Address review: make the 0-RTT fresh start check clock-safe

TimeNowInMilliseconds() reports failure as 0. InitSSL_Ctx stored that as a
real timestamp, which under WOLFSSL_32BIT_MILLI_TIME made every ticket look
like it predated the ctx. Treat a 0 return as "no clock" and skip the check.

The WOLFSSL_32BIT_MILLI_TIME comparison keyed its wrap window to the ctx
uptime rather than the ticket age, so once the ctx had been alive longer
than 2^31 ms (~24.9 days) it flagged its own fresh tickets and rejected all
0-RTT from then on. Bound both the ctx age and the ticket delta by the max
ticket age instead: past that age DoClientTicketCheck has already rejected
anything that could predate the ctx.

Document that the check needs a restart-comparable clock. Ports whose
millisecond clock counts from boot restart it near zero, so the check does
not fire for tickets minted before a reboot.

Author: julek-wolfssl

src/internal.c

@@ -2662,7 +2662,14 @@ int InitSSL_Ctx(WOLFSSL_CTX* ctx, WOLFSSL_METHOD* method, void* heap)
      * down to a whole second because stateful tickets only store second
      * resolution. */
     ctx->ticketStartTime = TimeNowInMilliseconds();
-    ctx->ticketStartTime -= ctx->ticketStartTime % 1000;
+    if (ctx->ticketStartTime == 0) {
+        /* TimeNowInMilliseconds() reports failure as 0. Without a reference
+         * point the check cannot run, so turn it off for this ctx. */
+        ctx->noFreshStartCheck = 1;
+    }
+    else {
+        ctx->ticketStartTime -= ctx->ticketStartTime % 1000;
+    }
 #endif
 
 #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_TLS_READ_AHEAD)

src/tls13.c

@@ -6641,12 +6641,22 @@ static int DoPreSharedKeys(WOLFSSL* ssl, const byte* input, word32 inputSz,
              * Flag tickets minted before this ctx was created. */
             if (!ssl->ctx->noFreshStartCheck) {
         #ifdef WOLFSSL_32BIT_MILLI_TIME
-                /* Wrap-safe: the max ticket age is far below half of the
-                 * 2^32 ms range. */
+                /* A 32 bit ms clock wraps every ~49.7 days, so the ctx age is
+                 * only exact while it stays below the max ticket age. Past
+                 * that point DoClientTicketCheck has already rejected
+                 * anything old enough to predate the ctx, so the check can be
+                 * skipped. A ctx that survives the wrap re-enters the window
+                 * for one max-ticket-age span and rejects 0-RTT until it
+                 * leaves again. */
+                word32 now = TimeNowInMilliseconds();
+                word32 ctxAge = now - ssl->ctx->ticketStartTime;
                 word32 delta = ssl->ctx->ticketStartTime -
                                ssl->session->ticketSeen;
                 ssl->options.ticketPredatesCtx =
-                    (delta != 0 && delta < 0x80000000U);
+                    (now != 0 &&
+                     ctxAge <= (word32)TLS13_MAX_TICKET_AGE * 1000 &&
+                     delta != 0 &&
+                     delta <= (word32)TLS13_MAX_TICKET_AGE * 1000);
         #else
                 ssl->options.ticketPredatesCtx =
                     (ssl->session->ticketSeen < ssl->ctx->ticketStartTime);
@@ -17147,6 +17157,10 @@ int wolfSSL_CTX_set_max_early_data(WOLFSSL_CTX* ctx, unsigned int sz)
  * then accepted for tickets minted before this ctx was created. Only use
  * this when the anti-replay state reliably survives server restarts.
  *
+ * The check needs TimeNowInMilliseconds() to be comparable across restarts.
+ * On ports where it counts from boot the check never fires for tickets
+ * minted before a reboot.
+ *
  * ctx  The SSL/TLS CTX object.
  * returns BAD_FUNC_ARG when ctx is NULL or not TLS v1.3, SIDE_ERROR when
  * called with a client and 0 on success.