ci: run tests on Android emulator (#2058)

mxinden · larseggert · web-flow · commit e660b0b8949c · 2025-03-15T11:24:28.000+02:00
* ci: run tests on Android emulator

* Use different cache key for Android NSS builds

* ndk

* Set ANDROID_NDK_HOME

* Use installed NDK

* Again

* Fix

* Again

* Fixes

* Fix parameter

* Fix

* Android

* Patch

* endsWith

* nspr.sh

* before

* sed

* sysroot

* long

* target

* Again

* ln

* quote

* ln

* Again

* toolchain

* again

* Again

* Again

* Again

* env

* Again

* elif

* Again

* Again

* Again

* Again

* -mandroid

* nspr

* Again

* nspr

* Again

* dash

* Switch

* arch

* space

* cpp

* Again

* cpp

* cpp

* ar

* ranlib

* target

* Use script

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* ARGH

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Fixes

* More

* MSRV

* mtu 0.2.7

* Fixes

* mold

* Again

* ls

* tmp

* include

* Again

* Again

* Again

* sysroot

* Again

* lib

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* c++

* Again

* Again

* Again

* Again

* 24

* 25

* pkix

* API level

* Again

* Fixes for 32-bit platforms

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* Again

* NSS_DB_PATH

* Again

* Again

* Fix

* clippy

* Android ECN test

* Update neqo-crypto/src/lib.rs

Co-authored-by: Max Inden &lt;mail@max-inden.de&gt;
Signed-off-by: Lars Eggert &lt;lars@eggert.org&gt;

* Pin `mozilla/application-services` scripts to `v137.0`

* Undo 32-bit changes

* Reorder libs

---------

Signed-off-by: Lars Eggert &lt;lars@eggert.org&gt;
Co-authored-by: Lars Eggert &lt;lars@eggert.org&gt;
diff --git a/.github/actions/nss/action.yml b/.github/actions/nss/action.yml
@@ -8,13 +8,16 @@ inputs:
   minimum-version:
     description: "Minimum required version of NSS"
     required: true
+  target:
+    description: "Target for cross-compilation"
+    default: ""
 
 runs:
   using: composite
   steps:
     - name: Install system NSS (Linux)
       shell: bash
-      if: ${{ runner.os == 'Linux' && runner.environment == 'github-hosted' }}
+      if: ${{ runner.os == 'Linux' && runner.environment == 'github-hosted' && inputs.target == '' }}
       env:
         DEBIAN_FRONTEND: noninteractive
       run: |
@@ -23,7 +26,7 @@ runs:
 
     - name: Install system NSS (MacOS)
       shell: bash
-      if: ${{ runner.os == 'MacOS' && runner.environment == 'github-hosted' }}
+      if: ${{ runner.os == 'MacOS' && runner.environment == 'github-hosted' && inputs.target == '' }}
       run: |
         [ "$BREW_UPDATED" ] || brew update && echo "BREW_UPDATED=1" >> "$GITHUB_ENV"
         brew install nss
@@ -33,6 +36,7 @@ runs:
       env:
         MIN_VERSION: ${{ inputs.minimum-version }}
       shell: bash
+      if: inputs.target == ''
       run: |
         if ! command -v pkg-config &> /dev/null; then
           echo "pkg-config: not found"
@@ -116,7 +120,7 @@ runs:
       uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
       with:
         path: dist
-        key: nss-${{ runner.os }}-${{ runner.arch }}-${{ inputs.type }}-${{ steps.heads.outputs.nss_head }}-${{ steps.heads.outputs.NSPR_HEAD }}
+        key: nss-${{ inputs.target && inputs.target || runner.os }}-${{ runner.arch }}-${{ inputs.type }}-${{ steps.heads.outputs.nss_head }}-${{ steps.heads.outputs.NSPR_HEAD }}
 
     - name: Check if build is needed
       id: check_build
@@ -184,9 +188,10 @@ runs:
       if: ${{ !steps.nss.outputs.use_system_nss }}
       env:
         NSS_TARGET: ${{ inputs.type }}
+        NSS_TYPE: ${{ inputs.type }}
         NSS_DIR: ${{ github.workspace }}/nss
       run: |
-        NSS_OUT="${{ github.workspace }}/nss/../dist/$NSS_TARGET"
+        NSS_OUT="${{ github.workspace }}/dist/$NSS_TARGET"
         {
           echo "LD_LIBRARY_PATH=$NSS_OUT/lib"
           echo "DYLD_FALLBACK_LIBRARY_PATH=$NSS_OUT/lib"
@@ -202,7 +207,7 @@ runs:
       shell: bash
       if: ${{ steps.check_build.outputs.build_nss }}
       env:
-        NSS_TARGET: ${{ inputs.type }}
+        TARGET_PLATFORM: ${{ inputs.target }}
       run: |
         if [ "$NSS_TARGET" != "Debug" ]; then
           # We want to do an optimized build for accurate CPU profiling, but
@@ -211,5 +216,40 @@ runs:
           OPT="-o"
           [ "${{ runner.os }}" != "Windows" ] && export CFLAGS="-ggdb3 -fno-omit-frame-pointer"
         fi
-        [ "$SCCACHE_CC" ] && [ "$SCCACHE_CXX" ] && export CC="$SCCACHE_CC" CXX="$SCCACHE_CXX"
-        $NSS_DIR/build.sh -g -Ddisable_tests=1 $OPT --static
+        if [[ $TARGET_PLATFORM == *-android* ]]; then
+          for file in build-nss-android.sh build-android-common.sh; do
+            curl -o "$file" -sSf "https://raw.githubusercontent.com/mozilla/application-services/refs/tags/v137.0/libs/$file"
+            chmod +x "$file"
+          done
+          # See https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md#android
+          ANDROID_NDK_VERSION=$(basename "$ANDROID_NDK" | cut -d. -f1)
+          # See https://github.com/mozilla/application-services/blob/46cacda811da094653dc8e93158956f4cd57e87a/libs/build-all.sh#L89-L102
+          # It figures that NSPR would require monkey-patching to build on Android.
+          sed -i'' 's/if test -z "$android_ndk" ; then/$as_echo "#define ANDROID 1" >>confdefs.h\n    ;;\nunreachable)\n    if test -z "$android_ndk" ; then/g' nspr/configure
+          ./build-nss-android.sh "$(pwd)" "/tmp/dist" "$ANDROID_NDK/toolchains/llvm/prebuilt/linux-x86_64" "$TARGET_PLATFORM" "$ANDROID_NDK_VERSION"
+          # Manually move the temporary build directory to the final location, which is what neqo-crypto expects.
+          find /tmp/tmp.* > tmp
+          CERTUTIL="$(grep certutil tmp)"
+          TARGET_DIR="$(dirname $(dirname $CERTUTIL))"
+          mkdir -p "dist/$NSS_TARGET"
+          cp -vaL "$TARGET_DIR"/* "dist/$NSS_TARGET/"
+          NSPR_H="$(grep nspr.h tmp)"
+          INCLUDE_DIR="$(dirname $NSPR_H)"
+          mkdir -p "dist/$NSS_TARGET/include/nspr"
+          cp -vaL "$INCLUDE_DIR"/* "dist/$NSS_TARGET/include/nspr"
+          CHACHA="$(grep chacha20poly1305.h tmp)"
+          PRIVATE_DIR="$(dirname $(dirname $CHACHA))"
+          mkdir -p "dist/private"
+          cp -vaL "$PRIVATE_DIR"/* "dist/private/"
+          UTILRENAME="$(grep utilrename.h tmp)"
+          PUBLIC_DIR="$(dirname $(dirname $(dirname $UTILRENAME)))"
+          mkdir -p "dist/public"
+          cp -vaL "$PUBLIC_DIR"/* "dist/"
+          LIBNSPR4="$(grep lib/libnspr4.a tmp)"
+          LIB_DIR="$(dirname $LIBNSPR4)"
+          mkdir -p "dist/$NSS_TARGET/lib"
+          cp -vaL "$LIB_DIR"/* "dist/$NSS_TARGET/lib"
+        else
+          [ "$SCCACHE_CC" ] && [ "$SCCACHE_CXX" ] && export CC="$SCCACHE_CC" CXX="$SCCACHE_CXX"
+          $NSS_DIR/build.sh -g -Ddisable_tests=1 $OPT --static
+        fi
diff --git a/.github/actions/rust/action.yml b/.github/actions/rust/action.yml
@@ -38,9 +38,9 @@ runs:
       if: ${{ env.SCCACHE_ENABLED != '1' && runner.environment != 'github-hosted' }}
       uses: mozilla-actions/sccache-action@2e7f9ec7921547d4b46598398ca573513895d0bd # v0.0.4
 
-    - name: Install build dependencies (Linux)
+    - name: Install mold (Linux)
       shell: bash
-      if: ${{ runner.os == 'Linux' && runner.environment == 'github-hosted' }}
+      if: ${{ runner.os == 'Linux' && runner.environment == 'github-hosted' && !contains(inputs.targets, '-android')}}
       env:
         DEBIAN_FRONTEND: noninteractive
       run: |
@@ -52,11 +52,13 @@ runs:
     # See https://corrode.dev/blog/tips-for-faster-ci-builds/
     - name: Set up build environment
       shell: bash
+      env:
+        TARGETS: ${{ inputs.targets }}
       run: |
         {
           echo "CARGO_PROFILE_RELEASE_LTO=true"
           echo "CARGO_PROFILE_RELEASE_CODEGEN_UNITS=1"
-          if [[ "${{ runner.os }}" == "Linux" && "${{ inputs.targets }}" == "" && "$(command -v mold)" ]]; then
+          if [[ "${{ runner.os }}" == "Linux" && "$TARGETS" == "" && "$(command -v mold)" ]]; then
             echo "RUSTFLAGS=-C linker=clang -C link-arg=-fuse-ld=mold $RUSTFLAGS"
           elif [[ "${{ runner.os }}" == "Windows" ]]; then
             echo "RUSTFLAGS=-C link-arg=-fuse-ld=lld $RUSTFLAGS"
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
@@ -151,3 +151,92 @@ jobs:
     needs: [check]
     if: ${{ !cancelled() && (github.event_name != 'workflow_dispatch' || github.event.inputs.run_benchmarks) && github.actor != 'dependabot[bot]' }}
     uses: ./.github/workflows/bench.yml
+
+  check-android:
+    runs-on: ubuntu-latest
+    env:
+      # https://searchfox.org/mozilla-central/search?q=NDK_VERSION =&path=python/mozboot/mozboot/android.py
+      NDK_VERSION: 27.2.12479018 # r27c
+      # https://searchfox.org/mozilla-central/search?q=\bapi_level=&path=taskcluster/scripts/misc/build-llvm-common.sh&regexp=true
+      # However, NSS requires an API >= 23 for a few symbols.
+      API_LEVEL: 23
+
+    strategy:
+      matrix:
+        include:
+          - target: x86_64-linux-android
+            emulator-arch: x86_64
+            # Note that x86_64 image is only available for API 21+. See
+            # https://github.com/ReactiveCircus/android-emulator-runner?tab=readme-ov-file#configurations.
+          - target: i686-linux-android
+            emulator-arch: x86
+          # FIXME: https://github.com/ReactiveCircus/android-emulator-runner/issues/404
+          # - target: armv7-linux-androideabi
+          #   emulator-arch: arm64-v8
+
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+        with:
+          distribution: zulu
+          java-version: 23
+
+      - uses: android-actions/setup-android@9fc6c4e9069bf8d3d10b2204b1fb8f6ef7065407 # v3.2.2
+      - run: sdkmanager --install "ndk;${{ env.NDK_VERSION }}"
+
+      - uses: ./.github/actions/rust
+        with:
+          version: stable
+          targets: ${{ matrix.target }}
+          tools: cargo-ndk
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: nss-version
+        run: echo "minimum=$(cat neqo-crypto/min_version.txt)" >> "$GITHUB_OUTPUT"
+
+      - uses: ./.github/actions/nss
+        with:
+          minimum-version: ${{ steps.nss-version.outputs.minimum }}
+          target: ${{ matrix.target }}
+
+      - run: cargo ndk --bindgen --platform "$API_LEVEL" --target ${{ matrix.target }} test --no-run
+
+      - env:
+          TARGET: ${{ matrix.target }}
+        run: |
+          echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666", OPTIONS+="static_node=kvm"' | sudo tee /etc/udev/rules.d/99-kvm4all.rules
+          sudo udevadm control --reload-rules
+          sudo udevadm trigger --name-match=kvm
+          cat <<'EOF' > /tmp/rust-android-run-tests-on-emulator.sh
+          #!/bin/bash
+          set -e
+          adb wait-for-device
+          while [ -z "$(adb shell getprop sys.boot_completed | tr -d '\r')" ]; do sleep 1; done
+          any_failures=0
+          TMP=/data/local/tmp
+          adb push "test-fixture/db" "$TMP/"
+          adb push "$LD_LIBRARY_PATH" "$TMP/"
+          for test in $(find target/$TARGET/debug/deps/ -type f -executable ! -name "*.so" -name "*-*"); do
+            adb push "$test" "$TMP/"
+            adb shell chmod +x "$TMP/$(basename "$test")"
+            # See https://unix.stackexchange.com/a/451140/409256
+            adb shell "CARGO_TERM_COLOR=always RUST_BACKTRACE=1 LD_LIBRARY_PATH=$TMP/lib NSS_DB_PATH=$TMP/db API_LEVEL=$API_LEVEL $TMP/$(basename "$test") || echo _FAIL_" 2>&1 | tee output
+            grep _FAIL_ output > /dev/null && any_failures=1
+          done
+          exit $any_failures
+          EOF
+          chmod a+x /tmp/rust-android-run-tests-on-emulator.sh
+
+      - uses: reactivecircus/android-emulator-runner@62dbb605bba737720e10b196cb4220d374026a6d # v2.33.0
+        with:
+          api-level: ${{ env.API_LEVEL }}
+          arch: ${{ matrix.emulator-arch == 'arm64-v8' && 'arm64-v8a' || matrix.emulator-arch }}
+          ndk: ${{ env.NDK_VERSION }}
+          emulator-boot-timeout: 120
+          disk-size: 2G
+          script: /tmp/rust-android-run-tests-on-emulator.sh
+        env:
+          TARGET: ${{ matrix.target }}
diff --git a/Cargo.toml b/Cargo.toml
@@ -77,7 +77,7 @@ infinite_loop = "warn"
 large_include_file = "warn"
 let_underscore_must_use = "warn"
 let_underscore_untyped = "warn"
-literal_string_with_formatting_args = "allow" # FIXME: Re-enable "warn" when MRSV is > 1.87. See https://github.com/rust-lang/rust-clippy/pull/13953#issuecomment-2676336899
+literal_string_with_formatting_args = "allow" # FIXME: Re-enable "warn" when MSRV is > 1.87. See https://github.com/rust-lang/rust-clippy/pull/13953#issuecomment-2676336899
 lossy_float_literal = "warn"
 mem_forget = "warn"
 mixed_read_write_in_expression = "warn"
diff --git a/neqo-crypto/build.rs b/neqo-crypto/build.rs
@@ -185,7 +185,11 @@ fn static_link() {
     // Dynamic libs that aren't transitively included by NSS libs.
     let mut other_libs = Vec::new();
     if env::consts::OS != "windows" {
-        other_libs.extend_from_slice(&["pthread", "dl", "c", "z"]);
+        if env::var("CARGO_CFG_TARGET_OS").unwrap_or_default() != "android" {
+            // On Android, pthread is part of libc.
+            other_libs.push("pthread");
+        }
+        other_libs.extend_from_slice(&["dl", "c", "z"]);
     }
     if env::consts::OS == "macos" {
         other_libs.push("sqlite3");
diff --git a/neqo-crypto/src/lib.rs b/neqo-crypto/src/lib.rs
@@ -28,7 +28,7 @@ pub mod selfencrypt;
 mod ssl;
 mod time;
 
-use std::{ffi::CString, path::PathBuf, ptr::null, sync::OnceLock};
+use std::{env, ffi::CString, path::PathBuf, ptr::null, sync::OnceLock};
 
 #[cfg(not(feature = "disable-encryption"))]
 pub use self::aead::RealAead as Aead;
@@ -167,6 +167,9 @@ pub fn init() -> Res<()> {
 ///
 /// If NSS cannot be initialized.
 pub fn init_db<P: Into<PathBuf>>(dir: P) -> Res<()> {
+    // Allow overriding the NSS database path with an environment variable.
+    let dir = env::var("NSS_DB_PATH")
+        .unwrap_or(dir.into().to_str().ok_or(Error::InternalError)?.to_string());
     let res = INITIALIZED.get_or_init(|| init_once(Some(dir.into())));
     res.as_ref().map(|_| ()).map_err(Clone::clone)
 }
diff --git a/neqo-udp/src/lib.rs b/neqo-udp/src/lib.rs
@@ -218,6 +218,8 @@ impl<S: SocketRef> Socket<S> {
 
 #[cfg(test)]
 mod tests {
+    use std::env;
+
     use neqo_common::{IpTosDscp, IpTosEcn};
 
     use super::*;
@@ -268,11 +270,25 @@ mod tests {
             .expect("receive to succeed");
 
         // Assert that the ECN is correct.
-        assert_eq!(
-            IpTosEcn::from(datagram.tos()),
-            IpTosEcn::from(received_datagrams.next().unwrap().tos())
-        );
-
+        // On Android API level <= 25 the IPv4 `IP_TOS` control message is
+        // not supported and thus ECN bits can not be received.
+        if cfg!(target_os = "android")
+            && env::var("API_LEVEL")
+                .ok()
+                .and_then(|v| v.parse::<u32>().ok())
+                .expect("API_LEVEL environment variable to be set on Android")
+                <= 25
+        {
+            assert_eq!(
+                IpTosEcn::default(),
+                IpTosEcn::from(received_datagrams.next().unwrap().tos())
+            );
+        } else {
+            assert_eq!(
+                IpTosEcn::from(datagram.tos()),
+                IpTosEcn::from(received_datagrams.next().unwrap().tos())
+            );
+        }
         Ok(())
     }
 
