Merge branch 'feature/esp_http_client_support_setting_server_common_n…

…ame' into 'master' tcp_transport: Add support of setting the common name for the TLS Closes IDFGH-8194 See merge request espressif/esp-idf!20102
espressif · Sep 13, 2022 · f684ab6 · f684ab6
2 parents 0b04838 + 4904d57
commit f684ab6
Show file tree

Hide file tree

Showing 5 changed files with 29 additions and 14 deletions.
diff --git a/components/esp_http_client/esp_http_client.c b/components/esp_http_client/esp_http_client.c
@@ -670,6 +670,10 @@ esp_http_client_handle_t esp_http_client_init(const esp_http_client_config_t *co
     if (config->skip_cert_common_name_check) {
         esp_transport_ssl_skip_common_name_check(ssl);
     }
+
+    if (config->common_name) {
+        esp_transport_ssl_set_common_name(ssl, config->common_name);
+    }
 #endif
 
     if (_set_config(client, config) != ESP_OK) {

diff --git a/components/esp_http_client/include/esp_http_client.h b/components/esp_http_client/include/esp_http_client.h
@@ -129,6 +129,9 @@ typedef struct {
     bool                        is_async;                 /*!< Set asynchronous mode, only supported with HTTPS for now */
     bool                        use_global_ca_store;      /*!< Use a global ca_store for all the connections in which this bool is set. */
     bool                        skip_cert_common_name_check;    /*!< Skip any validation of server certificate CN field */
+    const char                  *common_name;             /*!< Pointer to the string containing server certificate common name.
+                                                               If non-NULL, server certificate CN must match this name,
+                                                               If NULL, server certificate CN must match hostname. */
     esp_err_t (*crt_bundle_attach)(void *conf);      /*!< Function pointer to esp_crt_bundle_attach. Enables the use of certification
                                                           bundle for server verification, must be enabled in menuconfig */
     bool                        keep_alive_enable;   /*!< Enable keep-alive timeout */

diff --git a/components/tcp_transport/include/esp_transport_ssl.h b/components/tcp_transport/include/esp_transport_ssl.h
@@ -1,16 +1,8 @@
-// Copyright 2015-2018 Espressif Systems (Shanghai) PTE LTD
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
+/*
+ * SPDX-FileCopyrightText: 2015-2022 Espressif Systems (Shanghai) CO LTD
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
 
 #ifndef _ESP_TRANSPORT_SSL_H_
 #define _ESP_TRANSPORT_SSL_H_
@@ -142,6 +134,17 @@ void esp_transport_ssl_set_alpn_protocol(esp_transport_handle_t t, const char **
  */
 void esp_transport_ssl_skip_common_name_check(esp_transport_handle_t t);
 
+/**
+ * @brief      Set the server certificate's common name field
+ *
+ * @note
+ *             If non-NULL, server certificate CN must match this name,
+ *             If NULL, server certificate CN must match hostname.
+ * @param      t             ssl transport
+ *             common_name   A string containing the common name to be set
+ */
+void esp_transport_ssl_set_common_name(esp_transport_handle_t t, const char *common_name);
+
 /**
  * @brief      Set the ssl context to use secure element (atecc608a) for client(device) private key and certificate
  *

diff --git a/components/tcp_transport/transport_ssl.c b/components/tcp_transport/transport_ssl.c
@@ -408,6 +408,12 @@ void esp_transport_ssl_skip_common_name_check(esp_transport_handle_t t)
     ssl->cfg.skip_common_name = true;
 }
 
+void esp_transport_ssl_set_common_name(esp_transport_handle_t t, const char *common_name)
+{
+    GET_SSL_FROM_TRANSPORT_OR_RETURN(ssl, t);
+    ssl->cfg.common_name = common_name;
+}
+
 #ifdef CONFIG_ESP_TLS_USE_SECURE_ELEMENT
 void esp_transport_ssl_use_secure_element(esp_transport_handle_t t)
 {

diff --git a/tools/ci/check_copyright_ignore.txt b/tools/ci/check_copyright_ignore.txt
@@ -1260,7 +1260,6 @@ components/spi_flash/test/test_mmap.c
 components/spi_flash/test/test_out_of_bounds_write.c
 components/spi_flash/test/test_partition_ext.c
 components/spi_flash/test/test_spi_flash.c
-components/tcp_transport/include/esp_transport_ssl.h
 components/tcp_transport/include/esp_transport_tcp.h
 components/tcp_transport/include/esp_transport_ws.h
 components/tcp_transport/test/tcp_transport_fixtures.h