tests: rework the actually useful tests to live in the integration crate

crates/irtt-client/tests/client.rs

@@ -0,0 +1,8 @@
+use irtt_client::*;
+use std::{
+    net::SocketAddr,
+    time::{Duration, Instant},
+};
+
+#[path = "client/mod.rs"]
+mod client;

crates/irtt-client/tests/client/close.rs

@@ -0,0 +1,487 @@
+use super::*;
+
+#[test]
+fn open_fails_after_close() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.close().unwrap();
+    assert!(matches!(client.open(), Err(ClientError::AlreadyClosed)));
+    server.join();
+}
+
+#[test]
+fn send_probe_fails_after_close() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+        socket
+            .set_read_timeout(Some(Duration::from_secs(2)))
+            .unwrap();
+        loop {
+            let mut buf = [0_u8; 512];
+            match socket.recv_from(&mut buf) {
+                Ok((size, _)) => {
+                    tx.send(buf[..size].to_vec()).unwrap();
+                }
+                Err(_) => break,
+            }
+        }
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.close().unwrap();
+    assert!(matches!(
+        client.send_probe(),
+        Err(ClientError::AlreadyClosed)
+    ));
+    server.join();
+}
+
+#[test]
+fn recv_available_stops_after_peer_close() {
+    let params = default_params();
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            socket
+                .send_to(
+                    &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                    peer,
+                )
+                .unwrap();
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            let close = echo_reply_packet_with_flags(
+                TOKEN,
+                seq,
+                &params,
+                &TimestampFields::default(),
+                None,
+                FLAG_REPLY | flags::FLAG_CLOSE,
+            );
+            socket.send_to(&close, peer).unwrap();
+            socket.send_to(&close, peer).unwrap();
+        }
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+
+    let events = client
+        .recv_available(RecvBudget { max_packets: 8 })
+        .unwrap();
+
+    assert!(matches!(
+        events.as_slice(),
+        [
+            ClientEvent::EchoReply { .. },
+            ClientEvent::SessionClosed { token: TOKEN, .. }
+        ]
+    ));
+    assert!(client.is_peer_closed());
+    server.join();
+}
+
+#[test]
+fn close_flagged_duplicate_emits_duplicate_then_closes() {
+    let params = default_params();
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            socket
+                .send_to(
+                    &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                    peer,
+                )
+                .unwrap();
+
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            let normal = echo_reply_packet(TOKEN, seq, &params, &TimestampFields::default(), None);
+            let close = echo_reply_packet_with_flags(
+                TOKEN,
+                seq,
+                &params,
+                &TimestampFields::default(),
+                None,
+                FLAG_REPLY | flags::FLAG_CLOSE,
+            );
+            socket.send_to(&normal, peer).unwrap();
+            socket.send_to(&close, peer).unwrap();
+        }
+    });
+    let mut client = Client::connect(ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    })
+    .unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+
+    assert!(matches!(
+        client.recv_once().unwrap().as_slice(),
+        [ClientEvent::EchoReply { seq: 0, .. }]
+    ));
+    assert!(matches!(
+        client.recv_once().unwrap().as_slice(),
+        [
+            ClientEvent::DuplicateReply { seq: 0, .. },
+            ClientEvent::SessionClosed { token: TOKEN, .. }
+        ]
+    ));
+    assert!(client.is_peer_closed());
+    server.join();
+}
+
+#[test]
+fn close_flagged_retained_timeout_emits_late_then_closes() {
+    let params = default_params();
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            socket
+                .send_to(
+                    &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                    peer,
+                )
+                .unwrap();
+
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            socket
+                .send_to(
+                    &echo_reply_packet_with_flags(
+                        TOKEN,
+                        seq,
+                        &params,
+                        &TimestampFields::default(),
+                        None,
+                        FLAG_REPLY | flags::FLAG_CLOSE,
+                    ),
+                    peer,
+                )
+                .unwrap();
+        }
+    });
+    let mut client = Client::connect(ClientConfig {
+        probe_timeout: Duration::from_millis(50),
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    })
+    .unwrap();
+    assert_open_started(client.open().unwrap());
+    let sent = client.send_probe().unwrap();
+    let ClientEvent::EchoSent { sent_at, .. } = &sent[0] else {
+        panic!("expected EchoSent");
+    };
+    assert!(matches!(
+        client
+            .poll_timeouts_at(sent_at.mono + client.probe_timeout())
+            .unwrap()
+            .as_slice(),
+        [ClientEvent::EchoLoss { seq: 0, .. }]
+    ));
+
+    assert!(matches!(
+        client.recv_once().unwrap().as_slice(),
+        [
+            ClientEvent::LateReply {
+                seq: 0,
+                sent_at: Some(_),
+                ..
+            },
+            ClientEvent::SessionClosed { token: TOKEN, .. }
+        ]
+    ));
+    assert!(client.is_peer_closed());
+    server.join();
+}
+
+#[test]
+fn close_flagged_evicted_sequence_emits_late_then_closes() {
+    let params = default_params();
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            socket
+                .send_to(
+                    &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                    peer,
+                )
+                .unwrap();
+
+            let (first, _) = recv_request(&socket, &tx);
+            let first_seq = u32::from_le_bytes(first[12..16].try_into().unwrap());
+            socket
+                .send_to(
+                    &echo_reply_packet(
+                        TOKEN,
+                        first_seq,
+                        &params,
+                        &TimestampFields::default(),
+                        None,
+                    ),
+                    peer,
+                )
+                .unwrap();
+
+            let (second, _) = recv_request(&socket, &tx);
+            let second_seq = u32::from_le_bytes(second[12..16].try_into().unwrap());
+            socket
+                .send_to(
+                    &echo_reply_packet(
+                        TOKEN,
+                        second_seq,
+                        &params,
+                        &TimestampFields::default(),
+                        None,
+                    ),
+                    peer,
+                )
+                .unwrap();
+            socket
+                .send_to(
+                    &echo_reply_packet_with_flags(
+                        TOKEN,
+                        first_seq,
+                        &params,
+                        &TimestampFields::default(),
+                        None,
+                        FLAG_REPLY | flags::FLAG_CLOSE,
+                    ),
+                    peer,
+                )
+                .unwrap();
+        }
+    });
+    let mut client = Client::connect(ClientConfig {
+        max_pending_probes: 1,
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    })
+    .unwrap();
+    assert_open_started(client.open().unwrap());
+
+    client.send_probe().unwrap();
+    assert!(matches!(
+        client.recv_once().unwrap().as_slice(),
+        [ClientEvent::EchoReply { seq: 0, .. }]
+    ));
+    client.send_probe().unwrap();
+    assert!(matches!(
+        client.recv_once().unwrap().as_slice(),
+        [ClientEvent::EchoReply { seq: 1, .. }]
+    ));
+    assert!(matches!(
+        client.recv_once().unwrap().as_slice(),
+        [
+            ClientEvent::LateReply {
+                seq: 0,
+                sent_at: None,
+                rtt: None,
+                ..
+            },
+            ClientEvent::SessionClosed { token: TOKEN, .. }
+        ]
+    ));
+    assert!(client.is_peer_closed());
+    server.join();
+}
+
+#[test]
+fn close_flagged_untracked_sequence_emits_warning_then_closes() {
+    let params = default_params();
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            socket
+                .send_to(
+                    &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                    peer,
+                )
+                .unwrap();
+            socket
+                .send_to(
+                    &echo_reply_packet_with_flags(
+                        TOKEN,
+                        42,
+                        &params,
+                        &TimestampFields::default(),
+                        None,
+                        FLAG_REPLY | flags::FLAG_CLOSE,
+                    ),
+                    peer,
+                )
+                .unwrap();
+        }
+    });
+    let mut client = Client::connect(ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    })
+    .unwrap();
+    assert_open_started(client.open().unwrap());
+
+    assert!(matches!(
+        client.recv_once().unwrap().as_slice(),
+        [
+            ClientEvent::Warning {
+                kind: WarningKind::UntrackedReply,
+                ..
+            },
+            ClientEvent::SessionClosed { token: TOKEN, .. }
+        ]
+    ));
+    assert!(client.is_peer_closed());
+    server.join();
+}
+
+#[test]
+fn wrong_token_close_flag_does_not_close_session() {
+    let params = default_params();
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            socket
+                .send_to(
+                    &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                    peer,
+                )
+                .unwrap();
+
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            socket
+                .send_to(
+                    &echo_reply_packet_with_flags(
+                        TOKEN.wrapping_add(1),
+                        seq,
+                        &params,
+                        &TimestampFields::default(),
+                        None,
+                        FLAG_REPLY | flags::FLAG_CLOSE,
+                    ),
+                    peer,
+                )
+                .unwrap();
+
+            let _ = recv_request(&socket, &tx);
+            let _ = recv_request(&socket, &tx);
+        }
+    });
+    let mut client = Client::connect(ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    })
+    .unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+
+    assert!(matches!(
+        client.recv_once().unwrap().as_slice(),
+        [ClientEvent::Warning {
+            kind: WarningKind::WrongToken,
+            ..
+        }]
+    ));
+    assert!(!client.is_peer_closed());
+    assert!(matches!(
+        client.send_probe().unwrap().as_slice(),
+        [ClientEvent::EchoSent { seq: 1, .. }]
+    ));
+    client.close().unwrap();
+    server.join();
+}
+
+#[test]
+fn close_flagged_echo_reply_emits_reply_then_closes_without_sending_close() {
+    let params = default_params();
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+            socket.send_to(&reply, peer).unwrap();
+
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            let reply = echo_reply_packet_with_flags(
+                TOKEN,
+                seq,
+                &params,
+                &TimestampFields::default(),
+                None,
+                FLAG_REPLY | flags::FLAG_CLOSE,
+            );
+            socket.send_to(&reply, peer).unwrap();
+
+            socket
+                .set_read_timeout(Some(Duration::from_millis(250)))
+                .unwrap();
+            while recv_request_timeout(&socket, &tx).is_some() {}
+        }
+    });
+    let config = ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+
+    let events = client.recv_once().unwrap();
+    assert!(matches!(
+        events.first(),
+        Some(ClientEvent::EchoReply { .. })
+    ));
+    assert!(matches!(
+        events.get(1),
+        Some(ClientEvent::SessionClosed { token: TOKEN, .. })
+    ));
+    assert_eq!(events.len(), 2);
+
+    assert!(matches!(
+        client.send_probe(),
+        Err(ClientError::AlreadyClosed)
+    ));
+
+    let first = server.rx.recv_timeout(Duration::from_millis(100)).unwrap();
+    let second = server.rx.recv_timeout(Duration::from_millis(100)).unwrap();
+    assert_eq!(first[3] & FLAG_OPEN, FLAG_OPEN);
+    assert_eq!(second[3] & flags::FLAG_CLOSE, 0);
+    assert!(server.rx.recv_timeout(Duration::from_millis(400)).is_err());
+    server.join();
+}

crates/irtt-client/tests/client/config.rs

@@ -0,0 +1,117 @@
+use super::*;
+
+#[test]
+fn connect_rejects_invalid_configuration() {
+    let i64_max_ns = u64::try_from(i64::MAX).unwrap();
+    let too_large = Duration::from_nanos(i64_max_ns) + Duration::from_nanos(1);
+    let cases = [
+        (
+            "oversized UDP payload",
+            ClientConfig {
+                length: MAX_UDP_PAYLOAD_LENGTH + 1,
+                ..ClientConfig::default()
+            },
+            "packet length",
+        ),
+        (
+            "zero finite duration",
+            ClientConfig {
+                duration: Some(Duration::ZERO),
+                ..ClientConfig::default()
+            },
+            "duration must be greater than zero; use None for continuous mode",
+        ),
+        (
+            "zero interval",
+            ClientConfig {
+                interval: Duration::ZERO,
+                ..ClientConfig::default()
+            },
+            "interval must be greater than zero",
+        ),
+        (
+            "duration nanosecond overflow",
+            ClientConfig {
+                duration: Some(too_large),
+                ..ClientConfig::default()
+            },
+            "duration is too large to encode as nanoseconds",
+        ),
+        (
+            "interval nanosecond overflow",
+            ClientConfig {
+                interval: too_large,
+                ..ClientConfig::default()
+            },
+            "interval is too large to encode as nanoseconds",
+        ),
+        (
+            "invalid DSCP codepoint",
+            ClientConfig {
+                dscp: 64,
+                ..ClientConfig::default()
+            },
+            "dscp",
+        ),
+        (
+            // The unspecified clock is the absent-tag wire default, not a
+            // client mode; a client that needs timestamps must name a clock.
+            "unspecified clock",
+            ClientConfig {
+                clock: Clock::Unspecified,
+                ..ClientConfig::default()
+            },
+            "clock must be wall, monotonic, or both",
+        ),
+        (
+            "empty server fill",
+            ClientConfig {
+                server_fill: Some("".to_owned()),
+                ..ClientConfig::default()
+            },
+            "server_fill",
+        ),
+        (
+            "oversized server fill",
+            ClientConfig {
+                server_fill: Some("0123456789abcdef0123456789abcdefx".to_owned()),
+                ..ClientConfig::default()
+            },
+            "server_fill",
+        ),
+    ];
+
+    for (name, config, expected_reason) in cases {
+        assert!(
+            matches!(
+                Client::connect(config),
+                Err(ClientError::InvalidConfig { .. })
+            ),
+            "{name} should fail with InvalidConfig ({expected_reason})"
+        );
+    }
+}
+
+#[test]
+fn minimum_open_timeout_under_200ms_is_rejected() {
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(199)],
+        ..ClientConfig::default()
+    };
+    assert!(matches!(
+        Client::connect(config),
+        Err(ClientError::OpenTimeoutTooSmall { .. })
+    ));
+}
+
+#[test]
+fn empty_open_timeouts_is_rejected() {
+    let config = ClientConfig {
+        open_timeouts: vec![],
+        ..ClientConfig::default()
+    };
+    assert!(matches!(
+        Client::connect(config),
+        Err(ClientError::NoOpenTimeouts)
+    ));
+}

crates/irtt-client/tests/client/hmac.rs

@@ -0,0 +1,76 @@
+use super::*;
+
+#[test]
+fn hmac_open_ignores_missing_hmac_before_valid_reply() {
+    let key = b"secret".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let missing = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
+        socket.send_to(&missing, peer).unwrap();
+        socket.send_to(&valid, peer).unwrap();
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn hmac_open_ignores_bad_hmac_before_valid_reply() {
+    let key = b"secret".to_vec();
+    let wrong_key = b"wrong".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let bad = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&wrong_key));
+        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(&key));
+        socket.send_to(&bad, peer).unwrap();
+        socket.send_to(&valid, peer).unwrap();
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn post_token_hmac_negotiation_failure_sends_authenticated_cleanup_close() {
+    let key = b"secret".to_vec();
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.hmac_key = Some(key.clone());
+    let mut returned = default_params();
+    returned.interval_ns += 1;
+    let server_key = key.clone();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, Some(&server_key));
+        socket.send_to(&reply, peer).unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::NegotiationRejected { .. })
+    ));
+    let packets: Vec<_> = server.rx.iter().take(2).collect();
+    let cleanup = &packets[1];
+    assert_eq!(cleanup[3], flags::FLAG_CLOSE | FLAG_HMAC);
+    verify_packet_hmac(&key, cleanup).unwrap();
+    assert_eq!(
+        u64::from_le_bytes(cleanup[4 + HMAC_SIZE..12 + HMAC_SIZE].try_into().unwrap()),
+        TOKEN
+    );
+    server.join();
+}

crates/irtt-client/tests/client/mod.rs

@@ -0,0 +1,22 @@
+use super::*;
+use irtt_client::NegotiationPolicy;
+use irtt_client::{NegotiatedParams, RunMode, WarningKind, MAX_UDP_PAYLOAD_LENGTH};
+use irtt_proto::{flags, Params, TimestampFields};
+use irtt_proto::{
+    flags::FLAG_HMAC, flags::FLAG_OPEN, flags::FLAG_REPLY, verify_packet_hmac, Clock, HMAC_SIZE,
+    MAGIC,
+};
+use std::thread;
+#[cfg(all(target_os = "linux", feature = "ancillary"))]
+use std::time::SystemTime;
+
+mod support;
+use support::*;
+
+mod close;
+mod config;
+mod hmac;
+mod no_test;
+mod open;
+mod probes_replies;
+mod ttl;

crates/irtt-client/tests/client/no_test.rs

@@ -0,0 +1,114 @@
+use super::*;
+
+#[test]
+fn no_test_rejects_non_close_open_reply() {
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.run_mode = RunMode::NoTest;
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        socket
+            .send_to(
+                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                peer,
+            )
+            .unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::UnexpectedNoTestReply)
+    ));
+    let packets: Vec<_> = server.rx.iter().take(2).collect();
+    assert_eq!(packets[1][3], flags::FLAG_CLOSE);
+    assert_eq!(
+        u64::from_le_bytes(packets[1][4..12].try_into().unwrap()),
+        TOKEN
+    );
+    server.join();
+}
+
+#[test]
+fn no_test_rejects_non_zero_token_with_close_reply() {
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.run_mode = RunMode::NoTest;
+    let params = default_params();
+    let server = no_test_server(params, TOKEN);
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::NonZeroNoTestToken { token: TOKEN })
+    ));
+    server.join();
+}
+
+#[test]
+fn no_test_strict_negotiation_rejects_changed_params() {
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.run_mode = RunMode::NoTest;
+    let mut params = default_params();
+    params.dscp = 1;
+    let server = no_test_server(params, 0);
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::NegotiationRejected { .. })
+    ));
+    server.join();
+}
+
+#[test]
+fn no_test_loose_negotiation_accepts_restricted_params() {
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.run_mode = RunMode::NoTest;
+    config.negotiation_policy = NegotiationPolicy::Loose;
+    let requested = default_params();
+    let mut params = requested.clone();
+    params.duration_ns /= 2;
+    let server = no_test_server(params.clone(), 0);
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    let negotiated = assert_no_test_completed(client.open().unwrap());
+    assert_eq!(negotiated.params, params);
+    assert_eq!(
+        negotiated.restrictions,
+        vec![irtt_client::NegotiationRestriction::DurationReduced {
+            requested_ns: requested.duration_ns,
+            negotiated_ns: params.duration_ns,
+        }]
+    );
+    server.join();
+}
+
+#[test]
+fn send_probe_fails_after_no_test_completed() {
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.run_mode = RunMode::NoTest;
+    let params = default_params();
+    let server = no_test_server(params, 0);
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert_no_test_completed(client.open().unwrap());
+    assert!(matches!(
+        client.send_probe(),
+        Err(ClientError::AlreadyCompleted)
+    ));
+    server.join();
+}
+
+#[test]
+fn open_fails_after_no_test_completed() {
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.run_mode = RunMode::NoTest;
+    let params = default_params();
+    let server = no_test_server(params, 0);
+    config.server_addr = server.addr.to_string();
+    let mut client = Client::connect(config).unwrap();
+    assert_no_test_completed(client.open().unwrap());
+    assert!(matches!(client.open(), Err(ClientError::AlreadyCompleted)));
+    server.join();
+}

crates/irtt-client/tests/client/open.rs

@@ -0,0 +1,254 @@
+use super::*;
+
+// Untrusted returned intervals must be rejected before managed scheduling,
+// even when loose negotiation permits legitimate server restrictions.
+#[test]
+fn loose_open_rejects_nonpositive_returned_intervals() {
+    for interval_ns in [0, -1] {
+        let mut returned = default_params();
+        returned.interval_ns = interval_ns;
+        let server = open_success_server(returned);
+        let config = ClientConfig {
+            negotiation_policy: NegotiationPolicy::Loose,
+            ..default_test_config(server.addr)
+        };
+        let mut client = Client::connect(config).unwrap();
+        assert!(
+            matches!(client.open(), Err(ClientError::NegotiationRejected { .. })),
+            "returned interval {interval_ns} must be rejected"
+        );
+        server.join();
+    }
+}
+
+#[test]
+fn open_fails_when_already_open() {
+    let params = default_params();
+    let server = open_success_server(params);
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert!(matches!(client.open(), Err(ClientError::AlreadyOpen)));
+    server.join();
+}
+
+#[test]
+fn open_retries_after_first_timeout() {
+    let server = start_fake_server(|socket, tx| {
+        let (first, _) = recv_request(&socket, &tx);
+        let (_, peer) = recv_request(&socket, &tx);
+        let params = Params::decode(&first[4..]).unwrap();
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        assert_eq!(first[3] & FLAG_OPEN, FLAG_OPEN);
+        socket.send_to(&reply, peer).unwrap();
+    });
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(500)],
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    let outcome = client.open().unwrap();
+    assert_open_started(outcome);
+    assert_eq!(server.rx.iter().take(2).count(), 2);
+    server.join();
+}
+
+#[test]
+fn protocol_version_mismatch_fails() {
+    let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 1)));
+    config.negotiation_policy = NegotiationPolicy::Loose;
+    let mut params = default_params();
+    params.protocol_version = 2;
+    let server = open_success_server(params);
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::ProtocolVersionMismatch { received: 2, .. })
+    ));
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    server.join();
+}
+
+#[test]
+fn server_rejection_fails_in_normal_mode() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY | flags::FLAG_CLOSE, 0, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+    assert!(matches!(client.open(), Err(ClientError::ServerRejected)));
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    server.join();
+}
+
+#[test]
+fn ignored_datagrams_do_not_restart_the_attempt_deadline() {
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        thread::sleep(Duration::from_millis(150));
+        socket.send_to(&[0_u8], peer).unwrap();
+        thread::sleep(Duration::from_millis(150));
+        socket.send_to(&[0_u8], peer).unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(250), Duration::from_millis(250)],
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    let started = Instant::now();
+
+    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
+    let requests: Vec<_> = server.rx.iter().take(2).collect();
+    assert_eq!(requests.len(), 2);
+    assert!(
+        started.elapsed() < Duration::from_millis(700),
+        "ignored datagrams restarted an attempt deadline"
+    );
+    server.join();
+}
+
+#[test]
+fn opening_deadline_overflow_occurs_before_send() {
+    let server = timeout_server(Duration::from_millis(250));
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::MAX],
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+
+    assert!(matches!(client.open(), Err(ClientError::DurationOverflow)));
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn post_token_negotiation_failure_sends_cleanup_close() {
+    let mut returned = default_params();
+    returned.interval_ns += 1;
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        socket
+            .send_to(
+                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &returned, None),
+                peer,
+            )
+            .unwrap();
+        let _ = recv_request(&socket, &tx);
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::NegotiationRejected { .. })
+    ));
+    let packets: Vec<_> = server.rx.iter().take(2).collect();
+    assert_eq!(packets[1][3], flags::FLAG_CLOSE);
+    assert_eq!(
+        u64::from_le_bytes(packets[1][4..12].try_into().unwrap()),
+        TOKEN
+    );
+    server.join();
+}
+
+#[test]
+fn open_timeout_after_all_timeouts() {
+    let server = timeout_server(Duration::from_millis(700));
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(50)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
+    assert_eq!(server.rx.iter().take(2).count(), 2);
+    server.join();
+}
+
+#[test]
+fn multiple_untrusted_datagrams_before_valid_reply_use_one_attempt() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let valid = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        let mut wrong_type = valid.clone();
+        wrong_type[3] = FLAG_REPLY;
+        let mut reserved_flags = valid.clone();
+        reserved_flags[3] |= 0x10;
+        let mut bad_magic = valid.clone();
+        bad_magic[0] ^= 0xff;
+        let unexpected_hmac =
+            open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, Some(b"unexpected"));
+
+        for packet in [
+            vec![0_u8],
+            bad_magic,
+            wrong_type,
+            reserved_flags,
+            unexpected_hmac,
+            valid,
+        ] {
+            socket.send_to(&packet, peer).unwrap();
+        }
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+
+    assert_open_started(client.open().unwrap());
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+    assert!(server.rx.try_recv().is_err());
+
+    server.join();
+}
+
+#[test]
+fn only_ignored_open_datagrams_eventually_time_out() {
+    let server = start_fake_server(move |socket, tx| {
+        for _ in 0..2 {
+            let (_, peer) = recv_request(&socket, &tx);
+            socket.send_to(&[0_u8], peer).unwrap();
+            socket.send_to(&MAGIC, peer).unwrap();
+        }
+        thread::sleep(Duration::from_millis(300));
+    });
+    let config = ClientConfig {
+        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(50)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+
+    assert!(matches!(client.open(), Err(ClientError::OpenTimeout)));
+    assert_eq!(server.rx.iter().take(2).count(), 2);
+    assert!(server.rx.try_recv().is_err());
+    server.join();
+}
+
+#[test]
+fn trusted_zero_token_normal_reply_is_terminal() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        // encode_open_reply rejects a zero token without FLAG_CLOSE, so this
+        // deliberately non-compliant reply is built by encoding a normal
+        // reply with a placeholder token and then zeroing the token field.
+        let mut reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        reply[HMAC_OFFSET..HMAC_OFFSET + 8].copy_from_slice(&0_u64.to_le_bytes());
+        socket.send_to(&reply, peer).unwrap();
+    });
+    let mut client = Client::connect(default_test_config(server.addr)).unwrap();
+
+    assert!(matches!(
+        client.open(),
+        Err(ClientError::Protocol(irtt_proto::ProtoError::ZeroToken))
+    ));
+    assert_eq!(server.rx.iter().take(1).count(), 1);
+
+    server.join();
+}

crates/irtt-client/tests/client/probes_replies/burst_recv.rs

@@ -0,0 +1,54 @@
+use super::*;
+
+#[test]
+fn recv_available_drains_burst_replies() {
+    let params = default_params();
+    let (mut client, server) = open_client_with_echo_server(&params);
+
+    client.send_probe().unwrap();
+    client.send_probe().unwrap();
+    client.send_probe().unwrap();
+    thread::sleep(Duration::from_millis(80));
+
+    let events = client
+        .recv_available(RecvBudget { max_packets: 8 })
+        .unwrap();
+    assert_eq!(events.len(), 3);
+    for (seq, event) in events.iter().enumerate() {
+        assert!(matches!(
+            event,
+            ClientEvent::EchoReply {
+                seq: actual_seq,
+                ..
+            } if *actual_seq == seq as u32
+        ));
+    }
+
+    client.close().unwrap();
+    server.join();
+}
+
+#[test]
+fn recv_available_respects_packet_budget() {
+    let params = default_params();
+    let (mut client, server) = open_client_with_echo_server(&params);
+
+    client.send_probe().unwrap();
+    client.send_probe().unwrap();
+    thread::sleep(Duration::from_millis(80));
+
+    let first = client
+        .recv_available(RecvBudget { max_packets: 1 })
+        .unwrap();
+    assert_eq!(first.len(), 1);
+    assert!(matches!(&first[0], ClientEvent::EchoReply { seq: 0, .. }));
+
+    let second = client
+        .recv_available(RecvBudget { max_packets: 8 })
+        .unwrap();
+    assert_eq!(second.len(), 1);
+    assert!(matches!(&second[0], ClientEvent::EchoReply { seq: 1, .. }));
+
+    client.close().unwrap();
+    server.join();
+}

crates/irtt-client/tests/client/probes_replies/mod.rs

@@ -0,0 +1,27 @@
+use super::*;
+use support::echo_packet_len;
+
+#[cfg(not(all(target_os = "linux", feature = "ancillary")))]
+fn assert_packet_meta_unavailable(packet_meta: &irtt_client::PacketMeta) {
+    assert_eq!(packet_meta.traffic_class, None);
+    assert_eq!(packet_meta.dscp, None);
+    assert_eq!(packet_meta.ecn, None);
+    assert_eq!(packet_meta.kernel_rx_timestamp, None);
+}
+
+#[cfg(all(target_os = "linux", feature = "ancillary"))]
+fn metadata_unavailable_skip(test_name: &str) {
+    eprintln!("{test_name}: skipping metadata assertion because kernel did not provide traffic class metadata");
+}
+
+#[cfg(all(target_os = "linux", feature = "ancillary"))]
+fn kernel_rx_timestamp_unavailable_skip(test_name: &str) {
+    eprintln!("{test_name}: skipping kernel timestamp assertion because kernel did not provide SCM_TIMESTAMPNS");
+}
+
+mod burst_recv;
+mod packet_length;
+mod reply_classification;
+mod reply_decode;
+mod reply_metadata;
+mod timeouts;

crates/irtt-client/tests/client/probes_replies/packet_length.rs

@@ -0,0 +1,133 @@
+use super::*;
+
+// ---------- Regression tests ----------
+
+#[test]
+fn short_echo_reply_does_not_emit_echo_reply() {
+    let params = Params {
+        length: 64,
+        ..default_params()
+    };
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+            socket.send_to(&reply, peer).unwrap();
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            let mut reply =
+                echo_reply_packet(TOKEN, seq, &params, &TimestampFields::default(), None);
+            reply.truncate(echo_packet_len(false, &params) - 1);
+            socket.send_to(&reply, peer).unwrap();
+        }
+    });
+    let config = ClientConfig {
+        length: 64,
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+
+    let events = client.recv_once().unwrap();
+
+    assert!(matches!(
+        events.as_slice(),
+        [ClientEvent::Warning {
+            kind: WarningKind::MalformedOrUnrelatedPacket,
+            ..
+        }]
+    ));
+    client.close().unwrap();
+    server.join();
+}
+
+#[test]
+fn overlong_datagram_detection_uses_extra_receive_byte() {
+    let params = Params {
+        length: 4096,
+        ..default_params()
+    };
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+            socket.send_to(&reply, peer).unwrap();
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            let mut reply =
+                echo_reply_packet(TOKEN, seq, &params, &TimestampFields::default(), None);
+            reply.push(0);
+            socket.send_to(&reply, peer).unwrap();
+            let _ = recv_request_timeout(&socket, &tx);
+        }
+    });
+    let config = ClientConfig {
+        length: 4096,
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+
+    let events = client.recv_once().unwrap();
+    assert!(matches!(
+        events.as_slice(),
+        [ClientEvent::Warning {
+            kind: WarningKind::MalformedOrUnrelatedPacket,
+            ..
+        }]
+    ));
+    client.close().unwrap();
+    server.join();
+}
+
+#[test]
+fn exact_length_echo_reply_still_emits_echo_reply() {
+    let params = Params {
+        length: 4096,
+        ..default_params()
+    };
+    let server = start_fake_server({
+        let params = params.clone();
+        move |socket, tx| {
+            let (_, peer) = recv_request(&socket, &tx);
+            let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+            socket.send_to(&reply, peer).unwrap();
+            let (request, _) = recv_request(&socket, &tx);
+            let seq = u32::from_le_bytes(request[12..16].try_into().unwrap());
+            let reply = echo_reply_packet(TOKEN, seq, &params, &TimestampFields::default(), None);
+            socket.send_to(&reply, peer).unwrap();
+            let _ = recv_request_timeout(&socket, &tx);
+        }
+    });
+    let config = ClientConfig {
+        length: 4096,
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+
+    let events = client.recv_once().unwrap();
+    assert!(matches!(
+        events.as_slice(),
+        [ClientEvent::EchoReply { bytes, .. }] if *bytes == echo_packet_len(false, &params)
+    ));
+    client.close().unwrap();
+    server.join();
+}

crates/irtt-client/tests/client/probes_replies/reply_classification.rs

@@ -0,0 +1,113 @@
+use super::*;
+
+#[test]
+fn duplicate_reply_emits_duplicate_event() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+
+        socket
+            .set_read_timeout(Some(Duration::from_secs(2)))
+            .unwrap();
+        let mut buf = [0_u8; 2048];
+        if let Ok((size, _)) = socket.recv_from(&mut buf) {
+            tx.send(buf[..size].to_vec()).unwrap();
+            let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
+            let ts = TimestampFields::default();
+            let reply_packet = echo_reply_packet(TOKEN, seq, &params, &ts, None);
+            socket.send_to(&reply_packet, peer).unwrap();
+            thread::sleep(Duration::from_millis(10));
+            socket.send_to(&reply_packet, peer).unwrap();
+        }
+    });
+    let config = ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+    thread::sleep(Duration::from_millis(50));
+
+    let events1 = client.recv_once().unwrap();
+    assert_eq!(events1.len(), 1);
+    assert!(matches!(&events1[0], ClientEvent::EchoReply { .. }));
+
+    thread::sleep(Duration::from_millis(30));
+    let events2 = client.recv_once().unwrap();
+    assert_eq!(events2.len(), 1);
+    assert!(matches!(
+        &events2[0],
+        ClientEvent::DuplicateReply { seq: 0, .. }
+    ));
+    server.join();
+}
+
+#[test]
+fn out_of_order_reply_emits_late_event() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+
+        socket
+            .set_read_timeout(Some(Duration::from_secs(2)))
+            .unwrap();
+
+        let mut seqs = Vec::new();
+        for _ in 0..2 {
+            let mut buf = [0_u8; 2048];
+            if let Ok((size, _)) = socket.recv_from(&mut buf) {
+                tx.send(buf[..size].to_vec()).unwrap();
+                let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
+                seqs.push(seq);
+            }
+        }
+        let ts = TimestampFields::default();
+        let reply1 = echo_reply_packet(TOKEN, seqs[1], &params, &ts, None);
+        socket.send_to(&reply1, peer).unwrap();
+        thread::sleep(Duration::from_millis(10));
+        let reply0 = echo_reply_packet(TOKEN, seqs[0], &params, &ts, None);
+        socket.send_to(&reply0, peer).unwrap();
+    });
+    let config = ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    client.send_probe().unwrap();
+    client.send_probe().unwrap();
+    thread::sleep(Duration::from_millis(50));
+
+    let ev1 = client.recv_once().unwrap();
+    assert_eq!(ev1.len(), 1);
+    assert!(matches!(&ev1[0], ClientEvent::EchoReply { seq: 1, .. }));
+
+    thread::sleep(Duration::from_millis(30));
+    let ev2 = client.recv_once().unwrap();
+    assert_eq!(ev2.len(), 1);
+    match &ev2[0] {
+        ClientEvent::LateReply {
+            seq,
+            highest_seen,
+            rtt,
+            ..
+        } => {
+            assert_eq!(*seq, 0);
+            assert_eq!(*highest_seen, 1);
+            assert!(rtt.is_some());
+        }
+        other => panic!("expected LateReply, got {other:?}"),
+    }
+    server.join();
+}

crates/irtt-client/tests/client/probes_replies/reply_decode.rs

@@ -0,0 +1,80 @@
+use super::*;
+
+#[test]
+fn recv_once_returns_empty_on_timeout() {
+    let params = default_params();
+    let server = open_success_server(params);
+    let config = ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(50)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    let events = client.recv_once().unwrap();
+    assert!(events.is_empty());
+    server.join();
+}
+
+#[test]
+fn recv_once_decodes_only_received_bytes_after_longer_datagram() {
+    let params = default_params();
+    let server_params = params.clone();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &server_params, None);
+        socket.send_to(&reply, peer).unwrap();
+
+        let mut seqs = Vec::new();
+        for _ in 0..2 {
+            let (packet, _) = recv_request(&socket, &tx);
+            seqs.push(u32::from_le_bytes(packet[12..16].try_into().unwrap()));
+        }
+
+        let mut longer = echo_reply_packet(
+            TOKEN,
+            seqs[0],
+            &server_params,
+            &TimestampFields::default(),
+            None,
+        );
+        longer.extend_from_slice(b"trailing bytes");
+        socket.send_to(&longer, peer).unwrap();
+
+        let shorter = echo_reply_packet(
+            TOKEN,
+            seqs[1],
+            &server_params,
+            &TimestampFields::default(),
+            None,
+        );
+        socket.send_to(&shorter, peer).unwrap();
+    });
+    let config = ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+
+    client.send_probe().unwrap();
+    client.send_probe().unwrap();
+    thread::sleep(Duration::from_millis(50));
+
+    let _ = client.recv_once().unwrap();
+    let events = client.recv_once().unwrap();
+    assert_eq!(events.len(), 1);
+    match &events[0] {
+        ClientEvent::EchoReply { seq, bytes, .. } => {
+            assert_eq!(*seq, 1);
+            assert_eq!(*bytes, echo_packet_len(false, &params));
+        }
+        other => panic!("expected EchoReply after shorter datagram, got {other:?}"),
+    }
+    server.join();
+}

crates/irtt-client/tests/client/probes_replies/reply_metadata.rs

@@ -0,0 +1,86 @@
+#[cfg(all(target_os = "linux", feature = "ancillary"))]
+use super::*;
+
+#[test]
+#[cfg(all(target_os = "linux", feature = "ancillary"))]
+fn echo_reply_metadata_propagates_observed_dscp_with_ancillary() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+
+        let mut buf = [0_u8; 2048];
+        let (size, _) = socket.recv_from(&mut buf).unwrap();
+        tx.send(buf[..size].to_vec()).unwrap();
+        let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
+        socket2::SockRef::from(&socket).set_tos_v4(184).unwrap();
+        let reply_packet =
+            echo_reply_packet(TOKEN, seq, &params, &TimestampFields::default(), None);
+        socket.send_to(&reply_packet, peer).unwrap();
+    });
+    let config = ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+
+    client.send_probe().unwrap();
+    thread::sleep(Duration::from_millis(50));
+
+    let events = client.recv_once().unwrap();
+    assert_eq!(events.len(), 1);
+    match &events[0] {
+        ClientEvent::EchoReply { packet_meta, .. } => {
+            let Some(traffic_class) = packet_meta.traffic_class else {
+                metadata_unavailable_skip(
+                    "echo_reply_metadata_propagates_observed_dscp_with_ancillary",
+                );
+                client.close().unwrap();
+                server.join();
+                return;
+            };
+            assert_eq!(traffic_class, 184);
+            assert_eq!(packet_meta.dscp, Some(46));
+            assert_eq!(packet_meta.ecn, Some(0));
+        }
+        other => panic!("expected EchoReply, got {other:?}"),
+    }
+
+    client.close().unwrap();
+    server.join();
+}
+
+#[test]
+#[cfg(all(target_os = "linux", feature = "ancillary"))]
+fn echo_reply_metadata_propagates_kernel_rx_timestamp_with_ancillary() {
+    let params = default_params();
+    let (mut client, server) = open_client_with_echo_server(&params);
+
+    client.send_probe().unwrap();
+    thread::sleep(Duration::from_millis(50));
+
+    let events = client.recv_once().unwrap();
+    assert_eq!(events.len(), 1);
+    match &events[0] {
+        ClientEvent::EchoReply { packet_meta, .. } => {
+            let Some(timestamp) = packet_meta.kernel_rx_timestamp else {
+                kernel_rx_timestamp_unavailable_skip(
+                    "echo_reply_metadata_propagates_kernel_rx_timestamp_with_ancillary",
+                );
+                client.close().unwrap();
+                server.join();
+                return;
+            };
+            assert!(timestamp.duration_since(SystemTime::UNIX_EPOCH).is_ok());
+        }
+        other => panic!("expected EchoReply, got {other:?}"),
+    }
+
+    client.close().unwrap();
+    server.join();
+}

crates/irtt-client/tests/client/probes_replies/timeouts.rs

@@ -0,0 +1,201 @@
+use super::*;
+
+#[test]
+fn probe_timeout_overflow_transmits_no_echo() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        socket
+            .set_read_timeout(Some(Duration::from_secs(2)))
+            .unwrap();
+        let (_, peer) = recv_request(&socket, &tx);
+        socket
+            .send_to(
+                &open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None),
+                peer,
+            )
+            .unwrap();
+        // CLOSE is a completion barrier: any incorrectly transmitted ECHO
+        // precedes it on this connected loopback socket.
+        let _ = recv_request(&socket, &tx);
+    });
+    let config = ClientConfig {
+        probe_timeout: Duration::MAX,
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    assert!(matches!(
+        client.send_probe(),
+        Err(ClientError::DurationOverflow)
+    ));
+    assert!(!client.has_pending_probes());
+    client.close().unwrap();
+    let packets: Vec<_> = server.rx.iter().collect();
+    assert_eq!(packets.len(), 2);
+    assert_eq!(
+        packets[1][3],
+        flags::FLAG_CLOSE,
+        "overflow must not transmit an ECHO"
+    );
+    server.join();
+}
+
+#[test]
+fn poll_timeouts_emits_echo_loss() {
+    let params = default_params();
+    let server = silent_open_server(params);
+    let config = ClientConfig {
+        probe_timeout: Duration::from_millis(100),
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(50)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+
+    client.send_probe().unwrap();
+    client.send_probe().unwrap();
+
+    let no_loss = client.poll_timeouts().unwrap();
+    assert!(no_loss.is_empty());
+
+    thread::sleep(Duration::from_millis(150));
+    let events = client.poll_timeouts().unwrap();
+    assert_eq!(events.len(), 2);
+    for event in &events {
+        assert!(matches!(event, ClientEvent::EchoLoss { .. }));
+    }
+    server.join();
+}
+
+#[test]
+fn late_reply_after_timeout_preserves_measurement_metadata() {
+    let params = default_params();
+    let server = start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+
+        let mut buf = [0_u8; 2048];
+        let (size, _) = socket.recv_from(&mut buf).unwrap();
+        tx.send(buf[..size].to_vec()).unwrap();
+        let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
+
+        thread::sleep(Duration::from_millis(90));
+        let ts = TimestampFields {
+            recv_wall: Some(1_000_000_000),
+            recv_mono: Some(100_000),
+            send_wall: Some(1_000_100_000),
+            send_mono: Some(200_000),
+            ..Default::default()
+        };
+        let reply_packet = echo_reply_packet(TOKEN, seq, &params, &ts, None);
+        socket.send_to(&reply_packet, peer).unwrap();
+        socket.send_to(&reply_packet, peer).unwrap();
+    });
+    let config = ClientConfig {
+        probe_timeout: Duration::from_millis(40),
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+
+    client.send_probe().unwrap();
+    thread::sleep(Duration::from_millis(60));
+    let losses = client.poll_timeouts().unwrap();
+    assert!(matches!(&losses[0], ClientEvent::EchoLoss { seq: 0, .. }));
+
+    let late = client.recv_once().unwrap();
+    match &late[0] {
+        ClientEvent::LateReply {
+            seq,
+            sent_at,
+            rtt,
+            server_timing,
+            one_way,
+            bytes,
+            packet_meta,
+            ..
+        } => {
+            assert_eq!(*seq, 0);
+            assert!(sent_at.is_some());
+            assert!(rtt.is_some());
+            assert!(server_timing.is_some());
+            assert!(one_way.is_some());
+            assert_eq!(*bytes, echo_packet_len(false, &default_params()));
+            let _ = packet_meta;
+            #[cfg(not(all(target_os = "linux", feature = "ancillary")))]
+            assert_packet_meta_unavailable(packet_meta);
+        }
+        other => panic!("expected stats-eligible LateReply, got {other:?}"),
+    }
+    let duplicate = client.recv_once().unwrap();
+    assert!(matches!(
+        &duplicate[0],
+        ClientEvent::DuplicateReply {
+            seq: 0,
+            bytes,
+            ..
+        } if *bytes == echo_packet_len(false, &default_params())
+    ));
+
+    client.close().unwrap();
+    server.join();
+}
+
+#[test]
+fn pending_full_does_not_send_packet() {
+    let params = Params {
+        duration_ns: 60_000_000_000,
+        ..default_params()
+    };
+    let server = silent_open_server(params);
+    let config = ClientConfig {
+        duration: Some(Duration::from_secs(60)),
+        max_pending_probes: 2,
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(50)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+
+    client.send_probe().unwrap();
+    client.send_probe().unwrap();
+
+    thread::sleep(Duration::from_millis(30));
+    let before_count: Vec<_> = server.rx.try_iter().collect();
+    let echo_before: Vec<_> = before_count
+        .iter()
+        .filter(|p| p.len() >= 4 && p[3] & FLAG_OPEN == 0 && p[3] & flags::FLAG_CLOSE == 0)
+        .collect();
+    assert_eq!(echo_before.len(), 2);
+
+    assert!(matches!(
+        client.send_probe(),
+        Err(ClientError::PendingLimitExceeded { limit: 2 })
+    ));
+
+    thread::sleep(Duration::from_millis(30));
+    let after: Vec<_> = server.rx.try_iter().collect();
+    let echo_after: Vec<_> = after
+        .iter()
+        .filter(|p| p.len() >= 4 && p[3] & FLAG_OPEN == 0 && p[3] & flags::FLAG_CLOSE == 0)
+        .collect();
+    assert_eq!(
+        echo_after.len(),
+        0,
+        "no packet should be sent when pending is full"
+    );
+
+    client.close().unwrap();
+    server.join();
+}

crates/irtt-client/tests/client/support.rs

@@ -0,0 +1,277 @@
+use super::*;
+use irtt_proto::{
+    echo_packet_len as checked_echo_packet_len, encode_echo_reply, encode_open_reply,
+    flags::FLAG_OPEN, flags::FLAG_REPLY, layout::PacketLayout, Clock, EchoReply, OpenReply,
+    ReceivedStats, StampAt,
+};
+use std::{
+    net::UdpSocket,
+    sync::mpsc,
+    thread::{self, JoinHandle},
+};
+
+pub(super) const TOKEN: u64 = 0x1234_5678_90ab_cdef;
+pub(super) const HMAC_OFFSET: usize = 4;
+
+pub(super) struct FakeServer {
+    pub(super) addr: SocketAddr,
+    pub(super) rx: mpsc::Receiver<Vec<u8>>,
+    done: JoinHandle<()>,
+}
+
+impl FakeServer {
+    pub(super) fn join(self) {
+        self.done.join().unwrap();
+    }
+}
+
+pub(super) fn default_test_config(addr: SocketAddr) -> ClientConfig {
+    ClientConfig {
+        server_addr: addr.to_string(),
+        open_timeouts: vec![Duration::from_millis(200), Duration::from_millis(200)],
+        ..ClientConfig::default()
+    }
+}
+
+pub(super) fn start_fake_server<F>(handler: F) -> FakeServer
+where
+    F: FnOnce(UdpSocket, mpsc::Sender<Vec<u8>>) + Send + 'static,
+{
+    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+    let addr = socket.local_addr().unwrap();
+    let (tx, rx) = mpsc::channel();
+    let done = thread::spawn(move || handler(socket, tx));
+    FakeServer { addr, rx, done }
+}
+
+pub(super) fn recv_request(
+    socket: &UdpSocket,
+    tx: &mpsc::Sender<Vec<u8>>,
+) -> (Vec<u8>, SocketAddr) {
+    let mut buf = [0_u8; 512];
+    let (size, peer) = socket.recv_from(&mut buf).unwrap();
+    let packet = buf[..size].to_vec();
+    tx.send(packet.clone()).unwrap();
+    (packet, peer)
+}
+
+pub(super) fn open_reply(
+    flags: u8,
+    token: u64,
+    params: &Params,
+    hmac_key: Option<&[u8]>,
+) -> Vec<u8> {
+    encode_open_reply(
+        &OpenReply {
+            flags,
+            token,
+            params: params.clone(),
+        },
+        hmac_key,
+    )
+    .unwrap()
+}
+
+/// Test params always name a representable length, so the platform
+/// representability check cannot fire here.
+pub(crate) fn echo_packet_len(hmac: bool, params: &Params) -> usize {
+    checked_echo_packet_len(hmac, params).expect("test params must have a representable length")
+}
+
+pub(super) fn echo_reply_packet(
+    token: u64,
+    seq: u32,
+    params: &Params,
+    timestamps: &TimestampFields,
+    hmac_key: Option<&[u8]>,
+) -> Vec<u8> {
+    echo_reply_packet_with_flags(token, seq, params, timestamps, hmac_key, FLAG_REPLY)
+}
+
+pub(super) fn echo_reply_packet_with_flags(
+    token: u64,
+    seq: u32,
+    params: &Params,
+    timestamps: &TimestampFields,
+    hmac_key: Option<&[u8]>,
+    flags: u8,
+) -> Vec<u8> {
+    let layout = PacketLayout::echo(hmac_key.is_some(), params);
+    let reply = EchoReply {
+        flags,
+        token,
+        sequence: seq,
+        recv_count: layout.recv_count.then_some(42),
+        recv_window: layout.recv_window.then_some(0x07),
+        timestamps: TimestampFields {
+            recv_wall: layout.recv_wall.then(|| timestamps.recv_wall.unwrap_or(0)),
+            recv_mono: layout.recv_mono.then(|| timestamps.recv_mono.unwrap_or(0)),
+            midpoint_wall: layout
+                .midpoint_wall
+                .then(|| timestamps.midpoint_wall.unwrap_or(0)),
+            midpoint_mono: layout
+                .midpoint_mono
+                .then(|| timestamps.midpoint_mono.unwrap_or(0)),
+            send_wall: layout.send_wall.then(|| timestamps.send_wall.unwrap_or(0)),
+            send_mono: layout.send_mono.then(|| timestamps.send_mono.unwrap_or(0)),
+        },
+        payload: Vec::new(),
+    };
+    encode_echo_reply(&reply, params, hmac_key).unwrap()
+}
+
+pub(super) fn open_success_server(params: Params) -> FakeServer {
+    start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+    })
+}
+
+pub(super) fn no_test_server(params: Params, token: u64) -> FakeServer {
+    start_fake_server(move |socket, tx| {
+        let (request, peer) = recv_request(&socket, &tx);
+        assert_eq!(request[3] & flags::FLAG_CLOSE, flags::FLAG_CLOSE);
+        let reply = open_reply(
+            FLAG_OPEN | FLAG_REPLY | flags::FLAG_CLOSE,
+            token,
+            &params,
+            None,
+        );
+        socket.send_to(&reply, peer).unwrap();
+    })
+}
+
+pub(super) fn timeout_server(wait: Duration) -> FakeServer {
+    start_fake_server(move |socket, tx| {
+        socket.set_read_timeout(Some(wait)).unwrap();
+        while recv_request_timeout(&socket, &tx).is_some() {}
+    })
+}
+
+pub(super) fn recv_request_timeout(
+    socket: &UdpSocket,
+    tx: &mpsc::Sender<Vec<u8>>,
+) -> Option<(Vec<u8>, SocketAddr)> {
+    let mut buf = [0_u8; 512];
+    match socket.recv_from(&mut buf) {
+        Ok((size, peer)) => {
+            let packet = buf[..size].to_vec();
+            tx.send(packet.clone()).unwrap();
+            Some((packet, peer))
+        }
+        Err(_) => None,
+    }
+}
+
+pub(super) fn silent_open_server(params: Params) -> FakeServer {
+    start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+        socket
+            .set_read_timeout(Some(Duration::from_secs(5)))
+            .unwrap();
+        loop {
+            let mut buf = [0_u8; 2048];
+            match socket.recv_from(&mut buf) {
+                Ok((size, _)) => {
+                    tx.send(buf[..size].to_vec()).unwrap();
+                }
+                Err(_) => break,
+            }
+        }
+    })
+}
+
+pub(super) fn echo_server(params: Params) -> FakeServer {
+    start_fake_server(move |socket, tx| {
+        let (_, peer) = recv_request(&socket, &tx);
+        let reply = open_reply(FLAG_OPEN | FLAG_REPLY, TOKEN, &params, None);
+        socket.send_to(&reply, peer).unwrap();
+
+        socket
+            .set_read_timeout(Some(Duration::from_secs(5)))
+            .unwrap();
+        loop {
+            let mut buf = [0_u8; 2048];
+            let size = match socket.recv_from(&mut buf) {
+                Ok((size, _)) => size,
+                Err(_) => break,
+            };
+            let packet = buf[..size].to_vec();
+            tx.send(packet.clone()).unwrap();
+
+            if buf[3] & flags::FLAG_CLOSE != 0 {
+                break;
+            }
+
+            let seq = u32::from_le_bytes(buf[12..16].try_into().unwrap());
+            let ts = TimestampFields {
+                recv_wall: Some(1_000_000_000),
+                recv_mono: Some(100_000),
+                send_wall: Some(1_000_100_000),
+                send_mono: Some(200_000),
+                ..Default::default()
+            };
+            let reply_packet = echo_reply_packet(TOKEN, seq, &params, &ts, None);
+            socket.send_to(&reply_packet, peer).unwrap();
+        }
+    })
+}
+
+pub(super) fn assert_open_started(outcome: OpenOutcome) -> NegotiatedParams {
+    match outcome {
+        OpenOutcome::Started {
+            token, negotiated, ..
+        } => {
+            assert_eq!(token, TOKEN);
+            negotiated
+        }
+        OpenOutcome::NoTestCompleted { .. } => panic!("unexpected no-test outcome"),
+    }
+}
+
+pub(super) fn assert_no_test_completed(outcome: OpenOutcome) -> NegotiatedParams {
+    match outcome {
+        OpenOutcome::NoTestCompleted {
+            negotiated, event, ..
+        } => {
+            assert!(matches!(
+                event,
+                ClientEvent::NoTestCompleted {
+                    negotiated: ref event_params,
+                    ..
+                } if *event_params == negotiated
+            ));
+            negotiated
+        }
+        OpenOutcome::Started { .. } => panic!("unexpected started outcome"),
+    }
+}
+
+pub(super) fn open_client_with_echo_server(params: &Params) -> (Client, FakeServer) {
+    let server = echo_server(params.clone());
+    let config = ClientConfig {
+        socket_config: irtt_client::SocketConfig {
+            recv_timeout: Some(Duration::from_millis(200)),
+            ..Default::default()
+        },
+        ..default_test_config(server.addr)
+    };
+    let mut client = Client::connect(config).unwrap();
+    assert_open_started(client.open().unwrap());
+    (client, server)
+}
+
+pub(super) fn default_params() -> Params {
+    Params {
+        protocol_version: 1,
+        duration_ns: 3_000_000_000,
+        interval_ns: 1_000_000_000,
+        received_stats: ReceivedStats::Both,
+        stamp_at: StampAt::Both,
+        clock: Clock::Both,
+        ..Params::default()
+    }
+}

crates/irtt-client/tests/client/ttl.rs

@@ -0,0 +1,22 @@
+use super::*;
+
+#[test]
+fn connect_accepts_valid_ttl_config_values() {
+    for ttl in [None, Some(1), Some(255)] {
+        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
+        config.socket_config.ttl = ttl;
+        Client::connect(config).unwrap();
+    }
+}
+
+#[test]
+fn connect_rejects_invalid_ttl_values() {
+    for ttl in [0, 256] {
+        let mut config = default_test_config(SocketAddr::from(([127, 0, 0, 1], 9)));
+        config.socket_config.ttl = Some(ttl);
+        assert!(matches!(
+            Client::connect(config),
+            Err(ClientError::InvalidConfig { .. })
+        ));
+    }
+}

crates/irtt-client/tests/linux_transport.rs

@@ -0,0 +1,259 @@
+//! Real Linux socket observations through the public client adapters.
+#![cfg(all(target_os = "linux", feature = "ancillary"))]
+
+use std::{
+    io::IoSliceMut,
+    net::{SocketAddr, UdpSocket},
+    sync::mpsc,
+    thread,
+    time::{Duration, SystemTime, UNIX_EPOCH},
+};
+
+use irtt_client::{Client, ClientConfig, ClientEvent, NegotiationPolicy, SocketConfig};
+use irtt_proto::{decode_request, Clock, DecodedRequestKind, ReceivedStats, StampAt};
+use irtt_server::{ServerConfig, ServerCore};
+use nix::sys::socket::{recvmsg, ControlMessageOwned, MsgFlags};
+
+const TEST_TTL: u32 = 37;
+
+// A compliant packet peer uses the real server core. Its receive-side IP_TOS
+// observation is independent of the client/server parameter agreement.
+fn peer(dscp_allowed: bool, probes: usize) -> (SocketAddr, thread::JoinHandle<Vec<u8>>) {
+    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+    socket
+        .set_read_timeout(Some(Duration::from_secs(3)))
+        .unwrap();
+    socket2::SockRef::from(&socket)
+        .set_recv_tos_v4(true)
+        .unwrap();
+    nix::sys::socket::setsockopt(&socket, nix::sys::socket::sockopt::Ipv4RecvTtl, &true).unwrap();
+    let addr = socket.local_addr().unwrap();
+    let task = thread::spawn(move || {
+        let mut core = ServerCore::new(
+            ServerConfig::default()
+                .with_min_send_interval(Duration::ZERO)
+                .with_dscp_allowed(dscp_allowed),
+        );
+        let mut markings = Vec::new();
+        // OPEN, every ECHO, then CLOSE.
+        for _ in 0..probes + 2 {
+            let mut bytes = [0; 2048];
+            let mut control = nix::cmsg_space!(u8, i32);
+            let mut iov = [IoSliceMut::new(&mut bytes)];
+            let msg = recvmsg::<nix::sys::socket::SockaddrIn>(
+                std::os::fd::AsRawFd::as_raw_fd(&socket),
+                &mut iov,
+                Some(&mut control),
+                MsgFlags::empty(),
+            )
+            .unwrap();
+            let size = msg.bytes;
+            let source = msg.address.unwrap();
+            let marking = msg
+                .cmsgs()
+                .unwrap()
+                .find_map(|message| match message {
+                    ControlMessageOwned::Ipv4Tos(tos) => Some(tos),
+                    _ => None,
+                })
+                .expect("Linux must report IP_TOS");
+            let ttl = msg
+                .cmsgs()
+                .unwrap()
+                .find_map(|message| match message {
+                    ControlMessageOwned::Ipv4Ttl(ttl) => Some(ttl),
+                    _ => None,
+                })
+                .expect("Linux must report IP_TTL");
+            assert_eq!(
+                ttl, TEST_TTL as i32,
+                "configured TTL must survive OPEN, ECHO and CLOSE"
+            );
+            markings.push(marking);
+            let source = SocketAddr::from((source.ip(), source.port()));
+            if let Some(reply) = core.handle_datagram(source, &bytes[..size]).unwrap() {
+                socket.send_to(reply.bytes(), source).unwrap();
+            }
+        }
+        assert_eq!(core.session_count(), 0);
+        markings
+    });
+    (addr, task)
+}
+
+fn config(addr: SocketAddr) -> ClientConfig {
+    ClientConfig {
+        server_addr: addr.to_string(),
+        dscp: 46,
+        negotiation_policy: NegotiationPolicy::Loose,
+        duration: None,
+        interval: Duration::from_millis(10),
+        clock: Clock::Both,
+        stamp_at: StampAt::Both,
+        received_stats: ReceivedStats::Both,
+        length: 128,
+        open_timeouts: vec![Duration::from_secs(1)],
+        socket_config: SocketConfig {
+            ttl: Some(TEST_TTL),
+            recv_timeout: Some(Duration::from_secs(1)),
+            ..SocketConfig::default()
+        },
+        ..ClientConfig::default()
+    }
+}
+
+// TX timestamps have no separate public field: the upstream OWD exposes the
+// selected send endpoint. Reconstruct it and require a real kernel endpoint
+// rather than accepting the userspace fallback. RTT must still use sent_at.
+fn assert_kernel_send_endpoint(event: &ClientEvent, before_send: SystemTime) {
+    let ClientEvent::EchoReply {
+        sent_at,
+        received_at,
+        rtt,
+        server_timing: Some(timing),
+        one_way: Some(one_way),
+        packet_meta,
+        ..
+    } = event
+    else {
+        panic!("expected measured reply: {event:?}")
+    };
+    let ns = |wall: SystemTime| {
+        i128::try_from(wall.duration_since(UNIX_EPOCH).unwrap().as_nanos()).unwrap()
+    };
+    let selected =
+        i128::from(timing.receive_wall_ns.unwrap()) - one_way.client_to_server.unwrap().as_nanos();
+    assert!(selected >= ns(before_send));
+    // TX_SOFTWARE may arrive before or after send returns; only equality
+    // identifies the userspace fallback. Receipt remains the upper bound.
+    assert_ne!(
+        selected,
+        ns(sent_at.wall),
+        "TX timestamp was not observed; userspace fallback is insufficient"
+    );
+    assert!(selected <= ns(received_at.wall));
+    let selected_receive =
+        i128::from(timing.send_wall_ns.unwrap()) + one_way.server_to_client.unwrap().as_nanos();
+    assert_eq!(
+        selected_receive,
+        ns(packet_meta
+            .kernel_rx_timestamp
+            .expect("Linux RX timestamp required")),
+        "downstream OWD must use the kernel receive endpoint"
+    );
+    assert_eq!(rtt.raw, received_at.mono.duration_since(sent_at.mono));
+}
+
+#[test]
+fn blocking_probes_use_kernel_tx_timing_and_negotiated_packet_marking() {
+    for allowed in [true, false] {
+        const PROBES: usize = 3;
+        let (addr, peer) = peer(allowed, PROBES);
+        let mut client = Client::connect(config(addr)).unwrap();
+        client.open().unwrap();
+        assert_eq!(
+            client.negotiated_params().unwrap().params.dscp,
+            if allowed { 184 } else { 0 }
+        );
+        for _ in 0..PROBES {
+            let before = SystemTime::now();
+            client.send_probe().unwrap();
+            let events = client.recv_once().unwrap();
+            assert_eq!(events.len(), 1);
+            assert_kernel_send_endpoint(&events[0], before);
+        }
+        client.close().unwrap();
+        let markings = peer.join().unwrap();
+        assert_eq!(markings[0], 0, "OPEN is unmarked");
+        assert_eq!(
+            &markings[1..=PROBES],
+            vec![if allowed { 184 } else { 0 }; PROBES]
+        );
+        assert_eq!(
+            markings[PROBES + 1],
+            0,
+            "local CLOSE clears the negotiated marking"
+        );
+    }
+}
+
+#[cfg(feature = "tokio")]
+#[test]
+fn async_probes_use_kernel_tx_timing_and_negotiated_packet_marking() {
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    for allowed in [true, false] {
+        const PROBES: usize = 3;
+        let (addr, peer) = peer(allowed, PROBES);
+        runtime.block_on(async {
+            tokio::time::timeout(Duration::from_secs(5), async {
+                let mut client = irtt_client::AsyncClient::connect(config(addr))
+                    .await
+                    .unwrap();
+                client.open().await.unwrap();
+                assert_eq!(
+                    client.negotiated_params().unwrap().params.dscp,
+                    if allowed { 184 } else { 0 }
+                );
+                for _ in 0..PROBES {
+                    let before = SystemTime::now();
+                    client.send_probe().await.unwrap();
+                    let events = client.recv().await.unwrap();
+                    assert_eq!(events.len(), 1);
+                    assert_kernel_send_endpoint(&events[0], before);
+                }
+                client.close().await.unwrap();
+            })
+            .await
+            .expect("async transport observations timed out");
+        });
+        let markings = peer.join().unwrap();
+        assert_eq!(markings[0], 0);
+        assert_eq!(
+            &markings[1..=PROBES],
+            vec![if allowed { 184 } else { 0 }; PROBES]
+        );
+        assert_eq!(markings[PROBES + 1], 0);
+    }
+}
+
+// Real ICMP refusal remains a socket error, never optional timestamp metadata.
+// The bound peer closes only after the client has accepted a valid OPEN.
+#[test]
+fn a_closed_udp_peer_surfaces_a_socket_error() {
+    let socket = UdpSocket::bind("127.0.0.1:0").unwrap();
+    let addr = socket.local_addr().unwrap();
+    socket
+        .set_read_timeout(Some(Duration::from_secs(3)))
+        .unwrap();
+    let (close_tx, close_rx) = mpsc::channel();
+    let task = thread::spawn(move || {
+        let mut core = ServerCore::new(ServerConfig::default());
+        let mut bytes = [0; 2048];
+        let (size, source) = socket.recv_from(&mut bytes).unwrap();
+        assert!(matches!(
+            decode_request(&bytes[..size]).unwrap().kind,
+            DecodedRequestKind::Open { .. }
+        ));
+        let reply = core
+            .handle_datagram(source, &bytes[..size])
+            .unwrap()
+            .unwrap();
+        socket.send_to(reply.bytes(), source).unwrap();
+        close_rx.recv_timeout(Duration::from_secs(3)).unwrap();
+        drop(socket);
+    });
+    let mut client = Client::connect(config(addr)).unwrap();
+    client.open().unwrap();
+    close_tx.send(()).unwrap();
+    task.join().unwrap();
+    // Refusal can arrive during send's TX drain or the following receive.
+    let result = client.send_probe().and_then(|_| client.recv_once());
+    assert!(
+        matches!(result, Err(irtt_client::ClientError::Socket(ref error))
+        if error.kind() == std::io::ErrorKind::ConnectionRefused),
+        "{result:?}"
+    );
+}

crates/irtt-client/tests/managed_control.rs

@@ -0,0 +1,160 @@
+#![cfg(feature = "tokio")]
+
+use std::{
+    future::Future,
+    pin::pin,
+    task::{Context, Poll, Waker},
+    time::Duration,
+};
+
+use irtt_client::managed::*;
+
+fn config() -> ManagedClientConfig {
+    ManagedClientConfig {
+        completion: ManagedCompletionPolicy::ExplicitStop,
+        command_capacity: 3,
+        ..ManagedClientConfig::default()
+    }
+}
+
+#[test]
+fn stop_resolves_every_accepted_update_and_closes_admission() {
+    let (task, handle) = ManagedClient::task(config(), vec![]).unwrap();
+    let receipts: Vec<_> = (0..3)
+        .map(|index| {
+            handle
+                .update_targets(vec![ManagedTargetConfig::new(
+                    format!("queued-{index}"),
+                    "127.0.0.1:9",
+                )])
+                .unwrap()
+        })
+        .collect();
+    assert!(matches!(
+        handle.update_targets(vec![]),
+        Err(ManagedCommandError::QueueFull)
+    ));
+
+    let stop = handle.stop();
+    assert!(matches!(
+        handle.update_targets(vec![]),
+        Err(ManagedCommandError::Stopping)
+    ));
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    runtime.block_on(async {
+        tokio::time::timeout(Duration::from_secs(2), async {
+            let outcome = task.await;
+            stop.await;
+            for receipt in receipts {
+                assert!(matches!(
+                    receipt.await,
+                    Err(ManagedCommandApplyError::Stopping)
+                ));
+            }
+            assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
+            assert_eq!(outcome.applied_command_sequence, 0);
+            assert_eq!(outcome.total_target_outcomes, 0);
+            let status = handle.status();
+            assert_eq!(status.lifecycle, ManagedLifecycle::Completed);
+            assert!(status.stop_requested);
+            assert_eq!(status.final_outcome.as_deref(), Some(&outcome));
+            assert!(matches!(
+                handle.update_targets(vec![]),
+                Err(ManagedCommandError::DriverClosed)
+            ));
+            handle.stop().await;
+        })
+        .await
+        .expect("stop must resolve every buffered update and repeated stop receipt");
+    });
+}
+
+#[test]
+fn failed_driver_resolves_every_accepted_update_with_its_terminal_failure() {
+    let (task, handle) = ManagedClient::task(config(), vec![]).unwrap();
+    let receipts: Vec<_> = (0..3)
+        .map(|index| {
+            handle
+                .update_targets(vec![ManagedTargetConfig::new(
+                    format!("queued-{index}"),
+                    "127.0.0.1:9",
+                )])
+                .unwrap()
+        })
+        .collect();
+    let mut context = Context::from_waker(Waker::noop());
+    let Poll::Ready(outcome) = pin!(task).as_mut().poll(&mut context) else {
+        panic!("polling without Tokio must fail immediately");
+    };
+    assert_eq!(
+        outcome.end_reason,
+        ManagedEndReason::DriverFailed(ManagedDriverFailure::NoTokioRuntime)
+    );
+    for receipt in receipts {
+        assert!(matches!(
+            pin!(receipt).as_mut().poll(&mut context),
+            Poll::Ready(Err(ManagedCommandApplyError::DriverFailed(
+                ManagedDriverFailure::NoTokioRuntime
+            )))
+        ));
+    }
+    let status = handle.status();
+    assert_eq!(status.lifecycle, ManagedLifecycle::Failed);
+    assert_eq!(status.final_outcome.as_deref(), Some(&outcome));
+    assert!(matches!(
+        handle.update_targets(vec![]),
+        Err(ManagedCommandError::DriverClosed)
+    ));
+    assert!(pin!(handle.stop()).as_mut().poll(&mut context).is_ready());
+}
+
+#[test]
+fn concurrent_submission_and_stop_or_seal_never_lose_an_accepted_receipt() {
+    let (task, handle) = ManagedClient::task(config(), vec![]).unwrap();
+    let barrier = std::sync::Arc::new(std::sync::Barrier::new(2));
+    let submit_barrier = std::sync::Arc::clone(&barrier);
+    let submit_handle = handle.clone();
+    let (sender, receiver) = std::sync::mpsc::channel();
+    let submit = std::thread::spawn(move || {
+        submit_barrier.wait();
+        sender.send(submit_handle.update_targets(vec![])).unwrap();
+    });
+    let runtime = tokio::runtime::Builder::new_current_thread()
+        .enable_all()
+        .build()
+        .unwrap();
+    // Stop is latched before the driver starts, while submission may cross
+    // admission before stop, after stop, or after terminal sealing.
+    barrier.wait();
+    let stop = handle.stop();
+    runtime.block_on(async {
+        tokio::time::timeout(Duration::from_secs(2), async {
+            let outcome = task.await;
+            stop.await;
+            assert_eq!(outcome.end_reason, ManagedEndReason::StopRequested);
+            assert_eq!(outcome.applied_command_sequence, 0);
+            assert_eq!(outcome.total_target_outcomes, 0);
+            let result = receiver
+                .recv_timeout(Duration::from_secs(2))
+                .expect("concurrent submission must return");
+            submit.join().unwrap();
+            match result {
+                Ok(receipt) => assert!(matches!(
+                    receipt.await,
+                    Err(ManagedCommandApplyError::Stopping)
+                )),
+                Err(ManagedCommandError::Stopping | ManagedCommandError::DriverClosed) => {}
+                Err(error) => panic!("unexpected concurrent submission result: {error:?}"),
+            }
+            assert!(matches!(
+                handle.update_targets(vec![]),
+                Err(ManagedCommandError::DriverClosed)
+            ));
+        })
+        .await
+        .expect("every accepted concurrent submission must receive a terminal disposition");
+    });
+}