One Level Up Top Level

src/event/quic/ngx_event_quic_protection.c - nginx source code

Functions defined

Macros defined

Source code


  2. /*
  3. * Copyright (C) Nginx, Inc.
  4. */


  7. #include <ngx_config.h>
  8. #include <ngx_core.h>
  9. #include <ngx_event.h>
  10. #include <ngx_event_quic_connection.h>


  13. /* RFC 9001, 5.4.1.  Header Protection Application: 5-byte mask */
  14. ‌#define NGX_QUIC_HP_LEN               5

  16. ‌#define NGX_QUIC_AES_128_KEY_LEN      16

  18. ‌#define NGX_QUIC_INITIAL_CIPHER       TLS1_3_CK_AES_128_GCM_SHA256


  21. ‌#define ngx_quic_md(str)     { sizeof(str) - 1, str }


  24. static ngx_int_t ngx_hkdf_expand(u_char *out_key, size_t out_len,
  25.     const EVP_MD *digest, const u_char *prk, size_t prk_len,
  26.     const u_char *info, size_t info_len);
  27. static ngx_int_t ngx_hkdf_extract(u_char *out_key, size_t *out_len,
  28.     const EVP_MD *digest, const u_char *secret, size_t secret_len,
  29.     const u_char *salt, size_t salt_len);

  31. static uint64_t ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask,
  32.     uint64_t *largest_pn);

  34. static ngx_int_t ngx_quic_crypto_open(ngx_quic_secret_t *s, ngx_str_t *out,
  35.     const u_char *nonce, ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log);
  36. #ifndef OPENSSL_IS_BORINGSSL
  37. static ngx_int_t ngx_quic_crypto_common(ngx_quic_secret_t *s, ngx_str_t *out,
  38.     const u_char *nonce, ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log);
  39. #endif

  41. static ngx_int_t ngx_quic_crypto_hp_init(const EVP_CIPHER *cipher,
  42.     ngx_quic_secret_t *s, ngx_log_t *log);
  43. static ngx_int_t ngx_quic_crypto_hp(ngx_quic_secret_t *s,
  44.     u_char *out, u_char *in, ngx_log_t *log);
  45. static void ngx_quic_crypto_hp_cleanup(ngx_quic_secret_t *s);

  47. static ngx_int_t ngx_quic_create_packet(ngx_quic_header_t *pkt,
  48.     ngx_str_t *res);
  49. static ngx_int_t ngx_quic_create_retry_packet(ngx_quic_header_t *pkt,
  50.     ngx_str_t *res);


  53. ngx_int_t
  54. ‌ngx_quic_ciphers(ngx_uint_t id, ngx_quic_ciphers_t *ciphers)
  55. {
  56.     ngx_int_t  len;

  58.     switch (id) {

  60.     case TLS1_3_CK_AES_128_GCM_SHA256:
  61. #ifdef OPENSSL_IS_BORINGSSL
  62.         ciphers->c = EVP_aead_aes_128_gcm();
  63. #else
  64.         ciphers->c = EVP_aes_128_gcm();
  65. #endif
  66.         ciphers->hp = EVP_aes_128_ctr();
  67.         ciphers->d = EVP_sha256();
  68.         len = 16;
  69.         break;

  71.     case TLS1_3_CK_AES_256_GCM_SHA384:
  72. #ifdef OPENSSL_IS_BORINGSSL
  73.         ciphers->c = EVP_aead_aes_256_gcm();
  74. #else
  75.         ciphers->c = EVP_aes_256_gcm();
  76. #endif
  77.         ciphers->hp = EVP_aes_256_ctr();
  78.         ciphers->d = EVP_sha384();
  79.         len = 32;
  80.         break;

  82.     case TLS1_3_CK_CHACHA20_POLY1305_SHA256:
  83. #ifdef OPENSSL_IS_BORINGSSL
  84.         ciphers->c = EVP_aead_chacha20_poly1305();
  85. #else
  86.         ciphers->c = EVP_chacha20_poly1305();
  87. #endif
  88. #ifdef OPENSSL_IS_BORINGSSL
  89.         ciphers->hp = (const EVP_CIPHER *) EVP_aead_chacha20_poly1305();
  90. #else
  91.         ciphers->hp = EVP_chacha20();
  92. #endif
  93.         ciphers->d = EVP_sha256();
  94.         len = 32;
  95.         break;

  97. #ifndef OPENSSL_IS_BORINGSSL
  98.     case TLS1_3_CK_AES_128_CCM_SHA256:
  99.         ciphers->c = EVP_aes_128_ccm();
  100.         ciphers->hp = EVP_aes_128_ctr();
  101.         ciphers->d = EVP_sha256();
  102.         len = 16;
  103.         break;
  104. #endif

  106.     default:
  107.         return NGX_ERROR;
  108.     }

  110.     return len;
  111. }


  114. ngx_int_t
  115. ‌ngx_quic_keys_set_initial_secret(ngx_quic_keys_t *keys, ngx_str_t *secret,
  116.     ngx_log_t *log)
  117. {
  118.     size_t               is_len;
  119.     uint8_t              is[SHA256_DIGEST_LENGTH];
  120.     ngx_str_t            iss;
  121.     ngx_uint_t           i;
  122.     const EVP_MD        *digest;
  123.     ngx_quic_md_t        client_key, server_key;
  124.     ngx_quic_hkdf_t      seq[8];
  125.     ngx_quic_secret_t   *client, *server;
  126.     ngx_quic_ciphers_t   ciphers;

  128.     static const uint8_t salt[20] =
  129.         "\x38\x76\x2c\xf7\xf5\x59\x34\xb3\x4d\x17"
  130.         "\x9a\xe6\xa4\xc8\x0c\xad\xcc\xbb\x7f\x0a";

  132.     client = &keys->secrets[ssl_encryption_initial].client;
  133.     server = &keys->secrets[ssl_encryption_initial].server;

  135.     /*
  136.      * RFC 9001, section 5.  Packet Protection
  137.      *
  138.      * Initial packets use AEAD_AES_128_GCM.  The hash function
  139.      * for HKDF when deriving initial secrets and keys is SHA-256.
  140.      */

  142.     digest = EVP_sha256();
  143.     is_len = SHA256_DIGEST_LENGTH;

  145.     if (ngx_hkdf_extract(is, &is_len, digest, secret->data, secret->len,
  146.                          salt, sizeof(salt))
  147.         != NGX_OK)
  148.     {
  149.         return NGX_ERROR;
  150.     }

  152.     iss.len = is_len;
  153.     iss.data = is;

  155.     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, log, 0,
  156.                    "quic ngx_quic_set_initial_secret");
  157. #ifdef NGX_QUIC_DEBUG_CRYPTO
  158.     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, log, 0,
  159.                    "quic salt len:%uz %*xs", sizeof(salt), sizeof(salt), salt);
  160.     ngx_log_debug3(NGX_LOG_DEBUG_EVENT, log, 0,
  161.                    "quic initial secret len:%uz %*xs", is_len, is_len, is);
  162. #endif

  164.     client->secret.len = SHA256_DIGEST_LENGTH;
  165.     server->secret.len = SHA256_DIGEST_LENGTH;

  167.     client_key.len = NGX_QUIC_AES_128_KEY_LEN;
  168.     server_key.len = NGX_QUIC_AES_128_KEY_LEN;

  170.     client->hp.len = NGX_QUIC_AES_128_KEY_LEN;
  171.     server->hp.len = NGX_QUIC_AES_128_KEY_LEN;

  173.     client->iv.len = NGX_QUIC_IV_LEN;
  174.     server->iv.len = NGX_QUIC_IV_LEN;

  176.     /* labels per RFC 9001, 5.1. Packet Protection Keys */
  177.     ngx_quic_hkdf_set(&seq[0], "tls13 client in", &client->secret, &iss);
  178.     ngx_quic_hkdf_set(&seq[1], "tls13 quic key", &client_key, &client->secret);
  179.     ngx_quic_hkdf_set(&seq[2], "tls13 quic iv", &client->iv, &client->secret);
  180.     ngx_quic_hkdf_set(&seq[3], "tls13 quic hp", &client->hp, &client->secret);
  181.     ngx_quic_hkdf_set(&seq[4], "tls13 server in", &server->secret, &iss);
  182.     ngx_quic_hkdf_set(&seq[5], "tls13 quic key", &server_key, &server->secret);
  183.     ngx_quic_hkdf_set(&seq[6], "tls13 quic iv", &server->iv, &server->secret);
  184.     ngx_quic_hkdf_set(&seq[7], "tls13 quic hp", &server->hp, &server->secret);

  186.     for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
  187.         if (ngx_quic_hkdf_expand(&seq[i], digest, log) != NGX_OK) {
  188.             return NGX_ERROR;
  189.         }
  190.     }

  192.     if (ngx_quic_ciphers(NGX_QUIC_INITIAL_CIPHER, &ciphers) == NGX_ERROR) {
  193.         return NGX_ERROR;
  194.     }

  196.     if (ngx_quic_crypto_init(ciphers.c, client, &client_key, 0, log)
  197.         == NGX_ERROR)
  198.     {
  199.         return NGX_ERROR;
  200.     }

  202.     if (ngx_quic_crypto_init(ciphers.c, server, &server_key, 1, log)
  203.         == NGX_ERROR)
  204.     {
  205.         goto failed;
  206.     }

  208.     if (ngx_quic_crypto_hp_init(ciphers.hp, client, log) == NGX_ERROR) {
  209.         goto failed;
  210.     }

  212.     if (ngx_quic_crypto_hp_init(ciphers.hp, server, log) == NGX_ERROR) {
  213.         goto failed;
  214.     }

  216.     return NGX_OK;

  218. failed:

  220.     ngx_quic_keys_cleanup(keys);

  222.     return NGX_ERROR;
  223. }


  226. ngx_int_t
  227. ‌ngx_quic_hkdf_expand(ngx_quic_hkdf_t *h, const EVP_MD *digest, ngx_log_t *log)
  228. {
  229.     size_t    info_len;
  230.     uint8_t  *p;
  231.     uint8_t   info[20];

  233.     info_len = 2 + 1 + h->label_len + 1;

  235.     info[0] = 0;
  236.     info[1] = h->out_len;
  237.     info[2] = h->label_len;

  239.     p = ngx_cpymem(&info[3], h->label, h->label_len);
  240.     *p = '\0';

  242.     if (ngx_hkdf_expand(h->out, h->out_len, digest,
  243.                         h->prk, h->prk_len, info, info_len)
  244.         != NGX_OK)
  245.     {
  246.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  247.                       "ngx_hkdf_expand(%*s) failed", h->label_len, h->label);
  248.         return NGX_ERROR;
  249.     }

  251. #ifdef NGX_QUIC_DEBUG_CRYPTO
  252.     ngx_log_debug5(NGX_LOG_DEBUG_EVENT, log, 0,
  253.                    "quic expand \"%*s\" len:%uz %*xs",
  254.                    h->label_len, h->label, h->out_len, h->out_len, h->out);
  255. #endif

  257.     return NGX_OK;
  258. }


  261. static ngx_int_t
  262. ‌ngx_hkdf_expand(u_char *out_key, size_t out_len, const EVP_MD *digest,
  263.     const uint8_t *prk, size_t prk_len, const u_char *info, size_t info_len)
  264. {
  265. #ifdef OPENSSL_IS_BORINGSSL

  267.     if (HKDF_expand(out_key, out_len, digest, prk, prk_len, info, info_len)
  268.         == 0)
  269.     {
  270.         return NGX_ERROR;
  271.     }

  273.     return NGX_OK;

  275. #else

  277.     EVP_PKEY_CTX  *pctx;

  279.     pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
  280.     if (pctx == NULL) {
  281.         return NGX_ERROR;
  282.     }

  284.     if (EVP_PKEY_derive_init(pctx) <= 0) {
  285.         goto failed;
  286.     }

  288.     if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) <= 0) {
  289.         goto failed;
  290.     }

  292.     if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
  293.         goto failed;
  294.     }

  296.     if (EVP_PKEY_CTX_set1_hkdf_key(pctx, prk, prk_len) <= 0) {
  297.         goto failed;
  298.     }

  300.     if (EVP_PKEY_CTX_add1_hkdf_info(pctx, info, info_len) <= 0) {
  301.         goto failed;
  302.     }

  304.     if (EVP_PKEY_derive(pctx, out_key, &out_len) <= 0) {
  305.         goto failed;
  306.     }

  308.     EVP_PKEY_CTX_free(pctx);

  310.     return NGX_OK;

  312. failed:

  314.     EVP_PKEY_CTX_free(pctx);

  316.     return NGX_ERROR;

  318. #endif
  319. }


  322. static ngx_int_t
  323. ‌ngx_hkdf_extract(u_char *out_key, size_t *out_len, const EVP_MD *digest,
  324.     const u_char *secret, size_t secret_len, const u_char *salt,
  325.     size_t salt_len)
  326. {
  327. #ifdef OPENSSL_IS_BORINGSSL

  329.     if (HKDF_extract(out_key, out_len, digest, secret, secret_len, salt,
  330.                      salt_len)
  331.         == 0)
  332.     {
  333.         return NGX_ERROR;
  334.     }

  336.     return NGX_OK;

  338. #else

  340.     EVP_PKEY_CTX  *pctx;

  342.     pctx = EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, NULL);
  343.     if (pctx == NULL) {
  344.         return NGX_ERROR;
  345.     }

  347.     if (EVP_PKEY_derive_init(pctx) <= 0) {
  348.         goto failed;
  349.     }

  351.     if (EVP_PKEY_CTX_hkdf_mode(pctx, EVP_PKEY_HKDEF_MODE_EXTRACT_ONLY) <= 0) {
  352.         goto failed;
  353.     }

  355.     if (EVP_PKEY_CTX_set_hkdf_md(pctx, digest) <= 0) {
  356.         goto failed;
  357.     }

  359.     if (EVP_PKEY_CTX_set1_hkdf_key(pctx, secret, secret_len) <= 0) {
  360.         goto failed;
  361.     }

  363.     if (EVP_PKEY_CTX_set1_hkdf_salt(pctx, salt, salt_len) <= 0) {
  364.         goto failed;
  365.     }

  367.     if (EVP_PKEY_derive(pctx, out_key, out_len) <= 0) {
  368.         goto failed;
  369.     }

  371.     EVP_PKEY_CTX_free(pctx);

  373.     return NGX_OK;

  375. failed:

  377.     EVP_PKEY_CTX_free(pctx);

  379.     return NGX_ERROR;

  381. #endif
  382. }


  385. ngx_int_t
  386. ‌ngx_quic_crypto_init(const ngx_quic_cipher_t *cipher, ngx_quic_secret_t *s,
  387.     ngx_quic_md_t *key, ngx_int_t enc, ngx_log_t *log)
  388. {

  390. #ifdef OPENSSL_IS_BORINGSSL
  391.     EVP_AEAD_CTX  *ctx;

  393.     ctx = EVP_AEAD_CTX_new(cipher, key->data, key->len,
  394.                            EVP_AEAD_DEFAULT_TAG_LENGTH);
  395.     if (ctx == NULL) {
  396.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_AEAD_CTX_new() failed");
  397.         return NGX_ERROR;
  398.     }
  399. #else
  400.     EVP_CIPHER_CTX  *ctx;

  402.     ctx = EVP_CIPHER_CTX_new();
  403.     if (ctx == NULL) {
  404.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CIPHER_CTX_new() failed");
  405.         return NGX_ERROR;
  406.     }

  408.     if (EVP_CipherInit_ex(ctx, cipher, NULL, NULL, NULL, enc) != 1) {
  409.         EVP_CIPHER_CTX_free(ctx);
  410.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherInit_ex() failed");
  411.         return NGX_ERROR;
  412.     }

  414.     if (EVP_CIPHER_mode(cipher) == EVP_CIPH_CCM_MODE
  415.         && EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, NGX_QUIC_TAG_LEN,
  416.                                NULL)
  417.            == 0)
  418.     {
  419.         EVP_CIPHER_CTX_free(ctx);
  420.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  421.                       "EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed");
  422.         return NGX_ERROR;
  423.     }

  425.     if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN, s->iv.len, NULL)
  426.         == 0)
  427.     {
  428.         EVP_CIPHER_CTX_free(ctx);
  429.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  430.                       "EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_IVLEN) failed");
  431.         return NGX_ERROR;
  432.     }

  434.     if (EVP_CipherInit_ex(ctx, NULL, NULL, key->data, NULL, enc) != 1) {
  435.         EVP_CIPHER_CTX_free(ctx);
  436.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherInit_ex() failed");
  437.         return NGX_ERROR;
  438.     }
  439. #endif

  441.     s->ctx = ctx;
  442.     return NGX_OK;
  443. }


  446. static ngx_int_t
  447. ‌ngx_quic_crypto_open(ngx_quic_secret_t *s, ngx_str_t *out, const u_char *nonce,
  448.     ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log)
  449. {
  450. #ifdef OPENSSL_IS_BORINGSSL
  451.     if (EVP_AEAD_CTX_open(s->ctx, out->data, &out->len, out->len, nonce,
  452.                           s->iv.len, in->data, in->len, ad->data, ad->len)
  453.         != 1)
  454.     {
  455.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_AEAD_CTX_open() failed");
  456.         return NGX_ERROR;
  457.     }

  459.     return NGX_OK;
  460. #else
  461.     return ngx_quic_crypto_common(s, out, nonce, in, ad, log);
  462. #endif
  463. }


  466. ngx_int_t
  467. ‌ngx_quic_crypto_seal(ngx_quic_secret_t *s, ngx_str_t *out, const u_char *nonce,
  468.     ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log)
  469. {
  470. #ifdef OPENSSL_IS_BORINGSSL
  471.     if (EVP_AEAD_CTX_seal(s->ctx, out->data, &out->len, out->len, nonce,
  472.                           s->iv.len, in->data, in->len, ad->data, ad->len)
  473.         != 1)
  474.     {
  475.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_AEAD_CTX_seal() failed");
  476.         return NGX_ERROR;
  477.     }

  479.     return NGX_OK;
  480. #else
  481.     return ngx_quic_crypto_common(s, out, nonce, in, ad, log);
  482. #endif
  483. }


  486. #ifndef OPENSSL_IS_BORINGSSL

  488. static ngx_int_t
  489. ‌ngx_quic_crypto_common(ngx_quic_secret_t *s, ngx_str_t *out,
  490.     const u_char *nonce, ngx_str_t *in, ngx_str_t *ad, ngx_log_t *log)
  491. {
  492.     int                     len, enc;
  493.     ngx_quic_crypto_ctx_t  *ctx;

  495.     ctx = s->ctx;
  496.     enc = EVP_CIPHER_CTX_encrypting(ctx);

  498.     if (EVP_CipherInit_ex(ctx, NULL, NULL, NULL, nonce, enc) != 1) {
  499.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherInit_ex() failed");
  500.         return NGX_ERROR;
  501.     }

  503.     if (enc == 0) {
  504.         in->len -= NGX_QUIC_TAG_LEN;

  506.         if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, NGX_QUIC_TAG_LEN,
  507.                                 in->data + in->len)
  508.             == 0)
  509.         {
  510.             ngx_ssl_error(NGX_LOG_INFO, log, 0,
  511.                           "EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_SET_TAG) failed");
  512.             return NGX_ERROR;
  513.         }
  514.     }

  516.     if (EVP_CIPHER_mode(EVP_CIPHER_CTX_cipher(ctx)) == EVP_CIPH_CCM_MODE
  517.         && EVP_CipherUpdate(ctx, NULL, &len, NULL, in->len) != 1)
  518.     {
  519.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherUpdate() failed");
  520.         return NGX_ERROR;
  521.     }

  523.     if (EVP_CipherUpdate(ctx, NULL, &len, ad->data, ad->len) != 1) {
  524.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherUpdate() failed");
  525.         return NGX_ERROR;
  526.     }

  528.     if (EVP_CipherUpdate(ctx, out->data, &len, in->data, in->len) != 1) {
  529.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherUpdate() failed");
  530.         return NGX_ERROR;
  531.     }

  533.     out->len = len;

  535.     if (EVP_CipherFinal_ex(ctx, out->data + out->len, &len) <= 0) {
  536.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CipherFinal_ex failed");
  537.         return NGX_ERROR;
  538.     }

  540.     out->len += len;

  542.     if (enc == 1) {
  543.         if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_GET_TAG, NGX_QUIC_TAG_LEN,
  544.                                 out->data + out->len)
  545.             == 0)
  546.         {
  547.             ngx_ssl_error(NGX_LOG_INFO, log, 0,
  548.                           "EVP_CIPHER_CTX_ctrl(EVP_CTRL_AEAD_GET_TAG) failed");
  549.             return NGX_ERROR;
  550.         }

  552.         out->len += NGX_QUIC_TAG_LEN;
  553.     }

  555.     return NGX_OK;
  556. }

  558. #endif


  561. void
  562. ‌ngx_quic_crypto_cleanup(ngx_quic_secret_t *s)
  563. {
  564.     if (s->ctx) {
  565. #ifdef OPENSSL_IS_BORINGSSL
  566.         EVP_AEAD_CTX_free(s->ctx);
  567. #else
  568.         EVP_CIPHER_CTX_free(s->ctx);
  569. #endif
  570.         s->ctx = NULL;
  571.     }
  572. }


  575. static ngx_int_t
  576. ‌ngx_quic_crypto_hp_init(const EVP_CIPHER *cipher, ngx_quic_secret_t *s,
  577.     ngx_log_t *log)
  578. {
  579.     EVP_CIPHER_CTX  *ctx;

  581. #ifdef OPENSSL_IS_BORINGSSL
  582.     if (cipher == (EVP_CIPHER *) EVP_aead_chacha20_poly1305()) {
  583.         /* no EVP interface */
  584.         s->hp_ctx = NULL;
  585.         return NGX_OK;
  586.     }
  587. #endif

  589.     ctx = EVP_CIPHER_CTX_new();
  590.     if (ctx == NULL) {
  591.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_CIPHER_CTX_new() failed");
  592.         return NGX_ERROR;
  593.     }

  595.     if (EVP_EncryptInit_ex(ctx, cipher, NULL, s->hp.data, NULL) != 1) {
  596.         EVP_CIPHER_CTX_free(ctx);
  597.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_EncryptInit_ex() failed");
  598.         return NGX_ERROR;
  599.     }

  601.     s->hp_ctx = ctx;
  602.     return NGX_OK;
  603. }


  606. static ngx_int_t
  607. ‌ngx_quic_crypto_hp(ngx_quic_secret_t *s, u_char *out, u_char *in,
  608.     ngx_log_t *log)
  609. {
  610.     int              outlen;
  611.     EVP_CIPHER_CTX  *ctx;

  613.     static const u_char zero[NGX_QUIC_HP_LEN];

  615.     ctx = s->hp_ctx;

  617. #ifdef OPENSSL_IS_BORINGSSL
  618.     uint32_t         cnt;

  620.     if (ctx == NULL) {
  621.         ngx_memcpy(&cnt, in, sizeof(uint32_t));
  622.         CRYPTO_chacha_20(out, zero, NGX_QUIC_HP_LEN, s->hp.data, &in[4], cnt);
  623.         return NGX_OK;
  624.     }
  625. #endif

  627.     if (EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, in) != 1) {
  628.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_EncryptInit_ex() failed");
  629.         return NGX_ERROR;
  630.     }

  632.     if (!EVP_EncryptUpdate(ctx, out, &outlen, zero, NGX_QUIC_HP_LEN)) {
  633.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_EncryptUpdate() failed");
  634.         return NGX_ERROR;
  635.     }

  637.     if (!EVP_EncryptFinal_ex(ctx, out + NGX_QUIC_HP_LEN, &outlen)) {
  638.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "EVP_EncryptFinal_Ex() failed");
  639.         return NGX_ERROR;
  640.     }

  642.     return NGX_OK;
  643. }


  646. static void
  647. ‌ngx_quic_crypto_hp_cleanup(ngx_quic_secret_t *s)
  648. {
  649.     if (s->hp_ctx) {
  650.         EVP_CIPHER_CTX_free(s->hp_ctx);
  651.         s->hp_ctx = NULL;
  652.     }
  653. }


  656. ngx_int_t
  657. ‌ngx_quic_keys_set_encryption_secret(ngx_log_t *log, ngx_uint_t is_write,
  658.     ngx_quic_keys_t *keys, enum ssl_encryption_level_t level,
  659.     const SSL_CIPHER *cipher, const uint8_t *secret, size_t secret_len)
  660. {
  661.     ngx_int_t            key_len;
  662.     ngx_str_t            secret_str;
  663.     ngx_uint_t           i;
  664.     ngx_quic_md_t        key;
  665.     ngx_quic_hkdf_t      seq[3];
  666.     ngx_quic_secret_t   *peer_secret;
  667.     ngx_quic_ciphers_t   ciphers;

  669.     peer_secret = is_write ? &keys->secrets[level].server
  670.                            : &keys->secrets[level].client;

  672.     keys->cipher = SSL_CIPHER_get_id(cipher);

  674.     key_len = ngx_quic_ciphers(keys->cipher, &ciphers);

  676.     if (key_len == NGX_ERROR) {
  677.         ngx_ssl_error(NGX_LOG_INFO, log, 0, "unexpected cipher");
  678.         return NGX_ERROR;
  679.     }

  681.     if (sizeof(peer_secret->secret.data) < secret_len) {
  682.         ngx_log_error(NGX_LOG_ALERT, log, 0,
  683.                       "unexpected secret len: %uz", secret_len);
  684.         return NGX_ERROR;
  685.     }

  687.     peer_secret->secret.len = secret_len;
  688.     ngx_memcpy(peer_secret->secret.data, secret, secret_len);

  690.     key.len = key_len;
  691.     peer_secret->iv.len = NGX_QUIC_IV_LEN;
  692.     peer_secret->hp.len = key_len;

  694.     secret_str.len = secret_len;
  695.     secret_str.data = (u_char *) secret;

  697.     ngx_quic_hkdf_set(&seq[0], "tls13 quic key", &key, &secret_str);
  698.     ngx_quic_hkdf_set(&seq[1], "tls13 quic iv", &peer_secret->iv, &secret_str);
  699.     ngx_quic_hkdf_set(&seq[2], "tls13 quic hp", &peer_secret->hp, &secret_str);

  701.     for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
  702.         if (ngx_quic_hkdf_expand(&seq[i], ciphers.d, log) != NGX_OK) {
  703.             return NGX_ERROR;
  704.         }
  705.     }

  707.     if (ngx_quic_crypto_init(ciphers.c, peer_secret, &key, is_write, log)
  708.         == NGX_ERROR)
  709.     {
  710.         return NGX_ERROR;
  711.     }

  713.     if (ngx_quic_crypto_hp_init(ciphers.hp, peer_secret, log) == NGX_ERROR) {
  714.         return NGX_ERROR;
  715.     }

  717.     ngx_explicit_memzero(key.data, key.len);

  719.     return NGX_OK;
  720. }


  723. ngx_uint_t
  724. ‌ngx_quic_keys_available(ngx_quic_keys_t *keys,
  725.     enum ssl_encryption_level_t level, ngx_uint_t is_write)
  726. {
  727.     if (is_write == 0) {
  728.         return keys->secrets[level].client.ctx != NULL;
  729.     }

  731.     return keys->secrets[level].server.ctx != NULL;
  732. }


  735. void
  736. ‌ngx_quic_keys_discard(ngx_quic_keys_t *keys,
  737.     enum ssl_encryption_level_t level)
  738. {
  739.     ngx_quic_secret_t  *client, *server;

  741.     client = &keys->secrets[level].client;
  742.     server = &keys->secrets[level].server;

  744.     ngx_quic_crypto_cleanup(client);
  745.     ngx_quic_crypto_cleanup(server);

  747.     ngx_quic_crypto_hp_cleanup(client);
  748.     ngx_quic_crypto_hp_cleanup(server);

  750.     if (client->secret.len) {
  751.         ngx_explicit_memzero(client->secret.data, client->secret.len);
  752.         client->secret.len = 0;
  753.     }

  755.     if (server->secret.len) {
  756.         ngx_explicit_memzero(server->secret.data, server->secret.len);
  757.         server->secret.len = 0;
  758.     }
  759. }


  762. void
  763. ‌ngx_quic_keys_switch(ngx_connection_t *c, ngx_quic_keys_t *keys)
  764. {
  765.     ngx_quic_secrets_t  *current, *next, tmp;

  767.     current = &keys->secrets[ssl_encryption_application];
  768.     next = &keys->next_key;

  770.     ngx_quic_crypto_cleanup(&current->client);
  771.     ngx_quic_crypto_cleanup(&current->server);

  773.     tmp = *current;
  774.     *current = *next;
  775.     *next = tmp;
  776. }


  779. void
  780. ‌ngx_quic_keys_update(ngx_event_t *ev)
  781. {
  782.     ngx_int_t               key_len;
  783.     ngx_uint_t              i;
  784.     ngx_quic_md_t           client_key, server_key;
  785.     ngx_quic_hkdf_t         seq[6];
  786.     ngx_quic_keys_t        *keys;
  787.     ngx_connection_t       *c;
  788.     ngx_quic_ciphers_t      ciphers;
  789.     ngx_quic_secrets_t     *current, *next;
  790.     ngx_quic_connection_t  *qc;

  792.     c = ev->data;
  793.     qc = ngx_quic_get_connection(c);
  794.     keys = qc->keys;

  796.     current = &keys->secrets[ssl_encryption_application];
  797.     next = &keys->next_key;

  799.     ngx_log_debug0(NGX_LOG_DEBUG_EVENT, c->log, 0, "quic key update");

  801.     c->log->action = "updating keys";

  803.     key_len = ngx_quic_ciphers(keys->cipher, &ciphers);

  805.     if (key_len == NGX_ERROR) {
  806.         goto failed;
  807.     }

  809.     client_key.len = key_len;
  810.     server_key.len = key_len;

  812.     next->client.secret.len = current->client.secret.len;
  813.     next->client.iv.len = NGX_QUIC_IV_LEN;
  814.     next->client.hp = current->client.hp;
  815.     next->client.hp_ctx = current->client.hp_ctx;

  817.     next->server.secret.len = current->server.secret.len;
  818.     next->server.iv.len = NGX_QUIC_IV_LEN;
  819.     next->server.hp = current->server.hp;
  820.     next->server.hp_ctx = current->server.hp_ctx;

  822.     ngx_quic_hkdf_set(&seq[0], "tls13 quic ku",
  823.                       &next->client.secret, &current->client.secret);
  824.     ngx_quic_hkdf_set(&seq[1], "tls13 quic key",
  825.                       &client_key, &next->client.secret);
  826.     ngx_quic_hkdf_set(&seq[2], "tls13 quic iv",
  827.                       &next->client.iv, &next->client.secret);
  828.     ngx_quic_hkdf_set(&seq[3], "tls13 quic ku",
  829.                       &next->server.secret, &current->server.secret);
  830.     ngx_quic_hkdf_set(&seq[4], "tls13 quic key",
  831.                       &server_key, &next->server.secret);
  832.     ngx_quic_hkdf_set(&seq[5], "tls13 quic iv",
  833.                       &next->server.iv, &next->server.secret);

  835.     for (i = 0; i < (sizeof(seq) / sizeof(seq[0])); i++) {
  836.         if (ngx_quic_hkdf_expand(&seq[i], ciphers.d, c->log) != NGX_OK) {
  837.             goto failed;
  838.         }
  839.     }

  841.     if (ngx_quic_crypto_init(ciphers.c, &next->client, &client_key, 0, c->log)
  842.         == NGX_ERROR)
  843.     {
  844.         goto failed;
  845.     }

  847.     if (ngx_quic_crypto_init(ciphers.c, &next->server, &server_key, 1, c->log)
  848.         == NGX_ERROR)
  849.     {
  850.         goto failed;
  851.     }

  853.     ngx_explicit_memzero(current->client.secret.data,
  854.                          current->client.secret.len);
  855.     ngx_explicit_memzero(current->server.secret.data,
  856.                          current->server.secret.len);

  858.     current->client.secret.len = 0;
  859.     current->server.secret.len = 0;

  861.     ngx_explicit_memzero(client_key.data, client_key.len);
  862.     ngx_explicit_memzero(server_key.data, server_key.len);

  864.     return;

  866. failed:

  868.     ngx_quic_close_connection(c, NGX_ERROR);
  869. }


  872. void
  873. ‌ngx_quic_keys_cleanup(ngx_quic_keys_t *keys)
  874. {
  875.     ngx_uint_t           i;
  876.     ngx_quic_secrets_t  *next;

  878.     for (i = 0; i < NGX_QUIC_ENCRYPTION_LAST; i++) {
  879.         ngx_quic_keys_discard(keys, i);
  880.     }

  882.     next = &keys->next_key;

  884.     ngx_quic_crypto_cleanup(&next->client);
  885.     ngx_quic_crypto_cleanup(&next->server);

  887.     if (next->client.secret.len) {
  888.         ngx_explicit_memzero(next->client.secret.data,
  889.                              next->client.secret.len);
  890.         next->client.secret.len = 0;
  891.     }

  893.     if (next->server.secret.len) {
  894.         ngx_explicit_memzero(next->server.secret.data,
  895.                              next->server.secret.len);
  896.         next->server.secret.len = 0;
  897.     }
  898. }


  901. static ngx_int_t
  902. ‌ngx_quic_create_packet(ngx_quic_header_t *pkt, ngx_str_t *res)
  903. {
  904.     u_char             *pnp, *sample;
  905.     ngx_str_t           ad, out;
  906.     ngx_uint_t          i;
  907.     ngx_quic_secret_t  *secret;
  908.     u_char              nonce[NGX_QUIC_IV_LEN], mask[NGX_QUIC_HP_LEN];

  910.     ad.data = res->data;
  911.     ad.len = ngx_quic_create_header(pkt, ad.data, &pnp);

  913.     out.len = pkt->payload.len + NGX_QUIC_TAG_LEN;
  914.     out.data = res->data + ad.len;

  916. #ifdef NGX_QUIC_DEBUG_CRYPTO
  917.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  918.                    "quic ad len:%uz %xV", ad.len, &ad);
  919. #endif

  921.     secret = &pkt->keys->secrets[pkt->level].server;

  923.     ngx_memcpy(nonce, secret->iv.data, secret->iv.len);
  924.     ngx_quic_compute_nonce(nonce, sizeof(nonce), pkt->number);

  926.     if (ngx_quic_crypto_seal(secret, &out, nonce, &pkt->payload, &ad, pkt->log)
  927.         != NGX_OK)
  928.     {
  929.         return NGX_ERROR;
  930.     }

  932.     sample = &out.data[4 - pkt->num_len];
  933.     if (ngx_quic_crypto_hp(secret, mask, sample, pkt->log) != NGX_OK) {
  934.         return NGX_ERROR;
  935.     }

  937.     /* RFC 9001, 5.4.1.  Header Protection Application */
  938.     ad.data[0] ^= mask[0] & ngx_quic_pkt_hp_mask(pkt->flags);

  940.     for (i = 0; i < pkt->num_len; i++) {
  941.         pnp[i] ^= mask[i + 1];
  942.     }

  944.     res->len = ad.len + out.len;

  946.     return NGX_OK;
  947. }


  950. static ngx_int_t
  951. ‌ngx_quic_create_retry_packet(ngx_quic_header_t *pkt, ngx_str_t *res)
  952. {
  953.     u_char              *start;
  954.     ngx_str_t            ad, itag;
  955.     ngx_quic_secret_t    secret;
  956.     ngx_quic_ciphers_t   ciphers;

  958.     /* 5.8.  Retry Packet Integrity */
  959.     static ngx_quic_md_t  key = ngx_quic_md(
  960.         "\xbe\x0c\x69\x0b\x9f\x66\x57\x5a\x1d\x76\x6b\x54\xe3\x68\xc8\x4e");
  961.     static const u_char   nonce[NGX_QUIC_IV_LEN] =
  962.         "\x46\x15\x99\xd3\x5d\x63\x2b\xf2\x23\x98\x25\xbb";
  963.     static ngx_str_t      in = ngx_string("");

  965.     ad.data = res->data;
  966.     ad.len = ngx_quic_create_retry_itag(pkt, ad.data, &start);

  968.     itag.data = ad.data + ad.len;
  969.     itag.len = NGX_QUIC_TAG_LEN;

  971. #ifdef NGX_QUIC_DEBUG_CRYPTO
  972.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  973.                    "quic retry itag len:%uz %xV", ad.len, &ad);
  974. #endif

  976.     if (ngx_quic_ciphers(NGX_QUIC_INITIAL_CIPHER, &ciphers) == NGX_ERROR) {
  977.         return NGX_ERROR;
  978.     }

  980.     secret.iv.len = NGX_QUIC_IV_LEN;

  982.     if (ngx_quic_crypto_init(ciphers.c, &secret, &key, 1, pkt->log)
  983.         == NGX_ERROR)
  984.     {
  985.         return NGX_ERROR;
  986.     }

  988.     if (ngx_quic_crypto_seal(&secret, &itag, nonce, &in, &ad, pkt->log)
  989.         != NGX_OK)
  990.     {
  991.         ngx_quic_crypto_cleanup(&secret);
  992.         return NGX_ERROR;
  993.     }

  995.     ngx_quic_crypto_cleanup(&secret);

  997.     res->len = itag.data + itag.len - start;
  998.     res->data = start;

  1000.     return NGX_OK;
  1001. }


  1004. ngx_int_t
  1005. ‌ngx_quic_derive_key(ngx_log_t *log, const char *label, ngx_str_t *secret,
  1006.     ngx_str_t *salt, u_char *out, size_t len)
  1007. {
  1008.     size_t         is_len, info_len;
  1009.     uint8_t       *p;
  1010.     const EVP_MD  *digest;

  1012.     uint8_t        is[SHA256_DIGEST_LENGTH];
  1013.     uint8_t        info[20];

  1015.     digest = EVP_sha256();
  1016.     is_len = SHA256_DIGEST_LENGTH;

  1018.     if (ngx_hkdf_extract(is, &is_len, digest, secret->data, secret->len,
  1019.                          salt->data, salt->len)
  1020.         != NGX_OK)
  1021.     {
  1022.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  1023.                       "ngx_hkdf_extract(%s) failed", label);
  1024.         return NGX_ERROR;
  1025.     }

  1027.     info[0] = 0;
  1028.     info[1] = len;
  1029.     info[2] = ngx_strlen(label);

  1031.     info_len = 2 + 1 + info[2] + 1;

  1033.     if (info_len >= 20) {
  1034.         ngx_log_error(NGX_LOG_INFO, log, 0,
  1035.                       "ngx_quic_create_key label \"%s\" too long", label);
  1036.         return NGX_ERROR;
  1037.     }

  1039.     p = ngx_cpymem(&info[3], label, info[2]);
  1040.     *p = '\0';

  1042.     if (ngx_hkdf_expand(out, len, digest, is, is_len, info, info_len) != NGX_OK)
  1043.     {
  1044.         ngx_ssl_error(NGX_LOG_INFO, log, 0,
  1045.                       "ngx_hkdf_expand(%s) failed", label);
  1046.         return NGX_ERROR;
  1047.     }

  1049.     return NGX_OK;
  1050. }


  1053. static uint64_t
  1054. ‌ngx_quic_parse_pn(u_char **pos, ngx_int_t len, u_char *mask,
  1055.     uint64_t *largest_pn)
  1056. {
  1057.     u_char    *p;
  1058.     uint64_t   truncated_pn, expected_pn, candidate_pn;
  1059.     uint64_t   pn_nbits, pn_win, pn_hwin, pn_mask;

  1061.     pn_nbits = ngx_min(len * 8, 62);

  1063.     p = *pos;
  1064.     truncated_pn = *p++ ^ *mask++;

  1066.     while (--len) {
  1067.         truncated_pn = (truncated_pn << 8) + (*p++ ^ *mask++);
  1068.     }

  1070.     *pos = p;

  1072.     expected_pn = *largest_pn + 1;
  1073.     pn_win = 1ULL << pn_nbits;
  1074.     pn_hwin = pn_win / 2;
  1075.     pn_mask = pn_win - 1;

  1077.     candidate_pn = (expected_pn & ~pn_mask) | truncated_pn;

  1079.     if ((int64_t) candidate_pn <= (int64_t) (expected_pn - pn_hwin)
  1080.         && candidate_pn < (1ULL << 62) - pn_win)
  1081.     {
  1082.         candidate_pn += pn_win;

  1084.     } else if (candidate_pn > expected_pn + pn_hwin
  1085.                && candidate_pn >= pn_win)
  1086.     {
  1087.         candidate_pn -= pn_win;
  1088.     }

  1090.     *largest_pn = ngx_max((int64_t) *largest_pn, (int64_t) candidate_pn);

  1092.     return candidate_pn;
  1093. }


  1096. void
  1097. ‌ngx_quic_compute_nonce(u_char *nonce, size_t len, uint64_t pn)
  1098. {
  1099.     nonce[len - 8] ^= (pn >> 56) & 0x3f;
  1100.     nonce[len - 7] ^= (pn >> 48) & 0xff;
  1101.     nonce[len - 6] ^= (pn >> 40) & 0xff;
  1102.     nonce[len - 5] ^= (pn >> 32) & 0xff;
  1103.     nonce[len - 4] ^= (pn >> 24) & 0xff;
  1104.     nonce[len - 3] ^= (pn >> 16) & 0xff;
  1105.     nonce[len - 2] ^= (pn >> 8) & 0xff;
  1106.     nonce[len - 1] ^= pn & 0xff;
  1107. }


  1110. ngx_int_t
  1111. ‌ngx_quic_encrypt(ngx_quic_header_t *pkt, ngx_str_t *res)
  1112. {
  1113.     if (ngx_quic_pkt_retry(pkt->flags)) {
  1114.         return ngx_quic_create_retry_packet(pkt, res);
  1115.     }

  1117.     return ngx_quic_create_packet(pkt, res);
  1118. }


  1121. ngx_int_t
  1122. ‌ngx_quic_decrypt(ngx_quic_header_t *pkt, uint64_t *largest_pn)
  1123. {
  1124.     u_char             *p, *sample;
  1125.     size_t              len;
  1126.     uint64_t            pn, lpn;
  1127.     ngx_int_t           pnl;
  1128.     ngx_str_t           in, ad;
  1129.     ngx_uint_t          key_phase;
  1130.     ngx_quic_secret_t  *secret;
  1131.     uint8_t             nonce[NGX_QUIC_IV_LEN], mask[NGX_QUIC_HP_LEN];

  1133.     secret = &pkt->keys->secrets[pkt->level].client;

  1135.     p = pkt->raw->pos;
  1136.     len = pkt->data + pkt->len - p;

  1138.     /*
  1139.      * RFC 9001, 5.4.2. Header Protection Sample
  1140.      *           5.4.3. AES-Based Header Protection
  1141.      *           5.4.4. ChaCha20-Based Header Protection
  1142.      *
  1143.      * the Packet Number field is assumed to be 4 bytes long
  1144.      * AES and ChaCha20 algorithms sample 16 bytes
  1145.      */

  1147.     if (len < NGX_QUIC_TAG_LEN + 4) {
  1148.         return NGX_DECLINED;
  1149.     }

  1151.     sample = p + 4;

  1153.     /* header protection */

  1155.     if (ngx_quic_crypto_hp(secret, mask, sample, pkt->log) != NGX_OK) {
  1156.         return NGX_DECLINED;
  1157.     }

  1159.     pkt->flags ^= mask[0] & ngx_quic_pkt_hp_mask(pkt->flags);

  1161.     if (ngx_quic_short_pkt(pkt->flags)) {
  1162.         key_phase = (pkt->flags & NGX_QUIC_PKT_KPHASE) != 0;

  1164.         if (key_phase != pkt->key_phase) {
  1165.             if (pkt->keys->next_key.client.ctx != NULL) {
  1166.                 secret = &pkt->keys->next_key.client;
  1167.                 pkt->key_update = 1;

  1169.             } else {
  1170.                 /*
  1171.                  * RFC 9001,  6.3. Timing of Receive Key Generation.
  1172.                  *
  1173.                  * Trial decryption to avoid timing side-channel.
  1174.                  */
  1175.                 ngx_log_debug0(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1176.                                "quic next key missing");
  1177.             }
  1178.         }
  1179.     }

  1181.     lpn = *largest_pn;

  1183.     pnl = (pkt->flags & 0x03) + 1;
  1184.     pn = ngx_quic_parse_pn(&p, pnl, &mask[1], &lpn);

  1186.     pkt->pn = pn;

  1188.     ngx_log_debug1(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1189.                    "quic packet rx clearflags:%xd", pkt->flags);
  1190.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1191.                    "quic packet rx number:%uL len:%xi", pn, pnl);

  1193.     /* packet protection */

  1195.     in.data = p;
  1196.     in.len = len - pnl;

  1198.     ad.len = p - pkt->data;
  1199.     ad.data = pkt->plaintext;

  1201.     ngx_memcpy(ad.data, pkt->data, ad.len);
  1202.     ad.data[0] = pkt->flags;

  1204.     do {
  1205.         ad.data[ad.len - pnl] = pn >> (8 * (pnl - 1)) % 256;
  1206.     } while (--pnl);

  1208.     ngx_memcpy(nonce, secret->iv.data, secret->iv.len);
  1209.     ngx_quic_compute_nonce(nonce, sizeof(nonce), pn);

  1211. #ifdef NGX_QUIC_DEBUG_CRYPTO
  1212.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1213.                    "quic ad len:%uz %xV", ad.len, &ad);
  1214. #endif

  1216.     pkt->payload.len = in.len - NGX_QUIC_TAG_LEN;
  1217.     pkt->payload.data = pkt->plaintext + ad.len;

  1219.     if (ngx_quic_crypto_open(secret, &pkt->payload, nonce, &in, &ad, pkt->log)
  1220.         != NGX_OK)
  1221.     {
  1222.         return NGX_DECLINED;
  1223.     }

  1225.     if (pkt->payload.len == 0) {
  1226.         /*
  1227.          * RFC 9000, 12.4.  Frames and Frame Types
  1228.          *
  1229.          * An endpoint MUST treat receipt of a packet containing no
  1230.          * frames as a connection error of type PROTOCOL_VIOLATION.
  1231.          */
  1232.         ngx_log_error(NGX_LOG_INFO, pkt->log, 0, "quic zero-length packet");
  1233.         pkt->error = NGX_QUIC_ERR_PROTOCOL_VIOLATION;
  1234.         return NGX_ERROR;
  1235.     }

  1237.     if (pkt->flags & ngx_quic_pkt_rb_mask(pkt->flags)) {
  1238.         /*
  1239.          * RFC 9000, Reserved Bits
  1240.          *
  1241.          * An endpoint MUST treat receipt of a packet that has
  1242.          * a non-zero value for these bits, after removing both
  1243.          * packet and header protection, as a connection error
  1244.          * of type PROTOCOL_VIOLATION.
  1245.          */
  1246.         ngx_log_error(NGX_LOG_INFO, pkt->log, 0,
  1247.                       "quic reserved bit set in packet");
  1248.         pkt->error = NGX_QUIC_ERR_PROTOCOL_VIOLATION;
  1249.         return NGX_ERROR;
  1250.     }

  1252. #if defined(NGX_QUIC_DEBUG_CRYPTO) && defined(NGX_QUIC_DEBUG_PACKETS)
  1253.     ngx_log_debug2(NGX_LOG_DEBUG_EVENT, pkt->log, 0,
  1254.                    "quic packet payload len:%uz %xV",
  1255.                    pkt->payload.len, &pkt->payload);
  1256. #endif

  1258.     *largest_pn = lpn;

  1260.     return NGX_OK;
  1261. }

One Level Up Top Level