2 * Copyright 2023 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include "internal/quic_port.h"
11 #include "internal/quic_channel.h"
12 #include "internal/quic_lcidm.h"
13 #include "internal/quic_srtm.h"
14 #include "quic_port_local.h"
15 #include "quic_channel_local.h"
16 #include "../ssl_local.h"
22 #define INIT_DCID_LEN 8
24 static int port_init(QUIC_PORT *port);
25 static void port_cleanup(QUIC_PORT *port);
26 static OSSL_TIME get_time(void *arg);
27 static void port_tick(QUIC_TICK_RESULT *res, void *arg, uint32_t flags);
28 static void port_default_packet_handler(QUIC_URXE *e, void *arg,
29 const QUIC_CONN_ID *dcid);
30 static void port_rx_pre(QUIC_PORT *port);
32 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
34 QUIC_PORT *ossl_quic_port_new(const QUIC_PORT_ARGS *args)
38 if ((port = OPENSSL_zalloc(sizeof(QUIC_PORT))) == NULL)
41 port->libctx = args->libctx;
42 port->propq = args->propq;
43 port->mutex = args->mutex;
44 port->now_cb = args->now_cb;
45 port->now_cb_arg = args->now_cb_arg;
46 port->channel_ctx = args->channel_ctx;
47 port->is_multi_conn = args->is_multi_conn;
49 if (!port_init(port)) {
57 void ossl_quic_port_free(QUIC_PORT *port)
66 static int port_init(QUIC_PORT *port)
68 size_t rx_short_dcid_len = (port->is_multi_conn ? INIT_DCID_LEN : 0);
70 if (port->channel_ctx == NULL)
73 if ((port->demux = ossl_quic_demux_new(/*BIO=*/NULL,
74 /*Short CID Len=*/rx_short_dcid_len,
75 get_time, port)) == NULL)
78 ossl_quic_demux_set_default_handler(port->demux,
79 port_default_packet_handler,
82 if ((port->srtm = ossl_quic_srtm_new(port->libctx, port->propq)) == NULL)
85 if ((port->lcidm = ossl_quic_lcidm_new(port->libctx, rx_short_dcid_len)) == NULL)
88 ossl_quic_reactor_init(&port->rtor, port_tick, port, ossl_time_zero());
89 port->rx_short_dcid_len = (unsigned char)rx_short_dcid_len;
90 port->tx_init_dcid_len = INIT_DCID_LEN;
98 static void port_cleanup(QUIC_PORT *port)
100 assert(ossl_list_ch_num(&port->channel_list) == 0);
102 ossl_quic_demux_free(port->demux);
105 ossl_quic_srtm_free(port->srtm);
108 ossl_quic_lcidm_free(port->lcidm);
112 QUIC_REACTOR *ossl_quic_port_get0_reactor(QUIC_PORT *port)
117 QUIC_DEMUX *ossl_quic_port_get0_demux(QUIC_PORT *port)
122 CRYPTO_MUTEX *ossl_quic_port_get0_mutex(QUIC_PORT *port)
127 OSSL_TIME ossl_quic_port_get_time(QUIC_PORT *port)
129 if (port->now_cb == NULL)
130 return ossl_time_now();
132 return port->now_cb(port->now_cb_arg);
135 static OSSL_TIME get_time(void *port)
137 return ossl_quic_port_get_time(port);
140 int ossl_quic_port_get_rx_short_dcid_len(const QUIC_PORT *port)
142 return port->rx_short_dcid_len;
145 int ossl_quic_port_get_tx_init_dcid_len(const QUIC_PORT *port)
147 return port->tx_init_dcid_len;
151 * QUIC Port: Network BIO Configuration
152 * ====================================
155 /* Determines whether we can support a given poll descriptor. */
156 static int validate_poll_descriptor(const BIO_POLL_DESCRIPTOR *d)
158 if (d->type == BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD && d->value.fd < 0) {
159 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
166 BIO *ossl_quic_port_get_net_rbio(QUIC_PORT *port)
168 return port->net_rbio;
171 BIO *ossl_quic_port_get_net_wbio(QUIC_PORT *port)
173 return port->net_wbio;
176 static int port_update_poll_desc(QUIC_PORT *port, BIO *net_bio, int for_write)
178 BIO_POLL_DESCRIPTOR d = {0};
181 || (!for_write && !BIO_get_rpoll_descriptor(net_bio, &d))
182 || (for_write && !BIO_get_wpoll_descriptor(net_bio, &d)))
183 /* Non-pollable BIO */
184 d.type = BIO_POLL_DESCRIPTOR_TYPE_NONE;
186 if (!validate_poll_descriptor(&d))
190 ossl_quic_reactor_set_poll_w(&port->rtor, &d);
192 ossl_quic_reactor_set_poll_r(&port->rtor, &d);
197 int ossl_quic_port_update_poll_descriptors(QUIC_PORT *port)
201 if (!port_update_poll_desc(port, port->net_rbio, /*for_write=*/0))
204 if (!port_update_poll_desc(port, port->net_wbio, /*for_write=*/1))
211 * QUIC_PORT does not ref any BIO it is provided with, nor is any ref
212 * transferred to it. The caller (e.g., QUIC_CONNECTION) is responsible for
213 * ensuring the BIO lasts until the channel is freed or the BIO is switched out
214 * for another BIO by a subsequent successful call to this function.
216 int ossl_quic_port_set_net_rbio(QUIC_PORT *port, BIO *net_rbio)
218 if (port->net_rbio == net_rbio)
221 if (!port_update_poll_desc(port, net_rbio, /*for_write=*/0))
224 ossl_quic_demux_set_bio(port->demux, net_rbio);
225 port->net_rbio = net_rbio;
229 int ossl_quic_port_set_net_wbio(QUIC_PORT *port, BIO *net_wbio)
233 if (port->net_wbio == net_wbio)
236 if (!port_update_poll_desc(port, net_wbio, /*for_write=*/1))
239 LIST_FOREACH(ch, ch, &port->channel_list)
240 ossl_qtx_set_bio(ch->qtx, net_wbio);
242 port->net_wbio = net_wbio;
247 * QUIC Port: Channel Lifecycle
248 * ============================
251 static SSL *port_new_handshake_layer(QUIC_PORT *port)
254 SSL_CONNECTION *tls_conn = NULL;
256 tls = ossl_ssl_connection_new_int(port->channel_ctx, TLS_method());
257 if (tls == NULL || (tls_conn = SSL_CONNECTION_FROM_SSL(tls)) == NULL)
260 /* Override the user_ssl of the inner connection. */
261 tls_conn->s3.flags |= TLS1_FLAGS_QUIC;
263 /* Restrict options derived from the SSL_CTX. */
264 tls_conn->options &= OSSL_QUIC_PERMITTED_OPTIONS_CONN;
265 tls_conn->pha_enabled = 0;
269 static QUIC_CHANNEL *port_make_channel(QUIC_PORT *port, SSL *tls, int is_server)
271 QUIC_CHANNEL_ARGS args = {0};
275 args.is_server = is_server;
276 args.tls = (tls != NULL ? tls : port_new_handshake_layer(port));
277 args.lcidm = port->lcidm;
278 args.srtm = port->srtm;
279 if (args.tls == NULL)
282 ch = ossl_quic_channel_new(&args);
293 QUIC_CHANNEL *ossl_quic_port_create_outgoing(QUIC_PORT *port, SSL *tls)
295 return port_make_channel(port, tls, /*is_server=*/0);
298 QUIC_CHANNEL *ossl_quic_port_create_incoming(QUIC_PORT *port, SSL *tls)
302 assert(port->tserver_ch == NULL);
304 ch = port_make_channel(port, tls, /*is_server=*/1);
305 port->tserver_ch = ch;
310 * QUIC Port: Ticker-Mutator
311 * =========================
315 * The central ticker function called by the reactor. This does everything, or
316 * at least everything network I/O related. Best effort - not allowed to fail
319 static void port_tick(QUIC_TICK_RESULT *res, void *arg, uint32_t flags)
321 QUIC_PORT *port = arg;
324 res->net_read_desired = 0;
325 res->net_write_desired = 0;
326 res->tick_deadline = ossl_time_infinite();
328 if (!port->inhibit_tick) {
329 /* Handle any incoming data from network. */
332 /* Iterate through all channels and service them. */
333 LIST_FOREACH(ch, ch, &port->channel_list) {
334 QUIC_TICK_RESULT subr = {0};
336 ossl_quic_channel_subtick(ch, &subr, flags);
337 ossl_quic_tick_result_merge_into(res, &subr);
342 /* Process incoming datagrams, if any. */
343 static void port_rx_pre(QUIC_PORT *port)
347 // TODO !have_sent_any_pkt
350 * Get DEMUX to BIO_recvmmsg from the network and queue incoming datagrams
351 * to the appropriate QRX instances.
353 ret = ossl_quic_demux_pump(port->demux);
354 if (ret == QUIC_DEMUX_PUMP_RES_PERMANENT_FAIL)
356 * We don't care about transient failure, but permanent failure means we
357 * should tear down the port. All connections skip straight to the
358 * Terminated state as there is no point trying to send CONNECTION_CLOSE
359 * frames if the network BIO is not operating correctly.
361 ossl_quic_port_raise_net_error(port);
365 * Handles an incoming connection request and potentially decides to make a
366 * connection from it. If a new connection is made, the new channel is written
369 static void port_on_new_conn(QUIC_PORT *port, const BIO_ADDR *peer,
370 const QUIC_CONN_ID *scid,
371 const QUIC_CONN_ID *dcid,
372 QUIC_CHANNEL **new_ch)
374 if (port->tserver_ch != NULL) {
375 /* Specially assign to existing channel */
376 if (!ossl_quic_channel_on_new_conn(port->tserver_ch, peer, scid, dcid))
379 *new_ch = port->tserver_ch;
380 port->tserver_ch = NULL;
385 static int port_try_handle_stateless_reset(QUIC_PORT *port, const QUIC_URXE *e)
388 const unsigned char *data = ossl_quic_urxe_data(e);
392 * Perform some fast and cheap checks for a packet not being a stateless
393 * reset token. RFC 9000 s. 10.3 specifies this layout for stateless
397 * Fixed Bits (2) = 1,
398 * Unpredictable Bits (38..),
399 * Stateless Reset Token (128),
403 * However, endpoints MUST treat any packet ending in a valid
404 * stateless reset token as a Stateless Reset, as other QUIC
405 * versions might allow the use of a long header.
407 * We can rapidly check for the minimum length and that the first pair
408 * of bits in the first byte are 01 or 11.
410 * The function returns 1 if it is a stateless reset packet, 0 if it isn't
411 * and -1 if an error was encountered.
413 if (e->data_len < QUIC_STATELESS_RESET_TOKEN_LEN + 5
414 || (0100 & *data) != 0100)
418 if (!ossl_quic_srtm_lookup(port->srtm,
419 (QUIC_STATELESS_RESET_TOKEN *)(data + e->data_len
420 - sizeof(QUIC_STATELESS_RESET_TOKEN)),
424 assert(opaque != NULL);
425 ossl_quic_channel_on_stateless_reset((QUIC_CHANNEL *)opaque);
432 * This is called by the demux when we get a packet not destined for any known
435 static void port_default_packet_handler(QUIC_URXE *e, void *arg,
436 const QUIC_CONN_ID *dcid)
438 QUIC_PORT *port = arg;
441 QUIC_CHANNEL *ch = NULL, *new_ch = NULL;
444 && ossl_quic_lcidm_lookup(port->lcidm, dcid, NULL,
447 ossl_quic_channel_inject(ch, e);
451 if (port_try_handle_stateless_reset(port, e))
455 if (port->tserver_ch == NULL)
458 // TODO allow_incoming
459 //if (!ossl_assert(ch->is_server))
462 //TODO if (ch->state != QUIC_CHANNEL_STATE_IDLE)
466 * We have got a packet for an unknown DCID. This might be an attempt to
467 * open a new connection.
469 if (e->data_len < QUIC_MIN_INITIAL_DGRAM_LEN)
472 if (!PACKET_buf_init(&pkt, ossl_quic_urxe_data(e), e->data_len))
476 * We set short_conn_id_len to SIZE_MAX here which will cause the decode
477 * operation to fail if we get a 1-RTT packet. This is fine since we only
478 * care about Initial packets.
480 if (!ossl_quic_wire_decode_pkt_hdr(&pkt, SIZE_MAX, 1, 0, &hdr, NULL))
483 switch (hdr.version) {
487 case QUIC_VERSION_NONE:
489 /* Unknown version or proactive version negotiation request, bail. */
490 /* TODO(QUIC SERVER): Handle version negotiation on server side */
495 * We only care about Initial packets which might be trying to establish a
498 if (hdr.type != QUIC_PKT_TYPE_INITIAL)
502 * Try to process this as a valid attempt to initiate a connection.
504 * We do not register the DCID in the Initial packet we received as
505 * that DCID is not actually used again, thus after provisioning
506 * the new connection and associated Initial keys, we inject the
507 * received packet directly to the new channel's QRX so that it can
508 * process it as a one-time thing, instead of going through the usual
509 * DEMUX DCID-based routing.
511 port_on_new_conn(port, &e->peer, &hdr.src_conn_id, &hdr.dst_conn_id,
514 ossl_qrx_inject_urxe(new_ch->qrx, e);
519 ossl_quic_demux_release_urxe(port->demux, e);
522 void ossl_quic_port_set_inhibit_tick(QUIC_PORT *port, int inhibit)
524 port->inhibit_tick = (inhibit != 0);
527 void ossl_quic_port_raise_net_error(QUIC_PORT *port)
533 LIST_FOREACH(ch, ch, &port->channel_list)
534 ossl_quic_channel_raise_net_error(ch);