Merge 0.23.21 #2
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This will only have any positive effect with client auth.
The `HandshakeFlightTls12` type alias is only used when the tls12 feature is enabled. This commit adds a `cfg` gate to avoid a dead code warning on builds without the feature enabled.
For some reason the `crypto.cloudflare.com` DNS zone's HTTPS record no longer contains an `ech` config, breaking our ECH record deserialization connect-test. The domain that `crypto.cloudflare.com` redirects to in a browser, `research.cloudflare.com`, does include an `ech` value in the HTTPS record, so let's use that instead.
This main effect here appears to be due to fixing the extension randomisation seed.
callgrind also allows instruction counting, but also collects call trees. We turned off cache emulation in cachegrind, so callgrind should work alike. This regresses diffing of output, leave a TODO for later.
This eliminates: - for resumption and transfer tests, the full handshake - for all tests, one-time setup costs (eg, RSA private key validation)
This covered server tests that validated an RSA private key, when using the aws-lc-rs provider.
Previously, this would subtract a base case benchmark (the cost of the full handshake) but that adds the noise of that benchmark. It is no longer necessary now we are more precise about the instructions that are counted.
Now we are precise about when we count instructions, this measured precisely 0 instructions.
Small refactors and tidying.
That is the last one. Drop docopt dependency.
This reduces the cost of ClientSessionCommon::clone, which is inherent in every `ClientSessionStore` probe operation.
These can be large (hundreds of bytes), and even larger (thousands of bytes) if the server decides to include the client's identity. Parse them into an Arc, and then maintain that on the path to the session store.
The signed message has a pretty tight upper bound, so we can avoid a Vec allocation here.
Move the `resolver_config` into the match arm that uses it. Inline the `Resolver` since it isn't used anywhere except as an arg to `lookup_ech_configs()`.
Previously we only looked at the first HTTPS record's ech-config SCVB param. We should instead collect up the `EchConfigListBytes` from all available HTTPS records. With the list of config lists in hand we should only error if none of the ECH configs across the whole set are compatible.
This updates the documentation to match the more realistic invocation being used in the CI daily-tests.yml job. It also adds a bit more prose to clarify the overall process and where the outer/inner hostnames are used.
This aids manual evaluation of how deep these get.
This is intended to be a deterministic and cryptography-free CryptoProvider, so that fuzzing can reach further into the library. Things like HMAC and hashing ignore input and produces fixed output. Signing produces fixed output, verification accepts the same fixed signature which allows clients to accept the certificate in the corpus file, and should allow libfuzzer to explore branches around there. There is a test that checks this can talk to itself, and outputs transcripts into the fuzzing corpus. This is used by the client and server fuzzing harnesses.
This means fuzzing starts at a successful full handshake.
Prior to this, we gave up after `accept()` succeeded. Now we take the connection to its conclusion.
(with help from `cargo clippy --fix ...`) as suggested by nightly Clippy precedence rule: - https://rust-lang.github.io/rust-clippy/master/index.html#precedence
All good things come to an end :)
Tag version 0.23.21
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.