Skip to content
Permalink
Browse files Browse the repository at this point in the history
Close connection if we derive an extra 1-rtt write cipher
Summary: Fixes CVE-2021-24029

Reviewed By: mjoras, lnicco

Differential Revision: D26613890

fbshipit-source-id: 19bb2be2c731808144e1a074ece313fba11f1945
  • Loading branch information
yangchi authored and facebook-github-bot committed Mar 3, 2021
1 parent 6624ad7 commit a67083f
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 1 deletion.
5 changes: 4 additions & 1 deletion quic/server/state/ServerStateMachine.cpp
Expand Up @@ -311,7 +311,10 @@ void updateHandshakeState(QuicServerConnectionState& conn) {
conn.qLogger->addTransportStateUpdate(kDerivedOneRttWriteCipher);
}
QUIC_TRACE(fst_trace, conn, "derived 1-rtt write cipher");
CHECK(!conn.oneRttWriteCipher.get());
if (conn.oneRttWriteCipher) {
throw QuicTransportException(
"Duplicate 1-rtt write cipher", TransportErrorCode::CRYPTO_ERROR);
}
conn.oneRttWriteCipher = std::move(oneRttWriteCipher);

updatePacingOnKeyEstablished(conn);
Expand Down
15 changes: 15 additions & 0 deletions quic/server/test/QuicServerTransportTest.cpp
Expand Up @@ -4265,6 +4265,21 @@ TEST_P(QuicServerTransportHandshakeTest, TestD6DStartCallback) {
server->removeObserver(mockObserver.get());
}

TEST_F(QuicUnencryptedServerTransportTest, DuplicateOneRttWriteCipher) {
setupClientReadCodec();
recvClientHello();
recvClientFinished();
loopForWrites();
try {
recvClientHello();
recvClientFinished();
FAIL();
} catch (const std::runtime_error& ex) {
EXPECT_THAT(ex.what(), HasSubstr("Crypto error"));
}
EXPECT_TRUE(server->isClosed());
}

TEST_F(QuicServerTransportTest, TestRegisterAndHandleTransportKnobParams) {
int flag = 0;
server->registerKnobParamHandler(
Expand Down

0 comments on commit a67083f

Please sign in to comment.