Mercurial > hg > nginx
changeset 8533:62b58f0a4711 quic
QUIC: discard incorrect packets instead of closing the connection.
quic-transport
5.2:
Packets that are matched to an existing connection are discarded if
the packets are inconsistent with the state of that connection.
5.2.2:
Servers MUST drop incoming packets under all other circumstances.
author | Vladimir Homutov <vl@nginx.com> |
---|---|
date | Tue, 01 Sep 2020 17:20:42 +0300 |
parents | b13141d6d250 |
children | 985f9351dd87 |
files | src/event/ngx_event_quic.c src/event/ngx_event_quic_transport.c |
diffstat | 2 files changed, 29 insertions(+), 35 deletions(-) [+] |
line wrap: on
line diff
--- a/src/event/ngx_event_quic.c Tue Sep 01 15:21:49 2020 +0300 +++ b/src/event/ngx_event_quic.c Tue Sep 01 17:20:42 2020 +0300 @@ -658,9 +658,8 @@ return NGX_ERROR; } - rc = ngx_quic_parse_long_header(pkt); - if (rc != NGX_OK) { - return rc; + if (ngx_quic_parse_long_header(pkt) != NGX_OK) { + return NGX_ERROR; } if (pkt->version != NGX_QUIC_VERSION) { @@ -1645,7 +1644,6 @@ static ngx_int_t ngx_quic_retry_input(ngx_connection_t *c, ngx_quic_header_t *pkt) { - ngx_int_t rc; ngx_quic_secrets_t *keys; ngx_quic_send_ctx_t *ctx; ngx_quic_connection_t *qc; @@ -1659,15 +1657,14 @@ return NGX_OK; } - rc = ngx_quic_parse_long_header(pkt); - if (rc != NGX_OK) { - return rc; + if (ngx_quic_parse_long_header(pkt) != NGX_OK) { + return NGX_DECLINED; } if (pkt->version != NGX_QUIC_VERSION) { ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic unsupported version: 0x%xD", pkt->version); - return NGX_ERROR; + return NGX_DECLINED; } if (ngx_quic_pkt_zrtt(pkt->flags)) { @@ -1679,11 +1676,11 @@ if (!ngx_quic_pkt_in(pkt->flags)) { ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic invalid initial packet: 0x%xd", pkt->flags); - return NGX_ERROR; + return NGX_DECLINED; } if (ngx_quic_parse_initial_header(pkt) != NGX_OK) { - return NGX_ERROR; + return NGX_DECLINED; } if (ngx_quic_new_dcid(c, &pkt->dcid) != NGX_OK) { @@ -1742,7 +1739,6 @@ static ngx_int_t ngx_quic_initial_input(ngx_connection_t *c, ngx_quic_header_t *pkt) { - ngx_int_t rc; ngx_ssl_conn_t *ssl_conn; ngx_quic_secrets_t *keys; ngx_quic_send_ctx_t *ctx; @@ -1752,19 +1748,22 @@ ssl_conn = c->ssl->connection; - rc = ngx_quic_parse_long_header(pkt); - if (rc != NGX_OK) { - return rc; + if (ngx_quic_parse_long_header(pkt) != NGX_OK) { + return NGX_DECLINED; } if (pkt->version != NGX_QUIC_VERSION) { ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic unsupported version: 0x%xD", pkt->version); - return NGX_ERROR; + return NGX_DECLINED; + } + + if (ngx_quic_check_peer(c->quic, pkt) != NGX_OK) { + return NGX_DECLINED; } if (ngx_quic_parse_initial_header(pkt) != NGX_OK) { - return NGX_ERROR; + return NGX_DECLINED; } keys = &c->quic->keys[ssl_encryption_initial]; @@ -1787,7 +1786,6 @@ static ngx_int_t ngx_quic_handshake_input(ngx_connection_t *c, ngx_quic_header_t *pkt) { - ngx_int_t rc; ngx_queue_t *q; ngx_quic_frame_t *f; ngx_quic_secrets_t *keys; @@ -1808,23 +1806,22 @@ } /* extract cleartext data into pkt */ - rc = ngx_quic_parse_long_header(pkt); - if (rc != NGX_OK) { - return rc; + if (ngx_quic_parse_long_header(pkt) != NGX_OK) { + return NGX_DECLINED; } if (pkt->version != NGX_QUIC_VERSION) { ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic unsupported version: 0x%xD", pkt->version); - return NGX_ERROR; + return NGX_DECLINED; } if (ngx_quic_check_peer(qc, pkt) != NGX_OK) { - return NGX_ERROR; + return NGX_DECLINED; } if (ngx_quic_parse_handshake_header(pkt) != NGX_OK) { - return NGX_ERROR; + return NGX_DECLINED; } pkt->secret = &keys->client; @@ -1863,7 +1860,6 @@ static ngx_int_t ngx_quic_early_input(ngx_connection_t *c, ngx_quic_header_t *pkt) { - ngx_int_t rc; ngx_quic_secrets_t *keys; ngx_quic_send_ctx_t *ctx; ngx_quic_connection_t *qc; @@ -1874,23 +1870,22 @@ qc = c->quic; /* extract cleartext data into pkt */ - rc = ngx_quic_parse_long_header(pkt); - if (rc != NGX_OK) { - return rc; + if (ngx_quic_parse_long_header(pkt) != NGX_OK) { + return NGX_DECLINED; } if (pkt->version != NGX_QUIC_VERSION) { ngx_log_error(NGX_LOG_INFO, c->log, 0, "quic unsupported version: 0x%xD", pkt->version); - return NGX_ERROR; + return NGX_DECLINED; } if (ngx_quic_check_peer(qc, pkt) != NGX_OK) { - return NGX_ERROR; + return NGX_DECLINED; } if (ngx_quic_parse_handshake_header(pkt) != NGX_OK) { - return NGX_ERROR; + return NGX_DECLINED; } keys = &c->quic->keys[ssl_encryption_early_data]; @@ -1970,9 +1965,8 @@ return NGX_DECLINED; } - rc = ngx_quic_parse_short_header(pkt, &qc->dcid); - if (rc != NGX_OK) { - return rc; + if (ngx_quic_parse_short_header(pkt, &qc->dcid) != NGX_OK) { + return NGX_DECLINED; } pkt->secret = &keys->client;
--- a/src/event/ngx_event_quic_transport.c Tue Sep 01 15:21:49 2020 +0300 +++ b/src/event/ngx_event_quic_transport.c Tue Sep 01 17:20:42 2020 +0300 @@ -276,7 +276,7 @@ if (!(pkt->flags & NGX_QUIC_PKT_FIXED_BIT)) { ngx_log_error(NGX_LOG_INFO, pkt->log, 0, "quic fixed bit is not set"); - return NGX_DECLINED; + return NGX_ERROR; } p = ngx_quic_read_uint8(p, end, &idlen); @@ -491,7 +491,7 @@ if (!(pkt->flags & NGX_QUIC_PKT_FIXED_BIT)) { ngx_log_error(NGX_LOG_INFO, pkt->log, 0, "quic fixed bit is not set"); - return NGX_DECLINED; + return NGX_ERROR; } if (ngx_memcmp(p, dcid->data, dcid->len) != 0) {