fix(native): delay relay ACK behind cloud NAT reply

product-source/hololake-platform/guanghu-os/scripts/physical-native-icmp-peer.py

@@ -123,6 +123,7 @@ def main() -> None:
     parser.add_argument("--resident-pipeline", action="store_true")
     parser.add_argument("--native-relay", action="store_true")
     parser.add_argument("--allowed-source")
+    parser.add_argument("--native-ack-delay", type=float, default=0.25)
     args = parser.parse_args()
     if args.retry_interval < 1.0:
         raise SystemExit("--retry-interval must be at least 1 second")
@@ -130,6 +131,8 @@ def main() -> None:
         0 <= args.resume_resident_count <= 10
     ):
         raise SystemExit("--resume-resident-count must be between 0 and 10")
+    if not 0.0 <= args.native_ack_delay <= 2.0:
+        raise SystemExit("--native-ack-delay must be between 0 and 2 seconds")
     if sum(
         (
             args.resident,
@@ -181,6 +184,10 @@ def main() -> None:
                 continue
             if source != allowed_source:
                 continue
+            # The public-cloud NAT path is established by the host kernel's
+            # ordinary echo reply. Delay the authenticated ACK long enough for
+            # the native guest to discard that reply and repost its RX buffer.
+            time.sleep(args.native_ack_delay)
             peer.sendto(native_ack_reply(packet), address)
             acknowledged.add(sequence)
             sources.add(source)
@@ -197,6 +204,7 @@ def main() -> None:
             "status: PASS_100\n"
             "handshake_direction: NATIVE_INITIATED_OUTBOUND_ICMP\n"
             "native_ack_marker: HLDP-NATIVE-ACK!\n"
+            f"native_ack_delay_seconds: {args.native_ack_delay:g}\n"
             "acknowledged_sequences: 1-16\n"
             f"observed_nat_sources: {','.join(sorted(sources))}\n"
             "login_reply_count: 3\n"