gfe-relnote: In QUIC, validate packet number post decryption. Protected by quic_validate_packet_number_post_decryption.

PiperOrigin-RevId: 238908380
Change-Id: I4cd204b4e050427f19a7671bad65443a29305a83

quic/core/quic_connection.cc

diff --git a/quic/core/quic_connection.cc b/quic/core/quic_connection.cc
index cf72fec..ffc4093 100644
--- a/quic/core/quic_connection.cc
+++ b/quic/core/quic_connection.cc
@@ -339,7 +339,9 @@
       no_version_negotiation_(supported_versions.size() == 1),
       fix_termination_packets_(
           GetQuicReloadableFlag(quic_fix_termination_packets)),
-      send_ack_when_on_can_write_(false) {
+      send_ack_when_on_can_write_(false),
+      validate_packet_number_post_decryption_(
+          GetQuicReloadableFlag(quic_validate_packet_number_post_decryption)) {
   if (ack_mode_ == ACK_DECIMATION) {
     QUIC_RELOADABLE_FLAG_COUNT(quic_enable_ack_decimation);
   }
@@ -353,6 +355,9 @@
   if (received_packet_manager_.decide_when_to_send_acks()) {
     QUIC_RELOADABLE_FLAG_COUNT(quic_rpm_decides_when_to_send_acks);
   }
+  if (validate_packet_number_post_decryption_) {
+    QUIC_RELOADABLE_FLAG_COUNT(quic_validate_packet_number_post_decryption);
+  }
   QUIC_DLOG(INFO) << ENDPOINT
                   << "Created connection with connection_id: " << connection_id
                   << " and version: "
@@ -758,7 +763,8 @@
 
   // If this packet has already been seen, or the sender has told us that it
   // will not be retransmitted, then stop processing the packet.
-  if (!received_packet_manager_.IsAwaitingPacket(header.packet_number)) {
+  if (!validate_packet_number_post_decryption_ &&
+      !received_packet_manager_.IsAwaitingPacket(header.packet_number)) {
     if (framer_.IsIetfStatelessResetPacket(header)) {
       QuicIetfStatelessResetPacket packet(
           header, header.possible_stateless_reset_token);
@@ -1977,6 +1983,16 @@
 
 bool QuicConnection::ValidateReceivedPacketNumber(
     QuicPacketNumber packet_number) {
+  if (validate_packet_number_post_decryption_ &&
+      !received_packet_manager_.IsAwaitingPacket(packet_number)) {
+    QUIC_DLOG(INFO) << ENDPOINT << "Packet " << packet_number
+                    << " no longer being waited for.  Discarding.";
+    if (debug_visitor_ != nullptr) {
+      debug_visitor_->OnDuplicatePacket(packet_number);
+    }
+    return false;
+  }
+
   if (GetQuicRestartFlag(quic_enable_accept_random_ipn)) {
     QUIC_RESTART_FLAG_COUNT_N(quic_enable_accept_random_ipn, 2, 2);
     // Configured to accept any packet number in range 1...0x7fffffff as initial

quic/core/quic_connection.h

diff --git a/quic/core/quic_connection.h b/quic/core/quic_connection.h
index 961385c..b40e5c6 100644
--- a/quic/core/quic_connection.h
+++ b/quic/core/quic_connection.h
@@ -1457,6 +1457,9 @@
   // packet manager, and an ACK timeout would be used to record when an ACK
   // needs to be sent.
   bool send_ack_when_on_can_write_;
+
+  // Latched value of quic_validate_packet_number_post_decryption.
+  const bool validate_packet_number_post_decryption_;
 };
 
 }  // namespace quic