chore(deps): update rust crate icmp-socket2 to v0.6.4

Reviewed-on: #76

.gitea/workflows/ci.yml

@@ -0,0 +1,110 @@
+name: Rust CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  fmt:
+    name: cargo fmt
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
+        with:
+          components: rustfmt
+          cache: false
+      - name: Check formatting
+        run: cargo fmt --all -- --check
+
+  clippy:
+    name: cargo clippy
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
+        with:
+          components: clippy
+          cache: false
+      - name: Run clippy with all features
+        run: cargo clippy --workspace --all-targets --all-features --locked -- -D warnings
+      - name: Run clippy without default features
+        run: cargo clippy --workspace --all-targets --no-default-features --features toml --locked -- -D warnings
+
+  verify:
+    name: cargo ${{ matrix.task }} (${{ matrix.target }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - task: check
+            target: x86_64-unknown-linux-gnu
+            musl: false
+          - task: test
+            target: x86_64-unknown-linux-gnu
+            musl: false
+          - task: check
+            target: x86_64-unknown-linux-musl
+            musl: true
+          - task: test
+            target: x86_64-unknown-linux-musl
+            musl: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install musl toolchain
+        if: matrix.musl
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends musl-tools
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
+        with:
+          target: ${{ matrix.target }}
+          cache: false
+      - name: Run ${{ matrix.task }} with all features
+        run: cargo ${{ matrix.task }} --workspace --all-targets --all-features --target ${{ matrix.target }} --locked
+      - name: Run ${{ matrix.task }} without default features
+        run: cargo ${{ matrix.task }} --workspace --all-targets --no-default-features --features toml --target ${{ matrix.target }} --locked
+
+  docs:
+    name: cargo doc
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      RUSTDOCFLAGS: -D warnings
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
+        with:
+          cache: false
+      - name: Check documentation
+        run: cargo doc --workspace --all-features --no-deps --locked
+      - name: Run doctests
+        run: cargo test --workspace --doc --all-features --locked

.gitea/workflows/supply-chain.yml

@@ -0,0 +1,63 @@
+name: Supply chain
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: "41 2 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  ACTIONLINT_VERSION: 1.7.7
+  CARGO_DENY_VERSION: 0.20.2
+
+jobs:
+  cargo-deny:
+    name: cargo-deny ${{ matrix.checks }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - checks: advisories
+            continue-on-error: true
+          - checks: bans licenses sources
+            continue-on-error: false
+    continue-on-error: ${{ matrix.continue-on-error }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install cargo-deny
+        run: cargo install cargo-deny --version "${CARGO_DENY_VERSION}" --locked
+      - name: Run cargo-deny
+        run: cargo deny --manifest-path Cargo.toml --all-features check ${{ matrix.checks }}
+
+  actionlint:
+    name: actionlint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install actionlint
+        run: go install "github.com/rhysd/actionlint/cmd/actionlint@v${ACTIONLINT_VERSION}"
+      - name: Check workflow syntax
+        run: |
+          "$(go env GOPATH)/bin/actionlint" \
+            .gitea/workflows/ci.yml \
+            .gitea/workflows/supply-chain.yml \
+            .github/workflows/actions-security.yml \
+            .github/workflows/ci-arm.yml \
+            .github/workflows/devskim.yml \
+            .github/workflows/osv-scanner.yml \
+            .github/workflows/rust-clippy.yml

.github/workflows/actions-security.yml

@@ -0,0 +1,35 @@
+name: GitHub Actions Security
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  schedule:
+    - cron: "11 3 * * 1"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      actions: read
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          persona: regular
+          inputs: |
+            .github/workflows
+            .gitea/workflows

.github/workflows/build.yml

@@ -1,22 +0,0 @@
-name: Build
-
-on:
-  push:
-    branches: [ "master" ]
-  pull_request:
-    branches: [ "master" ]
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    steps:
-    - uses: actions/checkout@v7
-    - name: Install Mold
-      run: sudo apt install mold
-    - name: Build
-      run: cargo build --verbose

.github/workflows/ci-arm.yml

@@ -0,0 +1,55 @@
+name: Rust ARM CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  verify:
+    name: cargo ${{ matrix.task }} (${{ matrix.target }})
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - task: check
+            target: aarch64-unknown-linux-gnu
+            musl: false
+          - task: test
+            target: aarch64-unknown-linux-gnu
+            musl: false
+          - task: check
+            target: aarch64-unknown-linux-musl
+            musl: true
+          - task: test
+            target: aarch64-unknown-linux-musl
+            musl: true
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Install musl toolchain
+        if: matrix.musl
+        run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends musl-tools
+      - name: Install Rust toolchain
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
+        with:
+          target: ${{ matrix.target }}
+          cache: false
+      - name: Run ${{ matrix.task }} with all features
+        run: cargo ${{ matrix.task }} --workspace --all-targets --all-features --target ${{ matrix.target }} --locked
+      - name: Run ${{ matrix.task }} without default features
+        run: cargo ${{ matrix.task }} --workspace --all-targets --no-default-features --features toml --target ${{ matrix.target }} --locked

.github/workflows/devskim.yml

@@ -1,33 +1,29 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
+# This workflow uploads SARIF results to GitHub Code Scanning.
 name: DevSkim
 
 on:
   push:
-    branches: [ "master" ]
+    branches: [master]
   pull_request:
-    branches: [ "master" ]
+    branches: [master]
   schedule:
     - cron: '18 0 * * 4'
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: DevSkim
     runs-on: ubuntu-latest
     permissions:
-      actions: read
       contents: read
       security-events: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
-
       - name: Run DevSkim scanner
         uses: microsoft/DevSkim-Action@v1
-
       - name: Upload DevSkim scan results to GitHub Security tab
         uses: github/codeql-action/upload-sarif@v4
         with:

.github/workflows/osv-scanner.yml

@@ -1,55 +1,34 @@
 # Copyright 2023 Google LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+# Licensed under the Apache License, Version 2.0.
 
-name: OSV-Scanner Scheduled Scan
+name: OSV-Scanner
 
 on:
   pull_request:
-    branches: ["master", "v1"]
+    branches: [master, v1]
   schedule:
     - cron: "12 12 * * 1"
   push:
-    branches: ["master", "v1"]
+    branches: [master, v1]
 
-# Restrict jobs in this workflow to have no permissions by default; permissions
-# should be granted per job as needed using a dedicated `permissions` block
 permissions: {}
 
 jobs:
   scan-scheduled:
     permissions:
-      contents: read # to fetch code (actions/checkout)
-      security-events: write # for uploading SARIF files
+      contents: read
+      security-events: write
       actions: read
     if: ${{ github.event_name == 'push' || github.event_name == 'schedule' }}
-    # If you want to copy this config, highly suggest pinning this version to a release rather than tracking the main branch
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.5.0"
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.6.0
     with:
-      # Just scan the root directory and docs, since everything else is fixtures
-      scan-args: |-
-        ./
-        ./docs/
+      scan-args: ./
   scan-pr:
     permissions:
-      contents: read # to fetch code (actions/checkout)
-      security-events: write # for uploading SARIF files
+      contents: read
+      security-events: write
       actions: read
     if: ${{ github.event_name == 'pull_request' || github.event_name == 'merge_group' }}
-    # If you want to copy this config, highly suggest pinning this version to a release rather than tracking the main branch
-    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.5.0"
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.6.0
     with:
-      # Just scan the root directory and docs, since everything else is fixtures
-      scan-args: |-
-        ./
-        ./docs/
+      scan-args: ./

.github/workflows/rust-clippy.yml

@@ -1,55 +1,61 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-# rust-clippy is a tool that runs a bunch of lints to catch common
-# mistakes in your Rust code and help improve your Rust code.
-# More details at https://github.com/rust-lang/rust-clippy
-# and https://rust-lang.github.io/rust-clippy/
-
-name: rust-clippy analyze
+name: Clippy SARIF
 
 on:
   push:
-    branches: [ "master" ]
-  pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ "master" ]
+    branches: [master]
   schedule:
-    - cron: '28 20 * * 3'
+    - cron: "17 12 * * 4"
+  workflow_dispatch:
 
-jobs:
-  rust-clippy-analyze:
-    name: Run rust-clippy analyzing
-    runs-on: ubuntu-latest
-    permissions:
+permissions:
   contents: read
   security-events: write
-      actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
+  actions: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  clippy-sarif:
+    name: Clippy SARIF
+    runs-on: ubuntu-latest
+    timeout-minutes: 25
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v7
-
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af #@v1
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2
         with:
-          profile: minimal
-          toolchain: stable
           components: clippy
-          override: true
-
-      - name: Install required cargo
-        run: cargo install clippy-sarif sarif-fmt
-
-      - name: Run rust-clippy
-        run:
-          cargo clippy
-          --all-features
-          --message-format=json | clippy-sarif | tee rust-clippy-results.sarif | sarif-fmt
-        continue-on-error: true
-
-      - name: Upload analysis results to GitHub
-        uses: github/codeql-action/upload-sarif@v4
+          cache: false
+      - name: Install SARIF tools
+        run: cargo install --locked clippy-sarif sarif-fmt
+      - name: Run Clippy and generate SARIF
+        id: clippy
+        shell: bash
+        run: |
+          set +e
+          cargo clippy \
+            --workspace \
+            --all-targets \
+            --all-features \
+            --locked \
+            --message-format=json \
+            | clippy-sarif \
+            | tee rust-clippy-results.sarif \
+            | sarif-fmt
+          clippy_status=${PIPESTATUS[0]}
+          echo "exit_code=${clippy_status}" >> "$GITHUB_OUTPUT"
+          exit 0
+      - name: Upload Clippy SARIF
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        if: always()
         with:
           sarif_file: rust-clippy-results.sarif
+          category: clippy
           wait-for-processing: true
+      - name: Fail if Clippy failed
+        if: steps.clippy.outputs.exit_code != '0'
+        run: exit 1

Cargo.lock

@@ -17,6 +17,12 @@ version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
+[[package]]
+name = "autocfg"
+version = "1.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
+
 [[package]]
 name = "bindgen"
 version = "0.72.1"
@@ -74,6 +80,12 @@ version = "1.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"
 
+[[package]]
+name = "cfg_aliases"
+version = "0.2.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f079e83a288787bcd14a6aea84cee5c87a67c5a3e660c30f557a3d24761b3527"
+
 [[package]]
 name = "clang-sys"
 version = "1.8.1"
@@ -96,9 +108,9 @@ dependencies = [
 
 [[package]]
 name = "config"
-version = "0.15.25"
+version = "0.15.26"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b85f248a4de22d204ceabc6299d89d2c70fbd7f09fea53c06c852369652d8139"
+checksum = "790374c727a4cb20877dd2cc99ce7011cbe03b0b8df083acccd37df0d161304d"
 dependencies = [
  "pathdiff",
  "serde_core",
@@ -201,11 +213,13 @@ checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
 
 [[package]]
 name = "icmp-socket2"
-version = "0.6.0"
+version = "0.6.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86fc005b72eb9dbc1df87318cf906a415d4f4c0d5eea42849b29dd710cdf670d"
+checksum = "816dc56a4f7f76e42b0616818600b05528cd346cb3843276e82df982d5c3ee26"
 dependencies = [
+ "nix",
  "socket2",
+ "thiserror",
 ]
 
 [[package]]
@@ -286,20 +300,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.33"
+version = "0.4.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
-
-[[package]]
-name = "maybe-async"
-version = "0.2.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "746873a384ad60adc5db74471dfaba74bd278afbdcfd81db93fafcdfc8b5ca0c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
+checksum = "f9f8bd3e56ce4dfc153cf470fffbfa98c7620958b312ca5c3a4b8d5181fd13c6"
 
 [[package]]
 name = "memchr"
@@ -307,6 +310,15 @@ version = "2.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
 
+[[package]]
+name = "memoffset"
+version = "0.9.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "488016bfae457b036d996092f6cb448677611ce4449e970ceaf42695203f218a"
+dependencies = [
+ "autocfg",
+]
+
 [[package]]
 name = "minimal-lexical"
 version = "0.2.1"
@@ -315,19 +327,32 @@ checksum = "68354c5c6bd36d73ff3feceb05efa59b6acb7626617f4962be322a825e61f79a"
 
 [[package]]
 name = "netlink-bindings"
-version = "0.3.3"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "114816d03a633cef7cfa951721dafbda16bb1ff6af83393ee568ec2d4e4ded2d"
+checksum = "15c68f271f059945bc6fb55d210e78c1ceb2d3eac00d18fe9b0806ade81e8a21"
 
 [[package]]
 name = "netlink-socket2"
-version = "0.3.3"
+version = "0.3.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "11193969f046efafdc9d8670d395a6ddcf9b806169f504e520a35dc95cab3241"
+checksum = "0951d4d6a5131a59af90a26fcecd4e366e8fcee3a38880ba58705e479f5bd8c3"
 dependencies = [
  "libc",
- "maybe-async",
  "netlink-bindings",
+ "strip-async",
+]
+
+[[package]]
+name = "nix"
+version = "0.31.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d"
+dependencies = [
+ "bitflags",
+ "cfg-if",
+ "cfg_aliases",
+ "libc",
+ "memoffset",
 ]
 
 [[package]]
@@ -434,9 +459,9 @@ checksum = "6b1e7f9a428571be2dc5bc0505c13fb6bf936822b894ec87abf8a08a4e51742d"
 
 [[package]]
 name = "rustix"
-version = "1.1.4"
+version = "1.1.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6fe4565b9518b83ef4f91bb47ce29620ca828bd32cb7e408f0062e9930ba190"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
 dependencies = [
  "bitflags",
  "errno",
@@ -490,7 +515,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -563,11 +588,16 @@ dependencies = [
  "rust-uci",
  "rustix",
  "serde",
- "serde_json",
  "thiserror",
  "uci-derive",
 ]
 
+[[package]]
+name = "strip-async"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "85ec932792e62b2d3936163eacbd2e09984453bcd114f665c1e1694e36ff59c9"
+
 [[package]]
 name = "syn"
 version = "2.0.119"
@@ -581,9 +611,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.3"
+version = "3.0.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -591,10 +621,10 @@ dependencies = [
 ]
 
 [[package]]
-name = "target-triple"
-version = "1.0.1"
+name = "target-tuple"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3a6bfce3d99adfa72d24750a61f782f3036a81e7f86d8841ee1326deaebd171"
+checksum = "876fef147edbcbddc8ac5cbbba92c7b86519e314e86638596c09673b2ed01e7f"
 
 [[package]]
 name = "termcolor"
@@ -607,22 +637,22 @@ dependencies = [
 
 [[package]]
 name = "thiserror"
-version = "2.0.19"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09a43598840e33d5b0331f38c5e30d13bb11c11210a4b58f0d9b18a5a5eefcd9"
+checksum = "09e52cb86a36cede5cb101bf8908837b3e4c6e5e59fe7fd85c23fb56200d189e"
 dependencies = [
  "thiserror-impl",
 ]
 
 [[package]]
 name = "thiserror-impl"
-version = "2.0.19"
+version = "2.0.21"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43cbfe0cf76104d42a574802844187e84a305e531ed54455f11fbde0f10541cd"
+checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
 ]
 
 [[package]]
@@ -666,15 +696,15 @@ checksum = "7d56353a2a665ad0f41a421187180aab746c8c325620617ad883a99a1cbe66d2"
 
 [[package]]
 name = "trybuild"
-version = "1.0.120"
+version = "1.0.121"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1e605bf6b39357663d8ba4e984f8be8da8df6bb32e81031d6889024ea8fd68e4"
+checksum = "c0cabaa10be1917331a313866bd94526343e03c77bcf69144b62b072ad35d47c"
 dependencies = [
  "glob",
  "serde",
  "serde_derive",
  "serde_json",
- "target-triple",
+ "target-tuple",
  "termcolor",
  "toml",
 ]
@@ -685,7 +715,7 @@ version = "0.1.0"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.6",
  "trybuild",
 ]
 

Cargo.toml

@@ -20,7 +20,7 @@ strip = "symbols"
 
 [dependencies]
 anyhow = "1.0"
-icmp-socket2 = "0.6.0"
+icmp-socket2 = "0.6.2"
 fastrand = "2"
 rustix = { version = "1.1", features = ["fs", "system", "thread", "time"] }
 thiserror = "2.0"
@@ -29,7 +29,6 @@ flume = { version = "0.12.0",  default-features = false, features = ["eventual-f
 config = { version = "0.15.25", default-features = false }
 csv = "1.4.0"
 serde = { version = "1", features = ["derive"] }
-serde_json = { version = "1", optional = true }
 uci-derive = { path = "crates/uci-derive" }
 
 [dependencies.log]
@@ -44,11 +43,10 @@ netlink-socket2 = { version = "0.3.3" }
 rust-uci = { git = "https://github.com/Lochnair/rust-uci.git", rev = "fcfedd204fb76928ef617bf9631b041c816e03d4", optional = true, default-features = false, }
 
 [features]
-default = ["toml", "trace", "uci-vendored"]
+default = ["toml", "uci-vendored"]
 toml = ["config/toml"]
 uci = ["dep:rust-uci"]
 uci-vendored = ["uci", "rust-uci/vendored"]
-trace = ["dep:serde_json"]
 
 [workspace]
 members = ["crates/uci-derive"]

README.md

@@ -10,14 +10,6 @@
 * **Configurable via environment or UCI**: reads settings from environment variables or OpenWRT UCI, with sensible defaults and type‑safe parsing .
 * **Minimal dependencies**: relies on Rust crates only (anyhow, socket2, neli, rustix), no external scripts .
 
-## Legacy control trace v1
-
-The additive legacy characterization recorder is excluded from default builds. Build with
-`--features trace` and set `SQMA_TRACE_V1_PATH` to a JSON Lines output path to enable it at
-runtime. The format is versioned as trace v1 and is intended only for replaying the current
-baseliner and rate-controller boundary during the `SqmControlLaw` extraction; it is not the
-final runtime event schema. Existing CSV and metrics outputs remain unchanged.
-
 ## Installation
 
 You can install **sqm‑autorate‑rust** in two ways:

deny.toml

@@ -0,0 +1,50 @@
+# cargo-deny policy for sqm-autorate-rust.
+# Keep published dependency sources and license terms explicit while allowing
+# advisory reports to be reviewed without blocking unrelated changes.
+
+[graph]
+all-features = true
+no-default-features = false
+targets = []
+
+[output]
+feature-depth = 1
+
+[advisories]
+yanked = "deny"
+unmaintained = "workspace"
+unsound = "workspace"
+ignore = []
+
+[licenses]
+confidence-threshold = 0.8
+allow = [
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "CC0-1.0",
+    "ISC",
+    "MIT",
+    "MPL-2.0",
+    "Unicode-3.0",
+    "Zlib",
+]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+highlight = "all"
+workspace-default-features = "allow"
+external-default-features = "allow"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+required-git-spec = "rev"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = ["https://github.com/Lochnair/rust-uci"]
+
+[sources.allow-org]
+github = []
+gitlab = []
+bitbucket = []

renovate.json

@@ -2,5 +2,18 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended"
+  ],
+  "packageRules": [
+    {
+      "description": "Keep netlink-bindings and netlink-socket2 updates together",
+      "matchManagers": [
+        "cargo"
+      ],
+      "matchPackageNames": [
+        "netlink-bindings",
+        "netlink-socket2"
+      ],
+      "groupName": "netlink dependencies"
+    }
   ]
 }

src/baseliner.rs

@@ -9,7 +9,6 @@ use crate::SHUTDOWN;
 use crate::metrics::{Metric, MetricsSender};
 use crate::pinger::PingReply;
 use crate::settings::Settings;
-use crate::trace::{Recorder, v1};
 use flume::{Receiver, Sender};
 use log::{debug, info};
 use std::collections::HashMap;
@@ -79,7 +78,6 @@ pub struct Baseliner {
     pub selection_tx: Option<Sender<ControlSnapshot>>,
     pub baseline_metrics: MetricsSender,
     pub event_metrics: MetricsSender,
-    pub trace: Recorder,
 }
 
 fn ewma_factor(tick: f64, dur: f64) -> f64 {
@@ -209,23 +207,10 @@ impl Baseliner {
             );
 
             let snapshot = control_snapshot(&reflectors, Instant::now());
-            self.trace.linearize(|trace| {
-                if trace.is_enabled() {
-                    trace.record_at(
-                        reply.last_receive_time_s,
-                        v1::Event::PingReply {
-                            reflector: reply.reflector,
-                            down_time_ms: reply.down_time,
-                            up_time_ms: reply.up_time,
-                        },
-                    );
-                }
-
             if let Some(selection_tx) = &self.selection_tx {
                 let _ = selection_tx.send(snapshot.clone());
             }
-                self.control_tx.send(snapshot)
-            })?;
+            self.control_tx.send(snapshot)?;
         }
     }
 }

src/log.rs

@@ -2,7 +2,7 @@
 //
 // SPDX-License-Identifier: MPL-2.0
 
-use log::{Level, LevelFilter, Metadata, Record, SetLoggerError};
+use log::{Level, Metadata, Record, SetLoggerError};
 use rustix::time::ClockId;
 
 use crate::time::Time;
@@ -36,5 +36,5 @@ impl log::Log for SimpleLogger {
 
 pub fn init(level: Level) -> Result<(), SetLoggerError> {
     log::set_boxed_logger(Box::new(SimpleLogger { level }))
-        .map(|()| log::set_max_level(LevelFilter::Trace))
+        .map(|()| log::set_max_level(level.to_level_filter()))
 }

src/main.rs

@@ -18,7 +18,6 @@ mod ratecontroller;
 mod reflector_selector;
 mod settings;
 mod time;
-mod trace;
 mod util;
 
 use crate::baseliner::Baseliner;
@@ -31,7 +30,7 @@ use crate::ratecontroller::Ratecontroller;
 use crate::reflector_selector::ReflectorSelector;
 use crate::settings::MeasurementType;
 use crate::settings::Settings;
-use ::log::{debug, info, warn};
+use ::log::{info, warn};
 use flume::RecvTimeoutError;
 use std::collections::HashMap;
 use std::net::IpAddr;
@@ -244,7 +243,6 @@ fn run(settings: &Settings) -> anyhow::Result<()> {
     }
 
     let start_time = Instant::now();
-    let trace = trace::Recorder::from_env(start_time, settings);
     let probe_id = probe_identifier();
 
     let ReflectorSetup {
@@ -336,7 +334,6 @@ fn run(settings: &Settings) -> anyhow::Result<()> {
         selection_tx: selection_snapshot_tx,
         baseline_metrics,
         event_metrics: event_metrics.clone(),
-        trace: trace.clone(),
     };
 
     let mut main_traffic_control = traffic_control_backend();
@@ -420,7 +417,6 @@ fn run(settings: &Settings) -> anyhow::Result<()> {
         reflector_peers,
         reselect_tx,
         rate_metrics,
-        trace.clone(),
     )?;
 
     let err_tx = error_tx.clone();
@@ -464,8 +460,6 @@ fn run(settings: &Settings) -> anyhow::Result<()> {
         &up_shaper,
     );
 
-    trace.finish();
-
     result
 }
 

src/pinger_icmp_ts.rs

@@ -19,6 +19,19 @@ pub struct PingerICMPTimestampListener {}
 
 pub struct PingerICMPTimestampSender {}
 
+const MS_PER_DAY: i64 = 86_400_000;
+
+fn timestamp_delta(later: i64, earlier: i64) -> i64 {
+    let delta = later - earlier;
+    if delta < -MS_PER_DAY / 2 {
+        delta + MS_PER_DAY
+    } else if delta > MS_PER_DAY / 2 {
+        delta - MS_PER_DAY
+    } else {
+        delta
+    }
+}
+
 impl PingListener for PingerICMPTimestampListener {
     // Result: RTT, down time, up time
     fn parse_packet(
@@ -46,12 +59,18 @@ impl PingListener for PingerICMPTimestampListener {
                         });
                     }
 
-                    let time_now = Time::new(ClockId::Realtime);
-                    let time_since_midnight = time_now.get_time_since_midnight();
+                    if receive & 0x8000_0000 != 0 || transmit & 0x8000_0000 != 0 {
+                        return Err(PingError::InvalidPacket(
+                            "non-standard RFC 792 timestamp".into(),
+                        ));
+                    }
 
-                    let rtt = (time_since_midnight - originate as i64) as f64;
-                    let dl_time = (time_since_midnight - transmit as i64) as f64;
-                    let ul_time = (receive as i64 - originate as i64) as f64;
+                    let time_since_midnight =
+                        Time::new(ClockId::Realtime).get_time_since_midnight();
+
+                    let rtt = timestamp_delta(time_since_midnight, originate as i64) as f64;
+                    let dl_time = timestamp_delta(time_since_midnight, transmit as i64) as f64;
+                    let ul_time = timestamp_delta(receive as i64, originate as i64) as f64;
 
                     Ok(PingReply {
                         reflector,
@@ -88,3 +107,27 @@ impl PingSender for PingerICMPTimestampSender {
         )
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use icmp_socket2::packet::WithTimestampReply;
+
+    #[test]
+    fn timestamps_wrap_at_midnight_in_both_directions() {
+        assert_eq!(timestamp_delta(20, 86_399_900), 120);
+        assert_eq!(timestamp_delta(86_399_900, 20), -120);
+    }
+
+    #[test]
+    fn non_standard_rfc_792_timestamps_are_rejected() {
+        let packet = Icmpv4Packet::with_timestamp_reply(7, 1, 10, 0x8000_0001, 20).unwrap();
+        let result = PingerICMPTimestampListener {}.parse_packet(
+            7,
+            "192.0.2.1".parse().unwrap(),
+            MeasurementType::IcmpTimestamps,
+            packet,
+        );
+        assert!(matches!(result, Err(PingError::InvalidPacket(_))));
+    }
+}

src/platform/unix/uci.rs

@@ -262,7 +262,7 @@ impl Source for UciSource {
         let (_uci, packages) = match resolved {
             Ok(resolved) => resolved,
 
-            Err(_) if !self.required => {
+            Err(SourceError::NotFound(_)) if !self.required => {
                 return Ok(Map::new());
             }
 
@@ -285,3 +285,29 @@ impl Source for UciSource {
         Ok(values)
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::settings::Settings;
+    use std::fs;
+
+    #[test]
+    fn malformed_optional_package_is_an_error() {
+        let root = std::env::temp_dir().join(format!("sqma-uci-{}", std::process::id()));
+        let config_dir = root.join("config");
+        let save_dir = root.join("save");
+        fs::create_dir_all(&config_dir).unwrap();
+        fs::create_dir_all(&save_dir).unwrap();
+        let config_file = config_dir.join("sqm-autorate-rust");
+        fs::write(&config_file, "config network 'unterminated\n").unwrap();
+
+        let source = UciSource::from_schema::<Settings>()
+            .with_directories(&config_dir, &save_dir)
+            .required(false);
+        let result = source.collect();
+
+        fs::remove_dir_all(root).unwrap();
+        assert!(result.is_err());
+    }
+}

src/ratecontroller.rs

@@ -14,7 +14,6 @@ use crate::platform::{
 };
 use crate::settings::Settings;
 use crate::time::Time;
-use crate::trace::{Recorder, v1};
 use crate::util::{ArcRwLock, RwLockExt};
 use flume::{Receiver, Sender};
 use log::{debug, info, warn};
@@ -146,11 +145,9 @@ pub struct Ratecontroller<S: InterfaceStatsProvider, T: TrafficControlBackend> {
     state_dl: State<T::Handle>,
     state_ul: State<T::Handle>,
     rng: fastrand::Rng,
-    next_evaluation_id: u64,
     stats_provider: S,
     traffic_control: T,
     metrics: MetricsSender,
-    trace: Recorder,
 }
 
 impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
@@ -163,7 +160,6 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
         mut stats_provider: S,
         mut traffic_control: T,
         mut rng: fastrand::Rng,
-        trace: Recorder,
     ) -> anyhow::Result<Self> {
         let dl_shaper =
             traffic_control.find_shaper(settings.network.download_interface.as_str())?;
@@ -182,7 +178,7 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
         let (cur_rx, cur_tx) =
             get_interface_stats(&mut stats_provider, &settings.network.upload_interface)?;
 
-        let controller = Self {
+        Ok(Self {
             settings,
             control_snapshot: None,
             control_snapshot_rx,
@@ -191,32 +187,10 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
             state_dl: State::new(dl_shaper, cur_rx, dl_safe_rates),
             state_ul: State::new(ul_shaper, cur_tx, ul_safe_rates),
             rng,
-            next_evaluation_id: 0,
             stats_provider,
             traffic_control,
             metrics,
-            trace,
-        };
-
-        if controller.trace.is_enabled() {
-            controller.trace.record_at(
-                Instant::now(),
-                v1::Event::ControllerInitialized {
-                    previous_rx_bytes: controller.state_dl.previous_bytes,
-                    previous_tx_bytes: controller.state_ul.previous_bytes,
-                    download_prev_mono_ns: controller
-                        .trace
-                        .monotonic_ns(controller.state_dl.prev_t),
-                    upload_prev_mono_ns: controller.trace.monotonic_ns(controller.state_ul.prev_t),
-                    download_history_index: controller.state_dl.nrate as u64,
-                    upload_history_index: controller.state_ul.nrate as u64,
-                    download_safe_rates_kbit: controller.state_dl.safe_rates.clone(),
-                    upload_safe_rates_kbit: controller.state_ul.safe_rates.clone(),
-                },
-            );
-        }
-
-        Ok(controller)
+        })
     }
 
     fn request_initial_rates(&mut self) -> anyhow::Result<()> {
@@ -224,20 +198,6 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
         self.state_dl.current_rate = self.settings.network.download_base_kbits * 0.6;
         self.state_ul.current_rate = self.settings.network.upload_base_kbits * 0.6;
 
-        if self.trace.is_enabled() {
-            self.trace.record_at(
-                Instant::now(),
-                v1::Event::RequestedRates {
-                    evaluation_id: None,
-                    reason: v1::RateRequestReason::Startup,
-                    download_kbit: self.state_dl.current_rate.round() as u64,
-                    upload_kbit: self.state_ul.current_rate.round() as u64,
-                    download_requested: true,
-                    upload_requested: true,
-                },
-            );
-        }
-
         self.traffic_control.set_rate(
             &self.state_dl.shaper,
             self.state_dl.current_rate.round() as u64,
@@ -252,8 +212,7 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
         Ok(())
     }
 
-    fn calculate_rate(&mut self, direction: Direction, evaluation_id: u64) -> anyhow::Result<()> {
-        let trace = self.trace.clone();
+    fn calculate_rate(&mut self, direction: Direction) -> anyhow::Result<()> {
         let (base_rate, delay_ms, min_rate, state) = if direction == Direction::Down {
             (
                 self.settings.network.download_base_kbits,
@@ -272,20 +231,6 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
 
         let now_t = Instant::now();
         let dur = now_t.duration_since(state.prev_t);
-        let trace_enabled = trace.is_enabled();
-        let trace_direction = match direction {
-            Direction::Down => v1::Direction::Download,
-            Direction::Up => v1::Direction::Upload,
-        };
-        if trace_enabled {
-            trace.record_at(
-                now_t,
-                v1::Event::RateCalculation {
-                    evaluation_id,
-                    direction: trace_direction,
-                },
-            );
-        }
 
         if !state.deltas.is_empty() {
             state.next_rate = state.current_rate;
@@ -324,20 +269,11 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
                 }
 
                 if state.delta_stat > delay_ms {
-                    let selected_index = self.rng.usize(..state.safe_rates.len());
-                    match state.safe_rates.get(selected_index) {
+                    match state
+                        .safe_rates
+                        .get(self.rng.usize(..state.safe_rates.len()))
+                    {
                         Some(rnd_rate) => {
-                            if trace_enabled {
-                                trace.record_at(
-                                    Instant::now(),
-                                    v1::Event::RandomSafeRateChoice {
-                                        evaluation_id,
-                                        direction: trace_direction,
-                                        index: selected_index as u64,
-                                        rate_kbit: *rnd_rate,
-                                    },
-                                );
-                            }
                             state.next_rate = rnd_rate.min(0.9 * state.current_rate * state.load);
                         }
                         None => {
@@ -413,9 +349,7 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
                     &mut self.stats_provider,
                     &self.settings.network.upload_interface,
                 )?;
-                let evaluation_id = self.next_evaluation_id;
-                self.next_evaluation_id = self.next_evaluation_id.wrapping_add(1);
-                self.update_deltas(evaluation_id, now_t)?;
+                self.update_deltas()?;
 
                 if self.state_dl.deltas.is_empty() || self.state_ul.deltas.is_empty() {
                     warn!("No reflector data available, dropping to minimum rates");
@@ -428,20 +362,6 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
                     self.state_dl.next_rate = self.settings.network.download_min_kbits();
                     self.state_ul.next_rate = self.settings.network.upload_min_kbits();
 
-                    if self.trace.is_enabled() {
-                        self.trace.record_at(
-                            Instant::now(),
-                            v1::Event::RequestedRates {
-                                evaluation_id: Some(evaluation_id),
-                                reason: v1::RateRequestReason::NoReflectorData,
-                                download_kbit: self.state_dl.next_rate as u64,
-                                upload_kbit: self.state_ul.next_rate as u64,
-                                download_requested: true,
-                                upload_requested: true,
-                            },
-                        );
-                    }
-
                     self.traffic_control.set_rate(
                         &self.state_dl.shaper,
                         self.state_dl.next_rate as u64,
@@ -458,24 +378,8 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
                     continue;
                 }
 
-                self.calculate_rate(Direction::Down, evaluation_id)?;
-                self.calculate_rate(Direction::Up, evaluation_id)?;
-
-                if self.trace.is_enabled() {
-                    let download_requested = self.state_dl.next_rate != self.state_dl.current_rate;
-                    let upload_requested = self.state_ul.next_rate != self.state_ul.current_rate;
-                    self.trace.record_at(
-                        Instant::now(),
-                        v1::Event::RequestedRates {
-                            evaluation_id: Some(evaluation_id),
-                            reason: v1::RateRequestReason::Control,
-                            download_kbit: self.state_dl.next_rate as u64,
-                            upload_kbit: self.state_ul.next_rate as u64,
-                            download_requested,
-                            upload_requested,
-                        },
-                    );
-                }
+                self.calculate_rate(Direction::Down)?;
+                self.calculate_rate(Direction::Up)?;
 
                 if self.state_dl.next_rate != self.state_dl.current_rate
                     || self.state_ul.next_rate != self.state_ul.current_rate
@@ -575,9 +479,7 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
         }
     }
 
-    fn update_deltas(&mut self, evaluation_id: u64, loop_time: Instant) -> anyhow::Result<()> {
-        let recorder = self.trace.clone();
-        recorder.linearize(|trace| -> anyhow::Result<()> {
+    fn update_deltas(&mut self) -> anyhow::Result<()> {
         drain_latest_snapshot(&self.control_snapshot_rx, &mut self.control_snapshot);
         let now_t = Instant::now();
         let reflectors = self.reflectors_lock.read_anyhow()?;
@@ -590,22 +492,6 @@ impl<S: InterfaceStatsProvider, T: TrafficControlBackend> Ratecontroller<S, T> {
         self.state_dl.deltas = down_deltas;
         self.state_ul.deltas = up_deltas;
 
-            if trace.is_enabled() {
-                trace.record_at(
-                    now_t,
-                    v1::Event::ControlEvaluation {
-                        evaluation_id,
-                        loop_mono_ns: self.trace.monotonic_ns(loop_time),
-                        rx_bytes: self.state_dl.current_bytes,
-                        tx_bytes: self.state_ul.current_bytes,
-                        active_reflectors: reflectors.clone(),
-                    },
-                );
-            }
-
-            Ok(())
-        })?;
-
         if self.state_dl.deltas.len() < 5 || self.state_ul.deltas.len() < 5 {
             // trigger reselection
             warn!(
@@ -627,7 +513,6 @@ impl Ratecontroller<PlatformInterfaceStats, PlatformTrafficControl> {
         reflectors_lock: ArcRwLock<Vec<IpAddr>>,
         reselect_trigger: Sender<bool>,
         metrics: MetricsSender,
-        trace: Recorder,
     ) -> anyhow::Result<Self> {
         Self::new_with_backends(
             settings,
@@ -638,7 +523,6 @@ impl Ratecontroller<PlatformInterfaceStats, PlatformTrafficControl> {
             interface_stats_provider(),
             traffic_control_backend(),
             fastrand::Rng::new(),
-            trace,
         )
     }
 }

src/settings/mod.rs

@@ -192,7 +192,10 @@ impl Settings {
             })?;
 
             match (record.ip_version, record.reflector_ip) {
-                (4, IpAddr::V4(_)) | (6, IpAddr::V6(_)) => {}
+                (4, IpAddr::V4(_)) => {}
+                (6, address @ IpAddr::V6(_)) => {
+                    bail!("reflector {address} is IPv6; only IPv4 reflectors are supported");
+                }
                 (version, address) => {
                     bail!("reflector {address} has inconsistent IP version {version}");
                 }

src/settings/validation.rs

@@ -153,7 +153,12 @@ impl NetworkSettings {
         if download_base_valid && download_percent_valid {
             let minimum = self.download_min_kbits();
 
-            if minimum < WARN_DOWNLOAD_MIN_KBITS {
+            if minimum < 1.0 {
+                report.error(
+                    "network.download_min_percent",
+                    "minimum download rate floors to zero",
+                );
+            } else if minimum < WARN_DOWNLOAD_MIN_KBITS {
                 report.warning(
                     "network.download_min_percent",
                     format!(
@@ -168,7 +173,12 @@ impl NetworkSettings {
         if upload_base_valid && upload_percent_valid {
             let minimum = self.upload_min_kbits();
 
-            if minimum < WARN_UPLOAD_MIN_KBITS {
+            if minimum < 1.0 {
+                report.error(
+                    "network.upload_min_percent",
+                    "minimum upload rate floors to zero",
+                );
+            } else if minimum < WARN_UPLOAD_MIN_KBITS {
                 report.warning(
                     "network.upload_min_percent",
                     format!(
@@ -376,3 +386,38 @@ fn validate_percent(report: &mut ValidationReport, path: &'static str, value: f6
         true
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn network(download_base_kbits: f64, upload_base_kbits: f64) -> NetworkSettings {
+        NetworkSettings {
+            download_interface: "ifb0".into(),
+            upload_interface: "eth0".into(),
+            download_base_kbits,
+            download_min_percent: 1.0,
+            upload_base_kbits,
+            upload_min_percent: 1.0,
+        }
+    }
+
+    #[test]
+    fn minimum_rates_that_floor_to_zero_are_errors_for_both_directions() {
+        let mut report = ValidationReport::default();
+        network(50.0, 50.0).validate(&mut report);
+        let error = report.finish().unwrap_err().to_string();
+
+        assert!(error.contains("network.download_min_percent"));
+        assert!(error.contains("network.upload_min_percent"));
+        assert!(error.contains("floors to zero"));
+    }
+
+    #[test]
+    fn representable_low_minimum_rates_remain_warnings() {
+        let mut report = ValidationReport::default();
+        network(10_000.0, 10_000.0).validate(&mut report);
+
+        assert!(report.finish().is_ok());
+    }
+}

src/trace/mod.rs

@@ -1,417 +0,0 @@
-// SPDX-FileCopyrightText: 2026-Present Nils Andreas Svee mailto:contact@lochnair.net (github @Lochnair)
-//
-// SPDX-License-Identifier: MPL-2.0
-
-pub(crate) mod v1;
-
-#[cfg(feature = "trace")]
-mod writer;
-
-use crate::settings::Settings;
-use std::time::Instant;
-
-#[cfg(feature = "trace")]
-use std::time::SystemTime;
-
-#[cfg(feature = "trace")]
-use flume::Sender;
-#[cfg(feature = "trace")]
-use log::warn;
-#[cfg(feature = "trace")]
-use std::fs::File;
-#[cfg(feature = "trace")]
-use std::io::{BufWriter, Write};
-#[cfg(feature = "trace")]
-use std::path::Path;
-#[cfg(feature = "trace")]
-use std::sync::atomic::{AtomicBool, Ordering};
-#[cfg(feature = "trace")]
-use std::sync::{Arc, Mutex};
-#[cfg(feature = "trace")]
-use std::thread::JoinHandle;
-
-const TRACE_PATH_ENV: &str = "SQMA_TRACE_V1_PATH";
-#[cfg(feature = "trace")]
-const QUEUE_CAPACITY: usize = 4_096;
-
-#[derive(Clone, Default)]
-pub(crate) struct Recorder {
-    #[cfg(feature = "trace")]
-    inner: Option<Arc<Inner>>,
-}
-
-#[cfg(feature = "trace")]
-struct Inner {
-    origin: Instant,
-    records: Sender<v1::Record>,
-    next_seq: Mutex<u64>,
-    healthy: Arc<AtomicBool>,
-    writer: Mutex<Option<JoinHandle<()>>>,
-}
-
-pub(crate) struct OrderedRecorder<'a> {
-    #[cfg(feature = "trace")]
-    inner: Option<&'a Inner>,
-    #[cfg(feature = "trace")]
-    next_seq: Option<&'a mut u64>,
-    #[cfg(not(feature = "trace"))]
-    marker: std::marker::PhantomData<&'a ()>,
-}
-
-impl Recorder {
-    pub(crate) fn from_env(origin: Instant, settings: &Settings) -> Self {
-        let Some(path) = std::env::var_os(TRACE_PATH_ENV) else {
-            return Self::disabled();
-        };
-
-        #[cfg(feature = "trace")]
-        {
-            let header = v1::Event::Header {
-                format: v1::FORMAT_NAME.to_owned(),
-                version: v1::FORMAT_VERSION,
-                program_version: env!("CARGO_PKG_VERSION").to_owned(),
-                control: v1::ControlConfig::from_settings(settings),
-            };
-            Self::start_path(Path::new(&path), origin, header)
-        }
-
-        #[cfg(not(feature = "trace"))]
-        {
-            let _ = (origin, settings, path);
-            log::warn!(
-                "{TRACE_PATH_ENV} is set, but this binary was built without the `trace` feature"
-            );
-            Self::disabled()
-        }
-    }
-
-    pub(crate) fn disabled() -> Self {
-        Self::default()
-    }
-
-    pub(crate) fn is_enabled(&self) -> bool {
-        #[cfg(feature = "trace")]
-        {
-            self.inner
-                .as_ref()
-                .is_some_and(|inner| inner.healthy.load(Ordering::Acquire))
-        }
-
-        #[cfg(not(feature = "trace"))]
-        {
-            false
-        }
-    }
-
-    pub(crate) fn monotonic_ns(&self, instant: Instant) -> u64 {
-        #[cfg(feature = "trace")]
-        {
-            self.inner
-                .as_ref()
-                .map_or(0, |inner| v1::monotonic_ns(inner.origin, instant))
-        }
-
-        #[cfg(not(feature = "trace"))]
-        {
-            let _ = instant;
-            0
-        }
-    }
-
-    pub(crate) fn record_at(&self, instant: Instant, event: v1::Event) -> Option<u64> {
-        self.linearize(|recorder| recorder.record_at(instant, event))
-    }
-
-    pub(crate) fn linearize<R>(&self, callback: impl FnOnce(&mut OrderedRecorder<'_>) -> R) -> R {
-        #[cfg(feature = "trace")]
-        {
-            if self
-                .inner
-                .as_ref()
-                .is_some_and(|inner| inner.healthy.load(Ordering::Acquire))
-            {
-                let inner = self
-                    .inner
-                    .as_ref()
-                    .expect("healthy trace recorder must have inner state");
-                match inner.next_seq.lock() {
-                    Ok(mut next_seq) => {
-                        if inner.healthy.load(Ordering::Acquire) {
-                            let mut recorder = OrderedRecorder {
-                                inner: Some(inner),
-                                next_seq: Some(&mut next_seq),
-                            };
-                            return callback(&mut recorder);
-                        }
-                    }
-                    Err(_) => {
-                        if inner.healthy.swap(false, Ordering::AcqRel) {
-                            warn!("Legacy control trace sequencing lock failed; tracing disabled");
-                        }
-                    }
-                }
-            }
-
-            let mut recorder = OrderedRecorder {
-                inner: None,
-                next_seq: None,
-            };
-            callback(&mut recorder)
-        }
-
-        #[cfg(not(feature = "trace"))]
-        {
-            let mut recorder = OrderedRecorder {
-                marker: std::marker::PhantomData,
-            };
-            callback(&mut recorder)
-        }
-    }
-
-    pub(crate) fn finish(&self) {
-        #[cfg(feature = "trace")]
-        if let Some(inner) = self.inner.as_ref() {
-            self.linearize(|recorder| {
-                recorder.record_at(Instant::now(), v1::Event::End { clean: true });
-                inner.healthy.store(false, Ordering::Release);
-            });
-
-            let writer = match inner.writer.lock() {
-                Ok(mut writer) => writer.take(),
-                Err(_) => {
-                    warn!("Legacy control trace writer lock failed during shutdown");
-                    None
-                }
-            };
-            let writer_panicked = writer.map(|writer| writer.join().is_err()).unwrap_or(false);
-            if writer_panicked {
-                warn!("Legacy control trace writer panicked during shutdown");
-            }
-        }
-    }
-
-    #[cfg(feature = "trace")]
-    fn start_path(path: &Path, origin: Instant, header: v1::Event) -> Self {
-        let file = match File::options()
-            .create(true)
-            .write(true)
-            .truncate(true)
-            .open(path)
-        {
-            Ok(file) => file,
-            Err(error) => {
-                warn!(
-                    "Failed to open legacy control trace at {}: {error}; tracing disabled",
-                    path.display()
-                );
-                return Self::disabled();
-            }
-        };
-
-        Self::start_writer(BufWriter::new(file), origin, header)
-    }
-
-    #[cfg(feature = "trace")]
-    fn start_writer<W>(writer: W, origin: Instant, header: v1::Event) -> Self
-    where
-        W: Write + Send + 'static,
-    {
-        let (records, record_rx) = flume::bounded(QUEUE_CAPACITY);
-        let healthy = Arc::new(AtomicBool::new(true));
-        let header = v1::Record {
-            seq: 0,
-            timestamp: v1::timestamp(origin, origin, SystemTime::now()),
-            event: header,
-        };
-        let writer = match writer::spawn(writer, record_rx, header, Arc::clone(&healthy)) {
-            Ok(writer) => writer,
-            Err(error) => {
-                warn!("Failed to start legacy control trace writer: {error}; tracing disabled");
-                return Self::disabled();
-            }
-        };
-
-        Self {
-            inner: Some(Arc::new(Inner {
-                origin,
-                records,
-                next_seq: Mutex::new(1),
-                healthy,
-                writer: Mutex::new(Some(writer)),
-            })),
-        }
-    }
-}
-
-impl OrderedRecorder<'_> {
-    pub(crate) fn is_enabled(&self) -> bool {
-        #[cfg(feature = "trace")]
-        {
-            self.inner.is_some()
-        }
-
-        #[cfg(not(feature = "trace"))]
-        {
-            false
-        }
-    }
-
-    pub(crate) fn record_at(&mut self, instant: Instant, event: v1::Event) -> Option<u64> {
-        #[cfg(feature = "trace")]
-        {
-            let inner = self.inner?;
-            let next_seq = self.next_seq.as_deref_mut()?;
-            let seq = *next_seq;
-            let record = v1::Record {
-                seq,
-                timestamp: v1::timestamp(inner.origin, instant, SystemTime::now()),
-                event,
-            };
-
-            if inner.records.send(record).is_err() {
-                if inner.healthy.swap(false, Ordering::AcqRel) {
-                    warn!("Legacy control trace channel closed; tracing disabled");
-                }
-                return None;
-            }
-
-            *next_seq = (*next_seq).saturating_add(1);
-            Some(seq)
-        }
-
-        #[cfg(not(feature = "trace"))]
-        {
-            let _ = (instant, event);
-            None
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn disabled_recorder_is_a_no_op() {
-        let recorder = Recorder::disabled();
-
-        assert!(!recorder.is_enabled());
-        assert_eq!(
-            recorder.record_at(Instant::now(), v1::Event::End { clean: true }),
-            None
-        );
-        recorder.finish();
-    }
-
-    #[cfg(feature = "trace")]
-    mod enabled {
-        use super::*;
-        use std::io;
-        use std::net::{IpAddr, Ipv4Addr};
-        use std::path::PathBuf;
-        use std::sync::Barrier;
-        use std::sync::atomic::{AtomicU64, Ordering};
-        use std::thread;
-
-        static NEXT_PATH_ID: AtomicU64 = AtomicU64::new(0);
-
-        struct FailingWriter;
-
-        impl Write for FailingWriter {
-            fn write(&mut self, _buffer: &[u8]) -> io::Result<usize> {
-                Err(io::Error::other("injected writer failure"))
-            }
-
-            fn flush(&mut self) -> io::Result<()> {
-                Err(io::Error::other("injected writer failure"))
-            }
-        }
-
-        fn temp_path() -> PathBuf {
-            let id = NEXT_PATH_ID.fetch_add(1, Ordering::Relaxed);
-            std::env::temp_dir().join(format!(
-                "sqm-autorate-trace-v1-{}-{id}.jsonl",
-                std::process::id()
-            ))
-        }
-
-        fn ping_event(reflector: Ipv4Addr, value: f64) -> v1::Event {
-            v1::Event::PingReply {
-                reflector: IpAddr::V4(reflector),
-                down_time_ms: value,
-                up_time_ms: value,
-            }
-        }
-
-        #[test]
-        fn writer_preserves_global_sequence_order_from_multiple_producers() {
-            let path = temp_path();
-            let origin = Instant::now();
-            let recorder = Recorder::start_path(&path, origin, v1::tests::header_event());
-            let barrier = Arc::new(Barrier::new(3));
-            let mut producers = Vec::new();
-
-            for producer in 1..=2 {
-                let recorder = recorder.clone();
-                let barrier = Arc::clone(&barrier);
-                producers.push(thread::spawn(move || {
-                    barrier.wait();
-                    for value in 0..50 {
-                        recorder.record_at(
-                            origin,
-                            ping_event(Ipv4Addr::new(192, 0, 2, producer), value as f64),
-                        );
-                    }
-                }));
-            }
-
-            barrier.wait();
-            for producer in producers {
-                producer.join().unwrap();
-            }
-            recorder.finish();
-
-            let contents = std::fs::read_to_string(&path).unwrap();
-            let records = contents
-                .lines()
-                .map(|line| serde_json::from_str::<v1::Record>(line).unwrap())
-                .collect::<Vec<_>>();
-
-            assert_eq!(records.len(), 102);
-            assert!(matches!(
-                &records.first().unwrap().event,
-                v1::Event::Header { .. }
-            ));
-            assert!(matches!(
-                &records.last().unwrap().event,
-                v1::Event::End { clean: true }
-            ));
-            for (expected, record) in records.iter().enumerate() {
-                assert_eq!(record.seq, expected as u64);
-            }
-
-            std::fs::remove_file(path).unwrap();
-        }
-
-        #[test]
-        fn writer_failure_disables_recorder_without_propagating() {
-            let recorder =
-                Recorder::start_writer(FailingWriter, Instant::now(), v1::tests::header_event());
-
-            recorder.record_at(Instant::now(), ping_event(Ipv4Addr::new(192, 0, 2, 1), 1.0));
-            recorder.finish();
-
-            assert!(!recorder.is_enabled());
-        }
-
-        #[test]
-        fn open_failure_returns_disabled_recorder() {
-            let path = temp_path().join("missing-parent").join("trace.jsonl");
-            let recorder = Recorder::start_path(&path, Instant::now(), v1::tests::header_event());
-
-            assert!(!recorder.is_enabled());
-            recorder.record_at(Instant::now(), v1::Event::End { clean: true });
-            recorder.finish();
-        }
-    }
-}

src/trace/v1.rs

@@ -1,234 +0,0 @@
-// SPDX-FileCopyrightText: 2026-Present Nils Andreas Svee mailto:contact@lochnair.net (github @Lochnair)
-//
-// SPDX-License-Identifier: MPL-2.0
-
-use serde::{Deserialize, Serialize};
-use std::net::IpAddr;
-
-#[cfg(feature = "trace")]
-use crate::settings::Settings;
-#[cfg(any(feature = "trace", test))]
-use std::time::Duration;
-#[cfg(any(feature = "trace", test))]
-use std::time::Instant;
-#[cfg(feature = "trace")]
-use std::time::{SystemTime, UNIX_EPOCH};
-
-#[cfg(feature = "trace")]
-pub(crate) const FORMAT_VERSION: u16 = 1;
-#[cfg(feature = "trace")]
-pub(crate) const FORMAT_NAME: &str = "legacy-control-trace-v1";
-
-#[cfg(feature = "trace")]
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-pub(crate) struct Timestamp {
-    pub(crate) mono_ns: u64,
-    pub(crate) unix_us: i64,
-}
-
-#[cfg(feature = "trace")]
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-pub(crate) struct Record {
-    pub(crate) seq: u64,
-    pub(crate) timestamp: Timestamp,
-    #[serde(flatten)]
-    pub(crate) event: Event,
-}
-
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-#[serde(tag = "type", rename_all = "snake_case")]
-pub(crate) enum Event {
-    #[cfg(feature = "trace")]
-    Header {
-        format: String,
-        version: u16,
-        program_version: String,
-        control: ControlConfig,
-    },
-    PingReply {
-        reflector: IpAddr,
-        down_time_ms: f64,
-        up_time_ms: f64,
-    },
-    ControllerInitialized {
-        previous_rx_bytes: i128,
-        previous_tx_bytes: i128,
-        download_prev_mono_ns: u64,
-        upload_prev_mono_ns: u64,
-        download_history_index: u64,
-        upload_history_index: u64,
-        download_safe_rates_kbit: Vec<f64>,
-        upload_safe_rates_kbit: Vec<f64>,
-    },
-    ControlEvaluation {
-        evaluation_id: u64,
-        loop_mono_ns: u64,
-        rx_bytes: i128,
-        tx_bytes: i128,
-        active_reflectors: Vec<IpAddr>,
-    },
-    RateCalculation {
-        evaluation_id: u64,
-        direction: Direction,
-    },
-    RandomSafeRateChoice {
-        evaluation_id: u64,
-        direction: Direction,
-        index: u64,
-        rate_kbit: f64,
-    },
-    RequestedRates {
-        evaluation_id: Option<u64>,
-        reason: RateRequestReason,
-        download_kbit: u64,
-        upload_kbit: u64,
-        download_requested: bool,
-        upload_requested: bool,
-    },
-    End {
-        clean: bool,
-    },
-}
-
-#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub(crate) enum Direction {
-    Download,
-    Upload,
-}
-
-#[derive(Clone, Copy, Debug, Deserialize, PartialEq, Serialize)]
-#[serde(rename_all = "snake_case")]
-pub(crate) enum RateRequestReason {
-    Startup,
-    Control,
-    NoReflectorData,
-}
-
-#[cfg(feature = "trace")]
-#[derive(Clone, Debug, Deserialize, PartialEq, Serialize)]
-pub(crate) struct ControlConfig {
-    pub(crate) tick_interval_secs: f64,
-    pub(crate) min_change_interval_secs: f64,
-    pub(crate) download_base_kbit: f64,
-    pub(crate) upload_base_kbit: f64,
-    pub(crate) download_min_kbit: f64,
-    pub(crate) upload_min_kbit: f64,
-    pub(crate) download_delay_ms: f64,
-    pub(crate) upload_delay_ms: f64,
-    pub(crate) high_load_level: f64,
-    pub(crate) speed_history_size: u32,
-}
-
-#[cfg(feature = "trace")]
-impl ControlConfig {
-    pub(crate) fn from_settings(settings: &Settings) -> Self {
-        Self {
-            tick_interval_secs: settings.advanced_settings.tick_interval,
-            min_change_interval_secs: settings.advanced_settings.min_change_interval,
-            download_base_kbit: settings.network.download_base_kbits,
-            upload_base_kbit: settings.network.upload_base_kbits,
-            download_min_kbit: settings.network.download_min_kbits(),
-            upload_min_kbit: settings.network.upload_min_kbits(),
-            download_delay_ms: settings.advanced_settings.download_delay_ms,
-            upload_delay_ms: settings.advanced_settings.upload_delay_ms,
-            high_load_level: settings.advanced_settings.high_load_level,
-            speed_history_size: settings.advanced_settings.speed_hist_size,
-        }
-    }
-}
-
-#[cfg(feature = "trace")]
-pub(crate) fn timestamp(origin: Instant, monotonic: Instant, realtime: SystemTime) -> Timestamp {
-    Timestamp {
-        mono_ns: monotonic_ns(origin, monotonic),
-        unix_us: unix_us(realtime),
-    }
-}
-
-#[cfg(any(feature = "trace", test))]
-pub(crate) fn monotonic_ns(origin: Instant, monotonic: Instant) -> u64 {
-    duration_ns(monotonic.saturating_duration_since(origin))
-}
-
-#[cfg(any(feature = "trace", test))]
-fn duration_ns(duration: Duration) -> u64 {
-    duration.as_nanos().min(u64::MAX as u128) as u64
-}
-
-#[cfg(feature = "trace")]
-fn unix_us(realtime: SystemTime) -> i64 {
-    match realtime.duration_since(UNIX_EPOCH) {
-        Ok(duration) => duration
-            .as_micros()
-            .min(i64::MAX as u128)
-            .try_into()
-            .unwrap_or(i64::MAX),
-        Err(error) => {
-            let micros = error.duration().as_micros().min(i64::MAX as u128) as i64;
-            -micros
-        }
-    }
-}
-
-#[cfg(test)]
-pub(super) mod tests {
-    use super::*;
-
-    #[cfg(feature = "trace")]
-    fn control_config() -> ControlConfig {
-        ControlConfig {
-            tick_interval_secs: 0.5,
-            min_change_interval_secs: 0.5,
-            download_base_kbit: 100_000.0,
-            upload_base_kbit: 20_000.0,
-            download_min_kbit: 20_000.0,
-            upload_min_kbit: 4_000.0,
-            download_delay_ms: 15.0,
-            upload_delay_ms: 15.0,
-            high_load_level: 0.8,
-            speed_history_size: 100,
-        }
-    }
-
-    #[cfg(feature = "trace")]
-    pub(crate) fn header_event() -> Event {
-        Event::Header {
-            format: FORMAT_NAME.to_owned(),
-            version: FORMAT_VERSION,
-            program_version: "test".to_owned(),
-            control: control_config(),
-        }
-    }
-
-    #[cfg(feature = "trace")]
-    #[test]
-    fn serializes_versioned_header() {
-        let origin = Instant::now();
-        let record = Record {
-            seq: 0,
-            timestamp: timestamp(origin, origin, UNIX_EPOCH + Duration::from_secs(1)),
-            event: header_event(),
-        };
-
-        let json = serde_json::to_value(&record).unwrap();
-
-        assert_eq!(json["seq"], 0);
-        assert_eq!(json["type"], "header");
-        assert_eq!(json["format"], FORMAT_NAME);
-        assert_eq!(json["version"], FORMAT_VERSION);
-        assert_eq!(json["timestamp"]["mono_ns"], 0);
-        assert_eq!(serde_json::from_value::<Record>(json).unwrap(), record);
-    }
-
-    #[test]
-    fn converts_existing_instants_relative_to_origin() {
-        let origin = Instant::now();
-
-        assert_eq!(
-            monotonic_ns(origin, origin + Duration::from_nanos(123_456)),
-            123_456
-        );
-        assert_eq!(monotonic_ns(origin, origin - Duration::from_nanos(1)), 0);
-    }
-}

src/trace/writer.rs

@@ -1,54 +0,0 @@
-// SPDX-FileCopyrightText: 2026-Present Nils Andreas Svee mailto:contact@lochnair.net (github @Lochnair)
-//
-// SPDX-License-Identifier: MPL-2.0
-
-use super::v1::{Event, Record};
-use flume::Receiver;
-use log::warn;
-use std::io::{self, Write};
-use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, Ordering};
-use std::thread::{self, JoinHandle};
-
-pub(super) fn spawn<W>(
-    writer: W,
-    records: Receiver<Record>,
-    header: Record,
-    healthy: Arc<AtomicBool>,
-) -> io::Result<JoinHandle<()>>
-where
-    W: Write + Send + 'static,
-{
-    thread::Builder::new()
-        .name("trace-v1-writer".to_owned())
-        .spawn(move || {
-            if let Err(error) = write_records(writer, records, header) {
-                warn!("Legacy control trace writer failed; tracing disabled: {error}");
-                healthy.store(false, Ordering::Release);
-            }
-        })
-}
-
-fn write_records<W>(mut writer: W, records: Receiver<Record>, header: Record) -> io::Result<()>
-where
-    W: Write,
-{
-    write_record(&mut writer, &header)?;
-
-    while let Ok(record) = records.recv() {
-        let clean_end = matches!(record.event, Event::End { clean: true });
-        write_record(&mut writer, &record)?;
-
-        if clean_end {
-            writer.flush()?;
-            return Ok(());
-        }
-    }
-
-    writer.flush()
-}
-
-fn write_record(writer: &mut impl Write, record: &Record) -> io::Result<()> {
-    serde_json::to_writer(&mut *writer, record).map_err(io::Error::other)?;
-    writer.write_all(b"\n")
-}