commit 3f616c24930e25b7d97d4eb0873bd0373b69106b
author Xiaokang Qian <xiaokang.qian@arm.com> Thu Jan 12 03:36:31 2023 +0000
committer Xiaokang Qian <xiaokang.qian@arm.com> Wed Feb 08 05:47:47 2023 +0000
tree c9e469066591add9b45749beba078513982de468
parent 1d8e86ce00353fe7b53fc1a2754255d89785a17c

Move selected_identity zero check to post_server_hello

Signed-off-by: Xiaokang Qian <xiaokang.qian@arm.com>

library/ssl_tls13_client.c

diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index c925f87..55e5665 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -1903,6 +1903,20 @@
             ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
             goto cleanup;
     }
+#if defined(MBEDTLS_SSL_EARLY_DATA)
+    if (ssl->handshake->sent_extensions & MBEDTLS_SSL_EXT_MASK(EARLY_DATA) &&
+        ssl->handshake->selected_identity != 0) {
+        /* RFC8446 4.2.11
+         * If the server supplies an "early_data" extension, the
+         * client MUST verify that the server's selected_identity
+         * is 0. If any other value is returned, the client MUST
+         * abort the handshake with an "illegal_parameter" alert.
+         */
+        MBEDTLS_SSL_PEND_FATAL_ALERT(MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
+                                     MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
+        return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
+    }
+#endif
 
     if (!mbedtls_ssl_conf_tls13_check_kex_modes(ssl, handshake->key_exchange_mode)) {
         ret = MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE;
@@ -2123,18 +2137,6 @@
                                                  MBEDTLS_ERR_SSL_DECODE_ERROR);
                     return MBEDTLS_ERR_SSL_DECODE_ERROR;
                 }
-                if (ssl->handshake->selected_identity != 0) {
-                    /* RFC8446 4.2.11
-                     * If the server supplies an "early_data" extension, the
-                     * client MUST verify that the server's selected_identity
-                     * is 0. If any other value is returned, the client MUST
-                     * abort the handshake with an "illegal_parameter" alert.
-                     */
-                    MBEDTLS_SSL_PEND_FATAL_ALERT(
-                        MBEDTLS_SSL_ALERT_MSG_ILLEGAL_PARAMETER,
-                        MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER);
-                    return MBEDTLS_ERR_SSL_ILLEGAL_PARAMETER;
-                }
 
                 break;
 #endif /* MBEDTLS_SSL_EARLY_DATA */