marcpardo/nlink-lab
1
0
Fork 0
Code Issues 1 Pull requests 1 Projects Releases 1 Packages Wiki Activity Actions
1 release 8 tags
  • v0.7.0 8a6701dd17

    v0.7.0 — the Plan 160 / nlink 0.25 arc Stable

    p13marc released this 2026-07-15 08:46:25 +00:00 | 0 commits to master since this release

    The "Plan 160 / nlink 0.25" arc. Adopts nlink 0.21 → 0.25 — four minor versions of upstream correctness work, taken clean — and turns the new declarative/ergonomic APIs into three long-standing "pending" closeouts, plus two observability wins and the free upstream shaping/firewall correctness fixes.

    Highlights

    • WireGuard is fully declarative. The imperative device pre-create loop is gone; WireguardConfig::ensure_devices bootstraps the link inside apply_stack_for_node before the NetworkConfig apply so tunnel addresses land on an existing interface. Closes feedback item #3 against 0.19.
    • Rate limits reconcile instead of rebuild. RateLimiter::reconcile replaces the destructive delete-root-qdisc-then-rebuild — zero kernel calls when unchanged, no packet-drop window on edit. Closes Plan 158g.
    • Typed del_*_if_exists teardown. clear_impairment, mgmt teardown, and apply_diff link/route removal drop the hand-rolled QdiscNotFound matching and let _ = del_* swallowing.
    • Deploy self-heals a stale namespace marker. The pre-create guard uses namespace::is_namespace (a live-nsfs check) and clears a stale /var/run/netns/<name> marker left by an unclean shutdown, so a crashed deploy re-deploys without a manual destroy --orphans.
    • watch shows per-rule nftables counters. NewRule drift lines render the typed (packets, bytes) counter via RuleInfo::counter().
    • Per-process TCP bandwidth in live metrics. The backend collector dumps each node's TCP sockets (Connection<SockDiag>), tracks goodput with a per-node SocketRateTracker, and attributes flows via SocketOwnerMap. Top flows ride on the new NodeMetrics.sockets field and render in the metrics stream.

    Free upstream fixes now in effect

    • Traffic shaping is now correct — nlink 0.25's psched/HTB/TBF tick fixes (#191–#218); every RateLimiter / PerPeerImpairer shape was previously mis-programmed by 15–125×.
    • Firewall rules install in declared order (#195, the reversed insertion is fixed); reject really rejects (#205); impairment flower filters match IPv6/ARP/VLAN (#201).

    ⚠️ Breaking — apply --check --json schema v3

    The v1 diff, layered_summary, and layered_summary_deprecated fields — deprecated in 0.6.0 for a one-release window — are removed. Branch on schema_version == 3 and read the typed network / nftables maps. The human-readable apply --check output is unchanged.

    Migration notes for 0.6.0 → 0.7.0

    • Shaping numbers change — to the correct value. Impairment RTT/loss and rate-limit caps on existing labs now match what the topology declares. Re-check any hand-tuned burst you set to compensate for the old behaviour.
    • Firewall rule order is now honored. If a lab "worked" by accident under the old reversed insertion, its policy changes.

    See CHANGELOG.md for the full record.

    Downloads