fix: Abort on RX of illegal stream control/data frame

neqo-transport/src/connection/tests/stream.rs

@@ -11,21 +11,21 @@ use test_fixture::now;
 
 use super::{
     super::State, assert_error, connect, connect_force_idle, default_client, default_server,
-    maybe_authenticate, new_client, new_server, send_something, DEFAULT_STREAM_DATA,
+    maybe_authenticate, new_client, new_server, send_something, send_with_extra,
+    DEFAULT_STREAM_DATA,
 };
 use crate::{
     events::ConnectionEvent,
+    frame::{
+        FRAME_TYPE_MAX_STREAM_DATA, FRAME_TYPE_RESET_STREAM, FRAME_TYPE_STOP_SENDING,
+        FRAME_TYPE_STREAM_DATA_BLOCKED,
+    },
+    packet::PacketBuilder,
     recv_stream::RECV_BUFFER_SIZE,
     send_stream::{OrderGroup, SendStreamState, SEND_BUFFER_SIZE},
     streams::{SendOrder, StreamOrder},
     tparams::{self, TransportParameter},
-    CloseReason,
-    // tracking::DEFAULT_ACK_PACKET_TOLERANCE,
-    Connection,
-    ConnectionParameters,
-    Error,
-    StreamId,
-    StreamType,
+    CloseReason, Connection, ConnectionParameters, Error, StreamId, StreamType,
 };
 
 #[test]
@@ -539,6 +539,62 @@ fn do_not_accept_data_after_stop_sending() {
     );
 }
 
+struct IllegalWriter(Vec<u64>);
+
+impl crate::connection::test_internal::FrameWriter for IllegalWriter {
+    fn write_frames(&mut self, builder: &mut PacketBuilder) {
+        builder.write_varint_frame(&self.0);
+    }
+}
+
+// Server sends a stream-related frame for client-initiated stream that is not yet created.
+fn illegal_frame_test(frame: &[u64]) {
+    let mut client = default_client();
+    let mut server = default_server();
+    connect(&mut client, &mut server);
+    let dgram = send_with_extra(&mut server, IllegalWriter(frame.to_vec()), now());
+    client.process_input(dgram, now());
+    assert!(client.state().closed());
+}
+
+#[test]
+fn illegal_stream_reset_frame() {
+    // 0 = Client-Initiated, Bidirectional; 2 = Client-Initiated, Unidirectional
+    for stream_id in [0, 2] {
+        illegal_frame_test(&[FRAME_TYPE_RESET_STREAM, stream_id, 0, 0]);
+    }
+}
+
+#[test]
+fn illegal_stop_sending_frame() {
+    // 0 = Client-Initiated, Bidirectional; 2 = Client-Initiated, Unidirectional
+    for stream_id in [0, 2] {
+        illegal_frame_test(&[FRAME_TYPE_STOP_SENDING, stream_id, 0]);
+    }
+}
+
+#[test]
+fn illegal_max_stream_data_frame() {
+    // 0 = Client-Initiated, Bidirectional; 2 = Client-Initiated, Unidirectional
+    for stream_id in [0, 2] {
+        illegal_frame_test(&[FRAME_TYPE_MAX_STREAM_DATA, stream_id, 0]);
+    }
+}
+
+#[test]
+fn illegal_stream_data_blocked_frame() {
+    for stream_id in [0, 2] {
+        illegal_frame_test(&[FRAME_TYPE_STREAM_DATA_BLOCKED, stream_id, 0]);
+    }
+}
+
+#[test]
+fn illegal_stream_frame() {
+    for stream_id in [0, 2] {
+        illegal_frame_test(&[0x08, stream_id, 0]);
+    }
+}
+
 #[test]
 // Server sends stop_sending, the client simultaneous sends reset.
 fn simultaneous_stop_sending_and_reset() {

neqo-transport/src/streams.rs

@@ -131,6 +131,8 @@ impl Streams {
                 stats.reset_stream += 1;
                 if let (_, Some(rs)) = self.obtain_stream(*stream_id)? {
                     rs.reset(*application_error_code, *final_size)?;
+                } else {
+                    return Err(Error::StreamStateError);
                 }
             }
             Frame::StopSending {
@@ -142,6 +144,8 @@ impl Streams {
                     .send_stream_stop_sending(*stream_id, *application_error_code);
                 if let (Some(ss), _) = self.obtain_stream(*stream_id)? {
                     ss.reset(*application_error_code);
+                } else {
+                    return Err(Error::StreamStateError);
                 }
             }
             Frame::Stream {
@@ -154,6 +158,8 @@ impl Streams {
                 stats.stream += 1;
                 if let (_, Some(rs)) = self.obtain_stream(*stream_id)? {
                     rs.inbound_stream_frame(*fin, *offset, data)?;
+                } else {
+                    return Err(Error::StreamStateError);
                 }
             }
             Frame::MaxData { maximum_data } => {
@@ -172,6 +178,8 @@ impl Streams {
                 stats.max_stream_data += 1;
                 if let (Some(ss), _) = self.obtain_stream(*stream_id)? {
                     ss.set_max_stream_data(*maximum_stream_data);
+                } else {
+                    return Err(Error::StreamStateError);
                 }
             }
             Frame::MaxStreams {
@@ -198,6 +206,8 @@ impl Streams {
 
                 if let (_, Some(rs)) = self.obtain_stream(*stream_id)? {
                     rs.send_flowc_update();
+                } else {
+                    return Err(Error::StreamStateError);
                 }
             }
             Frame::StreamsBlocked { .. } => {