]> git.kaiwu.me - nginx.git/commit
QUIC: fixed handling of RETIRE_CONNECTION_ID frame.
authorVladimir Homutov <vl@nginx.com>
Thu, 18 Nov 2021 11:19:36 +0000 (14:19 +0300)
committerVladimir Homutov <vl@nginx.com>
Thu, 18 Nov 2021 11:19:36 +0000 (14:19 +0300)
commite165526e43d60b9249690faccbb380be20e88af3
tree66fd7c7f600713662c28f8ddce897144ea0f8f58
parent1688afd955e02b4a12ddf394b42a132e5e4daffc
QUIC: fixed handling of RETIRE_CONNECTION_ID frame.

Previously, the retired socket was not closed if it didn't match
active or backup.

New sockets could not be created (due to count limit), since retired socket
was not closed before calling ngx_quic_create_sockets().

When replacing retired socket, new socket is only requested after closing
old one, to avoid hitting the limit on the number of active connection ids.

Together with added restrictions, this fixes an issue when a current socket
could be closed during migration, recreated and erroneously reused leading
to null pointer dereference.
src/event/quic/ngx_event_quic_connid.c
src/event/quic/ngx_event_quic_socket.c
src/event/quic/ngx_event_quic_socket.h