QUIC DISPATCH/APL: Add SSL_set_incoming_stream_reject_policy (unwired)

Reviewed-by: Matt Caswell <matt@openssl.org>
Reviewed-by: Tomas Mraz <tomas@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/20765)

diff --git a/include/internal/quic_ssl.h b/include/internal/quic_ssl.h
index 986cd0e0d02ee11334e24700487e03626812041d..d307a9e1960624d967fa50a4763704b06c6b6d5a 100644 (file)
--- a/include/internal/quic_ssl.h
+++ b/include/internal/quic_ssl.h
@@ -72,6 +72,8 @@ __owur uint64_t ossl_quic_get_stream_id(SSL *s);
 __owur int ossl_quic_set_default_stream_mode(SSL *s, uint32_t mode);
 __owur SSL *ossl_quic_detach_stream(SSL *s);
 __owur int ossl_quic_attach_stream(SSL *conn, SSL *stream);
+__owur int ossl_quic_set_incoming_stream_reject_policy(SSL *s, int policy,
+                                                       uint64_t aec);
 
 /*
  * Used to override ossl_time_now() for debug purposes. Must be called before

diff --git a/include/openssl/ssl.h.in b/include/openssl/ssl.h.in
index c5ab10581643866fb6f9c7d30d60a80d7605204f..d29ad85ece2976c67dec886f4d958fe3c5560767 100644 (file)
--- a/include/openssl/ssl.h.in
+++ b/include/openssl/ssl.h.in
@@ -2288,6 +2288,11 @@ __owur int SSL_attach_stream(SSL *conn, SSL *stream);
 #define SSL_STREAM_FLAG_UNI     (1U << 0)
 __owur SSL *SSL_new_stream(SSL *s, uint64_t flags);
 
+#define SSL_INCOMING_STREAM_REJECT_POLICY_AUTO      0
+#define SSL_INCOMING_STREAM_REJECT_POLICY_ACCEPT    1
+#define SSL_INCOMING_STREAM_REJECT_POLICY_REJECT    2
+__owur int SSL_set_incoming_stream_reject_policy(SSL *s, int policy, uint64_t aec);
+
 # ifndef OPENSSL_NO_QUIC
 __owur int SSL_inject_net_dgram(SSL *s, const unsigned char *buf,
                                 size_t buf_len,

diff --git a/ssl/quic/quic_impl.c b/ssl/quic/quic_impl.c
index 4550ee3be0c3b6923231166c24a9f38d202fb41d..e76526a1b940523fe95028b741cbacafd7ccf3cf 100644 (file)
--- a/ssl/quic/quic_impl.c
+++ b/ssl/quic/quic_impl.c
@@ -296,6 +296,8 @@ SSL *ossl_quic_new(SSL_CTX *ctx)
     qc->default_stream_mode     = SSL_DEFAULT_STREAM_MODE_AUTO_BIDI;
     qc->default_ssl_mode        = qc->ssl.ctx->mode;
     qc->default_blocking        = 1;
+    qc->incoming_stream_reject_policy
+        = SSL_INCOMING_STREAM_REJECT_POLICY_AUTO;
     qc->last_error              = SSL_ERROR_NONE;
 
     if (!create_channel(qc))
@@ -2093,6 +2095,38 @@ int ossl_quic_attach_stream(SSL *conn, SSL *stream)
     return 1;
 }
 
+/*
+ * SSL_set_incoming_stream_reject_policy
+ * -------------------------------------
+ */
+int ossl_quic_set_incoming_stream_reject_policy(SSL *s, int policy,
+                                                uint64_t aec)
+{
+    int ret = 1;
+    QCTX ctx;
+
+    if (!expect_quic_conn_only(s, &ctx))
+        return 0;
+
+    quic_lock(ctx.qc);
+
+    switch (policy) {
+    case SSL_INCOMING_STREAM_REJECT_POLICY_AUTO:
+    case SSL_INCOMING_STREAM_REJECT_POLICY_ACCEPT:
+    case SSL_INCOMING_STREAM_REJECT_POLICY_REJECT:
+        ctx.qc->incoming_stream_reject_policy = policy;
+        ctx.qc->incoming_stream_reject_aec    = aec;
+        break;
+
+    default:
+        ret = 0;
+        break;
+    }
+
+    quic_unlock(ctx.qc);
+    return ret;
+}
+
 /*
  * QUIC Front-End I/O API: SSL_CTX Management
  * ==========================================

diff --git a/ssl/quic/quic_local.h b/ssl/quic/quic_local.h
index edc82a415e10d39054c7f15c879c0ec1d47fcdf8..1e6f35482a050100ee789d7822a6b6444b372306 100644 (file)
--- a/ssl/quic/quic_local.h
+++ b/ssl/quic/quic_local.h
@@ -178,6 +178,10 @@ struct quic_conn_st {
     /* SSL_set_mode. This is not used directly but inherited by new XSOs. */
     uint32_t                        default_ssl_mode;
 
+    /* SSL_set_incoming_stream_reject_policy. */
+    int                             incoming_stream_reject_policy;
+    uint64_t                        incoming_stream_reject_aec;
+
     /*
      * Last 'normal' error during an app-level I/O operation, used by
      * SSL_get_error(); used to track data-path errors like SSL_ERROR_WANT_READ

diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index c6cd2dabdae3a6c3ba25dd919aaa0abceac46e8c..6e3ef083765c2c7214df687ccea2cd7ee0759f64 100644 (file)
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -7388,6 +7388,18 @@ int SSL_attach_stream(SSL *conn, SSL *stream)
 #endif
 }
 
+int SSL_set_incoming_stream_reject_policy(SSL *s, int policy, uint64_t aec)
+{
+#ifndef OPENSSL_NO_QUIC
+    if (!IS_QUIC(s))
+        return 0;
+
+    return ossl_quic_set_incoming_stream_reject_policy(s, policy, aec);
+#else
+    return 0;
+#endif
+}
+
 int SSL_add_expected_rpk(SSL *s, EVP_PKEY *rpk)
 {
     unsigned char *data = NULL;

diff --git a/util/libssl.num b/util/libssl.num
index 8427cd1273694c14f4e34f88a5914ee18bed3473..ab28742a81a3559bef2aed02ea9430b6dae811bb 100644 (file)
--- a/util/libssl.num
+++ b/util/libssl.num
@@ -568,3 +568,4 @@ SSL_get_stream_id                       ?   3_2_0   EXIST::FUNCTION:
 SSL_set_default_stream_mode             ?      3_2_0   EXIST::FUNCTION:
 SSL_detach_stream                       ?      3_2_0   EXIST::FUNCTION:
 SSL_attach_stream                       ?      3_2_0   EXIST::FUNCTION:
+SSL_set_incoming_stream_reject_policy   ?      3_2_0   EXIST::FUNCTION: