arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-04-19 23:22:16 +03:00
Code

Drop X509 after connection, avoid hang on TLS broken (#6065)

Browse Source 
* Drop X509 context after successful server verification to save heap space

After completing handshake in BSSL, server is already verified and X509 context is no longer needed. Depending on verification method it save more or less heap space.

* Bugfix: Report not connected if there is no ready data and TLS connection is broken

Added the change for reporting not connected if TLS session is broken and there is no more buffered decrypted data. TLS can be broken if message authentication (MAC) cannot be verified. BearSSL enters BR_SSL_CLOSED state when processing invalid encrypted application data fragment. In such situation the current implementation get stuck forever unless user has own timeout mechanism build on top of WiFiClientSecureBearSSL. This change introduce fail fast via connected() returning false. Further it imply return -1 from read methods indicating broken channel upon which user should perform reconnect if needed.

Fixes #6005
This commit is contained in:
Dave 2019-05-15 18:55:06 +02:00 committed by Earle F. Philhower, III
parent 501022404f
commit 75f01dc35a
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libraries/ESP8266WiFi/src/WiFiClientSecureBearSSL.cpp
View File

@ -255,7 +255,7 @@ bool WiFiClientSecure::_clientConnected() {
}
uint8_t WiFiClientSecure::connected() {
if (available() || (_clientConnected() && _handshake_done)) {
if (available() || (_clientConnected() && _handshake_done && (br_ssl_engine_current_state(_eng) != BR_SSL_CLOSED))) {
return true;
}
return false;
@ -1003,6 +1003,12 @@ bool WiFiClientSecure::_connectSSL(const char* hostName) {
DEBUG_BSSL("Connected!\n");
}
#endif
// Session is already validated here, there is no need to keep following
_x509_minimal = nullptr;
_x509_insecure = nullptr;
_x509_knownkey = nullptr;
return ret;
}