ssl/quic/quic_channel.c

   1 /*
   2  * Copyright 2022-2024 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <openssl/rand.h>
  11 #include <openssl/err.h>
  12 #include "internal/quic_channel.h"
  13 #include "internal/quic_error.h"
  14 #include "internal/quic_rx_depack.h"
  15 #include "internal/quic_lcidm.h"
  16 #include "internal/quic_srtm.h"
  17 #include "internal/qlog_event_helpers.h"
  18 #include "../ssl_local.h"
  19 #include "quic_channel_local.h"
  20 #include "quic_port_local.h"
  21 #include "quic_engine_local.h"
  22
  23 /*
  24  * NOTE: While this channel implementation currently has basic server support,
  25  * this functionality has been implemented for internal testing purposes and is
  26  * not suitable for network use. In particular, it does not implement address
  27  * validation, anti-amplification or retry logic.
  28  *
  29  * TODO(QUIC SERVER): Implement address validation and anti-amplification
  30  * TODO(QUIC SERVER): Implement retry logic
  31  */
  32
  33 #define INIT_CRYPTO_RECV_BUF_LEN    16384
  34 #define INIT_CRYPTO_SEND_BUF_LEN    16384
  35 #define INIT_APP_BUF_LEN             8192
  36
  37 /*
  38  * Interval before we force a PING to ensure NATs don't timeout. This is based
  39  * on the lowest commonly seen value of 30 seconds as cited in RFC 9000 s.
  40  * 10.1.2.
  41  */
  42 #define MAX_NAT_INTERVAL (ossl_ms2time(25000))
  43
  44 /*
  45  * Our maximum ACK delay on the TX side. This is up to us to choose. Note that
  46  * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol
  47  * value which determines the value of the maximum ACK delay if the
  48  * max_ack_delay transport parameter is not set.
  49  */
  50 #define DEFAULT_MAX_ACK_DELAY   QUIC_DEFAULT_MAX_ACK_DELAY
  51
  52 DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
  53
  54 static void ch_save_err_state(QUIC_CHANNEL *ch);
  55 static int ch_rx(QUIC_CHANNEL *ch, int channel_only);
  56 static int ch_tx(QUIC_CHANNEL *ch);
  57 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only);
  58 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only);
  59 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch);
  60 static int ch_retry(QUIC_CHANNEL *ch,
  61                     const unsigned char *retry_token,
  62                     size_t retry_token_len,
  63                     const QUIC_CONN_ID *retry_scid);
  64 static void ch_cleanup(QUIC_CHANNEL *ch);
  65 static int ch_generate_transport_params(QUIC_CHANNEL *ch);
  66 static int ch_on_transport_params(const unsigned char *params,
  67                                   size_t params_len,
  68                                   void *arg);
  69 static int ch_on_handshake_alert(void *arg, unsigned char alert_code);
  70 static int ch_on_handshake_complete(void *arg);
  71 static int ch_on_handshake_yield_secret(uint32_t enc_level, int direction,
  72                                         uint32_t suite_id, EVP_MD *md,
  73                                         const unsigned char *secret,
  74                                         size_t secret_len,
  75                                         void *arg);
  76 static int ch_on_crypto_recv_record(const unsigned char **buf,
  77                                     size_t *bytes_read, void *arg);
  78 static int ch_on_crypto_release_record(size_t bytes_read, void *arg);
  79 static int crypto_ensure_empty(QUIC_RSTREAM *rstream);
  80 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len,
  81                              size_t *consumed, void *arg);
  82 static OSSL_TIME get_time(void *arg);
  83 static uint64_t get_stream_limit(int uni, void *arg);
  84 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg);
  85 static void rxku_detected(QUIC_PN pn, void *arg);
  86 static int ch_retry(QUIC_CHANNEL *ch,
  87                     const unsigned char *retry_token,
  88                     size_t retry_token_len,
  89                     const QUIC_CONN_ID *retry_scid);
  90 static void ch_update_idle(QUIC_CHANNEL *ch);
  91 static int ch_discard_el(QUIC_CHANNEL *ch,
  92                          uint32_t enc_level);
  93 static void ch_on_idle_timeout(QUIC_CHANNEL *ch);
  94 static void ch_update_idle(QUIC_CHANNEL *ch);
  95 static void ch_update_ping_deadline(QUIC_CHANNEL *ch);
  96 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch);
  97 static void ch_start_terminating(QUIC_CHANNEL *ch,
  98                                  const QUIC_TERMINATE_CAUSE *tcause,
  99                                  int force_immediate);
 100 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
 101                              void *arg);
 102 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt);
 103 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch);
 104 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state);
 105
 106 DEFINE_LHASH_OF_EX(QUIC_SRT_ELEM);
 107
 108 QUIC_NEEDS_LOCK
 109 static QLOG *ch_get_qlog(QUIC_CHANNEL *ch)
 110 {
 111 #ifndef OPENSSL_NO_QLOG
 112     QLOG_TRACE_INFO qti = {0};
 113
 114     if (ch->qlog != NULL)
 115         return ch->qlog;
 116
 117     if (!ch->use_qlog)
 118         return NULL;
 119
 120     if (ch->is_server && ch->init_dcid.id_len == 0)
 121         return NULL;
 122
 123     qti.odcid       = ch->init_dcid;
 124     qti.title       = ch->qlog_title;
 125     qti.description = NULL;
 126     qti.group_id    = NULL;
 127     qti.is_server   = ch->is_server;
 128     qti.now_cb      = get_time;
 129     qti.now_cb_arg  = ch;
 130     if ((ch->qlog = ossl_qlog_new_from_env(&qti)) == NULL) {
 131         ch->use_qlog = 0; /* don't try again */
 132         return NULL;
 133     }
 134
 135     return ch->qlog;
 136 #else
 137     return NULL;
 138 #endif
 139 }
 140
 141 QUIC_NEEDS_LOCK
 142 static QLOG *ch_get_qlog_cb(void *arg)
 143 {
 144     QUIC_CHANNEL *ch = arg;
 145
 146     return ch_get_qlog(ch);
 147 }
 148
 149 /*
 150  * QUIC Channel Initialization and Teardown
 151  * ========================================
 152  */
 153 #define DEFAULT_INIT_CONN_RXFC_WND      (768 * 1024)
 154 #define DEFAULT_CONN_RXFC_MAX_WND_MUL   20
 155
 156 #define DEFAULT_INIT_STREAM_RXFC_WND    (512 * 1024)
 157 #define DEFAULT_STREAM_RXFC_MAX_WND_MUL 12
 158
 159 #define DEFAULT_INIT_CONN_MAX_STREAMS           100
 160
 161 static int ch_init(QUIC_CHANNEL *ch)
 162 {
 163     OSSL_QUIC_TX_PACKETISER_ARGS txp_args = {0};
 164     OSSL_QTX_ARGS qtx_args = {0};
 165     OSSL_QRX_ARGS qrx_args = {0};
 166     QUIC_TLS_ARGS tls_args = {0};
 167     uint32_t pn_space;
 168     size_t rx_short_dcid_len;
 169     size_t tx_init_dcid_len;
 170
 171     if (ch->port == NULL || ch->lcidm == NULL || ch->srtm == NULL)
 172         goto err;
 173
 174     rx_short_dcid_len = ossl_quic_port_get_rx_short_dcid_len(ch->port);
 175     tx_init_dcid_len = ossl_quic_port_get_tx_init_dcid_len(ch->port);
 176
 177     /* For clients, generate our initial DCID. */
 178     if (!ch->is_server
 179         && !ossl_quic_gen_rand_conn_id(ch->port->engine->libctx, tx_init_dcid_len,
 180                                        &ch->init_dcid))
 181         goto err;
 182
 183     /* We plug in a network write BIO to the QTX later when we get one. */
 184     qtx_args.libctx             = ch->port->engine->libctx;
 185     qtx_args.get_qlog_cb        = ch_get_qlog_cb;
 186     qtx_args.get_qlog_cb_arg    = ch;
 187     qtx_args.mdpl               = QUIC_MIN_INITIAL_DGRAM_LEN;
 188     ch->rx_max_udp_payload_size = qtx_args.mdpl;
 189
 190     ch->ping_deadline = ossl_time_infinite();
 191
 192     ch->qtx = ossl_qtx_new(&qtx_args);
 193     if (ch->qtx == NULL)
 194         goto err;
 195
 196     ch->txpim = ossl_quic_txpim_new();
 197     if (ch->txpim == NULL)
 198         goto err;
 199
 200     ch->cfq = ossl_quic_cfq_new();
 201     if (ch->cfq == NULL)
 202         goto err;
 203
 204     if (!ossl_quic_txfc_init(&ch->conn_txfc, NULL))
 205         goto err;
 206
 207     /*
 208      * Note: The TP we transmit governs what the peer can transmit and thus
 209      * applies to the RXFC.
 210      */
 211     ch->tx_init_max_stream_data_bidi_local  = DEFAULT_INIT_STREAM_RXFC_WND;
 212     ch->tx_init_max_stream_data_bidi_remote = DEFAULT_INIT_STREAM_RXFC_WND;
 213     ch->tx_init_max_stream_data_uni         = DEFAULT_INIT_STREAM_RXFC_WND;
 214
 215     if (!ossl_quic_rxfc_init(&ch->conn_rxfc, NULL,
 216                              DEFAULT_INIT_CONN_RXFC_WND,
 217                              DEFAULT_CONN_RXFC_MAX_WND_MUL *
 218                              DEFAULT_INIT_CONN_RXFC_WND,
 219                              get_time, ch))
 220         goto err;
 221
 222     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space)
 223         if (!ossl_quic_rxfc_init_standalone(&ch->crypto_rxfc[pn_space],
 224                                             INIT_CRYPTO_RECV_BUF_LEN,
 225                                             get_time, ch))
 226             goto err;
 227
 228     if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_bidi_rxfc,
 229                                         DEFAULT_INIT_CONN_MAX_STREAMS,
 230                                         get_time, ch))
 231         goto err;
 232
 233     if (!ossl_quic_rxfc_init_standalone(&ch->max_streams_uni_rxfc,
 234                                         DEFAULT_INIT_CONN_MAX_STREAMS,
 235                                         get_time, ch))
 236         goto err;
 237
 238     if (!ossl_statm_init(&ch->statm))
 239         goto err;
 240
 241     ch->have_statm = 1;
 242     ch->cc_method = &ossl_cc_newreno_method;
 243     if ((ch->cc_data = ch->cc_method->new(get_time, ch)) == NULL)
 244         goto err;
 245
 246     if ((ch->ackm = ossl_ackm_new(get_time, ch, &ch->statm,
 247                                   ch->cc_method, ch->cc_data)) == NULL)
 248         goto err;
 249
 250     if (!ossl_quic_stream_map_init(&ch->qsm, get_stream_limit, ch,
 251                                    &ch->max_streams_bidi_rxfc,
 252                                    &ch->max_streams_uni_rxfc,
 253                                    ch->is_server))
 254         goto err;
 255
 256     ch->have_qsm = 1;
 257
 258     if (!ch->is_server
 259         && !ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &txp_args.cur_scid))
 260         goto err;
 261
 262     /* We use a zero-length SCID. */
 263     txp_args.cur_dcid               = ch->init_dcid;
 264     txp_args.ack_delay_exponent     = 3;
 265     txp_args.qtx                    = ch->qtx;
 266     txp_args.txpim                  = ch->txpim;
 267     txp_args.cfq                    = ch->cfq;
 268     txp_args.ackm                   = ch->ackm;
 269     txp_args.qsm                    = &ch->qsm;
 270     txp_args.conn_txfc              = &ch->conn_txfc;
 271     txp_args.conn_rxfc              = &ch->conn_rxfc;
 272     txp_args.max_streams_bidi_rxfc  = &ch->max_streams_bidi_rxfc;
 273     txp_args.max_streams_uni_rxfc   = &ch->max_streams_uni_rxfc;
 274     txp_args.cc_method              = ch->cc_method;
 275     txp_args.cc_data                = ch->cc_data;
 276     txp_args.now                    = get_time;
 277     txp_args.now_arg                = ch;
 278     txp_args.get_qlog_cb            = ch_get_qlog_cb;
 279     txp_args.get_qlog_cb_arg        = ch;
 280
 281     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
 282         ch->crypto_send[pn_space] = ossl_quic_sstream_new(INIT_CRYPTO_SEND_BUF_LEN);
 283         if (ch->crypto_send[pn_space] == NULL)
 284             goto err;
 285
 286         txp_args.crypto[pn_space] = ch->crypto_send[pn_space];
 287     }
 288
 289     ch->txp = ossl_quic_tx_packetiser_new(&txp_args);
 290     if (ch->txp == NULL)
 291         goto err;
 292
 293     ossl_quic_tx_packetiser_set_ack_tx_cb(ch->txp, ch_on_txp_ack_tx, ch);
 294
 295     qrx_args.libctx             = ch->port->engine->libctx;
 296     qrx_args.demux              = ch->port->demux;
 297     qrx_args.short_conn_id_len  = rx_short_dcid_len;
 298     qrx_args.max_deferred       = 32;
 299
 300     if ((ch->qrx = ossl_qrx_new(&qrx_args)) == NULL)
 301         goto err;
 302
 303     if (!ossl_qrx_set_late_validation_cb(ch->qrx,
 304                                          rx_late_validate,
 305                                          ch))
 306         goto err;
 307
 308     if (!ossl_qrx_set_key_update_cb(ch->qrx,
 309                                     rxku_detected,
 310                                     ch))
 311         goto err;
 312
 313     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
 314         ch->crypto_recv[pn_space] = ossl_quic_rstream_new(NULL, NULL, 0);
 315         if (ch->crypto_recv[pn_space] == NULL)
 316             goto err;
 317     }
 318
 319     /* Plug in the TLS handshake layer. */
 320     tls_args.s                          = ch->tls;
 321     tls_args.crypto_send_cb             = ch_on_crypto_send;
 322     tls_args.crypto_send_cb_arg         = ch;
 323     tls_args.crypto_recv_rcd_cb         = ch_on_crypto_recv_record;
 324     tls_args.crypto_recv_rcd_cb_arg     = ch;
 325     tls_args.crypto_release_rcd_cb      = ch_on_crypto_release_record;
 326     tls_args.crypto_release_rcd_cb_arg  = ch;
 327     tls_args.yield_secret_cb            = ch_on_handshake_yield_secret;
 328     tls_args.yield_secret_cb_arg        = ch;
 329     tls_args.got_transport_params_cb    = ch_on_transport_params;
 330     tls_args.got_transport_params_cb_arg= ch;
 331     tls_args.handshake_complete_cb      = ch_on_handshake_complete;
 332     tls_args.handshake_complete_cb_arg  = ch;
 333     tls_args.alert_cb                   = ch_on_handshake_alert;
 334     tls_args.alert_cb_arg               = ch;
 335     tls_args.is_server                  = ch->is_server;
 336
 337     if ((ch->qtls = ossl_quic_tls_new(&tls_args)) == NULL)
 338         goto err;
 339
 340     ch->tx_max_ack_delay        = DEFAULT_MAX_ACK_DELAY;
 341     ch->rx_max_ack_delay        = QUIC_DEFAULT_MAX_ACK_DELAY;
 342     ch->rx_ack_delay_exp        = QUIC_DEFAULT_ACK_DELAY_EXP;
 343     ch->rx_active_conn_id_limit = QUIC_MIN_ACTIVE_CONN_ID_LIMIT;
 344     ch->tx_enc_level            = QUIC_ENC_LEVEL_INITIAL;
 345     ch->rx_enc_level            = QUIC_ENC_LEVEL_INITIAL;
 346     ch->txku_threshold_override = UINT64_MAX;
 347
 348     ch->max_idle_timeout_local_req  = QUIC_DEFAULT_IDLE_TIMEOUT;
 349     ch->max_idle_timeout_remote_req = 0;
 350     ch->max_idle_timeout            = ch->max_idle_timeout_local_req;
 351
 352     ossl_ackm_set_tx_max_ack_delay(ch->ackm, ossl_ms2time(ch->tx_max_ack_delay));
 353     ossl_ackm_set_rx_max_ack_delay(ch->ackm, ossl_ms2time(ch->rx_max_ack_delay));
 354
 355     ch_update_idle(ch);
 356     ossl_list_ch_insert_tail(&ch->port->channel_list, ch);
 357     ch->on_port_list = 1;
 358     return 1;
 359
 360 err:
 361     ch_cleanup(ch);
 362     return 0;
 363 }
 364
 365 static void ch_cleanup(QUIC_CHANNEL *ch)
 366 {
 367     uint32_t pn_space;
 368
 369     if (ch->ackm != NULL)
 370         for (pn_space = QUIC_PN_SPACE_INITIAL;
 371              pn_space < QUIC_PN_SPACE_NUM;
 372              ++pn_space)
 373             ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
 374
 375     ossl_quic_lcidm_cull(ch->lcidm, ch);
 376     ossl_quic_srtm_cull(ch->srtm, ch);
 377     ossl_quic_tx_packetiser_free(ch->txp);
 378     ossl_quic_txpim_free(ch->txpim);
 379     ossl_quic_cfq_free(ch->cfq);
 380     ossl_qtx_free(ch->qtx);
 381     if (ch->cc_data != NULL)
 382         ch->cc_method->free(ch->cc_data);
 383     if (ch->have_statm)
 384         ossl_statm_destroy(&ch->statm);
 385     ossl_ackm_free(ch->ackm);
 386
 387     if (ch->have_qsm)
 388         ossl_quic_stream_map_cleanup(&ch->qsm);
 389
 390     for (pn_space = QUIC_PN_SPACE_INITIAL; pn_space < QUIC_PN_SPACE_NUM; ++pn_space) {
 391         ossl_quic_sstream_free(ch->crypto_send[pn_space]);
 392         ossl_quic_rstream_free(ch->crypto_recv[pn_space]);
 393     }
 394
 395     ossl_qrx_pkt_release(ch->qrx_pkt);
 396     ch->qrx_pkt = NULL;
 397
 398     ossl_quic_tls_free(ch->qtls);
 399     ossl_qrx_free(ch->qrx);
 400     OPENSSL_free(ch->local_transport_params);
 401     OPENSSL_free((char *)ch->terminate_cause.reason);
 402     OSSL_ERR_STATE_free(ch->err_state);
 403     OPENSSL_free(ch->ack_range_scratch);
 404
 405     if (ch->on_port_list) {
 406         ossl_list_ch_remove(&ch->port->channel_list, ch);
 407         ch->on_port_list = 0;
 408     }
 409
 410 #ifndef OPENSSL_NO_QLOG
 411     if (ch->qlog != NULL)
 412         ossl_qlog_flush(ch->qlog); /* best effort */
 413
 414     OPENSSL_free(ch->qlog_title);
 415     ossl_qlog_free(ch->qlog);
 416 #endif
 417 }
 418
 419 QUIC_CHANNEL *ossl_quic_channel_new(const QUIC_CHANNEL_ARGS *args)
 420 {
 421     QUIC_CHANNEL *ch = NULL;
 422
 423     if ((ch = OPENSSL_zalloc(sizeof(*ch))) == NULL)
 424         return NULL;
 425
 426     ch->port        = args->port;
 427     ch->is_server   = args->is_server;
 428     ch->tls         = args->tls;
 429     ch->lcidm       = args->lcidm;
 430     ch->srtm        = args->srtm;
 431 #ifndef OPENSSL_NO_QLOG
 432     ch->use_qlog    = args->use_qlog;
 433
 434     if (ch->use_qlog && args->qlog_title != NULL) {
 435         if ((ch->qlog_title = OPENSSL_strdup(args->qlog_title)) == NULL) {
 436             OPENSSL_free(ch);
 437             return NULL;
 438         }
 439     }
 440 #endif
 441
 442     if (!ch_init(ch)) {
 443         OPENSSL_free(ch);
 444         return NULL;
 445     }
 446
 447     return ch;
 448 }
 449
 450 void ossl_quic_channel_free(QUIC_CHANNEL *ch)
 451 {
 452     if (ch == NULL)
 453         return;
 454
 455     ch_cleanup(ch);
 456     OPENSSL_free(ch);
 457 }
 458
 459 /* Set mutator callbacks for test framework support */
 460 int ossl_quic_channel_set_mutator(QUIC_CHANNEL *ch,
 461                                   ossl_mutate_packet_cb mutatecb,
 462                                   ossl_finish_mutate_cb finishmutatecb,
 463                                   void *mutatearg)
 464 {
 465     if (ch->qtx == NULL)
 466         return 0;
 467
 468     ossl_qtx_set_mutator(ch->qtx, mutatecb, finishmutatecb, mutatearg);
 469     return 1;
 470 }
 471
 472 int ossl_quic_channel_get_peer_addr(QUIC_CHANNEL *ch, BIO_ADDR *peer_addr)
 473 {
 474     if (!ch->addressed_mode)
 475         return 0;
 476
 477     *peer_addr = ch->cur_peer_addr;
 478     return 1;
 479 }
 480
 481 int ossl_quic_channel_set_peer_addr(QUIC_CHANNEL *ch, const BIO_ADDR *peer_addr)
 482 {
 483     if (ch->state != QUIC_CHANNEL_STATE_IDLE)
 484         return 0;
 485
 486     if (peer_addr == NULL || BIO_ADDR_family(peer_addr) == AF_UNSPEC) {
 487         BIO_ADDR_clear(&ch->cur_peer_addr);
 488         ch->addressed_mode = 0;
 489         return 1;
 490     }
 491
 492     ch->cur_peer_addr   = *peer_addr;
 493     ch->addressed_mode  = 1;
 494     return 1;
 495 }
 496
 497 QUIC_REACTOR *ossl_quic_channel_get_reactor(QUIC_CHANNEL *ch)
 498 {
 499     return ossl_quic_port_get0_reactor(ch->port);
 500 }
 501
 502 QUIC_STREAM_MAP *ossl_quic_channel_get_qsm(QUIC_CHANNEL *ch)
 503 {
 504     return &ch->qsm;
 505 }
 506
 507 OSSL_STATM *ossl_quic_channel_get_statm(QUIC_CHANNEL *ch)
 508 {
 509     return &ch->statm;
 510 }
 511
 512 QUIC_STREAM *ossl_quic_channel_get_stream_by_id(QUIC_CHANNEL *ch,
 513                                                 uint64_t stream_id)
 514 {
 515     return ossl_quic_stream_map_get_by_id(&ch->qsm, stream_id);
 516 }
 517
 518 int ossl_quic_channel_is_active(const QUIC_CHANNEL *ch)
 519 {
 520     return ch != NULL && ch->state == QUIC_CHANNEL_STATE_ACTIVE;
 521 }
 522
 523 int ossl_quic_channel_is_closing(const QUIC_CHANNEL *ch)
 524 {
 525     return ch->state == QUIC_CHANNEL_STATE_TERMINATING_CLOSING;
 526 }
 527
 528 static int ossl_quic_channel_is_draining(const QUIC_CHANNEL *ch)
 529 {
 530     return ch->state == QUIC_CHANNEL_STATE_TERMINATING_DRAINING;
 531 }
 532
 533 static int ossl_quic_channel_is_terminating(const QUIC_CHANNEL *ch)
 534 {
 535     return ossl_quic_channel_is_closing(ch)
 536         || ossl_quic_channel_is_draining(ch);
 537 }
 538
 539 int ossl_quic_channel_is_terminated(const QUIC_CHANNEL *ch)
 540 {
 541     return ch->state == QUIC_CHANNEL_STATE_TERMINATED;
 542 }
 543
 544 int ossl_quic_channel_is_term_any(const QUIC_CHANNEL *ch)
 545 {
 546     return ossl_quic_channel_is_terminating(ch)
 547         || ossl_quic_channel_is_terminated(ch);
 548 }
 549
 550 const QUIC_TERMINATE_CAUSE *
 551 ossl_quic_channel_get_terminate_cause(const QUIC_CHANNEL *ch)
 552 {
 553     return ossl_quic_channel_is_term_any(ch) ? &ch->terminate_cause : NULL;
 554 }
 555
 556 int ossl_quic_channel_is_handshake_complete(const QUIC_CHANNEL *ch)
 557 {
 558     return ch->handshake_complete;
 559 }
 560
 561 int ossl_quic_channel_is_handshake_confirmed(const QUIC_CHANNEL *ch)
 562 {
 563     return ch->handshake_confirmed;
 564 }
 565
 566 QUIC_DEMUX *ossl_quic_channel_get0_demux(QUIC_CHANNEL *ch)
 567 {
 568     return ch->port->demux;
 569 }
 570
 571 QUIC_PORT *ossl_quic_channel_get0_port(QUIC_CHANNEL *ch)
 572 {
 573     return ch->port;
 574 }
 575
 576 QUIC_ENGINE *ossl_quic_channel_get0_engine(QUIC_CHANNEL *ch)
 577 {
 578     return ossl_quic_port_get0_engine(ch->port);
 579 }
 580
 581 CRYPTO_MUTEX *ossl_quic_channel_get_mutex(QUIC_CHANNEL *ch)
 582 {
 583     return ossl_quic_port_get0_mutex(ch->port);
 584 }
 585
 586 int ossl_quic_channel_has_pending(const QUIC_CHANNEL *ch)
 587 {
 588     return ossl_quic_demux_has_pending(ch->port->demux)
 589         || ossl_qrx_processed_read_pending(ch->qrx);
 590 }
 591
 592 /*
 593  * QUIC Channel: Callbacks from Miscellaneous Subsidiary Components
 594  * ================================================================
 595  */
 596
 597 /* Used by various components. */
 598 static OSSL_TIME get_time(void *arg)
 599 {
 600     QUIC_CHANNEL *ch = arg;
 601
 602     return ossl_quic_port_get_time(ch->port);
 603 }
 604
 605 /* Used by QSM. */
 606 static uint64_t get_stream_limit(int uni, void *arg)
 607 {
 608     QUIC_CHANNEL *ch = arg;
 609
 610     return uni ? ch->max_local_streams_uni : ch->max_local_streams_bidi;
 611 }
 612
 613 /*
 614  * Called by QRX to determine if a packet is potentially invalid before trying
 615  * to decrypt it.
 616  */
 617 static int rx_late_validate(QUIC_PN pn, int pn_space, void *arg)
 618 {
 619     QUIC_CHANNEL *ch = arg;
 620
 621     /* Potential duplicates should not be processed. */
 622     if (!ossl_ackm_is_rx_pn_processable(ch->ackm, pn, pn_space))
 623         return 0;
 624
 625     return 1;
 626 }
 627
 628 /*
 629  * Triggers a TXKU (whether spontaneous or solicited). Does not check whether
 630  * spontaneous TXKU is currently allowed.
 631  */
 632 QUIC_NEEDS_LOCK
 633 static void ch_trigger_txku(QUIC_CHANNEL *ch)
 634 {
 635     uint64_t next_pn
 636         = ossl_quic_tx_packetiser_get_next_pn(ch->txp, QUIC_PN_SPACE_APP);
 637
 638     if (!ossl_quic_pn_valid(next_pn)
 639         || !ossl_qtx_trigger_key_update(ch->qtx)) {
 640         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
 641                                                "key update");
 642         return;
 643     }
 644
 645     ch->txku_in_progress    = 1;
 646     ch->txku_pn             = next_pn;
 647     ch->rxku_expected       = ch->ku_locally_initiated;
 648 }
 649
 650 QUIC_NEEDS_LOCK
 651 static int txku_in_progress(QUIC_CHANNEL *ch)
 652 {
 653     if (ch->txku_in_progress
 654         && ossl_ackm_get_largest_acked(ch->ackm, QUIC_PN_SPACE_APP) >= ch->txku_pn) {
 655         OSSL_TIME pto = ossl_ackm_get_pto_duration(ch->ackm);
 656
 657         /*
 658          * RFC 9001 s. 6.5: Endpoints SHOULD wait three times the PTO before
 659          * initiating a key update after receiving an acknowledgment that
 660          * confirms that the previous key update was received.
 661          *
 662          * Note that by the above wording, this period starts from when we get
 663          * the ack for a TXKU-triggering packet, not when the TXKU is initiated.
 664          * So we defer TXKU cooldown deadline calculation to this point.
 665          */
 666         ch->txku_in_progress        = 0;
 667         ch->txku_cooldown_deadline  = ossl_time_add(get_time(ch),
 668                                                     ossl_time_multiply(pto, 3));
 669     }
 670
 671     return ch->txku_in_progress;
 672 }
 673
 674 QUIC_NEEDS_LOCK
 675 static int txku_allowed(QUIC_CHANNEL *ch)
 676 {
 677     return ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT /* Sanity check. */
 678         /* Strict RFC 9001 criterion for TXKU. */
 679         && ch->handshake_confirmed
 680         && !txku_in_progress(ch);
 681 }
 682
 683 QUIC_NEEDS_LOCK
 684 static int txku_recommendable(QUIC_CHANNEL *ch)
 685 {
 686     if (!txku_allowed(ch))
 687         return 0;
 688
 689     return
 690         /* Recommended RFC 9001 criterion for TXKU. */
 691         ossl_time_compare(get_time(ch), ch->txku_cooldown_deadline) >= 0
 692         /* Some additional sensible criteria. */
 693         && !ch->rxku_in_progress
 694         && !ch->rxku_pending_confirm;
 695 }
 696
 697 QUIC_NEEDS_LOCK
 698 static int txku_desirable(QUIC_CHANNEL *ch)
 699 {
 700     uint64_t cur_pkt_count, max_pkt_count, thresh_pkt_count;
 701     const uint32_t enc_level = QUIC_ENC_LEVEL_1RTT;
 702
 703     /* Check AEAD limit to determine if we should perform a spontaneous TXKU. */
 704     cur_pkt_count = ossl_qtx_get_cur_epoch_pkt_count(ch->qtx, enc_level);
 705     max_pkt_count = ossl_qtx_get_max_epoch_pkt_count(ch->qtx, enc_level);
 706
 707     thresh_pkt_count = max_pkt_count / 2;
 708     if (ch->txku_threshold_override != UINT64_MAX)
 709         thresh_pkt_count = ch->txku_threshold_override;
 710
 711     return cur_pkt_count >= thresh_pkt_count;
 712 }
 713
 714 QUIC_NEEDS_LOCK
 715 static void ch_maybe_trigger_spontaneous_txku(QUIC_CHANNEL *ch)
 716 {
 717     if (!txku_recommendable(ch) || !txku_desirable(ch))
 718         return;
 719
 720     ch->ku_locally_initiated = 1;
 721     ch_trigger_txku(ch);
 722 }
 723
 724 QUIC_NEEDS_LOCK
 725 static int rxku_allowed(QUIC_CHANNEL *ch)
 726 {
 727     /*
 728      * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a key update prior to
 729      * having confirmed the handshake (Section 4.1.2).
 730      *
 731      * RFC 9001 s. 6.1: An endpoint MUST NOT initiate a subsequent key update
 732      * unless it has received an acknowledgment for a packet that was sent
 733      * protected with keys from the current key phase.
 734      *
 735      * RFC 9001 s. 6.2: If an endpoint detects a second update before it has
 736      * sent any packets with updated keys containing an acknowledgment for the
 737      * packet that initiated the key update, it indicates that its peer has
 738      * updated keys twice without awaiting confirmation. An endpoint MAY treat
 739      * such consecutive key updates as a connection error of type
 740      * KEY_UPDATE_ERROR.
 741      */
 742     return ch->handshake_confirmed && !ch->rxku_pending_confirm;
 743 }
 744
 745 /*
 746  * Called when the QRX detects a new RX key update event.
 747  */
 748 enum rxku_decision {
 749     DECISION_RXKU_ONLY,
 750     DECISION_PROTOCOL_VIOLATION,
 751     DECISION_SOLICITED_TXKU
 752 };
 753
 754 /* Called when the QRX detects a key update has occurred. */
 755 QUIC_NEEDS_LOCK
 756 static void rxku_detected(QUIC_PN pn, void *arg)
 757 {
 758     QUIC_CHANNEL *ch = arg;
 759     enum rxku_decision decision;
 760     OSSL_TIME pto;
 761
 762     /*
 763      * Note: rxku_in_progress is always 0 here as an RXKU cannot be detected
 764      * when we are still in UPDATING or COOLDOWN (see quic_record_rx.h).
 765      */
 766     assert(!ch->rxku_in_progress);
 767
 768     if (!rxku_allowed(ch))
 769         /* Is RXKU even allowed at this time? */
 770         decision = DECISION_PROTOCOL_VIOLATION;
 771
 772     else if (ch->ku_locally_initiated)
 773         /*
 774          * If this key update was locally initiated (meaning that this detected
 775          * RXKU event is a result of our own spontaneous TXKU), we do not
 776          * trigger another TXKU; after all, to do so would result in an infinite
 777          * ping-pong of key updates. We still process it as an RXKU.
 778          */
 779         decision = DECISION_RXKU_ONLY;
 780
 781     else
 782         /*
 783          * Otherwise, a peer triggering a KU means we have to trigger a KU also.
 784          */
 785         decision = DECISION_SOLICITED_TXKU;
 786
 787     if (decision == DECISION_PROTOCOL_VIOLATION) {
 788         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR,
 789                                                0, "RX key update again too soon");
 790         return;
 791     }
 792
 793     pto = ossl_ackm_get_pto_duration(ch->ackm);
 794
 795     ch->ku_locally_initiated        = 0;
 796     ch->rxku_in_progress            = 1;
 797     ch->rxku_pending_confirm        = 1;
 798     ch->rxku_trigger_pn             = pn;
 799     ch->rxku_update_end_deadline    = ossl_time_add(get_time(ch), pto);
 800     ch->rxku_expected               = 0;
 801
 802     if (decision == DECISION_SOLICITED_TXKU)
 803         /* NOT gated by usual txku_allowed() */
 804         ch_trigger_txku(ch);
 805
 806     /*
 807      * Ordinarily, we only generate ACK when some ACK-eliciting frame has been
 808      * received. In some cases, this may not occur for a long time, for example
 809      * if transmission of application data is going in only one direction and
 810      * nothing else is happening with the connection. However, since the peer
 811      * cannot initiate a subsequent (spontaneous) TXKU until its prior
 812      * (spontaneous or solicited) TXKU has completed - meaning that prior
 813      * TXKU's trigger packet (or subsequent packet) has been acknowledged, this
 814      * can lead to very long times before a TXKU is considered 'completed'.
 815      * Optimise this by forcing ACK generation after triggering TXKU.
 816      * (Basically, we consider a RXKU event something that is 'ACK-eliciting',
 817      * which it more or less should be; it is necessarily separate from ordinary
 818      * processing of ACK-eliciting frames as key update is not indicated via a
 819      * frame.)
 820      */
 821     ossl_quic_tx_packetiser_schedule_ack(ch->txp, QUIC_PN_SPACE_APP);
 822 }
 823
 824 /* Called per tick to handle RXKU timer events. */
 825 QUIC_NEEDS_LOCK
 826 static void ch_rxku_tick(QUIC_CHANNEL *ch)
 827 {
 828     if (!ch->rxku_in_progress
 829         || ossl_time_compare(get_time(ch), ch->rxku_update_end_deadline) < 0)
 830         return;
 831
 832     ch->rxku_update_end_deadline    = ossl_time_infinite();
 833     ch->rxku_in_progress            = 0;
 834
 835     if (!ossl_qrx_key_update_timeout(ch->qrx, /*normal=*/1))
 836         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
 837                                                "RXKU cooldown internal error");
 838 }
 839
 840 QUIC_NEEDS_LOCK
 841 static void ch_on_txp_ack_tx(const OSSL_QUIC_FRAME_ACK *ack, uint32_t pn_space,
 842                              void *arg)
 843 {
 844     QUIC_CHANNEL *ch = arg;
 845
 846     if (pn_space != QUIC_PN_SPACE_APP || !ch->rxku_pending_confirm
 847         || !ossl_quic_frame_ack_contains_pn(ack, ch->rxku_trigger_pn))
 848         return;
 849
 850     /*
 851      * Defer clearing rxku_pending_confirm until TXP generate call returns
 852      * successfully.
 853      */
 854     ch->rxku_pending_confirm_done = 1;
 855 }
 856
 857 /*
 858  * QUIC Channel: Handshake Layer Event Handling
 859  * ============================================
 860  */
 861 static int ch_on_crypto_send(const unsigned char *buf, size_t buf_len,
 862                              size_t *consumed, void *arg)
 863 {
 864     int ret;
 865     QUIC_CHANNEL *ch = arg;
 866     uint32_t enc_level = ch->tx_enc_level;
 867     uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
 868     QUIC_SSTREAM *sstream = ch->crypto_send[pn_space];
 869
 870     if (!ossl_assert(sstream != NULL))
 871         return 0;
 872
 873     ret = ossl_quic_sstream_append(sstream, buf, buf_len, consumed);
 874     return ret;
 875 }
 876
 877 static int crypto_ensure_empty(QUIC_RSTREAM *rstream)
 878 {
 879     size_t avail = 0;
 880     int is_fin = 0;
 881
 882     if (rstream == NULL)
 883         return 1;
 884
 885     if (!ossl_quic_rstream_available(rstream, &avail, &is_fin))
 886         return 0;
 887
 888     return avail == 0;
 889 }
 890
 891 static int ch_on_crypto_recv_record(const unsigned char **buf,
 892                                     size_t *bytes_read, void *arg)
 893 {
 894     QUIC_CHANNEL *ch = arg;
 895     QUIC_RSTREAM *rstream;
 896     int is_fin = 0; /* crypto stream is never finished, so we don't use this */
 897     uint32_t i;
 898
 899     /*
 900      * After we move to a later EL we must not allow our peer to send any new
 901      * bytes in the crypto stream on a previous EL. Retransmissions of old bytes
 902      * are allowed.
 903      *
 904      * In practice we will only move to a new EL when we have consumed all bytes
 905      * which should be sent on the crypto stream at a previous EL. For example,
 906      * the Handshake EL should not be provisioned until we have completely
 907      * consumed a TLS 1.3 ServerHello. Thus when we provision an EL the output
 908      * of ossl_quic_rstream_available() should be 0 for all lower ELs. Thus if a
 909      * given EL is available we simply ensure we have not received any further
 910      * bytes at a lower EL.
 911      */
 912     for (i = QUIC_ENC_LEVEL_INITIAL; i < ch->rx_enc_level; ++i)
 913         if (i != QUIC_ENC_LEVEL_0RTT &&
 914             !crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) {
 915             /* Protocol violation (RFC 9001 s. 4.1.3) */
 916             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
 917                                                    OSSL_QUIC_FRAME_TYPE_CRYPTO,
 918                                                    "crypto stream data in wrong EL");
 919             return 0;
 920         }
 921
 922     rstream = ch->crypto_recv[ossl_quic_enc_level_to_pn_space(ch->rx_enc_level)];
 923     if (rstream == NULL)
 924         return 0;
 925
 926     return ossl_quic_rstream_get_record(rstream, buf, bytes_read,
 927                                         &is_fin);
 928 }
 929
 930 static int ch_on_crypto_release_record(size_t bytes_read, void *arg)
 931 {
 932     QUIC_CHANNEL *ch = arg;
 933     QUIC_RSTREAM *rstream;
 934     OSSL_RTT_INFO rtt_info;
 935     uint32_t rx_pn_space = ossl_quic_enc_level_to_pn_space(ch->rx_enc_level);
 936
 937     rstream = ch->crypto_recv[rx_pn_space];
 938     if (rstream == NULL)
 939         return 0;
 940
 941     ossl_statm_get_rtt_info(ossl_quic_channel_get_statm(ch), &rtt_info);
 942     if (!ossl_quic_rxfc_on_retire(&ch->crypto_rxfc[rx_pn_space], bytes_read,
 943                                   rtt_info.smoothed_rtt))
 944         return 0;
 945
 946     return ossl_quic_rstream_release_record(rstream, bytes_read);
 947 }
 948
 949 static int ch_on_handshake_yield_secret(uint32_t enc_level, int direction,
 950                                         uint32_t suite_id, EVP_MD *md,
 951                                         const unsigned char *secret,
 952                                         size_t secret_len,
 953                                         void *arg)
 954 {
 955     QUIC_CHANNEL *ch = arg;
 956     uint32_t i;
 957
 958     if (enc_level < QUIC_ENC_LEVEL_HANDSHAKE || enc_level >= QUIC_ENC_LEVEL_NUM)
 959         /* Invalid EL. */
 960         return 0;
 961
 962
 963     if (direction) {
 964         /* TX */
 965         if (enc_level <= ch->tx_enc_level)
 966             /*
 967              * Does not make sense for us to try and provision an EL we have already
 968              * attained.
 969              */
 970             return 0;
 971
 972         if (!ossl_qtx_provide_secret(ch->qtx, enc_level,
 973                                      suite_id, md,
 974                                      secret, secret_len))
 975             return 0;
 976
 977         ch->tx_enc_level = enc_level;
 978     } else {
 979         /* RX */
 980         if (enc_level <= ch->rx_enc_level)
 981             /*
 982              * Does not make sense for us to try and provision an EL we have already
 983              * attained.
 984              */
 985             return 0;
 986
 987         /*
 988          * Ensure all crypto streams for previous ELs are now empty of available
 989          * data.
 990          */
 991         for (i = QUIC_ENC_LEVEL_INITIAL; i < enc_level; ++i)
 992             if (!crypto_ensure_empty(ch->crypto_recv[ossl_quic_enc_level_to_pn_space(i)])) {
 993                 /* Protocol violation (RFC 9001 s. 4.1.3) */
 994                 ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
 995                                                     OSSL_QUIC_FRAME_TYPE_CRYPTO,
 996                                                     "crypto stream data in wrong EL");
 997                 return 0;
 998             }
 999
1000         if (!ossl_qrx_provide_secret(ch->qrx, enc_level,
1001                                      suite_id, md,
1002                                      secret, secret_len))
1003             return 0;
1004
1005         ch->have_new_rx_secret = 1;
1006         ch->rx_enc_level = enc_level;
1007     }
1008
1009     return 1;
1010 }
1011
1012 static int ch_on_handshake_complete(void *arg)
1013 {
1014     QUIC_CHANNEL *ch = arg;
1015
1016     if (!ossl_assert(!ch->handshake_complete))
1017         return 0; /* this should not happen twice */
1018
1019     if (!ossl_assert(ch->tx_enc_level == QUIC_ENC_LEVEL_1RTT))
1020         return 0;
1021
1022     if (!ch->got_remote_transport_params) {
1023         /*
1024          * Was not a valid QUIC handshake if we did not get valid transport
1025          * params.
1026          */
1027         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_CRYPTO_MISSING_EXT,
1028                                                OSSL_QUIC_FRAME_TYPE_CRYPTO,
1029                                                "no transport parameters received");
1030         return 0;
1031     }
1032
1033     /* Don't need transport parameters anymore. */
1034     OPENSSL_free(ch->local_transport_params);
1035     ch->local_transport_params = NULL;
1036
1037     /* Tell the QRX it can now process 1-RTT packets. */
1038     ossl_qrx_allow_1rtt_processing(ch->qrx);
1039
1040     /* Tell TXP the handshake is complete. */
1041     ossl_quic_tx_packetiser_notify_handshake_complete(ch->txp);
1042
1043     ch->handshake_complete = 1;
1044
1045     if (ch->is_server) {
1046         /*
1047          * On the server, the handshake is confirmed as soon as it is complete.
1048          */
1049         ossl_quic_channel_on_handshake_confirmed(ch);
1050
1051         ossl_quic_tx_packetiser_schedule_handshake_done(ch->txp);
1052     }
1053
1054     ch_record_state_transition(ch, ch->state);
1055     return 1;
1056 }
1057
1058 static int ch_on_handshake_alert(void *arg, unsigned char alert_code)
1059 {
1060     QUIC_CHANNEL *ch = arg;
1061
1062     /*
1063      * RFC 9001 s. 4.4: More specifically, servers MUST NOT send post-handshake
1064      * TLS CertificateRequest messages, and clients MUST treat receipt of such
1065      * messages as a connection error of type PROTOCOL_VIOLATION.
1066      */
1067     if (alert_code == SSL_AD_UNEXPECTED_MESSAGE
1068             && ch->handshake_complete
1069             && ossl_quic_tls_is_cert_request(ch->qtls))
1070         ossl_quic_channel_raise_protocol_error(ch,
1071                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1072                                                0,
1073                                                "Post-handshake TLS "
1074                                                "CertificateRequest received");
1075     /*
1076      * RFC 9001 s. 4.6.1: Servers MUST NOT send the early_data extension with a
1077      * max_early_data_size field set to any value other than 0xffffffff. A
1078      * client MUST treat receipt of a NewSessionTicket that contains an
1079      * early_data extension with any other value as a connection error of type
1080      * PROTOCOL_VIOLATION.
1081      */
1082     else if (alert_code == SSL_AD_ILLEGAL_PARAMETER
1083              && ch->handshake_complete
1084              && ossl_quic_tls_has_bad_max_early_data(ch->qtls))
1085         ossl_quic_channel_raise_protocol_error(ch,
1086                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
1087                                                0,
1088                                                "Bad max_early_data received");
1089     else
1090         ossl_quic_channel_raise_protocol_error(ch,
1091                                                OSSL_QUIC_ERR_CRYPTO_ERR_BEGIN
1092                                                + alert_code,
1093                                                0, "handshake alert");
1094
1095     return 1;
1096 }
1097
1098 /*
1099  * QUIC Channel: Transport Parameter Handling
1100  * ==========================================
1101  */
1102
1103 /*
1104  * Called by handshake layer when we receive QUIC Transport Parameters from the
1105  * peer. Note that these are not authenticated until the handshake is marked
1106  * as complete.
1107  */
1108 #define TP_REASON_SERVER_ONLY(x) \
1109     x " may not be sent by a client"
1110 #define TP_REASON_DUP(x) \
1111     x " appears multiple times"
1112 #define TP_REASON_MALFORMED(x) \
1113     x " is malformed"
1114 #define TP_REASON_EXPECTED_VALUE(x) \
1115     x " does not match expected value"
1116 #define TP_REASON_NOT_RETRY(x) \
1117     x " sent when not performing a retry"
1118 #define TP_REASON_REQUIRED(x) \
1119     x " was not sent but is required"
1120 #define TP_REASON_INTERNAL_ERROR(x) \
1121     x " encountered internal error"
1122
1123 static void txfc_bump_cwm_bidi(QUIC_STREAM *s, void *arg)
1124 {
1125     if (!ossl_quic_stream_is_bidi(s)
1126         || ossl_quic_stream_is_server_init(s))
1127         return;
1128
1129     ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg);
1130 }
1131
1132 static void txfc_bump_cwm_uni(QUIC_STREAM *s, void *arg)
1133 {
1134     if (ossl_quic_stream_is_bidi(s)
1135         || ossl_quic_stream_is_server_init(s))
1136         return;
1137
1138     ossl_quic_txfc_bump_cwm(&s->txfc, *(uint64_t *)arg);
1139 }
1140
1141 static void do_update(QUIC_STREAM *s, void *arg)
1142 {
1143     QUIC_CHANNEL *ch = arg;
1144
1145     ossl_quic_stream_map_update_state(&ch->qsm, s);
1146 }
1147
1148 static uint64_t min_u64_ignore_0(uint64_t a, uint64_t b)
1149 {
1150     if (a == 0)
1151         return b;
1152     if (b == 0)
1153         return a;
1154
1155     return a < b ? a : b;
1156 }
1157
1158 static int ch_on_transport_params(const unsigned char *params,
1159                                   size_t params_len,
1160                                   void *arg)
1161 {
1162     QUIC_CHANNEL *ch = arg;
1163     PACKET pkt;
1164     uint64_t id, v;
1165     size_t len;
1166     const unsigned char *body;
1167     int got_orig_dcid = 0;
1168     int got_initial_scid = 0;
1169     int got_retry_scid = 0;
1170     int got_initial_max_data = 0;
1171     int got_initial_max_stream_data_bidi_local = 0;
1172     int got_initial_max_stream_data_bidi_remote = 0;
1173     int got_initial_max_stream_data_uni = 0;
1174     int got_initial_max_streams_bidi = 0;
1175     int got_initial_max_streams_uni = 0;
1176     int got_stateless_reset_token = 0;
1177     int got_preferred_addr = 0;
1178     int got_ack_delay_exp = 0;
1179     int got_max_ack_delay = 0;
1180     int got_max_udp_payload_size = 0;
1181     int got_max_idle_timeout = 0;
1182     int got_active_conn_id_limit = 0;
1183     int got_disable_active_migration = 0;
1184     QUIC_CONN_ID cid;
1185     const char *reason = "bad transport parameter";
1186     ossl_unused uint64_t rx_max_idle_timeout = 0;
1187     ossl_unused const void *stateless_reset_token_p = NULL;
1188     QUIC_PREFERRED_ADDR pfa;
1189
1190     if (ch->got_remote_transport_params) {
1191         reason = "multiple transport parameter extensions";
1192         goto malformed;
1193     }
1194
1195     if (!PACKET_buf_init(&pkt, params, params_len)) {
1196         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
1197                                                "internal error (packet buf init)");
1198         return 0;
1199     }
1200
1201     while (PACKET_remaining(&pkt) > 0) {
1202         if (!ossl_quic_wire_peek_transport_param(&pkt, &id))
1203             goto malformed;
1204
1205         switch (id) {
1206         case QUIC_TPARAM_ORIG_DCID:
1207             if (got_orig_dcid) {
1208                 reason = TP_REASON_DUP("ORIG_DCID");
1209                 goto malformed;
1210             }
1211
1212             if (ch->is_server) {
1213                 reason = TP_REASON_SERVER_ONLY("ORIG_DCID");
1214                 goto malformed;
1215             }
1216
1217             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1218                 reason = TP_REASON_MALFORMED("ORIG_DCID");
1219                 goto malformed;
1220             }
1221
1222 #ifndef FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
1223             /* Must match our initial DCID. */
1224             if (!ossl_quic_conn_id_eq(&ch->init_dcid, &cid)) {
1225                 reason = TP_REASON_EXPECTED_VALUE("ORIG_DCID");
1226                 goto malformed;
1227             }
1228 #endif
1229
1230             got_orig_dcid = 1;
1231             break;
1232
1233         case QUIC_TPARAM_RETRY_SCID:
1234             if (ch->is_server) {
1235                 reason = TP_REASON_SERVER_ONLY("RETRY_SCID");
1236                 goto malformed;
1237             }
1238
1239             if (got_retry_scid) {
1240                 reason = TP_REASON_DUP("RETRY_SCID");
1241                 goto malformed;
1242             }
1243
1244             if (!ch->doing_retry) {
1245                 reason = TP_REASON_NOT_RETRY("RETRY_SCID");
1246                 goto malformed;
1247             }
1248
1249             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1250                 reason = TP_REASON_MALFORMED("RETRY_SCID");
1251                 goto malformed;
1252             }
1253
1254             /* Must match Retry packet SCID. */
1255             if (!ossl_quic_conn_id_eq(&ch->retry_scid, &cid)) {
1256                 reason = TP_REASON_EXPECTED_VALUE("RETRY_SCID");
1257                 goto malformed;
1258             }
1259
1260             got_retry_scid = 1;
1261             break;
1262
1263         case QUIC_TPARAM_INITIAL_SCID:
1264             if (got_initial_scid) {
1265                 /* must not appear more than once */
1266                 reason = TP_REASON_DUP("INITIAL_SCID");
1267                 goto malformed;
1268             }
1269
1270             if (!ossl_quic_wire_decode_transport_param_cid(&pkt, NULL, &cid)) {
1271                 reason = TP_REASON_MALFORMED("INITIAL_SCID");
1272                 goto malformed;
1273             }
1274
1275             /* Must match SCID of first Initial packet from server. */
1276             if (!ossl_quic_conn_id_eq(&ch->init_scid, &cid)) {
1277                 reason = TP_REASON_EXPECTED_VALUE("INITIAL_SCID");
1278                 goto malformed;
1279             }
1280
1281             got_initial_scid = 1;
1282             break;
1283
1284         case QUIC_TPARAM_INITIAL_MAX_DATA:
1285             if (got_initial_max_data) {
1286                 /* must not appear more than once */
1287                 reason = TP_REASON_DUP("INITIAL_MAX_DATA");
1288                 goto malformed;
1289             }
1290
1291             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1292                 reason = TP_REASON_MALFORMED("INITIAL_MAX_DATA");
1293                 goto malformed;
1294             }
1295
1296             ossl_quic_txfc_bump_cwm(&ch->conn_txfc, v);
1297             got_initial_max_data = 1;
1298             break;
1299
1300         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL:
1301             if (got_initial_max_stream_data_bidi_local) {
1302                 /* must not appear more than once */
1303                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1304                 goto malformed;
1305             }
1306
1307             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1308                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_LOCAL");
1309                 goto malformed;
1310             }
1311
1312             /*
1313              * This is correct; the BIDI_LOCAL TP governs streams created by
1314              * the endpoint which sends the TP, i.e., our peer.
1315              */
1316             ch->rx_init_max_stream_data_bidi_remote = v;
1317             got_initial_max_stream_data_bidi_local = 1;
1318             break;
1319
1320         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE:
1321             if (got_initial_max_stream_data_bidi_remote) {
1322                 /* must not appear more than once */
1323                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1324                 goto malformed;
1325             }
1326
1327             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1328                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_BIDI_REMOTE");
1329                 goto malformed;
1330             }
1331
1332             /*
1333              * This is correct; the BIDI_REMOTE TP governs streams created
1334              * by the endpoint which receives the TP, i.e., us.
1335              */
1336             ch->rx_init_max_stream_data_bidi_local = v;
1337
1338             /* Apply to all existing streams. */
1339             ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_bidi, &v);
1340             got_initial_max_stream_data_bidi_remote = 1;
1341             break;
1342
1343         case QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI:
1344             if (got_initial_max_stream_data_uni) {
1345                 /* must not appear more than once */
1346                 reason = TP_REASON_DUP("INITIAL_MAX_STREAM_DATA_UNI");
1347                 goto malformed;
1348             }
1349
1350             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1351                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAM_DATA_UNI");
1352                 goto malformed;
1353             }
1354
1355             ch->rx_init_max_stream_data_uni = v;
1356
1357             /* Apply to all existing streams. */
1358             ossl_quic_stream_map_visit(&ch->qsm, txfc_bump_cwm_uni, &v);
1359             got_initial_max_stream_data_uni = 1;
1360             break;
1361
1362         case QUIC_TPARAM_ACK_DELAY_EXP:
1363             if (got_ack_delay_exp) {
1364                 /* must not appear more than once */
1365                 reason = TP_REASON_DUP("ACK_DELAY_EXP");
1366                 goto malformed;
1367             }
1368
1369             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1370                 || v > QUIC_MAX_ACK_DELAY_EXP) {
1371                 reason = TP_REASON_MALFORMED("ACK_DELAY_EXP");
1372                 goto malformed;
1373             }
1374
1375             ch->rx_ack_delay_exp = (unsigned char)v;
1376             got_ack_delay_exp = 1;
1377             break;
1378
1379         case QUIC_TPARAM_MAX_ACK_DELAY:
1380             if (got_max_ack_delay) {
1381                 /* must not appear more than once */
1382                 reason = TP_REASON_DUP("MAX_ACK_DELAY");
1383                 goto malformed;
1384             }
1385
1386             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1387                 || v >= (((uint64_t)1) << 14)) {
1388                 reason = TP_REASON_MALFORMED("MAX_ACK_DELAY");
1389                 goto malformed;
1390             }
1391
1392             ch->rx_max_ack_delay = v;
1393             ossl_ackm_set_rx_max_ack_delay(ch->ackm,
1394                                            ossl_ms2time(ch->rx_max_ack_delay));
1395
1396             got_max_ack_delay = 1;
1397             break;
1398
1399         case QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI:
1400             if (got_initial_max_streams_bidi) {
1401                 /* must not appear more than once */
1402                 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_BIDI");
1403                 goto malformed;
1404             }
1405
1406             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1407                 || v > (((uint64_t)1) << 60)) {
1408                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_BIDI");
1409                 goto malformed;
1410             }
1411
1412             assert(ch->max_local_streams_bidi == 0);
1413             ch->max_local_streams_bidi = v;
1414             got_initial_max_streams_bidi = 1;
1415             break;
1416
1417         case QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI:
1418             if (got_initial_max_streams_uni) {
1419                 /* must not appear more than once */
1420                 reason = TP_REASON_DUP("INITIAL_MAX_STREAMS_UNI");
1421                 goto malformed;
1422             }
1423
1424             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1425                 || v > (((uint64_t)1) << 60)) {
1426                 reason = TP_REASON_MALFORMED("INITIAL_MAX_STREAMS_UNI");
1427                 goto malformed;
1428             }
1429
1430             assert(ch->max_local_streams_uni == 0);
1431             ch->max_local_streams_uni = v;
1432             got_initial_max_streams_uni = 1;
1433             break;
1434
1435         case QUIC_TPARAM_MAX_IDLE_TIMEOUT:
1436             if (got_max_idle_timeout) {
1437                 /* must not appear more than once */
1438                 reason = TP_REASON_DUP("MAX_IDLE_TIMEOUT");
1439                 goto malformed;
1440             }
1441
1442             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)) {
1443                 reason = TP_REASON_MALFORMED("MAX_IDLE_TIMEOUT");
1444                 goto malformed;
1445             }
1446
1447             ch->max_idle_timeout_remote_req = v;
1448
1449             ch->max_idle_timeout = min_u64_ignore_0(ch->max_idle_timeout_local_req,
1450                                                     ch->max_idle_timeout_remote_req);
1451
1452
1453             ch_update_idle(ch);
1454             got_max_idle_timeout = 1;
1455             rx_max_idle_timeout = v;
1456             break;
1457
1458         case QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE:
1459             if (got_max_udp_payload_size) {
1460                 /* must not appear more than once */
1461                 reason = TP_REASON_DUP("MAX_UDP_PAYLOAD_SIZE");
1462                 goto malformed;
1463             }
1464
1465             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1466                 || v < QUIC_MIN_INITIAL_DGRAM_LEN) {
1467                 reason = TP_REASON_MALFORMED("MAX_UDP_PAYLOAD_SIZE");
1468                 goto malformed;
1469             }
1470
1471             ch->rx_max_udp_payload_size = v;
1472             got_max_udp_payload_size    = 1;
1473             break;
1474
1475         case QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT:
1476             if (got_active_conn_id_limit) {
1477                 /* must not appear more than once */
1478                 reason = TP_REASON_DUP("ACTIVE_CONN_ID_LIMIT");
1479                 goto malformed;
1480             }
1481
1482             if (!ossl_quic_wire_decode_transport_param_int(&pkt, &id, &v)
1483                 || v < QUIC_MIN_ACTIVE_CONN_ID_LIMIT) {
1484                 reason = TP_REASON_MALFORMED("ACTIVE_CONN_ID_LIMIT");
1485                 goto malformed;
1486             }
1487
1488             ch->rx_active_conn_id_limit = v;
1489             got_active_conn_id_limit = 1;
1490             break;
1491
1492         case QUIC_TPARAM_STATELESS_RESET_TOKEN:
1493             if (got_stateless_reset_token) {
1494                 reason = TP_REASON_DUP("STATELESS_RESET_TOKEN");
1495                 goto malformed;
1496             }
1497
1498             /*
1499              * We must ensure a client doesn't send them because we don't have
1500              * processing for them.
1501              *
1502              * TODO(QUIC SERVER): remove this restriction
1503              */
1504             if (ch->is_server) {
1505                 reason = TP_REASON_SERVER_ONLY("STATELESS_RESET_TOKEN");
1506                 goto malformed;
1507             }
1508
1509             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len);
1510             if (body == NULL || len != QUIC_STATELESS_RESET_TOKEN_LEN) {
1511                 reason = TP_REASON_MALFORMED("STATELESS_RESET_TOKEN");
1512                 goto malformed;
1513             }
1514             if (!ossl_quic_srtm_add(ch->srtm, ch, ch->cur_remote_seq_num,
1515                                     (const QUIC_STATELESS_RESET_TOKEN *)body)) {
1516                 reason = TP_REASON_INTERNAL_ERROR("STATELESS_RESET_TOKEN");
1517                 goto malformed;
1518             }
1519
1520             stateless_reset_token_p     = body;
1521             got_stateless_reset_token   = 1;
1522             break;
1523
1524         case QUIC_TPARAM_PREFERRED_ADDR:
1525             /* TODO(QUIC FUTURE): Handle preferred address. */
1526             if (got_preferred_addr) {
1527                 reason = TP_REASON_DUP("PREFERRED_ADDR");
1528                 goto malformed;
1529             }
1530
1531             /*
1532              * RFC 9000 s. 18.2: "A server that chooses a zero-length
1533              * connection ID MUST NOT provide a preferred address.
1534              * Similarly, a server MUST NOT include a zero-length connection
1535              * ID in this transport parameter. A client MUST treat a
1536              * violation of these requirements as a connection error of type
1537              * TRANSPORT_PARAMETER_ERROR."
1538              */
1539             if (ch->is_server) {
1540                 reason = TP_REASON_SERVER_ONLY("PREFERRED_ADDR");
1541                 goto malformed;
1542             }
1543
1544             if (ch->cur_remote_dcid.id_len == 0) {
1545                 reason = "PREFERRED_ADDR provided for zero-length CID";
1546                 goto malformed;
1547             }
1548
1549             if (!ossl_quic_wire_decode_transport_param_preferred_addr(&pkt, &pfa)) {
1550                 reason = TP_REASON_MALFORMED("PREFERRED_ADDR");
1551                 goto malformed;
1552             }
1553
1554             if (pfa.cid.id_len == 0) {
1555                 reason = "zero-length CID in PREFERRED_ADDR";
1556                 goto malformed;
1557             }
1558
1559             got_preferred_addr = 1;
1560             break;
1561
1562         case QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION:
1563             /* We do not currently handle migration, so nothing to do. */
1564             if (got_disable_active_migration) {
1565                 /* must not appear more than once */
1566                 reason = TP_REASON_DUP("DISABLE_ACTIVE_MIGRATION");
1567                 goto malformed;
1568             }
1569
1570             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id, &len);
1571             if (body == NULL || len > 0) {
1572                 reason = TP_REASON_MALFORMED("DISABLE_ACTIVE_MIGRATION");
1573                 goto malformed;
1574             }
1575
1576             got_disable_active_migration = 1;
1577             break;
1578
1579         default:
1580             /*
1581              * Skip over and ignore.
1582              *
1583              * RFC 9000 s. 7.4: We SHOULD treat duplicated transport parameters
1584              * as a connection error, but we are not required to. Currently,
1585              * handle this programmatically by checking for duplicates in the
1586              * parameters that we recognise, as above, but don't bother
1587              * maintaining a list of duplicates for anything we don't recognise.
1588              */
1589             body = ossl_quic_wire_decode_transport_param_bytes(&pkt, &id,
1590                                                                &len);
1591             if (body == NULL)
1592                 goto malformed;
1593
1594             break;
1595         }
1596     }
1597
1598     if (!got_initial_scid) {
1599         reason = TP_REASON_REQUIRED("INITIAL_SCID");
1600         goto malformed;
1601     }
1602
1603     if (!ch->is_server) {
1604         if (!got_orig_dcid) {
1605             reason = TP_REASON_REQUIRED("ORIG_DCID");
1606             goto malformed;
1607         }
1608
1609         if (ch->doing_retry && !got_retry_scid) {
1610             reason = TP_REASON_REQUIRED("RETRY_SCID");
1611             goto malformed;
1612         }
1613     }
1614
1615     ch->got_remote_transport_params = 1;
1616
1617 #ifndef OPENSSL_NO_QLOG
1618     QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
1619         QLOG_STR("owner", "remote");
1620
1621         if (got_orig_dcid)
1622             QLOG_CID("original_destination_connection_id",
1623                      &ch->init_dcid);
1624         if (got_initial_scid)
1625             QLOG_CID("original_source_connection_id",
1626                      &ch->init_dcid);
1627         if (got_retry_scid)
1628             QLOG_CID("retry_source_connection_id",
1629                      &ch->retry_scid);
1630         if (got_initial_max_data)
1631             QLOG_U64("initial_max_data",
1632                      ossl_quic_txfc_get_cwm(&ch->conn_txfc));
1633         if (got_initial_max_stream_data_bidi_local)
1634             QLOG_U64("initial_max_stream_data_bidi_local",
1635                      ch->rx_init_max_stream_data_bidi_local);
1636         if (got_initial_max_stream_data_bidi_remote)
1637             QLOG_U64("initial_max_stream_data_bidi_remote",
1638                      ch->rx_init_max_stream_data_bidi_remote);
1639         if (got_initial_max_stream_data_uni)
1640             QLOG_U64("initial_max_stream_data_uni",
1641                      ch->rx_init_max_stream_data_uni);
1642         if (got_initial_max_streams_bidi)
1643             QLOG_U64("initial_max_streams_bidi",
1644                      ch->max_local_streams_bidi);
1645         if (got_initial_max_streams_uni)
1646             QLOG_U64("initial_max_streams_uni",
1647                      ch->max_local_streams_uni);
1648         if (got_ack_delay_exp)
1649             QLOG_U64("ack_delay_exponent", ch->rx_ack_delay_exp);
1650         if (got_max_ack_delay)
1651             QLOG_U64("max_ack_delay", ch->rx_max_ack_delay);
1652         if (got_max_udp_payload_size)
1653             QLOG_U64("max_udp_payload_size", ch->rx_max_udp_payload_size);
1654         if (got_max_idle_timeout)
1655             QLOG_U64("max_idle_timeout", rx_max_idle_timeout);
1656         if (got_active_conn_id_limit)
1657             QLOG_U64("active_connection_id_limit", ch->rx_active_conn_id_limit);
1658         if (got_stateless_reset_token)
1659             QLOG_BIN("stateless_reset_token", stateless_reset_token_p,
1660                      QUIC_STATELESS_RESET_TOKEN_LEN);
1661         if (got_preferred_addr) {
1662             QLOG_BEGIN("preferred_addr")
1663                 QLOG_U64("port_v4", pfa.ipv4_port);
1664                 QLOG_U64("port_v6", pfa.ipv6_port);
1665                 QLOG_BIN("ip_v4", pfa.ipv4, sizeof(pfa.ipv4));
1666                 QLOG_BIN("ip_v6", pfa.ipv6, sizeof(pfa.ipv6));
1667                 QLOG_BIN("stateless_reset_token", pfa.stateless_reset.token,
1668                          sizeof(pfa.stateless_reset.token));
1669                 QLOG_CID("connection_id", &pfa.cid);
1670             QLOG_END()
1671         }
1672         QLOG_BOOL("disable_active_migration", got_disable_active_migration);
1673     QLOG_EVENT_END()
1674 #endif
1675
1676     if (got_initial_max_data || got_initial_max_stream_data_bidi_remote
1677         || got_initial_max_streams_bidi || got_initial_max_streams_uni)
1678         /*
1679          * If FC credit was bumped, we may now be able to send. Update all
1680          * streams.
1681          */
1682         ossl_quic_stream_map_visit(&ch->qsm, do_update, ch);
1683
1684     /* If we are a server, we now generate our own transport parameters. */
1685     if (ch->is_server && !ch_generate_transport_params(ch)) {
1686         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR, 0,
1687                                                "internal error");
1688         return 0;
1689     }
1690
1691     return 1;
1692
1693 malformed:
1694     ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_TRANSPORT_PARAMETER_ERROR,
1695                                            0, reason);
1696     return 0;
1697 }
1698
1699 /*
1700  * Called when we want to generate transport parameters. This is called
1701  * immediately at instantiation time for a client and after we receive the
1702  * client's transport parameters for a server.
1703  */
1704 static int ch_generate_transport_params(QUIC_CHANNEL *ch)
1705 {
1706     int ok = 0;
1707     BUF_MEM *buf_mem = NULL;
1708     WPACKET wpkt;
1709     int wpkt_valid = 0;
1710     size_t buf_len = 0;
1711
1712     if (ch->local_transport_params != NULL || ch->got_local_transport_params)
1713         goto err;
1714
1715     if ((buf_mem = BUF_MEM_new()) == NULL)
1716         goto err;
1717
1718     if (!WPACKET_init(&wpkt, buf_mem))
1719         goto err;
1720
1721     wpkt_valid = 1;
1722
1723     if (ossl_quic_wire_encode_transport_param_bytes(&wpkt, QUIC_TPARAM_DISABLE_ACTIVE_MIGRATION,
1724                                                     NULL, 0) == NULL)
1725         goto err;
1726
1727     if (ch->is_server) {
1728         if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_ORIG_DCID,
1729                                                        &ch->init_dcid))
1730             goto err;
1731
1732         if (!ossl_quic_wire_encode_transport_param_cid(&wpkt, QUIC_TPARAM_INITIAL_SCID,
1733                                                        &ch->cur_local_cid))
1734             goto err;
1735     } else {
1736         /* Client always uses an empty SCID. */
1737         if (ossl_quic_wire_encode_transport_param_bytes(&wpkt, QUIC_TPARAM_INITIAL_SCID,
1738                                                         NULL, 0) == NULL)
1739             goto err;
1740     }
1741
1742     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_IDLE_TIMEOUT,
1743                                                    ch->max_idle_timeout_local_req))
1744         goto err;
1745
1746     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_UDP_PAYLOAD_SIZE,
1747                                                    QUIC_MIN_INITIAL_DGRAM_LEN))
1748         goto err;
1749
1750     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_ACTIVE_CONN_ID_LIMIT,
1751                                                    QUIC_MIN_ACTIVE_CONN_ID_LIMIT))
1752         goto err;
1753
1754     if (ch->tx_max_ack_delay != QUIC_DEFAULT_MAX_ACK_DELAY
1755         && !ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_MAX_ACK_DELAY,
1756                                                       ch->tx_max_ack_delay))
1757         goto err;
1758
1759     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_DATA,
1760                                                    ossl_quic_rxfc_get_cwm(&ch->conn_rxfc)))
1761         goto err;
1762
1763     /* Send the default CWM for a new RXFC. */
1764     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_LOCAL,
1765                                                    ch->tx_init_max_stream_data_bidi_local))
1766         goto err;
1767
1768     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_BIDI_REMOTE,
1769                                                    ch->tx_init_max_stream_data_bidi_remote))
1770         goto err;
1771
1772     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAM_DATA_UNI,
1773                                                    ch->tx_init_max_stream_data_uni))
1774         goto err;
1775
1776     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_BIDI,
1777                                                    ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc)))
1778         goto err;
1779
1780     if (!ossl_quic_wire_encode_transport_param_int(&wpkt, QUIC_TPARAM_INITIAL_MAX_STREAMS_UNI,
1781                                                    ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc)))
1782         goto err;
1783
1784     if (!WPACKET_finish(&wpkt))
1785         goto err;
1786
1787     wpkt_valid = 0;
1788
1789     if (!WPACKET_get_total_written(&wpkt, &buf_len))
1790         goto err;
1791
1792     ch->local_transport_params = (unsigned char *)buf_mem->data;
1793     buf_mem->data = NULL;
1794
1795
1796     if (!ossl_quic_tls_set_transport_params(ch->qtls, ch->local_transport_params,
1797                                             buf_len))
1798         goto err;
1799
1800 #ifndef OPENSSL_NO_QLOG
1801     QLOG_EVENT_BEGIN(ch_get_qlog(ch), transport, parameters_set)
1802         QLOG_STR("owner", "local");
1803         QLOG_BOOL("disable_active_migration", 1);
1804         if (ch->is_server) {
1805             QLOG_CID("original_destination_connection_id", &ch->init_dcid);
1806             QLOG_CID("initial_source_connection_id", &ch->cur_local_cid);
1807         } else {
1808             QLOG_STR("initial_source_connection_id", "");
1809         }
1810         QLOG_U64("max_idle_timeout", ch->max_idle_timeout);
1811         QLOG_U64("max_udp_payload_size", QUIC_MIN_INITIAL_DGRAM_LEN);
1812         QLOG_U64("active_connection_id_limit", QUIC_MIN_ACTIVE_CONN_ID_LIMIT);
1813         QLOG_U64("max_ack_delay", ch->tx_max_ack_delay);
1814         QLOG_U64("initial_max_data", ossl_quic_rxfc_get_cwm(&ch->conn_rxfc));
1815         QLOG_U64("initial_max_stream_data_bidi_local",
1816                  ch->tx_init_max_stream_data_bidi_local);
1817         QLOG_U64("initial_max_stream_data_bidi_remote",
1818                  ch->tx_init_max_stream_data_bidi_remote);
1819         QLOG_U64("initial_max_stream_data_uni",
1820                  ch->tx_init_max_stream_data_uni);
1821         QLOG_U64("initial_max_streams_bidi",
1822                  ossl_quic_rxfc_get_cwm(&ch->max_streams_bidi_rxfc));
1823         QLOG_U64("initial_max_streams_uni",
1824                  ossl_quic_rxfc_get_cwm(&ch->max_streams_uni_rxfc));
1825     QLOG_EVENT_END()
1826 #endif
1827
1828     ch->got_local_transport_params = 1;
1829
1830     ok = 1;
1831 err:
1832     if (wpkt_valid)
1833         WPACKET_cleanup(&wpkt);
1834     BUF_MEM_free(buf_mem);
1835     return ok;
1836 }
1837
1838 /*
1839  * QUIC Channel: Ticker-Mutator
1840  * ============================
1841  */
1842
1843 /*
1844  * The central ticker function called by the reactor. This does everything, or
1845  * at least everything network I/O related. Best effort - not allowed to fail
1846  * "loudly".
1847  */
1848 void ossl_quic_channel_subtick(QUIC_CHANNEL *ch, QUIC_TICK_RESULT *res,
1849                                uint32_t flags)
1850 {
1851     OSSL_TIME now, deadline;
1852     int channel_only = (flags & QUIC_REACTOR_TICK_FLAG_CHANNEL_ONLY) != 0;
1853
1854     /*
1855      * When we tick the QUIC connection, we do everything we need to do
1856      * periodically. Network I/O handling will already have been performed
1857      * as necessary by the QUIC port. Thus, in order, we:
1858      *
1859      *   - handle any packets the DEMUX has queued up for us;
1860      *   - handle any timer events which are due to fire (ACKM, etc.);
1861      *   - generate any packets which need to be sent;
1862      *   - determine the time at which we should next be ticked.
1863      */
1864
1865     /* If we are in the TERMINATED state, there is nothing to do. */
1866     if (ossl_quic_channel_is_terminated(ch)) {
1867         res->net_read_desired   = 0;
1868         res->net_write_desired  = 0;
1869         res->tick_deadline      = ossl_time_infinite();
1870         return;
1871     }
1872
1873     /*
1874      * If we are in the TERMINATING state, check if the terminating timer has
1875      * expired.
1876      */
1877     if (ossl_quic_channel_is_terminating(ch)) {
1878         now = get_time(ch);
1879
1880         if (ossl_time_compare(now, ch->terminate_deadline) >= 0) {
1881             ch_on_terminating_timeout(ch);
1882             res->net_read_desired   = 0;
1883             res->net_write_desired  = 0;
1884             res->tick_deadline      = ossl_time_infinite();
1885             return; /* abort normal processing, nothing to do */
1886         }
1887     }
1888
1889     if (!ch->port->engine->inhibit_tick) {
1890         /* Handle RXKU timeouts. */
1891         ch_rxku_tick(ch);
1892
1893         do {
1894             /* Process queued incoming packets. */
1895             ch->did_tls_tick        = 0;
1896             ch->have_new_rx_secret  = 0;
1897             ch_rx(ch, channel_only);
1898
1899             /*
1900              * Allow the handshake layer to check for any new incoming data and
1901              * generate new outgoing data.
1902              */
1903             if (!ch->did_tls_tick)
1904                 ch_tick_tls(ch, channel_only);
1905
1906             /*
1907              * If the handshake layer gave us a new secret, we need to do RX
1908              * again because packets that were not previously processable and
1909              * were deferred might now be processable.
1910              *
1911              * TODO(QUIC FUTURE): Consider handling this in the yield_secret callback.
1912              */
1913         } while (ch->have_new_rx_secret);
1914     }
1915
1916     /*
1917      * Handle any timer events which are due to fire; namely, the loss
1918      * detection deadline and the idle timeout.
1919      *
1920      * ACKM ACK generation deadline is polled by TXP, so we don't need to
1921      * handle it here.
1922      */
1923     now = get_time(ch);
1924     if (ossl_time_compare(now, ch->idle_deadline) >= 0) {
1925         /*
1926          * Idle timeout differs from normal protocol violation because we do
1927          * not send a CONN_CLOSE frame; go straight to TERMINATED.
1928          */
1929         if (!ch->port->engine->inhibit_tick)
1930             ch_on_idle_timeout(ch);
1931
1932         res->net_read_desired   = 0;
1933         res->net_write_desired  = 0;
1934         res->tick_deadline      = ossl_time_infinite();
1935         return;
1936     }
1937
1938     if (!ch->port->engine->inhibit_tick) {
1939         deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
1940         if (!ossl_time_is_zero(deadline)
1941             && ossl_time_compare(now, deadline) >= 0)
1942             ossl_ackm_on_timeout(ch->ackm);
1943
1944         /* If a ping is due, inform TXP. */
1945         if (ossl_time_compare(now, ch->ping_deadline) >= 0) {
1946             int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
1947
1948             ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
1949
1950             /*
1951              * If we have no CC budget at this time we cannot process the above
1952              * PING request immediately. In any case we have scheduled the
1953              * request so bump the ping deadline. If we don't do this we will
1954              * busy-loop endlessly as the above deadline comparison condition
1955              * will still be met.
1956              */
1957             ch_update_ping_deadline(ch);
1958         }
1959
1960         /* Queue any data to be sent for transmission. */
1961         ch_tx(ch);
1962
1963         /* Do stream GC. */
1964         ossl_quic_stream_map_gc(&ch->qsm);
1965     }
1966
1967     /* Determine the time at which we should next be ticked. */
1968     res->tick_deadline = ch_determine_next_tick_deadline(ch);
1969
1970     /*
1971      * Always process network input unless we are now terminated. Although we
1972      * had not terminated at the beginning of this tick, network errors in
1973      * ch_tx() may have caused us to transition to the Terminated state.
1974      */
1975     res->net_read_desired = !ossl_quic_channel_is_terminated(ch);
1976
1977     /* We want to write to the network if we have any data in our TX queue. */
1978     res->net_write_desired
1979         = (!ossl_quic_channel_is_terminated(ch)
1980            && ossl_qtx_get_queue_len_datagrams(ch->qtx) > 0);
1981 }
1982
1983 static int ch_tick_tls(QUIC_CHANNEL *ch, int channel_only)
1984 {
1985     uint64_t error_code;
1986     const char *error_msg;
1987     ERR_STATE *error_state = NULL;
1988
1989     if (channel_only)
1990         return 1;
1991
1992     ch->did_tls_tick = 1;
1993     ossl_quic_tls_tick(ch->qtls);
1994
1995     if (ossl_quic_tls_get_error(ch->qtls, &error_code, &error_msg,
1996                                 &error_state)) {
1997         ossl_quic_channel_raise_protocol_error_state(ch, error_code, 0,
1998                                                      error_msg, error_state);
1999         return 0;
2000     }
2001
2002     return 1;
2003 }
2004
2005 /* Check incoming forged packet limit and terminate connection if needed. */
2006 static void ch_rx_check_forged_pkt_limit(QUIC_CHANNEL *ch)
2007 {
2008     uint32_t enc_level;
2009     uint64_t limit = UINT64_MAX, l;
2010
2011     for (enc_level = QUIC_ENC_LEVEL_INITIAL;
2012          enc_level < QUIC_ENC_LEVEL_NUM;
2013          ++enc_level)
2014     {
2015         /*
2016          * Different ELs can have different AEADs which can in turn impose
2017          * different limits, so use the lowest value of any currently valid EL.
2018          */
2019         if ((ch->el_discarded & (1U << enc_level)) != 0)
2020             continue;
2021
2022         if (enc_level > ch->rx_enc_level)
2023             break;
2024
2025         l = ossl_qrx_get_max_forged_pkt_count(ch->qrx, enc_level);
2026         if (l < limit)
2027             limit = l;
2028     }
2029
2030     if (ossl_qrx_get_cur_forged_pkt_count(ch->qrx) < limit)
2031         return;
2032
2033     ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_AEAD_LIMIT_REACHED, 0,
2034                                            "forgery limit");
2035 }
2036
2037 /* Process queued incoming packets and handle frames, if any. */
2038 static int ch_rx(QUIC_CHANNEL *ch, int channel_only)
2039 {
2040     int handled_any = 0;
2041     const int closing = ossl_quic_channel_is_closing(ch);
2042
2043     if (!ch->is_server && !ch->have_sent_any_pkt)
2044         /*
2045          * We have not sent anything yet, therefore there is no need to check
2046          * for incoming data.
2047          */
2048         return 1;
2049
2050     for (;;) {
2051         assert(ch->qrx_pkt == NULL);
2052
2053         if (!ossl_qrx_read_pkt(ch->qrx, &ch->qrx_pkt))
2054             break;
2055
2056         /* Track the amount of data received while in the closing state */
2057         if (closing)
2058             ossl_quic_tx_packetiser_record_received_closing_bytes(
2059                     ch->txp, ch->qrx_pkt->hdr->len);
2060
2061         if (!handled_any) {
2062             ch_update_idle(ch);
2063             ch_update_ping_deadline(ch);
2064         }
2065
2066         ch_rx_handle_packet(ch, channel_only); /* best effort */
2067
2068         /*
2069          * Regardless of the outcome of frame handling, unref the packet.
2070          * This will free the packet unless something added another
2071          * reference to it during frame processing.
2072          */
2073         ossl_qrx_pkt_release(ch->qrx_pkt);
2074         ch->qrx_pkt = NULL;
2075
2076         ch->have_sent_ack_eliciting_since_rx = 0;
2077         handled_any = 1;
2078     }
2079
2080     ch_rx_check_forged_pkt_limit(ch);
2081
2082     /*
2083      * When in TERMINATING - CLOSING, generate a CONN_CLOSE frame whenever we
2084      * process one or more incoming packets.
2085      */
2086     if (handled_any && closing)
2087         ch->conn_close_queued = 1;
2088
2089     return 1;
2090 }
2091
2092 static int bio_addr_eq(const BIO_ADDR *a, const BIO_ADDR *b)
2093 {
2094     if (BIO_ADDR_family(a) != BIO_ADDR_family(b))
2095         return 0;
2096
2097     switch (BIO_ADDR_family(a)) {
2098         case AF_INET:
2099             return !memcmp(&a->s_in.sin_addr,
2100                            &b->s_in.sin_addr,
2101                            sizeof(a->s_in.sin_addr))
2102                 && a->s_in.sin_port == b->s_in.sin_port;
2103 #if OPENSSL_USE_IPV6
2104         case AF_INET6:
2105             return !memcmp(&a->s_in6.sin6_addr,
2106                            &b->s_in6.sin6_addr,
2107                            sizeof(a->s_in6.sin6_addr))
2108                 && a->s_in6.sin6_port == b->s_in6.sin6_port;
2109 #endif
2110         default:
2111             return 0; /* not supported */
2112     }
2113
2114     return 1;
2115 }
2116
2117 /* Handles the packet currently in ch->qrx_pkt->hdr. */
2118 static void ch_rx_handle_packet(QUIC_CHANNEL *ch, int channel_only)
2119 {
2120     uint32_t enc_level;
2121     int old_have_processed_any_pkt = ch->have_processed_any_pkt;
2122     OSSL_QTX_IOVEC iovec;
2123
2124     assert(ch->qrx_pkt != NULL);
2125
2126     /*
2127      * RFC 9000 s. 10.2.1 Closing Connection State:
2128      *      An endpoint that is closing is not required to process any
2129      *      received frame.
2130      */
2131     if (!ossl_quic_channel_is_active(ch))
2132         return;
2133
2134     if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)) {
2135         if (!ch->have_received_enc_pkt) {
2136             ch->cur_remote_dcid = ch->init_scid = ch->qrx_pkt->hdr->src_conn_id;
2137             ch->have_received_enc_pkt = 1;
2138
2139             /*
2140              * We change to using the SCID in the first Initial packet as the
2141              * DCID.
2142              */
2143             ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->init_scid);
2144         }
2145
2146         enc_level = ossl_quic_pkt_type_to_enc_level(ch->qrx_pkt->hdr->type);
2147         if ((ch->el_discarded & (1U << enc_level)) != 0)
2148             /* Do not process packets from ELs we have already discarded. */
2149             return;
2150     }
2151
2152     /*
2153      * RFC 9000 s. 9.6: "If a client receives packets from a new server address
2154      * when the client has not initiated a migration to that address, the client
2155      * SHOULD discard these packets."
2156      *
2157      * We need to be a bit careful here as due to the BIO abstraction layer an
2158      * application is liable to be weird and lie to us about peer addresses.
2159      * Only apply this check if we actually are using a real AF_INET or AF_INET6
2160      * address.
2161      */
2162     if (!ch->is_server
2163         && ch->qrx_pkt->peer != NULL
2164         && (
2165                BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET
2166 #if OPENSSL_USE_IPV6
2167             || BIO_ADDR_family(&ch->cur_peer_addr) == AF_INET6
2168 #endif
2169         )
2170         && !bio_addr_eq(ch->qrx_pkt->peer, &ch->cur_peer_addr))
2171         return;
2172
2173     if (!ch->is_server
2174         && ch->have_received_enc_pkt
2175         && ossl_quic_pkt_type_has_scid(ch->qrx_pkt->hdr->type)) {
2176         /*
2177          * RFC 9000 s. 7.2: "Once a client has received a valid Initial packet
2178          * from the server, it MUST discard any subsequent packet it receives on
2179          * that connection with a different SCID."
2180          */
2181         if (!ossl_quic_conn_id_eq(&ch->qrx_pkt->hdr->src_conn_id,
2182                                   &ch->init_scid))
2183             return;
2184     }
2185
2186     if (ossl_quic_pkt_type_has_version(ch->qrx_pkt->hdr->type)
2187         && ch->qrx_pkt->hdr->version != QUIC_VERSION_1)
2188         /*
2189          * RFC 9000 s. 5.2.1: If a client receives a packet that uses a
2190          * different version than it initially selected, it MUST discard the
2191          * packet. We only ever use v1, so require it.
2192          */
2193         return;
2194
2195     ch->have_processed_any_pkt = 1;
2196
2197     /*
2198      * RFC 9000 s. 17.2: "An endpoint MUST treat receipt of a packet that has a
2199      * non-zero value for [the reserved bits] after removing both packet and
2200      * header protection as a connection error of type PROTOCOL_VIOLATION."
2201      */
2202     if (ossl_quic_pkt_type_is_encrypted(ch->qrx_pkt->hdr->type)
2203         && ch->qrx_pkt->hdr->reserved != 0) {
2204         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2205                                                0, "packet header reserved bits");
2206         return;
2207     }
2208
2209     iovec.buf       = ch->qrx_pkt->hdr->data;
2210     iovec.buf_len   = ch->qrx_pkt->hdr->len;
2211     ossl_qlog_event_transport_packet_received(ch_get_qlog(ch), ch->qrx_pkt->hdr,
2212                                               ch->qrx_pkt->pn, &iovec, 1,
2213                                               ch->qrx_pkt->datagram_id);
2214
2215     /* Handle incoming packet. */
2216     switch (ch->qrx_pkt->hdr->type) {
2217     case QUIC_PKT_TYPE_RETRY:
2218         if (ch->doing_retry || ch->is_server)
2219             /*
2220              * It is not allowed to ask a client to do a retry more than
2221              * once. Clients may not send retries.
2222              */
2223             return;
2224
2225         /*
2226          * RFC 9000 s 17.2.5.2: After the client has received and processed an
2227          * Initial or Retry packet from the server, it MUST discard any
2228          * subsequent Retry packets that it receives.
2229          */
2230         if (ch->have_received_enc_pkt)
2231             return;
2232
2233         if (ch->qrx_pkt->hdr->len <= QUIC_RETRY_INTEGRITY_TAG_LEN)
2234             /* Packets with zero-length Retry Tokens are invalid. */
2235             return;
2236
2237         /*
2238          * TODO(QUIC FUTURE): Theoretically this should probably be in the QRX.
2239          * However because validation is dependent on context (namely the
2240          * client's initial DCID) we can't do this cleanly. In the future we
2241          * should probably add a callback to the QRX to let it call us (via
2242          * the DEMUX) and ask us about the correct original DCID, rather
2243          * than allow the QRX to emit a potentially malformed packet to the
2244          * upper layers. However, special casing this will do for now.
2245          */
2246         if (!ossl_quic_validate_retry_integrity_tag(ch->port->engine->libctx,
2247                                                     ch->port->engine->propq,
2248                                                     ch->qrx_pkt->hdr,
2249                                                     &ch->init_dcid))
2250             /* Malformed retry packet, ignore. */
2251             return;
2252
2253         if (!ch_retry(ch, ch->qrx_pkt->hdr->data,
2254                       ch->qrx_pkt->hdr->len - QUIC_RETRY_INTEGRITY_TAG_LEN,
2255                       &ch->qrx_pkt->hdr->src_conn_id))
2256             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR,
2257                                                    0, "handling retry packet");
2258         break;
2259
2260     case QUIC_PKT_TYPE_0RTT:
2261         if (!ch->is_server)
2262             /* Clients should never receive 0-RTT packets. */
2263             return;
2264
2265         /*
2266          * TODO(QUIC 0RTT): Implement 0-RTT on the server side. We currently
2267          * do not need to implement this as a client can only do 0-RTT if we
2268          * have given it permission to in a previous session.
2269          */
2270         break;
2271
2272     case QUIC_PKT_TYPE_INITIAL:
2273     case QUIC_PKT_TYPE_HANDSHAKE:
2274     case QUIC_PKT_TYPE_1RTT:
2275         if (ch->is_server && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_HANDSHAKE)
2276             /*
2277              * We automatically drop INITIAL EL keys when first successfully
2278              * decrypting a HANDSHAKE packet, as per the RFC.
2279              */
2280             ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
2281
2282         if (ch->rxku_in_progress
2283             && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_1RTT
2284             && ch->qrx_pkt->pn >= ch->rxku_trigger_pn
2285             && ch->qrx_pkt->key_epoch < ossl_qrx_get_key_epoch(ch->qrx)) {
2286             /*
2287              * RFC 9001 s. 6.4: Packets with higher packet numbers MUST be
2288              * protected with either the same or newer packet protection keys
2289              * than packets with lower packet numbers. An endpoint that
2290              * successfully removes protection with old keys when newer keys
2291              * were used for packets with lower packet numbers MUST treat this
2292              * as a connection error of type KEY_UPDATE_ERROR.
2293              */
2294             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_KEY_UPDATE_ERROR,
2295                                                    0, "new packet with old keys");
2296             break;
2297         }
2298
2299         if (!ch->is_server
2300             && ch->qrx_pkt->hdr->type == QUIC_PKT_TYPE_INITIAL
2301             && ch->qrx_pkt->hdr->token_len > 0) {
2302             /*
2303              * RFC 9000 s. 17.2.2: Clients that receive an Initial packet with a
2304              * non-zero Token Length field MUST either discard the packet or
2305              * generate a connection error of type PROTOCOL_VIOLATION.
2306              *
2307              * TODO(QUIC FUTURE): consider the implications of RFC 9000 s. 10.2.3
2308              * Immediate Close during the Handshake:
2309              *      However, at the cost of reducing feedback about
2310              *      errors for legitimate peers, some forms of denial of
2311              *      service can be made more difficult for an attacker
2312              *      if endpoints discard illegal packets rather than
2313              *      terminating a connection with CONNECTION_CLOSE. For
2314              *      this reason, endpoints MAY discard packets rather
2315              *      than immediately close if errors are detected in
2316              *      packets that lack authentication.
2317              * I.e. should we drop this packet instead of closing the connection?
2318              */
2319             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2320                                                    0, "client received initial token");
2321             break;
2322         }
2323
2324         /* This packet contains frames, pass to the RXDP. */
2325         ossl_quic_handle_frames(ch, ch->qrx_pkt); /* best effort */
2326
2327         if (ch->did_crypto_frame)
2328             ch_tick_tls(ch, channel_only);
2329
2330         break;
2331
2332     case QUIC_PKT_TYPE_VERSION_NEG:
2333         /*
2334          * "A client MUST discard any Version Negotiation packet if it has
2335          * received and successfully processed any other packet."
2336          */
2337         if (!old_have_processed_any_pkt)
2338             ch_rx_handle_version_neg(ch, ch->qrx_pkt);
2339
2340         break;
2341
2342     default:
2343         assert(0);
2344         break;
2345     }
2346 }
2347
2348 static void ch_rx_handle_version_neg(QUIC_CHANNEL *ch, OSSL_QRX_PKT *pkt)
2349 {
2350     /*
2351      * We do not support version negotiation at this time. As per RFC 9000 s.
2352      * 6.2., we MUST abandon the connection attempt if we receive a Version
2353      * Negotiation packet, unless we have already successfully processed another
2354      * incoming packet, or the packet lists the QUIC version we want to use.
2355      */
2356     PACKET vpkt;
2357     unsigned long v;
2358
2359     if (!PACKET_buf_init(&vpkt, pkt->hdr->data, pkt->hdr->len))
2360         return;
2361
2362     while (PACKET_remaining(&vpkt) > 0) {
2363         if (!PACKET_get_net_4(&vpkt, &v))
2364             break;
2365
2366         if ((uint32_t)v == QUIC_VERSION_1)
2367             return;
2368     }
2369
2370     /* No match, this is a failure case. */
2371     ch_raise_version_neg_failure(ch);
2372 }
2373
2374 static void ch_raise_version_neg_failure(QUIC_CHANNEL *ch)
2375 {
2376     QUIC_TERMINATE_CAUSE tcause = {0};
2377
2378     tcause.error_code = OSSL_QUIC_ERR_CONNECTION_REFUSED;
2379     tcause.reason     = "version negotiation failure";
2380     tcause.reason_len = strlen(tcause.reason);
2381
2382     /*
2383      * Skip TERMINATING state; this is not considered a protocol error and we do
2384      * not send CONNECTION_CLOSE.
2385      */
2386     ch_start_terminating(ch, &tcause, 1);
2387 }
2388
2389 /* Try to generate packets and if possible, flush them to the network. */
2390 static int ch_tx(QUIC_CHANNEL *ch)
2391 {
2392     QUIC_TXP_STATUS status;
2393     int res;
2394
2395     /*
2396      * RFC 9000 s. 10.2.2: Draining Connection State:
2397      *      While otherwise identical to the closing state, an endpoint
2398      *      in the draining state MUST NOT send any packets.
2399      * and:
2400      *      An endpoint MUST NOT send further packets.
2401      */
2402     if (ossl_quic_channel_is_draining(ch))
2403         return 0;
2404
2405     if (ossl_quic_channel_is_closing(ch)) {
2406         /*
2407          * While closing, only send CONN_CLOSE if we've received more traffic
2408          * from the peer. Once we tell the TXP to generate CONN_CLOSE, all
2409          * future calls to it generate CONN_CLOSE frames, so otherwise we would
2410          * just constantly generate CONN_CLOSE frames.
2411          *
2412          * Confirming to RFC 9000 s. 10.2.1 Closing Connection State:
2413          *      An endpoint SHOULD limit the rate at which it generates
2414          *      packets in the closing state.
2415          */
2416         if (!ch->conn_close_queued)
2417             return 0;
2418
2419         ch->conn_close_queued = 0;
2420     }
2421
2422     /* Do TXKU if we need to. */
2423     ch_maybe_trigger_spontaneous_txku(ch);
2424
2425     ch->rxku_pending_confirm_done = 0;
2426
2427     /* Loop until we stop generating packets to send */
2428     do {
2429         /*
2430         * Send packet, if we need to. Best effort. The TXP consults the CC and
2431         * applies any limitations imposed by it, so we don't need to do it here.
2432         *
2433         * Best effort. In particular if TXP fails for some reason we should
2434         * still flush any queued packets which we already generated.
2435         */
2436         res = ossl_quic_tx_packetiser_generate(ch->txp, &status);
2437         if (status.sent_pkt > 0) {
2438             ch->have_sent_any_pkt = 1; /* Packet(s) were sent */
2439             ch->port->have_sent_any_pkt = 1;
2440
2441             /*
2442             * RFC 9000 s. 10.1. 'An endpoint also restarts its idle timer when
2443             * sending an ack-eliciting packet if no other ack-eliciting packets
2444             * have been sent since last receiving and processing a packet.'
2445             */
2446             if (status.sent_ack_eliciting
2447                     && !ch->have_sent_ack_eliciting_since_rx) {
2448                 ch_update_idle(ch);
2449                 ch->have_sent_ack_eliciting_since_rx = 1;
2450             }
2451
2452             if (!ch->is_server && status.sent_handshake)
2453                 /*
2454                 * RFC 9001 s. 4.9.1: A client MUST discard Initial keys when it
2455                 * first sends a Handshake packet.
2456                 */
2457                 ch_discard_el(ch, QUIC_ENC_LEVEL_INITIAL);
2458
2459             if (ch->rxku_pending_confirm_done)
2460                 ch->rxku_pending_confirm = 0;
2461
2462             ch_update_ping_deadline(ch);
2463         }
2464
2465         if (!res) {
2466             /*
2467             * One case where TXP can fail is if we reach a TX PN of 2**62 - 1.
2468             * As per RFC 9000 s. 12.3, if this happens we MUST close the
2469             * connection without sending a CONNECTION_CLOSE frame. This is
2470             * actually handled as an emergent consequence of our design, as the
2471             * TX packetiser will never transmit another packet when the TX PN
2472             * reaches the limit.
2473             *
2474             * Calling the below function terminates the connection; its attempt
2475             * to schedule a CONNECTION_CLOSE frame will not actually cause a
2476             * packet to be transmitted for this reason.
2477             */
2478             ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INTERNAL_ERROR,
2479                                                    0,
2480                                                    "internal error (txp generate)");
2481             break;
2482         }
2483     } while (status.sent_pkt > 0);
2484
2485     /* Flush packets to network. */
2486     switch (ossl_qtx_flush_net(ch->qtx)) {
2487     case QTX_FLUSH_NET_RES_OK:
2488     case QTX_FLUSH_NET_RES_TRANSIENT_FAIL:
2489         /* Best effort, done for now. */
2490         break;
2491
2492     case QTX_FLUSH_NET_RES_PERMANENT_FAIL:
2493     default:
2494         /* Permanent underlying network BIO, start terminating. */
2495         ossl_quic_port_raise_net_error(ch->port, ch);
2496         break;
2497     }
2498
2499     return 1;
2500 }
2501
2502 /* Determine next tick deadline. */
2503 static OSSL_TIME ch_determine_next_tick_deadline(QUIC_CHANNEL *ch)
2504 {
2505     OSSL_TIME deadline;
2506     int i;
2507
2508     if (ossl_quic_channel_is_terminated(ch))
2509         return ossl_time_infinite();
2510
2511     deadline = ossl_ackm_get_loss_detection_deadline(ch->ackm);
2512     if (ossl_time_is_zero(deadline))
2513         deadline = ossl_time_infinite();
2514
2515     /*
2516      * Check the ack deadline for all enc_levels that are actually provisioned.
2517      * ACKs aren't restricted by CC.
2518      */
2519     for (i = 0; i < QUIC_ENC_LEVEL_NUM; i++) {
2520         if (ossl_qtx_is_enc_level_provisioned(ch->qtx, i)) {
2521             deadline = ossl_time_min(deadline,
2522                                      ossl_ackm_get_ack_deadline(ch->ackm,
2523                                                                 ossl_quic_enc_level_to_pn_space(i)));
2524         }
2525     }
2526
2527     /*
2528      * When do we need to send an ACK-eliciting packet to reset the idle
2529      * deadline timer for the peer?
2530      */
2531     if (!ossl_time_is_infinite(ch->ping_deadline))
2532         deadline = ossl_time_min(deadline, ch->ping_deadline);
2533
2534     /* Apply TXP wakeup deadline. */
2535     deadline = ossl_time_min(deadline,
2536                              ossl_quic_tx_packetiser_get_deadline(ch->txp));
2537
2538     /* Is the terminating timer armed? */
2539     if (ossl_quic_channel_is_terminating(ch))
2540         deadline = ossl_time_min(deadline,
2541                                  ch->terminate_deadline);
2542     else if (!ossl_time_is_infinite(ch->idle_deadline))
2543         deadline = ossl_time_min(deadline,
2544                                  ch->idle_deadline);
2545
2546     /* When does the RXKU process complete? */
2547     if (ch->rxku_in_progress)
2548         deadline = ossl_time_min(deadline, ch->rxku_update_end_deadline);
2549
2550     return deadline;
2551 }
2552
2553 /*
2554  * QUIC Channel: Lifecycle Events
2555  * ==============================
2556  */
2557
2558 /*
2559  * Record a state transition. This is not necessarily a change to ch->state but
2560  * also includes the handshake becoming complete or confirmed, etc.
2561  */
2562 static void ch_record_state_transition(QUIC_CHANNEL *ch, uint32_t new_state)
2563 {
2564     uint32_t old_state = ch->state;
2565
2566     ch->state = new_state;
2567
2568     ossl_qlog_event_connectivity_connection_state_updated(ch_get_qlog(ch),
2569                                                           old_state,
2570                                                           new_state,
2571                                                           ch->handshake_complete,
2572                                                           ch->handshake_confirmed);
2573 }
2574
2575 int ossl_quic_channel_start(QUIC_CHANNEL *ch)
2576 {
2577     if (ch->is_server)
2578         /*
2579          * This is not used by the server. The server moves to active
2580          * automatically on receiving an incoming connection.
2581          */
2582         return 0;
2583
2584     if (ch->state != QUIC_CHANNEL_STATE_IDLE)
2585         /* Calls to connect are idempotent */
2586         return 1;
2587
2588     /* Inform QTX of peer address. */
2589     if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr))
2590         return 0;
2591
2592     /* Plug in secrets for the Initial EL. */
2593     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
2594                                           ch->port->engine->propq,
2595                                           &ch->init_dcid,
2596                                           ch->is_server,
2597                                           ch->qrx, ch->qtx))
2598         return 0;
2599
2600     /*
2601      * Determine the QUIC Transport Parameters and serialize the transport
2602      * parameters block. (For servers, we do this later as we must defer
2603      * generation until we have received the client's transport parameters.)
2604      */
2605     if (!ch->is_server && !ch->got_local_transport_params
2606         && !ch_generate_transport_params(ch))
2607         return 0;
2608
2609     /* Change state. */
2610     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
2611     ch->doing_proactive_ver_neg = 0; /* not currently supported */
2612
2613     ossl_qlog_event_connectivity_connection_started(ch_get_qlog(ch),
2614                                                     &ch->init_dcid);
2615
2616     /* Handshake layer: start (e.g. send CH). */
2617     if (!ch_tick_tls(ch, /*channel_only=*/0))
2618         return 0;
2619
2620     ossl_quic_reactor_tick(ossl_quic_port_get0_reactor(ch->port), 0); /* best effort */
2621     return 1;
2622 }
2623
2624 /* Start a locally initiated connection shutdown. */
2625 void ossl_quic_channel_local_close(QUIC_CHANNEL *ch, uint64_t app_error_code,
2626                                    const char *app_reason)
2627 {
2628     QUIC_TERMINATE_CAUSE tcause = {0};
2629
2630     if (ossl_quic_channel_is_term_any(ch))
2631         return;
2632
2633     tcause.app          = 1;
2634     tcause.error_code   = app_error_code;
2635     tcause.reason       = app_reason;
2636     tcause.reason_len   = app_reason != NULL ? strlen(app_reason) : 0;
2637     ch_start_terminating(ch, &tcause, 0);
2638 }
2639
2640 static void free_token(const unsigned char *buf, size_t buf_len, void *arg)
2641 {
2642     OPENSSL_free((unsigned char *)buf);
2643 }
2644
2645 /* Called when a server asks us to do a retry. */
2646 static int ch_retry(QUIC_CHANNEL *ch,
2647                     const unsigned char *retry_token,
2648                     size_t retry_token_len,
2649                     const QUIC_CONN_ID *retry_scid)
2650 {
2651     void *buf;
2652
2653     /*
2654      * RFC 9000 s. 17.2.5.1: "A client MUST discard a Retry packet that contains
2655      * a SCID field that is identical to the DCID field of its initial packet."
2656      */
2657     if (ossl_quic_conn_id_eq(&ch->init_dcid, retry_scid))
2658         return 1;
2659
2660     /* We change to using the SCID in the Retry packet as the DCID. */
2661     if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, retry_scid))
2662         return 0;
2663
2664     /*
2665      * Now we retry. We will release the Retry packet immediately, so copy
2666      * the token.
2667      */
2668     if ((buf = OPENSSL_memdup(retry_token, retry_token_len)) == NULL)
2669         return 0;
2670
2671     if (!ossl_quic_tx_packetiser_set_initial_token(ch->txp, buf,
2672                                                    retry_token_len,
2673                                                    free_token, NULL)) {
2674         /*
2675          * This may fail if the token we receive is too big for us to ever be
2676          * able to transmit in an outgoing Initial packet.
2677          */
2678         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_INVALID_TOKEN, 0,
2679                                                "received oversize token");
2680         OPENSSL_free(buf);
2681         return 0;
2682     }
2683
2684     ch->retry_scid  = *retry_scid;
2685     ch->doing_retry = 1;
2686
2687     /*
2688      * We need to stimulate the Initial EL to generate the first CRYPTO frame
2689      * again. We can do this most cleanly by simply forcing the ACKM to consider
2690      * the first Initial packet as lost, which it effectively was as the server
2691      * hasn't processed it. This also maintains the desired behaviour with e.g.
2692      * PNs not resetting and so on.
2693      *
2694      * The PN we used initially is always zero, because QUIC does not allow
2695      * repeated retries.
2696      */
2697     if (!ossl_ackm_mark_packet_pseudo_lost(ch->ackm, QUIC_PN_SPACE_INITIAL,
2698                                            /*PN=*/0))
2699         return 0;
2700
2701     /*
2702      * Plug in new secrets for the Initial EL. This is the only time we change
2703      * the secrets for an EL after we already provisioned it.
2704      */
2705     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
2706                                           ch->port->engine->propq,
2707                                           &ch->retry_scid,
2708                                           /*is_server=*/0,
2709                                           ch->qrx, ch->qtx))
2710         return 0;
2711
2712     return 1;
2713 }
2714
2715 /* Called when an EL is to be discarded. */
2716 static int ch_discard_el(QUIC_CHANNEL *ch,
2717                          uint32_t enc_level)
2718 {
2719     if (!ossl_assert(enc_level < QUIC_ENC_LEVEL_1RTT))
2720         return 0;
2721
2722     if ((ch->el_discarded & (1U << enc_level)) != 0)
2723         /* Already done. */
2724         return 1;
2725
2726     /* Best effort for all of these. */
2727     ossl_quic_tx_packetiser_discard_enc_level(ch->txp, enc_level);
2728     ossl_qrx_discard_enc_level(ch->qrx, enc_level);
2729     ossl_qtx_discard_enc_level(ch->qtx, enc_level);
2730
2731     if (enc_level != QUIC_ENC_LEVEL_0RTT) {
2732         uint32_t pn_space = ossl_quic_enc_level_to_pn_space(enc_level);
2733
2734         ossl_ackm_on_pkt_space_discarded(ch->ackm, pn_space);
2735
2736         /* We should still have crypto streams at this point. */
2737         if (!ossl_assert(ch->crypto_send[pn_space] != NULL)
2738             || !ossl_assert(ch->crypto_recv[pn_space] != NULL))
2739             return 0;
2740
2741         /* Get rid of the crypto stream state for the EL. */
2742         ossl_quic_sstream_free(ch->crypto_send[pn_space]);
2743         ch->crypto_send[pn_space] = NULL;
2744
2745         ossl_quic_rstream_free(ch->crypto_recv[pn_space]);
2746         ch->crypto_recv[pn_space] = NULL;
2747     }
2748
2749     ch->el_discarded |= (1U << enc_level);
2750     return 1;
2751 }
2752
2753 /* Intended to be called by the RXDP. */
2754 int ossl_quic_channel_on_handshake_confirmed(QUIC_CHANNEL *ch)
2755 {
2756     if (ch->handshake_confirmed)
2757         return 1;
2758
2759     if (!ch->handshake_complete) {
2760         /*
2761          * Does not make sense for handshake to be confirmed before it is
2762          * completed.
2763          */
2764         ossl_quic_channel_raise_protocol_error(ch, OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
2765                                                OSSL_QUIC_FRAME_TYPE_HANDSHAKE_DONE,
2766                                                "handshake cannot be confirmed "
2767                                                "before it is completed");
2768         return 0;
2769     }
2770
2771     ch_discard_el(ch, QUIC_ENC_LEVEL_HANDSHAKE);
2772     ch->handshake_confirmed = 1;
2773     ch_record_state_transition(ch, ch->state);
2774     ossl_ackm_on_handshake_confirmed(ch->ackm);
2775     return 1;
2776 }
2777
2778 /*
2779  * Master function used when we want to start tearing down a connection:
2780  *
2781  *   - If the connection is still IDLE we can go straight to TERMINATED;
2782  *
2783  *   - If we are already TERMINATED this is a no-op.
2784  *
2785  *   - If we are TERMINATING - CLOSING and we have now got a CONNECTION_CLOSE
2786  *     from the peer (tcause->remote == 1), we move to TERMINATING - DRAINING.
2787  *
2788  *   - If we are TERMINATING - DRAINING, we remain here until the terminating
2789  *     timer expires.
2790  *
2791  *   - Otherwise, we are in ACTIVE and move to TERMINATING - CLOSING.
2792  *     if we caused the termination (e.g. we have sent a CONNECTION_CLOSE). Note
2793  *     that we are considered to have caused a termination if we sent the first
2794  *     CONNECTION_CLOSE frame, even if it is caused by a peer protocol
2795  *     violation. If the peer sent the first CONNECTION_CLOSE frame, we move to
2796  *     TERMINATING - DRAINING.
2797  *
2798  * We record the termination cause structure passed on the first call only.
2799  * Any successive calls have their termination cause data discarded;
2800  * once we start sending a CONNECTION_CLOSE frame, we don't change the details
2801  * in it.
2802  *
2803  * This conforms to RFC 9000 s. 10.2.1: Closing Connection State:
2804  *      To minimize the state that an endpoint maintains for a closing
2805  *      connection, endpoints MAY send the exact same packet in response
2806  *      to any received packet.
2807  *
2808  * We don't drop any connection state (specifically packet protection keys)
2809  * even though we are permitted to.  This conforms to RFC 9000 s. 10.2.1:
2810  * Closing Connection State:
2811  *       An endpoint MAY retain packet protection keys for incoming
2812  *       packets to allow it to read and process a CONNECTION_CLOSE frame.
2813  *
2814  * Note that we do not conform to these two from the same section:
2815  *      An endpoint's selected connection ID and the QUIC version
2816  *      are sufficient information to identify packets for a closing
2817  *      connection; the endpoint MAY discard all other connection state.
2818  * and:
2819  *      An endpoint MAY drop packet protection keys when entering the
2820  *      closing state and send a packet containing a CONNECTION_CLOSE
2821  *      frame in response to any UDP datagram that is received.
2822  */
2823 static void copy_tcause(QUIC_TERMINATE_CAUSE *dst,
2824                         const QUIC_TERMINATE_CAUSE *src)
2825 {
2826     dst->error_code = src->error_code;
2827     dst->frame_type = src->frame_type;
2828     dst->app        = src->app;
2829     dst->remote     = src->remote;
2830
2831     dst->reason     = NULL;
2832     dst->reason_len = 0;
2833
2834     if (src->reason != NULL && src->reason_len > 0) {
2835         size_t l = src->reason_len;
2836         char *r;
2837
2838         if (l >= SIZE_MAX)
2839             --l;
2840
2841         /*
2842          * If this fails, dst->reason becomes NULL and we simply do not use a
2843          * reason. This ensures termination is infallible.
2844          */
2845         dst->reason = r = OPENSSL_memdup(src->reason, l + 1);
2846         if (r == NULL)
2847             return;
2848
2849         r[l]  = '\0';
2850         dst->reason_len = l;
2851     }
2852 }
2853
2854 static void ch_start_terminating(QUIC_CHANNEL *ch,
2855                                  const QUIC_TERMINATE_CAUSE *tcause,
2856                                  int force_immediate)
2857 {
2858     /* No point sending anything if we haven't sent anything yet. */
2859     if (!ch->have_sent_any_pkt)
2860         force_immediate = 1;
2861
2862     switch (ch->state) {
2863     default:
2864     case QUIC_CHANNEL_STATE_IDLE:
2865         copy_tcause(&ch->terminate_cause, tcause);
2866         ch_on_terminating_timeout(ch);
2867         break;
2868
2869     case QUIC_CHANNEL_STATE_ACTIVE:
2870         copy_tcause(&ch->terminate_cause, tcause);
2871
2872         ossl_qlog_event_connectivity_connection_closed(ch_get_qlog(ch), tcause);
2873
2874         if (!force_immediate) {
2875             ch_record_state_transition(ch, tcause->remote
2876                                            ? QUIC_CHANNEL_STATE_TERMINATING_DRAINING
2877                                            : QUIC_CHANNEL_STATE_TERMINATING_CLOSING);
2878             /*
2879              * RFC 9000 s. 10.2 Immediate Close
2880              *  These states SHOULD persist for at least three times
2881              *  the current PTO interval as defined in [QUIC-RECOVERY].
2882              */
2883             ch->terminate_deadline
2884                 = ossl_time_add(get_time(ch),
2885                                 ossl_time_multiply(ossl_ackm_get_pto_duration(ch->ackm),
2886                                                    3));
2887
2888             if (!tcause->remote) {
2889                 OSSL_QUIC_FRAME_CONN_CLOSE f = {0};
2890
2891                 /* best effort */
2892                 f.error_code = ch->terminate_cause.error_code;
2893                 f.frame_type = ch->terminate_cause.frame_type;
2894                 f.is_app     = ch->terminate_cause.app;
2895                 f.reason     = (char *)ch->terminate_cause.reason;
2896                 f.reason_len = ch->terminate_cause.reason_len;
2897                 ossl_quic_tx_packetiser_schedule_conn_close(ch->txp, &f);
2898                 /*
2899                  * RFC 9000 s. 10.2.2 Draining Connection State:
2900                  *  An endpoint that receives a CONNECTION_CLOSE frame MAY
2901                  *  send a single packet containing a CONNECTION_CLOSE
2902                  *  frame before entering the draining state, using a
2903                  *  NO_ERROR code if appropriate
2904                  */
2905                 ch->conn_close_queued = 1;
2906             }
2907         } else {
2908             ch_on_terminating_timeout(ch);
2909         }
2910         break;
2911
2912     case QUIC_CHANNEL_STATE_TERMINATING_CLOSING:
2913         if (force_immediate)
2914             ch_on_terminating_timeout(ch);
2915         else if (tcause->remote)
2916             /*
2917              * RFC 9000 s. 10.2.2 Draining Connection State:
2918              *  An endpoint MAY enter the draining state from the
2919              *  closing state if it receives a CONNECTION_CLOSE frame,
2920              *  which indicates that the peer is also closing or draining.
2921              */
2922             ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATING_DRAINING);
2923
2924         break;
2925
2926     case QUIC_CHANNEL_STATE_TERMINATING_DRAINING:
2927         /*
2928          * Other than in the force-immediate case, we remain here until the
2929          * timeout expires.
2930          */
2931         if (force_immediate)
2932             ch_on_terminating_timeout(ch);
2933
2934         break;
2935
2936     case QUIC_CHANNEL_STATE_TERMINATED:
2937         /* No-op. */
2938         break;
2939     }
2940 }
2941
2942 /* For RXDP use. */
2943 void ossl_quic_channel_on_remote_conn_close(QUIC_CHANNEL *ch,
2944                                             OSSL_QUIC_FRAME_CONN_CLOSE *f)
2945 {
2946     QUIC_TERMINATE_CAUSE tcause = {0};
2947
2948     if (!ossl_quic_channel_is_active(ch))
2949         return;
2950
2951     tcause.remote     = 1;
2952     tcause.app        = f->is_app;
2953     tcause.error_code = f->error_code;
2954     tcause.frame_type = f->frame_type;
2955     tcause.reason     = f->reason;
2956     tcause.reason_len = f->reason_len;
2957     ch_start_terminating(ch, &tcause, 0);
2958 }
2959
2960 static void free_frame_data(unsigned char *buf, size_t buf_len, void *arg)
2961 {
2962     OPENSSL_free(buf);
2963 }
2964
2965 static int ch_enqueue_retire_conn_id(QUIC_CHANNEL *ch, uint64_t seq_num)
2966 {
2967     BUF_MEM *buf_mem = NULL;
2968     WPACKET wpkt;
2969     size_t l;
2970
2971     ossl_quic_srtm_remove(ch->srtm, ch, seq_num);
2972
2973     if ((buf_mem = BUF_MEM_new()) == NULL)
2974         goto err;
2975
2976     if (!WPACKET_init(&wpkt, buf_mem))
2977         goto err;
2978
2979     if (!ossl_quic_wire_encode_frame_retire_conn_id(&wpkt, seq_num)) {
2980         WPACKET_cleanup(&wpkt);
2981         goto err;
2982     }
2983
2984     WPACKET_finish(&wpkt);
2985     if (!WPACKET_get_total_written(&wpkt, &l))
2986         goto err;
2987
2988     if (ossl_quic_cfq_add_frame(ch->cfq, 1, QUIC_PN_SPACE_APP,
2989                                 OSSL_QUIC_FRAME_TYPE_RETIRE_CONN_ID, 0,
2990                                 (unsigned char *)buf_mem->data, l,
2991                                 free_frame_data, NULL) == NULL)
2992         goto err;
2993
2994     buf_mem->data = NULL;
2995     BUF_MEM_free(buf_mem);
2996     return 1;
2997
2998 err:
2999     ossl_quic_channel_raise_protocol_error(ch,
3000                                            OSSL_QUIC_ERR_INTERNAL_ERROR,
3001                                            OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3002                                            "internal error enqueueing retire conn id");
3003     BUF_MEM_free(buf_mem);
3004     return 0;
3005 }
3006
3007 void ossl_quic_channel_on_new_conn_id(QUIC_CHANNEL *ch,
3008                                       OSSL_QUIC_FRAME_NEW_CONN_ID *f)
3009 {
3010     uint64_t new_remote_seq_num = ch->cur_remote_seq_num;
3011     uint64_t new_retire_prior_to = ch->cur_retire_prior_to;
3012
3013     if (!ossl_quic_channel_is_active(ch))
3014         return;
3015
3016     /* We allow only two active connection ids; first check some constraints */
3017     if (ch->cur_remote_dcid.id_len == 0) {
3018         /* Changing from 0 length connection id is disallowed */
3019         ossl_quic_channel_raise_protocol_error(ch,
3020                                                OSSL_QUIC_ERR_PROTOCOL_VIOLATION,
3021                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3022                                                "zero length connection id in use");
3023
3024         return;
3025     }
3026
3027     if (f->seq_num > new_remote_seq_num)
3028         new_remote_seq_num = f->seq_num;
3029     if (f->retire_prior_to > new_retire_prior_to)
3030         new_retire_prior_to = f->retire_prior_to;
3031
3032     /*
3033      * RFC 9000-5.1.1: An endpoint MUST NOT provide more connection IDs
3034      * than the peer's limit.
3035      *
3036      * After processing a NEW_CONNECTION_ID frame and adding and retiring
3037      * active connection IDs, if the number of active connection IDs exceeds
3038      * the value advertised in its active_connection_id_limit transport
3039      * parameter, an endpoint MUST close the connection with an error of
3040      * type CONNECTION_ID_LIMIT_ERROR.
3041      */
3042     if (new_remote_seq_num - new_retire_prior_to > 1) {
3043         ossl_quic_channel_raise_protocol_error(ch,
3044                                                OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3045                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3046                                                "active_connection_id limit violated");
3047         return;
3048     }
3049
3050     /*
3051      * RFC 9000-5.1.1: An endpoint MAY send connection IDs that temporarily
3052      * exceed a peer's limit if the NEW_CONNECTION_ID frame also requires
3053      * the retirement of any excess, by including a sufficiently large
3054      * value in the Retire Prior To field.
3055      *
3056      * RFC 9000-5.1.2: An endpoint SHOULD allow for sending and tracking
3057      * a number of RETIRE_CONNECTION_ID frames of at least twice the value
3058      * of the active_connection_id_limit transport parameter.  An endpoint
3059      * MUST NOT forget a connection ID without retiring it, though it MAY
3060      * choose to treat having connection IDs in need of retirement that
3061      * exceed this limit as a connection error of type CONNECTION_ID_LIMIT_ERROR.
3062      *
3063      * We are a little bit more liberal than the minimum mandated.
3064      */
3065     if (new_retire_prior_to - ch->cur_retire_prior_to > 10) {
3066         ossl_quic_channel_raise_protocol_error(ch,
3067                                                OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3068                                                OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3069                                                "retiring connection id limit violated");
3070
3071         return;
3072     }
3073
3074     if (new_remote_seq_num > ch->cur_remote_seq_num) {
3075         /* Add new stateless reset token */
3076         if (!ossl_quic_srtm_add(ch->srtm, ch, new_remote_seq_num,
3077                                 &f->stateless_reset)) {
3078             ossl_quic_channel_raise_protocol_error(
3079                     ch, OSSL_QUIC_ERR_CONNECTION_ID_LIMIT_ERROR,
3080                     OSSL_QUIC_FRAME_TYPE_NEW_CONN_ID,
3081                     "unable to store stateless reset token");
3082
3083             return;
3084         }
3085         ch->cur_remote_seq_num = new_remote_seq_num;
3086         ch->cur_remote_dcid = f->conn_id;
3087         ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid);
3088     }
3089
3090     /*
3091      * RFC 9000-5.1.2: Upon receipt of an increased Retire Prior To
3092      * field, the peer MUST stop using the corresponding connection IDs
3093      * and retire them with RETIRE_CONNECTION_ID frames before adding the
3094      * newly provided connection ID to the set of active connection IDs.
3095      */
3096
3097     /*
3098      * Note: RFC 9000 s. 19.15 says:
3099      *   "An endpoint that receives a NEW_CONNECTION_ID frame with a sequence
3100      *    number smaller than the Retire Prior To field of a previously received
3101      *    NEW_CONNECTION_ID frame MUST send a corresponding
3102      *    RETIRE_CONNECTION_ID frame that retires the newly received connection
3103      *    ID, unless it has already done so for that sequence number."
3104      *
3105      * Since we currently always queue RETIRE_CONN_ID frames based on the Retire
3106      * Prior To field of a NEW_CONNECTION_ID frame immediately upon receiving
3107      * that NEW_CONNECTION_ID frame, by definition this will always be met.
3108      * This may change in future when we change our CID handling.
3109      */
3110     while (new_retire_prior_to > ch->cur_retire_prior_to) {
3111         if (!ch_enqueue_retire_conn_id(ch, ch->cur_retire_prior_to))
3112             break;
3113         ++ch->cur_retire_prior_to;
3114     }
3115 }
3116
3117 static void ch_save_err_state(QUIC_CHANNEL *ch)
3118 {
3119     if (ch->err_state == NULL)
3120         ch->err_state = OSSL_ERR_STATE_new();
3121
3122     if (ch->err_state == NULL)
3123         return;
3124
3125     OSSL_ERR_STATE_save(ch->err_state);
3126 }
3127
3128 void ossl_quic_channel_inject(QUIC_CHANNEL *ch, QUIC_URXE *e)
3129 {
3130     ossl_qrx_inject_urxe(ch->qrx, e);
3131 }
3132
3133 void ossl_quic_channel_on_stateless_reset(QUIC_CHANNEL *ch)
3134 {
3135     QUIC_TERMINATE_CAUSE tcause = {0};
3136
3137     tcause.error_code   = OSSL_QUIC_ERR_NO_ERROR;
3138     tcause.remote       = 1;
3139     ch_start_terminating(ch, &tcause, 0);
3140 }
3141
3142 void ossl_quic_channel_raise_net_error(QUIC_CHANNEL *ch)
3143 {
3144     QUIC_TERMINATE_CAUSE tcause = {0};
3145
3146     if (ch->net_error)
3147         return;
3148
3149     ch->net_error = 1;
3150
3151     tcause.error_code = OSSL_QUIC_ERR_INTERNAL_ERROR;
3152     tcause.reason     = "network BIO I/O error";
3153     tcause.reason_len = strlen(tcause.reason);
3154
3155     /*
3156      * Skip Terminating state and go directly to Terminated, no point trying to
3157      * send CONNECTION_CLOSE if we cannot communicate.
3158      */
3159     ch_start_terminating(ch, &tcause, 1);
3160 }
3161
3162 int ossl_quic_channel_net_error(QUIC_CHANNEL *ch)
3163 {
3164     return ch->net_error;
3165 }
3166
3167 void ossl_quic_channel_restore_err_state(QUIC_CHANNEL *ch)
3168 {
3169     if (ch == NULL)
3170         return;
3171
3172     if (!ossl_quic_port_is_running(ch->port))
3173         ossl_quic_port_restore_err_state(ch->port);
3174     else
3175         OSSL_ERR_STATE_restore(ch->err_state);
3176 }
3177
3178 void ossl_quic_channel_raise_protocol_error_loc(QUIC_CHANNEL *ch,
3179                                                 uint64_t error_code,
3180                                                 uint64_t frame_type,
3181                                                 const char *reason,
3182                                                 ERR_STATE *err_state,
3183                                                 const char *src_file,
3184                                                 int src_line,
3185                                                 const char *src_func)
3186 {
3187     QUIC_TERMINATE_CAUSE tcause = {0};
3188     int err_reason = error_code == OSSL_QUIC_ERR_INTERNAL_ERROR
3189                      ? ERR_R_INTERNAL_ERROR : SSL_R_QUIC_PROTOCOL_ERROR;
3190     const char *err_str = ossl_quic_err_to_string(error_code);
3191     const char *err_str_pfx = " (", *err_str_sfx = ")";
3192     const char *ft_str = NULL;
3193     const char *ft_str_pfx = " (", *ft_str_sfx = ")";
3194
3195     if (ch->protocol_error)
3196         /* Only the first call to this function matters. */
3197         return;
3198
3199     if (err_str == NULL) {
3200         err_str     = "";
3201         err_str_pfx = "";
3202         err_str_sfx = "";
3203     }
3204
3205     /*
3206      * If we were provided an underlying error state, restore it and then append
3207      * our ERR on top as a "cover letter" error.
3208      */
3209     if (err_state != NULL)
3210         OSSL_ERR_STATE_restore(err_state);
3211
3212     if (frame_type != 0) {
3213         ft_str = ossl_quic_frame_type_to_string(frame_type);
3214         if (ft_str == NULL) {
3215             ft_str      = "";
3216             ft_str_pfx  = "";
3217             ft_str_sfx  = "";
3218         }
3219
3220         ERR_raise_data(ERR_LIB_SSL, err_reason,
3221                        "QUIC error code: 0x%llx%s%s%s "
3222                        "(triggered by frame type: 0x%llx%s%s%s), reason: \"%s\"",
3223                        (unsigned long long) error_code,
3224                        err_str_pfx, err_str, err_str_sfx,
3225                        (unsigned long long) frame_type,
3226                        ft_str_pfx, ft_str, ft_str_sfx,
3227                        reason);
3228     } else {
3229         ERR_raise_data(ERR_LIB_SSL, err_reason,
3230                        "QUIC error code: 0x%llx%s%s%s, reason: \"%s\"",
3231                        (unsigned long long) error_code,
3232                        err_str_pfx, err_str, err_str_sfx,
3233                        reason);
3234     }
3235
3236     if (src_file != NULL)
3237         ERR_set_debug(src_file, src_line, src_func);
3238
3239     ch_save_err_state(ch);
3240
3241     tcause.error_code = error_code;
3242     tcause.frame_type = frame_type;
3243     tcause.reason     = reason;
3244     tcause.reason_len = strlen(reason);
3245
3246     ch->protocol_error = 1;
3247     ch_start_terminating(ch, &tcause, 0);
3248 }
3249
3250 /*
3251  * Called once the terminating timer expires, meaning we move from TERMINATING
3252  * to TERMINATED.
3253  */
3254 static void ch_on_terminating_timeout(QUIC_CHANNEL *ch)
3255 {
3256     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
3257 }
3258
3259 /*
3260  * Determines the effective idle timeout duration. This is based on the idle
3261  * timeout values that we and our peer signalled in transport parameters
3262  * but have some limits applied.
3263  */
3264 static OSSL_TIME ch_get_effective_idle_timeout_duration(QUIC_CHANNEL *ch)
3265 {
3266     OSSL_TIME pto;
3267
3268     if (ch->max_idle_timeout == 0)
3269         return ossl_time_infinite();
3270
3271     /*
3272      * RFC 9000 s. 10.1: Idle Timeout
3273      *  To avoid excessively small idle timeout periods, endpoints
3274      *  MUST increase the idle timeout period to be at least three
3275      *  times the current Probe Timeout (PTO). This allows for
3276      *  multiple PTOs to expire, and therefore multiple probes to
3277      *  be sent and lost, prior to idle timeout.
3278      */
3279     pto = ossl_ackm_get_pto_duration(ch->ackm);
3280     return ossl_time_max(ossl_ms2time(ch->max_idle_timeout),
3281                                       ossl_time_multiply(pto, 3));
3282 }
3283
3284 /*
3285  * Updates our idle deadline. Called when an event happens which should bump the
3286  * idle timeout.
3287  */
3288 static void ch_update_idle(QUIC_CHANNEL *ch)
3289 {
3290     ch->idle_deadline = ossl_time_add(get_time(ch),
3291                                       ch_get_effective_idle_timeout_duration(ch));
3292 }
3293
3294 /*
3295  * Updates our ping deadline, which determines when we next generate a ping if
3296  * we don't have any other ACK-eliciting frames to send.
3297  */
3298 static void ch_update_ping_deadline(QUIC_CHANNEL *ch)
3299 {
3300     OSSL_TIME max_span, idle_duration;
3301
3302     idle_duration = ch_get_effective_idle_timeout_duration(ch);
3303     if (ossl_time_is_infinite(idle_duration)) {
3304         ch->ping_deadline = ossl_time_infinite();
3305         return;
3306     }
3307
3308     /*
3309      * Maximum amount of time without traffic before we send a PING to keep
3310      * the connection open. Usually we use max_idle_timeout/2, but ensure
3311      * the period never exceeds the assumed NAT interval to ensure NAT
3312      * devices don't have their state time out (RFC 9000 s. 10.1.2).
3313      */
3314     max_span = ossl_time_divide(idle_duration, 2);
3315     max_span = ossl_time_min(max_span, MAX_NAT_INTERVAL);
3316     ch->ping_deadline = ossl_time_add(get_time(ch), max_span);
3317 }
3318
3319 /* Called when the idle timeout expires. */
3320 static void ch_on_idle_timeout(QUIC_CHANNEL *ch)
3321 {
3322     /*
3323      * Idle timeout does not have an error code associated with it because a
3324      * CONN_CLOSE is never sent for it. We shouldn't use this data once we reach
3325      * TERMINATED anyway.
3326      */
3327     ch->terminate_cause.app         = 0;
3328     ch->terminate_cause.error_code  = OSSL_QUIC_LOCAL_ERR_IDLE_TIMEOUT;
3329     ch->terminate_cause.frame_type  = 0;
3330
3331     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_TERMINATED);
3332 }
3333
3334 /* Called when we, as a server, get a new incoming connection. */
3335 int ossl_quic_channel_on_new_conn(QUIC_CHANNEL *ch, const BIO_ADDR *peer,
3336                                   const QUIC_CONN_ID *peer_scid,
3337                                   const QUIC_CONN_ID *peer_dcid)
3338 {
3339     if (!ossl_assert(ch->state == QUIC_CHANNEL_STATE_IDLE && ch->is_server))
3340         return 0;
3341
3342     /* Generate an Initial LCID we will use for the connection. */
3343     if (!ossl_quic_lcidm_generate_initial(ch->lcidm, ch, &ch->cur_local_cid))
3344         return 0;
3345
3346     /* Note our newly learnt peer address and CIDs. */
3347     ch->cur_peer_addr   = *peer;
3348     ch->init_dcid       = *peer_dcid;
3349     ch->cur_remote_dcid = *peer_scid;
3350
3351     /* Inform QTX of peer address. */
3352     if (!ossl_quic_tx_packetiser_set_peer(ch->txp, &ch->cur_peer_addr))
3353         return 0;
3354
3355     /* Inform TXP of desired CIDs. */
3356     if (!ossl_quic_tx_packetiser_set_cur_dcid(ch->txp, &ch->cur_remote_dcid))
3357         return 0;
3358
3359     if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
3360         return 0;
3361
3362     /* Setup QLOG, which did not happen earlier due to lacking an Initial ODCID. */
3363     ossl_qtx_set_qlog_cb(ch->qtx, ch_get_qlog_cb, ch);
3364     ossl_quic_tx_packetiser_set_qlog_cb(ch->txp, ch_get_qlog_cb, ch);
3365
3366     /* Plug in secrets for the Initial EL. */
3367     if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
3368                                           ch->port->engine->propq,
3369                                           &ch->init_dcid,
3370                                           /*is_server=*/1,
3371                                           ch->qrx, ch->qtx))
3372         return 0;
3373
3374     /* Register the peer ODCID in the LCIDM. */
3375     if (!ossl_quic_lcidm_enrol_odcid(ch->lcidm, ch, &ch->init_dcid))
3376         return 0;
3377
3378     /* Change state. */
3379     ch_record_state_transition(ch, QUIC_CHANNEL_STATE_ACTIVE);
3380     ch->doing_proactive_ver_neg = 0; /* not currently supported */
3381     return 1;
3382 }
3383
3384 SSL *ossl_quic_channel_get0_ssl(QUIC_CHANNEL *ch)
3385 {
3386     return ch->tls;
3387 }
3388
3389 static int ch_init_new_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs,
3390                               int can_send, int can_recv)
3391 {
3392     uint64_t rxfc_wnd;
3393     int server_init = ossl_quic_stream_is_server_init(qs);
3394     int local_init = (ch->is_server == server_init);
3395     int is_uni = !ossl_quic_stream_is_bidi(qs);
3396
3397     if (can_send)
3398         if ((qs->sstream = ossl_quic_sstream_new(INIT_APP_BUF_LEN)) == NULL)
3399             goto err;
3400
3401     if (can_recv)
3402         if ((qs->rstream = ossl_quic_rstream_new(NULL, NULL, 0)) == NULL)
3403             goto err;
3404
3405     /* TXFC */
3406     if (!ossl_quic_txfc_init(&qs->txfc, &ch->conn_txfc))
3407         goto err;
3408
3409     if (ch->got_remote_transport_params) {
3410         /*
3411          * If we already got peer TPs we need to apply the initial CWM credit
3412          * now. If we didn't already get peer TPs this will be done
3413          * automatically for all extant streams when we do.
3414          */
3415         if (can_send) {
3416             uint64_t cwm;
3417
3418             if (is_uni)
3419                 cwm = ch->rx_init_max_stream_data_uni;
3420             else if (local_init)
3421                 cwm = ch->rx_init_max_stream_data_bidi_local;
3422             else
3423                 cwm = ch->rx_init_max_stream_data_bidi_remote;
3424
3425             ossl_quic_txfc_bump_cwm(&qs->txfc, cwm);
3426         }
3427     }
3428
3429     /* RXFC */
3430     if (!can_recv)
3431         rxfc_wnd = 0;
3432     else if (is_uni)
3433         rxfc_wnd = ch->tx_init_max_stream_data_uni;
3434     else if (local_init)
3435         rxfc_wnd = ch->tx_init_max_stream_data_bidi_local;
3436     else
3437         rxfc_wnd = ch->tx_init_max_stream_data_bidi_remote;
3438
3439     if (!ossl_quic_rxfc_init(&qs->rxfc, &ch->conn_rxfc,
3440                              rxfc_wnd,
3441                              DEFAULT_STREAM_RXFC_MAX_WND_MUL * rxfc_wnd,
3442                              get_time, ch))
3443         goto err;
3444
3445     return 1;
3446
3447 err:
3448     ossl_quic_sstream_free(qs->sstream);
3449     qs->sstream = NULL;
3450     ossl_quic_rstream_free(qs->rstream);
3451     qs->rstream = NULL;
3452     return 0;
3453 }
3454
3455 static uint64_t *ch_get_local_stream_next_ordinal_ptr(QUIC_CHANNEL *ch,
3456                                                       int is_uni)
3457 {
3458     return is_uni ? &ch->next_local_stream_ordinal_uni
3459                   : &ch->next_local_stream_ordinal_bidi;
3460 }
3461
3462 static const uint64_t *ch_get_local_stream_max_ptr(const QUIC_CHANNEL *ch,
3463                                                    int is_uni)
3464 {
3465     return is_uni ? &ch->max_local_streams_uni
3466                   : &ch->max_local_streams_bidi;
3467 }
3468
3469 static const QUIC_RXFC *ch_get_remote_stream_count_rxfc(const QUIC_CHANNEL *ch,
3470                                                         int is_uni)
3471 {
3472     return is_uni ? &ch->max_streams_uni_rxfc
3473                   : &ch->max_streams_bidi_rxfc;
3474 }
3475
3476 int ossl_quic_channel_is_new_local_stream_admissible(QUIC_CHANNEL *ch,
3477                                                      int is_uni)
3478 {
3479     const uint64_t *p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni);
3480
3481     return ossl_quic_stream_map_is_local_allowed_by_stream_limit(&ch->qsm,
3482                                                                  *p_next_ordinal,
3483                                                                  is_uni);
3484 }
3485
3486 uint64_t ossl_quic_channel_get_local_stream_count_avail(const QUIC_CHANNEL *ch,
3487                                                         int is_uni)
3488 {
3489     const uint64_t *p_next_ordinal, *p_max;
3490
3491     p_next_ordinal  = ch_get_local_stream_next_ordinal_ptr((QUIC_CHANNEL *)ch,
3492                                                            is_uni);
3493     p_max           = ch_get_local_stream_max_ptr(ch, is_uni);
3494
3495     return *p_max - *p_next_ordinal;
3496 }
3497
3498 uint64_t ossl_quic_channel_get_remote_stream_count_avail(const QUIC_CHANNEL *ch,
3499                                                          int is_uni)
3500 {
3501     return ossl_quic_rxfc_get_credit(ch_get_remote_stream_count_rxfc(ch, is_uni));
3502 }
3503
3504 QUIC_STREAM *ossl_quic_channel_new_stream_local(QUIC_CHANNEL *ch, int is_uni)
3505 {
3506     QUIC_STREAM *qs;
3507     int type;
3508     uint64_t stream_id;
3509     uint64_t *p_next_ordinal;
3510
3511     type = ch->is_server ? QUIC_STREAM_INITIATOR_SERVER
3512                          : QUIC_STREAM_INITIATOR_CLIENT;
3513
3514     p_next_ordinal = ch_get_local_stream_next_ordinal_ptr(ch, is_uni);
3515
3516     if (is_uni)
3517         type |= QUIC_STREAM_DIR_UNI;
3518     else
3519         type |= QUIC_STREAM_DIR_BIDI;
3520
3521     if (*p_next_ordinal >= ((uint64_t)1) << 62)
3522         return NULL;
3523
3524     stream_id = ((*p_next_ordinal) << 2) | type;
3525
3526     if ((qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id, type)) == NULL)
3527         return NULL;
3528
3529     /* Locally-initiated stream, so we always want a send buffer. */
3530     if (!ch_init_new_stream(ch, qs, /*can_send=*/1, /*can_recv=*/!is_uni))
3531         goto err;
3532
3533     ++*p_next_ordinal;
3534     return qs;
3535
3536 err:
3537     ossl_quic_stream_map_release(&ch->qsm, qs);
3538     return NULL;
3539 }
3540
3541 QUIC_STREAM *ossl_quic_channel_new_stream_remote(QUIC_CHANNEL *ch,
3542                                                  uint64_t stream_id)
3543 {
3544     uint64_t peer_role;
3545     int is_uni;
3546     QUIC_STREAM *qs;
3547
3548     peer_role = ch->is_server
3549         ? QUIC_STREAM_INITIATOR_CLIENT
3550         : QUIC_STREAM_INITIATOR_SERVER;
3551
3552     if ((stream_id & QUIC_STREAM_INITIATOR_MASK) != peer_role)
3553         return NULL;
3554
3555     is_uni = ((stream_id & QUIC_STREAM_DIR_MASK) == QUIC_STREAM_DIR_UNI);
3556
3557     qs = ossl_quic_stream_map_alloc(&ch->qsm, stream_id,
3558                                     stream_id & (QUIC_STREAM_INITIATOR_MASK
3559                                                  | QUIC_STREAM_DIR_MASK));
3560     if (qs == NULL)
3561         return NULL;
3562
3563     if (!ch_init_new_stream(ch, qs, /*can_send=*/!is_uni, /*can_recv=*/1))
3564         goto err;
3565
3566     if (ch->incoming_stream_auto_reject)
3567         ossl_quic_channel_reject_stream(ch, qs);
3568     else
3569         ossl_quic_stream_map_push_accept_queue(&ch->qsm, qs);
3570
3571     return qs;
3572
3573 err:
3574     ossl_quic_stream_map_release(&ch->qsm, qs);
3575     return NULL;
3576 }
3577
3578 void ossl_quic_channel_set_incoming_stream_auto_reject(QUIC_CHANNEL *ch,
3579                                                        int enable,
3580                                                        uint64_t aec)
3581 {
3582     ch->incoming_stream_auto_reject     = (enable != 0);
3583     ch->incoming_stream_auto_reject_aec = aec;
3584 }
3585
3586 void ossl_quic_channel_reject_stream(QUIC_CHANNEL *ch, QUIC_STREAM *qs)
3587 {
3588     ossl_quic_stream_map_stop_sending_recv_part(&ch->qsm, qs,
3589                                                 ch->incoming_stream_auto_reject_aec);
3590
3591     ossl_quic_stream_map_reset_stream_send_part(&ch->qsm, qs,
3592                                                 ch->incoming_stream_auto_reject_aec);
3593     qs->deleted = 1;
3594
3595     ossl_quic_stream_map_update_state(&ch->qsm, qs);
3596 }
3597
3598 /* Replace local connection ID in TXP and DEMUX for testing purposes. */
3599 int ossl_quic_channel_replace_local_cid(QUIC_CHANNEL *ch,
3600                                         const QUIC_CONN_ID *conn_id)
3601 {
3602     /* Remove the current LCID from the LCIDM. */
3603     if (!ossl_quic_lcidm_debug_remove(ch->lcidm, &ch->cur_local_cid))
3604         return 0;
3605     ch->cur_local_cid = *conn_id;
3606     /* Set in the TXP, used only for long header packets. */
3607     if (!ossl_quic_tx_packetiser_set_cur_scid(ch->txp, &ch->cur_local_cid))
3608         return 0;
3609     /* Add the new LCID to the LCIDM. */
3610     if (!ossl_quic_lcidm_debug_add(ch->lcidm, ch, &ch->cur_local_cid,
3611                                    100))
3612         return 0;
3613     return 1;
3614 }
3615
3616 void ossl_quic_channel_set_msg_callback(QUIC_CHANNEL *ch,
3617                                         ossl_msg_cb msg_callback,
3618                                         SSL *msg_callback_ssl)
3619 {
3620     ch->msg_callback = msg_callback;
3621     ch->msg_callback_ssl = msg_callback_ssl;
3622     ossl_qtx_set_msg_callback(ch->qtx, msg_callback, msg_callback_ssl);
3623     ossl_quic_tx_packetiser_set_msg_callback(ch->txp, msg_callback,
3624                                              msg_callback_ssl);
3625     ossl_qrx_set_msg_callback(ch->qrx, msg_callback, msg_callback_ssl);
3626 }
3627
3628 void ossl_quic_channel_set_msg_callback_arg(QUIC_CHANNEL *ch,
3629                                             void *msg_callback_arg)
3630 {
3631     ch->msg_callback_arg = msg_callback_arg;
3632     ossl_qtx_set_msg_callback_arg(ch->qtx, msg_callback_arg);
3633     ossl_quic_tx_packetiser_set_msg_callback_arg(ch->txp, msg_callback_arg);
3634     ossl_qrx_set_msg_callback_arg(ch->qrx, msg_callback_arg);
3635 }
3636
3637 void ossl_quic_channel_set_txku_threshold_override(QUIC_CHANNEL *ch,
3638                                                    uint64_t tx_pkt_threshold)
3639 {
3640     ch->txku_threshold_override = tx_pkt_threshold;
3641 }
3642
3643 uint64_t ossl_quic_channel_get_tx_key_epoch(QUIC_CHANNEL *ch)
3644 {
3645     return ossl_qtx_get_key_epoch(ch->qtx);
3646 }
3647
3648 uint64_t ossl_quic_channel_get_rx_key_epoch(QUIC_CHANNEL *ch)
3649 {
3650     return ossl_qrx_get_key_epoch(ch->qrx);
3651 }
3652
3653 int ossl_quic_channel_trigger_txku(QUIC_CHANNEL *ch)
3654 {
3655     if (!txku_allowed(ch))
3656         return 0;
3657
3658     ch->ku_locally_initiated = 1;
3659     ch_trigger_txku(ch);
3660     return 1;
3661 }
3662
3663 int ossl_quic_channel_ping(QUIC_CHANNEL *ch)
3664 {
3665     int pn_space = ossl_quic_enc_level_to_pn_space(ch->tx_enc_level);
3666
3667     ossl_quic_tx_packetiser_schedule_ack_eliciting(ch->txp, pn_space);
3668
3669     return 1;
3670 }
3671
3672 uint16_t ossl_quic_channel_get_diag_num_rx_ack(QUIC_CHANNEL *ch)
3673 {
3674     return ch->diag_num_rx_ack;
3675 }
3676
3677 void ossl_quic_channel_get_diag_local_cid(QUIC_CHANNEL *ch, QUIC_CONN_ID *cid)
3678 {
3679     *cid = ch->cur_local_cid;
3680 }
3681
3682 int ossl_quic_channel_have_generated_transport_params(const QUIC_CHANNEL *ch)
3683 {
3684     return ch->got_local_transport_params;
3685 }
3686
3687 void ossl_quic_channel_set_max_idle_timeout_request(QUIC_CHANNEL *ch, uint64_t ms)
3688 {
3689     ch->max_idle_timeout_local_req = ms;
3690 }
3691 uint64_t ossl_quic_channel_get_max_idle_timeout_request(const QUIC_CHANNEL *ch)
3692 {
3693     return ch->max_idle_timeout_local_req;
3694 }
3695
3696 uint64_t ossl_quic_channel_get_max_idle_timeout_peer_request(const QUIC_CHANNEL *ch)
3697 {
3698     return ch->max_idle_timeout_remote_req;
3699 }
3700
3701 uint64_t ossl_quic_channel_get_max_idle_timeout_actual(const QUIC_CHANNEL *ch)
3702 {
3703     return ch->max_idle_timeout;
3704 }