/* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- */

/*

 * Anti-replay measures for TLS 1.3.

 *

 * This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "nss.h"      /* for NSS_RegisterShutdown */

#include "nssilock.h" /* for PZMonitor */

#include "pk11pub.h"

#include "prinit.h" /* for PR_CallOnce */

#include "prmon.h"

#include "prtime.h"

#include "secerr.h"

#include "ssl.h"

#include "sslbloom.h"

#include "sslimpl.h"

#include "tls13hkdf.h"

static struct {

    /* Used to ensure that we only initialize the cleanup function once. */

    PRCallOnceType init;

    /* Used to serialize access to the filters. */

    PZMonitor *lock;

    /* The filters, use of which alternates. */

    sslBloomFilter filters[2];

    /* Which of the two filters is active (0 or 1). */

    PRUint8 current;

    /* The time that we will next update. */

    PRTime nextUpdate;

    /* The width of the window; i.e., the period of updates. */

    PRTime window;

    /* This key ensures that the bloom filter index is unpredictable. */

    PK11SymKey *key;

} ssl_anti_replay;

/* Clear the current state and free any resources we allocated. The signature

 * here is odd to allow this to be called during shutdown. */

static SECStatus

tls13_AntiReplayReset(void *appData, void *nssData)

{

    if (ssl_anti_replay.key) {

        PK11_FreeSymKey(ssl_anti_replay.key);

        ssl_anti_replay.key = NULL;

    }

    if (ssl_anti_replay.lock) {

        PZ_DestroyMonitor(ssl_anti_replay.lock);

        ssl_anti_replay.lock = NULL;

    }

    sslBloom_Destroy(&ssl_anti_replay.filters[0]);

    sslBloom_Destroy(&ssl_anti_replay.filters[1]);

    return SECSuccess;

}

static PRStatus

tls13_AntiReplayInit(void)

{

    SECStatus rv = NSS_RegisterShutdown(tls13_AntiReplayReset, NULL);

    if (rv != SECSuccess) {

        return PR_FAILURE;

    }

    return PR_SUCCESS;

}

static SECStatus

tls13_AntiReplayKeyGen()

{

    PRUint8 buf[32];

    SECItem keyItem = { siBuffer, buf, sizeof(buf) };

    PK11SlotInfo *slot;

    SECStatus rv;

    slot = PK11_GetInternalSlot();

    if (!slot) {

        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

        return SECFailure;

    }

    rv = PK11_GenerateRandomOnSlot(slot, buf, sizeof(buf));

    if (rv != SECSuccess) {

        goto loser;

    }

    ssl_anti_replay.key = PK11_ImportSymKey(slot, CKM_NSS_HKDF_SHA256,

                                            PK11_OriginUnwrap, CKA_DERIVE,

                                            &keyItem, NULL);

    if (!ssl_anti_replay.key) {

        goto loser;

    }

    PK11_FreeSlot(slot);

    return SECSuccess;

loser:

    PK11_FreeSlot(slot);

    return SECFailure;

}

/* Set a limit on the combination of number of hashes and bits in each hash. */

#define SSL_MAX_BLOOM_FILTER_SIZE 64

/*

 * The structures created by this function can be called concurrently on

 * multiple threads if the server is multi-threaded.  A monitor is used to

 * ensure that only one thread can access the structures that change over time,

 * but no such guarantee is provided for configuration data.

 *

 * Functions that read from static configuration data depend on there being a

 * memory barrier between the setup and use of this function.

 */

SECStatus

SSLExp_SetupAntiReplay(PRTime window, unsigned int k, unsigned int bits)

{

    SECStatus rv;

    if (k == 0 || bits == 0) {

        PORT_SetError(SEC_ERROR_INVALID_ARGS);

        return SECFailure;

    }

    if ((k * (bits + 7) / 8) > SSL_MAX_BLOOM_FILTER_SIZE) {

        PORT_SetError(SEC_ERROR_INVALID_ARGS);

        return SECFailure;

    }

    if (PR_SUCCESS != PR_CallOnce(&ssl_anti_replay.init,

                                  tls13_AntiReplayInit)) {

        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);

        return SECFailure;

    }

    (void)tls13_AntiReplayReset(NULL, NULL);

    ssl_anti_replay.lock = PZ_NewMonitor(nssILockSSL);

    if (!ssl_anti_replay.lock) {

        goto loser; /* Code already set. */

    }

    rv = tls13_AntiReplayKeyGen();

    if (rv != SECSuccess) {

        goto loser; /* Code already set. */

    }

    rv = sslBloom_Init(&ssl_anti_replay.filters[0], k, bits);

    if (rv != SECSuccess) {

        goto loser; /* Code already set. */

    }

    rv = sslBloom_Init(&ssl_anti_replay.filters[1], k, bits);

    if (rv != SECSuccess) {

        goto loser; /* Code already set. */

    }

    /* When starting out, ensure that 0-RTT is not accepted until the window is

     * updated.  A ClientHello might have been accepted prior to a restart. */

    sslBloom_Fill(&ssl_anti_replay.filters[1]);

    ssl_anti_replay.current = 0;

    ssl_anti_replay.nextUpdate = ssl_TimeUsec() + window;

    ssl_anti_replay.window = window;

    return SECSuccess;

loser:

    (void)tls13_AntiReplayReset(NULL, NULL);

    return SECFailure;

}

/* This is exposed to tests.  Though it could, this doesn't take the lock on the

 * basis that those tests use thread confinement. */

void

tls13_AntiReplayRollover(PRTime now)

{

    ssl_anti_replay.current ^= 1;

    ssl_anti_replay.nextUpdate = now + ssl_anti_replay.window;

    sslBloom_Zero(ssl_anti_replay.filters + ssl_anti_replay.current);

}

static void

tls13_AntiReplayUpdate()

{

    PRTime now;

    PR_ASSERT_CURRENT_THREAD_IN_MONITOR(ssl_anti_replay.lock);

    now = ssl_TimeUsec();

    if (now < ssl_anti_replay.nextUpdate) {

        return;

    }

    tls13_AntiReplayRollover(now);

}

PRBool

tls13_InWindow(const sslSocket *ss, const sslSessionID *sid)

{

    PRInt32 timeDelta;

    /* Calculate the difference between the client's view of the age of the

     * ticket (in |ss->xtnData.ticketAge|) and the server's view, which we now

     * calculate.  The result should be close to zero.  timeDelta is signed to

     * make the comparisons below easier. */

    timeDelta = ss->xtnData.ticketAge -

                ((ssl_TimeUsec() - sid->creationTime) / PR_USEC_PER_MSEC);

    /* Only allow the time delta to be at most half of our window.  This is

     * symmetrical, though it doesn't need to be; this assumes that clock errors

     * on server and client will tend to cancel each other out.

     *

     * There are two anti-replay filters that roll over each window.  In the

     * worst case, immediately after a rollover of the filters, we only have a

     * single window worth of recorded 0-RTT attempts.  Thus, the period in

     * which we can accept 0-RTT is at most one window wide.  This uses PR_ABS()

     * and half the window so that the first attempt can be up to half a window

     * early and then replays will be caught until the attempts are half a

     * window late.

     *

     * For example, a 0-RTT attempt arrives early, but near the end of window 1.

     * The attempt is then recorded in window 1.  Rollover to window 2 could

     * occur immediately afterwards.  Window 1 is still checked for new 0-RTT

     * attempts for the remainder of window 2.  Therefore, attempts to replay

     * are detected because the value is recorded in window 1.  When rollover

     * occurs again, window 1 is erased and window 3 instated.  If we allowed an

     * attempt to be late by more than half a window, then this check would not

     * prevent the same 0-RTT attempt from being accepted during window 1 and

     * later window 3.

     */

    return PR_ABS(timeDelta) < (ssl_anti_replay.window / 2);

}

/* Checks for a duplicate in the two filters we have.  Performs maintenance on

 * the filters as a side-effect. This only detects a probable replay, it's

 * possible that this will return true when the 0-RTT attempt is not genuinely a

 * replay.  In that case, we reject 0-RTT unnecessarily, but that's OK because

 * no client expects 0-RTT to work every time. */

PRBool

tls13_IsReplay(const sslSocket *ss, const sslSessionID *sid)

{

    PRBool replay;

    unsigned int size;

    PRUint8 index;

    SECStatus rv;

    static const char *label = "tls13 anti-replay";

    PRUint8 buf[SSL_MAX_BLOOM_FILTER_SIZE];

    /* If SSL_SetupAntiReplay hasn't been called, then treat all attempts at

     * 0-RTT as a replay. */

    if (!ssl_anti_replay.init.initialized) {

        return PR_TRUE;

    }

    if (!tls13_InWindow(ss, sid)) {

        return PR_TRUE;

    }

    size = ssl_anti_replay.filters[0].k *

           (ssl_anti_replay.filters[0].bits + 7) / 8;

    PORT_Assert(size <= SSL_MAX_BLOOM_FILTER_SIZE);

    rv = tls13_HkdfExpandLabelRaw(ssl_anti_replay.key, ssl_hash_sha256,

                                  ss->xtnData.pskBinder.data,

                                  ss->xtnData.pskBinder.len,

                                  label, strlen(label),

                                  buf, size);

    if (rv != SECSuccess) {

        return PR_TRUE;

    }

    PZ_EnterMonitor(ssl_anti_replay.lock);

    tls13_AntiReplayUpdate();

    index = ssl_anti_replay.current;

    replay = sslBloom_Add(&ssl_anti_replay.filters[index], buf);

    if (!replay) {

        replay = sslBloom_Check(&ssl_anti_replay.filters[index ^ 1],

                                buf);

    }

    PZ_ExitMonitor(ssl_anti_replay.lock);

    return replay;

}