feat(acl): criterion benchmarks + nix bench-builder

Adds criterion benchmarks for both backends at v4 and v6 widths,
plus the nix / just plumbing to produce bench binaries from a
sandboxed build.

acl/benches/:

- reference_five_tuple.rs sweeps a deep miss (full per-rule scan)
  and an early hit through the reference's O(rules * fields) linear
  scan.  Both widths.
- dpdk_five_tuple.rs is the rte_acl companion: trie walk cost (close
  to flat in rule count), miss vs hit, single-shot vs SIMD batch.
  v6 exercises the wide-field split (one 16-byte address -> four
  4-byte sub-fields).  Requires a live EAL.
- table_build.rs measures construction cost vs rule count: reference
  (lower + Vec wrap) and DPDK (rte_acl_build, the update-latency
  cost).  Both widths.  iter_batched so teardown is excluded.

acl/Cargo.toml gets the criterion dev-dep and three harness = false
[[bench]] entries.  Workspace Cargo.toml gets the criterion = 0.5.1
shared dep entry.

default.nix adds a bench-builder derivation: cargo bench --no-run
under the profile-appropriate DPDK sysroot, then copies each
compiled benchmark into $out/bin (stripping cargo's -<hash>
suffix).  Linked against the optimized DPDK when profile = release.

justfile adds a bench recipe that builds the benches package and
runs every binary under results/benches/bin/ in turn.

just fmt; cargo check --workspace --all-targets and
cargo clippy -p dataplane-acl --features dpdk -- -D warnings pass.

Signed-off-by: Daniel Noland <daniel@githedgehog.com>

Author: daniel-noland

Cargo.lock

@@ -127,6 +127,7 @@ chrono = { version = "0.4.45", default-features = false, features = [] }
 clap = { version = "4.6.1", default-features = true, features = [] }
 color-eyre = { version = "0.6.5", default-features = false, features = [] }
 colored = { version = "3.1.1", default-features = false, features = [] }
+criterion = { version = "0.8.2", default-features = false, features = [] }
 crossbeam-utils = { version = "0.8.21", default-features = false, features = [] }
 dashmap = { version = "6.2.1", default-features = false, features = [] }
 derive_builder = { version = "0.20.2", default-features = false, features = [] }

Cargo.toml

@@ -7,12 +7,6 @@ version.workspace = true
 
 [features]
 default = []
-# Enables the DPDK `rte_acl` backend for `cascade::Lookup`.  Pulls in
-# the `dpdk` crate (and transitively `dpdk-sys`), so off by default;
-# only the production binary / DPDK-bound consumers turn it on.  The
-# reference backend (always built) carries its own `thiserror`-derived
-# error types, so `thiserror` is unconditional rather than feature-gated
-# under `dpdk`.
 dpdk = ["dep:dpdk"]
 
 [dependencies]
@@ -25,13 +19,20 @@ net = { workspace = true, features = [] }
 thiserror = { workspace = true }
 
 [dev-dependencies]
-# Differential oracle harness: random rulesets + packets compared
-# between the reference and DPDK backends.
 bolero = { workspace = true, features = ["std"] }
-# Override the regular `dpdk` dep to enable its `test` feature
-# (exposes `dpdk::test_support::start_eal` and `dpdk::with_eal`).
+criterion = { workspace = true, features = ["cargo_bench_support"] }
 dpdk = { workspace = true, features = ["test"] }
-# Override match-action to also enable `bolero` for property-test
-# generators (`FieldHit` / `FieldMiss`).
 match-action = { workspace = true, features = ["derive", "bolero"] }
 net = { workspace = true, features = ["test_buffer", "builder"] }
+
+[[bench]]
+name = "reference_five_tuple"
+harness = false
+
+[[bench]]
+name = "dpdk_five_tuple"
+harness = false
+
+[[bench]]
+name = "table_build"
+harness = false