commit cdc26ae099ff89a6184eebfcffd7414acd54c424
author Manuel Pégourié-Gonnard <mpg@elzevir.fr> Fri Jun 19 12:16:31 2015 +0200
committer Manuel Pégourié-Gonnard <mpg@elzevir.fr> Mon Jun 22 14:52:40 2015 +0200
tree 5f0a8459c6d2ff6a273a3faed0138ef39973ab0d
parent a752d8780ceac07146b9b8b4620f82913034c4de

Add mbedtls_ssl_set_hs_authmode

While at it, fix the following:
- on server with RSA_PSK, we don't want to set flags (client auth happens via
  the PSK, no cert is expected).
- use safer tests (eg == OPTIONAL vs != REQUIRED)

library/ssl_srv.c

diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index f09c916..02bc3db 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -2349,16 +2349,24 @@
     size_t ct_len, sa_len; /* including length bytes */
     unsigned char *buf, *p;
     const mbedtls_x509_crt *crt;
+    int authmode;
 
     MBEDTLS_SSL_DEBUG_MSG( 2, ( "=> write certificate request" ) );
 
     ssl->state++;
 
+#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
+    if( ssl->handshake->sni_authmode != MBEDTLS_SSL_VERIFY_UNSET )
+        authmode = ssl->handshake->sni_authmode;
+    else
+#endif
+        authmode = ssl->conf->authmode;
+
     if( ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_PSK ||
         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_RSA_PSK ||
         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_DHE_PSK ||
         ciphersuite_info->key_exchange == MBEDTLS_KEY_EXCHANGE_ECDHE_PSK ||
-        ssl->conf->authmode == MBEDTLS_SSL_VERIFY_NONE )
+        authmode == MBEDTLS_SSL_VERIFY_NONE )
     {
         MBEDTLS_SSL_DEBUG_MSG( 2, ( "<= skip write certificate request" ) );
         return( 0 );