Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-08-18 06:35:35 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(esp-tls): close CA-verification bypass during session resumption

Browse Source 
The session-resumption else-if in set_client_config() short-circuited
the CA verification chain when only client_session was supplied. Remove
the branch so session-only configs fall through to the normal error /
skip-verify path; resumption no longer silently disables CA validation.
This commit is contained in:
Aditya Patwardhan
2026-04-04 10:23:00 +05:30
parent 8f3d8b41c3
commit 15ac4697f3
1 changed files with 0 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
components/esp-tls/esp_tls_mbedtls.c
View File

@@ -1003,10 +1003,6 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t
ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret);
return ESP_ERR_MBEDTLS_SSL_CONF_PSK_FAILED;
}
#endif
#ifdef CONFIG_ESP_TLS_CLIENT_SESSION_TICKETS
} else if (cfg->client_session != NULL) {
ESP_LOGD(TAG, "Reusing the saved client session");
#endif
} else {
#ifdef CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY