qir-failures

Author: lws-team

lib/roles/quic/ops-quic.c

@@ -1148,28 +1148,6 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 			break;
 		}
 
-		/* Check reserved bits AFTER unmasking! */
-		if (p[0] & 0x80) {
-			/* Long header: Bits 0x0c MUST be zero */
-			if (p[0] & 0x0c) {
-				lwsl_wsi_notice(wsi, "QUIC RX: Reserved bits non-zero in long header");
-				if (nwsi && nwsi != wsi) {
-					lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_PROTOCOL_VIOLATION, 0, 0);
-					goto next_packet;
-				}
-				return LWS_HPI_RET_PLEASE_CLOSE_ME;
-			}
-		} else {
-			/* Short header: Bits 0x18 MUST be zero */
-			if (p[0] & 0x18) {
-				lwsl_wsi_notice(wsi, "QUIC RX: Reserved bits non-zero in short header");
-				if (nwsi && nwsi != wsi) {
-					lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_PROTOCOL_VIOLATION, 0, 0);
-					goto next_packet;
-				}
-				return LWS_HPI_RET_PLEASE_CLOSE_ME;
-			}
-		}
 
 		/*
 		 * Reconstruct full 62-bit PN.
@@ -1221,6 +1199,29 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 			goto next_packet;
 		}
 
+		/* Check reserved bits AFTER successful AEAD decryption (RFC 9000 5.4.1 & 12.2) */
+		if (p[0] & 0x80) {
+			/* Long header: Bits 0x0c MUST be zero */
+			if (p[0] & 0x0c) {
+				lwsl_wsi_notice(wsi, "QUIC RX: Reserved bits non-zero in long header");
+				if (nwsi && nwsi != wsi) {
+					lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_PROTOCOL_VIOLATION, 0, 0);
+					goto next_packet;
+				}
+				return LWS_HPI_RET_PLEASE_CLOSE_ME;
+			}
+		} else {
+			/* Short header: Bits 0x18 MUST be zero */
+			if (p[0] & 0x18) {
+				lwsl_wsi_notice(wsi, "QUIC RX: Reserved bits non-zero in short header");
+				if (nwsi && nwsi != wsi) {
+					lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_PROTOCOL_VIOLATION, 0, 0);
+					goto next_packet;
+				}
+				return LWS_HPI_RET_PLEASE_CLOSE_ME;
+			}
+		}
+
 		/* Decryption succeeded! Commit key update if pending */
 		if (is_key_update) {
 			lws_quic_keys_release_aead_rx(k);

lib/roles/quic/parse-quic.c

@@ -1672,13 +1672,16 @@ lws_quic_parse_transport_parameters(struct lws *wsi, const uint8_t *buf, size_t
 				}
 
 				if (port > 0) {
+					const char *host_str = (qn->nwsi && qn->nwsi->stash && qn->nwsi->stash->cis[CIS_HOST]) ?
+						qn->nwsi->stash->cis[CIS_HOST] : addr_str;
+
 					lwsl_wsi_notice(wsi, "QUIC TP: Migrating to preferred_address %s:%d", addr_str, port);
 					memset(&i, 0, sizeof(i));
 					i.context = wsi->a.context;
 					i.vhost = wsi->a.vhost;
 					i.address = addr_str;
-					i.host = addr_str;
-					i.origin = addr_str;
+					i.host = host_str;
+					i.origin = host_str;
 					i.port = port;
 					i.ssl_connection = LCCSCF_USE_SSL | LCCSCF_ALLOW_INSECURE;
 					i.quic_migrate_from_wsi = qn->nwsi;

lib/tls/openssl/openssl-client.c

@@ -708,13 +708,11 @@ lws_tls_client_create_vhost_context(struct lws_vhost *vh,
 					)
 {
 	struct lws_tls_client_reuse *tcr;
-	X509_STORE *x509_store;
 	unsigned long error;
 	SSL_METHOD *method;
 	EVP_MD_CTX *mdctx;
 	unsigned int len;
 	uint8_t hash[32];
-	X509 *client_CA;
 	char c;
 	int n;
 

lib/tls/private-lib-tls.h

@@ -249,12 +249,14 @@ lws_tls_check_all_cert_lifetimes(struct lws_context *context);
 LWS_VISIBLE int
 lws_tls_cert_get_x509_remaining(struct lws_context *context, const char *filepath, int *days_left, int *total_days);
 
+#if defined(LWS_WITH_NETWORK) && defined(LWS_WITH_CLIENT)
 int
 lws_tls_client_vhost_extra_cert_mem(struct lws_vhost *vh, const uint8_t *der, size_t len);
 
 int
 lws_tls_client_vhost_ca_mem_parse(struct lws_vhost *vh, const void *ca_mem,
 				  unsigned int ca_mem_len);
+#endif
 
 int
 lws_tls_alloc_pem_to_der_file(struct lws_context *context, const char *filename,

lib/tls/tls.c

@@ -597,6 +597,7 @@ lws_tls_alloc_pem_to_der_file(struct lws_context *context, const char *filename,
 	return 4;
 }
 
+#if defined(LWS_WITH_NETWORK) && defined(LWS_WITH_CLIENT)
 int
 lws_tls_client_vhost_ca_mem_parse(struct lws_vhost *vh, const void *ca_mem,
 				  unsigned int ca_mem_len)
@@ -659,6 +660,7 @@ lws_tls_client_vhost_ca_mem_parse(struct lws_vhost *vh, const void *ca_mem,
 	lwsl_info("%s: loaded %d CA cert(s) from ca_mem\n", __func__, count);
 	return 0;
 }
+#endif
 
 #endif