mirror of
https://github.com/openziti/ziti.git
synced 2026-09-10 16:55:41 +00:00
Paul Lorenz
647c4daa1e
The controller decided which of two racing connections for a router was current by comparing router instances, but loaded one per connect by evicting the router cache and reading back through it. Two connects could both evict, and whichever read second was handed the instance the first had just published. A shared instance makes the two connections indistinguishable: the connect path cannot reject the second into an occupied slot, and when either channel dies the disconnect path finds itself current and tears down the registration the other is still using. The surviving channel is never re-bound, so the router stays connected at the transport layer while absent from the model, unable to recover. Connect and disconnect were also unserialized, so a stale or superseded disconnect could interleave with a live connection and take its links with it. - serializes a router's connect and disconnect with a per-router striped lock - keeps at most one connection per router: a connect into an occupied slot is rejected via an error from ConnectRouter, so the bind fails and NewChannel closes it without starting rx or registering it, and the occupant is displaced; the router redials into the freed slot - displaces an occupant by closing its channel and also invoking the teardown directly, since a channel that is already closed never fires its close handler again; without this a dead but still registered connection holds the slot forever and every redial is rejected against a slot nothing can free - refuses a connect whose control channel is already closed rather than registering it, so a connection no disconnect could ever remove is never published - gives every connection its own router instance via RouterManager.NewCtrlChanRouter, read through readUncached so the cache neither supplies nor receives it, which is what makes comparing instances meaningful - moves recording the channel and connect time out of the accept path, so a caller cannot attach the wrong channel or forget to attach one - serializes link publication with that teardown on the same per-router stripe. Validating currency and then publishing without it is a check-then-act: a report can find the connection current and, by the time it reaches the link manager, the teardown has already snapshotted and cleared the router's links, so the link is recreated after everything that would have removed it. It is then absent from the router's own index while still in the link table with a disconnected source, and a reconnect reporting the same iteration can adopt that stale source instead of rebuilding the link - guards the entire DisconnectRouter teardown by connection currency, all or nothing, and clears the connected flag and link index only when the registration was actually given up, with the flag cleared under the same shard lock as the map removal so the two cannot be observed disagreeing; the connected flag decides whether the controller accepts a router's link reports, so clearing it for the wrong connection silences a router that is up and reporting - reduces MarkConnected to publishing the connection; the takeover-close moves into ConnectRouter's reject path - makes the per-router unlock idempotent so callers can defer it as a leak-safety net and still unlock early before closing a channel outside the lock - stops the replaced RouterSender in routerTxMap.Add so a takeover does not leak the old sender's goroutine when the broker's asynchronous RouterDisconnected loses the race to the redial's RouterConnected - discards pending peer state changes for a router whose channel has closed, since sending on one fails immediately and the failed send is retried as soon as the event loop turns, spinning the loop and flooding the log - queues the peer-state send-done event on every path, so a missing channel can no longer leave sendInProgress set and stall that router's updates permanently - resolves a router's version from its connected instance when validating link conn info, since the version arrives in the hello and so is absent from an instance loaded from the database - normalizes both endpoints to the connected instance in shortestPath, which is keyed and compared by pointer and so treated an endpoint held as any other instance of the same router as absent from the graph, reporting a router as unroutable from itself. That worked before only because the connect path published its instance into the router cache, so a cache read and the connected map returned the same object; nothing stated the requirement - configures test logging once per package in TestMain, so a test no longer writes global logger state while a previous test's shutdown logging reads it