lib/mbedtls
1
0
Fork 0
mirror of https://github.com/Mbed-TLS/mbedtls.git synced 2025-08-01 10:06:53 +03:00
Code Activity

Merge pull request #6498 from yuhaoth/pr/fix-session-resumption-fail-when-hostname-is-not-localhost

Browse Source 
BUG: Fix session resumption fail when hostname is not localhost
This commit is contained in:
Gilles Peskine
2022-11-07 17:33:38 +01:00
committed by GitHub
parent 34c09469f3 e8734d8a55
commit bf249accc7
4 changed files with 40 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
library/ssl_tls.c
View File

@ -1012,6 +1012,30 @@ static int ssl_conf_check(const mbedtls_ssl_context *ssl)
if( ret != 0 )
return( ret );
#if defined(MBEDTLS_SSL_PROTO_TLS1_3)
/* RFC 8446 section 4.4.3
*
* If the verification fails, the receiver MUST terminate the handshake with
* a "decrypt_error" alert.
*
* If the client is configured as TLS 1.3 only with optional verify, return
* bad config.
*
*/
if( mbedtls_ssl_conf_tls13_ephemeral_enabled(
(mbedtls_ssl_context *)ssl ) &&
ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT &&
ssl->conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
ssl->conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
ssl->conf->authmode == MBEDTLS_SSL_VERIFY_OPTIONAL )
{
MBEDTLS_SSL_DEBUG_MSG(
1, ( "Optional verify auth mode "
"is not available for TLS 1.3 client" ) );
return( MBEDTLS_ERR_SSL_BAD_CONFIG );
}
#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */
/* Space for further checks */
return( 0 );