12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196 |
- /*
- * ESPRSSIF MIT License
- *
- * Copyright (c) 2016 <ESPRESSIF SYSTEMS (SHANGHAI) PTE LTD>
- *
- * Permission is hereby granted for use on ESPRESSIF SYSTEMS ESP8266 only, in which case,
- * it is free of charge, to any person obtaining a copy of this software and associated
- * documentation files (the "Software"), to deal in the Software without restriction, including
- * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
- * and/or sell copies of the Software, and to permit persons to whom the Software is furnished
- * to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in all copies or
- * substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
- * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
- * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
- * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
- * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
- *
- */
- #if !defined(ESPCONN_MBEDTLS)
- #if !defined(MBEDTLS_CONFIG_FILE)
- #include "mbedtls/config.h"
- #else
- #include MBEDTLS_CONFIG_FILE
- #endif
- #include "mbedtls/ssl_internal.h"
- #include "mem.h"
- #ifdef MEMLEAK_DEBUG
- static const char mem_debug_file[] ICACHE_RODATA_ATTR = __FILE__;
- #endif
- #include "sys/socket.h"
- #include "sys/espconn_mbedtls.h"
- static os_event_t lwIPThreadQueue[lwIPThreadQueueLen];
- static bool lwIPThreadFlag = false;
- extern espconn_msg *plink_active;
- static espconn_msg *plink_server = NULL;
- static pmbedtls_parame def_certificate = NULL;
- static pmbedtls_parame def_private_key = NULL;
- /* Implementation that should never be optimized out by the compiler */
- static void mbedtls_zeroize( void *v, size_t n ) {
- volatile unsigned char *p = v;
- while( n-- ) *p++ = 0;
- }
- static pmbedtls_parame mbedtls_parame_new(size_t capacity)
- {
- pmbedtls_parame rb = (pmbedtls_parame)os_zalloc(sizeof(mbedtls_parame));
- if (rb && capacity != 0) {
- rb->parame_datalen = capacity;
- rb->parame_data = (uint8*)os_zalloc(rb->parame_datalen + 1);
- if (rb->parame_data) {
- } else {
- os_free(rb);
- rb = NULL;
- }
- }
- return rb;
- }
- static void mbedtls_parame_free(pmbedtls_parame *fp)
- {
- lwIP_ASSERT(fp);
- lwIP_ASSERT(*fp);
- os_free((*fp)->parame_data);
- os_free(*fp);
- *fp = NULL;
- }
- bool mbedtls_load_default_obj(uint32 flash_sector, int obj_type, const unsigned char *load_buf, uint16 length)
- {
- pmbedtls_parame mbedtls_write = NULL;
- uint32 mbedtls_head = 0;
- bool mbedtls_load_flag = false;
- if (flash_sector != 0) {
- spi_flash_read(flash_sector * FLASH_SECTOR_SIZE, (uint32*)&mbedtls_head, 4);
- if (mbedtls_head != ESPCONN_INVALID_TYPE) {
- mbedtls_write = mbedtls_parame_new(0);
- mbedtls_write->parame_datalen = length;
- }
- } else {
- const char* const begin = "-----BEGIN";
- int format_type = ESPCONN_FORMAT_INIT;
- /*
- * Determine data content. data contains either one DER certificate or
- * one or more PEM certificates.
- */
- if ((char*)os_strstr(load_buf, begin) != NULL) {
- format_type = ESPCONN_FORMAT_PEM;
- } else {
- format_type = ESPCONN_FORMAT_DER;
- }
- if (format_type == ESPCONN_FORMAT_PEM) {
- length += 1;
- }
- mbedtls_write = mbedtls_parame_new(length);
- if (mbedtls_write) {
- os_memcpy(mbedtls_write->parame_data, load_buf, length);
- if (format_type == ESPCONN_FORMAT_PEM)
- mbedtls_write->parame_data[length - 1] = '\0';
- }
- }
- if (mbedtls_write) {
- mbedtls_load_flag = true;
- mbedtls_write->parame_type = obj_type;
- mbedtls_write->parame_sec = flash_sector;
- if (obj_type == ESPCONN_PK) {
- def_private_key = mbedtls_write;
- } else {
- def_certificate = mbedtls_write;
- }
- }
- return mbedtls_load_flag;
- }
- static unsigned char* mbedtls_get_default_obj(uint32 *sec, uint32 type, uint32 *len)
- {
- const char* const begin = "-----BEGIN";
- unsigned char *parame_data = NULL;
- pmbedtls_parame mbedtls_obj = NULL;
- if (type == ESPCONN_PK) {
- mbedtls_obj = def_private_key;
- } else {
- mbedtls_obj = def_certificate;
- }
- if (mbedtls_obj->parame_sec != 0) {
- #define DATA_OFFSET 4
- uint32 data_len = mbedtls_obj->parame_datalen;
- parame_data = (unsigned char *)os_zalloc(data_len + DATA_OFFSET);
- if (parame_data) {
- spi_flash_read(mbedtls_obj->parame_sec * FLASH_SECTOR_SIZE, (uint32*)parame_data, data_len);
- /*
- * Determine buffer content. Buffer contains either one DER certificate or
- * one or more PEM certificates.
- */
- if ((char*)os_strstr(parame_data, begin) != NULL) {
- data_len ++;
- parame_data[data_len - 1] = '\0';
- }
- }
- *len = data_len;
- } else {
- parame_data = mbedtls_obj->parame_data;
- *len = mbedtls_obj->parame_datalen;
- }
- *sec = mbedtls_obj->parame_sec;
- return parame_data;
- }
- static int mbedtls_setsockopt(int sock_id, int level, int optname, int optval)
- {
- return setsockopt(sock_id, level, optname, (void*)&optval, sizeof(optval));
- }
- static int mbedtls_keep_alive(int sock_id, int onoff, int idle, int intvl, int cnt)
- {
- int ret = ERR_OK;
- if (onoff == 0)
- return mbedtls_setsockopt(sock_id, SOL_SOCKET, SO_KEEPALIVE, onoff);;
- ret = mbedtls_setsockopt(sock_id, SOL_SOCKET, SO_KEEPALIVE, onoff);
- lwIP_REQUIRE_NOERROR(ret, exit);
- ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPALIVE, onoff);
- lwIP_REQUIRE_NOERROR(ret, exit);
- ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPIDLE, idle);
- lwIP_REQUIRE_NOERROR(ret, exit);
- ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPINTVL, intvl);
- lwIP_REQUIRE_NOERROR(ret, exit);
- ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPCNT, cnt);
- lwIP_REQUIRE_NOERROR(ret, exit);
- exit:
- return ret;
- }
- static pmbedtls_espconn mbedtls_espconn_new(void)
- {
- pmbedtls_espconn mbedtls_conn = NULL;
- mbedtls_conn = (pmbedtls_espconn)os_zalloc(sizeof(mbedtls_espconn));
- if (mbedtls_conn) {
- mbedtls_conn->proto.tcp = (esp_tcp *)os_zalloc(sizeof(esp_tcp));
- if (mbedtls_conn->proto.tcp == NULL) {
- os_free(mbedtls_conn);
- mbedtls_conn = NULL;
- }
- }
- return mbedtls_conn;
- }
- static void mbedtls_espconn_free(pmbedtls_espconn *mbedtlsconn)
- {
- lwIP_ASSERT(mbedtlsconn);
- lwIP_ASSERT(*mbedtlsconn);
- os_free((*mbedtlsconn)->proto.tcp);
- (*mbedtlsconn)->proto.tcp = NULL;
- os_free((*mbedtlsconn));
- *mbedtlsconn = NULL;
- }
- static pmbedtls_session mbedtls_session_new(void)
- {
- pmbedtls_session session = (pmbedtls_session)os_zalloc(sizeof(mbedtls_session));
- if (session) {
- mbedtls_x509_crt_init(&session->cacert);
- mbedtls_x509_crt_init(&session->clicert);
- mbedtls_pk_init(&session->pkey);
- // mbedtls_entropy_init(&session->entropy);
- }
- return session;
- }
- static void mbedtls_session_free(pmbedtls_session *session)
- {
- lwIP_ASSERT(session);
- lwIP_ASSERT(*session);
- mbedtls_x509_crt_free(&(*session)->cacert);
- mbedtls_x509_crt_free(&(*session)->clicert);
- mbedtls_pk_free(&(*session)->pkey);
- // mbedtls_entropy_free(&(*session)->entropy);
- os_free(*session);
- *session = NULL;
- }
- static pmbedtls_msg mbedtls_msg_new(void)
- {
- pmbedtls_msg msg = (pmbedtls_msg)os_zalloc( sizeof(mbedtls_msg));
- if (msg) {
- os_bzero(msg, sizeof(mbedtls_msg));
- msg->psession = mbedtls_session_new();
- if (msg->psession) {
- mbedtls_net_init(&msg->listen_fd);
- mbedtls_net_init(&msg->fd);
- mbedtls_ssl_init(&msg->ssl);
- mbedtls_ssl_config_init(&msg->conf);
- mbedtls_ctr_drbg_init(&msg->ctr_drbg);
- mbedtls_entropy_init(&msg->entropy);
- #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && defined(SSL_MAX_FRAGMENT_LENGTH_CODE)
- mbedtls_ssl_conf_max_frag_len(&msg->conf, SSL_MAX_FRAGMENT_LENGTH_CODE);
- #endif
- } else {
- os_free(msg);
- msg = NULL;
- }
- }
- return msg;
- }
- static void mbedtls_msg_server_step(pmbedtls_msg msg)
- {
- lwIP_ASSERT(msg);
- /*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/
- if (msg->psession) {
- mbedtls_session_free(&msg->psession);
- }
- mbedtls_entropy_free(&msg->entropy);
- mbedtls_ssl_free(&msg->ssl);
- mbedtls_ssl_config_free(&msg->conf);
- mbedtls_ctr_drbg_free(&msg->ctr_drbg);
- /*New connection ensure that each initial for next handshake */
- os_bzero(msg, sizeof(mbedtls_msg));
- msg->psession = mbedtls_session_new();
- if (msg->psession) {
- mbedtls_net_init(&msg->fd);
- mbedtls_ssl_init(&msg->ssl);
- mbedtls_ssl_config_init(&msg->conf);
- mbedtls_ctr_drbg_init(&msg->ctr_drbg);
- mbedtls_entropy_init(&msg->entropy);
- }
- }
- static void mbedtls_msg_free(pmbedtls_msg *msg)
- {
- lwIP_ASSERT(msg);
- lwIP_ASSERT(*msg);
- /*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/
- if ((*msg)->psession) {
- mbedtls_session_free(&((*msg)->psession));
- }
- mbedtls_entropy_free(&(*msg)->entropy);
- mbedtls_ssl_free(&(*msg)->ssl);
- mbedtls_ssl_config_free(&(*msg)->conf);
- mbedtls_ctr_drbg_free(&(*msg)->ctr_drbg);
- os_free(*msg);
- *msg = NULL;
- }
- static espconn_msg* mbedtls_msg_find(int sock)
- {
- espconn_msg *plist = NULL;
- pmbedtls_msg msg = NULL;
- for (plist = plink_active; plist != NULL; plist = plist->pnext) {
- if(plist->pssl != NULL) {
- msg = plist->pssl;
- if (msg->fd.fd == sock)
- return plist;
- }
- }
- for (plist = plink_server; plist != NULL; plist = plist->pnext) {
- if(plist->pssl != NULL) {
- msg = plist->pssl;
- if (msg->listen_fd.fd == sock)
- return plist;
- }
- }
- return NULL;
- }
- void mbedtls_handshake_heap(mbedtls_ssl_context *ssl)
- {
- os_printf("mbedtls_handshake_heap %d %d\n", ssl->state, system_get_free_heap_size());
- }
- static bool mbedtls_handshake_result(const pmbedtls_msg Threadmsg)
- {
- if (Threadmsg == NULL)
- return false;
- if (Threadmsg->ssl.state == MBEDTLS_SSL_HANDSHAKE_OVER) {
- int ret = 0;
- if (Threadmsg->listen_fd.fd == -1)
- ret = ssl_option.client.cert_ca_sector.flag;
- else
- ret = ssl_option.server.cert_ca_sector.flag;
- if (ret == 1) {
- ret = mbedtls_ssl_get_verify_result(&Threadmsg->ssl);
- if (ret != 0) {
- char vrfy_buf[512];
- os_memset(vrfy_buf, 0, sizeof(vrfy_buf)-1);
- mbedtls_x509_crt_verify_info(vrfy_buf, sizeof(vrfy_buf), "!", ret);
- os_printf("%s\n", vrfy_buf);
- Threadmsg->verify_result = ret;
- return false;
- } else
- return true;
- } else
- return true;
- } else
- return false;
- }
- static void mbedtls_fail_info(espconn_msg *pinfo, int ret)
- {
- pmbedtls_msg TLSmsg = NULL;
- lwIP_REQUIRE_ACTION(pinfo,exit,);
- TLSmsg = pinfo->pssl;
- lwIP_REQUIRE_ACTION(TLSmsg,exit,);
- /* Don't complain to console if we've been told the other end is hanging
- * up. That's entirely normal and not worthy of the confusion it sows!
- */
- if (ret != MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
- if (TLSmsg->quiet) {
- if (pinfo->preverse != NULL) {
- os_printf("server's data invalid protocol\n");
- } else {
- os_printf("client's data invalid protocol\n");
- }
- mbedtls_ssl_close_notify(&TLSmsg->ssl);
- } else {
- if (pinfo->preverse != NULL) {
- os_printf("server handshake failed!\n");
- } else {
- os_printf("client handshake failed!\n");
- }
- }
- }
- os_printf("Reason:[-0x%2x]\n",-ret);
- /*Error code convert*/
- ret = -ret;
- if ((ret & 0xFF) != 0) {
- ret = ((ret >> 8) + ret);
- } else {
- ret >>= 8;
- }
- pinfo->hs_status = -ret;
- pinfo->pespconn->state = ESPCONN_CLOSE;
- mbedtls_net_free(&TLSmsg->fd);
- exit:
- return;
- }
- static void mbedtls_handshake_succ(mbedtls_ssl_context *ssl)
- {
- lwIP_ASSERT(ssl);
- if( ssl->handshake )
- {
- mbedtls_ssl_handshake_free( ssl );
- mbedtls_ssl_transform_free( ssl->transform_negotiate );
- mbedtls_ssl_session_free( ssl->session_negotiate );
- os_free( ssl->handshake );
- os_free( ssl->transform_negotiate );
- os_free( ssl->session_negotiate );
- ssl->handshake = NULL;
- ssl->transform_negotiate = NULL;
- ssl->session_negotiate = NULL;
- }
- if( ssl->session )
- {
- mbedtls_ssl_session_free( ssl->session );
- os_free( ssl->session );
- ssl->session = NULL;
- }
- #if defined(MBEDTLS_X509_CRT_PARSE_C)
- if( ssl->hostname != NULL )
- {
- mbedtls_zeroize( ssl->hostname, os_strlen( ssl->hostname ) );
- os_free( ssl->hostname );
- ssl->hostname = NULL;
- }
- #endif
- }
- /******************************************************************************
- * FunctionName : espconn_ssl_reconnect
- * Description : reconnect with host
- * Parameters : arg -- Additional argument to pass to the callback function
- * Returns : none
- *******************************************************************************/
- static void espconn_close_internal(void *arg, netconn_event event_type)
- {
- espconn_msg *pssl_recon = arg;
- struct espconn *espconn = NULL;
- sint8 ssl_reerr = 0;
- sint16 hs_status = 0;
- lwIP_ASSERT(pssl_recon);
- espconn = pssl_recon->preverse;
- ssl_reerr = pssl_recon->pcommon.err;
- hs_status = pssl_recon->hs_status;
- if (espconn != NULL) {
- //clear pcommon parameters.
- pssl_recon->pcommon.write_flag = false;
- pssl_recon->pcommon.ptrbuf = NULL;
- pssl_recon->pcommon.cntr = 0;
- pssl_recon->pcommon.err = 0;
- espconn = pssl_recon->preverse;
- } else {
- espconn = pssl_recon->pespconn;
- os_free(pssl_recon);
- pssl_recon = NULL;
- }
- espconn_kill_oldest_pcb();
- switch (event_type) {
- case NETCONN_EVENT_ERROR:
- if (hs_status == ESPCONN_OK)
- ESPCONN_EVENT_ERROR(espconn, ssl_reerr);
- else
- ESPCONN_EVENT_ERROR(espconn, hs_status);
- break;
- case NETCONN_EVENT_CLOSE:
- if (hs_status == ESPCONN_OK)
- ESPCONN_EVENT_CLOSED(espconn);
- else
- ESPCONN_EVENT_ERROR(espconn, hs_status);
- break;
- default:
- break;
- }
- }
- /******************************************************************************
- * FunctionName : espconn_ssl_read_param_from_flash
- * Description : load parameter from flash, toggle use two sector by flag value.
- * Parameters : param--the parame point which write the flash
- * Returns : none
- *******************************************************************************/
- static bool espconn_ssl_read_param_from_flash(void *param, uint16 len, int32 offset, mbedtls_auth_info *auth_info)
- {
- if (param == NULL || (len + offset) > ESPCONN_SECURE_MAX_SIZE) {
- return false;
- }
- uint32 FILE_PARAM_START_SEC = 0x3B;
- switch (auth_info->auth_level) {
- case ESPCONN_CLIENT:
- switch (auth_info->auth_type) {
- case ESPCONN_CERT_AUTH:
- FILE_PARAM_START_SEC = ssl_option.client.cert_ca_sector.sector;
- break;
- case ESPCONN_CERT_OWN:
- case ESPCONN_PK:
- FILE_PARAM_START_SEC = ssl_option.client.cert_req_sector.sector;
- break;
- default:
- return false;
- }
- break;
- case ESPCONN_SERVER:
- switch (auth_info->auth_type) {
- case ESPCONN_CERT_AUTH:
- FILE_PARAM_START_SEC = ssl_option.server.cert_ca_sector.sector;
- break;
- case ESPCONN_CERT_OWN:
- case ESPCONN_PK:
- FILE_PARAM_START_SEC = ssl_option.server.cert_req_sector.sector;
- break;
- default:
- return false;
- }
- break;
- default:
- return false;
- break;
- }
- spi_flash_read(FILE_PARAM_START_SEC * 4096 + offset, param, len);
- return true;
- }
- static bool mbedtls_msg_info_load(mbedtls_msg *msg, mbedtls_auth_info *auth_info)
- {
- const char* const begin = "-----BEGIN";
- const char* const type_name = "private_key";
- #define FILE_OFFSET 4
- int ret = 0;
- int32 offerset = 0;
- uint8* load_buf = NULL;
- size_t load_len = 0;
- file_param file_param;
- bzero(&file_param, sizeof(file_param));
- again:
- espconn_ssl_read_param_from_flash(&file_param.file_head, sizeof(file_head), offerset, auth_info);
- file_param.file_offerset = offerset;
- os_printf("%s %d, type[%s],length[%d]\n", __FILE__, __LINE__, file_param.file_head.file_name, file_param.file_head.file_length);
- if (file_param.file_head.file_length == 0xFFFF) {
- return false;
- } else {
- /*Optional is load the private key*/
- if (auth_info->auth_type == ESPCONN_PK && os_memcmp(&file_param.file_head.file_name, type_name, os_strlen(type_name)) != 0) {
- offerset += sizeof(file_head) + file_param.file_head.file_length;
- goto again;
- }
- /*Optional is load the cert*/
- if (auth_info->auth_type == ESPCONN_CERT_OWN && os_memcmp(file_param.file_head.file_name, "certificate", os_strlen("certificate")) != 0) {
- offerset += sizeof(file_head) + file_param.file_head.file_length;
- goto again;
- }
- load_buf = (uint8_t *) os_zalloc( file_param.file_head.file_length + FILE_OFFSET);
- if (load_buf == NULL) {
- return false;
- }
- offerset = sizeof(file_head) + file_param.file_offerset;
- espconn_ssl_read_param_from_flash(load_buf, file_param.file_head.file_length, offerset, auth_info);
- }
- load_len = file_param.file_head.file_length;
- /*
- * Determine buffer content. Buffer contains either one DER certificate or
- * one or more PEM certificates.
- */
- if ((char*)os_strstr(load_buf, begin) != NULL) {
- load_len += 1;
- load_buf[load_len - 1] = '\0';
- }
- switch (auth_info->auth_type) {
- case ESPCONN_CERT_AUTH:
- /*Optional is not optimal for security*/
- ret = mbedtls_x509_crt_parse(&msg->psession->cacert, (const uint8*) load_buf,load_len);
- lwIP_REQUIRE_NOERROR(ret, exit);
- mbedtls_ssl_conf_authmode(&msg->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
- mbedtls_ssl_conf_ca_chain(&msg->conf, &msg->psession->cacert, NULL);
- break;
- case ESPCONN_CERT_OWN:
- ret = mbedtls_x509_crt_parse(&msg->psession->clicert, (const uint8*) load_buf,load_len);
- break;
- case ESPCONN_PK:
- ret = mbedtls_pk_parse_key(&msg->psession->pkey, (const uint8*) load_buf,load_len, NULL, 0);
- lwIP_REQUIRE_NOERROR(ret, exit);
- ret = mbedtls_ssl_conf_own_cert(&msg->conf, &msg->psession->clicert, &msg->psession->pkey);
- break;
- }
- exit:
- os_free(load_buf);
- if (ret < 0) {
- return false;
- } else {
- return true;
- }
- }
- static void
- mbedtls_dbg(void *p, int level, const char *file, int line, const char *str)
- {
- os_printf("TLS<%d> (heap=%d): %s:%d %s", level, system_get_free_heap_size(), file, line, str);
- }
- static bool mbedtls_msg_config(mbedtls_msg *msg)
- {
- const char *pers = NULL;
- uint8 auth_type = 0;
- bool load_flag = false;
- int ret = ESPCONN_OK;
- mbedtls_auth_info auth_info;
- /*end_point mode*/
- if (msg->listen_fd.fd == -1) {
- pers = "client";
- auth_type = MBEDTLS_SSL_IS_CLIENT;
- } else {
- pers = "server";
- auth_type = MBEDTLS_SSL_IS_SERVER;
- }
- /*Initialize the RNG and the session data*/
- ret = mbedtls_ctr_drbg_seed(&msg->ctr_drbg, mbedtls_entropy_func, &msg->entropy, (const unsigned char*) pers, os_strlen(pers));
- lwIP_REQUIRE_NOERROR(ret, exit);
- if (auth_type == MBEDTLS_SSL_IS_SERVER) {
- uint32 flash_sector = 0;
- /*Load the certificate*/
- unsigned int def_certificate_len = 0;
- unsigned char *def_certificate = NULL;
- def_certificate = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_CERT_OWN, &def_certificate_len);
- lwIP_REQUIRE_ACTION(def_certificate, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
- ret = mbedtls_x509_crt_parse(&msg->psession->clicert, (const unsigned char *)def_certificate, def_certificate_len);
- if (flash_sector != 0)
- os_free(def_certificate);
- lwIP_REQUIRE_NOERROR(ret, exit);
- /*Load the private RSA key*/
- unsigned int def_private_key_len = 0;
- unsigned char *def_private_key = NULL;
- def_private_key = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_PK, &def_private_key_len);
- lwIP_REQUIRE_ACTION(def_private_key, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
- ret = mbedtls_pk_parse_key(&msg->psession->pkey, (const unsigned char *)def_private_key, def_private_key_len, NULL, 0);
- if (flash_sector != 0)
- os_free(def_private_key);
- lwIP_REQUIRE_NOERROR(ret, exit);
- ret = mbedtls_ssl_conf_own_cert(&msg->conf, &msg->psession->clicert, &msg->psession->pkey);
- lwIP_REQUIRE_NOERROR(ret, exit);
- /*Load the trusted CA*/
- if (ssl_option.server.cert_ca_sector.flag) {
- auth_info.auth_level = ESPCONN_SERVER;
- auth_info.auth_type = ESPCONN_CERT_AUTH;
- load_flag = mbedtls_msg_info_load(msg, &auth_info);
- lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
- }
- } else {
- /*Load the certificate and private RSA key*/
- if (ssl_option.client.cert_req_sector.flag) {
- auth_info.auth_level = ESPCONN_CLIENT;
- auth_info.auth_type = ESPCONN_CERT_OWN;
- load_flag = mbedtls_msg_info_load(msg, &auth_info);
- lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
- auth_info.auth_type = ESPCONN_PK;
- load_flag = mbedtls_msg_info_load(msg, &auth_info);
- lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
- }
- /*Load the trusted CA*/
- if(ssl_option.client.cert_ca_sector.flag) {
- auth_info.auth_level = ESPCONN_CLIENT;
- auth_info.auth_type = ESPCONN_CERT_AUTH;
- load_flag = mbedtls_msg_info_load(msg, &auth_info);
- lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
- }
- }
- /*Setup the stuff*/
- ret = mbedtls_ssl_config_defaults(&msg->conf, auth_type, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);
- lwIP_REQUIRE_NOERROR(ret, exit);
- /*OPTIONAL is not optimal for security, but makes interop easier in this session*/
- if (auth_type == MBEDTLS_SSL_IS_CLIENT && ssl_option.client.cert_ca_sector.flag == false) {
- mbedtls_ssl_conf_authmode(&msg->conf, MBEDTLS_SSL_VERIFY_NONE);
- }
- mbedtls_ssl_conf_rng(&msg->conf, mbedtls_ctr_drbg_random, &msg->ctr_drbg);
- mbedtls_ssl_conf_dbg(&msg->conf, mbedtls_dbg, NULL);
- ret = mbedtls_ssl_setup(&msg->ssl, &msg->conf);
- lwIP_REQUIRE_NOERROR(ret, exit);
- mbedtls_ssl_set_bio(&msg->ssl, &msg->fd, mbedtls_net_send, mbedtls_net_recv, NULL);
- exit:
- if (ret != 0) {
- return false;
- } else {
- return true;
- }
- }
- int espconn_mbedtls_parse_internal(int socket, sint8 error)
- {
- int ret = ERR_OK;
- bool config_flag = false;
- espconn_msg *Threadmsg = NULL;
- pmbedtls_msg TLSmsg = NULL;
- Threadmsg = mbedtls_msg_find(socket);
- lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
- TLSmsg = Threadmsg->pssl;
- lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
- if (error == ERR_OK) {
- if (TLSmsg->quiet) {
- uint8 *TheadBuff = NULL;
- size_t ThreadLen = MBEDTLS_SSL_PLAIN_ADD;
- TheadBuff = (uint8 *)os_zalloc(ThreadLen + 1);
- lwIP_REQUIRE_ACTION(TheadBuff, exit, ret = ERR_MEM);
- do {
- os_memset(TheadBuff, 0, ThreadLen);
- ret = mbedtls_ssl_read(&TLSmsg->ssl, TheadBuff, ThreadLen);
- if (ret > 0) {
- ESPCONN_EVENT_RECV(Threadmsg->pespconn, TheadBuff, ret);
- } else {
- if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == 0) {
- ret = ESPCONN_OK;
- break;
- } else if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
- ret = ESPCONN_OK;
- mbedtls_ssl_close_notify(&TLSmsg->ssl);
- } else {
- break;
- }
- }
- } while(1);
- os_free(TheadBuff);
- TheadBuff = NULL;
- lwIP_REQUIRE_NOERROR(ret, exit);
- } else {
- if (TLSmsg->ssl.state == MBEDTLS_SSL_HELLO_REQUEST) {
- if (Threadmsg->preverse != NULL) {
- struct espconn *accept_conn = NULL;
- struct espconn *espconn = Threadmsg->preverse;
- struct sockaddr_in name;
- socklen_t name_len = sizeof(name);
- remot_info *pinfo = NULL;
- espconn_get_connection_info(espconn, &pinfo, ESPCONN_SSL);
- if (espconn->link_cnt == 0x01)
- return ERR_ISCONN;
- ret = mbedtls_net_accept(&TLSmsg->listen_fd, &TLSmsg->fd, NULL, 0, NULL);
- lwIP_REQUIRE_NOERROR(ret, exit);
- accept_conn = mbedtls_espconn_new();
- lwIP_REQUIRE_ACTION(accept_conn, exit, ret = ERR_MEM);
- Threadmsg->pespconn = accept_conn;
- /*get the remote information*/
- getpeername(TLSmsg->fd.fd, (struct sockaddr*)&name, &name_len);
- Threadmsg->pcommon.remote_port = htons(name.sin_port);
- os_memcpy(Threadmsg->pcommon.remote_ip, &name.sin_addr.s_addr, 4);
- espconn->proto.tcp->remote_port = htons(name.sin_port);
- os_memcpy(espconn->proto.tcp->remote_ip, &name.sin_addr.s_addr, 4);
- espconn_copy_partial(accept_conn, espconn);
- /*insert the node to the active connection list*/
- espconn_list_creat(&plink_active, Threadmsg);
- os_printf("server handshake start.\n");
- } else {
- os_printf("client handshake start.\n");
- }
- config_flag = mbedtls_msg_config(TLSmsg);
- if (config_flag) {
- // mbedtls_keep_alive(TLSmsg->fd.fd, 1, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT);
- system_overclock();
- } else {
- ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
- lwIP_REQUIRE_NOERROR(ret, exit);
- }
- }
- system_soft_wdt_stop();
- uint8 cpu_freq;
- cpu_freq = system_get_cpu_freq();
- system_update_cpu_freq(160);
- while ((ret = mbedtls_ssl_handshake(&TLSmsg->ssl)) != 0) {
- if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
- ret = ESPCONN_OK;
- break;
- } else {
- break;
- }
- }
- system_soft_wdt_restart();
- system_update_cpu_freq(cpu_freq);
- lwIP_REQUIRE_NOERROR(ret, exit);
- /**/
- TLSmsg->quiet = mbedtls_handshake_result(TLSmsg);
- if (TLSmsg->quiet) {
- if (Threadmsg->preverse != NULL) {
- os_printf("server handshake ok!\n");
- } else {
- os_printf("client handshake ok!\n");
- }
- // mbedtls_keep_alive(TLSmsg->fd.fd, 0, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT);
- mbedtls_session_free(&TLSmsg->psession);
- mbedtls_handshake_succ(&TLSmsg->ssl);
- system_restoreclock();
- TLSmsg->SentFnFlag = true;
- ESPCONN_EVENT_CONNECTED(Threadmsg->pespconn);
- } else {
- lwIP_REQUIRE_NOERROR_ACTION(TLSmsg->verify_result, exit, ret = TLSmsg->verify_result);
- }
- }
- } else if (error < 0) {
- Threadmsg->pcommon.err = error;
- Threadmsg->pespconn->state = ESPCONN_CLOSE;
- mbedtls_net_free(&TLSmsg->fd);
- ets_post(lwIPThreadPrio, NETCONN_EVENT_ERROR, (uint32)Threadmsg);
- } else {
- ret = MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY;
- lwIP_REQUIRE_NOERROR(ret, exit);
- }
- exit:
- if (ret != ESPCONN_OK) {
- mbedtls_fail_info(Threadmsg, ret);
- if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
- Threadmsg->hs_status = ESPCONN_OK;
- }
- ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg);
- }
- return ret;
- }
- int espconn_mbedtls_parse_thread(int socket, int event, int error)
- {
- int ret = ERR_OK;
- espconn_msg *Threadmsg = NULL;
- pmbedtls_msg TLSmsg = NULL;
- Threadmsg = mbedtls_msg_find(socket);
- lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
- TLSmsg = Threadmsg->pssl;
- lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
- if (TLSmsg->quiet) {
- int out_msglen = TLSmsg->ssl.out_msglen + 5;
- if (Threadmsg->pcommon.write_flag)
- TLSmsg->record_len += error;
- if (TLSmsg->record_len == out_msglen) {
- TLSmsg->record_len = 0;
- Threadmsg->pcommon.write_flag = false;
- if (Threadmsg->pcommon.cntr != 0) {
- espconn_ssl_sent(Threadmsg, Threadmsg->pcommon.ptrbuf, Threadmsg->pcommon.cntr);
- } else {
- TLSmsg->SentFnFlag = true;
- ESPCONN_EVENT_SEND(Threadmsg->pespconn);
- }
- }
- }
- exit:
- return ret;
- }
- /**
- * @brief Api_Thread.
- * @param events: contain the Api_Thread processing data
- * @retval None
- */
- static void
- mbedtls_thread(os_event_t *events)
- {
- int ret = ESP_OK;
- bool active_flag = false;
- espconn_msg *Threadmsg = NULL;
- espconn_msg *ListMsg = NULL;
- pmbedtls_msg TLSmsg = NULL;
- Threadmsg = (espconn_msg *)events->par;
- lwIP_REQUIRE_ACTION(Threadmsg,exit,ret = ERR_ARG);
- TLSmsg = Threadmsg->pssl;
- lwIP_REQUIRE_ACTION(TLSmsg,exit,ret = ERR_ARG);
- lwIP_REQUIRE_ACTION(Threadmsg->pespconn,exit,ret = ERR_ARG);
- /*find the active connection*/
- for (ListMsg = plink_active; ListMsg != NULL; ListMsg = ListMsg->pnext) {
- if (Threadmsg == ListMsg) {
- active_flag = true;
- break;
- }
- }
- if (active_flag) {
- /*remove the node from the active connection list*/
- espconn_list_delete(&plink_active, Threadmsg);
- if (TLSmsg->listen_fd.fd != -1) {
- mbedtls_msg_server_step(TLSmsg);
- espconn_copy_partial(Threadmsg->preverse, Threadmsg->pespconn);
- mbedtls_espconn_free(&Threadmsg->pespconn);
- } else {
- mbedtls_msg_free(&TLSmsg);
- Threadmsg->pssl = NULL;
- }
- switch (events->sig) {
- case NETCONN_EVENT_ERROR:
- espconn_close_internal(Threadmsg, NETCONN_EVENT_ERROR);
- break;
- case NETCONN_EVENT_CLOSE:
- espconn_close_internal(Threadmsg, NETCONN_EVENT_CLOSE);
- break;
- default:
- break;
- }
- }
- exit:
- return;
- }
- static void mbedtls_threadinit(void)
- {
- ets_task(mbedtls_thread, lwIPThreadPrio, lwIPThreadQueue, lwIPThreadQueueLen);
- lwIPThreadFlag = true;
- }
- sint8 espconn_ssl_client(struct espconn *espconn)
- {
- int ret = ESPCONN_OK;
- struct ip_addr ipaddr;
- const char *server_name = NULL;
- const char *server_port = NULL;
- espconn_msg *pclient = NULL;
- pmbedtls_msg mbedTLSMsg = NULL;
- if (lwIPThreadFlag == false)
- mbedtls_threadinit();
- lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_ARG);
- pclient = (espconn_msg *)os_zalloc( sizeof(espconn_msg));
- lwIP_REQUIRE_ACTION(pclient, exit, ret = ESPCONN_MEM);
- mbedTLSMsg = mbedtls_msg_new();
- lwIP_REQUIRE_ACTION(mbedTLSMsg, exit, ret = ESPCONN_MEM);
- IP4_ADDR(&ipaddr, espconn->proto.tcp->remote_ip[0],espconn->proto.tcp->remote_ip[1],
- espconn->proto.tcp->remote_ip[2],espconn->proto.tcp->remote_ip[3]);
- server_name = ipaddr_ntoa(&ipaddr);
- server_port = (const char *)sys_itoa(espconn->proto.tcp->remote_port);
- /*start the connection*/
- ret = mbedtls_net_connect(&mbedTLSMsg->fd, server_name, server_port, MBEDTLS_NET_PROTO_TCP);
- lwIP_REQUIRE_NOERROR_ACTION(ret, exit, ret = ESPCONN_MEM);
- espconn->state = ESPCONN_WAIT;
- pclient->pespconn = espconn;
- pclient->pssl = mbedTLSMsg;
- pclient->preverse = NULL;
- /*insert the node to the active connection list*/
- espconn_list_creat(&plink_active, pclient);
- exit:
- if (ret != ESPCONN_OK) {
- if (mbedTLSMsg != NULL)
- mbedtls_msg_free(&mbedTLSMsg);
- if (pclient != NULL)
- os_free(pclient);
- }
- return ret;
- }
- /******************************************************************************
- * FunctionName : espconn_ssl_server
- * Description : as
- * Parameters :
- * Returns :
- *******************************************************************************/
- sint8 espconn_ssl_server(struct espconn *espconn)
- {
- int ret = ESPCONN_OK;
- struct ip_addr ipaddr;
- const char *server_port = NULL;
- espconn_msg *pserver = NULL;
- pmbedtls_msg mbedTLSMsg = NULL;
- if (lwIPThreadFlag == false)
- mbedtls_threadinit();
- if (plink_server != NULL)
- return ESPCONN_INPROGRESS;
- lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_ARG);
- /*Creates a new server control message*/
- pserver = (espconn_msg *) os_zalloc( sizeof(espconn_msg));
- lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_MEM);
- mbedTLSMsg = mbedtls_msg_new();
- lwIP_REQUIRE_ACTION(mbedTLSMsg, exit, ret = ESPCONN_MEM);
- server_port = (const char *)sys_itoa(espconn->proto.tcp->local_port);
- /*start the connection*/
- ret = mbedtls_net_bind(&mbedTLSMsg->listen_fd, NULL, server_port, MBEDTLS_NET_PROTO_TCP);
- lwIP_REQUIRE_NOERROR_ACTION(ret, exit, ret = ESPCONN_MEM);
- espconn->state = ESPCONN_LISTEN;
- pserver->pespconn = NULL;
- pserver->pssl = mbedTLSMsg;
- pserver->preverse = espconn;
- pserver->count_opt = MEMP_NUM_TCP_PCB;
- pserver->pcommon.timeout = 0x0a;
- espconn->state = ESPCONN_LISTEN;
- plink_server = pserver;
- exit:
- if (ret != ESPCONN_OK) {
- if (mbedTLSMsg != NULL)
- mbedtls_msg_free(&mbedTLSMsg);
- if (pserver != NULL)
- os_free(pserver);
- }
- return ret;
- }
- /******************************************************************************
- * FunctionName : espconn_ssl_delete
- * Description : delete the server: delete a listening PCB and free it
- * Parameters : pdeletecon -- the espconn used to delete a server
- * Returns : none
- *******************************************************************************/
- sint8 espconn_ssl_delete(struct espconn *pdeletecon)
- {
- remot_info *pinfo = NULL;
- espconn_msg *pdelete_msg = NULL;
- pmbedtls_msg mbedTLSMsg = NULL;
- if (pdeletecon == NULL)
- return ESPCONN_ARG;
- espconn_get_connection_info(pdeletecon, &pinfo, ESPCONN_SSL);
- /*make sure all the active connection have been disconnect*/
- if (pdeletecon->link_cnt != 0)
- return ESPCONN_INPROGRESS;
- else {
- pdelete_msg = plink_server;
- if (pdelete_msg != NULL && pdelete_msg->preverse == pdeletecon) {
- mbedTLSMsg = pdelete_msg->pssl;
- espconn_kill_pcb(pdeletecon->proto.tcp->local_port);
- mbedtls_net_free(&mbedTLSMsg->listen_fd);
- mbedtls_msg_free(&mbedTLSMsg);
- pdelete_msg->pssl = mbedTLSMsg;
- os_free(pdelete_msg);
- pdelete_msg = NULL;
- plink_server = pdelete_msg;
- mbedtls_parame_free(&def_private_key);
- mbedtls_parame_free(&def_certificate);
- return ESPCONN_OK;
- } else {
- return ESPCONN_ARG;
- }
- }
- }
- /******************************************************************************
- * FunctionName : espconn_ssl_write
- * Description : sent data for client or server
- * Parameters : void *arg -- client or server to send
- * uint8* psent -- Data to send
- * uint16 length -- Length of data to send
- * Returns : none
- *******************************************************************************/
- void espconn_ssl_sent(void *arg, uint8 *psent, uint16 length)
- {
- espconn_msg *Threadmsg = arg;
- uint16 out_msglen = length;
- int ret = ESPCONN_OK;
- lwIP_ASSERT(Threadmsg);
- lwIP_ASSERT(psent);
- lwIP_ASSERT(length);
- pmbedtls_msg mbedTLSMsg = Threadmsg->pssl;
- lwIP_ASSERT(mbedTLSMsg);
- if (length > MBEDTLS_SSL_PLAIN_ADD) {
- out_msglen = MBEDTLS_SSL_PLAIN_ADD;
- }
- Threadmsg->pcommon.write_flag = true;
- ret = mbedtls_ssl_write(&mbedTLSMsg->ssl, psent, out_msglen);
- if (ret > 0) {
- Threadmsg->pcommon.ptrbuf = psent + ret;
- Threadmsg->pcommon.cntr = length - ret;
- } else {
- if (ret == MBEDTLS_ERR_SSL_WANT_WRITE || ret == 0) {
- } else {
- mbedtls_fail_info(Threadmsg, ret);
- ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg);
- }
- }
- }
- /******************************************************************************
- * FunctionName : espconn_ssl_disconnect
- * Description : A new incoming connection has been disconnected.
- * Parameters : espconn -- the espconn used to disconnect with host
- * Returns : none
- *******************************************************************************/
- void espconn_ssl_disconnect(espconn_msg *Threadmsg)
- {
- lwIP_ASSERT(Threadmsg);
- pmbedtls_msg mbedTLSMsg = Threadmsg->pssl;
- lwIP_ASSERT(mbedTLSMsg);
- mbedtls_net_free(&mbedTLSMsg->fd);
- Threadmsg->pespconn->state = ESPCONN_CLOSE;
- ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE, (uint32)Threadmsg);
- }
- /*
- * Checkup routine
- */
- int mbedtls_x509_test(int verbose, char *ca_crt, size_t ca_crt_len, char *cli_crt, size_t cli_crt_len)
- {
- #if defined(MBEDTLS_SHA1_C)
- int ret;
- uint32_t flags;
- mbedtls_x509_crt cacert;
- mbedtls_x509_crt clicert;
- if( verbose != 0 )
- os_printf( " X.509 certificate load: " );
- mbedtls_x509_crt_init( &clicert );
- ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) cli_crt,
- cli_crt_len );
- if( ret != 0 )
- {
- if( verbose != 0 )
- os_printf( "failed\n" );
- return( ret );
- }
- mbedtls_x509_crt_init( &cacert );
- ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) ca_crt,
- ca_crt_len );
- if( ret != 0 )
- {
- if( verbose != 0 )
- os_printf( "failed\n" );
- return( ret );
- }
- if( verbose != 0 )
- os_printf( "passed\n X.509 signature verify: ");
- ret = mbedtls_x509_crt_verify( &clicert, &cacert, NULL, NULL, &flags, NULL, NULL );
- if( ret != 0 )
- {
- if( verbose != 0 )
- os_printf( "failed\n" );
- return( ret );
- }
- if( verbose != 0 )
- os_printf( "passed\n\n");
- mbedtls_x509_crt_free( &cacert );
- mbedtls_x509_crt_free( &clicert );
- return( 0 );
- #else
- ((void) verbose);
- return( 0 );
- #endif /* MBEDTLS_CERTS_C && MBEDTLS_SHA1_C */
- }
- #endif
|