mirror of
https://github.com/logicog/RTLPlayground.git
synced 2026-09-02 15:02:51 +08:00
d00f
c72d36af36
The failsafe used to watch management traffic for as long as STP ran, so three minutes of nobody looking at the web UI took the tree down on any quiet network. That made a standing STP config impractical, which is the problem raised in the review of the original PR. Enabling STP arms a window of stp_failsafe_s seconds. One HTTP request inside it confirms that management survived the new tree and disarms the watchdog; a silent window disables STP and restores forwarding. Both outcomes print to the console and the syslog. The window re-arms on any later event that newly takes a port out of forwarding: a port rejoining via "stp port N on", root guard firing, the loop latch. Those were covered by the old always-on surveillance and a disarmed window would have left them able to cut management off for good. If management traffic keeps flowing past the new block, the next request confirms straight away, which is the correct verdict, the block did not cut it. The arming deliberately does not refresh an already armed window: root guard can re-fire on every hello, and refreshing the countdown on each one would keep a cut-off window from ever expiring. A stable network with nothing newly blocked never re-arms, which is the reviewed-for behaviour. The request or console command that causes the arming never counts as its own confirmation: mgmt_alive is cleared when a command arms, and the console hook only disarms when the window predates the command. Without that, enabling from the web UI or the console would confirm the window before the new tree had any chance to cut management off. A command on the serial console confirms like HTTP does. An operator at the console has out-of-band access that no tree can cut, so the automatic restore only takes STP away from someone equipped to deal with the situation. The hook sits on the interactive console path only, identified by cmd_available, so neither the config replay at boot nor HTTP commands pass through it. After a confirmation STP runs unsupervised until something new blocks. Headless installs where nobody will confirm should set stp failsafe 0; doc/stp.md says so. Costs two bytes of XDATA, the armed flag and the console-path snapshot; stp.rel and rtlplayground.rel keep their segment sizes.