CERBERUS/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2026-10-21 03:21:08 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

QUIC: rejected CRYPTO frames received in 1-RTT packets

Browse source 
If a CRYPTO frame was received after the handshake, ngx_quic_handshake()
ran the handshake completion for the second time.  With the check added
in 6f8c520f4, this is limited to short header packets.

Since a client has nothing to send in a CRYPTO frame once the handshake
is complete, such frames are now rejected with the "unexpected_message"
connection error, as does TLS 1.3 for handshake messages received out of
order, and QUIC requires for KeyUpdate.
This commit is contained in:
Vadim Zhestikov 2026-08-12 12:41:54 -07:00 • committed by VadimZhestikov
parent 9b76c21b01
commit 9c30a4debc
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
src/event/quic/ngx_event_quic_ssl.c
View file

@ -638,6 +638,15 @@ ngx_quic_handle_crypto_frame(ngx_connection_t *c, ngx_quic_header_t *pkt,
return NGX_OK;
}
if (c->ssl->handshaked) {
/* QUIC doesn't define post-handshake messages for a client */
qc->error = NGX_QUIC_ERR_CRYPTO(SSL_AD_UNEXPECTED_MESSAGE);
qc->error_reason = "unexpected CRYPTO frame";
return NGX_ERROR;
}
ctx = ngx_quic_get_send_ctx(qc, pkt->level);
f = &frame->u.crypto;