From 84e640ddb87acb065b50b236cf8ea97035a35089 Mon Sep 17 00:00:00 2001 From: Jeongik Cha Date: Thu, 31 Oct 2024 00:36:56 +0900 Subject: [PATCH] mbedtls: verify_mode should match to auth_mode SSL_VERIFY_PEER->MBEDTLS_SSL_VERIFY_REQUIRED SSL_VERIFY_FAIL_IF_NO_PEER_CERT->MBEDTLS_SSL_VERIFY_OPTIONAL --- lib/tls/mbedtls/wrapper/platform/ssl_pm.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/tls/mbedtls/wrapper/platform/ssl_pm.c b/lib/tls/mbedtls/wrapper/platform/ssl_pm.c index 196c9219d..5961f4f11 100755 --- a/lib/tls/mbedtls/wrapper/platform/ssl_pm.c +++ b/lib/tls/mbedtls/wrapper/platform/ssl_pm.c @@ -255,10 +255,10 @@ static int ssl_pm_reload_crt(SSL *ssl) struct pkey_pm *pkey_pm = (struct pkey_pm *)ssl->cert->pkey->pkey_pm; struct x509_pm *crt_pm = (struct x509_pm *)ssl->cert->x509->x509_pm; - if (ssl->verify_mode == SSL_VERIFY_PEER) - mode = MBEDTLS_SSL_VERIFY_OPTIONAL; - else if (ssl->verify_mode == SSL_VERIFY_FAIL_IF_NO_PEER_CERT) + if ((ssl->verify_mode & SSL_VERIFY_PEER) > 0) mode = MBEDTLS_SSL_VERIFY_REQUIRED; + else if ((ssl->verify_mode & SSL_VERIFY_FAIL_IF_NO_PEER_CERT) > 0) + mode = MBEDTLS_SSL_VERIFY_OPTIONAL; else if (ssl->verify_mode == SSL_VERIFY_CLIENT_ONCE) mode = MBEDTLS_SSL_VERIFY_UNSET; else