Follow-up to #403. That PR stops this server from handing out NewSessionTickets, but a client can still be holding a ticket from another server — an unpatched node in a mid-rollout fleet, an unpatched member of a load-balanced pool, or a client from before a rollback. When such a client reaches a patched server, the symptom that motivated #403 is unchanged: the offered PSK trips the age != 0 check, the server returns a fatal internal_error alert, and every other connection from that client dies.
Root cause is in _nx_secure_tls_process_clienthello_psk_extension (nx_secure/src/nx_secure_tls_process_clienthello_extensions.c:1397-1401), which returns NX_SECURE_TLS_BAD_CLIENTHELLO_PSK_EXTENSION for any age != 0. That error is not mapped in _nx_secure_tls_map_error_to_alert, so it falls through to the default fatal internal_error branch.
RFC 8446 §4.2.11 is explicit: a server that does not accept an offered PSK identity should ignore it and fall back to a full handshake rather than abort. The fix is to treat "offered ticket this server cannot use" as a graceful decline — do not select the PSK, do not resume, complete the handshake normally.
Scope:
Compiled under NX_SECURE_ENABLE_PSK_CIPHERSUITES with TLS 1.3, per the guard at nx_secure_tls_process_clienthello_extensions.c:1269.
The two fixes are complementary: #403 removes one source of the trigger, this one makes the server robust regardless of where a ticket came from.
Follow-up to #403. That PR stops this server from handing out NewSessionTickets, but a client can still be holding a ticket from another server — an unpatched node in a mid-rollout fleet, an unpatched member of a load-balanced pool, or a client from before a rollback. When such a client reaches a patched server, the symptom that motivated #403 is unchanged: the offered PSK trips the age != 0 check, the server returns a fatal internal_error alert, and every other connection from that client dies.
Root cause is in
_nx_secure_tls_process_clienthello_psk_extension(nx_secure/src/nx_secure_tls_process_clienthello_extensions.c:1397-1401), which returnsNX_SECURE_TLS_BAD_CLIENTHELLO_PSK_EXTENSIONfor anyage != 0. That error is not mapped in_nx_secure_tls_map_error_to_alert, so it falls through to the default fatalinternal_errorbranch.RFC 8446 §4.2.11 is explicit: a server that does not accept an offered PSK identity should ignore it and fall back to a full handshake rather than abort. The fix is to treat "offered ticket this server cannot use" as a graceful decline — do not select the PSK, do not resume, complete the handshake normally.
Scope:
age != 0rejection to a "decline this identity" outcome that lets the handshake continue.Compiled under
NX_SECURE_ENABLE_PSK_CIPHERSUITESwith TLS 1.3, per the guard atnx_secure_tls_process_clienthello_extensions.c:1269.The two fixes are complementary: #403 removes one source of the trigger, this one makes the server robust regardless of where a ticket came from.