diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2020-09-01 15:21:49 +0300 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2020-09-01 15:21:49 +0300 |
| commit | 208735967547b989c243b70370061ba422c229d7 (patch) | |
| tree | 650a29220badbc8d826ecd6eab9dcf8a90eaadb1 | |
| parent | 6f0e1bc14ff0324c3b3680aa4731ce224e517295 (diff) | |
| download | nginx-208735967547b989c243b70370061ba422c229d7.tar.gz nginx-208735967547b989c243b70370061ba422c229d7.tar.bz2 | |
QUIC: do not update largest packet number from a bad packet.
The removal of QUIC packet protection depends on the largest packet number
received. When a garbage packet was received, the decoder still updated the
largest packet number from that packet. This could affect removing protection
from subsequent QUIC packets.
| -rw-r--r-- | src/event/ngx_event_quic_protection.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/src/event/ngx_event_quic_protection.c b/src/event/ngx_event_quic_protection.c index ae6ae27e7..8e7fcc1e8 100644 --- a/src/event/ngx_event_quic_protection.c +++ b/src/event/ngx_event_quic_protection.c @@ -998,7 +998,7 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn, { u_char clearflags, *p, *sample; uint8_t badflags; - uint64_t pn; + uint64_t pn, lpn; ngx_int_t pnl, rc, key_phase; ngx_str_t in, ad; ngx_quic_secret_t *secret; @@ -1043,8 +1043,10 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn, } } + lpn = *largest_pn; + pnl = (clearflags & 0x03) + 1; - pn = ngx_quic_parse_pn(&p, pnl, &mask[1], largest_pn); + pn = ngx_quic_parse_pn(&p, pnl, &mask[1], &lpn); pkt->pn = pn; pkt->flags = clearflags; @@ -1118,6 +1120,8 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn, return NGX_ERROR; } + *largest_pn = lpn; + return NGX_OK; } |