CN name check (IDFGH-3408) #158
Comments
|
Hi @coaxrobotics, thanks for the suggestion! I agree that being able to bypass this can be usual, as long as users are aware of the security implications! There is a MR in our pipeline now to add this as a config option. |
AdityaHPatwardhan
pushed a commit
to AdityaHPatwardhan/esp-mqtt
that referenced
this issue
Jul 21, 2020
Closes IDFGH-3408 Closes espressif#158
espressif-bot
pushed a commit
to espressif/esp-idf
that referenced
this issue
Sep 10, 2020
SSL: add config option for skipping common name check esp-mqtt commit: espressif/esp-mqtt@5e8950e) Closes espressif/esp-mqtt#158 SSL: add support for tls with secure element (ATECC608A) esp-mqtt commit: espressif/esp-mqtt@a7ff9af) Closes espressif/esp-mqtt#156 Websocket: Allow the query part of the uri to be a part of the path esp-mqtt commit: espressif/esp-mqtt@40b06de) Closes espressif/esp-mqtt#161 Config: Add check for consistency between config settings esp-mqtt commit: espressif/esp-mqtt@8a412c1) Add IDF version check for secure element feature esp-mqtt commit: espressif/esp-mqtt@db4bce0) Fix esp_mqtt_client_stop deadlock esp-mqtt commit: espressif/esp-mqtt@5e17dca) Closes espressif/esp-mqtt#163 Add dispatch error event for read errors esp-mqtt commit: espressif/esp-mqtt@d4aaec0 Closes #5704 Cleanup expired messages when offline esp-mqtt commit: espressif/esp-mqtt@bdadd77 Closes #5668 esp_mqtt_client_publish now returns msg id for QoS > 0 when offline esp-mqtt commit: espressif/esp-mqtt@f7325bf
espressif-bot
pushed a commit
to espressif/esp-idf
that referenced
this issue
Sep 16, 2020
SSL: add config option for skipping common name check esp-mqtt commit: espressif/esp-mqtt@5e8950e) Closes espressif/esp-mqtt#158 SSL: add support for tls with secure element (ATECC608A) esp-mqtt commit: espressif/esp-mqtt@a7ff9af) Closes espressif/esp-mqtt#156 Websocket: Allow the query part of the uri to be a part of the path esp-mqtt commit: espressif/esp-mqtt@40b06de) Closes espressif/esp-mqtt#161 Config: Add check for consistency between config settings esp-mqtt commit: espressif/esp-mqtt@8a412c1) Add IDF version check for secure element feature esp-mqtt commit: espressif/esp-mqtt@db4bce0) Fix esp_mqtt_client_stop deadlock esp-mqtt commit: espressif/esp-mqtt@5e17dca) Closes espressif/esp-mqtt#163 Add dispatch error event for read errors esp-mqtt commit: espressif/esp-mqtt@d4aaec0 Closes #5704 Cleanup expired messages when offline esp-mqtt commit: espressif/esp-mqtt@bdadd77 Closes #5668 esp_mqtt_client_publish now returns msg id for QoS > 0 when offline esp-mqtt commit: espressif/esp-mqtt@f7325bf Add support for Digital Signature through ESP-TLS esp-mqtt commit: espressif/esp-mqtt@7d8e59d
espressif-bot
pushed a commit
to espressif/esp-idf
that referenced
this issue
Sep 22, 2020
SSL: add config option for skipping common name check esp-mqtt commit: espressif/esp-mqtt@5e8950e) Closes espressif/esp-mqtt#158 SSL: add support for tls with secure element (ATECC608A) esp-mqtt commit: espressif/esp-mqtt@a7ff9af) Closes espressif/esp-mqtt#156 Websocket: Allow the query part of the uri to be a part of the path esp-mqtt commit: espressif/esp-mqtt@40b06de) Closes espressif/esp-mqtt#161 Config: Add check for consistency between config settings esp-mqtt commit: espressif/esp-mqtt@8a412c1) Add IDF version check for secure element feature esp-mqtt commit: espressif/esp-mqtt@db4bce0) Fix esp_mqtt_client_stop deadlock esp-mqtt commit: espressif/esp-mqtt@5e17dca) Closes espressif/esp-mqtt#163 Add dispatch error event for read errors esp-mqtt commit: espressif/esp-mqtt@d4aaec0 Closes #5704 Cleanup expired messages when offline esp-mqtt commit: espressif/esp-mqtt@bdadd77 Closes #5668 esp_mqtt_client_publish now returns msg id for QoS > 0 when offline esp-mqtt commit: espressif/esp-mqtt@f7325bf
|
#define MQTT_SUPPORTED_FEATURE_SKIP_CRT_CMN_NAME_CHECK seems in wrong #if ESP_IDF_VERSION guard. Currently MQTT_SUPPORTED_FEATURE_SKIP_CRT_CMN_NAME_CHECK is only defined when ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(4, 1, 0). I'm not sure if the target is adding the feature to 3.3.0 and 4.0.0 or just a mistake. |
|
Hmm, not sure what you mean here. I just tested it and It should be available in both those versions. |
|
I checked out esp-idf release/v4.0 branch, but I don't find MQTT_SUPPORTED_FEATURE_SKIP_CRT_CMN_NAME_CHECK. |
|
Ah you are right! I was looking at our internal repo. Both 3.3 and 4.0 should work when stuff gets synced to Github, sorry for the delay here! |
espressif-bot
pushed a commit
to espressif/esp-idf
that referenced
this issue
Oct 30, 2020
SSL: add config option for skipping common name check esp-mqtt commit: espressif/esp-mqtt@5e8950e) Closes espressif/esp-mqtt#158 Websocket: Allow the query part of the uri to be a part of the path esp-mqtt commit: espressif/esp-mqtt@40b06de) Closes espressif/esp-mqtt#161 Config: Add check for consistency between config settings esp-mqtt commit: espressif/esp-mqtt@8a412c1) Add IDF version check for secure element feature esp-mqtt commit: espressif/esp-mqtt@db4bce0) Fix esp_mqtt_client_stop deadlock esp-mqtt commit: espressif/esp-mqtt@5e17dca) Closes espressif/esp-mqtt#163 Add dispatch error event for read errors esp-mqtt commit: espressif/esp-mqtt@d4aaec0 Closes #5704 Cleanup expired messages when offline esp-mqtt commit: espressif/esp-mqtt@bdadd77 Closes #5668 esp_mqtt_client_publish now returns msg id for QoS > 0 when offline esp-mqtt commit: espressif/esp-mqtt@f7325bf
espressif-bot
pushed a commit
to espressif/esp-idf
that referenced
this issue
Nov 10, 2020
SSL: add config option for skipping common name check esp-mqtt commit: espressif/esp-mqtt@5e8950e) Closes espressif/esp-mqtt#158 Websocket: Allow the query part of the uri to be a part of the path esp-mqtt commit: espressif/esp-mqtt@40b06de) Closes espressif/esp-mqtt#161 Config: Add check for consistency between config settings esp-mqtt commit: espressif/esp-mqtt@8a412c1) Add IDF version check for secure element feature esp-mqtt commit: espressif/esp-mqtt@db4bce0) Fix esp_mqtt_client_stop deadlock esp-mqtt commit: espressif/esp-mqtt@5e17dca) Closes espressif/esp-mqtt#163 Add dispatch error event for read errors esp-mqtt commit: espressif/esp-mqtt@d4aaec0 Closes #5704 Cleanup expired messages when offline esp-mqtt commit: espressif/esp-mqtt@bdadd77 Closes #5668 esp_mqtt_client_publish now returns msg id for QoS > 0 when offline esp-mqtt commit: espressif/esp-mqtt@f7325bf
david-cermak
pushed a commit
that referenced
this issue
Dec 16, 2022
SSL: add config option for skipping common name check esp-mqtt commit: 5e8950e) Closes #158 SSL: add support for tls with secure element (ATECC608A) esp-mqtt commit: a7ff9af) Closes #156 Websocket: Allow the query part of the uri to be a part of the path esp-mqtt commit: 40b06de) Closes #161 Config: Add check for consistency between config settings esp-mqtt commit: 8a412c1) Add IDF version check for secure element feature esp-mqtt commit: db4bce0) Fix esp_mqtt_client_stop deadlock esp-mqtt commit: 5e17dca) Closes #163 Add dispatch error event for read errors esp-mqtt commit: d4aaec0 Closes espressif/esp-idf#5704 Cleanup expired messages when offline esp-mqtt commit: bdadd77 Closes espressif/esp-idf#5668 esp_mqtt_client_publish now returns msg id for QoS > 0 when offline esp-mqtt commit: f7325bf Add support for Digital Signature through ESP-TLS esp-mqtt commit: 7d8e59d
egnor
pushed a commit
to egnor/esp-mqtt
that referenced
this issue
Dec 23, 2022
SSL: add config option for skipping common name check esp-mqtt commit: espressif@5e8950e) Closes espressif#158 SSL: add support for tls with secure element (ATECC608A) esp-mqtt commit: espressif@a7ff9af) Closes espressif#156 Websocket: Allow the query part of the uri to be a part of the path esp-mqtt commit: espressif@40b06de) Closes espressif#161 Config: Add check for consistency between config settings esp-mqtt commit: espressif@8a412c1) Add IDF version check for secure element feature esp-mqtt commit: espressif@db4bce0) Fix esp_mqtt_client_stop deadlock esp-mqtt commit: espressif@5e17dca) Closes espressif#163 Add dispatch error event for read errors esp-mqtt commit: espressif@d4aaec0 Closes espressif/esp-idf#5704 Cleanup expired messages when offline esp-mqtt commit: espressif@bdadd77 Closes espressif/esp-idf#5668 esp_mqtt_client_publish now returns msg id for QoS > 0 when offline esp-mqtt commit: espressif@f7325bf Add support for Digital Signature through ESP-TLS esp-mqtt commit: espressif@7d8e59d
egnor
pushed a commit
to egnor/esp-mqtt
that referenced
this issue
Dec 23, 2022
SSL: add config option for skipping common name check esp-mqtt commit: espressif@5e8950e) Closes espressif#158 SSL: add support for tls with secure element (ATECC608A) esp-mqtt commit: espressif@a7ff9af) Closes espressif#156 Websocket: Allow the query part of the uri to be a part of the path esp-mqtt commit: espressif@40b06de) Closes espressif#161 Config: Add check for consistency between config settings esp-mqtt commit: espressif@8a412c1) Add IDF version check for secure element feature esp-mqtt commit: espressif@db4bce0) Fix esp_mqtt_client_stop deadlock esp-mqtt commit: espressif@5e17dca) Closes espressif#163 Add dispatch error event for read errors esp-mqtt commit: espressif@d4aaec0 Closes espressif/esp-idf#5704 Cleanup expired messages when offline esp-mqtt commit: espressif@bdadd77 Closes espressif/esp-idf#5668 esp_mqtt_client_publish now returns msg id for QoS > 0 when offline esp-mqtt commit: espressif@f7325bf Add support for Digital Signature through ESP-TLS esp-mqtt commit: espressif@7d8e59d
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Currently the library doesn't seem to allow to bypass server common name (CN) check. It would be convenient if there was a method to either bypass this check or override the CN that mbedTLS matches with the server certificate. This will be useful in connecting to broker on local network where the IP is usually dynamic and the broker certificate's CN field cannot reflect this.
The text was updated successfully, but these errors were encountered: