Release 2.26.1

- [BUGFIX] Migration corner cases: drop or pad over path challenge
  and response frames when necessary.
- Fix stream unit test.

src/liblsquic/lsquic_full_conn_ietf.c

@@ -728,6 +728,8 @@ path_chal_alarm_expired (enum alarm_id al_id, void *ctx,
     {
         LSQ_INFO("migration to path #%u failed after none of %u path "
             "challenges received responses", path_id, copath->cop_n_chals);
+        /* There may be a lingering challenge if its generation is delayed */
+        lsquic_send_ctl_cancel_chals(&conn->ifc_send_ctl, &copath->cop_path);
         wipe_path(conn, path_id);
     }
     else

src/liblsquic/lsquic_packet_out.c

@@ -527,3 +527,24 @@ lsquic_packet_out_equal_dcids (const struct lsquic_packet_out *a,
     return sizes[0] == sizes[1]
         && 0 == memcmp(dcids[0], dcids[1], sizes[0]);
 }
+
+
+void
+lsquic_packet_out_pad_over (struct lsquic_packet_out *packet_out,
+                                                enum quic_ft_bit frame_types)
+{
+    struct packet_out_frec_iter pofi;
+    struct frame_rec *frec;
+
+    for (frec = lsquic_pofi_first(&pofi, packet_out); frec;
+                                                frec = lsquic_pofi_next(&pofi))
+    {
+        if ((1 << frec->fe_frame_type) & frame_types)
+        {
+            memset(packet_out->po_data + frec->fe_off, 0, frec->fe_len);
+            frec->fe_frame_type = QUIC_FRAME_PADDING;
+        }
+    }
+
+    packet_out->po_frame_types &= ~frame_types;
+}

src/liblsquic/lsquic_packet_out.h

@@ -351,4 +351,9 @@ lsquic_packet_out_turn_on_fin (struct lsquic_packet_out *,
 int
 lsquic_packet_out_equal_dcids (const struct lsquic_packet_out *,
                                const struct lsquic_packet_out *);
+
+void
+lsquic_packet_out_pad_over (struct lsquic_packet_out *packet_out,
+                                                enum quic_ft_bit frame_types);
+
 #endif

src/liblsquic/lsquic_send_ctl.c

@@ -3578,6 +3578,14 @@ lsquic_send_ctl_repath (struct lsquic_send_ctl *ctl,
                 packet_out->po_path = new;
                 if (packet_out->po_flags & PO_ENCRYPTED)
                     send_ctl_return_enc_data(ctl, packet_out);
+                if (packet_out->po_frame_types
+                        & (QUIC_FTBIT_PATH_CHALLENGE|QUIC_FTBIT_PATH_RESPONSE))
+                    /* This is a corner case, we just want to avoid protocol
+                     * violation.  No optimization is done.  If we happen to
+                     * send a packet of padding, oh well.
+                     */
+                    lsquic_packet_out_pad_over(packet_out,
+                            QUIC_FTBIT_PATH_CHALLENGE|QUIC_FTBIT_PATH_RESPONSE);
             }
 
     LSQ_DEBUG("repathed %u packet%.*s", count, count != 1, "s");
@@ -3594,6 +3602,32 @@ lsquic_send_ctl_repath (struct lsquic_send_ctl *ctl,
 }
 
 
+/* Drop PATH_CHALLENGE packets for path `path'. */
+void
+lsquic_send_ctl_cancel_chals (struct lsquic_send_ctl *ctl,
+                                            const struct network_path *path)
+{
+    struct lsquic_packet_out *packet_out, *next;
+
+    /* We need only to examine the scheduled queue as lost challenges are
+     * not retransmitted.
+     */
+    for (packet_out = TAILQ_FIRST(&ctl->sc_scheduled_packets); packet_out;
+                                                            packet_out = next)
+    {
+        next = TAILQ_NEXT(packet_out, po_next);
+        if (packet_out->po_path == path
+                && packet_out->po_frame_types == QUIC_FTBIT_PATH_CHALLENGE)
+        {
+            send_ctl_maybe_renumber_sched_to_right(ctl, packet_out);
+            send_ctl_sched_remove(ctl, packet_out);
+            assert(packet_out->po_loss_chain == packet_out);
+            send_ctl_destroy_packet(ctl, packet_out);
+        }
+    }
+}
+
+
 /* Examine packets in scheduled and buffered queues and resize packets if
  * they exceed path MTU.
  */

src/liblsquic/lsquic_send_ctl.h

@@ -386,6 +386,10 @@ lsquic_send_ctl_repath (struct lsquic_send_ctl *ctl,
     const struct network_path *old, const struct network_path *new,
     int keep_path_properties);
 
+void
+lsquic_send_ctl_cancel_chals (struct lsquic_send_ctl *,
+                                                const struct network_path *);
+
 void
 lsquic_send_ctl_resize (struct lsquic_send_ctl *);