Skip to content

colibri 0.7.0: QUIC version 2, the program's CPU probe, and the server's deadlines

Choose a tag to compare

View all tags
@c4milo c4milo released this 30 Sep 17:07
· 558 commits to main since this release
v0.7.0
6d91b1e

colibri 0.7.0 speaks QUIC version 2 beside version 1, takes the program's probe of its CPU for TLS, and ends slow and silent peers at the server. It pins chapulin 900ce67 and stdx fa53aa4.

Breaking changes

  • tls.Client and tls.Server values take cpu, the platform.Cpu that stdx's platform.probe() returns, with no default. A session runs the AES instructions only when aes_clmul is yes, and ChaCha20 alone otherwise (decision 97). Depend on stdx at the commit colibri pins, with the options colibri gives it (.target and .release), so both reach one platform.Cpu. colibri's package does not export platform.
  • server enforces deadlines: first request, idle, head, body, send, h2's SETTINGS acknowledgment and drain. Each is a named limit in its configuration that a caller may change or turn off (decision 110).

What's new

  • QUIC version 2 (RFC 9369) with compatible version negotiation (RFC 9368). A client lists version 2 and switches when its server answers in it. A server switches every client that lists it, unless its switch_to is null. A client offered a ticket starts in the ticket's version (decisions 108 and 111).
  • h2 ends a connection whose peer opens and resets more than 100 streams a second (CVE-2023-44487).
  • One chapulin object per architecture runs the AES instructions or ChaCha20, as the probe says. ChaCha20 runs four blocks at a time on SSE2 and NEON. chapulin 900ce67 seals a 16 KiB AES-256-GCM record in about 5.5 µs on an Apple M1 Pro, where 044a49c took 27 to 36 µs (chapulin's own figures).
  • bench/: the judge and its workflow (design §8 step 13a).
  • h11: CONNECT and Upgrade fixes.

Checked

tools/ci.sh passed every section on macOS arm64, with 2505 of 2505 tests in Debug and ReleaseSafe.

Assets 2
Loading