base red: panic ratchet: cmux-rd-link's 2 index hits in the TURN response lookup (tip panic-ratchet red from 2294e6bc9728)
Summary
The Rust panic ratchet is red on the feat-cmux-next tip (8c42af169ebc and after):
panic-ratchet: cmux-rd-link: clippy::indexing_slicing 2 > new crate (must be 0).
The last green tip was 562235a0f07f. The culprit is commit 2294e6bc9728
("cmux-rd-link: TURN relay carrier (RFC 8656 over UDP)"), which came to feat-cmux-next by direct push, not through a PR.
The 2 hits are both in TurnClient::on_message (cmux-tui/crates/cmux-rd-link/src/turn.rs):
it found the pending request with position(), then read self.requests[index].purpose and
self.requests[index].authenticated. The lookup now takes the index and the request together from
iter().enumerate().find(), reads the method and the authenticated flag from that reference, and
swap_removes by the same index. The baseline is not raised and no allow is added. This matches
the earlier rd-link fix in #29024 (checked access, no behavior change).
No behavior change. These 2 hits were not reachable panics: the index came from position() on
the same Vec with no change between the lookup and the reads, so no datagram could make it go out
of range. The datagram parser itself (Message::parse, on_channel_data, decode_address) already
used split_first_chunk/get and had no hits.
Testing
Regression test a_response_matches_its_request_by_transaction_and_method (tests/turn_client.rs), in its own commit before the fix:
a response with an unknown transaction id and truncated copies of the genuine answer are Ignored,
another method's answer to the same transaction is Handled and leaves the request pending,
and the genuine answer still allocates after the retransmission. Because the old index was in range
by construction, this test cannot fail on the old code; it pins the lookup's behavior across the
rewrite (green before and after), not a panic.
Fleet results (hq Actions runs on blacksmith-8vcpu-ubuntu-2404):
| What | Ref | Command | Result |
|---|---|---|---|
| panic ratchet, before | tip 35e47943e5d8 | cmux-ci run --class light --script scripts/ci/cmux-tui-rust-check.sh --arg panic --os linux (job cb88e10f2454856620ef6eec, run 41518452234) | RED: cmux-rd-link: clippy::indexing_slicing 2 > new crate (must be 0) at turn.rs:606:30 and turn.rs:618:16 |
| panic ratchet, after | head 5c89199ec273 | same (job 20ca1e36c9fcc7fcef2c7ed8, run 41518888791) | pass (84 crates, 34 at deny; cmux-rd-link now at deny) |
| new test, before the fix | test commit ab86b3e4eb1a | ... --arg test --arg a_response_matches_its_request_by_transaction_and_method (job bf893a1c0e9448026d6c57c0, run 41518850693) | 1 passed |
| new test, after the fix | head 5c89199ec273 | same (job 4305de7f75a3b797ffbfa6ae, run 41521530862) | 1 passed |
The ratchet still warns (tracked, not deny) on cmux-rd-link arithmetic_side_effects 32 and
cast_possible_truncation 1, both from the same commit; those lints do not fail the ratchet and this PR does not change them.
Observed / Not run
- Observed: the four fleet runs above; rustfmt (edition 2024, repo config) clean;
prepush-gate.pyno new violations. - No red-before-green run: the old hits could not panic for any datagram, so no test can fail on the base for this defect. The new test pins behavior across the rewrite instead.
- Not run: the full
cmux-rd-linktest suite (the first try used the filterturn_client, a binary name, which nextest matched to 0 tests). Theclippy (changed cmux-tui packages)andbuildPR checks are green on this head. net.rs(featurenet) is not in the ratchet's view: it hasself.relays[index]andfallback[..16]indexing, which this PR does not touch.
Risk
Review (claude-review-subagent): SHIP at 5c89199ec273ebe268e4a242a34430ab1982c8b8
risk_tier.py classify grades this normal (cmux-tui crate logic and a test).
cmux-tui/crates/cmux-rd-link is not a BSL directory in LICENSE.
Changelog
none