]> granicus.if.org Git - esp-idf/commitdiff
mbedtls integration in esp-tls
authorJitin George <jitin@espressif.com>
Wed, 28 Feb 2018 12:39:43 +0000 (18:09 +0530)
committerJitin George <jitin@espressif.com>
Fri, 6 Apr 2018 11:46:27 +0000 (17:16 +0530)
components/esp-tls/esp_tls.c
components/esp-tls/esp_tls.h
examples/protocols/http2_request/components/sh2lib/sh2lib.c
examples/protocols/https_request/main/https_request_example_main.c

index d6e79f54dc2ff4984c26229bb7f8dbd92670a003..d84cf77bf93166934a07ffe61a1023bd6c4edddd 100644 (file)
@@ -23,7 +23,6 @@
 #include <http_parser.h>
 #include "esp_tls.h"
 
-
 static const char *TAG = "esp-tls";
 
 #ifdef ESP_PLATFORM
@@ -63,13 +62,14 @@ static ssize_t tcp_read(esp_tls_t *tls, char *data, size_t datalen)
 
 static ssize_t tls_read(esp_tls_t *tls, char *data, size_t datalen)
 {
-    ssize_t ret = SSL_read(tls->ssl, data, datalen);
+    ssize_t ret = mbedtls_ssl_read(&tls->ssl, (unsigned char *)data, datalen);   
     if (ret < 0) {
-       int err = SSL_get_error(tls->ssl, ret);
-       if (err != SSL_ERROR_WANT_WRITE && err != SSL_ERROR_WANT_READ) {
-           ESP_LOGE(TAG, "read error :%d:", ret);
-       }
-       return -err;
+        if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
+            return 0;
+        }
+        if (ret != MBEDTLS_ERR_SSL_WANT_READ  && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
+            ESP_LOGE(TAG, "read error :%d:", ret);
+        }
     }
     return ret;
 }
@@ -89,17 +89,17 @@ static int esp_tcp_connect(const char *host, int hostlen, int port)
 
     void *addr_ptr;
     if (res->ai_family == AF_INET) {
-       struct sockaddr_in *p = (struct sockaddr_in *)res->ai_addr;
-       p->sin_port = htons(port);
-       addr_ptr = p;
+        struct sockaddr_in *p = (struct sockaddr_in *)res->ai_addr;
+        p->sin_port = htons(port);
+        addr_ptr = p;
     } else if (res->ai_family == AF_INET6) {
-       struct sockaddr_in6 *p = (struct sockaddr_in6 *)res->ai_addr;
-       p->sin6_port = htons(port);
-       p->sin6_family = AF_INET6;
-       addr_ptr = p;
+        struct sockaddr_in6 *p = (struct sockaddr_in6 *)res->ai_addr;
+        p->sin6_port = htons(port);
+        p->sin6_family = AF_INET6;
+        addr_ptr = p;
     } else {
        /* Unsupported Protocol Family */
-       goto err_freesocket;
+        goto err_freesocket;
     }
 
     ret = connect(fd, addr_ptr, res->ai_addrlen);
@@ -117,74 +117,112 @@ err_freeaddr:
     return -1;
 }
 
+static void verify_certificate(esp_tls_t *tls)
+{
+    int flags;
+    char buf[100]; 
+    if ((flags = mbedtls_ssl_get_verify_result(&tls->ssl)) != 0) {
+        ESP_LOGI(TAG, "Failed to verify peer certificate!");
+        bzero(buf, sizeof(buf));
+        mbedtls_x509_crt_verify_info(buf, sizeof(buf), "  ! ", flags);
+        ESP_LOGI(TAG, "verification info: %s", buf);
+    } else {
+        ESP_LOGI(TAG, "Certificate verified.");
+    }
+}
+
+static void mbedtls_cleanup(esp_tls_t *tls) 
+{
+    if (!tls) {
+        return;
+    }
+    
+    mbedtls_entropy_free(&tls->entropy);
+    mbedtls_ssl_config_free(&tls->conf);
+    mbedtls_ctr_drbg_free(&tls->ctr_drbg);
+    mbedtls_ssl_free(&tls->ssl);
+    mbedtls_net_free(&tls->server_fd);
+}
+
 static int create_ssl_handle(esp_tls_t *tls, const char *hostname, size_t hostlen, const esp_tls_cfg_t *cfg)
 {
     int ret;
     
-    const SSL_METHOD *method = cfg->ssl_method!= NULL ? cfg->ssl_method : TLSv1_2_client_method();
-    SSL_CTX *ssl_ctx = SSL_CTX_new(method);
-    if (!ssl_ctx) {
-        return -1;
+    mbedtls_net_init(&tls->server_fd);
+    tls->server_fd.fd = tls->sockfd;
+    mbedtls_ssl_init(&tls->ssl);
+    mbedtls_ctr_drbg_init(&tls->ctr_drbg);
+    mbedtls_ssl_config_init(&tls->conf);
+    mbedtls_entropy_init(&tls->entropy);
+    
+    if ((ret = mbedtls_ctr_drbg_seed(&tls->ctr_drbg, 
+                    mbedtls_entropy_func, &tls->entropy, NULL, 0)) != 0) {
+        ESP_LOGE(TAG, "mbedtls_ctr_drbg_seed returned %d", ret);
+        goto exit;        
+    }
+    
+    /* Hostname set here should match CN in server certificate */    
+    char *use_host = strndup(hostname, hostlen);
+    if (!use_host) {
+        goto exit;
     }
-#ifdef __APPLE__
-    SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2);
-    SSL_CTX_set_mode(ssl_ctx, SSL_MODE_AUTO_RETRY);
-    SSL_CTX_set_mode(ssl_ctx, SSL_MODE_RELEASE_BUFFERS);
-#endif
-
-    if (cfg->cacert_pem_buf != NULL) {
-        SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL);
 
-        BIO *bio;
-        bio = BIO_new(BIO_s_mem());
-        BIO_write(bio, cfg->cacert_pem_buf, cfg->cacert_pem_bytes);
+    if ((ret = mbedtls_ssl_set_hostname(&tls->ssl, use_host)) != 0) {
+        ESP_LOGE(TAG, "mbedtls_ssl_set_hostname returned -0x%x", -ret);
+        free(use_host);
+        goto exit;
+    }
+    free(use_host);
 
-        X509 *ca = PEM_read_bio_X509(bio, NULL, 0, NULL);
+    if ((ret = mbedtls_ssl_config_defaults(&tls->conf,
+                    MBEDTLS_SSL_IS_CLIENT,
+                    MBEDTLS_SSL_TRANSPORT_STREAM,
+                    MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
+        ESP_LOGE(TAG, "mbedtls_ssl_config_defaults returned %d", ret);
+        goto exit;
+    }
 
-        if (!ca) {
-            ESP_LOGE(TAG, "CA Error");
-            X509_free(ca);
-            BIO_free(bio);
-            SSL_CTX_free(ssl_ctx);
-            return -1;            
+    if (cfg->cacert_pem_buf != NULL) {
+        mbedtls_x509_crt_init(&tls->cacert);
+        ret = mbedtls_x509_crt_parse(&tls->cacert, cfg->cacert_pem_buf, cfg->cacert_pem_bytes);
+        if (ret < 0) {
+            ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%x\n\n", -ret);
+            goto exit;
         }
-        ESP_LOGD(TAG, "CA OK");
-            
-        X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx), ca);
-
-        X509_free(ca);
-        BIO_free(bio);
+        mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_REQUIRED);
+        mbedtls_ssl_conf_ca_chain(&tls->conf, &tls->cacert, NULL);
+    } else {
+        mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_NONE);
     }
+    
+    mbedtls_ssl_conf_rng(&tls->conf, mbedtls_ctr_drbg_random, &tls->ctr_drbg);
 
-    if (cfg->alpn_protos) {
-       SSL_CTX_set_alpn_protos(ssl_ctx, cfg->alpn_protos, strlen((char *)cfg->alpn_protos));
-    }
-    SSL *ssl = SSL_new(ssl_ctx);
-    if (!ssl) {
-        SSL_CTX_free(ssl_ctx);
-        return -1;
-    }
+#ifdef CONFIG_MBEDTLS_DEBUG
+    mbedtls_esp_enable_debug_log(&tls->conf, 4);
+#endif
 
-    char *use_host = strndup(hostname, hostlen);
-    if (!use_host) {
-           SSL_CTX_free(ssl_ctx);
-           return -1;
+    if ((ret = mbedtls_ssl_setup(&tls->ssl, &tls->conf)) != 0) {
+        ESP_LOGE(TAG, "mbedtls_ssl_setup returned -0x%x\n\n", -ret);
+        goto exit;
     }
-    SSL_set_tlsext_host_name(ssl, use_host);
-    free(use_host);
 
-    SSL_set_fd(ssl, tls->sockfd);
-    ret = SSL_connect(ssl);
-    if (ret < 1) {
-        ESP_LOGE(TAG, "SSL handshake failed");
-        SSL_free(ssl);
-        SSL_CTX_free(ssl_ctx);
-        return -1;
-    }
+    mbedtls_ssl_set_bio(&tls->ssl, &tls->server_fd, mbedtls_net_send, mbedtls_net_recv, NULL);
 
-    tls->ctx = ssl_ctx;
-    tls->ssl = ssl;
+    while ((ret = mbedtls_ssl_handshake(&tls->ssl)) != 0) {
+        if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
+            ESP_LOGE(TAG, "mbedtls_ssl_handshake returned -0x%x", -ret);
+            if (cfg->cacert_pem_buf != NULL) {
+                /* This is to check whether handshake failed due to invalid certificate*/
+                verify_certificate(tls);
+            }   
+            goto exit;
+        }
+    }
+    
     return 0;
+exit:
+    mbedtls_cleanup(tls);
+    return -1;
 }
 
 /**
@@ -192,15 +230,7 @@ static int create_ssl_handle(esp_tls_t *tls, const char *hostname, size_t hostle
  */
 void esp_tls_conn_delete(esp_tls_t *tls)
 {
-    if (!tls) {
-        return;
-    }
-    if (tls->ssl) {
-        SSL_free(tls->ssl);
-    }
-    if (tls->ctx) {
-        SSL_CTX_free(tls->ctx);
-    }
+    mbedtls_cleanup(tls);
     if (tls->sockfd) {
         close(tls->sockfd);
     }
@@ -214,13 +244,11 @@ static ssize_t tcp_write(esp_tls_t *tls, const char *data, size_t datalen)
 
 static ssize_t tls_write(esp_tls_t *tls, const char *data, size_t datalen)
 {
-    ssize_t ret = SSL_write(tls->ssl, data, datalen);
+    ssize_t ret = mbedtls_ssl_write(&tls->ssl, (unsigned char*) data, datalen);
     if (ret < 0) {
-       int err = SSL_get_error(tls->ssl, ret);
-       if (err != SSL_ERROR_WANT_WRITE && err != SSL_ERROR_WANT_READ) {
-           ESP_LOGE(TAG, "write error :%d:", ret);
-       }
-       return -err;
+        if (ret != MBEDTLS_ERR_SSL_WANT_READ  && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
+            ESP_LOGE(TAG, "write error :%d:", ret);
+        }
     }
     return ret;
 }
@@ -253,7 +281,7 @@ esp_tls_t *esp_tls_conn_new(const char *hostname, int hostlen, int port, const e
        tls->write = tls_write;
     }
 
-    if(cfg->non_block == true) {
+    if (cfg->non_block == true) {
         int flags = fcntl(tls->sockfd, F_GETFL, 0);
         fcntl(tls->sockfd, F_SETFL, flags | O_NONBLOCK);    
     }
index 182034278af68ec221d3d93c78cc5913125fdf70..4f2f35a03ac43fde0dcc857edc8bf391f9adfe07 100644 (file)
 
 #include <stdbool.h>
 #include <sys/socket.h>
-#include <openssl/ssl.h>
 #include <fcntl.h>
 
+
+#include "mbedtls/platform.h"
+#include "mbedtls/net_sockets.h"
+#include "mbedtls/esp_debug.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/error.h"
+#include "mbedtls/certs.h"
+
 #ifdef __cplusplus
 extern "C" {
 #endif
@@ -36,13 +45,12 @@ typedef struct esp_tls_cfg {
                                                  "\x02h2"
                                                  - where the first '2' is the length of the protocol and
                                                  - the subsequent 'h2' is the protocol name */
     const unsigned char *cacert_pem_buf;    /*!< Certificate Authority's certificate in a buffer */
     const unsigned int cacert_pem_bytes;    /*!< Size of Certificate Authority certificate 
                                                  pointed to by cacert_pem_buf */
-    const SSL_METHOD *ssl_method;           /*!< SSL method that describes internal ssl library
-                                                 methods/functions which implements the various protocol 
-                                                 versions. If set to NULL, it defaults to 
-                                                 method returned by TLSv1_2_client_method() API. */
     bool non_block;                         /*!< Configure non-blocking mode. If set to true the 
                                                  underneath socket will be configured in non 
                                                  blocking mode after tls session is established */
@@ -52,15 +60,27 @@ typedef struct esp_tls_cfg {
  * @brief      ESP-TLS Connection Handle 
  */
 typedef struct esp_tls {
-    SSL_CTX  *ctx;                                                             /*!< SSL_CTX object is used to establish
-                                                                                    TLS/SSL enabled connection */
-    SSL      *ssl;                                                              /*!< SSL object which is needed to hold the data for a 
-                                                                                    TLS/SSL connection. The new structure inherits the settings of the
-                                                                                    underlying context ctx: connection method (SSLv2/v3/TLSv1), 
-                                                                                    options, verification settings, timeout settings. */  
-    int      sockfd;                                                            /*!< Underlying socket file descriptor. */
+    mbedtls_ssl_context ssl;                                                    /*!< TLS/SSL context */
+    mbedtls_entropy_context entropy;                                            /*!< mbedTLS entropy context structure */
+    mbedtls_ctr_drbg_context ctr_drbg;                                          /*!< mbedTLS ctr drbg context structure.
+                                                                                     CTR_DRBG is deterministic random 
+                                                                                     bit generation based on AES-256 */
+    mbedtls_ssl_config conf;                                                    /*!< TLS/SSL configuration to be shared 
+                                                                                     between mbedtls_ssl_context 
+                                                                                     structures */
+    mbedtls_net_context server_fd;                                              /*!< mbedTLS wrapper type for sockets */
+    mbedtls_x509_crt cacert;                                                    /*!< Container for an X.509 certificate */
+    int sockfd;                                                                 /*!< Underlying socket file descriptor. */
     ssize_t (*read)(struct esp_tls  *tls, char *data, size_t datalen);          /*!< Callback function for reading data from TLS/SSL
                                                                                      connection. */
     ssize_t (*write)(struct esp_tls *tls, const char *data, size_t datalen);    /*!< Callback function for writing data to TLS/SSL
                                                                                      connection. */
 } esp_tls_t;
index 5a25f9bc4f7c154c127e57aef7ff6372603ea1c2..c5bae587be88c1be15d9dbe2f0e390749de73ce7 100644 (file)
@@ -75,7 +75,7 @@ static ssize_t callback_send_inner(struct sh2lib_handle *hd, const uint8_t *data
 {
     int rv = esp_tls_conn_write(hd->http2_tls, data, length);
     if (rv <= 0) {
-        if (rv == -SSL_ERROR_WANT_WRITE || rv == -SSL_ERROR_WANT_READ) {
+        if (rv == MBEDTLS_ERR_SSL_WANT_READ || rv == MBEDTLS_ERR_SSL_WANT_WRITE) {
             rv = NGHTTP2_ERR_WOULDBLOCK;
         } else {
             rv = NGHTTP2_ERR_CALLBACK_FAILURE;
@@ -127,7 +127,7 @@ static ssize_t callback_recv(nghttp2_session *session, uint8_t *buf,
     int rv;
     rv = esp_tls_conn_read(hd->http2_tls, (char *)buf, (int)length);
     if (rv < 0) {
-        if (rv == -SSL_ERROR_WANT_WRITE || rv == -SSL_ERROR_WANT_READ) {
+        if (rv == MBEDTLS_ERR_SSL_WANT_READ || rv == MBEDTLS_ERR_SSL_WANT_WRITE) {
             rv = NGHTTP2_ERR_WOULDBLOCK;
         } else {
             rv = NGHTTP2_ERR_CALLBACK_FAILURE;
index 479399a0ae8bddc62f75382d537512e7bd381250..3964b4ea5274b7637135d2ca939c16c692aa15c6 100644 (file)
@@ -157,7 +157,7 @@ static void https_get_task(void *pvParameters)
             if (ret >= 0) {
                 ESP_LOGI(TAG, "%d bytes written", ret);
                 written_bytes += ret;
-            } else if (ret != -SSL_ERROR_WANT_WRITE  && ret != -SSL_ERROR_WANT_READ) {
+            } else if (ret != MBEDTLS_ERR_SSL_WANT_READ  && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
                 ESP_LOGE(TAG, "esp_tls_conn_write  returned 0x%x", ret);
                 goto exit;
             }
@@ -171,12 +171,12 @@ static void https_get_task(void *pvParameters)
             bzero(buf, sizeof(buf));
             ret = esp_tls_conn_read(tls, (char *)buf, len);
             
-            if(ret == -SSL_ERROR_WANT_WRITE || ret == -SSL_ERROR_WANT_READ)
+            if(ret == MBEDTLS_ERR_SSL_WANT_WRITE  || ret == MBEDTLS_ERR_SSL_WANT_READ)
                 continue;
             
             if(ret < 0)
-            {
-                ESP_LOGE(TAG, "esp_tls_conn_read  returned 0x%x", ret);
+           {
+                ESP_LOGE(TAG, "esp_tls_conn_read  returned -0x%x", -ret);
                 break;
             }