Skip to content

v0.9.3

Choose a tag to compare

View all tags
@github-actions github-actions released this 04 Sep 04:20
· 120 commits to main since this release
v0.9.3
e80a0f7

Changed

  • The SNI gate now refuses a first Initial whose Destination Connection ID is under eight bytes. The gate's own documentation named three replies quinn gives a stranger and promised to take them away, and one of them it never did: an Initial with a short connection ID drew a CONNECTION_CLOSE carrying PROTOCOL_VIOLATION before a frame was read and without any name being involved. That is the reply a port scan came for. The rule sits directly after the packet opens, which is what makes it decidable: opening under the keys its own connection ID derives is what says this is a client's first Initial, and RFC 9000 section 7.2 gives a first Initial a floor of eight bytes. Every later Initial of an admitted handshake is addressed by the eight bytes this server chose, and so is the one a Retry supplies, so no legitimate packet is ever this shape; a packet the gate cannot open keeps passing, which is the v0.9.1 rule this leaves untouched. The refusal is silent like the others and logs one debug line.
  • The pinned quinn-proto moves to the 0.11.x branch head 48455d3, which carries our quinn-rs/quinn#2823. A datagram naming an unsupported QUIC version used to draw a Version Negotiation packet whatever its size, where RFC 9000 section 5.2.2 says servers MUST drop the small ones; that was an amplification vector against exactly the scanner the gate is for, gate on or off. The same branch head brings two unrelated backports, ACK frames bundled into DATAGRAM and STREAM packets and a minimum-RTT path statistic. No 0.11.x release exists yet, so the [patch.crates-io] stanza stays.

Testing

  • A fuzz target for the gate's judgement of a datagram. The long header, the Initial packet protection, the frame walk and the ClientHello reader, on bytes a sender chose every one of, with the module's own promises as oracles: every shape the documentation says passes does pass, a refusal by name implies a real Initial, and changing the connection ID of a refused datagram turns the refusal into a pass. A seed corpus of authenticating Initials is written by the test suite, since a fuzzer cannot spell one by luck.
  • A shape matrix for the gate. Thirty-four legal layouts of one first flight, each built naming a host on the list and one that is not, assert that neither verdict moves; a real quinn first flight and a real aioquic first flight are judged as the bytes they put on the wire; and four on-wire probes record what still answers a stranger with the gate on. Three of those stay #[ignore]d as the documented residual: a decryptable, ack-eliciting Initial that names nobody draws an acknowledgement, and refusing it would refuse the large first flight the gate deliberately lets through.
  • The gate's three Initial-packet toolkits are folded into one in tests/it_gate_shapes.rs, the nameless key source is shared by the judgement seam, the tests and the fuzz target, and the judge itself loses an enum and two copies per packet. No verdict moves.

Dependencies

  • Both lockfiles refreshed: aws-lc-rs 1.18.1, aws-lc-sys 0.45.0, mio 1.2.3, smallvec 1.16.0, toml 1.1.5, tinyvec 1.13.1. The musl cross-build with the new aws-lc-sys was verified on the pull request that carried it.
  • Dependabot now watches fuzz/Cargo.toml too; the interop client moves to quic-go 0.62.0, and three workflow actions are bumped.

Upgrading: nothing to do. With expected_sni set, a scanner sending an Initial with a short connection ID, or a small probe naming a QUIC version this server does not speak, now gets nothing back; nothing changes for clients.

Static musl builds for x86_64 and aarch64. Verify with SHA256SUMS.

Each archive carries the binary, LICENSE, README.md and the script/ and docs/ directories. Installing and updating is described in docs/deployment.md.

What's Changed

  • build(deps): quinn-proto pin to 0.11.x HEAD 48455d3, lockfile refresh by @vcarus in #9
  • build(deps): Bump github.com/quic-go/quic-go from 0.61.0 to 0.62.0 in /tests/interop by @dependabot[bot] in #10
  • build(deps): Bump taiki-e/install-action from 2.86.8 to 2.87.3 by @dependabot[bot] in #11
  • build(deps): Bump actions/deploy-pages from 5.0.0 to 5.0.1 by @dependabot[bot] in #12
  • build(deps): Bump softprops/action-gh-release from 3.0.2 to 3.0.3 by @dependabot[bot] in #13

New Contributors

  • @vcarus made their first contribution in #9

Full Changelog: v0.9.2...v0.9.3

Contributors

vcarus and dependabot
Assets 5
Loading