From bb37da72c0ec3567563f5c072f62a0c688dda4d2 Mon Sep 17 00:00:00 2001 From: Crimson Date: Tue, 12 May 2026 17:50:15 +0500 Subject: [PATCH] =?UTF-8?q?fix30:=20=D0=BE=D1=87=D0=B8=D1=89=D0=B5=D0=BD?= =?UTF-8?q?=D1=8B=20old-bash=20=D1=84=D0=BE=D1=80=D0=BC=D1=83=D0=BB=D0=B8?= =?UTF-8?q?=D1=80=D0=BE=D0=B2=D0=BA=D0=B8=20=D0=B8=20=D1=83=D1=82=D0=BE?= =?UTF-8?q?=D1=87=D0=BD=D1=91=D0=BD=20class-id=20=D0=BA=D0=BE=D0=BD=D1=82?= =?UTF-8?q?=D1=80=D0=B0=D0=BA=D1=82?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- docs/ACCEPTANCE_CHECKLIST.md | 2 +- docs/CONFIGURATION.md | 6 +++--- docs/IMPLEMENTATION_SPEC.md | 10 +++++----- tools/README.md | 2 +- traffic_core/src/wg.rs | 2 +- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/docs/ACCEPTANCE_CHECKLIST.md b/docs/ACCEPTANCE_CHECKLIST.md index 8bbcff2..c82fbef 100644 --- a/docs/ACCEPTANCE_CHECKLIST.md +++ b/docs/ACCEPTANCE_CHECKLIST.md @@ -21,7 +21,7 @@ - [ ] Offline peers с allowed IP тоже попадают в список shaping. - [ ] IP вне `amnezia.peer_ipv4_cidr` не попадают в traffic shaping. -## C. Traffic topology parity with old bash +## C. Traffic topology contract - [ ] `awg2-harness apply-limits` успешно завершается. - [ ] На AWG/WG-интерфейсе есть root qdisc `1: htb`. diff --git a/docs/CONFIGURATION.md b/docs/CONFIGURATION.md index 022acd8..4ee6e23 100644 --- a/docs/CONFIGURATION.md +++ b/docs/CONFIGURATION.md @@ -55,11 +55,11 @@ swappiness = 1 `amnezia.interface_patterns` — fallback-паттерны для устойчивости к обновлениям Amnezia. Старые материалы прямо отмечают риск переименования интерфейса между `awg0`, `wg0`, `amnezia0`. -`amnezia.peer_ipv4_cidr` — подсеть VPN peers. Сейчас старая bash-система жёстко ищет `10.8.1.x`; в Rust это должно быть конфигурируемо. +`amnezia.peer_ipv4_cidr` — подсеть VPN peers. Production default — `10.8.1.0/24`; значение конфигурируемое. `traffic.peer_limit` — per-peer лимит в обе стороны. Текущий production default — `50mbit`. -`traffic.root_rate` — верхний HTB-класс, в текущем production default — `500mbit`. Историческое значение old bash — `1000mbit`. +`traffic.root_rate` — верхний HTB-класс, в текущем production default — `500mbit`. `traffic.reconcile_interval_secs` — период фоновой проверки. Он нужен не вместо Docker events, а вместе с ними. @@ -71,7 +71,7 @@ swappiness = 1 При drift orchestrator всегда делает controlled rebuild owned topology. -`anti_torrent.enabled` — включает nftables connection-count guard против high-peer-count P2P-нагрузки. Это новое расширение, не часть old bash. +`anti_torrent.enabled` — включает nftables connection-count guard против high-peer-count P2P-нагрузки. Это отдельный AWG2 Harness module и часть текущего production-контракта. `host_firewall.enabled` — включает host-level INPUT firewall в отдельной AWG2-owned таблице `inet awg2_host_firewall`. diff --git a/docs/IMPLEMENTATION_SPEC.md b/docs/IMPLEMENTATION_SPEC.md index c9bffd9..f60ba86 100644 --- a/docs/IMPLEMENTATION_SPEC.md +++ b/docs/IMPLEMENTATION_SPEC.md @@ -24,7 +24,7 @@ It owns the infrastructure state needed by the VPN service: - planned reboot; - emergency swap setup. -It does not replace Amnezia. It controls the surrounding system state that the old bash package configured manually. +It does not replace Amnezia. It controls the surrounding host-side infrastructure state required by the Amnezia service. ## 2. Process model @@ -123,7 +123,7 @@ struct PeerTrafficClass { } ``` -Class assignment must be deterministic. For strict parity with bash v1, peer IP strings must be sorted lexicographically, exactly like `sort -u` in the old script, then assigned `class_start_id + index`. Do not silently switch this to numeric IPv4 sorting in v1: the production snapshot maps `10.8.1.10` before `10.8.1.2` because bash sorted text, not numeric addresses. +Class assignment must be deterministic. Peer IP strings are sorted lexicographically, then assigned `class_start_id + index`. Do not silently switch this to numeric IPv4 sorting in v1: the production class-id contract maps `10.8.1.10` before `10.8.1.2` because sorting is textual, not numeric. ## 5. Namespace strategy @@ -141,7 +141,7 @@ Implementation options: `docker exec` should not be the architectural default. It can remain as compatibility fallback if `nsenter`/host tools are unavailable, but the design assumption is that the Rust binary has host authority and controls the relevant namespace. -This also reduces the risk noted in the old docs: if the Amnezia container drops `tc` or `iproute2`, host-side tools can still apply rules inside the container netns. +This also reduces operational risk: if the Amnezia container drops `tc` or `iproute2`, host-side tools can still apply rules inside the container netns. ## 6. Discovery flow @@ -174,7 +174,7 @@ Parsing rules: - parse lines structurally into peer public key and allowed IPs; - keep IPv4 `/32` addresses within `amnezia.peer_ipv4_cidr`; - include offline peers; online state is not a requirement for shaping; -- sort peer IP strings lexicographically before class assignment to preserve old bash `sort -u` parity. +- sort peer IP strings lexicographically before class assignment to preserve the v1 lexicographic class-id contract. Fallback: @@ -192,7 +192,7 @@ Execution policy for production: ## 8. Desired traffic topology -The expected topology exactly mirrors old bash. +The expected topology is the v1 AWG2 traffic topology. Egress: diff --git a/tools/README.md b/tools/README.md index 51ab8e7..3326320 100644 --- a/tools/README.md +++ b/tools/README.md @@ -14,7 +14,7 @@ reboot_module -> awg2-reboot-scheduler ## Поддерживаемая build-среда - Debian 13 с `apt`. -- amd64/x86_64. +- Debian package architecture: amd64. - Rust toolchain из `rust-toolchain.toml` (`1.95.0` в текущем дереве). - `Cargo.lock` обязателен: build gate работает в `--locked` режиме. diff --git a/traffic_core/src/wg.rs b/traffic_core/src/wg.rs index 02565ba..0070b40 100644 --- a/traffic_core/src/wg.rs +++ b/traffic_core/src/wg.rs @@ -272,7 +272,7 @@ mod tests { } #[test] - fn lexicographic_sorting_parity() { + fn lexicographic_sorting_preserves_class_id_contract() { let raw = "wg0 key1 10.8.1.2/32\nwg0 key2 10.8.1.10/32"; let mut peers = parse_allowed_ips(raw, "10.8.1.0/24").expect("parse"); peers.sort_by_key(|p| p.ipv4.to_string());