mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-02-23 14:42:15 +08:00
Code Issues Packages Projects Releases Wiki Activity

Ignore retry packets that arrive too late

Browse Source 
RFC 9000 s 17.2.5.2 says

> After the client has received and processed an Initial or Retry packet
> from the server, it MUST discard any subsequent Retry packets that it
> receives.

We were checking for multiple Retry packets, but not if we had already
processed an Initial packet.

Fixes the assertion failure noted in
https://github.com/openssl/openssl/pull/22368#issuecomment-1765618884

Reviewed-by: Hugo Landau <hlandau@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22411)
This commit is contained in:
Matt Caswell 2023-10-17 16:26:13 +01:00 committed by Tomas Mraz
parent fa9e6ad468
commit 56e303259e
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
ssl/quic/quic_channel.c
View File

@ -2220,6 +2220,14 @@ static void ch_rx_handle_packet(QUIC_CHANNEL *ch)
*/
return;
/*
* RFC 9000 s 17.2.5.2: After the client has received and processed an
* Initial or Retry packet from the server, it MUST discard any
* subsequent Retry packets that it receives.
*/
if (ch->have_received_enc_pkt)
return;
if (ch->qrx_pkt->hdr->len <= QUIC_RETRY_INTEGRITY_TAG_LEN)
/* Packets with zero-length Retry Tokens are invalid. */
return;