2 * Copyright 2022-2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/rand.h>
11 #include <openssl/err.h>
12 #include "internal/quic_channel.h"
13 #include "internal/quic_error.h"
14 #include "internal/quic_rx_depack.h"
15 #include "internal/quic_lcidm.h"
16 #include "internal/quic_srtm.h"
17 #include "internal/qlog_event_helpers.h"
18 #include "../ssl_local.h"
19 #include "quic_channel_local.h"
20 #include "quic_port_local.h"
21 #include "quic_engine_local.h"
24 * NOTE: While this channel implementation currently has basic server support,
25 * this functionality has been implemented for internal testing purposes and is
26 * not suitable for network use. In particular, it does not implement address
27 * validation, anti-amplification or retry logic.
29 * TODO(QUIC SERVER): Implement address validation and anti-amplification
30 * TODO(QUIC SERVER): Implement retry logic
33 #define INIT_CRYPTO_RECV_BUF_LEN 16384
34 #define INIT_CRYPTO_SEND_BUF_LEN 16384
35 #define INIT_APP_BUF_LEN 8192
38 * Interval before we force a PING to ensure NATs don't timeout. This is based
39 * on the lowest commonly seen value of 30 seconds as cited in RFC 9000 s.
42 #define MAX_NAT_INTERVAL (ossl_ms2time(25000))
45 * Our maximum ACK delay on the TX side. This is up to us to choose. Note that
46 * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol
47 * value which determines the value of the maximum ACK delay if the
48 * max_ack_delay transport parameter is not set.
50 #define DEFAULT_MAX_ACK_DELAY QUIC_DEFAULT_MAX_ACK_DELAY
52 DEFINE_LIST_OF_IMPL(ch
, QUIC_CHANNEL
);
54 static void ch_save_err_state(QUIC_CHANNEL
*ch
);
55 static int ch_rx(QUIC_CHANNEL
*ch
, int channel_only
);
56 static int ch_tx(QUIC_CHANNEL
*ch
);
57 static int ch_tick_tls(QUIC_CHANNEL
*ch
, int channel_only
);
58 static void ch_rx_handle_packet(QUIC_CHANNEL
*ch
, int channel_only
);
59 static OSSL_TIME
ch_determine_next_tick_deadline(QUIC_CHANNEL
*ch
);
60 static int ch_retry(QUIC_CHANNEL
*ch
,
61 const unsigned char *retry_token
,
62 size_t retry_token_len
,
63 const QUIC_CONN_ID
*retry_scid
);
64 static void ch_cleanup(QUIC_CHANNEL
*ch
);
65 static int ch_generate_transport_params(QUIC_CHANNEL
*ch
);
66 static int ch_on_transport_params(const unsigned char *params
,
69 static int ch_on_handshake_alert(void *arg
, unsigned char alert_code
);
70 static int ch_on_handshake_complete(void *arg
);
71 static int ch_on_handshake_yield_secret(uint32_t enc_level
, int direction
,
72 uint32_t suite_id
, EVP_MD
*md
,
73 const unsigned char *secret
,
76 static int ch_on_crypto_recv_record(const unsigned char **buf
,
77 size_t *bytes_read
, void *arg
);
78 static int ch_on_crypto_release_record(size_t bytes_read
, void *arg
);
79 static int crypto_ensure_empty(QUIC_RSTREAM
*rstream
);
80 static int ch_on_crypto_send(const unsigned char *buf
, size_t buf_len
,
81 size_t *consumed
, void *arg
);
82 static OSSL_TIME
get_time(void *arg
);
83 static uint64_t get_stream_limit(int uni
, void *arg
);
84 static int rx_late_validate(QUIC_PN pn
, int pn_space
, void *arg
);
85 static void rxku_detected(QUIC_PN pn
, void *arg
);
86 static int ch_retry(QUIC_CHANNEL
*ch
,
87 const unsigned char *retry_token
,
88 size_t retry_token_len
,
89 const QUIC_CONN_ID
*retry_scid
);
90 static void ch_update_idle(QUIC_CHANNEL
*ch
);
91 static int ch_discard_el(QUIC_CHANNEL
*ch
,
93 static void ch_on_idle_timeout(QUIC_CHANNEL
*ch
);
94 static void ch_update_idle(QUIC_CHANNEL
*ch
);
95 static void ch_update_ping_deadline(QUIC_CHANNEL
*ch
);
96 static void ch_on_terminating_timeout(QUIC_CHANNEL
*ch
);
97 static void ch_start_terminating(QUIC_CHANNEL
*ch
,
98 const QUIC_TERMINATE_CAUSE
*tcause
,
100 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK
*ack
, uint32_t pn_space
,
102 static void ch_rx_handle_version_neg(QUIC_CHANNEL
*ch
, OSSL_QRX_PKT
*pkt
);
103 static void ch_raise_version_neg_failure(QUIC_CHANNEL
*ch
);
104 static void ch_record_state_transition(QUIC_CHANNEL
*ch
, uint32_t new_state
);
106 DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM
);
109 static QLOG
*ch_get_qlog(QUIC_CHANNEL
*ch
)
111 #ifndef OPENSSL_NO_QLOG
112 QLOG_TRACE_INFO qti
= {0};
114 if (ch
->qlog
!= NULL
)
120 if (ch
->is_server
&& ch
->init_dcid
.id_len
== 0)
123 qti
.odcid
= ch
->init_dcid
;
124 qti
.title
= ch
->qlog_title
;
125 qti
.description
= NULL
;
127 qti
.is_server
= ch
->is_server
;
128 qti
.now_cb
= get_time
;
130 if ((ch
->qlog
= ossl_qlog_new_from_env(&qti
)) == NULL
) {
131 ch
->use_qlog
= 0; /* don't try again */
142 * QUIC Channel Initialization and Teardown
143 * ========================================
145 #define DEFAULT_INIT_CONN_RXFC_WND (768 * 1024)
146 #define DEFAULT_CONN_RXFC_MAX_WND_MUL 20
148 #define DEFAULT_INIT_STREAM_RXFC_WND (512 * 1024)
149 #define DEFAULT_STREAM_RXFC_MAX_WND_MUL 12
151 #define DEFAULT_INIT_CONN_MAX_STREAMS 100
153 static int ch_init(QUIC_CHANNEL
*ch
)
155 OSSL_QUIC_TX_PACKETISER_ARGS txp_args
= {0};
156 OSSL_QTX_ARGS qtx_args
= {0};
157 OSSL_QRX_ARGS qrx_args
= {0};
158 QUIC_TLS_ARGS tls_args
= {0};
160 size_t rx_short_dcid_len
;
161 size_t tx_init_dcid_len
;
163 if (ch
->port
== NULL
|| ch
->lcidm
== NULL
|| ch
->srtm
== NULL
)
166 rx_short_dcid_len
= ossl_quic_port_get_rx_short_dcid_len(ch
->port
);
167 tx_init_dcid_len
= ossl_quic_port_get_tx_init_dcid_len(ch
->port
);
169 /* For clients, generate our initial DCID. */
171 && !ossl_quic_gen_rand_conn_id(ch
->port
->engine
->libctx
, tx_init_dcid_len
,
175 /* We plug in a network write BIO to the QTX later when we get one. */
176 qtx_args
.libctx
= ch
->port
->engine
->libctx
;
177 qtx_args
.qlog
= ch_get_qlog(ch
);
178 qtx_args
.mdpl
= QUIC_MIN_INITIAL_DGRAM_LEN
;
179 ch
->rx_max_udp_payload_size
= qtx_args
.mdpl
;
181 ch
->ping_deadline
= ossl_time_infinite();
183 ch
->qtx
= ossl_qtx_new(&qtx_args
);
187 ch
->txpim
= ossl_quic_txpim_new();
188 if (ch
->txpim
== NULL
)
191 ch
->cfq
= ossl_quic_cfq_new();
195 if (!ossl_quic_txfc_init(&ch
->conn_txfc
, NULL
))
199 * Note: The TP we transmit governs what the peer can transmit and thus
200 * applies to the RXFC.
202 ch
->tx_init_max_stream_data_bidi_local
= DEFAULT_INIT_STREAM_RXFC_WND
;
203 ch
->tx_init_max_stream_data_bidi_remote
= DEFAULT_INIT_STREAM_RXFC_WND
;
204 ch
->tx_init_max_stream_data_uni
= DEFAULT_INIT_STREAM_RXFC_WND
;
206 if (!ossl_quic_rxfc_init(&ch
->conn_rxfc
, NULL
,
207 DEFAULT_INIT_CONN_RXFC_WND
,
208 DEFAULT_CONN_RXFC_MAX_WND_MUL
*
209 DEFAULT_INIT_CONN_RXFC_WND
,
213 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
)
214 if (!ossl_quic_rxfc_init_standalone(&ch
->crypto_rxfc
[pn_space
],
215 INIT_CRYPTO_RECV_BUF_LEN
,
219 if (!ossl_quic_rxfc_init_standalone(&ch
->max_streams_bidi_rxfc
,
220 DEFAULT_INIT_CONN_MAX_STREAMS
,
224 if (!ossl_quic_rxfc_init_standalone(&ch
->max_streams_uni_rxfc
,
225 DEFAULT_INIT_CONN_MAX_STREAMS
,
229 if (!ossl_statm_init(&ch
->statm
))
233 ch
->cc_method
= &ossl_cc_newreno_method
;
234 if ((ch
->cc_data
= ch
->cc_method
->new(get_time
, ch
)) == NULL
)
237 if ((ch
->ackm
= ossl_ackm_new(get_time
, ch
, &ch
->statm
,
238 ch
->cc_method
, ch
->cc_data
)) == NULL
)
241 if (!ossl_quic_stream_map_init(&ch
->qsm
, get_stream_limit
, ch
,
242 &ch
->max_streams_bidi_rxfc
,
243 &ch
->max_streams_uni_rxfc
,
250 && !ossl_quic_lcidm_generate_initial(ch
->lcidm
, ch
, &txp_args
.cur_scid
))
253 /* We use a zero-length SCID. */
254 txp_args
.cur_dcid
= ch
->init_dcid
;
255 txp_args
.ack_delay_exponent
= 3;
256 txp_args
.qtx
= ch
->qtx
;
257 txp_args
.txpim
= ch
->txpim
;
258 txp_args
.cfq
= ch
->cfq
;
259 txp_args
.ackm
= ch
->ackm
;
260 txp_args
.qsm
= &ch
->qsm
;
261 txp_args
.conn_txfc
= &ch
->conn_txfc
;
262 txp_args
.conn_rxfc
= &ch
->conn_rxfc
;
263 txp_args
.max_streams_bidi_rxfc
= &ch
->max_streams_bidi_rxfc
;
264 txp_args
.max_streams_uni_rxfc
= &ch
->max_streams_uni_rxfc
;
265 txp_args
.cc_method
= ch
->cc_method
;
266 txp_args
.cc_data
= ch
->cc_data
;
267 txp_args
.now
= get_time
;
268 txp_args
.now_arg
= ch
;
269 txp_args
.qlog
= ch_get_qlog(ch
);
271 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
272 ch
->crypto_send
[pn_space
] = ossl_quic_sstream_new(INIT_CRYPTO_SEND_BUF_LEN
);
273 if (ch
->crypto_send
[pn_space
] == NULL
)
276 txp_args
.crypto
[pn_space
] = ch
->crypto_send
[pn_space
];
279 ch
->txp
= ossl_quic_tx_packetiser_new(&txp_args
);
283 ossl_quic_tx_packetiser_set_ack_tx_cb(ch
->txp
, ch_on_txp_ack_tx
, ch
);
285 qrx_args
.libctx
= ch
->port
->engine
->libctx
;
286 qrx_args
.demux
= ch
->port
->demux
;
287 qrx_args
.short_conn_id_len
= rx_short_dcid_len
;
288 qrx_args
.max_deferred
= 32;
290 if ((ch
->qrx
= ossl_qrx_new(&qrx_args
)) == NULL
)
293 if (!ossl_qrx_set_late_validation_cb(ch
->qrx
,
298 if (!ossl_qrx_set_key_update_cb(ch
->qrx
,
303 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
304 ch
->crypto_recv
[pn_space
] = ossl_quic_rstream_new(NULL
, NULL
, 0);
305 if (ch
->crypto_recv
[pn_space
] == NULL
)
309 /* Plug in the TLS handshake layer. */
310 tls_args
.s
= ch
->tls
;
311 tls_args
.crypto_send_cb
= ch_on_crypto_send
;
312 tls_args
.crypto_send_cb_arg
= ch
;
313 tls_args
.crypto_recv_rcd_cb
= ch_on_crypto_recv_record
;
314 tls_args
.crypto_recv_rcd_cb_arg
= ch
;
315 tls_args
.crypto_release_rcd_cb
= ch_on_crypto_release_record
;
316 tls_args
.crypto_release_rcd_cb_arg
= ch
;
317 tls_args
.yield_secret_cb
= ch_on_handshake_yield_secret
;
318 tls_args
.yield_secret_cb_arg
= ch
;
319 tls_args
.got_transport_params_cb
= ch_on_transport_params
;
320 tls_args
.got_transport_params_cb_arg
= ch
;
321 tls_args
.handshake_complete_cb
= ch_on_handshake_complete
;
322 tls_args
.handshake_complete_cb_arg
= ch
;
323 tls_args
.alert_cb
= ch_on_handshake_alert
;
324 tls_args
.alert_cb_arg
= ch
;
325 tls_args
.is_server
= ch
->is_server
;
327 if ((ch
->qtls
= ossl_quic_tls_new(&tls_args
)) == NULL
)
330 ch
->tx_max_ack_delay
= DEFAULT_MAX_ACK_DELAY
;
331 ch
->rx_max_ack_delay
= QUIC_DEFAULT_MAX_ACK_DELAY
;
332 ch
->rx_ack_delay_exp
= QUIC_DEFAULT_ACK_DELAY_EXP
;
333 ch
->rx_active_conn_id_limit
= QUIC_MIN_ACTIVE_CONN_ID_LIMIT
;
334 ch
->tx_enc_level
= QUIC_ENC_LEVEL_INITIAL
;
335 ch
->rx_enc_level
= QUIC_ENC_LEVEL_INITIAL
;
336 ch
->txku_threshold_override
= UINT64_MAX
;
338 ch
->max_idle_timeout_local_req
= QUIC_DEFAULT_IDLE_TIMEOUT
;
339 ch
->max_idle_timeout_remote_req
= 0;
340 ch
->max_idle_timeout
= ch
->max_idle_timeout_local_req
;
342 ossl_ackm_set_tx_max_ack_delay(ch
->ackm
, ossl_ms2time(ch
->tx_max_ack_delay
));
343 ossl_ackm_set_rx_max_ack_delay(ch
->ackm
, ossl_ms2time(ch
->rx_max_ack_delay
));
346 * Determine the QUIC Transport Parameters and serialize the transport
347 * parameters block. (For servers, we do this later as we must defer
348 * generation until we have received the client's transport parameters.)
350 if (!ch
->is_server
&& !ch_generate_transport_params(ch
))
354 ossl_list_ch_insert_tail(&ch
->port
->channel_list
, ch
);
355 ch
->on_port_list
= 1;
363 static void ch_cleanup(QUIC_CHANNEL
*ch
)
367 if (ch
->ackm
!= NULL
)
368 for (pn_space
= QUIC_PN_SPACE_INITIAL
;
369 pn_space
< QUIC_PN_SPACE_NUM
;
371 ossl_ackm_on_pkt_space_discarded(ch
->ackm
, pn_space
);
373 ossl_quic_lcidm_cull(ch
->lcidm
, ch
);
374 ossl_quic_srtm_cull(ch
->srtm
, ch
);
375 ossl_quic_tx_packetiser_free(ch
->txp
);
376 ossl_quic_txpim_free(ch
->txpim
);
377 ossl_quic_cfq_free(ch
->cfq
);
378 ossl_qtx_free(ch
->qtx
);
379 if (ch
->cc_data
!= NULL
)
380 ch
->cc_method
->free(ch
->cc_data
);
382 ossl_statm_destroy(&ch
->statm
);
383 ossl_ackm_free(ch
->ackm
);
386 ossl_quic_stream_map_cleanup(&ch
->qsm
);
388 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
389 ossl_quic_sstream_free(ch
->crypto_send
[pn_space
]);
390 ossl_quic_rstream_free(ch
->crypto_recv
[pn_space
]);
393 ossl_qrx_pkt_release(ch
->qrx_pkt
);
396 ossl_quic_tls_free(ch
->qtls
);
397 ossl_qrx_free(ch
->qrx
);
398 OPENSSL_free(ch
->local_transport_params
);
399 OPENSSL_free((char *)ch
->terminate_cause
.reason
);
400 OSSL_ERR_STATE_free(ch
->err_state
);
401 OPENSSL_free(ch
->ack_range_scratch
);
403 if (ch
->on_port_list
) {
404 ossl_list_ch_remove(&ch
->port
->channel_list
, ch
);
405 ch
->on_port_list
= 0;
408 #ifndef OPENSSL_NO_QLOG
409 if (ch
->qlog
!= NULL
)
410 ossl_qlog_flush(ch
->qlog
); /* best effort */
412 OPENSSL_free(ch
->qlog_title
);
413 ossl_qlog_free(ch
->qlog
);
417 QUIC_CHANNEL
*ossl_quic_channel_new(const QUIC_CHANNEL_ARGS
*args
)
419 QUIC_CHANNEL
*ch
= NULL
;
421 if ((ch
= OPENSSL_zalloc(sizeof(*ch
))) == NULL
)
424 ch
->port
= args
->port
;
425 ch
->is_server
= args
->is_server
;
427 ch
->lcidm
= args
->lcidm
;
428 ch
->srtm
= args
->srtm
;
429 #ifndef OPENSSL_NO_QLOG
430 ch
->use_qlog
= args
->use_qlog
;
432 if (ch
->use_qlog
&& args
->qlog_title
!= NULL
) {
433 if ((ch
->qlog_title
= OPENSSL_strdup(args
->qlog_title
)) == NULL
) {
448 void ossl_quic_channel_free(QUIC_CHANNEL
*ch
)
457 /* Set mutator callbacks for test framework support */
458 int ossl_quic_channel_set_mutator(QUIC_CHANNEL
*ch
,
459 ossl_mutate_packet_cb mutatecb
,
460 ossl_finish_mutate_cb finishmutatecb
,
466 ossl_qtx_set_mutator(ch
->qtx
, mutatecb
, finishmutatecb
, mutatearg
);
470 int ossl_quic_channel_get_peer_addr(QUIC_CHANNEL
*ch
, BIO_ADDR
*peer_addr
)
472 if (!ch
->addressed_mode
)
475 *peer_addr
= ch
->cur_peer_addr
;
479 int ossl_quic_channel_set_peer_addr(QUIC_CHANNEL
*ch
, const BIO_ADDR
*peer_addr
)
481 if (ch
->state
!= QUIC_CHANNEL_STATE_IDLE
)
484 if (peer_addr
== NULL
|| BIO_ADDR_family(peer_addr
) == AF_UNSPEC
) {
485 BIO_ADDR_clear(&ch
->cur_peer_addr
);
486 ch
->addressed_mode
= 0;
490 ch
->cur_peer_addr
= *peer_addr
;
491 ch
->addressed_mode
= 1;
495 QUIC_REACTOR
*ossl_quic_channel_get_reactor(QUIC_CHANNEL
*ch
)
497 return ossl_quic_port_get0_reactor(ch
->port
);
500 QUIC_STREAM_MAP
*ossl_quic_channel_get_qsm(QUIC_CHANNEL
*ch
)
505 OSSL_STATM
*ossl_quic_channel_get_statm(QUIC_CHANNEL
*ch
)
510 QUIC_STREAM
*ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL
*ch
,
513 return ossl_quic_stream_map_get_by_id(&ch
->qsm
, stream_id
);
516 int ossl_quic_channel_is_active(const QUIC_CHANNEL
*ch
)
518 return ch
!= NULL
&& ch
->state
== QUIC_CHANNEL_STATE_ACTIVE
;
521 int ossl_quic_channel_is_closing(const QUIC_CHANNEL
*ch
)
523 return ch
->state
== QUIC_CHANNEL_STATE_TERMINATING_CLOSING
;
526 static int ossl_quic_channel_is_draining(const QUIC_CHANNEL
*ch
)
528 return ch
->state
== QUIC_CHANNEL_STATE_TERMINATING_DRAINING
;
531 static int ossl_quic_channel_is_terminating(const QUIC_CHANNEL
*ch
)
533 return ossl_quic_channel_is_closing(ch
)
534 || ossl_quic_channel_is_draining(ch
);
537 int ossl_quic_channel_is_terminated(const QUIC_CHANNEL
*ch
)
539 return ch
->state
== QUIC_CHANNEL_STATE_TERMINATED
;
542 int ossl_quic_channel_is_term_any(const QUIC_CHANNEL
*ch
)
544 return ossl_quic_channel_is_terminating(ch
)
545 || ossl_quic_channel_is_terminated(ch
);
548 const QUIC_TERMINATE_CAUSE
*
549 ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL
*ch
)
551 return ossl_quic_channel_is_term_any(ch
) ? &ch
->terminate_cause
: NULL
;
554 int ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL
*ch
)
556 return ch
->handshake_complete
;
559 int ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL
*ch
)
561 return ch
->handshake_confirmed
;
564 QUIC_DEMUX
*ossl_quic_channel_get0_demux(QUIC_CHANNEL
*ch
)
566 return ch
->port
->demux
;
569 QUIC_PORT
*ossl_quic_channel_get0_port(QUIC_CHANNEL
*ch
)
574 QUIC_ENGINE
*ossl_quic_channel_get0_engine(QUIC_CHANNEL
*ch
)
576 return ossl_quic_port_get0_engine(ch
->port
);
579 CRYPTO_MUTEX
*ossl_quic_channel_get_mutex(QUIC_CHANNEL
*ch
)
581 return ossl_quic_port_get0_mutex(ch
->port
);
584 int ossl_quic_channel_has_pending(const QUIC_CHANNEL
*ch
)
586 return ossl_quic_demux_has_pending(ch
->port
->demux
)
587 || ossl_qrx_processed_read_pending(ch
->qrx
);
591 * QUIC Channel: Callbacks from Miscellaneous Subsidiary Components
592 * ================================================================
595 /* Used by various components. */
596 static OSSL_TIME
get_time(void *arg
)
598 QUIC_CHANNEL
*ch
= arg
;
600 return ossl_quic_port_get_time(ch
->port
);
604 static uint64_t get_stream_limit(int uni
, void *arg
)
606 QUIC_CHANNEL
*ch
= arg
;
608 return uni
? ch
->max_local_streams_uni
: ch
->max_local_streams_bidi
;
612 * Called by QRX to determine if a packet is potentially invalid before trying
615 static int rx_late_validate(QUIC_PN pn
, int pn_space
, void *arg
)
617 QUIC_CHANNEL
*ch
= arg
;
619 /* Potential duplicates should not be processed. */
620 if (!ossl_ackm_is_rx_pn_processable(ch
->ackm
, pn
, pn_space
))
627 * Triggers a TXKU (whether spontaneous or solicited). Does not check whether
628 * spontaneous TXKU is currently allowed.
631 static void ch_trigger_txku(QUIC_CHANNEL
*ch
)
634 = ossl_quic_tx_packetiser_get_next_pn(ch
->txp
, QUIC_PN_SPACE_APP
);
636 if (!ossl_quic_pn_valid(next_pn
)
637 || !ossl_qtx_trigger_key_update(ch
->qtx
)) {
638 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
643 ch
->txku_in_progress
= 1;
644 ch
->txku_pn
= next_pn
;
645 ch
->rxku_expected
= ch
->ku_locally_initiated
;
649 static int txku_in_progress(QUIC_CHANNEL
*ch
)
651 if (ch
->txku_in_progress
652 && ossl_ackm_get_largest_acked(ch
->ackm
, QUIC_PN_SPACE_APP
) >= ch
->txku_pn
) {
653 OSSL_TIME pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
656 * RFC 9001 s. 6.5: Endpoints SHOULD wait three times the PTO before
657 * initiating a key update after receiving an acknowledgment that
658 * confirms that the previous key update was received.
660 * Note that by the above wording, this period starts from when we get
661 * the ack for a TXKU-triggering packet, not when the TXKU is initiated.
662 * So we defer TXKU cooldown deadline calculation to this point.
664 ch
->txku_in_progress
= 0;
665 ch
->txku_cooldown_deadline
= ossl_time_add(get_time(ch
),
666 ossl_time_multiply(pto
, 3));
669 return ch
->txku_in_progress
;
673 static int txku_allowed(QUIC_CHANNEL
*ch
)
675 return ch
->tx_enc_level
== QUIC_ENC_LEVEL_1RTT
/* Sanity check. */
676 /* Strict RFC 9001 criterion for TXKU. */
677 && ch
->handshake_confirmed
678 && !txku_in_progress(ch
);
682 static int txku_recommendable(QUIC_CHANNEL
*ch
)
684 if (!txku_allowed(ch
))
688 /* Recommended RFC 9001 criterion for TXKU. */
689 ossl_time_compare(get_time(ch
), ch
->txku_cooldown_deadline
) >= 0
690 /* Some additional sensible criteria. */
691 && !ch
->rxku_in_progress
692 && !ch
->rxku_pending_confirm
;
696 static int txku_desirable(QUIC_CHANNEL
*ch
)
698 uint64_t cur_pkt_count
, max_pkt_count
, thresh_pkt_count
;
699 const uint32_t enc_level
= QUIC_ENC_LEVEL_1RTT
;
701 /* Check AEAD limit to determine if we should perform a spontaneous TXKU. */
702 cur_pkt_count
= ossl_qtx_get_cur_epoch_pkt_count(ch
->qtx
, enc_level
);
703 max_pkt_count
= ossl_qtx_get_max_epoch_pkt_count(ch
->qtx
, enc_level
);
705 thresh_pkt_count
= max_pkt_count
/ 2;
706 if (ch
->txku_threshold_override
!= UINT64_MAX
)
707 thresh_pkt_count
= ch
->txku_threshold_override
;
709 return cur_pkt_count
>= thresh_pkt_count
;
713 static void ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL
*ch
)
715 if (!txku_recommendable(ch
) || !txku_desirable(ch
))
718 ch
->ku_locally_initiated
= 1;
723 static int rxku_allowed(QUIC_CHANNEL
*ch
)
726 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a key update prior to
727 * having confirmed the handshake (Section 4.1.2).
729 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a subsequent key update
730 * unless it has received an acknowledgment for a packet that was sent
731 * protected with keys from the current key phase.
733 * RFC 9001 s. 6.2: If an endpoint detects a second update before it has
734 * sent any packets with updated keys containing an acknowledgment for the
735 * packet that initiated the key update, it indicates that its peer has
736 * updated keys twice without awaiting confirmation. An endpoint MAY treat
737 * such consecutive key updates as a connection error of type
740 return ch
->handshake_confirmed
&& !ch
->rxku_pending_confirm
;
744 * Called when the QRX detects a new RX key update event.
748 DECISION_PROTOCOL_VIOLATION
,
749 DECISION_SOLICITED_TXKU
752 /* Called when the QRX detects a key update has occurred. */
754 static void rxku_detected(QUIC_PN pn
, void *arg
)
756 QUIC_CHANNEL
*ch
= arg
;
757 enum rxku_decision decision
;
761 * Note: rxku_in_progress is always 0 here as an RXKU cannot be detected
762 * when we are still in UPDATING or COOLDOWN (see quic_record_rx.h).
764 assert(!ch
->rxku_in_progress
);
766 if (!rxku_allowed(ch
))
767 /* Is RXKU even allowed at this time? */
768 decision
= DECISION_PROTOCOL_VIOLATION
;
770 else if (ch
->ku_locally_initiated
)
772 * If this key update was locally initiated (meaning that this detected
773 * RXKU event is a result of our own spontaneous TXKU), we do not
774 * trigger another TXKU; after all, to do so would result in an infinite
775 * ping-pong of key updates. We still process it as an RXKU.
777 decision
= DECISION_RXKU_ONLY
;
781 * Otherwise, a peer triggering a KU means we have to trigger a KU also.
783 decision
= DECISION_SOLICITED_TXKU
;
785 if (decision
== DECISION_PROTOCOL_VIOLATION
) {
786 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_KEY_UPDATE_ERROR
,
787 0, "RX key update again too soon");
791 pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
793 ch
->ku_locally_initiated
= 0;
794 ch
->rxku_in_progress
= 1;
795 ch
->rxku_pending_confirm
= 1;
796 ch
->rxku_trigger_pn
= pn
;
797 ch
->rxku_update_end_deadline
= ossl_time_add(get_time(ch
), pto
);
798 ch
->rxku_expected
= 0;
800 if (decision
== DECISION_SOLICITED_TXKU
)
801 /* NOT gated by usual txku_allowed() */
805 * Ordinarily, we only generate ACK when some ACK-eliciting frame has been
806 * received. In some cases, this may not occur for a long time, for example
807 * if transmission of application data is going in only one direction and
808 * nothing else is happening with the connection. However, since the peer
809 * cannot initiate a subsequent (spontaneous) TXKU until its prior
810 * (spontaneous or solicited) TXKU has completed - meaning that prior
811 * TXKU's trigger packet (or subsequent packet) has been acknowledged, this
812 * can lead to very long times before a TXKU is considered 'completed'.
813 * Optimise this by forcing ACK generation after triggering TXKU.
814 * (Basically, we consider a RXKU event something that is 'ACK-eliciting',
815 * which it more or less should be; it is necessarily separate from ordinary
816 * processing of ACK-eliciting frames as key update is not indicated via a
819 ossl_quic_tx_packetiser_schedule_ack(ch
->txp
, QUIC_PN_SPACE_APP
);
822 /* Called per tick to handle RXKU timer events. */
824 static void ch_rxku_tick(QUIC_CHANNEL
*ch
)
826 if (!ch
->rxku_in_progress
827 || ossl_time_compare(get_time(ch
), ch
->rxku_update_end_deadline
) < 0)
830 ch
->rxku_update_end_deadline
= ossl_time_infinite();
831 ch
->rxku_in_progress
= 0;
833 if (!ossl_qrx_key_update_timeout(ch
->qrx
, /*normal=*/1))
834 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
835 "RXKU cooldown internal error");
839 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK
*ack
, uint32_t pn_space
,
842 QUIC_CHANNEL
*ch
= arg
;
844 if (pn_space
!= QUIC_PN_SPACE_APP
|| !ch
->rxku_pending_confirm
845 || !ossl_quic_frame_ack_contains_pn(ack
, ch
->rxku_trigger_pn
))
849 * Defer clearing rxku_pending_confirm until TXP generate call returns
852 ch
->rxku_pending_confirm_done
= 1;
856 * QUIC Channel: Handshake Layer Event Handling
857 * ============================================
859 static int ch_on_crypto_send(const unsigned char *buf
, size_t buf_len
,
860 size_t *consumed
, void *arg
)
863 QUIC_CHANNEL
*ch
= arg
;
864 uint32_t enc_level
= ch
->tx_enc_level
;
865 uint32_t pn_space
= ossl_quic_enc_level_to_pn_space(enc_level
);
866 QUIC_SSTREAM
*sstream
= ch
->crypto_send
[pn_space
];
868 if (!ossl_assert(sstream
!= NULL
))
871 ret
= ossl_quic_sstream_append(sstream
, buf
, buf_len
, consumed
);
875 static int crypto_ensure_empty(QUIC_RSTREAM
*rstream
)
883 if (!ossl_quic_rstream_available(rstream
, &avail
, &is_fin
))
889 static int ch_on_crypto_recv_record(const unsigned char **buf
,
890 size_t *bytes_read
, void *arg
)
892 QUIC_CHANNEL
*ch
= arg
;
893 QUIC_RSTREAM
*rstream
;
894 int is_fin
= 0; /* crypto stream is never finished, so we don't use this */
898 * After we move to a later EL we must not allow our peer to send any new
899 * bytes in the crypto stream on a previous EL. Retransmissions of old bytes
902 * In practice we will only move to a new EL when we have consumed all bytes
903 * which should be sent on the crypto stream at a previous EL. For example,
904 * the Handshake EL should not be provisioned until we have completely
905 * consumed a TLS 1.3 ServerHello. Thus when we provision an EL the output
906 * of ossl_quic_rstream_available() should be 0 for all lower ELs. Thus if a
907 * given EL is available we simply ensure we have not received any further
908 * bytes at a lower EL.
910 for (i
= QUIC_ENC_LEVEL_INITIAL
; i
< ch
->rx_enc_level
; ++i
)
911 if (i
!= QUIC_ENC_LEVEL_0RTT
&&
912 !crypto_ensure_empty(ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(i
)])) {
913 /* Protocol violation (RFC 9001 s. 4.1.3) */
914 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
915 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
916 "crypto stream data in wrong EL");
920 rstream
= ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(ch
->rx_enc_level
)];
924 return ossl_quic_rstream_get_record(rstream
, buf
, bytes_read
,
928 static int ch_on_crypto_release_record(size_t bytes_read
, void *arg
)
930 QUIC_CHANNEL
*ch
= arg
;
931 QUIC_RSTREAM
*rstream
;
932 OSSL_RTT_INFO rtt_info
;
933 uint32_t rx_pn_space
= ossl_quic_enc_level_to_pn_space(ch
->rx_enc_level
);
935 rstream
= ch
->crypto_recv
[rx_pn_space
];
939 ossl_statm_get_rtt_info(ossl_quic_channel_get_statm(ch
), &rtt_info
);
940 if (!ossl_quic_rxfc_on_retire(&ch
->crypto_rxfc
[rx_pn_space
], bytes_read
,
941 rtt_info
.smoothed_rtt
))
944 return ossl_quic_rstream_release_record(rstream
, bytes_read
);
947 static int ch_on_handshake_yield_secret(uint32_t enc_level
, int direction
,
948 uint32_t suite_id
, EVP_MD
*md
,
949 const unsigned char *secret
,
953 QUIC_CHANNEL
*ch
= arg
;
956 if (enc_level
< QUIC_ENC_LEVEL_HANDSHAKE
|| enc_level
>= QUIC_ENC_LEVEL_NUM
)
963 if (enc_level
<= ch
->tx_enc_level
)
965 * Does not make sense for us to try and provision an EL we have already
970 if (!ossl_qtx_provide_secret(ch
->qtx
, enc_level
,
975 ch
->tx_enc_level
= enc_level
;
978 if (enc_level
<= ch
->rx_enc_level
)
980 * Does not make sense for us to try and provision an EL we have already
986 * Ensure all crypto streams for previous ELs are now empty of available
989 for (i
= QUIC_ENC_LEVEL_INITIAL
; i
< enc_level
; ++i
)
990 if (!crypto_ensure_empty(ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(i
)])) {
991 /* Protocol violation (RFC 9001 s. 4.1.3) */
992 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
993 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
994 "crypto stream data in wrong EL");
998 if (!ossl_qrx_provide_secret(ch
->qrx
, enc_level
,
1000 secret
, secret_len
))
1003 ch
->have_new_rx_secret
= 1;
1004 ch
->rx_enc_level
= enc_level
;
1010 static int ch_on_handshake_complete(void *arg
)
1012 QUIC_CHANNEL
*ch
= arg
;
1014 if (!ossl_assert(!ch
->handshake_complete
))
1015 return 0; /* this should not happen twice */
1017 if (!ossl_assert(ch
->tx_enc_level
== QUIC_ENC_LEVEL_1RTT
))
1020 if (!ch
->got_remote_transport_params
) {
1022 * Was not a valid QUIC handshake if we did not get valid transport
1025 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_CRYPTO_MISSING_EXT
,
1026 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
1027 "no transport parameters received");
1031 /* Don't need transport parameters anymore. */
1032 OPENSSL_free(ch
->local_transport_params
);
1033 ch
->local_transport_params
= NULL
;
1035 /* Tell the QRX it can now process 1-RTT packets. */
1036 ossl_qrx_allow_1rtt_processing(ch
->qrx
);
1038 /* Tell TXP the handshake is complete. */
1039 ossl_quic_tx_packetiser_notify_handshake_complete(ch
->txp
);
1041 ch
->handshake_complete
= 1;
1043 if (ch
->is_server
) {
1045 * On the server, the handshake is confirmed as soon as it is complete.
1047 ossl_quic_channel_on_handshake_confirmed(ch
);
1049 ossl_quic_tx_packetiser_schedule_handshake_done(ch
->txp
);
1052 ch_record_state_transition(ch
, ch
->state
);
1056 static int ch_on_handshake_alert(void *arg
, unsigned char alert_code
)
1058 QUIC_CHANNEL
*ch
= arg
;
1061 * RFC 9001 s. 4.4: More specifically, servers MUST NOT send post-handshake
1062 * TLS CertificateRequest messages, and clients MUST treat receipt of such
1063 * messages as a connection error of type PROTOCOL_VIOLATION.
1065 if (alert_code
== SSL_AD_UNEXPECTED_MESSAGE
1066 && ch
->handshake_complete
1067 && ossl_quic_tls_is_cert_request(ch
->qtls
))
1068 ossl_quic_channel_raise_protocol_error(ch
,
1069 QUIC_ERR_PROTOCOL_VIOLATION
,
1071 "Post-handshake TLS "
1072 "CertificateRequest received");
1074 * RFC 9001 s. 4.6.1: Servers MUST NOT send the early_data extension with a
1075 * max_early_data_size field set to any value other than 0xffffffff. A
1076 * client MUST treat receipt of a NewSessionTicket that contains an
1077 * early_data extension with any other value as a connection error of type
1078 * PROTOCOL_VIOLATION.
1080 else if (alert_code
== SSL_AD_ILLEGAL_PARAMETER
1081 && ch
->handshake_complete
1082 && ossl_quic_tls_has_bad_max_early_data(ch
->qtls
))
1083 ossl_quic_channel_raise_protocol_error(ch
,
1084 QUIC_ERR_PROTOCOL_VIOLATION
,
1086 "Bad max_early_data received");
1088 ossl_quic_channel_raise_protocol_error(ch
,
1089 QUIC_ERR_CRYPTO_ERR_BEGIN
1091 0, "handshake alert");
1097 * QUIC Channel: Transport Parameter Handling
1098 * ==========================================
1102 * Called by handshake layer when we receive QUIC Transport Parameters from the
1103 * peer. Note that these are not authenticated until the handshake is marked
1106 #define TP_REASON_SERVER_ONLY(x) \
1107 x " may not be sent by a client"
1108 #define TP_REASON_DUP(x) \
1109 x " appears multiple times"
1110 #define TP_REASON_MALFORMED(x) \
1112 #define TP_REASON_EXPECTED_VALUE(x) \
1113 x " does not match expected value"
1114 #define TP_REASON_NOT_RETRY(x) \
1115 x " sent when not performing a retry"
1116 #define TP_REASON_REQUIRED(x) \
1117 x " was not sent but is required"
1118 #define TP_REASON_INTERNAL_ERROR(x) \
1119 x " encountered internal error"
1121 static void txfc_bump_cwm_bidi(QUIC_STREAM
*s
, void *arg
)
1123 if (!ossl_quic_stream_is_bidi(s
)
1124 || ossl_quic_stream_is_server_init(s
))
1127 ossl_quic_txfc_bump_cwm(&s
->txfc
, *(uint64_t *)arg
);
1130 static void txfc_bump_cwm_uni(QUIC_STREAM
*s
, void *arg
)
1132 if (ossl_quic_stream_is_bidi(s
)
1133 || ossl_quic_stream_is_server_init(s
))
1136 ossl_quic_txfc_bump_cwm(&s
->txfc
, *(uint64_t *)arg
);
1139 static void do_update(QUIC_STREAM
*s
, void *arg
)
1141 QUIC_CHANNEL
*ch
= arg
;
1143 ossl_quic_stream_map_update_state(&ch
->qsm
, s
);
1146 static int ch_on_transport_params(const unsigned char *params
,
1150 QUIC_CHANNEL
*ch
= arg
;
1154 const unsigned char *body
;
1155 int got_orig_dcid
= 0;
1156 int got_initial_scid
= 0;
1157 int got_retry_scid
= 0;
1158 int got_initial_max_data
= 0;
1159 int got_initial_max_stream_data_bidi_local
= 0;
1160 int got_initial_max_stream_data_bidi_remote
= 0;
1161 int got_initial_max_stream_data_uni
= 0;
1162 int got_initial_max_streams_bidi
= 0;
1163 int got_initial_max_streams_uni
= 0;
1164 int got_stateless_reset_token
= 0;
1165 int got_preferred_addr
= 0;
1166 int got_ack_delay_exp
= 0;
1167 int got_max_ack_delay
= 0;
1168 int got_max_udp_payload_size
= 0;
1169 int got_max_idle_timeout
= 0;
1170 int got_active_conn_id_limit
= 0;
1171 int got_disable_active_migration
= 0;
1173 const char *reason
= "bad transport parameter";
1174 ossl_unused
uint64_t rx_max_idle_timeout
= 0;
1175 ossl_unused
const void *stateless_reset_token_p
= NULL
;
1176 QUIC_PREFERRED_ADDR pfa
;
1178 if (ch
->got_remote_transport_params
) {
1179 reason
= "multiple transport parameter extensions";
1183 if (!PACKET_buf_init(&pkt
, params
, params_len
)) {
1184 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
1185 "internal error (packet buf init)");
1189 while (PACKET_remaining(&pkt
) > 0) {
1190 if (!ossl_quic_wire_peek_transport_param(&pkt
, &id
))
1194 case QUIC_TPARAM_ORIG_DCID
:
1195 if (got_orig_dcid
) {
1196 reason
= TP_REASON_DUP("ORIG_DCID");
1200 if (ch
->is_server
) {
1201 reason
= TP_REASON_SERVER_ONLY("ORIG_DCID");
1205 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1206 reason
= TP_REASON_MALFORMED("ORIG_DCID");
1210 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1211 /* Must match our initial DCID. */
1212 if (!ossl_quic_conn_id_eq(&ch
->init_dcid
, &cid
)) {
1213 reason
= TP_REASON_EXPECTED_VALUE("ORIG_DCID");
1221 case QUIC_TPARAM_RETRY_SCID
:
1222 if (ch
->is_server
) {
1223 reason
= TP_REASON_SERVER_ONLY("RETRY_SCID");
1227 if (got_retry_scid
) {
1228 reason
= TP_REASON_DUP("RETRY_SCID");
1232 if (!ch
->doing_retry
) {
1233 reason
= TP_REASON_NOT_RETRY("RETRY_SCID");
1237 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1238 reason
= TP_REASON_MALFORMED("RETRY_SCID");
1242 /* Must match Retry packet SCID. */
1243 if (!ossl_quic_conn_id_eq(&ch
->retry_scid
, &cid
)) {
1244 reason
= TP_REASON_EXPECTED_VALUE("RETRY_SCID");
1251 case QUIC_TPARAM_INITIAL_SCID
:
1252 if (got_initial_scid
) {
1253 /* must not appear more than once */
1254 reason
= TP_REASON_DUP("INITIAL_SCID");
1258 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1259 reason
= TP_REASON_MALFORMED("INITIAL_SCID");
1263 /* Must match SCID of first Initial packet from server. */
1264 if (!ossl_quic_conn_id_eq(&ch
->init_scid
, &cid
)) {
1265 reason
= TP_REASON_EXPECTED_VALUE("INITIAL_SCID");
1269 got_initial_scid
= 1;
1272 case QUIC_TPARAM_INITIAL_MAX_DATA
:
1273 if (got_initial_max_data
) {
1274 /* must not appear more than once */
1275 reason
= TP_REASON_DUP("INITIAL_MAX_DATA");
1279 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1280 reason
= TP_REASON_MALFORMED("INITIAL_MAX_DATA");
1284 ossl_quic_txfc_bump_cwm(&ch
->conn_txfc
, v
);
1285 got_initial_max_data
= 1;
1288 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL
:
1289 if (got_initial_max_stream_data_bidi_local
) {
1290 /* must not appear more than once */
1291 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1295 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1296 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1301 * This is correct; the BIDI_LOCAL TP governs streams created by
1302 * the endpoint which sends the TP, i.e., our peer.
1304 ch
->rx_init_max_stream_data_bidi_remote
= v
;
1305 got_initial_max_stream_data_bidi_local
= 1;
1308 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE
:
1309 if (got_initial_max_stream_data_bidi_remote
) {
1310 /* must not appear more than once */
1311 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1315 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1316 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1321 * This is correct; the BIDI_REMOTE TP governs streams created
1322 * by the endpoint which receives the TP, i.e., us.
1324 ch
->rx_init_max_stream_data_bidi_local
= v
;
1326 /* Apply to all existing streams. */
1327 ossl_quic_stream_map_visit(&ch
->qsm
, txfc_bump_cwm_bidi
, &v
);
1328 got_initial_max_stream_data_bidi_remote
= 1;
1331 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI
:
1332 if (got_initial_max_stream_data_uni
) {
1333 /* must not appear more than once */
1334 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_UNI");
1338 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1339 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_UNI");
1343 ch
->rx_init_max_stream_data_uni
= v
;
1345 /* Apply to all existing streams. */
1346 ossl_quic_stream_map_visit(&ch
->qsm
, txfc_bump_cwm_uni
, &v
);
1347 got_initial_max_stream_data_uni
= 1;
1350 case QUIC_TPARAM_ACK_DELAY_EXP
:
1351 if (got_ack_delay_exp
) {
1352 /* must not appear more than once */
1353 reason
= TP_REASON_DUP("ACK_DELAY_EXP");
1357 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1358 || v
> QUIC_MAX_ACK_DELAY_EXP
) {
1359 reason
= TP_REASON_MALFORMED("ACK_DELAY_EXP");
1363 ch
->rx_ack_delay_exp
= (unsigned char)v
;
1364 got_ack_delay_exp
= 1;
1367 case QUIC_TPARAM_MAX_ACK_DELAY
:
1368 if (got_max_ack_delay
) {
1369 /* must not appear more than once */
1370 reason
= TP_REASON_DUP("MAX_ACK_DELAY");
1374 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1375 || v
>= (((uint64_t)1) << 14)) {
1376 reason
= TP_REASON_MALFORMED("MAX_ACK_DELAY");
1380 ch
->rx_max_ack_delay
= v
;
1381 ossl_ackm_set_rx_max_ack_delay(ch
->ackm
,
1382 ossl_ms2time(ch
->rx_max_ack_delay
));
1384 got_max_ack_delay
= 1;
1387 case QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI
:
1388 if (got_initial_max_streams_bidi
) {
1389 /* must not appear more than once */
1390 reason
= TP_REASON_DUP("INITIAL_MAX_STREAMS_BIDI");
1394 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1395 || v
> (((uint64_t)1) << 60)) {
1396 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_BIDI");
1400 assert(ch
->max_local_streams_bidi
== 0);
1401 ch
->max_local_streams_bidi
= v
;
1402 got_initial_max_streams_bidi
= 1;
1405 case QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI
:
1406 if (got_initial_max_streams_uni
) {
1407 /* must not appear more than once */
1408 reason
= TP_REASON_DUP("INITIAL_MAX_STREAMS_UNI");
1412 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1413 || v
> (((uint64_t)1) << 60)) {
1414 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_UNI");
1418 assert(ch
->max_local_streams_uni
== 0);
1419 ch
->max_local_streams_uni
= v
;
1420 got_initial_max_streams_uni
= 1;
1423 case QUIC_TPARAM_MAX_IDLE_TIMEOUT
:
1424 if (got_max_idle_timeout
) {
1425 /* must not appear more than once */
1426 reason
= TP_REASON_DUP("MAX_IDLE_TIMEOUT");
1430 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1431 reason
= TP_REASON_MALFORMED("MAX_IDLE_TIMEOUT");
1435 ch
->max_idle_timeout_remote_req
= v
;
1437 if (v
> 0 && v
< ch
->max_idle_timeout
)
1438 ch
->max_idle_timeout
= v
;
1441 got_max_idle_timeout
= 1;
1442 rx_max_idle_timeout
= v
;
1445 case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE
:
1446 if (got_max_udp_payload_size
) {
1447 /* must not appear more than once */
1448 reason
= TP_REASON_DUP("MAX_UDP_PAYLOAD_SIZE");
1452 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1453 || v
< QUIC_MIN_INITIAL_DGRAM_LEN
) {
1454 reason
= TP_REASON_MALFORMED("MAX_UDP_PAYLOAD_SIZE");
1458 ch
->rx_max_udp_payload_size
= v
;
1459 got_max_udp_payload_size
= 1;
1462 case QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT
:
1463 if (got_active_conn_id_limit
) {
1464 /* must not appear more than once */
1465 reason
= TP_REASON_DUP("ACTIVE_CONN_ID_LIMIT");
1469 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1470 || v
< QUIC_MIN_ACTIVE_CONN_ID_LIMIT
) {
1471 reason
= TP_REASON_MALFORMED("ACTIVE_CONN_ID_LIMIT");
1475 ch
->rx_active_conn_id_limit
= v
;
1476 got_active_conn_id_limit
= 1;
1479 case QUIC_TPARAM_STATELESS_RESET_TOKEN
:
1480 if (got_stateless_reset_token
) {
1481 reason
= TP_REASON_DUP("STATELESS_RESET_TOKEN");
1486 * We must ensure a client doesn't send them because we don't have
1487 * processing for them.
1489 * TODO(QUIC SERVER): remove this restriction
1491 if (ch
->is_server
) {
1492 reason
= TP_REASON_SERVER_ONLY("STATELESS_RESET_TOKEN");
1496 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
, &len
);
1497 if (body
== NULL
|| len
!= QUIC_STATELESS_RESET_TOKEN_LEN
) {
1498 reason
= TP_REASON_MALFORMED("STATELESS_RESET_TOKEN");
1501 if (!ossl_quic_srtm_add(ch
->srtm
, ch
, ch
->cur_remote_seq_num
,
1502 (const QUIC_STATELESS_RESET_TOKEN
*)body
)) {
1503 reason
= TP_REASON_INTERNAL_ERROR("STATELESS_RESET_TOKEN");
1507 stateless_reset_token_p
= body
;
1508 got_stateless_reset_token
= 1;
1511 case QUIC_TPARAM_PREFERRED_ADDR
:
1512 /* TODO(QUIC FUTURE): Handle preferred address. */
1513 if (got_preferred_addr
) {
1514 reason
= TP_REASON_DUP("PREFERRED_ADDR");
1519 * RFC 9000 s. 18.2: "A server that chooses a zero-length
1520 * connection ID MUST NOT provide a preferred address.
1521 * Similarly, a server MUST NOT include a zero-length connection
1522 * ID in this transport parameter. A client MUST treat a
1523 * violation of these requirements as a connection error of type
1524 * TRANSPORT_PARAMETER_ERROR."
1526 if (ch
->is_server
) {
1527 reason
= TP_REASON_SERVER_ONLY("PREFERRED_ADDR");
1531 if (ch
->cur_remote_dcid
.id_len
== 0) {
1532 reason
= "PREFERRED_ADDR provided for zero-length CID";
1536 if (!ossl_quic_wire_decode_transport_param_preferred_addr(&pkt
, &pfa
)) {
1537 reason
= TP_REASON_MALFORMED("PREFERRED_ADDR");
1541 if (pfa
.cid
.id_len
== 0) {
1542 reason
= "zero-length CID in PREFERRED_ADDR";
1546 got_preferred_addr
= 1;
1549 case QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION
:
1550 /* We do not currently handle migration, so nothing to do. */
1551 if (got_disable_active_migration
) {
1552 /* must not appear more than once */
1553 reason
= TP_REASON_DUP("DISABLE_ACTIVE_MIGRATION");
1557 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
, &len
);
1558 if (body
== NULL
|| len
> 0) {
1559 reason
= TP_REASON_MALFORMED("DISABLE_ACTIVE_MIGRATION");
1563 got_disable_active_migration
= 1;
1568 * Skip over and ignore.
1570 * RFC 9000 s. 7.4: We SHOULD treat duplicated transport parameters
1571 * as a connection error, but we are not required to. Currently,
1572 * handle this programmatically by checking for duplicates in the
1573 * parameters that we recognise, as above, but don't bother
1574 * maintaining a list of duplicates for anything we don't recognise.
1576 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
,
1585 if (!got_initial_scid
) {
1586 reason
= TP_REASON_REQUIRED("INITIAL_SCID");
1590 if (!ch
->is_server
) {
1591 if (!got_orig_dcid
) {
1592 reason
= TP_REASON_REQUIRED("ORIG_DCID");
1596 if (ch
->doing_retry
&& !got_retry_scid
) {
1597 reason
= TP_REASON_REQUIRED("RETRY_SCID");
1602 ch
->got_remote_transport_params
= 1;
1604 #ifndef OPENSSL_NO_QLOG
1605 QLOG_EVENT_BEGIN(ch_get_qlog(ch
), transport
, parameters_set
)
1606 QLOG_STR("owner", "remote");
1609 QLOG_CID("original_destination_connection_id",
1611 if (got_initial_scid
)
1612 QLOG_CID("original_source_connection_id",
1615 QLOG_CID("retry_source_connection_id",
1617 if (got_initial_max_data
)
1618 QLOG_U64("initial_max_data",
1619 ossl_quic_txfc_get_cwm(&ch
->conn_txfc
));
1620 if (got_initial_max_stream_data_bidi_local
)
1621 QLOG_U64("initial_max_stream_data_bidi_local",
1622 ch
->rx_init_max_stream_data_bidi_local
);
1623 if (got_initial_max_stream_data_bidi_remote
)
1624 QLOG_U64("initial_max_stream_data_bidi_remote",
1625 ch
->rx_init_max_stream_data_bidi_remote
);
1626 if (got_initial_max_stream_data_uni
)
1627 QLOG_U64("initial_max_stream_data_uni",
1628 ch
->rx_init_max_stream_data_uni
);
1629 if (got_initial_max_streams_bidi
)
1630 QLOG_U64("initial_max_streams_bidi",
1631 ch
->max_local_streams_bidi
);
1632 if (got_initial_max_streams_uni
)
1633 QLOG_U64("initial_max_streams_uni",
1634 ch
->max_local_streams_uni
);
1635 if (got_ack_delay_exp
)
1636 QLOG_U64("ack_delay_exponent", ch
->rx_ack_delay_exp
);
1637 if (got_max_ack_delay
)
1638 QLOG_U64("max_ack_delay", ch
->rx_max_ack_delay
);
1639 if (got_max_udp_payload_size
)
1640 QLOG_U64("max_udp_payload_size", ch
->rx_max_udp_payload_size
);
1641 if (got_max_idle_timeout
)
1642 QLOG_U64("max_idle_timeout", rx_max_idle_timeout
);
1643 if (got_active_conn_id_limit
)
1644 QLOG_U64("active_connection_id_limit", ch
->rx_active_conn_id_limit
);
1645 if (got_stateless_reset_token
)
1646 QLOG_BIN("stateless_reset_token", stateless_reset_token_p
,
1647 QUIC_STATELESS_RESET_TOKEN_LEN
);
1648 if (got_preferred_addr
) {
1649 QLOG_BEGIN("preferred_addr")
1650 QLOG_U64("port_v4", pfa
.ipv4_port
);
1651 QLOG_U64("port_v6", pfa
.ipv6_port
);
1652 QLOG_BIN("ip_v4", pfa
.ipv4
, sizeof(pfa
.ipv4
));
1653 QLOG_BIN("ip_v6", pfa
.ipv6
, sizeof(pfa
.ipv6
));
1654 QLOG_BIN("stateless_reset_token", pfa
.stateless_reset
.token
,
1655 sizeof(pfa
.stateless_reset
.token
));
1656 QLOG_CID("connection_id", &pfa
.cid
);
1659 QLOG_BOOL("disable_active_migration", got_disable_active_migration
);
1663 if (got_initial_max_data
|| got_initial_max_stream_data_bidi_remote
1664 || got_initial_max_streams_bidi
|| got_initial_max_streams_uni
)
1666 * If FC credit was bumped, we may now be able to send. Update all
1669 ossl_quic_stream_map_visit(&ch
->qsm
, do_update
, ch
);
1671 /* If we are a server, we now generate our own transport parameters. */
1672 if (ch
->is_server
&& !ch_generate_transport_params(ch
)) {
1673 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
1681 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_TRANSPORT_PARAMETER_ERROR
,
1687 * Called when we want to generate transport parameters. This is called
1688 * immediately at instantiation time for a client and after we receive the
1689 * client's transport parameters for a server.
1691 static int ch_generate_transport_params(QUIC_CHANNEL
*ch
)
1694 BUF_MEM
*buf_mem
= NULL
;
1699 if (ch
->local_transport_params
!= NULL
|| ch
->got_local_transport_params
)
1702 if ((buf_mem
= BUF_MEM_new()) == NULL
)
1705 if (!WPACKET_init(&wpkt
, buf_mem
))
1710 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt
, QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION
,
1714 if (ch
->is_server
) {
1715 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt
, QUIC_TPARAM_ORIG_DCID
,
1719 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt
, QUIC_TPARAM_INITIAL_SCID
,
1720 &ch
->cur_local_cid
))
1723 /* Client always uses an empty SCID. */
1724 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt
, QUIC_TPARAM_INITIAL_SCID
,
1729 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_IDLE_TIMEOUT
,
1730 ch
->max_idle_timeout_local_req
))
1733 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE
,
1734 QUIC_MIN_INITIAL_DGRAM_LEN
))
1737 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT
,
1738 QUIC_MIN_ACTIVE_CONN_ID_LIMIT
))
1741 if (ch
->tx_max_ack_delay
!= QUIC_DEFAULT_MAX_ACK_DELAY
1742 && !ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_ACK_DELAY
,
1743 ch
->tx_max_ack_delay
))
1746 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_DATA
,
1747 ossl_quic_rxfc_get_cwm(&ch
->conn_rxfc
)))
1750 /* Send the default CWM for a new RXFC. */
1751 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL
,
1752 ch
->tx_init_max_stream_data_bidi_local
))
1755 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE
,
1756 ch
->tx_init_max_stream_data_bidi_remote
))
1759 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI
,
1760 ch
->tx_init_max_stream_data_uni
))
1763 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI
,
1764 ossl_quic_rxfc_get_cwm(&ch
->max_streams_bidi_rxfc
)))
1767 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI
,
1768 ossl_quic_rxfc_get_cwm(&ch
->max_streams_uni_rxfc
)))
1771 if (!WPACKET_finish(&wpkt
))
1776 if (!WPACKET_get_total_written(&wpkt
, &buf_len
))
1779 ch
->local_transport_params
= (unsigned char *)buf_mem
->data
;
1780 buf_mem
->data
= NULL
;
1783 if (!ossl_quic_tls_set_transport_params(ch
->qtls
, ch
->local_transport_params
,
1787 #ifndef OPENSSL_NO_QLOG
1788 QLOG_EVENT_BEGIN(ch_get_qlog(ch
), transport
, parameters_set
)
1789 QLOG_STR("owner", "local");
1790 QLOG_BOOL("disable_active_migration", 1);
1791 if (ch
->is_server
) {
1792 QLOG_CID("original_destination_connection_id", &ch
->init_dcid
);
1793 QLOG_CID("initial_source_connection_id", &ch
->cur_local_cid
);
1795 QLOG_STR("initial_source_connection_id", "");
1797 QLOG_U64("max_idle_timeout", ch
->max_idle_timeout
);
1798 QLOG_U64("max_udp_payload_size", QUIC_MIN_INITIAL_DGRAM_LEN
);
1799 QLOG_U64("active_connection_id_limit", QUIC_MIN_ACTIVE_CONN_ID_LIMIT
);
1800 QLOG_U64("max_ack_delay", ch
->tx_max_ack_delay
);
1801 QLOG_U64("initial_max_data", ossl_quic_rxfc_get_cwm(&ch
->conn_rxfc
));
1802 QLOG_U64("initial_max_stream_data_bidi_local",
1803 ch
->tx_init_max_stream_data_bidi_local
);
1804 QLOG_U64("initial_max_stream_data_bidi_remote",
1805 ch
->tx_init_max_stream_data_bidi_remote
);
1806 QLOG_U64("initial_max_stream_data_uni",
1807 ch
->tx_init_max_stream_data_uni
);
1808 QLOG_U64("initial_max_streams_bidi",
1809 ossl_quic_rxfc_get_cwm(&ch
->max_streams_bidi_rxfc
));
1810 QLOG_U64("initial_max_streams_uni",
1811 ossl_quic_rxfc_get_cwm(&ch
->max_streams_uni_rxfc
));
1815 ch
->got_local_transport_params
= 1;
1820 WPACKET_cleanup(&wpkt
);
1821 BUF_MEM_free(buf_mem
);
1826 * QUIC Channel: Ticker-Mutator
1827 * ============================
1831 * The central ticker function called by the reactor. This does everything, or
1832 * at least everything network I/O related. Best effort - not allowed to fail
1835 void ossl_quic_channel_subtick(QUIC_CHANNEL
*ch
, QUIC_TICK_RESULT
*res
,
1838 OSSL_TIME now
, deadline
;
1839 int channel_only
= (flags
& QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY
) != 0;
1842 * When we tick the QUIC connection, we do everything we need to do
1843 * periodically. Network I/O handling will already have been performed
1844 * as necessary by the QUIC port. Thus, in order, we:
1846 * - handle any packets the DEMUX has queued up for us;
1847 * - handle any timer events which are due to fire (ACKM, etc.);
1848 * - generate any packets which need to be sent;
1849 * - determine the time at which we should next be ticked.
1852 /* If we are in the TERMINATED state, there is nothing to do. */
1853 if (ossl_quic_channel_is_terminated(ch
)) {
1854 res
->net_read_desired
= 0;
1855 res
->net_write_desired
= 0;
1856 res
->tick_deadline
= ossl_time_infinite();
1861 * If we are in the TERMINATING state, check if the terminating timer has
1864 if (ossl_quic_channel_is_terminating(ch
)) {
1867 if (ossl_time_compare(now
, ch
->terminate_deadline
) >= 0) {
1868 ch_on_terminating_timeout(ch
);
1869 res
->net_read_desired
= 0;
1870 res
->net_write_desired
= 0;
1871 res
->tick_deadline
= ossl_time_infinite();
1872 return; /* abort normal processing, nothing to do */
1876 if (!ch
->port
->engine
->inhibit_tick
) {
1877 /* Handle RXKU timeouts. */
1881 /* Process queued incoming packets. */
1882 ch
->did_tls_tick
= 0;
1883 ch
->have_new_rx_secret
= 0;
1884 ch_rx(ch
, channel_only
);
1887 * Allow the handshake layer to check for any new incoming data and
1888 * generate new outgoing data.
1890 if (!ch
->did_tls_tick
)
1891 ch_tick_tls(ch
, channel_only
);
1894 * If the handshake layer gave us a new secret, we need to do RX
1895 * again because packets that were not previously processable and
1896 * were deferred might now be processable.
1898 * TODO(QUIC FUTURE): Consider handling this in the yield_secret callback.
1900 } while (ch
->have_new_rx_secret
);
1904 * Handle any timer events which are due to fire; namely, the loss
1905 * detection deadline and the idle timeout.
1907 * ACKM ACK generation deadline is polled by TXP, so we don't need to
1911 if (ossl_time_compare(now
, ch
->idle_deadline
) >= 0) {
1913 * Idle timeout differs from normal protocol violation because we do
1914 * not send a CONN_CLOSE frame; go straight to TERMINATED.
1916 if (!ch
->port
->engine
->inhibit_tick
)
1917 ch_on_idle_timeout(ch
);
1919 res
->net_read_desired
= 0;
1920 res
->net_write_desired
= 0;
1921 res
->tick_deadline
= ossl_time_infinite();
1925 if (!ch
->port
->engine
->inhibit_tick
) {
1926 deadline
= ossl_ackm_get_loss_detection_deadline(ch
->ackm
);
1927 if (!ossl_time_is_zero(deadline
)
1928 && ossl_time_compare(now
, deadline
) >= 0)
1929 ossl_ackm_on_timeout(ch
->ackm
);
1931 /* If a ping is due, inform TXP. */
1932 if (ossl_time_compare(now
, ch
->ping_deadline
) >= 0) {
1933 int pn_space
= ossl_quic_enc_level_to_pn_space(ch
->tx_enc_level
);
1935 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch
->txp
, pn_space
);
1938 * If we have no CC budget at this time we cannot process the above
1939 * PING request immediately. In any case we have scheduled the
1940 * request so bump the ping deadline. If we don't do this we will
1941 * busy-loop endlessly as the above deadline comparison condition
1942 * will still be met.
1944 ch_update_ping_deadline(ch
);
1947 /* Queue any data to be sent for transmission. */
1951 ossl_quic_stream_map_gc(&ch
->qsm
);
1954 /* Determine the time at which we should next be ticked. */
1955 res
->tick_deadline
= ch_determine_next_tick_deadline(ch
);
1958 * Always process network input unless we are now terminated. Although we
1959 * had not terminated at the beginning of this tick, network errors in
1960 * ch_tx() may have caused us to transition to the Terminated state.
1962 res
->net_read_desired
= !ossl_quic_channel_is_terminated(ch
);
1964 /* We want to write to the network if we have any data in our TX queue. */
1965 res
->net_write_desired
1966 = (!ossl_quic_channel_is_terminated(ch
)
1967 && ossl_qtx_get_queue_len_datagrams(ch
->qtx
) > 0);
1970 static int ch_tick_tls(QUIC_CHANNEL
*ch
, int channel_only
)
1972 uint64_t error_code
;
1973 const char *error_msg
;
1974 ERR_STATE
*error_state
= NULL
;
1979 ch
->did_tls_tick
= 1;
1980 ossl_quic_tls_tick(ch
->qtls
);
1982 if (ossl_quic_tls_get_error(ch
->qtls
, &error_code
, &error_msg
,
1984 ossl_quic_channel_raise_protocol_error_state(ch
, error_code
, 0,
1985 error_msg
, error_state
);
1992 /* Check incoming forged packet limit and terminate connection if needed. */
1993 static void ch_rx_check_forged_pkt_limit(QUIC_CHANNEL
*ch
)
1996 uint64_t limit
= UINT64_MAX
, l
;
1998 for (enc_level
= QUIC_ENC_LEVEL_INITIAL
;
1999 enc_level
< QUIC_ENC_LEVEL_NUM
;
2003 * Different ELs can have different AEADs which can in turn impose
2004 * different limits, so use the lowest value of any currently valid EL.
2006 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
2009 if (enc_level
> ch
->rx_enc_level
)
2012 l
= ossl_qrx_get_max_forged_pkt_count(ch
->qrx
, enc_level
);
2017 if (ossl_qrx_get_cur_forged_pkt_count(ch
->qrx
) < limit
)
2020 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_AEAD_LIMIT_REACHED
, 0,
2024 /* Process queued incoming packets and handle frames, if any. */
2025 static int ch_rx(QUIC_CHANNEL
*ch
, int channel_only
)
2027 int handled_any
= 0;
2028 const int closing
= ossl_quic_channel_is_closing(ch
);
2030 if (!ch
->is_server
&& !ch
->have_sent_any_pkt
)
2032 * We have not sent anything yet, therefore there is no need to check
2033 * for incoming data.
2038 assert(ch
->qrx_pkt
== NULL
);
2040 if (!ossl_qrx_read_pkt(ch
->qrx
, &ch
->qrx_pkt
))
2043 /* Track the amount of data received while in the closing state */
2045 ossl_quic_tx_packetiser_record_received_closing_bytes(
2046 ch
->txp
, ch
->qrx_pkt
->hdr
->len
);
2050 ch_update_ping_deadline(ch
);
2053 ch_rx_handle_packet(ch
, channel_only
); /* best effort */
2056 * Regardless of the outcome of frame handling, unref the packet.
2057 * This will free the packet unless something added another
2058 * reference to it during frame processing.
2060 ossl_qrx_pkt_release(ch
->qrx_pkt
);
2063 ch
->have_sent_ack_eliciting_since_rx
= 0;
2067 ch_rx_check_forged_pkt_limit(ch
);
2070 * When in TERMINATING - CLOSING, generate a CONN_CLOSE frame whenever we
2071 * process one or more incoming packets.
2073 if (handled_any
&& closing
)
2074 ch
->conn_close_queued
= 1;
2079 static int bio_addr_eq(const BIO_ADDR
*a
, const BIO_ADDR
*b
)
2081 if (BIO_ADDR_family(a
) != BIO_ADDR_family(b
))
2084 switch (BIO_ADDR_family(a
)) {
2086 return !memcmp(&a
->s_in
.sin_addr
,
2088 sizeof(a
->s_in
.sin_addr
))
2089 && a
->s_in
.sin_port
== b
->s_in
.sin_port
;
2090 #if OPENSSL_USE_IPV6
2092 return !memcmp(&a
->s_in6
.sin6_addr
,
2093 &b
->s_in6
.sin6_addr
,
2094 sizeof(a
->s_in6
.sin6_addr
))
2095 && a
->s_in6
.sin6_port
== b
->s_in6
.sin6_port
;
2098 return 0; /* not supported */
2104 /* Handles the packet currently in ch->qrx_pkt->hdr. */
2105 static void ch_rx_handle_packet(QUIC_CHANNEL
*ch
, int channel_only
)
2108 int old_have_processed_any_pkt
= ch
->have_processed_any_pkt
;
2109 OSSL_QTX_IOVEC iovec
;
2111 assert(ch
->qrx_pkt
!= NULL
);
2114 * RFC 9000 s. 10.2.1 Closing Connection State:
2115 * An endpoint that is closing is not required to process any
2118 if (!ossl_quic_channel_is_active(ch
))
2121 if (ossl_quic_pkt_type_is_encrypted(ch
->qrx_pkt
->hdr
->type
)) {
2122 if (!ch
->have_received_enc_pkt
) {
2123 ch
->cur_remote_dcid
= ch
->init_scid
= ch
->qrx_pkt
->hdr
->src_conn_id
;
2124 ch
->have_received_enc_pkt
= 1;
2127 * We change to using the SCID in the first Initial packet as the
2130 ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->init_scid
);
2133 enc_level
= ossl_quic_pkt_type_to_enc_level(ch
->qrx_pkt
->hdr
->type
);
2134 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
2135 /* Do not process packets from ELs we have already discarded. */
2140 * RFC 9000 s. 9.6: "If a client receives packets from a new server address
2141 * when the client has not initiated a migration to that address, the client
2142 * SHOULD discard these packets."
2144 * We need to be a bit careful here as due to the BIO abstraction layer an
2145 * application is liable to be weird and lie to us about peer addresses.
2146 * Only apply this check if we actually are using a real AF_INET or AF_INET6
2150 && ch
->qrx_pkt
->peer
!= NULL
2152 BIO_ADDR_family(&ch
->cur_peer_addr
) == AF_INET
2153 #if OPENSSL_USE_IPV6
2154 || BIO_ADDR_family(&ch
->cur_peer_addr
) == AF_INET6
2157 && !bio_addr_eq(ch
->qrx_pkt
->peer
, &ch
->cur_peer_addr
))
2161 && ch
->have_received_enc_pkt
2162 && ossl_quic_pkt_type_has_scid(ch
->qrx_pkt
->hdr
->type
)) {
2164 * RFC 9000 s. 7.2: "Once a client has received a valid Initial packet
2165 * from the server, it MUST discard any subsequent packet it receives on
2166 * that connection with a different SCID."
2168 if (!ossl_quic_conn_id_eq(&ch
->qrx_pkt
->hdr
->src_conn_id
,
2173 if (ossl_quic_pkt_type_has_version(ch
->qrx_pkt
->hdr
->type
)
2174 && ch
->qrx_pkt
->hdr
->version
!= QUIC_VERSION_1
)
2176 * RFC 9000 s. 5.2.1: If a client receives a packet that uses a
2177 * different version than it initially selected, it MUST discard the
2178 * packet. We only ever use v1, so require it.
2182 ch
->have_processed_any_pkt
= 1;
2185 * RFC 9000 s. 17.2: "An endpoint MUST treat receipt of a packet that has a
2186 * non-zero value for [the reserved bits] after removing both packet and
2187 * header protection as a connection error of type PROTOCOL_VIOLATION."
2189 if (ossl_quic_pkt_type_is_encrypted(ch
->qrx_pkt
->hdr
->type
)
2190 && ch
->qrx_pkt
->hdr
->reserved
!= 0) {
2191 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
2192 0, "packet header reserved bits");
2196 iovec
.buf
= ch
->qrx_pkt
->hdr
->data
;
2197 iovec
.buf_len
= ch
->qrx_pkt
->hdr
->len
;
2198 ossl_qlog_event_transport_packet_received(ch_get_qlog(ch
), ch
->qrx_pkt
->hdr
,
2199 ch
->qrx_pkt
->pn
, &iovec
, 1,
2200 ch
->qrx_pkt
->datagram_id
);
2202 /* Handle incoming packet. */
2203 switch (ch
->qrx_pkt
->hdr
->type
) {
2204 case QUIC_PKT_TYPE_RETRY
:
2205 if (ch
->doing_retry
|| ch
->is_server
)
2207 * It is not allowed to ask a client to do a retry more than
2208 * once. Clients may not send retries.
2213 * RFC 9000 s 17.2.5.2: After the client has received and processed an
2214 * Initial or Retry packet from the server, it MUST discard any
2215 * subsequent Retry packets that it receives.
2217 if (ch
->have_received_enc_pkt
)
2220 if (ch
->qrx_pkt
->hdr
->len
<= QUIC_RETRY_INTEGRITY_TAG_LEN
)
2221 /* Packets with zero-length Retry Tokens are invalid. */
2225 * TODO(QUIC FUTURE): Theoretically this should probably be in the QRX.
2226 * However because validation is dependent on context (namely the
2227 * client's initial DCID) we can't do this cleanly. In the future we
2228 * should probably add a callback to the QRX to let it call us (via
2229 * the DEMUX) and ask us about the correct original DCID, rather
2230 * than allow the QRX to emit a potentially malformed packet to the
2231 * upper layers. However, special casing this will do for now.
2233 if (!ossl_quic_validate_retry_integrity_tag(ch
->port
->engine
->libctx
,
2234 ch
->port
->engine
->propq
,
2237 /* Malformed retry packet, ignore. */
2240 if (!ch_retry(ch
, ch
->qrx_pkt
->hdr
->data
,
2241 ch
->qrx_pkt
->hdr
->len
- QUIC_RETRY_INTEGRITY_TAG_LEN
,
2242 &ch
->qrx_pkt
->hdr
->src_conn_id
))
2243 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
,
2244 0, "handling retry packet");
2247 case QUIC_PKT_TYPE_0RTT
:
2249 /* Clients should never receive 0-RTT packets. */
2253 * TODO(QUIC 0RTT): Implement 0-RTT on the server side. We currently
2254 * do not need to implement this as a client can only do 0-RTT if we
2255 * have given it permission to in a previous session.
2259 case QUIC_PKT_TYPE_INITIAL
:
2260 case QUIC_PKT_TYPE_HANDSHAKE
:
2261 case QUIC_PKT_TYPE_1RTT
:
2262 if (ch
->is_server
&& ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_HANDSHAKE
)
2264 * We automatically drop INITIAL EL keys when first successfully
2265 * decrypting a HANDSHAKE packet, as per the RFC.
2267 ch_discard_el(ch
, QUIC_ENC_LEVEL_INITIAL
);
2269 if (ch
->rxku_in_progress
2270 && ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_1RTT
2271 && ch
->qrx_pkt
->pn
>= ch
->rxku_trigger_pn
2272 && ch
->qrx_pkt
->key_epoch
< ossl_qrx_get_key_epoch(ch
->qrx
)) {
2274 * RFC 9001 s. 6.4: Packets with higher packet numbers MUST be
2275 * protected with either the same or newer packet protection keys
2276 * than packets with lower packet numbers. An endpoint that
2277 * successfully removes protection with old keys when newer keys
2278 * were used for packets with lower packet numbers MUST treat this
2279 * as a connection error of type KEY_UPDATE_ERROR.
2281 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_KEY_UPDATE_ERROR
,
2282 0, "new packet with old keys");
2287 && ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_INITIAL
2288 && ch
->qrx_pkt
->hdr
->token_len
> 0) {
2290 * RFC 9000 s. 17.2.2: Clients that receive an Initial packet with a
2291 * non-zero Token Length field MUST either discard the packet or
2292 * generate a connection error of type PROTOCOL_VIOLATION.
2294 * TODO(QUIC FUTURE): consider the implications of RFC 9000 s. 10.2.3
2295 * Immediate Close during the Handshake:
2296 * However, at the cost of reducing feedback about
2297 * errors for legitimate peers, some forms of denial of
2298 * service can be made more difficult for an attacker
2299 * if endpoints discard illegal packets rather than
2300 * terminating a connection with CONNECTION_CLOSE. For
2301 * this reason, endpoints MAY discard packets rather
2302 * than immediately close if errors are detected in
2303 * packets that lack authentication.
2304 * I.e. should we drop this packet instead of closing the connection?
2306 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
2307 0, "client received initial token");
2311 /* This packet contains frames, pass to the RXDP. */
2312 ossl_quic_handle_frames(ch
, ch
->qrx_pkt
); /* best effort */
2314 if (ch
->did_crypto_frame
)
2315 ch_tick_tls(ch
, channel_only
);
2319 case QUIC_PKT_TYPE_VERSION_NEG
:
2321 * "A client MUST discard any Version Negotiation packet if it has
2322 * received and successfully processed any other packet."
2324 if (!old_have_processed_any_pkt
)
2325 ch_rx_handle_version_neg(ch
, ch
->qrx_pkt
);
2335 static void ch_rx_handle_version_neg(QUIC_CHANNEL
*ch
, OSSL_QRX_PKT
*pkt
)
2338 * We do not support version negotiation at this time. As per RFC 9000 s.
2339 * 6.2., we MUST abandon the connection attempt if we receive a Version
2340 * Negotiation packet, unless we have already successfully processed another
2341 * incoming packet, or the packet lists the QUIC version we want to use.
2346 if (!PACKET_buf_init(&vpkt
, pkt
->hdr
->data
, pkt
->hdr
->len
))
2349 while (PACKET_remaining(&vpkt
) > 0) {
2350 if (!PACKET_get_net_4(&vpkt
, &v
))
2353 if ((uint32_t)v
== QUIC_VERSION_1
)
2357 /* No match, this is a failure case. */
2358 ch_raise_version_neg_failure(ch
);
2361 static void ch_raise_version_neg_failure(QUIC_CHANNEL
*ch
)
2363 QUIC_TERMINATE_CAUSE tcause
= {0};
2365 tcause
.error_code
= QUIC_ERR_CONNECTION_REFUSED
;
2366 tcause
.reason
= "version negotiation failure";
2367 tcause
.reason_len
= strlen(tcause
.reason
);
2370 * Skip TERMINATING state; this is not considered a protocol error and we do
2371 * not send CONNECTION_CLOSE.
2373 ch_start_terminating(ch
, &tcause
, 1);
2376 /* Try to generate packets and if possible, flush them to the network. */
2377 static int ch_tx(QUIC_CHANNEL
*ch
)
2379 QUIC_TXP_STATUS status
;
2383 * RFC 9000 s. 10.2.2: Draining Connection State:
2384 * While otherwise identical to the closing state, an endpoint
2385 * in the draining state MUST NOT send any packets.
2387 * An endpoint MUST NOT send further packets.
2389 if (ossl_quic_channel_is_draining(ch
))
2392 if (ossl_quic_channel_is_closing(ch
)) {
2394 * While closing, only send CONN_CLOSE if we've received more traffic
2395 * from the peer. Once we tell the TXP to generate CONN_CLOSE, all
2396 * future calls to it generate CONN_CLOSE frames, so otherwise we would
2397 * just constantly generate CONN_CLOSE frames.
2399 * Confirming to RFC 9000 s. 10.2.1 Closing Connection State:
2400 * An endpoint SHOULD limit the rate at which it generates
2401 * packets in the closing state.
2403 if (!ch
->conn_close_queued
)
2406 ch
->conn_close_queued
= 0;
2409 /* Do TXKU if we need to. */
2410 ch_maybe_trigger_spontaneous_txku(ch
);
2412 ch
->rxku_pending_confirm_done
= 0;
2414 /* Loop until we stop generating packets to send */
2417 * Send packet, if we need to. Best effort. The TXP consults the CC and
2418 * applies any limitations imposed by it, so we don't need to do it here.
2420 * Best effort. In particular if TXP fails for some reason we should
2421 * still flush any queued packets which we already generated.
2423 res
= ossl_quic_tx_packetiser_generate(ch
->txp
, &status
);
2424 if (status
.sent_pkt
> 0) {
2425 ch
->have_sent_any_pkt
= 1; /* Packet(s) were sent */
2426 ch
->port
->have_sent_any_pkt
= 1;
2429 * RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when
2430 * sending an ack-eliciting packet if no other ack-eliciting packets
2431 * have been sent since last receiving and processing a packet.'
2433 if (status
.sent_ack_eliciting
2434 && !ch
->have_sent_ack_eliciting_since_rx
) {
2436 ch
->have_sent_ack_eliciting_since_rx
= 1;
2439 if (!ch
->is_server
&& status
.sent_handshake
)
2441 * RFC 9001 s. 4.9.1: A client MUST discard Initial keys when it
2442 * first sends a Handshake packet.
2444 ch_discard_el(ch
, QUIC_ENC_LEVEL_INITIAL
);
2446 if (ch
->rxku_pending_confirm_done
)
2447 ch
->rxku_pending_confirm
= 0;
2449 ch_update_ping_deadline(ch
);
2454 * One case where TXP can fail is if we reach a TX PN of 2**62 - 1.
2455 * As per RFC 9000 s. 12.3, if this happens we MUST close the
2456 * connection without sending a CONNECTION_CLOSE frame. This is
2457 * actually handled as an emergent consequence of our design, as the
2458 * TX packetiser will never transmit another packet when the TX PN
2459 * reaches the limit.
2461 * Calling the below function terminates the connection; its attempt
2462 * to schedule a CONNECTION_CLOSE frame will not actually cause a
2463 * packet to be transmitted for this reason.
2465 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
,
2467 "internal error (txp generate)");
2470 } while (status
.sent_pkt
> 0);
2472 /* Flush packets to network. */
2473 switch (ossl_qtx_flush_net(ch
->qtx
)) {
2474 case QTX_FLUSH_NET_RES_OK
:
2475 case QTX_FLUSH_NET_RES_TRANSIENT_FAIL
:
2476 /* Best effort, done for now. */
2479 case QTX_FLUSH_NET_RES_PERMANENT_FAIL
:
2481 /* Permanent underlying network BIO, start terminating. */
2482 ossl_quic_port_raise_net_error(ch
->port
, ch
);
2489 /* Determine next tick deadline. */
2490 static OSSL_TIME
ch_determine_next_tick_deadline(QUIC_CHANNEL
*ch
)
2495 if (ossl_quic_channel_is_terminated(ch
))
2496 return ossl_time_infinite();
2498 deadline
= ossl_ackm_get_loss_detection_deadline(ch
->ackm
);
2499 if (ossl_time_is_zero(deadline
))
2500 deadline
= ossl_time_infinite();
2503 * Check the ack deadline for all enc_levels that are actually provisioned.
2504 * ACKs aren't restricted by CC.
2506 for (i
= 0; i
< QUIC_ENC_LEVEL_NUM
; i
++) {
2507 if (ossl_qtx_is_enc_level_provisioned(ch
->qtx
, i
)) {
2508 deadline
= ossl_time_min(deadline
,
2509 ossl_ackm_get_ack_deadline(ch
->ackm
,
2510 ossl_quic_enc_level_to_pn_space(i
)));
2515 * When do we need to send an ACK-eliciting packet to reset the idle
2516 * deadline timer for the peer?
2518 if (!ossl_time_is_infinite(ch
->ping_deadline
))
2519 deadline
= ossl_time_min(deadline
, ch
->ping_deadline
);
2521 /* Apply TXP wakeup deadline. */
2522 deadline
= ossl_time_min(deadline
,
2523 ossl_quic_tx_packetiser_get_deadline(ch
->txp
));
2525 /* Is the terminating timer armed? */
2526 if (ossl_quic_channel_is_terminating(ch
))
2527 deadline
= ossl_time_min(deadline
,
2528 ch
->terminate_deadline
);
2529 else if (!ossl_time_is_infinite(ch
->idle_deadline
))
2530 deadline
= ossl_time_min(deadline
,
2533 /* When does the RXKU process complete? */
2534 if (ch
->rxku_in_progress
)
2535 deadline
= ossl_time_min(deadline
, ch
->rxku_update_end_deadline
);
2541 * QUIC Channel: Lifecycle Events
2542 * ==============================
2546 * Record a state transition. This is not necessarily a change to ch->state but
2547 * also includes the handshake becoming complete or confirmed, etc.
2549 static void ch_record_state_transition(QUIC_CHANNEL
*ch
, uint32_t new_state
)
2551 uint32_t old_state
= ch
->state
;
2553 ch
->state
= new_state
;
2555 ossl_qlog_event_connectivity_connection_state_updated(ch_get_qlog(ch
),
2558 ch
->handshake_complete
,
2559 ch
->handshake_confirmed
);
2562 int ossl_quic_channel_start(QUIC_CHANNEL
*ch
)
2566 * This is not used by the server. The server moves to active
2567 * automatically on receiving an incoming connection.
2571 if (ch
->state
!= QUIC_CHANNEL_STATE_IDLE
)
2572 /* Calls to connect are idempotent */
2575 /* Inform QTX of peer address. */
2576 if (!ossl_quic_tx_packetiser_set_peer(ch
->txp
, &ch
->cur_peer_addr
))
2579 /* Plug in secrets for the Initial EL. */
2580 if (!ossl_quic_provide_initial_secret(ch
->port
->engine
->libctx
,
2581 ch
->port
->engine
->propq
,
2588 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_ACTIVE
);
2589 ch
->doing_proactive_ver_neg
= 0; /* not currently supported */
2591 ossl_qlog_event_connectivity_connection_started(ch_get_qlog(ch
),
2594 /* Handshake layer: start (e.g. send CH). */
2595 if (!ch_tick_tls(ch
, /*channel_only=*/0))
2598 ossl_quic_reactor_tick(ossl_quic_port_get0_reactor(ch
->port
), 0); /* best effort */
2602 /* Start a locally initiated connection shutdown. */
2603 void ossl_quic_channel_local_close(QUIC_CHANNEL
*ch
, uint64_t app_error_code
,
2604 const char *app_reason
)
2606 QUIC_TERMINATE_CAUSE tcause
= {0};
2608 if (ossl_quic_channel_is_term_any(ch
))
2612 tcause
.error_code
= app_error_code
;
2613 tcause
.reason
= app_reason
;
2614 tcause
.reason_len
= app_reason
!= NULL
? strlen(app_reason
) : 0;
2615 ch_start_terminating(ch
, &tcause
, 0);
2618 static void free_token(const unsigned char *buf
, size_t buf_len
, void *arg
)
2620 OPENSSL_free((unsigned char *)buf
);
2623 /* Called when a server asks us to do a retry. */
2624 static int ch_retry(QUIC_CHANNEL
*ch
,
2625 const unsigned char *retry_token
,
2626 size_t retry_token_len
,
2627 const QUIC_CONN_ID
*retry_scid
)
2632 * RFC 9000 s. 17.2.5.1: "A client MUST discard a Retry packet that contains
2633 * a SCID field that is identical to the DCID field of its initial packet."
2635 if (ossl_quic_conn_id_eq(&ch
->init_dcid
, retry_scid
))
2638 /* We change to using the SCID in the Retry packet as the DCID. */
2639 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, retry_scid
))
2643 * Now we retry. We will release the Retry packet immediately, so copy
2646 if ((buf
= OPENSSL_memdup(retry_token
, retry_token_len
)) == NULL
)
2649 if (!ossl_quic_tx_packetiser_set_initial_token(ch
->txp
, buf
,
2651 free_token
, NULL
)) {
2653 * This may fail if the token we receive is too big for us to ever be
2654 * able to transmit in an outgoing Initial packet.
2656 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INVALID_TOKEN
, 0,
2657 "received oversize token");
2662 ch
->retry_scid
= *retry_scid
;
2663 ch
->doing_retry
= 1;
2666 * We need to stimulate the Initial EL to generate the first CRYPTO frame
2667 * again. We can do this most cleanly by simply forcing the ACKM to consider
2668 * the first Initial packet as lost, which it effectively was as the server
2669 * hasn't processed it. This also maintains the desired behaviour with e.g.
2670 * PNs not resetting and so on.
2672 * The PN we used initially is always zero, because QUIC does not allow
2675 if (!ossl_ackm_mark_packet_pseudo_lost(ch
->ackm
, QUIC_PN_SPACE_INITIAL
,
2680 * Plug in new secrets for the Initial EL. This is the only time we change
2681 * the secrets for an EL after we already provisioned it.
2683 if (!ossl_quic_provide_initial_secret(ch
->port
->engine
->libctx
,
2684 ch
->port
->engine
->propq
,
2693 /* Called when an EL is to be discarded. */
2694 static int ch_discard_el(QUIC_CHANNEL
*ch
,
2697 if (!ossl_assert(enc_level
< QUIC_ENC_LEVEL_1RTT
))
2700 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
2704 /* Best effort for all of these. */
2705 ossl_quic_tx_packetiser_discard_enc_level(ch
->txp
, enc_level
);
2706 ossl_qrx_discard_enc_level(ch
->qrx
, enc_level
);
2707 ossl_qtx_discard_enc_level(ch
->qtx
, enc_level
);
2709 if (enc_level
!= QUIC_ENC_LEVEL_0RTT
) {
2710 uint32_t pn_space
= ossl_quic_enc_level_to_pn_space(enc_level
);
2712 ossl_ackm_on_pkt_space_discarded(ch
->ackm
, pn_space
);
2714 /* We should still have crypto streams at this point. */
2715 if (!ossl_assert(ch
->crypto_send
[pn_space
] != NULL
)
2716 || !ossl_assert(ch
->crypto_recv
[pn_space
] != NULL
))
2719 /* Get rid of the crypto stream state for the EL. */
2720 ossl_quic_sstream_free(ch
->crypto_send
[pn_space
]);
2721 ch
->crypto_send
[pn_space
] = NULL
;
2723 ossl_quic_rstream_free(ch
->crypto_recv
[pn_space
]);
2724 ch
->crypto_recv
[pn_space
] = NULL
;
2727 ch
->el_discarded
|= (1U << enc_level
);
2731 /* Intended to be called by the RXDP. */
2732 int ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL
*ch
)
2734 if (ch
->handshake_confirmed
)
2737 if (!ch
->handshake_complete
) {
2739 * Does not make sense for handshake to be confirmed before it is
2742 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
2743 OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE
,
2744 "handshake cannot be confirmed "
2745 "before it is completed");
2749 ch_discard_el(ch
, QUIC_ENC_LEVEL_HANDSHAKE
);
2750 ch
->handshake_confirmed
= 1;
2751 ch_record_state_transition(ch
, ch
->state
);
2752 ossl_ackm_on_handshake_confirmed(ch
->ackm
);
2757 * Master function used when we want to start tearing down a connection:
2759 * - If the connection is still IDLE we can go straight to TERMINATED;
2761 * - If we are already TERMINATED this is a no-op.
2763 * - If we are TERMINATING - CLOSING and we have now got a CONNECTION_CLOSE
2764 * from the peer (tcause->remote == 1), we move to TERMINATING - DRAINING.
2766 * - If we are TERMINATING - DRAINING, we remain here until the terminating
2769 * - Otherwise, we are in ACTIVE and move to TERMINATING - CLOSING.
2770 * if we caused the termination (e.g. we have sent a CONNECTION_CLOSE). Note
2771 * that we are considered to have caused a termination if we sent the first
2772 * CONNECTION_CLOSE frame, even if it is caused by a peer protocol
2773 * violation. If the peer sent the first CONNECTION_CLOSE frame, we move to
2774 * TERMINATING - DRAINING.
2776 * We record the termination cause structure passed on the first call only.
2777 * Any successive calls have their termination cause data discarded;
2778 * once we start sending a CONNECTION_CLOSE frame, we don't change the details
2781 * This conforms to RFC 9000 s. 10.2.1: Closing Connection State:
2782 * To minimize the state that an endpoint maintains for a closing
2783 * connection, endpoints MAY send the exact same packet in response
2784 * to any received packet.
2786 * We don't drop any connection state (specifically packet protection keys)
2787 * even though we are permitted to. This conforms to RFC 9000 s. 10.2.1:
2788 * Closing Connection State:
2789 * An endpoint MAY retain packet protection keys for incoming
2790 * packets to allow it to read and process a CONNECTION_CLOSE frame.
2792 * Note that we do not conform to these two from the same section:
2793 * An endpoint's selected connection ID and the QUIC version
2794 * are sufficient information to identify packets for a closing
2795 * connection; the endpoint MAY discard all other connection state.
2797 * An endpoint MAY drop packet protection keys when entering the
2798 * closing state and send a packet containing a CONNECTION_CLOSE
2799 * frame in response to any UDP datagram that is received.
2801 static void copy_tcause(QUIC_TERMINATE_CAUSE
*dst
,
2802 const QUIC_TERMINATE_CAUSE
*src
)
2804 dst
->error_code
= src
->error_code
;
2805 dst
->frame_type
= src
->frame_type
;
2806 dst
->app
= src
->app
;
2807 dst
->remote
= src
->remote
;
2810 dst
->reason_len
= 0;
2812 if (src
->reason
!= NULL
&& src
->reason_len
> 0) {
2813 size_t l
= src
->reason_len
;
2820 * If this fails, dst->reason becomes NULL and we simply do not use a
2821 * reason. This ensures termination is infallible.
2823 dst
->reason
= r
= OPENSSL_memdup(src
->reason
, l
+ 1);
2828 dst
->reason_len
= l
;
2832 static void ch_start_terminating(QUIC_CHANNEL
*ch
,
2833 const QUIC_TERMINATE_CAUSE
*tcause
,
2834 int force_immediate
)
2836 /* No point sending anything if we haven't sent anything yet. */
2837 if (!ch
->have_sent_any_pkt
)
2838 force_immediate
= 1;
2840 switch (ch
->state
) {
2842 case QUIC_CHANNEL_STATE_IDLE
:
2843 copy_tcause(&ch
->terminate_cause
, tcause
);
2844 ch_on_terminating_timeout(ch
);
2847 case QUIC_CHANNEL_STATE_ACTIVE
:
2848 copy_tcause(&ch
->terminate_cause
, tcause
);
2850 ossl_qlog_event_connectivity_connection_closed(ch_get_qlog(ch
), tcause
);
2852 if (!force_immediate
) {
2853 ch_record_state_transition(ch
, tcause
->remote
2854 ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
2855 : QUIC_CHANNEL_STATE_TERMINATING_CLOSING
);
2857 * RFC 9000 s. 10.2 Immediate Close
2858 * These states SHOULD persist for at least three times
2859 * the current PTO interval as defined in [QUIC-RECOVERY].
2861 ch
->terminate_deadline
2862 = ossl_time_add(get_time(ch
),
2863 ossl_time_multiply(ossl_ackm_get_pto_duration(ch
->ackm
),
2866 if (!tcause
->remote
) {
2867 OSSL_QUIC_FRAME_CONN_CLOSE f
= {0};
2870 f
.error_code
= ch
->terminate_cause
.error_code
;
2871 f
.frame_type
= ch
->terminate_cause
.frame_type
;
2872 f
.is_app
= ch
->terminate_cause
.app
;
2873 f
.reason
= (char *)ch
->terminate_cause
.reason
;
2874 f
.reason_len
= ch
->terminate_cause
.reason_len
;
2875 ossl_quic_tx_packetiser_schedule_conn_close(ch
->txp
, &f
);
2877 * RFC 9000 s. 10.2.2 Draining Connection State:
2878 * An endpoint that receives a CONNECTION_CLOSE frame MAY
2879 * send a single packet containing a CONNECTION_CLOSE
2880 * frame before entering the draining state, using a
2881 * NO_ERROR code if appropriate
2883 ch
->conn_close_queued
= 1;
2886 ch_on_terminating_timeout(ch
);
2890 case QUIC_CHANNEL_STATE_TERMINATING_CLOSING
:
2891 if (force_immediate
)
2892 ch_on_terminating_timeout(ch
);
2893 else if (tcause
->remote
)
2895 * RFC 9000 s. 10.2.2 Draining Connection State:
2896 * An endpoint MAY enter the draining state from the
2897 * closing state if it receives a CONNECTION_CLOSE frame,
2898 * which indicates that the peer is also closing or draining.
2900 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_TERMINATING_DRAINING
);
2904 case QUIC_CHANNEL_STATE_TERMINATING_DRAINING
:
2906 * Other than in the force-immediate case, we remain here until the
2909 if (force_immediate
)
2910 ch_on_terminating_timeout(ch
);
2914 case QUIC_CHANNEL_STATE_TERMINATED
:
2921 void ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL
*ch
,
2922 OSSL_QUIC_FRAME_CONN_CLOSE
*f
)
2924 QUIC_TERMINATE_CAUSE tcause
= {0};
2926 if (!ossl_quic_channel_is_active(ch
))
2930 tcause
.app
= f
->is_app
;
2931 tcause
.error_code
= f
->error_code
;
2932 tcause
.frame_type
= f
->frame_type
;
2933 tcause
.reason
= f
->reason
;
2934 tcause
.reason_len
= f
->reason_len
;
2935 ch_start_terminating(ch
, &tcause
, 0);
2938 static void free_frame_data(unsigned char *buf
, size_t buf_len
, void *arg
)
2943 static int ch_enqueue_retire_conn_id(QUIC_CHANNEL
*ch
, uint64_t seq_num
)
2945 BUF_MEM
*buf_mem
= NULL
;
2949 ossl_quic_srtm_remove(ch
->srtm
, ch
, seq_num
);
2951 if ((buf_mem
= BUF_MEM_new()) == NULL
)
2954 if (!WPACKET_init(&wpkt
, buf_mem
))
2957 if (!ossl_quic_wire_encode_frame_retire_conn_id(&wpkt
, seq_num
)) {
2958 WPACKET_cleanup(&wpkt
);
2962 WPACKET_finish(&wpkt
);
2963 if (!WPACKET_get_total_written(&wpkt
, &l
))
2966 if (ossl_quic_cfq_add_frame(ch
->cfq
, 1, QUIC_PN_SPACE_APP
,
2967 OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID
, 0,
2968 (unsigned char *)buf_mem
->data
, l
,
2969 free_frame_data
, NULL
) == NULL
)
2972 buf_mem
->data
= NULL
;
2973 BUF_MEM_free(buf_mem
);
2977 ossl_quic_channel_raise_protocol_error(ch
,
2978 QUIC_ERR_INTERNAL_ERROR
,
2979 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
2980 "internal error enqueueing retire conn id");
2981 BUF_MEM_free(buf_mem
);
2985 void ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL
*ch
,
2986 OSSL_QUIC_FRAME_NEW_CONN_ID
*f
)
2988 uint64_t new_remote_seq_num
= ch
->cur_remote_seq_num
;
2989 uint64_t new_retire_prior_to
= ch
->cur_retire_prior_to
;
2991 if (!ossl_quic_channel_is_active(ch
))
2994 /* We allow only two active connection ids; first check some constraints */
2995 if (ch
->cur_remote_dcid
.id_len
== 0) {
2996 /* Changing from 0 length connection id is disallowed */
2997 ossl_quic_channel_raise_protocol_error(ch
,
2998 QUIC_ERR_PROTOCOL_VIOLATION
,
2999 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3000 "zero length connection id in use");
3005 if (f
->seq_num
> new_remote_seq_num
)
3006 new_remote_seq_num
= f
->seq_num
;
3007 if (f
->retire_prior_to
> new_retire_prior_to
)
3008 new_retire_prior_to
= f
->retire_prior_to
;
3011 * RFC 9000-5.1.1: An endpoint MUST NOT provide more connection IDs
3012 * than the peer's limit.
3014 * After processing a NEW_CONNECTION_ID frame and adding and retiring
3015 * active connection IDs, if the number of active connection IDs exceeds
3016 * the value advertised in its active_connection_id_limit transport
3017 * parameter, an endpoint MUST close the connection with an error of
3018 * type CONNECTION_ID_LIMIT_ERROR.
3020 if (new_remote_seq_num
- new_retire_prior_to
> 1) {
3021 ossl_quic_channel_raise_protocol_error(ch
,
3022 QUIC_ERR_CONNECTION_ID_LIMIT_ERROR
,
3023 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3024 "active_connection_id limit violated");
3029 * RFC 9000-5.1.1: An endpoint MAY send connection IDs that temporarily
3030 * exceed a peer's limit if the NEW_CONNECTION_ID frame also requires
3031 * the retirement of any excess, by including a sufficiently large
3032 * value in the Retire Prior To field.
3034 * RFC 9000-5.1.2: An endpoint SHOULD allow for sending and tracking
3035 * a number of RETIRE_CONNECTION_ID frames of at least twice the value
3036 * of the active_connection_id_limit transport parameter. An endpoint
3037 * MUST NOT forget a connection ID without retiring it, though it MAY
3038 * choose to treat having connection IDs in need of retirement that
3039 * exceed this limit as a connection error of type CONNECTION_ID_LIMIT_ERROR.
3041 * We are a little bit more liberal than the minimum mandated.
3043 if (new_retire_prior_to
- ch
->cur_retire_prior_to
> 10) {
3044 ossl_quic_channel_raise_protocol_error(ch
,
3045 QUIC_ERR_CONNECTION_ID_LIMIT_ERROR
,
3046 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3047 "retiring connection id limit violated");
3052 if (new_remote_seq_num
> ch
->cur_remote_seq_num
) {
3053 /* Add new stateless reset token */
3054 if (!ossl_quic_srtm_add(ch
->srtm
, ch
, new_remote_seq_num
,
3055 &f
->stateless_reset
)) {
3056 ossl_quic_channel_raise_protocol_error(
3057 ch
, QUIC_ERR_CONNECTION_ID_LIMIT_ERROR
,
3058 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
3059 "unable to store stateless reset token");
3063 ch
->cur_remote_seq_num
= new_remote_seq_num
;
3064 ch
->cur_remote_dcid
= f
->conn_id
;
3065 ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->cur_remote_dcid
);
3069 * RFC 9000-5.1.2: Upon receipt of an increased Retire Prior To
3070 * field, the peer MUST stop using the corresponding connection IDs
3071 * and retire them with RETIRE_CONNECTION_ID frames before adding the
3072 * newly provided connection ID to the set of active connection IDs.
3076 * Note: RFC 9000 s. 19.15 says:
3077 * "An endpoint that receives a NEW_CONNECTION_ID frame with a sequence
3078 * number smaller than the Retire Prior To field of a previously received
3079 * NEW_CONNECTION_ID frame MUST send a corresponding
3080 * RETIRE_CONNECTION_ID frame that retires the newly received connection
3081 * ID, unless it has already done so for that sequence number."
3083 * Since we currently always queue RETIRE_CONN_ID frames based on the Retire
3084 * Prior To field of a NEW_CONNECTION_ID frame immediately upon receiving
3085 * that NEW_CONNECTION_ID frame, by definition this will always be met.
3086 * This may change in future when we change our CID handling.
3088 while (new_retire_prior_to
> ch
->cur_retire_prior_to
) {
3089 if (!ch_enqueue_retire_conn_id(ch
, ch
->cur_retire_prior_to
))
3091 ++ch
->cur_retire_prior_to
;
3095 static void ch_save_err_state(QUIC_CHANNEL
*ch
)
3097 if (ch
->err_state
== NULL
)
3098 ch
->err_state
= OSSL_ERR_STATE_new();
3100 if (ch
->err_state
== NULL
)
3103 OSSL_ERR_STATE_save(ch
->err_state
);
3106 void ossl_quic_channel_inject(QUIC_CHANNEL
*ch
, QUIC_URXE
*e
)
3108 ossl_qrx_inject_urxe(ch
->qrx
, e
);
3111 void ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL
*ch
)
3113 QUIC_TERMINATE_CAUSE tcause
= {0};
3115 tcause
.error_code
= QUIC_ERR_NO_ERROR
;
3117 ch_start_terminating(ch
, &tcause
, 0);
3120 void ossl_quic_channel_raise_net_error(QUIC_CHANNEL
*ch
)
3122 QUIC_TERMINATE_CAUSE tcause
= {0};
3129 tcause
.error_code
= QUIC_ERR_INTERNAL_ERROR
;
3130 tcause
.reason
= "network BIO I/O error";
3131 tcause
.reason_len
= strlen(tcause
.reason
);
3134 * Skip Terminating state and go directly to Terminated, no point trying to
3135 * send CONNECTION_CLOSE if we cannot communicate.
3137 ch_start_terminating(ch
, &tcause
, 1);
3140 int ossl_quic_channel_net_error(QUIC_CHANNEL
*ch
)
3142 return ch
->net_error
;
3145 void ossl_quic_channel_restore_err_state(QUIC_CHANNEL
*ch
)
3150 if (!ossl_quic_port_is_running(ch
->port
))
3151 ossl_quic_port_restore_err_state(ch
->port
);
3153 OSSL_ERR_STATE_restore(ch
->err_state
);
3156 void ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL
*ch
,
3157 uint64_t error_code
,
3158 uint64_t frame_type
,
3160 ERR_STATE
*err_state
,
3161 const char *src_file
,
3163 const char *src_func
)
3165 QUIC_TERMINATE_CAUSE tcause
= {0};
3166 int err_reason
= error_code
== QUIC_ERR_INTERNAL_ERROR
3167 ? ERR_R_INTERNAL_ERROR
: SSL_R_QUIC_PROTOCOL_ERROR
;
3168 const char *err_str
= ossl_quic_err_to_string(error_code
);
3169 const char *err_str_pfx
= " (", *err_str_sfx
= ")";
3170 const char *ft_str
= NULL
;
3171 const char *ft_str_pfx
= " (", *ft_str_sfx
= ")";
3173 if (ch
->protocol_error
)
3174 /* Only the first call to this function matters. */
3177 if (err_str
== NULL
) {
3184 * If we were provided an underlying error state, restore it and then append
3185 * our ERR on top as a "cover letter" error.
3187 if (err_state
!= NULL
)
3188 OSSL_ERR_STATE_restore(err_state
);
3190 if (frame_type
!= 0) {
3191 ft_str
= ossl_quic_frame_type_to_string(frame_type
);
3192 if (ft_str
== NULL
) {
3198 ERR_raise_data(ERR_LIB_SSL
, err_reason
,
3199 "QUIC error code: 0x%llx%s%s%s "
3200 "(triggered by frame type: 0x%llx%s%s%s), reason: \"%s\"",
3201 (unsigned long long) error_code
,
3202 err_str_pfx
, err_str
, err_str_sfx
,
3203 (unsigned long long) frame_type
,
3204 ft_str_pfx
, ft_str
, ft_str_sfx
,
3207 ERR_raise_data(ERR_LIB_SSL
, err_reason
,
3208 "QUIC error code: 0x%llx%s%s%s, reason: \"%s\"",
3209 (unsigned long long) error_code
,
3210 err_str_pfx
, err_str
, err_str_sfx
,
3214 if (src_file
!= NULL
)
3215 ERR_set_debug(src_file
, src_line
, src_func
);
3217 ch_save_err_state(ch
);
3219 tcause
.error_code
= error_code
;
3220 tcause
.frame_type
= frame_type
;
3221 tcause
.reason
= reason
;
3222 tcause
.reason_len
= strlen(reason
);
3224 ch
->protocol_error
= 1;
3225 ch_start_terminating(ch
, &tcause
, 0);
3229 * Called once the terminating timer expires, meaning we move from TERMINATING
3232 static void ch_on_terminating_timeout(QUIC_CHANNEL
*ch
)
3234 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_TERMINATED
);
3238 * Determines the effective idle timeout duration. This is based on the idle
3239 * timeout values that we and our peer signalled in transport parameters
3240 * but have some limits applied.
3242 static OSSL_TIME
ch_get_effective_idle_timeout_duration(QUIC_CHANNEL
*ch
)
3246 if (ch
->max_idle_timeout
== 0)
3247 return ossl_time_infinite();
3250 * RFC 9000 s. 10.1: Idle Timeout
3251 * To avoid excessively small idle timeout periods, endpoints
3252 * MUST increase the idle timeout period to be at least three
3253 * times the current Probe Timeout (PTO). This allows for
3254 * multiple PTOs to expire, and therefore multiple probes to
3255 * be sent and lost, prior to idle timeout.
3257 pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
3258 return ossl_time_max(ossl_ms2time(ch
->max_idle_timeout
),
3259 ossl_time_multiply(pto
, 3));
3263 * Updates our idle deadline. Called when an event happens which should bump the
3266 static void ch_update_idle(QUIC_CHANNEL
*ch
)
3268 ch
->idle_deadline
= ossl_time_add(get_time(ch
),
3269 ch_get_effective_idle_timeout_duration(ch
));
3273 * Updates our ping deadline, which determines when we next generate a ping if
3274 * we don't have any other ACK-eliciting frames to send.
3276 static void ch_update_ping_deadline(QUIC_CHANNEL
*ch
)
3278 OSSL_TIME max_span
, idle_duration
;
3280 idle_duration
= ch_get_effective_idle_timeout_duration(ch
);
3281 if (ossl_time_is_infinite(idle_duration
)) {
3282 ch
->ping_deadline
= ossl_time_infinite();
3287 * Maximum amount of time without traffic before we send a PING to keep
3288 * the connection open. Usually we use max_idle_timeout/2, but ensure
3289 * the period never exceeds the assumed NAT interval to ensure NAT
3290 * devices don't have their state time out (RFC 9000 s. 10.1.2).
3292 max_span
= ossl_time_divide(idle_duration
, 2);
3293 max_span
= ossl_time_min(max_span
, MAX_NAT_INTERVAL
);
3294 ch
->ping_deadline
= ossl_time_add(get_time(ch
), max_span
);
3297 /* Called when the idle timeout expires. */
3298 static void ch_on_idle_timeout(QUIC_CHANNEL
*ch
)
3301 * Idle timeout does not have an error code associated with it because a
3302 * CONN_CLOSE is never sent for it. We shouldn't use this data once we reach
3303 * TERMINATED anyway.
3305 ch
->terminate_cause
.app
= 0;
3306 ch
->terminate_cause
.error_code
= UINT64_MAX
;
3307 ch
->terminate_cause
.frame_type
= 0;
3309 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_TERMINATED
);
3312 /* Called when we, as a server, get a new incoming connection. */
3313 int ossl_quic_channel_on_new_conn(QUIC_CHANNEL
*ch
, const BIO_ADDR
*peer
,
3314 const QUIC_CONN_ID
*peer_scid
,
3315 const QUIC_CONN_ID
*peer_dcid
)
3317 if (!ossl_assert(ch
->state
== QUIC_CHANNEL_STATE_IDLE
&& ch
->is_server
))
3320 /* Generate an Initial LCID we will use for the connection. */
3321 if (!ossl_quic_lcidm_generate_initial(ch
->lcidm
, ch
, &ch
->cur_local_cid
))
3324 /* Note our newly learnt peer address and CIDs. */
3325 ch
->cur_peer_addr
= *peer
;
3326 ch
->init_dcid
= *peer_dcid
;
3327 ch
->cur_remote_dcid
= *peer_scid
;
3329 /* Inform QTX of peer address. */
3330 if (!ossl_quic_tx_packetiser_set_peer(ch
->txp
, &ch
->cur_peer_addr
))
3333 /* Inform TXP of desired CIDs. */
3334 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->cur_remote_dcid
))
3337 if (!ossl_quic_tx_packetiser_set_cur_scid(ch
->txp
, &ch
->cur_local_cid
))
3340 /* Setup QLOG, which did not happen earlier due to lacking an Initial ODCID. */
3341 ossl_qtx_set0_qlog(ch
->qtx
, ch_get_qlog(ch
));
3342 ossl_quic_tx_packetiser_set0_qlog(ch
->txp
, ch_get_qlog(ch
));
3344 /* Plug in secrets for the Initial EL. */
3345 if (!ossl_quic_provide_initial_secret(ch
->port
->engine
->libctx
,
3346 ch
->port
->engine
->propq
,
3352 /* Register the peer ODCID in the LCIDM. */
3353 if (!ossl_quic_lcidm_enrol_odcid(ch
->lcidm
, ch
, &ch
->init_dcid
))
3357 ch_record_state_transition(ch
, QUIC_CHANNEL_STATE_ACTIVE
);
3358 ch
->doing_proactive_ver_neg
= 0; /* not currently supported */
3362 SSL
*ossl_quic_channel_get0_ssl(QUIC_CHANNEL
*ch
)
3367 static int ch_init_new_stream(QUIC_CHANNEL
*ch
, QUIC_STREAM
*qs
,
3368 int can_send
, int can_recv
)
3371 int server_init
= ossl_quic_stream_is_server_init(qs
);
3372 int local_init
= (ch
->is_server
== server_init
);
3373 int is_uni
= !ossl_quic_stream_is_bidi(qs
);
3376 if ((qs
->sstream
= ossl_quic_sstream_new(INIT_APP_BUF_LEN
)) == NULL
)
3380 if ((qs
->rstream
= ossl_quic_rstream_new(NULL
, NULL
, 0)) == NULL
)
3384 if (!ossl_quic_txfc_init(&qs
->txfc
, &ch
->conn_txfc
))
3387 if (ch
->got_remote_transport_params
) {
3389 * If we already got peer TPs we need to apply the initial CWM credit
3390 * now. If we didn't already get peer TPs this will be done
3391 * automatically for all extant streams when we do.
3397 cwm
= ch
->rx_init_max_stream_data_uni
;
3398 else if (local_init
)
3399 cwm
= ch
->rx_init_max_stream_data_bidi_local
;
3401 cwm
= ch
->rx_init_max_stream_data_bidi_remote
;
3403 ossl_quic_txfc_bump_cwm(&qs
->txfc
, cwm
);
3411 rxfc_wnd
= ch
->tx_init_max_stream_data_uni
;
3412 else if (local_init
)
3413 rxfc_wnd
= ch
->tx_init_max_stream_data_bidi_local
;
3415 rxfc_wnd
= ch
->tx_init_max_stream_data_bidi_remote
;
3417 if (!ossl_quic_rxfc_init(&qs
->rxfc
, &ch
->conn_rxfc
,
3419 DEFAULT_STREAM_RXFC_MAX_WND_MUL
* rxfc_wnd
,
3426 ossl_quic_sstream_free(qs
->sstream
);
3428 ossl_quic_rstream_free(qs
->rstream
);
3433 static uint64_t *ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL
*ch
,
3436 return is_uni
? &ch
->next_local_stream_ordinal_uni
3437 : &ch
->next_local_stream_ordinal_bidi
;
3440 static const uint64_t *ch_get_local_stream_max_ptr(const QUIC_CHANNEL
*ch
,
3443 return is_uni
? &ch
->max_local_streams_uni
3444 : &ch
->max_local_streams_bidi
;
3447 static const QUIC_RXFC
*ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL
*ch
,
3450 return is_uni
? &ch
->max_streams_uni_rxfc
3451 : &ch
->max_streams_bidi_rxfc
;
3454 int ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL
*ch
,
3457 const uint64_t *p_next_ordinal
= ch_get_local_stream_next_ordinal_ptr(ch
, is_uni
);
3459 return ossl_quic_stream_map_is_local_allowed_by_stream_limit(&ch
->qsm
,
3464 uint64_t ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL
*ch
,
3467 const uint64_t *p_next_ordinal
, *p_max
;
3469 p_next_ordinal
= ch_get_local_stream_next_ordinal_ptr((QUIC_CHANNEL
*)ch
,
3471 p_max
= ch_get_local_stream_max_ptr(ch
, is_uni
);
3473 return *p_max
- *p_next_ordinal
;
3476 uint64_t ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL
*ch
,
3479 return ossl_quic_rxfc_get_credit(ch_get_remote_stream_count_rxfc(ch
, is_uni
));
3482 QUIC_STREAM
*ossl_quic_channel_new_stream_local(QUIC_CHANNEL
*ch
, int is_uni
)
3487 uint64_t *p_next_ordinal
;
3489 type
= ch
->is_server
? QUIC_STREAM_INITIATOR_SERVER
3490 : QUIC_STREAM_INITIATOR_CLIENT
;
3492 p_next_ordinal
= ch_get_local_stream_next_ordinal_ptr(ch
, is_uni
);
3495 type
|= QUIC_STREAM_DIR_UNI
;
3497 type
|= QUIC_STREAM_DIR_BIDI
;
3499 if (*p_next_ordinal
>= ((uint64_t)1) << 62)
3502 stream_id
= ((*p_next_ordinal
) << 2) | type
;
3504 if ((qs
= ossl_quic_stream_map_alloc(&ch
->qsm
, stream_id
, type
)) == NULL
)
3507 /* Locally-initiated stream, so we always want a send buffer. */
3508 if (!ch_init_new_stream(ch
, qs
, /*can_send=*/1, /*can_recv=*/!is_uni
))
3515 ossl_quic_stream_map_release(&ch
->qsm
, qs
);
3519 QUIC_STREAM
*ossl_quic_channel_new_stream_remote(QUIC_CHANNEL
*ch
,
3526 peer_role
= ch
->is_server
3527 ? QUIC_STREAM_INITIATOR_CLIENT
3528 : QUIC_STREAM_INITIATOR_SERVER
;
3530 if ((stream_id
& QUIC_STREAM_INITIATOR_MASK
) != peer_role
)
3533 is_uni
= ((stream_id
& QUIC_STREAM_DIR_MASK
) == QUIC_STREAM_DIR_UNI
);
3535 qs
= ossl_quic_stream_map_alloc(&ch
->qsm
, stream_id
,
3536 stream_id
& (QUIC_STREAM_INITIATOR_MASK
3537 | QUIC_STREAM_DIR_MASK
));
3541 if (!ch_init_new_stream(ch
, qs
, /*can_send=*/!is_uni
, /*can_recv=*/1))
3544 if (ch
->incoming_stream_auto_reject
)
3545 ossl_quic_channel_reject_stream(ch
, qs
);
3547 ossl_quic_stream_map_push_accept_queue(&ch
->qsm
, qs
);
3552 ossl_quic_stream_map_release(&ch
->qsm
, qs
);
3556 void ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL
*ch
,
3560 ch
->incoming_stream_auto_reject
= (enable
!= 0);
3561 ch
->incoming_stream_auto_reject_aec
= aec
;
3564 void ossl_quic_channel_reject_stream(QUIC_CHANNEL
*ch
, QUIC_STREAM
*qs
)
3566 ossl_quic_stream_map_stop_sending_recv_part(&ch
->qsm
, qs
,
3567 ch
->incoming_stream_auto_reject_aec
);
3569 ossl_quic_stream_map_reset_stream_send_part(&ch
->qsm
, qs
,
3570 ch
->incoming_stream_auto_reject_aec
);
3573 ossl_quic_stream_map_update_state(&ch
->qsm
, qs
);
3576 /* Replace local connection ID in TXP and DEMUX for testing purposes. */
3577 int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL
*ch
,
3578 const QUIC_CONN_ID
*conn_id
)
3580 /* Remove the current LCID from the LCIDM. */
3581 if (!ossl_quic_lcidm_debug_remove(ch
->lcidm
, &ch
->cur_local_cid
))
3583 ch
->cur_local_cid
= *conn_id
;
3584 /* Set in the TXP, used only for long header packets. */
3585 if (!ossl_quic_tx_packetiser_set_cur_scid(ch
->txp
, &ch
->cur_local_cid
))
3587 /* Add the new LCID to the LCIDM. */
3588 if (!ossl_quic_lcidm_debug_add(ch
->lcidm
, ch
, &ch
->cur_local_cid
,
3594 void ossl_quic_channel_set_msg_callback(QUIC_CHANNEL
*ch
,
3595 ossl_msg_cb msg_callback
,
3596 SSL
*msg_callback_ssl
)
3598 ch
->msg_callback
= msg_callback
;
3599 ch
->msg_callback_ssl
= msg_callback_ssl
;
3600 ossl_qtx_set_msg_callback(ch
->qtx
, msg_callback
, msg_callback_ssl
);
3601 ossl_quic_tx_packetiser_set_msg_callback(ch
->txp
, msg_callback
,
3603 ossl_qrx_set_msg_callback(ch
->qrx
, msg_callback
, msg_callback_ssl
);
3606 void ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL
*ch
,
3607 void *msg_callback_arg
)
3609 ch
->msg_callback_arg
= msg_callback_arg
;
3610 ossl_qtx_set_msg_callback_arg(ch
->qtx
, msg_callback_arg
);
3611 ossl_quic_tx_packetiser_set_msg_callback_arg(ch
->txp
, msg_callback_arg
);
3612 ossl_qrx_set_msg_callback_arg(ch
->qrx
, msg_callback_arg
);
3615 void ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL
*ch
,
3616 uint64_t tx_pkt_threshold
)
3618 ch
->txku_threshold_override
= tx_pkt_threshold
;
3621 uint64_t ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL
*ch
)
3623 return ossl_qtx_get_key_epoch(ch
->qtx
);
3626 uint64_t ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL
*ch
)
3628 return ossl_qrx_get_key_epoch(ch
->qrx
);
3631 int ossl_quic_channel_trigger_txku(QUIC_CHANNEL
*ch
)
3633 if (!txku_allowed(ch
))
3636 ch
->ku_locally_initiated
= 1;
3637 ch_trigger_txku(ch
);
3641 int ossl_quic_channel_ping(QUIC_CHANNEL
*ch
)
3643 int pn_space
= ossl_quic_enc_level_to_pn_space(ch
->tx_enc_level
);
3645 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch
->txp
, pn_space
);
3650 uint16_t ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL
*ch
)
3652 return ch
->diag_num_rx_ack
;
3655 void ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL
*ch
, QUIC_CONN_ID
*cid
)
3657 *cid
= ch
->cur_local_cid
;
3660 int ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL
*ch
)
3662 return ch
->got_local_transport_params
;
3665 void ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL
*ch
, uint64_t ms
)
3667 ch
->max_idle_timeout_local_req
= ms
;
3669 uint64_t ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL
*ch
)
3671 return ch
->max_idle_timeout_local_req
;
3674 uint64_t ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL
*ch
)
3676 return ch
->max_idle_timeout_remote_req
;
3679 uint64_t ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL
*ch
)
3681 return ch
->max_idle_timeout
;