commit 93566780479215d389b17b523c7797ca01676ef3
author Pengyu Lv <pengyu.lv@arm.com> Wed Dec 07 12:10:05 2022 +0800
committer Pengyu Lv <pengyu.lv@arm.com> Fri Jan 13 11:05:56 2023 +0800
tree babc78bb2c5dfdd09e56d162795eb6ff1edfea46
parent e6487fe3c25a20a1ae87ea6211f4118a86684cdd

filter the tickets with tls13_kex_mode on client side.

Signed-off-by: Pengyu Lv <pengyu.lv@arm.com>

library/ssl_tls13_client.c

diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index e824a54..d5a41ce 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -672,11 +672,22 @@
 }
 
 #if defined(MBEDTLS_SSL_SESSION_TICKETS)
+static int ssl_tls13_has_compat_ticket_flags(mbedtls_ssl_context *ssl)
+{
+    mbedtls_ssl_session *session = ssl->session_negotiate;
+    return session != NULL &&
+           mbedtls_ssl_conf_tls13_check_kex_modes(ssl,
+                                                  mbedtls_ssl_tls13_session_get_ticket_flags(
+                                                      session,
+                                                      MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL));
+}
+
 static int ssl_tls13_has_configured_ticket(mbedtls_ssl_context *ssl)
 {
     mbedtls_ssl_session *session = ssl->session_negotiate;
     return ssl->handshake->resume &&
-           session != NULL && session->ticket != NULL;
+           session != NULL && session->ticket != NULL &&
+           ssl_tls13_has_compat_ticket_flags(ssl);
 }
 
 #if defined(MBEDTLS_SSL_EARLY_DATA)