From: Hugo Landau <hlandau@openssl.org>
Date: Tue, 22 Nov 2022 13:46:05 +0000 (+0000)
Subject: QUIC CHANNEL: Only reprocess after an RX secret has been provisioned
X-Git-Tag: openssl-3.2.0-alpha1~1488
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=92282a17c9959bc61e012e93517320df1ec8ace8;p=thirdparty%2Fopenssl.git

QUIC CHANNEL: Only reprocess after an RX secret has been provisioned

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/19703)
---

diff --git a/ssl/quic/quic_channel.c b/ssl/quic/quic_channel.c
index 431344bcf16..e02773a430b 100644
--- a/ssl/quic/quic_channel.c
+++ b/ssl/quic/quic_channel.c
@@ -527,9 +527,10 @@ static int ch_on_handshake_yield_secret(uint32_t enc_level, int direction,
                                      suite_id, md,
                                      secret, secret_len))
             return 0;
+
+        ch->have_new_rx_secret = 1;
     }
 
-    ch->have_new_secret = 1;
     return 1;
 }
 
@@ -1014,7 +1015,7 @@ static void ch_tick(QUIC_TICK_RESULT *res, void *arg)
          * Allow the handshake layer to check for any new incoming data and generate
          * new outgoing data.
          */
-        ch->have_new_secret = 0;
+        ch->have_new_rx_secret = 0;
         ossl_quic_dhs_tick(ch->dhs);
 
         /*
@@ -1022,7 +1023,7 @@ static void ch_tick(QUIC_TICK_RESULT *res, void *arg)
          * because packets that were not previously processable and were
          * deferred might now be processable.
          */
-    } while (ch->have_new_secret);
+    } while (ch->have_new_rx_secret);
 
     /*
      * Handle any timer events which are due to fire; namely, the loss detection
diff --git a/ssl/quic/quic_channel_local.h b/ssl/quic/quic_channel_local.h
index 88e49d588c1..c5edf2a8b01 100644
--- a/ssl/quic/quic_channel_local.h
+++ b/ssl/quic/quic_channel_local.h
@@ -265,10 +265,10 @@ struct quic_channel_st {
     unsigned int                    is_server               : 1;
 
     /*
-     * Set temporarily when the handshake layer has given us a new secret. Used
-     * to determine if we need to check our RX queues again.
+     * Set temporarily when the handshake layer has given us a new RX secret.
+     * Used to determine if we need to check our RX queues again.
      */
-    unsigned int                    have_new_secret         : 1;
+    unsigned int                    have_new_rx_secret      : 1;
 };
 
 # endif