One Level Up Top Level

src/event/quic/ngx_event_quic_protection.c - nginx

Functions defined

Macros defined

Source code


  2. /*
  3. * Copyright (C) Nginx, Inc.
  4. */


  7. #include <ngx_config.h>
  8. #include <ngx_core.h>
  9. #include <ngx_event.h>
  10. #include <ngx_event_quic_connection.h>
  11. #if (NGX_QUIC_BORINGSSL_EVP_API)
  12. #include <openssl/hkdf.h>
  13. #include <openssl/chacha.h>
  14. #else
  15. #include <openssl/kdf.h>
  16. #endif


  19. /* RFC 9001, 5.4.1.  Header Protection Application: 5-byte mask */
  20. ‌#define NGX_QUIC_HP_LEN               5

  22. ‌#define NGX_QUIC_AES_128_KEY_LEN      16

  24. ‌#define NGX_QUIC_INITIAL_CIPHER       TLS1_3_CK_AES_128_GCM_SHA256


  27. ‌#define ngx_quic_md(str)     { sizeof(str) - 1, str }


  30. static ngx_int_t ngx_hkdf_expand(u_char *out_key, size_t out_len,
  31.     const EVP_MD *digest, const u_char *prk, size_t prk_len,
  32.     const u_char *info, size_t info_len);
  33. static ngx_int_t ngx_hkdf_extract(u_char *out_key, size_t *out_len,
  34.     const EVP_MD *digest, const u_char *secret, size_t secret_len,
  35.     const u_char *salt, size_t salt_len);

  37. static uint64_t ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask,
  38.     uint64_t *largest_pn);

  40. static ngx_int_t ngx_quic_crypto_open(ngx_quic_secret_t *s, ngx_str_t *out,
  41.     const u_char *nonce, ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log);
  42. #if !(NGX_QUIC_BORINGSSL_EVP_API)
  43. static ngx_int_t ngx_quic_crypto_common(ngx_quic_secret_t *s, ngx_str_t *out,
  44.     const u_char *nonce, ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log);
  45. #endif

  47. static ngx_int_t ngx_quic_crypto_hp_init(const EVP_CIPHER *cipher,
  48.     ngx_quic_secret_t *s, ngx_log_t *log);
  49. static ngx_int_t ngx_quic_crypto_hp(ngx_quic_secret_t *s,
  50.     u_char *out, u_char *in, ngx_log_t *log);
  51. static void ngx_quic_crypto_hp_cleanup(ngx_quic_secret_t *s);

  53. static ngx_int_t ngx_quic_create_packet(ngx_quic_header_t *pkt,
  54.     ngx_str_t *res);
  55. static ngx_int_t ngx_quic_create_retry_packet(ngx_quic_header_t *pkt,
  56.     ngx_str_t *res);


  59. ngx_int_t
  60. ‌ngx_quic_ciphers(ngx_uint_t id, ngx_quic_ciphers_t *ciphers)
  61. {
  62.     ngx_int_t  len;

  64.     switch (id) {

  66.     case TLS1_3_CK_AES_128_GCM_SHA256:
  67. #if (NGX_QUIC_BORINGSSL_EVP_API)
  68.         ciphers->c = EVP_aead_aes_128_gcm();
  69. #else
  70.         ciphers->c = EVP_aes_128_gcm();
  71. #endif
  72.         ciphers->hp = EVP_aes_128_ctr();
  73.         ciphers->d = EVP_sha256();
  74.         len = 16;
  75.         break;

  77.     case TLS1_3_CK_AES_256_GCM_SHA384:
  78. #if (NGX_QUIC_BORINGSSL_EVP_API)
  79.         ciphers->c = EVP_aead_aes_256_gcm();
  80. #else
  81.         ciphers->c = EVP_aes_256_gcm();
  82. #endif
  83.         ciphers->hp = EVP_aes_256_ctr();
  84.         ciphers->d = EVP_sha384();
  85.         len = 32;
  86.         break;

  88.     case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
  89. #if (NGX_QUIC_BORINGSSL_EVP_API)
  90.         ciphers->c = EVP_aead_chacha20_poly1305();
  91. #else
  92.         ciphers->c = EVP_chacha20_poly1305();
  93. #endif
  94. #if (NGX_QUIC_BORINGSSL_EVP_API)
  95.         ciphers->hp = (const EVP_CIPHER *) EVP_aead_chacha20_poly1305();
  96. #else
  97.         ciphers->hp = EVP_chacha20();
  98. #endif
  99.         ciphers->d = EVP_sha256();
  100.         len = 32;
  101.         break;

  103. #if !(NGX_QUIC_BORINGSSL_EVP_API)
  104.     case TLS1_3_CK_AES_128_CCM_SHA256:
  105.         ciphers->c = EVP_aes_128_ccm();
  106.         ciphers->hp = EVP_aes_128_ctr();
  107.         ciphers->d = EVP_sha256();
  108.         len = 16;
  109.         break;
  110. #endif

  112.     default:
  113.         return NGX_ERROR;
  114.     }

  116.     return len;
  117. }


  120. ngx_int_t
  121. ‌ngx_quic_keys_set_initial_secret(ngx_quic_keys_t *keys, ngx_str_t *secret,
  122.     ngx_log_t *log)
  123. {
  124.     size_t               is_len;
  125.     uint8_t              is[SHA256_DIGEST_LENGTH];
  126.     ngx_str_t            iss;
  127.     ngx_uint_t           i;
  128.     const EVP_MD        *digest;
  129.     ngx_quic_md_t        client_key, server_key;
  130.     ngx_quic_hkdf_t      seq[8];
  131.     ngx_quic_secret_t   *client, *server;
  132.     ngx_quic_ciphers_t   ciphers;

  134.     static const uint8_t salt[20] = {
  135.         0x38, 0x76, 0x2c, 0xf7, 0xf5, 0x59, 0x34, 0xb3, 0x4d, 0x17,
  136.         0x9a, 0xe6, 0xa4, 0xc8, 0x0c, 0xad, 0xcc, 0xbb, 0x7f, 0x0a
  137.     };

  139.     client = &keys->secrets[NGX_QUIC_ENCRYPTION_INITIAL].client;
  140.     server = &keys->secrets[NGX_QUIC_ENCRYPTION_INITIAL].server;

  142.     /*
  143.      * RFC 9001, section 5.  Packet Protection
  144.      *
  145.      * Initial packets use AEAD_AES_128_GCM.  The hash function
  146.      * for HKDF when deriving initial secrets and keys is SHA-256.
  147.      */

  149.     digest = EVP_sha256();
  150.     is_len = SHA256_DIGEST_LENGTH;

  152.     if (ngx_hkdf_extract(is, &is_len, digest, secret->data, secret->len,
  153.                          salt, sizeof(salt))
  154.         != NGX_OK)
  155.     {
  156.         return NGX_ERROR;
  157.     }

  159.     iss.len = is_len;
  160.     iss.data = is;

  162.     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, log, 0,
  163.                    "quic ngx_quic_set_initial_secret");
  164. #ifdef NGX_QUIC_DEBUG_CRYPTO
  165.     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, log, 0,
  166.                    "quic salt len:%uz %*xs", sizeof(salt), sizeof(salt), salt);
  167.     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, log, 0,
  168.                    "quic initial secret len:%uz %*xs", is_len, is_len, is);
  169. #endif

  171.     client->secret.len = SHA256_DIGEST_LENGTH;
  172.     server->secret.len = SHA256_DIGEST_LENGTH;

  174.     client_key.len = NGX_QUIC_AES_128_KEY_LEN;
  175.     server_key.len = NGX_QUIC_AES_128_KEY_LEN;

  177.     client->hp.len = NGX_QUIC_AES_128_KEY_LEN;
  178.     server->hp.len = NGX_QUIC_AES_128_KEY_LEN;

  180.     client->iv.len = NGX_QUIC_IV_LEN;
  181.     server->iv.len = NGX_QUIC_IV_LEN;

  183.     /* labels per RFC 9001, 5.1. Packet Protection Keys */
  184.     ngx_quic_hkdf_set(&seq[0], "tls13 client in", &client->secret, &iss);
  185.     ngx_quic_hkdf_set(&seq[1], "tls13 quic key", &client_key, &client->secret);
  186.     ngx_quic_hkdf_set(&seq[2], "tls13 quic iv", &client->iv, &client->secret);
  187.     ngx_quic_hkdf_set(&seq[3], "tls13 quic hp", &client->hp, &client->secret);
  188.     ngx_quic_hkdf_set(&seq[4], "tls13 server in", &server->secret, &iss);
  189.     ngx_quic_hkdf_set(&seq[5], "tls13 quic key", &server_key, &server->secret);
  190.     ngx_quic_hkdf_set(&seq[6], "tls13 quic iv", &server->iv, &server->secret);
  191.     ngx_quic_hkdf_set(&seq[7], "tls13 quic hp", &server->hp, &server->secret);

  193.     for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
  194.         if (ngx_quic_hkdf_expand(&seq[i], digest, log) != NGX_OK) {
  195.             return NGX_ERROR;
  196.         }
  197.     }

  199.     if (ngx_quic_ciphers(NGX_QUIC_INITIAL_CIPHER, &ciphers) == NGX_ERROR) {
  200.         return NGX_ERROR;
  201.     }

  203.     if (ngx_quic_crypto_init(ciphers.c, client, &client_key, 0, log)
  204.         == NGX_ERROR)
  205.     {
  206.         return NGX_ERROR;
  207.     }

  209.     if (ngx_quic_crypto_init(ciphers.c, server, &server_key, 1, log)
  210.         == NGX_ERROR)
  211.     {
  212.         goto failed;
  213.     }

  215.     if (ngx_quic_crypto_hp_init(ciphers.hp, client, log) == NGX_ERROR) {
  216.         goto failed;
  217.     }

  219.     if (ngx_quic_crypto_hp_init(ciphers.hp, server, log) == NGX_ERROR) {
  220.         goto failed;
  221.     }

  223.     return NGX_OK;

  225. failed:

  227.     ngx_quic_keys_cleanup(keys);

  229.     return NGX_ERROR;
  230. }


  233. ngx_int_t
  234. ‌ngx_quic_hkdf_expand(ngx_quic_hkdf_t *h, const EVP_MD *digest, ngx_log_t *log)
  235. {
  236.     size_t    info_len;
  237.     uint8_t  *p;
  238.     uint8_t   info[20];

  240.     info_len = 2 + 1 + h->label_len + 1;

  242.     info[0] = 0;
  243.     info[1] = h->out_len;
  244.     info[2] = h->label_len;

  246.     p = ngx_cpymem(&info[3], h->label, h->label_len);
  247.     *p = '\0';

  249.     if (ngx_hkdf_expand(h->out, h->out_len, digest,
  250.                         h->prk, h->prk_len, info, info_len)
  251.         != NGX_OK)
  252.     {
  253.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  254.                       "ngx_hkdf_expand(%*s) failed", h->label_len, h->label);
  255.         return NGX_ERROR;
  256.     }

  258. #ifdef NGX_QUIC_DEBUG_CRYPTO
  259.     ngx_log_debug5(NGX_LOG_DEBUG_EVENT, log, 0,
  260.                    "quic expand \"%*s\" len:%uz %*xs",
  261.                    h->label_len, h->label, h->out_len, h->out_len, h->out);
  262. #endif

  264.     return NGX_OK;
  265. }


  268. static ngx_int_t
  269. ‌ngx_hkdf_expand(u_char *out_key, size_t out_len, const EVP_MD *digest,
  270.     const uint8_t *prk, size_t prk_len, const u_char *info, size_t info_len)
  271. {
  272. #if (NGX_QUIC_BORINGSSL_EVP_API)

  274.     if (HKDF_expand(out_key, out_len, digest, prk, prk_len, info, info_len)
  275.         == 0)
  276.     {
  277.         return NGX_ERROR;
  278.     }

  280.     return NGX_OK;

  282. #else

  284.     EVP_PKEY_CTX  *pctx;

  286.     pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
  287.     if (pctx == NULL) {
  288.         return NGX_ERROR;
  289.     }

  291.     if (EVP_PKEY_derive_init(pctx) <= 0) {
  292.         goto failed;
  293.     }

  295.     if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) <= 0) {
  296.         goto failed;
  297.     }

  299.     if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
  300.         goto failed;
  301.     }

  303.     if (EVP_PKEY_CTX_set1_hkdf_key(pctx, prk, prk_len) <= 0) {
  304.         goto failed;
  305.     }

  307.     if (EVP_PKEY_CTX_add1_hkdf_info(pctx, info, info_len) <= 0) {
  308.         goto failed;
  309.     }

  311.     if (EVP_PKEY_derive(pctx, out_key, &out_len) <= 0) {
  312.         goto failed;
  313.     }

  315.     EVP_PKEY_CTX_free(pctx);

  317.     return NGX_OK;

  319. failed:

  321.     EVP_PKEY_CTX_free(pctx);

  323.     return NGX_ERROR;

  325. #endif
  326. }


  329. static ngx_int_t
  330. ‌ngx_hkdf_extract(u_char *out_key, size_t *out_len, const EVP_MD *digest,
  331.     const u_char *secret, size_t secret_len, const u_char *salt,
  332.     size_t salt_len)
  333. {
  334. #if (NGX_QUIC_BORINGSSL_EVP_API)

  336.     if (HKDF_extract(out_key, out_len, digest, secret, secret_len, salt,
  337.                      salt_len)
  338.         == 0)
  339.     {
  340.         return NGX_ERROR;
  341.     }

  343.     return NGX_OK;

  345. #else

  347.     EVP_PKEY_CTX  *pctx;

  349.     pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
  350.     if (pctx == NULL) {
  351.         return NGX_ERROR;
  352.     }

  354.     if (EVP_PKEY_derive_init(pctx) <= 0) {
  355.         goto failed;
  356.     }

  358.     if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) <= 0) {
  359.         goto failed;
  360.     }

  362.     if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
  363.         goto failed;
  364.     }

  366.     if (EVP_PKEY_CTX_set1_hkdf_key(pctx, secret, secret_len) <= 0) {
  367.         goto failed;
  368.     }

  370.     if (EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, salt_len) <= 0) {
  371.         goto failed;
  372.     }

  374.     if (EVP_PKEY_derive(pctx, out_key, out_len) <= 0) {
  375.         goto failed;
  376.     }

  378.     EVP_PKEY_CTX_free(pctx);

  380.     return NGX_OK;

  382. failed:

  384.     EVP_PKEY_CTX_free(pctx);

  386.     return NGX_ERROR;

  388. #endif
  389. }


  392. ngx_int_t
  393. ‌ngx_quic_crypto_init(const ngx_quic_cipher_t *cipher, ngx_quic_secret_t *s,
  394.     ngx_quic_md_t *key, ngx_int_t enc, ngx_log_t *log)
  395. {

  397. #if (NGX_QUIC_BORINGSSL_EVP_API)
  398.     EVP_AEAD_CTX  *ctx;

  400.     ctx = EVP_AEAD_CTX_new(cipher, key->data, key->len,
  401.                            EVP_AEAD_DEFAULT_TAG_LENGTH);
  402.     if (ctx == NULL) {
  403.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_AEAD_CTX_new() failed");
  404.         return NGX_ERROR;
  405.     }
  406. #else
  407.     EVP_CIPHER_CTX  *ctx;

  409.     ctx = EVP_CIPHER_CTX_new();
  410.     if (ctx == NULL) {
  411.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CIPHER_CTX_new() failed");
  412.         return NGX_ERROR;
  413.     }

  415.     if (EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc) != 1) {
  416.         EVP_CIPHER_CTX_free(ctx);
  417.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherInit_ex() failed");
  418.         return NGX_ERROR;
  419.     }

  421.     if (EVP_CIPHER_mode(cipher) == EVP_CIPH_CCM_MODE
  422.         && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, NGX_QUIC_TAG_LEN,
  423.                                NULL)
  424.            == 0)
  425.     {
  426.         EVP_CIPHER_CTX_free(ctx);
  427.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  428.                       "EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed");
  429.         return NGX_ERROR;
  430.     }

  432.     if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, s->iv.len, NULL)
  433.         == 0)
  434.     {
  435.         EVP_CIPHER_CTX_free(ctx);
  436.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  437.                       "EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_IVLEN) failed");
  438.         return NGX_ERROR;
  439.     }

  441.     if (EVP_CipherInit_ex(ctx, NULL, NULL, key->data, NULL, enc) != 1) {
  442.         EVP_CIPHER_CTX_free(ctx);
  443.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherInit_ex() failed");
  444.         return NGX_ERROR;
  445.     }
  446. #endif

  448.     s->ctx = ctx;
  449.     return NGX_OK;
  450. }


  453. static ngx_int_t
  454. ‌ngx_quic_crypto_open(ngx_quic_secret_t *s, ngx_str_t *out, const u_char *nonce,
  455.     ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log)
  456. {
  457. #if (NGX_QUIC_BORINGSSL_EVP_API)
  458.     if (EVP_AEAD_CTX_open(s->ctx, out->data, &out->len, out->len, nonce,
  459.                           s->iv.len, in->data, in->len, ad->data, ad->len)
  460.         != 1)
  461.     {
  462.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_AEAD_CTX_open() failed");
  463.         return NGX_ERROR;
  464.     }

  466.     return NGX_OK;
  467. #else
  468.     return ngx_quic_crypto_common(s, out, nonce, in, ad, log);
  469. #endif
  470. }


  473. ngx_int_t
  474. ‌ngx_quic_crypto_seal(ngx_quic_secret_t *s, ngx_str_t *out, const u_char *nonce,
  475.     ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log)
  476. {
  477. #if (NGX_QUIC_BORINGSSL_EVP_API)
  478.     if (EVP_AEAD_CTX_seal(s->ctx, out->data, &out->len, out->len, nonce,
  479.                           s->iv.len, in->data, in->len, ad->data, ad->len)
  480.         != 1)
  481.     {
  482.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_AEAD_CTX_seal() failed");
  483.         return NGX_ERROR;
  484.     }

  486.     return NGX_OK;
  487. #else
  488.     return ngx_quic_crypto_common(s, out, nonce, in, ad, log);
  489. #endif
  490. }


  493. #if !(NGX_QUIC_BORINGSSL_EVP_API)

  495. static ngx_int_t
  496. ‌ngx_quic_crypto_common(ngx_quic_secret_t *s, ngx_str_t *out,
  497.     const u_char *nonce, ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log)
  498. {
  499.     int                     len, enc;
  500.     ngx_quic_crypto_ctx_t  *ctx;

  502.     ctx = s->ctx;
  503.     enc = EVP_CIPHER_CTX_encrypting(ctx);

  505.     if (EVP_CipherInit_ex(ctx, NULL, NULL, NULL, nonce, enc) != 1) {
  506.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherInit_ex() failed");
  507.         return NGX_ERROR;
  508.     }

  510.     if (enc == 0) {
  511.         in->len -= NGX_QUIC_TAG_LEN;

  513.         if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, NGX_QUIC_TAG_LEN,
  514.                                 in->data + in->len)
  515.             == 0)
  516.         {
  517.             ngx_ssl_error(NGX_LOG_INFO, log, 0,
  518.                           "EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed");
  519.             return NGX_ERROR;
  520.         }
  521.     }

  523.     if (EVP_CIPHER_mode(EVP_CIPHER_CTX_cipher(ctx)) == EVP_CIPH_CCM_MODE
  524.         && EVP_CipherUpdate(ctx, NULL, &len, NULL, in->len) != 1)
  525.     {
  526.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherUpdate() failed");
  527.         return NGX_ERROR;
  528.     }

  530.     if (EVP_CipherUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
  531.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherUpdate() failed");
  532.         return NGX_ERROR;
  533.     }

  535.     if (EVP_CipherUpdate(ctx, out->data, &len, in->data, in->len) != 1) {
  536.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherUpdate() failed");
  537.         return NGX_ERROR;
  538.     }

  540.     out->len = len;

  542.     if (EVP_CipherFinal_ex(ctx, out->data + out->len, &len) <= 0) {
  543.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherFinal_ex failed");
  544.         return NGX_ERROR;
  545.     }

  547.     out->len += len;

  549.     if (enc == 1) {
  550.         if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, NGX_QUIC_TAG_LEN,
  551.                                 out->data + out->len)
  552.             == 0)
  553.         {
  554.             ngx_ssl_error(NGX_LOG_INFO, log, 0,
  555.                           "EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_GET_TAG) failed");
  556.             return NGX_ERROR;
  557.         }

  559.         out->len += NGX_QUIC_TAG_LEN;
  560.     }

  562.     return NGX_OK;
  563. }

  565. #endif


  568. void
  569. ‌ngx_quic_crypto_cleanup(ngx_quic_secret_t *s)
  570. {
  571.     if (s->ctx) {
  572. #if (NGX_QUIC_BORINGSSL_EVP_API)
  573.         EVP_AEAD_CTX_free(s->ctx);
  574. #else
  575.         EVP_CIPHER_CTX_free(s->ctx);
  576. #endif
  577.         s->ctx = NULL;
  578.     }
  579. }


  582. static ngx_int_t
  583. ‌ngx_quic_crypto_hp_init(const EVP_CIPHER *cipher, ngx_quic_secret_t *s,
  584.     ngx_log_t *log)
  585. {
  586.     EVP_CIPHER_CTX  *ctx;

  588. #if (NGX_QUIC_BORINGSSL_EVP_API)
  589.     if (cipher == (EVP_CIPHER *) EVP_aead_chacha20_poly1305()) {
  590.         /* no EVP interface */
  591.         s->hp_ctx = NULL;
  592.         return NGX_OK;
  593.     }
  594. #endif

  596.     ctx = EVP_CIPHER_CTX_new();
  597.     if (ctx == NULL) {
  598.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CIPHER_CTX_new() failed");
  599.         return NGX_ERROR;
  600.     }

  602.     if (EVP_EncryptInit_ex(ctx, cipher, NULL, s->hp.data, NULL) != 1) {
  603.         EVP_CIPHER_CTX_free(ctx);
  604.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_EncryptInit_ex() failed");
  605.         return NGX_ERROR;
  606.     }

  608.     s->hp_ctx = ctx;
  609.     return NGX_OK;
  610. }


  613. static ngx_int_t
  614. ‌ngx_quic_crypto_hp(ngx_quic_secret_t *s, u_char *out, u_char *in,
  615.     ngx_log_t *log)
  616. {
  617.     int              outlen;
  618.     EVP_CIPHER_CTX  *ctx;

  620.     static const u_char zero[NGX_QUIC_HP_LEN];

  622.     ctx = s->hp_ctx;

  624. #if (NGX_QUIC_BORINGSSL_EVP_API)
  625.     uint32_t         cnt;

  627.     if (ctx == NULL) {
  628.         ngx_memcpy(&cnt, in, sizeof(uint32_t));
  629.         CRYPTO_chacha_20(out, zero, NGX_QUIC_HP_LEN, s->hp.data, &in[4], cnt);
  630.         return NGX_OK;
  631.     }
  632. #endif

  634.     if (EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, in) != 1) {
  635.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_EncryptInit_ex() failed");
  636.         return NGX_ERROR;
  637.     }

  639.     if (!EVP_EncryptUpdate(ctx, out, &outlen, zero, NGX_QUIC_HP_LEN)) {
  640.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_EncryptUpdate() failed");
  641.         return NGX_ERROR;
  642.     }

  644.     if (!EVP_EncryptFinal_ex(ctx, out + NGX_QUIC_HP_LEN, &outlen)) {
  645.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_EncryptFinal_Ex() failed");
  646.         return NGX_ERROR;
  647.     }

  649.     return NGX_OK;
  650. }


  653. static void
  654. ‌ngx_quic_crypto_hp_cleanup(ngx_quic_secret_t *s)
  655. {
  656.     if (s->hp_ctx) {
  657.         EVP_CIPHER_CTX_free(s->hp_ctx);
  658.         s->hp_ctx = NULL;
  659.     }
  660. }


  663. ngx_int_t
  664. ‌ngx_quic_keys_set_encryption_secret(ngx_log_t *log, ngx_uint_t is_write,
  665.     ngx_quic_keys_t *keys, ngx_uint_t level, const SSL_CIPHER *cipher,
  666.     const uint8_t *secret, size_t secret_len)
  667. {
  668.     ngx_int_t            key_len;
  669.     ngx_str_t            secret_str;
  670.     ngx_uint_t           i;
  671.     ngx_quic_md_t        key;
  672.     ngx_quic_hkdf_t      seq[3];
  673.     ngx_quic_secret_t   *peer_secret;
  674.     ngx_quic_ciphers_t   ciphers;

  676.     peer_secret = is_write ? &keys->secrets[level].server
  677.                            : &keys->secrets[level].client;

  679.     keys->cipher = SSL_CIPHER_get_id(cipher);

  681.     key_len = ngx_quic_ciphers(keys->cipher, &ciphers);

  683.     if (key_len == NGX_ERROR) {
  684.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "unexpected cipher");
  685.         return NGX_ERROR;
  686.     }

  688.     if (sizeof(peer_secret->secret.data) < secret_len) {
  689.         ngx_log_error(NGX_LOG_ALERT, log, 0,
  690.                       "unexpected secret len: %uz", secret_len);
  691.         return NGX_ERROR;
  692.     }

  694.     peer_secret->secret.len = secret_len;
  695.     ngx_memcpy(peer_secret->secret.data, secret, secret_len);

  697.     key.len = key_len;
  698.     peer_secret->iv.len = NGX_QUIC_IV_LEN;
  699.     peer_secret->hp.len = key_len;

  701.     secret_str.len = secret_len;
  702.     secret_str.data = (u_char *) secret;

  704.     ngx_quic_hkdf_set(&seq[0], "tls13 quic key", &key, &secret_str);
  705.     ngx_quic_hkdf_set(&seq[1], "tls13 quic iv", &peer_secret->iv, &secret_str);
  706.     ngx_quic_hkdf_set(&seq[2], "tls13 quic hp", &peer_secret->hp, &secret_str);

  708.     for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
  709.         if (ngx_quic_hkdf_expand(&seq[i], ciphers.d, log) != NGX_OK) {
  710.             return NGX_ERROR;
  711.         }
  712.     }

  714.     if (ngx_quic_crypto_init(ciphers.c, peer_secret, &key, is_write, log)
  715.         == NGX_ERROR)
  716.     {
  717.         return NGX_ERROR;
  718.     }

  720.     if (ngx_quic_crypto_hp_init(ciphers.hp, peer_secret, log) == NGX_ERROR) {
  721.         return NGX_ERROR;
  722.     }

  724.     ngx_explicit_memzero(key.data, key.len);

  726.     return NGX_OK;
  727. }


  730. ngx_uint_t
  731. ‌ngx_quic_keys_available(ngx_quic_keys_t *keys, ngx_uint_t level,
  732.     ngx_uint_t is_write)
  733. {
  734.     if (is_write == 0) {
  735.         return keys->secrets[level].client.ctx != NULL;
  736.     }

  738.     return keys->secrets[level].server.ctx != NULL;
  739. }


  742. void
  743. ‌ngx_quic_keys_discard(ngx_quic_keys_t *keys, ngx_uint_t level)
  744. {
  745.     ngx_quic_secret_t  *client, *server;

  747.     client = &keys->secrets[level].client;
  748.     server = &keys->secrets[level].server;

  750.     ngx_quic_crypto_cleanup(client);
  751.     ngx_quic_crypto_cleanup(server);

  753.     ngx_quic_crypto_hp_cleanup(client);
  754.     ngx_quic_crypto_hp_cleanup(server);

  756.     if (client->secret.len) {
  757.         ngx_explicit_memzero(client->secret.data, client->secret.len);
  758.         client->secret.len = 0;
  759.     }

  761.     if (server->secret.len) {
  762.         ngx_explicit_memzero(server->secret.data, server->secret.len);
  763.         server->secret.len = 0;
  764.     }
  765. }


  768. void
  769. ‌ngx_quic_keys_switch(ngx_connection_t *c, ngx_quic_keys_t *keys)
  770. {
  771.     ngx_quic_secrets_t  *current, *next, tmp;

  773.     current = &keys->secrets[NGX_QUIC_ENCRYPTION_APPLICATION];
  774.     next = &keys->next_key;

  776.     ngx_quic_crypto_cleanup(&current->client);
  777.     ngx_quic_crypto_cleanup(&current->server);

  779.     tmp = *current;
  780.     *current = *next;
  781.     *next = tmp;
  782. }


  785. void
  786. ‌ngx_quic_keys_update(ngx_event_t *ev)
  787. {
  788.     ngx_int_t               key_len;
  789.     ngx_uint_t              i;
  790.     ngx_quic_md_t           client_key, server_key;
  791.     ngx_quic_hkdf_t         seq[6];
  792.     ngx_quic_keys_t        *keys;
  793.     ngx_connection_t       *c;
  794.     ngx_quic_ciphers_t      ciphers;
  795.     ngx_quic_secrets_t     *current, *next;
  796.     ngx_quic_connection_t  *qc;

  798.     c = ev->data;
  799.     qc = ngx_quic_get_connection(c);
  800.     keys = qc->keys;

  802.     current = &keys->secrets[NGX_QUIC_ENCRYPTION_APPLICATION];
  803.     next = &keys->next_key;

  805.     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic key update");

  807.     c->log->action = "updating keys";

  809.     key_len = ngx_quic_ciphers(keys->cipher, &ciphers);

  811.     if (key_len == NGX_ERROR) {
  812.         goto failed;
  813.     }

  815.     client_key.len = key_len;
  816.     server_key.len = key_len;

  818.     next->client.secret.len = current->client.secret.len;
  819.     next->client.iv.len = NGX_QUIC_IV_LEN;
  820.     next->client.hp = current->client.hp;
  821.     next->client.hp_ctx = current->client.hp_ctx;

  823.     next->server.secret.len = current->server.secret.len;
  824.     next->server.iv.len = NGX_QUIC_IV_LEN;
  825.     next->server.hp = current->server.hp;
  826.     next->server.hp_ctx = current->server.hp_ctx;

  828.     ngx_quic_hkdf_set(&seq[0], "tls13 quic ku",
  829.                       &next->client.secret, &current->client.secret);
  830.     ngx_quic_hkdf_set(&seq[1], "tls13 quic key",
  831.                       &client_key, &next->client.secret);
  832.     ngx_quic_hkdf_set(&seq[2], "tls13 quic iv",
  833.                       &next->client.iv, &next->client.secret);
  834.     ngx_quic_hkdf_set(&seq[3], "tls13 quic ku",
  835.                       &next->server.secret, &current->server.secret);
  836.     ngx_quic_hkdf_set(&seq[4], "tls13 quic key",
  837.                       &server_key, &next->server.secret);
  838.     ngx_quic_hkdf_set(&seq[5], "tls13 quic iv",
  839.                       &next->server.iv, &next->server.secret);

  841.     for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
  842.         if (ngx_quic_hkdf_expand(&seq[i], ciphers.d, c->log) != NGX_OK) {
  843.             goto failed;
  844.         }
  845.     }

  847.     if (ngx_quic_crypto_init(ciphers.c, &next->client, &client_key, 0, c->log)
  848.         == NGX_ERROR)
  849.     {
  850.         goto failed;
  851.     }

  853.     if (ngx_quic_crypto_init(ciphers.c, &next->server, &server_key, 1, c->log)
  854.         == NGX_ERROR)
  855.     {
  856.         goto failed;
  857.     }

  859.     ngx_explicit_memzero(current->client.secret.data,
  860.                          current->client.secret.len);
  861.     ngx_explicit_memzero(current->server.secret.data,
  862.                          current->server.secret.len);

  864.     current->client.secret.len = 0;
  865.     current->server.secret.len = 0;

  867.     ngx_explicit_memzero(client_key.data, client_key.len);
  868.     ngx_explicit_memzero(server_key.data, server_key.len);

  870.     return;

  872. failed:

  874.     ngx_quic_close_connection(c, NGX_ERROR);
  875. }


  878. void
  879. ‌ngx_quic_keys_cleanup(ngx_quic_keys_t *keys)
  880. {
  881.     ngx_uint_t           i;
  882.     ngx_quic_secrets_t  *next;

  884.     for (i = 0; i < NGX_QUIC_ENCRYPTION_LAST; i++) {
  885.         ngx_quic_keys_discard(keys, i);
  886.     }

  888.     next = &keys->next_key;

  890.     ngx_quic_crypto_cleanup(&next->client);
  891.     ngx_quic_crypto_cleanup(&next->server);

  893.     if (next->client.secret.len) {
  894.         ngx_explicit_memzero(next->client.secret.data,
  895.                              next->client.secret.len);
  896.         next->client.secret.len = 0;
  897.     }

  899.     if (next->server.secret.len) {
  900.         ngx_explicit_memzero(next->server.secret.data,
  901.                              next->server.secret.len);
  902.         next->server.secret.len = 0;
  903.     }
  904. }


  907. static ngx_int_t
  908. ‌ngx_quic_create_packet(ngx_quic_header_t *pkt, ngx_str_t *res)
  909. {
  910.     u_char             *pnp, *sample;
  911.     ngx_str_t           ad, out;
  912.     ngx_uint_t          i;
  913.     ngx_quic_secret_t  *secret;
  914.     u_char              nonce[NGX_QUIC_IV_LEN], mask[NGX_QUIC_HP_LEN];

  916.     ad.data = res->data;
  917.     ad.len = ngx_quic_create_header(pkt, ad.data, &pnp);

  919.     out.len = pkt->payload.len + NGX_QUIC_TAG_LEN;
  920.     out.data = res->data + ad.len;

  922. #ifdef NGX_QUIC_DEBUG_CRYPTO
  923.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  924.                    "quic ad len:%uz %xV", ad.len, &ad);
  925. #endif

  927.     secret = &pkt->keys->secrets[pkt->level].server;

  929.     ngx_memcpy(nonce, secret->iv.data, secret->iv.len);
  930.     ngx_quic_compute_nonce(nonce, sizeof(nonce), pkt->number);

  932.     if (ngx_quic_crypto_seal(secret, &out, nonce, &pkt->payload, &ad, pkt->log)
  933.         != NGX_OK)
  934.     {
  935.         return NGX_ERROR;
  936.     }

  938.     sample = &out.data[4 - pkt->num_len];
  939.     if (ngx_quic_crypto_hp(secret, mask, sample, pkt->log) != NGX_OK) {
  940.         return NGX_ERROR;
  941.     }

  943.     /* RFC 9001, 5.4.1.  Header Protection Application */
  944.     ad.data[0] ^= mask[0] & ngx_quic_pkt_hp_mask(pkt->flags);

  946.     for (i = 0; i < pkt->num_len; i++) {
  947.         pnp[i] ^= mask[i + 1];
  948.     }

  950.     res->len = ad.len + out.len;

  952.     return NGX_OK;
  953. }


  956. static ngx_int_t
  957. ‌ngx_quic_create_retry_packet(ngx_quic_header_t *pkt, ngx_str_t *res)
  958. {
  959.     u_char              *start;
  960.     ngx_str_t            ad, itag;
  961.     ngx_quic_secret_t    secret;
  962.     ngx_quic_ciphers_t   ciphers;

  964.     /* 5.8.  Retry Packet Integrity */
  965.     static ngx_quic_md_t  key = ngx_quic_md(
  966.         "\xbe\x0c\x69\x0b\x9f\x66\x57\x5a\x1d\x76\x6b\x54\xe3\x68\xc8\x4e");
  967.     static const u_char   nonce[NGX_QUIC_IV_LEN] = {
  968.         0x46, 0x15, 0x99, 0xd3, 0x5d, 0x63, 0x2b, 0xf2, 0x23, 0x98, 0x25, 0xbb
  969.     };
  970.     static ngx_str_t      in = ngx_string("");

  972.     ad.data = res->data;
  973.     ad.len = ngx_quic_create_retry_itag(pkt, ad.data, &start);

  975.     itag.data = ad.data + ad.len;
  976.     itag.len = NGX_QUIC_TAG_LEN;

  978. #ifdef NGX_QUIC_DEBUG_CRYPTO
  979.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  980.                    "quic retry itag len:%uz %xV", ad.len, &ad);
  981. #endif

  983.     if (ngx_quic_ciphers(NGX_QUIC_INITIAL_CIPHER, &ciphers) == NGX_ERROR) {
  984.         return NGX_ERROR;
  985.     }

  987.     secret.iv.len = NGX_QUIC_IV_LEN;

  989.     if (ngx_quic_crypto_init(ciphers.c, &secret, &key, 1, pkt->log)
  990.         == NGX_ERROR)
  991.     {
  992.         return NGX_ERROR;
  993.     }

  995.     if (ngx_quic_crypto_seal(&secret, &itag, nonce, &in, &ad, pkt->log)
  996.         != NGX_OK)
  997.     {
  998.         ngx_quic_crypto_cleanup(&secret);
  999.         return NGX_ERROR;
  1000.     }

  1002.     ngx_quic_crypto_cleanup(&secret);

  1004.     res->len = itag.data + itag.len - start;
  1005.     res->data = start;

  1007.     return NGX_OK;
  1008. }


  1011. ngx_int_t
  1012. ‌ngx_quic_derive_key(ngx_log_t *log, const char *label, ngx_str_t *secret,
  1013.     ngx_str_t *salt, u_char *out, size_t len)
  1014. {
  1015.     size_t         is_len, info_len;
  1016.     uint8_t       *p;
  1017.     const EVP_MD  *digest;

  1019.     uint8_t        is[SHA256_DIGEST_LENGTH];
  1020.     uint8_t        info[20];

  1022.     digest = EVP_sha256();
  1023.     is_len = SHA256_DIGEST_LENGTH;

  1025.     if (ngx_hkdf_extract(is, &is_len, digest, secret->data, secret->len,
  1026.                          salt->data, salt->len)
  1027.         != NGX_OK)
  1028.     {
  1029.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  1030.                       "ngx_hkdf_extract(%s) failed", label);
  1031.         return NGX_ERROR;
  1032.     }

  1034.     info[0] = 0;
  1035.     info[1] = len;
  1036.     info[2] = ngx_strlen(label);

  1038.     info_len = 2 + 1 + info[2] + 1;

  1040.     if (info_len >= 20) {
  1041.         ngx_log_error(NGX_LOG_INFO, log, 0,
  1042.                       "ngx_quic_create_key label \"%s\" too long", label);
  1043.         return NGX_ERROR;
  1044.     }

  1046.     p = ngx_cpymem(&info[3], label, info[2]);
  1047.     *p = '\0';

  1049.     if (ngx_hkdf_expand(out, len, digest, is, is_len, info, info_len) != NGX_OK)
  1050.     {
  1051.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  1052.                       "ngx_hkdf_expand(%s) failed", label);
  1053.         return NGX_ERROR;
  1054.     }

  1056.     return NGX_OK;
  1057. }


  1060. static uint64_t
  1061. ‌ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask,
  1062.     uint64_t *largest_pn)
  1063. {
  1064.     u_char    *p;
  1065.     uint64_t   truncated_pn, expected_pn, candidate_pn;
  1066.     uint64_t   pn_nbits, pn_win, pn_hwin, pn_mask;

  1068.     pn_nbits = ngx_min(len * 8, 62);

  1070.     p = *pos;
  1071.     truncated_pn = *p++ ^ *mask++;

  1073.     while (--len) {
  1074.         truncated_pn = (truncated_pn << 8) + (*p++ ^ *mask++);
  1075.     }

  1077.     *pos = p;

  1079.     expected_pn = *largest_pn + 1;
  1080.     pn_win = 1ULL << pn_nbits;
  1081.     pn_hwin = pn_win / 2;
  1082.     pn_mask = pn_win - 1;

  1084.     candidate_pn = (expected_pn & ~pn_mask) | truncated_pn;

  1086.     if ((int64_t) candidate_pn <= (int64_t) (expected_pn - pn_hwin)
  1087.         && candidate_pn < (1ULL << 62) - pn_win)
  1088.     {
  1089.         candidate_pn += pn_win;

  1091.     } else if (candidate_pn > expected_pn + pn_hwin
  1092.                && candidate_pn >= pn_win)
  1093.     {
  1094.         candidate_pn -= pn_win;
  1095.     }

  1097.     *largest_pn = ngx_max((int64_t) *largest_pn, (int64_t) candidate_pn);

  1099.     return candidate_pn;
  1100. }


  1103. void
  1104. ‌ngx_quic_compute_nonce(u_char *nonce, size_t len, uint64_t pn)
  1105. {
  1106.     nonce[len - 8] ^= (pn >> 56) & 0x3f;
  1107.     nonce[len - 7] ^= (pn >> 48) & 0xff;
  1108.     nonce[len - 6] ^= (pn >> 40) & 0xff;
  1109.     nonce[len - 5] ^= (pn >> 32) & 0xff;
  1110.     nonce[len - 4] ^= (pn >> 24) & 0xff;
  1111.     nonce[len - 3] ^= (pn >> 16) & 0xff;
  1112.     nonce[len - 2] ^= (pn >> 8) & 0xff;
  1113.     nonce[len - 1] ^= pn & 0xff;
  1114. }


  1117. ngx_int_t
  1118. ‌ngx_quic_encrypt(ngx_quic_header_t *pkt, ngx_str_t *res)
  1119. {
  1120.     if (ngx_quic_pkt_retry(pkt->flags)) {
  1121.         return ngx_quic_create_retry_packet(pkt, res);
  1122.     }

  1124.     return ngx_quic_create_packet(pkt, res);
  1125. }


  1128. ngx_int_t
  1129. ‌ngx_quic_decrypt(ngx_quic_header_t *pkt, uint64_t *largest_pn)
  1130. {
  1131.     u_char             *p, *sample;
  1132.     size_t              len;
  1133.     uint64_t            pn, lpn;
  1134.     ngx_int_t           pnl;
  1135.     ngx_str_t           in, ad;
  1136.     ngx_uint_t          key_phase;
  1137.     ngx_quic_secret_t  *secret;
  1138.     uint8_t             nonce[NGX_QUIC_IV_LEN], mask[NGX_QUIC_HP_LEN];

  1140.     secret = &pkt->keys->secrets[pkt->level].client;

  1142.     p = pkt->raw->pos;
  1143.     len = pkt->data + pkt->len - p;

  1145.     /*
  1146.      * RFC 9001, 5.4.2. Header Protection Sample
  1147.      *           5.4.3. AES-Based Header Protection
  1148.      *           5.4.4. ChaCha20-Based Header Protection
  1149.      *
  1150.      * the Packet Number field is assumed to be 4 bytes long
  1151.      * AES and ChaCha20 algorithms sample 16 bytes
  1152.      */

  1154.     if (len < NGX_QUIC_TAG_LEN + 4) {
  1155.         return NGX_DECLINED;
  1156.     }

  1158.     sample = p + 4;

  1160.     /* header protection */

  1162.     if (ngx_quic_crypto_hp(secret, mask, sample, pkt->log) != NGX_OK) {
  1163.         return NGX_DECLINED;
  1164.     }

  1166.     pkt->flags ^= mask[0] & ngx_quic_pkt_hp_mask(pkt->flags);

  1168.     if (ngx_quic_short_pkt(pkt->flags)) {
  1169.         key_phase = (pkt->flags & NGX_QUIC_PKT_KPHASE) != 0;

  1171.         if (key_phase != pkt->key_phase) {
  1172.             if (pkt->keys->next_key.client.ctx != NULL) {
  1173.                 secret = &pkt->keys->next_key.client;
  1174.                 pkt->key_update = 1;

  1176.             } else {
  1177.                 /*
  1178.                  * RFC 9001,  6.3. Timing of Receive Key Generation.
  1179.                  *
  1180.                  * Trial decryption to avoid timing side-channel.
  1181.                  */
  1182.                 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1183.                                "quic next key missing");
  1184.             }
  1185.         }
  1186.     }

  1188.     lpn = *largest_pn;

  1190.     pnl = (pkt->flags & 0x03) + 1;
  1191.     pn = ngx_quic_parse_pn(&p, pnl, &mask[1], &lpn);

  1193.     pkt->pn = pn;

  1195.     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1196.                    "quic packet rx clearflags:%xd", pkt->flags);
  1197.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1198.                    "quic packet rx number:%uL len:%xi", pn, pnl);

  1200.     /* packet protection */

  1202.     in.data = p;
  1203.     in.len = len - pnl;

  1205.     ad.len = p - pkt->data;
  1206.     ad.data = pkt->plaintext;

  1208.     ngx_memcpy(ad.data, pkt->data, ad.len);
  1209.     ad.data[0] = pkt->flags;

  1211.     do {
  1212.         ad.data[ad.len - pnl] = pn >> (8 * (pnl - 1)) % 256;
  1213.     } while (--pnl);

  1215.     ngx_memcpy(nonce, secret->iv.data, secret->iv.len);
  1216.     ngx_quic_compute_nonce(nonce, sizeof(nonce), pn);

  1218. #ifdef NGX_QUIC_DEBUG_CRYPTO
  1219.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1220.                    "quic ad len:%uz %xV", ad.len, &ad);
  1221. #endif

  1223.     pkt->payload.len = in.len - NGX_QUIC_TAG_LEN;
  1224.     pkt->payload.data = pkt->plaintext + ad.len;

  1226.     if (ngx_quic_crypto_open(secret, &pkt->payload, nonce, &in, &ad, pkt->log)
  1227.         != NGX_OK)
  1228.     {
  1229.         return NGX_DECLINED;
  1230.     }

  1232.     if (pkt->payload.len == 0) {
  1233.         /*
  1234.          * RFC 9000, 12.4.  Frames and Frame Types
  1235.          *
  1236.          * An endpoint MUST treat receipt of a packet containing no
  1237.          * frames as a connection error of type PROTOCOL_VIOLATION.
  1238.          */
  1239.         ngx_log_error(NGX_LOG_INFO, pkt->log, 0, "quic zero-length packet");
  1240.         pkt->error = NGX_QUIC_ERR_PROTOCOL_VIOLATION;
  1241.         return NGX_ERROR;
  1242.     }

  1244.     if (pkt->flags & ngx_quic_pkt_rb_mask(pkt->flags)) {
  1245.         /*
  1246.          * RFC 9000, Reserved Bits
  1247.          *
  1248.          * An endpoint MUST treat receipt of a packet that has
  1249.          * a non-zero value for these bits, after removing both
  1250.          * packet and header protection, as a connection error
  1251.          * of type PROTOCOL_VIOLATION.
  1252.          */
  1253.         ngx_log_error(NGX_LOG_INFO, pkt->log, 0,
  1254.                       "quic reserved bit set in packet");
  1255.         pkt->error = NGX_QUIC_ERR_PROTOCOL_VIOLATION;
  1256.         return NGX_ERROR;
  1257.     }

  1259. #if defined(NGX_QUIC_DEBUG_CRYPTO) && defined(NGX_QUIC_DEBUG_PACKETS)
  1260.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1261.                    "quic packet payload len:%uz %xV",
  1262.                    pkt->payload.len, &pkt->payload);
  1263. #endif

  1265.     *largest_pn = lpn;

  1267.     return NGX_OK;
  1268. }

One Level Up Top Level