ci.yml

name: CI

on:
  push:
  pull_request:
  workflow_dispatch:

# Cache-key convention: keys carry a trailing `-vN`. Bump that suffix in EVERY
# affected job whenever you change CMake flags / configure commands / compiler
# for the cached artifact, or a stale build from a different config is restored.

jobs:
  format-check:
    runs-on: ubuntu-latest
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v6
      - name: Install clang-format
        run: sudo apt-get update && sudo apt-get install -y clang-format
      - name: Check formatting
        run: |
          fail=0
          while IFS= read -r f; do
            if ! clang-format --dry-run --Werror "$f" 2>/dev/null; then
              echo "needs formatting: $f"; fail=1
            fi
          done < <(find src cli tests -type f \( -name '*.c' -o -name '*.h' \))
          if [ "$fail" -ne 0 ]; then
            echo "Fix: find src cli tests -name '*.c' -o -name '*.h' | xargs clang-format -i"
            exit 1
          fi

  build:
    # gcc Release: build + full unit suite. e2e_multipath self-skips (exit 77,
    # SKIP_RETURN_CODE) on the unprivileged runner — no tc/netem needed.
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install dependencies
        run: sudo apt-get update && sudo apt-get install -y cmake libevent-dev libcurl4-openssl-dev libnghttp2-dev golang
      - name: Compute xquic SHA
        id: xqsha
        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"

      - name: Cache BoringSSL (gcc fPIC)
        id: bssl-cache
        uses: actions/cache@v5
        with:
          path: third_party/xquic/third_party/boringssl
          key: bssl-9c95ec7-linux-gcc-fpic-v1
      - name: Clone + build BoringSSL (pinned)
        if: steps.bssl-cache.outputs.cache-hit != 'true'
        run: |
          git clone https://github.com/google/boringssl.git third_party/xquic/third_party/boringssl
          cd third_party/xquic/third_party/boringssl
          git checkout 9c95ec797c65fde9e8ddffc3888f0b8c1460fe4c
          mkdir -p build && cd build
          cmake -DBUILD_SHARED_LIBS=0 -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC" ..
          make -j"$(nproc)" ssl crypto

      - name: Cache xquic (gcc Release, EVENT_LOG)
        id: xquic-cache
        uses: actions/cache@v5
        with:
          # xqc_configure.h is generated INTO the source tree (not the build
          # dir); cache it too or a restored lib pairs with a stale header.
          path: |
            third_party/xquic/build
            third_party/xquic/include/xquic/xqc_configure.h
          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-9c95ec7-v1
      - name: Build xquic
        if: steps.xquic-cache.outputs.cache-hit != 'true'
        run: |
          cd third_party/xquic
          mkdir -p build && cd build
          cmake -DCMAKE_BUILD_TYPE=Release -DSSL_TYPE=boringssl \
                -DXQC_ENABLE_EVENT_LOG=ON \
                -DXQC_ENABLE_BBR2=ON -DXQC_ENABLE_UNLIMITED=ON \
                -DXQC_ENABLE_FEC=ON -DXQC_ENABLE_XOR=ON \
                -DCMAKE_C_FLAGS="-Wno-dangling-pointer" ..
          make -j"$(nproc)"

      - name: Build mqproxy (Release)
        run: |
          cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
                -DXQUIC_BUILD_DIR="$PWD/third_party/xquic/build"
          cmake --build build -j"$(nproc)"
      - name: Unit tests (ctest)
        run: ctest --test-dir build --output-on-failure

  packaging:
    # Static-link (xquic+BoringSSL) packaging build: verify the install layout +
    # self-containment, then a REAL `systemctl start` of the hardened unit (the only
    # check that exercises MemoryDenyWriteExecute / @system-service / RestrictAddressFamilies
    # / ProtectHome against a live process — systemd-analyze cannot). Self-contained:
    # rebuilds BoringSSL+xquic from the same caches as `build` (no artifact to depend on).
    runs-on: ubuntu-latest
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install dependencies
        run: sudo apt-get update && sudo apt-get install -y cmake libevent-dev libcurl4-openssl-dev libnghttp2-dev golang
      - name: Compute xquic SHA
        id: xqsha
        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"

      - name: Cache BoringSSL (gcc fPIC)
        id: bssl-cache
        uses: actions/cache@v5
        with:
          path: third_party/xquic/third_party/boringssl
          key: bssl-9c95ec7-linux-gcc-fpic-v1
      - name: Clone + build BoringSSL (pinned)
        if: steps.bssl-cache.outputs.cache-hit != 'true'
        run: |
          git clone https://github.com/google/boringssl.git third_party/xquic/third_party/boringssl
          cd third_party/xquic/third_party/boringssl
          git checkout 9c95ec797c65fde9e8ddffc3888f0b8c1460fe4c
          mkdir -p build && cd build
          cmake -DBUILD_SHARED_LIBS=0 -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC" ..
          make -j"$(nproc)" ssl crypto

      - name: Cache xquic (gcc Release, EVENT_LOG)
        id: xquic-cache
        uses: actions/cache@v5
        with:
          path: |
            third_party/xquic/build
            third_party/xquic/include/xquic/xqc_configure.h
          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-9c95ec7-v1
      - name: Build xquic
        if: steps.xquic-cache.outputs.cache-hit != 'true'
        run: |
          cd third_party/xquic
          mkdir -p build && cd build
          cmake -DCMAKE_BUILD_TYPE=Release -DSSL_TYPE=boringssl \
                -DXQC_ENABLE_EVENT_LOG=ON \
                -DXQC_ENABLE_BBR2=ON -DXQC_ENABLE_UNLIMITED=ON \
                -DXQC_ENABLE_FEC=ON -DXQC_ENABLE_XOR=ON \
                -DCMAKE_C_FLAGS="-Wno-dangling-pointer" ..
          make -j"$(nproc)"

      - name: Configure (static, prefix=/usr)
        run: |
          cmake -S . -B build-pkg -DCMAKE_BUILD_TYPE=Release \
                -DXQUIC_BUILD_DIR="$PWD/third_party/xquic/build" \
                -DMQPROXY_STATIC_XQUIC=ON -DCMAKE_INSTALL_PREFIX=/usr
      - name: Build CLI
        run: cmake --build build-pkg --target mqproxy_cli -j"$(nproc)"
      - name: Verify packaging (layout + self-containment)
        run: ctest --test-dir build-pkg -R packaging_install_static --output-on-failure
      - name: Install + provision + live start smoke
        run: |
          sudo cmake --install build-pkg
          sudo systemd-sysusers
          sudo systemd-tmpfiles --create
          sudo install -d -o mqproxy -g mqproxy -m 0750 /etc/mqproxy
          # Cert/key MUST be readable by the hardened unit: the compiled-in default
          # cert path is under /home (blocked by ProtectHome=yes), so copy the repo
          # test cert into /etc/mqproxy (readable under ProtectSystem=strict).
          sudo install -o mqproxy -g mqproxy -m 0644 tests/certs/test.crt /etc/mqproxy/test.crt
          sudo install -o mqproxy -g mqproxy -m 0600 tests/certs/test.key /etc/mqproxy/test.key
          printf '[Interface]\nListen = 127.0.0.1:4433\n[TLS]\nCert = /etc/mqproxy/test.crt\nKey = /etc/mqproxy/test.key\n[Auth]\nKey = citoken\n' \
            | sudo tee /etc/mqproxy/test.conf >/dev/null
          sudo chown mqproxy:mqproxy /etc/mqproxy/test.conf
          sudo chmod 0600 /etc/mqproxy/test.conf
          sudo systemctl daemon-reload
          sudo systemctl start mqproxy-server@test
          sleep 2
          sudo journalctl -u mqproxy-server@test --no-pager | tail -30
          sudo systemctl is-active mqproxy-server@test   # fails the job if the unit died
          sudo systemctl stop mqproxy-server@test
      - name: Client unit live start smoke
        run: |
          # Client unit: dummy unreachable server + a local SOCKS5 ingress. Reconnect is
          # on by default, so it binds the ingress and stays up retrying — is-active holds.
          # No TLS cert needed (client side). Proves the client ExecStart/path + ingress
          # bind work under the same hardening sandbox as the server.
          printf '[Server]\nAddress = 127.0.0.1:14999\n[Auth]\nKey = citoken\n[Ingress]\nSocks5 = 127.0.0.1:1080\n' \
            | sudo tee /etc/mqproxy/testclient.conf >/dev/null
          sudo chown mqproxy:mqproxy /etc/mqproxy/testclient.conf
          sudo chmod 0600 /etc/mqproxy/testclient.conf
          sudo systemctl daemon-reload
          sudo systemctl start mqproxy-client@testclient
          sleep 2
          sudo journalctl -u mqproxy-client@testclient --no-pager | tail -30
          sudo systemctl is-active mqproxy-client@testclient   # fails the job if the unit died
          sudo systemctl stop mqproxy-client@testclient

  sanitizer:
    # ASan/UBSan build + unit suite (the configuration the proxy was developed
    # under). Same non-ASan Release xquic; only mqproxy gets the sanitizers.
    runs-on: ubuntu-latest
    timeout-minutes: 25
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install dependencies
        run: sudo apt-get update && sudo apt-get install -y cmake libevent-dev libcurl4-openssl-dev libnghttp2-dev golang
      - name: Compute xquic SHA
        id: xqsha
        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"

      - name: Cache BoringSSL (gcc fPIC)
        id: bssl-cache
        uses: actions/cache@v5
        with:
          path: third_party/xquic/third_party/boringssl
          key: bssl-9c95ec7-linux-gcc-fpic-v1
      - name: Clone + build BoringSSL (pinned)
        if: steps.bssl-cache.outputs.cache-hit != 'true'
        run: |
          git clone https://github.com/google/boringssl.git third_party/xquic/third_party/boringssl
          cd third_party/xquic/third_party/boringssl
          git checkout 9c95ec797c65fde9e8ddffc3888f0b8c1460fe4c
          mkdir -p build && cd build
          cmake -DBUILD_SHARED_LIBS=0 -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC" ..
          make -j"$(nproc)" ssl crypto

      - name: Cache xquic (gcc Release, EVENT_LOG)
        id: xquic-cache
        uses: actions/cache@v5
        with:
          path: |
            third_party/xquic/build
            third_party/xquic/include/xquic/xqc_configure.h
          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-9c95ec7-v1
      - name: Build xquic
        if: steps.xquic-cache.outputs.cache-hit != 'true'
        run: |
          cd third_party/xquic
          mkdir -p build && cd build
          cmake -DCMAKE_BUILD_TYPE=Release -DSSL_TYPE=boringssl \
                -DXQC_ENABLE_EVENT_LOG=ON \
                -DXQC_ENABLE_BBR2=ON -DXQC_ENABLE_UNLIMITED=ON \
                -DXQC_ENABLE_FEC=ON -DXQC_ENABLE_XOR=ON \
                -DCMAKE_C_FLAGS="-Wno-dangling-pointer" ..
          make -j"$(nproc)"

      - name: Build mqproxy (ASan/UBSan)
        run: |
          cmake -S . -B build-asan -DMQPROXY_SANITIZE=ON \
                -DXQUIC_BUILD_DIR="$PWD/third_party/xquic/build"
          cmake --build build-asan -j"$(nproc)"
      - name: Unit tests (ASan/UBSan)
        env:
          ASAN_OPTIONS: detect_leaks=1
          # Without halt_on_error, UBSan prints a diagnostic but exits 0, so
          # ctest would pass despite a UB finding — make UBSan actually gate.
          UBSAN_OPTIONS: print_stacktrace=1:halt_on_error=1
        run: ctest --test-dir build-asan --output-on-failure

  perf:
    # NET_ADMIN e2e tests (multipath aggregation, tproxy, MITM, UDP multipath
    # sub-cases) that cannot run on the unprivileged default runner. Runs inside
    # a Docker container with CAP_NET_ADMIN so tc/netem/nft work. The multipath
    # aggregation test (e2e_multipath) is the perf regression gate: it asserts
    # >=1.5x throughput over two shaped paths. All other NET_ADMIN-gated e2e
    # sub-cases (e2e_gateway case 8, e2e_tproxy, e2e_mitm_h2, e2e_udp case 6)
    # exercise their full codepath here instead of being SKIPPED.
    runs-on: ubuntu-latest
    timeout-minutes: 25
    container:
      image: ubuntu:24.04
      options: --cap-add=NET_ADMIN
    steps:
      - name: Install git (needed before checkout for submodules)
        run: apt-get update && apt-get install -y git
      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install dependencies
        run: |
          apt-get install -y \
            cmake gcc g++ make \
            libevent-dev libcurl4-openssl-dev libnghttp2-dev golang \
            iproute2 nftables curl python3 openssl sudo \
            ca-certificates
      - name: Compute xquic SHA
        id: xqsha
        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"

      - name: Cache BoringSSL (gcc fPIC)
        id: bssl-cache
        uses: actions/cache@v5
        with:
          path: third_party/xquic/third_party/boringssl
          key: bssl-9c95ec7-linux-gcc-fpic-v1
      - name: Clone + build BoringSSL (pinned)
        if: steps.bssl-cache.outputs.cache-hit != 'true'
        run: |
          git clone https://github.com/google/boringssl.git third_party/xquic/third_party/boringssl
          cd third_party/xquic/third_party/boringssl
          git checkout 9c95ec797c65fde9e8ddffc3888f0b8c1460fe4c
          mkdir -p build && cd build
          cmake -DBUILD_SHARED_LIBS=0 -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC" ..
          make -j"$(nproc)" ssl crypto

      - name: Cache xquic (gcc Release, EVENT_LOG)
        id: xquic-cache
        uses: actions/cache@v5
        with:
          path: |
            third_party/xquic/build
            third_party/xquic/include/xquic/xqc_configure.h
          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-9c95ec7-v1
      - name: Build xquic
        if: steps.xquic-cache.outputs.cache-hit != 'true'
        run: |
          cd third_party/xquic
          mkdir -p build && cd build
          cmake -DCMAKE_BUILD_TYPE=Release -DSSL_TYPE=boringssl \
                -DXQC_ENABLE_EVENT_LOG=ON \
                -DXQC_ENABLE_BBR2=ON -DXQC_ENABLE_UNLIMITED=ON \
                -DXQC_ENABLE_FEC=ON -DXQC_ENABLE_XOR=ON \
                -DCMAKE_C_FLAGS="-Wno-dangling-pointer" ..
          make -j"$(nproc)"

      - name: Build mqproxy (Release)
        run: |
          cmake -S . -B build -DCMAKE_BUILD_TYPE=Release \
                -DXQUIC_BUILD_DIR="$PWD/third_party/xquic/build"
          cmake --build build -j"$(nproc)"
      - name: E2E tests (ctest, with NET_ADMIN)
        run: ctest --test-dir build -V
      - name: Upload e2e logs on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: perf-e2e-logs
          path: /tmp/mqproxy_e2e_*
          if-no-files-found: ignore

  h3-curl:
    # OPTIONAL / NON-BLOCKING h3-libcurl build (Phase 6 origin-protocol h3).
    # Builds ngtcp2 + nghttp3 + libcurl on the pinned BoringSSL via
    # scripts/build-h3-curl.sh, then builds + tests mqproxy linked against it
    # (-DMQPROXY_H3_CURL). This is heavy (clones + compiles a QUIC+TLS+curl
    # stack) and version-pin-sensitive (ngtcp2 vs BoringSSL QUIC-API), so it
    # runs ONLY on manual dispatch and is continue-on-error: it must never block
    # the default-build CI. The DEFAULT mqproxy build does NOT use this.
    if: github.event_name == 'workflow_dispatch'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    continue-on-error: true
    steps:
      - uses: actions/checkout@v6
        with:
          submodules: recursive
      - name: Install dependencies
        run: sudo apt-get update && sudo apt-get install -y cmake libevent-dev libnghttp2-dev golang pkg-config
      - name: Compute xquic SHA
        id: xqsha
        run: echo "sha=$(git submodule status third_party/xquic | awk '{print $1}' | tr -d '+-')" >> "$GITHUB_OUTPUT"

      - name: Cache BoringSSL (gcc fPIC)
        id: bssl-cache
        uses: actions/cache@v5
        with:
          path: third_party/xquic/third_party/boringssl
          key: bssl-9c95ec7-linux-gcc-fpic-v1
      - name: Clone + build BoringSSL (pinned)
        if: steps.bssl-cache.outputs.cache-hit != 'true'
        run: |
          git clone https://github.com/google/boringssl.git third_party/xquic/third_party/boringssl
          cd third_party/xquic/third_party/boringssl
          git checkout 9c95ec797c65fde9e8ddffc3888f0b8c1460fe4c
          mkdir -p build && cd build
          cmake -DBUILD_SHARED_LIBS=0 -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC" ..
          make -j"$(nproc)" ssl crypto

      - name: Cache xquic (gcc Release, EVENT_LOG)
        id: xquic-cache
        uses: actions/cache@v5
        with:
          path: |
            third_party/xquic/build
            third_party/xquic/include/xquic/xqc_configure.h
          key: xquic-${{ steps.xqsha.outputs.sha }}-linux-gcc-release-eventlog-bssl-9c95ec7-v1
      - name: Build xquic
        if: steps.xquic-cache.outputs.cache-hit != 'true'
        run: |
          cd third_party/xquic
          mkdir -p build && cd build
          cmake -DCMAKE_BUILD_TYPE=Release -DSSL_TYPE=boringssl \
                -DXQC_ENABLE_EVENT_LOG=ON \
                -DXQC_ENABLE_BBR2=ON -DXQC_ENABLE_UNLIMITED=ON \
                -DXQC_ENABLE_FEC=ON -DXQC_ENABLE_XOR=ON \
                -DCMAKE_C_FLAGS="-Wno-dangling-pointer" ..
          make -j"$(nproc)"

      - name: Build h3-libcurl (ngtcp2 + nghttp3 + curl on BoringSSL)
        run: scripts/build-h3-curl.sh

      - name: Build mqproxy (MQPROXY_H3_CURL)
        run: |
          cmake -S . -B build-h3 -DCMAKE_BUILD_TYPE=Release \
                -DXQUIC_BUILD_DIR="$PWD/third_party/xquic/build" \
                -DMQPROXY_H3_CURL="$PWD/third_party/h3-curl/install"
          cmake --build build-h3 -j"$(nproc)"
      - name: Verify RPATH resolves the vendored libcurl
        run: |
          bin="$(find build-h3 -type f -name mqproxy | head -1)"
          echo "binary: $bin"
          readelf -d "$bin" | grep -iE 'r(un)?path' || { echo "no RPATH/RUNPATH"; exit 1; }
          readelf -d "$bin" | grep -iE 'r(un)?path' | grep -q "third_party/h3-curl/install/lib" \
            || { echo "vendored libcurl dir NOT in RPATH"; exit 1; }
      - name: Unit tests (ctest)
        run: ctest --test-dir build-h3 --output-on-failure

  fuzz:
    # libFuzzer harnesses over the wire/ingress parse surface. Self-contained:
    # the parsers depend only on libc, so NO submodules / NO boringssl+xquic
    # build / NO cache are needed (see fuzz/CMakeLists.txt).
    runs-on: ubuntu-latest
    timeout-minutes: 20
    env:
      FUZZ_SECONDS: 30   # per-target exploration budget (tune here)
    steps:
      - uses: actions/checkout@v6
        # no submodules: fuzz harnesses compile only src/wire + src/ingress
      - name: Install clang
        run: sudo apt-get update && sudo apt-get install -y clang cmake
      - name: Configure + build harnesses
        run: |
          cmake -S fuzz -B build-fuzz -DCMAKE_C_COMPILER=clang
          cmake --build build-fuzz -j"$(nproc)"
      - name: Replay committed corpus (deterministic gate)
        run: |
          set -e
          for t in build-fuzz/fuzz_*; do
            name=$(basename "$t"); dir="fuzz/corpus/${name#fuzz_}"
            if [ -d "$dir" ] && [ -n "$(ls -A "$dir" 2>/dev/null)" ]; then
              echo "== replay $name =="; "$t" "$dir"/*
            else
              echo "== $name: no corpus, skipping replay =="
            fi
          done
      - name: Short exploration (best-effort, fails on any new crash)
        run: |
          set -e
          for t in build-fuzz/fuzz_*; do
            name=$(basename "$t"); dir="fuzz/corpus/${name#fuzz_}"; mkdir -p "$dir"
            echo "== explore $name (${FUZZ_SECONDS}s) =="
            "$t" "$dir" -max_total_time="${FUZZ_SECONDS}" -print_final_stats=1
          done
      - name: Upload crashes on failure
        if: failure()
        uses: actions/upload-artifact@v4
        with:
          name: fuzz-crashes
          path: |
            crash-*
            leak-*
            timeout-*
            oom-*
          if-no-files-found: ignore