commit ce3b95e2c9cd26cc39fd2b4c79d6c79fe2fb3336
author Jerry Yu <jerry.h.yu@arm.com> Tue Oct 31 16:02:04 2023 +0800
committer Jerry Yu <jerry.h.yu@arm.com> Wed Nov 01 10:32:17 2023 +0800
tree fd536bc12ac4c149a0aec8aac15d07356eedb77f
parent 454dda3e250597b94069918ea2cbf54959f72618

move ticket version check

Signed-off-by: Jerry Yu <jerry.h.yu@arm.com>

library/ssl_tls13_server.c

diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c
index 44abb4b..5a0c69f 100644
--- a/library/ssl_tls13_server.c
+++ b/library/ssl_tls13_server.c
@@ -159,6 +159,13 @@
     /* We delete the temporary buffer */
     mbedtls_free(ticket_buffer);
 
+#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
+    if (ret == 0 && session->tls_version != MBEDTLS_SSL_VERSION_TLS1_3) {
+        MBEDTLS_SSL_DEBUG_MSG(3, ("ticket version invalid."));
+        ret = MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
+    }
+#endif
+
     if (ret != 0) {
         goto exit;
     }
@@ -1752,7 +1759,6 @@
 #if defined(MBEDTLS_SSL_EARLY_DATA)
 static void ssl_tls13_update_early_data_status(mbedtls_ssl_context *ssl)
 {
-    mbedtls_ssl_session *session = ssl->session_negotiate;
     mbedtls_ssl_handshake_params *handshake = ssl->handshake;
 
     if ((handshake->received_extensions &
@@ -1781,12 +1787,6 @@
         return;
     }
 
-    if (session->tls_version != MBEDTLS_SSL_VERSION_TLS1_3) {
-        MBEDTLS_SSL_DEBUG_MSG(
-            1,
-            ("EarlyData: rejected, not a TLS 1.3 ticket."));
-        return;
-    }
 
     /* TODO: Add more checks here. */