Visitar URL original
macOS: 加固 DNS、Ping 与诊断任务 / harden DNS, Ping and diagnostic jobs by Nevergoodstudy · Pull Request #20 · Nevergoodstudy/NETworkManager-macOS · GitHub
Skip to content

macOS: 加固 DNS、Ping 与诊断任务 / harden DNS, Ping and diagnostic jobs - #20

Open
Nevergoodstudy wants to merge 6 commits into
mainfrom
codex/t01-t03-runtime
Open

macOS: 加固 DNS、Ping 与诊断任务 / harden DNS, Ping and diagnostic jobs#20
Nevergoodstudy wants to merge 6 commits into
mainfrom
codex/t01-t03-runtime

Conversation

@Nevergoodstudy

@Nevergoodstudy Nevergoodstudy commented Nov 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Owner

本次更新修复 DNS/Ping 在阶段回退中重复获得超时预算的问题，收紧 DNS 解析、修正 Lookup 旧结果状态，并保留可核查的诊断证据。改进通过同一 PR 交付，覆盖 T01/T02/T03 的七个实现切片；3/16 主项有实现，0/16 满足全部验收。

This update preserves diagnostic failure evidence and fixes renewed DNS/Ping fallback budgets, permissive response parsing and stale Lookup states. It delivers seven implementation slices across T01/T02/T03: 3/16 main items with implementation, 0/16 fully accepted.

变更 / Changes

  • 采集与 TCP / Inventory and TCP: Connections、Listeners、ARP、Wi-Fi 区分成功、空、partial 与不可用，保留命令/解析/截断证据；逐地址 TCP 保留 errno/SO_ERROR 与阶段，GUI/MCP 展示一致结果。 / Typed inventory and per-address TCP outcomes retain evidence through GUI/MCP.
  • DNS 模式 / DNS modes: 系统 A/AAAA 通过 macOS DNS-SD；指定服务器查询单独标注，不静默回退公网、不伪造 TTL。旧 MCP 调用提供 server 而未提供 mode 时仍兼容。 / Separate system and explicit-server queries, preserving legacy MCP calls.
  • DNS 传输 / Transport: nameserver 解析、UDP 与 TCP connect/send/frame reads 共享单调总时限；复用 endpoint，使用非阻塞套接字、连接结果检查、完整长度帧、取消与 SIGPIPE 防护。 / One deadline covers resolution and fallback, including segmented reads and EOF handling.
  • DNS 解析 / Parsing: 先校验事务、响应头和 echoed question 再信任 TC；完整校验 section、RDATA、压缩名称及边界。支持十种记录与完整 SOA，仅返回 answer 中选定类型的 IN 记录；基础 RCODE 错误为失败，NOERROR 空结果为成功。 / Strict response validation and selected-type IN answers with distinct failed/empty outcomes.
  • Ping 总预算与取消 / Ping budget and cancellation: 排队、一次解析、原生 ICMP 与系统回退共用派发前建立的单调 deadline，复用数字地址、为回退保留剩余预算。Swift Task 取消桥接 token；阶段前后检查到期/取消，拒绝迟到成功；无回复或不匹配报文不会续期。修正 IPv4/IPv6 系统参数、IPv6/hlim/序号解析及附属 TTL 边界，更新 MCP Ping/DNS 总网络预算说明。 / One deadline and numeric endpoint cover dispatch through fallback, with cancellation/late-result checks and corrected family-specific fallback/parser/schema semantics.
  • Lookup 与批次 / UI and batches: 初始、加载、错误、成功空态、表格；条件修改清旧数据、空服务器校验、运行中控件禁用及离页取消。IP/TCP 按项进度，取消后停派发并保留结果。 / Explicit Lookup states and bounded batch cancellation preserve results.
  • 已有 runtime 与阶段记录 / Runtime and records: 保留有界进程、Traceroute 共用服务、历史/导出及 MCP 证据；新增确定性 DNS regressions、中文提示与 CoreWLAN 字段能力评估，更新双语实施/验收记录。 / Retains the existing runtime scope and adds fixtures, localization and the field assessment.

本批 Ping 验证 / Ping batch validation

Ping 专项、完整 NMTest、NMCheck（含 SNMPv3 向量）、Debug 应用与内置 NMCP 构建、LaunchServices 启动、ad-hoc 签名和 MCP 集成均通过（arm64 macOS 27.2.1 / Swift 6.4.2）。新增预取消/各阶段运行中取消、无回复/无关报文、短附属数据及双栈回环回归。确定性一秒预算按解析 0.4、原生 0.3、回退仅余 0.3 秒消耗。Ping.once 和直接 SystemPing 均通过 IPv4/IPv6 回环；48 个相对链接和 git diff --check 通过。本批未新增 GUI 交互验收。 / Focused/full suites, app/launch/MCP/signature checks passed. Deterministic phases share one second; both APIs pass dual-stack loopback. No new GUI interaction acceptance in this batch.

复现、应用技能、官方 SE-0304/ContinuousClock 依据及研究限制见 Ping 阶段记录。 / Reproduction, applied skills, official references and research limitations are documented.

先前 DNS 验证 / Earlier DNS validation

此前 DNS 批次在 arm64 macOS 27.2.1（26B131）、Swift 6.4.2 上通过：

  • 定向 DNS 回归、完整 NMTest、NMCheck（含 SNMPv3 密码向量）。 / Focused DNS, full NMTest and NMCheck.
  • UDP/TCP IPv4/IPv6 回环 fixtures：分段帧、共享 deadline、EOF、取消、失败与成功空结果。 / Deterministic transport/service fixtures.
  • Debug .app 与内置 NMCP 构建、LaunchServices 启动、MCP stdio/离线/回环/时限/取消/并发/设置保留/launcher 集成、ad-hoc 签名完整性。 / App/bundled MCP, launch and integration checks.
  • 实际 Lookup 初始/校验/localhost A/AAAA/未知 TTL/条件变化/空结果与失败历史/中文错误状态。 / The documented primary GUI states.
  • 相对文档/源码链接与 git diff --check。 / Documentation links and diff formatting.

完整套件在 DNS 实现后、最后一条翻译前通过；翻译后重跑定向 DNS、重建并检查应用。SwiftPM 既存 CommandLineTools 搜索路径告警不影响退出成功。Swift 5 语言模式、macOS 14 最低版本未变。可复现命令、证据范围和官方研究依据见阶段记录。 / Full suites ran after DNS changes; focused checks and app verification were repeated after the final translation. Existing non-fatal toolchain warnings and the language/minimum-OS baselines are documented.

本提交远端 CI / Current-commit CI · 2026-11-14 09:06 UTC

仅以下 dd21503 工作流用于当前状态；历史证据保留在后文。 / Only these dd21503 runs establish current CI status.

检查 / Check 状态 / Status 构建任务 / Build jobs
pull_request · attempt 1 completed / success Test and build macOS app (macos-15-intel): success; Test and build macOS app (macos-26): success
push · attempt 1 completed / success Test and build macOS app (macos-26): success; Test and build macOS app (macos-15-intel): success

两个事件的 macOS 15 Intel 与 macOS 26 构建、核心/协议/MCP、应用/DMG、迁移后 MCP 和安装/升级/卸载检查均通过。 / Both events passed all build, core/protocol/MCP, app/DMG, relocated-MCP and install/upgrade/uninstall checks on macOS 15 Intel and macOS 26.

Developer ID/公证任务仅由版本标签触发。本次没有创建标签、合并或发布；CI/ad-hoc 产物不满足正式签名、公证、Gatekeeper 或整项验收。 / The Developer ID/notarization job is tag-only; no tag, merge or release was created, and formal-release/whole-task acceptance remains open.

历史 CI / Historical CI — 6b8f26f and 576dba0

以下仅对应旧提交，保留首轮失败、修复与受限重跑证据。 / Earlier-commit evidence only; original failures and fixes remain traceable.

历史 CI / Historical CI · 2026-11-14 07:20 UTC

历史提交 / Historical commit: 6b8f26f。ARP 按六个独立十六进制字节校验并补零；新增确定性回归，本机完整 NMTest 再次通过。 / ARP octet normalization and malformed-input fixtures added; full local NMTest passed again.

检查 / Check 状态 / Status 平台 / Platforms
历史 PR / Historical PR (attempt 1) completed / success (macos-26): success; (macos-15-intel): success
历史 push / Historical push (attempt 2) completed / success (macos-26): success; (macos-15-intel): success

该历史提交 push 的首轮记录：macOS 26 已通过核心测试、签名与 Info.plist 验证，但创建 DMG 后的 hdiutil verify 返回 Resource temporarily unavailable；同提交 PR 的 macOS 26 全部通过。随后仅重跑失败任务，第二轮已通过 DMG 校验、迁移后 MCP 和安装/升级/卸载检查。首轮失败保留可追溯记录；本次未修改或降低工作流校验。 / Historical push attempt 1 passed core tests, code-signature and Info.plist checks, then hdiutil verify reported Resource temporarily unavailable. The same-commit macOS 26 PR job passed. Only the failed job was rerun; attempt 2 passed DMG verification, relocated MCP and install/upgrade/uninstall checks. The first failure remains linked, and workflow validation was not changed or weakened.

该历史提交的 PR 和 push 均成功，macOS 15 Intel 与 macOS 26 构建任务通过。Developer ID/公证发布任务仅由版本标签触发，本次按条件跳过，不能据此宣称正式发布验收通过。 / Those historical PR and push runs succeeded on macOS 15 Intel and macOS 26. The tag-only Developer ID/notarization release job was skipped; formal-release acceptance remains open.

历史证据 / Previous evidence for 576dba0:

检查 / Check 状态 / Status 平台 / Platforms
前次 PR / Previous PR (attempt 1) completed / success (macos-15-intel): success; (macos-26): success
前次 push / Previous push (attempt 1) completed / failure (macos-15-intel): failure; (macos-26): success

前次 push 的 macOS 15 Intel 在实采 ARP 断言失败；检查发现原解析器拒绝省略前导零的合法字节格式，后续提交修复该兼容性问题。没有用重跑覆盖首轮失败。 / The previous Intel push failed the live ARP assertion. Inspection exposed rejection of valid unpadded octets, addressed by the follow-up commit; the first failure remains visible.

以上均为历史结果，不用于判断本次提交的 CI 状态。CI/ad-hoc 产物不等同于整项验收、合并、Developer ID 或公证发布。 / These historical runs do not establish CI status for the new commit. CI/ad-hoc artifacts do not establish full task acceptance, merge or a Developer ID/notarized release.

阶段与剩余验收 / Stage and remaining acceptance

当前为 P0 基础诊断实施与 PR 审阅。本 PR 尚未合并或发布；本机/CI 通过不代表整项验收。

P0 implementation and PR review are in progress. Inventory permissions/platforms, controlled DNS GUI and real network conditions, wider runtime/lifecycle coverage, real devices, formal signing/notarization/Gatekeeper and concurrency acceptance remain open. Loopback IPv6 and ad-hoc signing do not satisfy those gates.

PR #20 · 提交 / Commit dd21503 · Ping 阶段记录 / Ping stage record

Refs #14, #15, #16. Overall plan: #13.

@Nevergoodstudy
feat(macos): preserve TCP evidence and bound process jobs
541ec46 
保留逐地址 TCP 结果，统一进程期限、输出预算和进程组清理，并补齐历史、导出与 MCP 证据。

Keep per-address TCP outcomes, use one bounded process owner, and carry typed evidence through history, exports and MCP.
@Nevergoodstudy
macOS: 区分套接字采集失败与空结果 / distinguish socket inventory failures from emp…
8dd838a 
…ty results
@Nevergoodstudy
feat(macos): expose typed inventory and DNS modes
69d83b8 
Preserve system collection failures and partial results across socket, ARP and Wi-Fi views. Separate macOS system resolution from explicit DNS-server queries, and add scan progress/cancellation coverage with bilingual implementation notes.
@Nevergoodstudy Nevergoodstudy changed the title macOS: 类型化 TCP 结果与有界进程执行 / typed TCP outcomes and bounded process jobs macOS: 保留诊断证据并约束任务 / preserve diagnostic evidence and bound jobs Nov 11, 2026
@Nevergoodstudy
fix(macos): harden DNS transport and response validation
576dba0 
Integrate Lookup states and localization, add deterministic DNS parser and transport regressions, and document stage evidence and remaining acceptance gates.
@Nevergoodstudy Nevergoodstudy changed the title macOS: 保留诊断证据并约束任务 / preserve diagnostic evidence and bound jobs macOS: 加固 DNS 与诊断任务 / harden DNS and diagnostic jobs Nov 14, 2026
This was referenced Nov 14, 2026
Open
Open
Open
Open
@Nevergoodstudy Nevergoodstudy changed the title macOS: 加固 DNS 与诊断任务 / harden DNS and diagnostic jobs macOS: 加固 DNS、Ping 与诊断任务 / harden DNS, Ping and diagnostic jobs Nov 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Nevergoodstudy