examples: ech-client should process all HTTPS records #2278
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
I haven't added this host/config to the daily-test CI job. Perhaps I should? |
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #2278 +/- ##
=======================================
Coverage 94.82% 94.82%
=======================================
Files 104 104
Lines 24102 24102
=======================================
Hits 22855 22855
Misses 1247 1247 ☔ View full report in Codecov by Sentry. |
cpu
force-pushed
the
cpu-ech-client-example-update
branch
from
0816561 to
cb01d9f
Compare
djc
reviewed
Dec 12, 2024
cpu
force-pushed
the
cpu-ech-client-example-update
branch
from
cb01d9f to
c85c70e
Compare
djc
approved these changes
Dec 13, 2024
Benchmark resultsInstruction countsSignificant differencesThere are no significant instruction count differences Other differencesClick to expand
Wall-timeSignificant differencesThere are no significant wall-time differences Other differencesClick to expand
Additional informationCheckout details:
|
cpu
force-pushed
the
cpu-ech-client-example-update
branch
from
df2f66e to
5e0fc07
Compare
This allows us to remove a bunch of `unwrap()`'s from `main()`, simplifying the code.
Move the `resolver_config` into the match arm that uses it. Inline the `Resolver` since it isn't used anywhere except as an arg to `lookup_ech_configs()`.
Previously we only looked at the first HTTPS record's ech-config SCVB param. We should instead collect up the `EchConfigListBytes` from all available HTTPS records. With the list of config lists in hand we should only error if none of the ECH configs across the whole set are compatible.
This updates the documentation to match the more realistic invocation being used in the CI daily-tests.yml job. It also adds a bit more prose to clarify the overall process and where the outer/inner hostnames are used.
cpu
force-pushed
the
cpu-ech-client-example-update
branch
from
5e0fc07 to
84b882f
Compare
djc
approved these changes
Dec 13, 2024
ctz
approved these changes
Dec 13, 2024
Yeah, the |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Previously in the
ech-client.rsexample we only pulledEchConfigListBytesfrom the first HTTPS recordech-configSVC param we found when performing a DNS-over-HTTPS lookup using HickoryDNS.Instead we should process all of the HTTPS records, collect up all of the
EchConfigListBytesfrom each we can, and then use the first compatible ECH config from all of the available lists.As reported in #2276 you could observe this causing issues when running:
Before this change, the client would panic approximately 50% of the time after finding no supported ECH configs from the list in the first HTTPS record. The ECH configs in the other records were not examined.
With this change the client acts as expected and successfully negotiates ECH with the server after finding a good config from the whole set.
Along the way I tried to reduce some of the combinator-soup in favour of simpler logic.
Resolves #2276