iOS Iroh: bounded dials, hint-refresh fallback, fail-open credential refresh

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxConnectivityEngine.swift

@@ -26,6 +26,9 @@ public actor CmxConnectivityEngine {
     private let installRouteSnapshot: RouteSnapshotInstaller?
     private let diagnosticLog: DiagnosticLog?
     private let clock: any CmxIrohRelayClock
+    /// Deadline for each dial phase (public paths, private fallback, and the
+    /// admission barrier) of every peer session this engine creates.
+    private let dialPhaseTimeout: Duration
     private var desiredActive = false
     private var lifecycleRevision: UInt64 = 0
     private var endpointGeneration: UInt64?
@@ -59,7 +62,8 @@ public actor CmxConnectivityEngine {
         authority: (any CmxConnectivityAuthorityServing)? = nil,
         installRouteSnapshot: RouteSnapshotInstaller? = nil,
         diagnosticLog: DiagnosticLog? = nil,
-        clock: any CmxIrohRelayClock = CmxIrohSystemRelayClock()
+        clock: any CmxIrohRelayClock = CmxIrohSystemRelayClock(),
+        dialPhaseTimeout: Duration = .seconds(5)
     ) {
         precondition((authority == nil) == (installRouteSnapshot == nil))
         supervisor = CmxIrohEndpointSupervisor(
@@ -72,6 +76,7 @@ public actor CmxConnectivityEngine {
         self.installRouteSnapshot = installRouteSnapshot
         self.diagnosticLog = diagnosticLog
         self.clock = clock
+        self.dialPhaseTimeout = dialPhaseTimeout
     }
 
     /// Creates a stopped endpoint-only engine for a host acceptor.
@@ -90,6 +95,7 @@ public actor CmxConnectivityEngine {
         installRouteSnapshot = nil
         diagnosticLog = nil
         clock = CmxIrohSystemRelayClock()
+        dialPhaseTimeout = .seconds(5)
     }
 
     init(
@@ -99,7 +105,8 @@ public actor CmxConnectivityEngine {
         authority: (any CmxConnectivityAuthorityServing)? = nil,
         installRouteSnapshot: RouteSnapshotInstaller? = nil,
         diagnosticLog: DiagnosticLog? = nil,
-        clock: any CmxIrohRelayClock = CmxIrohSystemRelayClock()
+        clock: any CmxIrohRelayClock = CmxIrohSystemRelayClock(),
+        dialPhaseTimeout: Duration = .seconds(5)
     ) {
         precondition((authority == nil) == (installRouteSnapshot == nil))
         self.supervisor = supervisor
@@ -109,6 +116,7 @@ public actor CmxConnectivityEngine {
         self.installRouteSnapshot = installRouteSnapshot
         self.diagnosticLog = diagnosticLog
         self.clock = clock
+        self.dialPhaseTimeout = dialPhaseTimeout
     }
 
     /// Returns the current immutable UI-safe state.
@@ -533,6 +541,7 @@ public actor CmxConnectivityEngine {
         let protocolConfiguration = protocolConfiguration
         let diagnosticLog = diagnosticLog
         let clock = clock
+        let dialPhaseTimeout = dialPhaseTimeout
         let peer = CmxConnectivityPeerSession(
             peerID: peerID,
             buildSession: { request in
@@ -551,6 +560,7 @@ public actor CmxConnectivityEngine {
                             basedOn: context
                         )
                     },
+                    dialPhaseTimeout: dialPhaseTimeout,
                     protocolConfiguration: protocolConfiguration,
                     diagnostics: diagnosticLog
                 )

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientRuntime.swift

@@ -172,7 +172,8 @@ public actor CmxIrohClientRuntime {
             supervisor: supervisor,
             contextProvider: contextRouter,
             protocolConfiguration: protocolConfiguration,
-            diagnosticLog: diagnosticLog
+            diagnosticLog: diagnosticLog,
+            dialPhaseTimeout: configuration.dialPhaseTimeout
         )
         self.supervisor = supervisor
         self.connectivityEngine = connectivityEngine

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientRuntimeConfiguration.swift

@@ -44,6 +44,12 @@ public struct CmxIrohClientRuntimeConfiguration: Equatable, Sendable {
     /// flight. A signed registration refresh follows after activation.
     public let cachedBinding: CmxIrohBrokerBindingMetadata?
 
+    /// Deadline for each dial phase (public paths, private fallback, and the
+    /// admission barrier) of every peer dial this runtime performs. A phase
+    /// that never answers fails typed at this bound and hands control back to
+    /// recovery instead of holding the reconnect owner (cmux#9724).
+    public let dialPhaseTimeout: Duration
+
     /// Creates an immutable iOS client lifecycle configuration.
     ///
     /// Broker-facing validation occurs when ``CmxIrohClientRuntime/start()``
@@ -60,6 +66,8 @@ public struct CmxIrohClientRuntimeConfiguration: Equatable, Sendable {
     ///   - endpointRelayProfile: An optional local selection or custom override.
     ///   - cachedRelayCredential: A validated cached relay capability.
     ///   - cachedBinding: A previously verified exact local binding tuple.
+    ///   - dialPhaseTimeout: The per-phase dial deadline, injectable so tests
+    ///     can shrink it.
     public init(
         accountID: String,
         deviceID: String,
@@ -72,7 +80,8 @@ public struct CmxIrohClientRuntimeConfiguration: Equatable, Sendable {
         managedRelayURLs: Set<String>,
         endpointRelayProfile: CmxIrohEndpointRelayProfile? = nil,
         cachedRelayCredential: CmxIrohRelayTokenResponse? = nil,
-        cachedBinding: CmxIrohBrokerBindingMetadata? = nil
+        cachedBinding: CmxIrohBrokerBindingMetadata? = nil,
+        dialPhaseTimeout: Duration = .seconds(5)
     ) {
         self.accountID = accountID
         self.deviceID = cmxCanonicalDeviceID(deviceID)
@@ -86,5 +95,6 @@ public struct CmxIrohClientRuntimeConfiguration: Equatable, Sendable {
         self.endpointRelayProfile = endpointRelayProfile
         self.cachedRelayCredential = cachedRelayCredential
         self.cachedBinding = cachedBinding
+        self.dialPhaseTimeout = dialPhaseTimeout
     }
 }

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohClientSession.swift

@@ -431,56 +431,71 @@ public actor CmxIrohClientSession {
 
         do {
             try Task.checkCancellation()
-            guard await establishedConnection.remoteIdentity() == targetIdentity else {
-                throw CmxIrohClientSessionError.remoteIdentityMismatch
+            // A half-ready peer can accept the QUIC connection and then never
+            // serve the admission frames. Bound the whole barrier like a dial
+            // phase so a silent peer hands control back to recovery instead
+            // of holding the redial owner open-endedly (cmux#9724).
+            return try await boundedByDialPhase { [weak self] in
+                guard let self else { throw CancellationError() }
+                return try await self.performAdmissionBarrier(
+                    on: establishedConnection
+                )
+            }
+        } catch {
+            await establishedConnection.close(errorCode: 1, reason: "admission_failed")
+            throw error
+        }
+    }
+
+    private func performAdmissionBarrier(
+        on establishedConnection: any CmxIrohConnection
+    ) async throws -> CmxIrohConnectedControl {
+        guard await establishedConnection.remoteIdentity() == targetIdentity else {
+            throw CmxIrohClientSessionError.remoteIdentityMismatch
+        }
+        try await establishedConnection.setIncomingStreamLimits(
+            maximumBidirectionalStreamCount: 0,
+            maximumUnidirectionalStreamCount: 0
+        )
+        let stream = try await establishedConnection.openBidirectionalStream()
+        let header = try CmxIrohStreamHeader(
+            lane: .control,
+            credential: credential
+        )
+        try await stream.sendStream.send(headerCodec.encode(header))
+        let admission = try await readAdmissionFrame(from: stream.receiveStream)
+        switch admission.frame {
+        case .acceptedPendingNatTraversal, .acceptedRelayOnly:
+            if admission.frame == .acceptedPendingNatTraversal {
+                try Task.checkCancellation()
+                try await establishedConnection.authorizeNatTraversal()
             }
-            try await establishedConnection.setIncomingStreamLimits(
-                maximumBidirectionalStreamCount: 0,
-                maximumUnidirectionalStreamCount: 0
+            try Task.checkCancellation()
+            try await stream.sendStream.send(
+                admissionCodec.encodeFrame(.clientReady)
             )
-            let stream = try await establishedConnection.openBidirectionalStream()
-            let header = try CmxIrohStreamHeader(
-                lane: .control,
-                credential: credential
+            let confirmation = try await readAdmissionFrame(
+                from: stream.receiveStream,
+                initialBuffer: admission.trailingBytes
             )
-            try await stream.sendStream.send(headerCodec.encode(header))
-            let admission = try await readAdmissionFrame(from: stream.receiveStream)
-            switch admission.frame {
-            case .acceptedPendingNatTraversal, .acceptedRelayOnly:
-                if admission.frame == .acceptedPendingNatTraversal {
-                    try Task.checkCancellation()
-                    try await establishedConnection.authorizeNatTraversal()
-                }
-                try Task.checkCancellation()
-                try await stream.sendStream.send(
-                    admissionCodec.encodeFrame(.clientReady)
-                )
-                let confirmation = try await readAdmissionFrame(
-                    from: stream.receiveStream,
-                    initialBuffer: admission.trailingBytes
-                )
-                switch confirmation.frame {
-                case .serverReady:
-                    break
-                case let .denied(code):
-                    throw CmxIrohClientSessionError.admissionDenied(code: code)
-                case .acceptedPendingNatTraversal, .acceptedRelayOnly, .clientReady:
-                    throw CmxIrohClientSessionError.invalidAdmissionFrame
-                }
-                try Task.checkCancellation()
-                return CmxIrohConnectedControl(
-                    connection: establishedConnection,
-                    stream: stream,
-                    initialReceiveBuffer: confirmation.trailingBytes
-                )
+            switch confirmation.frame {
+            case .serverReady:
+                break
             case let .denied(code):
                 throw CmxIrohClientSessionError.admissionDenied(code: code)
-            case .clientReady, .serverReady:
+            case .acceptedPendingNatTraversal, .acceptedRelayOnly, .clientReady:
                 throw CmxIrohClientSessionError.invalidAdmissionFrame
             }
-        } catch {
-            await establishedConnection.close(errorCode: 1, reason: "admission_failed")
-            throw error
+            try Task.checkCancellation()
+            return CmxIrohConnectedControl(
+                connection: establishedConnection,
+                stream: stream,
+                initialReceiveBuffer: confirmation.trailingBytes
+            )
+        case let .denied(code):
+            throw CmxIrohClientSessionError.admissionDenied(code: code)
+        case .clientReady, .serverReady:
+            throw CmxIrohClientSessionError.invalidAdmissionFrame
         }
     }
 
@@ -498,22 +513,32 @@ public actor CmxIrohClientSession {
     ) async throws -> any CmxIrohConnection {
         let endpoint = endpoint
         let alpn = protocolConfiguration.alpn
+        return try await boundedByDialPhase {
+            try await endpoint.connect(to: address, alpn: alpn)
+        }
+    }
+
+    /// Races one dial-phase operation against the injected phase bound. The
+    /// operation must cancel cooperatively; on timeout the loser is cancelled
+    /// and the phase fails typed so the redial machinery supersedes it
+    /// instead of wedging behind it (cmux#8531).
+    private func boundedByDialPhase<Value: Sendable>(
+        _ operation: @escaping @Sendable () async throws -> Value
+    ) async throws -> Value {
         let bound = dialPhaseTimeout
-        return try await withThrowingTaskGroup(
-            of: (any CmxIrohConnection)?.self
-        ) { group in
+        return try await withThrowingTaskGroup(of: Value?.self) { group in
             group.addTask {
-                try await endpoint.connect(to: address, alpn: alpn)
+                try await operation()
             }
             group.addTask {
                 try await ContinuousClock().sleep(for: bound)
                 return nil
             }
             defer { group.cancelAll() }
-            guard let first = try await group.next(), let connection = first else {
+            guard let first = try await group.next(), let value = first else {
                 throw CmxIrohClientSessionError.dialTimedOut
             }
-            return connection
+            return value
         }
     }
 

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohRegistryContextProvider.swift

@@ -193,6 +193,28 @@ public actor CmxIrohRegistryContextProvider: CmxIrohClientContextProvider {
                 )
                 usedFreshDiscovery = true
             } catch {
+                try Task.checkCancellation()
+                // The refresh failed. Dialing with the last verified snapshot
+                // beats not dialing at all (cmux#9724): the staleness mark
+                // survives, so the next attempt still refetches once the
+                // broker recovers. Verification is not weakened; this
+                // snapshot passed the same checks when it was fetched.
+                if let lastGood = authoritativeDiscovery {
+                    do {
+                        return try await resolveContext(
+                            for: request,
+                            targetIdentity: targetIdentity,
+                            routeHints: routeHints,
+                            discovery: lastGood,
+                            at: clock
+                        )
+                    } catch is CancellationError {
+                        throw CancellationError()
+                    } catch {
+                        // The last-good snapshot no longer authorizes this
+                        // peer; fall through to the offline cache.
+                    }
+                }
                 guard Self.isConnectivity(error),
                       let cached = try await cachedPolicy(
                           for: request,

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohRelayCredentialCoordinator.swift

@@ -374,6 +374,14 @@ public actor CmxIrohRelayCredentialCoordinator {
                 ),
                 initialFailureCount: 1
             )
+            // Fail open while a last-good credential is installed on the
+            // endpoint: a failed mint must not fail the caller's foreground
+            // path into zero-route dial churn (cmux#10375). The bounded retry
+            // loop above keeps refreshing in the background, and the relay is
+            // the authority that rejects a credential that truly went bad.
+            if installedCredential != nil, !(error is CancellationError) {
+                return
+            }
             throw error
         }
     }

Packages/Shared/CmuxIrohTransport/Sources/CmuxIrohTransport/CmxIrohRelayPolicyCache.swift

@@ -97,16 +97,47 @@ public actor CmxIrohRelayPolicyCache {
     /// - Parameters:
     ///   - trustRoot: App-pinned public verification keys.
     ///   - now: Verification time.
+    ///   - expiredPolicyReuseGrace: Bounded fail-open window after the signed
+    ///     expiry in which the last-good policy still loads. The policy is
+    ///     re-verified at its final valid instant, so signature, rollback,
+    ///     and claim checks run unweakened; only the expiry gate is graced
+    ///     (cmux#10375). Zero preserves strict expiry.
     /// - Returns: The verified policy, or `nil` when no policy is cached.
     /// - Throws: ``CmxIrohRelayPolicyError`` or a secure-storage error.
     public func load(
         trustRoot: CmxIrohRelayPolicyTrustRoot,
-        now: Date
+        now: Date,
+        expiredPolicyReuseGrace: TimeInterval = 0
     ) async throws -> CmxIrohManagedRelayPolicy? {
         await acquire()
         defer { release() }
         guard let record = try await storedRecord() else { return nil }
-        let policy = try verifier.verify(record.signedPolicy, trustRoot: trustRoot, now: now)
+        let policy: CmxIrohManagedRelayPolicy
+        do {
+            policy = try verifier.verify(
+                record.signedPolicy,
+                trustRoot: trustRoot,
+                now: now
+            )
+        } catch CmxIrohRelayPolicyError.expired {
+            // The recorded expiry is cross-checked against the signed claims
+            // below; a record that overstates it re-fails as expired here or
+            // as rollback below.
+            guard expiredPolicyReuseGrace > 0,
+                  let recordedExpiry = record.expiresAt,
+                  now.timeIntervalSince1970
+                    <= TimeInterval(recordedExpiry) + expiredPolicyReuseGrace else {
+                throw CmxIrohRelayPolicyError.expired
+            }
+            let lastValidInstant = Date(
+                timeIntervalSince1970: TimeInterval(recordedExpiry) - 1
+            )
+            policy = try verifier.verify(
+                record.signedPolicy,
+                trustRoot: trustRoot,
+                now: min(now, lastValidInstant)
+            )
+        }
         guard policy.sequence == record.highestSequence,
               Self.metadataMatches(policy, record: record) else {
             throw CmxIrohRelayPolicyError.rollback