Repository navigation
extmod/modussl_mbedtls: change getpeercert for a callback #5835
Description
Activity
I came up with another idea:
- compile with MBEDTLS_SSL_KEEP_PEER_CERTIFICATE disabled
- use a callback to store the cert in ussl
- change getpeercert to return the cert and remove the reference in ussl to the cert, i.e., it will return the cert only once
- add getpeercert to docs and explain the read once semantics
The net effect is that current code continues to work unless it calls getpeercert repeatedly, which is unlikely. Code that wishes to save some memory can call getpeercert and drop/delete the return value.
Just for reference:
MBEDTLS_SSL_KEEP_PEER_CERTIFICATEwas always enabled by default, just the mbedtls version was too old to recognize it. On current main, mbedtls has been upgraded, soMBEDTLS_SSL_KEEP_PEER_CERTIFICATEhas been set automatically, andgetpeercertis broken and just returns none on current master. So this issue has been "solved" by accident.MBEDTLS_SSL_KEEP_PEER_CERTIFICATEwas always enabled by default, just the mbedtls version was too old to recognize it. On current main, mbedtls has been upgraded, soMBEDTLS_SSL_KEEP_PEER_CERTIFICATEhas been set automatically, andgetpeercertis broken and just returns none on current master.Ah, thanks for the explanation! I didn't realise this config option changed in this way.
Actually, in ef996d1 I made it so the
.getpeercert()method is only included ifMBEDTLS_SSL_KEEP_PEER_CERTIFICATEis enabled. So that method is now removed in most builds (I think only esp32 enables this option).
The mbedtls module provides an undocumented
getpeercertmethod. I'd like to remove it and replace it with a callback passed into wrap_socket. Since it's undocumented, there should be no harm, right? :-) :-)Why would I want to do this? Well, https://tls.mbed.org/kb/how-to/reduce-mbedtls-memory-and-storage-footprint says:
I just took a random sample: the peer cert for micropython.org is 1363 bytes long. I only created the socket, connected, and wrapped it and at some point there were only 4.7KB free in the esp-idf heaps... So those 1363 bytes do count IMHO.
Why do I want to add a callback? That doc further says:
I'm happy to submit a PR for this, thoughts on how to navigate the deprecation of the
getpeercertmethod?