Ensure free buffer space when reading TLS messages - #83480

Merged
rzikm merged 3 commits into
dotnet:mainfrom
rzikm:83455-SslStream-buffer
Mar 17, 2023
Merged

Ensure free buffer space when reading TLS messages#83480
rzikm merged 3 commits into
dotnet:mainfrom
rzikm:83455-SslStream-buffer

Conversation

@rzikm

@rzikmrzikm commented Mar 15, 2023

Copy link
Copy Markdown
Member

Fixes#83455.

@ghostghost assigned rzikmMar 15, 2023
@ghost

ghost commented Mar 15, 2023

Copy link
Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

Fixes #83455.

Author:rzikm
Assignees:-
Labels:

area-System.Net.Security

Milestone:-

@rzikm
rzikm requested a review from wfurtMarch 15, 2023 22:10
wfurt
wfurt reviewed Mar 15, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs Outdated
// there should be space left to read into
Debug.Assert(_buffer.AvailableLength > 0, "_buffer.AvailableBytes > 0");
// make sure we have space to read into
_buffer.EnsureAvailableSpace(Math.Min(frameSize, _buffer.Capacity) - _buffer.EncryptedLength);

@wfurtwfurtMar 15, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there risk of growing too much if framers are keep coming. I know this is not normal case but as far as I understand the old code, we would make space for a frame, maybe more if needed.
We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.

@rzikmrzikmMar 16, 2023

Copy link
Copy Markdown
MemberAuthor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there is, I should've waited with the fix till the morning :D

We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.

Not sure which one you are talking about, the closes one is in 214 and 287 and both are outside of the while loop which is receiving TLS frames

@wfurt

wfurt commented Mar 15, 2023

Copy link
Copy Markdown
Member

I assume test would be difficult?

This was referenced Mar 16, 2023
Closed
Closed
@rzikm

rzikm commented Mar 16, 2023

Copy link
Copy Markdown
MemberAuthor

I assume test would be difficult?

yes, the exact condition for this regression is that there are just enough leftover bytes at the end of the buffer that we don't know the size of the next frame (when debugging it was 3 or 4 bytes). With more bytes, the frame size would be known and the check on 720 would fix that.

I am not even sure we can make a test for this, since we can't control the size of TLS frames in handshake in order to hit the condition above.

@rzikm
Fix failing tests
372a386
The initial size is not enough to cover later TLS frames
@rzikm

rzikm commented Mar 16, 2023

Copy link
Copy Markdown
MemberAuthor

Test failures are

@rzikm
rzikm requested a review from wfurtMarch 16, 2023 17:24
@build-analysisbuild-analysisBot mentioned this pull request Mar 16, 2023
Closed
wfurt
wfurt approved these changes Mar 16, 2023
View reviewed changes

@wfurtwfurt left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@rzikm
rzikm merged commit 673afec into dotnet:mainMar 17, 2023
@rzikm

rzikm commented Mar 17, 2023

Copy link
Copy Markdown
MemberAuthor

/backport to release/7.0

@github-actions

github-actionsBot commented Mar 17, 2023

Copy link
Copy Markdown
Contributor

Started backporting to release/7.0: https://github.com/dotnet/runtime/actions/runs/4445535094

@github-actionsgithub-actionsBot mentioned this pull request Mar 17, 2023
Merged
@karelzkarelz added this to the 8.0.0 milestone Mar 22, 2023
@ghostghost locked as resolved and limited conversation to collaborators Apr 21, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Security

Projects

None yet

Milestone

8.0.0

Development

Successfully merging this pull request may close these issues.

SslStream fails to authenticate in .NET 7.0 but works in .NET 6.0

3 participants

@rzikm@wfurt@karelz
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
Ensure free buffer space when reading TLS messages - #83480
Merged
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Mar 17, 2023
Merged
Ensure free buffer space when reading TLS messages#83480
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Conversation
@rzikm
@rzikmrzikm
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
Fixes#83455.
@ghostghost
assigned rzikmMar 15, 2023
@ghost
ghost
commented
Mar 15, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #83455.
Author:rzikm
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 15, 2023 22:10
wfurt
wfurt
reviewed
Mar 15, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 // there should be space left to read into
Debug.Assert(_buffer.AvailableLength > 0, "_buffer.AvailableBytes > 0");
 // make sure we have space to read into
_buffer.EnsureAvailableSpace(Math.Min(frameSize, _buffer.Capacity) - _buffer.EncryptedLength);
@wfurtwfurtMar 15, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there risk of growing too much if framers are keep coming. I know this is not normal case but as far as I understand the old code, we would make space for a frame, maybe more if needed.

We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
@rzikmrzikmMar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there is, I should've waited with the fix till the morning :D
We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
Not sure which one you are talking about, the closes one is in 214 and 287 and both are outside of the while loop which is receiving TLS frames
@wfurt
wfurt
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
I assume test would be difficult?

This was referenced Mar 16, 2023

Closed


Closed

@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
I assume test would be difficult?
yes, the exact condition for this regression is that there are just enough leftover bytes at the end of the buffer that we don't know the size of the next frame (when debugging it was 3 or 4 bytes). With more bytes, the frame size would be known and the check on 720 would fix that.
I am not even sure we can make a test for this, since we can't control the size of TLS frames in handshake in order to hit the condition above.
@rzikm
Fix failing tests
372a386
The initial size is not enough to cover later TLS frames
@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Test failures are
@rzikm
rzikm
requested a review
from wfurtMarch 16, 2023 17:24
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 16, 2023

Closed

wfurt
wfurt
approved these changes
Mar 16, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@rzikm
rzikm
merged commit 673afec
into
dotnet:mainMar 17, 2023
@rzikm
rzikm
commented
Mar 17, 2023

Copy link


Copy Markdown

MemberAuthor
/backport to release/7.0
@github-actions
github-actionsBot
commented
Mar 17, 2023

Copy link


Copy Markdown

Contributor
Started backporting to release/7.0: https://github.com/dotnet/runtime/actions/runs/4445535094
@github-actionsgithub-actionsBot
mentioned this pull request
Mar 17, 2023
 Merged

@karelzkarelz
added this to the 8.0.0 milestone
Mar 22, 2023
@ghostghost
locked as resolved and limited conversation to collaborators
Apr 21, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Security

Projects


None yet


Milestone

8.0.0

Development

Successfully merging this pull request may close these issues.

SslStream fails to authenticate in .NET 7.0 but works in .NET 6.0


3 participants

@rzikm@wfurt@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Ensure free buffer space when reading TLS messages - #83480
Merged
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Mar 17, 2023
Merged
Ensure free buffer space when reading TLS messages#83480
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Conversation
@rzikm
@rzikmrzikm
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
Fixes#83455.
@ghostghost
assigned rzikmMar 15, 2023
@ghost
ghost
commented
Mar 15, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #83455.
Author:rzikm
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 15, 2023 22:10
wfurt
wfurt
reviewed
Mar 15, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 // there should be space left to read into
Debug.Assert(_buffer.AvailableLength > 0, "_buffer.AvailableBytes > 0");
 // make sure we have space to read into
_buffer.EnsureAvailableSpace(Math.Min(frameSize, _buffer.Capacity) - _buffer.EncryptedLength);
@wfurtwfurtMar 15, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there risk of growing too much if framers are keep coming. I know this is not normal case but as far as I understand the old code, we would make space for a frame, maybe more if needed.

We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
@rzikmrzikmMar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there is, I should've waited with the fix till the morning :D
We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
Not sure which one you are talking about, the closes one is in 214 and 287 and both are outside of the while loop which is receiving TLS frames
@wfurt
wfurt
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
I assume test would be difficult?

This was referenced Mar 16, 2023

Closed


Closed

@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
I assume test would be difficult?
yes, the exact condition for this regression is that there are just enough leftover bytes at the end of the buffer that we don't know the size of the next frame (when debugging it was 3 or 4 bytes). With more bytes, the frame size would be known and the check on 720 would fix that.
I am not even sure we can make a test for this, since we can't control the size of TLS frames in handshake in order to hit the condition above.
@rzikm
Fix failing tests
372a386
The initial size is not enough to cover later TLS frames
@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Test failures are
@rzikm
rzikm
requested a review
from wfurtMarch 16, 2023 17:24
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 16, 2023

Closed

wfurt
wfurt
approved these changes
Mar 16, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@rzikm
rzikm
merged commit 673afec
into
dotnet:mainMar 17, 2023
@rzikm
rzikm
commented
Mar 17, 2023

Copy link


Copy Markdown

MemberAuthor
/backport to release/7.0
@github-actions
github-actionsBot
commented
Mar 17, 2023

Copy link


Copy Markdown

Contributor
Started backporting to release/7.0: https://github.com/dotnet/runtime/actions/runs/4445535094
@github-actionsgithub-actionsBot
mentioned this pull request
Mar 17, 2023
 Merged

@karelzkarelz
added this to the 8.0.0 milestone
Mar 22, 2023
@ghostghost
locked as resolved and limited conversation to collaborators
Apr 21, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Security

Projects


None yet


Milestone

8.0.0

Development

Successfully merging this pull request may close these issues.

SslStream fails to authenticate in .NET 7.0 but works in .NET 6.0


3 participants

@rzikm@wfurt@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Ensure free buffer space when reading TLS messages - #83480
Merged
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Mar 17, 2023
Merged
Ensure free buffer space when reading TLS messages#83480
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Conversation
@rzikm
@rzikmrzikm
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
Fixes#83455.
@ghostghost
assigned rzikmMar 15, 2023
@ghost
ghost
commented
Mar 15, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #83455.
Author:rzikm
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 15, 2023 22:10
wfurt
wfurt
reviewed
Mar 15, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 // there should be space left to read into
Debug.Assert(_buffer.AvailableLength > 0, "_buffer.AvailableBytes > 0");
 // make sure we have space to read into
_buffer.EnsureAvailableSpace(Math.Min(frameSize, _buffer.Capacity) - _buffer.EncryptedLength);
@wfurtwfurtMar 15, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there risk of growing too much if framers are keep coming. I know this is not normal case but as far as I understand the old code, we would make space for a frame, maybe more if needed.

We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
@rzikmrzikmMar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there is, I should've waited with the fix till the morning :D
We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
Not sure which one you are talking about, the closes one is in 214 and 287 and both are outside of the while loop which is receiving TLS frames
@wfurt
wfurt
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
I assume test would be difficult?

This was referenced Mar 16, 2023

Closed


Closed

@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
I assume test would be difficult?
yes, the exact condition for this regression is that there are just enough leftover bytes at the end of the buffer that we don't know the size of the next frame (when debugging it was 3 or 4 bytes). With more bytes, the frame size would be known and the check on 720 would fix that.
I am not even sure we can make a test for this, since we can't control the size of TLS frames in handshake in order to hit the condition above.
@rzikm
Fix failing tests
372a386
The initial size is not enough to cover later TLS frames
@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Test failures are
@rzikm
rzikm
requested a review
from wfurtMarch 16, 2023 17:24
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 16, 2023

Closed

wfurt
wfurt
approved these changes
Mar 16, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@rzikm
rzikm
merged commit 673afec
into
dotnet:mainMar 17, 2023
@rzikm
rzikm
commented
Mar 17, 2023

Copy link


Copy Markdown

MemberAuthor
/backport to release/7.0
@github-actions
github-actionsBot
commented
Mar 17, 2023

Copy link


Copy Markdown

Contributor
Started backporting to release/7.0: https://github.com/dotnet/runtime/actions/runs/4445535094
@github-actionsgithub-actionsBot
mentioned this pull request
Mar 17, 2023
 Merged

@karelzkarelz
added this to the 8.0.0 milestone
Mar 22, 2023
@ghostghost
locked as resolved and limited conversation to collaborators
Apr 21, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Security

Projects


None yet


Milestone

8.0.0

Development

Successfully merging this pull request may close these issues.

SslStream fails to authenticate in .NET 7.0 but works in .NET 6.0


3 participants

@rzikm@wfurt@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
Ensure free buffer space when reading TLS messages - #83480
Merged
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Mar 17, 2023
Merged
Ensure free buffer space when reading TLS messages#83480
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Conversation
@rzikm
@rzikmrzikm
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
Fixes#83455.
@ghostghost
assigned rzikmMar 15, 2023
@ghost
ghost
commented
Mar 15, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #83455.
Author:rzikm
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 15, 2023 22:10
wfurt
wfurt
reviewed
Mar 15, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 // there should be space left to read into
Debug.Assert(_buffer.AvailableLength > 0, "_buffer.AvailableBytes > 0");
 // make sure we have space to read into
_buffer.EnsureAvailableSpace(Math.Min(frameSize, _buffer.Capacity) - _buffer.EncryptedLength);
@wfurtwfurtMar 15, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there risk of growing too much if framers are keep coming. I know this is not normal case but as far as I understand the old code, we would make space for a frame, maybe more if needed.

We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
@rzikmrzikmMar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there is, I should've waited with the fix till the morning :D
We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
Not sure which one you are talking about, the closes one is in 214 and 287 and both are outside of the while loop which is receiving TLS frames
@wfurt
wfurt
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
I assume test would be difficult?

This was referenced Mar 16, 2023

Closed


Closed

@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
I assume test would be difficult?
yes, the exact condition for this regression is that there are just enough leftover bytes at the end of the buffer that we don't know the size of the next frame (when debugging it was 3 or 4 bytes). With more bytes, the frame size would be known and the check on 720 would fix that.
I am not even sure we can make a test for this, since we can't control the size of TLS frames in handshake in order to hit the condition above.
@rzikm
Fix failing tests
372a386
The initial size is not enough to cover later TLS frames
@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Test failures are
@rzikm
rzikm
requested a review
from wfurtMarch 16, 2023 17:24
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 16, 2023

Closed

wfurt
wfurt
approved these changes
Mar 16, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@rzikm
rzikm
merged commit 673afec
into
dotnet:mainMar 17, 2023
@rzikm
rzikm
commented
Mar 17, 2023

Copy link


Copy Markdown

MemberAuthor
/backport to release/7.0
@github-actions
github-actionsBot
commented
Mar 17, 2023

Copy link


Copy Markdown

Contributor
Started backporting to release/7.0: https://github.com/dotnet/runtime/actions/runs/4445535094
@github-actionsgithub-actionsBot
mentioned this pull request
Mar 17, 2023
 Merged

@karelzkarelz
added this to the 8.0.0 milestone
Mar 22, 2023
@ghostghost
locked as resolved and limited conversation to collaborators
Apr 21, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Security

Projects


None yet


Milestone

8.0.0

Development

Successfully merging this pull request may close these issues.

SslStream fails to authenticate in .NET 7.0 but works in .NET 6.0


3 participants

@rzikm@wfurt@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Ensure free buffer space when reading TLS messages - #83480
Merged
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Mar 17, 2023
Merged
Ensure free buffer space when reading TLS messages#83480
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Conversation
@rzikm
@rzikmrzikm
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
Fixes#83455.
@ghostghost
assigned rzikmMar 15, 2023
@ghost
ghost
commented
Mar 15, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #83455.
Author:rzikm
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 15, 2023 22:10
wfurt
wfurt
reviewed
Mar 15, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 // there should be space left to read into
Debug.Assert(_buffer.AvailableLength > 0, "_buffer.AvailableBytes > 0");
 // make sure we have space to read into
_buffer.EnsureAvailableSpace(Math.Min(frameSize, _buffer.Capacity) - _buffer.EncryptedLength);
@wfurtwfurtMar 15, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there risk of growing too much if framers are keep coming. I know this is not normal case but as far as I understand the old code, we would make space for a frame, maybe more if needed.

We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
@rzikmrzikmMar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there is, I should've waited with the fix till the morning :D
We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
Not sure which one you are talking about, the closes one is in 214 and 287 and both are outside of the while loop which is receiving TLS frames
@wfurt
wfurt
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
I assume test would be difficult?

This was referenced Mar 16, 2023

Closed


Closed

@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
I assume test would be difficult?
yes, the exact condition for this regression is that there are just enough leftover bytes at the end of the buffer that we don't know the size of the next frame (when debugging it was 3 or 4 bytes). With more bytes, the frame size would be known and the check on 720 would fix that.
I am not even sure we can make a test for this, since we can't control the size of TLS frames in handshake in order to hit the condition above.
@rzikm
Fix failing tests
372a386
The initial size is not enough to cover later TLS frames
@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Test failures are
@rzikm
rzikm
requested a review
from wfurtMarch 16, 2023 17:24
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 16, 2023

Closed

wfurt
wfurt
approved these changes
Mar 16, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@rzikm
rzikm
merged commit 673afec
into
dotnet:mainMar 17, 2023
@rzikm
rzikm
commented
Mar 17, 2023

Copy link


Copy Markdown

MemberAuthor
/backport to release/7.0
@github-actions
github-actionsBot
commented
Mar 17, 2023

Copy link


Copy Markdown

Contributor
Started backporting to release/7.0: https://github.com/dotnet/runtime/actions/runs/4445535094
@github-actionsgithub-actionsBot
mentioned this pull request
Mar 17, 2023
 Merged

@karelzkarelz
added this to the 8.0.0 milestone
Mar 22, 2023
@ghostghost
locked as resolved and limited conversation to collaborators
Apr 21, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Security

Projects


None yet


Milestone

8.0.0

Development

Successfully merging this pull request may close these issues.

SslStream fails to authenticate in .NET 7.0 but works in .NET 6.0


3 participants

@rzikm@wfurt@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
Ensure free buffer space when reading TLS messages - #83480
Merged
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Mar 17, 2023
Merged
Ensure free buffer space when reading TLS messages#83480
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Conversation
@rzikm
@rzikmrzikm
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
Fixes#83455.
@ghostghost
assigned rzikmMar 15, 2023
@ghost
ghost
commented
Mar 15, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #83455.
Author:rzikm
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 15, 2023 22:10
wfurt
wfurt
reviewed
Mar 15, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 // there should be space left to read into
Debug.Assert(_buffer.AvailableLength > 0, "_buffer.AvailableBytes > 0");
 // make sure we have space to read into
_buffer.EnsureAvailableSpace(Math.Min(frameSize, _buffer.Capacity) - _buffer.EncryptedLength);
@wfurtwfurtMar 15, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there risk of growing too much if framers are keep coming. I know this is not normal case but as far as I understand the old code, we would make space for a frame, maybe more if needed.

We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
@rzikmrzikmMar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there is, I should've waited with the fix till the morning :D
We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
Not sure which one you are talking about, the closes one is in 214 and 287 and both are outside of the while loop which is receiving TLS frames
@wfurt
wfurt
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
I assume test would be difficult?

This was referenced Mar 16, 2023

Closed


Closed

@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
I assume test would be difficult?
yes, the exact condition for this regression is that there are just enough leftover bytes at the end of the buffer that we don't know the size of the next frame (when debugging it was 3 or 4 bytes). With more bytes, the frame size would be known and the check on 720 would fix that.
I am not even sure we can make a test for this, since we can't control the size of TLS frames in handshake in order to hit the condition above.
@rzikm
Fix failing tests
372a386
The initial size is not enough to cover later TLS frames
@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Test failures are
@rzikm
rzikm
requested a review
from wfurtMarch 16, 2023 17:24
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 16, 2023

Closed

wfurt
wfurt
approved these changes
Mar 16, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@rzikm
rzikm
merged commit 673afec
into
dotnet:mainMar 17, 2023
@rzikm
rzikm
commented
Mar 17, 2023

Copy link


Copy Markdown

MemberAuthor
/backport to release/7.0
@github-actions
github-actionsBot
commented
Mar 17, 2023

Copy link


Copy Markdown

Contributor
Started backporting to release/7.0: https://github.com/dotnet/runtime/actions/runs/4445535094
@github-actionsgithub-actionsBot
mentioned this pull request
Mar 17, 2023
 Merged

@karelzkarelz
added this to the 8.0.0 milestone
Mar 22, 2023
@ghostghost
locked as resolved and limited conversation to collaborators
Apr 21, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Security

Projects


None yet


Milestone

8.0.0

Development

Successfully merging this pull request may close these issues.

SslStream fails to authenticate in .NET 7.0 but works in .NET 6.0


3 participants

@rzikm@wfurt@karelz

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
Ensure free buffer space when reading TLS messages - #83480
Merged
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Mar 17, 2023
Merged
Ensure free buffer space when reading TLS messages#83480
rzikm merged 3 commits into
dotnet:mainfrom 
rzikm:83455-SslStream-buffer
Conversation
@rzikm
@rzikmrzikm
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
Fixes#83455.
@ghostghost
assigned rzikmMar 15, 2023
@ghost
ghost
commented
Mar 15, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Fixes #83455.
Author:rzikm
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 15, 2023 22:10
wfurt
wfurt
reviewed
Mar 15, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 // there should be space left to read into
Debug.Assert(_buffer.AvailableLength > 0, "_buffer.AvailableBytes > 0");
 // make sure we have space to read into
_buffer.EnsureAvailableSpace(Math.Min(frameSize, _buffer.Capacity) - _buffer.EncryptedLength);
@wfurtwfurtMar 15, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is there risk of growing too much if framers are keep coming. I know this is not normal case but as far as I understand the old code, we would make space for a frame, maybe more if needed.

We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
@rzikmrzikmMar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes, there is, I should've waited with the fix till the morning :D
We had EnsureAvailableSpace on line 246 so I'm wondering why that was not sufficient.
Not sure which one you are talking about, the closes one is in 214 and 287 and both are outside of the while loop which is receiving TLS frames
@wfurt
wfurt
commented
Mar 15, 2023

Copy link


Copy Markdown

Member
I assume test would be difficult?

This was referenced Mar 16, 2023

Closed


Closed

@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
I assume test would be difficult?
yes, the exact condition for this regression is that there are just enough leftover bytes at the end of the buffer that we don't know the size of the next frame (when debugging it was 3 or 4 bytes). With more bytes, the frame size would be known and the check on 720 would fix that.
I am not even sure we can make a test for this, since we can't control the size of TLS frames in handshake in order to hit the condition above.
@rzikm
Fix failing tests
372a386
The initial size is not enough to cover later TLS frames
@rzikm
rzikm
commented
Mar 16, 2023

Copy link


Copy Markdown

MemberAuthor
Test failures are
@rzikm
rzikm
requested a review
from wfurtMarch 16, 2023 17:24
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 16, 2023

Closed

wfurt
wfurt
approved these changes
Mar 16, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.
@rzikm
rzikm
merged commit 673afec
into
dotnet:mainMar 17, 2023
@rzikm
rzikm
commented
Mar 17, 2023

Copy link


Copy Markdown

MemberAuthor
/backport to release/7.0
@github-actions
github-actionsBot
commented
Mar 17, 2023

Copy link


Copy Markdown

Contributor
Started backporting to release/7.0: https://github.com/dotnet/runtime/actions/runs/4445535094
@github-actionsgithub-actionsBot
mentioned this pull request
Mar 17, 2023
 Merged

@karelzkarelz
added this to the 8.0.0 milestone
Mar 22, 2023
@ghostghost
locked as resolved and limited conversation to collaborators
Apr 21, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@wfurtwfurtwfurt approved these changes

Assignees

@rzikmrzikm

Labels

area-System.Net.Security

Projects


None yet


Milestone

8.0.0

Development

Successfully merging this pull request may close these issues.

SslStream fails to authenticate in .NET 7.0 but works in .NET 6.0


3 participants

@rzikm@wfurt@karelz