Mercurial > hg > nginx

comparison src/http/v3/ngx_http_v3_parse.c @ 8765:687445803d0f quic

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
HTTP/3: reject empty DATA and HEADERS frames on control stream. Previously only non-empty frames were rejected.
author Roman Arutyunyan <arut@nginx.com>
date Wed, 05 May 2021 13:28:05 +0300
parents 12f18e0bca09
children 0981329169ea
comparison
equal deleted inserted replaced
8764:0bd1dd39a08b 8765:687445803d0f
1024 st->type = st->vlint.value; 1024 st->type = st->vlint.value;
1025 1025
1026 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, 1026 ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
1027 "http3 parse frame type:%ui", st->type); 1027 "http3 parse frame type:%ui", st->type);
1028 1028
1029 if (ngx_http_v3_is_v2_frame(st->type)) { 1029 if (ngx_http_v3_is_v2_frame(st->type)
1030 || st->type == NGX_HTTP_V3_FRAME_DATA
1031 || st->type == NGX_HTTP_V3_FRAME_HEADERS)
1032 {
1030 return NGX_HTTP_V3_ERR_FRAME_UNEXPECTED; 1033 return NGX_HTTP_V3_ERR_FRAME_UNEXPECTED;
1031 } 1034 }
1032 1035
1033 if (st->state == sw_first_type 1036 if (st->state == sw_first_type
1034 && st->type != NGX_HTTP_V3_FRAME_SETTINGS) 1037 && st->type != NGX_HTTP_V3_FRAME_SETTINGS)
1066 break; 1069 break;
1067 1070
1068 case NGX_HTTP_V3_FRAME_MAX_PUSH_ID: 1071 case NGX_HTTP_V3_FRAME_MAX_PUSH_ID:
1069 st->state = sw_max_push_id; 1072 st->state = sw_max_push_id;
1070 break; 1073 break;
1071
1072 case NGX_HTTP_V3_FRAME_DATA:
1073 case NGX_HTTP_V3_FRAME_HEADERS:
1074 return NGX_HTTP_V3_ERR_FRAME_UNEXPECTED;
1075 1074
1076 default: 1075 default:
1077 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, 1076 ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
1078 "http3 parse skip unknown frame"); 1077 "http3 parse skip unknown frame");
1079 st->state = sw_skip; 1078 st->state = sw_skip;