Seven region audits, every finding adversarially verified against the
whole workspace before being applied; 80 landed and the two that failed
in application were refuted honestly (ParseError has a from_str_radix
producer the audit missed; NatPmpError's Display is the only reader of
its diagnostic payloads).
The bigger cuts:
- The NewPeer/PierceFireWall cluster: an operation variant nothing ever
sent, its 77-line arm, a protocol-wrong Client::pierce_firewall that
wrote a peer-init frame down the server socket, and the struct only
they used. The live paths in peer/listen.rs are untouched.
- The ops loop reads `for operation in reader` instead of hand-rolling
recv/break, de-indenting the whole dispatch body.
- Dead lib surface: Message::print_hex and four unused accessors,
UploadFailed, registry and actor getters, build_watch_user,
strip_ansi_codes, delegating shims on ClientContext. Removing public
items makes this a semver major, which the release pipeline enforces.
- Never-used flexibility: the state-migration framework that never held
a migration, border-type helpers that all answered Rounded, the TUI's
max_concurrent_downloads field nothing read.
- Convergence: six poll loops into poll_until, three wrap-around
navigation blocks into cycle, hit tests into Rect::contains, char
walkers into floor/ceil_char_boundary, five Download literals into
one helper, the suites' shared scaffolding into tests/common.
Deliberately not taken: swapping the hand-rolled zlib inflate and MD5
for crates (they replace wire-facing machinery whose tolerance of
real-world peer quirks no local test exercises) and pulling chrono into
the lib for a log timestamp. Recorded for their own decision.
Net -1002 lines. Both e2e modes stay green: 94 CLI tests each way, 16
protocol, 33 lib, unit suites, clippy pedantic clean, aislop 100/100
with the four scanner false positives suppressed inline where they
fire.
Address the gap that the port mapper's UPnP path and gateway discovery
had no automated coverage (only NAT-PMP did):
- UPnP e2e: split map_via_gateway out of discovery and drive it through
igd-next against an in-process mock IGD (a std HTTP server returning a
canned SOAP envelope). Verifies the real add_port SOAP round-trip and
that we request the exact external/internal port + LAN client.
- default_gateway parsing is now pure, testable functions with unit
tests for the macOS and Linux formats (including the 0.0.0.0 skip).
- New 'portmap' CLI subcommand (needs no login): synchronously probes
UPnP/NAT-PMP against the real router and reports whether the port was
opened + the external address, then removes the test mapping — so a
user can verify reachability on their own network.
9 port_mapping tests now cover the NAT-PMP protocol, the UPnP SOAP
round-trip, gateway parsing, and the map/renew/cleanup lifecycle.
- Shutdown no longer freezes: Drop signalled stop but then blocked on a
thread join, and nothing observed stop during the blocking UPnP/NAT-PMP
discovery (up to ~9s). Drop now waits on a done-channel with a 1s cap
and detaches otherwise, so quitting is always prompt; the finite lease
cleans up if we detach mid-discovery. Regression-tested against an
unresponsive gateway.
- Linux default_gateway() no longer returns 0.0.0.0 for a gateway-less
(directly-connected) default route — it keeps scanning, matching the
macOS branch, instead of firing pointless NAT-PMP at the unspecified
address.
- UPnP now retries AddPortMapping with a permanent (lease 0) mapping when
the router rejects a timed lease (IGDs that only support permanent
leases), and renews/removes with the accepted lease.
Behind a home router the client is unreachable for incoming peer
connections, so browsing/downloading firewalled peers (and the
server-brokered connect-back) times out. Add a best-effort port mapper
to the binary crate that, when listening is enabled, makes us reachable:
- NAT-PMP (RFC 6886) hand-rolled on std::net::UdpSocket, zero deps, with
an injectable gateway address so it is fully testable.
- UPnP-IGD via the blocking igd-next crate as the primary path.
- A background PortMapper that discovers off the main thread (never
blocks startup), renews at half the lease, and removes the mapping on
drop. Any failure is non-fatal and logged.
- Maps the EXACT listen port only (we advertise it verbatim via
SetWaitPort, so a different external port would be unreachable) and
warns the user to forward manually otherwise.
Wired into the TUI, search, and CLI browse (the P2P modes); chat/rooms/
messaging are server-mediated and skip it. e2e-tested against an
in-process mock NAT-PMP gateway: the map request bytes, response parsing,
result-code/timeout handling, and the full spawn -> map -> drop -> unmap
service lifecycle.
Michel de Graaf