xref: /freebsd/crypto/openssl/ssl/quic/quic_channel.c (revision e7be843b4a162e68651d3911f0357ed464915629)
1 /*
2  * Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <openssl/rand.h>
11 #include <openssl/err.h>
12 #include "internal/ssl_unwrap.h"
13 #include "internal/quic_channel.h"
14 #include "internal/quic_error.h"
15 #include "internal/quic_rx_depack.h"
16 #include "internal/quic_lcidm.h"
17 #include "internal/quic_srtm.h"
18 #include "internal/qlog_event_helpers.h"
19 #include "internal/quic_txp.h"
20 #include "internal/quic_tls.h"
21 #include "internal/quic_ssl.h"
22 #include "../ssl_local.h"
23 #include "quic_channel_local.h"
24 #include "quic_port_local.h"
25 #include "quic_engine_local.h"
26 
27 #define INIT_CRYPTO_RECV_BUF_LEN    16384
28 #define INIT_CRYPTO_SEND_BUF_LEN    16384
29 #define INIT_APP_BUF_LEN             8192
30 
31 /*
32  * Interval before we force a PING to ensure NATs don't timeout. This is based
33  * on the lowest commonly seen value of 30 seconds as cited in RFC 9000 s.
34  * 10.1.2.
35  */
36 #define MAX_NAT_INTERVAL (ossl_ms2time(25000))
37 
38 /*
39  * Our maximum ACK delay on the TX side. This is up to us to choose. Note that
40  * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol
41  * value which determines the value of the maximum ACK delay if the
42  * max_ack_delay transport parameter is not set.
43  */
44 #define DEFAULT_MAX_ACK_DELAY   QUIC_DEFAULT_MAX_ACK_DELAY
45 
46 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
47 
48 static void ch_save_err_state(QUIC_CHANNEL *ch);
49 static int ch_rx(QUIC_CHANNEL *ch, int channel_only, int *notify_other_threads);
50 static int ch_tx(QUIC_CHANNEL *ch, int *notify_other_threads);
51 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only, int *notify_other_threads);
52 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only);
53 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch);
54 static int ch_retry(QUIC_CHANNEL *ch,
55                     const unsigned char *retry_token,
56                     size_t retry_token_len,
57                     const QUIC_CONN_ID *retry_scid,
58                     int drop_later_pn);
59 static int ch_restart(QUIC_CHANNEL *ch);
60 
61 static void ch_cleanup(QUIC_CHANNEL *ch);
62 static int ch_generate_transport_params(QUIC_CHANNEL *ch);
63 static int ch_on_transport_params(const unsigned char *params,
64                                   size_t params_len,
65                                   void *arg);
66 static int ch_on_handshake_alert(void *arg, unsigned char alert_code);
67 static int ch_on_handshake_complete(void *arg);
68 static int ch_on_handshake_yield_secret(uint32_t prot_level, int direction,
69                                         uint32_t suite_id, EVP_MD *md,
70                                         const unsigned char *secret,
71                                         size_t secret_len,
72                                         void *arg);
73 static int ch_on_crypto_recv_record(const unsigned char **buf,
74                                     size_t *bytes_read, void *arg);
75 static int ch_on_crypto_release_record(size_t bytes_read, void *arg);
76 static int crypto_ensure_empty(QUIC_RSTREAM *rstream);
77 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len,
78                              size_t *consumed, void *arg);
79 static OSSL_TIME get_time(void *arg);
80 static uint64_t get_stream_limit(int uni, void *arg);
81 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg);
82 static void rxku_detected(QUIC_PN pn, void *arg);
83 static int ch_retry(QUIC_CHANNEL *ch,
84                     const unsigned char *retry_token,
85                     size_t retry_token_len,
86                     const QUIC_CONN_ID *retry_scid,
87                     int drop_later_pn);
88 static void ch_update_idle(QUIC_CHANNEL *ch);
89 static int ch_discard_el(QUIC_CHANNEL *ch,
90                          uint32_t enc_level);
91 static void ch_on_idle_timeout(QUIC_CHANNEL *ch);
92 static void ch_update_idle(QUIC_CHANNEL *ch);
93 static void ch_update_ping_deadline(QUIC_CHANNEL *ch);
94 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch);
95 static void ch_start_terminating(QUIC_CHANNEL *ch,
96                                  const QUIC_TERMINATE_CAUSE *tcause,
97                                  int force_immediate);
98 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
99                              void *arg);
100 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt);
101 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch);
102 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state);
103 
104 DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM);
105 
106 QUIC_NEEDS_LOCK
ch_get_qlog(QUIC_CHANNEL * ch)107 static QLOG *ch_get_qlog(QUIC_CHANNEL *ch)
108 {
109 #ifndef OPENSSL_NO_QLOG
110     QLOG_TRACE_INFO qti = {0};
111 
112     if (ch->qlog != NULL)
113         return ch->qlog;
114 
115     if (!ch->use_qlog)
116         return NULL;
117 
118     if (ch->is_server && ch->init_dcid.id_len == 0)
119         return NULL;
120 
121     qti.odcid       = ch->init_dcid;
122     qti.title       = ch->qlog_title;
123     qti.description = NULL;
124     qti.group_id    = NULL;
125     qti.is_server   = ch->is_server;
126     qti.now_cb      = get_time;
127     qti.now_cb_arg  = ch;
128     if ((ch->qlog = ossl_qlog_new_from_env(&qti)) == NULL) {
129         ch->use_qlog = 0; /* don't try again */
130         return NULL;
131     }
132 
133     return ch->qlog;
134 #else
135     return NULL;
136 #endif
137 }
138 
139 QUIC_NEEDS_LOCK
ch_get_qlog_cb(void * arg)140 static QLOG *ch_get_qlog_cb(void *arg)
141 {
142     QUIC_CHANNEL *ch = arg;
143 
144     return ch_get_qlog(ch);
145 }
146 
147 /*
148  * QUIC Channel Initialization and Teardown
149  * ========================================
150  */
151 #define DEFAULT_INIT_CONN_RXFC_WND      (768 * 1024)
152 #define DEFAULT_CONN_RXFC_MAX_WND_MUL   20
153 
154 #define DEFAULT_INIT_STREAM_RXFC_WND    (512 * 1024)
155 #define DEFAULT_STREAM_RXFC_MAX_WND_MUL 12
156 
157 #define DEFAULT_INIT_CONN_MAX_STREAMS           100
158 
ch_init(QUIC_CHANNEL * ch)159 static int ch_init(QUIC_CHANNEL *ch)
160 {
161     OSSL_QUIC_TX_PACKETISER_ARGS txp_args = {0};
162     OSSL_QTX_ARGS qtx_args = {0};
163     OSSL_QRX_ARGS qrx_args = {0};
164     QUIC_TLS_ARGS tls_args = {0};
165     uint32_t pn_space;
166     size_t rx_short_dcid_len;
167     size_t tx_init_dcid_len;
168 
169     if (ch->port == NULL || ch->lcidm == NULL || ch->srtm == NULL)
170         goto err;
171 
172     rx_short_dcid_len = ossl_quic_port_get_rx_short_dcid_len(ch->port);
173     tx_init_dcid_len = ossl_quic_port_get_tx_init_dcid_len(ch->port);
174 
175     /* For clients, generate our initial DCID. */
176     if (!ch->is_server
177         && !ossl_quic_gen_rand_conn_id(ch->port->engine->libctx, tx_init_dcid_len,
178                                        &ch->init_dcid))
179         goto err;
180 
181     /* We plug in a network write BIO to the QTX later when we get one. */
182     qtx_args.libctx             = ch->port->engine->libctx;
183     qtx_args.get_qlog_cb        = ch_get_qlog_cb;
184     qtx_args.get_qlog_cb_arg    = ch;
185     qtx_args.mdpl               = QUIC_MIN_INITIAL_DGRAM_LEN;
186     ch->rx_max_udp_payload_size = qtx_args.mdpl;
187 
188     ch->ping_deadline = ossl_time_infinite();
189 
190     ch->qtx = ossl_qtx_new(&qtx_args);
191     if (ch->qtx == NULL)
192         goto err;
193 
194     ch->txpim = ossl_quic_txpim_new();
195     if (ch->txpim == NULL)
196         goto err;
197 
198     ch->cfq = ossl_quic_cfq_new();
199     if (ch->cfq == NULL)
200         goto err;
201 
202     if (!ossl_quic_txfc_init(&ch->conn_txfc, NULL))
203         goto err;
204 
205     /*
206      * Note: The TP we transmit governs what the peer can transmit and thus
207      * applies to the RXFC.
208      */
209     ch->tx_init_max_stream_data_bidi_local  = DEFAULT_INIT_STREAM_RXFC_WND;
210     ch->tx_init_max_stream_data_bidi_remote = DEFAULT_INIT_STREAM_RXFC_WND;
211     ch->tx_init_max_stream_data_uni         = DEFAULT_INIT_STREAM_RXFC_WND;
212 
213     if (!ossl_quic_rxfc_init(&ch->conn_rxfc, NULL,
214                              DEFAULT_INIT_CONN_RXFC_WND,
215                              DEFAULT_CONN_RXFC_MAX_WND_MUL *
216                              DEFAULT_INIT_CONN_RXFC_WND,
217                              get_time, ch))
218         goto err;
219 
220     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
221         if (!ossl_quic_rxfc_init_standalone(&ch->crypto_rxfc[pn_space],
222                                             INIT_CRYPTO_RECV_BUF_LEN,
223                                             get_time, ch))
224             goto err;
225 
226     if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_bidi_rxfc,
227                                         DEFAULT_INIT_CONN_MAX_STREAMS,
228                                         get_time, ch))
229         goto err;
230 
231     if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_uni_rxfc,
232                                         DEFAULT_INIT_CONN_MAX_STREAMS,
233                                         get_time, ch))
234         goto err;
235 
236     if (!ossl_statm_init(&ch->statm))
237         goto err;
238 
239     ch->have_statm = 1;
240     ch->cc_method = &ossl_cc_newreno_method;
241     if ((ch->cc_data = ch->cc_method->new(get_time, ch)) == NULL)
242         goto err;
243 
244     if ((ch->ackm = ossl_ackm_new(get_time, ch, &ch->statm,
245                                   ch->cc_method, ch->cc_data)) == NULL)
246         goto err;
247 
248     if (!ossl_quic_stream_map_init(&ch->qsm, get_stream_limit, ch,
249                                    &ch->max_streams_bidi_rxfc,
250                                    &ch->max_streams_uni_rxfc,
251                                    ch->is_server))
252         goto err;
253 
254     ch->have_qsm = 1;
255 
256     if (!ch->is_server
257         && !ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &ch->init_scid))
258         goto err;
259 
260     txp_args.cur_scid               = ch->init_scid;
261     txp_args.cur_dcid               = ch->init_dcid;
262     txp_args.ack_delay_exponent     = 3;
263     txp_args.qtx                    = ch->qtx;
264     txp_args.txpim                  = ch->txpim;
265     txp_args.cfq                    = ch->cfq;
266     txp_args.ackm                   = ch->ackm;
267     txp_args.qsm                    = &ch->qsm;
268     txp_args.conn_txfc              = &ch->conn_txfc;
269     txp_args.conn_rxfc              = &ch->conn_rxfc;
270     txp_args.max_streams_bidi_rxfc  = &ch->max_streams_bidi_rxfc;
271     txp_args.max_streams_uni_rxfc   = &ch->max_streams_uni_rxfc;
272     txp_args.cc_method              = ch->cc_method;
273     txp_args.cc_data                = ch->cc_data;
274     txp_args.now                    = get_time;
275     txp_args.now_arg                = ch;
276     txp_args.get_qlog_cb            = ch_get_qlog_cb;
277     txp_args.get_qlog_cb_arg        = ch;
278     txp_args.protocol_version       = QUIC_VERSION_1;
279 
280     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
281         ch->crypto_send[pn_space] = ossl_quic_sstream_new(INIT_CRYPTO_SEND_BUF_LEN);
282         if (ch->crypto_send[pn_space] == NULL)
283             goto err;
284 
285         txp_args.crypto[pn_space] = ch->crypto_send[pn_space];
286     }
287 
288     ch->txp = ossl_quic_tx_packetiser_new(&txp_args);
289     if (ch->txp == NULL)
290         goto err;
291 
292     /* clients have no amplification limit, so are considered always valid */
293     if (!ch->is_server)
294         ossl_quic_tx_packetiser_set_validated(ch->txp);
295 
296     ossl_quic_tx_packetiser_set_ack_tx_cb(ch->txp, ch_on_txp_ack_tx, ch);
297 
298     /*
299      * qrx does not exist yet, then we must be dealing with client channel
300      * (QUIC connection initiator).
301      * If qrx exists already, then we are dealing with server channel which
302      * qrx gets created by port_default_packet_handler() before
303      * port_default_packet_handler() accepts connection and creates channel
304      * for it.
305      * The exception here is tserver which always creates channel,
306      * before the first packet is ever seen.
307      */
308     if (ch->qrx == NULL && ch->is_tserver_ch == 0) {
309         /* we are regular client, create channel */
310         qrx_args.libctx             = ch->port->engine->libctx;
311         qrx_args.demux              = ch->port->demux;
312         qrx_args.short_conn_id_len  = rx_short_dcid_len;
313         qrx_args.max_deferred       = 32;
314 
315         if ((ch->qrx = ossl_qrx_new(&qrx_args)) == NULL)
316             goto err;
317     }
318 
319     if (ch->qrx != NULL) {
320         /*
321          * callbacks for channels associated with tserver's port
322          * are set up later when we call ossl_quic_channel_bind_qrx()
323          * in port_default_packet_handler()
324          */
325         if (!ossl_qrx_set_late_validation_cb(ch->qrx,
326                                              rx_late_validate,
327                                              ch))
328             goto err;
329 
330         if (!ossl_qrx_set_key_update_cb(ch->qrx,
331                                         rxku_detected,
332                                         ch))
333             goto err;
334     }
335 
336 
337     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
338         ch->crypto_recv[pn_space] = ossl_quic_rstream_new(NULL, NULL, 0);
339         if (ch->crypto_recv[pn_space] == NULL)
340             goto err;
341     }
342 
343     /* Plug in the TLS handshake layer. */
344     tls_args.s                          = ch->tls;
345     tls_args.crypto_send_cb             = ch_on_crypto_send;
346     tls_args.crypto_send_cb_arg         = ch;
347     tls_args.crypto_recv_rcd_cb         = ch_on_crypto_recv_record;
348     tls_args.crypto_recv_rcd_cb_arg     = ch;
349     tls_args.crypto_release_rcd_cb      = ch_on_crypto_release_record;
350     tls_args.crypto_release_rcd_cb_arg  = ch;
351     tls_args.yield_secret_cb            = ch_on_handshake_yield_secret;
352     tls_args.yield_secret_cb_arg        = ch;
353     tls_args.got_transport_params_cb    = ch_on_transport_params;
354     tls_args.got_transport_params_cb_arg= ch;
355     tls_args.handshake_complete_cb      = ch_on_handshake_complete;
356     tls_args.handshake_complete_cb_arg  = ch;
357     tls_args.alert_cb                   = ch_on_handshake_alert;
358     tls_args.alert_cb_arg               = ch;
359     tls_args.is_server                  = ch->is_server;
360     tls_args.ossl_quic                  = 1;
361 
362     if ((ch->qtls = ossl_quic_tls_new(&tls_args)) == NULL)
363         goto err;
364 
365     ch->tx_max_ack_delay        = DEFAULT_MAX_ACK_DELAY;
366     ch->rx_max_ack_delay        = QUIC_DEFAULT_MAX_ACK_DELAY;
367     ch->rx_ack_delay_exp        = QUIC_DEFAULT_ACK_DELAY_EXP;
368     ch->rx_active_conn_id_limit = QUIC_MIN_ACTIVE_CONN_ID_LIMIT;
369     ch->tx_enc_level            = QUIC_ENC_LEVEL_INITIAL;
370     ch->rx_enc_level            = QUIC_ENC_LEVEL_INITIAL;
371     ch->txku_threshold_override = UINT64_MAX;
372 
373     ch->max_idle_timeout_local_req  = QUIC_DEFAULT_IDLE_TIMEOUT;
374     ch->max_idle_timeout_remote_req = 0;
375     ch->max_idle_timeout            = ch->max_idle_timeout_local_req;
376 
377     ossl_ackm_set_tx_max_ack_delay(ch->ackm, ossl_ms2time(ch->tx_max_ack_delay));
378     ossl_ackm_set_rx_max_ack_delay(ch->ackm, ossl_ms2time(ch->rx_max_ack_delay));
379 
380     ch_update_idle(ch);
381     ossl_list_ch_insert_tail(&ch->port->channel_list, ch);
382     ch->on_port_list = 1;
383     return 1;
384 
385 err:
386     ch_cleanup(ch);
387     return 0;
388 }
389 
ch_cleanup(QUIC_CHANNEL * ch)390 static void ch_cleanup(QUIC_CHANNEL *ch)
391 {
392     uint32_t pn_space;
393 
394     if (ch->ackm != NULL)
395         for (pn_space = QUIC_PN_SPACE_INITIAL;
396              pn_space < QUIC_PN_SPACE_NUM;
397              ++pn_space)
398             ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
399 
400     ossl_quic_lcidm_cull(ch->lcidm, ch);
401     ossl_quic_srtm_cull(ch->srtm, ch);
402     ossl_quic_tx_packetiser_free(ch->txp);
403     ossl_quic_txpim_free(ch->txpim);
404     ossl_quic_cfq_free(ch->cfq);
405     ossl_qtx_free(ch->qtx);
406     if (ch->cc_data != NULL)
407         ch->cc_method->free(ch->cc_data);
408     if (ch->have_statm)
409         ossl_statm_destroy(&ch->statm);
410     ossl_ackm_free(ch->ackm);
411 
412     if (ch->have_qsm)
413         ossl_quic_stream_map_cleanup(&ch->qsm);
414 
415     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
416         ossl_quic_sstream_free(ch->crypto_send[pn_space]);
417         ossl_quic_rstream_free(ch->crypto_recv[pn_space]);
418     }
419 
420     ossl_qrx_pkt_release(ch->qrx_pkt);
421     ch->qrx_pkt = NULL;
422 
423     ossl_quic_tls_free(ch->qtls);
424     ossl_qrx_free(ch->qrx);
425     OPENSSL_free(ch->local_transport_params);
426     OPENSSL_free((char *)ch->terminate_cause.reason);
427     OSSL_ERR_STATE_free(ch->err_state);
428     OPENSSL_free(ch->ack_range_scratch);
429     OPENSSL_free(ch->pending_new_token);
430 
431     if (ch->on_port_list) {
432         ossl_list_ch_remove(&ch->port->channel_list, ch);
433         ch->on_port_list = 0;
434     }
435 
436 #ifndef OPENSSL_NO_QLOG
437     if (ch->qlog != NULL)
438         ossl_qlog_flush(ch->qlog); /* best effort */
439 
440     OPENSSL_free(ch->qlog_title);
441     ossl_qlog_free(ch->qlog);
442 #endif
443 }
444 
ossl_quic_channel_init(QUIC_CHANNEL * ch)445 int ossl_quic_channel_init(QUIC_CHANNEL *ch)
446 {
447     return ch_init(ch);
448 }
449 
ossl_quic_channel_bind_qrx(QUIC_CHANNEL * tserver_ch,OSSL_QRX * qrx)450 void ossl_quic_channel_bind_qrx(QUIC_CHANNEL *tserver_ch, OSSL_QRX *qrx)
451 {
452     if (tserver_ch->qrx == NULL && tserver_ch->is_tserver_ch == 1) {
453         tserver_ch->qrx = qrx;
454         ossl_qrx_set_late_validation_cb(tserver_ch->qrx, rx_late_validate,
455                                         tserver_ch);
456         ossl_qrx_set_key_update_cb(tserver_ch->qrx, rxku_detected,
457                                    tserver_ch);
458     }
459 }
460 
ossl_quic_channel_alloc(const QUIC_CHANNEL_ARGS * args)461 QUIC_CHANNEL *ossl_quic_channel_alloc(const QUIC_CHANNEL_ARGS *args)
462 {
463     QUIC_CHANNEL *ch = NULL;
464 
465     if ((ch = OPENSSL_zalloc(sizeof(*ch))) == NULL)
466         return NULL;
467 
468     ch->port           = args->port;
469     ch->is_server      = args->is_server;
470     ch->tls            = args->tls;
471     ch->lcidm          = args->lcidm;
472     ch->srtm           = args->srtm;
473     ch->qrx            = args->qrx;
474     ch->is_tserver_ch  = args->is_tserver_ch;
475 #ifndef OPENSSL_NO_QLOG
476     ch->use_qlog    = args->use_qlog;
477 
478     if (ch->use_qlog && args->qlog_title != NULL) {
479         if ((ch->qlog_title = OPENSSL_strdup(args->qlog_title)) == NULL) {
480             OPENSSL_free(ch);
481             return NULL;
482         }
483     }
484 #endif
485 
486     return ch;
487 }
488 
ossl_quic_channel_free(QUIC_CHANNEL * ch)489 void ossl_quic_channel_free(QUIC_CHANNEL *ch)
490 {
491     if (ch == NULL)
492         return;
493 
494     ch_cleanup(ch);
495     OPENSSL_free(ch);
496 }
497 
498 /* Set mutator callbacks for test framework support */
ossl_quic_channel_set_mutator(QUIC_CHANNEL * ch,ossl_mutate_packet_cb mutatecb,ossl_finish_mutate_cb finishmutatecb,void * mutatearg)499 int ossl_quic_channel_set_mutator(QUIC_CHANNEL *ch,
500                                   ossl_mutate_packet_cb mutatecb,
501                                   ossl_finish_mutate_cb finishmutatecb,
502                                   void *mutatearg)
503 {
504     if (ch->qtx == NULL)
505         return 0;
506 
507     ossl_qtx_set_mutator(ch->qtx, mutatecb, finishmutatecb, mutatearg);
508     return 1;
509 }
510 
ossl_quic_channel_get_peer_addr(QUIC_CHANNEL * ch,BIO_ADDR * peer_addr)511 int ossl_quic_channel_get_peer_addr(QUIC_CHANNEL *ch, BIO_ADDR *peer_addr)
512 {
513     if (!ch->addressed_mode)
514         return 0;
515 
516     return BIO_ADDR_copy(peer_addr, &ch->cur_peer_addr);
517 }
518 
ossl_quic_channel_set_peer_addr(QUIC_CHANNEL * ch,const BIO_ADDR * peer_addr)519 int ossl_quic_channel_set_peer_addr(QUIC_CHANNEL *ch, const BIO_ADDR *peer_addr)
520 {
521     if (ch->state != QUIC_CHANNEL_STATE_IDLE)
522         return 0;
523 
524     if (peer_addr == NULL || BIO_ADDR_family(peer_addr) == AF_UNSPEC) {
525         BIO_ADDR_clear(&ch->cur_peer_addr);
526         ch->addressed_mode = 0;
527         return 1;
528     }
529 
530     if (!BIO_ADDR_copy(&ch->cur_peer_addr, peer_addr)) {
531         ch->addressed_mode = 0;
532         return 0;
533     }
534     ch->addressed_mode = 1;
535 
536     return 1;
537 }
538 
ossl_quic_channel_get_reactor(QUIC_CHANNEL * ch)539 QUIC_REACTOR *ossl_quic_channel_get_reactor(QUIC_CHANNEL *ch)
540 {
541     return ossl_quic_port_get0_reactor(ch->port);
542 }
543 
ossl_quic_channel_get_qsm(QUIC_CHANNEL * ch)544 QUIC_STREAM_MAP *ossl_quic_channel_get_qsm(QUIC_CHANNEL *ch)
545 {
546     return &ch->qsm;
547 }
548 
ossl_quic_channel_get_statm(QUIC_CHANNEL * ch)549 OSSL_STATM *ossl_quic_channel_get_statm(QUIC_CHANNEL *ch)
550 {
551     return &ch->statm;
552 }
553 
ossl_quic_channel_get0_tls(QUIC_CHANNEL * ch)554 SSL *ossl_quic_channel_get0_tls(QUIC_CHANNEL *ch)
555 {
556     return ch->tls;
557 }
558 
free_buf_mem(unsigned char * buf,size_t buf_len,void * arg)559 static void free_buf_mem(unsigned char *buf, size_t buf_len, void *arg)
560 {
561     BUF_MEM_free((BUF_MEM *)arg);
562 }
563 
ossl_quic_channel_schedule_new_token(QUIC_CHANNEL * ch,const unsigned char * token,size_t token_len)564 int ossl_quic_channel_schedule_new_token(QUIC_CHANNEL *ch,
565                                          const unsigned char *token,
566                                          size_t token_len)
567 {
568     int rc = 0;
569     QUIC_CFQ_ITEM *cfq_item;
570     WPACKET wpkt;
571     BUF_MEM *buf_mem = NULL;
572     size_t l = 0;
573 
574     buf_mem = BUF_MEM_new();
575     if (buf_mem == NULL)
576         goto err;
577 
578     if (!WPACKET_init(&wpkt, buf_mem))
579         goto err;
580 
581     if (!ossl_quic_wire_encode_frame_new_token(&wpkt, token,
582                                                token_len)) {
583         WPACKET_cleanup(&wpkt);
584         goto err;
585     }
586 
587     WPACKET_finish(&wpkt);
588 
589     if (!WPACKET_get_total_written(&wpkt, &l))
590         goto err;
591 
592     cfq_item = ossl_quic_cfq_add_frame(ch->cfq, 1,
593                                        QUIC_PN_SPACE_APP,
594                                        OSSL_QUIC_FRAME_TYPE_NEW_TOKEN, 0,
595                                        (unsigned char *)buf_mem->data, l,
596                                        free_buf_mem,
597                                        buf_mem);
598     if (cfq_item == NULL)
599         goto err;
600 
601     rc = 1;
602 err:
603     if (!rc)
604         BUF_MEM_free(buf_mem);
605     return rc;
606 }
607 
ossl_quic_channel_get_short_header_conn_id_len(QUIC_CHANNEL * ch)608 size_t ossl_quic_channel_get_short_header_conn_id_len(QUIC_CHANNEL *ch)
609 {
610     return ossl_quic_port_get_rx_short_dcid_len(ch->port);
611 }
612 
ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL * ch,uint64_t stream_id)613 QUIC_STREAM *ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL *ch,
614                                                 uint64_t stream_id)
615 {
616     return ossl_quic_stream_map_get_by_id(&ch->qsm, stream_id);
617 }
618 
ossl_quic_channel_is_active(const QUIC_CHANNEL * ch)619 int ossl_quic_channel_is_active(const QUIC_CHANNEL *ch)
620 {
621     return ch != NULL && ch->state == QUIC_CHANNEL_STATE_ACTIVE;
622 }
623 
ossl_quic_channel_is_closing(const QUIC_CHANNEL * ch)624 int ossl_quic_channel_is_closing(const QUIC_CHANNEL *ch)
625 {
626     return ch->state == QUIC_CHANNEL_STATE_TERMINATING_CLOSING;
627 }
628 
ossl_quic_channel_is_draining(const QUIC_CHANNEL * ch)629 static int ossl_quic_channel_is_draining(const QUIC_CHANNEL *ch)
630 {
631     return ch->state == QUIC_CHANNEL_STATE_TERMINATING_DRAINING;
632 }
633 
ossl_quic_channel_is_terminating(const QUIC_CHANNEL * ch)634 static int ossl_quic_channel_is_terminating(const QUIC_CHANNEL *ch)
635 {
636     return ossl_quic_channel_is_closing(ch)
637         || ossl_quic_channel_is_draining(ch);
638 }
639 
ossl_quic_channel_is_terminated(const QUIC_CHANNEL * ch)640 int ossl_quic_channel_is_terminated(const QUIC_CHANNEL *ch)
641 {
642     return ch->state == QUIC_CHANNEL_STATE_TERMINATED;
643 }
644 
ossl_quic_channel_is_term_any(const QUIC_CHANNEL * ch)645 int ossl_quic_channel_is_term_any(const QUIC_CHANNEL *ch)
646 {
647     return ossl_quic_channel_is_terminating(ch)
648         || ossl_quic_channel_is_terminated(ch);
649 }
650 
651 const QUIC_TERMINATE_CAUSE *
ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL * ch)652 ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL *ch)
653 {
654     return ossl_quic_channel_is_term_any(ch) ? &ch->terminate_cause : NULL;
655 }
656 
ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL * ch)657 int ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL *ch)
658 {
659     return ch->handshake_complete;
660 }
661 
ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL * ch)662 int ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL *ch)
663 {
664     return ch->handshake_confirmed;
665 }
666 
ossl_quic_channel_get0_demux(QUIC_CHANNEL * ch)667 QUIC_DEMUX *ossl_quic_channel_get0_demux(QUIC_CHANNEL *ch)
668 {
669     return ch->port->demux;
670 }
671 
ossl_quic_channel_get0_port(QUIC_CHANNEL * ch)672 QUIC_PORT *ossl_quic_channel_get0_port(QUIC_CHANNEL *ch)
673 {
674     return ch->port;
675 }
676 
ossl_quic_channel_get0_engine(QUIC_CHANNEL * ch)677 QUIC_ENGINE *ossl_quic_channel_get0_engine(QUIC_CHANNEL *ch)
678 {
679     return ossl_quic_port_get0_engine(ch->port);
680 }
681 
ossl_quic_channel_get_mutex(QUIC_CHANNEL * ch)682 CRYPTO_MUTEX *ossl_quic_channel_get_mutex(QUIC_CHANNEL *ch)
683 {
684     return ossl_quic_port_get0_mutex(ch->port);
685 }
686 
ossl_quic_channel_has_pending(const QUIC_CHANNEL * ch)687 int ossl_quic_channel_has_pending(const QUIC_CHANNEL *ch)
688 {
689     return ossl_quic_demux_has_pending(ch->port->demux)
690         || ossl_qrx_processed_read_pending(ch->qrx);
691 }
692 
693 /*
694  * QUIC Channel: Callbacks from Miscellaneous Subsidiary Components
695  * ================================================================
696  */
697 
698 /* Used by various components. */
get_time(void * arg)699 static OSSL_TIME get_time(void *arg)
700 {
701     QUIC_CHANNEL *ch = arg;
702 
703     return ossl_quic_port_get_time(ch->port);
704 }
705 
706 /* Used by QSM. */
get_stream_limit(int uni,void * arg)707 static uint64_t get_stream_limit(int uni, void *arg)
708 {
709     QUIC_CHANNEL *ch = arg;
710 
711     return uni ? ch->max_local_streams_uni : ch->max_local_streams_bidi;
712 }
713 
714 /*
715  * Called by QRX to determine if a packet is potentially invalid before trying
716  * to decrypt it.
717  */
rx_late_validate(QUIC_PN pn,int pn_space,void * arg)718 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg)
719 {
720     QUIC_CHANNEL *ch = arg;
721 
722     /* Potential duplicates should not be processed. */
723     if (!ossl_ackm_is_rx_pn_processable(ch->ackm, pn, pn_space))
724         return 0;
725 
726     return 1;
727 }
728 
729 /*
730  * Triggers a TXKU (whether spontaneous or solicited). Does not check whether
731  * spontaneous TXKU is currently allowed.
732  */
733 QUIC_NEEDS_LOCK
ch_trigger_txku(QUIC_CHANNEL * ch)734 static void ch_trigger_txku(QUIC_CHANNEL *ch)
735 {
736     uint64_t next_pn
737         = ossl_quic_tx_packetiser_get_next_pn(ch->txp, QUIC_PN_SPACE_APP);
738 
739     if (!ossl_quic_pn_valid(next_pn)
740         || !ossl_qtx_trigger_key_update(ch->qtx)) {
741         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
742                                                "key update");
743         return;
744     }
745 
746     ch->txku_in_progress    = 1;
747     ch->txku_pn             = next_pn;
748     ch->rxku_expected       = ch->ku_locally_initiated;
749 }
750 
751 QUIC_NEEDS_LOCK
txku_in_progress(QUIC_CHANNEL * ch)752 static int txku_in_progress(QUIC_CHANNEL *ch)
753 {
754     if (ch->txku_in_progress
755         && ossl_ackm_get_largest_acked(ch->ackm, QUIC_PN_SPACE_APP) >= ch->txku_pn) {
756         OSSL_TIME pto = ossl_ackm_get_pto_duration(ch->ackm);
757 
758         /*
759          * RFC 9001 s. 6.5: Endpoints SHOULD wait three times the PTO before
760          * initiating a key update after receiving an acknowledgment that
761          * confirms that the previous key update was received.
762          *
763          * Note that by the above wording, this period starts from when we get
764          * the ack for a TXKU-triggering packet, not when the TXKU is initiated.
765          * So we defer TXKU cooldown deadline calculation to this point.
766          */
767         ch->txku_in_progress        = 0;
768         ch->txku_cooldown_deadline  = ossl_time_add(get_time(ch),
769                                                     ossl_time_multiply(pto, 3));
770     }
771 
772     return ch->txku_in_progress;
773 }
774 
775 QUIC_NEEDS_LOCK
txku_allowed(QUIC_CHANNEL * ch)776 static int txku_allowed(QUIC_CHANNEL *ch)
777 {
778     return ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT /* Sanity check. */
779         /* Strict RFC 9001 criterion for TXKU. */
780         && ch->handshake_confirmed
781         && !txku_in_progress(ch);
782 }
783 
784 QUIC_NEEDS_LOCK
txku_recommendable(QUIC_CHANNEL * ch)785 static int txku_recommendable(QUIC_CHANNEL *ch)
786 {
787     if (!txku_allowed(ch))
788         return 0;
789 
790     return
791         /* Recommended RFC 9001 criterion for TXKU. */
792         ossl_time_compare(get_time(ch), ch->txku_cooldown_deadline) >= 0
793         /* Some additional sensible criteria. */
794         && !ch->rxku_in_progress
795         && !ch->rxku_pending_confirm;
796 }
797 
798 QUIC_NEEDS_LOCK
txku_desirable(QUIC_CHANNEL * ch)799 static int txku_desirable(QUIC_CHANNEL *ch)
800 {
801     uint64_t cur_pkt_count, max_pkt_count, thresh_pkt_count;
802     const uint32_t enc_level = QUIC_ENC_LEVEL_1RTT;
803 
804     /* Check AEAD limit to determine if we should perform a spontaneous TXKU. */
805     cur_pkt_count = ossl_qtx_get_cur_epoch_pkt_count(ch->qtx, enc_level);
806     max_pkt_count = ossl_qtx_get_max_epoch_pkt_count(ch->qtx, enc_level);
807 
808     thresh_pkt_count = max_pkt_count / 2;
809     if (ch->txku_threshold_override != UINT64_MAX)
810         thresh_pkt_count = ch->txku_threshold_override;
811 
812     return cur_pkt_count >= thresh_pkt_count;
813 }
814 
815 QUIC_NEEDS_LOCK
ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL * ch)816 static void ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL *ch)
817 {
818     if (!txku_recommendable(ch) || !txku_desirable(ch))
819         return;
820 
821     ch->ku_locally_initiated = 1;
822     ch_trigger_txku(ch);
823 }
824 
825 QUIC_NEEDS_LOCK
rxku_allowed(QUIC_CHANNEL * ch)826 static int rxku_allowed(QUIC_CHANNEL *ch)
827 {
828     /*
829      * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a key update prior to
830      * having confirmed the handshake (Section 4.1.2).
831      *
832      * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a subsequent key update
833      * unless it has received an acknowledgment for a packet that was sent
834      * protected with keys from the current key phase.
835      *
836      * RFC 9001 s. 6.2: If an endpoint detects a second update before it has
837      * sent any packets with updated keys containing an acknowledgment for the
838      * packet that initiated the key update, it indicates that its peer has
839      * updated keys twice without awaiting confirmation. An endpoint MAY treat
840      * such consecutive key updates as a connection error of type
841      * KEY_UPDATE_ERROR.
842      */
843     return ch->handshake_confirmed && !ch->rxku_pending_confirm;
844 }
845 
846 /*
847  * Called when the QRX detects a new RX key update event.
848  */
849 enum rxku_decision {
850     DECISION_RXKU_ONLY,
851     DECISION_PROTOCOL_VIOLATION,
852     DECISION_SOLICITED_TXKU
853 };
854 
855 /* Called when the QRX detects a key update has occurred. */
856 QUIC_NEEDS_LOCK
rxku_detected(QUIC_PN pn,void * arg)857 static void rxku_detected(QUIC_PN pn, void *arg)
858 {
859     QUIC_CHANNEL *ch = arg;
860     enum rxku_decision decision;
861     OSSL_TIME pto;
862 
863     /*
864      * Note: rxku_in_progress is always 0 here as an RXKU cannot be detected
865      * when we are still in UPDATING or COOLDOWN (see quic_record_rx.h).
866      */
867     assert(!ch->rxku_in_progress);
868 
869     if (!rxku_allowed(ch))
870         /* Is RXKU even allowed at this time? */
871         decision = DECISION_PROTOCOL_VIOLATION;
872 
873     else if (ch->ku_locally_initiated)
874         /*
875          * If this key update was locally initiated (meaning that this detected
876          * RXKU event is a result of our own spontaneous TXKU), we do not
877          * trigger another TXKU; after all, to do so would result in an infinite
878          * ping-pong of key updates. We still process it as an RXKU.
879          */
880         decision = DECISION_RXKU_ONLY;
881 
882     else
883         /*
884          * Otherwise, a peer triggering a KU means we have to trigger a KU also.
885          */
886         decision = DECISION_SOLICITED_TXKU;
887 
888     if (decision == DECISION_PROTOCOL_VIOLATION) {
889         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR,
890                                                0, "RX key update again too soon");
891         return;
892     }
893 
894     pto = ossl_ackm_get_pto_duration(ch->ackm);
895 
896     ch->ku_locally_initiated        = 0;
897     ch->rxku_in_progress            = 1;
898     ch->rxku_pending_confirm        = 1;
899     ch->rxku_trigger_pn             = pn;
900     ch->rxku_update_end_deadline    = ossl_time_add(get_time(ch), pto);
901     ch->rxku_expected               = 0;
902 
903     if (decision == DECISION_SOLICITED_TXKU)
904         /* NOT gated by usual txku_allowed() */
905         ch_trigger_txku(ch);
906 
907     /*
908      * Ordinarily, we only generate ACK when some ACK-eliciting frame has been
909      * received. In some cases, this may not occur for a long time, for example
910      * if transmission of application data is going in only one direction and
911      * nothing else is happening with the connection. However, since the peer
912      * cannot initiate a subsequent (spontaneous) TXKU until its prior
913      * (spontaneous or solicited) TXKU has completed - meaning that prior
914      * TXKU's trigger packet (or subsequent packet) has been acknowledged, this
915      * can lead to very long times before a TXKU is considered 'completed'.
916      * Optimise this by forcing ACK generation after triggering TXKU.
917      * (Basically, we consider a RXKU event something that is 'ACK-eliciting',
918      * which it more or less should be; it is necessarily separate from ordinary
919      * processing of ACK-eliciting frames as key update is not indicated via a
920      * frame.)
921      */
922     ossl_quic_tx_packetiser_schedule_ack(ch->txp, QUIC_PN_SPACE_APP);
923 }
924 
925 /* Called per tick to handle RXKU timer events. */
926 QUIC_NEEDS_LOCK
ch_rxku_tick(QUIC_CHANNEL * ch)927 static void ch_rxku_tick(QUIC_CHANNEL *ch)
928 {
929     if (!ch->rxku_in_progress
930         || ossl_time_compare(get_time(ch), ch->rxku_update_end_deadline) < 0)
931         return;
932 
933     ch->rxku_update_end_deadline    = ossl_time_infinite();
934     ch->rxku_in_progress            = 0;
935 
936     if (!ossl_qrx_key_update_timeout(ch->qrx, /*normal=*/1))
937         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
938                                                "RXKU cooldown internal error");
939 }
940 
941 QUIC_NEEDS_LOCK
ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK * ack,uint32_t pn_space,void * arg)942 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
943                              void *arg)
944 {
945     QUIC_CHANNEL *ch = arg;
946 
947     if (pn_space != QUIC_PN_SPACE_APP || !ch->rxku_pending_confirm
948         || !ossl_quic_frame_ack_contains_pn(ack, ch->rxku_trigger_pn))
949         return;
950 
951     /*
952      * Defer clearing rxku_pending_confirm until TXP generate call returns
953      * successfully.
954      */
955     ch->rxku_pending_confirm_done = 1;
956 }
957 
958 /*
959  * QUIC Channel: Handshake Layer Event Handling
960  * ============================================
961  */
ch_on_crypto_send(const unsigned char * buf,size_t buf_len,size_t * consumed,void * arg)962 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len,
963                              size_t *consumed, void *arg)
964 {
965     int ret;
966     QUIC_CHANNEL *ch = arg;
967     uint32_t enc_level = ch->tx_enc_level;
968     uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
969     QUIC_SSTREAM *sstream = ch->crypto_send[pn_space];
970 
971     if (!ossl_assert(sstream != NULL))
972         return 0;
973 
974     ret = ossl_quic_sstream_append(sstream, buf, buf_len, consumed);
975     return ret;
976 }
977 
crypto_ensure_empty(QUIC_RSTREAM * rstream)978 static int crypto_ensure_empty(QUIC_RSTREAM *rstream)
979 {
980     size_t avail = 0;
981     int is_fin = 0;
982 
983     if (rstream == NULL)
984         return 1;
985 
986     if (!ossl_quic_rstream_available(rstream, &avail, &is_fin))
987         return 0;
988 
989     return avail == 0;
990 }
991 
ch_on_crypto_recv_record(const unsigned char ** buf,size_t * bytes_read,void * arg)992 static int ch_on_crypto_recv_record(const unsigned char **buf,
993                                     size_t *bytes_read, void *arg)
994 {
995     QUIC_CHANNEL *ch = arg;
996     QUIC_RSTREAM *rstream;
997     int is_fin = 0; /* crypto stream is never finished, so we don't use this */
998     uint32_t i;
999 
1000     /*
1001      * After we move to a later EL we must not allow our peer to send any new
1002      * bytes in the crypto stream on a previous EL. Retransmissions of old bytes
1003      * are allowed.
1004      *
1005      * In practice we will only move to a new EL when we have consumed all bytes
1006      * which should be sent on the crypto stream at a previous EL. For example,
1007      * the Handshake EL should not be provisioned until we have completely
1008      * consumed a TLS 1.3 ServerHello. Thus when we provision an EL the output
1009      * of ossl_quic_rstream_available() should be 0 for all lower ELs. Thus if a
1010      * given EL is available we simply ensure we have not received any further
1011      * bytes at a lower EL.
1012      */
1013     for (i = QUIC_ENC_LEVEL_INITIAL; i < ch->rx_enc_level; ++i)
1014         if (i != QUIC_ENC_LEVEL_0RTT &&
1015             !crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) {
1016             /* Protocol violation (RFC 9001 s. 4.1.3) */
1017             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1018                                                    OSSL_QUIC_FRAME_TYPE_CRYPTO,
1019                                                    "crypto stream data in wrong EL");
1020             return 0;
1021         }
1022 
1023     rstream = ch->crypto_recv[ossl_quic_enc_level_to_pn_space(ch->rx_enc_level)];
1024     if (rstream == NULL)
1025         return 0;
1026 
1027     return ossl_quic_rstream_get_record(rstream, buf, bytes_read,
1028                                         &is_fin);
1029 }
1030 
ch_on_crypto_release_record(size_t bytes_read,void * arg)1031 static int ch_on_crypto_release_record(size_t bytes_read, void *arg)
1032 {
1033     QUIC_CHANNEL *ch = arg;
1034     QUIC_RSTREAM *rstream;
1035     OSSL_RTT_INFO rtt_info;
1036     uint32_t rx_pn_space = ossl_quic_enc_level_to_pn_space(ch->rx_enc_level);
1037 
1038     rstream = ch->crypto_recv[rx_pn_space];
1039     if (rstream == NULL)
1040         return 0;
1041 
1042     ossl_statm_get_rtt_info(ossl_quic_channel_get_statm(ch), &rtt_info);
1043     if (!ossl_quic_rxfc_on_retire(&ch->crypto_rxfc[rx_pn_space], bytes_read,
1044                                   rtt_info.smoothed_rtt))
1045         return 0;
1046 
1047     return ossl_quic_rstream_release_record(rstream, bytes_read);
1048 }
1049 
ch_on_handshake_yield_secret(uint32_t prot_level,int direction,uint32_t suite_id,EVP_MD * md,const unsigned char * secret,size_t secret_len,void * arg)1050 static int ch_on_handshake_yield_secret(uint32_t prot_level, int direction,
1051                                         uint32_t suite_id, EVP_MD *md,
1052                                         const unsigned char *secret,
1053                                         size_t secret_len,
1054                                         void *arg)
1055 {
1056     QUIC_CHANNEL *ch = arg;
1057     uint32_t i;
1058     uint32_t enc_level;
1059 
1060     /* Convert TLS protection level to QUIC encryption level */
1061     switch (prot_level) {
1062     case OSSL_RECORD_PROTECTION_LEVEL_EARLY:
1063         enc_level = QUIC_ENC_LEVEL_0RTT;
1064         break;
1065 
1066     case OSSL_RECORD_PROTECTION_LEVEL_HANDSHAKE:
1067         enc_level = QUIC_ENC_LEVEL_HANDSHAKE;
1068         break;
1069 
1070     case OSSL_RECORD_PROTECTION_LEVEL_APPLICATION:
1071         enc_level = QUIC_ENC_LEVEL_1RTT;
1072         break;
1073 
1074     default:
1075         return 0;
1076     }
1077 
1078     if (enc_level < QUIC_ENC_LEVEL_HANDSHAKE || enc_level >= QUIC_ENC_LEVEL_NUM)
1079         /* Invalid EL. */
1080         return 0;
1081 
1082 
1083     if (direction) {
1084         /* TX */
1085         if (enc_level <= ch->tx_enc_level)
1086             /*
1087              * Does not make sense for us to try and provision an EL we have already
1088              * attained.
1089              */
1090             return 0;
1091 
1092         if (!ossl_qtx_provide_secret(ch->qtx, enc_level,
1093                                      suite_id, md,
1094                                      secret, secret_len))
1095             return 0;
1096 
1097         ch->tx_enc_level = enc_level;
1098     } else {
1099         /* RX */
1100         if (enc_level <= ch->rx_enc_level)
1101             /*
1102              * Does not make sense for us to try and provision an EL we have already
1103              * attained.
1104              */
1105             return 0;
1106 
1107         /*
1108          * Ensure all crypto streams for previous ELs are now empty of available
1109          * data.
1110          */
1111         for (i = QUIC_ENC_LEVEL_INITIAL; i < enc_level; ++i)
1112             if (!crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) {
1113                 /* Protocol violation (RFC 9001 s. 4.1.3) */
1114                 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1115                                                     OSSL_QUIC_FRAME_TYPE_CRYPTO,
1116                                                     "crypto stream data in wrong EL");
1117                 return 0;
1118             }
1119 
1120         if (!ossl_qrx_provide_secret(ch->qrx, enc_level,
1121                                      suite_id, md,
1122                                      secret, secret_len))
1123             return 0;
1124 
1125         ch->have_new_rx_secret = 1;
1126         ch->rx_enc_level = enc_level;
1127     }
1128 
1129     return 1;
1130 }
1131 
ch_on_handshake_complete(void * arg)1132 static int ch_on_handshake_complete(void *arg)
1133 {
1134     QUIC_CHANNEL *ch = arg;
1135 
1136     if (!ossl_assert(!ch->handshake_complete))
1137         return 0; /* this should not happen twice */
1138 
1139     if (!ossl_assert(ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT))
1140         return 0;
1141 
1142     /*
1143      * When handshake is complete, we no longer need to abide by the
1144      * 3x amplification limit, though we should be validated as soon
1145      * as we see a handshake key encrypted packet (see ossl_quic_handle_packet)
1146      */
1147     ossl_quic_tx_packetiser_set_validated(ch->txp);
1148 
1149     if (!ch->got_remote_transport_params) {
1150         /*
1151          * Was not a valid QUIC handshake if we did not get valid transport
1152          * params.
1153          */
1154         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_CRYPTO_MISSING_EXT,
1155                                                OSSL_QUIC_FRAME_TYPE_CRYPTO,
1156                                                "no transport parameters received");
1157         return 0;
1158     }
1159 
1160     /* Don't need transport parameters anymore. */
1161     OPENSSL_free(ch->local_transport_params);
1162     ch->local_transport_params = NULL;
1163 
1164     /* Tell the QRX it can now process 1-RTT packets. */
1165     ossl_qrx_allow_1rtt_processing(ch->qrx);
1166 
1167     /* Tell TXP the handshake is complete. */
1168     ossl_quic_tx_packetiser_notify_handshake_complete(ch->txp);
1169 
1170     ch->handshake_complete = 1;
1171 
1172     if (ch->pending_new_token != NULL) {
1173         /*
1174          * Note this is a best effort operation here
1175          * If scheduling a new token fails, the worst outcome is that
1176          * a client, not having received it, will just have to go through
1177          * an extra roundtrip on a subsequent connection via the retry frame
1178          * path, at which point we get another opportunity to schedule another
1179          * new token.  As a result, we don't need to handle any errors here
1180          */
1181         ossl_quic_channel_schedule_new_token(ch,
1182                                              ch->pending_new_token,
1183                                              ch->pending_new_token_len);
1184         OPENSSL_free(ch->pending_new_token);
1185         ch->pending_new_token = NULL;
1186         ch->pending_new_token_len = 0;
1187     }
1188 
1189     if (ch->is_server) {
1190         /*
1191          * On the server, the handshake is confirmed as soon as it is complete.
1192          */
1193         ossl_quic_channel_on_handshake_confirmed(ch);
1194 
1195         ossl_quic_tx_packetiser_schedule_handshake_done(ch->txp);
1196     }
1197 
1198     ch_record_state_transition(ch, ch->state);
1199     return 1;
1200 }
1201 
ch_on_handshake_alert(void * arg,unsigned char alert_code)1202 static int ch_on_handshake_alert(void *arg, unsigned char alert_code)
1203 {
1204     QUIC_CHANNEL *ch = arg;
1205 
1206     /*
1207      * RFC 9001 s. 4.4: More specifically, servers MUST NOT send post-handshake
1208      * TLS CertificateRequest messages, and clients MUST treat receipt of such
1209      * messages as a connection error of type PROTOCOL_VIOLATION.
1210      */
1211     if (alert_code == SSL_AD_UNEXPECTED_MESSAGE
1212             && ch->handshake_complete
1213             && ossl_quic_tls_is_cert_request(ch->qtls))
1214         ossl_quic_channel_raise_protocol_error(ch,
1215                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1216                                                0,
1217                                                "Post-handshake TLS "
1218                                                "CertificateRequest received");
1219     /*
1220      * RFC 9001 s. 4.6.1: Servers MUST NOT send the early_data extension with a
1221      * max_early_data_size field set to any value other than 0xffffffff. A
1222      * client MUST treat receipt of a NewSessionTicket that contains an
1223      * early_data extension with any other value as a connection error of type
1224      * PROTOCOL_VIOLATION.
1225      */
1226     else if (alert_code == SSL_AD_ILLEGAL_PARAMETER
1227              && ch->handshake_complete
1228              && ossl_quic_tls_has_bad_max_early_data(ch->qtls))
1229         ossl_quic_channel_raise_protocol_error(ch,
1230                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1231                                                0,
1232                                                "Bad max_early_data received");
1233     else
1234         ossl_quic_channel_raise_protocol_error(ch,
1235                                                OSSL_QUIC_ERR_CRYPTO_ERR_BEGIN
1236                                                + alert_code,
1237                                                0, "handshake alert");
1238 
1239     return 1;
1240 }
1241 
1242 /*
1243  * QUIC Channel: Transport Parameter Handling
1244  * ==========================================
1245  */
1246 
1247 /*
1248  * Called by handshake layer when we receive QUIC Transport Parameters from the
1249  * peer. Note that these are not authenticated until the handshake is marked
1250  * as complete.
1251  */
1252 #define TP_REASON_SERVER_ONLY(x) \
1253     x " may not be sent by a client"
1254 #define TP_REASON_DUP(x) \
1255     x " appears multiple times"
1256 #define TP_REASON_MALFORMED(x) \
1257     x " is malformed"
1258 #define TP_REASON_EXPECTED_VALUE(x) \
1259     x " does not match expected value"
1260 #define TP_REASON_NOT_RETRY(x) \
1261     x " sent when not performing a retry"
1262 #define TP_REASON_REQUIRED(x) \
1263     x " was not sent but is required"
1264 #define TP_REASON_INTERNAL_ERROR(x) \
1265     x " encountered internal error"
1266 
txfc_bump_cwm_bidi(QUIC_STREAM * s,void * arg)1267 static void txfc_bump_cwm_bidi(QUIC_STREAM *s, void *arg)
1268 {
1269     if (!ossl_quic_stream_is_bidi(s)
1270         || ossl_quic_stream_is_server_init(s))
1271         return;
1272 
1273     ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg);
1274 }
1275 
txfc_bump_cwm_uni(QUIC_STREAM * s,void * arg)1276 static void txfc_bump_cwm_uni(QUIC_STREAM *s, void *arg)
1277 {
1278     if (ossl_quic_stream_is_bidi(s)
1279         || ossl_quic_stream_is_server_init(s))
1280         return;
1281 
1282     ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg);
1283 }
1284 
do_update(QUIC_STREAM * s,void * arg)1285 static void do_update(QUIC_STREAM *s, void *arg)
1286 {
1287     QUIC_CHANNEL *ch = arg;
1288 
1289     ossl_quic_stream_map_update_state(&ch->qsm, s);
1290 }
1291 
min_u64_ignore_0(uint64_t a,uint64_t b)1292 static uint64_t min_u64_ignore_0(uint64_t a, uint64_t b)
1293 {
1294     if (a == 0)
1295         return b;
1296     if (b == 0)
1297         return a;
1298 
1299     return a < b ? a : b;
1300 }
1301 
ch_on_transport_params(const unsigned char * params,size_t params_len,void * arg)1302 static int ch_on_transport_params(const unsigned char *params,
1303                                   size_t params_len,
1304                                   void *arg)
1305 {
1306     QUIC_CHANNEL *ch = arg;
1307     PACKET pkt;
1308     uint64_t id, v;
1309     size_t len;
1310     const unsigned char *body;
1311     int got_orig_dcid = 0;
1312     int got_initial_scid = 0;
1313     int got_retry_scid = 0;
1314     int got_initial_max_data = 0;
1315     int got_initial_max_stream_data_bidi_local = 0;
1316     int got_initial_max_stream_data_bidi_remote = 0;
1317     int got_initial_max_stream_data_uni = 0;
1318     int got_initial_max_streams_bidi = 0;
1319     int got_initial_max_streams_uni = 0;
1320     int got_stateless_reset_token = 0;
1321     int got_preferred_addr = 0;
1322     int got_ack_delay_exp = 0;
1323     int got_max_ack_delay = 0;
1324     int got_max_udp_payload_size = 0;
1325     int got_max_idle_timeout = 0;
1326     int got_active_conn_id_limit = 0;
1327     int got_disable_active_migration = 0;
1328     QUIC_CONN_ID cid;
1329     const char *reason = "bad transport parameter";
1330     ossl_unused uint64_t rx_max_idle_timeout = 0;
1331     ossl_unused const void *stateless_reset_token_p = NULL;
1332     QUIC_PREFERRED_ADDR pfa;
1333 
1334     if (ch->got_remote_transport_params) {
1335         reason = "multiple transport parameter extensions";
1336         goto malformed;
1337     }
1338 
1339     if (!PACKET_buf_init(&pkt, params, params_len)) {
1340         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
1341                                                "internal error (packet buf init)");
1342         return 0;
1343     }
1344 
1345     while (PACKET_remaining(&pkt) > 0) {
1346         if (!ossl_quic_wire_peek_transport_param(&pkt, &id))
1347             goto malformed;
1348 
1349         switch (id) {
1350         case QUIC_TPARAM_ORIG_DCID:
1351             if (got_orig_dcid) {
1352                 reason = TP_REASON_DUP("ORIG_DCID");
1353                 goto malformed;
1354             }
1355 
1356             if (ch->is_server) {
1357                 reason = TP_REASON_SERVER_ONLY("ORIG_DCID");
1358                 goto malformed;
1359             }
1360 
1361             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1362                 reason = TP_REASON_MALFORMED("ORIG_DCID");
1363                 goto malformed;
1364             }
1365 
1366 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1367             /* Must match our initial DCID. */
1368             if (!ossl_quic_conn_id_eq(&ch->init_dcid, &cid)) {
1369                 reason = TP_REASON_EXPECTED_VALUE("ORIG_DCID");
1370                 goto malformed;
1371             }
1372 #endif
1373 
1374             got_orig_dcid = 1;
1375             break;
1376 
1377         case QUIC_TPARAM_RETRY_SCID:
1378             if (ch->is_server) {
1379                 reason = TP_REASON_SERVER_ONLY("RETRY_SCID");
1380                 goto malformed;
1381             }
1382 
1383             if (got_retry_scid) {
1384                 reason = TP_REASON_DUP("RETRY_SCID");
1385                 goto malformed;
1386             }
1387 
1388             if (!ch->doing_retry) {
1389                 reason = TP_REASON_NOT_RETRY("RETRY_SCID");
1390                 goto malformed;
1391             }
1392 
1393             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1394                 reason = TP_REASON_MALFORMED("RETRY_SCID");
1395                 goto malformed;
1396             }
1397 
1398             /* Must match Retry packet SCID. */
1399             if (!ossl_quic_conn_id_eq(&ch->retry_scid, &cid)) {
1400                 reason = TP_REASON_EXPECTED_VALUE("RETRY_SCID");
1401                 goto malformed;
1402             }
1403 
1404             got_retry_scid = 1;
1405             break;
1406 
1407         case QUIC_TPARAM_INITIAL_SCID:
1408             if (got_initial_scid) {
1409                 /* must not appear more than once */
1410                 reason = TP_REASON_DUP("INITIAL_SCID");
1411                 goto malformed;
1412             }
1413 
1414             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1415                 reason = TP_REASON_MALFORMED("INITIAL_SCID");
1416                 goto malformed;
1417             }
1418 
1419             if (!ossl_quic_conn_id_eq(&ch->init_scid, &cid)) {
1420                 reason = TP_REASON_EXPECTED_VALUE("INITIAL_SCID");
1421                 goto malformed;
1422             }
1423 
1424             got_initial_scid = 1;
1425             break;
1426 
1427         case QUIC_TPARAM_INITIAL_MAX_DATA:
1428             if (got_initial_max_data) {
1429                 /* must not appear more than once */
1430                 reason = TP_REASON_DUP("INITIAL_MAX_DATA");
1431                 goto malformed;
1432             }
1433 
1434             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1435                 reason = TP_REASON_MALFORMED("INITIAL_MAX_DATA");
1436                 goto malformed;
1437             }
1438 
1439             ossl_quic_txfc_bump_cwm(&ch->conn_txfc, v);
1440             got_initial_max_data = 1;
1441             break;
1442 
1443         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL:
1444             if (got_initial_max_stream_data_bidi_local) {
1445                 /* must not appear more than once */
1446                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1447                 goto malformed;
1448             }
1449 
1450             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1451                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1452                 goto malformed;
1453             }
1454 
1455             /*
1456              * This is correct; the BIDI_LOCAL TP governs streams created by
1457              * the endpoint which sends the TP, i.e., our peer.
1458              */
1459             ch->rx_init_max_stream_data_bidi_remote = v;
1460             got_initial_max_stream_data_bidi_local = 1;
1461             break;
1462 
1463         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE:
1464             if (got_initial_max_stream_data_bidi_remote) {
1465                 /* must not appear more than once */
1466                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1467                 goto malformed;
1468             }
1469 
1470             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1471                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1472                 goto malformed;
1473             }
1474 
1475             /*
1476              * This is correct; the BIDI_REMOTE TP governs streams created
1477              * by the endpoint which receives the TP, i.e., us.
1478              */
1479             ch->rx_init_max_stream_data_bidi_local = v;
1480 
1481             /* Apply to all existing streams. */
1482             ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_bidi, &v);
1483             got_initial_max_stream_data_bidi_remote = 1;
1484             break;
1485 
1486         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI:
1487             if (got_initial_max_stream_data_uni) {
1488                 /* must not appear more than once */
1489                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_UNI");
1490                 goto malformed;
1491             }
1492 
1493             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1494                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_UNI");
1495                 goto malformed;
1496             }
1497 
1498             ch->rx_init_max_stream_data_uni = v;
1499 
1500             /* Apply to all existing streams. */
1501             ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_uni, &v);
1502             got_initial_max_stream_data_uni = 1;
1503             break;
1504 
1505         case QUIC_TPARAM_ACK_DELAY_EXP:
1506             if (got_ack_delay_exp) {
1507                 /* must not appear more than once */
1508                 reason = TP_REASON_DUP("ACK_DELAY_EXP");
1509                 goto malformed;
1510             }
1511 
1512             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1513                 || v > QUIC_MAX_ACK_DELAY_EXP) {
1514                 reason = TP_REASON_MALFORMED("ACK_DELAY_EXP");
1515                 goto malformed;
1516             }
1517 
1518             ch->rx_ack_delay_exp = (unsigned char)v;
1519             got_ack_delay_exp = 1;
1520             break;
1521 
1522         case QUIC_TPARAM_MAX_ACK_DELAY:
1523             if (got_max_ack_delay) {
1524                 /* must not appear more than once */
1525                 reason = TP_REASON_DUP("MAX_ACK_DELAY");
1526                 goto malformed;
1527             }
1528 
1529             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1530                 || v >= (((uint64_t)1) << 14)) {
1531                 reason = TP_REASON_MALFORMED("MAX_ACK_DELAY");
1532                 goto malformed;
1533             }
1534 
1535             ch->rx_max_ack_delay = v;
1536             ossl_ackm_set_rx_max_ack_delay(ch->ackm,
1537                                            ossl_ms2time(ch->rx_max_ack_delay));
1538 
1539             got_max_ack_delay = 1;
1540             break;
1541 
1542         case QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI:
1543             if (got_initial_max_streams_bidi) {
1544                 /* must not appear more than once */
1545                 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_BIDI");
1546                 goto malformed;
1547             }
1548 
1549             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1550                 || v > (((uint64_t)1) << 60)) {
1551                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_BIDI");
1552                 goto malformed;
1553             }
1554 
1555             assert(ch->max_local_streams_bidi == 0);
1556             ch->max_local_streams_bidi = v;
1557             got_initial_max_streams_bidi = 1;
1558             break;
1559 
1560         case QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI:
1561             if (got_initial_max_streams_uni) {
1562                 /* must not appear more than once */
1563                 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_UNI");
1564                 goto malformed;
1565             }
1566 
1567             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1568                 || v > (((uint64_t)1) << 60)) {
1569                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_UNI");
1570                 goto malformed;
1571             }
1572 
1573             assert(ch->max_local_streams_uni == 0);
1574             ch->max_local_streams_uni = v;
1575             got_initial_max_streams_uni = 1;
1576             break;
1577 
1578         case QUIC_TPARAM_MAX_IDLE_TIMEOUT:
1579             if (got_max_idle_timeout) {
1580                 /* must not appear more than once */
1581                 reason = TP_REASON_DUP("MAX_IDLE_TIMEOUT");
1582                 goto malformed;
1583             }
1584 
1585             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1586                 reason = TP_REASON_MALFORMED("MAX_IDLE_TIMEOUT");
1587                 goto malformed;
1588             }
1589 
1590             ch->max_idle_timeout_remote_req = v;
1591 
1592             ch->max_idle_timeout = min_u64_ignore_0(ch->max_idle_timeout_local_req,
1593                                                     ch->max_idle_timeout_remote_req);
1594 
1595 
1596             ch_update_idle(ch);
1597             got_max_idle_timeout = 1;
1598             rx_max_idle_timeout = v;
1599             break;
1600 
1601         case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE:
1602             if (got_max_udp_payload_size) {
1603                 /* must not appear more than once */
1604                 reason = TP_REASON_DUP("MAX_UDP_PAYLOAD_SIZE");
1605                 goto malformed;
1606             }
1607 
1608             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1609                 || v < QUIC_MIN_INITIAL_DGRAM_LEN) {
1610                 reason = TP_REASON_MALFORMED("MAX_UDP_PAYLOAD_SIZE");
1611                 goto malformed;
1612             }
1613 
1614             ch->rx_max_udp_payload_size = v;
1615             got_max_udp_payload_size    = 1;
1616             break;
1617 
1618         case QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT:
1619             if (got_active_conn_id_limit) {
1620                 /* must not appear more than once */
1621                 reason = TP_REASON_DUP("ACTIVE_CONN_ID_LIMIT");
1622                 goto malformed;
1623             }
1624 
1625             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1626                 || v < QUIC_MIN_ACTIVE_CONN_ID_LIMIT) {
1627                 reason = TP_REASON_MALFORMED("ACTIVE_CONN_ID_LIMIT");
1628                 goto malformed;
1629             }
1630 
1631             ch->rx_active_conn_id_limit = v;
1632             got_active_conn_id_limit = 1;
1633             break;
1634 
1635         case QUIC_TPARAM_STATELESS_RESET_TOKEN:
1636             if (got_stateless_reset_token) {
1637                 reason = TP_REASON_DUP("STATELESS_RESET_TOKEN");
1638                 goto malformed;
1639             }
1640 
1641             /*
1642              * RFC 9000 s. 18.2: This transport parameter MUST NOT be sent
1643              * by a client but MAY be sent by a server.
1644              */
1645             if (ch->is_server) {
1646                 reason = TP_REASON_SERVER_ONLY("STATELESS_RESET_TOKEN");
1647                 goto malformed;
1648             }
1649 
1650             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len);
1651             if (body == NULL || len != QUIC_STATELESS_RESET_TOKEN_LEN) {
1652                 reason = TP_REASON_MALFORMED("STATELESS_RESET_TOKEN");
1653                 goto malformed;
1654             }
1655             if (!ossl_quic_srtm_add(ch->srtm, ch, ch->cur_remote_seq_num,
1656                                     (const QUIC_STATELESS_RESET_TOKEN *)body)) {
1657                 reason = TP_REASON_INTERNAL_ERROR("STATELESS_RESET_TOKEN");
1658                 goto malformed;
1659             }
1660 
1661             stateless_reset_token_p     = body;
1662             got_stateless_reset_token   = 1;
1663             break;
1664 
1665         case QUIC_TPARAM_PREFERRED_ADDR:
1666             /* TODO(QUIC FUTURE): Handle preferred address. */
1667             if (got_preferred_addr) {
1668                 reason = TP_REASON_DUP("PREFERRED_ADDR");
1669                 goto malformed;
1670             }
1671 
1672             /*
1673              * RFC 9000 s. 18.2: "A server that chooses a zero-length
1674              * connection ID MUST NOT provide a preferred address.
1675              * Similarly, a server MUST NOT include a zero-length connection
1676              * ID in this transport parameter. A client MUST treat a
1677              * violation of these requirements as a connection error of type
1678              * TRANSPORT_PARAMETER_ERROR."
1679              */
1680             if (ch->is_server) {
1681                 reason = TP_REASON_SERVER_ONLY("PREFERRED_ADDR");
1682                 goto malformed;
1683             }
1684 
1685             if (ch->cur_remote_dcid.id_len == 0) {
1686                 reason = "PREFERRED_ADDR provided for zero-length CID";
1687                 goto malformed;
1688             }
1689 
1690             if (!ossl_quic_wire_decode_transport_param_preferred_addr(&pkt, &pfa)) {
1691                 reason = TP_REASON_MALFORMED("PREFERRED_ADDR");
1692                 goto malformed;
1693             }
1694 
1695             if (pfa.cid.id_len == 0) {
1696                 reason = "zero-length CID in PREFERRED_ADDR";
1697                 goto malformed;
1698             }
1699 
1700             got_preferred_addr = 1;
1701             break;
1702 
1703         case QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION:
1704             /* We do not currently handle migration, so nothing to do. */
1705             if (got_disable_active_migration) {
1706                 /* must not appear more than once */
1707                 reason = TP_REASON_DUP("DISABLE_ACTIVE_MIGRATION");
1708                 goto malformed;
1709             }
1710 
1711             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len);
1712             if (body == NULL || len > 0) {
1713                 reason = TP_REASON_MALFORMED("DISABLE_ACTIVE_MIGRATION");
1714                 goto malformed;
1715             }
1716 
1717             got_disable_active_migration = 1;
1718             break;
1719 
1720         default:
1721             /*
1722              * Skip over and ignore.
1723              *
1724              * RFC 9000 s. 7.4: We SHOULD treat duplicated transport parameters
1725              * as a connection error, but we are not required to. Currently,
1726              * handle this programmatically by checking for duplicates in the
1727              * parameters that we recognise, as above, but don't bother
1728              * maintaining a list of duplicates for anything we don't recognise.
1729              */
1730             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id,
1731                                                                &len);
1732             if (body == NULL)
1733                 goto malformed;
1734 
1735             break;
1736         }
1737     }
1738 
1739     if (!got_initial_scid) {
1740         reason = TP_REASON_REQUIRED("INITIAL_SCID");
1741         goto malformed;
1742     }
1743 
1744     if (!ch->is_server) {
1745         if (!got_orig_dcid) {
1746             reason = TP_REASON_REQUIRED("ORIG_DCID");
1747             goto malformed;
1748         }
1749 
1750         if (ch->doing_retry && !got_retry_scid) {
1751             reason = TP_REASON_REQUIRED("RETRY_SCID");
1752             goto malformed;
1753         }
1754     }
1755 
1756     ch->got_remote_transport_params = 1;
1757 
1758 #ifndef OPENSSL_NO_QLOG
1759     QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
1760         QLOG_STR("owner", "remote");
1761 
1762         if (got_orig_dcid)
1763             QLOG_CID("original_destination_connection_id",
1764                      &ch->init_dcid);
1765         if (got_initial_scid)
1766             QLOG_CID("original_source_connection_id",
1767                      &ch->init_dcid);
1768         if (got_retry_scid)
1769             QLOG_CID("retry_source_connection_id",
1770                      &ch->retry_scid);
1771         if (got_initial_max_data)
1772             QLOG_U64("initial_max_data",
1773                      ossl_quic_txfc_get_cwm(&ch->conn_txfc));
1774         if (got_initial_max_stream_data_bidi_local)
1775             QLOG_U64("initial_max_stream_data_bidi_local",
1776                      ch->rx_init_max_stream_data_bidi_local);
1777         if (got_initial_max_stream_data_bidi_remote)
1778             QLOG_U64("initial_max_stream_data_bidi_remote",
1779                      ch->rx_init_max_stream_data_bidi_remote);
1780         if (got_initial_max_stream_data_uni)
1781             QLOG_U64("initial_max_stream_data_uni",
1782                      ch->rx_init_max_stream_data_uni);
1783         if (got_initial_max_streams_bidi)
1784             QLOG_U64("initial_max_streams_bidi",
1785                      ch->max_local_streams_bidi);
1786         if (got_initial_max_streams_uni)
1787             QLOG_U64("initial_max_streams_uni",
1788                      ch->max_local_streams_uni);
1789         if (got_ack_delay_exp)
1790             QLOG_U64("ack_delay_exponent", ch->rx_ack_delay_exp);
1791         if (got_max_ack_delay)
1792             QLOG_U64("max_ack_delay", ch->rx_max_ack_delay);
1793         if (got_max_udp_payload_size)
1794             QLOG_U64("max_udp_payload_size", ch->rx_max_udp_payload_size);
1795         if (got_max_idle_timeout)
1796             QLOG_U64("max_idle_timeout", rx_max_idle_timeout);
1797         if (got_active_conn_id_limit)
1798             QLOG_U64("active_connection_id_limit", ch->rx_active_conn_id_limit);
1799         if (got_stateless_reset_token)
1800             QLOG_BIN("stateless_reset_token", stateless_reset_token_p,
1801                      QUIC_STATELESS_RESET_TOKEN_LEN);
1802         if (got_preferred_addr) {
1803             QLOG_BEGIN("preferred_addr")
1804                 QLOG_U64("port_v4", pfa.ipv4_port);
1805                 QLOG_U64("port_v6", pfa.ipv6_port);
1806                 QLOG_BIN("ip_v4", pfa.ipv4, sizeof(pfa.ipv4));
1807                 QLOG_BIN("ip_v6", pfa.ipv6, sizeof(pfa.ipv6));
1808                 QLOG_BIN("stateless_reset_token", pfa.stateless_reset.token,
1809                          sizeof(pfa.stateless_reset.token));
1810                 QLOG_CID("connection_id", &pfa.cid);
1811             QLOG_END()
1812         }
1813         QLOG_BOOL("disable_active_migration", got_disable_active_migration);
1814     QLOG_EVENT_END()
1815 #endif
1816 
1817     if (got_initial_max_data || got_initial_max_stream_data_bidi_remote
1818         || got_initial_max_streams_bidi || got_initial_max_streams_uni)
1819         /*
1820          * If FC credit was bumped, we may now be able to send. Update all
1821          * streams.
1822          */
1823         ossl_quic_stream_map_visit(&ch->qsm, do_update, ch);
1824 
1825     /* If we are a server, we now generate our own transport parameters. */
1826     if (ch->is_server && !ch_generate_transport_params(ch)) {
1827         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
1828                                                "internal error");
1829         return 0;
1830     }
1831 
1832     return 1;
1833 
1834 malformed:
1835     ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_TRANSPORT_PARAMETER_ERROR,
1836                                            0, reason);
1837     return 0;
1838 }
1839 
1840 /*
1841  * Called when we want to generate transport parameters. This is called
1842  * immediately at instantiation time for a client and after we receive the
1843  * client's transport parameters for a server.
1844  */
ch_generate_transport_params(QUIC_CHANNEL * ch)1845 static int ch_generate_transport_params(QUIC_CHANNEL *ch)
1846 {
1847     int ok = 0;
1848     BUF_MEM *buf_mem = NULL;
1849     WPACKET wpkt;
1850     int wpkt_valid = 0;
1851     size_t buf_len = 0;
1852     QUIC_CONN_ID *id_to_use = NULL;
1853 
1854     /*
1855      * We need to select which connection id to encode in the
1856      * QUIC_TPARAM_ORIG_DCID transport parameter
1857      * If we have an odcid, then this connection was established
1858      * in response to a retry request, and we need to use the connection
1859      * id sent in the first initial packet.
1860      * If we don't have an odcid, then this connection was established
1861      * without a retry and the init_dcid is the connection we should use
1862      */
1863     if (ch->odcid.id_len == 0)
1864         id_to_use = &ch->init_dcid;
1865     else
1866         id_to_use = &ch->odcid;
1867 
1868     if (ch->local_transport_params != NULL || ch->got_local_transport_params)
1869         goto err;
1870 
1871     if ((buf_mem = BUF_MEM_new()) == NULL)
1872         goto err;
1873 
1874     if (!WPACKET_init(&wpkt, buf_mem))
1875         goto err;
1876 
1877     wpkt_valid = 1;
1878 
1879     if (ossl_quic_wire_encode_transport_param_bytes(&wpkt, QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION,
1880                                                     NULL, 0) == NULL)
1881         goto err;
1882 
1883     if (ch->is_server) {
1884         if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_ORIG_DCID,
1885                                                        id_to_use))
1886             goto err;
1887 
1888         if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_INITIAL_SCID,
1889                                                        &ch->cur_local_cid))
1890             goto err;
1891         if (ch->odcid.id_len != 0)
1892             if (!ossl_quic_wire_encode_transport_param_cid(&wpkt,
1893                                                            QUIC_TPARAM_RETRY_SCID,
1894                                                            &ch->init_dcid))
1895                 goto err;
1896     } else {
1897         if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_INITIAL_SCID,
1898                                                        &ch->init_scid))
1899             goto err;
1900     }
1901 
1902     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_IDLE_TIMEOUT,
1903                                                    ch->max_idle_timeout_local_req))
1904         goto err;
1905 
1906     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE,
1907                                                    QUIC_MIN_INITIAL_DGRAM_LEN))
1908         goto err;
1909 
1910     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT,
1911                                                    QUIC_MIN_ACTIVE_CONN_ID_LIMIT))
1912         goto err;
1913 
1914     if (ch->tx_max_ack_delay != QUIC_DEFAULT_MAX_ACK_DELAY
1915         && !ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_ACK_DELAY,
1916                                                       ch->tx_max_ack_delay))
1917         goto err;
1918 
1919     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_DATA,
1920                                                    ossl_quic_rxfc_get_cwm(&ch->conn_rxfc)))
1921         goto err;
1922 
1923     /* Send the default CWM for a new RXFC. */
1924     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL,
1925                                                    ch->tx_init_max_stream_data_bidi_local))
1926         goto err;
1927 
1928     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE,
1929                                                    ch->tx_init_max_stream_data_bidi_remote))
1930         goto err;
1931 
1932     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI,
1933                                                    ch->tx_init_max_stream_data_uni))
1934         goto err;
1935 
1936     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI,
1937                                                    ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc)))
1938         goto err;
1939 
1940     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI,
1941                                                    ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc)))
1942         goto err;
1943 
1944     if (!WPACKET_finish(&wpkt))
1945         goto err;
1946 
1947     wpkt_valid = 0;
1948 
1949     if (!WPACKET_get_total_written(&wpkt, &buf_len))
1950         goto err;
1951 
1952     ch->local_transport_params = (unsigned char *)buf_mem->data;
1953     buf_mem->data = NULL;
1954 
1955     if (!ossl_quic_tls_set_transport_params(ch->qtls, ch->local_transport_params,
1956                                             buf_len))
1957         goto err;
1958 
1959 #ifndef OPENSSL_NO_QLOG
1960     QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
1961         QLOG_STR("owner", "local");
1962         QLOG_BOOL("disable_active_migration", 1);
1963         if (ch->is_server) {
1964             QLOG_CID("original_destination_connection_id", &ch->init_dcid);
1965             QLOG_CID("initial_source_connection_id", &ch->cur_local_cid);
1966         } else {
1967             QLOG_STR("initial_source_connection_id", "");
1968         }
1969         QLOG_U64("max_idle_timeout", ch->max_idle_timeout);
1970         QLOG_U64("max_udp_payload_size", QUIC_MIN_INITIAL_DGRAM_LEN);
1971         QLOG_U64("active_connection_id_limit", QUIC_MIN_ACTIVE_CONN_ID_LIMIT);
1972         QLOG_U64("max_ack_delay", ch->tx_max_ack_delay);
1973         QLOG_U64("initial_max_data", ossl_quic_rxfc_get_cwm(&ch->conn_rxfc));
1974         QLOG_U64("initial_max_stream_data_bidi_local",
1975                  ch->tx_init_max_stream_data_bidi_local);
1976         QLOG_U64("initial_max_stream_data_bidi_remote",
1977                  ch->tx_init_max_stream_data_bidi_remote);
1978         QLOG_U64("initial_max_stream_data_uni",
1979                  ch->tx_init_max_stream_data_uni);
1980         QLOG_U64("initial_max_streams_bidi",
1981                  ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc));
1982         QLOG_U64("initial_max_streams_uni",
1983                  ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc));
1984     QLOG_EVENT_END()
1985 #endif
1986 
1987     ch->got_local_transport_params = 1;
1988 
1989     ok = 1;
1990 err:
1991     if (wpkt_valid)
1992         WPACKET_cleanup(&wpkt);
1993     BUF_MEM_free(buf_mem);
1994     return ok;
1995 }
1996 
1997 /*
1998  * QUIC Channel: Ticker-Mutator
1999  * ============================
2000  */
2001 
2002 /*
2003  * The central ticker function called by the reactor. This does everything, or
2004  * at least everything network I/O related. Best effort - not allowed to fail
2005  * "loudly".
2006  */
ossl_quic_channel_subtick(QUIC_CHANNEL * ch,QUIC_TICK_RESULT * res,uint32_t flags)2007 void ossl_quic_channel_subtick(QUIC_CHANNEL *ch, QUIC_TICK_RESULT *res,
2008                                uint32_t flags)
2009 {
2010     OSSL_TIME now, deadline;
2011     int channel_only = (flags & QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY) != 0;
2012     int notify_other_threads = 0;
2013 
2014     /*
2015      * When we tick the QUIC connection, we do everything we need to do
2016      * periodically. Network I/O handling will already have been performed
2017      * as necessary by the QUIC port. Thus, in order, we:
2018      *
2019      *   - handle any packets the DEMUX has queued up for us;
2020      *   - handle any timer events which are due to fire (ACKM, etc.);
2021      *   - generate any packets which need to be sent;
2022      *   - determine the time at which we should next be ticked.
2023      */
2024 
2025     /*
2026      * If the connection has not yet started, or we are in the TERMINATED state,
2027      * there is nothing to do.
2028      */
2029     if (ch->state == QUIC_CHANNEL_STATE_IDLE
2030             || ossl_quic_channel_is_terminated(ch)) {
2031         res->net_read_desired       = 0;
2032         res->net_write_desired      = 0;
2033         res->notify_other_threads   = 0;
2034         res->tick_deadline          = ossl_time_infinite();
2035         return;
2036     }
2037 
2038     /*
2039      * If we are in the TERMINATING state, check if the terminating timer has
2040      * expired.
2041      */
2042     if (ossl_quic_channel_is_terminating(ch)) {
2043         now = get_time(ch);
2044 
2045         if (ossl_time_compare(now, ch->terminate_deadline) >= 0) {
2046             ch_on_terminating_timeout(ch);
2047             res->net_read_desired       = 0;
2048             res->net_write_desired      = 0;
2049             res->notify_other_threads   = 1;
2050             res->tick_deadline          = ossl_time_infinite();
2051             return; /* abort normal processing, nothing to do */
2052         }
2053     }
2054 
2055     if (!ch->port->engine->inhibit_tick) {
2056         /* Handle RXKU timeouts. */
2057         ch_rxku_tick(ch);
2058 
2059         do {
2060             /* Process queued incoming packets. */
2061             ch->did_tls_tick        = 0;
2062             ch->have_new_rx_secret  = 0;
2063             ch_rx(ch, channel_only, &notify_other_threads);
2064 
2065             /*
2066              * Allow the handshake layer to check for any new incoming data and
2067              * generate new outgoing data.
2068              */
2069             if (!ch->did_tls_tick)
2070                 ch_tick_tls(ch, channel_only, &notify_other_threads);
2071 
2072             /*
2073              * If the handshake layer gave us a new secret, we need to do RX
2074              * again because packets that were not previously processable and
2075              * were deferred might now be processable.
2076              *
2077              * TODO(QUIC FUTURE): Consider handling this in the yield_secret callback.
2078              */
2079         } while (ch->have_new_rx_secret);
2080     }
2081 
2082     /*
2083      * Handle any timer events which are due to fire; namely, the loss
2084      * detection deadline and the idle timeout.
2085      *
2086      * ACKM ACK generation deadline is polled by TXP, so we don't need to
2087      * handle it here.
2088      */
2089     now = get_time(ch);
2090     if (ossl_time_compare(now, ch->idle_deadline) >= 0) {
2091         /*
2092          * Idle timeout differs from normal protocol violation because we do
2093          * not send a CONN_CLOSE frame; go straight to TERMINATED.
2094          */
2095         if (!ch->port->engine->inhibit_tick)
2096             ch_on_idle_timeout(ch);
2097 
2098         res->net_read_desired       = 0;
2099         res->net_write_desired      = 0;
2100         res->notify_other_threads   = 1;
2101         res->tick_deadline          = ossl_time_infinite();
2102         return;
2103     }
2104 
2105     if (!ch->port->engine->inhibit_tick) {
2106         deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
2107         if (!ossl_time_is_zero(deadline)
2108             && ossl_time_compare(now, deadline) >= 0)
2109             ossl_ackm_on_timeout(ch->ackm);
2110 
2111         /* If a ping is due, inform TXP. */
2112         if (ossl_time_compare(now, ch->ping_deadline) >= 0) {
2113             int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
2114 
2115             ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
2116 
2117             /*
2118              * If we have no CC budget at this time we cannot process the above
2119              * PING request immediately. In any case we have scheduled the
2120              * request so bump the ping deadline. If we don't do this we will
2121              * busy-loop endlessly as the above deadline comparison condition
2122              * will still be met.
2123              */
2124             ch_update_ping_deadline(ch);
2125         }
2126 
2127         /* Queue any data to be sent for transmission. */
2128         ch_tx(ch, &notify_other_threads);
2129 
2130         /* Do stream GC. */
2131         ossl_quic_stream_map_gc(&ch->qsm);
2132     }
2133 
2134     /* Determine the time at which we should next be ticked. */
2135     res->tick_deadline = ch_determine_next_tick_deadline(ch);
2136 
2137     /*
2138      * Always process network input unless we are now terminated. Although we
2139      * had not terminated at the beginning of this tick, network errors in
2140      * ch_tx() may have caused us to transition to the Terminated state.
2141      */
2142     res->net_read_desired = !ossl_quic_channel_is_terminated(ch);
2143 
2144     /* We want to write to the network if we have any data in our TX queue. */
2145     res->net_write_desired
2146         = (!ossl_quic_channel_is_terminated(ch)
2147            && ossl_qtx_get_queue_len_datagrams(ch->qtx) > 0);
2148 
2149     res->notify_other_threads = notify_other_threads;
2150 }
2151 
ch_tick_tls(QUIC_CHANNEL * ch,int channel_only,int * notify_other_threads)2152 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only, int *notify_other_threads)
2153 {
2154     uint64_t error_code;
2155     const char *error_msg;
2156     ERR_STATE *error_state = NULL;
2157 
2158     if (channel_only)
2159         return 1;
2160 
2161     ch->did_tls_tick = 1;
2162     ossl_quic_tls_tick(ch->qtls);
2163 
2164     if (ossl_quic_tls_get_error(ch->qtls, &error_code, &error_msg,
2165                                 &error_state)) {
2166         ossl_quic_channel_raise_protocol_error_state(ch, error_code, 0,
2167                                                      error_msg, error_state);
2168         if (notify_other_threads != NULL)
2169             *notify_other_threads = 1;
2170 
2171         return 0;
2172     }
2173 
2174     return 1;
2175 }
2176 
2177 /* Check incoming forged packet limit and terminate connection if needed. */
ch_rx_check_forged_pkt_limit(QUIC_CHANNEL * ch)2178 static void ch_rx_check_forged_pkt_limit(QUIC_CHANNEL *ch)
2179 {
2180     uint32_t enc_level;
2181     uint64_t limit = UINT64_MAX, l;
2182 
2183     for (enc_level = QUIC_ENC_LEVEL_INITIAL;
2184          enc_level < QUIC_ENC_LEVEL_NUM;
2185          ++enc_level)
2186     {
2187         /*
2188          * Different ELs can have different AEADs which can in turn impose
2189          * different limits, so use the lowest value of any currently valid EL.
2190          */
2191         if ((ch->el_discarded & (1U << enc_level)) != 0)
2192             continue;
2193 
2194         if (enc_level > ch->rx_enc_level)
2195             break;
2196 
2197         l = ossl_qrx_get_max_forged_pkt_count(ch->qrx, enc_level);
2198         if (l < limit)
2199             limit = l;
2200     }
2201 
2202     if (ossl_qrx_get_cur_forged_pkt_count(ch->qrx) < limit)
2203         return;
2204 
2205     ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_AEAD_LIMIT_REACHED, 0,
2206                                            "forgery limit");
2207 }
2208 
2209 /* Process queued incoming packets and handle frames, if any. */
ch_rx(QUIC_CHANNEL * ch,int channel_only,int * notify_other_threads)2210 static int ch_rx(QUIC_CHANNEL *ch, int channel_only, int *notify_other_threads)
2211 {
2212     int handled_any = 0;
2213     const int closing = ossl_quic_channel_is_closing(ch);
2214 
2215     if (!ch->is_server && !ch->have_sent_any_pkt)
2216         /*
2217          * We have not sent anything yet, therefore there is no need to check
2218          * for incoming data.
2219          */
2220         return 1;
2221 
2222     for (;;) {
2223         assert(ch->qrx_pkt == NULL);
2224 
2225         if (!ossl_qrx_read_pkt(ch->qrx, &ch->qrx_pkt))
2226             break;
2227 
2228         /* Track the amount of data received while in the closing state */
2229         if (closing)
2230             ossl_quic_tx_packetiser_record_received_closing_bytes(
2231                     ch->txp, ch->qrx_pkt->hdr->len);
2232 
2233         if (!handled_any) {
2234             ch_update_idle(ch);
2235             ch_update_ping_deadline(ch);
2236         }
2237 
2238         ch_rx_handle_packet(ch, channel_only); /* best effort */
2239 
2240         /*
2241          * Regardless of the outcome of frame handling, unref the packet.
2242          * This will free the packet unless something added another
2243          * reference to it during frame processing.
2244          */
2245         ossl_qrx_pkt_release(ch->qrx_pkt);
2246         ch->qrx_pkt = NULL;
2247 
2248         ch->have_sent_ack_eliciting_since_rx = 0;
2249         handled_any = 1;
2250     }
2251 
2252     ch_rx_check_forged_pkt_limit(ch);
2253 
2254     if (handled_any && notify_other_threads != NULL)
2255         *notify_other_threads = 1;
2256 
2257     /*
2258      * When in TERMINATING - CLOSING, generate a CONN_CLOSE frame whenever we
2259      * process one or more incoming packets.
2260      */
2261     if (handled_any && closing)
2262         ch->conn_close_queued = 1;
2263 
2264     return 1;
2265 }
2266 
bio_addr_eq(const BIO_ADDR * a,const BIO_ADDR * b)2267 static int bio_addr_eq(const BIO_ADDR *a, const BIO_ADDR *b)
2268 {
2269     if (BIO_ADDR_family(a) != BIO_ADDR_family(b))
2270         return 0;
2271 
2272     switch (BIO_ADDR_family(a)) {
2273         case AF_INET:
2274             return !memcmp(&a->s_in.sin_addr,
2275                            &b->s_in.sin_addr,
2276                            sizeof(a->s_in.sin_addr))
2277                 && a->s_in.sin_port == b->s_in.sin_port;
2278 #if OPENSSL_USE_IPV6
2279         case AF_INET6:
2280             return !memcmp(&a->s_in6.sin6_addr,
2281                            &b->s_in6.sin6_addr,
2282                            sizeof(a->s_in6.sin6_addr))
2283                 && a->s_in6.sin6_port == b->s_in6.sin6_port;
2284 #endif
2285         default:
2286             return 0; /* not supported */
2287     }
2288 
2289     return 1;
2290 }
2291 
2292 /* Handles the packet currently in ch->qrx_pkt->hdr. */
ch_rx_handle_packet(QUIC_CHANNEL * ch,int channel_only)2293 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only)
2294 {
2295     uint32_t enc_level;
2296     int old_have_processed_any_pkt = ch->have_processed_any_pkt;
2297     OSSL_QTX_IOVEC iovec;
2298     PACKET vpkt;
2299     unsigned long supported_ver;
2300 
2301     assert(ch->qrx_pkt != NULL);
2302 
2303     /*
2304      * RFC 9000 s. 10.2.1 Closing Connection State:
2305      *      An endpoint that is closing is not required to process any
2306      *      received frame.
2307      */
2308     if (!ossl_quic_channel_is_active(ch))
2309         return;
2310 
2311     if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)) {
2312         if (!ch->have_received_enc_pkt) {
2313             ch->cur_remote_dcid = ch->init_scid = ch->qrx_pkt->hdr->src_conn_id;
2314             ch->have_received_enc_pkt = 1;
2315 
2316             /*
2317              * We change to using the SCID in the first Initial packet as the
2318              * DCID.
2319              */
2320             ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->init_scid);
2321         }
2322 
2323         enc_level = ossl_quic_pkt_type_to_enc_level(ch->qrx_pkt->hdr->type);
2324         if ((ch->el_discarded & (1U << enc_level)) != 0)
2325             /* Do not process packets from ELs we have already discarded. */
2326             return;
2327     }
2328 
2329     /*
2330      * RFC 9000 s. 9.6: "If a client receives packets from a new server address
2331      * when the client has not initiated a migration to that address, the client
2332      * SHOULD discard these packets."
2333      *
2334      * We need to be a bit careful here as due to the BIO abstraction layer an
2335      * application is liable to be weird and lie to us about peer addresses.
2336      * Only apply this check if we actually are using a real AF_INET or AF_INET6
2337      * address.
2338      */
2339     if (!ch->is_server
2340         && ch->qrx_pkt->peer != NULL
2341         && (
2342                BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET
2343 #if OPENSSL_USE_IPV6
2344             || BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET6
2345 #endif
2346         )
2347         && !bio_addr_eq(ch->qrx_pkt->peer, &ch->cur_peer_addr))
2348         return;
2349 
2350     if (!ch->is_server
2351         && ch->have_received_enc_pkt
2352         && ossl_quic_pkt_type_has_scid(ch->qrx_pkt->hdr->type)) {
2353         /*
2354          * RFC 9000 s. 7.2: "Once a client has received a valid Initial packet
2355          * from the server, it MUST discard any subsequent packet it receives on
2356          * that connection with a different SCID."
2357          */
2358         if (!ossl_quic_conn_id_eq(&ch->qrx_pkt->hdr->src_conn_id,
2359                                   &ch->init_scid))
2360             return;
2361     }
2362 
2363     if (ossl_quic_pkt_type_has_version(ch->qrx_pkt->hdr->type)
2364         && ch->qrx_pkt->hdr->version != QUIC_VERSION_1)
2365         /*
2366          * RFC 9000 s. 5.2.1: If a client receives a packet that uses a
2367          * different version than it initially selected, it MUST discard the
2368          * packet. We only ever use v1, so require it.
2369          */
2370         return;
2371 
2372     if (ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_VERSION_NEG) {
2373 
2374         /*
2375          * Sanity check.  Version negotiation packet MUST have a version
2376          * value of 0 according to the RFC.  We must discard such packets
2377          */
2378         if (ch->qrx_pkt->hdr->version != 0)
2379             return;
2380 
2381         /*
2382          * RFC 9000 s. 6.2: If a client receives a version negotiation
2383          * packet, we need to do the following:
2384          * a) If the negotiation packet lists the version we initially sent
2385          *    then we must abandon this connection attempt
2386          * b) We have to select a version from the list provided in the
2387          *    version negotiation packet, and retry the connection attempt
2388          *    in much the same way that ch_retry does, but we can reuse the
2389          *    connection id values
2390          */
2391 
2392         if (old_have_processed_any_pkt == 1) {
2393             /*
2394              * We've gotten previous packets, need to discard this.
2395              */
2396             return;
2397         }
2398 
2399         /*
2400          * Indicate that we have processed a packet, as any subsequently
2401          * received version negotiation packet must be discarded above
2402          */
2403         ch->have_processed_any_pkt = 1;
2404 
2405         /*
2406          * Following the header, version negotiation packets
2407          * contain an array of 32 bit integers representing
2408          * the supported versions that the server honors
2409          * this array, bounded by the hdr->len field
2410          * needs to be traversed so that we can find a matching
2411          * version
2412          */
2413         if (!PACKET_buf_init(&vpkt, ch->qrx_pkt->hdr->data,
2414                              ch->qrx_pkt->hdr->len))
2415             return;
2416 
2417         while (PACKET_remaining(&vpkt) > 0) {
2418             /*
2419              * We only support quic version 1 at the moment, so
2420              * look to see if thats offered
2421              */
2422             if (!PACKET_get_net_4(&vpkt, &supported_ver))
2423                 return;
2424 
2425             supported_ver = ntohl(supported_ver);
2426             if (supported_ver == QUIC_VERSION_1) {
2427                 /*
2428                  * If the server supports version 1, set it as
2429                  * the packetisers version
2430                  */
2431                 ossl_quic_tx_packetiser_set_protocol_version(ch->txp, QUIC_VERSION_1);
2432 
2433                 /*
2434                  * And then request a restart of the QUIC connection
2435                  */
2436                 if (!ch_restart(ch))
2437                     ossl_quic_channel_raise_protocol_error(ch,
2438                                                            OSSL_QUIC_ERR_INTERNAL_ERROR,
2439                                                            0, "handling ver negotiation packet");
2440                 return;
2441             }
2442         }
2443 
2444         /*
2445          * If we get here, then the server doesn't support a version of the
2446          * protocol that we can handle, abandon the connection
2447          */
2448         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_CONNECTION_REFUSED,
2449                                                0, "unsupported protocol version");
2450         return;
2451     }
2452 
2453     ch->have_processed_any_pkt = 1;
2454 
2455     /*
2456      * RFC 9000 s. 17.2: "An endpoint MUST treat receipt of a packet that has a
2457      * non-zero value for [the reserved bits] after removing both packet and
2458      * header protection as a connection error of type PROTOCOL_VIOLATION."
2459      */
2460     if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)
2461         && ch->qrx_pkt->hdr->reserved != 0) {
2462         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2463                                                0, "packet header reserved bits");
2464         return;
2465     }
2466 
2467     iovec.buf       = ch->qrx_pkt->hdr->data;
2468     iovec.buf_len   = ch->qrx_pkt->hdr->len;
2469     ossl_qlog_event_transport_packet_received(ch_get_qlog(ch), ch->qrx_pkt->hdr,
2470                                               ch->qrx_pkt->pn, &iovec, 1,
2471                                               ch->qrx_pkt->datagram_id);
2472 
2473     /* Handle incoming packet. */
2474     switch (ch->qrx_pkt->hdr->type) {
2475     case QUIC_PKT_TYPE_RETRY:
2476         if (ch->doing_retry || ch->is_server)
2477             /*
2478              * It is not allowed to ask a client to do a retry more than
2479              * once. Clients may not send retries.
2480              */
2481             return;
2482 
2483         /*
2484          * RFC 9000 s 17.2.5.2: After the client has received and processed an
2485          * Initial or Retry packet from the server, it MUST discard any
2486          * subsequent Retry packets that it receives.
2487          */
2488         if (ch->have_received_enc_pkt)
2489             return;
2490 
2491         if (ch->qrx_pkt->hdr->len <= QUIC_RETRY_INTEGRITY_TAG_LEN)
2492             /* Packets with zero-length Retry Tokens are invalid. */
2493             return;
2494 
2495         /*
2496          * TODO(QUIC FUTURE): Theoretically this should probably be in the QRX.
2497          * However because validation is dependent on context (namely the
2498          * client's initial DCID) we can't do this cleanly. In the future we
2499          * should probably add a callback to the QRX to let it call us (via
2500          * the DEMUX) and ask us about the correct original DCID, rather
2501          * than allow the QRX to emit a potentially malformed packet to the
2502          * upper layers. However, special casing this will do for now.
2503          */
2504         if (!ossl_quic_validate_retry_integrity_tag(ch->port->engine->libctx,
2505                                                     ch->port->engine->propq,
2506                                                     ch->qrx_pkt->hdr,
2507                                                     &ch->init_dcid))
2508             /* Malformed retry packet, ignore. */
2509             return;
2510 
2511         if (!ch_retry(ch, ch->qrx_pkt->hdr->data,
2512                       ch->qrx_pkt->hdr->len - QUIC_RETRY_INTEGRITY_TAG_LEN,
2513                       &ch->qrx_pkt->hdr->src_conn_id, old_have_processed_any_pkt))
2514             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR,
2515                                                    0, "handling retry packet");
2516         break;
2517 
2518     case QUIC_PKT_TYPE_0RTT:
2519         if (!ch->is_server)
2520             /* Clients should never receive 0-RTT packets. */
2521             return;
2522 
2523         /*
2524          * TODO(QUIC 0RTT): Implement 0-RTT on the server side. We currently
2525          * do not need to implement this as a client can only do 0-RTT if we
2526          * have given it permission to in a previous session.
2527          */
2528         break;
2529 
2530     case QUIC_PKT_TYPE_INITIAL:
2531     case QUIC_PKT_TYPE_HANDSHAKE:
2532     case QUIC_PKT_TYPE_1RTT:
2533         if (ch->is_server && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_HANDSHAKE)
2534             /*
2535              * We automatically drop INITIAL EL keys when first successfully
2536              * decrypting a HANDSHAKE packet, as per the RFC.
2537              */
2538             ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
2539 
2540         if (ch->rxku_in_progress
2541             && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_1RTT
2542             && ch->qrx_pkt->pn >= ch->rxku_trigger_pn
2543             && ch->qrx_pkt->key_epoch < ossl_qrx_get_key_epoch(ch->qrx)) {
2544             /*
2545              * RFC 9001 s. 6.4: Packets with higher packet numbers MUST be
2546              * protected with either the same or newer packet protection keys
2547              * than packets with lower packet numbers. An endpoint that
2548              * successfully removes protection with old keys when newer keys
2549              * were used for packets with lower packet numbers MUST treat this
2550              * as a connection error of type KEY_UPDATE_ERROR.
2551              */
2552             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR,
2553                                                    0, "new packet with old keys");
2554             break;
2555         }
2556 
2557         if (!ch->is_server
2558             && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_INITIAL
2559             && ch->qrx_pkt->hdr->token_len > 0) {
2560             /*
2561              * RFC 9000 s. 17.2.2: Clients that receive an Initial packet with a
2562              * non-zero Token Length field MUST either discard the packet or
2563              * generate a connection error of type PROTOCOL_VIOLATION.
2564              *
2565              * TODO(QUIC FUTURE): consider the implications of RFC 9000 s. 10.2.3
2566              * Immediate Close during the Handshake:
2567              *      However, at the cost of reducing feedback about
2568              *      errors for legitimate peers, some forms of denial of
2569              *      service can be made more difficult for an attacker
2570              *      if endpoints discard illegal packets rather than
2571              *      terminating a connection with CONNECTION_CLOSE. For
2572              *      this reason, endpoints MAY discard packets rather
2573              *      than immediately close if errors are detected in
2574              *      packets that lack authentication.
2575              * I.e. should we drop this packet instead of closing the connection?
2576              */
2577             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2578                                                    0, "client received initial token");
2579             break;
2580         }
2581 
2582         /* This packet contains frames, pass to the RXDP. */
2583         ossl_quic_handle_frames(ch, ch->qrx_pkt); /* best effort */
2584 
2585         if (ch->did_crypto_frame)
2586             ch_tick_tls(ch, channel_only, NULL);
2587 
2588         break;
2589 
2590     case QUIC_PKT_TYPE_VERSION_NEG:
2591         /*
2592          * "A client MUST discard any Version Negotiation packet if it has
2593          * received and successfully processed any other packet."
2594          */
2595         if (!old_have_processed_any_pkt)
2596             ch_rx_handle_version_neg(ch, ch->qrx_pkt);
2597 
2598         break;
2599 
2600     default:
2601         assert(0);
2602         break;
2603     }
2604 
2605 }
2606 
ch_rx_handle_version_neg(QUIC_CHANNEL * ch,OSSL_QRX_PKT * pkt)2607 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt)
2608 {
2609     /*
2610      * We do not support version negotiation at this time. As per RFC 9000 s.
2611      * 6.2., we MUST abandon the connection attempt if we receive a Version
2612      * Negotiation packet, unless we have already successfully processed another
2613      * incoming packet, or the packet lists the QUIC version we want to use.
2614      */
2615     PACKET vpkt;
2616     unsigned long v;
2617 
2618     if (!PACKET_buf_init(&vpkt, pkt->hdr->data, pkt->hdr->len))
2619         return;
2620 
2621     while (PACKET_remaining(&vpkt) > 0) {
2622         if (!PACKET_get_net_4(&vpkt, &v))
2623             break;
2624 
2625         if ((uint32_t)v == QUIC_VERSION_1)
2626             return;
2627     }
2628 
2629     /* No match, this is a failure case. */
2630     ch_raise_version_neg_failure(ch);
2631 }
2632 
ch_raise_version_neg_failure(QUIC_CHANNEL * ch)2633 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch)
2634 {
2635     QUIC_TERMINATE_CAUSE tcause = {0};
2636 
2637     tcause.error_code = OSSL_QUIC_ERR_CONNECTION_REFUSED;
2638     tcause.reason     = "version negotiation failure";
2639     tcause.reason_len = strlen(tcause.reason);
2640 
2641     /*
2642      * Skip TERMINATING state; this is not considered a protocol error and we do
2643      * not send CONNECTION_CLOSE.
2644      */
2645     ch_start_terminating(ch, &tcause, 1);
2646 }
2647 
2648 /* Try to generate packets and if possible, flush them to the network. */
ch_tx(QUIC_CHANNEL * ch,int * notify_other_threads)2649 static int ch_tx(QUIC_CHANNEL *ch, int *notify_other_threads)
2650 {
2651     QUIC_TXP_STATUS status;
2652     int res;
2653 
2654     /*
2655      * RFC 9000 s. 10.2.2: Draining Connection State:
2656      *      While otherwise identical to the closing state, an endpoint
2657      *      in the draining state MUST NOT send any packets.
2658      * and:
2659      *      An endpoint MUST NOT send further packets.
2660      */
2661     if (ossl_quic_channel_is_draining(ch))
2662         return 0;
2663 
2664     if (ossl_quic_channel_is_closing(ch)) {
2665         /*
2666          * While closing, only send CONN_CLOSE if we've received more traffic
2667          * from the peer. Once we tell the TXP to generate CONN_CLOSE, all
2668          * future calls to it generate CONN_CLOSE frames, so otherwise we would
2669          * just constantly generate CONN_CLOSE frames.
2670          *
2671          * Confirming to RFC 9000 s. 10.2.1 Closing Connection State:
2672          *      An endpoint SHOULD limit the rate at which it generates
2673          *      packets in the closing state.
2674          */
2675         if (!ch->conn_close_queued)
2676             return 0;
2677 
2678         ch->conn_close_queued = 0;
2679     }
2680 
2681     /* Do TXKU if we need to. */
2682     ch_maybe_trigger_spontaneous_txku(ch);
2683 
2684     ch->rxku_pending_confirm_done = 0;
2685 
2686     /* Loop until we stop generating packets to send */
2687     do {
2688         /*
2689         * Send packet, if we need to. Best effort. The TXP consults the CC and
2690         * applies any limitations imposed by it, so we don't need to do it here.
2691         *
2692         * Best effort. In particular if TXP fails for some reason we should
2693         * still flush any queued packets which we already generated.
2694         */
2695         res = ossl_quic_tx_packetiser_generate(ch->txp, &status);
2696         if (status.sent_pkt > 0) {
2697             ch->have_sent_any_pkt = 1; /* Packet(s) were sent */
2698             ch->port->have_sent_any_pkt = 1;
2699 
2700             /*
2701             * RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when
2702             * sending an ack-eliciting packet if no other ack-eliciting packets
2703             * have been sent since last receiving and processing a packet.'
2704             */
2705             if (status.sent_ack_eliciting
2706                     && !ch->have_sent_ack_eliciting_since_rx) {
2707                 ch_update_idle(ch);
2708                 ch->have_sent_ack_eliciting_since_rx = 1;
2709             }
2710 
2711             if (!ch->is_server && status.sent_handshake)
2712                 /*
2713                 * RFC 9001 s. 4.9.1: A client MUST discard Initial keys when it
2714                 * first sends a Handshake packet.
2715                 */
2716                 ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
2717 
2718             if (ch->rxku_pending_confirm_done)
2719                 ch->rxku_pending_confirm = 0;
2720 
2721             ch_update_ping_deadline(ch);
2722         }
2723 
2724         if (!res) {
2725             /*
2726             * One case where TXP can fail is if we reach a TX PN of 2**62 - 1.
2727             * As per RFC 9000 s. 12.3, if this happens we MUST close the
2728             * connection without sending a CONNECTION_CLOSE frame. This is
2729             * actually handled as an emergent consequence of our design, as the
2730             * TX packetiser will never transmit another packet when the TX PN
2731             * reaches the limit.
2732             *
2733             * Calling the below function terminates the connection; its attempt
2734             * to schedule a CONNECTION_CLOSE frame will not actually cause a
2735             * packet to be transmitted for this reason.
2736             */
2737             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR,
2738                                                    0,
2739                                                    "internal error (txp generate)");
2740             break;
2741         }
2742     } while (status.sent_pkt > 0);
2743 
2744     /* Flush packets to network. */
2745     switch (ossl_qtx_flush_net(ch->qtx)) {
2746     case QTX_FLUSH_NET_RES_OK:
2747     case QTX_FLUSH_NET_RES_TRANSIENT_FAIL:
2748         /* Best effort, done for now. */
2749         break;
2750 
2751     case QTX_FLUSH_NET_RES_PERMANENT_FAIL:
2752     default:
2753         /* Permanent underlying network BIO, start terminating. */
2754         ossl_quic_port_raise_net_error(ch->port, ch);
2755         break;
2756     }
2757 
2758     /*
2759      * If we have datagrams we have yet to successfully transmit, we need to
2760      * notify other threads so that they can switch to polling on POLLOUT as
2761      * well as POLLIN.
2762      */
2763     if (ossl_qtx_get_queue_len_datagrams(ch->qtx) > 0)
2764         *notify_other_threads = 1;
2765 
2766     return 1;
2767 }
2768 
2769 /* Determine next tick deadline. */
ch_determine_next_tick_deadline(QUIC_CHANNEL * ch)2770 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch)
2771 {
2772     OSSL_TIME deadline;
2773     int i;
2774 
2775     if (ossl_quic_channel_is_terminated(ch))
2776         return ossl_time_infinite();
2777 
2778     deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
2779     if (ossl_time_is_zero(deadline))
2780         deadline = ossl_time_infinite();
2781 
2782     /*
2783      * Check the ack deadline for all enc_levels that are actually provisioned.
2784      * ACKs aren't restricted by CC.
2785      */
2786     for (i = 0; i < QUIC_ENC_LEVEL_NUM; i++) {
2787         if (ossl_qtx_is_enc_level_provisioned(ch->qtx, i)) {
2788             deadline = ossl_time_min(deadline,
2789                                      ossl_ackm_get_ack_deadline(ch->ackm,
2790                                                                 ossl_quic_enc_level_to_pn_space(i)));
2791         }
2792     }
2793 
2794     /*
2795      * When do we need to send an ACK-eliciting packet to reset the idle
2796      * deadline timer for the peer?
2797      */
2798     if (!ossl_time_is_infinite(ch->ping_deadline))
2799         deadline = ossl_time_min(deadline, ch->ping_deadline);
2800 
2801     /* Apply TXP wakeup deadline. */
2802     deadline = ossl_time_min(deadline,
2803                              ossl_quic_tx_packetiser_get_deadline(ch->txp));
2804 
2805     /* Is the terminating timer armed? */
2806     if (ossl_quic_channel_is_terminating(ch))
2807         deadline = ossl_time_min(deadline,
2808                                  ch->terminate_deadline);
2809     else if (!ossl_time_is_infinite(ch->idle_deadline))
2810         deadline = ossl_time_min(deadline,
2811                                  ch->idle_deadline);
2812 
2813     /* When does the RXKU process complete? */
2814     if (ch->rxku_in_progress)
2815         deadline = ossl_time_min(deadline, ch->rxku_update_end_deadline);
2816 
2817     return deadline;
2818 }
2819 
2820 /*
2821  * QUIC Channel: Lifecycle Events
2822  * ==============================
2823  */
2824 
2825 /*
2826  * Record a state transition. This is not necessarily a change to ch->state but
2827  * also includes the handshake becoming complete or confirmed, etc.
2828  */
ch_record_state_transition(QUIC_CHANNEL * ch,uint32_t new_state)2829 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state)
2830 {
2831     uint32_t old_state = ch->state;
2832 
2833     ch->state = new_state;
2834 
2835     ossl_qlog_event_connectivity_connection_state_updated(ch_get_qlog(ch),
2836                                                           old_state,
2837                                                           new_state,
2838                                                           ch->handshake_complete,
2839                                                           ch->handshake_confirmed);
2840 }
2841 
free_peer_token(const unsigned char * token,size_t token_len,void * arg)2842 static void free_peer_token(const unsigned char *token,
2843                             size_t token_len, void *arg)
2844 {
2845     ossl_quic_free_peer_token((QUIC_TOKEN *)arg);
2846 }
2847 
ossl_quic_channel_start(QUIC_CHANNEL * ch)2848 int ossl_quic_channel_start(QUIC_CHANNEL *ch)
2849 {
2850     QUIC_TOKEN *token;
2851 
2852     if (ch->is_server)
2853         /*
2854          * This is not used by the server. The server moves to active
2855          * automatically on receiving an incoming connection.
2856          */
2857         return 0;
2858 
2859     if (ch->state != QUIC_CHANNEL_STATE_IDLE)
2860         /* Calls to connect are idempotent */
2861         return 1;
2862 
2863     /* Inform QTX of peer address. */
2864     if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr))
2865         return 0;
2866 
2867     /*
2868      * Look to see if we have a token, and if so, set it on the packetiser
2869      */
2870     if (!ch->is_server
2871         && ossl_quic_get_peer_token(ch->port->channel_ctx,
2872                                     &ch->cur_peer_addr,
2873                                     &token)
2874         && !ossl_quic_tx_packetiser_set_initial_token(ch->txp, token->token,
2875                                                       token->token_len,
2876                                                       free_peer_token,
2877                                                       token))
2878         free_peer_token(NULL, 0, token);
2879 
2880     /* Plug in secrets for the Initial EL. */
2881     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
2882                                           ch->port->engine->propq,
2883                                           &ch->init_dcid,
2884                                           ch->is_server,
2885                                           ch->qrx, ch->qtx))
2886         return 0;
2887 
2888     /*
2889      * Determine the QUIC Transport Parameters and serialize the transport
2890      * parameters block. (For servers, we do this later as we must defer
2891      * generation until we have received the client's transport parameters.)
2892      */
2893     if (!ch->is_server && !ch->got_local_transport_params
2894         && !ch_generate_transport_params(ch))
2895         return 0;
2896 
2897     /* Change state. */
2898     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
2899     ch->doing_proactive_ver_neg = 0; /* not currently supported */
2900 
2901     ossl_qlog_event_connectivity_connection_started(ch_get_qlog(ch),
2902                                                     &ch->init_dcid);
2903 
2904     /* Handshake layer: start (e.g. send CH). */
2905     if (!ch_tick_tls(ch, /*channel_only=*/0, NULL))
2906         return 0;
2907 
2908     ossl_quic_reactor_tick(ossl_quic_port_get0_reactor(ch->port), 0); /* best effort */
2909     return 1;
2910 }
2911 
free_token(const unsigned char * token,size_t token_len,void * arg)2912 static void free_token(const unsigned char *token, size_t token_len, void *arg)
2913 {
2914     OPENSSL_free((char *)token);
2915 }
2916 
2917 /* Start a locally initiated connection shutdown. */
ossl_quic_channel_local_close(QUIC_CHANNEL * ch,uint64_t app_error_code,const char * app_reason)2918 void ossl_quic_channel_local_close(QUIC_CHANNEL *ch, uint64_t app_error_code,
2919                                    const char *app_reason)
2920 {
2921     QUIC_TERMINATE_CAUSE tcause = {0};
2922 
2923     if (ossl_quic_channel_is_term_any(ch))
2924         return;
2925 
2926     tcause.app          = 1;
2927     tcause.error_code   = app_error_code;
2928     tcause.reason       = app_reason;
2929     tcause.reason_len   = app_reason != NULL ? strlen(app_reason) : 0;
2930     ch_start_terminating(ch, &tcause, 0);
2931 }
2932 
2933 /**
2934  * ch_restart - Restarts the QUIC channel by simulating loss of the initial
2935  * packet. This forces the packet to be regenerated with the updated protocol
2936  * version number.
2937  *
2938  * @ch: Pointer to the QUIC_CHANNEL structure.
2939  *
2940  * Returns 1 on success, 0 on failure.
2941  */
ch_restart(QUIC_CHANNEL * ch)2942 static int ch_restart(QUIC_CHANNEL *ch)
2943 {
2944     /*
2945      * Just pretend we lost our initial packet, so it gets
2946      * regenerated, with our updated protocol version number
2947      */
2948    return ossl_ackm_mark_packet_pseudo_lost(ch->ackm, QUIC_PN_SPACE_INITIAL,
2949                                             /* PN= */ 0);
2950 }
2951 
2952 /* Called when a server asks us to do a retry. */
ch_retry(QUIC_CHANNEL * ch,const unsigned char * retry_token,size_t retry_token_len,const QUIC_CONN_ID * retry_scid,int drop_later_pn)2953 static int ch_retry(QUIC_CHANNEL *ch,
2954                     const unsigned char *retry_token,
2955                     size_t retry_token_len,
2956                     const QUIC_CONN_ID *retry_scid,
2957                     int drop_later_pn)
2958 {
2959     void *buf;
2960     QUIC_PN pn = 0;
2961 
2962     /*
2963      * RFC 9000 s. 17.2.5.1: "A client MUST discard a Retry packet that contains
2964      * a SCID field that is identical to the DCID field of its initial packet."
2965      */
2966     if (ossl_quic_conn_id_eq(&ch->init_dcid, retry_scid))
2967         return 1;
2968 
2969     /* We change to using the SCID in the Retry packet as the DCID. */
2970     if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, retry_scid))
2971         return 0;
2972 
2973     /*
2974      * Now we retry. We will release the Retry packet immediately, so copy
2975      * the token.
2976      */
2977     if ((buf = OPENSSL_memdup(retry_token, retry_token_len)) == NULL)
2978         return 0;
2979 
2980     if (!ossl_quic_tx_packetiser_set_initial_token(ch->txp, buf,
2981                                                    retry_token_len,
2982                                                    free_token, NULL)) {
2983         /*
2984          * This may fail if the token we receive is too big for us to ever be
2985          * able to transmit in an outgoing Initial packet.
2986          */
2987         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INVALID_TOKEN, 0,
2988                                                "received oversize token");
2989         OPENSSL_free(buf);
2990         return 0;
2991     }
2992 
2993     ch->retry_scid  = *retry_scid;
2994     ch->doing_retry = 1;
2995 
2996     /*
2997      * If a retry isn't our first response, we need to drop packet number
2998      * one instead (i.e. the case where we did version negotiation first
2999      */
3000     if (drop_later_pn == 1)
3001         pn = 1;
3002 
3003     /*
3004      * We need to stimulate the Initial EL to generate the first CRYPTO frame
3005      * again. We can do this most cleanly by simply forcing the ACKM to consider
3006      * the first Initial packet as lost, which it effectively was as the server
3007      * hasn't processed it. This also maintains the desired behaviour with e.g.
3008      * PNs not resetting and so on.
3009      *
3010      * The PN we used initially is always zero, because QUIC does not allow
3011      * repeated retries.
3012      */
3013     if (!ossl_ackm_mark_packet_pseudo_lost(ch->ackm, QUIC_PN_SPACE_INITIAL,
3014                                            pn))
3015         return 0;
3016 
3017     /*
3018      * Plug in new secrets for the Initial EL. This is the only time we change
3019      * the secrets for an EL after we already provisioned it.
3020      */
3021     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
3022                                           ch->port->engine->propq,
3023                                           &ch->retry_scid,
3024                                           /*is_server=*/0,
3025                                           ch->qrx, ch->qtx))
3026         return 0;
3027 
3028     return 1;
3029 }
3030 
3031 /* Called when an EL is to be discarded. */
ch_discard_el(QUIC_CHANNEL * ch,uint32_t enc_level)3032 static int ch_discard_el(QUIC_CHANNEL *ch,
3033                          uint32_t enc_level)
3034 {
3035     if (!ossl_assert(enc_level < QUIC_ENC_LEVEL_1RTT))
3036         return 0;
3037 
3038     if ((ch->el_discarded & (1U << enc_level)) != 0)
3039         /* Already done. */
3040         return 1;
3041 
3042     /* Best effort for all of these. */
3043     ossl_quic_tx_packetiser_discard_enc_level(ch->txp, enc_level);
3044     ossl_qrx_discard_enc_level(ch->qrx, enc_level);
3045     ossl_qtx_discard_enc_level(ch->qtx, enc_level);
3046 
3047     if (enc_level != QUIC_ENC_LEVEL_0RTT) {
3048         uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
3049 
3050         ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
3051 
3052         /* We should still have crypto streams at this point. */
3053         if (!ossl_assert(ch->crypto_send[pn_space] != NULL)
3054             || !ossl_assert(ch->crypto_recv[pn_space] != NULL))
3055             return 0;
3056 
3057         /* Get rid of the crypto stream state for the EL. */
3058         ossl_quic_sstream_free(ch->crypto_send[pn_space]);
3059         ch->crypto_send[pn_space] = NULL;
3060 
3061         ossl_quic_rstream_free(ch->crypto_recv[pn_space]);
3062         ch->crypto_recv[pn_space] = NULL;
3063     }
3064 
3065     ch->el_discarded |= (1U << enc_level);
3066     return 1;
3067 }
3068 
3069 /* Intended to be called by the RXDP. */
ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL * ch)3070 int ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL *ch)
3071 {
3072     if (ch->handshake_confirmed)
3073         return 1;
3074 
3075     if (!ch->handshake_complete) {
3076         /*
3077          * Does not make sense for handshake to be confirmed before it is
3078          * completed.
3079          */
3080         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
3081                                                OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE,
3082                                                "handshake cannot be confirmed "
3083                                                "before it is completed");
3084         return 0;
3085     }
3086 
3087     ch_discard_el(ch, QUIC_ENC_LEVEL_HANDSHAKE);
3088     ch->handshake_confirmed = 1;
3089     ch_record_state_transition(ch, ch->state);
3090     ossl_ackm_on_handshake_confirmed(ch->ackm);
3091     return 1;
3092 }
3093 
3094 /*
3095  * Master function used when we want to start tearing down a connection:
3096  *
3097  *   - If the connection is still IDLE we can go straight to TERMINATED;
3098  *
3099  *   - If we are already TERMINATED this is a no-op.
3100  *
3101  *   - If we are TERMINATING - CLOSING and we have now got a CONNECTION_CLOSE
3102  *     from the peer (tcause->remote == 1), we move to TERMINATING - DRAINING.
3103  *
3104  *   - If we are TERMINATING - DRAINING, we remain here until the terminating
3105  *     timer expires.
3106  *
3107  *   - Otherwise, we are in ACTIVE and move to TERMINATING - CLOSING.
3108  *     if we caused the termination (e.g. we have sent a CONNECTION_CLOSE). Note
3109  *     that we are considered to have caused a termination if we sent the first
3110  *     CONNECTION_CLOSE frame, even if it is caused by a peer protocol
3111  *     violation. If the peer sent the first CONNECTION_CLOSE frame, we move to
3112  *     TERMINATING - DRAINING.
3113  *
3114  * We record the termination cause structure passed on the first call only.
3115  * Any successive calls have their termination cause data discarded;
3116  * once we start sending a CONNECTION_CLOSE frame, we don't change the details
3117  * in it.
3118  *
3119  * This conforms to RFC 9000 s. 10.2.1: Closing Connection State:
3120  *      To minimize the state that an endpoint maintains for a closing
3121  *      connection, endpoints MAY send the exact same packet in response
3122  *      to any received packet.
3123  *
3124  * We don't drop any connection state (specifically packet protection keys)
3125  * even though we are permitted to.  This conforms to RFC 9000 s. 10.2.1:
3126  * Closing Connection State:
3127  *       An endpoint MAY retain packet protection keys for incoming
3128  *       packets to allow it to read and process a CONNECTION_CLOSE frame.
3129  *
3130  * Note that we do not conform to these two from the same section:
3131  *      An endpoint's selected connection ID and the QUIC version
3132  *      are sufficient information to identify packets for a closing
3133  *      connection; the endpoint MAY discard all other connection state.
3134  * and:
3135  *      An endpoint MAY drop packet protection keys when entering the
3136  *      closing state and send a packet containing a CONNECTION_CLOSE
3137  *      frame in response to any UDP datagram that is received.
3138  */
copy_tcause(QUIC_TERMINATE_CAUSE * dst,const QUIC_TERMINATE_CAUSE * src)3139 static void copy_tcause(QUIC_TERMINATE_CAUSE *dst,
3140                         const QUIC_TERMINATE_CAUSE *src)
3141 {
3142     dst->error_code = src->error_code;
3143     dst->frame_type = src->frame_type;
3144     dst->app        = src->app;
3145     dst->remote     = src->remote;
3146 
3147     dst->reason     = NULL;
3148     dst->reason_len = 0;
3149 
3150     if (src->reason != NULL && src->reason_len > 0) {
3151         size_t l = src->reason_len;
3152         char *r;
3153 
3154         if (l >= SIZE_MAX)
3155             --l;
3156 
3157         /*
3158          * If this fails, dst->reason becomes NULL and we simply do not use a
3159          * reason. This ensures termination is infallible.
3160          */
3161         dst->reason = r = OPENSSL_memdup(src->reason, l + 1);
3162         if (r == NULL)
3163             return;
3164 
3165         r[l]  = '\0';
3166         dst->reason_len = l;
3167     }
3168 }
3169 
ch_start_terminating(QUIC_CHANNEL * ch,const QUIC_TERMINATE_CAUSE * tcause,int force_immediate)3170 static void ch_start_terminating(QUIC_CHANNEL *ch,
3171                                  const QUIC_TERMINATE_CAUSE *tcause,
3172                                  int force_immediate)
3173 {
3174     /* No point sending anything if we haven't sent anything yet. */
3175     if (!ch->have_sent_any_pkt)
3176         force_immediate = 1;
3177 
3178     switch (ch->state) {
3179     default:
3180     case QUIC_CHANNEL_STATE_IDLE:
3181         copy_tcause(&ch->terminate_cause, tcause);
3182         ch_on_terminating_timeout(ch);
3183         break;
3184 
3185     case QUIC_CHANNEL_STATE_ACTIVE:
3186         copy_tcause(&ch->terminate_cause, tcause);
3187 
3188         ossl_qlog_event_connectivity_connection_closed(ch_get_qlog(ch), tcause);
3189 
3190         if (!force_immediate) {
3191             ch_record_state_transition(ch, tcause->remote
3192                                            ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
3193                                            : QUIC_CHANNEL_STATE_TERMINATING_CLOSING);
3194             /*
3195              * RFC 9000 s. 10.2 Immediate Close
3196              *  These states SHOULD persist for at least three times
3197              *  the current PTO interval as defined in [QUIC-RECOVERY].
3198              */
3199             ch->terminate_deadline
3200                 = ossl_time_add(get_time(ch),
3201                                 ossl_time_multiply(ossl_ackm_get_pto_duration(ch->ackm),
3202                                                    3));
3203 
3204             if (!tcause->remote) {
3205                 OSSL_QUIC_FRAME_CONN_CLOSE f = {0};
3206 
3207                 /* best effort */
3208                 f.error_code = ch->terminate_cause.error_code;
3209                 f.frame_type = ch->terminate_cause.frame_type;
3210                 f.is_app     = ch->terminate_cause.app;
3211                 f.reason     = (char *)ch->terminate_cause.reason;
3212                 f.reason_len = ch->terminate_cause.reason_len;
3213                 ossl_quic_tx_packetiser_schedule_conn_close(ch->txp, &f);
3214                 /*
3215                  * RFC 9000 s. 10.2.2 Draining Connection State:
3216                  *  An endpoint that receives a CONNECTION_CLOSE frame MAY
3217                  *  send a single packet containing a CONNECTION_CLOSE
3218                  *  frame before entering the draining state, using a
3219                  *  NO_ERROR code if appropriate
3220                  */
3221                 ch->conn_close_queued = 1;
3222             }
3223         } else {
3224             ch_on_terminating_timeout(ch);
3225         }
3226         break;
3227 
3228     case QUIC_CHANNEL_STATE_TERMINATING_CLOSING:
3229         if (force_immediate)
3230             ch_on_terminating_timeout(ch);
3231         else if (tcause->remote)
3232             /*
3233              * RFC 9000 s. 10.2.2 Draining Connection State:
3234              *  An endpoint MAY enter the draining state from the
3235              *  closing state if it receives a CONNECTION_CLOSE frame,
3236              *  which indicates that the peer is also closing or draining.
3237              */
3238             ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATING_DRAINING);
3239 
3240         break;
3241 
3242     case QUIC_CHANNEL_STATE_TERMINATING_DRAINING:
3243         /*
3244          * Other than in the force-immediate case, we remain here until the
3245          * timeout expires.
3246          */
3247         if (force_immediate)
3248             ch_on_terminating_timeout(ch);
3249 
3250         break;
3251 
3252     case QUIC_CHANNEL_STATE_TERMINATED:
3253         /* No-op. */
3254         break;
3255     }
3256 }
3257 
3258 /* For RXDP use. */
ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL * ch,OSSL_QUIC_FRAME_CONN_CLOSE * f)3259 void ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL *ch,
3260                                             OSSL_QUIC_FRAME_CONN_CLOSE *f)
3261 {
3262     QUIC_TERMINATE_CAUSE tcause = {0};
3263 
3264     if (!ossl_quic_channel_is_active(ch))
3265         return;
3266 
3267     tcause.remote     = 1;
3268     tcause.app        = f->is_app;
3269     tcause.error_code = f->error_code;
3270     tcause.frame_type = f->frame_type;
3271     tcause.reason     = f->reason;
3272     tcause.reason_len = f->reason_len;
3273     ch_start_terminating(ch, &tcause, 0);
3274 }
3275 
free_frame_data(unsigned char * buf,size_t buf_len,void * arg)3276 static void free_frame_data(unsigned char *buf, size_t buf_len, void *arg)
3277 {
3278     OPENSSL_free(buf);
3279 }
3280 
ch_enqueue_retire_conn_id(QUIC_CHANNEL * ch,uint64_t seq_num)3281 static int ch_enqueue_retire_conn_id(QUIC_CHANNEL *ch, uint64_t seq_num)
3282 {
3283     BUF_MEM *buf_mem = NULL;
3284     WPACKET wpkt;
3285     size_t l;
3286 
3287     ossl_quic_srtm_remove(ch->srtm, ch, seq_num);
3288 
3289     if ((buf_mem = BUF_MEM_new()) == NULL)
3290         goto err;
3291 
3292     if (!WPACKET_init(&wpkt, buf_mem))
3293         goto err;
3294 
3295     if (!ossl_quic_wire_encode_frame_retire_conn_id(&wpkt, seq_num)) {
3296         WPACKET_cleanup(&wpkt);
3297         goto err;
3298     }
3299 
3300     WPACKET_finish(&wpkt);
3301     if (!WPACKET_get_total_written(&wpkt, &l))
3302         goto err;
3303 
3304     if (ossl_quic_cfq_add_frame(ch->cfq, 1, QUIC_PN_SPACE_APP,
3305                                 OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID, 0,
3306                                 (unsigned char *)buf_mem->data, l,
3307                                 free_frame_data, NULL) == NULL)
3308         goto err;
3309 
3310     buf_mem->data = NULL;
3311     BUF_MEM_free(buf_mem);
3312     return 1;
3313 
3314 err:
3315     ossl_quic_channel_raise_protocol_error(ch,
3316                                            OSSL_QUIC_ERR_INTERNAL_ERROR,
3317                                            OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3318                                            "internal error enqueueing retire conn id");
3319     BUF_MEM_free(buf_mem);
3320     return 0;
3321 }
3322 
ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL * ch,OSSL_QUIC_FRAME_NEW_CONN_ID * f)3323 void ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL *ch,
3324                                       OSSL_QUIC_FRAME_NEW_CONN_ID *f)
3325 {
3326     uint64_t new_remote_seq_num = ch->cur_remote_seq_num;
3327     uint64_t new_retire_prior_to = ch->cur_retire_prior_to;
3328 
3329     if (!ossl_quic_channel_is_active(ch))
3330         return;
3331 
3332     /* We allow only two active connection ids; first check some constraints */
3333     if (ch->cur_remote_dcid.id_len == 0) {
3334         /* Changing from 0 length connection id is disallowed */
3335         ossl_quic_channel_raise_protocol_error(ch,
3336                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
3337                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3338                                                "zero length connection id in use");
3339 
3340         return;
3341     }
3342 
3343     if (f->seq_num > new_remote_seq_num)
3344         new_remote_seq_num = f->seq_num;
3345     if (f->retire_prior_to > new_retire_prior_to)
3346         new_retire_prior_to = f->retire_prior_to;
3347 
3348     /*
3349      * RFC 9000-5.1.1: An endpoint MUST NOT provide more connection IDs
3350      * than the peer's limit.
3351      *
3352      * After processing a NEW_CONNECTION_ID frame and adding and retiring
3353      * active connection IDs, if the number of active connection IDs exceeds
3354      * the value advertised in its active_connection_id_limit transport
3355      * parameter, an endpoint MUST close the connection with an error of
3356      * type CONNECTION_ID_LIMIT_ERROR.
3357      */
3358     if (new_remote_seq_num - new_retire_prior_to > 1) {
3359         ossl_quic_channel_raise_protocol_error(ch,
3360                                                OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3361                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3362                                                "active_connection_id limit violated");
3363         return;
3364     }
3365 
3366     /*
3367      * RFC 9000-5.1.1: An endpoint MAY send connection IDs that temporarily
3368      * exceed a peer's limit if the NEW_CONNECTION_ID frame also requires
3369      * the retirement of any excess, by including a sufficiently large
3370      * value in the Retire Prior To field.
3371      *
3372      * RFC 9000-5.1.2: An endpoint SHOULD allow for sending and tracking
3373      * a number of RETIRE_CONNECTION_ID frames of at least twice the value
3374      * of the active_connection_id_limit transport parameter.  An endpoint
3375      * MUST NOT forget a connection ID without retiring it, though it MAY
3376      * choose to treat having connection IDs in need of retirement that
3377      * exceed this limit as a connection error of type CONNECTION_ID_LIMIT_ERROR.
3378      *
3379      * We are a little bit more liberal than the minimum mandated.
3380      */
3381     if (new_retire_prior_to - ch->cur_retire_prior_to > 10) {
3382         ossl_quic_channel_raise_protocol_error(ch,
3383                                                OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3384                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3385                                                "retiring connection id limit violated");
3386 
3387         return;
3388     }
3389 
3390     if (new_remote_seq_num > ch->cur_remote_seq_num) {
3391         /* Add new stateless reset token */
3392         if (!ossl_quic_srtm_add(ch->srtm, ch, new_remote_seq_num,
3393                                 &f->stateless_reset)) {
3394             ossl_quic_channel_raise_protocol_error(
3395                     ch, OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3396                     OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3397                     "unable to store stateless reset token");
3398 
3399             return;
3400         }
3401         ch->cur_remote_seq_num = new_remote_seq_num;
3402         ch->cur_remote_dcid = f->conn_id;
3403         ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid);
3404     }
3405 
3406     /*
3407      * RFC 9000-5.1.2: Upon receipt of an increased Retire Prior To
3408      * field, the peer MUST stop using the corresponding connection IDs
3409      * and retire them with RETIRE_CONNECTION_ID frames before adding the
3410      * newly provided connection ID to the set of active connection IDs.
3411      */
3412 
3413     /*
3414      * Note: RFC 9000 s. 19.15 says:
3415      *   "An endpoint that receives a NEW_CONNECTION_ID frame with a sequence
3416      *    number smaller than the Retire Prior To field of a previously received
3417      *    NEW_CONNECTION_ID frame MUST send a corresponding
3418      *    RETIRE_CONNECTION_ID frame that retires the newly received connection
3419      *    ID, unless it has already done so for that sequence number."
3420      *
3421      * Since we currently always queue RETIRE_CONN_ID frames based on the Retire
3422      * Prior To field of a NEW_CONNECTION_ID frame immediately upon receiving
3423      * that NEW_CONNECTION_ID frame, by definition this will always be met.
3424      * This may change in future when we change our CID handling.
3425      */
3426     while (new_retire_prior_to > ch->cur_retire_prior_to) {
3427         if (!ch_enqueue_retire_conn_id(ch, ch->cur_retire_prior_to))
3428             break;
3429         ++ch->cur_retire_prior_to;
3430     }
3431 }
3432 
ch_save_err_state(QUIC_CHANNEL * ch)3433 static void ch_save_err_state(QUIC_CHANNEL *ch)
3434 {
3435     if (ch->err_state == NULL)
3436         ch->err_state = OSSL_ERR_STATE_new();
3437 
3438     if (ch->err_state == NULL)
3439         return;
3440 
3441     OSSL_ERR_STATE_save(ch->err_state);
3442 }
3443 
ossl_quic_channel_inject(QUIC_CHANNEL * ch,QUIC_URXE * e)3444 void ossl_quic_channel_inject(QUIC_CHANNEL *ch, QUIC_URXE *e)
3445 {
3446     ossl_qrx_inject_urxe(ch->qrx, e);
3447 }
3448 
ossl_quic_channel_inject_pkt(QUIC_CHANNEL * ch,OSSL_QRX_PKT * qpkt)3449 void ossl_quic_channel_inject_pkt(QUIC_CHANNEL *ch, OSSL_QRX_PKT *qpkt)
3450 {
3451     ossl_qrx_inject_pkt(ch->qrx, qpkt);
3452 }
3453 
ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL * ch)3454 void ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL *ch)
3455 {
3456     QUIC_TERMINATE_CAUSE tcause = {0};
3457 
3458     tcause.error_code   = OSSL_QUIC_ERR_NO_ERROR;
3459     tcause.remote       = 1;
3460     ch_start_terminating(ch, &tcause, 0);
3461 }
3462 
ossl_quic_channel_raise_net_error(QUIC_CHANNEL * ch)3463 void ossl_quic_channel_raise_net_error(QUIC_CHANNEL *ch)
3464 {
3465     QUIC_TERMINATE_CAUSE tcause = {0};
3466 
3467     if (ch->net_error)
3468         return;
3469 
3470     ch->net_error = 1;
3471 
3472     tcause.error_code = OSSL_QUIC_ERR_INTERNAL_ERROR;
3473     tcause.reason     = "network BIO I/O error";
3474     tcause.reason_len = strlen(tcause.reason);
3475 
3476     /*
3477      * Skip Terminating state and go directly to Terminated, no point trying to
3478      * send CONNECTION_CLOSE if we cannot communicate.
3479      */
3480     ch_start_terminating(ch, &tcause, 1);
3481 }
3482 
ossl_quic_channel_net_error(QUIC_CHANNEL * ch)3483 int ossl_quic_channel_net_error(QUIC_CHANNEL *ch)
3484 {
3485     return ch->net_error;
3486 }
3487 
ossl_quic_channel_restore_err_state(QUIC_CHANNEL * ch)3488 void ossl_quic_channel_restore_err_state(QUIC_CHANNEL *ch)
3489 {
3490     if (ch == NULL)
3491         return;
3492 
3493     if (!ossl_quic_port_is_running(ch->port))
3494         ossl_quic_port_restore_err_state(ch->port);
3495     else
3496         OSSL_ERR_STATE_restore(ch->err_state);
3497 }
3498 
ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL * ch,uint64_t error_code,uint64_t frame_type,const char * reason,ERR_STATE * err_state,const char * src_file,int src_line,const char * src_func)3499 void ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL *ch,
3500                                                 uint64_t error_code,
3501                                                 uint64_t frame_type,
3502                                                 const char *reason,
3503                                                 ERR_STATE *err_state,
3504                                                 const char *src_file,
3505                                                 int src_line,
3506                                                 const char *src_func)
3507 {
3508     QUIC_TERMINATE_CAUSE tcause = {0};
3509     int err_reason = error_code == OSSL_QUIC_ERR_INTERNAL_ERROR
3510                      ? ERR_R_INTERNAL_ERROR : SSL_R_QUIC_PROTOCOL_ERROR;
3511     const char *err_str = ossl_quic_err_to_string(error_code);
3512     const char *err_str_pfx = " (", *err_str_sfx = ")";
3513     const char *ft_str = NULL;
3514     const char *ft_str_pfx = " (", *ft_str_sfx = ")";
3515 
3516     if (ch->protocol_error)
3517         /* Only the first call to this function matters. */
3518         return;
3519 
3520     if (err_str == NULL) {
3521         err_str     = "";
3522         err_str_pfx = "";
3523         err_str_sfx = "";
3524     }
3525 
3526     /*
3527      * If we were provided an underlying error state, restore it and then append
3528      * our ERR on top as a "cover letter" error.
3529      */
3530     if (err_state != NULL)
3531         OSSL_ERR_STATE_restore(err_state);
3532 
3533     if (frame_type != 0) {
3534         ft_str = ossl_quic_frame_type_to_string(frame_type);
3535         if (ft_str == NULL) {
3536             ft_str      = "";
3537             ft_str_pfx  = "";
3538             ft_str_sfx  = "";
3539         }
3540 
3541         ERR_raise_data(ERR_LIB_SSL, err_reason,
3542                        "QUIC error code: 0x%llx%s%s%s "
3543                        "(triggered by frame type: 0x%llx%s%s%s), reason: \"%s\"",
3544                        (unsigned long long) error_code,
3545                        err_str_pfx, err_str, err_str_sfx,
3546                        (unsigned long long) frame_type,
3547                        ft_str_pfx, ft_str, ft_str_sfx,
3548                        reason);
3549     } else {
3550         ERR_raise_data(ERR_LIB_SSL, err_reason,
3551                        "QUIC error code: 0x%llx%s%s%s, reason: \"%s\"",
3552                        (unsigned long long) error_code,
3553                        err_str_pfx, err_str, err_str_sfx,
3554                        reason);
3555     }
3556 
3557     if (src_file != NULL)
3558         ERR_set_debug(src_file, src_line, src_func);
3559 
3560     ch_save_err_state(ch);
3561 
3562     tcause.error_code = error_code;
3563     tcause.frame_type = frame_type;
3564     tcause.reason     = reason;
3565     tcause.reason_len = strlen(reason);
3566 
3567     ch->protocol_error = 1;
3568     ch_start_terminating(ch, &tcause, 0);
3569 }
3570 
3571 /*
3572  * Called once the terminating timer expires, meaning we move from TERMINATING
3573  * to TERMINATED.
3574  */
ch_on_terminating_timeout(QUIC_CHANNEL * ch)3575 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch)
3576 {
3577     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
3578 }
3579 
3580 /*
3581  * Determines the effective idle timeout duration. This is based on the idle
3582  * timeout values that we and our peer signalled in transport parameters
3583  * but have some limits applied.
3584  */
ch_get_effective_idle_timeout_duration(QUIC_CHANNEL * ch)3585 static OSSL_TIME ch_get_effective_idle_timeout_duration(QUIC_CHANNEL *ch)
3586 {
3587     OSSL_TIME pto;
3588 
3589     if (ch->max_idle_timeout == 0)
3590         return ossl_time_infinite();
3591 
3592     /*
3593      * RFC 9000 s. 10.1: Idle Timeout
3594      *  To avoid excessively small idle timeout periods, endpoints
3595      *  MUST increase the idle timeout period to be at least three
3596      *  times the current Probe Timeout (PTO). This allows for
3597      *  multiple PTOs to expire, and therefore multiple probes to
3598      *  be sent and lost, prior to idle timeout.
3599      */
3600     pto = ossl_ackm_get_pto_duration(ch->ackm);
3601     return ossl_time_max(ossl_ms2time(ch->max_idle_timeout),
3602                                       ossl_time_multiply(pto, 3));
3603 }
3604 
3605 /*
3606  * Updates our idle deadline. Called when an event happens which should bump the
3607  * idle timeout.
3608  */
ch_update_idle(QUIC_CHANNEL * ch)3609 static void ch_update_idle(QUIC_CHANNEL *ch)
3610 {
3611     ch->idle_deadline = ossl_time_add(get_time(ch),
3612                                       ch_get_effective_idle_timeout_duration(ch));
3613 }
3614 
3615 /*
3616  * Updates our ping deadline, which determines when we next generate a ping if
3617  * we don't have any other ACK-eliciting frames to send.
3618  */
ch_update_ping_deadline(QUIC_CHANNEL * ch)3619 static void ch_update_ping_deadline(QUIC_CHANNEL *ch)
3620 {
3621     OSSL_TIME max_span, idle_duration;
3622 
3623     idle_duration = ch_get_effective_idle_timeout_duration(ch);
3624     if (ossl_time_is_infinite(idle_duration)) {
3625         ch->ping_deadline = ossl_time_infinite();
3626         return;
3627     }
3628 
3629     /*
3630      * Maximum amount of time without traffic before we send a PING to keep
3631      * the connection open. Usually we use max_idle_timeout/2, but ensure
3632      * the period never exceeds the assumed NAT interval to ensure NAT
3633      * devices don't have their state time out (RFC 9000 s. 10.1.2).
3634      */
3635     max_span = ossl_time_divide(idle_duration, 2);
3636     max_span = ossl_time_min(max_span, MAX_NAT_INTERVAL);
3637     ch->ping_deadline = ossl_time_add(get_time(ch), max_span);
3638 }
3639 
3640 /* Called when the idle timeout expires. */
ch_on_idle_timeout(QUIC_CHANNEL * ch)3641 static void ch_on_idle_timeout(QUIC_CHANNEL *ch)
3642 {
3643     /*
3644      * Idle timeout does not have an error code associated with it because a
3645      * CONN_CLOSE is never sent for it. We shouldn't use this data once we reach
3646      * TERMINATED anyway.
3647      */
3648     ch->terminate_cause.app         = 0;
3649     ch->terminate_cause.error_code  = OSSL_QUIC_LOCAL_ERR_IDLE_TIMEOUT;
3650     ch->terminate_cause.frame_type  = 0;
3651 
3652     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
3653 }
3654 
3655 /**
3656  * @brief Common handler for initializing a new QUIC connection.
3657  *
3658  * This function configures a QUIC channel (`QUIC_CHANNEL *ch`) for a new
3659  * connection by setting the peer address, connection IDs, and necessary
3660  * callbacks. It establishes initial secrets, sets up logging, and performs
3661  * required transitions for the channel state.
3662  *
3663  * @param ch       Pointer to the QUIC channel being initialized.
3664  * @param peer     Address of the peer to which the channel connects.
3665  * @param peer_scid Peer-specified source connection ID.
3666  * @param peer_dcid Peer-specified destination connection ID.
3667  * @param peer_odcid Peer-specified original destination connection ID
3668  *                   may be NULL if retry frame not sent to client
3669  * @return         1 on success, 0 on failure to set required elements.
3670  */
ch_on_new_conn_common(QUIC_CHANNEL * ch,const BIO_ADDR * peer,const QUIC_CONN_ID * peer_scid,const QUIC_CONN_ID * peer_dcid,const QUIC_CONN_ID * peer_odcid)3671 static int ch_on_new_conn_common(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
3672                                  const QUIC_CONN_ID *peer_scid,
3673                                  const QUIC_CONN_ID *peer_dcid,
3674                                  const QUIC_CONN_ID *peer_odcid)
3675 {
3676     /* Note our newly learnt peer address and CIDs. */
3677     if (!BIO_ADDR_copy(&ch->cur_peer_addr, peer))
3678         return 0;
3679 
3680     ch->init_dcid       = *peer_dcid;
3681     ch->cur_remote_dcid = *peer_scid;
3682     ch->odcid.id_len = 0;
3683 
3684     if (peer_odcid != NULL)
3685         ch->odcid = *peer_odcid;
3686 
3687     /* Inform QTX of peer address. */
3688     if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr))
3689         return 0;
3690 
3691     /* Inform TXP of desired CIDs. */
3692     if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid))
3693         return 0;
3694 
3695     if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
3696         return 0;
3697 
3698     /* Setup QLOG, which did not happen earlier due to lacking an Initial ODCID. */
3699     ossl_qtx_set_qlog_cb(ch->qtx, ch_get_qlog_cb, ch);
3700     ossl_quic_tx_packetiser_set_qlog_cb(ch->txp, ch_get_qlog_cb, ch);
3701 
3702     /*
3703      * Plug in secrets for the Initial EL. secrets for QRX were created in
3704      * port_default_packet_handler() already.
3705      */
3706     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
3707                                           ch->port->engine->propq,
3708                                           &ch->init_dcid,
3709                                           /*is_server=*/1,
3710                                           NULL, ch->qtx))
3711         return 0;
3712 
3713     /* Register the peer ODCID in the LCIDM. */
3714     if (!ossl_quic_lcidm_enrol_odcid(ch->lcidm, ch, peer_odcid == NULL ?
3715                                      &ch->init_dcid :
3716                                      peer_odcid))
3717         return 0;
3718 
3719     /* Change state. */
3720     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
3721     ch->doing_proactive_ver_neg = 0; /* not currently supported */
3722     return 1;
3723 }
3724 
3725 /* Called when we, as a server, get a new incoming connection. */
ossl_quic_channel_on_new_conn(QUIC_CHANNEL * ch,const BIO_ADDR * peer,const QUIC_CONN_ID * peer_scid,const QUIC_CONN_ID * peer_dcid)3726 int ossl_quic_channel_on_new_conn(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
3727                                   const QUIC_CONN_ID *peer_scid,
3728                                   const QUIC_CONN_ID *peer_dcid)
3729 {
3730     if (!ossl_assert(ch->state == QUIC_CHANNEL_STATE_IDLE && ch->is_server))
3731         return 0;
3732 
3733     /* Generate an Initial LCID we will use for the connection. */
3734     if (!ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &ch->cur_local_cid))
3735         return 0;
3736 
3737     return ch_on_new_conn_common(ch, peer, peer_scid, peer_dcid, NULL);
3738 }
3739 
3740 /**
3741  * Binds a QUIC channel to a specific peer's address and connection IDs.
3742  *
3743  * This function is used to establish a binding between a QUIC channel and a
3744  * peer's address and connection IDs. The binding is performed only if the
3745  * channel is idle and is on the server side. The peer's destination connection
3746  * ID (`peer_dcid`) is mandatory, and the channel's current local connection ID
3747  * is set to this value.
3748  *
3749  * @param ch          Pointer to the QUIC_CHANNEL structure representing the
3750  *                    channel to be bound.
3751  * @param peer        Pointer to a BIO_ADDR structure representing the peer's
3752  *                    address.
3753  * @param peer_scid   Pointer to the peer's source connection ID (QUIC_CONN_ID).
3754  * @param peer_dcid   Pointer to the peer's destination connection ID
3755  *                    (QUIC_CONN_ID). This must not be NULL.
3756  * @param peer_odcid  Pointer to the original destination connection ID
3757  *                    (QUIC_CONN_ID) chosen by the peer in its first initial
3758  *                    packet received without a token.
3759  *
3760  * @return 1 on success, or 0 on failure if the conditions for binding are not
3761  *         met (e.g., channel is not idle or not a server, or binding fails).
3762  */
ossl_quic_bind_channel(QUIC_CHANNEL * ch,const BIO_ADDR * peer,const QUIC_CONN_ID * peer_scid,const QUIC_CONN_ID * peer_dcid,const QUIC_CONN_ID * peer_odcid)3763 int ossl_quic_bind_channel(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
3764                            const QUIC_CONN_ID *peer_scid,
3765                            const QUIC_CONN_ID *peer_dcid,
3766                            const QUIC_CONN_ID *peer_odcid)
3767 {
3768     if (peer_dcid == NULL)
3769         return 0;
3770 
3771     if (!ossl_assert(ch->state == QUIC_CHANNEL_STATE_IDLE && ch->is_server))
3772         return 0;
3773 
3774     ch->cur_local_cid = *peer_dcid;
3775     if (!ossl_quic_lcidm_bind_channel(ch->lcidm, ch, peer_dcid))
3776         return 0;
3777 
3778     /*
3779      * peer_odcid <=> is initial dst conn id chosen by peer in its
3780      * first initial packet we received without token.
3781      */
3782     return ch_on_new_conn_common(ch, peer, peer_scid, peer_dcid, peer_odcid);
3783 }
3784 
ossl_quic_channel_get0_ssl(QUIC_CHANNEL * ch)3785 SSL *ossl_quic_channel_get0_ssl(QUIC_CHANNEL *ch)
3786 {
3787     return ch->tls;
3788 }
3789 
ch_init_new_stream(QUIC_CHANNEL * ch,QUIC_STREAM * qs,int can_send,int can_recv)3790 static int ch_init_new_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs,
3791                               int can_send, int can_recv)
3792 {
3793     uint64_t rxfc_wnd;
3794     int server_init = ossl_quic_stream_is_server_init(qs);
3795     int local_init = (ch->is_server == server_init);
3796     int is_uni = !ossl_quic_stream_is_bidi(qs);
3797 
3798     if (can_send)
3799         if ((qs->sstream = ossl_quic_sstream_new(INIT_APP_BUF_LEN)) == NULL)
3800             goto err;
3801 
3802     if (can_recv)
3803         if ((qs->rstream = ossl_quic_rstream_new(NULL, NULL, 0)) == NULL)
3804             goto err;
3805 
3806     /* TXFC */
3807     if (!ossl_quic_txfc_init(&qs->txfc, &ch->conn_txfc))
3808         goto err;
3809 
3810     if (ch->got_remote_transport_params) {
3811         /*
3812          * If we already got peer TPs we need to apply the initial CWM credit
3813          * now. If we didn't already get peer TPs this will be done
3814          * automatically for all extant streams when we do.
3815          */
3816         if (can_send) {
3817             uint64_t cwm;
3818 
3819             if (is_uni)
3820                 cwm = ch->rx_init_max_stream_data_uni;
3821             else if (local_init)
3822                 cwm = ch->rx_init_max_stream_data_bidi_local;
3823             else
3824                 cwm = ch->rx_init_max_stream_data_bidi_remote;
3825 
3826             ossl_quic_txfc_bump_cwm(&qs->txfc, cwm);
3827         }
3828     }
3829 
3830     /* RXFC */
3831     if (!can_recv)
3832         rxfc_wnd = 0;
3833     else if (is_uni)
3834         rxfc_wnd = ch->tx_init_max_stream_data_uni;
3835     else if (local_init)
3836         rxfc_wnd = ch->tx_init_max_stream_data_bidi_local;
3837     else
3838         rxfc_wnd = ch->tx_init_max_stream_data_bidi_remote;
3839 
3840     if (!ossl_quic_rxfc_init(&qs->rxfc, &ch->conn_rxfc,
3841                              rxfc_wnd,
3842                              DEFAULT_STREAM_RXFC_MAX_WND_MUL * rxfc_wnd,
3843                              get_time, ch))
3844         goto err;
3845 
3846     return 1;
3847 
3848 err:
3849     ossl_quic_sstream_free(qs->sstream);
3850     qs->sstream = NULL;
3851     ossl_quic_rstream_free(qs->rstream);
3852     qs->rstream = NULL;
3853     return 0;
3854 }
3855 
ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL * ch,int is_uni)3856 static uint64_t *ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL *ch,
3857                                                       int is_uni)
3858 {
3859     return is_uni ? &ch->next_local_stream_ordinal_uni
3860                   : &ch->next_local_stream_ordinal_bidi;
3861 }
3862 
ch_get_local_stream_max_ptr(const QUIC_CHANNEL * ch,int is_uni)3863 static const uint64_t *ch_get_local_stream_max_ptr(const QUIC_CHANNEL *ch,
3864                                                    int is_uni)
3865 {
3866     return is_uni ? &ch->max_local_streams_uni
3867                   : &ch->max_local_streams_bidi;
3868 }
3869 
ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL * ch,int is_uni)3870 static const QUIC_RXFC *ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL *ch,
3871                                                         int is_uni)
3872 {
3873     return is_uni ? &ch->max_streams_uni_rxfc
3874                   : &ch->max_streams_bidi_rxfc;
3875 }
3876 
ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL * ch,int is_uni)3877 int ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL *ch,
3878                                                      int is_uni)
3879 {
3880     const uint64_t *p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni);
3881 
3882     return ossl_quic_stream_map_is_local_allowed_by_stream_limit(&ch->qsm,
3883                                                                  *p_next_ordinal,
3884                                                                  is_uni);
3885 }
3886 
ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL * ch,int is_uni)3887 uint64_t ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL *ch,
3888                                                         int is_uni)
3889 {
3890     const uint64_t *p_next_ordinal, *p_max;
3891 
3892     p_next_ordinal  = ch_get_local_stream_next_ordinal_ptr((QUIC_CHANNEL *)ch,
3893                                                            is_uni);
3894     p_max           = ch_get_local_stream_max_ptr(ch, is_uni);
3895 
3896     return *p_max - *p_next_ordinal;
3897 }
3898 
ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL * ch,int is_uni)3899 uint64_t ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL *ch,
3900                                                          int is_uni)
3901 {
3902     return ossl_quic_rxfc_get_credit(ch_get_remote_stream_count_rxfc(ch, is_uni));
3903 }
3904 
ossl_quic_channel_new_stream_local(QUIC_CHANNEL * ch,int is_uni)3905 QUIC_STREAM *ossl_quic_channel_new_stream_local(QUIC_CHANNEL *ch, int is_uni)
3906 {
3907     QUIC_STREAM *qs;
3908     int type;
3909     uint64_t stream_id;
3910     uint64_t *p_next_ordinal;
3911 
3912     type = ch->is_server ? QUIC_STREAM_INITIATOR_SERVER
3913                          : QUIC_STREAM_INITIATOR_CLIENT;
3914 
3915     p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni);
3916 
3917     if (is_uni)
3918         type |= QUIC_STREAM_DIR_UNI;
3919     else
3920         type |= QUIC_STREAM_DIR_BIDI;
3921 
3922     if (*p_next_ordinal >= ((uint64_t)1) << 62)
3923         return NULL;
3924 
3925     stream_id = ((*p_next_ordinal) << 2) | type;
3926 
3927     if ((qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id, type)) == NULL)
3928         return NULL;
3929 
3930     /* Locally-initiated stream, so we always want a send buffer. */
3931     if (!ch_init_new_stream(ch, qs, /*can_send=*/1, /*can_recv=*/!is_uni))
3932         goto err;
3933 
3934     ++*p_next_ordinal;
3935     return qs;
3936 
3937 err:
3938     ossl_quic_stream_map_release(&ch->qsm, qs);
3939     return NULL;
3940 }
3941 
ossl_quic_channel_new_stream_remote(QUIC_CHANNEL * ch,uint64_t stream_id)3942 QUIC_STREAM *ossl_quic_channel_new_stream_remote(QUIC_CHANNEL *ch,
3943                                                  uint64_t stream_id)
3944 {
3945     uint64_t peer_role;
3946     int is_uni;
3947     QUIC_STREAM *qs;
3948 
3949     peer_role = ch->is_server
3950         ? QUIC_STREAM_INITIATOR_CLIENT
3951         : QUIC_STREAM_INITIATOR_SERVER;
3952 
3953     if ((stream_id & QUIC_STREAM_INITIATOR_MASK) != peer_role)
3954         return NULL;
3955 
3956     is_uni = ((stream_id & QUIC_STREAM_DIR_MASK) == QUIC_STREAM_DIR_UNI);
3957 
3958     qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id,
3959                                     stream_id & (QUIC_STREAM_INITIATOR_MASK
3960                                                  | QUIC_STREAM_DIR_MASK));
3961     if (qs == NULL)
3962         return NULL;
3963 
3964     if (!ch_init_new_stream(ch, qs, /*can_send=*/!is_uni, /*can_recv=*/1))
3965         goto err;
3966 
3967     if (ch->incoming_stream_auto_reject)
3968         ossl_quic_channel_reject_stream(ch, qs);
3969     else
3970         ossl_quic_stream_map_push_accept_queue(&ch->qsm, qs);
3971 
3972     return qs;
3973 
3974 err:
3975     ossl_quic_stream_map_release(&ch->qsm, qs);
3976     return NULL;
3977 }
3978 
ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL * ch,int enable,uint64_t aec)3979 void ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL *ch,
3980                                                        int enable,
3981                                                        uint64_t aec)
3982 {
3983     ch->incoming_stream_auto_reject     = (enable != 0);
3984     ch->incoming_stream_auto_reject_aec = aec;
3985 }
3986 
ossl_quic_channel_reject_stream(QUIC_CHANNEL * ch,QUIC_STREAM * qs)3987 void ossl_quic_channel_reject_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs)
3988 {
3989     ossl_quic_stream_map_stop_sending_recv_part(&ch->qsm, qs,
3990                                                 ch->incoming_stream_auto_reject_aec);
3991 
3992     ossl_quic_stream_map_reset_stream_send_part(&ch->qsm, qs,
3993                                                 ch->incoming_stream_auto_reject_aec);
3994     qs->deleted = 1;
3995 
3996     ossl_quic_stream_map_update_state(&ch->qsm, qs);
3997 }
3998 
3999 /* Replace local connection ID in TXP and DEMUX for testing purposes. */
ossl_quic_channel_replace_local_cid(QUIC_CHANNEL * ch,const QUIC_CONN_ID * conn_id)4000 int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL *ch,
4001                                         const QUIC_CONN_ID *conn_id)
4002 {
4003     /* Remove the current LCID from the LCIDM. */
4004     if (!ossl_quic_lcidm_debug_remove(ch->lcidm, &ch->cur_local_cid))
4005         return 0;
4006     ch->cur_local_cid = *conn_id;
4007     /* Set in the TXP, used only for long header packets. */
4008     if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
4009         return 0;
4010     /* Add the new LCID to the LCIDM. */
4011     if (!ossl_quic_lcidm_debug_add(ch->lcidm, ch, &ch->cur_local_cid,
4012                                    100))
4013         return 0;
4014     return 1;
4015 }
4016 
ossl_quic_channel_set_msg_callback(QUIC_CHANNEL * ch,ossl_msg_cb msg_callback,SSL * msg_callback_ssl)4017 void ossl_quic_channel_set_msg_callback(QUIC_CHANNEL *ch,
4018                                         ossl_msg_cb msg_callback,
4019                                         SSL *msg_callback_ssl)
4020 {
4021     ch->msg_callback = msg_callback;
4022     ch->msg_callback_ssl = msg_callback_ssl;
4023     ossl_qtx_set_msg_callback(ch->qtx, msg_callback, msg_callback_ssl);
4024     ossl_quic_tx_packetiser_set_msg_callback(ch->txp, msg_callback,
4025                                              msg_callback_ssl);
4026     /*
4027      * postpone msg callback setting for tserver until port calls
4028      * port_bind_channel().
4029      */
4030     if (ch->is_tserver_ch == 0)
4031         ossl_qrx_set_msg_callback(ch->qrx, msg_callback, msg_callback_ssl);
4032 }
4033 
ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL * ch,void * msg_callback_arg)4034 void ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL *ch,
4035                                             void *msg_callback_arg)
4036 {
4037     ch->msg_callback_arg = msg_callback_arg;
4038     ossl_qtx_set_msg_callback_arg(ch->qtx, msg_callback_arg);
4039     ossl_quic_tx_packetiser_set_msg_callback_arg(ch->txp, msg_callback_arg);
4040 
4041     /*
4042      * postpone msg callback setting for tserver until port calls
4043      * port_bind_channel().
4044      */
4045     if (ch->is_tserver_ch == 0)
4046         ossl_qrx_set_msg_callback_arg(ch->qrx, msg_callback_arg);
4047 }
4048 
ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL * ch,uint64_t tx_pkt_threshold)4049 void ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL *ch,
4050                                                    uint64_t tx_pkt_threshold)
4051 {
4052     ch->txku_threshold_override = tx_pkt_threshold;
4053 }
4054 
ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL * ch)4055 uint64_t ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL *ch)
4056 {
4057     return ossl_qtx_get_key_epoch(ch->qtx);
4058 }
4059 
ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL * ch)4060 uint64_t ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL *ch)
4061 {
4062     return ossl_qrx_get_key_epoch(ch->qrx);
4063 }
4064 
ossl_quic_channel_trigger_txku(QUIC_CHANNEL * ch)4065 int ossl_quic_channel_trigger_txku(QUIC_CHANNEL *ch)
4066 {
4067     if (!txku_allowed(ch))
4068         return 0;
4069 
4070     ch->ku_locally_initiated = 1;
4071     ch_trigger_txku(ch);
4072     return 1;
4073 }
4074 
ossl_quic_channel_ping(QUIC_CHANNEL * ch)4075 int ossl_quic_channel_ping(QUIC_CHANNEL *ch)
4076 {
4077     int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
4078 
4079     ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
4080 
4081     return 1;
4082 }
4083 
ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL * ch)4084 uint16_t ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL *ch)
4085 {
4086     return ch->diag_num_rx_ack;
4087 }
4088 
ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL * ch,QUIC_CONN_ID * cid)4089 void ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL *ch, QUIC_CONN_ID *cid)
4090 {
4091     *cid = ch->cur_local_cid;
4092 }
4093 
ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL * ch)4094 int ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL *ch)
4095 {
4096     return ch->got_local_transport_params;
4097 }
4098 
ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL * ch,uint64_t ms)4099 void ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL *ch, uint64_t ms)
4100 {
4101     ch->max_idle_timeout_local_req = ms;
4102 }
ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL * ch)4103 uint64_t ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL *ch)
4104 {
4105     return ch->max_idle_timeout_local_req;
4106 }
4107 
ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL * ch)4108 uint64_t ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL *ch)
4109 {
4110     return ch->max_idle_timeout_remote_req;
4111 }
4112 
ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL * ch)4113 uint64_t ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL *ch)
4114 {
4115     return ch->max_idle_timeout;
4116 }
4117