Release/v0.20 fixes

Cargo.toml

@@ -85,41 +85,41 @@ vpcmap = { path = "./vpcmap", package = "dataplane-vpcmap", features = [] }
 # External
 afpacket = { version = "0.2.3", default-features = false, features = [] }
 ahash = { version = "0.8.12", default-features = false, features = [] }
-anyhow = { version = "1.0.102", default-features = false, features = ["std"] }
-arc-swap = { version = "1.9.1", default-features = false, features = [] }
-arrayvec = { version = "0.7.6", default-features = false, features = [] }
+anyhow = { version = "1.0.103", default-features = false, features = ["std"] }
+arc-swap = { version = "1.9.2", default-features = false, features = [] }
+arrayvec = { version = "0.7.8", default-features = false, features = [] }
 async-trait = { version = "0.1.89", default-features = false, features = [] }
 atomic-instant-full = { version = "0.1.1", default-features = false, features = [] }
 axum = { version = "0.8.9", default-features = false, features = [] }
 axum-server = { version = "0.8.0", default-features = false, features = [] }
 bindgen = { version = "0.72.1", default-features = false, features = [] }
-bitflags = { version = "2.11.1", default-features = false, features = [] }
+bitflags = { version = "2.13.1", default-features = false, features = [] }
 bnum = { version = "0.14.4", default-features = false, features = [] }
 bolero = { version = "0.13.4", default-features = false, features = [] }
 bytecheck = { version = "0.8.2", default-features = false, features = [] }
-bytes = { version = "1.11.1", default-features = false, features = [] }
+bytes = { version = "1.12.1", default-features = false, features = [] }
 caps = { version = "0.5.6", default-features = false, features = [] }
-chrono = { version = "0.4.44", default-features = false, features = [] }
-clap = { version = "4.6.1", default-features = true, features = [] }
+chrono = { version = "0.4.45", default-features = false, features = [] }
+clap = { version = "4.6.2", default-features = true, features = [] }
 color-eyre = { version = "0.6.5", default-features = false, features = [] }
 colored = { version = "3.1.1", default-features = false, features = [] }
 ctrlc = { version = "3.5.2", default-features = false, features = [] }
-dashmap = { version = "6.1.0", default-features = false, features = [] }
+dashmap = { version = "6.2.1", default-features = false, features = [] }
 derive_builder = { version = "0.20.2", default-features = false, features = [] }
 dotenvy = { version = "0.15.7", default-features = false, features = [] }
 downcast-rs = { version = "2.0.2", default-features = false, features = [] }
 doxygen-bindgen = { version = "0.1.3", default-features = false, features = [] }
 dyn-iter = { version = "1.0.1", default-features = false, features = [] }
-etherparse = { version = "0.20.1", default-features = false, features = [] }
+etherparse = { version = "0.20.3", default-features = false, features = [] }
 fixin = { git = "https://github.com/githedgehog/fixin", branch = "main", features = [] }
 futures = { version = "0.3.32", default-features = false, features = [] }
 futures-util = { version = "0.3.32", default-features = false, features = ["std"] }
-hashbrown = { version = "0.17.0", default-features = false, features = [] }
+hashbrown = { version = "0.17.1", default-features = false, features = [] }
 hwlocality = { version = "1.0.0-alpha.12", default-features = false, features = [] }
-hyper = { version = "1.9.0", default-features = false, features = [] }
+hyper = { version = "1.10.1", default-features = false, features = [] }
 hyper-util = { version = "0.1.20", default-features = false, features = [] }
 indenter = { version = "0.3.4", default-features = false, features = [] }
-inotify = { version = "0.11.1", default-features = false, features = [] }
+inotify = { version = "0.11.4", default-features = false, features = [] }
 ipnet = { version = "2.12.0", default-features = false, features = [] }
 k8s-openapi = { version = "0.27.1", default-features = false, features = [] }
 kanal = { version = "0.1.1", default-features = false, features = [] }
@@ -129,63 +129,63 @@ kube-core = { version = "3.1.0", default-features = false, features = [] }
 left-right = { git = "https://github.com/githedgehog/left-right.git", branch = "fredi/fix-writehandle-drop", default-features = false, features = [] }
 libc = { version = "1.0.0-alpha.3", default-features = false, features = [] }
 linkme = { version = "0.3.36", default-features = false, features = [] }
-log = { version = "0.4.29", default-features = false, features = [] } # TODO: try to remove this
+log = { version = "0.4.33", default-features = false, features = [] } # TODO: try to remove this
 loom = { version = "0.7.2", default-features = false, features = [] }
-memmap2 = { version = "0.9.10", default-features = false, features = [] }
-metrics = { version = "0.24.5", default-features = false, features = [] }
+memmap2 = { version = "0.9.11", default-features = false, features = [] }
+metrics = { version = "0.24.6", default-features = false, features = [] }
 metrics-exporter-prometheus = { version = "0.18.3", default-features = false, features = [] }
 miette = { version = "7.6.0", default-features = false, features = [] }
-mio = { version = "1.2.0", default-features = false, features = [] }
+mio = { version = "1.2.2", default-features = false, features = [] }
 multi_index_map = { version = "0.15.1", default-features = false, features = [] }
-n-vm = { git = "https://github.com/githedgehog/testn.git", tag = "v0.0.9", default-features = false, features = [], package = "n-vm" }
+n-vm = { git = "https://github.com/githedgehog/testn.git", tag = "v0.0.10", default-features = false, features = [], package = "n-vm" }
 netdev = { version = "0.43.0", default-features = false, features = [] }
 netgauze-bgp-pkt = { version = "0.11.0", features = [] }
 netgauze-bmp-pkt = { version = "0.11.0", features = ["codec"] }
-nix = { version = "0.31.2", default-features = false, features = [] }
+nix = { version = "0.31.3", default-features = false, features = [] }
 num-derive = { version = "0.4.2", default-features = false, features = [] }
 num-traits = { version = "0.2.19", default-features = false, features = [] }
 once_cell = { version = "1.21.4", default-features = false, features = [] }
 ordermap = { version = "1.2.0", default-features = false, features = [] }
 parking_lot = { version = "0.12.5", default-features = false, features = [] }
 pci-ids = { version = "0.2.6", default-features = false, features = [] }
-prefix-trie = { version = "0.8.2", default-features = false, features = [] }
+prefix-trie = { version = "0.8.4", default-features = false, features = [] }
 pretty_assertions = { version = "1.4.1", default-features = false, features = [] }
 priority-queue = { version = "2.7.0", default-features = false, features = [] }
 proc-macro2 = { version = "1.0.106", default-features = false, features = [] }
 procfs = { version = "0.18.0", default-features = false, features = [] }
-pyroscope = { version = "2.0.3", default-features = false, features = ["backend-pprof-rs"] }
-quote = { version = "1.0.45", default-features = false, features = [] }
-rand = { version = "0.10.1", default-features = false, features = ["thread_rng"] }
-rapidhash = { version = "4.4.1", default-features = false, features = [] }
+pyroscope = { version = "2.1.0", default-features = false, features = ["backend-pprof-rs"] }
+quote = { version = "1.0.46", default-features = false, features = [] }
+rand = { version = "0.10.2", default-features = false, features = ["thread_rng"] }
+rapidhash = { version = "4.5.1", default-features = false, features = [] }
 reedline = { version = "0.47.0", default-features = false, features = [] }
-rkyv = { version = "0.8.16", default-features = false, features = [] }
+rkyv = { version = "0.8.17", default-features = false, features = [] }
 roaring = { version = "0.11.4", default-features = false, features = [] }
 rtnetlink = { git = "https://github.com/githedgehog/rtnetlink.git", branch = "hh/tc-actions3", default-features = false, features = [] }
-rustls = { version = "0.23.40", default-features = false, features = [] }
+rustls = { version = "0.23.42", default-features = false, features = [] }
 schemars = { version = "1", default-features = false, features = [] }
 serde = { version = "1.0.228", default-features = false, features = [] }
-serde_json = { version = "1.0.149", default-features = false, features = [] }
+serde_json = { version = "1.0.150", default-features = false, features = [] }
 serde_yaml_ng = { version = "0.10.0", default-features = false, features = [] }
-serial_test = { version = "3.4.0", default-features = false, features = [] }
+serial_test = { version = "3.5.0", default-features = false, features = [] }
 sha2 = { version = "0.11.0", default-features = false, features = [] }
 shuttle = { version = "0.9.1", default-features = false, features = [] }
 small-map = { version = "0.1.5", default-features = false, features = [] }
 static_assertions = { version = "1.1.0", default-features = false, features = [] }
 strum = { version = "0.28.0", default-features = false, features = [] }
 strum_macros = { version = "0.28.0", default-features = false, features = [] }
-syn = { version = "2.0.117", default-features = false, features = [] }
+syn = { version = "2.0.119", default-features = false, features = [] }
 thiserror = { version = "2.0.18", default-features = false, features = [] }
-thread_local = { version = "1.1.9", default-features = false, features = [] }
-tokio = { version = "1.52.1", default-features = false, features = [] }
+thread_local = { version = "1.1.10", default-features = false, features = [] }
+tokio = { version = "1.53.0", default-features = false, features = [] }
 tokio-util = { version = "0.7.18", default-features = false, features = [] }
-tonic = { version = "0.14.5", default-features = false, features = [] }
+tonic = { version = "0.14.6", default-features = false, features = [] }
 tracing = { version = "0.1.44", default-features = false, features = [] }
 tracing-error = { version = "0.2.1", default-features = false, features = [] }
 tracing-subscriber = { version = "0.3.23", default-features = false, features = [] }
 tracing-test = { version = "0.2.6", default-features = false, features = [] }
 ureq = { version = "3.3.0", default-features = false, features = [] }
 url = { version = "2.5.8", default-features = false, features = [] }
-uuid = { version = "1.23.1", default-features = false, features = [] }
+uuid = { version = "1.24.0", default-features = false, features = [] }
 
 [profile.dev]
 panic = "unwind"

cli/bin/main.rs

@@ -37,7 +37,7 @@ fn ask_user(question: &str) -> bool {
     let mut answer = String::new();
     loop {
         println!("{question}");
-        answer.truncate(0);
+        answer.clear();
         let _ = stdin().read_line(&mut answer);
         if let Some('\n') = answer.chars().next_back() {
             answer.pop();

config/src/display.rs

@@ -78,7 +78,7 @@ impl Display for VpcExpose {
             if !nat.as_range.is_empty() {
                 write!(f, "{SEP}       as:")?;
                 nat.as_range.iter().for_each(|pfx| {
-                    let _ = write!(f, " {pfx} proto: {:?} NAT:{}", nat.proto, &nat.config);
+                    let _ = write!(f, " {pfx} proto: {:?} NAT:{}", nat.proto, nat.config);
                 });
                 carriage = true;
             }

dataplane/src/drivers/kernel/worker.rs

@@ -271,7 +271,7 @@ fn packet_recv(
     max_to_read: usize,
     pkts: &mut Vec<Box<Packet<TestBuffer>>>,
 ) -> Result<(), nix::Error> {
-    let mut raw = [0u8; 9100];
+    let mut raw = [0u8; 9600];
     let mut ret = Ok(());
     pkts.clear();
     while pkts.len() < max_to_read {

dataplane/src/packet_processor/egress.rs

@@ -27,6 +27,7 @@ pub struct Egress {
     atabler: AtableReader,
 }
 
+#[allow(dead_code)]
 fn determine_ether_type<Buf: PacketBufferMut>(packet: &Packet<Buf>) -> Option<EthType> {
     // FIXME(fredi): this should consider interface type; e.g. for vlan
     if packet.try_ipv4().is_some() {
@@ -40,8 +41,8 @@ fn determine_ether_type<Buf: PacketBufferMut>(packet: &Packet<Buf>) -> Option<Et
     }
 }
 
+#[allow(dead_code)]
 impl Egress {
-    #[allow(dead_code)]
     pub fn new(name: &str, iftr: IfTableReader, atabler: AtableReader) -> Self {
         let name = name.to_owned();
         Self {

deny.toml

@@ -1,6 +1,15 @@
 # see https://github.com/EmbarkStudios/cargo-deny for docs
 [graph]
-targets = []
+# We only ship on Linux, so scope the dependency graph to the Linux targets we
+# actually build for. This keeps Windows/macOS-only crates (e.g. windows-sys,
+# winapi) out of advisory/license/ban checks, where they are dangerous noise.
+targets = [
+    "x86_64-unknown-linux-gnu",
+    "aarch64-unknown-linux-gnu",
+    "x86_64-unknown-linux-musl",
+    "aarch64-unknown-linux-musl",
+    "wasm32-wasip1",
+]
 #exclude = []
 all-features = false
 no-default-features = false
@@ -12,15 +21,10 @@ feature-depth = 1
 
 [advisories]
 ignore = [
+    # paste is unmaintained but is needed by netlink-packet-core.  We should submit a patch when possible.
     "RUSTSEC-2024-0436",
-    # this relates to the use of abandoned "safemem" crate in cloud-hypervisor.
-    # Since cloud-hypervisor is only a dev-dependency, we can safely ignore this.
-    "RUSTSEC-2023-0081",
-    # instant is unmaintained but is needed by afpacket with the tokio feature, remove when we stop using this crate in favor of our own
-    "RUSTSEC-2024-0384",
-    # rustls_pemfile is unmaintained, but we aren't actually even using it.  We don't enable the feature of bollard
-    # which would pull this in.
-    "RUSTSEC-2025-0134"
+    # proc-macro-error2 is unmaintained but is needed by multi_index_map_derive, and our own fixin; ignore until both dependencies have migrated away from it.
+    "RUSTSEC-2026-0173",
 ]
 
 [licenses]

flow-entry/src/flow_table/table.rs

@@ -474,7 +474,7 @@ mod tests {
 
             flow_table.insert(flow_info).unwrap();
             let result = flow_table.remove(&flow_key).unwrap();
-            assert!(result.0 == flow_key);
+            assert_eq!(result.0, flow_key);
         }
 
         #[tokio::test]

flow-filter/src/setup.rs

@@ -479,7 +479,7 @@ fn get_split_prefixes_for_manifest(
             let mut fragments_to_check = vec![*prefix];
             'next_fragment: while let Some(fragment) = fragments_to_check.pop() {
                 // Split the fragment into sub-fragments as long as we find overlapping prefixes
-                for (overlap_prefix, _overlap_data) in overlaps.iter() {
+                for overlap_prefix in overlaps.keys() {
                     if fragment.overlaps(overlap_prefix) && !overlap_prefix.covers(&fragment) {
                         fragments_to_check.extend(split_overlapping(&fragment, overlap_prefix));
                         continue 'next_fragment;

justfile

@@ -62,7 +62,7 @@ version_platform := if platform == "x86-64-v3" { "" } else { "-" + platform }
 version_profile := if profile == "release" { "" } else { "-" + profile }
 version_san := if sanitize == "" { "" } else { "-san." + replace(sanitize, ",", ".") }
 version_feat := if features == "" { "" } else { "-feat." + replace(features, ",", ".") }
-version := env("VERSION", "") || `git describe --tags --dirty --always` + version_platform + version_profile + version_san + version_feat + version_extra
+version := env("VERSION", `git describe --tags --dirty --always` + version_platform + version_profile + version_san + version_feat + version_extra)
 
 # Print version that will be used in the build
 version:

lpm/src/prefix/mod.rs

@@ -1819,9 +1819,9 @@ mod tests {
 
                 if one == two {
                     // Consitency between PartialEq and PartialOrd
-                    assert!(one.partial_cmp(two) == Some(Ordering::Equal));
+                    assert_eq!(one.partial_cmp(two), Some(Ordering::Equal));
                     // PartialEq is symmetric
-                    assert!(two == one);
+                    assert_eq!(two, one);
                 }
 
                 if let (Ok(one_int), Ok(two_int)) = (u128::try_from(one), u128::try_from(two)) {

mgmt/src/processor/confbuild/namegen.rs

@@ -66,7 +66,7 @@ impl VpcConfigNames for Vpc {
     fn import_plist_peer(&self, remote_name: &str) -> String {
         format!(
             "{}-FROM-{}",
-            &self.name.to_uppercase(),
+            self.name.to_uppercase(),
             remote_name.to_uppercase()
         )
     }
@@ -77,18 +77,18 @@ impl VpcConfigNames for Vpc {
     fn adv_plist(&self, remote_name: &str) -> String {
         format!(
             "ADV-TO-{}-FOR-{}",
-            &self.name.to_uppercase(),
+            self.name.to_uppercase(),
             remote_name.to_uppercase()
         )
     }
     fn adv_plist_desc(&self, remote_name: &str) -> String {
         format!(
             "Prefixes advertised to {} for {}",
-            &self.name.to_uppercase(),
+            self.name.to_uppercase(),
             remote_name.to_uppercase()
         )
     }
     fn adv_rmap(&self) -> String {
-        format!("ADV-TO-{}", &self.name.to_uppercase())
+        format!("ADV-TO-{}", self.name.to_uppercase())
     }
 }

nat/src/portfw/portfwtable/portrange.rs

@@ -84,7 +84,7 @@ impl PortRange {
     /// Given a `PortRange` and a port, provide the corresponding port in another `PortRange`,
     /// provided that the port falls within ranges. Both ranges need to be of the same size.
     pub fn map_port_to(self, port: NonZero<u16>, other: Self) -> Option<NonZero<u16>> {
-        debug_assert!(self.len() == other.len());
+        debug_assert_eq!(self.len(), other.len());
         let index = self.indexof(port)?;
         other.get_port_at(index)
     }

nat/src/portfw/test.rs

@@ -364,7 +364,7 @@ mod nf_test {
         packet.try_tcp_mut().unwrap().set_ack(true);
         let output = process_packet(&mut pipeline, packet);
         assert!(output.meta().flow_info.is_some());
-        assert!(get_flow_status(&output) != Some(FlowStatus::Active)); // it may be None if the nf expiration removes it
+        assert_ne!(get_flow_status(&output), Some(FlowStatus::Active)); // it may be None if the nf expiration removes it
         assert_eq!(get_pfw_flow_status(&output), Some(NatFlowStatus::Closed));
         println!("{flow_table}");
         assert_eq!(flow_table.len().unwrap(), 2);
@@ -400,7 +400,7 @@ mod nf_test {
         packet.try_tcp_mut().unwrap().set_ack(true);
         let output = process_packet(&mut pipeline, packet);
         assert!(output.meta().flow_info.is_some());
-        assert!(get_flow_status(&output) != Some(FlowStatus::Active)); // may be cancelled or none
+        assert_ne!(get_flow_status(&output), Some(FlowStatus::Active)); // may be cancelled or none
         assert_eq!(get_pfw_flow_status(&output), Some(NatFlowStatus::Closed));
         println!("{flow_table}");
         assert_eq!(flow_table.len().unwrap(), 2);
@@ -446,7 +446,7 @@ mod nf_test {
         packet.try_tcp_mut().unwrap().set_ack(true);
         let output = process_packet(&mut pipeline, packet);
         assert!(output.meta().flow_info.is_some());
-        assert!(get_flow_status(&output) != Some(FlowStatus::Active)); // may be cancelled or none
+        assert_ne!(get_flow_status(&output), Some(FlowStatus::Active)); // may be cancelled or none
         assert_eq!(get_pfw_flow_status(&output), Some(NatFlowStatus::Closed));
         println!("{flow_table}");
         assert_eq!(flow_table.len().unwrap(), 2);

nat/src/stateful/apalloc/mod.rs

@@ -441,7 +441,7 @@ mod tests {
             Ipv4Addr::new(1, 1, 1, 1),
             Ipv4Addr::new(1, 1, 1, 1),
         );
-        assert!(key1 == key2);
+        assert_eq!(key1, key2);
 
         let key1 = PoolTableKey::new(
             NextHeader::TCP,

nat/src/stateful/apalloc/port_alloc.rs

@@ -720,7 +720,7 @@ impl<I: NatIpWithBitmap> AllocatedPortBlockMap<I> {
     fn allocated_port_ranges(&self) -> BTreeSet<PortRange> {
         let blocks = self.0.read().unwrap();
         let mut ranges = BTreeSet::<PortRange>::new();
-        for (_, block) in blocks.iter() {
+        for block in blocks.values() {
             if let Some(block) = block.upgrade() {
                 merge_ranges(&mut ranges, block.allocated_port_ranges());
             }

nat/src/stateful/nf.rs

@@ -148,10 +148,7 @@ impl StatefulNat {
             | NatFlowStatus::CHalfClose
             | NatFlowStatus::SHalfClose
             | NatFlowStatus::LastAck => Some(Self::MASQUERADE_CLOSING_TIMEOUT),
-            NatFlowStatus::OneWay => {
-                warn!("Unexpected oneway state");
-                None
-            }
+            NatFlowStatus::OneWay => None,
         };
 
         // extend the duration of the flow according to the new status