Name the machines a failing network part points at in the node's health report, so the watchman holds it where the controller does (issue 774)

delivery.NetworkPart.Targets (mesh-sdk 6eae076) is filled where the report is made, by the controller's own rule: - the hub's node for "hub"; - each resolver's node by its address on the private network; - none when the part points at nothing, at this machine, or at an address no other mesh machine has. The names come from the placements the node's own composer holds (Decided.Address, Decided.Hub). A spoke's tunnel names only the hub, so the tunnel cannot name a resolver on another spoke. A node that does not compose its own names no target. Test: rows in TestAHealthStatementIsSaidOnTheLinkOpenNow (hub, two resolvers, a VPN's resolver, its own, a healthy part).
2026-10-29 23:05:02 +01:00
parent 3ed9abf658
commit c3ff18de4e
7 changed files with 98 additions and 11 deletions
@@ -3,6 +3,7 @@ package link
 import (
 	"context"
 	"encoding/json"
+	"slices"
 	"strings"
 	"testing"
 	"time"
@@ -69,12 +70,32 @@ func TestAHealthStatementIsSaidOnTheLinkOpenNow(t *testing.T) {
 					{Module: "letta", Resource: "letta.server", Kind: "container", State: StateHealthy, Since: since}}}
 		}
 		peers := []PeerSeen{{Key: "B=", Seen: true}, {Key: "A=", Addresses: []string{"10.10.0.2/32"}}}
-		r := NodeHealthOf("anchor", look(1, "NetworkManager"), peers)
+		r := NodeHealthOf("anchor", look(1, "NetworkManager"), peers, Machines{})
 		if r.Network.Parts[0].Writer != "NetworkManager" || r.Network.Parts[0].Streak != 0 || r.Peers[0].Key != "A=" ||
 			len(r.Units.Failed) != 1 || len(r.Relogin) != 1 || r.Relogin[0].Account != "jochen" ||
 			len(r.Found) != 1 || r.Found[0].Path != "/srv/photos" {
 			t.Fatalf("the report is %+v", r)
 		}
+		// The machines an unhealthy part points at, as the controller holds it there; none for the machine's own.
+		machines := Machines{ByAddress: map[string]string{"10.10.0.1": "novox", "10.10.0.4": "ace", "10.10.0.9": "anchor"}, Hub: "novox"}
+		for _, tc := range []struct {
+			name   string
+			toward []string
+			state  string
+			want   []string
+		}{
+			{"the tunnel to the hub", []string{"hub"}, StateUnhealthy, []string{"novox"}},
+			{"two mesh resolvers", []string{"10.10.0.1", "10.10.0.4"}, StateUnhealthy, []string{"novox", "ace"}},
+			{"a resolver a VPN client wrote in is the machine's own", []string{"10.10.0.1", "192.0.2.53"}, StateUnhealthy, nil},
+			{"its own resolver is its own", []string{"10.10.0.9"}, StateUnhealthy, nil},
+			{"a healthy part points at nothing", []string{"hub"}, StateHealthy, nil},
+		} {
+			h := Health{Network: &NetworkHealth{State: tc.state, Parts: []NetworkPart{{Part: "names", State: tc.state, Toward: tc.toward}}}}
+			got := NodeHealthOf("anchor", h, nil, machines).Network.Parts[0].Targets
+			if !slices.Equal(got, tc.want) {
+				t.Errorf("%s: targets %v, want %v", tc.name, got, tc.want)
+			}
+		}
 		store := &memHealth{}
 		var last *NodeHealth
 		clock := func() time.Time { return since }
@@ -84,10 +105,10 @@ func TestAHealthStatementIsSaidOnTheLinkOpenNow(t *testing.T) {
 			wrote bool
 		}{
 			{h: r, wrote: true},
-			{h: NodeHealthOf("anchor", look(2, "NetworkManager"), peers)},
-			{h: NodeHealthOf("anchor", look(3, "NetworkManager"), peers), fresh: true},
-			{h: NodeHealthOf("anchor", look(3, "openvpn"), peers), wrote: true},
-			{h: NodeHealthOf("anchor", look(3, "openvpn"), []PeerSeen{{Key: "A=", Seen: true}}), wrote: true},
+			{h: NodeHealthOf("anchor", look(2, "NetworkManager"), peers, Machines{})},
+			{h: NodeHealthOf("anchor", look(3, "NetworkManager"), peers, Machines{}), fresh: true},
+			{h: NodeHealthOf("anchor", look(3, "openvpn"), peers, Machines{}), wrote: true},
+			{h: NodeHealthOf("anchor", look(3, "openvpn"), []PeerSeen{{Key: "A=", Seen: true}}, Machines{}), wrote: true},
 		} {
 			if step.fresh {
 				last = nil
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -43,9 +44,43 @@ type (
 // ReasonReloginNeeded starts an account's reason when its session needs a new login (accounts.ReasonRelogin).
 const ReasonReloginNeeded = "relogin needed"

+// Machines names the mesh's machines for a report's targets: each node by its address on the private network, and the
+// hub's node. The zero value names none, and every part is then the machine's own.
+type Machines struct {
+	ByAddress map[string]string
+	Hub       string
+}
+
+// targets is the machines a part points at, as the controller holds it (mesh-controller machine_network.go): the hub's
+// node for TowardHub, each resolver's node by its address; none when it points at nothing, or at this machine or an
+// address no other mesh machine has, as one of them makes the part the machine's own.
+func (m Machines) targets(node string, toward []string) []string {
+	if len(toward) == 0 {
+		return nil
+	}
+	var out []string
+	for _, t := range toward {
+		x := m.ByAddress[t]
+		if t == TowardHub {
+			x = m.Hub
+		}
+		if x == "" || x == node {
+			return nil
+		}
+		if !slices.Contains(out, x) {
+			out = append(out, x)
+		}
+	}
+	return out
+}
+
+// TowardHub is what a part failing toward the hub names in Toward (network.TowardHub).
+const TowardHub = "hub"
+
 // NodeHealthOf is the report a health statement and the tunnel's peers make: the statement's network without its
-// streaks, its machine units, and each account and directory of its resources that the six alerts read.
-func NodeHealthOf(node string, h Health, peers []PeerSeen) NodeHealth {
+// streaks, each unhealthy part naming the machines it points at (machines), its machine units, and each account and
+// directory of its resources that the six alerts read.
+func NodeHealthOf(node string, h Health, peers []PeerSeen, machines Machines) NodeHealth {
 	out := NodeHealth{V: NodeHealthVersion, Node: node, Units: h.Units}
 	if len(peers) > 0 {
 		out.Peers = append([]PeerSeen(nil), peers...)
@@ -55,6 +90,10 @@ func NodeHealthOf(node string, h Health, peers []PeerSeen) NodeHealth {
 		n := NetworkHealth{State: h.Network.State, Since: h.Network.Since, Parts: make([]NetworkPart, 0, len(h.Network.Parts))}
 		for _, p := range h.Network.Parts {
 			p.Streak = 0 // a look's count moves every look; the report says a part's state, not how often it was seen
+			p.Targets = nil
+			if p.State == StateUnhealthy {
+				p.Targets = machines.targets(node, p.Toward)
+			}
 			n.Parts = append(n.Parts, p)
 		}
 		out.Network = &n
@@ -423,6 +423,24 @@ func (c *Composer) takeModuleHave(u agent.Update) bool {
 }

 // inOwnOf is, of the modules p places, those the node runs inside its own composition (c.inOwn), sorted; c.mu held.
+// Machines is, from the placements this composer holds, each node by its address on the private network, and the hub's
+// node: what names the machine a failing network part points at (delivery.NetworkPart.Targets, issue 774). Empty
+// before any placement is read.
+func (c *Composer) Machines() (byAddress map[string]string, hub string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	byAddress = map[string]string{}
+	for node, p := range c.placements {
+		if a, _, _ := strings.Cut(p.Decided.Address, "/"); a != "" {
+			byAddress[a] = node
+		}
+		if p.Decided.Hub {
+			hub = node
+		}
+	}
+	return byAddress, hub
+}
+
 func (c *Composer) inOwnOf(p delivery.Placement) []string {
 	var out []string
 	for _, m := range p.Modules {