glm-5.3-flash
63dbdb64a5
- DatagramReader::feed is infallible (the oversize bound is enforced at frame time; the same zombie category as 4014ba6's InvalidLength). The Vec<Result> shape, the local adapter's dead InvalidData mapping, and consumer.rs's `?` drop. - The sender-block machinery test (root-gated veth fixture, auto-skip without root): the peer address unassigned + the neighbor table flushed pins the connected sender in a persistent WouldBlock/ENOBUFS state; the test drives the WouldBlock stash, the readiness-Pending arms, AND the accepted-byte high-water Pend in one behavior, then resolves (addr assign + peer bind) and asserts the queued datagrams drain and deliver. Jumbo MTU (65535) keeps IP fragmentation out of the way; the block-state probe runs on a throwaway socket (an oversized probe's partially-built skb chain stays corked on EAGAIN and poisons the socket). - pump_queue_to_socket's stash arm now matches ENOBUFS(105) alongside WouldBlock — the blocked-neighbor state reports 105, and both mean "the socket cannot take this datagram now". - connect_udp's resolve-failure arm covered (an RFC 6761 .invalid target maps to dial_failed; rootless). - The no-witness tunnel_establisher wrapper covered (a harness DialNoWitness mode + a full open round-trip through the wrapper). Negative result pinned in the task doc: tokio 1.53 structurally masks UDP ICMP errors out of the poll drive (poll_recv_ready/try_io mask ERROR out of the read direction), so the recv-side ECONNREFUSED mapping arm is unreachable through the pump's drive — it joins the defensive list. Coverage: 92.86% -> 93.91% lines (50 -> 41 uncovered, all deliberate). Verification: cargo test + cargo test --all-features (91 tests), clippy --all-targets --all-features, fmt, wasm32 check+clippy, cargo doc — all clean.
alktunnels
Arbitrary bidirectional tunnels over alkcall
channels: TCP, UDP, unix sockets, and other stream or datagram
substrates — in the ssh -L / ssh -D / ssh -R sense, without SSH.
A producer/consumer protocol crate riding alkcall channels the same
way alktty does (alk/tty is the
sibling precedent): the producer half registers the alk/tunnel open
op and pumps bytes between the channel and the substrate; the consumer
half is the typed session (TunnelSession) that opens tunnel channels
and owns teardown.
A tunnel is a resource, not an address
Open-op params identify a produced resource + substrate:
{ "resource": "postgres-primary", "substrate": "tcp" }
The producer owns the backing — the consumer never learns an address.
Rich addressing (SOCKS5 ATYP, per-datagram remotes) enters only
through the -D/dynamic composition path, inside the tunnel payload,
never in the wire (ADR-001).
- Wire format:
docs/architecture/wire.md(+ the BAST document atdocs/architecture/bast.md) - Open-op params: ADR-001; codec: ADR-003; ALPN: ADR-002
- Producer shapes: ADR-004; consumer session: ADR-005; ACL: ADR-006
- The full spec set:
docs/architecture/(overview, wire, producer, consumer, six ADRs, OQ tracker)
Status
v0.1.0 — the v1 protocol implementation, Phase-2 complete (spec:
docs/architecture/; reviews: docs/reviews/). The wire surface
(params, ALPN, codec) is one-way-door stable from this point; the
API surface becomes ABI-stable at the first external consumer.
Features
| Feature | Contents | wasm |
|---|---|---|
| (default) | params, wire codec, open-op spec, establisher shapes, TunnelSession — protocol only |
yes |
local |
TCP/UDP/unix dial + listen helpers (real sockets) | no |
Verification
cargo test # default crate (wasm-clean)
cargo test --features local # + real-socket suites
cargo clippy --all-targets -- -D warnings
cargo fmt --check
cargo check --target wasm32-unknown-unknown # the wasm-clean guard
License
MIT OR Apache-2.0