Skip to content

Fix easy tracker and native hotpath bugs - #912

Closed
kasnder wants to merge 9 commits into
masterfrom
codex/fix-easy-hotpath
Closed

Fix easy tracker and native hotpath bugs#912
kasnder wants to merge 9 commits into
masterfrom
codex/fix-easy-hotpath

Conversation

@kasnder

@kasnder kasnder commented Sep 5, 2026

Copy link
Copy Markdown
Member

Fixes five independently reproduced hotpath findings:

  • invalidate cached tracker verdicts when DNS evidence is refreshed
  • reload policy when Internet blocking actually changes
  • use 32-bit modular arithmetic for the native TCP send window
  • forward zero-length UDP datagrams instead of treating them as EOF
  • avoid redundant screen-off DoH eviction after cache hits

The audit document records these findings as fixed and leaves the harder findings open. Production-backed TCP-window and UDP-socket host regression tests are included; their Linux ASan/UBSan CI wiring remains follow-up work because the publishing credential cannot update workflow files.

Validation:

  • focused Java/Robolectric policy and DNS tests
  • existing native DNS-frame, IPv6-extension, DHCP-option, UDP-state and WireGuard flow-cache host suites under ASan/UBSan
  • assembleGithubDebug, including C and Rust builds for all four Android ABIs
  • git diff --check origin/master...HEAD

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 5, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-05T10:46:12.798309Z 24f169b PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 24f169bef4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment thread HOTPATH_BUG_AUDIT.md Outdated

**Status: Fixed in this pull request.** The distance is now calculated with
unsigned `uint32_t` subtraction. A production-backed host test covers both the
wrap and non-wrap cases and is wired into CI under ASan/UBSan.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Correct the claim that the native tests run in CI

At this commit, .github/workflows/test.yml proceeds directly from the existing UDP-state test to the WireGuard flow-cache test and a repo-wide search finds no invocation of either new test, so tcp_window_test.c is not wired into CI under ASan/UBSan; the same unsupported claim appears for udp_socket_test.c at line 463 and contradicts lines 505–507, which correctly call CI wiring future work. Either add both test commands to the workflow or describe them consistently as currently manual, otherwise these regressions can return while CI remains green.

Useful? React with 👍 / 👎.

…path-912

# Conflicts:
#	app/src/test/native/host_compat/jni.h
#	app/src/test/native/host_compat/netinet/in6.h
#	app/src/test/native/host_compat/sys/epoll.h
@kasnder

kasnder commented Sep 6, 2026

Copy link
Copy Markdown
Member Author

Superseded by the fixes now merged into master, including #924, #925 and combined Pixel-tested batch #926. The remaining #913 stack has been reconciled with master.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant