[release/7.0] Ensure free buffer space when reading TLS messages - #83574

Merged
rzikm merged 4 commits into
release/7.0-stagingfrom
backport/pr-83480-to-release/7.0
Apr 3, 2023
Merged

[release/7.0] Ensure free buffer space when reading TLS messages#83574
rzikm merged 4 commits into
release/7.0-stagingfrom
backport/pr-83480-to-release/7.0

Conversation

@github-actions

@github-actionsgithub-actionsBot commented Mar 17, 2023•
edited by karelz
Loading

Copy link
Copy Markdown
Contributor

Backport of #83480 to release/7.0

Fixes#83455.

/cc @rzikm

Customer Impact

7.0 Introduced regression where SslStream would fail to establish TLS connection (and, by extension, HTTPS) to some servers in very specific circumstances (depending on the sizing of TLS records exchanged during the handshake). One such server is lh3.googleusercontent.com.
For affected servers it happens all the time - i.e. .NET is unable to establish connection to them.

Testing

Manual test against the affected server lh3.googleusercontent.com.
CI test suite passes.

Risk

Low, we didn't change code path when the frame size is known. The code change affects only code path when the frame size is unknown, which happens only when the server sends TLS frames slightly shorter than 16K/8K/4K (see example of the google server above).

@ghost

ghost commented Mar 17, 2023

Copy link
Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones
See info in area-owners.md if you want to be subscribed.

Issue Details

Backport of #83480 to release/7.0

/cc @rzikm

Customer Impact

Testing

Risk

IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.

Author:github-actions[bot]
Assignees:-
Labels:

area-System.Net.Security

Milestone:-

@rzikm
rzikm requested a review from wfurtMarch 17, 2023 08:25
@rzikmrzikm added this to the 7.0.x milestone Mar 17, 2023
@rzikm
rzikm requested a review from karelzMarch 17, 2023 08:27
@build-analysisbuild-analysisBot mentioned this pull request Mar 17, 2023
Closed
wfurt
wfurt approved these changes Mar 17, 2023
View reviewed changes

@wfurtwfurt left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

karelz
karelz reviewed Mar 21, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs Outdated
}

if (frameSize < int.MaxValue)
if (frameSize != int.MaxValue)

@karelzkarelzMar 21, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it needed? Looks like semantically it is the same. Only MaxValue can be "not <".

@rzikmrzikmMar 21, 2023

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed, it was part of stylistic change to make it evident that int.MaxValue is a special value ("unknown size"). I can remove it from the backport.

This was referenced Mar 21, 2023
Closed
Closed
Closed
@karelzkarelz added the Servicing-consider Issue for next servicing release review label Mar 28, 2023
@karelz

karelz commented Mar 28, 2023

Copy link
Copy Markdown
Member

Impact on customers hitting real servers (see top post), worth servicing.

@rbhandarbhanda modified the milestones: 7.0.x, 7.0.6Mar 28, 2023
@rbhandarbhanda added Servicing-approved Approved for servicing release and removed Servicing-consider Issue for next servicing release review labels Mar 28, 2023
@carlossanlop

carlossanlop commented Mar 28, 2023

Copy link
Copy Markdown
Contributor

I'm retargeting this PR to the new release/7.0-staging branch, which is the one that we will use from now on for servicing fixes.

Repo maintainers will now be allowed to merge their own servicing PR as long as it meets the requirements:

  • It is approved by Tactics (signaled by adding the Servicing-approved label).
  • It's signed-off by an area owner.
  • The CI is green, or the failures are investigated as unrelated.
  • And if the PR touches an OOB package, the necessary OOB authoring changes are added.

The new process is described here: runtime/docs/project/library-servicing.md.

The infra team will be actively monitoring servicing PRs to ensure all requirements are met and to help with any issues.

Let me know if you have any questions.

@carlossanlop
carlossanlop changed the base branch from release/7.0 to release/7.0-stagingMarch 28, 2023 21:00
@rzikm

rzikm commented Mar 29, 2023•
edited by karelz
Loading

Copy link
Copy Markdown
Member

Test failures are known problems - tracked in #83901

@build-analysisbuild-analysisBot mentioned this pull request Mar 29, 2023
Closed
@rzikm

rzikm commented Mar 29, 2023

Copy link
Copy Markdown
Member

@carlossanlop The check-labels check seems to be stuck in the Expected -- Waiting for status to be reported state. Is there a way to restart it?

@carlossanlopcarlossanlop added Servicing-approved Approved for servicing release and removed Servicing-approved Approved for servicing release labels Mar 30, 2023
@rzikm

rzikm commented Apr 3, 2023

Copy link
Copy Markdown
Member

Test failures are #83901 (known and closed already)

@rzikm
rzikm merged commit 001172f into release/7.0-stagingApr 3, 2023
@jkotas
jkotas deleted the backport/pr-83480-to-release/7.0 branch April 18, 2023 22:46
@ghostghost locked as resolved and limited conversation to collaborators May 19, 2023
@rbhandarbhanda modified the milestones: 7.0.6, 7.0.7Jun 1, 2023
Sign up for freeto subscribe to this conversation on GitHub. Already have an account? Sign in.

Reviewers

@rzikmrzikmrzikm left review comments
@karelzkarelzkarelz approved these changes
@wfurtwfurtwfurt approved these changes

Assignees

No one assigned

Labels

area-System.Net.SecurityServicing-approvedApproved for servicing release

Projects

None yet

Milestone

7.0.7

Development

Successfully merging this pull request may close these issues.

5 participants

@karelz@carlossanlop@rzikm@wfurt@rbhanda
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
[release/7.0] Ensure free buffer space when reading TLS messages - #83574
Merged
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Apr 3, 2023
Merged
[release/7.0] Ensure free buffer space when reading TLS messages#83574
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 17, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Contributor
Backport of #83480 to release/7.0
Fixes#83455.
/cc @rzikm
Customer Impact
7.0 Introduced regression where SslStream would fail to establish TLS connection (and, by extension, HTTPS) to some servers in very specific circumstances (depending on the sizing of TLS records exchanged during the handshake). One such server is lh3.googleusercontent.com.

For affected servers it happens all the time - i.e. .NET is unable to establish connection to them.
Testing
Manual test against the affected server lh3.googleusercontent.com.

CI test suite passes.
Risk
Low, we didn't change code path when the frame size is known. The code change affects only code path when the frame size is unknown, which happens only when the server sends TLS frames slightly shorter than 16K/8K/4K (see example of the google server above).
@ghost
ghost
commented
Mar 17, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Backport of #83480 to release/7.0
/cc @rzikm
Customer Impact
Testing
Risk
IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
Author:github-actions[bot]
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 17, 2023 08:25
@rzikmrzikm
added this to the 7.0.x milestone
Mar 17, 2023
@rzikm
rzikm
requested a review
from karelzMarch 17, 2023 08:27
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 17, 2023

Closed

wfurt
wfurt
approved these changes
Mar 17, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
karelz
karelz
reviewed
Mar 21, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 }

 if (frameSize < int.MaxValue)
 if (frameSize != int.MaxValue)
@karelzkarelzMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it needed? Looks like semantically it is the same. Only MaxValue can be "not <".
@rzikmrzikmMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed, it was part of stylistic change to make it evident that int.MaxValue is a special value ("unknown size"). I can remove it from the backport.

This was referenced Mar 21, 2023

Closed


Closed


Closed

@karelzkarelz
added
the 
Servicing-consider
Issue for next servicing release review
label
Mar 28, 2023
@karelz
karelz
commented
Mar 28, 2023

Copy link


Copy Markdown

Member
Impact on customers hitting real servers (see top post), worth servicing.
@rbhandarbhanda
modified the milestones:
7.0.x, 7.0.6Mar 28, 2023
@rbhandarbhanda
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Mar 28, 2023
@carlossanlop
carlossanlop
commented
Mar 28, 2023

Copy link


Copy Markdown

Contributor
I'm retargeting this PR to the new release/7.0-staging branch, which is the one that we will use from now on for servicing fixes.
Repo maintainers will now be allowed to merge their own servicing PR as long as it meets the requirements:
  • It is approved by Tactics (signaled by adding the Servicing-approved label).
  • It's signed-off by an area owner.
  • The CI is green, or the failures are investigated as unrelated.
  • And if the PR touches an OOB package, the necessary OOB authoring changes are added.
The new process is described here: runtime/docs/project/library-servicing.md.
The infra team will be actively monitoring servicing PRs to ensure all requirements are met and to help with any issues.
Let me know if you have any questions.
@carlossanlop
carlossanlop
changed the base branch from
release/7.0
to
release/7.0-stagingMarch 28, 2023 21:00
@rzikm
rzikm
commented
Mar 29, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Test failures are known problems - tracked in #83901
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 29, 2023

Closed

@rzikm
rzikm
commented
Mar 29, 2023

Copy link


Copy Markdown

Member
@carlossanlop The check-labels check seems to be stuck in the Expected -- Waiting for status to be reported state. Is there a way to restart it?
@carlossanlopcarlossanlop
added

Servicing-approved
Approved for servicing release
and removed

Servicing-approved
Approved for servicing release
labels
Mar 30, 2023
@rzikm
rzikm
commented
Apr 3, 2023

Copy link


Copy Markdown

Member
Test failures are #83901 (known and closed already)
@rzikm
rzikm
merged commit 001172f
into
release/7.0-stagingApr 3, 2023
@jkotas
jkotas
deleted the

backport/pr-83480-to-release/7.0

branch
April 18, 2023 22:46
@ghostghost
locked as resolved and limited conversation to collaborators
May 19, 2023
@rbhandarbhanda
modified the milestones:
7.0.6, 7.0.7Jun 1, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@rzikmrzikmrzikm left review comments
@karelzkarelzkarelz approved these changes
@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Net.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

7.0.7

Development

Successfully merging this pull request may close these issues.

5 participants

@karelz@carlossanlop@rzikm@wfurt@rbhanda

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/7.0] Ensure free buffer space when reading TLS messages - #83574
Merged
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Apr 3, 2023
Merged
[release/7.0] Ensure free buffer space when reading TLS messages#83574
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 17, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Contributor
Backport of #83480 to release/7.0
Fixes#83455.
/cc @rzikm
Customer Impact
7.0 Introduced regression where SslStream would fail to establish TLS connection (and, by extension, HTTPS) to some servers in very specific circumstances (depending on the sizing of TLS records exchanged during the handshake). One such server is lh3.googleusercontent.com.

For affected servers it happens all the time - i.e. .NET is unable to establish connection to them.
Testing
Manual test against the affected server lh3.googleusercontent.com.

CI test suite passes.
Risk
Low, we didn't change code path when the frame size is known. The code change affects only code path when the frame size is unknown, which happens only when the server sends TLS frames slightly shorter than 16K/8K/4K (see example of the google server above).
@ghost
ghost
commented
Mar 17, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Backport of #83480 to release/7.0
/cc @rzikm
Customer Impact
Testing
Risk
IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
Author:github-actions[bot]
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 17, 2023 08:25
@rzikmrzikm
added this to the 7.0.x milestone
Mar 17, 2023
@rzikm
rzikm
requested a review
from karelzMarch 17, 2023 08:27
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 17, 2023

Closed

wfurt
wfurt
approved these changes
Mar 17, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
karelz
karelz
reviewed
Mar 21, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 }

 if (frameSize < int.MaxValue)
 if (frameSize != int.MaxValue)
@karelzkarelzMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it needed? Looks like semantically it is the same. Only MaxValue can be "not <".
@rzikmrzikmMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed, it was part of stylistic change to make it evident that int.MaxValue is a special value ("unknown size"). I can remove it from the backport.

This was referenced Mar 21, 2023

Closed


Closed


Closed

@karelzkarelz
added
the 
Servicing-consider
Issue for next servicing release review
label
Mar 28, 2023
@karelz
karelz
commented
Mar 28, 2023

Copy link


Copy Markdown

Member
Impact on customers hitting real servers (see top post), worth servicing.
@rbhandarbhanda
modified the milestones:
7.0.x, 7.0.6Mar 28, 2023
@rbhandarbhanda
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Mar 28, 2023
@carlossanlop
carlossanlop
commented
Mar 28, 2023

Copy link


Copy Markdown

Contributor
I'm retargeting this PR to the new release/7.0-staging branch, which is the one that we will use from now on for servicing fixes.
Repo maintainers will now be allowed to merge their own servicing PR as long as it meets the requirements:
  • It is approved by Tactics (signaled by adding the Servicing-approved label).
  • It's signed-off by an area owner.
  • The CI is green, or the failures are investigated as unrelated.
  • And if the PR touches an OOB package, the necessary OOB authoring changes are added.
The new process is described here: runtime/docs/project/library-servicing.md.
The infra team will be actively monitoring servicing PRs to ensure all requirements are met and to help with any issues.
Let me know if you have any questions.
@carlossanlop
carlossanlop
changed the base branch from
release/7.0
to
release/7.0-stagingMarch 28, 2023 21:00
@rzikm
rzikm
commented
Mar 29, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Test failures are known problems - tracked in #83901
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 29, 2023

Closed

@rzikm
rzikm
commented
Mar 29, 2023

Copy link


Copy Markdown

Member
@carlossanlop The check-labels check seems to be stuck in the Expected -- Waiting for status to be reported state. Is there a way to restart it?
@carlossanlopcarlossanlop
added

Servicing-approved
Approved for servicing release
and removed

Servicing-approved
Approved for servicing release
labels
Mar 30, 2023
@rzikm
rzikm
commented
Apr 3, 2023

Copy link


Copy Markdown

Member
Test failures are #83901 (known and closed already)
@rzikm
rzikm
merged commit 001172f
into
release/7.0-stagingApr 3, 2023
@jkotas
jkotas
deleted the

backport/pr-83480-to-release/7.0

branch
April 18, 2023 22:46
@ghostghost
locked as resolved and limited conversation to collaborators
May 19, 2023
@rbhandarbhanda
modified the milestones:
7.0.6, 7.0.7Jun 1, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@rzikmrzikmrzikm left review comments
@karelzkarelzkarelz approved these changes
@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Net.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

7.0.7

Development

Successfully merging this pull request may close these issues.

5 participants

@karelz@carlossanlop@rzikm@wfurt@rbhanda

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/7.0] Ensure free buffer space when reading TLS messages - #83574
Merged
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Apr 3, 2023
Merged
[release/7.0] Ensure free buffer space when reading TLS messages#83574
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 17, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Contributor
Backport of #83480 to release/7.0
Fixes#83455.
/cc @rzikm
Customer Impact
7.0 Introduced regression where SslStream would fail to establish TLS connection (and, by extension, HTTPS) to some servers in very specific circumstances (depending on the sizing of TLS records exchanged during the handshake). One such server is lh3.googleusercontent.com.

For affected servers it happens all the time - i.e. .NET is unable to establish connection to them.
Testing
Manual test against the affected server lh3.googleusercontent.com.

CI test suite passes.
Risk
Low, we didn't change code path when the frame size is known. The code change affects only code path when the frame size is unknown, which happens only when the server sends TLS frames slightly shorter than 16K/8K/4K (see example of the google server above).
@ghost
ghost
commented
Mar 17, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Backport of #83480 to release/7.0
/cc @rzikm
Customer Impact
Testing
Risk
IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
Author:github-actions[bot]
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 17, 2023 08:25
@rzikmrzikm
added this to the 7.0.x milestone
Mar 17, 2023
@rzikm
rzikm
requested a review
from karelzMarch 17, 2023 08:27
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 17, 2023

Closed

wfurt
wfurt
approved these changes
Mar 17, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
karelz
karelz
reviewed
Mar 21, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 }

 if (frameSize < int.MaxValue)
 if (frameSize != int.MaxValue)
@karelzkarelzMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it needed? Looks like semantically it is the same. Only MaxValue can be "not <".
@rzikmrzikmMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed, it was part of stylistic change to make it evident that int.MaxValue is a special value ("unknown size"). I can remove it from the backport.

This was referenced Mar 21, 2023

Closed


Closed


Closed

@karelzkarelz
added
the 
Servicing-consider
Issue for next servicing release review
label
Mar 28, 2023
@karelz
karelz
commented
Mar 28, 2023

Copy link


Copy Markdown

Member
Impact on customers hitting real servers (see top post), worth servicing.
@rbhandarbhanda
modified the milestones:
7.0.x, 7.0.6Mar 28, 2023
@rbhandarbhanda
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Mar 28, 2023
@carlossanlop
carlossanlop
commented
Mar 28, 2023

Copy link


Copy Markdown

Contributor
I'm retargeting this PR to the new release/7.0-staging branch, which is the one that we will use from now on for servicing fixes.
Repo maintainers will now be allowed to merge their own servicing PR as long as it meets the requirements:
  • It is approved by Tactics (signaled by adding the Servicing-approved label).
  • It's signed-off by an area owner.
  • The CI is green, or the failures are investigated as unrelated.
  • And if the PR touches an OOB package, the necessary OOB authoring changes are added.
The new process is described here: runtime/docs/project/library-servicing.md.
The infra team will be actively monitoring servicing PRs to ensure all requirements are met and to help with any issues.
Let me know if you have any questions.
@carlossanlop
carlossanlop
changed the base branch from
release/7.0
to
release/7.0-stagingMarch 28, 2023 21:00
@rzikm
rzikm
commented
Mar 29, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Test failures are known problems - tracked in #83901
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 29, 2023

Closed

@rzikm
rzikm
commented
Mar 29, 2023

Copy link


Copy Markdown

Member
@carlossanlop The check-labels check seems to be stuck in the Expected -- Waiting for status to be reported state. Is there a way to restart it?
@carlossanlopcarlossanlop
added

Servicing-approved
Approved for servicing release
and removed

Servicing-approved
Approved for servicing release
labels
Mar 30, 2023
@rzikm
rzikm
commented
Apr 3, 2023

Copy link


Copy Markdown

Member
Test failures are #83901 (known and closed already)
@rzikm
rzikm
merged commit 001172f
into
release/7.0-stagingApr 3, 2023
@jkotas
jkotas
deleted the

backport/pr-83480-to-release/7.0

branch
April 18, 2023 22:46
@ghostghost
locked as resolved and limited conversation to collaborators
May 19, 2023
@rbhandarbhanda
modified the milestones:
7.0.6, 7.0.7Jun 1, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@rzikmrzikmrzikm left review comments
@karelzkarelzkarelz approved these changes
@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Net.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

7.0.7

Development

Successfully merging this pull request may close these issues.

5 participants

@karelz@carlossanlop@rzikm@wfurt@rbhanda

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
[release/7.0] Ensure free buffer space when reading TLS messages - #83574
Merged
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Apr 3, 2023
Merged
[release/7.0] Ensure free buffer space when reading TLS messages#83574
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 17, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Contributor
Backport of #83480 to release/7.0
Fixes#83455.
/cc @rzikm
Customer Impact
7.0 Introduced regression where SslStream would fail to establish TLS connection (and, by extension, HTTPS) to some servers in very specific circumstances (depending on the sizing of TLS records exchanged during the handshake). One such server is lh3.googleusercontent.com.

For affected servers it happens all the time - i.e. .NET is unable to establish connection to them.
Testing
Manual test against the affected server lh3.googleusercontent.com.

CI test suite passes.
Risk
Low, we didn't change code path when the frame size is known. The code change affects only code path when the frame size is unknown, which happens only when the server sends TLS frames slightly shorter than 16K/8K/4K (see example of the google server above).
@ghost
ghost
commented
Mar 17, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Backport of #83480 to release/7.0
/cc @rzikm
Customer Impact
Testing
Risk
IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
Author:github-actions[bot]
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 17, 2023 08:25
@rzikmrzikm
added this to the 7.0.x milestone
Mar 17, 2023
@rzikm
rzikm
requested a review
from karelzMarch 17, 2023 08:27
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 17, 2023

Closed

wfurt
wfurt
approved these changes
Mar 17, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
karelz
karelz
reviewed
Mar 21, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 }

 if (frameSize < int.MaxValue)
 if (frameSize != int.MaxValue)
@karelzkarelzMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it needed? Looks like semantically it is the same. Only MaxValue can be "not <".
@rzikmrzikmMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed, it was part of stylistic change to make it evident that int.MaxValue is a special value ("unknown size"). I can remove it from the backport.

This was referenced Mar 21, 2023

Closed


Closed


Closed

@karelzkarelz
added
the 
Servicing-consider
Issue for next servicing release review
label
Mar 28, 2023
@karelz
karelz
commented
Mar 28, 2023

Copy link


Copy Markdown

Member
Impact on customers hitting real servers (see top post), worth servicing.
@rbhandarbhanda
modified the milestones:
7.0.x, 7.0.6Mar 28, 2023
@rbhandarbhanda
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Mar 28, 2023
@carlossanlop
carlossanlop
commented
Mar 28, 2023

Copy link


Copy Markdown

Contributor
I'm retargeting this PR to the new release/7.0-staging branch, which is the one that we will use from now on for servicing fixes.
Repo maintainers will now be allowed to merge their own servicing PR as long as it meets the requirements:
  • It is approved by Tactics (signaled by adding the Servicing-approved label).
  • It's signed-off by an area owner.
  • The CI is green, or the failures are investigated as unrelated.
  • And if the PR touches an OOB package, the necessary OOB authoring changes are added.
The new process is described here: runtime/docs/project/library-servicing.md.
The infra team will be actively monitoring servicing PRs to ensure all requirements are met and to help with any issues.
Let me know if you have any questions.
@carlossanlop
carlossanlop
changed the base branch from
release/7.0
to
release/7.0-stagingMarch 28, 2023 21:00
@rzikm
rzikm
commented
Mar 29, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Test failures are known problems - tracked in #83901
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 29, 2023

Closed

@rzikm
rzikm
commented
Mar 29, 2023

Copy link


Copy Markdown

Member
@carlossanlop The check-labels check seems to be stuck in the Expected -- Waiting for status to be reported state. Is there a way to restart it?
@carlossanlopcarlossanlop
added

Servicing-approved
Approved for servicing release
and removed

Servicing-approved
Approved for servicing release
labels
Mar 30, 2023
@rzikm
rzikm
commented
Apr 3, 2023

Copy link


Copy Markdown

Member
Test failures are #83901 (known and closed already)
@rzikm
rzikm
merged commit 001172f
into
release/7.0-stagingApr 3, 2023
@jkotas
jkotas
deleted the

backport/pr-83480-to-release/7.0

branch
April 18, 2023 22:46
@ghostghost
locked as resolved and limited conversation to collaborators
May 19, 2023
@rbhandarbhanda
modified the milestones:
7.0.6, 7.0.7Jun 1, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@rzikmrzikmrzikm left review comments
@karelzkarelzkarelz approved these changes
@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Net.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

7.0.7

Development

Successfully merging this pull request may close these issues.

5 participants

@karelz@carlossanlop@rzikm@wfurt@rbhanda

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/7.0] Ensure free buffer space when reading TLS messages - #83574
Merged
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Apr 3, 2023
Merged
[release/7.0] Ensure free buffer space when reading TLS messages#83574
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 17, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Contributor
Backport of #83480 to release/7.0
Fixes#83455.
/cc @rzikm
Customer Impact
7.0 Introduced regression where SslStream would fail to establish TLS connection (and, by extension, HTTPS) to some servers in very specific circumstances (depending on the sizing of TLS records exchanged during the handshake). One such server is lh3.googleusercontent.com.

For affected servers it happens all the time - i.e. .NET is unable to establish connection to them.
Testing
Manual test against the affected server lh3.googleusercontent.com.

CI test suite passes.
Risk
Low, we didn't change code path when the frame size is known. The code change affects only code path when the frame size is unknown, which happens only when the server sends TLS frames slightly shorter than 16K/8K/4K (see example of the google server above).
@ghost
ghost
commented
Mar 17, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Backport of #83480 to release/7.0
/cc @rzikm
Customer Impact
Testing
Risk
IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
Author:github-actions[bot]
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 17, 2023 08:25
@rzikmrzikm
added this to the 7.0.x milestone
Mar 17, 2023
@rzikm
rzikm
requested a review
from karelzMarch 17, 2023 08:27
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 17, 2023

Closed

wfurt
wfurt
approved these changes
Mar 17, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
karelz
karelz
reviewed
Mar 21, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 }

 if (frameSize < int.MaxValue)
 if (frameSize != int.MaxValue)
@karelzkarelzMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it needed? Looks like semantically it is the same. Only MaxValue can be "not <".
@rzikmrzikmMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed, it was part of stylistic change to make it evident that int.MaxValue is a special value ("unknown size"). I can remove it from the backport.

This was referenced Mar 21, 2023

Closed


Closed


Closed

@karelzkarelz
added
the 
Servicing-consider
Issue for next servicing release review
label
Mar 28, 2023
@karelz
karelz
commented
Mar 28, 2023

Copy link


Copy Markdown

Member
Impact on customers hitting real servers (see top post), worth servicing.
@rbhandarbhanda
modified the milestones:
7.0.x, 7.0.6Mar 28, 2023
@rbhandarbhanda
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Mar 28, 2023
@carlossanlop
carlossanlop
commented
Mar 28, 2023

Copy link


Copy Markdown

Contributor
I'm retargeting this PR to the new release/7.0-staging branch, which is the one that we will use from now on for servicing fixes.
Repo maintainers will now be allowed to merge their own servicing PR as long as it meets the requirements:
  • It is approved by Tactics (signaled by adding the Servicing-approved label).
  • It's signed-off by an area owner.
  • The CI is green, or the failures are investigated as unrelated.
  • And if the PR touches an OOB package, the necessary OOB authoring changes are added.
The new process is described here: runtime/docs/project/library-servicing.md.
The infra team will be actively monitoring servicing PRs to ensure all requirements are met and to help with any issues.
Let me know if you have any questions.
@carlossanlop
carlossanlop
changed the base branch from
release/7.0
to
release/7.0-stagingMarch 28, 2023 21:00
@rzikm
rzikm
commented
Mar 29, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Test failures are known problems - tracked in #83901
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 29, 2023

Closed

@rzikm
rzikm
commented
Mar 29, 2023

Copy link


Copy Markdown

Member
@carlossanlop The check-labels check seems to be stuck in the Expected -- Waiting for status to be reported state. Is there a way to restart it?
@carlossanlopcarlossanlop
added

Servicing-approved
Approved for servicing release
and removed

Servicing-approved
Approved for servicing release
labels
Mar 30, 2023
@rzikm
rzikm
commented
Apr 3, 2023

Copy link


Copy Markdown

Member
Test failures are #83901 (known and closed already)
@rzikm
rzikm
merged commit 001172f
into
release/7.0-stagingApr 3, 2023
@jkotas
jkotas
deleted the

backport/pr-83480-to-release/7.0

branch
April 18, 2023 22:46
@ghostghost
locked as resolved and limited conversation to collaborators
May 19, 2023
@rbhandarbhanda
modified the milestones:
7.0.6, 7.0.7Jun 1, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@rzikmrzikmrzikm left review comments
@karelzkarelzkarelz approved these changes
@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Net.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

7.0.7

Development

Successfully merging this pull request may close these issues.

5 participants

@karelz@carlossanlop@rzikm@wfurt@rbhanda

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
[release/7.0] Ensure free buffer space when reading TLS messages - #83574
Merged
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Apr 3, 2023
Merged
[release/7.0] Ensure free buffer space when reading TLS messages#83574
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 17, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Contributor
Backport of #83480 to release/7.0
Fixes#83455.
/cc @rzikm
Customer Impact
7.0 Introduced regression where SslStream would fail to establish TLS connection (and, by extension, HTTPS) to some servers in very specific circumstances (depending on the sizing of TLS records exchanged during the handshake). One such server is lh3.googleusercontent.com.

For affected servers it happens all the time - i.e. .NET is unable to establish connection to them.
Testing
Manual test against the affected server lh3.googleusercontent.com.

CI test suite passes.
Risk
Low, we didn't change code path when the frame size is known. The code change affects only code path when the frame size is unknown, which happens only when the server sends TLS frames slightly shorter than 16K/8K/4K (see example of the google server above).
@ghost
ghost
commented
Mar 17, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Backport of #83480 to release/7.0
/cc @rzikm
Customer Impact
Testing
Risk
IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
Author:github-actions[bot]
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 17, 2023 08:25
@rzikmrzikm
added this to the 7.0.x milestone
Mar 17, 2023
@rzikm
rzikm
requested a review
from karelzMarch 17, 2023 08:27
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 17, 2023

Closed

wfurt
wfurt
approved these changes
Mar 17, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
karelz
karelz
reviewed
Mar 21, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 }

 if (frameSize < int.MaxValue)
 if (frameSize != int.MaxValue)
@karelzkarelzMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it needed? Looks like semantically it is the same. Only MaxValue can be "not <".
@rzikmrzikmMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed, it was part of stylistic change to make it evident that int.MaxValue is a special value ("unknown size"). I can remove it from the backport.

This was referenced Mar 21, 2023

Closed


Closed


Closed

@karelzkarelz
added
the 
Servicing-consider
Issue for next servicing release review
label
Mar 28, 2023
@karelz
karelz
commented
Mar 28, 2023

Copy link


Copy Markdown

Member
Impact on customers hitting real servers (see top post), worth servicing.
@rbhandarbhanda
modified the milestones:
7.0.x, 7.0.6Mar 28, 2023
@rbhandarbhanda
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Mar 28, 2023
@carlossanlop
carlossanlop
commented
Mar 28, 2023

Copy link


Copy Markdown

Contributor
I'm retargeting this PR to the new release/7.0-staging branch, which is the one that we will use from now on for servicing fixes.
Repo maintainers will now be allowed to merge their own servicing PR as long as it meets the requirements:
  • It is approved by Tactics (signaled by adding the Servicing-approved label).
  • It's signed-off by an area owner.
  • The CI is green, or the failures are investigated as unrelated.
  • And if the PR touches an OOB package, the necessary OOB authoring changes are added.
The new process is described here: runtime/docs/project/library-servicing.md.
The infra team will be actively monitoring servicing PRs to ensure all requirements are met and to help with any issues.
Let me know if you have any questions.
@carlossanlop
carlossanlop
changed the base branch from
release/7.0
to
release/7.0-stagingMarch 28, 2023 21:00
@rzikm
rzikm
commented
Mar 29, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Test failures are known problems - tracked in #83901
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 29, 2023

Closed

@rzikm
rzikm
commented
Mar 29, 2023

Copy link


Copy Markdown

Member
@carlossanlop The check-labels check seems to be stuck in the Expected -- Waiting for status to be reported state. Is there a way to restart it?
@carlossanlopcarlossanlop
added

Servicing-approved
Approved for servicing release
and removed

Servicing-approved
Approved for servicing release
labels
Mar 30, 2023
@rzikm
rzikm
commented
Apr 3, 2023

Copy link


Copy Markdown

Member
Test failures are #83901 (known and closed already)
@rzikm
rzikm
merged commit 001172f
into
release/7.0-stagingApr 3, 2023
@jkotas
jkotas
deleted the

backport/pr-83480-to-release/7.0

branch
April 18, 2023 22:46
@ghostghost
locked as resolved and limited conversation to collaborators
May 19, 2023
@rbhandarbhanda
modified the milestones:
7.0.6, 7.0.7Jun 1, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@rzikmrzikmrzikm left review comments
@karelzkarelzkarelz approved these changes
@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Net.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

7.0.7

Development

Successfully merging this pull request may close these issues.

5 participants

@karelz@carlossanlop@rzikm@wfurt@rbhanda

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
[release/7.0] Ensure free buffer space when reading TLS messages - #83574
Merged
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Apr 3, 2023
Merged
[release/7.0] Ensure free buffer space when reading TLS messages#83574
rzikm merged 4 commits into
release/7.0-stagingfrom 
backport/pr-83480-to-release/7.0
Conversation
@github-actions
@github-actionsgithub-actionsBot
commented
Mar 17, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Contributor
Backport of #83480 to release/7.0
Fixes#83455.
/cc @rzikm
Customer Impact
7.0 Introduced regression where SslStream would fail to establish TLS connection (and, by extension, HTTPS) to some servers in very specific circumstances (depending on the sizing of TLS records exchanged during the handshake). One such server is lh3.googleusercontent.com.

For affected servers it happens all the time - i.e. .NET is unable to establish connection to them.
Testing
Manual test against the affected server lh3.googleusercontent.com.

CI test suite passes.
Risk
Low, we didn't change code path when the frame size is known. The code change affects only code path when the frame size is unknown, which happens only when the server sends TLS frames slightly shorter than 16K/8K/4K (see example of the google server above).
@ghost
ghost
commented
Mar 17, 2023

Copy link


Copy Markdown

Tagging subscribers to this area: @dotnet/ncl, @vcsjones

See info in area-owners.md if you want to be subscribed.
Issue Details
Backport of #83480 to release/7.0
/cc @rzikm
Customer Impact
Testing
Risk
IMPORTANT: Is this backport for a servicing release? If so and this change touches code that ships in a NuGet package, please make certain that you have added any necessary package authoring and gotten it explicitly reviewed.
Author:github-actions[bot]
Assignees:-
Labels:
area-System.Net.Security
Milestone:-
@rzikm
rzikm
requested a review
from wfurtMarch 17, 2023 08:25
@rzikmrzikm
added this to the 7.0.x milestone
Mar 17, 2023
@rzikm
rzikm
requested a review
from karelzMarch 17, 2023 08:27
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 17, 2023

Closed

wfurt
wfurt
approved these changes
Mar 17, 2023
View reviewed changes
@wfurtwfurt
left a comment


Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM
karelz
karelz
reviewed
Mar 21, 2023
View reviewed changes
Comment threadsrc/libraries/System.Net.Security/src/System/Net/Security/SslStream.IO.cs
Outdated

 }

 if (frameSize < int.MaxValue)
 if (frameSize != int.MaxValue)
@karelzkarelzMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is it needed? Looks like semantically it is the same. Only MaxValue can be "not <".
@rzikmrzikmMar 21, 2023

Copy link


Copy Markdown

Member
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not needed, it was part of stylistic change to make it evident that int.MaxValue is a special value ("unknown size"). I can remove it from the backport.

This was referenced Mar 21, 2023

Closed


Closed


Closed

@karelzkarelz
added
the 
Servicing-consider
Issue for next servicing release review
label
Mar 28, 2023
@karelz
karelz
commented
Mar 28, 2023

Copy link


Copy Markdown

Member
Impact on customers hitting real servers (see top post), worth servicing.
@rbhandarbhanda
modified the milestones:
7.0.x, 7.0.6Mar 28, 2023
@rbhandarbhanda
added

Servicing-approved
Approved for servicing release
and removed

Servicing-consider
Issue for next servicing release review
labels
Mar 28, 2023
@carlossanlop
carlossanlop
commented
Mar 28, 2023

Copy link


Copy Markdown

Contributor
I'm retargeting this PR to the new release/7.0-staging branch, which is the one that we will use from now on for servicing fixes.
Repo maintainers will now be allowed to merge their own servicing PR as long as it meets the requirements:
  • It is approved by Tactics (signaled by adding the Servicing-approved label).
  • It's signed-off by an area owner.
  • The CI is green, or the failures are investigated as unrelated.
  • And if the PR touches an OOB package, the necessary OOB authoring changes are added.
The new process is described here: runtime/docs/project/library-servicing.md.
The infra team will be actively monitoring servicing PRs to ensure all requirements are met and to help with any issues.
Let me know if you have any questions.
@carlossanlop
carlossanlop
changed the base branch from
release/7.0
to
release/7.0-stagingMarch 28, 2023 21:00
@rzikm
rzikm
commented
Mar 29, 2023•

edited by karelz

Loading

Copy link


Copy Markdown

Member
Test failures are known problems - tracked in #83901
@build-analysisbuild-analysisBot
mentioned this pull request
Mar 29, 2023

Closed

@rzikm
rzikm
commented
Mar 29, 2023

Copy link


Copy Markdown

Member
@carlossanlop The check-labels check seems to be stuck in the Expected -- Waiting for status to be reported state. Is there a way to restart it?
@carlossanlopcarlossanlop
added

Servicing-approved
Approved for servicing release
and removed

Servicing-approved
Approved for servicing release
labels
Mar 30, 2023
@rzikm
rzikm
commented
Apr 3, 2023

Copy link


Copy Markdown

Member
Test failures are #83901 (known and closed already)
@rzikm
rzikm
merged commit 001172f
into
release/7.0-stagingApr 3, 2023
@jkotas
jkotas
deleted the

backport/pr-83480-to-release/7.0

branch
April 18, 2023 22:46
@ghostghost
locked as resolved and limited conversation to collaborators
May 19, 2023
@rbhandarbhanda
modified the milestones:
7.0.6, 7.0.7Jun 1, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.


Reviewers

@rzikmrzikmrzikm left review comments
@karelzkarelzkarelz approved these changes
@wfurtwfurtwfurt approved these changes

Assignees


No one assigned


Labels

area-System.Net.SecurityServicing-approvedApproved for servicing release

Projects


None yet


Milestone

7.0.7

Development

Successfully merging this pull request may close these issues.

5 participants

@karelz@carlossanlop@rzikm@wfurt@rbhanda