Commit c240ca4588 for openssl.org
commit c240ca4588fa99df07cbfb0f75593b1ad72af61c
Author: Mounir IDRASSI <mounir.idrassi@idrix.fr>
Date: Tue Sep 15 12:02:33 2026 +0900
Fix TLS 1.3 ticket age decoding when the offset wraps
Subtract the ticket age offset modulo 2^32 before converting to
OSSL_TIME. Saturating subtraction turns a wrapped age into zero,
which can reject valid early data or let an incorrect age pass
the freshness check.
Restore modular ticket age subtraction lost in f0131dc04a when
libssl moved to OSSL_TIME. This regression first shipped in 3.2.0;
3.0 and 3.1 retain modular subtraction and are not affected.
Add TLS and DTLS tests with controlled ages and offsets, checking
acceptance and rejection with both stateful and stateless tickets.
After rejecting early data, verify that both peers complete session
resumption and can exchange ordinary application data.
Fixes: https://github.com/openssl/openssl/issues/32834
Assisted-by: Codex:gpt-6-astra
Reviewed-by: Matt Caswell <matt@openssl.foundation>
Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
Merge-date: Tue Sep 29 16:38:27 2026
Merged-from: https://github.com/openssl/openssl/pull/32889
diff --git a/ssl/statem/extensions_srvr.c b/ssl/statem/extensions_srvr.c
index ad652861d8..02ff6e8106 100644
--- a/ssl/statem/extensions_srvr.c
+++ b/ssl/statem/extensions_srvr.c
@@ -1500,8 +1500,8 @@ int tls_parse_ctos_psk(SSL_CONNECTION *s, PACKET *pkt, unsigned int context,
continue;
}
- age = ossl_time_subtract(ossl_ms2time(ticket_agel),
- ossl_ms2time(sess->ext.tick_age_add));
+ /* Undo ticket age obfuscation modulo 2^32 (RFC 9846, 4.3.11.1). */
+ age = ossl_ms2time((uint32_t)(ticket_agel - sess->ext.tick_age_add));
t = ossl_time_subtract(ossl_time_now(), sess->time);
/*
diff --git a/test/sslapitest.c b/test/sslapitest.c
index 911ab4f3bf..697c3d5b83 100644
--- a/test/sslapitest.c
+++ b/test/sslapitest.c
@@ -4784,6 +4784,127 @@ static int check_early_data_timeout(OSSL_TIME timer)
return res;
}
+typedef struct {
+ time_t server_time;
+ uint32_t age_add;
+} TICKET_AGE_TEST_DATA;
+
+static int ticket_age_gen_cb(SSL *ssl, void *arg)
+{
+ TICKET_AGE_TEST_DATA *data = arg;
+ SSL_SESSION *sess = SSL_get0_session(ssl);
+
+ if (!TEST_ptr(sess))
+ return 0;
+ sess->ext.tick_age_add = data->age_add;
+ return TEST_time_t_ne(SSL_SESSION_set_time_ex(sess, data->server_time), 0);
+}
+
+static int test_early_data_ticket_age(int idx)
+{
+ SSL_CTX *cctx = NULL, *sctx = NULL;
+ SSL *clientssl = NULL, *serverssl = NULL;
+ SSL_SESSION *sess = NULL;
+ TICKET_AGE_TEST_DATA data;
+ time_t now = time(NULL);
+ OSSL_TIME timer, setup_timer = ossl_time_now();
+ unsigned char buf[20];
+ size_t readbytes, written;
+ /* Bits select rejection, wraparound, stateless tickets, and DTLS. */
+ int accept = (idx & 1) == 0;
+ int wrapped = (idx & 2) != 0;
+ int stateless = (idx & 4) != 0;
+ int testdtls = (idx & 8) != 0;
+ int ret, testresult = 0;
+
+ if (testdtls) {
+#if defined(OSSL_NO_USABLE_DTLS1_3)
+ return TEST_skip("No usable DTLSv1.3");
+#endif
+ } else {
+#if defined(OSSL_NO_USABLE_TLS1_3)
+ return TEST_skip("No usable TLSv1.3");
+#endif
+ }
+
+ data.age_add = wrapped ? UINT32_MAX - 10000 : 1000000;
+ data.server_time = accept ? now - 20 : now;
+
+ if (!TEST_true(create_ssl_ctx_pair(libctx,
+ testdtls ? DTLS_server_method() : TLS_server_method(),
+ testdtls ? DTLS_client_method() : TLS_client_method(),
+ testdtls ? DTLS1_3_VERSION : TLS1_3_VERSION, 0,
+ &sctx, &cctx, cert, privkey))
+ || !TEST_true(SSL_CTX_set_session_ticket_cb(sctx, ticket_age_gen_cb,
+ NULL, &data)))
+ goto end;
+
+ if (stateless)
+ SSL_CTX_set_options(sctx, SSL_OP_NO_ANTI_REPLAY);
+
+ if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl, &serverssl,
+ &sess, 0, SHA256_DIGEST_LENGTH, testdtls))
+ || !TEST_ptr(sess)
+ || !TEST_time_t_ne(SSL_SESSION_set_time_ex(sess, now - 20), 0))
+ goto end;
+
+ /* Match the stored offset; the callback doesn't change the wire value. */
+ sess->ext.tick_age_add = data.age_add;
+
+ timer = ossl_time_now();
+ if (!TEST_true(SSL_write_early_data(clientssl, MSG1, strlen(MSG1), &written))
+ || !TEST_size_t_eq(written, strlen(MSG1)))
+ goto end;
+
+ ret = SSL_read_early_data(serverssl, buf, sizeof(buf), &readbytes);
+ /*
+ * A long setup could make the unfixed code reject wrapped early data for
+ * the wrong reason, so do not count that as regression coverage.
+ */
+ if (!accept && wrapped
+ && (testresult = check_early_data_timeout(setup_timer)) != 0)
+ goto end;
+ if (!TEST_int_eq(ret, accept ? SSL_READ_EARLY_DATA_SUCCESS : SSL_READ_EARLY_DATA_FINISH)) {
+ testresult = check_early_data_timeout(timer);
+ goto end;
+ }
+
+ if (!TEST_true(SSL_session_reused(serverssl))
+ || !TEST_int_eq(SSL_get_early_data_status(serverssl),
+ accept ? SSL_EARLY_DATA_ACCEPTED : SSL_EARLY_DATA_REJECTED))
+ goto end;
+
+ if (accept) {
+ if (!TEST_mem_eq(buf, readbytes, MSG1, strlen(MSG1)))
+ goto end;
+ } else {
+ /* Rejecting early data must still allow session resumption. */
+ if (!TEST_size_t_eq(readbytes, 0)
+ || !TEST_true(create_ssl_connection(serverssl, clientssl,
+ SSL_ERROR_NONE))
+ || !TEST_true(SSL_session_reused(clientssl))
+ || !TEST_true(SSL_session_reused(serverssl))
+ || !TEST_int_eq(SSL_get_early_data_status(clientssl),
+ SSL_EARLY_DATA_REJECTED)
+ || !TEST_int_eq(SSL_get_early_data_status(serverssl),
+ SSL_EARLY_DATA_REJECTED)
+ || !TEST_true(SSL_write_ex(clientssl, MSG2, strlen(MSG2), &written))
+ || !TEST_size_t_eq(written, strlen(MSG2))
+ || !TEST_true(SSL_read_ex(serverssl, buf, sizeof(buf), &readbytes))
+ || !TEST_mem_eq(buf, readbytes, MSG2, strlen(MSG2)))
+ goto end;
+ }
+
+ testresult = 1;
+end:
+ SSL_SESSION_free(sess);
+ SSL_free(serverssl);
+ SSL_free(clientssl);
+ SSL_CTX_free(sctx);
+ SSL_CTX_free(cctx);
+ return testresult;
+}
+
static int test_early_data_read_write(int idx)
{
SSL_CTX *cctx = NULL, *sctx = NULL;
@@ -17962,6 +18083,7 @@ int setup_tests(void)
#endif
#if !defined(OSSL_NO_USABLE_TLS1_3) || !defined(OSSL_NO_USABLE_DTLS1_3)
ADD_ALL_TESTS(test_early_data_read_write, 12);
+ ADD_ALL_TESTS(test_early_data_ticket_age, 16);
/*
* We don't do replay tests for external PSK. Replay protection isn't used
* in that scenario.