diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2021-05-25 16:41:59 +0300 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2021-05-25 16:41:59 +0300 |
| commit | 1677503f98ca577745f95508bf73dbbaf36c4b21 (patch) | |
| tree | 8d4923d6d1dcb3cce8dff3726f7511a9200f2452 /src | |
| parent | cd86cf34db80c517c8e26bb81bc393065eb96eda (diff) | |
| download | nginx-1677503f98ca577745f95508bf73dbbaf36c4b21.tar.gz nginx-1677503f98ca577745f95508bf73dbbaf36c4b21.zip | |
QUIC: make sure stream data size is lower than final size.
As per quic-transport 34, FINAL_SIZE_ERROR is generated if an endpoint received
a STREAM frame or a RESET_STREAM frame containing a final size that was lower
than the size of stream data that was already received.
Diffstat (limited to 'src')
| -rw-r--r-- | src/event/quic/ngx_event_quic.h | 1 | ||||
| -rw-r--r-- | src/event/quic/ngx_event_quic_streams.c | 16 |
2 files changed, 17 insertions, 0 deletions
diff --git a/src/event/quic/ngx_event_quic.h b/src/event/quic/ngx_event_quic.h index 83e72a6f3..230c2c46f 100644 --- a/src/event/quic/ngx_event_quic.h +++ b/src/event/quic/ngx_event_quic.h @@ -79,6 +79,7 @@ struct ngx_quic_stream_s { uint64_t send_max_data; uint64_t recv_max_data; uint64_t recv_offset; + uint64_t recv_last; uint64_t final_size; ngx_chain_t *in; ngx_uint_t cancelable; /* unsigned cancelable:1; */ diff --git a/src/event/quic/ngx_event_quic_streams.c b/src/event/quic/ngx_event_quic_streams.c index 816da61d5..d63938192 100644 --- a/src/event/quic/ngx_event_quic_streams.c +++ b/src/event/quic/ngx_event_quic_streams.c @@ -857,6 +857,8 @@ ngx_quic_handle_stream_frame(ngx_connection_t *c, ngx_quic_header_t *pkt, qs->final_size = last; } + qs->recv_last = last; + if (f->offset == 0) { sc->read->ready = 1; } @@ -884,6 +886,10 @@ ngx_quic_handle_stream_frame(ngx_connection_t *c, ngx_quic_header_t *pkt, return NGX_OK; } + if (qs->recv_last < last) { + qs->recv_last = last; + } + if (f->offset < qs->recv_offset) { ngx_quic_trim_bufs(frame->data, qs->recv_offset - f->offset); f->offset = qs->recv_offset; @@ -899,6 +905,11 @@ ngx_quic_handle_stream_frame(ngx_connection_t *c, ngx_quic_header_t *pkt, return NGX_ERROR; } + if (qs->recv_last > last) { + qc->error = NGX_QUIC_ERR_FINAL_SIZE_ERROR; + return NGX_ERROR; + } + qs->connection->read->pending_eof = 1; qs->final_size = last; } @@ -1129,6 +1140,11 @@ ngx_quic_handle_reset_stream_frame(ngx_connection_t *c, return NGX_ERROR; } + if (qs->recv_last > f->final_size) { + qc->error = NGX_QUIC_ERR_FINAL_SIZE_ERROR; + return NGX_ERROR; + } + qs->final_size = f->final_size; rev = qs->connection->read; |