tree ced9c4da9f37d6810ac4b2232a3e40797e39e8ca
parent 6bf2625ee0435a2d07e5609318a86c3ce1d533b6
author David Benjamin <davidben@google.com> 1732567384 -0500
committer Boringssl LUCI CQ <boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com> 1733416971 +0000

Check for message sequence overflow in DTLS

In DTLS 1.2, message sequence number overflow was impossible. The
counter reset on every handshake, and every handshake had a bounded
number of messages. (The counter reset was actually problematic. The end
of one handshake and the start of the next shared epochs, so sequence
numbers become ambiguous. 1.3 fixes this by removing the reset but, in
hindsight, resetting on each epoch would probably have been better.)

In DTLS 1.3, there is no bound and overflow is possible. Check for
overflow. Somewhat annoyingly, because we tend to store the next
sequence number, we actually need 17 bits per sequence number to
represent this, if we want to accept up to the maximum possible message.
Test this on the read side with KeyUpdate. (To test this on the write
side, we must be able to send KeyUpdate.)

Bug: 42290594
Change-Id: I691855dc72427afb9e82d8de0fb2eeea6818f2ea
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/73507
Reviewed-by: Nick Harper <nharper@chromium.org>
Commit-Queue: David Benjamin <davidben@google.com>