2 * Copyright 2022 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/rand.h>
11 #include <openssl/err.h>
12 #include "internal/quic_channel.h"
13 #include "internal/quic_error.h"
14 #include "internal/quic_rx_depack.h"
15 #include "../ssl_local.h"
16 #include "quic_channel_local.h"
19 * NOTE: While this channel implementation currently has basic server support,
20 * this functionality has been implemented for internal testing purposes and is
21 * not suitable for network use. In particular, it does not implement address
22 * validation, anti-amplification or retry logic.
24 * TODO(QUIC): Implement address validation and anti-amplification
25 * TODO(QUIC): Implement retry logic
28 #define INIT_DCID_LEN 8
29 #define INIT_CRYPTO_BUF_LEN 8192
30 #define INIT_APP_BUF_LEN 8192
33 * Interval before we force a PING to ensure NATs don't timeout. This is based
34 * on the lowest commonly seen value of 30 seconds as cited in RFC 9000 s.
37 #define MAX_NAT_INTERVAL (ossl_ms2time(25000))
40 * Our maximum ACK delay on the TX side. This is up to us to choose. Note that
41 * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol
42 * value which determines the value of the maximum ACK delay if the
43 * max_ack_delay transport parameter is not set.
45 #define DEFAULT_MAX_ACK_DELAY QUIC_DEFAULT_MAX_ACK_DELAY
47 static void ch_rx_pre(QUIC_CHANNEL
*ch
);
48 static int ch_rx(QUIC_CHANNEL
*ch
);
49 static int ch_tx(QUIC_CHANNEL
*ch
);
50 static void ch_tick(QUIC_TICK_RESULT
*res
, void *arg
, uint32_t flags
);
51 static void ch_rx_handle_packet(QUIC_CHANNEL
*ch
);
52 static OSSL_TIME
ch_determine_next_tick_deadline(QUIC_CHANNEL
*ch
);
53 static int ch_retry(QUIC_CHANNEL
*ch
,
54 const unsigned char *retry_token
,
55 size_t retry_token_len
,
56 const QUIC_CONN_ID
*retry_scid
);
57 static void ch_cleanup(QUIC_CHANNEL
*ch
);
58 static int ch_generate_transport_params(QUIC_CHANNEL
*ch
);
59 static int ch_on_transport_params(const unsigned char *params
,
62 static int ch_on_handshake_alert(void *arg
, unsigned char alert_code
);
63 static int ch_on_handshake_complete(void *arg
);
64 static int ch_on_handshake_yield_secret(uint32_t enc_level
, int direction
,
65 uint32_t suite_id
, EVP_MD
*md
,
66 const unsigned char *secret
,
69 static int ch_on_crypto_recv_record(const unsigned char **buf
,
70 size_t *bytes_read
, void *arg
);
71 static int ch_on_crypto_release_record(size_t bytes_read
, void *arg
);
72 static int crypto_ensure_empty(QUIC_RSTREAM
*rstream
);
73 static int ch_on_crypto_send(const unsigned char *buf
, size_t buf_len
,
74 size_t *consumed
, void *arg
);
75 static OSSL_TIME
get_time(void *arg
);
76 static uint64_t get_stream_limit(int uni
, void *arg
);
77 static int rx_late_validate(QUIC_PN pn
, int pn_space
, void *arg
);
78 static void rxku_detected(QUIC_PN pn
, void *arg
);
79 static int ch_retry(QUIC_CHANNEL
*ch
,
80 const unsigned char *retry_token
,
81 size_t retry_token_len
,
82 const QUIC_CONN_ID
*retry_scid
);
83 static void ch_update_idle(QUIC_CHANNEL
*ch
);
84 static int ch_discard_el(QUIC_CHANNEL
*ch
,
86 static void ch_on_idle_timeout(QUIC_CHANNEL
*ch
);
87 static void ch_update_idle(QUIC_CHANNEL
*ch
);
88 static void ch_update_ping_deadline(QUIC_CHANNEL
*ch
);
89 static void ch_raise_net_error(QUIC_CHANNEL
*ch
);
90 static void ch_on_terminating_timeout(QUIC_CHANNEL
*ch
);
91 static void ch_start_terminating(QUIC_CHANNEL
*ch
,
92 const QUIC_TERMINATE_CAUSE
*tcause
,
94 static void ch_default_packet_handler(QUIC_URXE
*e
, void *arg
);
95 static int ch_server_on_new_conn(QUIC_CHANNEL
*ch
, const BIO_ADDR
*peer
,
96 const QUIC_CONN_ID
*peer_scid
,
97 const QUIC_CONN_ID
*peer_dcid
);
98 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK
*ack
, uint32_t pn_space
,
101 static int gen_rand_conn_id(OSSL_LIB_CTX
*libctx
, size_t len
, QUIC_CONN_ID
*cid
)
103 if (len
> QUIC_MAX_CONN_ID_LEN
)
106 cid
->id_len
= (unsigned char)len
;
108 if (RAND_bytes_ex(libctx
, cid
->id
, len
, len
* 8) != 1) {
117 * QUIC Channel Initialization and Teardown
118 * ========================================
120 #define DEFAULT_INIT_CONN_RXFC_WND (2 * 1024 * 1024)
121 #define DEFAULT_CONN_RXFC_MAX_WND_MUL 5
123 #define DEFAULT_INIT_STREAM_RXFC_WND (2 * 1024 * 1024)
124 #define DEFAULT_STREAM_RXFC_MAX_WND_MUL 5
126 #define DEFAULT_INIT_CONN_MAX_STREAMS 100
128 static int ch_init(QUIC_CHANNEL
*ch
)
130 OSSL_QUIC_TX_PACKETISER_ARGS txp_args
= {0};
131 OSSL_QTX_ARGS qtx_args
= {0};
132 OSSL_QRX_ARGS qrx_args
= {0};
133 QUIC_TLS_ARGS tls_args
= {0};
135 size_t rx_short_cid_len
= ch
->is_server
? INIT_DCID_LEN
: 0;
137 /* For clients, generate our initial DCID. */
139 && !gen_rand_conn_id(ch
->libctx
, INIT_DCID_LEN
, &ch
->init_dcid
))
142 /* We plug in a network write BIO to the QTX later when we get one. */
143 qtx_args
.libctx
= ch
->libctx
;
144 qtx_args
.mdpl
= QUIC_MIN_INITIAL_DGRAM_LEN
;
145 ch
->rx_max_udp_payload_size
= qtx_args
.mdpl
;
147 ch
->ping_deadline
= ossl_time_infinite();
149 ch
->qtx
= ossl_qtx_new(&qtx_args
);
153 ch
->txpim
= ossl_quic_txpim_new();
154 if (ch
->txpim
== NULL
)
157 ch
->cfq
= ossl_quic_cfq_new();
161 if (!ossl_quic_txfc_init(&ch
->conn_txfc
, NULL
))
165 * Note: The TP we transmit governs what the peer can transmit and thus
166 * applies to the RXFC.
168 ch
->tx_init_max_stream_data_bidi_local
= DEFAULT_INIT_STREAM_RXFC_WND
;
169 ch
->tx_init_max_stream_data_bidi_remote
= DEFAULT_INIT_STREAM_RXFC_WND
;
170 ch
->tx_init_max_stream_data_uni
= DEFAULT_INIT_STREAM_RXFC_WND
;
172 if (!ossl_quic_rxfc_init(&ch
->conn_rxfc
, NULL
,
173 DEFAULT_INIT_CONN_RXFC_WND
,
174 DEFAULT_CONN_RXFC_MAX_WND_MUL
*
175 DEFAULT_INIT_CONN_RXFC_WND
,
179 if (!ossl_quic_rxfc_init_for_stream_count(&ch
->max_streams_bidi_rxfc
,
180 DEFAULT_INIT_CONN_MAX_STREAMS
,
184 if (!ossl_quic_rxfc_init_for_stream_count(&ch
->max_streams_uni_rxfc
,
185 DEFAULT_INIT_CONN_MAX_STREAMS
,
189 if (!ossl_statm_init(&ch
->statm
))
193 ch
->cc_method
= &ossl_cc_newreno_method
;
194 if ((ch
->cc_data
= ch
->cc_method
->new(get_time
, ch
)) == NULL
)
197 if ((ch
->ackm
= ossl_ackm_new(get_time
, ch
, &ch
->statm
,
198 ch
->cc_method
, ch
->cc_data
)) == NULL
)
201 if (!ossl_quic_stream_map_init(&ch
->qsm
, get_stream_limit
, ch
,
202 &ch
->max_streams_bidi_rxfc
,
203 &ch
->max_streams_uni_rxfc
,
209 /* We use a zero-length SCID. */
210 txp_args
.cur_dcid
= ch
->init_dcid
;
211 txp_args
.ack_delay_exponent
= 3;
212 txp_args
.qtx
= ch
->qtx
;
213 txp_args
.txpim
= ch
->txpim
;
214 txp_args
.cfq
= ch
->cfq
;
215 txp_args
.ackm
= ch
->ackm
;
216 txp_args
.qsm
= &ch
->qsm
;
217 txp_args
.conn_txfc
= &ch
->conn_txfc
;
218 txp_args
.conn_rxfc
= &ch
->conn_rxfc
;
219 txp_args
.max_streams_bidi_rxfc
= &ch
->max_streams_bidi_rxfc
;
220 txp_args
.max_streams_uni_rxfc
= &ch
->max_streams_uni_rxfc
;
221 txp_args
.cc_method
= ch
->cc_method
;
222 txp_args
.cc_data
= ch
->cc_data
;
223 txp_args
.now
= get_time
;
224 txp_args
.now_arg
= ch
;
226 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
227 ch
->crypto_send
[pn_space
] = ossl_quic_sstream_new(INIT_CRYPTO_BUF_LEN
);
228 if (ch
->crypto_send
[pn_space
] == NULL
)
231 txp_args
.crypto
[pn_space
] = ch
->crypto_send
[pn_space
];
234 ch
->txp
= ossl_quic_tx_packetiser_new(&txp_args
);
238 ossl_quic_tx_packetiser_set_ack_tx_cb(ch
->txp
, ch_on_txp_ack_tx
, ch
);
240 if ((ch
->demux
= ossl_quic_demux_new(/*BIO=*/NULL
,
241 /*Short CID Len=*/rx_short_cid_len
,
242 get_time
, ch
)) == NULL
)
246 * If we are a server, setup our handler for packets not corresponding to
247 * any known DCID on our end. This is for handling clients establishing new
251 ossl_quic_demux_set_default_handler(ch
->demux
,
252 ch_default_packet_handler
,
255 qrx_args
.libctx
= ch
->libctx
;
256 qrx_args
.demux
= ch
->demux
;
257 qrx_args
.short_conn_id_len
= rx_short_cid_len
;
258 qrx_args
.max_deferred
= 32;
260 if ((ch
->qrx
= ossl_qrx_new(&qrx_args
)) == NULL
)
263 if (!ossl_qrx_set_late_validation_cb(ch
->qrx
,
268 if (!ossl_qrx_set_key_update_cb(ch
->qrx
,
273 if (!ch
->is_server
&& !ossl_qrx_add_dst_conn_id(ch
->qrx
, &txp_args
.cur_scid
))
276 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
277 ch
->crypto_recv
[pn_space
] = ossl_quic_rstream_new(NULL
, NULL
, 0);
278 if (ch
->crypto_recv
[pn_space
] == NULL
)
282 /* Plug in the TLS handshake layer. */
283 tls_args
.s
= ch
->tls
;
284 tls_args
.crypto_send_cb
= ch_on_crypto_send
;
285 tls_args
.crypto_send_cb_arg
= ch
;
286 tls_args
.crypto_recv_rcd_cb
= ch_on_crypto_recv_record
;
287 tls_args
.crypto_recv_rcd_cb_arg
= ch
;
288 tls_args
.crypto_release_rcd_cb
= ch_on_crypto_release_record
;
289 tls_args
.crypto_release_rcd_cb_arg
= ch
;
290 tls_args
.yield_secret_cb
= ch_on_handshake_yield_secret
;
291 tls_args
.yield_secret_cb_arg
= ch
;
292 tls_args
.got_transport_params_cb
= ch_on_transport_params
;
293 tls_args
.got_transport_params_cb_arg
= ch
;
294 tls_args
.handshake_complete_cb
= ch_on_handshake_complete
;
295 tls_args
.handshake_complete_cb_arg
= ch
;
296 tls_args
.alert_cb
= ch_on_handshake_alert
;
297 tls_args
.alert_cb_arg
= ch
;
298 tls_args
.is_server
= ch
->is_server
;
300 if ((ch
->qtls
= ossl_quic_tls_new(&tls_args
)) == NULL
)
303 ch
->tx_max_ack_delay
= DEFAULT_MAX_ACK_DELAY
;
304 ch
->rx_max_ack_delay
= QUIC_DEFAULT_MAX_ACK_DELAY
;
305 ch
->rx_ack_delay_exp
= QUIC_DEFAULT_ACK_DELAY_EXP
;
306 ch
->rx_active_conn_id_limit
= QUIC_MIN_ACTIVE_CONN_ID_LIMIT
;
307 ch
->max_idle_timeout
= QUIC_DEFAULT_IDLE_TIMEOUT
;
308 ch
->tx_enc_level
= QUIC_ENC_LEVEL_INITIAL
;
309 ch
->rx_enc_level
= QUIC_ENC_LEVEL_INITIAL
;
310 ch
->txku_threshold_override
= UINT64_MAX
;
312 ossl_ackm_set_tx_max_ack_delay(ch
->ackm
, ossl_ms2time(ch
->tx_max_ack_delay
));
313 ossl_ackm_set_rx_max_ack_delay(ch
->ackm
, ossl_ms2time(ch
->rx_max_ack_delay
));
316 * Determine the QUIC Transport Parameters and serialize the transport
317 * parameters block. (For servers, we do this later as we must defer
318 * generation until we have received the client's transport parameters.)
320 if (!ch
->is_server
&& !ch_generate_transport_params(ch
))
324 ossl_quic_reactor_init(&ch
->rtor
, ch_tick
, ch
,
325 ch_determine_next_tick_deadline(ch
));
333 static void ch_cleanup(QUIC_CHANNEL
*ch
)
337 if (ch
->ackm
!= NULL
)
338 for (pn_space
= QUIC_PN_SPACE_INITIAL
;
339 pn_space
< QUIC_PN_SPACE_NUM
;
341 ossl_ackm_on_pkt_space_discarded(ch
->ackm
, pn_space
);
343 ossl_quic_tx_packetiser_free(ch
->txp
);
344 ossl_quic_txpim_free(ch
->txpim
);
345 ossl_quic_cfq_free(ch
->cfq
);
346 ossl_qtx_free(ch
->qtx
);
347 if (ch
->cc_data
!= NULL
)
348 ch
->cc_method
->free(ch
->cc_data
);
350 ossl_statm_destroy(&ch
->statm
);
351 ossl_ackm_free(ch
->ackm
);
354 ossl_quic_stream_map_cleanup(&ch
->qsm
);
356 for (pn_space
= QUIC_PN_SPACE_INITIAL
; pn_space
< QUIC_PN_SPACE_NUM
; ++pn_space
) {
357 ossl_quic_sstream_free(ch
->crypto_send
[pn_space
]);
358 ossl_quic_rstream_free(ch
->crypto_recv
[pn_space
]);
361 ossl_qrx_pkt_release(ch
->qrx_pkt
);
364 ossl_quic_tls_free(ch
->qtls
);
365 ossl_qrx_free(ch
->qrx
);
366 ossl_quic_demux_free(ch
->demux
);
367 OPENSSL_free(ch
->local_transport_params
);
368 OSSL_ERR_STATE_free(ch
->err_state
);
371 QUIC_CHANNEL
*ossl_quic_channel_new(const QUIC_CHANNEL_ARGS
*args
)
373 QUIC_CHANNEL
*ch
= NULL
;
375 if ((ch
= OPENSSL_zalloc(sizeof(*ch
))) == NULL
)
378 ch
->libctx
= args
->libctx
;
379 ch
->propq
= args
->propq
;
380 ch
->is_server
= args
->is_server
;
382 ch
->mutex
= args
->mutex
;
383 ch
->now_cb
= args
->now_cb
;
384 ch
->now_cb_arg
= args
->now_cb_arg
;
394 void ossl_quic_channel_free(QUIC_CHANNEL
*ch
)
403 /* Set mutator callbacks for test framework support */
404 int ossl_quic_channel_set_mutator(QUIC_CHANNEL
*ch
,
405 ossl_mutate_packet_cb mutatecb
,
406 ossl_finish_mutate_cb finishmutatecb
,
412 ossl_qtx_set_mutator(ch
->qtx
, mutatecb
, finishmutatecb
, mutatearg
);
416 int ossl_quic_channel_get_peer_addr(QUIC_CHANNEL
*ch
, BIO_ADDR
*peer_addr
)
418 *peer_addr
= ch
->cur_peer_addr
;
422 int ossl_quic_channel_set_peer_addr(QUIC_CHANNEL
*ch
, const BIO_ADDR
*peer_addr
)
424 ch
->cur_peer_addr
= *peer_addr
;
428 QUIC_REACTOR
*ossl_quic_channel_get_reactor(QUIC_CHANNEL
*ch
)
433 QUIC_STREAM_MAP
*ossl_quic_channel_get_qsm(QUIC_CHANNEL
*ch
)
438 OSSL_STATM
*ossl_quic_channel_get_statm(QUIC_CHANNEL
*ch
)
443 QUIC_STREAM
*ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL
*ch
,
446 return ossl_quic_stream_map_get_by_id(&ch
->qsm
, stream_id
);
449 int ossl_quic_channel_is_active(const QUIC_CHANNEL
*ch
)
451 return ch
!= NULL
&& ch
->state
== QUIC_CHANNEL_STATE_ACTIVE
;
454 int ossl_quic_channel_is_terminating(const QUIC_CHANNEL
*ch
)
456 if (ch
->state
== QUIC_CHANNEL_STATE_TERMINATING_CLOSING
457 || ch
->state
== QUIC_CHANNEL_STATE_TERMINATING_DRAINING
)
463 int ossl_quic_channel_is_terminated(const QUIC_CHANNEL
*ch
)
465 if (ch
->state
== QUIC_CHANNEL_STATE_TERMINATED
)
471 int ossl_quic_channel_is_term_any(const QUIC_CHANNEL
*ch
)
473 return ossl_quic_channel_is_terminating(ch
)
474 || ossl_quic_channel_is_terminated(ch
);
477 const QUIC_TERMINATE_CAUSE
*
478 ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL
*ch
)
480 return ossl_quic_channel_is_term_any(ch
) ? &ch
->terminate_cause
: NULL
;
483 int ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL
*ch
)
485 return ch
->handshake_complete
;
488 int ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL
*ch
)
490 return ch
->handshake_confirmed
;
493 QUIC_DEMUX
*ossl_quic_channel_get0_demux(QUIC_CHANNEL
*ch
)
498 CRYPTO_MUTEX
*ossl_quic_channel_get_mutex(QUIC_CHANNEL
*ch
)
503 int ossl_quic_channel_has_pending(const QUIC_CHANNEL
*ch
)
505 return ossl_quic_demux_has_pending(ch
->demux
)
506 || ossl_qrx_processed_read_pending(ch
->qrx
);
510 * QUIC Channel: Callbacks from Miscellaneous Subsidiary Components
511 * ================================================================
514 /* Used by various components. */
515 static OSSL_TIME
get_time(void *arg
)
517 QUIC_CHANNEL
*ch
= arg
;
519 if (ch
->now_cb
== NULL
)
520 return ossl_time_now();
522 return ch
->now_cb(ch
->now_cb_arg
);
526 static uint64_t get_stream_limit(int uni
, void *arg
)
528 QUIC_CHANNEL
*ch
= arg
;
530 return uni
? ch
->max_local_streams_uni
: ch
->max_local_streams_bidi
;
534 * Called by QRX to determine if a packet is potentially invalid before trying
537 static int rx_late_validate(QUIC_PN pn
, int pn_space
, void *arg
)
539 QUIC_CHANNEL
*ch
= arg
;
541 /* Potential duplicates should not be processed. */
542 if (!ossl_ackm_is_rx_pn_processable(ch
->ackm
, pn
, pn_space
))
549 * Triggers a TXKU (whether spontaneous or solicited). Does not check whether
550 * spontaneous TXKU is currently allowed.
553 static void ch_trigger_txku(QUIC_CHANNEL
*ch
)
556 = ossl_quic_tx_packetiser_get_next_pn(ch
->txp
, QUIC_PN_SPACE_APP
);
558 if (!ossl_quic_pn_valid(next_pn
)
559 || !ossl_qtx_trigger_key_update(ch
->qtx
)) {
560 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
565 ch
->txku_in_progress
= 1;
566 ch
->txku_pn
= next_pn
;
567 ch
->rxku_expected
= ch
->ku_locally_initiated
;
571 static int txku_in_progress(QUIC_CHANNEL
*ch
)
573 if (ch
->txku_in_progress
574 && ossl_ackm_get_largest_acked(ch
->ackm
, QUIC_PN_SPACE_APP
) >= ch
->txku_pn
) {
575 OSSL_TIME pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
578 * RFC 9001 s. 6.5: Endpoints SHOULD wait three times the PTO before
579 * initiating a key update after receiving an acknowledgment that
580 * confirms that the previous key update was received.
582 * Note that by the above wording, this period starts from when we get
583 * the ack for a TXKU-triggering packet, not when the TXKU is initiated.
584 * So we defer TXKU cooldown deadline calculation to this point.
586 ch
->txku_in_progress
= 0;
587 ch
->txku_cooldown_deadline
= ossl_time_add(get_time(ch
),
588 ossl_time_multiply(pto
, 3));
591 return ch
->txku_in_progress
;
595 static int txku_allowed(QUIC_CHANNEL
*ch
)
597 return ch
->tx_enc_level
== QUIC_ENC_LEVEL_1RTT
/* Sanity check. */
598 /* Strict RFC 9001 criterion for TXKU. */
599 && ch
->handshake_confirmed
600 && !txku_in_progress(ch
);
604 static int txku_recommendable(QUIC_CHANNEL
*ch
)
606 if (!txku_allowed(ch
))
610 /* Recommended RFC 9001 criterion for TXKU. */
611 ossl_time_compare(get_time(ch
), ch
->txku_cooldown_deadline
) >= 0
612 /* Some additional sensible criteria. */
613 && !ch
->rxku_in_progress
614 && !ch
->rxku_pending_confirm
;
618 static int txku_desirable(QUIC_CHANNEL
*ch
)
620 uint64_t cur_pkt_count
, max_pkt_count
, thresh_pkt_count
;
621 const uint32_t enc_level
= QUIC_ENC_LEVEL_1RTT
;
623 /* Check AEAD limit to determine if we should perform a spontaneous TXKU. */
624 cur_pkt_count
= ossl_qtx_get_cur_epoch_pkt_count(ch
->qtx
, enc_level
);
625 max_pkt_count
= ossl_qtx_get_max_epoch_pkt_count(ch
->qtx
, enc_level
);
627 thresh_pkt_count
= max_pkt_count
/ 2;
628 if (ch
->txku_threshold_override
!= UINT64_MAX
)
629 thresh_pkt_count
= ch
->txku_threshold_override
;
631 return cur_pkt_count
>= thresh_pkt_count
;
635 static void ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL
*ch
)
637 if (!txku_recommendable(ch
) || !txku_desirable(ch
))
640 ch
->ku_locally_initiated
= 1;
645 static int rxku_allowed(QUIC_CHANNEL
*ch
)
648 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a key update prior to
649 * having confirmed the handshake (Section 4.1.2).
651 * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a subsequent key update
652 * unless it has received an acknowledgment for a packet that was sent
653 * protected with keys from the current key phase.
655 * RFC 9001 s. 6.2: If an endpoint detects a second update before it has
656 * sent any packets with updated keys containing an acknowledgment for the
657 * packet that initiated the key update, it indicates that its peer has
658 * updated keys twice without awaiting confirmation. An endpoint MAY treat
659 * such consecutive key updates as a connection error of type
662 return ch
->handshake_confirmed
&& !ch
->rxku_pending_confirm
;
666 * Called when the QRX detects a new RX key update event.
670 DECISION_PROTOCOL_VIOLATION
,
671 DECISION_SOLICITED_TXKU
674 /* Called when the QRX detects a key update has occurred. */
676 static void rxku_detected(QUIC_PN pn
, void *arg
)
678 QUIC_CHANNEL
*ch
= arg
;
679 enum rxku_decision decision
;
683 * Note: rxku_in_progress is always 0 here as an RXKU cannot be detected
684 * when we are still in UPDATING or COOLDOWN (see quic_record_rx.h).
686 assert(!ch
->rxku_in_progress
);
688 if (!rxku_allowed(ch
))
689 /* Is RXKU even allowed at this time? */
690 decision
= DECISION_PROTOCOL_VIOLATION
;
692 else if (ch
->ku_locally_initiated
)
694 * If this key update was locally initiated (meaning that this detected
695 * RXKU event is a result of our own spontaneous TXKU), we do not
696 * trigger another TXKU; after all, to do so would result in an infinite
697 * ping-pong of key updates. We still process it as an RXKU.
699 decision
= DECISION_RXKU_ONLY
;
703 * Otherwise, a peer triggering a KU means we have to trigger a KU also.
705 decision
= DECISION_SOLICITED_TXKU
;
707 if (decision
== DECISION_PROTOCOL_VIOLATION
) {
708 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_KEY_UPDATE_ERROR
,
709 0, "RX key update again too soon");
713 pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
715 ch
->ku_locally_initiated
= 0;
716 ch
->rxku_in_progress
= 1;
717 ch
->rxku_pending_confirm
= 1;
718 ch
->rxku_trigger_pn
= pn
;
719 ch
->rxku_update_end_deadline
= ossl_time_add(get_time(ch
), pto
);
720 ch
->rxku_expected
= 0;
722 if (decision
== DECISION_SOLICITED_TXKU
)
723 /* NOT gated by usual txku_allowed() */
727 * Ordinarily, we only generate ACK when some ACK-eliciting frame has been
728 * received. In some cases, this may not occur for a long time, for example
729 * if transmission of application data is going in only one direction and
730 * nothing else is happening with the connection. However, since the peer
731 * cannot initiate a subsequent (spontaneous) TXKU until its prior
732 * (spontaneous or solicited) TXKU has completed - meaning that prior
733 * TXKU's trigger packet (or subsequent packet) has been acknowledged, this
734 * can lead to very long times before a TXKU is considered 'completed'.
735 * Optimise this by forcing ACK generation after triggering TXKU.
736 * (Basically, we consider a RXKU event something that is 'ACK-eliciting',
737 * which it more or less should be; it is necessarily separate from ordinary
738 * processing of ACK-eliciting frames as key update is not indicated via a
741 ossl_quic_tx_packetiser_schedule_ack(ch
->txp
, QUIC_PN_SPACE_APP
);
744 /* Called per tick to handle RXKU timer events. */
746 static void ch_rxku_tick(QUIC_CHANNEL
*ch
)
748 if (!ch
->rxku_in_progress
749 || ossl_time_compare(get_time(ch
), ch
->rxku_update_end_deadline
) < 0)
752 ch
->rxku_update_end_deadline
= ossl_time_infinite();
753 ch
->rxku_in_progress
= 0;
755 if (!ossl_qrx_key_update_timeout(ch
->qrx
, /*normal=*/1))
756 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
757 "RXKU cooldown internal error");
761 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK
*ack
, uint32_t pn_space
,
764 QUIC_CHANNEL
*ch
= arg
;
766 if (pn_space
!= QUIC_PN_SPACE_APP
|| !ch
->rxku_pending_confirm
767 || !ossl_quic_frame_ack_contains_pn(ack
, ch
->rxku_trigger_pn
))
771 * Defer clearing rxku_pending_confirm until TXP generate call returns
774 ch
->rxku_pending_confirm_done
= 1;
778 * QUIC Channel: Handshake Layer Event Handling
779 * ============================================
781 static int ch_on_crypto_send(const unsigned char *buf
, size_t buf_len
,
782 size_t *consumed
, void *arg
)
785 QUIC_CHANNEL
*ch
= arg
;
786 uint32_t enc_level
= ch
->tx_enc_level
;
787 uint32_t pn_space
= ossl_quic_enc_level_to_pn_space(enc_level
);
788 QUIC_SSTREAM
*sstream
= ch
->crypto_send
[pn_space
];
790 if (!ossl_assert(sstream
!= NULL
))
793 ret
= ossl_quic_sstream_append(sstream
, buf
, buf_len
, consumed
);
797 static int crypto_ensure_empty(QUIC_RSTREAM
*rstream
)
805 if (!ossl_quic_rstream_available(rstream
, &avail
, &is_fin
))
811 static int ch_on_crypto_recv_record(const unsigned char **buf
,
812 size_t *bytes_read
, void *arg
)
814 QUIC_CHANNEL
*ch
= arg
;
815 QUIC_RSTREAM
*rstream
;
816 int is_fin
= 0; /* crypto stream is never finished, so we don't use this */
820 * After we move to a later EL we must not allow our peer to send any new
821 * bytes in the crypto stream on a previous EL. Retransmissions of old bytes
824 * In practice we will only move to a new EL when we have consumed all bytes
825 * which should be sent on the crypto stream at a previous EL. For example,
826 * the Handshake EL should not be provisioned until we have completely
827 * consumed a TLS 1.3 ServerHello. Thus when we provision an EL the output
828 * of ossl_quic_rstream_available() should be 0 for all lower ELs. Thus if a
829 * given EL is available we simply ensure we have not received any further
830 * bytes at a lower EL.
832 for (i
= QUIC_ENC_LEVEL_INITIAL
; i
< ch
->rx_enc_level
; ++i
)
833 if (i
!= QUIC_ENC_LEVEL_0RTT
&&
834 !crypto_ensure_empty(ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(i
)])) {
835 /* Protocol violation (RFC 9001 s. 4.1.3) */
836 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
837 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
838 "crypto stream data in wrong EL");
842 rstream
= ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(ch
->rx_enc_level
)];
846 return ossl_quic_rstream_get_record(rstream
, buf
, bytes_read
,
850 static int ch_on_crypto_release_record(size_t bytes_read
, void *arg
)
852 QUIC_CHANNEL
*ch
= arg
;
853 QUIC_RSTREAM
*rstream
;
855 rstream
= ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(ch
->rx_enc_level
)];
859 return ossl_quic_rstream_release_record(rstream
, bytes_read
);
862 static int ch_on_handshake_yield_secret(uint32_t enc_level
, int direction
,
863 uint32_t suite_id
, EVP_MD
*md
,
864 const unsigned char *secret
,
868 QUIC_CHANNEL
*ch
= arg
;
871 if (enc_level
< QUIC_ENC_LEVEL_HANDSHAKE
|| enc_level
>= QUIC_ENC_LEVEL_NUM
)
878 if (enc_level
<= ch
->tx_enc_level
)
880 * Does not make sense for us to try and provision an EL we have already
885 if (!ossl_qtx_provide_secret(ch
->qtx
, enc_level
,
890 ch
->tx_enc_level
= enc_level
;
893 if (enc_level
<= ch
->rx_enc_level
)
895 * Does not make sense for us to try and provision an EL we have already
901 * Ensure all crypto streams for previous ELs are now empty of available
904 for (i
= QUIC_ENC_LEVEL_INITIAL
; i
< enc_level
; ++i
)
905 if (!crypto_ensure_empty(ch
->crypto_recv
[ossl_quic_enc_level_to_pn_space(i
)])) {
906 /* Protocol violation (RFC 9001 s. 4.1.3) */
907 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
908 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
909 "crypto stream data in wrong EL");
913 if (!ossl_qrx_provide_secret(ch
->qrx
, enc_level
,
918 ch
->have_new_rx_secret
= 1;
919 ch
->rx_enc_level
= enc_level
;
925 static int ch_on_handshake_complete(void *arg
)
927 QUIC_CHANNEL
*ch
= arg
;
929 if (!ossl_assert(!ch
->handshake_complete
))
930 return 0; /* this should not happen twice */
932 if (!ossl_assert(ch
->tx_enc_level
== QUIC_ENC_LEVEL_1RTT
))
935 if (!ch
->got_remote_transport_params
) {
937 * Was not a valid QUIC handshake if we did not get valid transport
940 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
941 OSSL_QUIC_FRAME_TYPE_CRYPTO
,
942 "no transport parameters received");
946 /* Don't need transport parameters anymore. */
947 OPENSSL_free(ch
->local_transport_params
);
948 ch
->local_transport_params
= NULL
;
950 /* Tell TXP the handshake is complete. */
951 ossl_quic_tx_packetiser_notify_handshake_complete(ch
->txp
);
953 ch
->handshake_complete
= 1;
957 * On the server, the handshake is confirmed as soon as it is complete.
959 ossl_quic_channel_on_handshake_confirmed(ch
);
961 ossl_quic_tx_packetiser_schedule_handshake_done(ch
->txp
);
967 static int ch_on_handshake_alert(void *arg
, unsigned char alert_code
)
969 QUIC_CHANNEL
*ch
= arg
;
971 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_CRYPTO_ERR_BEGIN
+ alert_code
,
972 0, "handshake alert");
977 * QUIC Channel: Transport Parameter Handling
978 * ==========================================
982 * Called by handshake layer when we receive QUIC Transport Parameters from the
983 * peer. Note that these are not authenticated until the handshake is marked
986 #define TP_REASON_SERVER_ONLY(x) \
987 x " may not be sent by a client"
988 #define TP_REASON_DUP(x) \
989 x " appears multiple times"
990 #define TP_REASON_MALFORMED(x) \
992 #define TP_REASON_EXPECTED_VALUE(x) \
993 x " does not match expected value"
994 #define TP_REASON_NOT_RETRY(x) \
995 x " sent when not performing a retry"
996 #define TP_REASON_REQUIRED(x) \
997 x " was not sent but is required"
999 static void txfc_bump_cwm_bidi(QUIC_STREAM
*s
, void *arg
)
1001 if (!ossl_quic_stream_is_bidi(s
)
1002 || ossl_quic_stream_is_server_init(s
))
1005 ossl_quic_txfc_bump_cwm(&s
->txfc
, *(uint64_t *)arg
);
1008 static void txfc_bump_cwm_uni(QUIC_STREAM
*s
, void *arg
)
1010 if (ossl_quic_stream_is_bidi(s
)
1011 || ossl_quic_stream_is_server_init(s
))
1014 ossl_quic_txfc_bump_cwm(&s
->txfc
, *(uint64_t *)arg
);
1017 static void do_update(QUIC_STREAM
*s
, void *arg
)
1019 QUIC_CHANNEL
*ch
= arg
;
1021 ossl_quic_stream_map_update_state(&ch
->qsm
, s
);
1024 static int ch_on_transport_params(const unsigned char *params
,
1028 QUIC_CHANNEL
*ch
= arg
;
1032 const unsigned char *body
;
1033 int got_orig_dcid
= 0;
1034 int got_initial_scid
= 0;
1035 int got_retry_scid
= 0;
1036 int got_initial_max_data
= 0;
1037 int got_initial_max_stream_data_bidi_local
= 0;
1038 int got_initial_max_stream_data_bidi_remote
= 0;
1039 int got_initial_max_stream_data_uni
= 0;
1040 int got_initial_max_streams_bidi
= 0;
1041 int got_initial_max_streams_uni
= 0;
1042 int got_ack_delay_exp
= 0;
1043 int got_max_ack_delay
= 0;
1044 int got_max_udp_payload_size
= 0;
1045 int got_max_idle_timeout
= 0;
1046 int got_active_conn_id_limit
= 0;
1047 int got_disable_active_migration
= 0;
1049 const char *reason
= "bad transport parameter";
1051 if (ch
->got_remote_transport_params
)
1054 if (!PACKET_buf_init(&pkt
, params
, params_len
))
1057 while (PACKET_remaining(&pkt
) > 0) {
1058 if (!ossl_quic_wire_peek_transport_param(&pkt
, &id
))
1062 case QUIC_TPARAM_ORIG_DCID
:
1063 if (got_orig_dcid
) {
1064 reason
= TP_REASON_DUP("ORIG_DCID");
1068 if (ch
->is_server
) {
1069 reason
= TP_REASON_SERVER_ONLY("ORIG_DCID");
1073 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1074 reason
= TP_REASON_MALFORMED("ORIG_DCID");
1078 /* Must match our initial DCID. */
1079 if (!ossl_quic_conn_id_eq(&ch
->init_dcid
, &cid
)) {
1080 reason
= TP_REASON_EXPECTED_VALUE("ORIG_DCID");
1087 case QUIC_TPARAM_RETRY_SCID
:
1088 if (ch
->is_server
) {
1089 reason
= TP_REASON_SERVER_ONLY("RETRY_SCID");
1093 if (got_retry_scid
) {
1094 reason
= TP_REASON_DUP("RETRY_SCID");
1098 if (!ch
->doing_retry
) {
1099 reason
= TP_REASON_NOT_RETRY("RETRY_SCID");
1103 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1104 reason
= TP_REASON_MALFORMED("RETRY_SCID");
1108 /* Must match Retry packet SCID. */
1109 if (!ossl_quic_conn_id_eq(&ch
->retry_scid
, &cid
)) {
1110 reason
= TP_REASON_EXPECTED_VALUE("RETRY_SCID");
1117 case QUIC_TPARAM_INITIAL_SCID
:
1118 if (got_initial_scid
) {
1119 /* must not appear more than once */
1120 reason
= TP_REASON_DUP("INITIAL_SCID");
1124 if (!ossl_quic_wire_decode_transport_param_cid(&pkt
, NULL
, &cid
)) {
1125 reason
= TP_REASON_MALFORMED("INITIAL_SCID");
1129 /* Must match SCID of first Initial packet from server. */
1130 if (!ossl_quic_conn_id_eq(&ch
->init_scid
, &cid
)) {
1131 reason
= TP_REASON_EXPECTED_VALUE("INITIAL_SCID");
1135 got_initial_scid
= 1;
1138 case QUIC_TPARAM_INITIAL_MAX_DATA
:
1139 if (got_initial_max_data
) {
1140 /* must not appear more than once */
1141 reason
= TP_REASON_DUP("INITIAL_MAX_DATA");
1145 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1146 reason
= TP_REASON_MALFORMED("INITIAL_MAX_DATA");
1150 ossl_quic_txfc_bump_cwm(&ch
->conn_txfc
, v
);
1151 got_initial_max_data
= 1;
1154 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL
:
1155 if (got_initial_max_stream_data_bidi_local
) {
1156 /* must not appear more than once */
1157 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1161 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1162 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1167 * This is correct; the BIDI_LOCAL TP governs streams created by
1168 * the endpoint which sends the TP, i.e., our peer.
1170 ch
->rx_init_max_stream_data_bidi_remote
= v
;
1171 got_initial_max_stream_data_bidi_local
= 1;
1174 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE
:
1175 if (got_initial_max_stream_data_bidi_remote
) {
1176 /* must not appear more than once */
1177 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1181 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1182 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1187 * This is correct; the BIDI_REMOTE TP governs streams created
1188 * by the endpoint which receives the TP, i.e., us.
1190 ch
->rx_init_max_stream_data_bidi_local
= v
;
1192 /* Apply to all existing streams. */
1193 ossl_quic_stream_map_visit(&ch
->qsm
, txfc_bump_cwm_bidi
, &v
);
1194 got_initial_max_stream_data_bidi_remote
= 1;
1197 case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI
:
1198 if (got_initial_max_stream_data_uni
) {
1199 /* must not appear more than once */
1200 reason
= TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_UNI");
1204 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1205 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_UNI");
1209 ch
->rx_init_max_stream_data_uni
= v
;
1211 /* Apply to all existing streams. */
1212 ossl_quic_stream_map_visit(&ch
->qsm
, txfc_bump_cwm_uni
, &v
);
1213 got_initial_max_stream_data_uni
= 1;
1216 case QUIC_TPARAM_ACK_DELAY_EXP
:
1217 if (got_ack_delay_exp
) {
1218 /* must not appear more than once */
1219 reason
= TP_REASON_DUP("ACK_DELAY_EXP");
1223 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1224 || v
> QUIC_MAX_ACK_DELAY_EXP
) {
1225 reason
= TP_REASON_MALFORMED("ACK_DELAY_EXP");
1229 ch
->rx_ack_delay_exp
= (unsigned char)v
;
1230 got_ack_delay_exp
= 1;
1233 case QUIC_TPARAM_MAX_ACK_DELAY
:
1234 if (got_max_ack_delay
) {
1235 /* must not appear more than once */
1236 reason
= TP_REASON_DUP("MAX_ACK_DELAY");
1240 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1241 || v
>= (((uint64_t)1) << 14)) {
1242 reason
= TP_REASON_MALFORMED("MAX_ACK_DELAY");
1246 ch
->rx_max_ack_delay
= v
;
1247 ossl_ackm_set_rx_max_ack_delay(ch
->ackm
,
1248 ossl_ms2time(ch
->rx_max_ack_delay
));
1250 got_max_ack_delay
= 1;
1253 case QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI
:
1254 if (got_initial_max_streams_bidi
) {
1255 /* must not appear more than once */
1256 reason
= TP_REASON_DUP("INITIAL_MAX_STREAMS_BIDI");
1260 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1261 || v
> (((uint64_t)1) << 60)) {
1262 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_BIDI");
1266 assert(ch
->max_local_streams_bidi
== 0);
1267 ch
->max_local_streams_bidi
= v
;
1268 got_initial_max_streams_bidi
= 1;
1271 case QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI
:
1272 if (got_initial_max_streams_uni
) {
1273 /* must not appear more than once */
1274 reason
= TP_REASON_DUP("INITIAL_MAX_STREAMS_UNI");
1278 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1279 || v
> (((uint64_t)1) << 60)) {
1280 reason
= TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_UNI");
1284 assert(ch
->max_local_streams_uni
== 0);
1285 ch
->max_local_streams_uni
= v
;
1286 got_initial_max_streams_uni
= 1;
1289 case QUIC_TPARAM_MAX_IDLE_TIMEOUT
:
1290 if (got_max_idle_timeout
) {
1291 /* must not appear more than once */
1292 reason
= TP_REASON_DUP("MAX_IDLE_TIMEOUT");
1296 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)) {
1297 reason
= TP_REASON_MALFORMED("MAX_IDLE_TIMEOUT");
1301 if (v
> 0 && v
< ch
->max_idle_timeout
)
1302 ch
->max_idle_timeout
= v
;
1305 got_max_idle_timeout
= 1;
1308 case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE
:
1309 if (got_max_udp_payload_size
) {
1310 /* must not appear more than once */
1311 reason
= TP_REASON_DUP("MAX_UDP_PAYLOAD_SIZE");
1315 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1316 || v
< QUIC_MIN_INITIAL_DGRAM_LEN
) {
1317 reason
= TP_REASON_MALFORMED("MAX_UDP_PAYLOAD_SIZE");
1321 ch
->rx_max_udp_payload_size
= v
;
1322 got_max_udp_payload_size
= 1;
1325 case QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT
:
1326 if (got_active_conn_id_limit
) {
1327 /* must not appear more than once */
1328 reason
= TP_REASON_DUP("ACTIVE_CONN_ID_LIMIT");
1332 if (!ossl_quic_wire_decode_transport_param_int(&pkt
, &id
, &v
)
1333 || v
< QUIC_MIN_ACTIVE_CONN_ID_LIMIT
) {
1334 reason
= TP_REASON_MALFORMED("ACTIVE_CONN_ID_LIMIT");
1338 ch
->rx_active_conn_id_limit
= v
;
1339 got_active_conn_id_limit
= 1;
1342 case QUIC_TPARAM_STATELESS_RESET_TOKEN
:
1343 /* TODO(QUIC): Handle stateless reset tokens. */
1345 * We ignore these for now, but we must ensure a client doesn't
1348 if (ch
->is_server
) {
1349 reason
= TP_REASON_SERVER_ONLY("STATELESS_RESET_TOKEN");
1353 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
, &len
);
1354 if (body
== NULL
|| len
!= QUIC_STATELESS_RESET_TOKEN_LEN
) {
1355 reason
= TP_REASON_MALFORMED("STATELESS_RESET_TOKEN");
1361 case QUIC_TPARAM_PREFERRED_ADDR
:
1363 /* TODO(QUIC): Handle preferred address. */
1364 QUIC_PREFERRED_ADDR pfa
;
1367 * RFC 9000 s. 18.2: "A server that chooses a zero-length
1368 * connection ID MUST NOT provide a preferred address.
1369 * Similarly, a server MUST NOT include a zero-length connection
1370 * ID in this transport parameter. A client MUST treat a
1371 * violation of these requirements as a connection error of type
1372 * TRANSPORT_PARAMETER_ERROR."
1374 if (ch
->is_server
) {
1375 reason
= TP_REASON_SERVER_ONLY("PREFERRED_ADDR");
1379 if (ch
->cur_remote_dcid
.id_len
== 0) {
1380 reason
= "PREFERRED_ADDR provided for zero-length CID";
1384 if (!ossl_quic_wire_decode_transport_param_preferred_addr(&pkt
, &pfa
)) {
1385 reason
= TP_REASON_MALFORMED("PREFERRED_ADDR");
1389 if (pfa
.cid
.id_len
== 0) {
1390 reason
= "zero-length CID in PREFERRED_ADDR";
1396 case QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION
:
1397 /* We do not currently handle migration, so nothing to do. */
1398 if (got_disable_active_migration
) {
1399 /* must not appear more than once */
1400 reason
= TP_REASON_DUP("DISABLE_ACTIVE_MIGRATION");
1404 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
, &len
);
1405 if (body
== NULL
|| len
> 0) {
1406 reason
= TP_REASON_MALFORMED("DISABLE_ACTIVE_MIGRATION");
1410 got_disable_active_migration
= 1;
1415 * Skip over and ignore.
1417 * RFC 9000 s. 7.4: We SHOULD treat duplicated transport parameters
1418 * as a connection error, but we are not required to. Currently,
1419 * handle this programmatically by checking for duplicates in the
1420 * parameters that we recognise, as above, but don't bother
1421 * maintaining a list of duplicates for anything we don't recognise.
1423 body
= ossl_quic_wire_decode_transport_param_bytes(&pkt
, &id
,
1432 if (!got_initial_scid
) {
1433 reason
= TP_REASON_REQUIRED("INITIAL_SCID");
1437 if (!ch
->is_server
) {
1438 if (!got_orig_dcid
) {
1439 reason
= TP_REASON_REQUIRED("ORIG_DCID");
1443 if (ch
->doing_retry
&& !got_retry_scid
) {
1444 reason
= TP_REASON_REQUIRED("RETRY_SCID");
1449 ch
->got_remote_transport_params
= 1;
1451 if (got_initial_max_data
|| got_initial_max_stream_data_bidi_remote
1452 || got_initial_max_streams_bidi
|| got_initial_max_streams_uni
)
1454 * If FC credit was bumped, we may now be able to send. Update all
1457 ossl_quic_stream_map_visit(&ch
->qsm
, do_update
, ch
);
1459 /* If we are a server, we now generate our own transport parameters. */
1460 if (ch
->is_server
&& !ch_generate_transport_params(ch
)) {
1461 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
1469 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_TRANSPORT_PARAMETER_ERROR
,
1475 * Called when we want to generate transport parameters. This is called
1476 * immediately at instantiation time for a client and after we receive the
1477 * client's transport parameters for a server.
1479 static int ch_generate_transport_params(QUIC_CHANNEL
*ch
)
1482 BUF_MEM
*buf_mem
= NULL
;
1487 if (ch
->local_transport_params
!= NULL
)
1490 if ((buf_mem
= BUF_MEM_new()) == NULL
)
1493 if (!WPACKET_init(&wpkt
, buf_mem
))
1498 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt
, QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION
,
1502 if (ch
->is_server
) {
1503 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt
, QUIC_TPARAM_ORIG_DCID
,
1507 if (!ossl_quic_wire_encode_transport_param_cid(&wpkt
, QUIC_TPARAM_INITIAL_SCID
,
1508 &ch
->cur_local_cid
))
1511 /* Client always uses an empty SCID. */
1512 if (ossl_quic_wire_encode_transport_param_bytes(&wpkt
, QUIC_TPARAM_INITIAL_SCID
,
1517 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_IDLE_TIMEOUT
,
1518 ch
->max_idle_timeout
))
1521 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE
,
1522 QUIC_MIN_INITIAL_DGRAM_LEN
))
1525 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT
,
1526 QUIC_MIN_ACTIVE_CONN_ID_LIMIT
))
1529 if (ch
->tx_max_ack_delay
!= QUIC_DEFAULT_MAX_ACK_DELAY
1530 && !ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_MAX_ACK_DELAY
,
1531 ch
->tx_max_ack_delay
))
1534 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_DATA
,
1535 ossl_quic_rxfc_get_cwm(&ch
->conn_rxfc
)))
1538 /* Send the default CWM for a new RXFC. */
1539 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL
,
1540 ch
->tx_init_max_stream_data_bidi_local
))
1543 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE
,
1544 ch
->tx_init_max_stream_data_bidi_remote
))
1547 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI
,
1548 ch
->tx_init_max_stream_data_uni
))
1551 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI
,
1552 ossl_quic_rxfc_get_cwm(&ch
->max_streams_bidi_rxfc
)))
1555 if (!ossl_quic_wire_encode_transport_param_int(&wpkt
, QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI
,
1556 ossl_quic_rxfc_get_cwm(&ch
->max_streams_uni_rxfc
)))
1559 if (!WPACKET_finish(&wpkt
))
1564 if (!WPACKET_get_total_written(&wpkt
, &buf_len
))
1567 ch
->local_transport_params
= (unsigned char *)buf_mem
->data
;
1568 buf_mem
->data
= NULL
;
1571 if (!ossl_quic_tls_set_transport_params(ch
->qtls
, ch
->local_transport_params
,
1578 WPACKET_cleanup(&wpkt
);
1579 BUF_MEM_free(buf_mem
);
1584 * QUIC Channel: Ticker-Mutator
1585 * ============================
1589 * The central ticker function called by the reactor. This does everything, or
1590 * at least everything network I/O related. Best effort - not allowed to fail
1593 static void ch_tick(QUIC_TICK_RESULT
*res
, void *arg
, uint32_t flags
)
1595 OSSL_TIME now
, deadline
;
1596 QUIC_CHANNEL
*ch
= arg
;
1597 int channel_only
= (flags
& QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY
) != 0;
1600 * When we tick the QUIC connection, we do everything we need to do
1601 * periodically. In order, we:
1603 * - handle any incoming data from the network;
1604 * - handle any timer events which are due to fire (ACKM, etc.)
1605 * - write any data to the network due to be sent, to the extent
1607 * - determine the time at which we should next be ticked.
1610 /* If we are in the TERMINATED state, there is nothing to do. */
1611 if (ossl_quic_channel_is_terminated(ch
)) {
1612 res
->net_read_desired
= 0;
1613 res
->net_write_desired
= 0;
1614 res
->tick_deadline
= ossl_time_infinite();
1619 * If we are in the TERMINATING state, check if the terminating timer has
1622 if (ossl_quic_channel_is_terminating(ch
)) {
1625 if (ossl_time_compare(now
, ch
->terminate_deadline
) >= 0) {
1626 ch_on_terminating_timeout(ch
);
1627 res
->net_read_desired
= 0;
1628 res
->net_write_desired
= 0;
1629 res
->tick_deadline
= ossl_time_infinite();
1630 return; /* abort normal processing, nothing to do */
1634 if (!ch
->inhibit_tick
) {
1635 /* Handle RXKU timeouts. */
1638 /* Handle any incoming data from network. */
1642 /* Process queued incoming packets. */
1646 * Allow the handshake layer to check for any new incoming data and
1647 * generate new outgoing data.
1649 ch
->have_new_rx_secret
= 0;
1651 ossl_quic_tls_tick(ch
->qtls
);
1654 * If the handshake layer gave us a new secret, we need to do RX
1655 * again because packets that were not previously processable and
1656 * were deferred might now be processable.
1658 * TODO(QUIC): Consider handling this in the yield_secret callback.
1660 } while (ch
->have_new_rx_secret
);
1664 * Handle any timer events which are due to fire; namely, the loss
1665 * detection deadline and the idle timeout.
1667 * ACKM ACK generation deadline is polled by TXP, so we don't need to
1671 if (ossl_time_compare(now
, ch
->idle_deadline
) >= 0) {
1673 * Idle timeout differs from normal protocol violation because we do
1674 * not send a CONN_CLOSE frame; go straight to TERMINATED.
1676 if (!ch
->inhibit_tick
)
1677 ch_on_idle_timeout(ch
);
1679 res
->net_read_desired
= 0;
1680 res
->net_write_desired
= 0;
1681 res
->tick_deadline
= ossl_time_infinite();
1685 if (!ch
->inhibit_tick
) {
1686 deadline
= ossl_ackm_get_loss_detection_deadline(ch
->ackm
);
1687 if (!ossl_time_is_zero(deadline
)
1688 && ossl_time_compare(now
, deadline
) >= 0)
1689 ossl_ackm_on_timeout(ch
->ackm
);
1691 /* If a ping is due, inform TXP. */
1692 if (ossl_time_compare(now
, ch
->ping_deadline
) >= 0) {
1693 int pn_space
= ossl_quic_enc_level_to_pn_space(ch
->tx_enc_level
);
1695 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch
->txp
, pn_space
);
1698 /* Write any data to the network due to be sent. */
1702 ossl_quic_stream_map_gc(&ch
->qsm
);
1705 /* Determine the time at which we should next be ticked. */
1706 res
->tick_deadline
= ch_determine_next_tick_deadline(ch
);
1709 * Always process network input unless we are now terminated.
1710 * Although we had not terminated at the beginning of this tick, network
1711 * errors in ch_rx_pre() or ch_tx() may have caused us to transition to the
1714 res
->net_read_desired
= !ossl_quic_channel_is_terminated(ch
);
1716 /* We want to write to the network if we have any in our queue. */
1717 res
->net_write_desired
1718 = (!ossl_quic_channel_is_terminated(ch
)
1719 && ossl_qtx_get_queue_len_datagrams(ch
->qtx
) > 0);
1722 /* Process incoming datagrams, if any. */
1723 static void ch_rx_pre(QUIC_CHANNEL
*ch
)
1727 if (!ch
->is_server
&& !ch
->have_sent_any_pkt
)
1731 * Get DEMUX to BIO_recvmmsg from the network and queue incoming datagrams
1732 * to the appropriate QRX instance.
1734 ret
= ossl_quic_demux_pump(ch
->demux
);
1735 if (ret
== QUIC_DEMUX_PUMP_RES_PERMANENT_FAIL
)
1737 * We don't care about transient failure, but permanent failure means we
1738 * should tear down the connection as though a protocol violation
1739 * occurred. Skip straight to the Terminating state as there is no point
1740 * trying to send CONNECTION_CLOSE frames if the network BIO is not
1741 * operating correctly.
1743 ch_raise_net_error(ch
);
1746 /* Check incoming forged packet limit and terminate connection if needed. */
1747 static void ch_rx_check_forged_pkt_limit(QUIC_CHANNEL
*ch
)
1750 uint64_t limit
= UINT64_MAX
, l
;
1752 for (enc_level
= QUIC_ENC_LEVEL_INITIAL
;
1753 enc_level
< QUIC_ENC_LEVEL_NUM
;
1757 * Different ELs can have different AEADs which can in turn impose
1758 * different limits, so use the lowest value of any currently valid EL.
1760 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
1763 if (enc_level
> ch
->rx_enc_level
)
1766 l
= ossl_qrx_get_max_forged_pkt_count(ch
->qrx
, enc_level
);
1771 if (ossl_qrx_get_cur_forged_pkt_count(ch
->qrx
) < limit
)
1774 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_AEAD_LIMIT_REACHED
, 0,
1778 /* Process queued incoming packets and handle frames, if any. */
1779 static int ch_rx(QUIC_CHANNEL
*ch
)
1781 int handled_any
= 0;
1783 if (!ch
->is_server
&& !ch
->have_sent_any_pkt
)
1785 * We have not sent anything yet, therefore there is no need to check
1786 * for incoming data.
1791 assert(ch
->qrx_pkt
== NULL
);
1793 if (!ossl_qrx_read_pkt(ch
->qrx
, &ch
->qrx_pkt
))
1799 ch_rx_handle_packet(ch
); /* best effort */
1802 * Regardless of the outcome of frame handling, unref the packet.
1803 * This will free the packet unless something added another
1804 * reference to it during frame processing.
1806 ossl_qrx_pkt_release(ch
->qrx_pkt
);
1809 ch
->have_sent_ack_eliciting_since_rx
= 0;
1813 ch_rx_check_forged_pkt_limit(ch
);
1816 * When in TERMINATING - CLOSING, generate a CONN_CLOSE frame whenever we
1817 * process one or more incoming packets.
1819 if (handled_any
&& ch
->state
== QUIC_CHANNEL_STATE_TERMINATING_CLOSING
)
1820 ch
->conn_close_queued
= 1;
1825 static int bio_addr_eq(const BIO_ADDR
*a
, const BIO_ADDR
*b
)
1827 if (BIO_ADDR_family(a
) != BIO_ADDR_family(b
))
1830 switch (BIO_ADDR_family(a
)) {
1832 return !memcmp(&a
->s_in
.sin_addr
,
1834 sizeof(a
->s_in
.sin_addr
))
1835 && a
->s_in
.sin_port
== b
->s_in
.sin_port
;
1836 #if OPENSSL_USE_IPV6
1838 return !memcmp(&a
->s_in6
.sin6_addr
,
1839 &b
->s_in6
.sin6_addr
,
1840 sizeof(a
->s_in6
.sin6_addr
))
1841 && a
->s_in6
.sin6_port
== b
->s_in6
.sin6_port
;
1844 return 0; /* not supported */
1850 /* Handles the packet currently in ch->qrx_pkt->hdr. */
1851 static void ch_rx_handle_packet(QUIC_CHANNEL
*ch
)
1855 assert(ch
->qrx_pkt
!= NULL
);
1857 if (!ossl_quic_channel_is_active(ch
))
1858 /* Do not process packets once we are terminating. */
1861 if (ossl_quic_pkt_type_is_encrypted(ch
->qrx_pkt
->hdr
->type
)) {
1862 if (!ch
->have_received_enc_pkt
) {
1863 ch
->cur_remote_dcid
= ch
->init_scid
= ch
->qrx_pkt
->hdr
->src_conn_id
;
1864 ch
->have_received_enc_pkt
= 1;
1867 * We change to using the SCID in the first Initial packet as the
1870 ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->init_scid
);
1873 enc_level
= ossl_quic_pkt_type_to_enc_level(ch
->qrx_pkt
->hdr
->type
);
1874 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
1875 /* Do not process packets from ELs we have already discarded. */
1880 * RFC 9000 s. 9.6: "If a client receives packets from a new server address
1881 * when the client has not initiated a migration to that address, the client
1882 * SHOULD discard these packets."
1884 * We need to be a bit careful here as due to the BIO abstraction layer an
1885 * application is liable to be weird and lie to us about peer addresses.
1886 * Only apply this check if we actually are using a real AF_INET or AF_INET6
1890 && ch
->qrx_pkt
->peer
!= NULL
1892 BIO_ADDR_family(&ch
->cur_peer_addr
) == AF_INET
1893 #if OPENSSL_USE_IPV6
1894 || BIO_ADDR_family(&ch
->cur_peer_addr
) == AF_INET6
1897 && !bio_addr_eq(ch
->qrx_pkt
->peer
, &ch
->cur_peer_addr
))
1901 && ch
->have_received_enc_pkt
1902 && ossl_quic_pkt_type_has_scid(ch
->qrx_pkt
->hdr
->type
)) {
1904 * RFC 9000 s. 7.2: "Once a client has received a valid Initial packet
1905 * from the server, it MUST discard any subsequent packet it receives on
1906 * that connection with a different SCID."
1908 if (!ossl_quic_conn_id_eq(&ch
->qrx_pkt
->hdr
->src_conn_id
,
1913 if (ossl_quic_pkt_type_has_version(ch
->qrx_pkt
->hdr
->type
)
1914 && ch
->qrx_pkt
->hdr
->version
!= QUIC_VERSION_1
)
1916 * RFC 9000 s. 5.2.1: If a client receives a packet that uses a
1917 * different version than it initially selected, it MUST discard the
1918 * packet. We only ever use v1, so require it.
1923 * RFC 9000 s. 17.2: "An endpoint MUST treat receipt of a packet that has a
1924 * non-zero value for [the reserved bits] after removing both packet and
1925 * header protection as a connection error of type PROTOCOL_VIOLATION."
1927 if (ossl_quic_pkt_type_is_encrypted(ch
->qrx_pkt
->hdr
->type
)
1928 && ch
->qrx_pkt
->hdr
->reserved
!= 0) {
1929 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
1930 0, "packet header reserved bits");
1934 /* Handle incoming packet. */
1935 switch (ch
->qrx_pkt
->hdr
->type
) {
1936 case QUIC_PKT_TYPE_RETRY
:
1937 if (ch
->doing_retry
|| ch
->is_server
)
1939 * It is not allowed to ask a client to do a retry more than
1940 * once. Clients may not send retries.
1944 if (ch
->qrx_pkt
->hdr
->len
<= QUIC_RETRY_INTEGRITY_TAG_LEN
)
1945 /* Packets with zero-length Retry Tokens are invalid. */
1949 * TODO(QUIC): Theoretically this should probably be in the QRX.
1950 * However because validation is dependent on context (namely the
1951 * client's initial DCID) we can't do this cleanly. In the future we
1952 * should probably add a callback to the QRX to let it call us (via
1953 * the DEMUX) and ask us about the correct original DCID, rather
1954 * than allow the QRX to emit a potentially malformed packet to the
1955 * upper layers. However, special casing this will do for now.
1957 if (!ossl_quic_validate_retry_integrity_tag(ch
->libctx
,
1961 /* Malformed retry packet, ignore. */
1964 ch_retry(ch
, ch
->qrx_pkt
->hdr
->data
,
1965 ch
->qrx_pkt
->hdr
->len
- QUIC_RETRY_INTEGRITY_TAG_LEN
,
1966 &ch
->qrx_pkt
->hdr
->src_conn_id
);
1969 case QUIC_PKT_TYPE_0RTT
:
1971 /* Clients should never receive 0-RTT packets. */
1975 * TODO(QUIC): Implement 0-RTT on the server side. We currently do
1976 * not need to implement this as a client can only do 0-RTT if we
1977 * have given it permission to in a previous session.
1981 case QUIC_PKT_TYPE_INITIAL
:
1982 case QUIC_PKT_TYPE_HANDSHAKE
:
1983 case QUIC_PKT_TYPE_1RTT
:
1984 if (ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_HANDSHAKE
)
1986 * We automatically drop INITIAL EL keys when first successfully
1987 * decrypting a HANDSHAKE packet, as per the RFC.
1989 ch_discard_el(ch
, QUIC_ENC_LEVEL_INITIAL
);
1991 if (ch
->rxku_in_progress
1992 && ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_1RTT
1993 && ch
->qrx_pkt
->pn
>= ch
->rxku_trigger_pn
1994 && ch
->qrx_pkt
->key_epoch
< ossl_qrx_get_key_epoch(ch
->qrx
)) {
1996 * RFC 9001 s. 6.4: Packets with higher packet numbers MUST be
1997 * protected with either the same or newer packet protection keys
1998 * than packets with lower packet numbers. An endpoint that
1999 * successfully removes protection with old keys when newer keys
2000 * were used for packets with lower packet numbers MUST treat this
2001 * as a connection error of type KEY_UPDATE_ERROR.
2003 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_KEY_UPDATE_ERROR
,
2004 0, "new packet with old keys");
2009 && ch
->qrx_pkt
->hdr
->type
== QUIC_PKT_TYPE_INITIAL
2010 && ch
->qrx_pkt
->hdr
->token_len
> 0) {
2012 * RFC 9000 s. 17.2.2: Clients that receive an Initial packet with a
2013 * non-zero Token Length field MUST either discard the packet or
2014 * generate a connection error of type PROTOCOL_VIOLATION.
2016 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
2017 0, "client received initial token");
2021 /* This packet contains frames, pass to the RXDP. */
2022 ossl_quic_handle_frames(ch
, ch
->qrx_pkt
); /* best effort */
2032 * This is called by the demux when we get a packet not destined for any known
2035 static void ch_default_packet_handler(QUIC_URXE
*e
, void *arg
)
2037 QUIC_CHANNEL
*ch
= arg
;
2041 if (!ossl_assert(ch
->is_server
))
2045 * We only support one connection to our server currently, so if we already
2046 * started one, ignore any new connection attempts.
2048 if (ch
->state
!= QUIC_CHANNEL_STATE_IDLE
)
2052 * We have got a packet for an unknown DCID. This might be an attempt to
2053 * open a new connection.
2055 if (e
->data_len
< QUIC_MIN_INITIAL_DGRAM_LEN
)
2058 if (!PACKET_buf_init(&pkt
, ossl_quic_urxe_data(e
), e
->data_len
))
2062 * We set short_conn_id_len to SIZE_MAX here which will cause the decode
2063 * operation to fail if we get a 1-RTT packet. This is fine since we only
2064 * care about Initial packets.
2066 if (!ossl_quic_wire_decode_pkt_hdr(&pkt
, SIZE_MAX
, 1, 0, &hdr
, NULL
))
2069 switch (hdr
.version
) {
2070 case QUIC_VERSION_1
:
2073 case QUIC_VERSION_NONE
:
2075 /* Unknown version or proactive version negotiation request, bail. */
2076 /* TODO(QUIC): Handle version negotiation on server side */
2081 * We only care about Initial packets which might be trying to establish a
2084 if (hdr
.type
!= QUIC_PKT_TYPE_INITIAL
)
2088 * Assume this is a valid attempt to initiate a connection.
2090 * We do not register the DCID in the initial packet we received and that
2091 * DCID is not actually used again, thus after provisioning the correct
2092 * Initial keys derived from it (which is done in the call below) we pass
2093 * the received packet directly to the QRX so that it can process it as a
2094 * one-time thing, instead of going through the usual DEMUX DCID-based
2097 if (!ch_server_on_new_conn(ch
, &e
->peer
,
2102 ossl_qrx_inject_urxe(ch
->qrx
, e
);
2106 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
2109 ossl_quic_demux_release_urxe(ch
->demux
, e
);
2112 /* Try to generate packets and if possible, flush them to the network. */
2113 static int ch_tx(QUIC_CHANNEL
*ch
)
2115 QUIC_TXP_STATUS status
;
2117 if (ch
->state
== QUIC_CHANNEL_STATE_TERMINATING_CLOSING
) {
2119 * While closing, only send CONN_CLOSE if we've received more traffic
2120 * from the peer. Once we tell the TXP to generate CONN_CLOSE, all
2121 * future calls to it generate CONN_CLOSE frames, so otherwise we would
2122 * just constantly generate CONN_CLOSE frames.
2124 * Conforming to RFC 9000 s. 10.2.1 Closing Connection State:
2125 * An endpoint SHOULD limit the rate at which it generates
2126 * packets in the closing state. TODO(QUIC)
2128 if (!ch
->conn_close_queued
)
2131 ch
->conn_close_queued
= 0;
2134 /* Do TXKU if we need to. */
2135 ch_maybe_trigger_spontaneous_txku(ch
);
2137 ch
->rxku_pending_confirm_done
= 0;
2140 * Send a packet, if we need to. Best effort. The TXP consults the CC and
2141 * applies any limitations imposed by it, so we don't need to do it here.
2143 * Best effort. In particular if TXP fails for some reason we should still
2144 * flush any queued packets which we already generated.
2146 switch (ossl_quic_tx_packetiser_generate(ch
->txp
, &status
)) {
2147 case TX_PACKETISER_RES_SENT_PKT
:
2148 ch
->have_sent_any_pkt
= 1; /* Packet was sent */
2151 * RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when
2152 * sending an ack-eliciting packet if no other ack-eliciting packets
2153 * have been sent since last receiving and processing a packet.'
2155 if (status
.sent_ack_eliciting
&& !ch
->have_sent_ack_eliciting_since_rx
) {
2157 ch
->have_sent_ack_eliciting_since_rx
= 1;
2160 if (ch
->rxku_pending_confirm_done
)
2161 ch
->rxku_pending_confirm
= 0;
2163 ch_update_ping_deadline(ch
);
2166 case TX_PACKETISER_RES_NO_PKT
:
2167 break; /* No packet was sent */
2171 * One case where TXP can fail is if we reach a TX PN of 2**62 - 1. As
2172 * per RFC 9000 s. 12.3, if this happens we MUST close the connection
2173 * without sending a CONNECTION_CLOSE frame. This is actually handled as
2174 * an emergent consequence of our design, as the TX packetiser will
2175 * never transmit another packet when the TX PN reaches the limit.
2177 * Calling the below function terminates the connection; its attempt to
2178 * schedule a CONNECTION_CLOSE frame will not actually cause a packet to
2179 * be transmitted for this reason.
2181 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_INTERNAL_ERROR
, 0,
2183 break; /* Internal failure (e.g. allocation, assertion) */
2186 /* Flush packets to network. */
2187 switch (ossl_qtx_flush_net(ch
->qtx
)) {
2188 case QTX_FLUSH_NET_RES_OK
:
2189 case QTX_FLUSH_NET_RES_TRANSIENT_FAIL
:
2190 /* Best effort, done for now. */
2193 case QTX_FLUSH_NET_RES_PERMANENT_FAIL
:
2195 /* Permanent underlying network BIO, start terminating. */
2196 ch_raise_net_error(ch
);
2203 /* Determine next tick deadline. */
2204 static OSSL_TIME
ch_determine_next_tick_deadline(QUIC_CHANNEL
*ch
)
2209 if (ossl_quic_channel_is_terminated(ch
))
2210 return ossl_time_infinite();
2212 deadline
= ossl_ackm_get_loss_detection_deadline(ch
->ackm
);
2213 if (ossl_time_is_zero(deadline
))
2214 deadline
= ossl_time_infinite();
2217 * If the CC will let us send acks, check the ack deadline for all
2218 * enc_levels that are actually provisioned
2220 if (ch
->cc_method
->get_tx_allowance(ch
->cc_data
) > 0) {
2221 for (i
= 0; i
< QUIC_ENC_LEVEL_NUM
; i
++) {
2222 if (ossl_qtx_is_enc_level_provisioned(ch
->qtx
, i
)) {
2223 deadline
= ossl_time_min(deadline
,
2224 ossl_ackm_get_ack_deadline(ch
->ackm
,
2225 ossl_quic_enc_level_to_pn_space(i
)));
2230 /* Apply TXP wakeup deadline. */
2231 deadline
= ossl_time_min(deadline
,
2232 ossl_quic_tx_packetiser_get_deadline(ch
->txp
));
2234 /* Is the terminating timer armed? */
2235 if (ossl_quic_channel_is_terminating(ch
))
2236 deadline
= ossl_time_min(deadline
,
2237 ch
->terminate_deadline
);
2238 else if (!ossl_time_is_infinite(ch
->idle_deadline
))
2239 deadline
= ossl_time_min(deadline
,
2243 * When do we need to send an ACK-eliciting packet to reset the idle
2244 * deadline timer for the peer?
2246 if (!ossl_time_is_infinite(ch
->ping_deadline
))
2247 deadline
= ossl_time_min(deadline
,
2250 /* When does the RXKU process complete? */
2251 if (ch
->rxku_in_progress
)
2252 deadline
= ossl_time_min(deadline
, ch
->rxku_update_end_deadline
);
2258 * QUIC Channel: Network BIO Configuration
2259 * =======================================
2262 /* Determines whether we can support a given poll descriptor. */
2263 static int validate_poll_descriptor(const BIO_POLL_DESCRIPTOR
*d
)
2265 if (d
->type
== BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD
&& d
->value
.fd
< 0)
2271 BIO
*ossl_quic_channel_get_net_rbio(QUIC_CHANNEL
*ch
)
2273 return ch
->net_rbio
;
2276 BIO
*ossl_quic_channel_get_net_wbio(QUIC_CHANNEL
*ch
)
2278 return ch
->net_wbio
;
2282 * QUIC_CHANNEL does not ref any BIO it is provided with, nor is any ref
2283 * transferred to it. The caller (i.e., QUIC_CONNECTION) is responsible for
2284 * ensuring the BIO lasts until the channel is freed or the BIO is switched out
2285 * for another BIO by a subsequent successful call to this function.
2287 int ossl_quic_channel_set_net_rbio(QUIC_CHANNEL
*ch
, BIO
*net_rbio
)
2289 BIO_POLL_DESCRIPTOR d
= {0};
2291 if (ch
->net_rbio
== net_rbio
)
2294 if (net_rbio
!= NULL
) {
2295 if (!BIO_get_rpoll_descriptor(net_rbio
, &d
))
2296 /* Non-pollable BIO */
2297 d
.type
= BIO_POLL_DESCRIPTOR_TYPE_NONE
;
2299 if (!validate_poll_descriptor(&d
))
2303 ossl_quic_reactor_set_poll_r(&ch
->rtor
, &d
);
2304 ossl_quic_demux_set_bio(ch
->demux
, net_rbio
);
2305 ch
->net_rbio
= net_rbio
;
2309 int ossl_quic_channel_set_net_wbio(QUIC_CHANNEL
*ch
, BIO
*net_wbio
)
2311 BIO_POLL_DESCRIPTOR d
= {0};
2313 if (ch
->net_wbio
== net_wbio
)
2316 if (net_wbio
!= NULL
) {
2317 if (!BIO_get_wpoll_descriptor(net_wbio
, &d
))
2318 /* Non-pollable BIO */
2319 d
.type
= BIO_POLL_DESCRIPTOR_TYPE_NONE
;
2321 if (!validate_poll_descriptor(&d
))
2325 ossl_quic_reactor_set_poll_w(&ch
->rtor
, &d
);
2326 ossl_qtx_set_bio(ch
->qtx
, net_wbio
);
2327 ch
->net_wbio
= net_wbio
;
2332 * QUIC Channel: Lifecycle Events
2333 * ==============================
2335 int ossl_quic_channel_start(QUIC_CHANNEL
*ch
)
2339 * This is not used by the server. The server moves to active
2340 * automatically on receiving an incoming connection.
2344 if (ch
->state
!= QUIC_CHANNEL_STATE_IDLE
)
2345 /* Calls to connect are idempotent */
2348 /* Inform QTX of peer address. */
2349 if (!ossl_quic_tx_packetiser_set_peer(ch
->txp
, &ch
->cur_peer_addr
))
2352 /* Plug in secrets for the Initial EL. */
2353 if (!ossl_quic_provide_initial_secret(ch
->libctx
,
2361 ch
->state
= QUIC_CHANNEL_STATE_ACTIVE
;
2362 ch
->doing_proactive_ver_neg
= 0; /* not currently supported */
2364 /* Handshake layer: start (e.g. send CH). */
2365 if (!ossl_quic_tls_tick(ch
->qtls
))
2368 ossl_quic_reactor_tick(&ch
->rtor
, 0); /* best effort */
2372 /* Start a locally initiated connection shutdown. */
2373 void ossl_quic_channel_local_close(QUIC_CHANNEL
*ch
, uint64_t app_error_code
)
2375 QUIC_TERMINATE_CAUSE tcause
= {0};
2377 if (ossl_quic_channel_is_term_any(ch
))
2381 tcause
.error_code
= app_error_code
;
2382 ch_start_terminating(ch
, &tcause
, 0);
2385 static void free_token(const unsigned char *buf
, size_t buf_len
, void *arg
)
2387 OPENSSL_free((unsigned char *)buf
);
2390 /* Called when a server asks us to do a retry. */
2391 static int ch_retry(QUIC_CHANNEL
*ch
,
2392 const unsigned char *retry_token
,
2393 size_t retry_token_len
,
2394 const QUIC_CONN_ID
*retry_scid
)
2399 * RFC 9000 s. 17.2.5.1: "A client MUST discard a Retry packet that contains
2400 * a SCID field that is identical to the DCID field of its initial packet."
2402 if (ossl_quic_conn_id_eq(&ch
->init_dcid
, retry_scid
))
2405 /* We change to using the SCID in the Retry packet as the DCID. */
2406 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, retry_scid
))
2410 * Now we retry. We will release the Retry packet immediately, so copy
2413 if ((buf
= OPENSSL_memdup(retry_token
, retry_token_len
)) == NULL
)
2416 ossl_quic_tx_packetiser_set_initial_token(ch
->txp
, buf
, retry_token_len
,
2419 ch
->retry_scid
= *retry_scid
;
2420 ch
->doing_retry
= 1;
2423 * We need to stimulate the Initial EL to generate the first CRYPTO frame
2424 * again. We can do this most cleanly by simply forcing the ACKM to consider
2425 * the first Initial packet as lost, which it effectively was as the server
2426 * hasn't processed it. This also maintains the desired behaviour with e.g.
2427 * PNs not resetting and so on.
2429 * The PN we used initially is always zero, because QUIC does not allow
2432 if (!ossl_ackm_mark_packet_pseudo_lost(ch
->ackm
, QUIC_PN_SPACE_INITIAL
,
2437 * Plug in new secrets for the Initial EL. This is the only time we change
2438 * the secrets for an EL after we already provisioned it.
2440 if (!ossl_quic_provide_initial_secret(ch
->libctx
,
2450 /* Called when an EL is to be discarded. */
2451 static int ch_discard_el(QUIC_CHANNEL
*ch
,
2454 if (!ossl_assert(enc_level
< QUIC_ENC_LEVEL_1RTT
))
2457 if ((ch
->el_discarded
& (1U << enc_level
)) != 0)
2461 /* Best effort for all of these. */
2462 ossl_quic_tx_packetiser_discard_enc_level(ch
->txp
, enc_level
);
2463 ossl_qrx_discard_enc_level(ch
->qrx
, enc_level
);
2464 ossl_qtx_discard_enc_level(ch
->qtx
, enc_level
);
2466 if (enc_level
!= QUIC_ENC_LEVEL_0RTT
) {
2467 uint32_t pn_space
= ossl_quic_enc_level_to_pn_space(enc_level
);
2469 ossl_ackm_on_pkt_space_discarded(ch
->ackm
, pn_space
);
2471 /* We should still have crypto streams at this point. */
2472 if (!ossl_assert(ch
->crypto_send
[pn_space
] != NULL
)
2473 || !ossl_assert(ch
->crypto_recv
[pn_space
] != NULL
))
2476 /* Get rid of the crypto stream state for the EL. */
2477 ossl_quic_sstream_free(ch
->crypto_send
[pn_space
]);
2478 ch
->crypto_send
[pn_space
] = NULL
;
2480 ossl_quic_rstream_free(ch
->crypto_recv
[pn_space
]);
2481 ch
->crypto_recv
[pn_space
] = NULL
;
2484 ch
->el_discarded
|= (1U << enc_level
);
2488 /* Intended to be called by the RXDP. */
2489 int ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL
*ch
)
2491 if (ch
->handshake_confirmed
)
2494 if (!ch
->handshake_complete
) {
2496 * Does not make sense for handshake to be confirmed before it is
2499 ossl_quic_channel_raise_protocol_error(ch
, QUIC_ERR_PROTOCOL_VIOLATION
,
2500 OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE
,
2501 "handshake cannot be confirmed "
2502 "before it is completed");
2506 ch_discard_el(ch
, QUIC_ENC_LEVEL_HANDSHAKE
);
2507 ch
->handshake_confirmed
= 1;
2508 ossl_ackm_on_handshake_confirmed(ch
->ackm
);
2513 * Master function used when we want to start tearing down a connection:
2515 * - If the connection is still IDLE we can go straight to TERMINATED;
2517 * - If we are already TERMINATED this is a no-op.
2519 * - If we are TERMINATING - CLOSING and we have now got a CONNECTION_CLOSE
2520 * from the peer (tcause->remote == 1), we move to TERMINATING - DRAINING.
2522 * - If we are TERMINATING - DRAINING, we remain here until the terminating
2525 * - Otherwise, we are in ACTIVE and move to TERMINATING - CLOSING.
2526 * if we caused the termination (e.g. we have sent a CONNECTION_CLOSE). Note
2527 * that we are considered to have caused a termination if we sent the first
2528 * CONNECTION_CLOSE frame, even if it is caused by a peer protocol
2529 * violation. If the peer sent the first CONNECTION_CLOSE frame, we move to
2530 * TERMINATING - DRAINING.
2532 * We record the termination cause structure passed on the first call only.
2533 * Any successive calls have their termination cause data discarded;
2534 * once we start sending a CONNECTION_CLOSE frame, we don't change the details
2537 * This conforms to RFC 9000 s. 10.2.1: Closing Connection State:
2538 * To minimize the state that an endpoint maintains for a closing
2539 * connection, endpoints MAY send the exact same packet in response
2540 * to any received packet.
2542 * We don't drop any connection state (specifically packet protection keys)
2543 * even though we are permitted to. This conforms to RFC 9000 s. 10.2.1:
2544 * Closing Connection State:
2545 * An endpoint MAY retain packet protection keys for incoming
2546 * packets to allow it to read and process a CONNECTION_CLOSE frame.
2548 * Note that we do not conform to these two from the same section:
2549 * An endpoint's selected connection ID and the QUIC version
2550 * are sufficient information to identify packets for a closing
2551 * connection; the endpoint MAY discard all other connection state.
2553 * An endpoint MAY drop packet protection keys when entering the
2554 * closing state and send a packet containing a CONNECTION_CLOSE
2555 * frame in response to any UDP datagram that is received.
2557 static void ch_start_terminating(QUIC_CHANNEL
*ch
,
2558 const QUIC_TERMINATE_CAUSE
*tcause
,
2559 int force_immediate
)
2561 switch (ch
->state
) {
2563 case QUIC_CHANNEL_STATE_IDLE
:
2564 ch
->terminate_cause
= *tcause
;
2565 ch_on_terminating_timeout(ch
);
2568 case QUIC_CHANNEL_STATE_ACTIVE
:
2569 ch
->terminate_cause
= *tcause
;
2571 if (!force_immediate
) {
2572 ch
->state
= tcause
->remote
? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
2573 : QUIC_CHANNEL_STATE_TERMINATING_CLOSING
;
2575 * RFC 9000 s. 10.2 Immediate Close
2576 * These states SHOULD persist for at least three times
2577 * the current PTO interval as defined in [QUIC-RECOVERY].
2579 ch
->terminate_deadline
2580 = ossl_time_add(get_time(ch
),
2581 ossl_time_multiply(ossl_ackm_get_pto_duration(ch
->ackm
),
2584 if (!tcause
->remote
) {
2585 OSSL_QUIC_FRAME_CONN_CLOSE f
= {0};
2588 f
.error_code
= ch
->terminate_cause
.error_code
;
2589 f
.frame_type
= ch
->terminate_cause
.frame_type
;
2590 f
.is_app
= ch
->terminate_cause
.app
;
2591 ossl_quic_tx_packetiser_schedule_conn_close(ch
->txp
, &f
);
2592 ch
->conn_close_queued
= 1;
2595 ch_on_terminating_timeout(ch
);
2599 case QUIC_CHANNEL_STATE_TERMINATING_CLOSING
:
2600 if (force_immediate
)
2601 ch_on_terminating_timeout(ch
);
2602 else if (tcause
->remote
)
2603 ch
->state
= QUIC_CHANNEL_STATE_TERMINATING_DRAINING
;
2607 case QUIC_CHANNEL_STATE_TERMINATING_DRAINING
:
2609 * Other than in the force-immediate case, we remain here until the
2612 if (force_immediate
)
2613 ch_on_terminating_timeout(ch
);
2617 case QUIC_CHANNEL_STATE_TERMINATED
:
2624 void ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL
*ch
,
2625 OSSL_QUIC_FRAME_CONN_CLOSE
*f
)
2627 QUIC_TERMINATE_CAUSE tcause
= {0};
2629 if (!ossl_quic_channel_is_active(ch
))
2633 tcause
.app
= f
->is_app
;
2634 tcause
.error_code
= f
->error_code
;
2635 tcause
.frame_type
= f
->frame_type
;
2637 ch_start_terminating(ch
, &tcause
, 0);
2640 static void free_frame_data(unsigned char *buf
, size_t buf_len
, void *arg
)
2645 static int ch_enqueue_retire_conn_id(QUIC_CHANNEL
*ch
, uint64_t seq_num
)
2651 if ((buf_mem
= BUF_MEM_new()) == NULL
)
2654 if (!WPACKET_init(&wpkt
, buf_mem
))
2657 if (!ossl_quic_wire_encode_frame_retire_conn_id(&wpkt
, seq_num
)) {
2658 WPACKET_cleanup(&wpkt
);
2662 WPACKET_finish(&wpkt
);
2663 if (!WPACKET_get_total_written(&wpkt
, &l
))
2666 if (ossl_quic_cfq_add_frame(ch
->cfq
, 1, QUIC_PN_SPACE_APP
,
2667 OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID
,
2668 (unsigned char *)buf_mem
->data
, l
,
2669 free_frame_data
, NULL
) == NULL
)
2672 buf_mem
->data
= NULL
;
2673 BUF_MEM_free(buf_mem
);
2677 ossl_quic_channel_raise_protocol_error(ch
,
2678 QUIC_ERR_INTERNAL_ERROR
,
2679 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
2680 "internal error enqueueing retire conn id");
2681 BUF_MEM_free(buf_mem
);
2685 void ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL
*ch
,
2686 OSSL_QUIC_FRAME_NEW_CONN_ID
*f
)
2688 uint64_t new_remote_seq_num
= ch
->cur_remote_seq_num
;
2689 uint64_t new_retire_prior_to
= ch
->cur_retire_prior_to
;
2691 if (!ossl_quic_channel_is_active(ch
))
2694 /* We allow only two active connection ids; first check some constraints */
2695 if (ch
->cur_remote_dcid
.id_len
== 0) {
2696 /* Changing from 0 length connection id is disallowed */
2697 ossl_quic_channel_raise_protocol_error(ch
,
2698 QUIC_ERR_PROTOCOL_VIOLATION
,
2699 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
2700 "zero length connection id in use");
2705 if (f
->seq_num
> new_remote_seq_num
)
2706 new_remote_seq_num
= f
->seq_num
;
2707 if (f
->retire_prior_to
> new_retire_prior_to
)
2708 new_retire_prior_to
= f
->retire_prior_to
;
2711 * RFC 9000-5.1.1: An endpoint MUST NOT provide more connection IDs
2712 * than the peer's limit.
2714 * After processing a NEW_CONNECTION_ID frame and adding and retiring
2715 * active connection IDs, if the number of active connection IDs exceeds
2716 * the value advertised in its active_connection_id_limit transport
2717 * parameter, an endpoint MUST close the connection with an error of
2718 * type CONNECTION_ID_LIMIT_ERROR.
2720 if (new_remote_seq_num
- new_retire_prior_to
> 1) {
2721 ossl_quic_channel_raise_protocol_error(ch
,
2722 QUIC_ERR_CONNECTION_ID_LIMIT_ERROR
,
2723 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
2724 "active_connection_id limit violated");
2729 * RFC 9000-5.1.1: An endpoint MAY send connection IDs that temporarily
2730 * exceed a peer's limit if the NEW_CONNECTION_ID frame also requires
2731 * the retirement of any excess, by including a sufficiently large
2732 * value in the Retire Prior To field.
2734 * RFC 9000-5.1.2: An endpoint SHOULD allow for sending and tracking
2735 * a number of RETIRE_CONNECTION_ID frames of at least twice the value
2736 * of the active_connection_id_limit transport parameter. An endpoint
2737 * MUST NOT forget a connection ID without retiring it, though it MAY
2738 * choose to treat having connection IDs in need of retirement that
2739 * exceed this limit as a connection error of type CONNECTION_ID_LIMIT_ERROR.
2741 * We are a little bit more liberal than the minimum mandated.
2743 if (new_retire_prior_to
- ch
->cur_retire_prior_to
> 10) {
2744 ossl_quic_channel_raise_protocol_error(ch
,
2745 QUIC_ERR_CONNECTION_ID_LIMIT_ERROR
,
2746 OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID
,
2747 "retiring connection id limit violated");
2752 if (new_remote_seq_num
> ch
->cur_remote_seq_num
) {
2753 ch
->cur_remote_seq_num
= new_remote_seq_num
;
2754 ch
->cur_remote_dcid
= f
->conn_id
;
2755 ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->cur_remote_dcid
);
2759 * RFC 9000-5.1.2: Upon receipt of an increased Retire Prior To
2760 * field, the peer MUST stop using the corresponding connection IDs
2761 * and retire them with RETIRE_CONNECTION_ID frames before adding the
2762 * newly provided connection ID to the set of active connection IDs.
2766 * Note: RFC 9000 s. 19.15 says:
2767 * "An endpoint that receives a NEW_CONNECTION_ID frame with a sequence
2768 * number smaller than the Retire Prior To field of a previously received
2769 * NEW_CONNECTION_ID frame MUST send a correspoonding
2770 * RETIRE_CONNECTION_ID frame that retires the newly received connection
2771 * ID, unless it has already done so for that sequence number."
2773 * Since we currently always queue RETIRE_CONN_ID frames based on the Retire
2774 * Prior To field of a NEW_CONNECTION_ID frame immediately upon receiving
2775 * that NEW_CONNECTION_ID frame, by definition this will always be met.
2776 * This may change in future when we change our CID handling.
2778 while (new_retire_prior_to
> ch
->cur_retire_prior_to
) {
2779 if (!ch_enqueue_retire_conn_id(ch
, ch
->cur_retire_prior_to
))
2781 ++ch
->cur_retire_prior_to
;
2785 static void ch_save_err_state(QUIC_CHANNEL
*ch
)
2787 if (ch
->err_state
== NULL
)
2788 ch
->err_state
= OSSL_ERR_STATE_new();
2790 if (ch
->err_state
== NULL
)
2793 OSSL_ERR_STATE_save(ch
->err_state
);
2796 static void ch_raise_net_error(QUIC_CHANNEL
*ch
)
2798 QUIC_TERMINATE_CAUSE tcause
= {0};
2801 ch_save_err_state(ch
);
2803 tcause
.error_code
= QUIC_ERR_INTERNAL_ERROR
;
2806 * Skip Terminating state and go directly to Terminated, no point trying to
2807 * send CONNECTION_CLOSE if we cannot communicate.
2809 ch_start_terminating(ch
, &tcause
, 1);
2812 int ossl_quic_channel_net_error(QUIC_CHANNEL
*ch
)
2814 return ch
->net_error
;
2817 void ossl_quic_channel_restore_err_state(QUIC_CHANNEL
*ch
)
2822 OSSL_ERR_STATE_restore(ch
->err_state
);
2825 void ossl_quic_channel_raise_protocol_error(QUIC_CHANNEL
*ch
,
2826 uint64_t error_code
,
2827 uint64_t frame_type
,
2830 QUIC_TERMINATE_CAUSE tcause
= {0};
2831 int err_reason
= error_code
== QUIC_ERR_INTERNAL_ERROR
2832 ? ERR_R_INTERNAL_ERROR
: SSL_R_QUIC_PROTOCOL_ERROR
;
2834 ERR_raise_data(ERR_LIB_SSL
, err_reason
,
2835 "Error code: %llu Frame type: %llu Reason: %s",
2836 (unsigned long long) error_code
,
2837 (unsigned long long) frame_type
, reason
);
2838 ch_save_err_state(ch
);
2840 tcause
.error_code
= error_code
;
2841 tcause
.frame_type
= frame_type
;
2843 ch_start_terminating(ch
, &tcause
, 0);
2847 * Called once the terminating timer expires, meaning we move from TERMINATING
2850 static void ch_on_terminating_timeout(QUIC_CHANNEL
*ch
)
2852 ch
->state
= QUIC_CHANNEL_STATE_TERMINATED
;
2856 * Updates our idle deadline. Called when an event happens which should bump the
2859 static void ch_update_idle(QUIC_CHANNEL
*ch
)
2861 if (ch
->max_idle_timeout
== 0)
2862 ch
->idle_deadline
= ossl_time_infinite();
2864 /* RFC 9000 s. 10.1: Idle Timeout
2865 * To avoid excessively small idle timeout periods, endpoints
2866 * MUST increase the idle timeout period to be at least three
2867 * times the current Probe Timeout (PTO). This allows for
2868 * multiple PTOs to expire, and therefore multiple probes to
2869 * be sent and lost, prior to idle timeout.
2871 OSSL_TIME pto
= ossl_ackm_get_pto_duration(ch
->ackm
);
2872 OSSL_TIME timeout
= ossl_time_max(ossl_ms2time(ch
->max_idle_timeout
),
2873 ossl_time_multiply(pto
, 3));
2875 ch
->idle_deadline
= ossl_time_add(get_time(ch
), timeout
);
2880 * Updates our ping deadline, which determines when we next generate a ping if
2881 * we don't have any other ACK-eliciting frames to send.
2883 static void ch_update_ping_deadline(QUIC_CHANNEL
*ch
)
2885 if (ch
->max_idle_timeout
> 0) {
2887 * Maximum amount of time without traffic before we send a PING to keep
2888 * the connection open. Usually we use max_idle_timeout/2, but ensure
2889 * the period never exceeds the assumed NAT interval to ensure NAT
2890 * devices don't have their state time out (RFC 9000 s. 10.1.2).
2893 = ossl_time_divide(ossl_ms2time(ch
->max_idle_timeout
), 2);
2895 max_span
= ossl_time_min(max_span
, MAX_NAT_INTERVAL
);
2897 ch
->ping_deadline
= ossl_time_add(get_time(ch
), max_span
);
2899 ch
->ping_deadline
= ossl_time_infinite();
2903 /* Called when the idle timeout expires. */
2904 static void ch_on_idle_timeout(QUIC_CHANNEL
*ch
)
2907 * Idle timeout does not have an error code associated with it because a
2908 * CONN_CLOSE is never sent for it. We shouldn't use this data once we reach
2909 * TERMINATED anyway.
2911 ch
->terminate_cause
.app
= 0;
2912 ch
->terminate_cause
.error_code
= UINT64_MAX
;
2913 ch
->terminate_cause
.frame_type
= 0;
2915 ch
->state
= QUIC_CHANNEL_STATE_TERMINATED
;
2918 /* Called when we, as a server, get a new incoming connection. */
2919 static int ch_server_on_new_conn(QUIC_CHANNEL
*ch
, const BIO_ADDR
*peer
,
2920 const QUIC_CONN_ID
*peer_scid
,
2921 const QUIC_CONN_ID
*peer_dcid
)
2923 if (!ossl_assert(ch
->state
== QUIC_CHANNEL_STATE_IDLE
&& ch
->is_server
))
2926 /* Generate a SCID we will use for the connection. */
2927 if (!gen_rand_conn_id(ch
->libctx
, INIT_DCID_LEN
,
2928 &ch
->cur_local_cid
))
2931 /* Note our newly learnt peer address and CIDs. */
2932 ch
->cur_peer_addr
= *peer
;
2933 ch
->init_dcid
= *peer_dcid
;
2934 ch
->cur_remote_dcid
= *peer_scid
;
2936 /* Inform QTX of peer address. */
2937 if (!ossl_quic_tx_packetiser_set_peer(ch
->txp
, &ch
->cur_peer_addr
))
2940 /* Inform TXP of desired CIDs. */
2941 if (!ossl_quic_tx_packetiser_set_cur_dcid(ch
->txp
, &ch
->cur_remote_dcid
))
2944 if (!ossl_quic_tx_packetiser_set_cur_scid(ch
->txp
, &ch
->cur_local_cid
))
2947 /* Plug in secrets for the Initial EL. */
2948 if (!ossl_quic_provide_initial_secret(ch
->libctx
,
2955 /* Register our local CID in the DEMUX. */
2956 if (!ossl_qrx_add_dst_conn_id(ch
->qrx
, &ch
->cur_local_cid
))
2960 ch
->state
= QUIC_CHANNEL_STATE_ACTIVE
;
2961 ch
->doing_proactive_ver_neg
= 0; /* not currently supported */
2965 SSL
*ossl_quic_channel_get0_ssl(QUIC_CHANNEL
*ch
)
2970 static int ch_init_new_stream(QUIC_CHANNEL
*ch
, QUIC_STREAM
*qs
,
2971 int can_send
, int can_recv
)
2974 int server_init
= ossl_quic_stream_is_server_init(qs
);
2975 int local_init
= (ch
->is_server
== server_init
);
2976 int is_uni
= !ossl_quic_stream_is_bidi(qs
);
2979 if ((qs
->sstream
= ossl_quic_sstream_new(INIT_APP_BUF_LEN
)) == NULL
)
2983 if ((qs
->rstream
= ossl_quic_rstream_new(NULL
, NULL
, 0)) == NULL
)
2987 if (!ossl_quic_txfc_init(&qs
->txfc
, &ch
->conn_txfc
))
2990 if (ch
->got_remote_transport_params
) {
2992 * If we already got peer TPs we need to apply the initial CWM credit
2993 * now. If we didn't already get peer TPs this will be done
2994 * automatically for all extant streams when we do.
3000 cwm
= ch
->rx_init_max_stream_data_uni
;
3001 else if (local_init
)
3002 cwm
= ch
->rx_init_max_stream_data_bidi_local
;
3004 cwm
= ch
->rx_init_max_stream_data_bidi_remote
;
3006 ossl_quic_txfc_bump_cwm(&qs
->txfc
, cwm
);
3014 rxfc_wnd
= ch
->tx_init_max_stream_data_uni
;
3015 else if (local_init
)
3016 rxfc_wnd
= ch
->tx_init_max_stream_data_bidi_local
;
3018 rxfc_wnd
= ch
->tx_init_max_stream_data_bidi_remote
;
3020 if (!ossl_quic_rxfc_init(&qs
->rxfc
, &ch
->conn_rxfc
,
3022 DEFAULT_STREAM_RXFC_MAX_WND_MUL
* rxfc_wnd
,
3029 ossl_quic_sstream_free(qs
->sstream
);
3031 ossl_quic_rstream_free(qs
->rstream
);
3036 QUIC_STREAM
*ossl_quic_channel_new_stream_local(QUIC_CHANNEL
*ch
, int is_uni
)
3040 uint64_t stream_id
, *p_next_ordinal
;
3042 type
= ch
->is_server
? QUIC_STREAM_INITIATOR_SERVER
3043 : QUIC_STREAM_INITIATOR_CLIENT
;
3046 p_next_ordinal
= &ch
->next_local_stream_ordinal_uni
;
3047 type
|= QUIC_STREAM_DIR_UNI
;
3049 p_next_ordinal
= &ch
->next_local_stream_ordinal_bidi
;
3050 type
|= QUIC_STREAM_DIR_BIDI
;
3053 if (*p_next_ordinal
>= ((uint64_t)1) << 62)
3056 stream_id
= ((*p_next_ordinal
) << 2) | type
;
3058 if ((qs
= ossl_quic_stream_map_alloc(&ch
->qsm
, stream_id
, type
)) == NULL
)
3061 /* Locally-initiated stream, so we always want a send buffer. */
3062 if (!ch_init_new_stream(ch
, qs
, /*can_send=*/1, /*can_recv=*/!is_uni
))
3069 ossl_quic_stream_map_release(&ch
->qsm
, qs
);
3073 QUIC_STREAM
*ossl_quic_channel_new_stream_remote(QUIC_CHANNEL
*ch
,
3080 peer_role
= ch
->is_server
3081 ? QUIC_STREAM_INITIATOR_CLIENT
3082 : QUIC_STREAM_INITIATOR_SERVER
;
3084 if ((stream_id
& QUIC_STREAM_INITIATOR_MASK
) != peer_role
)
3087 is_uni
= ((stream_id
& QUIC_STREAM_DIR_MASK
) == QUIC_STREAM_DIR_UNI
);
3089 qs
= ossl_quic_stream_map_alloc(&ch
->qsm
, stream_id
,
3090 stream_id
& (QUIC_STREAM_INITIATOR_MASK
3091 | QUIC_STREAM_DIR_MASK
));
3095 if (!ch_init_new_stream(ch
, qs
, /*can_send=*/!is_uni
, /*can_recv=*/1))
3098 if (ch
->incoming_stream_auto_reject
)
3099 ossl_quic_channel_reject_stream(ch
, qs
);
3101 ossl_quic_stream_map_push_accept_queue(&ch
->qsm
, qs
);
3106 ossl_quic_stream_map_release(&ch
->qsm
, qs
);
3110 void ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL
*ch
,
3114 ch
->incoming_stream_auto_reject
= (enable
!= 0);
3115 ch
->incoming_stream_auto_reject_aec
= aec
;
3118 void ossl_quic_channel_reject_stream(QUIC_CHANNEL
*ch
, QUIC_STREAM
*qs
)
3120 ossl_quic_stream_map_stop_sending_recv_part(&ch
->qsm
, qs
,
3121 ch
->incoming_stream_auto_reject_aec
);
3123 ossl_quic_stream_map_reset_stream_send_part(&ch
->qsm
, qs
,
3124 ch
->incoming_stream_auto_reject_aec
);
3127 ossl_quic_stream_map_update_state(&ch
->qsm
, qs
);
3130 /* Replace local connection ID in TXP and DEMUX for testing purposes. */
3131 int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL
*ch
,
3132 const QUIC_CONN_ID
*conn_id
)
3134 /* Remove the current local CID from the DEMUX. */
3135 if (!ossl_qrx_remove_dst_conn_id(ch
->qrx
, &ch
->cur_local_cid
))
3137 ch
->cur_local_cid
= *conn_id
;
3138 /* Set in the TXP, used only for long header packets. */
3139 if (!ossl_quic_tx_packetiser_set_cur_scid(ch
->txp
, &ch
->cur_local_cid
))
3141 /* Register our new local CID in the DEMUX. */
3142 if (!ossl_qrx_add_dst_conn_id(ch
->qrx
, &ch
->cur_local_cid
))
3147 void ossl_quic_channel_set_msg_callback(QUIC_CHANNEL
*ch
,
3148 ossl_msg_cb msg_callback
,
3149 SSL
*msg_callback_ssl
)
3151 ch
->msg_callback
= msg_callback
;
3152 ch
->msg_callback_ssl
= msg_callback_ssl
;
3153 ossl_qtx_set_msg_callback(ch
->qtx
, msg_callback
, msg_callback_ssl
);
3154 ossl_quic_tx_packetiser_set_msg_callback(ch
->txp
, msg_callback
,
3156 ossl_qrx_set_msg_callback(ch
->qrx
, msg_callback
, msg_callback_ssl
);
3159 void ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL
*ch
,
3160 void *msg_callback_arg
)
3162 ch
->msg_callback_arg
= msg_callback_arg
;
3163 ossl_qtx_set_msg_callback_arg(ch
->qtx
, msg_callback_arg
);
3164 ossl_quic_tx_packetiser_set_msg_callback_arg(ch
->txp
, msg_callback_arg
);
3165 ossl_qrx_set_msg_callback_arg(ch
->qrx
, msg_callback_arg
);
3168 void ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL
*ch
,
3169 uint64_t tx_pkt_threshold
)
3171 ch
->txku_threshold_override
= tx_pkt_threshold
;
3174 uint64_t ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL
*ch
)
3176 return ossl_qtx_get_key_epoch(ch
->qtx
);
3179 uint64_t ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL
*ch
)
3181 return ossl_qrx_get_key_epoch(ch
->qrx
);
3184 int ossl_quic_channel_trigger_txku(QUIC_CHANNEL
*ch
)
3186 if (!txku_allowed(ch
))
3189 ch
->ku_locally_initiated
= 1;
3190 ch_trigger_txku(ch
);
3194 int ossl_quic_channel_ping(QUIC_CHANNEL
*ch
)
3196 int pn_space
= ossl_quic_enc_level_to_pn_space(ch
->tx_enc_level
);
3198 ossl_quic_tx_packetiser_schedule_ack_eliciting(ch
->txp
, pn_space
);
3203 void ossl_quic_channel_set_inhibit_tick(QUIC_CHANNEL
*ch
, int inhibit
)
3205 ch
->inhibit_tick
= (inhibit
!= 0);