From: William Dauchy <wdauchy@gmail.com>
Date: Sat, 7 Nov 2026 19:44:30 +0000 (+0100)
Subject: BUG/MINOR: quic-be: fix Initial token length check on backend connections
X-Git-Tag: v3.5-dev12~32
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=a5855404ef6db94519fe4a139e788b73a83cfbb8;p=haproxy.git

BUG/MINOR: quic-be: fix Initial token length check on backend connections

The check rejecting server Initial packets with a non-zero token length
tests pkt->token_len before it is set, so it never matches. Test the
parsed <token_len> value instead, as required by RFC 9000 17.2.2.

This should be backported up to 3.3, where it was introduced by 43d88a44f
("MINOR: quic-be: Datagrams and packet parsing support").

Signed-off-by: William Dauchy <wdauchy@gmail.com>
---

diff --git a/src/quic_rx.c b/src/quic_rx.c
index 92d84ef4b..657269e6b 100644
--- a/src/quic_rx.c
+++ b/src/quic_rx.c
@@ -2117,9 +2117,9 @@ static int quic_rx_pkt_parse(struct quic_conn *qc, struct quic_rx_packet *pkt,
 				goto drop;
 			}
 
-			if (!l && pkt->token_len) {
+			if (!l && token_len) {
 				/* A server must sent Initial packets with a null token length. */
-				TRACE_PROTO("Packet dropped",
+				TRACE_PROTO("RX Initial packet with non-zero token length on backend",
 				            QUIC_EV_CONN_LPKT, NULL, NULL, NULL, pkt->version);
 				goto drop;
 			}