mirror of
https://github.com/Runnin4ik/dpi-detector.git
synced 2026-10-20 02:51:27 +00:00
5e83c885f7
The provider was the one reason the tree vendored a second fork: rustls's `ring` provider is C and assembly, and Rule 1 forbade that. The measurement in `docs/PROFILES_AND_PROVIDER.md` settled it — the rule is gone, the provider is `ring`: * on the router the C provider is faster than the pure-Rust stack on the crypto-heavy test (19.8 s against 32.6 s) and no larger (the mipsel artifact is 5 140 576 B against 5 181 324 B); * the base-form ClientHello moves — 19 of 105 endpoints in test 1 take a different path — which is what that document records, and what the fingerprint profiles exist to control; * `ring` does build for the router targets: the MIPS images carry a GCC toolchain (the unwinder alias step already called it), and the generic C path is what the missing MIPS assembly falls back to. Measured with `cross`. What went with it: `vendor/rustls-rustcrypto/` and `net/x25519.rs` (`ring` rejects a low-order X25519 peer key itself), the `policy` job's `cargo tree` ban list and the 6 MiB size step in `check.yml`, and the two `advisories` ignores in `deny.toml` — `rsa` and `paste` left the graph with the provider. Rule 1 is retired rather than renumbered: the numbers are quoted from code comments and CI, so Rule 2 keeps its name and only the ceiling inside it is gone; size and RSS stay measured, in `docs/OPTIMIZATIONS.md`. The release matrix names its profile per row now: `release-router` (`-Oz`, fat LTO, one codegen unit, `package.ring` at O3) for armv7/mipsel/mips, `release` (O3, thin LTO, 16 cgu) for the rest. The desktop artifact grows to 6 955 520 B and the relink to 53 s; `release-local` stays the edit-to-run loop (1.58 s, 6 157 312 B, and smaller than `release`). Verified: `cargo test --workspace --locked` (280 + 88, 0 failed), `cargo clippy --workspace --all-targets -- -D warnings`, a `cross` build of the mipsel row under `release-router`, and a live `--tests 2` run of that binary (35 domains, tls12/tls13 ok on all but one network timeout). |
||
|---|---|---|
| .. | ||
| diag | ||
| fingerprint | ||
| quinn-stand | ||