From 88603b58c3aab64dd3c42dc3eaabd21e77166783 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Iwo=20Strzebo=C5=84ski?= Date: Fri, 28 Aug 2026 21:13:28 +0000 Subject: [PATCH] Fix Bambu TLS: relax hostname/IP verification, keep chain trust enforced MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Real hardware surfaced this: H2C failed with 'IP address mismatch', not a chain-of-trust error like P1P's 'self-signed certificate'. Bambu printer certs don't carry their DHCP-assigned LAN IP as a SAN, so native-tls's default hostname check will never pass against a real printer. Added danger_accept_invalid_hostnames(true) unconditionally in build_connector() — this only skips the SAN/IP match, it's independent from danger_accept_invalid_certs (chain trust), which stays fully enforced for BundledCa/Custom. Verified both directions against local test servers, not just compiled: - a cert signed by a trusted CA, with a SAN that does NOT match the connecting IP, now verifies OK (previously failed exactly like H2C did) - a cert signed by an UNTRUSTED CA still correctly fails verification, confirming this change didn't weaken chain-of-trust checking --- src/printer/bambu.rs | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/printer/bambu.rs b/src/printer/bambu.rs index 69c8eeb..3d405a8 100644 --- a/src/printer/bambu.rs +++ b/src/printer/bambu.rs @@ -56,6 +56,16 @@ impl BambuTls { fn build_connector(&self) -> anyhow::Result { let mut builder = native_tls::TlsConnector::builder(); + // Bambu printer certificates don't carry their LAN IP as a Subject + // Alternative Name — it's DHCP-assigned, so baking it in at + // manufacture time wouldn't make sense. Hostname verification has + // to be off regardless of trust mode: what matters is whether the + // certificate chains to a CA we trust, not whether its SAN matches + // the specific IP we happened to dial today. Chain verification + // itself stays fully enforced below for BundledCa/Custom — this + // narrows *what* gets checked, it doesn't turn checking off. + builder.danger_accept_invalid_hostnames(true); + if matches!(self, BambuTls::Insecure) { builder.danger_accept_invalid_certs(true); } else {