@amritk/nish-x86_64-linux 0.17.0 → 0.20.0

package/std/net/tls-tcp.ts

@@ -26,13 +26,20 @@
  * stops asking to be written. An event with the hang-up bit (4) goes to
  * `readable`, which is where a closed or failed socket is noticed.
  *
- * **Slots, sized at start-up.** The constructor allocates every connection's
- * buffers — about 136 KB of resident memory each, the largest record twice
- * over in each direction and the handshake's own state (TLS-3) — and `accept` hands the next connection a free slot and
- * reuses it once the program `close`s it (WP34 N9). When every slot is busy
- * a new connection is accepted and closed at once, so the listener does not
- * stay readable; the program sees `TLS_TCP_POOL_FULL`. Each slot keeps its
- * own `TlsServer`, which `accept` restarts for the connection, so neither the
+ * **Slots, built on first use; record buffers, borrowed.** The pool's size
+ * is a cap: the constructor builds no slot, and the first `accept` into a
+ * slot builds its handshake state and keys (TLS-3) and keeps them, so a pool
+ * sized for its peak costs at start-up only what does not depend on the
+ * size. `accept` hands the next connection the slot closed last, or failing
+ * that the next never used, and reuses it once the program `close`s it
+ * (WP34 N9). The record buffers — the bytes to send, the plaintext waiting
+ * for the program, the record being opened and the record being read — are
+ * borrowed from pools this server owns while a connection uses the slot, and
+ * given back zeroed (`BufferPool.giveSecret`) when it ends, so a free slot
+ * holds none of them ("What moves between connections" in
+ * `docs/security/tls.md`). When every slot is busy a new connection is
+ * accepted and closed at once, so the listener does not stay readable; the
+ * program sees `TLS_TCP_POOL_FULL`. Each slot keeps its own `TlsServer`, which `accept` restarts for the connection, so neither the
  * handshake nor application data allocates anything that outlives a call:
  * a thousand connections through one slot leave `Arena.mark()` where the
  * first left it, under every suite (TLS-3 in `docs/security/tls.md`,
@@ -50,6 +57,15 @@
  * borrows for the call, and `signatureInput` / `sign` hand the input out and
  * take any signature back.
  *
+ * **Resumption is opt-in, and its keys are the caller's.** After
+ * `enableTickets`, a slot whose interest says `TLS_RECORD_TICKET` waits on
+ * the program: in the handshake, `resume` reads the ClientHello's tickets
+ * under the current and previous ticket keys and a strike register the
+ * program lends for the call, and answers the hello resumed or in full; once
+ * the connection is open, `issue` seals it one ticket. The pool keeps no
+ * ticket key and no register of its own (`docs/security/tls.md`,
+ * "Resumption").
+ *
  * `read`, `write` and `close` answer as `nish:net`'s calls do — a count, `0`
  * at the end of the stream, `-11` to wait — so a program written against a
  * plain socket moves over with the `slot` in place of the descriptor.
@@ -61,14 +77,16 @@
  */
 import { Secret } from "nish:secret"
 import { netClose, netRead, netWrite, tcpAccept } from "nish:net"
-import { TlsServer, TlsServerConfig, tlsSignEcdsaP256 } from "nish/net/tls"
+import { TlsP256Signer, TlsServer, TlsServerConfig } from "nish/net/tls"
 import { TLS_ALERT_INTERNAL_ERROR } from "nish/net/tls/codec"
 import { TLS_MAX_RECORD } from "nish/net/tls/record"
+import { TlsTicketKeyInfo, TlsTicketStrikes } from "nish/net/tls/ticket"
 import {
   TLS_RECORD_AGAIN,
   TLS_RECORD_DONE,
   TLS_RECORD_INVALID,
   TLS_RECORD_STATE_FAILED,
+  TlsRecordPools,
   TlsRecordServer,
 } from "nish/net/tls/record-server"
 
@@ -95,57 +113,117 @@ const TLS_TCP_ADDRESS_SIZE: i32 = 18
  */
 export class TlsTcpServer {
   config: TlsServerConfig
-  /** The connections, one per slot, made once. */
+  /**
+   * The connections built so far, slot `k`'s at `k`: one per slot ever
+   * accepted into. `connection` never adds to it; a slot never built reads
+   * `vacant` instead.
+   */
   connections: TlsRecordServer[]
-  /** Each slot's descriptor, or -1 while the slot is free. */
+  /**
+   * Each slot's descriptor, or -1 while the slot is free, for the slots
+   * accepted into so far: its length is the high-water mark, and a slot past
+   * it has never been used.
+   */
   fds: i32[]
+  /**
+   * The slots closed since they were used, a stack whose top `accept` takes
+   * before it builds a slot past the high-water mark, so finding one costs
+   * the same with every slot free as with all but one busy.
+   */
+  free: i32[]
   /** Where the socket is read into before a connection takes the bytes: the largest record. */
   scratch: u8[]
   /** The last accepted peer's address, in `nish:net`'s 18-byte form. */
   peer: u8[]
+  /** Signs every slot's CertificateVerify in `signP256`, one for the pool, keeping nothing per signature. */
+  signer: TlsP256Signer
   /**
-   * Each slot's own copy of its connection's ephemeral key, so that wiping it
-   * can never reach an array the program has refilled for the next one.
+   * Each slot's own copy of its connection's server random: `TlsServer`
+   * keeps the array it is given and writes it into the ServerHello only once
+   * the ClientHello arrives, so the program's array may be refilled for the
+   * next one. The ephemeral key needs no copy here: `TlsServer.restart`
+   * copies it into the server's own `Secret` and wipes the array it was
+   * handed.
    */
-  keys: u8[][]
+  randoms: u8[][]
+  /** How many slots the pool may hold, which `size` answers. */
+  slots: i32 = 1
+  /** Whether `enableTickets` has run, so a slot built after it resumes too. */
+  tickets: boolean = false
   /**
-   * Each slot's own copy of its connection's server random, for the same
-   * reason: `TlsServer` keeps the array it is given and writes it into the
-   * ServerHello only once the ClientHello arrives.
+   * What `connection` answers for every slot never built: one failed
+   * connection no slot holds and every such slot shares, so the slot reads
+   * as a free one does (no ALPN, not open) and never as another slot's live
+   * session. Its first read allocates it, once per server; it has no
+   * tickets, and a caller must not change it.
    */
-  randoms: u8[][]
+  vacant: TlsRecordServer | null = null
+  /**
+   * The pools every slot borrows its record buffers from, each with a
+   * ceiling of one per slot: `lent()` is 0 once every connection has ended,
+   * and `made()` is the most connections that were ever open at once.
+   */
+  pools: TlsRecordPools
   /** The listening socket, which the program made with `tcpListen` and still owns. */
   listener: i32 = -1
 
   /**
    * A pool of `size` slots, at least one, serving `config` on `listener`, a
-   * socket `tcpListen` made. Every slot's buffers are allocated here.
+   * socket `tcpListen` made. No slot is built here: a slot's handshake state
+   * and its server random are allocated by the first `accept` into it and
+   * kept, and its record buffers are borrowed from `pools` while a
+   * connection uses them, so a pool sized for a peak costs at start-up only
+   * the read scratch, the signer and the empty pools.
    */
   constructor(config: TlsServerConfig, listener: i32, size: i32) {
     this.config = config
     this.listener = listener
     this.connections = []
     this.fds = []
-    this.keys = []
+    this.free = []
     this.randoms = []
-    const none: u8[] = []
-    const slots: i32 = size < 1 ? 1 : size
-    for (let k: i32 = 0; k < slots; k++) {
-      // Each slot's own handshake, refused by `TlsServer` for its empty
-      // randomness, so the slot starts out failed until `accept` restarts it
-      // for a connection; every later connection reuses its buffers.
-      this.connections.push(new TlsRecordServer(new TlsServer(config, none, none)))
-      this.fds.push(TLS_TCP_FREE)
-      this.keys.push(new Array<u8>(TLS_TCP_KEY_SIZE))
-      this.randoms.push(new Array<u8>(TLS_TCP_KEY_SIZE))
-    }
+    this.slots = size < 1 ? 1 : size
+    this.pools = new TlsRecordPools(this.slots)
     this.scratch = new Array<u8>(TLS_MAX_RECORD)
     this.peer = new Array<u8>(TLS_TCP_ADDRESS_SIZE)
+    this.signer = new TlsP256Signer()
   }
 
-  /** How many slots the pool has. */
+  /**
+   * The next slot's connection and server random, for the slot built next.
+   * Called by `accept` alone, as the pool's high-water mark rises: slot `k`'s
+   * entry must sit at index `k` of `connections` and `randoms`. Its handshake
+   * is never given a ClientHello: `accept` restarts it for a connection with
+   * real randomness, and every later connection reuses its state.
+   */
+  build(): TlsRecordServer {
+    const random: u8[] = new Array<u8>(TLS_TCP_KEY_SIZE)
+    this.randoms.push(random)
+    const conn: TlsRecordServer = this.make(random)
+    if (this.tickets) {
+      conn.tls.enableTickets()
+    }
+    this.connections.push(conn)
+    return conn
+  }
+
+  /**
+   * A connection over `random` that is marked failed without sealing an
+   * alert, so a stray call on it fails closed, and that borrows no buffer
+   * until a connection moves bytes through it.
+   */
+  make(random: u8[]): TlsRecordServer {
+    // A placeholder key for a first handshake, which never runs.
+    const zeros: u8[] = new Array<u8>(TLS_TCP_KEY_SIZE)
+    const conn: TlsRecordServer = new TlsRecordServer(new TlsServer(this.config, random, zeros))
+    conn.borrowFrom(this.pools)
+    conn.state = TLS_RECORD_STATE_FAILED
+    return conn
+  }
+
+  /** How many slots the pool has, built or not. */
   size(): i32 {
-    return toI32(this.fds.length)
+    return this.slots
   }
 
   /** How many slots hold a connection. */
@@ -172,11 +250,22 @@ export class TlsTcpServer {
   /**
    * The connection in `slot`: its state, its handshake (`tls`: suite, ALPN,
    * server name) and the alerts sent and received. A free slot answers the
-   * last connection it held.
+   * last connection it held. A slot never accepted into answers `vacant`,
+   * failed, as a free slot does, and builds no slot; a slot out of range
+   * names slot 0's.
    */
   connection(slot: i32): TlsRecordServer {
-    const at: i32 = slot >= 0 && slot < toI32(this.connections.length) ? slot : 0
-    return this.connections[at]
+    const index: i32 = slot >= 0 && slot < this.slots ? slot : 0
+    if (index >= 0 && index < toI32(this.connections.length)) {
+      return this.connections[index]
+    }
+    const vacant: TlsRecordServer | null = this.vacant
+    if (vacant !== null) {
+      return vacant
+    }
+    const made: TlsRecordServer = this.make(new Array<u8>(TLS_TCP_KEY_SIZE))
+    this.vacant = made
+    return made
   }
 
   /**
@@ -202,20 +291,25 @@ export class TlsTcpServer {
     if (fd < 0) {
       return fd
     }
-    let slot: i32 = -1
-    for (let k: i32 = 0; k < toI32(this.fds.length); k++) {
-      if (this.fds[k] < 0) {
-        slot = k
-        break
-      }
+    // A slot closed before is taken first, then the next never used, so the
+    // first accepts take slots 0, 1, 2 ... and a pool that never fills never
+    // builds its last slots.
+    let slot: i32 = TLS_TCP_POOL_FULL
+    if (this.free.length > 0) {
+      slot = this.free[this.free.length - 1]
+      this.free.pop()
+    } else if (toI32(this.fds.length) < this.slots) {
+      slot = toI32(this.fds.length)
+      this.fds.push(TLS_TCP_FREE)
     }
-    if (slot < 0) {
+    if (slot < 0 || slot >= toI32(this.fds.length)) {
       netClose(fd)
       return TLS_TCP_POOL_FULL
     }
+    const conn: TlsRecordServer =
+      slot < toI32(this.connections.length) ? this.connections[slot] : this.build()
     this.fds[slot] = fd
     const random: u8[] = this.randoms[slot]
-    const key: u8[] = this.keys[slot]
     for (
       let k: i32 = 0;
       k < TLS_TCP_KEY_SIZE && k < toI32(random.length) && k < toI32(serverRandom.length);
@@ -223,16 +317,8 @@ export class TlsTcpServer {
     ) {
       random[k] = serverRandom[k]
     }
-    for (
-      let k: i32 = 0;
-      k < TLS_TCP_KEY_SIZE && k < toI32(key.length) && k < toI32(ephemeralPrivate.length);
-      k++
-    ) {
-      key[k] = ephemeralPrivate[k]
-    }
-    secureZero(ephemeralPrivate)
-    const conn: TlsRecordServer = this.connections[slot]
-    conn.tls.restart(random, key)
+    // `restart` copies the key into the server's own `Secret` and wipes this array.
+    conn.tls.restart(random, ephemeralPrivate)
     conn.start(conn.tls)
     return slot
   }
@@ -277,8 +363,15 @@ export class TlsTcpServer {
     return this.flush(slot)
   }
 
-  /** Writes the connection's output until the socket would block or it is all sent, and answers its `interest`. */
+  /**
+   * Writes the connection's output until the socket would block or it is all
+   * sent, and answers its `interest`; a slot never built answers
+   * `TLS_RECORD_DONE`.
+   */
   flush(slot: i32): i32 {
+    if (slot < 0 || slot >= toI32(this.fds.length) || slot >= toI32(this.connections.length)) {
+      return TLS_RECORD_DONE
+    }
     const fd: i32 = this.fds[slot]
     const conn: TlsRecordServer = this.connections[slot]
     while (conn.outputEnd > conn.outputStart) {
@@ -315,8 +408,9 @@ export class TlsTcpServer {
 
   /**
    * Signs `slot`'s CertificateVerify with the P-256 private key `key` and
-   * hands it over, as `sign` does. The key is borrowed: the caller made the
-   * `Secret`, and wipes it. A malformed key fails the connection with
+   * hands it over, as `sign` does, through the pool's `TlsP256Signer`, so a
+   * handshake's signature keeps nothing. The key is borrowed: the caller made
+   * the `Secret`, and wipes it. A malformed key fails the connection with
    * `internal_error`.
    */
   signP256(slot: i32, key: Secret<u8[]>): i32 {
@@ -324,7 +418,7 @@ export class TlsTcpServer {
     if (input === null) {
       return this.interest(slot)
     }
-    const signature: u8[] | null = tlsSignEcdsaP256(key, input)
+    const signature: u8[] | null = this.signer.sign(key, input)
     if (signature === null) {
       this.connections[slot].fail(TLS_ALERT_INTERNAL_ERROR)
       return this.flush(slot)
@@ -332,6 +426,56 @@ export class TlsTcpServer {
     return this.sign(slot, signature)
   }
 
+  /**
+   * Turns session resumption on for every slot (`TlsServer.enableTickets`):
+   * from the next `accept`, a connection offering a ticket, or one that may
+   * be issued one, says `TLS_RECORD_TICKET` in its interest. A slot built
+   * later is built with them on.
+   */
+  enableTickets(): void {
+    this.tickets = true
+    for (let k: i32 = 0; k < toI32(this.connections.length); k++) {
+      this.connections[k].tls.enableTickets()
+    }
+  }
+
+  /**
+   * While `slot`'s interest says `TLS_RECORD_TICKET` in the handshake: reads
+   * its ClientHello's tickets under `current` and `previous`, with what each
+   * `info` says of them, records the one it resumes in `strikes`, and sends
+   * the flight that answers the hello, resumed or in full
+   * (`TlsRecordServer.resume`). The keys and the register are borrowed for
+   * the call. Answers the slot's interest.
+   */
+  resume(
+    slot: i32,
+    current: Secret<u8[]>,
+    currentInfo: TlsTicketKeyInfo,
+    previous: Secret<u8[]>,
+    previousInfo: TlsTicketKeyInfo,
+    strikes: TlsTicketStrikes,
+    now: i64
+  ): i32 {
+    if (!this.holds(slot)) {
+      return TLS_RECORD_DONE
+    }
+    this.connections[slot].resume(current, currentInfo, previous, previousInfo, strikes, now)
+    return this.flush(slot)
+  }
+
+  /**
+   * While `slot`'s interest says `TLS_RECORD_TICKET` on an open connection:
+   * seals one ticket under the borrowed `key` and sends its
+   * NewSessionTicket (`TlsRecordServer.issue`). Answers the slot's interest.
+   */
+  issue(slot: i32, key: Secret<u8[]>, info: TlsTicketKeyInfo, now: i64): i32 {
+    if (!this.holds(slot)) {
+      return TLS_RECORD_DONE
+    }
+    this.connections[slot].issue(key, info, now)
+    return this.flush(slot)
+  }
+
   /**
    * Application data from `slot`'s client into `buf[off .. off + len)`: the
    * count, 0 at the end of its stream, -11 when nothing is waiting, -104 once
@@ -405,6 +549,9 @@ export class TlsTcpServer {
     this.flush(slot)
     netClose(this.fds[slot])
     this.fds[slot] = TLS_TCP_FREE
+    this.free.push(slot)
     conn.wipeKeys()
+    // Whatever the last flush could not send is dropped with its buffer.
+    conn.release()
   }
 }