Ensure that a resumed session properly handles client auth. Clear session ticket resumption state in wolfSSL_clear. by kareem-wolfssl · Pull Request #11600 · wolfSSL/wolfssl

The changes introduce an optional-build compilation failure, a callback-backed authentication bypass, and an unversioned persisted-cache layout change.

Review effort: Balanced
Findings: 2 · 1 · 1

Open (4)

Old ClientHello auth check does not compile or enforce gating · New
Retained session metadata can bypass client authentication · New
Bump cache version after changing persisted session layout · New
Add TLS 1.3 rejection test for unauthenticated ticket resumption · New

What changed in this PR

Adds client-authentication awareness to resumed sessions and clears stale ticket state during wolfSSL_clear().

Changes:

Persists client-auth status in sessions and tickets.
Rejects resumptions that cannot satisfy mandatory client authentication.
Adds TLS 1.2 resumption and reset tests.

File	Description
`wolfssl/internal.h`	Adds ticket flags and session authentication state.
`src/internal.c`	Enforces client authentication during TLS 1.2 resumption.
`src/tls13.c`	Enforces authentication for TLS 1.3 ticket PSKs.
`src/ssl.c`	Clears stale ticket and alternate-session state.
`src/ssl_sess.c`	Serializes and populates authentication state.
`tests/api/test_tls.c`	Adds TLS 1.2 resumption and reuse tests.
`tests/api/test_tls.h`	Registers new TLS tests.
`tests/api.c`	Tests session serialization compatibility.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

julek-wolfssl

It looks correct but the comments are getting too verbose. Cut them down.

philljj

merge conflict, and a nit.

also, see Fenrir item

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11600

Scan targets checked: wolfssl-src, wolfssl-bugs
Coverage: 5 of 8 in-scope changed file(s) opened by the reviewer; not opened: tests/api.c, tests/api/test_tls.c, wolfssl/ssl_sess.h

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

kareem-wolfssl · 2026-10-07T22:05:16Z

Retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11600

Scan targets checked: wolfssl-src, wolfssl-bugs
Coverage: 5 of 7 in-scope changed file(s) opened by the reviewer; not opened: tests/api.c, tests/api/test_tls.c

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11600

Scan targets checked: wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): tests/api/test_tls.h
Coverage: 1 of 2 in-scope changed file(s) opened by the reviewer; not opened: tests/api/test_tls.c

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Lite

Reset useTicket and createTicket, the server's alternate session id, and the per-connection alert count, empty record count, fragment offset and message building state, so a reused object starts the next handshake clean. DoClientHello resets the ticket flags itself, except during secure renegotiation, where the hello inherits the connection's. Thanks to ByteRay Ltd for the report.

Record in the session and in the ticket whether the client presented a certificate and proved possession of its key, and do a full handshake instead of resuming (session id, ticket, session secret callback and TLS 1.3 PSK) when the policy requires a client certificate the session never had. Every site deciding that policy uses ClientAuthRequired(), which covers mutual auth without verifyPeer and the PSK exception of WOLFSSL_VERIFY_FAIL_EXCEPT_PSK. The TLS 1.3 post-handshake exemption stays with the callers that defer. wolfSSL_mutual_auth() sets the verify mode so the certificate is asked for, and FAIL_IF_NO_PEER_CERT and FAIL_EXCEPT_PSK imply VERIFY_PEER. The i2d/d2i session encoding carries the new flag and d2i requires the full length. Thanks to ByteRay Ltd for the report.

Fix peerAuthOK logic around resumption and PHA. Fix PSK determination logic. Ensure PSK/anon suite options are fully reset between connections and in wolfSSL_clear. Don't set failNoCert in _mutual_auth functions as it is redundant and wouldn't get reset on clear. Add tests.

…east one reference, otherwise clear the session. Use isPsk to determine PSK status rather than verifyPeer. Add tests.

…ntAuthRequired should only check if the ticket was authenticated for this case.

Add isPsk to the session for TLS 1.3, as it has no other way of knowing if a session ticket is PSK. Refactor to always build ClientAuthRequired function. Search for CERT_WITH_EXTERN_PSK extension from the peer rather than relying on certWithExternPsk option. Add tests.

Gate WOLFSSL_SESSION members on !NO_WOLFSSL_SERVER.

philljj · 2026-10-29T17:45:28Z

tests good with multi-test with gcc-c89, c89-clang-tidy, wolfssl-all, openssl-extra-coexist, tls13, dtls13, quic, etc scenarios.

kareem-wolfssl requested review from julek-wolfssl and a balanced review from Copilot September 29, 2026 23:53

kareem-wolfssl self-assigned this Sep 29, 2026

Copilot started reviewing on behalf of kareem-wolfssl September 29, 2026 23:53

View session

Copilot AI reviewed Sep 29, 2026

View reviewed changes

Comment thread src/internal.c Resolved

Comment thread src/internal.c Resolved

Comment thread wolfssl/internal.h Resolved

Comment thread src/tls13.c Resolved

kareem-wolfssl force-pushed the zd22516 branch from b2fffb7 to 9b72742 Compare September 30, 2026 00:10

julek-wolfssl requested changes Sep 30, 2026

View reviewed changes

kareem-wolfssl force-pushed the zd22516 branch 4 times, most recently from 9edcb65 to 6db895a Compare October 2, 2026 19:17

kareem-wolfssl assigned wolfSSL-Bot and unassigned kareem-wolfssl Oct 2, 2026

philljj requested a review from wolfSSL-Fenrir-bot October 6, 2026 20:44

philljj requested changes Oct 6, 2026

View reviewed changes

Comment thread src/ssl_sess.c Resolved

Comment thread wolfssl/ssl_sess.h Resolved

wolfSSL-Fenrir-bot requested changes Oct 6, 2026

View reviewed changes

Comment thread src/internal.c Resolved

philljj assigned kareem-wolfssl and philljj and unassigned wolfSSL-Bot Oct 7, 2026

kareem-wolfssl force-pushed the zd22516 branch from 6db895a to c452a98 Compare October 7, 2026 19:50

kareem-wolfssl force-pushed the zd22516 branch from c452a98 to f06d567 Compare October 8, 2026 17:23

kareem-wolfssl assigned wolfSSL-Bot and philljj and unassigned philljj and kareem-wolfssl Oct 8, 2026

philljj requested a review from wolfSSL-Fenrir-bot October 9, 2026 17:58

wolfSSL-Fenrir-bot requested changes Oct 9, 2026

View reviewed changes

Comment thread src/ssl_sess.c Resolved

philljj requested a review from julek-wolfssl October 9, 2026 18:29

kareem-wolfssl assigned wolfSSL-Bot and philljj and unassigned kareem-wolfssl Oct 22, 2026

philljj requested a review from wolfSSL-Fenrir-bot October 23, 2026 01:43

wolfSSL-Fenrir-bot previously requested changes Oct 23, 2026

View reviewed changes

Comment thread src/tls13.c Resolved

julek-wolfssl requested changes Oct 23, 2026

View reviewed changes

Comment thread wolfssl/internal.h Resolved

Comment thread wolfssl/internal.h Resolved

Comment thread wolfssl/internal.h Resolved

Comment thread wolfssl/internal.h Resolved

Comment thread src/ssl_sess.c Resolved

Comment thread src/tls13.c Resolved

Comment thread src/tls13.c Resolved

julek-wolfssl assigned julek-wolfssl and kareem-wolfssl and unassigned wolfSSL-Bot, philljj and julek-wolfssl Oct 23, 2026

kareem-wolfssl force-pushed the zd22516 branch 2 times, most recently from e768bcf to 5006f88 Compare October 26, 2026 17:50

kareem-wolfssl assigned wolfSSL-Bot and unassigned kareem-wolfssl Oct 26, 2026

philljj requested changes Oct 28, 2026

View reviewed changes

Comment thread src/internal.c Resolved

Comment thread src/tls13.c Resolved

Comment thread wolfssl/internal.h Resolved

kareem-wolfssl added 11 commits October 28, 2026 14:06

Fix FIPS test failures

e1349ad

Only run wolfSSL_FreeSession in wolfSSL_clear if the session has at l…

6c872e0

…east one reference, otherwise clear the session. Use isPsk to determine PSK status rather than verifyPeer. Add tests.

Fix failing test.

cb7b287

Fix failing test in --enable-coding=no builds.

8b5bf5a

Disable PSK parameter for ClientAuthRequired in DoPreSharedKeys. Clie…

4036c8d

…ntAuthRequired should only check if the ticket was authenticated for this case.

Fix MSVC warning

ec59b59

Properly set PSK status for TLS 1.3 resumption.

69b2305

Gate WOLFSSL_SESSION members on !NO_WOLFSSL_SERVER.

julek-wolfssl approved these changes Oct 29, 2026

View reviewed changes

philljj approved these changes Oct 29, 2026

View reviewed changes

Conversation

kareem-wolfssl commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Checklist

Uh oh!

github-actions Bot commented Sep 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report · Explore what changed →

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

julek-wolfssl left a comment

Choose a reason for hiding this comment

Uh oh!

philljj left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11600

Uh oh!

Uh oh!

kareem-wolfssl commented Oct 7, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11600

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11600

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

philljj commented Oct 29, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

kareem-wolfssl commented Sep 29, 2026 •

edited

Loading

github-actions Bot commented Sep 29, 2026 •

edited

Loading

philljj left a comment •

edited

Loading