Skip to content

lwIP: require TLS certificate verification when CA is configured #11523

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Old-Ding wants to merge 2 commits into
base: master
Choose a base branch
from
+6 −2
Open

lwIP: require TLS certificate verification when CA is configured #11523

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
54b4d19
lwip: require TLS certificate verification when CA is configured
Old-Ding Jun 27, 2026
2d0e3c9
lwip: fix trailing whitespace in TLS config
Old-Ding Jun 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions components/net/lwip/lwip-2.1.2/src/apps/altcp_tls/altcp_tls_mbedtls.c
View file
Open in desktop

@Rbb666 Rbb666 Jul 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is the official lwip source code. Is it appropriate to modify it this way?

@Old-Ding Old-Ding Jul 3, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. This is a vendored lwIP source file, so I kept the change as small as possible and put it at the layer that owns the mbedTLS auth mode.

struct altcp_tls_config is opaque in altcp_tls.h, and mbedtls_ssl_conf_authmode() is only reachable inside this mbedTLS port implementation. Callers can pass a CA via altcp_tls_create_config_client() / _2wayauth(), but they cannot safely adjust the internal mbedtls_ssl_config afterwards.

With MBEDTLS_SSL_VERIFY_OPTIONAL, mbedTLS still lets the handshake continue after certificate verification fails unless the user later calls mbedtls_ssl_get_verify_result(). The lwIP altcp TLS API here does not expose that verification step to callers, so a configured CA would not reliably enforce the trust anchor.

This patch only switches client configs that actually provide a CA to MBEDTLS_SSL_VERIFY_REQUIRED; server configs and clients without CA keep the existing optional mode for compatibility. If RT-Thread prefers to avoid behavior patches in vendored lwIP files, I can rework this as an upstream-style backport, but that would need a separate RT-Thread config policy to preserve the same security behavior for client connections with CA.

Original file line number Diff line number Diff line change
Expand Up @@ -732,7 +732,11 @@ altcp_tls_create_config(int is_server, int have_cert, int have_pkey, int have_ca
altcp_mbedtls_free_config(conf);
return NULL;
}
mbedtls_ssl_conf_authmode(&conf->conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
if (!is_server && have_ca) {
mbedtls_ssl_conf_authmode(&conf->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
} else {
mbedtls_ssl_conf_authmode(&conf->conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
}

mbedtls_ssl_conf_rng(&conf->conf, mbedtls_ctr_drbg_random, &conf->ctr_drbg);
#if ALTCP_MBEDTLS_DEBUG != LWIP_DBG_OFF
Expand Down Expand Up @@ -886,7 +890,7 @@ altcp_tls_free_config(struct altcp_tls_config *conf)
}
if (conf->ca) {
mbedtls_x509_crt_free(conf->ca);
}
}
altcp_mbedtls_free_config(conf);
}

Expand Down
Loading