diff options
Diffstat (limited to 'src/lib.rs')
| -rw-r--r-- | src/lib.rs | 36 |
1 files changed, 35 insertions, 1 deletions
@@ -1864,7 +1864,17 @@ impl Connection { let read = match self.recv_single(&mut buf[len - left..len], &info) { Ok(v) => v, - Err(Error::Done) => left, + Err(Error::Done) => { + // If the packet can't be processed or decrypted, check if + // it's a stateless reset. + if self.is_stateless_reset(&buf[len - left..len]) { + trace!("{} packet is a stateless reset", self.trace_id); + + self.closed = true; + } + + left + }, Err(e) => { // In case of error processing the incoming packet, close @@ -1900,6 +1910,30 @@ impl Connection { Ok(done) } + /// Returns true if a QUIC packet is a stateless reset. + fn is_stateless_reset(&self, buf: &[u8]) -> bool { + // If the packet is too small, then we just throw it away. + let buf_len = buf.len(); + if buf_len < 21 { + return false; + } + + // TODO: we should iterate over all active destination connection IDs + // and check against their reset token. + match &self.peer_transport_params.stateless_reset_token { + Some(token) => { + let token_len = 16; + ring::constant_time::verify_slices_are_equal( + &token, + &buf[buf_len - token_len..buf_len], + ) + .is_ok() + }, + + None => false, + } + } + /// Processes a single QUIC packet received from the peer. /// /// On success the number of bytes processed from the input buffer is |