espressif/openthread
1
0
Fork 0
mirror of https://github.com/espressif/openthread.git synced 2026-09-14 05:00:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

[crypto] avoid direct access to crypto context structs members (#12700)

Browse Source 
This commit improves robustness and forward compatibility of Secure
Transport with newer MbedTLS/PSA configurations. There are places
where mbedtls structures are accessed directly , which can be fragile
when internal struct layouts change across Mbed TLS configurations or
versions.

To address this, this commit makes the following changes:

1. Replace direct TLS struct member access in secure transport with
mbedtls_ssl_get_peer_cert(), and tighten state/null checks to improve
robustness and forward compatibility with newer MbedTLS/PSA
configurations.
This commit is contained in:
silabs-HarshaK
2026-04-07 14:07:02 -05:00
committed by GitHub
parent a44970bdb4
commit bb31558fac
1 changed files with 18 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/core/meshcop/secure_transport.cpp
+18 -34
View File
@@ -1208,27 +1208,20 @@ Error SecureTransport::Extension::GetPeerCertificateBase64(unsigned char *aPeerC
size_t *aCertLength, size_t *aCertLength,
size_t aCertBufferSize) size_t aCertBufferSize)
{ {
Error error = kErrorNone; Error error = kErrorNone;
SecureSession *session = mSecureTransport.mSessions.GetHead(); SecureSession *session;
const mbedtls_x509_crt *peerCert;
session = mSecureTransport.mSessions.GetHead();
VerifyOrExit(session != nullptr, error = kErrorInvalidState); VerifyOrExit(session != nullptr, error = kErrorInvalidState);
VerifyOrExit(session->IsConnected(), error = kErrorInvalidState); VerifyOrExit(session->IsConnected(), error = kErrorInvalidState);
#if (MBEDTLS_VERSION_NUMBER >= 0x03010000) peerCert = mbedtls_ssl_get_peer_cert(&session->mSsl);
VerifyOrExit(mbedtls_base64_encode(aPeerCert, aCertBufferSize, aCertLength, VerifyOrExit(peerCert != nullptr, error = kErrorInvalidState);
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.p,
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.len) == VerifyOrExit(mbedtls_base64_encode(aPeerCert, aCertBufferSize, aCertLength, peerCert->raw.p, peerCert->raw.len) ==
0, 0,
error = kErrorNoBufs); error = kErrorNoBufs);
#else
VerifyOrExit(
mbedtls_base64_encode(
aPeerCert, aCertBufferSize, aCertLength,
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(
len)) == 0,
error = kErrorNoBufs);
#endif
exit: exit:
return error; return error;
@@ -1238,30 +1231,21 @@ exit:
#if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE) #if defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
Error SecureTransport::Extension::GetPeerCertificateDer(uint8_t *aPeerCert, size_t *aCertLength, size_t aCertBufferSize) Error SecureTransport::Extension::GetPeerCertificateDer(uint8_t *aPeerCert, size_t *aCertLength, size_t aCertBufferSize)
{ {
Error error = kErrorNone; Error error = kErrorNone;
SecureSession *session = mSecureTransport.mSessions.GetHead(); SecureSession *session;
const mbedtls_x509_crt *peerCert;
session = mSecureTransport.mSessions.GetHead();
VerifyOrExit(session != nullptr, error = kErrorInvalidState);
VerifyOrExit(session->IsConnected(), error = kErrorInvalidState); VerifyOrExit(session->IsConnected(), error = kErrorInvalidState);
#if (MBEDTLS_VERSION_NUMBER >= 0x03010000) peerCert = mbedtls_ssl_get_peer_cert(&session->mSsl);
VerifyOrExit(session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.len < aCertBufferSize, VerifyOrExit(peerCert != nullptr, error = kErrorInvalidState);
error = kErrorNoBufs);
*aCertLength = session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.len; VerifyOrExit(peerCert->raw.len <= aCertBufferSize, error = kErrorNoBufs);
memcpy(aPeerCert, session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->raw.p, *aCertLength);
#else *aCertLength = peerCert->raw.len;
VerifyOrExit( memcpy(aPeerCert, peerCert->raw.p, *aCertLength);
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len) <
aCertBufferSize,
error = kErrorNoBufs);
*aCertLength =
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len);
memcpy(aPeerCert,
session->mSsl.MBEDTLS_PRIVATE(session)->MBEDTLS_PRIVATE(peer_cert)->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
*aCertLength);
#endif
exit: exit:
return error; return error;