#include "internal/quic_channel.h"
#include "internal/quic_error.h"
#include "internal/quic_rx_depack.h"
+#include "internal/quic_lcidm.h"
+#include "internal/quic_srtm.h"
+#include "internal/qlog_event_helpers.h"
#include "../ssl_local.h"
#include "quic_channel_local.h"
+#include "quic_port_local.h"
+#include "quic_engine_local.h"
/*
* NOTE: While this channel implementation currently has basic server support,
* TODO(QUIC SERVER): Implement retry logic
*/
-#define INIT_DCID_LEN 8
-#define INIT_CRYPTO_BUF_LEN 8192
-#define INIT_APP_BUF_LEN 8192
+#define INIT_CRYPTO_RECV_BUF_LEN 16384
+#define INIT_CRYPTO_SEND_BUF_LEN 16384
+#define INIT_APP_BUF_LEN 8192
/*
* Interval before we force a PING to ensure NATs don't timeout. This is based
*/
#define DEFAULT_MAX_ACK_DELAY QUIC_DEFAULT_MAX_ACK_DELAY
+DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
+
static void ch_save_err_state(QUIC_CHANNEL *ch);
-static void ch_rx_pre(QUIC_CHANNEL *ch);
-static int ch_rx(QUIC_CHANNEL *ch);
+static int ch_rx(QUIC_CHANNEL *ch, int channel_only);
static int ch_tx(QUIC_CHANNEL *ch);
-static void ch_tick(QUIC_TICK_RESULT *res, void *arg, uint32_t flags);
-static void ch_rx_handle_packet(QUIC_CHANNEL *ch);
+static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only);
+static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only);
static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch);
static int ch_retry(QUIC_CHANNEL *ch,
const unsigned char *retry_token,
static void ch_on_idle_timeout(QUIC_CHANNEL *ch);
static void ch_update_idle(QUIC_CHANNEL *ch);
static void ch_update_ping_deadline(QUIC_CHANNEL *ch);
-static void ch_stateless_reset(QUIC_CHANNEL *ch);
-static void ch_raise_net_error(QUIC_CHANNEL *ch);
static void ch_on_terminating_timeout(QUIC_CHANNEL *ch);
static void ch_start_terminating(QUIC_CHANNEL *ch,
const QUIC_TERMINATE_CAUSE *tcause,
int force_immediate);
-static int ch_stateless_reset_token_handler(const unsigned char *data, size_t datalen, void *arg);
-static void ch_default_packet_handler(QUIC_URXE *e, void *arg);
-static int ch_server_on_new_conn(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
- const QUIC_CONN_ID *peer_scid,
- const QUIC_CONN_ID *peer_dcid);
static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
void *arg);
static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt);
static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch);
+static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state);
DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM);
-static int gen_rand_conn_id(OSSL_LIB_CTX *libctx, size_t len, QUIC_CONN_ID *cid)
-{
- if (len > QUIC_MAX_CONN_ID_LEN)
- return 0;
-
- cid->id_len = (unsigned char)len;
-
- if (RAND_bytes_ex(libctx, cid->id, len, len * 8) != 1) {
- ERR_raise(ERR_LIB_SSL, ERR_R_RAND_LIB);
- cid->id_len = 0;
- return 0;
- }
-
- return 1;
-}
-
-static unsigned long chan_reset_token_hash(const QUIC_SRT_ELEM *a)
-{
- unsigned long h;
-
- assert(sizeof(h) <= sizeof(a->token));
- memcpy(&h, &a->token, sizeof(h));
- return h;
-}
-
-static int chan_reset_token_cmp(const QUIC_SRT_ELEM *a, const QUIC_SRT_ELEM *b)
-{
- /* RFC 9000 s. 10.3.1:
- * When comparing a datagram to stateless reset token values,
- * endpoints MUST perform the comparison without leaking
- * information about the value of the token. For example,
- * performing this comparison in constant time protects the
- * value of individual stateless reset tokens from information
- * leakage through timing side channels.
- *
- * TODO(QUIC FUTURE): make this a memcmp when obfuscation is done and update
- * comment above.
- */
- return CRYPTO_memcmp(&a->token, &b->token, sizeof(a->token));
-}
-
-static int reset_token_obfuscate(QUIC_SRT_ELEM *out, const unsigned char *in)
-{
- /*
- * TODO(QUIC FUTURE): update this to AES encrypt the token in ECB mode with a
- * random (per channel) key.
- */
- memcpy(&out->token, in, sizeof(out->token));
- return 1;
-}
-
-/*
- * Add a stateless reset token to the channel
- */
-static int chan_add_reset_token(QUIC_CHANNEL *ch, const unsigned char *new,
- uint64_t seq_num)
+QUIC_NEEDS_LOCK
+static QLOG *ch_get_qlog(QUIC_CHANNEL *ch)
{
- QUIC_SRT_ELEM *srte;
- int err;
-
- /* Add to list by sequence number (always the tail) */
- if ((srte = OPENSSL_malloc(sizeof(*srte))) == NULL)
- return 0;
+#ifndef OPENSSL_NO_QLOG
+ QLOG_TRACE_INFO qti = {0};
- ossl_list_stateless_reset_tokens_init_elem(srte);
- ossl_list_stateless_reset_tokens_insert_tail(&ch->srt_list_seq, srte);
- reset_token_obfuscate(srte, new);
- srte->seq_num = seq_num;
-
- lh_QUIC_SRT_ELEM_insert(ch->srt_hash_tok, srte);
- err = lh_QUIC_SRT_ELEM_error(ch->srt_hash_tok);
- if (err > 0) {
- ossl_list_stateless_reset_tokens_remove(&ch->srt_list_seq, srte);
- OPENSSL_free(srte);
- return 0;
- }
- return 1;
-}
+ if (ch->qlog != NULL)
+ return ch->qlog;
-/*
- * Remove a stateless reset token from the channel
- * If the token isn't known, we just ignore the remove request which is safe.
- */
-static void chan_remove_reset_token(QUIC_CHANNEL *ch, uint64_t seq_num)
-{
- QUIC_SRT_ELEM *srte;
+ if (!ch->use_qlog)
+ return NULL;
- /*
- * Because the list is ordered and we only ever remove CIDs in order,
- * this loop should never iterate, but safer to provide the option.
- */
- for (srte = ossl_list_stateless_reset_tokens_head(&ch->srt_list_seq);
- srte != NULL;
- srte = ossl_list_stateless_reset_tokens_next(srte)) {
- if (srte->seq_num > seq_num)
- return;
- if (srte->seq_num == seq_num) {
- ossl_list_stateless_reset_tokens_remove(&ch->srt_list_seq, srte);
- (void)lh_QUIC_SRT_ELEM_delete(ch->srt_hash_tok, srte);
- OPENSSL_free(srte);
- return;
- }
+ qti.odcid = ch->init_dcid;
+ qti.title = NULL;
+ qti.description = NULL;
+ qti.group_id = NULL;
+ qti.is_server = ch->is_server;
+ qti.now_cb = get_time;
+ qti.now_cb_arg = ch;
+ if ((ch->qlog = ossl_qlog_new_from_env(&qti)) == NULL) {
+ ch->use_qlog = 0; /* don't try again */
+ return NULL;
}
-}
-/*
- * This is called by the demux whenever a new datagram arrives
- *
- * TODO(QUIC FUTURE): optimise this to only be called for unparsable packets
- */
-static int ch_stateless_reset_token_handler(const unsigned char *data,
- size_t datalen, void *arg)
-{
- QUIC_SRT_ELEM srte;
- QUIC_CHANNEL *ch = (QUIC_CHANNEL *)arg;
-
- /*
- * Perform some fast and cheap checks for a packet not being a stateless
- * reset token. RFC 9000 s. 10.3 specifies this layout for stateless
- * reset packets:
- *
- * Stateless Reset {
- * Fixed Bits (2) = 1,
- * Unpredictable Bits (38..),
- * Stateless Reset Token (128),
- * }
- *
- * It also specifies:
- * However, endpoints MUST treat any packet ending in a valid
- * stateless reset token as a Stateless Reset, as other QUIC
- * versions might allow the use of a long header.
- *
- * We can rapidly check for the minimum length and that the first pair
- * of bits in the first byte are 01 or 11.
- *
- * The function returns 1 if it is a stateless reset packet, 0 if it isn't
- * and -1 if an error was encountered.
- */
- if (datalen < QUIC_STATELESS_RESET_TOKEN_LEN + 5 || (0100 & *data) != 0100)
- return 0;
- memset(&srte, 0, sizeof(srte));
- if (!reset_token_obfuscate(&srte, data + datalen - sizeof(srte.token)))
- return -1;
- return lh_QUIC_SRT_ELEM_retrieve(ch->srt_hash_tok, &srte) != NULL;
+ return ch->qlog;
+#else
+ return NULL;
+#endif
}
/*
OSSL_QRX_ARGS qrx_args = {0};
QUIC_TLS_ARGS tls_args = {0};
uint32_t pn_space;
- size_t rx_short_cid_len = ch->is_server ? INIT_DCID_LEN : 0;
+ size_t rx_short_dcid_len;
+ size_t tx_init_dcid_len;
- ossl_list_stateless_reset_tokens_init(&ch->srt_list_seq);
- ch->srt_hash_tok = lh_QUIC_SRT_ELEM_new(&chan_reset_token_hash,
- &chan_reset_token_cmp);
- if (ch->srt_hash_tok == NULL)
+ if (ch->port == NULL || ch->lcidm == NULL || ch->srtm == NULL)
goto err;
+ rx_short_dcid_len = ossl_quic_port_get_rx_short_dcid_len(ch->port);
+ tx_init_dcid_len = ossl_quic_port_get_tx_init_dcid_len(ch->port);
+
/* For clients, generate our initial DCID. */
if (!ch->is_server
- && !gen_rand_conn_id(ch->libctx, INIT_DCID_LEN, &ch->init_dcid))
+ && !ossl_quic_gen_rand_conn_id(ch->port->engine->libctx, tx_init_dcid_len,
+ &ch->init_dcid))
goto err;
/* We plug in a network write BIO to the QTX later when we get one. */
- qtx_args.libctx = ch->libctx;
+ qtx_args.libctx = ch->port->engine->libctx;
qtx_args.mdpl = QUIC_MIN_INITIAL_DGRAM_LEN;
ch->rx_max_udp_payload_size = qtx_args.mdpl;
for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
if (!ossl_quic_rxfc_init_standalone(&ch->crypto_rxfc[pn_space],
- INIT_CRYPTO_BUF_LEN,
+ INIT_CRYPTO_RECV_BUF_LEN,
get_time, ch))
goto err;
ch->have_qsm = 1;
+ if (!ch->is_server
+ && !ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &txp_args.cur_scid))
+ goto err;
+
/* We use a zero-length SCID. */
txp_args.cur_dcid = ch->init_dcid;
txp_args.ack_delay_exponent = 3;
txp_args.cc_data = ch->cc_data;
txp_args.now = get_time;
txp_args.now_arg = ch;
+ txp_args.qlog = ch_get_qlog(ch);
for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
- ch->crypto_send[pn_space] = ossl_quic_sstream_new(INIT_CRYPTO_BUF_LEN);
+ ch->crypto_send[pn_space] = ossl_quic_sstream_new(INIT_CRYPTO_SEND_BUF_LEN);
if (ch->crypto_send[pn_space] == NULL)
goto err;
ossl_quic_tx_packetiser_set_ack_tx_cb(ch->txp, ch_on_txp_ack_tx, ch);
- if ((ch->demux = ossl_quic_demux_new(/*BIO=*/NULL,
- /*Short CID Len=*/rx_short_cid_len,
- get_time, ch)) == NULL)
- goto err;
-
- /*
- * Setup a handler to detect stateless reset tokens.
- */
- ossl_quic_demux_set_stateless_reset_handler(ch->demux,
- &ch_stateless_reset_token_handler,
- ch);
-
- /*
- * If we are a server, setup our handler for packets not corresponding to
- * any known DCID on our end. This is for handling clients establishing new
- * connections.
- */
- if (ch->is_server)
- ossl_quic_demux_set_default_handler(ch->demux,
- ch_default_packet_handler,
- ch);
-
- qrx_args.libctx = ch->libctx;
- qrx_args.demux = ch->demux;
- qrx_args.short_conn_id_len = rx_short_cid_len;
+ qrx_args.libctx = ch->port->engine->libctx;
+ qrx_args.demux = ch->port->demux;
+ qrx_args.short_conn_id_len = rx_short_dcid_len;
qrx_args.max_deferred = 32;
if ((ch->qrx = ossl_qrx_new(&qrx_args)) == NULL)
ch))
goto err;
- if (!ch->is_server && !ossl_qrx_add_dst_conn_id(ch->qrx, &txp_args.cur_scid))
- goto err;
-
for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
ch->crypto_recv[pn_space] = ossl_quic_rstream_new(NULL, NULL, 0);
if (ch->crypto_recv[pn_space] == NULL)
goto err;
ch_update_idle(ch);
- ossl_quic_reactor_init(&ch->rtor, ch_tick, ch,
- ch_determine_next_tick_deadline(ch));
+ ossl_list_ch_insert_tail(&ch->port->channel_list, ch);
+ ch->on_port_list = 1;
return 1;
err:
static void ch_cleanup(QUIC_CHANNEL *ch)
{
- QUIC_SRT_ELEM *srte, *srte_next;
uint32_t pn_space;
if (ch->ackm != NULL)
++pn_space)
ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
+ ossl_quic_lcidm_cull(ch->lcidm, ch);
+ ossl_quic_srtm_cull(ch->srtm, ch);
ossl_quic_tx_packetiser_free(ch->txp);
ossl_quic_txpim_free(ch->txpim);
ossl_quic_cfq_free(ch->cfq);
ossl_quic_tls_free(ch->qtls);
ossl_qrx_free(ch->qrx);
- ossl_quic_demux_free(ch->demux);
OPENSSL_free(ch->local_transport_params);
OPENSSL_free((char *)ch->terminate_cause.reason);
OSSL_ERR_STATE_free(ch->err_state);
OPENSSL_free(ch->ack_range_scratch);
- /* Free the stateless reset tokens */
- for (srte = ossl_list_stateless_reset_tokens_head(&ch->srt_list_seq);
- srte != NULL;
- srte = srte_next) {
- srte_next = ossl_list_stateless_reset_tokens_next(srte);
- ossl_list_stateless_reset_tokens_remove(&ch->srt_list_seq, srte);
- (void)lh_QUIC_SRT_ELEM_delete(ch->srt_hash_tok, srte);
- OPENSSL_free(srte);
+ if (ch->on_port_list) {
+ ossl_list_ch_remove(&ch->port->channel_list, ch);
+ ch->on_port_list = 0;
}
- lh_QUIC_SRT_ELEM_free(ch->srt_hash_tok);
+
+#ifndef OPENSSL_NO_QLOG
+ if (ch->qlog != NULL)
+ ossl_qlog_flush(ch->qlog); /* best effort */
+
+ ossl_qlog_free(ch->qlog);
+#endif
}
QUIC_CHANNEL *ossl_quic_channel_new(const QUIC_CHANNEL_ARGS *args)
if ((ch = OPENSSL_zalloc(sizeof(*ch))) == NULL)
return NULL;
- ch->libctx = args->libctx;
- ch->propq = args->propq;
+ ch->port = args->port;
ch->is_server = args->is_server;
ch->tls = args->tls;
- ch->mutex = args->mutex;
- ch->now_cb = args->now_cb;
- ch->now_cb_arg = args->now_cb_arg;
+ ch->lcidm = args->lcidm;
+ ch->srtm = args->srtm;
+#ifndef OPENSSL_NO_QLOG
+ ch->use_qlog = args->use_qlog;
+#endif
if (!ch_init(ch)) {
OPENSSL_free(ch);
QUIC_REACTOR *ossl_quic_channel_get_reactor(QUIC_CHANNEL *ch)
{
- return &ch->rtor;
+ return ossl_quic_port_get0_reactor(ch->port);
}
QUIC_STREAM_MAP *ossl_quic_channel_get_qsm(QUIC_CHANNEL *ch)
QUIC_DEMUX *ossl_quic_channel_get0_demux(QUIC_CHANNEL *ch)
{
- return ch->demux;
+ return ch->port->demux;
+}
+
+QUIC_PORT *ossl_quic_channel_get0_port(QUIC_CHANNEL *ch)
+{
+ return ch->port;
+}
+
+QUIC_ENGINE *ossl_quic_channel_get0_engine(QUIC_CHANNEL *ch)
+{
+ return ossl_quic_port_get0_engine(ch->port);
}
CRYPTO_MUTEX *ossl_quic_channel_get_mutex(QUIC_CHANNEL *ch)
{
- return ch->mutex;
+ return ossl_quic_port_get0_mutex(ch->port);
}
int ossl_quic_channel_has_pending(const QUIC_CHANNEL *ch)
{
- return ossl_quic_demux_has_pending(ch->demux)
+ return ossl_quic_demux_has_pending(ch->port->demux)
|| ossl_qrx_processed_read_pending(ch->qrx);
}
{
QUIC_CHANNEL *ch = arg;
- if (ch->now_cb == NULL)
- return ossl_time_now();
-
- return ch->now_cb(ch->now_cb_arg);
+ return ossl_quic_port_get_time(ch->port);
}
/* Used by QSM. */
ossl_quic_tx_packetiser_schedule_handshake_done(ch->txp);
}
+ ch_record_state_transition(ch, ch->state);
return 1;
}
int got_disable_active_migration = 0;
QUIC_CONN_ID cid;
const char *reason = "bad transport parameter";
+ ossl_unused uint64_t rx_max_idle_timeout = 0;
+ ossl_unused const void *stateless_reset_token_p = NULL;
+ QUIC_PREFERRED_ADDR pfa;
- if (ch->got_remote_transport_params)
+ if (ch->got_remote_transport_params) {
+ reason = "multiple transport parameter extensions";
goto malformed;
+ }
if (!PACKET_buf_init(&pkt, params, params_len)) {
ossl_quic_channel_raise_protocol_error(ch, QUIC_ERR_INTERNAL_ERROR, 0,
goto malformed;
}
+#ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
/* Must match our initial DCID. */
if (!ossl_quic_conn_id_eq(&ch->init_dcid, &cid)) {
reason = TP_REASON_EXPECTED_VALUE("ORIG_DCID");
goto malformed;
}
+#endif
got_orig_dcid = 1;
break;
ch_update_idle(ch);
got_max_idle_timeout = 1;
+ rx_max_idle_timeout = v;
break;
case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE:
reason = TP_REASON_MALFORMED("STATELESS_RESET_TOKEN");
goto malformed;
}
- if (!chan_add_reset_token(ch, body, ch->cur_remote_seq_num)) {
+ if (!ossl_quic_srtm_add(ch->srtm, ch, ch->cur_remote_seq_num,
+ (const QUIC_STATELESS_RESET_TOKEN *)body)) {
reason = TP_REASON_INTERNAL_ERROR("STATELESS_RESET_TOKEN");
goto malformed;
}
- got_stateless_reset_token = 1;
+ stateless_reset_token_p = body;
+ got_stateless_reset_token = 1;
break;
case QUIC_TPARAM_PREFERRED_ADDR:
{
/* TODO(QUIC FUTURE): Handle preferred address. */
- QUIC_PREFERRED_ADDR pfa;
if (got_preferred_addr) {
reason = TP_REASON_DUP("PREFERRED_ADDR");
goto malformed;
ch->got_remote_transport_params = 1;
+#ifndef OPENSSL_NO_QLOG
+ QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
+ QLOG_STR("owner", "remote");
+
+ if (got_orig_dcid)
+ QLOG_CID("original_destination_connection_id",
+ &ch->init_dcid);
+ if (got_initial_scid)
+ QLOG_CID("original_source_connection_id",
+ &ch->init_dcid);
+ if (got_retry_scid)
+ QLOG_CID("retry_source_connection_id",
+ &ch->retry_scid);
+ if (got_initial_max_data)
+ QLOG_U64("initial_max_data",
+ ossl_quic_txfc_get_cwm(&ch->conn_txfc));
+ if (got_initial_max_stream_data_bidi_local)
+ QLOG_U64("initial_max_stream_data_bidi_local",
+ ch->rx_init_max_stream_data_bidi_local);
+ if (got_initial_max_stream_data_bidi_remote)
+ QLOG_U64("initial_max_stream_data_bidi_remote",
+ ch->rx_init_max_stream_data_bidi_remote);
+ if (got_initial_max_stream_data_uni)
+ QLOG_U64("initial_max_stream_data_uni",
+ ch->rx_init_max_stream_data_uni);
+ if (got_initial_max_streams_bidi)
+ QLOG_U64("initial_max_streams_bidi",
+ ch->max_local_streams_bidi);
+ if (got_initial_max_streams_uni)
+ QLOG_U64("initial_max_streams_uni",
+ ch->max_local_streams_uni);
+ if (got_ack_delay_exp)
+ QLOG_U64("ack_delay_exponent", ch->rx_ack_delay_exp);
+ if (got_max_ack_delay)
+ QLOG_U64("max_ack_delay", ch->rx_max_ack_delay);
+ if (got_max_udp_payload_size)
+ QLOG_U64("max_udp_payload_size", ch->rx_max_udp_payload_size);
+ if (got_max_idle_timeout)
+ QLOG_U64("max_idle_timeout", rx_max_idle_timeout);
+ if (got_active_conn_id_limit)
+ QLOG_U64("active_connection_id_limit", ch->rx_active_conn_id_limit);
+ if (got_stateless_reset_token)
+ QLOG_BIN("stateless_reset_token", stateless_reset_token_p,
+ QUIC_STATELESS_RESET_TOKEN_LEN);
+ if (got_preferred_addr) {
+ QLOG_BEGIN("preferred_addr")
+ QLOG_U64("port_v4", pfa.ipv4_port);
+ QLOG_U64("port_v6", pfa.ipv6_port);
+ QLOG_BIN("ip_v4", pfa.ipv4, sizeof(pfa.ipv4));
+ QLOG_BIN("ip_v6", pfa.ipv6, sizeof(pfa.ipv6));
+ QLOG_BIN("stateless_reset_token", pfa.stateless_reset.token,
+ sizeof(pfa.stateless_reset.token));
+ QLOG_CID("connection_id", &pfa.cid);
+ QLOG_END()
+ }
+ QLOG_BOOL("disable_active_migration", got_disable_active_migration);
+ QLOG_EVENT_END()
+#endif
+
if (got_initial_max_data || got_initial_max_stream_data_bidi_remote
|| got_initial_max_streams_bidi || got_initial_max_streams_uni)
/*
buf_len))
goto err;
+#ifndef OPENSSL_NO_QLOG
+ QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
+ QLOG_STR("owner", "local");
+ QLOG_BOOL("disable_active_migration", 1);
+ if (ch->is_server) {
+ QLOG_CID("original_destination_connection_id", &ch->init_dcid);
+ QLOG_CID("initial_source_connection_id", &ch->cur_local_cid);
+ } else {
+ QLOG_STR("initial_source_connection_id", "");
+ }
+ QLOG_U64("max_idle_timeout", ch->max_idle_timeout);
+ QLOG_U64("max_udp_payload_size", QUIC_MIN_INITIAL_DGRAM_LEN);
+ QLOG_U64("active_connection_id_limit", QUIC_MIN_ACTIVE_CONN_ID_LIMIT);
+ QLOG_U64("max_ack_delay", ch->tx_max_ack_delay);
+ QLOG_U64("initial_max_data", ossl_quic_rxfc_get_cwm(&ch->conn_rxfc));
+ QLOG_U64("initial_max_stream_data_bidi_local",
+ ch->tx_init_max_stream_data_bidi_local);
+ QLOG_U64("initial_max_stream_data_bidi_remote",
+ ch->tx_init_max_stream_data_bidi_remote);
+ QLOG_U64("initial_max_stream_data_uni",
+ ch->tx_init_max_stream_data_uni);
+ QLOG_U64("initial_max_streams_bidi",
+ ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc));
+ QLOG_U64("initial_max_streams_uni",
+ ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc));
+ QLOG_EVENT_END()
+#endif
+
ok = 1;
err:
if (wpkt_valid)
* at least everything network I/O related. Best effort - not allowed to fail
* "loudly".
*/
-static void ch_tick(QUIC_TICK_RESULT *res, void *arg, uint32_t flags)
+void ossl_quic_channel_subtick(QUIC_CHANNEL *ch, QUIC_TICK_RESULT *res,
+ uint32_t flags)
{
OSSL_TIME now, deadline;
- QUIC_CHANNEL *ch = arg;
int channel_only = (flags & QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY) != 0;
- uint64_t error_code;
- const char *error_msg;
- ERR_STATE *error_state = NULL;
/*
* When we tick the QUIC connection, we do everything we need to do
- * periodically. In order, we:
+ * periodically. Network I/O handling will already have been performed
+ * as necessary by the QUIC port. Thus, in order, we:
*
- * - handle any incoming data from the network;
- * - handle any timer events which are due to fire (ACKM, etc.)
- * - write any data to the network due to be sent, to the extent
- * possible;
+ * - handle any packets the DEMUX has queued up for us;
+ * - handle any timer events which are due to fire (ACKM, etc.);
+ * - generate any packets which need to be sent;
* - determine the time at which we should next be ticked.
*/
}
}
- if (!ch->inhibit_tick) {
+ if (!ch->port->engine->inhibit_tick) {
/* Handle RXKU timeouts. */
ch_rxku_tick(ch);
- /* Handle any incoming data from network. */
- ch_rx_pre(ch);
-
do {
/* Process queued incoming packets. */
- ch_rx(ch);
+ ch->did_tls_tick = 0;
+ ch->have_new_rx_secret = 0;
+ ch_rx(ch, channel_only);
/*
* Allow the handshake layer to check for any new incoming data and
* generate new outgoing data.
*/
- ch->have_new_rx_secret = 0;
- if (!channel_only) {
- ossl_quic_tls_tick(ch->qtls);
-
- if (ossl_quic_tls_get_error(ch->qtls, &error_code, &error_msg,
- &error_state))
- ossl_quic_channel_raise_protocol_error_state(ch, error_code, 0,
- error_msg, error_state);
- }
+ if (!ch->did_tls_tick)
+ ch_tick_tls(ch, channel_only);
/*
* If the handshake layer gave us a new secret, we need to do RX
* Idle timeout differs from normal protocol violation because we do
* not send a CONN_CLOSE frame; go straight to TERMINATED.
*/
- if (!ch->inhibit_tick)
+ if (!ch->port->engine->inhibit_tick)
ch_on_idle_timeout(ch);
res->net_read_desired = 0;
return;
}
- if (!ch->inhibit_tick) {
+ if (!ch->port->engine->inhibit_tick) {
deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
if (!ossl_time_is_zero(deadline)
&& ossl_time_compare(now, deadline) >= 0)
int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
+
+ /*
+ * If we have no CC budget at this time we cannot process the above
+ * PING request immediately. In any case we have scheduled the
+ * request so bump the ping deadline. If we don't do this we will
+ * busy-loop endlessly as the above deadline comparison condition
+ * will still be met.
+ */
+ ch_update_ping_deadline(ch);
}
- /* Write any data to the network due to be sent. */
+ /* Queue any data to be sent for transmission. */
ch_tx(ch);
/* Do stream GC. */
res->tick_deadline = ch_determine_next_tick_deadline(ch);
/*
- * Always process network input unless we are now terminated.
- * Although we had not terminated at the beginning of this tick, network
- * errors in ch_rx_pre() or ch_tx() may have caused us to transition to the
- * Terminated state.
+ * Always process network input unless we are now terminated. Although we
+ * had not terminated at the beginning of this tick, network errors in
+ * ch_tx() may have caused us to transition to the Terminated state.
*/
res->net_read_desired = !ossl_quic_channel_is_terminated(ch);
- /* We want to write to the network if we have any in our queue. */
+ /* We want to write to the network if we have any data in our TX queue. */
res->net_write_desired
= (!ossl_quic_channel_is_terminated(ch)
&& ossl_qtx_get_queue_len_datagrams(ch->qtx) > 0);
}
-/* Process incoming datagrams, if any. */
-static void ch_rx_pre(QUIC_CHANNEL *ch)
+static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only)
{
- int ret;
+ uint64_t error_code;
+ const char *error_msg;
+ ERR_STATE *error_state = NULL;
- if (!ch->is_server && !ch->have_sent_any_pkt)
- return;
+ if (channel_only)
+ return 1;
- /*
- * Get DEMUX to BIO_recvmmsg from the network and queue incoming datagrams
- * to the appropriate QRX instance.
- */
- ret = ossl_quic_demux_pump(ch->demux);
- if (ret == QUIC_DEMUX_PUMP_RES_STATELESS_RESET)
- ch_stateless_reset(ch);
- else if (ret == QUIC_DEMUX_PUMP_RES_PERMANENT_FAIL)
- /*
- * We don't care about transient failure, but permanent failure means we
- * should tear down the connection as though a protocol violation
- * occurred. Skip straight to the Terminating state as there is no point
- * trying to send CONNECTION_CLOSE frames if the network BIO is not
- * operating correctly.
- */
- ch_raise_net_error(ch);
+ ch->did_tls_tick = 1;
+ ossl_quic_tls_tick(ch->qtls);
+
+ if (ossl_quic_tls_get_error(ch->qtls, &error_code, &error_msg,
+ &error_state)) {
+ ossl_quic_channel_raise_protocol_error_state(ch, error_code, 0,
+ error_msg, error_state);
+ return 0;
+ }
+
+ return 1;
}
/* Check incoming forged packet limit and terminate connection if needed. */
}
/* Process queued incoming packets and handle frames, if any. */
-static int ch_rx(QUIC_CHANNEL *ch)
+static int ch_rx(QUIC_CHANNEL *ch, int channel_only)
{
int handled_any = 0;
const int closing = ossl_quic_channel_is_closing(ch);
ch_update_ping_deadline(ch);
}
- ch_rx_handle_packet(ch); /* best effort */
+ ch_rx_handle_packet(ch, channel_only); /* best effort */
/*
* Regardless of the outcome of frame handling, unref the packet.
}
/* Handles the packet currently in ch->qrx_pkt->hdr. */
-static void ch_rx_handle_packet(QUIC_CHANNEL *ch)
+static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only)
{
uint32_t enc_level;
int old_have_processed_any_pkt = ch->have_processed_any_pkt;
* than allow the QRX to emit a potentially malformed packet to the
* upper layers. However, special casing this will do for now.
*/
- if (!ossl_quic_validate_retry_integrity_tag(ch->libctx,
- ch->propq,
+ if (!ossl_quic_validate_retry_integrity_tag(ch->port->engine->libctx,
+ ch->port->engine->propq,
ch->qrx_pkt->hdr,
&ch->init_dcid))
/* Malformed retry packet, ignore. */
/* This packet contains frames, pass to the RXDP. */
ossl_quic_handle_frames(ch, ch->qrx_pkt); /* best effort */
+
+ if (ch->did_crypto_frame)
+ ch_tick_tls(ch, channel_only);
+
break;
case QUIC_PKT_TYPE_VERSION_NEG:
ch_start_terminating(ch, &tcause, 1);
}
-/*
- * This is called by the demux when we get a packet not destined for any known
- * DCID.
- */
-static void ch_default_packet_handler(QUIC_URXE *e, void *arg)
-{
- QUIC_CHANNEL *ch = arg;
- PACKET pkt;
- QUIC_PKT_HDR hdr;
-
- if (!ossl_assert(ch->is_server))
- goto undesirable;
-
- /*
- * We only support one connection to our server currently, so if we already
- * started one, ignore any new connection attempts.
- */
- if (ch->state != QUIC_CHANNEL_STATE_IDLE)
- goto undesirable;
-
- /*
- * We have got a packet for an unknown DCID. This might be an attempt to
- * open a new connection.
- */
- if (e->data_len < QUIC_MIN_INITIAL_DGRAM_LEN)
- goto undesirable;
-
- if (!PACKET_buf_init(&pkt, ossl_quic_urxe_data(e), e->data_len))
- goto err;
-
- /*
- * We set short_conn_id_len to SIZE_MAX here which will cause the decode
- * operation to fail if we get a 1-RTT packet. This is fine since we only
- * care about Initial packets.
- */
- if (!ossl_quic_wire_decode_pkt_hdr(&pkt, SIZE_MAX, 1, 0, &hdr, NULL))
- goto undesirable;
-
- switch (hdr.version) {
- case QUIC_VERSION_1:
- break;
-
- case QUIC_VERSION_NONE:
- default:
- /* Unknown version or proactive version negotiation request, bail. */
- /* TODO(QUIC SERVER): Handle version negotiation on server side */
- goto undesirable;
- }
-
- /*
- * We only care about Initial packets which might be trying to establish a
- * connection.
- */
- if (hdr.type != QUIC_PKT_TYPE_INITIAL)
- goto undesirable;
-
- /*
- * Assume this is a valid attempt to initiate a connection.
- *
- * We do not register the DCID in the initial packet we received and that
- * DCID is not actually used again, thus after provisioning the correct
- * Initial keys derived from it (which is done in the call below) we pass
- * the received packet directly to the QRX so that it can process it as a
- * one-time thing, instead of going through the usual DEMUX DCID-based
- * routing.
- */
- if (!ch_server_on_new_conn(ch, &e->peer,
- &hdr.src_conn_id,
- &hdr.dst_conn_id))
- goto err;
-
- ossl_qrx_inject_urxe(ch->qrx, e);
- return;
-
-err:
- ossl_quic_channel_raise_protocol_error(ch, QUIC_ERR_INTERNAL_ERROR, 0,
- "internal error");
-undesirable:
- ossl_quic_demux_release_urxe(ch->demux, e);
-}
-
/* Try to generate packets and if possible, flush them to the network. */
static int ch_tx(QUIC_CHANNEL *ch)
{
res = ossl_quic_tx_packetiser_generate(ch->txp, &status);
if (status.sent_pkt > 0) {
ch->have_sent_any_pkt = 1; /* Packet(s) were sent */
+ ch->port->have_sent_any_pkt = 1;
/*
* RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when
case QTX_FLUSH_NET_RES_PERMANENT_FAIL:
default:
/* Permanent underlying network BIO, start terminating. */
- ch_raise_net_error(ch);
+ ossl_quic_port_raise_net_error(ch->port, ch);
break;
}
deadline = ossl_time_infinite();
/*
- * If the CC will let us send acks, check the ack deadline for all
- * enc_levels that are actually provisioned
+ * Check the ack deadline for all enc_levels that are actually provisioned.
+ * ACKs aren't restricted by CC.
*/
- if (ch->cc_method->get_tx_allowance(ch->cc_data) > 0) {
- for (i = 0; i < QUIC_ENC_LEVEL_NUM; i++) {
- if (ossl_qtx_is_enc_level_provisioned(ch->qtx, i)) {
- deadline = ossl_time_min(deadline,
- ossl_ackm_get_ack_deadline(ch->ackm,
- ossl_quic_enc_level_to_pn_space(i)));
- }
+ for (i = 0; i < QUIC_ENC_LEVEL_NUM; i++) {
+ if (ossl_qtx_is_enc_level_provisioned(ch->qtx, i)) {
+ deadline = ossl_time_min(deadline,
+ ossl_ackm_get_ack_deadline(ch->ackm,
+ ossl_quic_enc_level_to_pn_space(i)));
}
-
- /*
- * When do we need to send an ACK-eliciting packet to reset the idle
- * deadline timer for the peer?
- */
- if (!ossl_time_is_infinite(ch->ping_deadline))
- deadline = ossl_time_min(deadline, ch->ping_deadline);
}
+ /*
+ * When do we need to send an ACK-eliciting packet to reset the idle
+ * deadline timer for the peer?
+ */
+ if (!ossl_time_is_infinite(ch->ping_deadline))
+ deadline = ossl_time_min(deadline, ch->ping_deadline);
+
/* Apply TXP wakeup deadline. */
deadline = ossl_time_min(deadline,
ossl_quic_tx_packetiser_get_deadline(ch->txp));
}
/*
- * QUIC Channel: Network BIO Configuration
- * =======================================
+ * QUIC Channel: Lifecycle Events
+ * ==============================
*/
-/* Determines whether we can support a given poll descriptor. */
-static int validate_poll_descriptor(const BIO_POLL_DESCRIPTOR *d)
-{
- if (d->type == BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD && d->value.fd < 0) {
- ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
- return 0;
- }
-
- return 1;
-}
-
-BIO *ossl_quic_channel_get_net_rbio(QUIC_CHANNEL *ch)
-{
- return ch->net_rbio;
-}
-
-BIO *ossl_quic_channel_get_net_wbio(QUIC_CHANNEL *ch)
-{
- return ch->net_wbio;
-}
-
-static int ch_update_poll_desc(QUIC_CHANNEL *ch, BIO *net_bio, int for_write)
-{
- BIO_POLL_DESCRIPTOR d = {0};
-
- if (net_bio == NULL
- || (!for_write && !BIO_get_rpoll_descriptor(net_bio, &d))
- || (for_write && !BIO_get_wpoll_descriptor(net_bio, &d)))
- /* Non-pollable BIO */
- d.type = BIO_POLL_DESCRIPTOR_TYPE_NONE;
-
- if (!validate_poll_descriptor(&d))
- return 0;
-
- if (for_write)
- ossl_quic_reactor_set_poll_w(&ch->rtor, &d);
- else
- ossl_quic_reactor_set_poll_r(&ch->rtor, &d);
-
- return 1;
-}
-
-int ossl_quic_channel_update_poll_descriptors(QUIC_CHANNEL *ch)
-{
- int ok = 1;
-
- if (!ch_update_poll_desc(ch, ch->net_rbio, /*for_write=*/0))
- ok = 0;
-
- if (!ch_update_poll_desc(ch, ch->net_wbio, /*for_write=*/1))
- ok = 0;
-
- return ok;
-}
-
/*
- * QUIC_CHANNEL does not ref any BIO it is provided with, nor is any ref
- * transferred to it. The caller (i.e., QUIC_CONNECTION) is responsible for
- * ensuring the BIO lasts until the channel is freed or the BIO is switched out
- * for another BIO by a subsequent successful call to this function.
+ * Record a state transition. This is not necessarily a change to ch->state but
+ * also includes the handshake becoming complete or confirmed, etc.
*/
-int ossl_quic_channel_set_net_rbio(QUIC_CHANNEL *ch, BIO *net_rbio)
+static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state)
{
- if (ch->net_rbio == net_rbio)
- return 1;
+ uint32_t old_state = ch->state;
- if (!ch_update_poll_desc(ch, net_rbio, /*for_write=*/0))
- return 0;
+ ch->state = new_state;
- ossl_quic_demux_set_bio(ch->demux, net_rbio);
- ch->net_rbio = net_rbio;
- return 1;
+ ossl_qlog_event_connectivity_connection_state_updated(ch_get_qlog(ch),
+ old_state,
+ new_state,
+ ch->handshake_complete,
+ ch->handshake_confirmed);
}
-int ossl_quic_channel_set_net_wbio(QUIC_CHANNEL *ch, BIO *net_wbio)
-{
- if (ch->net_wbio == net_wbio)
- return 1;
-
- if (!ch_update_poll_desc(ch, net_wbio, /*for_write=*/1))
- return 0;
-
- ossl_qtx_set_bio(ch->qtx, net_wbio);
- ch->net_wbio = net_wbio;
- return 1;
-}
-
-/*
- * QUIC Channel: Lifecycle Events
- * ==============================
- */
int ossl_quic_channel_start(QUIC_CHANNEL *ch)
{
- uint64_t error_code;
- const char *error_msg;
- ERR_STATE *error_state = NULL;
-
if (ch->is_server)
/*
* This is not used by the server. The server moves to active
return 0;
/* Plug in secrets for the Initial EL. */
- if (!ossl_quic_provide_initial_secret(ch->libctx,
- ch->propq,
+ if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
+ ch->port->engine->propq,
&ch->init_dcid,
ch->is_server,
ch->qrx, ch->qtx))
return 0;
/* Change state. */
- ch->state = QUIC_CHANNEL_STATE_ACTIVE;
+ ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
ch->doing_proactive_ver_neg = 0; /* not currently supported */
- /* Handshake layer: start (e.g. send CH). */
- ossl_quic_tls_tick(ch->qtls);
+ ossl_qlog_event_connectivity_connection_started(ch_get_qlog(ch),
+ &ch->init_dcid);
- if (ossl_quic_tls_get_error(ch->qtls, &error_code, &error_msg,
- &error_state)) {
- ossl_quic_channel_raise_protocol_error_state(ch, error_code, 0,
- error_msg, error_state);
+ /* Handshake layer: start (e.g. send CH). */
+ if (!ch_tick_tls(ch, /*channel_only=*/0))
return 0;
- }
- ossl_quic_reactor_tick(&ch->rtor, 0); /* best effort */
+ ossl_quic_reactor_tick(ossl_quic_port_get0_reactor(ch->port), 0); /* best effort */
return 1;
}
if ((buf = OPENSSL_memdup(retry_token, retry_token_len)) == NULL)
return 0;
- ossl_quic_tx_packetiser_set_initial_token(ch->txp, buf, retry_token_len,
- free_token, NULL);
+ if (!ossl_quic_tx_packetiser_set_initial_token(ch->txp, buf,
+ retry_token_len,
+ free_token, NULL)) {
+ /*
+ * This may fail if the token we receive is too big for us to ever be
+ * able to transmit in an outgoing Initial packet.
+ */
+ ossl_quic_channel_raise_protocol_error(ch, QUIC_ERR_INVALID_TOKEN, 0,
+ "received oversize token");
+ OPENSSL_free(buf);
+ return 0;
+ }
ch->retry_scid = *retry_scid;
ch->doing_retry = 1;
* Plug in new secrets for the Initial EL. This is the only time we change
* the secrets for an EL after we already provisioned it.
*/
- if (!ossl_quic_provide_initial_secret(ch->libctx,
- ch->propq,
+ if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
+ ch->port->engine->propq,
&ch->retry_scid,
/*is_server=*/0,
ch->qrx, ch->qtx))
ch_discard_el(ch, QUIC_ENC_LEVEL_HANDSHAKE);
ch->handshake_confirmed = 1;
+ ch_record_state_transition(ch, ch->state);
ossl_ackm_on_handshake_confirmed(ch->ackm);
return 1;
}
case QUIC_CHANNEL_STATE_ACTIVE:
copy_tcause(&ch->terminate_cause, tcause);
+ ossl_qlog_event_connectivity_connection_closed(ch_get_qlog(ch), tcause);
+
if (!force_immediate) {
- ch->state = tcause->remote ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
- : QUIC_CHANNEL_STATE_TERMINATING_CLOSING;
+ ch_record_state_transition(ch, tcause->remote
+ ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
+ : QUIC_CHANNEL_STATE_TERMINATING_CLOSING);
/*
* RFC 9000 s. 10.2 Immediate Close
* These states SHOULD persist for at least three times
* closing state if it receives a CONNECTION_CLOSE frame,
* which indicates that the peer is also closing or draining.
*/
- ch->state = QUIC_CHANNEL_STATE_TERMINATING_DRAINING;
+ ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATING_DRAINING);
break;
WPACKET wpkt;
size_t l;
- chan_remove_reset_token(ch, seq_num);
+ ossl_quic_srtm_remove(ch->srtm, ch, seq_num);
if ((buf_mem = BUF_MEM_new()) == NULL)
goto err;
if (new_remote_seq_num > ch->cur_remote_seq_num) {
/* Add new stateless reset token */
- if (!chan_add_reset_token(ch, f->stateless_reset.token,
- new_remote_seq_num)) {
+ if (!ossl_quic_srtm_add(ch->srtm, ch, new_remote_seq_num,
+ &f->stateless_reset)) {
ossl_quic_channel_raise_protocol_error(
ch, QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
OSSL_ERR_STATE_save(ch->err_state);
}
-static void ch_stateless_reset(QUIC_CHANNEL *ch)
+void ossl_quic_channel_inject(QUIC_CHANNEL *ch, QUIC_URXE *e)
+{
+ ossl_qrx_inject_urxe(ch->qrx, e);
+}
+
+void ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL *ch)
{
QUIC_TERMINATE_CAUSE tcause = {0};
- tcause.error_code = QUIC_ERR_NO_ERROR;
- ch_start_terminating(ch, &tcause, 1);
+ tcause.error_code = QUIC_ERR_NO_ERROR;
+ tcause.remote = 1;
+ ch_start_terminating(ch, &tcause, 0);
}
-static void ch_raise_net_error(QUIC_CHANNEL *ch)
+void ossl_quic_channel_raise_net_error(QUIC_CHANNEL *ch)
{
QUIC_TERMINATE_CAUSE tcause = {0};
- ch->net_error = 1;
+ if (ch->net_error)
+ return;
- ERR_raise_data(ERR_LIB_SSL, SSL_R_QUIC_NETWORK_ERROR,
- "connection terminated due to network error");
- ch_save_err_state(ch);
+ ch->net_error = 1;
tcause.error_code = QUIC_ERR_INTERNAL_ERROR;
+ tcause.reason = "network BIO I/O error";
+ tcause.reason_len = strlen(tcause.reason);
/*
* Skip Terminating state and go directly to Terminated, no point trying to
if (ch == NULL)
return;
- OSSL_ERR_STATE_restore(ch->err_state);
+ if (!ossl_quic_port_is_running(ch->port))
+ ossl_quic_port_restore_err_state(ch->port);
+ else
+ OSSL_ERR_STATE_restore(ch->err_state);
}
void ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL *ch,
*/
static void ch_on_terminating_timeout(QUIC_CHANNEL *ch)
{
- ch->state = QUIC_CHANNEL_STATE_TERMINATED;
+ ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
+}
+
+/*
+ * Determines the effective idle timeout duration. This is based on the idle
+ * timeout values that we and our peer signalled in transport parameters
+ * but have some limits applied.
+ */
+static OSSL_TIME ch_get_effective_idle_timeout_duration(QUIC_CHANNEL *ch)
+{
+ OSSL_TIME pto;
+
+ if (ch->max_idle_timeout == 0)
+ return ossl_time_infinite();
+
+ /*
+ * RFC 9000 s. 10.1: Idle Timeout
+ * To avoid excessively small idle timeout periods, endpoints
+ * MUST increase the idle timeout period to be at least three
+ * times the current Probe Timeout (PTO). This allows for
+ * multiple PTOs to expire, and therefore multiple probes to
+ * be sent and lost, prior to idle timeout.
+ */
+ pto = ossl_ackm_get_pto_duration(ch->ackm);
+ return ossl_time_max(ossl_ms2time(ch->max_idle_timeout),
+ ossl_time_multiply(pto, 3));
}
/*
*/
static void ch_update_idle(QUIC_CHANNEL *ch)
{
- if (ch->max_idle_timeout == 0)
- ch->idle_deadline = ossl_time_infinite();
- else {
- /* RFC 9000 s. 10.1: Idle Timeout
- * To avoid excessively small idle timeout periods, endpoints
- * MUST increase the idle timeout period to be at least three
- * times the current Probe Timeout (PTO). This allows for
- * multiple PTOs to expire, and therefore multiple probes to
- * be sent and lost, prior to idle timeout.
- */
- OSSL_TIME pto = ossl_ackm_get_pto_duration(ch->ackm);
- OSSL_TIME timeout = ossl_time_max(ossl_ms2time(ch->max_idle_timeout),
- ossl_time_multiply(pto, 3));
-
- ch->idle_deadline = ossl_time_add(get_time(ch), timeout);
- }
+ ch->idle_deadline = ossl_time_add(get_time(ch),
+ ch_get_effective_idle_timeout_duration(ch));
}
/*
*/
static void ch_update_ping_deadline(QUIC_CHANNEL *ch)
{
- if (ch->max_idle_timeout > 0) {
- /*
- * Maximum amount of time without traffic before we send a PING to keep
- * the connection open. Usually we use max_idle_timeout/2, but ensure
- * the period never exceeds the assumed NAT interval to ensure NAT
- * devices don't have their state time out (RFC 9000 s. 10.1.2).
- */
- OSSL_TIME max_span
- = ossl_time_divide(ossl_ms2time(ch->max_idle_timeout), 2);
-
- max_span = ossl_time_min(max_span, MAX_NAT_INTERVAL);
+ OSSL_TIME max_span, idle_duration;
- ch->ping_deadline = ossl_time_add(get_time(ch), max_span);
- } else {
+ idle_duration = ch_get_effective_idle_timeout_duration(ch);
+ if (ossl_time_is_infinite(idle_duration)) {
ch->ping_deadline = ossl_time_infinite();
+ return;
}
+
+ /*
+ * Maximum amount of time without traffic before we send a PING to keep
+ * the connection open. Usually we use max_idle_timeout/2, but ensure
+ * the period never exceeds the assumed NAT interval to ensure NAT
+ * devices don't have their state time out (RFC 9000 s. 10.1.2).
+ */
+ max_span = ossl_time_divide(idle_duration, 2);
+ max_span = ossl_time_min(max_span, MAX_NAT_INTERVAL);
+ ch->ping_deadline = ossl_time_add(get_time(ch), max_span);
}
/* Called when the idle timeout expires. */
ch->terminate_cause.error_code = UINT64_MAX;
ch->terminate_cause.frame_type = 0;
- ch->state = QUIC_CHANNEL_STATE_TERMINATED;
+ ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
}
/* Called when we, as a server, get a new incoming connection. */
-static int ch_server_on_new_conn(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
- const QUIC_CONN_ID *peer_scid,
- const QUIC_CONN_ID *peer_dcid)
+int ossl_quic_channel_on_new_conn(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
+ const QUIC_CONN_ID *peer_scid,
+ const QUIC_CONN_ID *peer_dcid)
{
if (!ossl_assert(ch->state == QUIC_CHANNEL_STATE_IDLE && ch->is_server))
return 0;
- /* Generate a SCID we will use for the connection. */
- if (!gen_rand_conn_id(ch->libctx, INIT_DCID_LEN,
- &ch->cur_local_cid))
+ /* Generate an Initial LCID we will use for the connection. */
+ if (!ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &ch->cur_local_cid))
return 0;
/* Note our newly learnt peer address and CIDs. */
return 0;
/* Plug in secrets for the Initial EL. */
- if (!ossl_quic_provide_initial_secret(ch->libctx,
- ch->propq,
+ if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
+ ch->port->engine->propq,
&ch->init_dcid,
/*is_server=*/1,
ch->qrx, ch->qtx))
return 0;
- /* Register our local CID in the DEMUX. */
- if (!ossl_qrx_add_dst_conn_id(ch->qrx, &ch->cur_local_cid))
+ /* Register the peer ODCID in the LCIDM. */
+ if (!ossl_quic_lcidm_enrol_odcid(ch->lcidm, ch, &ch->init_dcid))
return 0;
/* Change state. */
- ch->state = QUIC_CHANNEL_STATE_ACTIVE;
+ ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
ch->doing_proactive_ver_neg = 0; /* not currently supported */
return 1;
}
int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL *ch,
const QUIC_CONN_ID *conn_id)
{
- /* Remove the current local CID from the DEMUX. */
- if (!ossl_qrx_remove_dst_conn_id(ch->qrx, &ch->cur_local_cid))
+ /* Remove the current LCID from the LCIDM. */
+ if (!ossl_quic_lcidm_debug_remove(ch->lcidm, &ch->cur_local_cid))
return 0;
ch->cur_local_cid = *conn_id;
/* Set in the TXP, used only for long header packets. */
if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
return 0;
- /* Register our new local CID in the DEMUX. */
- if (!ossl_qrx_add_dst_conn_id(ch->qrx, &ch->cur_local_cid))
+ /* Add the new LCID to the LCIDM. */
+ if (!ossl_quic_lcidm_debug_add(ch->lcidm, ch, &ch->cur_local_cid,
+ 100))
return 0;
return 1;
}
return 1;
}
-void ossl_quic_channel_set_inhibit_tick(QUIC_CHANNEL *ch, int inhibit)
-{
- ch->inhibit_tick = (inhibit != 0);
-}
-
uint16_t ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL *ch)
{
return ch->diag_num_rx_ack;
projects / thirdparty / openssl.git / blobdiff