feat(server): apply reply traffic class

crates/irtt-server/src/core.rs

@@ -718,9 +718,10 @@ fn same_endpoint(session: SocketAddr, peer: SocketAddr) -> bool {
 /// Every other known parameter is already validated or deliberately
 /// unrestricted here. Protocol version is accepted at any value and rewritten
 /// during negotiation. Length and DSCP are accepted as decoded, including zero,
-/// negative and out-of-byte-range values; a later slice may restrict a DSCP it
-/// cannot actually apply to the socket. Unknown tags were ignored by the
-/// decoder and are not reflected in the reply.
+/// negative and out-of-byte-range values; a DSCP the socket could never carry
+/// is negotiated unchanged and transported unmarked instead of being refused
+/// (see [`transport_traffic_class`]). Unknown tags were ignored by the decoder
+/// and are not reflected in the reply.
 fn open_params_are_admissible(decoded: &DecodedParams) -> bool {
     let admissible = |present: bool, value: i64| !present || value > 0;
     admissible(decoded.presence.duration_ns, decoded.params.duration_ns)

crates/irtt-server/src/lib.rs

@@ -43,9 +43,10 @@
 //!
 //! Open handling and negotiation, session creation, normal echo processing,
 //! per-session rate limiting, idle expiry, the maximum-duration
-//! server-initiated close and Tokio UDP orchestration. DSCP application, the
-//! full server fill policy, wildcard-bind destination-address metadata and the
-//! CLI server applet remain separate slices. Echo payloads are zero-filled.
+//! server-initiated close, the negotiated per-session reply traffic class and
+//! Tokio UDP orchestration. The full server fill policy and wildcard-bind
+//! destination-address metadata remain separate slices. Echo payloads are
+//! zero-filled.
 #![forbid(unsafe_code)]
 
 mod clock;
@@ -55,6 +56,7 @@ mod error;
 mod negotiate;
 mod runtime;
 mod session;
+mod socket_options;
 mod token;
 
 #[cfg(test)]

crates/irtt-server/src/runtime.rs

@@ -2,10 +2,11 @@
 
 use std::{future::Future, io, net::SocketAddr, time::Duration};
 
+use socket2::SockRef;
 use thiserror::Error;
 use tokio::{net::UdpSocket, time::MissedTickBehavior};
 
-use crate::{ServerConfig, ServerCore, ServerError};
+use crate::{socket_options::set_reply_traffic_class, ServerConfig, ServerCore, ServerError};
 
 /// Fixed transport receive capacity.
 ///
@@ -21,6 +22,14 @@ const MAINTENANCE_INTERVAL: Duration = Duration::from_secs(1);
 /// process it, and sends the optional reply from the same socket. No
 /// per-datagram tasks or locks are involved.
 ///
+/// **That sequential ownership is what makes the reply traffic class correct.**
+/// The class is a socket-wide setting, and every reply explicitly applies its
+/// own — zero included — immediately before its send, so the reply about to go
+/// out is always the one that set it. Nothing else sends from this socket, not
+/// even while a send is suspended, so no reply can inherit another session's
+/// marking. Adding a concurrent sender would break that and require per-packet
+/// control messages instead.
+///
 /// Bind an explicit local address when reply source-address identity matters.
 /// Wildcard binds rely on the kernel's source-address choice; destination
 /// packet metadata and per-packet source selection are not yet implemented for
@@ -30,6 +39,11 @@ pub struct Server {
     socket: UdpSocket,
     core: ServerCore,
     recv_buffer: Vec<u8>,
+    /// The listener's own address family, which selects the IPv4 TOS or IPv6
+    /// Traffic Class option. `None` only if the bound address could not be
+    /// queried at construction, in which case the send path asks again rather
+    /// than guessing a family.
+    listener_is_ipv4: Option<bool>,
 }
 
 impl Server {
@@ -45,13 +59,30 @@ impl Server {
     /// Wraps an already prepared Tokio UDP socket in a server.
     #[must_use]
     pub fn from_socket(socket: UdpSocket, config: ServerConfig) -> Self {
+        let listener_is_ipv4 = socket.local_addr().ok().map(|addr| addr.is_ipv4());
         Self {
             socket,
             core: ServerCore::new(config),
             recv_buffer: vec![0; RECEIVE_BUFFER_LEN],
+            listener_is_ipv4,
         }
     }
 
+    /// Applies one reply's raw traffic class to the listener socket.
+    ///
+    /// This runs before *every* send, and zero is applied as deliberately as
+    /// any other value: a listener serves many sessions from one socket, so
+    /// skipping the call for an unmarked reply — an open reply, or a session
+    /// that negotiated nothing — would send it under whichever marking the
+    /// previous reply left behind.
+    fn apply_reply_traffic_class(&self, traffic_class: u8) -> io::Result<()> {
+        let is_ipv4 = match self.listener_is_ipv4 {
+            Some(is_ipv4) => is_ipv4,
+            None => self.socket.local_addr()?.is_ipv4(),
+        };
+        set_reply_traffic_class(SockRef::from(&self.socket), is_ipv4, traffic_class)
+    }
+
     /// Returns the local endpoint selected for the listener.
     pub fn local_addr(&self) -> Result<SocketAddr, ServerRuntimeError> {
         self.socket
@@ -64,8 +95,13 @@ impl Server {
     /// Graceful shutdown sends no session-close packets and leaves no hidden
     /// receive task behind, even while a reply send is waiting for socket
     /// writability. Per-packet send failures and short sends drop only that
-    /// reply; receive failures and internal core failures terminate the loop
-    /// with an error.
+    /// reply, and so does a failure to apply that reply's traffic class —
+    /// preparing one packet is not a reason to stop serving every other
+    /// session, and the next reply makes its own independent attempt. Receive
+    /// failures and internal core failures terminate the loop with an error.
+    ///
+    /// A reply whose class could not be applied is never sent anyway: sending it
+    /// would put it on the wire under the previous reply's marking.
     pub async fn run<F>(&mut self, shutdown: F) -> Result<(), ServerRuntimeError>
     where
         F: Future<Output = ()>,
@@ -90,6 +126,9 @@ impl Server {
                     }
 
                     if let Some(reply) = self.core.handle_datagram(peer, &self.recv_buffer[..len])? {
+                        if self.apply_reply_traffic_class(reply.traffic_class()).is_err() {
+                            continue;
+                        }
                         let send = self.socket.send_to(reply.bytes(), peer);
                         tokio::pin!(send);
                         let sent = loop {

crates/irtt-server/src/socket_options.rs

@@ -0,0 +1,120 @@
+//! Applying a reply's traffic class to the listener socket.
+//!
+//! The value is the raw IPv4 TOS / IPv6 Traffic Class byte an
+//! [`OutboundDatagram`](crate::OutboundDatagram) asks for, and which option
+//! carries it is decided by the listener's own address family — one `Server`
+//! owns one bound socket, so the peer a reply happens to be going to never
+//! selects the option.
+//!
+//! Everything here is `socket2`'s safe API; the crate forbids unsafe code and
+//! there is no raw `setsockopt` or per-packet control message anywhere in the
+//! server.
+
+use std::io;
+
+use socket2::SockRef;
+
+/// Applies `traffic_class` to a socket bound in the given family.
+///
+/// `is_ipv4` is the *listener's* family, not the peer's.
+pub(crate) fn set_reply_traffic_class(
+    socket: SockRef<'_>,
+    is_ipv4: bool,
+    traffic_class: u8,
+) -> io::Result<()> {
+    let traffic_class = u32::from(traffic_class);
+    if is_ipv4 {
+        set_ipv4_traffic_class(socket, traffic_class)
+    } else {
+        set_ipv6_traffic_class(socket, traffic_class)
+    }
+}
+
+#[cfg(not(any(
+    target_os = "fuchsia",
+    target_os = "redox",
+    target_os = "solaris",
+    target_os = "illumos",
+    target_os = "haiku",
+)))]
+fn set_ipv4_traffic_class(socket: SockRef<'_>, traffic_class: u32) -> io::Result<()> {
+    socket.set_tos_v4(traffic_class)
+}
+
+#[cfg(any(
+    target_os = "fuchsia",
+    target_os = "redox",
+    target_os = "solaris",
+    target_os = "illumos",
+    target_os = "haiku",
+))]
+fn set_ipv4_traffic_class(_socket: SockRef<'_>, traffic_class: u32) -> io::Result<()> {
+    unsupported_traffic_class(traffic_class, "IPv4 TOS socket options")
+}
+
+#[cfg(any(
+    target_os = "android",
+    target_os = "dragonfly",
+    target_os = "freebsd",
+    target_os = "fuchsia",
+    target_os = "linux",
+    target_os = "macos",
+    target_os = "netbsd",
+    target_os = "openbsd",
+    target_os = "cygwin",
+))]
+fn set_ipv6_traffic_class(socket: SockRef<'_>, traffic_class: u32) -> io::Result<()> {
+    socket.set_tclass_v6(traffic_class)
+}
+
+#[cfg(not(any(
+    target_os = "android",
+    target_os = "dragonfly",
+    target_os = "freebsd",
+    target_os = "fuchsia",
+    target_os = "linux",
+    target_os = "macos",
+    target_os = "netbsd",
+    target_os = "openbsd",
+    target_os = "cygwin",
+)))]
+fn set_ipv6_traffic_class(_socket: SockRef<'_>, traffic_class: u32) -> io::Result<()> {
+    unsupported_traffic_class(traffic_class, "IPv6 Traffic Class socket options")
+}
+
+/// A target where the safe API cannot express this option.
+///
+/// Requesting *unmarked* still succeeds, because a platform that can never
+/// apply a nonzero class also never left one on the socket for the next reply to
+/// inherit — the invariant the explicit zero exists to protect. Asking for a
+/// real marking reports [`io::ErrorKind::Unsupported`] rather than pretending:
+/// the runtime drops that one reply and stays alive, and no reply ever goes out
+/// carrying a class the server did not intend.
+#[cfg(any(
+    target_os = "fuchsia",
+    target_os = "redox",
+    target_os = "solaris",
+    target_os = "illumos",
+    target_os = "haiku",
+    not(any(
+        target_os = "android",
+        target_os = "dragonfly",
+        target_os = "freebsd",
+        target_os = "fuchsia",
+        target_os = "linux",
+        target_os = "macos",
+        target_os = "netbsd",
+        target_os = "openbsd",
+        target_os = "cygwin",
+    )),
+))]
+fn unsupported_traffic_class(traffic_class: u32, option: &'static str) -> io::Result<()> {
+    if traffic_class == 0 {
+        Ok(())
+    } else {
+        Err(io::Error::new(
+            io::ErrorKind::Unsupported,
+            format!("{option} are unsupported on this target"),
+        ))
+    }
+}