Fix implementation of VERIFY_OPTIONAL verification mode
This commit changes the behaviour of mbedtls_ssl_parse_certificate
to make the two authentication modes SSL_VERIFY_REQUIRED and
SSL_VERIFY_OPTIONAL be in the following relationship:
Mode == SSL_VERIFY_REQUIRED
<=> Mode == SSL_VERIFY_OPTIONAL + check verify result
Also, it changes the behaviour to perform the certificate chain
verification even if the trusted CA chain is empty. Previously, the
function failed in this case, even when using optional verification,
which was brought up in #864.
diff --git a/ChangeLog b/ChangeLog
index a64de5d..d33897c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -15,6 +15,12 @@
* Wipe stack buffers in RSA private key operations
(rsa_rsaes_pkcs1_v15_decrypt(), rsa_rsaes_oaep_decrypt).
Found by Laurent Simon.
+ * Accept empty trusted CA chain in authentication mode
+ SSL_VERIFY_OPTIONAL. Fixes #864. Found by jethrogb.
+ * Fix implementation of ssl_parse_certificate
+ to not annihilate fatal errors in authentication mode
+ SSL_VERIFY_OPTIONAL and to reflect bad EC curves
+ within verification result.
= mbed TLS 1.3.19 branch released 2017-03-08