]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
MINOR: quic: send new tokens (NEW_TOKEN) even for 1RTT sessions
authorFrederic Lecaille <flecaille@haproxy.com>
Thu, 17 Oct 2024 05:59:59 +0000 (07:59 +0200)
committerFrederic Lecaille <flecaille@haproxy.com>
Thu, 17 Oct 2024 13:04:06 +0000 (15:04 +0200)
Tokens are sent when opening a connection, just after the handshake, to
be possibly reused by the peer for the next connection. They are used
to validate the peer address during the 0RTT connection openings.
But there is no reason to reserve this feature to 0RTT connections.
This patch modifies quic_build_post_handshake_frames() to do so.

src/quic_conn.c

index 5adf528b5c8313b3cba920c44f84054589b3a30f..ea9e16315afa5a08311545c50c40026bf32e46a0 100644 (file)
@@ -473,6 +473,8 @@ int quic_build_post_handshake_frames(struct quic_conn *qc)
        qel = qc->ael;
        /* Only servers must send a HANDSHAKE_DONE frame. */
        if (qc_is_listener(qc)) {
+               size_t new_token_frm_len;
+
                frm = qc_frm_alloc(QUIC_FT_HANDSHAKE_DONE);
                if (!frm) {
                        TRACE_ERROR("frame allocation error", QUIC_EV_CONN_IO_CB, qc);
@@ -481,29 +483,23 @@ int quic_build_post_handshake_frames(struct quic_conn *qc)
 
                LIST_APPEND(&frm_list, &frm->list);
 
-#ifdef HAVE_SSL_0RTT_QUIC
-               if (qc->li->bind_conf->ssl_conf.early_data) {
-                       size_t new_token_frm_len;
-
-                       frm = qc_frm_alloc(QUIC_FT_NEW_TOKEN);
-                       if (!frm) {
-                               TRACE_ERROR("frame allocation error", QUIC_EV_CONN_IO_CB, qc);
-                               goto err;
-                       }
-
-                       new_token_frm_len =
-                               quic_generate_token(frm->new_token.data,
-                                                   sizeof(frm->new_token.data), &qc->peer_addr);
-                       if (!new_token_frm_len) {
-                               TRACE_ERROR("token generation failed", QUIC_EV_CONN_IO_CB, qc);
-                               goto err;
-                       }
+               frm = qc_frm_alloc(QUIC_FT_NEW_TOKEN);
+               if (!frm) {
+                       TRACE_ERROR("frame allocation error", QUIC_EV_CONN_IO_CB, qc);
+                       goto err;
+               }
 
-                       BUG_ON(new_token_frm_len != sizeof(frm->new_token.data));
-                       frm->new_token.len = new_token_frm_len;
-                       LIST_APPEND(&frm_list, &frm->list);
+               new_token_frm_len =
+                       quic_generate_token(frm->new_token.data,
+                                           sizeof(frm->new_token.data), &qc->peer_addr);
+               if (!new_token_frm_len) {
+                       TRACE_ERROR("token generation failed", QUIC_EV_CONN_IO_CB, qc);
+                       goto err;
                }
-#endif
+
+               BUG_ON(new_token_frm_len != sizeof(frm->new_token.data));
+               frm->new_token.len = new_token_frm_len;
+               LIST_APPEND(&frm_list, &frm->list);
        }
 
        /* Initialize <max> connection IDs minus one: there is