espconn_mbedtls.c 37 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968969970971972973974975976977978979980981982983984985986987988989990991992993994995996997998999100010011002100310041005100610071008100910101011101210131014101510161017101810191020102110221023102410251026102710281029103010311032103310341035103610371038103910401041104210431044104510461047104810491050105110521053105410551056105710581059106010611062106310641065106610671068106910701071107210731074107510761077107810791080108110821083108410851086108710881089109010911092109310941095109610971098109911001101110211031104110511061107110811091110111111121113111411151116111711181119112011211122112311241125112611271128112911301131113211331134113511361137113811391140114111421143114411451146114711481149115011511152115311541155115611571158115911601161116211631164116511661167116811691170117111721173117411751176117711781179118011811182118311841185118611871188118911901191119211931194119511961197119811991200120112021203120412051206120712081209121012111212121312141215121612171218121912201221122212231224122512261227122812291230123112321233123412351236123712381239124012411242124312441245124612471248124912501251125212531254125512561257125812591260126112621263126412651266126712681269127012711272127312741275127612771278127912801281128212831284
  1. /*
  2. * ESPRSSIF MIT License
  3. *
  4. * Copyright (c) 2016 <ESPRESSIF SYSTEMS (SHANGHAI) PTE LTD>
  5. *
  6. * Permission is hereby granted for use on ESPRESSIF SYSTEMS ESP8266 only, in which case,
  7. * it is free of charge, to any person obtaining a copy of this software and associated
  8. * documentation files (the "Software"), to deal in the Software without restriction, including
  9. * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
  10. * and/or sell copies of the Software, and to permit persons to whom the Software is furnished
  11. * to do so, subject to the following conditions:
  12. *
  13. * The above copyright notice and this permission notice shall be included in all copies or
  14. * substantial portions of the Software.
  15. *
  16. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
  18. * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
  19. * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
  20. * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  21. * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  22. *
  23. */
  24. #if !defined(ESPCONN_MBEDTLS)
  25. #if !defined(MBEDTLS_CONFIG_FILE)
  26. #include "mbedtls/config.h"
  27. #else
  28. #include MBEDTLS_CONFIG_FILE
  29. #endif
  30. #include "mbedtls/ssl_internal.h"
  31. #include "mem.h"
  32. #ifdef MEMLEAK_DEBUG
  33. static const char mem_debug_file[] ICACHE_RODATA_ATTR = __FILE__;
  34. #endif
  35. #include "sys/socket.h"
  36. #include "sys/espconn_mbedtls.h"
  37. static os_event_t lwIPThreadQueue[lwIPThreadQueueLen];
  38. static bool lwIPThreadFlag = false;
  39. extern espconn_msg *plink_active;
  40. static espconn_msg *plink_server = NULL;
  41. static pmbedtls_parame def_certificate = NULL;
  42. static pmbedtls_parame def_private_key = NULL;
  43. #if defined(ESP8266_PLATFORM)
  44. #define MBEDTLS_SSL_OUTBUFFER_LEN ( MBEDTLS_SSL_PLAIN_ADD \
  45. + MBEDTLS_SSL_COMPRESSION_ADD \
  46. + 29 /* counter + header + IV */ \
  47. + MBEDTLS_SSL_MAC_ADD \
  48. + MBEDTLS_SSL_PADDING_ADD \
  49. )
  50. #endif
  51. /* Implementation that should never be optimized out by the compiler */
  52. static void mbedtls_zeroize( void *v, size_t n ) {
  53. volatile unsigned char *p = v; while( n-- ) *p++ = 0;
  54. }
  55. static pmbedtls_parame mbedtls_parame_new(size_t capacity)
  56. {
  57. pmbedtls_parame rb = (pmbedtls_parame)os_zalloc(sizeof(mbedtls_parame));
  58. if (rb && capacity != 0){
  59. rb->parame_datalen = capacity;
  60. rb->parame_data = (uint8*)os_zalloc(rb->parame_datalen + 1);
  61. if (rb->parame_data){
  62. } else{
  63. os_free(rb);
  64. rb = NULL;
  65. }
  66. }
  67. return rb;
  68. }
  69. static void mbedtls_parame_free(pmbedtls_parame *fp)
  70. {
  71. lwIP_ASSERT(fp);
  72. lwIP_ASSERT(*fp);
  73. os_free((*fp)->parame_data);
  74. os_free(*fp);
  75. *fp = NULL;
  76. }
  77. bool mbedtls_load_default_obj(uint32 flash_sector, int obj_type, const unsigned char *load_buf, uint16 length)
  78. {
  79. pmbedtls_parame mbedtls_write = NULL;
  80. uint32 mbedtls_head = 0;
  81. bool mbedtls_load_flag = false;
  82. if (flash_sector != 0){
  83. spi_flash_read(flash_sector * FLASH_SECTOR_SIZE, (uint32*)&mbedtls_head, 4);
  84. if (mbedtls_head != ESPCONN_INVALID_TYPE){
  85. mbedtls_write = mbedtls_parame_new(0);
  86. mbedtls_write->parame_datalen = length;
  87. }
  88. } else{
  89. const char* const begin = "-----BEGIN";
  90. int format_type = ESPCONN_FORMAT_INIT;
  91. /*
  92. * Determine data content. data contains either one DER certificate or
  93. * one or more PEM certificates.
  94. */
  95. if ((char*)os_strstr(load_buf, begin) != NULL){
  96. format_type = ESPCONN_FORMAT_PEM;
  97. }else{
  98. format_type = ESPCONN_FORMAT_DER;
  99. }
  100. if (format_type == ESPCONN_FORMAT_PEM){
  101. length += 1;
  102. }
  103. mbedtls_write = mbedtls_parame_new(length);
  104. if (mbedtls_write){
  105. os_memcpy(mbedtls_write->parame_data, load_buf, length);
  106. if (format_type == ESPCONN_FORMAT_PEM)
  107. mbedtls_write->parame_data[length - 1] = '\0';
  108. }
  109. }
  110. if (mbedtls_write){
  111. mbedtls_load_flag = true;
  112. mbedtls_write->parame_type = obj_type;
  113. mbedtls_write->parame_sec = flash_sector;
  114. if (obj_type == ESPCONN_PK){
  115. def_private_key = mbedtls_write;
  116. } else{
  117. def_certificate = mbedtls_write;
  118. }
  119. }
  120. return mbedtls_load_flag;
  121. }
  122. static unsigned char* mbedtls_get_default_obj(uint32 *sec, uint32 type, uint32 *len)
  123. {
  124. const char* const begin = "-----BEGIN";
  125. unsigned char *parame_data = NULL;
  126. pmbedtls_parame mbedtls_obj = NULL;
  127. if (type == ESPCONN_PK){
  128. mbedtls_obj = def_private_key;
  129. } else{
  130. mbedtls_obj = def_certificate;
  131. }
  132. if (mbedtls_obj->parame_sec != 0){
  133. #define DATA_OFFSET 4
  134. uint32 data_len = mbedtls_obj->parame_datalen;
  135. parame_data = (unsigned char *)os_zalloc(data_len + DATA_OFFSET);
  136. if (parame_data){
  137. spi_flash_read(mbedtls_obj->parame_sec * FLASH_SECTOR_SIZE, (uint32*)parame_data, data_len);
  138. /*
  139. * Determine buffer content. Buffer contains either one DER certificate or
  140. * one or more PEM certificates.
  141. */
  142. if ((char*)os_strstr(parame_data, begin) != NULL){
  143. data_len ++;
  144. parame_data[data_len - 1] = '\0';
  145. }
  146. }
  147. *len = data_len;
  148. } else{
  149. parame_data = mbedtls_obj->parame_data;
  150. *len = mbedtls_obj->parame_datalen;
  151. }
  152. *sec = mbedtls_obj->parame_sec;
  153. return parame_data;
  154. }
  155. static int mbedtls_setsockopt(int sock_id, int level, int optname, int optval)
  156. {
  157. return setsockopt(sock_id, level, optname, (void*)&optval, sizeof(optval));
  158. }
  159. static int mbedtls_keep_alive(int sock_id, int onoff, int idle, int intvl, int cnt)
  160. {
  161. int ret = ERR_OK;
  162. if (onoff == 0)
  163. return mbedtls_setsockopt(sock_id, SOL_SOCKET, SO_KEEPALIVE, onoff);;
  164. ret = mbedtls_setsockopt(sock_id, SOL_SOCKET, SO_KEEPALIVE, onoff);
  165. lwIP_REQUIRE_NOERROR(ret, exit);
  166. ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPALIVE, onoff);
  167. lwIP_REQUIRE_NOERROR(ret, exit);
  168. ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPIDLE, idle);
  169. lwIP_REQUIRE_NOERROR(ret, exit);
  170. ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPINTVL, intvl);
  171. lwIP_REQUIRE_NOERROR(ret, exit);
  172. ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPCNT, cnt);
  173. lwIP_REQUIRE_NOERROR(ret, exit);
  174. exit:
  175. return ret;
  176. }
  177. #if defined(ESP8266_PLATFORM)
  178. static pmbedtls_finished mbedtls_finished_new(int len)
  179. {
  180. pmbedtls_finished finished = (pmbedtls_finished)os_zalloc(sizeof(mbedtls_finished));
  181. if (finished)
  182. {
  183. finished->finished_len = len;
  184. finished->finished_buf = (uint8*)os_zalloc(finished->finished_len + 1);
  185. if (finished->finished_buf)
  186. {
  187. }
  188. else
  189. {
  190. os_free(finished);
  191. finished = NULL;
  192. }
  193. }
  194. return finished;
  195. }
  196. static void mbedtls_finished_free(pmbedtls_finished *pfinished)
  197. {
  198. lwIP_ASSERT(pfinished);
  199. lwIP_ASSERT(*pfinished);
  200. os_free((*pfinished)->finished_buf);
  201. os_free(*pfinished);
  202. *pfinished = NULL;
  203. }
  204. #endif
  205. static pmbedtls_espconn mbedtls_espconn_new(void)
  206. {
  207. pmbedtls_espconn mbedtls_conn = NULL;
  208. mbedtls_conn = (pmbedtls_espconn)os_zalloc(sizeof(mbedtls_espconn));
  209. if (mbedtls_conn){
  210. mbedtls_conn->proto.tcp = (esp_tcp *)os_zalloc(sizeof(esp_tcp));
  211. if (mbedtls_conn->proto.tcp == NULL){
  212. os_free(mbedtls_conn);
  213. mbedtls_conn = NULL;
  214. }
  215. }
  216. return mbedtls_conn;
  217. }
  218. static void mbedtls_espconn_free(pmbedtls_espconn *mbedtlsconn)
  219. {
  220. lwIP_ASSERT(mbedtlsconn);
  221. lwIP_ASSERT(*mbedtlsconn);
  222. os_free((*mbedtlsconn)->proto.tcp);
  223. (*mbedtlsconn)->proto.tcp = NULL;
  224. os_free((*mbedtlsconn));
  225. *mbedtlsconn = NULL;
  226. }
  227. static pmbedtls_session mbedtls_session_new(void)
  228. {
  229. pmbedtls_session session = (pmbedtls_session)os_zalloc(sizeof(mbedtls_session));
  230. if (session){
  231. mbedtls_x509_crt_init(&session->cacert);
  232. mbedtls_x509_crt_init(&session->clicert);
  233. mbedtls_pk_init(&session->pkey);
  234. // mbedtls_entropy_init(&session->entropy);
  235. }
  236. return session;
  237. }
  238. static void mbedtls_session_free(pmbedtls_session *session)
  239. {
  240. lwIP_ASSERT(session);
  241. lwIP_ASSERT(*session);
  242. mbedtls_x509_crt_free(&(*session)->cacert);
  243. mbedtls_x509_crt_free(&(*session)->clicert);
  244. mbedtls_pk_free(&(*session)->pkey);
  245. // mbedtls_entropy_free(&(*session)->entropy);
  246. os_free(*session);
  247. *session = NULL;
  248. }
  249. static pmbedtls_msg mbedtls_msg_new(void)
  250. {
  251. pmbedtls_msg msg = (pmbedtls_msg)os_zalloc( sizeof(mbedtls_msg));
  252. if (msg) {
  253. os_bzero(msg, sizeof(mbedtls_msg));
  254. msg->psession = mbedtls_session_new();
  255. if (msg->psession){
  256. mbedtls_net_init(&msg->listen_fd);
  257. mbedtls_net_init(&msg->fd);
  258. mbedtls_ssl_init(&msg->ssl);
  259. mbedtls_ssl_config_init(&msg->conf);
  260. mbedtls_ctr_drbg_init(&msg->ctr_drbg);
  261. mbedtls_entropy_init(&msg->entropy);
  262. } else{
  263. os_free(msg);
  264. msg = NULL;
  265. }
  266. }
  267. return msg;
  268. }
  269. static void mbedtls_msg_server_step(pmbedtls_msg msg)
  270. {
  271. lwIP_ASSERT(msg);
  272. /*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/
  273. if (msg->psession){
  274. mbedtls_session_free(&msg->psession);
  275. }
  276. #if defined(ESP8266_PLATFORM)
  277. if (msg->quiet && msg->ssl.out_buf)
  278. {
  279. mbedtls_zeroize(msg->ssl.out_buf, MBEDTLS_SSL_OUTBUFFER_LEN);
  280. os_free(msg->ssl.out_buf);
  281. msg->ssl.out_buf = NULL;
  282. }
  283. #endif
  284. mbedtls_entropy_free(&msg->entropy);
  285. mbedtls_ssl_free(&msg->ssl);
  286. mbedtls_ssl_config_free(&msg->conf);
  287. mbedtls_ctr_drbg_free(&msg->ctr_drbg);
  288. /*New connection ensure that each initial for next handshake */
  289. os_bzero(msg, sizeof(mbedtls_msg));
  290. msg->psession = mbedtls_session_new();
  291. if (msg->psession){
  292. mbedtls_net_init(&msg->fd);
  293. mbedtls_ssl_init(&msg->ssl);
  294. mbedtls_ssl_config_init(&msg->conf);
  295. mbedtls_ctr_drbg_init(&msg->ctr_drbg);
  296. mbedtls_entropy_init(&msg->entropy);
  297. }
  298. }
  299. static void mbedtls_msg_free(pmbedtls_msg *msg)
  300. {
  301. lwIP_ASSERT(msg);
  302. lwIP_ASSERT(*msg);
  303. /*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/
  304. if ((*msg)->psession){
  305. mbedtls_session_free(&((*msg)->psession));
  306. }
  307. #if defined(ESP8266_PLATFORM)
  308. if ((*msg)->quiet && (*msg)->ssl.out_buf)
  309. {
  310. mbedtls_zeroize((*msg)->ssl.out_buf, MBEDTLS_SSL_OUTBUFFER_LEN);
  311. os_free((*msg)->ssl.out_buf);
  312. (*msg)->ssl.out_buf = NULL;
  313. }
  314. #endif
  315. mbedtls_entropy_free(&(*msg)->entropy);
  316. mbedtls_ssl_free(&(*msg)->ssl);
  317. mbedtls_ssl_config_free(&(*msg)->conf);
  318. mbedtls_ctr_drbg_free(&(*msg)->ctr_drbg);
  319. os_free(*msg);
  320. *msg = NULL;
  321. }
  322. static espconn_msg* mbedtls_msg_find(int sock)
  323. {
  324. espconn_msg *plist = NULL;
  325. pmbedtls_msg msg = NULL;
  326. for (plist = plink_active; plist != NULL; plist = plist->pnext) {
  327. if(plist->pssl != NULL){
  328. msg = plist->pssl;
  329. if (msg->fd.fd == sock)
  330. return plist;
  331. }
  332. }
  333. for (plist = plink_server; plist != NULL; plist = plist->pnext){
  334. if(plist->pssl != NULL){
  335. msg = plist->pssl;
  336. if (msg->listen_fd.fd == sock)
  337. return plist;
  338. }
  339. }
  340. return NULL;
  341. }
  342. void mbedtls_handshake_heap(mbedtls_ssl_context *ssl)
  343. {
  344. os_printf("mbedtls_handshake_heap %d %d\n", ssl->state, system_get_free_heap_size());
  345. }
  346. static bool mbedtls_handshake_result(const pmbedtls_msg Threadmsg)
  347. {
  348. if (Threadmsg == NULL)
  349. return false;
  350. if (Threadmsg->ssl.state == MBEDTLS_SSL_HANDSHAKE_OVER) {
  351. int ret = 0;
  352. if (Threadmsg->listen_fd.fd == -1)
  353. ret = ssl_option.client.cert_ca_sector.flag;
  354. else
  355. ret = ssl_option.server.cert_ca_sector.flag;
  356. if (ret == 1){
  357. ret = mbedtls_ssl_get_verify_result(&Threadmsg->ssl);
  358. if (ret != 0) {
  359. char vrfy_buf[512];
  360. os_memset(vrfy_buf, 0, sizeof(vrfy_buf)-1);
  361. mbedtls_x509_crt_verify_info(vrfy_buf, sizeof(vrfy_buf), "!", ret);
  362. os_printf("%s\n", vrfy_buf);
  363. Threadmsg->verify_result = ret;
  364. return false;
  365. } else
  366. return true;
  367. } else
  368. return true;
  369. }else
  370. return false;
  371. }
  372. static void mbedtls_fail_info(espconn_msg *pinfo, int ret)
  373. {
  374. pmbedtls_msg TLSmsg = NULL;
  375. lwIP_REQUIRE_ACTION(pinfo,exit,);
  376. TLSmsg = pinfo->pssl;
  377. lwIP_REQUIRE_ACTION(TLSmsg,exit,);
  378. if (TLSmsg->quiet) {
  379. mbedtls_ssl_close_notify(&TLSmsg->ssl);
  380. }
  381. /* Don't complain to console if we've been told the other end is hanging
  382. * up. That's entirely normal and not worthy of the confusion it sows!
  383. */
  384. if (ret != MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
  385. if (TLSmsg->quiet){
  386. if (pinfo->preverse != NULL) {
  387. os_printf("server's data invalid protocol\n");
  388. } else {
  389. os_printf("client's data invalid protocol\n");
  390. }
  391. } else{
  392. if (pinfo->preverse != NULL) {
  393. os_printf("server handshake failed!\n");
  394. } else {
  395. os_printf("client handshake failed!\n");
  396. }
  397. }
  398. }
  399. os_printf("Reason:[-0x%2x]\n",-ret);
  400. /*Error code convert*/
  401. ret = -ret;
  402. if ((ret & 0xFF) != 0){
  403. ret = ((ret >> 8) + ret);
  404. } else{
  405. ret >>= 8;
  406. }
  407. pinfo->hs_status = -ret;
  408. pinfo->pespconn->state = ESPCONN_CLOSE;
  409. mbedtls_net_free(&TLSmsg->fd);
  410. exit:
  411. return;
  412. }
  413. #if defined(ESP8266_PLATFORM)
  414. int mbedtls_write_finished(mbedtls_ssl_context *ssl)
  415. {
  416. lwIP_ASSERT(ssl);
  417. lwIP_ASSERT(ssl->p_bio);
  418. int ret = ERR_OK;
  419. int fd = ((mbedtls_net_context *) ssl->p_bio)->fd;
  420. espconn_msg *Threadmsg = mbedtls_msg_find(fd);
  421. lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
  422. pmbedtls_msg TLSmsg = Threadmsg->pssl;
  423. lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
  424. TLSmsg->pfinished = mbedtls_finished_new(ssl->out_msglen + 29);
  425. lwIP_REQUIRE_ACTION(TLSmsg->pfinished, exit, ret = ERR_MEM);
  426. os_memcpy(TLSmsg->pfinished->finished_buf, ssl->out_ctr, TLSmsg->pfinished->finished_len);
  427. exit:
  428. return ret;
  429. }
  430. static int mbedtls_hanshake_finished(mbedtls_msg *msg)
  431. {
  432. lwIP_ASSERT(msg);
  433. int ret = ERR_OK;
  434. const size_t len = MBEDTLS_SSL_OUTBUFFER_LEN;
  435. mbedtls_ssl_context *ssl = &msg->ssl;
  436. lwIP_REQUIRE_ACTION(ssl, exit, ret = ERR_MEM);
  437. pmbedtls_finished finished = msg->pfinished;
  438. lwIP_REQUIRE_ACTION(finished, exit, ret = ERR_MEM);
  439. ssl->out_buf = (unsigned char*)os_zalloc(len);
  440. lwIP_REQUIRE_ACTION(ssl->out_buf, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
  441. ssl->out_ctr = ssl->out_buf;
  442. ssl->out_hdr = ssl->out_buf + 8;
  443. ssl->out_len = ssl->out_buf + 11;
  444. ssl->out_iv = ssl->out_buf + 13;
  445. ssl->out_msg = ssl->out_buf + 29;
  446. os_memcpy(ssl->out_ctr, finished->finished_buf, finished->finished_len);
  447. mbedtls_finished_free(&msg->pfinished);
  448. exit:
  449. return ret;
  450. }
  451. #endif
  452. static void mbedtls_handshake_succ(mbedtls_ssl_context *ssl)
  453. {
  454. lwIP_ASSERT(ssl);
  455. if( ssl->handshake )
  456. {
  457. mbedtls_ssl_handshake_free( ssl->handshake );
  458. mbedtls_ssl_transform_free( ssl->transform_negotiate );
  459. mbedtls_ssl_session_free( ssl->session_negotiate );
  460. os_free( ssl->handshake );
  461. os_free( ssl->transform_negotiate );
  462. os_free( ssl->session_negotiate );
  463. ssl->handshake = NULL;
  464. ssl->transform_negotiate = NULL;
  465. ssl->session_negotiate = NULL;
  466. }
  467. if( ssl->session )
  468. {
  469. mbedtls_ssl_session_free( ssl->session );
  470. os_free( ssl->session );
  471. ssl->session = NULL;
  472. }
  473. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  474. if( ssl->hostname != NULL )
  475. {
  476. mbedtls_zeroize( ssl->hostname, os_strlen( ssl->hostname ) );
  477. os_free( ssl->hostname );
  478. ssl->hostname = NULL;
  479. }
  480. #endif
  481. }
  482. /******************************************************************************
  483. * FunctionName : espconn_ssl_reconnect
  484. * Description : reconnect with host
  485. * Parameters : arg -- Additional argument to pass to the callback function
  486. * Returns : none
  487. *******************************************************************************/
  488. static void espconn_close_internal(void *arg, netconn_event event_type)
  489. {
  490. espconn_msg *pssl_recon = arg;
  491. struct espconn *espconn = NULL;
  492. sint8 ssl_reerr = 0;
  493. sint16 hs_status = 0;
  494. lwIP_ASSERT(pssl_recon);
  495. espconn = pssl_recon->preverse;
  496. ssl_reerr = pssl_recon->pcommon.err;
  497. hs_status = pssl_recon->hs_status;
  498. if (espconn != NULL) {
  499. espconn = pssl_recon->preverse;
  500. } else {
  501. espconn = pssl_recon->pespconn;
  502. os_free(pssl_recon);
  503. pssl_recon = NULL;
  504. }
  505. espconn_kill_oldest_pcb();
  506. switch (event_type){
  507. case NETCONN_EVENT_ERROR:
  508. if (hs_status == ESPCONN_OK)
  509. ESPCONN_EVENT_ERROR(espconn, ssl_reerr);
  510. else
  511. ESPCONN_EVENT_ERROR(espconn, hs_status);
  512. break;
  513. case NETCONN_EVENT_CLOSE:
  514. if (hs_status == ESPCONN_OK)
  515. ESPCONN_EVENT_CLOSED(espconn);
  516. else
  517. ESPCONN_EVENT_ERROR(espconn, hs_status);
  518. break;
  519. default:
  520. break;
  521. }
  522. }
  523. /******************************************************************************
  524. * FunctionName : espconn_ssl_read_param_from_flash
  525. * Description : load parameter from flash, toggle use two sector by flag value.
  526. * Parameters : param--the parame point which write the flash
  527. * Returns : none
  528. *******************************************************************************/
  529. static bool espconn_ssl_read_param_from_flash(void *param, uint16 len, int32 offset, mbedtls_auth_info *auth_info)
  530. {
  531. if (param == NULL || (len + offset) > ESPCONN_SECURE_MAX_SIZE) {
  532. return false;
  533. }
  534. uint32 FILE_PARAM_START_SEC = 0x3B;
  535. switch (auth_info->auth_level) {
  536. case ESPCONN_CLIENT:
  537. switch (auth_info->auth_type) {
  538. case ESPCONN_CERT_AUTH:
  539. FILE_PARAM_START_SEC = ssl_option.client.cert_ca_sector.sector;
  540. break;
  541. case ESPCONN_CERT_OWN:
  542. case ESPCONN_PK:
  543. FILE_PARAM_START_SEC = ssl_option.client.cert_req_sector.sector;
  544. break;
  545. default:
  546. return false;
  547. }
  548. break;
  549. case ESPCONN_SERVER:
  550. switch (auth_info->auth_type) {
  551. case ESPCONN_CERT_AUTH:
  552. FILE_PARAM_START_SEC = ssl_option.server.cert_ca_sector.sector;
  553. break;
  554. case ESPCONN_CERT_OWN:
  555. case ESPCONN_PK:
  556. FILE_PARAM_START_SEC = ssl_option.server.cert_req_sector.sector;
  557. break;
  558. default:
  559. return false;
  560. }
  561. break;
  562. default:
  563. return false;
  564. break;
  565. }
  566. spi_flash_read(FILE_PARAM_START_SEC * 4096 + offset, param, len);
  567. return true;
  568. }
  569. static bool mbedtls_msg_info_load(mbedtls_msg *msg, mbedtls_auth_info *auth_info)
  570. {
  571. const char* const begin = "-----BEGIN";
  572. const char* const type_name = "private_key";
  573. #define FILE_OFFSET 4
  574. int ret = 0;
  575. int32 offerset = 0;
  576. uint8* load_buf = NULL;
  577. size_t load_len = 0;
  578. file_param *pfile_param = NULL;
  579. pfile_param = (file_param *)os_zalloc( sizeof(file_param));
  580. if (pfile_param==NULL)
  581. return false;
  582. again:
  583. espconn_ssl_read_param_from_flash(&pfile_param->file_head, sizeof(file_head), offerset, auth_info);
  584. pfile_param->file_offerset = offerset;
  585. os_printf("%s %d, type[%s],length[%d]\n", __FILE__, __LINE__, pfile_param->file_head.file_name, pfile_param->file_head.file_length);
  586. if (pfile_param->file_head.file_length == 0xFFFF){
  587. os_free(pfile_param);
  588. return false;
  589. } else{
  590. /*Optional is load the private key*/
  591. if (auth_info->auth_type == ESPCONN_PK && os_memcmp(pfile_param->file_head.file_name, type_name, os_strlen(type_name)) != 0){
  592. offerset += sizeof(file_head) + pfile_param->file_head.file_length;
  593. goto again;
  594. }
  595. load_buf = (uint8_t *) os_zalloc( pfile_param->file_head.file_length + FILE_OFFSET);
  596. if (load_buf == NULL){
  597. os_free(pfile_param);
  598. return false;
  599. }
  600. offerset = sizeof(file_head) + pfile_param->file_offerset;
  601. espconn_ssl_read_param_from_flash(load_buf, pfile_param->file_head.file_length, offerset, auth_info);
  602. }
  603. load_len = pfile_param->file_head.file_length;
  604. /*
  605. * Determine buffer content. Buffer contains either one DER certificate or
  606. * one or more PEM certificates.
  607. */
  608. if ((char*)os_strstr(load_buf, begin) != NULL){
  609. load_len += 1;
  610. load_buf[load_len - 1] = '\0';
  611. }
  612. switch (auth_info->auth_type){
  613. case ESPCONN_CERT_AUTH:
  614. /*Optional is not optimal for security*/
  615. ret = mbedtls_x509_crt_parse(&msg->psession->cacert, (const uint8*) load_buf,load_len);
  616. lwIP_REQUIRE_NOERROR(ret, exit);
  617. mbedtls_ssl_conf_authmode(&msg->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
  618. mbedtls_ssl_conf_ca_chain(&msg->conf, &msg->psession->cacert, NULL);
  619. break;
  620. case ESPCONN_CERT_OWN:
  621. ret = mbedtls_x509_crt_parse(&msg->psession->clicert, (const uint8*) load_buf,load_len);
  622. break;
  623. case ESPCONN_PK:
  624. ret = mbedtls_pk_parse_key(&msg->psession->pkey, (const uint8*) load_buf,load_len, NULL, 0);
  625. lwIP_REQUIRE_NOERROR(ret, exit);
  626. ret = mbedtls_ssl_conf_own_cert(&msg->conf, &msg->psession->clicert, &msg->psession->pkey);
  627. break;
  628. }
  629. exit:
  630. os_free(load_buf);
  631. os_free(pfile_param);
  632. if (ret < 0){
  633. return false;
  634. }else{
  635. return true;
  636. }
  637. }
  638. static void
  639. mbedtls_dbg(void *p, int level, const char *file, int line, const char *str)
  640. {
  641. os_printf("TLS<%d> (heap=%d): %s:%d %s", level, system_get_free_heap_size(), file, line, str);
  642. }
  643. static bool mbedtls_msg_config(mbedtls_msg *msg)
  644. {
  645. const char *pers = NULL;
  646. uint8 auth_type = 0;
  647. bool load_flag = false;
  648. int ret = ESPCONN_OK;
  649. mbedtls_auth_info auth_info;
  650. /*end_point mode*/
  651. if (msg->listen_fd.fd == -1){
  652. pers = "client";
  653. auth_type = MBEDTLS_SSL_IS_CLIENT;
  654. } else {
  655. pers = "server";
  656. auth_type = MBEDTLS_SSL_IS_SERVER;
  657. }
  658. /*Initialize the RNG and the session data*/
  659. ret = mbedtls_ctr_drbg_seed(&msg->ctr_drbg, mbedtls_entropy_func, &msg->entropy, (const unsigned char*) pers, os_strlen(pers));
  660. lwIP_REQUIRE_NOERROR(ret, exit);
  661. if (auth_type == MBEDTLS_SSL_IS_SERVER){
  662. uint32 flash_sector = 0;
  663. /*Load the certificate*/
  664. unsigned int def_certificate_len = 0;unsigned char *def_certificate = NULL;
  665. def_certificate = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_CERT_OWN, &def_certificate_len);
  666. lwIP_REQUIRE_ACTION(def_certificate, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
  667. ret = mbedtls_x509_crt_parse(&msg->psession->clicert, (const unsigned char *)def_certificate, def_certificate_len);
  668. if (flash_sector != 0)
  669. os_free(def_certificate);
  670. lwIP_REQUIRE_NOERROR(ret, exit);
  671. /*Load the private RSA key*/
  672. unsigned int def_private_key_len = 0;unsigned char *def_private_key = NULL;
  673. def_private_key = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_PK, &def_private_key_len);
  674. lwIP_REQUIRE_ACTION(def_private_key, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
  675. ret = mbedtls_pk_parse_key(&msg->psession->pkey, (const unsigned char *)def_private_key, def_private_key_len, NULL, 0);
  676. if (flash_sector != 0)
  677. os_free(def_private_key);
  678. lwIP_REQUIRE_NOERROR(ret, exit);
  679. ret = mbedtls_ssl_conf_own_cert(&msg->conf, &msg->psession->clicert, &msg->psession->pkey);
  680. lwIP_REQUIRE_NOERROR(ret, exit);
  681. /*Load the trusted CA*/
  682. if (ssl_option.server.cert_ca_sector.flag) {
  683. auth_info.auth_level = ESPCONN_SERVER;
  684. auth_info.auth_type = ESPCONN_CERT_AUTH;
  685. load_flag = mbedtls_msg_info_load(msg, &auth_info);
  686. lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
  687. }
  688. } else{
  689. /*Load the certificate and private RSA key*/
  690. if (ssl_option.client.cert_req_sector.flag) {
  691. auth_info.auth_level = ESPCONN_CLIENT;
  692. auth_info.auth_type = ESPCONN_CERT_OWN;
  693. load_flag = mbedtls_msg_info_load(msg, &auth_info);
  694. lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
  695. auth_info.auth_type = ESPCONN_PK;
  696. load_flag = mbedtls_msg_info_load(msg, &auth_info);
  697. lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
  698. }
  699. /*Load the trusted CA*/
  700. if(ssl_option.client.cert_ca_sector.flag){
  701. auth_info.auth_level = ESPCONN_CLIENT;
  702. auth_info.auth_type = ESPCONN_CERT_AUTH;
  703. load_flag = mbedtls_msg_info_load(msg, &auth_info);
  704. lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
  705. }
  706. }
  707. /*Setup the stuff*/
  708. ret = mbedtls_ssl_config_defaults(&msg->conf, auth_type, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);
  709. lwIP_REQUIRE_NOERROR(ret, exit);
  710. /*OPTIONAL is not optimal for security, but makes interop easier in this session*/
  711. if (auth_type == MBEDTLS_SSL_IS_CLIENT && ssl_option.client.cert_ca_sector.flag == false){
  712. mbedtls_ssl_conf_authmode(&msg->conf, MBEDTLS_SSL_VERIFY_NONE);
  713. }
  714. mbedtls_ssl_conf_rng(&msg->conf, mbedtls_ctr_drbg_random, &msg->ctr_drbg);
  715. mbedtls_ssl_conf_dbg(&msg->conf, mbedtls_dbg, NULL);
  716. ret = mbedtls_ssl_setup(&msg->ssl, &msg->conf);
  717. lwIP_REQUIRE_NOERROR(ret, exit);
  718. mbedtls_ssl_set_bio(&msg->ssl, &msg->fd, mbedtls_net_send, mbedtls_net_recv, NULL);
  719. exit:
  720. if (ret != 0){
  721. return false;
  722. } else{
  723. return true;
  724. }
  725. }
  726. int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
  727. {
  728. int ret = ERR_OK;
  729. bool config_flag = false;
  730. espconn_msg *Threadmsg = NULL;
  731. pmbedtls_msg TLSmsg = NULL;
  732. Threadmsg = mbedtls_msg_find(socket);
  733. lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
  734. TLSmsg = Threadmsg->pssl;
  735. lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
  736. if (error == ERR_OK){
  737. if (TLSmsg->quiet){
  738. uint8 *TheadBuff = NULL;
  739. size_t ThreadLen = MBEDTLS_SSL_PLAIN_ADD;
  740. TheadBuff = (uint8 *)os_zalloc(ThreadLen + 1);
  741. lwIP_REQUIRE_ACTION(TheadBuff, exit, ret = ERR_MEM);
  742. do {
  743. os_memset(TheadBuff, 0, ThreadLen);
  744. ret = mbedtls_ssl_read(&TLSmsg->ssl, TheadBuff, ThreadLen);
  745. if (ret > 0){
  746. ESPCONN_EVENT_RECV(Threadmsg->pespconn, TheadBuff, ret);
  747. } else{
  748. if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == 0){
  749. ret = ESPCONN_OK;
  750. break;
  751. } else{
  752. break;
  753. }
  754. }
  755. } while(1);
  756. os_free(TheadBuff);
  757. TheadBuff = NULL;
  758. lwIP_REQUIRE_NOERROR(ret, exit);
  759. } else{
  760. if (TLSmsg->ssl.state == MBEDTLS_SSL_HELLO_REQUEST){
  761. if (Threadmsg->preverse != NULL){
  762. struct espconn *accept_conn = NULL;
  763. struct espconn *espconn = Threadmsg->preverse;
  764. struct sockaddr_in name;
  765. socklen_t name_len = sizeof(name);
  766. remot_info *pinfo = NULL;
  767. espconn_get_connection_info(espconn, &pinfo , ESPCONN_SSL);
  768. if (espconn->link_cnt == 0x01)
  769. return ERR_ISCONN;
  770. ret = mbedtls_net_accept(&TLSmsg->listen_fd, &TLSmsg->fd, NULL, 0, NULL);
  771. lwIP_REQUIRE_NOERROR(ret, exit);
  772. accept_conn = mbedtls_espconn_new();
  773. lwIP_REQUIRE_ACTION(accept_conn, exit, ret = ERR_MEM);
  774. Threadmsg->pespconn = accept_conn;
  775. /*get the remote information*/
  776. getpeername(TLSmsg->fd.fd, (struct sockaddr*)&name, &name_len);
  777. Threadmsg->pcommon.remote_port = htons(name.sin_port);
  778. os_memcpy(Threadmsg->pcommon.remote_ip, &name.sin_addr.s_addr, 4);
  779. espconn->proto.tcp->remote_port = htons(name.sin_port);
  780. os_memcpy(espconn->proto.tcp->remote_ip, &name.sin_addr.s_addr, 4);
  781. espconn_copy_partial(accept_conn, espconn);
  782. /*insert the node to the active connection list*/
  783. espconn_list_creat(&plink_active, Threadmsg);
  784. os_printf("server handshake start.\n");
  785. } else{
  786. os_printf("client handshake start.\n");
  787. }
  788. config_flag = mbedtls_msg_config(TLSmsg);
  789. if (config_flag){
  790. // mbedtls_keep_alive(TLSmsg->fd.fd, 1, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT);
  791. system_overclock();
  792. } else{
  793. ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
  794. lwIP_REQUIRE_NOERROR(ret, exit);
  795. }
  796. }
  797. system_soft_wdt_stop();
  798. while ((ret = mbedtls_ssl_handshake(&TLSmsg->ssl)) != 0) {
  799. if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
  800. ret = ESPCONN_OK;
  801. break;
  802. } else{
  803. break;
  804. }
  805. }
  806. system_soft_wdt_restart();
  807. lwIP_REQUIRE_NOERROR(ret, exit);
  808. /**/
  809. TLSmsg->quiet = mbedtls_handshake_result(TLSmsg);
  810. if (TLSmsg->quiet){
  811. if (Threadmsg->preverse != NULL) {
  812. os_printf("server handshake ok!\n");
  813. } else {
  814. os_printf("client handshake ok!\n");
  815. }
  816. // mbedtls_keep_alive(TLSmsg->fd.fd, 0, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT);
  817. mbedtls_session_free(&TLSmsg->psession);
  818. mbedtls_handshake_succ(&TLSmsg->ssl);
  819. #if defined(ESP8266_PLATFORM)
  820. mbedtls_hanshake_finished(TLSmsg);
  821. #endif
  822. system_restoreclock();
  823. TLSmsg->SentFnFlag = true;
  824. ESPCONN_EVENT_CONNECTED(Threadmsg->pespconn);
  825. } else{
  826. lwIP_REQUIRE_NOERROR_ACTION(TLSmsg->verify_result, exit, ret = TLSmsg->verify_result);
  827. }
  828. }
  829. } else if (error < 0){
  830. Threadmsg->pcommon.err = error;
  831. Threadmsg->pespconn->state = ESPCONN_CLOSE;
  832. mbedtls_net_free(&TLSmsg->fd);
  833. ets_post(lwIPThreadPrio, NETCONN_EVENT_ERROR, (uint32)Threadmsg);
  834. } else {
  835. ret = MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY;
  836. lwIP_REQUIRE_NOERROR(ret, exit);
  837. }
  838. exit:
  839. if (ret != ESPCONN_OK){
  840. mbedtls_fail_info(Threadmsg, ret);
  841. ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg);
  842. }
  843. return ret;
  844. }
  845. int __attribute__((weak)) mbedtls_parse_thread(int socket, int event, int error)
  846. {
  847. int ret = ERR_OK;
  848. espconn_msg *Threadmsg = NULL;
  849. pmbedtls_msg TLSmsg = NULL;
  850. Threadmsg = mbedtls_msg_find(socket);
  851. lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
  852. TLSmsg = Threadmsg->pssl;
  853. lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
  854. if (TLSmsg->quiet){
  855. int out_msglen = TLSmsg->ssl.out_msglen + 5;
  856. if (Threadmsg->pcommon.write_flag)
  857. TLSmsg->record.record_len += error;
  858. if (TLSmsg->record.record_len == out_msglen){
  859. TLSmsg->record.record_len = 0;
  860. Threadmsg->pcommon.write_flag = false;
  861. if (Threadmsg->pcommon.cntr != 0){
  862. espconn_ssl_sent(Threadmsg, Threadmsg->pcommon.ptrbuf, Threadmsg->pcommon.cntr);
  863. } else{
  864. TLSmsg->SentFnFlag = true;
  865. ESPCONN_EVENT_SEND(Threadmsg->pespconn);
  866. }
  867. } else{
  868. }
  869. } else{
  870. }
  871. exit:
  872. return ret;
  873. }
  874. /**
  875. * @brief Api_Thread.
  876. * @param events: contain the Api_Thread processing data
  877. * @retval None
  878. */
  879. static void
  880. mbedtls_thread(os_event_t *events)
  881. {
  882. int ret = ESP_OK;
  883. bool active_flag = false;
  884. espconn_msg *Threadmsg = NULL;
  885. espconn_msg *ListMsg = NULL;
  886. pmbedtls_msg TLSmsg = NULL;
  887. Threadmsg = (espconn_msg *)events->par;
  888. lwIP_REQUIRE_ACTION(Threadmsg,exit,ret = ERR_ARG);
  889. TLSmsg = Threadmsg->pssl;
  890. lwIP_REQUIRE_ACTION(TLSmsg,exit,ret = ERR_ARG);
  891. lwIP_REQUIRE_ACTION(Threadmsg->pespconn,exit,ret = ERR_ARG);
  892. /*find the active connection*/
  893. for (ListMsg = plink_active; ListMsg != NULL; ListMsg = ListMsg->pnext){
  894. if (Threadmsg == ListMsg){
  895. active_flag = true;
  896. break;
  897. }
  898. }
  899. if (active_flag){
  900. /*remove the node from the active connection list*/
  901. espconn_list_delete(&plink_active, Threadmsg);
  902. if (TLSmsg->listen_fd.fd != -1){
  903. mbedtls_msg_server_step(TLSmsg);
  904. espconn_copy_partial(Threadmsg->preverse, Threadmsg->pespconn);
  905. mbedtls_espconn_free(&Threadmsg->pespconn);
  906. } else{
  907. mbedtls_msg_free(&TLSmsg);
  908. Threadmsg->pssl = NULL;
  909. }
  910. switch (events->sig){
  911. case NETCONN_EVENT_ERROR:
  912. espconn_close_internal(Threadmsg, NETCONN_EVENT_ERROR);
  913. break;
  914. case NETCONN_EVENT_CLOSE:
  915. espconn_close_internal(Threadmsg, NETCONN_EVENT_CLOSE);
  916. break;
  917. default:
  918. break;
  919. }
  920. }
  921. exit:
  922. return;
  923. }
  924. static void mbedtls_threadinit(void)
  925. {
  926. ets_task(mbedtls_thread, lwIPThreadPrio, lwIPThreadQueue, lwIPThreadQueueLen);
  927. lwIPThreadFlag = true;
  928. }
  929. sint8 espconn_ssl_client(struct espconn *espconn)
  930. {
  931. int ret = ESPCONN_OK;
  932. struct ip_addr ipaddr;
  933. const char *server_name = NULL;
  934. const char *server_port = NULL;
  935. espconn_msg *pclient = NULL;
  936. pmbedtls_msg mbedTLSMsg = NULL;
  937. if (lwIPThreadFlag == false)
  938. mbedtls_threadinit();
  939. lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_ARG);
  940. pclient = (espconn_msg *)os_zalloc( sizeof(espconn_msg));
  941. lwIP_REQUIRE_ACTION(pclient, exit, ret = ESPCONN_MEM);
  942. mbedTLSMsg = mbedtls_msg_new();
  943. lwIP_REQUIRE_ACTION(mbedTLSMsg, exit, ret = ESPCONN_MEM);
  944. IP4_ADDR(&ipaddr, espconn->proto.tcp->remote_ip[0],espconn->proto.tcp->remote_ip[1],
  945. espconn->proto.tcp->remote_ip[2],espconn->proto.tcp->remote_ip[3]);
  946. server_name = ipaddr_ntoa(&ipaddr);
  947. server_port = (const char *)sys_itoa(espconn->proto.tcp->remote_port);
  948. /*start the connection*/
  949. ret = mbedtls_net_connect(&mbedTLSMsg->fd, server_name, server_port, MBEDTLS_NET_PROTO_TCP);
  950. lwIP_REQUIRE_NOERROR_ACTION(ret, exit, ret = ESPCONN_MEM);
  951. espconn->state = ESPCONN_WAIT;
  952. pclient->pespconn = espconn;
  953. pclient->pssl = mbedTLSMsg;
  954. pclient->preverse = NULL;
  955. /*insert the node to the active connection list*/
  956. espconn_list_creat(&plink_active, pclient);
  957. exit:
  958. if (ret != ESPCONN_OK){
  959. if (mbedTLSMsg != NULL)
  960. mbedtls_msg_free(&mbedTLSMsg);
  961. if (pclient != NULL)
  962. os_free(pclient);
  963. }
  964. return ret;
  965. }
  966. /******************************************************************************
  967. * FunctionName : espconn_ssl_server
  968. * Description : as
  969. * Parameters :
  970. * Returns :
  971. *******************************************************************************/
  972. sint8 espconn_ssl_server(struct espconn *espconn)
  973. {
  974. int ret = ESPCONN_OK;
  975. struct ip_addr ipaddr;
  976. const char *server_port = NULL;
  977. espconn_msg *pserver = NULL;
  978. pmbedtls_msg mbedTLSMsg = NULL;
  979. if (lwIPThreadFlag == false)
  980. mbedtls_threadinit();
  981. if (plink_server != NULL)
  982. return ESPCONN_INPROGRESS;
  983. lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_ARG);
  984. /*Creates a new server control message*/
  985. pserver = (espconn_msg *) os_zalloc( sizeof(espconn_msg));
  986. lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_MEM);
  987. mbedTLSMsg = mbedtls_msg_new();
  988. lwIP_REQUIRE_ACTION(mbedTLSMsg, exit, ret = ESPCONN_MEM);
  989. server_port = (const char *)sys_itoa(espconn->proto.tcp->local_port);
  990. /*start the connection*/
  991. ret = mbedtls_net_bind(&mbedTLSMsg->listen_fd, NULL, server_port, MBEDTLS_NET_PROTO_TCP);
  992. lwIP_REQUIRE_NOERROR_ACTION(ret, exit, ret = ESPCONN_MEM);
  993. espconn->state = ESPCONN_LISTEN;
  994. pserver->pespconn = NULL;
  995. pserver->pssl = mbedTLSMsg;
  996. pserver->preverse = espconn;
  997. pserver->count_opt = MEMP_NUM_TCP_PCB;
  998. pserver->pcommon.timeout = 0x0a;
  999. espconn->state = ESPCONN_LISTEN;
  1000. plink_server = pserver;
  1001. exit:
  1002. if (ret != ESPCONN_OK) {
  1003. if (mbedTLSMsg != NULL)
  1004. mbedtls_msg_free(&mbedTLSMsg);
  1005. if (pserver != NULL)
  1006. os_free(pserver);
  1007. }
  1008. return ret;
  1009. }
  1010. /******************************************************************************
  1011. * FunctionName : espconn_ssl_delete
  1012. * Description : delete the server: delete a listening PCB and free it
  1013. * Parameters : pdeletecon -- the espconn used to delete a server
  1014. * Returns : none
  1015. *******************************************************************************/
  1016. sint8 espconn_ssl_delete(struct espconn *pdeletecon)
  1017. {
  1018. remot_info *pinfo = NULL;
  1019. espconn_msg *pdelete_msg = NULL;
  1020. pmbedtls_msg mbedTLSMsg = NULL;
  1021. if (pdeletecon == NULL)
  1022. return ESPCONN_ARG;
  1023. espconn_get_connection_info(pdeletecon, &pinfo, ESPCONN_SSL);
  1024. /*make sure all the active connection have been disconnect*/
  1025. if (pdeletecon->link_cnt != 0)
  1026. return ESPCONN_INPROGRESS;
  1027. else {
  1028. pdelete_msg = plink_server;
  1029. if (pdelete_msg != NULL && pdelete_msg->preverse == pdeletecon) {
  1030. mbedTLSMsg = pdelete_msg->pssl;
  1031. espconn_kill_pcb(pdeletecon->proto.tcp->local_port);
  1032. mbedtls_net_free(&mbedTLSMsg->listen_fd);
  1033. mbedtls_msg_free(&mbedTLSMsg);
  1034. pdelete_msg->pssl = mbedTLSMsg;
  1035. os_free(pdelete_msg);
  1036. pdelete_msg = NULL;
  1037. plink_server = pdelete_msg;
  1038. mbedtls_parame_free(&def_private_key);
  1039. mbedtls_parame_free(&def_certificate);
  1040. return ESPCONN_OK;
  1041. } else {
  1042. return ESPCONN_ARG;
  1043. }
  1044. }
  1045. }
  1046. /******************************************************************************
  1047. * FunctionName : espconn_ssl_write
  1048. * Description : sent data for client or server
  1049. * Parameters : void *arg -- client or server to send
  1050. * uint8* psent -- Data to send
  1051. * uint16 length -- Length of data to send
  1052. * Returns : none
  1053. *******************************************************************************/
  1054. void espconn_ssl_sent(void *arg, uint8 *psent, uint16 length)
  1055. {
  1056. espconn_msg *Threadmsg = arg;
  1057. uint16 out_msglen = length;
  1058. int ret = ESPCONN_OK;
  1059. lwIP_ASSERT(Threadmsg);
  1060. lwIP_ASSERT(psent);
  1061. lwIP_ASSERT(length);
  1062. pmbedtls_msg mbedTLSMsg = Threadmsg->pssl;
  1063. lwIP_ASSERT(mbedTLSMsg);
  1064. if (length > MBEDTLS_SSL_PLAIN_ADD){
  1065. out_msglen = MBEDTLS_SSL_PLAIN_ADD;
  1066. }
  1067. Threadmsg->pcommon.write_flag = true;
  1068. ret = mbedtls_ssl_write(&mbedTLSMsg->ssl, psent, out_msglen);
  1069. if (ret > 0){
  1070. Threadmsg->pcommon.ptrbuf = psent + ret;
  1071. Threadmsg->pcommon.cntr = length - ret;
  1072. } else{
  1073. if (ret == MBEDTLS_ERR_SSL_WANT_WRITE || ret == 0) {
  1074. } else{
  1075. mbedtls_fail_info(Threadmsg, ret);
  1076. ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg);
  1077. }
  1078. }
  1079. }
  1080. /******************************************************************************
  1081. * FunctionName : espconn_ssl_disconnect
  1082. * Description : A new incoming connection has been disconnected.
  1083. * Parameters : espconn -- the espconn used to disconnect with host
  1084. * Returns : none
  1085. *******************************************************************************/
  1086. void espconn_ssl_disconnect(espconn_msg *Threadmsg)
  1087. {
  1088. lwIP_ASSERT(Threadmsg);
  1089. pmbedtls_msg mbedTLSMsg = Threadmsg->pssl;
  1090. lwIP_ASSERT(mbedTLSMsg);
  1091. mbedtls_net_free(&mbedTLSMsg->fd);
  1092. Threadmsg->pespconn->state = ESPCONN_CLOSE;
  1093. ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE, (uint32)Threadmsg);
  1094. }
  1095. /*
  1096. * Checkup routine
  1097. */
  1098. int mbedtls_x509_test(int verbose, char *ca_crt, size_t ca_crt_len, char *cli_crt, size_t cli_crt_len)
  1099. {
  1100. #if defined(MBEDTLS_SHA1_C)
  1101. int ret;
  1102. uint32_t flags;
  1103. mbedtls_x509_crt cacert;
  1104. mbedtls_x509_crt clicert;
  1105. if( verbose != 0 )
  1106. os_printf( " X.509 certificate load: " );
  1107. mbedtls_x509_crt_init( &clicert );
  1108. ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) cli_crt,
  1109. cli_crt_len );
  1110. if( ret != 0 )
  1111. {
  1112. if( verbose != 0 )
  1113. os_printf( "failed\n" );
  1114. return( ret );
  1115. }
  1116. mbedtls_x509_crt_init( &cacert );
  1117. ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) ca_crt,
  1118. ca_crt_len );
  1119. if( ret != 0 )
  1120. {
  1121. if( verbose != 0 )
  1122. os_printf( "failed\n" );
  1123. return( ret );
  1124. }
  1125. if( verbose != 0 )
  1126. os_printf( "passed\n X.509 signature verify: ");
  1127. ret = mbedtls_x509_crt_verify( &clicert, &cacert, NULL, NULL, &flags, NULL, NULL );
  1128. if( ret != 0 )
  1129. {
  1130. if( verbose != 0 )
  1131. os_printf( "failed\n" );
  1132. return( ret );
  1133. }
  1134. if( verbose != 0 )
  1135. os_printf( "passed\n\n");
  1136. mbedtls_x509_crt_free( &cacert );
  1137. mbedtls_x509_crt_free( &clicert );
  1138. return( 0 );
  1139. #else
  1140. ((void) verbose);
  1141. return( 0 );
  1142. #endif /* MBEDTLS_CERTS_C && MBEDTLS_SHA1_C */
  1143. }
  1144. #endif