TLS 1.3: fix early data decryption handling and middlebox compat build option - #11097
Draft
julek-wolfssl wants to merge 3 commits into
Draft
TLS 1.3: fix early data decryption handling and middlebox compat build option#11097julek-wolfssl wants to merge 3 commits into
julek-wolfssl wants to merge 3 commits into
Conversation
…yption Only skip undecryptable records when the server rejected early data. Once the server has accepted the early_data extension, RFC 8446 Section 4.2.10 requires a decrypt failure on a 0-RTT record to terminate the connection with a fatal bad_record_mac alert. Fixes wolfSSL#11011.
Declare WOLFSSL_TLS13_MIDDLEBOX_COMPAT as a real CMake option and add --enable-tls13-middlebox-compat to configure. Previously CMake accepted -DWOLFSSL_TLS13_MIDDLEBOX_COMPAT=yes, advertised the macro in the generated options.h, but never passed it to the library compile. Such a build sent an empty legacy_session_id instead of the non-empty 32-byte value RFC 8446 Section 4.1.2 requires in compatibility mode. Fixes wolfSSL#11012. Fixes wolfSSL#11014.
…eated RFC 8446 Section 8.2 recommends that freshly started servers reject 0-RTT while their anti-replay state cannot cover the ticket. A restarted server that keeps its session cache or ticket encryption keys would otherwise accept early data it cannot check for replays. Record the ctx creation time and refuse early data, but not resumption, when the ticket was minted by a previous instance. Deployments whose anti-replay state reliably survives restarts can opt out with wolfSSL_CTX_no_early_data_fresh_start_check(). Fixes wolfSSL#11013.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR tightens TLS 1.3 0-RTT handling to match RFC 8446 requirements (fatal bad_record_mac on accepted early-data decrypt failure; fresh-start 0-RTT rejection), and fixes the build-system plumbing for TLS 1.3 middlebox compatibility so the macro is consistently applied in both Autotools and CMake builds.
Changes:
- Adjust TLS 1.3 record-decrypt failure handling so ignored/skip behavior only applies when early data was not accepted; accepted early data now triggers fatal
bad_record_mac. - Introduce server “fresh-start” protection that rejects 0-RTT for tickets minted before the current
WOLFSSL_CTXcreation time, with an opt-out API. - Add proper build options for
WOLFSSL_TLS13_MIDDLEBOX_COMPATin Autotools (--enable-tls13-middlebox-compat) and CMake (WOLFSSL_TLS13_MIDDLEBOX_COMPAT), plus new tests.
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| wolfssl/ssl.h | Adds public API declaration for disabling the fresh-start 0-RTT check. |
| wolfssl/internal.h | Adds context timestamp/flag fields and a new internal option bit for “ticket predates ctx”. |
| src/internal.c | Initializes ctx ticket start time and tightens early-data decrypt-failure behavior. |
| src/tls13.c | Implements fresh-start 0-RTT rejection gating, adds opt-out API, and integrates ticket age vs ctx logic. |
| tests/api/test_tls13.h | Registers new TLS 1.3 tests for middlebox compat, bad_record_mac, and fresh-start 0-RTT. |
| tests/api/test_tls13.c | Adds new memio-based tests for the new behaviors. |
| doc/dox_comments/header_files/ssl.h | Adds Doxygen documentation for the new opt-out API. |
| configure.ac | Adds --enable-tls13-middlebox-compat and guards it vs TLS 1.3 / ECH. |
| CMakeLists.txt | Declares the CMake option and propagates the macro; adds ECH incompatibility handling. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+714
to
+722
| if(WOLFSSL_TLS13_MIDDLEBOX_COMPAT) | ||
| if(NOT WOLFSSL_TLS13) | ||
| message(WARNING "TLS 1.3 is disabled - disabling middlebox compatibility") | ||
| override_cache(WOLFSSL_TLS13_MIDDLEBOX_COMPAT "no") | ||
| else() | ||
| list(APPEND WOLFSSL_DEFINITIONS | ||
| "-DWOLFSSL_TLS13_MIDDLEBOX_COMPAT") | ||
| endif() | ||
| endif() |
Comment on lines
+5137
to
+5146
| while (off + 5 <= test_ctx.s_len) { | ||
| int recLen = ((int)test_ctx.s_buff[off + 3] << 8) | | ||
| (int)test_ctx.s_buff[off + 4]; | ||
| if (test_ctx.s_buff[off] == 0x17) { | ||
| test_ctx.s_buff[off + 5] ^= 0x01; | ||
| corrupted = 1; | ||
| break; | ||
| } | ||
| off += 5 + recLen; | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
bad_record_macalert when a 0-RTTrecord fails to decrypt after the server accepted early data, per RFC 8446
Section 4.2.10. Undecryptable records are only skipped when early data was
rejected. Fixes Corrupted accepted 0-RTT data does not produce the required bad_record_mac alert #11011.
WOLFSSL_TLS13_MIDDLEBOX_COMPATas a real CMake option and add--enable-tls13-middlebox-compatto configure. Previously CMake accepted-DWOLFSSL_TLS13_MIDDLEBOX_COMPAT=yesand advertised the macro in thegenerated
options.hbut never passed it to the library compile, so sucha build sent an empty
legacy_session_idinstead of the non-empty 32-bytevalue RFC 8446 Section 4.1.2 requires in compatibility mode. Fixes Supposed middlebox-compat client build still sends an empty legacy_session_id #11012,
Generated options.h advertises WOLFSSL_TLS13_MIDDLEBOX_COMPAT, but libwolfssl is built without it #11014.
current server ctx was created, per the RFC 8446 Section 8.2 recommendation
that freshly started servers reject 0-RTT while their anti-replay state
cannot cover the ticket. This protects restarted servers that keep their
session cache or ticket encryption keys from accepting early data they
cannot check for replays. Deployments whose anti-replay state reliably
survives restarts can opt out with
wolfSSL_CTX_no_early_data_fresh_start_check(). Fixes Fresh-start deployments still accept 0-RTT while the replay window overlaps startup time #11013.