Refuse to send a DTLS handshake message whose message_seq would wrap the uint16, relates to github #1468.

Author: mondain

tls/src/main/java/org/bouncycastle/tls/DTLSReliableHandshake.java

@@ -183,6 +183,15 @@ void sendMessage(short msg_type, byte[] body)
     {
         TlsUtils.checkUint24(body.length);
 
+        /*
+         * draft-ietf-tls-rfc9147bis: message_seq is a uint16 and "MUST NOT wrap"; writeUint16 would
+         * silently truncate and reuse the sequence number of an earlier message.
+         */
+        if (next_send_seq > 0xFFFF)
+        {
+            throw new TlsFatalAlert(AlertDescription.internal_error);
+        }
+
         if (null != resendTimeout)
         {
             checkInboundFlight();
@@ -781,6 +790,12 @@ void acknowledgeForTest(Vector recordNumbers)
         flightTracker.acknowledge(recordNumbers);
     }
 
+    /** For the reliable-handshake tests: position the send counter, e.g. at the uint16 limit. */
+    void setNextSendSeqForTest(int nextSendSeq)
+    {
+        next_send_seq = nextSendSeq;
+    }
+
     /** For the reliable-handshake tests: drive the retransmission path directly. */
     void resendOutboundFlightForTest() throws IOException
     {

tls/src/test/java/org/bouncycastle/tls/AllTests.java

@@ -30,6 +30,7 @@ public static Test suite()
         suite.addTestSuite(DTLS13UnifiedHeaderTest.class);
         suite.addTestSuite(DTLSAckTest.class);
         suite.addTestSuite(DTLSAckTransportTest.class);
+        suite.addTestSuite(DTLSMessageSeqTest.class);
         suite.addTestSuite(DTLSReassemblerTest.class);
         suite.addTestSuite(DTLSRecordLayer13Test.class);
         suite.addTestSuite(DTLSRecordLayerAggregationTest.class);

tls/src/test/java/org/bouncycastle/tls/DTLS13HandshakeTestSupport.java

@@ -316,6 +316,11 @@ void receiveUntilTimeout() throws IOException
     }
 
     /** Send a small message, which opens a new outbound flight (and so a new inbound flight). */
+    void setNextSendSeq(int nextSendSeq)
+    {
+        handshake.setNextSendSeqForTest(nextSendSeq);
+    }
+
     void sendMessage() throws IOException
     {
         handshake.sendMessage(HandshakeType.certificate, new byte[8]);

tls/src/test/java/org/bouncycastle/tls/DTLSMessageSeqTest.java

@@ -0,0 +1,39 @@
+package org.bouncycastle.tls;
+
+import java.io.IOException;
+
+import junit.framework.TestCase;
+
+/**
+ * draft-ietf-tls-rfc9147bis: message_seq is a uint16 that MUST NOT wrap. The send side has to refuse the
+ * 65537th message rather than let writeUint16 truncate it onto the sequence number of an earlier one.
+ */
+public class DTLSMessageSeqTest
+    extends TestCase
+{
+    public void testLastMessageSeqIsStillSent() throws IOException
+    {
+        DTLS13HandshakeTestSupport support = new DTLS13HandshakeTestSupport();
+        support.begin(500);
+
+        support.setNextSendSeq(0xFFFF);
+        support.sendMessage();
+    }
+
+    public void testMessageSeqWrapIsRefused() throws IOException
+    {
+        DTLS13HandshakeTestSupport support = new DTLS13HandshakeTestSupport();
+        support.begin(500);
+
+        support.setNextSendSeq(0x10000);
+        try
+        {
+            support.sendMessage();
+            fail("message_seq 65536 must not be sent");
+        }
+        catch (TlsFatalAlert e)
+        {
+            assertEquals(AlertDescription.internal_error, e.getAlertDescription());
+        }
+    }
+}