quinn-rs/quinn quinn-proto-0.11.18

quinn-proto 0.11.18, quinn 0.11.12

on GitHub

Three more security issues were reported and fixed since 0.11.17:

• GHSA-465w-v9q3-7j98: a remote peer can panic unordered reads from quinn-proto with five small STREAM frames
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-ppcp-v39w-8jq2: Datagrams::send() double-subtracts payload_bytes on the drop-oldest path, panicking the sender
• https://github.com/quinn-rs/quinn/security/advisories/GHSA-3g6h-r5qx-f6hq: Peer minimum ACK delay can panic when ACK_FREQUENCY transmission is enabled

What's Changed

• 0.11.x: backport the black hole detector fixes by @vcarus in #2799
• 0.11.x: fix payload_bytes double subtraction when evicting outgoing datagrams by @vcarus in #2806
• 0.11.x: Backport #2816 (add min rtt to path stats) by @somtochiama in #2817
• 0.11.x: Bundle ACK in packets with DATAGRAM or STREAM frames by @anatawa12 in #2819
• quinn-proto: drop short packets with unsupported versions (0.11.x) by @vcarus in #2823
• 0.11.x: backport: Avoid re-instantiating debug span in ConnectionDriver::poll by @stormshield-fabs in #2829
• 0.11.x: backport #2814 (proto: coalesce contiguous chunks during defragment) by @Ralith in #2826
• [0.11.x] proto: release the send window when rejecting 0-RTT by @zerox80 in #2843
• [0.11.x] Reject DATAGRAMs larger than the send buffer by @zerox80 in #2844
• 0.11.x: backport #2847 (proto: send DATA_BLOCKED and STREAM_DATA_BLOCKED when blocked by flow control) by @heitzlki in #2852
• [0.11.x] proto: reset pacing state when resetting a path by @zerox80 in #2850
• [0.11.x] proto: avoid duplicate flow-control credit for stopped streams by @zerox80 in #2848
• [0.11.x] proto: prune queued DATAGRAMs after path MTU changes by @zerox80 in #2849
• [0.11.x] proto: preserve the server config for pending incoming connections by @zerox80 in #2865
• [0.11.x] proto: reject transport parameters with a mismatched length by @MaxFreedomPollard in #2866
• [0.11.x] quinn: enforce read_to_end limits for reordered chunks by @zerox80 in #2864
• [0.11.x] streams: bound retained send storage by the send window by @zerox80 in #2863
• Prepare 0.11.18 by @djc in #2867