Skip to content

refactor(goip,xtcpnl): separate the read-shared helpers from the write code (FP-8a) - #297

Merged
randomizedcoder merged 15 commits into
mainfrom
sec/fp8a-goip-shared-helpers
Nov 14, 2026
Merged

randomizedcoder merged 15 commits into
mainfrom
sec/fp8a-goip-shared-helpers

Conversation

@randomizedcoder

Copy link
Copy Markdown
Owner

First of three stacked PRs (FP-8a/b/c) that compile the netlink write encoders out of xtcp2 and go-link-monitor; cmd/goip keeps them behind a goip_write tag.

  • Pure moves, no behaviour change: one helper group per commit, so each diff is a move.
  • goip: decls the read paths reach now live in untagged files: errors.go, args.go, inet_prefix.go, names.go, verb_names.go, keywords.go, nlmsg.go, link_resolver.go, xfrm_common.go.
  • goip: write-only code that sat in read files moved into write files: obj_<x>_write.go for fou, ila, ioam, l2tp, macsec, mptcp, netns, sr, tcp_metrics and token; rule_save_write.go; cparse_write.go.
  • The link/address/route verb chains carry their own write-verb names instead of building them from the write tables; TestWriteSegmentsMatchTables keeps the copies equal (checked by dropping one verb: it fails).
  • xtcpnl: RouteAttr*, LinkAttr, EncodeIfInfomsg, putRaw, VethPeer/putPeerNest moved out of the write files; BuildWriteRequest, BuildSetNsidRequest and BuildGenlWriteRequest got write files of their own. The admission predicates stay untagged.
  • Placement came from a type-checked reachability pass (read roots vs write entry points). With every write file excluded, the remaining build errors are only the write arms in runX, which FP-8b routes through a seam.
  • Verified: go build ./..., go test over goip, xtcpnl, nlparity, goipparity and cmd, and checks.lint-baseline (all three tiers exit 0).

🤖 Generated with Claude Code

randomizedcoder and others added 13 commits November 11, 2026 23:58
The link, address and route chains built their write segments from the
write tables, so the verb resolver depended on the write paths. The
chains now hold the names and kinds directly, and
TestWriteSegmentsMatchTables keeps them equal to the tables, so a build
without the write paths can still refuse a write verb.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pure move. The read paths return these too, so they cannot live in the
write files a later commit tags out.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pure move: nextArg, the invarg/duparg/nodev/incomplete refusals,
checkIfname and the usage wrappers. The read parsers use them too.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pure move: inetPrefix, get_addr_1 and friends, the family words. Route
get, the filters and the read selectors parse with them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pure move: rtnl_*_a2n's tables and lookups. The read selectors and
the show printers resolve names through them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
…files

Pure move: the write verbs' names (verb_names.go) and the keywords and
link kinds the read parsers share (keywords.go).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
… files

Pure move: the link name resolver, nlmsgAlign, addrLabelFamily,
netnsOpen and the xfrm ctx/dir words. No read path now reaches a
declaration in a write file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pure move: the C parsers only the write parsers call (cparse_write.go),
llProtoA2N, the flush filter's matchFlush, xfrm state delete, and the
mtu and group keywords, into the write files that use them.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pure move: fou, ila, ioam, l2tp, macsec, mptcp, netns, sr, tcp_metrics
and token's modifiers, and rule save's flush and restore, out of the
read files into files a later commit tags. Consts pulled out of a
group are regrouped in the new file.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
…f the write files

Pure move: RouteAttr and its constructors (BuildGetRouteRequest takes
them), LinkAttr, EncodeIfInfomsg, putRaw and linkWriteBufCst (the
per-kind encoders next to the decoders use them), and VethPeer with
putPeerNest.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Pure rename. The file is mostly the read request and the family
versions; the next commit moves the one write builder back out.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
…e.go

Pure move. The write builder is now alone in the write file; the read
request, the versions and the admission predicate stay untagged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
…s of their own

Pure move. They sat beside BuildRequest and the nsid dump, which the
read paths need; IsAdmittedWriteType stays with BuildRequest, as a
classifier the read side uses too.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
randomizedcoder and others added 2 commits November 13, 2026 21:12
obj_fou.go: main's fouProto (protoByName, invalid ipproto refused) goes
to obj_fou_write.go, where this branch moved it; fouProtoNames and
ruleProtoNames go, as on main (the names now come from render).

Co-Authored-By: Claude Opus 5.5 <[email protected]>
@randomizedcoder
randomizedcoder merged commit dfa835b into main Nov 14, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant