]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
MINOR: quic-be: Store the remote transport parameters asap
authorFrederic Lecaille <flecaille@haproxy.com>
Wed, 17 Jan 2024 14:30:04 +0000 (15:30 +0100)
committerAmaury Denoyelle <adenoyelle@haproxy.com>
Wed, 11 Jun 2025 16:37:34 +0000 (18:37 +0200)
This is done from TLS secrets derivation callback at Application level (the last
encryption level) calling SSL_get_peer_quic_transport_params() to have an access
to the TLS transport paremeters extension embedded into the Server Hello TLS message.
Then, quic_transport_params_store() is called to store a decoded version of
these transport parameters.

src/quic_ssl.c

index 69e24905ec1216124718fceeed11e9eae2e72084..811b785027b6688a691670066c364e663afffc9f 100644 (file)
@@ -278,12 +278,26 @@ write:
                goto leave;
 
  keyupdate_init:
-       /* Store the secret provided by the TLS stack, required for keyupdate. */
        if (level == ssl_encryption_application) {
                struct quic_tls_kp *prv_rx = &qc->ku.prv_rx;
                struct quic_tls_kp *nxt_rx = &qc->ku.nxt_rx;
                struct quic_tls_kp *nxt_tx = &qc->ku.nxt_tx;
 
+#ifndef USE_QUIC_OPENSSL_COMPAT
+               if (!qc_is_listener(qc)) {
+                       const unsigned char *tp;
+                       size_t tplen;
+
+                       SSL_get_peer_quic_transport_params(ssl, &tp, &tplen);
+                       if (!tplen || !quic_transport_params_store(qc, 1,tp, tp + tplen)) {
+                               TRACE_ERROR("Could not parse remote transport paratemers",
+                                           QUIC_EV_CONN_RWSEC, qc);
+                               goto leave;
+                       }
+               }
+#endif
+
+               /* Store the secret provided by the TLS stack, required for keyupdate. */
                if (rx) {
                        if (!(rx->secret = pool_alloc(pool_head_quic_tls_secret))) {
                                TRACE_ERROR("Could not allocate RX Application secrete keys", QUIC_EV_CONN_RWSEC, qc);