espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-07-30 07:37:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] avoid direct access to crypto context structs members (#12700)

Browse Source 
This commit improves robustness and forward compatibility of Secure
Transport with newer MbedTLS/PSA configurations. There are places
where mbedtls structures are accessed directly , which can be fragile
when internal struct layouts change across Mbed TLS configurations or
versions.

To address this, this commit makes the following changes:

1. Replace direct TLS struct member access in secure transport with
mbedtls_ssl_get_peer_cert(), and tighten state/null checks to improve
robustness and forward compatibility with newer MbedTLS/PSA
configurations.
This commit is contained in:
silabs-HarshaK
2026-04-07 14:07:02 -05:00
committed by GitHub
parent a44970bdb4
commit bb31558fac
1 changed files with 18 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/meshcop/secure_transport.cpp
+18 -34
View File
@@ -1208,27 +1208,20 @@ Error SecureTransport::Extension::GetPeerCertificateBase64(unsigned char *aPeerC
size_t *aCertLength,
size_t aCertBufferSize)
{
Error error = kErrorNone;
SecureSession *session = mSecureTransport.mSessions.GetHead();
Error error = kErrorNone;
SecureSession *session;
const mbedtls_x509_crt *peerCert;
session = mSecureTransport.mSessions.GetHead();
VerifyOrExit(session != nullptr, error = kErrorInvalidState);
VerifyOrExit(session->IsConnected(), error = kErrorInvalidState);
#if (MBEDTLS_VERSION_NUMBER >= 0x03010000)
VerifyOrExit(mbedtls_base64_encode(aPeerCert, aCertBufferSize, aCertLength,
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.p,
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.len) ==
peerCert = mbedtls_ssl_get_peer_cert(&session->mSsl);
VerifyOrExit(peerCert != nullptr, error = kErrorInvalidState);
VerifyOrExit(mbedtls_base64_encode(aPeerCert, aCertBufferSize, aCertLength, peerCert->raw.p, peerCert->raw.len) ==
0,
error = kErrorNoBufs);
#else
VerifyOrExit(
mbedtls_base64_encode(
aPeerCert, aCertBufferSize, aCertLength,
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(
len)) == 0,
error = kErrorNoBufs);
#endif
exit:
return error;
@@ -1238,30 +1231,21 @@ exit:
#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Error SecureTransport::Extension::GetPeerCertificateDer(uint8_t *aPeerCert, size_t *aCertLength, size_t aCertBufferSize)
{
Error error = kErrorNone;
SecureSession *session = mSecureTransport.mSessions.GetHead();
Error error = kErrorNone;
SecureSession *session;
const mbedtls_x509_crt *peerCert;
session = mSecureTransport.mSessions.GetHead();
VerifyOrExit(session != nullptr, error = kErrorInvalidState);
VerifyOrExit(session->IsConnected(), error = kErrorInvalidState);
#if (MBEDTLS_VERSION_NUMBER >= 0x03010000)
VerifyOrExit(session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.len < aCertBufferSize,
error = kErrorNoBufs);
peerCert = mbedtls_ssl_get_peer_cert(&session->mSsl);
VerifyOrExit(peerCert != nullptr, error = kErrorInvalidState);
*aCertLength = session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.len;
memcpy(aPeerCert, session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.p, *aCertLength);
VerifyOrExit(peerCert->raw.len <= aCertBufferSize, error = kErrorNoBufs);
#else
VerifyOrExit(
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len) <
aCertBufferSize,
error = kErrorNoBufs);
*aCertLength =
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len);
memcpy(aPeerCert,
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
*aCertLength);
#endif
*aCertLength = peerCert->raw.len;
memcpy(aPeerCert, peerCert->raw.p, *aCertLength);
exit:
return error;