/src/openssl/ssl/quic/quic_port.c

Source
/*
 * Copyright 2023-2026 The OpenSSL Project Authors. All Rights Reserved.
 *
 * Licensed under the Apache License 2.0 (the "License").  You may not use
 * this file except in compliance with the License.  You can obtain a copy
 * in the file LICENSE in the source distribution or at
 * https://www.openssl.org/source/license.html
 */

#include "internal/quic_port.h"
#include "internal/quic_channel.h"
#include "internal/quic_lcidm.h"
#include "internal/quic_srtm.h"
#include "internal/quic_txp.h"
#include "internal/ssl_unwrap.h"
#include "quic_port_local.h"
#include "quic_channel_local.h"
#include "quic_engine_local.h"
#include "quic_local.h"
#include "../ssl_local.h"
#include <openssl/rand.h>

/*
 * QUIC Port Structure
 * ===================
 */
#define INIT_DCID_LEN 8

static int port_init(QUIC_PORT *port);
static void port_cleanup(QUIC_PORT *port);
static OSSL_TIME get_time(void *arg);
static void port_default_packet_handler(QUIC_URXE *e, void *arg,
    const QUIC_CONN_ID *dcid);
static void port_rx_pre(QUIC_PORT *port);

/**
 * @struct validation_token
 * @brief Represents a validation token for secure connection handling.
 *
 * This struct is used to store information related to a validation token.
 *
 * @var validation_token::is_retry
 * True iff this validation token is for a token sent in a RETRY packet.
 * Otherwise, this token is from a NEW_TOKEN_packet. Iff this value is true,
 * then ODCID and RSCID are set.
 *
 * @var validation_token::timestamp
 * Time that the validation token was minted.
 *
 * @var validation_token::odcid
 * An original connection ID (`QUIC_CONN_ID`) used to identify the QUIC
 * connection. This ID helps associate the token with a specific connection.
 * This will only be valid for validation tokens from RETRY packets.
 *
 * @var validation_token::rscid
 * DCID that the client will use as the DCID of the subsequent initial packet
 * i.e the "new" DCID.
 * This will only be valid for validation tokens from RETRY packets.
 *
 * @var validation_token::remote_addr_len
 * Length of the following character array.
 *
 * @var validation_token::remote_addr
 * A character array holding the raw address of the client requesting the
 * connection.
 */
typedef struct validation_token {
    OSSL_TIME timestamp;
    QUIC_CONN_ID odcid;
    QUIC_CONN_ID rscid;
    size_t remote_addr_len;
    unsigned char *remote_addr;
    unsigned char is_retry;
} QUIC_VALIDATION_TOKEN;

/*
 * Maximum length of a marshalled validation token.
 *
 * - timestamp is 8 bytes
 * - odcid and rscid are maximally 42 bytes in total
 * - remote_addr_len is a size_t (8 bytes)
 * - remote_addr is in the worst case 110 bytes (in the case of using a
 *   maximally sized AF_UNIX socket)
 * - is_retry is a single byte
 */
#define MARSHALLED_TOKEN_MAX_LEN 169

/*
 * Maximum length of an encrypted marshalled validation token.
 *
 * This will include the size of the marshalled validation token plus a 16 byte
 * tag and a 12 byte IV, so in total 197 bytes.
 */
#define ENCRYPTED_TOKEN_MAX_LEN (MARSHALLED_TOKEN_MAX_LEN + 16 + 12)

/* Arbitrary choice of default idle timeout (not an RFC value). */
#define DEFAULT_IDLE_TIMEOUT 30000

#define DEFAULT_INIT_CONN_RXFC_WND (768 * 1024)
#define DEFAULT_INIT_STREAM_RXFC_WND (512 * 1024)

#define DEFAULT_INIT_CONN_MAX_STREAMS 100

#define DEFAULT_MAX_PENDING_CONNS 256

DEFINE_LIST_OF_IMPL(ch, QUIC_CHANNEL);
DEFINE_LIST_OF_IMPL(incoming_ch, QUIC_CHANNEL);
DEFINE_LIST_OF_IMPL(port, QUIC_PORT);

QUIC_PORT *ossl_quic_port_new(const QUIC_PORT_ARGS *args)
{
    QUIC_PORT *port;

    if ((port = OPENSSL_zalloc(sizeof(QUIC_PORT))) == NULL)
        return NULL;

    port->engine = args->engine;
    port->channel_ctx = args->channel_ctx;
    port->is_multi_conn = args->is_multi_conn;
    port->validate_addr = args->do_addr_validation;
    port->get_conn_user_ssl = args->get_conn_user_ssl;
    port->ql = args->ql;
    port->max_pending_channels = DEFAULT_MAX_PENDING_CONNS;

    if (!port_init(port)) {
        OPENSSL_free(port);
        return NULL;
    }

    return port;
}

void ossl_quic_port_free(QUIC_PORT *port)
{
    if (port == NULL)
        return;

    port_cleanup(port);
    OPENSSL_free(port);
}

static int port_init(QUIC_PORT *port)
{
    size_t rx_short_dcid_len = (port->is_multi_conn ? INIT_DCID_LEN : 0);
    int key_len = -1;
    EVP_CIPHER *cipher = NULL;
    unsigned char *token_key = NULL;
    int ret = 0;

    if (port->engine == NULL || port->channel_ctx == NULL)
        goto err;

    if ((port->err_state = OSSL_ERR_STATE_new()) == NULL)
        goto err;

    if ((port->demux = ossl_quic_demux_new(/*BIO=*/NULL,
             /*Short CID Len=*/rx_short_dcid_len,
             get_time, port))
        == NULL)
        goto err;

    ossl_quic_demux_set_default_handler(port->demux,
        port_default_packet_handler,
        port);

    if ((port->srtm = ossl_quic_srtm_new(port->engine->libctx,
             port->engine->propq))
        == NULL)
        goto err;

    if ((port->lcidm = ossl_quic_lcidm_new(port->engine->libctx,
             rx_short_dcid_len))
        == NULL)
        goto err;

    port->rx_short_dcid_len = (unsigned char)rx_short_dcid_len;
    port->tx_init_dcid_len = INIT_DCID_LEN;

    port->max_idle_timeout = DEFAULT_IDLE_TIMEOUT;

    /*
     * We tell the peer we can handle at most this many bytes in a datagram payload.
     * However, currently the QUIC_DEMUX in the QRX uses the BIO's MTU as upper bound
     * on an incoming datagram size.
     */
    port->max_udp_payload_size = QUIC_MIN_INITIAL_DGRAM_LEN;
    port->init_max_data = DEFAULT_INIT_CONN_RXFC_WND;
    port->init_max_stream_data_bidi_local = DEFAULT_INIT_STREAM_RXFC_WND;
    port->init_max_stream_data_bidi_remote = DEFAULT_INIT_STREAM_RXFC_WND;
    port->init_max_stream_data_uni = DEFAULT_INIT_STREAM_RXFC_WND;
    port->init_max_streams_bidi = DEFAULT_INIT_CONN_MAX_STREAMS;
    port->init_max_streams_uni = DEFAULT_INIT_CONN_MAX_STREAMS;
    port->ack_delay_exponent = QUIC_DEFAULT_ACK_DELAY_EXP;

    /*
     * Our maximum ACK delay on the TX side. This is up to us to choose. Note that
     * this could differ from QUIC_DEFAULT_MAX_DELAY in future as that is a protocol
     * value which determines the value of the maximum ACK delay if the
     * max_ack_delay transport parameter is not set.
     */
    port->max_ack_delay = QUIC_DEFAULT_MAX_ACK_DELAY;
    port->disable_active_migration = 1;
    port->active_conn_id_limit = QUIC_MIN_ACTIVE_CONN_ID_LIMIT;

    port->state = QUIC_PORT_STATE_RUNNING;

    ossl_list_port_insert_tail(&port->engine->port_list, port);
    port->on_engine_list = 1;
    port->bio_changed = 1;

    /* Generate random key for token encryption */
    if ((port->token_ctx = EVP_CIPHER_CTX_new()) == NULL
        || (cipher = EVP_CIPHER_fetch(port->engine->libctx,
                "AES-256-GCM", NULL))
            == NULL
        || !EVP_EncryptInit_ex(port->token_ctx, cipher, NULL, NULL, NULL)
        || (key_len = EVP_CIPHER_CTX_get_key_length(port->token_ctx)) <= 0
        || (token_key = OPENSSL_malloc(key_len)) == NULL
        || !RAND_priv_bytes_ex(port->engine->libctx, token_key, key_len, 0)
        || !EVP_EncryptInit_ex(port->token_ctx, NULL, NULL, token_key, NULL))
        goto err;

    ret = 1;
err:
    EVP_CIPHER_free(cipher);
    if (key_len >= 1)
        OPENSSL_clear_free(token_key, key_len);
    else
        OPENSSL_free(token_key);
    if (!ret)
        port_cleanup(port);
    return ret;
}

static void port_cleanup(QUIC_PORT *port)
{
    assert(ossl_list_ch_num(&port->channel_list) == 0);

    ossl_quic_demux_free(port->demux);
    port->demux = NULL;

    ossl_quic_srtm_free(port->srtm);
    port->srtm = NULL;

    ossl_quic_lcidm_free(port->lcidm);
    port->lcidm = NULL;

    OSSL_ERR_STATE_free(port->err_state);
    port->err_state = NULL;

    if (port->on_engine_list) {
        ossl_list_port_remove(&port->engine->port_list, port);
        port->on_engine_list = 0;
    }

    EVP_CIPHER_CTX_free(port->token_ctx);
    port->token_ctx = NULL;
}

static void port_transition_failed(QUIC_PORT *port)
{
    if (port->state == QUIC_PORT_STATE_FAILED)
        return;

    port->state = QUIC_PORT_STATE_FAILED;
}

int ossl_quic_port_is_running(const QUIC_PORT *port)
{
    return port->state == QUIC_PORT_STATE_RUNNING;
}

QUIC_ENGINE *ossl_quic_port_get0_engine(QUIC_PORT *port)
{
    return port->engine;
}

QUIC_REACTOR *ossl_quic_port_get0_reactor(QUIC_PORT *port)
{
    return ossl_quic_engine_get0_reactor(port->engine);
}

QUIC_DEMUX *ossl_quic_port_get0_demux(QUIC_PORT *port)
{
    return port->demux;
}

CRYPTO_MUTEX *ossl_quic_port_get0_mutex(QUIC_PORT *port)
{
    return ossl_quic_engine_get0_mutex(port->engine);
}

OSSL_TIME ossl_quic_port_get_time(QUIC_PORT *port)
{
    return ossl_quic_engine_get_time(port->engine);
}

static OSSL_TIME get_time(void *port)
{
    return ossl_quic_port_get_time((QUIC_PORT *)port);
}

int ossl_quic_port_get_rx_short_dcid_len(const QUIC_PORT *port)
{
    return port->rx_short_dcid_len;
}

int ossl_quic_port_get_tx_init_dcid_len(const QUIC_PORT *port)
{
    return port->tx_init_dcid_len;
}

size_t ossl_quic_port_get_num_incoming_channels(const QUIC_PORT *port)
{
    return ossl_list_incoming_ch_num(&port->incoming_channel_list);
}

/*
 * QUIC Port: Network BIO Configuration
 * ====================================
 */

/* Determines whether we can support a given poll descriptor. */
static int validate_poll_descriptor(const BIO_POLL_DESCRIPTOR *d)
{
    if (d->type == BIO_POLL_DESCRIPTOR_TYPE_SOCK_FD && d->value.fd < 0) {
        ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_INVALID_ARGUMENT);
        return 0;
    }

    return 1;
}

BIO *ossl_quic_port_get_net_rbio(QUIC_PORT *port)
{
    return port->net_rbio;
}

BIO *ossl_quic_port_get_net_wbio(QUIC_PORT *port)
{
    return port->net_wbio;
}

static int port_update_poll_desc(QUIC_PORT *port, BIO *net_bio, int for_write)
{
    BIO_POLL_DESCRIPTOR d = { 0 };

    if (net_bio == NULL
        || (!for_write && !BIO_get_rpoll_descriptor(net_bio, &d))
        || (for_write && !BIO_get_wpoll_descriptor(net_bio, &d)))
        /* Non-pollable BIO */
        d.type = BIO_POLL_DESCRIPTOR_TYPE_NONE;

    if (!validate_poll_descriptor(&d))
        return 0;

    /*
     * TODO(QUIC MULTIPORT): We currently only support one port per
     * engine/domain. This is necessitated because QUIC_REACTOR only supports a
     * single pollable currently. In the future, once complete polling
     * infrastructure has been implemented, this limitation can be removed.
     *
     * For now, just update the descriptor on the engine's reactor as we are
     * guaranteed to be the only port under it.
     */
    if (for_write)
        ossl_quic_reactor_set_poll_w(&port->engine->rtor, &d);
    else
        ossl_quic_reactor_set_poll_r(&port->engine->rtor, &d);

    return 1;
}

int ossl_quic_port_update_poll_descriptors(QUIC_PORT *port, int force)
{
    int ok = 1;

    if (!force && !port->bio_changed)
        return 0;

    if (!port_update_poll_desc(port, port->net_rbio, /*for_write=*/0))
        ok = 0;

    if (!port_update_poll_desc(port, port->net_wbio, /*for_write=*/1))
        ok = 0;

    port->bio_changed = 0;
    return ok;
}

/*
 * We need to determine our addressing mode. There are basically two ways we can
 * use L4 addresses:
 *
 *   - Addressed mode, in which our BIO_sendmmsg calls have destination
 *     addresses attached to them which we expect the underlying network BIO to
 *     handle;
 *
 *   - Unaddressed mode, in which the BIO provided to us on the network side
 *     neither provides us with L4 addresses nor is capable of honouring ones we
 *     provide. We don't know where the QUIC traffic we send ends up exactly and
 *     trust the application to know what it is doing.
 *
 * Addressed mode is preferred because it enables support for connection
 * migration, multipath, etc. in the future. Addressed mode is automatically
 * enabled if we are using e.g. BIO_s_datagram, with or without BIO_s_connect.
 *
 * If we are passed a BIO_s_dgram_pair (or some custom BIO) we may have to use
 * unaddressed mode unless that BIO supports capability flags indicating it can
 * provide and honour L4 addresses.
 *
 * Our strategy for determining address mode is simple: we probe the underlying
 * network BIOs for their capabilities. If the network BIOs support what we
 * need, we use addressed mode. Otherwise, we use unaddressed mode.
 *
 * If addressed mode is chosen, we require an initial peer address to be set. If
 * this is not set, we fail. If unaddressed mode is used, we do not require
 * this, as such an address is superfluous, though it can be set if desired.
 */
static void port_update_addressing_mode(QUIC_PORT *port)
{
    long rcaps = 0, wcaps = 0;

    if (port->net_rbio != NULL)
        rcaps = BIO_dgram_get_effective_caps(port->net_rbio);

    if (port->net_wbio != NULL)
        wcaps = BIO_dgram_get_effective_caps(port->net_wbio);

    port->addressed_mode_r = ((rcaps & BIO_DGRAM_CAP_PROVIDES_SRC_ADDR) != 0);
    port->addressed_mode_w = ((wcaps & BIO_DGRAM_CAP_HANDLES_DST_ADDR) != 0);
    port->bio_changed = 1;
}

int ossl_quic_port_is_addressed_r(const QUIC_PORT *port)
{
    return port->addressed_mode_r;
}

int ossl_quic_port_is_addressed_w(const QUIC_PORT *port)
{
    return port->addressed_mode_w;
}

int ossl_quic_port_is_addressed(const QUIC_PORT *port)
{
    return ossl_quic_port_is_addressed_r(port) && ossl_quic_port_is_addressed_w(port);
}

/*
 * QUIC_PORT does not ref any BIO it is provided with, nor is any ref
 * transferred to it. The caller (e.g., QUIC_CONNECTION) is responsible for
 * ensuring the BIO lasts until the channel is freed or the BIO is switched out
 * for another BIO by a subsequent successful call to this function.
 */
int ossl_quic_port_set_net_rbio(QUIC_PORT *port, BIO *net_rbio)
{
    if (port->net_rbio == net_rbio)
        return 1;

    if (!port_update_poll_desc(port, net_rbio, /*for_write=*/0))
        return 0;

    ossl_quic_demux_set_bio(port->demux, net_rbio);
    port->net_rbio = net_rbio;
    port_update_addressing_mode(port);
    return 1;
}

int ossl_quic_port_set_net_wbio(QUIC_PORT *port, BIO *net_wbio)
{
    QUIC_CHANNEL *ch;

    if (port->net_wbio == net_wbio)
        return 1;

    if (!port_update_poll_desc(port, net_wbio, /*for_write=*/1))
        return 0;

    OSSL_LIST_FOREACH (ch, ch, &port->channel_list)
        ossl_qtx_set_bio(ch->qtx, net_wbio);

    port->net_wbio = net_wbio;
    port_update_addressing_mode(port);
    return 1;
}

SSL_CTX *ossl_quic_port_get_channel_ctx(QUIC_PORT *port)
{
    return port->channel_ctx;
}

/*
 * QUIC Port: Channel Lifecycle
 * ============================
 */

/**
 * @brief Create the inner TLS handshake layer for a QUIC channel.
 *
 * After a successful return:
 *   - @c *user_sslp holds the user_ssl. The caller is expected to also
 *     stash the returned @c tls in @c ch->tls so the channel can find its
 *     inner TLS.
 *   - @c qc->tls and @c qc->ch are both set, so a single
 *     @c SSL_free(user_ssl) cascades through @c ossl_quic_free() ->
 *     @c qc_cleanup() to free the inner TLS and the channel together.
 *
 * Failure semantics (returns @c NULL)
 * -----------------------------------
 *   - If the callback never returned a user_ssl (callback missing or it
 *     returned @c NULL), nothing was allocated; @c *user_sslp is left
 *     untouched and stays whatever the caller initialised it to.
 *   - Otherwise, this function frees what it allocated and resets
 *     @c *user_sslp to @c NULL before returning. The caller retains ownership
 *     of @c ch on failure.
 *
 * @param port       Port supplying the channel @c SSL_CTX and the
 *                   @c get_conn_user_ssl callback.
 * @param ch         Channel that the new handshake layer is being attached
 *                   to. Borrowed; on success the channel is shared with
 *                   user_ssl via @c qc->ch.
 * @param user_sslp  In/out parameter. On success, set to the user_ssl
 *                   so the caller can later free the whole graph with
 *                   @c SSL_free(*user_sslp). On failure, set to @c NULL
 *                   if the function actually obtained and freed a
 *                   user_ssl; otherwise left untouched.
 *
 * @return The inner TLS @c SSL_CONNECTION (also stored as @c qc->tls)
 *         on success, or @c NULL on failure.
 */
static SSL *port_new_handshake_layer(QUIC_PORT *port, QUIC_CHANNEL *ch, SSL **user_sslp)
{
    SSL *tls = NULL;
    SSL_CONNECTION *tls_conn = NULL;
    SSL *user_ssl = NULL;
    QUIC_CONNECTION *qc = NULL;
    QUIC_LISTENER *ql = NULL;

    /*
     * It only makes sense to call this function if we know how to associate
     * the handshake layer we are about to create with some user_ssl object.
     */
    if (!ossl_assert(port->get_conn_user_ssl != NULL))
        return NULL;
    user_ssl = port->get_conn_user_ssl(ch, port->ql);
    if (user_ssl == NULL)
        return NULL;
    qc = (QUIC_CONNECTION *)user_ssl;
    ql = port->ql;

    /*
     * We expect the user_ssl to be newly created so it must not have an
     * existing qc->tls
     */
    if (!ossl_assert(qc->tls == NULL))
        goto err;

    tls = ossl_ssl_connection_new_int(port->channel_ctx, user_ssl, TLS_method());
    if (tls == NULL || (tls_conn = SSL_CONNECTION_FROM_SSL(tls)) == NULL)
        goto err;

    if (ql != NULL && ql->obj.ssl.ctx->new_pending_conn_cb != NULL)
        if (!ql->obj.ssl.ctx->new_pending_conn_cb(ql->obj.ssl.ctx, user_ssl,
                ql->obj.ssl.ctx->new_pending_conn_arg))
            goto err;
    qc->tls = tls;
    qc->ch = ch;
    *user_sslp = user_ssl;

    /* Override the user_ssl of the inner connection. */
    tls_conn->s3.flags |= TLS1_FLAGS_QUIC | TLS1_FLAGS_QUIC_INTERNAL;

    /* Restrict options derived from the SSL_CTX. */
    tls_conn->options &= OSSL_QUIC_PERMITTED_OPTIONS_CONN;
    tls_conn->pha_enabled = 0;

    return qc->tls;

err:
    SSL_free(tls);
    SSL_free(user_ssl);
    *user_sslp = NULL;

    return NULL;
}

static QUIC_CHANNEL *port_make_channel(QUIC_PORT *port, SSL *tls, OSSL_QRX *qrx,
    int is_server, int is_tserver)
{
    QUIC_CHANNEL_ARGS args = { 0 };
    QUIC_CHANNEL *ch;
    SSL *user_ssl = NULL;
#ifndef OPENSSL_NO_QLOG
    SSL_CTX *qlog_ctx;
#endif

    args.port = port;
    args.is_server = is_server;
    args.lcidm = port->lcidm;
    args.srtm = port->srtm;
    args.qrx = qrx;
    args.is_tserver_ch = is_tserver;

    args.max_idle_timeout = port->max_idle_timeout;
    args.max_udp_payload_size = port->max_udp_payload_size;
    args.init_max_data = port->init_max_data;
    args.init_max_stream_data_bidi_local = port->init_max_stream_data_bidi_local;
    args.init_max_stream_data_bidi_remote = port->init_max_stream_data_bidi_remote;
    args.init_max_stream_data_uni = port->init_max_stream_data_uni;
    args.init_max_streams_bidi = port->init_max_streams_bidi;
    args.init_max_streams_uni = port->init_max_streams_uni;
    args.ack_delay_exponent = port->ack_delay_exponent;
    args.max_ack_delay = port->max_ack_delay;
    args.disable_active_migration = port->disable_active_migration;
    args.active_conn_id_limit = port->active_conn_id_limit;

    /*
     * Creating a new channel is made a bit tricky here as there is a
     * bit of a circular dependency.  Initializing a channel requires that
     * the ch->tls and optionally the qlog_title be configured prior to
     * initialization, but we need the channel at least partially configured
     * to create the new handshake layer, so we have to do this in a few steps.
     */

    /*
     * start by allocation and provisioning as much of the channel as we can
     */
    ch = ossl_quic_channel_alloc(&args);
    if (ch == NULL) {
        ossl_qrx_free(qrx);
        return NULL;
    }

    if (tls != NULL) {
        ch->tls = tls;
    } else {
        if (ossl_quic_port_test_and_set_peeloff(port, PEELOFF_ACCEPT)) {
            /*
             * We're using the normal SSL_accept_connection_path
             */
            tls = port_new_handshake_layer(port, ch, &user_ssl);
            if (tls == NULL)
                goto err;
            ch->tls = tls;
        } else {
            /*
             * We're deferring user ssl creation until SSL_listen_ex is called
             */
            ch->tls = NULL;
        }
    }
#ifndef OPENSSL_NO_QLOG
    /*
     * A deferred SSL_listen_ex() channel does not have its TLS object yet, but
     * it still uses the port's channel context. Configure its qlog title before
     * the first packet can cause the qlog object to be instantiated.
     */
    ch->use_qlog = 1;
    qlog_ctx = ch->tls != NULL ? ch->tls->ctx : port->channel_ctx;
    if (qlog_ctx != NULL && qlog_ctx->qlog_title != NULL) {
        OPENSSL_free(ch->qlog_title);
        if ((ch->qlog_title = OPENSSL_strdup(qlog_ctx->qlog_title)) == NULL)
            goto err;
    }
#endif

    /*
     * And finally init the channel struct
     */
    if (!ossl_quic_channel_init(ch))
        goto err;

    ossl_qtx_set_bio(ch->qtx, port->net_wbio);
    return ch;

err:
    if (user_ssl != NULL)
        ((QUIC_CONNECTION *)user_ssl)->ch = NULL;

    ossl_quic_channel_free(ch);
    SSL_free(user_ssl);

    return NULL;
}

QUIC_CHANNEL *ossl_quic_port_create_outgoing(QUIC_PORT *port, SSL *tls)
{
    return port_make_channel(port, tls, NULL, /* is_server= */ 0,
        /* is_tserver= */ 0);
}

QUIC_CHANNEL *ossl_quic_port_create_incoming(QUIC_PORT *port, SSL *tls)
{
    QUIC_CHANNEL *ch;

    assert(port->tserver_ch == NULL);

    /*
     * pass -1 for qrx to indicate port will create qrx
     * later in port_default_packet_handler() when calling port_bind_channel().
     */
    ch = port_make_channel(port, tls, NULL, /* is_server= */ 1,
        /* is_tserver_ch */ 1);
    port->tserver_ch = ch;
    port->allow_incoming = 1;
    return ch;
}

QUIC_CHANNEL *ossl_quic_port_pop_incoming(QUIC_PORT *port)
{
    QUIC_CHANNEL *ch;

    ch = ossl_list_incoming_ch_head(&port->incoming_channel_list);
    if (ch == NULL)
        return NULL;

    ossl_list_incoming_ch_remove(&port->incoming_channel_list, ch);
    return ch;
}

QUIC_CHANNEL *ossl_quic_port_peek_incoming(QUIC_PORT *port)
{
    return ossl_list_incoming_ch_head(&port->incoming_channel_list);
}

int ossl_quic_port_have_incoming(QUIC_PORT *port)
{
    return ossl_quic_port_peek_incoming(port) != NULL;
}

void ossl_quic_port_drop_incoming(QUIC_PORT *port)
{
    QUIC_CHANNEL *ch;
    SSL *tls;
    SSL *user_ssl;
    SSL_CONNECTION *sc;

    for (;;) {
        ch = ossl_quic_port_pop_incoming(port);
        if (ch == NULL)
            break;

        tls = ossl_quic_channel_get0_tls(ch);
        if (tls == NULL) {
            /* Unpeeled SSL_listen_ex() channels have no user SSL. */
            ossl_quic_channel_free(ch);
            continue;
        }

        /*
         * The user ssl may or may not have been created via the
         * get_conn_user_ssl callback in the QUIC stack.  The
         * differentiation being if the user_ssl pointer and tls pointer
         * are different.  If they are, then the user_ssl needs freeing here
         * which sends us through ossl_quic_free, which then drops the actual
         * ch->tls ref and frees the channel
         */
        sc = SSL_CONNECTION_FROM_SSL(tls);
        if (sc == NULL)
            break;

        user_ssl = SSL_CONNECTION_GET_USER_SSL(sc);
        if (user_ssl == tls) {
            ossl_quic_channel_free(ch);
            SSL_free(tls);
        } else {
            SSL_free(user_ssl);
        }
    }
}

void ossl_quic_port_set_allow_incoming(QUIC_PORT *port, int allow_incoming)
{
    port->allow_incoming = allow_incoming;
}

int ossl_quic_port_test_and_set_peeloff(QUIC_PORT *port, int using_peeloff)
{

    /*
     * Peeloff state must be one of PEELOFF_LISTEN or PEELOFF_ACCEPT
     */
    if (using_peeloff != PEELOFF_LISTEN && using_peeloff != PEELOFF_ACCEPT)
        return 0;

    /*
     * We can only set the peeloff state if its not already been set
     * or if we're setting it to the already set value
     * i.e. this is a trapdoor, once we set using_peeloff to LISTEN or ACCEPT
     * Then the only thing we can set that port too in the future is the same value.
     */
    if (port->peeloff_mode != using_peeloff && port->peeloff_mode != PEELOFF_UNSET)
        return 0;
    port->peeloff_mode = using_peeloff;
    return 1;
}

/*
 * QUIC Port: Ticker-Mutator
 * =========================
 */

/*
 * Tick function for this port. This does everything related to network I/O for
 * this port's network BIOs, and services child channels.
 */
void ossl_quic_port_subtick(QUIC_PORT *port, QUIC_TICK_RESULT *res,
    uint32_t flags)
{
    QUIC_CHANNEL *ch;

    res->net_read_desired = ossl_quic_port_is_running(port);
    res->net_write_desired = 0;
    res->notify_other_threads = 0;
    res->tick_deadline = ossl_time_infinite();

    if (!port->engine->inhibit_tick) {
        /* Handle any incoming data from network. */
        if (ossl_quic_port_is_running(port))
            port_rx_pre(port);

        /* Iterate through all channels and service them. */
        OSSL_LIST_FOREACH (ch, ch, &port->channel_list) {
            QUIC_TICK_RESULT subr = { 0 };

            ossl_quic_channel_subtick(ch, &subr, flags);
            ossl_quic_tick_result_merge_into(res, &subr);
        }
    }
}

/* Process incoming datagrams, if any. */
static void port_rx_pre(QUIC_PORT *port)
{
    int ret;

    /*
     * Originally, this check (don't RX before we have sent anything if we are
     * not a server, because there can't be anything) was just intended as a
     * minor optimisation. However, it is actually required on Windows, and
     * removing this check will cause Windows to break.
     *
     * The reason is that under Win32, recvfrom() does not work on a UDP socket
     * which has not had bind() called (???). However, calling sendto() will
     * automatically bind an unbound UDP socket. Therefore, if we call a Winsock
     * recv-type function before calling a Winsock send-type function, that call
     * will fail with WSAEINVAL, which we will regard as a permanent network
     * error.
     *
     * Therefore, this check is essential as we do not require our API users to
     * bind a socket first when using the API in client mode.
     */
    if (!port->allow_incoming && !port->have_sent_any_pkt)
        return;

    /*
     * Get DEMUX to BIO_recvmmsg from the network and queue incoming datagrams
     * to the appropriate QRX instances.
     */
    ret = ossl_quic_demux_pump(port->demux);
    if (ret == QUIC_DEMUX_PUMP_RES_PERMANENT_FAIL)
        /*
         * We don't care about transient failure, but permanent failure means we
         * should tear down the port. All connections skip straight to the
         * Terminated state as there is no point trying to send CONNECTION_CLOSE
         * frames if the network BIO is not operating correctly.
         */
        ossl_quic_port_raise_net_error(port, NULL);
}

/*
 * Handles an incoming connection request and potentially decides to make a
 * connection from it. If a new connection is made, the new channel is written
 * to *new_ch.
 */
static void port_bind_channel(QUIC_PORT *port, const BIO_ADDR *peer,
    const QUIC_CONN_ID *dcid,
    const QUIC_CONN_ID *odcid, OSSL_QRX *qrx,
    QUIC_CHANNEL **new_ch)
{
    QUIC_CHANNEL *ch;

    /*
     * If we're running with a simulated tserver, it will already have
     * a dummy channel created, use that instead
     */
    if (port->tserver_ch != NULL) {
        ch = port->tserver_ch;
        port->tserver_ch = NULL;
        if (peer != NULL && BIO_ADDR_family(peer) != AF_UNSPEC)
            ossl_quic_channel_set_peer_addr(ch, peer);

        ossl_quic_channel_bind_qrx(ch, qrx);
        ossl_qrx_set_msg_callback(ch->qrx, ch->msg_callback,
            ch->msg_callback_ssl);
        ossl_qrx_set_msg_callback_arg(ch->qrx, ch->msg_callback_arg);
    } else {
        ch = port_make_channel(port, NULL, qrx, /* is_server= */ 1,
            /* is_tserver */ 0);
    }

    if (ch == NULL)
        return;

    /*
     * If we didn't provide a qrx here that means we need to set our initial
     * secret here, since we just created a qrx
     * Normally its not needed, as the initial secret gets added when we send
     * our first server hello, but if we get a huge client hello, crossing
     * multiple datagrams, we don't have a chance to do that, and datagrams
     * after the first won't get decoded properly, for lack of secrets
     */
    if (qrx == NULL)
        if (!ossl_quic_provide_initial_secret(ch->port->engine->libctx,
                ch->port->engine->propq,
                dcid, /* is_server */ 1,
                ch->qrx, NULL)) {
            ossl_quic_channel_free(ch);
            return;
        }

    if (odcid->id_len != 0) {
        /*
         * If we have an odcid, then we went through server address validation
         * and as such, this channel need not conform to the 3x validation cap
         * See RFC 9000 s. 8.1
         */
        ossl_quic_tx_packetiser_set_validated(ch->txp);
        if (!ossl_quic_bind_channel(ch, peer, dcid, odcid)) {
            ossl_quic_channel_free(ch);
            return;
        }
    } else {
        /*
         * No odcid means we didn't do server validation, so we need to
         * generate a cid via ossl_quic_channel_on_new_conn
         */
        if (!ossl_quic_channel_on_new_conn(ch, peer, dcid)) {
            ossl_quic_channel_free(ch);
            return;
        }
    }

    ossl_list_incoming_ch_insert_tail(&port->incoming_channel_list, ch);
    *new_ch = ch;
}

static int port_try_handle_stateless_reset(QUIC_PORT *port, const QUIC_URXE *e)
{
    size_t i;
    const unsigned char *data = ossl_quic_urxe_data(e);
    void *opaque = NULL;

    /*
     * Perform some fast and cheap checks for a packet not being a stateless
     * reset token.  RFC 9000 s. 10.3 specifies this layout for stateless
     * reset packets:
     *
     *  Stateless Reset {
     *      Fixed Bits (2) = 1,
     *      Unpredictable Bits (38..),
     *      Stateless Reset Token (128),
     *  }
     *
     * It also specifies:
     *      However, endpoints MUST treat any packet ending in a valid
     *      stateless reset token as a Stateless Reset, as other QUIC
     *      versions might allow the use of a long header.
     *
     * We can rapidly check for the minimum length and that the first pair
     * of bits in the first byte are 01 or 11.
     *
     * The function returns 1 if it is a stateless reset packet, 0 if it isn't
     * and -1 if an error was encountered.
     */
    if (e->data_len < QUIC_STATELESS_RESET_TOKEN_LEN + 5
        || (0100 & *data) != 0100)
        return 0;

    for (i = 0;; ++i) {
        if (!ossl_quic_srtm_lookup(port->srtm,
                (const QUIC_STATELESS_RESET_TOKEN *)(data + e->data_len
                    - sizeof(QUIC_STATELESS_RESET_TOKEN)),
                i, &opaque, NULL))
            break;

        assert(opaque != NULL);
        ossl_quic_channel_on_stateless_reset((QUIC_CHANNEL *)opaque);
    }

    return i > 0;
}

static void cleanup_validation_token(QUIC_VALIDATION_TOKEN *token)
{
    OPENSSL_free(token->remote_addr);
}

/**
 * @brief Generates a validation token for a RETRY/NEW_TOKEN packet.
 *
 *
 * @param peer  Address of the client peer receiving the packet.
 * @param odcid DCID of the connection attempt.
 * @param rscid Retry source connection ID of the connection attempt.
 * @param token Address of token to fill data.
 *
 * @return 1 if validation token is filled successfully, 0 otherwise.
 */
static int generate_token(BIO_ADDR *peer, QUIC_CONN_ID odcid,
    QUIC_CONN_ID rscid, QUIC_VALIDATION_TOKEN *token,
    int is_retry)
{
    token->is_retry = is_retry;
    token->timestamp = ossl_time_now();
    token->remote_addr = NULL;
    token->odcid = odcid;
    token->rscid = rscid;

    if (!BIO_ADDR_rawaddress(peer, NULL, &token->remote_addr_len)
        || token->remote_addr_len == 0
        || (token->remote_addr = OPENSSL_malloc(token->remote_addr_len)) == NULL
        || !BIO_ADDR_rawaddress(peer, token->remote_addr,
            &token->remote_addr_len)) {
        cleanup_validation_token(token);
        return 0;
    }

    return 1;
}

/**
 * @brief Marshals a validation token into a new buffer.
 *
 * |buffer| should already be allocated and at least MARSHALLED_TOKEN_MAX_LEN
 * bytes long. Stores the length of data stored in |buffer| in |buffer_len|.
 *
 * @param token      Validation token.
 * @param buffer     Address to store the marshalled token.
 * @param buffer_len Size of data stored in |buffer|.
 */
static int marshal_validation_token(QUIC_VALIDATION_TOKEN *token,
    unsigned char *buffer, size_t *buffer_len)
{
    WPACKET wpkt = { 0 };
    BUF_MEM *buf_mem = BUF_MEM_new();

    if (buffer == NULL || buf_mem == NULL
        || (token->is_retry != 0 && token->is_retry != 1)) {
        BUF_MEM_free(buf_mem);
        return 0;
    }

    if (!WPACKET_init(&wpkt, buf_mem)
        || !WPACKET_put_bytes_u8(&wpkt, token->is_retry)
        || !WPACKET_memcpy(&wpkt, &token->timestamp,
            sizeof(token->timestamp))
        || (token->is_retry
            && (!WPACKET_sub_memcpy_u8(&wpkt, &token->odcid.id,
                    token->odcid.id_len)
                || !WPACKET_sub_memcpy_u8(&wpkt, &token->rscid.id,
                    token->rscid.id_len)))
        || !WPACKET_sub_memcpy_u8(&wpkt, token->remote_addr, token->remote_addr_len)
        || !WPACKET_get_total_written(&wpkt, buffer_len)
        || *buffer_len > MARSHALLED_TOKEN_MAX_LEN
        || !WPACKET_finish(&wpkt)) {
        WPACKET_cleanup(&wpkt);
        BUF_MEM_free(buf_mem);
        return 0;
    }

    memcpy(buffer, buf_mem->data, *buffer_len);
    BUF_MEM_free(buf_mem);
    return 1;
}

/**
 * @brief Encrypts a validation token using AES-256-GCM
 *
 * @param port       The QUIC port containing the encryption key
 * @param plaintext  The data to encrypt
 * @param pt_len     Length of the plaintext
 * @param ciphertext Buffer to receive encrypted data. If NULL, ct_len will be
 *                   set to the required buffer size and function returns
 *                   immediately.
 * @param ct_len     Pointer to size_t that will receive the ciphertext length.
 *                   This also includes bytes for QUIC_RETRY_INTEGRITY_TAG_LEN.
 *
 * @return 1 on success, 0 on failure
 *
 * The ciphertext format is:
 * [EVP_GCM_IV_LEN bytes IV][encrypted data][EVP_GCM_TAG_LEN bytes tag]
 */
static int encrypt_validation_token(const QUIC_PORT *port,
    const unsigned char *plaintext,
    size_t pt_len,
    unsigned char *ciphertext,
    size_t *ct_len)
{
    int iv_len, len, ret = 0;
    int tag_len;
    unsigned char *iv = ciphertext, *data, *tag;

    if ((tag_len = EVP_CIPHER_CTX_get_tag_length(port->token_ctx)) <= 0
        || (iv_len = EVP_CIPHER_CTX_get_iv_length(port->token_ctx)) <= 0)
        goto err;

    *ct_len = iv_len + pt_len + tag_len + QUIC_RETRY_INTEGRITY_TAG_LEN;
    if (ciphertext == NULL) {
        ret = 1;
        goto err;
    }

    data = ciphertext + iv_len;
    tag = data + pt_len;

    if (!RAND_bytes_ex(port->engine->libctx, ciphertext, iv_len, 0)
        || !EVP_EncryptInit_ex(port->token_ctx, NULL, NULL, NULL, iv)
        || !EVP_EncryptUpdate(port->token_ctx, data, &len, plaintext, (int)pt_len)
        || !EVP_EncryptFinal_ex(port->token_ctx, data + pt_len, &len)
        || !EVP_CIPHER_CTX_ctrl(port->token_ctx, EVP_CTRL_GCM_GET_TAG, tag_len, tag))
        goto err;

    ret = 1;
err:
    return ret;
}

/**
 * @brief Decrypts a validation token using AES-256-GCM
 *
 * @param port       The QUIC port containing the decryption key
 * @param ciphertext The encrypted data (including IV and tag)
 * @param ct_len     Length of the ciphertext
 * @param plaintext  Buffer to receive decrypted data. If NULL, pt_len will be
 *                   set to the required buffer size.
 * @param pt_len     Pointer to size_t that will receive the plaintext length
 *
 * @return 1 on success, 0 on failure
 *
 * Expected ciphertext format:
 * [EVP_GCM_IV_LEN bytes IV][encrypted data][EVP_GCM_TAG_LEN bytes tag]
 */
static int decrypt_validation_token(const QUIC_PORT *port,
    const unsigned char *ciphertext,
    size_t ct_len,
    unsigned char *plaintext,
    size_t *pt_len)
{
    int iv_len, len = 0, ret = 0;
    int tag_len;
    const unsigned char *iv = ciphertext, *data, *tag;

    if ((tag_len = EVP_CIPHER_CTX_get_tag_length(port->token_ctx)) <= 0
        || (iv_len = EVP_CIPHER_CTX_get_iv_length(port->token_ctx)) <= 0)
        goto err;

    /* Prevent decryption of a buffer that is not within reasonable bounds */
    if (ct_len < (size_t)iv_len + tag_len || ct_len > ENCRYPTED_TOKEN_MAX_LEN)
        goto err;

    *pt_len = ct_len - iv_len - tag_len;
    if (plaintext == NULL) {
        ret = 1;
        goto err;
    }

    data = ciphertext + iv_len;
    tag = ciphertext + ct_len - tag_len;

    if (!EVP_DecryptInit_ex(port->token_ctx, NULL, NULL, NULL, iv)
        || !EVP_DecryptUpdate(port->token_ctx, plaintext, &len, data,
            (int)(ct_len - iv_len - tag_len))
        || !EVP_CIPHER_CTX_ctrl(port->token_ctx, EVP_CTRL_GCM_SET_TAG, tag_len,
            (void *)tag)
        || !EVP_DecryptFinal_ex(port->token_ctx, plaintext + len, &len))
        goto err;

    ret = 1;

err:
    return ret;
}

/**
 * @brief Parses contents of a buffer into a validation token.
 *
 * VALIDATION_TOKEN should already be initialized. Does some basic sanity checks.
 *
 * @param token   Validation token to fill data in.
 * @param buf     Buffer of previously marshaled validation token.
 * @param buf_len Length of |buf|.
 */
static int parse_validation_token(QUIC_VALIDATION_TOKEN *token,
    const unsigned char *buf, size_t buf_len)
{
    PACKET pkt, subpkt;

    if (buf == NULL || token == NULL)
        return 0;

    token->remote_addr = NULL;

    if (!PACKET_buf_init(&pkt, buf, buf_len)
        || !PACKET_copy_bytes(&pkt, &token->is_retry, sizeof(token->is_retry))
        || !(token->is_retry == 0 || token->is_retry == 1)
        || !PACKET_copy_bytes(&pkt, (unsigned char *)&token->timestamp,
            sizeof(token->timestamp))
        || (token->is_retry
            && (!PACKET_get_length_prefixed_1(&pkt, &subpkt)
                || (token->odcid.id_len = (unsigned char)PACKET_remaining(&subpkt))
                    > QUIC_MAX_CONN_ID_LEN
                || !PACKET_copy_bytes(&subpkt,
                    (unsigned char *)&token->odcid.id,
                    token->odcid.id_len)
                || !PACKET_get_length_prefixed_1(&pkt, &subpkt)
                || (token->rscid.id_len = (unsigned char)PACKET_remaining(&subpkt))
                    > QUIC_MAX_CONN_ID_LEN
                || !PACKET_copy_bytes(&subpkt, (unsigned char *)&token->rscid.id,
                    token->rscid.id_len)))
        || !PACKET_get_length_prefixed_1(&pkt, &subpkt)
        || (token->remote_addr_len = PACKET_remaining(&subpkt)) == 0
        || (token->remote_addr = OPENSSL_malloc(token->remote_addr_len)) == NULL
        || !PACKET_copy_bytes(&subpkt, token->remote_addr, token->remote_addr_len)
        || PACKET_remaining(&pkt) != 0) {
        cleanup_validation_token(token);
        return 0;
    }

    return 1;
}

/**
 * @brief Sends a QUIC Retry packet to a client.
 *
 * This function constructs and sends a Retry packet to the specified client
 * using the provided connection header information. The Retry packet
 * includes a generated validation token and a new connection ID, following
 * the QUIC protocol specifications for connection establishment.
 *
 * @param port        Pointer to the QUIC port from which to send the packet.
 * @param peer        Address of the client peer receiving the packet.
 * @param client_hdr  Header of the client's initial packet, containing
 *                    connection IDs and other relevant information.
 *
 * This function performs the following steps:
 * - Generates a validation token for the client.
 * - Sets the destination and source connection IDs.
 * - Calculates the integrity tag and sets the token length.
 * - Encodes and sends the packet via the BIO network interface.
 *
 * Error handling is included for failures in CID generation, encoding, and
 * network transmiss
 */
static void port_send_retry(QUIC_PORT *port,
    BIO_ADDR *peer,
    QUIC_PKT_HDR *client_hdr)
{
    BIO_MSG msg[1];
    /*
     * Buffer is used for both marshalling the token as well as for the RETRY
     * packet. The size of buffer should not be less than
     * MARSHALLED_TOKEN_MAX_LEN.
     */
    unsigned char buffer[512];
    unsigned char ct_buf[ENCRYPTED_TOKEN_MAX_LEN];
    WPACKET wpkt = { 0 };
    size_t written, token_buf_len, ct_len;
    QUIC_PKT_HDR hdr = { 0 };
    QUIC_VALIDATION_TOKEN token = { 0 };
    int ok;

    if (!ossl_assert(sizeof(buffer) >= MARSHALLED_TOKEN_MAX_LEN))
        return;
    /*
     * 17.2.5.1 Sending a Retry packet
     *   dst ConnId is src ConnId we got from client
     *   src ConnId comes from local conn ID manager
     */
    memset(&hdr, 0, sizeof(QUIC_PKT_HDR));
    hdr.dst_conn_id = client_hdr->src_conn_id;
    /*
     * this is the random connection ID, we expect client is
     * going to send the ID with next INITIAL packet which
     * will also come with token we generate here.
     */
    ok = ossl_quic_lcidm_get_unused_cid(port->lcidm, &hdr.src_conn_id);
    if (ok == 0)
        goto err;

    memset(&token, 0, sizeof(QUIC_VALIDATION_TOKEN));

    /* Generate retry validation token */
    if (!generate_token(peer, client_hdr->dst_conn_id,
            hdr.src_conn_id, &token, 1)
        || !marshal_validation_token(&token, buffer, &token_buf_len)
        || !encrypt_validation_token(port, buffer, token_buf_len, NULL,
            &ct_len)
        || ct_len > ENCRYPTED_TOKEN_MAX_LEN
        || !encrypt_validation_token(port, buffer, token_buf_len, ct_buf,
            &ct_len)
        || !ossl_assert(ct_len >= QUIC_RETRY_INTEGRITY_TAG_LEN))
        goto err;

    hdr.dst_conn_id = client_hdr->src_conn_id;
    hdr.type = QUIC_PKT_TYPE_RETRY;
    hdr.fixed = 1;
    hdr.version = 1;
    hdr.len = ct_len;
    hdr.data = ct_buf;
    ok = ossl_quic_calculate_retry_integrity_tag(port->engine->libctx,
        port->engine->propq, &hdr,
        &client_hdr->dst_conn_id,
        ct_buf + ct_len
            - QUIC_RETRY_INTEGRITY_TAG_LEN);
    if (ok == 0)
        goto err;

    hdr.token = hdr.data;
    hdr.token_len = hdr.len;

    msg[0].data = buffer;
    msg[0].peer = peer;
    msg[0].local = NULL;
    msg[0].flags = 0;

    ok = WPACKET_init_static_len(&wpkt, buffer, sizeof(buffer), 0);
    if (ok == 0)
        goto err;

    ok = ossl_quic_wire_encode_pkt_hdr(&wpkt, client_hdr->dst_conn_id.id_len,
        &hdr, NULL);
    if (ok == 0)
        goto err;

    ok = WPACKET_get_total_written(&wpkt, &msg[0].data_len);
    if (ok == 0)
        goto err;

    ok = WPACKET_finish(&wpkt);
    if (ok == 0)
        goto err;

    /*
     * TODO(QUIC FUTURE) need to retry this in the event it return EAGAIN
     * on a non-blocking BIO
     */
    if (!BIO_sendmmsg(port->net_wbio, msg, sizeof(BIO_MSG), 1, 0, &written))
        ERR_raise_data(ERR_LIB_SSL, SSL_R_QUIC_NETWORK_ERROR,
            "port retry send failed due to network BIO I/O error");

err:
    WPACKET_cleanup(&wpkt);
    cleanup_validation_token(&token);
}

/**
 * @brief Sends a QUIC Version Negotiation packet to the specified peer.
 *
 * This function constructs and sends a Version Negotiation packet using
 * the connection IDs from the client's initial packet header. The
 * Version Negotiation packet indicates support for QUIC version 1.
 *
 * @param port      Pointer to the QUIC_PORT structure representing the port
 *                  context used for network communication.
 * @param peer      Pointer to the BIO_ADDR structure specifying the address
 *                  of the peer to which the Version Negotiation packet
 *                  will be sent.
 * @param client_hdr Pointer to the QUIC_PKT_HDR structure containing the
 *                  client's packet header used to extract connection IDs.
 *
 * @note The function will raise an error if sending the message fails.
 */
static void port_send_version_negotiation(QUIC_PORT *port, BIO_ADDR *peer,
    QUIC_PKT_HDR *client_hdr)
{
    BIO_MSG msg[1];
    unsigned char buffer[1024];
    QUIC_PKT_HDR hdr;
    WPACKET wpkt;
    uint32_t supported_versions[1];
    size_t written;
    size_t i;

    memset(&hdr, 0, sizeof(QUIC_PKT_HDR));
    /*
     * Reverse the source and dst conn ids
     */
    hdr.dst_conn_id = client_hdr->src_conn_id;
    hdr.src_conn_id = client_hdr->dst_conn_id;

    /*
     * This is our list of supported protocol versions
     * Currently only QUIC_VERSION_1
     */
    supported_versions[0] = QUIC_VERSION_1;

    /*
     * Fill out the header fields
     * Note: Version negotiation packets, must, unlike
     * other packet types have a version of 0
     */
    hdr.type = QUIC_PKT_TYPE_VERSION_NEG;
    hdr.version = 0;
    hdr.token = 0;
    hdr.token_len = 0;
    hdr.len = sizeof(supported_versions);
    hdr.data = (unsigned char *)supported_versions;

    msg[0].data = buffer;
    msg[0].peer = peer;
    msg[0].local = NULL;
    msg[0].flags = 0;

    if (!WPACKET_init_static_len(&wpkt, buffer, sizeof(buffer), 0))
        return;

    if (!ossl_quic_wire_encode_pkt_hdr(&wpkt, client_hdr->dst_conn_id.id_len,
            &hdr, NULL))
        goto err;

    /*
     * Add the array of supported versions to the end of the packet
     */
    for (i = 0; i < OSSL_NELEM(supported_versions); i++) {
        if (!WPACKET_put_bytes_u32(&wpkt, supported_versions[i]))
            goto err;
    }

    if (!WPACKET_get_total_written(&wpkt, &msg[0].data_len))
        goto err;

    if (!WPACKET_finish(&wpkt))
        goto err;

    /*
     * Send it back to the client attempting to connect
     * TODO(QUIC FUTURE): Need to handle the EAGAIN case here, if the
     * BIO_sendmmsg call falls in a retryable manner
     */
    if (!BIO_sendmmsg(port->net_wbio, msg, sizeof(BIO_MSG), 1, 0, &written))
        ERR_raise_data(ERR_LIB_SSL, SSL_R_QUIC_NETWORK_ERROR,
            "port version negotiation send failed");
    return;
err:
    WPACKET_cleanup(&wpkt);
    return;
}

/**
 * @brief definitions of token lifetimes
 *
 * RETRY tokens are only valid for 10 seconds
 * NEW_TOKEN tokens have a lifetime of 3600 sec (1 hour)
 */

#define RETRY_LIFETIME 10
#define NEW_TOKEN_LIFETIME 3600
/**
 * @brief Validates a received token in a QUIC packet header.
 *
 * This function checks the validity of a token contained in the provided
 * QUIC packet header (`QUIC_PKT_HDR *hdr`). The validation process involves
 * verifying that the token matches an expected format and value. If the
 * token is from a RETRY packet, the function extracts the original connection
 * ID (ODCID)/original source connection ID (SCID) and stores it in the provided
 * parameters. If the token is from a NEW_TOKEN packet, the values will be
 * derived instead.
 *
 * @param hdr   Pointer to the QUIC packet header containing the token.
 * @param port  Pointer to the QUIC port from which to send the packet.
 * @param peer  Address of the client peer receiving the packet.
 * @param odcid Pointer to the connection ID structure to store the ODCID if the
 *              token is valid.
 * @param scid  Pointer to the connection ID structure to store the SCID if the
 *              token is valid.
 * @param gen_new_token Set to 1 if a NEW_TOKEN frame should be sent on the
 *              new connection.
 * @param is_retry Set to 1 if the token decrypted and parsed as a token we
 *              minted for a RETRY packet, even if it then failed validation.
 *
 * @return      1 if the token is valid and ODCID/SCID are successfully set.
 *              0 otherwise.
 *
 * The function performs the following checks:
 * - Token length meets the required minimum.
 * - Buffer matches expected format.
 * - Peer address matches previous connection address.
 * - Token has not expired. Currently set to 10 seconds for tokens from RETRY
 *   packets and 60 minutes for tokens from NEW_TOKEN packets. This may be
 *   configurable in the future.
 */
static int port_validate_token(QUIC_PKT_HDR *hdr, QUIC_PORT *port,
    BIO_ADDR *peer, QUIC_CONN_ID *odcid, uint8_t *gen_new_token,
    uint8_t *is_retry)
{
    int ret = 0;
    QUIC_VALIDATION_TOKEN token = { 0 };
    uint64_t time_diff;
    size_t remote_addr_len, dec_token_len;
    unsigned char *remote_addr = NULL, dec_token[MARSHALLED_TOKEN_MAX_LEN];
    OSSL_TIME now = ossl_time_now();

    *gen_new_token = 0;
    *is_retry = 0;

    if (!decrypt_validation_token(port, hdr->token, hdr->token_len, NULL,
            &dec_token_len)
        || dec_token_len > MARSHALLED_TOKEN_MAX_LEN
        || !decrypt_validation_token(port, hdr->token, hdr->token_len,
            dec_token, &dec_token_len)
        || !parse_validation_token(&token, dec_token, dec_token_len))
        goto err;

    *is_retry = token.is_retry;

    /*
     * Validate token timestamp. Current time should not be before the token
     * timestamp.
     */
    if (ossl_time_compare(now, token.timestamp) < 0)
        goto err;
    time_diff = ossl_time2seconds(ossl_time_abs_difference(token.timestamp,
        now));
    if ((token.is_retry && time_diff > RETRY_LIFETIME)
        || (!token.is_retry && time_diff > NEW_TOKEN_LIFETIME))
        goto err;

    /* Validate remote address */
    if (!BIO_ADDR_rawaddress(peer, NULL, &remote_addr_len)
        || remote_addr_len != token.remote_addr_len
        || (remote_addr = OPENSSL_malloc(remote_addr_len)) == NULL
        || !BIO_ADDR_rawaddress(peer, remote_addr, &remote_addr_len)
        || memcmp(remote_addr, token.remote_addr, remote_addr_len) != 0)
        goto err;

    /*
     * Set ODCID and SCID. If the token is from a RETRY packet, retrieve both
     * from the token. Otherwise, generate a new ODCID and use the header's
     * source connection ID for SCID.
     */
    if (token.is_retry) {
        /*
         * We're parsing a packet header before its gone through AEAD validation
         * here, so there is a chance we are dealing with corrupted data. Make
         * Sure the dcid encoded in the token matches the headers dcid to
         * mitigate that.
         * TODO(QUIC FUTURE): Consider handling AEAD validation at the port
         * level rather than the QRX/channel level to eliminate the need for
         * this.
         */
        if (token.rscid.id_len != hdr->dst_conn_id.id_len
            || memcmp(&token.rscid.id, &hdr->dst_conn_id.id,
                   token.rscid.id_len)
                != 0)
            goto err;
        *odcid = token.odcid;
    } else {
        if (!ossl_quic_lcidm_get_unused_cid(port->lcidm, odcid))
            goto err;
    }

    /*
     * Determine if we need to send a NEW_TOKEN frame
     * If we validated a retry token, we should always
     * send a NEW_TOKEN frame to the client
     *
     * If however, we validated a NEW_TOKEN, which may be
     * reused multiple times, only send a NEW_TOKEN frame
     * if the existing received token has less than 10% of its lifetime
     * remaining.  This prevents us from constantly sending
     * NEW_TOKEN frames on every connection when not needed
     */
    if (token.is_retry) {
        *gen_new_token = 1;
    } else {
        if (time_diff > ((NEW_TOKEN_LIFETIME * 9) / 10))
            *gen_new_token = 1;
    }

    ret = 1;
err:
    cleanup_validation_token(&token);
    OPENSSL_free(remote_addr);
    return ret;
}

static void generate_new_token(QUIC_CHANNEL *ch, BIO_ADDR *peer)
{
    QUIC_CONN_ID rscid = { 0 };
    QUIC_VALIDATION_TOKEN token;
    unsigned char buffer[ENCRYPTED_TOKEN_MAX_LEN];
    unsigned char *ct_buf;
    size_t ct_len;
    size_t token_buf_len = 0;

    /* Clients never send a NEW_TOKEN */
    if (!ch->is_server)
        return;

    ct_buf = OPENSSL_zalloc(ENCRYPTED_TOKEN_MAX_LEN);
    if (ct_buf == NULL)
        return;

    /*
     * NEW_TOKEN tokens may be used for multiple subsequent connections
     * within their timeout period, so don't reserve an rscid here
     * like we do for retry tokens, instead, just fill it with random
     * data, as we won't use it anyway
     */
    rscid.id_len = 8;
    if (!RAND_bytes_ex(ch->port->engine->libctx, rscid.id, 8, 0)) {
        OPENSSL_free(ct_buf);
        return;
    }

    memset(&token, 0, sizeof(QUIC_VALIDATION_TOKEN));

    if (!generate_token(peer, ch->init_dcid, rscid, &token, 0)
        || !marshal_validation_token(&token, buffer, &token_buf_len)
        || !encrypt_validation_token(ch->port, buffer, token_buf_len, NULL,
            &ct_len)
        || ct_len > ENCRYPTED_TOKEN_MAX_LEN
        || !encrypt_validation_token(ch->port, buffer, token_buf_len, ct_buf,
            &ct_len)
        || !ossl_assert(ct_len >= QUIC_RETRY_INTEGRITY_TAG_LEN)) {
        OPENSSL_free(ct_buf);
        cleanup_validation_token(&token);
        return;
    }

    ch->pending_new_token = ct_buf;
    ch->pending_new_token_len = ct_len;

    cleanup_validation_token(&token);
}

/*
 * This is called by the demux when we get a packet not destined for any known
 * DCID.
 */
static void port_default_packet_handler(QUIC_URXE *e, void *arg,
    const QUIC_CONN_ID *dcid)
{
    QUIC_PORT *port = arg;
    PACKET pkt;
    QUIC_PKT_HDR hdr;
    QUIC_CHANNEL *ch = NULL, *new_ch = NULL;
    QUIC_CONN_ID odcid;
    uint8_t gen_new_token = 0;
    uint8_t is_retry_token = 0;
    OSSL_QRX *qrx = NULL, *qrx_ref;
    OSSL_QRX *qrx_src = NULL;
    OSSL_QRX_ARGS qrx_args = { 0 };
    uint64_t cause_flags = 0;
    OSSL_QRX_PKT *qrx_pkt = NULL;

    /* Don't handle anything if we are no longer running. */
    if (!ossl_quic_port_is_running(port))
        goto undesirable;

    if (port_try_handle_stateless_reset(port, e))
        goto undesirable;

    if (dcid != NULL
        && ossl_quic_lcidm_lookup(port->lcidm, dcid, NULL,
            (void **)&ch)) {
        assert(ch != NULL);
        ossl_quic_tx_packetiser_add_unvalidated_credit(ch->txp, e->data_len);
        ossl_quic_channel_inject(ch, e);
        return;
    }

    /*
     * If we have an incoming packet which doesn't match any existing connection
     * we assume this is an attempt to make a new connection.
     */
    if (!port->allow_incoming)
        goto undesirable;

    /*
     * packet without destination connection id is invalid/corrupted here.
     * stop wasting CPU cycles now.
     */
    if (dcid == NULL)
        goto undesirable;

    /*
     * We have got a packet for an unknown DCID. This might be an attempt to
     * open a new connection.
     */
    if (e->data_len < QUIC_MIN_INITIAL_DGRAM_LEN)
        goto undesirable;

    if (!PACKET_buf_init(&pkt, ossl_quic_urxe_data(e), e->data_len))
        goto undesirable;

    /*
     * We set short_conn_id_len to SIZE_MAX here which will cause the decode
     * operation to fail if we get a 1-RTT packet. This is fine since we only
     * care about Initial packets.
     */
    if (!ossl_quic_wire_decode_pkt_hdr(&pkt, SIZE_MAX, 1, 0, &hdr, NULL,
            &cause_flags)) {
        /*
         * If we fail due to a bad version, we know the packet up to the version
         * number was decoded, and we use it below to send a version
         * negotiation packet
         */
        if ((cause_flags & QUIC_PKT_HDR_DECODE_BAD_VERSION) == 0)
            goto undesirable;
    }

    switch (hdr.version) {
    case QUIC_VERSION_1:
        break;

    case QUIC_VERSION_NONE:
    default:

        /*
         * If we get here, then we have a bogus version, and might need
         * to send a version negotiation packet.  According to
         * RFC 9000 s. 6 and 14.1, we only do so however, if the UDP datagram
         * is a minimum of 1200 bytes in size
         */
        if (e->data_len < 1200)
            goto undesirable;

        /*
         * If we don't get a supported version, respond with a ver
         * negotiation packet, and discard
         * TODO(QUIC FUTURE): Rate limit the reception of these
         */
        port_send_version_negotiation(port, &e->peer, &hdr);
        goto undesirable;
    }

    /*
     * We only care about Initial packets which might be trying to establish a
     * connection.
     */
    if (hdr.type != QUIC_PKT_TYPE_INITIAL)
        goto undesirable;

    if (port->max_pending_channels > 0 && ossl_list_incoming_ch_num(&port->incoming_channel_list) >= port->max_pending_channels)
        goto undesirable;

    odcid.id_len = 0;

    /*
     * Create qrx now so we can check integrity of packet
     * which does not belong to any channel.
     */
    qrx_args.libctx = port->engine->libctx;
    qrx_args.demux = port->demux;
    qrx_args.short_conn_id_len = dcid->id_len;
    qrx_args.max_deferred = 32;
    qrx = ossl_qrx_new(&qrx_args);
    if (qrx == NULL)
        goto undesirable;

    /*
     * Derive secrets for qrx only.
     */
    if (!ossl_quic_provide_initial_secret(port->engine->libctx,
            port->engine->propq,
            &hdr.dst_conn_id,
            /* is_server */ 1,
            qrx, NULL))
        goto undesirable;

    if (ossl_qrx_validate_initial_packet(qrx, e, (const QUIC_CONN_ID *)dcid) == 0)
        goto undesirable;

    if (port->validate_addr == 0) {
        /*
         * Forget qrx, because it becomes (almost) useless here. We must let
         * channel to create a new QRX for connection ID server chooses. The
         * validation keys for new DCID will be derived by
         * ossl_quic_channel_on_new_conn() when we will be creating channel.
         * See RFC 9000 section 7.2 negotiating connection id to better
         * understand what's going on here.
         *
         * Did we say qrx is almost useless? Why? Because qrx remembers packets
         * we just validated. Those packets must be injected to channel we are
         * going to create. We use qrx_src alias so we can read packets from
         * qrx and inject them to channel.
         */
        qrx_src = qrx;
        qrx = NULL;
    }
    /*
     * TODO(QUIC FUTURE): there should be some logic similar to accounting half-open
     * states in TCP. If we reach certain threshold, then we want to
     * validate clients.
     */
    if (port->validate_addr == 1 && hdr.token == NULL) {
        port_send_retry(port, &e->peer, &hdr);
        goto undesirable;
    }

    /*
     * Note, even if we don't enforce the sending of retry frames for
     * server address validation, we may still get a token if we sent
     * a NEW_TOKEN frame during a prior connection, which we should still
     * validate here
     */
    if (hdr.token != NULL
        && port_validate_token(&hdr, port, &e->peer,
               &odcid, &gen_new_token, &is_retry_token)
            == 0) {
        /*
         * RFC 9000 s 8.1.3
         * When a server receives an Initial packet with an address
         * validation token, it MUST attempt to validate the token,
         * unless it has already completed address validation.
         * If the token is invalid, then the server SHOULD proceed as
         * if the client did not have a validated address,
         * including potentially sending a Retry packet
         * Note: If address validation is disabled, just act like
         * the request is valid
         */
        if (port->validate_addr == 1) {
            /*
             * RFC 9000 s 8.1.2
             * If we minted this token for a Retry packet, the client has
             * already processed a Retry and will not accept another one
             * (RFC 9000 s 17.2.5.2), so sending one would only leave the
             * client waiting for its idle timeout. The RFC prefers closing
             * with INVALID_TOKEN, but also allows discarding the packet,
             * which is what we do here.
             */
            if (is_retry_token)
                goto undesirable;

            /*
             * Again: we should consider saving initial encryption level
             * secrets to token here to save some CPU cycles.
             */
            port_send_retry(port, &e->peer, &hdr);
            goto undesirable;
        }

        /*
         * client is under amplification limit, until it completes
         * handshake.
         *
         * forget qrx so channel can create a new one
         * with valid initial encryption level keys.
         */
        if (qrx != NULL) {
            qrx_src = qrx;
            qrx = NULL;
        }
    }

    qrx_ref = NULL;
    if (qrx != NULL) {
        /*
         * if we are here, then client is validated via retry packet
         * (client sent a valid token). In this case the qrx has valid
         * secrets set for QUIC initial level encryption. We can pass
         * reference to qrx to newly created channel.
         *
         * Note: port_bind_channel()/channel becomes owner of qrx_ref.
         */
        qrx_ref = ossl_qrx_newref(qrx);
        if (qrx_ref == NULL)
            goto undesirable;
    }
    port_bind_channel(port, &e->peer, &hdr.dst_conn_id,
        &odcid, qrx_ref, &new_ch);

    /*
     * if packet validates it gets moved to channel, we've just bound
     * to port.
     */
    if (new_ch == NULL)
        goto undesirable;

    /*
     * Generate a token for sending in a later NEW_TOKEN frame
     */
    if (gen_new_token == 1)
        generate_new_token(new_ch, &e->peer);

    if (qrx_src != NULL) {
        /*
         * Time to reinject packets from qrx to channel before
         * qrx will be destroyed here.
         */
        ossl_quic_tx_packetiser_add_unvalidated_credit(new_ch->txp, e->data_len);
        while (ossl_qrx_read_pkt(qrx_src, &qrx_pkt) == 1)
            ossl_quic_channel_inject_pkt(new_ch, qrx_pkt);
        ossl_qrx_update_pn_space(qrx_src, new_ch->qrx);
        /*
         * transfer ownership back to qrx;
         */
        qrx = qrx_src;
        qrx_src = NULL;
    }

    /*
     * If function reaches this place, then packet got validated in
     * ossl_qrx_validate_initial_packet(). Keep in mind the function
     * ossl_qrx_validate_initial_packet() decrypts the packet to validate it.
     * If packet validation was successful (and it was because we are here),
     * then the function puts the packet to qrx->rx_pending. We must not call
     * ossl_qrx_inject_urxe() here now, because we don't want to insert
     * the packet to qrx->urx_pending which keeps packet waiting for decryption.
     *
     * We are going to call ossl_quic_demux_release_urxe() to dispose buffer
     * which still holds encrypted data.
     */

undesirable:
    ossl_qrx_free(qrx); /* releases reference */
    ossl_qrx_free(qrx_src);
    ossl_quic_demux_release_urxe(port->demux, e);
}

void ossl_quic_port_raise_net_error(QUIC_PORT *port,
    QUIC_CHANNEL *triggering_ch)
{
    QUIC_CHANNEL *ch;

    if (!ossl_quic_port_is_running(port))
        return;

    /*
     * Immediately capture any triggering error on the error stack, with a
     * cover error.
     */
    ERR_raise_data(ERR_LIB_SSL, SSL_R_QUIC_NETWORK_ERROR,
        "port failed due to network BIO I/O error");
    OSSL_ERR_STATE_save(port->err_state);

    port_transition_failed(port);

    /* Give the triggering channel (if any) the first notification. */
    if (triggering_ch != NULL)
        ossl_quic_channel_raise_net_error(triggering_ch);

    OSSL_LIST_FOREACH (ch, ch, &port->channel_list)
        if (ch != triggering_ch)
            ossl_quic_channel_raise_net_error(ch);
}

void ossl_quic_port_restore_err_state(const QUIC_PORT *port)
{
    ERR_clear_error();
    OSSL_ERR_STATE_restore(port->err_state);
}

void ossl_quic_port_set_max_idle_timeout(QUIC_PORT *port, uint64_t ms)
{
    port->max_idle_timeout = ms;
}

uint64_t ossl_quic_port_get_max_idle_timeout(const QUIC_PORT *port)
{
    return port->max_idle_timeout;
}

void ossl_quic_port_set_max_udp_payload_size(QUIC_PORT *port, uint64_t size)
{
    port->max_udp_payload_size = size;
}

uint64_t ossl_quic_port_get_max_udp_payload_size(const QUIC_PORT *port)
{
    return port->max_udp_payload_size;
}

void ossl_quic_port_set_init_max_data(QUIC_PORT *port, uint64_t max_data)
{
    port->init_max_data = max_data;
}

uint64_t ossl_quic_port_get_init_max_data(const QUIC_PORT *port)
{
    return port->init_max_data;
}

void ossl_quic_port_set_init_max_stream_data(QUIC_PORT *port, uint64_t max_data, int is_uni, int is_remote)
{
    if (is_uni) {
        port->init_max_stream_data_uni = max_data;
    } else {
        if (is_remote)
            port->init_max_stream_data_bidi_remote = max_data;
        else
            port->init_max_stream_data_bidi_local = max_data;
    }
}

uint64_t ossl_quic_port_get_init_max_stream_data(const QUIC_PORT *port, int is_uni, int is_remote)
{
    if (is_uni)
        return port->init_max_stream_data_uni;
    else
        return is_remote ? port->init_max_stream_data_bidi_remote : port->init_max_stream_data_bidi_local;
}

void ossl_quic_port_set_init_max_streams(QUIC_PORT *port, uint64_t max_streams, int is_uni)
{
    if (is_uni) {
        port->init_max_streams_uni = max_streams;
    } else {
        port->init_max_streams_bidi = max_streams;
    }
}

uint64_t ossl_quic_port_get_init_max_streams(const QUIC_PORT *port, int is_uni)
{
    return is_uni ? port->init_max_streams_uni : port->init_max_streams_bidi;
}

void ossl_quic_port_set_ack_delay_exponent(QUIC_PORT *port, uint64_t exp)
{
    port->ack_delay_exponent = (unsigned char)exp;
}

uint64_t ossl_quic_port_get_ack_delay_exponent(const QUIC_PORT *port)
{
    return port->ack_delay_exponent;
}

void ossl_quic_port_set_max_ack_delay(QUIC_PORT *port, uint64_t ms)
{
    port->max_ack_delay = ms;
}

uint64_t ossl_quic_port_get_max_ack_delay(const QUIC_PORT *port)
{
    return port->max_ack_delay;
}

void ossl_quic_port_set_disable_active_migration(QUIC_PORT *port, uint64_t disable)
{
    port->disable_active_migration = (unsigned char)disable;
}

uint64_t ossl_quic_port_get_disable_active_migration(const QUIC_PORT *port)
{
    return port->disable_active_migration;
}

void ossl_quic_port_set_active_conn_id_limit(QUIC_PORT *port, uint64_t limit)
{
    port->active_conn_id_limit = limit;
}

uint64_t ossl_quic_port_get_active_conn_id_limit(const QUIC_PORT *port)
{
    return port->active_conn_id_limit;
}

uint64_t ossl_quic_port_get_max_pending_channels(const QUIC_PORT *port)
{
    return port->max_pending_channels;
}

void ossl_quic_port_set_max_pending_channels(QUIC_PORT *port, uint64_t max_pending_channels)
{
    port->max_pending_channels = max_pending_channels;
}

Coverage Report

Created: 2026-10-16 07:31