Known-cluster gate can stay unpublished (fail-open) for up to 60 s after central boot #654

New Issue

2026-10-08T20:51:29-04:00

dohertj2 commented

2026-10-08 20:51:29 -04:00

Found in the #606 CI-lane review (batch b647). CentralCommunicationActor starts its contact-refresh timer with TimeSpan.Zero, so the first RefreshContacts runs immediately after PreStart — not 'long after every starter finished' as its comment claims. If that first refresh loses the race with the starter that resolves the provider, the known-cluster gate is not published until the next refresh, MeshTransport:ContactRefreshSeconds (default 60 s) later. ControlPlaneStarterOrder's Dps case failed 2/7 Gitea runs on exactly this race (the test now uses a 1 s refresh, so it no longer proves production heals fast).

Impact: for up to 60 s after a central admin node boots, the gate (documented as a defence against a timing oracle and a pre-auth store/audit flood) is fail-open. Bounded, admin-only, still behind the PSK interceptor; dialling unaffected.
Fix: a short bounded retry (2–5 s) while the provider is null, or a small initial timer delay; plus a test that the gate publishes within seconds when the provider resolves late under the default refresh interval.

Found in the #606 CI-lane review (batch b647). `CentralCommunicationActor` starts its contact-refresh timer with `TimeSpan.Zero`, so the first `RefreshContacts` runs immediately after `PreStart` — not 'long after every starter finished' as its comment claims. If that first refresh loses the race with the starter that resolves the provider, the known-cluster gate is not published until the next refresh, `MeshTransport:ContactRefreshSeconds` (default 60 s) later. `ControlPlaneStarterOrder`'s Dps case failed 2/7 Gitea runs on exactly this race (the test now uses a 1 s refresh, so it no longer proves production heals fast). Impact: for up to 60 s after a central admin node boots, the gate (documented as a defence against a timing oracle and a pre-auth store/audit flood) is fail-open. Bounded, admin-only, still behind the PSK interceptor; dialling unaffected. Fix: a short bounded retry (2–5 s) while the provider is null, or a small initial timer delay; plus a test that the gate publishes within seconds when the provider resolves late under the default refresh interval.

dohertj2 referenced this issue from a commit

2026-10-09 04:54:22 -04:00

fix(#654): bounded fast retry while the known-cluster gate is unpublished

dohertj2 referenced this issue from a commit

2026-10-09 04:54:22 -04:00

fix(#654): review fixes - non-vacuous stop-on-publish test, Error only when retry budget refuses

dohertj2 referenced this issue from a commit

2026-10-09 04:54:22 -04:00

Merge hw3-gate (#654 known-cluster gate bounded fast retry)

dohertj2 commented

2026-10-09 04:55:25 -04:00

Fixed on master — merge 7c4cc318 (commits 9dc6390d, 2659a690), pushed 2026-10-09.

While the known-cluster gate is unpublished, CentralCommunicationActor now schedules a single-shot RefreshContacts retry every 2 s (max 15, stops as soon as the gate publishes) instead of waiting for the 60 s refresh. The "will NEVER be published" Error now fires only when the retry budget is exhausted. Covers both causes: the TimeSpan.Zero first refresh racing the IMeshPskProvider resolve, and a failed first ClusterNode load.

Tests: a non-vacuous stop-on-publish test (the gate is unpublished on the first attempt so a retry really is scheduled), plus the budget-exhaustion Error. Docs: docs/Configuration.md. Full suite green on the merged master.

Fixed on master — merge `7c4cc318` (commits `9dc6390d`, `2659a690`), pushed 2026-10-09. While the known-cluster gate is unpublished, `CentralCommunicationActor` now schedules a single-shot `RefreshContacts` retry every 2 s (max 15, stops as soon as the gate publishes) instead of waiting for the 60 s refresh. The "will NEVER be published" Error now fires only when the retry budget is exhausted. Covers both causes: the TimeSpan.Zero first refresh racing the `IMeshPskProvider` resolve, and a failed first ClusterNode load. Tests: a non-vacuous stop-on-publish test (the gate is unpublished on the first attempt so a retry really is scheduled), plus the budget-exhaustion Error. Docs: `docs/Configuration.md`. Full suite green on the merged master.

dohertj2 closed this issue

2026-10-09 04:55:27 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: dohertj2/lmxopcua#654