/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */ /* * Anti-replay measures for TLS 1.3. * * This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ #include "nss.h" /* for NSS_RegisterShutdown */ #include "nssilock.h" /* for PZMonitor */ #include "pk11pub.h" #include "prinit.h" /* for PR_CallOnce */ #include "prmon.h" #include "prtime.h" #include "secerr.h" #include "ssl.h" #include "sslbloom.h" #include "sslimpl.h" #include "tls13hkdf.h" static struct { /* Used to ensure that we only initialize the cleanup function once. */ PRCallOnceType init; /* Used to serialize access to the filters. */ PZMonitor *lock; /* The filters, use of which alternates. */ sslBloomFilter filters[2]; /* Which of the two filters is active (0 or 1). */ PRUint8 current; /* The time that we will next update. */ PRTime nextUpdate; /* The width of the window; i.e., the period of updates. */ PRTime window; /* This key ensures that the bloom filter index is unpredictable. */ PK11SymKey *key; } ssl_anti_replay; /* Clear the current state and free any resources we allocated. The signature * here is odd to allow this to be called during shutdown. */ static SECStatus tls13_AntiReplayReset(void *appData, void *nssData) { if (ssl_anti_replay.key) { PK11_FreeSymKey(ssl_anti_replay.key); ssl_anti_replay.key = NULL; } if (ssl_anti_replay.lock) { PZ_DestroyMonitor(ssl_anti_replay.lock); ssl_anti_replay.lock = NULL; } sslBloom_Destroy(&ssl_anti_replay.filters[0]); sslBloom_Destroy(&ssl_anti_replay.filters[1]); return SECSuccess; } static PRStatus tls13_AntiReplayInit(void) { SECStatus rv = NSS_RegisterShutdown(tls13_AntiReplayReset, NULL); if (rv != SECSuccess) { return PR_FAILURE; } return PR_SUCCESS; } static SECStatus tls13_AntiReplayKeyGen() { PRUint8 buf[32]; SECItem keyItem = { siBuffer, buf, sizeof(buf) }; PK11SlotInfo *slot; SECStatus rv; slot = PK11_GetInternalSlot(); if (!slot) { PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); return SECFailure; } rv = PK11_GenerateRandomOnSlot(slot, buf, sizeof(buf)); if (rv != SECSuccess) { goto loser; } ssl_anti_replay.key = PK11_ImportSymKey(slot, CKM_NSS_HKDF_SHA256, PK11_OriginUnwrap, CKA_DERIVE, &keyItem, NULL); if (!ssl_anti_replay.key) { goto loser; } PK11_FreeSlot(slot); return SECSuccess; loser: PK11_FreeSlot(slot); return SECFailure; } /* Set a limit on the combination of number of hashes and bits in each hash. */ #define SSL_MAX_BLOOM_FILTER_SIZE 64 /* * The structures created by this function can be called concurrently on * multiple threads if the server is multi-threaded. A monitor is used to * ensure that only one thread can access the structures that change over time, * but no such guarantee is provided for configuration data. * * Functions that read from static configuration data depend on there being a * memory barrier between the setup and use of this function. */ SECStatus SSLExp_SetupAntiReplay(PRTime window, unsigned int k, unsigned int bits) { SECStatus rv; if (k == 0 || bits == 0) { PORT_SetError(SEC_ERROR_INVALID_ARGS); return SECFailure; } if ((k * (bits + 7) / 8) > SSL_MAX_BLOOM_FILTER_SIZE) { PORT_SetError(SEC_ERROR_INVALID_ARGS); return SECFailure; } if (PR_SUCCESS != PR_CallOnce(&ssl_anti_replay.init, tls13_AntiReplayInit)) { PORT_SetError(SEC_ERROR_LIBRARY_FAILURE); return SECFailure; } (void)tls13_AntiReplayReset(NULL, NULL); ssl_anti_replay.lock = PZ_NewMonitor(nssILockSSL); if (!ssl_anti_replay.lock) { goto loser; /* Code already set. */ } rv = tls13_AntiReplayKeyGen(); if (rv != SECSuccess) { goto loser; /* Code already set. */ } rv = sslBloom_Init(&ssl_anti_replay.filters[0], k, bits); if (rv != SECSuccess) { goto loser; /* Code already set. */ } rv = sslBloom_Init(&ssl_anti_replay.filters[1], k, bits); if (rv != SECSuccess) { goto loser; /* Code already set. */ } /* When starting out, ensure that 0-RTT is not accepted until the window is * updated. A ClientHello might have been accepted prior to a restart. */ sslBloom_Fill(&ssl_anti_replay.filters[1]); ssl_anti_replay.current = 0; ssl_anti_replay.nextUpdate = ssl_TimeUsec() + window; ssl_anti_replay.window = window; return SECSuccess; loser: (void)tls13_AntiReplayReset(NULL, NULL); return SECFailure; } /* This is exposed to tests. Though it could, this doesn't take the lock on the * basis that those tests use thread confinement. */ void tls13_AntiReplayRollover(PRTime now) { ssl_anti_replay.current ^= 1; ssl_anti_replay.nextUpdate = now + ssl_anti_replay.window; sslBloom_Zero(ssl_anti_replay.filters + ssl_anti_replay.current); } static void tls13_AntiReplayUpdate() { PRTime now; PR_ASSERT_CURRENT_THREAD_IN_MONITOR(ssl_anti_replay.lock); now = ssl_TimeUsec(); if (now < ssl_anti_replay.nextUpdate) { return; } tls13_AntiReplayRollover(now); } PRBool tls13_InWindow(const sslSocket *ss, const sslSessionID *sid) { PRInt32 timeDelta; /* Calculate the difference between the client's view of the age of the * ticket (in |ss->xtnData.ticketAge|) and the server's view, which we now * calculate. The result should be close to zero. timeDelta is signed to * make the comparisons below easier. */ timeDelta = ss->xtnData.ticketAge - ((ssl_TimeUsec() - sid->creationTime) / PR_USEC_PER_MSEC); /* Only allow the time delta to be at most half of our window. This is * symmetrical, though it doesn't need to be; this assumes that clock errors * on server and client will tend to cancel each other out. * * There are two anti-replay filters that roll over each window. In the * worst case, immediately after a rollover of the filters, we only have a * single window worth of recorded 0-RTT attempts. Thus, the period in * which we can accept 0-RTT is at most one window wide. This uses PR_ABS() * and half the window so that the first attempt can be up to half a window * early and then replays will be caught until the attempts are half a * window late. * * For example, a 0-RTT attempt arrives early, but near the end of window 1. * The attempt is then recorded in window 1. Rollover to window 2 could * occur immediately afterwards. Window 1 is still checked for new 0-RTT * attempts for the remainder of window 2. Therefore, attempts to replay * are detected because the value is recorded in window 1. When rollover * occurs again, window 1 is erased and window 3 instated. If we allowed an * attempt to be late by more than half a window, then this check would not * prevent the same 0-RTT attempt from being accepted during window 1 and * later window 3. */ return PR_ABS(timeDelta) < (ssl_anti_replay.window / 2); } /* Checks for a duplicate in the two filters we have. Performs maintenance on * the filters as a side-effect. This only detects a probable replay, it's * possible that this will return true when the 0-RTT attempt is not genuinely a * replay. In that case, we reject 0-RTT unnecessarily, but that's OK because * no client expects 0-RTT to work every time. */ PRBool tls13_IsReplay(const sslSocket *ss, const sslSessionID *sid) { PRBool replay; unsigned int size; PRUint8 index; SECStatus rv; static const char *label = "tls13 anti-replay"; PRUint8 buf[SSL_MAX_BLOOM_FILTER_SIZE]; /* If SSL_SetupAntiReplay hasn't been called, then treat all attempts at * 0-RTT as a replay. */ if (!ssl_anti_replay.init.initialized) { return PR_TRUE; } if (!tls13_InWindow(ss, sid)) { return PR_TRUE; } size = ssl_anti_replay.filters[0].k * (ssl_anti_replay.filters[0].bits + 7) / 8; PORT_Assert(size <= SSL_MAX_BLOOM_FILTER_SIZE); rv = tls13_HkdfExpandLabelRaw(ssl_anti_replay.key, ssl_hash_sha256, ss->xtnData.pskBinder.data, ss->xtnData.pskBinder.len, label, strlen(label), buf, size); if (rv != SECSuccess) { return PR_TRUE; } PZ_EnterMonitor(ssl_anti_replay.lock); tls13_AntiReplayUpdate(); index = ssl_anti_replay.current; replay = sslBloom_Add(&ssl_anti_replay.filters[index], buf); if (!replay) { replay = sslBloom_Check(&ssl_anti_replay.filters[index ^ 1], buf); } PZ_ExitMonitor(ssl_anti_replay.lock); return replay; }