tls 1.3: respect advertised psk_key_exchange modes for tickets and PSKs - #11137
Open
gasbytes wants to merge 1 commit into
Open
tls 1.3: respect advertised psk_key_exchange modes for tickets and PSKs#11137gasbytes wants to merge 1 commit into
gasbytes wants to merge 1 commit into
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This PR fixes a TLS 1.3 interoperability/standards issue where the server could (a) issue NewSessionTicket messages that cannot be resumed under the client’s advertised psk_key_exchange_modes, and (b) abort resumption with PSK_KEY_ERROR instead of declining an unusable PSK and continuing with a full handshake, aligning behavior with RFC 8446 (Sections 4.2.9 and 4.2.11).
Changes:
- Adds a TLS 1.3 helper to evaluate whether any client-advertised PSK key exchange mode is usable and uses it to (1) ignore offered PSKs when no advertised mode is usable and (2) skip sending
NewSessionTicketin that case. - Adds two regression tests covering ticket suppression for incompatible modes and fallback-to-full-handshake behavior when an incompatible ticket is offered.
- Registers the new tests in the TLS 1.3 API test header.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| tests/api/test_tls13.h | Declares and registers two new TLS 1.3 regression tests. |
| tests/api/test_tls13.c | Implements regression tests for mode-incompatible tickets and resumption fallback. |
| src/tls13.c | Adds PskKeyModesUsable() and uses it to skip unusable tickets and ignore unusable PSKs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
gasbytes
marked this pull request as ready for review
August 11, 2026 13:08
|
retest this please |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
A wolfSSL server ignored the client's advertised psk_key_exchange_modes when issuing a NewSessionTicket, handing out tickets it would never accept , and then aborted the resuption attempt with PSK_KEY_ERROR instead of falling back to a full handshake.
This skips tickets no advertised mode can use (as mentioned in RFC 8446, around section 4.2.9) and declines unusuable PSKs rather than failing the connection (section 4.2.11).
Fixes #11087.
Testing
Added two regression tests: test_tls13_psk_mode_no_incompatible_ticket test_tls13_psk_mode_incompatible_falls_back. The first one asserts no ticket is sent to a psk_ke-only client when the server requires psk_dhe_ke, with a compatible-client control that still gets one.
The second offers a valid ticket under that same mode mismatch and asserts the handshake completes unresumed instead of aborting.
Checklist