BUG/MINOR: quic: valid NEW_TOKEN connections are counted as half-open

Commit 29fb1aee5 ("MINOR: quic-be: QUIC connection allocation adaptation
(qc_new_conn())") replaced the token presence check with token_odcid->len
when marking a listener connection's peer address as validated.

Only Retry token validation populates token_odcid. A connection created
with a valid NEW_TOKEN token is therefore counted in half_open_conn and
remains subject to the anti-amplification limit until a Handshake packet
is successfully processed, even though the token has been accepted.

This does not prevent the connection from being established, but the
unnecessary anti-amplification limit may delay the handshake. The inflated
half_open_conn counter may also reach the Retry threshold earlier, causing
more Retry packets to be sent to other clients connecting without a token.

Use initial_pkt->token_len instead, as any non-empty token has already
been validated by the caller before allocating the connection. This marks
the peer address as validated for both accepted token formats without
changing the outgoing connection handling.

Thank you to Yeonggi Kim for having reported this issue on the haproxy mailing
list.

Must be backported as far as 3.3.

diff --git a/src/quic_conn.c b/src/quic_conn.c
index a664b9fb1acb316dea373b101ffdb2700d90da60..e992cf91cf4cb1d375f13822c57b56293968cbfe 100644 (file)
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -1252,7 +1252,7 @@ struct quic_conn *qc_new_conn(void *target,
         * already checked token, consider the peer address as validated.
         */
        if (l) {
-               if (token_odcid->len) {
+               if (initial_pkt->token_len) {
                        TRACE_STATE("validate peer address due to initial token",
                                                QUIC_EV_CONN_INIT, qc);
                        qc->flags |= QUIC_FL_CONN_PEER_VALIDATED_ADDR;