Correct complete_io behaviour when close_notify alert is received

[ctz]

Release notes:

• This release corrects a denial-of-service condition in rustls::ConnectionCommon::complete_io, reachable via network input. If a close_notify alert is received during a handshake, complete_io did not terminate. Callers which do not call complete_io are not affected.
• Add an API (handshake_kind()) for learning whether a handshake was resumed or not.

[rustls-benchmarking]

Benchmark results

Instruction counts

Significant differences

There are no significant instruction count differences

Other differences

Click to expand

Scenario	Baseline	Candidate	Diff	Threshold
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_aes_client	8664969	8698170	33201 (0.38%)	0.58%
handshake_session_id_aws_lc_rs_1.2_rsa_aes_server	3911500	3897292	-14208 (-0.36%)	2.93%
handshake_tickets_aws_lc_rs_1.2_rsa_aes_server	4382383	4394755	12372 (0.28%)	4.44%
handshake_tickets_aws_lc_rs_1.3_rsa_chacha_server	32548545	32607173	58628 (0.18%)	0.51%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_aes_client	30325657	30275054	-50603 (-0.17%)	0.38%
handshake_no_resume_aws_lc_rs_1.3_rsa_aes_server	13354873	13373955	19082 (0.14%)	1.18%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_chacha_client	8656902	8668947	12045 (0.14%)	0.95%
transfer_no_resume_aws_lc_rs_1.2_rsa_aes_server	46425625	46373056	-52569 (-0.11%)	0.35%
handshake_no_resume_ring_1.3_ecdsap256_chacha_client	3911844	3916016	4172 (0.11%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_rsa_chacha_server	13410656	13400595	-10061 (-0.08%)	1.63%
handshake_no_resume_aws_lc_rs_1.2_rsa_aes_server	12992871	13000775	7904 (0.06%)	1.03%
transfer_no_resume_aws_lc_rs_1.3_rsa_aes_server	46494579	46469615	-24964 (-0.05%)	0.43%
handshake_session_id_aws_lc_rs_1.3_rsa_aes_server	32331988	32348590	16602 (0.05%)	0.66%
handshake_no_resume_ring_1.3_ecdsap256_aes_client	3914183	3912175	-2008 (-0.05%)	0.21%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_aes_client	30094251	30085643	-8608 (-0.03%)	0.23%
handshake_no_resume_aws_lc_rs_1.2_rsa_aes_client	2009382	2008914	-468 (-0.02%)	0.20%
handshake_tickets_ring_1.2_rsa_aes_client	4507938	4507032	-906 (-0.02%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_aes_server	1885337	1885042	-295 (-0.02%)	0.20%
handshake_no_resume_ring_1.3_rsa_chacha_client	2954968	2954506	-462 (-0.02%)	0.20%
handshake_no_resume_ring_1.3_ecdsap256_aes_server	2129632	2129321	-311 (-0.01%)	0.31%
handshake_tickets_ring_1.3_ecdsap256_chacha_client	41971120	41965449	-5671 (-0.01%)	0.20%
handshake_tickets_aws_lc_rs_1.3_rsa_aes_server	32626408	32622337	-4071 (-0.01%)	0.68%
handshake_session_id_ring_1.3_ecdsap256_aes_client	41847105	41851720	4615 (0.01%)	0.20%
handshake_no_resume_ring_1.3_rsa_aes_client	2949177	2948872	-305 (-0.01%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_chacha_client	30090648	30093728	3080 (0.01%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_chacha_client	30302345	30299359	-2986 (-0.01%)	0.33%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_chacha_client	92711219	92702601	-8618 (-0.01%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_rsa_chacha_client	2216750	2216950	200 (0.01%)	0.20%
handshake_tickets_ring_1.2_rsa_aes_server	4663198	4663603	405 (0.01%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_aes_client	58206418	58201395	-5023 (-0.01%)	0.20%
handshake_session_id_ring_1.3_ecdsap256_chacha_client	41771295	41767803	-3492 (-0.01%)	0.20%
handshake_tickets_aws_lc_rs_1.2_rsa_aes_client	4283047	4282786	-261 (-0.01%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_rsa_aes_client	2209279	2209150	-129 (-0.01%)	0.20%
handshake_no_resume_ring_1.3_rsa_chacha_server	12174549	12173861	-688 (-0.01%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_rsa_chacha_server	80601951	80597617	-4334 (-0.01%)	0.30%
handshake_session_id_ring_1.2_rsa_aes_server	4231869	4231686	-183 (-0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_rsa_chacha_server	32249625	32248266	-1359 (-0.00%)	0.82%
handshake_tickets_aws_lc_rs_1.3_rsa_aes_client	30319353	30320471	1118 (0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_chacha_server	4265090	4264953	-137 (-0.00%)	0.20%
handshake_session_id_ring_1.3_rsa_aes_client	41862834	41861495	-1339 (-0.00%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_chacha_client	30295157	30294232	-925 (-0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_aes_client	30107184	30106311	-873 (-0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_chacha_server	32302100	32303010	910 (0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap384_chacha_server	13739932	13739546	-386 (-0.00%)	0.20%
handshake_no_resume_ring_1.3_rsa_aes_server	12168273	12167937	-336 (-0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap256_aes_client	58318976	58320553	1577 (0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap256_chacha_server	2131347	2131290	-57 (-0.00%)	0.36%
handshake_tickets_ring_1.3_rsa_chacha_server	43614638	43615707	1069 (0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_aes_server	4261371	4261475	104 (0.00%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_aes_server	32588945	32589703	758 (0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap256_chacha_client	92653426	92651449	-1977 (-0.00%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_chacha_server	32577283	32577969	686 (0.00%)	0.20%
handshake_session_id_ring_1.3_rsa_chacha_client	41780432	41781310	878 (0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_rsa_chacha_client	30105231	30104665	-566 (-0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_chacha_server	1888683	1888648	-35 (-0.00%)	0.20%
handshake_tickets_ring_1.3_ecdsap384_aes_server	43692976	43693765	789 (0.00%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_aes_server	32589836	32590350	514 (0.00%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_chacha_server	32577383	32577893	510 (0.00%)	0.20%
handshake_no_resume_ring_1.2_rsa_aes_client	2856056	2856098	42 (0.00%)	0.20%
handshake_session_id_ring_1.3_rsa_chacha_server	43307358	43307988	630 (0.00%)	0.20%
handshake_tickets_ring_1.3_ecdsap384_aes_client	42032269	42032876	607 (0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_chacha_client	3362636	3362590	-46 (-0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_rsa_aes_client	30120258	30120665	407 (0.00%)	0.20%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_aes_client	3360757	3360802	45 (0.00%)	0.25%
handshake_tickets_aws_lc_rs_1.3_rsa_chacha_client	30306617	30306215	-402 (-0.00%)	0.20%
handshake_session_id_ring_1.3_rsa_aes_server	43409997	43409424	-573 (-0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap384_chacha_client	35473704	35473251	-453 (-0.00%)	0.20%
handshake_no_resume_ring_1.2_rsa_aes_server	11985236	11985085	-151 (-0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_aes_server	32330865	32331266	401 (0.00%)	0.20%
handshake_tickets_ring_1.3_ecdsap256_chacha_server	43617731	43618265	534 (0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_chacha_server	32302487	32302097	-390 (-0.00%)	0.20%
handshake_tickets_ring_1.3_rsa_chacha_client	41981511	41981014	-497 (-0.00%)	0.20%
handshake_session_id_ring_1.2_rsa_aes_client	4233770	4233812	42 (0.00%)	0.20%
handshake_tickets_ring_1.3_rsa_aes_client	42050106	42050510	404 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_aes_client	58219651	58220189	538 (0.00%)	0.20%
handshake_session_id_ring_1.3_ecdsap384_chacha_client	41763109	41762739	-370 (-0.00%)	0.20%
handshake_session_id_ring_1.3_ecdsap384_aes_server	43412726	43412346	-380 (-0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_chacha_client	30109510	30109251	-259 (-0.00%)	0.48%
transfer_no_resume_ring_1.3_rsa_chacha_server	80514300	80514965	665 (0.00%)	0.20%
handshake_session_id_ring_1.3_ecdsap384_aes_client	41843482	41843820	338 (0.00%)	0.20%
handshake_tickets_ring_1.3_ecdsap384_chacha_server	43617188	43617512	324 (0.00%)	0.20%
handshake_tickets_ring_1.3_ecdsap384_chacha_client	41962900	41962592	-308 (-0.00%)	0.20%
transfer_no_resume_ring_1.3_rsa_aes_client	58319105	58319496	391 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.2_rsa_aes_client	68643796	68644224	428 (0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.2_rsa_aes_client	3958800	3958776	-24 (-0.00%)	0.20%
transfer_no_resume_ring_1.3_rsa_chacha_client	92651885	92652421	536 (0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap256_chacha_server	80507212	80506759	-453 (-0.00%)	0.20%
handshake_tickets_ring_1.3_rsa_aes_server	43691408	43691652	244 (0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap384_aes_server	46457471	46457692	221 (0.00%)	0.20%
handshake_session_id_ring_1.3_ecdsap384_chacha_server	43310660	43310454	-206 (-0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap384_chacha_client	92647677	92648090	413 (0.00%)	0.20%
transfer_no_resume_ring_1.2_rsa_aes_client	58202884	58202627	-257 (-0.00%)	0.20%
transfer_no_resume_ring_1.2_rsa_aes_server	46361752	46361950	198 (0.00%)	0.20%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_aes_server	32330837	32330969	132 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_chacha_client	92688725	92689048	323 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_rsa_aes_client	58221647	58221482	-165 (-0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_aes_server	46419400	46419272	-128 (-0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap384_aes_client	58315767	58315617	-150 (-0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_aes_server	46419168	46419285	117 (0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap256_aes_server	46453944	46454060	116 (0.00%)	0.20%
handshake_session_id_ring_1.3_ecdsap256_aes_server	43412821	43412720	-101 (-0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_chacha_server	80609484	80609334	-150 (-0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap384_aes_client	35471616	35471554	-62 (-0.00%)	0.20%
transfer_no_resume_ring_1.3_ecdsap384_chacha_server	80510543	80510681	138 (0.00%)	0.20%
handshake_tickets_ring_1.3_ecdsap256_aes_server	43694311	43694379	68 (0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_chacha_server	80609483	80609378	-105 (-0.00%)	0.20%
transfer_no_resume_aws_lc_rs_1.3_rsa_chacha_client	92689795	92689883	88 (0.00%)	0.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_aes_client	30306454	30306429	-25 (-0.00%)	0.20%
handshake_no_resume_ring_1.3_ecdsap384_aes_server	13737519	13737511	-8 (-0.00%)	0.20%
transfer_no_resume_ring_1.3_rsa_aes_server	46461630	46461657	27 (0.00%)	0.20%
handshake_tickets_ring_1.3_ecdsap256_aes_client	42037222	42037209	-13 (-0.00%)	0.20%
handshake_session_id_ring_1.3_ecdsap256_chacha_server	43311013	43311004	-9 (-0.00%)	0.20%

Wall-time

Significant differences

There are no significant wall-time differences

Other differences

Click to expand

Scenario	Baseline	Candidate	Diff	Threshold
handshake_session_id_aws_lc_rs_1.2_rsa_aes	2.03 ms	2.02 ms	-0.02 ms (-0.77%)	1.27%
handshake_tickets_ring_1.3_ecdsap256_chacha	6.73 ms	6.69 ms	-0.04 ms (-0.53%)	1.00%
handshake_tickets_ring_1.3_ecdsap256_aes	6.77 ms	6.73 ms	-0.03 ms (-0.51%)	1.15%
handshake_tickets_ring_1.3_rsa_chacha	7.22 ms	7.19 ms	-0.03 ms (-0.46%)	1.11%
handshake_session_id_ring_1.3_rsa_chacha	7.21 ms	7.18 ms	-0.03 ms (-0.45%)	1.00%
handshake_session_id_ring_1.3_rsa_aes	7.25 ms	7.22 ms	-0.03 ms (-0.40%)	1.00%
handshake_session_id_ring_1.3_ecdsap256_chacha	6.71 ms	6.68 ms	-0.03 ms (-0.40%)	1.00%
handshake_tickets_ring_1.3_rsa_aes	7.26 ms	7.23 ms	-0.03 ms (-0.40%)	1.00%
handshake_session_id_ring_1.3_ecdsap256_aes	6.74 ms	6.72 ms	-0.03 ms (-0.37%)	1.00%
handshake_session_id_ring_1.3_ecdsap384_aes	9.85 ms	9.82 ms	-0.03 ms (-0.35%)	1.00%
transfer_no_resume_ring_1.2_rsa_aes	6.72 ms	6.75 ms	0.02 ms (0.35%)	3.41%
handshake_session_id_ring_1.3_ecdsap384_chacha	9.82 ms	9.78 ms	-0.03 ms (-0.34%)	1.00%
handshake_tickets_ring_1.3_ecdsap384_chacha	9.83 ms	9.80 ms	-0.03 ms (-0.32%)	1.00%
handshake_tickets_ring_1.3_ecdsap384_aes	9.87 ms	9.84 ms	-0.03 ms (-0.32%)	1.00%
handshake_tickets_aws_lc_rs_1.2_rsa_aes	2.19 ms	2.18 ms	-0.01 ms (-0.29%)	1.83%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_aes	5.94 ms	5.92 ms	-0.02 ms (-0.28%)	1.26%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_aes	1.19 ms	1.18 ms	-0.00 ms (-0.28%)	1.00%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_aes	5.24 ms	5.23 ms	-0.01 ms (-0.22%)	1.30%
transfer_no_resume_aws_lc_rs_1.2_rsa_aes	5.41 ms	5.42 ms	0.01 ms (0.22%)	4.22%
handshake_session_id_aws_lc_rs_1.3_ecdsap384_chacha	5.91 ms	5.90 ms	-0.01 ms (-0.22%)	1.00%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_aes	5.95 ms	5.94 ms	-0.01 ms (-0.21%)	1.00%
handshake_session_id_aws_lc_rs_1.3_rsa_aes	6.16 ms	6.14 ms	-0.01 ms (-0.20%)	1.57%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_aes	4.48 ms	4.49 ms	0.01 ms (0.20%)	4.88%
transfer_no_resume_ring_1.3_ecdsap384_aes	9.43 ms	9.45 ms	0.02 ms (0.19%)	1.71%
handshake_tickets_ring_1.2_rsa_aes	1.63 ms	1.63 ms	-0.00 ms (-0.16%)	1.54%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_chacha	5.21 ms	5.20 ms	-0.01 ms (-0.14%)	1.56%
transfer_no_resume_ring_1.3_rsa_aes	6.82 ms	6.82 ms	0.01 ms (0.13%)	2.66%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_aes	474.71 µs	475.29 µs	0.57 µs (0.12%)	3.78%
transfer_no_resume_aws_lc_rs_1.3_rsa_aes	5.40 ms	5.41 ms	0.01 ms (0.12%)	3.73%
handshake_session_id_aws_lc_rs_1.3_rsa_chacha	6.13 ms	6.12 ms	-0.01 ms (-0.12%)	1.29%
handshake_no_resume_aws_lc_rs_1.3_ecdsap384_chacha	1.17 ms	1.18 ms	0.00 ms (0.12%)	1.04%
handshake_session_id_aws_lc_rs_1.3_ecdsap256_aes	5.22 ms	5.21 ms	-0.01 ms (-0.12%)	1.48%
handshake_no_resume_aws_lc_rs_1.2_rsa_aes	1.33 ms	1.33 ms	0.00 ms (0.11%)	1.28%
handshake_no_resume_ring_1.3_ecdsap256_chacha	504.27 µs	503.75 µs	-0.53 µs (-0.10%)	2.08%
handshake_tickets_aws_lc_rs_1.3_rsa_aes	6.16 ms	6.16 ms	-0.01 ms (-0.10%)	1.14%
handshake_session_id_ring_1.2_rsa_aes	1.55 ms	1.55 ms	-0.00 ms (-0.09%)	1.58%
handshake_no_resume_aws_lc_rs_1.3_ecdsap256_chacha	474.17 µs	474.54 µs	0.37 µs (0.08%)	2.46%
handshake_no_resume_aws_lc_rs_1.3_rsa_chacha	1.38 ms	1.38 ms	0.00 ms (0.07%)	1.02%
transfer_no_resume_aws_lc_rs_1.3_rsa_chacha	13.87 ms	13.88 ms	0.01 ms (0.07%)	1.43%
handshake_no_resume_aws_lc_rs_1.3_rsa_aes	1.39 ms	1.39 ms	0.00 ms (0.07%)	1.14%
transfer_no_resume_aws_lc_rs_1.3_ecdsap256_chacha	12.96 ms	12.97 ms	0.01 ms (0.06%)	1.62%
handshake_no_resume_ring_1.3_ecdsap384_chacha	3.61 ms	3.61 ms	0.00 ms (0.05%)	1.00%
transfer_no_resume_ring_1.3_ecdsap384_chacha	16.08 ms	16.09 ms	0.01 ms (0.05%)	1.23%
transfer_no_resume_ring_1.3_rsa_chacha	13.47 ms	13.48 ms	0.00 ms (0.04%)	1.41%
transfer_no_resume_ring_1.3_ecdsap256_chacha	12.98 ms	12.98 ms	0.00 ms (0.03%)	1.50%
handshake_tickets_aws_lc_rs_1.3_ecdsap384_chacha	5.93 ms	5.94 ms	0.00 ms (0.03%)	1.00%
handshake_no_resume_ring_1.3_ecdsap384_aes	3.61 ms	3.61 ms	-0.00 ms (-0.03%)	1.00%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_chacha	13.67 ms	13.67 ms	0.00 ms (0.03%)	1.61%
handshake_no_resume_ring_1.3_rsa_chacha	998.28 µs	998.00 µs	-0.28 µs (-0.03%)	1.00%
transfer_no_resume_ring_1.3_ecdsap256_aes	6.32 ms	6.33 ms	0.00 ms (0.03%)	3.23%
handshake_no_resume_ring_1.2_rsa_aes	976.69 µs	976.92 µs	0.22 µs (0.02%)	1.00%
handshake_no_resume_ring_1.3_rsa_aes	997.92 µs	998.14 µs	0.21 µs (0.02%)	1.00%
handshake_no_resume_ring_1.3_ecdsap256_aes	505.73 µs	505.80 µs	0.07 µs (0.01%)	2.63%
transfer_no_resume_aws_lc_rs_1.3_ecdsap384_aes	5.20 ms	5.20 ms	-0.00 ms (-0.01%)	4.11%
handshake_tickets_aws_lc_rs_1.3_rsa_chacha	6.16 ms	6.16 ms	-0.00 ms (-0.01%)	1.20%
handshake_tickets_aws_lc_rs_1.3_ecdsap256_chacha	5.23 ms	5.23 ms	0.00 ms (0.00%)	1.17%

Additional information

Historical results

Checkout details:

• Base repo: https://github.com/rustls/rustls.git
• Base branch: main (1f5146c)
• Candidate repo: https://github.com/rustls/rustls.git
• Candidate branch: jbp-complete-io-with-early-close_notify (0d9f9c7)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.49%. Comparing base (5ea02ed) to head (0d9f9c7).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1905   +/-   ##
=======================================
  Coverage   95.49%   95.49%           
=======================================
  Files          86       86           
  Lines       18646    18650    +4     
=======================================
+ Hits        17806    17810    +4     
  Misses        840      840           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[cpu]

Add an API for learning whether a handshake was resumed or not.

Maybe worth mentioning the new API fn? "Add an API, handshake_kind(), for learning whether a handshake was resumed or not."