conn_recv.go

     1  // Copyright 2023 The Go Authors. All rights reserved.
     2  // Use of this source code is governed by a BSD-style
     3  // license that can be found in the LICENSE file.
     4  
     5  package quic
     6  
     7  import (
     8  	"bytes"
     9  	"encoding/binary"
    10  	"errors"
    11  	"time"
    12  )
    13  
    14  func (c *Conn) handleDatagram(now time.Time, dgram *datagram) (handled bool) {
    15  	if !c.localAddr.IsValid() {
    16  		// We don't have any way to tell in the general case what address we're
    17  		// sending packets from. Set our address from the destination address of
    18  		// the first packet received from the peer.
    19  		c.localAddr = dgram.localAddr
    20  	}
    21  	if dgram.peerAddr.IsValid() && dgram.peerAddr != c.peerAddr {
    22  		if c.side == clientSide {
    23  			// "If a client receives packets from an unknown server address,
    24  			// the client MUST discard these packets."
    25  			// https://www.rfc-editor.org/rfc/rfc9000#section-9-6
    26  			return false
    27  		}
    28  		// We currently don't support connection migration,
    29  		// so for now the server also drops packets from an unknown address.
    30  		return false
    31  	}
    32  	buf := dgram.b
    33  	c.loss.datagramReceived(now, len(buf))
    34  	if c.isDraining() {
    35  		return false
    36  	}
    37  	for len(buf) > 0 {
    38  		var n int
    39  		ptype := getPacketType(buf)
    40  		switch ptype {
    41  		case packetTypeInitial:
    42  			if c.side == serverSide && len(dgram.b) < paddedInitialDatagramSize {
    43  				// Discard client-sent Initial packets in too-short datagrams.
    44  				// https://www.rfc-editor.org/rfc/rfc9000#section-14.1-4
    45  				return false
    46  			}
    47  			n = c.handleLongHeader(now, dgram, ptype, initialSpace, c.keysInitial.r, buf)
    48  		case packetTypeHandshake:
    49  			n = c.handleLongHeader(now, dgram, ptype, handshakeSpace, c.keysHandshake.r, buf)
    50  		case packetType1RTT:
    51  			n = c.handle1RTT(now, dgram, buf)
    52  		case packetTypeRetry:
    53  			c.handleRetry(now, buf)
    54  			return true
    55  		case packetTypeVersionNegotiation:
    56  			c.handleVersionNegotiation(now, buf)
    57  			return true
    58  		default:
    59  			n = -1
    60  		}
    61  		if n <= 0 {
    62  			// We don't expect to get a stateless reset with a valid
    63  			// destination connection ID, since the sender of a stateless
    64  			// reset doesn't know what the connection ID is.
    65  			//
    66  			// We're required to perform this check anyway.
    67  			//
    68  			// "[...] the comparison MUST be performed when the first packet
    69  			// in an incoming datagram [...] cannot be decrypted."
    70  			// https://www.rfc-editor.org/rfc/rfc9000#section-10.3.1-2
    71  			if len(buf) == len(dgram.b) && len(buf) > statelessResetTokenLen {
    72  				var token statelessResetToken
    73  				copy(token[:], buf[len(buf)-len(token):])
    74  				if c.handleStatelessReset(now, token) {
    75  					return true
    76  				}
    77  			}
    78  			// Invalid data at the end of a datagram is ignored.
    79  			return false
    80  		}
    81  		c.idleHandlePacketReceived(now)
    82  		buf = buf[n:]
    83  	}
    84  	return true
    85  }
    86  
    87  func (c *Conn) handleLongHeader(now time.Time, dgram *datagram, ptype packetType, space numberSpace, k fixedKeys, buf []byte) int {
    88  	if !k.isSet() {
    89  		return skipLongHeaderPacket(buf)
    90  	}
    91  
    92  	pnumMax := c.acks[space].largestSeen()
    93  	p, n := parseLongHeaderPacket(buf, k, pnumMax)
    94  	if n < 0 {
    95  		return -1
    96  	}
    97  	if buf[0]&reservedLongBits != 0 {
    98  		// Reserved header bits must be 0.
    99  		// https://www.rfc-editor.org/rfc/rfc9000#section-17.2-8.2.1
   100  		c.abort(now, localTransportError{
   101  			code:   errProtocolViolation,
   102  			reason: "reserved header bits are not zero",
   103  		})
   104  		return -1
   105  	}
   106  	if p.version != quicVersion1 {
   107  		// The peer has changed versions on us mid-handshake?
   108  		c.abort(now, localTransportError{
   109  			code:   errProtocolViolation,
   110  			reason: "protocol version changed during handshake",
   111  		})
   112  		return -1
   113  	}
   114  
   115  	if !c.acks[space].shouldProcess(p.num) {
   116  		return n
   117  	}
   118  
   119  	if logPackets {
   120  		logInboundLongPacket(c, p)
   121  	}
   122  	if c.logEnabled(QLogLevelPacket) {
   123  		c.logLongPacketReceived(p, buf[:n])
   124  	}
   125  	c.connIDState.handlePacket(c, p.ptype, p.srcConnID)
   126  	ackEliciting := c.handleFrames(now, dgram, ptype, space, p.payload)
   127  	c.acks[space].receive(now, space, p.num, ackEliciting, dgram.ecn)
   128  	if p.ptype == packetTypeHandshake && c.side == serverSide {
   129  		c.loss.validateClientAddress()
   130  
   131  		// "[...] a server MUST discard Initial keys when it first successfully
   132  		// processes a Handshake packet [...]"
   133  		// https://www.rfc-editor.org/rfc/rfc9001#section-4.9.1-2
   134  		c.discardKeys(now, initialSpace)
   135  	}
   136  	return n
   137  }
   138  
   139  func (c *Conn) handle1RTT(now time.Time, dgram *datagram, buf []byte) int {
   140  	if !c.keysAppData.canRead() {
   141  		// 1-RTT packets extend to the end of the datagram,
   142  		// so skip the remainder of the datagram if we can't parse this.
   143  		return len(buf)
   144  	}
   145  
   146  	pnumMax := c.acks[appDataSpace].largestSeen()
   147  	p, err := parse1RTTPacket(buf, &c.keysAppData, connIDLen, pnumMax)
   148  	if err != nil {
   149  		// A localTransportError terminates the connection.
   150  		// Other errors indicate an unparsable packet, but otherwise may be ignored.
   151  		if _, ok := err.(localTransportError); ok {
   152  			c.abort(now, err)
   153  		}
   154  		return -1
   155  	}
   156  	if buf[0]&reserved1RTTBits != 0 {
   157  		// Reserved header bits must be 0.
   158  		// https://www.rfc-editor.org/rfc/rfc9000#section-17.3.1-4.8.1
   159  		c.abort(now, localTransportError{
   160  			code:   errProtocolViolation,
   161  			reason: "reserved header bits are not zero",
   162  		})
   163  		return -1
   164  	}
   165  
   166  	if !c.acks[appDataSpace].shouldProcess(p.num) {
   167  		return len(buf)
   168  	}
   169  
   170  	if logPackets {
   171  		logInboundShortPacket(c, p)
   172  	}
   173  	if c.logEnabled(QLogLevelPacket) {
   174  		c.log1RTTPacketReceived(p, buf)
   175  	}
   176  	ackEliciting := c.handleFrames(now, dgram, packetType1RTT, appDataSpace, p.payload)
   177  	c.acks[appDataSpace].receive(now, appDataSpace, p.num, ackEliciting, dgram.ecn)
   178  	return len(buf)
   179  }
   180  
   181  func (c *Conn) handleRetry(now time.Time, pkt []byte) {
   182  	if c.side != clientSide {
   183  		return // clients don't send Retry packets
   184  	}
   185  	// "After the client has received and processed an Initial or Retry packet
   186  	// from the server, it MUST discard any subsequent Retry packets that it receives."
   187  	// https://www.rfc-editor.org/rfc/rfc9000#section-17.2.5.2-1
   188  	if !c.keysInitial.canRead() {
   189  		return // discarded Initial keys, connection is already established
   190  	}
   191  	if c.acks[initialSpace].seen.numRanges() != 0 {
   192  		return // processed at least one packet
   193  	}
   194  	if c.retryToken != nil {
   195  		return // received a Retry already
   196  	}
   197  	// "Clients MUST discard Retry packets that have a Retry Integrity Tag
   198  	// that cannot be validated."
   199  	// https://www.rfc-editor.org/rfc/rfc9000#section-17.2.5.2-2
   200  	p, ok := parseRetryPacket(pkt, c.connIDState.originalDstConnID)
   201  	if !ok {
   202  		return
   203  	}
   204  	// "A client MUST discard a Retry packet with a zero-length Retry Token field."
   205  	// https://www.rfc-editor.org/rfc/rfc9000#section-17.2.5.2-2
   206  	if len(p.token) == 0 {
   207  		return
   208  	}
   209  	c.retryToken = cloneBytes(p.token)
   210  	c.connIDState.handleRetryPacket(p.srcConnID)
   211  	c.keysInitial = initialKeys(p.srcConnID, c.side)
   212  	// We need to resend any data we've already sent in Initial packets.
   213  	// We must not reuse already sent packet numbers.
   214  	c.loss.discardPackets(initialSpace, c.log, c.handleAckOrLoss)
   215  	// TODO: Discard 0-RTT packets as well, once we support 0-RTT.
   216  	if c.testHooks != nil {
   217  		c.testHooks.init(false)
   218  	}
   219  }
   220  
   221  var errVersionNegotiation = errors.New("server does not support QUIC version 1")
   222  
   223  func (c *Conn) handleVersionNegotiation(now time.Time, pkt []byte) {
   224  	if c.side != clientSide {
   225  		return // servers don't handle Version Negotiation packets
   226  	}
   227  	// "A client MUST discard any Version Negotiation packet if it has
   228  	// received and successfully processed any other packet [...]"
   229  	// https://www.rfc-editor.org/rfc/rfc9000#section-6.2-2
   230  	if !c.keysInitial.canRead() {
   231  		return // discarded Initial keys, connection is already established
   232  	}
   233  	if c.acks[initialSpace].seen.numRanges() != 0 {
   234  		return // processed at least one packet
   235  	}
   236  	_, srcConnID, versions := parseVersionNegotiation(pkt)
   237  	if len(c.connIDState.remote) < 1 || !bytes.Equal(c.connIDState.remote[0].cid, srcConnID) {
   238  		return // Source Connection ID doesn't match what we sent
   239  	}
   240  	for len(versions) >= 4 {
   241  		ver := binary.BigEndian.Uint32(versions)
   242  		if ver == 1 {
   243  			// "A client MUST discard a Version Negotiation packet that lists
   244  			// the QUIC version selected by the client."
   245  			// https://www.rfc-editor.org/rfc/rfc9000#section-6.2-2
   246  			return
   247  		}
   248  		versions = versions[4:]
   249  	}
   250  	// "A client that supports only this version of QUIC MUST
   251  	// abandon the current connection attempt if it receives
   252  	// a Version Negotiation packet, [with the two exceptions handled above]."
   253  	// https://www.rfc-editor.org/rfc/rfc9000#section-6.2-2
   254  	c.abortImmediately(now, errVersionNegotiation)
   255  }
   256  
   257  func (c *Conn) handleFrames(now time.Time, dgram *datagram, ptype packetType, space numberSpace, payload []byte) (ackEliciting bool) {
   258  	if len(payload) == 0 {
   259  		// "An endpoint MUST treat receipt of a packet containing no frames
   260  		// as a connection error of type PROTOCOL_VIOLATION."
   261  		// https://www.rfc-editor.org/rfc/rfc9000#section-12.4-3
   262  		c.abort(now, localTransportError{
   263  			code:   errProtocolViolation,
   264  			reason: "packet contains no frames",
   265  		})
   266  		return false
   267  	}
   268  	// frameOK verifies that ptype is one of the packets in mask.
   269  	frameOK := func(c *Conn, ptype, mask packetType) (ok bool) {
   270  		if ptype&mask == 0 {
   271  			// "An endpoint MUST treat receipt of a frame in a packet type
   272  			// that is not permitted as a connection error of type
   273  			// PROTOCOL_VIOLATION."
   274  			// https://www.rfc-editor.org/rfc/rfc9000#section-12.4-3
   275  			c.abort(now, localTransportError{
   276  				code:   errProtocolViolation,
   277  				reason: "frame not allowed in packet",
   278  			})
   279  			return false
   280  		}
   281  		return true
   282  	}
   283  	// Packet masks from RFC 9000 Table 3.
   284  	// https://www.rfc-editor.org/rfc/rfc9000#table-3
   285  	const (
   286  		IH_1 = packetTypeInitial | packetTypeHandshake | packetType1RTT
   287  		__01 = packetType0RTT | packetType1RTT
   288  		___1 = packetType1RTT
   289  	)
   290  	hasCrypto := false
   291  	for len(payload) > 0 {
   292  		switch payload[0] {
   293  		case frameTypePadding, frameTypeAck, frameTypeAckECN,
   294  			frameTypeConnectionCloseTransport, frameTypeConnectionCloseApplication:
   295  		default:
   296  			ackEliciting = true
   297  		}
   298  		n := -1
   299  		switch payload[0] {
   300  		case frameTypePadding:
   301  			// PADDING is OK in all spaces.
   302  			n = 1
   303  		case frameTypePing:
   304  			// PING is OK in all spaces.
   305  			//
   306  			// A PING frame causes us to respond with an ACK by virtue of being
   307  			// an ack-eliciting frame, but requires no other action.
   308  			n = 1
   309  		case frameTypeAck, frameTypeAckECN:
   310  			if !frameOK(c, ptype, IH_1) {
   311  				return
   312  			}
   313  			n = c.handleAckFrame(now, space, payload)
   314  		case frameTypeResetStream:
   315  			if !frameOK(c, ptype, __01) {
   316  				return
   317  			}
   318  			n = c.handleResetStreamFrame(now, space, payload)
   319  		case frameTypeStopSending:
   320  			if !frameOK(c, ptype, __01) {
   321  				return
   322  			}
   323  			n = c.handleStopSendingFrame(now, space, payload)
   324  		case frameTypeCrypto:
   325  			if !frameOK(c, ptype, IH_1) {
   326  				return
   327  			}
   328  			hasCrypto = true
   329  			n = c.handleCryptoFrame(now, space, payload)
   330  		case frameTypeNewToken:
   331  			if !frameOK(c, ptype, ___1) {
   332  				return
   333  			}
   334  			_, n = consumeNewTokenFrame(payload)
   335  		case 0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f: // STREAM
   336  			if !frameOK(c, ptype, __01) {
   337  				return
   338  			}
   339  			n = c.handleStreamFrame(now, space, payload)
   340  		case frameTypeMaxData:
   341  			if !frameOK(c, ptype, __01) {
   342  				return
   343  			}
   344  			n = c.handleMaxDataFrame(now, payload)
   345  		case frameTypeMaxStreamData:
   346  			if !frameOK(c, ptype, __01) {
   347  				return
   348  			}
   349  			n = c.handleMaxStreamDataFrame(now, payload)
   350  		case frameTypeMaxStreamsBidi, frameTypeMaxStreamsUni:
   351  			if !frameOK(c, ptype, __01) {
   352  				return
   353  			}
   354  			n = c.handleMaxStreamsFrame(now, payload)
   355  		case frameTypeDataBlocked:
   356  			if !frameOK(c, ptype, __01) {
   357  				return
   358  			}
   359  			_, n = consumeDataBlockedFrame(payload)
   360  		case frameTypeStreamsBlockedBidi, frameTypeStreamsBlockedUni:
   361  			if !frameOK(c, ptype, __01) {
   362  				return
   363  			}
   364  			_, _, n = consumeStreamsBlockedFrame(payload)
   365  		case frameTypeStreamDataBlocked:
   366  			if !frameOK(c, ptype, __01) {
   367  				return
   368  			}
   369  			_, _, n = consumeStreamDataBlockedFrame(payload)
   370  		case frameTypeNewConnectionID:
   371  			if !frameOK(c, ptype, __01) {
   372  				return
   373  			}
   374  			n = c.handleNewConnectionIDFrame(now, space, payload)
   375  		case frameTypeRetireConnectionID:
   376  			if !frameOK(c, ptype, __01) {
   377  				return
   378  			}
   379  			n = c.handleRetireConnectionIDFrame(now, space, payload)
   380  		case frameTypePathChallenge:
   381  			if !frameOK(c, ptype, __01) {
   382  				return
   383  			}
   384  			n = c.handlePathChallengeFrame(now, dgram, space, payload)
   385  		case frameTypePathResponse:
   386  			if !frameOK(c, ptype, ___1) {
   387  				return
   388  			}
   389  			n = c.handlePathResponseFrame(now, space, payload)
   390  		case frameTypeConnectionCloseTransport:
   391  			// Transport CONNECTION_CLOSE is OK in all spaces.
   392  			n = c.handleConnectionCloseTransportFrame(now, payload)
   393  		case frameTypeConnectionCloseApplication:
   394  			if !frameOK(c, ptype, __01) {
   395  				return
   396  			}
   397  			n = c.handleConnectionCloseApplicationFrame(now, payload)
   398  		case frameTypeHandshakeDone:
   399  			if !frameOK(c, ptype, ___1) {
   400  				return
   401  			}
   402  			n = c.handleHandshakeDoneFrame(now, space, payload)
   403  		}
   404  		if n < 0 {
   405  			c.abort(now, localTransportError{
   406  				code:   errFrameEncoding,
   407  				reason: "frame encoding error",
   408  			})
   409  			return false
   410  		}
   411  		payload = payload[n:]
   412  	}
   413  	if hasCrypto {
   414  		// Process TLS events after handling all frames in a packet.
   415  		// TLS events can cause us to drop state for a number space,
   416  		// so do that last, to avoid handling frames differently
   417  		// depending on whether they come before or after a CRYPTO frame.
   418  		if err := c.handleTLSEvents(now); err != nil {
   419  			c.abort(now, err)
   420  		}
   421  	}
   422  	return ackEliciting
   423  }
   424  
   425  func (c *Conn) handleAckFrame(now time.Time, space numberSpace, payload []byte) int {
   426  	c.loss.receiveAckStart()
   427  	largest, ackDelay, ecn, n := consumeAckFrame(payload, func(rangeIndex int, start, end packetNumber) {
   428  		if err := c.loss.receiveAckRange(now, space, rangeIndex, start, end, c.handleAckOrLoss); err != nil {
   429  			c.abort(now, err)
   430  			return
   431  		}
   432  	})
   433  	// TODO: Make use of ECN feedback.
   434  	// https://www.rfc-editor.org/rfc/rfc9000.html#section-19.3.2
   435  	_ = ecn
   436  	// Prior to receiving the peer's transport parameters, we cannot
   437  	// interpret the ACK Delay field because we don't know the ack_delay_exponent
   438  	// to apply.
   439  	//
   440  	// For servers, we should always know the ack_delay_exponent because the
   441  	// client's transport parameters are carried in its Initial packets and we
   442  	// won't send an ack-eliciting Initial packet until after receiving the last
   443  	// client Initial packet.
   444  	//
   445  	// For clients, we won't receive the server's transport parameters until handling
   446  	// its Handshake flight, which will probably happen after reading its ACK for our
   447  	// Initial packet(s). However, the peer's acknowledgement delay cannot reduce our
   448  	// adjusted RTT sample below min_rtt, and min_rtt is generally going to be set
   449  	// by the packet containing the ACK for our Initial flight. Therefore, the
   450  	// ACK Delay for an ACK in the Initial space is likely to be ignored anyway.
   451  	//
   452  	// Long story short, setting the delay to 0 prior to reading transport parameters
   453  	// is usually going to have no effect, will have only a minor effect in the rare
   454  	// cases when it happens, and there aren't any good alternatives anyway since we
   455  	// can't interpret the ACK Delay field without knowing the exponent.
   456  	var delay time.Duration
   457  	if c.peerAckDelayExponent >= 0 {
   458  		delay = ackDelay.Duration(uint8(c.peerAckDelayExponent))
   459  	}
   460  	c.loss.receiveAckEnd(now, c.log, space, delay, c.handleAckOrLoss)
   461  	if space == appDataSpace {
   462  		c.keysAppData.handleAckFor(largest)
   463  	}
   464  	return n
   465  }
   466  
   467  func (c *Conn) handleMaxDataFrame(now time.Time, payload []byte) int {
   468  	maxData, n := consumeMaxDataFrame(payload)
   469  	if n < 0 {
   470  		return -1
   471  	}
   472  	c.streams.outflow.setMaxData(maxData)
   473  	return n
   474  }
   475  
   476  func (c *Conn) handleMaxStreamDataFrame(now time.Time, payload []byte) int {
   477  	id, maxStreamData, n := consumeMaxStreamDataFrame(payload)
   478  	if n < 0 {
   479  		return -1
   480  	}
   481  	if s := c.streamForFrame(now, id, sendStream); s != nil {
   482  		if err := s.handleMaxStreamData(maxStreamData); err != nil {
   483  			c.abort(now, err)
   484  			return -1
   485  		}
   486  	}
   487  	return n
   488  }
   489  
   490  func (c *Conn) handleMaxStreamsFrame(now time.Time, payload []byte) int {
   491  	styp, max, n := consumeMaxStreamsFrame(payload)
   492  	if n < 0 {
   493  		return -1
   494  	}
   495  	c.streams.localLimit[styp].setMax(max)
   496  	return n
   497  }
   498  
   499  func (c *Conn) handleResetStreamFrame(now time.Time, space numberSpace, payload []byte) int {
   500  	id, code, finalSize, n := consumeResetStreamFrame(payload)
   501  	if n < 0 {
   502  		return -1
   503  	}
   504  	if s := c.streamForFrame(now, id, recvStream); s != nil {
   505  		if err := s.handleReset(code, finalSize); err != nil {
   506  			c.abort(now, err)
   507  		}
   508  	}
   509  	return n
   510  }
   511  
   512  func (c *Conn) handleStopSendingFrame(now time.Time, space numberSpace, payload []byte) int {
   513  	id, code, n := consumeStopSendingFrame(payload)
   514  	if n < 0 {
   515  		return -1
   516  	}
   517  	if s := c.streamForFrame(now, id, sendStream); s != nil {
   518  		if err := s.handleStopSending(code); err != nil {
   519  			c.abort(now, err)
   520  		}
   521  	}
   522  	return n
   523  }
   524  
   525  func (c *Conn) handleCryptoFrame(now time.Time, space numberSpace, payload []byte) int {
   526  	off, data, n := consumeCryptoFrame(payload)
   527  	err := c.handleCrypto(now, space, off, data)
   528  	if err != nil {
   529  		c.abort(now, err)
   530  		return -1
   531  	}
   532  	return n
   533  }
   534  
   535  func (c *Conn) handleStreamFrame(now time.Time, space numberSpace, payload []byte) int {
   536  	id, off, fin, b, n := consumeStreamFrame(payload)
   537  	if n < 0 {
   538  		return -1
   539  	}
   540  	if s := c.streamForFrame(now, id, recvStream); s != nil {
   541  		if err := s.handleData(off, b, fin); err != nil {
   542  			c.abort(now, err)
   543  		}
   544  	}
   545  	return n
   546  }
   547  
   548  func (c *Conn) handleNewConnectionIDFrame(now time.Time, space numberSpace, payload []byte) int {
   549  	seq, retire, connID, resetToken, n := consumeNewConnectionIDFrame(payload)
   550  	if n < 0 {
   551  		return -1
   552  	}
   553  	if err := c.connIDState.handleNewConnID(c, seq, retire, connID, resetToken); err != nil {
   554  		c.abort(now, err)
   555  	}
   556  	return n
   557  }
   558  
   559  func (c *Conn) handleRetireConnectionIDFrame(now time.Time, space numberSpace, payload []byte) int {
   560  	seq, n := consumeRetireConnectionIDFrame(payload)
   561  	if n < 0 {
   562  		return -1
   563  	}
   564  	if err := c.connIDState.handleRetireConnID(c, seq); err != nil {
   565  		c.abort(now, err)
   566  	}
   567  	return n
   568  }
   569  
   570  func (c *Conn) handlePathChallengeFrame(now time.Time, dgram *datagram, space numberSpace, payload []byte) int {
   571  	data, n := consumePathChallengeFrame(payload)
   572  	if n < 0 {
   573  		return -1
   574  	}
   575  	c.handlePathChallenge(now, dgram, data)
   576  	return n
   577  }
   578  
   579  func (c *Conn) handlePathResponseFrame(now time.Time, space numberSpace, payload []byte) int {
   580  	data, n := consumePathResponseFrame(payload)
   581  	if n < 0 {
   582  		return -1
   583  	}
   584  	c.handlePathResponse(now, data)
   585  	return n
   586  }
   587  
   588  func (c *Conn) handleConnectionCloseTransportFrame(now time.Time, payload []byte) int {
   589  	code, _, reason, n := consumeConnectionCloseTransportFrame(payload)
   590  	if n < 0 {
   591  		return -1
   592  	}
   593  	c.handlePeerConnectionClose(now, peerTransportError{code: code, reason: reason})
   594  	return n
   595  }
   596  
   597  func (c *Conn) handleConnectionCloseApplicationFrame(now time.Time, payload []byte) int {
   598  	code, reason, n := consumeConnectionCloseApplicationFrame(payload)
   599  	if n < 0 {
   600  		return -1
   601  	}
   602  	c.handlePeerConnectionClose(now, &ApplicationError{Code: code, Reason: reason})
   603  	return n
   604  }
   605  
   606  func (c *Conn) handleHandshakeDoneFrame(now time.Time, space numberSpace, payload []byte) int {
   607  	if c.side == serverSide {
   608  		// Clients should never send HANDSHAKE_DONE.
   609  		// https://www.rfc-editor.org/rfc/rfc9000#section-19.20-4
   610  		c.abort(now, localTransportError{
   611  			code:   errProtocolViolation,
   612  			reason: "client sent HANDSHAKE_DONE",
   613  		})
   614  		return -1
   615  	}
   616  	if c.isAlive() {
   617  		c.confirmHandshake(now)
   618  	}
   619  	return 1
   620  }
   621  
   622  var errStatelessReset = errors.New("received stateless reset")
   623  
   624  func (c *Conn) handleStatelessReset(now time.Time, resetToken statelessResetToken) (valid bool) {
   625  	if !c.connIDState.isValidStatelessResetToken(resetToken) {
   626  		return false
   627  	}
   628  	c.setFinalError(errStatelessReset)
   629  	c.enterDraining(now)
   630  	return true
   631  }
   632
View as plain text