[gnutls-devel] GnuTLS | add support for 0-RTT (!775)

[Development of GNU's TLS library]

Nikos Mavrogiannopoulos started a new discussion on lib/tls13/anti_replay.c:

> +			ret = gnutls_assert_val(GNUTLS_E_EARLY_DATA_REJECTED);
> +			goto out;
> +		}
> +	} else {
> +		gnutls_datum_t value;
> +
> +		value = db_retrieve_func(db_ptr, key);
> +		if (value.data) {
> +			/* We don't care about the data. */
> +			free(value.data);
> +			_gnutls_handshake_log("anti_replay: duplicate ClientHello found\n");
> +			ret = gnutls_assert_val(GNUTLS_E_EARLY_DATA_REJECTED);
> +			goto out;
> +		}
> +	}
> +

between this read and store there is a window that an session on another server in a pool would accept the same hello message.

Seeing how `apr_memcache` works it has an `apr_memcache_add` command which can add only when it doesn't exist, and otherwise return an error. Maybe we can rely on that, instead on separate read and store?

-- 
Reply to this email directly or view it on GitLab: https://gitlab.com/gnutls/gnutls/merge_requests/775#note_114129499
You're receiving this email because of your account on gitlab.com.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.gnupg.org/pipermail/gnutls-devel/attachments/20181102/f6803bda/attachment.html>