qir-failures

Author: lws-team

.sai.json

@@ -321,7 +321,7 @@
 		},
 
 		"qir": {
-			"cmake":    "cd /opt/quic-interop-runner ; source venv/bin/activate ; rm -rf logs_* ; export QIR_LWS_BRANCH=main ; cd /opt/quic-interop-runner/lws ; if [ \"`docker ps -q`\" ] ; then docker kill $(docker ps -q) ; fi ;  docker system prune -a --volumes -f && docker build --build-arg QIR_LWS_BRANCH=${QIR_LWS_BRANCH} -t lws-quic-interop . --no-cache && cd .. && python3 run.py -c lws -s lws --delete-successful-logs ; python3 run.py -p webtransport -c lws -s lws --delete-successful-logs -t handshake,transfer-unidirectional-receive,transfer-unidirectional-send,transfer-bidirectional-receive,transfer-bidirectional-send,transfer-datagram-receive,transfer-datagram-send",
+			"cmake":    "cd /opt/quic-interop-runner ; source venv/bin/activate ; rm -rf logs_* ; export QIR_LWS_BRANCH=main ; cd /opt/quic-interop-runner/lws ; if [ \"`docker ps -q`\" ] ; then docker kill $(docker ps -q) ; fi ;  docker system prune -f && docker build --build-arg QIR_LWS_BRANCH=${QIR_LWS_BRANCH} -t lws-quic-interop . --no-cache && cd .. && python3 run.py -c lws -s lws --delete-successful-logs ; python3 run.py -p webtransport -c lws -s lws --delete-successful-logs -t handshake,transfer-unidirectional-receive,transfer-unidirectional-send,transfer-bidirectional-receive,transfer-bidirectional-send,transfer-datagram-receive,transfer-datagram-send",
 			"platforms":	"none, linux-debian13/x86_64-amd/gcc"
 		}
 

lib/core-net/client/sort-dns.c

@@ -640,6 +640,9 @@ lws_sort_dns(struct lws *wsi, const struct addrinfo *result)
 #if defined(LWS_WITH_IPV6)
 		if (!wsi->ipv6 && ai->ai_family == AF_INET6)
 			goto next;
+#else
+		if (ai->ai_family == AF_INET6)
+			goto next;
 #endif
 
 		ds = lws_zalloc(sizeof(*ds), __func__);

lib/core-net/wsi.c

@@ -118,11 +118,6 @@ struct lws *lws_get_network_wsi(struct lws *wsi) {
 	if (!wsi)
 		return NULL;
 
-#if defined(LWS_ROLE_QUIC)
-	if (wsi->quic.qn)
-		return wsi;
-#endif
-
 #if defined(LWS_WITH_HTTP2) || defined(LWS_ROLE_MQTT) || defined(LWS_ROLE_QUIC)
 	if (!wsi->mux_substream
 #if defined(LWS_WITH_CLIENT)
@@ -131,13 +126,8 @@ struct lws *lws_get_network_wsi(struct lws *wsi) {
 	   )
 		return wsi;
 
-	while (wsi->mux.parent_wsi) {
-#if defined(LWS_ROLE_QUIC)
-		if (wsi->quic.qn)
-			return wsi;
-#endif
+	while (wsi->mux.parent_wsi)
 		wsi = wsi->mux.parent_wsi;
-	}
 #endif
 
 	return wsi;

lib/roles/http/server/interceptor.c

@@ -159,6 +159,29 @@ lws_interceptor_inject_header(struct lws *wsi, struct vhd_interceptor *vhd, cons
 	p[cur_len + n] = '\0';
 }
 
+static int
+lws_interceptor_redirect(struct lws *wsi, const char *uri)
+{
+	char buf[LWS_PRE + 1024], *p = buf + LWS_PRE, *end = buf + sizeof(buf) - 1;
+
+	if (lws_add_http_header_status(wsi, HTTP_STATUS_SEE_OTHER,
+				       (unsigned char **)&p, (unsigned char *)end))
+		return 1;
+	if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_LOCATION,
+					 (unsigned char *)uri, (int)strlen(uri),
+					 (unsigned char **)&p, (unsigned char *)end))
+		return 1;
+	if (lws_finalize_http_header(wsi, (unsigned char **)&p,
+				     (unsigned char *)end))
+		return 1;
+
+	lws_write(wsi, (unsigned char *)buf + LWS_PRE,
+		  lws_ptr_diff_size_t(p, buf + LWS_PRE),
+		  LWS_WRITE_HTTP_HEADERS | LWS_WRITE_H2_STREAM_END);
+
+	return lws_http_transaction_completed(wsi);
+}
+
 static int
 lws_interceptor_issue_cookie(struct lws *wsi)
 {
@@ -522,35 +545,38 @@ lws_interceptor_handle_http(struct lws *wsi, void *user, const struct lws_interc
 	}
 
 	if (lws_hdr_total_length(wsi, WSI_TOKEN_POST_URI)) {
+		unsigned long pre_delay_sec = (unsigned long)(vhd->pre_delay_ms / 1000);
+		unsigned long min_req_sec = pre_delay_sec > 1 ? pre_delay_sec - 1 : 0;
+
 		vs = sizeof(vbuf);
 
 		lws_interceptor_init_jwt_cookie(&vck, vhd, ip, "lws_interceptor_v");
 
 		if (lws_jwt_get_http_cookie_validate_jwt(wsi, &vck, vbuf, &vs)) {
 			lwsl_vhost_notice(vhd->vhost, "%s: POST: missing or invalid visit cookie", __func__);
-			return 1;
+			return lws_interceptor_redirect(wsi, uri);
 		}
 
 		iat_p = lws_json_simple_find(vbuf, vs, "\"iat\":", &iat_len);
 		if (!iat_p) {
 			lwsl_vhost_notice(vhd->vhost, "%s: POST: visit cookie missing iat", __func__);
-			return 1;
+			return lws_interceptor_redirect(wsi, uri);
 		}
 		iat = atoll(iat_p);
 
 		if (ops && ops->verify) {
 			lws_interceptor_result_t res = ops->verify(wsi, NULL, 0);
 			if (res == LWS_INTERCEPTOR_RET_REJECT)
-				return 1;
+				return lws_interceptor_redirect(wsi, uri);
 			if (res == LWS_INTERCEPTOR_RET_PASS)
 				return lws_interceptor_issue_cookie(wsi);
 
 			/* RET_DELAYED falls through to timer setup */
 		}
 
-		if (lws_now_secs() < (unsigned long)iat + (unsigned long)(vhd->pre_delay_ms / 1000)) {
+		if (lws_now_secs() < (unsigned long)iat + min_req_sec) {
 			lwsl_vhost_notice(vhd->vhost, "%s: POST: pre-delay not met", __func__);
-			return 1;
+			return lws_interceptor_redirect(wsi, uri);
 		}
 
 		lws_set_timeout(wsi, PENDING_TIMEOUT_CLIENT_CONN_IDLE, 25);

lib/roles/quic/crypto-quic.c

@@ -259,7 +259,7 @@ lws_quic_set_keys(struct lws *wsi, enum lws_tls_quic_secret_type type, const uin
 	}
 
         if (is_rx) {
-                if (level == LWS_QUIC_LEVEL_APP && k->valid && k->secret_rx[0] && qn->handshake_done) {
+                if (level == LWS_QUIC_LEVEL_APP && k->valid && k->secret_rx[0]) {
                         lwsl_notice("%s: ignoring post-handshake TLS secret_rx update for APP level\n", __func__);
                         return 0;
                 }
@@ -270,7 +270,7 @@ lws_quic_set_keys(struct lws *wsi, enum lws_tls_quic_secret_type type, const uin
                                               &k->el_aead_rx, k->key_aead_rx, &k->el_hp_rx, k->key_hp_rx))
                         return -1;
         } else {
-                if (level == LWS_QUIC_LEVEL_APP && k->valid && k->secret_tx[0] && qn->handshake_done) {
+                if (level == LWS_QUIC_LEVEL_APP && k->valid && k->secret_tx[0]) {
                         lwsl_notice("%s: ignoring post-handshake TLS secret_tx update for APP level\n", __func__);
                         return 0;
                 }

lib/roles/quic/ops-quic.c

@@ -1148,28 +1148,6 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 			break;
 		}
 
-		/* Check reserved bits AFTER unmasking! */
-		if (p[0] & 0x80) {
-			/* Long header: Bits 0x0c MUST be zero */
-			if (p[0] & 0x0c) {
-				lwsl_wsi_notice(wsi, "QUIC RX: Reserved bits non-zero in long header");
-				if (nwsi && nwsi != wsi) {
-					lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_PROTOCOL_VIOLATION, 0, 0);
-					goto next_packet;
-				}
-				return LWS_HPI_RET_PLEASE_CLOSE_ME;
-			}
-		} else {
-			/* Short header: Bits 0x18 MUST be zero */
-			if (p[0] & 0x18) {
-				lwsl_wsi_notice(wsi, "QUIC RX: Reserved bits non-zero in short header");
-				if (nwsi && nwsi != wsi) {
-					lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_PROTOCOL_VIOLATION, 0, 0);
-					goto next_packet;
-				}
-				return LWS_HPI_RET_PLEASE_CLOSE_ME;
-			}
-		}
 
 		/*
 		 * Reconstruct full 62-bit PN.
@@ -1221,6 +1199,29 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 			goto next_packet;
 		}
 
+		/* Check reserved bits AFTER successful AEAD decryption (RFC 9000 5.4.1 & 12.2) */
+		if (p[0] & 0x80) {
+			/* Long header: Bits 0x0c MUST be zero */
+			if (p[0] & 0x0c) {
+				lwsl_wsi_notice(wsi, "QUIC RX: Reserved bits non-zero in long header");
+				if (nwsi && nwsi != wsi) {
+					lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_PROTOCOL_VIOLATION, 0, 0);
+					goto next_packet;
+				}
+				return LWS_HPI_RET_PLEASE_CLOSE_ME;
+			}
+		} else {
+			/* Short header: Bits 0x18 MUST be zero */
+			if (p[0] & 0x18) {
+				lwsl_wsi_notice(wsi, "QUIC RX: Reserved bits non-zero in short header");
+				if (nwsi && nwsi != wsi) {
+					lws_quic_enter_closing_state(nwsi, LWS_QUIC_ERR_PROTOCOL_VIOLATION, 0, 0);
+					goto next_packet;
+				}
+				return LWS_HPI_RET_PLEASE_CLOSE_ME;
+			}
+		}
+
 		/* Decryption succeeded! Commit key update if pending */
 		if (is_key_update) {
 			lws_quic_keys_release_aead_rx(k);
@@ -1272,6 +1273,7 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 		}
 
 		/* Check for duplicate/replayed packet numbers (Security Fix) */
+		int is_out_of_order = 0;
 		if (nwsi->quic.qn) {
 			uint64_t highest = nwsi->quic.qn->highest_rx_pn[pn_space];
 			if ((nwsi->quic.qn->rx_pn_bitmask[pn_space] != 0 || highest != 0) && full_pn <= highest) {
@@ -1281,6 +1283,7 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 					goto next_packet;
 				}
 				nwsi->quic.qn->rx_pn_bitmask[pn_space] |= (1ULL << diff);
+				is_out_of_order = 1;
 			} else {
 				if (nwsi->quic.qn->rx_pn_bitmask[pn_space] != 0 || highest != 0) {
 					uint64_t diff = full_pn - highest;
@@ -1295,6 +1298,11 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 
 			/* Connection Migration: Execute pending migration now that the packet is cryptographically verified */
 			if (pending_migration) {
+				if (is_out_of_order) {
+					lwsl_notice("QUIC: Ignoring connection migration from out-of-order packet (PN %llu <= highest %llu)\n",
+						    (unsigned long long)full_pn, (unsigned long long)highest);
+					pending_migration = 0;
+				} else {
 				pending_migration = 0;
 #if (_LWS_ENABLED_LOGS & LLL_NOTICE)
 				char buf_old[64], buf_new[64];
@@ -1318,7 +1326,7 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 						    buf_old, (unsigned int)ntohs(port_old),
 						    buf_new, (unsigned int)ntohs(port_new));
 #endif
-					/* F-60: Do NOT commit nwsi->udp->sa46 yet! Wait for PATH_RESPONSE! */
+					nwsi->quic.qn->rx_has_non_probing = 0;
 					nwsi->quic.qn->probing_sa46 = migration_sa46;
 					nwsi->quic.qn->probing_sa46_valid = 1;
 
@@ -1381,6 +1389,7 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 						lws_callback_on_writable(nwsi);
 					}
 				}
+				}
 			}
 
 			/* 5. Parse and handle all frames in the payload */
@@ -1400,6 +1409,46 @@ rops_handle_POLLIN_quic(struct lws_context_per_thread *pt, struct lws *wsi,
 				nwsi = lws_get_quic_network_wsi(nwsi);
 			}
 
+			/* RFC 9000 Section 9.3: Receiving non-probing frames (STREAM, ACK, etc.) from a new address
+			 * indicates that the peer has migrated (e.g. due to NAT rebinding or active client migration).
+			 * The server MUST commit its active path to the new address. */
+			if (nwsi && nwsi->quic.qn && nwsi->quic.qn->is_server &&
+			    nwsi->quic.qn->probing_sa46_valid && nwsi->quic.qn->rx_has_non_probing) {
+#if (_LWS_ENABLED_LOGS & LLL_NOTICE)
+				char buf_old[64], buf_new[64];
+				uint16_t port_old, port_new;
+				lws_sa46_write_numeric_address(&nwsi->udp->sa46, buf_old, sizeof(buf_old));
+				lws_sa46_write_numeric_address(&nwsi->quic.qn->probing_sa46, buf_new, sizeof(buf_new));
+#if defined(LWS_WITH_IPV6)
+				port_old = nwsi->udp->sa46.sa4.sin_family == AF_INET ? nwsi->udp->sa46.sa4.sin_port : nwsi->udp->sa46.sa6.sin6_port;
+				port_new = nwsi->quic.qn->probing_sa46.sa4.sin_family == AF_INET ? nwsi->quic.qn->probing_sa46.sa4.sin_port : nwsi->quic.qn->probing_sa46.sa6.sin6_port;
+#else
+				port_old = nwsi->udp->sa46.sa4.sin_port;
+				port_new = nwsi->quic.qn->probing_sa46.sa4.sin_port;
+#endif
+				lwsl_notice("QUIC Server: Connection Migration committed via non-probing packet! Peer address updated from %s:%u to %s:%u\n",
+					    buf_old, (unsigned int)ntohs(port_old),
+					    buf_new, (unsigned int)ntohs(port_new));
+#endif
+
+				nwsi->udp->sa46 = nwsi->quic.qn->probing_sa46;
+				nwsi->quic.qn->probing_sa46_valid = 0;
+
+				/* Reset Congestion Control State (RFC 9000 9.3.3) */
+				if (nwsi->quic.qn->cc_ops && nwsi->quic.qn->cc_ops->init)
+					nwsi->quic.qn->cc_ops->init(nwsi);
+
+				/* Reset RTT estimator */
+				nwsi->quic.qn->smoothed_rtt = 0;
+				nwsi->quic.qn->rttvar = 0;
+				nwsi->quic.qn->latest_rtt = 0;
+
+				/* Reset PMTUD */
+				nwsi->quic.qn->current_mtu = 1280;
+				nwsi->quic.qn->probed_mtu = 1380;
+				nwsi->quic.qn->pmtud_state = 1;
+			}
+
 			if (nwsi) {
 				struct lws *w = nwsi->mux.child_list;
 				while (w) {
@@ -2648,6 +2697,9 @@ rops_client_bind_quic(struct lws *wsi, const struct lws_client_connect_info *i)
 
                         lws_quic_queue_path_challenge(wsi);
 
+                        lws_role_transition(wsi, LWSIFR_CLIENT, LRS_UNCONNECTED, &role_ops_quic);
+                        lws_callback_on_writable(wsi);
+
                         /* Skip all initialization and key derivation, just return */
                         return 1;
                 }

lib/roles/quic/parse-quic.c

@@ -315,6 +315,21 @@ lws_quic_rx_reassemble(struct lws *nwsi, struct lws *wsi_child, struct lws_quic_
 			lws_start_foreach_dll_safe(struct lws_dll2 *, d, d1, owner->head) {
 				struct lws_quic_rx_chunk *c = lws_container_of(d, struct lws_quic_rx_chunk, list);
 
+				if (c->offset < *expected_offset) {
+					if (c->offset + c->len <= *expected_offset) {
+						/* Completely obsolete chunk already delivered, discard */
+						lws_dll2_remove(&c->list);
+						lws_free(c);
+						flushed = 1;
+						break;
+					}
+					/* Trim overlapping prefix */
+					size_t overlap = (size_t)(*expected_offset - c->offset);
+					c->data += overlap;
+					c->len -= overlap;
+					c->offset = *expected_offset;
+				}
+
 				if (c->offset == *expected_offset) {
 					/* We found the next contiguous piece! */
 					if (is_crypto) {
@@ -543,6 +558,14 @@ lws_quic_parse_frames(struct lws *nwsi, int level, uint8_t *payload, size_t payl
 		if (!consumed) return -1;
 		pos += consumed;
 
+		/* Track non-probing frames (RFC 9000 Section 9.1) */
+		if (qn && type != LWS_QUIC_FT_PADDING &&
+		    type != LWS_QUIC_FT_PATH_CHALLENGE &&
+		    type != LWS_QUIC_FT_PATH_RESPONSE &&
+		    type != LWS_QUIC_FT_NEW_CONNECTION_ID) {
+			qn->rx_has_non_probing = 1;
+		}
+
 		/* Epoch Gating (RFC 9000 12.5) */
 		int is_allowed = 0;
 		switch (type) {
@@ -1672,16 +1695,21 @@ lws_quic_parse_transport_parameters(struct lws *wsi, const uint8_t *buf, size_t
 				}
 
 				if (port > 0) {
+					const char *host_str = (qn->nwsi && qn->nwsi->stash && qn->nwsi->stash->cis[CIS_HOST]) ?
+						qn->nwsi->stash->cis[CIS_HOST] : addr_str;
+
 					lwsl_wsi_notice(wsi, "QUIC TP: Migrating to preferred_address %s:%d", addr_str, port);
 					memset(&i, 0, sizeof(i));
 					i.context = wsi->a.context;
 					i.vhost = wsi->a.vhost;
 					i.address = addr_str;
-					i.host = addr_str;
-					i.origin = addr_str;
+					i.host = host_str;
+					i.origin = host_str;
 					i.port = port;
 					i.ssl_connection = LCCSCF_USE_SSL | LCCSCF_ALLOW_INSECURE;
 					i.quic_migrate_from_wsi = qn->nwsi;
+					i.method = "QUIC";
+					i.alpn = wsi->alpn;
 
 					lws_client_connect_via_info(&i);
 				}

lib/roles/quic/private-lib-roles-quic.h

@@ -316,6 +316,7 @@ struct lws_quic_netconn {
 	struct lws              *migration_probing_wsi;
 	lws_sockaddr46		probing_sa46;
 	uint8_t			probing_sa46_valid:1;
+	uint8_t			rx_has_non_probing:1;
 
 	/* ECN (Explicit Congestion Notification) */
 	uint64_t		ecn_rx_ect0;

lib/tls/gnutls/gnutls-session.c

@@ -174,7 +174,7 @@ lws_tls_session_new_gnutls(struct lws *wsi)
 	struct lws_vhost *vh;
 	lws_tls_scm_t *ts;
 	size_t nl;
-	gnutls_datum_t gd;
+	gnutls_datum_t gd = { NULL, 0 };
 #if (_LWS_ENABLED_LOGS & LLL_INFO)
 	const char *disposition = "reuse";
 #endif

lib/tls/openssl/openssl-client.c

@@ -708,13 +708,11 @@ lws_tls_client_create_vhost_context(struct lws_vhost *vh,
 					)
 {
 	struct lws_tls_client_reuse *tcr;
-	X509_STORE *x509_store;
 	unsigned long error;
 	SSL_METHOD *method;
 	EVP_MD_CTX *mdctx;
 	unsigned int len;
 	uint8_t hash[32];
-	X509 *client_CA;
 	char c;
 	int n;