dangernoodle-io / breadboard / 30771460894

97%

push

github

feat: resolve bb_tcp_client TLS creds via bb_tls_creds (#1206)

bb_tcp_client's ESP-IDF backend previously read PEM data
straight from the instance cfg, forcing every TLS consumer to
hand-roll the programmatic-override/NVS/embedded-default
precedence bb_tls_creds already owns as the SSOT.

bb_tcp_client_init() now resolves ca_cert_pem/
client_cert_pem/client_key_pem via bb_tls_creds_resolve()
once, using cfg's PEM fields as the top-tier programmatic
override (any left NULL fall through to NVS in the same
namespace the instance was initialised with, then to embedded
weak defaults). The resolved creds are cached in the instance
for its lifetime and freed by bb_tcp_client_destroy(). A
plaintext instance does no credential work; an empty resolve
still falls through to the ESP cert bundle, matching existing
behaviour.

connect() passes inst->creds.ca_len/cert_len/key_len minus 1
to esp_transport_ssl_set_*_data(), not the raw length.
bb_tls_creds' *_len fields are NUL-inclusive (strlen(pem) + 1)
so mbedtls_x509_crt_parse's PEM path gets the NUL it requires,
but esp-idf's set_*_data() setters take PEM content length and
add their own +1 internally (tcp_transport/transport_ssl.c).
The pre-existing strlen()-based calls this replaces were
already correct for that contract; this keeps the same
effective byte count while sourcing the PEMs from
bb_tls_creds instead of raw cfg, rather than fixing a
pre-existing bug.

The precedence-wiring logic lives in a new portable helper in
bb_tcp_client_common.c (bb_tcp_client_priv_resolve_tls_creds()),
compiled for both host and ESP-IDF, so it is host-unit-testable
even though only the ESP-IDF backend consumes the result.

Part of B1-1390.


Claude-Session: https://claude.ai/code/session_0119nuE2NZME9y2aYEVJTPB5

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

8228 of 8792 branches covered (93.59%)

Branch coverage included in aggregate %.

9 of 9 new or added lines in 1 file covered. (100.0%)

13926 of 14081 relevant lines covered (98.9%)

2683.04 hits per line