# HG changeset patch
# User Sergey Kandaurov <pluknet@nginx.com>
# Date 1592902620 -10800
# Node ID 3de1b739965044c0a1737223f0620886cb7822a3
# Parent  769d8bdeffb02f6e45b4b2328c2e154af4bf3dd1
Close connection with PROTOCOL_VIOLATION on decryption failure.

A previously used undefined error code is now replaced with the generic one.

Note that quic-transport prescribes keeping connection intact, discarding such
QUIC packets individually, in the sense that coalesced packets could be there.
This is selectively handled in the next change.

diff --git a/src/event/ngx_event_quic_protection.c b/src/event/ngx_event_quic_protection.c
--- a/src/event/ngx_event_quic_protection.c
+++ b/src/event/ngx_event_quic_protection.c
@@ -1050,7 +1050,7 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt,
     if (ngx_quic_tls_hp(pkt->log, ciphers.hp, secret, mask, sample)
         != NGX_OK)
     {
-        pkt->error = NGX_QUIC_ERR_CRYPTO_ERROR;
+        pkt->error = NGX_QUIC_ERR_PROTOCOL_VIOLATION;
         return NGX_ERROR;
     }
 
@@ -1130,7 +1130,7 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt,
 #endif
 
     if (rc != NGX_OK) {
-        pkt->error = NGX_QUIC_ERR_CRYPTO_ERROR;
+        pkt->error = NGX_QUIC_ERR_PROTOCOL_VIOLATION;
         return rc;
     }