-
Notifications
You must be signed in to change notification settings - Fork 2.7k
Disabling MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE reduces interoperability #9551
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Labels
Comments
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 9, 2024
The documentation of MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE suggested that disabling it breaks TLS 1.3 when an incompatible middlebox is disabled. But it actually breaks interoperability with any TLS 1.3 client or server that has middlebox compatibility active, such as OpenSSL or GnuTLS with default settings. Document this. Mbed-TLS#9551 Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 11, 2024
The documentation of MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE suggested that disabling it breaks TLS 1.3 when an incompatible middlebox is disabled. But it actually breaks interoperability with any TLS 1.3 client or server that has middlebox compatibility active, such as OpenSSL or GnuTLS with default settings. Document this. Mbed-TLS#9551 Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 12, 2024
The documentation of MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE suggested that disabling it breaks TLS 1.3 when an incompatible middlebox is disabled. But it actually breaks interoperability with any TLS 1.3 client or server that has middlebox compatibility active, such as OpenSSL or GnuTLS with default settings. Document this. Mbed-TLS#9551 Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 13, 2024
Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 13, 2024
Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 13, 2024
Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 13, 2024
Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 13, 2024
Signed-off-by: Gilles Peskine <[email protected]>
Merged
5 tasks
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 20, 2024
Signed-off-by: Gilles Peskine <[email protected]>
gilles-peskine-arm
added a commit
to gilles-peskine-arm/mbedtls
that referenced
this issue
Sep 24, 2024
Signed-off-by: Gilles Peskine <[email protected]>
5 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
As of Mbed TLS 3.6.1, the documentation of suggests that disabling it breaks TLS 1.3 when an incompatible middlebox is disabled. But it actually breaks interoperability with any TLS 1.3 client or server that has middlebox compatibility active, such as OpenSSL or GnuTLS with default settings.
I will fix the documentation in #9546 (+ forward port).Thanks to Ronald's advice, the fix is very easy, all it takes is to adapt the tests. Done in #9563.The definition of done for this issue is that disabling
MBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
only breaks interoperability when a middlebox is involved, and that it has no effect on interoperability with a peer that has middlebox compatibility enabled. This is how GnuTLS and OpenSSL behave. In particular, even whenMBEDTLS_SSL_TLS1_3_COMPATIBILITY_MODE
is disabled,ssl_client1
andssl_server
should interoperate with GnuTLS and OpenSSL with their default settings (without requiring-no_middlebox
or%DISABLE_TLS13_COMPAT_MODE
).The text was updated successfully, but these errors were encountered: