stir_shaken DIV: Bump freshness margin from 1s to 60s

Author: liviuchircu

modules/stir_shaken/README.md

@@ -110,7 +110,7 @@ SHAKEN and earlier DIV tokens. The outermost token uses
 token, this parameter has no effect.
 
 When omitted, the default is `10800` (three hours), or
-`verify_date_freshness + 1` if that is larger. An explicit value must exceed
+`verify_date_freshness + 60` if that is larger. An explicit value must exceed
 `verify_date_freshness`, or be `-1` to skip inner freshness checking.
 
 The `inner_freshness` argument to `stir_shaken_verify_chain()` overrides this

modules/stir_shaken/test/README.md

@@ -58,5 +58,6 @@ results for A/B/C, bad signature, stale outermost, broken chain, and absent
 Identity. Tests check its resulting `verstat` on the serialized request.
 
 Freshness initialization tests cover the normal three-hour inner default,
-automatic adjustment when the outer window grows, preservation of explicit
-inner settings and `-1`, invalid explicit limits, and integer overflow bounds.
+automatic adjustment to retain a 60-second margin as the outer window grows,
+preservation of explicit inner settings and `-1`, invalid explicit limits, and
+integer overflow bounds.

modules/stir_shaken/test/test_vs.c

@@ -22,19 +22,23 @@ static void test_freshness_defaults(void)
 		const char *name;
 	} cases[] = {
 		{60,10800,0,0,60,10800,"ordinary outer window retains three-hour default"},
-		{10799,10800,0,0,10799,10800,"default already exceeds outer window"},
-		{10800,10800,0,0,10800,10801,"default grows when outer reaches three hours"},
-		{28400,10800,0,0,28400,28401,"untouched default follows enlarged outer window"},
+		{10740,10800,0,0,10740,10800,"default already has a full minute of margin"},
+		{10741,10800,0,0,10741,10801,"default grows when margin falls below one minute"},
+		{10799,10800,0,0,10799,10859,"default grows even when it already exceeds outer window"},
+		{10799,10800,1,0,10799,10800,"explicit inner window need not adopt the default margin"},
+		{10800,10800,0,0,10800,10860,"default grows when outer reaches three hours"},
+		{28400,10800,0,0,28400,28460,"untouched default follows enlarged outer window"},
 		{28400,10800,1,-1,28400,10800,"explicit three-hour limit is not silently increased"},
 		{28400,40000,1,0,28400,40000,"explicit larger inner limit is preserved"},
 		{28400,-1,1,0,28400,-1,"explicit inner bypass is preserved"},
 		{-1,10800,0,-1,-1,10800,"negative outer window remains invalid"},
 		{60,0,1,-1,60,0,"explicit zero inner window remains invalid"},
 		{28400,28400,1,-1,28400,28400,"explicit equal inner window remains invalid"},
-		{INT_MAX-1,10800,0,0,INT_MAX-1,INT_MAX,"largest representable inherited limit"},
-		{INT_MAX,10800,0,0,INT_MAX-1,INT_MAX,"maximal outer window leaves room for inner default"},
-		{INT_MAX,-1,1,0,INT_MAX-1,-1,"clamping the outer window preserves explicit inner bypass"},
-		{INT_MAX,INT_MAX,1,0,INT_MAX-1,INT_MAX,"clamping permits an explicit maximal inner window"}
+		{INT_MAX-60,10800,0,0,INT_MAX-60,INT_MAX,"largest outer window with a full minute of margin"},
+		{INT_MAX-59,10800,0,0,INT_MAX-60,INT_MAX,"clamping starts when a full minute would overflow"},
+		{INT_MAX,10800,0,0,INT_MAX-60,INT_MAX,"maximal outer window leaves room for inner default"},
+		{INT_MAX,-1,1,0,INT_MAX-60,-1,"clamping the outer window preserves explicit inner bypass"},
+		{INT_MAX,INT_MAX,1,0,INT_MAX-60,INT_MAX,"clamping permits an explicit maximal inner window"}
 	};
 	int i, outer, inner, rc;
 	for (i = 0; i < sizeof(cases)/sizeof(cases[0]); i++) {

modules/stir_shaken/verify.c

@@ -9,8 +9,9 @@
 #include "../../parser/parse_uri.h"
 
 /* The default earlier-token window is three hours, increased at startup if
- * needed to exceed the normal outermost window. Per-call -1 disables only
- * earlier-token age checks. */
+ * needed to leave 60 seconds above the normal outermost window. Per-call -1
+ * disables only earlier-token age checks. */
+#define INNER_FRESHNESS_MARGIN 60
 int verify_date_div_freshness = 10800;
 static int snapshot_ctx = -1;
 
@@ -46,13 +47,13 @@ static int resolve_freshness(int *outer, int inner_configured, int *inner)
 		LM_ERR("verify_date_freshness must not disable outermost freshness\n");
 		return -1;
 	}
-	if (*outer >= INT_MAX) {
-		*outer = INT_MAX - 1;
+	if (*outer > INT_MAX - INNER_FRESHNESS_MARGIN) {
+		*outer = INT_MAX - INNER_FRESHNESS_MARGIN;
 		LM_WARN("reducing verify_date_freshness to %d to leave room for verify_date_div_freshness\n",
 			*outer);
 	}
-	if (!inner_configured && *inner <= *outer) {
-		*inner = *outer + 1;
+	if (!inner_configured && *inner < *outer + INNER_FRESHNESS_MARGIN) {
+		*inner = *outer + INNER_FRESHNESS_MARGIN;
 		LM_INFO("using default verify_date_div_freshness=%d to exceed verify_date_freshness=%d\n",
 			*inner, *outer);
 	}