ssl_api_ext: lock ticket key context in the public key APIs

[yosuke-wolfssl]

Problem

wolfSSL_CTX_get_tlsext_ticket_keys() and wolfSSL_CTX_set_tlsext_ticket_keys() read and overwrite ctx->ticketKeyCtx.name, key[0], key[1] and expirary[0..1] field by field with no lock, while DefTicketEncCb() guards those same fields with ticketKeyCtx.mutex. A management thread rotating session ticket keys on a live WOLFSSL_CTX races a handshake: the setter can leave a name from one key set beside a key from another, producing tickets that cannot be resumed, and the getter can return a key set that never existed. Closes f-13440.

A second, latent issue in the same code: TicketEncCbCtx_Init() is only called when NO_TLS is undefined, but both APIs compiled regardless, so a --disable-tls --enable-session-ticket build reached a mutex that was never initialized.

Fix (src/ssl_api_ext.c)

Both functions take ticketKeyCtx.mutex across the entire copy, via a locking else if that extends the existing argument-validation chain — no new scope block and no goto:

• wc_LockMutex() failure returns WOLFSSL_FAILURE; the doc comment of each function now names that as a failure case.
• wc_UnLockMutex() runs at the end of the copy branch.
• Both lock sites sit under #ifndef SINGLE_THREADED — the mutex field only exists there.

The guard now matches the one on the context's initializer:

Site	Guard
TicketEncCbCtx_Init() call, src/internal.c	HAVE_SESSION_TICKET, !NO_WOLFSSL_SERVER, !WOLFSSL_NO_DEF_TICKET_ENC_CB, !NO_TLS
Both APIs, src/ssl_api_ext.c	same (!NO_TLS added)
Prototypes, wolfssl/ssl.h	same (!NO_TLS added)

Test harness (tests/api/test_session.c)

test_wolfSSL_ticket_keys_threaded() seeds the context with one key blob, then runs a writer thread alternating two blobs through the setter while the main thread calls the getter and asserts every read returns one blob whole. Guarded on the file's existing condition plus !SINGLE_THREADED; registered in tests/api/test_session.h.

Verification

• Negative control: 10/10 failures with only the locks reverted, 10/10 passes with them in place.
• ThreadSanitizer: data race on ticketKeyCtx.expirary[0] between the setter and getter before the fix, zero reports after.
• make check 5 passed / 5 skipped / 0 failed; session group 3 passed / 0 failed.
• Builds clean under --enable-singlethreaded (test reports skipped) and under --disable-tls --enable-session-ticket, where both symbols are correctly absent from the library.
• No ASan/UBSan run: the change adds locking around existing copies and touches no buffer arithmetic, so it is outside that class.

Not in this PR

The encrypt path in DefTicketEncCb() still reads keyCtx->name and key[keyIdx] without the lock — a deliberate lock-light design documented in that function. A setter racing an in-flight encrypt can therefore still tear.

[Copilot]

🟢 Approval recommended

The locking and NO_TLS gating are consistent with the context initialization guard and are backed by a targeted threaded regression test.

Pull request overview

This PR hardens the session ticket key public APIs against concurrent access by taking the existing ticketKeyCtx.mutex across the full key blob copy, and aligns API availability with the actual initialization conditions (notably !NO_TLS). It also adds a threaded regression test to catch mixed/teared reads during key rotation.

Changes:

• Add mutex locking to wolfSSL_CTX_get_tlsext_ticket_keys() / wolfSSL_CTX_set_tlsext_ticket_keys() to serialize full-blob reads/writes of the ticket key context.
• Add !defined(NO_TLS) to the compile guards for the public prototypes and the implementation so the APIs are absent when TLS is disabled.
• Add and register a threaded API test that validates reads always return an intact, whole key blob under concurrent writes.

File summaries

File	Description
src/ssl_api_ext.c	Locks ctx->ticketKeyCtx.mutex around the full key copy for get/set, and updates doc comments to include mutex-lock failure as a return case.
wolfssl/ssl.h	Adds !defined(NO_TLS) to the prototype guard to match the implementation/initializer availability.
tests/api/test_session.c	Adds test_wolfSSL_ticket_keys_threaded() to exercise concurrent setter/getter behavior and detect mixed key blobs.
tests/api/test_session.h	Registers the new threaded session ticket keys test in the session test group.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11403

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11403

Scan targets checked: wolfcrypt-rs-bugs, wolfssl-bugs, wolfssl-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[github-actions]

MemBrowse Memory Report

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• linuxkm-standard
• stm32-sim-stm32h753