From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Tue, 28 Nov 2023 10:23:41 +0000 (+0100)
Subject: BUG/MINOR: quic: fix CONNECTION_CLOSE_APP encoding
X-Git-Tag: v2.9-dev12~75
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fe3726cb765c25cf5886bd0e0ca54f29b6a3d4ea;p=thirdparty%2Fhaproxy.git

BUG/MINOR: quic: fix CONNECTION_CLOSE_APP encoding

CONNECTION_CLOSE_APP encoding is broken, which prevents the sending of
every packet with such a frame. This bug was always present in quic
haproxy. However, it was slightly dissimulated by the previous code
which always initialized all frame members to zero, which was sufficient
to ensure CONNECTION_CLOSE_APP encoding was ok. The below patch changes
this behavior by removing this costly initialization step.

  4cf784f38ed20b42f6e71bd8a2e8157b95329ee5
  MINOR: quic: Avoid zeroing frame structures

Now, frames members must always be initialized individually given the
type of frame to used. However, for CONNECTION_CLOSE_APP this was not
done as qc_cc_build_frm() accessed the wrong union member refering to a
CONNECTION_CLOSE instead.

This bug was detected when trying to generate a HTTP/3 error. The
CONNECTION_CLOSE_APP frame encoding failed due to a non-initialized
<reason_phrase_len> which was too big. This was reported by the
following trace :
  "frame building error : qc@0x5555561b86c0 idle_timer_task@0x5555561e5050 flags=0x86038058 CONNECTION_CLOSE_APP"

This must be backported up to 2.6. This is necessary even if above
commit is not as previous code is also buggy, albeit with a different
behavior.
---

diff --git a/src/quic_tx.c b/src/quic_tx.c
index 63ff86f849..4c1157f637 100644
--- a/src/quic_tx.c
+++ b/src/quic_tx.c
@@ -2172,8 +2172,8 @@ static void qc_build_cc_frm(struct quic_conn *qc, struct quic_enc_level *qel,
 		}
 		else {
 			out->type = QUIC_FT_CONNECTION_CLOSE_APP;
-			out->connection_close.error_code = qc->err.code;
-			out->connection_close.reason_phrase_len = 0;
+			out->connection_close_app.error_code = qc->err.code;
+			out->connection_close_app.reason_phrase_len = 0;
 		}
 	}
 	else {