Repository navigation

fix(socket): bound AlgAddr::new inputs to avoid OOB read in alg_type/alg_name #2806

Workflow file for this run

	name: CI

	on:
	pull_request:
	types: [opened, synchronize, reopened]
	push:
	branches:
	- master
	merge_group:
	types: [checks_requested]

	permissions:
	contents: read

	env:
	MSRV: 1.69.0
	RUSTFLAGS: -Dwarnings

	jobs:
	macos:
	runs-on: macos-26-intel
	env:
	TARGET: x86_64-apple-darwin
	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@master
	with:
	toolchain: stable
	components: clippy

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: '${{ env.TARGET }}'

	- name: test
	uses: ./.github/actions/test
	with:
	TARGET: '${{ env.TARGET }}'

	- name: before_cache_script
	run: sudo rm -rf $CARGO_HOME/registry/index

	macos-aarch64:
	runs-on: macos-latest
	env:
	TARGET: aarch64-apple-darwin
	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@master
	with:
	toolchain: stable
	components: clippy

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: "${{ env.TARGET }}"

	- name: test
	uses: ./.github/actions/test
	with:
	TARGET: "${{ env.TARGET }}"

	- name: before_cache_script
	run: sudo rm -rf $CARGO_HOME/registry/index

	# Use cross for QEMU-based testing
	# cross needs to execute Docker, GitHub Action already has it installed
	cross:
	runs-on: ubuntu-24.04
	needs: [rustfmt, minver, macos, x86_64_linux_native_builds]
	strategy:
	fail-fast: false
	matrix:
	target: [
	arm-unknown-linux-gnueabi,
	armv7-unknown-linux-gnueabihf,
	i686-unknown-linux-gnu,
	i686-unknown-linux-musl,

	# Disable MIPS CIs, see https://github.com/nix-rust/nix/issues/2593
	# for detailed info.
	#
	# mips-unknown-linux-gnu,
	# mips64-unknown-linux-gnuabi64,
	# mips64el-unknown-linux-gnuabi64,
	# mipsel-unknown-linux-gnu,

	powerpc64le-unknown-linux-gnu,
	loongarch64-unknown-linux-gnu,
	]

	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@master
	with:
	toolchain: stable
	components: clippy

	# cross relies on docker or podman, GitHub Acton already has it installed.
	- name: Set up cross
	uses: taiki-e/install-action@v2
	with:
	tool: cross@0.2.5

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: '${{ matrix.target }}'
	TOOL: cross
	RUSTFLAGS: --cfg qemu -D warnings

	- name: test
	uses: ./.github/actions/test
	with:
	TARGET: '${{ matrix.target }}'
	SUDO: ""
	TOOL: cross
	RUSTFLAGS: --cfg qemu -D warnings
	RUSTDOCFLAGS: --cfg qemu

	- name: before_cache_script
	run: rm -rf $CARGO_HOME/registry/index



	# Tasks for x86_64 Linux native builds
	x86_64_linux_native_builds:
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	target: [
	x86_64-unknown-linux-gnu,
	x86_64-unknown-linux-musl,
	]

	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@master
	with:
	toolchain: stable
	components: clippy

	- name: install targets
	run: rustup target add ${{ matrix.target }}

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: '${{ matrix.TARGET }}'

	- name: test
	uses: ./.github/actions/test
	with:
	TARGET: '${{ matrix.TARGET }}'

	- name: before_cache_script
	run: sudo rm -rf $CARGO_HOME/registry/index;

	# Tasks for aarch64 Linux native builds
	aarch64_linux_native_builds:
	runs-on: ubuntu-24.04-arm
	strategy:
	fail-fast: false
	matrix:
	target: [
	aarch64-unknown-linux-gnu,
	aarch64-unknown-linux-musl,
	]

	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@master
	with:
	toolchain: stable
	components: clippy

	- name: install targets
	run: rustup target add ${{ matrix.target }}

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: '${{ matrix.TARGET }}'

	- name: test
	uses: ./.github/actions/test
	with:
	TARGET: '${{ matrix.TARGET }}'

	- name: before_cache_script
	run: sudo rm -rf $CARGO_HOME/registry/index;

	# Jobs that use nested virtualization
	vmactions:
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	include:
	- os: freebsd
	version: "14.4"
	arch: x86_64
	rustflags: --cfg fbsd14 -D warnings
	rustdocflags: --cfg fbsd14

	# Disable FreeBSD/aarch64 because it's too slow
	#- os: freebsd
	#version: "15.0"
	#arch: aarch64

	# Disable Haiku because Nix doesn't have a Haiku maintainer who can
	# fix the tests for us.
	#- os: haiku
	#version: "r1beta5"
	#arch: x86_64

	# Disable NetBSD because Nix doesn't have a NetBSD maintainer who can
	# fix the tests for us.
	#- os: netbsd
	#version: "10.1"
	#arch: x86_64

	# Disable OmniOS because Nix doesn't have an OmniOS maintainer who can
	# fix the tests for us.
	#- os: omnios
	#version: "r151056"
	#arch: x86_64

	# Disable OpenBSD because Nix doesn't have an OpenBSD maintainer who
	# can fix the tests for us.
	#- os: openbsd
	#version: "7.8"
	#arch: x86_64
	env:
	RUSTFLAGS: ${{ matrix.rustflags \|\| '-Dwarnings' }}
	RUSTDOCFLAGS: ${{ matrix.rustdocflags \|\| '-D warnings' }}
	steps:
	- uses: actions/checkout@v6

	- name: Start VM
	if: matrix.os == 'freebsd'
	uses: vmactions/freebsd-vm@v1
	with:
	release: ${{ matrix.version }}
	arch: ${{ matrix.arch }}
	usesh: true
	custom-shell-name: vmsh
	- name: Start VM
	if: matrix.os == 'haiku'
	uses: vmactions/haiku-vm@v1
	with:
	release: ${{ matrix.version }}
	arch: ${{ matrix.arch }}
	usesh: true
	custom-shell-name: vmsh
	- name: Start VM
	if: matrix.os == 'netbsd'
	uses: vmactions/netbsd-vm@v1
	with:
	release: ${{ matrix.version }}
	arch: ${{ matrix.arch }}
	usesh: true
	custom-shell-name: vmsh
	- name: Start VM
	if: matrix.os == 'omnios'
	uses: vmactions/omnios-vm@v1
	with:
	release: ${{ matrix.version }}
	arch: ${{ matrix.arch }}
	usesh: true
	custom-shell-name: vmsh
	- name: Start VM
	if: matrix.os == 'openbsd'
	uses: vmactions/openbsd-vm@v1
	with:
	release: ${{ matrix.version }}
	arch: ${{ matrix.arch }}
	usesh: true
	custom-shell-name: vmsh

	- name: Install dependencies
	if: matrix.arch == 'x86_64' && matrix.os == 'freebsd'
	shell: vmsh {0}
	run: \|
	pkg install -y curl
	kldload mqueuefs
	fetch https://sh.rustup.rs -o rustup.sh
	sh rustup.sh -y --profile=minimal --default-toolchain stable
	. $HOME/.cargo/env
	rustc -vV
	rustup component add clippy
	- name: Install dependencies
	if: matrix.arch == 'aarch64' && matrix.os == 'freebsd'
	shell: vmsh {0}
	run: \|
	pkg install -y rust
	kldload mqueuefs
	rustc -vV
	- name: Install dependencies
	if: matrix.os == 'haiku'
	shell: vmsh {0}
	run: \|
	pkgman install -y rust_bin
	rustc -vV
	- name: Install dependencies
	if: matrix.os == 'netbsd'
	shell: vmsh {0}
	run: \|
	pkg_add curl
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh -s -- -y
	- name: Install dependencies
	if: matrix.os == 'omnios'
	shell: vmsh {0}
	run: \|
	pkg install developer/build-essential
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs \| sh -s -- -y
	- name: Install dependencies
	if: matrix.os == 'openbsd'
	shell: vmsh {0}
	run: \|
	pkg_add rust
	rustc -vV

	- name: Build
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	cargo build --all-targets --all-features
	- name: Test
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	cargo test --all-targets --all-features
	- name: Clippy
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	cargo clippy --all-targets --all-features -- -D warnings -A unknown-lints
	- name: Doc
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	cargo doc --no-deps --all-features

	- name: Hack
	if: matrix.arch == 'x86_64' && matrix.os == 'freebsd'
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	mkdir -p $HOME/.cargo/bin; export PATH=$HOME/.cargo/bin:$PATH
	curl -LsSf https://github.com/taiki-e/cargo-hack/releases/latest/download/cargo-hack-x86_64-unknown-freebsd.tar.gz \| tar xzf - -C ~/.cargo/bin
	cargo hack check --each-feature

	- name: i686 Build
	if: matrix.arch == 'x86_64' && matrix.os == 'freebsd'
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	rustup target add i686-unknown-freebsd
	cargo build --target i686-unknown-freebsd --all-features --all-targets
	- name: i686 Test
	if: matrix.arch == 'x86_64' && matrix.os == 'freebsd'
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	cargo test --all-targets --all-features --target i686-unknown-freebsd
	- name: i686 Doc
	if: matrix.arch == 'x86_64' && matrix.os == 'freebsd'
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	cargo doc --no-deps --all-features --target i686-unknown-freebsd
	- name: i686 Hack
	if: matrix.arch == 'x86_64' && matrix.os == 'freebsd'
	shell: vmsh {0}
	run: \|
	if [ -f $HOME/.cargo/env ]; then . $HOME/.cargo/env; fi
	cargo hack check --each-feature --target i686-unknown-freebsd

	# Tasks for cross-compiling, but no testing
	cross_compiling:
	runs-on: ubuntu-latest
	needs: [rustfmt, minver, macos, x86_64_linux_native_builds]
	env:
	BUILD: check
	strategy:
	fail-fast: false
	matrix:
	include:
	# Cross claims to support Android, but when it tries to run Nix's tests it
	# reports undefined symbol references.
	- target: aarch64-linux-android
	- target: arm-linux-androideabi
	- target: armv7-linux-androideabi
	- target: i686-linux-android
	- target: x86_64-linux-android
	- target: arm-unknown-linux-musleabi
	- target: x86_64-unknown-fuchsia
	- target: x86_64-unknown-illumos
	# Cross claims to support running tests on iOS, but it actually doesn't.
	# https://github.com/rust-embedded/cross/issues/535
	- target: aarch64-apple-ios
	# cargo hack tries to invoke the iphonesimulator SDK for iOS
	NOHACK: true
	# Cross claims to support Linux powerpc64, but it really doesn't.
	# https://github.com/rust-embedded/cross/issues/441
	- target: powerpc64-unknown-linux-gnu
	- target: s390x-unknown-linux-gnu
	- target: x86_64-unknown-linux-gnux32
	- target: x86_64-unknown-netbsd
	- target: aarch64-unknown-linux-ohos
	- target: armv7-unknown-linux-ohos
	- target: x86_64-unknown-linux-ohos

	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@master
	with:
	toolchain: stable
	components: clippy

	- name: install targets
	run: rustup target add ${{ matrix.target }}

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: '${{ matrix.target }}'
	BUILD: '${{ env.BUILD }}'
	NOHACK: '${{ matrix.NOHACK }}'

	- name: before_cache_script
	run: rm -rf $CARGO_HOME/registry/index

	# Check that Nix will build on the MSRV, on a variety of operating systems.
	# But don't check the tests. Those are not required to build on MSRV.
	msrv:
	runs-on: ubuntu-latest
	needs: [rustfmt, minver, macos, x86_64_linux_native_builds]
	env:
	BUILD: check
	NOCLIPPY: true
	NODOC: true
	NOHACK: true
	TARGETS: ""
	strategy:
	fail-fast: false
	matrix:
	include:
	- target: aarch64-linux-android
	- target: x86_64-unknown-linux-gnu
	- target: x86_64-unknown-linux-musl
	- target: aarch64-apple-darwin
	- target: x86_64-unknown-freebsd
	- target: x86_64-unknown-netbsd
	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@master
	with:
	toolchain: ${{ env.MSRV }}

	- name: install targets
	run: rustup target add ${{ matrix.target }}

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: '${{ matrix.target }}'
	TARGETS: '${{ env.TARGETS }}'
	BUILD: '${{ env.BUILD }}'
	NOCLIPPY: '${{ env.NOCLIPPY }}'
	NODOC: '${{ env.NODOC }}'
	NOHACK: '${{ env.NOHACK }}'

	- name: before_cache_script
	run: rm -rf $CARGO_HOME/registry/index


	redox:
	runs-on: ubuntu-latest
	needs: [rustfmt, minver, macos, x86_64_linux_native_builds]
	env:
	TARGET: x86_64-unknown-redox
	CLIPPYFLAGS: -D warnings
	BUILD: check
	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	# Redox's MSRV policy is unclear. Until they define it, use nightly.
	uses: dtolnay/rust-toolchain@nightly
	with:
	components: clippy

	- name: install targets
	run: rustup target add ${{ env.TARGET }}

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: '${{ env.TARGET }}'
	BUILD: '${{ env.BUILD }}'
	CLIPPYFLAGS: '${{ env.CLIPPYFLAGS }}'

	- name: before_cache_script
	run: rm -rf $CARGO_HOME/registry/index



	# Rust Tier 3 targets can't use Rustup
	tier3:
	runs-on: ubuntu-latest
	env:
	BUILD: check
	ZFLAGS: -Zbuild-std
	CLIPPYFLAGS: -D warnings
	strategy:
	fail-fast: false
	matrix:
	include:
	- target: x86_64-unknown-dragonfly
	- target: x86_64-unknown-openbsd
	- target: x86_64-unknown-haiku
	- target: armv7-unknown-linux-uclibceabihf
	- target: i686-unknown-hurd-gnu
	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@nightly
	with:
	components: clippy

	- name: install src
	run: rustup component add rust-src

	- name: build
	uses: ./.github/actions/build
	with:
	TARGET: '${{ matrix.target }}'
	BUILD: '${{ env.BUILD }}'
	ZFLAGS: '${{ env.ZFLAGS }}'
	CLIPPYFLAGS: '${{ env.CLIPPYFLAGS }}'

	- name: before_cache_script
	run: rm -rf $CARGO_HOME/registry/index

	solaris:
	name: solaris (x86_64-pc-solaris)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	- name: build and test
	uses: vmactions/solaris-vm@v1
	with:
	release: "11.4-gcc"
	usesh: true
	mem: 4096
	copyback: false
	prepare: \|
	source <(curl -s https://raw.githubusercontent.com/psumbera/solaris-rust/refs/heads/main/sh.rust-web-install)
	echo "~~~~ rustc --version ~~~~"
	rustc --version
	echo "~~~~ Solaris-version ~~~~"
	uname -a
	run: \|
	export PATH=$HOME/.rust_solaris/bin:$PATH
	cargo build --target x86_64-pc-solaris --all-targets --all-features && sudo env PATH=$PATH cargo test

	# Test that we can build with the lowest version of all dependencies.
	# "cargo test" doesn't work because some of our dev-dependencies, like
	# rand, can't build with their own minimal dependencies.
	minver:
	runs-on: ubuntu-latest
	env:
	TARGET: x86_64-unknown-linux-gnu
	steps:
	- name: checkout
	uses: actions/checkout@v4

	- name: setup Rust
	uses: dtolnay/rust-toolchain@nightly

	- name: setup
	run: cargo update -Zdirect-minimal-versions

	- name: check
	run: cargo check

	- name: before_cache_script
	run: rm -rf $CARGO_HOME/registry/index

	# Tasks that checks if the code is formatted right using `cargo fmt` tool
	rustfmt:
	runs-on: ubuntu-latest
	steps:
	- name: Checkout
	uses: actions/checkout@v4

	- name: Setup Rust
	uses: dtolnay/rust-toolchain@stable
	with:
	components: rustfmt

	- name: Check format
	run: cargo fmt --all -- --check */.rs

	- name: before_cache_script
	run: rm -rf $CARGO_HOME/registry/index

Navigation Menu

Repository navigation

fix(socket): bound AlgAddr::new inputs to avoid OOB read in alg_type/alg_name #2806

Workflow file

fix(socket): bound AlgAddr::new inputs to avoid OOB read in alg_type/alg_name #2806

Uh oh!

Workflow file for this run