LLT-7562, LLT-7644: Rebuild Apple listen sockets on network change and release the old port on listen_port change - #76
Merged
sfraczek merged 3 commits intoAug 25, 2026
Conversation
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
from
August 11, 2026 18:46
ff2ae3e to
889b27e
Compare
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #76 +/- ##
==========================================
+ Coverage 73.02% 73.81% +0.78%
==========================================
Files 20 20
Lines 4601 4724 +123
==========================================
+ Hits 3360 3487 +127
+ Misses 1241 1237 -4
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
2 times, most recently
from
August 11, 2026 19:55
f2bffa6 to
7779dc7
Compare
sfraczek
requested review from
djkarwowski,
lcruz99,
mathiaspeters and
tomasz-grz
and removed request for
djkarwowski and
lcruz99
August 12, 2026 06:46
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
from
August 12, 2026 14:40
7779dc7 to
0f7c885
Compare
Contributor
Author
|
Follow-up filed: LLT-7623 |
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
from
August 14, 2026 12:48
0f7c885 to
87d2e04
Compare
tomasz-grz
reviewed
Aug 17, 2026
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
3 times, most recently
from
August 21, 2026 10:01
5be0a6b to
377084d
Compare
sfraczek
changed the title
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
from
August 21, 2026 11:42
377084d to
1c54b7c
Compare
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
2 times, most recently
from
August 24, 2026 09:40
88c7e56 to
a4d8f8f
Compare
jjanowsk
reviewed
Aug 24, 2026
jjanowsk
requested changes
Aug 24, 2026
jjanowsk
reviewed
Aug 24, 2026
register_udp_handler took a try_clone() duplicate, so the event was registered under the duplicate's descriptor while cleanup cleared the original's: the event survived, kept its dup of the socket open, and the old port stayed bound after a rebind. With a shared Arc there is one descriptor throughout, and cleanup clears it straight off the socket it is about to drop.
Reading the port back only fails if the bound socket reports an address family other than AF_INET, which should not happen. The old branch let it fall through: the IPv6 socket then bound another random port and listen_port stayed 0, which api.rs reports as no port at all.
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
from
August 24, 2026 14:50
0397bf3 to
6ad87dd
Compare
On Apple the UDP socket is pinned to a physical interface, and its flow control can wedge against a dead interface incarnation - every send fails with EAGAIN and the queue never drains. drop_connected_sockets() does not help there, it only closes per-peer sockets. Rebuild the socket instead: close it, then rebind the same port to keep NAT mappings, falling back to an ephemeral one.
sfraczek
force-pushed
the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
from
August 24, 2026 14:57
6ad87dd to
3f9784b
Compare
Contributor
|
+0.5 |
sfraczek
enabled auto-merge
August 24, 2026 15:50
jjanowsk
approved these changes
Aug 25, 2026
sfraczek
deleted the
sfraczek/LLT-7562-rebuild-sockets-on-network-change
branch
August 25, 2026 06:03
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
On macOS/iOS/tvOS the WireGuard UDP socket is pinned to a physical interface via
IP_BOUND_IF, since these platforms have no fwmark equivalent for routing the socket's traffic around the tunnel. When that interface disappears and comes back, the socket's flow control can wedge against the dead incarnation: every send fails withEAGAINand the queue never drains, because the kernel's resume signal can only come from that same incarnation.drop_connected_sockets()is the only thing run on a network change, and it doesn't help - it closes per-peer connected sockets, which are compiled out on Apple.This rebuilds the shared socket instead: close the old one, then rebind the same port so an existing NAT mapping stays valid when the same interface returns with the same address, falling back to an ephemeral port if that port is taken. Closing has to go through the event loop, since it holds a duplicate of the descriptor that keeps the port allocated.