ssl/quic/quic_port.c

   1 /*
   2  * Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include "internal/quic_port.h"
  11 #include "internal/quic_channel.h"
  12 #include "internal/quic_lcidm.h"
  13 #include "internal/quic_srtm.h"
  14 #include "quic_port_local.h"
  15 #include "quic_channel_local.h"
  16 #include "../ssl_local.h"
  17
  18 /*
  19  * QUIC Port Structure
  20  * ===================
  21  */
  22 #define INIT_DCID_LEN                   8
  23
  24 static int port_init(QUIC_PORT *port);
  25 static void port_cleanup(QUIC_PORT *port);
  26 static OSSL_TIME get_time(void *arg);
  27 static void port_tick(QUIC_TICK_RESULT *res, void *arg, uint32_t flags);
  28 static void port_default_packet_handler(QUIC_URXE *e, void *arg);
  29 static void port_rx_pre(QUIC_PORT *port);
  30
  31 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
  32
  33 QUIC_PORT *ossl_quic_port_new(const QUIC_PORT_ARGS *args)
  34 {
  35     QUIC_PORT *port;
  36
  37     if ((port = OPENSSL_zalloc(sizeof(QUIC_PORT))) == NULL)
  38         return NULL;
  39
  40     port->libctx        = args->libctx;
  41     port->propq         = args->propq;
  42     port->mutex         = args->mutex;
  43     port->now_cb        = args->now_cb;
  44     port->now_cb_arg    = args->now_cb_arg;
  45     port->channel_ctx   = args->channel_ctx;
  46     port->is_multi_conn = args->is_multi_conn;
  47
  48     if (!port_init(port)) {
  49         OPENSSL_free(port);
  50         return NULL;
  51     }
  52
  53     return port;
  54 }
  55
  56 void ossl_quic_port_free(QUIC_PORT *port)
  57 {
  58     if (port == NULL)
  59         return;
  60
  61     port_cleanup(port);
  62     OPENSSL_free(port);
  63 }
  64
  65 static int port_init(QUIC_PORT *port)
  66 {
  67     size_t rx_short_dcid_len = (port->is_multi_conn ? INIT_DCID_LEN : 0);
  68
  69     if (port->channel_ctx == NULL)
  70         goto err;
  71
  72     if ((port->demux = ossl_quic_demux_new(/*BIO=*/NULL,
  73                                            /*Short CID Len=*/rx_short_dcid_len,
  74                                            get_time, port)) == NULL)
  75         goto err;
  76
  77     /*
  78      * If we are a server, setup our handler for packets not corresponding to
  79      * any known DCID on our end. This is for handling clients establishing new
  80      * connections.
  81      */
  82     // if (is_server)
  83     ossl_quic_demux_set_default_handler(port->demux,
  84                                         port_default_packet_handler,
  85                                         port);
  86
  87     if ((port->srtm = ossl_quic_srtm_new(port->libctx, port->propq)) == NULL)
  88         goto err;
  89
  90     ossl_quic_reactor_init(&port->rtor, port_tick, port, ossl_time_zero());
  91     port->rx_short_dcid_len = (unsigned char)rx_short_dcid_len;
  92     port->tx_init_dcid_len  = INIT_DCID_LEN;
  93     return 1;
  94
  95 err:
  96     port_cleanup(port);
  97     return 0;
  98 }
  99
 100 static void port_cleanup(QUIC_PORT *port)
 101 {
 102     assert(ossl_list_ch_num(&port->channel_list) == 0);
 103
 104     ossl_quic_demux_free(port->demux);
 105     port->demux = NULL;
 106
 107     ossl_quic_srtm_free(port->srtm);
 108     port->srtm = NULL;
 109 }
 110
 111 QUIC_REACTOR *ossl_quic_port_get0_reactor(QUIC_PORT *port)
 112 {
 113     return &port->rtor;
 114 }
 115
 116 QUIC_DEMUX *ossl_quic_port_get0_demux(QUIC_PORT *port)
 117 {
 118     return port->demux;
 119 }
 120
 121 CRYPTO_MUTEX *ossl_quic_port_get0_mutex(QUIC_PORT *port)
 122 {
 123     return port->mutex;
 124 }
 125
 126 OSSL_TIME ossl_quic_port_get_time(QUIC_PORT *port)
 127 {
 128     if (port->now_cb == NULL)
 129         return ossl_time_now();
 130
 131     return port->now_cb(port->now_cb_arg);
 132 }
 133
 134 static OSSL_TIME get_time(void *port)
 135 {
 136     return ossl_quic_port_get_time(port);
 137 }
 138
 139 int ossl_quic_port_get_rx_short_dcid_len(const QUIC_PORT *port)
 140 {
 141     return port->rx_short_dcid_len;
 142 }
 143
 144 int ossl_quic_port_get_tx_init_dcid_len(const QUIC_PORT *port)
 145 {
 146     return port->tx_init_dcid_len;
 147 }
 148
 149 /*
 150  * QUIC Port: Network BIO Configuration
 151  * ====================================
 152  */
 153
 154 /* Determines whether we can support a given poll descriptor. */
 155 static int validate_poll_descriptor(const BIO_POLL_DESCRIPTOR *d)
 156 {
 157     if (d->type == BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD && d->value.fd < 0) {
 158         ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
 159         return 0;
 160     }
 161
 162     return 1;
 163 }
 164
 165 BIO *ossl_quic_port_get_net_rbio(QUIC_PORT *port)
 166 {
 167     return port->net_rbio;
 168 }
 169
 170 BIO *ossl_quic_port_get_net_wbio(QUIC_PORT *port)
 171 {
 172     return port->net_wbio;
 173 }
 174
 175 static int port_update_poll_desc(QUIC_PORT *port, BIO *net_bio, int for_write)
 176 {
 177     BIO_POLL_DESCRIPTOR d = {0};
 178
 179     if (net_bio == NULL
 180         || (!for_write && !BIO_get_rpoll_descriptor(net_bio, &d))
 181         || (for_write && !BIO_get_wpoll_descriptor(net_bio, &d)))
 182         /* Non-pollable BIO */
 183         d.type = BIO_POLL_DESCRIPTOR_TYPE_NONE;
 184
 185     if (!validate_poll_descriptor(&d))
 186         return 0;
 187
 188     if (for_write)
 189         ossl_quic_reactor_set_poll_w(&port->rtor, &d);
 190     else
 191         ossl_quic_reactor_set_poll_r(&port->rtor, &d);
 192
 193     return 1;
 194 }
 195
 196 int ossl_quic_port_update_poll_descriptors(QUIC_PORT *port)
 197 {
 198     int ok = 1;
 199
 200     if (!port_update_poll_desc(port, port->net_rbio, /*for_write=*/0))
 201         ok = 0;
 202
 203     if (!port_update_poll_desc(port, port->net_wbio, /*for_write=*/1))
 204         ok = 0;
 205
 206     return ok;
 207 }
 208
 209 /*
 210  * QUIC_PORT does not ref any BIO it is provided with, nor is any ref
 211  * transferred to it. The caller (e.g., QUIC_CONNECTION) is responsible for
 212  * ensuring the BIO lasts until the channel is freed or the BIO is switched out
 213  * for another BIO by a subsequent successful call to this function.
 214  */
 215 int ossl_quic_port_set_net_rbio(QUIC_PORT *port, BIO *net_rbio)
 216 {
 217     if (port->net_rbio == net_rbio)
 218         return 1;
 219
 220     if (!port_update_poll_desc(port, net_rbio, /*for_write=*/0))
 221         return 0;
 222
 223     ossl_quic_demux_set_bio(port->demux, net_rbio);
 224     port->net_rbio = net_rbio;
 225     return 1;
 226 }
 227
 228 int ossl_quic_port_set_net_wbio(QUIC_PORT *port, BIO *net_wbio)
 229 {
 230     QUIC_CHANNEL *ch;
 231
 232     if (port->net_wbio == net_wbio)
 233         return 1;
 234
 235     if (!port_update_poll_desc(port, net_wbio, /*for_write=*/1))
 236         return 0;
 237
 238     LIST_FOREACH(ch, ch, &port->channel_list)
 239         ossl_qtx_set_bio(ch->qtx, net_wbio);
 240
 241     port->net_wbio = net_wbio;
 242     return 1;
 243 }
 244
 245 /*
 246  * QUIC Port: Channel Lifecycle
 247  * ============================
 248  */
 249
 250 static SSL *port_new_handshake_layer(QUIC_PORT *port)
 251 {
 252     SSL *tls = NULL;
 253     SSL_CONNECTION *tls_conn = NULL;
 254
 255     tls = ossl_ssl_connection_new_int(port->channel_ctx, TLS_method());
 256     if (tls == NULL || (tls_conn = SSL_CONNECTION_FROM_SSL(tls)) == NULL)
 257         return NULL;
 258
 259     /* Override the user_ssl of the inner connection. */
 260     tls_conn->s3.flags      |= TLS1_FLAGS_QUIC;
 261
 262     /* Restrict options derived from the SSL_CTX. */
 263     tls_conn->options       &= OSSL_QUIC_PERMITTED_OPTIONS_CONN;
 264     tls_conn->pha_enabled   = 0;
 265     return tls;
 266 }
 267
 268 static QUIC_CHANNEL *port_make_channel(QUIC_PORT *port, SSL *tls, int is_server)
 269 {
 270     QUIC_CHANNEL_ARGS args = {0};
 271     QUIC_CHANNEL *ch;
 272
 273     args.port       = port;
 274     args.is_server  = is_server;
 275     args.tls        = (tls != NULL ? tls : port_new_handshake_layer(port));
 276     if (args.tls == NULL)
 277         return NULL;
 278
 279     ch = ossl_quic_channel_new(&args);
 280     if (ch == NULL) {
 281         if (tls == NULL)
 282             SSL_free(args.tls);
 283
 284         return NULL;
 285     }
 286
 287     return ch;
 288 }
 289
 290 QUIC_CHANNEL *ossl_quic_port_create_outgoing(QUIC_PORT *port, SSL *tls)
 291 {
 292     return port_make_channel(port, tls, /*is_server=*/0);
 293 }
 294
 295 QUIC_CHANNEL *ossl_quic_port_create_incoming(QUIC_PORT *port, SSL *tls)
 296 {
 297     QUIC_CHANNEL *ch;
 298
 299     assert(port->tserver_ch == NULL);
 300
 301     ch = port_make_channel(port, tls, /*is_server=*/1);
 302     port->tserver_ch = ch;
 303     return ch;
 304 }
 305
 306 /*
 307  * QUIC Port: Ticker-Mutator
 308  * =========================
 309  */
 310
 311 /*
 312  * The central ticker function called by the reactor. This does everything, or
 313  * at least everything network I/O related. Best effort - not allowed to fail
 314  * "loudly".
 315  */
 316 static void port_tick(QUIC_TICK_RESULT *res, void *arg, uint32_t flags)
 317 {
 318     QUIC_PORT *port = arg;
 319     QUIC_CHANNEL *ch;
 320
 321     res->net_read_desired   = 0;
 322     res->net_write_desired  = 0;
 323     res->tick_deadline      = ossl_time_infinite();
 324
 325     if (!port->inhibit_tick) {
 326         /* Handle any incoming data from network. */
 327         port_rx_pre(port);
 328
 329         /* Iterate through all channels and service them. */
 330         LIST_FOREACH(ch, ch, &port->channel_list) {
 331             QUIC_TICK_RESULT subr = {0};
 332
 333             ossl_quic_channel_subtick(ch, &subr, flags);
 334             ossl_quic_tick_result_merge_into(res, &subr);
 335         }
 336     }
 337 }
 338
 339 /* Process incoming datagrams, if any. */
 340 static void port_rx_pre(QUIC_PORT *port)
 341 {
 342     int ret;
 343
 344     // TODO !have_sent_any_pkt
 345
 346     /*
 347      * Get DEMUX to BIO_recvmmsg from the network and queue incoming datagrams
 348      * to the appropriate QRX instances.
 349      */
 350     ret = ossl_quic_demux_pump(port->demux);
 351     // TODO: handle ret, stateless reset
 352
 353     if (ret == QUIC_DEMUX_PUMP_RES_PERMANENT_FAIL)
 354         /*
 355          * We don't care about transient failure, but permanent failure means we
 356          * should tear down the port. All connections skip straight to the
 357          * Terminated state as there is no point trying to send CONNECTION_CLOSE
 358          * frames if the network BIO is not operating correctly.
 359          */
 360         ossl_quic_port_raise_net_error(port);
 361 }
 362
 363 /*
 364  * Handles an incoming connection request and potentially decides to make a
 365  * connection from it. If a new connection is made, the new channel is written
 366  * to *new_ch.
 367  */
 368 static void port_on_new_conn(QUIC_PORT *port, const BIO_ADDR *peer,
 369                              const QUIC_CONN_ID *scid,
 370                              const QUIC_CONN_ID *dcid,
 371                              QUIC_CHANNEL **new_ch)
 372 {
 373     if (port->tserver_ch != NULL) {
 374         /* Specially assign to existing channel */
 375         if (!ossl_quic_channel_on_new_conn(port->tserver_ch, peer, scid, dcid))
 376             return;
 377
 378         *new_ch = port->tserver_ch;
 379         port->tserver_ch = NULL;
 380         return;
 381     }
 382 }
 383
 384 /*
 385  * This is called by the demux when we get a packet not destined for any known
 386  * DCID.
 387  */
 388 static void port_default_packet_handler(QUIC_URXE *e, void *arg)
 389 {
 390     QUIC_PORT *port = arg;
 391     PACKET pkt;
 392     QUIC_PKT_HDR hdr;
 393     QUIC_CHANNEL *new_ch = NULL;
 394
 395     // TODO review this
 396     if (port->tserver_ch == NULL)
 397         goto undesirable;
 398
 399     // TODO allow_incoming
 400     //if (!ossl_assert(ch->is_server))
 401     //    goto undesirable;
 402
 403     //TODO if (ch->state != QUIC_CHANNEL_STATE_IDLE)
 404     //    goto undesirable;
 405
 406     /*
 407      * We have got a packet for an unknown DCID. This might be an attempt to
 408      * open a new connection.
 409      */
 410     if (e->data_len < QUIC_MIN_INITIAL_DGRAM_LEN)
 411         goto undesirable;
 412
 413     if (!PACKET_buf_init(&pkt, ossl_quic_urxe_data(e), e->data_len))
 414         goto undesirable;
 415
 416     /*
 417      * We set short_conn_id_len to SIZE_MAX here which will cause the decode
 418      * operation to fail if we get a 1-RTT packet. This is fine since we only
 419      * care about Initial packets.
 420      */
 421     if (!ossl_quic_wire_decode_pkt_hdr(&pkt, SIZE_MAX, 1, 0, &hdr, NULL))
 422         goto undesirable;
 423
 424     switch (hdr.version) {
 425         case QUIC_VERSION_1:
 426             break;
 427
 428         case QUIC_VERSION_NONE:
 429         default:
 430             /* Unknown version or proactive version negotiation request, bail. */
 431             /* TODO(QUIC SERVER): Handle version negotiation on server side */
 432             goto undesirable;
 433     }
 434
 435     /*
 436      * We only care about Initial packets which might be trying to establish a
 437      * connection.
 438      */
 439     if (hdr.type != QUIC_PKT_TYPE_INITIAL)
 440         goto undesirable;
 441
 442     /*
 443      * Try to process this as a valid attempt to initiate a connection.
 444      *
 445      * We do not register the DCID in the Initial packet we received as
 446      * that DCID is not actually used again, thus after provisioning
 447      * the new connection and associated Initial keys, we inject the
 448      * received packet directly to the new channel's QRX so that it can
 449      * process it as a one-time thing, instead of going through the usual
 450      * DEMUX DCID-based routing.
 451      */
 452     port_on_new_conn(port, &e->peer, &hdr.src_conn_id, &hdr.dst_conn_id,
 453                      &new_ch);
 454     if (new_ch != NULL)
 455         ossl_qrx_inject_urxe(new_ch->qrx, e);
 456
 457     return;
 458
 459 undesirable:
 460     ossl_quic_demux_release_urxe(port->demux, e);
 461 }
 462
 463 void ossl_quic_port_set_inhibit_tick(QUIC_PORT *port, int inhibit)
 464 {
 465     port->inhibit_tick = (inhibit != 0);
 466 }
 467
 468 void ossl_quic_port_raise_net_error(QUIC_PORT *port)
 469 {
 470     QUIC_CHANNEL *ch;
 471
 472     // TODO fsm
 473
 474     LIST_FOREACH(ch, ch, &port->channel_list)
 475         ossl_quic_channel_raise_net_error(ch);
 476 }