Data-plane follow-ups & investigations (umbrella)

Smaller deferrals / follow-ups / things-to-investigate accumulated across the throughput pass, feedback+ARQ, and io_uring Phase A milestones. Each is bounded; none blocks current work. ## Correctness / robustness - [ ] **Wire-auth `object_id` binding** (M5/M6 carry-forward). `object_id` (u16) and `object_size` are attacker-forgeable on the wire; a forged `object_id` can LRU-evict a live object in the reassembler. Bind them to authenticated peer/epoch context. Also: u16 wraps every 65536 objects (currently unreachable within the bounded retx/reassembler windows, but relevant if rates rise or windows grow). - [ ] **Loss-detector partial-receive limitation** (documented in `lossdetect.rs`). The gap model reports fully-absent counters and, since PR #4, seen-but-undecoded counters too — but the seen-but-undecoded suppression (`resolved_set`) is *best-effort* under extreme reordering (evicted-far-above-watermark → a benign spurious NACK the sender drops). Exact for the single-symbol zero-repair case. Revisit if heavy-loss multi-symbol accuracy matters. - [ ] **Per-class loss denominator** is a conservative approximation (sent-log residency → biases the fraction high → over-repair, safe). An exact per-class windowed rate is hard (receiver knows window totals but not classes; sender knows classes but not the receiver's window). Only worth it if over-repair-under-loss becomes a measured cost. - [ ] **Deadline-based FEC eviction**: `FlowParams.deadline` is only partially honored (LRU-count eviction dominates). Honor per-class deadlines for reassembler eviction + ARQ eligibility. - [ ] **Bidirectional flow accounting**: the M5.5 classifier heuristic observes egress only. ## Performance / cleanup - [ ] **`drain_tun` `to_vec()` clone** (`yip-io/poll.rs`, Phase A): clones the egress scratch to drop the `&mut DataPlane` borrow before sending. Negligible now; a candidate to eliminate in the io_uring pass (#7) by splitting the borrow. - [ ] **AF_XDP backend**: still a stub. The second kernel-bypass I/O tier after io_uring (#7). ## Anti-DPI hooks still live in the data plane (feed sub-project #3) - [ ] Static 1-byte `PacketType` prefix (`Data=2`/`Control=3`/handshake) + fixed handshake prefixes — a DPI signature. Fold into keyed header-protection. - [ ] Static `conn_tag` = linkability signature — rotate per epoch (tied to rekey, #9). ## Broader roadmap (each a future sub-project, own design→build) - **Sub-project #2 — control plane:** decentralized discovery (DHT/gossip), self-certifying key-derived addresses, NAT hole-punching (rendezvous + UDP punch), relay fallback. yipd is currently two static hand-configured peers — this is "the real work" per CLAUDE.md. - **Sub-project #3 — anti-DPI/obfuscation:** the two anti-DPI items above + AmneziaWG recipe (junk/padding/jitter), optional REALITY TLS-mimicry, nDPI/nDPId wired into CI. - **Sub-project #4/#5:** DAITA/anonymity (Arti); hardening/multi-platform (macOS/Windows). ## Bench polish (optional) - [ ] ZeroTier + AmneziaWG bench contenders (named in the brief, not installed). - [ ] OpenVPN currently benched with TLS+AES-256-GCM (good); could add a UDP-under-loss column for WG/OpenVPN/n2n. - [ ] 1000-ping samples to tighten netem loss-rate variance.

vxfemboy commented

2026-07-01 13:10:37 +00:00

(Migrated from github.com)

Smaller deferrals / follow-ups / things-to-investigate accumulated across the throughput pass, feedback+ARQ, and io_uring Phase A milestones. Each is bounded; none blocks current work.

Correctness / robustness

Wire-auth object_id binding (M5/M6 carry-forward). object_id (u16) and object_size are attacker-forgeable on the wire; a forged object_id can LRU-evict a live object in the reassembler. Bind them to authenticated peer/epoch context. Also: u16 wraps every 65536 objects (currently unreachable within the bounded retx/reassembler windows, but relevant if rates rise or windows grow).
Loss-detector partial-receive limitation (documented in lossdetect.rs). The gap model reports fully-absent counters and, since PR #4, seen-but-undecoded counters too — but the seen-but-undecoded suppression (resolved_set) is best-effort under extreme reordering (evicted-far-above-watermark → a benign spurious NACK the sender drops). Exact for the single-symbol zero-repair case. Revisit if heavy-loss multi-symbol accuracy matters.
Per-class loss denominator is a conservative approximation (sent-log residency → biases the fraction high → over-repair, safe). An exact per-class windowed rate is hard (receiver knows window totals but not classes; sender knows classes but not the receiver's window). Only worth it if over-repair-under-loss becomes a measured cost.
Deadline-based FEC eviction: FlowParams.deadline is only partially honored (LRU-count eviction dominates). Honor per-class deadlines for reassembler eviction + ARQ eligibility.
Bidirectional flow accounting: the M5.5 classifier heuristic observes egress only.

Performance / cleanup

drain_tun to_vec() clone (yip-io/poll.rs, Phase A): clones the egress scratch to drop the &mut DataPlane borrow before sending. Negligible now; a candidate to eliminate in the io_uring pass (#7) by splitting the borrow.
AF_XDP backend: still a stub. The second kernel-bypass I/O tier after io_uring (#7).

Anti-DPI hooks still live in the data plane (feed sub-project #3)

Static 1-byte PacketType prefix (Data=2/Control=3/handshake) + fixed handshake prefixes — a DPI signature. Fold into keyed header-protection.
Static conn_tag = linkability signature — rotate per epoch (tied to rekey, #9).

Broader roadmap (each a future sub-project, own design→build)

Sub-project #2 — control plane: decentralized discovery (DHT/gossip), self-certifying key-derived addresses, NAT hole-punching (rendezvous + UDP punch), relay fallback. yipd is currently two static hand-configured peers — this is "the real work" per CLAUDE.md.
Sub-project #3 — anti-DPI/obfuscation: the two anti-DPI items above + AmneziaWG recipe (junk/padding/jitter), optional REALITY TLS-mimicry, nDPI/nDPId wired into CI.
Sub-project #4/#5: DAITA/anonymity (Arti); hardening/multi-platform (macOS/Windows).

Bench polish (optional)

ZeroTier + AmneziaWG bench contenders (named in the brief, not installed).
OpenVPN currently benched with TLS+AES-256-GCM (good); could add a UDP-under-loss column for WG/OpenVPN/n2n.
1000-ping samples to tighten netem loss-rate variance.

vxfemboy referenced this issue from a commit

2026-07-27 03:01:38 +00:00

docs(spec): peer_manager.rs module split design (#11, prereq for multi-core #10)

Merge pull request 'refactor(yipd): split peer_manager.rs into a module directory (#11)' (#119) from refactor/peer-manager-module-split into main

Rows
Columns

Data-plane follow-ups & investigations (umbrella) #11

Correctness / robustness

Performance / cleanup

Anti-DPI hooks still live in the data plane (feed sub-project #3)

Broader roadmap (each a future sub-project, own design→build)

Bench polish (optional)