QUIC CHANNEL, TXP: Discard INITIAL EL correctly

Reviewed-by: Tomas Mraz <tomas@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from #21547)
openssl · Aug 8, 2023 · 3eb0f9a · 3eb0f9a
1 parent 457678d
commit 3eb0f9a
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 0 deletions.
diff --git a/include/internal/quic_txp.h b/include/internal/quic_txp.h
@@ -94,6 +94,7 @@ void ossl_quic_tx_packetiser_record_received_closing_bytes(
 
 typedef struct quic_txp_status_st {
     int sent_ack_eliciting; /* Was an ACK-eliciting packet sent? */
+    int sent_handshake; /* Was a Handshake packet sent? */
 } QUIC_TXP_STATUS;
 
 int ossl_quic_tx_packetiser_generate(OSSL_QUIC_TX_PACKETISER *txp,

diff --git a/ssl/quic/quic_channel.c b/ssl/quic/quic_channel.c
@@ -2200,6 +2200,13 @@ static int ch_tx(QUIC_CHANNEL *ch)
             ch->have_sent_ack_eliciting_since_rx = 1;
         }
 
+        if (!ch->is_server && status.sent_handshake)
+            /*
+             * RFC 9001 s. 4.9.1: A client MUST discard Initial keys when it
+             * first sends a Handshake packet.
+             */
+            ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
+
         if (ch->rxku_pending_confirm_done)
             ch->rxku_pending_confirm = 0;
 

diff --git a/ssl/quic/quic_txp.c b/ssl/quic/quic_txp.c
@@ -823,6 +823,10 @@ int ossl_quic_tx_packetiser_generate(OSSL_QUIC_TX_PACKETISER *txp,
         ++pkts_done;
     }
 
+    status->sent_handshake
+        = (pkt[QUIC_ENC_LEVEL_HANDSHAKE].h_valid
+           && pkt[QUIC_ENC_LEVEL_HANDSHAKE].h.bytes_appended > 0);
+
     /* Flush & Cleanup */
     res = TX_PACKETISER_RES_NO_PKT;
 out: