[~] fix issue #581: reject coalesced packets with mismatched DCID per RFC 9000 12.2

The receive path in xqc_conn_process_packet walks every QUIC packet inside
a single UDP datagram but never compares the Destination Connection ID of
the second-and-later packets against the first one. RFC 9000 Section 12.2
requires receivers to ignore those mismatching follow-up packets while
still processing the rest of the datagram; without that check a peer that
holds more than one valid SCID for the connection can sneak frames in
under a different CID once handshake is past, and during handshake the
long header path skips the connection-level DCID set entirely for INIT
and 0-RTT.

Anchor the datagram on the DCID of its first successfully parsed packet
and drop any subsequent packet whose pi_pkt.pkt_dcid does not match,
emitting a WARN log plus a TRA_PACKET_DROPPED qlog event and bumping
packet_dropped_count. The rest of the datagram keeps flowing.

Coverage: tests/unittest/xqc_coalesced_test.c adds five CUnit cases that
build coalesced Initials with controlled DCIDs and assert single-packet,
match, mismatch, length-mismatch, and A+B+A patterns.

Fixes: #581

Author: Yanmei-Liu

src/transport/xqc_conn.c

@@ -5012,7 +5012,7 @@ xqc_conn_log_recvd_packet(xqc_connection_t *c, xqc_packet_in_t *pi,
 
 xqc_int_t
 xqc_conn_process_packet(xqc_connection_t *c,
-    const unsigned char *packet_in_buf, size_t packet_in_size, 
+    const unsigned char *packet_in_buf, size_t packet_in_size,
     xqc_usec_t recv_time)
 {
     xqc_int_t ret = XQC_OK;
@@ -5022,6 +5022,17 @@ xqc_conn_process_packet(xqc_connection_t *c,
     xqc_packet_in_t packet;
     unsigned char decrypt_payload[XQC_MAX_PACKET_IN_LEN];
 
+    /*
+     * RFC 9000 Section 12.2: every coalesced packet that follows the first
+     * one in a UDP datagram is required to carry the same Destination
+     * Connection ID as the first packet; receivers SHOULD discard any
+     * mismatching subsequent packet but continue to process the rest.
+     * first_dcid only needs to be valid once first_dcid_seen flips to TRUE,
+     * so leaving the rest of the struct uninitialized is intentional.
+     */
+    xqc_cid_t first_dcid;
+    xqc_bool_t first_dcid_seen = XQC_FALSE;
+
     /* process all QUIC packets in UDP datagram */
     while (pos < end) {
         last_pos = pos;
@@ -5039,6 +5050,44 @@ xqc_conn_process_packet(xqc_connection_t *c,
         xqc_conn_log_recvd_packet(c, packet_in, packet_in_size, ret, recv_time);
 
         if (ret == XQC_OK) {
+            /*
+             * Anchor the datagram on the DCID of its first successfully
+             * parsed packet. Subsequent packets must match, otherwise the
+             * peer is either confused or attempting to smuggle traffic
+             * onto another connection's path through coalescing.
+             */
+            if (first_dcid_seen == XQC_FALSE) {
+                xqc_cid_set(&first_dcid, packet_in->pi_pkt.pkt_dcid.cid_buf,
+                            packet_in->pi_pkt.pkt_dcid.cid_len);
+                first_dcid_seen = XQC_TRUE;
+
+            } else if (xqc_cid_is_equal(&first_dcid,
+                                        &packet_in->pi_pkt.pkt_dcid) != XQC_OK)
+            {
+                /*
+                 * Drop only the offending packet, not the whole datagram;
+                 * xqc_dcid_str/xqc_scid_str use distinct engine-side
+                 * scratch buffers, so it is safe to print both CIDs in one
+                 * log statement.
+                 */
+                xqc_log(c->log, XQC_LOG_WARN,
+                        "|coalesced pkt dcid mismatch|first_dcid:%s|pkt_dcid:%s|pkt_type:%s|pkt_num:%ui|",
+                        xqc_dcid_str(c->engine, &first_dcid),
+                        xqc_scid_str(c->engine, &packet_in->pi_pkt.pkt_dcid),
+                        xqc_pkt_type_2_str(packet_in->pi_pkt.pkt_type),
+                        packet_in->pi_pkt.pkt_num);
+
+                c->packet_dropped_count++;
+                xqc_log_event(c->log, TRA_PACKET_DROPPED,
+                              "coalesced pkt dcid mismatch", XQC_OK,
+                              xqc_pkt_type_2_str(packet_in->pi_pkt.pkt_type),
+                              packet_in->pi_pkt.pkt_num);
+
+                pos = packet_in->last;
+                xqc_log_event(c->log, TRA_PACKET_RECEIVED, packet_in);
+                continue;
+            }
+
             ret = xqc_conn_on_pkt_processed(c, packet_in, recv_time);
 
         } else if (xqc_conn_tolerant_error(ret)) {

tests/CMakeLists.txt

@@ -114,6 +114,7 @@ if(HAVE_CUNIT)
         ${UNIT_TEST_DIR}/xqc_h3_ext_test.c
         ${UNIT_TEST_DIR}/xqc_ack_with_timestamp_test.c
         ${UNIT_TEST_DIR}/xqc_send_ctl_test.c
+        ${UNIT_TEST_DIR}/xqc_coalesced_test.c
     )
 
     if(XQC_ENABLE_FEC)

tests/unittest/main.c

@@ -42,6 +42,7 @@
 #include "xqc_fec_test.h"
 #include "xqc_ack_with_timestamp_test.h"
 #include "xqc_send_ctl_test.h"
+#include "xqc_coalesced_test.h"
 
 static int xqc_init_suite(void) { return 0; }
 static int xqc_clean_suite(void) { return 0; }
@@ -126,7 +127,12 @@ main()
                         xqc_test_pto_uses_remote_max_ack_delay)
         || !CU_add_test(pSuite, "xqc_test_pto_remote_default_when_unset",
                         xqc_test_pto_remote_default_when_unset)
-        /* ADD TESTS HERE */) 
+        || !CU_add_test(pSuite, "xqc_test_coalesced_single_pkt", xqc_test_coalesced_single_pkt)
+        || !CU_add_test(pSuite, "xqc_test_coalesced_dcid_match", xqc_test_coalesced_dcid_match)
+        || !CU_add_test(pSuite, "xqc_test_coalesced_dcid_mismatch", xqc_test_coalesced_dcid_mismatch)
+        || !CU_add_test(pSuite, "xqc_test_coalesced_dcid_len_mismatch", xqc_test_coalesced_dcid_len_mismatch)
+        || !CU_add_test(pSuite, "xqc_test_coalesced_dcid_a_b_a", xqc_test_coalesced_dcid_a_b_a)
+        /* ADD TESTS HERE */)
     {
         CU_cleanup_registry();
         return (int)CU_get_error();