IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2025-02-25 18:55:26 -06:00
Code Issues Packages Projects Releases Wiki Activity

QUIC: do not update largest packet number from a bad packet.

Browse Source 
The removal of QUIC packet protection depends on the largest packet number
received.  When a garbage packet was received, the decoder still updated the
largest packet number from that packet.  This could affect removing protection
from subsequent QUIC packets.
This commit is contained in:
Roman Arutyunyan 2020-09-01 15:21:49 +03:00
parent 6f0e1bc14f
commit 2087359675
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/event/ngx_event_quic_protection.c
View File

@ -998,7 +998,7 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn,
{
u_char clearflags, *p, *sample;
uint8_t badflags;
uint64_t pn;
uint64_t pn, lpn;
ngx_int_t pnl, rc, key_phase;
ngx_str_t in, ad;
ngx_quic_secret_t *secret;
@ -1043,8 +1043,10 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn,
}
}
lpn = *largest_pn;
pnl = (clearflags & 0x03) + 1;
pn = ngx_quic_parse_pn(&p, pnl, &mask[1], largest_pn);
pn = ngx_quic_parse_pn(&p, pnl, &mask[1], &lpn);
pkt->pn = pn;
pkt->flags = clearflags;
@ -1118,6 +1120,8 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn,
return NGX_ERROR;
}
*largest_pn = lpn;
return NGX_OK;
}