Package io.github.mahmoudimus.quic.tls

Interface EarlyDataPolicy

Functional Interface:
This is a functional interface and can therefore be used as the assignment target for a lambda expression or method reference.
@FunctionalInterface public interface EarlyDataPolicy
Decides, on a server, whether to accept the 0-RTT data a resuming client offers. The handshake asks only once the offer passes the protocol's own checks: the first PSK identity was accepted, the ticket allows early data, and the cipher suite, ALPN protocol, server name and QUIC transport parameters match the session's. Rejecting early data is always safe: the handshake goes on, the client learns of the rejection and sends its data again after the handshake.

Replay. 0-RTT data has no protection against replay (RFC 8446 sections 2.3 and 8): an attacker who captures a client's first flight can send it again, and a server that accepts it acts on the early data twice. The default, antiReplay(), narrows this as RFC 8446 section 8 describes: it accepts a ticket's early data at most once, and only while the client's idea of the ticket's age agrees with the server's within a short window, so a first flight replayed later fails the age check and one replayed sooner hits the single-use record. That record lives in one process: servers behind one address that share a ticket key but not the record can each accept a replay once. Even then, early data should only carry requests that are safe to repeat, which is the application's call; RFC 8470 describes it for HTTP. Compose an application veto with and(EarlyDataPolicy).

Policies are called on the thread that drives the handshake, so they should be quick and must be thread-safe.

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final EarlyDataPolicy
    ACCEPT_ALL
    Accepts any early data the protocol allows, with no protection against replay.
    static final EarlyDataPolicy
    REJECT
    Accepts no early data.

  • Method Summary

    Modifier and Type
    Method
    Description
    boolean
    accept(EarlyDataAttempt attempt)
    Whether to accept a client's early data.
    default EarlyDataPolicy
    and(EarlyDataPolicy other)
    A policy that accepts only what both this one and another accept.
    static EarlyDataPolicy
    antiReplay()
    The default anti-replay policy: a ticket age window of 10 seconds and a single-use record of up to 100000 tickets.
    static EarlyDataPolicy
    antiReplay(Duration window, int maxEntries)
    An anti-replay policy.

  • Field Details

    • REJECT

      static final EarlyDataPolicy REJECT
      Accepts no early data.

    • ACCEPT_ALL

      static final EarlyDataPolicy ACCEPT_ALL
      Accepts any early data the protocol allows, with no protection against replay. For tests.

  • Method Details

    • accept

      boolean accept(EarlyDataAttempt attempt)
      Whether to accept a client's early data.
      Parameters:
      attempt - what the client offers
      Returns:
      true to accept it

    • and

      default EarlyDataPolicy and(EarlyDataPolicy other)
      A policy that accepts only what both this one and another accept. The other is asked first, and this one only if the other accepts: in antiReplay().and(veto) the anti-replay record notes a ticket only when the application's veto lets it through.
      Parameters:
      other - the second policy
      Returns:
      the combined policy

    • antiReplay

      static EarlyDataPolicy antiReplay()
      The default anti-replay policy: a ticket age window of 10 seconds and a single-use record of up to 100000 tickets.
      Returns:
      a new policy with its own record

    • antiReplay

      static EarlyDataPolicy antiReplay(Duration window, int maxEntries)
      An anti-replay policy.
      Parameters:
      window - how far the client's and the server's ticket ages may differ; the single-use record keeps each ticket for twice this long
      maxEntries - the most tickets the record holds; when it is full, early data is refused
      Returns:
      a new policy with its own record