xref: /openssl/ssl/quic/quic_channel.c (revision b6461792)
1 /*
2  * Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <openssl/rand.h>
11 #include <openssl/err.h>
12 #include "internal/quic_channel.h"
13 #include "internal/quic_error.h"
14 #include "internal/quic_rx_depack.h"
15 #include "internal/quic_lcidm.h"
16 #include "internal/quic_srtm.h"
17 #include "internal/qlog_event_helpers.h"
18 #include "../ssl_local.h"
19 #include "quic_channel_local.h"
20 #include "quic_port_local.h"
21 #include "quic_engine_local.h"
22 
23 /*
24  * NOTE: While this channel implementation currently has basic server support,
25  * this functionality has been implemented for internal testing purposes and is
26  * not suitable for network use. In particular, it does not implement address
27  * validation, anti-amplification or retry logic.
28  *
29  * TODO(QUIC SERVER): Implement address validation and anti-amplification
30  * TODO(QUIC SERVER): Implement retry logic
31  */
32 
33 #define INIT_CRYPTO_RECV_BUF_LEN    16384
34 #define INIT_CRYPTO_SEND_BUF_LEN    16384
35 #define INIT_APP_BUF_LEN             8192
36 
37 /*
38  * Interval before we force a PING to ensure NATs don't timeout. This is based
39  * on the lowest commonly seen value of 30 seconds as cited in RFC 9000 s.
40  * 10.1.2.
41  */
42 #define MAX_NAT_INTERVAL (ossl_ms2time(25000))
43 
44 /*
45  * Our maximum ACK delay on the TX side. This is up to us to choose. Note that
46  * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol
47  * value which determines the value of the maximum ACK delay if the
48  * max_ack_delay transport parameter is not set.
49  */
50 #define DEFAULT_MAX_ACK_DELAY   QUIC_DEFAULT_MAX_ACK_DELAY
51 
52 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
53 
54 static void ch_save_err_state(QUIC_CHANNEL *ch);
55 static int ch_rx(QUIC_CHANNEL *ch, int channel_only);
56 static int ch_tx(QUIC_CHANNEL *ch);
57 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only);
58 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only);
59 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch);
60 static int ch_retry(QUIC_CHANNEL *ch,
61                     const unsigned char *retry_token,
62                     size_t retry_token_len,
63                     const QUIC_CONN_ID *retry_scid);
64 static void ch_cleanup(QUIC_CHANNEL *ch);
65 static int ch_generate_transport_params(QUIC_CHANNEL *ch);
66 static int ch_on_transport_params(const unsigned char *params,
67                                   size_t params_len,
68                                   void *arg);
69 static int ch_on_handshake_alert(void *arg, unsigned char alert_code);
70 static int ch_on_handshake_complete(void *arg);
71 static int ch_on_handshake_yield_secret(uint32_t enc_level, int direction,
72                                         uint32_t suite_id, EVP_MD *md,
73                                         const unsigned char *secret,
74                                         size_t secret_len,
75                                         void *arg);
76 static int ch_on_crypto_recv_record(const unsigned char **buf,
77                                     size_t *bytes_read, void *arg);
78 static int ch_on_crypto_release_record(size_t bytes_read, void *arg);
79 static int crypto_ensure_empty(QUIC_RSTREAM *rstream);
80 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len,
81                              size_t *consumed, void *arg);
82 static OSSL_TIME get_time(void *arg);
83 static uint64_t get_stream_limit(int uni, void *arg);
84 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg);
85 static void rxku_detected(QUIC_PN pn, void *arg);
86 static int ch_retry(QUIC_CHANNEL *ch,
87                     const unsigned char *retry_token,
88                     size_t retry_token_len,
89                     const QUIC_CONN_ID *retry_scid);
90 static void ch_update_idle(QUIC_CHANNEL *ch);
91 static int ch_discard_el(QUIC_CHANNEL *ch,
92                          uint32_t enc_level);
93 static void ch_on_idle_timeout(QUIC_CHANNEL *ch);
94 static void ch_update_idle(QUIC_CHANNEL *ch);
95 static void ch_update_ping_deadline(QUIC_CHANNEL *ch);
96 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch);
97 static void ch_start_terminating(QUIC_CHANNEL *ch,
98                                  const QUIC_TERMINATE_CAUSE *tcause,
99                                  int force_immediate);
100 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
101                              void *arg);
102 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt);
103 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch);
104 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state);
105 
106 DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM);
107 
108 QUIC_NEEDS_LOCK
ch_get_qlog(QUIC_CHANNEL * ch)109 static QLOG *ch_get_qlog(QUIC_CHANNEL *ch)
110 {
111 #ifndef OPENSSL_NO_QLOG
112     QLOG_TRACE_INFO qti = {0};
113 
114     if (ch->qlog != NULL)
115         return ch->qlog;
116 
117     if (!ch->use_qlog)
118         return NULL;
119 
120     if (ch->is_server && ch->init_dcid.id_len == 0)
121         return NULL;
122 
123     qti.odcid       = ch->init_dcid;
124     qti.title       = ch->qlog_title;
125     qti.description = NULL;
126     qti.group_id    = NULL;
127     qti.is_server   = ch->is_server;
128     qti.now_cb      = get_time;
129     qti.now_cb_arg  = ch;
130     if ((ch->qlog = ossl_qlog_new_from_env(&qti)) == NULL) {
131         ch->use_qlog = 0; /* don't try again */
132         return NULL;
133     }
134 
135     return ch->qlog;
136 #else
137     return NULL;
138 #endif
139 }
140 
141 QUIC_NEEDS_LOCK
ch_get_qlog_cb(void * arg)142 static QLOG *ch_get_qlog_cb(void *arg)
143 {
144     QUIC_CHANNEL *ch = arg;
145 
146     return ch_get_qlog(ch);
147 }
148 
149 /*
150  * QUIC Channel Initialization and Teardown
151  * ========================================
152  */
153 #define DEFAULT_INIT_CONN_RXFC_WND      (768 * 1024)
154 #define DEFAULT_CONN_RXFC_MAX_WND_MUL   20
155 
156 #define DEFAULT_INIT_STREAM_RXFC_WND    (512 * 1024)
157 #define DEFAULT_STREAM_RXFC_MAX_WND_MUL 12
158 
159 #define DEFAULT_INIT_CONN_MAX_STREAMS           100
160 
ch_init(QUIC_CHANNEL * ch)161 static int ch_init(QUIC_CHANNEL *ch)
162 {
163     OSSL_QUIC_TX_PACKETISER_ARGS txp_args = {0};
164     OSSL_QTX_ARGS qtx_args = {0};
165     OSSL_QRX_ARGS qrx_args = {0};
166     QUIC_TLS_ARGS tls_args = {0};
167     uint32_t pn_space;
168     size_t rx_short_dcid_len;
169     size_t tx_init_dcid_len;
170 
171     if (ch->port == NULL || ch->lcidm == NULL || ch->srtm == NULL)
172         goto err;
173 
174     rx_short_dcid_len = ossl_quic_port_get_rx_short_dcid_len(ch->port);
175     tx_init_dcid_len = ossl_quic_port_get_tx_init_dcid_len(ch->port);
176 
177     /* For clients, generate our initial DCID. */
178     if (!ch->is_server
179         && !ossl_quic_gen_rand_conn_id(ch->port->engine->libctx, tx_init_dcid_len,
180                                        &ch->init_dcid))
181         goto err;
182 
183     /* We plug in a network write BIO to the QTX later when we get one. */
184     qtx_args.libctx             = ch->port->engine->libctx;
185     qtx_args.get_qlog_cb        = ch_get_qlog_cb;
186     qtx_args.get_qlog_cb_arg    = ch;
187     qtx_args.mdpl               = QUIC_MIN_INITIAL_DGRAM_LEN;
188     ch->rx_max_udp_payload_size = qtx_args.mdpl;
189 
190     ch->ping_deadline = ossl_time_infinite();
191 
192     ch->qtx = ossl_qtx_new(&qtx_args);
193     if (ch->qtx == NULL)
194         goto err;
195 
196     ch->txpim = ossl_quic_txpim_new();
197     if (ch->txpim == NULL)
198         goto err;
199 
200     ch->cfq = ossl_quic_cfq_new();
201     if (ch->cfq == NULL)
202         goto err;
203 
204     if (!ossl_quic_txfc_init(&ch->conn_txfc, NULL))
205         goto err;
206 
207     /*
208      * Note: The TP we transmit governs what the peer can transmit and thus
209      * applies to the RXFC.
210      */
211     ch->tx_init_max_stream_data_bidi_local  = DEFAULT_INIT_STREAM_RXFC_WND;
212     ch->tx_init_max_stream_data_bidi_remote = DEFAULT_INIT_STREAM_RXFC_WND;
213     ch->tx_init_max_stream_data_uni         = DEFAULT_INIT_STREAM_RXFC_WND;
214 
215     if (!ossl_quic_rxfc_init(&ch->conn_rxfc, NULL,
216                              DEFAULT_INIT_CONN_RXFC_WND,
217                              DEFAULT_CONN_RXFC_MAX_WND_MUL *
218                              DEFAULT_INIT_CONN_RXFC_WND,
219                              get_time, ch))
220         goto err;
221 
222     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
223         if (!ossl_quic_rxfc_init_standalone(&ch->crypto_rxfc[pn_space],
224                                             INIT_CRYPTO_RECV_BUF_LEN,
225                                             get_time, ch))
226             goto err;
227 
228     if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_bidi_rxfc,
229                                         DEFAULT_INIT_CONN_MAX_STREAMS,
230                                         get_time, ch))
231         goto err;
232 
233     if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_uni_rxfc,
234                                         DEFAULT_INIT_CONN_MAX_STREAMS,
235                                         get_time, ch))
236         goto err;
237 
238     if (!ossl_statm_init(&ch->statm))
239         goto err;
240 
241     ch->have_statm = 1;
242     ch->cc_method = &ossl_cc_newreno_method;
243     if ((ch->cc_data = ch->cc_method->new(get_time, ch)) == NULL)
244         goto err;
245 
246     if ((ch->ackm = ossl_ackm_new(get_time, ch, &ch->statm,
247                                   ch->cc_method, ch->cc_data)) == NULL)
248         goto err;
249 
250     if (!ossl_quic_stream_map_init(&ch->qsm, get_stream_limit, ch,
251                                    &ch->max_streams_bidi_rxfc,
252                                    &ch->max_streams_uni_rxfc,
253                                    ch->is_server))
254         goto err;
255 
256     ch->have_qsm = 1;
257 
258     if (!ch->is_server
259         && !ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &txp_args.cur_scid))
260         goto err;
261 
262     /* We use a zero-length SCID. */
263     txp_args.cur_dcid               = ch->init_dcid;
264     txp_args.ack_delay_exponent     = 3;
265     txp_args.qtx                    = ch->qtx;
266     txp_args.txpim                  = ch->txpim;
267     txp_args.cfq                    = ch->cfq;
268     txp_args.ackm                   = ch->ackm;
269     txp_args.qsm                    = &ch->qsm;
270     txp_args.conn_txfc              = &ch->conn_txfc;
271     txp_args.conn_rxfc              = &ch->conn_rxfc;
272     txp_args.max_streams_bidi_rxfc  = &ch->max_streams_bidi_rxfc;
273     txp_args.max_streams_uni_rxfc   = &ch->max_streams_uni_rxfc;
274     txp_args.cc_method              = ch->cc_method;
275     txp_args.cc_data                = ch->cc_data;
276     txp_args.now                    = get_time;
277     txp_args.now_arg                = ch;
278     txp_args.get_qlog_cb            = ch_get_qlog_cb;
279     txp_args.get_qlog_cb_arg        = ch;
280 
281     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
282         ch->crypto_send[pn_space] = ossl_quic_sstream_new(INIT_CRYPTO_SEND_BUF_LEN);
283         if (ch->crypto_send[pn_space] == NULL)
284             goto err;
285 
286         txp_args.crypto[pn_space] = ch->crypto_send[pn_space];
287     }
288 
289     ch->txp = ossl_quic_tx_packetiser_new(&txp_args);
290     if (ch->txp == NULL)
291         goto err;
292 
293     ossl_quic_tx_packetiser_set_ack_tx_cb(ch->txp, ch_on_txp_ack_tx, ch);
294 
295     qrx_args.libctx             = ch->port->engine->libctx;
296     qrx_args.demux              = ch->port->demux;
297     qrx_args.short_conn_id_len  = rx_short_dcid_len;
298     qrx_args.max_deferred       = 32;
299 
300     if ((ch->qrx = ossl_qrx_new(&qrx_args)) == NULL)
301         goto err;
302 
303     if (!ossl_qrx_set_late_validation_cb(ch->qrx,
304                                          rx_late_validate,
305                                          ch))
306         goto err;
307 
308     if (!ossl_qrx_set_key_update_cb(ch->qrx,
309                                     rxku_detected,
310                                     ch))
311         goto err;
312 
313     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
314         ch->crypto_recv[pn_space] = ossl_quic_rstream_new(NULL, NULL, 0);
315         if (ch->crypto_recv[pn_space] == NULL)
316             goto err;
317     }
318 
319     /* Plug in the TLS handshake layer. */
320     tls_args.s                          = ch->tls;
321     tls_args.crypto_send_cb             = ch_on_crypto_send;
322     tls_args.crypto_send_cb_arg         = ch;
323     tls_args.crypto_recv_rcd_cb         = ch_on_crypto_recv_record;
324     tls_args.crypto_recv_rcd_cb_arg     = ch;
325     tls_args.crypto_release_rcd_cb      = ch_on_crypto_release_record;
326     tls_args.crypto_release_rcd_cb_arg  = ch;
327     tls_args.yield_secret_cb            = ch_on_handshake_yield_secret;
328     tls_args.yield_secret_cb_arg        = ch;
329     tls_args.got_transport_params_cb    = ch_on_transport_params;
330     tls_args.got_transport_params_cb_arg= ch;
331     tls_args.handshake_complete_cb      = ch_on_handshake_complete;
332     tls_args.handshake_complete_cb_arg  = ch;
333     tls_args.alert_cb                   = ch_on_handshake_alert;
334     tls_args.alert_cb_arg               = ch;
335     tls_args.is_server                  = ch->is_server;
336 
337     if ((ch->qtls = ossl_quic_tls_new(&tls_args)) == NULL)
338         goto err;
339 
340     ch->tx_max_ack_delay        = DEFAULT_MAX_ACK_DELAY;
341     ch->rx_max_ack_delay        = QUIC_DEFAULT_MAX_ACK_DELAY;
342     ch->rx_ack_delay_exp        = QUIC_DEFAULT_ACK_DELAY_EXP;
343     ch->rx_active_conn_id_limit = QUIC_MIN_ACTIVE_CONN_ID_LIMIT;
344     ch->tx_enc_level            = QUIC_ENC_LEVEL_INITIAL;
345     ch->rx_enc_level            = QUIC_ENC_LEVEL_INITIAL;
346     ch->txku_threshold_override = UINT64_MAX;
347 
348     ch->max_idle_timeout_local_req  = QUIC_DEFAULT_IDLE_TIMEOUT;
349     ch->max_idle_timeout_remote_req = 0;
350     ch->max_idle_timeout            = ch->max_idle_timeout_local_req;
351 
352     ossl_ackm_set_tx_max_ack_delay(ch->ackm, ossl_ms2time(ch->tx_max_ack_delay));
353     ossl_ackm_set_rx_max_ack_delay(ch->ackm, ossl_ms2time(ch->rx_max_ack_delay));
354 
355     ch_update_idle(ch);
356     ossl_list_ch_insert_tail(&ch->port->channel_list, ch);
357     ch->on_port_list = 1;
358     return 1;
359 
360 err:
361     ch_cleanup(ch);
362     return 0;
363 }
364 
ch_cleanup(QUIC_CHANNEL * ch)365 static void ch_cleanup(QUIC_CHANNEL *ch)
366 {
367     uint32_t pn_space;
368 
369     if (ch->ackm != NULL)
370         for (pn_space = QUIC_PN_SPACE_INITIAL;
371              pn_space < QUIC_PN_SPACE_NUM;
372              ++pn_space)
373             ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
374 
375     ossl_quic_lcidm_cull(ch->lcidm, ch);
376     ossl_quic_srtm_cull(ch->srtm, ch);
377     ossl_quic_tx_packetiser_free(ch->txp);
378     ossl_quic_txpim_free(ch->txpim);
379     ossl_quic_cfq_free(ch->cfq);
380     ossl_qtx_free(ch->qtx);
381     if (ch->cc_data != NULL)
382         ch->cc_method->free(ch->cc_data);
383     if (ch->have_statm)
384         ossl_statm_destroy(&ch->statm);
385     ossl_ackm_free(ch->ackm);
386 
387     if (ch->have_qsm)
388         ossl_quic_stream_map_cleanup(&ch->qsm);
389 
390     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
391         ossl_quic_sstream_free(ch->crypto_send[pn_space]);
392         ossl_quic_rstream_free(ch->crypto_recv[pn_space]);
393     }
394 
395     ossl_qrx_pkt_release(ch->qrx_pkt);
396     ch->qrx_pkt = NULL;
397 
398     ossl_quic_tls_free(ch->qtls);
399     ossl_qrx_free(ch->qrx);
400     OPENSSL_free(ch->local_transport_params);
401     OPENSSL_free((char *)ch->terminate_cause.reason);
402     OSSL_ERR_STATE_free(ch->err_state);
403     OPENSSL_free(ch->ack_range_scratch);
404 
405     if (ch->on_port_list) {
406         ossl_list_ch_remove(&ch->port->channel_list, ch);
407         ch->on_port_list = 0;
408     }
409 
410 #ifndef OPENSSL_NO_QLOG
411     if (ch->qlog != NULL)
412         ossl_qlog_flush(ch->qlog); /* best effort */
413 
414     OPENSSL_free(ch->qlog_title);
415     ossl_qlog_free(ch->qlog);
416 #endif
417 }
418 
ossl_quic_channel_new(const QUIC_CHANNEL_ARGS * args)419 QUIC_CHANNEL *ossl_quic_channel_new(const QUIC_CHANNEL_ARGS *args)
420 {
421     QUIC_CHANNEL *ch = NULL;
422 
423     if ((ch = OPENSSL_zalloc(sizeof(*ch))) == NULL)
424         return NULL;
425 
426     ch->port        = args->port;
427     ch->is_server   = args->is_server;
428     ch->tls         = args->tls;
429     ch->lcidm       = args->lcidm;
430     ch->srtm        = args->srtm;
431 #ifndef OPENSSL_NO_QLOG
432     ch->use_qlog    = args->use_qlog;
433 
434     if (ch->use_qlog && args->qlog_title != NULL) {
435         if ((ch->qlog_title = OPENSSL_strdup(args->qlog_title)) == NULL) {
436             OPENSSL_free(ch);
437             return NULL;
438         }
439     }
440 #endif
441 
442     if (!ch_init(ch)) {
443         OPENSSL_free(ch);
444         return NULL;
445     }
446 
447     return ch;
448 }
449 
ossl_quic_channel_free(QUIC_CHANNEL * ch)450 void ossl_quic_channel_free(QUIC_CHANNEL *ch)
451 {
452     if (ch == NULL)
453         return;
454 
455     ch_cleanup(ch);
456     OPENSSL_free(ch);
457 }
458 
459 /* Set mutator callbacks for test framework support */
ossl_quic_channel_set_mutator(QUIC_CHANNEL * ch,ossl_mutate_packet_cb mutatecb,ossl_finish_mutate_cb finishmutatecb,void * mutatearg)460 int ossl_quic_channel_set_mutator(QUIC_CHANNEL *ch,
461                                   ossl_mutate_packet_cb mutatecb,
462                                   ossl_finish_mutate_cb finishmutatecb,
463                                   void *mutatearg)
464 {
465     if (ch->qtx == NULL)
466         return 0;
467 
468     ossl_qtx_set_mutator(ch->qtx, mutatecb, finishmutatecb, mutatearg);
469     return 1;
470 }
471 
ossl_quic_channel_get_peer_addr(QUIC_CHANNEL * ch,BIO_ADDR * peer_addr)472 int ossl_quic_channel_get_peer_addr(QUIC_CHANNEL *ch, BIO_ADDR *peer_addr)
473 {
474     if (!ch->addressed_mode)
475         return 0;
476 
477     *peer_addr = ch->cur_peer_addr;
478     return 1;
479 }
480 
ossl_quic_channel_set_peer_addr(QUIC_CHANNEL * ch,const BIO_ADDR * peer_addr)481 int ossl_quic_channel_set_peer_addr(QUIC_CHANNEL *ch, const BIO_ADDR *peer_addr)
482 {
483     if (ch->state != QUIC_CHANNEL_STATE_IDLE)
484         return 0;
485 
486     if (peer_addr == NULL || BIO_ADDR_family(peer_addr) == AF_UNSPEC) {
487         BIO_ADDR_clear(&ch->cur_peer_addr);
488         ch->addressed_mode = 0;
489         return 1;
490     }
491 
492     ch->cur_peer_addr   = *peer_addr;
493     ch->addressed_mode  = 1;
494     return 1;
495 }
496 
ossl_quic_channel_get_reactor(QUIC_CHANNEL * ch)497 QUIC_REACTOR *ossl_quic_channel_get_reactor(QUIC_CHANNEL *ch)
498 {
499     return ossl_quic_port_get0_reactor(ch->port);
500 }
501 
ossl_quic_channel_get_qsm(QUIC_CHANNEL * ch)502 QUIC_STREAM_MAP *ossl_quic_channel_get_qsm(QUIC_CHANNEL *ch)
503 {
504     return &ch->qsm;
505 }
506 
ossl_quic_channel_get_statm(QUIC_CHANNEL * ch)507 OSSL_STATM *ossl_quic_channel_get_statm(QUIC_CHANNEL *ch)
508 {
509     return &ch->statm;
510 }
511 
ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL * ch,uint64_t stream_id)512 QUIC_STREAM *ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL *ch,
513                                                 uint64_t stream_id)
514 {
515     return ossl_quic_stream_map_get_by_id(&ch->qsm, stream_id);
516 }
517 
ossl_quic_channel_is_active(const QUIC_CHANNEL * ch)518 int ossl_quic_channel_is_active(const QUIC_CHANNEL *ch)
519 {
520     return ch != NULL && ch->state == QUIC_CHANNEL_STATE_ACTIVE;
521 }
522 
ossl_quic_channel_is_closing(const QUIC_CHANNEL * ch)523 int ossl_quic_channel_is_closing(const QUIC_CHANNEL *ch)
524 {
525     return ch->state == QUIC_CHANNEL_STATE_TERMINATING_CLOSING;
526 }
527 
ossl_quic_channel_is_draining(const QUIC_CHANNEL * ch)528 static int ossl_quic_channel_is_draining(const QUIC_CHANNEL *ch)
529 {
530     return ch->state == QUIC_CHANNEL_STATE_TERMINATING_DRAINING;
531 }
532 
ossl_quic_channel_is_terminating(const QUIC_CHANNEL * ch)533 static int ossl_quic_channel_is_terminating(const QUIC_CHANNEL *ch)
534 {
535     return ossl_quic_channel_is_closing(ch)
536         || ossl_quic_channel_is_draining(ch);
537 }
538 
ossl_quic_channel_is_terminated(const QUIC_CHANNEL * ch)539 int ossl_quic_channel_is_terminated(const QUIC_CHANNEL *ch)
540 {
541     return ch->state == QUIC_CHANNEL_STATE_TERMINATED;
542 }
543 
ossl_quic_channel_is_term_any(const QUIC_CHANNEL * ch)544 int ossl_quic_channel_is_term_any(const QUIC_CHANNEL *ch)
545 {
546     return ossl_quic_channel_is_terminating(ch)
547         || ossl_quic_channel_is_terminated(ch);
548 }
549 
550 const QUIC_TERMINATE_CAUSE *
ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL * ch)551 ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL *ch)
552 {
553     return ossl_quic_channel_is_term_any(ch) ? &ch->terminate_cause : NULL;
554 }
555 
ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL * ch)556 int ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL *ch)
557 {
558     return ch->handshake_complete;
559 }
560 
ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL * ch)561 int ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL *ch)
562 {
563     return ch->handshake_confirmed;
564 }
565 
ossl_quic_channel_get0_demux(QUIC_CHANNEL * ch)566 QUIC_DEMUX *ossl_quic_channel_get0_demux(QUIC_CHANNEL *ch)
567 {
568     return ch->port->demux;
569 }
570 
ossl_quic_channel_get0_port(QUIC_CHANNEL * ch)571 QUIC_PORT *ossl_quic_channel_get0_port(QUIC_CHANNEL *ch)
572 {
573     return ch->port;
574 }
575 
ossl_quic_channel_get0_engine(QUIC_CHANNEL * ch)576 QUIC_ENGINE *ossl_quic_channel_get0_engine(QUIC_CHANNEL *ch)
577 {
578     return ossl_quic_port_get0_engine(ch->port);
579 }
580 
ossl_quic_channel_get_mutex(QUIC_CHANNEL * ch)581 CRYPTO_MUTEX *ossl_quic_channel_get_mutex(QUIC_CHANNEL *ch)
582 {
583     return ossl_quic_port_get0_mutex(ch->port);
584 }
585 
ossl_quic_channel_has_pending(const QUIC_CHANNEL * ch)586 int ossl_quic_channel_has_pending(const QUIC_CHANNEL *ch)
587 {
588     return ossl_quic_demux_has_pending(ch->port->demux)
589         || ossl_qrx_processed_read_pending(ch->qrx);
590 }
591 
592 /*
593  * QUIC Channel: Callbacks from Miscellaneous Subsidiary Components
594  * ================================================================
595  */
596 
597 /* Used by various components. */
get_time(void * arg)598 static OSSL_TIME get_time(void *arg)
599 {
600     QUIC_CHANNEL *ch = arg;
601 
602     return ossl_quic_port_get_time(ch->port);
603 }
604 
605 /* Used by QSM. */
get_stream_limit(int uni,void * arg)606 static uint64_t get_stream_limit(int uni, void *arg)
607 {
608     QUIC_CHANNEL *ch = arg;
609 
610     return uni ? ch->max_local_streams_uni : ch->max_local_streams_bidi;
611 }
612 
613 /*
614  * Called by QRX to determine if a packet is potentially invalid before trying
615  * to decrypt it.
616  */
rx_late_validate(QUIC_PN pn,int pn_space,void * arg)617 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg)
618 {
619     QUIC_CHANNEL *ch = arg;
620 
621     /* Potential duplicates should not be processed. */
622     if (!ossl_ackm_is_rx_pn_processable(ch->ackm, pn, pn_space))
623         return 0;
624 
625     return 1;
626 }
627 
628 /*
629  * Triggers a TXKU (whether spontaneous or solicited). Does not check whether
630  * spontaneous TXKU is currently allowed.
631  */
632 QUIC_NEEDS_LOCK
ch_trigger_txku(QUIC_CHANNEL * ch)633 static void ch_trigger_txku(QUIC_CHANNEL *ch)
634 {
635     uint64_t next_pn
636         = ossl_quic_tx_packetiser_get_next_pn(ch->txp, QUIC_PN_SPACE_APP);
637 
638     if (!ossl_quic_pn_valid(next_pn)
639         || !ossl_qtx_trigger_key_update(ch->qtx)) {
640         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
641                                                "key update");
642         return;
643     }
644 
645     ch->txku_in_progress    = 1;
646     ch->txku_pn             = next_pn;
647     ch->rxku_expected       = ch->ku_locally_initiated;
648 }
649 
650 QUIC_NEEDS_LOCK
txku_in_progress(QUIC_CHANNEL * ch)651 static int txku_in_progress(QUIC_CHANNEL *ch)
652 {
653     if (ch->txku_in_progress
654         && ossl_ackm_get_largest_acked(ch->ackm, QUIC_PN_SPACE_APP) >= ch->txku_pn) {
655         OSSL_TIME pto = ossl_ackm_get_pto_duration(ch->ackm);
656 
657         /*
658          * RFC 9001 s. 6.5: Endpoints SHOULD wait three times the PTO before
659          * initiating a key update after receiving an acknowledgment that
660          * confirms that the previous key update was received.
661          *
662          * Note that by the above wording, this period starts from when we get
663          * the ack for a TXKU-triggering packet, not when the TXKU is initiated.
664          * So we defer TXKU cooldown deadline calculation to this point.
665          */
666         ch->txku_in_progress        = 0;
667         ch->txku_cooldown_deadline  = ossl_time_add(get_time(ch),
668                                                     ossl_time_multiply(pto, 3));
669     }
670 
671     return ch->txku_in_progress;
672 }
673 
674 QUIC_NEEDS_LOCK
txku_allowed(QUIC_CHANNEL * ch)675 static int txku_allowed(QUIC_CHANNEL *ch)
676 {
677     return ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT /* Sanity check. */
678         /* Strict RFC 9001 criterion for TXKU. */
679         && ch->handshake_confirmed
680         && !txku_in_progress(ch);
681 }
682 
683 QUIC_NEEDS_LOCK
txku_recommendable(QUIC_CHANNEL * ch)684 static int txku_recommendable(QUIC_CHANNEL *ch)
685 {
686     if (!txku_allowed(ch))
687         return 0;
688 
689     return
690         /* Recommended RFC 9001 criterion for TXKU. */
691         ossl_time_compare(get_time(ch), ch->txku_cooldown_deadline) >= 0
692         /* Some additional sensible criteria. */
693         && !ch->rxku_in_progress
694         && !ch->rxku_pending_confirm;
695 }
696 
697 QUIC_NEEDS_LOCK
txku_desirable(QUIC_CHANNEL * ch)698 static int txku_desirable(QUIC_CHANNEL *ch)
699 {
700     uint64_t cur_pkt_count, max_pkt_count, thresh_pkt_count;
701     const uint32_t enc_level = QUIC_ENC_LEVEL_1RTT;
702 
703     /* Check AEAD limit to determine if we should perform a spontaneous TXKU. */
704     cur_pkt_count = ossl_qtx_get_cur_epoch_pkt_count(ch->qtx, enc_level);
705     max_pkt_count = ossl_qtx_get_max_epoch_pkt_count(ch->qtx, enc_level);
706 
707     thresh_pkt_count = max_pkt_count / 2;
708     if (ch->txku_threshold_override != UINT64_MAX)
709         thresh_pkt_count = ch->txku_threshold_override;
710 
711     return cur_pkt_count >= thresh_pkt_count;
712 }
713 
714 QUIC_NEEDS_LOCK
ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL * ch)715 static void ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL *ch)
716 {
717     if (!txku_recommendable(ch) || !txku_desirable(ch))
718         return;
719 
720     ch->ku_locally_initiated = 1;
721     ch_trigger_txku(ch);
722 }
723 
724 QUIC_NEEDS_LOCK
rxku_allowed(QUIC_CHANNEL * ch)725 static int rxku_allowed(QUIC_CHANNEL *ch)
726 {
727     /*
728      * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a key update prior to
729      * having confirmed the handshake (Section 4.1.2).
730      *
731      * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a subsequent key update
732      * unless it has received an acknowledgment for a packet that was sent
733      * protected with keys from the current key phase.
734      *
735      * RFC 9001 s. 6.2: If an endpoint detects a second update before it has
736      * sent any packets with updated keys containing an acknowledgment for the
737      * packet that initiated the key update, it indicates that its peer has
738      * updated keys twice without awaiting confirmation. An endpoint MAY treat
739      * such consecutive key updates as a connection error of type
740      * KEY_UPDATE_ERROR.
741      */
742     return ch->handshake_confirmed && !ch->rxku_pending_confirm;
743 }
744 
745 /*
746  * Called when the QRX detects a new RX key update event.
747  */
748 enum rxku_decision {
749     DECISION_RXKU_ONLY,
750     DECISION_PROTOCOL_VIOLATION,
751     DECISION_SOLICITED_TXKU
752 };
753 
754 /* Called when the QRX detects a key update has occurred. */
755 QUIC_NEEDS_LOCK
rxku_detected(QUIC_PN pn,void * arg)756 static void rxku_detected(QUIC_PN pn, void *arg)
757 {
758     QUIC_CHANNEL *ch = arg;
759     enum rxku_decision decision;
760     OSSL_TIME pto;
761 
762     /*
763      * Note: rxku_in_progress is always 0 here as an RXKU cannot be detected
764      * when we are still in UPDATING or COOLDOWN (see quic_record_rx.h).
765      */
766     assert(!ch->rxku_in_progress);
767 
768     if (!rxku_allowed(ch))
769         /* Is RXKU even allowed at this time? */
770         decision = DECISION_PROTOCOL_VIOLATION;
771 
772     else if (ch->ku_locally_initiated)
773         /*
774          * If this key update was locally initiated (meaning that this detected
775          * RXKU event is a result of our own spontaneous TXKU), we do not
776          * trigger another TXKU; after all, to do so would result in an infinite
777          * ping-pong of key updates. We still process it as an RXKU.
778          */
779         decision = DECISION_RXKU_ONLY;
780 
781     else
782         /*
783          * Otherwise, a peer triggering a KU means we have to trigger a KU also.
784          */
785         decision = DECISION_SOLICITED_TXKU;
786 
787     if (decision == DECISION_PROTOCOL_VIOLATION) {
788         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR,
789                                                0, "RX key update again too soon");
790         return;
791     }
792 
793     pto = ossl_ackm_get_pto_duration(ch->ackm);
794 
795     ch->ku_locally_initiated        = 0;
796     ch->rxku_in_progress            = 1;
797     ch->rxku_pending_confirm        = 1;
798     ch->rxku_trigger_pn             = pn;
799     ch->rxku_update_end_deadline    = ossl_time_add(get_time(ch), pto);
800     ch->rxku_expected               = 0;
801 
802     if (decision == DECISION_SOLICITED_TXKU)
803         /* NOT gated by usual txku_allowed() */
804         ch_trigger_txku(ch);
805 
806     /*
807      * Ordinarily, we only generate ACK when some ACK-eliciting frame has been
808      * received. In some cases, this may not occur for a long time, for example
809      * if transmission of application data is going in only one direction and
810      * nothing else is happening with the connection. However, since the peer
811      * cannot initiate a subsequent (spontaneous) TXKU until its prior
812      * (spontaneous or solicited) TXKU has completed - meaning that prior
813      * TXKU's trigger packet (or subsequent packet) has been acknowledged, this
814      * can lead to very long times before a TXKU is considered 'completed'.
815      * Optimise this by forcing ACK generation after triggering TXKU.
816      * (Basically, we consider a RXKU event something that is 'ACK-eliciting',
817      * which it more or less should be; it is necessarily separate from ordinary
818      * processing of ACK-eliciting frames as key update is not indicated via a
819      * frame.)
820      */
821     ossl_quic_tx_packetiser_schedule_ack(ch->txp, QUIC_PN_SPACE_APP);
822 }
823 
824 /* Called per tick to handle RXKU timer events. */
825 QUIC_NEEDS_LOCK
ch_rxku_tick(QUIC_CHANNEL * ch)826 static void ch_rxku_tick(QUIC_CHANNEL *ch)
827 {
828     if (!ch->rxku_in_progress
829         || ossl_time_compare(get_time(ch), ch->rxku_update_end_deadline) < 0)
830         return;
831 
832     ch->rxku_update_end_deadline    = ossl_time_infinite();
833     ch->rxku_in_progress            = 0;
834 
835     if (!ossl_qrx_key_update_timeout(ch->qrx, /*normal=*/1))
836         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
837                                                "RXKU cooldown internal error");
838 }
839 
840 QUIC_NEEDS_LOCK
ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK * ack,uint32_t pn_space,void * arg)841 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
842                              void *arg)
843 {
844     QUIC_CHANNEL *ch = arg;
845 
846     if (pn_space != QUIC_PN_SPACE_APP || !ch->rxku_pending_confirm
847         || !ossl_quic_frame_ack_contains_pn(ack, ch->rxku_trigger_pn))
848         return;
849 
850     /*
851      * Defer clearing rxku_pending_confirm until TXP generate call returns
852      * successfully.
853      */
854     ch->rxku_pending_confirm_done = 1;
855 }
856 
857 /*
858  * QUIC Channel: Handshake Layer Event Handling
859  * ============================================
860  */
ch_on_crypto_send(const unsigned char * buf,size_t buf_len,size_t * consumed,void * arg)861 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len,
862                              size_t *consumed, void *arg)
863 {
864     int ret;
865     QUIC_CHANNEL *ch = arg;
866     uint32_t enc_level = ch->tx_enc_level;
867     uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
868     QUIC_SSTREAM *sstream = ch->crypto_send[pn_space];
869 
870     if (!ossl_assert(sstream != NULL))
871         return 0;
872 
873     ret = ossl_quic_sstream_append(sstream, buf, buf_len, consumed);
874     return ret;
875 }
876 
crypto_ensure_empty(QUIC_RSTREAM * rstream)877 static int crypto_ensure_empty(QUIC_RSTREAM *rstream)
878 {
879     size_t avail = 0;
880     int is_fin = 0;
881 
882     if (rstream == NULL)
883         return 1;
884 
885     if (!ossl_quic_rstream_available(rstream, &avail, &is_fin))
886         return 0;
887 
888     return avail == 0;
889 }
890 
ch_on_crypto_recv_record(const unsigned char ** buf,size_t * bytes_read,void * arg)891 static int ch_on_crypto_recv_record(const unsigned char **buf,
892                                     size_t *bytes_read, void *arg)
893 {
894     QUIC_CHANNEL *ch = arg;
895     QUIC_RSTREAM *rstream;
896     int is_fin = 0; /* crypto stream is never finished, so we don't use this */
897     uint32_t i;
898 
899     /*
900      * After we move to a later EL we must not allow our peer to send any new
901      * bytes in the crypto stream on a previous EL. Retransmissions of old bytes
902      * are allowed.
903      *
904      * In practice we will only move to a new EL when we have consumed all bytes
905      * which should be sent on the crypto stream at a previous EL. For example,
906      * the Handshake EL should not be provisioned until we have completely
907      * consumed a TLS 1.3 ServerHello. Thus when we provision an EL the output
908      * of ossl_quic_rstream_available() should be 0 for all lower ELs. Thus if a
909      * given EL is available we simply ensure we have not received any further
910      * bytes at a lower EL.
911      */
912     for (i = QUIC_ENC_LEVEL_INITIAL; i < ch->rx_enc_level; ++i)
913         if (i != QUIC_ENC_LEVEL_0RTT &&
914             !crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) {
915             /* Protocol violation (RFC 9001 s. 4.1.3) */
916             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
917                                                    OSSL_QUIC_FRAME_TYPE_CRYPTO,
918                                                    "crypto stream data in wrong EL");
919             return 0;
920         }
921 
922     rstream = ch->crypto_recv[ossl_quic_enc_level_to_pn_space(ch->rx_enc_level)];
923     if (rstream == NULL)
924         return 0;
925 
926     return ossl_quic_rstream_get_record(rstream, buf, bytes_read,
927                                         &is_fin);
928 }
929 
ch_on_crypto_release_record(size_t bytes_read,void * arg)930 static int ch_on_crypto_release_record(size_t bytes_read, void *arg)
931 {
932     QUIC_CHANNEL *ch = arg;
933     QUIC_RSTREAM *rstream;
934     OSSL_RTT_INFO rtt_info;
935     uint32_t rx_pn_space = ossl_quic_enc_level_to_pn_space(ch->rx_enc_level);
936 
937     rstream = ch->crypto_recv[rx_pn_space];
938     if (rstream == NULL)
939         return 0;
940 
941     ossl_statm_get_rtt_info(ossl_quic_channel_get_statm(ch), &rtt_info);
942     if (!ossl_quic_rxfc_on_retire(&ch->crypto_rxfc[rx_pn_space], bytes_read,
943                                   rtt_info.smoothed_rtt))
944         return 0;
945 
946     return ossl_quic_rstream_release_record(rstream, bytes_read);
947 }
948 
ch_on_handshake_yield_secret(uint32_t enc_level,int direction,uint32_t suite_id,EVP_MD * md,const unsigned char * secret,size_t secret_len,void * arg)949 static int ch_on_handshake_yield_secret(uint32_t enc_level, int direction,
950                                         uint32_t suite_id, EVP_MD *md,
951                                         const unsigned char *secret,
952                                         size_t secret_len,
953                                         void *arg)
954 {
955     QUIC_CHANNEL *ch = arg;
956     uint32_t i;
957 
958     if (enc_level < QUIC_ENC_LEVEL_HANDSHAKE || enc_level >= QUIC_ENC_LEVEL_NUM)
959         /* Invalid EL. */
960         return 0;
961 
962 
963     if (direction) {
964         /* TX */
965         if (enc_level <= ch->tx_enc_level)
966             /*
967              * Does not make sense for us to try and provision an EL we have already
968              * attained.
969              */
970             return 0;
971 
972         if (!ossl_qtx_provide_secret(ch->qtx, enc_level,
973                                      suite_id, md,
974                                      secret, secret_len))
975             return 0;
976 
977         ch->tx_enc_level = enc_level;
978     } else {
979         /* RX */
980         if (enc_level <= ch->rx_enc_level)
981             /*
982              * Does not make sense for us to try and provision an EL we have already
983              * attained.
984              */
985             return 0;
986 
987         /*
988          * Ensure all crypto streams for previous ELs are now empty of available
989          * data.
990          */
991         for (i = QUIC_ENC_LEVEL_INITIAL; i < enc_level; ++i)
992             if (!crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) {
993                 /* Protocol violation (RFC 9001 s. 4.1.3) */
994                 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
995                                                     OSSL_QUIC_FRAME_TYPE_CRYPTO,
996                                                     "crypto stream data in wrong EL");
997                 return 0;
998             }
999 
1000         if (!ossl_qrx_provide_secret(ch->qrx, enc_level,
1001                                      suite_id, md,
1002                                      secret, secret_len))
1003             return 0;
1004 
1005         ch->have_new_rx_secret = 1;
1006         ch->rx_enc_level = enc_level;
1007     }
1008 
1009     return 1;
1010 }
1011 
ch_on_handshake_complete(void * arg)1012 static int ch_on_handshake_complete(void *arg)
1013 {
1014     QUIC_CHANNEL *ch = arg;
1015 
1016     if (!ossl_assert(!ch->handshake_complete))
1017         return 0; /* this should not happen twice */
1018 
1019     if (!ossl_assert(ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT))
1020         return 0;
1021 
1022     if (!ch->got_remote_transport_params) {
1023         /*
1024          * Was not a valid QUIC handshake if we did not get valid transport
1025          * params.
1026          */
1027         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_CRYPTO_MISSING_EXT,
1028                                                OSSL_QUIC_FRAME_TYPE_CRYPTO,
1029                                                "no transport parameters received");
1030         return 0;
1031     }
1032 
1033     /* Don't need transport parameters anymore. */
1034     OPENSSL_free(ch->local_transport_params);
1035     ch->local_transport_params = NULL;
1036 
1037     /* Tell the QRX it can now process 1-RTT packets. */
1038     ossl_qrx_allow_1rtt_processing(ch->qrx);
1039 
1040     /* Tell TXP the handshake is complete. */
1041     ossl_quic_tx_packetiser_notify_handshake_complete(ch->txp);
1042 
1043     ch->handshake_complete = 1;
1044 
1045     if (ch->is_server) {
1046         /*
1047          * On the server, the handshake is confirmed as soon as it is complete.
1048          */
1049         ossl_quic_channel_on_handshake_confirmed(ch);
1050 
1051         ossl_quic_tx_packetiser_schedule_handshake_done(ch->txp);
1052     }
1053 
1054     ch_record_state_transition(ch, ch->state);
1055     return 1;
1056 }
1057 
ch_on_handshake_alert(void * arg,unsigned char alert_code)1058 static int ch_on_handshake_alert(void *arg, unsigned char alert_code)
1059 {
1060     QUIC_CHANNEL *ch = arg;
1061 
1062     /*
1063      * RFC 9001 s. 4.4: More specifically, servers MUST NOT send post-handshake
1064      * TLS CertificateRequest messages, and clients MUST treat receipt of such
1065      * messages as a connection error of type PROTOCOL_VIOLATION.
1066      */
1067     if (alert_code == SSL_AD_UNEXPECTED_MESSAGE
1068             && ch->handshake_complete
1069             && ossl_quic_tls_is_cert_request(ch->qtls))
1070         ossl_quic_channel_raise_protocol_error(ch,
1071                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1072                                                0,
1073                                                "Post-handshake TLS "
1074                                                "CertificateRequest received");
1075     /*
1076      * RFC 9001 s. 4.6.1: Servers MUST NOT send the early_data extension with a
1077      * max_early_data_size field set to any value other than 0xffffffff. A
1078      * client MUST treat receipt of a NewSessionTicket that contains an
1079      * early_data extension with any other value as a connection error of type
1080      * PROTOCOL_VIOLATION.
1081      */
1082     else if (alert_code == SSL_AD_ILLEGAL_PARAMETER
1083              && ch->handshake_complete
1084              && ossl_quic_tls_has_bad_max_early_data(ch->qtls))
1085         ossl_quic_channel_raise_protocol_error(ch,
1086                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1087                                                0,
1088                                                "Bad max_early_data received");
1089     else
1090         ossl_quic_channel_raise_protocol_error(ch,
1091                                                OSSL_QUIC_ERR_CRYPTO_ERR_BEGIN
1092                                                + alert_code,
1093                                                0, "handshake alert");
1094 
1095     return 1;
1096 }
1097 
1098 /*
1099  * QUIC Channel: Transport Parameter Handling
1100  * ==========================================
1101  */
1102 
1103 /*
1104  * Called by handshake layer when we receive QUIC Transport Parameters from the
1105  * peer. Note that these are not authenticated until the handshake is marked
1106  * as complete.
1107  */
1108 #define TP_REASON_SERVER_ONLY(x) \
1109     x " may not be sent by a client"
1110 #define TP_REASON_DUP(x) \
1111     x " appears multiple times"
1112 #define TP_REASON_MALFORMED(x) \
1113     x " is malformed"
1114 #define TP_REASON_EXPECTED_VALUE(x) \
1115     x " does not match expected value"
1116 #define TP_REASON_NOT_RETRY(x) \
1117     x " sent when not performing a retry"
1118 #define TP_REASON_REQUIRED(x) \
1119     x " was not sent but is required"
1120 #define TP_REASON_INTERNAL_ERROR(x) \
1121     x " encountered internal error"
1122 
txfc_bump_cwm_bidi(QUIC_STREAM * s,void * arg)1123 static void txfc_bump_cwm_bidi(QUIC_STREAM *s, void *arg)
1124 {
1125     if (!ossl_quic_stream_is_bidi(s)
1126         || ossl_quic_stream_is_server_init(s))
1127         return;
1128 
1129     ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg);
1130 }
1131 
txfc_bump_cwm_uni(QUIC_STREAM * s,void * arg)1132 static void txfc_bump_cwm_uni(QUIC_STREAM *s, void *arg)
1133 {
1134     if (ossl_quic_stream_is_bidi(s)
1135         || ossl_quic_stream_is_server_init(s))
1136         return;
1137 
1138     ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg);
1139 }
1140 
do_update(QUIC_STREAM * s,void * arg)1141 static void do_update(QUIC_STREAM *s, void *arg)
1142 {
1143     QUIC_CHANNEL *ch = arg;
1144 
1145     ossl_quic_stream_map_update_state(&ch->qsm, s);
1146 }
1147 
min_u64_ignore_0(uint64_t a,uint64_t b)1148 static uint64_t min_u64_ignore_0(uint64_t a, uint64_t b)
1149 {
1150     if (a == 0)
1151         return b;
1152     if (b == 0)
1153         return a;
1154 
1155     return a < b ? a : b;
1156 }
1157 
ch_on_transport_params(const unsigned char * params,size_t params_len,void * arg)1158 static int ch_on_transport_params(const unsigned char *params,
1159                                   size_t params_len,
1160                                   void *arg)
1161 {
1162     QUIC_CHANNEL *ch = arg;
1163     PACKET pkt;
1164     uint64_t id, v;
1165     size_t len;
1166     const unsigned char *body;
1167     int got_orig_dcid = 0;
1168     int got_initial_scid = 0;
1169     int got_retry_scid = 0;
1170     int got_initial_max_data = 0;
1171     int got_initial_max_stream_data_bidi_local = 0;
1172     int got_initial_max_stream_data_bidi_remote = 0;
1173     int got_initial_max_stream_data_uni = 0;
1174     int got_initial_max_streams_bidi = 0;
1175     int got_initial_max_streams_uni = 0;
1176     int got_stateless_reset_token = 0;
1177     int got_preferred_addr = 0;
1178     int got_ack_delay_exp = 0;
1179     int got_max_ack_delay = 0;
1180     int got_max_udp_payload_size = 0;
1181     int got_max_idle_timeout = 0;
1182     int got_active_conn_id_limit = 0;
1183     int got_disable_active_migration = 0;
1184     QUIC_CONN_ID cid;
1185     const char *reason = "bad transport parameter";
1186     ossl_unused uint64_t rx_max_idle_timeout = 0;
1187     ossl_unused const void *stateless_reset_token_p = NULL;
1188     QUIC_PREFERRED_ADDR pfa;
1189 
1190     if (ch->got_remote_transport_params) {
1191         reason = "multiple transport parameter extensions";
1192         goto malformed;
1193     }
1194 
1195     if (!PACKET_buf_init(&pkt, params, params_len)) {
1196         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
1197                                                "internal error (packet buf init)");
1198         return 0;
1199     }
1200 
1201     while (PACKET_remaining(&pkt) > 0) {
1202         if (!ossl_quic_wire_peek_transport_param(&pkt, &id))
1203             goto malformed;
1204 
1205         switch (id) {
1206         case QUIC_TPARAM_ORIG_DCID:
1207             if (got_orig_dcid) {
1208                 reason = TP_REASON_DUP("ORIG_DCID");
1209                 goto malformed;
1210             }
1211 
1212             if (ch->is_server) {
1213                 reason = TP_REASON_SERVER_ONLY("ORIG_DCID");
1214                 goto malformed;
1215             }
1216 
1217             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1218                 reason = TP_REASON_MALFORMED("ORIG_DCID");
1219                 goto malformed;
1220             }
1221 
1222 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1223             /* Must match our initial DCID. */
1224             if (!ossl_quic_conn_id_eq(&ch->init_dcid, &cid)) {
1225                 reason = TP_REASON_EXPECTED_VALUE("ORIG_DCID");
1226                 goto malformed;
1227             }
1228 #endif
1229 
1230             got_orig_dcid = 1;
1231             break;
1232 
1233         case QUIC_TPARAM_RETRY_SCID:
1234             if (ch->is_server) {
1235                 reason = TP_REASON_SERVER_ONLY("RETRY_SCID");
1236                 goto malformed;
1237             }
1238 
1239             if (got_retry_scid) {
1240                 reason = TP_REASON_DUP("RETRY_SCID");
1241                 goto malformed;
1242             }
1243 
1244             if (!ch->doing_retry) {
1245                 reason = TP_REASON_NOT_RETRY("RETRY_SCID");
1246                 goto malformed;
1247             }
1248 
1249             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1250                 reason = TP_REASON_MALFORMED("RETRY_SCID");
1251                 goto malformed;
1252             }
1253 
1254             /* Must match Retry packet SCID. */
1255             if (!ossl_quic_conn_id_eq(&ch->retry_scid, &cid)) {
1256                 reason = TP_REASON_EXPECTED_VALUE("RETRY_SCID");
1257                 goto malformed;
1258             }
1259 
1260             got_retry_scid = 1;
1261             break;
1262 
1263         case QUIC_TPARAM_INITIAL_SCID:
1264             if (got_initial_scid) {
1265                 /* must not appear more than once */
1266                 reason = TP_REASON_DUP("INITIAL_SCID");
1267                 goto malformed;
1268             }
1269 
1270             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1271                 reason = TP_REASON_MALFORMED("INITIAL_SCID");
1272                 goto malformed;
1273             }
1274 
1275             /* Must match SCID of first Initial packet from server. */
1276             if (!ossl_quic_conn_id_eq(&ch->init_scid, &cid)) {
1277                 reason = TP_REASON_EXPECTED_VALUE("INITIAL_SCID");
1278                 goto malformed;
1279             }
1280 
1281             got_initial_scid = 1;
1282             break;
1283 
1284         case QUIC_TPARAM_INITIAL_MAX_DATA:
1285             if (got_initial_max_data) {
1286                 /* must not appear more than once */
1287                 reason = TP_REASON_DUP("INITIAL_MAX_DATA");
1288                 goto malformed;
1289             }
1290 
1291             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1292                 reason = TP_REASON_MALFORMED("INITIAL_MAX_DATA");
1293                 goto malformed;
1294             }
1295 
1296             ossl_quic_txfc_bump_cwm(&ch->conn_txfc, v);
1297             got_initial_max_data = 1;
1298             break;
1299 
1300         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL:
1301             if (got_initial_max_stream_data_bidi_local) {
1302                 /* must not appear more than once */
1303                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1304                 goto malformed;
1305             }
1306 
1307             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1308                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1309                 goto malformed;
1310             }
1311 
1312             /*
1313              * This is correct; the BIDI_LOCAL TP governs streams created by
1314              * the endpoint which sends the TP, i.e., our peer.
1315              */
1316             ch->rx_init_max_stream_data_bidi_remote = v;
1317             got_initial_max_stream_data_bidi_local = 1;
1318             break;
1319 
1320         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE:
1321             if (got_initial_max_stream_data_bidi_remote) {
1322                 /* must not appear more than once */
1323                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1324                 goto malformed;
1325             }
1326 
1327             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1328                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1329                 goto malformed;
1330             }
1331 
1332             /*
1333              * This is correct; the BIDI_REMOTE TP governs streams created
1334              * by the endpoint which receives the TP, i.e., us.
1335              */
1336             ch->rx_init_max_stream_data_bidi_local = v;
1337 
1338             /* Apply to all existing streams. */
1339             ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_bidi, &v);
1340             got_initial_max_stream_data_bidi_remote = 1;
1341             break;
1342 
1343         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI:
1344             if (got_initial_max_stream_data_uni) {
1345                 /* must not appear more than once */
1346                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_UNI");
1347                 goto malformed;
1348             }
1349 
1350             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1351                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_UNI");
1352                 goto malformed;
1353             }
1354 
1355             ch->rx_init_max_stream_data_uni = v;
1356 
1357             /* Apply to all existing streams. */
1358             ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_uni, &v);
1359             got_initial_max_stream_data_uni = 1;
1360             break;
1361 
1362         case QUIC_TPARAM_ACK_DELAY_EXP:
1363             if (got_ack_delay_exp) {
1364                 /* must not appear more than once */
1365                 reason = TP_REASON_DUP("ACK_DELAY_EXP");
1366                 goto malformed;
1367             }
1368 
1369             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1370                 || v > QUIC_MAX_ACK_DELAY_EXP) {
1371                 reason = TP_REASON_MALFORMED("ACK_DELAY_EXP");
1372                 goto malformed;
1373             }
1374 
1375             ch->rx_ack_delay_exp = (unsigned char)v;
1376             got_ack_delay_exp = 1;
1377             break;
1378 
1379         case QUIC_TPARAM_MAX_ACK_DELAY:
1380             if (got_max_ack_delay) {
1381                 /* must not appear more than once */
1382                 reason = TP_REASON_DUP("MAX_ACK_DELAY");
1383                 goto malformed;
1384             }
1385 
1386             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1387                 || v >= (((uint64_t)1) << 14)) {
1388                 reason = TP_REASON_MALFORMED("MAX_ACK_DELAY");
1389                 goto malformed;
1390             }
1391 
1392             ch->rx_max_ack_delay = v;
1393             ossl_ackm_set_rx_max_ack_delay(ch->ackm,
1394                                            ossl_ms2time(ch->rx_max_ack_delay));
1395 
1396             got_max_ack_delay = 1;
1397             break;
1398 
1399         case QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI:
1400             if (got_initial_max_streams_bidi) {
1401                 /* must not appear more than once */
1402                 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_BIDI");
1403                 goto malformed;
1404             }
1405 
1406             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1407                 || v > (((uint64_t)1) << 60)) {
1408                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_BIDI");
1409                 goto malformed;
1410             }
1411 
1412             assert(ch->max_local_streams_bidi == 0);
1413             ch->max_local_streams_bidi = v;
1414             got_initial_max_streams_bidi = 1;
1415             break;
1416 
1417         case QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI:
1418             if (got_initial_max_streams_uni) {
1419                 /* must not appear more than once */
1420                 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_UNI");
1421                 goto malformed;
1422             }
1423 
1424             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1425                 || v > (((uint64_t)1) << 60)) {
1426                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_UNI");
1427                 goto malformed;
1428             }
1429 
1430             assert(ch->max_local_streams_uni == 0);
1431             ch->max_local_streams_uni = v;
1432             got_initial_max_streams_uni = 1;
1433             break;
1434 
1435         case QUIC_TPARAM_MAX_IDLE_TIMEOUT:
1436             if (got_max_idle_timeout) {
1437                 /* must not appear more than once */
1438                 reason = TP_REASON_DUP("MAX_IDLE_TIMEOUT");
1439                 goto malformed;
1440             }
1441 
1442             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1443                 reason = TP_REASON_MALFORMED("MAX_IDLE_TIMEOUT");
1444                 goto malformed;
1445             }
1446 
1447             ch->max_idle_timeout_remote_req = v;
1448 
1449             ch->max_idle_timeout = min_u64_ignore_0(ch->max_idle_timeout_local_req,
1450                                                     ch->max_idle_timeout_remote_req);
1451 
1452 
1453             ch_update_idle(ch);
1454             got_max_idle_timeout = 1;
1455             rx_max_idle_timeout = v;
1456             break;
1457 
1458         case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE:
1459             if (got_max_udp_payload_size) {
1460                 /* must not appear more than once */
1461                 reason = TP_REASON_DUP("MAX_UDP_PAYLOAD_SIZE");
1462                 goto malformed;
1463             }
1464 
1465             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1466                 || v < QUIC_MIN_INITIAL_DGRAM_LEN) {
1467                 reason = TP_REASON_MALFORMED("MAX_UDP_PAYLOAD_SIZE");
1468                 goto malformed;
1469             }
1470 
1471             ch->rx_max_udp_payload_size = v;
1472             got_max_udp_payload_size    = 1;
1473             break;
1474 
1475         case QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT:
1476             if (got_active_conn_id_limit) {
1477                 /* must not appear more than once */
1478                 reason = TP_REASON_DUP("ACTIVE_CONN_ID_LIMIT");
1479                 goto malformed;
1480             }
1481 
1482             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1483                 || v < QUIC_MIN_ACTIVE_CONN_ID_LIMIT) {
1484                 reason = TP_REASON_MALFORMED("ACTIVE_CONN_ID_LIMIT");
1485                 goto malformed;
1486             }
1487 
1488             ch->rx_active_conn_id_limit = v;
1489             got_active_conn_id_limit = 1;
1490             break;
1491 
1492         case QUIC_TPARAM_STATELESS_RESET_TOKEN:
1493             if (got_stateless_reset_token) {
1494                 reason = TP_REASON_DUP("STATELESS_RESET_TOKEN");
1495                 goto malformed;
1496             }
1497 
1498             /*
1499              * We must ensure a client doesn't send them because we don't have
1500              * processing for them.
1501              *
1502              * TODO(QUIC SERVER): remove this restriction
1503              */
1504             if (ch->is_server) {
1505                 reason = TP_REASON_SERVER_ONLY("STATELESS_RESET_TOKEN");
1506                 goto malformed;
1507             }
1508 
1509             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len);
1510             if (body == NULL || len != QUIC_STATELESS_RESET_TOKEN_LEN) {
1511                 reason = TP_REASON_MALFORMED("STATELESS_RESET_TOKEN");
1512                 goto malformed;
1513             }
1514             if (!ossl_quic_srtm_add(ch->srtm, ch, ch->cur_remote_seq_num,
1515                                     (const QUIC_STATELESS_RESET_TOKEN *)body)) {
1516                 reason = TP_REASON_INTERNAL_ERROR("STATELESS_RESET_TOKEN");
1517                 goto malformed;
1518             }
1519 
1520             stateless_reset_token_p     = body;
1521             got_stateless_reset_token   = 1;
1522             break;
1523 
1524         case QUIC_TPARAM_PREFERRED_ADDR:
1525             /* TODO(QUIC FUTURE): Handle preferred address. */
1526             if (got_preferred_addr) {
1527                 reason = TP_REASON_DUP("PREFERRED_ADDR");
1528                 goto malformed;
1529             }
1530 
1531             /*
1532              * RFC 9000 s. 18.2: "A server that chooses a zero-length
1533              * connection ID MUST NOT provide a preferred address.
1534              * Similarly, a server MUST NOT include a zero-length connection
1535              * ID in this transport parameter. A client MUST treat a
1536              * violation of these requirements as a connection error of type
1537              * TRANSPORT_PARAMETER_ERROR."
1538              */
1539             if (ch->is_server) {
1540                 reason = TP_REASON_SERVER_ONLY("PREFERRED_ADDR");
1541                 goto malformed;
1542             }
1543 
1544             if (ch->cur_remote_dcid.id_len == 0) {
1545                 reason = "PREFERRED_ADDR provided for zero-length CID";
1546                 goto malformed;
1547             }
1548 
1549             if (!ossl_quic_wire_decode_transport_param_preferred_addr(&pkt, &pfa)) {
1550                 reason = TP_REASON_MALFORMED("PREFERRED_ADDR");
1551                 goto malformed;
1552             }
1553 
1554             if (pfa.cid.id_len == 0) {
1555                 reason = "zero-length CID in PREFERRED_ADDR";
1556                 goto malformed;
1557             }
1558 
1559             got_preferred_addr = 1;
1560             break;
1561 
1562         case QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION:
1563             /* We do not currently handle migration, so nothing to do. */
1564             if (got_disable_active_migration) {
1565                 /* must not appear more than once */
1566                 reason = TP_REASON_DUP("DISABLE_ACTIVE_MIGRATION");
1567                 goto malformed;
1568             }
1569 
1570             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len);
1571             if (body == NULL || len > 0) {
1572                 reason = TP_REASON_MALFORMED("DISABLE_ACTIVE_MIGRATION");
1573                 goto malformed;
1574             }
1575 
1576             got_disable_active_migration = 1;
1577             break;
1578 
1579         default:
1580             /*
1581              * Skip over and ignore.
1582              *
1583              * RFC 9000 s. 7.4: We SHOULD treat duplicated transport parameters
1584              * as a connection error, but we are not required to. Currently,
1585              * handle this programmatically by checking for duplicates in the
1586              * parameters that we recognise, as above, but don't bother
1587              * maintaining a list of duplicates for anything we don't recognise.
1588              */
1589             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id,
1590                                                                &len);
1591             if (body == NULL)
1592                 goto malformed;
1593 
1594             break;
1595         }
1596     }
1597 
1598     if (!got_initial_scid) {
1599         reason = TP_REASON_REQUIRED("INITIAL_SCID");
1600         goto malformed;
1601     }
1602 
1603     if (!ch->is_server) {
1604         if (!got_orig_dcid) {
1605             reason = TP_REASON_REQUIRED("ORIG_DCID");
1606             goto malformed;
1607         }
1608 
1609         if (ch->doing_retry && !got_retry_scid) {
1610             reason = TP_REASON_REQUIRED("RETRY_SCID");
1611             goto malformed;
1612         }
1613     }
1614 
1615     ch->got_remote_transport_params = 1;
1616 
1617 #ifndef OPENSSL_NO_QLOG
1618     QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
1619         QLOG_STR("owner", "remote");
1620 
1621         if (got_orig_dcid)
1622             QLOG_CID("original_destination_connection_id",
1623                      &ch->init_dcid);
1624         if (got_initial_scid)
1625             QLOG_CID("original_source_connection_id",
1626                      &ch->init_dcid);
1627         if (got_retry_scid)
1628             QLOG_CID("retry_source_connection_id",
1629                      &ch->retry_scid);
1630         if (got_initial_max_data)
1631             QLOG_U64("initial_max_data",
1632                      ossl_quic_txfc_get_cwm(&ch->conn_txfc));
1633         if (got_initial_max_stream_data_bidi_local)
1634             QLOG_U64("initial_max_stream_data_bidi_local",
1635                      ch->rx_init_max_stream_data_bidi_local);
1636         if (got_initial_max_stream_data_bidi_remote)
1637             QLOG_U64("initial_max_stream_data_bidi_remote",
1638                      ch->rx_init_max_stream_data_bidi_remote);
1639         if (got_initial_max_stream_data_uni)
1640             QLOG_U64("initial_max_stream_data_uni",
1641                      ch->rx_init_max_stream_data_uni);
1642         if (got_initial_max_streams_bidi)
1643             QLOG_U64("initial_max_streams_bidi",
1644                      ch->max_local_streams_bidi);
1645         if (got_initial_max_streams_uni)
1646             QLOG_U64("initial_max_streams_uni",
1647                      ch->max_local_streams_uni);
1648         if (got_ack_delay_exp)
1649             QLOG_U64("ack_delay_exponent", ch->rx_ack_delay_exp);
1650         if (got_max_ack_delay)
1651             QLOG_U64("max_ack_delay", ch->rx_max_ack_delay);
1652         if (got_max_udp_payload_size)
1653             QLOG_U64("max_udp_payload_size", ch->rx_max_udp_payload_size);
1654         if (got_max_idle_timeout)
1655             QLOG_U64("max_idle_timeout", rx_max_idle_timeout);
1656         if (got_active_conn_id_limit)
1657             QLOG_U64("active_connection_id_limit", ch->rx_active_conn_id_limit);
1658         if (got_stateless_reset_token)
1659             QLOG_BIN("stateless_reset_token", stateless_reset_token_p,
1660                      QUIC_STATELESS_RESET_TOKEN_LEN);
1661         if (got_preferred_addr) {
1662             QLOG_BEGIN("preferred_addr")
1663                 QLOG_U64("port_v4", pfa.ipv4_port);
1664                 QLOG_U64("port_v6", pfa.ipv6_port);
1665                 QLOG_BIN("ip_v4", pfa.ipv4, sizeof(pfa.ipv4));
1666                 QLOG_BIN("ip_v6", pfa.ipv6, sizeof(pfa.ipv6));
1667                 QLOG_BIN("stateless_reset_token", pfa.stateless_reset.token,
1668                          sizeof(pfa.stateless_reset.token));
1669                 QLOG_CID("connection_id", &pfa.cid);
1670             QLOG_END()
1671         }
1672         QLOG_BOOL("disable_active_migration", got_disable_active_migration);
1673     QLOG_EVENT_END()
1674 #endif
1675 
1676     if (got_initial_max_data || got_initial_max_stream_data_bidi_remote
1677         || got_initial_max_streams_bidi || got_initial_max_streams_uni)
1678         /*
1679          * If FC credit was bumped, we may now be able to send. Update all
1680          * streams.
1681          */
1682         ossl_quic_stream_map_visit(&ch->qsm, do_update, ch);
1683 
1684     /* If we are a server, we now generate our own transport parameters. */
1685     if (ch->is_server && !ch_generate_transport_params(ch)) {
1686         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
1687                                                "internal error");
1688         return 0;
1689     }
1690 
1691     return 1;
1692 
1693 malformed:
1694     ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_TRANSPORT_PARAMETER_ERROR,
1695                                            0, reason);
1696     return 0;
1697 }
1698 
1699 /*
1700  * Called when we want to generate transport parameters. This is called
1701  * immediately at instantiation time for a client and after we receive the
1702  * client's transport parameters for a server.
1703  */
ch_generate_transport_params(QUIC_CHANNEL * ch)1704 static int ch_generate_transport_params(QUIC_CHANNEL *ch)
1705 {
1706     int ok = 0;
1707     BUF_MEM *buf_mem = NULL;
1708     WPACKET wpkt;
1709     int wpkt_valid = 0;
1710     size_t buf_len = 0;
1711 
1712     if (ch->local_transport_params != NULL || ch->got_local_transport_params)
1713         goto err;
1714 
1715     if ((buf_mem = BUF_MEM_new()) == NULL)
1716         goto err;
1717 
1718     if (!WPACKET_init(&wpkt, buf_mem))
1719         goto err;
1720 
1721     wpkt_valid = 1;
1722 
1723     if (ossl_quic_wire_encode_transport_param_bytes(&wpkt, QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION,
1724                                                     NULL, 0) == NULL)
1725         goto err;
1726 
1727     if (ch->is_server) {
1728         if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_ORIG_DCID,
1729                                                        &ch->init_dcid))
1730             goto err;
1731 
1732         if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_INITIAL_SCID,
1733                                                        &ch->cur_local_cid))
1734             goto err;
1735     } else {
1736         /* Client always uses an empty SCID. */
1737         if (ossl_quic_wire_encode_transport_param_bytes(&wpkt, QUIC_TPARAM_INITIAL_SCID,
1738                                                         NULL, 0) == NULL)
1739             goto err;
1740     }
1741 
1742     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_IDLE_TIMEOUT,
1743                                                    ch->max_idle_timeout_local_req))
1744         goto err;
1745 
1746     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE,
1747                                                    QUIC_MIN_INITIAL_DGRAM_LEN))
1748         goto err;
1749 
1750     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT,
1751                                                    QUIC_MIN_ACTIVE_CONN_ID_LIMIT))
1752         goto err;
1753 
1754     if (ch->tx_max_ack_delay != QUIC_DEFAULT_MAX_ACK_DELAY
1755         && !ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_ACK_DELAY,
1756                                                       ch->tx_max_ack_delay))
1757         goto err;
1758 
1759     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_DATA,
1760                                                    ossl_quic_rxfc_get_cwm(&ch->conn_rxfc)))
1761         goto err;
1762 
1763     /* Send the default CWM for a new RXFC. */
1764     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL,
1765                                                    ch->tx_init_max_stream_data_bidi_local))
1766         goto err;
1767 
1768     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE,
1769                                                    ch->tx_init_max_stream_data_bidi_remote))
1770         goto err;
1771 
1772     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI,
1773                                                    ch->tx_init_max_stream_data_uni))
1774         goto err;
1775 
1776     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI,
1777                                                    ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc)))
1778         goto err;
1779 
1780     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI,
1781                                                    ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc)))
1782         goto err;
1783 
1784     if (!WPACKET_finish(&wpkt))
1785         goto err;
1786 
1787     wpkt_valid = 0;
1788 
1789     if (!WPACKET_get_total_written(&wpkt, &buf_len))
1790         goto err;
1791 
1792     ch->local_transport_params = (unsigned char *)buf_mem->data;
1793     buf_mem->data = NULL;
1794 
1795 
1796     if (!ossl_quic_tls_set_transport_params(ch->qtls, ch->local_transport_params,
1797                                             buf_len))
1798         goto err;
1799 
1800 #ifndef OPENSSL_NO_QLOG
1801     QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
1802         QLOG_STR("owner", "local");
1803         QLOG_BOOL("disable_active_migration", 1);
1804         if (ch->is_server) {
1805             QLOG_CID("original_destination_connection_id", &ch->init_dcid);
1806             QLOG_CID("initial_source_connection_id", &ch->cur_local_cid);
1807         } else {
1808             QLOG_STR("initial_source_connection_id", "");
1809         }
1810         QLOG_U64("max_idle_timeout", ch->max_idle_timeout);
1811         QLOG_U64("max_udp_payload_size", QUIC_MIN_INITIAL_DGRAM_LEN);
1812         QLOG_U64("active_connection_id_limit", QUIC_MIN_ACTIVE_CONN_ID_LIMIT);
1813         QLOG_U64("max_ack_delay", ch->tx_max_ack_delay);
1814         QLOG_U64("initial_max_data", ossl_quic_rxfc_get_cwm(&ch->conn_rxfc));
1815         QLOG_U64("initial_max_stream_data_bidi_local",
1816                  ch->tx_init_max_stream_data_bidi_local);
1817         QLOG_U64("initial_max_stream_data_bidi_remote",
1818                  ch->tx_init_max_stream_data_bidi_remote);
1819         QLOG_U64("initial_max_stream_data_uni",
1820                  ch->tx_init_max_stream_data_uni);
1821         QLOG_U64("initial_max_streams_bidi",
1822                  ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc));
1823         QLOG_U64("initial_max_streams_uni",
1824                  ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc));
1825     QLOG_EVENT_END()
1826 #endif
1827 
1828     ch->got_local_transport_params = 1;
1829 
1830     ok = 1;
1831 err:
1832     if (wpkt_valid)
1833         WPACKET_cleanup(&wpkt);
1834     BUF_MEM_free(buf_mem);
1835     return ok;
1836 }
1837 
1838 /*
1839  * QUIC Channel: Ticker-Mutator
1840  * ============================
1841  */
1842 
1843 /*
1844  * The central ticker function called by the reactor. This does everything, or
1845  * at least everything network I/O related. Best effort - not allowed to fail
1846  * "loudly".
1847  */
ossl_quic_channel_subtick(QUIC_CHANNEL * ch,QUIC_TICK_RESULT * res,uint32_t flags)1848 void ossl_quic_channel_subtick(QUIC_CHANNEL *ch, QUIC_TICK_RESULT *res,
1849                                uint32_t flags)
1850 {
1851     OSSL_TIME now, deadline;
1852     int channel_only = (flags & QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY) != 0;
1853 
1854     /*
1855      * When we tick the QUIC connection, we do everything we need to do
1856      * periodically. Network I/O handling will already have been performed
1857      * as necessary by the QUIC port. Thus, in order, we:
1858      *
1859      *   - handle any packets the DEMUX has queued up for us;
1860      *   - handle any timer events which are due to fire (ACKM, etc.);
1861      *   - generate any packets which need to be sent;
1862      *   - determine the time at which we should next be ticked.
1863      */
1864 
1865     /* If we are in the TERMINATED state, there is nothing to do. */
1866     if (ossl_quic_channel_is_terminated(ch)) {
1867         res->net_read_desired   = 0;
1868         res->net_write_desired  = 0;
1869         res->tick_deadline      = ossl_time_infinite();
1870         return;
1871     }
1872 
1873     /*
1874      * If we are in the TERMINATING state, check if the terminating timer has
1875      * expired.
1876      */
1877     if (ossl_quic_channel_is_terminating(ch)) {
1878         now = get_time(ch);
1879 
1880         if (ossl_time_compare(now, ch->terminate_deadline) >= 0) {
1881             ch_on_terminating_timeout(ch);
1882             res->net_read_desired   = 0;
1883             res->net_write_desired  = 0;
1884             res->tick_deadline      = ossl_time_infinite();
1885             return; /* abort normal processing, nothing to do */
1886         }
1887     }
1888 
1889     if (!ch->port->engine->inhibit_tick) {
1890         /* Handle RXKU timeouts. */
1891         ch_rxku_tick(ch);
1892 
1893         do {
1894             /* Process queued incoming packets. */
1895             ch->did_tls_tick        = 0;
1896             ch->have_new_rx_secret  = 0;
1897             ch_rx(ch, channel_only);
1898 
1899             /*
1900              * Allow the handshake layer to check for any new incoming data and
1901              * generate new outgoing data.
1902              */
1903             if (!ch->did_tls_tick)
1904                 ch_tick_tls(ch, channel_only);
1905 
1906             /*
1907              * If the handshake layer gave us a new secret, we need to do RX
1908              * again because packets that were not previously processable and
1909              * were deferred might now be processable.
1910              *
1911              * TODO(QUIC FUTURE): Consider handling this in the yield_secret callback.
1912              */
1913         } while (ch->have_new_rx_secret);
1914     }
1915 
1916     /*
1917      * Handle any timer events which are due to fire; namely, the loss
1918      * detection deadline and the idle timeout.
1919      *
1920      * ACKM ACK generation deadline is polled by TXP, so we don't need to
1921      * handle it here.
1922      */
1923     now = get_time(ch);
1924     if (ossl_time_compare(now, ch->idle_deadline) >= 0) {
1925         /*
1926          * Idle timeout differs from normal protocol violation because we do
1927          * not send a CONN_CLOSE frame; go straight to TERMINATED.
1928          */
1929         if (!ch->port->engine->inhibit_tick)
1930             ch_on_idle_timeout(ch);
1931 
1932         res->net_read_desired   = 0;
1933         res->net_write_desired  = 0;
1934         res->tick_deadline      = ossl_time_infinite();
1935         return;
1936     }
1937 
1938     if (!ch->port->engine->inhibit_tick) {
1939         deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
1940         if (!ossl_time_is_zero(deadline)
1941             && ossl_time_compare(now, deadline) >= 0)
1942             ossl_ackm_on_timeout(ch->ackm);
1943 
1944         /* If a ping is due, inform TXP. */
1945         if (ossl_time_compare(now, ch->ping_deadline) >= 0) {
1946             int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
1947 
1948             ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
1949 
1950             /*
1951              * If we have no CC budget at this time we cannot process the above
1952              * PING request immediately. In any case we have scheduled the
1953              * request so bump the ping deadline. If we don't do this we will
1954              * busy-loop endlessly as the above deadline comparison condition
1955              * will still be met.
1956              */
1957             ch_update_ping_deadline(ch);
1958         }
1959 
1960         /* Queue any data to be sent for transmission. */
1961         ch_tx(ch);
1962 
1963         /* Do stream GC. */
1964         ossl_quic_stream_map_gc(&ch->qsm);
1965     }
1966 
1967     /* Determine the time at which we should next be ticked. */
1968     res->tick_deadline = ch_determine_next_tick_deadline(ch);
1969 
1970     /*
1971      * Always process network input unless we are now terminated. Although we
1972      * had not terminated at the beginning of this tick, network errors in
1973      * ch_tx() may have caused us to transition to the Terminated state.
1974      */
1975     res->net_read_desired = !ossl_quic_channel_is_terminated(ch);
1976 
1977     /* We want to write to the network if we have any data in our TX queue. */
1978     res->net_write_desired
1979         = (!ossl_quic_channel_is_terminated(ch)
1980            && ossl_qtx_get_queue_len_datagrams(ch->qtx) > 0);
1981 }
1982 
ch_tick_tls(QUIC_CHANNEL * ch,int channel_only)1983 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only)
1984 {
1985     uint64_t error_code;
1986     const char *error_msg;
1987     ERR_STATE *error_state = NULL;
1988 
1989     if (channel_only)
1990         return 1;
1991 
1992     ch->did_tls_tick = 1;
1993     ossl_quic_tls_tick(ch->qtls);
1994 
1995     if (ossl_quic_tls_get_error(ch->qtls, &error_code, &error_msg,
1996                                 &error_state)) {
1997         ossl_quic_channel_raise_protocol_error_state(ch, error_code, 0,
1998                                                      error_msg, error_state);
1999         return 0;
2000     }
2001 
2002     return 1;
2003 }
2004 
2005 /* Check incoming forged packet limit and terminate connection if needed. */
ch_rx_check_forged_pkt_limit(QUIC_CHANNEL * ch)2006 static void ch_rx_check_forged_pkt_limit(QUIC_CHANNEL *ch)
2007 {
2008     uint32_t enc_level;
2009     uint64_t limit = UINT64_MAX, l;
2010 
2011     for (enc_level = QUIC_ENC_LEVEL_INITIAL;
2012          enc_level < QUIC_ENC_LEVEL_NUM;
2013          ++enc_level)
2014     {
2015         /*
2016          * Different ELs can have different AEADs which can in turn impose
2017          * different limits, so use the lowest value of any currently valid EL.
2018          */
2019         if ((ch->el_discarded & (1U << enc_level)) != 0)
2020             continue;
2021 
2022         if (enc_level > ch->rx_enc_level)
2023             break;
2024 
2025         l = ossl_qrx_get_max_forged_pkt_count(ch->qrx, enc_level);
2026         if (l < limit)
2027             limit = l;
2028     }
2029 
2030     if (ossl_qrx_get_cur_forged_pkt_count(ch->qrx) < limit)
2031         return;
2032 
2033     ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_AEAD_LIMIT_REACHED, 0,
2034                                            "forgery limit");
2035 }
2036 
2037 /* Process queued incoming packets and handle frames, if any. */
ch_rx(QUIC_CHANNEL * ch,int channel_only)2038 static int ch_rx(QUIC_CHANNEL *ch, int channel_only)
2039 {
2040     int handled_any = 0;
2041     const int closing = ossl_quic_channel_is_closing(ch);
2042 
2043     if (!ch->is_server && !ch->have_sent_any_pkt)
2044         /*
2045          * We have not sent anything yet, therefore there is no need to check
2046          * for incoming data.
2047          */
2048         return 1;
2049 
2050     for (;;) {
2051         assert(ch->qrx_pkt == NULL);
2052 
2053         if (!ossl_qrx_read_pkt(ch->qrx, &ch->qrx_pkt))
2054             break;
2055 
2056         /* Track the amount of data received while in the closing state */
2057         if (closing)
2058             ossl_quic_tx_packetiser_record_received_closing_bytes(
2059                     ch->txp, ch->qrx_pkt->hdr->len);
2060 
2061         if (!handled_any) {
2062             ch_update_idle(ch);
2063             ch_update_ping_deadline(ch);
2064         }
2065 
2066         ch_rx_handle_packet(ch, channel_only); /* best effort */
2067 
2068         /*
2069          * Regardless of the outcome of frame handling, unref the packet.
2070          * This will free the packet unless something added another
2071          * reference to it during frame processing.
2072          */
2073         ossl_qrx_pkt_release(ch->qrx_pkt);
2074         ch->qrx_pkt = NULL;
2075 
2076         ch->have_sent_ack_eliciting_since_rx = 0;
2077         handled_any = 1;
2078     }
2079 
2080     ch_rx_check_forged_pkt_limit(ch);
2081 
2082     /*
2083      * When in TERMINATING - CLOSING, generate a CONN_CLOSE frame whenever we
2084      * process one or more incoming packets.
2085      */
2086     if (handled_any && closing)
2087         ch->conn_close_queued = 1;
2088 
2089     return 1;
2090 }
2091 
bio_addr_eq(const BIO_ADDR * a,const BIO_ADDR * b)2092 static int bio_addr_eq(const BIO_ADDR *a, const BIO_ADDR *b)
2093 {
2094     if (BIO_ADDR_family(a) != BIO_ADDR_family(b))
2095         return 0;
2096 
2097     switch (BIO_ADDR_family(a)) {
2098         case AF_INET:
2099             return !memcmp(&a->s_in.sin_addr,
2100                            &b->s_in.sin_addr,
2101                            sizeof(a->s_in.sin_addr))
2102                 && a->s_in.sin_port == b->s_in.sin_port;
2103 #if OPENSSL_USE_IPV6
2104         case AF_INET6:
2105             return !memcmp(&a->s_in6.sin6_addr,
2106                            &b->s_in6.sin6_addr,
2107                            sizeof(a->s_in6.sin6_addr))
2108                 && a->s_in6.sin6_port == b->s_in6.sin6_port;
2109 #endif
2110         default:
2111             return 0; /* not supported */
2112     }
2113 
2114     return 1;
2115 }
2116 
2117 /* Handles the packet currently in ch->qrx_pkt->hdr. */
ch_rx_handle_packet(QUIC_CHANNEL * ch,int channel_only)2118 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only)
2119 {
2120     uint32_t enc_level;
2121     int old_have_processed_any_pkt = ch->have_processed_any_pkt;
2122     OSSL_QTX_IOVEC iovec;
2123 
2124     assert(ch->qrx_pkt != NULL);
2125 
2126     /*
2127      * RFC 9000 s. 10.2.1 Closing Connection State:
2128      *      An endpoint that is closing is not required to process any
2129      *      received frame.
2130      */
2131     if (!ossl_quic_channel_is_active(ch))
2132         return;
2133 
2134     if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)) {
2135         if (!ch->have_received_enc_pkt) {
2136             ch->cur_remote_dcid = ch->init_scid = ch->qrx_pkt->hdr->src_conn_id;
2137             ch->have_received_enc_pkt = 1;
2138 
2139             /*
2140              * We change to using the SCID in the first Initial packet as the
2141              * DCID.
2142              */
2143             ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->init_scid);
2144         }
2145 
2146         enc_level = ossl_quic_pkt_type_to_enc_level(ch->qrx_pkt->hdr->type);
2147         if ((ch->el_discarded & (1U << enc_level)) != 0)
2148             /* Do not process packets from ELs we have already discarded. */
2149             return;
2150     }
2151 
2152     /*
2153      * RFC 9000 s. 9.6: "If a client receives packets from a new server address
2154      * when the client has not initiated a migration to that address, the client
2155      * SHOULD discard these packets."
2156      *
2157      * We need to be a bit careful here as due to the BIO abstraction layer an
2158      * application is liable to be weird and lie to us about peer addresses.
2159      * Only apply this check if we actually are using a real AF_INET or AF_INET6
2160      * address.
2161      */
2162     if (!ch->is_server
2163         && ch->qrx_pkt->peer != NULL
2164         && (
2165                BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET
2166 #if OPENSSL_USE_IPV6
2167             || BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET6
2168 #endif
2169         )
2170         && !bio_addr_eq(ch->qrx_pkt->peer, &ch->cur_peer_addr))
2171         return;
2172 
2173     if (!ch->is_server
2174         && ch->have_received_enc_pkt
2175         && ossl_quic_pkt_type_has_scid(ch->qrx_pkt->hdr->type)) {
2176         /*
2177          * RFC 9000 s. 7.2: "Once a client has received a valid Initial packet
2178          * from the server, it MUST discard any subsequent packet it receives on
2179          * that connection with a different SCID."
2180          */
2181         if (!ossl_quic_conn_id_eq(&ch->qrx_pkt->hdr->src_conn_id,
2182                                   &ch->init_scid))
2183             return;
2184     }
2185 
2186     if (ossl_quic_pkt_type_has_version(ch->qrx_pkt->hdr->type)
2187         && ch->qrx_pkt->hdr->version != QUIC_VERSION_1)
2188         /*
2189          * RFC 9000 s. 5.2.1: If a client receives a packet that uses a
2190          * different version than it initially selected, it MUST discard the
2191          * packet. We only ever use v1, so require it.
2192          */
2193         return;
2194 
2195     ch->have_processed_any_pkt = 1;
2196 
2197     /*
2198      * RFC 9000 s. 17.2: "An endpoint MUST treat receipt of a packet that has a
2199      * non-zero value for [the reserved bits] after removing both packet and
2200      * header protection as a connection error of type PROTOCOL_VIOLATION."
2201      */
2202     if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)
2203         && ch->qrx_pkt->hdr->reserved != 0) {
2204         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2205                                                0, "packet header reserved bits");
2206         return;
2207     }
2208 
2209     iovec.buf       = ch->qrx_pkt->hdr->data;
2210     iovec.buf_len   = ch->qrx_pkt->hdr->len;
2211     ossl_qlog_event_transport_packet_received(ch_get_qlog(ch), ch->qrx_pkt->hdr,
2212                                               ch->qrx_pkt->pn, &iovec, 1,
2213                                               ch->qrx_pkt->datagram_id);
2214 
2215     /* Handle incoming packet. */
2216     switch (ch->qrx_pkt->hdr->type) {
2217     case QUIC_PKT_TYPE_RETRY:
2218         if (ch->doing_retry || ch->is_server)
2219             /*
2220              * It is not allowed to ask a client to do a retry more than
2221              * once. Clients may not send retries.
2222              */
2223             return;
2224 
2225         /*
2226          * RFC 9000 s 17.2.5.2: After the client has received and processed an
2227          * Initial or Retry packet from the server, it MUST discard any
2228          * subsequent Retry packets that it receives.
2229          */
2230         if (ch->have_received_enc_pkt)
2231             return;
2232 
2233         if (ch->qrx_pkt->hdr->len <= QUIC_RETRY_INTEGRITY_TAG_LEN)
2234             /* Packets with zero-length Retry Tokens are invalid. */
2235             return;
2236 
2237         /*
2238          * TODO(QUIC FUTURE): Theoretically this should probably be in the QRX.
2239          * However because validation is dependent on context (namely the
2240          * client's initial DCID) we can't do this cleanly. In the future we
2241          * should probably add a callback to the QRX to let it call us (via
2242          * the DEMUX) and ask us about the correct original DCID, rather
2243          * than allow the QRX to emit a potentially malformed packet to the
2244          * upper layers. However, special casing this will do for now.
2245          */
2246         if (!ossl_quic_validate_retry_integrity_tag(ch->port->engine->libctx,
2247                                                     ch->port->engine->propq,
2248                                                     ch->qrx_pkt->hdr,
2249                                                     &ch->init_dcid))
2250             /* Malformed retry packet, ignore. */
2251             return;
2252 
2253         if (!ch_retry(ch, ch->qrx_pkt->hdr->data,
2254                       ch->qrx_pkt->hdr->len - QUIC_RETRY_INTEGRITY_TAG_LEN,
2255                       &ch->qrx_pkt->hdr->src_conn_id))
2256             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR,
2257                                                    0, "handling retry packet");
2258         break;
2259 
2260     case QUIC_PKT_TYPE_0RTT:
2261         if (!ch->is_server)
2262             /* Clients should never receive 0-RTT packets. */
2263             return;
2264 
2265         /*
2266          * TODO(QUIC 0RTT): Implement 0-RTT on the server side. We currently
2267          * do not need to implement this as a client can only do 0-RTT if we
2268          * have given it permission to in a previous session.
2269          */
2270         break;
2271 
2272     case QUIC_PKT_TYPE_INITIAL:
2273     case QUIC_PKT_TYPE_HANDSHAKE:
2274     case QUIC_PKT_TYPE_1RTT:
2275         if (ch->is_server && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_HANDSHAKE)
2276             /*
2277              * We automatically drop INITIAL EL keys when first successfully
2278              * decrypting a HANDSHAKE packet, as per the RFC.
2279              */
2280             ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
2281 
2282         if (ch->rxku_in_progress
2283             && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_1RTT
2284             && ch->qrx_pkt->pn >= ch->rxku_trigger_pn
2285             && ch->qrx_pkt->key_epoch < ossl_qrx_get_key_epoch(ch->qrx)) {
2286             /*
2287              * RFC 9001 s. 6.4: Packets with higher packet numbers MUST be
2288              * protected with either the same or newer packet protection keys
2289              * than packets with lower packet numbers. An endpoint that
2290              * successfully removes protection with old keys when newer keys
2291              * were used for packets with lower packet numbers MUST treat this
2292              * as a connection error of type KEY_UPDATE_ERROR.
2293              */
2294             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR,
2295                                                    0, "new packet with old keys");
2296             break;
2297         }
2298 
2299         if (!ch->is_server
2300             && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_INITIAL
2301             && ch->qrx_pkt->hdr->token_len > 0) {
2302             /*
2303              * RFC 9000 s. 17.2.2: Clients that receive an Initial packet with a
2304              * non-zero Token Length field MUST either discard the packet or
2305              * generate a connection error of type PROTOCOL_VIOLATION.
2306              *
2307              * TODO(QUIC FUTURE): consider the implications of RFC 9000 s. 10.2.3
2308              * Immediate Close during the Handshake:
2309              *      However, at the cost of reducing feedback about
2310              *      errors for legitimate peers, some forms of denial of
2311              *      service can be made more difficult for an attacker
2312              *      if endpoints discard illegal packets rather than
2313              *      terminating a connection with CONNECTION_CLOSE. For
2314              *      this reason, endpoints MAY discard packets rather
2315              *      than immediately close if errors are detected in
2316              *      packets that lack authentication.
2317              * I.e. should we drop this packet instead of closing the connection?
2318              */
2319             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2320                                                    0, "client received initial token");
2321             break;
2322         }
2323 
2324         /* This packet contains frames, pass to the RXDP. */
2325         ossl_quic_handle_frames(ch, ch->qrx_pkt); /* best effort */
2326 
2327         if (ch->did_crypto_frame)
2328             ch_tick_tls(ch, channel_only);
2329 
2330         break;
2331 
2332     case QUIC_PKT_TYPE_VERSION_NEG:
2333         /*
2334          * "A client MUST discard any Version Negotiation packet if it has
2335          * received and successfully processed any other packet."
2336          */
2337         if (!old_have_processed_any_pkt)
2338             ch_rx_handle_version_neg(ch, ch->qrx_pkt);
2339 
2340         break;
2341 
2342     default:
2343         assert(0);
2344         break;
2345     }
2346 }
2347 
ch_rx_handle_version_neg(QUIC_CHANNEL * ch,OSSL_QRX_PKT * pkt)2348 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt)
2349 {
2350     /*
2351      * We do not support version negotiation at this time. As per RFC 9000 s.
2352      * 6.2., we MUST abandon the connection attempt if we receive a Version
2353      * Negotiation packet, unless we have already successfully processed another
2354      * incoming packet, or the packet lists the QUIC version we want to use.
2355      */
2356     PACKET vpkt;
2357     unsigned long v;
2358 
2359     if (!PACKET_buf_init(&vpkt, pkt->hdr->data, pkt->hdr->len))
2360         return;
2361 
2362     while (PACKET_remaining(&vpkt) > 0) {
2363         if (!PACKET_get_net_4(&vpkt, &v))
2364             break;
2365 
2366         if ((uint32_t)v == QUIC_VERSION_1)
2367             return;
2368     }
2369 
2370     /* No match, this is a failure case. */
2371     ch_raise_version_neg_failure(ch);
2372 }
2373 
ch_raise_version_neg_failure(QUIC_CHANNEL * ch)2374 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch)
2375 {
2376     QUIC_TERMINATE_CAUSE tcause = {0};
2377 
2378     tcause.error_code = OSSL_QUIC_ERR_CONNECTION_REFUSED;
2379     tcause.reason     = "version negotiation failure";
2380     tcause.reason_len = strlen(tcause.reason);
2381 
2382     /*
2383      * Skip TERMINATING state; this is not considered a protocol error and we do
2384      * not send CONNECTION_CLOSE.
2385      */
2386     ch_start_terminating(ch, &tcause, 1);
2387 }
2388 
2389 /* Try to generate packets and if possible, flush them to the network. */
ch_tx(QUIC_CHANNEL * ch)2390 static int ch_tx(QUIC_CHANNEL *ch)
2391 {
2392     QUIC_TXP_STATUS status;
2393     int res;
2394 
2395     /*
2396      * RFC 9000 s. 10.2.2: Draining Connection State:
2397      *      While otherwise identical to the closing state, an endpoint
2398      *      in the draining state MUST NOT send any packets.
2399      * and:
2400      *      An endpoint MUST NOT send further packets.
2401      */
2402     if (ossl_quic_channel_is_draining(ch))
2403         return 0;
2404 
2405     if (ossl_quic_channel_is_closing(ch)) {
2406         /*
2407          * While closing, only send CONN_CLOSE if we've received more traffic
2408          * from the peer. Once we tell the TXP to generate CONN_CLOSE, all
2409          * future calls to it generate CONN_CLOSE frames, so otherwise we would
2410          * just constantly generate CONN_CLOSE frames.
2411          *
2412          * Confirming to RFC 9000 s. 10.2.1 Closing Connection State:
2413          *      An endpoint SHOULD limit the rate at which it generates
2414          *      packets in the closing state.
2415          */
2416         if (!ch->conn_close_queued)
2417             return 0;
2418 
2419         ch->conn_close_queued = 0;
2420     }
2421 
2422     /* Do TXKU if we need to. */
2423     ch_maybe_trigger_spontaneous_txku(ch);
2424 
2425     ch->rxku_pending_confirm_done = 0;
2426 
2427     /* Loop until we stop generating packets to send */
2428     do {
2429         /*
2430         * Send packet, if we need to. Best effort. The TXP consults the CC and
2431         * applies any limitations imposed by it, so we don't need to do it here.
2432         *
2433         * Best effort. In particular if TXP fails for some reason we should
2434         * still flush any queued packets which we already generated.
2435         */
2436         res = ossl_quic_tx_packetiser_generate(ch->txp, &status);
2437         if (status.sent_pkt > 0) {
2438             ch->have_sent_any_pkt = 1; /* Packet(s) were sent */
2439             ch->port->have_sent_any_pkt = 1;
2440 
2441             /*
2442             * RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when
2443             * sending an ack-eliciting packet if no other ack-eliciting packets
2444             * have been sent since last receiving and processing a packet.'
2445             */
2446             if (status.sent_ack_eliciting
2447                     && !ch->have_sent_ack_eliciting_since_rx) {
2448                 ch_update_idle(ch);
2449                 ch->have_sent_ack_eliciting_since_rx = 1;
2450             }
2451 
2452             if (!ch->is_server && status.sent_handshake)
2453                 /*
2454                 * RFC 9001 s. 4.9.1: A client MUST discard Initial keys when it
2455                 * first sends a Handshake packet.
2456                 */
2457                 ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
2458 
2459             if (ch->rxku_pending_confirm_done)
2460                 ch->rxku_pending_confirm = 0;
2461 
2462             ch_update_ping_deadline(ch);
2463         }
2464 
2465         if (!res) {
2466             /*
2467             * One case where TXP can fail is if we reach a TX PN of 2**62 - 1.
2468             * As per RFC 9000 s. 12.3, if this happens we MUST close the
2469             * connection without sending a CONNECTION_CLOSE frame. This is
2470             * actually handled as an emergent consequence of our design, as the
2471             * TX packetiser will never transmit another packet when the TX PN
2472             * reaches the limit.
2473             *
2474             * Calling the below function terminates the connection; its attempt
2475             * to schedule a CONNECTION_CLOSE frame will not actually cause a
2476             * packet to be transmitted for this reason.
2477             */
2478             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR,
2479                                                    0,
2480                                                    "internal error (txp generate)");
2481             break;
2482         }
2483     } while (status.sent_pkt > 0);
2484 
2485     /* Flush packets to network. */
2486     switch (ossl_qtx_flush_net(ch->qtx)) {
2487     case QTX_FLUSH_NET_RES_OK:
2488     case QTX_FLUSH_NET_RES_TRANSIENT_FAIL:
2489         /* Best effort, done for now. */
2490         break;
2491 
2492     case QTX_FLUSH_NET_RES_PERMANENT_FAIL:
2493     default:
2494         /* Permanent underlying network BIO, start terminating. */
2495         ossl_quic_port_raise_net_error(ch->port, ch);
2496         break;
2497     }
2498 
2499     return 1;
2500 }
2501 
2502 /* Determine next tick deadline. */
ch_determine_next_tick_deadline(QUIC_CHANNEL * ch)2503 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch)
2504 {
2505     OSSL_TIME deadline;
2506     int i;
2507 
2508     if (ossl_quic_channel_is_terminated(ch))
2509         return ossl_time_infinite();
2510 
2511     deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
2512     if (ossl_time_is_zero(deadline))
2513         deadline = ossl_time_infinite();
2514 
2515     /*
2516      * Check the ack deadline for all enc_levels that are actually provisioned.
2517      * ACKs aren't restricted by CC.
2518      */
2519     for (i = 0; i < QUIC_ENC_LEVEL_NUM; i++) {
2520         if (ossl_qtx_is_enc_level_provisioned(ch->qtx, i)) {
2521             deadline = ossl_time_min(deadline,
2522                                      ossl_ackm_get_ack_deadline(ch->ackm,
2523                                                                 ossl_quic_enc_level_to_pn_space(i)));
2524         }
2525     }
2526 
2527     /*
2528      * When do we need to send an ACK-eliciting packet to reset the idle
2529      * deadline timer for the peer?
2530      */
2531     if (!ossl_time_is_infinite(ch->ping_deadline))
2532         deadline = ossl_time_min(deadline, ch->ping_deadline);
2533 
2534     /* Apply TXP wakeup deadline. */
2535     deadline = ossl_time_min(deadline,
2536                              ossl_quic_tx_packetiser_get_deadline(ch->txp));
2537 
2538     /* Is the terminating timer armed? */
2539     if (ossl_quic_channel_is_terminating(ch))
2540         deadline = ossl_time_min(deadline,
2541                                  ch->terminate_deadline);
2542     else if (!ossl_time_is_infinite(ch->idle_deadline))
2543         deadline = ossl_time_min(deadline,
2544                                  ch->idle_deadline);
2545 
2546     /* When does the RXKU process complete? */
2547     if (ch->rxku_in_progress)
2548         deadline = ossl_time_min(deadline, ch->rxku_update_end_deadline);
2549 
2550     return deadline;
2551 }
2552 
2553 /*
2554  * QUIC Channel: Lifecycle Events
2555  * ==============================
2556  */
2557 
2558 /*
2559  * Record a state transition. This is not necessarily a change to ch->state but
2560  * also includes the handshake becoming complete or confirmed, etc.
2561  */
ch_record_state_transition(QUIC_CHANNEL * ch,uint32_t new_state)2562 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state)
2563 {
2564     uint32_t old_state = ch->state;
2565 
2566     ch->state = new_state;
2567 
2568     ossl_qlog_event_connectivity_connection_state_updated(ch_get_qlog(ch),
2569                                                           old_state,
2570                                                           new_state,
2571                                                           ch->handshake_complete,
2572                                                           ch->handshake_confirmed);
2573 }
2574 
ossl_quic_channel_start(QUIC_CHANNEL * ch)2575 int ossl_quic_channel_start(QUIC_CHANNEL *ch)
2576 {
2577     if (ch->is_server)
2578         /*
2579          * This is not used by the server. The server moves to active
2580          * automatically on receiving an incoming connection.
2581          */
2582         return 0;
2583 
2584     if (ch->state != QUIC_CHANNEL_STATE_IDLE)
2585         /* Calls to connect are idempotent */
2586         return 1;
2587 
2588     /* Inform QTX of peer address. */
2589     if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr))
2590         return 0;
2591 
2592     /* Plug in secrets for the Initial EL. */
2593     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
2594                                           ch->port->engine->propq,
2595                                           &ch->init_dcid,
2596                                           ch->is_server,
2597                                           ch->qrx, ch->qtx))
2598         return 0;
2599 
2600     /*
2601      * Determine the QUIC Transport Parameters and serialize the transport
2602      * parameters block. (For servers, we do this later as we must defer
2603      * generation until we have received the client's transport parameters.)
2604      */
2605     if (!ch->is_server && !ch->got_local_transport_params
2606         && !ch_generate_transport_params(ch))
2607         return 0;
2608 
2609     /* Change state. */
2610     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
2611     ch->doing_proactive_ver_neg = 0; /* not currently supported */
2612 
2613     ossl_qlog_event_connectivity_connection_started(ch_get_qlog(ch),
2614                                                     &ch->init_dcid);
2615 
2616     /* Handshake layer: start (e.g. send CH). */
2617     if (!ch_tick_tls(ch, /*channel_only=*/0))
2618         return 0;
2619 
2620     ossl_quic_reactor_tick(ossl_quic_port_get0_reactor(ch->port), 0); /* best effort */
2621     return 1;
2622 }
2623 
2624 /* Start a locally initiated connection shutdown. */
ossl_quic_channel_local_close(QUIC_CHANNEL * ch,uint64_t app_error_code,const char * app_reason)2625 void ossl_quic_channel_local_close(QUIC_CHANNEL *ch, uint64_t app_error_code,
2626                                    const char *app_reason)
2627 {
2628     QUIC_TERMINATE_CAUSE tcause = {0};
2629 
2630     if (ossl_quic_channel_is_term_any(ch))
2631         return;
2632 
2633     tcause.app          = 1;
2634     tcause.error_code   = app_error_code;
2635     tcause.reason       = app_reason;
2636     tcause.reason_len   = app_reason != NULL ? strlen(app_reason) : 0;
2637     ch_start_terminating(ch, &tcause, 0);
2638 }
2639 
free_token(const unsigned char * buf,size_t buf_len,void * arg)2640 static void free_token(const unsigned char *buf, size_t buf_len, void *arg)
2641 {
2642     OPENSSL_free((unsigned char *)buf);
2643 }
2644 
2645 /* Called when a server asks us to do a retry. */
ch_retry(QUIC_CHANNEL * ch,const unsigned char * retry_token,size_t retry_token_len,const QUIC_CONN_ID * retry_scid)2646 static int ch_retry(QUIC_CHANNEL *ch,
2647                     const unsigned char *retry_token,
2648                     size_t retry_token_len,
2649                     const QUIC_CONN_ID *retry_scid)
2650 {
2651     void *buf;
2652 
2653     /*
2654      * RFC 9000 s. 17.2.5.1: "A client MUST discard a Retry packet that contains
2655      * a SCID field that is identical to the DCID field of its initial packet."
2656      */
2657     if (ossl_quic_conn_id_eq(&ch->init_dcid, retry_scid))
2658         return 1;
2659 
2660     /* We change to using the SCID in the Retry packet as the DCID. */
2661     if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, retry_scid))
2662         return 0;
2663 
2664     /*
2665      * Now we retry. We will release the Retry packet immediately, so copy
2666      * the token.
2667      */
2668     if ((buf = OPENSSL_memdup(retry_token, retry_token_len)) == NULL)
2669         return 0;
2670 
2671     if (!ossl_quic_tx_packetiser_set_initial_token(ch->txp, buf,
2672                                                    retry_token_len,
2673                                                    free_token, NULL)) {
2674         /*
2675          * This may fail if the token we receive is too big for us to ever be
2676          * able to transmit in an outgoing Initial packet.
2677          */
2678         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INVALID_TOKEN, 0,
2679                                                "received oversize token");
2680         OPENSSL_free(buf);
2681         return 0;
2682     }
2683 
2684     ch->retry_scid  = *retry_scid;
2685     ch->doing_retry = 1;
2686 
2687     /*
2688      * We need to stimulate the Initial EL to generate the first CRYPTO frame
2689      * again. We can do this most cleanly by simply forcing the ACKM to consider
2690      * the first Initial packet as lost, which it effectively was as the server
2691      * hasn't processed it. This also maintains the desired behaviour with e.g.
2692      * PNs not resetting and so on.
2693      *
2694      * The PN we used initially is always zero, because QUIC does not allow
2695      * repeated retries.
2696      */
2697     if (!ossl_ackm_mark_packet_pseudo_lost(ch->ackm, QUIC_PN_SPACE_INITIAL,
2698                                            /*PN=*/0))
2699         return 0;
2700 
2701     /*
2702      * Plug in new secrets for the Initial EL. This is the only time we change
2703      * the secrets for an EL after we already provisioned it.
2704      */
2705     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
2706                                           ch->port->engine->propq,
2707                                           &ch->retry_scid,
2708                                           /*is_server=*/0,
2709                                           ch->qrx, ch->qtx))
2710         return 0;
2711 
2712     return 1;
2713 }
2714 
2715 /* Called when an EL is to be discarded. */
ch_discard_el(QUIC_CHANNEL * ch,uint32_t enc_level)2716 static int ch_discard_el(QUIC_CHANNEL *ch,
2717                          uint32_t enc_level)
2718 {
2719     if (!ossl_assert(enc_level < QUIC_ENC_LEVEL_1RTT))
2720         return 0;
2721 
2722     if ((ch->el_discarded & (1U << enc_level)) != 0)
2723         /* Already done. */
2724         return 1;
2725 
2726     /* Best effort for all of these. */
2727     ossl_quic_tx_packetiser_discard_enc_level(ch->txp, enc_level);
2728     ossl_qrx_discard_enc_level(ch->qrx, enc_level);
2729     ossl_qtx_discard_enc_level(ch->qtx, enc_level);
2730 
2731     if (enc_level != QUIC_ENC_LEVEL_0RTT) {
2732         uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
2733 
2734         ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
2735 
2736         /* We should still have crypto streams at this point. */
2737         if (!ossl_assert(ch->crypto_send[pn_space] != NULL)
2738             || !ossl_assert(ch->crypto_recv[pn_space] != NULL))
2739             return 0;
2740 
2741         /* Get rid of the crypto stream state for the EL. */
2742         ossl_quic_sstream_free(ch->crypto_send[pn_space]);
2743         ch->crypto_send[pn_space] = NULL;
2744 
2745         ossl_quic_rstream_free(ch->crypto_recv[pn_space]);
2746         ch->crypto_recv[pn_space] = NULL;
2747     }
2748 
2749     ch->el_discarded |= (1U << enc_level);
2750     return 1;
2751 }
2752 
2753 /* Intended to be called by the RXDP. */
ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL * ch)2754 int ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL *ch)
2755 {
2756     if (ch->handshake_confirmed)
2757         return 1;
2758 
2759     if (!ch->handshake_complete) {
2760         /*
2761          * Does not make sense for handshake to be confirmed before it is
2762          * completed.
2763          */
2764         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2765                                                OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE,
2766                                                "handshake cannot be confirmed "
2767                                                "before it is completed");
2768         return 0;
2769     }
2770 
2771     ch_discard_el(ch, QUIC_ENC_LEVEL_HANDSHAKE);
2772     ch->handshake_confirmed = 1;
2773     ch_record_state_transition(ch, ch->state);
2774     ossl_ackm_on_handshake_confirmed(ch->ackm);
2775     return 1;
2776 }
2777 
2778 /*
2779  * Master function used when we want to start tearing down a connection:
2780  *
2781  *   - If the connection is still IDLE we can go straight to TERMINATED;
2782  *
2783  *   - If we are already TERMINATED this is a no-op.
2784  *
2785  *   - If we are TERMINATING - CLOSING and we have now got a CONNECTION_CLOSE
2786  *     from the peer (tcause->remote == 1), we move to TERMINATING - DRAINING.
2787  *
2788  *   - If we are TERMINATING - DRAINING, we remain here until the terminating
2789  *     timer expires.
2790  *
2791  *   - Otherwise, we are in ACTIVE and move to TERMINATING - CLOSING.
2792  *     if we caused the termination (e.g. we have sent a CONNECTION_CLOSE). Note
2793  *     that we are considered to have caused a termination if we sent the first
2794  *     CONNECTION_CLOSE frame, even if it is caused by a peer protocol
2795  *     violation. If the peer sent the first CONNECTION_CLOSE frame, we move to
2796  *     TERMINATING - DRAINING.
2797  *
2798  * We record the termination cause structure passed on the first call only.
2799  * Any successive calls have their termination cause data discarded;
2800  * once we start sending a CONNECTION_CLOSE frame, we don't change the details
2801  * in it.
2802  *
2803  * This conforms to RFC 9000 s. 10.2.1: Closing Connection State:
2804  *      To minimize the state that an endpoint maintains for a closing
2805  *      connection, endpoints MAY send the exact same packet in response
2806  *      to any received packet.
2807  *
2808  * We don't drop any connection state (specifically packet protection keys)
2809  * even though we are permitted to.  This conforms to RFC 9000 s. 10.2.1:
2810  * Closing Connection State:
2811  *       An endpoint MAY retain packet protection keys for incoming
2812  *       packets to allow it to read and process a CONNECTION_CLOSE frame.
2813  *
2814  * Note that we do not conform to these two from the same section:
2815  *      An endpoint's selected connection ID and the QUIC version
2816  *      are sufficient information to identify packets for a closing
2817  *      connection; the endpoint MAY discard all other connection state.
2818  * and:
2819  *      An endpoint MAY drop packet protection keys when entering the
2820  *      closing state and send a packet containing a CONNECTION_CLOSE
2821  *      frame in response to any UDP datagram that is received.
2822  */
copy_tcause(QUIC_TERMINATE_CAUSE * dst,const QUIC_TERMINATE_CAUSE * src)2823 static void copy_tcause(QUIC_TERMINATE_CAUSE *dst,
2824                         const QUIC_TERMINATE_CAUSE *src)
2825 {
2826     dst->error_code = src->error_code;
2827     dst->frame_type = src->frame_type;
2828     dst->app        = src->app;
2829     dst->remote     = src->remote;
2830 
2831     dst->reason     = NULL;
2832     dst->reason_len = 0;
2833 
2834     if (src->reason != NULL && src->reason_len > 0) {
2835         size_t l = src->reason_len;
2836         char *r;
2837 
2838         if (l >= SIZE_MAX)
2839             --l;
2840 
2841         /*
2842          * If this fails, dst->reason becomes NULL and we simply do not use a
2843          * reason. This ensures termination is infallible.
2844          */
2845         dst->reason = r = OPENSSL_memdup(src->reason, l + 1);
2846         if (r == NULL)
2847             return;
2848 
2849         r[l]  = '\0';
2850         dst->reason_len = l;
2851     }
2852 }
2853 
ch_start_terminating(QUIC_CHANNEL * ch,const QUIC_TERMINATE_CAUSE * tcause,int force_immediate)2854 static void ch_start_terminating(QUIC_CHANNEL *ch,
2855                                  const QUIC_TERMINATE_CAUSE *tcause,
2856                                  int force_immediate)
2857 {
2858     /* No point sending anything if we haven't sent anything yet. */
2859     if (!ch->have_sent_any_pkt)
2860         force_immediate = 1;
2861 
2862     switch (ch->state) {
2863     default:
2864     case QUIC_CHANNEL_STATE_IDLE:
2865         copy_tcause(&ch->terminate_cause, tcause);
2866         ch_on_terminating_timeout(ch);
2867         break;
2868 
2869     case QUIC_CHANNEL_STATE_ACTIVE:
2870         copy_tcause(&ch->terminate_cause, tcause);
2871 
2872         ossl_qlog_event_connectivity_connection_closed(ch_get_qlog(ch), tcause);
2873 
2874         if (!force_immediate) {
2875             ch_record_state_transition(ch, tcause->remote
2876                                            ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
2877                                            : QUIC_CHANNEL_STATE_TERMINATING_CLOSING);
2878             /*
2879              * RFC 9000 s. 10.2 Immediate Close
2880              *  These states SHOULD persist for at least three times
2881              *  the current PTO interval as defined in [QUIC-RECOVERY].
2882              */
2883             ch->terminate_deadline
2884                 = ossl_time_add(get_time(ch),
2885                                 ossl_time_multiply(ossl_ackm_get_pto_duration(ch->ackm),
2886                                                    3));
2887 
2888             if (!tcause->remote) {
2889                 OSSL_QUIC_FRAME_CONN_CLOSE f = {0};
2890 
2891                 /* best effort */
2892                 f.error_code = ch->terminate_cause.error_code;
2893                 f.frame_type = ch->terminate_cause.frame_type;
2894                 f.is_app     = ch->terminate_cause.app;
2895                 f.reason     = (char *)ch->terminate_cause.reason;
2896                 f.reason_len = ch->terminate_cause.reason_len;
2897                 ossl_quic_tx_packetiser_schedule_conn_close(ch->txp, &f);
2898                 /*
2899                  * RFC 9000 s. 10.2.2 Draining Connection State:
2900                  *  An endpoint that receives a CONNECTION_CLOSE frame MAY
2901                  *  send a single packet containing a CONNECTION_CLOSE
2902                  *  frame before entering the draining state, using a
2903                  *  NO_ERROR code if appropriate
2904                  */
2905                 ch->conn_close_queued = 1;
2906             }
2907         } else {
2908             ch_on_terminating_timeout(ch);
2909         }
2910         break;
2911 
2912     case QUIC_CHANNEL_STATE_TERMINATING_CLOSING:
2913         if (force_immediate)
2914             ch_on_terminating_timeout(ch);
2915         else if (tcause->remote)
2916             /*
2917              * RFC 9000 s. 10.2.2 Draining Connection State:
2918              *  An endpoint MAY enter the draining state from the
2919              *  closing state if it receives a CONNECTION_CLOSE frame,
2920              *  which indicates that the peer is also closing or draining.
2921              */
2922             ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATING_DRAINING);
2923 
2924         break;
2925 
2926     case QUIC_CHANNEL_STATE_TERMINATING_DRAINING:
2927         /*
2928          * Other than in the force-immediate case, we remain here until the
2929          * timeout expires.
2930          */
2931         if (force_immediate)
2932             ch_on_terminating_timeout(ch);
2933 
2934         break;
2935 
2936     case QUIC_CHANNEL_STATE_TERMINATED:
2937         /* No-op. */
2938         break;
2939     }
2940 }
2941 
2942 /* For RXDP use. */
ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL * ch,OSSL_QUIC_FRAME_CONN_CLOSE * f)2943 void ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL *ch,
2944                                             OSSL_QUIC_FRAME_CONN_CLOSE *f)
2945 {
2946     QUIC_TERMINATE_CAUSE tcause = {0};
2947 
2948     if (!ossl_quic_channel_is_active(ch))
2949         return;
2950 
2951     tcause.remote     = 1;
2952     tcause.app        = f->is_app;
2953     tcause.error_code = f->error_code;
2954     tcause.frame_type = f->frame_type;
2955     tcause.reason     = f->reason;
2956     tcause.reason_len = f->reason_len;
2957     ch_start_terminating(ch, &tcause, 0);
2958 }
2959 
free_frame_data(unsigned char * buf,size_t buf_len,void * arg)2960 static void free_frame_data(unsigned char *buf, size_t buf_len, void *arg)
2961 {
2962     OPENSSL_free(buf);
2963 }
2964 
ch_enqueue_retire_conn_id(QUIC_CHANNEL * ch,uint64_t seq_num)2965 static int ch_enqueue_retire_conn_id(QUIC_CHANNEL *ch, uint64_t seq_num)
2966 {
2967     BUF_MEM *buf_mem = NULL;
2968     WPACKET wpkt;
2969     size_t l;
2970 
2971     ossl_quic_srtm_remove(ch->srtm, ch, seq_num);
2972 
2973     if ((buf_mem = BUF_MEM_new()) == NULL)
2974         goto err;
2975 
2976     if (!WPACKET_init(&wpkt, buf_mem))
2977         goto err;
2978 
2979     if (!ossl_quic_wire_encode_frame_retire_conn_id(&wpkt, seq_num)) {
2980         WPACKET_cleanup(&wpkt);
2981         goto err;
2982     }
2983 
2984     WPACKET_finish(&wpkt);
2985     if (!WPACKET_get_total_written(&wpkt, &l))
2986         goto err;
2987 
2988     if (ossl_quic_cfq_add_frame(ch->cfq, 1, QUIC_PN_SPACE_APP,
2989                                 OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID, 0,
2990                                 (unsigned char *)buf_mem->data, l,
2991                                 free_frame_data, NULL) == NULL)
2992         goto err;
2993 
2994     buf_mem->data = NULL;
2995     BUF_MEM_free(buf_mem);
2996     return 1;
2997 
2998 err:
2999     ossl_quic_channel_raise_protocol_error(ch,
3000                                            OSSL_QUIC_ERR_INTERNAL_ERROR,
3001                                            OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3002                                            "internal error enqueueing retire conn id");
3003     BUF_MEM_free(buf_mem);
3004     return 0;
3005 }
3006 
ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL * ch,OSSL_QUIC_FRAME_NEW_CONN_ID * f)3007 void ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL *ch,
3008                                       OSSL_QUIC_FRAME_NEW_CONN_ID *f)
3009 {
3010     uint64_t new_remote_seq_num = ch->cur_remote_seq_num;
3011     uint64_t new_retire_prior_to = ch->cur_retire_prior_to;
3012 
3013     if (!ossl_quic_channel_is_active(ch))
3014         return;
3015 
3016     /* We allow only two active connection ids; first check some constraints */
3017     if (ch->cur_remote_dcid.id_len == 0) {
3018         /* Changing from 0 length connection id is disallowed */
3019         ossl_quic_channel_raise_protocol_error(ch,
3020                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
3021                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3022                                                "zero length connection id in use");
3023 
3024         return;
3025     }
3026 
3027     if (f->seq_num > new_remote_seq_num)
3028         new_remote_seq_num = f->seq_num;
3029     if (f->retire_prior_to > new_retire_prior_to)
3030         new_retire_prior_to = f->retire_prior_to;
3031 
3032     /*
3033      * RFC 9000-5.1.1: An endpoint MUST NOT provide more connection IDs
3034      * than the peer's limit.
3035      *
3036      * After processing a NEW_CONNECTION_ID frame and adding and retiring
3037      * active connection IDs, if the number of active connection IDs exceeds
3038      * the value advertised in its active_connection_id_limit transport
3039      * parameter, an endpoint MUST close the connection with an error of
3040      * type CONNECTION_ID_LIMIT_ERROR.
3041      */
3042     if (new_remote_seq_num - new_retire_prior_to > 1) {
3043         ossl_quic_channel_raise_protocol_error(ch,
3044                                                OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3045                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3046                                                "active_connection_id limit violated");
3047         return;
3048     }
3049 
3050     /*
3051      * RFC 9000-5.1.1: An endpoint MAY send connection IDs that temporarily
3052      * exceed a peer's limit if the NEW_CONNECTION_ID frame also requires
3053      * the retirement of any excess, by including a sufficiently large
3054      * value in the Retire Prior To field.
3055      *
3056      * RFC 9000-5.1.2: An endpoint SHOULD allow for sending and tracking
3057      * a number of RETIRE_CONNECTION_ID frames of at least twice the value
3058      * of the active_connection_id_limit transport parameter.  An endpoint
3059      * MUST NOT forget a connection ID without retiring it, though it MAY
3060      * choose to treat having connection IDs in need of retirement that
3061      * exceed this limit as a connection error of type CONNECTION_ID_LIMIT_ERROR.
3062      *
3063      * We are a little bit more liberal than the minimum mandated.
3064      */
3065     if (new_retire_prior_to - ch->cur_retire_prior_to > 10) {
3066         ossl_quic_channel_raise_protocol_error(ch,
3067                                                OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3068                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3069                                                "retiring connection id limit violated");
3070 
3071         return;
3072     }
3073 
3074     if (new_remote_seq_num > ch->cur_remote_seq_num) {
3075         /* Add new stateless reset token */
3076         if (!ossl_quic_srtm_add(ch->srtm, ch, new_remote_seq_num,
3077                                 &f->stateless_reset)) {
3078             ossl_quic_channel_raise_protocol_error(
3079                     ch, OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3080                     OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3081                     "unable to store stateless reset token");
3082 
3083             return;
3084         }
3085         ch->cur_remote_seq_num = new_remote_seq_num;
3086         ch->cur_remote_dcid = f->conn_id;
3087         ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid);
3088     }
3089 
3090     /*
3091      * RFC 9000-5.1.2: Upon receipt of an increased Retire Prior To
3092      * field, the peer MUST stop using the corresponding connection IDs
3093      * and retire them with RETIRE_CONNECTION_ID frames before adding the
3094      * newly provided connection ID to the set of active connection IDs.
3095      */
3096 
3097     /*
3098      * Note: RFC 9000 s. 19.15 says:
3099      *   "An endpoint that receives a NEW_CONNECTION_ID frame with a sequence
3100      *    number smaller than the Retire Prior To field of a previously received
3101      *    NEW_CONNECTION_ID frame MUST send a corresponding
3102      *    RETIRE_CONNECTION_ID frame that retires the newly received connection
3103      *    ID, unless it has already done so for that sequence number."
3104      *
3105      * Since we currently always queue RETIRE_CONN_ID frames based on the Retire
3106      * Prior To field of a NEW_CONNECTION_ID frame immediately upon receiving
3107      * that NEW_CONNECTION_ID frame, by definition this will always be met.
3108      * This may change in future when we change our CID handling.
3109      */
3110     while (new_retire_prior_to > ch->cur_retire_prior_to) {
3111         if (!ch_enqueue_retire_conn_id(ch, ch->cur_retire_prior_to))
3112             break;
3113         ++ch->cur_retire_prior_to;
3114     }
3115 }
3116 
ch_save_err_state(QUIC_CHANNEL * ch)3117 static void ch_save_err_state(QUIC_CHANNEL *ch)
3118 {
3119     if (ch->err_state == NULL)
3120         ch->err_state = OSSL_ERR_STATE_new();
3121 
3122     if (ch->err_state == NULL)
3123         return;
3124 
3125     OSSL_ERR_STATE_save(ch->err_state);
3126 }
3127 
ossl_quic_channel_inject(QUIC_CHANNEL * ch,QUIC_URXE * e)3128 void ossl_quic_channel_inject(QUIC_CHANNEL *ch, QUIC_URXE *e)
3129 {
3130     ossl_qrx_inject_urxe(ch->qrx, e);
3131 }
3132 
ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL * ch)3133 void ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL *ch)
3134 {
3135     QUIC_TERMINATE_CAUSE tcause = {0};
3136 
3137     tcause.error_code   = OSSL_QUIC_ERR_NO_ERROR;
3138     tcause.remote       = 1;
3139     ch_start_terminating(ch, &tcause, 0);
3140 }
3141 
ossl_quic_channel_raise_net_error(QUIC_CHANNEL * ch)3142 void ossl_quic_channel_raise_net_error(QUIC_CHANNEL *ch)
3143 {
3144     QUIC_TERMINATE_CAUSE tcause = {0};
3145 
3146     if (ch->net_error)
3147         return;
3148 
3149     ch->net_error = 1;
3150 
3151     tcause.error_code = OSSL_QUIC_ERR_INTERNAL_ERROR;
3152     tcause.reason     = "network BIO I/O error";
3153     tcause.reason_len = strlen(tcause.reason);
3154 
3155     /*
3156      * Skip Terminating state and go directly to Terminated, no point trying to
3157      * send CONNECTION_CLOSE if we cannot communicate.
3158      */
3159     ch_start_terminating(ch, &tcause, 1);
3160 }
3161 
ossl_quic_channel_net_error(QUIC_CHANNEL * ch)3162 int ossl_quic_channel_net_error(QUIC_CHANNEL *ch)
3163 {
3164     return ch->net_error;
3165 }
3166 
ossl_quic_channel_restore_err_state(QUIC_CHANNEL * ch)3167 void ossl_quic_channel_restore_err_state(QUIC_CHANNEL *ch)
3168 {
3169     if (ch == NULL)
3170         return;
3171 
3172     if (!ossl_quic_port_is_running(ch->port))
3173         ossl_quic_port_restore_err_state(ch->port);
3174     else
3175         OSSL_ERR_STATE_restore(ch->err_state);
3176 }
3177 
ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL * ch,uint64_t error_code,uint64_t frame_type,const char * reason,ERR_STATE * err_state,const char * src_file,int src_line,const char * src_func)3178 void ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL *ch,
3179                                                 uint64_t error_code,
3180                                                 uint64_t frame_type,
3181                                                 const char *reason,
3182                                                 ERR_STATE *err_state,
3183                                                 const char *src_file,
3184                                                 int src_line,
3185                                                 const char *src_func)
3186 {
3187     QUIC_TERMINATE_CAUSE tcause = {0};
3188     int err_reason = error_code == OSSL_QUIC_ERR_INTERNAL_ERROR
3189                      ? ERR_R_INTERNAL_ERROR : SSL_R_QUIC_PROTOCOL_ERROR;
3190     const char *err_str = ossl_quic_err_to_string(error_code);
3191     const char *err_str_pfx = " (", *err_str_sfx = ")";
3192     const char *ft_str = NULL;
3193     const char *ft_str_pfx = " (", *ft_str_sfx = ")";
3194 
3195     if (ch->protocol_error)
3196         /* Only the first call to this function matters. */
3197         return;
3198 
3199     if (err_str == NULL) {
3200         err_str     = "";
3201         err_str_pfx = "";
3202         err_str_sfx = "";
3203     }
3204 
3205     /*
3206      * If we were provided an underlying error state, restore it and then append
3207      * our ERR on top as a "cover letter" error.
3208      */
3209     if (err_state != NULL)
3210         OSSL_ERR_STATE_restore(err_state);
3211 
3212     if (frame_type != 0) {
3213         ft_str = ossl_quic_frame_type_to_string(frame_type);
3214         if (ft_str == NULL) {
3215             ft_str      = "";
3216             ft_str_pfx  = "";
3217             ft_str_sfx  = "";
3218         }
3219 
3220         ERR_raise_data(ERR_LIB_SSL, err_reason,
3221                        "QUIC error code: 0x%llx%s%s%s "
3222                        "(triggered by frame type: 0x%llx%s%s%s), reason: \"%s\"",
3223                        (unsigned long long) error_code,
3224                        err_str_pfx, err_str, err_str_sfx,
3225                        (unsigned long long) frame_type,
3226                        ft_str_pfx, ft_str, ft_str_sfx,
3227                        reason);
3228     } else {
3229         ERR_raise_data(ERR_LIB_SSL, err_reason,
3230                        "QUIC error code: 0x%llx%s%s%s, reason: \"%s\"",
3231                        (unsigned long long) error_code,
3232                        err_str_pfx, err_str, err_str_sfx,
3233                        reason);
3234     }
3235 
3236     if (src_file != NULL)
3237         ERR_set_debug(src_file, src_line, src_func);
3238 
3239     ch_save_err_state(ch);
3240 
3241     tcause.error_code = error_code;
3242     tcause.frame_type = frame_type;
3243     tcause.reason     = reason;
3244     tcause.reason_len = strlen(reason);
3245 
3246     ch->protocol_error = 1;
3247     ch_start_terminating(ch, &tcause, 0);
3248 }
3249 
3250 /*
3251  * Called once the terminating timer expires, meaning we move from TERMINATING
3252  * to TERMINATED.
3253  */
ch_on_terminating_timeout(QUIC_CHANNEL * ch)3254 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch)
3255 {
3256     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
3257 }
3258 
3259 /*
3260  * Determines the effective idle timeout duration. This is based on the idle
3261  * timeout values that we and our peer signalled in transport parameters
3262  * but have some limits applied.
3263  */
ch_get_effective_idle_timeout_duration(QUIC_CHANNEL * ch)3264 static OSSL_TIME ch_get_effective_idle_timeout_duration(QUIC_CHANNEL *ch)
3265 {
3266     OSSL_TIME pto;
3267 
3268     if (ch->max_idle_timeout == 0)
3269         return ossl_time_infinite();
3270 
3271     /*
3272      * RFC 9000 s. 10.1: Idle Timeout
3273      *  To avoid excessively small idle timeout periods, endpoints
3274      *  MUST increase the idle timeout period to be at least three
3275      *  times the current Probe Timeout (PTO). This allows for
3276      *  multiple PTOs to expire, and therefore multiple probes to
3277      *  be sent and lost, prior to idle timeout.
3278      */
3279     pto = ossl_ackm_get_pto_duration(ch->ackm);
3280     return ossl_time_max(ossl_ms2time(ch->max_idle_timeout),
3281                                       ossl_time_multiply(pto, 3));
3282 }
3283 
3284 /*
3285  * Updates our idle deadline. Called when an event happens which should bump the
3286  * idle timeout.
3287  */
ch_update_idle(QUIC_CHANNEL * ch)3288 static void ch_update_idle(QUIC_CHANNEL *ch)
3289 {
3290     ch->idle_deadline = ossl_time_add(get_time(ch),
3291                                       ch_get_effective_idle_timeout_duration(ch));
3292 }
3293 
3294 /*
3295  * Updates our ping deadline, which determines when we next generate a ping if
3296  * we don't have any other ACK-eliciting frames to send.
3297  */
ch_update_ping_deadline(QUIC_CHANNEL * ch)3298 static void ch_update_ping_deadline(QUIC_CHANNEL *ch)
3299 {
3300     OSSL_TIME max_span, idle_duration;
3301 
3302     idle_duration = ch_get_effective_idle_timeout_duration(ch);
3303     if (ossl_time_is_infinite(idle_duration)) {
3304         ch->ping_deadline = ossl_time_infinite();
3305         return;
3306     }
3307 
3308     /*
3309      * Maximum amount of time without traffic before we send a PING to keep
3310      * the connection open. Usually we use max_idle_timeout/2, but ensure
3311      * the period never exceeds the assumed NAT interval to ensure NAT
3312      * devices don't have their state time out (RFC 9000 s. 10.1.2).
3313      */
3314     max_span = ossl_time_divide(idle_duration, 2);
3315     max_span = ossl_time_min(max_span, MAX_NAT_INTERVAL);
3316     ch->ping_deadline = ossl_time_add(get_time(ch), max_span);
3317 }
3318 
3319 /* Called when the idle timeout expires. */
ch_on_idle_timeout(QUIC_CHANNEL * ch)3320 static void ch_on_idle_timeout(QUIC_CHANNEL *ch)
3321 {
3322     /*
3323      * Idle timeout does not have an error code associated with it because a
3324      * CONN_CLOSE is never sent for it. We shouldn't use this data once we reach
3325      * TERMINATED anyway.
3326      */
3327     ch->terminate_cause.app         = 0;
3328     ch->terminate_cause.error_code  = OSSL_QUIC_LOCAL_ERR_IDLE_TIMEOUT;
3329     ch->terminate_cause.frame_type  = 0;
3330 
3331     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
3332 }
3333 
3334 /* Called when we, as a server, get a new incoming connection. */
ossl_quic_channel_on_new_conn(QUIC_CHANNEL * ch,const BIO_ADDR * peer,const QUIC_CONN_ID * peer_scid,const QUIC_CONN_ID * peer_dcid)3335 int ossl_quic_channel_on_new_conn(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
3336                                   const QUIC_CONN_ID *peer_scid,
3337                                   const QUIC_CONN_ID *peer_dcid)
3338 {
3339     if (!ossl_assert(ch->state == QUIC_CHANNEL_STATE_IDLE && ch->is_server))
3340         return 0;
3341 
3342     /* Generate an Initial LCID we will use for the connection. */
3343     if (!ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &ch->cur_local_cid))
3344         return 0;
3345 
3346     /* Note our newly learnt peer address and CIDs. */
3347     ch->cur_peer_addr   = *peer;
3348     ch->init_dcid       = *peer_dcid;
3349     ch->cur_remote_dcid = *peer_scid;
3350 
3351     /* Inform QTX of peer address. */
3352     if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr))
3353         return 0;
3354 
3355     /* Inform TXP of desired CIDs. */
3356     if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid))
3357         return 0;
3358 
3359     if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
3360         return 0;
3361 
3362     /* Setup QLOG, which did not happen earlier due to lacking an Initial ODCID. */
3363     ossl_qtx_set_qlog_cb(ch->qtx, ch_get_qlog_cb, ch);
3364     ossl_quic_tx_packetiser_set_qlog_cb(ch->txp, ch_get_qlog_cb, ch);
3365 
3366     /* Plug in secrets for the Initial EL. */
3367     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
3368                                           ch->port->engine->propq,
3369                                           &ch->init_dcid,
3370                                           /*is_server=*/1,
3371                                           ch->qrx, ch->qtx))
3372         return 0;
3373 
3374     /* Register the peer ODCID in the LCIDM. */
3375     if (!ossl_quic_lcidm_enrol_odcid(ch->lcidm, ch, &ch->init_dcid))
3376         return 0;
3377 
3378     /* Change state. */
3379     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
3380     ch->doing_proactive_ver_neg = 0; /* not currently supported */
3381     return 1;
3382 }
3383 
ossl_quic_channel_get0_ssl(QUIC_CHANNEL * ch)3384 SSL *ossl_quic_channel_get0_ssl(QUIC_CHANNEL *ch)
3385 {
3386     return ch->tls;
3387 }
3388 
ch_init_new_stream(QUIC_CHANNEL * ch,QUIC_STREAM * qs,int can_send,int can_recv)3389 static int ch_init_new_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs,
3390                               int can_send, int can_recv)
3391 {
3392     uint64_t rxfc_wnd;
3393     int server_init = ossl_quic_stream_is_server_init(qs);
3394     int local_init = (ch->is_server == server_init);
3395     int is_uni = !ossl_quic_stream_is_bidi(qs);
3396 
3397     if (can_send)
3398         if ((qs->sstream = ossl_quic_sstream_new(INIT_APP_BUF_LEN)) == NULL)
3399             goto err;
3400 
3401     if (can_recv)
3402         if ((qs->rstream = ossl_quic_rstream_new(NULL, NULL, 0)) == NULL)
3403             goto err;
3404 
3405     /* TXFC */
3406     if (!ossl_quic_txfc_init(&qs->txfc, &ch->conn_txfc))
3407         goto err;
3408 
3409     if (ch->got_remote_transport_params) {
3410         /*
3411          * If we already got peer TPs we need to apply the initial CWM credit
3412          * now. If we didn't already get peer TPs this will be done
3413          * automatically for all extant streams when we do.
3414          */
3415         if (can_send) {
3416             uint64_t cwm;
3417 
3418             if (is_uni)
3419                 cwm = ch->rx_init_max_stream_data_uni;
3420             else if (local_init)
3421                 cwm = ch->rx_init_max_stream_data_bidi_local;
3422             else
3423                 cwm = ch->rx_init_max_stream_data_bidi_remote;
3424 
3425             ossl_quic_txfc_bump_cwm(&qs->txfc, cwm);
3426         }
3427     }
3428 
3429     /* RXFC */
3430     if (!can_recv)
3431         rxfc_wnd = 0;
3432     else if (is_uni)
3433         rxfc_wnd = ch->tx_init_max_stream_data_uni;
3434     else if (local_init)
3435         rxfc_wnd = ch->tx_init_max_stream_data_bidi_local;
3436     else
3437         rxfc_wnd = ch->tx_init_max_stream_data_bidi_remote;
3438 
3439     if (!ossl_quic_rxfc_init(&qs->rxfc, &ch->conn_rxfc,
3440                              rxfc_wnd,
3441                              DEFAULT_STREAM_RXFC_MAX_WND_MUL * rxfc_wnd,
3442                              get_time, ch))
3443         goto err;
3444 
3445     return 1;
3446 
3447 err:
3448     ossl_quic_sstream_free(qs->sstream);
3449     qs->sstream = NULL;
3450     ossl_quic_rstream_free(qs->rstream);
3451     qs->rstream = NULL;
3452     return 0;
3453 }
3454 
ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL * ch,int is_uni)3455 static uint64_t *ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL *ch,
3456                                                       int is_uni)
3457 {
3458     return is_uni ? &ch->next_local_stream_ordinal_uni
3459                   : &ch->next_local_stream_ordinal_bidi;
3460 }
3461 
ch_get_local_stream_max_ptr(const QUIC_CHANNEL * ch,int is_uni)3462 static const uint64_t *ch_get_local_stream_max_ptr(const QUIC_CHANNEL *ch,
3463                                                    int is_uni)
3464 {
3465     return is_uni ? &ch->max_local_streams_uni
3466                   : &ch->max_local_streams_bidi;
3467 }
3468 
ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL * ch,int is_uni)3469 static const QUIC_RXFC *ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL *ch,
3470                                                         int is_uni)
3471 {
3472     return is_uni ? &ch->max_streams_uni_rxfc
3473                   : &ch->max_streams_bidi_rxfc;
3474 }
3475 
ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL * ch,int is_uni)3476 int ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL *ch,
3477                                                      int is_uni)
3478 {
3479     const uint64_t *p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni);
3480 
3481     return ossl_quic_stream_map_is_local_allowed_by_stream_limit(&ch->qsm,
3482                                                                  *p_next_ordinal,
3483                                                                  is_uni);
3484 }
3485 
ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL * ch,int is_uni)3486 uint64_t ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL *ch,
3487                                                         int is_uni)
3488 {
3489     const uint64_t *p_next_ordinal, *p_max;
3490 
3491     p_next_ordinal  = ch_get_local_stream_next_ordinal_ptr((QUIC_CHANNEL *)ch,
3492                                                            is_uni);
3493     p_max           = ch_get_local_stream_max_ptr(ch, is_uni);
3494 
3495     return *p_max - *p_next_ordinal;
3496 }
3497 
ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL * ch,int is_uni)3498 uint64_t ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL *ch,
3499                                                          int is_uni)
3500 {
3501     return ossl_quic_rxfc_get_credit(ch_get_remote_stream_count_rxfc(ch, is_uni));
3502 }
3503 
ossl_quic_channel_new_stream_local(QUIC_CHANNEL * ch,int is_uni)3504 QUIC_STREAM *ossl_quic_channel_new_stream_local(QUIC_CHANNEL *ch, int is_uni)
3505 {
3506     QUIC_STREAM *qs;
3507     int type;
3508     uint64_t stream_id;
3509     uint64_t *p_next_ordinal;
3510 
3511     type = ch->is_server ? QUIC_STREAM_INITIATOR_SERVER
3512                          : QUIC_STREAM_INITIATOR_CLIENT;
3513 
3514     p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni);
3515 
3516     if (is_uni)
3517         type |= QUIC_STREAM_DIR_UNI;
3518     else
3519         type |= QUIC_STREAM_DIR_BIDI;
3520 
3521     if (*p_next_ordinal >= ((uint64_t)1) << 62)
3522         return NULL;
3523 
3524     stream_id = ((*p_next_ordinal) << 2) | type;
3525 
3526     if ((qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id, type)) == NULL)
3527         return NULL;
3528 
3529     /* Locally-initiated stream, so we always want a send buffer. */
3530     if (!ch_init_new_stream(ch, qs, /*can_send=*/1, /*can_recv=*/!is_uni))
3531         goto err;
3532 
3533     ++*p_next_ordinal;
3534     return qs;
3535 
3536 err:
3537     ossl_quic_stream_map_release(&ch->qsm, qs);
3538     return NULL;
3539 }
3540 
ossl_quic_channel_new_stream_remote(QUIC_CHANNEL * ch,uint64_t stream_id)3541 QUIC_STREAM *ossl_quic_channel_new_stream_remote(QUIC_CHANNEL *ch,
3542                                                  uint64_t stream_id)
3543 {
3544     uint64_t peer_role;
3545     int is_uni;
3546     QUIC_STREAM *qs;
3547 
3548     peer_role = ch->is_server
3549         ? QUIC_STREAM_INITIATOR_CLIENT
3550         : QUIC_STREAM_INITIATOR_SERVER;
3551 
3552     if ((stream_id & QUIC_STREAM_INITIATOR_MASK) != peer_role)
3553         return NULL;
3554 
3555     is_uni = ((stream_id & QUIC_STREAM_DIR_MASK) == QUIC_STREAM_DIR_UNI);
3556 
3557     qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id,
3558                                     stream_id & (QUIC_STREAM_INITIATOR_MASK
3559                                                  | QUIC_STREAM_DIR_MASK));
3560     if (qs == NULL)
3561         return NULL;
3562 
3563     if (!ch_init_new_stream(ch, qs, /*can_send=*/!is_uni, /*can_recv=*/1))
3564         goto err;
3565 
3566     if (ch->incoming_stream_auto_reject)
3567         ossl_quic_channel_reject_stream(ch, qs);
3568     else
3569         ossl_quic_stream_map_push_accept_queue(&ch->qsm, qs);
3570 
3571     return qs;
3572 
3573 err:
3574     ossl_quic_stream_map_release(&ch->qsm, qs);
3575     return NULL;
3576 }
3577 
ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL * ch,int enable,uint64_t aec)3578 void ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL *ch,
3579                                                        int enable,
3580                                                        uint64_t aec)
3581 {
3582     ch->incoming_stream_auto_reject     = (enable != 0);
3583     ch->incoming_stream_auto_reject_aec = aec;
3584 }
3585 
ossl_quic_channel_reject_stream(QUIC_CHANNEL * ch,QUIC_STREAM * qs)3586 void ossl_quic_channel_reject_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs)
3587 {
3588     ossl_quic_stream_map_stop_sending_recv_part(&ch->qsm, qs,
3589                                                 ch->incoming_stream_auto_reject_aec);
3590 
3591     ossl_quic_stream_map_reset_stream_send_part(&ch->qsm, qs,
3592                                                 ch->incoming_stream_auto_reject_aec);
3593     qs->deleted = 1;
3594 
3595     ossl_quic_stream_map_update_state(&ch->qsm, qs);
3596 }
3597 
3598 /* Replace local connection ID in TXP and DEMUX for testing purposes. */
ossl_quic_channel_replace_local_cid(QUIC_CHANNEL * ch,const QUIC_CONN_ID * conn_id)3599 int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL *ch,
3600                                         const QUIC_CONN_ID *conn_id)
3601 {
3602     /* Remove the current LCID from the LCIDM. */
3603     if (!ossl_quic_lcidm_debug_remove(ch->lcidm, &ch->cur_local_cid))
3604         return 0;
3605     ch->cur_local_cid = *conn_id;
3606     /* Set in the TXP, used only for long header packets. */
3607     if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
3608         return 0;
3609     /* Add the new LCID to the LCIDM. */
3610     if (!ossl_quic_lcidm_debug_add(ch->lcidm, ch, &ch->cur_local_cid,
3611                                    100))
3612         return 0;
3613     return 1;
3614 }
3615 
ossl_quic_channel_set_msg_callback(QUIC_CHANNEL * ch,ossl_msg_cb msg_callback,SSL * msg_callback_ssl)3616 void ossl_quic_channel_set_msg_callback(QUIC_CHANNEL *ch,
3617                                         ossl_msg_cb msg_callback,
3618                                         SSL *msg_callback_ssl)
3619 {
3620     ch->msg_callback = msg_callback;
3621     ch->msg_callback_ssl = msg_callback_ssl;
3622     ossl_qtx_set_msg_callback(ch->qtx, msg_callback, msg_callback_ssl);
3623     ossl_quic_tx_packetiser_set_msg_callback(ch->txp, msg_callback,
3624                                              msg_callback_ssl);
3625     ossl_qrx_set_msg_callback(ch->qrx, msg_callback, msg_callback_ssl);
3626 }
3627 
ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL * ch,void * msg_callback_arg)3628 void ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL *ch,
3629                                             void *msg_callback_arg)
3630 {
3631     ch->msg_callback_arg = msg_callback_arg;
3632     ossl_qtx_set_msg_callback_arg(ch->qtx, msg_callback_arg);
3633     ossl_quic_tx_packetiser_set_msg_callback_arg(ch->txp, msg_callback_arg);
3634     ossl_qrx_set_msg_callback_arg(ch->qrx, msg_callback_arg);
3635 }
3636 
ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL * ch,uint64_t tx_pkt_threshold)3637 void ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL *ch,
3638                                                    uint64_t tx_pkt_threshold)
3639 {
3640     ch->txku_threshold_override = tx_pkt_threshold;
3641 }
3642 
ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL * ch)3643 uint64_t ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL *ch)
3644 {
3645     return ossl_qtx_get_key_epoch(ch->qtx);
3646 }
3647 
ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL * ch)3648 uint64_t ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL *ch)
3649 {
3650     return ossl_qrx_get_key_epoch(ch->qrx);
3651 }
3652 
ossl_quic_channel_trigger_txku(QUIC_CHANNEL * ch)3653 int ossl_quic_channel_trigger_txku(QUIC_CHANNEL *ch)
3654 {
3655     if (!txku_allowed(ch))
3656         return 0;
3657 
3658     ch->ku_locally_initiated = 1;
3659     ch_trigger_txku(ch);
3660     return 1;
3661 }
3662 
ossl_quic_channel_ping(QUIC_CHANNEL * ch)3663 int ossl_quic_channel_ping(QUIC_CHANNEL *ch)
3664 {
3665     int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
3666 
3667     ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
3668 
3669     return 1;
3670 }
3671 
ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL * ch)3672 uint16_t ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL *ch)
3673 {
3674     return ch->diag_num_rx_ack;
3675 }
3676 
ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL * ch,QUIC_CONN_ID * cid)3677 void ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL *ch, QUIC_CONN_ID *cid)
3678 {
3679     *cid = ch->cur_local_cid;
3680 }
3681 
ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL * ch)3682 int ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL *ch)
3683 {
3684     return ch->got_local_transport_params;
3685 }
3686 
ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL * ch,uint64_t ms)3687 void ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL *ch, uint64_t ms)
3688 {
3689     ch->max_idle_timeout_local_req = ms;
3690 }
ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL * ch)3691 uint64_t ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL *ch)
3692 {
3693     return ch->max_idle_timeout_local_req;
3694 }
3695 
ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL * ch)3696 uint64_t ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL *ch)
3697 {
3698     return ch->max_idle_timeout_remote_req;
3699 }
3700 
ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL * ch)3701 uint64_t ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL *ch)
3702 {
3703     return ch->max_idle_timeout;
3704 }
3705