tls.c 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649
  1. // Module for TLS
  2. #include "module.h"
  3. #if defined(CLIENT_SSL_ENABLE) && defined(LUA_USE_MODULES_NET)
  4. #include "lauxlib.h"
  5. #include "platform.h"
  6. #include "lmem.h"
  7. #include "c_string.h"
  8. #include "c_stdlib.h"
  9. #include "c_types.h"
  10. #include "mem.h"
  11. #include "lwip/ip_addr.h"
  12. #include "espconn.h"
  13. #include "lwip/err.h"
  14. #include "lwip/dns.h"
  15. #ifdef HAVE_SSL_SERVER_CRT
  16. #include HAVE_SSL_SERVER_CRT
  17. #else
  18. __attribute__((section(".servercert.flash"))) unsigned char tls_server_cert_area[INTERNAL_FLASH_SECTOR_SIZE];
  19. #endif
  20. __attribute__((section(".clientcert.flash"))) unsigned char tls_client_cert_area[INTERNAL_FLASH_SECTOR_SIZE];
  21. extern int tls_socket_create( lua_State *L );
  22. extern const LUA_REG_TYPE tls_cert_map[];
  23. typedef struct {
  24. struct espconn *pesp_conn;
  25. int self_ref;
  26. int cb_connect_ref;
  27. int cb_reconnect_ref;
  28. int cb_disconnect_ref;
  29. int cb_sent_ref;
  30. int cb_receive_ref;
  31. int cb_dns_ref;
  32. } tls_socket_ud;
  33. int tls_socket_create( lua_State *L ) {
  34. tls_socket_ud *ud = (tls_socket_ud*) lua_newuserdata(L, sizeof(tls_socket_ud));
  35. ud->pesp_conn = NULL;
  36. ud->self_ref =
  37. ud->cb_connect_ref =
  38. ud->cb_reconnect_ref =
  39. ud->cb_disconnect_ref =
  40. ud->cb_sent_ref =
  41. ud->cb_receive_ref =
  42. ud->cb_dns_ref = LUA_NOREF;
  43. luaL_getmetatable(L, "tls.socket");
  44. lua_setmetatable(L, -2);
  45. return 1;
  46. }
  47. static void tls_socket_onconnect( struct espconn *pesp_conn ) {
  48. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  49. if (!ud || ud->self_ref == LUA_NOREF) return;
  50. if (ud->cb_connect_ref != LUA_NOREF) {
  51. lua_State *L = lua_getstate();
  52. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_connect_ref);
  53. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  54. lua_call(L, 1, 0);
  55. }
  56. }
  57. static void tls_socket_cleanup(tls_socket_ud *ud) {
  58. if (ud->pesp_conn) {
  59. espconn_secure_disconnect(ud->pesp_conn);
  60. if (ud->pesp_conn->proto.tcp) {
  61. c_free(ud->pesp_conn->proto.tcp);
  62. ud->pesp_conn->proto.tcp = NULL;
  63. }
  64. c_free(ud->pesp_conn);
  65. ud->pesp_conn = NULL;
  66. }
  67. lua_State *L = lua_getstate();
  68. lua_gc(L, LUA_GCSTOP, 0);
  69. luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
  70. ud->self_ref = LUA_NOREF;
  71. lua_gc(L, LUA_GCRESTART, 0);
  72. }
  73. static void tls_socket_ondisconnect( struct espconn *pesp_conn ) {
  74. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  75. if (!ud || ud->self_ref == LUA_NOREF) return;
  76. tls_socket_cleanup(ud);
  77. if (ud->cb_disconnect_ref != LUA_NOREF) {
  78. lua_State *L = lua_getstate();
  79. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_disconnect_ref);
  80. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  81. tls_socket_cleanup(ud);
  82. lua_call(L, 1, 0);
  83. } else tls_socket_cleanup(ud);
  84. }
  85. static void tls_socket_onreconnect( struct espconn *pesp_conn, s8 err ) {
  86. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  87. if (!ud || ud->self_ref == LUA_NOREF) return;
  88. if (ud->cb_reconnect_ref != LUA_NOREF) {
  89. const char* reason = NULL;
  90. switch (err) {
  91. case(ESPCONN_MEM): reason = "Out of memory"; break;
  92. case(ESPCONN_TIMEOUT): reason = "Timeout"; break;
  93. case(ESPCONN_RTE): reason = "Routing problem"; break;
  94. case(ESPCONN_ABRT): reason = "Connection aborted"; break;
  95. case(ESPCONN_RST): reason = "Connection reset"; break;
  96. case(ESPCONN_CLSD): reason = "Connection closed"; break;
  97. case(ESPCONN_HANDSHAKE): reason = "SSL handshake failed"; break;
  98. case(ESPCONN_SSL_INVALID_DATA): reason = "SSL application invalid"; break;
  99. }
  100. lua_State *L = lua_getstate();
  101. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_reconnect_ref);
  102. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  103. if (reason != NULL) {
  104. lua_pushstring(L, reason);
  105. } else {
  106. lua_pushnil(L);
  107. }
  108. tls_socket_cleanup(ud);
  109. lua_call(L, 2, 0);
  110. } else tls_socket_cleanup(ud);
  111. }
  112. static void tls_socket_onrecv( struct espconn *pesp_conn, char *buf, u16 length ) {
  113. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  114. if (!ud || ud->self_ref == LUA_NOREF) return;
  115. if (ud->cb_receive_ref != LUA_NOREF) {
  116. lua_State *L = lua_getstate();
  117. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_receive_ref);
  118. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  119. lua_pushlstring(L, buf, length);
  120. lua_call(L, 2, 0);
  121. }
  122. }
  123. static void tls_socket_onsent( struct espconn *pesp_conn ) {
  124. tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  125. if (!ud || ud->self_ref == LUA_NOREF) return;
  126. if (ud->cb_sent_ref != LUA_NOREF) {
  127. lua_State *L = lua_getstate();
  128. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_sent_ref);
  129. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  130. lua_call(L, 1, 0);
  131. }
  132. }
  133. static void tls_socket_dns_cb( const char* domain, const ip_addr_t *ip_addr, tls_socket_ud *ud ) {
  134. if (ud->self_ref == LUA_NOREF) return;
  135. ip_addr_t addr;
  136. if (ip_addr) addr = *ip_addr;
  137. else addr.addr = 0xFFFFFFFF;
  138. lua_State *L = lua_getstate();
  139. if (ud->cb_dns_ref != LUA_NOREF) {
  140. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_dns_ref);
  141. lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
  142. if (addr.addr == 0xFFFFFFFF) {
  143. lua_pushnil(L);
  144. } else {
  145. char tmp[20];
  146. c_sprintf(tmp, IPSTR, IP2STR(&addr.addr));
  147. lua_pushstring(L, tmp);
  148. }
  149. lua_call(L, 2, 0);
  150. }
  151. if (addr.addr == 0xFFFFFFFF) {
  152. lua_gc(L, LUA_GCSTOP, 0);
  153. luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
  154. ud->self_ref = LUA_NOREF;
  155. lua_gc(L, LUA_GCRESTART, 0);
  156. } else {
  157. os_memcpy(ud->pesp_conn->proto.tcp->remote_ip, &addr.addr, 4);
  158. espconn_secure_connect(ud->pesp_conn);
  159. }
  160. }
  161. static int tls_socket_connect( lua_State *L ) {
  162. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  163. luaL_argcheck(L, ud, 1, "TLS socket expected");
  164. if(ud==NULL){
  165. NODE_DBG("userdata is nil.\n");
  166. return 0;
  167. }
  168. if (ud->pesp_conn) {
  169. return luaL_error(L, "already connected");
  170. }
  171. u16 port = luaL_checkinteger( L, 2 );
  172. size_t il;
  173. const char *domain = "127.0.0.1";
  174. if( lua_isstring(L, 3) )
  175. domain = luaL_checklstring( L, 3, &il );
  176. if (port == 0)
  177. return luaL_error(L, "invalid port");
  178. if (domain == NULL)
  179. return luaL_error(L, "invalid domain");
  180. ud->pesp_conn = (struct espconn*)c_zalloc(sizeof(struct espconn));
  181. if(!ud->pesp_conn)
  182. return luaL_error(L, "not enough memory");
  183. ud->pesp_conn->proto.udp = NULL;
  184. ud->pesp_conn->proto.tcp = (esp_tcp *)c_zalloc(sizeof(esp_tcp));
  185. if(!ud->pesp_conn->proto.tcp){
  186. c_free(ud->pesp_conn);
  187. ud->pesp_conn = NULL;
  188. return luaL_error(L, "not enough memory");
  189. }
  190. ud->pesp_conn->type = ESPCONN_TCP;
  191. ud->pesp_conn->state = ESPCONN_NONE;
  192. ud->pesp_conn->reverse = ud;
  193. ud->pesp_conn->proto.tcp->remote_port = port;
  194. espconn_regist_connectcb(ud->pesp_conn, (espconn_connect_callback)tls_socket_onconnect);
  195. espconn_regist_disconcb(ud->pesp_conn, (espconn_connect_callback)tls_socket_ondisconnect);
  196. espconn_regist_reconcb(ud->pesp_conn, (espconn_reconnect_callback)tls_socket_onreconnect);
  197. espconn_regist_recvcb(ud->pesp_conn, (espconn_recv_callback)tls_socket_onrecv);
  198. espconn_regist_sentcb(ud->pesp_conn, (espconn_sent_callback)tls_socket_onsent);
  199. if (ud->self_ref == LUA_NOREF) {
  200. lua_pushvalue(L, 1); // copy to the top of stack
  201. ud->self_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  202. }
  203. ip_addr_t addr;
  204. err_t err = dns_gethostbyname(domain, &addr, (dns_found_callback)tls_socket_dns_cb, ud);
  205. if (err == ERR_OK) {
  206. tls_socket_dns_cb(domain, &addr, ud);
  207. } else if (err != ERR_INPROGRESS) {
  208. tls_socket_dns_cb(domain, NULL, ud);
  209. }
  210. return 0;
  211. }
  212. static int tls_socket_on( lua_State *L ) {
  213. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  214. luaL_argcheck(L, ud, 1, "TLS socket expected");
  215. if(ud==NULL){
  216. NODE_DBG("userdata is nil.\n");
  217. return 0;
  218. }
  219. size_t sl;
  220. const char *method = luaL_checklstring( L, 2, &sl );
  221. if (method == NULL)
  222. return luaL_error( L, "wrong arg type" );
  223. luaL_checkanyfunction(L, 3);
  224. lua_pushvalue(L, 3); // copy argument (func) to the top of stack
  225. if (strcmp(method, "connection") == 0) {
  226. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_connect_ref);
  227. ud->cb_connect_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  228. } else if (strcmp(method, "disconnection") == 0) {
  229. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_disconnect_ref);
  230. ud->cb_disconnect_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  231. } else if (strcmp(method, "reconnection") == 0) {
  232. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_reconnect_ref);
  233. ud->cb_reconnect_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  234. } else if (strcmp(method, "receive") == 0) {
  235. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_receive_ref);
  236. ud->cb_receive_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  237. } else if (strcmp(method, "sent") == 0) {
  238. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_sent_ref);
  239. ud->cb_sent_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  240. } else if (strcmp(method, "dns") == 0) {
  241. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_dns_ref);
  242. ud->cb_dns_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  243. } else {
  244. return luaL_error(L, "invalid method");
  245. }
  246. return 0;
  247. }
  248. static int tls_socket_send( lua_State *L ) {
  249. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  250. luaL_argcheck(L, ud, 1, "TLS socket expected");
  251. if(ud==NULL){
  252. NODE_DBG("userdata is nil.\n");
  253. return 0;
  254. }
  255. if(ud->pesp_conn == NULL) {
  256. NODE_DBG("not connected");
  257. return 0;
  258. }
  259. size_t sl;
  260. const char* buf = luaL_checklstring(L, 2, &sl);
  261. if (!buf) {
  262. return luaL_error(L, "wrong arg type");
  263. }
  264. espconn_secure_send(ud->pesp_conn, (void*)buf, sl);
  265. return 0;
  266. }
  267. static int tls_socket_hold( lua_State *L ) {
  268. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  269. luaL_argcheck(L, ud, 1, "TLS socket expected");
  270. if(ud==NULL){
  271. NODE_DBG("userdata is nil.\n");
  272. return 0;
  273. }
  274. if(ud->pesp_conn == NULL) {
  275. NODE_DBG("not connected");
  276. return 0;
  277. }
  278. espconn_recv_hold(ud->pesp_conn);
  279. return 0;
  280. }
  281. static int tls_socket_unhold( lua_State *L ) {
  282. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  283. luaL_argcheck(L, ud, 1, "TLS socket expected");
  284. if(ud==NULL){
  285. NODE_DBG("userdata is nil.\n");
  286. return 0;
  287. }
  288. if(ud->pesp_conn == NULL) {
  289. NODE_DBG("not connected");
  290. return 0;
  291. }
  292. espconn_recv_unhold(ud->pesp_conn);
  293. return 0;
  294. }
  295. static int tls_socket_dns( lua_State *L ) {
  296. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  297. luaL_argcheck(L, ud, 1, "TLS socket expected");
  298. if(ud==NULL){
  299. NODE_DBG("userdata is nil.\n");
  300. return 0;
  301. }
  302. return 0;
  303. }
  304. static int tls_socket_getpeer( lua_State *L ) {
  305. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  306. luaL_argcheck(L, ud, 1, "TLS socket expected");
  307. if(ud==NULL){
  308. NODE_DBG("userdata is nil.\n");
  309. return 0;
  310. }
  311. if(ud->pesp_conn && ud->pesp_conn->proto.tcp->remote_port != 0){
  312. char temp[20] = {0};
  313. c_sprintf(temp, IPSTR, IP2STR( &(ud->pesp_conn->proto.tcp->remote_ip) ) );
  314. lua_pushstring( L, temp );
  315. lua_pushinteger( L, ud->pesp_conn->proto.tcp->remote_port );
  316. } else {
  317. lua_pushnil( L );
  318. lua_pushnil( L );
  319. }
  320. return 2;
  321. }
  322. static int tls_socket_close( lua_State *L ) {
  323. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  324. luaL_argcheck(L, ud, 1, "TLS socket expected");
  325. if(ud==NULL){
  326. NODE_DBG("userdata is nil.\n");
  327. return 0;
  328. }
  329. if (ud->pesp_conn) {
  330. espconn_secure_disconnect(ud->pesp_conn);
  331. }
  332. return 0;
  333. }
  334. static int tls_socket_delete( lua_State *L ) {
  335. tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  336. luaL_argcheck(L, ud, 1, "TLS socket expected");
  337. if(ud==NULL){
  338. NODE_DBG("userdata is nil.\n");
  339. return 0;
  340. }
  341. if (ud->pesp_conn) {
  342. espconn_secure_disconnect(ud->pesp_conn);
  343. if (ud->pesp_conn->proto.tcp) {
  344. c_free(ud->pesp_conn->proto.tcp);
  345. ud->pesp_conn->proto.tcp = NULL;
  346. }
  347. c_free(ud->pesp_conn);
  348. ud->pesp_conn = NULL;
  349. }
  350. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_connect_ref);
  351. ud->cb_connect_ref = LUA_NOREF;
  352. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_disconnect_ref);
  353. ud->cb_disconnect_ref = LUA_NOREF;
  354. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_reconnect_ref);
  355. ud->cb_reconnect_ref = LUA_NOREF;
  356. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_dns_ref);
  357. ud->cb_dns_ref = LUA_NOREF;
  358. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_receive_ref);
  359. ud->cb_receive_ref = LUA_NOREF;
  360. luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_sent_ref);
  361. ud->cb_sent_ref = LUA_NOREF;
  362. lua_gc(L, LUA_GCSTOP, 0);
  363. luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
  364. ud->self_ref = LUA_NOREF;
  365. lua_gc(L, LUA_GCRESTART, 0);
  366. return 0;
  367. }
  368. // Returns NULL on success, error message otherwise
  369. static const char *append_pem_blob(const char *pem, const char *type, uint8_t **buffer_p, uint8_t *buffer_limit, const char *name) {
  370. char unb64[256];
  371. memset(unb64, 0xff, sizeof(unb64));
  372. int i;
  373. for (i = 0; i < 64; i++) {
  374. unb64["ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[i]] = i;
  375. }
  376. if (!pem) {
  377. return "No PEM blob";
  378. }
  379. // Scan for -----BEGIN CERT
  380. pem = strstr(pem, "-----BEGIN ");
  381. if (!pem) {
  382. return "No PEM header";
  383. }
  384. if (strncmp(pem + 11, type, strlen(type))) {
  385. return "Wrong PEM type";
  386. }
  387. pem = strchr(pem, '\n');
  388. if (!pem) {
  389. return "Incorrect PEM format";
  390. }
  391. //
  392. // Base64 encoded data starts here
  393. // Get all the base64 data into a single buffer....
  394. // We will use the back end of the buffer....
  395. //
  396. uint8_t *buffer = *buffer_p;
  397. uint8_t *dest = buffer + 32 + 2; // Leave space for name and length
  398. int bitcount = 0;
  399. int accumulator = 0;
  400. for (; *pem && dest < buffer_limit; pem++) {
  401. int val = unb64[*(uint8_t*) pem];
  402. if (val & 0xC0) {
  403. // not a base64 character
  404. if (isspace(*(uint8_t*) pem)) {
  405. continue;
  406. }
  407. if (*pem == '=') {
  408. // just ignore -- at the end
  409. bitcount = 0;
  410. continue;
  411. }
  412. if (*pem == '-') {
  413. break;
  414. }
  415. return "Invalid character in PEM";
  416. } else {
  417. bitcount += 6;
  418. accumulator = (accumulator << 6) + val;
  419. if (bitcount >= 8) {
  420. bitcount -= 8;
  421. *dest++ = accumulator >> bitcount;
  422. }
  423. }
  424. }
  425. if (dest >= buffer_limit || strncmp(pem, "-----END ", 9) || strncmp(pem + 9, type, strlen(type)) || bitcount) {
  426. return "Invalid PEM format data";
  427. }
  428. size_t len = dest - (buffer + 32 + 2);
  429. memset(buffer, 0, 32);
  430. strcpy(buffer, name);
  431. buffer[32] = len & 0xff;
  432. buffer[33] = (len >> 8) & 0xff;
  433. *buffer_p = dest;
  434. return NULL;
  435. }
  436. static const char *fill_page_with_pem(lua_State *L, const unsigned char *flash_memory, int flash_offset, const char **types, const char **names)
  437. {
  438. uint8_t *buffer = luaM_malloc(L, INTERNAL_FLASH_SECTOR_SIZE);
  439. uint8_t *buffer_base = buffer;
  440. uint8_t *buffer_limit = buffer + INTERNAL_FLASH_SECTOR_SIZE;
  441. int argno;
  442. for (argno = 1; argno <= lua_gettop(L) && types[argno - 1]; argno++) {
  443. const char *pem = lua_tostring(L, argno);
  444. const char *error = append_pem_blob(pem, types[argno - 1], &buffer, buffer_limit, names[argno - 1]);
  445. if (error) {
  446. luaM_free(L, buffer_base);
  447. return error;
  448. }
  449. }
  450. memset(buffer, 0xff, buffer_limit - buffer);
  451. // Lets see if it matches what is already there....
  452. if (c_memcmp(buffer_base, flash_memory, INTERNAL_FLASH_SECTOR_SIZE) != 0) {
  453. // Starts being dangerous
  454. if (platform_flash_erase_sector(flash_offset / INTERNAL_FLASH_SECTOR_SIZE) != PLATFORM_OK) {
  455. luaM_free(L, buffer_base);
  456. return "Failed to erase sector";
  457. }
  458. if (platform_s_flash_write(buffer_base, flash_offset, INTERNAL_FLASH_SECTOR_SIZE) != INTERNAL_FLASH_SECTOR_SIZE) {
  459. luaM_free(L, buffer_base);
  460. return "Failed to write sector";
  461. }
  462. // ends being dangerous
  463. }
  464. luaM_free(L, buffer_base);
  465. return NULL;
  466. }
  467. // Lua: tls.cert.auth(true / false | PEM data [, PEM data] )
  468. static int tls_cert_auth(lua_State *L)
  469. {
  470. int enable;
  471. uint32_t flash_offset = platform_flash_mapped2phys((uint32_t) &tls_client_cert_area[0]);
  472. if ((flash_offset & 0xfff) || flash_offset > 0xff000 || INTERNAL_FLASH_SECTOR_SIZE != 0x1000) {
  473. // THis should never happen
  474. return luaL_error( L, "bad offset" );
  475. }
  476. if (lua_type(L, 1) == LUA_TSTRING) {
  477. const char *types[3] = { "CERTIFICATE", "RSA PRIVATE KEY", NULL };
  478. const char *names[2] = { "certificate", "private_key" };
  479. const char *error = fill_page_with_pem(L, &tls_client_cert_area[0], flash_offset, types, names);
  480. if (error) {
  481. return luaL_error(L, error);
  482. }
  483. enable = 1;
  484. } else {
  485. enable = lua_toboolean(L, 1);
  486. }
  487. bool rc;
  488. if (enable) {
  489. // See if there is a cert there
  490. if (tls_client_cert_area[0] == 0x00 || tls_client_cert_area[0] == 0xff) {
  491. return luaL_error( L, "no certificates found" );
  492. }
  493. rc = espconn_secure_cert_req_enable(1, flash_offset / INTERNAL_FLASH_SECTOR_SIZE);
  494. } else {
  495. rc = espconn_secure_cert_req_disable(1);
  496. }
  497. lua_pushboolean(L, rc);
  498. return 1;
  499. }
  500. // Lua: tls.cert.verify(true / false | PEM data [, PEM data] )
  501. static int tls_cert_verify(lua_State *L)
  502. {
  503. int enable;
  504. uint32_t flash_offset = platform_flash_mapped2phys((uint32_t) &tls_server_cert_area[0]);
  505. if ((flash_offset & 0xfff) || flash_offset > 0xff000 || INTERNAL_FLASH_SECTOR_SIZE != 0x1000) {
  506. // THis should never happen
  507. return luaL_error( L, "bad offset" );
  508. }
  509. if (lua_type(L, 1) == LUA_TSTRING) {
  510. const char *types[2] = { "CERTIFICATE", NULL };
  511. const char *names[1] = { "certificate" };
  512. const char *error = fill_page_with_pem(L, &tls_server_cert_area[0], flash_offset, types, names);
  513. if (error) {
  514. return luaL_error(L, error);
  515. }
  516. enable = 1;
  517. } else {
  518. enable = lua_toboolean(L, 1);
  519. }
  520. bool rc;
  521. if (enable) {
  522. // See if there is a cert there
  523. if (tls_server_cert_area[0] == 0x00 || tls_server_cert_area[0] == 0xff) {
  524. return luaL_error( L, "no certificates found" );
  525. }
  526. rc = espconn_secure_ca_enable(1, flash_offset / INTERNAL_FLASH_SECTOR_SIZE);
  527. } else {
  528. rc = espconn_secure_ca_disable(1);
  529. }
  530. lua_pushboolean(L, rc);
  531. return 1;
  532. }
  533. static const LUA_REG_TYPE tls_socket_map[] = {
  534. { LSTRKEY( "connect" ), LFUNCVAL( tls_socket_connect ) },
  535. { LSTRKEY( "close" ), LFUNCVAL( tls_socket_close ) },
  536. { LSTRKEY( "on" ), LFUNCVAL( tls_socket_on ) },
  537. { LSTRKEY( "send" ), LFUNCVAL( tls_socket_send ) },
  538. { LSTRKEY( "hold" ), LFUNCVAL( tls_socket_hold ) },
  539. { LSTRKEY( "unhold" ), LFUNCVAL( tls_socket_unhold ) },
  540. { LSTRKEY( "dns" ), LFUNCVAL( tls_socket_dns ) },
  541. { LSTRKEY( "getpeer" ), LFUNCVAL( tls_socket_getpeer ) },
  542. { LSTRKEY( "__gc" ), LFUNCVAL( tls_socket_delete ) },
  543. { LSTRKEY( "__index" ), LROVAL( tls_socket_map ) },
  544. { LNILKEY, LNILVAL }
  545. };
  546. const LUA_REG_TYPE tls_cert_map[] = {
  547. { LSTRKEY( "verify" ), LFUNCVAL( tls_cert_verify ) },
  548. { LSTRKEY( "auth" ), LFUNCVAL( tls_cert_auth ) },
  549. { LSTRKEY( "__index" ), LROVAL( tls_cert_map ) },
  550. { LNILKEY, LNILVAL }
  551. };
  552. static const LUA_REG_TYPE tls_map[] = {
  553. { LSTRKEY( "createConnection" ), LFUNCVAL( tls_socket_create ) },
  554. { LSTRKEY( "cert" ), LROVAL( tls_cert_map ) },
  555. { LSTRKEY( "__metatable" ), LROVAL( tls_map ) },
  556. { LNILKEY, LNILVAL }
  557. };
  558. int luaopen_tls( lua_State *L ) {
  559. luaL_rometatable(L, "tls.socket", (void *)tls_socket_map); // create metatable for net.server
  560. espconn_secure_set_size(ESPCONN_CLIENT, 4096);
  561. return 0;
  562. }
  563. NODEMCU_MODULE(TLS, "tls", tls_map, luaopen_tls);
  564. #endif