fix30: очищены old-bash формулировки и уточнён class-id контракт

This commit is contained in:
2026-05-12 17:50:15 +05:00
parent b493c9df3b
commit bb37da72c0
5 changed files with 11 additions and 11 deletions
+5 -5
View File
@@ -24,7 +24,7 @@ It owns the infrastructure state needed by the VPN service:
- planned reboot;
- emergency swap setup.
It does not replace Amnezia. It controls the surrounding system state that the old bash package configured manually.
It does not replace Amnezia. It controls the surrounding host-side infrastructure state required by the Amnezia service.
## 2. Process model
@@ -123,7 +123,7 @@ struct PeerTrafficClass {
}
```
Class assignment must be deterministic. For strict parity with bash v1, peer IP strings must be sorted lexicographically, exactly like `sort -u` in the old script, then assigned `class_start_id + index`. Do not silently switch this to numeric IPv4 sorting in v1: the production snapshot maps `10.8.1.10` before `10.8.1.2` because bash sorted text, not numeric addresses.
Class assignment must be deterministic. Peer IP strings are sorted lexicographically, then assigned `class_start_id + index`. Do not silently switch this to numeric IPv4 sorting in v1: the production class-id contract maps `10.8.1.10` before `10.8.1.2` because sorting is textual, not numeric.
## 5. Namespace strategy
@@ -141,7 +141,7 @@ Implementation options:
`docker exec` should not be the architectural default. It can remain as compatibility fallback if `nsenter`/host tools are unavailable, but the design assumption is that the Rust binary has host authority and controls the relevant namespace.
This also reduces the risk noted in the old docs: if the Amnezia container drops `tc` or `iproute2`, host-side tools can still apply rules inside the container netns.
This also reduces operational risk: if the Amnezia container drops `tc` or `iproute2`, host-side tools can still apply rules inside the container netns.
## 6. Discovery flow
@@ -174,7 +174,7 @@ Parsing rules:
- parse lines structurally into peer public key and allowed IPs;
- keep IPv4 `/32` addresses within `amnezia.peer_ipv4_cidr`;
- include offline peers; online state is not a requirement for shaping;
- sort peer IP strings lexicographically before class assignment to preserve old bash `sort -u` parity.
- sort peer IP strings lexicographically before class assignment to preserve the v1 lexicographic class-id contract.
Fallback:
@@ -192,7 +192,7 @@ Execution policy for production:
## 8. Desired traffic topology
The expected topology exactly mirrors old bash.
The expected topology is the v1 AWG2 traffic topology.
Egress: