(03) clock

.cargo/mutants.toml

@@ -0,0 +1,13 @@
+
+exclude_re = [
+    "<impl Display for",
+    "<impl Debug for",
+    "<impl std::fmt::Display for",
+    "<impl std::fmt::Debug for",
+
+    "contract::",
+]
+
+exclude_globs = [
+    "sysfs/**",
+]

.semgrep/rules/no-std-time-direct.yaml

@@ -0,0 +1,25 @@
+rules:
+  - id: rust-no-direct-clock-read
+    languages: [rust]
+    severity: ERROR
+    message: |
+      Read the clock via `clock::now()` (or `clock::system_now()` for wall
+      time), not `Instant::now()` / `SystemTime::now()`. The workspace's
+      `clock` facade reads `std` in production and tokio's pausable clock
+      under the `virtual` feature; reading `std` directly pins the deadline
+      to the wall clock while the timer waiting on it follows tokio's, so a
+      test that advances time sees the two diverge.
+
+      `Duration` needs no facade -- it is a plain value with no clock in it,
+      and `clock` re-exports it only for convenience.
+    paths:
+      exclude:
+        - .codeql/tests/
+        - clock/src/
+        - concurrency/tests/
+    pattern-either:
+      - pattern: Instant::now()
+      - pattern: std::time::Instant::now()
+      - pattern: SystemTime::now()
+      - pattern: std::time::SystemTime::now()
+      - pattern: tokio::time::Instant::now()

Cargo.toml

@@ -5,6 +5,7 @@ members = [
     "acl-filter",
     "args",
     "cli",
+    "clock",
     "common",
     "concurrency",
     "concurrency-macros",
@@ -71,6 +72,7 @@ acl-filter = { path = "./acl-filter", package = "dataplane-acl-filter", features
 args = { path = "./args", package = "dataplane-args", features = [] }
 cli = { path = "./cli", package = "dataplane-cli", features = [] }
 common = { path = "./common", package = "dataplane-common", features = [] }
+clock = { path = "./clock", package = "dataplane-clock", features = [] }
 concurrency = { path = "./concurrency", package = "dataplane-concurrency", features = [] }
 concurrency-macros = { path = "./concurrency-macros", package = "dataplane-concurrency-macros", features = [] }
 config = { path = "./config", package = "dataplane-config", features = [] }

acl-filter/Cargo.toml

@@ -7,6 +7,7 @@ version.workspace = true
 
 [dependencies]
 acl = { workspace = true }
+clock = { workspace = true }
 common = { workspace = true }
 concurrency = { workspace = true }
 config = { workspace = true }
@@ -22,6 +23,7 @@ tracectl = { workspace = true }
 tracing = { workspace = true }
 
 [dev-dependencies]
+clock = { workspace = true, features = ["virtual"] }
 # The reference (linear-scan) ACL backend is the differential-test oracle and drives the fast,
 # EAL-free semantic suite. It is `cfg(test)`-gated in the source, so it is never part of a
 # production build; this dev-dep just makes `acl::reference` available to test builds.

acl-filter/src/tests.rs

@@ -36,7 +36,7 @@ use concurrency::sync::Arc;
 use pipeline::NetworkFunction;
 
 use std::net::{Ipv4Addr, Ipv6Addr};
-use std::time::{Duration, Instant};
+use std::time::Duration;
 
 // VNIs and IP ranges used by the standard two-VPC peering (vpc1 <-> vpc2). The manifest names
 // ("vpc1"/"vpc2") double as the ACL rule `from`/`to` endpoints.
@@ -670,7 +670,7 @@ fn ipv6_allow_and_default_deny() {
 // reply's weak `related` reference can still be upgraded.
 fn attach_related_flow(reply: &mut Packet<TestBuffer>, fwd_key: FlowKey) -> Arc<FlowInfo> {
     let reply_key = FlowKey::try_from(&*reply).unwrap();
-    let expiry = Instant::now() + Duration::from_secs(60);
+    let expiry = clock::now() + Duration::from_secs(60);
     let (fwd_flow, reply_flow) = FlowInfo::related_pair(
         expiry,
         fwd_key,

acl/Cargo.toml

@@ -12,6 +12,7 @@ reference = []
 
 [dependencies]
 arrayvec = { workspace = true, default-features = true }
+clock = { workspace = true }
 concurrency = { workspace = true, features = [] }
 dpdk = { workspace = true, optional = true }
 lookup = { workspace = true, features = [] }
@@ -20,6 +21,7 @@ net = { workspace = true, features = [] }
 thiserror = { workspace = true }
 
 [dev-dependencies]
+clock = { workspace = true, features = ["virtual"] }
 # Enable the "reference" backend for this crate's own tests and benches. It is a non-default feature
 # (production links only the rte_acl backend), but the integration tests and benches
 # differential-test against it, so make it available whenever test/bench targets are built.

acl/src/dpdk/dyn_table.rs

@@ -494,7 +494,6 @@ mod tests {
     use lookup::Lookup;
     use match_action::{Erased, ExactSpec, MaskSpec, MatchKey, PrefixSpec, RangeSpec};
     use std::hint::black_box;
-    use std::time::Instant;
 
     #[derive(MatchKey, Debug, Clone, Copy)]
     struct FiveTuple {
@@ -969,7 +968,7 @@ mod tests {
                 let rules = make(n);
                 let max = NonZero::new(u32::try_from(n).unwrap()).unwrap();
                 let rss_before = rss_kb();
-                let t = Instant::now();
+                let t = clock::now();
                 let res: Result<DpdkAclLookup<RemoteKey<Ipv4Addr>, u32>, _> =
                     install_table(&unique_name("cap"), max, rules);
                 let dt = t.elapsed().as_secs_f64() * 1e3;

clock/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "dataplane-clock"
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+version.workspace = true
+
+[features]
+default = []
+virtual = ["dep:tokio"]
+
+[dependencies]
+tokio = { workspace = true, optional = true, features = ["test-util", "time"] }

clock/src/lib.rs

@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Open Network Fabric Authors
+
+#![deny(clippy::all, clippy::pedantic)]
+#![deny(rustdoc::all)]
+#![deny(unsafe_code)]
+
+pub use std::time::{Duration, Instant, SystemTime, SystemTimeError, TryFromFloatSecsError};
+
+#[must_use]
+pub fn now() -> Instant {
+    #[cfg(feature = "virtual")]
+    {
+        tokio::time::Instant::now().into_std()
+    }
+    #[cfg(not(feature = "virtual"))]
+    {
+        Instant::now()
+    }
+}
+
+#[must_use]
+pub fn system_now() -> SystemTime {
+    SystemTime::now()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{Duration, now, system_now};
+
+    #[test]
+    fn now_is_monotonic() {
+        let first = now();
+        let second = now();
+        assert!(second >= first, "the monotonic clock went backwards");
+    }
+
+    #[test]
+    fn now_works_with_no_runtime() {
+        let _ = now();
+        let _ = system_now();
+    }
+
+    #[test]
+    fn durations_are_plain_values() {
+        assert_eq!(Duration::from_secs(1).as_millis(), 1000);
+    }
+}

config/Cargo.toml

@@ -10,6 +10,7 @@ bolero = ["dep:bolero", "lpm/bolero"]
 
 [dependencies]
 # internal
+clock = { workspace = true }
 common = { workspace = true }
 concurrency = { workspace = true }
 k8s-intf = { workspace = true }
@@ -33,6 +34,7 @@ linkme = { workspace = true }
 tracectl = { workspace = true }
 
 [dev-dependencies]
+clock = { workspace = true, features = ["virtual"] }
 # internal
 pipeline = { workspace = true } # should be removed w/ NAT
 lpm = { workspace = true, features = ["bolero", "testing"] }