rustls · ctz · May 21, 2025 · May 21, 2025 · May 21, 2025 · May 21, 2025
diff --git a/bogo/src/main.rs b/bogo/src/main.rs
@@ -4,9 +4,23 @@
 // https://boringssl.googlesource.com/boringssl/+/master/ssl/test
 //
 
-#![allow(clippy::disallowed_types)]
-
-use std::fmt::{Debug, Formatter};
+#![warn(
+    clippy::alloc_instead_of_core,
+    clippy::clone_on_ref_ptr,
+    clippy::manual_let_else,
+    clippy::std_instead_of_core,
+    clippy::use_self,
+    clippy::upper_case_acronyms,
+    elided_lifetimes_in_paths,
+    trivial_casts,
+    trivial_numeric_casts,
+    unreachable_pub,
+    unused_import_braces,
+    unused_extern_crates,
+    unused_qualifications
+)]
+
+use core::fmt::{Debug, Formatter};
 use std::io::{self, Read, Write};
 use std::sync::Arc;
 use std::{env, net, process, thread, time};
@@ -119,7 +133,7 @@ struct Options {
 impl Options {
     fn new() -> Self {
         let selected_provider = SelectedProvider::from_env();
-        Options {
+        Self {
             port: 0,
             shim_id: 0,
             side: Side::Client,
@@ -402,7 +416,7 @@ struct DummyServerAuth {
 
 impl DummyServerAuth {
     fn new(trusted_cert_file: &str) -> Self {
-        DummyServerAuth {
+        Self {
             parent: WebPkiServerVerifier::builder_with_provider(
                 load_root_certs(trusted_cert_file),
                 SelectedProvider::from_env()
@@ -478,10 +492,10 @@ struct FixedSignatureSchemeServerCertResolver {
 }
 
 impl server::ResolvesServerCert for FixedSignatureSchemeServerCertResolver {
-    fn resolve(&self, client_hello: ClientHello) -> Option<Arc<sign::CertifiedKey>> {
+    fn resolve(&self, client_hello: ClientHello<'_>) -> Option<Arc<sign::CertifiedKey>> {
         let mut certkey = self.resolver.resolve(client_hello)?;
         Arc::make_mut(&mut certkey).key = Arc::new(FixedSignatureSchemeSigningKey {
-            key: certkey.key.clone(),
+            key: Arc::clone(&certkey.key),
             scheme: self.scheme,
         });
         Some(certkey)
@@ -507,7 +521,7 @@ impl client::ResolvesClientCert for FixedSignatureSchemeClientCertResolver {
             .resolver
             .resolve(root_hint_subjects, sigschemes)?;
         Arc::make_mut(&mut certkey).key = Arc::new(FixedSignatureSchemeSigningKey {
-            key: certkey.key.clone(),
+            key: Arc::clone(&certkey.key),
             scheme: self.scheme,
         });
         Some(certkey)
@@ -607,7 +621,7 @@ fn make_server_cfg(opts: &Options) -> Arc<ServerConfig> {
                 opts.root_hint_subjects.clone(),
             ))
         } else {
-            server::WebPkiClientVerifier::no_client_auth()
+            WebPkiClientVerifier::no_client_auth()
         };
 
     let cert = CertificateDer::pem_file_iter(&opts.cert_file)
@@ -640,7 +654,7 @@ fn make_server_cfg(opts: &Options) -> Arc<ServerConfig> {
     if opts.use_signing_scheme > 0 {
         let scheme = lookup_scheme(opts.use_signing_scheme);
         cfg.cert_resolver = Arc::new(FixedSignatureSchemeServerCertResolver {
-            resolver: cfg.cert_resolver.clone(),
+            resolver: Arc::clone(&cfg.cert_resolver),
             scheme,
         });
     }
@@ -692,8 +706,8 @@ struct ClientCacheWithoutKxHints {
 }
 
 impl ClientCacheWithoutKxHints {
-    fn new(delay: u32) -> Arc<ClientCacheWithoutKxHints> {
-        Arc::new(ClientCacheWithoutKxHints {
+    fn new(delay: u32) -> Arc<Self> {
+        Arc::new(Self {
             delay,
             storage: Arc::new(client::ClientSessionMemoryCache::new(32)),
         })
@@ -748,7 +762,7 @@ impl client::ClientSessionStore for ClientCacheWithoutKxHints {
 }
 
 impl Debug for ClientCacheWithoutKxHints {
-    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+    fn fmt(&self, f: &mut Formatter<'_>) -> core::fmt::Result {
         // Note: we omit self.storage here as it may contain sensitive data.
         f.debug_struct("ClientCacheWithoutKxHints")
             .field("delay", &self.delay)
@@ -811,7 +825,7 @@ fn make_client_cfg(opts: &Options) -> Arc<ClientConfig> {
     if !opts.cert_file.is_empty() && opts.use_signing_scheme > 0 {
         let scheme = lookup_scheme(opts.use_signing_scheme);
         cfg.client_auth_cert_resolver = Arc::new(FixedSignatureSchemeClientCertResolver {
-            resolver: cfg.client_auth_cert_resolver.clone(),
+            resolver: Arc::clone(&cfg.client_auth_cert_resolver),
             scheme,
         });
     }

diff --git a/ci-bench/src/benchmark.rs b/ci-bench/src/benchmark.rs
@@ -12,7 +12,7 @@ use rustls_test::KeyType;
 /// Benchmarks can be invalid because of the following reasons:
 ///
 /// - Re-using an already defined benchmark name.
-pub fn validate_benchmarks(benchmarks: &[Benchmark]) -> anyhow::Result<()> {
+pub(crate) fn validate_benchmarks(benchmarks: &[Benchmark]) -> anyhow::Result<()> {
     // Detect duplicate definitions
     let duplicate_names: Vec<_> = benchmarks
         .iter()
@@ -30,7 +30,7 @@ pub fn validate_benchmarks(benchmarks: &[Benchmark]) -> anyhow::Result<()> {
 }
 
 /// Get the reported instruction counts for the provided benchmark
-pub fn get_reported_instr_count(
+pub(crate) fn get_reported_instr_count(
     bench: &Benchmark,
     results: &FxHashMap<&str, InstructionCounts>,
 ) -> InstructionCounts {
@@ -50,8 +50,8 @@ impl BenchmarkKind {
     /// Returns the [`ResumptionKind`] used in the handshake part of the benchmark
     pub fn resumption_kind(self) -> ResumptionKind {
         match self {
-            BenchmarkKind::Handshake(kind) => kind,
-            BenchmarkKind::Transfer => ResumptionKind::No,
+            Self::Handshake(kind) => kind,
+            Self::Transfer => ResumptionKind::No,
         }
     }
 }
@@ -68,7 +68,7 @@ pub enum ResumptionKind {
 }
 
 impl ResumptionKind {
-    pub const ALL: &'static [ResumptionKind] = &[Self::No, Self::SessionId, Self::Tickets];
+    pub const ALL: &'static [Self] = &[Self::No, Self::SessionId, Self::Tickets];
 
     /// Returns a user-facing label that identifies the resumption kind
     pub fn label(&self) -> &'static str {

diff --git a/ci-bench/src/callgrind.rs b/ci-bench/src/callgrind.rs
@@ -1,6 +1,6 @@
+use core::ops::Sub;
 use std::fs::File;
 use std::io::{BufRead, BufReader};
-use std::ops::Sub;
 use std::path::{Path, PathBuf};
 use std::process::{Child, Command, Stdio};
 
@@ -13,7 +13,7 @@ use crate::benchmark::Benchmark;
 const CALLGRIND_OUTPUT_SUBDIR: &str = "callgrind";
 
 /// A callgrind-based benchmark runner
-pub struct CallgrindRunner {
+pub(crate) struct CallgrindRunner {
     /// The path to the ci-bench executable
     ///
     /// This is necessary because the callgrind runner works by spawning child processes
@@ -24,21 +24,21 @@ pub struct CallgrindRunner {
 
 impl CallgrindRunner {
     /// Returns a new callgrind-based benchmark runner
-    pub fn new(executable: String, output_dir: PathBuf) -> anyhow::Result<Self> {
+    pub(crate) fn new(executable: String, output_dir: PathBuf) -> anyhow::Result<Self> {
         Self::ensure_callgrind_available()?;
 
         let callgrind_output_dir = output_dir.join(CALLGRIND_OUTPUT_SUBDIR);
         std::fs::create_dir_all(&callgrind_output_dir)
             .context("Failed to create callgrind output directory")?;
 
-        Ok(CallgrindRunner {
+        Ok(Self {
             executable,
             output_dir: callgrind_output_dir,
         })
     }
 
     /// Runs the benchmark at the specified index and returns the instruction counts for each side
-    pub fn run_bench(
+    pub(crate) fn run_bench(
         &self,
         benchmark_index: u32,
         bench: &Benchmark,
@@ -194,24 +194,24 @@ fn parse_callgrind_output(file: &Path) -> anyhow::Result<u64> {
 
 /// The instruction counts, for each side, after running a benchmark
 #[derive(Copy, Clone)]
-pub struct InstructionCounts {
+pub(crate) struct InstructionCounts {
     pub client: u64,
     pub server: u64,
 }
 
 impl Sub for InstructionCounts {
-    type Output = InstructionCounts;
+    type Output = Self;
 
     fn sub(self, rhs: Self) -> Self::Output {
-        InstructionCounts {
+        Self {
             client: self.client - rhs.client,
             server: self.server - rhs.server,
         }
     }
 }
 
 /// Returns the detailed instruction diff between the baseline and the candidate
-pub fn diff(baseline: &Path, candidate: &Path, scenario: &str) -> anyhow::Result<String> {
+pub(crate) fn diff(baseline: &Path, candidate: &Path, scenario: &str) -> anyhow::Result<String> {
     // callgrind_annotate formats the callgrind output file, suitable for comparison with
     // callgrind_differ
     let callgrind_annotate_base = Command::new("callgrind_annotate")
@@ -279,7 +279,7 @@ impl CountInstructions {
     pub(crate) fn start() -> Self {
         #[cfg(target_os = "linux")]
         crabgrind::callgrind::toggle_collect();
-        CountInstructions
+        Self
     }
 }
 

diff --git a/ci-bench/src/main.rs b/ci-bench/src/main.rs
@@ -1,8 +1,24 @@
+#![warn(
+    clippy::alloc_instead_of_core,
+    clippy::clone_on_ref_ptr,
+    clippy::manual_let_else,
+    clippy::std_instead_of_core,
+    clippy::use_self,
+    clippy::upper_case_acronyms,
+    elided_lifetimes_in_paths,
+    trivial_casts,
+    trivial_numeric_casts,
+    unreachable_pub,
+    unused_import_braces,
+    unused_extern_crates,
+    unused_qualifications
+)]
+
+use core::hint::black_box;
+use core::mem;
 use std::collections::HashMap;
 use std::fs::File;
-use std::hint::black_box;
 use std::io::{self, BufRead, BufReader, Write};
-use std::mem;
 use std::os::fd::{AsRawFd, FromRawFd};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
@@ -102,8 +118,8 @@ impl Side {
     /// Returns the string representation of the side
     pub fn as_str(self) -> &'static str {
         match self {
-            Side::Client => "client",
-            Side::Server => "server",
+            Self::Client => "client",
+            Self::Server => "server",
         }
     }
 }
@@ -299,12 +315,14 @@ fn all_benchmarks_params() -> Vec<BenchmarkParams> {
         (
             derandomize(ring::default_provider()),
             ring::ALL_CIPHER_SUITES,
+            #[allow(trivial_casts)]
             &(ring_ticketer as fn() -> Arc<dyn rustls::server::ProducesTickets>),
             "ring",
         ),
         (
             derandomize(aws_lc_rs::default_provider()),
             aws_lc_rs::ALL_CIPHER_SUITES,
+            #[allow(trivial_casts)]
             &(aws_lc_rs_ticketer as fn() -> Arc<dyn rustls::server::ProducesTickets>),
             "aws_lc_rs",
         ),
@@ -534,7 +552,7 @@ impl BenchStepper for ClientSideStepper<'_> {
 
     async fn handshake(&mut self) -> anyhow::Result<Self::Endpoint> {
         let server_name = "localhost".try_into().unwrap();
-        let mut client = ClientConnection::new(self.config.clone(), server_name).unwrap();
+        let mut client = ClientConnection::new(Arc::clone(&self.config), server_name).unwrap();
         client.set_buffer_limit(None);
 
         loop {
@@ -610,7 +628,7 @@ impl BenchStepper for ServerSideStepper<'_> {
     type Endpoint = ServerConnection;
 
     async fn handshake(&mut self) -> anyhow::Result<Self::Endpoint> {
-        let mut server = ServerConnection::new(self.config.clone()).unwrap();
+        let mut server = ServerConnection::new(Arc::clone(&self.config)).unwrap();
         server.set_buffer_limit(None);
 
         while server.is_handshaking() {