feat(ipsec-xfrm): supervise cancellation-safe single-object installs#513
Merged
Conversation
…409) Add XfrmStagedObjectInstall, the single-object counterpart of the composite staged install, for exact SA-only and policy-only installs that cannot use the SA-plus-policy composite: an SA that intentionally reuses an existing shared policy, or an additional policy direction for one SA. The typed XfrmObjectInstallRequest supervises one backend operation without inventing a dummy companion mutation and preserves the staged boundary properties: affine one-run execution with a caller-retained XfrmObjectInstallJournal, an owned Tokio worker after first poll, explicit issued, acknowledged, rejected, indeterminate, committed, recovered, and supervision-lost ownership states, and generation-bound classified recovery of the exact retained removal candidate under caller-held writer exclusion. An observed AlreadyExists rejection authorizes no removal of the pre-existing object, and runtime or worker loss permanently disables in-process commit and recovery. Signed-off-by: VerifiedOrganic <verifiedorganic@sent.com>
) Assert the staged single-object removal identity preserves the Linux XFRM lookup mark for SA-only and policy-only installs, byte-exact against the expected removal request end to end through classified recovery. Exercise run and recover first polled outside a Tokio runtime: both return the typed RuntimeUnavailable error and leave the journal unpoisoned, with plan generation and ownership provably unchanged. Signed-off-by: VerifiedOrganic <verifiedorganic@sent.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #409. Generalizes the #403 staged journal so single-object XFRM installs — SA-only (reusing a shared policy) and policy-only (an additional direction for one SA) — get the same cancellation-safe ownership supervision as the SA+policy composite, without inventing dummy companion mutations.
XfrmStagedObjectInstall: affine one-run staged value; on first poll spawns an owned Tokio worker, so dropping the caller's future at any await leaves the worker and claim live until the backend result is observed. Dropping an unpolled install performs no mutation (compile-fail doctest proves one-run affinity).XfrmObjectInstallJournal(caller-cloned):NotStarted / InstallInFlight / Acquired / Recovering / Recovered / Committed / Indeterminate{op} / SupervisionLost{op}. Worker panic or runtime loss flipsSupervisionLostand permanently blocks in-process commit/recovery — later quiescence of the detached mutation cannot forge supervised completion.AlreadyExists— observed or unobserved-then-rejected — clears the candidate, so a pre-existing object is never authorized for deletion.Owned;AbsentandForeignretire without any backend mutation; the classification goes stale on any journal state change (Arcgeneration rotation, ABA-immune);StateIndeterminaterequires explicit classified readback first. Dropping a recovery observer keeps the claim while removal is live; concurrent recovery attempts converge to exactly one backend call.Fully additive: no changes to
staged.rsor any existing API.Testing
26 new tests (281 crate total) with gated fake backends covering every acceptance bullet: unpolled-drop no-mutation, dropped-observer worker liveness, AlreadyExists non-removal (observed + unobserved), commit of acknowledged acquisition, classified-readback gating, exact-Owned-only removal, Absent/Foreign non-deletion, dropped-recovery claim retention, panicked-worker and runtime-shutdown supervision loss (install AND recovery), mark-carrying identity derivation, runtime-free typed failures, and full redaction.
Review
Two-lane adversarial review, both SHIP: