1 /*
2 * Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <openssl/rand.h>
11 #include <openssl/err.h>
12 #include "internal/quic_channel.h"
13 #include "internal/quic_error.h"
14 #include "internal/quic_rx_depack.h"
15 #include "internal/quic_lcidm.h"
16 #include "internal/quic_srtm.h"
17 #include "internal/qlog_event_helpers.h"
18 #include "../ssl_local.h"
19 #include "quic_channel_local.h"
20 #include "quic_port_local.h"
21 #include "quic_engine_local.h"
22
23 /*
24 * NOTE: While this channel implementation currently has basic server support,
25 * this functionality has been implemented for internal testing purposes and is
26 * not suitable for network use. In particular, it does not implement address
27 * validation, anti-amplification or retry logic.
28 *
29 * TODO(QUIC SERVER): Implement address validation and anti-amplification
30 * TODO(QUIC SERVER): Implement retry logic
31 */
32
33 #define INIT_CRYPTO_RECV_BUF_LEN 16384
34 #define INIT_CRYPTO_SEND_BUF_LEN 16384
35 #define INIT_APP_BUF_LEN 8192
36
37 /*
38 * Interval before we force a PING to ensure NATs don't timeout. This is based
39 * on the lowest commonly seen value of 30 seconds as cited in RFC 9000 s.
40 * 10.1.2.
41 */
42 #define MAX_NAT_INTERVAL (ossl_ms2time(25000))
43
44 /*
45 * Our maximum ACK delay on the TX side. This is up to us to choose. Note that
46 * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol
47 * value which determines the value of the maximum ACK delay if the
48 * max_ack_delay transport parameter is not set.
49 */
50 #define DEFAULT_MAX_ACK_DELAY QUIC_DEFAULT_MAX_ACK_DELAY
51
52 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
53
54 static void ch_save_err_state(QUIC_CHANNEL *ch);
55 static int ch_rx(QUIC_CHANNEL *ch, int channel_only);
56 static int ch_tx(QUIC_CHANNEL *ch);
57 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only);
58 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only);
59 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch);
60 static int ch_retry(QUIC_CHANNEL *ch,
61 const unsigned char *retry_token,
62 size_t retry_token_len,
63 const QUIC_CONN_ID *retry_scid);
64 static void ch_cleanup(QUIC_CHANNEL *ch);
65 static int ch_generate_transport_params(QUIC_CHANNEL *ch);
66 static int ch_on_transport_params(const unsigned char *params,
67 size_t params_len,
68 void *arg);
69 static int ch_on_handshake_alert(void *arg, unsigned char alert_code);
70 static int ch_on_handshake_complete(void *arg);
71 static int ch_on_handshake_yield_secret(uint32_t enc_level, int direction,
72 uint32_t suite_id, EVP_MD *md,
73 const unsigned char *secret,
74 size_t secret_len,
75 void *arg);
76 static int ch_on_crypto_recv_record(const unsigned char **buf,
77 size_t *bytes_read, void *arg);
78 static int ch_on_crypto_release_record(size_t bytes_read, void *arg);
79 static int crypto_ensure_empty(QUIC_RSTREAM *rstream);
80 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len,
81 size_t *consumed, void *arg);
82 static OSSL_TIME get_time(void *arg);
83 static uint64_t get_stream_limit(int uni, void *arg);
84 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg);
85 static void rxku_detected(QUIC_PN pn, void *arg);
86 static int ch_retry(QUIC_CHANNEL *ch,
87 const unsigned char *retry_token,
88 size_t retry_token_len,
89 const QUIC_CONN_ID *retry_scid);
90 static void ch_update_idle(QUIC_CHANNEL *ch);
91 static int ch_discard_el(QUIC_CHANNEL *ch,
92 uint32_t enc_level);
93 static void ch_on_idle_timeout(QUIC_CHANNEL *ch);
94 static void ch_update_idle(QUIC_CHANNEL *ch);
95 static void ch_update_ping_deadline(QUIC_CHANNEL *ch);
96 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch);
97 static void ch_start_terminating(QUIC_CHANNEL *ch,
98 const QUIC_TERMINATE_CAUSE *tcause,
99 int force_immediate);
100 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
101 void *arg);
102 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt);
103 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch);
104 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state);
105
106 DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM);
107
108 QUIC_NEEDS_LOCK
ch_get_qlog(QUIC_CHANNEL * ch)109 static QLOG *ch_get_qlog(QUIC_CHANNEL *ch)
110 {
111 #ifndef OPENSSL_NO_QLOG
112 QLOG_TRACE_INFO qti = {0};
113
114 if (ch->qlog != NULL)
115 return ch->qlog;
116
117 if (!ch->use_qlog)
118 return NULL;
119
120 if (ch->is_server && ch->init_dcid.id_len == 0)
121 return NULL;
122
123 qti.odcid = ch->init_dcid;
124 qti.title = ch->qlog_title;
125 qti.description = NULL;
126 qti.group_id = NULL;
127 qti.is_server = ch->is_server;
128 qti.now_cb = get_time;
129 qti.now_cb_arg = ch;
130 if ((ch->qlog = ossl_qlog_new_from_env(&qti)) == NULL) {
131 ch->use_qlog = 0; /* don't try again */
132 return NULL;
133 }
134
135 return ch->qlog;
136 #else
137 return NULL;
138 #endif
139 }
140
141 QUIC_NEEDS_LOCK
ch_get_qlog_cb(void * arg)142 static QLOG *ch_get_qlog_cb(void *arg)
143 {
144 QUIC_CHANNEL *ch = arg;
145
146 return ch_get_qlog(ch);
147 }
148
149 /*
150 * QUIC Channel Initialization and Teardown
151 * ========================================
152 */
153 #define DEFAULT_INIT_CONN_RXFC_WND (768 * 1024)
154 #define DEFAULT_CONN_RXFC_MAX_WND_MUL 20
155
156 #define DEFAULT_INIT_STREAM_RXFC_WND (512 * 1024)
157 #define DEFAULT_STREAM_RXFC_MAX_WND_MUL 12
158
159 #define DEFAULT_INIT_CONN_MAX_STREAMS 100
160
ch_init(QUIC_CHANNEL * ch)161 static int ch_init(QUIC_CHANNEL *ch)
162 {
163 OSSL_QUIC_TX_PACKETISER_ARGS txp_args = {0};
164 OSSL_QTX_ARGS qtx_args = {0};
165 OSSL_QRX_ARGS qrx_args = {0};
166 QUIC_TLS_ARGS tls_args = {0};
167 uint32_t pn_space;
168 size_t rx_short_dcid_len;
169 size_t tx_init_dcid_len;
170
171 if (ch->port == NULL || ch->lcidm == NULL || ch->srtm == NULL)
172 goto err;
173
174 rx_short_dcid_len = ossl_quic_port_get_rx_short_dcid_len(ch->port);
175 tx_init_dcid_len = ossl_quic_port_get_tx_init_dcid_len(ch->port);
176
177 /* For clients, generate our initial DCID. */
178 if (!ch->is_server
179 && !ossl_quic_gen_rand_conn_id(ch->port->engine->libctx, tx_init_dcid_len,
180 &ch->init_dcid))
181 goto err;
182
183 /* We plug in a network write BIO to the QTX later when we get one. */
184 qtx_args.libctx = ch->port->engine->libctx;
185 qtx_args.get_qlog_cb = ch_get_qlog_cb;
186 qtx_args.get_qlog_cb_arg = ch;
187 qtx_args.mdpl = QUIC_MIN_INITIAL_DGRAM_LEN;
188 ch->rx_max_udp_payload_size = qtx_args.mdpl;
189
190 ch->ping_deadline = ossl_time_infinite();
191
192 ch->qtx = ossl_qtx_new(&qtx_args);
193 if (ch->qtx == NULL)
194 goto err;
195
196 ch->txpim = ossl_quic_txpim_new();
197 if (ch->txpim == NULL)
198 goto err;
199
200 ch->cfq = ossl_quic_cfq_new();
201 if (ch->cfq == NULL)
202 goto err;
203
204 if (!ossl_quic_txfc_init(&ch->conn_txfc, NULL))
205 goto err;
206
207 /*
208 * Note: The TP we transmit governs what the peer can transmit and thus
209 * applies to the RXFC.
210 */
211 ch->tx_init_max_stream_data_bidi_local = DEFAULT_INIT_STREAM_RXFC_WND;
212 ch->tx_init_max_stream_data_bidi_remote = DEFAULT_INIT_STREAM_RXFC_WND;
213 ch->tx_init_max_stream_data_uni = DEFAULT_INIT_STREAM_RXFC_WND;
214
215 if (!ossl_quic_rxfc_init(&ch->conn_rxfc, NULL,
216 DEFAULT_INIT_CONN_RXFC_WND,
217 DEFAULT_CONN_RXFC_MAX_WND_MUL *
218 DEFAULT_INIT_CONN_RXFC_WND,
219 get_time, ch))
220 goto err;
221
222 for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
223 if (!ossl_quic_rxfc_init_standalone(&ch->crypto_rxfc[pn_space],
224 INIT_CRYPTO_RECV_BUF_LEN,
225 get_time, ch))
226 goto err;
227
228 if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_bidi_rxfc,
229 DEFAULT_INIT_CONN_MAX_STREAMS,
230 get_time, ch))
231 goto err;
232
233 if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_uni_rxfc,
234 DEFAULT_INIT_CONN_MAX_STREAMS,
235 get_time, ch))
236 goto err;
237
238 if (!ossl_statm_init(&ch->statm))
239 goto err;
240
241 ch->have_statm = 1;
242 ch->cc_method = &ossl_cc_newreno_method;
243 if ((ch->cc_data = ch->cc_method->new(get_time, ch)) == NULL)
244 goto err;
245
246 if ((ch->ackm = ossl_ackm_new(get_time, ch, &ch->statm,
247 ch->cc_method, ch->cc_data)) == NULL)
248 goto err;
249
250 if (!ossl_quic_stream_map_init(&ch->qsm, get_stream_limit, ch,
251 &ch->max_streams_bidi_rxfc,
252 &ch->max_streams_uni_rxfc,
253 ch->is_server))
254 goto err;
255
256 ch->have_qsm = 1;
257
258 if (!ch->is_server
259 && !ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &txp_args.cur_scid))
260 goto err;
261
262 /* We use a zero-length SCID. */
263 txp_args.cur_dcid = ch->init_dcid;
264 txp_args.ack_delay_exponent = 3;
265 txp_args.qtx = ch->qtx;
266 txp_args.txpim = ch->txpim;
267 txp_args.cfq = ch->cfq;
268 txp_args.ackm = ch->ackm;
269 txp_args.qsm = &ch->qsm;
270 txp_args.conn_txfc = &ch->conn_txfc;
271 txp_args.conn_rxfc = &ch->conn_rxfc;
272 txp_args.max_streams_bidi_rxfc = &ch->max_streams_bidi_rxfc;
273 txp_args.max_streams_uni_rxfc = &ch->max_streams_uni_rxfc;
274 txp_args.cc_method = ch->cc_method;
275 txp_args.cc_data = ch->cc_data;
276 txp_args.now = get_time;
277 txp_args.now_arg = ch;
278 txp_args.get_qlog_cb = ch_get_qlog_cb;
279 txp_args.get_qlog_cb_arg = ch;
280
281 for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
282 ch->crypto_send[pn_space] = ossl_quic_sstream_new(INIT_CRYPTO_SEND_BUF_LEN);
283 if (ch->crypto_send[pn_space] == NULL)
284 goto err;
285
286 txp_args.crypto[pn_space] = ch->crypto_send[pn_space];
287 }
288
289 ch->txp = ossl_quic_tx_packetiser_new(&txp_args);
290 if (ch->txp == NULL)
291 goto err;
292
293 ossl_quic_tx_packetiser_set_ack_tx_cb(ch->txp, ch_on_txp_ack_tx, ch);
294
295 qrx_args.libctx = ch->port->engine->libctx;
296 qrx_args.demux = ch->port->demux;
297 qrx_args.short_conn_id_len = rx_short_dcid_len;
298 qrx_args.max_deferred = 32;
299
300 if ((ch->qrx = ossl_qrx_new(&qrx_args)) == NULL)
301 goto err;
302
303 if (!ossl_qrx_set_late_validation_cb(ch->qrx,
304 rx_late_validate,
305 ch))
306 goto err;
307
308 if (!ossl_qrx_set_key_update_cb(ch->qrx,
309 rxku_detected,
310 ch))
311 goto err;
312
313 for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
314 ch->crypto_recv[pn_space] = ossl_quic_rstream_new(NULL, NULL, 0);
315 if (ch->crypto_recv[pn_space] == NULL)
316 goto err;
317 }
318
319 /* Plug in the TLS handshake layer. */
320 tls_args.s = ch->tls;
321 tls_args.crypto_send_cb = ch_on_crypto_send;
322 tls_args.crypto_send_cb_arg = ch;
323 tls_args.crypto_recv_rcd_cb = ch_on_crypto_recv_record;
324 tls_args.crypto_recv_rcd_cb_arg = ch;
325 tls_args.crypto_release_rcd_cb = ch_on_crypto_release_record;
326 tls_args.crypto_release_rcd_cb_arg = ch;
327 tls_args.yield_secret_cb = ch_on_handshake_yield_secret;
328 tls_args.yield_secret_cb_arg = ch;
329 tls_args.got_transport_params_cb = ch_on_transport_params;
330 tls_args.got_transport_params_cb_arg= ch;
331 tls_args.handshake_complete_cb = ch_on_handshake_complete;
332 tls_args.handshake_complete_cb_arg = ch;
333 tls_args.alert_cb = ch_on_handshake_alert;
334 tls_args.alert_cb_arg = ch;
335 tls_args.is_server = ch->is_server;
336
337 if ((ch->qtls = ossl_quic_tls_new(&tls_args)) == NULL)
338 goto err;
339
340 ch->tx_max_ack_delay = DEFAULT_MAX_ACK_DELAY;
341 ch->rx_max_ack_delay = QUIC_DEFAULT_MAX_ACK_DELAY;
342 ch->rx_ack_delay_exp = QUIC_DEFAULT_ACK_DELAY_EXP;
343 ch->rx_active_conn_id_limit = QUIC_MIN_ACTIVE_CONN_ID_LIMIT;
344 ch->tx_enc_level = QUIC_ENC_LEVEL_INITIAL;
345 ch->rx_enc_level = QUIC_ENC_LEVEL_INITIAL;
346 ch->txku_threshold_override = UINT64_MAX;
347
348 ch->max_idle_timeout_local_req = QUIC_DEFAULT_IDLE_TIMEOUT;
349 ch->max_idle_timeout_remote_req = 0;
350 ch->max_idle_timeout = ch->max_idle_timeout_local_req;
351
352 ossl_ackm_set_tx_max_ack_delay(ch->ackm, ossl_ms2time(ch->tx_max_ack_delay));
353 ossl_ackm_set_rx_max_ack_delay(ch->ackm, ossl_ms2time(ch->rx_max_ack_delay));
354
355 ch_update_idle(ch);
356 ossl_list_ch_insert_tail(&ch->port->channel_list, ch);
357 ch->on_port_list = 1;
358 return 1;
359
360 err:
361 ch_cleanup(ch);
362 return 0;
363 }
364
ch_cleanup(QUIC_CHANNEL * ch)365 static void ch_cleanup(QUIC_CHANNEL *ch)
366 {
367 uint32_t pn_space;
368
369 if (ch->ackm != NULL)
370 for (pn_space = QUIC_PN_SPACE_INITIAL;
371 pn_space < QUIC_PN_SPACE_NUM;
372 ++pn_space)
373 ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
374
375 ossl_quic_lcidm_cull(ch->lcidm, ch);
376 ossl_quic_srtm_cull(ch->srtm, ch);
377 ossl_quic_tx_packetiser_free(ch->txp);
378 ossl_quic_txpim_free(ch->txpim);
379 ossl_quic_cfq_free(ch->cfq);
380 ossl_qtx_free(ch->qtx);
381 if (ch->cc_data != NULL)
382 ch->cc_method->free(ch->cc_data);
383 if (ch->have_statm)
384 ossl_statm_destroy(&ch->statm);
385 ossl_ackm_free(ch->ackm);
386
387 if (ch->have_qsm)
388 ossl_quic_stream_map_cleanup(&ch->qsm);
389
390 for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
391 ossl_quic_sstream_free(ch->crypto_send[pn_space]);
392 ossl_quic_rstream_free(ch->crypto_recv[pn_space]);
393 }
394
395 ossl_qrx_pkt_release(ch->qrx_pkt);
396 ch->qrx_pkt = NULL;
397
398 ossl_quic_tls_free(ch->qtls);
399 ossl_qrx_free(ch->qrx);
400 OPENSSL_free(ch->local_transport_params);
401 OPENSSL_free((char *)ch->terminate_cause.reason);
402 OSSL_ERR_STATE_free(ch->err_state);
403 OPENSSL_free(ch->ack_range_scratch);
404
405 if (ch->on_port_list) {
406 ossl_list_ch_remove(&ch->port->channel_list, ch);
407 ch->on_port_list = 0;
408 }
409
410 #ifndef OPENSSL_NO_QLOG
411 if (ch->qlog != NULL)
412 ossl_qlog_flush(ch->qlog); /* best effort */
413
414 OPENSSL_free(ch->qlog_title);
415 ossl_qlog_free(ch->qlog);
416 #endif
417 }
418
ossl_quic_channel_new(const QUIC_CHANNEL_ARGS * args)419 QUIC_CHANNEL *ossl_quic_channel_new(const QUIC_CHANNEL_ARGS *args)
420 {
421 QUIC_CHANNEL *ch = NULL;
422
423 if ((ch = OPENSSL_zalloc(sizeof(*ch))) == NULL)
424 return NULL;
425
426 ch->port = args->port;
427 ch->is_server = args->is_server;
428 ch->tls = args->tls;
429 ch->lcidm = args->lcidm;
430 ch->srtm = args->srtm;
431 #ifndef OPENSSL_NO_QLOG
432 ch->use_qlog = args->use_qlog;
433
434 if (ch->use_qlog && args->qlog_title != NULL) {
435 if ((ch->qlog_title = OPENSSL_strdup(args->qlog_title)) == NULL) {
436 OPENSSL_free(ch);
437 return NULL;
438 }
439 }
440 #endif
441
442 if (!ch_init(ch)) {
443 OPENSSL_free(ch);
444 return NULL;
445 }
446
447 return ch;
448 }
449
ossl_quic_channel_free(QUIC_CHANNEL * ch)450 void ossl_quic_channel_free(QUIC_CHANNEL *ch)
451 {
452 if (ch == NULL)
453 return;
454
455 ch_cleanup(ch);
456 OPENSSL_free(ch);
457 }
458
459 /* Set mutator callbacks for test framework support */
ossl_quic_channel_set_mutator(QUIC_CHANNEL * ch,ossl_mutate_packet_cb mutatecb,ossl_finish_mutate_cb finishmutatecb,void * mutatearg)460 int ossl_quic_channel_set_mutator(QUIC_CHANNEL *ch,
461 ossl_mutate_packet_cb mutatecb,
462 ossl_finish_mutate_cb finishmutatecb,
463 void *mutatearg)
464 {
465 if (ch->qtx == NULL)
466 return 0;
467
468 ossl_qtx_set_mutator(ch->qtx, mutatecb, finishmutatecb, mutatearg);
469 return 1;
470 }
471
ossl_quic_channel_get_peer_addr(QUIC_CHANNEL * ch,BIO_ADDR * peer_addr)472 int ossl_quic_channel_get_peer_addr(QUIC_CHANNEL *ch, BIO_ADDR *peer_addr)
473 {
474 if (!ch->addressed_mode)
475 return 0;
476
477 *peer_addr = ch->cur_peer_addr;
478 return 1;
479 }
480
ossl_quic_channel_set_peer_addr(QUIC_CHANNEL * ch,const BIO_ADDR * peer_addr)481 int ossl_quic_channel_set_peer_addr(QUIC_CHANNEL *ch, const BIO_ADDR *peer_addr)
482 {
483 if (ch->state != QUIC_CHANNEL_STATE_IDLE)
484 return 0;
485
486 if (peer_addr == NULL || BIO_ADDR_family(peer_addr) == AF_UNSPEC) {
487 BIO_ADDR_clear(&ch->cur_peer_addr);
488 ch->addressed_mode = 0;
489 return 1;
490 }
491
492 ch->cur_peer_addr = *peer_addr;
493 ch->addressed_mode = 1;
494 return 1;
495 }
496
ossl_quic_channel_get_reactor(QUIC_CHANNEL * ch)497 QUIC_REACTOR *ossl_quic_channel_get_reactor(QUIC_CHANNEL *ch)
498 {
499 return ossl_quic_port_get0_reactor(ch->port);
500 }
501
ossl_quic_channel_get_qsm(QUIC_CHANNEL * ch)502 QUIC_STREAM_MAP *ossl_quic_channel_get_qsm(QUIC_CHANNEL *ch)
503 {
504 return &ch->qsm;
505 }
506
ossl_quic_channel_get_statm(QUIC_CHANNEL * ch)507 OSSL_STATM *ossl_quic_channel_get_statm(QUIC_CHANNEL *ch)
508 {
509 return &ch->statm;
510 }
511
ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL * ch,uint64_t stream_id)512 QUIC_STREAM *ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL *ch,
513 uint64_t stream_id)
514 {
515 return ossl_quic_stream_map_get_by_id(&ch->qsm, stream_id);
516 }
517
ossl_quic_channel_is_active(const QUIC_CHANNEL * ch)518 int ossl_quic_channel_is_active(const QUIC_CHANNEL *ch)
519 {
520 return ch != NULL && ch->state == QUIC_CHANNEL_STATE_ACTIVE;
521 }
522
ossl_quic_channel_is_closing(const QUIC_CHANNEL * ch)523 int ossl_quic_channel_is_closing(const QUIC_CHANNEL *ch)
524 {
525 return ch->state == QUIC_CHANNEL_STATE_TERMINATING_CLOSING;
526 }
527
ossl_quic_channel_is_draining(const QUIC_CHANNEL * ch)528 static int ossl_quic_channel_is_draining(const QUIC_CHANNEL *ch)
529 {
530 return ch->state == QUIC_CHANNEL_STATE_TERMINATING_DRAINING;
531 }
532
ossl_quic_channel_is_terminating(const QUIC_CHANNEL * ch)533 static int ossl_quic_channel_is_terminating(const QUIC_CHANNEL *ch)
534 {
535 return ossl_quic_channel_is_closing(ch)
536 || ossl_quic_channel_is_draining(ch);
537 }
538
ossl_quic_channel_is_terminated(const QUIC_CHANNEL * ch)539 int ossl_quic_channel_is_terminated(const QUIC_CHANNEL *ch)
540 {
541 return ch->state == QUIC_CHANNEL_STATE_TERMINATED;
542 }
543
ossl_quic_channel_is_term_any(const QUIC_CHANNEL * ch)544 int ossl_quic_channel_is_term_any(const QUIC_CHANNEL *ch)
545 {
546 return ossl_quic_channel_is_terminating(ch)
547 || ossl_quic_channel_is_terminated(ch);
548 }
549
550 const QUIC_TERMINATE_CAUSE *
ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL * ch)551 ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL *ch)
552 {
553 return ossl_quic_channel_is_term_any(ch) ? &ch->terminate_cause : NULL;
554 }
555
ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL * ch)556 int ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL *ch)
557 {
558 return ch->handshake_complete;
559 }
560
ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL * ch)561 int ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL *ch)
562 {
563 return ch->handshake_confirmed;
564 }
565
ossl_quic_channel_get0_demux(QUIC_CHANNEL * ch)566 QUIC_DEMUX *ossl_quic_channel_get0_demux(QUIC_CHANNEL *ch)
567 {
568 return ch->port->demux;
569 }
570
ossl_quic_channel_get0_port(QUIC_CHANNEL * ch)571 QUIC_PORT *ossl_quic_channel_get0_port(QUIC_CHANNEL *ch)
572 {
573 return ch->port;
574 }
575
ossl_quic_channel_get0_engine(QUIC_CHANNEL * ch)576 QUIC_ENGINE *ossl_quic_channel_get0_engine(QUIC_CHANNEL *ch)
577 {
578 return ossl_quic_port_get0_engine(ch->port);
579 }
580
ossl_quic_channel_get_mutex(QUIC_CHANNEL * ch)581 CRYPTO_MUTEX *ossl_quic_channel_get_mutex(QUIC_CHANNEL *ch)
582 {
583 return ossl_quic_port_get0_mutex(ch->port);
584 }
585
ossl_quic_channel_has_pending(const QUIC_CHANNEL * ch)586 int ossl_quic_channel_has_pending(const QUIC_CHANNEL *ch)
587 {
588 return ossl_quic_demux_has_pending(ch->port->demux)
589 || ossl_qrx_processed_read_pending(ch->qrx);
590 }
591
592 /*
593 * QUIC Channel: Callbacks from Miscellaneous Subsidiary Components
594 * ================================================================
595 */
596
597 /* Used by various components. */
get_time(void * arg)598 static OSSL_TIME get_time(void *arg)
599 {
600 QUIC_CHANNEL *ch = arg;
601
602 return ossl_quic_port_get_time(ch->port);
603 }
604
605 /* Used by QSM. */
get_stream_limit(int uni,void * arg)606 static uint64_t get_stream_limit(int uni, void *arg)
607 {
608 QUIC_CHANNEL *ch = arg;
609
610 return uni ? ch->max_local_streams_uni : ch->max_local_streams_bidi;
611 }
612
613 /*
614 * Called by QRX to determine if a packet is potentially invalid before trying
615 * to decrypt it.
616 */
rx_late_validate(QUIC_PN pn,int pn_space,void * arg)617 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg)
618 {
619 QUIC_CHANNEL *ch = arg;
620
621 /* Potential duplicates should not be processed. */
622 if (!ossl_ackm_is_rx_pn_processable(ch->ackm, pn, pn_space))
623 return 0;
624
625 return 1;
626 }
627
628 /*
629 * Triggers a TXKU (whether spontaneous or solicited). Does not check whether
630 * spontaneous TXKU is currently allowed.
631 */
632 QUIC_NEEDS_LOCK
ch_trigger_txku(QUIC_CHANNEL * ch)633 static void ch_trigger_txku(QUIC_CHANNEL *ch)
634 {
635 uint64_t next_pn
636 = ossl_quic_tx_packetiser_get_next_pn(ch->txp, QUIC_PN_SPACE_APP);
637
638 if (!ossl_quic_pn_valid(next_pn)
639 || !ossl_qtx_trigger_key_update(ch->qtx)) {
640 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
641 "key update");
642 return;
643 }
644
645 ch->txku_in_progress = 1;
646 ch->txku_pn = next_pn;
647 ch->rxku_expected = ch->ku_locally_initiated;
648 }
649
650 QUIC_NEEDS_LOCK
txku_in_progress(QUIC_CHANNEL * ch)651 static int txku_in_progress(QUIC_CHANNEL *ch)
652 {
653 if (ch->txku_in_progress
654 && ossl_ackm_get_largest_acked(ch->ackm, QUIC_PN_SPACE_APP) >= ch->txku_pn) {
655 OSSL_TIME pto = ossl_ackm_get_pto_duration(ch->ackm);
656
657 /*
658 * RFC 9001 s. 6.5: Endpoints SHOULD wait three times the PTO before
659 * initiating a key update after receiving an acknowledgment that
660 * confirms that the previous key update was received.
661 *
662 * Note that by the above wording, this period starts from when we get
663 * the ack for a TXKU-triggering packet, not when the TXKU is initiated.
664 * So we defer TXKU cooldown deadline calculation to this point.
665 */
666 ch->txku_in_progress = 0;
667 ch->txku_cooldown_deadline = ossl_time_add(get_time(ch),
668 ossl_time_multiply(pto, 3));
669 }
670
671 return ch->txku_in_progress;
672 }
673
674 QUIC_NEEDS_LOCK
txku_allowed(QUIC_CHANNEL * ch)675 static int txku_allowed(QUIC_CHANNEL *ch)
676 {
677 return ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT /* Sanity check. */
678 /* Strict RFC 9001 criterion for TXKU. */
679 && ch->handshake_confirmed
680 && !txku_in_progress(ch);
681 }
682
683 QUIC_NEEDS_LOCK
txku_recommendable(QUIC_CHANNEL * ch)684 static int txku_recommendable(QUIC_CHANNEL *ch)
685 {
686 if (!txku_allowed(ch))
687 return 0;
688
689 return
690 /* Recommended RFC 9001 criterion for TXKU. */
691 ossl_time_compare(get_time(ch), ch->txku_cooldown_deadline) >= 0
692 /* Some additional sensible criteria. */
693 && !ch->rxku_in_progress
694 && !ch->rxku_pending_confirm;
695 }
696
697 QUIC_NEEDS_LOCK
txku_desirable(QUIC_CHANNEL * ch)698 static int txku_desirable(QUIC_CHANNEL *ch)
699 {
700 uint64_t cur_pkt_count, max_pkt_count, thresh_pkt_count;
701 const uint32_t enc_level = QUIC_ENC_LEVEL_1RTT;
702
703 /* Check AEAD limit to determine if we should perform a spontaneous TXKU. */
704 cur_pkt_count = ossl_qtx_get_cur_epoch_pkt_count(ch->qtx, enc_level);
705 max_pkt_count = ossl_qtx_get_max_epoch_pkt_count(ch->qtx, enc_level);
706
707 thresh_pkt_count = max_pkt_count / 2;
708 if (ch->txku_threshold_override != UINT64_MAX)
709 thresh_pkt_count = ch->txku_threshold_override;
710
711 return cur_pkt_count >= thresh_pkt_count;
712 }
713
714 QUIC_NEEDS_LOCK
ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL * ch)715 static void ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL *ch)
716 {
717 if (!txku_recommendable(ch) || !txku_desirable(ch))
718 return;
719
720 ch->ku_locally_initiated = 1;
721 ch_trigger_txku(ch);
722 }
723
724 QUIC_NEEDS_LOCK
rxku_allowed(QUIC_CHANNEL * ch)725 static int rxku_allowed(QUIC_CHANNEL *ch)
726 {
727 /*
728 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a key update prior to
729 * having confirmed the handshake (Section 4.1.2).
730 *
731 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a subsequent key update
732 * unless it has received an acknowledgment for a packet that was sent
733 * protected with keys from the current key phase.
734 *
735 * RFC 9001 s. 6.2: If an endpoint detects a second update before it has
736 * sent any packets with updated keys containing an acknowledgment for the
737 * packet that initiated the key update, it indicates that its peer has
738 * updated keys twice without awaiting confirmation. An endpoint MAY treat
739 * such consecutive key updates as a connection error of type
740 * KEY_UPDATE_ERROR.
741 */
742 return ch->handshake_confirmed && !ch->rxku_pending_confirm;
743 }
744
745 /*
746 * Called when the QRX detects a new RX key update event.
747 */
748 enum rxku_decision {
749 DECISION_RXKU_ONLY,
750 DECISION_PROTOCOL_VIOLATION,
751 DECISION_SOLICITED_TXKU
752 };
753
754 /* Called when the QRX detects a key update has occurred. */
755 QUIC_NEEDS_LOCK
rxku_detected(QUIC_PN pn,void * arg)756 static void rxku_detected(QUIC_PN pn, void *arg)
757 {
758 QUIC_CHANNEL *ch = arg;
759 enum rxku_decision decision;
760 OSSL_TIME pto;
761
762 /*
763 * Note: rxku_in_progress is always 0 here as an RXKU cannot be detected
764 * when we are still in UPDATING or COOLDOWN (see quic_record_rx.h).
765 */
766 assert(!ch->rxku_in_progress);
767
768 if (!rxku_allowed(ch))
769 /* Is RXKU even allowed at this time? */
770 decision = DECISION_PROTOCOL_VIOLATION;
771
772 else if (ch->ku_locally_initiated)
773 /*
774 * If this key update was locally initiated (meaning that this detected
775 * RXKU event is a result of our own spontaneous TXKU), we do not
776 * trigger another TXKU; after all, to do so would result in an infinite
777 * ping-pong of key updates. We still process it as an RXKU.
778 */
779 decision = DECISION_RXKU_ONLY;
780
781 else
782 /*
783 * Otherwise, a peer triggering a KU means we have to trigger a KU also.
784 */
785 decision = DECISION_SOLICITED_TXKU;
786
787 if (decision == DECISION_PROTOCOL_VIOLATION) {
788 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR,
789 0, "RX key update again too soon");
790 return;
791 }
792
793 pto = ossl_ackm_get_pto_duration(ch->ackm);
794
795 ch->ku_locally_initiated = 0;
796 ch->rxku_in_progress = 1;
797 ch->rxku_pending_confirm = 1;
798 ch->rxku_trigger_pn = pn;
799 ch->rxku_update_end_deadline = ossl_time_add(get_time(ch), pto);
800 ch->rxku_expected = 0;
801
802 if (decision == DECISION_SOLICITED_TXKU)
803 /* NOT gated by usual txku_allowed() */
804 ch_trigger_txku(ch);
805
806 /*
807 * Ordinarily, we only generate ACK when some ACK-eliciting frame has been
808 * received. In some cases, this may not occur for a long time, for example
809 * if transmission of application data is going in only one direction and
810 * nothing else is happening with the connection. However, since the peer
811 * cannot initiate a subsequent (spontaneous) TXKU until its prior
812 * (spontaneous or solicited) TXKU has completed - meaning that prior
813 * TXKU's trigger packet (or subsequent packet) has been acknowledged, this
814 * can lead to very long times before a TXKU is considered 'completed'.
815 * Optimise this by forcing ACK generation after triggering TXKU.
816 * (Basically, we consider a RXKU event something that is 'ACK-eliciting',
817 * which it more or less should be; it is necessarily separate from ordinary
818 * processing of ACK-eliciting frames as key update is not indicated via a
819 * frame.)
820 */
821 ossl_quic_tx_packetiser_schedule_ack(ch->txp, QUIC_PN_SPACE_APP);
822 }
823
824 /* Called per tick to handle RXKU timer events. */
825 QUIC_NEEDS_LOCK
ch_rxku_tick(QUIC_CHANNEL * ch)826 static void ch_rxku_tick(QUIC_CHANNEL *ch)
827 {
828 if (!ch->rxku_in_progress
829 || ossl_time_compare(get_time(ch), ch->rxku_update_end_deadline) < 0)
830 return;
831
832 ch->rxku_update_end_deadline = ossl_time_infinite();
833 ch->rxku_in_progress = 0;
834
835 if (!ossl_qrx_key_update_timeout(ch->qrx, /*normal=*/1))
836 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
837 "RXKU cooldown internal error");
838 }
839
840 QUIC_NEEDS_LOCK
ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK * ack,uint32_t pn_space,void * arg)841 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
842 void *arg)
843 {
844 QUIC_CHANNEL *ch = arg;
845
846 if (pn_space != QUIC_PN_SPACE_APP || !ch->rxku_pending_confirm
847 || !ossl_quic_frame_ack_contains_pn(ack, ch->rxku_trigger_pn))
848 return;
849
850 /*
851 * Defer clearing rxku_pending_confirm until TXP generate call returns
852 * successfully.
853 */
854 ch->rxku_pending_confirm_done = 1;
855 }
856
857 /*
858 * QUIC Channel: Handshake Layer Event Handling
859 * ============================================
860 */
ch_on_crypto_send(const unsigned char * buf,size_t buf_len,size_t * consumed,void * arg)861 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len,
862 size_t *consumed, void *arg)
863 {
864 int ret;
865 QUIC_CHANNEL *ch = arg;
866 uint32_t enc_level = ch->tx_enc_level;
867 uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
868 QUIC_SSTREAM *sstream = ch->crypto_send[pn_space];
869
870 if (!ossl_assert(sstream != NULL))
871 return 0;
872
873 ret = ossl_quic_sstream_append(sstream, buf, buf_len, consumed);
874 return ret;
875 }
876
crypto_ensure_empty(QUIC_RSTREAM * rstream)877 static int crypto_ensure_empty(QUIC_RSTREAM *rstream)
878 {
879 size_t avail = 0;
880 int is_fin = 0;
881
882 if (rstream == NULL)
883 return 1;
884
885 if (!ossl_quic_rstream_available(rstream, &avail, &is_fin))
886 return 0;
887
888 return avail == 0;
889 }
890
ch_on_crypto_recv_record(const unsigned char ** buf,size_t * bytes_read,void * arg)891 static int ch_on_crypto_recv_record(const unsigned char **buf,
892 size_t *bytes_read, void *arg)
893 {
894 QUIC_CHANNEL *ch = arg;
895 QUIC_RSTREAM *rstream;
896 int is_fin = 0; /* crypto stream is never finished, so we don't use this */
897 uint32_t i;
898
899 /*
900 * After we move to a later EL we must not allow our peer to send any new
901 * bytes in the crypto stream on a previous EL. Retransmissions of old bytes
902 * are allowed.
903 *
904 * In practice we will only move to a new EL when we have consumed all bytes
905 * which should be sent on the crypto stream at a previous EL. For example,
906 * the Handshake EL should not be provisioned until we have completely
907 * consumed a TLS 1.3 ServerHello. Thus when we provision an EL the output
908 * of ossl_quic_rstream_available() should be 0 for all lower ELs. Thus if a
909 * given EL is available we simply ensure we have not received any further
910 * bytes at a lower EL.
911 */
912 for (i = QUIC_ENC_LEVEL_INITIAL; i < ch->rx_enc_level; ++i)
913 if (i != QUIC_ENC_LEVEL_0RTT &&
914 !crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) {
915 /* Protocol violation (RFC 9001 s. 4.1.3) */
916 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
917 OSSL_QUIC_FRAME_TYPE_CRYPTO,
918 "crypto stream data in wrong EL");
919 return 0;
920 }
921
922 rstream = ch->crypto_recv[ossl_quic_enc_level_to_pn_space(ch->rx_enc_level)];
923 if (rstream == NULL)
924 return 0;
925
926 return ossl_quic_rstream_get_record(rstream, buf, bytes_read,
927 &is_fin);
928 }
929
ch_on_crypto_release_record(size_t bytes_read,void * arg)930 static int ch_on_crypto_release_record(size_t bytes_read, void *arg)
931 {
932 QUIC_CHANNEL *ch = arg;
933 QUIC_RSTREAM *rstream;
934 OSSL_RTT_INFO rtt_info;
935 uint32_t rx_pn_space = ossl_quic_enc_level_to_pn_space(ch->rx_enc_level);
936
937 rstream = ch->crypto_recv[rx_pn_space];
938 if (rstream == NULL)
939 return 0;
940
941 ossl_statm_get_rtt_info(ossl_quic_channel_get_statm(ch), &rtt_info);
942 if (!ossl_quic_rxfc_on_retire(&ch->crypto_rxfc[rx_pn_space], bytes_read,
943 rtt_info.smoothed_rtt))
944 return 0;
945
946 return ossl_quic_rstream_release_record(rstream, bytes_read);
947 }
948
ch_on_handshake_yield_secret(uint32_t enc_level,int direction,uint32_t suite_id,EVP_MD * md,const unsigned char * secret,size_t secret_len,void * arg)949 static int ch_on_handshake_yield_secret(uint32_t enc_level, int direction,
950 uint32_t suite_id, EVP_MD *md,
951 const unsigned char *secret,
952 size_t secret_len,
953 void *arg)
954 {
955 QUIC_CHANNEL *ch = arg;
956 uint32_t i;
957
958 if (enc_level < QUIC_ENC_LEVEL_HANDSHAKE || enc_level >= QUIC_ENC_LEVEL_NUM)
959 /* Invalid EL. */
960 return 0;
961
962
963 if (direction) {
964 /* TX */
965 if (enc_level <= ch->tx_enc_level)
966 /*
967 * Does not make sense for us to try and provision an EL we have already
968 * attained.
969 */
970 return 0;
971
972 if (!ossl_qtx_provide_secret(ch->qtx, enc_level,
973 suite_id, md,
974 secret, secret_len))
975 return 0;
976
977 ch->tx_enc_level = enc_level;
978 } else {
979 /* RX */
980 if (enc_level <= ch->rx_enc_level)
981 /*
982 * Does not make sense for us to try and provision an EL we have already
983 * attained.
984 */
985 return 0;
986
987 /*
988 * Ensure all crypto streams for previous ELs are now empty of available
989 * data.
990 */
991 for (i = QUIC_ENC_LEVEL_INITIAL; i < enc_level; ++i)
992 if (!crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) {
993 /* Protocol violation (RFC 9001 s. 4.1.3) */
994 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
995 OSSL_QUIC_FRAME_TYPE_CRYPTO,
996 "crypto stream data in wrong EL");
997 return 0;
998 }
999
1000 if (!ossl_qrx_provide_secret(ch->qrx, enc_level,
1001 suite_id, md,
1002 secret, secret_len))
1003 return 0;
1004
1005 ch->have_new_rx_secret = 1;
1006 ch->rx_enc_level = enc_level;
1007 }
1008
1009 return 1;
1010 }
1011
ch_on_handshake_complete(void * arg)1012 static int ch_on_handshake_complete(void *arg)
1013 {
1014 QUIC_CHANNEL *ch = arg;
1015
1016 if (!ossl_assert(!ch->handshake_complete))
1017 return 0; /* this should not happen twice */
1018
1019 if (!ossl_assert(ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT))
1020 return 0;
1021
1022 if (!ch->got_remote_transport_params) {
1023 /*
1024 * Was not a valid QUIC handshake if we did not get valid transport
1025 * params.
1026 */
1027 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_CRYPTO_MISSING_EXT,
1028 OSSL_QUIC_FRAME_TYPE_CRYPTO,
1029 "no transport parameters received");
1030 return 0;
1031 }
1032
1033 /* Don't need transport parameters anymore. */
1034 OPENSSL_free(ch->local_transport_params);
1035 ch->local_transport_params = NULL;
1036
1037 /* Tell the QRX it can now process 1-RTT packets. */
1038 ossl_qrx_allow_1rtt_processing(ch->qrx);
1039
1040 /* Tell TXP the handshake is complete. */
1041 ossl_quic_tx_packetiser_notify_handshake_complete(ch->txp);
1042
1043 ch->handshake_complete = 1;
1044
1045 if (ch->is_server) {
1046 /*
1047 * On the server, the handshake is confirmed as soon as it is complete.
1048 */
1049 ossl_quic_channel_on_handshake_confirmed(ch);
1050
1051 ossl_quic_tx_packetiser_schedule_handshake_done(ch->txp);
1052 }
1053
1054 ch_record_state_transition(ch, ch->state);
1055 return 1;
1056 }
1057
ch_on_handshake_alert(void * arg,unsigned char alert_code)1058 static int ch_on_handshake_alert(void *arg, unsigned char alert_code)
1059 {
1060 QUIC_CHANNEL *ch = arg;
1061
1062 /*
1063 * RFC 9001 s. 4.4: More specifically, servers MUST NOT send post-handshake
1064 * TLS CertificateRequest messages, and clients MUST treat receipt of such
1065 * messages as a connection error of type PROTOCOL_VIOLATION.
1066 */
1067 if (alert_code == SSL_AD_UNEXPECTED_MESSAGE
1068 && ch->handshake_complete
1069 && ossl_quic_tls_is_cert_request(ch->qtls))
1070 ossl_quic_channel_raise_protocol_error(ch,
1071 OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1072 0,
1073 "Post-handshake TLS "
1074 "CertificateRequest received");
1075 /*
1076 * RFC 9001 s. 4.6.1: Servers MUST NOT send the early_data extension with a
1077 * max_early_data_size field set to any value other than 0xffffffff. A
1078 * client MUST treat receipt of a NewSessionTicket that contains an
1079 * early_data extension with any other value as a connection error of type
1080 * PROTOCOL_VIOLATION.
1081 */
1082 else if (alert_code == SSL_AD_ILLEGAL_PARAMETER
1083 && ch->handshake_complete
1084 && ossl_quic_tls_has_bad_max_early_data(ch->qtls))
1085 ossl_quic_channel_raise_protocol_error(ch,
1086 OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1087 0,
1088 "Bad max_early_data received");
1089 else
1090 ossl_quic_channel_raise_protocol_error(ch,
1091 OSSL_QUIC_ERR_CRYPTO_ERR_BEGIN
1092 + alert_code,
1093 0, "handshake alert");
1094
1095 return 1;
1096 }
1097
1098 /*
1099 * QUIC Channel: Transport Parameter Handling
1100 * ==========================================
1101 */
1102
1103 /*
1104 * Called by handshake layer when we receive QUIC Transport Parameters from the
1105 * peer. Note that these are not authenticated until the handshake is marked
1106 * as complete.
1107 */
1108 #define TP_REASON_SERVER_ONLY(x) \
1109 x " may not be sent by a client"
1110 #define TP_REASON_DUP(x) \
1111 x " appears multiple times"
1112 #define TP_REASON_MALFORMED(x) \
1113 x " is malformed"
1114 #define TP_REASON_EXPECTED_VALUE(x) \
1115 x " does not match expected value"
1116 #define TP_REASON_NOT_RETRY(x) \
1117 x " sent when not performing a retry"
1118 #define TP_REASON_REQUIRED(x) \
1119 x " was not sent but is required"
1120 #define TP_REASON_INTERNAL_ERROR(x) \
1121 x " encountered internal error"
1122
txfc_bump_cwm_bidi(QUIC_STREAM * s,void * arg)1123 static void txfc_bump_cwm_bidi(QUIC_STREAM *s, void *arg)
1124 {
1125 if (!ossl_quic_stream_is_bidi(s)
1126 || ossl_quic_stream_is_server_init(s))
1127 return;
1128
1129 ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg);
1130 }
1131
txfc_bump_cwm_uni(QUIC_STREAM * s,void * arg)1132 static void txfc_bump_cwm_uni(QUIC_STREAM *s, void *arg)
1133 {
1134 if (ossl_quic_stream_is_bidi(s)
1135 || ossl_quic_stream_is_server_init(s))
1136 return;
1137
1138 ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg);
1139 }
1140
do_update(QUIC_STREAM * s,void * arg)1141 static void do_update(QUIC_STREAM *s, void *arg)
1142 {
1143 QUIC_CHANNEL *ch = arg;
1144
1145 ossl_quic_stream_map_update_state(&ch->qsm, s);
1146 }
1147
min_u64_ignore_0(uint64_t a,uint64_t b)1148 static uint64_t min_u64_ignore_0(uint64_t a, uint64_t b)
1149 {
1150 if (a == 0)
1151 return b;
1152 if (b == 0)
1153 return a;
1154
1155 return a < b ? a : b;
1156 }
1157
ch_on_transport_params(const unsigned char * params,size_t params_len,void * arg)1158 static int ch_on_transport_params(const unsigned char *params,
1159 size_t params_len,
1160 void *arg)
1161 {
1162 QUIC_CHANNEL *ch = arg;
1163 PACKET pkt;
1164 uint64_t id, v;
1165 size_t len;
1166 const unsigned char *body;
1167 int got_orig_dcid = 0;
1168 int got_initial_scid = 0;
1169 int got_retry_scid = 0;
1170 int got_initial_max_data = 0;
1171 int got_initial_max_stream_data_bidi_local = 0;
1172 int got_initial_max_stream_data_bidi_remote = 0;
1173 int got_initial_max_stream_data_uni = 0;
1174 int got_initial_max_streams_bidi = 0;
1175 int got_initial_max_streams_uni = 0;
1176 int got_stateless_reset_token = 0;
1177 int got_preferred_addr = 0;
1178 int got_ack_delay_exp = 0;
1179 int got_max_ack_delay = 0;
1180 int got_max_udp_payload_size = 0;
1181 int got_max_idle_timeout = 0;
1182 int got_active_conn_id_limit = 0;
1183 int got_disable_active_migration = 0;
1184 QUIC_CONN_ID cid;
1185 const char *reason = "bad transport parameter";
1186 ossl_unused uint64_t rx_max_idle_timeout = 0;
1187 ossl_unused const void *stateless_reset_token_p = NULL;
1188 QUIC_PREFERRED_ADDR pfa;
1189
1190 if (ch->got_remote_transport_params) {
1191 reason = "multiple transport parameter extensions";
1192 goto malformed;
1193 }
1194
1195 if (!PACKET_buf_init(&pkt, params, params_len)) {
1196 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
1197 "internal error (packet buf init)");
1198 return 0;
1199 }
1200
1201 while (PACKET_remaining(&pkt) > 0) {
1202 if (!ossl_quic_wire_peek_transport_param(&pkt, &id))
1203 goto malformed;
1204
1205 switch (id) {
1206 case QUIC_TPARAM_ORIG_DCID:
1207 if (got_orig_dcid) {
1208 reason = TP_REASON_DUP("ORIG_DCID");
1209 goto malformed;
1210 }
1211
1212 if (ch->is_server) {
1213 reason = TP_REASON_SERVER_ONLY("ORIG_DCID");
1214 goto malformed;
1215 }
1216
1217 if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1218 reason = TP_REASON_MALFORMED("ORIG_DCID");
1219 goto malformed;
1220 }
1221
1222 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1223 /* Must match our initial DCID. */
1224 if (!ossl_quic_conn_id_eq(&ch->init_dcid, &cid)) {
1225 reason = TP_REASON_EXPECTED_VALUE("ORIG_DCID");
1226 goto malformed;
1227 }
1228 #endif
1229
1230 got_orig_dcid = 1;
1231 break;
1232
1233 case QUIC_TPARAM_RETRY_SCID:
1234 if (ch->is_server) {
1235 reason = TP_REASON_SERVER_ONLY("RETRY_SCID");
1236 goto malformed;
1237 }
1238
1239 if (got_retry_scid) {
1240 reason = TP_REASON_DUP("RETRY_SCID");
1241 goto malformed;
1242 }
1243
1244 if (!ch->doing_retry) {
1245 reason = TP_REASON_NOT_RETRY("RETRY_SCID");
1246 goto malformed;
1247 }
1248
1249 if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1250 reason = TP_REASON_MALFORMED("RETRY_SCID");
1251 goto malformed;
1252 }
1253
1254 /* Must match Retry packet SCID. */
1255 if (!ossl_quic_conn_id_eq(&ch->retry_scid, &cid)) {
1256 reason = TP_REASON_EXPECTED_VALUE("RETRY_SCID");
1257 goto malformed;
1258 }
1259
1260 got_retry_scid = 1;
1261 break;
1262
1263 case QUIC_TPARAM_INITIAL_SCID:
1264 if (got_initial_scid) {
1265 /* must not appear more than once */
1266 reason = TP_REASON_DUP("INITIAL_SCID");
1267 goto malformed;
1268 }
1269
1270 if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1271 reason = TP_REASON_MALFORMED("INITIAL_SCID");
1272 goto malformed;
1273 }
1274
1275 /* Must match SCID of first Initial packet from server. */
1276 if (!ossl_quic_conn_id_eq(&ch->init_scid, &cid)) {
1277 reason = TP_REASON_EXPECTED_VALUE("INITIAL_SCID");
1278 goto malformed;
1279 }
1280
1281 got_initial_scid = 1;
1282 break;
1283
1284 case QUIC_TPARAM_INITIAL_MAX_DATA:
1285 if (got_initial_max_data) {
1286 /* must not appear more than once */
1287 reason = TP_REASON_DUP("INITIAL_MAX_DATA");
1288 goto malformed;
1289 }
1290
1291 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1292 reason = TP_REASON_MALFORMED("INITIAL_MAX_DATA");
1293 goto malformed;
1294 }
1295
1296 ossl_quic_txfc_bump_cwm(&ch->conn_txfc, v);
1297 got_initial_max_data = 1;
1298 break;
1299
1300 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL:
1301 if (got_initial_max_stream_data_bidi_local) {
1302 /* must not appear more than once */
1303 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1304 goto malformed;
1305 }
1306
1307 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1308 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1309 goto malformed;
1310 }
1311
1312 /*
1313 * This is correct; the BIDI_LOCAL TP governs streams created by
1314 * the endpoint which sends the TP, i.e., our peer.
1315 */
1316 ch->rx_init_max_stream_data_bidi_remote = v;
1317 got_initial_max_stream_data_bidi_local = 1;
1318 break;
1319
1320 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE:
1321 if (got_initial_max_stream_data_bidi_remote) {
1322 /* must not appear more than once */
1323 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1324 goto malformed;
1325 }
1326
1327 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1328 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1329 goto malformed;
1330 }
1331
1332 /*
1333 * This is correct; the BIDI_REMOTE TP governs streams created
1334 * by the endpoint which receives the TP, i.e., us.
1335 */
1336 ch->rx_init_max_stream_data_bidi_local = v;
1337
1338 /* Apply to all existing streams. */
1339 ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_bidi, &v);
1340 got_initial_max_stream_data_bidi_remote = 1;
1341 break;
1342
1343 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI:
1344 if (got_initial_max_stream_data_uni) {
1345 /* must not appear more than once */
1346 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_UNI");
1347 goto malformed;
1348 }
1349
1350 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1351 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_UNI");
1352 goto malformed;
1353 }
1354
1355 ch->rx_init_max_stream_data_uni = v;
1356
1357 /* Apply to all existing streams. */
1358 ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_uni, &v);
1359 got_initial_max_stream_data_uni = 1;
1360 break;
1361
1362 case QUIC_TPARAM_ACK_DELAY_EXP:
1363 if (got_ack_delay_exp) {
1364 /* must not appear more than once */
1365 reason = TP_REASON_DUP("ACK_DELAY_EXP");
1366 goto malformed;
1367 }
1368
1369 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1370 || v > QUIC_MAX_ACK_DELAY_EXP) {
1371 reason = TP_REASON_MALFORMED("ACK_DELAY_EXP");
1372 goto malformed;
1373 }
1374
1375 ch->rx_ack_delay_exp = (unsigned char)v;
1376 got_ack_delay_exp = 1;
1377 break;
1378
1379 case QUIC_TPARAM_MAX_ACK_DELAY:
1380 if (got_max_ack_delay) {
1381 /* must not appear more than once */
1382 reason = TP_REASON_DUP("MAX_ACK_DELAY");
1383 goto malformed;
1384 }
1385
1386 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1387 || v >= (((uint64_t)1) << 14)) {
1388 reason = TP_REASON_MALFORMED("MAX_ACK_DELAY");
1389 goto malformed;
1390 }
1391
1392 ch->rx_max_ack_delay = v;
1393 ossl_ackm_set_rx_max_ack_delay(ch->ackm,
1394 ossl_ms2time(ch->rx_max_ack_delay));
1395
1396 got_max_ack_delay = 1;
1397 break;
1398
1399 case QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI:
1400 if (got_initial_max_streams_bidi) {
1401 /* must not appear more than once */
1402 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_BIDI");
1403 goto malformed;
1404 }
1405
1406 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1407 || v > (((uint64_t)1) << 60)) {
1408 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_BIDI");
1409 goto malformed;
1410 }
1411
1412 assert(ch->max_local_streams_bidi == 0);
1413 ch->max_local_streams_bidi = v;
1414 got_initial_max_streams_bidi = 1;
1415 break;
1416
1417 case QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI:
1418 if (got_initial_max_streams_uni) {
1419 /* must not appear more than once */
1420 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_UNI");
1421 goto malformed;
1422 }
1423
1424 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1425 || v > (((uint64_t)1) << 60)) {
1426 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_UNI");
1427 goto malformed;
1428 }
1429
1430 assert(ch->max_local_streams_uni == 0);
1431 ch->max_local_streams_uni = v;
1432 got_initial_max_streams_uni = 1;
1433 break;
1434
1435 case QUIC_TPARAM_MAX_IDLE_TIMEOUT:
1436 if (got_max_idle_timeout) {
1437 /* must not appear more than once */
1438 reason = TP_REASON_DUP("MAX_IDLE_TIMEOUT");
1439 goto malformed;
1440 }
1441
1442 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1443 reason = TP_REASON_MALFORMED("MAX_IDLE_TIMEOUT");
1444 goto malformed;
1445 }
1446
1447 ch->max_idle_timeout_remote_req = v;
1448
1449 ch->max_idle_timeout = min_u64_ignore_0(ch->max_idle_timeout_local_req,
1450 ch->max_idle_timeout_remote_req);
1451
1452
1453 ch_update_idle(ch);
1454 got_max_idle_timeout = 1;
1455 rx_max_idle_timeout = v;
1456 break;
1457
1458 case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE:
1459 if (got_max_udp_payload_size) {
1460 /* must not appear more than once */
1461 reason = TP_REASON_DUP("MAX_UDP_PAYLOAD_SIZE");
1462 goto malformed;
1463 }
1464
1465 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1466 || v < QUIC_MIN_INITIAL_DGRAM_LEN) {
1467 reason = TP_REASON_MALFORMED("MAX_UDP_PAYLOAD_SIZE");
1468 goto malformed;
1469 }
1470
1471 ch->rx_max_udp_payload_size = v;
1472 got_max_udp_payload_size = 1;
1473 break;
1474
1475 case QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT:
1476 if (got_active_conn_id_limit) {
1477 /* must not appear more than once */
1478 reason = TP_REASON_DUP("ACTIVE_CONN_ID_LIMIT");
1479 goto malformed;
1480 }
1481
1482 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1483 || v < QUIC_MIN_ACTIVE_CONN_ID_LIMIT) {
1484 reason = TP_REASON_MALFORMED("ACTIVE_CONN_ID_LIMIT");
1485 goto malformed;
1486 }
1487
1488 ch->rx_active_conn_id_limit = v;
1489 got_active_conn_id_limit = 1;
1490 break;
1491
1492 case QUIC_TPARAM_STATELESS_RESET_TOKEN:
1493 if (got_stateless_reset_token) {
1494 reason = TP_REASON_DUP("STATELESS_RESET_TOKEN");
1495 goto malformed;
1496 }
1497
1498 /*
1499 * We must ensure a client doesn't send them because we don't have
1500 * processing for them.
1501 *
1502 * TODO(QUIC SERVER): remove this restriction
1503 */
1504 if (ch->is_server) {
1505 reason = TP_REASON_SERVER_ONLY("STATELESS_RESET_TOKEN");
1506 goto malformed;
1507 }
1508
1509 body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len);
1510 if (body == NULL || len != QUIC_STATELESS_RESET_TOKEN_LEN) {
1511 reason = TP_REASON_MALFORMED("STATELESS_RESET_TOKEN");
1512 goto malformed;
1513 }
1514 if (!ossl_quic_srtm_add(ch->srtm, ch, ch->cur_remote_seq_num,
1515 (const QUIC_STATELESS_RESET_TOKEN *)body)) {
1516 reason = TP_REASON_INTERNAL_ERROR("STATELESS_RESET_TOKEN");
1517 goto malformed;
1518 }
1519
1520 stateless_reset_token_p = body;
1521 got_stateless_reset_token = 1;
1522 break;
1523
1524 case QUIC_TPARAM_PREFERRED_ADDR:
1525 /* TODO(QUIC FUTURE): Handle preferred address. */
1526 if (got_preferred_addr) {
1527 reason = TP_REASON_DUP("PREFERRED_ADDR");
1528 goto malformed;
1529 }
1530
1531 /*
1532 * RFC 9000 s. 18.2: "A server that chooses a zero-length
1533 * connection ID MUST NOT provide a preferred address.
1534 * Similarly, a server MUST NOT include a zero-length connection
1535 * ID in this transport parameter. A client MUST treat a
1536 * violation of these requirements as a connection error of type
1537 * TRANSPORT_PARAMETER_ERROR."
1538 */
1539 if (ch->is_server) {
1540 reason = TP_REASON_SERVER_ONLY("PREFERRED_ADDR");
1541 goto malformed;
1542 }
1543
1544 if (ch->cur_remote_dcid.id_len == 0) {
1545 reason = "PREFERRED_ADDR provided for zero-length CID";
1546 goto malformed;
1547 }
1548
1549 if (!ossl_quic_wire_decode_transport_param_preferred_addr(&pkt, &pfa)) {
1550 reason = TP_REASON_MALFORMED("PREFERRED_ADDR");
1551 goto malformed;
1552 }
1553
1554 if (pfa.cid.id_len == 0) {
1555 reason = "zero-length CID in PREFERRED_ADDR";
1556 goto malformed;
1557 }
1558
1559 got_preferred_addr = 1;
1560 break;
1561
1562 case QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION:
1563 /* We do not currently handle migration, so nothing to do. */
1564 if (got_disable_active_migration) {
1565 /* must not appear more than once */
1566 reason = TP_REASON_DUP("DISABLE_ACTIVE_MIGRATION");
1567 goto malformed;
1568 }
1569
1570 body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len);
1571 if (body == NULL || len > 0) {
1572 reason = TP_REASON_MALFORMED("DISABLE_ACTIVE_MIGRATION");
1573 goto malformed;
1574 }
1575
1576 got_disable_active_migration = 1;
1577 break;
1578
1579 default:
1580 /*
1581 * Skip over and ignore.
1582 *
1583 * RFC 9000 s. 7.4: We SHOULD treat duplicated transport parameters
1584 * as a connection error, but we are not required to. Currently,
1585 * handle this programmatically by checking for duplicates in the
1586 * parameters that we recognise, as above, but don't bother
1587 * maintaining a list of duplicates for anything we don't recognise.
1588 */
1589 body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id,
1590 &len);
1591 if (body == NULL)
1592 goto malformed;
1593
1594 break;
1595 }
1596 }
1597
1598 if (!got_initial_scid) {
1599 reason = TP_REASON_REQUIRED("INITIAL_SCID");
1600 goto malformed;
1601 }
1602
1603 if (!ch->is_server) {
1604 if (!got_orig_dcid) {
1605 reason = TP_REASON_REQUIRED("ORIG_DCID");
1606 goto malformed;
1607 }
1608
1609 if (ch->doing_retry && !got_retry_scid) {
1610 reason = TP_REASON_REQUIRED("RETRY_SCID");
1611 goto malformed;
1612 }
1613 }
1614
1615 ch->got_remote_transport_params = 1;
1616
1617 #ifndef OPENSSL_NO_QLOG
1618 QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
1619 QLOG_STR("owner", "remote");
1620
1621 if (got_orig_dcid)
1622 QLOG_CID("original_destination_connection_id",
1623 &ch->init_dcid);
1624 if (got_initial_scid)
1625 QLOG_CID("original_source_connection_id",
1626 &ch->init_dcid);
1627 if (got_retry_scid)
1628 QLOG_CID("retry_source_connection_id",
1629 &ch->retry_scid);
1630 if (got_initial_max_data)
1631 QLOG_U64("initial_max_data",
1632 ossl_quic_txfc_get_cwm(&ch->conn_txfc));
1633 if (got_initial_max_stream_data_bidi_local)
1634 QLOG_U64("initial_max_stream_data_bidi_local",
1635 ch->rx_init_max_stream_data_bidi_local);
1636 if (got_initial_max_stream_data_bidi_remote)
1637 QLOG_U64("initial_max_stream_data_bidi_remote",
1638 ch->rx_init_max_stream_data_bidi_remote);
1639 if (got_initial_max_stream_data_uni)
1640 QLOG_U64("initial_max_stream_data_uni",
1641 ch->rx_init_max_stream_data_uni);
1642 if (got_initial_max_streams_bidi)
1643 QLOG_U64("initial_max_streams_bidi",
1644 ch->max_local_streams_bidi);
1645 if (got_initial_max_streams_uni)
1646 QLOG_U64("initial_max_streams_uni",
1647 ch->max_local_streams_uni);
1648 if (got_ack_delay_exp)
1649 QLOG_U64("ack_delay_exponent", ch->rx_ack_delay_exp);
1650 if (got_max_ack_delay)
1651 QLOG_U64("max_ack_delay", ch->rx_max_ack_delay);
1652 if (got_max_udp_payload_size)
1653 QLOG_U64("max_udp_payload_size", ch->rx_max_udp_payload_size);
1654 if (got_max_idle_timeout)
1655 QLOG_U64("max_idle_timeout", rx_max_idle_timeout);
1656 if (got_active_conn_id_limit)
1657 QLOG_U64("active_connection_id_limit", ch->rx_active_conn_id_limit);
1658 if (got_stateless_reset_token)
1659 QLOG_BIN("stateless_reset_token", stateless_reset_token_p,
1660 QUIC_STATELESS_RESET_TOKEN_LEN);
1661 if (got_preferred_addr) {
1662 QLOG_BEGIN("preferred_addr")
1663 QLOG_U64("port_v4", pfa.ipv4_port);
1664 QLOG_U64("port_v6", pfa.ipv6_port);
1665 QLOG_BIN("ip_v4", pfa.ipv4, sizeof(pfa.ipv4));
1666 QLOG_BIN("ip_v6", pfa.ipv6, sizeof(pfa.ipv6));
1667 QLOG_BIN("stateless_reset_token", pfa.stateless_reset.token,
1668 sizeof(pfa.stateless_reset.token));
1669 QLOG_CID("connection_id", &pfa.cid);
1670 QLOG_END()
1671 }
1672 QLOG_BOOL("disable_active_migration", got_disable_active_migration);
1673 QLOG_EVENT_END()
1674 #endif
1675
1676 if (got_initial_max_data || got_initial_max_stream_data_bidi_remote
1677 || got_initial_max_streams_bidi || got_initial_max_streams_uni)
1678 /*
1679 * If FC credit was bumped, we may now be able to send. Update all
1680 * streams.
1681 */
1682 ossl_quic_stream_map_visit(&ch->qsm, do_update, ch);
1683
1684 /* If we are a server, we now generate our own transport parameters. */
1685 if (ch->is_server && !ch_generate_transport_params(ch)) {
1686 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
1687 "internal error");
1688 return 0;
1689 }
1690
1691 return 1;
1692
1693 malformed:
1694 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_TRANSPORT_PARAMETER_ERROR,
1695 0, reason);
1696 return 0;
1697 }
1698
1699 /*
1700 * Called when we want to generate transport parameters. This is called
1701 * immediately at instantiation time for a client and after we receive the
1702 * client's transport parameters for a server.
1703 */
ch_generate_transport_params(QUIC_CHANNEL * ch)1704 static int ch_generate_transport_params(QUIC_CHANNEL *ch)
1705 {
1706 int ok = 0;
1707 BUF_MEM *buf_mem = NULL;
1708 WPACKET wpkt;
1709 int wpkt_valid = 0;
1710 size_t buf_len = 0;
1711
1712 if (ch->local_transport_params != NULL || ch->got_local_transport_params)
1713 goto err;
1714
1715 if ((buf_mem = BUF_MEM_new()) == NULL)
1716 goto err;
1717
1718 if (!WPACKET_init(&wpkt, buf_mem))
1719 goto err;
1720
1721 wpkt_valid = 1;
1722
1723 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt, QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION,
1724 NULL, 0) == NULL)
1725 goto err;
1726
1727 if (ch->is_server) {
1728 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_ORIG_DCID,
1729 &ch->init_dcid))
1730 goto err;
1731
1732 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_INITIAL_SCID,
1733 &ch->cur_local_cid))
1734 goto err;
1735 } else {
1736 /* Client always uses an empty SCID. */
1737 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt, QUIC_TPARAM_INITIAL_SCID,
1738 NULL, 0) == NULL)
1739 goto err;
1740 }
1741
1742 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_IDLE_TIMEOUT,
1743 ch->max_idle_timeout_local_req))
1744 goto err;
1745
1746 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE,
1747 QUIC_MIN_INITIAL_DGRAM_LEN))
1748 goto err;
1749
1750 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT,
1751 QUIC_MIN_ACTIVE_CONN_ID_LIMIT))
1752 goto err;
1753
1754 if (ch->tx_max_ack_delay != QUIC_DEFAULT_MAX_ACK_DELAY
1755 && !ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_ACK_DELAY,
1756 ch->tx_max_ack_delay))
1757 goto err;
1758
1759 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_DATA,
1760 ossl_quic_rxfc_get_cwm(&ch->conn_rxfc)))
1761 goto err;
1762
1763 /* Send the default CWM for a new RXFC. */
1764 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL,
1765 ch->tx_init_max_stream_data_bidi_local))
1766 goto err;
1767
1768 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE,
1769 ch->tx_init_max_stream_data_bidi_remote))
1770 goto err;
1771
1772 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI,
1773 ch->tx_init_max_stream_data_uni))
1774 goto err;
1775
1776 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI,
1777 ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc)))
1778 goto err;
1779
1780 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI,
1781 ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc)))
1782 goto err;
1783
1784 if (!WPACKET_finish(&wpkt))
1785 goto err;
1786
1787 wpkt_valid = 0;
1788
1789 if (!WPACKET_get_total_written(&wpkt, &buf_len))
1790 goto err;
1791
1792 ch->local_transport_params = (unsigned char *)buf_mem->data;
1793 buf_mem->data = NULL;
1794
1795
1796 if (!ossl_quic_tls_set_transport_params(ch->qtls, ch->local_transport_params,
1797 buf_len))
1798 goto err;
1799
1800 #ifndef OPENSSL_NO_QLOG
1801 QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
1802 QLOG_STR("owner", "local");
1803 QLOG_BOOL("disable_active_migration", 1);
1804 if (ch->is_server) {
1805 QLOG_CID("original_destination_connection_id", &ch->init_dcid);
1806 QLOG_CID("initial_source_connection_id", &ch->cur_local_cid);
1807 } else {
1808 QLOG_STR("initial_source_connection_id", "");
1809 }
1810 QLOG_U64("max_idle_timeout", ch->max_idle_timeout);
1811 QLOG_U64("max_udp_payload_size", QUIC_MIN_INITIAL_DGRAM_LEN);
1812 QLOG_U64("active_connection_id_limit", QUIC_MIN_ACTIVE_CONN_ID_LIMIT);
1813 QLOG_U64("max_ack_delay", ch->tx_max_ack_delay);
1814 QLOG_U64("initial_max_data", ossl_quic_rxfc_get_cwm(&ch->conn_rxfc));
1815 QLOG_U64("initial_max_stream_data_bidi_local",
1816 ch->tx_init_max_stream_data_bidi_local);
1817 QLOG_U64("initial_max_stream_data_bidi_remote",
1818 ch->tx_init_max_stream_data_bidi_remote);
1819 QLOG_U64("initial_max_stream_data_uni",
1820 ch->tx_init_max_stream_data_uni);
1821 QLOG_U64("initial_max_streams_bidi",
1822 ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc));
1823 QLOG_U64("initial_max_streams_uni",
1824 ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc));
1825 QLOG_EVENT_END()
1826 #endif
1827
1828 ch->got_local_transport_params = 1;
1829
1830 ok = 1;
1831 err:
1832 if (wpkt_valid)
1833 WPACKET_cleanup(&wpkt);
1834 BUF_MEM_free(buf_mem);
1835 return ok;
1836 }
1837
1838 /*
1839 * QUIC Channel: Ticker-Mutator
1840 * ============================
1841 */
1842
1843 /*
1844 * The central ticker function called by the reactor. This does everything, or
1845 * at least everything network I/O related. Best effort - not allowed to fail
1846 * "loudly".
1847 */
ossl_quic_channel_subtick(QUIC_CHANNEL * ch,QUIC_TICK_RESULT * res,uint32_t flags)1848 void ossl_quic_channel_subtick(QUIC_CHANNEL *ch, QUIC_TICK_RESULT *res,
1849 uint32_t flags)
1850 {
1851 OSSL_TIME now, deadline;
1852 int channel_only = (flags & QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY) != 0;
1853
1854 /*
1855 * When we tick the QUIC connection, we do everything we need to do
1856 * periodically. Network I/O handling will already have been performed
1857 * as necessary by the QUIC port. Thus, in order, we:
1858 *
1859 * - handle any packets the DEMUX has queued up for us;
1860 * - handle any timer events which are due to fire (ACKM, etc.);
1861 * - generate any packets which need to be sent;
1862 * - determine the time at which we should next be ticked.
1863 */
1864
1865 /* If we are in the TERMINATED state, there is nothing to do. */
1866 if (ossl_quic_channel_is_terminated(ch)) {
1867 res->net_read_desired = 0;
1868 res->net_write_desired = 0;
1869 res->tick_deadline = ossl_time_infinite();
1870 return;
1871 }
1872
1873 /*
1874 * If we are in the TERMINATING state, check if the terminating timer has
1875 * expired.
1876 */
1877 if (ossl_quic_channel_is_terminating(ch)) {
1878 now = get_time(ch);
1879
1880 if (ossl_time_compare(now, ch->terminate_deadline) >= 0) {
1881 ch_on_terminating_timeout(ch);
1882 res->net_read_desired = 0;
1883 res->net_write_desired = 0;
1884 res->tick_deadline = ossl_time_infinite();
1885 return; /* abort normal processing, nothing to do */
1886 }
1887 }
1888
1889 if (!ch->port->engine->inhibit_tick) {
1890 /* Handle RXKU timeouts. */
1891 ch_rxku_tick(ch);
1892
1893 do {
1894 /* Process queued incoming packets. */
1895 ch->did_tls_tick = 0;
1896 ch->have_new_rx_secret = 0;
1897 ch_rx(ch, channel_only);
1898
1899 /*
1900 * Allow the handshake layer to check for any new incoming data and
1901 * generate new outgoing data.
1902 */
1903 if (!ch->did_tls_tick)
1904 ch_tick_tls(ch, channel_only);
1905
1906 /*
1907 * If the handshake layer gave us a new secret, we need to do RX
1908 * again because packets that were not previously processable and
1909 * were deferred might now be processable.
1910 *
1911 * TODO(QUIC FUTURE): Consider handling this in the yield_secret callback.
1912 */
1913 } while (ch->have_new_rx_secret);
1914 }
1915
1916 /*
1917 * Handle any timer events which are due to fire; namely, the loss
1918 * detection deadline and the idle timeout.
1919 *
1920 * ACKM ACK generation deadline is polled by TXP, so we don't need to
1921 * handle it here.
1922 */
1923 now = get_time(ch);
1924 if (ossl_time_compare(now, ch->idle_deadline) >= 0) {
1925 /*
1926 * Idle timeout differs from normal protocol violation because we do
1927 * not send a CONN_CLOSE frame; go straight to TERMINATED.
1928 */
1929 if (!ch->port->engine->inhibit_tick)
1930 ch_on_idle_timeout(ch);
1931
1932 res->net_read_desired = 0;
1933 res->net_write_desired = 0;
1934 res->tick_deadline = ossl_time_infinite();
1935 return;
1936 }
1937
1938 if (!ch->port->engine->inhibit_tick) {
1939 deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
1940 if (!ossl_time_is_zero(deadline)
1941 && ossl_time_compare(now, deadline) >= 0)
1942 ossl_ackm_on_timeout(ch->ackm);
1943
1944 /* If a ping is due, inform TXP. */
1945 if (ossl_time_compare(now, ch->ping_deadline) >= 0) {
1946 int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
1947
1948 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
1949
1950 /*
1951 * If we have no CC budget at this time we cannot process the above
1952 * PING request immediately. In any case we have scheduled the
1953 * request so bump the ping deadline. If we don't do this we will
1954 * busy-loop endlessly as the above deadline comparison condition
1955 * will still be met.
1956 */
1957 ch_update_ping_deadline(ch);
1958 }
1959
1960 /* Queue any data to be sent for transmission. */
1961 ch_tx(ch);
1962
1963 /* Do stream GC. */
1964 ossl_quic_stream_map_gc(&ch->qsm);
1965 }
1966
1967 /* Determine the time at which we should next be ticked. */
1968 res->tick_deadline = ch_determine_next_tick_deadline(ch);
1969
1970 /*
1971 * Always process network input unless we are now terminated. Although we
1972 * had not terminated at the beginning of this tick, network errors in
1973 * ch_tx() may have caused us to transition to the Terminated state.
1974 */
1975 res->net_read_desired = !ossl_quic_channel_is_terminated(ch);
1976
1977 /* We want to write to the network if we have any data in our TX queue. */
1978 res->net_write_desired
1979 = (!ossl_quic_channel_is_terminated(ch)
1980 && ossl_qtx_get_queue_len_datagrams(ch->qtx) > 0);
1981 }
1982
ch_tick_tls(QUIC_CHANNEL * ch,int channel_only)1983 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only)
1984 {
1985 uint64_t error_code;
1986 const char *error_msg;
1987 ERR_STATE *error_state = NULL;
1988
1989 if (channel_only)
1990 return 1;
1991
1992 ch->did_tls_tick = 1;
1993 ossl_quic_tls_tick(ch->qtls);
1994
1995 if (ossl_quic_tls_get_error(ch->qtls, &error_code, &error_msg,
1996 &error_state)) {
1997 ossl_quic_channel_raise_protocol_error_state(ch, error_code, 0,
1998 error_msg, error_state);
1999 return 0;
2000 }
2001
2002 return 1;
2003 }
2004
2005 /* Check incoming forged packet limit and terminate connection if needed. */
ch_rx_check_forged_pkt_limit(QUIC_CHANNEL * ch)2006 static void ch_rx_check_forged_pkt_limit(QUIC_CHANNEL *ch)
2007 {
2008 uint32_t enc_level;
2009 uint64_t limit = UINT64_MAX, l;
2010
2011 for (enc_level = QUIC_ENC_LEVEL_INITIAL;
2012 enc_level < QUIC_ENC_LEVEL_NUM;
2013 ++enc_level)
2014 {
2015 /*
2016 * Different ELs can have different AEADs which can in turn impose
2017 * different limits, so use the lowest value of any currently valid EL.
2018 */
2019 if ((ch->el_discarded & (1U << enc_level)) != 0)
2020 continue;
2021
2022 if (enc_level > ch->rx_enc_level)
2023 break;
2024
2025 l = ossl_qrx_get_max_forged_pkt_count(ch->qrx, enc_level);
2026 if (l < limit)
2027 limit = l;
2028 }
2029
2030 if (ossl_qrx_get_cur_forged_pkt_count(ch->qrx) < limit)
2031 return;
2032
2033 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_AEAD_LIMIT_REACHED, 0,
2034 "forgery limit");
2035 }
2036
2037 /* Process queued incoming packets and handle frames, if any. */
ch_rx(QUIC_CHANNEL * ch,int channel_only)2038 static int ch_rx(QUIC_CHANNEL *ch, int channel_only)
2039 {
2040 int handled_any = 0;
2041 const int closing = ossl_quic_channel_is_closing(ch);
2042
2043 if (!ch->is_server && !ch->have_sent_any_pkt)
2044 /*
2045 * We have not sent anything yet, therefore there is no need to check
2046 * for incoming data.
2047 */
2048 return 1;
2049
2050 for (;;) {
2051 assert(ch->qrx_pkt == NULL);
2052
2053 if (!ossl_qrx_read_pkt(ch->qrx, &ch->qrx_pkt))
2054 break;
2055
2056 /* Track the amount of data received while in the closing state */
2057 if (closing)
2058 ossl_quic_tx_packetiser_record_received_closing_bytes(
2059 ch->txp, ch->qrx_pkt->hdr->len);
2060
2061 if (!handled_any) {
2062 ch_update_idle(ch);
2063 ch_update_ping_deadline(ch);
2064 }
2065
2066 ch_rx_handle_packet(ch, channel_only); /* best effort */
2067
2068 /*
2069 * Regardless of the outcome of frame handling, unref the packet.
2070 * This will free the packet unless something added another
2071 * reference to it during frame processing.
2072 */
2073 ossl_qrx_pkt_release(ch->qrx_pkt);
2074 ch->qrx_pkt = NULL;
2075
2076 ch->have_sent_ack_eliciting_since_rx = 0;
2077 handled_any = 1;
2078 }
2079
2080 ch_rx_check_forged_pkt_limit(ch);
2081
2082 /*
2083 * When in TERMINATING - CLOSING, generate a CONN_CLOSE frame whenever we
2084 * process one or more incoming packets.
2085 */
2086 if (handled_any && closing)
2087 ch->conn_close_queued = 1;
2088
2089 return 1;
2090 }
2091
bio_addr_eq(const BIO_ADDR * a,const BIO_ADDR * b)2092 static int bio_addr_eq(const BIO_ADDR *a, const BIO_ADDR *b)
2093 {
2094 if (BIO_ADDR_family(a) != BIO_ADDR_family(b))
2095 return 0;
2096
2097 switch (BIO_ADDR_family(a)) {
2098 case AF_INET:
2099 return !memcmp(&a->s_in.sin_addr,
2100 &b->s_in.sin_addr,
2101 sizeof(a->s_in.sin_addr))
2102 && a->s_in.sin_port == b->s_in.sin_port;
2103 #if OPENSSL_USE_IPV6
2104 case AF_INET6:
2105 return !memcmp(&a->s_in6.sin6_addr,
2106 &b->s_in6.sin6_addr,
2107 sizeof(a->s_in6.sin6_addr))
2108 && a->s_in6.sin6_port == b->s_in6.sin6_port;
2109 #endif
2110 default:
2111 return 0; /* not supported */
2112 }
2113
2114 return 1;
2115 }
2116
2117 /* Handles the packet currently in ch->qrx_pkt->hdr. */
ch_rx_handle_packet(QUIC_CHANNEL * ch,int channel_only)2118 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only)
2119 {
2120 uint32_t enc_level;
2121 int old_have_processed_any_pkt = ch->have_processed_any_pkt;
2122 OSSL_QTX_IOVEC iovec;
2123
2124 assert(ch->qrx_pkt != NULL);
2125
2126 /*
2127 * RFC 9000 s. 10.2.1 Closing Connection State:
2128 * An endpoint that is closing is not required to process any
2129 * received frame.
2130 */
2131 if (!ossl_quic_channel_is_active(ch))
2132 return;
2133
2134 if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)) {
2135 if (!ch->have_received_enc_pkt) {
2136 ch->cur_remote_dcid = ch->init_scid = ch->qrx_pkt->hdr->src_conn_id;
2137 ch->have_received_enc_pkt = 1;
2138
2139 /*
2140 * We change to using the SCID in the first Initial packet as the
2141 * DCID.
2142 */
2143 ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->init_scid);
2144 }
2145
2146 enc_level = ossl_quic_pkt_type_to_enc_level(ch->qrx_pkt->hdr->type);
2147 if ((ch->el_discarded & (1U << enc_level)) != 0)
2148 /* Do not process packets from ELs we have already discarded. */
2149 return;
2150 }
2151
2152 /*
2153 * RFC 9000 s. 9.6: "If a client receives packets from a new server address
2154 * when the client has not initiated a migration to that address, the client
2155 * SHOULD discard these packets."
2156 *
2157 * We need to be a bit careful here as due to the BIO abstraction layer an
2158 * application is liable to be weird and lie to us about peer addresses.
2159 * Only apply this check if we actually are using a real AF_INET or AF_INET6
2160 * address.
2161 */
2162 if (!ch->is_server
2163 && ch->qrx_pkt->peer != NULL
2164 && (
2165 BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET
2166 #if OPENSSL_USE_IPV6
2167 || BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET6
2168 #endif
2169 )
2170 && !bio_addr_eq(ch->qrx_pkt->peer, &ch->cur_peer_addr))
2171 return;
2172
2173 if (!ch->is_server
2174 && ch->have_received_enc_pkt
2175 && ossl_quic_pkt_type_has_scid(ch->qrx_pkt->hdr->type)) {
2176 /*
2177 * RFC 9000 s. 7.2: "Once a client has received a valid Initial packet
2178 * from the server, it MUST discard any subsequent packet it receives on
2179 * that connection with a different SCID."
2180 */
2181 if (!ossl_quic_conn_id_eq(&ch->qrx_pkt->hdr->src_conn_id,
2182 &ch->init_scid))
2183 return;
2184 }
2185
2186 if (ossl_quic_pkt_type_has_version(ch->qrx_pkt->hdr->type)
2187 && ch->qrx_pkt->hdr->version != QUIC_VERSION_1)
2188 /*
2189 * RFC 9000 s. 5.2.1: If a client receives a packet that uses a
2190 * different version than it initially selected, it MUST discard the
2191 * packet. We only ever use v1, so require it.
2192 */
2193 return;
2194
2195 ch->have_processed_any_pkt = 1;
2196
2197 /*
2198 * RFC 9000 s. 17.2: "An endpoint MUST treat receipt of a packet that has a
2199 * non-zero value for [the reserved bits] after removing both packet and
2200 * header protection as a connection error of type PROTOCOL_VIOLATION."
2201 */
2202 if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)
2203 && ch->qrx_pkt->hdr->reserved != 0) {
2204 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2205 0, "packet header reserved bits");
2206 return;
2207 }
2208
2209 iovec.buf = ch->qrx_pkt->hdr->data;
2210 iovec.buf_len = ch->qrx_pkt->hdr->len;
2211 ossl_qlog_event_transport_packet_received(ch_get_qlog(ch), ch->qrx_pkt->hdr,
2212 ch->qrx_pkt->pn, &iovec, 1,
2213 ch->qrx_pkt->datagram_id);
2214
2215 /* Handle incoming packet. */
2216 switch (ch->qrx_pkt->hdr->type) {
2217 case QUIC_PKT_TYPE_RETRY:
2218 if (ch->doing_retry || ch->is_server)
2219 /*
2220 * It is not allowed to ask a client to do a retry more than
2221 * once. Clients may not send retries.
2222 */
2223 return;
2224
2225 /*
2226 * RFC 9000 s 17.2.5.2: After the client has received and processed an
2227 * Initial or Retry packet from the server, it MUST discard any
2228 * subsequent Retry packets that it receives.
2229 */
2230 if (ch->have_received_enc_pkt)
2231 return;
2232
2233 if (ch->qrx_pkt->hdr->len <= QUIC_RETRY_INTEGRITY_TAG_LEN)
2234 /* Packets with zero-length Retry Tokens are invalid. */
2235 return;
2236
2237 /*
2238 * TODO(QUIC FUTURE): Theoretically this should probably be in the QRX.
2239 * However because validation is dependent on context (namely the
2240 * client's initial DCID) we can't do this cleanly. In the future we
2241 * should probably add a callback to the QRX to let it call us (via
2242 * the DEMUX) and ask us about the correct original DCID, rather
2243 * than allow the QRX to emit a potentially malformed packet to the
2244 * upper layers. However, special casing this will do for now.
2245 */
2246 if (!ossl_quic_validate_retry_integrity_tag(ch->port->engine->libctx,
2247 ch->port->engine->propq,
2248 ch->qrx_pkt->hdr,
2249 &ch->init_dcid))
2250 /* Malformed retry packet, ignore. */
2251 return;
2252
2253 if (!ch_retry(ch, ch->qrx_pkt->hdr->data,
2254 ch->qrx_pkt->hdr->len - QUIC_RETRY_INTEGRITY_TAG_LEN,
2255 &ch->qrx_pkt->hdr->src_conn_id))
2256 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR,
2257 0, "handling retry packet");
2258 break;
2259
2260 case QUIC_PKT_TYPE_0RTT:
2261 if (!ch->is_server)
2262 /* Clients should never receive 0-RTT packets. */
2263 return;
2264
2265 /*
2266 * TODO(QUIC 0RTT): Implement 0-RTT on the server side. We currently
2267 * do not need to implement this as a client can only do 0-RTT if we
2268 * have given it permission to in a previous session.
2269 */
2270 break;
2271
2272 case QUIC_PKT_TYPE_INITIAL:
2273 case QUIC_PKT_TYPE_HANDSHAKE:
2274 case QUIC_PKT_TYPE_1RTT:
2275 if (ch->is_server && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_HANDSHAKE)
2276 /*
2277 * We automatically drop INITIAL EL keys when first successfully
2278 * decrypting a HANDSHAKE packet, as per the RFC.
2279 */
2280 ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
2281
2282 if (ch->rxku_in_progress
2283 && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_1RTT
2284 && ch->qrx_pkt->pn >= ch->rxku_trigger_pn
2285 && ch->qrx_pkt->key_epoch < ossl_qrx_get_key_epoch(ch->qrx)) {
2286 /*
2287 * RFC 9001 s. 6.4: Packets with higher packet numbers MUST be
2288 * protected with either the same or newer packet protection keys
2289 * than packets with lower packet numbers. An endpoint that
2290 * successfully removes protection with old keys when newer keys
2291 * were used for packets with lower packet numbers MUST treat this
2292 * as a connection error of type KEY_UPDATE_ERROR.
2293 */
2294 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR,
2295 0, "new packet with old keys");
2296 break;
2297 }
2298
2299 if (!ch->is_server
2300 && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_INITIAL
2301 && ch->qrx_pkt->hdr->token_len > 0) {
2302 /*
2303 * RFC 9000 s. 17.2.2: Clients that receive an Initial packet with a
2304 * non-zero Token Length field MUST either discard the packet or
2305 * generate a connection error of type PROTOCOL_VIOLATION.
2306 *
2307 * TODO(QUIC FUTURE): consider the implications of RFC 9000 s. 10.2.3
2308 * Immediate Close during the Handshake:
2309 * However, at the cost of reducing feedback about
2310 * errors for legitimate peers, some forms of denial of
2311 * service can be made more difficult for an attacker
2312 * if endpoints discard illegal packets rather than
2313 * terminating a connection with CONNECTION_CLOSE. For
2314 * this reason, endpoints MAY discard packets rather
2315 * than immediately close if errors are detected in
2316 * packets that lack authentication.
2317 * I.e. should we drop this packet instead of closing the connection?
2318 */
2319 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2320 0, "client received initial token");
2321 break;
2322 }
2323
2324 /* This packet contains frames, pass to the RXDP. */
2325 ossl_quic_handle_frames(ch, ch->qrx_pkt); /* best effort */
2326
2327 if (ch->did_crypto_frame)
2328 ch_tick_tls(ch, channel_only);
2329
2330 break;
2331
2332 case QUIC_PKT_TYPE_VERSION_NEG:
2333 /*
2334 * "A client MUST discard any Version Negotiation packet if it has
2335 * received and successfully processed any other packet."
2336 */
2337 if (!old_have_processed_any_pkt)
2338 ch_rx_handle_version_neg(ch, ch->qrx_pkt);
2339
2340 break;
2341
2342 default:
2343 assert(0);
2344 break;
2345 }
2346 }
2347
ch_rx_handle_version_neg(QUIC_CHANNEL * ch,OSSL_QRX_PKT * pkt)2348 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt)
2349 {
2350 /*
2351 * We do not support version negotiation at this time. As per RFC 9000 s.
2352 * 6.2., we MUST abandon the connection attempt if we receive a Version
2353 * Negotiation packet, unless we have already successfully processed another
2354 * incoming packet, or the packet lists the QUIC version we want to use.
2355 */
2356 PACKET vpkt;
2357 unsigned long v;
2358
2359 if (!PACKET_buf_init(&vpkt, pkt->hdr->data, pkt->hdr->len))
2360 return;
2361
2362 while (PACKET_remaining(&vpkt) > 0) {
2363 if (!PACKET_get_net_4(&vpkt, &v))
2364 break;
2365
2366 if ((uint32_t)v == QUIC_VERSION_1)
2367 return;
2368 }
2369
2370 /* No match, this is a failure case. */
2371 ch_raise_version_neg_failure(ch);
2372 }
2373
ch_raise_version_neg_failure(QUIC_CHANNEL * ch)2374 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch)
2375 {
2376 QUIC_TERMINATE_CAUSE tcause = {0};
2377
2378 tcause.error_code = OSSL_QUIC_ERR_CONNECTION_REFUSED;
2379 tcause.reason = "version negotiation failure";
2380 tcause.reason_len = strlen(tcause.reason);
2381
2382 /*
2383 * Skip TERMINATING state; this is not considered a protocol error and we do
2384 * not send CONNECTION_CLOSE.
2385 */
2386 ch_start_terminating(ch, &tcause, 1);
2387 }
2388
2389 /* Try to generate packets and if possible, flush them to the network. */
ch_tx(QUIC_CHANNEL * ch)2390 static int ch_tx(QUIC_CHANNEL *ch)
2391 {
2392 QUIC_TXP_STATUS status;
2393 int res;
2394
2395 /*
2396 * RFC 9000 s. 10.2.2: Draining Connection State:
2397 * While otherwise identical to the closing state, an endpoint
2398 * in the draining state MUST NOT send any packets.
2399 * and:
2400 * An endpoint MUST NOT send further packets.
2401 */
2402 if (ossl_quic_channel_is_draining(ch))
2403 return 0;
2404
2405 if (ossl_quic_channel_is_closing(ch)) {
2406 /*
2407 * While closing, only send CONN_CLOSE if we've received more traffic
2408 * from the peer. Once we tell the TXP to generate CONN_CLOSE, all
2409 * future calls to it generate CONN_CLOSE frames, so otherwise we would
2410 * just constantly generate CONN_CLOSE frames.
2411 *
2412 * Confirming to RFC 9000 s. 10.2.1 Closing Connection State:
2413 * An endpoint SHOULD limit the rate at which it generates
2414 * packets in the closing state.
2415 */
2416 if (!ch->conn_close_queued)
2417 return 0;
2418
2419 ch->conn_close_queued = 0;
2420 }
2421
2422 /* Do TXKU if we need to. */
2423 ch_maybe_trigger_spontaneous_txku(ch);
2424
2425 ch->rxku_pending_confirm_done = 0;
2426
2427 /* Loop until we stop generating packets to send */
2428 do {
2429 /*
2430 * Send packet, if we need to. Best effort. The TXP consults the CC and
2431 * applies any limitations imposed by it, so we don't need to do it here.
2432 *
2433 * Best effort. In particular if TXP fails for some reason we should
2434 * still flush any queued packets which we already generated.
2435 */
2436 res = ossl_quic_tx_packetiser_generate(ch->txp, &status);
2437 if (status.sent_pkt > 0) {
2438 ch->have_sent_any_pkt = 1; /* Packet(s) were sent */
2439 ch->port->have_sent_any_pkt = 1;
2440
2441 /*
2442 * RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when
2443 * sending an ack-eliciting packet if no other ack-eliciting packets
2444 * have been sent since last receiving and processing a packet.'
2445 */
2446 if (status.sent_ack_eliciting
2447 && !ch->have_sent_ack_eliciting_since_rx) {
2448 ch_update_idle(ch);
2449 ch->have_sent_ack_eliciting_since_rx = 1;
2450 }
2451
2452 if (!ch->is_server && status.sent_handshake)
2453 /*
2454 * RFC 9001 s. 4.9.1: A client MUST discard Initial keys when it
2455 * first sends a Handshake packet.
2456 */
2457 ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
2458
2459 if (ch->rxku_pending_confirm_done)
2460 ch->rxku_pending_confirm = 0;
2461
2462 ch_update_ping_deadline(ch);
2463 }
2464
2465 if (!res) {
2466 /*
2467 * One case where TXP can fail is if we reach a TX PN of 2**62 - 1.
2468 * As per RFC 9000 s. 12.3, if this happens we MUST close the
2469 * connection without sending a CONNECTION_CLOSE frame. This is
2470 * actually handled as an emergent consequence of our design, as the
2471 * TX packetiser will never transmit another packet when the TX PN
2472 * reaches the limit.
2473 *
2474 * Calling the below function terminates the connection; its attempt
2475 * to schedule a CONNECTION_CLOSE frame will not actually cause a
2476 * packet to be transmitted for this reason.
2477 */
2478 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR,
2479 0,
2480 "internal error (txp generate)");
2481 break;
2482 }
2483 } while (status.sent_pkt > 0);
2484
2485 /* Flush packets to network. */
2486 switch (ossl_qtx_flush_net(ch->qtx)) {
2487 case QTX_FLUSH_NET_RES_OK:
2488 case QTX_FLUSH_NET_RES_TRANSIENT_FAIL:
2489 /* Best effort, done for now. */
2490 break;
2491
2492 case QTX_FLUSH_NET_RES_PERMANENT_FAIL:
2493 default:
2494 /* Permanent underlying network BIO, start terminating. */
2495 ossl_quic_port_raise_net_error(ch->port, ch);
2496 break;
2497 }
2498
2499 return 1;
2500 }
2501
2502 /* Determine next tick deadline. */
ch_determine_next_tick_deadline(QUIC_CHANNEL * ch)2503 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch)
2504 {
2505 OSSL_TIME deadline;
2506 int i;
2507
2508 if (ossl_quic_channel_is_terminated(ch))
2509 return ossl_time_infinite();
2510
2511 deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
2512 if (ossl_time_is_zero(deadline))
2513 deadline = ossl_time_infinite();
2514
2515 /*
2516 * Check the ack deadline for all enc_levels that are actually provisioned.
2517 * ACKs aren't restricted by CC.
2518 */
2519 for (i = 0; i < QUIC_ENC_LEVEL_NUM; i++) {
2520 if (ossl_qtx_is_enc_level_provisioned(ch->qtx, i)) {
2521 deadline = ossl_time_min(deadline,
2522 ossl_ackm_get_ack_deadline(ch->ackm,
2523 ossl_quic_enc_level_to_pn_space(i)));
2524 }
2525 }
2526
2527 /*
2528 * When do we need to send an ACK-eliciting packet to reset the idle
2529 * deadline timer for the peer?
2530 */
2531 if (!ossl_time_is_infinite(ch->ping_deadline))
2532 deadline = ossl_time_min(deadline, ch->ping_deadline);
2533
2534 /* Apply TXP wakeup deadline. */
2535 deadline = ossl_time_min(deadline,
2536 ossl_quic_tx_packetiser_get_deadline(ch->txp));
2537
2538 /* Is the terminating timer armed? */
2539 if (ossl_quic_channel_is_terminating(ch))
2540 deadline = ossl_time_min(deadline,
2541 ch->terminate_deadline);
2542 else if (!ossl_time_is_infinite(ch->idle_deadline))
2543 deadline = ossl_time_min(deadline,
2544 ch->idle_deadline);
2545
2546 /* When does the RXKU process complete? */
2547 if (ch->rxku_in_progress)
2548 deadline = ossl_time_min(deadline, ch->rxku_update_end_deadline);
2549
2550 return deadline;
2551 }
2552
2553 /*
2554 * QUIC Channel: Lifecycle Events
2555 * ==============================
2556 */
2557
2558 /*
2559 * Record a state transition. This is not necessarily a change to ch->state but
2560 * also includes the handshake becoming complete or confirmed, etc.
2561 */
ch_record_state_transition(QUIC_CHANNEL * ch,uint32_t new_state)2562 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state)
2563 {
2564 uint32_t old_state = ch->state;
2565
2566 ch->state = new_state;
2567
2568 ossl_qlog_event_connectivity_connection_state_updated(ch_get_qlog(ch),
2569 old_state,
2570 new_state,
2571 ch->handshake_complete,
2572 ch->handshake_confirmed);
2573 }
2574
ossl_quic_channel_start(QUIC_CHANNEL * ch)2575 int ossl_quic_channel_start(QUIC_CHANNEL *ch)
2576 {
2577 if (ch->is_server)
2578 /*
2579 * This is not used by the server. The server moves to active
2580 * automatically on receiving an incoming connection.
2581 */
2582 return 0;
2583
2584 if (ch->state != QUIC_CHANNEL_STATE_IDLE)
2585 /* Calls to connect are idempotent */
2586 return 1;
2587
2588 /* Inform QTX of peer address. */
2589 if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr))
2590 return 0;
2591
2592 /* Plug in secrets for the Initial EL. */
2593 if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
2594 ch->port->engine->propq,
2595 &ch->init_dcid,
2596 ch->is_server,
2597 ch->qrx, ch->qtx))
2598 return 0;
2599
2600 /*
2601 * Determine the QUIC Transport Parameters and serialize the transport
2602 * parameters block. (For servers, we do this later as we must defer
2603 * generation until we have received the client's transport parameters.)
2604 */
2605 if (!ch->is_server && !ch->got_local_transport_params
2606 && !ch_generate_transport_params(ch))
2607 return 0;
2608
2609 /* Change state. */
2610 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
2611 ch->doing_proactive_ver_neg = 0; /* not currently supported */
2612
2613 ossl_qlog_event_connectivity_connection_started(ch_get_qlog(ch),
2614 &ch->init_dcid);
2615
2616 /* Handshake layer: start (e.g. send CH). */
2617 if (!ch_tick_tls(ch, /*channel_only=*/0))
2618 return 0;
2619
2620 ossl_quic_reactor_tick(ossl_quic_port_get0_reactor(ch->port), 0); /* best effort */
2621 return 1;
2622 }
2623
2624 /* Start a locally initiated connection shutdown. */
ossl_quic_channel_local_close(QUIC_CHANNEL * ch,uint64_t app_error_code,const char * app_reason)2625 void ossl_quic_channel_local_close(QUIC_CHANNEL *ch, uint64_t app_error_code,
2626 const char *app_reason)
2627 {
2628 QUIC_TERMINATE_CAUSE tcause = {0};
2629
2630 if (ossl_quic_channel_is_term_any(ch))
2631 return;
2632
2633 tcause.app = 1;
2634 tcause.error_code = app_error_code;
2635 tcause.reason = app_reason;
2636 tcause.reason_len = app_reason != NULL ? strlen(app_reason) : 0;
2637 ch_start_terminating(ch, &tcause, 0);
2638 }
2639
free_token(const unsigned char * buf,size_t buf_len,void * arg)2640 static void free_token(const unsigned char *buf, size_t buf_len, void *arg)
2641 {
2642 OPENSSL_free((unsigned char *)buf);
2643 }
2644
2645 /* Called when a server asks us to do a retry. */
ch_retry(QUIC_CHANNEL * ch,const unsigned char * retry_token,size_t retry_token_len,const QUIC_CONN_ID * retry_scid)2646 static int ch_retry(QUIC_CHANNEL *ch,
2647 const unsigned char *retry_token,
2648 size_t retry_token_len,
2649 const QUIC_CONN_ID *retry_scid)
2650 {
2651 void *buf;
2652
2653 /*
2654 * RFC 9000 s. 17.2.5.1: "A client MUST discard a Retry packet that contains
2655 * a SCID field that is identical to the DCID field of its initial packet."
2656 */
2657 if (ossl_quic_conn_id_eq(&ch->init_dcid, retry_scid))
2658 return 1;
2659
2660 /* We change to using the SCID in the Retry packet as the DCID. */
2661 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, retry_scid))
2662 return 0;
2663
2664 /*
2665 * Now we retry. We will release the Retry packet immediately, so copy
2666 * the token.
2667 */
2668 if ((buf = OPENSSL_memdup(retry_token, retry_token_len)) == NULL)
2669 return 0;
2670
2671 if (!ossl_quic_tx_packetiser_set_initial_token(ch->txp, buf,
2672 retry_token_len,
2673 free_token, NULL)) {
2674 /*
2675 * This may fail if the token we receive is too big for us to ever be
2676 * able to transmit in an outgoing Initial packet.
2677 */
2678 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INVALID_TOKEN, 0,
2679 "received oversize token");
2680 OPENSSL_free(buf);
2681 return 0;
2682 }
2683
2684 ch->retry_scid = *retry_scid;
2685 ch->doing_retry = 1;
2686
2687 /*
2688 * We need to stimulate the Initial EL to generate the first CRYPTO frame
2689 * again. We can do this most cleanly by simply forcing the ACKM to consider
2690 * the first Initial packet as lost, which it effectively was as the server
2691 * hasn't processed it. This also maintains the desired behaviour with e.g.
2692 * PNs not resetting and so on.
2693 *
2694 * The PN we used initially is always zero, because QUIC does not allow
2695 * repeated retries.
2696 */
2697 if (!ossl_ackm_mark_packet_pseudo_lost(ch->ackm, QUIC_PN_SPACE_INITIAL,
2698 /*PN=*/0))
2699 return 0;
2700
2701 /*
2702 * Plug in new secrets for the Initial EL. This is the only time we change
2703 * the secrets for an EL after we already provisioned it.
2704 */
2705 if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
2706 ch->port->engine->propq,
2707 &ch->retry_scid,
2708 /*is_server=*/0,
2709 ch->qrx, ch->qtx))
2710 return 0;
2711
2712 return 1;
2713 }
2714
2715 /* Called when an EL is to be discarded. */
ch_discard_el(QUIC_CHANNEL * ch,uint32_t enc_level)2716 static int ch_discard_el(QUIC_CHANNEL *ch,
2717 uint32_t enc_level)
2718 {
2719 if (!ossl_assert(enc_level < QUIC_ENC_LEVEL_1RTT))
2720 return 0;
2721
2722 if ((ch->el_discarded & (1U << enc_level)) != 0)
2723 /* Already done. */
2724 return 1;
2725
2726 /* Best effort for all of these. */
2727 ossl_quic_tx_packetiser_discard_enc_level(ch->txp, enc_level);
2728 ossl_qrx_discard_enc_level(ch->qrx, enc_level);
2729 ossl_qtx_discard_enc_level(ch->qtx, enc_level);
2730
2731 if (enc_level != QUIC_ENC_LEVEL_0RTT) {
2732 uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
2733
2734 ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
2735
2736 /* We should still have crypto streams at this point. */
2737 if (!ossl_assert(ch->crypto_send[pn_space] != NULL)
2738 || !ossl_assert(ch->crypto_recv[pn_space] != NULL))
2739 return 0;
2740
2741 /* Get rid of the crypto stream state for the EL. */
2742 ossl_quic_sstream_free(ch->crypto_send[pn_space]);
2743 ch->crypto_send[pn_space] = NULL;
2744
2745 ossl_quic_rstream_free(ch->crypto_recv[pn_space]);
2746 ch->crypto_recv[pn_space] = NULL;
2747 }
2748
2749 ch->el_discarded |= (1U << enc_level);
2750 return 1;
2751 }
2752
2753 /* Intended to be called by the RXDP. */
ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL * ch)2754 int ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL *ch)
2755 {
2756 if (ch->handshake_confirmed)
2757 return 1;
2758
2759 if (!ch->handshake_complete) {
2760 /*
2761 * Does not make sense for handshake to be confirmed before it is
2762 * completed.
2763 */
2764 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2765 OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE,
2766 "handshake cannot be confirmed "
2767 "before it is completed");
2768 return 0;
2769 }
2770
2771 ch_discard_el(ch, QUIC_ENC_LEVEL_HANDSHAKE);
2772 ch->handshake_confirmed = 1;
2773 ch_record_state_transition(ch, ch->state);
2774 ossl_ackm_on_handshake_confirmed(ch->ackm);
2775 return 1;
2776 }
2777
2778 /*
2779 * Master function used when we want to start tearing down a connection:
2780 *
2781 * - If the connection is still IDLE we can go straight to TERMINATED;
2782 *
2783 * - If we are already TERMINATED this is a no-op.
2784 *
2785 * - If we are TERMINATING - CLOSING and we have now got a CONNECTION_CLOSE
2786 * from the peer (tcause->remote == 1), we move to TERMINATING - DRAINING.
2787 *
2788 * - If we are TERMINATING - DRAINING, we remain here until the terminating
2789 * timer expires.
2790 *
2791 * - Otherwise, we are in ACTIVE and move to TERMINATING - CLOSING.
2792 * if we caused the termination (e.g. we have sent a CONNECTION_CLOSE). Note
2793 * that we are considered to have caused a termination if we sent the first
2794 * CONNECTION_CLOSE frame, even if it is caused by a peer protocol
2795 * violation. If the peer sent the first CONNECTION_CLOSE frame, we move to
2796 * TERMINATING - DRAINING.
2797 *
2798 * We record the termination cause structure passed on the first call only.
2799 * Any successive calls have their termination cause data discarded;
2800 * once we start sending a CONNECTION_CLOSE frame, we don't change the details
2801 * in it.
2802 *
2803 * This conforms to RFC 9000 s. 10.2.1: Closing Connection State:
2804 * To minimize the state that an endpoint maintains for a closing
2805 * connection, endpoints MAY send the exact same packet in response
2806 * to any received packet.
2807 *
2808 * We don't drop any connection state (specifically packet protection keys)
2809 * even though we are permitted to. This conforms to RFC 9000 s. 10.2.1:
2810 * Closing Connection State:
2811 * An endpoint MAY retain packet protection keys for incoming
2812 * packets to allow it to read and process a CONNECTION_CLOSE frame.
2813 *
2814 * Note that we do not conform to these two from the same section:
2815 * An endpoint's selected connection ID and the QUIC version
2816 * are sufficient information to identify packets for a closing
2817 * connection; the endpoint MAY discard all other connection state.
2818 * and:
2819 * An endpoint MAY drop packet protection keys when entering the
2820 * closing state and send a packet containing a CONNECTION_CLOSE
2821 * frame in response to any UDP datagram that is received.
2822 */
copy_tcause(QUIC_TERMINATE_CAUSE * dst,const QUIC_TERMINATE_CAUSE * src)2823 static void copy_tcause(QUIC_TERMINATE_CAUSE *dst,
2824 const QUIC_TERMINATE_CAUSE *src)
2825 {
2826 dst->error_code = src->error_code;
2827 dst->frame_type = src->frame_type;
2828 dst->app = src->app;
2829 dst->remote = src->remote;
2830
2831 dst->reason = NULL;
2832 dst->reason_len = 0;
2833
2834 if (src->reason != NULL && src->reason_len > 0) {
2835 size_t l = src->reason_len;
2836 char *r;
2837
2838 if (l >= SIZE_MAX)
2839 --l;
2840
2841 /*
2842 * If this fails, dst->reason becomes NULL and we simply do not use a
2843 * reason. This ensures termination is infallible.
2844 */
2845 dst->reason = r = OPENSSL_memdup(src->reason, l + 1);
2846 if (r == NULL)
2847 return;
2848
2849 r[l] = '\0';
2850 dst->reason_len = l;
2851 }
2852 }
2853
ch_start_terminating(QUIC_CHANNEL * ch,const QUIC_TERMINATE_CAUSE * tcause,int force_immediate)2854 static void ch_start_terminating(QUIC_CHANNEL *ch,
2855 const QUIC_TERMINATE_CAUSE *tcause,
2856 int force_immediate)
2857 {
2858 /* No point sending anything if we haven't sent anything yet. */
2859 if (!ch->have_sent_any_pkt)
2860 force_immediate = 1;
2861
2862 switch (ch->state) {
2863 default:
2864 case QUIC_CHANNEL_STATE_IDLE:
2865 copy_tcause(&ch->terminate_cause, tcause);
2866 ch_on_terminating_timeout(ch);
2867 break;
2868
2869 case QUIC_CHANNEL_STATE_ACTIVE:
2870 copy_tcause(&ch->terminate_cause, tcause);
2871
2872 ossl_qlog_event_connectivity_connection_closed(ch_get_qlog(ch), tcause);
2873
2874 if (!force_immediate) {
2875 ch_record_state_transition(ch, tcause->remote
2876 ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
2877 : QUIC_CHANNEL_STATE_TERMINATING_CLOSING);
2878 /*
2879 * RFC 9000 s. 10.2 Immediate Close
2880 * These states SHOULD persist for at least three times
2881 * the current PTO interval as defined in [QUIC-RECOVERY].
2882 */
2883 ch->terminate_deadline
2884 = ossl_time_add(get_time(ch),
2885 ossl_time_multiply(ossl_ackm_get_pto_duration(ch->ackm),
2886 3));
2887
2888 if (!tcause->remote) {
2889 OSSL_QUIC_FRAME_CONN_CLOSE f = {0};
2890
2891 /* best effort */
2892 f.error_code = ch->terminate_cause.error_code;
2893 f.frame_type = ch->terminate_cause.frame_type;
2894 f.is_app = ch->terminate_cause.app;
2895 f.reason = (char *)ch->terminate_cause.reason;
2896 f.reason_len = ch->terminate_cause.reason_len;
2897 ossl_quic_tx_packetiser_schedule_conn_close(ch->txp, &f);
2898 /*
2899 * RFC 9000 s. 10.2.2 Draining Connection State:
2900 * An endpoint that receives a CONNECTION_CLOSE frame MAY
2901 * send a single packet containing a CONNECTION_CLOSE
2902 * frame before entering the draining state, using a
2903 * NO_ERROR code if appropriate
2904 */
2905 ch->conn_close_queued = 1;
2906 }
2907 } else {
2908 ch_on_terminating_timeout(ch);
2909 }
2910 break;
2911
2912 case QUIC_CHANNEL_STATE_TERMINATING_CLOSING:
2913 if (force_immediate)
2914 ch_on_terminating_timeout(ch);
2915 else if (tcause->remote)
2916 /*
2917 * RFC 9000 s. 10.2.2 Draining Connection State:
2918 * An endpoint MAY enter the draining state from the
2919 * closing state if it receives a CONNECTION_CLOSE frame,
2920 * which indicates that the peer is also closing or draining.
2921 */
2922 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATING_DRAINING);
2923
2924 break;
2925
2926 case QUIC_CHANNEL_STATE_TERMINATING_DRAINING:
2927 /*
2928 * Other than in the force-immediate case, we remain here until the
2929 * timeout expires.
2930 */
2931 if (force_immediate)
2932 ch_on_terminating_timeout(ch);
2933
2934 break;
2935
2936 case QUIC_CHANNEL_STATE_TERMINATED:
2937 /* No-op. */
2938 break;
2939 }
2940 }
2941
2942 /* For RXDP use. */
ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL * ch,OSSL_QUIC_FRAME_CONN_CLOSE * f)2943 void ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL *ch,
2944 OSSL_QUIC_FRAME_CONN_CLOSE *f)
2945 {
2946 QUIC_TERMINATE_CAUSE tcause = {0};
2947
2948 if (!ossl_quic_channel_is_active(ch))
2949 return;
2950
2951 tcause.remote = 1;
2952 tcause.app = f->is_app;
2953 tcause.error_code = f->error_code;
2954 tcause.frame_type = f->frame_type;
2955 tcause.reason = f->reason;
2956 tcause.reason_len = f->reason_len;
2957 ch_start_terminating(ch, &tcause, 0);
2958 }
2959
free_frame_data(unsigned char * buf,size_t buf_len,void * arg)2960 static void free_frame_data(unsigned char *buf, size_t buf_len, void *arg)
2961 {
2962 OPENSSL_free(buf);
2963 }
2964
ch_enqueue_retire_conn_id(QUIC_CHANNEL * ch,uint64_t seq_num)2965 static int ch_enqueue_retire_conn_id(QUIC_CHANNEL *ch, uint64_t seq_num)
2966 {
2967 BUF_MEM *buf_mem = NULL;
2968 WPACKET wpkt;
2969 size_t l;
2970
2971 ossl_quic_srtm_remove(ch->srtm, ch, seq_num);
2972
2973 if ((buf_mem = BUF_MEM_new()) == NULL)
2974 goto err;
2975
2976 if (!WPACKET_init(&wpkt, buf_mem))
2977 goto err;
2978
2979 if (!ossl_quic_wire_encode_frame_retire_conn_id(&wpkt, seq_num)) {
2980 WPACKET_cleanup(&wpkt);
2981 goto err;
2982 }
2983
2984 WPACKET_finish(&wpkt);
2985 if (!WPACKET_get_total_written(&wpkt, &l))
2986 goto err;
2987
2988 if (ossl_quic_cfq_add_frame(ch->cfq, 1, QUIC_PN_SPACE_APP,
2989 OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID, 0,
2990 (unsigned char *)buf_mem->data, l,
2991 free_frame_data, NULL) == NULL)
2992 goto err;
2993
2994 buf_mem->data = NULL;
2995 BUF_MEM_free(buf_mem);
2996 return 1;
2997
2998 err:
2999 ossl_quic_channel_raise_protocol_error(ch,
3000 OSSL_QUIC_ERR_INTERNAL_ERROR,
3001 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3002 "internal error enqueueing retire conn id");
3003 BUF_MEM_free(buf_mem);
3004 return 0;
3005 }
3006
ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL * ch,OSSL_QUIC_FRAME_NEW_CONN_ID * f)3007 void ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL *ch,
3008 OSSL_QUIC_FRAME_NEW_CONN_ID *f)
3009 {
3010 uint64_t new_remote_seq_num = ch->cur_remote_seq_num;
3011 uint64_t new_retire_prior_to = ch->cur_retire_prior_to;
3012
3013 if (!ossl_quic_channel_is_active(ch))
3014 return;
3015
3016 /* We allow only two active connection ids; first check some constraints */
3017 if (ch->cur_remote_dcid.id_len == 0) {
3018 /* Changing from 0 length connection id is disallowed */
3019 ossl_quic_channel_raise_protocol_error(ch,
3020 OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
3021 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3022 "zero length connection id in use");
3023
3024 return;
3025 }
3026
3027 if (f->seq_num > new_remote_seq_num)
3028 new_remote_seq_num = f->seq_num;
3029 if (f->retire_prior_to > new_retire_prior_to)
3030 new_retire_prior_to = f->retire_prior_to;
3031
3032 /*
3033 * RFC 9000-5.1.1: An endpoint MUST NOT provide more connection IDs
3034 * than the peer's limit.
3035 *
3036 * After processing a NEW_CONNECTION_ID frame and adding and retiring
3037 * active connection IDs, if the number of active connection IDs exceeds
3038 * the value advertised in its active_connection_id_limit transport
3039 * parameter, an endpoint MUST close the connection with an error of
3040 * type CONNECTION_ID_LIMIT_ERROR.
3041 */
3042 if (new_remote_seq_num - new_retire_prior_to > 1) {
3043 ossl_quic_channel_raise_protocol_error(ch,
3044 OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3045 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3046 "active_connection_id limit violated");
3047 return;
3048 }
3049
3050 /*
3051 * RFC 9000-5.1.1: An endpoint MAY send connection IDs that temporarily
3052 * exceed a peer's limit if the NEW_CONNECTION_ID frame also requires
3053 * the retirement of any excess, by including a sufficiently large
3054 * value in the Retire Prior To field.
3055 *
3056 * RFC 9000-5.1.2: An endpoint SHOULD allow for sending and tracking
3057 * a number of RETIRE_CONNECTION_ID frames of at least twice the value
3058 * of the active_connection_id_limit transport parameter. An endpoint
3059 * MUST NOT forget a connection ID without retiring it, though it MAY
3060 * choose to treat having connection IDs in need of retirement that
3061 * exceed this limit as a connection error of type CONNECTION_ID_LIMIT_ERROR.
3062 *
3063 * We are a little bit more liberal than the minimum mandated.
3064 */
3065 if (new_retire_prior_to - ch->cur_retire_prior_to > 10) {
3066 ossl_quic_channel_raise_protocol_error(ch,
3067 OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3068 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3069 "retiring connection id limit violated");
3070
3071 return;
3072 }
3073
3074 if (new_remote_seq_num > ch->cur_remote_seq_num) {
3075 /* Add new stateless reset token */
3076 if (!ossl_quic_srtm_add(ch->srtm, ch, new_remote_seq_num,
3077 &f->stateless_reset)) {
3078 ossl_quic_channel_raise_protocol_error(
3079 ch, OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3080 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3081 "unable to store stateless reset token");
3082
3083 return;
3084 }
3085 ch->cur_remote_seq_num = new_remote_seq_num;
3086 ch->cur_remote_dcid = f->conn_id;
3087 ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid);
3088 }
3089
3090 /*
3091 * RFC 9000-5.1.2: Upon receipt of an increased Retire Prior To
3092 * field, the peer MUST stop using the corresponding connection IDs
3093 * and retire them with RETIRE_CONNECTION_ID frames before adding the
3094 * newly provided connection ID to the set of active connection IDs.
3095 */
3096
3097 /*
3098 * Note: RFC 9000 s. 19.15 says:
3099 * "An endpoint that receives a NEW_CONNECTION_ID frame with a sequence
3100 * number smaller than the Retire Prior To field of a previously received
3101 * NEW_CONNECTION_ID frame MUST send a corresponding
3102 * RETIRE_CONNECTION_ID frame that retires the newly received connection
3103 * ID, unless it has already done so for that sequence number."
3104 *
3105 * Since we currently always queue RETIRE_CONN_ID frames based on the Retire
3106 * Prior To field of a NEW_CONNECTION_ID frame immediately upon receiving
3107 * that NEW_CONNECTION_ID frame, by definition this will always be met.
3108 * This may change in future when we change our CID handling.
3109 */
3110 while (new_retire_prior_to > ch->cur_retire_prior_to) {
3111 if (!ch_enqueue_retire_conn_id(ch, ch->cur_retire_prior_to))
3112 break;
3113 ++ch->cur_retire_prior_to;
3114 }
3115 }
3116
ch_save_err_state(QUIC_CHANNEL * ch)3117 static void ch_save_err_state(QUIC_CHANNEL *ch)
3118 {
3119 if (ch->err_state == NULL)
3120 ch->err_state = OSSL_ERR_STATE_new();
3121
3122 if (ch->err_state == NULL)
3123 return;
3124
3125 OSSL_ERR_STATE_save(ch->err_state);
3126 }
3127
ossl_quic_channel_inject(QUIC_CHANNEL * ch,QUIC_URXE * e)3128 void ossl_quic_channel_inject(QUIC_CHANNEL *ch, QUIC_URXE *e)
3129 {
3130 ossl_qrx_inject_urxe(ch->qrx, e);
3131 }
3132
ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL * ch)3133 void ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL *ch)
3134 {
3135 QUIC_TERMINATE_CAUSE tcause = {0};
3136
3137 tcause.error_code = OSSL_QUIC_ERR_NO_ERROR;
3138 tcause.remote = 1;
3139 ch_start_terminating(ch, &tcause, 0);
3140 }
3141
ossl_quic_channel_raise_net_error(QUIC_CHANNEL * ch)3142 void ossl_quic_channel_raise_net_error(QUIC_CHANNEL *ch)
3143 {
3144 QUIC_TERMINATE_CAUSE tcause = {0};
3145
3146 if (ch->net_error)
3147 return;
3148
3149 ch->net_error = 1;
3150
3151 tcause.error_code = OSSL_QUIC_ERR_INTERNAL_ERROR;
3152 tcause.reason = "network BIO I/O error";
3153 tcause.reason_len = strlen(tcause.reason);
3154
3155 /*
3156 * Skip Terminating state and go directly to Terminated, no point trying to
3157 * send CONNECTION_CLOSE if we cannot communicate.
3158 */
3159 ch_start_terminating(ch, &tcause, 1);
3160 }
3161
ossl_quic_channel_net_error(QUIC_CHANNEL * ch)3162 int ossl_quic_channel_net_error(QUIC_CHANNEL *ch)
3163 {
3164 return ch->net_error;
3165 }
3166
ossl_quic_channel_restore_err_state(QUIC_CHANNEL * ch)3167 void ossl_quic_channel_restore_err_state(QUIC_CHANNEL *ch)
3168 {
3169 if (ch == NULL)
3170 return;
3171
3172 if (!ossl_quic_port_is_running(ch->port))
3173 ossl_quic_port_restore_err_state(ch->port);
3174 else
3175 OSSL_ERR_STATE_restore(ch->err_state);
3176 }
3177
ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL * ch,uint64_t error_code,uint64_t frame_type,const char * reason,ERR_STATE * err_state,const char * src_file,int src_line,const char * src_func)3178 void ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL *ch,
3179 uint64_t error_code,
3180 uint64_t frame_type,
3181 const char *reason,
3182 ERR_STATE *err_state,
3183 const char *src_file,
3184 int src_line,
3185 const char *src_func)
3186 {
3187 QUIC_TERMINATE_CAUSE tcause = {0};
3188 int err_reason = error_code == OSSL_QUIC_ERR_INTERNAL_ERROR
3189 ? ERR_R_INTERNAL_ERROR : SSL_R_QUIC_PROTOCOL_ERROR;
3190 const char *err_str = ossl_quic_err_to_string(error_code);
3191 const char *err_str_pfx = " (", *err_str_sfx = ")";
3192 const char *ft_str = NULL;
3193 const char *ft_str_pfx = " (", *ft_str_sfx = ")";
3194
3195 if (ch->protocol_error)
3196 /* Only the first call to this function matters. */
3197 return;
3198
3199 if (err_str == NULL) {
3200 err_str = "";
3201 err_str_pfx = "";
3202 err_str_sfx = "";
3203 }
3204
3205 /*
3206 * If we were provided an underlying error state, restore it and then append
3207 * our ERR on top as a "cover letter" error.
3208 */
3209 if (err_state != NULL)
3210 OSSL_ERR_STATE_restore(err_state);
3211
3212 if (frame_type != 0) {
3213 ft_str = ossl_quic_frame_type_to_string(frame_type);
3214 if (ft_str == NULL) {
3215 ft_str = "";
3216 ft_str_pfx = "";
3217 ft_str_sfx = "";
3218 }
3219
3220 ERR_raise_data(ERR_LIB_SSL, err_reason,
3221 "QUIC error code: 0x%llx%s%s%s "
3222 "(triggered by frame type: 0x%llx%s%s%s), reason: \"%s\"",
3223 (unsigned long long) error_code,
3224 err_str_pfx, err_str, err_str_sfx,
3225 (unsigned long long) frame_type,
3226 ft_str_pfx, ft_str, ft_str_sfx,
3227 reason);
3228 } else {
3229 ERR_raise_data(ERR_LIB_SSL, err_reason,
3230 "QUIC error code: 0x%llx%s%s%s, reason: \"%s\"",
3231 (unsigned long long) error_code,
3232 err_str_pfx, err_str, err_str_sfx,
3233 reason);
3234 }
3235
3236 if (src_file != NULL)
3237 ERR_set_debug(src_file, src_line, src_func);
3238
3239 ch_save_err_state(ch);
3240
3241 tcause.error_code = error_code;
3242 tcause.frame_type = frame_type;
3243 tcause.reason = reason;
3244 tcause.reason_len = strlen(reason);
3245
3246 ch->protocol_error = 1;
3247 ch_start_terminating(ch, &tcause, 0);
3248 }
3249
3250 /*
3251 * Called once the terminating timer expires, meaning we move from TERMINATING
3252 * to TERMINATED.
3253 */
ch_on_terminating_timeout(QUIC_CHANNEL * ch)3254 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch)
3255 {
3256 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
3257 }
3258
3259 /*
3260 * Determines the effective idle timeout duration. This is based on the idle
3261 * timeout values that we and our peer signalled in transport parameters
3262 * but have some limits applied.
3263 */
ch_get_effective_idle_timeout_duration(QUIC_CHANNEL * ch)3264 static OSSL_TIME ch_get_effective_idle_timeout_duration(QUIC_CHANNEL *ch)
3265 {
3266 OSSL_TIME pto;
3267
3268 if (ch->max_idle_timeout == 0)
3269 return ossl_time_infinite();
3270
3271 /*
3272 * RFC 9000 s. 10.1: Idle Timeout
3273 * To avoid excessively small idle timeout periods, endpoints
3274 * MUST increase the idle timeout period to be at least three
3275 * times the current Probe Timeout (PTO). This allows for
3276 * multiple PTOs to expire, and therefore multiple probes to
3277 * be sent and lost, prior to idle timeout.
3278 */
3279 pto = ossl_ackm_get_pto_duration(ch->ackm);
3280 return ossl_time_max(ossl_ms2time(ch->max_idle_timeout),
3281 ossl_time_multiply(pto, 3));
3282 }
3283
3284 /*
3285 * Updates our idle deadline. Called when an event happens which should bump the
3286 * idle timeout.
3287 */
ch_update_idle(QUIC_CHANNEL * ch)3288 static void ch_update_idle(QUIC_CHANNEL *ch)
3289 {
3290 ch->idle_deadline = ossl_time_add(get_time(ch),
3291 ch_get_effective_idle_timeout_duration(ch));
3292 }
3293
3294 /*
3295 * Updates our ping deadline, which determines when we next generate a ping if
3296 * we don't have any other ACK-eliciting frames to send.
3297 */
ch_update_ping_deadline(QUIC_CHANNEL * ch)3298 static void ch_update_ping_deadline(QUIC_CHANNEL *ch)
3299 {
3300 OSSL_TIME max_span, idle_duration;
3301
3302 idle_duration = ch_get_effective_idle_timeout_duration(ch);
3303 if (ossl_time_is_infinite(idle_duration)) {
3304 ch->ping_deadline = ossl_time_infinite();
3305 return;
3306 }
3307
3308 /*
3309 * Maximum amount of time without traffic before we send a PING to keep
3310 * the connection open. Usually we use max_idle_timeout/2, but ensure
3311 * the period never exceeds the assumed NAT interval to ensure NAT
3312 * devices don't have their state time out (RFC 9000 s. 10.1.2).
3313 */
3314 max_span = ossl_time_divide(idle_duration, 2);
3315 max_span = ossl_time_min(max_span, MAX_NAT_INTERVAL);
3316 ch->ping_deadline = ossl_time_add(get_time(ch), max_span);
3317 }
3318
3319 /* Called when the idle timeout expires. */
ch_on_idle_timeout(QUIC_CHANNEL * ch)3320 static void ch_on_idle_timeout(QUIC_CHANNEL *ch)
3321 {
3322 /*
3323 * Idle timeout does not have an error code associated with it because a
3324 * CONN_CLOSE is never sent for it. We shouldn't use this data once we reach
3325 * TERMINATED anyway.
3326 */
3327 ch->terminate_cause.app = 0;
3328 ch->terminate_cause.error_code = OSSL_QUIC_LOCAL_ERR_IDLE_TIMEOUT;
3329 ch->terminate_cause.frame_type = 0;
3330
3331 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
3332 }
3333
3334 /* Called when we, as a server, get a new incoming connection. */
ossl_quic_channel_on_new_conn(QUIC_CHANNEL * ch,const BIO_ADDR * peer,const QUIC_CONN_ID * peer_scid,const QUIC_CONN_ID * peer_dcid)3335 int ossl_quic_channel_on_new_conn(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
3336 const QUIC_CONN_ID *peer_scid,
3337 const QUIC_CONN_ID *peer_dcid)
3338 {
3339 if (!ossl_assert(ch->state == QUIC_CHANNEL_STATE_IDLE && ch->is_server))
3340 return 0;
3341
3342 /* Generate an Initial LCID we will use for the connection. */
3343 if (!ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &ch->cur_local_cid))
3344 return 0;
3345
3346 /* Note our newly learnt peer address and CIDs. */
3347 ch->cur_peer_addr = *peer;
3348 ch->init_dcid = *peer_dcid;
3349 ch->cur_remote_dcid = *peer_scid;
3350
3351 /* Inform QTX of peer address. */
3352 if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr))
3353 return 0;
3354
3355 /* Inform TXP of desired CIDs. */
3356 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid))
3357 return 0;
3358
3359 if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
3360 return 0;
3361
3362 /* Setup QLOG, which did not happen earlier due to lacking an Initial ODCID. */
3363 ossl_qtx_set_qlog_cb(ch->qtx, ch_get_qlog_cb, ch);
3364 ossl_quic_tx_packetiser_set_qlog_cb(ch->txp, ch_get_qlog_cb, ch);
3365
3366 /* Plug in secrets for the Initial EL. */
3367 if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
3368 ch->port->engine->propq,
3369 &ch->init_dcid,
3370 /*is_server=*/1,
3371 ch->qrx, ch->qtx))
3372 return 0;
3373
3374 /* Register the peer ODCID in the LCIDM. */
3375 if (!ossl_quic_lcidm_enrol_odcid(ch->lcidm, ch, &ch->init_dcid))
3376 return 0;
3377
3378 /* Change state. */
3379 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
3380 ch->doing_proactive_ver_neg = 0; /* not currently supported */
3381 return 1;
3382 }
3383
ossl_quic_channel_get0_ssl(QUIC_CHANNEL * ch)3384 SSL *ossl_quic_channel_get0_ssl(QUIC_CHANNEL *ch)
3385 {
3386 return ch->tls;
3387 }
3388
ch_init_new_stream(QUIC_CHANNEL * ch,QUIC_STREAM * qs,int can_send,int can_recv)3389 static int ch_init_new_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs,
3390 int can_send, int can_recv)
3391 {
3392 uint64_t rxfc_wnd;
3393 int server_init = ossl_quic_stream_is_server_init(qs);
3394 int local_init = (ch->is_server == server_init);
3395 int is_uni = !ossl_quic_stream_is_bidi(qs);
3396
3397 if (can_send)
3398 if ((qs->sstream = ossl_quic_sstream_new(INIT_APP_BUF_LEN)) == NULL)
3399 goto err;
3400
3401 if (can_recv)
3402 if ((qs->rstream = ossl_quic_rstream_new(NULL, NULL, 0)) == NULL)
3403 goto err;
3404
3405 /* TXFC */
3406 if (!ossl_quic_txfc_init(&qs->txfc, &ch->conn_txfc))
3407 goto err;
3408
3409 if (ch->got_remote_transport_params) {
3410 /*
3411 * If we already got peer TPs we need to apply the initial CWM credit
3412 * now. If we didn't already get peer TPs this will be done
3413 * automatically for all extant streams when we do.
3414 */
3415 if (can_send) {
3416 uint64_t cwm;
3417
3418 if (is_uni)
3419 cwm = ch->rx_init_max_stream_data_uni;
3420 else if (local_init)
3421 cwm = ch->rx_init_max_stream_data_bidi_local;
3422 else
3423 cwm = ch->rx_init_max_stream_data_bidi_remote;
3424
3425 ossl_quic_txfc_bump_cwm(&qs->txfc, cwm);
3426 }
3427 }
3428
3429 /* RXFC */
3430 if (!can_recv)
3431 rxfc_wnd = 0;
3432 else if (is_uni)
3433 rxfc_wnd = ch->tx_init_max_stream_data_uni;
3434 else if (local_init)
3435 rxfc_wnd = ch->tx_init_max_stream_data_bidi_local;
3436 else
3437 rxfc_wnd = ch->tx_init_max_stream_data_bidi_remote;
3438
3439 if (!ossl_quic_rxfc_init(&qs->rxfc, &ch->conn_rxfc,
3440 rxfc_wnd,
3441 DEFAULT_STREAM_RXFC_MAX_WND_MUL * rxfc_wnd,
3442 get_time, ch))
3443 goto err;
3444
3445 return 1;
3446
3447 err:
3448 ossl_quic_sstream_free(qs->sstream);
3449 qs->sstream = NULL;
3450 ossl_quic_rstream_free(qs->rstream);
3451 qs->rstream = NULL;
3452 return 0;
3453 }
3454
ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL * ch,int is_uni)3455 static uint64_t *ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL *ch,
3456 int is_uni)
3457 {
3458 return is_uni ? &ch->next_local_stream_ordinal_uni
3459 : &ch->next_local_stream_ordinal_bidi;
3460 }
3461
ch_get_local_stream_max_ptr(const QUIC_CHANNEL * ch,int is_uni)3462 static const uint64_t *ch_get_local_stream_max_ptr(const QUIC_CHANNEL *ch,
3463 int is_uni)
3464 {
3465 return is_uni ? &ch->max_local_streams_uni
3466 : &ch->max_local_streams_bidi;
3467 }
3468
ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL * ch,int is_uni)3469 static const QUIC_RXFC *ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL *ch,
3470 int is_uni)
3471 {
3472 return is_uni ? &ch->max_streams_uni_rxfc
3473 : &ch->max_streams_bidi_rxfc;
3474 }
3475
ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL * ch,int is_uni)3476 int ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL *ch,
3477 int is_uni)
3478 {
3479 const uint64_t *p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni);
3480
3481 return ossl_quic_stream_map_is_local_allowed_by_stream_limit(&ch->qsm,
3482 *p_next_ordinal,
3483 is_uni);
3484 }
3485
ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL * ch,int is_uni)3486 uint64_t ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL *ch,
3487 int is_uni)
3488 {
3489 const uint64_t *p_next_ordinal, *p_max;
3490
3491 p_next_ordinal = ch_get_local_stream_next_ordinal_ptr((QUIC_CHANNEL *)ch,
3492 is_uni);
3493 p_max = ch_get_local_stream_max_ptr(ch, is_uni);
3494
3495 return *p_max - *p_next_ordinal;
3496 }
3497
ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL * ch,int is_uni)3498 uint64_t ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL *ch,
3499 int is_uni)
3500 {
3501 return ossl_quic_rxfc_get_credit(ch_get_remote_stream_count_rxfc(ch, is_uni));
3502 }
3503
ossl_quic_channel_new_stream_local(QUIC_CHANNEL * ch,int is_uni)3504 QUIC_STREAM *ossl_quic_channel_new_stream_local(QUIC_CHANNEL *ch, int is_uni)
3505 {
3506 QUIC_STREAM *qs;
3507 int type;
3508 uint64_t stream_id;
3509 uint64_t *p_next_ordinal;
3510
3511 type = ch->is_server ? QUIC_STREAM_INITIATOR_SERVER
3512 : QUIC_STREAM_INITIATOR_CLIENT;
3513
3514 p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni);
3515
3516 if (is_uni)
3517 type |= QUIC_STREAM_DIR_UNI;
3518 else
3519 type |= QUIC_STREAM_DIR_BIDI;
3520
3521 if (*p_next_ordinal >= ((uint64_t)1) << 62)
3522 return NULL;
3523
3524 stream_id = ((*p_next_ordinal) << 2) | type;
3525
3526 if ((qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id, type)) == NULL)
3527 return NULL;
3528
3529 /* Locally-initiated stream, so we always want a send buffer. */
3530 if (!ch_init_new_stream(ch, qs, /*can_send=*/1, /*can_recv=*/!is_uni))
3531 goto err;
3532
3533 ++*p_next_ordinal;
3534 return qs;
3535
3536 err:
3537 ossl_quic_stream_map_release(&ch->qsm, qs);
3538 return NULL;
3539 }
3540
ossl_quic_channel_new_stream_remote(QUIC_CHANNEL * ch,uint64_t stream_id)3541 QUIC_STREAM *ossl_quic_channel_new_stream_remote(QUIC_CHANNEL *ch,
3542 uint64_t stream_id)
3543 {
3544 uint64_t peer_role;
3545 int is_uni;
3546 QUIC_STREAM *qs;
3547
3548 peer_role = ch->is_server
3549 ? QUIC_STREAM_INITIATOR_CLIENT
3550 : QUIC_STREAM_INITIATOR_SERVER;
3551
3552 if ((stream_id & QUIC_STREAM_INITIATOR_MASK) != peer_role)
3553 return NULL;
3554
3555 is_uni = ((stream_id & QUIC_STREAM_DIR_MASK) == QUIC_STREAM_DIR_UNI);
3556
3557 qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id,
3558 stream_id & (QUIC_STREAM_INITIATOR_MASK
3559 | QUIC_STREAM_DIR_MASK));
3560 if (qs == NULL)
3561 return NULL;
3562
3563 if (!ch_init_new_stream(ch, qs, /*can_send=*/!is_uni, /*can_recv=*/1))
3564 goto err;
3565
3566 if (ch->incoming_stream_auto_reject)
3567 ossl_quic_channel_reject_stream(ch, qs);
3568 else
3569 ossl_quic_stream_map_push_accept_queue(&ch->qsm, qs);
3570
3571 return qs;
3572
3573 err:
3574 ossl_quic_stream_map_release(&ch->qsm, qs);
3575 return NULL;
3576 }
3577
ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL * ch,int enable,uint64_t aec)3578 void ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL *ch,
3579 int enable,
3580 uint64_t aec)
3581 {
3582 ch->incoming_stream_auto_reject = (enable != 0);
3583 ch->incoming_stream_auto_reject_aec = aec;
3584 }
3585
ossl_quic_channel_reject_stream(QUIC_CHANNEL * ch,QUIC_STREAM * qs)3586 void ossl_quic_channel_reject_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs)
3587 {
3588 ossl_quic_stream_map_stop_sending_recv_part(&ch->qsm, qs,
3589 ch->incoming_stream_auto_reject_aec);
3590
3591 ossl_quic_stream_map_reset_stream_send_part(&ch->qsm, qs,
3592 ch->incoming_stream_auto_reject_aec);
3593 qs->deleted = 1;
3594
3595 ossl_quic_stream_map_update_state(&ch->qsm, qs);
3596 }
3597
3598 /* Replace local connection ID in TXP and DEMUX for testing purposes. */
ossl_quic_channel_replace_local_cid(QUIC_CHANNEL * ch,const QUIC_CONN_ID * conn_id)3599 int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL *ch,
3600 const QUIC_CONN_ID *conn_id)
3601 {
3602 /* Remove the current LCID from the LCIDM. */
3603 if (!ossl_quic_lcidm_debug_remove(ch->lcidm, &ch->cur_local_cid))
3604 return 0;
3605 ch->cur_local_cid = *conn_id;
3606 /* Set in the TXP, used only for long header packets. */
3607 if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
3608 return 0;
3609 /* Add the new LCID to the LCIDM. */
3610 if (!ossl_quic_lcidm_debug_add(ch->lcidm, ch, &ch->cur_local_cid,
3611 100))
3612 return 0;
3613 return 1;
3614 }
3615
ossl_quic_channel_set_msg_callback(QUIC_CHANNEL * ch,ossl_msg_cb msg_callback,SSL * msg_callback_ssl)3616 void ossl_quic_channel_set_msg_callback(QUIC_CHANNEL *ch,
3617 ossl_msg_cb msg_callback,
3618 SSL *msg_callback_ssl)
3619 {
3620 ch->msg_callback = msg_callback;
3621 ch->msg_callback_ssl = msg_callback_ssl;
3622 ossl_qtx_set_msg_callback(ch->qtx, msg_callback, msg_callback_ssl);
3623 ossl_quic_tx_packetiser_set_msg_callback(ch->txp, msg_callback,
3624 msg_callback_ssl);
3625 ossl_qrx_set_msg_callback(ch->qrx, msg_callback, msg_callback_ssl);
3626 }
3627
ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL * ch,void * msg_callback_arg)3628 void ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL *ch,
3629 void *msg_callback_arg)
3630 {
3631 ch->msg_callback_arg = msg_callback_arg;
3632 ossl_qtx_set_msg_callback_arg(ch->qtx, msg_callback_arg);
3633 ossl_quic_tx_packetiser_set_msg_callback_arg(ch->txp, msg_callback_arg);
3634 ossl_qrx_set_msg_callback_arg(ch->qrx, msg_callback_arg);
3635 }
3636
ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL * ch,uint64_t tx_pkt_threshold)3637 void ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL *ch,
3638 uint64_t tx_pkt_threshold)
3639 {
3640 ch->txku_threshold_override = tx_pkt_threshold;
3641 }
3642
ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL * ch)3643 uint64_t ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL *ch)
3644 {
3645 return ossl_qtx_get_key_epoch(ch->qtx);
3646 }
3647
ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL * ch)3648 uint64_t ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL *ch)
3649 {
3650 return ossl_qrx_get_key_epoch(ch->qrx);
3651 }
3652
ossl_quic_channel_trigger_txku(QUIC_CHANNEL * ch)3653 int ossl_quic_channel_trigger_txku(QUIC_CHANNEL *ch)
3654 {
3655 if (!txku_allowed(ch))
3656 return 0;
3657
3658 ch->ku_locally_initiated = 1;
3659 ch_trigger_txku(ch);
3660 return 1;
3661 }
3662
ossl_quic_channel_ping(QUIC_CHANNEL * ch)3663 int ossl_quic_channel_ping(QUIC_CHANNEL *ch)
3664 {
3665 int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
3666
3667 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
3668
3669 return 1;
3670 }
3671
ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL * ch)3672 uint16_t ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL *ch)
3673 {
3674 return ch->diag_num_rx_ack;
3675 }
3676
ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL * ch,QUIC_CONN_ID * cid)3677 void ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL *ch, QUIC_CONN_ID *cid)
3678 {
3679 *cid = ch->cur_local_cid;
3680 }
3681
ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL * ch)3682 int ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL *ch)
3683 {
3684 return ch->got_local_transport_params;
3685 }
3686
ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL * ch,uint64_t ms)3687 void ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL *ch, uint64_t ms)
3688 {
3689 ch->max_idle_timeout_local_req = ms;
3690 }
ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL * ch)3691 uint64_t ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL *ch)
3692 {
3693 return ch->max_idle_timeout_local_req;
3694 }
3695
ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL * ch)3696 uint64_t ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL *ch)
3697 {
3698 return ch->max_idle_timeout_remote_req;
3699 }
3700
ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL * ch)3701 uint64_t ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL *ch)
3702 {
3703 return ch->max_idle_timeout;
3704 }
3705
