]> git.ipfire.org Git - thirdparty/haproxy.git/commitdiff
MINOR: quic: Immediately close if no transport parameters extension found
authorFrédéric Lécaille <flecaille@haproxy.com>
Mon, 22 Nov 2021 14:55:16 +0000 (15:55 +0100)
committerFrédéric Lécaille <flecaille@haproxy.com>
Tue, 30 Nov 2021 10:47:46 +0000 (11:47 +0100)
If the ClientHello callback does not manage to find a correct QUIC transport
parameters extension, we immediately close the connection with
missing_extension(109) as TLS alert which is turned into 0x16d QUIC connection
error.

src/ssl_sock.c

index ffbfa5031d9a3f33428c7373e125e8c5639dfbc2..158cb48ffcd25f2d947c3eeac72d9276d2663e18 100644 (file)
@@ -2463,7 +2463,15 @@ int ssl_sock_switchctx_cbk(SSL *ssl, int *al, void *arg)
                if (!SSL_client_hello_get0_ext(ssl, conn->qc->tps_tls_ext,
                                               &extension_data, &extension_len))
 #endif
-                       goto abort;
+               {
+                       /* This is not redundant. It we only return 0 without setting
+                        * <*al>, this has as side effect to generate another TLS alert
+                        * which would be set after calling quic_set_tls_alert().
+                        */
+                       *al = SSL_AD_MISSING_EXTENSION;
+                       quic_set_tls_alert(conn->qc, SSL_AD_MISSING_EXTENSION);
+                       return 0;
+               }
 
                if (!quic_transport_params_store(conn->qc, 0, extension_data,
                                                 extension_data + extension_len))