From e847b524906db2e41e9ac0ac2352838cf4dd3d1a Mon Sep 17 00:00:00 2001
From: zhaowu <zhaowu.zw@alibaba-inc.com>
Date: Tue, 23 Apr 2024 15:26:40 +0800
Subject: [PATCH] [~] validate cid after receiving a RC frame

---
 src/transport/xqc_cid.c   | 20 ++++++++++++++++++--
 src/transport/xqc_cid.h   |  1 +
 src/transport/xqc_frame.c |  7 +++++++
 3 files changed, 26 insertions(+), 2 deletions(-)

diff --git a/src/transport/xqc_cid.c b/src/transport/xqc_cid.c
index 6e632b191..bfa447029 100644
--- a/src/transport/xqc_cid.c
+++ b/src/transport/xqc_cid.c
@@ -250,7 +250,7 @@ xqc_int_t
 xqc_cid_switch_to_next_state(xqc_cid_set_t *cid_set, xqc_cid_inner_t *cid, xqc_cid_state_t next_state)
 {
     if (xqc_cid_in_cid_set(cid_set, &cid->cid) == NULL) {
-        return XQC_OK;
+        return -XQC_ECONN_CID_NOT_FOUND;
     }
 
     xqc_cid_state_t current_state = cid->state;
@@ -259,7 +259,7 @@ xqc_cid_switch_to_next_state(xqc_cid_set_t *cid_set, xqc_cid_inner_t *cid, xqc_c
         return XQC_OK;
 
     } else if (current_state > next_state) {
-        return XQC_OK;
+        return -XQC_ECID_STATE;
     }
 
     /* current_state < next_state */
@@ -341,3 +341,19 @@ xqc_get_inner_cid_by_seq(xqc_cid_set_t *cid_set, uint64_t seq_num)
 
     return NULL;
 }
+
+xqc_bool_t
+xqc_validate_retire_cid_frame(xqc_cid_set_t *cid_set, xqc_cid_inner_t *cid)
+{
+    /* maybe retired already */
+    if (xqc_cid_in_cid_set(cid_set, &cid->cid) == NULL) {
+        return XQC_FALSE;
+    }
+
+    /* the cid is retired already */
+    if (cid->state >= XQC_CID_RETIRED) {
+        return XQC_FALSE;
+    }
+
+    return XQC_TRUE;
+}
diff --git a/src/transport/xqc_cid.h b/src/transport/xqc_cid.h
index 9acfe4a76..dd57594d2 100644
--- a/src/transport/xqc_cid.h
+++ b/src/transport/xqc_cid.h
@@ -71,6 +71,7 @@ xqc_cid_inner_t *xqc_cid_in_cid_set(const xqc_cid_set_t *cid_set, xqc_cid_t *cid
 xqc_int_t xqc_cid_switch_to_next_state(xqc_cid_set_t *cid_set, xqc_cid_inner_t *cid, xqc_cid_state_t state);
 xqc_int_t xqc_get_unused_cid(xqc_cid_set_t *cid_set, xqc_cid_t *cid);
 
+xqc_bool_t xqc_validate_retire_cid_frame(xqc_cid_set_t *cid_set, xqc_cid_inner_t *cid);
 
 unsigned char *xqc_sr_token_str(const char *sr_token);
 
diff --git a/src/transport/xqc_frame.c b/src/transport/xqc_frame.c
index e572cac61..6fbf48246 100644
--- a/src/transport/xqc_frame.c
+++ b/src/transport/xqc_frame.c
@@ -877,6 +877,13 @@ xqc_process_retire_conn_id_frame(xqc_connection_t *conn, xqc_packet_in_t *packet
         return XQC_OK;
     }
 
+    /* skip if cid not available anymore */
+    if (!xqc_validate_retire_cid_frame(&conn->scid_set.cid_set, inner_cid)) {
+        xqc_log(conn->log, XQC_LOG_DEBUG, "|cid not valid any more|seq_num:%ui",
+                seq_num);
+        return XQC_OK;
+    }
+
     if (XQC_OK == xqc_cid_is_equal(&inner_cid->cid, &packet_in->pi_pkt.pkt_dcid)) {
         /* 
          * The sequence number specified in a RETIRE_CONNECTION_ID frame MUST NOT refer to