Commit 1e5d536b05 for openssl.org
commit 1e5d536b0530bd0578a9dcd3cd3e0a4403f5558b
Author: Adraca <abhishek.k@adraca.io>
Date: Wed Apr 29 06:32:53 2026 +0000
Harden SSL_set_session_ticket_ext and add docs
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
MergeDate: Mon May 18 07:27:55 2026
(Merged from https://github.com/openssl/openssl/pull/31022)
diff --git a/doc/man3/SSL_set_session_secret_cb.pod b/doc/man3/SSL_set_session_secret_cb.pod
index e79d81d40a..e40479ce1f 100644
--- a/doc/man3/SSL_set_session_secret_cb.pod
+++ b/doc/man3/SSL_set_session_secret_cb.pod
@@ -2,8 +2,10 @@
=head1 NAME
-SSL_set_session_secret_cb, tls_session_secret_cb_fn
-- set the session secret callback
+SSL_set_session_secret_cb, tls_session_secret_cb_fn,
+SSL_set_session_ticket_ext, SSL_set_session_ticket_ext_cb,
+tls_session_ticket_ext_cb_fn
+- set the session secret and EAP-FAST session ticket extension callbacks
=head1 SYNOPSIS
@@ -17,6 +19,15 @@ SSL_set_session_secret_cb, tls_session_secret_cb_fn
tls_session_secret_cb_fn session_secret_cb,
void *arg);
+ typedef int (*tls_session_ticket_ext_cb_fn)(SSL *s, const unsigned char *data,
+ int len, void *arg);
+
+ int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len);
+
+ int SSL_set_session_ticket_ext_cb(SSL *s,
+ tls_session_ticket_ext_cb_fn cb,
+ void *arg);
+
=head1 DESCRIPTION
SSL_set_session_secret_cb() sets the session secret callback to be used
@@ -44,13 +55,29 @@ server.
The callback is also supplied with an additional argument in I<arg> which is the
argument that was provided to the original SSL_set_session_secret_cb() call.
+SSL_set_session_ticket_ext() is used on the client-side to set the session ticket
+extension data for EAP-FAST (RFC4851). The I<ext_data> argument is a pointer to
+the extension data, and I<ext_len> is the length of that data. I<ext_len> must
+be between 0 and 65535. If I<ext_data> is NULL, then the session ticket
+extension will not be sent.
+
+SSL_set_session_ticket_ext_cb() is used on the server-side to set a callback
+(I<cb>) that will be called when a session ticket extension is received. The
+callback is supplied with the extension data in I<data> and its length in
+I<len>, as well as the additional argument I<arg> that was provided when the
+callback was set.
+
=head1 RETURN VALUES
-SSL_set_session_secret_cb() returns 1 on success and 0 on failure.
+SSL_set_session_secret_cb(), SSL_set_session_ticket_ext(), and
+SSL_set_session_ticket_ext_cb() return 1 on success and 0 on failure.
+
+If the session secret callback returns 1 then this indicates it has successfully
+set the secret. A return value of 0 indicates that the secret has not been set.
+On the client this will cause an immediate abort of the handshake.
-If the callback returns 1 then this indicates it has successfully set the
-secret. A return value of 0 indicates that the secret has not been set. On the
-client this will cause an immediate abort of the handshake.
+The session ticket extension callback should return 1 for success. A return value
+of 0 indicates failure and will cause the handshake to abort immediately.
=head1 SEE ALSO
@@ -59,7 +86,7 @@ L<SSL_get_session(3)>
=head1 COPYRIGHT
-Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2024-2026 The OpenSSL Project Authors. All Rights Reserved.
Licensed under the Apache License 2.0 (the "License"). You may not use
this file except in compliance with the License. You can obtain a copy
diff --git a/ssl/ssl_sess.c b/ssl/ssl_sess.c
index 82d5d74352..7892873ecf 100644
--- a/ssl/ssl_sess.c
+++ b/ssl/ssl_sess.c
@@ -1172,30 +1172,24 @@ int SSL_set_session_ticket_ext_cb(SSL *s, tls_session_ticket_ext_cb_fn cb,
int SSL_set_session_ticket_ext(SSL *s, void *ext_data, int ext_len)
{
SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(s);
-
- if (sc == NULL)
+ if (sc == NULL || ext_len < 0 || ext_len > 0xffff)
return 0;
-
- if (sc->version >= TLS1_VERSION) {
- OPENSSL_free(sc->ext.session_ticket);
- sc->ext.session_ticket = NULL;
+ OPENSSL_free(sc->ext.session_ticket);
+ if (ext_data != NULL) {
sc->ext.session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT) + ext_len);
if (sc->ext.session_ticket == NULL)
return 0;
-
- if (ext_data != NULL) {
- sc->ext.session_ticket->length = ext_len;
- sc->ext.session_ticket->data = sc->ext.session_ticket + 1;
- memcpy(sc->ext.session_ticket->data, ext_data, ext_len);
- } else {
- sc->ext.session_ticket->length = 0;
- sc->ext.session_ticket->data = NULL;
- }
-
- return 1;
+ sc->ext.session_ticket->length = ext_len;
+ sc->ext.session_ticket->data = sc->ext.session_ticket + 1;
+ memcpy(sc->ext.session_ticket->data, ext_data, ext_len);
+ } else {
+ sc->ext.session_ticket = OPENSSL_malloc(sizeof(TLS_SESSION_TICKET_EXT));
+ if (sc->ext.session_ticket == NULL)
+ return 0;
+ sc->ext.session_ticket->data = NULL;
+ sc->ext.session_ticket->length = 0;
}
-
- return 0;
+ return 1;
}
#ifndef OPENSSL_NO_DEPRECATED_3_4
diff --git a/util/missingssl.txt b/util/missingssl.txt
index 8da9842a0b..0ab346fe57 100644
--- a/util/missingssl.txt
+++ b/util/missingssl.txt
@@ -25,7 +25,5 @@ SSL_get_peer_finished(3)
SSL_set_SSL_CTX(3)
SSL_set_debug(3)
SSL_set_not_resumable_session_callback(3)
-SSL_set_session_ticket_ext(3)
-SSL_set_session_ticket_ext_cb(3)
SSL_srp_server_param_with_username(3)
SSL_test_functions(3)
diff --git a/util/other.syms b/util/other.syms
index dc34638f09..b61353ff32 100644
--- a/util/other.syms
+++ b/util/other.syms
@@ -160,6 +160,7 @@ custom_ext_parse_cb datatype
pem_password_cb datatype
ssl_ct_validation_cb datatype
tls_session_secret_cb_fn datatype
+tls_session_ticket_ext_cb_fn datatype
ASYNC_stack_alloc_fn datatype
ASYNC_stack_free_fn datatype
PKCS12_create_cb datatype