quic: don't allow combining appTicketData with Http3Session

Author: pimterry

lib/internal/quic/quic.js

@@ -4574,6 +4574,11 @@ function processSessionOptions(options, config = kEmptyObject) {
       throw new ERR_INVALID_ARG_TYPE('options.appTicketData',
                                      ['ArrayBufferView'], appTicketData);
     }
+    if (application !== undefined) {
+      throw new ERR_INVALID_ARG_VALUE(
+        'options.appTicketData', appTicketData,
+        'cannot be combined with a session application');
+    }
   }
 
   if (cc !== undefined) {

src/quic/http3.cc

@@ -1829,7 +1829,9 @@ void CreateHttp3Handle(const FunctionCallbackInfo<Value>& args) {
           "becomes active (begins emitting events)");
       return;
     }
-    session->SetApplication(CreateHttp3Application(session));
+    if (!session->AttachApplication(CreateHttp3Application(session))) {
+      return;
+    }
 
     if (session->is_server() && !session->application().Start()) {
       // Start() failed (e.g. the peer's initial_max_streams_uni is < 3), so

src/quic/session.cc

@@ -2864,6 +2864,17 @@ std::unique_ptr<Session::Application> Session::SelectApplication() {
   return factory->create(this);
 }
 
+bool Session::AttachApplication(std::unique_ptr<Application> app) {
+  if (config().options.app_ticket_data.has_value()) {
+    THROW_ERR_INVALID_STATE(
+        env(),
+        "A QUIC application cannot be combined with appTicketData");
+    return false;
+  }
+  SetApplication(std::move(app));
+  return true;
+}
+
 void Session::SetApplication(std::unique_ptr<Application> app) {
   DCHECK(!impl_->application_);
   DCHECK(app);

src/quic/session.h

@@ -90,11 +90,14 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
   // path and no Application is ever installed.
   std::unique_ptr<Application> SelectApplication();
 
-  // Install the Application on the session. Called at construction for
-  // clients or from OnSelectAlpn for servers (later in the handshake,
-  // after session-ticket decryption). Must be called before any
-  // application data is received.
+  // Installs the Application on the session WITHOUT validation. Called at
+  // construction for clients or from OnSelectAlpn for servers (later in the
+  // handshake, after session-ticket decryption).
   void SetApplication(std::unique_ptr<Application> app);
+
+  // Validating wrapper around SetApplication() for dynamic attachment of an
+  // application to a live session.
+  bool AttachApplication(std::unique_ptr<Application> app);
   // Controls which datagram to drop when the pending datagram queue is full.
   enum class DatagramDropPolicy : uint8_t {
     DROP_OLDEST = 0,  // Drop the oldest queued datagram (default).