tls: disable resumption for mTLS with no session id context

Signed-off-by: Tim Perry <pimterry@gmail.com>
Backport-PR-URL: nodejs-private/node-private#1054
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
PR-URL: nodejs-private/node-private#1030
CVE-ID: CVE-2026-123872

Author: pimterry

src/crypto/crypto_tls.cc

@@ -102,6 +102,7 @@ SSL_SESSION* GetSessionCallback(
     int* copy) {
   TLSWrap* w = static_cast<TLSWrap*>(SSL_get_app_data(s));
   *copy = 0;
+  if (w->is_resumption_disabled()) return nullptr;
   return w->ReleaseSession();
 }
 
@@ -1519,7 +1520,15 @@ bool TLSWrap::PinServerName(std::string_view servername) {
 }
 
 bool TLSWrap::BindSessionsToServerName(std::string_view servername) {
-  if (sc_->session_id_context().empty()) return true;
+  // If we have no session id context and we need to verify peers, we reject
+  // all resumption since we can't do so securely.
+  if (sc_->session_id_context().empty()) {
+    if (SSL_get_verify_mode(ssl_.get()) & SSL_VERIFY_PEER) {
+      SSL_set_options(ssl_.get(), SSL_OP_NO_TICKET);
+      resumption_disabled_ = true;
+    }
+    return true;
+  }
 
   // Server names can't contain NULs, so a NUL keeps the parts apart.
   std::string input = sc_->session_id_context();

src/crypto/crypto_tls.h

@@ -65,6 +65,7 @@ class TLSWrap : public AsyncWrap,
   void set_cert_cb_running(bool on = true) { cert_cb_running_ = on; }
   void set_awaiting_new_session(bool on = true) { awaiting_new_session_ = on; }
   void enable_session_callbacks() { session_callbacks_ = true; }
+  bool is_resumption_disabled() const { return resumption_disabled_; }
   bool BindSessionsToServerName(std::string_view servername);
   bool PinServerName(std::string_view servername);
   bool is_server() const { return kind_ == Kind::kServer; }
@@ -284,6 +285,7 @@ class TLSWrap : public AsyncWrap,
   bool established_ = false;
   bool write_callback_scheduled_ = false;
   bool servername_pinned_ = false;
+  bool resumption_disabled_ = false;
 
   int cycle_depth_ = 0;
 

test/parallel/test-tls-resume-no-session-id-context.js

@@ -0,0 +1,81 @@
+'use strict';
+
+// A server with no session id context of its own - possible when creating a
+// TLSSocket directly - can't tell which application a session belongs to. One
+// that verifies client certificates mustn't resume any, or a session from an
+// application sharing its secure context (and so its ticket keys) would skip
+// the client's certificate check. It gets a full handshake instead.
+
+const common = require('../common');
+
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const assert = require('node:assert');
+const net = require('node:net');
+const tls = require('node:tls');
+const fixtures = require('../common/fixtures');
+
+const secureContext = tls.createSecureContext({
+  key: fixtures.readKey('agent2-key.pem'),
+  cert: fixtures.readKey('agent2-cert.pem'),
+});
+
+// Whether the server resumed each connection it accepted, in order.
+const reused = [];
+
+async function listen(requestCert) {
+  const server = net.createServer((socket) => {
+    const tlsSocket = new tls.TLSSocket(socket, {
+      isServer: true,
+      secureContext,
+      requestCert,
+    });
+    tlsSocket.on('secure', () => {
+      reused.push(tlsSocket.isSessionReused());
+      // End must be deferred on v22.x, or TLS 1.3 session tickets aren't sent:
+      setImmediate(() => tlsSocket.end());
+    });
+  });
+  await new Promise((resolve) => server.listen(0, resolve));
+  return server;
+}
+
+// Resolves with the first session issued, once the connection closes. This is
+// the raw session from the TLS library: on BoringSSL the 'session' event's
+// TLS 1.3 session can't be resumed.
+function connect(server, options) {
+  return new Promise((resolve) => {
+    let session;
+    const socket = tls.connect({
+      port: server.address().port,
+      rejectUnauthorized: false,
+      ...options,
+    });
+    const { onnewsession } = socket._handle;
+    socket._handle.onnewsession = function(id, raw) {
+      session ??= raw;
+      return onnewsession.call(this, id, raw);
+    };
+    socket.on('session', () => {});
+    socket.on('close', () => resolve(session));
+    socket.resume();
+  });
+}
+
+(async () => {
+  const open = await listen(false);
+  const verifying = await listen(true);
+
+  for (const maxVersion of ['TLSv1.2', 'TLSv1.3']) {
+    reused.length = 0;
+    const session = await connect(open, { maxVersion });
+    assert.ok(session);
+    await connect(open, { maxVersion, session });
+    await connect(verifying, { maxVersion, session });
+    assert.deepStrictEqual(reused, [false, true, false], maxVersion);
+  }
+
+  open.close();
+  verifying.close();
+})().then(common.mustCall());