Aleksandr Bogomiakov
2b0c938487
A long-running rc.33 daemon reached OOM with roughly 22 GiB resident and 24 GiB swapped. Live inspection found 40 GiB and 10/20 GiB anonymous container mappings; the active worker stack and tracing metadata identified iroh's scheduled path-open retry loop. In iroh 1.2.0 every failed connection requeues the same path, while each retry visits every connection again. Separate control and data connections multiply the queue geometrically. Vendor the published iroh 1.2.0 source and select it with a workspace Cargo patch. Deduplicate retry admission and cap distinct pending paths at 64, evicting the oldest before inserting a new candidate. Keep the current and next retry batches bounded without combining control/data connections or changing wire protocols, identity derivation, authentication or state. Document source provenance, the live evidence and removal conditions. Upstream PR 4551 merged on October 6, but inspection of the official 1.3.0 crate still shows the unconditional enqueue, so that upgrade alone is not a fix. No version bump, release tag or installed-service change. The default workspace suite includes the exact vendored admission module. Three regressions failed with the original enqueue and pass with the fix: repeated failures across connections, duplicate admission at capacity, and 10,000 distinct candidates with bounded length/capacity and FIFO eviction. Transport integration tests continue using real endpoints and encryption. Checks on Linux in nix develop: - cargo fmt --all -- --check - cargo clippy --locked --workspace --all-targets -- -D warnings - cargo test --locked --workspace --all-targets, with only the inherited TSUNAGI_CONTROL_SOCKET removed from the test environment - git diff --cached --check Initial full-suite runs failed six DNS readiness checks because the inherited system socket path overrode their temporary state directories. Clearing that environment variable resolves those failures without changing application code. Root/network-dependent ignored tests and other operating systems were not run.
257 lines
7.7 KiB
TOML
257 lines
7.7 KiB
TOML
[package]
|
|
name = "iroh"
|
|
version = "1.2.0"
|
|
edition = "2024"
|
|
readme = "README.md"
|
|
description = "p2p quic connections dialed by public key"
|
|
license = "MIT OR Apache-2.0"
|
|
authors = ["dignifiedquire <me@dignifiedquire.com>", "n0 team"]
|
|
repository = "https://github.com/n0-computer/iroh"
|
|
keywords = ["quic", "networking", "holepunching", "p2p"]
|
|
|
|
# Sadly this also needs to be updated in .github/workflows/ci.yml
|
|
rust-version = "1.91"
|
|
|
|
[lib]
|
|
# We need "cdylib" to actually generate .wasm files when we run with --target=wasm32-unknown-unknown.
|
|
# It would be nice if we could make this target-dependent, but we can't (yet): https://github.com/rust-lang/cargo/issues/12260
|
|
crate-type = ["lib", "cdylib"]
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
backon = { version = "1.4" }
|
|
blake3 = { version = "1.8.3", default-features = false }
|
|
bytes = "1.11"
|
|
ctutils = { version = "0.4.0", default-features = false }
|
|
data-encoding = "2.2"
|
|
|
|
derive_more = { version = "2.0.1", features = ["debug", "display", "from", "try_into", "deref", "from_str", "into_iterator"] }
|
|
ed25519-dalek = { version = ">=3.0.0-rc.0,<4.0.0", features = ["serde", "rand_core", "zeroize", "pkcs8", "pem"] }
|
|
http = "1"
|
|
ipnet = "2"
|
|
iroh-base = { version = "1.2.0", default-features = false, features = ["key", "relay"], path = "../iroh-base" }
|
|
iroh-dns = { version = "1.3.0", path = "../iroh-dns" }
|
|
iroh-relay = { version = "1.2.0", path = "../iroh-relay", default-features = false }
|
|
n0-future = "0.3"
|
|
n0-error = "1.0.0"
|
|
n0-watcher = "1.0.0"
|
|
netwatch = "0.19.3"
|
|
papaya = { version = "0.2.3", default-features = false }
|
|
pin-project = "1"
|
|
portable-atomic = "1"
|
|
noq = { version = "1.3.0", default-features = false, features = ["rustls"] }
|
|
noq-proto = { version = "1.3.0", default-features = false }
|
|
noq-udp = { version = "1.3.0", default-features = false }
|
|
rand = "0.10"
|
|
reqwest = { version = "0.13", default-features = false, features = ["rustls-no-provider", "stream"] }
|
|
rustc-hash = "2"
|
|
rustls = { version = "0.23.33", default-features = false }
|
|
serde = { version = "1.0.219", features = ["derive", "rc"] }
|
|
simple-dns = { version = "0.12", optional = true }
|
|
smallvec = "1.11.1"
|
|
strum = { version = "0.28", features = ["derive"] }
|
|
tokio = { version = "1.44.1", features = [
|
|
"io-util",
|
|
"macros",
|
|
"sync",
|
|
"rt",
|
|
] }
|
|
tokio-stream = { version = "0.1.15", features = ["sync"] }
|
|
tokio-util = { version = "0.7", features = ["io-util", "io", "rt"] }
|
|
tracing = "0.1"
|
|
url = { version = "2.5", features = ["serde"] }
|
|
webpki_types = { package = "rustls-pki-types", version = "1.12" }
|
|
|
|
# metrics
|
|
iroh-metrics = { version = "1.0.1", default-features = false }
|
|
|
|
futures-util = "0.3"
|
|
|
|
# test_utils
|
|
axum = { version = "0.8", optional = true }
|
|
|
|
# non-wasm-in-browser dependencies
|
|
[target.'cfg(not(all(target_family = "wasm", target_os = "unknown")))'.dependencies]
|
|
portmapper = { version = "0.19.3", optional = true, default-features = false }
|
|
noq = { version = "1.3.0", default-features = false, features = ["runtime-tokio", "rustls"] }
|
|
tokio = { version = "1", features = [
|
|
"io-util",
|
|
"macros",
|
|
"sync",
|
|
"rt",
|
|
"net",
|
|
"fs",
|
|
"io-std",
|
|
] }
|
|
|
|
# wasm-in-browser dependencies
|
|
[target.'cfg(all(target_family = "wasm", target_os = "unknown"))'.dependencies]
|
|
wasm-bindgen-futures = "0.4"
|
|
# we don't use time directly, but need to enable it because x509_parser uses these in browsers and we need to enable some feature flags for that to work
|
|
time = { version = "0.3", features = ["wasm-bindgen"] }
|
|
getrandom = { version = "0.4", features = ["wasm_js"] }
|
|
|
|
# target-common test/dev dependencies
|
|
[dev-dependencies]
|
|
console_error_panic_hook = "0.1"
|
|
n0-error = { version = "1.0.0", features = ["anyhow"] }
|
|
postcard = { version = "1.1.1", features = ["use-std"] }
|
|
tracing-subscriber = { version = "0.3", features = ["env-filter"] }
|
|
rand_chacha = "0.10"
|
|
chrono = "0.4.43"
|
|
simple-dns = "0.12"
|
|
|
|
# *non*-wasm-in-browser test/dev dependencies
|
|
[target.'cfg(not(all(target_family = "wasm", target_os = "unknown")))'.dev-dependencies]
|
|
assert_matches = "1.5.0"
|
|
axum = { version = "0.8" }
|
|
pretty_assertions = "1.4"
|
|
rand_chacha = "0.10"
|
|
tokio = { version = "1", features = [
|
|
"io-util",
|
|
"sync",
|
|
"rt",
|
|
"rt-multi-thread",
|
|
"net",
|
|
"fs",
|
|
"macros",
|
|
"time",
|
|
"test-util",
|
|
] }
|
|
serde_json = "1"
|
|
iroh-relay = { version = "1.2.0", path = "../iroh-relay", default-features = false, features = ["test-utils", "server"] }
|
|
n0-tracing-test = "0.3"
|
|
clap = { version = "4", features = ["derive"] }
|
|
tracing-subscriber = { version = "0.3", features = [
|
|
"env-filter",
|
|
] }
|
|
indicatif = { version = "0.18", features = ["tokio"] }
|
|
parse-size = { version = "1.1.0", features = ['std'] }
|
|
iroh-base = { version = "1.2.0", default-features = false, features = ["key", "relay"], path = "../iroh-base" }
|
|
console = { version = "0.16" }
|
|
|
|
# wasm-in-browser test/dev dependencies
|
|
[target.'cfg(all(target_family = "wasm", target_os = "unknown"))'.dev-dependencies]
|
|
wasm-tracing = "2.1.0"
|
|
wasm-bindgen-test = "0.3.62"
|
|
|
|
# patchbay netsim test dependencies (linux only)
|
|
[target.'cfg(target_os = "linux")'.dev-dependencies]
|
|
ctor = "1.0"
|
|
patchbay = { version = "0.7", features = ["iroh-metrics"] }
|
|
testdir = "0.10"
|
|
|
|
[build-dependencies]
|
|
cfg_aliases = { version = "0.2.2" }
|
|
|
|
[features]
|
|
default = ["metrics", "fast-apple-datapath", "portmapper", "tls-ring"]
|
|
portmapper = ["dep:portmapper"]
|
|
metrics = ["iroh-metrics/metrics", "iroh-relay/metrics"]
|
|
test-utils = ["iroh-relay/test-utils", "iroh-relay/server", "dep:axum", "dep:simple-dns"]
|
|
# Enables fetching TLS trust anchors from the operating system
|
|
platform-verifier = ["iroh-relay/platform-verifier"]
|
|
qlog = ["noq/qlog"]
|
|
# Use private Apple APIs to send multiple packets in a single syscall.
|
|
fast-apple-datapath = ["noq/fast-apple-datapath"]
|
|
# Use ring as the crypto backend.
|
|
tls-ring = ["noq/ring", "iroh-relay/tls-ring", "iroh-dns/tls-ring"]
|
|
# Use aws-lc-rs as the crypto backend, unless `ring` is also enabled.
|
|
tls-aws-lc-rs = ["noq/aws-lc-rs", "iroh-relay/tls-aws-lc-rs", "iroh-dns/tls-aws-lc-rs"]
|
|
# Unstable: Custom transport API (may change without notice)
|
|
unstable-custom-transports = []
|
|
# Unstable: API to access an endpoint's NetReport (may change without notice)
|
|
unstable-net-report = []
|
|
|
|
[package.metadata.docs.rs]
|
|
all-features = true
|
|
rustdoc-args = ["--cfg", "iroh_docsrs"]
|
|
|
|
[package.metadata.cargo_check_external_types]
|
|
allowed_external_types = [
|
|
# workspace crates
|
|
"iroh_base::*",
|
|
"iroh_dns::*",
|
|
"iroh_relay::*",
|
|
# crates owned by us that will move to 1.0 as well
|
|
"iroh_metrics::*",
|
|
"n0_error::*",
|
|
"n0_watcher::*",
|
|
"noq::*",
|
|
"noq_proto::*",
|
|
"noq_udp::*",
|
|
# 1.0 crates that we deem fine to be part of the public API
|
|
"bytes::*",
|
|
"http::*",
|
|
"serde_core::*",
|
|
"tokio::*",
|
|
"url::*",
|
|
# non-1.0 crates that we decided to accept in the public API
|
|
"rustls::*",
|
|
"futures_core::stream::Stream",
|
|
# only type alias
|
|
"futures_lite::stream::Boxed",
|
|
]
|
|
|
|
[[test]]
|
|
name = "integration"
|
|
path = "tests/integration.rs"
|
|
|
|
[[example]]
|
|
name = "listen"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "connect"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "custom-transport"
|
|
required-features = ["test-utils", "unstable-custom-transports"]
|
|
|
|
[[example]]
|
|
name = "listen-unreliable"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "connect-unreliable"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "search"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "echo"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "echo-no-router"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "transfer"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "0rtt"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "incoming-filter"
|
|
required-features = []
|
|
|
|
[[example]]
|
|
name = "pq-only-key-exchange"
|
|
required-features = ["tls-aws-lc-rs"]
|
|
|
|
[[example]]
|
|
name = "prefer-pq-key-exchange"
|
|
required-features = ["tls-aws-lc-rs"]
|
|
|
|
[[example]]
|
|
name = "home-relay-status"
|
|
required-features = []
|