1 /* 2 * Copyright 2022-2025 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <openssl/rand.h> 11 #include <openssl/err.h> 12 #include "internal/ssl_unwrap.h" 13 #include "internal/quic_channel.h" 14 #include "internal/quic_error.h" 15 #include "internal/quic_rx_depack.h" 16 #include "internal/quic_lcidm.h" 17 #include "internal/quic_srtm.h" 18 #include "internal/qlog_event_helpers.h" 19 #include "internal/quic_txp.h" 20 #include "internal/quic_tls.h" 21 #include "internal/quic_ssl.h" 22 #include "../ssl_local.h" 23 #include "quic_channel_local.h" 24 #include "quic_port_local.h" 25 #include "quic_engine_local.h" 26 27 #define INIT_CRYPTO_RECV_BUF_LEN 16384 28 #define INIT_CRYPTO_SEND_BUF_LEN 16384 29 #define INIT_APP_BUF_LEN 8192 30 31 /* 32 * Interval before we force a PING to ensure NATs don't timeout. This is based 33 * on the lowest commonly seen value of 30 seconds as cited in RFC 9000 s. 34 * 10.1.2. 35 */ 36 #define MAX_NAT_INTERVAL (ossl_ms2time(25000)) 37 38 /* 39 * Our maximum ACK delay on the TX side. This is up to us to choose. Note that 40 * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol 41 * value which determines the value of the maximum ACK delay if the 42 * max_ack_delay transport parameter is not set. 43 */ 44 #define DEFAULT_MAX_ACK_DELAY QUIC_DEFAULT_MAX_ACK_DELAY 45 46 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL); 47 48 static void ch_save_err_state(QUIC_CHANNEL *ch); 49 static int ch_rx(QUIC_CHANNEL *ch, int channel_only, int *notify_other_threads); 50 static int ch_tx(QUIC_CHANNEL *ch, int *notify_other_threads); 51 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only, int *notify_other_threads); 52 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only); 53 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch); 54 static int ch_retry(QUIC_CHANNEL *ch, 55 const unsigned char *retry_token, 56 size_t retry_token_len, 57 const QUIC_CONN_ID *retry_scid, 58 int drop_later_pn); 59 static int ch_restart(QUIC_CHANNEL *ch); 60 61 static void ch_cleanup(QUIC_CHANNEL *ch); 62 static int ch_generate_transport_params(QUIC_CHANNEL *ch); 63 static int ch_on_transport_params(const unsigned char *params, 64 size_t params_len, 65 void *arg); 66 static int ch_on_handshake_alert(void *arg, unsigned char alert_code); 67 static int ch_on_handshake_complete(void *arg); 68 static int ch_on_handshake_yield_secret(uint32_t prot_level, int direction, 69 uint32_t suite_id, EVP_MD *md, 70 const unsigned char *secret, 71 size_t secret_len, 72 void *arg); 73 static int ch_on_crypto_recv_record(const unsigned char **buf, 74 size_t *bytes_read, void *arg); 75 static int ch_on_crypto_release_record(size_t bytes_read, void *arg); 76 static int crypto_ensure_empty(QUIC_RSTREAM *rstream); 77 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len, 78 size_t *consumed, void *arg); 79 static OSSL_TIME get_time(void *arg); 80 static uint64_t get_stream_limit(int uni, void *arg); 81 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg); 82 static void rxku_detected(QUIC_PN pn, void *arg); 83 static int ch_retry(QUIC_CHANNEL *ch, 84 const unsigned char *retry_token, 85 size_t retry_token_len, 86 const QUIC_CONN_ID *retry_scid, 87 int drop_later_pn); 88 static void ch_update_idle(QUIC_CHANNEL *ch); 89 static int ch_discard_el(QUIC_CHANNEL *ch, 90 uint32_t enc_level); 91 static void ch_on_idle_timeout(QUIC_CHANNEL *ch); 92 static void ch_update_idle(QUIC_CHANNEL *ch); 93 static void ch_update_ping_deadline(QUIC_CHANNEL *ch); 94 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch); 95 static void ch_start_terminating(QUIC_CHANNEL *ch, 96 const QUIC_TERMINATE_CAUSE *tcause, 97 int force_immediate); 98 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space, 99 void *arg); 100 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt); 101 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch); 102 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state); 103 104 DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM); 105 106 QUIC_NEEDS_LOCK 107 static QLOG *ch_get_qlog(QUIC_CHANNEL *ch) 108 { 109 #ifndef OPENSSL_NO_QLOG 110 QLOG_TRACE_INFO qti = {0}; 111 112 if (ch->qlog != NULL) 113 return ch->qlog; 114 115 if (!ch->use_qlog) 116 return NULL; 117 118 if (ch->is_server && ch->init_dcid.id_len == 0) 119 return NULL; 120 121 qti.odcid = ch->init_dcid; 122 qti.title = ch->qlog_title; 123 qti.description = NULL; 124 qti.group_id = NULL; 125 qti.is_server = ch->is_server; 126 qti.now_cb = get_time; 127 qti.now_cb_arg = ch; 128 if ((ch->qlog = ossl_qlog_new_from_env(&qti)) == NULL) { 129 ch->use_qlog = 0; /* don't try again */ 130 return NULL; 131 } 132 133 return ch->qlog; 134 #else 135 return NULL; 136 #endif 137 } 138 139 QUIC_NEEDS_LOCK 140 static QLOG *ch_get_qlog_cb(void *arg) 141 { 142 QUIC_CHANNEL *ch = arg; 143 144 return ch_get_qlog(ch); 145 } 146 147 /* 148 * QUIC Channel Initialization and Teardown 149 * ======================================== 150 */ 151 #define DEFAULT_INIT_CONN_RXFC_WND (768 * 1024) 152 #define DEFAULT_CONN_RXFC_MAX_WND_MUL 20 153 154 #define DEFAULT_INIT_STREAM_RXFC_WND (512 * 1024) 155 #define DEFAULT_STREAM_RXFC_MAX_WND_MUL 12 156 157 #define DEFAULT_INIT_CONN_MAX_STREAMS 100 158 159 static int ch_init(QUIC_CHANNEL *ch) 160 { 161 OSSL_QUIC_TX_PACKETISER_ARGS txp_args = {0}; 162 OSSL_QTX_ARGS qtx_args = {0}; 163 OSSL_QRX_ARGS qrx_args = {0}; 164 QUIC_TLS_ARGS tls_args = {0}; 165 uint32_t pn_space; 166 size_t rx_short_dcid_len; 167 size_t tx_init_dcid_len; 168 169 if (ch->port == NULL || ch->lcidm == NULL || ch->srtm == NULL) 170 goto err; 171 172 rx_short_dcid_len = ossl_quic_port_get_rx_short_dcid_len(ch->port); 173 tx_init_dcid_len = ossl_quic_port_get_tx_init_dcid_len(ch->port); 174 175 /* For clients, generate our initial DCID. */ 176 if (!ch->is_server 177 && !ossl_quic_gen_rand_conn_id(ch->port->engine->libctx, tx_init_dcid_len, 178 &ch->init_dcid)) 179 goto err; 180 181 /* We plug in a network write BIO to the QTX later when we get one. */ 182 qtx_args.libctx = ch->port->engine->libctx; 183 qtx_args.get_qlog_cb = ch_get_qlog_cb; 184 qtx_args.get_qlog_cb_arg = ch; 185 qtx_args.mdpl = QUIC_MIN_INITIAL_DGRAM_LEN; 186 ch->rx_max_udp_payload_size = qtx_args.mdpl; 187 188 ch->ping_deadline = ossl_time_infinite(); 189 190 ch->qtx = ossl_qtx_new(&qtx_args); 191 if (ch->qtx == NULL) 192 goto err; 193 194 ch->txpim = ossl_quic_txpim_new(); 195 if (ch->txpim == NULL) 196 goto err; 197 198 ch->cfq = ossl_quic_cfq_new(); 199 if (ch->cfq == NULL) 200 goto err; 201 202 if (!ossl_quic_txfc_init(&ch->conn_txfc, NULL)) 203 goto err; 204 205 /* 206 * Note: The TP we transmit governs what the peer can transmit and thus 207 * applies to the RXFC. 208 */ 209 ch->tx_init_max_stream_data_bidi_local = DEFAULT_INIT_STREAM_RXFC_WND; 210 ch->tx_init_max_stream_data_bidi_remote = DEFAULT_INIT_STREAM_RXFC_WND; 211 ch->tx_init_max_stream_data_uni = DEFAULT_INIT_STREAM_RXFC_WND; 212 213 if (!ossl_quic_rxfc_init(&ch->conn_rxfc, NULL, 214 DEFAULT_INIT_CONN_RXFC_WND, 215 DEFAULT_CONN_RXFC_MAX_WND_MUL * 216 DEFAULT_INIT_CONN_RXFC_WND, 217 get_time, ch)) 218 goto err; 219 220 for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) 221 if (!ossl_quic_rxfc_init_standalone(&ch->crypto_rxfc[pn_space], 222 INIT_CRYPTO_RECV_BUF_LEN, 223 get_time, ch)) 224 goto err; 225 226 if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_bidi_rxfc, 227 DEFAULT_INIT_CONN_MAX_STREAMS, 228 get_time, ch)) 229 goto err; 230 231 if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_uni_rxfc, 232 DEFAULT_INIT_CONN_MAX_STREAMS, 233 get_time, ch)) 234 goto err; 235 236 if (!ossl_statm_init(&ch->statm)) 237 goto err; 238 239 ch->have_statm = 1; 240 ch->cc_method = &ossl_cc_newreno_method; 241 if ((ch->cc_data = ch->cc_method->new(get_time, ch)) == NULL) 242 goto err; 243 244 if ((ch->ackm = ossl_ackm_new(get_time, ch, &ch->statm, 245 ch->cc_method, ch->cc_data)) == NULL) 246 goto err; 247 248 if (!ossl_quic_stream_map_init(&ch->qsm, get_stream_limit, ch, 249 &ch->max_streams_bidi_rxfc, 250 &ch->max_streams_uni_rxfc, 251 ch->is_server)) 252 goto err; 253 254 ch->have_qsm = 1; 255 256 if (!ch->is_server 257 && !ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &ch->init_scid)) 258 goto err; 259 260 txp_args.cur_scid = ch->init_scid; 261 txp_args.cur_dcid = ch->init_dcid; 262 txp_args.ack_delay_exponent = 3; 263 txp_args.qtx = ch->qtx; 264 txp_args.txpim = ch->txpim; 265 txp_args.cfq = ch->cfq; 266 txp_args.ackm = ch->ackm; 267 txp_args.qsm = &ch->qsm; 268 txp_args.conn_txfc = &ch->conn_txfc; 269 txp_args.conn_rxfc = &ch->conn_rxfc; 270 txp_args.max_streams_bidi_rxfc = &ch->max_streams_bidi_rxfc; 271 txp_args.max_streams_uni_rxfc = &ch->max_streams_uni_rxfc; 272 txp_args.cc_method = ch->cc_method; 273 txp_args.cc_data = ch->cc_data; 274 txp_args.now = get_time; 275 txp_args.now_arg = ch; 276 txp_args.get_qlog_cb = ch_get_qlog_cb; 277 txp_args.get_qlog_cb_arg = ch; 278 txp_args.protocol_version = QUIC_VERSION_1; 279 280 for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) { 281 ch->crypto_send[pn_space] = ossl_quic_sstream_new(INIT_CRYPTO_SEND_BUF_LEN); 282 if (ch->crypto_send[pn_space] == NULL) 283 goto err; 284 285 txp_args.crypto[pn_space] = ch->crypto_send[pn_space]; 286 } 287 288 ch->txp = ossl_quic_tx_packetiser_new(&txp_args); 289 if (ch->txp == NULL) 290 goto err; 291 292 /* clients have no amplification limit, so are considered always valid */ 293 if (!ch->is_server) 294 ossl_quic_tx_packetiser_set_validated(ch->txp); 295 296 ossl_quic_tx_packetiser_set_ack_tx_cb(ch->txp, ch_on_txp_ack_tx, ch); 297 298 /* 299 * qrx does not exist yet, then we must be dealing with client channel 300 * (QUIC connection initiator). 301 * If qrx exists already, then we are dealing with server channel which 302 * qrx gets created by port_default_packet_handler() before 303 * port_default_packet_handler() accepts connection and creates channel 304 * for it. 305 * The exception here is tserver which always creates channel, 306 * before the first packet is ever seen. 307 */ 308 if (ch->qrx == NULL && ch->is_tserver_ch == 0) { 309 /* we are regular client, create channel */ 310 qrx_args.libctx = ch->port->engine->libctx; 311 qrx_args.demux = ch->port->demux; 312 qrx_args.short_conn_id_len = rx_short_dcid_len; 313 qrx_args.max_deferred = 32; 314 315 if ((ch->qrx = ossl_qrx_new(&qrx_args)) == NULL) 316 goto err; 317 } 318 319 if (ch->qrx != NULL) { 320 /* 321 * callbacks for channels associated with tserver's port 322 * are set up later when we call ossl_quic_channel_bind_qrx() 323 * in port_default_packet_handler() 324 */ 325 if (!ossl_qrx_set_late_validation_cb(ch->qrx, 326 rx_late_validate, 327 ch)) 328 goto err; 329 330 if (!ossl_qrx_set_key_update_cb(ch->qrx, 331 rxku_detected, 332 ch)) 333 goto err; 334 } 335 336 337 for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) { 338 ch->crypto_recv[pn_space] = ossl_quic_rstream_new(NULL, NULL, 0); 339 if (ch->crypto_recv[pn_space] == NULL) 340 goto err; 341 } 342 343 /* Plug in the TLS handshake layer. */ 344 tls_args.s = ch->tls; 345 tls_args.crypto_send_cb = ch_on_crypto_send; 346 tls_args.crypto_send_cb_arg = ch; 347 tls_args.crypto_recv_rcd_cb = ch_on_crypto_recv_record; 348 tls_args.crypto_recv_rcd_cb_arg = ch; 349 tls_args.crypto_release_rcd_cb = ch_on_crypto_release_record; 350 tls_args.crypto_release_rcd_cb_arg = ch; 351 tls_args.yield_secret_cb = ch_on_handshake_yield_secret; 352 tls_args.yield_secret_cb_arg = ch; 353 tls_args.got_transport_params_cb = ch_on_transport_params; 354 tls_args.got_transport_params_cb_arg= ch; 355 tls_args.handshake_complete_cb = ch_on_handshake_complete; 356 tls_args.handshake_complete_cb_arg = ch; 357 tls_args.alert_cb = ch_on_handshake_alert; 358 tls_args.alert_cb_arg = ch; 359 tls_args.is_server = ch->is_server; 360 tls_args.ossl_quic = 1; 361 362 if ((ch->qtls = ossl_quic_tls_new(&tls_args)) == NULL) 363 goto err; 364 365 ch->tx_max_ack_delay = DEFAULT_MAX_ACK_DELAY; 366 ch->rx_max_ack_delay = QUIC_DEFAULT_MAX_ACK_DELAY; 367 ch->rx_ack_delay_exp = QUIC_DEFAULT_ACK_DELAY_EXP; 368 ch->rx_active_conn_id_limit = QUIC_MIN_ACTIVE_CONN_ID_LIMIT; 369 ch->tx_enc_level = QUIC_ENC_LEVEL_INITIAL; 370 ch->rx_enc_level = QUIC_ENC_LEVEL_INITIAL; 371 ch->txku_threshold_override = UINT64_MAX; 372 373 ch->max_idle_timeout_local_req = QUIC_DEFAULT_IDLE_TIMEOUT; 374 ch->max_idle_timeout_remote_req = 0; 375 ch->max_idle_timeout = ch->max_idle_timeout_local_req; 376 377 ossl_ackm_set_tx_max_ack_delay(ch->ackm, ossl_ms2time(ch->tx_max_ack_delay)); 378 ossl_ackm_set_rx_max_ack_delay(ch->ackm, ossl_ms2time(ch->rx_max_ack_delay)); 379 380 ch_update_idle(ch); 381 ossl_list_ch_insert_tail(&ch->port->channel_list, ch); 382 ch->on_port_list = 1; 383 return 1; 384 385 err: 386 ch_cleanup(ch); 387 return 0; 388 } 389 390 static void ch_cleanup(QUIC_CHANNEL *ch) 391 { 392 uint32_t pn_space; 393 394 if (ch->ackm != NULL) 395 for (pn_space = QUIC_PN_SPACE_INITIAL; 396 pn_space < QUIC_PN_SPACE_NUM; 397 ++pn_space) 398 ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space); 399 400 ossl_quic_lcidm_cull(ch->lcidm, ch); 401 ossl_quic_srtm_cull(ch->srtm, ch); 402 ossl_quic_tx_packetiser_free(ch->txp); 403 ossl_quic_txpim_free(ch->txpim); 404 ossl_quic_cfq_free(ch->cfq); 405 ossl_qtx_free(ch->qtx); 406 if (ch->cc_data != NULL) 407 ch->cc_method->free(ch->cc_data); 408 if (ch->have_statm) 409 ossl_statm_destroy(&ch->statm); 410 ossl_ackm_free(ch->ackm); 411 412 if (ch->have_qsm) 413 ossl_quic_stream_map_cleanup(&ch->qsm); 414 415 for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) { 416 ossl_quic_sstream_free(ch->crypto_send[pn_space]); 417 ossl_quic_rstream_free(ch->crypto_recv[pn_space]); 418 } 419 420 ossl_qrx_pkt_release(ch->qrx_pkt); 421 ch->qrx_pkt = NULL; 422 423 ossl_quic_tls_free(ch->qtls); 424 ossl_qrx_free(ch->qrx); 425 OPENSSL_free(ch->local_transport_params); 426 OPENSSL_free((char *)ch->terminate_cause.reason); 427 OSSL_ERR_STATE_free(ch->err_state); 428 OPENSSL_free(ch->ack_range_scratch); 429 OPENSSL_free(ch->pending_new_token); 430 431 if (ch->on_port_list) { 432 ossl_list_ch_remove(&ch->port->channel_list, ch); 433 ch->on_port_list = 0; 434 } 435 436 #ifndef OPENSSL_NO_QLOG 437 if (ch->qlog != NULL) 438 ossl_qlog_flush(ch->qlog); /* best effort */ 439 440 OPENSSL_free(ch->qlog_title); 441 ossl_qlog_free(ch->qlog); 442 #endif 443 } 444 445 int ossl_quic_channel_init(QUIC_CHANNEL *ch) 446 { 447 return ch_init(ch); 448 } 449 450 void ossl_quic_channel_bind_qrx(QUIC_CHANNEL *tserver_ch, OSSL_QRX *qrx) 451 { 452 if (tserver_ch->qrx == NULL && tserver_ch->is_tserver_ch == 1) { 453 tserver_ch->qrx = qrx; 454 ossl_qrx_set_late_validation_cb(tserver_ch->qrx, rx_late_validate, 455 tserver_ch); 456 ossl_qrx_set_key_update_cb(tserver_ch->qrx, rxku_detected, 457 tserver_ch); 458 } 459 } 460 461 QUIC_CHANNEL *ossl_quic_channel_alloc(const QUIC_CHANNEL_ARGS *args) 462 { 463 QUIC_CHANNEL *ch = NULL; 464 465 if ((ch = OPENSSL_zalloc(sizeof(*ch))) == NULL) 466 return NULL; 467 468 ch->port = args->port; 469 ch->is_server = args->is_server; 470 ch->tls = args->tls; 471 ch->lcidm = args->lcidm; 472 ch->srtm = args->srtm; 473 ch->qrx = args->qrx; 474 ch->is_tserver_ch = args->is_tserver_ch; 475 #ifndef OPENSSL_NO_QLOG 476 ch->use_qlog = args->use_qlog; 477 478 if (ch->use_qlog && args->qlog_title != NULL) { 479 if ((ch->qlog_title = OPENSSL_strdup(args->qlog_title)) == NULL) { 480 OPENSSL_free(ch); 481 return NULL; 482 } 483 } 484 #endif 485 486 return ch; 487 } 488 489 void ossl_quic_channel_free(QUIC_CHANNEL *ch) 490 { 491 if (ch == NULL) 492 return; 493 494 ch_cleanup(ch); 495 OPENSSL_free(ch); 496 } 497 498 /* Set mutator callbacks for test framework support */ 499 int ossl_quic_channel_set_mutator(QUIC_CHANNEL *ch, 500 ossl_mutate_packet_cb mutatecb, 501 ossl_finish_mutate_cb finishmutatecb, 502 void *mutatearg) 503 { 504 if (ch->qtx == NULL) 505 return 0; 506 507 ossl_qtx_set_mutator(ch->qtx, mutatecb, finishmutatecb, mutatearg); 508 return 1; 509 } 510 511 int ossl_quic_channel_get_peer_addr(QUIC_CHANNEL *ch, BIO_ADDR *peer_addr) 512 { 513 if (!ch->addressed_mode) 514 return 0; 515 516 return BIO_ADDR_copy(peer_addr, &ch->cur_peer_addr); 517 } 518 519 int ossl_quic_channel_set_peer_addr(QUIC_CHANNEL *ch, const BIO_ADDR *peer_addr) 520 { 521 if (ch->state != QUIC_CHANNEL_STATE_IDLE) 522 return 0; 523 524 if (peer_addr == NULL || BIO_ADDR_family(peer_addr) == AF_UNSPEC) { 525 BIO_ADDR_clear(&ch->cur_peer_addr); 526 ch->addressed_mode = 0; 527 return 1; 528 } 529 530 if (!BIO_ADDR_copy(&ch->cur_peer_addr, peer_addr)) { 531 ch->addressed_mode = 0; 532 return 0; 533 } 534 ch->addressed_mode = 1; 535 536 return 1; 537 } 538 539 QUIC_REACTOR *ossl_quic_channel_get_reactor(QUIC_CHANNEL *ch) 540 { 541 return ossl_quic_port_get0_reactor(ch->port); 542 } 543 544 QUIC_STREAM_MAP *ossl_quic_channel_get_qsm(QUIC_CHANNEL *ch) 545 { 546 return &ch->qsm; 547 } 548 549 OSSL_STATM *ossl_quic_channel_get_statm(QUIC_CHANNEL *ch) 550 { 551 return &ch->statm; 552 } 553 554 SSL *ossl_quic_channel_get0_tls(QUIC_CHANNEL *ch) 555 { 556 return ch->tls; 557 } 558 559 static void free_buf_mem(unsigned char *buf, size_t buf_len, void *arg) 560 { 561 BUF_MEM_free((BUF_MEM *)arg); 562 } 563 564 int ossl_quic_channel_schedule_new_token(QUIC_CHANNEL *ch, 565 const unsigned char *token, 566 size_t token_len) 567 { 568 int rc = 0; 569 QUIC_CFQ_ITEM *cfq_item; 570 WPACKET wpkt; 571 BUF_MEM *buf_mem = NULL; 572 size_t l = 0; 573 574 buf_mem = BUF_MEM_new(); 575 if (buf_mem == NULL) 576 goto err; 577 578 if (!WPACKET_init(&wpkt, buf_mem)) 579 goto err; 580 581 if (!ossl_quic_wire_encode_frame_new_token(&wpkt, token, 582 token_len)) { 583 WPACKET_cleanup(&wpkt); 584 goto err; 585 } 586 587 WPACKET_finish(&wpkt); 588 589 if (!WPACKET_get_total_written(&wpkt, &l)) 590 goto err; 591 592 cfq_item = ossl_quic_cfq_add_frame(ch->cfq, 1, 593 QUIC_PN_SPACE_APP, 594 OSSL_QUIC_FRAME_TYPE_NEW_TOKEN, 0, 595 (unsigned char *)buf_mem->data, l, 596 free_buf_mem, 597 buf_mem); 598 if (cfq_item == NULL) 599 goto err; 600 601 rc = 1; 602 err: 603 if (!rc) 604 BUF_MEM_free(buf_mem); 605 return rc; 606 } 607 608 size_t ossl_quic_channel_get_short_header_conn_id_len(QUIC_CHANNEL *ch) 609 { 610 return ossl_quic_port_get_rx_short_dcid_len(ch->port); 611 } 612 613 QUIC_STREAM *ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL *ch, 614 uint64_t stream_id) 615 { 616 return ossl_quic_stream_map_get_by_id(&ch->qsm, stream_id); 617 } 618 619 int ossl_quic_channel_is_active(const QUIC_CHANNEL *ch) 620 { 621 return ch != NULL && ch->state == QUIC_CHANNEL_STATE_ACTIVE; 622 } 623 624 int ossl_quic_channel_is_closing(const QUIC_CHANNEL *ch) 625 { 626 return ch->state == QUIC_CHANNEL_STATE_TERMINATING_CLOSING; 627 } 628 629 static int ossl_quic_channel_is_draining(const QUIC_CHANNEL *ch) 630 { 631 return ch->state == QUIC_CHANNEL_STATE_TERMINATING_DRAINING; 632 } 633 634 static int ossl_quic_channel_is_terminating(const QUIC_CHANNEL *ch) 635 { 636 return ossl_quic_channel_is_closing(ch) 637 || ossl_quic_channel_is_draining(ch); 638 } 639 640 int ossl_quic_channel_is_terminated(const QUIC_CHANNEL *ch) 641 { 642 return ch->state == QUIC_CHANNEL_STATE_TERMINATED; 643 } 644 645 int ossl_quic_channel_is_term_any(const QUIC_CHANNEL *ch) 646 { 647 return ossl_quic_channel_is_terminating(ch) 648 || ossl_quic_channel_is_terminated(ch); 649 } 650 651 const QUIC_TERMINATE_CAUSE * 652 ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL *ch) 653 { 654 return ossl_quic_channel_is_term_any(ch) ? &ch->terminate_cause : NULL; 655 } 656 657 int ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL *ch) 658 { 659 return ch->handshake_complete; 660 } 661 662 int ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL *ch) 663 { 664 return ch->handshake_confirmed; 665 } 666 667 QUIC_DEMUX *ossl_quic_channel_get0_demux(QUIC_CHANNEL *ch) 668 { 669 return ch->port->demux; 670 } 671 672 QUIC_PORT *ossl_quic_channel_get0_port(QUIC_CHANNEL *ch) 673 { 674 return ch->port; 675 } 676 677 QUIC_ENGINE *ossl_quic_channel_get0_engine(QUIC_CHANNEL *ch) 678 { 679 return ossl_quic_port_get0_engine(ch->port); 680 } 681 682 CRYPTO_MUTEX *ossl_quic_channel_get_mutex(QUIC_CHANNEL *ch) 683 { 684 return ossl_quic_port_get0_mutex(ch->port); 685 } 686 687 int ossl_quic_channel_has_pending(const QUIC_CHANNEL *ch) 688 { 689 return ossl_quic_demux_has_pending(ch->port->demux) 690 || ossl_qrx_processed_read_pending(ch->qrx); 691 } 692 693 /* 694 * QUIC Channel: Callbacks from Miscellaneous Subsidiary Components 695 * ================================================================ 696 */ 697 698 /* Used by various components. */ 699 static OSSL_TIME get_time(void *arg) 700 { 701 QUIC_CHANNEL *ch = arg; 702 703 return ossl_quic_port_get_time(ch->port); 704 } 705 706 /* Used by QSM. */ 707 static uint64_t get_stream_limit(int uni, void *arg) 708 { 709 QUIC_CHANNEL *ch = arg; 710 711 return uni ? ch->max_local_streams_uni : ch->max_local_streams_bidi; 712 } 713 714 /* 715 * Called by QRX to determine if a packet is potentially invalid before trying 716 * to decrypt it. 717 */ 718 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg) 719 { 720 QUIC_CHANNEL *ch = arg; 721 722 /* Potential duplicates should not be processed. */ 723 if (!ossl_ackm_is_rx_pn_processable(ch->ackm, pn, pn_space)) 724 return 0; 725 726 return 1; 727 } 728 729 /* 730 * Triggers a TXKU (whether spontaneous or solicited). Does not check whether 731 * spontaneous TXKU is currently allowed. 732 */ 733 QUIC_NEEDS_LOCK 734 static void ch_trigger_txku(QUIC_CHANNEL *ch) 735 { 736 uint64_t next_pn 737 = ossl_quic_tx_packetiser_get_next_pn(ch->txp, QUIC_PN_SPACE_APP); 738 739 if (!ossl_quic_pn_valid(next_pn) 740 || !ossl_qtx_trigger_key_update(ch->qtx)) { 741 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0, 742 "key update"); 743 return; 744 } 745 746 ch->txku_in_progress = 1; 747 ch->txku_pn = next_pn; 748 ch->rxku_expected = ch->ku_locally_initiated; 749 } 750 751 QUIC_NEEDS_LOCK 752 static int txku_in_progress(QUIC_CHANNEL *ch) 753 { 754 if (ch->txku_in_progress 755 && ossl_ackm_get_largest_acked(ch->ackm, QUIC_PN_SPACE_APP) >= ch->txku_pn) { 756 OSSL_TIME pto = ossl_ackm_get_pto_duration(ch->ackm); 757 758 /* 759 * RFC 9001 s. 6.5: Endpoints SHOULD wait three times the PTO before 760 * initiating a key update after receiving an acknowledgment that 761 * confirms that the previous key update was received. 762 * 763 * Note that by the above wording, this period starts from when we get 764 * the ack for a TXKU-triggering packet, not when the TXKU is initiated. 765 * So we defer TXKU cooldown deadline calculation to this point. 766 */ 767 ch->txku_in_progress = 0; 768 ch->txku_cooldown_deadline = ossl_time_add(get_time(ch), 769 ossl_time_multiply(pto, 3)); 770 } 771 772 return ch->txku_in_progress; 773 } 774 775 QUIC_NEEDS_LOCK 776 static int txku_allowed(QUIC_CHANNEL *ch) 777 { 778 return ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT /* Sanity check. */ 779 /* Strict RFC 9001 criterion for TXKU. */ 780 && ch->handshake_confirmed 781 && !txku_in_progress(ch); 782 } 783 784 QUIC_NEEDS_LOCK 785 static int txku_recommendable(QUIC_CHANNEL *ch) 786 { 787 if (!txku_allowed(ch)) 788 return 0; 789 790 return 791 /* Recommended RFC 9001 criterion for TXKU. */ 792 ossl_time_compare(get_time(ch), ch->txku_cooldown_deadline) >= 0 793 /* Some additional sensible criteria. */ 794 && !ch->rxku_in_progress 795 && !ch->rxku_pending_confirm; 796 } 797 798 QUIC_NEEDS_LOCK 799 static int txku_desirable(QUIC_CHANNEL *ch) 800 { 801 uint64_t cur_pkt_count, max_pkt_count, thresh_pkt_count; 802 const uint32_t enc_level = QUIC_ENC_LEVEL_1RTT; 803 804 /* Check AEAD limit to determine if we should perform a spontaneous TXKU. */ 805 cur_pkt_count = ossl_qtx_get_cur_epoch_pkt_count(ch->qtx, enc_level); 806 max_pkt_count = ossl_qtx_get_max_epoch_pkt_count(ch->qtx, enc_level); 807 808 thresh_pkt_count = max_pkt_count / 2; 809 if (ch->txku_threshold_override != UINT64_MAX) 810 thresh_pkt_count = ch->txku_threshold_override; 811 812 return cur_pkt_count >= thresh_pkt_count; 813 } 814 815 QUIC_NEEDS_LOCK 816 static void ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL *ch) 817 { 818 if (!txku_recommendable(ch) || !txku_desirable(ch)) 819 return; 820 821 ch->ku_locally_initiated = 1; 822 ch_trigger_txku(ch); 823 } 824 825 QUIC_NEEDS_LOCK 826 static int rxku_allowed(QUIC_CHANNEL *ch) 827 { 828 /* 829 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a key update prior to 830 * having confirmed the handshake (Section 4.1.2). 831 * 832 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a subsequent key update 833 * unless it has received an acknowledgment for a packet that was sent 834 * protected with keys from the current key phase. 835 * 836 * RFC 9001 s. 6.2: If an endpoint detects a second update before it has 837 * sent any packets with updated keys containing an acknowledgment for the 838 * packet that initiated the key update, it indicates that its peer has 839 * updated keys twice without awaiting confirmation. An endpoint MAY treat 840 * such consecutive key updates as a connection error of type 841 * KEY_UPDATE_ERROR. 842 */ 843 return ch->handshake_confirmed && !ch->rxku_pending_confirm; 844 } 845 846 /* 847 * Called when the QRX detects a new RX key update event. 848 */ 849 enum rxku_decision { 850 DECISION_RXKU_ONLY, 851 DECISION_PROTOCOL_VIOLATION, 852 DECISION_SOLICITED_TXKU 853 }; 854 855 /* Called when the QRX detects a key update has occurred. */ 856 QUIC_NEEDS_LOCK 857 static void rxku_detected(QUIC_PN pn, void *arg) 858 { 859 QUIC_CHANNEL *ch = arg; 860 enum rxku_decision decision; 861 OSSL_TIME pto; 862 863 /* 864 * Note: rxku_in_progress is always 0 here as an RXKU cannot be detected 865 * when we are still in UPDATING or COOLDOWN (see quic_record_rx.h). 866 */ 867 assert(!ch->rxku_in_progress); 868 869 if (!rxku_allowed(ch)) 870 /* Is RXKU even allowed at this time? */ 871 decision = DECISION_PROTOCOL_VIOLATION; 872 873 else if (ch->ku_locally_initiated) 874 /* 875 * If this key update was locally initiated (meaning that this detected 876 * RXKU event is a result of our own spontaneous TXKU), we do not 877 * trigger another TXKU; after all, to do so would result in an infinite 878 * ping-pong of key updates. We still process it as an RXKU. 879 */ 880 decision = DECISION_RXKU_ONLY; 881 882 else 883 /* 884 * Otherwise, a peer triggering a KU means we have to trigger a KU also. 885 */ 886 decision = DECISION_SOLICITED_TXKU; 887 888 if (decision == DECISION_PROTOCOL_VIOLATION) { 889 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR, 890 0, "RX key update again too soon"); 891 return; 892 } 893 894 pto = ossl_ackm_get_pto_duration(ch->ackm); 895 896 ch->ku_locally_initiated = 0; 897 ch->rxku_in_progress = 1; 898 ch->rxku_pending_confirm = 1; 899 ch->rxku_trigger_pn = pn; 900 ch->rxku_update_end_deadline = ossl_time_add(get_time(ch), pto); 901 ch->rxku_expected = 0; 902 903 if (decision == DECISION_SOLICITED_TXKU) 904 /* NOT gated by usual txku_allowed() */ 905 ch_trigger_txku(ch); 906 907 /* 908 * Ordinarily, we only generate ACK when some ACK-eliciting frame has been 909 * received. In some cases, this may not occur for a long time, for example 910 * if transmission of application data is going in only one direction and 911 * nothing else is happening with the connection. However, since the peer 912 * cannot initiate a subsequent (spontaneous) TXKU until its prior 913 * (spontaneous or solicited) TXKU has completed - meaning that prior 914 * TXKU's trigger packet (or subsequent packet) has been acknowledged, this 915 * can lead to very long times before a TXKU is considered 'completed'. 916 * Optimise this by forcing ACK generation after triggering TXKU. 917 * (Basically, we consider a RXKU event something that is 'ACK-eliciting', 918 * which it more or less should be; it is necessarily separate from ordinary 919 * processing of ACK-eliciting frames as key update is not indicated via a 920 * frame.) 921 */ 922 ossl_quic_tx_packetiser_schedule_ack(ch->txp, QUIC_PN_SPACE_APP); 923 } 924 925 /* Called per tick to handle RXKU timer events. */ 926 QUIC_NEEDS_LOCK 927 static void ch_rxku_tick(QUIC_CHANNEL *ch) 928 { 929 if (!ch->rxku_in_progress 930 || ossl_time_compare(get_time(ch), ch->rxku_update_end_deadline) < 0) 931 return; 932 933 ch->rxku_update_end_deadline = ossl_time_infinite(); 934 ch->rxku_in_progress = 0; 935 936 if (!ossl_qrx_key_update_timeout(ch->qrx, /*normal=*/1)) 937 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0, 938 "RXKU cooldown internal error"); 939 } 940 941 QUIC_NEEDS_LOCK 942 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space, 943 void *arg) 944 { 945 QUIC_CHANNEL *ch = arg; 946 947 if (pn_space != QUIC_PN_SPACE_APP || !ch->rxku_pending_confirm 948 || !ossl_quic_frame_ack_contains_pn(ack, ch->rxku_trigger_pn)) 949 return; 950 951 /* 952 * Defer clearing rxku_pending_confirm until TXP generate call returns 953 * successfully. 954 */ 955 ch->rxku_pending_confirm_done = 1; 956 } 957 958 /* 959 * QUIC Channel: Handshake Layer Event Handling 960 * ============================================ 961 */ 962 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len, 963 size_t *consumed, void *arg) 964 { 965 int ret; 966 QUIC_CHANNEL *ch = arg; 967 uint32_t enc_level = ch->tx_enc_level; 968 uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level); 969 QUIC_SSTREAM *sstream = ch->crypto_send[pn_space]; 970 971 if (!ossl_assert(sstream != NULL)) 972 return 0; 973 974 ret = ossl_quic_sstream_append(sstream, buf, buf_len, consumed); 975 return ret; 976 } 977 978 static int crypto_ensure_empty(QUIC_RSTREAM *rstream) 979 { 980 size_t avail = 0; 981 int is_fin = 0; 982 983 if (rstream == NULL) 984 return 1; 985 986 if (!ossl_quic_rstream_available(rstream, &avail, &is_fin)) 987 return 0; 988 989 return avail == 0; 990 } 991 992 static int ch_on_crypto_recv_record(const unsigned char **buf, 993 size_t *bytes_read, void *arg) 994 { 995 QUIC_CHANNEL *ch = arg; 996 QUIC_RSTREAM *rstream; 997 int is_fin = 0; /* crypto stream is never finished, so we don't use this */ 998 uint32_t i; 999 1000 /* 1001 * After we move to a later EL we must not allow our peer to send any new 1002 * bytes in the crypto stream on a previous EL. Retransmissions of old bytes 1003 * are allowed. 1004 * 1005 * In practice we will only move to a new EL when we have consumed all bytes 1006 * which should be sent on the crypto stream at a previous EL. For example, 1007 * the Handshake EL should not be provisioned until we have completely 1008 * consumed a TLS 1.3 ServerHello. Thus when we provision an EL the output 1009 * of ossl_quic_rstream_available() should be 0 for all lower ELs. Thus if a 1010 * given EL is available we simply ensure we have not received any further 1011 * bytes at a lower EL. 1012 */ 1013 for (i = QUIC_ENC_LEVEL_INITIAL; i < ch->rx_enc_level; ++i) 1014 if (i != QUIC_ENC_LEVEL_0RTT && 1015 !crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) { 1016 /* Protocol violation (RFC 9001 s. 4.1.3) */ 1017 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION, 1018 OSSL_QUIC_FRAME_TYPE_CRYPTO, 1019 "crypto stream data in wrong EL"); 1020 return 0; 1021 } 1022 1023 rstream = ch->crypto_recv[ossl_quic_enc_level_to_pn_space(ch->rx_enc_level)]; 1024 if (rstream == NULL) 1025 return 0; 1026 1027 return ossl_quic_rstream_get_record(rstream, buf, bytes_read, 1028 &is_fin); 1029 } 1030 1031 static int ch_on_crypto_release_record(size_t bytes_read, void *arg) 1032 { 1033 QUIC_CHANNEL *ch = arg; 1034 QUIC_RSTREAM *rstream; 1035 OSSL_RTT_INFO rtt_info; 1036 uint32_t rx_pn_space = ossl_quic_enc_level_to_pn_space(ch->rx_enc_level); 1037 1038 rstream = ch->crypto_recv[rx_pn_space]; 1039 if (rstream == NULL) 1040 return 0; 1041 1042 ossl_statm_get_rtt_info(ossl_quic_channel_get_statm(ch), &rtt_info); 1043 if (!ossl_quic_rxfc_on_retire(&ch->crypto_rxfc[rx_pn_space], bytes_read, 1044 rtt_info.smoothed_rtt)) 1045 return 0; 1046 1047 return ossl_quic_rstream_release_record(rstream, bytes_read); 1048 } 1049 1050 static int ch_on_handshake_yield_secret(uint32_t prot_level, int direction, 1051 uint32_t suite_id, EVP_MD *md, 1052 const unsigned char *secret, 1053 size_t secret_len, 1054 void *arg) 1055 { 1056 QUIC_CHANNEL *ch = arg; 1057 uint32_t i; 1058 uint32_t enc_level; 1059 1060 /* Convert TLS protection level to QUIC encryption level */ 1061 switch (prot_level) { 1062 case OSSL_RECORD_PROTECTION_LEVEL_EARLY: 1063 enc_level = QUIC_ENC_LEVEL_0RTT; 1064 break; 1065 1066 case OSSL_RECORD_PROTECTION_LEVEL_HANDSHAKE: 1067 enc_level = QUIC_ENC_LEVEL_HANDSHAKE; 1068 break; 1069 1070 case OSSL_RECORD_PROTECTION_LEVEL_APPLICATION: 1071 enc_level = QUIC_ENC_LEVEL_1RTT; 1072 break; 1073 1074 default: 1075 return 0; 1076 } 1077 1078 if (enc_level < QUIC_ENC_LEVEL_HANDSHAKE || enc_level >= QUIC_ENC_LEVEL_NUM) 1079 /* Invalid EL. */ 1080 return 0; 1081 1082 1083 if (direction) { 1084 /* TX */ 1085 if (enc_level <= ch->tx_enc_level) 1086 /* 1087 * Does not make sense for us to try and provision an EL we have already 1088 * attained. 1089 */ 1090 return 0; 1091 1092 if (!ossl_qtx_provide_secret(ch->qtx, enc_level, 1093 suite_id, md, 1094 secret, secret_len)) 1095 return 0; 1096 1097 ch->tx_enc_level = enc_level; 1098 } else { 1099 /* RX */ 1100 if (enc_level <= ch->rx_enc_level) 1101 /* 1102 * Does not make sense for us to try and provision an EL we have already 1103 * attained. 1104 */ 1105 return 0; 1106 1107 /* 1108 * Ensure all crypto streams for previous ELs are now empty of available 1109 * data. 1110 */ 1111 for (i = QUIC_ENC_LEVEL_INITIAL; i < enc_level; ++i) 1112 if (!crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) { 1113 /* Protocol violation (RFC 9001 s. 4.1.3) */ 1114 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION, 1115 OSSL_QUIC_FRAME_TYPE_CRYPTO, 1116 "crypto stream data in wrong EL"); 1117 return 0; 1118 } 1119 1120 if (!ossl_qrx_provide_secret(ch->qrx, enc_level, 1121 suite_id, md, 1122 secret, secret_len)) 1123 return 0; 1124 1125 ch->have_new_rx_secret = 1; 1126 ch->rx_enc_level = enc_level; 1127 } 1128 1129 return 1; 1130 } 1131 1132 static int ch_on_handshake_complete(void *arg) 1133 { 1134 QUIC_CHANNEL *ch = arg; 1135 1136 if (!ossl_assert(!ch->handshake_complete)) 1137 return 0; /* this should not happen twice */ 1138 1139 if (!ossl_assert(ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT)) 1140 return 0; 1141 1142 /* 1143 * When handshake is complete, we no longer need to abide by the 1144 * 3x amplification limit, though we should be validated as soon 1145 * as we see a handshake key encrypted packet (see ossl_quic_handle_packet) 1146 */ 1147 ossl_quic_tx_packetiser_set_validated(ch->txp); 1148 1149 if (!ch->got_remote_transport_params) { 1150 /* 1151 * Was not a valid QUIC handshake if we did not get valid transport 1152 * params. 1153 */ 1154 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_CRYPTO_MISSING_EXT, 1155 OSSL_QUIC_FRAME_TYPE_CRYPTO, 1156 "no transport parameters received"); 1157 return 0; 1158 } 1159 1160 /* Don't need transport parameters anymore. */ 1161 OPENSSL_free(ch->local_transport_params); 1162 ch->local_transport_params = NULL; 1163 1164 /* Tell the QRX it can now process 1-RTT packets. */ 1165 ossl_qrx_allow_1rtt_processing(ch->qrx); 1166 1167 /* Tell TXP the handshake is complete. */ 1168 ossl_quic_tx_packetiser_notify_handshake_complete(ch->txp); 1169 1170 ch->handshake_complete = 1; 1171 1172 if (ch->pending_new_token != NULL) { 1173 /* 1174 * Note this is a best effort operation here 1175 * If scheduling a new token fails, the worst outcome is that 1176 * a client, not having received it, will just have to go through 1177 * an extra roundtrip on a subsequent connection via the retry frame 1178 * path, at which point we get another opportunity to schedule another 1179 * new token. As a result, we don't need to handle any errors here 1180 */ 1181 ossl_quic_channel_schedule_new_token(ch, 1182 ch->pending_new_token, 1183 ch->pending_new_token_len); 1184 OPENSSL_free(ch->pending_new_token); 1185 ch->pending_new_token = NULL; 1186 ch->pending_new_token_len = 0; 1187 } 1188 1189 if (ch->is_server) { 1190 /* 1191 * On the server, the handshake is confirmed as soon as it is complete. 1192 */ 1193 ossl_quic_channel_on_handshake_confirmed(ch); 1194 1195 ossl_quic_tx_packetiser_schedule_handshake_done(ch->txp); 1196 } 1197 1198 ch_record_state_transition(ch, ch->state); 1199 return 1; 1200 } 1201 1202 static int ch_on_handshake_alert(void *arg, unsigned char alert_code) 1203 { 1204 QUIC_CHANNEL *ch = arg; 1205 1206 /* 1207 * RFC 9001 s. 4.4: More specifically, servers MUST NOT send post-handshake 1208 * TLS CertificateRequest messages, and clients MUST treat receipt of such 1209 * messages as a connection error of type PROTOCOL_VIOLATION. 1210 */ 1211 if (alert_code == SSL_AD_UNEXPECTED_MESSAGE 1212 && ch->handshake_complete 1213 && ossl_quic_tls_is_cert_request(ch->qtls)) 1214 ossl_quic_channel_raise_protocol_error(ch, 1215 OSSL_QUIC_ERR_PROTOCOL_VIOLATION, 1216 0, 1217 "Post-handshake TLS " 1218 "CertificateRequest received"); 1219 /* 1220 * RFC 9001 s. 4.6.1: Servers MUST NOT send the early_data extension with a 1221 * max_early_data_size field set to any value other than 0xffffffff. A 1222 * client MUST treat receipt of a NewSessionTicket that contains an 1223 * early_data extension with any other value as a connection error of type 1224 * PROTOCOL_VIOLATION. 1225 */ 1226 else if (alert_code == SSL_AD_ILLEGAL_PARAMETER 1227 && ch->handshake_complete 1228 && ossl_quic_tls_has_bad_max_early_data(ch->qtls)) 1229 ossl_quic_channel_raise_protocol_error(ch, 1230 OSSL_QUIC_ERR_PROTOCOL_VIOLATION, 1231 0, 1232 "Bad max_early_data received"); 1233 else 1234 ossl_quic_channel_raise_protocol_error(ch, 1235 OSSL_QUIC_ERR_CRYPTO_ERR_BEGIN 1236 + alert_code, 1237 0, "handshake alert"); 1238 1239 return 1; 1240 } 1241 1242 /* 1243 * QUIC Channel: Transport Parameter Handling 1244 * ========================================== 1245 */ 1246 1247 /* 1248 * Called by handshake layer when we receive QUIC Transport Parameters from the 1249 * peer. Note that these are not authenticated until the handshake is marked 1250 * as complete. 1251 */ 1252 #define TP_REASON_SERVER_ONLY(x) \ 1253 x " may not be sent by a client" 1254 #define TP_REASON_DUP(x) \ 1255 x " appears multiple times" 1256 #define TP_REASON_MALFORMED(x) \ 1257 x " is malformed" 1258 #define TP_REASON_EXPECTED_VALUE(x) \ 1259 x " does not match expected value" 1260 #define TP_REASON_NOT_RETRY(x) \ 1261 x " sent when not performing a retry" 1262 #define TP_REASON_REQUIRED(x) \ 1263 x " was not sent but is required" 1264 #define TP_REASON_INTERNAL_ERROR(x) \ 1265 x " encountered internal error" 1266 1267 static void txfc_bump_cwm_bidi(QUIC_STREAM *s, void *arg) 1268 { 1269 if (!ossl_quic_stream_is_bidi(s) 1270 || ossl_quic_stream_is_server_init(s)) 1271 return; 1272 1273 ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg); 1274 } 1275 1276 static void txfc_bump_cwm_uni(QUIC_STREAM *s, void *arg) 1277 { 1278 if (ossl_quic_stream_is_bidi(s) 1279 || ossl_quic_stream_is_server_init(s)) 1280 return; 1281 1282 ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg); 1283 } 1284 1285 static void do_update(QUIC_STREAM *s, void *arg) 1286 { 1287 QUIC_CHANNEL *ch = arg; 1288 1289 ossl_quic_stream_map_update_state(&ch->qsm, s); 1290 } 1291 1292 static uint64_t min_u64_ignore_0(uint64_t a, uint64_t b) 1293 { 1294 if (a == 0) 1295 return b; 1296 if (b == 0) 1297 return a; 1298 1299 return a < b ? a : b; 1300 } 1301 1302 static int ch_on_transport_params(const unsigned char *params, 1303 size_t params_len, 1304 void *arg) 1305 { 1306 QUIC_CHANNEL *ch = arg; 1307 PACKET pkt; 1308 uint64_t id, v; 1309 size_t len; 1310 const unsigned char *body; 1311 int got_orig_dcid = 0; 1312 int got_initial_scid = 0; 1313 int got_retry_scid = 0; 1314 int got_initial_max_data = 0; 1315 int got_initial_max_stream_data_bidi_local = 0; 1316 int got_initial_max_stream_data_bidi_remote = 0; 1317 int got_initial_max_stream_data_uni = 0; 1318 int got_initial_max_streams_bidi = 0; 1319 int got_initial_max_streams_uni = 0; 1320 int got_stateless_reset_token = 0; 1321 int got_preferred_addr = 0; 1322 int got_ack_delay_exp = 0; 1323 int got_max_ack_delay = 0; 1324 int got_max_udp_payload_size = 0; 1325 int got_max_idle_timeout = 0; 1326 int got_active_conn_id_limit = 0; 1327 int got_disable_active_migration = 0; 1328 QUIC_CONN_ID cid; 1329 const char *reason = "bad transport parameter"; 1330 ossl_unused uint64_t rx_max_idle_timeout = 0; 1331 ossl_unused const void *stateless_reset_token_p = NULL; 1332 QUIC_PREFERRED_ADDR pfa; 1333 1334 if (ch->got_remote_transport_params) { 1335 reason = "multiple transport parameter extensions"; 1336 goto malformed; 1337 } 1338 1339 if (!PACKET_buf_init(&pkt, params, params_len)) { 1340 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0, 1341 "internal error (packet buf init)"); 1342 return 0; 1343 } 1344 1345 while (PACKET_remaining(&pkt) > 0) { 1346 if (!ossl_quic_wire_peek_transport_param(&pkt, &id)) 1347 goto malformed; 1348 1349 switch (id) { 1350 case QUIC_TPARAM_ORIG_DCID: 1351 if (got_orig_dcid) { 1352 reason = TP_REASON_DUP("ORIG_DCID"); 1353 goto malformed; 1354 } 1355 1356 if (ch->is_server) { 1357 reason = TP_REASON_SERVER_ONLY("ORIG_DCID"); 1358 goto malformed; 1359 } 1360 1361 if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) { 1362 reason = TP_REASON_MALFORMED("ORIG_DCID"); 1363 goto malformed; 1364 } 1365 1366 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION 1367 /* Must match our initial DCID. */ 1368 if (!ossl_quic_conn_id_eq(&ch->init_dcid, &cid)) { 1369 reason = TP_REASON_EXPECTED_VALUE("ORIG_DCID"); 1370 goto malformed; 1371 } 1372 #endif 1373 1374 got_orig_dcid = 1; 1375 break; 1376 1377 case QUIC_TPARAM_RETRY_SCID: 1378 if (ch->is_server) { 1379 reason = TP_REASON_SERVER_ONLY("RETRY_SCID"); 1380 goto malformed; 1381 } 1382 1383 if (got_retry_scid) { 1384 reason = TP_REASON_DUP("RETRY_SCID"); 1385 goto malformed; 1386 } 1387 1388 if (!ch->doing_retry) { 1389 reason = TP_REASON_NOT_RETRY("RETRY_SCID"); 1390 goto malformed; 1391 } 1392 1393 if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) { 1394 reason = TP_REASON_MALFORMED("RETRY_SCID"); 1395 goto malformed; 1396 } 1397 1398 /* Must match Retry packet SCID. */ 1399 if (!ossl_quic_conn_id_eq(&ch->retry_scid, &cid)) { 1400 reason = TP_REASON_EXPECTED_VALUE("RETRY_SCID"); 1401 goto malformed; 1402 } 1403 1404 got_retry_scid = 1; 1405 break; 1406 1407 case QUIC_TPARAM_INITIAL_SCID: 1408 if (got_initial_scid) { 1409 /* must not appear more than once */ 1410 reason = TP_REASON_DUP("INITIAL_SCID"); 1411 goto malformed; 1412 } 1413 1414 if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) { 1415 reason = TP_REASON_MALFORMED("INITIAL_SCID"); 1416 goto malformed; 1417 } 1418 1419 if (!ossl_quic_conn_id_eq(&ch->init_scid, &cid)) { 1420 reason = TP_REASON_EXPECTED_VALUE("INITIAL_SCID"); 1421 goto malformed; 1422 } 1423 1424 got_initial_scid = 1; 1425 break; 1426 1427 case QUIC_TPARAM_INITIAL_MAX_DATA: 1428 if (got_initial_max_data) { 1429 /* must not appear more than once */ 1430 reason = TP_REASON_DUP("INITIAL_MAX_DATA"); 1431 goto malformed; 1432 } 1433 1434 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) { 1435 reason = TP_REASON_MALFORMED("INITIAL_MAX_DATA"); 1436 goto malformed; 1437 } 1438 1439 ossl_quic_txfc_bump_cwm(&ch->conn_txfc, v); 1440 got_initial_max_data = 1; 1441 break; 1442 1443 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL: 1444 if (got_initial_max_stream_data_bidi_local) { 1445 /* must not appear more than once */ 1446 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL"); 1447 goto malformed; 1448 } 1449 1450 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) { 1451 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL"); 1452 goto malformed; 1453 } 1454 1455 /* 1456 * This is correct; the BIDI_LOCAL TP governs streams created by 1457 * the endpoint which sends the TP, i.e., our peer. 1458 */ 1459 ch->rx_init_max_stream_data_bidi_remote = v; 1460 got_initial_max_stream_data_bidi_local = 1; 1461 break; 1462 1463 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE: 1464 if (got_initial_max_stream_data_bidi_remote) { 1465 /* must not appear more than once */ 1466 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE"); 1467 goto malformed; 1468 } 1469 1470 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) { 1471 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE"); 1472 goto malformed; 1473 } 1474 1475 /* 1476 * This is correct; the BIDI_REMOTE TP governs streams created 1477 * by the endpoint which receives the TP, i.e., us. 1478 */ 1479 ch->rx_init_max_stream_data_bidi_local = v; 1480 1481 /* Apply to all existing streams. */ 1482 ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_bidi, &v); 1483 got_initial_max_stream_data_bidi_remote = 1; 1484 break; 1485 1486 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI: 1487 if (got_initial_max_stream_data_uni) { 1488 /* must not appear more than once */ 1489 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_UNI"); 1490 goto malformed; 1491 } 1492 1493 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) { 1494 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_UNI"); 1495 goto malformed; 1496 } 1497 1498 ch->rx_init_max_stream_data_uni = v; 1499 1500 /* Apply to all existing streams. */ 1501 ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_uni, &v); 1502 got_initial_max_stream_data_uni = 1; 1503 break; 1504 1505 case QUIC_TPARAM_ACK_DELAY_EXP: 1506 if (got_ack_delay_exp) { 1507 /* must not appear more than once */ 1508 reason = TP_REASON_DUP("ACK_DELAY_EXP"); 1509 goto malformed; 1510 } 1511 1512 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v) 1513 || v > QUIC_MAX_ACK_DELAY_EXP) { 1514 reason = TP_REASON_MALFORMED("ACK_DELAY_EXP"); 1515 goto malformed; 1516 } 1517 1518 ch->rx_ack_delay_exp = (unsigned char)v; 1519 got_ack_delay_exp = 1; 1520 break; 1521 1522 case QUIC_TPARAM_MAX_ACK_DELAY: 1523 if (got_max_ack_delay) { 1524 /* must not appear more than once */ 1525 reason = TP_REASON_DUP("MAX_ACK_DELAY"); 1526 goto malformed; 1527 } 1528 1529 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v) 1530 || v >= (((uint64_t)1) << 14)) { 1531 reason = TP_REASON_MALFORMED("MAX_ACK_DELAY"); 1532 goto malformed; 1533 } 1534 1535 ch->rx_max_ack_delay = v; 1536 ossl_ackm_set_rx_max_ack_delay(ch->ackm, 1537 ossl_ms2time(ch->rx_max_ack_delay)); 1538 1539 got_max_ack_delay = 1; 1540 break; 1541 1542 case QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI: 1543 if (got_initial_max_streams_bidi) { 1544 /* must not appear more than once */ 1545 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_BIDI"); 1546 goto malformed; 1547 } 1548 1549 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v) 1550 || v > (((uint64_t)1) << 60)) { 1551 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_BIDI"); 1552 goto malformed; 1553 } 1554 1555 assert(ch->max_local_streams_bidi == 0); 1556 ch->max_local_streams_bidi = v; 1557 got_initial_max_streams_bidi = 1; 1558 break; 1559 1560 case QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI: 1561 if (got_initial_max_streams_uni) { 1562 /* must not appear more than once */ 1563 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_UNI"); 1564 goto malformed; 1565 } 1566 1567 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v) 1568 || v > (((uint64_t)1) << 60)) { 1569 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_UNI"); 1570 goto malformed; 1571 } 1572 1573 assert(ch->max_local_streams_uni == 0); 1574 ch->max_local_streams_uni = v; 1575 got_initial_max_streams_uni = 1; 1576 break; 1577 1578 case QUIC_TPARAM_MAX_IDLE_TIMEOUT: 1579 if (got_max_idle_timeout) { 1580 /* must not appear more than once */ 1581 reason = TP_REASON_DUP("MAX_IDLE_TIMEOUT"); 1582 goto malformed; 1583 } 1584 1585 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) { 1586 reason = TP_REASON_MALFORMED("MAX_IDLE_TIMEOUT"); 1587 goto malformed; 1588 } 1589 1590 ch->max_idle_timeout_remote_req = v; 1591 1592 ch->max_idle_timeout = min_u64_ignore_0(ch->max_idle_timeout_local_req, 1593 ch->max_idle_timeout_remote_req); 1594 1595 1596 ch_update_idle(ch); 1597 got_max_idle_timeout = 1; 1598 rx_max_idle_timeout = v; 1599 break; 1600 1601 case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE: 1602 if (got_max_udp_payload_size) { 1603 /* must not appear more than once */ 1604 reason = TP_REASON_DUP("MAX_UDP_PAYLOAD_SIZE"); 1605 goto malformed; 1606 } 1607 1608 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v) 1609 || v < QUIC_MIN_INITIAL_DGRAM_LEN) { 1610 reason = TP_REASON_MALFORMED("MAX_UDP_PAYLOAD_SIZE"); 1611 goto malformed; 1612 } 1613 1614 ch->rx_max_udp_payload_size = v; 1615 got_max_udp_payload_size = 1; 1616 break; 1617 1618 case QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT: 1619 if (got_active_conn_id_limit) { 1620 /* must not appear more than once */ 1621 reason = TP_REASON_DUP("ACTIVE_CONN_ID_LIMIT"); 1622 goto malformed; 1623 } 1624 1625 if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v) 1626 || v < QUIC_MIN_ACTIVE_CONN_ID_LIMIT) { 1627 reason = TP_REASON_MALFORMED("ACTIVE_CONN_ID_LIMIT"); 1628 goto malformed; 1629 } 1630 1631 ch->rx_active_conn_id_limit = v; 1632 got_active_conn_id_limit = 1; 1633 break; 1634 1635 case QUIC_TPARAM_STATELESS_RESET_TOKEN: 1636 if (got_stateless_reset_token) { 1637 reason = TP_REASON_DUP("STATELESS_RESET_TOKEN"); 1638 goto malformed; 1639 } 1640 1641 /* 1642 * RFC 9000 s. 18.2: This transport parameter MUST NOT be sent 1643 * by a client but MAY be sent by a server. 1644 */ 1645 if (ch->is_server) { 1646 reason = TP_REASON_SERVER_ONLY("STATELESS_RESET_TOKEN"); 1647 goto malformed; 1648 } 1649 1650 body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len); 1651 if (body == NULL || len != QUIC_STATELESS_RESET_TOKEN_LEN) { 1652 reason = TP_REASON_MALFORMED("STATELESS_RESET_TOKEN"); 1653 goto malformed; 1654 } 1655 if (!ossl_quic_srtm_add(ch->srtm, ch, ch->cur_remote_seq_num, 1656 (const QUIC_STATELESS_RESET_TOKEN *)body)) { 1657 reason = TP_REASON_INTERNAL_ERROR("STATELESS_RESET_TOKEN"); 1658 goto malformed; 1659 } 1660 1661 stateless_reset_token_p = body; 1662 got_stateless_reset_token = 1; 1663 break; 1664 1665 case QUIC_TPARAM_PREFERRED_ADDR: 1666 /* TODO(QUIC FUTURE): Handle preferred address. */ 1667 if (got_preferred_addr) { 1668 reason = TP_REASON_DUP("PREFERRED_ADDR"); 1669 goto malformed; 1670 } 1671 1672 /* 1673 * RFC 9000 s. 18.2: "A server that chooses a zero-length 1674 * connection ID MUST NOT provide a preferred address. 1675 * Similarly, a server MUST NOT include a zero-length connection 1676 * ID in this transport parameter. A client MUST treat a 1677 * violation of these requirements as a connection error of type 1678 * TRANSPORT_PARAMETER_ERROR." 1679 */ 1680 if (ch->is_server) { 1681 reason = TP_REASON_SERVER_ONLY("PREFERRED_ADDR"); 1682 goto malformed; 1683 } 1684 1685 if (ch->cur_remote_dcid.id_len == 0) { 1686 reason = "PREFERRED_ADDR provided for zero-length CID"; 1687 goto malformed; 1688 } 1689 1690 if (!ossl_quic_wire_decode_transport_param_preferred_addr(&pkt, &pfa)) { 1691 reason = TP_REASON_MALFORMED("PREFERRED_ADDR"); 1692 goto malformed; 1693 } 1694 1695 if (pfa.cid.id_len == 0) { 1696 reason = "zero-length CID in PREFERRED_ADDR"; 1697 goto malformed; 1698 } 1699 1700 got_preferred_addr = 1; 1701 break; 1702 1703 case QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION: 1704 /* We do not currently handle migration, so nothing to do. */ 1705 if (got_disable_active_migration) { 1706 /* must not appear more than once */ 1707 reason = TP_REASON_DUP("DISABLE_ACTIVE_MIGRATION"); 1708 goto malformed; 1709 } 1710 1711 body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len); 1712 if (body == NULL || len > 0) { 1713 reason = TP_REASON_MALFORMED("DISABLE_ACTIVE_MIGRATION"); 1714 goto malformed; 1715 } 1716 1717 got_disable_active_migration = 1; 1718 break; 1719 1720 default: 1721 /* 1722 * Skip over and ignore. 1723 * 1724 * RFC 9000 s. 7.4: We SHOULD treat duplicated transport parameters 1725 * as a connection error, but we are not required to. Currently, 1726 * handle this programmatically by checking for duplicates in the 1727 * parameters that we recognise, as above, but don't bother 1728 * maintaining a list of duplicates for anything we don't recognise. 1729 */ 1730 body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, 1731 &len); 1732 if (body == NULL) 1733 goto malformed; 1734 1735 break; 1736 } 1737 } 1738 1739 if (!got_initial_scid) { 1740 reason = TP_REASON_REQUIRED("INITIAL_SCID"); 1741 goto malformed; 1742 } 1743 1744 if (!ch->is_server) { 1745 if (!got_orig_dcid) { 1746 reason = TP_REASON_REQUIRED("ORIG_DCID"); 1747 goto malformed; 1748 } 1749 1750 if (ch->doing_retry && !got_retry_scid) { 1751 reason = TP_REASON_REQUIRED("RETRY_SCID"); 1752 goto malformed; 1753 } 1754 } 1755 1756 ch->got_remote_transport_params = 1; 1757 1758 #ifndef OPENSSL_NO_QLOG 1759 QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set) 1760 QLOG_STR("owner", "remote"); 1761 1762 if (got_orig_dcid) 1763 QLOG_CID("original_destination_connection_id", 1764 &ch->init_dcid); 1765 if (got_initial_scid) 1766 QLOG_CID("original_source_connection_id", 1767 &ch->init_dcid); 1768 if (got_retry_scid) 1769 QLOG_CID("retry_source_connection_id", 1770 &ch->retry_scid); 1771 if (got_initial_max_data) 1772 QLOG_U64("initial_max_data", 1773 ossl_quic_txfc_get_cwm(&ch->conn_txfc)); 1774 if (got_initial_max_stream_data_bidi_local) 1775 QLOG_U64("initial_max_stream_data_bidi_local", 1776 ch->rx_init_max_stream_data_bidi_local); 1777 if (got_initial_max_stream_data_bidi_remote) 1778 QLOG_U64("initial_max_stream_data_bidi_remote", 1779 ch->rx_init_max_stream_data_bidi_remote); 1780 if (got_initial_max_stream_data_uni) 1781 QLOG_U64("initial_max_stream_data_uni", 1782 ch->rx_init_max_stream_data_uni); 1783 if (got_initial_max_streams_bidi) 1784 QLOG_U64("initial_max_streams_bidi", 1785 ch->max_local_streams_bidi); 1786 if (got_initial_max_streams_uni) 1787 QLOG_U64("initial_max_streams_uni", 1788 ch->max_local_streams_uni); 1789 if (got_ack_delay_exp) 1790 QLOG_U64("ack_delay_exponent", ch->rx_ack_delay_exp); 1791 if (got_max_ack_delay) 1792 QLOG_U64("max_ack_delay", ch->rx_max_ack_delay); 1793 if (got_max_udp_payload_size) 1794 QLOG_U64("max_udp_payload_size", ch->rx_max_udp_payload_size); 1795 if (got_max_idle_timeout) 1796 QLOG_U64("max_idle_timeout", rx_max_idle_timeout); 1797 if (got_active_conn_id_limit) 1798 QLOG_U64("active_connection_id_limit", ch->rx_active_conn_id_limit); 1799 if (got_stateless_reset_token) 1800 QLOG_BIN("stateless_reset_token", stateless_reset_token_p, 1801 QUIC_STATELESS_RESET_TOKEN_LEN); 1802 if (got_preferred_addr) { 1803 QLOG_BEGIN("preferred_addr") 1804 QLOG_U64("port_v4", pfa.ipv4_port); 1805 QLOG_U64("port_v6", pfa.ipv6_port); 1806 QLOG_BIN("ip_v4", pfa.ipv4, sizeof(pfa.ipv4)); 1807 QLOG_BIN("ip_v6", pfa.ipv6, sizeof(pfa.ipv6)); 1808 QLOG_BIN("stateless_reset_token", pfa.stateless_reset.token, 1809 sizeof(pfa.stateless_reset.token)); 1810 QLOG_CID("connection_id", &pfa.cid); 1811 QLOG_END() 1812 } 1813 QLOG_BOOL("disable_active_migration", got_disable_active_migration); 1814 QLOG_EVENT_END() 1815 #endif 1816 1817 if (got_initial_max_data || got_initial_max_stream_data_bidi_remote 1818 || got_initial_max_streams_bidi || got_initial_max_streams_uni) 1819 /* 1820 * If FC credit was bumped, we may now be able to send. Update all 1821 * streams. 1822 */ 1823 ossl_quic_stream_map_visit(&ch->qsm, do_update, ch); 1824 1825 /* If we are a server, we now generate our own transport parameters. */ 1826 if (ch->is_server && !ch_generate_transport_params(ch)) { 1827 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0, 1828 "internal error"); 1829 return 0; 1830 } 1831 1832 return 1; 1833 1834 malformed: 1835 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_TRANSPORT_PARAMETER_ERROR, 1836 0, reason); 1837 return 0; 1838 } 1839 1840 /* 1841 * Called when we want to generate transport parameters. This is called 1842 * immediately at instantiation time for a client and after we receive the 1843 * client's transport parameters for a server. 1844 */ 1845 static int ch_generate_transport_params(QUIC_CHANNEL *ch) 1846 { 1847 int ok = 0; 1848 BUF_MEM *buf_mem = NULL; 1849 WPACKET wpkt; 1850 int wpkt_valid = 0; 1851 size_t buf_len = 0; 1852 QUIC_CONN_ID *id_to_use = NULL; 1853 1854 /* 1855 * We need to select which connection id to encode in the 1856 * QUIC_TPARAM_ORIG_DCID transport parameter 1857 * If we have an odcid, then this connection was established 1858 * in response to a retry request, and we need to use the connection 1859 * id sent in the first initial packet. 1860 * If we don't have an odcid, then this connection was established 1861 * without a retry and the init_dcid is the connection we should use 1862 */ 1863 if (ch->odcid.id_len == 0) 1864 id_to_use = &ch->init_dcid; 1865 else 1866 id_to_use = &ch->odcid; 1867 1868 if (ch->local_transport_params != NULL || ch->got_local_transport_params) 1869 goto err; 1870 1871 if ((buf_mem = BUF_MEM_new()) == NULL) 1872 goto err; 1873 1874 if (!WPACKET_init(&wpkt, buf_mem)) 1875 goto err; 1876 1877 wpkt_valid = 1; 1878 1879 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt, QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION, 1880 NULL, 0) == NULL) 1881 goto err; 1882 1883 if (ch->is_server) { 1884 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_ORIG_DCID, 1885 id_to_use)) 1886 goto err; 1887 1888 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_INITIAL_SCID, 1889 &ch->cur_local_cid)) 1890 goto err; 1891 if (ch->odcid.id_len != 0) 1892 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, 1893 QUIC_TPARAM_RETRY_SCID, 1894 &ch->init_dcid)) 1895 goto err; 1896 } else { 1897 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_INITIAL_SCID, 1898 &ch->init_scid)) 1899 goto err; 1900 } 1901 1902 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_IDLE_TIMEOUT, 1903 ch->max_idle_timeout_local_req)) 1904 goto err; 1905 1906 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE, 1907 QUIC_MIN_INITIAL_DGRAM_LEN)) 1908 goto err; 1909 1910 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT, 1911 QUIC_MIN_ACTIVE_CONN_ID_LIMIT)) 1912 goto err; 1913 1914 if (ch->tx_max_ack_delay != QUIC_DEFAULT_MAX_ACK_DELAY 1915 && !ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_ACK_DELAY, 1916 ch->tx_max_ack_delay)) 1917 goto err; 1918 1919 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_DATA, 1920 ossl_quic_rxfc_get_cwm(&ch->conn_rxfc))) 1921 goto err; 1922 1923 /* Send the default CWM for a new RXFC. */ 1924 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL, 1925 ch->tx_init_max_stream_data_bidi_local)) 1926 goto err; 1927 1928 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE, 1929 ch->tx_init_max_stream_data_bidi_remote)) 1930 goto err; 1931 1932 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI, 1933 ch->tx_init_max_stream_data_uni)) 1934 goto err; 1935 1936 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI, 1937 ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc))) 1938 goto err; 1939 1940 if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI, 1941 ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc))) 1942 goto err; 1943 1944 if (!WPACKET_finish(&wpkt)) 1945 goto err; 1946 1947 wpkt_valid = 0; 1948 1949 if (!WPACKET_get_total_written(&wpkt, &buf_len)) 1950 goto err; 1951 1952 ch->local_transport_params = (unsigned char *)buf_mem->data; 1953 buf_mem->data = NULL; 1954 1955 if (!ossl_quic_tls_set_transport_params(ch->qtls, ch->local_transport_params, 1956 buf_len)) 1957 goto err; 1958 1959 #ifndef OPENSSL_NO_QLOG 1960 QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set) 1961 QLOG_STR("owner", "local"); 1962 QLOG_BOOL("disable_active_migration", 1); 1963 if (ch->is_server) { 1964 QLOG_CID("original_destination_connection_id", &ch->init_dcid); 1965 QLOG_CID("initial_source_connection_id", &ch->cur_local_cid); 1966 } else { 1967 QLOG_STR("initial_source_connection_id", ""); 1968 } 1969 QLOG_U64("max_idle_timeout", ch->max_idle_timeout); 1970 QLOG_U64("max_udp_payload_size", QUIC_MIN_INITIAL_DGRAM_LEN); 1971 QLOG_U64("active_connection_id_limit", QUIC_MIN_ACTIVE_CONN_ID_LIMIT); 1972 QLOG_U64("max_ack_delay", ch->tx_max_ack_delay); 1973 QLOG_U64("initial_max_data", ossl_quic_rxfc_get_cwm(&ch->conn_rxfc)); 1974 QLOG_U64("initial_max_stream_data_bidi_local", 1975 ch->tx_init_max_stream_data_bidi_local); 1976 QLOG_U64("initial_max_stream_data_bidi_remote", 1977 ch->tx_init_max_stream_data_bidi_remote); 1978 QLOG_U64("initial_max_stream_data_uni", 1979 ch->tx_init_max_stream_data_uni); 1980 QLOG_U64("initial_max_streams_bidi", 1981 ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc)); 1982 QLOG_U64("initial_max_streams_uni", 1983 ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc)); 1984 QLOG_EVENT_END() 1985 #endif 1986 1987 ch->got_local_transport_params = 1; 1988 1989 ok = 1; 1990 err: 1991 if (wpkt_valid) 1992 WPACKET_cleanup(&wpkt); 1993 BUF_MEM_free(buf_mem); 1994 return ok; 1995 } 1996 1997 /* 1998 * QUIC Channel: Ticker-Mutator 1999 * ============================ 2000 */ 2001 2002 /* 2003 * The central ticker function called by the reactor. This does everything, or 2004 * at least everything network I/O related. Best effort - not allowed to fail 2005 * "loudly". 2006 */ 2007 void ossl_quic_channel_subtick(QUIC_CHANNEL *ch, QUIC_TICK_RESULT *res, 2008 uint32_t flags) 2009 { 2010 OSSL_TIME now, deadline; 2011 int channel_only = (flags & QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY) != 0; 2012 int notify_other_threads = 0; 2013 2014 /* 2015 * When we tick the QUIC connection, we do everything we need to do 2016 * periodically. Network I/O handling will already have been performed 2017 * as necessary by the QUIC port. Thus, in order, we: 2018 * 2019 * - handle any packets the DEMUX has queued up for us; 2020 * - handle any timer events which are due to fire (ACKM, etc.); 2021 * - generate any packets which need to be sent; 2022 * - determine the time at which we should next be ticked. 2023 */ 2024 2025 /* 2026 * If the connection has not yet started, or we are in the TERMINATED state, 2027 * there is nothing to do. 2028 */ 2029 if (ch->state == QUIC_CHANNEL_STATE_IDLE 2030 || ossl_quic_channel_is_terminated(ch)) { 2031 res->net_read_desired = 0; 2032 res->net_write_desired = 0; 2033 res->notify_other_threads = 0; 2034 res->tick_deadline = ossl_time_infinite(); 2035 return; 2036 } 2037 2038 /* 2039 * If we are in the TERMINATING state, check if the terminating timer has 2040 * expired. 2041 */ 2042 if (ossl_quic_channel_is_terminating(ch)) { 2043 now = get_time(ch); 2044 2045 if (ossl_time_compare(now, ch->terminate_deadline) >= 0) { 2046 ch_on_terminating_timeout(ch); 2047 res->net_read_desired = 0; 2048 res->net_write_desired = 0; 2049 res->notify_other_threads = 1; 2050 res->tick_deadline = ossl_time_infinite(); 2051 return; /* abort normal processing, nothing to do */ 2052 } 2053 } 2054 2055 if (!ch->port->engine->inhibit_tick) { 2056 /* Handle RXKU timeouts. */ 2057 ch_rxku_tick(ch); 2058 2059 do { 2060 /* Process queued incoming packets. */ 2061 ch->did_tls_tick = 0; 2062 ch->have_new_rx_secret = 0; 2063 ch_rx(ch, channel_only, ¬ify_other_threads); 2064 2065 /* 2066 * Allow the handshake layer to check for any new incoming data and 2067 * generate new outgoing data. 2068 */ 2069 if (!ch->did_tls_tick) 2070 ch_tick_tls(ch, channel_only, ¬ify_other_threads); 2071 2072 /* 2073 * If the handshake layer gave us a new secret, we need to do RX 2074 * again because packets that were not previously processable and 2075 * were deferred might now be processable. 2076 * 2077 * TODO(QUIC FUTURE): Consider handling this in the yield_secret callback. 2078 */ 2079 } while (ch->have_new_rx_secret); 2080 } 2081 2082 /* 2083 * Handle any timer events which are due to fire; namely, the loss 2084 * detection deadline and the idle timeout. 2085 * 2086 * ACKM ACK generation deadline is polled by TXP, so we don't need to 2087 * handle it here. 2088 */ 2089 now = get_time(ch); 2090 if (ossl_time_compare(now, ch->idle_deadline) >= 0) { 2091 /* 2092 * Idle timeout differs from normal protocol violation because we do 2093 * not send a CONN_CLOSE frame; go straight to TERMINATED. 2094 */ 2095 if (!ch->port->engine->inhibit_tick) 2096 ch_on_idle_timeout(ch); 2097 2098 res->net_read_desired = 0; 2099 res->net_write_desired = 0; 2100 res->notify_other_threads = 1; 2101 res->tick_deadline = ossl_time_infinite(); 2102 return; 2103 } 2104 2105 if (!ch->port->engine->inhibit_tick) { 2106 deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm); 2107 if (!ossl_time_is_zero(deadline) 2108 && ossl_time_compare(now, deadline) >= 0) 2109 ossl_ackm_on_timeout(ch->ackm); 2110 2111 /* If a ping is due, inform TXP. */ 2112 if (ossl_time_compare(now, ch->ping_deadline) >= 0) { 2113 int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level); 2114 2115 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space); 2116 2117 /* 2118 * If we have no CC budget at this time we cannot process the above 2119 * PING request immediately. In any case we have scheduled the 2120 * request so bump the ping deadline. If we don't do this we will 2121 * busy-loop endlessly as the above deadline comparison condition 2122 * will still be met. 2123 */ 2124 ch_update_ping_deadline(ch); 2125 } 2126 2127 /* Queue any data to be sent for transmission. */ 2128 ch_tx(ch, ¬ify_other_threads); 2129 2130 /* Do stream GC. */ 2131 ossl_quic_stream_map_gc(&ch->qsm); 2132 } 2133 2134 /* Determine the time at which we should next be ticked. */ 2135 res->tick_deadline = ch_determine_next_tick_deadline(ch); 2136 2137 /* 2138 * Always process network input unless we are now terminated. Although we 2139 * had not terminated at the beginning of this tick, network errors in 2140 * ch_tx() may have caused us to transition to the Terminated state. 2141 */ 2142 res->net_read_desired = !ossl_quic_channel_is_terminated(ch); 2143 2144 /* We want to write to the network if we have any data in our TX queue. */ 2145 res->net_write_desired 2146 = (!ossl_quic_channel_is_terminated(ch) 2147 && ossl_qtx_get_queue_len_datagrams(ch->qtx) > 0); 2148 2149 res->notify_other_threads = notify_other_threads; 2150 } 2151 2152 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only, int *notify_other_threads) 2153 { 2154 uint64_t error_code; 2155 const char *error_msg; 2156 ERR_STATE *error_state = NULL; 2157 2158 if (channel_only) 2159 return 1; 2160 2161 ch->did_tls_tick = 1; 2162 ossl_quic_tls_tick(ch->qtls); 2163 2164 if (ossl_quic_tls_get_error(ch->qtls, &error_code, &error_msg, 2165 &error_state)) { 2166 ossl_quic_channel_raise_protocol_error_state(ch, error_code, 0, 2167 error_msg, error_state); 2168 if (notify_other_threads != NULL) 2169 *notify_other_threads = 1; 2170 2171 return 0; 2172 } 2173 2174 return 1; 2175 } 2176 2177 /* Check incoming forged packet limit and terminate connection if needed. */ 2178 static void ch_rx_check_forged_pkt_limit(QUIC_CHANNEL *ch) 2179 { 2180 uint32_t enc_level; 2181 uint64_t limit = UINT64_MAX, l; 2182 2183 for (enc_level = QUIC_ENC_LEVEL_INITIAL; 2184 enc_level < QUIC_ENC_LEVEL_NUM; 2185 ++enc_level) 2186 { 2187 /* 2188 * Different ELs can have different AEADs which can in turn impose 2189 * different limits, so use the lowest value of any currently valid EL. 2190 */ 2191 if ((ch->el_discarded & (1U << enc_level)) != 0) 2192 continue; 2193 2194 if (enc_level > ch->rx_enc_level) 2195 break; 2196 2197 l = ossl_qrx_get_max_forged_pkt_count(ch->qrx, enc_level); 2198 if (l < limit) 2199 limit = l; 2200 } 2201 2202 if (ossl_qrx_get_cur_forged_pkt_count(ch->qrx) < limit) 2203 return; 2204 2205 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_AEAD_LIMIT_REACHED, 0, 2206 "forgery limit"); 2207 } 2208 2209 /* Process queued incoming packets and handle frames, if any. */ 2210 static int ch_rx(QUIC_CHANNEL *ch, int channel_only, int *notify_other_threads) 2211 { 2212 int handled_any = 0; 2213 const int closing = ossl_quic_channel_is_closing(ch); 2214 2215 if (!ch->is_server && !ch->have_sent_any_pkt) 2216 /* 2217 * We have not sent anything yet, therefore there is no need to check 2218 * for incoming data. 2219 */ 2220 return 1; 2221 2222 for (;;) { 2223 assert(ch->qrx_pkt == NULL); 2224 2225 if (!ossl_qrx_read_pkt(ch->qrx, &ch->qrx_pkt)) 2226 break; 2227 2228 /* Track the amount of data received while in the closing state */ 2229 if (closing) 2230 ossl_quic_tx_packetiser_record_received_closing_bytes( 2231 ch->txp, ch->qrx_pkt->hdr->len); 2232 2233 if (!handled_any) { 2234 ch_update_idle(ch); 2235 ch_update_ping_deadline(ch); 2236 } 2237 2238 ch_rx_handle_packet(ch, channel_only); /* best effort */ 2239 2240 /* 2241 * Regardless of the outcome of frame handling, unref the packet. 2242 * This will free the packet unless something added another 2243 * reference to it during frame processing. 2244 */ 2245 ossl_qrx_pkt_release(ch->qrx_pkt); 2246 ch->qrx_pkt = NULL; 2247 2248 ch->have_sent_ack_eliciting_since_rx = 0; 2249 handled_any = 1; 2250 } 2251 2252 ch_rx_check_forged_pkt_limit(ch); 2253 2254 if (handled_any && notify_other_threads != NULL) 2255 *notify_other_threads = 1; 2256 2257 /* 2258 * When in TERMINATING - CLOSING, generate a CONN_CLOSE frame whenever we 2259 * process one or more incoming packets. 2260 */ 2261 if (handled_any && closing) 2262 ch->conn_close_queued = 1; 2263 2264 return 1; 2265 } 2266 2267 static int bio_addr_eq(const BIO_ADDR *a, const BIO_ADDR *b) 2268 { 2269 if (BIO_ADDR_family(a) != BIO_ADDR_family(b)) 2270 return 0; 2271 2272 switch (BIO_ADDR_family(a)) { 2273 case AF_INET: 2274 return !memcmp(&a->s_in.sin_addr, 2275 &b->s_in.sin_addr, 2276 sizeof(a->s_in.sin_addr)) 2277 && a->s_in.sin_port == b->s_in.sin_port; 2278 #if OPENSSL_USE_IPV6 2279 case AF_INET6: 2280 return !memcmp(&a->s_in6.sin6_addr, 2281 &b->s_in6.sin6_addr, 2282 sizeof(a->s_in6.sin6_addr)) 2283 && a->s_in6.sin6_port == b->s_in6.sin6_port; 2284 #endif 2285 default: 2286 return 0; /* not supported */ 2287 } 2288 2289 return 1; 2290 } 2291 2292 /* Handles the packet currently in ch->qrx_pkt->hdr. */ 2293 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only) 2294 { 2295 uint32_t enc_level; 2296 int old_have_processed_any_pkt = ch->have_processed_any_pkt; 2297 OSSL_QTX_IOVEC iovec; 2298 PACKET vpkt; 2299 unsigned long supported_ver; 2300 2301 assert(ch->qrx_pkt != NULL); 2302 2303 /* 2304 * RFC 9000 s. 10.2.1 Closing Connection State: 2305 * An endpoint that is closing is not required to process any 2306 * received frame. 2307 */ 2308 if (!ossl_quic_channel_is_active(ch)) 2309 return; 2310 2311 if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)) { 2312 if (!ch->have_received_enc_pkt) { 2313 ch->cur_remote_dcid = ch->init_scid = ch->qrx_pkt->hdr->src_conn_id; 2314 ch->have_received_enc_pkt = 1; 2315 2316 /* 2317 * We change to using the SCID in the first Initial packet as the 2318 * DCID. 2319 */ 2320 ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->init_scid); 2321 } 2322 2323 enc_level = ossl_quic_pkt_type_to_enc_level(ch->qrx_pkt->hdr->type); 2324 if ((ch->el_discarded & (1U << enc_level)) != 0) 2325 /* Do not process packets from ELs we have already discarded. */ 2326 return; 2327 } 2328 2329 /* 2330 * RFC 9000 s. 9.6: "If a client receives packets from a new server address 2331 * when the client has not initiated a migration to that address, the client 2332 * SHOULD discard these packets." 2333 * 2334 * We need to be a bit careful here as due to the BIO abstraction layer an 2335 * application is liable to be weird and lie to us about peer addresses. 2336 * Only apply this check if we actually are using a real AF_INET or AF_INET6 2337 * address. 2338 */ 2339 if (!ch->is_server 2340 && ch->qrx_pkt->peer != NULL 2341 && ( 2342 BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET 2343 #if OPENSSL_USE_IPV6 2344 || BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET6 2345 #endif 2346 ) 2347 && !bio_addr_eq(ch->qrx_pkt->peer, &ch->cur_peer_addr)) 2348 return; 2349 2350 if (!ch->is_server 2351 && ch->have_received_enc_pkt 2352 && ossl_quic_pkt_type_has_scid(ch->qrx_pkt->hdr->type)) { 2353 /* 2354 * RFC 9000 s. 7.2: "Once a client has received a valid Initial packet 2355 * from the server, it MUST discard any subsequent packet it receives on 2356 * that connection with a different SCID." 2357 */ 2358 if (!ossl_quic_conn_id_eq(&ch->qrx_pkt->hdr->src_conn_id, 2359 &ch->init_scid)) 2360 return; 2361 } 2362 2363 if (ossl_quic_pkt_type_has_version(ch->qrx_pkt->hdr->type) 2364 && ch->qrx_pkt->hdr->version != QUIC_VERSION_1) 2365 /* 2366 * RFC 9000 s. 5.2.1: If a client receives a packet that uses a 2367 * different version than it initially selected, it MUST discard the 2368 * packet. We only ever use v1, so require it. 2369 */ 2370 return; 2371 2372 if (ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_VERSION_NEG) { 2373 2374 /* 2375 * Sanity check. Version negotiation packet MUST have a version 2376 * value of 0 according to the RFC. We must discard such packets 2377 */ 2378 if (ch->qrx_pkt->hdr->version != 0) 2379 return; 2380 2381 /* 2382 * RFC 9000 s. 6.2: If a client receives a version negotiation 2383 * packet, we need to do the following: 2384 * a) If the negotiation packet lists the version we initially sent 2385 * then we must abandon this connection attempt 2386 * b) We have to select a version from the list provided in the 2387 * version negotiation packet, and retry the connection attempt 2388 * in much the same way that ch_retry does, but we can reuse the 2389 * connection id values 2390 */ 2391 2392 if (old_have_processed_any_pkt == 1) { 2393 /* 2394 * We've gotten previous packets, need to discard this. 2395 */ 2396 return; 2397 } 2398 2399 /* 2400 * Indicate that we have processed a packet, as any subsequently 2401 * received version negotiation packet must be discarded above 2402 */ 2403 ch->have_processed_any_pkt = 1; 2404 2405 /* 2406 * Following the header, version negotiation packets 2407 * contain an array of 32 bit integers representing 2408 * the supported versions that the server honors 2409 * this array, bounded by the hdr->len field 2410 * needs to be traversed so that we can find a matching 2411 * version 2412 */ 2413 if (!PACKET_buf_init(&vpkt, ch->qrx_pkt->hdr->data, 2414 ch->qrx_pkt->hdr->len)) 2415 return; 2416 2417 while (PACKET_remaining(&vpkt) > 0) { 2418 /* 2419 * We only support quic version 1 at the moment, so 2420 * look to see if thats offered 2421 */ 2422 if (!PACKET_get_net_4(&vpkt, &supported_ver)) 2423 return; 2424 2425 supported_ver = ntohl(supported_ver); 2426 if (supported_ver == QUIC_VERSION_1) { 2427 /* 2428 * If the server supports version 1, set it as 2429 * the packetisers version 2430 */ 2431 ossl_quic_tx_packetiser_set_protocol_version(ch->txp, QUIC_VERSION_1); 2432 2433 /* 2434 * And then request a restart of the QUIC connection 2435 */ 2436 if (!ch_restart(ch)) 2437 ossl_quic_channel_raise_protocol_error(ch, 2438 OSSL_QUIC_ERR_INTERNAL_ERROR, 2439 0, "handling ver negotiation packet"); 2440 return; 2441 } 2442 } 2443 2444 /* 2445 * If we get here, then the server doesn't support a version of the 2446 * protocol that we can handle, abandon the connection 2447 */ 2448 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_CONNECTION_REFUSED, 2449 0, "unsupported protocol version"); 2450 return; 2451 } 2452 2453 ch->have_processed_any_pkt = 1; 2454 2455 /* 2456 * RFC 9000 s. 17.2: "An endpoint MUST treat receipt of a packet that has a 2457 * non-zero value for [the reserved bits] after removing both packet and 2458 * header protection as a connection error of type PROTOCOL_VIOLATION." 2459 */ 2460 if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type) 2461 && ch->qrx_pkt->hdr->reserved != 0) { 2462 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION, 2463 0, "packet header reserved bits"); 2464 return; 2465 } 2466 2467 iovec.buf = ch->qrx_pkt->hdr->data; 2468 iovec.buf_len = ch->qrx_pkt->hdr->len; 2469 ossl_qlog_event_transport_packet_received(ch_get_qlog(ch), ch->qrx_pkt->hdr, 2470 ch->qrx_pkt->pn, &iovec, 1, 2471 ch->qrx_pkt->datagram_id); 2472 2473 /* Handle incoming packet. */ 2474 switch (ch->qrx_pkt->hdr->type) { 2475 case QUIC_PKT_TYPE_RETRY: 2476 if (ch->doing_retry || ch->is_server) 2477 /* 2478 * It is not allowed to ask a client to do a retry more than 2479 * once. Clients may not send retries. 2480 */ 2481 return; 2482 2483 /* 2484 * RFC 9000 s 17.2.5.2: After the client has received and processed an 2485 * Initial or Retry packet from the server, it MUST discard any 2486 * subsequent Retry packets that it receives. 2487 */ 2488 if (ch->have_received_enc_pkt) 2489 return; 2490 2491 if (ch->qrx_pkt->hdr->len <= QUIC_RETRY_INTEGRITY_TAG_LEN) 2492 /* Packets with zero-length Retry Tokens are invalid. */ 2493 return; 2494 2495 /* 2496 * TODO(QUIC FUTURE): Theoretically this should probably be in the QRX. 2497 * However because validation is dependent on context (namely the 2498 * client's initial DCID) we can't do this cleanly. In the future we 2499 * should probably add a callback to the QRX to let it call us (via 2500 * the DEMUX) and ask us about the correct original DCID, rather 2501 * than allow the QRX to emit a potentially malformed packet to the 2502 * upper layers. However, special casing this will do for now. 2503 */ 2504 if (!ossl_quic_validate_retry_integrity_tag(ch->port->engine->libctx, 2505 ch->port->engine->propq, 2506 ch->qrx_pkt->hdr, 2507 &ch->init_dcid)) 2508 /* Malformed retry packet, ignore. */ 2509 return; 2510 2511 if (!ch_retry(ch, ch->qrx_pkt->hdr->data, 2512 ch->qrx_pkt->hdr->len - QUIC_RETRY_INTEGRITY_TAG_LEN, 2513 &ch->qrx_pkt->hdr->src_conn_id, old_have_processed_any_pkt)) 2514 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 2515 0, "handling retry packet"); 2516 break; 2517 2518 case QUIC_PKT_TYPE_0RTT: 2519 if (!ch->is_server) 2520 /* Clients should never receive 0-RTT packets. */ 2521 return; 2522 2523 /* 2524 * TODO(QUIC 0RTT): Implement 0-RTT on the server side. We currently 2525 * do not need to implement this as a client can only do 0-RTT if we 2526 * have given it permission to in a previous session. 2527 */ 2528 break; 2529 2530 case QUIC_PKT_TYPE_INITIAL: 2531 case QUIC_PKT_TYPE_HANDSHAKE: 2532 case QUIC_PKT_TYPE_1RTT: 2533 if (ch->is_server && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_HANDSHAKE) 2534 /* 2535 * We automatically drop INITIAL EL keys when first successfully 2536 * decrypting a HANDSHAKE packet, as per the RFC. 2537 */ 2538 ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL); 2539 2540 if (ch->rxku_in_progress 2541 && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_1RTT 2542 && ch->qrx_pkt->pn >= ch->rxku_trigger_pn 2543 && ch->qrx_pkt->key_epoch < ossl_qrx_get_key_epoch(ch->qrx)) { 2544 /* 2545 * RFC 9001 s. 6.4: Packets with higher packet numbers MUST be 2546 * protected with either the same or newer packet protection keys 2547 * than packets with lower packet numbers. An endpoint that 2548 * successfully removes protection with old keys when newer keys 2549 * were used for packets with lower packet numbers MUST treat this 2550 * as a connection error of type KEY_UPDATE_ERROR. 2551 */ 2552 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR, 2553 0, "new packet with old keys"); 2554 break; 2555 } 2556 2557 if (!ch->is_server 2558 && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_INITIAL 2559 && ch->qrx_pkt->hdr->token_len > 0) { 2560 /* 2561 * RFC 9000 s. 17.2.2: Clients that receive an Initial packet with a 2562 * non-zero Token Length field MUST either discard the packet or 2563 * generate a connection error of type PROTOCOL_VIOLATION. 2564 * 2565 * TODO(QUIC FUTURE): consider the implications of RFC 9000 s. 10.2.3 2566 * Immediate Close during the Handshake: 2567 * However, at the cost of reducing feedback about 2568 * errors for legitimate peers, some forms of denial of 2569 * service can be made more difficult for an attacker 2570 * if endpoints discard illegal packets rather than 2571 * terminating a connection with CONNECTION_CLOSE. For 2572 * this reason, endpoints MAY discard packets rather 2573 * than immediately close if errors are detected in 2574 * packets that lack authentication. 2575 * I.e. should we drop this packet instead of closing the connection? 2576 */ 2577 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION, 2578 0, "client received initial token"); 2579 break; 2580 } 2581 2582 /* This packet contains frames, pass to the RXDP. */ 2583 ossl_quic_handle_frames(ch, ch->qrx_pkt); /* best effort */ 2584 2585 if (ch->did_crypto_frame) 2586 ch_tick_tls(ch, channel_only, NULL); 2587 2588 break; 2589 2590 case QUIC_PKT_TYPE_VERSION_NEG: 2591 /* 2592 * "A client MUST discard any Version Negotiation packet if it has 2593 * received and successfully processed any other packet." 2594 */ 2595 if (!old_have_processed_any_pkt) 2596 ch_rx_handle_version_neg(ch, ch->qrx_pkt); 2597 2598 break; 2599 2600 default: 2601 assert(0); 2602 break; 2603 } 2604 2605 } 2606 2607 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt) 2608 { 2609 /* 2610 * We do not support version negotiation at this time. As per RFC 9000 s. 2611 * 6.2., we MUST abandon the connection attempt if we receive a Version 2612 * Negotiation packet, unless we have already successfully processed another 2613 * incoming packet, or the packet lists the QUIC version we want to use. 2614 */ 2615 PACKET vpkt; 2616 unsigned long v; 2617 2618 if (!PACKET_buf_init(&vpkt, pkt->hdr->data, pkt->hdr->len)) 2619 return; 2620 2621 while (PACKET_remaining(&vpkt) > 0) { 2622 if (!PACKET_get_net_4(&vpkt, &v)) 2623 break; 2624 2625 if ((uint32_t)v == QUIC_VERSION_1) 2626 return; 2627 } 2628 2629 /* No match, this is a failure case. */ 2630 ch_raise_version_neg_failure(ch); 2631 } 2632 2633 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch) 2634 { 2635 QUIC_TERMINATE_CAUSE tcause = {0}; 2636 2637 tcause.error_code = OSSL_QUIC_ERR_CONNECTION_REFUSED; 2638 tcause.reason = "version negotiation failure"; 2639 tcause.reason_len = strlen(tcause.reason); 2640 2641 /* 2642 * Skip TERMINATING state; this is not considered a protocol error and we do 2643 * not send CONNECTION_CLOSE. 2644 */ 2645 ch_start_terminating(ch, &tcause, 1); 2646 } 2647 2648 /* Try to generate packets and if possible, flush them to the network. */ 2649 static int ch_tx(QUIC_CHANNEL *ch, int *notify_other_threads) 2650 { 2651 QUIC_TXP_STATUS status; 2652 int res; 2653 2654 /* 2655 * RFC 9000 s. 10.2.2: Draining Connection State: 2656 * While otherwise identical to the closing state, an endpoint 2657 * in the draining state MUST NOT send any packets. 2658 * and: 2659 * An endpoint MUST NOT send further packets. 2660 */ 2661 if (ossl_quic_channel_is_draining(ch)) 2662 return 0; 2663 2664 if (ossl_quic_channel_is_closing(ch)) { 2665 /* 2666 * While closing, only send CONN_CLOSE if we've received more traffic 2667 * from the peer. Once we tell the TXP to generate CONN_CLOSE, all 2668 * future calls to it generate CONN_CLOSE frames, so otherwise we would 2669 * just constantly generate CONN_CLOSE frames. 2670 * 2671 * Confirming to RFC 9000 s. 10.2.1 Closing Connection State: 2672 * An endpoint SHOULD limit the rate at which it generates 2673 * packets in the closing state. 2674 */ 2675 if (!ch->conn_close_queued) 2676 return 0; 2677 2678 ch->conn_close_queued = 0; 2679 } 2680 2681 /* Do TXKU if we need to. */ 2682 ch_maybe_trigger_spontaneous_txku(ch); 2683 2684 ch->rxku_pending_confirm_done = 0; 2685 2686 /* Loop until we stop generating packets to send */ 2687 do { 2688 /* 2689 * Send packet, if we need to. Best effort. The TXP consults the CC and 2690 * applies any limitations imposed by it, so we don't need to do it here. 2691 * 2692 * Best effort. In particular if TXP fails for some reason we should 2693 * still flush any queued packets which we already generated. 2694 */ 2695 res = ossl_quic_tx_packetiser_generate(ch->txp, &status); 2696 if (status.sent_pkt > 0) { 2697 ch->have_sent_any_pkt = 1; /* Packet(s) were sent */ 2698 ch->port->have_sent_any_pkt = 1; 2699 2700 /* 2701 * RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when 2702 * sending an ack-eliciting packet if no other ack-eliciting packets 2703 * have been sent since last receiving and processing a packet.' 2704 */ 2705 if (status.sent_ack_eliciting 2706 && !ch->have_sent_ack_eliciting_since_rx) { 2707 ch_update_idle(ch); 2708 ch->have_sent_ack_eliciting_since_rx = 1; 2709 } 2710 2711 if (!ch->is_server && status.sent_handshake) 2712 /* 2713 * RFC 9001 s. 4.9.1: A client MUST discard Initial keys when it 2714 * first sends a Handshake packet. 2715 */ 2716 ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL); 2717 2718 if (ch->rxku_pending_confirm_done) 2719 ch->rxku_pending_confirm = 0; 2720 2721 ch_update_ping_deadline(ch); 2722 } 2723 2724 if (!res) { 2725 /* 2726 * One case where TXP can fail is if we reach a TX PN of 2**62 - 1. 2727 * As per RFC 9000 s. 12.3, if this happens we MUST close the 2728 * connection without sending a CONNECTION_CLOSE frame. This is 2729 * actually handled as an emergent consequence of our design, as the 2730 * TX packetiser will never transmit another packet when the TX PN 2731 * reaches the limit. 2732 * 2733 * Calling the below function terminates the connection; its attempt 2734 * to schedule a CONNECTION_CLOSE frame will not actually cause a 2735 * packet to be transmitted for this reason. 2736 */ 2737 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 2738 0, 2739 "internal error (txp generate)"); 2740 break; 2741 } 2742 } while (status.sent_pkt > 0); 2743 2744 /* Flush packets to network. */ 2745 switch (ossl_qtx_flush_net(ch->qtx)) { 2746 case QTX_FLUSH_NET_RES_OK: 2747 case QTX_FLUSH_NET_RES_TRANSIENT_FAIL: 2748 /* Best effort, done for now. */ 2749 break; 2750 2751 case QTX_FLUSH_NET_RES_PERMANENT_FAIL: 2752 default: 2753 /* Permanent underlying network BIO, start terminating. */ 2754 ossl_quic_port_raise_net_error(ch->port, ch); 2755 break; 2756 } 2757 2758 /* 2759 * If we have datagrams we have yet to successfully transmit, we need to 2760 * notify other threads so that they can switch to polling on POLLOUT as 2761 * well as POLLIN. 2762 */ 2763 if (ossl_qtx_get_queue_len_datagrams(ch->qtx) > 0) 2764 *notify_other_threads = 1; 2765 2766 return 1; 2767 } 2768 2769 /* Determine next tick deadline. */ 2770 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch) 2771 { 2772 OSSL_TIME deadline; 2773 int i; 2774 2775 if (ossl_quic_channel_is_terminated(ch)) 2776 return ossl_time_infinite(); 2777 2778 deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm); 2779 if (ossl_time_is_zero(deadline)) 2780 deadline = ossl_time_infinite(); 2781 2782 /* 2783 * Check the ack deadline for all enc_levels that are actually provisioned. 2784 * ACKs aren't restricted by CC. 2785 */ 2786 for (i = 0; i < QUIC_ENC_LEVEL_NUM; i++) { 2787 if (ossl_qtx_is_enc_level_provisioned(ch->qtx, i)) { 2788 deadline = ossl_time_min(deadline, 2789 ossl_ackm_get_ack_deadline(ch->ackm, 2790 ossl_quic_enc_level_to_pn_space(i))); 2791 } 2792 } 2793 2794 /* 2795 * When do we need to send an ACK-eliciting packet to reset the idle 2796 * deadline timer for the peer? 2797 */ 2798 if (!ossl_time_is_infinite(ch->ping_deadline)) 2799 deadline = ossl_time_min(deadline, ch->ping_deadline); 2800 2801 /* Apply TXP wakeup deadline. */ 2802 deadline = ossl_time_min(deadline, 2803 ossl_quic_tx_packetiser_get_deadline(ch->txp)); 2804 2805 /* Is the terminating timer armed? */ 2806 if (ossl_quic_channel_is_terminating(ch)) 2807 deadline = ossl_time_min(deadline, 2808 ch->terminate_deadline); 2809 else if (!ossl_time_is_infinite(ch->idle_deadline)) 2810 deadline = ossl_time_min(deadline, 2811 ch->idle_deadline); 2812 2813 /* When does the RXKU process complete? */ 2814 if (ch->rxku_in_progress) 2815 deadline = ossl_time_min(deadline, ch->rxku_update_end_deadline); 2816 2817 return deadline; 2818 } 2819 2820 /* 2821 * QUIC Channel: Lifecycle Events 2822 * ============================== 2823 */ 2824 2825 /* 2826 * Record a state transition. This is not necessarily a change to ch->state but 2827 * also includes the handshake becoming complete or confirmed, etc. 2828 */ 2829 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state) 2830 { 2831 uint32_t old_state = ch->state; 2832 2833 ch->state = new_state; 2834 2835 ossl_qlog_event_connectivity_connection_state_updated(ch_get_qlog(ch), 2836 old_state, 2837 new_state, 2838 ch->handshake_complete, 2839 ch->handshake_confirmed); 2840 } 2841 2842 static void free_peer_token(const unsigned char *token, 2843 size_t token_len, void *arg) 2844 { 2845 ossl_quic_free_peer_token((QUIC_TOKEN *)arg); 2846 } 2847 2848 int ossl_quic_channel_start(QUIC_CHANNEL *ch) 2849 { 2850 QUIC_TOKEN *token; 2851 2852 if (ch->is_server) 2853 /* 2854 * This is not used by the server. The server moves to active 2855 * automatically on receiving an incoming connection. 2856 */ 2857 return 0; 2858 2859 if (ch->state != QUIC_CHANNEL_STATE_IDLE) 2860 /* Calls to connect are idempotent */ 2861 return 1; 2862 2863 /* Inform QTX of peer address. */ 2864 if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr)) 2865 return 0; 2866 2867 /* 2868 * Look to see if we have a token, and if so, set it on the packetiser 2869 */ 2870 if (!ch->is_server 2871 && ossl_quic_get_peer_token(ch->port->channel_ctx, 2872 &ch->cur_peer_addr, 2873 &token) 2874 && !ossl_quic_tx_packetiser_set_initial_token(ch->txp, token->token, 2875 token->token_len, 2876 free_peer_token, 2877 token)) 2878 free_peer_token(NULL, 0, token); 2879 2880 /* Plug in secrets for the Initial EL. */ 2881 if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx, 2882 ch->port->engine->propq, 2883 &ch->init_dcid, 2884 ch->is_server, 2885 ch->qrx, ch->qtx)) 2886 return 0; 2887 2888 /* 2889 * Determine the QUIC Transport Parameters and serialize the transport 2890 * parameters block. (For servers, we do this later as we must defer 2891 * generation until we have received the client's transport parameters.) 2892 */ 2893 if (!ch->is_server && !ch->got_local_transport_params 2894 && !ch_generate_transport_params(ch)) 2895 return 0; 2896 2897 /* Change state. */ 2898 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE); 2899 ch->doing_proactive_ver_neg = 0; /* not currently supported */ 2900 2901 ossl_qlog_event_connectivity_connection_started(ch_get_qlog(ch), 2902 &ch->init_dcid); 2903 2904 /* Handshake layer: start (e.g. send CH). */ 2905 if (!ch_tick_tls(ch, /*channel_only=*/0, NULL)) 2906 return 0; 2907 2908 ossl_quic_reactor_tick(ossl_quic_port_get0_reactor(ch->port), 0); /* best effort */ 2909 return 1; 2910 } 2911 2912 static void free_token(const unsigned char *token, size_t token_len, void *arg) 2913 { 2914 OPENSSL_free((char *)token); 2915 } 2916 2917 /* Start a locally initiated connection shutdown. */ 2918 void ossl_quic_channel_local_close(QUIC_CHANNEL *ch, uint64_t app_error_code, 2919 const char *app_reason) 2920 { 2921 QUIC_TERMINATE_CAUSE tcause = {0}; 2922 2923 if (ossl_quic_channel_is_term_any(ch)) 2924 return; 2925 2926 tcause.app = 1; 2927 tcause.error_code = app_error_code; 2928 tcause.reason = app_reason; 2929 tcause.reason_len = app_reason != NULL ? strlen(app_reason) : 0; 2930 ch_start_terminating(ch, &tcause, 0); 2931 } 2932 2933 /** 2934 * ch_restart - Restarts the QUIC channel by simulating loss of the initial 2935 * packet. This forces the packet to be regenerated with the updated protocol 2936 * version number. 2937 * 2938 * @ch: Pointer to the QUIC_CHANNEL structure. 2939 * 2940 * Returns 1 on success, 0 on failure. 2941 */ 2942 static int ch_restart(QUIC_CHANNEL *ch) 2943 { 2944 /* 2945 * Just pretend we lost our initial packet, so it gets 2946 * regenerated, with our updated protocol version number 2947 */ 2948 return ossl_ackm_mark_packet_pseudo_lost(ch->ackm, QUIC_PN_SPACE_INITIAL, 2949 /* PN= */ 0); 2950 } 2951 2952 /* Called when a server asks us to do a retry. */ 2953 static int ch_retry(QUIC_CHANNEL *ch, 2954 const unsigned char *retry_token, 2955 size_t retry_token_len, 2956 const QUIC_CONN_ID *retry_scid, 2957 int drop_later_pn) 2958 { 2959 void *buf; 2960 QUIC_PN pn = 0; 2961 2962 /* 2963 * RFC 9000 s. 17.2.5.1: "A client MUST discard a Retry packet that contains 2964 * a SCID field that is identical to the DCID field of its initial packet." 2965 */ 2966 if (ossl_quic_conn_id_eq(&ch->init_dcid, retry_scid)) 2967 return 1; 2968 2969 /* We change to using the SCID in the Retry packet as the DCID. */ 2970 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, retry_scid)) 2971 return 0; 2972 2973 /* 2974 * Now we retry. We will release the Retry packet immediately, so copy 2975 * the token. 2976 */ 2977 if ((buf = OPENSSL_memdup(retry_token, retry_token_len)) == NULL) 2978 return 0; 2979 2980 if (!ossl_quic_tx_packetiser_set_initial_token(ch->txp, buf, 2981 retry_token_len, 2982 free_token, NULL)) { 2983 /* 2984 * This may fail if the token we receive is too big for us to ever be 2985 * able to transmit in an outgoing Initial packet. 2986 */ 2987 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INVALID_TOKEN, 0, 2988 "received oversize token"); 2989 OPENSSL_free(buf); 2990 return 0; 2991 } 2992 2993 ch->retry_scid = *retry_scid; 2994 ch->doing_retry = 1; 2995 2996 /* 2997 * If a retry isn't our first response, we need to drop packet number 2998 * one instead (i.e. the case where we did version negotiation first 2999 */ 3000 if (drop_later_pn == 1) 3001 pn = 1; 3002 3003 /* 3004 * We need to stimulate the Initial EL to generate the first CRYPTO frame 3005 * again. We can do this most cleanly by simply forcing the ACKM to consider 3006 * the first Initial packet as lost, which it effectively was as the server 3007 * hasn't processed it. This also maintains the desired behaviour with e.g. 3008 * PNs not resetting and so on. 3009 * 3010 * The PN we used initially is always zero, because QUIC does not allow 3011 * repeated retries. 3012 */ 3013 if (!ossl_ackm_mark_packet_pseudo_lost(ch->ackm, QUIC_PN_SPACE_INITIAL, 3014 pn)) 3015 return 0; 3016 3017 /* 3018 * Plug in new secrets for the Initial EL. This is the only time we change 3019 * the secrets for an EL after we already provisioned it. 3020 */ 3021 if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx, 3022 ch->port->engine->propq, 3023 &ch->retry_scid, 3024 /*is_server=*/0, 3025 ch->qrx, ch->qtx)) 3026 return 0; 3027 3028 return 1; 3029 } 3030 3031 /* Called when an EL is to be discarded. */ 3032 static int ch_discard_el(QUIC_CHANNEL *ch, 3033 uint32_t enc_level) 3034 { 3035 if (!ossl_assert(enc_level < QUIC_ENC_LEVEL_1RTT)) 3036 return 0; 3037 3038 if ((ch->el_discarded & (1U << enc_level)) != 0) 3039 /* Already done. */ 3040 return 1; 3041 3042 /* Best effort for all of these. */ 3043 ossl_quic_tx_packetiser_discard_enc_level(ch->txp, enc_level); 3044 ossl_qrx_discard_enc_level(ch->qrx, enc_level); 3045 ossl_qtx_discard_enc_level(ch->qtx, enc_level); 3046 3047 if (enc_level != QUIC_ENC_LEVEL_0RTT) { 3048 uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level); 3049 3050 ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space); 3051 3052 /* We should still have crypto streams at this point. */ 3053 if (!ossl_assert(ch->crypto_send[pn_space] != NULL) 3054 || !ossl_assert(ch->crypto_recv[pn_space] != NULL)) 3055 return 0; 3056 3057 /* Get rid of the crypto stream state for the EL. */ 3058 ossl_quic_sstream_free(ch->crypto_send[pn_space]); 3059 ch->crypto_send[pn_space] = NULL; 3060 3061 ossl_quic_rstream_free(ch->crypto_recv[pn_space]); 3062 ch->crypto_recv[pn_space] = NULL; 3063 } 3064 3065 ch->el_discarded |= (1U << enc_level); 3066 return 1; 3067 } 3068 3069 /* Intended to be called by the RXDP. */ 3070 int ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL *ch) 3071 { 3072 if (ch->handshake_confirmed) 3073 return 1; 3074 3075 if (!ch->handshake_complete) { 3076 /* 3077 * Does not make sense for handshake to be confirmed before it is 3078 * completed. 3079 */ 3080 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION, 3081 OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE, 3082 "handshake cannot be confirmed " 3083 "before it is completed"); 3084 return 0; 3085 } 3086 3087 ch_discard_el(ch, QUIC_ENC_LEVEL_HANDSHAKE); 3088 ch->handshake_confirmed = 1; 3089 ch_record_state_transition(ch, ch->state); 3090 ossl_ackm_on_handshake_confirmed(ch->ackm); 3091 return 1; 3092 } 3093 3094 /* 3095 * Master function used when we want to start tearing down a connection: 3096 * 3097 * - If the connection is still IDLE we can go straight to TERMINATED; 3098 * 3099 * - If we are already TERMINATED this is a no-op. 3100 * 3101 * - If we are TERMINATING - CLOSING and we have now got a CONNECTION_CLOSE 3102 * from the peer (tcause->remote == 1), we move to TERMINATING - DRAINING. 3103 * 3104 * - If we are TERMINATING - DRAINING, we remain here until the terminating 3105 * timer expires. 3106 * 3107 * - Otherwise, we are in ACTIVE and move to TERMINATING - CLOSING. 3108 * if we caused the termination (e.g. we have sent a CONNECTION_CLOSE). Note 3109 * that we are considered to have caused a termination if we sent the first 3110 * CONNECTION_CLOSE frame, even if it is caused by a peer protocol 3111 * violation. If the peer sent the first CONNECTION_CLOSE frame, we move to 3112 * TERMINATING - DRAINING. 3113 * 3114 * We record the termination cause structure passed on the first call only. 3115 * Any successive calls have their termination cause data discarded; 3116 * once we start sending a CONNECTION_CLOSE frame, we don't change the details 3117 * in it. 3118 * 3119 * This conforms to RFC 9000 s. 10.2.1: Closing Connection State: 3120 * To minimize the state that an endpoint maintains for a closing 3121 * connection, endpoints MAY send the exact same packet in response 3122 * to any received packet. 3123 * 3124 * We don't drop any connection state (specifically packet protection keys) 3125 * even though we are permitted to. This conforms to RFC 9000 s. 10.2.1: 3126 * Closing Connection State: 3127 * An endpoint MAY retain packet protection keys for incoming 3128 * packets to allow it to read and process a CONNECTION_CLOSE frame. 3129 * 3130 * Note that we do not conform to these two from the same section: 3131 * An endpoint's selected connection ID and the QUIC version 3132 * are sufficient information to identify packets for a closing 3133 * connection; the endpoint MAY discard all other connection state. 3134 * and: 3135 * An endpoint MAY drop packet protection keys when entering the 3136 * closing state and send a packet containing a CONNECTION_CLOSE 3137 * frame in response to any UDP datagram that is received. 3138 */ 3139 static void copy_tcause(QUIC_TERMINATE_CAUSE *dst, 3140 const QUIC_TERMINATE_CAUSE *src) 3141 { 3142 dst->error_code = src->error_code; 3143 dst->frame_type = src->frame_type; 3144 dst->app = src->app; 3145 dst->remote = src->remote; 3146 3147 dst->reason = NULL; 3148 dst->reason_len = 0; 3149 3150 if (src->reason != NULL && src->reason_len > 0) { 3151 size_t l = src->reason_len; 3152 char *r; 3153 3154 if (l >= SIZE_MAX) 3155 --l; 3156 3157 /* 3158 * If this fails, dst->reason becomes NULL and we simply do not use a 3159 * reason. This ensures termination is infallible. 3160 */ 3161 dst->reason = r = OPENSSL_memdup(src->reason, l + 1); 3162 if (r == NULL) 3163 return; 3164 3165 r[l] = '\0'; 3166 dst->reason_len = l; 3167 } 3168 } 3169 3170 static void ch_start_terminating(QUIC_CHANNEL *ch, 3171 const QUIC_TERMINATE_CAUSE *tcause, 3172 int force_immediate) 3173 { 3174 /* No point sending anything if we haven't sent anything yet. */ 3175 if (!ch->have_sent_any_pkt) 3176 force_immediate = 1; 3177 3178 switch (ch->state) { 3179 default: 3180 case QUIC_CHANNEL_STATE_IDLE: 3181 copy_tcause(&ch->terminate_cause, tcause); 3182 ch_on_terminating_timeout(ch); 3183 break; 3184 3185 case QUIC_CHANNEL_STATE_ACTIVE: 3186 copy_tcause(&ch->terminate_cause, tcause); 3187 3188 ossl_qlog_event_connectivity_connection_closed(ch_get_qlog(ch), tcause); 3189 3190 if (!force_immediate) { 3191 ch_record_state_transition(ch, tcause->remote 3192 ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING 3193 : QUIC_CHANNEL_STATE_TERMINATING_CLOSING); 3194 /* 3195 * RFC 9000 s. 10.2 Immediate Close 3196 * These states SHOULD persist for at least three times 3197 * the current PTO interval as defined in [QUIC-RECOVERY]. 3198 */ 3199 ch->terminate_deadline 3200 = ossl_time_add(get_time(ch), 3201 ossl_time_multiply(ossl_ackm_get_pto_duration(ch->ackm), 3202 3)); 3203 3204 if (!tcause->remote) { 3205 OSSL_QUIC_FRAME_CONN_CLOSE f = {0}; 3206 3207 /* best effort */ 3208 f.error_code = ch->terminate_cause.error_code; 3209 f.frame_type = ch->terminate_cause.frame_type; 3210 f.is_app = ch->terminate_cause.app; 3211 f.reason = (char *)ch->terminate_cause.reason; 3212 f.reason_len = ch->terminate_cause.reason_len; 3213 ossl_quic_tx_packetiser_schedule_conn_close(ch->txp, &f); 3214 /* 3215 * RFC 9000 s. 10.2.2 Draining Connection State: 3216 * An endpoint that receives a CONNECTION_CLOSE frame MAY 3217 * send a single packet containing a CONNECTION_CLOSE 3218 * frame before entering the draining state, using a 3219 * NO_ERROR code if appropriate 3220 */ 3221 ch->conn_close_queued = 1; 3222 } 3223 } else { 3224 ch_on_terminating_timeout(ch); 3225 } 3226 break; 3227 3228 case QUIC_CHANNEL_STATE_TERMINATING_CLOSING: 3229 if (force_immediate) 3230 ch_on_terminating_timeout(ch); 3231 else if (tcause->remote) 3232 /* 3233 * RFC 9000 s. 10.2.2 Draining Connection State: 3234 * An endpoint MAY enter the draining state from the 3235 * closing state if it receives a CONNECTION_CLOSE frame, 3236 * which indicates that the peer is also closing or draining. 3237 */ 3238 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATING_DRAINING); 3239 3240 break; 3241 3242 case QUIC_CHANNEL_STATE_TERMINATING_DRAINING: 3243 /* 3244 * Other than in the force-immediate case, we remain here until the 3245 * timeout expires. 3246 */ 3247 if (force_immediate) 3248 ch_on_terminating_timeout(ch); 3249 3250 break; 3251 3252 case QUIC_CHANNEL_STATE_TERMINATED: 3253 /* No-op. */ 3254 break; 3255 } 3256 } 3257 3258 /* For RXDP use. */ 3259 void ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL *ch, 3260 OSSL_QUIC_FRAME_CONN_CLOSE *f) 3261 { 3262 QUIC_TERMINATE_CAUSE tcause = {0}; 3263 3264 if (!ossl_quic_channel_is_active(ch)) 3265 return; 3266 3267 tcause.remote = 1; 3268 tcause.app = f->is_app; 3269 tcause.error_code = f->error_code; 3270 tcause.frame_type = f->frame_type; 3271 tcause.reason = f->reason; 3272 tcause.reason_len = f->reason_len; 3273 ch_start_terminating(ch, &tcause, 0); 3274 } 3275 3276 static void free_frame_data(unsigned char *buf, size_t buf_len, void *arg) 3277 { 3278 OPENSSL_free(buf); 3279 } 3280 3281 static int ch_enqueue_retire_conn_id(QUIC_CHANNEL *ch, uint64_t seq_num) 3282 { 3283 BUF_MEM *buf_mem = NULL; 3284 WPACKET wpkt; 3285 size_t l; 3286 3287 ossl_quic_srtm_remove(ch->srtm, ch, seq_num); 3288 3289 if ((buf_mem = BUF_MEM_new()) == NULL) 3290 goto err; 3291 3292 if (!WPACKET_init(&wpkt, buf_mem)) 3293 goto err; 3294 3295 if (!ossl_quic_wire_encode_frame_retire_conn_id(&wpkt, seq_num)) { 3296 WPACKET_cleanup(&wpkt); 3297 goto err; 3298 } 3299 3300 WPACKET_finish(&wpkt); 3301 if (!WPACKET_get_total_written(&wpkt, &l)) 3302 goto err; 3303 3304 if (ossl_quic_cfq_add_frame(ch->cfq, 1, QUIC_PN_SPACE_APP, 3305 OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID, 0, 3306 (unsigned char *)buf_mem->data, l, 3307 free_frame_data, NULL) == NULL) 3308 goto err; 3309 3310 buf_mem->data = NULL; 3311 BUF_MEM_free(buf_mem); 3312 return 1; 3313 3314 err: 3315 ossl_quic_channel_raise_protocol_error(ch, 3316 OSSL_QUIC_ERR_INTERNAL_ERROR, 3317 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID, 3318 "internal error enqueueing retire conn id"); 3319 BUF_MEM_free(buf_mem); 3320 return 0; 3321 } 3322 3323 void ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL *ch, 3324 OSSL_QUIC_FRAME_NEW_CONN_ID *f) 3325 { 3326 uint64_t new_remote_seq_num = ch->cur_remote_seq_num; 3327 uint64_t new_retire_prior_to = ch->cur_retire_prior_to; 3328 3329 if (!ossl_quic_channel_is_active(ch)) 3330 return; 3331 3332 /* We allow only two active connection ids; first check some constraints */ 3333 if (ch->cur_remote_dcid.id_len == 0) { 3334 /* Changing from 0 length connection id is disallowed */ 3335 ossl_quic_channel_raise_protocol_error(ch, 3336 OSSL_QUIC_ERR_PROTOCOL_VIOLATION, 3337 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID, 3338 "zero length connection id in use"); 3339 3340 return; 3341 } 3342 3343 if (f->seq_num > new_remote_seq_num) 3344 new_remote_seq_num = f->seq_num; 3345 if (f->retire_prior_to > new_retire_prior_to) 3346 new_retire_prior_to = f->retire_prior_to; 3347 3348 /* 3349 * RFC 9000-5.1.1: An endpoint MUST NOT provide more connection IDs 3350 * than the peer's limit. 3351 * 3352 * After processing a NEW_CONNECTION_ID frame and adding and retiring 3353 * active connection IDs, if the number of active connection IDs exceeds 3354 * the value advertised in its active_connection_id_limit transport 3355 * parameter, an endpoint MUST close the connection with an error of 3356 * type CONNECTION_ID_LIMIT_ERROR. 3357 */ 3358 if (new_remote_seq_num - new_retire_prior_to > 1) { 3359 ossl_quic_channel_raise_protocol_error(ch, 3360 OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR, 3361 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID, 3362 "active_connection_id limit violated"); 3363 return; 3364 } 3365 3366 /* 3367 * RFC 9000-5.1.1: An endpoint MAY send connection IDs that temporarily 3368 * exceed a peer's limit if the NEW_CONNECTION_ID frame also requires 3369 * the retirement of any excess, by including a sufficiently large 3370 * value in the Retire Prior To field. 3371 * 3372 * RFC 9000-5.1.2: An endpoint SHOULD allow for sending and tracking 3373 * a number of RETIRE_CONNECTION_ID frames of at least twice the value 3374 * of the active_connection_id_limit transport parameter. An endpoint 3375 * MUST NOT forget a connection ID without retiring it, though it MAY 3376 * choose to treat having connection IDs in need of retirement that 3377 * exceed this limit as a connection error of type CONNECTION_ID_LIMIT_ERROR. 3378 * 3379 * We are a little bit more liberal than the minimum mandated. 3380 */ 3381 if (new_retire_prior_to - ch->cur_retire_prior_to > 10) { 3382 ossl_quic_channel_raise_protocol_error(ch, 3383 OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR, 3384 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID, 3385 "retiring connection id limit violated"); 3386 3387 return; 3388 } 3389 3390 if (new_remote_seq_num > ch->cur_remote_seq_num) { 3391 /* Add new stateless reset token */ 3392 if (!ossl_quic_srtm_add(ch->srtm, ch, new_remote_seq_num, 3393 &f->stateless_reset)) { 3394 ossl_quic_channel_raise_protocol_error( 3395 ch, OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR, 3396 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID, 3397 "unable to store stateless reset token"); 3398 3399 return; 3400 } 3401 ch->cur_remote_seq_num = new_remote_seq_num; 3402 ch->cur_remote_dcid = f->conn_id; 3403 ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid); 3404 } 3405 3406 /* 3407 * RFC 9000-5.1.2: Upon receipt of an increased Retire Prior To 3408 * field, the peer MUST stop using the corresponding connection IDs 3409 * and retire them with RETIRE_CONNECTION_ID frames before adding the 3410 * newly provided connection ID to the set of active connection IDs. 3411 */ 3412 3413 /* 3414 * Note: RFC 9000 s. 19.15 says: 3415 * "An endpoint that receives a NEW_CONNECTION_ID frame with a sequence 3416 * number smaller than the Retire Prior To field of a previously received 3417 * NEW_CONNECTION_ID frame MUST send a corresponding 3418 * RETIRE_CONNECTION_ID frame that retires the newly received connection 3419 * ID, unless it has already done so for that sequence number." 3420 * 3421 * Since we currently always queue RETIRE_CONN_ID frames based on the Retire 3422 * Prior To field of a NEW_CONNECTION_ID frame immediately upon receiving 3423 * that NEW_CONNECTION_ID frame, by definition this will always be met. 3424 * This may change in future when we change our CID handling. 3425 */ 3426 while (new_retire_prior_to > ch->cur_retire_prior_to) { 3427 if (!ch_enqueue_retire_conn_id(ch, ch->cur_retire_prior_to)) 3428 break; 3429 ++ch->cur_retire_prior_to; 3430 } 3431 } 3432 3433 static void ch_save_err_state(QUIC_CHANNEL *ch) 3434 { 3435 if (ch->err_state == NULL) 3436 ch->err_state = OSSL_ERR_STATE_new(); 3437 3438 if (ch->err_state == NULL) 3439 return; 3440 3441 OSSL_ERR_STATE_save(ch->err_state); 3442 } 3443 3444 void ossl_quic_channel_inject(QUIC_CHANNEL *ch, QUIC_URXE *e) 3445 { 3446 ossl_qrx_inject_urxe(ch->qrx, e); 3447 } 3448 3449 void ossl_quic_channel_inject_pkt(QUIC_CHANNEL *ch, OSSL_QRX_PKT *qpkt) 3450 { 3451 ossl_qrx_inject_pkt(ch->qrx, qpkt); 3452 } 3453 3454 void ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL *ch) 3455 { 3456 QUIC_TERMINATE_CAUSE tcause = {0}; 3457 3458 tcause.error_code = OSSL_QUIC_ERR_NO_ERROR; 3459 tcause.remote = 1; 3460 ch_start_terminating(ch, &tcause, 0); 3461 } 3462 3463 void ossl_quic_channel_raise_net_error(QUIC_CHANNEL *ch) 3464 { 3465 QUIC_TERMINATE_CAUSE tcause = {0}; 3466 3467 if (ch->net_error) 3468 return; 3469 3470 ch->net_error = 1; 3471 3472 tcause.error_code = OSSL_QUIC_ERR_INTERNAL_ERROR; 3473 tcause.reason = "network BIO I/O error"; 3474 tcause.reason_len = strlen(tcause.reason); 3475 3476 /* 3477 * Skip Terminating state and go directly to Terminated, no point trying to 3478 * send CONNECTION_CLOSE if we cannot communicate. 3479 */ 3480 ch_start_terminating(ch, &tcause, 1); 3481 } 3482 3483 int ossl_quic_channel_net_error(QUIC_CHANNEL *ch) 3484 { 3485 return ch->net_error; 3486 } 3487 3488 void ossl_quic_channel_restore_err_state(QUIC_CHANNEL *ch) 3489 { 3490 if (ch == NULL) 3491 return; 3492 3493 if (!ossl_quic_port_is_running(ch->port)) 3494 ossl_quic_port_restore_err_state(ch->port); 3495 else 3496 OSSL_ERR_STATE_restore(ch->err_state); 3497 } 3498 3499 void ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL *ch, 3500 uint64_t error_code, 3501 uint64_t frame_type, 3502 const char *reason, 3503 ERR_STATE *err_state, 3504 const char *src_file, 3505 int src_line, 3506 const char *src_func) 3507 { 3508 QUIC_TERMINATE_CAUSE tcause = {0}; 3509 int err_reason = error_code == OSSL_QUIC_ERR_INTERNAL_ERROR 3510 ? ERR_R_INTERNAL_ERROR : SSL_R_QUIC_PROTOCOL_ERROR; 3511 const char *err_str = ossl_quic_err_to_string(error_code); 3512 const char *err_str_pfx = " (", *err_str_sfx = ")"; 3513 const char *ft_str = NULL; 3514 const char *ft_str_pfx = " (", *ft_str_sfx = ")"; 3515 3516 if (ch->protocol_error) 3517 /* Only the first call to this function matters. */ 3518 return; 3519 3520 if (err_str == NULL) { 3521 err_str = ""; 3522 err_str_pfx = ""; 3523 err_str_sfx = ""; 3524 } 3525 3526 /* 3527 * If we were provided an underlying error state, restore it and then append 3528 * our ERR on top as a "cover letter" error. 3529 */ 3530 if (err_state != NULL) 3531 OSSL_ERR_STATE_restore(err_state); 3532 3533 if (frame_type != 0) { 3534 ft_str = ossl_quic_frame_type_to_string(frame_type); 3535 if (ft_str == NULL) { 3536 ft_str = ""; 3537 ft_str_pfx = ""; 3538 ft_str_sfx = ""; 3539 } 3540 3541 ERR_raise_data(ERR_LIB_SSL, err_reason, 3542 "QUIC error code: 0x%llx%s%s%s " 3543 "(triggered by frame type: 0x%llx%s%s%s), reason: \"%s\"", 3544 (unsigned long long) error_code, 3545 err_str_pfx, err_str, err_str_sfx, 3546 (unsigned long long) frame_type, 3547 ft_str_pfx, ft_str, ft_str_sfx, 3548 reason); 3549 } else { 3550 ERR_raise_data(ERR_LIB_SSL, err_reason, 3551 "QUIC error code: 0x%llx%s%s%s, reason: \"%s\"", 3552 (unsigned long long) error_code, 3553 err_str_pfx, err_str, err_str_sfx, 3554 reason); 3555 } 3556 3557 if (src_file != NULL) 3558 ERR_set_debug(src_file, src_line, src_func); 3559 3560 ch_save_err_state(ch); 3561 3562 tcause.error_code = error_code; 3563 tcause.frame_type = frame_type; 3564 tcause.reason = reason; 3565 tcause.reason_len = strlen(reason); 3566 3567 ch->protocol_error = 1; 3568 ch_start_terminating(ch, &tcause, 0); 3569 } 3570 3571 /* 3572 * Called once the terminating timer expires, meaning we move from TERMINATING 3573 * to TERMINATED. 3574 */ 3575 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch) 3576 { 3577 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED); 3578 } 3579 3580 /* 3581 * Determines the effective idle timeout duration. This is based on the idle 3582 * timeout values that we and our peer signalled in transport parameters 3583 * but have some limits applied. 3584 */ 3585 static OSSL_TIME ch_get_effective_idle_timeout_duration(QUIC_CHANNEL *ch) 3586 { 3587 OSSL_TIME pto; 3588 3589 if (ch->max_idle_timeout == 0) 3590 return ossl_time_infinite(); 3591 3592 /* 3593 * RFC 9000 s. 10.1: Idle Timeout 3594 * To avoid excessively small idle timeout periods, endpoints 3595 * MUST increase the idle timeout period to be at least three 3596 * times the current Probe Timeout (PTO). This allows for 3597 * multiple PTOs to expire, and therefore multiple probes to 3598 * be sent and lost, prior to idle timeout. 3599 */ 3600 pto = ossl_ackm_get_pto_duration(ch->ackm); 3601 return ossl_time_max(ossl_ms2time(ch->max_idle_timeout), 3602 ossl_time_multiply(pto, 3)); 3603 } 3604 3605 /* 3606 * Updates our idle deadline. Called when an event happens which should bump the 3607 * idle timeout. 3608 */ 3609 static void ch_update_idle(QUIC_CHANNEL *ch) 3610 { 3611 ch->idle_deadline = ossl_time_add(get_time(ch), 3612 ch_get_effective_idle_timeout_duration(ch)); 3613 } 3614 3615 /* 3616 * Updates our ping deadline, which determines when we next generate a ping if 3617 * we don't have any other ACK-eliciting frames to send. 3618 */ 3619 static void ch_update_ping_deadline(QUIC_CHANNEL *ch) 3620 { 3621 OSSL_TIME max_span, idle_duration; 3622 3623 idle_duration = ch_get_effective_idle_timeout_duration(ch); 3624 if (ossl_time_is_infinite(idle_duration)) { 3625 ch->ping_deadline = ossl_time_infinite(); 3626 return; 3627 } 3628 3629 /* 3630 * Maximum amount of time without traffic before we send a PING to keep 3631 * the connection open. Usually we use max_idle_timeout/2, but ensure 3632 * the period never exceeds the assumed NAT interval to ensure NAT 3633 * devices don't have their state time out (RFC 9000 s. 10.1.2). 3634 */ 3635 max_span = ossl_time_divide(idle_duration, 2); 3636 max_span = ossl_time_min(max_span, MAX_NAT_INTERVAL); 3637 ch->ping_deadline = ossl_time_add(get_time(ch), max_span); 3638 } 3639 3640 /* Called when the idle timeout expires. */ 3641 static void ch_on_idle_timeout(QUIC_CHANNEL *ch) 3642 { 3643 /* 3644 * Idle timeout does not have an error code associated with it because a 3645 * CONN_CLOSE is never sent for it. We shouldn't use this data once we reach 3646 * TERMINATED anyway. 3647 */ 3648 ch->terminate_cause.app = 0; 3649 ch->terminate_cause.error_code = OSSL_QUIC_LOCAL_ERR_IDLE_TIMEOUT; 3650 ch->terminate_cause.frame_type = 0; 3651 3652 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED); 3653 } 3654 3655 /** 3656 * @brief Common handler for initializing a new QUIC connection. 3657 * 3658 * This function configures a QUIC channel (`QUIC_CHANNEL *ch`) for a new 3659 * connection by setting the peer address, connection IDs, and necessary 3660 * callbacks. It establishes initial secrets, sets up logging, and performs 3661 * required transitions for the channel state. 3662 * 3663 * @param ch Pointer to the QUIC channel being initialized. 3664 * @param peer Address of the peer to which the channel connects. 3665 * @param peer_scid Peer-specified source connection ID. 3666 * @param peer_dcid Peer-specified destination connection ID. 3667 * @param peer_odcid Peer-specified original destination connection ID 3668 * may be NULL if retry frame not sent to client 3669 * @return 1 on success, 0 on failure to set required elements. 3670 */ 3671 static int ch_on_new_conn_common(QUIC_CHANNEL *ch, const BIO_ADDR *peer, 3672 const QUIC_CONN_ID *peer_scid, 3673 const QUIC_CONN_ID *peer_dcid, 3674 const QUIC_CONN_ID *peer_odcid) 3675 { 3676 /* Note our newly learnt peer address and CIDs. */ 3677 if (!BIO_ADDR_copy(&ch->cur_peer_addr, peer)) 3678 return 0; 3679 3680 ch->init_dcid = *peer_dcid; 3681 ch->cur_remote_dcid = *peer_scid; 3682 ch->odcid.id_len = 0; 3683 3684 if (peer_odcid != NULL) 3685 ch->odcid = *peer_odcid; 3686 3687 /* Inform QTX of peer address. */ 3688 if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr)) 3689 return 0; 3690 3691 /* Inform TXP of desired CIDs. */ 3692 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid)) 3693 return 0; 3694 3695 if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid)) 3696 return 0; 3697 3698 /* Setup QLOG, which did not happen earlier due to lacking an Initial ODCID. */ 3699 ossl_qtx_set_qlog_cb(ch->qtx, ch_get_qlog_cb, ch); 3700 ossl_quic_tx_packetiser_set_qlog_cb(ch->txp, ch_get_qlog_cb, ch); 3701 3702 /* 3703 * Plug in secrets for the Initial EL. secrets for QRX were created in 3704 * port_default_packet_handler() already. 3705 */ 3706 if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx, 3707 ch->port->engine->propq, 3708 &ch->init_dcid, 3709 /*is_server=*/1, 3710 NULL, ch->qtx)) 3711 return 0; 3712 3713 /* Register the peer ODCID in the LCIDM. */ 3714 if (!ossl_quic_lcidm_enrol_odcid(ch->lcidm, ch, peer_odcid == NULL ? 3715 &ch->init_dcid : 3716 peer_odcid)) 3717 return 0; 3718 3719 /* Change state. */ 3720 ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE); 3721 ch->doing_proactive_ver_neg = 0; /* not currently supported */ 3722 return 1; 3723 } 3724 3725 /* Called when we, as a server, get a new incoming connection. */ 3726 int ossl_quic_channel_on_new_conn(QUIC_CHANNEL *ch, const BIO_ADDR *peer, 3727 const QUIC_CONN_ID *peer_scid, 3728 const QUIC_CONN_ID *peer_dcid) 3729 { 3730 if (!ossl_assert(ch->state == QUIC_CHANNEL_STATE_IDLE && ch->is_server)) 3731 return 0; 3732 3733 /* Generate an Initial LCID we will use for the connection. */ 3734 if (!ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &ch->cur_local_cid)) 3735 return 0; 3736 3737 return ch_on_new_conn_common(ch, peer, peer_scid, peer_dcid, NULL); 3738 } 3739 3740 /** 3741 * Binds a QUIC channel to a specific peer's address and connection IDs. 3742 * 3743 * This function is used to establish a binding between a QUIC channel and a 3744 * peer's address and connection IDs. The binding is performed only if the 3745 * channel is idle and is on the server side. The peer's destination connection 3746 * ID (`peer_dcid`) is mandatory, and the channel's current local connection ID 3747 * is set to this value. 3748 * 3749 * @param ch Pointer to the QUIC_CHANNEL structure representing the 3750 * channel to be bound. 3751 * @param peer Pointer to a BIO_ADDR structure representing the peer's 3752 * address. 3753 * @param peer_scid Pointer to the peer's source connection ID (QUIC_CONN_ID). 3754 * @param peer_dcid Pointer to the peer's destination connection ID 3755 * (QUIC_CONN_ID). This must not be NULL. 3756 * @param peer_odcid Pointer to the original destination connection ID 3757 * (QUIC_CONN_ID) chosen by the peer in its first initial 3758 * packet received without a token. 3759 * 3760 * @return 1 on success, or 0 on failure if the conditions for binding are not 3761 * met (e.g., channel is not idle or not a server, or binding fails). 3762 */ 3763 int ossl_quic_bind_channel(QUIC_CHANNEL *ch, const BIO_ADDR *peer, 3764 const QUIC_CONN_ID *peer_scid, 3765 const QUIC_CONN_ID *peer_dcid, 3766 const QUIC_CONN_ID *peer_odcid) 3767 { 3768 if (peer_dcid == NULL) 3769 return 0; 3770 3771 if (!ossl_assert(ch->state == QUIC_CHANNEL_STATE_IDLE && ch->is_server)) 3772 return 0; 3773 3774 ch->cur_local_cid = *peer_dcid; 3775 if (!ossl_quic_lcidm_bind_channel(ch->lcidm, ch, peer_dcid)) 3776 return 0; 3777 3778 /* 3779 * peer_odcid <=> is initial dst conn id chosen by peer in its 3780 * first initial packet we received without token. 3781 */ 3782 return ch_on_new_conn_common(ch, peer, peer_scid, peer_dcid, peer_odcid); 3783 } 3784 3785 SSL *ossl_quic_channel_get0_ssl(QUIC_CHANNEL *ch) 3786 { 3787 return ch->tls; 3788 } 3789 3790 static int ch_init_new_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs, 3791 int can_send, int can_recv) 3792 { 3793 uint64_t rxfc_wnd; 3794 int server_init = ossl_quic_stream_is_server_init(qs); 3795 int local_init = (ch->is_server == server_init); 3796 int is_uni = !ossl_quic_stream_is_bidi(qs); 3797 3798 if (can_send) 3799 if ((qs->sstream = ossl_quic_sstream_new(INIT_APP_BUF_LEN)) == NULL) 3800 goto err; 3801 3802 if (can_recv) 3803 if ((qs->rstream = ossl_quic_rstream_new(NULL, NULL, 0)) == NULL) 3804 goto err; 3805 3806 /* TXFC */ 3807 if (!ossl_quic_txfc_init(&qs->txfc, &ch->conn_txfc)) 3808 goto err; 3809 3810 if (ch->got_remote_transport_params) { 3811 /* 3812 * If we already got peer TPs we need to apply the initial CWM credit 3813 * now. If we didn't already get peer TPs this will be done 3814 * automatically for all extant streams when we do. 3815 */ 3816 if (can_send) { 3817 uint64_t cwm; 3818 3819 if (is_uni) 3820 cwm = ch->rx_init_max_stream_data_uni; 3821 else if (local_init) 3822 cwm = ch->rx_init_max_stream_data_bidi_local; 3823 else 3824 cwm = ch->rx_init_max_stream_data_bidi_remote; 3825 3826 ossl_quic_txfc_bump_cwm(&qs->txfc, cwm); 3827 } 3828 } 3829 3830 /* RXFC */ 3831 if (!can_recv) 3832 rxfc_wnd = 0; 3833 else if (is_uni) 3834 rxfc_wnd = ch->tx_init_max_stream_data_uni; 3835 else if (local_init) 3836 rxfc_wnd = ch->tx_init_max_stream_data_bidi_local; 3837 else 3838 rxfc_wnd = ch->tx_init_max_stream_data_bidi_remote; 3839 3840 if (!ossl_quic_rxfc_init(&qs->rxfc, &ch->conn_rxfc, 3841 rxfc_wnd, 3842 DEFAULT_STREAM_RXFC_MAX_WND_MUL * rxfc_wnd, 3843 get_time, ch)) 3844 goto err; 3845 3846 return 1; 3847 3848 err: 3849 ossl_quic_sstream_free(qs->sstream); 3850 qs->sstream = NULL; 3851 ossl_quic_rstream_free(qs->rstream); 3852 qs->rstream = NULL; 3853 return 0; 3854 } 3855 3856 static uint64_t *ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL *ch, 3857 int is_uni) 3858 { 3859 return is_uni ? &ch->next_local_stream_ordinal_uni 3860 : &ch->next_local_stream_ordinal_bidi; 3861 } 3862 3863 static const uint64_t *ch_get_local_stream_max_ptr(const QUIC_CHANNEL *ch, 3864 int is_uni) 3865 { 3866 return is_uni ? &ch->max_local_streams_uni 3867 : &ch->max_local_streams_bidi; 3868 } 3869 3870 static const QUIC_RXFC *ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL *ch, 3871 int is_uni) 3872 { 3873 return is_uni ? &ch->max_streams_uni_rxfc 3874 : &ch->max_streams_bidi_rxfc; 3875 } 3876 3877 int ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL *ch, 3878 int is_uni) 3879 { 3880 const uint64_t *p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni); 3881 3882 return ossl_quic_stream_map_is_local_allowed_by_stream_limit(&ch->qsm, 3883 *p_next_ordinal, 3884 is_uni); 3885 } 3886 3887 uint64_t ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL *ch, 3888 int is_uni) 3889 { 3890 const uint64_t *p_next_ordinal, *p_max; 3891 3892 p_next_ordinal = ch_get_local_stream_next_ordinal_ptr((QUIC_CHANNEL *)ch, 3893 is_uni); 3894 p_max = ch_get_local_stream_max_ptr(ch, is_uni); 3895 3896 return *p_max - *p_next_ordinal; 3897 } 3898 3899 uint64_t ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL *ch, 3900 int is_uni) 3901 { 3902 return ossl_quic_rxfc_get_credit(ch_get_remote_stream_count_rxfc(ch, is_uni)); 3903 } 3904 3905 QUIC_STREAM *ossl_quic_channel_new_stream_local(QUIC_CHANNEL *ch, int is_uni) 3906 { 3907 QUIC_STREAM *qs; 3908 int type; 3909 uint64_t stream_id; 3910 uint64_t *p_next_ordinal; 3911 3912 type = ch->is_server ? QUIC_STREAM_INITIATOR_SERVER 3913 : QUIC_STREAM_INITIATOR_CLIENT; 3914 3915 p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni); 3916 3917 if (is_uni) 3918 type |= QUIC_STREAM_DIR_UNI; 3919 else 3920 type |= QUIC_STREAM_DIR_BIDI; 3921 3922 if (*p_next_ordinal >= ((uint64_t)1) << 62) 3923 return NULL; 3924 3925 stream_id = ((*p_next_ordinal) << 2) | type; 3926 3927 if ((qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id, type)) == NULL) 3928 return NULL; 3929 3930 /* Locally-initiated stream, so we always want a send buffer. */ 3931 if (!ch_init_new_stream(ch, qs, /*can_send=*/1, /*can_recv=*/!is_uni)) 3932 goto err; 3933 3934 ++*p_next_ordinal; 3935 return qs; 3936 3937 err: 3938 ossl_quic_stream_map_release(&ch->qsm, qs); 3939 return NULL; 3940 } 3941 3942 QUIC_STREAM *ossl_quic_channel_new_stream_remote(QUIC_CHANNEL *ch, 3943 uint64_t stream_id) 3944 { 3945 uint64_t peer_role; 3946 int is_uni; 3947 QUIC_STREAM *qs; 3948 3949 peer_role = ch->is_server 3950 ? QUIC_STREAM_INITIATOR_CLIENT 3951 : QUIC_STREAM_INITIATOR_SERVER; 3952 3953 if ((stream_id & QUIC_STREAM_INITIATOR_MASK) != peer_role) 3954 return NULL; 3955 3956 is_uni = ((stream_id & QUIC_STREAM_DIR_MASK) == QUIC_STREAM_DIR_UNI); 3957 3958 qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id, 3959 stream_id & (QUIC_STREAM_INITIATOR_MASK 3960 | QUIC_STREAM_DIR_MASK)); 3961 if (qs == NULL) 3962 return NULL; 3963 3964 if (!ch_init_new_stream(ch, qs, /*can_send=*/!is_uni, /*can_recv=*/1)) 3965 goto err; 3966 3967 if (ch->incoming_stream_auto_reject) 3968 ossl_quic_channel_reject_stream(ch, qs); 3969 else 3970 ossl_quic_stream_map_push_accept_queue(&ch->qsm, qs); 3971 3972 return qs; 3973 3974 err: 3975 ossl_quic_stream_map_release(&ch->qsm, qs); 3976 return NULL; 3977 } 3978 3979 void ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL *ch, 3980 int enable, 3981 uint64_t aec) 3982 { 3983 ch->incoming_stream_auto_reject = (enable != 0); 3984 ch->incoming_stream_auto_reject_aec = aec; 3985 } 3986 3987 void ossl_quic_channel_reject_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs) 3988 { 3989 ossl_quic_stream_map_stop_sending_recv_part(&ch->qsm, qs, 3990 ch->incoming_stream_auto_reject_aec); 3991 3992 ossl_quic_stream_map_reset_stream_send_part(&ch->qsm, qs, 3993 ch->incoming_stream_auto_reject_aec); 3994 qs->deleted = 1; 3995 3996 ossl_quic_stream_map_update_state(&ch->qsm, qs); 3997 } 3998 3999 /* Replace local connection ID in TXP and DEMUX for testing purposes. */ 4000 int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL *ch, 4001 const QUIC_CONN_ID *conn_id) 4002 { 4003 /* Remove the current LCID from the LCIDM. */ 4004 if (!ossl_quic_lcidm_debug_remove(ch->lcidm, &ch->cur_local_cid)) 4005 return 0; 4006 ch->cur_local_cid = *conn_id; 4007 /* Set in the TXP, used only for long header packets. */ 4008 if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid)) 4009 return 0; 4010 /* Add the new LCID to the LCIDM. */ 4011 if (!ossl_quic_lcidm_debug_add(ch->lcidm, ch, &ch->cur_local_cid, 4012 100)) 4013 return 0; 4014 return 1; 4015 } 4016 4017 void ossl_quic_channel_set_msg_callback(QUIC_CHANNEL *ch, 4018 ossl_msg_cb msg_callback, 4019 SSL *msg_callback_ssl) 4020 { 4021 ch->msg_callback = msg_callback; 4022 ch->msg_callback_ssl = msg_callback_ssl; 4023 ossl_qtx_set_msg_callback(ch->qtx, msg_callback, msg_callback_ssl); 4024 ossl_quic_tx_packetiser_set_msg_callback(ch->txp, msg_callback, 4025 msg_callback_ssl); 4026 /* 4027 * postpone msg callback setting for tserver until port calls 4028 * port_bind_channel(). 4029 */ 4030 if (ch->is_tserver_ch == 0) 4031 ossl_qrx_set_msg_callback(ch->qrx, msg_callback, msg_callback_ssl); 4032 } 4033 4034 void ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL *ch, 4035 void *msg_callback_arg) 4036 { 4037 ch->msg_callback_arg = msg_callback_arg; 4038 ossl_qtx_set_msg_callback_arg(ch->qtx, msg_callback_arg); 4039 ossl_quic_tx_packetiser_set_msg_callback_arg(ch->txp, msg_callback_arg); 4040 4041 /* 4042 * postpone msg callback setting for tserver until port calls 4043 * port_bind_channel(). 4044 */ 4045 if (ch->is_tserver_ch == 0) 4046 ossl_qrx_set_msg_callback_arg(ch->qrx, msg_callback_arg); 4047 } 4048 4049 void ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL *ch, 4050 uint64_t tx_pkt_threshold) 4051 { 4052 ch->txku_threshold_override = tx_pkt_threshold; 4053 } 4054 4055 uint64_t ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL *ch) 4056 { 4057 return ossl_qtx_get_key_epoch(ch->qtx); 4058 } 4059 4060 uint64_t ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL *ch) 4061 { 4062 return ossl_qrx_get_key_epoch(ch->qrx); 4063 } 4064 4065 int ossl_quic_channel_trigger_txku(QUIC_CHANNEL *ch) 4066 { 4067 if (!txku_allowed(ch)) 4068 return 0; 4069 4070 ch->ku_locally_initiated = 1; 4071 ch_trigger_txku(ch); 4072 return 1; 4073 } 4074 4075 int ossl_quic_channel_ping(QUIC_CHANNEL *ch) 4076 { 4077 int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level); 4078 4079 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space); 4080 4081 return 1; 4082 } 4083 4084 uint16_t ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL *ch) 4085 { 4086 return ch->diag_num_rx_ack; 4087 } 4088 4089 void ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL *ch, QUIC_CONN_ID *cid) 4090 { 4091 *cid = ch->cur_local_cid; 4092 } 4093 4094 int ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL *ch) 4095 { 4096 return ch->got_local_transport_params; 4097 } 4098 4099 void ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL *ch, uint64_t ms) 4100 { 4101 ch->max_idle_timeout_local_req = ms; 4102 } 4103 uint64_t ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL *ch) 4104 { 4105 return ch->max_idle_timeout_local_req; 4106 } 4107 4108 uint64_t ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL *ch) 4109 { 4110 return ch->max_idle_timeout_remote_req; 4111 } 4112 4113 uint64_t ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL *ch) 4114 { 4115 return ch->max_idle_timeout; 4116 } 4117