TLS 1.3: Fix anti replay fail from GnuTLS #6788
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
yuhaoth
force-pushed
the
pr/fix-gnutls_anti_replay_fail
branch
8 times, most recently
from
0b842fc to
8edc501
Compare
yuhaoth
added
bug
component-tls13
needs-review
yuhaoth
force-pushed
the
pr/fix-gnutls_anti_replay_fail
branch
2 times, most recently
from
4eb83db to
304fb38
Compare
yuhaoth
force-pushed
the
pr/fix-gnutls_anti_replay_fail
branch
from
304fb38 to
b62df4f
Compare
xkqian
suggested changes
Jan 3, 2023
yuhaoth
force-pushed
the
pr/fix-gnutls_anti_replay_fail
branch
from
6eb846c to
0551d8d
Compare
ronald-cron-arm
requested changes
Jan 6, 2023
yuhaoth
force-pushed
the
pr/fix-gnutls_anti_replay_fail
branch
from
0551d8d to
3717758
Compare
3 tasks
yuhaoth
added
needs-preceding-pr
yuhaoth
force-pushed
the
pr/fix-gnutls_anti_replay_fail
branch
3 times, most recently
from
c9487a0 to
6da4268
Compare
yuhaoth
force-pushed
the
pr/fix-gnutls_anti_replay_fail
branch
from
6da4268 to
30e2973
Compare
The unit of ticket time has been changed to milliseconds. And age difference might be negative Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Also add comments for age cast Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
- fix CI failure due to wrong usage of ticket_lifetime - Improve document and comments Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Also add comments for age cast Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
- improve change log entry - improve comments - remove unnecessary statement - change type of client_age Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
The output has been changed Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>
yuhaoth
force-pushed
the
pr/fix-gnutls_anti_replay_fail
branch
from
2721fd3 to
aa5dc24
Compare
|
Rebased to resolve conflicts |
|
internal CI reports pip install fail and open CI pass |
ronald-cron-arm
approved these changes
Nov 21, 2023
daverodgman
added
approved
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
fix #6623
preceding-pr: #6891
ROOT CAUSE
TIME RESOLUTION OF TICKET AGE
The time precision of ticket_age is milliseconds(RFC 8446). But our precision is senconds, we caculate
ticket age with (mbedtls_time( NULL ) - ticket_recived)*1000 .
If the ticket is sent/received near the end of a second and client send ticket at the beggining of
next second, ticket age of client is 1000 ms, but ticket age of server is less than it. As a result,
it offends the anit replay ruler.
Workaround solution: Add 1 second to ticket_received and do reconnect 1 second later.
The issue can be reproduce and verified with #6712 . That PR include test script and test result.
This PR is to fix that.
ticket->startandticket->ticket_receivedThe commit is come from #6712 and verified in that PR
Gatekeeper checklist
I am not sure if it needs backport.
Notes for the submitter
Please refer to the contributing guidelines, especially the
checklist for PR contributors.