BUG/MINOR: Crash on O-RTT RX packet after dropping Initial pktns

This bug arrived with this naive commit:

    BUG/MINOR: quic: Too shord datagram during O-RTT handshakes (aws-lc only)

which omitted to consider the case where the Initial packet number space
could be discarded before receiving 0-RTT packets.

To fix this, append/insert the O-RTT (early-data) packet number space
into the encryption level list depending on the presence or not of
the Initial packet number space.

This issue was revealed when using aws-lc as TLS stack in GH #2701 issue.
Thank you to @Tristan971 for having reported this issue.

Must be backported where the commit mentionned above is supposed to be
backported: as far as 2.9.

(cherry picked from commit 7e19432fd41e9c0146f0227b43d0dd3dc740e20b)
Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/src/quic_tls.c b/src/quic_tls.c
index c7a15d8..c3bea30 100644 (file)
--- a/src/quic_tls.c
+++ b/src/quic_tls.c
@@ -253,8 +253,12 @@ static int quic_conn_enc_level_init(struct quic_conn *qc,
         * Here early-data is added after the Initial encryption level which is
         * always already present.
         */
-       if (level == ssl_encryption_early_data)
-               LIST_APPEND(&qc->iel->list, &qel->list);
+       if (level == ssl_encryption_early_data) {
+               if (qc->iel)
+                       LIST_APPEND(&qc->iel->list, &qel->list);
+               else
+                       LIST_INSERT(&qc->qel_list, &qel->list);
+       }
        else
                LIST_APPEND(&qc->qel_list, &qel->list);
        *el = qel;