From c9c7807bf0f068474ce5c853244bcb392bdfcce3 Mon Sep 17 00:00:00 2001 From: tv Date: Sun, 8 Nov 2026 19:16:10 +0000 Subject: roots: an epoch's root pinned, and named in every handshake Review 2, N7, the care it raised: a joining node's empty document took as the first epoch's root whatever dependency-less change came first, from whichever peer it joined through; the first epoch's ID is all zeros, so nothing pinned it. A remake's epoch has its ID, the snapshot change's hash, which the rules hold its root to. * Every node names its epoch's root in HELLO and HELLO_REPLY (the epoch's ID for a remake's, its genesis change for the first; wire version 45). A node whose document starts from another root of the same epoch refuses the handshake, logging it: another history under the swarm's ID, a forged root or a genesis started again. * A joining node with an empty document takes as its root only the one it was given (--genesis-root, new), else the one its peers name, and none while they name different ones (access::screen::RootPin, kept in Screening across documents): one peer hands it another root only if it is all the joiner hears, or never, with --genesis-root. A root refused is listed with the refused, what builds on it with it. * The genesis node logs the root (`The swarm's root`); GET /admin/epochs shows it (`root`). A genesis started again under a remembered swarm ID used to merge with the nodes of it still running; they now refuse it (another root), and the docs say to join them with seeds instead. The epoch's identity stays as it is (generation 0 all zeros): records and epoch metadata name it so, and every comparison of epochs with them. --- src/transport/mod.rs | 9 +++++++++ src/transport/wire.rs | 12 +++++++++--- 2 files changed, 18 insertions(+), 3 deletions(-) (limited to 'src/transport') diff --git a/src/transport/mod.rs b/src/transport/mod.rs index e0359b0..640754a 100644 --- a/src/transport/mod.rs +++ b/src/transport/mod.rs @@ -576,6 +576,10 @@ pub(crate) struct HelloRequest { /// with all peers, from 1. A retry carries the same number, so the recipient resets /// its sync session only for a new handshake, not for every resend or late copy. pub(crate) handshake: u32, + /// The hash of its epoch's root, where its document holds it (`swarm::roots`): what + /// a joining node takes as the root, where those it hears agree. + #[serde(with = "serde_bytes")] + pub(crate) root: Option>, } /// A peer a HELLO_REPLY lists: who it is, and where the sender reaches it. @@ -661,6 +665,9 @@ pub(crate) struct HelloReply { /// The sender's own run (as its HELLOs carry it): a new one means it restarted. #[serde(with = "crate::transport::wire::codec::run_id")] pub(crate) sender_run_id: RunId, + /// As `HelloRequest::root`. + #[serde(with = "serde_bytes")] + pub(crate) root: Option>, } /// Bytes shown as lowercase hex, e.g. run IDs in logs. @@ -694,6 +701,7 @@ impl std::fmt::Debug for HelloRequest { .field("ready", &self.ready) .field("run_id", &Hex(&self.run_id)) .field("handshake", &self.handshake) + .field("root", &self.root.as_deref().map(Hex)) .finish() } } @@ -710,6 +718,7 @@ impl std::fmt::Debug for HelloReply { .field("run_id", &Hex(&self.run_id)) .field("away_ms", &self.away_ms) .field("sender_run_id", &Hex(&self.sender_run_id)) + .field("root", &self.root.as_deref().map(Hex)) .finish() } } diff --git a/src/transport/wire.rs b/src/transport/wire.rs index 2ab39e5..5763407 100644 --- a/src/transport/wire.rs +++ b/src/transport/wire.rs @@ -14,7 +14,7 @@ use super::{EncodedMessage, MessageKind, ParsedMessage}; /// The wire format's version, the first byte of every payload. Bump it with every change /// to a message type or a codec (`golden_bytes` fails then). -pub(crate) const VERSION: u8 = 44; +pub(crate) const VERSION: u8 = 45; /// What the second byte of a payload says. fn tag(kind: MessageKind) -> u8 { @@ -461,6 +461,7 @@ pub(crate) fn samples() -> Vec { ready: true, run_id: [4; 16], handshake: 7, + root: None, }), ParsedMessage::HelloReply(HelloReply { swarm_id: "swarm".into(), @@ -475,6 +476,7 @@ pub(crate) fn samples() -> Vec { run_id: [4; 16], away_ms: Some(5), sender_run_id: [6; 16], + root: None, }), ParsedMessage::Sync(SyncEnvelope { epoch: crate::transport::EpochTag::of(epoch), @@ -607,6 +609,7 @@ mod tests { ready: true, run_id: [4; 16], handshake: 7, + root: None, }); let ParsedMessage::Hello(decoded) = decode(&encode(&hello).unwrap()).unwrap() else { panic!("not a HELLO"); @@ -630,6 +633,7 @@ mod tests { run_id: [4; 16], away_ms: Some(5), sender_run_id: [6; 16], + root: None, }); let ParsedMessage::HelloReply(decoded) = decode(&encode(&reply).unwrap()).unwrap() else { panic!("not a HELLO_REPLY"); @@ -745,11 +749,12 @@ mod tests { ready: true, run_id: [4; 16], handshake: 7, + root: None, }); assert_eq!( hex(&encode(&hello).unwrap()), format!( - "{v}0097a5737761726d{epoch_hex}01c403010203c3{}07", + "{v}0098a5737761726d{epoch_hex}01c403010203c3{}07c0", run("04") ) ); @@ -767,11 +772,12 @@ mod tests { run_id: [4; 16], away_ms: Some(5), sender_run_id: [6; 16], + root: None, }); assert_eq!( hex(&encode(&reply).unwrap()), format!( - "{v}0199a5737761726d9192a17091a161{epoch_hex}01c400c2{}05{}", + "{v}019aa5737761726d9192a17091a161{epoch_hex}01c400c2{}05{}c0", run("04"), run("06") ) -- cgit v1.3.1