Mercurial > hg > nginx-quic
changeset 8070:b13141d6d250 quic
QUIC: do not update largest packet number from a bad packet.
The removal of QUIC packet protection depends on the largest packet number
received. When a garbage packet was received, the decoder still updated the
largest packet number from that packet. This could affect removing protection
from subsequent QUIC packets.
author | Roman Arutyunyan <arut@nginx.com> |
---|---|
date | Tue, 01 Sep 2020 15:21:49 +0300 |
parents | 4ff2a0b747d1 |
children | 62b58f0a4711 |
files | src/event/ngx_event_quic_protection.c |
diffstat | 1 files changed, 6 insertions(+), 2 deletions(-) [+] |
line wrap: on
line diff
--- a/src/event/ngx_event_quic_protection.c +++ b/src/event/ngx_event_quic_protection.c @@ -998,7 +998,7 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, { u_char clearflags, *p, *sample; uint8_t badflags; - uint64_t pn; + uint64_t pn, lpn; ngx_int_t pnl, rc, key_phase; ngx_str_t in, ad; ngx_quic_secret_t *secret; @@ -1043,8 +1043,10 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, } } + lpn = *largest_pn; + pnl = (clearflags & 0x03) + 1; - pn = ngx_quic_parse_pn(&p, pnl, &mask[1], largest_pn); + pn = ngx_quic_parse_pn(&p, pnl, &mask[1], &lpn); pkt->pn = pn; pkt->flags = clearflags; @@ -1118,6 +1120,8 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, return NGX_ERROR; } + *largest_pn = lpn; + return NGX_OK; }