Allow sending NEW_TOKEN frames before TLS NewSessionTickets

[John-Athan]

This issue was originally opened in the quic-go repository.

Currently, it is not possible to make use of QUIC's address validation tokens if the server sends the NEW_TOKEN frame before sending the crypto frame containing the TLS NewSessionTicket. The address validation token gets stored, then thrown away.

It currently works as follows:

• Upon arrival of a NEW_TOKEN frame, the token gets stored alongside its associated server ID (i.e. a combination of host and port) inside a cache that holds TLS sessions.
• When a new session ticket arrives, the session gets added to the cache entry for the associated server
• This new session does not specify the same QUIC transport parameters and is therefore assumed to be related to another, more recent session. The old cache entry (containing the token) gets removed and a new entry without the token is inserted.

Is the described behavior on purpose or is it a bug?
AFAIK, a client should be able to use tokens independent of the TLS session ticket.

If this is a bug, maybe it would make sense to copy an existing address validation token from the existing cache entry into the new cache entry for the same server ID before deleting the existing cache entry. Let me know if I should contribute this solution to the QUICHE project if the solution is fine.

[yangfanud]

Thank you very much for the details. Yes, this is a bug. A client should correctly handle the case where tokens arrive before session tickets. Because tokens are one-time use, as you said, copying existing tokens from old entry to new entry is definitely the right thing to do. In addition, the fix should also handle cases where token arrives and there is no entry (either because this is new session or old session only contains one ticket and has been used for resumption). If you can write the patch, we are more than happy to review it (and patch it in). Please follow https://github.com/google/quiche/blob/main/CONTRIBUTING.md

Again, thank you very much for the great catch!