Repository navigation
Conversation
woolfi182
force-pushed
the
quic-local-reset-tokens
branch
from
October 25, 2026 07:45
7787cd0 to
667f58e
Compare
The stateless reset tokens that a session generates for its own connection IDs (in NEW_CONNECTION_ID frames and for the preferred address) were added to the token map that the endpoint consults for incoming stateless resets. That map is meant to hold only the tokens issued by the peer, and session teardown only removes those, so the locally issued entries outlived the session as dangling pointers. A short header packet for an unknown connection ID that ended in one of these tokens was then dispatched to the destroyed session instead of being answered with a stateless reset, and once the session had been garbage collected the lookup read freed memory. Assisted-by: Claude Code Signed-off-by: woolfi182 <[email protected]>
woolfi182
force-pushed
the
quic-local-reset-tokens
branch
from
October 25, 2026 10:49
667f58e to
89c5ac9
Compare
Owner
Author
|
Opened upstream at nodejs#67000 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The stateless reset tokens that a QUIC session generates for its own connection IDs (
Session::GenerateNewConnectionId()for NEW_CONNECTION_ID frames, andTransportParams::GeneratePreferredAddressToken()) were registered inSessionManager::token_map_. That map is whatEndpoint::Receive()consults to recognize a stateless reset sent by the peer; per the comments inendpoint.ccandsession_manager.h, it should only contain tokens previously given by the remote peer, and sessions clean up their entries on teardown.Teardown (
Session::Impl::~Impl()) only removes the peer's tokens (ngtcp2_conn_get_active_dcid2()), so the locally issued entries were never removed and kept a rawSession*after the session was destroyed. A short header packet for an unknown connection ID ending in one of those tokens was then:Sessionhad been garbage collected, a use-after-free inmaybeStatelessReset().This change stops registering locally issued tokens. They are still generated and sent to the peer; nothing on the receive side needs them, since the peer's tokens are registered through the
dcid_statuscallback.The new test reads the server's NEW_CONNECTION_ID tokens from its qlog, destroys the session, and sends the server endpoint a short header packet that ends in one of those tokens, followed by a control packet. Without the fix, the server answers only the control packet (and the process occasionally crashes with SIGSEGV); with it, both get a stateless reset.
QUIC is at Stability 1.0 behind
--experimental-quic, so per SECURITY.md this is handled as a regular bug.AI disclosure: this change was developed with assistance from Claude Code (analysis, fix and test). I reviewed the change and verified locally that the new test fails without the fix and passes with it, and that
parallel/test-quic-*and the QUIC cctests pass.