CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-05-13 09:36:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

QUIC: added safety belt to prevent using discarded keys.

Browse source 
In addition to triggering alert, it ensures that such packets won't be sent.

With the previous change that marks server keys as discarded by zeroing the
key lengh, it is now an error to send packets with discarded keys.  OpenSSL
based stacks tolerate such behaviour because key length isn't used in packet
protection, but BoringSSL will raise the UNSUPPORTED_KEY_SIZE cipher error.
It won't be possible to use discarded keys with reused crypto contexts as it
happens in subsequent changes.
This commit is contained in:
Sergey Kandaurov 2023-10-20 18:05:07 +04:00
parent cd5f4cd8d3
commit fffd2823ba
1 changed files with 15 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

15
src/event/quic/ngx_event_quic_output.c
View file

@ -519,6 +519,21 @@ ngx_quic_output_packet(ngx_connection_t *c, ngx_quic_send_ctx_t *ctx,
qc = ngx_quic_get_connection(c);
if (!ngx_quic_keys_available(qc->keys, ctx->level, 1)) {
ngx_log_error(NGX_LOG_ALERT, c->log, 0, "quic %s write keys discarded",
ngx_quic_level_name(ctx->level));
while (!ngx_queue_empty(&ctx->frames)) {
q = ngx_queue_head(&ctx->frames);
ngx_queue_remove(q);
f = ngx_queue_data(q, ngx_quic_frame_t, queue);
ngx_quic_free_frame(c, f);
}
return 0;
}
ngx_quic_init_packet(c, ctx, &pkt, qc->path);
min_payload = ngx_quic_payload_size(&pkt, min);