Implement DTLSv1_get_timeout and DTLSv1_handle_timeout

wolfSSL_DTLSv1_get_timeout always returned 0 and reported the full
timeout instead of the time left, and wolfSSL_DTLSv1_handle_timeout was
a stub that did nothing. OpenSSL style event loops that wait for
get_timeout and then call handle_timeout never retransmitted a lost
flight.

Track two timers on the object. The retransmission timer restarts
whenever a handshake message is stored for retransmission (each DTLS 1.2
pool save and DTLS 1.3 retransmit record), whenever the flight is
resent, either on a timeout or because the peer retransmitted or acked
part of it, including a resend that hit WANT_WRITE, on every timeout
backoff, and when a valid handshake message, or in DTLS 1.3 an ACK that
leaves nothing to retransmit, resets a backed off timeout to its initial
value. Restarting on every stored message rather than only on an empty
list keeps a renegotiation or post-handshake flight from inheriting the
start time of an older flight that is still kept. A DTLS 1.2 flight
counts as sent only in the states DtlsMsgPoolSend accepts for a
retransmission, so no timer runs while a flight is still being written
or waits for an asynchronous operation. A DTLS 1.3 flight counts as
sent while records are kept for it. get_timeout and handle_timeout
report no retransmission timer while the handshake is suspended on
asynchronous crypto, non-blocking OCSP or a chain verify callback, so a
slow signature cannot trigger a retransmission of a partly sent flight.
The DTLS 1.3 ack timer runs for
a quarter of the timeout while received records wait for an ack that can
be sent. It starts when the first of those records is seen and whenever
the quick timeout flag is set again.

DtlsTimersRunning() reports which timer runs and replaces the inline
check in EmbedReceiveFrom, which keeps its behaviour. The timers use
TimeNowInMilliseconds, which is now also built for DTLS, so DTLS 1.2
builds without session tickets, PSK or TLS 1.3 no longer count whole
seconds. Whole seconds stay the fallback where TLS 1.3 tickets, PSK and
DTLS 1.3 do not require a millisecond clock. With USER_TICKS, or on a
platform that would land in the gettimeofday() default without
HAVE_GETTIMEOFDAY, the library defines no TimeNowInMilliseconds and the
timers count LowResTimer seconds instead. Ports with only a seconds
clock, such as Xilinx or Nucleus, keep building, and a
USER_TICKS application that supplies its own TimeNowInMilliseconds still
links. The DEOS clock now reads the tick counter through a const
volatile pointer like the DEOS LowResTimer, since DTLS 1.2 builds now
compile it. The Zephyr clock skips k_cpu_idle() on native_posix and
native_sim like the Zephyr LowResTimer, since idling there advances
simulated time and the DTLS timers now read this clock. CMake now
exports HAVE_GETTIMEOFDAY to config.h as autotools does. The ladder
marks its whole second branches and DtlsTimerLowRes reports that to the
timers, so internal.h needs no second copy of the ladder. With a whole
second clock the timers round elapsed time down by one tick so a timer
never expires early. The ack timer is not rounded down, since an early
ACK only makes the peer resend the records it is missing. A timeout of 0
means no timeout, so no timer runs. get_timeout reports at most
DTLS_TIMEOUT_MAX seconds, which also keeps the millisecond count from
overflowing. DtlsTimerNowMs and DtlsTimerLowRes are visible to the tests
and get WOLFSSL_API_PREFIX_MAP aliases.

Fix the DTLS 1.3 quick timeout. Dtls13RtxTimeout cleared the flag when
it sent the ACKs and then checked it, so a timeout taken after the
quarter wait also retransmitted the flight and doubled the timeout.
Dtls13RtxTimeout now takes the timer that expired. handle_timeout passes
the timer it found expired. The receive path and
wolfSSL_dtls_got_timeout do not know how long the caller waited, so with
the quick timeout flag set they send only the ACKs while the buffered
flight has waited less than half its timeout, and retransmit with
backoff once it waited longer. Without a clock a quick timeout only
sends the ACKs and the next full timeout retransmits. A quick wait stays
under half the timeout and a full one reaches it. A whole second clock
is rounded down as for the timers, so a full wait can read as a quick
one and retransmit one timeout later. With nothing buffered to
retransmit, a timeout with the flag set only sends the ACKs instead of
backing off. Flushing the seen records also clears the flag, so a flag
left over from the previous flight no longer turns the next full timeout
into an ACK-only one. A timeout within DTLS13_MIN_RTX_INTERVAL of the
last retransmission no longer doubles the timeout when
Dtls13RtxSendBuffered holds the retransmission back.
Dtls13RtxSendBuffered now uses Dtls13RtxWaitMs for that check, and a
clock that stepped back counts as elapsed, so it no longer holds the
retransmission back until the clock catches up. test_dtls_timeout clears
the last retransmission time before its second timeout, which falls
within that interval of the first one. test_dtls_drop_client_ack takes
one timeout instead of two, since the first one no longer finds a flag
left over from the handshake.

get_timeout now returns 1 with the time left while a timer runs and 0
otherwise, and no longer fills in dtls_timeout when no timer runs, so
callers must check the return value. The time left includes any wait
before DTLS 1.3 may retransmit again. No timer runs while the object's
own output is still pending, so handle_timeout cannot queue a second
copy of a blocked write. handle_timeout returns 0 when no timer expired.
For an expired retransmission timer it sends any pending ACKs and
retransmits with backoff, and returns 1. For an expired DTLS 1.3 ack
timer it only sends the ACKs, without retransmitting or backing off, and
returns 1. It returns -1 on error, including when the timeout reached
its maximum, the ACK hits WANT_WRITE or the timers cannot be read under
WOLFSSL_RW_THREADED, which also sets the error, while get_timeout
returns 0. At the maximum timeout DTLS 1.3 now sets SOCKET_ERROR_E, as
DTLS 1.2 does, instead of -1. Both return 0 when NO_ASN_TIME leaves no
clock.

Under WOLFSSL_RW_THREADED the DTLS 1.3 ack timer state now sits behind
the dtls13Rtx mutex. The read thread sets the ack timer start and the
quick timeout flag with it held, the timeout handler reads and clears
the flag and the pending ACK state with it held, and get_timeout reads
the start in the same locked section as the flag, so it never pairs a
set flag with a stale start.

Author: Frauschi

cmake/config.in

@@ -19,6 +19,9 @@
 /* Define to 1 if you have the `getaddrinfo' function. */
 #cmakedefine HAVE_GETADDRINFO @HAVE_GETADDRINFO@
 
+/* Define to 1 if you have the `gettimeofday' function. */
+#cmakedefine HAVE_GETTIMEOFDAY @HAVE_GETTIMEOFDAY@
+
 /* Define to 1 if you have the `gmtime_r' function. */
 #cmakedefine HAVE_GMTIME_R @HAVE_GMTIME_R@
 

src/dtls13.c

@@ -782,6 +782,10 @@ int Dtls13RtxAddAck(WOLFSSL* ssl, w64wrapper epoch, w64wrapper seq)
             return MEMORY_E;
         }
 
+    #ifndef NO_ASN_TIME
+        if (ssl->dtls13Rtx.seenRecords == NULL)
+            ssl->dtls_ack_timer_start = DtlsTimerNowMs();
+    #endif
         *prevNext = rn;
         rn->next = cur;
         ssl->dtls13Rtx.seenRecordsCount++;
@@ -827,6 +831,7 @@ static void Dtls13RtxFlushAcks(WOLFSSL* ssl)
 
         ssl->dtls13Rtx.seenRecords = NULL;
         ssl->dtls13Rtx.seenRecordsCount = 0;
+        ssl->dtls13FastTimeout = 0;
     #ifdef WOLFSSL_RW_THREADED
         wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
     #endif
@@ -1039,8 +1044,10 @@ static int Dtls13SendOneFragmentRtx(WOLFSSL* ssl,
         handshakeType, hashOutput, Dtls13SendNow(ssl, handshakeType));
 
     if (rtxRecord != NULL) {
-        if (ret == 0 || ret == WC_NO_ERR_TRACE(WANT_WRITE))
+        if (ret == 0 || ret == WC_NO_ERR_TRACE(WANT_WRITE)) {
             Dtls13RtxAddRecord(&ssl->dtls13Rtx, rtxRecord);
+            DtlsTimerStart(ssl);
+        }
         else
             Dtls13FreeRtxBufferRecord(ssl, rtxRecord);
     }
@@ -1628,8 +1635,20 @@ int Dtls13RecordRecvd(WOLFSSL* ssl)
     if (ssl->curRL.type != handshake)
         return 0;
 
-    if (!ssl->options.dtls13SendMoreAcks)
+    if (!ssl->options.dtls13SendMoreAcks) {
+    #ifdef WOLFSSL_RW_THREADED
+        if (wc_LockMutex(&ssl->dtls13Rtx.mutex) != 0)
+            return BAD_MUTEX_E;
+    #endif
+    #ifndef NO_ASN_TIME
+        if (!ssl->dtls13FastTimeout)
+            ssl->dtls_ack_timer_start = DtlsTimerNowMs();
+    #endif
         ssl->dtls13FastTimeout = 1;
+    #ifdef WOLFSSL_RW_THREADED
+        wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
+    #endif
+    }
 
     /* Acking happens in Dtls13RtxAddAckForCurRecord(). */
     return 0;
@@ -1655,26 +1674,18 @@ static int Dtls13RtxSendBuffered(WOLFSSL* ssl)
     byte* output;
     int isLast;
     int sendSz;
-#ifndef NO_ASN_TIME
-#ifdef WOLFSSL_32BIT_MILLI_TIME
-    word32 now;
-#else
-    sword64 now;
-#endif
-#endif
     int ret;
 
     WOLFSSL_ENTER("Dtls13RtxSendBuffered");
 
 #ifndef NO_ASN_TIME
-    now = TimeNowInMilliseconds();
-    if (now - ssl->dtls13Rtx.lastRtx < DTLS13_MIN_RTX_INTERVAL) {
+    if (Dtls13RtxWaitMs(ssl) > 0) {
 #ifdef WOLFSSL_DEBUG_TLS
         WOLFSSL_MSG("Avoid too fast retransmission");
 #endif /* WOLFSSL_DEBUG_TLS */
         return 0;
     }
-    ssl->dtls13Rtx.lastRtx = now;
+    ssl->dtls13Rtx.lastRtx = TimeNowInMilliseconds();
 #endif
 
     r = ssl->dtls13Rtx.rtxRecords;
@@ -1731,13 +1742,15 @@ static int Dtls13RtxSendBuffered(WOLFSSL* ssl)
             /* this fragment will be sent eventually. Move it to the end of the
                list so next time we start with a new one. */
             Dtls13RtxMoveToEndOfList(ssl, prevNext, r);
+            DtlsTimerStart(ssl);
             return ret;
         }
 
         prevNext = &r->next;
         r = r->next;
     }
 
+    DtlsTimerStart(ssl);
     return 0;
 }
 
@@ -3418,6 +3431,7 @@ int Dtls13DoScheduledWork(WOLFSSL* ssl)
                 *tail = ssl->dtls13Rtx.seenRecords;
                 ssl->dtls13Rtx.seenRecords = NULL;
                 ssl->dtls13Rtx.seenRecordsCount = 0;
+                ssl->dtls13FastTimeout = 0;
             }
             else {
                 /* Queue already at the cap: drop this batch. */
@@ -3456,39 +3470,89 @@ int Dtls13DoScheduledWork(WOLFSSL* ssl)
     return 0;
 }
 
-/* Send ACKs when available after a timeout but only retransmit the last
- * flight after a long timeout */
-int Dtls13RtxTimeout(WOLFSSL* ssl)
+/* Return 1 when seen records wait for an ACK that may be sent now. */
+int Dtls13AckSendable(const WOLFSSL* ssl)
+{
+    return ssl->dtls13Rtx.seenRecords != NULL &&
+        (ssl->options.serverState >= SERVER_HELLO_COMPLETE ||
+         ssl->options.seenUnifiedHdr);
+}
+
+/* Milliseconds until Dtls13RtxSendBuffered() retransmits again. */
+word32 Dtls13RtxWaitMs(WOLFSSL* ssl)
+{
+#ifndef NO_ASN_TIME
+#ifdef WOLFSSL_32BIT_MILLI_TIME
+    word32 since = TimeNowInMilliseconds() - ssl->dtls13Rtx.lastRtx;
+#else
+    sword64 since = TimeNowInMilliseconds() - ssl->dtls13Rtx.lastRtx;
+
+    if (since < 0)
+        return 0;
+#endif
+
+    if (since < DTLS13_MIN_RTX_INTERVAL)
+        return (word32)(DTLS13_MIN_RTX_INTERVAL - since);
+#else
+    (void)ssl;
+#endif
+    return 0;
+}
+
+/* Return 1 once the buffered flight waited half its retransmission timeout. */
+static int Dtls13RtxTimerDue(WOLFSSL* ssl)
+{
+#ifndef NO_ASN_TIME
+    if (ssl->dtls13Rtx.rtxRecords == NULL || ssl->dtls_timeout <= 0)
+        return 0;
+    return DtlsTimerElapsedMs(ssl->dtls_timer_start) >=
+        DtlsTimerTimeoutMs(ssl) / 2;
+#else
+    (void)ssl;
+    return 0;
+#endif
+}
+
+/* Send ACKs after a timeout and retransmit the last flight only after a long
+ * timeout. expired is the DtlsTimer that expired, or 0 when not known. */
+int Dtls13RtxTimeout(WOLFSSL* ssl, int expired)
 {
     int ret = 0;
+    int ackOnly = (expired == DTLS_TIMER_ACK);
+    int fastTimeout;
+    int sendAck;
 
-    /* We don't want to send acks until we have done version
-     * negotiation in the SH or have received a unified header in the
-     * DTLS record. */
-    if (ssl->dtls13Rtx.seenRecords != NULL &&
-            (ssl->options.serverState >= SERVER_HELLO_COMPLETE ||
-                    ssl->options.seenUnifiedHdr)) {
+#ifdef WOLFSSL_RW_THREADED
+    if (wc_LockMutex(&ssl->dtls13Rtx.mutex) != 0)
+        return BAD_MUTEX_E;
+#endif
+    fastTimeout = ssl->dtls13FastTimeout;
+    ssl->dtls13FastTimeout = 0;
+    sendAck = Dtls13AckSendable(ssl);
+    if (sendAck)
         ssl->dtls13Rtx.sendAcks = 0;
-        /* reset fast timeout as we are sending ACKs */
-        ssl->dtls13FastTimeout = 0;
+#ifdef WOLFSSL_RW_THREADED
+    wc_UnLockMutex(&ssl->dtls13Rtx.mutex);
+#endif
+
+    if (expired == 0 && fastTimeout)
+        ackOnly = !Dtls13RtxTimerDue(ssl);
+
+    if (sendAck) {
         ret = SendDtls13Ack(ssl);
         if (ret != 0)
             return ret;
     }
 
-    /* we have two timeouts, a shorter (dtls13FastTimeout = 1) and a longer
-       one. When the shorter expires we only send ACKs, as it normally means
-       that some messages we are waiting for don't arrive yet. But we
-       retransmit our buffered messages only if the longer timeout
-       expires. fastTimeout is 1/4 of the longer timeout */
-    if (ssl->dtls13FastTimeout) {
-        ssl->dtls13FastTimeout = 0;
+    if (ackOnly)
+        return 0;
+
+    if (Dtls13RtxWaitMs(ssl) > 0)
         return 0;
-    }
 
     /* Increase timeout on long timeout */
     if (DtlsMsgPoolTimeout(ssl) != 0)
-        return WOLFSSL_FATAL_ERROR;
+        return SOCKET_ERROR_E;
 
     return Dtls13RtxSendBuffered(ssl);
 }
@@ -3623,6 +3687,7 @@ int DoDtls13Ack(WOLFSSL* ssl, const byte* input, word32 inputSize,
 #ifndef WOLFSSL_RW_THREADED
     int ret;
 #endif
+    int hadRecords;
     int i;
 
     /* an epoch 0 ACK once encrypted only triggers retransmission */
@@ -3646,6 +3711,7 @@ int DoDtls13Ack(WOLFSSL* ssl, const byte* input, word32 inputSize,
 
     WOLFSSL_MSG("read ack records");
 
+    hadRecords = ssl->dtls13Rtx.rtxRecords != NULL;
     ackMessage = input + OPAQUE16_LEN;
     for (i = 0; i < length; i += DTLS13_RN_SIZE) {
         ato64(ackMessage + i, &epoch);
@@ -3670,6 +3736,9 @@ int DoDtls13Ack(WOLFSSL* ssl, const byte* input, word32 inputSize,
 #endif /* HAVE_WRITE_DUP */
     }
 
+    if (hadRecords && ssl->dtls13Rtx.rtxRecords == NULL)
+        DtlsTimeoutReset(ssl);
+
     /* last client flight was completely acknowledged by the server. Handshake
        is complete. */
     if (ssl->options.side == WOLFSSL_CLIENT_END &&