Fix multiple security vulnerabilities in QPACK/STREAM/FEC/HTTP3 receive paths (#838)

[+] fix vul:42057008 use local qpack_blocked_streams for blocked stream limit per RFC 9204 Section 2.1.2
[+] add test case for vul:42057008 verify blocked stream limit uses local settings
[+] fix vul:42058006 add buffered_frame_count limit to xqc_insert_stream_frame per RFC 9000 Section 21.7, fix counter leak in rm_from_list and reset_stream_frame paths
[+] add test case for vul:42058006 verify stream frame buffered count limit
[~] fix 42059008 refine QPACK prefixed string limit enforcement per RFC 9204 Section 7.4
[+] add test cases for vul:42059008 QPACK prefixed string limit boundary
[+] fix vul:42072005 cap and clamp loss_src_num to XQC_REPAIR_LEN in xqc_fec_bc_decoder to prevent stack buffer overflow and cleanup loop out-of-bounds
[+] add test case for vul:42072005 verify loss_src_num boundary check and cleanup path safety in fec_bc_decoder
[+] fix vul:42073004 cap receive-side SETTINGS/PUSH_PROMISE frame buffer to prevent memory exhaustion
[+] add test case for vul:42073004 verify oversized SETTINGS/PUSH_PROMISE frame is rejected
[~] fix code review issues: add defensive underflow check in xqc_prefixed_str.c, add NULL checks and leak prevention in xqc_ins_encoder_ctx_create and xqc_rep_ctx_create
[~] refactor xqc_test_0rtt_params_each_reduced to avoid TLS state dependency
[~] line-buffer test_server stdout to fix flaky active_cid_limit_exceeded case

XQUIC

GitHub

Introduction

XQUIC Library released by Alibaba is …

… a client and server implementation of QUIC and HTTP/3 as specified by the IETF. Currently supported QUIC versions are v1 and draft-29.

… OS and platform agnostic. It currently supports Android, iOS, HarmonyOS, Linux, macOS and Windows(v1.2.0). Most of the code is used in our own products, and has been tested at scale on android, iOS apps, as well as servers.

… still in active development. Interoperability is regularly tested with other QUIC implementations.

Features

Standardized Features

All big features conforming with RFC 9000, RFC9001, RFC9002, RFC9114 and RFC9204, including the interface between QUIC and TLS, 0-RTT connection establishment, HTTP/3 and QPACK.
ALPN Extension conforming with RFC7301

Supported TLS 1.3 Cipher Suites

XQUIC supports the following TLS 1.3 cipher suites for QUIC packet protection (as defined in RFC 9001 Section 5):

Cipher Suite	AEAD	Header Protection	Status
TLS_AES_128_GCM_SHA256	AEAD_AES_128_GCM	AES-ECB (128-bit)	Supported
TLS_AES_256_GCM_SHA384	AEAD_AES_256_GCM	AES-ECB (256-bit)	Supported
TLS_CHACHA20_POLY1305_SHA256	AEAD_CHACHA20_POLY1305	ChaCha20	Supported
TLS_AES_128_CCM_SHA256	AEAD_AES_128_CCM	—	Not Supported
TLS_AES_128_CCM_8_SHA256	—	—	Not Supported

Note: TLS_AES_128_CCM_SHA256 and TLS_AES_128_CCM_8_SHA256 are not supported. CCM-based cipher suites are optional per RFC 9001 and have significantly lower confidentiality and integrity limits (2^21.5) compared to GCM (2^23 / 2^52) and ChaCha20-Poly1305. TLS_AES_128_CCM_8_SHA256 is further excluded from QUIC usage by RFC 9001 as no header protection scheme is defined for it.

Not Yet Standardized Features

Library Features

Pluggable congestion control: NewReno, Cubic, BBR and BBRv2, …
Pluggable cryptography, integration with BoringSSL and BabaSSL
Cross-platform implementation, support Android, iOS, HarmonyOS, Linux, macOS and Windows(v1.2.0)

Requirements

To build XQUIC, you need

CMake
BoringSSL or BabaSSL

To run test cases, you need

libevent
CUnit

QuickStart Guide

XQUIC can be built with BabaSSL(Tongsuo) or BoringSSL.

Build with BoringSSL

sudo apt-get install -y build-essential libevent-dev

# get XQUIC source code
git clone https://github.com/alibaba/xquic.git; cd xquic

# get and build BoringSSL
git clone https://github.com/google/boringssl.git ./third_party/boringssl; cd ./third_party/boringssl
mkdir -p build && cd build
cmake -DBUILD_SHARED_LIBS=0 -DCMAKE_C_FLAGS="-fPIC" -DCMAKE_CXX_FLAGS="-fPIC" ..
make -j ssl crypto
cd ..
SSL_TYPE_STR="boringssl"
SSL_PATH_STR="${PWD}"
cd ../..

# build XQUIC with BoringSSL
# When build XQUIC with boringssl, by default XQUIC will use boringssl
# in third_party. If boringssl is deployed in other directories, SSL_PATH could be 
# used to specify the search path of boringssl
git submodule update --init --recursive
mkdir -p build; cd build
cmake -DGCOV=on -DCMAKE_BUILD_TYPE=Debug -DXQC_ENABLE_TESTING=1 -DXQC_SUPPORT_SENDMMSG_BUILD=1 -DXQC_ENABLE_EVENT_LOG=1 -DXQC_ENABLE_BBR2=1 -DXQC_ENABLE_RENO=1 -DSSL_TYPE=${SSL_TYPE_STR} -DSSL_PATH=${SSL_PATH_STR} ..

# exit if cmake error
if [ $? -ne 0 ]; then
    echo "cmake failed"
    exit 1
fi

make -j

Build with BabaSSL(Tongsuo)

sudo apt-get install -y build-essential libevent-dev

# get XQUIC source code
git clone https://github.com/alibaba/xquic.git; cd xquic

# get and build BabaSSL(Tongsuo)
git clone -b 8.3-stable https://github.com/Tongsuo-Project/Tongsuo.git ./third_party/babassl; cd ./third_party/babassl/
./config --prefix=/usr/local/babassl
make -j
SSL_TYPE_STR="babassl"
SSL_PATH_STR="${PWD}"
cd -

# build XQUIC with BabaSSL
# When build XQUIC with babassl, /usr/local/babassl directory will be searched
# as default. If babassl is deployed in other directories, SSL_PATH could be 
# used to specify the search path of babassl
git submodule update --init --recursive
mkdir -p build; cd build
cmake -DGCOV=on -DCMAKE_BUILD_TYPE=Debug -DXQC_ENABLE_TESTING=1 -DXQC_SUPPORT_SENDMMSG_BUILD=1 -DXQC_ENABLE_EVENT_LOG=1 -DXQC_ENABLE_BBR2=1 -DXQC_ENABLE_RENO=1 -DSSL_TYPE=${SSL_TYPE_STR} -DSSL_PATH=${SSL_PATH_STR} ..

# exit if cmake error
if [ $? -ne 0 ]; then
    echo "cmake failed"
    exit 1
fi

make -j

Run testcases

sh ../scripts/xquic_test.sh

Documentation

For using the API, see the API docs.
For platform support details, see the Platforms docs.
For Chinese Simplified (zh-CN) translation of the IETF QUIC Protocol, see the Translation docs.
For using quic-qlog, see the Features: qlog
For testing the library, see the Testing docs.
For other frequently asked questions, see the FAQs and Trouble Shooting Guide.

Contributing

We would love for you to contribute to XQUIC and help make it even better than it is today! All types of contributions are encouraged and valued. Thanks to all contributors. See our Contributing Guidelines for more information.

If you have any questions, please feel free to open a new Discussion topic in our discussion forums.

License

XQUIC is released under the Apache 2.0 License.

Contact Us

Feel free to contact us in the following ways:

e-mail: xquic@alibaba-inc.com
Dingtalk group: 34059705
slack channel: #xquic in quicdev group