Skip to content

Properly check validity of a session ID #1367

@ddragana

Description

@ddragana

The spec says:

If at any point a session ID is received that cannot a valid ID for a
client-initiated bidirectional stream, the recepient MUST close the
connection with an H3_ID_ERROR error code.If at any point a session ID is received that cannot a valid ID for a
client-initiated bidirectional stream, the recepient MUST close the
connection with an H3_ID_ERROR error code.

Our current implementation behaves as follows:
When a WebTransprot stream is received with a session id, we check if we have a session with the ID that is active. If we do not we close the steam with the HttpStreamCreation error (this code). We do not check id session ID is a valid stream ID for client-initiated streams.
An invalid session ID will not have a session registered therefore the stream will be closed. The spec foresees that the connection will be closed with an H3_ID_ERROR error.

What we need to do:

  • check if the session ID is a valid client-initiated stream id. We should also check stream limits, i.e. that we do not receive an ID that is a valid valid client-initiated stream id, but it is higher than the allowed stream ID.
  • for the later check use the is_stream_id_allowed function.

Metadata

Metadata

Assignees

No one assigned

    Labels

    p2Issues that we want to fix

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions