Issue

The TLS 1.3 implementation allowed ApplicationData records to be processed prior to the Finished message being received.

Impact

A server which is attempting to enforce client authentication via certificates can by bypassed by a client which entirely omits Certificate, CertificateVerify, and the Finished message and instead sends application data records.

Workarounds

Several workarounds for this issue are possible including:

• Disable TLS 1.3 and use TLS 1.2, which correctly enforces the ordering of application vs handshake messages.
• If peer certificate authentication is expected, check the return value of Channel::peer_cert_chain
• Override TLS::Callbacks::tls_inspect_handshake_msg in your application and verify that a Finished message is received.

Credit

Reported by Ben Smyth