TLS 1.3 (RFC 8446) 0-RTT再生攻撃耐性と DNSSEC / DANE / MTA-STS 暗号検証パイプライン

#![forbid(unsafe_code)]

/// Constant-time 32-byte SHA-256 digest comparison to prevent timing side-channels.
#[inline]
pub fn ct_eq_sha256(a: &[u8; 32], b: &[u8; 32]) -> bool {
    let mut diff: u8 = 0;
    let mut i = 0;
    while i < 32 {
        diff |= a[i] ^ b[i];
        i += 1;
    }
    diff == 0
}

/// RFC 6698 DANE TLSA Record parameters.
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub struct TlsaRecord {
    /// 3 = DANE-EE (Domain-Issued Certificate), 2 = DANE-TA (Trust Anchor)
    pub cert_usage: u8,
    /// 1 = SubjectPublicKeyInfo (SPKI DER), 0 = Full Certificate
    pub selector: u8,
    /// 1 = SHA-256 (32 bytes)
    pub matching_type: u8,
    pub spki_sha256: [u8; 32],
    pub dnssec_ad_flag: bool,
}

/// RFC 8461 MTA-STS Policy representation.
#[derive(Clone, Debug, PartialEq, Eq)]
pub enum MtaStsMode {
    Enforce,
    Testing,
    None,
}

#[derive(Clone, Debug)]
pub struct MtaStsPolicy {
    pub mode: MtaStsMode,
    pub max_age_seconds: u64,
    pub allowed_mx_patterns: Vec<&'static str>,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub enum TransportVerifyError {
    DnssecBogusOrUnsigned,
    UnsupportedTlsaProfile,
    TlsaSpkiPinMismatch,
    MtaStsMxHostForbidden,
    MtaStsWeakTlsVersion,
    ZeroRttClockSkewExceeded,
    ZeroRttReplayDetected,
    ZeroRttUnsafeMethodRejected,
}

impl TlsaRecord {
    /// Verifies peer certificate SPKI SHA-256 digest against DNSSEC-authenticated TLSA (3 1 1).
    pub fn verify_peer_spki(
        &self,
        peer_spki_sha256: &[u8; 32],
    ) -> Result<(), TransportVerifyError> {
        if !self.dnssec_ad_flag {
            return Err(TransportVerifyError::DnssecBogusOrUnsigned);
        }
        if (self.cert_usage != 3 && self.cert_usage != 2)
            || self.selector != 1
            || self.matching_type != 1
        {
            return Err(TransportVerifyError::UnsupportedTlsaProfile);
        }
        if !ct_eq_sha256(&self.spki_sha256, peer_spki_sha256) {
            return Err(TransportVerifyError::TlsaSpkiPinMismatch);
        }
        Ok(())
    }
}

impl MtaStsPolicy {
    /// Validates MX hostname against RFC 8461 wildcard/exact policy and enforces TLS 1.3.
    pub fn verify_mx_session(
        &self,
        candidate_mx: &str,
        negotiated_tls_version: u16,
    ) -> Result<(), TransportVerifyError> {
        // Require TLS 1.2 (0x0303) minimum; enforce TLS 1.3 (0x0304) on strict profile
        if negotiated_tls_version < 0x0304 {
            return Err(TransportVerifyError::MtaStsWeakTlsVersion);
        }
        let matched = self.allowed_mx_patterns.iter().any(|pattern| {
            if let Some(suffix) = pattern.strip_prefix("*.") {
                candidate_mx.ends_with(suffix)
                    && candidate_mx.len() > suffix.len()
                    && candidate_mx.as_bytes()[candidate_mx.len() - suffix.len() - 1] == b'.'
            } else {
                candidate_mx.eq_ignore_ascii_case(pattern)
            }
        });

        if !matched && self.mode == MtaStsMode::Enforce {
            return Err(TransportVerifyError::MtaStsMxHostForbidden);
        }
        Ok(())
    }
}

/// RFC 8446 Section 8: Dual-Epoch Sliding Bloom Filter (Strike Register) for 0-RTT Anti-Replay.
pub struct ZeroRttStrikeRegister {
    active_bits: [u64; 64],
    previous_bits: [u64; 64],
    epoch_start_ms: u64,
    freshness_window_ms: u64,
}

impl ZeroRttStrikeRegister {
    pub const fn new(epoch_start_ms: u64, freshness_window_ms: u64) -> Self {
        Self {
            active_bits: [0u64; 64],
            previous_bits: [0u64; 64],
            epoch_start_ms,
            freshness_window_ms,
        }
    }

    #[inline]
    fn bloom_indices(client_random: &[u8; 32], psk_binder: &[u8; 32]) -> [usize; 4] {
        let mut h0: u64 = 0x243F_6A88_85A3_08D3;
        let mut h1: u64 = 0x1319_8A2E_0370_7344;
        let mut i = 0;
        while i < 32 {
            h0 = (h0 ^ (client_random[i] as u64)).wrapping_mul(0x1000_0000_01B3);
            h1 = (h1 ^ (psk_binder[i] as u64)).wrapping_mul(0x1000_0000_01B3);
            i += 1;
        }
        [
            (h0 as usize) & 4095,
            ((h0 >> 16) as usize) & 4095,
            (h1 as usize) & 4095,
            ((h1 >> 16) as usize) & 4095,
        ]
    }

    /// Validates TLS 1.3 0-RTT Early Data against method safety, ticket age skew, and replay cache.
    pub fn validate_and_record_0rtt(
        &mut self,
        is_safe_http_method: bool,
        obfuscated_ticket_age_ms: u32,
        ticket_age_add_ms: u32,
        ticket_issued_at_ms: u64,
        server_now_ms: u64,
        client_random: &[u8; 32],
        psk_binder: &[u8; 32],
    ) -> Result<(), TransportVerifyError> {
        if !is_safe_http_method {
            return Err(TransportVerifyError::ZeroRttUnsafeMethodRejected);
        }

        // Rotate bloom filter epoch when freshness window elapses
        if server_now_ms.saturating_sub(self.epoch_start_ms) >= self.freshness_window_ms {
            self.previous_bits = self.active_bits;
            self.active_bits = [0u64; 64];
            self.epoch_start_ms = server_now_ms;
        }

        let claimed_age = obfuscated_ticket_age_ms.wrapping_sub(ticket_age_add_ms) as u64;
        let actual_age = server_now_ms.saturating_sub(ticket_issued_at_ms);
        let skew = claimed_age.abs_diff(actual_age);
        if skew > self.freshness_window_ms {
            return Err(TransportVerifyError::ZeroRttClockSkewExceeded);
        }

        let indices = Self::bloom_indices(client_random, psk_binder);
        let mut seen_in_active = true;
        let mut seen_in_prev = true;

        for &idx in &indices {
            let word = idx >> 6;
            let mask = 1u64 << (idx & 63);
            if (self.active_bits[word] & mask) == 0 {
                seen_in_active = false;
            }
            if (self.previous_bits[word] & mask) == 0 {
                seen_in_prev = false;
            }
        }

        if seen_in_active || seen_in_prev {
            return Err(TransportVerifyError::ZeroRttReplayDetected);
        }

        for &idx in &indices {
            let word = idx >> 6;
            let mask = 1u64 << (idx & 63);
            self.active_bits[word] |= mask;
        }
        Ok(())
    }
}