From def7ae4404f707aa3ce2228137d5e88804bb5a35 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Sun, 30 Oct 2022 14:13:19 +0800 Subject: [PATCH] Add auth mode check Signed-off-by: Jerry Yu --- library/ssl_tls.c | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/library/ssl_tls.c b/library/ssl_tls.c index a49f774ed1..6446b760e0 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -1012,6 +1012,30 @@ static int ssl_conf_check(const mbedtls_ssl_context *ssl) if( ret != 0 ) return( ret ); +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) + /* RFC 8446 section 4.4.3 + * + * If the verification fails, the receiver MUST terminate the handshake with + * a "decrypt_error" alert. + * + * If the client is configured as TLS 1.3 only with optional verify, return + * bad config. + * + */ + if( mbedtls_ssl_conf_tls13_ephemeral_enabled( + (mbedtls_ssl_context *)ssl ) && + ssl->conf->endpoint == MBEDTLS_SSL_IS_CLIENT && + ssl->conf->max_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 && + ssl->conf->min_tls_version == MBEDTLS_SSL_VERSION_TLS1_3 && + ssl->conf->authmode == MBEDTLS_SSL_VERIFY_OPTIONAL ) + { + MBEDTLS_SSL_DEBUG_MSG( + 1, ( "Optional verfiy auth mode " + "is not available for TLS 1.3 client" ) ); + return( MBEDTLS_ERR_SSL_BAD_CONFIG ); + } +#endif /* MBEDTLS_SSL_PROTO_TLS1_3 */ + /* Space for further checks */ return( 0 );