tls.c 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613
  1. // Module for TLS
  2. #include "module.h"
  3. #if defined(CLIENT_SSL_ENABLE) && defined(LUA_USE_MODULES_NET)
  4. #include "lauxlib.h"
  5. #include "platform.h"
  6. #include "lmem.h"
  7. #include <string.h>
  8. #include <stddef.h>
  9. #include <stdint.h>
  10. #include <ctype.h>
  11. #include "mem.h"
  12. #include "lwip/ip_addr.h"
  13. #include "espconn.h"
  14. #include "sys/espconn_mbedtls.h"
  15. #include "lwip/err.h"
  16. #include "lwip/dns.h"
  17. #include "mbedtls/debug.h"
  18. #include "user_mbedtls.h"
  19. #ifdef HAVE_SSL_SERVER_CRT
  20. #include HAVE_SSL_SERVER_CRT
  21. #else
  22. __attribute__((section(".servercert.flash"))) unsigned char tls_server_cert_area[INTERNAL_FLASH_SECTOR_SIZE];
  23. #endif
  24. __attribute__((section(".clientcert.flash"))) unsigned char tls_client_cert_area[INTERNAL_FLASH_SECTOR_SIZE];
  25. typedef struct {
  26. struct espconn pesp_conn;
  27. int self_ref;
  28. int cb_connect_ref;
  29. int cb_reconnect_ref;
  30. int cb_disconnect_ref;
  31. int cb_sent_ref;
  32. int cb_receive_ref;
  33. int cb_dns_ref;
  34. } tls_socket_ud;
  35. static int tls_socket_create( lua_State *L ) {
  36. tls_socket_ud *ud = (tls_socket_ud*) lua_newuserdata(L, sizeof(tls_socket_ud));
  37. bzero(&ud->pesp_conn, sizeof(ud->pesp_conn));
  38. ud->self_ref =
  39. ud->cb_connect_ref =
  40. ud->cb_reconnect_ref =
  41. ud->cb_disconnect_ref =
  42. ud->cb_sent_ref =
  43. ud->cb_receive_ref =
  44. ud->cb_dns_ref = LUA_NOREF;
  45. luaL_getmetatable(L, "tls.socket");
  46. lua_setmetatable(L, -2);
  47. return 1;
  48. }
  49. static void tls_socket_onconnect( struct espconn *pesp_conn ) {
  50. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn;
  51. if (!ud || ud->self_ref == LUA_NOREF) return;
  52. if (ud->cb_connect_ref != LUA_NOREF) {
  53. lua_State *L = lua_getstate();
  54. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_connect_ref);
  55. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  56. lua_call(L, 1, 0);
  57. }
  58. }
  59. static void tls_socket_cleanup(tls_socket_ud *ud) {
  60. if (ud->pesp_conn.proto.tcp) {
  61. espconn_secure_disconnect(&ud->pesp_conn);
  62. free(ud->pesp_conn.proto.tcp);
  63. ud->pesp_conn.proto.tcp = NULL;
  64. }
  65. lua_State *L = lua_getstate();
  66. lua_gc(L, LUA_GCSTOP, 0);
  67. luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
  68. ud->self_ref = LUA_NOREF;
  69. lua_gc(L, LUA_GCRESTART, 0);
  70. }
  71. static void tls_socket_ondisconnect( struct espconn *pesp_conn ) {
  72. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn;
  73. if (!ud || ud->self_ref == LUA_NOREF) return;
  74. tls_socket_cleanup(ud);
  75. if (ud->cb_disconnect_ref != LUA_NOREF) {
  76. lua_State *L = lua_getstate();
  77. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_disconnect_ref);
  78. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  79. tls_socket_cleanup(ud);
  80. lua_call(L, 1, 0);
  81. } else tls_socket_cleanup(ud);
  82. }
  83. static void tls_socket_onreconnect( struct espconn *pesp_conn, s8 err ) {
  84. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn;
  85. if (!ud || ud->self_ref == LUA_NOREF) return;
  86. if (ud->cb_reconnect_ref != LUA_NOREF) {
  87. const char* reason = NULL;
  88. switch (err) {
  89. case(ESPCONN_MEM): reason = "Out of memory"; break;
  90. case(ESPCONN_TIMEOUT): reason = "Timeout"; break;
  91. case(ESPCONN_RTE): reason = "Routing problem"; break;
  92. case(ESPCONN_ABRT): reason = "Connection aborted"; break;
  93. case(ESPCONN_RST): reason = "Connection reset"; break;
  94. case(ESPCONN_CLSD): reason = "Connection closed"; break;
  95. case(ESPCONN_HANDSHAKE): reason = "SSL handshake failed"; break;
  96. case(ESPCONN_SSL_INVALID_DATA): reason = "SSL application invalid"; break;
  97. }
  98. lua_State *L = lua_getstate();
  99. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_reconnect_ref);
  100. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  101. if (reason != NULL) {
  102. lua_pushstring(L, reason);
  103. } else {
  104. lua_pushnil(L);
  105. }
  106. tls_socket_cleanup(ud);
  107. lua_call(L, 2, 0);
  108. } else tls_socket_cleanup(ud);
  109. }
  110. static void tls_socket_onrecv( struct espconn *pesp_conn, char *buf, u16 length ) {
  111. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn;
  112. if (!ud || ud->self_ref == LUA_NOREF) return;
  113. if (ud->cb_receive_ref != LUA_NOREF) {
  114. lua_State *L = lua_getstate();
  115. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_receive_ref);
  116. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  117. lua_pushlstring(L, buf, length);
  118. lua_call(L, 2, 0);
  119. }
  120. }
  121. static void tls_socket_onsent( struct espconn *pesp_conn ) {
  122. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn;
  123. if (!ud || ud->self_ref == LUA_NOREF) return;
  124. if (ud->cb_sent_ref != LUA_NOREF) {
  125. lua_State *L = lua_getstate();
  126. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_sent_ref);
  127. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  128. lua_call(L, 1, 0);
  129. }
  130. }
  131. static void tls_socket_dns_cb( const char* domain, const ip_addr_t *ip_addr, tls_socket_ud *ud ) {
  132. if (ud->self_ref == LUA_NOREF) return;
  133. ip_addr_t addr;
  134. if (ip_addr) addr = *ip_addr;
  135. else addr.addr = 0xFFFFFFFF;
  136. lua_State *L = lua_getstate();
  137. if (ud->cb_dns_ref != LUA_NOREF) {
  138. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_dns_ref);
  139. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  140. if (addr.addr == 0xFFFFFFFF) {
  141. lua_pushnil(L);
  142. } else {
  143. char tmp[20];
  144. sprintf(tmp, IPSTR, IP2STR(&addr.addr));
  145. lua_pushstring(L, tmp);
  146. }
  147. lua_call(L, 2, 0);
  148. }
  149. if (addr.addr == 0xFFFFFFFF) {
  150. lua_gc(L, LUA_GCSTOP, 0);
  151. luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
  152. ud->self_ref = LUA_NOREF;
  153. lua_gc(L, LUA_GCRESTART, 0);
  154. } else {
  155. os_memcpy(ud->pesp_conn.proto.tcp->remote_ip, &addr.addr, 4);
  156. espconn_secure_connect(&ud->pesp_conn);
  157. }
  158. }
  159. static int tls_socket_connect( lua_State *L ) {
  160. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  161. if (ud->pesp_conn.proto.tcp) {
  162. return luaL_error(L, "already connected");
  163. }
  164. u16 port = luaL_checkinteger( L, 2 );
  165. size_t il;
  166. const char *domain = "127.0.0.1";
  167. if( lua_isstring(L, 3) )
  168. domain = luaL_checklstring( L, 3, &il );
  169. if (port == 0)
  170. return luaL_error(L, "invalid port");
  171. if (domain == NULL)
  172. return luaL_error(L, "invalid domain");
  173. ud->pesp_conn.proto.udp = NULL;
  174. ud->pesp_conn.proto.tcp = (esp_tcp *)calloc(1,sizeof(esp_tcp));
  175. if(!ud->pesp_conn.proto.tcp){
  176. return luaL_error(L, "not enough memory");
  177. }
  178. ud->pesp_conn.type = ESPCONN_TCP;
  179. ud->pesp_conn.state = ESPCONN_NONE;
  180. ud->pesp_conn.proto.tcp->remote_port = port;
  181. espconn_regist_connectcb(&ud->pesp_conn, (espconn_connect_callback)tls_socket_onconnect);
  182. espconn_regist_disconcb(&ud->pesp_conn, (espconn_connect_callback)tls_socket_ondisconnect);
  183. espconn_regist_reconcb(&ud->pesp_conn, (espconn_reconnect_callback)tls_socket_onreconnect);
  184. espconn_regist_recvcb(&ud->pesp_conn, (espconn_recv_callback)tls_socket_onrecv);
  185. espconn_regist_sentcb(&ud->pesp_conn, (espconn_sent_callback)tls_socket_onsent);
  186. if (ud->self_ref == LUA_NOREF) {
  187. lua_pushvalue(L, 1); // copy to the top of stack
  188. ud->self_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  189. }
  190. ip_addr_t addr;
  191. err_t err = dns_gethostbyname(domain, &addr, (dns_found_callback)tls_socket_dns_cb, ud);
  192. if (err == ERR_OK) {
  193. tls_socket_dns_cb(domain, &addr, ud);
  194. } else if (err != ERR_INPROGRESS) {
  195. tls_socket_dns_cb(domain, NULL, ud);
  196. }
  197. return 0;
  198. }
  199. static int tls_socket_on( lua_State *L ) {
  200. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  201. size_t sl;
  202. const char *method = luaL_checklstring( L, 2, &sl );
  203. int *cbp;
  204. if (strcmp(method, "connection" ) == 0) { cbp = &ud->cb_connect_ref ; }
  205. else if (strcmp(method, "disconnection") == 0) { cbp = &ud->cb_disconnect_ref; }
  206. else if (strcmp(method, "reconnection" ) == 0) { cbp = &ud->cb_reconnect_ref ; }
  207. else if (strcmp(method, "receive" ) == 0) { cbp = &ud->cb_receive_ref ; }
  208. else if (strcmp(method, "sent" ) == 0) { cbp = &ud->cb_sent_ref ; }
  209. else if (strcmp(method, "dns" ) == 0) { cbp = &ud->cb_dns_ref ; }
  210. else {
  211. return luaL_error(L, "invalid method");
  212. }
  213. if (lua_isfunction(L, 3)) {
  214. lua_pushvalue(L, 3); // copy argument (func) to the top of stack
  215. luaL_unref(L, LUA_REGISTRYINDEX, *cbp);
  216. *cbp = luaL_ref(L, LUA_REGISTRYINDEX);
  217. } else if (lua_isnil(L, 3)) {
  218. luaL_unref(L, LUA_REGISTRYINDEX, *cbp);
  219. *cbp = LUA_NOREF;
  220. } else {
  221. return luaL_error(L, "invalid callback function");
  222. }
  223. return 0;
  224. }
  225. static int tls_socket_send( lua_State *L ) {
  226. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  227. size_t sl;
  228. const char* buf = luaL_checklstring(L, 2, &sl);
  229. if(ud->pesp_conn.proto.tcp == NULL) {
  230. NODE_DBG("not connected");
  231. return 0;
  232. }
  233. espconn_secure_send(&ud->pesp_conn, (void*)buf, sl);
  234. return 0;
  235. }
  236. static int tls_socket_hold( lua_State *L ) {
  237. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  238. luaL_argcheck(L, ud, 1, "TLS socket expected");
  239. if(ud->pesp_conn.proto.tcp == NULL) {
  240. NODE_DBG("not connected");
  241. return 0;
  242. }
  243. espconn_recv_hold(&ud->pesp_conn);
  244. return 0;
  245. }
  246. static int tls_socket_unhold( lua_State *L ) {
  247. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  248. if(ud->pesp_conn.proto.tcp == NULL) {
  249. NODE_DBG("not connected");
  250. return 0;
  251. }
  252. espconn_recv_unhold(&ud->pesp_conn);
  253. return 0;
  254. }
  255. static int tls_socket_getpeer( lua_State *L ) {
  256. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  257. if(ud->pesp_conn.proto.tcp && ud->pesp_conn.proto.tcp->remote_port != 0){
  258. char temp[20] = {0};
  259. sprintf(temp, IPSTR, IP2STR( &(ud->pesp_conn.proto.tcp->remote_ip) ) );
  260. lua_pushstring( L, temp );
  261. lua_pushinteger( L, ud->pesp_conn.proto.tcp->remote_port );
  262. } else {
  263. lua_pushnil( L );
  264. lua_pushnil( L );
  265. }
  266. return 2;
  267. }
  268. static int tls_socket_close( lua_State *L ) {
  269. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  270. if (ud->pesp_conn.proto.tcp) {
  271. espconn_secure_disconnect(&ud->pesp_conn);
  272. }
  273. return 0;
  274. }
  275. static int tls_socket_delete( lua_State *L ) {
  276. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  277. if (ud->pesp_conn.proto.tcp) {
  278. espconn_secure_disconnect(&ud->pesp_conn);
  279. free(ud->pesp_conn.proto.tcp);
  280. ud->pesp_conn.proto.tcp = NULL;
  281. }
  282. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_connect_ref);
  283. ud->cb_connect_ref = LUA_NOREF;
  284. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_disconnect_ref);
  285. ud->cb_disconnect_ref = LUA_NOREF;
  286. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_reconnect_ref);
  287. ud->cb_reconnect_ref = LUA_NOREF;
  288. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_dns_ref);
  289. ud->cb_dns_ref = LUA_NOREF;
  290. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_receive_ref);
  291. ud->cb_receive_ref = LUA_NOREF;
  292. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_sent_ref);
  293. ud->cb_sent_ref = LUA_NOREF;
  294. lua_gc(L, LUA_GCSTOP, 0);
  295. luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
  296. ud->self_ref = LUA_NOREF;
  297. lua_gc(L, LUA_GCRESTART, 0);
  298. return 0;
  299. }
  300. // Returns NULL on success, error message otherwise
  301. static const char *append_pem_blob(const char *pem, const char *type, uint8_t **buffer_p, uint8_t *buffer_limit, const char *name) {
  302. char unb64[256];
  303. memset(unb64, 0xff, sizeof(unb64));
  304. int i;
  305. for (i = 0; i < 64; i++) {
  306. unb64["ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[i]] = i;
  307. }
  308. if (!pem) {
  309. return "No PEM blob";
  310. }
  311. // Scan for -----BEGIN CERT
  312. pem = strstr(pem, "-----BEGIN ");
  313. if (!pem) {
  314. return "No PEM header";
  315. }
  316. if (strncmp(pem + 11, type, strlen(type))) {
  317. return "Wrong PEM type";
  318. }
  319. pem = strchr(pem, '\n');
  320. if (!pem) {
  321. return "Incorrect PEM format";
  322. }
  323. //
  324. // Base64 encoded data starts here
  325. // Get all the base64 data into a single buffer....
  326. // We will use the back end of the buffer....
  327. //
  328. uint8_t *buffer = *buffer_p;
  329. uint8_t *dest = buffer + 32 + 2; // Leave space for name and length
  330. int bitcount = 0;
  331. int accumulator = 0;
  332. for (; *pem && dest < buffer_limit; pem++) {
  333. int val = unb64[*(uint8_t*) pem];
  334. if (val & 0xC0) {
  335. // not a base64 character
  336. if (isspace(*(uint8_t*) pem)) {
  337. continue;
  338. }
  339. if (*pem == '=') {
  340. // just ignore -- at the end
  341. bitcount = 0;
  342. continue;
  343. }
  344. if (*pem == '-') {
  345. break;
  346. }
  347. return "Invalid character in PEM";
  348. } else {
  349. bitcount += 6;
  350. accumulator = (accumulator << 6) + val;
  351. if (bitcount >= 8) {
  352. bitcount -= 8;
  353. *dest++ = accumulator >> bitcount;
  354. }
  355. }
  356. }
  357. if (dest >= buffer_limit || strncmp(pem, "-----END ", 9) || strncmp(pem + 9, type, strlen(type)) || bitcount) {
  358. return "Invalid PEM format data";
  359. }
  360. size_t len = dest - (buffer + 32 + 2);
  361. memset(buffer, 0, 32);
  362. strcpy(buffer, name);
  363. buffer[32] = len & 0xff;
  364. buffer[33] = (len >> 8) & 0xff;
  365. *buffer_p = dest;
  366. return NULL;
  367. }
  368. static const char *fill_page_with_pem(lua_State *L, const unsigned char *flash_memory, int flash_offset, const char **types, const char **names)
  369. {
  370. uint8_t *buffer = luaM_malloc(L, INTERNAL_FLASH_SECTOR_SIZE);
  371. uint8_t *buffer_base = buffer;
  372. uint8_t *buffer_limit = buffer + INTERNAL_FLASH_SECTOR_SIZE;
  373. int argno;
  374. for (argno = 1; argno <= lua_gettop(L) && types[argno - 1]; argno++) {
  375. const char *pem = lua_tostring(L, argno);
  376. const char *error = append_pem_blob(pem, types[argno - 1], &buffer, buffer_limit, names[argno - 1]);
  377. if (error) {
  378. luaM_free(L, buffer_base);
  379. return error;
  380. }
  381. }
  382. memset(buffer, 0xff, buffer_limit - buffer);
  383. // Lets see if it matches what is already there....
  384. if (memcmp(buffer_base, flash_memory, INTERNAL_FLASH_SECTOR_SIZE) != 0) {
  385. // Starts being dangerous
  386. if (platform_flash_erase_sector(flash_offset / INTERNAL_FLASH_SECTOR_SIZE) != PLATFORM_OK) {
  387. luaM_free(L, buffer_base);
  388. return "Failed to erase sector";
  389. }
  390. if (platform_s_flash_write(buffer_base, flash_offset, INTERNAL_FLASH_SECTOR_SIZE) != INTERNAL_FLASH_SECTOR_SIZE) {
  391. luaM_free(L, buffer_base);
  392. return "Failed to write sector";
  393. }
  394. // ends being dangerous
  395. }
  396. luaM_free(L, buffer_base);
  397. return NULL;
  398. }
  399. // Lua: tls.cert.auth(PEM data [, PEM data] )
  400. // Lua: tls.cert.auth(true / false)
  401. static int tls_cert_auth(lua_State *L)
  402. {
  403. if (ssl_client_options.cert_auth_callback != LUA_NOREF) {
  404. luaL_unref(L, LUA_REGISTRYINDEX, ssl_client_options.cert_auth_callback);
  405. ssl_client_options.cert_auth_callback = LUA_NOREF;
  406. }
  407. if (lua_type(L, 1) == LUA_TFUNCTION) {
  408. ssl_client_options.cert_auth_callback = luaL_ref(L, LUA_REGISTRYINDEX);
  409. lua_pushboolean(L, true);
  410. return 1;
  411. }
  412. if (lua_type(L, 1) != LUA_TNIL) {
  413. platform_print_deprecation_note("tls.cert.auth's old interface", "soon");
  414. }
  415. int enable;
  416. uint32_t flash_offset = platform_flash_mapped2phys((uint32_t) &tls_client_cert_area[0]);
  417. if ((flash_offset & 0xfff) || flash_offset > 0xff000 || INTERNAL_FLASH_SECTOR_SIZE != 0x1000) {
  418. // THis should never happen
  419. return luaL_error( L, "bad offset" );
  420. }
  421. if (lua_type(L, 1) == LUA_TSTRING) {
  422. const char *types[3] = { "CERTIFICATE", "RSA PRIVATE KEY", NULL };
  423. const char *names[2] = { "certificate", "private_key" };
  424. const char *error = fill_page_with_pem(L, &tls_client_cert_area[0], flash_offset, types, names);
  425. if (error) {
  426. return luaL_error(L, error);
  427. }
  428. enable = 1;
  429. } else {
  430. enable = lua_toboolean(L, 1);
  431. }
  432. bool rc;
  433. if (enable) {
  434. // See if there is a cert there
  435. if (tls_client_cert_area[0] == 0x00 || tls_client_cert_area[0] == 0xff) {
  436. return luaL_error( L, "no certificates found" );
  437. }
  438. rc = espconn_secure_cert_req_enable(ESPCONN_CLIENT, flash_offset / INTERNAL_FLASH_SECTOR_SIZE);
  439. } else {
  440. rc = espconn_secure_cert_req_disable(ESPCONN_CLIENT);
  441. }
  442. lua_pushboolean(L, rc);
  443. return 1;
  444. }
  445. // Lua: tls.cert.verify(PEM data [, PEM data] )
  446. // Lua: tls.cert.verify(true / false)
  447. static int tls_cert_verify(lua_State *L)
  448. {
  449. if (ssl_client_options.cert_verify_callback != LUA_NOREF) {
  450. luaL_unref(L, LUA_REGISTRYINDEX, ssl_client_options.cert_verify_callback);
  451. ssl_client_options.cert_verify_callback = LUA_NOREF;
  452. }
  453. if (lua_type(L, 1) == LUA_TFUNCTION) {
  454. ssl_client_options.cert_verify_callback = luaL_ref(L, LUA_REGISTRYINDEX);
  455. lua_pushboolean(L, true);
  456. return 1;
  457. }
  458. if (lua_type(L, 1) != LUA_TNIL) {
  459. platform_print_deprecation_note("tls.cert.verify's old interface", "soon");
  460. }
  461. int enable;
  462. uint32_t flash_offset = platform_flash_mapped2phys((uint32_t) &tls_server_cert_area[0]);
  463. if ((flash_offset & 0xfff) || flash_offset > 0xff000 || INTERNAL_FLASH_SECTOR_SIZE != 0x1000) {
  464. // THis should never happen
  465. return luaL_error( L, "bad offset" );
  466. }
  467. if (lua_type(L, 1) == LUA_TSTRING) {
  468. const char *types[2] = { "CERTIFICATE", NULL };
  469. const char *names[1] = { "certificate" };
  470. const char *error = fill_page_with_pem(L, &tls_server_cert_area[0], flash_offset, types, names);
  471. if (error) {
  472. return luaL_error(L, error);
  473. }
  474. enable = 1;
  475. } else {
  476. enable = lua_toboolean(L, 1);
  477. }
  478. bool rc;
  479. if (enable) {
  480. // See if there is a cert there
  481. if (tls_server_cert_area[0] == 0x00 || tls_server_cert_area[0] == 0xff) {
  482. return luaL_error( L, "no certificates found" );
  483. }
  484. rc = espconn_secure_ca_enable(ESPCONN_CLIENT, flash_offset / INTERNAL_FLASH_SECTOR_SIZE);
  485. } else {
  486. rc = espconn_secure_ca_disable(ESPCONN_CLIENT);
  487. }
  488. lua_pushboolean(L, rc);
  489. return 1;
  490. }
  491. #if defined(MBEDTLS_DEBUG_C)
  492. static int tls_set_debug_threshold(lua_State *L) {
  493. mbedtls_debug_set_threshold(luaL_checkint( L, 1 ));
  494. return 0;
  495. }
  496. #endif
  497. LROT_BEGIN(tls_socket, NULL, LROT_MASK_GC_INDEX)
  498. LROT_FUNCENTRY( __gc, tls_socket_delete )
  499. LROT_TABENTRY( __index, tls_socket )
  500. LROT_FUNCENTRY( connect, tls_socket_connect )
  501. LROT_FUNCENTRY( close, tls_socket_close )
  502. LROT_FUNCENTRY( on, tls_socket_on )
  503. LROT_FUNCENTRY( send, tls_socket_send )
  504. LROT_FUNCENTRY( hold, tls_socket_hold )
  505. LROT_FUNCENTRY( unhold, tls_socket_unhold )
  506. LROT_FUNCENTRY( getpeer, tls_socket_getpeer )
  507. LROT_END(tls_socket, NULL, LROT_MASK_GC_INDEX)
  508. LROT_BEGIN(tls_cert, NULL, LROT_MASK_INDEX)
  509. LROT_TABENTRY( __index, tls_cert )
  510. LROT_FUNCENTRY( verify, tls_cert_verify )
  511. LROT_FUNCENTRY( auth, tls_cert_auth )
  512. LROT_END(tls_cert, NULL, LROT_MASK_INDEX)
  513. LROT_BEGIN(tls, NULL, 0)
  514. LROT_FUNCENTRY( createConnection, tls_socket_create )
  515. #if defined(MBEDTLS_DEBUG_C)
  516. LROT_FUNCENTRY( setDebug, tls_set_debug_threshold )
  517. #endif
  518. LROT_TABENTRY( cert, tls_cert )
  519. LROT_END(tls, NULL, 0)
  520. int luaopen_tls( lua_State *L ) {
  521. luaL_rometatable(L, "tls.socket", LROT_TABLEREF(tls_socket));
  522. return 0;
  523. }
  524. NODEMCU_MODULE(TLS, "tls", tls, luaopen_tls);
  525. #endif