1
0
mirror of https://github.com/facebookincubator/mvfst.git synced 2025-11-09 10:00:57 +03:00
Commit Graph

206 Commits

Author SHA1 Message Date
Yang Chi
a67083ff4b Close connection if we derive an extra 1-rtt write cipher
Summary: Fixes CVE-2021-24029

Reviewed By: mjoras, lnicco

Differential Revision: D26613890

fbshipit-source-id: 19bb2be2c731808144e1a074ece313fba11f1945
2021-03-03 07:26:26 -08:00
Matt Joras
21f190220e Implement basic ACK_FREQUENCY support.
Summary: As in title. This doesn't actually send any frames, but implements basic support for the transport parameter and responding to the frames.

Reviewed By: yangchi

Differential Revision: D26134787

fbshipit-source-id: 2c48e01084034317c8f36f89c69d172e3cb42278
2021-02-02 19:02:40 -08:00
Yang Chi
5d6d9c5ae2 Increase QUIC connection flow control blocked closing connection log
Summary: as title

Reviewed By: lnicco

Differential Revision: D25860869

fbshipit-source-id: 6c83621d3c01b625bf5d63d4aa4cbcd72df91646
2021-01-09 13:43:42 -08:00
Yang Chi
8fcb4805f5 Only logs the client giving up FC blocked stream/conn log if stream/conn has
Summary:
as title

(Note: this ignores all push blocking failures!)

Reviewed By: mjoras

Differential Revision: D25772188

fbshipit-source-id: aa466539d301ba913ceb78d717f53ca31dbd4644
2021-01-06 07:39:33 -08:00
Yang Chi
ee71bf229e Reduce the amount of client giving up FC Blocked stream logging
Summary: as title

Reviewed By: mjoras, lnicco

Differential Revision: D25771697

fbshipit-source-id: 71498c0cad7cecca08f3481461ed425e3a56c9fa
2021-01-04 18:28:56 -08:00
Yang Chi
8657b5e1ac Log QUIC stream receives stop_sending from peer when it's flow control blocked
Summary:
well, the previously added log was wrong in the reset path. it should
be in the stop sending path

Reviewed By: avasylev

Differential Revision: D25724136

fbshipit-source-id: e6cec3c225e066d16c09da895356578cd6ec6808
2020-12-29 14:01:51 -08:00
Yang Chi
9faa4544f3 A couple easy code hygiene in QUIC
Summary:
(1) Stop moving integral types (2) stop copying
ClientTransportParameters

Reviewed By: lnicco, avasylev

Differential Revision: D25724204

fbshipit-source-id: 624ff097f7ea7595e122904c84f6f12a3324e1e9
2020-12-29 11:00:56 -08:00
Yang Chi
c1223a2f78 Remove trailing _E from QUIC variant type
Summary:
I think this should just work without the trailing `_E`. It was added
when we mixed up our own union based variant and boost::variant. Some compiler
flags didn't like that. Now we no longer have mixed up cases, this should be
fine

Reviewed By: lnicco

Differential Revision: D25589393

fbshipit-source-id: 6430dc20f8e81af0329d89e6990c16826da168b8
2020-12-16 18:03:05 -08:00
Yang Chi
1160b9594c Vlog when QUIC stream/connection is closed while flow control blocked
Summary: as title

Reviewed By: avasylev

Differential Revision: D25587900

fbshipit-source-id: 07b7796a9ad60db71c1ea0497d80cde8187631f4
2020-12-16 10:02:49 -08:00
Xiaoting Tang
a30b49b914 turn off blackhole detection
Summary: Speed up the experiment by disabling blackhole detection all together temporarily.

Reviewed By: mjoras

Differential Revision: D24997566

fbshipit-source-id: 2781e586f5ba9896633ab0716e78cfc49e0e34a4
2020-11-16 20:40:50 -08:00
Xiaoting Tang
d985a8fcc1 Add transport knob to enforce udp payload size
Summary: Adds another knob param to enforce udp payload size. This is basically a "canIgnorePathMTU" knob that client has.

Reviewed By: mjoras

Differential Revision: D24586165

fbshipit-source-id: befb265a24fae8f450f323cf2d652a8b448e698c
2020-11-05 12:45:18 -08:00
Matt Joras
a1b70eb5f7 Experiment with disabling reordering threshold.
Summary: Accomplished by setting it very high.

Reviewed By: yangchi

Differential Revision: D24656684

fbshipit-source-id: 97120b867b659f1ef6ff46ea23de0db672e36948
2020-11-02 10:43:04 -08:00
Matt Joras
e8208baa3d TokenlessPacer default.
Summary: As in title.

Reviewed By: yangchi

Differential Revision: D24495623

fbshipit-source-id: f0cb39bc3e1d680cd9a1639e4a25ecaebc27952a
2020-10-23 21:02:36 -07:00
Matt Joras
3961235618 1ms pacing timer tick for experimental
Summary: This is potentially a better min interval for the TokenlessPacer, as event loops can often take > 200us.

Reviewed By: yangchi

Differential Revision: D24123176

fbshipit-source-id: 21b023925d331b196676a71a3a2eb3bc8e62df6c
2020-10-07 11:53:20 -07:00
Xiaoting Tang
f4086dc092 Make commonly-used d6d types individual target
Summary: This reduces dependencies for both testing and instrumentation.

Reviewed By: mjoras

Differential Revision: D23997313

fbshipit-source-id: 5eb3a790c7bb2569dc1e941e3911ad4aac4e9258
2020-09-30 09:32:50 -07:00
Matt Joras
f16d60e922 Use initial CID as DCID in the qlogger.
Summary: Since the DCID is often empty for clients, this is otherwise not a very useful field.

Reviewed By: yangchi

Differential Revision: D23998639

fbshipit-source-id: b8949ca6913ed270e5ebd0a0c5335b224f817774
2020-09-29 16:59:13 -07:00
Xiaoting Tang
f9e916c194 Prepare metadata
Summary:
Here are some of the questions I guess we'd like to answer regarding d6d:
- How long, and how many probes does d6d take to find the PMTU upper bound for a
  given connection?
- If PMTU blackhole is detected, what's the packet size that triggers the
  signal? And what's the state of d6d when that happens? Also, if there's issue
  with the PMTU stability in the path, in what frequency does it oscillate?

This adds some meta data in d6d's lifecycle in order to provide info when those
events happen.

Reviewed By: mjoras

Differential Revision: D23972069

fbshipit-source-id: f6a2d1d656b33d94b41ecfbb0c06bdaf299caa8b
2020-09-29 11:47:20 -07:00
Matt Joras
af3a408cf7 Increment out of order QUIC_STATS
Summary: We have this counter but don't increment it, might as well.

Reviewed By: yangchi

Differential Revision: D23916621

fbshipit-source-id: 0a8cb947f1941e04789a0144a4fec87239caef50
2020-09-25 12:12:02 -07:00
Amaury Séchet
71c88def3d Assing hanshake cipher directly in the conn object (#174)
Summary:
This reduce the amount of state overall.

Depends on https://github.com/facebookincubator/mvfst/issues/173

Pull Request resolved: https://github.com/facebookincubator/mvfst/pull/174

Test Plan:
Imported from GitHub, without a `Test Plan:` line.

 ---
## Traffic Canary
https://our.intern.facebook.com/intern/traffic/canary?fbid=1410439575823198
* elb.prod.msp1c01 - binary - 2020-09-21 11:33 - https://fburl.com/dyndash/uq2r8ruc
* slb.prod_regional.rrva0c00 - binary - 2020-09-21 11:33 - https://fburl.com/dyndash/aq7vnb1e
* slb.regional.rcln0c01 - binary - 2020-09-21 11:33 - https://fburl.com/dyndash/t2oc8ll3
 ---

Reviewed By: yangchi

Differential Revision: D23681965

Pulled By: mjoras

fbshipit-source-id: 15cad0dd807720f3f6d000aade9368fe4608b832
2020-09-24 10:31:13 -07:00
vaz985
a8d5c156a1 Adding packet rtt sampling to instrumentationObserver (#178)
Summary:
Due to high number of RTT samples I refactored the OutstandingPacket to
split the packet data and packet metrics. We know have access to metrics
without the need of saving the packet data.

Pull Request resolved: https://github.com/facebookincubator/mvfst/pull/178

Reviewed By: mjoras

Differential Revision: D23711641

Pulled By: bschlinker

fbshipit-source-id: 53791f1f6f6e184f37afca991a873af05909fbd2
2020-09-22 18:39:00 -07:00
Xiaoting Tang
5317134c84 Timeouts that drive d6d lifecycle
Summary:
This glues together the d6d lifecycle via probe timeout and raise timeout.
Had to put these two timeouts in the base transport because it has all the
necessary accountings (e.g. check close state, process callbacks) that should
happen before scheduling timeouts.

Other notable changes (included here because code is simple):
- Keep track of d6d probes in loss state. Upon second thought, it makes more
sense because we are reducing the available bandwidth as a result of sending
probes anyway. And not tracking them imposes a delay on congestion controller.
I think this does not violate the d6d spec's point of not penalizing congestion
window for d6d probes, because
    - 1. we don't put losses of d6d probes in loss event. Therefore from the POV of
congestion controller, d6d probes never get lost.
    - there will be at most kDefaultD6DMaxOutstandingProbes losses (i.e.  2)
that we don't tell congestion controller about. Even if those are actually
caused by congestion, it should have minimal impact because 2 is small and if there's really a congestion, the loss of normal packets should provide the signal.
- Pacing d6d probes
- Kick off d6d after a delay of 1s. This should filter out short-lived connections where probing is relatively expensive and less useful.

Reviewed By: mjoras

Differential Revision: D23736656

fbshipit-source-id: 8121fa8bcebab10a56a4e046c32c4e99ed6c3013
2020-09-22 08:44:25 -07:00
Xiaoting Tang
ffc434ab11 Refactor server handling of max_recv_pkt_size to prepare a larger probing upper limit
Summary:
This should be a noop in our current set up. I added some comments to clarify
the logic. Put it in another way,
- `udpSendPacketLen = f(max_packet_size, kDefaultMaxUDPPayload, canIgnorePathMTU)`
- `d6d.maxPMTU = g(max_packet_size, kDefaultMaxUDPPayload, d6dConfig.enabled)`

`f` and `g` are what the code does.

Reviewed By: mjoras

Differential Revision: D23745844

fbshipit-source-id: bc8c38a8a9086fe31e5f367d01737f360c403353
2020-09-22 08:44:25 -07:00
Xiaoting Tang
33c5832ff3 Add probe timeout transport setting
Summary:
Similar to raise timeout, client can choose the probe timeout via transport
parameter. This timeout might not end up being useful because by the time the
recommended timeout (15s) expires, either:
i. the probe gets acked, d6d send a larger probe or sleeps if the upper bound
is found
ii. the probe is lost, then quic will likely determine its loss faster than
15s, upon which a PMTU blackhole is recognized

So adding this is mostly for mvfst to be compliant with the d6d spec, and
potentially useful if we want to control probe sending rate upon ack, e.g. send
the next probe after 1s upon ack instead of immediately.

Reviewed By: yangchi

Differential Revision: D23700182

fbshipit-source-id: 18b740d05343591d6afa086b9fae746e6c71aca5
2020-09-16 13:58:34 -07:00
Xiaoting Tang
485726f5d6 log error only when d6d transport parameters are present
Summary:
Currently it logs error even if transport parameters are not present, but in
that we should assume the client doesn't want d6d, so we should not log error at
all.

Reviewed By: yangchi

Differential Revision: D23681935

fbshipit-source-id: 6420ff3053cd6c7d2d0ddad854f481e4f422c992
2020-09-14 23:29:27 -07:00
Xiaoting Tang
9cdb922288 Special treatment to d6d probe in tx/rx path via isD6DProbe flag in OutstandingPacket
Summary:
According to the spec, loss of d6d probe packet should not affect congestion
control, but AFAIU its ack should be considered a normal ack and has all the
implications of an ack (e.g. sample srtt, increment largest ack num).

Additionally, although d6d probe uses ping frame, neither sending a d6d probe
nor receiving the ack should have any bearing on either pendingEvents.sendPing
or pendingEvents.cancelPingTimeout.

To differentiate a d6d probe from a normal packet in tx/rx path, the isD6DProbe
flag is added. I also added a new struct to store d6d specific states (1 field
in this diff, more to come in subsequent diffs). In updateConnection, we
identify a d6d probe by comparing the packet sequence num with the sequence num
stored in the lastProbe field of the d6d state.

Reviewed By: mjoras

Differential Revision: D22551400

fbshipit-source-id: 85ec30c185666c3d5cf827bf03b4f92e6f22d4ec
2020-09-14 16:06:21 -07:00
Matt Joras
ab381b319a Use TokenlessPacer for experimental
Summary: This enables the TokenlessPacer if the version is MVFST_EXPERIMENAL.

Reviewed By: yangchi

Differential Revision: D23600318

fbshipit-source-id: 22f2c702a0aa7f1219d3a84bb21a4ad6135240b5
2020-09-09 13:39:52 -07:00
Amaury Séchet
91525d80bf Make ServerHandshake's fields protected (#161)
Summary:
This will make migrating the fizz parts way easier.

Pull Request resolved: https://github.com/facebookincubator/mvfst/pull/161

Reviewed By: yangchi

Differential Revision: D23560257

Pulled By: xttjsn

fbshipit-source-id: 1f0f78f26d221f23542a9d900b23ba0bc4e60f6d
2020-09-09 09:26:43 -07:00
Xiaoting Tang
1ee77666b6 Re-introduce d6d configs
Summary:
As a second attempt to add d6d, I tried to be as non-intrusive as possible, by de-coupling all state that d6d needs from the existing transport state.

To reduce complexity, I made the assumption that, as a starter, only server does the probing. To make it easy to control d6d in different connection settings, both the server and the client has a toggle `enabled`. It is only when both the server and client are `enabled`, that server will do probing for a connection.

Among all the changes, this adds:
- Two transport parameters:
  - `d6d_base_pmtu`: this is the base PMTU client advertises to server during handshake. A valid presence of this value indicates that clients d6d module is `enabled`. Although this config value is not used by server, I kept it in `D6DConfig` to avoid complexity and make it possible for future extension where clients might also do probing.
  - `d6d_raise_timeout`: this is the raise timeout client advertises to server during handshake. It is the amount of time d6d "sleeps" after it finds an upper bond. It is optional. We want this because depending on the network conditions we might need to adjust this timeout.

Reviewed By: mjoras

Differential Revision: D23409623

fbshipit-source-id: bad6df443cc13dc4d69532342f182cb919c5a7dd
2020-09-02 15:40:12 -07:00
Luca Niccolini
c47c3cf5c6 Revert PMTU and size-enforced packet builder
Differential Revision: D23283619

fbshipit-source-id: b7fe31871dad5711016234a2d10ae84edc4fd24c
2020-08-22 16:55:54 -07:00
Xiaoting Tang
dc3cc9fca4 Respect canIgnorePMTU transport setting
Summary: Mitigate a regression caused by ignoring this setting.

Reviewed By: mjoras, lnicco

Differential Revision: D23267566

fbshipit-source-id: dc93116c0dab21c9070a4245c4e4eb9dcd9d2de1
2020-08-21 19:51:44 -07:00
Xiaoting Tang
4762cfb927 Introduce PMTU as a variable
Summary:
First step towards d6d. Semantically we need to separate the old `udpSendPacketLen` into `peerMaxPacketSize` as well as `currPMTU`. The former is directly tied to the peer's max_packet_size transport parameter whereas the second is controlled by d6d. To get the actual udp mss, call `conn_->getUdpSendPacketLen()`, which will use the minimum of the two if d6d is enabled, otherwise it will fallback to use `peerMaxPacketSize` only.

During processClientInitialParams and processServerInitialParams, we no longer need to check whether `canIgnorePathMTU` is set because that logic is moved to `setUdpSendPacketLen`. If d6d is enabled, we set both `peerMaxPacketSize` and `currPMTU` to `packetSize` because receiving an initial packet of size x indicates both that the peer accepts x-sized packet and that the PMTU is at least x.

Many call sites and tests are changed.

Faebook:
For now, d6d is considered enabled if `canIgnorePathMTU==false` and `turnoffPMTUD==true`. Down the road, from semantic & practical POV at least one of them should be renamed to something like `enableD6D`, since enabling d6d implies turning off PMTUD and that we should not ignore PMTU. We can keep one for the sake of testing.

Reviewed By: mjoras

Differential Revision: D22049806

fbshipit-source-id: 7a9b30b7e2519c132101509be56a9e63b803dc93
2020-08-17 16:15:24 -07:00
Matt Joras
4e55f8272a Implicit ack Initial space on receiving a Handshake packet.
Summary:
This should be safe, as by the time we have successfully decrypted a handshake packet there's no more initial data.

The caveat here, I suppose, is that we are now relying on an implicit ACK of the initial instead of an explicit RTT signal.

Reviewed By: yangchi

Differential Revision: D22667820

fbshipit-source-id: 8d34e063d4bf4bb435db09694153fbaa0f061be1
2020-07-22 17:26:22 -07:00
Junqi Wang
8fd23f5316 Remove redundant const value kDefaultConnectionIdLimit
Reviewed By: mjoras

Differential Revision: D22264684

fbshipit-source-id: aade83c4c19d0d285bd78755227bc257b071561a
2020-06-29 15:52:32 -07:00
Yang Chi
51b917b0b3 PingFrame is not a simple frame
Summary:
The problem with Ping being a simple frame:
(1) All SimpleFrames are in the same scheduler. So sending ping means we may
also send other frames which can be problematic if we send in Initial or
Handshake space
(2) Ping isn't retranmisttable. But other Simple frames are. So we are
certainly setting this wrong when we send pure Ping packet today.

That being said, there are cases where we need to treat Ping as retransmittable.
One is when it comes to update ack state: If peer sends us Ping, we may want to
Ack early rather than late. so it makes sense to treat Ping as retransmittable.
Another place is insertion into OutstandingPackets list. When our API user sends
Ping, then also add a Ping timeout. Without adding pure Ping packets into OP list,
we won't be able to track the acks to our Pings.

Reviewed By: mjoras

Differential Revision: D21763935

fbshipit-source-id: a04e97b50cf4dd4e3974320a4d2cc16eda48eef9
2020-06-18 15:30:44 -07:00
Matt Joras
42bba01005 Draft-29 support.
Summary:
This implements the connection ID validation via transport parameters. Note we don't do anything with the retry transport parameter yet.

This will probably require further surgery to tests when we want the MVFST version to do this, but for now I'm punting on that test plumbing.

This retains support for h3-27.

Reviewed By: yangchi

Differential Revision: D22045631

fbshipit-source-id: e93841e734c0683655c751d808fd90b3b391eb3e
2020-06-16 17:05:41 -07:00
Matt Joras
50d5c29346 Cipher dropping take 2
Summary:
Now we won't have a zero PTO and we will properly clear out the outstanding packets.

Note that this cipher dropping is not what the draft prescribes, instead dropping both the initial and handshake ciphers when we know 1-rtt communication is functioning.

Reviewed By: yangchi

Differential Revision: D20388737

fbshipit-source-id: 0b89eb80c8faa796ab09eda3eaa10a00dcf7bae9
2020-05-06 11:14:20 -07:00
Luca Niccolini
5ca21a5278 rename infoCallback to statsCallback
Summary:
```
find ./quic | xargs -I{} sed -i "s/infoCallback/statsCallback/g" {}
find ./quic | xargs -I{} sed -i "s/InfoCallback/StatsCallback/g" {}
```

(Note: this ignores all push blocking failures!)

Reviewed By: mjoras

Differential Revision: D20860675

fbshipit-source-id: 4fe99a375b5983da51b6727d7f40788f89083ab3
2020-04-11 11:16:51 -07:00
Aman Sharma
bf1cecdd40 Add a new "RetryPacket" type
Summary: This diff adds a new RetryPacket type, without changing any existing functionality.

Reviewed By: mjoras

Differential Revision: D19631435

fbshipit-source-id: 227864ee8f276fe4c593d5aa37209ca77267310d
2020-04-06 14:16:50 -07:00
Matt Joras
2176f080ff Set upper limits on max_packet_size from the peer.
Summary: This will limit us to standard Ethernet MTU (1500) for now, but I think that is fine. This will allow us to experiment with packet size from the client more easily.

Reviewed By: yangchi

Differential Revision: D20709146

fbshipit-source-id: 608463de53d4520a257052491683263e14fc9682
2020-03-27 17:22:44 -07:00
Junqi Wang
eff7f6166b active conn id limit includes the one negotiated during handshake
Summary: https://tools.ietf.org/html/draft-ietf-quic-transport-27#section-18.1

Reviewed By: vchynarov

Differential Revision: D20671649

fbshipit-source-id: 23cf96e4e13201aedf0bb6a1e31dfe2f2feaa987
2020-03-26 21:57:28 -07:00
Yang Chi
264203b87d Remove duplicate Quic logging of PARSE_ERROR in 0-rtt buffered case
Summary:
When parsePacket returns anything other than RegularPacket, we already
log the Drop even inside the switch-case blocks before checking if
RegularPacket has been parsed. So the logging of Drop with PARSE_ERROR when the
CodecResult isn't RegularPacket is wrong. For example, right now when we
buffer 0-rtt data, we always log a Drop immediatly afterwards into QLog which
is incorrect.

Reviewed By: JunqiWang

Differential Revision: D20421934

fbshipit-source-id: d836700fd691645951d5e5b49b19cbcc1e5df51a
2020-03-13 11:32:40 -07:00
Zachary Weinberger
88e3fdadc0 Add streaming option for FileQLogger
Summary: In the constructor of FileQlogger adds a bool that sets streaming mode. If it's set it creates a thread that reads events from the log and immediatly outputs them to an output file.

Reviewed By: mjoras

Differential Revision: D20250881

fbshipit-source-id: 2af3ff0aeaa5b62f90b0c01570c96c92fdab4412
2020-03-12 13:47:35 -07:00
Yang Chi
9cea11f2bd QuicServerWorker rejects CID already present in CID Map
Summary:
The CID Algo can possibly generate a CID that's already in the map.
This diff adds a mechanism to reject such CID and try another one.
ServerStateMachine will loop encoding CIDs until either QuicServerWorker no
longer rejects, or encode fails

Reviewed By: udippant, vchynarov

Differential Revision: D20251043

fbshipit-source-id: a38e4e8b33007779a9710c32057d47f32f7d1774
2020-03-09 16:06:22 -07:00
Matt Joras
7a08fec63d Set active connection id limit properly
Summary: This has a mandatory minimum of 2. This diff doesn't fix the unit tests which use a lower value, but currently other clients will fail our connection as this is a MUST.

Reviewed By: lnicco

Differential Revision: D20299054

fbshipit-source-id: 769337ccc5bdf75b7b85518bf88e393979b63f3f
2020-03-05 20:30:21 -08:00
Matt Joras
d1a3652a4c Iterate QuicVersion::MVFST
Summary:
This iterates the mvfst version to be semantically equivalent to draft-27, and leaves support for the old mvfst version.

The client will not yet be moved to draft-27 by default.

Reviewed By: lnicco

Differential Revision: D20182452

fbshipit-source-id: 1e11ad7296a6cd8d15ca5ed359d9ed82af79bb17
2020-03-04 22:08:34 -08:00
Matt Joras
ef92376cb0 Support draft-27 transport parameters
Summary:
The transport parameters format changed in draft 27. It is now self describing via varints.

This diff retains support for the old encoding and does not iterate the mvfst version.

Reviewed By: lnicco

Differential Revision: D20149977

fbshipit-source-id: c6fa9c226f859ed81ca83ada5a8bc5832b4a3388
2020-03-04 22:08:34 -08:00
Matt Joras
3b2ba3fe8b Implement handshake done
Summary: This is without cipher dropping, but the frame is parseable and the server will send it at the correct time.

Reviewed By: yangchi, lnicco

Differential Revision: D20235013

fbshipit-source-id: 696c11ec573a530b3ed9f4185a2f6847ee08819f
2020-03-04 22:08:33 -08:00
Matt Joras
61cd1a7289 Back out "Implement handshake done and cipher dropping."
Summary: This caused an increase in client errors.

Reviewed By: yangchi, lnicco

Differential Revision: D20186386

fbshipit-source-id: 737122a94c97498efba61292a6c292cfe482925c
2020-03-01 18:31:40 -08:00
Matt Joras
2b3b76cc4d Remove support for MVFST_OLD.
Summary:
This eliminatees some tech debt by completely removing the notion of version from the core transport parameters structure and the app token for zero rtt.

Note that for the draft-27 changes we will need to temporarily re-introduce it, but to a different layer (the extension encoding itself).

Reviewed By: JunqiWang

Differential Revision: D20073578

fbshipit-source-id: 2b55af621566bf1c20e21dd17251116de1788fa0
2020-02-28 09:52:34 -08:00
Matt Joras
472e40a902 Implement handshake done and cipher dropping.
Summary: This implements the handshake done signal and also cipher dropping.

Reviewed By: yangchi

Differential Revision: D19584922

fbshipit-source-id: a98bec8f1076393b051ff65a2d8aae7d572b42f5
2020-02-27 12:25:52 -08:00