Drop connection if incoming packet has wrong path and no progress in handshake
@@ -8677,12 +8677,21 @@ int ngtcp2_conn_read_pkt(ngtcp2_conn *conn, const ngtcp2_path *path,
case NGTCP2_CS_CLIENT_INITIAL:
case NGTCP2_CS_CLIENT_WAIT_HANDSHAKE:
case NGTCP2_CS_CLIENT_TLS_HANDSHAKE_FAILED:
+ return conn_read_handshake(conn, path, pi, pkt, pktlen, ts);
case NGTCP2_CS_SERVER_INITIAL:
case NGTCP2_CS_SERVER_WAIT_HANDSHAKE:
case NGTCP2_CS_SERVER_TLS_HANDSHAKE_FAILED:
- if (conn->server && !ngtcp2_path_eq(&conn->dcid.current.ps.path, path)) {
+ if (!ngtcp2_path_eq(&conn->dcid.current.ps.path, path)) {
ngtcp2_log_info(&conn->log, NGTCP2_LOG_EVENT_CON,
"ignore packet from unknown path during handshake");
+
+ if (conn->state == NGTCP2_CS_SERVER_INITIAL &&
+ ngtcp2_strm_rx_offset(&conn->in_pktns->crypto.strm) == 0 &&
+ (!conn->in_pktns->crypto.strm.rx.rob ||
+ !ngtcp2_rob_data_buffered(conn->in_pktns->crypto.strm.rx.rob))) {
+ return NGTCP2_ERR_DROP_CONN;
+ }
+
return 0;
}
return conn_read_handshake(conn, path, pi, pkt, pktlen, ts);
