mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-06 23:27:04 +02:00
Code Issues Projects Releases Wiki Activity

BUG/MINOR: quic: reject NEW_TOKEN frames from clients

Browse Source 
As specified by RFC 9000, reject NEW_TOKEN frames emitted by clients.
Close the connection with error code PROTOCOL_VIOLATION.

This must be backported up to 2.6.
This commit is contained in:
Amaury Denoyelle 2025-01-07 18:22:00 +01:00
parent a2c0c459a4
commit 4a5d82a97d
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/quic_rx.c
View File

@ -915,7 +915,21 @@ static int qc_parse_pkt_frms(struct quic_conn *qc, struct quic_rx_packet *pkt,
break; break;
case QUIC_FT_NEW_TOKEN: case QUIC_FT_NEW_TOKEN:
/* TODO */ if (qc_is_listener(qc)) {
TRACE_ERROR("reject NEW_TOKEN frame emitted by client",
QUIC_EV_CONN_PRSHPKT, qc);
/* RFC 9000 19.7. NEW_TOKEN Frames
* Clients MUST NOT send NEW_TOKEN frames. A server MUST treat receipt
* of a NEW_TOKEN frame as a connection error of type
* PROTOCOL_VIOLATION.
*/
quic_set_connection_close(qc, quic_err_transport(QC_ERR_PROTOCOL_VIOLATION));
goto err;
}
else {
/* TODO */
}
break; break;
case QUIC_FT_STREAM_8 ... QUIC_FT_STREAM_F: case QUIC_FT_STREAM_8 ... QUIC_FT_STREAM_F:
{ {