Harden reassembly, proxy, decoder, and TUI; add Parse→SQL resolution - #33
Open
iPeluwa wants to merge 3 commits into
Open
Harden reassembly, proxy, decoder, and TUI; add Parse→SQL resolution#33iPeluwa wants to merge 3 commits into
iPeluwa wants to merge 3 commits into
Conversation
Addresses a broad review of the capture data path, MITM proxy, decoder, TUI, and filter language, plus project-health gaps. Capture path (flow.rs, net.rs, capture.rs): - Evict connections (close-grace tombstone sweep + LRU backstop) so a long-running tap of short-lived clients no longer leaks memory. - Resync past an over-cap reassembly gap instead of stalling forever; deliver every byte of overlapping/re-segmented retransmits; keep the longer of duplicate out-of-order segments; keep the TCP Fast Open first byte; reset state on port-reuse SYNs; stop phantom connections from bare packets and duplicate RSTs. - Handle TSO/GSO (IP total-length 0), drop non-first IP fragments, surface kernel drops and snaplen truncation, match VLAN frames, immediate mode. MITM proxy (proxy.rs): - Support PG17+ direct SSL (ALPN "postgresql"); re-dispatch the client's SSLRequest after a GSS refusal; probe upstream TLS on the cancel path; join both relay legs so half-closed peers finish; derive upstream SNI; keep serving through transient accept errors. Add an in-process E2E test. Decoder (decode.rs): - Resolve prepared-statement SQL so Bind/Execute show the query text. - Recover from decode desync and give up cleanly after repeated failures; cap printable CopyData previews; show CancelRequest pid/key. - Bound the output channel and drop-with-count via try_send behind an RwLock, so a wedged consumer can't OOM or stall the relay. TUI + search (tui.rs): - Surface fatal source errors on the splash and exit non-zero; preserve scroll across history-cap eviction; apply the filter on Enter and let Esc cancel-restore; fix the blank viewport when leaving follow; catch source panics; guard :save against the replay input; account for cleared events; expand ~ in paths; Ctrl-C cancels input; snapshot metrics once per frame. - Add "/" text search with n/N navigation and match highlighting; ":" opens the command bar. Filter language (filter.rs): - Ordered client.port comparisons, quote-terminated bare words, and quoted port numbers accepted symmetrically with IPs. Docs and project health: - Correct the man page (-Y fatality, exit status, message.type vocabulary, new keys); README key table; troubleshooting and sensitive-data notes. - CI macOS/MSRV/audit jobs; test-gated multi-platform release with checksums; PKGBUILD hygiene; CONTRIBUTING, SECURITY, CHANGELOG, and a replayable examples/demo-session.jsonl. Test suite grows from 64 to 89; clippy and rustfmt clean.
Owner
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Broad hardening pass over the capture data path, MITM proxy, decoder, TUI, and filter language, plus project-health gaps.
Highlights
postgresql); GSS-refusal → SSLRequest re-dispatch; cancel-path upstream TLS;join!both legs for half-close; SNI from the upstream host; resilient accept loop. New in-process end-to-end test.Bind/Executeshow the query; decode-desync recovery; cappedCopyDatapreviews;CancelRequestpid/key; bounded, non-blocking output channel (no OOM, no relay stall).:saveself-overwrite guard;~expansion; Ctrl-C cancels input. New/text search withn/Nand highlighting (:= command bar).client.portcomparisons; quote-terminated bare words; quoted port numbers.CONTRIBUTING/SECURITY/CHANGELOG; replayableexamples/demo-session.jsonl.Verification
cargo clippy --all-targetsclean;cargo fmt --checkclean.examples/demo-session.jsonlverified to replay.Notes