From 5a720f0af0072013abd928546e2705535a9219db Mon Sep 17 00:00:00 2001
From: Marten Seemann <martenseemann@gmail.com>
Date: Fri, 10 Apr 2020 13:55:43 +0700
Subject: [PATCH] drop packets with version numbers that don't match the
 session's version

---
 session.go      |  8 ++++++++
 session_test.go | 22 ++++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/session.go b/session.go
index b95cee308..0ac4146f6 100644
--- a/session.go
+++ b/session.go
@@ -711,6 +711,14 @@ func (s *session) handlePacketImpl(rp *receivedPacket) bool {
 			break
 		}
 
+		if hdr.IsLongHeader && hdr.Version != s.version {
+			if s.qlogger != nil {
+				s.qlogger.DroppedPacket(qlog.PacketTypeFromHeader(hdr), protocol.ByteCount(len(data)), qlog.PacketDropUnexpectedVersion)
+			}
+			s.logger.Debugf("Dropping packet with version %x. Expected %x.", hdr.Version, s.version)
+			break
+		}
+
 		if counter > 0 && !hdr.DestConnectionID.Equal(lastConnID) {
 			if s.qlogger != nil {
 				s.qlogger.DroppedPacket(qlog.PacketTypeFromHeader(hdr), protocol.ByteCount(len(data)), qlog.PacketDropUnknownConnectionID)
diff --git a/session_test.go b/session_test.go
index fb7459ace..b04a02fd1 100644
--- a/session_test.go
+++ b/session_test.go
@@ -616,6 +616,28 @@ var _ = Describe("Session", func() {
 			Expect(sess.handlePacketImpl(p)).To(BeFalse())
 		})
 
+		It("drops packets with an unsupported version", func() {
+			origSupportedVersions := make([]protocol.VersionNumber, len(protocol.SupportedVersions))
+			copy(origSupportedVersions, protocol.SupportedVersions)
+			defer func() {
+				protocol.SupportedVersions = origSupportedVersions
+			}()
+
+			protocol.SupportedVersions = append(protocol.SupportedVersions, sess.version+1)
+			p := getPacket(&wire.ExtendedHeader{
+				Header: wire.Header{
+					IsLongHeader:     true,
+					Type:             protocol.PacketTypeHandshake,
+					DestConnectionID: destConnID,
+					SrcConnectionID:  srcConnID,
+					Version:          sess.version + 1,
+				},
+				PacketNumberLen: protocol.PacketNumberLen2,
+			}, nil)
+			qlogger.EXPECT().DroppedPacket(qlog.PacketTypeHandshake, protocol.ByteCount(len(p.data)), qlog.PacketDropUnexpectedVersion)
+			Expect(sess.handlePacketImpl(p)).To(BeFalse())
+		})
+
 		It("informs the ReceivedPacketHandler about non-ack-eliciting packets", func() {
 			hdr := &wire.ExtendedHeader{
 				Header:          wire.Header{DestConnectionID: srcConnID},