ircd.rs/docs/blog/ at a08bcfffc483aa112452f028f2dad5b6fb1217de · xeiaso.net/ircd.rs · Tangled

xeiaso.net / ircd.rs

0

Proof of concept mechanical port of ircnet/ircd to Rust as part of a bit about C being insecure for network services

0

ircd.rs / docs / blog

17 files

at a08bcfffc483aa112452f028f2dad5b6fb1217de

Xe Iaso docs(site): add install & run page 4w ago

001-project-goals.md

docs(blog): add 017-the-keystone-wasnt-the-monster The sendto_one keystone rip-out (P8l): post four and sixteen named it the scary one (~478 call sites + per-recipient formatting), but the per-recipient horror lives in vsendpreprep/the prefix senders, not here. sendto_one is the same format-once shape as sendto_iauth, just with 435 call sites. Covers the two builders (wire! for 58 literals, reply_one! snprintf bridge for ~375 runtime replies[] patterns), the corrected 'blocked on leveva P10' assumption (libc vsprintf delivery means a libc snprintf bridge is byte-identical), the 15-agent fan-out for the mechanical edits, and the migrated L1 byte-diff. Assisted-by: Claude (Opus 4.8) <noreply@anthropic.com> Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

002-strangler-fig.md

docs(blog): add 002-strangler-fig on the outside-in port shape Explains the strangler fig migration pattern and why Rust owns fn main() from day one (the *-sys crate + drop-the-.o seam), why outside-in ownership beats an inside-out C-owns-main approach (single-definition link discipline vs duplicate-symbol games), the bottom-up porting order, the iauth greenfield exception, and the layout-replication cost it trades for falsifiability.

1 month ago

003-the-oracle.md

docs(blog): add 003-the-oracle on the differential test harness The third post in the port series pays off the 'build the oracle first' promise from 001/002: the L1 differential harness (objcopy --redefine-syms to run cref_-renamed C and the implementation-under-test in one process), the link-anchor gotcha, the L2 golden harness, and the clock-pinning trap (a constant clock freezes timeofday and the listener is never serviced). Honest about L3/L4 being designed-not-built.

1 month ago

004-variadic-trampolines.md

docs(blog): add 004-variadic-trampolines Fourth post in the C→Rust port series, paying off the variadic trampoline problem named in 001/002: stable Rust can call an extern "C" variadic but cannot define one, so ~25 thin C shims (va_start → format → Rust core) outlive nearly all other C and die in P8. Explains why "format once, hand Rust a string" fails (the per-recipient va_arg in vsendpreprep) and why "100% Rust" is a dated goal, not day one. Voice-checked via sound-like-a-person. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

005-the-greenfield-exception.md

docs(blog): add 005-the-greenfield-exception iauth is the one component rewritten from scratch rather than faithfully ported, because its contract is the fd-0 text wire and not in-process ABI. The post covers when greenfield is the honest call (where the contract lives), the 8-fn module vtable collapsing into one async fn, and that the rewrite is still oracle-gated against a relinked C-iauth, down to reproducing the rfc931 dead-else-if popt bug bug-for-bug. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

006-the-retrospective-is-where-you-round-up.md

docs(blog): add 006-the-retrospective-is-where-you-round-up A halfway-mark retrospective framed as the moment a project is most tempted to round up. Instead of a victory lap, the un-rounded ledger of what the differential harness actually caught: a test that only failed on aarch64 (c_char signedness), a clean-checkout golden red because the reference C prints an uninitialized sendq, the iauth bug I had to keep, and the calculate_preference pow() the port calls through libc FFI rather than f64::powf so a last-ULP drift can't move the truncated integer on the wire. Plus what was harder than planned (P5's 56 clusters over shared file-statics; replies[]/alphabet_id dumped from the oracle, not text-extracted) and the honest cost: phases 9-12 exist to un-do the faithfulness phases 1-8 built. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

007-prove-the-structs.md

docs(blog): add 007-prove-the-structs The P0b post: proving Rust and C agree on struct layout before any faithful port can be trusted. Covers the two silent bindgen failures (C++-default eating `class`/`register` fields into opaque `_address: u8` blobs; the 0.70-vs-0.72 forward-decl regression) and the ctruth.c + layout.rs drift net that asserts bindgen's view matches the real C compile, field by field, with MAXCONNECTIONS as the cheap proxy for the tables it can't reach yet. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

008-eat-the-file-one-function-at-a-time.md

docs(blog): add 008-eat-the-file-one-function-at-a-time Post on the sub-file strangler-fig seam: the guarded `_link.o` second compile (-DPORT_… per function), de-static'ing leaves so the linker and the cref oracle can see them, and the objcopy --redefine-syms cref_ renamer that keeps the full object diffable. All code quotes verified against ircd-sys/build.rs, ircd-testkit/build.rs, and the s_auth.c set_clean_username (P7v) seam. Assisted-by: Claude (Opus 4.8) Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

009-hand-both-of-them-the-same-socket.md

docs(claude): update memory Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

010-you-dont-write-a-test-for-the-front-door.md

docs(claude): update memory Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

011-the-dial-out-you-can-only-test-by-not-dialing.md

docs(blog): add 011-the-dial-out-you-can-only-test-by-not-dialing Post 011 in the C->Rust port series, closing the I/O trilogy (009 leaves, 010 inbound front door, this outbound dial). connect_server (s_bsd.c:2516) is the daemon dialing out to a configured C-line peer. Its whole point is the connect() succeeding, and that path is untestable at L1 -- it needs a live listening peer plus the event loop, which is the L2 golden harness; and the 111 golden scenarios all dial INTO the daemon, never make it dial out, so the most-tested program here has zero coverage of this function's success path. The L1 oracle therefore diffs the negative space: the three deterministic ways connect_server refuses to dial -- find_server hit (server already present, return -1 before any socket), the remote-by notice arm, and connect_inet's bind() failure into the free_server cleanup (asserting highest_fd unchanged + hash left clean). Three tests for a function whose job is to connect, none of which connect. Also the faithful-port edge case: the DNS-resolution block at s_bsd.c:2544 guarded by !aconf->ipnum.S_ADDR is dead under AF_INET6 (S_ADDR = s6_addr, an embedded array, so !&array is a constant false; common/os.h:686). Ported by omitting it -- dead code has no behavior, so the oracle can't distinguish present from absent, but the oracle also can't PROVE it dead; that's a reading of the macro, not a test result. Plus the find_server/hash_find_server gotcha: the suffix-mask search overwrites '.'->'*' in place, faulting on read-only c"..." literals. All citations verified vs s_bsd.c + connect_server_diff.rs. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

012-you-cant-rename-a-symbol-that-isnt-there.md

docs(blog): add 012-you-cant-rename-a-symbol-that-isnt-there Post 012 in the C->Rust port series, on the one class of function the L1 differential oracle structurally cannot test: file-`static` functions. The oracle is built on `objcopy --redefine-syms foo cref_foo`, and the rename map comes from `nm -g --defined-only` (ircd-testkit/build.rs) -- globals only. A `static` function has internal linkage, no external symbol, so no `cref_` twin can be made without editing the C. First hit in P6 (lookup_confhost, static int in s_conf.c -> the L1 test linked but failed undefined). Two opposite escape hatches: de-static it (the one C edit the faithful port allows -- storage-class only, justified in a comment; mysk in P7s minted cref_mysk for free), or leave it static and port a private Rust twin verified only transitively through its exported caller. P7 has four twins: set_sock_opts (s_bsd.c:1489), check_init (:873), check_clones (:1577), connect_inet (:2680). The honest limit: the oracle diffs at exported-symbol granularity, so a red caller-diff can't localize to the static callee -- GCC already inlined the static into its caller C-side; the Rust port un-fused them for readability, but the diff stays whole-symbol. And the 010 trap recurs: transitive coverage only walks the branches the caller's tested path takes (check_clones' age-out branch needs a 2s gap no golden scenario waits, so it's covered by a reading, not a test). Topic chosen by the user from a 2-option AskUserQuestion. All citations verified vs s_bsd.rs (the four twins) + ircd-testkit/build.rs (the nm -g filter) + the P6 progress log (lookup_confhost). Mandatory xe-writing-style + sound-like-a-person passes run; successive-paragraph-letter audit clean. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

013-the-function-that-launches-the-program-i-didnt-port.md

docs(blog): add 013-the-function-that-launches-the-program-i-didnt-port The next post in the C->Rust port series. Covers P7dd start_iauth, the C launcher of the greenfield iauth from post 005: how you run a differential test on a function whose success means forking and execing into a different program (you diff the parent-side shoreline, fork for real, and reap the children), plus the vfork->fork swap kept faithful by leaving the error message wrong on purpose. Assisted-by: Claude Opus 4.8 via Claude Code Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

014-a-daemons-first-job-is-to-stop-being-watched.md

docs(blog): add 014-a-daemons-first-job-is-to-stop-being-watched Post 014 on the P7ee daemonize port. Thesis: daemonize's entire job is to make the process unobservable (close 0/1/2, fork + parent exit, TIOCNOTTY, setpgrp) — running it faithfully destroys the test harness, so the L1 oracle can only diff the BOOT_TTY "foreground" short-circuit (which is also the only path golden ever boots). The inverse check: resfd must change (init_resolver ran) while adfd stays -1 (start_iauth reached but short-circuited on BOOT_NOIAUTH). Distinct from 011's can't-afford-it untestability — this is can't-survive-it. Footer-links 013/011/003/008/012. Assisted-by: Claude Opus 4.8 (claude-opus-4-8) Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

015-the-loop-that-runs-every-test.md

docs(blog): add 015-the-loop-that-runs-every-test P7ff read_message — the select event loop, body of io_loop, last logic in s_bsd.c. The post on the function the L1 oracle can barely touch: one near-empty differentially-safe case (empty fd_set -> select -> return 0) for the busiest function in the program, and why that's honest — every byte the daemon moves flows through read_message, so the whole golden/s2s suite is its real test. Covers the dead USE_POLL half dropped at compile time, the 8 static twins with no cref_ oracle, and the lopsided coverage ledger. Opens on the miscount in 014's closing (eight statics, not two). Assisted-by: Claude (claude-opus-4-8) <noreply@anthropic.com> Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

016-the-trampoline-with-no-riders.md

docs(blog): add 016-the-trampoline-with-no-riders The inverse of post 004: that post explained why ~25 variadic sender trampolines had to stay C and promised they'd die in P8 by deletion, not translation. This is the first one out — sendto_iauth (s_auth.c:120-170), the P8a rip-out. The throughline: deleting a variadic isn't about the variadic. By P8 every caller is already Rust, so you move the va_start work to the call sites (where format! already lives) and the function loses its `...`. nm showed zero live C callers, which is why I picked it first — the safe one to learn the mechanics on. Covers the seam-inversion + ia_str bridge, the faithfully replicated dead p-cursor bug, the oracle-is-allowed-to-be-variadic test shape (cref_sendto_iauth stays C), and the honest ledger (1 of ~25; the sendto_one/sendto_flag keystones are still per-recipient-hard per post 004). All claims verified vs s_auth.rs:38/77 + s_auth.c:120 + sendto_iauth_diff.rs + build.rs:292 + the P8a plan. Mandatory xe-writing-style (before) and sound-like-a-person (after) passes run; successive-paragraph-letter audit clean. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago

017-the-keystone-wasnt-the-monster.md

docs(blog): add 017-the-keystone-wasnt-the-monster The sendto_one keystone rip-out (P8l): post four and sixteen named it the scary one (~478 call sites + per-recipient formatting), but the per-recipient horror lives in vsendpreprep/the prefix senders, not here. sendto_one is the same format-once shape as sendto_iauth, just with 435 call sites. Covers the two builders (wire! for 58 literals, reply_one! snprintf bridge for ~375 runtime replies[] patterns), the corrected 'blocked on leveva P10' assumption (libc vsprintf delivery means a libc snprintf bridge is byte-identical), the 15-agent fan-out for the mechanical edits, and the migrated L1 byte-diff. Assisted-by: Claude (Opus 4.8) <noreply@anthropic.com> Signed-off-by: Xe Iaso <me@xeiaso.net>

1 month ago