From 676d43a5e9a63bd98ddfca74a98e50653835df43 Mon Sep 17 00:00:00 2001 From: Marten Seemann Date: Mon, 2 Nov 2020 16:08:12 +0700 Subject: [PATCH 1/2] remove incorrect log line about retirement of preferred address conn ID --- session.go | 1 - 1 file changed, 1 deletion(-) diff --git a/session.go b/session.go index 2275c834f..e30e52c0d 100644 --- a/session.go +++ b/session.go @@ -1432,7 +1432,6 @@ func (s *session) processTransportParametersImpl(params *wire.TransportParameter } // We don't support connection migration yet, so we don't have any use for the preferred_address. if params.PreferredAddress != nil { - s.logger.Debugf("Server sent preferred_address. Retiring the preferred_address connection ID.") // Retire the connection ID. s.connIDManager.AddFromPreferredAddress(params.PreferredAddress.ConnectionID, params.PreferredAddress.StatelessResetToken) } From 337e2171ef80939a07c86f9c47c280b23074b431 Mon Sep 17 00:00:00 2001 From: Marten Seemann Date: Mon, 2 Nov 2020 16:24:02 +0700 Subject: [PATCH 2/2] only check the SCID for Initial packets There's no risk that Handshake packets could be injected by an attacker. --- session.go | 6 +++--- session_test.go | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/session.go b/session.go index e30e52c0d..f672b2899 100644 --- a/session.go +++ b/session.go @@ -799,11 +799,11 @@ func (s *session) handleSinglePacket(p *receivedPacket, hdr *wire.Header) bool / // The server can change the source connection ID with the first Handshake packet. // After this, all packets with a different source connection have to be ignored. - if s.receivedFirstPacket && hdr.IsLongHeader && !hdr.SrcConnectionID.Equal(s.handshakeDestConnID) { + if s.receivedFirstPacket && hdr.IsLongHeader && hdr.Type == protocol.PacketTypeInitial && !hdr.SrcConnectionID.Equal(s.handshakeDestConnID) { if s.tracer != nil { - s.tracer.DroppedPacket(logging.PacketTypeFromHeader(hdr), p.Size(), logging.PacketDropUnknownConnectionID) + s.tracer.DroppedPacket(logging.PacketTypeInitial, p.Size(), logging.PacketDropUnknownConnectionID) } - s.logger.Debugf("Dropping %s packet (%d bytes) with unexpected source connection ID: %s (expected %s)", hdr.PacketType(), p.Size(), hdr.SrcConnectionID, s.handshakeDestConnID) + s.logger.Debugf("Dropping Initial packet (%d bytes) with unexpected source connection ID: %s (expected %s)", p.Size(), hdr.SrcConnectionID, s.handshakeDestConnID) return false } // drop 0-RTT packets, if we are a client diff --git a/session_test.go b/session_test.go index 81fdfee0e..0111d89ee 100644 --- a/session_test.go +++ b/session_test.go @@ -968,7 +968,7 @@ var _ = Describe("Session", func() { hdr1 := &wire.ExtendedHeader{ Header: wire.Header{ IsLongHeader: true, - Type: protocol.PacketTypeHandshake, + Type: protocol.PacketTypeInitial, DestConnectionID: destConnID, SrcConnectionID: srcConnID, Length: 1, @@ -980,7 +980,7 @@ var _ = Describe("Session", func() { hdr2 := &wire.ExtendedHeader{ Header: wire.Header{ IsLongHeader: true, - Type: protocol.PacketTypeHandshake, + Type: protocol.PacketTypeInitial, DestConnectionID: destConnID, SrcConnectionID: protocol.ConnectionID{0xde, 0xad, 0xbe, 0xef}, Length: 1, @@ -1003,7 +1003,7 @@ var _ = Describe("Session", func() { Expect(sess.handlePacketImpl(p1)).To(BeTrue()) // The next packet has to be ignored, since the source connection ID doesn't match. p2 := getPacket(hdr2, nil) - tracer.EXPECT().DroppedPacket(logging.PacketTypeHandshake, protocol.ByteCount(len(p2.data)), logging.PacketDropUnknownConnectionID) + tracer.EXPECT().DroppedPacket(logging.PacketTypeInitial, protocol.ByteCount(len(p2.data)), logging.PacketDropUnknownConnectionID) Expect(sess.handlePacketImpl(p2)).To(BeFalse()) })