Skip to content

Commit 770346f

Browse files
Add warning when no authenticator, drop verify()
Print a warning when in debug mode when a BearSSL connection tries to connect without having any defined authentication methods, since it will fail. Completely remove the empty axTLS compatibilty method "::verify(char *fp, char *name)" because it can't be done w/BearSSL w/o code changes, and always failed. Better to have a compile failure when we know at compile time the app won't do what is expected. Completes the changes started by @d-a-v in PR esp8266#4833
1 parent 678c7be commit 770346f

File tree

2 files changed

+8
-1
lines changed

2 files changed

+8
-1
lines changed

libraries/ESP8266WiFi/src/WiFiClientSecureBearSSL.cpp

+7
Original file line numberDiff line numberDiff line change
@@ -847,6 +847,13 @@ bool WiFiClientSecure::_connectSSL(const char* hostName) {
847847
_freeSSL();
848848
_oom_err = false;
849849

850+
#ifdef DEBUG_ESP_SSL
851+
// BearSSL will reject all connections unless an authentication option is set, warn in DEBUG builds
852+
if (!_use_insecure && !_use_fingerprint && !_use_self_signed && !_knownkey && !_certStore && !_ta) {
853+
DEBUGV("BSSL: Connection *will* fail, no authentication method is setup");
854+
}
855+
#endif
856+
850857
_sc = std::make_shared<br_ssl_client_context>();
851858
_eng = &_sc->eng; // Allocation/deallocation taken care of by the _sc shared_ptr
852859
_iobuf_in = std::shared_ptr<unsigned char>(new unsigned char[_iobuf_in_size], std::default_delete<unsigned char[]>());

libraries/ESP8266WiFi/src/WiFiClientSecureBearSSL.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ class WiFiClientSecure : public WiFiClient {
120120
static bool probeMaxFragmentLength(const String host, uint16_t port, uint16_t len);
121121

122122
// AXTLS compatible wrappers
123-
bool verify(const char* fingerprint, const char* domain_name) { (void) fingerprint; (void) domain_name; return false; } // Can't handle this case, need app code changes
123+
// Cannot implement this mode, we need FP before we can connect: bool verify(const char* fingerprint, const char* domain_name)
124124
bool verifyCertChain(const char* domain_name) { (void)domain_name; return connected(); } // If we're connected, the cert passed validation during handshake
125125

126126
bool setCACert(const uint8_t* pk, size_t size);

0 commit comments

Comments
 (0)