From de255f4240901057f1a9f2cec87eaa4897349369 Mon Sep 17 00:00:00 2001
From: Nikolay Edigaryev <edigaryev@gmail.com>
Date: Wed, 14 Jan 2026 18:44:17 +0100
Subject: [PATCH] Ensure that coarsetime::Updater is stopped on
 Proxy::shutdown()

---
 lib/proxy/mod.rs | 17 +++++++++++++++--
 src/main.rs      |  4 +++-
 2 files changed, 18 insertions(+), 3 deletions(-)

diff --git a/lib/proxy/mod.rs b/lib/proxy/mod.rs
index 9dbd416..ae8e8ce 100644
--- a/lib/proxy/mod.rs
+++ b/lib/proxy/mod.rs
@@ -9,7 +9,7 @@ use crate::host::Host;
 use crate::host::NetType;
 use crate::poller::Poller;
 use crate::vm::VM;
-use anyhow::Result;
+use anyhow::{Context, Result};
 pub use exposed_port::ExposedPort;
 use ipnet::Ipv4Net;
 use mac_address::MacAddress;
@@ -27,6 +27,7 @@ pub struct Proxy<'proxy> {
     poller: Poller<'proxy>,
     vm_mac_address: smoltcp::wire::EthernetAddress,
     dhcp_snooper: DhcpSnooper,
+    coarsetime_updater: coarsetime::Updater,
     rules: PrefixMap<Ipv4Net, Action>,
     enobufs_encountered: bool,
     port_forwarder: PortForwarder,
@@ -66,7 +67,8 @@ impl Proxy<'_> {
         }
 
         let coarsetime_update_interval_millis = 100;
-        coarsetime::Updater::new(coarsetime_update_interval_millis).start()?;
+        let coarsetime_updater =
+            coarsetime::Updater::new(coarsetime_update_interval_millis).start()?;
 
         Ok(Proxy {
             vm,
@@ -76,6 +78,7 @@ impl Proxy<'_> {
             dhcp_snooper: DhcpSnooper::new(Duration::from_millis(
                 coarsetime_update_interval_millis,
             )),
+            coarsetime_updater,
             rules,
             enobufs_encountered: false,
             port_forwarder: PortForwarder::new(exposed_ports),
@@ -121,6 +124,12 @@ impl Proxy<'_> {
         }
     }
 
+    pub fn shutdown(self) -> Result<()> {
+        self.coarsetime_updater
+            .stop()
+            .context("failed to shutdown coarsetime updater")
+    }
+
     fn read_from_vm(&mut self, buf: &mut [u8]) -> Result<()> {
         loop {
             match self.vm.read(buf) {
@@ -193,6 +202,8 @@ mod tests {
         );
 
         assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "66.66.66.66").is_none());
+
+        proxy.shutdown().unwrap();
     }
 
     #[test]
@@ -212,6 +223,8 @@ mod tests {
         assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.32").is_none());
         assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.33").is_some());
         assert!(allowed_from_vm_ipv4(&proxy, vm_ip, "33.33.33.34").is_none());
+
+        proxy.shutdown().unwrap();
     }
 
     fn create_proxy<'test>(vm_ip: Ipv4Address, allow: Vec<&str>, block: Vec<&str>) -> Proxy<'test> {
diff --git a/src/main.rs b/src/main.rs
index 49e84cd..d1b4fa2 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -211,7 +211,9 @@ fn try_main() -> anyhow::Result<()> {
         .context("failed to drop privileges")?;
 
     // Run proxy
-    proxy.run()
+    proxy.run()?;
+
+    proxy.shutdown()
 }
 
 fn sudo_escalation_works() -> bool {