From fceddb310e740605b389cf97035b8d9303fb4b58 Mon Sep 17 00:00:00 2001 From: Jerry Yu Date: Mon, 12 Dec 2022 15:30:34 +0800 Subject: [PATCH] Add early data permission check Signed-off-by: Jerry Yu --- library/ssl_tls13_server.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/library/ssl_tls13_server.c b/library/ssl_tls13_server.c index 78a85633b..e3ee95b1c 100644 --- a/library/ssl_tls13_server.c +++ b/library/ssl_tls13_server.c @@ -1845,6 +1845,14 @@ static void ssl_tls13_update_early_data_status(mbedtls_ssl_context *ssl) } + if (mbedtls_ssl_session_get_ticket_flags( + ssl->session_negotiate, + MBEDTLS_SSL_TLS1_3_TICKET_ALLOW_EARLY_DATA) == 0) { + MBEDTLS_SSL_DEBUG_MSG( + 1, + ("EarlyData: rejected, denied by ticket permission bits.")); + return; + } ssl->early_data_status = MBEDTLS_SSL_EARLY_DATA_STATUS_ACCEPTED;