mirror/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git synced 2026-02-15 12:22:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

BUG/MINOR: quic-be: missing version negotiation

Browse Source 
This bug impacts only the QUIC clients (or backends). The version negotiation
was not supported at all for them. This is an oversight.

Contrary to the QUIC server which choose the negotiated version after having
received the transport parameters (into ClientHello message) the client selects
the negotiated version from the first Initial packet version field. Indeed, the
server transport parameters are inside the ServerHello messages ciphered
into Handshake packets.

This non intrusive patch does not impact the QUIC server implementation.
It only selects the negotiated version from the first Initial packet
received from the server and consequently initializes the TLS cipher context.

Thank you to @InputOutputZ for having reporte this issue in GH #3178.

No need to backport because the QUIC backends support arrives with 3.3.
This commit is contained in:
Frederic Lecaille
2025-11-14 17:21:53 +01:00
parent 0746aa68b8
commit f0c52f7160
1 changed files with 22 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/quic_rx.c
View File

@@ -2077,6 +2077,28 @@ static int quic_rx_pkt_parse(struct quic_conn *qc, struct quic_rx_packet *pkt,
memcpy(qc->dcid.data, pkt->scid.data, pkt->scid.len);
qc->dcid.len = pkt->scid.len;
}
/* Identify the negotiated version, chosen and sent by the server */
if (qc_is_back(qc) && pkt->version != qc->original_version && !qc->nictx) {
qc->nictx = pool_alloc(pool_head_quic_tls_ctx);
if (!qc->nictx) {
TRACE_PROTO("Could not alloc a new Initial secrets TLS context",
QUIC_EV_CONN_RXPKT, qc);
goto drop;
}
quic_tls_ctx_reset(qc->nictx);
if (!qc_new_isecs(qc, qc->nictx, pkt->version,
qc->odcid.data, qc->odcid.len, 0)) {
TRACE_PROTO("Could not derive Initial secrets for new version",
QUIC_EV_CONN_RXPKT, qc);
goto drop;
}
TRACE_PROTO("new Initial secrets TLS context initialization done",
QUIC_EV_CONN_RXPKT, qc);
qc->negotiated_version = pkt->version;
}
}
}
else if (pkt->type == QUIC_PACKET_TYPE_0RTT) {