Incomplete session lifetime management (key rotation)

[cloudflare]

Incomplete session lifetime management (key rotation)

[vkrasnov]

but it checks for: keypair.isInitiator

[vkrasnov]

I opened a PR that directly fixes problems 1, 4, 5 and 6.

Problem 2: indeed that is an extra handshake message, but I don't see much harm in it. To fix, we'd have to add an extra overhead to check the time for each processed outbound packet. If no data is sent using the new session, no new handshakes should be exchange further on.

Problem 3:
It seems the whitepaper is in disagreement with https://www.wireguard.com/protocol/ and wireguard-go implementation, as both state it only applies to the initiator.

[Lekensteyn]

Problem 1 is not fully addressed, out-of-order packets (legitimate or forced by an attacker) can still convince a receiver to change a new session to an old session:

boringtun/src/noise/mod.rs

Lines 391 to 397 in 6feb8e6

	let idx = packet.receiver_idx as usize;
	// Get the (probably) right session
	let lock = self.sessions[idx % N_SESSIONS].read();
	let session = (*lock).as_ref().ok_or(WireGuardError::NoCurrentSession)?;
	let packet = session.receive_packet_data(packet, dst)?;
	// Update current session, the exact session we use is not important as long as it is valid
	self.current.store(idx, Ordering::Relaxed);

Before changing the session, it should probably check that the candidate session is newer than the current one.

Problem 3: that protocol page does not seem to list all requirements. The wireguard-go implementation does implement the handshake initiation when the session associated with a received packet is too old:
https://github.com/WireGuard/wireguard-go/blob/7bc0e118317d20974107a8a0f17cf57d400f4791/device/receive.go#L77-L86

func (peer *Peer) keepKeyFreshReceiving() {
	if peer.timers.sentLastMinuteHandshake.Get() {
		return
	}
	keypair := peer.keypairs.Current()
	if keypair != nil && keypair.isInitiator && time.Since(keypair.created) > (RejectAfterTime-KeepaliveTimeout-RekeyTimeout) {
		peer.timers.sentLastMinuteHandshake.Set(true)
		peer.SendHandshakeInitiation(false)
	}
}