quic: select AEAD and header-protection cipher from negotiated suite

The built-in QUIC/H3 stack derived its packet-protection AEAD and
header-protection (HP) cipher from the length of the exported TLS 1.3
traffic secret alone: a 48-byte secret was treated as AES-256-GCM and
anything else as AES-128-GCM. ChaCha20-Poly1305 was never selected.

Per RFC 9001 (5.3, 5.4) the AEAD and HP algorithms are fixed by the
negotiated TLS 1.3 cipher suite, not by the secret length. Because
TLS_AES_128_GCM_SHA256 and TLS_CHACHA20_POLY1305_SHA256 both use SHA-256,
they produce identical 32-byte secrets, so a ChaCha20 handshake was
mis-keyed with AES header protection and failed ("reserved bits" /
decryption failure) whenever ChaCha20-Poly1305 was negotiated.

Make the choice cipher-suite aware:

  - add enum lws_tls_quic_aead and wsi->tls.quic_aead, reported by the
    TLS backend from the negotiated suite;
  - every QUIC-capable TLS backend now reports it from the negotiated
    cipher as the traffic secrets are installed:
      * mbedTLS: maps the negotiated TLS 1.3 ciphersuite id in the
        traffic-secret export callback (the suite is only available there
        mid-handshake; ssl->session, which
        mbedtls_ssl_get_ciphersuite_id_from_ssl() reads, is not yet set);
      * OpenSSL/BoringSSL/AWS-LC/LibreSSL: from the SSL_CIPHER handed to
        set_{read,write}_secret();
      * wolfSSL: from SSL_get_current_cipher() in set_encryption_secrets();
      * GnuTLS: from gnutls_cipher_get();
      * SChannel: from the SEC_TRAFFIC_SECRETS symmetric alg / key size;
  - lws_quic_set_keys() selects the internal cipher_type from the
    reported AEAD, falling back to the legacy length heuristic only when
    a backend does not report it (still correct for AES-128 vs AES-256
    GCM, blind to ChaCha20 as before).

The correct SHA-256/SHA-384 HKDF hash is still chosen from the secret
length, which is unambiguous (it mirrors the suite's PRF hash size).

Note: to build mbedtls support for quic/h3 after this patch, you
need to patch mbedtls with "Epoch 2" patches from
https://libwebsockets.org/git/mbedtls/log?h=development

Author: saghul

CMakeLists-implied-options.txt

@@ -451,6 +451,9 @@ if (LWS_WITHOUT_DAEMONIZE OR WIN32)
 	set(LWS_NO_DAEMONIZE 1)
 endif()
 
+if (LWS_IPV4)
+    set(LWS_WITH_IPV4 1)
+endif()
 if (LWS_IPV6)
 	set(LWS_WITH_IPV6 1)
 endif()

CMakeLists.txt

@@ -170,6 +170,7 @@ option(LWS_WITH_HTTP2 "Compile with server support for HTTP/2" ON)
 option(LWS_WITH_LS_QPACK "Compile tests against ls-qpack for correctness testing" OFF)
 option(LWS_WITH_LWSWS "Libwebsockets Webserver" OFF)
 option(LWS_WITH_CGI "Include CGI (spawn process with network-connected stdin/out/err) APIs" OFF)
+option(LWS_IPV4 "Compile with support for ipv4" ON)
 option(LWS_IPV6 "Compile with support for ipv6" ON)
 option(LWS_UNIX_SOCK "Compile with support for UNIX domain socket if OS supports it" ON)
 option(LWS_WITH_PLUGINS "Support plugins for protocols and extensions (implies LWS_WITH_PLUGINS_API)" OFF)

READMEs/README.quic.md

@@ -148,8 +148,9 @@ config string will append the mbedtls version with +LWSQUIC.
     ```bash
     cmake .. \
         -DLWS_WITH_MBEDTLS=ON \
-        -DMBEDTLS_INCLUDE_DIRS="/path/to/mbedtls/include" \
-        -DMBEDTLS_LIBRARIES="/path/to/mbedtls/library/libmbedcrypto.a;/path/to/mbedtls/library/libmbedx509.a;/path/to/mbedtls/library/libmbedtls.a" \
+        -DLWS_MBEDTLS_INCLUDE_DIRS="/path/to/mbedtls/include" \
+        -DLWS_MBEDTLS_LIBRARIES="/path/to/mbedtls/library/libmbedtls.a;/path/to/mbedtls/library/libmbedx509.a;/path/to/mbedtls/library/libmbedcrypto.a" \
+        -DLWS_MBEDTLS_TF_PSA_PATH="/path/to/mbedtls/tf-psa-crypto" \
         -DLWS_ROLE_QUIC=ON
     make -j
     ```

cmake/lws_config.h.in

@@ -202,6 +202,7 @@
 #cmakedefine LWS_WITH_HTTP_PROXY
 #cmakedefine LWS_WITH_HTTP_STREAM_COMPRESSION
 #cmakedefine LWS_WITH_HTTP_UNCOMMON_HEADERS
+#cmakedefine LWS_WITH_IPV4
 #cmakedefine LWS_WITH_IPV6
 #cmakedefine LWS_WITH_JOSE
 #cmakedefine LWS_WITH_CBOR

include/libwebsockets/lws-quic.h

@@ -38,6 +38,22 @@ enum lws_tls_quic_secret_type {
 	LWS_TLS_QUIC_SECRET_SERVER_APPLICATION,
 };
 
+/*
+ * RFC 9001 4.1 / 5.3 / 5.4: the QUIC packet-protection AEAD and the header-
+ * protection cipher are both fixed by the negotiated TLS 1.3 cipher suite, and
+ * cannot be inferred from the traffic-secret length alone (TLS_AES_128_GCM_
+ * SHA256 and TLS_CHACHA20_POLY1305_SHA256 both use SHA-256 and so produce a
+ * 32-byte secret).  The TLS backend reports the negotiated AEAD to the QUIC
+ * role via wsi->tls.quic_aead so the correct algorithms are selected.
+ */
+enum lws_tls_quic_aead {
+	LWS_TLS_QUIC_AEAD_UNKNOWN,	   /**< backend didn't report; caller
+					     * falls back to length heuristic */
+	LWS_TLS_QUIC_AEAD_AES_128_GCM,	   /**< TLS_AES_128_GCM_SHA256 */
+	LWS_TLS_QUIC_AEAD_AES_256_GCM,	   /**< TLS_AES_256_GCM_SHA384 */
+	LWS_TLS_QUIC_AEAD_CHACHA20_POLY1305, /**< TLS_CHACHA20_POLY1305_SHA256 */
+};
+
 enum lws_0rtt_status {
 	LWS_0RTT_STATUS_NONE,       /**< No 0-RTT attempted */
 	LWS_0RTT_STATUS_ATTEMPTED,  /**< Client sent 0-RTT, awaiting server decision */

lib/roles/quic/crypto-quic.c

@@ -39,6 +39,39 @@ static const uint8_t quic_v2_initial_salt[20] = {
 	0xf9, 0xbd, 0x2e, 0xd9
 };
 
+/*
+ * RFC 9001 5.3 / 5.4: the QUIC packet-protection AEAD and the header-protection
+ * cipher are both fixed by the negotiated TLS 1.3 cipher suite:
+ *
+ *   TLS_AES_128_GCM_SHA256       -> AEAD AES-128-GCM,       HP AES-128-ECB
+ *   TLS_AES_256_GCM_SHA384       -> AEAD AES-256-GCM,       HP AES-256-ECB
+ *   TLS_CHACHA20_POLY1305_SHA256 -> AEAD ChaCha20-Poly1305, HP ChaCha20
+ *
+ * They must NOT be inferred from the traffic-secret length: AES-128-GCM and
+ * ChaCha20-Poly1305 both use SHA-256, so both yield a 32-byte secret.  The TLS
+ * backend reports the negotiated AEAD in wsi->tls.quic_aead; only when it did
+ * not (LWS_TLS_QUIC_AEAD_UNKNOWN, e.g. a backend that doesn't plumb it through)
+ * do we fall back to the length heuristic, which can still tell AES-256-GCM
+ * (48-byte / SHA-384) from AES-128-GCM but is blind to ChaCha20.
+ *
+ * Maps to the internal cipher_type used throughout this file:
+ *   0 = AES-128-GCM, 1 = ChaCha20-Poly1305, 2 = AES-256-GCM.
+ */
+static uint8_t
+lws_quic_cipher_type(struct lws *wsi, size_t secret_len)
+{
+	switch (wsi->tls.quic_aead) {
+	case LWS_TLS_QUIC_AEAD_AES_128_GCM:
+		return 0;
+	case LWS_TLS_QUIC_AEAD_CHACHA20_POLY1305:
+		return 1;
+	case LWS_TLS_QUIC_AEAD_AES_256_GCM:
+		return 2;
+	default:
+		return (secret_len == 48) ? 2 : 0;
+	}
+}
+
 static int
 lws_quic_derive_key_iv_hp(uint8_t *secret, size_t secret_len, uint8_t cipher_type,
 			  uint8_t *iv, size_t iv_len,
@@ -265,7 +298,7 @@ lws_quic_set_keys(struct lws *wsi, enum lws_tls_quic_secret_type type, const uin
                 }
                 k->secret_len = secret_len > 48 ? 48 : secret_len;
                 memcpy(k->secret_rx, secret, k->secret_len);
-                if (k->cipher_type != 1) k->cipher_type = (k->secret_len == 48) ? 2 : 0;
+                k->cipher_type = lws_quic_cipher_type(wsi, k->secret_len);
                 if (lws_quic_derive_key_iv_hp(k->secret_rx, k->secret_len, k->cipher_type, k->iv_rx, sizeof(k->iv_rx),
                                               &k->el_aead_rx, k->key_aead_rx, &k->el_hp_rx, k->key_hp_rx))
                         return -1;
@@ -276,7 +309,7 @@ lws_quic_set_keys(struct lws *wsi, enum lws_tls_quic_secret_type type, const uin
                 }
                 k->secret_len = secret_len > 48 ? 48 : secret_len;
                 memcpy(k->secret_tx, secret, k->secret_len);
-                if (k->cipher_type != 1) k->cipher_type = (k->secret_len == 48) ? 2 : 0;
+                k->cipher_type = lws_quic_cipher_type(wsi, k->secret_len);
                 if (lws_quic_derive_key_iv_hp(k->secret_tx, k->secret_len, k->cipher_type, k->iv_tx, sizeof(k->iv_tx),
                                               &k->el_aead_tx, k->key_aead_tx, &k->el_hp_tx, k->key_hp_tx))
                         return -1;

lib/tls/gnutls/gnutls-quic.c

@@ -72,6 +72,27 @@ gnutls_quic_secret_func(gnutls_session_t session,
 	if (!wsi || !wsi->tls.quic_secret_cb || secret_size > 48)
 		return 0;
 
+	/*
+	 * RFC 9001: report the negotiated AEAD so the QUIC role selects the
+	 * matching packet-protection and header-protection ciphers instead of
+	 * guessing from the secret length (AES-128-GCM and ChaCha20-Poly1305
+	 * both yield a 32-byte SHA-256 secret).
+	 */
+	switch (gnutls_cipher_get(session)) {
+	case GNUTLS_CIPHER_AES_128_GCM:
+		wsi->tls.quic_aead = LWS_TLS_QUIC_AEAD_AES_128_GCM;
+		break;
+	case GNUTLS_CIPHER_AES_256_GCM:
+		wsi->tls.quic_aead = LWS_TLS_QUIC_AEAD_AES_256_GCM;
+		break;
+	case GNUTLS_CIPHER_CHACHA20_POLY1305:
+		wsi->tls.quic_aead = LWS_TLS_QUIC_AEAD_CHACHA20_POLY1305;
+		break;
+	default:
+		/* leave any previously-reported suite in force */
+		break;
+	}
+
 	if (wsi->a.vhost)
 		is_client = lwsi_role_client(wsi) ? 1 : 0;
 	else

lib/tls/mbedtls/mbedtls-quic.c

@@ -24,6 +24,7 @@
 
 #include "private-lib-core.h"
 #include "private-lib-tls-mbedtls.h"
+#include <mbedtls/ssl_ciphersuites.h>
 
 void
 mbedtls_quic_bio_free(struct lws *wsi);
@@ -113,7 +114,8 @@ mbedtls_quic_set_traffic_secrets(mbedtls_ssl_context *ssl,
 			    mbedtls_ssl_secret_type_t type,
 			    const unsigned char *client_secret,
 			    const unsigned char *server_secret,
-			    size_t secret_len)
+			    size_t secret_len,
+			    int ciphersuite_id)
 {
 	struct lws *wsi = (struct lws *)mbedtls_ssl_get_user_data_p(ssl);
 	enum lws_tls_quic_secret_type ct, st;
@@ -124,6 +126,30 @@ mbedtls_quic_set_traffic_secrets(mbedtls_ssl_context *ssl,
 	if (wsi->tls.quic_secret_cb == (lws_tls_quic_secret_cb)1)
 		return 0;
 
+	/*
+	 * RFC 9001: the QUIC AEAD and header-protection algorithms are fixed
+	 * by the negotiated TLS 1.3 cipher suite, not by the secret length
+	 * (AES-128-GCM and ChaCha20-Poly1305 both use a 32-byte SHA-256
+	 * secret).  Record which one is in force so the QUIC role selects the
+	 * matching AEAD / HP cipher.  The negotiated suite is only available
+	 * here via the export callback: mbedtls_ssl_get_ciphersuite_id_from_
+	 * ssl() reads ssl->session, which is not yet populated mid-handshake.
+	 */
+	switch (ciphersuite_id) {
+	case MBEDTLS_TLS1_3_AES_128_GCM_SHA256:
+		wsi->tls.quic_aead = LWS_TLS_QUIC_AEAD_AES_128_GCM;
+		break;
+	case MBEDTLS_TLS1_3_AES_256_GCM_SHA384:
+		wsi->tls.quic_aead = LWS_TLS_QUIC_AEAD_AES_256_GCM;
+		break;
+	case MBEDTLS_TLS1_3_CHACHA20_POLY1305_SHA256:
+		wsi->tls.quic_aead = LWS_TLS_QUIC_AEAD_CHACHA20_POLY1305;
+		break;
+	default:
+		/* leave any previously-reported suite in force */
+		break;
+	}
+
 	switch (type) {
 	case MBEDTLS_SSL_SECRET_TYPE_EARLY:
 		ct = st = LWS_TLS_QUIC_SECRET_CLIENT_EARLY;

lib/tls/openssl/openssl-quic.c

@@ -33,6 +33,30 @@
 
 #if defined(LWS_HAVE_BORINGSSL_QUIC_API)
 
+/*
+ * RFC 9001: the QUIC AEAD and header-protection ciphers are fixed by the
+ * negotiated TLS 1.3 cipher suite, not by the traffic-secret length
+ * (AES-128-GCM and ChaCha20-Poly1305 both use a 32-byte SHA-256 secret).  Map
+ * the negotiated suite's IANA code point to the enum the QUIC role consumes.
+ * SSL_CIPHER_get_id() returns 0x0300<id> on OpenSSL/BoringSSL, so mask to the
+ * low 16 bits; an unrecognised id leaves LWS_TLS_QUIC_AEAD_UNKNOWN and the QUIC
+ * role falls back to its length heuristic.
+ */
+static enum lws_tls_quic_aead
+lws_openssl_quic_aead_from_id(uint32_t cipher_id)
+{
+	switch (cipher_id & 0xffff) {
+	case 0x1301: /* TLS_AES_128_GCM_SHA256 */
+		return LWS_TLS_QUIC_AEAD_AES_128_GCM;
+	case 0x1302: /* TLS_AES_256_GCM_SHA384 */
+		return LWS_TLS_QUIC_AEAD_AES_256_GCM;
+	case 0x1303: /* TLS_CHACHA20_POLY1305_SHA256 */
+		return LWS_TLS_QUIC_AEAD_CHACHA20_POLY1305;
+	default:
+		return LWS_TLS_QUIC_AEAD_UNKNOWN;
+	}
+}
+
 #if defined(USE_WOLFSSL)
 
 static int
@@ -43,10 +67,21 @@ set_encryption_secrets(WOLFSSL *ssl, enum wolfssl_encryption_level_t level,
 {
 	struct lws *wsi = (struct lws *)SSL_get_app_data((SSL *)ssl);
 	enum lws_tls_quic_secret_type rt, wt;
+	const SSL_CIPHER *c;
 
 	if (!wsi || secret_len > 48)
 		return 0;
 
+	/*
+	 * Report the negotiated AEAD (see lws_openssl_quic_aead_from_id). The
+	 * wolfSSL callback carries no cipher, so query the negotiated one via
+	 * the OpenSSL-compat API this file already uses for wolfSSL.
+	 */
+	c = SSL_get_current_cipher((SSL *)ssl);
+	if (c)
+		wsi->tls.quic_aead = lws_openssl_quic_aead_from_id(
+					(uint32_t)SSL_CIPHER_get_id(c));
+
 	switch (level) {
 	case wolfssl_encryption_early_data:
 		rt = LWS_TLS_QUIC_SECRET_CLIENT_EARLY;
@@ -150,6 +185,11 @@ set_read_secret(SSL *ssl, enum ssl_encryption_level_t level,
 	if (!wsi || secret_len > 48)
 		return 0;
 
+	/* Report the negotiated AEAD (see lws_openssl_quic_aead_from_id). */
+	if (cipher)
+		wsi->tls.quic_aead = lws_openssl_quic_aead_from_id(
+					(uint32_t)SSL_CIPHER_get_id(cipher));
+
 	switch (level) {
 	case ssl_encryption_early_data:
 		t = LWS_TLS_QUIC_SECRET_CLIENT_EARLY;
@@ -181,6 +221,11 @@ set_write_secret(SSL *ssl, enum ssl_encryption_level_t level,
 	if (!wsi || secret_len > 48)
 		return 0;
 
+	/* Report the negotiated AEAD (see lws_openssl_quic_aead_from_id). */
+	if (cipher)
+		wsi->tls.quic_aead = lws_openssl_quic_aead_from_id(
+					(uint32_t)SSL_CIPHER_get_id(cipher));
+
 	switch (level) {
 	case ssl_encryption_early_data:
 		t = LWS_TLS_QUIC_SECRET_CLIENT_EARLY;

lib/tls/private-network.h

@@ -131,6 +131,9 @@ struct lws_lws_tls {
 	size_t			quic_tp_send_len;
 	lws_tls_quic_secret_cb	quic_secret_cb;
 	int			quic_alert;
+	uint8_t			quic_aead; /* enum lws_tls_quic_aead, set by the
+					    * TLS backend from the negotiated
+					    * TLS 1.3 cipher suite */
 
 	unsigned int		use_ssl;
 	unsigned int		redirect_to_https:1;