diff --git a/quest/m1/quic/coverage/README.md b/quest/m1/quic/coverage/README.md index 83612a88e24..41f9854a134 100644 --- a/quest/m1/quic/coverage/README.md +++ b/quest/m1/quic/coverage/README.md @@ -43,6 +43,8 @@ and the harness defaults to Cubic while production runs BBR3. ## Required - [Characterization tests](/quest/m1/quic/coverage/characterize.md) - golden scheduling order, and every uncovered frame, reset, limit, and endpoint path, on today's harness +- [Plaintext fuzz crypto](/quest/m1/quic/coverage/fuzz-crypto.md) - a fuzz-only plaintext session so the connection target skips TLS and its injected packets decrypt +- [Richer simulation workloads](/quest/m1/quic/coverage/sim-workloads.md) - resets, bidi streams, datagrams, and migration in the random workloads, each with its own invariant - [Pin benchmark cores](/quest/m1/quic/coverage/bench-pin.md) - local base/head comparisons run on one core type on hybrid CPUs ## Related diff --git a/quest/m1/quic/coverage/fuzz-crypto.md b/quest/m1/quic/coverage/fuzz-crypto.md new file mode 100644 index 00000000000..a8bd437ed9f --- /dev/null +++ b/quest/m1/quic/coverage/fuzz-crypto.md @@ -0,0 +1,27 @@ +# [S] Plaintext crypto for fuzzing + +## Goal + +A plaintext crypto session in `moq-quic`'s hidden `fuzz` module (no TLS +handshake, no packet protection) lets the `connection` fuzz target skip the +per-input TLS cost and decrypt the packets it injects, so fuzzing reaches the +frame layer at far higher throughput. It never ships in a non-test build. + +## Plan + +Decided 2026-10-16 with the maintainer: + +- One implementation, in the hidden `fuzz` feature module. The Criterion + benchmarks enable `--features fuzz`, as moq-net's already do, and replace + their bench-local no-op protection (`NoProtection*` in + `rs/moq-quic/benches/common/mod.rs`, ported from quinn `perf`'s + `noprotection.rs`) with it. +- The `connection` target switches to it, so injected and mutated packets + decrypt instead of being dropped at the AEAD. Today it runs about 64 + inputs/s, almost all spent in the handshake. +- Once packets decrypt, an injected or corrupted packet can carry valid + STREAM or DATAGRAM frames, so the target's integrity checks (stream bytes + match what was written, `check_datagram` matches what was sent) exclude + the streams and datagrams those packets touch; no-panic still covers every + input. +- Not a debug transport: nothing outside the `fuzz` feature can name it. diff --git a/quest/m1/quic/coverage/sim-workloads.md b/quest/m1/quic/coverage/sim-workloads.md new file mode 100644 index 00000000000..15926f0aeab --- /dev/null +++ b/quest/m1/quic/coverage/sim-workloads.md @@ -0,0 +1,32 @@ +# [M] Richer simulation workloads + +## Goal + +The seeded simulation's random workloads in `rs/moq-quic/src/tests/sim.rs` +also exercise the paths the QUIC rewrites cut, each with its own invariant, +so a refactor that breaks one fails a replayable seed: + +- **Resets**: RESET_STREAM and RESET_STREAM_AT mid-transfer. The reader + sees an unmodified prefix of what was written, then the reset code. The + prefix covers at least the reliable size for RESET_STREAM_AT and may be + any length for RESET_STREAM, since bytes already read stay read. Stream + and connection credit come back. +- **Stops**: STOP_SENDING mid-transfer. The sender observes the code + through `SendStream::stopped` or `WriteError::Stopped`, the stopped + reader sees nothing further, and credit comes back. +- **Bidirectional streams**: both sides write on the same streams, and every + byte arrives once and in order in each direction. +- **Datagrams** interleaved with streams: each arrives at most once and + unmodified, and datagrams never stall stream progress. On a lossless link + with buffers sized for the workload, every datagram arrives, so dropping + them all fails. +- **Migration**: NAT rebinding and active migration mid-workload. The + connection survives and every delivery invariant still holds. + +## Plan + +Decided 2026-10-16 with the maintainer. Reuse the workload generator and +invariant checks from the seeded simulation, under the same PR budget (64 +fixed cases) and nightly sweep (`just rs quic-sim`). If migration needs +address changes that `Pair`'s `Link`s cannot express, add the smallest +harness hook for it here; flag it on the PR if that pushes past [M]. diff --git a/quest/m1/test-flakes-2/README.md b/quest/m1/test-flakes-2/README.md index 1a33b9d966b..cc225ae508f 100644 --- a/quest/m1/test-flakes-2/README.md +++ b/quest/m1/test-flakes-2/README.md @@ -38,6 +38,7 @@ Public API: none. Wire: none. - [Update after finish](/quest/m1/test-flakes-2/update-after-finish.md) - a subscribe update racing a publisher's finish ends the track cleanly in JS and Rust, not with the write's error - [Auth refresh mocks time](/quest/m1/test-flakes-2/auth-refresh-mock-time.md) - moq-relay's auth refresh and fixed-lease tests measure a grant's life on one mocked clock - [uring teardown close](/quest/m1/test-flakes-2/uring-teardown-close.md) - moq-uring's published-close teardown test holds under load, fixed at its cause +- [Relay burst drill](/quest/m1/test-flakes-2/relay-burst-impaired.md) - the impaired transport-peer burst drill never aborts its subscription while the link is up - [WASM IETF read](/quest/m1/test-flakes-2/wasm-ietf-read.md) - the WASM suite's IETF read case reads whole groups on a loaded runner, fixed at the burst or the assertion as the evidence says - [BBR marking seed](/quest/m1/test-flakes-2/bbr-marking-seed.md) - the BBR marking test seeds its probe schedule, replays a failing seed, and its rare drop is fixed at the cause diff --git a/quest/m1/test-flakes-2/relay-burst-impaired.md b/quest/m1/test-flakes-2/relay-burst-impaired.md new file mode 100644 index 00000000000..25c8f670973 --- /dev/null +++ b/quest/m1/test-flakes-2/relay-burst-impaired.md @@ -0,0 +1,25 @@ +# [S] The relay burst drill holds on an impaired peer link + +## Goal + +The `bursts_cross_a_transport_peer::impaired` drill +(`rs/moq-relay/tests/drills.rs`) passes reliably, fixed at its cause. It +still proves that bursts cross a relay peer link over an impaired transport +without the subscription aborting while the link is up. + +## Plan + +Seen 2026-10-16 on the io_uring job for #5772 (run 38974661047, head +1c1055c): the subscription aborted with "internal error" at the drill's +`Err(err) => panic!("the subscription aborted: {err}")` arm, which is +reached only when the route is not flapping. A rerun passed. The PR touched +only the dev shell, so the drill ran only because every crate was retested. + +Decided 2026-10-16 (maintainer): a child of this questline, m1. Reproduce it +first, on the io_uring lane under load. Then find which layer produces the +"internal error": an abort that reaches a subscriber while its peer link is +up is a product bug unless the drill's impairment legitimately cut the link, +in which case the drill must classify that as a flap. Never widen a timeout +or add a retry. + +Public API: none expected. Wire: none.