# 1. 获取 WebRTC 源码（建议固定分支，如 branch-heads/5941）
fetch --nohooks webrtc_android
gclient sync

# 2. 编译 NLCC 独立二进制
gn gen out/nlcc --args='is_debug=false rtc_build_examples=false'
ninja -C out/nlcc network_link_conditioner

# 3. 验证二进制可用性
./out/nlcc/network_link_conditioner --help

# Dockerfile.nlcc
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y --no-install-recommends 
    libstdc++6 ca-certificates && rm -rf /var/lib/apt/lists/*
COPY network_link_conditioner /usr/local/bin/
ENTRYPOINT ["network_link_conditioner"]

# 构建与推送
docker build -f Dockerfile.nlcc -t registry.example.com/nlcc:v1.2.3 .
docker push registry.example.com/nlcc:v1.2.3

┌─────────────┐     ┌──────────────┐     ┌─────────────────┐
│  CI Server  │────▶│  NLCC Sidecar │────▶│  Device Farm /  │
│ (Jenkins/   │     │  (gRPC/CLI)  │     │  Emulator Cloud │
│  GitLab CI) │     └──────┬───────┘     └────────┬────────┘
└─────────────┘            │                      │
                           ▼                      ▼
                    ┌──────────────┐     ┌─────────────────┐
                    │  Test Runner │     │  Metrics Collector│
                    │ (Pytest/     │     │ (Prometheus +    │
                    │  Go Test)    │     │  Grafana /      │
                    └──────┬───────┘     │  InfluxDB)      │
                           │             └────────┬────────┘
                           ▼                      ▼
                    ┌──────────────┐     ┌─────────────────┐
                    │  Report Gen  │     │  Alert / Gate   │
                    │ (Allure/     │     │ (阈值判定、阻断 │
                    │  HTML)       │     │  合并请求)       │
                    └──────────────┘     └─────────────────┘

stages:
  - build
  - weaknet_test
  - report

variables:
  NLCC_IMAGE: registry.example.com/nlcc:v1.2.3
  NLCC_GRPC_ADDR: "localhost:50051"

# 1. 编译测试二进制 / 打包 APK/IPA
build_artifacts:
  stage: build
  script:
    - ./gradlew assembleDebug assembleAndroidTest
  artifacts:
    paths: [app/build/outputs/]
    expire_in: 1 week

# 2. 弱网矩阵测试（并行矩阵策略）
weaknet_matrix:
  stage: weaknet_test
  image: $NLCC_IMAGE
  services:
    - name: $NLCC_IMAGE
      alias: nlcc
      command: ["--grpc_port=50051", "--log_level=info"]
  parallel:
    matrix:
      - SCENARIO: ["L1", "L2", "L3"]
        DEVICE: ["pixel7_api33", "pixel6_api31"]
  variables:
    SCENARIO_PARAMS: |
      {"L1":{"bandwidth_kbps":2000,"latency_ms":40,"loss_pct":0.1,"jitter_ms":10},
       "L2":{"bandwidth_kbps":800,"latency_ms":100,"loss_pct":1,"jitter_ms":30},
       "L3":{"bandwidth_kbps":400,"latency_ms":200,"loss_pct":3,"jitter_ms":60}}
  script:
    - |
      python3 run_weaknet_suite.py 
        --scenario "$SCENARIO" 
        --device "$DEVICE" 
        --nlcc-grpc "$NLCC_GRPC_ADDR" 
        --params "$SCENARIO_PARAMS" 
        --output "reports/${SCENARIO}_${DEVICE}.json"
  artifacts:
    when: always
    reports:
      junit: reports/*_junit.xml
    paths: [reports/]
    expire_in: 30 days

# 3. 汇总报告与质量阈值判定
quality_gate:
  stage: report
  needs: [weaknet_matrix]
  script:
    - python3 evaluate_gate.py --input reports/ --threshold config/thresholds.yaml
  allow_failure: false  # 阻断合并

import grpc, json, subprocess, sys
from nlcc_pb2 import NetworkConfig, StartRequest, StopRequest
from nlcc_pb2_grpc import NetworkLinkConditionerStub

def apply_scenario(stub, params):
    cfg = NetworkConfig(
        uplink=NetworkConfig.LinkParams(
            bandwidth_kbps=params["bandwidth_kbps"],
            latency_ms=params["latency_ms"],
            loss_percent=params["loss_pct"],
            jitter_ms=params["jitter_ms"]
        ),
        downlink=NetworkConfig.LinkParams(...)  # 对称或非对称配置
    )
    stub.Start(StartRequest(config=cfg))

def run_test(device, scenario, out_path):
    # 1. 启动 NLCC 场景
    with grpc.insecure_channel(NLCC_GRPC_ADDR) as ch:
        stub = NetworkLinkConditionerStub(ch)
        apply_scenario(stub, SCENARIOS[scenario])
        try:
            # 2. 启动自动化用例（Appium / Espresso / 自研 Runner）
            result = subprocess.run(
                ["pytest", f"tests/{scenario}_suite.py", f"--device={device}"],
                capture_output=True, text=True, timeout=600
            )
            # 3. 采集指标并写报告
            collect_metrics(device, out_path)
        finally:
            # 4. 复位网络
            stub.Stop(StopRequest())
    return result.returncode == 0

L1_good_4g:
  freeze_rate_pct: "<= 1.0"
  first_frame_ms_p95: "<= 1500"
  mos_score: ">= 4.0"

L2_weak_4g:
  freeze_rate_pct: "<= 3.0"
  first_frame_ms_p95: "<= 3000"
  mos_score: ">= 3.5"

L3_3g_edge:
  freeze_rate_pct: "<= 8.0"
  first_frame_ms_p95: "<= 5000"
  reconnect_success_rate_pct: ">= 95"

FROM gcr.io/distroless/cc-debian12:nonroot AS runtime
COPY --from=builder /webrtc/out/nlcc/network_link_conditioner /nlcc
EXPOSE 50051
USER nonroot:nonroot
ENTRYPOINT ["/nlcc", "--grpc_port=50051", "--log_level=info"]

# 启动弱网（对称 400kbps / 200ms / 3% loss / 60ms jitter）
network_link_conditioner 
  --uplink_bandwidth_kbps=400 
  --downlink_bandwidth_kbps=400 
  --uplink_latency_ms=200 
  --downlink_latency_ms=200 
  --uplink_loss_percent=3 
  --downlink_loss_percent=3 
  --uplink_jitter_ms=60 
  --downlink_jitter_ms=60

# 停止并复位
network_link_conditioner --stop

// WeakNetVpnService.kt 核心流量转发逻辑
class WeakNetVpnService : VpnService() {
    private var tunnelThread: Thread? = null
    private val nlccGrpcClient = NlccGrpcClient("10.0.2.2", 50051) // 宿主机映射地址

    override fun onCreate() {
        // 1. 建立 TUN 接口
        val builder = Builder()
            .setMtu(1500)
            .addAddress("10.0.0.1", 24) // 虚拟网段
            .addRoute("0.0.0.0", 0)     // 全流量劫持
            .addDnsServer("114.114.114.114")
            .setSession("WeakNetTestTunnel")
            .setBlocking(true)
        vpnInterface = builder.establish()

        // 2. 启动转发线程
        tunnelThread = Thread(::runTunnel, "WeakNetTunnel").apply { start() }
    }

    private fun runTunnel() {
        val input = vpnInterface.inputStream
        val output = vpnInterface.outputStream
        val udpChannel = DatagramChannel.open().apply { connect(InetSocketAddress("10.0.2.2", 50052)) } // NLCC UDP 代理端口
        
        // 双向拷贝：TUN <-> NLCC Proxy (UDP 封装)
        // 注意：需实现简单的分片重组与会话维持，建议复用 gVisor/tcpip 库
        while (!Thread.interrupted()) {
            // 读取 TUN 包 -> 封装元数据 -> 发送至 NLCC Sidecar
            // 从 NLCC Sidecar 读取 -> 写入 TUN
        }
    }
}

// nlcc_proxy_extension.go
func StartUDPProxy(ctx context.Context, listenAddr string, targetNLCC *NLCCController) error {
    conn, err := net.ListenPacket("udp", listenAddr)
    if err != nil { return err }
    defer conn.Close()

    buf := make([]byte, 65535)
    for {
        n, addr, err := conn.ReadFrom(buf)
        if err != nil { continue }
        
        // 1. 解析内层 IP 包 (从移动端 TUN 来)
        // 2. 调用 targetNLCC.ApplyPolicy(pkt) 进行弱网处理 (丢包/延迟/乱序)
        // 3. 将处理后的包转发至真实目标 (或回环给客户端模拟服务端)
        go handlePacket(buf[:n], addr, targetNLCC, conn)
    }
}

# conftest.py (pytest fixture)
@pytest.fixture(scope="session")
def weaknet_device(adb_serial, nlcc_grpc):
    # 1. 推送测试版 APK (含 VpnService)
    install_test_apk(adb_serial, "app-weaknet-debug.apk")
    
    # 2. 授权 VPN 权限 (需解锁屏幕、处理弹窗)
    grant_vpn_permission(adb_serial, "com.example.weaknet")
    
    # 3. 启动 VPN 服务 (通过 am startservice)
    start_vpn_service(adb_serial)
    
    # 4. 等待隧道建立心跳
    wait_for_tunnel_ready(adb_serial, timeout=30)
    
    yield WeakNetDeviceController(adb_serial, nlcc_grpc)
    
    # Teardown: 停止 VPN, 卸载测试包
    stop_vpn_service(adb_serial)

{"ts": 0.000, "event": "config", "uplink": {"bw": 2000, "rtt": 40, "loss": 0.1, "jitter": 5}, "downlink": {"bw": 5000, "rtt": 40, "loss": 0.1, "jitter": 5}}
{"ts": 12.345, "event": "update", "uplink": {"bw": 300, "rtt": 350, "loss": 15, "jitter": 120}, "trigger": "enter_elevator"}
{"ts": 18.001, "event": "burst_loss", "duration_ms": 2000, "loss_pct": 80, "pattern": "gilbert_elliott", "params": {"p": 0.8, "q": 0.2}}
{"ts": 45.600, "event": "recover", "target": "L1", "transition_ms": 500}

// NetworkTraceCollector.cc (集成至 RTC SDK 内部)
class NetworkTraceCollector {
public:
    void OnNetworkInfoUpdate(const NetworkInfo& info) {
        // 仅当指标变化超过阈值时记录，控制体积
        if (ShouldRecord(info)) {
            TraceEvent evt;
            evt.ts = NowMs() / 1000.0;
            evt.uplink = ExtractLinkParams(info.uplink);
            evt.downlink = ExtractLinkParams(info.downlink);
            evt.trigger = ClassifyTrigger(info); // 启发式判断：切网/进电梯/高铁
            writer_->Write(evt);
        }
    }
    
    // 定期上报至后端存储 (Kafka -> ClickHouse)
    void Flush() { writer_->Flush(); }
};

# trace_replayer.py
class TraceReplayer:
    def __init__(self, nlcc_stub):
        self.stub = nlcc_stub
        self.stream = self.stub.StreamControl() # 双向流式 RPC

    def replay(self, trace_file: str, speed: float = 1.0):
        last_ts = 0.0
        for line in open(trace_file):
            evt = json.loads(line)
            # 1. 时间推进
            sleep((evt['ts'] - last_ts) / speed)
            last_ts = evt['ts']
            
            # 2. 构造 NLCC Config
            cfg = self._build_config(evt)
            
            # 3. 流式下发 (非阻塞)
            self.stream.write(StreamControlRequest(config=cfg))
            
            # 4. 处理突发事件
            if evt['event'] == 'burst_loss':
                self._inject_burst_loss(evt)
        
        self.stream.close()

    def _inject_burst_loss(self, evt):
        # 启动协程，在 duration 内按 Gilbert-Elliott 模型动态调用 Update
        # 避免阻塞主回放线程
        ge = GilbertElliottModel(evt['params']['p'], evt['params']['q'])
        threading.Thread(target=self._burst_worker, args=(ge, evt['duration_ms'])).start()

# k8s deployment / pod template for NLCC Sidecar
resources:
  requests:
    cpu: "500m"      # 保障基础调度延迟
    memory: "256Mi"
  limits:
    cpu: "2000m"     # 防止 tc 规则计算抢占测试主进程
    memory: "1Gi"
# 关键：开启 CPU Manager 静态策略，绑定独占核心
annotations:
  cpu-manager-policy: "static"

# /etc/sysctl.d/99-nlcc-ci.conf
# 连接跟踪表扩容 (高并发 UDP 旁路模式必改)
net.netfilter.nf_conntrack_max = 1048576
net.netfilter.nf_conntrack_tcp_timeout_established = 300
net.netfilter.nf_conntrack_udp_timeout = 30
net.netfilter.nf_conntrack_udp_timeout_stream = 60

# 端口范围扩大 (避免 bind 失败)
net.ipv4.ip_local_port_range = 10240 65535

# TCP 快速回收复用 (针对频繁建连的测试流量)
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 15

# 启动参数建议
network_link_conditioner 
  --grpc_port=50051 
  --worker_threads=4               # 与 CPU Limit 核心数对齐
  --packet_pool_size=8192          # 预分配内存池，减少 GC/分配抖动
  --enable_zero_copy=true          # 利用 AF_XDP / netmap (需内核/驱动支持)
  --batch_processing=true          # 批量处理包，提升吞吐
  --latency_histogram_buckets=50    # 内部延迟观测精度

# sprt_gate.py
class SPRTGate:
    def __init__(self, p0=0.03, p1=0.08, alpha=0.05, beta=0.1):
        # H0: 卡顿率 <= 3% (合格) vs H1: 卡顿率 >= 8% (不合格)
        self.A = math.log((1-beta)/alpha)
        self.B = math.log(beta/(1-alpha))
        self.p0, self.p1 = p0, p1
        self.log_lambda = 0.0
        self.n = 0

    def feed(self, is_freeze: bool):
        self.n += 1
        # 似然比累积
        self.log_lambda += math.log(
            (self.p1 if is_freeze else (1-self.p1)) / 
            (self.p0 if is_freeze else (1-self.p0))
        )
        
        if self.log_lambda >= self.A: return "REJECT_H0"  # 判定不合格，提前终止
        if self.log_lambda <= self.B: return "ACCEPT_H0"  # 判定合格，提前终止
        return "CONTINUE"

# CI 中集成
gate = SPRTGate()
for i in range(MAX_RUNS=50):
    result = run_one_test()
    decision = gate.feed(result.has_freeze)
    if decision != "CONTINUE":
        break
assert decision == "ACCEPT_H0", f"SPRT 拒收: 第 {gate.n} 次判定不合格"

# 1. 可复现构建
docker build --build-arg WEBRTC_COMMIT=<fixed_sha> -t nlcc:v1.2.3-repro .

# 2. 签名与验签 (Cosign + Sigstore)
cosign sign --key env://COSIGN_PRIVATE_KEY registry.example.com/nlcc:v1.2.3-repro
cosign verify --key env://COSIGN_PUBLIC_KEY registry.example.com/nlcc:v1.2.3-repro

# 3. SBOM 生成
syft registry.example.com/nlcc:v1.2.3-repro -o spdx-json > nlcc.sbom.json

# 仅需 Docker，5 分钟拉起完整验证链路
git clone https://github.com/your-org/weaknet-pipeline-starter.git
cd weaknet-pipeline-starter
docker compose -f docker-compose.ci.yml up -d
# 访问 http://localhost:3000 (Grafana) 查看实时弱网仪表盘
# 访问 http://localhost:8080 (MinIO) 下载示例 .wntf 轨迹文件