[lwip-users] BEDTLS_SSL_VERIFY_REQUIRED in altcp_tls_mbedtls

[Cesare Garlati]

LWIP builds by default with TLS ca certificate verification optional
(MBEDTLS_SSL_VERIFY_OPTIONAL), which is unsuitable for production as it
bypasses TLS authentication.

Question: is there a way to change the mbedTLS setting into 
MBEDTLS_SSL_VERIFY_REQUIRED without hacking the lwip code?

Would it make sense to add a new lwip config macro
ALTCP_MBEDTLS_SSL_VERIFY with the 4 mbedTLS options below?

#define MBEDTLS_SSL_VERIFY_NONE           0
#define MBEDTLS_SSL_VERIFY_OPTIONAL     1
#define MBEDTLS_SSL_VERIFY_REQUIRED    2
#define MBEDTLS_SSL_VERIFY_UNSET          3

Alternatively, Would it make sense to ship lwip with security enabled by
default and simply replace  the current MBEDTLS_SSL_VERIFY_OPTIONAL with
MBEDTLS_SSL_VERIFY_REQUIRED in apps/altcp_tls/altcp_tls_mbedtls?

Happy to submit a patch if it makes sense.


Cesare

signature.asc
Description: OpenPGP digital signature