commit dbe87f08ec4d621d3c28d328d220cba845c5629a
author Ronald Cron <ronald.cron@arm.com> Thu Feb 10 14:35:27 2022 +0100
committer Ronald Cron <ronald.cron@arm.com> Tue Mar 29 18:58:31 2022 +0200
tree 2930c1f8737886e05c6107bc3172bee4b7199e3c
parent 9f0fba374ce496450c3fcc5415e55c172acaa28a

Propose TLS 1.3 and TLS 1.2

Signed-off-by: Ronald Cron <ronald.cron@arm.com>

library/ssl_tls13_client.c

diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index 0f7448f..97cf61b 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -49,6 +49,8 @@
                                                    size_t *out_len )
 {
     unsigned char *p = buf;
+    unsigned char versions_len = ( ssl->handshake->min_minor_ver <=
+                                   MBEDTLS_SSL_MINOR_VERSION_3 ) ? 4 : 2;
 
     *out_len = 0;
 
@@ -58,35 +60,37 @@
      * - extension_type         (2 bytes)
      * - extension_data_length  (2 bytes)
      * - versions_length        (1 byte )
-     * - versions               (2 bytes)
+     * - versions               (2 to 4 bytes)
      */
-    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 7 );
 
-    /* Write extension_type */
+    MBEDTLS_SSL_CHK_BUF_PTR( p, end, 9 );
+
     MBEDTLS_PUT_UINT16_BE( MBEDTLS_TLS_EXT_SUPPORTED_VERSIONS, p, 0 );
-
-    /* Write extension_data_length */
-    MBEDTLS_PUT_UINT16_BE( 3, p, 2 );
+    MBEDTLS_PUT_UINT16_BE( versions_len + 1, p, 2 );
     p += 4;
 
     /* Length of versions */
-    *p++ = 0x2;
+    *p++ = versions_len;
 
     /* Write values of supported versions.
-     *
      * They are defined by the configuration.
-     *
-     * Currently, only one version is advertised.
+     * Currently, we advertise only TLS 1.3 or both TLS 1.3 and TLS 1.2.
      */
-    mbedtls_ssl_write_version( ssl->conf->max_major_ver,
-                               ssl->conf->max_minor_ver,
-                               ssl->conf->transport, p );
+    mbedtls_ssl_write_version( MBEDTLS_SSL_MAJOR_VERSION_3,
+                               MBEDTLS_SSL_MINOR_VERSION_4,
+                               MBEDTLS_SSL_TRANSPORT_STREAM, p );
+    MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [3:4]" ) );
 
-    MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [%d:%d]",
-                                ssl->conf->max_major_ver,
-                                ssl->conf->max_minor_ver ) );
 
-    *out_len = 7;
+    if( ssl->handshake->min_minor_ver <= MBEDTLS_SSL_MINOR_VERSION_3 )
+    {
+        mbedtls_ssl_write_version( MBEDTLS_SSL_MAJOR_VERSION_3,
+                                   MBEDTLS_SSL_MINOR_VERSION_3,
+                                   MBEDTLS_SSL_TRANSPORT_STREAM, p + 2 );
+        MBEDTLS_SSL_DEBUG_MSG( 3, ( "supported version: [3:3]" ) );
+    }
+
+    *out_len = 5 + versions_len;
 
     return( 0 );
 }