connection: validate QUIC response before hijacking

connection/quic_connection.go

@@ -334,6 +334,9 @@ func (hrw *httpResponseAdapter) WriteHeader(status int) {
 }
 
 func (hrw *httpResponseAdapter) Hijack() (net.Conn, *bufio.ReadWriter, error) {
+	if !hrw.connectResponseSent {
+		return nil, nil, fmt.Errorf("status not yet written before attempting to hijack connection")
+	}
 	conn := &localProxyConnection{hrw.ReadWriteCloser}
 	readWriter := bufio.NewReadWriter(
 		bufio.NewReader(hrw.ReadWriteCloser),
@@ -476,4 +479,4 @@ func (np *nopCloserReadWriter) Close() error {
 	// Closing only the receive side satisfies that contract without preventing
 	// the response from being written on this bidirectional QUIC stream.
 	return np.CloseRead()
-}
+}

connection/quic_response_writer_test.go

@@ -0,0 +1,42 @@
+package connection
+
+import (
+	"net"
+	"testing"
+
+	rpcquic "github.com/cloudflare/cloudflared/tunnelrpc/quic"
+	"github.com/stretchr/testify/require"
+)
+
+func TestHTTPResponseAdapterHijackRequiresResponse(t *testing.T) {
+	t.Parallel()
+
+	stream, peer := net.Pipe()
+	defer stream.Close()
+	defer peer.Close()
+	adapter := httpResponseAdapter{
+		RequestServerStream: &rpcquic.RequestServerStream{ReadWriteCloser: stream},
+	}
+	conn, readWriter, err := adapter.Hijack()
+
+	require.Nil(t, conn)
+	require.Nil(t, readWriter)
+	require.EqualError(t, err, "status not yet written before attempting to hijack connection")
+}
+
+func TestHTTPResponseAdapterHijackAfterResponse(t *testing.T) {
+	t.Parallel()
+
+	stream, peer := net.Pipe()
+	defer stream.Close()
+	defer peer.Close()
+	adapter := httpResponseAdapter{
+		RequestServerStream: &rpcquic.RequestServerStream{ReadWriteCloser: stream},
+		connectResponseSent: true,
+	}
+	conn, readWriter, err := adapter.Hijack()
+
+	require.NoError(t, err)
+	require.NotNil(t, conn)
+	require.NotNil(t, readWriter)
+}