Mercurial > hg > nginx

comparison src/event/quic/ngx_event_quic_output.c @ 9169:60c4e8d3151f

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
QUIC: added safety belt to prevent using discarded keys. In addition to triggering alert, it ensures that such packets won't be sent. With the previous change that marks server keys as discarded by zeroing the key lengh, it is now an error to send packets with discarded keys. OpenSSL based stacks tolerate such behaviour because key length isn't used in packet protection, but BoringSSL will raise the UNSUPPORTED_KEY_SIZE cipher error. It won't be possible to use discarded keys with reused crypto contexts as it happens in subsequent changes.
author Sergey Kandaurov <pluknet@nginx.com>
date Fri, 20 Oct 2023 18:05:07 +0400
parents 58afcd72446f
children 4ccb0d973206
comparison
equal deleted inserted replaced
9168:ff98ae7d261e 9169:60c4e8d3151f
517 "quic output %s packet max:%uz min:%uz", 517 "quic output %s packet max:%uz min:%uz",
518 ngx_quic_level_name(ctx->level), max, min); 518 ngx_quic_level_name(ctx->level), max, min);
519 519
520 qc = ngx_quic_get_connection(c); 520 qc = ngx_quic_get_connection(c);
521 521
522 if (!ngx_quic_keys_available(qc->keys, ctx->level, 1)) {
523 ngx_log_error(NGX_LOG_ALERT, c->log, 0, "quic %s write keys discarded",
524 ngx_quic_level_name(ctx->level));
525
526 while (!ngx_queue_empty(&ctx->frames)) {
527 q = ngx_queue_head(&ctx->frames);
528 ngx_queue_remove(q);
529
530 f = ngx_queue_data(q, ngx_quic_frame_t, queue);
531 ngx_quic_free_frame(c, f);
532 }
533
534 return 0;
535 }
536
522 ngx_quic_init_packet(c, ctx, &pkt, qc->path); 537 ngx_quic_init_packet(c, ctx, &pkt, qc->path);
523 538
524 min_payload = ngx_quic_payload_size(&pkt, min); 539 min_payload = ngx_quic_payload_size(&pkt, min);
525 max_payload = ngx_quic_payload_size(&pkt, max); 540 max_payload = ngx_quic_payload_size(&pkt, max);
526 541