cameri / nostream / 41202358734

78%

main: 78%

push

github

fix(config): reject a zero frame-memory budget or per-IP cap (#996) (#997)

* feat(relay): bound the total queued frames and the sockets one address may hold (#959)

The outbound queue was bounded per socket and their sum was bounded by nothing: one
address could hold 8 MiB for every socket it kept, and a closed socket's queued bytes
were never given back. Every socket now counts its queued payload against one
process-wide FrameBudget (256 MiB, RelayConfig::frame_memory_budget_bytes), refunded
when the socket's last sink handle drops, and one address may hold at most
max_connections_per_ip live sockets (64) as a gauge beside the attempt limiter. Both
refuse with an immediate 1013 close, a fixed reason and their own counter.

See docs/rewrite/decisions/0008-frame-memory-budget.md and #959.

* docs(rewrite): record the frame-memory budget and the per-IP cap (ADR 0008)

Both numbers are deviations from the capture, with their arithmetic, the rejected
accept-time shape, the refund on the last handle's Drop, and what an operator can see
today (#959).

* docs(relay): name the two new knobs where RelayConfig's list is, and the budget in the sink doc

The RelayConfig doc enumerates the port-only policies, so it has to name all four;
the sink's module doc is where a reader learns what the sum is bounded by.

* docs(rewrite): correct ADR 0008's line citations to the final tree

* fix(relay): wake the connection loop on a refusal, and encode only frames it can queue

Three static-review findings on the frame-memory budget, in one commit because they meet
in FrameSink::send:

- A refusal recorded a flag but woke nothing. A shared-budget refusal can arrive while
  this socket's own queue is empty, the socket idle and its read parked, so the 1013
  waited for the next liveness tick instead of being immediate. The first refusal now
  signals a tokio::Notify the account owns, and the connection loop selects on
  FrameSink::refused(); notify_one stores a permit, so a ... (continued)

3587 of 5362 branches covered (66.9%)

Branch coverage included in aggregate %.

7992 of 10291 relevant lines covered (77.66%)

867.79 hits per line