Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Properly check validity of a session ID #1367

Open
ddragana opened this issue Oct 5, 2022 · 0 comments · May be fixed by #1390
Open

Properly check validity of a session ID #1367

ddragana opened this issue Oct 5, 2022 · 0 comments · May be fixed by #1390
Labels
p2 Issues that we want to fix

Comments

@ddragana
Copy link
Contributor

ddragana commented Oct 5, 2022

The spec says:

If at any point a session ID is received that cannot a valid ID for a
client-initiated bidirectional stream, the recepient MUST close the
connection with an H3_ID_ERROR error code.If at any point a session ID is received that cannot a valid ID for a
client-initiated bidirectional stream, the recepient MUST close the
connection with an H3_ID_ERROR error code.

Our current implementation behaves as follows:
When a WebTransprot stream is received with a session id, we check if we have a session with the ID that is active. If we do not we close the steam with the HttpStreamCreation error (this code). We do not check id session ID is a valid stream ID for client-initiated streams.
An invalid session ID will not have a session registered therefore the stream will be closed. The spec foresees that the connection will be closed with an H3_ID_ERROR error.

What we need to do:

  • check if the session ID is a valid client-initiated stream id. We should also check stream limits, i.e. that we do not receive an ID that is a valid valid client-initiated stream id, but it is higher than the allowed stream ID.
  • for the later check use the is_stream_id_allowed function.
@ddragana ddragana added the p2 Issues that we want to fix label Oct 6, 2022
@highpon highpon linked a pull request Dec 3, 2022 that will close this issue
@larseggert larseggert linked a pull request Feb 1, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
p2 Issues that we want to fix
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant