From e6883c3d6724be8d910f22b621184ea67b32ac6d Mon Sep 17 00:00:00 2001 From: Jon Shallow Date: Wed, 18 Jun 2025 14:17:13 +0100 Subject: [PATCH] coap_mbedtls.c: Fix SNI hostname definition if not provided MbedTLS based PKI clients may report SSL - Attempt to verify a certificate without an expected hostname. This is usually insecure. In TLS clients, when a client authenticates a server through its certificate, the client normally checks three things: .... The application provided client_sni may have been removed as per https://datatracker.ietf.org/doc/html/rfc6066#section-3 Literal IPv4 and IPv6 addresses are not permitted in "HostName". and so MbedTLS is now explicitly told that therw is no hostname. --- src/coap_mbedtls.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/src/coap_mbedtls.c b/src/coap_mbedtls.c index 0facccbf..e8ef52aa 100644 --- a/src/coap_mbedtls.c +++ b/src/coap_mbedtls.c @@ -1435,9 +1435,7 @@ setup_client_ssl_session(coap_session_t *c_session, } } #endif /* MBEDTLS_SSL_SRV_C && MBEDTLS_SSL_ALPN */ - if (m_context->setup_data.client_sni) { - mbedtls_ssl_set_hostname(&m_env->ssl, m_context->setup_data.client_sni); - } + mbedtls_ssl_set_hostname(&m_env->ssl, m_context->setup_data.client_sni); #if defined(MBEDTLS_SSL_PROTO_DTLS) #if MBEDTLS_VERSION_NUMBER >= 0x02100100 mbedtls_ssl_set_mtu(&m_env->ssl, (uint16_t)c_session->mtu);