diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2024-02-14 15:55:34 +0400 |
|---|---|---|
| committer | Sergey Kandaurov <pluknet@nginx.com> | 2024-02-14 15:55:34 +0400 |
| commit | 5902baf680609f884a1e11ff2b82a0bffb3724cc (patch) | |
| tree | e332f243fb1bc01521b1fa06aae1c95103dab146 | |
| parent | ed47f72a85fb6279e2ba5d431f64ea4db695cf4e (diff) | |
| download | nginx-5902baf680609f884a1e11ff2b82a0bffb3724cc.tar.gz nginx-5902baf680609f884a1e11ff2b82a0bffb3724cc.zip | |
QUIC: trial packet decryption in response to invalid key update.
Inspired by RFC 9001, Section 6.3, trial packet decryption with the current
keys is now used to avoid a timing side-channel signal. Further, this fixes
segfault while accessing missing next keys (ticket #2585).
| -rw-r--r-- | src/event/quic/ngx_event_quic_protection.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/src/event/quic/ngx_event_quic_protection.c b/src/event/quic/ngx_event_quic_protection.c index 88e6954cf..8223626b6 100644 --- a/src/event/quic/ngx_event_quic_protection.c +++ b/src/event/quic/ngx_event_quic_protection.c @@ -1144,8 +1144,19 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, uint64_t *largest_pn) key_phase = (pkt->flags & NGX_QUIC_PKT_KPHASE) != 0; if (key_phase != pkt->key_phase) { - secret = &pkt->keys->next_key.client; - pkt->key_update = 1; + if (pkt->keys->next_key.client.ctx != NULL) { + secret = &pkt->keys->next_key.client; + pkt->key_update = 1; + + } else { + /* + * RFC 9001, 6.3. Timing of Receive Key Generation. + * + * Trial decryption to avoid timing side-channel. + */ + ngx_log_debug0(NGX_LOG_DEBUG_EVENT, pkt->log, 0, + "quic next key missing"); + } } } |