drop initial keys when the handshake is confirmed (#5354)

diff --git a/connection.go b/connection.go
index 50e39349f2fb1f8c21dacb986c696da636a0d212..74e84cba685f40b4989369cff5fc231e79150069 100644 (file)
--- a/connection.go
+++ b/connection.go
@@ -949,6 +949,13 @@ func (c *Conn) handleHandshakeComplete(now monotime.Time) error {
 }
 
 func (c *Conn) handleHandshakeConfirmed(now monotime.Time) error {
+       // Drop initial keys.
+       // On the client side, this should have happened when sending the first Handshake packet,
+       // but this is not guaranteed if the server misbehaves.
+       // See CVE-2025-59530 for more details.
+       if err := c.dropEncryptionLevel(protocol.EncryptionInitial, now); err != nil {
+               return err
+       }
        if err := c.dropEncryptionLevel(protocol.EncryptionHandshake, now); err != nil {
                return err
        }

diff --git a/connection_test.go b/connection_test.go
index bdf1f2726a2a1c10795f530338dac9380d066966..51ea93e4c091157d58c8dafbe8deead3e7dd6e5a 100644 (file)
--- a/connection_test.go
+++ b/connection_test.go
@@ -1084,7 +1084,7 @@ func TestConnectionHandshakeServer(t *testing.T) {
        data, err := (&wire.CryptoFrame{Data: []byte("foobar")}).Append(nil, protocol.Version1)
        require.NoError(t, err)
 
-       cs.EXPECT().DiscardInitialKeys()
+       cs.EXPECT().DiscardInitialKeys().Times(2)
        gomock.InOrder(
                cs.EXPECT().StartHandshake(gomock.Any()),
                cs.EXPECT().NextEvent().Return(handshake.Event{Kind: handshake.EventNoEvent}),
@@ -1235,6 +1235,7 @@ func testConnectionHandshakeClient(t *testing.T, usePreferredAddress bool) {
                unpacker.EXPECT().UnpackLongHeader(gomock.Any(), gomock.Any()).Return(
                        &unpackedPacket{hdr: hdr, encryptionLevel: protocol.Encryption1RTT, data: data}, nil,
                ),
+               cs.EXPECT().DiscardInitialKeys(),
                cs.EXPECT().SetHandshakeConfirmed(),
                tc.packer.EXPECT().AppendPacket(gomock.Any(), gomock.Any(), gomock.Any(), gomock.Any()).DoAndReturn(
                        func(buf *packetBuffer, _ protocol.ByteCount, _ monotime.Time, _ protocol.Version) (shortHeaderPacket, error) {