Skip to content

Commit d00fb29

Browse files
donghengqazdonghengqaz
committed
Merge branch 'feature/esp_tls_wolfssl_v3.1' into 'release/v3.1'
Add wolfSSL library in esp_tls component (backport v3.1) See merge request sdk/ESP8266_RTOS_SDK!751
2 parents a0a054a + 9cf24e1 commit d00fb29

3 files changed

Lines changed: 184 additions & 12 deletions

File tree

‎components/esp-tls/component.mk‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,12 @@
1-
ifdef CONFIG_SSL_USING_MBEDTLS
2-
COMPONENT_SRCDIRS := .
3-
COMPONENT_ADD_INCLUDEDIRS := .
4-
else
51
COMPONENT_SRCDIRS :=
62
COMPONENT_ADD_INCLUDEDIRS :=
3+
4+
ifdef CONFIG_SSL_USING_MBEDTLS
5+
COMPONENT_SRCDIRS := .
6+
COMPONENT_ADD_INCLUDEDIRS := .
77
endif
8+
9+
ifdef CONFIG_SSL_USING_WOLFSSL
10+
COMPONENT_SRCDIRS := .
11+
COMPONENT_ADD_INCLUDEDIRS := .
12+
endif

‎components/esp-tls/esp_tls.c‎

Lines changed: 165 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,12 @@
2828
#endif
2929

3030
static const char *TAG = "esp-tls";
31+
#if CONFIG_SSL_USING_MBEDTLS
3132
static mbedtls_x509_crt *global_cacert = NULL;
33+
#else
34+
static unsigned char *global_cacert = NULL;
35+
static unsigned int global_cacert_pem_bytes = 0;
36+
#endif
3237

3338
#ifdef ESP_PLATFORM
3439
#include <esp_log.h>
@@ -67,6 +72,7 @@ static ssize_t tcp_read(esp_tls_t *tls, char *data, size_t datalen)
6772

6873
static ssize_t tls_read(esp_tls_t *tls, char *data, size_t datalen)
6974
{
75+
#if CONFIG_SSL_USING_MBEDTLS
7076
ssize_t ret = mbedtls_ssl_read(&tls->ssl, (unsigned char *)data, datalen);
7177
if (ret < 0) {
7278
if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
@@ -76,6 +82,20 @@ static ssize_t tls_read(esp_tls_t *tls, char *data, size_t datalen)
7682
ESP_LOGE(TAG, "read error :%d:", ret);
7783
}
7884
}
85+
#else
86+
size_t ret = wolfSSL_read(tls->ssl, (unsigned char *)data, datalen);
87+
if (ret < 0) {
88+
ret = wolfSSL_get_error(tls->ssl, ret);
89+
/* peer sent close notify */
90+
if (ret == WOLFSSL_ERROR_ZERO_RETURN) {
91+
return 0;
92+
}
93+
94+
if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) {
95+
ESP_LOGE(TAG, "read error :%d:", ret);
96+
}
97+
}
98+
#endif
7999
return ret;
80100
}
81101

@@ -146,12 +166,14 @@ static int esp_tcp_connect(const char *host, int hostlen, int port, int *sockfd,
146166
return ret;
147167
}
148168

169+
149170
esp_err_t esp_tls_set_global_ca_store(const unsigned char *cacert_pem_buf, const unsigned int cacert_pem_bytes)
150171
{
151172
if (cacert_pem_buf == NULL) {
152173
ESP_LOGE(TAG, "cacert_pem_buf is null");
153174
return ESP_ERR_INVALID_ARG;
154175
}
176+
#if CONFIG_SSL_USING_MBEDTLS
155177
if (global_cacert != NULL) {
156178
mbedtls_x509_crt_free(global_cacert);
157179
}
@@ -171,23 +193,43 @@ esp_err_t esp_tls_set_global_ca_store(const unsigned char *cacert_pem_buf, const
171193
ESP_LOGE(TAG, "mbedtls_x509_crt_parse was partly successful. No. of failed certificates: %d", ret);
172194
}
173195
return ESP_OK;
196+
#else
197+
if (global_cacert != NULL) {
198+
esp_tls_free_global_ca_store(global_cacert);
199+
}
200+
201+
global_cacert = (unsigned char *)strndup((const char *)cacert_pem_buf, cacert_pem_bytes);
202+
if (!global_cacert)
203+
return ESP_FAIL;
204+
205+
global_cacert_pem_bytes = cacert_pem_bytes;
206+
207+
return ESP_OK;
208+
#endif
174209
}
175210

176-
mbedtls_x509_crt *esp_tls_get_global_ca_store()
211+
void *esp_tls_get_global_ca_store()
177212
{
178-
return global_cacert;
213+
return (void*)global_cacert;
179214
}
180215

181216
void esp_tls_free_global_ca_store()
182217
{
183218
if (global_cacert) {
219+
#if CONFIG_SSL_USING_MBEDTLS
184220
mbedtls_x509_crt_free(global_cacert);
185221
global_cacert = NULL;
222+
#else
223+
free(global_cacert);
224+
global_cacert = NULL;
225+
global_cacert_pem_bytes = 0;
226+
#endif
186227
}
187228
}
188229

189230
static void verify_certificate(esp_tls_t *tls)
190231
{
232+
#if CONFIG_SSL_USING_MBEDTLS
191233
int flags;
192234
char buf[100];
193235
if ((flags = mbedtls_ssl_get_verify_result(&tls->ssl)) != 0) {
@@ -198,13 +240,22 @@ static void verify_certificate(esp_tls_t *tls)
198240
} else {
199241
ESP_LOGI(TAG, "Certificate verified.");
200242
}
243+
#else
244+
int flags;
245+
if ((flags = wolfSSL_get_verify_result(tls->ssl)) != WOLFSSL_SUCCESS) {
246+
ESP_LOGE(TAG, "Failed to verify peer certificate %d!", flags);
247+
} else {
248+
ESP_LOGI(TAG, "Certificate verified.");
249+
}
250+
#endif
201251
}
202252

203-
static void mbedtls_cleanup(esp_tls_t *tls)
253+
static void esp_tls_cleanup(esp_tls_t *tls)
204254
{
205255
if (!tls) {
206256
return;
207257
}
258+
#if CONFIG_SSL_USING_MBEDTLS
208259
if (tls->cacert_ptr != global_cacert) {
209260
mbedtls_x509_crt_free(tls->cacert_ptr);
210261
}
@@ -217,12 +268,19 @@ static void mbedtls_cleanup(esp_tls_t *tls)
217268
mbedtls_ctr_drbg_free(&tls->ctr_drbg);
218269
mbedtls_ssl_free(&tls->ssl);
219270
mbedtls_net_free(&tls->server_fd);
271+
#else
272+
wolfSSL_shutdown(tls->ssl);
273+
wolfSSL_free(tls->ssl);
274+
close(tls->sockfd);
275+
wolfSSL_CTX_free(tls->ctx);
276+
wolfSSL_Cleanup();
277+
#endif
220278
}
221279

222280
static int create_ssl_handle(esp_tls_t *tls, const char *hostname, size_t hostlen, const esp_tls_cfg_t *cfg)
223281
{
224282
int ret;
225-
283+
#if CONFIG_SSL_USING_MBEDTLS
226284
mbedtls_net_init(&tls->server_fd);
227285
tls->server_fd.fd = tls->sockfd;
228286
mbedtls_ssl_init(&tls->ssl);
@@ -326,8 +384,74 @@ static int create_ssl_handle(esp_tls_t *tls, const char *hostname, size_t hostle
326384

327385
return 0;
328386
exit:
329-
mbedtls_cleanup(tls);
387+
esp_tls_cleanup(tls);
388+
return -1;
389+
#else
390+
ret = wolfSSL_Init();
391+
if (ret != WOLFSSL_SUCCESS) {
392+
ESP_LOGE(TAG, "Init wolfSSL failed: %d", ret);
393+
goto exit;
394+
}
395+
396+
tls->ctx = wolfSSL_CTX_new(wolfTLSv1_2_client_method());
397+
if (!tls->ctx) {
398+
ESP_LOGE(TAG, "Set wolfSSL ctx failed");
399+
goto exit;
400+
}
401+
402+
#ifdef HAVE_ALPN
403+
if (cfg->alpn_protos) {
404+
char **alpn_list = (char **)cfg->alpn_protos;
405+
for (; *alpn_list != NULL; alpn_list ++) {
406+
if (wolfSSL_UseALPN(tls->ssl, *alpn_list, strlen(*alpn_list), WOLFSSL_ALPN_FAILED_ON_MISMATCH) != WOLFSSL_SUCCESS) {
407+
ESP_LOGE(TAG, "Use wolfSSL ALPN failed");
408+
goto exit;
409+
}
410+
}
411+
}
412+
#endif
413+
414+
if (cfg->use_global_ca_store == true) {
415+
wolfSSL_CTX_load_verify_buffer(tls->ctx, global_cacert, global_cacert_pem_bytes, WOLFSSL_FILETYPE_PEM);
416+
wolfSSL_CTX_set_verify(tls->ctx, SSL_VERIFY_PEER, NULL);
417+
} else if (cfg->cacert_pem_buf != NULL) {
418+
wolfSSL_CTX_load_verify_buffer(tls->ctx, cfg->cacert_pem_buf, cfg->cacert_pem_bytes, WOLFSSL_FILETYPE_PEM);
419+
wolfSSL_CTX_set_verify(tls->ctx, SSL_VERIFY_PEER, NULL);
420+
} else {
421+
wolfSSL_CTX_set_verify(tls->ctx, SSL_VERIFY_NONE, NULL);
422+
}
423+
424+
if (cfg->clientcert_pem_buf != NULL && cfg->clientkey_pem_buf != NULL) {
425+
wolfSSL_CTX_use_certificate_buffer(tls->ctx, cfg->clientcert_pem_buf, cfg->clientcert_pem_bytes, WOLFSSL_FILETYPE_PEM);
426+
wolfSSL_CTX_use_PrivateKey_buffer(tls->ctx, cfg->clientkey_pem_buf, cfg->clientkey_pem_bytes, WOLFSSL_FILETYPE_PEM);
427+
} else if (cfg->clientcert_pem_buf != NULL || cfg->clientkey_pem_buf != NULL) {
428+
ESP_LOGE(TAG, "You have to provide both clientcert_pem_buf and clientkey_pem_buf for mutual authentication\n\n");
429+
goto exit;
430+
}
431+
432+
tls->ssl = wolfSSL_new(tls->ctx);
433+
if (!tls->ssl) {
434+
ESP_LOGE(TAG, "Create wolfSSL failed");
435+
goto exit;
436+
}
437+
438+
#ifdef HAVE_SNI
439+
/* Hostname set here should match CN in server certificate */
440+
char *use_host = strndup(hostname, hostlen);
441+
if (!use_host) {
442+
goto exit;
443+
}
444+
wolfSSL_set_tlsext_host_name(tls->ssl, use_host);
445+
free(use_host);
446+
#endif
447+
448+
wolfSSL_set_fd(tls->ssl, tls->sockfd);
449+
450+
return 0;
451+
exit:
452+
esp_tls_cleanup(tls);
330453
return -1;
454+
#endif
331455
}
332456

333457
/**
@@ -336,7 +460,7 @@ static int create_ssl_handle(esp_tls_t *tls, const char *hostname, size_t hostle
336460
void esp_tls_conn_delete(esp_tls_t *tls)
337461
{
338462
if (tls != NULL) {
339-
mbedtls_cleanup(tls);
463+
esp_tls_cleanup(tls);
340464
if (tls->sockfd) {
341465
close(tls->sockfd);
342466
}
@@ -351,13 +475,23 @@ static ssize_t tcp_write(esp_tls_t *tls, const char *data, size_t datalen)
351475

352476
static ssize_t tls_write(esp_tls_t *tls, const char *data, size_t datalen)
353477
{
478+
#if CONFIG_SSL_USING_MBEDTLS
354479
ssize_t ret = mbedtls_ssl_write(&tls->ssl, (unsigned char*) data, datalen);
355480
if (ret < 0) {
356481
if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
357482
ESP_LOGE(TAG, "write error :%d:", ret);
358483
}
359484
}
360485
return ret;
486+
#else
487+
ssize_t ret = wolfSSL_write(tls->ssl, (unsigned char*) data, datalen);
488+
if (ret < 0) {
489+
if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) {
490+
ESP_LOGE(TAG, "write error :%d:", ret);
491+
}
492+
}
493+
return ret;
494+
#endif
361495
}
362496

363497
static int esp_tls_low_level_conn(const char *hostname, int hostlen, int port, const esp_tls_cfg_t *cfg, esp_tls_t *tls)
@@ -427,6 +561,7 @@ static int esp_tls_low_level_conn(const char *hostname, int hostlen, int port, c
427561
/* falls through */
428562
case ESP_TLS_HANDSHAKE:
429563
ESP_LOGD(TAG, "handshake in progress...");
564+
#if CONFIG_SSL_USING_MBEDTLS
430565
ret = mbedtls_ssl_handshake(&tls->ssl);
431566
if (ret == 0) {
432567
tls->conn_state = ESP_TLS_DONE;
@@ -445,6 +580,26 @@ static int esp_tls_low_level_conn(const char *hostname, int hostlen, int port, c
445580
or MBEDTLS_ERR_SSL_WANT_WRITE during handshake */
446581
return 0;
447582
}
583+
#else
584+
ret = wolfSSL_connect(tls->ssl);
585+
if (ret == WOLFSSL_SUCCESS) {
586+
tls->conn_state = ESP_TLS_DONE;
587+
return 1;
588+
} else {
589+
if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) {
590+
ESP_LOGE(TAG, "wolfSSL_connect returned -0x%x", -ret);
591+
if (cfg->cacert_pem_buf != NULL || cfg->use_global_ca_store == true) {
592+
/* This is to check whether handshake failed due to invalid certificate*/
593+
verify_certificate(tls);
594+
}
595+
tls->conn_state = ESP_TLS_FAIL;
596+
return -1;
597+
}
598+
/* Irrespective of blocking or non-blocking I/O, we return on getting wolfSSL_want_read
599+
or wolfSSL_want_write during handshake */
600+
return 0;
601+
}
602+
#endif
448603
break;
449604
case ESP_TLS_FAIL:
450605
ESP_LOGE(TAG, "failed to open a new connection");;
@@ -490,9 +645,13 @@ int esp_tls_conn_new_async(const char *hostname, int hostlen, int port, const es
490645

491646
size_t esp_tls_get_bytes_avail(esp_tls_t *tls)
492647
{
648+
#if CONFIG_SSL_USING_MBEDTLS
493649
if (!tls) {
494650
ESP_LOGE(TAG, "empty arg passed to esp_tls_get_bytes_avail()");
495651
return ESP_FAIL;
496652
}
497653
return mbedtls_ssl_get_bytes_avail(&tls->ssl);
654+
#else
655+
return 0;
656+
#endif
498657
}

‎components/esp-tls/esp_tls.h‎

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
#include <sys/socket.h>
1919
#include <fcntl.h>
2020

21+
#if CONFIG_SSL_USING_MBEDTLS
2122
#include "mbedtls/platform.h"
2223
#include "mbedtls/net_sockets.h"
2324
#include "mbedtls/esp_debug.h"
@@ -26,6 +27,9 @@
2627
#include "mbedtls/ctr_drbg.h"
2728
#include "mbedtls/error.h"
2829
#include "mbedtls/certs.h"
30+
#else
31+
#include "wolfssl/ssl.h"
32+
#endif
2933

3034
#ifdef __cplusplus
3135
extern "C" {
@@ -90,6 +94,7 @@ typedef struct esp_tls_cfg {
9094
* @brief ESP-TLS Connection Handle
9195
*/
9296
typedef struct esp_tls {
97+
#if CONFIG_SSL_USING_MBEDTLS
9398
mbedtls_ssl_context ssl; /*!< TLS/SSL context */
9499

95100
mbedtls_entropy_context entropy; /*!< mbedTLS entropy context structure */
@@ -112,7 +117,10 @@ typedef struct esp_tls {
112117

113118
mbedtls_pk_context clientkey; /*!< Container for the private key of the client
114119
certificate */
115-
120+
#else
121+
WOLFSSL_CTX *ctx;
122+
WOLFSSL *ssl;
123+
#endif
116124
int sockfd; /*!< Underlying socket file descriptor. */
117125

118126
ssize_t (*esp_tls_read)(struct esp_tls *tls, char *data, size_t datalen); /*!< Callback function for reading data from TLS/SSL
@@ -258,7 +266,7 @@ esp_err_t esp_tls_set_global_ca_store(const unsigned char *cacert_pem_buf, const
258266
* - Pointer to the global CA store currently being used if successful.
259267
* - NULL if there is no global CA store set.
260268
*/
261-
mbedtls_x509_crt *esp_tls_get_global_ca_store();
269+
void *esp_tls_get_global_ca_store();
262270

263271
/**
264272
* @brief Free the global CA store currently being used.

0 commit comments

Comments
 (0)