reject RST_STREAM frames for the crypto stream

session.go

@@ -602,6 +602,9 @@ func (s *session) handleMaxStreamDataFrame(frame *wire.MaxStreamDataFrame) error
 }
 
 func (s *session) handleRstStreamFrame(frame *wire.RstStreamFrame) error {
+	if frame.StreamID == s.version.CryptoStreamID() {
+		return errors.New("Received RST_STREAM frame for the crypto stream")
+	}
 	str, err := s.streamsMap.GetOrOpenStream(frame.StreamID)
 	if err != nil {
 		return err

session_test.go

@@ -392,6 +392,14 @@ var _ = Describe("Session", func() {
 				}}, protocol.EncryptionUnspecified)
 				Expect(err).NotTo(HaveOccurred())
 			})
+
+			It("erros when a RST_STREAM frame would reset the crypto stream", func() {
+				err := sess.handleRstStreamFrame(&wire.RstStreamFrame{
+					StreamID:  sess.version.CryptoStreamID(),
+					ErrorCode: 123,
+				})
+				Expect(err).To(MatchError("Received RST_STREAM frame for the crypto stream"))
+			})
 		})
 
 		Context("handling MAX_DATA and MAX_STREAM_DATA frames", func() {