From d7baead1e82f13d26a90894dfbd0f665c45bfd46 Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Tue, 23 Jun 2020 11:57:00 +0300 Subject: [PATCH] Close connection with PROTOCOL_VIOLATION on decryption failure. A previously used undefined error code is now replaced with the generic one. Note that quic-transport prescribes keeping connection intact, discarding such QUIC packets individually, in the sense that coalesced packets could be there. This is selectively handled in the next change. --- src/event/ngx_event_quic_protection.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/event/ngx_event_quic_protection.c b/src/event/ngx_event_quic_protection.c index 7162c7703..8afa9e842 100644 --- a/src/event/ngx_event_quic_protection.c +++ b/src/event/ngx_event_quic_protection.c @@ -1050,7 +1050,7 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn, if (ngx_quic_tls_hp(pkt->log, ciphers.hp, secret, mask, sample) != NGX_OK) { - pkt->error = NGX_QUIC_ERR_CRYPTO_ERROR; + pkt->error = NGX_QUIC_ERR_PROTOCOL_VIOLATION; return NGX_ERROR; } @@ -1130,7 +1130,7 @@ ngx_quic_decrypt(ngx_quic_header_t *pkt, ngx_ssl_conn_t *ssl_conn, #endif if (rc != NGX_OK) { - pkt->error = NGX_QUIC_ERR_CRYPTO_ERROR; + pkt->error = NGX_QUIC_ERR_PROTOCOL_VIOLATION; return rc; }