ssl/quic/quic_port.c

   1 /*
   2  * Copyright 2023-2024 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include "internal/quic_port.h"
  11 #include "internal/quic_channel.h"
  12 #include "internal/quic_lcidm.h"
  13 #include "internal/quic_srtm.h"
  14 #include "quic_port_local.h"
  15 #include "quic_channel_local.h"
  16 #include "quic_engine_local.h"
  17 #include "../ssl_local.h"
  18
  19 /*
  20  * QUIC Port Structure
  21  * ===================
  22  */
  23 #define INIT_DCID_LEN                   8
  24
  25 static int port_init(QUIC_PORT *port);
  26 static void port_cleanup(QUIC_PORT *port);
  27 static OSSL_TIME get_time(void *arg);
  28 static void port_default_packet_handler(QUIC_URXE *e, void *arg,
  29                                         const QUIC_CONN_ID *dcid);
  30 static void port_rx_pre(QUIC_PORT *port);
  31
  32 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
  33 DEFINE_LIST_OF_IMPL(port, QUIC_PORT);
  34
  35 QUIC_PORT *ossl_quic_port_new(const QUIC_PORT_ARGS *args)
  36 {
  37     QUIC_PORT *port;
  38
  39     if ((port = OPENSSL_zalloc(sizeof(QUIC_PORT))) == NULL)
  40         return NULL;
  41
  42     port->engine        = args->engine;
  43     port->channel_ctx   = args->channel_ctx;
  44     port->is_multi_conn = args->is_multi_conn;
  45
  46     if (!port_init(port)) {
  47         OPENSSL_free(port);
  48         return NULL;
  49     }
  50
  51     return port;
  52 }
  53
  54 void ossl_quic_port_free(QUIC_PORT *port)
  55 {
  56     if (port == NULL)
  57         return;
  58
  59     port_cleanup(port);
  60     OPENSSL_free(port);
  61 }
  62
  63 static int port_init(QUIC_PORT *port)
  64 {
  65     size_t rx_short_dcid_len = (port->is_multi_conn ? INIT_DCID_LEN : 0);
  66
  67     if (port->engine == NULL || port->channel_ctx == NULL)
  68         goto err;
  69
  70     if ((port->err_state = OSSL_ERR_STATE_new()) == NULL)
  71         goto err;
  72
  73     if ((port->demux = ossl_quic_demux_new(/*BIO=*/NULL,
  74                                            /*Short CID Len=*/rx_short_dcid_len,
  75                                            get_time, port)) == NULL)
  76         goto err;
  77
  78     ossl_quic_demux_set_default_handler(port->demux,
  79                                         port_default_packet_handler,
  80                                         port);
  81
  82     if ((port->srtm = ossl_quic_srtm_new(port->engine->libctx,
  83                                          port->engine->propq)) == NULL)
  84         goto err;
  85
  86     if ((port->lcidm = ossl_quic_lcidm_new(port->engine->libctx,
  87                                            rx_short_dcid_len)) == NULL)
  88         goto err;
  89
  90     port->rx_short_dcid_len = (unsigned char)rx_short_dcid_len;
  91     port->tx_init_dcid_len  = INIT_DCID_LEN;
  92     port->state             = QUIC_PORT_STATE_RUNNING;
  93
  94     ossl_list_port_insert_tail(&port->engine->port_list, port);
  95     port->on_engine_list    = 1;
  96     return 1;
  97
  98 err:
  99     port_cleanup(port);
 100     return 0;
 101 }
 102
 103 static void port_cleanup(QUIC_PORT *port)
 104 {
 105     assert(ossl_list_ch_num(&port->channel_list) == 0);
 106
 107     ossl_quic_demux_free(port->demux);
 108     port->demux = NULL;
 109
 110     ossl_quic_srtm_free(port->srtm);
 111     port->srtm = NULL;
 112
 113     ossl_quic_lcidm_free(port->lcidm);
 114     port->lcidm = NULL;
 115
 116     OSSL_ERR_STATE_free(port->err_state);
 117     port->err_state = NULL;
 118
 119     if (port->on_engine_list) {
 120         ossl_list_port_remove(&port->engine->port_list, port);
 121         port->on_engine_list = 0;
 122     }
 123 }
 124
 125 static void port_transition_failed(QUIC_PORT *port)
 126 {
 127     if (port->state == QUIC_PORT_STATE_FAILED)
 128         return;
 129
 130     port->state = QUIC_PORT_STATE_FAILED;
 131 }
 132
 133 int ossl_quic_port_is_running(const QUIC_PORT *port)
 134 {
 135     return port->state == QUIC_PORT_STATE_RUNNING;
 136 }
 137
 138 QUIC_ENGINE *ossl_quic_port_get0_engine(QUIC_PORT *port)
 139 {
 140     return port->engine;
 141 }
 142
 143 QUIC_REACTOR *ossl_quic_port_get0_reactor(QUIC_PORT *port)
 144 {
 145     return ossl_quic_engine_get0_reactor(port->engine);
 146 }
 147
 148 QUIC_DEMUX *ossl_quic_port_get0_demux(QUIC_PORT *port)
 149 {
 150     return port->demux;
 151 }
 152
 153 CRYPTO_MUTEX *ossl_quic_port_get0_mutex(QUIC_PORT *port)
 154 {
 155     return ossl_quic_engine_get0_mutex(port->engine);
 156 }
 157
 158 OSSL_TIME ossl_quic_port_get_time(QUIC_PORT *port)
 159 {
 160     return ossl_quic_engine_get_time(port->engine);
 161 }
 162
 163 static OSSL_TIME get_time(void *port)
 164 {
 165     return ossl_quic_port_get_time((QUIC_PORT *)port);
 166 }
 167
 168 int ossl_quic_port_get_rx_short_dcid_len(const QUIC_PORT *port)
 169 {
 170     return port->rx_short_dcid_len;
 171 }
 172
 173 int ossl_quic_port_get_tx_init_dcid_len(const QUIC_PORT *port)
 174 {
 175     return port->tx_init_dcid_len;
 176 }
 177
 178 /*
 179  * QUIC Port: Network BIO Configuration
 180  * ====================================
 181  */
 182
 183 /* Determines whether we can support a given poll descriptor. */
 184 static int validate_poll_descriptor(const BIO_POLL_DESCRIPTOR *d)
 185 {
 186     if (d->type == BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD && d->value.fd < 0) {
 187         ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
 188         return 0;
 189     }
 190
 191     return 1;
 192 }
 193
 194 BIO *ossl_quic_port_get_net_rbio(QUIC_PORT *port)
 195 {
 196     return port->net_rbio;
 197 }
 198
 199 BIO *ossl_quic_port_get_net_wbio(QUIC_PORT *port)
 200 {
 201     return port->net_wbio;
 202 }
 203
 204 static int port_update_poll_desc(QUIC_PORT *port, BIO *net_bio, int for_write)
 205 {
 206     BIO_POLL_DESCRIPTOR d = {0};
 207
 208     if (net_bio == NULL
 209         || (!for_write && !BIO_get_rpoll_descriptor(net_bio, &d))
 210         || (for_write && !BIO_get_wpoll_descriptor(net_bio, &d)))
 211         /* Non-pollable BIO */
 212         d.type = BIO_POLL_DESCRIPTOR_TYPE_NONE;
 213
 214     if (!validate_poll_descriptor(&d))
 215         return 0;
 216
 217     /*
 218      * TODO(QUIC MULTIPORT): We currently only support one port per
 219      * engine/domain. This is necessitated because QUIC_REACTOR only supports a
 220      * single pollable currently. In the future, once complete polling
 221      * infrastructure has been implemented, this limitation can be removed.
 222      *
 223      * For now, just update the descriptor on the engine's reactor as we are
 224      * guaranteed to be the only port under it.
 225      */
 226     if (for_write)
 227         ossl_quic_reactor_set_poll_w(&port->engine->rtor, &d);
 228     else
 229         ossl_quic_reactor_set_poll_r(&port->engine->rtor, &d);
 230
 231     return 1;
 232 }
 233
 234 int ossl_quic_port_update_poll_descriptors(QUIC_PORT *port)
 235 {
 236     int ok = 1;
 237
 238     if (!port_update_poll_desc(port, port->net_rbio, /*for_write=*/0))
 239         ok = 0;
 240
 241     if (!port_update_poll_desc(port, port->net_wbio, /*for_write=*/1))
 242         ok = 0;
 243
 244     return ok;
 245 }
 246
 247 /*
 248  * QUIC_PORT does not ref any BIO it is provided with, nor is any ref
 249  * transferred to it. The caller (e.g., QUIC_CONNECTION) is responsible for
 250  * ensuring the BIO lasts until the channel is freed or the BIO is switched out
 251  * for another BIO by a subsequent successful call to this function.
 252  */
 253 int ossl_quic_port_set_net_rbio(QUIC_PORT *port, BIO *net_rbio)
 254 {
 255     if (port->net_rbio == net_rbio)
 256         return 1;
 257
 258     if (!port_update_poll_desc(port, net_rbio, /*for_write=*/0))
 259         return 0;
 260
 261     ossl_quic_demux_set_bio(port->demux, net_rbio);
 262     port->net_rbio = net_rbio;
 263     return 1;
 264 }
 265
 266 int ossl_quic_port_set_net_wbio(QUIC_PORT *port, BIO *net_wbio)
 267 {
 268     QUIC_CHANNEL *ch;
 269
 270     if (port->net_wbio == net_wbio)
 271         return 1;
 272
 273     if (!port_update_poll_desc(port, net_wbio, /*for_write=*/1))
 274         return 0;
 275
 276     LIST_FOREACH(ch, ch, &port->channel_list)
 277         ossl_qtx_set_bio(ch->qtx, net_wbio);
 278
 279     port->net_wbio = net_wbio;
 280     return 1;
 281 }
 282
 283 /*
 284  * QUIC Port: Channel Lifecycle
 285  * ============================
 286  */
 287
 288 static SSL *port_new_handshake_layer(QUIC_PORT *port)
 289 {
 290     SSL *tls = NULL;
 291     SSL_CONNECTION *tls_conn = NULL;
 292
 293     tls = ossl_ssl_connection_new_int(port->channel_ctx, TLS_method());
 294     if (tls == NULL || (tls_conn = SSL_CONNECTION_FROM_SSL(tls)) == NULL)
 295         return NULL;
 296
 297     /* Override the user_ssl of the inner connection. */
 298     tls_conn->s3.flags      |= TLS1_FLAGS_QUIC;
 299
 300     /* Restrict options derived from the SSL_CTX. */
 301     tls_conn->options       &= OSSL_QUIC_PERMITTED_OPTIONS_CONN;
 302     tls_conn->pha_enabled   = 0;
 303     return tls;
 304 }
 305
 306 static QUIC_CHANNEL *port_make_channel(QUIC_PORT *port, SSL *tls, int is_server)
 307 {
 308     QUIC_CHANNEL_ARGS args = {0};
 309     QUIC_CHANNEL *ch;
 310
 311     args.port       = port;
 312     args.is_server  = is_server;
 313     args.tls        = (tls != NULL ? tls : port_new_handshake_layer(port));
 314     args.lcidm      = port->lcidm;
 315     args.srtm       = port->srtm;
 316     if (args.tls == NULL)
 317         return NULL;
 318
 319 #ifndef OPENSSL_NO_QLOG
 320     args.use_qlog   = 1; /* disabled if env not set */
 321     args.qlog_title = args.tls->ctx->qlog_title;
 322 #endif
 323
 324     ch = ossl_quic_channel_new(&args);
 325     if (ch == NULL) {
 326         if (tls == NULL)
 327             SSL_free(args.tls);
 328
 329         return NULL;
 330     }
 331
 332     return ch;
 333 }
 334
 335 QUIC_CHANNEL *ossl_quic_port_create_outgoing(QUIC_PORT *port, SSL *tls)
 336 {
 337     return port_make_channel(port, tls, /*is_server=*/0);
 338 }
 339
 340 QUIC_CHANNEL *ossl_quic_port_create_incoming(QUIC_PORT *port, SSL *tls)
 341 {
 342     QUIC_CHANNEL *ch;
 343
 344     assert(port->tserver_ch == NULL);
 345
 346     ch = port_make_channel(port, tls, /*is_server=*/1);
 347     port->tserver_ch = ch;
 348     port->is_server  = 1;
 349     return ch;
 350 }
 351
 352 /*
 353  * QUIC Port: Ticker-Mutator
 354  * =========================
 355  */
 356
 357 /*
 358  * Tick function for this port. This does everything related to network I/O for
 359  * this port's network BIOs, and services child channels.
 360  */
 361 void ossl_quic_port_subtick(QUIC_PORT *port, QUIC_TICK_RESULT *res,
 362                             uint32_t flags)
 363 {
 364     QUIC_CHANNEL *ch;
 365
 366     res->net_read_desired   = 0;
 367     res->net_write_desired  = 0;
 368     res->tick_deadline      = ossl_time_infinite();
 369
 370     if (!port->engine->inhibit_tick) {
 371         /* Handle any incoming data from network. */
 372         if (ossl_quic_port_is_running(port))
 373             port_rx_pre(port);
 374
 375         /* Iterate through all channels and service them. */
 376         LIST_FOREACH(ch, ch, &port->channel_list) {
 377             QUIC_TICK_RESULT subr = {0};
 378
 379             ossl_quic_channel_subtick(ch, &subr, flags);
 380             ossl_quic_tick_result_merge_into(res, &subr);
 381         }
 382     }
 383 }
 384
 385 /* Process incoming datagrams, if any. */
 386 static void port_rx_pre(QUIC_PORT *port)
 387 {
 388     int ret;
 389
 390     /*
 391      * Originally, this check (don't RX before we have sent anything if we are
 392      * not a server, because there can't be anything) was just intended as a
 393      * minor optimisation. However, it is actually required on Windows, and
 394      * removing this check will cause Windows to break.
 395      *
 396      * The reason is that under Win32, recvfrom() does not work on a UDP socket
 397      * which has not had bind() called (???). However, calling sendto() will
 398      * automatically bind an unbound UDP socket. Therefore, if we call a Winsock
 399      * recv-type function before calling a Winsock send-type function, that call
 400      * will fail with WSAEINVAL, which we will regard as a permanent network
 401      * error.
 402      *
 403      * Therefore, this check is essential as we do not require our API users to
 404      * bind a socket first when using the API in client mode.
 405      */
 406     if (!port->is_server && !port->have_sent_any_pkt)
 407         return;
 408
 409     /*
 410      * Get DEMUX to BIO_recvmmsg from the network and queue incoming datagrams
 411      * to the appropriate QRX instances.
 412      */
 413     ret = ossl_quic_demux_pump(port->demux);
 414     if (ret == QUIC_DEMUX_PUMP_RES_PERMANENT_FAIL)
 415         /*
 416          * We don't care about transient failure, but permanent failure means we
 417          * should tear down the port. All connections skip straight to the
 418          * Terminated state as there is no point trying to send CONNECTION_CLOSE
 419          * frames if the network BIO is not operating correctly.
 420          */
 421         ossl_quic_port_raise_net_error(port, NULL);
 422 }
 423
 424 /*
 425  * Handles an incoming connection request and potentially decides to make a
 426  * connection from it. If a new connection is made, the new channel is written
 427  * to *new_ch.
 428  */
 429 static void port_on_new_conn(QUIC_PORT *port, const BIO_ADDR *peer,
 430                              const QUIC_CONN_ID *scid,
 431                              const QUIC_CONN_ID *dcid,
 432                              QUIC_CHANNEL **new_ch)
 433 {
 434     if (port->tserver_ch != NULL) {
 435         /* Specially assign to existing channel */
 436         if (!ossl_quic_channel_on_new_conn(port->tserver_ch, peer, scid, dcid))
 437             return;
 438
 439         *new_ch = port->tserver_ch;
 440         port->tserver_ch = NULL;
 441         return;
 442     }
 443 }
 444
 445 static int port_try_handle_stateless_reset(QUIC_PORT *port, const QUIC_URXE *e)
 446 {
 447     size_t i;
 448     const unsigned char *data = ossl_quic_urxe_data(e);
 449     void *opaque = NULL;
 450
 451     /*
 452      * Perform some fast and cheap checks for a packet not being a stateless
 453      * reset token.  RFC 9000 s. 10.3 specifies this layout for stateless
 454      * reset packets:
 455      *
 456      *  Stateless Reset {
 457      *      Fixed Bits (2) = 1,
 458      *      Unpredictable Bits (38..),
 459      *      Stateless Reset Token (128),
 460      *  }
 461      *
 462      * It also specifies:
 463      *      However, endpoints MUST treat any packet ending in a valid
 464      *      stateless reset token as a Stateless Reset, as other QUIC
 465      *      versions might allow the use of a long header.
 466      *
 467      * We can rapidly check for the minimum length and that the first pair
 468      * of bits in the first byte are 01 or 11.
 469      *
 470      * The function returns 1 if it is a stateless reset packet, 0 if it isn't
 471      * and -1 if an error was encountered.
 472      */
 473     if (e->data_len < QUIC_STATELESS_RESET_TOKEN_LEN + 5
 474         || (0100 & *data) != 0100)
 475         return 0;
 476
 477     for (i = 0;; ++i) {
 478         if (!ossl_quic_srtm_lookup(port->srtm,
 479                                    (QUIC_STATELESS_RESET_TOKEN *)(data + e->data_len
 480                                    - sizeof(QUIC_STATELESS_RESET_TOKEN)),
 481                                    i, &opaque, NULL))
 482             break;
 483
 484         assert(opaque != NULL);
 485         ossl_quic_channel_on_stateless_reset((QUIC_CHANNEL *)opaque);
 486     }
 487
 488     return i > 0;
 489 }
 490
 491 /*
 492  * This is called by the demux when we get a packet not destined for any known
 493  * DCID.
 494  */
 495 static void port_default_packet_handler(QUIC_URXE *e, void *arg,
 496                                         const QUIC_CONN_ID *dcid)
 497 {
 498     QUIC_PORT *port = arg;
 499     PACKET pkt;
 500     QUIC_PKT_HDR hdr;
 501     QUIC_CHANNEL *ch = NULL, *new_ch = NULL;
 502
 503     /* Don't handle anything if we are no longer running. */
 504     if (!ossl_quic_port_is_running(port))
 505         goto undesirable;
 506
 507     if (port_try_handle_stateless_reset(port, e))
 508         goto undesirable;
 509
 510     if (dcid != NULL
 511         && ossl_quic_lcidm_lookup(port->lcidm, dcid, NULL,
 512                                   (void **)&ch)) {
 513         assert(ch != NULL);
 514         ossl_quic_channel_inject(ch, e);
 515         return;
 516     }
 517
 518     /*
 519      * If we have an incoming packet which doesn't match any existing connection
 520      * we assume this is an attempt to make a new connection. Currently we
 521      * require our caller to have precreated a latent 'incoming' channel via
 522      * TSERVER which then gets turned into the new connection.
 523      *
 524      * TODO(QUIC SERVER): In the future we will construct channels dynamically
 525      * in this case.
 526      */
 527     if (port->tserver_ch == NULL)
 528         goto undesirable;
 529
 530     /*
 531      * We have got a packet for an unknown DCID. This might be an attempt to
 532      * open a new connection.
 533      */
 534     if (e->data_len < QUIC_MIN_INITIAL_DGRAM_LEN)
 535         goto undesirable;
 536
 537     if (!PACKET_buf_init(&pkt, ossl_quic_urxe_data(e), e->data_len))
 538         goto undesirable;
 539
 540     /*
 541      * We set short_conn_id_len to SIZE_MAX here which will cause the decode
 542      * operation to fail if we get a 1-RTT packet. This is fine since we only
 543      * care about Initial packets.
 544      */
 545     if (!ossl_quic_wire_decode_pkt_hdr(&pkt, SIZE_MAX, 1, 0, &hdr, NULL))
 546         goto undesirable;
 547
 548     switch (hdr.version) {
 549         case QUIC_VERSION_1:
 550             break;
 551
 552         case QUIC_VERSION_NONE:
 553         default:
 554             /* Unknown version or proactive version negotiation request, bail. */
 555             /* TODO(QUIC SERVER): Handle version negotiation on server side */
 556             goto undesirable;
 557     }
 558
 559     /*
 560      * We only care about Initial packets which might be trying to establish a
 561      * connection.
 562      */
 563     if (hdr.type != QUIC_PKT_TYPE_INITIAL)
 564         goto undesirable;
 565
 566     /*
 567      * Try to process this as a valid attempt to initiate a connection.
 568      *
 569      * The channel will do all the LCID registration needed, but as an
 570      * optimization inject this packet directly into the channel's QRX for
 571      * processing without going through the DEMUX again.
 572      */
 573     port_on_new_conn(port, &e->peer, &hdr.src_conn_id, &hdr.dst_conn_id,
 574                      &new_ch);
 575     if (new_ch != NULL)
 576         ossl_qrx_inject_urxe(new_ch->qrx, e);
 577
 578     return;
 579
 580 undesirable:
 581     ossl_quic_demux_release_urxe(port->demux, e);
 582 }
 583
 584 void ossl_quic_port_raise_net_error(QUIC_PORT *port,
 585                                     QUIC_CHANNEL *triggering_ch)
 586 {
 587     QUIC_CHANNEL *ch;
 588
 589     if (!ossl_quic_port_is_running(port))
 590         return;
 591
 592     /*
 593      * Immediately capture any triggering error on the error stack, with a
 594      * cover error.
 595      */
 596     ERR_raise_data(ERR_LIB_SSL, SSL_R_QUIC_NETWORK_ERROR,
 597                    "port failed due to network BIO I/O error");
 598     OSSL_ERR_STATE_save(port->err_state);
 599
 600     port_transition_failed(port);
 601
 602     /* Give the triggering channel (if any) the first notification. */
 603     if (triggering_ch != NULL)
 604         ossl_quic_channel_raise_net_error(triggering_ch);
 605
 606     LIST_FOREACH(ch, ch, &port->channel_list)
 607         if (ch != triggering_ch)
 608             ossl_quic_channel_raise_net_error(ch);
 609 }
 610
 611 void ossl_quic_port_restore_err_state(const QUIC_PORT *port)
 612 {
 613     ERR_clear_error();
 614     OSSL_ERR_STATE_restore(port->err_state);
 615 }