GeezerVison

[CP] Harden 0-RTT frame processing and source CID cleanup (#6476) (#6480

)

## Description

Fix the filtering of which frames are accepted as 0-RTT, and improve
source CID cleanup.

IcMs: 31000000684550, 31000000687914, 31000000700159, 31000000734379,
31000000738257, 31000000738436, 31000000751296.

## Testing

Test run, CI.

## Documentation

No documentation changes.

---------

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 5d910406-82b3-497f-bf92-25a04f3adba2
Copilot-Session: 487d3521-ce98-409c-97d0-ad0f913db058

[CP] Fix path challenge and removal logic (#6020) (#6478)

## Description

Fixes a kernel-mode PAGE_FAULT crash (`KeBugCheckEx`) where
`Connection->PathsCount` reaches 0 and a reverse loop `for (uint8_t i =
PathsCount - 1; ...)` underflows to 255, causing an out-of-bounds read
on `Connection->Paths[255]`.

The results of a combination of issues, largely tied to the invalid
assumption that the path at index 0 in the path array is always valid.

**Root cause:** This is a combination of multiple issues:
- `QuicLossDetectionRetransmitFrames` was used as a way to detect
PATH_CHALLENGE failures and would remove a path, but would not validate
any whether the removed path was the last one.
- `QuicConnGetPathForPacket` would always create a path for incoming
packets at index 1 of the path array, even if the path at index 0 has
been removed.
- `QuicPathRemove` would happily "remove" the same path multiple times

This allows the following scenario:
- A path challenge is sent on path 0
- The path challenge times out
- A PTO causes the retransmission of the path challenge ->
`QuicLossDetectionRetransmitFrames` -> Path 0 is removed (nbPath = 0)
- ACKs are received over a new path 1
- A Path 1 is created at index 1 in the array (nbPath = 1, first
problem, nbPath does match the index actually used)
- Loss detection triggers `QuicLossDetectionRetransmitFrames` -> Path 0
is "removed" again, nbPath = 0

Also fixes #5505: paths were not removed when the peer ACKed a
PATH_CHALLENGE but never sent a PATH_RESPONSE, because path validation
timeout was driven by loss detection retransmission rather than a
wall-clock timer. If the challenge frame was ACKed, loss detection
considered it delivered and never retransmitted, so the timeout never
fired.

### Commits

1. **Replace loss-detection path validation with wall-clock timer**:
Adds a dedicated `QUIC_CONN_TIMER_PATH_VALIDATION` timer instead of
attempting to use loss detection retransmission as a proxy.

2. **Enforce close-if-last and active-path-fallback invariants in
QuicPathRemove** `QuicPathRemove` now handles fallbacks to others paths.
When an attempt is made to remove the last path, QuicPathRemove now
shutdowns the connection and **keeps** the last path as a placeholder
for every operation assuming a path is present.

3. **Use signed int for reverse path loops to prevent underflow**
Changes `uint8_t` loop indices to `int` in all backward-iterating path
loops. When `PathsCount == 0`, `PathsCount - 1` evaluates to `-1` via
integer promotion, making the loop condition immediately false.

4. **Add structured ETW events for path lifecycle operations** Replaces
five `QuicTraceLogConnInfo` string traces with typed `QuicTraceEvent`
ETW events, so further path-related issues can be diagnosed with
low-volume events only.

## Testing

CI

## Documentation

No documentation impact.

Co-authored-by: Sujeet Kumar <[email protected]>
Co-authored-by: Copilot <[email protected]>
Copilot-Session: 487d3521-ce98-409c-97d0-ad0f913db058

[CP] Retry io_uring event queue allocation in execution context tests (…

…#6447) (#6452)

## Description

Add bounded exponential backoff to event queue allocation in the
execution context validation test to mitigate transient io_uring
resource pressure observed in #6441.

The test helper makes at most nine allocation attempts with 255 ms of
total backoff, cleans up the mutex after failed io_uring initialization,
and still fails the test if allocation never succeeds. All three
subcases retain fresh queues. Product code and non-io_uring
initialization behavior are unchanged.

## Testing

Built and tested the PR branch in WSL Ubuntu 24.04, Debug/quictls, with
io_uring enabled and system libcrypto.

- `./msquictest
--gtest_filter=ParameterValidation.ValidateExecutionContext` — passed.
- `git diff --check` — passed.

The existing test covers the queue lifecycle. A passing run does not
establish that memory pressure exercised the retry path.

## Documentation

No documentation impact.

Co-authored-by: Copilot <[email protected]>
Copilot-Session: dea8593e-0432-445b-8a4c-49dcf81fbcd1

[CP] Fix uint16_t underflow in QuicStreamSendWrite (#6384) (#6386)

# Description

Add a guard to prevent integer underflow when computing the available
stream frame length in `QuicStreamSendWrite`. For IPv6 packets with
maximum CID length, the header + crypto overhead could otherwise be
larger than the minimum allowance accepted for sending.

Co-authored-by: Sujeet Kumar <[email protected]>
Co-authored-by: Copilot <[email protected]>
Copilot-Session: 678f4666-c263-4162-8395-ddf61e99ce50

[CP] Fix Ack of a retransmitted RETIRE_CONNECTION_ID causing use-afte…

…r-free of a CID (#6383) (#6388)

# Description

In `QuicLossDetectionOnPacketAcknowledged`, the RETIRE_CONNECTION_ID
case looked up a dest CID by sequence number and freed it without
verifying `CID.Retired`.
A stale ACK after sequence reuse could free an active CID, leading to
UAF.

The removal now checks that the CID is retired before removing
it/freeing it.

Co-authored-by: Sujeet Kumar <[email protected]>
Co-authored-by: Copilot <[email protected]>
Copilot-Session: 678f4666-c263-4162-8395-ddf61e99ce50

[CP] Fix RegistrationCloseCleanupRundown handle leak (#6345) (#6350)

## Description

Fix a user-mode event handle leak during normal MsQuic library shutdown.

#5459 introduced `RegistrationCloseCleanupRundown` to prevent library
unload while asynchronous registration cleanup is pending. Its
initialization failure path uninitializes the rundown, but the
successful shutdown path did not. Add the missing
`CxPlatRundownUninitialize` after the cleanup worker has exited,
restoring symmetric lifecycle cleanup.

## Testing

Not run. The change adds the missing teardown call after rundown
references have drained and the cleanup worker has exited.

## Documentation

No documentation impact.

[CP] Fix RegistrationCloseCleanupRundown handle leak (#6345) (#6350)

## Description

Fix a user-mode event handle leak during normal MsQuic library shutdown.

#5459 introduced `RegistrationCloseCleanupRundown` to prevent library
unload while asynchronous registration cleanup is pending. Its
initialization failure path uninitializes the rundown, but the
successful shutdown path did not. Add the missing
`CxPlatRundownUninitialize` after the cleanup worker has exited,
restoring symmetric lifecycle cleanup.

## Testing

Not run. The change adds the missing teardown call after rundown
references have drained and the cleanup worker has exited.

## Documentation

No documentation impact.

[CP] Fix hostname validation with OpenSSL/QuicTLS (#6274) (#6275)

## Description

Addresses https://microsoft.visualstudio.com/OS/_workitems/edit/62840655

When using the OpenSSL or QuicTLS backends, the target hostname was not
properly validated against the server certificate.
`X509_VERIFY_PARAM_set1_host` and `X509_VERIFY_PARAM_set1_ip_asc` are
now properly called.

The server name provided to `ConnectionStart` is used for the
validation, if it isn't provided, the target IP address is used instead.

## Testing

CI. Manual testing validating a connection succeeds and fail as expected
against various certificate matching or not the hostname and/or IP.
New automated test cases will be added in a follow up.

## Documentation

N/A

Copilot-Session: 25e9a5bc-61c1-44b4-9221-b75067ecca54

[CP] Fix hostname validation with OpenSSL/QuicTLS (#6274) (#6276)

## Description

Addresses https://microsoft.visualstudio.com/OS/_workitems/edit/62840655

When using the OpenSSL or QuicTLS backends, the target hostname was not
properly validated against the server certificate.
`X509_VERIFY_PARAM_set1_host` and `X509_VERIFY_PARAM_set1_ip_asc` are
now properly called.

The server name provided to `ConnectionStart` is used for the
validation, if it isn't provided, the target IP address is used instead.

## Testing

CI. Manual testing validating a connection succeeds and fail as expected
against various certificate matching or not the hostname and/or IP.
New automated test cases will be added in a follow up.

## Documentation

N/A

Copilot-Session: 25e9a5bc-61c1-44b4-9221-b75067ecca54

[CP] Fix hostname validation with OpenSSL/QuicTLS (#6274) (#6277)

## Description

Addresses https://microsoft.visualstudio.com/OS/_workitems/edit/62840655

When using the OpenSSL or QuicTLS backends, the target hostname was not
properly validated against the server certificate.
`X509_VERIFY_PARAM_set1_host` and `X509_VERIFY_PARAM_set1_ip_asc` are
now properly called.

The server name provided to `ConnectionStart` is used for the
validation, if it isn't provided, the target IP address is used instead.

## Testing

CI. Manual testing validating a connection succeeds and fail as expected
against various certificate matching or not the hostname and/or IP.
New automated test cases will be added in a follow up.

## Documentation

N/A

---------

Co-authored-by: Copilot <[email protected]>
Copilot-Session: 25e9a5bc-61c1-44b4-9221-b75067ecca54