# HG changeset patch
# User Roman Arutyunyan <arut@nginx.com>
# Date 1598962909 -10800
# Node ID b13141d6d2503192852a04603e83c018b878d2a3
# Parent  4ff2a0b747d188868c72e4b5e3c4d05195e367b2
QUIC: do not update largest packet number from a bad packet.

The removal of QUIC packet protection depends on the largest packet number
received.  When a garbage packet was received, the decoder still updated the
largest packet number from that packet.  This could affect removing protection
from subsequent QUIC packets.

diff --git a/src/event/ngx_event_quic_protection.c b/src/event/ngx_event_quic_protection.c
--- a/src/event/ngx_event_quic_protection.c
+++ b/src/event/ngx_event_quic_protection.c
@@ -998,7 +998,7 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt,
 {
     u_char               clearflags, *p, *sample;
     uint8_t              badflags;
-    uint64_t             pn;
+    uint64_t             pn, lpn;
     ngx_int_t            pnl, rc, key_phase;
     ngx_str_t            in, ad;
     ngx_quic_secret_t   *secret;
@@ -1043,8 +1043,10 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt,
         }
     }
 
+    lpn = *largest_pn;
+
     pnl = (clearflags & 0x03) + 1;
-    pn = ngx_quic_parse_pn(&p, pnl, &mask[1], largest_pn);
+    pn = ngx_quic_parse_pn(&p, pnl, &mask[1], &lpn);
 
     pkt->pn = pn;
     pkt->flags = clearflags;
@@ -1118,6 +1120,8 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt,
         return NGX_ERROR;
     }
 
+    *largest_pn = lpn;
+
     return NGX_OK;
 }