Mirrors/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2026-10-02 11:10:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'fix/esp_tls_cert_flags_on_handshake_failure' into 'master'

Browse Source 
fix(esp-tls): report certificate flags when the handshake fails

Closes IDF-16151

See merge request espressif/esp-idf!52627
This commit is contained in:
Mahavir Jain
2026-09-13 16:22:44 +05:30
parent a1b76d3f45 8fbfc7fc5f
commit 4ce95a0296
1 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/esp-tls/esp_tls_mbedtls.c
+14 -3
View File
@@ -301,11 +301,22 @@ int esp_mbedtls_handshake(esp_tls_t *tls, const esp_tls_cfg_t *cfg)
ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret);
ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_MBEDTLS_SSL_HANDSHAKE_FAILED); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_MBEDTLS_SSL_HANDSHAKE_FAILED);
if (cfg->crt_bundle_attach != NULL || cfg->cacert_buf != NULL || cfg->use_global_ca_store == true) { if (cfg->crt_bundle_attach != NULL || cfg->cacert_buf != NULL || cfg->use_global_ca_store == true) {
if (mbedtls_ssl_get_peer_cert(&tls->ssl) != NULL) { /* Check whether the handshake failed because of an invalid certificate.
/* This is to check whether handshake failed due to invalid certificate*/ * Three values are not certificate failures:
* - 0xFFFFFFFF is the initial value of verify_result. mbedTLS sets it in
* mbedtls_ssl_session_init() to mark the result as not available, and also
* returns it when the session context is absent.
* - 0 means that the peer certificate passed verification, and that the
* handshake failed for a different reason.
* - MBEDTLS_X509_BADCERT_SKIP_VERIFY means that mbedTLS did not verify a
* certificate at all. A TLS 1.3 handshake that resumes a session uses a
* PSK key exchange, and mbedTLS marks the result as skipped. */
uint32_t verify_result = mbedtls_ssl_get_verify_result(&tls->ssl);
if (verify_result != 0 && verify_result != 0xFFFFFFFF
&& verify_result != MBEDTLS_X509_BADCERT_SKIP_VERIFY) {
esp_mbedtls_verify_certificate(tls); esp_mbedtls_verify_certificate(tls);
} else { } else {
ESP_LOGD(TAG, "Skipping certificate verification - no peer certificate received"); ESP_LOGD(TAG, "Skipping certificate verification - handshake did not fail on the peer certificate");
} }
} }
tls->conn_state = ESP_TLS_FAIL; tls->conn_state = ESP_TLS_FAIL;