Make PAC backends platform-aware (#16)

Author: chrmarti

.github/workflows/ci.yml

@@ -23,15 +23,15 @@ jobs:
           # backend — wasm2c is what makes the sandbox reachable there). The
           # shipped proxytester artifact is a separate single-backend build:
           # Wasmtime everywhere, wasm2c on armv7 (`artifact_features`).
-          # Single-backend combinations (WinHTTP-only, native-only, ...) are
+          # Single-backend combinations (WinHTTP fallback, native-only, ...) are
           # additionally covered by the `pac-backend-variants` job below.
           #
           # The native engine needs a C toolchain for the QuickJS sources
           # (MSVC on Windows, `cross` images on ARM Linux); wasm2c needs the
           # pinned `wasm2c` binary (installed below; the cross containers get
           # it via Cross.toml pre-build hooks).
 
-          # Windows (WinHTTP still handles normal resolution).
+          # Windows.
           - name: windows x64
             os: windows-latest
             target: x86_64-pc-windows-msvc
@@ -159,7 +159,7 @@ jobs:
         run: ${{ matrix.use_cross && 'cross' || 'cargo' }} test --target ${{ matrix.target }} ${{ matrix.features }}
         shell: bash
 
-      - name: Build Node addon (wasm2c)
+      - name: Build Node addon
         if: ${{ !matrix.use_cross }}
         run: node npm/scripts/build-native.js ${{ matrix.target }}
         shell: bash
@@ -183,7 +183,7 @@ jobs:
           mkdir -p "$stage"
           # The PAC engine (Wasmtime + AOT guest; the wasm2c sandbox on armv7)
           # is statically linked into the binary, so proxytester is
-          # self-contained (WinHTTP handles normal resolution on Windows).
+          # self-contained.
           cp "target/${{ matrix.target }}/release/examples/proxytester${ext}" "$stage/"
         shell: bash
 
@@ -233,17 +233,21 @@ jobs:
       # These tests read the real OS proxy config after configuring it, so they
       # only run here (gated behind OS_PROXY_RESOLVER_OS_TESTS). On Linux the
       # whole thing runs under a private D-Bus session.
-      # These tests only exercise OS-config reading, not PAC, but the crate
-      # still needs a backend to compile on non-Windows. Use the default
-      # (Wasmtime) backend, which needs no C toolchain.
+      # These tests only exercise OS-config reading, not PAC. Non-Windows still
+      # needs an explicit backend to compile; Windows intentionally uses its
+      # backend-less WinHTTP default.
       - name: Run OS round-trip tests
         env:
           OS_PROXY_RESOLVER_OS_TESTS: "1"
         run: |
+          features="tokio"
+          if [ "${{ matrix.os }}" != "windows-latest" ]; then
+            features="tokio pac-engine-wasmtime"
+          fi
           if [ "${{ matrix.os }}" = "ubuntu-latest" ]; then
-            dbus-run-session -- cargo test --features tokio os_roundtrip -- --nocapture
+            dbus-run-session -- cargo test --features "$features" os_roundtrip -- --nocapture
           else
-            cargo test --features tokio os_roundtrip -- --nocapture
+            cargo test --features "$features" os_roundtrip -- --nocapture
           fi
         shell: bash
 
@@ -257,7 +261,8 @@ jobs:
           # Every engine available per OS is built and timed separately on the
           # same PAC script and URLs; their captured results are cross-checked
           # across processes:
-          #   windows      : WinHTTP + native QuickJS + Wasmtime AOT/JIT + wasm2c
+          #   windows      : native QuickJS + Wasmtime AOT/JIT + wasm2c;
+          #                  WinHTTP in a separate backend-less build
           #   macos/linux  : native QuickJS + Wasmtime AOT/JIT + wasm2c
           #   linux armv7  : native QuickJS + wasm2c (no Cranelift for 32-bit
           #                  ARM), built with `cross` and run under qemu — the
@@ -395,11 +400,13 @@ jobs:
           done
           echo "all embedded backends agree on all URLs"
 
-          # WinHTTP is part of every Windows binary regardless of embedded
-          # feature selection. Benchmark it once using the last artifact; it
-          # is intentionally excluded from the strict result diff because it
-          # may omit a trailing DIRECT fallback.
+          # WinHTTP resolution is only compiled when no embedded backend is
+          # selected. Build that variant separately; its results are excluded
+          # from the strict diff because WinHTTP may omit trailing DIRECT.
           if [ "$RUNNER_OS" = "Windows" ]; then
+            $CARGO build --release --example pac_bench $TARGET_FLAG \
+              --no-default-features --features tokio
+            printf '  %-26s: %s bytes\n' "winhttp" "$(wc -c < "$BIN" | tr -d ' ')"
             echo
             echo "pac_bench platform performance: winhttp"
             "$BIN" --backend winhttp --iterations ${{ matrix.iterations }}
@@ -421,19 +428,18 @@ jobs:
       fail-fast: false
       matrix:
         include:
-          # WinHTTP-only pure-Rust Windows build: no embedded engine at all.
-          # Valid on Windows because WinHTTP handles PAC.
-          - name: windows WinHTTP-only (pure Rust)
+          # Backend-less Windows build: WinHTTP handles PAC and WPAD.
+          - name: windows WinHTTP fallback
             os: windows-latest
             features: --no-default-features --features tokio
           # Native-only build (no wasm sandbox) on a 64-bit host.
           - name: linux native-only
             os: ubuntu-latest
             features: --no-default-features --features "tokio pac-engine"
-          # Wasmtime-only (the default feature set): no C toolchain use at all.
+          # Wasmtime-only: no native QuickJS.
           - name: linux wasmtime-only
             os: ubuntu-latest
-            features: --features tokio
+            features: --no-default-features --features "tokio pac-engine-wasmtime"
           # wasm2c-only: the sandbox without Wasmtime, as an armv7-style build
           # would use, but tested on a fast 64-bit host.
           - name: linux wasm2c-only

Cargo.lock

@@ -7,7 +7,7 @@ rust-version = "1.77"
 # the MIT-licensed quickjs-ng via the `rquickjs-sys` crate; the PAC helper
 # functions are original, implemented from the public PAC specification.
 license = "MIT"
-description = "Resolve the OS-configured proxy (static, PAC, WPAD) for a URL, with change notification. WinHTTP on Windows; SystemConfiguration/gsettings + an embedded QuickJS PAC engine on macOS/Linux."
+description = "Resolve the OS-configured proxy (static, PAC, WPAD) for a URL, with change notification and a sandboxed PAC engine."
 repository = "https://github.com/microsoft/os-proxy-resolver"
 keywords = ["proxy", "pac", "wpad", "winhttp", "system-proxy"]
 categories = ["network-programming", "os"]
@@ -17,18 +17,16 @@ crate-type = ["rlib", "cdylib"]
 
 [features]
 # PAC backend selection is explicit: enable at least one of `pac-engine`
-# (native QuickJS) and/or `pac-engine-wasmtime` (sandboxed). On non-Windows a
-# backend is required (there is no OS PAC evaluator) — building with neither is
-# a compile error; on Windows WinHTTP always handles PAC, so a backend-less
-# build is valid there. The default set enables the sandboxed Wasmtime backend
-# on every platform, which is also the default runtime `pac_backend`.
-default = ["pac-engine-wasmtime"]
+# (native QuickJS), `pac-engine-wasmtime` (sandboxed), or the other backends
+# below. On non-Windows a backend is required (there is no OS PAC evaluator),
+# so building with no features is a compile error. On Windows the default
+# backend-less build delegates PAC/WPAD resolution to WinHTTP.
+default = []
 # Async change notification via tokio::sync::watch.
 tokio = ["dep:tokio"]
 # The embedded native QuickJS PAC engine (compiles the quickjs-ng C sources via
-# `rquickjs-sys`). Optional on every platform. Off Windows it is one of the two
-# selectable backends; on Windows it is additionally useful for the `pac_bench`
-# WinHTTP-vs-embedded comparison.
+# `rquickjs-sys`). Optional on every platform and selected for normal PAC
+# resolution when it is the configured backend.
 pac-engine = ["dep:rquickjs-sys"]
 # The sandboxed PAC backend: QuickJS-NG compiled to WebAssembly (see
 # pac-wasm-guest/), run under Wasmtime in AOT mode. The runtime dependency is
@@ -91,8 +89,9 @@ wasmtime = { version = "=46.0.1", optional = true, default-features = false, fea
 cc = { version = "1", optional = true }
 
 [target.'cfg(not(windows))'.dependencies]
-# PAC / wpad.dat fetching. Sync, small, rustls-backed so no OpenSSL cross headaches.
-ureq = { version = "2", default-features = false, features = ["tls", "gzip"] }
+# PAC / wpad.dat fetching. Sync and rustls-backed, loading roots from the OS
+# trust store so locally installed enterprise CAs are honored.
+ureq = { version = "2", default-features = false, features = ["tls", "native-certs", "gzip"] }
 # Embedded QuickJS-NG (MIT) for the native PAC engine. Vendors and compiles the
 # quickjs-ng C sources via `cc`. Optional (feature `pac-engine`) so a
 # Wasmtime-only build links no C engine.
@@ -113,10 +112,8 @@ windows-sys = { version = "0.60", features = [
     "Win32_System_Registry",
     "Win32_System_Threading",
 ] }
-# Optional on Windows so the default build stays pure Rust (WinHTTP handles
-# PAC). Enabled by the `pac-engine` feature for the WinHTTP-vs-QuickJS
-# benchmark. Off Windows the engine is always built (see the not(windows)
-# table above), where this crate is a required dependency.
+# Optional on Windows and enabled by the `pac-engine` feature, matching the
+# non-Windows dependency above.
 rquickjs-sys = { version = "0.12.1", optional = true }
 
 [dev-dependencies]

Cargo.toml

@@ -22,7 +22,8 @@ SOFTWARE.
 
 ---
 
-The embedded PAC engine (in src/pac/engine) links the QuickJS-NG JavaScript
-engine on macOS and Linux via the MIT-licensed rquickjs-sys crate. QuickJS-NG
-is also MIT-licensed. See ThirdPartyNotices.txt for details. The MIT license
-above applies to the first-party source of this project.
+The optional native PAC backend (in src/pac/engine) links the QuickJS-NG
+JavaScript engine on every supported platform via the MIT-licensed
+rquickjs-sys crate. QuickJS-NG is also MIT-licensed. See
+ThirdPartyNotices.txt for details. The MIT license above applies to the
+first-party source of this project.