Skip to content

Commit ef94006

Browse files
committed
fix(tls): do not attach bundle from runtime
1 parent 8b4c130 commit ef94006

File tree

3 files changed

+22
-4
lines changed

3 files changed

+22
-4
lines changed

libraries/NetworkClientSecure/src/NetworkClientSecure.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,9 +317,11 @@ void NetworkClientSecure::setCACert(const char *rootCA) {
317317
void NetworkClientSecure::setCACertBundle(const uint8_t *bundle) {
318318
if (bundle != NULL) {
319319
esp_crt_bundle_set(bundle, sizeof(bundle));
320+
attach_ssl_certificate_bundle(true);
320321
_use_ca_bundle = true;
321322
} else {
322323
esp_crt_bundle_detach(NULL);
324+
attach_ssl_certificate_bundle(false);
323325
_use_ca_bundle = false;
324326
}
325327
}

libraries/NetworkClientSecure/src/ssl_client.cpp

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@
2626

2727
const char *pers = "esp32-tls";
2828

29+
typedef esp_err_t (*crt_bundle_attach_cb)(void *conf);
30+
static crt_bundle_attach_cb _bundle_attach_cb = NULL;
31+
2932
static int _handle_error(int err, const char *function, int line) {
3033
if (err == -30848) {
3134
return err;
@@ -51,6 +54,14 @@ void ssl_init(sslclient_context *ssl_client) {
5154
ssl_client->peek_buf = -1;
5255
}
5356

57+
void attach_ssl_certificate_bundle(bool att) {
58+
if (att) {
59+
_bundle_attach_cb = &esp_crt_bundle_attach;
60+
} else {
61+
_bundle_attach_cb = NULL;
62+
}
63+
}
64+
5465
int start_ssl_client(
5566
sslclient_context *ssl_client, const IPAddress &ip, uint32_t port, const char *hostname, int timeout, const char *rootCABuff, bool useRootCABundle,
5667
const char *cli_cert, const char *cli_key, const char *pskIdent, const char *psKey, bool insecure, const char **alpn_protos
@@ -195,11 +206,15 @@ int start_ssl_client(
195206
return handle_error(ret);
196207
}
197208
} else if (useRootCABundle) {
198-
log_v("Attaching root CA cert bundle");
199-
ret = esp_crt_bundle_attach(&ssl_client->ssl_conf);
209+
if (_bundle_attach_cb != NULL) {
210+
log_v("Attaching root CA cert bundle");
211+
ret = _bundle_attach_cb(&ssl_client->ssl_conf);
200212

201-
if (ret < 0) {
202-
return handle_error(ret);
213+
if (ret < 0) {
214+
return handle_error(ret);
215+
}
216+
} else {
217+
log_e("useRootCABundle is set, but attach_ssl_certificate_bundle(true); was not called!");
203218
}
204219
} else if (pskIdent != NULL && psKey != NULL) {
205220
log_v("Setting up PSK");

libraries/NetworkClientSecure/src/ssl_client.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@ int start_ssl_client(
3737
sslclient_context *ssl_client, const IPAddress &ip, uint32_t port, const char *hostname, int timeout, const char *rootCABuff, bool useRootCABundle,
3838
const char *cli_cert, const char *cli_key, const char *pskIdent, const char *psKey, bool insecure, const char **alpn_protos
3939
);
40+
void attach_ssl_certificate_bundle(bool att);
4041
int ssl_starttls_handshake(sslclient_context *ssl_client);
4142
void stop_ssl_socket(sslclient_context *ssl_client);
4243
int data_to_read(sslclient_context *ssl_client);

0 commit comments

Comments
 (0)