From ededcccda5db9a1c73f66853f76e69a3c8423373 Mon Sep 17 00:00:00 2001 From: Ashish Sharma Date: Fri, 28 Mar 2025 15:46:48 +0800 Subject: [PATCH] feat(mbedtls): new config to allow weak cert verification --- components/esp-tls/esp_tls_mbedtls.c | 4 ++-- components/mbedtls/Kconfig | 7 +++++++ .../mbedtls/port/include/mbedtls/esp_config.h | 15 +++++++++++++++ 3 files changed, 24 insertions(+), 2 deletions(-) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index b05fe835d3..aab8c8d427 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -1,5 +1,5 @@ /* - * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD + * SPDX-FileCopyrightText: 2019-2025 Espressif Systems (Shanghai) CO LTD * * SPDX-License-Identifier: Apache-2.0 */ @@ -294,7 +294,7 @@ ssize_t esp_mbedtls_write(esp_tls_t *tls, const char *data, size_t datalen) return ret; } else { // Exiting the tls-write process as less than desired datalen are writable - ESP_LOGD(TAG, "mbedtls_ssl_write() returned -0x%04zX, already written %zu, exitting...", -ret, written); + ESP_LOGD(TAG, "mbedtls_ssl_write() returned -0x%04zX, already written %zu, exiting...", -ret, written); mbedtls_print_error_msg(ret); return (written > 0) ? written : ret; } diff --git a/components/mbedtls/Kconfig b/components/mbedtls/Kconfig index aaac9ab1bb..ec9647067c 100644 --- a/components/mbedtls/Kconfig +++ b/components/mbedtls/Kconfig @@ -1230,4 +1230,11 @@ menu "mbedTLS" which is added through vfs component for ESP32 based targets or by the host system when the target is Linux. + config MBEDTLS_ALLOW_WEAK_CERTIFICATE_VERIFICATION + bool "Allow weak certificate verification" + default n + help + This options allows weak certificate verification by skipping the hostname verification. + It is not recommended to use this option. + endmenu # mbedTLS diff --git a/components/mbedtls/port/include/mbedtls/esp_config.h b/components/mbedtls/port/include/mbedtls/esp_config.h index d71ae1072f..6b25a2f065 100644 --- a/components/mbedtls/port/include/mbedtls/esp_config.h +++ b/components/mbedtls/port/include/mbedtls/esp_config.h @@ -2088,6 +2088,21 @@ #undef MBEDTLS_ERROR_C #endif +/** + * \def MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME + * + * Caller: library/ssl_tls.c + * + * Allow weak certificate verification without a hostname. + * This option is not recommended for production use. + */ + +#if CONFIG_MBEDTLS_ALLOW_WEAK_CERTIFICATE_VERIFICATION +#define MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME +#else +#undef MBEDTLS_SSL_CLI_ALLOW_WEAK_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME +#endif + /** * \def MBEDTLS_GCM_C *