Fix TLS 1.2 session ticket handling when the server declines the ticket

src/dtls.c

@@ -426,7 +426,7 @@ static int FindExtByType(WolfSSL_ConstVector* ret, word16 extType,
 #if defined(WOLFSSL_DTLS_NO_HVR_ON_RESUME)
 #ifdef HAVE_SESSION_TICKET
 static int TlsTicketIsValid(const WOLFSSL* ssl, WolfSSL_ConstVector exts,
-                            int* resume)
+                            int* resume, int* haveTicket)
 {
     WolfSSL_ConstVector tlsxSessionTicket;
     byte tempTicket[SESSION_TICKET_LEN];
@@ -440,9 +440,16 @@ static int TlsTicketIsValid(const WOLFSSL* ssl, WolfSSL_ConstVector exts,
                          &tlsxFound);
     if (ret != 0)
         return ret;
-    if (tlsxSessionTicket.size == 0)
+    if (tlsxSessionTicket.size == 0) {
+        /* The server answers a blank ticket with a new one, not resumption */
+        if (tlsxFound && ssl->ctx->ticketEncCb != NULL &&
+                !ssl->options.noTicketTls12)
+            *haveTicket = TRUE;
         return 0;
-    if (tlsxSessionTicket.size > SESSION_TICKET_LEN)
+    }
+    *haveTicket = TRUE;
+    if (ssl->options.noTicketTls12 ||
+            tlsxSessionTicket.size > SESSION_TICKET_LEN)
         return 0;
     XMEMCPY(tempTicket, tlsxSessionTicket.elements, tlsxSessionTicket.size);
     ret = DoDecryptTicket(ssl, tempTicket, (word32)tlsxSessionTicket.size, &it);
@@ -522,12 +529,14 @@ static int TlsResumptionIsValid(const WOLFSSL* ssl, WolfSSL_CH* ch,
                                 int* resume)
 {
     int ret;
-
 #ifdef HAVE_SESSION_TICKET
-    ret = TlsTicketIsValid(ssl, ch->extension, resume);
+    int haveTicket = FALSE;
+
+    ret = TlsTicketIsValid(ssl, ch->extension, resume, &haveTicket);
     if (ret != 0)
         return ret;
-    if (*resume)
+    /* No resumption by the session ID that came with a ticket */
+    if (*resume || haveTicket)
         return 0;
 #endif /* HAVE_SESSION_TICKET */
     ret = TlsSessionIdIsValid(ssl, ch->sessionId, resume);

src/internal.c

@@ -22543,9 +22543,8 @@ int DoHandShakeMsgType(WOLFSSL* ssl, byte* input, word32* inOutIdx,
                  * "certificate" or "server_key_exchange" are received then we
                  * are doing a full handshake */
 
-                /* If the server included a session id then we
-                 * treat this as a fatal error, since the server said it was
-                 * doing resumption, but did not. */
+                /* A server that echoed the client's session id said it was
+                 * resuming, so a full handshake after it is a fatal error. */
 
                 /* https://www.rfc-editor.org/rfc/rfc5077.html#section-3.4
                  *   Alternatively, the client MAY include an empty Session ID
@@ -22555,7 +22554,12 @@ int DoHandShakeMsgType(WOLFSSL* ssl, byte* input, word32* inOutIdx,
                  *   messages.
                  */
 #ifndef WOLFSSL_WPAS
-                if (ssl->arrays->sessionIDSz != 0) {
+                if (ssl->arrays->sessionIDSz != 0
+    #ifdef HAVE_SESSION_TICKET
+                        /* A ticket goes out with an empty session ID */
+                        && ssl->session->ticketLen == 0
+    #endif
+                        ) {
                     /* Fatal error. Only try to send an alert. RFC 5246 does not
                      * allow for reverting back to a full handshake after the
                      * server has indicated the intention to do a resumption. */
@@ -22571,6 +22575,24 @@ int DoHandShakeMsgType(WOLFSSL* ssl, byte* input, word32* inOutIdx,
                 ssl->options.resuming = 0;
                 /* No longer resuming, reset peer authentication state. */
                 ssl->options.peerAuthGood = 0;
+#if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_CLIENT)
+                /* The declined ticket does not belong to the new session */
+                if (ssl->session->ticketLen > 0) {
+                    if (!HaveUniqueSessionObj(ssl))
+                        return MEMORY_ERROR;
+                    ForceZero(ssl->session->ticket, ssl->session->ticketLen);
+                    if (ssl->session->ticketLenAlloc > 0) {
+                        XFREE(ssl->session->ticket, ssl->session->heap,
+                              DYNAMIC_TYPE_SESSION_TICK);
+                        ssl->session->ticket = ssl->session->staticTicket;
+                        ssl->session->ticketLenAlloc = 0;
+                    }
+                    ssl->session->ticketLen = 0;
+                    /* The ID made up for the ticket goes with it */
+                    ForceZero(ssl->session->altSessionID, ID_LEN);
+                    ssl->session->haveAltSessionID = 0;
+                }
+#endif
             }
         }
     }

src/tls.c

@@ -7093,18 +7093,23 @@ static int TLSX_SessionTicket_Parse(WOLFSSL* ssl, const byte* input,
 #ifndef NO_WOLFSSL_SERVER
     else {
         /* server side */
-        if (ssl->ctx->ticketEncCb == NULL) {
-            WOLFSSL_MSG("Client sent session ticket, server has no callback");
-            return 0;
-        }
-
 #ifdef HAVE_SECURE_RENEGOTIATION
         if (IsSCR(ssl)) {
             WOLFSSL_MSG("Client sent session ticket during SCR. Ignoring.");
             return 0;
         }
 #endif
 
+        /* No stateful resumption with the session ID that came with a ticket
+         * (RFC 5077 Section 3.4) */
+        if (length > 0 && !IsAtLeastTLSv1_3(ssl->version))
+            ssl->options.resuming = 0;
+
+        if (ssl->ctx->ticketEncCb == NULL) {
+            WOLFSSL_MSG("Client sent session ticket, server has no callback");
+            return 0;
+        }
+
         if (length > SESSION_TICKET_LEN) {
             ret = BAD_TICKET_MSG_SZ;
             WOLFSSL_ERROR_VERBOSE(ret);