6/16 Discord Meeting

[nibanks]

Agenda

The focus on this month is bringing down overhead. This includes increasing test coverage and improving test reliability.

• We have a TON of issues that are marked Area: Testing: query. We can spend some time going through these to see if any should be improved this month.
  • Are there any that are no longer necessary and can be simply closed?
• We also have a couple issues marked Bug: Core: query. Should we do anything about those?
• We've also got a few security advisories that'd be nice to clean up.
• It might be a good idea to go through recent Discussion questions to see if we should update the existing documentation / TSGs for common problem areas.

[nibanks]

For those of you without access to the security advisories, here are the relevant ones:

They're mostly false positives that just need some code clean up.

[nibanks]

Notes

• Unbounded writes - low priority
  • False positive - Tool not able to validate our method of bounding scanf()
• Support OSS-Fuzz
  • A couple days to a few weeks. Someone with OSS fuzz could do it faster
• Lots of tests related to TLS
  • 0RTT
  • Certificates
  • Resumption
  • searching by principal name
  • Peer certificate
  • Tag for TLS_tests(?)
• Perf test pipeline crash when HPS run individually
  • Rewrites could invalidate
• Look for most likely issues in active code paths
  • Calling close within a callback
    • Like calling a destructor of yourself - requires code to unwind the stack and make sure that you are not deleted until cleanup is complete
• Client doesn't receive cert chain in INDICATE_PEER_CERTIFICATE
• Indicate peer cert
  • We have hit this
• Test TLS HelloRetryRequest
  • I support these params (client) -> Server - picks preferred match or send HelloRetryRequest if nothing matches
  • Worth testing (happens in prod).
  • How can you force it to happen (repro)?
  • Need discussion with TLS devs.
• 0-RTT version negotiation
  • Low priority - we don't have any customers using this code path right now.
• Things to test for:
  • Crashes
  • Connections fail
  • Individual connections have perf issues
• Test Version Deployment
  • Ask our friends in interop to exercise the code path
  • Have interop, haven't interoped version negotiation yet.
• Load Balancer problem
  • Theoretically LB will break any kind of migration testing.
  • Might be able to use fancy routing to get around this.
  • Have an automated test for a little LB.
    • It's very limited, but we do have some tests.
  • Should consider investing here for version negotiation tests
  • Start with a simple LB version neg test
• OSS-Fuzz
  • Takes time to investigate
• 2206
  • Anthony: Version neg LB
  • Daike: Test Connection Close
  • Completely support Principal Name for Schannel TLS:
    • Tell people don't use.
    • Disable in UM
    • Add not supported in UM flag
    • Worth putting a call out to .NET to make sure that they are not using it.
  • INDICATE_PEER_CERT
    • Okay to slip to 2207
• RJ does Sterling Labs expose the Principal Name?
  • No, don't use Schannel at all.
• Other aspects:
  • QUIC_TLS_SECRETS
    • For Wireshark, not working 100% on server side because of order of operations

Thanks to @dahavey for putting these together!