ignore delayed packets with a version mismatched

fixes #359

server.go

@@ -142,6 +142,17 @@ func (s *Server) handlePacket(conn *net.UDPConn, remoteAddr *net.UDPAddr, packet
 	}
 	hdr.Raw = packet[:len(packet)-r.Len()]
 
+	s.sessionsMutex.RLock()
+	session, ok := s.sessions[hdr.ConnectionID]
+	s.sessionsMutex.RUnlock()
+
+	// a session is only created once the client sent a supported version
+	// if we receive a packet for a connection that already has session, it's probably an old packet that was sent by the client before the version was negotiated
+	// it is safe to drop it
+	if ok && hdr.VersionFlag && !protocol.IsSupportedVersion(hdr.VersionNumber) {
+		return nil
+	}
+
 	// Send Version Negotiation Packet if the client is speaking a different protocol version
 	if hdr.VersionFlag && !protocol.IsSupportedVersion(hdr.VersionNumber) {
 		utils.Infof("Client offered version %d, sending VersionNegotiationPacket", hdr.VersionNumber)
@@ -149,10 +160,6 @@ func (s *Server) handlePacket(conn *net.UDPConn, remoteAddr *net.UDPAddr, packet
 		return err
 	}
 
-	s.sessionsMutex.RLock()
-	session, ok := s.sessions[hdr.ConnectionID]
-	s.sessionsMutex.RUnlock()
-
 	if !ok {
 		if !hdr.VersionFlag {
 			_, err = conn.WriteToUDP(writePublicReset(hdr.ConnectionID, hdr.PacketNumber, 0), remoteAddr)

server_test.go

@@ -47,7 +47,7 @@ var _ = Describe("Server", func() {
 				newSession: newMockSession,
 			}
 			b := &bytes.Buffer{}
-			utils.WriteUint32(b, protocol.VersionNumberToTag(protocol.Version36))
+			utils.WriteUint32(b, protocol.VersionNumberToTag(protocol.SupportedVersions[0]))
 			firstPacket = []byte{0x09, 0xf6, 0x19, 0x86, 0x66, 0x9b, 0x9f, 0xfa, 0x4c}
 			firstPacket = append(append(firstPacket, b.Bytes()...), 0x01)
 		})
@@ -104,6 +104,23 @@ var _ = Describe("Server", func() {
 			Expect(server.sessions[0x4cfa9f9b668619f6]).To(BeNil())
 		})
 
+		It("ignores delayed packets with mismatching versions", func() {
+			err := server.handlePacket(nil, nil, firstPacket)
+			Expect(err).ToNot(HaveOccurred())
+			Expect(server.sessions[0x4cfa9f9b668619f6].(*mockSession).packetCount).To(Equal(1))
+			b := &bytes.Buffer{}
+			// add an unsupported version
+			utils.WriteUint32(b, protocol.VersionNumberToTag(protocol.SupportedVersions[0]-2))
+			data := []byte{0x09, 0xf6, 0x19, 0x86, 0x66, 0x9b, 0x9f, 0xfa, 0x4c}
+			data = append(append(data, b.Bytes()...), 0x01)
+			err = server.handlePacket(nil, nil, data)
+			Expect(err).ToNot(HaveOccurred())
+			// if we didn't ignore the packet, the server would try to send a version negotation packet, which would make the test panic because it doesn't have a udpConn
+			// TODO: test that really doesn't send anything on the udpConn
+			// make sure the packet was *not* passed to session.handlePacket()
+			Expect(server.sessions[0x4cfa9f9b668619f6].(*mockSession).packetCount).To(Equal(1))
+		})
+
 		It("errors on invalid public header", func() {
 			err := server.handlePacket(nil, nil, nil)
 			Expect(err.(*qerr.QuicError).ErrorCode).To(Equal(qerr.InvalidPacketHeader))