2 * Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/rand.h>
11 #include <openssl/err.h>
12 #include "internal/quic_channel.h"
13 #include "internal/quic_error.h"
14 #include "internal/quic_rx_depack.h"
15 #include "internal/quic_lcidm.h"
16 #include "internal/quic_srtm.h"
17 #include "internal/qlog_event_helpers.h"
18 #include "../ssl_local.h"
19 #include "quic_channel_local.h"
20 #include "quic_port_local.h"
21 #include "quic_engine_local.h"
24 * NOTE: While this channel implementation currently has basic server support,
25 * this functionality has been implemented for internal testing purposes and is
26 * not suitable for network use. In particular, it does not implement address
27 * validation, anti-amplification or retry logic.
29 * TODO(QUIC SERVER): Implement address validation and anti-amplification
30 * TODO(QUIC SERVER): Implement retry logic
33 #define INIT_CRYPTO_RECV_BUF_LEN 16384
34 #define INIT_CRYPTO_SEND_BUF_LEN 16384
35 #define INIT_APP_BUF_LEN 8192
38 * Interval before we force a PING to ensure NATs don't timeout. This is based
39 * on the lowest commonly seen value of 30 seconds as cited in RFC 9000 s.
42 #define MAX_NAT_INTERVAL (ossl_ms2time(25000))
45 * Our maximum ACK delay on the TX side. This is up to us to choose. Note that
46 * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol
47 * value which determines the value of the maximum ACK delay if the
48 * max_ack_delay transport parameter is not set.
50 #define DEFAULT_MAX_ACK_DELAY QUIC_DEFAULT_MAX_ACK_DELAY
52 DEFINE_LIST_OF_IMPL(ch
, QUIC_CHANNEL
);
54 static void ch_save_err_state(QUIC_CHANNEL
*ch
);
55 static int ch_rx(QUIC_CHANNEL
*ch
, int channel_only
);
56 static int ch_tx(QUIC_CHANNEL
*ch
);
57 static int ch_tick_tls(QUIC_CHANNEL
*ch
, int channel_only
);
58 static void ch_rx_handle_packet(QUIC_CHANNEL
*ch
, int channel_only
);
59 static OSSL_TIME
ch_determine_next_tick_deadline(QUIC_CHANNEL
*ch
);
60 static int ch_retry(QUIC_CHANNEL
*ch
,
61 const unsigned char *retry_token
,
62 size_t retry_token_len
,
63 const QUIC_CONN_ID
*retry_scid
);
64 static void ch_cleanup(QUIC_CHANNEL
*ch
);
65 static int ch_generate_transport_params(QUIC_CHANNEL
*ch
);
66 static int ch_on_transport_params(const unsigned char *params
,
69 static int ch_on_handshake_alert(void *arg
, unsigned char alert_code
);
70 static int ch_on_handshake_complete(void *arg
);
71 static int ch_on_handshake_yield_secret(uint32_t enc_level
, int direction
,
72 uint32_t suite_id
, EVP_MD
*md
,
73 const unsigned char *secret
,
76 static int ch_on_crypto_recv_record(const unsigned char **buf
,
77 size_t *bytes_read
, void *arg
);
78 static int ch_on_crypto_release_record(size_t bytes_read
, void *arg
);
79 static int crypto_ensure_empty(QUIC_RSTREAM
*rstream
);
80 static int ch_on_crypto_send(const unsigned char *buf
, size_t buf_len
,
81 size_t *consumed
, void *arg
);
82 static OSSL_TIME
get_time(void *arg
);
83 static uint64_t get_stream_limit(int uni
, void *arg
);
84 static int rx_late_validate(QUIC_PN pn
, int pn_space
, void *arg
);
85 static void rxku_detected(QUIC_PN pn
, void *arg
);
86 static int ch_retry(QUIC_CHANNEL
*ch
,
87 const unsigned char *retry_token
,
88 size_t retry_token_len
,
89 const QUIC_CONN_ID
*retry_scid
);
90 static void ch_update_idle(QUIC_CHANNEL
*ch
);
91 static int ch_discard_el(QUIC_CHANNEL
*ch
,
93 static void ch_on_idle_timeout(QUIC_CHANNEL
*ch
);
94 static void ch_update_idle(QUIC_CHANNEL
*ch
);
95 static void ch_update_ping_deadline(QUIC_CHANNEL
*ch
);
96 static void ch_on_terminating_timeout(QUIC_CHANNEL
*ch
);
97 static void ch_start_terminating(QUIC_CHANNEL
*ch
,
98 const QUIC_TERMINATE_CAUSE
*tcause
,
100 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK
*ack
, uint32_t pn_space
,
102 static void ch_rx_handle_version_neg(QUIC_CHANNEL
*ch
, OSSL_QRX_PKT
*pkt
);
103 static void ch_raise_version_neg_failure(QUIC_CHANNEL
*ch
);
104 static void ch_record_state_transition(QUIC_CHANNEL
*ch
, uint32_t new_state
);
106 DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM
);
109 static QLOG
*ch_get_qlog(QUIC_CHANNEL
*ch
)
111 #ifndef OPENSSL_NO_QLOG
112 QLOG_TRACE_INFO qti
= {0};
114 if (ch
->qlog
!= NULL
)
120 if (ch
->is_server
&& ch
->init_dcid
.id_len
== 0)
123 qti
.odcid
= ch
->init_dcid
;
124 qti
.title
= ch
->qlog_title
;
125 qti
.description
= NULL
;
127 qti
.is_server
= ch
->is_server
;
128 qti
.now_cb
= get_time
;
130 if ((ch
->qlog
= ossl_qlog_new_from_env(&qti
)) == NULL
) {
131 ch
->use_qlog
= 0; /* don't try again */
142 static QLOG
*ch_get_qlog_cb(void *arg
)
144 QUIC_CHANNEL
*ch
= arg
;
146 return ch_get_qlog(ch
);
150 * QUIC Channel Initialization and Teardown
151 * ========================================
153 #define DEFAULT_INIT_CONN_RXFC_WND (768 * 1024)
154 #define DEFAULT_CONN_RXFC_MAX_WND_MUL 20
156 #define DEFAULT_INIT_STREAM_RXFC_WND (512 * 1024)
157 #define DEFAULT_STREAM_RXFC_MAX_WND_MUL 12
159 #define DEFAULT_INIT_CONN_MAX_STREAMS 100
161 static int ch_init(QUIC_CHANNEL
*ch
)
163 OSSL_QUIC_TX_PACKETISER_ARGS txp_args
= {0};
164 OSSL_QTX_ARGS qtx_args
= {0};
165 OSSL_QRX_ARGS qrx_args
= {0};
166 QUIC_TLS_ARGS tls_args
= {0};
168 size_t rx_short_dcid_len
;
169 size_t tx_init_dcid_len
;
171 if (ch
->port
== NULL
|| ch
->lcidm
== NULL
|| ch
->srtm
== NULL
)
174 rx_short_dcid_len
= ossl_quic_port_get_rx_short_dcid_len(ch
->port
);
175 tx_init_dcid_len
= ossl_quic_port_get_tx_init_dcid_len(ch
->port
);
177 /* For clients, generate our initial DCID. */
179 && !ossl_quic_gen_rand_conn_id(ch
->port
->engine
->libctx
, tx_init_dcid_len
,
183 /* We plug in a network write BIO to the QTX later when we get one. */
184 qtx_args
.libctx
= ch
->port
->engine
->libctx
;
185 qtx_args
.get_qlog_cb
= ch_get_qlog_cb
;
186 qtx_args
.get_qlog_cb_arg
= ch
;
187 qtx_args
.mdpl
= QUIC_MIN_INITIAL_DGRAM_LEN
;
188 ch
->rx_max_udp_payload_size
= qtx_args
.mdpl
;
190 ch
->ping_deadline
= ossl_time_infinite();
192 ch
->qtx
= ossl_qtx_new(&qtx_args
);
196 ch
->txpim
= ossl_quic_txpim_new();
197 if (ch
->txpim
== NULL
)
200 ch
->cfq
= ossl_quic_cfq_new();
204 if (!ossl_quic_txfc_init(&ch
->conn_txfc
, NULL
))
208 * Note: The TP we transmit governs what the peer can transmit and thus
209 * applies to the RXFC.
211 ch
->tx_init_max_stream_data_bidi_local
= DEFAULT_INIT_STREAM_RXFC_WND
;
212 ch
->tx_init_max_stream_data_bidi_remote
= DEFAULT_INIT_STREAM_RXFC_WND
;
213 ch
->tx_init_max_stream_data_uni
= DEFAULT_INIT_STREAM_RXFC_WND
;
215 if (!ossl_quic_rxfc_init(&ch
->conn_rxfc
, NULL
,
216 DEFAULT_INIT_CONN_RXFC_WND
,
217 DEFAULT_CONN_RXFC_MAX_WND_MUL
*
218 DEFAULT_INIT_CONN_RXFC_WND
,
222 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
)
223 if (!ossl_quic_rxfc_init_standalone(&ch
->crypto_rxfc
[pn_space
],
224 INIT_CRYPTO_RECV_BUF_LEN
,
228 if (!ossl_quic_rxfc_init_standalone(&ch
->max_streams_bidi_rxfc
,
229 DEFAULT_INIT_CONN_MAX_STREAMS
,
233 if (!ossl_quic_rxfc_init_standalone(&ch
->max_streams_uni_rxfc
,
234 DEFAULT_INIT_CONN_MAX_STREAMS
,
238 if (!ossl_statm_init(&ch
->statm
))
242 ch
->cc_method
= &ossl_cc_newreno_method
;
243 if ((ch
->cc_data
= ch
->cc_method
->new(get_time
, ch
)) == NULL
)
246 if ((ch
->ackm
= ossl_ackm_new(get_time
, ch
, &ch
->statm
,
247 ch
->cc_method
, ch
->cc_data
)) == NULL
)
250 if (!ossl_quic_stream_map_init(&ch
->qsm
, get_stream_limit
, ch
,
251 &ch
->max_streams_bidi_rxfc
,
252 &ch
->max_streams_uni_rxfc
,
259 && !ossl_quic_lcidm_generate_initial(ch
->lcidm
, ch
, &txp_args
.cur_scid
))
262 /* We use a zero-length SCID. */
263 txp_args
.cur_dcid
= ch
->init_dcid
;
264 txp_args
.ack_delay_exponent
= 3;
265 txp_args
.qtx
= ch
->qtx
;
266 txp_args
.txpim
= ch
->txpim
;
267 txp_args
.cfq
= ch
->cfq
;
268 txp_args
.ackm
= ch
->ackm
;
269 txp_args
.qsm
= &ch
->qsm
;
270 txp_args
.conn_txfc
= &ch
->conn_txfc
;
271 txp_args
.conn_rxfc
= &ch
->conn_rxfc
;
272 txp_args
.max_streams_bidi_rxfc
= &ch
->max_streams_bidi_rxfc
;
273 txp_args
.max_streams_uni_rxfc
= &ch
->max_streams_uni_rxfc
;
274 txp_args
.cc_method
= ch
->cc_method
;
275 txp_args
.cc_data
= ch
->cc_data
;
276 txp_args
.now
= get_time
;
277 txp_args
.now_arg
= ch
;
278 txp_args
.get_qlog_cb
= ch_get_qlog_cb
;
279 txp_args
.get_qlog_cb_arg
= ch
;
281 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
282 ch
->crypto_send
[pn_space
] = ossl_quic_sstream_new(INIT_CRYPTO_SEND_BUF_LEN
);
283 if (ch
->crypto_send
[pn_space
] == NULL
)
286 txp_args
.crypto
[pn_space
] = ch
->crypto_send
[pn_space
];
289 ch
->txp
= ossl_quic_tx_packetiser_new(&txp_args
);
293 ossl_quic_tx_packetiser_set_ack_tx_cb(ch
->txp
, ch_on_txp_ack_tx
, ch
);
295 qrx_args
.libctx
= ch
->port
->engine
->libctx
;
296 qrx_args
.demux
= ch
->port
->demux
;
297 qrx_args
.short_conn_id_len
= rx_short_dcid_len
;
298 qrx_args
.max_deferred
= 32;
300 if ((ch
->qrx
= ossl_qrx_new(&qrx_args
)) == NULL
)
303 if (!ossl_qrx_set_late_validation_cb(ch
->qrx
,
308 if (!ossl_qrx_set_key_update_cb(ch
->qrx
,
313 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
314 ch
->crypto_recv
[pn_space
] = ossl_quic_rstream_new(NULL
, NULL
, 0);
315 if (ch
->crypto_recv
[pn_space
] == NULL
)
319 /* Plug in the TLS handshake layer. */
320 tls_args
.s
= ch
->tls
;
321 tls_args
.crypto_send_cb
= ch_on_crypto_send
;
322 tls_args
.crypto_send_cb_arg
= ch
;
323 tls_args
.crypto_recv_rcd_cb
= ch_on_crypto_recv_record
;
324 tls_args
.crypto_recv_rcd_cb_arg
= ch
;
325 tls_args
.crypto_release_rcd_cb
= ch_on_crypto_release_record
;
326 tls_args
.crypto_release_rcd_cb_arg
= ch
;
327 tls_args
.yield_secret_cb
= ch_on_handshake_yield_secret
;
328 tls_args
.yield_secret_cb_arg
= ch
;
329 tls_args
.got_transport_params_cb
= ch_on_transport_params
;
330 tls_args
.got_transport_params_cb_arg
= ch
;
331 tls_args
.handshake_complete_cb
= ch_on_handshake_complete
;
332 tls_args
.handshake_complete_cb_arg
= ch
;
333 tls_args
.alert_cb
= ch_on_handshake_alert
;
334 tls_args
.alert_cb_arg
= ch
;
335 tls_args
.is_server
= ch
->is_server
;
337 if ((ch
->qtls
= ossl_quic_tls_new(&tls_args
)) == NULL
)
340 ch
->tx_max_ack_delay
= DEFAULT_MAX_ACK_DELAY
;
341 ch
->rx_max_ack_delay
= QUIC_DEFAULT_MAX_ACK_DELAY
;
342 ch
->rx_ack_delay_exp
= QUIC_DEFAULT_ACK_DELAY_EXP
;
343 ch
->rx_active_conn_id_limit
= QUIC_MIN_ACTIVE_CONN_ID_LIMIT
;
344 ch
->tx_enc_level
= QUIC_ENC_LEVEL_INITIAL
;
345 ch
->rx_enc_level
= QUIC_ENC_LEVEL_INITIAL
;
346 ch
->txku_threshold_override
= UINT64_MAX
;
348 ch
->max_idle_timeout_local_req
= QUIC_DEFAULT_IDLE_TIMEOUT
;
349 ch
->max_idle_timeout_remote_req
= 0;
350 ch
->max_idle_timeout
= ch
->max_idle_timeout_local_req
;
352 ossl_ackm_set_tx_max_ack_delay(ch
->ackm
, ossl_ms2time(ch
->tx_max_ack_delay
));
353 ossl_ackm_set_rx_max_ack_delay(ch
->ackm
, ossl_ms2time(ch
->rx_max_ack_delay
));
356 ossl_list_ch_insert_tail(&ch
->port
->channel_list
, ch
);
357 ch
->on_port_list
= 1;
365 static void ch_cleanup(QUIC_CHANNEL
*ch
)
369 if (ch
->ackm
!= NULL
)
370 for (pn_space
= QUIC_PN_SPACE_INITIAL
;
371 pn_space
< QUIC_PN_SPACE_NUM
;
373 ossl_ackm_on_pkt_space_discarded(ch
->ackm
, pn_space
);
375 ossl_quic_lcidm_cull(ch
->lcidm
, ch
);
376 ossl_quic_srtm_cull(ch
->srtm
, ch
);
377 ossl_quic_tx_packetiser_free(ch
->txp
);
378 ossl_quic_txpim_free(ch
->txpim
);
379 ossl_quic_cfq_free(ch
->cfq
);
380 ossl_qtx_free(ch
->qtx
);
381 if (ch
->cc_data
!= NULL
)
382 ch
->cc_method
->free(ch
->cc_data
);
384 ossl_statm_destroy(&ch
->statm
);
385 ossl_ackm_free(ch
->ackm
);
388 ossl_quic_stream_map_cleanup(&ch
->qsm
);
390 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
391 ossl_quic_sstream_free(ch
->crypto_send
[pn_space
]);
392 ossl_quic_rstream_free(ch
->crypto_recv
[pn_space
]);
395 ossl_qrx_pkt_release(ch
->qrx_pkt
);
398 ossl_quic_tls_free(ch
->qtls
);
399 ossl_qrx_free(ch
->qrx
);
400 OPENSSL_free(ch
->local_transport_params
);
401 OPENSSL_free((char *)ch
->terminate_cause
.reason
);
402 OSSL_ERR_STATE_free(ch
->err_state
);
403 OPENSSL_free(ch
->ack_range_scratch
);
405 if (ch
->on_port_list
) {
406 ossl_list_ch_remove(&ch
->port
->channel_list
, ch
);
407 ch
->on_port_list
= 0;
410 #ifndef OPENSSL_NO_QLOG
411 if (ch
->qlog
!= NULL
)
412 ossl_qlog_flush(ch
->qlog
); /* best effort */
414 OPENSSL_free(ch
->qlog_title
);
415 ossl_qlog_free(ch
->qlog
);
419 QUIC_CHANNEL
*ossl_quic_channel_new(const QUIC_CHANNEL_ARGS
*args
)
421 QUIC_CHANNEL
*ch
= NULL
;
423 if ((ch
= OPENSSL_zalloc(sizeof(*ch
))) == NULL
)
426 ch
->port
= args
->port
;
427 ch
->is_server
= args
->is_server
;
429 ch
->lcidm
= args
->lcidm
;
430 ch
->srtm
= args
->srtm
;
431 #ifndef OPENSSL_NO_QLOG
432 ch
->use_qlog
= args
->use_qlog
;
434 if (ch
->use_qlog
&& args
->qlog_title
!= NULL
) {
435 if ((ch
->qlog_title
= OPENSSL_strdup(args
->qlog_title
)) == NULL
) {
450 void ossl_quic_channel_free(QUIC_CHANNEL
*ch
)
459 /* Set mutator callbacks for test framework support */
460 int ossl_quic_channel_set_mutator(QUIC_CHANNEL
*ch
,
461 ossl_mutate_packet_cb mutatecb
,
462 ossl_finish_mutate_cb finishmutatecb
,
468 ossl_qtx_set_mutator(ch
->qtx
, mutatecb
, finishmutatecb
, mutatearg
);
472 int ossl_quic_channel_get_peer_addr(QUIC_CHANNEL
*ch
, BIO_ADDR
*peer_addr
)
474 if (!ch
->addressed_mode
)
477 *peer_addr
= ch
->cur_peer_addr
;
481 int ossl_quic_channel_set_peer_addr(QUIC_CHANNEL
*ch
, const BIO_ADDR
*peer_addr
)
483 if (ch
->state
!= QUIC_CHANNEL_STATE_IDLE
)
486 if (peer_addr
== NULL
|| BIO_ADDR_family(peer_addr
) == AF_UNSPEC
) {
487 BIO_ADDR_clear(&ch
->cur_peer_addr
);
488 ch
->addressed_mode
= 0;
492 ch
->cur_peer_addr
= *peer_addr
;
493 ch
->addressed_mode
= 1;
497 QUIC_REACTOR
*ossl_quic_channel_get_reactor(QUIC_CHANNEL
*ch
)
499 return ossl_quic_port_get0_reactor(ch
->port
);
502 QUIC_STREAM_MAP
*ossl_quic_channel_get_qsm(QUIC_CHANNEL
*ch
)
507 OSSL_STATM
*ossl_quic_channel_get_statm(QUIC_CHANNEL
*ch
)
512 QUIC_STREAM
*ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL
*ch
,
515 return ossl_quic_stream_map_get_by_id(&ch
->qsm
, stream_id
);
518 int ossl_quic_channel_is_active(const QUIC_CHANNEL
*ch
)
520 return ch
!= NULL
&& ch
->state
== QUIC_CHANNEL_STATE_ACTIVE
;
523 int ossl_quic_channel_is_closing(const QUIC_CHANNEL
*ch
)
525 return ch
->state
== QUIC_CHANNEL_STATE_TERMINATING_CLOSING
;
528 static int ossl_quic_channel_is_draining(const QUIC_CHANNEL
*ch
)
530 return ch
->state
== QUIC_CHANNEL_STATE_TERMINATING_DRAINING
;
533 static int ossl_quic_channel_is_terminating(const QUIC_CHANNEL
*ch
)
535 return ossl_quic_channel_is_closing(ch
)
536 || ossl_quic_channel_is_draining(ch
);
539 int ossl_quic_channel_is_terminated(const QUIC_CHANNEL
*ch
)
541 return ch
->state
== QUIC_CHANNEL_STATE_TERMINATED
;
544 int ossl_quic_channel_is_term_any(const QUIC_CHANNEL
*ch
)
546 return ossl_quic_channel_is_terminating(ch
)
547 || ossl_quic_channel_is_terminated(ch
);
550 const QUIC_TERMINATE_CAUSE
*
551 ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL
*ch
)
553 return ossl_quic_channel_is_term_any(ch
) ? &ch
->terminate_cause
: NULL
;
556 int ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL
*ch
)
558 return ch
->handshake_complete
;
561 int ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL
*ch
)
563 return ch
->handshake_confirmed
;
566 QUIC_DEMUX
*ossl_quic_channel_get0_demux(QUIC_CHANNEL
*ch
)
568 return ch
->port
->demux
;
571 QUIC_PORT
*ossl_quic_channel_get0_port(QUIC_CHANNEL
*ch
)
576 QUIC_ENGINE
*ossl_quic_channel_get0_engine(QUIC_CHANNEL
*ch
)
578 return ossl_quic_port_get0_engine(ch
->port
);
581 CRYPTO_MUTEX
*ossl_quic_channel_get_mutex(QUIC_CHANNEL
*ch
)
583 return ossl_quic_port_get0_mutex(ch
->port
);
586 int ossl_quic_channel_has_pending(const QUIC_CHANNEL
*ch
)
588 return ossl_quic_demux_has_pending(ch
->port
->demux
)
589 || ossl_qrx_processed_read_pending(ch
->qrx
);
593 * QUIC Channel: Callbacks from Miscellaneous Subsidiary Components
594 * ================================================================
597 /* Used by various components. */
598 static OSSL_TIME
get_time(void *arg
)
600 QUIC_CHANNEL
*ch
= arg
;
602 return ossl_quic_port_get_time(ch
->port
);
606 static uint64_t get_stream_limit(int uni
, void *arg
)
608 QUIC_CHANNEL
*ch
= arg
;
610 return uni
? ch
->max_local_streams_uni
: ch
->max_local_streams_bidi
;
614 * Called by QRX to determine if a packet is potentially invalid before trying
617 static int rx_late_validate(QUIC_PN pn
, int pn_space
, void *arg
)
619 QUIC_CHANNEL
*ch
= arg
;
621 /* Potential duplicates should not be processed. */
622 if (!ossl_ackm_is_rx_pn_processable(ch
->ackm
, pn
, pn_space
))
629 * Triggers a TXKU (whether spontaneous or solicited). Does not check whether
630 * spontaneous TXKU is currently allowed.
633 static void ch_trigger_txku(QUIC_CHANNEL
*ch
)
636 = ossl_quic_tx_packetiser_get_next_pn(ch
->txp
, QUIC_PN_SPACE_APP
);
638 if (!ossl_quic_pn_valid(next_pn
)
639 || !ossl_qtx_trigger_key_update(ch
->qtx
)) {
640 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_INTERNAL_ERROR
, 0,
645 ch
->txku_in_progress
= 1;
646 ch
->txku_pn
= next_pn
;
647 ch
->rxku_expected
= ch
->ku_locally_initiated
;
651 static int txku_in_progress(QUIC_CHANNEL
*ch
)
653 if (ch
->txku_in_progress
654 && ossl_ackm_get_largest_acked(ch
->ackm
, QUIC_PN_SPACE_APP
) >= ch
->txku_pn
) {
655 OSSL_TIME pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
658 * RFC 9001 s. 6.5: Endpoints SHOULD wait three times the PTO before
659 * initiating a key update after receiving an acknowledgment that
660 * confirms that the previous key update was received.
662 * Note that by the above wording, this period starts from when we get
663 * the ack for a TXKU-triggering packet, not when the TXKU is initiated.
664 * So we defer TXKU cooldown deadline calculation to this point.
666 ch
->txku_in_progress
= 0;
667 ch
->txku_cooldown_deadline
= ossl_time_add(get_time(ch
),
668 ossl_time_multiply(pto
, 3));
671 return ch
->txku_in_progress
;
675 static int txku_allowed(QUIC_CHANNEL
*ch
)
677 return ch
->tx_enc_level
== QUIC_ENC_LEVEL_1RTT
/* Sanity check. */
678 /* Strict RFC 9001 criterion for TXKU. */
679 && ch
->handshake_confirmed
680 && !txku_in_progress(ch
);
684 static int txku_recommendable(QUIC_CHANNEL
*ch
)
686 if (!txku_allowed(ch
))
690 /* Recommended RFC 9001 criterion for TXKU. */
691 ossl_time_compare(get_time(ch
), ch
->txku_cooldown_deadline
) >= 0
692 /* Some additional sensible criteria. */
693 && !ch
->rxku_in_progress
694 && !ch
->rxku_pending_confirm
;
698 static int txku_desirable(QUIC_CHANNEL
*ch
)
700 uint64_t cur_pkt_count
, max_pkt_count
, thresh_pkt_count
;
701 const uint32_t enc_level
= QUIC_ENC_LEVEL_1RTT
;
703 /* Check AEAD limit to determine if we should perform a spontaneous TXKU. */
704 cur_pkt_count
= ossl_qtx_get_cur_epoch_pkt_count(ch
->qtx
, enc_level
);
705 max_pkt_count
= ossl_qtx_get_max_epoch_pkt_count(ch
->qtx
, enc_level
);
707 thresh_pkt_count
= max_pkt_count
/ 2;
708 if (ch
->txku_threshold_override
!= UINT64_MAX
)
709 thresh_pkt_count
= ch
->txku_threshold_override
;
711 return cur_pkt_count
>= thresh_pkt_count
;
715 static void ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL
*ch
)
717 if (!txku_recommendable(ch
) || !txku_desirable(ch
))
720 ch
->ku_locally_initiated
= 1;
725 static int rxku_allowed(QUIC_CHANNEL
*ch
)
728 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a key update prior to
729 * having confirmed the handshake (Section 4.1.2).
731 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a subsequent key update
732 * unless it has received an acknowledgment for a packet that was sent
733 * protected with keys from the current key phase.
735 * RFC 9001 s. 6.2: If an endpoint detects a second update before it has
736 * sent any packets with updated keys containing an acknowledgment for the
737 * packet that initiated the key update, it indicates that its peer has
738 * updated keys twice without awaiting confirmation. An endpoint MAY treat
739 * such consecutive key updates as a connection error of type
742 return ch
->handshake_confirmed
&& !ch
->rxku_pending_confirm
;
746 * Called when the QRX detects a new RX key update event.
750 DECISION_PROTOCOL_VIOLATION
,
751 DECISION_SOLICITED_TXKU
754 /* Called when the QRX detects a key update has occurred. */
756 static void rxku_detected(QUIC_PN pn
, void *arg
)
758 QUIC_CHANNEL
*ch
= arg
;
759 enum rxku_decision decision
;
763 * Note: rxku_in_progress is always 0 here as an RXKU cannot be detected
764 * when we are still in UPDATING or COOLDOWN (see quic_record_rx.h).
766 assert(!ch
->rxku_in_progress
);
768 if (!rxku_allowed(ch
))
769 /* Is RXKU even allowed at this time? */
770 decision
= DECISION_PROTOCOL_VIOLATION
;
772 else if (ch
->ku_locally_initiated
)
774 * If this key update was locally initiated (meaning that this detected
775 * RXKU event is a result of our own spontaneous TXKU), we do not
776 * trigger another TXKU; after all, to do so would result in an infinite
777 * ping-pong of key updates. We still process it as an RXKU.
779 decision
= DECISION_RXKU_ONLY
;
783 * Otherwise, a peer triggering a KU means we have to trigger a KU also.
785 decision
= DECISION_SOLICITED_TXKU
;
787 if (decision
== DECISION_PROTOCOL_VIOLATION
) {
788 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_KEY_UPDATE_ERROR
,
789 0, "RX key update again too soon");
793 pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
795 ch
->ku_locally_initiated
= 0;
796 ch
->rxku_in_progress
= 1;
797 ch
->rxku_pending_confirm
= 1;
798 ch
->rxku_trigger_pn
= pn
;
799 ch
->rxku_update_end_deadline
= ossl_time_add(get_time(ch
), pto
);
800 ch
->rxku_expected
= 0;
802 if (decision
== DECISION_SOLICITED_TXKU
)
803 /* NOT gated by usual txku_allowed() */
807 * Ordinarily, we only generate ACK when some ACK-eliciting frame has been
808 * received. In some cases, this may not occur for a long time, for example
809 * if transmission of application data is going in only one direction and
810 * nothing else is happening with the connection. However, since the peer
811 * cannot initiate a subsequent (spontaneous) TXKU until its prior
812 * (spontaneous or solicited) TXKU has completed - meaning that prior
813 * TXKU's trigger packet (or subsequent packet) has been acknowledged, this
814 * can lead to very long times before a TXKU is considered 'completed'.
815 * Optimise this by forcing ACK generation after triggering TXKU.
816 * (Basically, we consider a RXKU event something that is 'ACK-eliciting',
817 * which it more or less should be; it is necessarily separate from ordinary
818 * processing of ACK-eliciting frames as key update is not indicated via a
821 ossl_quic_tx_packetiser_schedule_ack(ch
->txp
, QUIC_PN_SPACE_APP
);
824 /* Called per tick to handle RXKU timer events. */
826 static void ch_rxku_tick(QUIC_CHANNEL
*ch
)
828 if (!ch
->rxku_in_progress
829 || ossl_time_compare(get_time(ch
), ch
->rxku_update_end_deadline
) < 0)
832 ch
->rxku_update_end_deadline
= ossl_time_infinite();
833 ch
->rxku_in_progress
= 0;
835 if (!ossl_qrx_key_update_timeout(ch
->qrx
, /*normal=*/1))
836 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_INTERNAL_ERROR
, 0,
837 "RXKU cooldown internal error");
841 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK
*ack
, uint32_t pn_space
,
844 QUIC_CHANNEL
*ch
= arg
;
846 if (pn_space
!= QUIC_PN_SPACE_APP
|| !ch
->rxku_pending_confirm
847 || !ossl_quic_frame_ack_contains_pn(ack
, ch
->rxku_trigger_pn
))
851 * Defer clearing rxku_pending_confirm until TXP generate call returns
854 ch
->rxku_pending_confirm_done
= 1;
858 * QUIC Channel: Handshake Layer Event Handling
859 * ============================================
861 static int ch_on_crypto_send(const unsigned char *buf
, size_t buf_len
,
862 size_t *consumed
, void *arg
)
865 QUIC_CHANNEL
*ch
= arg
;
866 uint32_t enc_level
= ch
->tx_enc_level
;
867 uint32_t pn_space
= ossl_quic_enc_level_to_pn_space(enc_level
);
868 QUIC_SSTREAM
*sstream
= ch
->crypto_send
[pn_space
];
870 if (!ossl_assert(sstream
!= NULL
))
873 ret
= ossl_quic_sstream_append(sstream
, buf
, buf_len
, consumed
);
877 static int crypto_ensure_empty(QUIC_RSTREAM
*rstream
)
885 if (!ossl_quic_rstream_available(rstream
, &avail
, &is_fin
))
891 static int ch_on_crypto_recv_record(const unsigned char **buf
,
892 size_t *bytes_read
, void *arg
)
894 QUIC_CHANNEL
*ch
= arg
;
895 QUIC_RSTREAM
*rstream
;
896 int is_fin
= 0; /* crypto stream is never finished, so we don't use this */
900 * After we move to a later EL we must not allow our peer to send any new
901 * bytes in the crypto stream on a previous EL. Retransmissions of old bytes
904 * In practice we will only move to a new EL when we have consumed all bytes
905 * which should be sent on the crypto stream at a previous EL. For example,
906 * the Handshake EL should not be provisioned until we have completely
907 * consumed a TLS 1.3 ServerHello. Thus when we provision an EL the output
908 * of ossl_quic_rstream_available() should be 0 for all lower ELs. Thus if a
909 * given EL is available we simply ensure we have not received any further
910 * bytes at a lower EL.
912 for (i
= QUIC_ENC_LEVEL_INITIAL
; i
< ch
->rx_enc_level
; ++i
)
913 if (i
!= QUIC_ENC_LEVEL_0RTT
&&
914 !crypto_ensure_empty(ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(i
)])) {
915 /* Protocol violation (RFC 9001 s. 4.1.3) */
916 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_PROTOCOL_VIOLATION
,
917 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
918 "crypto stream data in wrong EL");
922 rstream
= ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(ch
->rx_enc_level
)];
926 return ossl_quic_rstream_get_record(rstream
, buf
, bytes_read
,
930 static int ch_on_crypto_release_record(size_t bytes_read
, void *arg
)
932 QUIC_CHANNEL
*ch
= arg
;
933 QUIC_RSTREAM
*rstream
;
934 OSSL_RTT_INFO rtt_info
;
935 uint32_t rx_pn_space
= ossl_quic_enc_level_to_pn_space(ch
->rx_enc_level
);
937 rstream
= ch
->crypto_recv
[rx_pn_space
];
941 ossl_statm_get_rtt_info(ossl_quic_channel_get_statm(ch
), &rtt_info
);
942 if (!ossl_quic_rxfc_on_retire(&ch
->crypto_rxfc
[rx_pn_space
], bytes_read
,
943 rtt_info
.smoothed_rtt
))
946 return ossl_quic_rstream_release_record(rstream
, bytes_read
);
949 static int ch_on_handshake_yield_secret(uint32_t enc_level
, int direction
,
950 uint32_t suite_id
, EVP_MD
*md
,
951 const unsigned char *secret
,
955 QUIC_CHANNEL
*ch
= arg
;
958 if (enc_level
< QUIC_ENC_LEVEL_HANDSHAKE
|| enc_level
>= QUIC_ENC_LEVEL_NUM
)
965 if (enc_level
<= ch
->tx_enc_level
)
967 * Does not make sense for us to try and provision an EL we have already
972 if (!ossl_qtx_provide_secret(ch
->qtx
, enc_level
,
977 ch
->tx_enc_level
= enc_level
;
980 if (enc_level
<= ch
->rx_enc_level
)
982 * Does not make sense for us to try and provision an EL we have already
988 * Ensure all crypto streams for previous ELs are now empty of available
991 for (i
= QUIC_ENC_LEVEL_INITIAL
; i
< enc_level
; ++i
)
992 if (!crypto_ensure_empty(ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(i
)])) {
993 /* Protocol violation (RFC 9001 s. 4.1.3) */
994 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_PROTOCOL_VIOLATION
,
995 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
996 "crypto stream data in wrong EL");
1000 if (!ossl_qrx_provide_secret(ch
->qrx
, enc_level
,
1002 secret
, secret_len
))
1005 ch
->have_new_rx_secret
= 1;
1006 ch
->rx_enc_level
= enc_level
;
1012 static int ch_on_handshake_complete(void *arg
)
1014 QUIC_CHANNEL
*ch
= arg
;
1016 if (!ossl_assert(!ch
->handshake_complete
))
1017 return 0; /* this should not happen twice */
1019 if (!ossl_assert(ch
->tx_enc_level
== QUIC_ENC_LEVEL_1RTT
))
1022 if (!ch
->got_remote_transport_params
) {
1024 * Was not a valid QUIC handshake if we did not get valid transport
1027 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_CRYPTO_MISSING_EXT
,
1028 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
1029 "no transport parameters received");
1033 /* Don't need transport parameters anymore. */
1034 OPENSSL_free(ch
->local_transport_params
);
1035 ch
->local_transport_params
= NULL
;
1037 /* Tell the QRX it can now process 1-RTT packets. */
1038 ossl_qrx_allow_1rtt_processing(ch
->qrx
);
1040 /* Tell TXP the handshake is complete. */
1041 ossl_quic_tx_packetiser_notify_handshake_complete(ch
->txp
);
1043 ch
->handshake_complete
= 1;
1045 if (ch
->is_server
) {
1047 * On the server, the handshake is confirmed as soon as it is complete.
1049 ossl_quic_channel_on_handshake_confirmed(ch
);
1051 ossl_quic_tx_packetiser_schedule_handshake_done(ch
->txp
);
1054 ch_record_state_transition(ch
, ch
->state
);
1058 static int ch_on_handshake_alert(void *arg
, unsigned char alert_code
)
1060 QUIC_CHANNEL
*ch
= arg
;
1063 * RFC 9001 s. 4.4: More specifically, servers MUST NOT send post-handshake
1064 * TLS CertificateRequest messages, and clients MUST treat receipt of such
1065 * messages as a connection error of type PROTOCOL_VIOLATION.
1067 if (alert_code
== SSL_AD_UNEXPECTED_MESSAGE
1068 && ch
->handshake_complete
1069 && ossl_quic_tls_is_cert_request(ch
->qtls
))
1070 ossl_quic_channel_raise_protocol_error(ch
,
1071 OSSL_QUIC_ERR_PROTOCOL_VIOLATION
,
1073 "Post-handshake TLS "
1074 "CertificateRequest received");
1076 * RFC 9001 s. 4.6.1: Servers MUST NOT send the early_data extension with a
1077 * max_early_data_size field set to any value other than 0xffffffff. A
1078 * client MUST treat receipt of a NewSessionTicket that contains an
1079 * early_data extension with any other value as a connection error of type
1080 * PROTOCOL_VIOLATION.
1082 else if (alert_code
== SSL_AD_ILLEGAL_PARAMETER
1083 && ch
->handshake_complete
1084 && ossl_quic_tls_has_bad_max_early_data(ch
->qtls
))
1085 ossl_quic_channel_raise_protocol_error(ch
,
1086 OSSL_QUIC_ERR_PROTOCOL_VIOLATION
,
1088 "Bad max_early_data received");
1090 ossl_quic_channel_raise_protocol_error(ch
,
1091 OSSL_QUIC_ERR_CRYPTO_ERR_BEGIN
1093 0, "handshake alert");
1099 * QUIC Channel: Transport Parameter Handling
1100 * ==========================================
1104 * Called by handshake layer when we receive QUIC Transport Parameters from the
1105 * peer. Note that these are not authenticated until the handshake is marked
1108 #define TP_REASON_SERVER_ONLY(x) \
1109 x " may not be sent by a client"
1110 #define TP_REASON_DUP(x) \
1111 x " appears multiple times"
1112 #define TP_REASON_MALFORMED(x) \
1114 #define TP_REASON_EXPECTED_VALUE(x) \
1115 x " does not match expected value"
1116 #define TP_REASON_NOT_RETRY(x) \
1117 x " sent when not performing a retry"
1118 #define TP_REASON_REQUIRED(x) \
1119 x " was not sent but is required"
1120 #define TP_REASON_INTERNAL_ERROR(x) \
1121 x " encountered internal error"
1123 static void txfc_bump_cwm_bidi(QUIC_STREAM
*s
, void *arg
)
1125 if (!ossl_quic_stream_is_bidi(s
)
1126 || ossl_quic_stream_is_server_init(s
))
1129 ossl_quic_txfc_bump_cwm(&s
->txfc
, *(uint64_t *)arg
);
1132 static void txfc_bump_cwm_uni(QUIC_STREAM
*s
, void *arg
)
1134 if (ossl_quic_stream_is_bidi(s
)
1135 || ossl_quic_stream_is_server_init(s
))
1138 ossl_quic_txfc_bump_cwm(&s
->txfc
, *(uint64_t *)arg
);
1141 static void do_update(QUIC_STREAM
*s
, void *arg
)
1143 QUIC_CHANNEL
*ch
= arg
;
1145 ossl_quic_stream_map_update_state(&ch
->qsm
, s
);
1148 static uint64_t min_u64_ignore_0(uint64_t a
, uint64_t b
)
1155 return a
< b
? a
: b
;
1158 static int ch_on_transport_params(const unsigned char *params
,
1162 QUIC_CHANNEL
*ch
= arg
;
1166 const unsigned char *body
;
1167 int got_orig_dcid
= 0;
1168 int got_initial_scid
= 0;
1169 int got_retry_scid
= 0;
1170 int got_initial_max_data
= 0;
1171 int got_initial_max_stream_data_bidi_local
= 0;
1172 int got_initial_max_stream_data_bidi_remote
= 0;
1173 int got_initial_max_stream_data_uni
= 0;
1174 int got_initial_max_streams_bidi
= 0;
1175 int got_initial_max_streams_uni
= 0;
1176 int got_stateless_reset_token
= 0;
1177 int got_preferred_addr
= 0;
1178 int got_ack_delay_exp
= 0;
1179 int got_max_ack_delay
= 0;
1180 int got_max_udp_payload_size
= 0;
1181 int got_max_idle_timeout
= 0;
1182 int got_active_conn_id_limit
= 0;
1183 int got_disable_active_migration
= 0;
1185 const char *reason
= "bad transport parameter";
1186 ossl_unused
uint64_t rx_max_idle_timeout
= 0;
1187 ossl_unused
const void *stateless_reset_token_p
= NULL
;
1188 QUIC_PREFERRED_ADDR pfa
;
1190 if (ch
->got_remote_transport_params
) {
1191 reason
= "multiple transport parameter extensions";
1195 if (!PACKET_buf_init(&pkt
, params
, params_len
)) {
1196 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_INTERNAL_ERROR
, 0,
1197 "internal error (packet buf init)");
1201 while (PACKET_remaining(&pkt
) > 0) {
1202 if (!ossl_quic_wire_peek_transport_param(&pkt
, &id
))
1206 case QUIC_TPARAM_ORIG_DCID
:
1207 if (got_orig_dcid
) {
1208 reason
= TP_REASON_DUP("ORIG_DCID");
1212 if (ch
->is_server
) {
1213 reason
= TP_REASON_SERVER_ONLY("ORIG_DCID");
1217 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1218 reason
= TP_REASON_MALFORMED("ORIG_DCID");
1222 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1223 /* Must match our initial DCID. */
1224 if (!ossl_quic_conn_id_eq(&ch
->init_dcid
, &cid
)) {
1225 reason
= TP_REASON_EXPECTED_VALUE("ORIG_DCID");
1233 case QUIC_TPARAM_RETRY_SCID
:
1234 if (ch
->is_server
) {
1235 reason
= TP_REASON_SERVER_ONLY("RETRY_SCID");
1239 if (got_retry_scid
) {
1240 reason
= TP_REASON_DUP("RETRY_SCID");
1244 if (!ch
->doing_retry
) {
1245 reason
= TP_REASON_NOT_RETRY("RETRY_SCID");
1249 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1250 reason
= TP_REASON_MALFORMED("RETRY_SCID");
1254 /* Must match Retry packet SCID. */
1255 if (!ossl_quic_conn_id_eq(&ch
->retry_scid
, &cid
)) {
1256 reason
= TP_REASON_EXPECTED_VALUE("RETRY_SCID");
1263 case QUIC_TPARAM_INITIAL_SCID
:
1264 if (got_initial_scid
) {
1265 /* must not appear more than once */
1266 reason
= TP_REASON_DUP("INITIAL_SCID");
1270 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1271 reason
= TP_REASON_MALFORMED("INITIAL_SCID");
1275 /* Must match SCID of first Initial packet from server. */
1276 if (!ossl_quic_conn_id_eq(&ch
->init_scid
, &cid
)) {
1277 reason
= TP_REASON_EXPECTED_VALUE("INITIAL_SCID");
1281 got_initial_scid
= 1;
1284 case QUIC_TPARAM_INITIAL_MAX_DATA
:
1285 if (got_initial_max_data
) {
1286 /* must not appear more than once */
1287 reason
= TP_REASON_DUP("INITIAL_MAX_DATA");
1291 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1292 reason
= TP_REASON_MALFORMED("INITIAL_MAX_DATA");
1296 ossl_quic_txfc_bump_cwm(&ch
->conn_txfc
, v
);
1297 got_initial_max_data
= 1;
1300 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL
:
1301 if (got_initial_max_stream_data_bidi_local
) {
1302 /* must not appear more than once */
1303 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1307 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1308 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1313 * This is correct; the BIDI_LOCAL TP governs streams created by
1314 * the endpoint which sends the TP, i.e., our peer.
1316 ch
->rx_init_max_stream_data_bidi_remote
= v
;
1317 got_initial_max_stream_data_bidi_local
= 1;
1320 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE
:
1321 if (got_initial_max_stream_data_bidi_remote
) {
1322 /* must not appear more than once */
1323 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1327 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1328 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1333 * This is correct; the BIDI_REMOTE TP governs streams created
1334 * by the endpoint which receives the TP, i.e., us.
1336 ch
->rx_init_max_stream_data_bidi_local
= v
;
1338 /* Apply to all existing streams. */
1339 ossl_quic_stream_map_visit(&ch
->qsm
, txfc_bump_cwm_bidi
, &v
);
1340 got_initial_max_stream_data_bidi_remote
= 1;
1343 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI
:
1344 if (got_initial_max_stream_data_uni
) {
1345 /* must not appear more than once */
1346 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_UNI");
1350 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1351 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_UNI");
1355 ch
->rx_init_max_stream_data_uni
= v
;
1357 /* Apply to all existing streams. */
1358 ossl_quic_stream_map_visit(&ch
->qsm
, txfc_bump_cwm_uni
, &v
);
1359 got_initial_max_stream_data_uni
= 1;
1362 case QUIC_TPARAM_ACK_DELAY_EXP
:
1363 if (got_ack_delay_exp
) {
1364 /* must not appear more than once */
1365 reason
= TP_REASON_DUP("ACK_DELAY_EXP");
1369 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1370 || v
> QUIC_MAX_ACK_DELAY_EXP
) {
1371 reason
= TP_REASON_MALFORMED("ACK_DELAY_EXP");
1375 ch
->rx_ack_delay_exp
= (unsigned char)v
;
1376 got_ack_delay_exp
= 1;
1379 case QUIC_TPARAM_MAX_ACK_DELAY
:
1380 if (got_max_ack_delay
) {
1381 /* must not appear more than once */
1382 reason
= TP_REASON_DUP("MAX_ACK_DELAY");
1386 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1387 || v
>= (((uint64_t)1) << 14)) {
1388 reason
= TP_REASON_MALFORMED("MAX_ACK_DELAY");
1392 ch
->rx_max_ack_delay
= v
;
1393 ossl_ackm_set_rx_max_ack_delay(ch
->ackm
,
1394 ossl_ms2time(ch
->rx_max_ack_delay
));
1396 got_max_ack_delay
= 1;
1399 case QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI
:
1400 if (got_initial_max_streams_bidi
) {
1401 /* must not appear more than once */
1402 reason
= TP_REASON_DUP("INITIAL_MAX_STREAMS_BIDI");
1406 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1407 || v
> (((uint64_t)1) << 60)) {
1408 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_BIDI");
1412 assert(ch
->max_local_streams_bidi
== 0);
1413 ch
->max_local_streams_bidi
= v
;
1414 got_initial_max_streams_bidi
= 1;
1417 case QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI
:
1418 if (got_initial_max_streams_uni
) {
1419 /* must not appear more than once */
1420 reason
= TP_REASON_DUP("INITIAL_MAX_STREAMS_UNI");
1424 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1425 || v
> (((uint64_t)1) << 60)) {
1426 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_UNI");
1430 assert(ch
->max_local_streams_uni
== 0);
1431 ch
->max_local_streams_uni
= v
;
1432 got_initial_max_streams_uni
= 1;
1435 case QUIC_TPARAM_MAX_IDLE_TIMEOUT
:
1436 if (got_max_idle_timeout
) {
1437 /* must not appear more than once */
1438 reason
= TP_REASON_DUP("MAX_IDLE_TIMEOUT");
1442 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1443 reason
= TP_REASON_MALFORMED("MAX_IDLE_TIMEOUT");
1447 ch
->max_idle_timeout_remote_req
= v
;
1449 ch
->max_idle_timeout
= min_u64_ignore_0(ch
->max_idle_timeout_local_req
,
1450 ch
->max_idle_timeout_remote_req
);
1454 got_max_idle_timeout
= 1;
1455 rx_max_idle_timeout
= v
;
1458 case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE
:
1459 if (got_max_udp_payload_size
) {
1460 /* must not appear more than once */
1461 reason
= TP_REASON_DUP("MAX_UDP_PAYLOAD_SIZE");
1465 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1466 || v
< QUIC_MIN_INITIAL_DGRAM_LEN
) {
1467 reason
= TP_REASON_MALFORMED("MAX_UDP_PAYLOAD_SIZE");
1471 ch
->rx_max_udp_payload_size
= v
;
1472 got_max_udp_payload_size
= 1;
1475 case QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT
:
1476 if (got_active_conn_id_limit
) {
1477 /* must not appear more than once */
1478 reason
= TP_REASON_DUP("ACTIVE_CONN_ID_LIMIT");
1482 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1483 || v
< QUIC_MIN_ACTIVE_CONN_ID_LIMIT
) {
1484 reason
= TP_REASON_MALFORMED("ACTIVE_CONN_ID_LIMIT");
1488 ch
->rx_active_conn_id_limit
= v
;
1489 got_active_conn_id_limit
= 1;
1492 case QUIC_TPARAM_STATELESS_RESET_TOKEN
:
1493 if (got_stateless_reset_token
) {
1494 reason
= TP_REASON_DUP("STATELESS_RESET_TOKEN");
1499 * We must ensure a client doesn't send them because we don't have
1500 * processing for them.
1502 * TODO(QUIC SERVER): remove this restriction
1504 if (ch
->is_server
) {
1505 reason
= TP_REASON_SERVER_ONLY("STATELESS_RESET_TOKEN");
1509 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
, &len
);
1510 if (body
== NULL
|| len
!= QUIC_STATELESS_RESET_TOKEN_LEN
) {
1511 reason
= TP_REASON_MALFORMED("STATELESS_RESET_TOKEN");
1514 if (!ossl_quic_srtm_add(ch
->srtm
, ch
, ch
->cur_remote_seq_num
,
1515 (const QUIC_STATELESS_RESET_TOKEN
*)body
)) {
1516 reason
= TP_REASON_INTERNAL_ERROR("STATELESS_RESET_TOKEN");
1520 stateless_reset_token_p
= body
;
1521 got_stateless_reset_token
= 1;
1524 case QUIC_TPARAM_PREFERRED_ADDR
:
1525 /* TODO(QUIC FUTURE): Handle preferred address. */
1526 if (got_preferred_addr
) {
1527 reason
= TP_REASON_DUP("PREFERRED_ADDR");
1532 * RFC 9000 s. 18.2: "A server that chooses a zero-length
1533 * connection ID MUST NOT provide a preferred address.
1534 * Similarly, a server MUST NOT include a zero-length connection
1535 * ID in this transport parameter. A client MUST treat a
1536 * violation of these requirements as a connection error of type
1537 * TRANSPORT_PARAMETER_ERROR."
1539 if (ch
->is_server
) {
1540 reason
= TP_REASON_SERVER_ONLY("PREFERRED_ADDR");
1544 if (ch
->cur_remote_dcid
.id_len
== 0) {
1545 reason
= "PREFERRED_ADDR provided for zero-length CID";
1549 if (!ossl_quic_wire_decode_transport_param_preferred_addr(&pkt
, &pfa
)) {
1550 reason
= TP_REASON_MALFORMED("PREFERRED_ADDR");
1554 if (pfa
.cid
.id_len
== 0) {
1555 reason
= "zero-length CID in PREFERRED_ADDR";
1559 got_preferred_addr
= 1;
1562 case QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION
:
1563 /* We do not currently handle migration, so nothing to do. */
1564 if (got_disable_active_migration
) {
1565 /* must not appear more than once */
1566 reason
= TP_REASON_DUP("DISABLE_ACTIVE_MIGRATION");
1570 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
, &len
);
1571 if (body
== NULL
|| len
> 0) {
1572 reason
= TP_REASON_MALFORMED("DISABLE_ACTIVE_MIGRATION");
1576 got_disable_active_migration
= 1;
1581 * Skip over and ignore.
1583 * RFC 9000 s. 7.4: We SHOULD treat duplicated transport parameters
1584 * as a connection error, but we are not required to. Currently,
1585 * handle this programmatically by checking for duplicates in the
1586 * parameters that we recognise, as above, but don't bother
1587 * maintaining a list of duplicates for anything we don't recognise.
1589 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
,
1598 if (!got_initial_scid
) {
1599 reason
= TP_REASON_REQUIRED("INITIAL_SCID");
1603 if (!ch
->is_server
) {
1604 if (!got_orig_dcid
) {
1605 reason
= TP_REASON_REQUIRED("ORIG_DCID");
1609 if (ch
->doing_retry
&& !got_retry_scid
) {
1610 reason
= TP_REASON_REQUIRED("RETRY_SCID");
1615 ch
->got_remote_transport_params
= 1;
1617 #ifndef OPENSSL_NO_QLOG
1618 QLOG_EVENT_BEGIN(ch_get_qlog(ch
), transport
, parameters_set
)
1619 QLOG_STR("owner", "remote");
1622 QLOG_CID("original_destination_connection_id",
1624 if (got_initial_scid
)
1625 QLOG_CID("original_source_connection_id",
1628 QLOG_CID("retry_source_connection_id",
1630 if (got_initial_max_data
)
1631 QLOG_U64("initial_max_data",
1632 ossl_quic_txfc_get_cwm(&ch
->conn_txfc
));
1633 if (got_initial_max_stream_data_bidi_local
)
1634 QLOG_U64("initial_max_stream_data_bidi_local",
1635 ch
->rx_init_max_stream_data_bidi_local
);
1636 if (got_initial_max_stream_data_bidi_remote
)
1637 QLOG_U64("initial_max_stream_data_bidi_remote",
1638 ch
->rx_init_max_stream_data_bidi_remote
);
1639 if (got_initial_max_stream_data_uni
)
1640 QLOG_U64("initial_max_stream_data_uni",
1641 ch
->rx_init_max_stream_data_uni
);
1642 if (got_initial_max_streams_bidi
)
1643 QLOG_U64("initial_max_streams_bidi",
1644 ch
->max_local_streams_bidi
);
1645 if (got_initial_max_streams_uni
)
1646 QLOG_U64("initial_max_streams_uni",
1647 ch
->max_local_streams_uni
);
1648 if (got_ack_delay_exp
)
1649 QLOG_U64("ack_delay_exponent", ch
->rx_ack_delay_exp
);
1650 if (got_max_ack_delay
)
1651 QLOG_U64("max_ack_delay", ch
->rx_max_ack_delay
);
1652 if (got_max_udp_payload_size
)
1653 QLOG_U64("max_udp_payload_size", ch
->rx_max_udp_payload_size
);
1654 if (got_max_idle_timeout
)
1655 QLOG_U64("max_idle_timeout", rx_max_idle_timeout
);
1656 if (got_active_conn_id_limit
)
1657 QLOG_U64("active_connection_id_limit", ch
->rx_active_conn_id_limit
);
1658 if (got_stateless_reset_token
)
1659 QLOG_BIN("stateless_reset_token", stateless_reset_token_p
,
1660 QUIC_STATELESS_RESET_TOKEN_LEN
);
1661 if (got_preferred_addr
) {
1662 QLOG_BEGIN("preferred_addr")
1663 QLOG_U64("port_v4", pfa
.ipv4_port
);
1664 QLOG_U64("port_v6", pfa
.ipv6_port
);
1665 QLOG_BIN("ip_v4", pfa
.ipv4
, sizeof(pfa
.ipv4
));
1666 QLOG_BIN("ip_v6", pfa
.ipv6
, sizeof(pfa
.ipv6
));
1667 QLOG_BIN("stateless_reset_token", pfa
.stateless_reset
.token
,
1668 sizeof(pfa
.stateless_reset
.token
));
1669 QLOG_CID("connection_id", &pfa
.cid
);
1672 QLOG_BOOL("disable_active_migration", got_disable_active_migration
);
1676 if (got_initial_max_data
|| got_initial_max_stream_data_bidi_remote
1677 || got_initial_max_streams_bidi
|| got_initial_max_streams_uni
)
1679 * If FC credit was bumped, we may now be able to send. Update all
1682 ossl_quic_stream_map_visit(&ch
->qsm
, do_update
, ch
);
1684 /* If we are a server, we now generate our own transport parameters. */
1685 if (ch
->is_server
&& !ch_generate_transport_params(ch
)) {
1686 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_INTERNAL_ERROR
, 0,
1694 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_TRANSPORT_PARAMETER_ERROR
,
1700 * Called when we want to generate transport parameters. This is called
1701 * immediately at instantiation time for a client and after we receive the
1702 * client's transport parameters for a server.
1704 static int ch_generate_transport_params(QUIC_CHANNEL
*ch
)
1707 BUF_MEM
*buf_mem
= NULL
;
1712 if (ch
->local_transport_params
!= NULL
|| ch
->got_local_transport_params
)
1715 if ((buf_mem
= BUF_MEM_new()) == NULL
)
1718 if (!WPACKET_init(&wpkt
, buf_mem
))
1723 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt
, QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION
,
1727 if (ch
->is_server
) {
1728 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt
, QUIC_TPARAM_ORIG_DCID
,
1732 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt
, QUIC_TPARAM_INITIAL_SCID
,
1733 &ch
->cur_local_cid
))
1736 /* Client always uses an empty SCID. */
1737 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt
, QUIC_TPARAM_INITIAL_SCID
,
1742 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_IDLE_TIMEOUT
,
1743 ch
->max_idle_timeout_local_req
))
1746 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE
,
1747 QUIC_MIN_INITIAL_DGRAM_LEN
))
1750 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT
,
1751 QUIC_MIN_ACTIVE_CONN_ID_LIMIT
))
1754 if (ch
->tx_max_ack_delay
!= QUIC_DEFAULT_MAX_ACK_DELAY
1755 && !ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_ACK_DELAY
,
1756 ch
->tx_max_ack_delay
))
1759 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_DATA
,
1760 ossl_quic_rxfc_get_cwm(&ch
->conn_rxfc
)))
1763 /* Send the default CWM for a new RXFC. */
1764 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL
,
1765 ch
->tx_init_max_stream_data_bidi_local
))
1768 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE
,
1769 ch
->tx_init_max_stream_data_bidi_remote
))
1772 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI
,
1773 ch
->tx_init_max_stream_data_uni
))
1776 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI
,
1777 ossl_quic_rxfc_get_cwm(&ch
->max_streams_bidi_rxfc
)))
1780 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI
,
1781 ossl_quic_rxfc_get_cwm(&ch
->max_streams_uni_rxfc
)))
1784 if (!WPACKET_finish(&wpkt
))
1789 if (!WPACKET_get_total_written(&wpkt
, &buf_len
))
1792 ch
->local_transport_params
= (unsigned char *)buf_mem
->data
;
1793 buf_mem
->data
= NULL
;
1796 if (!ossl_quic_tls_set_transport_params(ch
->qtls
, ch
->local_transport_params
,
1800 #ifndef OPENSSL_NO_QLOG
1801 QLOG_EVENT_BEGIN(ch_get_qlog(ch
), transport
, parameters_set
)
1802 QLOG_STR("owner", "local");
1803 QLOG_BOOL("disable_active_migration", 1);
1804 if (ch
->is_server
) {
1805 QLOG_CID("original_destination_connection_id", &ch
->init_dcid
);
1806 QLOG_CID("initial_source_connection_id", &ch
->cur_local_cid
);
1808 QLOG_STR("initial_source_connection_id", "");
1810 QLOG_U64("max_idle_timeout", ch
->max_idle_timeout
);
1811 QLOG_U64("max_udp_payload_size", QUIC_MIN_INITIAL_DGRAM_LEN
);
1812 QLOG_U64("active_connection_id_limit", QUIC_MIN_ACTIVE_CONN_ID_LIMIT
);
1813 QLOG_U64("max_ack_delay", ch
->tx_max_ack_delay
);
1814 QLOG_U64("initial_max_data", ossl_quic_rxfc_get_cwm(&ch
->conn_rxfc
));
1815 QLOG_U64("initial_max_stream_data_bidi_local",
1816 ch
->tx_init_max_stream_data_bidi_local
);
1817 QLOG_U64("initial_max_stream_data_bidi_remote",
1818 ch
->tx_init_max_stream_data_bidi_remote
);
1819 QLOG_U64("initial_max_stream_data_uni",
1820 ch
->tx_init_max_stream_data_uni
);
1821 QLOG_U64("initial_max_streams_bidi",
1822 ossl_quic_rxfc_get_cwm(&ch
->max_streams_bidi_rxfc
));
1823 QLOG_U64("initial_max_streams_uni",
1824 ossl_quic_rxfc_get_cwm(&ch
->max_streams_uni_rxfc
));
1828 ch
->got_local_transport_params
= 1;
1833 WPACKET_cleanup(&wpkt
);
1834 BUF_MEM_free(buf_mem
);
1839 * QUIC Channel: Ticker-Mutator
1840 * ============================
1844 * The central ticker function called by the reactor. This does everything, or
1845 * at least everything network I/O related. Best effort - not allowed to fail
1848 void ossl_quic_channel_subtick(QUIC_CHANNEL
*ch
, QUIC_TICK_RESULT
*res
,
1851 OSSL_TIME now
, deadline
;
1852 int channel_only
= (flags
& QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY
) != 0;
1855 * When we tick the QUIC connection, we do everything we need to do
1856 * periodically. Network I/O handling will already have been performed
1857 * as necessary by the QUIC port. Thus, in order, we:
1859 * - handle any packets the DEMUX has queued up for us;
1860 * - handle any timer events which are due to fire (ACKM, etc.);
1861 * - generate any packets which need to be sent;
1862 * - determine the time at which we should next be ticked.
1865 /* If we are in the TERMINATED state, there is nothing to do. */
1866 if (ossl_quic_channel_is_terminated(ch
)) {
1867 res
->net_read_desired
= 0;
1868 res
->net_write_desired
= 0;
1869 res
->tick_deadline
= ossl_time_infinite();
1874 * If we are in the TERMINATING state, check if the terminating timer has
1877 if (ossl_quic_channel_is_terminating(ch
)) {
1880 if (ossl_time_compare(now
, ch
->terminate_deadline
) >= 0) {
1881 ch_on_terminating_timeout(ch
);
1882 res
->net_read_desired
= 0;
1883 res
->net_write_desired
= 0;
1884 res
->tick_deadline
= ossl_time_infinite();
1885 return; /* abort normal processing, nothing to do */
1889 if (!ch
->port
->engine
->inhibit_tick
) {
1890 /* Handle RXKU timeouts. */
1894 /* Process queued incoming packets. */
1895 ch
->did_tls_tick
= 0;
1896 ch
->have_new_rx_secret
= 0;
1897 ch_rx(ch
, channel_only
);
1900 * Allow the handshake layer to check for any new incoming data and
1901 * generate new outgoing data.
1903 if (!ch
->did_tls_tick
)
1904 ch_tick_tls(ch
, channel_only
);
1907 * If the handshake layer gave us a new secret, we need to do RX
1908 * again because packets that were not previously processable and
1909 * were deferred might now be processable.
1911 * TODO(QUIC FUTURE): Consider handling this in the yield_secret callback.
1913 } while (ch
->have_new_rx_secret
);
1917 * Handle any timer events which are due to fire; namely, the loss
1918 * detection deadline and the idle timeout.
1920 * ACKM ACK generation deadline is polled by TXP, so we don't need to
1924 if (ossl_time_compare(now
, ch
->idle_deadline
) >= 0) {
1926 * Idle timeout differs from normal protocol violation because we do
1927 * not send a CONN_CLOSE frame; go straight to TERMINATED.
1929 if (!ch
->port
->engine
->inhibit_tick
)
1930 ch_on_idle_timeout(ch
);
1932 res
->net_read_desired
= 0;
1933 res
->net_write_desired
= 0;
1934 res
->tick_deadline
= ossl_time_infinite();
1938 if (!ch
->port
->engine
->inhibit_tick
) {
1939 deadline
= ossl_ackm_get_loss_detection_deadline(ch
->ackm
);
1940 if (!ossl_time_is_zero(deadline
)
1941 && ossl_time_compare(now
, deadline
) >= 0)
1942 ossl_ackm_on_timeout(ch
->ackm
);
1944 /* If a ping is due, inform TXP. */
1945 if (ossl_time_compare(now
, ch
->ping_deadline
) >= 0) {
1946 int pn_space
= ossl_quic_enc_level_to_pn_space(ch
->tx_enc_level
);
1948 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch
->txp
, pn_space
);
1951 * If we have no CC budget at this time we cannot process the above
1952 * PING request immediately. In any case we have scheduled the
1953 * request so bump the ping deadline. If we don't do this we will
1954 * busy-loop endlessly as the above deadline comparison condition
1955 * will still be met.
1957 ch_update_ping_deadline(ch
);
1960 /* Queue any data to be sent for transmission. */
1964 ossl_quic_stream_map_gc(&ch
->qsm
);
1967 /* Determine the time at which we should next be ticked. */
1968 res
->tick_deadline
= ch_determine_next_tick_deadline(ch
);
1971 * Always process network input unless we are now terminated. Although we
1972 * had not terminated at the beginning of this tick, network errors in
1973 * ch_tx() may have caused us to transition to the Terminated state.
1975 res
->net_read_desired
= !ossl_quic_channel_is_terminated(ch
);
1977 /* We want to write to the network if we have any data in our TX queue. */
1978 res
->net_write_desired
1979 = (!ossl_quic_channel_is_terminated(ch
)
1980 && ossl_qtx_get_queue_len_datagrams(ch
->qtx
) > 0);
1983 static int ch_tick_tls(QUIC_CHANNEL
*ch
, int channel_only
)
1985 uint64_t error_code
;
1986 const char *error_msg
;
1987 ERR_STATE
*error_state
= NULL
;
1992 ch
->did_tls_tick
= 1;
1993 ossl_quic_tls_tick(ch
->qtls
);
1995 if (ossl_quic_tls_get_error(ch
->qtls
, &error_code
, &error_msg
,
1997 ossl_quic_channel_raise_protocol_error_state(ch
, error_code
, 0,
1998 error_msg
, error_state
);
2005 /* Check incoming forged packet limit and terminate connection if needed. */
2006 static void ch_rx_check_forged_pkt_limit(QUIC_CHANNEL
*ch
)
2009 uint64_t limit
= UINT64_MAX
, l
;
2011 for (enc_level
= QUIC_ENC_LEVEL_INITIAL
;
2012 enc_level
< QUIC_ENC_LEVEL_NUM
;
2016 * Different ELs can have different AEADs which can in turn impose
2017 * different limits, so use the lowest value of any currently valid EL.
2019 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
2022 if (enc_level
> ch
->rx_enc_level
)
2025 l
= ossl_qrx_get_max_forged_pkt_count(ch
->qrx
, enc_level
);
2030 if (ossl_qrx_get_cur_forged_pkt_count(ch
->qrx
) < limit
)
2033 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_AEAD_LIMIT_REACHED
, 0,
2037 /* Process queued incoming packets and handle frames, if any. */
2038 static int ch_rx(QUIC_CHANNEL
*ch
, int channel_only
)
2040 int handled_any
= 0;
2041 const int closing
= ossl_quic_channel_is_closing(ch
);
2043 if (!ch
->is_server
&& !ch
->have_sent_any_pkt
)
2045 * We have not sent anything yet, therefore there is no need to check
2046 * for incoming data.
2051 assert(ch
->qrx_pkt
== NULL
);
2053 if (!ossl_qrx_read_pkt(ch
->qrx
, &ch
->qrx_pkt
))
2056 /* Track the amount of data received while in the closing state */
2058 ossl_quic_tx_packetiser_record_received_closing_bytes(
2059 ch
->txp
, ch
->qrx_pkt
->hdr
->len
);
2063 ch_update_ping_deadline(ch
);
2066 ch_rx_handle_packet(ch
, channel_only
); /* best effort */
2069 * Regardless of the outcome of frame handling, unref the packet.
2070 * This will free the packet unless something added another
2071 * reference to it during frame processing.
2073 ossl_qrx_pkt_release(ch
->qrx_pkt
);
2076 ch
->have_sent_ack_eliciting_since_rx
= 0;
2080 ch_rx_check_forged_pkt_limit(ch
);
2083 * When in TERMINATING - CLOSING, generate a CONN_CLOSE frame whenever we
2084 * process one or more incoming packets.
2086 if (handled_any
&& closing
)
2087 ch
->conn_close_queued
= 1;
2092 static int bio_addr_eq(const BIO_ADDR
*a
, const BIO_ADDR
*b
)
2094 if (BIO_ADDR_family(a
) != BIO_ADDR_family(b
))
2097 switch (BIO_ADDR_family(a
)) {
2099 return !memcmp(&a
->s_in
.sin_addr
,
2101 sizeof(a
->s_in
.sin_addr
))
2102 && a
->s_in
.sin_port
== b
->s_in
.sin_port
;
2103 #if OPENSSL_USE_IPV6
2105 return !memcmp(&a
->s_in6
.sin6_addr
,
2106 &b
->s_in6
.sin6_addr
,
2107 sizeof(a
->s_in6
.sin6_addr
))
2108 && a
->s_in6
.sin6_port
== b
->s_in6
.sin6_port
;
2111 return 0; /* not supported */
2117 /* Handles the packet currently in ch->qrx_pkt->hdr. */
2118 static void ch_rx_handle_packet(QUIC_CHANNEL
*ch
, int channel_only
)
2121 int old_have_processed_any_pkt
= ch
->have_processed_any_pkt
;
2122 OSSL_QTX_IOVEC iovec
;
2124 assert(ch
->qrx_pkt
!= NULL
);
2127 * RFC 9000 s. 10.2.1 Closing Connection State:
2128 * An endpoint that is closing is not required to process any
2131 if (!ossl_quic_channel_is_active(ch
))
2134 if (ossl_quic_pkt_type_is_encrypted(ch
->qrx_pkt
->hdr
->type
)) {
2135 if (!ch
->have_received_enc_pkt
) {
2136 ch
->cur_remote_dcid
= ch
->init_scid
= ch
->qrx_pkt
->hdr
->src_conn_id
;
2137 ch
->have_received_enc_pkt
= 1;
2140 * We change to using the SCID in the first Initial packet as the
2143 ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->init_scid
);
2146 enc_level
= ossl_quic_pkt_type_to_enc_level(ch
->qrx_pkt
->hdr
->type
);
2147 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
2148 /* Do not process packets from ELs we have already discarded. */
2153 * RFC 9000 s. 9.6: "If a client receives packets from a new server address
2154 * when the client has not initiated a migration to that address, the client
2155 * SHOULD discard these packets."
2157 * We need to be a bit careful here as due to the BIO abstraction layer an
2158 * application is liable to be weird and lie to us about peer addresses.
2159 * Only apply this check if we actually are using a real AF_INET or AF_INET6
2163 && ch
->qrx_pkt
->peer
!= NULL
2165 BIO_ADDR_family(&ch
->cur_peer_addr
) == AF_INET
2166 #if OPENSSL_USE_IPV6
2167 || BIO_ADDR_family(&ch
->cur_peer_addr
) == AF_INET6
2170 && !bio_addr_eq(ch
->qrx_pkt
->peer
, &ch
->cur_peer_addr
))
2174 && ch
->have_received_enc_pkt
2175 && ossl_quic_pkt_type_has_scid(ch
->qrx_pkt
->hdr
->type
)) {
2177 * RFC 9000 s. 7.2: "Once a client has received a valid Initial packet
2178 * from the server, it MUST discard any subsequent packet it receives on
2179 * that connection with a different SCID."
2181 if (!ossl_quic_conn_id_eq(&ch
->qrx_pkt
->hdr
->src_conn_id
,
2186 if (ossl_quic_pkt_type_has_version(ch
->qrx_pkt
->hdr
->type
)
2187 && ch
->qrx_pkt
->hdr
->version
!= QUIC_VERSION_1
)
2189 * RFC 9000 s. 5.2.1: If a client receives a packet that uses a
2190 * different version than it initially selected, it MUST discard the
2191 * packet. We only ever use v1, so require it.
2195 ch
->have_processed_any_pkt
= 1;
2198 * RFC 9000 s. 17.2: "An endpoint MUST treat receipt of a packet that has a
2199 * non-zero value for [the reserved bits] after removing both packet and
2200 * header protection as a connection error of type PROTOCOL_VIOLATION."
2202 if (ossl_quic_pkt_type_is_encrypted(ch
->qrx_pkt
->hdr
->type
)
2203 && ch
->qrx_pkt
->hdr
->reserved
!= 0) {
2204 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_PROTOCOL_VIOLATION
,
2205 0, "packet header reserved bits");
2209 iovec
.buf
= ch
->qrx_pkt
->hdr
->data
;
2210 iovec
.buf_len
= ch
->qrx_pkt
->hdr
->len
;
2211 ossl_qlog_event_transport_packet_received(ch_get_qlog(ch
), ch
->qrx_pkt
->hdr
,
2212 ch
->qrx_pkt
->pn
, &iovec
, 1,
2213 ch
->qrx_pkt
->datagram_id
);
2215 /* Handle incoming packet. */
2216 switch (ch
->qrx_pkt
->hdr
->type
) {
2217 case QUIC_PKT_TYPE_RETRY
:
2218 if (ch
->doing_retry
|| ch
->is_server
)
2220 * It is not allowed to ask a client to do a retry more than
2221 * once. Clients may not send retries.
2226 * RFC 9000 s 17.2.5.2: After the client has received and processed an
2227 * Initial or Retry packet from the server, it MUST discard any
2228 * subsequent Retry packets that it receives.
2230 if (ch
->have_received_enc_pkt
)
2233 if (ch
->qrx_pkt
->hdr
->len
<= QUIC_RETRY_INTEGRITY_TAG_LEN
)
2234 /* Packets with zero-length Retry Tokens are invalid. */
2238 * TODO(QUIC FUTURE): Theoretically this should probably be in the QRX.
2239 * However because validation is dependent on context (namely the
2240 * client's initial DCID) we can't do this cleanly. In the future we
2241 * should probably add a callback to the QRX to let it call us (via
2242 * the DEMUX) and ask us about the correct original DCID, rather
2243 * than allow the QRX to emit a potentially malformed packet to the
2244 * upper layers. However, special casing this will do for now.
2246 if (!ossl_quic_validate_retry_integrity_tag(ch
->port
->engine
->libctx
,
2247 ch
->port
->engine
->propq
,
2250 /* Malformed retry packet, ignore. */
2253 if (!ch_retry(ch
, ch
->qrx_pkt
->hdr
->data
,
2254 ch
->qrx_pkt
->hdr
->len
- QUIC_RETRY_INTEGRITY_TAG_LEN
,
2255 &ch
->qrx_pkt
->hdr
->src_conn_id
))
2256 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_INTERNAL_ERROR
,
2257 0, "handling retry packet");
2260 case QUIC_PKT_TYPE_0RTT
:
2262 /* Clients should never receive 0-RTT packets. */
2266 * TODO(QUIC 0RTT): Implement 0-RTT on the server side. We currently
2267 * do not need to implement this as a client can only do 0-RTT if we
2268 * have given it permission to in a previous session.
2272 case QUIC_PKT_TYPE_INITIAL
:
2273 case QUIC_PKT_TYPE_HANDSHAKE
:
2274 case QUIC_PKT_TYPE_1RTT
:
2275 if (ch
->is_server
&& ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_HANDSHAKE
)
2277 * We automatically drop INITIAL EL keys when first successfully
2278 * decrypting a HANDSHAKE packet, as per the RFC.
2280 ch_discard_el(ch
, QUIC_ENC_LEVEL_INITIAL
);
2282 if (ch
->rxku_in_progress
2283 && ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_1RTT
2284 && ch
->qrx_pkt
->pn
>= ch
->rxku_trigger_pn
2285 && ch
->qrx_pkt
->key_epoch
< ossl_qrx_get_key_epoch(ch
->qrx
)) {
2287 * RFC 9001 s. 6.4: Packets with higher packet numbers MUST be
2288 * protected with either the same or newer packet protection keys
2289 * than packets with lower packet numbers. An endpoint that
2290 * successfully removes protection with old keys when newer keys
2291 * were used for packets with lower packet numbers MUST treat this
2292 * as a connection error of type KEY_UPDATE_ERROR.
2294 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_KEY_UPDATE_ERROR
,
2295 0, "new packet with old keys");
2300 && ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_INITIAL
2301 && ch
->qrx_pkt
->hdr
->token_len
> 0) {
2303 * RFC 9000 s. 17.2.2: Clients that receive an Initial packet with a
2304 * non-zero Token Length field MUST either discard the packet or
2305 * generate a connection error of type PROTOCOL_VIOLATION.
2307 * TODO(QUIC FUTURE): consider the implications of RFC 9000 s. 10.2.3
2308 * Immediate Close during the Handshake:
2309 * However, at the cost of reducing feedback about
2310 * errors for legitimate peers, some forms of denial of
2311 * service can be made more difficult for an attacker
2312 * if endpoints discard illegal packets rather than
2313 * terminating a connection with CONNECTION_CLOSE. For
2314 * this reason, endpoints MAY discard packets rather
2315 * than immediately close if errors are detected in
2316 * packets that lack authentication.
2317 * I.e. should we drop this packet instead of closing the connection?
2319 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_PROTOCOL_VIOLATION
,
2320 0, "client received initial token");
2324 /* This packet contains frames, pass to the RXDP. */
2325 ossl_quic_handle_frames(ch
, ch
->qrx_pkt
); /* best effort */
2327 if (ch
->did_crypto_frame
)
2328 ch_tick_tls(ch
, channel_only
);
2332 case QUIC_PKT_TYPE_VERSION_NEG
:
2334 * "A client MUST discard any Version Negotiation packet if it has
2335 * received and successfully processed any other packet."
2337 if (!old_have_processed_any_pkt
)
2338 ch_rx_handle_version_neg(ch
, ch
->qrx_pkt
);
2348 static void ch_rx_handle_version_neg(QUIC_CHANNEL
*ch
, OSSL_QRX_PKT
*pkt
)
2351 * We do not support version negotiation at this time. As per RFC 9000 s.
2352 * 6.2., we MUST abandon the connection attempt if we receive a Version
2353 * Negotiation packet, unless we have already successfully processed another
2354 * incoming packet, or the packet lists the QUIC version we want to use.
2359 if (!PACKET_buf_init(&vpkt
, pkt
->hdr
->data
, pkt
->hdr
->len
))
2362 while (PACKET_remaining(&vpkt
) > 0) {
2363 if (!PACKET_get_net_4(&vpkt
, &v
))
2366 if ((uint32_t)v
== QUIC_VERSION_1
)
2370 /* No match, this is a failure case. */
2371 ch_raise_version_neg_failure(ch
);
2374 static void ch_raise_version_neg_failure(QUIC_CHANNEL
*ch
)
2376 QUIC_TERMINATE_CAUSE tcause
= {0};
2378 tcause
.error_code
= OSSL_QUIC_ERR_CONNECTION_REFUSED
;
2379 tcause
.reason
= "version negotiation failure";
2380 tcause
.reason_len
= strlen(tcause
.reason
);
2383 * Skip TERMINATING state; this is not considered a protocol error and we do
2384 * not send CONNECTION_CLOSE.
2386 ch_start_terminating(ch
, &tcause
, 1);
2389 /* Try to generate packets and if possible, flush them to the network. */
2390 static int ch_tx(QUIC_CHANNEL
*ch
)
2392 QUIC_TXP_STATUS status
;
2396 * RFC 9000 s. 10.2.2: Draining Connection State:
2397 * While otherwise identical to the closing state, an endpoint
2398 * in the draining state MUST NOT send any packets.
2400 * An endpoint MUST NOT send further packets.
2402 if (ossl_quic_channel_is_draining(ch
))
2405 if (ossl_quic_channel_is_closing(ch
)) {
2407 * While closing, only send CONN_CLOSE if we've received more traffic
2408 * from the peer. Once we tell the TXP to generate CONN_CLOSE, all
2409 * future calls to it generate CONN_CLOSE frames, so otherwise we would
2410 * just constantly generate CONN_CLOSE frames.
2412 * Confirming to RFC 9000 s. 10.2.1 Closing Connection State:
2413 * An endpoint SHOULD limit the rate at which it generates
2414 * packets in the closing state.
2416 if (!ch
->conn_close_queued
)
2419 ch
->conn_close_queued
= 0;
2422 /* Do TXKU if we need to. */
2423 ch_maybe_trigger_spontaneous_txku(ch
);
2425 ch
->rxku_pending_confirm_done
= 0;
2427 /* Loop until we stop generating packets to send */
2430 * Send packet, if we need to. Best effort. The TXP consults the CC and
2431 * applies any limitations imposed by it, so we don't need to do it here.
2433 * Best effort. In particular if TXP fails for some reason we should
2434 * still flush any queued packets which we already generated.
2436 res
= ossl_quic_tx_packetiser_generate(ch
->txp
, &status
);
2437 if (status
.sent_pkt
> 0) {
2438 ch
->have_sent_any_pkt
= 1; /* Packet(s) were sent */
2439 ch
->port
->have_sent_any_pkt
= 1;
2442 * RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when
2443 * sending an ack-eliciting packet if no other ack-eliciting packets
2444 * have been sent since last receiving and processing a packet.'
2446 if (status
.sent_ack_eliciting
2447 && !ch
->have_sent_ack_eliciting_since_rx
) {
2449 ch
->have_sent_ack_eliciting_since_rx
= 1;
2452 if (!ch
->is_server
&& status
.sent_handshake
)
2454 * RFC 9001 s. 4.9.1: A client MUST discard Initial keys when it
2455 * first sends a Handshake packet.
2457 ch_discard_el(ch
, QUIC_ENC_LEVEL_INITIAL
);
2459 if (ch
->rxku_pending_confirm_done
)
2460 ch
->rxku_pending_confirm
= 0;
2462 ch_update_ping_deadline(ch
);
2467 * One case where TXP can fail is if we reach a TX PN of 2**62 - 1.
2468 * As per RFC 9000 s. 12.3, if this happens we MUST close the
2469 * connection without sending a CONNECTION_CLOSE frame. This is
2470 * actually handled as an emergent consequence of our design, as the
2471 * TX packetiser will never transmit another packet when the TX PN
2472 * reaches the limit.
2474 * Calling the below function terminates the connection; its attempt
2475 * to schedule a CONNECTION_CLOSE frame will not actually cause a
2476 * packet to be transmitted for this reason.
2478 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_INTERNAL_ERROR
,
2480 "internal error (txp generate)");
2483 } while (status
.sent_pkt
> 0);
2485 /* Flush packets to network. */
2486 switch (ossl_qtx_flush_net(ch
->qtx
)) {
2487 case QTX_FLUSH_NET_RES_OK
:
2488 case QTX_FLUSH_NET_RES_TRANSIENT_FAIL
:
2489 /* Best effort, done for now. */
2492 case QTX_FLUSH_NET_RES_PERMANENT_FAIL
:
2494 /* Permanent underlying network BIO, start terminating. */
2495 ossl_quic_port_raise_net_error(ch
->port
, ch
);
2502 /* Determine next tick deadline. */
2503 static OSSL_TIME
ch_determine_next_tick_deadline(QUIC_CHANNEL
*ch
)
2508 if (ossl_quic_channel_is_terminated(ch
))
2509 return ossl_time_infinite();
2511 deadline
= ossl_ackm_get_loss_detection_deadline(ch
->ackm
);
2512 if (ossl_time_is_zero(deadline
))
2513 deadline
= ossl_time_infinite();
2516 * Check the ack deadline for all enc_levels that are actually provisioned.
2517 * ACKs aren't restricted by CC.
2519 for (i
= 0; i
< QUIC_ENC_LEVEL_NUM
; i
++) {
2520 if (ossl_qtx_is_enc_level_provisioned(ch
->qtx
, i
)) {
2521 deadline
= ossl_time_min(deadline
,
2522 ossl_ackm_get_ack_deadline(ch
->ackm
,
2523 ossl_quic_enc_level_to_pn_space(i
)));
2528 * When do we need to send an ACK-eliciting packet to reset the idle
2529 * deadline timer for the peer?
2531 if (!ossl_time_is_infinite(ch
->ping_deadline
))
2532 deadline
= ossl_time_min(deadline
, ch
->ping_deadline
);
2534 /* Apply TXP wakeup deadline. */
2535 deadline
= ossl_time_min(deadline
,
2536 ossl_quic_tx_packetiser_get_deadline(ch
->txp
));
2538 /* Is the terminating timer armed? */
2539 if (ossl_quic_channel_is_terminating(ch
))
2540 deadline
= ossl_time_min(deadline
,
2541 ch
->terminate_deadline
);
2542 else if (!ossl_time_is_infinite(ch
->idle_deadline
))
2543 deadline
= ossl_time_min(deadline
,
2546 /* When does the RXKU process complete? */
2547 if (ch
->rxku_in_progress
)
2548 deadline
= ossl_time_min(deadline
, ch
->rxku_update_end_deadline
);
2554 * QUIC Channel: Lifecycle Events
2555 * ==============================
2559 * Record a state transition. This is not necessarily a change to ch->state but
2560 * also includes the handshake becoming complete or confirmed, etc.
2562 static void ch_record_state_transition(QUIC_CHANNEL
*ch
, uint32_t new_state
)
2564 uint32_t old_state
= ch
->state
;
2566 ch
->state
= new_state
;
2568 ossl_qlog_event_connectivity_connection_state_updated(ch_get_qlog(ch
),
2571 ch
->handshake_complete
,
2572 ch
->handshake_confirmed
);
2575 int ossl_quic_channel_start(QUIC_CHANNEL
*ch
)
2579 * This is not used by the server. The server moves to active
2580 * automatically on receiving an incoming connection.
2584 if (ch
->state
!= QUIC_CHANNEL_STATE_IDLE
)
2585 /* Calls to connect are idempotent */
2588 /* Inform QTX of peer address. */
2589 if (!ossl_quic_tx_packetiser_set_peer(ch
->txp
, &ch
->cur_peer_addr
))
2592 /* Plug in secrets for the Initial EL. */
2593 if (!ossl_quic_provide_initial_secret(ch
->port
->engine
->libctx
,
2594 ch
->port
->engine
->propq
,
2601 * Determine the QUIC Transport Parameters and serialize the transport
2602 * parameters block. (For servers, we do this later as we must defer
2603 * generation until we have received the client's transport parameters.)
2605 if (!ch
->is_server
&& !ch
->got_local_transport_params
2606 && !ch_generate_transport_params(ch
))
2610 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_ACTIVE
);
2611 ch
->doing_proactive_ver_neg
= 0; /* not currently supported */
2613 ossl_qlog_event_connectivity_connection_started(ch_get_qlog(ch
),
2616 /* Handshake layer: start (e.g. send CH). */
2617 if (!ch_tick_tls(ch
, /*channel_only=*/0))
2620 ossl_quic_reactor_tick(ossl_quic_port_get0_reactor(ch
->port
), 0); /* best effort */
2624 /* Start a locally initiated connection shutdown. */
2625 void ossl_quic_channel_local_close(QUIC_CHANNEL
*ch
, uint64_t app_error_code
,
2626 const char *app_reason
)
2628 QUIC_TERMINATE_CAUSE tcause
= {0};
2630 if (ossl_quic_channel_is_term_any(ch
))
2634 tcause
.error_code
= app_error_code
;
2635 tcause
.reason
= app_reason
;
2636 tcause
.reason_len
= app_reason
!= NULL
? strlen(app_reason
) : 0;
2637 ch_start_terminating(ch
, &tcause
, 0);
2640 static void free_token(const unsigned char *buf
, size_t buf_len
, void *arg
)
2642 OPENSSL_free((unsigned char *)buf
);
2645 /* Called when a server asks us to do a retry. */
2646 static int ch_retry(QUIC_CHANNEL
*ch
,
2647 const unsigned char *retry_token
,
2648 size_t retry_token_len
,
2649 const QUIC_CONN_ID
*retry_scid
)
2654 * RFC 9000 s. 17.2.5.1: "A client MUST discard a Retry packet that contains
2655 * a SCID field that is identical to the DCID field of its initial packet."
2657 if (ossl_quic_conn_id_eq(&ch
->init_dcid
, retry_scid
))
2660 /* We change to using the SCID in the Retry packet as the DCID. */
2661 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, retry_scid
))
2665 * Now we retry. We will release the Retry packet immediately, so copy
2668 if ((buf
= OPENSSL_memdup(retry_token
, retry_token_len
)) == NULL
)
2671 if (!ossl_quic_tx_packetiser_set_initial_token(ch
->txp
, buf
,
2673 free_token
, NULL
)) {
2675 * This may fail if the token we receive is too big for us to ever be
2676 * able to transmit in an outgoing Initial packet.
2678 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_INVALID_TOKEN
, 0,
2679 "received oversize token");
2684 ch
->retry_scid
= *retry_scid
;
2685 ch
->doing_retry
= 1;
2688 * We need to stimulate the Initial EL to generate the first CRYPTO frame
2689 * again. We can do this most cleanly by simply forcing the ACKM to consider
2690 * the first Initial packet as lost, which it effectively was as the server
2691 * hasn't processed it. This also maintains the desired behaviour with e.g.
2692 * PNs not resetting and so on.
2694 * The PN we used initially is always zero, because QUIC does not allow
2697 if (!ossl_ackm_mark_packet_pseudo_lost(ch
->ackm
, QUIC_PN_SPACE_INITIAL
,
2702 * Plug in new secrets for the Initial EL. This is the only time we change
2703 * the secrets for an EL after we already provisioned it.
2705 if (!ossl_quic_provide_initial_secret(ch
->port
->engine
->libctx
,
2706 ch
->port
->engine
->propq
,
2715 /* Called when an EL is to be discarded. */
2716 static int ch_discard_el(QUIC_CHANNEL
*ch
,
2719 if (!ossl_assert(enc_level
< QUIC_ENC_LEVEL_1RTT
))
2722 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
2726 /* Best effort for all of these. */
2727 ossl_quic_tx_packetiser_discard_enc_level(ch
->txp
, enc_level
);
2728 ossl_qrx_discard_enc_level(ch
->qrx
, enc_level
);
2729 ossl_qtx_discard_enc_level(ch
->qtx
, enc_level
);
2731 if (enc_level
!= QUIC_ENC_LEVEL_0RTT
) {
2732 uint32_t pn_space
= ossl_quic_enc_level_to_pn_space(enc_level
);
2734 ossl_ackm_on_pkt_space_discarded(ch
->ackm
, pn_space
);
2736 /* We should still have crypto streams at this point. */
2737 if (!ossl_assert(ch
->crypto_send
[pn_space
] != NULL
)
2738 || !ossl_assert(ch
->crypto_recv
[pn_space
] != NULL
))
2741 /* Get rid of the crypto stream state for the EL. */
2742 ossl_quic_sstream_free(ch
->crypto_send
[pn_space
]);
2743 ch
->crypto_send
[pn_space
] = NULL
;
2745 ossl_quic_rstream_free(ch
->crypto_recv
[pn_space
]);
2746 ch
->crypto_recv
[pn_space
] = NULL
;
2749 ch
->el_discarded
|= (1U << enc_level
);
2753 /* Intended to be called by the RXDP. */
2754 int ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL
*ch
)
2756 if (ch
->handshake_confirmed
)
2759 if (!ch
->handshake_complete
) {
2761 * Does not make sense for handshake to be confirmed before it is
2764 ossl_quic_channel_raise_protocol_error(ch
, OSSL_QUIC_ERR_PROTOCOL_VIOLATION
,
2765 OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE
,
2766 "handshake cannot be confirmed "
2767 "before it is completed");
2771 ch_discard_el(ch
, QUIC_ENC_LEVEL_HANDSHAKE
);
2772 ch
->handshake_confirmed
= 1;
2773 ch_record_state_transition(ch
, ch
->state
);
2774 ossl_ackm_on_handshake_confirmed(ch
->ackm
);
2779 * Master function used when we want to start tearing down a connection:
2781 * - If the connection is still IDLE we can go straight to TERMINATED;
2783 * - If we are already TERMINATED this is a no-op.
2785 * - If we are TERMINATING - CLOSING and we have now got a CONNECTION_CLOSE
2786 * from the peer (tcause->remote == 1), we move to TERMINATING - DRAINING.
2788 * - If we are TERMINATING - DRAINING, we remain here until the terminating
2791 * - Otherwise, we are in ACTIVE and move to TERMINATING - CLOSING.
2792 * if we caused the termination (e.g. we have sent a CONNECTION_CLOSE). Note
2793 * that we are considered to have caused a termination if we sent the first
2794 * CONNECTION_CLOSE frame, even if it is caused by a peer protocol
2795 * violation. If the peer sent the first CONNECTION_CLOSE frame, we move to
2796 * TERMINATING - DRAINING.
2798 * We record the termination cause structure passed on the first call only.
2799 * Any successive calls have their termination cause data discarded;
2800 * once we start sending a CONNECTION_CLOSE frame, we don't change the details
2803 * This conforms to RFC 9000 s. 10.2.1: Closing Connection State:
2804 * To minimize the state that an endpoint maintains for a closing
2805 * connection, endpoints MAY send the exact same packet in response
2806 * to any received packet.
2808 * We don't drop any connection state (specifically packet protection keys)
2809 * even though we are permitted to. This conforms to RFC 9000 s. 10.2.1:
2810 * Closing Connection State:
2811 * An endpoint MAY retain packet protection keys for incoming
2812 * packets to allow it to read and process a CONNECTION_CLOSE frame.
2814 * Note that we do not conform to these two from the same section:
2815 * An endpoint's selected connection ID and the QUIC version
2816 * are sufficient information to identify packets for a closing
2817 * connection; the endpoint MAY discard all other connection state.
2819 * An endpoint MAY drop packet protection keys when entering the
2820 * closing state and send a packet containing a CONNECTION_CLOSE
2821 * frame in response to any UDP datagram that is received.
2823 static void copy_tcause(QUIC_TERMINATE_CAUSE
*dst
,
2824 const QUIC_TERMINATE_CAUSE
*src
)
2826 dst
->error_code
= src
->error_code
;
2827 dst
->frame_type
= src
->frame_type
;
2828 dst
->app
= src
->app
;
2829 dst
->remote
= src
->remote
;
2832 dst
->reason_len
= 0;
2834 if (src
->reason
!= NULL
&& src
->reason_len
> 0) {
2835 size_t l
= src
->reason_len
;
2842 * If this fails, dst->reason becomes NULL and we simply do not use a
2843 * reason. This ensures termination is infallible.
2845 dst
->reason
= r
= OPENSSL_memdup(src
->reason
, l
+ 1);
2850 dst
->reason_len
= l
;
2854 static void ch_start_terminating(QUIC_CHANNEL
*ch
,
2855 const QUIC_TERMINATE_CAUSE
*tcause
,
2856 int force_immediate
)
2858 /* No point sending anything if we haven't sent anything yet. */
2859 if (!ch
->have_sent_any_pkt
)
2860 force_immediate
= 1;
2862 switch (ch
->state
) {
2864 case QUIC_CHANNEL_STATE_IDLE
:
2865 copy_tcause(&ch
->terminate_cause
, tcause
);
2866 ch_on_terminating_timeout(ch
);
2869 case QUIC_CHANNEL_STATE_ACTIVE
:
2870 copy_tcause(&ch
->terminate_cause
, tcause
);
2872 ossl_qlog_event_connectivity_connection_closed(ch_get_qlog(ch
), tcause
);
2874 if (!force_immediate
) {
2875 ch_record_state_transition(ch
, tcause
->remote
2876 ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
2877 : QUIC_CHANNEL_STATE_TERMINATING_CLOSING
);
2879 * RFC 9000 s. 10.2 Immediate Close
2880 * These states SHOULD persist for at least three times
2881 * the current PTO interval as defined in [QUIC-RECOVERY].
2883 ch
->terminate_deadline
2884 = ossl_time_add(get_time(ch
),
2885 ossl_time_multiply(ossl_ackm_get_pto_duration(ch
->ackm
),
2888 if (!tcause
->remote
) {
2889 OSSL_QUIC_FRAME_CONN_CLOSE f
= {0};
2892 f
.error_code
= ch
->terminate_cause
.error_code
;
2893 f
.frame_type
= ch
->terminate_cause
.frame_type
;
2894 f
.is_app
= ch
->terminate_cause
.app
;
2895 f
.reason
= (char *)ch
->terminate_cause
.reason
;
2896 f
.reason_len
= ch
->terminate_cause
.reason_len
;
2897 ossl_quic_tx_packetiser_schedule_conn_close(ch
->txp
, &f
);
2899 * RFC 9000 s. 10.2.2 Draining Connection State:
2900 * An endpoint that receives a CONNECTION_CLOSE frame MAY
2901 * send a single packet containing a CONNECTION_CLOSE
2902 * frame before entering the draining state, using a
2903 * NO_ERROR code if appropriate
2905 ch
->conn_close_queued
= 1;
2908 ch_on_terminating_timeout(ch
);
2912 case QUIC_CHANNEL_STATE_TERMINATING_CLOSING
:
2913 if (force_immediate
)
2914 ch_on_terminating_timeout(ch
);
2915 else if (tcause
->remote
)
2917 * RFC 9000 s. 10.2.2 Draining Connection State:
2918 * An endpoint MAY enter the draining state from the
2919 * closing state if it receives a CONNECTION_CLOSE frame,
2920 * which indicates that the peer is also closing or draining.
2922 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_TERMINATING_DRAINING
);
2926 case QUIC_CHANNEL_STATE_TERMINATING_DRAINING
:
2928 * Other than in the force-immediate case, we remain here until the
2931 if (force_immediate
)
2932 ch_on_terminating_timeout(ch
);
2936 case QUIC_CHANNEL_STATE_TERMINATED
:
2943 void ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL
*ch
,
2944 OSSL_QUIC_FRAME_CONN_CLOSE
*f
)
2946 QUIC_TERMINATE_CAUSE tcause
= {0};
2948 if (!ossl_quic_channel_is_active(ch
))
2952 tcause
.app
= f
->is_app
;
2953 tcause
.error_code
= f
->error_code
;
2954 tcause
.frame_type
= f
->frame_type
;
2955 tcause
.reason
= f
->reason
;
2956 tcause
.reason_len
= f
->reason_len
;
2957 ch_start_terminating(ch
, &tcause
, 0);
2960 static void free_frame_data(unsigned char *buf
, size_t buf_len
, void *arg
)
2965 static int ch_enqueue_retire_conn_id(QUIC_CHANNEL
*ch
, uint64_t seq_num
)
2967 BUF_MEM
*buf_mem
= NULL
;
2971 ossl_quic_srtm_remove(ch
->srtm
, ch
, seq_num
);
2973 if ((buf_mem
= BUF_MEM_new()) == NULL
)
2976 if (!WPACKET_init(&wpkt
, buf_mem
))
2979 if (!ossl_quic_wire_encode_frame_retire_conn_id(&wpkt
, seq_num
)) {
2980 WPACKET_cleanup(&wpkt
);
2984 WPACKET_finish(&wpkt
);
2985 if (!WPACKET_get_total_written(&wpkt
, &l
))
2988 if (ossl_quic_cfq_add_frame(ch
->cfq
, 1, QUIC_PN_SPACE_APP
,
2989 OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID
, 0,
2990 (unsigned char *)buf_mem
->data
, l
,
2991 free_frame_data
, NULL
) == NULL
)
2994 buf_mem
->data
= NULL
;
2995 BUF_MEM_free(buf_mem
);
2999 ossl_quic_channel_raise_protocol_error(ch
,
3000 OSSL_QUIC_ERR_INTERNAL_ERROR
,
3001 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3002 "internal error enqueueing retire conn id");
3003 BUF_MEM_free(buf_mem
);
3007 void ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL
*ch
,
3008 OSSL_QUIC_FRAME_NEW_CONN_ID
*f
)
3010 uint64_t new_remote_seq_num
= ch
->cur_remote_seq_num
;
3011 uint64_t new_retire_prior_to
= ch
->cur_retire_prior_to
;
3013 if (!ossl_quic_channel_is_active(ch
))
3016 /* We allow only two active connection ids; first check some constraints */
3017 if (ch
->cur_remote_dcid
.id_len
== 0) {
3018 /* Changing from 0 length connection id is disallowed */
3019 ossl_quic_channel_raise_protocol_error(ch
,
3020 OSSL_QUIC_ERR_PROTOCOL_VIOLATION
,
3021 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3022 "zero length connection id in use");
3027 if (f
->seq_num
> new_remote_seq_num
)
3028 new_remote_seq_num
= f
->seq_num
;
3029 if (f
->retire_prior_to
> new_retire_prior_to
)
3030 new_retire_prior_to
= f
->retire_prior_to
;
3033 * RFC 9000-5.1.1: An endpoint MUST NOT provide more connection IDs
3034 * than the peer's limit.
3036 * After processing a NEW_CONNECTION_ID frame and adding and retiring
3037 * active connection IDs, if the number of active connection IDs exceeds
3038 * the value advertised in its active_connection_id_limit transport
3039 * parameter, an endpoint MUST close the connection with an error of
3040 * type CONNECTION_ID_LIMIT_ERROR.
3042 if (new_remote_seq_num
- new_retire_prior_to
> 1) {
3043 ossl_quic_channel_raise_protocol_error(ch
,
3044 OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR
,
3045 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3046 "active_connection_id limit violated");
3051 * RFC 9000-5.1.1: An endpoint MAY send connection IDs that temporarily
3052 * exceed a peer's limit if the NEW_CONNECTION_ID frame also requires
3053 * the retirement of any excess, by including a sufficiently large
3054 * value in the Retire Prior To field.
3056 * RFC 9000-5.1.2: An endpoint SHOULD allow for sending and tracking
3057 * a number of RETIRE_CONNECTION_ID frames of at least twice the value
3058 * of the active_connection_id_limit transport parameter. An endpoint
3059 * MUST NOT forget a connection ID without retiring it, though it MAY
3060 * choose to treat having connection IDs in need of retirement that
3061 * exceed this limit as a connection error of type CONNECTION_ID_LIMIT_ERROR.
3063 * We are a little bit more liberal than the minimum mandated.
3065 if (new_retire_prior_to
- ch
->cur_retire_prior_to
> 10) {
3066 ossl_quic_channel_raise_protocol_error(ch
,
3067 OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR
,
3068 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3069 "retiring connection id limit violated");
3074 if (new_remote_seq_num
> ch
->cur_remote_seq_num
) {
3075 /* Add new stateless reset token */
3076 if (!ossl_quic_srtm_add(ch
->srtm
, ch
, new_remote_seq_num
,
3077 &f
->stateless_reset
)) {
3078 ossl_quic_channel_raise_protocol_error(
3079 ch
, OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR
,
3080 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3081 "unable to store stateless reset token");
3085 ch
->cur_remote_seq_num
= new_remote_seq_num
;
3086 ch
->cur_remote_dcid
= f
->conn_id
;
3087 ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->cur_remote_dcid
);
3091 * RFC 9000-5.1.2: Upon receipt of an increased Retire Prior To
3092 * field, the peer MUST stop using the corresponding connection IDs
3093 * and retire them with RETIRE_CONNECTION_ID frames before adding the
3094 * newly provided connection ID to the set of active connection IDs.
3098 * Note: RFC 9000 s. 19.15 says:
3099 * "An endpoint that receives a NEW_CONNECTION_ID frame with a sequence
3100 * number smaller than the Retire Prior To field of a previously received
3101 * NEW_CONNECTION_ID frame MUST send a corresponding
3102 * RETIRE_CONNECTION_ID frame that retires the newly received connection
3103 * ID, unless it has already done so for that sequence number."
3105 * Since we currently always queue RETIRE_CONN_ID frames based on the Retire
3106 * Prior To field of a NEW_CONNECTION_ID frame immediately upon receiving
3107 * that NEW_CONNECTION_ID frame, by definition this will always be met.
3108 * This may change in future when we change our CID handling.
3110 while (new_retire_prior_to
> ch
->cur_retire_prior_to
) {
3111 if (!ch_enqueue_retire_conn_id(ch
, ch
->cur_retire_prior_to
))
3113 ++ch
->cur_retire_prior_to
;
3117 static void ch_save_err_state(QUIC_CHANNEL
*ch
)
3119 if (ch
->err_state
== NULL
)
3120 ch
->err_state
= OSSL_ERR_STATE_new();
3122 if (ch
->err_state
== NULL
)
3125 OSSL_ERR_STATE_save(ch
->err_state
);
3128 void ossl_quic_channel_inject(QUIC_CHANNEL
*ch
, QUIC_URXE
*e
)
3130 ossl_qrx_inject_urxe(ch
->qrx
, e
);
3133 void ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL
*ch
)
3135 QUIC_TERMINATE_CAUSE tcause
= {0};
3137 tcause
.error_code
= OSSL_QUIC_ERR_NO_ERROR
;
3139 ch_start_terminating(ch
, &tcause
, 0);
3142 void ossl_quic_channel_raise_net_error(QUIC_CHANNEL
*ch
)
3144 QUIC_TERMINATE_CAUSE tcause
= {0};
3151 tcause
.error_code
= OSSL_QUIC_ERR_INTERNAL_ERROR
;
3152 tcause
.reason
= "network BIO I/O error";
3153 tcause
.reason_len
= strlen(tcause
.reason
);
3156 * Skip Terminating state and go directly to Terminated, no point trying to
3157 * send CONNECTION_CLOSE if we cannot communicate.
3159 ch_start_terminating(ch
, &tcause
, 1);
3162 int ossl_quic_channel_net_error(QUIC_CHANNEL
*ch
)
3164 return ch
->net_error
;
3167 void ossl_quic_channel_restore_err_state(QUIC_CHANNEL
*ch
)
3172 if (!ossl_quic_port_is_running(ch
->port
))
3173 ossl_quic_port_restore_err_state(ch
->port
);
3175 OSSL_ERR_STATE_restore(ch
->err_state
);
3178 void ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL
*ch
,
3179 uint64_t error_code
,
3180 uint64_t frame_type
,
3182 ERR_STATE
*err_state
,
3183 const char *src_file
,
3185 const char *src_func
)
3187 QUIC_TERMINATE_CAUSE tcause
= {0};
3188 int err_reason
= error_code
== OSSL_QUIC_ERR_INTERNAL_ERROR
3189 ? ERR_R_INTERNAL_ERROR
: SSL_R_QUIC_PROTOCOL_ERROR
;
3190 const char *err_str
= ossl_quic_err_to_string(error_code
);
3191 const char *err_str_pfx
= " (", *err_str_sfx
= ")";
3192 const char *ft_str
= NULL
;
3193 const char *ft_str_pfx
= " (", *ft_str_sfx
= ")";
3195 if (ch
->protocol_error
)
3196 /* Only the first call to this function matters. */
3199 if (err_str
== NULL
) {
3206 * If we were provided an underlying error state, restore it and then append
3207 * our ERR on top as a "cover letter" error.
3209 if (err_state
!= NULL
)
3210 OSSL_ERR_STATE_restore(err_state
);
3212 if (frame_type
!= 0) {
3213 ft_str
= ossl_quic_frame_type_to_string(frame_type
);
3214 if (ft_str
== NULL
) {
3220 ERR_raise_data(ERR_LIB_SSL
, err_reason
,
3221 "QUIC error code: 0x%llx%s%s%s "
3222 "(triggered by frame type: 0x%llx%s%s%s), reason: \"%s\"",
3223 (unsigned long long) error_code
,
3224 err_str_pfx
, err_str
, err_str_sfx
,
3225 (unsigned long long) frame_type
,
3226 ft_str_pfx
, ft_str
, ft_str_sfx
,
3229 ERR_raise_data(ERR_LIB_SSL
, err_reason
,
3230 "QUIC error code: 0x%llx%s%s%s, reason: \"%s\"",
3231 (unsigned long long) error_code
,
3232 err_str_pfx
, err_str
, err_str_sfx
,
3236 if (src_file
!= NULL
)
3237 ERR_set_debug(src_file
, src_line
, src_func
);
3239 ch_save_err_state(ch
);
3241 tcause
.error_code
= error_code
;
3242 tcause
.frame_type
= frame_type
;
3243 tcause
.reason
= reason
;
3244 tcause
.reason_len
= strlen(reason
);
3246 ch
->protocol_error
= 1;
3247 ch_start_terminating(ch
, &tcause
, 0);
3251 * Called once the terminating timer expires, meaning we move from TERMINATING
3254 static void ch_on_terminating_timeout(QUIC_CHANNEL
*ch
)
3256 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_TERMINATED
);
3260 * Determines the effective idle timeout duration. This is based on the idle
3261 * timeout values that we and our peer signalled in transport parameters
3262 * but have some limits applied.
3264 static OSSL_TIME
ch_get_effective_idle_timeout_duration(QUIC_CHANNEL
*ch
)
3268 if (ch
->max_idle_timeout
== 0)
3269 return ossl_time_infinite();
3272 * RFC 9000 s. 10.1: Idle Timeout
3273 * To avoid excessively small idle timeout periods, endpoints
3274 * MUST increase the idle timeout period to be at least three
3275 * times the current Probe Timeout (PTO). This allows for
3276 * multiple PTOs to expire, and therefore multiple probes to
3277 * be sent and lost, prior to idle timeout.
3279 pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
3280 return ossl_time_max(ossl_ms2time(ch
->max_idle_timeout
),
3281 ossl_time_multiply(pto
, 3));
3285 * Updates our idle deadline. Called when an event happens which should bump the
3288 static void ch_update_idle(QUIC_CHANNEL
*ch
)
3290 ch
->idle_deadline
= ossl_time_add(get_time(ch
),
3291 ch_get_effective_idle_timeout_duration(ch
));
3295 * Updates our ping deadline, which determines when we next generate a ping if
3296 * we don't have any other ACK-eliciting frames to send.
3298 static void ch_update_ping_deadline(QUIC_CHANNEL
*ch
)
3300 OSSL_TIME max_span
, idle_duration
;
3302 idle_duration
= ch_get_effective_idle_timeout_duration(ch
);
3303 if (ossl_time_is_infinite(idle_duration
)) {
3304 ch
->ping_deadline
= ossl_time_infinite();
3309 * Maximum amount of time without traffic before we send a PING to keep
3310 * the connection open. Usually we use max_idle_timeout/2, but ensure
3311 * the period never exceeds the assumed NAT interval to ensure NAT
3312 * devices don't have their state time out (RFC 9000 s. 10.1.2).
3314 max_span
= ossl_time_divide(idle_duration
, 2);
3315 max_span
= ossl_time_min(max_span
, MAX_NAT_INTERVAL
);
3316 ch
->ping_deadline
= ossl_time_add(get_time(ch
), max_span
);
3319 /* Called when the idle timeout expires. */
3320 static void ch_on_idle_timeout(QUIC_CHANNEL
*ch
)
3323 * Idle timeout does not have an error code associated with it because a
3324 * CONN_CLOSE is never sent for it. We shouldn't use this data once we reach
3325 * TERMINATED anyway.
3327 ch
->terminate_cause
.app
= 0;
3328 ch
->terminate_cause
.error_code
= OSSL_QUIC_LOCAL_ERR_IDLE_TIMEOUT
;
3329 ch
->terminate_cause
.frame_type
= 0;
3331 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_TERMINATED
);
3334 /* Called when we, as a server, get a new incoming connection. */
3335 int ossl_quic_channel_on_new_conn(QUIC_CHANNEL
*ch
, const BIO_ADDR
*peer
,
3336 const QUIC_CONN_ID
*peer_scid
,
3337 const QUIC_CONN_ID
*peer_dcid
)
3339 if (!ossl_assert(ch
->state
== QUIC_CHANNEL_STATE_IDLE
&& ch
->is_server
))
3342 /* Generate an Initial LCID we will use for the connection. */
3343 if (!ossl_quic_lcidm_generate_initial(ch
->lcidm
, ch
, &ch
->cur_local_cid
))
3346 /* Note our newly learnt peer address and CIDs. */
3347 ch
->cur_peer_addr
= *peer
;
3348 ch
->init_dcid
= *peer_dcid
;
3349 ch
->cur_remote_dcid
= *peer_scid
;
3351 /* Inform QTX of peer address. */
3352 if (!ossl_quic_tx_packetiser_set_peer(ch
->txp
, &ch
->cur_peer_addr
))
3355 /* Inform TXP of desired CIDs. */
3356 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->cur_remote_dcid
))
3359 if (!ossl_quic_tx_packetiser_set_cur_scid(ch
->txp
, &ch
->cur_local_cid
))
3362 /* Setup QLOG, which did not happen earlier due to lacking an Initial ODCID. */
3363 ossl_qtx_set_qlog_cb(ch
->qtx
, ch_get_qlog_cb
, ch
);
3364 ossl_quic_tx_packetiser_set_qlog_cb(ch
->txp
, ch_get_qlog_cb
, ch
);
3366 /* Plug in secrets for the Initial EL. */
3367 if (!ossl_quic_provide_initial_secret(ch
->port
->engine
->libctx
,
3368 ch
->port
->engine
->propq
,
3374 /* Register the peer ODCID in the LCIDM. */
3375 if (!ossl_quic_lcidm_enrol_odcid(ch
->lcidm
, ch
, &ch
->init_dcid
))
3379 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_ACTIVE
);
3380 ch
->doing_proactive_ver_neg
= 0; /* not currently supported */
3384 SSL
*ossl_quic_channel_get0_ssl(QUIC_CHANNEL
*ch
)
3389 static int ch_init_new_stream(QUIC_CHANNEL
*ch
, QUIC_STREAM
*qs
,
3390 int can_send
, int can_recv
)
3393 int server_init
= ossl_quic_stream_is_server_init(qs
);
3394 int local_init
= (ch
->is_server
== server_init
);
3395 int is_uni
= !ossl_quic_stream_is_bidi(qs
);
3398 if ((qs
->sstream
= ossl_quic_sstream_new(INIT_APP_BUF_LEN
)) == NULL
)
3402 if ((qs
->rstream
= ossl_quic_rstream_new(NULL
, NULL
, 0)) == NULL
)
3406 if (!ossl_quic_txfc_init(&qs
->txfc
, &ch
->conn_txfc
))
3409 if (ch
->got_remote_transport_params
) {
3411 * If we already got peer TPs we need to apply the initial CWM credit
3412 * now. If we didn't already get peer TPs this will be done
3413 * automatically for all extant streams when we do.
3419 cwm
= ch
->rx_init_max_stream_data_uni
;
3420 else if (local_init
)
3421 cwm
= ch
->rx_init_max_stream_data_bidi_local
;
3423 cwm
= ch
->rx_init_max_stream_data_bidi_remote
;
3425 ossl_quic_txfc_bump_cwm(&qs
->txfc
, cwm
);
3433 rxfc_wnd
= ch
->tx_init_max_stream_data_uni
;
3434 else if (local_init
)
3435 rxfc_wnd
= ch
->tx_init_max_stream_data_bidi_local
;
3437 rxfc_wnd
= ch
->tx_init_max_stream_data_bidi_remote
;
3439 if (!ossl_quic_rxfc_init(&qs
->rxfc
, &ch
->conn_rxfc
,
3441 DEFAULT_STREAM_RXFC_MAX_WND_MUL
* rxfc_wnd
,
3448 ossl_quic_sstream_free(qs
->sstream
);
3450 ossl_quic_rstream_free(qs
->rstream
);
3455 static uint64_t *ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL
*ch
,
3458 return is_uni
? &ch
->next_local_stream_ordinal_uni
3459 : &ch
->next_local_stream_ordinal_bidi
;
3462 static const uint64_t *ch_get_local_stream_max_ptr(const QUIC_CHANNEL
*ch
,
3465 return is_uni
? &ch
->max_local_streams_uni
3466 : &ch
->max_local_streams_bidi
;
3469 static const QUIC_RXFC
*ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL
*ch
,
3472 return is_uni
? &ch
->max_streams_uni_rxfc
3473 : &ch
->max_streams_bidi_rxfc
;
3476 int ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL
*ch
,
3479 const uint64_t *p_next_ordinal
= ch_get_local_stream_next_ordinal_ptr(ch
, is_uni
);
3481 return ossl_quic_stream_map_is_local_allowed_by_stream_limit(&ch
->qsm
,
3486 uint64_t ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL
*ch
,
3489 const uint64_t *p_next_ordinal
, *p_max
;
3491 p_next_ordinal
= ch_get_local_stream_next_ordinal_ptr((QUIC_CHANNEL
*)ch
,
3493 p_max
= ch_get_local_stream_max_ptr(ch
, is_uni
);
3495 return *p_max
- *p_next_ordinal
;
3498 uint64_t ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL
*ch
,
3501 return ossl_quic_rxfc_get_credit(ch_get_remote_stream_count_rxfc(ch
, is_uni
));
3504 QUIC_STREAM
*ossl_quic_channel_new_stream_local(QUIC_CHANNEL
*ch
, int is_uni
)
3509 uint64_t *p_next_ordinal
;
3511 type
= ch
->is_server
? QUIC_STREAM_INITIATOR_SERVER
3512 : QUIC_STREAM_INITIATOR_CLIENT
;
3514 p_next_ordinal
= ch_get_local_stream_next_ordinal_ptr(ch
, is_uni
);
3517 type
|= QUIC_STREAM_DIR_UNI
;
3519 type
|= QUIC_STREAM_DIR_BIDI
;
3521 if (*p_next_ordinal
>= ((uint64_t)1) << 62)
3524 stream_id
= ((*p_next_ordinal
) << 2) | type
;
3526 if ((qs
= ossl_quic_stream_map_alloc(&ch
->qsm
, stream_id
, type
)) == NULL
)
3529 /* Locally-initiated stream, so we always want a send buffer. */
3530 if (!ch_init_new_stream(ch
, qs
, /*can_send=*/1, /*can_recv=*/!is_uni
))
3537 ossl_quic_stream_map_release(&ch
->qsm
, qs
);
3541 QUIC_STREAM
*ossl_quic_channel_new_stream_remote(QUIC_CHANNEL
*ch
,
3548 peer_role
= ch
->is_server
3549 ? QUIC_STREAM_INITIATOR_CLIENT
3550 : QUIC_STREAM_INITIATOR_SERVER
;
3552 if ((stream_id
& QUIC_STREAM_INITIATOR_MASK
) != peer_role
)
3555 is_uni
= ((stream_id
& QUIC_STREAM_DIR_MASK
) == QUIC_STREAM_DIR_UNI
);
3557 qs
= ossl_quic_stream_map_alloc(&ch
->qsm
, stream_id
,
3558 stream_id
& (QUIC_STREAM_INITIATOR_MASK
3559 | QUIC_STREAM_DIR_MASK
));
3563 if (!ch_init_new_stream(ch
, qs
, /*can_send=*/!is_uni
, /*can_recv=*/1))
3566 if (ch
->incoming_stream_auto_reject
)
3567 ossl_quic_channel_reject_stream(ch
, qs
);
3569 ossl_quic_stream_map_push_accept_queue(&ch
->qsm
, qs
);
3574 ossl_quic_stream_map_release(&ch
->qsm
, qs
);
3578 void ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL
*ch
,
3582 ch
->incoming_stream_auto_reject
= (enable
!= 0);
3583 ch
->incoming_stream_auto_reject_aec
= aec
;
3586 void ossl_quic_channel_reject_stream(QUIC_CHANNEL
*ch
, QUIC_STREAM
*qs
)
3588 ossl_quic_stream_map_stop_sending_recv_part(&ch
->qsm
, qs
,
3589 ch
->incoming_stream_auto_reject_aec
);
3591 ossl_quic_stream_map_reset_stream_send_part(&ch
->qsm
, qs
,
3592 ch
->incoming_stream_auto_reject_aec
);
3595 ossl_quic_stream_map_update_state(&ch
->qsm
, qs
);
3598 /* Replace local connection ID in TXP and DEMUX for testing purposes. */
3599 int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL
*ch
,
3600 const QUIC_CONN_ID
*conn_id
)
3602 /* Remove the current LCID from the LCIDM. */
3603 if (!ossl_quic_lcidm_debug_remove(ch
->lcidm
, &ch
->cur_local_cid
))
3605 ch
->cur_local_cid
= *conn_id
;
3606 /* Set in the TXP, used only for long header packets. */
3607 if (!ossl_quic_tx_packetiser_set_cur_scid(ch
->txp
, &ch
->cur_local_cid
))
3609 /* Add the new LCID to the LCIDM. */
3610 if (!ossl_quic_lcidm_debug_add(ch
->lcidm
, ch
, &ch
->cur_local_cid
,
3616 void ossl_quic_channel_set_msg_callback(QUIC_CHANNEL
*ch
,
3617 ossl_msg_cb msg_callback
,
3618 SSL
*msg_callback_ssl
)
3620 ch
->msg_callback
= msg_callback
;
3621 ch
->msg_callback_ssl
= msg_callback_ssl
;
3622 ossl_qtx_set_msg_callback(ch
->qtx
, msg_callback
, msg_callback_ssl
);
3623 ossl_quic_tx_packetiser_set_msg_callback(ch
->txp
, msg_callback
,
3625 ossl_qrx_set_msg_callback(ch
->qrx
, msg_callback
, msg_callback_ssl
);
3628 void ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL
*ch
,
3629 void *msg_callback_arg
)
3631 ch
->msg_callback_arg
= msg_callback_arg
;
3632 ossl_qtx_set_msg_callback_arg(ch
->qtx
, msg_callback_arg
);
3633 ossl_quic_tx_packetiser_set_msg_callback_arg(ch
->txp
, msg_callback_arg
);
3634 ossl_qrx_set_msg_callback_arg(ch
->qrx
, msg_callback_arg
);
3637 void ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL
*ch
,
3638 uint64_t tx_pkt_threshold
)
3640 ch
->txku_threshold_override
= tx_pkt_threshold
;
3643 uint64_t ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL
*ch
)
3645 return ossl_qtx_get_key_epoch(ch
->qtx
);
3648 uint64_t ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL
*ch
)
3650 return ossl_qrx_get_key_epoch(ch
->qrx
);
3653 int ossl_quic_channel_trigger_txku(QUIC_CHANNEL
*ch
)
3655 if (!txku_allowed(ch
))
3658 ch
->ku_locally_initiated
= 1;
3659 ch_trigger_txku(ch
);
3663 int ossl_quic_channel_ping(QUIC_CHANNEL
*ch
)
3665 int pn_space
= ossl_quic_enc_level_to_pn_space(ch
->tx_enc_level
);
3667 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch
->txp
, pn_space
);
3672 uint16_t ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL
*ch
)
3674 return ch
->diag_num_rx_ack
;
3677 void ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL
*ch
, QUIC_CONN_ID
*cid
)
3679 *cid
= ch
->cur_local_cid
;
3682 int ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL
*ch
)
3684 return ch
->got_local_transport_params
;
3687 void ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL
*ch
, uint64_t ms
)
3689 ch
->max_idle_timeout_local_req
= ms
;
3691 uint64_t ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL
*ch
)
3693 return ch
->max_idle_timeout_local_req
;
3696 uint64_t ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL
*ch
)
3698 return ch
->max_idle_timeout_remote_req
;
3701 uint64_t ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL
*ch
)
3703 return ch
->max_idle_timeout
;