chenjintao/lucky-cat
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(tls): disable unsafe renegotiation path

Browse Source
This commit is contained in:
chenjintao
2026-08-13 09:36:44 +08:00
parent 1c32d9f0e7
commit f610ee3c55
1 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sdkconfig.defaults
+7 -2
View File
@@ -212,8 +212,9 @@ CONFIG_MULTIMODAL_WS_JSON_TASK_STACK_BYTES=8192
CONFIG_MULTIMODAL_WS_OPUS_TASK_STACK_BYTES=12288
CONFIG_MULTIMODAL_WS_MSG_QUEUE_LEN=512
CONFIG_MULTIMODAL_RECONNECT_DELAY_MS=2000
# Keep both symbols for compatibility; defaults follow doc behavior.
# Disable separate TX lock for stability; single lock avoids close/send race under high-frequency uplink.
# Keep the separate TX lock so realtime uplink writes do not contend with the
# WebSocket receive loop. TLS renegotiation is disabled below so a concurrent
# write cannot inspect a dynamically released RX record counter.
CONFIG_ESP_WS_CLIENT_SEPARATE_TX_LOCK=y
CONFIG_ESP_WS_CLIENT_TX_LOCK_TIMEOUT_MS=2000
# mbedTLS certificate parsing and dynamic record buffers otherwise compete for
@@ -222,6 +223,10 @@ CONFIG_ESP_WS_CLIENT_TX_LOCK_TIMEOUT_MS=2000
# CONFIG_MBEDTLS_INTERNAL_MEM_ALLOC is not set
CONFIG_MBEDTLS_DEFAULT_MEM_ALLOC=y
CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
# TLS renegotiation is not used by the device's HTTPS/WSS clients. With dynamic
# TLS buffers and concurrent WebSocket RX/TX, its write-side counter check can
# observe a released RX buffer and dereference a null in_ctr pointer.
# CONFIG_MBEDTLS_SSL_RENEGOTIATION is not set
# Keep inbound TLS large enough for certificate handshake records while still
# capping outbound request records. The token endpoint currently sends a
# certificate handshake message larger than 4 KB, which mbedTLS reports as