mirror of
https://github.com/nginx/nginx.git
synced 2025-02-25 18:55:26 -06:00
QUIC: ignore version negotiation packets.
Previously, such packets were treated as long header packets with unknown version 0, and a version negotiation packet was sent in response. This could be used to set up an infinite traffic reflect loop with another nginx instance. Now version negotiation packets are ignored. As per RFC 9000, Section 6.1: An endpoint MUST NOT send a Version Negotiation packet in response to receiving a Version Negotiation packet.
This commit is contained in:
parent
e9e83dbb69
commit
0d11f2885e
@ -295,6 +295,11 @@ ngx_quic_parse_packet(ngx_quic_header_t *pkt)
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
if (pkt->version == 0) {
|
||||
/* version negotiation */
|
||||
return NGX_ERROR;
|
||||
}
|
||||
|
||||
if (!ngx_quic_supported_version(pkt->version)) {
|
||||
return NGX_ABORT;
|
||||
}
|
||||
|
Loading…
Reference in New Issue
Block a user