From: Frédéric Lécaille <flecaille@haproxy.com>
Date: Fri, 30 Jun 2023 12:41:31 +0000 (+0200)
Subject: BUG/MINOR: quic: Wrong Retry paquet version field endianess
X-Git-Tag: v2.9-dev1~23
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=5997d18c7862e9461a005a4e74ca1ab80c49bb20;p=thirdparty%2Fhaproxy.git

BUG/MINOR: quic: Wrong Retry paquet version field endianess

The 32-bits version field of the Retry paquet was inversed by the code. As this
field must be in the network byte order on the wire, this code has supposed that
the sender of the Retry packet will always be little endian. Hopefully this is
often the case on our Intel machines ;)

Must be backported as far as 2.6.
---

diff --git a/src/quic_conn.c b/src/quic_conn.c
index 9ecce91973..6be031717d 100644
--- a/src/quic_conn.c
+++ b/src/quic_conn.c
@@ -6646,10 +6646,8 @@ static int send_retry(int fd, struct sockaddr_storage *addr,
 		(quic_pkt_type(QUIC_PACKET_TYPE_RETRY, qv->num) << QUIC_PACKET_TYPE_SHIFT) |
 		statistical_prng_range(16);
 	/* version */
-	buf[i++] = *((unsigned char *)&qv->num + 3);
-	buf[i++] = *((unsigned char *)&qv->num + 2);
-	buf[i++] = *((unsigned char *)&qv->num + 1);
-	buf[i++] = *(unsigned char *)&qv->num;
+	*(uint32_t *)&buf[i] = htonl(qv->num);
+	i += sizeof(uint32_t);
 
 	/* Use the SCID from <pkt> for Retry DCID. */
 	buf[i++] = pkt->scid.len;