Commit 4d12497b64 for openssl.org

commit 4d12497b6499eb57a5d9e77d46d15abdd8a2ba98
Author: Daniel Kubec <kubec@openssl.foundation>
Date:   Fri Sep 25 10:43:51 2026 +0200

    TLS 1.3: Enforce the ticket lifetime when offering a ticket

    Bound the effective lifetime to 604800 seconds and treat a zero lifetime as
    unusable in tls13_check_tick_lifetime_hint(), which gates both the
    pre_shared_key offer and the early_data advertisement. The cap in the message
    parser is kept so that SSL_SESSION_get_ticket_lifetime_hint() and the session
    cache callbacks keep seeing the capped value for tickets received from the
    wire.

    - RFC 9846 4.7.1: Servers MUST NOT use any value greater than 604800 seconds
      (7 days). The value of zero indicates that the ticket should be discarded
      immediately. Clients MUST NOT use tickets for longer than 7 days after
      issuance, regardless of the ticket_lifetime, and MAY delete tickets earlier
      based on local policy. A server MAY treat a ticket as valid for a shorter
      period of time than what is stated in the ticket_lifetime.

    Complements: 17bf6c48ea8a "TLS 1.3: Suppress early_data on PSK ticket age mismatch"
    Complements: 66985198d233 "TLS 1.3: Apply the cap to the lifetime hint in the session"
    Co-authored-by: Mounir IDRASSI <mounir.idrassi@amcrypto.jp>
    Reviewed-by: Mounir Idrassi <mounir.idrassi@idrix.fr>
    Reviewed-by: Tomas Mraz <tomas@openssl.foundation>
    Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
    Merge-date: Mon Oct 19 12:37:00 2026
    Merged-from: https://github.com/openssl/openssl/pull/32808

diff --git a/ssl/statem/extensions_clnt.c b/ssl/statem/extensions_clnt.c
index 478b4ddce6..57c6166c16 100644
--- a/ssl/statem/extensions_clnt.c
+++ b/ssl/statem/extensions_clnt.c
@@ -1051,6 +1051,7 @@ static int tls13_check_tick_lifetime_hint(SSL_CONNECTION *s)
 {
     OSSL_TIME t;
     uint32_t agesec;
+    unsigned long lifetime;

     if (s->ext.tick_age_checked)
         return s->ext.tick_age_ok;
@@ -1085,10 +1086,21 @@ static int tls13_check_tick_lifetime_hint(SSL_CONNECTION *s)
     s->ext.tick_age_ms = agesec * (uint32_t)1000;

     /*
-     * Ticket is too old. Ignore it. Overflow. Shouldn't happen unless this is a
-     * *really* old session. If so we just ignore it.
+     * RFC 9846 4.7.1: Servers MUST NOT use any value greater than 604800
+     * seconds (7 days). The value of zero indicates that the ticket should be
+     * discarded immediately. Clients MUST NOT use tickets for longer than 7
+     * days after issuance, regardless of the ticket_lifetime, and MAY delete
+     * tickets earlier based on local policy. A server MAY treat a ticket as
+     * valid for a shorter period of time than what is stated in the
+     * ticket_lifetime.
+     *
+     * The hint is capped when a NewSessionTicket is parsed, but a session
+     * restored with d2i_SSL_SESSION() carries whatever value was serialised.
      */
-    if (s->session->ext.tick_lifetime_hint < agesec)
+    lifetime = s->session->ext.tick_lifetime_hint;
+    if (lifetime > 604800)
+        lifetime = 604800;
+    if (lifetime == 0 || ossl_time_compare(t, ossl_seconds2time(lifetime)) > 0)
         s->ext.tick_age_ok = 0;
     else if (agesec != 0 && s->ext.tick_age_ms / (uint32_t)1000 != agesec)
         s->ext.tick_age_ok = 0;