cfrs v0.3.0-beta.9

The ninth prerelease of cfrs, for tests.

Binaries

File	System
cfrs-x86_64-unknown-linux-musl, pod-netns-x86_64-unknown-linux-musl	Linux x86-64
cfrs-aarch64-unknown-linux-musl, pod-netns-aarch64-unknown-linux-musl	Linux ARM64
cfrs-armv7-unknown-linux-musleabihf, pod-netns-armv7-unknown-linux-musleabihf	Linux ARMv7 (32-bit, hard float)
cfrs-arm-unknown-linux-musleabihf, pod-netns-arm-unknown-linux-musleabihf	Linux ARMv6 (32-bit, hard float)
cfrs-i686-unknown-linux-musl, pod-netns-i686-unknown-linux-musl	Linux x86 (32-bit)
cfrs-riscv64gc-unknown-linux-musl, pod-netns-riscv64gc-unknown-linux-musl	Linux RISC-V 64
cfrs-loongarch64-unknown-linux-musl, pod-netns-loongarch64-unknown-linux-musl	Linux LoongArch64
cfrs-powerpc64le-unknown-linux-musl, pod-netns-powerpc64le-unknown-linux-musl	Linux POWER, little-endian

Each binary is static (musl). It needs no C library on the host. cfrs.1
is the manual page.

The image is ghcr.io/azathothas/cfrs:v0.3.0-beta.9 (also :beta).

Check a download

sha256sum -c SHA256SUMS --ignore-missing
gh attestation verify cfrs-x86_64-unknown-linux-musl --repo Azathothas/cfrs
cosign verify-blob --bundle SHA256SUMS.sigstore.json \
  --certificate-identity https://github.com/Azathothas/cfrs/.github/workflows/release.yml@refs/tags/v0.3.0-beta.9 \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com SHA256SUMS
sh scripts/rebuild.sh v0.3.0-beta.9   # rebuild and compare (x86_64, aarch64)

cfrs update from 0.3.0-beta.8 does the first three checks itself.

Breaking

Changes that a command written for beta.8 can need:

• The TCP window of the userspace stack of WARP has no limit by default
  (before: 1 segment). CFRS_WARP_TCP_BURST=1 gives the old window (#100).
• smoltcp is 0.12 (before: 0.11), in cfrs and in pod-netns.
• The vnet stack takes an MTU from 576 (before: at least 1280).

Fixed

• An upload through the userspace stack of WARP (warp proxy, warp run, warp
  nc) of more than the send buffer sent some bytes twice: the TLS server
  answered bad record mac. Each byte now goes once. beta.8 and before have
  the fault (f55dd65).

Changes for a tester

Transports of the tunnel

• warp --masque-transport h3: MASQUE over HTTP/3 on UDP 443. Each IP packet
  is an HTTP datagram (#157).
• warp --transport wireguard: the tunnel on WireGuard (UDP 2408), with the
  device of warp export (#152).
• warp --carry wg: a second WireGuard device inside the tunnel; a
  destination sees its exit. With --transport wireguard, both hops are
  WireGuard (#154, #155).
• warp --cc none|reno|cubic: the congestion controller of the TCP
  connections of the stack (#134).

Proxy

• warp proxy --l4: one HTTP/3 CONNECT for each TCP client, with no IP
  stack (#140). The door of WARP does not take it yet: a report only.

Release

• scripts/rebuild.sh TAG: rebuild a release and compare it with
  SHA256SUMS. release-proofs.yml runs it for x86_64 and aarch64; the
  binaries of beta.8 were the same (#162).

Live numbers (a download of 20 MB through warp proxy, GitHub runner)

Transport	window 1	window 16	no limit
HTTP/2	7.1 to 8.9 MB/s	11.1 and 12.3 MB/s	11.6 to 16.8 MB/s
HTTP/3	9.5 and 9.6 MB/s	29.8 and 34.2 MB/s	44.8 and 66.1 MB/s

An upload of 16 MiB: 23 to 24 MB/s over HTTP/2 (each controller), 29 and
35 MB/s over HTTP/3, 28.5 MB/s over WireGuard.

The licenses of the crates in the binaries, with their texts: THIRD-PARTY-LICENSES.md.

The commits of this release

Other

• docs: v0.3.0-beta.8 is published (e1706c7)
• warp: an upload through the stack sent bytes twice; smoltcp 0.12 and --cc (#134) (f55dd65)
• warp: MASQUE over HTTP/3 on UDP 443 (--masque-transport h3) (#157) (165021d)
• release: rebuild a release from its tag and compare with SHA256SUMS (#162) (72259d2)
• warp: the variable of --masque-transport is CFRS_WARP_MASQUE_TRANSPORT (5b7fee6)
• warp: a WireGuard leg for the tunnel (--transport wireguard) (#152) (ece0155)
• live-batch2: the download over h3 and h2 with TCP windows 16 and none (#100) (b752443)
• warp proxy: --l4, one HTTP/3 CONNECT for each TCP client (#140) (9d30496)
• warp: --carry wg, a WireGuard device inside the tunnel (#154, #155); mac1 with zero reserved bytes (#152) (87cebb8)
• warp: the TCP window of the stack has no limit by default (#100); log the error of an L4 client (#140) (81e56d0)
• Version 0.3.0-beta.9; release notes (aa93371)
• warp proxy --l4: three forms of the CONNECT, for a test of the door (#140) (3e1e1a3)