From 93566780479215d389b17b523c7797ca01676ef3 Mon Sep 17 00:00:00 2001 From: Pengyu Lv Date: Wed, 7 Dec 2022 12:10:05 +0800 Subject: [PATCH] filter the tickets with tls13_kex_mode on client side. Signed-off-by: Pengyu Lv --- library/ssl_tls13_client.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index e824a5431..d5a41ce5e 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -672,11 +672,22 @@ static psa_algorithm_t ssl_tls13_get_ciphersuite_hash_alg(int ciphersuite) } #if defined(MBEDTLS_SSL_SESSION_TICKETS) +static int ssl_tls13_has_compat_ticket_flags(mbedtls_ssl_context *ssl) +{ + mbedtls_ssl_session *session = ssl->session_negotiate; + return session != NULL && + mbedtls_ssl_conf_tls13_check_kex_modes(ssl, + mbedtls_ssl_tls13_session_get_ticket_flags( + session, + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_ALL)); +} + static int ssl_tls13_has_configured_ticket(mbedtls_ssl_context *ssl) { mbedtls_ssl_session *session = ssl->session_negotiate; return ssl->handshake->resume && - session != NULL && session->ticket != NULL; + session != NULL && session->ticket != NULL && + ssl_tls13_has_compat_ticket_flags(ssl); } #if defined(MBEDTLS_SSL_EARLY_DATA)