Reject second ClientHello that withdraws PSK offer - #3259
Merged
djc merged 1 commit intoSep 11, 2026
Merged
Conversation
oleksii-udovychenko
force-pushed
the
reject-psk-withdrawal-after-hrr
branch
from
September 10, 2026 01:51
fc2f24f to
10dca06
Compare
oleksii-udovychenko
changed the title
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3259 +/- ##
==========================================
+ Coverage 95.35% 95.36% +0.01%
==========================================
Files 99 99
Lines 23570 23624 +54
Branches 677 679 +2
==========================================
+ Hits 22474 22529 +55
+ Misses 940 939 -1
Partials 156 156 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
oleksii-udovychenko
changed the title
djc
approved these changes
Sep 10, 2026
djc
left a comment
djc
left a comment
Member
There was a problem hiding this comment.
Thanks! Is there bogo coverage for this?
Benchmark resultsInstruction countsSignificant differencesClick to expand
Other differencesClick to expand
Wall-timeSignificant differencesThere are no significant wall-time differences Other differencesClick to expand
Memory usageKey:
Significant differencesThere are no significant memory usage differences Additional informationCheckout details:
|
Contributor
Author
|
Yes. It is the test the change came from: without the check the shim finishes a full handshake with a HelloRetryRequest instead of sending |
Member
|
Ugh, not sure why I missed that. Thanks, I think this looks good but will wait for one more maintainer to have a look. |
cpu
approved these changes
Sep 10, 2026
cpu
left a comment
cpu
left a comment
Member
There was a problem hiding this comment.
Thanks! Seems reasonable to me. I had two very minor comment nits to consider.
oleksii-udovychenko
force-pushed
the
reject-psk-withdrawal-after-hrr
branch
from
September 10, 2026 15:15
10dca06 to
d53de85
Compare
oleksii-udovychenko
force-pushed
the
reject-psk-withdrawal-after-hrr
branch
from
September 10, 2026 15:18
d53de85 to
f8273ac
Compare
Contributor
Author
|
Pushed the RFC number update just now. Thanks! |
cpu
approved these changes
Sep 10, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RFC 8446 §4.1.2 lists exhaustively what a client may change in its second ClientHello after a HelloRetryRequest. A
pre_shared_keyextension may be updated there (recomputing the binders, adjusting the obfuscated ticket age, and optionally dropping PSKs incompatible with the server's chosen cipher suite), but withdrawing the extension altogether is not one of the permitted changes.We accepted that anyway.
ExpectClientHellokept no record of whether the first ClientHello carried a PSK offer, so a second hello that omitted the extension was handled as if the client had never offered a PSK at all.This PR:
PeerMisbehaved::MissingPskExtensionInSecondClientHello, which maps to amissing_extensionalertExpectClientHello::offered_psk_before_retrywhen emitting the HelloRetryRequest, and rejects a second hello that drops it inclient_hello::handle_client_helloResume-Server-OmitAllPSKsOnSecondClientHello, which was disabled with aTODOreason