Merge branch 'contrib/github_pr_17641_v6.0' into 'release/v6.0'

Allow the https server to request client certs only with OPTIONAL (GitHub PR) (v6.0)

See merge request espressif/esp-idf!43454

components/esp-tls/Kconfig

@@ -63,13 +63,14 @@ menu "ESP-TLS"
     config ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
         bool "ESP-TLS Server: Set minimum Certificate Verification mode to Optional"
         depends on ESP_TLS_USING_MBEDTLS
+        default n
         help
-            When this option is enabled, the peer (here, the client) certificate is checked by the server,
-            however the handshake continues even if verification failed. By default, the
-            peer certificate is not checked and ignored by the server.
+            When this option is enabled, the ESP-TLS server can be configured to
+            request client certificates optionally. This is done by setting the
+            client_cert_authmode_optional field in the esp_https_server_config_t structure.
 
             mbedtls_ssl_get_verify_result() can be called after the handshake is complete to
-            retrieve status of verification.
+            retrieve status of verification of the client certificate, if presented.
 
     config ESP_TLS_PSK_VERIFICATION
         bool "Enable PSK verification"

components/esp-tls/esp_tls.h

@@ -297,6 +297,10 @@ typedef struct esp_tls_cfg_server {
     unsigned int cacert_pem_bytes;          /*!< Size of client CA certificate legacy name */
     };
 
+#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
+    bool client_cert_authmode_optional;              /*!< Set client certificate authentication mode to optional.
+                                                     By default, client certificate authentication mode is set to required */
+#endif // CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
     union {
     const unsigned char *servercert_buf;        /*!< Server certificate in a buffer
                                                      This buffer should be NULL terminated */

components/esp-tls/esp_tls_mbedtls.c

@@ -757,12 +757,11 @@ static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls)
         if (esp_ret != ESP_OK) {
             return esp_ret;
         }
-    } else {
 #ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
-        mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
-#else
-        mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_NONE);
-#endif
+        if (cfg->client_cert_authmode_optional) {
+            mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
+        }
+#endif // CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
     }
 
     if (cfg->use_secure_element) {

components/esp_https_server/include/esp_https_server.h

@@ -91,6 +91,11 @@ struct httpd_ssl_config {
     /** CA certificate byte length */
     size_t cacert_len;
 
+#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
+    /** Client certificate authentication mode */
+    bool client_cert_authmode_optional;
+#endif // CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
+
     /** Private key */
     const uint8_t *prvtkey_pem;
 
@@ -154,6 +159,16 @@ struct httpd_ssl_config {
 
 typedef struct httpd_ssl_config httpd_ssl_config_t;
 
+/**
+ * Helper macro for optional client certificate authentication field
+ */
+#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
+#define HTTPD_SSL_CONFIG_CLIENT_AUTH_OPTIONAL_INIT \
+    .client_cert_authmode_optional = false,
+#else
+#define HTTPD_SSL_CONFIG_CLIENT_AUTH_OPTIONAL_INIT
+#endif
+
 /**
  * Default config struct init
  * Notes:
@@ -197,6 +212,7 @@ typedef struct httpd_ssl_config httpd_ssl_config_t;
     .servercert_len = 0,                          \
     .cacert_pem = NULL,                           \
     .cacert_len = 0,                              \
+    HTTPD_SSL_CONFIG_CLIENT_AUTH_OPTIONAL_INIT    \
     .prvtkey_pem = NULL,                          \
     .prvtkey_len = 0,                             \
     .use_ecdsa_peripheral = false,                \

components/esp_https_server/src/https_server.c

@@ -278,6 +278,9 @@ static esp_err_t create_secure_context(const struct httpd_ssl_config *config, ht
     cfg->userdata = config->ssl_userdata;
     cfg->alpn_protos = config->alpn_protos;
     cfg->tls_handshake_timeout_ms = config->tls_handshake_timeout_ms;
+#ifdef CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
+    cfg->client_cert_authmode_optional = config->client_cert_authmode_optional;
+#endif // CONFIG_ESP_TLS_SERVER_MIN_AUTH_MODE_OPTIONAL
 
     cfg->tls_version = config->tls_version;
     cfg->ciphersuites_list = config->ciphersuites_list;