]> git.kaiwu.me - nginx.git/commit
QUIC: added safety belt to prevent using discarded keys.
authorSergey Kandaurov <pluknet@nginx.com>
Fri, 20 Oct 2023 14:05:07 +0000 (18:05 +0400)
committerSergey Kandaurov <pluknet@nginx.com>
Fri, 20 Oct 2023 14:05:07 +0000 (18:05 +0400)
commitfffd2823ba8bddcdfdffca47990c73cd4298208d
tree70bc64d02ec35c04a9386b95579912bf44463e0f
parentcd5f4cd8d3991414167a734f452e8e3fe98f3916
QUIC: added safety belt to prevent using discarded keys.

In addition to triggering alert, it ensures that such packets won't be sent.

With the previous change that marks server keys as discarded by zeroing the
key lengh, it is now an error to send packets with discarded keys.  OpenSSL
based stacks tolerate such behaviour because key length isn't used in packet
protection, but BoringSSL will raise the UNSUPPORTED_KEY_SIZE cipher error.
It won't be possible to use discarded keys with reused crypto contexts as it
happens in subsequent changes.
src/event/quic/ngx_event_quic_output.c