SABITHSAHEB opened a new pull request, #13966: URL: https://github.com/apache/trafficserver/pull/13966
1. `QUICPacketHandlerIn::_recv_packet` checks the client token's MAC only when `proxy.config.quic.server.stateless_retry_enabled` is on (off by default), but always passes the token's `original_dcid()` to `quiche_conn_new_with_tls`, and quiche 0.28.0 treats a non-empty original DCID as proof of a Retry (`path.verified_peer_address = retry_cids.is_some()`), which drops the RFC 9000 section 8.1 limit of 3x the bytes received from an unvalidated address. 2. A spoofed-source Initial carrying any token of 35+ bytes whose byte 33 is 1 to 20 therefore turns the listener into a UDP amplifier: for one unanswered 1,200 B Initial and a 3 KB certificate chain, master sent 7,529 B back against 3,600 B without the token, and a compliant client that presents a real token (a NEW_TOKEN from another node, say) fails with `original_destination_connection_id does not match`. 3. The ODCID now comes only from a token that passed `is_valid()` under stateless retry; the new `test_h3_client_token` Uranium test fails on master with that error and passes with the fix. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
