espconn_mbedtls.c 34 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196
  1. /*
  2. * ESPRSSIF MIT License
  3. *
  4. * Copyright (c) 2016 <ESPRESSIF SYSTEMS (SHANGHAI) PTE LTD>
  5. *
  6. * Permission is hereby granted for use on ESPRESSIF SYSTEMS ESP8266 only, in which case,
  7. * it is free of charge, to any person obtaining a copy of this software and associated
  8. * documentation files (the "Software"), to deal in the Software without restriction, including
  9. * without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
  10. * and/or sell copies of the Software, and to permit persons to whom the Software is furnished
  11. * to do so, subject to the following conditions:
  12. *
  13. * The above copyright notice and this permission notice shall be included in all copies or
  14. * substantial portions of the Software.
  15. *
  16. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
  18. * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
  19. * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
  20. * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
  21. * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
  22. *
  23. */
  24. #if !defined(ESPCONN_MBEDTLS)
  25. #if !defined(MBEDTLS_CONFIG_FILE)
  26. #include "mbedtls/config.h"
  27. #else
  28. #include MBEDTLS_CONFIG_FILE
  29. #endif
  30. #include "mbedtls/ssl_internal.h"
  31. #include "mem.h"
  32. #ifdef MEMLEAK_DEBUG
  33. static const char mem_debug_file[] ICACHE_RODATA_ATTR = __FILE__;
  34. #endif
  35. #include "sys/socket.h"
  36. #include "sys/espconn_mbedtls.h"
  37. static os_event_t lwIPThreadQueue[lwIPThreadQueueLen];
  38. static bool lwIPThreadFlag = false;
  39. extern espconn_msg *plink_active;
  40. static espconn_msg *plink_server = NULL;
  41. static pmbedtls_parame def_certificate = NULL;
  42. static pmbedtls_parame def_private_key = NULL;
  43. /* Implementation that should never be optimized out by the compiler */
  44. static void mbedtls_zeroize( void *v, size_t n ) {
  45. volatile unsigned char *p = v;
  46. while( n-- ) *p++ = 0;
  47. }
  48. static pmbedtls_parame mbedtls_parame_new(size_t capacity)
  49. {
  50. pmbedtls_parame rb = (pmbedtls_parame)os_zalloc(sizeof(mbedtls_parame));
  51. if (rb && capacity != 0) {
  52. rb->parame_datalen = capacity;
  53. rb->parame_data = (uint8*)os_zalloc(rb->parame_datalen + 1);
  54. if (rb->parame_data) {
  55. } else {
  56. os_free(rb);
  57. rb = NULL;
  58. }
  59. }
  60. return rb;
  61. }
  62. static void mbedtls_parame_free(pmbedtls_parame *fp)
  63. {
  64. lwIP_ASSERT(fp);
  65. lwIP_ASSERT(*fp);
  66. os_free((*fp)->parame_data);
  67. os_free(*fp);
  68. *fp = NULL;
  69. }
  70. bool mbedtls_load_default_obj(uint32 flash_sector, int obj_type, const unsigned char *load_buf, uint16 length)
  71. {
  72. pmbedtls_parame mbedtls_write = NULL;
  73. uint32 mbedtls_head = 0;
  74. bool mbedtls_load_flag = false;
  75. if (flash_sector != 0) {
  76. spi_flash_read(flash_sector * FLASH_SECTOR_SIZE, (uint32*)&mbedtls_head, 4);
  77. if (mbedtls_head != ESPCONN_INVALID_TYPE) {
  78. mbedtls_write = mbedtls_parame_new(0);
  79. mbedtls_write->parame_datalen = length;
  80. }
  81. } else {
  82. const char* const begin = "-----BEGIN";
  83. int format_type = ESPCONN_FORMAT_INIT;
  84. /*
  85. * Determine data content. data contains either one DER certificate or
  86. * one or more PEM certificates.
  87. */
  88. if ((char*)os_strstr(load_buf, begin) != NULL) {
  89. format_type = ESPCONN_FORMAT_PEM;
  90. } else {
  91. format_type = ESPCONN_FORMAT_DER;
  92. }
  93. if (format_type == ESPCONN_FORMAT_PEM) {
  94. length += 1;
  95. }
  96. mbedtls_write = mbedtls_parame_new(length);
  97. if (mbedtls_write) {
  98. os_memcpy(mbedtls_write->parame_data, load_buf, length);
  99. if (format_type == ESPCONN_FORMAT_PEM)
  100. mbedtls_write->parame_data[length - 1] = '\0';
  101. }
  102. }
  103. if (mbedtls_write) {
  104. mbedtls_load_flag = true;
  105. mbedtls_write->parame_type = obj_type;
  106. mbedtls_write->parame_sec = flash_sector;
  107. if (obj_type == ESPCONN_PK) {
  108. def_private_key = mbedtls_write;
  109. } else {
  110. def_certificate = mbedtls_write;
  111. }
  112. }
  113. return mbedtls_load_flag;
  114. }
  115. static unsigned char* mbedtls_get_default_obj(uint32 *sec, uint32 type, uint32 *len)
  116. {
  117. const char* const begin = "-----BEGIN";
  118. unsigned char *parame_data = NULL;
  119. pmbedtls_parame mbedtls_obj = NULL;
  120. if (type == ESPCONN_PK) {
  121. mbedtls_obj = def_private_key;
  122. } else {
  123. mbedtls_obj = def_certificate;
  124. }
  125. if (mbedtls_obj->parame_sec != 0) {
  126. #define DATA_OFFSET 4
  127. uint32 data_len = mbedtls_obj->parame_datalen;
  128. parame_data = (unsigned char *)os_zalloc(data_len + DATA_OFFSET);
  129. if (parame_data) {
  130. spi_flash_read(mbedtls_obj->parame_sec * FLASH_SECTOR_SIZE, (uint32*)parame_data, data_len);
  131. /*
  132. * Determine buffer content. Buffer contains either one DER certificate or
  133. * one or more PEM certificates.
  134. */
  135. if ((char*)os_strstr(parame_data, begin) != NULL) {
  136. data_len ++;
  137. parame_data[data_len - 1] = '\0';
  138. }
  139. }
  140. *len = data_len;
  141. } else {
  142. parame_data = mbedtls_obj->parame_data;
  143. *len = mbedtls_obj->parame_datalen;
  144. }
  145. *sec = mbedtls_obj->parame_sec;
  146. return parame_data;
  147. }
  148. static int mbedtls_setsockopt(int sock_id, int level, int optname, int optval)
  149. {
  150. return setsockopt(sock_id, level, optname, (void*)&optval, sizeof(optval));
  151. }
  152. static int mbedtls_keep_alive(int sock_id, int onoff, int idle, int intvl, int cnt)
  153. {
  154. int ret = ERR_OK;
  155. if (onoff == 0)
  156. return mbedtls_setsockopt(sock_id, SOL_SOCKET, SO_KEEPALIVE, onoff);;
  157. ret = mbedtls_setsockopt(sock_id, SOL_SOCKET, SO_KEEPALIVE, onoff);
  158. lwIP_REQUIRE_NOERROR(ret, exit);
  159. ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPALIVE, onoff);
  160. lwIP_REQUIRE_NOERROR(ret, exit);
  161. ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPIDLE, idle);
  162. lwIP_REQUIRE_NOERROR(ret, exit);
  163. ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPINTVL, intvl);
  164. lwIP_REQUIRE_NOERROR(ret, exit);
  165. ret = mbedtls_setsockopt(sock_id, IPPROTO_TCP, TCP_KEEPCNT, cnt);
  166. lwIP_REQUIRE_NOERROR(ret, exit);
  167. exit:
  168. return ret;
  169. }
  170. static pmbedtls_espconn mbedtls_espconn_new(void)
  171. {
  172. pmbedtls_espconn mbedtls_conn = NULL;
  173. mbedtls_conn = (pmbedtls_espconn)os_zalloc(sizeof(mbedtls_espconn));
  174. if (mbedtls_conn) {
  175. mbedtls_conn->proto.tcp = (esp_tcp *)os_zalloc(sizeof(esp_tcp));
  176. if (mbedtls_conn->proto.tcp == NULL) {
  177. os_free(mbedtls_conn);
  178. mbedtls_conn = NULL;
  179. }
  180. }
  181. return mbedtls_conn;
  182. }
  183. static void mbedtls_espconn_free(pmbedtls_espconn *mbedtlsconn)
  184. {
  185. lwIP_ASSERT(mbedtlsconn);
  186. lwIP_ASSERT(*mbedtlsconn);
  187. os_free((*mbedtlsconn)->proto.tcp);
  188. (*mbedtlsconn)->proto.tcp = NULL;
  189. os_free((*mbedtlsconn));
  190. *mbedtlsconn = NULL;
  191. }
  192. static pmbedtls_session mbedtls_session_new(void)
  193. {
  194. pmbedtls_session session = (pmbedtls_session)os_zalloc(sizeof(mbedtls_session));
  195. if (session) {
  196. mbedtls_x509_crt_init(&session->cacert);
  197. mbedtls_x509_crt_init(&session->clicert);
  198. mbedtls_pk_init(&session->pkey);
  199. // mbedtls_entropy_init(&session->entropy);
  200. }
  201. return session;
  202. }
  203. static void mbedtls_session_free(pmbedtls_session *session)
  204. {
  205. lwIP_ASSERT(session);
  206. lwIP_ASSERT(*session);
  207. mbedtls_x509_crt_free(&(*session)->cacert);
  208. mbedtls_x509_crt_free(&(*session)->clicert);
  209. mbedtls_pk_free(&(*session)->pkey);
  210. // mbedtls_entropy_free(&(*session)->entropy);
  211. os_free(*session);
  212. *session = NULL;
  213. }
  214. static pmbedtls_msg mbedtls_msg_new(void)
  215. {
  216. pmbedtls_msg msg = (pmbedtls_msg)os_zalloc( sizeof(mbedtls_msg));
  217. if (msg) {
  218. os_bzero(msg, sizeof(mbedtls_msg));
  219. msg->psession = mbedtls_session_new();
  220. if (msg->psession) {
  221. mbedtls_net_init(&msg->listen_fd);
  222. mbedtls_net_init(&msg->fd);
  223. mbedtls_ssl_init(&msg->ssl);
  224. mbedtls_ssl_config_init(&msg->conf);
  225. mbedtls_ctr_drbg_init(&msg->ctr_drbg);
  226. mbedtls_entropy_init(&msg->entropy);
  227. #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && defined(SSL_MAX_FRAGMENT_LENGTH_CODE)
  228. mbedtls_ssl_conf_max_frag_len(&msg->conf, SSL_MAX_FRAGMENT_LENGTH_CODE);
  229. #endif
  230. } else {
  231. os_free(msg);
  232. msg = NULL;
  233. }
  234. }
  235. return msg;
  236. }
  237. static void mbedtls_msg_server_step(pmbedtls_msg msg)
  238. {
  239. lwIP_ASSERT(msg);
  240. /*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/
  241. if (msg->psession) {
  242. mbedtls_session_free(&msg->psession);
  243. }
  244. mbedtls_entropy_free(&msg->entropy);
  245. mbedtls_ssl_free(&msg->ssl);
  246. mbedtls_ssl_config_free(&msg->conf);
  247. mbedtls_ctr_drbg_free(&msg->ctr_drbg);
  248. /*New connection ensure that each initial for next handshake */
  249. os_bzero(msg, sizeof(mbedtls_msg));
  250. msg->psession = mbedtls_session_new();
  251. if (msg->psession) {
  252. mbedtls_net_init(&msg->fd);
  253. mbedtls_ssl_init(&msg->ssl);
  254. mbedtls_ssl_config_init(&msg->conf);
  255. mbedtls_ctr_drbg_init(&msg->ctr_drbg);
  256. mbedtls_entropy_init(&msg->entropy);
  257. }
  258. }
  259. static void mbedtls_msg_free(pmbedtls_msg *msg)
  260. {
  261. lwIP_ASSERT(msg);
  262. lwIP_ASSERT(*msg);
  263. /*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/
  264. if ((*msg)->psession) {
  265. mbedtls_session_free(&((*msg)->psession));
  266. }
  267. mbedtls_entropy_free(&(*msg)->entropy);
  268. mbedtls_ssl_free(&(*msg)->ssl);
  269. mbedtls_ssl_config_free(&(*msg)->conf);
  270. mbedtls_ctr_drbg_free(&(*msg)->ctr_drbg);
  271. os_free(*msg);
  272. *msg = NULL;
  273. }
  274. static espconn_msg* mbedtls_msg_find(int sock)
  275. {
  276. espconn_msg *plist = NULL;
  277. pmbedtls_msg msg = NULL;
  278. for (plist = plink_active; plist != NULL; plist = plist->pnext) {
  279. if(plist->pssl != NULL) {
  280. msg = plist->pssl;
  281. if (msg->fd.fd == sock)
  282. return plist;
  283. }
  284. }
  285. for (plist = plink_server; plist != NULL; plist = plist->pnext) {
  286. if(plist->pssl != NULL) {
  287. msg = plist->pssl;
  288. if (msg->listen_fd.fd == sock)
  289. return plist;
  290. }
  291. }
  292. return NULL;
  293. }
  294. void mbedtls_handshake_heap(mbedtls_ssl_context *ssl)
  295. {
  296. os_printf("mbedtls_handshake_heap %d %d\n", ssl->state, system_get_free_heap_size());
  297. }
  298. static bool mbedtls_handshake_result(const pmbedtls_msg Threadmsg)
  299. {
  300. if (Threadmsg == NULL)
  301. return false;
  302. if (Threadmsg->ssl.state == MBEDTLS_SSL_HANDSHAKE_OVER) {
  303. int ret = 0;
  304. if (Threadmsg->listen_fd.fd == -1)
  305. ret = ssl_option.client.cert_ca_sector.flag;
  306. else
  307. ret = ssl_option.server.cert_ca_sector.flag;
  308. if (ret == 1) {
  309. ret = mbedtls_ssl_get_verify_result(&Threadmsg->ssl);
  310. if (ret != 0) {
  311. char vrfy_buf[512];
  312. os_memset(vrfy_buf, 0, sizeof(vrfy_buf)-1);
  313. mbedtls_x509_crt_verify_info(vrfy_buf, sizeof(vrfy_buf), "!", ret);
  314. os_printf("%s\n", vrfy_buf);
  315. Threadmsg->verify_result = ret;
  316. return false;
  317. } else
  318. return true;
  319. } else
  320. return true;
  321. } else
  322. return false;
  323. }
  324. static void mbedtls_fail_info(espconn_msg *pinfo, int ret)
  325. {
  326. pmbedtls_msg TLSmsg = NULL;
  327. lwIP_REQUIRE_ACTION(pinfo,exit,);
  328. TLSmsg = pinfo->pssl;
  329. lwIP_REQUIRE_ACTION(TLSmsg,exit,);
  330. /* Don't complain to console if we've been told the other end is hanging
  331. * up. That's entirely normal and not worthy of the confusion it sows!
  332. */
  333. if (ret != MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
  334. if (TLSmsg->quiet) {
  335. if (pinfo->preverse != NULL) {
  336. os_printf("server's data invalid protocol\n");
  337. } else {
  338. os_printf("client's data invalid protocol\n");
  339. }
  340. mbedtls_ssl_close_notify(&TLSmsg->ssl);
  341. } else {
  342. if (pinfo->preverse != NULL) {
  343. os_printf("server handshake failed!\n");
  344. } else {
  345. os_printf("client handshake failed!\n");
  346. }
  347. }
  348. }
  349. os_printf("Reason:[-0x%2x]\n",-ret);
  350. /*Error code convert*/
  351. ret = -ret;
  352. if ((ret & 0xFF) != 0) {
  353. ret = ((ret >> 8) + ret);
  354. } else {
  355. ret >>= 8;
  356. }
  357. pinfo->hs_status = -ret;
  358. pinfo->pespconn->state = ESPCONN_CLOSE;
  359. mbedtls_net_free(&TLSmsg->fd);
  360. exit:
  361. return;
  362. }
  363. static void mbedtls_handshake_succ(mbedtls_ssl_context *ssl)
  364. {
  365. lwIP_ASSERT(ssl);
  366. if( ssl->handshake )
  367. {
  368. mbedtls_ssl_handshake_free( ssl );
  369. mbedtls_ssl_transform_free( ssl->transform_negotiate );
  370. mbedtls_ssl_session_free( ssl->session_negotiate );
  371. os_free( ssl->handshake );
  372. os_free( ssl->transform_negotiate );
  373. os_free( ssl->session_negotiate );
  374. ssl->handshake = NULL;
  375. ssl->transform_negotiate = NULL;
  376. ssl->session_negotiate = NULL;
  377. }
  378. if( ssl->session )
  379. {
  380. mbedtls_ssl_session_free( ssl->session );
  381. os_free( ssl->session );
  382. ssl->session = NULL;
  383. }
  384. #if defined(MBEDTLS_X509_CRT_PARSE_C)
  385. if( ssl->hostname != NULL )
  386. {
  387. mbedtls_zeroize( ssl->hostname, os_strlen( ssl->hostname ) );
  388. os_free( ssl->hostname );
  389. ssl->hostname = NULL;
  390. }
  391. #endif
  392. }
  393. /******************************************************************************
  394. * FunctionName : espconn_ssl_reconnect
  395. * Description : reconnect with host
  396. * Parameters : arg -- Additional argument to pass to the callback function
  397. * Returns : none
  398. *******************************************************************************/
  399. static void espconn_close_internal(void *arg, netconn_event event_type)
  400. {
  401. espconn_msg *pssl_recon = arg;
  402. struct espconn *espconn = NULL;
  403. sint8 ssl_reerr = 0;
  404. sint16 hs_status = 0;
  405. lwIP_ASSERT(pssl_recon);
  406. espconn = pssl_recon->preverse;
  407. ssl_reerr = pssl_recon->pcommon.err;
  408. hs_status = pssl_recon->hs_status;
  409. if (espconn != NULL) {
  410. //clear pcommon parameters.
  411. pssl_recon->pcommon.write_flag = false;
  412. pssl_recon->pcommon.ptrbuf = NULL;
  413. pssl_recon->pcommon.cntr = 0;
  414. pssl_recon->pcommon.err = 0;
  415. espconn = pssl_recon->preverse;
  416. } else {
  417. espconn = pssl_recon->pespconn;
  418. os_free(pssl_recon);
  419. pssl_recon = NULL;
  420. }
  421. espconn_kill_oldest_pcb();
  422. switch (event_type) {
  423. case NETCONN_EVENT_ERROR:
  424. if (hs_status == ESPCONN_OK)
  425. ESPCONN_EVENT_ERROR(espconn, ssl_reerr);
  426. else
  427. ESPCONN_EVENT_ERROR(espconn, hs_status);
  428. break;
  429. case NETCONN_EVENT_CLOSE:
  430. if (hs_status == ESPCONN_OK)
  431. ESPCONN_EVENT_CLOSED(espconn);
  432. else
  433. ESPCONN_EVENT_ERROR(espconn, hs_status);
  434. break;
  435. default:
  436. break;
  437. }
  438. }
  439. /******************************************************************************
  440. * FunctionName : espconn_ssl_read_param_from_flash
  441. * Description : load parameter from flash, toggle use two sector by flag value.
  442. * Parameters : param--the parame point which write the flash
  443. * Returns : none
  444. *******************************************************************************/
  445. static bool espconn_ssl_read_param_from_flash(void *param, uint16 len, int32 offset, mbedtls_auth_info *auth_info)
  446. {
  447. if (param == NULL || (len + offset) > ESPCONN_SECURE_MAX_SIZE) {
  448. return false;
  449. }
  450. uint32 FILE_PARAM_START_SEC = 0x3B;
  451. switch (auth_info->auth_level) {
  452. case ESPCONN_CLIENT:
  453. switch (auth_info->auth_type) {
  454. case ESPCONN_CERT_AUTH:
  455. FILE_PARAM_START_SEC = ssl_option.client.cert_ca_sector.sector;
  456. break;
  457. case ESPCONN_CERT_OWN:
  458. case ESPCONN_PK:
  459. FILE_PARAM_START_SEC = ssl_option.client.cert_req_sector.sector;
  460. break;
  461. default:
  462. return false;
  463. }
  464. break;
  465. case ESPCONN_SERVER:
  466. switch (auth_info->auth_type) {
  467. case ESPCONN_CERT_AUTH:
  468. FILE_PARAM_START_SEC = ssl_option.server.cert_ca_sector.sector;
  469. break;
  470. case ESPCONN_CERT_OWN:
  471. case ESPCONN_PK:
  472. FILE_PARAM_START_SEC = ssl_option.server.cert_req_sector.sector;
  473. break;
  474. default:
  475. return false;
  476. }
  477. break;
  478. default:
  479. return false;
  480. break;
  481. }
  482. spi_flash_read(FILE_PARAM_START_SEC * 4096 + offset, param, len);
  483. return true;
  484. }
  485. static bool mbedtls_msg_info_load(mbedtls_msg *msg, mbedtls_auth_info *auth_info)
  486. {
  487. const char* const begin = "-----BEGIN";
  488. const char* const type_name = "private_key";
  489. #define FILE_OFFSET 4
  490. int ret = 0;
  491. int32 offerset = 0;
  492. uint8* load_buf = NULL;
  493. size_t load_len = 0;
  494. file_param file_param;
  495. bzero(&file_param, sizeof(file_param));
  496. again:
  497. espconn_ssl_read_param_from_flash(&file_param.file_head, sizeof(file_head), offerset, auth_info);
  498. file_param.file_offerset = offerset;
  499. os_printf("%s %d, type[%s],length[%d]\n", __FILE__, __LINE__, file_param.file_head.file_name, file_param.file_head.file_length);
  500. if (file_param.file_head.file_length == 0xFFFF) {
  501. return false;
  502. } else {
  503. /*Optional is load the private key*/
  504. if (auth_info->auth_type == ESPCONN_PK && os_memcmp(&file_param.file_head.file_name, type_name, os_strlen(type_name)) != 0) {
  505. offerset += sizeof(file_head) + file_param.file_head.file_length;
  506. goto again;
  507. }
  508. /*Optional is load the cert*/
  509. if (auth_info->auth_type == ESPCONN_CERT_OWN && os_memcmp(file_param.file_head.file_name, "certificate", os_strlen("certificate")) != 0) {
  510. offerset += sizeof(file_head) + file_param.file_head.file_length;
  511. goto again;
  512. }
  513. load_buf = (uint8_t *) os_zalloc( file_param.file_head.file_length + FILE_OFFSET);
  514. if (load_buf == NULL) {
  515. return false;
  516. }
  517. offerset = sizeof(file_head) + file_param.file_offerset;
  518. espconn_ssl_read_param_from_flash(load_buf, file_param.file_head.file_length, offerset, auth_info);
  519. }
  520. load_len = file_param.file_head.file_length;
  521. /*
  522. * Determine buffer content. Buffer contains either one DER certificate or
  523. * one or more PEM certificates.
  524. */
  525. if ((char*)os_strstr(load_buf, begin) != NULL) {
  526. load_len += 1;
  527. load_buf[load_len - 1] = '\0';
  528. }
  529. switch (auth_info->auth_type) {
  530. case ESPCONN_CERT_AUTH:
  531. /*Optional is not optimal for security*/
  532. ret = mbedtls_x509_crt_parse(&msg->psession->cacert, (const uint8*) load_buf,load_len);
  533. lwIP_REQUIRE_NOERROR(ret, exit);
  534. mbedtls_ssl_conf_authmode(&msg->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
  535. mbedtls_ssl_conf_ca_chain(&msg->conf, &msg->psession->cacert, NULL);
  536. break;
  537. case ESPCONN_CERT_OWN:
  538. ret = mbedtls_x509_crt_parse(&msg->psession->clicert, (const uint8*) load_buf,load_len);
  539. break;
  540. case ESPCONN_PK:
  541. ret = mbedtls_pk_parse_key(&msg->psession->pkey, (const uint8*) load_buf,load_len, NULL, 0);
  542. lwIP_REQUIRE_NOERROR(ret, exit);
  543. ret = mbedtls_ssl_conf_own_cert(&msg->conf, &msg->psession->clicert, &msg->psession->pkey);
  544. break;
  545. }
  546. exit:
  547. os_free(load_buf);
  548. if (ret < 0) {
  549. return false;
  550. } else {
  551. return true;
  552. }
  553. }
  554. static void
  555. mbedtls_dbg(void *p, int level, const char *file, int line, const char *str)
  556. {
  557. os_printf("TLS<%d> (heap=%d): %s:%d %s", level, system_get_free_heap_size(), file, line, str);
  558. }
  559. static bool mbedtls_msg_config(mbedtls_msg *msg)
  560. {
  561. const char *pers = NULL;
  562. uint8 auth_type = 0;
  563. bool load_flag = false;
  564. int ret = ESPCONN_OK;
  565. mbedtls_auth_info auth_info;
  566. /*end_point mode*/
  567. if (msg->listen_fd.fd == -1) {
  568. pers = "client";
  569. auth_type = MBEDTLS_SSL_IS_CLIENT;
  570. } else {
  571. pers = "server";
  572. auth_type = MBEDTLS_SSL_IS_SERVER;
  573. }
  574. /*Initialize the RNG and the session data*/
  575. ret = mbedtls_ctr_drbg_seed(&msg->ctr_drbg, mbedtls_entropy_func, &msg->entropy, (const unsigned char*) pers, os_strlen(pers));
  576. lwIP_REQUIRE_NOERROR(ret, exit);
  577. if (auth_type == MBEDTLS_SSL_IS_SERVER) {
  578. uint32 flash_sector = 0;
  579. /*Load the certificate*/
  580. unsigned int def_certificate_len = 0;
  581. unsigned char *def_certificate = NULL;
  582. def_certificate = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_CERT_OWN, &def_certificate_len);
  583. lwIP_REQUIRE_ACTION(def_certificate, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
  584. ret = mbedtls_x509_crt_parse(&msg->psession->clicert, (const unsigned char *)def_certificate, def_certificate_len);
  585. if (flash_sector != 0)
  586. os_free(def_certificate);
  587. lwIP_REQUIRE_NOERROR(ret, exit);
  588. /*Load the private RSA key*/
  589. unsigned int def_private_key_len = 0;
  590. unsigned char *def_private_key = NULL;
  591. def_private_key = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_PK, &def_private_key_len);
  592. lwIP_REQUIRE_ACTION(def_private_key, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
  593. ret = mbedtls_pk_parse_key(&msg->psession->pkey, (const unsigned char *)def_private_key, def_private_key_len, NULL, 0);
  594. if (flash_sector != 0)
  595. os_free(def_private_key);
  596. lwIP_REQUIRE_NOERROR(ret, exit);
  597. ret = mbedtls_ssl_conf_own_cert(&msg->conf, &msg->psession->clicert, &msg->psession->pkey);
  598. lwIP_REQUIRE_NOERROR(ret, exit);
  599. /*Load the trusted CA*/
  600. if (ssl_option.server.cert_ca_sector.flag) {
  601. auth_info.auth_level = ESPCONN_SERVER;
  602. auth_info.auth_type = ESPCONN_CERT_AUTH;
  603. load_flag = mbedtls_msg_info_load(msg, &auth_info);
  604. lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
  605. }
  606. } else {
  607. /*Load the certificate and private RSA key*/
  608. if (ssl_option.client.cert_req_sector.flag) {
  609. auth_info.auth_level = ESPCONN_CLIENT;
  610. auth_info.auth_type = ESPCONN_CERT_OWN;
  611. load_flag = mbedtls_msg_info_load(msg, &auth_info);
  612. lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
  613. auth_info.auth_type = ESPCONN_PK;
  614. load_flag = mbedtls_msg_info_load(msg, &auth_info);
  615. lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
  616. }
  617. /*Load the trusted CA*/
  618. if(ssl_option.client.cert_ca_sector.flag) {
  619. auth_info.auth_level = ESPCONN_CLIENT;
  620. auth_info.auth_type = ESPCONN_CERT_AUTH;
  621. load_flag = mbedtls_msg_info_load(msg, &auth_info);
  622. lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
  623. }
  624. }
  625. /*Setup the stuff*/
  626. ret = mbedtls_ssl_config_defaults(&msg->conf, auth_type, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT);
  627. lwIP_REQUIRE_NOERROR(ret, exit);
  628. /*OPTIONAL is not optimal for security, but makes interop easier in this session*/
  629. if (auth_type == MBEDTLS_SSL_IS_CLIENT && ssl_option.client.cert_ca_sector.flag == false) {
  630. mbedtls_ssl_conf_authmode(&msg->conf, MBEDTLS_SSL_VERIFY_NONE);
  631. }
  632. mbedtls_ssl_conf_rng(&msg->conf, mbedtls_ctr_drbg_random, &msg->ctr_drbg);
  633. mbedtls_ssl_conf_dbg(&msg->conf, mbedtls_dbg, NULL);
  634. ret = mbedtls_ssl_setup(&msg->ssl, &msg->conf);
  635. lwIP_REQUIRE_NOERROR(ret, exit);
  636. mbedtls_ssl_set_bio(&msg->ssl, &msg->fd, mbedtls_net_send, mbedtls_net_recv, NULL);
  637. exit:
  638. if (ret != 0) {
  639. return false;
  640. } else {
  641. return true;
  642. }
  643. }
  644. int espconn_mbedtls_parse_internal(int socket, sint8 error)
  645. {
  646. int ret = ERR_OK;
  647. bool config_flag = false;
  648. espconn_msg *Threadmsg = NULL;
  649. pmbedtls_msg TLSmsg = NULL;
  650. Threadmsg = mbedtls_msg_find(socket);
  651. lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
  652. TLSmsg = Threadmsg->pssl;
  653. lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
  654. if (error == ERR_OK) {
  655. if (TLSmsg->quiet) {
  656. uint8 *TheadBuff = NULL;
  657. size_t ThreadLen = MBEDTLS_SSL_PLAIN_ADD;
  658. TheadBuff = (uint8 *)os_zalloc(ThreadLen + 1);
  659. lwIP_REQUIRE_ACTION(TheadBuff, exit, ret = ERR_MEM);
  660. do {
  661. os_memset(TheadBuff, 0, ThreadLen);
  662. ret = mbedtls_ssl_read(&TLSmsg->ssl, TheadBuff, ThreadLen);
  663. if (ret > 0) {
  664. ESPCONN_EVENT_RECV(Threadmsg->pespconn, TheadBuff, ret);
  665. } else {
  666. if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == 0) {
  667. ret = ESPCONN_OK;
  668. break;
  669. } else if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
  670. ret = ESPCONN_OK;
  671. mbedtls_ssl_close_notify(&TLSmsg->ssl);
  672. } else {
  673. break;
  674. }
  675. }
  676. } while(1);
  677. os_free(TheadBuff);
  678. TheadBuff = NULL;
  679. lwIP_REQUIRE_NOERROR(ret, exit);
  680. } else {
  681. if (TLSmsg->ssl.state == MBEDTLS_SSL_HELLO_REQUEST) {
  682. if (Threadmsg->preverse != NULL) {
  683. struct espconn *accept_conn = NULL;
  684. struct espconn *espconn = Threadmsg->preverse;
  685. struct sockaddr_in name;
  686. socklen_t name_len = sizeof(name);
  687. remot_info *pinfo = NULL;
  688. espconn_get_connection_info(espconn, &pinfo, ESPCONN_SSL);
  689. if (espconn->link_cnt == 0x01)
  690. return ERR_ISCONN;
  691. ret = mbedtls_net_accept(&TLSmsg->listen_fd, &TLSmsg->fd, NULL, 0, NULL);
  692. lwIP_REQUIRE_NOERROR(ret, exit);
  693. accept_conn = mbedtls_espconn_new();
  694. lwIP_REQUIRE_ACTION(accept_conn, exit, ret = ERR_MEM);
  695. Threadmsg->pespconn = accept_conn;
  696. /*get the remote information*/
  697. getpeername(TLSmsg->fd.fd, (struct sockaddr*)&name, &name_len);
  698. Threadmsg->pcommon.remote_port = htons(name.sin_port);
  699. os_memcpy(Threadmsg->pcommon.remote_ip, &name.sin_addr.s_addr, 4);
  700. espconn->proto.tcp->remote_port = htons(name.sin_port);
  701. os_memcpy(espconn->proto.tcp->remote_ip, &name.sin_addr.s_addr, 4);
  702. espconn_copy_partial(accept_conn, espconn);
  703. /*insert the node to the active connection list*/
  704. espconn_list_creat(&plink_active, Threadmsg);
  705. os_printf("server handshake start.\n");
  706. } else {
  707. os_printf("client handshake start.\n");
  708. }
  709. config_flag = mbedtls_msg_config(TLSmsg);
  710. if (config_flag) {
  711. // mbedtls_keep_alive(TLSmsg->fd.fd, 1, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT);
  712. system_overclock();
  713. } else {
  714. ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
  715. lwIP_REQUIRE_NOERROR(ret, exit);
  716. }
  717. }
  718. system_soft_wdt_stop();
  719. uint8 cpu_freq;
  720. cpu_freq = system_get_cpu_freq();
  721. system_update_cpu_freq(160);
  722. while ((ret = mbedtls_ssl_handshake(&TLSmsg->ssl)) != 0) {
  723. if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
  724. ret = ESPCONN_OK;
  725. break;
  726. } else {
  727. break;
  728. }
  729. }
  730. system_soft_wdt_restart();
  731. system_update_cpu_freq(cpu_freq);
  732. lwIP_REQUIRE_NOERROR(ret, exit);
  733. /**/
  734. TLSmsg->quiet = mbedtls_handshake_result(TLSmsg);
  735. if (TLSmsg->quiet) {
  736. if (Threadmsg->preverse != NULL) {
  737. os_printf("server handshake ok!\n");
  738. } else {
  739. os_printf("client handshake ok!\n");
  740. }
  741. // mbedtls_keep_alive(TLSmsg->fd.fd, 0, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT);
  742. mbedtls_session_free(&TLSmsg->psession);
  743. mbedtls_handshake_succ(&TLSmsg->ssl);
  744. system_restoreclock();
  745. TLSmsg->SentFnFlag = true;
  746. ESPCONN_EVENT_CONNECTED(Threadmsg->pespconn);
  747. } else {
  748. lwIP_REQUIRE_NOERROR_ACTION(TLSmsg->verify_result, exit, ret = TLSmsg->verify_result);
  749. }
  750. }
  751. } else if (error < 0) {
  752. Threadmsg->pcommon.err = error;
  753. Threadmsg->pespconn->state = ESPCONN_CLOSE;
  754. mbedtls_net_free(&TLSmsg->fd);
  755. ets_post(lwIPThreadPrio, NETCONN_EVENT_ERROR, (uint32)Threadmsg);
  756. } else {
  757. ret = MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY;
  758. lwIP_REQUIRE_NOERROR(ret, exit);
  759. }
  760. exit:
  761. if (ret != ESPCONN_OK) {
  762. mbedtls_fail_info(Threadmsg, ret);
  763. if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
  764. Threadmsg->hs_status = ESPCONN_OK;
  765. }
  766. ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg);
  767. }
  768. return ret;
  769. }
  770. int espconn_mbedtls_parse_thread(int socket, int event, int error)
  771. {
  772. int ret = ERR_OK;
  773. espconn_msg *Threadmsg = NULL;
  774. pmbedtls_msg TLSmsg = NULL;
  775. Threadmsg = mbedtls_msg_find(socket);
  776. lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
  777. TLSmsg = Threadmsg->pssl;
  778. lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
  779. if (TLSmsg->quiet) {
  780. int out_msglen = TLSmsg->ssl.out_msglen + 5;
  781. if (Threadmsg->pcommon.write_flag)
  782. TLSmsg->record_len += error;
  783. if (TLSmsg->record_len == out_msglen) {
  784. TLSmsg->record_len = 0;
  785. Threadmsg->pcommon.write_flag = false;
  786. if (Threadmsg->pcommon.cntr != 0) {
  787. espconn_ssl_sent(Threadmsg, Threadmsg->pcommon.ptrbuf, Threadmsg->pcommon.cntr);
  788. } else {
  789. TLSmsg->SentFnFlag = true;
  790. ESPCONN_EVENT_SEND(Threadmsg->pespconn);
  791. }
  792. }
  793. }
  794. exit:
  795. return ret;
  796. }
  797. /**
  798. * @brief Api_Thread.
  799. * @param events: contain the Api_Thread processing data
  800. * @retval None
  801. */
  802. static void
  803. mbedtls_thread(os_event_t *events)
  804. {
  805. int ret = ESP_OK;
  806. bool active_flag = false;
  807. espconn_msg *Threadmsg = NULL;
  808. espconn_msg *ListMsg = NULL;
  809. pmbedtls_msg TLSmsg = NULL;
  810. Threadmsg = (espconn_msg *)events->par;
  811. lwIP_REQUIRE_ACTION(Threadmsg,exit,ret = ERR_ARG);
  812. TLSmsg = Threadmsg->pssl;
  813. lwIP_REQUIRE_ACTION(TLSmsg,exit,ret = ERR_ARG);
  814. lwIP_REQUIRE_ACTION(Threadmsg->pespconn,exit,ret = ERR_ARG);
  815. /*find the active connection*/
  816. for (ListMsg = plink_active; ListMsg != NULL; ListMsg = ListMsg->pnext) {
  817. if (Threadmsg == ListMsg) {
  818. active_flag = true;
  819. break;
  820. }
  821. }
  822. if (active_flag) {
  823. /*remove the node from the active connection list*/
  824. espconn_list_delete(&plink_active, Threadmsg);
  825. if (TLSmsg->listen_fd.fd != -1) {
  826. mbedtls_msg_server_step(TLSmsg);
  827. espconn_copy_partial(Threadmsg->preverse, Threadmsg->pespconn);
  828. mbedtls_espconn_free(&Threadmsg->pespconn);
  829. } else {
  830. mbedtls_msg_free(&TLSmsg);
  831. Threadmsg->pssl = NULL;
  832. }
  833. switch (events->sig) {
  834. case NETCONN_EVENT_ERROR:
  835. espconn_close_internal(Threadmsg, NETCONN_EVENT_ERROR);
  836. break;
  837. case NETCONN_EVENT_CLOSE:
  838. espconn_close_internal(Threadmsg, NETCONN_EVENT_CLOSE);
  839. break;
  840. default:
  841. break;
  842. }
  843. }
  844. exit:
  845. return;
  846. }
  847. static void mbedtls_threadinit(void)
  848. {
  849. ets_task(mbedtls_thread, lwIPThreadPrio, lwIPThreadQueue, lwIPThreadQueueLen);
  850. lwIPThreadFlag = true;
  851. }
  852. sint8 espconn_ssl_client(struct espconn *espconn)
  853. {
  854. int ret = ESPCONN_OK;
  855. struct ip_addr ipaddr;
  856. const char *server_name = NULL;
  857. const char *server_port = NULL;
  858. espconn_msg *pclient = NULL;
  859. pmbedtls_msg mbedTLSMsg = NULL;
  860. if (lwIPThreadFlag == false)
  861. mbedtls_threadinit();
  862. lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_ARG);
  863. pclient = (espconn_msg *)os_zalloc( sizeof(espconn_msg));
  864. lwIP_REQUIRE_ACTION(pclient, exit, ret = ESPCONN_MEM);
  865. mbedTLSMsg = mbedtls_msg_new();
  866. lwIP_REQUIRE_ACTION(mbedTLSMsg, exit, ret = ESPCONN_MEM);
  867. IP4_ADDR(&ipaddr, espconn->proto.tcp->remote_ip[0],espconn->proto.tcp->remote_ip[1],
  868. espconn->proto.tcp->remote_ip[2],espconn->proto.tcp->remote_ip[3]);
  869. server_name = ipaddr_ntoa(&ipaddr);
  870. server_port = (const char *)sys_itoa(espconn->proto.tcp->remote_port);
  871. /*start the connection*/
  872. ret = mbedtls_net_connect(&mbedTLSMsg->fd, server_name, server_port, MBEDTLS_NET_PROTO_TCP);
  873. lwIP_REQUIRE_NOERROR_ACTION(ret, exit, ret = ESPCONN_MEM);
  874. espconn->state = ESPCONN_WAIT;
  875. pclient->pespconn = espconn;
  876. pclient->pssl = mbedTLSMsg;
  877. pclient->preverse = NULL;
  878. /*insert the node to the active connection list*/
  879. espconn_list_creat(&plink_active, pclient);
  880. exit:
  881. if (ret != ESPCONN_OK) {
  882. if (mbedTLSMsg != NULL)
  883. mbedtls_msg_free(&mbedTLSMsg);
  884. if (pclient != NULL)
  885. os_free(pclient);
  886. }
  887. return ret;
  888. }
  889. /******************************************************************************
  890. * FunctionName : espconn_ssl_server
  891. * Description : as
  892. * Parameters :
  893. * Returns :
  894. *******************************************************************************/
  895. sint8 espconn_ssl_server(struct espconn *espconn)
  896. {
  897. int ret = ESPCONN_OK;
  898. struct ip_addr ipaddr;
  899. const char *server_port = NULL;
  900. espconn_msg *pserver = NULL;
  901. pmbedtls_msg mbedTLSMsg = NULL;
  902. if (lwIPThreadFlag == false)
  903. mbedtls_threadinit();
  904. if (plink_server != NULL)
  905. return ESPCONN_INPROGRESS;
  906. lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_ARG);
  907. /*Creates a new server control message*/
  908. pserver = (espconn_msg *) os_zalloc( sizeof(espconn_msg));
  909. lwIP_REQUIRE_ACTION(espconn, exit, ret = ESPCONN_MEM);
  910. mbedTLSMsg = mbedtls_msg_new();
  911. lwIP_REQUIRE_ACTION(mbedTLSMsg, exit, ret = ESPCONN_MEM);
  912. server_port = (const char *)sys_itoa(espconn->proto.tcp->local_port);
  913. /*start the connection*/
  914. ret = mbedtls_net_bind(&mbedTLSMsg->listen_fd, NULL, server_port, MBEDTLS_NET_PROTO_TCP);
  915. lwIP_REQUIRE_NOERROR_ACTION(ret, exit, ret = ESPCONN_MEM);
  916. espconn->state = ESPCONN_LISTEN;
  917. pserver->pespconn = NULL;
  918. pserver->pssl = mbedTLSMsg;
  919. pserver->preverse = espconn;
  920. pserver->count_opt = MEMP_NUM_TCP_PCB;
  921. pserver->pcommon.timeout = 0x0a;
  922. espconn->state = ESPCONN_LISTEN;
  923. plink_server = pserver;
  924. exit:
  925. if (ret != ESPCONN_OK) {
  926. if (mbedTLSMsg != NULL)
  927. mbedtls_msg_free(&mbedTLSMsg);
  928. if (pserver != NULL)
  929. os_free(pserver);
  930. }
  931. return ret;
  932. }
  933. /******************************************************************************
  934. * FunctionName : espconn_ssl_delete
  935. * Description : delete the server: delete a listening PCB and free it
  936. * Parameters : pdeletecon -- the espconn used to delete a server
  937. * Returns : none
  938. *******************************************************************************/
  939. sint8 espconn_ssl_delete(struct espconn *pdeletecon)
  940. {
  941. remot_info *pinfo = NULL;
  942. espconn_msg *pdelete_msg = NULL;
  943. pmbedtls_msg mbedTLSMsg = NULL;
  944. if (pdeletecon == NULL)
  945. return ESPCONN_ARG;
  946. espconn_get_connection_info(pdeletecon, &pinfo, ESPCONN_SSL);
  947. /*make sure all the active connection have been disconnect*/
  948. if (pdeletecon->link_cnt != 0)
  949. return ESPCONN_INPROGRESS;
  950. else {
  951. pdelete_msg = plink_server;
  952. if (pdelete_msg != NULL && pdelete_msg->preverse == pdeletecon) {
  953. mbedTLSMsg = pdelete_msg->pssl;
  954. espconn_kill_pcb(pdeletecon->proto.tcp->local_port);
  955. mbedtls_net_free(&mbedTLSMsg->listen_fd);
  956. mbedtls_msg_free(&mbedTLSMsg);
  957. pdelete_msg->pssl = mbedTLSMsg;
  958. os_free(pdelete_msg);
  959. pdelete_msg = NULL;
  960. plink_server = pdelete_msg;
  961. mbedtls_parame_free(&def_private_key);
  962. mbedtls_parame_free(&def_certificate);
  963. return ESPCONN_OK;
  964. } else {
  965. return ESPCONN_ARG;
  966. }
  967. }
  968. }
  969. /******************************************************************************
  970. * FunctionName : espconn_ssl_write
  971. * Description : sent data for client or server
  972. * Parameters : void *arg -- client or server to send
  973. * uint8* psent -- Data to send
  974. * uint16 length -- Length of data to send
  975. * Returns : none
  976. *******************************************************************************/
  977. void espconn_ssl_sent(void *arg, uint8 *psent, uint16 length)
  978. {
  979. espconn_msg *Threadmsg = arg;
  980. uint16 out_msglen = length;
  981. int ret = ESPCONN_OK;
  982. lwIP_ASSERT(Threadmsg);
  983. lwIP_ASSERT(psent);
  984. lwIP_ASSERT(length);
  985. pmbedtls_msg mbedTLSMsg = Threadmsg->pssl;
  986. lwIP_ASSERT(mbedTLSMsg);
  987. if (length > MBEDTLS_SSL_PLAIN_ADD) {
  988. out_msglen = MBEDTLS_SSL_PLAIN_ADD;
  989. }
  990. Threadmsg->pcommon.write_flag = true;
  991. ret = mbedtls_ssl_write(&mbedTLSMsg->ssl, psent, out_msglen);
  992. if (ret > 0) {
  993. Threadmsg->pcommon.ptrbuf = psent + ret;
  994. Threadmsg->pcommon.cntr = length - ret;
  995. } else {
  996. if (ret == MBEDTLS_ERR_SSL_WANT_WRITE || ret == 0) {
  997. } else {
  998. mbedtls_fail_info(Threadmsg, ret);
  999. ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg);
  1000. }
  1001. }
  1002. }
  1003. /******************************************************************************
  1004. * FunctionName : espconn_ssl_disconnect
  1005. * Description : A new incoming connection has been disconnected.
  1006. * Parameters : espconn -- the espconn used to disconnect with host
  1007. * Returns : none
  1008. *******************************************************************************/
  1009. void espconn_ssl_disconnect(espconn_msg *Threadmsg)
  1010. {
  1011. lwIP_ASSERT(Threadmsg);
  1012. pmbedtls_msg mbedTLSMsg = Threadmsg->pssl;
  1013. lwIP_ASSERT(mbedTLSMsg);
  1014. mbedtls_net_free(&mbedTLSMsg->fd);
  1015. Threadmsg->pespconn->state = ESPCONN_CLOSE;
  1016. ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE, (uint32)Threadmsg);
  1017. }
  1018. /*
  1019. * Checkup routine
  1020. */
  1021. int mbedtls_x509_test(int verbose, char *ca_crt, size_t ca_crt_len, char *cli_crt, size_t cli_crt_len)
  1022. {
  1023. #if defined(MBEDTLS_SHA1_C)
  1024. int ret;
  1025. uint32_t flags;
  1026. mbedtls_x509_crt cacert;
  1027. mbedtls_x509_crt clicert;
  1028. if( verbose != 0 )
  1029. os_printf( " X.509 certificate load: " );
  1030. mbedtls_x509_crt_init( &clicert );
  1031. ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) cli_crt,
  1032. cli_crt_len );
  1033. if( ret != 0 )
  1034. {
  1035. if( verbose != 0 )
  1036. os_printf( "failed\n" );
  1037. return( ret );
  1038. }
  1039. mbedtls_x509_crt_init( &cacert );
  1040. ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) ca_crt,
  1041. ca_crt_len );
  1042. if( ret != 0 )
  1043. {
  1044. if( verbose != 0 )
  1045. os_printf( "failed\n" );
  1046. return( ret );
  1047. }
  1048. if( verbose != 0 )
  1049. os_printf( "passed\n X.509 signature verify: ");
  1050. ret = mbedtls_x509_crt_verify( &clicert, &cacert, NULL, NULL, &flags, NULL, NULL );
  1051. if( ret != 0 )
  1052. {
  1053. if( verbose != 0 )
  1054. os_printf( "failed\n" );
  1055. return( ret );
  1056. }
  1057. if( verbose != 0 )
  1058. os_printf( "passed\n\n");
  1059. mbedtls_x509_crt_free( &cacert );
  1060. mbedtls_x509_crt_free( &clicert );
  1061. return( 0 );
  1062. #else
  1063. ((void) verbose);
  1064. return( 0 );
  1065. #endif /* MBEDTLS_CERTS_C && MBEDTLS_SHA1_C */
  1066. }
  1067. #endif