librats 1.0.2 → 2.2.0

package/native-src/src/librats/subsystems/relay.h

@@ -0,0 +1,211 @@
+#pragma once
+
+/**
+ * @file relay.h
+ * @brief Reaching a peer through a node both ends can already reach.
+ *
+ * The last rung of the connectivity ladder. A direct dial handles the easy cases;
+ * PortMappingService and HolePunch handle most of the rest. What is left is the
+ * pair of nodes for which no endpoint either one can advertise will ever work —
+ * a symmetric NAT on one side, a network that drops UDP and blocks inbound TCP,
+ * a punch that simply never lands. For them the only way through is to borrow a
+ * path: a node connected to both carries the bytes.
+ *
+ * ── What is relayed, and what is not ────────────────────────────────────────
+ * The relayed thing is a *byte stream*, not a message. It becomes a `Circuit` and
+ * a `RelayLink` (transport/relay_link.h), the reactor adopts it as an ordinary
+ * Connection, and everything above the Link runs unchanged — which is why:
+ *
+ *   - the Noise_XX handshake is END TO END. The relay moves ciphertext it cannot
+ *     read, cannot forge and cannot replay. It is a pipe, not a party, and it
+ *     learns nothing beyond who is talking to whom and how much;
+ *   - the peers authenticate each other's real keys, so a relay cannot substitute
+ *     itself for either end;
+ *   - every subsystem — pub/sub, file transfer, PEX — works over a relayed peer
+ *     with no code of its own. To the application it is simply a peer, and
+ *     PeerInfo::transport is the only thing that says otherwise.
+ *
+ * ── Finding a relay ─────────────────────────────────────────────────────────
+ * This stage covers the case where the two ends share a peer — the same topology
+ * HolePunch already relies on for its rendezvous, and the one a bootstrap or DHT
+ * mesh produces on its own. The initiator asks a few of its peers "do you hold
+ * this id?" (Probe) and opens a circuit with the first that says yes. Probing
+ * first, rather than opening with everybody at once, is what keeps a successful
+ * search from producing three redundant connections to the same peer — each with
+ * its own handshake — for the peer table to then tear two of down.
+ *
+ * Not covered here, deliberately: reaching a peer with whom we share NO peer. That
+ * needs reservations (a node asking a relay to hold a slot for it) and a way to
+ * advertise "reachable via R" as an address, which touches identify and PEX. The
+ * version byte and the free op-codes in the wire format leave room for it.
+ *
+ * ── Getting off the relay again ─────────────────────────────────────────────
+ * A circuit is a fallback, not a destination: it costs a third node bandwidth and
+ * a round trip. So when one comes up, this module asks HolePunch to try the target
+ * again — now that the two ends are peers, they can exchange what a punch needs
+ * over the very circuit that is carrying them. If the punch lands, PeerTable::add
+ * prefers the direct link at BOTH ends (any direct transport outranks Relay) and
+ * swaps the route with no disconnect event: the application never sees the seam.
+ *
+ * ── Carrying other peers' traffic ───────────────────────────────────────────
+ * Serving as a relay is off by default. Forwarding a rendezvous, as HolePunch
+ * does, is a few dozen bytes; forwarding a connection is somebody else's file
+ * transfer on your uplink, and that is a decision to be made rather than assumed.
+ * A node that turns it on is protected by, in order of how much they matter:
+ *
+ *   - the end-to-end credit window (transport/relay_link.h), which bounds what one
+ *     circuit can make the relay hold no matter what either end does. Without it a
+ *     slow receiver would grow the relay's send queue until the relay dropped that
+ *     peer entirely — losing all of its traffic, not just the circuit's;
+ *   - forwarding only between peers it already holds. A relay never dials, never
+ *     resolves an address, and can only ever deliver to somebody that chose to
+ *     connect to it, so it cannot be turned into an open reflector;
+ *   - no chaining. A circuit is refused if either end is itself only reachable
+ *     through a relay, which is what stops loops and multi-hop amplification;
+ *   - per-circuit byte and duration caps, per-peer and total circuit counts, and a
+ *     rate limit on the requests themselves.
+ *
+ * ── Threading ───────────────────────────────────────────────────────────────
+ * Message handlers run on reactor threads; one worker thread drives attempt
+ * timeouts and the relay's own expiry. The tables are behind one mutex, which is
+ * never held across a call into a circuit or the reactor — a circuit is touched
+ * only by the reactor thread that owns its connection, which is by construction
+ * the thread that owns its carrier's (see node/circuit_service.h).
+ */
+
+#include "librats/util/rats_export.h"
+#include "librats/core/service_registry.h"
+#include "librats/node/peer_network.h"
+#include "librats/peer/peer_id.h"
+#include "librats/subsystems/relay_service.h"
+#include "librats/transport/relay_link.h"   // Circuit::kDefaultWindow
+
+#include <atomic>
+#include <chrono>
+#include <condition_variable>
+#include <cstdint>
+#include <memory>
+#include <mutex>
+#include <thread>
+
+namespace librats {
+
+class RATS_API Relay final : public Subsystem, public RelayService {
+public:
+    struct Config {
+        // ── Using relays to reach peers we cannot dial ──────────────────────
+
+        /// Open circuits through other peers. Off makes this a relay-only node.
+        bool enable_client = true;
+
+        /// Peers asked whether they hold a target, per attempt. Small: each probe
+        /// is a question to somebody who probably cannot help, and one useful
+        /// answer is all an attempt needs.
+        size_t max_probes = 3;
+
+        /// Circuits this node may hold open as a client at once. Bounds both memory
+        /// and how many relayed peers a discovery module can talk us into.
+        size_t max_outbound_circuits = 8;
+
+        /// How long an attempt may take from the first probe to a live connection.
+        /// Covers the probe round trip, the circuit setup, and the handshake across
+        /// two hops.
+        std::chrono::milliseconds open_timeout{8000};
+
+        /// How long after a failed attempt before the same target may be tried
+        /// again. Only an attempt WE started ever ends in one.
+        std::chrono::milliseconds cooldown{60000};
+
+        // ── Accepting circuits opened to us ─────────────────────────────────
+
+        /// Accept circuits other peers open toward us. Off makes this node
+        /// unreachable by relay, which is a choice a well-connected node can make.
+        bool accept_inbound = true;
+
+        /// Circuits opened TO us that may be live at once.
+        size_t max_inbound_circuits = 16;
+
+        // ── Carrying other peers' traffic ───────────────────────────────────
+
+        /// Serve as a relay. OFF by default: unlike a hole-punch rendezvous, this
+        /// spends real bandwidth on somebody else's connection, so it is opted into
+        /// rather than assumed. A mesh in which nobody serves cannot relay at all.
+        bool serve = false;
+
+        /// Circuits this node will carry for others at once.
+        size_t max_circuits = 32;
+
+        /// Circuits one peer may have us carrying, so a single peer cannot take the
+        /// whole budget.
+        size_t max_circuits_per_peer = 2;
+
+        /// Bytes one circuit may move before it is closed. 0 removes the cap. The
+        /// default is generous for a fallback path and still bounds what one pair
+        /// of peers can spend of ours.
+        uint64_t max_bytes_per_circuit = 64ull * 1024 * 1024;
+
+        /// How long one circuit may live. 0 removes the cap.
+        std::chrono::seconds max_circuit_duration{600};
+
+        /// Requests (probes and circuit openings) one peer may make per window.
+        size_t                    request_budget = 8;
+        std::chrono::milliseconds request_window{1000};
+
+        // ── Both ends ───────────────────────────────────────────────────────
+
+        /// Bytes this node is willing to have in flight per circuit — the credit
+        /// window it advertises (see transport/relay_link.h). Raising it makes a
+        /// relayed peer faster on a long path and asks the relay to hold more.
+        uint32_t window = Circuit::kDefaultWindow;
+
+        /// When a relayed peer connects, ask HolePunch to try it directly, so the
+        /// circuit is replaced by a direct link as soon as one is possible. Costs
+        /// nothing when no HolePunch is attached.
+        bool upgrade_with_hole_punch = true;
+
+        /// Bookkeeping cadence — attempt timeouts, cooldowns, circuit expiry.
+        std::chrono::milliseconds tick{250};
+    };
+
+    Relay();
+    explicit Relay(Config config);
+    ~Relay() override;
+
+    void attach(NodeContext& ctx) override;
+    void start() override;
+    void stop() override;
+
+    /// @copydoc RelayService::connect_via_relay
+    bool connect_via_relay(const PeerId& target) override;
+
+    // — diagnostics and tests —
+    /// Circuits this node terminates (relayed peers, live or still being set up).
+    size_t circuits() const;
+    /// Circuits this node is carrying on behalf of other peers.
+    size_t carried_circuits() const;
+    /// Bytes forwarded on behalf of other peers.
+    uint64_t carried_bytes() const;
+    /// Attempts to reach a peer through a relay that are currently running.
+    size_t attempts() const;
+
+private:
+    /// Everything mutable, held by shared_ptr because a Connection — and therefore
+    /// the Link that reports its circuit released — can outlive this subsystem: the
+    /// node stops subsystems before it stops the reactors that own the connections.
+    struct State;
+
+    Config                 config_;
+    std::shared_ptr<State> state_;
+    /// Kept from attach() so start() can resolve HolePunchService — which may be
+    /// attached after us, and is only guaranteed to have registered by then.
+    ServiceRegistry*       services_ = nullptr;
+
+    std::thread             worker_;
+    std::atomic<bool>       running_{false};
+    std::mutex              worker_mutex_;
+    std::condition_variable worker_cv_;
+
+    void loop();
+};
+
+} // namespace librats

package/native-src/src/librats/subsystems/relay_service.h

@@ -0,0 +1,46 @@
+#pragma once
+
+/**
+ * @file relay_service.h
+ * @brief Capability that lets a sibling module ask for a peer to be reached
+ *        through a third node, by PeerId.
+ *
+ * Published by Relay via ServiceRegistry (see service_registry.h). It is the last
+ * rung of the connectivity ladder — a direct dial, then a hole punch, then this —
+ * and the module that gives up on the rung above should not have to know anything
+ * about how the rung below works. HolePunch, for instance, learns that a target is
+ * unreachable (a symmetric NAT it declined to punch, or a rendezvous that ran out
+ * of attempts) and this is the whole contract it needs to hand the id on: no relay
+ * selection, no circuits, no policy, all of which are Relay's own business.
+ *
+ * Resolving it returns nullptr when relaying is not enabled, which is exactly what
+ * makes the fallback optional at the consumer's side:
+ *
+ *     if (auto* relay = ctx.services.get<RelayService>()) relay->connect_via_relay(id);
+ *
+ * The provider registers during attach(), so resolve it in start() (every attach()
+ * runs before any start()) rather than in your own attach(), where the provider may
+ * not have been attached yet. The pointer is NON-owning and valid while the node is.
+ */
+
+#include "librats/util/rats_export.h"
+#include "librats/peer/peer_id.h"
+
+namespace librats {
+
+struct RATS_API RelayService {
+    virtual ~RelayService() = default;
+
+    /// Try to reach `target` through a node both ends are connected to.
+    /// Non-blocking; success surfaces as an ordinary peer-connected event, and the
+    /// resulting peer is ordinary in every way except that its bytes take a detour
+    /// (PeerInfo::transport is TransportKind::Relay).
+    ///
+    /// @return whether an attempt actually started — false is routine (already
+    ///         connected, an attempt is already running, the target is in cooldown,
+    ///         or this node has no peer that could carry the circuit) and needs no
+    ///         handling by the caller.
+    virtual bool connect_via_relay(const PeerId& target) = 0;
+};
+
+} // namespace librats

package/native-src/src/librats/transport/connection.cpp

@@ -0,0 +1,343 @@
+#include "librats/transport/connection.h"
+#include "librats/transport/reactor.h"
+#include "librats/core/io_poller.h"
+#include "librats/util/logger.h"
+
+#include <algorithm>
+#include <cerrno>
+#include <cstring>
+
+namespace librats {
+
+namespace {
+
+constexpr size_t kRecvChunk = 16 * 1024;  ///< bytes offered to each recv()
+
+/// Ceiling on how far rx_ may be grown on the strength of a *declared* block length
+/// alone. Sizing the buffer for the whole block up front (as libtorrent does, growing
+/// straight to packet_size) turns a large frame into one allocation instead of a
+/// 1.5x-at-a-time climb that memmoves everything received so far at every step. But
+/// the length is the peer's word: a 4-byte prefix claiming kMaxBlockSize must not
+/// make us allocate 64 MiB for a peer that then sends nothing. Past this, growth
+/// falls back to geometric, so the allocation only ever tracks bytes that really
+/// arrived — a big block still costs a handful of reallocations, not tens.
+constexpr size_t kMaxEagerReserve = 1024 * 1024;
+
+/// Frames up to this size are copied into the send queue rather than moved into a
+/// chunk of their own (see queue_block). Matches the queue's scratch chunk, so a
+/// small frame and its length prefix land in the same allocation.
+constexpr size_t kInlineBlockLimit = ChainedSendBuffer::kScratchCapacity;
+
+} // namespace
+
+Connection::Connection(ConnId id, std::unique_ptr<Link> link, ConnRole role,
+                       Reactor& reactor, ConnectionDelegate& delegate)
+    : id_(id), link_(std::move(link)), role_(role), reactor_(reactor), delegate_(delegate) {}
+
+Connection::~Connection() = default;
+
+IpAddress Connection::remote_ip() const {
+    // The peer's source IP as the transport sees it, with no textual round-trip.
+    // (The source port is not dialable — ephemeral on TCP, NAT-rewritten on UDP —
+    // so it is discarded; identify supplies the real listen port.)
+    const auto ep = link_->remote_endpoint();
+    return ep ? ep->ip : IpAddress{};
+}
+
+uint8_t Connection::reactor_index() const noexcept { return reactor_.index(); }
+
+// ── Outbound application frames ─────────────────────────────────────────────
+
+bool Connection::send(FrameHeader header, ByteView payload) {
+    if (state_ != ConnState::Established) return false;  // frames only flow post-handshake
+
+    Bytes inner;
+    framer::encode_message(inner, header, payload);
+
+    Bytes cipher;
+    if (!session_->encrypt(inner, cipher)) {
+        LOG_ERROR("connection", "Peer " << remote_id_.short_hex() << " encrypt failed");
+        reactor_.close(id_, CloseReason::ProtocolError);
+        return false;
+    }
+
+    queue_block(std::move(cipher));
+
+    const size_t backlog_now = backlog();
+    if (backlog_now > send_high_water_) {
+        LOG_WARN("connection", "Peer " << remote_id_.short_hex() << " over send high-water ("
+                 << backlog_now << " B); closing as slow consumer");
+        close_reason_ = CloseReason::SlowConsumer;
+        state_ = ConnState::Closing;
+        reactor_.close(id_, CloseReason::SlowConsumer);
+        return false;
+    }
+
+    // The queue has grown past what a caller should keep adding to. Everything
+    // still goes out — nothing is dropped here — but the answer to "may I send
+    // more?" becomes no, and stays no until the queue drains back under the mark
+    // and on_writable says so. Without this an application has no way at all to
+    // tell that it is outrunning the link, and the only thing that eventually
+    // tells it is the disconnection above.
+    if (!over_low_water_ && backlog_now > send_low_water_) {
+        over_low_water_ = true;
+        delegate_.on_writable_changed(*this, false);
+    }
+
+    // Aggregate rather than write through. Several frames produced in one batch
+    // of reactor tasks belong in ONE write, and flushing on each of them costs a
+    // system call per frame — measured at roughly ten times the throughput on
+    // small messages, on both transports. The flush happens at the end of the
+    // reactor turn (Reactor::flush_dirty), which is still the same turn: nothing
+    // waits on a timer and no latency is added.
+    //
+    // Past a point, though, waiting buys nothing: a backlog this size already
+    // fills a write, and letting it grow further would only hold memory and
+    // delay the bytes. So a large queue goes out at once, exactly as before.
+    if (tx_.size() >= kCoalesceLimit) {
+        if (!flush()) reactor_.close(id_, close_reason_);
+    } else if (!flush_queued_) {
+        flush_queued_ = true;
+        reactor_.mark_dirty(id_);
+    }
+    return !over_low_water_;
+}
+
+bool Connection::flush_pending() {
+    flush_queued_ = false;
+    return flush();
+}
+
+void Connection::queue_block(Bytes body) {
+    // The length prefix is queued as its own slice instead of being spliced in front
+    // of `body` — gather I/O reunites them in one writev, so framing costs no copy.
+    uint8_t prefix[framer::kLengthPrefixSize];
+    framer::encode_block_header(prefix, body.size());
+    tx_.append(ByteView(prefix, sizeof(prefix)));
+
+    // Small frame: copy it in, so prefix and body share one packed chunk. A memcpy of
+    // a few hundred bytes is cheaper than the allocation it saves — and it keeps a
+    // backlog of small frames from costing a chunk each.
+    // Large frame: move it, so a megabyte-sized payload is never copied to be framed.
+    if (body.size() <= kInlineBlockLimit) tx_.append(ByteView(body));
+    else                                  tx_.append(std::move(body));
+}
+
+// ── Handshake lifecycle ─────────────────────────────────────────────────────
+
+void Connection::start_handshake() {
+    if (state_ == ConnState::Connecting) begin_handshake();
+}
+
+void Connection::begin_handshake() {
+    state_ = ConnState::Handshaking;
+    // The transport is up, so the write-interest raised for the connect itself is
+    // no longer wanted; flush() re-arms it if the handshake outgrows the link.
+    want_write_ = false;
+    link_->want_write(false);
+
+    handshaker_ = reactor_.security().create(role_);
+    Bytes out;
+    if (!handshaker_->start(out)) {
+        reactor_.close(id_, CloseReason::HandshakeFailed);
+        return;
+    }
+    if (!out.empty()) {
+        queue_block(std::move(out));   // initiator's first message
+        if (!flush()) { reactor_.close(id_, close_reason_); return; }
+    }
+}
+
+bool Connection::drive_handshake(ByteView body) {
+    Bytes out;
+    auto outcome = handshaker_->consume(body, out);
+    if (outcome.status == Handshaker::Outcome::Failed) {
+        return fail(CloseReason::HandshakeFailed);
+    }
+    if (!out.empty()) {
+        queue_block(std::move(out));   // reply (responder's message, or initiator's final)
+        if (!flush()) return false;
+    }
+    if (outcome.status == Handshaker::Outcome::Done) {
+        session_   = std::move(outcome.session);
+        remote_id_ = outcome.remote_id;
+        handshaker_.reset();
+        complete_established();
+    }
+    return true;
+}
+
+void Connection::cancel_establish_timer() {
+    if (establish_timer_ != kInvalidTimerId) {
+        reactor_.cancel(establish_timer_);
+        establish_timer_ = kInvalidTimerId;
+    }
+}
+
+void Connection::complete_established() {
+    state_ = ConnState::Established;
+    cancel_establish_timer();
+    LOG_DEBUG("connection", "Peer " << remote_id_.short_hex() << " established ("
+              << (role_ == ConnRole::Inbound ? "inbound" : "outbound")
+              << (is_secure() ? ", encrypted)" : ", plaintext)"));
+    delegate_.on_established(*this);
+}
+
+// ── Inbound ─────────────────────────────────────────────────────────────────
+
+bool Connection::on_readable() {
+    // Drain the kernel buffer (the socket is non-blocking), parsing as we go. The
+    // parse step is inside the loop on purpose: it keeps rx_ down to one in-flight
+    // block no matter how fast the peer sends, where draining first and parsing
+    // afterwards would let rx_ grow to everything the peer managed to deliver.
+    //
+    // We must drain to would-block (or to a short read, which means the kernel
+    // buffer is now empty) — the kqueue backend is edge-triggered, so stopping with
+    // data still queued would leave the connection stalled until the *next* byte.
+    while (true) {
+        const ByteSpan into = rx_.prepare(read_size());
+
+        const Link::IoResult r = link_->read(into);
+        if (r.status == Link::Status::Closed) {
+            if (!process_blocks()) return false;  // deliver what the peer sent before FIN
+            return fail(CloseReason::PeerClosed);
+        }
+        if (r.status == Link::Status::Error)      return fail(link_->error_reason());
+        if (r.status == Link::Status::WouldBlock) break;
+
+        rx_.commit(r.bytes);
+        if (!process_blocks()) return false;
+
+        if (r.bytes < into.size()) break;  // link drained
+    }
+    return true;
+}
+
+size_t Connection::read_size() const {
+    // Not established yet: the peer is still anonymous, so its declared length buys it
+    // nothing. A handshake block is a Noise message plus the protocol id — hundreds of
+    // bytes — so there is no large allocation to save here, while honouring the length
+    // would let four bytes from an unauthenticated socket reserve kMaxEagerReserve. rx_
+    // still grows geometrically to hold whatever actually arrives, so an unusually large
+    // handshake block is served just as correctly, only without the eager reserve.
+    if (state_ != ConnState::Established) return kRecvChunk;
+
+    // Ask for the rest of the block we are mid-way through, so a large frame lands in
+    // one allocation rather than a series of 1.5x growth steps. Bounded by
+    // kMaxEagerReserve, since rx_need_ is a length the *peer* declared.
+    //
+    // Note this asks for the remainder even when it is *smaller* than kRecvChunk. It
+    // is tempting to floor it at kRecvChunk ("read as much as we can anyway"), but
+    // prepare(n) is a demand for n bytes of free tail, and a buffer sized exactly for
+    // the block has no kRecvChunk of tail left near the end of it — so the floor would
+    // force one last 1.5x grow (memcpy'ing the whole block that already arrived) for
+    // room that the block does not need. Nothing is lost by asking for less: prepare()
+    // hands back the *entire* free tail regardless, so the recv() is just as big.
+    if (rx_need_ > rx_.size()) return (std::min)(rx_need_ - rx_.size(), kMaxEagerReserve);
+    return kRecvChunk;
+}
+
+bool Connection::process_blocks() {
+    rx_need_ = 0;  // recomputed below: 0 == no block is mid-flight
+
+    // Body views point into rx_, so each block must be consumed before the next is
+    // decoded (and before any recv() reallocates the buffer under us).
+    while (!rx_.empty()) {
+        const auto block = framer::try_take_block(rx_.data(), rx_.size());
+        if (block.status == framer::Block::Incomplete) {
+            rx_need_ = block.needed;  // 0 while even the length prefix is short
+            break;
+        }
+        if (block.status == framer::Block::Error) return fail(CloseReason::ProtocolError);
+
+        const bool keep = (state_ == ConnState::Handshaking) ? drive_handshake(block.body)
+                                                             : deliver_frame(block.body);
+        rx_.consume(block.consumed);
+        if (!keep) return false;
+        if (state_ == ConnState::Closing || state_ == ConnState::Closed) return false;
+    }
+    return true;
+}
+
+bool Connection::deliver_frame(ByteView body) {
+    if (!session_) return fail(CloseReason::ProtocolError);  // data before handshake
+
+    Bytes plain;
+    if (!session_->decrypt(body, plain)) return fail(CloseReason::ProtocolError);
+
+    auto msg = framer::parse_message(plain);
+    if (!msg.ok) return fail(CloseReason::ProtocolError);
+
+    delegate_.on_frame(*this, msg.frame);
+    return true;
+}
+
+bool Connection::on_writable() {
+    // Finish the transport-level connect (a non-blocking TCP connect, or a Syn
+    // that has just been acknowledged), then begin the handshake.
+    if (state_ == ConnState::Connecting) {
+        if (!link_->connect_completed()) {
+            LOG_DEBUG("connection", "Peer " << id_ << " connect failed");
+            return fail(CloseReason::ConnectFailed);
+        }
+        begin_handshake();
+        if (state_ == ConnState::Closing) return false;
+    }
+    return flush();
+}
+
+bool Connection::on_error() {
+    return fail(link_->error_reason());
+}
+
+// ── Send buffer flush + write interest ──────────────────────────────────────
+
+bool Connection::flush() {
+    while (!tx_.empty()) {
+        // Hand the whole backlog to the kernel at once: a burst of queued frames
+        // (and the length prefix that precedes each one) leaves in a single syscall
+        // instead of one per chunk.
+        ByteView slices[kMaxSendSlices];
+        const size_t count = tx_.gather(slices, kMaxSendSlices);
+
+        const Link::IoResult r = link_->write(slices, count);
+        if (r.status == Link::Status::Ok) { tx_.pop_front(r.bytes); continue; }
+        if (r.status == Link::Status::WouldBlock) break;  // retry on the next writable event
+        return fail(link_->error_reason());
+    }
+
+    if (tx_.empty()) disarm_write();
+    else             arm_write();
+
+    // Drained back under the mark: whoever was told to stop can start again. The
+    // re-entrancy guard is what keeps a handler that answers by sending from
+    // recursing through flush() — it may queue, and the next drain reports the
+    // next opening, but it cannot nest.
+    if (over_low_water_ && !in_writable_ && backlog() <= send_low_water_) {
+        over_low_water_ = false;
+        in_writable_    = true;
+        delegate_.on_writable_changed(*this, true);
+        in_writable_    = false;
+    }
+    return true;
+}
+
+void Connection::arm_write() {
+    if (want_write_) return;
+    want_write_ = true;
+    link_->want_write(true);
+}
+
+void Connection::disarm_write() {
+    if (!want_write_) return;
+    want_write_ = false;
+    link_->want_write(false);
+}
+
+bool Connection::fail(CloseReason reason) {
+    close_reason_ = reason;
+    state_ = ConnState::Closing;
+    return false;  // tells the reactor to tear this connection down
+}
+
+} // namespace librats