mirror of
https://git.haproxy.org/git/haproxy.git/
synced 2025-08-22 23:21:20 +02:00
3c250cb847
This reverts commit 072e77493961a06b89f853f4ab2bbf0e9cf3eff7. Doing h2load with h3 tests we notice this behavior: Client ---- INIT no token SCID = a , DCID = A ---> Server (1) Client <--- RETRY+TOKEN DCID = a, SCID = B ---- Server (2) Client ---- INIT+TOKEN SCID = a , DCID = B ---> Server (3) Client <--- INIT DCID = a, SCID = C ---- Server (4) Client ---- INIT+TOKEN SCID = a, DCID = C ---> Server (5) With (5) dropped by haproxy due to token validation. Indeed the previous patch adds SCID of retry packet sent to the aad of the token ciphering aad. It was useful to validate the next INIT packets including the token are sent by the client using the new provided SCID for DCID as mantionned into the RFC 9000. But this stateless information is lost on received INIT packets following the first outgoing INIT packet from the server because the client is also supposed to re-use a second time the lastest received SCID for its new DCID. This will break the token validation on those last packets and they will be dropped by haproxy. It was discussed there: https://mailarchive.ietf.org/arch/msg/quic/7kXVvzhNCpgPk6FwtyPuIC6tRk0/ To resume: this is not the role of the server to verify the re-use of retry's SCID for DCID in further client's INIT packets. The previous patch must be reverted in all versions where it was backported (supposed until 2.6)
89 lines
3.3 KiB
C
89 lines
3.3 KiB
C
/*
|
|
* QUIC protocol definitions (TX side).
|
|
*
|
|
* Copyright (C) 2023
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation, version 2.1
|
|
* exclusively.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#ifndef _HAPROXY_QUIC_TX_H
|
|
#define _HAPROXY_QUIC_TX_H
|
|
|
|
#include <haproxy/buf-t.h>
|
|
#include <haproxy/list-t.h>
|
|
#include <haproxy/quic_conn-t.h>
|
|
#include <haproxy/quic_tls-t.h>
|
|
#include <haproxy/quic_tx-t.h>
|
|
|
|
struct buffer *qc_txb_alloc(struct quic_conn *qc);
|
|
void qc_txb_release(struct quic_conn *qc);
|
|
int qc_purge_txbuf(struct quic_conn *qc, struct buffer *buf);
|
|
struct buffer *qc_get_txb(struct quic_conn *qc);
|
|
|
|
int qc_need_sending(struct quic_conn *qc, struct quic_enc_level *qel);
|
|
int qc_prep_hpkts(struct quic_conn *qc, struct buffer *buf, struct list *qels);
|
|
int qc_send_ppkts(struct buffer *buf, struct ssl_sock_ctx *ctx);
|
|
int qc_may_probe_ipktns(struct quic_conn *qc);
|
|
int quic_build_post_handshake_frames(struct quic_conn *qc);
|
|
int qc_send_app_pkts(struct quic_conn *qc, struct list *frms);
|
|
int qc_dgrams_retransmit(struct quic_conn *qc);
|
|
int qc_notify_send(struct quic_conn *qc);
|
|
void qc_prep_hdshk_fast_retrans(struct quic_conn *qc,
|
|
struct list *ifrms, struct list *hfrms);
|
|
int quic_generate_retry_token_aad(unsigned char *aad,
|
|
uint32_t version,
|
|
const struct quic_cid *scid,
|
|
const struct sockaddr_storage *addr);
|
|
int send_retry(int fd, struct sockaddr_storage *addr,
|
|
struct quic_rx_packet *pkt, const struct quic_version *qv);
|
|
int send_stateless_reset(struct listener *l, struct sockaddr_storage *dstaddr,
|
|
struct quic_rx_packet *rxpkt);
|
|
int send_version_negotiation(int fd, struct sockaddr_storage *addr,
|
|
struct quic_rx_packet *pkt);
|
|
|
|
/* The TX packets sent in the same datagram are linked to each others in
|
|
* the order they are built. This function detach a packet from its successor
|
|
* and predecessor in the same datagram.
|
|
*/
|
|
static inline void quic_tx_packet_dgram_detach(struct quic_tx_packet *pkt)
|
|
{
|
|
if (pkt->prev)
|
|
pkt->prev->next = pkt->next;
|
|
if (pkt->next)
|
|
pkt->next->prev = pkt->prev;
|
|
}
|
|
|
|
|
|
/* Increment the reference counter of <pkt> */
|
|
static inline void quic_tx_packet_refinc(struct quic_tx_packet *pkt)
|
|
{
|
|
pkt->refcnt++;
|
|
}
|
|
|
|
/* Decrement the reference counter of <pkt> */
|
|
static inline void quic_tx_packet_refdec(struct quic_tx_packet *pkt)
|
|
{
|
|
if (--pkt->refcnt == 0) {
|
|
BUG_ON(!LIST_ISEMPTY(&pkt->frms));
|
|
/* If there are others packet in the same datagram <pkt> is attached to,
|
|
* detach the previous one and the next one from <pkt>.
|
|
*/
|
|
quic_tx_packet_dgram_detach(pkt);
|
|
pool_free(pool_head_quic_tx_packet, pkt);
|
|
}
|
|
}
|
|
|
|
#endif /* _HAPROXY_QUIC_TX_H */
|