view auto/cc/ccc @ 8798:077a1e403446 quic

QUIC: additional limit for probing packets. RFC 9000, 9.3. Responding to Connection Migration: An endpoint only changes the address to which it sends packets in response to the highest-numbered non-probing packet. The patch extends this requirement to probing packets. Although it may seem excessive, it helps with mitigation of reply attacks (when an off-path attacker has copied packet with PATH_CHALLENGE and uses different addresses to exhaust available connection ids).
author Vladimir Homutov <vl@nginx.com>
date Thu, 20 Jan 2022 22:00:25 +0300
parents d620f497c50f
children
line wrap: on
line source


# Copyright (C) Igor Sysoev
# Copyright (C) Nginx, Inc.


# Compaq C V6.5-207

ngx_include_opt="-I"

# warnings

CFLAGS="$CFLAGS -msg_enable level6 -msg_fatal level6"

CFLAGS="$CFLAGS -msg_disable unknownmacro"
CFLAGS="$CFLAGS -msg_disable unusedincl"
CFLAGS="$CFLAGS -msg_disable unnecincl"
CFLAGS="$CFLAGS -msg_disable nestincl"
CFLAGS="$CFLAGS -msg_disable strctpadding"
CFLAGS="$CFLAGS -msg_disable ansialiascast"
CFLAGS="$CFLAGS -msg_disable inlinestoclsmod"
CFLAGS="$CFLAGS -msg_disable cxxkeyword"
CFLAGS="$CFLAGS -msg_disable longlongsufx"
CFLAGS="$CFLAGS -msg_disable valuepres"

# STUB
CFLAGS="$CFLAGS -msg_disable truncintcast"
CFLAGS="$CFLAGS -msg_disable trunclongcast"

CFLAGS="$CFLAGS -msg_disable truncintasn"
CFLAGS="$CFLAGS -msg_disable trunclongint"
CFLAGS="$CFLAGS -msg_disable intconcastsgn"
CFLAGS="$CFLAGS -msg_disable intconstsign"
CFLAGS="$CFLAGS -msg_disable switchlong"
CFLAGS="$CFLAGS -msg_disable subscrbounds2"

CFLAGS="$CFLAGS -msg_disable hexoctunsign"

CFLAGS="$CFLAGS -msg_disable ignorecallval"
CFLAGS="$CFLAGS -msg_disable nonstandcast"
CFLAGS="$CFLAGS -msg_disable embedcomment"
CFLAGS="$CFLAGS -msg_disable unreachcode"
CFLAGS="$CFLAGS -msg_disable questcompare2"
CFLAGS="$CFLAGS -msg_disable unusedtop"
CFLAGS="$CFLAGS -msg_disable unrefdecl"

CFLAGS="$CFLAGS -msg_disable bitnotint"