From: Frédéric Lécaille <flecaille@haproxy.com>
Date: Tue, 2 May 2023 06:57:37 +0000 (+0200)
Subject: BUG/MINOR: quic: Buggy acknowlegments of acknowlegments function
X-Git-Tag: v2.8-dev12~78
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0dd4fa58e6ead1a6723a6a126f9e8b0e6979d9c3;p=thirdparty%2Fhaproxy.git

BUG/MINOR: quic: Buggy acknowlegments of acknowlegments function

qc_treat_ack_of_ack() must remove ranges of acknowlegments from an ebtree which
have been acknowledged. This is done keeping track of the largest acknowledged
packet number which has been acknowledged and sent with an ack-eliciting packet.
But due to the data structure of the acknowledgement ranges used to build an ACK frame,
one must leave at least one range in such an ebtree which must at least contain
a unique one-element range with the largest acknowledged packet number as element.

This issue was revealed by @Tristan971 in GH #2140.

Must be backported in 2.7 and 2.6.
---

diff --git a/src/quic_conn.c b/src/quic_conn.c
index 069609ab68..5c564843bf 100644
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -2056,6 +2056,12 @@ static void qc_treat_ack_of_ack(struct quic_conn *qc,
 			break;
 		}
 
+		/* Do not empty the tree: the first ACK range contains the
+		 * largest acknowledged packet number.
+		 */
+		if (arngs->sz == 1)
+			break;
+
 		eb64_delete(ar);
 		pool_free(pool_head_quic_arng, ar_node);
 		arngs->sz--;