diff --git a/library/ssl_tls.c b/library/ssl_tls.c index e9563f9993ef..4c37849ce518 100644 --- a/library/ssl_tls.c +++ b/library/ssl_tls.c @@ -1602,7 +1602,7 @@ void mbedtls_ssl_conf_session_cache( mbedtls_ssl_config *conf, } #endif /* MBEDTLS_SSL_SRV_C */ -#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_NEW_SESSION_TICKET_REMOVED) +#if defined(MBEDTLS_SSL_CLI_C) && defined(MBEDTLS_SSL_SESSION_TICKETS) int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session *session ) { int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED; @@ -1643,7 +1643,7 @@ int mbedtls_ssl_set_session( mbedtls_ssl_context *ssl, const mbedtls_ssl_session return( 0 ); } -#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_NEW_SESSION_TICKET_REMOVED */ +#endif /* MBEDTLS_SSL_CLI_C && MBEDTLS_SSL_SESSION_TICKETS */ void mbedtls_ssl_conf_ciphersuites( mbedtls_ssl_config *conf, const int *ciphersuites ) diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c index a78a1b2245ba..b62a56966b70 100644 --- a/library/ssl_tls13_client.c +++ b/library/ssl_tls13_client.c @@ -2575,9 +2575,10 @@ static int ssl_tls13_write_early_data_coordinate( mbedtls_ssl_context *ssl ) MBEDTLS_CHECK_RETURN_CRITICAL static int ssl_tls13_write_early_data_postprocess( mbedtls_ssl_context *ssl ) { +#if defined(MBEDTLS_ZERO_RTT) /* Clear PSK we've used for the 0-RTT. */ mbedtls_ssl_remove_hs_psk( ssl ); - +#endif mbedtls_ssl_handshake_set_state( ssl, MBEDTLS_SSL_SERVER_HELLO ); return ( 0 ); } diff --git a/library/ssl_tls13_generic.c b/library/ssl_tls13_generic.c index f01fe84ce64b..f2585c937a56 100644 --- a/library/ssl_tls13_generic.c +++ b/library/ssl_tls13_generic.c @@ -237,8 +237,6 @@ static void ssl_tls13_create_verify_structure( const unsigned char *transcript_h *verify_buffer_len = idx; } -#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ - /* Coordinate: Check whether a certificate verify message is expected. * Returns a negative value on failure, and otherwise * - SSL_CERTIFICATE_VERIFY_SKIP @@ -253,7 +251,7 @@ static int ssl_tls13_read_certificate_verify_coordinate( mbedtls_ssl_context *ss if( mbedtls_ssl_tls13_key_exchange_mode_with_psk( ssl ) ) return( SSL_CERTIFICATE_VERIFY_SKIP ); -#if !defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) +#if !defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED) MBEDTLS_SSL_DEBUG_MSG( 1, ( "should never happen" ) ); return( MBEDTLS_ERR_SSL_INTERNAL_ERROR ); #else @@ -261,10 +259,9 @@ static int ssl_tls13_read_certificate_verify_coordinate( mbedtls_ssl_context *ss return( SSL_CERTIFICATE_VERIFY_SKIP ); return( SSL_CERTIFICATE_VERIFY_READ ); -#endif /* MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED */ +#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED */ } -#if defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED) /* Parse and validate CertificateVerify message * * Note: The size of the hash buffer is assumed to be large enough to diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c index 9c260204e4f8..89097836ec17 100644 --- a/library/ssl_tls13_keys.c +++ b/library/ssl_tls13_keys.c @@ -787,7 +787,7 @@ int mbedtls_ssl_tls13_calculate_verify_data( mbedtls_ssl_context* ssl, return( ret ); } -#if defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED) +#if defined(MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED) /* mbedtls_ssl_tls13_create_psk_binder(): * * 0 @@ -892,7 +892,7 @@ int mbedtls_ssl_tls13_create_psk_binder( mbedtls_ssl_context *ssl, mbedtls_platform_zeroize( binder_key, sizeof( binder_key ) ); return( ret ); } -#endif /* MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED */ +#endif /* MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_SOME_PSK_ENABLED */ int mbedtls_ssl_tls13_populate_transform( mbedtls_ssl_transform *transform, int endpoint, diff --git a/programs/ssl/ssl_client2.c b/programs/ssl/ssl_client2.c index cdea89510607..532c07086ec6 100644 --- a/programs/ssl/ssl_client2.c +++ b/programs/ssl/ssl_client2.c @@ -3228,7 +3228,7 @@ int main( int argc, char *argv[] ) * 9. Reconnect? */ reconnect: -#if defined(MBEDTLS_SSL_NEW_SESSION_TICKET_REMOVED) +#if defined(MBEDTLS_SSL_SESSION_TICKETS) if( opt.reconnect != 0 ) { --opt.reconnect; @@ -3339,7 +3339,7 @@ int main( int argc, char *argv[] ) goto send_request; } -#endif /* MBEDTLS_SSL_NEW_SESSION_TICKET_REMOVED */ +#endif /* MBEDTLS_SSL_SESSION_TICKETS */ /* * Cleanup and exit diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh index be1ee5158799..b1c3a9c21b16 100755 --- a/tests/ssl-opt.sh +++ b/tests/ssl-opt.sh @@ -2161,6 +2161,8 @@ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 requires_config_enabled MBEDTLS_DEBUG_C requires_config_enabled MBEDTLS_SSL_SRV_C requires_config_enabled MBEDTLS_SSL_CLI_C +requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED run_test "TLS 1.3, TLS1-3-AES-128-CCM-SHA256, ECDHE-ECDSA, CLI+SRV auth, with ticket" \ "$P_SRV_ crt_file=data_files/server5.crt key_file=data_files/server5.key \ nbio=2 debug_level=5 force_version=tls13 auth_mode=required tls13_kex_modes=all tickets=1" \ @@ -2183,6 +2185,8 @@ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 requires_config_enabled MBEDTLS_DEBUG_C requires_config_enabled MBEDTLS_SSL_SRV_C requires_config_enabled MBEDTLS_SSL_CLI_C +requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED run_test "TLS 1.3, TLS1-3-AES-128-GCM-SHA256, ECDHE-ECDSA, CLI+SRV auth, with ticket" \ "$P_SRV_ crt_file=data_files/server5.crt key_file=data_files/server5.key \ nbio=2 debug_level=5 force_version=tls13 auth_mode=required tls13_kex_modes=all tickets=1" \ @@ -2205,6 +2209,8 @@ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 requires_config_enabled MBEDTLS_DEBUG_C requires_config_enabled MBEDTLS_SSL_SRV_C requires_config_enabled MBEDTLS_SSL_CLI_C +requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED run_test "TLS 1.3, TLS1-3-AES-128-CCM-8-SHA256, ECDHE-ECDSA, CLI+SRV auth, with ticket" \ "$P_SRV_ crt_file=data_files/server5.crt key_file=data_files/server5.key \ nbio=2 debug_level=5 force_version=tls13 auth_mode=required tls13_kex_modes=all tickets=1" \ @@ -2227,6 +2233,8 @@ requires_config_enabled MBEDTLS_SSL_PROTO_TLS1_3 requires_config_enabled MBEDTLS_DEBUG_C requires_config_enabled MBEDTLS_SSL_SRV_C requires_config_enabled MBEDTLS_SSL_CLI_C +requires_all_configs_enabled MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED \ + MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED run_test "TLS 1.3, TLS1-3-AES-256-GCM-SHA384, ECDHE-ECDSA, CLI+SRV auth, with ticket" \ "$P_SRV_ crt_file=data_files/server5.crt key_file=data_files/server5.key \ nbio=2 debug_level=5 force_version=tls13 auth_mode=required tls13_kex_modes=all tickets=1" \ diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function index da9650181efe..b2ce06a78a3f 100644 --- a/tests/suites/test_suite_ssl.function +++ b/tests/suites/test_suite_ssl.function @@ -4510,7 +4510,7 @@ void ssl_tls13_derive_resumption_secrets( int hash_alg, } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3 */ +/* BEGIN_CASE depends_on:MBEDTLS_SSL_PROTO_TLS1_3:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED:MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED */ void ssl_tls13_create_psk_binder( int hash_alg, data_t *psk, int psk_type,