net: sockets: tls: Add new options for certificate verification #90068
Conversation
Add new TLS socket option, TLS_CERT_VERIFY_RESULT, to obtain the certificate verification result from the most recent handshake on the socket. The option works if TLS_PEER_VERIFY_OPTIONAL was set on the socket, in which case the handshake may succeed even if certificate verification fails. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
Extract server configuration, client configuration and test shutdown into separate functions so that they're reusable in other tests. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
Add test case to verify if TLS_CERT_VERIFY_RESULT socket option works as expected. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
rlubos
force-pushed
the
net/tls-cert-verify-opts
branch
from
fa5c83c to
fc6641d
Compare
subsys/net/lib/sockets/sockets_tls.c
Outdated
| } | ||
|
|
||
| cert_verify = (struct tls_cert_verify_cb *)optval; | ||
| if (cert_verify->cb == NULL && cert_verify->ctx != NULL) { |
There was a problem hiding this comment.
Why do we care what the ctx is here, or was the idea that user can unset the callback by setting both values null (this is not documented if that is the idea)?
There was a problem hiding this comment.
I just thought that setting context w/o the callback does not make sense. Perhaps we should just forbid the NULL cb pointer?
There was a problem hiding this comment.
Is user able to unregister the callback somehow, or does it make sense in the first place?
There was a problem hiding this comment.
I'm not sure actually if mbed TLS allows that, perhaps better to check for NULL pointer after all. I'll send a fix.
Add new TLS socket option, TLS_CERT_VERIFY_CALLBACK, which allows to register an application callback to verify certificates obtained during the TLS handshake. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
Add test case to verify if TLS_CERT_VERIFY_CALLBACK socket option works as expected. Signed-off-by: Robert Lubos <robert.lubos@nordicsemi.no>
rlubos
force-pushed
the
net/tls-cert-verify-opts
branch
from
fc6641d to
8b7775c
Compare
|
Add new TLS socket options:
TLS_CERT_VERIFY_RESULTto retrieve certificate verification result,TLS_CERT_VERIFY_CALLBACKto regsiter ceritificate verification callback.Plus associated tests.
Resolves #52541