You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat: one UDP port for QUIC and the WebRTC media path - #7095
Finishes the UDP demux quest: the relay's one UDP port serves QUIC and hands the WebRTC media path (ICE checks, DTLS, RTP) to an embedder.
Summary
moq-sock::demux (runtime-agnostic): classify reads RFC 7983's first-byte ranges, with QUIC filling the gaps by its fixed bit, and parses STUN just far enough to tell ICE (a Binding request with USERNAME, or a Binding response) from a public query. No STUN codec dependency. Flows pins a remote to WebRTC whatever it sends and releases it when the Pin guard drops. Queue buffers one stack's datagrams with a byte bound and a per-source share. Counters counts drops by Discard reason (stun, unknown, unclaimed, overflow).
moq-tokio::quic::demux: the QUIC server's socket runs the split inline in its receive. The demux wraps the endpoint-owned AsyncUdpSocket in a Split that runs Divert::split on each poll_recv and passes everything else through. QUIC segments are compacted in place and stay on the endpoint, so a QUIC datagram is never copied or handed across tasks. Everything else is diverted to a WebRtc feed or dropped and counted. Demux lives in server::Config::demux and is shared by every shard of a worker group, so one feed and one set of counters covers the whole port. The feed stays open while the listener runs, even if no Demux clone is kept, and ends once every listening socket is released and every clone is gone. WebRtc has recv, send (a Transmit from the shared port, IPv4 mapped for an AF_INET6 socket), and pin. A feed sends through the endpoint's own socket slot, as its connections do: it shares their writable-waker fan-out, and it loses its datagrams once the endpoint releases the port. Diverting runs only while a feed exists; otherwise the traffic is unclaimed.
QUIC-bit greasing is off on every tokio QUIC server now, not only sharded ones, since the demux tells QUIC apart by its fixed bit.
Endpoint driver: a receive that returns an empty batch, because every datagram was diverted, now counts as work, so a non-QUIC flood still yields.
moq-relay: Relay::webrtc() returns the feed. It fails on a stream-only relay and on runtime.io_uring, which doesn't split the port yet (io_uring demux). /metrics gains moq_relay_demux_dropped_total{reason}.
Docs: doc/bin/relay/config.md describes the port once, and doc/bin/relay/index.md adds the embedding bullet.
moq_sock::demux::{classify, Class, Route, Discard, Counters, Flows, Pin, Queue}. Class, Route, and Discard are #[non_exhaustive], since SRT adds to each.
moq_tokio::server::Config::demux (the struct is #[non_exhaustive])
moq_relay::Relay::webrtc
Wire: no tokio QUIC server advertises grease_quic_bit (RFC 9287) now; before, only sharded ones held it back. Clients keep the fixed bit set. No framing change.
Performance
A new moq-sock bench, demux_route, sweeps pins against shards and is added to Nightly's rust-extra leg. Throughput is datagrams per second, summed over shards:
pins
1 shard
4 shards
0
1.08 G/s
4.12 G/s
1
52 M/s
174 M/s
1024
49 M/s
172 M/s
The first version guarded the pin table with a mutex. With a single pin held, four shards dropped to 6.8 M/s because they contended on that lock. The table is now an arc-swap snapshot behind an AtomicBool, so an unpinned listener pays about 1 ns per datagram and a pinned one about 20 ns. The cost is flat in the number of pins and scales with shards.
Tests
moq-sock: one test per first-byte class (including Binding responses and indications), malformed STUN, routing, pin refcounts, the queue's per-source share, and the counters.
moq-tokio: unit tests for Divert::split covering each class reaching its stack, a mixed GRO batch keeping its stride, a pin overriding the class, unclaimed traffic, a flooding source overflowing alone, and the feed ending with the listener. Also one_port_serves_quic_and_webrtc: on a dual-stack port, a QUIC session connects while an ICE check, DTLS, and RTP reach the feed, the reply leaves from the QUIC port, and a public STUN query is counted. The test keeps no Demux clone, and the feed ends after the server shuts down.
moq-relay: shared_tokio_webrtc_feed and worker_tokio_webrtc_feed take Relay::webrtc(), send DTLS from 16 sources to the QUIC port, receive all of them, and answer through the feed. There is also a metrics rendering test.
Choices made without asking
No flow-table deferral. WebRTC pins have no routing effect a WebRTC peer can trigger until SRT lands, because WebRTC never sends QUIC-shaped bytes. They ship anyway because rtc-feed pins into them, and a pin does win over the class, which the tests cover.
Pins are keyed by the canonical remote address, not a full 4-tuple. The local port is the socket's own. A remote that reaches two of a wildcard socket's local IPs counts as one flow, and rtc-feed's pinned only knows the remote.
Queue bounds are private constants: 4 MiB per listener, with no source holding more than 1/8 of it. Each datagram's cost includes its struct overhead, so tiny datagrams can't pin unbounded memory. A fixed share is O(1). Longest-queue-drop would let a lone burst use the whole queue, but scanning for the longest holder costs O(sources) per drop, which a spoofed flood would exploit.
Binding responses go to WebRTC.moq-ice runs str0m's full ICE (str0m's default; nothing sets ice_lite), so the relay's agent sends its own checks and needs their responses, which carry no USERNAME. Only the WebRTC agent sends STUN requests from this port, since [stun] binds its own. This goes past the old quest Plan's "USERNAME-carrying STUN" wording, which predates the full-ICE consumer.
A feed answers through the first live socket of the group. Every member shares the port, so the reply's source address is the same whichever member sends it.
Decisions
Settled by the maintainer, 2026-10-31. The finished quest's file is deleted here, so they are recorded in the one-port Plan too.
Inline split versus a demux task. The quest's Plan described a task that owns the socket and fans datagrams out to per-stack virtual sockets.
✅ Keep the inline split in the QUIC socket's poll_recv. QUIC keeps its zero-copy, same-task path and its GRO batches, as the io_uring demux plan also wants ("a QUIC datagram never leaves its worker"). Cost: WebRTC delivery advances only while the endpoint reads its socket, which it does for the listener's whole life, and the endpoint driver counts an empty batch as work.
A socket-owning demux task.
API shape and names.
✅ As shipped: moq_tokio::quic::demux::Demux in server::Config::demux, Demux::webrtc() -> WebRtc, Relay::webrtc() -> anyhow::Result<WebRtc>.
A demux::Producer / demux::Consumer pair.
Relay::demux() -> &Demux, so an embedder also reads the counters directly.
Merging main
main's endpoint now owns its socket (moq-dev/moq#7045), which deleted the backend's Socket wrapper this PR split in. The split moved to the Split wrapper above, and the feed's sends moved to the endpoint's slot (Slot::is_released is new, crate-private). The PR's own unreachable-send test is dropped, since main moved the same test to the driver's tokio socket. moq-sock's bench takes the bench-harness Criterion, as every crate does since moq-dev/moq#7130. The bench is multi-threaded iter_custom, so it stays out of the CodSpeed list and runs in Nightly.
The land queue ejected the PR on check rs (2026-11-01). Earlier mechanical merges had left three breaks, all fixed here:
Demux::webrtc and Divert::push still called kio::Producer::is_used, which moq-dev/moq#7036 renamed to wanted, so moq-tokio didn't compile.
Two tests called tokio::time::timeout, which main's clippy config now disallows in favor of kio::clock::timeout.
rs/moq-sock/Cargo.toml had its sections out of cargo sort order.
main renders /metrics through prometheus-client now (moq-dev/moq#7363). The demux counter is an encode_demux family on Scrape, with the same moq_relay_demux_dropped_total{reason} series, and metrics_series_are_pinned covers it.
Checks
On head ec4fc0ec90: CHECK_MODULES=rs just ci origin/main passed: lint-changed, clippy, and nextest over the changed crates and their dependents, with 10958 tests passed. Also cargo clippy --all-targets --all-features -D warnings on moq-tokio, moq-sock, and moq-relay, cargo fmt --check, and quest check --base origin/main.
Review
mechanical fix by codex / Codex: Merged base and re·solved sh/gh/nightly.sh conflict retaining both demux and auth benchmarks; passed bash -n sh/gh/nightly.sh; python3 sh/gh/nightly.test.py (14 tests); cargo build --locked -p moq-sock -p moq-tokio -p moq-relay --all-targets; cargo test --locked -p moq-sock -p moq-tokio -p moq-relay. (head 3c52ab6)
Codex gpt-6-astra, medium effort (quest review --deep), against origin/main at 88e6990626. This was a new session (round 1), because the base's agent instructions changed. Round 1 on ec4fc0ec90 found nothing.
Online-reviewer threads on the previous head, all fixed in this push:
Pullfrog, add #[non_exhaustive] to Class, Route, and Discard: fixed in ec4fc0ec90.
Pullfrog (two threads), is_used was removed: fixed in 269e175a62.
CodeRabbit, document src_ip for multihomed wildcard binds: fixed in ec4fc0ec90, in the guide and in WebRtc::poll_send.
CodeRabbit, document the stream-only failure of relay.webrtc(): fixed in ec4fc0ec90.
Earlier rounds:
mechanical fix by codex / Codex: Merged base and re·solved endpoint receive conflict by retaining demux work accounting and base receive timestamps. (head cb17d89)
mechanical fix by codex / Codex: Merged base, retaining both WebRTC and RTMP relay hooks and documentation and base deletion of the completed TCP quest. (head 219487b)
mechanical fix by codex / Codex: Merged base and preserved both the demux benchmark and Apple-only test dependency in Cargo.toml. (head 85c76cc)
mechanical fix by codex / Codex: Merged base and re·solved nightly benchmark conflict by preserving both sign and demux coverage. (head 64974fb)
Codex gpt-6-astra, medium effort (quest review --deep), against origin/main.
Round 1 on 0aa6085893, two findings, both fixed in 13334904bb:
Tie feed liveness to the listening socket (medium). Fixed: a listening socket's Divert holds the feed's liveness producer. A feed taken before Server::new moves its config in now stays open while the listener runs. A Demux clone still holds it too, since a feed must be obtainable before the listener binds, which is the shipped API shape the maintainer picked.
Deliver ICE responses before a remote is pinned (medium). Fixed: Class::Check became Class::Ice, which also takes Binding success and error responses, because str0m runs full ICE here.
Round 2 on 13334904bb: no findings.
Follow-ups
Datagram carries no ECN or kernel receive timestamp. If rtc-feed wants either for RTP congestion control, add them there.
A pinned lookup hashes with SipHash, about 20 ns. If SRT's pins make every datagram take that path, measure a faster keyed hasher with the demux_route bench.
main's endpoint now owns its socket (#7045), so the backend's
Socket wrapper is gone. The demux wraps the endpoint's AsyncUdpSocket in a
Split that runs Divert::split on every receive, and a WebRtc feed answers
through the endpoint's Slot, which the endpoint empties when it releases
the port. QUIC-bit greasing is still off on every tokio server.
moq-sock's bench takes the bench-harness criterion, as every crate does
since #7130. Records the maintainer's 2026-10-31 picks in the
one-port Plan and drops a new link to the finished quest.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
moq-ice runs str0m's full ICE, whose own connectivity checks are answered
by Binding responses without USERNAME. Those were dropped as plain STUN,
so ICE could never validate a pair on the shared port. Class::Check becomes
Class::Ice, which also takes Binding success and error responses; only the
WebRTC agent sends requests from this port.
A listening socket's Divert now holds the feed's liveness producer, so a
feed taken before Server::new moves its config in stays open while the
listener runs, and ends once the endpoint releases its socket.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
No actionable comments were generated in the recent review.
Recent review info
Run configuration
Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Organization UI
Review profile: CHILL
Plan: Advanced
Run ID: db82f663-25f9-44cc-98b7-858f370c9fcf
Commits
Reviewing files that changed from the base of the PR and between cb17d89 and 3c52ab6.
Files ignored due to path filters: 1
Cargo.lock is excluded by !**/*.lock
Files selected for processing: 10
doc/bin/relay/index.md
rs/moq-relay/src/internal.rs
rs/moq-relay/tests/integration/embed.rs
rs/moq-sock/Cargo.toml
rs/moq-sock/src/demux.rs
rs/moq-tokio/src/quic/backend.rs
rs/moq-tokio/src/quic/demux.rs
rs/moq-tokio/src/quic/driver/endpoint.rs
rs/moq-tokio/src/quic/driver/mod.rs
sh/gh/nightly.sh
Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.
Walkthrough
The change adds a shared-port UDP demultiplexer that classifies QUIC, WebRTC, and STUN datagrams, routes traffic through a bounded feed, and tracks discarded datagrams. Tokio QUIC servers use the demultiplexer, and the relay exposes the WebRTC feed when Tokio serves QUIC. Relay metrics report discard counts by reason. Tests cover routing, feed behavior, and lifecycle. Documentation and plans describe the implementation and its io_uring limitation.
Merge Risk: Minimal · up to 3c52a
The guide now explains when the WebRTC feed is unavailable. No issue identified here prevents merging after normal checks.
Pre-merge checks: 4 · 1
Failed checks: 1 warning
Check name
Status
Explanation
Resolution
Docstring Coverage
Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documenta…
Write docstrings for the functions missing them to satisfy the coverage threshold.
Passed checks: 4 passed
Check name
Status
Explanation
Title check
The title clearly and concisely identifies the main change: sharing one UDP port between QUIC and the WebRTC media path.
Description check
The description directly explains the UDP demultiplexer, WebRTC feed, relay API, metrics, tests, documentation, and implementation decisions described in the changeset.
Linked Issues check
Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check
Check skipped because no linked issues were found for this pull request.
Full details: Docstring Coverage
Explanation
Docstring coverage is 62.50% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 32 functions across 14 files. (2 skipped: 2 unsupported.)
Resolution
Write docstrings for the functions missing them to satisfy the coverage threshold.
Finishing Touches
Simplify code
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Warning
Some tools did not complete. Review the errors below.
Clippy (1.99.0)
Clippy execution timed out
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
No actionable bugs found in the changed code. The inline split is a reasonable direction: it preserves the endpoint receive path and GRO ordering while bounding the WebRTC queue; the snapshot pin table avoids a per-packet cross-shard mutex. A separate socket-owning task would add coordination without a clear benefit here.
Checked classification/ICE responses, pin lifetime, queue accounting, batch compaction, socket/feed shutdown and sends, relay/worker integration, and the added tests. The two issues described in the PR's earlier local review—listener-owned feed liveness and delivery of Binding responses—are addressed in this head; these are not new findings.
Verification limits: static GitHub inspection, including an independent lifecycle/send-path check. I did not run builds, tests, benchmarks, or real ICE/DTLS interoperability checks.
Landing head 13334904bbbebed96e1fe940f82cadecceb1f415 through quest land.
Changes since the last review: none. The ## Review record (Codex --deep, round 2 on 13334904bb, no findings) names this head.
Online review: the automated OpenAI review on this head reported no actionable findings. There are no unresolved threads.
Pre-land check:quest check --base origin/main passes (690 documents) against main at 1ea4b1a2c3, and the head merges into it without conflicts.
Decisions: the maintainer settled both open decisions on 2026-10-31 (keep the inline split, ship the API shape as is). No new decisions were taken while merging.
Follow-ups, to be planned after merge: ECN and receive timestamps on Datagram if rtc-feed needs them, and a faster keyed hasher for pinned lookups if SRT's pins put every datagram on that path.
The reason will be displayed to describe this comment to others. Learn more.
ℹ️ Minor suggestion inline.
Reviewed changes
moq-sock::demux — new runtime-agnostic classifier (classify/is_ice), an arc-swap pin table (Flows/Pin), a bounded per-source Queue, and drop Counters, with unit tests plus the demux_route bench.
moq-tokio::quic::demux — Demux wraps the endpoint-owned socket in a Split that runs the split inline in poll_recv, diverting ICE/DTLS/RTP to a WebRtc feed (queue, send through a group member's slot, pin); feed liveness tied to the listening sockets.
QUIC server — grease_quic_bit is off on every tokio QUIC server now (was sharded-only), and the endpoint driver counts a fully diverted read as work so a non-QUIC flood yields.
moq-relay — Relay::webrtc() returns the feed (fails stream-only and io_uring), /metrics gains moq_relay_demux_dropped_total{reason}, and integration tests cover the shared and worker tokio feeds.
Docs / quests — relay config/index docs describe the one UDP port; the finished quest is deleted and five others updated.
The inline comment notes a forward-compatibility gap in the new public enums. I traced the demux split (GRO compaction, pin canonicalization, queue accounting) and the feed's liveness/queue races and found no behavioral issues.
quest land removed this pull request from the queue: the batch check failed (exit 101).
js: selecting docs
..js: selecting reader
...
----------------------------------------------------------------------
Ran 24 tests in 0.382s
OK
python3 sh/js/audit.test.py
..
----------------------------------------------------------------------
Ran 2 tests in 0.069s
OK
python3 sh/rs/test-lints.test.py
.
----------------------------------------------------------------------
Ran 1 test in 2.539s
OK
python3 sh/gh/nightly.test.py
..............
----------------------------------------------------------------------
Ran 14 tests in 1.181s
OK
python3 sh/gh/pages-clean.test.py
....
----------------------------------------------------------------------
Ran 4 tests in 0.052s
OK
python3 sh/gh/bench-report.test.py
............
----------------------------------------------------------------------
Ran 12 tests in 0.440s
OK
bench-ffi: 2 measured entries
bench-rust: failure; no history point
bench-ffi: failure; no history point
bench-rust: failure; no history point
no completed benchmark reports; no history point
bench-rust: 1 measured entries
bench-rust: failure; no history point
no completed benchmark reports; no history point
Paired comparison of c2 against c1: 1 confirmed regressions, 1 targets not compared
- `rust/kio/lock/4`: +40.0% (rounds +30.0%, +40.0%, +50.0%)
- `rust/gst/moq-gst/catalog` not compared: base build failed
Paired comparison of c2 against c1: 0 confirmed regressions, 0 targets not compared
python3 sh/gh/ts-paths.test.py
.....
----------------------------------------------------------------------
Ran 5 tests in 0.001s
OK
sh/go/publish-wrapper.test.sh
publish-wrapper test: no rsync on PATH, skipping
bash .claude/hooks/direnv.test.sh
direnv hook: could not load the dev shell, see the direnv output above.
direnv hook: regression tests passed
python3 sh/rs/uring.test.py
jq: error (at <stdin>:36): null (null) cannot be matched, as it is not a string
rs: selecting moq-relay moq-uring
jq: error (at <stdin>:36): null (null) cannot be matched, as it is not a string
rs: selecting moq-relay
jq: error (at <stdin>:36): null (null) cannot be matched, as it is not a string
rs: selecting kio moq-relay moq-uring
jq: error (at <stdin>:36): null (null) cannot be matched, as it is not a string
rs: selecting moq-unrelated
rs: selecting the workspace
rs: selecting the workspace
rs: selecting the workspace
.
----------------------------------------------------------------------
Ran 1 test in 0.280s
OK
ci: check rs failed
ci: check rs_shapes failed
ci: seconds per module
75 check rs (failed)
77 check rs_shapes (failed)
278 check js
52 test js
13 check markdown
2 check gh
46 test gh
68 check flake
0 check drill
3 check quest
0 check ts_paths
14 check shell
0 check large_files
1 check toml
0 check nix
0 check justfile
392 wall time
error: recipe `ci` failed on line 104 with exit code 101
The reason will be displayed to describe this comment to others. Learn more.
Caution
The base merge itself is clean, but the branch still does not compile. rs/moq-tokio/src/quic/demux.rs:79 and :305 call kio::Producer::is_used(), which main removed in favor of wanted(), so moq-tokio (and every crate depending on it, including moq-relay) fails with E0599. This is the same blocker flagged at the prior heads and tracked by the open thread at demux.rs:79; this merge did not touch that file, so it is not duplicated inline.
Reviewed changes
Merged main into the branch, resolving the endpoint receive conflict by keeping the branch's recv_limiter.record_work(msgs.max(1)) while absorbing main's kernel receive-timestamp sampling (RecvState.wall, wall.sample(received, kio::clock::Wall::now()) per batch, and the per-datagram arrival), so a fully diverted (empty) read still counts as work and the first datagram of each GRO batch reports an arrival. The resolution is correct: Instant in this file is kio::clock::Instant, matching WallMap::sample, and arrival falls back to received when no kernel stamp maps.
No other net change: rs/moq-tokio/src/quic/driver/mod.rs and the demux source are identical to the prior head.
codex / Codex land fixer: This maintainer pick already used its mechanical fi·x attempt. Run /quest-iterate to diagnose the repeated failure, then pick it again.
main renders /metrics through prometheus-client now (#7363), so the demux drop
counter becomes an `encode_demux` family on `Scrape`, and the pinned series test
covers it. Also rename the two `kio::Producer::is_used` calls to `wanted`, which
#7036 renamed; the previous merge left them uncompiled.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ply sources
`Class`, `Route`, and `Discard` gain variants with the SRT demux, so they are
`#[non_exhaustive]`; the tokio split counts a route it does not serve as
`unknown`. `WebRtc::poll_send` and the relay guide say to set `src_ip` from
`Datagram::local` on a multihomed wildcard bind, and the guide names the
stream-only relay as a case `relay.webrtc()` refuses. The tests use the
ambient-clock `kio::clock::timeout`, which main's clippy config now requires.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The reason will be displayed to describe this comment to others. Learn more.
Automated review by review (OpenAI)
Reviewed commit: ec4fc0ec905a1b2cbc02d14fc32bda881539490d, compared with my previous review of 64974fb1ede2b41a759a7a2cce0480f8a2375178, accounting for merged base changes.
Prior finding fixed: both demux liveness checks now use Producer::wanted(), whose consumer-exists semantics match the old calls. No new actionable bugs found in this update.
The metrics merge follows the existing counter encoder rather than retaining a second formatter, preserving the drop-reason series and zero-valued rows. The non-exhaustive enums and unknown-route fallback fit the planned additional protocols without changing current routing. The documented source-IP requirement and stream-only limitation also address the existing reviewers' concerns; these are not new findings. The inline split remains a reasonable direction, with no additional abstraction needed for these fixes.
Verification limits: static GitHub source and base-relative diff inspection, including the updated metrics tests and timeout call sites. I did not run builds, tests, benchmarks, or WebRTC interoperability checks.
The reason will be displayed to describe this comment to others. Learn more.
✅ No new issues found.
Reviewed changes
The delta since the prior pullfrog review (cb17d89c4) is the main merge plus the fixes for both prior threads. All three concerns land cleanly at this head.
Fixed the moq-tokio build break — both kio::Producer::is_used() call sites (now demux.rs:79 and :311) use wanted(), so the crate trivially compiles again.
Marked the demux enums #[non_exhaustive] — Class, Route, and Discard carry it, and Divert::split_batch gained the wildcard arm the attribute forces, counting a route this listener does not serve as Discard::Unknown.
Ported the demux counter to prometheus-client — merged from main: render_demux is now encode_demux on Scrape, and metrics_series_are_pinned pins moq_relay_demux_dropped_total{reason}.
Switched the touched tests to kio::clock::timeout — the two tokio::time::timeout sites in embed.rs and backend.rs, matching main's clippy config.
Documented Transmit.src_ip — the wildcard-bind source-address guidance on WebRtc::poll_send and in doc/bin/relay/index.md, plus the stream-only failure of relay.webrtc().
Sorted rs/moq-sock/Cargo.toml — section order restored and [lints] workspace = true added.
The reason will be displayed to describe this comment to others. Learn more.
✅ No new issues found.
Reviewed changes
The delta since the prior pullfrog review (ec4fc0ec9) is a single base merge (3c52ab601) that resolved the sh/gh/nightly.sh conflict. No source or docs changed. I confirmed the merge keeps both nightly benchmark additions instead of dropping either, and that the file stays valid.
Merged main and kept both benchmark additions in the rust-extra leg — the branch's -p moq-sock --bench demux alongside main's criterion auth … --bench verify. bash -n sh/gh/nightly.sh passes and sh/gh/nightly.test.py (14 tests) is green; the [[bench]] name = "demux" harness = false declaration is present in rs/moq-sock/Cargo.toml, so the new --bench demux target resolves.
Validation observed an intermittent failure in moq-tokio::integration backend::quic_client_close_drains_finished_track at backend.rs:902: subscribe failed: Unroutable. The full suite then passed all 1042 tests with four workers, including this test. The moq-sock benchmark compile check also passed. No changes were made to this branch; the intermittent test should be followed up.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
kixelated
changed the title
kixelated
left a comment
![pullfrog[bot]](https://avatars.githubusercontent.com/in/1768019?s=60&v=4){kind=small}
Finishes the UDP demux quest: the relay's one UDP port serves QUIC and hands the WebRTC media path (ICE checks, DTLS, RTP) to an embedder.
Summary
moq-sock::demux(runtime-agnostic):classifyreads RFC 7983's first-byte ranges, with QUIC filling the gaps by its fixed bit, and parses STUN just far enough to tell ICE (a Binding request with USERNAME, or a Binding response) from a public query. No STUN codec dependency.Flowspins a remote to WebRTC whatever it sends and releases it when thePinguard drops.Queuebuffers one stack's datagrams with a byte bound and a per-source share.Counterscounts drops byDiscardreason (stun,unknown,unclaimed,overflow).moq-tokio::quic::demux: the QUIC server's socket runs the split inline in its receive. The demux wraps the endpoint-ownedAsyncUdpSocketin aSplitthat runsDivert::spliton eachpoll_recvand passes everything else through. QUIC segments are compacted in place and stay on the endpoint, so a QUIC datagram is never copied or handed across tasks. Everything else is diverted to aWebRtcfeed or dropped and counted.Demuxlives inserver::Config::demuxand is shared by every shard of a worker group, so one feed and one set of counters covers the whole port. The feed stays open while the listener runs, even if noDemuxclone is kept, and ends once every listening socket is released and every clone is gone.WebRtchasrecv,send(aTransmitfrom the shared port, IPv4 mapped for an AF_INET6 socket), andpin. A feed sends through the endpoint's own socket slot, as its connections do: it shares their writable-waker fan-out, and it loses its datagrams once the endpoint releases the port. Diverting runs only while a feed exists; otherwise the traffic isunclaimed.moq-relay:Relay::webrtc()returns the feed. It fails on a stream-only relay and onruntime.io_uring, which doesn't split the port yet (io_uring demux)./metricsgainsmoq_relay_demux_dropped_total{reason}.doc/bin/relay/config.mddescribes the port once, anddoc/bin/relay/index.mdadds the embedding bullet.Impact
moq_sock::demux::{classify, Class, Route, Discard, Counters, Flows, Pin, Queue}.Class,Route, andDiscardare#[non_exhaustive], since SRT adds to each.moq_tokio::quic::demux::{Demux, WebRtc, Datagram, Counters, Discard, Pin, Transmit}moq_tokio::server::Config::demux(the struct is#[non_exhaustive])moq_relay::Relay::webrtcgrease_quic_bit(RFC 9287) now; before, only sharded ones held it back. Clients keep the fixed bit set. No framing change.Performance
A new
moq-sockbench,demux_route, sweeps pins against shards and is added to Nightly'srust-extraleg. Throughput is datagrams per second, summed over shards:The first version guarded the pin table with a mutex. With a single pin held, four shards dropped to 6.8 M/s because they contended on that lock. The table is now an
arc-swapsnapshot behind anAtomicBool, so an unpinned listener pays about 1 ns per datagram and a pinned one about 20 ns. The cost is flat in the number of pins and scales with shards.Tests
moq-sock: one test per first-byte class (including Binding responses and indications), malformed STUN, routing, pin refcounts, the queue's per-source share, and the counters.moq-tokio: unit tests forDivert::splitcovering each class reaching its stack, a mixed GRO batch keeping its stride, a pin overriding the class, unclaimed traffic, a flooding source overflowing alone, and the feed ending with the listener. Alsoone_port_serves_quic_and_webrtc: on a dual-stack port, a QUIC session connects while an ICE check, DTLS, and RTP reach the feed, the reply leaves from the QUIC port, and a public STUN query is counted. The test keeps noDemuxclone, and the feed ends after the server shuts down.moq-relay:shared_tokio_webrtc_feedandworker_tokio_webrtc_feedtakeRelay::webrtc(), send DTLS from 16 sources to the QUIC port, receive all of them, and answer through the feed. There is also a metrics rendering test.Choices made without asking
pinnedonly knows the remote.moq-iceruns str0m's full ICE (str0m's default; nothing setsice_lite), so the relay's agent sends its own checks and needs their responses, which carry no USERNAME. Only the WebRTC agent sends STUN requests from this port, since[stun]binds its own. This goes past the old quest Plan's "USERNAME-carrying STUN" wording, which predates the full-ICE consumer.Decisions
Settled by the maintainer, 2026-10-31. The finished quest's file is deleted here, so they are recorded in the one-port Plan too.
poll_recv. QUIC keeps its zero-copy, same-task path and its GRO batches, as the io_uring demux plan also wants ("a QUIC datagram never leaves its worker"). Cost: WebRTC delivery advances only while the endpoint reads its socket, which it does for the listener's whole life, and the endpoint driver counts an empty batch as work.moq_tokio::quic::demux::Demuxinserver::Config::demux,Demux::webrtc() -> WebRtc,Relay::webrtc() -> anyhow::Result<WebRtc>.demux::Producer/demux::Consumerpair.Relay::demux() -> &Demux, so an embedder also reads the counters directly.Merging main
main's endpoint now owns its socket (moq-dev/moq#7045), which deleted the backend's
Socketwrapper this PR split in. The split moved to theSplitwrapper above, and the feed's sends moved to the endpoint's slot (Slot::is_releasedis new, crate-private). The PR's own unreachable-send test is dropped, since main moved the same test to the driver's tokio socket.moq-sock's bench takes thebench-harnessCriterion, as every crate does since moq-dev/moq#7130. The bench is multi-threadediter_custom, so it stays out of the CodSpeed list and runs in Nightly.The land queue ejected the PR on
check rs(2026-11-01). Earlier mechanical merges had left three breaks, all fixed here:Demux::webrtcandDivert::pushstill calledkio::Producer::is_used, which moq-dev/moq#7036 renamed towanted, somoq-tokiodidn't compile.tokio::time::timeout, which main's clippy config now disallows in favor ofkio::clock::timeout.rs/moq-sock/Cargo.tomlhad its sections out ofcargo sortorder.main renders
/metricsthrough prometheus-client now (moq-dev/moq#7363). The demux counter is anencode_demuxfamily onScrape, with the samemoq_relay_demux_dropped_total{reason}series, andmetrics_series_are_pinnedcovers it.Checks
On head
ec4fc0ec90:CHECK_MODULES=rs just ci origin/mainpassed: lint-changed, clippy, and nextest over the changed crates and their dependents, with 10958 tests passed. Alsocargo clippy --all-targets --all-features -D warningson moq-tokio, moq-sock, and moq-relay,cargo fmt --check, andquest check --base origin/main.Review
mechanical fix by codex / Codex:
Merged base and re·solved sh/gh/nightly.sh conflict retaining both demux and auth benchmarks; passed bash -n sh/gh/nightly.sh; python3 sh/gh/nightly.test.py (14 tests); cargo build --locked -p moq-sock -p moq-tokio -p moq-relay --all-targets; cargo test --locked -p moq-sock -p moq-tokio -p moq-relay.(head 3c52ab6)Codex
gpt-6-astra, medium effort (quest review --deep), againstorigin/mainat88e6990626. This was a new session (round 1), because the base's agent instructions changed. Round 1 onec4fc0ec90found nothing.Online-reviewer threads on the previous head, all fixed in this push:
#[non_exhaustive]toClass,Route, andDiscard: fixed inec4fc0ec90.is_usedwas removed: fixed in269e175a62.src_ipfor multihomed wildcard binds: fixed inec4fc0ec90, in the guide and inWebRtc::poll_send.relay.webrtc(): fixed inec4fc0ec90.Earlier rounds:
mechanical fix by codex / Codex:
Merged base and re·solved endpoint receive conflict by retaining demux work accounting and base receive timestamps.(head cb17d89)mechanical fix by codex / Codex:
Merged base, retaining both WebRTC and RTMP relay hooks and documentation and base deletion of the completed TCP quest.(head 219487b)mechanical fix by codex / Codex:
Merged base and preserved both the demux benchmark and Apple-only test dependency in Cargo.toml.(head 85c76cc)mechanical fix by codex / Codex:
Merged base and re·solved nightly benchmark conflict by preserving both sign and demux coverage.(head 64974fb)Codex
gpt-6-astra, medium effort (quest review --deep), againstorigin/main.0aa6085893, two findings, both fixed in13334904bb:Divertholds the feed's liveness producer. A feed taken beforeServer::newmoves its config in now stays open while the listener runs. ADemuxclone still holds it too, since a feed must be obtainable before the listener binds, which is the shipped API shape the maintainer picked.Class::CheckbecameClass::Ice, which also takes Binding success and error responses, because str0m runs full ICE here.13334904bb: no findings.Follow-ups
Datagramcarries no ECN or kernel receive timestamp. If rtc-feed wants either for RTP congestion control, add them there.demux_routebench.(Written by Claude Opus 5.5)
🤖 Generated with Claude Code