@threadedstack/wmd-web 0.0.0-stage → 0.1.13

package/src/net/stack.js

@@ -0,0 +1,867 @@
+// P-B10: the guest's network in the browser: a small user-space TCP/IP stack that
+// terminates the guest's Ethernet frames (virtio-net over the net channel) and carries its
+// TCP connections and DNS lookups over the relay (relay-client.js), as the engine's
+// gvisor-tap-vsock netstack does natively (internal/engine/netstack.go).
+//
+// What it answers, on the engine's addresses (192.168.127.0/24, gateway .1, guest .2):
+//   ARP      for the gateway only
+//   DHCP     one static lease: the guest's address, the gateway as router and DNS server
+//   DNS      UDP to gateway:53: A queries go to the relay (which resolves and filters them);
+//            AAAA and other types get an empty answer (the guest has no IPv6 route);
+//            gateway.wmd.internal is the gateway
+//   TCP      every connection the guest opens is a relay stream; the SYN-ACK is sent only
+//            once the relay has connected, so a refused connection is a RST (ECONNREFUSED)
+//   ICMP     echo to the gateway; anything else is answered "administratively prohibited"
+//   UDP      other than DHCP/DNS: ICMP unreachable
+//
+// TCP here is the passive end of each connection. The link (the channel rings) is
+// reliable and ordered, and vm.wasm waits rather than drops when the guest has no receive
+// buffer (chan_pump.c), so there is no congestion control; the guest's advertised window
+// and the ring's room bound what is in flight. Retransmission on a timeout, three
+// duplicate ACKs and zero-window probes are still there in case the guest drops a segment.
+//
+// W56: on an in-page switch (switch.js, peer.js) the guest has neighbours: ARP is answered for
+// each guest on the switch too, their names (name, name.wmd.internal) resolve to their addresses
+// before any relay lookup, a connection to one of them is a stream to that guest's network Worker
+// (peer.js) instead of a relay stream, and a connection a neighbour opens to this guest comes in
+// through peerOpen(): here the stack is the active end (it sends the SYN). Without a relay (a
+// switch only) other addresses and names fail at once.
+//
+// Truncation: a stream the relay ends cleanly (the remote's FIN) ends with a FIN; a stream
+// that fails (the remote reset, the relay dropped, a limit) ends with a RST, never a FIN,
+// so the guest's program sees an error, not a short file that looks complete.
+
+import {
+  ETH_ARP, ETH_IPV4, IP_ICMP, IP_TCP, IP_UDP, TCP_ACK, TCP_FIN, TCP_PSH, TCP_RST, TCP_SYN, arpReply, icmpEchoReply, icmpUnreachable,
+  ipToU32, macBytes, macStr, parseArp, parseEth, parseIp, parseTcp, parseUdp, seqAdd, seqDiff, seqLe, seqLt, tcpFrame, u32ToIp, udpFrame,
+} from './packet.js'
+import { DHCP, QTYPE, RC, dhcpReply, dnsResponse, parseDhcp, parseDnsQuery } from './dhcp-dns.js'
+import { E, E_NAMES, MAX_DATA, WINDOW } from './proto.js'
+
+export const NET_DEFAULTS = {
+  gateway: '192.168.127.1',
+  ip: '192.168.127.2',
+  mask: '255.255.255.0',
+  gatewayMac: '5a:94:ef:e4:0c:dd', // internal/engine/netstack.go gatewayMAC
+  mtu: 1500,
+}
+
+const OUR_MSS = 1460
+const OUR_WS = 3 // window scale we offer: windows up to 512 KiB
+const RCV_BUF = WINDOW // bytes from the guest held for the relay at most, per connection
+const RTO_MIN = 1000
+const RTO_MAX = 30_000
+const CONNECT_TIMEOUT_MS = 30_000
+const DNS_TIMEOUT_MS = 10_000
+const HALF_OPEN_IDLE_MS = 10 * 60_000
+const SYNACK_GIVE_UP_MS = 60_000 // Linux: tcp_synack_retries (5), about 63 s
+const GUEST_CLOSED_IDLE_MS = 120_000 // the guest's FIN is in, the remote says nothing: its kernel forgot it (FIN_WAIT2, 60 s)
+const MAX_PENDING = 32 // handshakes not finished at once (more get a RST), so abandoned ones cannot take every relay slot
+const INTERNAL_ZONE = 'wmd.internal'
+
+const P_CONNECTING = 1 // waiting for the relay's CONNECTED
+const P_SYNACK = 2 // SYN-ACK sent, waiting for the guest's ACK
+const P_OPEN = 3
+const P_SYNSENT = 4 // W56: a peer's connection to the guest: our SYN sent, waiting for its SYN-ACK
+const PEER_TTL = 60 // seconds: DNS answers for guests on the switch
+
+/** The transport when there is no relay (a guest on a switch only): every connect and lookup fails at once. */
+class NoRelay {
+  constructor() {
+    this.up = false
+    this.connecting = false
+    this.stack = null
+  }
+  connect(id) {
+    queueMicrotask(() => this.stack?.onConnected(id, E.UNREACHABLE, 0, 'no relay: only the guests on this network are reachable'))
+  }
+  data() {}
+  end() {}
+  abort() {}
+  credit() {}
+  dns() {}
+}
+
+class Conn {
+  constructor(key, id, s, ip) {
+    this.key = key
+    this.id = id
+    this.gip = ip.src
+    this.rip = ip.dst
+    this.gport = s.sport
+    this.rport = s.dport
+    this.phase = P_CONNECTING
+    this.irs = s.seq
+    this.rcvNxt = seqAdd(s.seq, 1)
+    this.guestWs = s.wscale >= 0 ? s.wscale : -1
+    this.ourWs = this.guestWs >= 0 ? OUR_WS : 0
+    this.mss = Math.min(s.mss || 536, OUR_MSS)
+    this.iss = (Math.random() * 0x100000000) >>> 0
+    this.sndUna = this.iss
+    this.sndNxt = this.iss
+    this.sndWnd = s.win // until the handshake ends: unscaled, as RFC 7323 says for SYNs
+    this.sendQ = [] // bytes from the relay from sndUna on (after the SYN)
+    this.sendQBytes = 0
+    this.toRelay = [] // bytes from the guest waiting for relay credit
+    this.toRelayBytes = 0
+    this.relayCredit = 0
+    this.guestFin = false // the guest's FIN was received
+    this.relayEndSent = false
+    this.remoteEnd = false // the relay said END
+    this.finSent = false
+    this.finSeq = 0
+    this.finAcked = false
+    this.rto = RTO_MIN
+    this.rtoAt = 0
+    this.dupAcks = 0
+    this.needAck = false
+    this.lastWndSent = 0
+    this.openedAt = 0
+    this.synAckAt = 0
+    this.lastActive = 0
+    this.lastRemote = 0 // the last data or end from the relay
+    this.bytesIn = 0 // guest -> relay
+    this.bytesOut = 0 // relay -> guest
+  }
+  inflight() {
+    return seqDiff(this.sndNxt, this.sndUna)
+  }
+}
+
+export class NetStack {
+  /**
+   * @param {object} o
+   * @param {(frame: Uint8Array) => void} o.send     a frame for the guest
+   * @param {object} [o.relay]   {connect(id, host, port), data(id, u8), end(id), abort(id), credit(id, n), dns(id, name, qtype), up}; none: no internet
+   * @param {object} [o.peers]   W56: the guests on an in-page switch (peer.js PeerNet)
+   * @param {() => number} [o.now]
+   * @param {() => number} [o.txRoom]  bytes the guest's ring can take now (net-worker.js); data waits when 0
+   * @param {number} [o.maxConns]  connections at once (more get a RST)
+   * @param {(line: string) => void} [o.log]
+   */
+  constructor(o) {
+    const c = { ...NET_DEFAULTS, ...(o.config || {}) }
+    this.cfg = c
+    this.gw = ipToU32(c.gateway)
+    this.ip = ipToU32(c.ip)
+    this.mask = ipToU32(c.mask)
+    this.gwMac = macBytes(c.gatewayMac)
+    this.guestMac = null
+    this.sendFrame = o.send
+    this.relay = o.relay || new NoRelay()
+    if (!o.relay) this.relay.stack = this
+    this.noRelay = !o.relay
+    this.peers = o.peers || null // W56: the switch's guests (peer.js)
+    this.now = o.now || (() => performance.now())
+    this.maxConns = o.maxConns ?? 256
+    this.log = o.log || (() => {})
+    this.conns = new Map() // key -> Conn
+    this.byId = new Map() // relay stream id -> Conn
+    this.dns = new Map() // relay query id -> {q, p, sport, at}
+    this.nextId = 1
+    this.txRoom = o.txRoom || (() => Infinity)
+    this.wantsSend = new Set()
+    this.acks = new Set()
+    this.stats = {
+      framesIn: 0, framesOut: 0, bytesIn: 0, bytesOut: 0, arp: 0, dhcp: 0, dnsQueries: 0, dnsAnswered: 0, dnsFailed: 0,
+      tcpOpened: 0, tcpRefused: 0, tcpReset: 0, tcpFinished: 0, retransmits: 0, dupAckRetransmits: 0, probes: 0,
+      dropped: 0, icmp: 0, refusedBy: {}, connectMs: [], payloadIn: 0, payloadOut: 0,
+    }
+    this.events = []
+  }
+
+  #event(e) {
+    this.events.push({ at: Math.round(this.now()), ...e })
+    if (this.events.length > 200) this.events.shift()
+  }
+
+  #out(f) {
+    this.stats.framesOut++
+    this.stats.bytesOut += f.length
+    this.sendFrame(f)
+  }
+
+  /** A frame from the guest. */
+  input(f) {
+    this.stats.framesIn++
+    this.stats.bytesIn += f.length
+    const eth = parseEth(f)
+    if (!eth) return this.#drop('short frame')
+    if (!this.guestMac && !(eth.src[0] & 1)) this.guestMac = eth.src.slice()
+    if (eth.type === ETH_ARP) return this.#arp(eth)
+    if (eth.type !== ETH_IPV4) return // IPv6 and others: no route
+    const ip = parseIp(eth.payload)
+    if (!ip) return this.#drop('bad IPv4')
+    if (ip.fragment) return this.#drop('IPv4 fragment')
+    const mac = eth.src
+    if (ip.proto === IP_UDP) return this.#udp(mac, ip)
+    if (ip.proto === IP_TCP) return this.#tcp(mac, ip)
+    if (ip.proto === IP_ICMP) return this.#icmp(mac, ip)
+    this.#drop(`IP protocol ${ip.proto}`)
+  }
+
+  #drop(why) {
+    this.stats.dropped++
+    if (this.stats.dropped <= 20) this.log(`net: dropped a frame: ${why}`)
+  }
+
+  #arp(eth) {
+    const a = parseArp(eth.payload)
+    if (!a || a.op !== 1) return
+    // the gateway, and (W56) each other guest on the switch: their frames come here too
+    if (a.tpa !== this.gw && !(this.peers && a.tpa !== this.ip && this.peers.has(a.tpa))) return
+    this.stats.arp++
+    this.#out(arpReply(this.gwMac, a.tpa, a.sha, a.spa))
+  }
+
+  #icmp(mac, ip) {
+    this.stats.icmp++
+    const p = ip.payload
+    if (p.length < 8 || p[0] !== 8) return
+    if (ip.dst === this.gw) return this.#out(icmpEchoReply(this.gwMac, mac, this.gw, ip.src, p))
+    this.#out(icmpUnreachable(this.gwMac, mac, this.gw, ip.src, 13, quoteOf(ip))) // only TCP and DNS leave the guest
+  }
+
+  #udp(mac, ip) {
+    const u = parseUdp(ip.payload)
+    if (!u) return this.#drop('bad UDP')
+    if (u.dport === 67) return this.#dhcp(mac, u)
+    if (u.dport === 53 && ip.dst === this.gw) return this.#dnsQuery(mac, ip, u)
+    if ((ip.dst & 0xf0000000) >>> 0 === 0xe0000000 || ip.dst === 0xffffffff || ip.dst === ((this.ip | ~this.mask) >>> 0)) return // multicast/broadcast
+    this.#out(icmpUnreachable(this.gwMac, mac, this.gw, ip.src, ip.dst === this.gw ? 3 : 13, quoteOf(ip)))
+  }
+
+  #dhcp(mac, u) {
+    const m = parseDhcp(u.payload)
+    if (!m) return
+    this.stats.dhcp++
+    let type
+    if (m.type === DHCP.DISCOVER) type = DHCP.OFFER
+    else if (m.type === DHCP.REQUEST || m.type === DHCP.INFORM) type = DHCP.ACK
+    else return
+    this.guestMac = m.chaddr.slice()
+    const reply = dhcpReply(m, type, { ip: this.ip, gw: this.gw, mask: this.mask })
+    this.#event({ ev: 'dhcp', type: m.type, mac: macStr(m.chaddr) })
+    this.#out(udpFrame(this.gwMac, m.chaddr, this.gw, 0xffffffff, 67, 68, reply))
+  }
+
+  #dnsQuery(mac, ip, u) {
+    const q = parseDnsQuery(u.payload)
+    if (!q) return this.#drop('bad DNS query')
+    this.stats.dnsQueries++
+    const reply = (rcode, answers = [], ttl = 60) => {
+      if (rcode === RC.NOERROR) this.stats.dnsAnswered++
+      else this.stats.dnsFailed++
+      this.#out(udpFrame(this.gwMac, mac, this.gw, ip.src, 53, u.sport, dnsResponse(u.payload, q, rcode, answers, ttl)))
+    }
+    if (q.opcode !== 0 || q.qdcount !== 1) return reply(RC.NOTIMP)
+    const name = q.name.toLowerCase().replace(/\.$/, '')
+    if (q.qclass !== 1) return reply(RC.REFUSED)
+    if (name === `gateway.${INTERNAL_ZONE}`) return reply(RC.NOERROR, q.qtype === QTYPE.A ? [u32b(this.gw)] : [])
+    if (this.peers) {
+      // W56: a guest on the switch, by its name or name.wmd.internal
+      const short = name.endsWith(`.${INTERNAL_ZONE}`) ? name.slice(0, -INTERNAL_ZONE.length - 1) : name
+      const a = this.peers.lookup(short)
+      if (a !== undefined) {
+        this.stats.dnsPeer = (this.stats.dnsPeer || 0) + 1
+        return reply(RC.NOERROR, q.qtype === QTYPE.A ? [u32b(a)] : [], PEER_TTL)
+      }
+    }
+    if (name === INTERNAL_ZONE || name.endsWith(`.${INTERNAL_ZONE}`)) return reply(RC.NXDOMAIN)
+    if (q.qtype !== QTYPE.A) return reply(RC.NOERROR) // no IPv6 route; other types: nothing
+    if (this.noRelay) return reply(RC.SERVFAIL)
+    if (!this.relay.up && !this.relay.connecting) this.relay.wake?.()
+    const id = this.nextId++
+    this.dns.set(id, { reply, name, at: this.now() })
+    this.relay.dns(id, name, QTYPE.A)
+  }
+
+  /** The relay's answer to DNS query id. rcode: RC.*, addrs: 4-byte arrays. */
+  onDnsReply(id, rcode, ttl, addrs, reason) {
+    const d = this.dns.get(id)
+    if (!d) return
+    this.dns.delete(id)
+    if (rcode !== RC.NOERROR) this.#event({ ev: 'dns', name: d.name, rcode, reason })
+    d.reply(rcode, rcode === RC.NOERROR ? addrs.filter(a => a.length === 4) : [], Math.min(Math.max(ttl, 1), 300))
+  }
+
+  // ---- TCP ----
+
+  #key(ip, s) {
+    return `${ip.src}:${s.sport}>${ip.dst}:${s.dport}`
+  }
+
+  #seg(c, flags, seq, data, opts) {
+    const win = c.phase === P_SYNACK && (flags & TCP_SYN) ? Math.min(this.#rcvWnd(c), 0xffff) : this.#rcvWnd(c) >> c.ourWs
+    if (!(flags & TCP_SYN)) c.lastWndSent = this.#rcvWnd(c)
+    this.#out(tcpFrame(this.gwMac, this.guestMac || this.gwMac, c.rip, c.gip, c.rport, c.gport, seq, c.rcvNxt, flags, win, data, opts))
+  }
+
+  #rcvWnd(c) {
+    const w = Math.max(0, RCV_BUF - c.toRelayBytes)
+    return c.ourWs ? w : Math.min(w, 0xffff)
+  }
+
+  #rst(mac, ip, s) {
+    // RFC 793: a reset for a segment with no connection
+    const len = s.payload.length + (s.flags & TCP_SYN ? 1 : 0) + (s.flags & TCP_FIN ? 1 : 0)
+    const flags = s.flags & TCP_ACK ? TCP_RST : TCP_RST | TCP_ACK
+    const seq = s.flags & TCP_ACK ? s.ack : 0
+    this.#out(tcpFrame(this.gwMac, mac, ip.dst, ip.src, s.dport, s.sport, seq, seqAdd(s.seq, len), flags, 0))
+  }
+
+  #tcp(mac, ip) {
+    const s = parseTcp(ip.payload)
+    if (!s) return this.#drop('bad TCP')
+    if (s.flags & TCP_RST) {
+      const c = this.conns.get(this.#key(ip, s))
+      if (c?.phase === P_SYNSENT) {
+        // nothing listens on the port: the peer's connect() gets ECONNREFUSED
+        if (!(s.flags & TCP_ACK) || s.ack !== seqAdd(c.iss, 1)) return
+        this.#forget(c)
+        this.stats.tcpRefused++
+        c.via.accepted(c.id, E.REFUSED, 'connection refused')
+      } else if (c) this.#close(c, 'guest reset', true)
+      return
+    }
+    let c = this.conns.get(this.#key(ip, s))
+    if (s.flags & TCP_SYN && !(s.flags & TCP_ACK)) {
+      if (c) {
+        if (s.seq === c.irs && !c.inbound) {
+          // our SYN-ACK was lost: send it again, but do not move the retransmit timer or the give-up time
+          if (c.phase === P_SYNACK && !this.#giveUpSynAck(c)) this.#seg(c, TCP_SYN | TCP_ACK, c.iss, null, { mss: OUR_MSS, wscale: c.ourWs })
+          return
+        }
+        this.#close(c, 'a new connection on the same ports', true) // a new connection on the same 4-tuple
+      }
+      return this.#syn(mac, ip, s)
+    }
+    if (!c) return this.#rst(mac, ip, s)
+    c.lastActive = this.now()
+    if (c.phase === P_CONNECTING) return // the guest retransmits its SYN until we answer
+    if (c.phase === P_SYNSENT) return this.#synAckIn(c, s)
+    if (!(s.flags & TCP_ACK)) return
+    this.#ack(c, s)
+    if (!this.conns.has(c.key) || c.phase !== P_OPEN) return
+    this.#data(c, s)
+    if (this.conns.has(c.key)) this.#maybeDone(c)
+  }
+
+  #syn(mac, ip, s) {
+    const dst = ip.dst
+    const local = ((dst & this.mask) >>> 0) === ((this.gw & this.mask) >>> 0)
+    const why =
+      dst === this.gw ? 'the gateway has no TCP services' :
+      dst === this.ip || (dst >>> 24) === 127 || dst === 0 || dst >>> 28 >= 14 || dst === ((this.ip | ~this.mask) >>> 0) ? 'not a remote address' :
+      local && !this.peers ? 'nothing else is on the guest network' :
+      local && !this.peers.has(dst) ? 'no guest on the network has that address' :
+      this.conns.size >= this.maxConns ? `more than ${this.maxConns} connections at once` :
+      this.#pending() >= MAX_PENDING && !this.#evictOldestSynAck() ? `more than ${MAX_PENDING} connections being opened at once` : ''
+    if (why) {
+      this.stats.tcpRefused++
+      this.stats.refusedBy.local = (this.stats.refusedBy.local || 0) + 1
+      this.#event({ ev: 'refused', to: `${u32ToIp(dst)}:${s.dport}`, why })
+      return this.#rst(mac, ip, s)
+    }
+    if (!this.guestMac) this.guestMac = mac.slice()
+    const id = this.nextId++
+    const c = new Conn(this.#key(ip, s), id, s, ip)
+    c.via = local ? this.peers : this.relay
+    c.openedAt = c.lastActive = this.now()
+    this.conns.set(c.key, c)
+    this.byId.set(id, c)
+    if (local) this.peers.connect(id, dst, s.dport, s.sport)
+    else this.relay.connect(id, u32ToIp(dst), s.dport)
+  }
+
+  /** The stack still has stream id (a transport asks before it acts on a late answer). */
+  hasConn(id) {
+    return this.byId.has(id)
+  }
+
+  /**
+   * W56: a guest on the switch (at rip, from its port rport) opens a connection to this guest's
+   * port gport: SYN the guest; via.accepted(id, code) once it answers. Returns the stream id, or
+   * null when it is refused at once.
+   */
+  peerOpen(rip, rport, gport, via) {
+    const key = `${this.ip}:${gport}>${rip}:${rport}`
+    const why =
+      !this.guestMac ? 'the guest has no network yet' :
+      this.conns.has(key) ? 'a connection on the same ports is open' :
+      this.conns.size >= this.maxConns ? `more than ${this.maxConns} connections at once` : ''
+    if (why) {
+      this.#event({ ev: 'refused-in', from: `${u32ToIp(rip)}:${rport}`, to: gport, why })
+      return null
+    }
+    const id = this.nextId++
+    const c = new Conn(key, id, { sport: gport, dport: rport, seq: 0, wscale: -1, mss: OUR_MSS, win: 0 }, { src: this.ip, dst: rip })
+    c.via = via
+    c.phase = P_SYNSENT
+    c.inbound = true
+    c.ourWs = OUR_WS
+    c.sndNxt = seqAdd(c.iss, 1)
+    c.openedAt = c.lastActive = c.synAckAt = this.now()
+    c.relayCredit = WINDOW // the opener's grant: it takes WINDOW bytes before it says more
+    this.conns.set(key, c)
+    this.byId.set(id, c)
+    this.stats.peerIn = (this.stats.peerIn || 0) + 1
+    this.#synOut(c)
+    return id
+  }
+
+  #synOut(c) {
+    this.#out(tcpFrame(this.gwMac, this.guestMac, c.rip, c.gip, c.rport, c.gport, c.iss, 0, TCP_SYN, Math.min(RCV_BUF, 0xffff), null, { mss: OUR_MSS, wscale: OUR_WS }))
+    c.rtoAt = this.now() + c.rto
+  }
+
+  /** W56: the guest's answer to our SYN. */
+  #synAckIn(c, s) {
+    if (!(s.flags & TCP_SYN) || !(s.flags & TCP_ACK) || s.ack !== seqAdd(c.iss, 1)) return
+    c.irs = s.seq
+    c.rcvNxt = seqAdd(s.seq, 1)
+    c.guestWs = s.wscale >= 0 ? s.wscale : -1
+    c.ourWs = c.guestWs >= 0 ? OUR_WS : 0 // window scaling only when both offered it
+    c.mss = Math.min(s.mss || 536, OUR_MSS)
+    c.sndUna = c.sndNxt = seqAdd(c.iss, 1)
+    c.sndWnd = s.win // a SYN's window is not scaled
+    c.phase = P_OPEN
+    c.rto = RTO_MIN
+    c.rtoAt = 0
+    this.stats.tcpOpened++
+    this.#seg(c, TCP_ACK, c.sndNxt, null)
+    c.via.accepted(c.id, E.OK)
+    this.wantsSend.add(c)
+    this.#trySend(c)
+  }
+
+  #pending() {
+    let n = 0
+    for (const c of this.conns.values()) if (c.phase !== P_OPEN) n++
+    return n
+  }
+
+  /** The pending cap is full: the oldest handshake that is not open yet gives way to the new SYN, so a flood of half-open handshakes cannot lock out real connects. False if none can go. */
+  #evictOldestSynAck() {
+    let old = null
+    for (const c of this.conns.values()) if (c.phase !== P_OPEN && (!old || c.openedAt < old.openedAt)) old = c
+    if (!old) return false
+    this.#abandon(old, 'evicted for a newer SYN')
+    return true
+  }
+
+  #abandon(c, why) {
+    this.stats.handshakesAbandoned = (this.stats.handshakesAbandoned || 0) + 1
+    this.#event({ ev: 'abandoned', to: `${u32ToIp(c.rip)}:${c.rport}`, why })
+    this.#forget(c)
+    c.via.abort(c.id)
+    this.#out(tcpFrame(this.gwMac, this.guestMac || this.gwMac, c.rip, c.gip, c.rport, c.gport, c.sndNxt, c.rcvNxt, TCP_RST | TCP_ACK, 0))
+  }
+
+  /** A handshake the guest never finishes is given up after SYNACK_GIVE_UP_MS (counted from the first SYN-ACK, whatever the guest re-sends). True if it was given up. */
+  #giveUpSynAck(c) {
+    if (c.phase !== P_SYNACK || this.now() - c.synAckAt <= SYNACK_GIVE_UP_MS) return false
+    this.#abandon(c, 'no ACK for the SYN-ACK')
+    return true
+  }
+
+  #synAck(c) {
+    this.#seg(c, TCP_SYN | TCP_ACK, c.iss, null, { mss: OUR_MSS, wscale: c.ourWs })
+    c.rtoAt = this.now() + c.rto
+  }
+
+  /** The relay's answer to a connect. */
+  onConnected(id, code, credit, detail) {
+    const c = this.byId.get(id)
+    if (!c || c.phase !== P_CONNECTING) {
+      if (!c && code === E.OK) this.relay.abort(id) // a connect that came back after we gave up on it
+      return
+    }
+    if (code !== E.OK) {
+      this.stats.tcpRefused++
+      const name = E_NAMES[code] || `code ${code}`
+      this.stats.refusedBy[name] = (this.stats.refusedBy[name] || 0) + 1
+      this.#event({ ev: 'refused', to: `${u32ToIp(c.rip)}:${c.rport}`, why: name, detail })
+      this.log(`net: connect to ${u32ToIp(c.rip)}:${c.rport} refused by the relay: ${name}${detail ? ` (${detail})` : ''}`)
+      this.#forget(c)
+      // RST|ACK acknowledging the SYN: the guest's connect() fails with ECONNREFUSED
+      this.#out(tcpFrame(this.gwMac, this.guestMac, c.rip, c.gip, c.rport, c.gport, 0, c.rcvNxt, TCP_RST | TCP_ACK, 0))
+      return
+    }
+    this.stats.tcpOpened++
+    const ms = this.now() - c.openedAt
+    this.stats.connectMs.push(Math.round(ms * 10) / 10)
+    if (this.stats.connectMs.length > 100) this.stats.connectMs.shift()
+    c.relayCredit = credit
+    c.phase = P_SYNACK
+    c.synAckAt = this.now()
+    c.sndNxt = seqAdd(c.iss, 1)
+    this.#synAck(c)
+  }
+
+  #ack(c, s) {
+    const ack = s.ack
+    if (c.phase === P_SYNACK) {
+      if (ack !== seqAdd(c.iss, 1)) return // not for our SYN-ACK
+      c.phase = P_OPEN
+      c.sndUna = ack
+      c.rto = RTO_MIN
+      c.rtoAt = 0
+      c.sndWnd = s.win << Math.max(c.guestWs, 0)
+      this.wantsSend.add(c)
+      this.#trySend(c)
+      return
+    }
+    const wnd = s.win << Math.max(c.guestWs, 0)
+    if (seqLt(c.sndUna, ack) && seqLe(ack, c.sndNxt)) {
+      let n = seqDiff(ack, c.sndUna)
+      c.sndUna = ack
+      if (c.finSent && ack === seqAdd(c.finSeq, 1)) {
+        c.finAcked = true
+        n--
+      }
+      if (n > 0) {
+        this.#takeAcked(c, n)
+        c.via.credit(c.id, n) // the relay may send what the guest has taken
+      }
+      c.dupAcks = 0
+      c.rto = RTO_MIN
+      c.rtoAt = c.inflight() > 0 ? this.now() + c.rto : 0
+      c.sndWnd = wnd
+      this.wantsSend.add(c)
+      this.#trySend(c)
+      return
+    }
+    if (ack === c.sndUna && !s.payload.length && !(s.flags & TCP_FIN)) {
+      const opened = wnd > c.sndWnd
+      c.sndWnd = wnd
+      if (opened) {
+        this.wantsSend.add(c)
+        this.#trySend(c)
+      } else if (c.inflight() > 0 && ++c.dupAcks === 3) {
+        this.stats.dupAckRetransmits++
+        c.sndNxt = c.sndUna // go back: the segment after the ACK was lost
+        if (c.finSent && !c.finAcked) c.finSent = false
+        this.#trySend(c)
+      }
+    }
+  }
+
+  #takeAcked(c, n) {
+    c.sendQBytes -= n
+    while (n > 0 && c.sendQ.length) {
+      const h = c.sendQ[0]
+      if (h.length <= n) {
+        n -= h.length
+        c.sendQ.shift()
+      } else {
+        c.sendQ[0] = h.subarray(n)
+        n = 0
+      }
+    }
+  }
+
+  #data(c, s) {
+    const len = s.payload.length
+    const fin = !!(s.flags & TCP_FIN)
+    if (!len && !fin) {
+      // an old sequence number with no data is the guest's zero-window probe (or a keepalive):
+      // answer with our window, as RFC 9293 3.10.7.4 says for any unacceptable segment
+      if (seqLt(s.seq, c.rcvNxt)) {
+        c.needAck = true
+        this.acks.add(c)
+      }
+      return
+    }
+    let data = s.payload
+    let seq = s.seq
+    if (c.guestFin) {
+      c.needAck = true // a retransmission after its FIN
+      this.acks.add(c)
+      return
+    }
+    if (seqLt(seq, c.rcvNxt)) {
+      const skip = seqDiff(c.rcvNxt, seq)
+      if (skip >= len + (fin ? 1 : 0)) {
+        c.needAck = true
+        this.acks.add(c)
+        return // all old
+      }
+      data = data.subarray(Math.min(skip, len))
+      seq = c.rcvNxt
+    }
+    if (seq !== c.rcvNxt) {
+      c.needAck = true // a gap: ask again for what we expect
+      this.acks.add(c)
+      return
+    }
+    const room = this.#rcvWnd(c)
+    const take = Math.min(data.length, room)
+    if (take) {
+      const chunk = data.slice(0, take)
+      c.toRelay.push(chunk)
+      c.toRelayBytes += take
+      c.bytesIn += take
+      this.stats.payloadIn += take
+      c.rcvNxt = seqAdd(c.rcvNxt, take)
+    }
+    if (fin && take === data.length) {
+      c.rcvNxt = seqAdd(c.rcvNxt, 1)
+      c.guestFin = true
+    }
+    c.needAck = true
+    this.acks.add(c) // flushAcks() sends what came in this batch to the relay, coalesced, then the ACK
+  }
+
+  /** Send held guest bytes to the relay as credit allows, in messages of up to MAX_DATA (one per segment cost a WebSocket message each). */
+  #flushToRelay(c) {
+    while (c.toRelay.length && c.relayCredit > 0) {
+      const n = Math.min(c.toRelayBytes, c.relayCredit, MAX_DATA)
+      let part
+      if (c.toRelay[0].length >= n) {
+        const h = c.toRelay[0]
+        part = h.subarray(0, n)
+        if (h.length === n) c.toRelay.shift()
+        else c.toRelay[0] = h.subarray(n)
+      } else {
+        part = new Uint8Array(n)
+        let o = 0
+        while (o < n) {
+          const h = c.toRelay[0]
+          const k = Math.min(h.length, n - o)
+          part.set(h.subarray(0, k), o)
+          o += k
+          if (k === h.length) c.toRelay.shift()
+          else c.toRelay[0] = h.subarray(k)
+        }
+      }
+      c.toRelayBytes -= n
+      c.relayCredit -= n
+      c.via.data(c.id, part)
+    }
+    if (c.guestFin && !c.toRelay.length && !c.relayEndSent) {
+      c.relayEndSent = true
+      c.via.end(c.id)
+    }
+  }
+
+  onRelayCredit(id, n) {
+    const c = this.byId.get(id)
+    if (!c) return
+    const before = this.#rcvWnd(c)
+    c.relayCredit += n
+    this.#flushToRelay(c)
+    // the window opened since the guest last heard (by two segments, or from below one): tell it
+    const now = this.#rcvWnd(c)
+    if (c.phase === P_OPEN && before < now && (now - c.lastWndSent >= 2 * c.mss || (c.lastWndSent < c.mss && now >= c.mss))) {
+      c.needAck = true
+      this.acks.add(c)
+    }
+    this.#maybeDone(c)
+  }
+
+  onRelayData(id, u8) {
+    const c = this.byId.get(id)
+    if (!c) return
+    if (c.remoteEnd) return
+    c.lastRemote = this.now()
+    c.sendQ.push(u8)
+    c.sendQBytes += u8.length
+    c.bytesOut += u8.length
+    this.stats.payloadOut += u8.length
+    this.wantsSend.add(c)
+    this.#trySend(c)
+  }
+
+  onRelayEnd(id) {
+    const c = this.byId.get(id)
+    if (!c) return
+    c.remoteEnd = true
+    c.lastRemote = this.now()
+    this.wantsSend.add(c)
+    this.#trySend(c)
+  }
+
+  onRelayAbort(id, code, reason) {
+    const c = this.byId.get(id)
+    if (!c) return
+    if (c.phase === P_CONNECTING) return this.onConnected(id, code || E.GONE, 0, reason)
+    this.#event({ ev: 'abort', to: `${u32ToIp(c.rip)}:${c.rport}`, why: E_NAMES[code] || code, reason })
+    this.#close(c, `relay: ${E_NAMES[code] || code} ${reason || ''}`.trim(), false)
+  }
+
+  /** The relay connection is gone: every stream fails (RST), every lookup fails. */
+  onRelayDown(why) {
+    for (const c of [...this.conns.values()]) {
+      if (c.via !== this.relay) continue // W56: a stream to a guest on the switch does not use the relay
+      if (c.phase === P_CONNECTING) this.onConnected(c.id, E.GONE, 0, why)
+      else this.#close(c, `relay down: ${why}`, false)
+    }
+    for (const id of [...this.dns.keys()]) this.onDnsReply(id, RC.SERVFAIL, 0, [], why)
+  }
+
+  /** Send what the guest's window and the ring allow. */
+  #trySend(c) {
+    if (c.phase !== P_OPEN || !this.conns.has(c.key)) return
+    for (;;) {
+      const off = c.inflight()
+      const avail = c.sendQBytes - off
+      if (avail > 0) {
+        const wnd = c.sndWnd - off
+        const room = this.txRoom()
+        if (wnd <= 0 || room <= 0) break
+        const n = Math.min(avail, wnd, c.mss, room)
+        const data = peek(c.sendQ, off, n)
+        this.#seg(c, TCP_ACK | (n === avail ? TCP_PSH : 0), c.sndNxt, data)
+        c.needAck = false
+        c.sndNxt = seqAdd(c.sndNxt, n)
+        if (!c.rtoAt) c.rtoAt = this.now() + c.rto
+        continue
+      }
+      if (c.remoteEnd && !c.finSent && avail === 0) {
+        c.finSent = true
+        c.finSeq = c.sndNxt
+        this.#seg(c, TCP_FIN | TCP_ACK, c.sndNxt, null)
+        c.needAck = false
+        c.sndNxt = seqAdd(c.sndNxt, 1)
+        if (!c.rtoAt) c.rtoAt = this.now() + c.rto
+      }
+      break
+    }
+    if (c.sendQBytes - c.inflight() <= 0 && (!c.remoteEnd || c.finSent)) this.wantsSend.delete(c)
+  }
+
+  /** More room in the guest's ring: send what waited. */
+  pump() {
+    for (const c of [...this.wantsSend]) {
+      if (this.txRoom() <= 0) break
+      this.#trySend(c)
+    }
+  }
+
+  #maybeDone(c) {
+    if (c.guestFin && c.finAcked && c.relayEndSent) {
+      this.stats.tcpFinished++
+      this.#forget(c)
+      c.via.closed?.(c.id) // a peer's stream ends with no abort: drop its record
+    }
+  }
+
+  /** End a connection; tell the relay (abort) unless it told us; RST the guest unless it reset. */
+  #close(c, why, fromGuest) {
+    if (!this.conns.has(c.key)) return
+    this.#forget(c)
+    if (fromGuest) {
+      c.via.abort(c.id)
+      return
+    }
+    this.stats.tcpReset++
+    this.#event({ ev: 'reset', to: `${u32ToIp(c.rip)}:${c.rport}`, why, sent: c.bytesOut, recv: c.bytesIn })
+    this.#out(tcpFrame(this.gwMac, this.guestMac, c.rip, c.gip, c.rport, c.gport, c.sndNxt, c.rcvNxt, TCP_RST | TCP_ACK, 0))
+  }
+
+  #forget(c) {
+    this.conns.delete(c.key)
+    this.byId.delete(c.id)
+    this.wantsSend.delete(c)
+    this.acks.delete(c)
+  }
+
+  /** After a batch of input: one ACK per connection that needs one. */
+  flushAcks() {
+    for (const c of this.acks) {
+      if (this.conns.has(c.key)) this.#flushToRelay(c)
+      if (c.needAck && this.conns.has(c.key) && c.phase === P_OPEN) this.#seg(c, TCP_ACK, c.sndNxt, null)
+      c.needAck = false
+      if (this.conns.has(c.key)) this.#maybeDone(c)
+    }
+    this.acks.clear()
+  }
+
+  /** Timers: retransmission, zero-window probes, connect and DNS timeouts. Call every ~100 ms. */
+  tick() {
+    const t = this.now()
+    for (const c of [...this.conns.values()]) {
+      if (c.phase === P_CONNECTING) {
+        if (t - c.openedAt > CONNECT_TIMEOUT_MS) {
+          c.via.abort(c.id)
+          this.onConnected(c.id, E.TIMEOUT, 0, 'no answer from the relay')
+        }
+        continue
+      }
+      if (c.phase === P_SYNSENT) {
+        if (t - c.synAckAt > SYNACK_GIVE_UP_MS) {
+          this.#forget(c)
+          c.via.accepted(c.id, E.TIMEOUT, 'the guest did not answer')
+        } else if (c.rtoAt && t >= c.rtoAt) {
+          c.rto = Math.min(c.rto * 2, RTO_MAX)
+          this.stats.retransmits++
+          this.#synOut(c)
+        }
+        continue
+      }
+      if (this.#giveUpSynAck(c)) continue
+      if (c.rtoAt && t >= c.rtoAt) {
+        c.rto = Math.min(c.rto * 2, RTO_MAX)
+        c.rtoAt = t + c.rto
+        if (c.phase === P_SYNACK) {
+          if (this.#giveUpSynAck(c)) continue
+          this.stats.retransmits++
+          this.#seg(c, TCP_SYN | TCP_ACK, c.iss, null, { mss: OUR_MSS, wscale: c.ourWs })
+          continue
+        }
+        if (c.inflight() > 0) {
+          this.stats.retransmits++
+          c.sndNxt = c.sndUna
+          if (c.finSent && !c.finAcked) c.finSent = false
+          this.#trySend(c)
+        } else if (c.sendQBytes > 0 && c.sndWnd === 0) {
+          this.stats.probes++
+          this.#seg(c, TCP_ACK, seqAdd(c.sndUna, -1 >>> 0), null) // a window probe: an old sequence number makes the guest ACK with its window
+        } else c.rtoAt = 0
+      } else if (!c.rtoAt && c.sendQBytes > c.inflight() && c.sndWnd - c.inflight() <= 0) {
+        c.rtoAt = t + c.rto // the persist timer
+      }
+      if (c.remoteEnd && c.finAcked && !c.guestFin && t - c.lastActive > HALF_OPEN_IDLE_MS) this.#close(c, 'half-open and idle', false)
+      else if (c.guestFin && !c.remoteEnd && t - Math.max(c.lastActive, c.lastRemote) > GUEST_CLOSED_IDLE_MS) {
+        // the guest closed and the remote has been silent since: nobody will end it; tell the relay
+        c.via.abort(c.id)
+        this.#close(c, 'closed by the guest, the remote silent', false)
+      }
+    }
+    for (const [id, d] of this.dns) if (t - d.at > DNS_TIMEOUT_MS) this.onDnsReply(id, RC.SERVFAIL, 0, [], 'timed out')
+  }
+
+  snapshot() {
+    return { ...this.stats, conns: this.conns.size, pendingDns: this.dns.size, events: this.events.slice(-60) }
+  }
+}
+
+/** The IP header and 8 bytes of an IP packet, for an ICMP error. */
+function quoteOf(ip) {
+  const q = new Uint8Array(ip.header.length + Math.min(8, ip.payload.length))
+  q.set(ip.header)
+  q.set(ip.payload.subarray(0, 8), ip.header.length)
+  return q
+}
+
+function u32b(v) {
+  return Uint8Array.of(v >>> 24, (v >>> 16) & 255, (v >>> 8) & 255, v & 255)
+}
+
+/** n bytes at offset off of a chunk list (a view when it is in one chunk). */
+function peek(chunks, off, n) {
+  let i = 0
+  while (off >= chunks[i].length) off -= chunks[i++].length
+  if (chunks[i].length - off >= n) return chunks[i].subarray(off, off + n)
+  const out = new Uint8Array(n)
+  let o = 0
+  while (o < n) {
+    const c = chunks[i++]
+    const k = Math.min(c.length - off, n - o)
+    out.set(c.subarray(off, off + k), o)
+    o += k
+    off = 0
+  }
+  return out
+}