mirror of
https://github.com/permissionlesstech/bitchat.git
synced 2026-07-25 02:05:19 +00:00
* Fix restore-path main↔bleQueue deadlock and courier drop amplification A device froze permanently in a two-phone test. Debugger stacks showed an ABBA deadlock: the main actor was in bleQueue.sync (delivery-ack send → broadcastPacket → readLinkState) while bleQueue was in main.sync (captureBluetoothStatus reading backgroundTimeRemaining). The load that lined the two edges up came from a courier-drop amplification storm: drop dedup was in-memory only while the outbox driving 120s re-deposits is persisted, so every relaunch republished the same undelivered DM as a fresh 24h relay drop and every gateway relaunch re-fetched the whole backlog — ~20 copies of one DM delivered in 40ms, each triggering decrypt + delivery + ack + handshake work. Fixes, in rank order: - Edge B (P0): captureBluetoothStatus no longer main.syncs from bleQueue; backgroundTimeRemaining is sampled on main and cached behind a lock. Invariant documented: bleQueue must NEVER sync-dispatch to main. - Edge A (P0, defense in depth): sendDeliveryAck / sendReadReceipt / sendPrivateMessage / sendNoisePayload / triggerHandshake hop to messageQueue like sendMessage, so no main-actor call path reaches readLinkState's bleQueue.sync. - Drop dedup (P1): publishedDropKeys and seenDropEventIDs persist across relaunches (new BridgeDropDedupStore, entries expire with the 24h NIP-40 drop window; wiped on panic) — one drop per message ID per 24h regardless of relaunch count. - Receiver dedup (P1): openCourierEnvelope dedups on the inner private message ID before delivery, so a duplicate copy costs one decrypt and never re-delivers, re-acks, or re-triggers a handshake. - Handshake gating (P2): queued acks initiate a Noise handshake only for reachable peers; mail from absent/rotated identities no longer turns each copy into a mesh-wide handshake flood (the ack stays queued and flushes when a session eventually establishes). - Outbox (P3): re-enqueueing a queued message ID carries over its depositedCourierKeys so resends stop re-burning the same courier slots. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Review fixes: offline-drop durability, gateway handoff retry, restore-log freshness, coalesced persist Adversarial review of the storm/deadlock PR surfaced four issues: - Offline blackhole (must-fix): a deposit made while relays were down persisted its dedup key even though the drop only sat in the in-memory pending queue — app killed before reconnect meant the relaunch lost the drop but the persisted key blocked every re-deposit for 24h. The persisted snapshot now excludes keys still pending; they become durable only when flushPendingDrops actually publishes them. - Gateway handoff: seen-event IDs were consumed before the deliverToPeer handoff; a failed handoff (peer walked away) permanently dropped the event for a single-gateway island. deliverToPeer now reports whether the handoff was attempted, and a failure releases the seen slot so a relaunch or backlog redelivery retries. - Restore-path logs: central/peripheral-restore captures logged the init sentinel bgRemaining=∞. The cache is now seeded in init's main-thread branch and restore captures route through the sampler, which refreshes the cached budget before logging. - Persist cost: the dedup record was a full JSON encode + atomic write on the main actor per mutation (once per event during a backlog re-fetch). Writes now coalesce behind a 1s window, flushed immediately on background/terminate; panic wipe stays immediate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Remove BoundedIDSet.remove, orphaned by the ExpiringIDSet migration The drop-dedup sets that needed slot release moved to ExpiringIDSet; remaining BoundedIDSet users only insert and check. Periphery caught it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: jack <jackjackbits@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
119 lines
4.0 KiB
Swift
119 lines
4.0 KiB
Swift
//
|
|
// BridgeDropDedupStoreTests.swift
|
|
// bitchat
|
|
//
|
|
// This is free and unencumbered software released into the public domain.
|
|
// For more information, see <https://unlicense.org>
|
|
//
|
|
|
|
import Foundation
|
|
import Testing
|
|
@testable import bitchat
|
|
|
|
@Suite("Bridge drop dedup persistence")
|
|
struct BridgeDropDedupStoreTests {
|
|
|
|
// MARK: - ExpiringIDSet
|
|
|
|
@Test func entriesExpireAfterLifetime() {
|
|
let start = Date(timeIntervalSince1970: 1_700_000_000)
|
|
var set = ExpiringIDSet(capacity: 8, lifetime: 60)
|
|
|
|
let inserted = set.insert("a", now: start)
|
|
#expect(inserted)
|
|
#expect(set.contains("a", now: start))
|
|
let duplicate = set.insert("a", now: start.addingTimeInterval(30))
|
|
#expect(!duplicate)
|
|
|
|
// Past the lifetime the slot is free again.
|
|
let later = start.addingTimeInterval(61)
|
|
#expect(!set.contains("a", now: later))
|
|
let reinserted = set.insert("a", now: later)
|
|
#expect(reinserted)
|
|
}
|
|
|
|
@Test func capacityEvictsOldestFirst() {
|
|
let start = Date(timeIntervalSince1970: 1_700_000_000)
|
|
var set = ExpiringIDSet(capacity: 2, lifetime: 3600)
|
|
|
|
set.insert("oldest", now: start)
|
|
set.insert("middle", now: start.addingTimeInterval(1))
|
|
set.insert("newest", now: start.addingTimeInterval(2))
|
|
|
|
let check = start.addingTimeInterval(3)
|
|
#expect(!set.contains("oldest", now: check))
|
|
#expect(set.contains("middle", now: check))
|
|
#expect(set.contains("newest", now: check))
|
|
}
|
|
|
|
@Test func removeReleasesSlot() {
|
|
let now = Date()
|
|
var set = ExpiringIDSet(capacity: 8, lifetime: 3600)
|
|
set.insert("a", now: now)
|
|
set.remove("a")
|
|
#expect(!set.contains("a", now: now))
|
|
let reinserted = set.insert("a", now: now)
|
|
#expect(reinserted)
|
|
}
|
|
|
|
@Test func initPrunesExpiredPersistedEntries() {
|
|
let now = Date()
|
|
let set = ExpiringIDSet(
|
|
capacity: 8,
|
|
lifetime: 3600,
|
|
entries: [
|
|
"stale": now.addingTimeInterval(-7200),
|
|
"fresh": now.addingTimeInterval(-60),
|
|
],
|
|
now: now
|
|
)
|
|
#expect(!set.contains("stale", now: now))
|
|
#expect(set.contains("fresh", now: now))
|
|
}
|
|
|
|
// MARK: - Store round trip
|
|
|
|
@Test func snapshotRoundTripsThroughDisk() {
|
|
let fileURL = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("bridge-dedup-store-\(UUID().uuidString).json")
|
|
defer { try? FileManager.default.removeItem(at: fileURL) }
|
|
let recorded = Date(timeIntervalSince1970: 1_700_000_000)
|
|
|
|
let store = BridgeDropDedupStore(fileURL: fileURL)
|
|
store.save(BridgeDropDedupStore.Snapshot(
|
|
publishedDropKeys: ["msg-1": recorded],
|
|
seenDropEventIDs: ["event-1": recorded]
|
|
))
|
|
|
|
let reloaded = BridgeDropDedupStore(fileURL: fileURL).load()
|
|
#expect(reloaded.publishedDropKeys["msg-1"] == recorded)
|
|
#expect(reloaded.seenDropEventIDs["event-1"] == recorded)
|
|
}
|
|
|
|
@Test func wipeRemovesTheRecord() {
|
|
let fileURL = FileManager.default.temporaryDirectory
|
|
.appendingPathComponent("bridge-dedup-store-\(UUID().uuidString).json")
|
|
defer { try? FileManager.default.removeItem(at: fileURL) }
|
|
|
|
let store = BridgeDropDedupStore(fileURL: fileURL)
|
|
store.save(BridgeDropDedupStore.Snapshot(
|
|
publishedDropKeys: ["msg-1": Date()],
|
|
seenDropEventIDs: [:]
|
|
))
|
|
store.wipe()
|
|
|
|
let reloaded = BridgeDropDedupStore(fileURL: fileURL).load()
|
|
#expect(reloaded.publishedDropKeys.isEmpty)
|
|
#expect(reloaded.seenDropEventIDs.isEmpty)
|
|
}
|
|
|
|
@Test func nonPersistingStoreStaysEmpty() {
|
|
let store = BridgeDropDedupStore(persistsToDisk: false)
|
|
store.save(BridgeDropDedupStore.Snapshot(
|
|
publishedDropKeys: ["msg-1": Date()],
|
|
seenDropEventIDs: [:]
|
|
))
|
|
#expect(store.load().publishedDropKeys.isEmpty)
|
|
}
|
|
}
|