Merge branch 'main' into fix/3641-neqo-ack-32-range-limit

Author: larseggert

.clippy.toml

@@ -10,4 +10,4 @@ allow-unwrap-in-tests = true
 allow-dbg-in-tests = true
 avoid-breaking-exported-api = false # We have one consumer and can afford to break the API.
 pass-by-value-size-limit = 32
-doc-valid-idents = ["HyStart", "CHokepoint", ".."]
+doc-valid-idents = ["HyStart", "CHokepoint", "CodSpeed", ".."]

.github/CODEOWNERS

@@ -1 +1,2 @@
 *    @KershawChang @martinthomson @larseggert @mxinden
+/neqo-transport/ @omansfeld @KershawChang @martinthomson @larseggert @mxinden

.github/actionlint.yml

@@ -2,6 +2,11 @@
 self-hosted-runner:
   # Labels of self-hosted runner in array of strings.
   labels:
-    - moonshot
-    - moonshot-exp
-    - codspeed-macro
+    - codspeed-macro-x86-ryzen-9950x-ubuntu-24-04
+
+# actionlint 1.7.12 does not know the `$/` syntax, see https://github.com/rhysd/actionlint/issues/711
+paths:
+  .github/workflows/**/*.{yml,yaml}:
+    ignore:
+      - 'specifying action "\$/[^"]+" in invalid format because ref is missing'
+      - 'reusable workflow call "\$/[^"]+" at "uses" is not following the format'

.github/actions/bench-machine/action.yml

@@ -0,0 +1,56 @@
+name: Prepare machine for benchmarks
+description: >
+  Widen the loopback MTU, install the debug symbols samply needs, and report which CPUs to
+  pin benchmarks to. The runners already set the governor, disable SMT and turbo, relax the
+  perf restrictions, and reserve an isolated CPU die. Each job gets its own runner, so
+  nothing has to be restored afterwards.
+
+inputs:
+  mtu:
+    description: MTU to set on the loopback interface
+    default: ""
+
+outputs:
+  server-cpu:
+    description: CPU to pin the server to
+    value: ${{ steps.machine.outputs.server-cpu }}
+  client-cpu:
+    description: CPU to pin the client to
+    value: ${{ steps.machine.outputs.client-cpu }}
+  bench-cpus:
+    description: Both CPUs, for benchmarks that serve from a thread of their own
+    value: ${{ steps.machine.outputs.bench-cpus }}
+
+runs:
+  using: composite
+  steps:
+    - id: machine
+      shell: bash
+      env:
+        MTU: ${{ inputs.mtu }}
+      run: |
+        # The runner's hostname does not resolve, which makes `sudo` warn on every call.
+        grep -qw "$(hostname)" /etc/hosts ||
+          echo "127.0.0.1 $(hostname)" | sudo tee -a /etc/hosts > /dev/null
+
+        [ -z "$MTU" ] || sudo ip link set dev lo mtu "$MTU"
+
+        # `libc6-dbg` lets samply symbolicate libc frames.
+        [ "$APT_UPDATED" ] || sudo apt-get update && echo "APT_UPDATED=1" >> "$GITHUB_ENV"
+        sudo apt-get install -y --no-install-recommends libc6-dbg
+
+        ALLOWED=$(sed -n 's/^Cpus_allowed_list:[[:space:]]*//p' /proc/self/status)
+        CPUS=()
+        for RANGE in ${ALLOWED//,/ }; do  # A bare CPU number is a range of one.
+          for ((CPU=${RANGE%-*}; CPU<=${RANGE#*-}; CPU++)); do CPUS+=("$CPU"); done
+        done
+        if [ ${#CPUS[@]} -lt 2 ]; then
+          echo "::error::Need a CPU each for client and server, runner allows only: $ALLOWED"
+          exit 1
+        fi
+        echo "Runner allows CPUs $ALLOWED, pinning the server to ${CPUS[-1]}, the client to ${CPUS[-2]}"
+        {
+          echo "server-cpu=${CPUS[-1]}"
+          echo "client-cpu=${CPUS[-2]}"
+          echo "bench-cpus=${CPUS[-2]},${CPUS[-1]}"
+        } >> "$GITHUB_OUTPUT"

.github/actions/bench-matrix/action.yml

@@ -3,7 +3,7 @@ description: Determine the list of benchmarks from cargo metadata
 
 outputs:
   benches:
-    description: JSON array of benchmarks for CodSpeed (non-walltime, with runner)
+    description: JSON array of benchmarks for CodSpeed
     value: ${{ steps.benches.outputs.benches }}
   all:
     description: JSON array of all unique crate/bench pairs (for profiling)
@@ -43,13 +43,10 @@ runs:
             )
           ]')
 
-        # CodSpeed benchmarks (non-walltime, with runner)
-        NON_WALLTIME=$(echo "$ALL_BENCHES" | jq -c '[.[] | select(.mode != "walltime") | . + {runner: "ubuntu-24.04"}]')
-
         # All unique crate/bench pairs (for profiling)
         ALL_UNIQUE=$(echo "$ALL_BENCHES" | jq -c '[.[] | {crate, bench}] | unique')
 
         {
-          echo "benches=$NON_WALLTIME"
+          echo "benches=$ALL_BENCHES"
           echo "all=$ALL_UNIQUE"
         } >> "$GITHUB_OUTPUT"

.github/actions/build-neqo/action.yml

@@ -5,9 +5,6 @@ description: >
   and upload everything as a single artifact.
 
 inputs:
-  token:
-    description: GitHub token
-    required: true
   artifact-name:
     description: Name for the uploaded artifact
     required: true
@@ -17,9 +14,6 @@ inputs:
   baseline-ref:
     description: Git ref to build baseline binaries from
     default: "origin/main"
-  nss-minimum-version:
-    description: Minimum NSS version required by nss-rs
-    required: true
 
 runs:
   using: composite
@@ -30,17 +24,11 @@ runs:
         [ "$APT_UPDATED" ] || sudo apt-get update && echo "APT_UPDATED=1" >> "$GITHUB_ENV"
         sudo apt-get install -y --no-install-recommends clang lld
 
-    - name: Install Rust
-      uses: mozilla/actions/rust@c7f9db3409fff64a55f16ac0cacbc4cdd05ae435 # v1.1.19
+    - name: Install Rust and NSS
+      uses: $/.github/actions/install-build-deps
       with:
         version: stable
-        token: ${{ inputs.token }}
-
-    - name: Install NSS
-      uses: mozilla/actions/nss@c7f9db3409fff64a55f16ac0cacbc4cdd05ae435 # v1.1.19
-      with:
-        minimum-version: ${{ inputs.nss-minimum-version }}
-        token: ${{ inputs.token }}
+        working-directory: neqo
 
     - name: Build neqo
       shell: bash
@@ -87,21 +75,11 @@ runs:
         if [[ "$BENCHES" == "true" ]]; then build_walltime_benches ../dist/neqo; fi
         cp target/release/neqo-client target/release/neqo-server ../dist/neqo/
 
-    - name: Bundle NSS libraries and test fixture
-      shell: bash
-      run: |
-        mkdir -p dist/lib
-        if [ -d "$NSS_DIR/../dist/Release/lib" ]; then
-          cp -L "$NSS_DIR"/../dist/Release/lib/*.so dist/lib/ 2>/dev/null || true
-          cp -L "$NSS_DIR"/../dist/Release/lib/*.so.* dist/lib/ 2>/dev/null || true
-        else
-          for lib in nss3 nssutil3 smime3 ssl3 nspr4 plc4 plds4; do
-            cp -L /usr/lib/*/lib${lib}.so* dist/lib/ 2>/dev/null || true
-          done
-        fi
-        NSS_DB=$(cd neqo && cargo metadata --format-version 1 | jq -r 'first(.packages[] | select(.name == "test-fixture" and (.source // "" | startswith("git+"))) | .manifest_path | rtrimstr("/Cargo.toml"))')/db
-        mkdir -p dist/test-fixture
-        cp -r "$NSS_DB" dist/test-fixture/
+    - name: Bundle NSS runtime files
+      uses: $/.github/actions/bundle-nss
+      with:
+        path: dist
+        working-directory: neqo
 
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:

.github/actions/bundle-nss/action.yml

@@ -0,0 +1,44 @@
+name: Bundle NSS runtime files
+description: >
+  Copy what neqo binaries need at runtime into <path>: the NSS shared libraries they link
+  against into lib/, and the test-fixture certificate database into test-fixture/db.
+  Requires install-build-deps to have run first, which sets NSS_DIR, and a Cargo workspace at
+  <working-directory> to resolve test-fixture from.
+
+inputs:
+  path:
+    description: Directory to create lib/ and test-fixture/ under
+    required: true
+  working-directory:
+    description: Directory containing the Cargo.toml that pins test-fixture
+    default: "."
+
+runs:
+  using: composite
+  steps:
+    - shell: bash
+      env:
+        DEST: ${{ inputs.path }}
+        WORKING_DIRECTORY: ${{ inputs.working-directory }}
+      run: |
+        mkdir -p "$DEST/lib"
+        if [ -d "$NSS_DIR/../dist/Release/lib" ]; then
+          cp -L "$NSS_DIR"/../dist/Release/lib/*.so "$DEST/lib/" 2>/dev/null || true
+          cp -L "$NSS_DIR"/../dist/Release/lib/*.so.* "$DEST/lib/" 2>/dev/null || true
+        else
+          for lib in nss3 nssutil3 smime3 ssl3 nspr4 plc4 plds4; do
+            cp -L /usr/lib/*/lib${lib}.so* "$DEST/lib/" 2>/dev/null || true
+          done
+        fi
+        if [ -z "$(ls -A "$DEST/lib")" ]; then
+          echo "::error::No NSS libraries found (NSS_DIR=${NSS_DIR:-unset})"
+          exit 1
+        fi
+        # Without TEST_FIXTURE_DB, test-fixture falls back to the cargo checkout path.
+        NSS_DB=$(cd "$WORKING_DIRECTORY" && cargo metadata --format-version 1 | jq -r 'first(.packages[] | select(.name == "test-fixture" and (.source // "" | startswith("git+"))) | .manifest_path | rtrimstr("/Cargo.toml"))')/db
+        if [ ! -d "$NSS_DB" ]; then
+          echo "::error::No nss-rs test-fixture db found (looked in $NSS_DB)"
+          exit 1
+        fi
+        mkdir -p "$DEST/test-fixture"
+        cp -r "$NSS_DB" "$DEST/test-fixture/"

.github/actions/check-android/action.yml

@@ -17,45 +17,37 @@ inputs:
     # https://searchfox.org/mozilla-central/search?q=\bapi_level=&path=taskcluster/scripts/misc/build-llvm-common.sh&regexp=true
     # However, NSS requires an API >= 23 for a few symbols.
     default: "23"
-  minimum-nss-version:
-    description: "If NSS is required, the minimum version required."
-    default: ""
-  github-token:
-    description: "A Github PAT"
-    required: true
+  nss:
+    description: "Whether to install NSS."
+    default: "true"
 
 runs:
   using: composite
   steps:
-    - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+    - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
       with:
         distribution: zulu
         java-version: 23
 
-    - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+    - uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
       with:
         accept-android-sdk-licenses: true
         log-accepted-android-sdk-licenses: false
+        packages: platform-tools
 
     - shell: bash
       env:
         NDK_VERSION: ${{ inputs.ndk-version }}
         WD: ${{ inputs.working-directory }}
       run: cd "$WD" && sdkmanager --install "ndk;$NDK_VERSION"
 
-    - uses: mozilla/actions/rust@c7f9db3409fff64a55f16ac0cacbc4cdd05ae435 # v1.1.19
+    - uses: $/.github/actions/install-build-deps
       with:
         version: stable
-        targets: ${{ inputs.target }}
-        tools: cargo-ndk@^4
-        token: ${{ inputs.github-token }}
-
-    - uses: mozilla/actions/nss@c7f9db3409fff64a55f16ac0cacbc4cdd05ae435 # v1.1.19
-      if: ${{ inputs.minimum-nss-version != '' }}
-      with:
-        minimum-version: ${{ inputs.minimum-nss-version }}
         target: ${{ inputs.target }}
-        token: ${{ inputs.github-token }}
+        tools: cargo-ndk@^4
+        nss: ${{ inputs.nss }}
+        working-directory: ${{ inputs.working-directory }}
 
     - shell: bash
       env:
@@ -90,14 +82,14 @@ runs:
           adb push "$test" "$TMP/"
           adb shell chmod +x "$TMP/$(basename "$test")"
           # See https://unix.stackexchange.com/a/451140/409256
-          adb shell "CARGO_TERM_COLOR=always RUST_BACKTRACE=1 LD_LIBRARY_PATH=$TMP/lib NSS_DB_PATH=$TMP/db API_LEVEL=$API_LEVEL $TMP/$(basename "$test") || echo _FAIL_" 2>&1 | tee output
+          adb shell "CARGO_TERM_COLOR=always RUST_BACKTRACE=1 LD_LIBRARY_PATH=$TMP/lib TEST_FIXTURE_DB=$TMP/db API_LEVEL=$API_LEVEL $TMP/$(basename "$test") || echo _FAIL_" 2>&1 | tee output
           grep _FAIL_ output > /dev/null && any_failures=1
         done
         exit $any_failures
         EOF
         chmod a+x /tmp/rust-android-run-tests-on-emulator.sh
 
-    - uses: reactivecircus/android-emulator-runner@e89f39f1abbbd05b1113a29cf4db69e7540cae5a # v2.37.0
+    - uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2.38.0
       if: ${{ !startsWith(inputs.target, 'aarch64') }}
       with:
         api-level: ${{ inputs.api-level }}

.github/actions/check-vm/action.yml

@@ -14,6 +14,9 @@ inputs:
   bindgen-args:
     description: "bindgen arguments for generating BSD bindings. Non-empty enables binding generation."
     default: ""
+  nss-version-check:
+    description: "Whether to check the system NSS version against the minimum required by nss-rs."
+    default: "true"
 
 runs:
   using: composite
@@ -25,7 +28,17 @@ runs:
         PLATFORM: ${{ inputs.platform }}
         WORKSPACE: ${{ inputs.working-directory == '.' && '--workspace' || '' }}
         BINDGEN_ARGS: ${{ inputs.bindgen-args }}
+        NSS_VERSION_CHECK: ${{ inputs.nss-version-check }}
       run: |
+        # Minimum NSS version required by nss-rs, so that we can detect a too-old system NSS below.
+        if [ "$NSS_VERSION_CHECK" = "true" ]; then
+          NSS_MIN_VERSION=$(cargo metadata --locked --format-version=1 -q \
+            | jq -r '.packages[] | select(.name=="nss-rs") | .metadata.nss["min-version"]')
+          case "$NSS_MIN_VERSION" in
+            *[!0-9.]*|"") echo "Could not determine minimum NSS version"; exit 1 ;;
+          esac
+        fi
+
         cat <<EOF > prepare.sh
           # This executes as root
           set -ex
@@ -55,6 +68,16 @@ runs:
           set -ex
           cd "$WD"
           pwd
+          NSS_MIN_VERSION='$NSS_MIN_VERSION'
+          if [ -n "\$NSS_MIN_VERSION" ]; then
+            if ! pkg-config --exists nss; then
+              echo "::warning::No nss.pc on $PLATFORM, cannot check the NSS version"
+            elif ! pkg-config --atleast-version="\$NSS_MIN_VERSION" nss; then
+              echo "Skipping $PLATFORM: system NSS \$(pkg-config --modversion nss) is older than the required \$NSS_MIN_VERSION" > nss-skipped.txt
+              echo "::warning::\$(cat nss-skipped.txt)"
+              exit 0
+            fi
+          fi
           case "$PLATFORM" in
             openbsd)    export LIBCLANG_PATH=/usr/local/llvm21/lib
                         export LLVM_COV=/usr/local/llvm21/bin/llvm-cov
@@ -123,7 +146,7 @@ runs:
         echo "envs=CARGO_TERM_COLOR RUST_BACKTRACE RUST_LOG RUST_TEST_TIME_UNIT RUST_TEST_TIME_INTEGRATION RUST_TEST_TIME_DOCTEST WD" >> "$GITHUB_OUTPUT"
 
     - if: ${{ inputs.platform == 'freebsd' }}
-      uses: vmactions/freebsd-vm@a6de9343ef5747433d9c25784c90e84998b9d69a # v1.4.6
+      uses: vmactions/freebsd-vm@4469451fe39bee80be4066836c5170362e9349f3 # v1.5.7
       with:
         usesh: true
         disable-cache: true
@@ -133,7 +156,7 @@ runs:
         run: ${{ steps.prep.outputs.run }}
 
     - if: ${{ inputs.platform == 'openbsd' }}
-      uses: vmactions/openbsd-vm@fcf799d7ce9c305ad89eabef1fb2fa5c1c42d0ee # v1.4.3
+      uses: vmactions/openbsd-vm@86cdc08415d9d0865267e686561e276c52d62530 # v1.4.7
       with:
         usesh: true
         disable-cache: true
@@ -143,7 +166,7 @@ runs:
         run: ${{ steps.prep.outputs.run }}
 
     - if: ${{ inputs.platform == 'netbsd' }}
-      uses: vmactions/netbsd-vm@99816dccf75edf233ed6cd00a159e3a5b85ea373 # v1.4.0
+      uses: vmactions/netbsd-vm@20ee93a005c9fc78743e6e05269f4cb023b87413 # v1.5.0
       with:
         usesh: true
         disable-cache: true
@@ -153,7 +176,7 @@ runs:
         run: ${{ steps.prep.outputs.run }}
 
     - if: ${{ inputs.platform == 'solaris' }}
-      uses: vmactions/solaris-vm@d30dd6c228c8661ade859e36ead7660b9a62efcc # v1.3.7
+      uses: vmactions/solaris-vm@a11f407d3720a3717673d4194f19ee63b284977e # v1.4.0
       with:
         release: "11.4-gcc"
         usesh: true
@@ -163,14 +186,22 @@ runs:
         prepare: ${{ steps.prep.outputs.prepare }}
         run: ${{ steps.prep.outputs.run }}
 
+    - shell: bash
+      env:
+        WORKING_DIR: ${{ inputs.working-directory }}
+      run: |
+        if [ -f "$WORKING_DIR/nss-skipped.txt" ]; then
+          echo "### $(cat "$WORKING_DIR/nss-skipped.txt")" >> "$GITHUB_STEP_SUMMARY"
+        fi
+
     - id: check-coverage
       shell: bash
       env:
         WORKING_DIR: ${{ inputs.working-directory }}
       run: test -f "$WORKING_DIR/codecov.json" && echo "exists=true" >> "$GITHUB_OUTPUT" || true
 
     - if: ${{ steps.check-coverage.outputs.exists == 'true' }}
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
       with:
         files: codecov.json
         working-directory: ${{ inputs.working-directory }}