Implement credential-safe programs smoke gate (#97)

crates/libremetaverse/src/agent_movement.rs

@@ -1256,11 +1256,13 @@ impl AgentMovementRuntime {
         packet.agent_data.agent_id = agent_id;
         packet.agent_data.session_id = session_id;
         packet.agent_data.circuit_code = self.network.native_circuit_code();
+        // The reference packet constructor marks this final region transition
+        // reliable; OpenSim may never publish the scene if this datagram is lost.
         send_encoded(
             &simulator,
             PacketType::CompleteAgentMovement,
             packet.to_bytes_with_method()?,
-            None,
+            Some(true),
         )
     }
 
@@ -2914,7 +2916,7 @@ mod tests {
             let socket =
                 UdpSocket::bind(SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 0)).unwrap();
             socket
-                .set_read_timeout(Some(Duration::from_millis(100)))
+                .set_read_timeout(Some(Duration::from_secs(3)))
                 .unwrap();
             let endpoint = socket.local_addr().unwrap();
             let (packet_sender, packets) = mpsc::channel();
@@ -2934,6 +2936,9 @@ mod tests {
                 let mut bytes = handshake.to_bytes_with_method().unwrap();
                 bytes[0] &= !(crate::Helpers::MSG_RELIABLE | crate::Helpers::MSG_ZEROCODED);
                 socket.send_to(&bytes, client_endpoint).unwrap();
+                socket
+                    .set_read_timeout(Some(Duration::from_millis(100)))
+                    .unwrap();
 
                 loop {
                     match shutdown_receiver.try_recv() {
@@ -3074,7 +3079,19 @@ mod tests {
             .native_connect(grid.endpoint, 0x1000, true, None, 256, 256)
             .unwrap()
             .unwrap();
-        let _ = grid.receive(PacketType::CompleteAgentMovement);
+        let initial_complete = grid.receive(PacketType::CompleteAgentMovement);
+        assert_ne!(
+            initial_complete[0] & crate::Helpers::MSG_RELIABLE,
+            0,
+            "the simulator transition must survive UDP startup loss"
+        );
+        manager.complete_agent_movement(simulator.clone()).unwrap();
+        let repeated_complete = grid.receive(PacketType::CompleteAgentMovement);
+        assert_ne!(
+            repeated_complete[0] & crate::Helpers::MSG_RELIABLE,
+            0,
+            "explicit simulator transitions must be reliable"
+        );
 
         let mut complete = AgentMovementCompletePacket::new_with_constructor().unwrap();
         complete.data.position = Vector3 {

crates/libremetaverse/src/network_manager.rs

@@ -1852,7 +1852,10 @@ impl Simulator {
         packet.agent_data.agent_id = *read(&self.agent_id);
         packet.agent_data.session_id = *read(&self.session_id);
         packet.agent_data.circuit_code = self.circuit_code.load(Ordering::Acquire);
-        let data = packet.to_bytes_with_method()?;
+        let mut data = packet.to_bytes_with_method()?;
+        // Match the reference packet constructor: this transition is reliable.
+        let flags = data.first_mut().ok_or(Error::Argument)?;
+        *flags |= Helpers::MSG_RELIABLE;
         self.native_send_packet_data(
             data.clone(),
             i32::try_from(data.len()).map_err(|_| Error::Argument)?,

crates/libremetaverse/src/object_manager.rs

@@ -53,8 +53,18 @@ fn decode_packet<T: GeneratedPacket>(bytes: &[u8]) -> Result<T, Error> {
     if bytes.len() > MAX_FIELD_BYTES * 16 {
         return Err(Error::Argument);
     }
+    let mut packet = T::new_generated();
     let mut position = 0_i32;
-    T::new_from_bytes(bytes, &mut position)
+    let mut packet_end = i32::try_from(bytes.len()).map_err(|_| Error::Argument)? - 1;
+    let mut zero_buffer =
+        vec![0_u8; crate::udp_transport::UdpTransportConfig::default().max_decoded_packet_size];
+    packet.decode_from_bytes(
+        bytes,
+        &mut position,
+        &mut packet_end,
+        Some(zero_buffer.as_mut_slice()),
+    )?;
+    Ok(packet)
 }
 
 fn wire_string(bytes: &[u8]) -> Result<String, Error> {
@@ -2745,6 +2755,24 @@ mod tests {
         (manager, simulator)
     }
 
+    fn transport_wire(data: &[u8]) -> Vec<u8> {
+        if data
+            .first()
+            .is_none_or(|flags| flags & crate::Helpers::MSG_ZEROCODED == 0)
+        {
+            return data.to_vec();
+        }
+        let mut encoded = vec![0_u8; data.len().saturating_mul(2).saturating_add(2)];
+        let length = crate::packet_wire::zero_encode(
+            Some(data),
+            i32::try_from(data.len()).unwrap(),
+            Some(&mut encoded),
+        )
+        .unwrap();
+        encoded.truncate(usize::try_from(length).unwrap());
+        encoded
+    }
+
     #[test]
     fn movement_decoding_accepts_all_reference_encodings_and_rejects_other_lengths() {
         for length in [16, 32, 48, 60, 76] {
@@ -2843,12 +2871,10 @@ mod tests {
         block.object_data = vec![0; 60];
         block.scale = Vector3::one();
         packet.object_data = vec![block];
+        let wire = transport_wire(&packet.to_bytes_with_method().expect("wire packet"));
         manager
             .inner
-            .handle_object_update(
-                &packet.to_bytes_with_method().expect("wire packet"),
-                simulator.clone(),
-            )
+            .handle_object_update(&wire, simulator.clone())
             .expect("object update");
 
         assert!(preapply_saw_absent.load(Ordering::Acquire));