fix(net): broadcast LEFT on disconnect, add keepalive/reaper, cap PLC hiss

Three reported bugs traced to one root cause plus two missing designed features:

1. Stale users + eternal PLC hiss (root cause): ConnSession::close() silently
   erased dropped users without broadcasting UserEvent::LEFT, so peers never
   learned the user left and their audio engines never called remove_stream —
   Opus PLC synthesized comfort noise forever. Fix: broadcast_left() helper
   + close() broadcasts LEFT before erasing.

2. PLC cap (defense-in-depth): on_playback now caps pure PLC at ~2s, then
   emits digital silence so a stale stream can never hiss forever even if
   remove_stream is skipped. Resets automatically on fresh packets.

3. No timeout / no ping: client never sent Ping, server had no last_seen /
   reaper, so half-open connections (NAT timeout, wifi loss, sleep) left
   ghost users forever. Fix: client Ping every 15s with RTT measurement,
   ConnSession::last_seen bumped on every inbound TCP/UDP frame, steady_timer
   reaper sweeps every 15s and drops sessions older than 45s (configurable
   via server::Config).

4. UDP KEEPALIVE: client sends plaintext kFrameKeepalive every 5s; server
   bumps last_seen + echoes back. Keeps NAT bindings alive and lets media
   activity defer the reaper independently of TCP.

5. Graceful client disconnect: vc_disconnect() sends Disconnect{code=0} via
   a flag-based io-thread exit (no double-close race); server handles
   client-sent Disconnect with immediate close() + LEFT broadcast.

3 new tests: disconnect_left, plc_cap, reaper_timeout. 21/21 ctest green.

Docs: protocol.md §6/§7, voice.md §6, architecture.md §5, PROGRESS.md.
This commit is contained in:
2026-06-18 01:18:33 +02:00
parent cccf085a87
commit 487a561963
19 changed files with 1006 additions and 13 deletions

View File

@@ -60,6 +60,15 @@ if(VOICECAT_USE_VCPKG_DEPS)
target_include_directories(test_opus_codec PRIVATE ${VC_TEST_INTERNAL_INCLUDES})
add_test(NAME opus_codec COMMAND test_opus_codec)
# PLC cap: after ~2s of pure PLC (no real packets), the mixer emits silence instead of
# comfort noise — bounds the eternal-hiss failure mode (defense-in-depth for the
# disconnect/LEFT fix). White-box AudioEngine test, no server needed.
add_executable(test_plc_cap test_plc_cap.cpp)
target_link_libraries(test_plc_cap PRIVATE voicecat::voicecat)
target_compile_features(test_plc_cap PRIVATE cxx_std_20)
target_include_directories(test_plc_cap PRIVATE ${VC_TEST_INTERNAL_INCLUDES})
add_test(NAME plc_cap COMMAND test_plc_cap)
# M2 exit criterion: two headless clients relay encrypted Opus frames via the SFU.
add_executable(test_m2_voice test_m2_voice.cpp)
target_link_libraries(test_m2_voice PRIVATE voicecat::server)
@@ -145,4 +154,24 @@ if(VOICECAT_USE_VCPKG_DEPS)
target_include_directories(test_m5_channel_crud PRIVATE ${VC_TEST_INTERNAL_INCLUDES})
add_test(NAME m5_channel_crud COMMAND test_m5_channel_crud)
set_tests_properties(m5_channel_crud PROPERTIES TIMEOUT 90)
# Disconnect/timeout: server broadcasts UserEvent::LEFT on TCP drop (no more ghost
# users or eternal PLC hiss on peers). Also covers the keepalive/reaper paths added
# alongside the LEFT-broadcast fix.
add_executable(test_disconnect_left test_disconnect_left.cpp)
target_link_libraries(test_disconnect_left PRIVATE voicecat::server)
target_compile_features(test_disconnect_left PRIVATE cxx_std_20)
target_include_directories(test_disconnect_left PRIVATE ${VC_TEST_INTERNAL_INCLUDES})
add_test(NAME disconnect_left COMMAND test_disconnect_left)
set_tests_properties(disconnect_left PROPERTIES TIMEOUT 90)
# Reaper: half-open connections (no TCP EOF) are dropped after the configurable timeout,
# peers get UserEvent::LEFT, the stale client gets disconnected. Uses a 2s timeout for
# fast test turnaround (production default is 45s).
add_executable(test_reaper_timeout test_reaper_timeout.cpp)
target_link_libraries(test_reaper_timeout PRIVATE voicecat::server)
target_compile_features(test_reaper_timeout PRIVATE cxx_std_20)
target_include_directories(test_reaper_timeout PRIVATE ${VC_TEST_INTERNAL_INCLUDES})
add_test(NAME reaper_timeout COMMAND test_reaper_timeout)
set_tests_properties(reaper_timeout PROPERTIES TIMEOUT 30)
endif()

View File

@@ -0,0 +1,221 @@
/*
* test_disconnect_left — regression test for the ungraceful-disconnect LEFT bug.
*
* Verifies that when a client's TCP connection drops (vc_disconnect / socket close /
* process kill), the server broadcasts UserEvent::LEFT to remaining clients — so peer
* user lists stay fresh and peer audio engines remove the stale stream (no eternal PLC
* hiss). Before the fix, ConnSession::close() silently erased the user from the registry
* without broadcasting, leaving ghost users and never-ending comfort noise on peers.
*/
#include <cstdio>
#ifdef VOICECAT_HAS_NET
#include <atomic>
#include <chrono>
#include <condition_variable>
#include <filesystem>
#include <mutex>
#include <string>
#include <thread>
#include <vector>
#include "voicecat.h"
#include "server.h"
#include "db.h"
struct EventStore {
std::mutex mu;
std::condition_variable cv;
bool auth_ok{false};
bool auth_done{false};
uint32_t self_user_id{0};
bool channel_list_received{false};
bool disconnected{false};
std::vector<uint32_t> joined_users;
std::vector<uint32_t> left_users;
vc_client* client{nullptr};
const char* label{nullptr};
};
static void on_event(void* user, const vc_event* ev) {
auto* s = static_cast<EventStore*>(user);
std::lock_guard lk(s->mu);
switch (ev->type) {
case VC_EVENT_SERVER_IDENTITY:
vc_confirm_server_identity(s->client, 1);
break;
case VC_EVENT_AUTH_RESULT:
s->auth_ok = (ev->result == VC_OK);
s->auth_done = true;
s->self_user_id = ev->user_id;
break;
case VC_EVENT_CHANNEL_LIST:
s->channel_list_received = true;
break;
case VC_EVENT_USER_JOINED:
s->joined_users.push_back(ev->user_id);
break;
case VC_EVENT_USER_LEFT:
s->left_users.push_back(ev->user_id);
break;
case VC_EVENT_DISCONNECTED:
s->disconnected = true;
break;
default:
break;
}
s->cv.notify_all();
}
template <typename Pred>
static bool wait_for(EventStore& s, Pred pred, int timeout_ms) {
auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(timeout_ms);
std::unique_lock lk(s.mu);
return s.cv.wait_until(lk, deadline, [&] { return pred(s); });
}
static int g_failures = 0;
#define CHECK(cond) \
do { \
if (!(cond)) { \
std::printf("FAIL: %s (%s:%d)\n", #cond, __FILE__, __LINE__); \
++g_failures; \
} \
} while (0)
static bool user_list_contains(vc_client* c, uint32_t uid) {
vc_user_list ul{};
if (vc_list_users(c, &ul) != VC_OK) return false;
bool found = false;
for (size_t i = 0; i < ul.count; ++i) {
if (ul.items[i].id == uid) { found = true; break; }
}
vc_free_user_list(&ul);
return found;
}
int main() {
auto tmp = std::filesystem::temp_directory_path() /
("vctest_disc_left_" + std::to_string(
std::chrono::steady_clock::now().time_since_epoch().count()));
std::filesystem::create_directories(tmp);
std::string data_dir = tmp.string();
std::atomic<uint16_t> bound_port{0};
std::mutex ready_mu;
std::condition_variable ready_cv;
bool ready{false};
voicecat::server::Config cfg;
cfg.data_dir = data_dir;
cfg.bind_port = 0;
cfg.server_name = "VoiceCat-DiscLeftTest";
cfg.allow_guests = true;
cfg.on_ready = [&](uint16_t p) {
bound_port.store(p);
{ std::lock_guard lk(ready_mu); ready = true; }
ready_cv.notify_all();
};
voicecat::server::Server server(cfg);
std::thread server_thread([&] { server.run(); });
{
std::unique_lock lk(ready_mu);
if (!ready_cv.wait_for(lk, std::chrono::seconds(10), [&] { return ready; })) {
std::printf("FAIL: server did not become ready\n");
server.stop();
server_thread.join();
std::filesystem::remove_all(tmp);
return 1;
}
}
uint16_t port = bound_port.load();
auto make_client = [&](const char* label, const char* nick) -> EventStore* {
auto* ev = new EventStore();
ev->label = label;
vc_callbacks cb{on_event, nullptr, ev};
vc_config cfgx{label, "0.1", VC_LOG_OFF};
ev->client = vc_client_create(&cfgx, cb);
if (!ev->client) return nullptr;
if (vc_connect(ev->client, "127.0.0.1", port) != VC_OK) return nullptr;
if (vc_authenticate_guest(ev->client, nick) != VC_OK) return nullptr;
return ev;
};
EventStore* evA = make_client("clientA", "Alpha");
CHECK(evA != nullptr);
CHECK(wait_for(*evA, [](EventStore& s) { return s.auth_ok; }, 8000));
CHECK(wait_for(*evA, [](EventStore& s) { return s.channel_list_received; }, 3000));
uint32_t a_uid = evA->self_user_id;
CHECK(a_uid != 0);
EventStore* evB = make_client("clientB", "Bravo");
CHECK(evB != nullptr);
CHECK(wait_for(*evB, [](EventStore& s) { return s.auth_ok; }, 8000));
CHECK(wait_for(*evB, [](EventStore& s) { return s.channel_list_received; }, 3000));
uint32_t b_uid = evB->self_user_id;
CHECK(b_uid != 0);
// A should see B join (broadcast_user_joined fires when B authenticates).
CHECK(wait_for(*evA, [b_uid](EventStore& s) {
for (auto u : s.joined_users) if (u == b_uid) return true;
return false;
}, 5000));
// Both should see each other in the authoritative user list.
CHECK(user_list_contains(evA->client, b_uid));
CHECK(user_list_contains(evB->client, a_uid));
// ── Drop A's TCP connection abruptly (no LeaveChannelRequest, no Goodbye —
// just close the socket, exactly like vccli Ctrl-C or a network drop). ──
vc_disconnect(evA->client);
vc_client_destroy(evA->client);
// (evA is now a dangling store; only evB is observed below.)
// B must receive VC_EVENT_USER_LEFT for A — the core fix under test.
CHECK(wait_for(*evB, [a_uid](EventStore& s) {
for (auto u : s.left_users) if (u == a_uid) return true;
return false;
}, 5000));
// B's authoritative user list must no longer contain A.
// Give the event a moment to propagate through the SessionModel, then poll briefly.
bool a_gone = false;
for (int i = 0; i < 20; ++i) {
if (!user_list_contains(evB->client, a_uid)) { a_gone = true; break; }
std::this_thread::sleep_for(std::chrono::milliseconds(100));
}
CHECK(a_gone);
// ── Cleanup ──────────────────────────────────────────────────────────────
vc_disconnect(evB->client);
vc_client_destroy(evB->client);
delete evA;
delete evB;
server.stop();
server_thread.join();
std::filesystem::remove_all(tmp);
if (g_failures == 0) {
std::printf("disconnect_left: all checks passed\n");
return 0;
}
std::printf("disconnect_left: %d failure(s)\n", g_failures);
return 1;
}
#else // !VOICECAT_HAS_NET
int main() {
std::printf("disconnect_left: SKIP (VOICECAT_HAS_NET not defined)\n");
return 0;
}
#endif // VOICECAT_HAS_NET

148
tests/test_plc_cap.cpp Normal file
View File

@@ -0,0 +1,148 @@
/*
* test_plc_cap — verifies the PLC cap in AudioEngine::on_playback.
*
* After ~2s of pure packet-loss concealment (no real packets decoded), the mixer stops
* calling opus_decode(nullptr,0,...) and emits digital silence instead. This bounds the
* Opus comfort-noise hiss so a stale stream left in the mixer can never hiss forever —
* defense-in-depth for the server's UserEvent::LEFT broadcast (the primary fix that
* triggers remove_stream on disconnect). Also verifies that a fresh real packet resets
* the PLC streak and audio resumes.
*
* White-box: drives AudioEngine::mix_for_test directly (no audio hardware needed).
*/
#include <cmath>
#include <cstdio>
#include <cstring>
#include <vector>
#if defined(VOICECAT_HAS_AUDIO) && defined(VOICECAT_HAS_OPUS)
#include "audio/audio_engine.h"
#include "codec/opus_codec.h"
static int g_failures = 0;
#define CHECK(cond) \
do { \
if (!(cond)) { \
std::printf("FAIL [%s:%d]: %s\n", __FILE__, __LINE__, #cond); \
++g_failures; \
} \
} while (0)
static double rms(const int16_t* pcm, int n) {
double sum = 0.0;
for (int i = 0; i < n; ++i) sum += static_cast<double>(pcm[i]) * pcm[i];
return std::sqrt(sum / n);
}
static int64_t abs_energy(const int16_t* pcm, int n) {
int64_t e = 0;
for (int i = 0; i < n; ++i) e += static_cast<int64_t>(std::abs(static_cast<int>(pcm[i])));
return e;
}
int main() {
voicecat::audio::AudioEngine engine;
voicecat::audio::AudioParams p;
p.sample_rate = 48000;
p.capture_channels = 1;
p.playback_channels = 2;
p.frame_ms = 20;
CHECK(engine.start(p)); // no capture_cb — headless safe (devices may fail to init; ok)
voicecat::codec::OpusParams op;
op.sample_rate = 48000;
op.frame_ms = 20;
op.stereo = false;
int frame_samples = voicecat::codec::opus_frame_samples(op); // 960
// Encode a loud sine wave to seed the decoder's PLC state.
voicecat::codec::OpusEncoder enc;
CHECK(enc.init(op));
std::vector<int16_t> sine(static_cast<size_t>(frame_samples));
for (int i = 0; i < frame_samples; ++i) {
float t = static_cast<float>(i) / 48000.0f;
sine[i] = static_cast<int16_t>(std::sin(2.0f * 3.14159265f * 440.0f * t) * 20000.0f);
}
uint8_t opus_buf[1500];
int opus_len = enc.encode(sine.data(), frame_samples, opus_buf, sizeof(opus_buf));
CHECK(opus_len > 0);
const uint32_t ssrc = 1;
engine.init_recv_stream(ssrc, op);
// Push one real frame to seed the decoder.
voicecat::audio::JitterBuffer::Frame f;
f.seq = 0;
f.timestamp = 0;
f.fec_present = false;
f.payload.assign(opus_buf, opus_buf + opus_len);
engine.push_recv_frame(ssrc, std::move(f));
// mix_for_test period — 480 frames @ 48kHz = 10ms (typical WASAPI shared period).
const uint32_t pb_frames = 480;
const int out_n = static_cast<int>(pb_frames) * 2; // stereo interleaved
std::vector<int16_t> out(static_cast<size_t>(out_n), 0);
// 1) Decode the real frame (first mix call) — seeds PLC state.
engine.mix_for_test(out.data(), pb_frames);
// 2) Drive ~50ms of pure PLC — should produce comfort noise (non-zero).
double early_rms = 0.0;
for (int i = 0; i < 5; ++i) {
engine.mix_for_test(out.data(), pb_frames);
early_rms = std::max(early_rms, rms(out.data(), out_n));
}
CHECK(early_rms > 1.0); // PLC of a loud sine is audible, not digital silence
// 3) Drive well past the 2s PLC cap (250 callbacks = 2.5s of output).
// After the cap, on_playback emits silence (memset 0) instead of PLC noise.
for (int i = 0; i < 250; ++i) {
engine.mix_for_test(out.data(), pb_frames);
}
// 4) The output must now be digital silence (all zeros), not comfort noise.
// Drain a couple more callbacks to flush any ring residue, then assert.
int64_t energy = 0;
for (int i = 0; i < 3; ++i) {
engine.mix_for_test(out.data(), pb_frames);
energy = std::max(energy, abs_energy(out.data(), out_n));
}
CHECK(energy == 0); // capped PLC = silence
// 5) Resumption: push a fresh real frame — PLC streak resets, audio returns.
voicecat::audio::JitterBuffer::Frame f2;
f2.seq = 1;
f2.timestamp = 200000; // far ahead — playout-clock re-sync snaps to it
f2.fec_present = false;
f2.payload.assign(opus_buf, opus_buf + opus_len);
engine.push_recv_frame(ssrc, std::move(f2));
double resume_rms = 0.0;
for (int i = 0; i < 5; ++i) { // a few calls to flush silence residue + decode real
engine.mix_for_test(out.data(), pb_frames);
resume_rms = std::max(resume_rms, rms(out.data(), out_n));
}
CHECK(resume_rms > 1.0); // real audio is back
engine.remove_stream(ssrc);
engine.stop();
enc.destroy();
if (g_failures == 0) {
std::printf("plc_cap: all checks passed (early_rms=%.1f resume_rms=%.1f)\n",
early_rms, resume_rms);
return 0;
}
std::printf("plc_cap: %d failure(s)\n", g_failures);
return 1;
}
#else
int main() {
std::printf("plc_cap: SKIP (VOICECAT_HAS_AUDIO or VOICECAT_HAS_OPUS not defined)\n");
return 0;
}
#endif

View File

@@ -0,0 +1,206 @@
/*
* test_reaper_timeout — verifies the server's keepalive reaper (docs/protocol.md §7).
*
* Simulates a half-open connection: client B authenticates then goes completely silent
* (no TCP traffic, no pings — the 15s ping interval far exceeds the test's 2s reaper
* timeout). Client A stays alive by sending channel text every 500ms, which bumps its
* last_seen on the server. After ~2s the reaper drops B: B's TCP connection is closed
* (B sees VC_EVENT_DISCONNECTED) and A receives VC_EVENT_USER_LEFT for B (the Tier 1
* LEFT-broadcast fires from close()).
*
* This catches the "ghost user forever" failure mode for half-open connections (NAT
* timeout, wifi loss without RST, laptop sleep) that never produce a TCP EOF.
*/
#include <cstdio>
#ifdef VOICECAT_HAS_NET
#include <atomic>
#include <chrono>
#include <condition_variable>
#include <filesystem>
#include <mutex>
#include <string>
#include <thread>
#include <vector>
#include "voicecat.h"
#include "server.h"
#include "db.h"
struct EventStore {
std::mutex mu;
std::condition_variable cv;
bool auth_ok{false};
uint32_t self_user_id{0};
bool channel_list_received{false};
bool disconnected{false};
std::vector<uint32_t> left_users;
vc_client* client{nullptr};
const char* label{nullptr};
};
static void on_event(void* user, const vc_event* ev) {
auto* s = static_cast<EventStore*>(user);
std::lock_guard lk(s->mu);
switch (ev->type) {
case VC_EVENT_SERVER_IDENTITY:
vc_confirm_server_identity(s->client, 1);
break;
case VC_EVENT_AUTH_RESULT:
s->auth_ok = (ev->result == VC_OK);
s->self_user_id = ev->user_id;
break;
case VC_EVENT_CHANNEL_LIST:
s->channel_list_received = true;
break;
case VC_EVENT_USER_LEFT:
s->left_users.push_back(ev->user_id);
break;
case VC_EVENT_DISCONNECTED:
s->disconnected = true;
break;
default:
break;
}
s->cv.notify_all();
}
template <typename Pred>
static bool wait_for(EventStore& s, Pred pred, int timeout_ms) {
auto deadline = std::chrono::steady_clock::now() + std::chrono::milliseconds(timeout_ms);
std::unique_lock lk(s.mu);
return s.cv.wait_until(lk, deadline, [&] { return pred(s); });
}
static int g_failures = 0;
#define CHECK(cond) \
do { \
if (!(cond)) { \
std::printf("FAIL: %s (%s:%d)\n", #cond, __FILE__, __LINE__); \
++g_failures; \
} \
} while (0)
int main() {
auto tmp = std::filesystem::temp_directory_path() /
("vctest_reaper_" + std::to_string(
std::chrono::steady_clock::now().time_since_epoch().count()));
std::filesystem::create_directories(tmp);
std::string data_dir = tmp.string();
std::atomic<uint16_t> bound_port{0};
std::mutex ready_mu;
std::condition_variable ready_cv;
bool ready{false};
voicecat::server::Config cfg;
cfg.data_dir = data_dir;
cfg.bind_port = 0;
cfg.server_name = "VoiceCat-ReaperTest";
cfg.allow_guests = true;
cfg.reaper_timeout_ms = 2000; // 2s — drop sessions silent for this long
cfg.reaper_sweep_ms = 500; // check every 500ms
cfg.on_ready = [&](uint16_t p) {
bound_port.store(p);
{ std::lock_guard lk(ready_mu); ready = true; }
ready_cv.notify_all();
};
voicecat::server::Server server(cfg);
std::thread server_thread([&] { server.run(); });
{
std::unique_lock lk(ready_mu);
if (!ready_cv.wait_for(lk, std::chrono::seconds(10), [&] { return ready; })) {
std::printf("FAIL: server did not become ready\n");
server.stop();
server_thread.join();
std::filesystem::remove_all(tmp);
return 1;
}
}
uint16_t port = bound_port.load();
auto make_client = [&](const char* label, const char* nick) -> EventStore* {
auto* ev = new EventStore();
ev->label = label;
vc_callbacks cb{on_event, nullptr, ev};
vc_config cfgx{label, "0.1", VC_LOG_OFF};
ev->client = vc_client_create(&cfgx, cb);
if (!ev->client) return nullptr;
if (vc_connect(ev->client, "127.0.0.1", port) != VC_OK) return nullptr;
if (vc_authenticate_guest(ev->client, nick) != VC_OK) return nullptr;
return ev;
};
EventStore* evA = make_client("clientA", "Alpha");
CHECK(evA != nullptr);
CHECK(wait_for(*evA, [](EventStore& s) { return s.auth_ok; }, 8000));
CHECK(wait_for(*evA, [](EventStore& s) { return s.channel_list_received; }, 3000));
uint32_t a_uid = evA->self_user_id;
CHECK(a_uid != 0);
EventStore* evB = make_client("clientB", "Bravo");
CHECK(evB != nullptr);
CHECK(wait_for(*evB, [](EventStore& s) { return s.auth_ok; }, 8000));
CHECK(wait_for(*evB, [](EventStore& s) { return s.channel_list_received; }, 3000));
uint32_t b_uid = evB->self_user_id;
CHECK(b_uid != 0);
// A stays alive by sending channel text every 500ms (bumps A's last_seen on the server).
// B goes completely silent — no TCP traffic, no pings (15s ping >> 2s reaper timeout).
// Start the keepalive IMMEDIATELY: the reaper timeout is only 2s, so A must begin
// sending well before its last_seen goes stale.
std::atomic<bool> keepalive_stop{false};
std::thread keepalive([&] {
while (!keepalive_stop.load()) {
vc_send_text(evA->client, VC_TEXT_CHANNEL, 1, ".");
std::this_thread::sleep_for(std::chrono::milliseconds(500));
}
});
// Give B time to go stale and the reaper to fire (2s timeout + 500ms sweep + margin).
// A must receive VC_EVENT_USER_LEFT for B.
CHECK(wait_for(*evA, [b_uid](EventStore& s) {
for (auto u : s.left_users) if (u == b_uid) return true;
return false;
}, 10000));
// B's TCP connection is closed by the reaper → B sees VC_EVENT_DISCONNECTED.
CHECK(wait_for(*evB, [](EventStore& s) { return s.disconnected; }, 5000));
// ── Cleanup ──────────────────────────────────────────────────────────────
keepalive_stop.store(true);
keepalive.join();
vc_disconnect(evA->client);
if (!evB->disconnected) vc_disconnect(evB->client);
vc_client_destroy(evA->client);
vc_client_destroy(evB->client);
delete evA;
delete evB;
server.stop();
server_thread.join();
std::filesystem::remove_all(tmp);
if (g_failures == 0) {
std::printf("reaper_timeout: all checks passed\n");
return 0;
}
std::printf("reaper_timeout: %d failure(s)\n", g_failures);
return 1;
}
#else // !VOICECAT_HAS_NET
int main() {
std::printf("reaper_timeout: SKIP (VOICECAT_HAS_NET not defined)\n");
return 0;
}
#endif // VOICECAT_HAS_NET