Merge branch 'main' into feat-stop-pmtud-at-iface-mtu

.github/actions/nss/action.yml

@@ -111,7 +111,7 @@ runs:
     - name: Cache NSS
       id: cache
       if: env.USE_SYSTEM_NSS == '0' && runner.environment == 'github-hosted'
-      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+      uses: actions/cache@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
       with:
         path: dist
         key: nss-${{ runner.os }}-${{ inputs.type }}-${{ env.NSS_HEAD }}-${{ env.NSPR_HEAD }}

.github/workflows/bench.yml

@@ -86,7 +86,7 @@ jobs:
 
       - name: Download cached main-branch results
         id: criterion-cache
-        uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: ./target/criterion
           key: criterion-${{ runner.name }}-${{ github.sha }}
@@ -269,7 +269,7 @@ jobs:
 
       - name: Cache main-branch results
         if: github.ref == 'refs/heads/main'
-        uses: actions/cache/save@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: ./target/criterion
           key: criterion-${{ runner.name }}-${{ github.sha }}

.github/workflows/check.yml

@@ -65,8 +65,8 @@ jobs:
       - uses: ./.github/actions/rust
         with:
           version: ${{ matrix.rust-toolchain }}
-          components: ${{ matrix.rust-toolchain == 'stable' && 'llvm-tools-preview' || '' }}
-          tools: ${{ matrix.rust-toolchain == 'stable' && 'cargo-llvm-cov, ' || '' }} cargo-nextest
+          components: ${{ matrix.rust-toolchain == 'nightly' && 'llvm-tools' || '' }}
+          tools: ${{ matrix.rust-toolchain == 'nightly' && 'cargo-llvm-cov, ' || '' }} cargo-nextest
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - id: nss-version
@@ -88,8 +88,8 @@ jobs:
           DUMP_SIMULATION_SEEDS="$(pwd)/simulation-seeds"
           export DUMP_SIMULATION_SEEDS
           # shellcheck disable=SC2086
-          if [ "${{ matrix.rust-toolchain }}" == "stable" ]; then
-            cargo +${{ matrix.rust-toolchain }} llvm-cov nextest $BUILD_TYPE --features ci --profile ci --lcov --output-path lcov.info
+          if [ "${{ matrix.rust-toolchain }}" == "nightly" ]; then
+            cargo +${{ matrix.rust-toolchain }} llvm-cov nextest $BUILD_TYPE --mcdc --include-ffi --features ci --profile ci --codecov --output-path codecov.json
           else
             cargo +${{ matrix.rust-toolchain }} nextest run $BUILD_TYPE --features ci --profile ci
           fi
@@ -111,15 +111,15 @@ jobs:
           RUST_LOG: warn
           BUILD_DIR: ${{ matrix.type == 'release' && 'release' || 'debug' }}
 
-      - uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a # v5.0.7
+      - uses: codecov/codecov-action@7f8b4b4bde536c465e797be725718b88c5d95e0e # v5.1.1
         with:
-          files: lcov.info
+          files: codecov.json
           fail_ci_if_error: false
           token: ${{ secrets.CODECOV_TOKEN }}
           verbose: true
         env:
           CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        if: matrix.type == 'debug' && matrix.rust-toolchain == 'stable'
+        if: matrix.type == 'debug' && matrix.rust-toolchain == 'nightly'
 
       - name: Save simulation seeds artifact
         if: always()

.github/workflows/qns.yml

@@ -55,7 +55,7 @@ jobs:
             # set latest tag for default branch
             type=raw,value=latest,enable={{is_default_branch}}
 
-      - uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+      - uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
         if: github.event_name != 'pull_request'
         with:
           push: true
@@ -66,7 +66,7 @@ jobs:
           cache-to: type=gha,mode=max
           platforms: 'linux/amd64, linux/arm64'
 
-      - uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+      - uses: docker/build-push-action@48aba3b46d1b1fec4febb7c5d0c644b249a11355 # v6.10.0
         id: docker_build_and_push
         with:
           tags: ${{ steps.meta.outputs.tags }}
@@ -167,7 +167,7 @@ jobs:
           pattern: '*results'
           path: results
 
-      - uses: actions/cache/restore@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+      - uses: actions/cache/restore@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: results-main
           key: qns-${{ github.sha }}
@@ -259,11 +259,12 @@ jobs:
 
       - if: github.ref == 'refs/heads/main'
         run: |
+          rm -rf results-main || true
           mv results results-main
           echo "${{ github.sha }}" > results-main/baseline-sha.txt
 
       - if: github.ref == 'refs/heads/main'
-        uses: actions/cache/save@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
+        uses: actions/cache/save@1bd1e32a3bdc45362d1e726936510720a7c30a57 # v4.2.0
         with:
           path: results-main
           key: qns-${{ github.sha }}

.gitignore

@@ -3,4 +3,5 @@
 *~
 /.vscode/
 /lcov.info
+/mutants.out*/
 /target/

neqo-bin/src/client/mod.rs

@@ -508,9 +508,9 @@ fn qlog_new(args: &Args, hostname: &str, cid: &ConnectionId) -> Res<NeqoQlog> {
     NeqoQlog::enabled_with_file(
         qlog_dir,
         Role::Client,
-        Some("Example qlog".to_string()),
-        Some("Example qlog description".to_string()),
-        format!("{hostname}-{cid}"),
+        Some("Neqo client qlog".to_string()),
+        Some("Neqo client qlog".to_string()),
+        format!("client-{hostname}-{cid}"),
     )
     .map_err(Error::QlogError)
 }

neqo-bin/src/server/http3.rs

@@ -12,7 +12,7 @@ use std::{
     time::Instant,
 };
 
-use neqo_common::{hex, qdebug, qerror, qinfo, Datagram, Header};
+use neqo_common::{header::HeadersExt, hex, qdebug, qerror, qinfo, Datagram, Header};
 use neqo_crypto::{generate_ech_keys, random, AntiReplay};
 use neqo_http3::{
     Http3OrWebTransportStream, Http3Parameters, Http3Server, Http3ServerEvent, StreamId,
@@ -94,15 +94,12 @@ impl super::HttpServer for HttpServer {
                 } => {
                     qdebug!("Headers (request={stream} fin={fin}): {headers:?}");
 
-                    if headers
-                        .iter()
-                        .any(|h| h.name() == ":method" && h.value() == "POST")
-                    {
+                    if headers.contains_header(":method", "POST") {
                         self.posts.insert(stream, 0);
                         continue;
                     }
 
-                    let Some(path) = headers.iter().find(|&h| h.name() == ":path") else {
+                    let Some(path) = headers.find_header(":path") else {
                         stream
                             .cancel_fetch(neqo_http3::Error::HttpRequestIncomplete.code())
                             .unwrap();

neqo-common/Cargo.toml

@@ -28,13 +28,22 @@ qlog = { workspace = true }
 windows = { version = "0.58", default-features = false, features = ["Win32_Media"] }
 
 [dev-dependencies]
+criterion = { version = "0.5", default-features = false }
+neqo-crypto = { path = "../neqo-crypto" }
 test-fixture = { path = "../test-fixture" }
 regex = { workspace = true }
 
 [features]
-ci = []
+bench = ["test-fixture/bench"]
 build-fuzzing-corpus = ["hex"]
+ci = []
+test-fixture = []
 
 [lib]
 # See https://github.com/bheisler/criterion.rs/blob/master/book/src/faq.md#cargo-bench-gives-unrecognized-option-errors-for-valid-command-line-options
 bench = false
+
+[[bench]]
+name = "decoder"
+harness = false
+required-features = ["bench"]

neqo-common/benches/decoder.rs

@@ -0,0 +1,52 @@
+// Licensed under the Apache License, Version 2.0 <LICENSE-APACHE or
+// http://www.apache.org/licenses/LICENSE-2.0> or the MIT license
+// <LICENSE-MIT or http://opensource.org/licenses/MIT>, at your
+// option. This file may not be copied, modified, or distributed
+// except according to those terms.
+
+use criterion::{black_box, criterion_group, criterion_main, Criterion};
+use neqo_common::Decoder;
+use neqo_crypto::{init, randomize};
+
+fn randomize_buffer(n: usize, mask: u8) -> Vec<u8> {
+    let mut buf = vec![0; n];
+    // NSS doesn't like randomizing larger buffers, so chunk them up.
+    // https://searchfox.org/nss/rev/968939484921b0ceecca189cd1b66e97950c39da/lib/freebl/drbg.c#29
+    for chunk in buf.chunks_mut(0x10000) {
+        randomize(chunk);
+    }
+    // Masking the top bits off causes the resulting values to be interpreted as
+    // smaller varints, which stresses the decoder differently.
+    // This is worth testing because most varints contain small values.
+    for x in &mut buf[..] {
+        *x &= mask;
+    }
+    buf
+}
+
+fn decoder(c: &mut Criterion, count: usize, mask: u8) {
+    c.bench_function(&format!("decode {count} bytes, mask {mask:x}"), |b| {
+        b.iter_batched_ref(
+            || randomize_buffer(count, mask),
+            |buf| {
+                let mut dec = Decoder::new(&buf[..]);
+                while black_box(dec.decode_varint()).is_some() {
+                    // Do nothing;
+                }
+            },
+            criterion::BatchSize::SmallInput,
+        );
+    });
+}
+
+fn benchmark_decoder(c: &mut Criterion) {
+    init().unwrap();
+    for mask in [0xff, 0x7f, 0x3f] {
+        for exponent in [12, 20] {
+            decoder(c, 1 << exponent, mask);
+        }
+    }
+}
+
+criterion_group!(benches, benchmark_decoder);
+criterion_main!(benches);