arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-06-12 01:53:07 +03:00
Code Activity

Add a dump of received FP and CERT when in debug mode (#6300)

Browse Source 
* Add a dump of received FP and CERT when in debug mode

To simplify BearSSL debugging, print the received FP (when it doesn't
match the expected) and the binary certificate (always), when in debug
mode.

* Add documentation section on FP mismatch in rare instances.
This commit is contained in:
Earle F. Philhower, III
2019-07-14 14:09:44 -07:00
committed by GitHub
parent 38d8b6efde
commit c18b402c31
2 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
libraries/ESP8266WiFi/src/WiFiClientSecureBearSSL.cpp
View File

@ -654,6 +654,13 @@ extern "C" {
if (!xc->done_cert) {
br_sha1_update(&xc->sha1_cert, buf, len);
br_x509_decoder_push(&xc->ctx, (const void*)buf, len);
#ifdef DEBUG_ESP_SSL
DEBUG_BSSL("CERT: ");
for (size_t i=0; i<len; i++) {
DEBUG_ESP_PORT.printf_P(PSTR("%02x "), buf[i] & 0xff);
}
DEBUG_ESP_PORT.printf_P(PSTR("\n"));
#endif
}
}
@ -676,7 +683,24 @@ extern "C" {
char res[20];
br_sha1_out(&xc->sha1_cert, res);
if (xc->match_fingerprint && memcmp(res, xc->match_fingerprint, sizeof(res))) {
#ifdef DEBUG_ESP_SSL
DEBUG_BSSL("insecure_end_chain: Received cert FP doesn't match\n");
char buff[3 * sizeof(res) + 1]; // 3 chars per byte XX_, and null
buff[0] = 0;
for (size_t i=0; i<sizeof(res); i++) {
char hex[4]; // XX_\0
snprintf(hex, sizeof(hex), "%02x ", xc->match_fingerprint[i] & 0xff);
strlcat(buff, hex, sizeof(buff));
}
DEBUG_BSSL("insecure_end_chain: expected %s\n", buff);
buff[0] =0;
for (size_t i=0; i<sizeof(res); i++) {
char hex[4]; // XX_\0
snprintf(hex, sizeof(hex), "%02x ", res[i] & 0xff);
strlcat(buff, hex, sizeof(buff));
}
DEBUG_BSSL("insecure_end_chain: received %s\n", buff);
#endif
return BR_ERR_X509_NOT_TRUSTED;
}