From 73ed158e7644b7926d4ec50af5a384ed8085b0f2 Mon Sep 17 00:00:00 2001 From: "Sergio R. Caprile" Date: Tue, 12 Aug 2025 12:00:59 -0300 Subject: [PATCH] Fix built-in TLS CA bundle, cleanup --- mongoose.h | 70 ++++++++++++++++++++++----------------------- test/data/e5.crt | 33 +++++++++++++++++++++ test/mip_tap_test.c | 12 ++++++-- test/unit_test.c | 19 ++++++++---- 4 files changed, 92 insertions(+), 42 deletions(-) create mode 100644 test/data/e5.crt diff --git a/mongoose.h b/mongoose.h index 3b50b26d..160ac1cd 100644 --- a/mongoose.h +++ b/mongoose.h @@ -3684,6 +3684,41 @@ struct mg_tcpip_driver_tms570_data { +#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_XMC7) && MG_ENABLE_DRIVER_XMC7 + +struct mg_tcpip_driver_xmc7_data { + int mdc_cr; // Valid values: -1, 0, 1, 2, 3, 4, 5 + uint8_t phy_addr; +}; + +#ifndef MG_TCPIP_PHY_ADDR +#define MG_TCPIP_PHY_ADDR 0 +#endif + +#ifndef MG_DRIVER_MDC_CR +#define MG_DRIVER_MDC_CR 3 +#endif + +#define MG_TCPIP_DRIVER_INIT(mgr) \ + do { \ + static struct mg_tcpip_driver_xmc7_data driver_data_; \ + static struct mg_tcpip_if mif_; \ + driver_data_.mdc_cr = MG_DRIVER_MDC_CR; \ + driver_data_.phy_addr = MG_TCPIP_PHY_ADDR; \ + mif_.ip = MG_TCPIP_IP; \ + mif_.mask = MG_TCPIP_MASK; \ + mif_.gw = MG_TCPIP_GW; \ + mif_.driver = &mg_tcpip_driver_xmc7; \ + mif_.driver_data = &driver_data_; \ + MG_SET_MAC_ADDRESS(mif_.mac); \ + mg_tcpip_init(mgr, &mif_); \ + MG_INFO(("Driver: xmc7, MAC: %M", mg_print_mac, mif_.mac)); \ + } while (0) + +#endif + + + #if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_XMC) && MG_ENABLE_DRIVER_XMC struct mg_tcpip_driver_xmc_data { @@ -3730,41 +3765,6 @@ struct mg_tcpip_driver_xmc_data { #endif - -#if MG_ENABLE_TCPIP && defined(MG_ENABLE_DRIVER_XMC7) && MG_ENABLE_DRIVER_XMC7 - -struct mg_tcpip_driver_xmc7_data { - int mdc_cr; // Valid values: -1, 0, 1, 2, 3, 4, 5 - uint8_t phy_addr; -}; - -#ifndef MG_TCPIP_PHY_ADDR -#define MG_TCPIP_PHY_ADDR 0 -#endif - -#ifndef MG_DRIVER_MDC_CR -#define MG_DRIVER_MDC_CR 3 -#endif - -#define MG_TCPIP_DRIVER_INIT(mgr) \ - do { \ - static struct mg_tcpip_driver_xmc7_data driver_data_; \ - static struct mg_tcpip_if mif_; \ - driver_data_.mdc_cr = MG_DRIVER_MDC_CR; \ - driver_data_.phy_addr = MG_TCPIP_PHY_ADDR; \ - mif_.ip = MG_TCPIP_IP; \ - mif_.mask = MG_TCPIP_MASK; \ - mif_.gw = MG_TCPIP_GW; \ - mif_.driver = &mg_tcpip_driver_xmc7; \ - mif_.driver_data = &driver_data_; \ - MG_SET_MAC_ADDRESS(mif_.mac); \ - mg_tcpip_init(mgr, &mif_); \ - MG_INFO(("Driver: xmc7, MAC: %M", mg_print_mac, mif_.mac)); \ - } while (0) - -#endif - - #ifdef __cplusplus } #endif diff --git a/test/data/e5.crt b/test/data/e5.crt new file mode 100644 index 00000000..d7db75fc --- /dev/null +++ b/test/data/e5.crt @@ -0,0 +1,33 @@ +- Make sure your PEM file starts with a dash - + + +Issuer: C=US, O=Internet Security Research Group, CN=ISRG Root X1 +Not Before: Mar 13 00:00:00 2024 GMT +Not After : Mar 12 23:59:59 2027 GMT +-----BEGIN CERTIFICATE----- +MIIEVzCCAj+gAwIBAgIRAIOPbGPOsTmMYgZigxXJ/d4wDQYJKoZIhvcNAQELBQAw +TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh +cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw +WhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg +RW5jcnlwdDELMAkGA1UEAxMCRTUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQNCzqK +a2GOtu/cX1jnxkJFVKtj9mZhSAouWXW0gQI3ULc/FnncmOyhKJdyIBwsz9V8UiBO +VHhbhBRrwJCuhezAUUE8Wod/Bk3U/mDR+mwt4X2VEIiiCFQPmRpM5uoKrNijgfgw +gfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD +ATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSfK1/PPCFPnQS37SssxMZw +i9LXDTAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB +AQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g +BAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu +Y3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAH3KdNEVCQdqk0LKyuNImTKdRJY1C +2uw2SJajuhqkyGPY8C+zzsufZ+mgnhnq1A2KVQOSykOEnUbx1cy637rBAihx97r+ +bcwbZM6sTDIaEriR/PLk6LKs9Be0uoVxgOKDcpG9svD33J+G9Lcfv1K9luDmSTgG +6XNFIN5vfI5gs/lMPyojEMdIzK9blcl2/1vKxO8WGCcjvsQ1nJ/Pwt8LQZBfOFyV +XP8ubAp/au3dc4EKWG9MO5zcx1qT9+NXRGdVWxGvmBFRAajciMfXME1ZuGmk3/GO +koAM7ZkjZmleyokP1LGzmfJcUd9s7eeu1/9/eg5XlXd/55GtYjAM+C4DG5i7eaNq +cm2F+yxYIPt6cbbtYVNJCGfHWqHEQ4FYStUyFnv8sjyqU8ypgZaNJ9aVcWSICLOI +E1/Qv/7oKsnZCWJ926wU6RqG1OYPGOi1zuABhLw61cuPVDT28nQS/e6z95cJXq0e +K1BcaJ6fJZsmbjRgD5p3mvEf5vdQM7MCEvU0tHbsx2I5mHHJoABHb8KVBgWp/lcX +GWiWaeOyB7RP+OfDtvi2OsapxXiV7vNVs7fMlrRjY1joKaqmmycnBvAq14AEbtyL +sVfOS66B8apkeFX2NY4XPEYV4ZSCe8VHPrdrERk2wILG3T/EGmSIkCYVUMSnjmJd +VQD9F6Na/+zmXCc= +-----END CERTIFICATE----- + diff --git a/test/mip_tap_test.c b/test/mip_tap_test.c index 96568e9b..f4cffd24 100644 --- a/test/mip_tap_test.c +++ b/test/mip_tap_test.c @@ -179,14 +179,22 @@ static void fcb(struct mg_connection *c, int ev, void *ev_data) { if (mg_url_is_ssl(fd->url)) { struct mg_tls_opts opts; memset(&opts, 0, sizeof(opts)); // read CA from packed_fs - opts.name = mg_url_host(fd->url); - opts.ca = mg_unpacked("/data/ca.pem"); if (host_ip != NULL && strstr(fd->url, host_ip) != NULL) { MG_DEBUG(("Local connection, using self-signed certificates")); opts.name = mg_str_s("localhost"); opts.ca = mg_unpacked("/certs/ca.crt"); + } else { + opts.name = mg_url_host(fd->url); + opts.ca = mg_unpacked("/data/ca.pem"); +#if MG_TLS == MG_TLS_BUILTIN + // our TLS does not search for the proper CA in a bundle + opts.ca = mg_file_read(&mg_fs_posix, "data/e5.crt"); +#endif } mg_tls_init(c, &opts); +#if MG_TLS == MG_TLS_BUILTIN + mg_free((void *) opts.ca.buf); +#endif } } else if (ev == MG_EV_HTTP_MSG) { struct mg_http_message *hm = (struct mg_http_message *) ev_data; diff --git a/test/unit_test.c b/test/unit_test.c index a7b18735..54b276b5 100644 --- a/test/unit_test.c +++ b/test/unit_test.c @@ -1511,7 +1511,13 @@ static void test_http_client(void) { mg_mgr_poll(&mgr, 0); ok = 0; #if MG_TLS - c = mg_http_connect(&mgr, "https://cesanta.com", f3, &ok); + url = "https://cesanta.com"; + opts.name = mg_url_host(url); +#if MG_TLS == MG_TLS_BUILTIN + // our TLS does not search for the proper CA in a bundle + opts.ca = mg_file_read(&mg_fs_posix, "data/e5.crt"); +#endif + c = mg_http_connect(&mgr, url, f3, &ok); ASSERT(c != NULL); mg_tls_init(c, &opts); for (i = 0; i < 1500 && ok <= 0; i++) mg_mgr_poll(&mgr, 1); @@ -1519,8 +1525,8 @@ static void test_http_client(void) { ASSERT(ok == 200); mg_mgr_poll(&mgr, 1); - // Test failed host validation - c = mg_http_connect(&mgr, "https://cesanta.com", f3, &ok); + // Make host validationfail + c = mg_http_connect(&mgr, url, f3, &ok); ASSERT(c != NULL); opts.name = mg_str("dummy"); // Set some invalid hostname value mg_tls_init(c, &opts); @@ -1529,13 +1535,16 @@ static void test_http_client(void) { MG_INFO(("OK: %d", ok)); ASSERT(ok == 777); mg_mgr_poll(&mgr, 1); + opts.name = mg_url_host(url); +#if MG_TLS == MG_TLS_BUILTIN + mg_free((void *) opts.ca.buf); +#endif // Test empty CA // Disable mbedTLS: https://github.com/Mbed-TLS/mbedtls/issues/7075 #if MG_TLS != MG_TLS_MBED - opts.name = mg_str("cesanta.com"); opts.ca = mg_str(""); - c = mg_http_connect(&mgr, "https://cesanta.com", f3, &ok); + c = mg_http_connect(&mgr, url, f3, &ok); mg_tls_init(c, &opts); ok = 0; for (i = 0; i < 1000 && ok <= 0; i++) mg_mgr_poll(&mgr, 10);