Commit 863dfb59 authored by Nathaniel Wesley Filardo's avatar Nathaniel Wesley Filardo Committed by Marcel Stör
Browse files

SSL rampage (#2938)

* Remove stale putative MD2 support

This hasn't worked in a while, presumably since one of our upstream
merges.  Don't bother making it work, since MD2 is generally considered
insecure.

* Land mbedtls 2.16.3-77-gf02988e57

* TLS: remove some dead code from espconn_mbedtls

There was some... frankly kind of scary buffer and data shuffling if
ESP8266_PLATFORM was defined.  Since we don't, in fact, define that
preprocessor symbol, just drop the code lest anyone (possibly future-me)
be scared.

* TLS: espconn_mbedtls: run through astyle

No functional changes

* TLS: espconn_mbedtls: put the file_params on the stack

There's no need to malloc a structure that's used only locally.

* TLS: Further minor tidying of mbedtls glue

What an absolute shitshow this is.  mbedtls should absolutely not
be mentioned inside sys/socket.h and app/mbedtls/app/lwIPSocket.c is not
so much glue as it as a complete copy of a random subset of lwIP; it
should go, but we aren't there yet.

Get rid of the mysterious "mbedlts_record" struct, which housed merely a
length of bytes sent solely for gating the "record sent" callback.

Remove spurious __attribute__((weak)) from symbols not otherwise
defined and rename them to emphasize that they are not actually part of
mbedtls proper.

* TLS: Rampage esp mbedtls glue and delete unused code

This at least makes the shitshow smaller

* TLS: lwip: fix some memp definitions

I presume these also need the new arguments

* TLS: Remove more non-NodeMCU code from our mbedtls

* TLS: drop support for 1.1

Depending on who you ask it's either EOL already or EOL soon, so
we may as well get rid of it now.
parent f5672207
...@@ -24,6 +24,12 @@ ...@@ -24,6 +24,12 @@
#ifndef MBEDTLS_SSL_CACHE_H #ifndef MBEDTLS_SSL_CACHE_H
#define MBEDTLS_SSL_CACHE_H #define MBEDTLS_SSL_CACHE_H
#if !defined(MBEDTLS_CONFIG_FILE)
#include "config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#include "ssl.h" #include "ssl.h"
#if defined(MBEDTLS_THREADING_C) #if defined(MBEDTLS_THREADING_C)
......
...@@ -24,6 +24,12 @@ ...@@ -24,6 +24,12 @@
#ifndef MBEDTLS_SSL_CIPHERSUITES_H #ifndef MBEDTLS_SSL_CIPHERSUITES_H
#define MBEDTLS_SSL_CIPHERSUITES_H #define MBEDTLS_SSL_CIPHERSUITES_H
#if !defined(MBEDTLS_CONFIG_FILE)
#include "config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#include "pk.h" #include "pk.h"
#include "cipher.h" #include "cipher.h"
#include "md.h" #include "md.h"
...@@ -169,6 +175,45 @@ extern "C" { ...@@ -169,6 +175,45 @@ extern "C" {
#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A /**< Weak! No SSL3! */ #define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA256 0xC03A /**< Weak! No SSL3! */
#define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B /**< Weak! No SSL3! */ #define MBEDTLS_TLS_ECDHE_PSK_WITH_NULL_SHA384 0xC03B /**< Weak! No SSL3! */
#define MBEDTLS_TLS_RSA_WITH_ARIA_128_CBC_SHA256 0xC03C /**< TLS 1.2 */
#define MBEDTLS_TLS_RSA_WITH_ARIA_256_CBC_SHA384 0xC03D /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC044 /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC045 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC048 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC049 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_CBC_SHA256 0xC04A /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_CBC_SHA384 0xC04B /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_CBC_SHA256 0xC04C /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_CBC_SHA384 0xC04D /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_CBC_SHA256 0xC04E /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_CBC_SHA384 0xC04F /**< TLS 1.2 */
#define MBEDTLS_TLS_RSA_WITH_ARIA_128_GCM_SHA256 0xC050 /**< TLS 1.2 */
#define MBEDTLS_TLS_RSA_WITH_ARIA_256_GCM_SHA384 0xC051 /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC052 /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC053 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05C /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05D /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_128_GCM_SHA256 0xC05E /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_ARIA_256_GCM_SHA384 0xC05F /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_128_GCM_SHA256 0xC060 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_RSA_WITH_ARIA_256_GCM_SHA384 0xC061 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_128_GCM_SHA256 0xC062 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDH_RSA_WITH_ARIA_256_GCM_SHA384 0xC063 /**< TLS 1.2 */
#define MBEDTLS_TLS_PSK_WITH_ARIA_128_CBC_SHA256 0xC064 /**< TLS 1.2 */
#define MBEDTLS_TLS_PSK_WITH_ARIA_256_CBC_SHA384 0xC065 /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC066 /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC067 /**< TLS 1.2 */
#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_CBC_SHA256 0xC068 /**< TLS 1.2 */
#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_CBC_SHA384 0xC069 /**< TLS 1.2 */
#define MBEDTLS_TLS_PSK_WITH_ARIA_128_GCM_SHA256 0xC06A /**< TLS 1.2 */
#define MBEDTLS_TLS_PSK_WITH_ARIA_256_GCM_SHA384 0xC06B /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_128_GCM_SHA256 0xC06C /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_PSK_WITH_ARIA_256_GCM_SHA384 0xC06D /**< TLS 1.2 */
#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_128_GCM_SHA256 0xC06E /**< TLS 1.2 */
#define MBEDTLS_TLS_RSA_PSK_WITH_ARIA_256_GCM_SHA384 0xC06F /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_128_CBC_SHA256 0xC070 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_PSK_WITH_ARIA_256_CBC_SHA384 0xC071 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 /**< Not in SSL3! */ #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC072 /**< Not in SSL3! */
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 /**< Not in SSL3! */ #define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CAMELLIA_256_CBC_SHA384 0xC073 /**< Not in SSL3! */
#define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074 /**< Not in SSL3! */ #define MBEDTLS_TLS_ECDH_ECDSA_WITH_CAMELLIA_128_CBC_SHA256 0xC074 /**< Not in SSL3! */
...@@ -232,6 +277,15 @@ extern "C" { ...@@ -232,6 +277,15 @@ extern "C" {
#define MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 0xC0FF /**< experimental */ #define MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8 0xC0FF /**< experimental */
/* RFC 7905 */
#define MBEDTLS_TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA8 /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 0xCCA9 /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 0xCCAA /**< TLS 1.2 */
#define MBEDTLS_TLS_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAB /**< TLS 1.2 */
#define MBEDTLS_TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAC /**< TLS 1.2 */
#define MBEDTLS_TLS_DHE_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAD /**< TLS 1.2 */
#define MBEDTLS_TLS_RSA_PSK_WITH_CHACHA20_POLY1305_SHA256 0xCCAE /**< TLS 1.2 */
/* Reminder: update mbedtls_ssl_premaster_secret when adding a new key exchange. /* Reminder: update mbedtls_ssl_premaster_secret when adding a new key exchange.
* Reminder: update MBEDTLS_KEY_EXCHANGE__xxx below * Reminder: update MBEDTLS_KEY_EXCHANGE__xxx below
*/ */
......
...@@ -24,6 +24,12 @@ ...@@ -24,6 +24,12 @@
#ifndef MBEDTLS_SSL_COOKIE_H #ifndef MBEDTLS_SSL_COOKIE_H
#define MBEDTLS_SSL_COOKIE_H #define MBEDTLS_SSL_COOKIE_H
#if !defined(MBEDTLS_CONFIG_FILE)
#include "config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#include "ssl.h" #include "ssl.h"
#if defined(MBEDTLS_THREADING_C) #if defined(MBEDTLS_THREADING_C)
...@@ -50,7 +56,7 @@ extern "C" { ...@@ -50,7 +56,7 @@ extern "C" {
/** /**
* \brief Context for the default cookie functions. * \brief Context for the default cookie functions.
*/ */
typedef struct typedef struct mbedtls_ssl_cookie_ctx
{ {
mbedtls_md_context_t hmac_ctx; /*!< context for the HMAC portion */ mbedtls_md_context_t hmac_ctx; /*!< context for the HMAC portion */
#if !defined(MBEDTLS_HAVE_TIME) #if !defined(MBEDTLS_HAVE_TIME)
......
...@@ -24,6 +24,12 @@ ...@@ -24,6 +24,12 @@
#ifndef MBEDTLS_SSL_INTERNAL_H #ifndef MBEDTLS_SSL_INTERNAL_H
#define MBEDTLS_SSL_INTERNAL_H #define MBEDTLS_SSL_INTERNAL_H
#if !defined(MBEDTLS_CONFIG_FILE)
#include "config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
#include "ssl.h" #include "ssl.h"
#include "cipher.h" #include "cipher.h"
...@@ -93,6 +99,14 @@ ...@@ -93,6 +99,14 @@
#endif /* MBEDTLS_SSL_PROTO_TLS1_1 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_1 */
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */ #endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
/* Shorthand for restartable ECC */
#if defined(MBEDTLS_ECP_RESTARTABLE) && \
defined(MBEDTLS_SSL_CLI_C) && \
defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
defined(MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED)
#define MBEDTLS_SSL__ECP_RESTARTABLE
#endif
#define MBEDTLS_SSL_INITIAL_HANDSHAKE 0 #define MBEDTLS_SSL_INITIAL_HANDSHAKE 0
#define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */ #define MBEDTLS_SSL_RENEGOTIATION_IN_PROGRESS 1 /* In progress */
#define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */ #define MBEDTLS_SSL_RENEGOTIATION_DONE 2 /* Done or aborted */
...@@ -143,32 +157,76 @@ ...@@ -143,32 +157,76 @@
#define MBEDTLS_SSL_PADDING_ADD 0 #define MBEDTLS_SSL_PADDING_ADD 0
#endif #endif
#define MBEDTLS_SSL_PAYLOAD_LEN ( MBEDTLS_SSL_MAX_CONTENT_LEN \ #define MBEDTLS_SSL_PAYLOAD_OVERHEAD ( MBEDTLS_SSL_COMPRESSION_ADD + \
+ MBEDTLS_SSL_COMPRESSION_ADD \ MBEDTLS_MAX_IV_LENGTH + \
+ MBEDTLS_MAX_IV_LENGTH \ MBEDTLS_SSL_MAC_ADD + \
+ MBEDTLS_SSL_MAC_ADD \ MBEDTLS_SSL_PADDING_ADD \
+ MBEDTLS_SSL_PADDING_ADD \ )
)
#define MBEDTLS_SSL_IN_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \
( MBEDTLS_SSL_IN_CONTENT_LEN ) )
#define MBEDTLS_SSL_OUT_PAYLOAD_LEN ( MBEDTLS_SSL_PAYLOAD_OVERHEAD + \
( MBEDTLS_SSL_OUT_CONTENT_LEN ) )
/* The maximum number of buffered handshake messages. */
#define MBEDTLS_SSL_MAX_BUFFERED_HS 4
/* Maximum length we can advertise as our max content length for
RFC 6066 max_fragment_length extension negotiation purposes
(the lesser of both sizes, if they are unequal.)
*/
#define MBEDTLS_TLS_EXT_ADV_CONTENT_LEN ( \
(MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_OUT_CONTENT_LEN) \
? ( MBEDTLS_SSL_OUT_CONTENT_LEN ) \
: ( MBEDTLS_SSL_IN_CONTENT_LEN ) \
)
/* /*
* Check that we obey the standard's message size bounds * Check that we obey the standard's message size bounds
*/ */
#if MBEDTLS_SSL_MAX_CONTENT_LEN > 16384 #if MBEDTLS_SSL_MAX_CONTENT_LEN > 16384
#error Bad configuration - record content too large. #error "Bad configuration - record content too large."
#endif
#if MBEDTLS_SSL_IN_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN
#error "Bad configuration - incoming record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN."
#endif
#if MBEDTLS_SSL_OUT_CONTENT_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN
#error "Bad configuration - outgoing record content should not be larger than MBEDTLS_SSL_MAX_CONTENT_LEN."
#endif #endif
#if MBEDTLS_SSL_PAYLOAD_LEN > 16384 + 2048 #if MBEDTLS_SSL_IN_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048
#error Bad configuration - protected record payload too large. #error "Bad configuration - incoming protected record payload too large."
#endif #endif
#if MBEDTLS_SSL_OUT_PAYLOAD_LEN > MBEDTLS_SSL_MAX_CONTENT_LEN + 2048
#error "Bad configuration - outgoing protected record payload too large."
#endif
/* Calculate buffer sizes */
/* Note: Even though the TLS record header is only 5 bytes /* Note: Even though the TLS record header is only 5 bytes
long, we're internally using 8 bytes to store the long, we're internally using 8 bytes to store the
implicit sequence number. */ implicit sequence number. */
#define MBEDTLS_SSL_HEADER_LEN 13 #define MBEDTLS_SSL_HEADER_LEN 13
#define MBEDTLS_SSL_BUFFER_LEN \ #define MBEDTLS_SSL_IN_BUFFER_LEN \
( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_PAYLOAD_LEN ) ) ( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_IN_PAYLOAD_LEN ) )
#define MBEDTLS_SSL_OUT_BUFFER_LEN \
( ( MBEDTLS_SSL_HEADER_LEN ) + ( MBEDTLS_SSL_OUT_PAYLOAD_LEN ) )
#ifdef MBEDTLS_ZLIB_SUPPORT
/* Compression buffer holds both IN and OUT buffers, so should be size of the larger */
#define MBEDTLS_SSL_COMPRESS_BUFFER_LEN ( \
( MBEDTLS_SSL_IN_BUFFER_LEN > MBEDTLS_SSL_OUT_BUFFER_LEN ) \
? MBEDTLS_SSL_IN_BUFFER_LEN \
: MBEDTLS_SSL_OUT_BUFFER_LEN \
)
#endif
/* /*
* TLS extension flags (for extensions with outgoing ServerHello content * TLS extension flags (for extensions with outgoing ServerHello content
...@@ -243,6 +301,18 @@ struct mbedtls_ssl_handshake_params ...@@ -243,6 +301,18 @@ struct mbedtls_ssl_handshake_params
mbedtls_x509_crl *sni_ca_crl; /*!< trusted CAs CRLs from SNI */ mbedtls_x509_crl *sni_ca_crl; /*!< trusted CAs CRLs from SNI */
#endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */ #endif /* MBEDTLS_SSL_SERVER_NAME_INDICATION */
#endif /* MBEDTLS_X509_CRT_PARSE_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */
#if defined(MBEDTLS_SSL__ECP_RESTARTABLE)
int ecrs_enabled; /*!< Handshake supports EC restart? */
mbedtls_x509_crt_restart_ctx ecrs_ctx; /*!< restart context */
enum { /* this complements ssl->state with info on intra-state operations */
ssl_ecrs_none = 0, /*!< nothing going on (yet) */
ssl_ecrs_crt_verify, /*!< Certificate: crt_verify() */
ssl_ecrs_ske_start_processing, /*!< ServerKeyExchange: pk_verify() */
ssl_ecrs_cke_ecdh_calc_secret, /*!< ClientKeyExchange: ECDH step 2 */
ssl_ecrs_crt_vrfy_sign, /*!< CertificateVerify: pk_sign() */
} ecrs_state; /*!< current (or last) operation */
size_t ecrs_n; /*!< place for saving a length */
#endif
#if defined(MBEDTLS_SSL_PROTO_DTLS) #if defined(MBEDTLS_SSL_PROTO_DTLS)
unsigned int out_msg_seq; /*!< Outgoing handshake sequence number */ unsigned int out_msg_seq; /*!< Outgoing handshake sequence number */
unsigned int in_msg_seq; /*!< Incoming handshake sequence number */ unsigned int in_msg_seq; /*!< Incoming handshake sequence number */
...@@ -252,18 +322,45 @@ struct mbedtls_ssl_handshake_params ...@@ -252,18 +322,45 @@ struct mbedtls_ssl_handshake_params
unsigned char verify_cookie_len; /*!< Cli: cookie length unsigned char verify_cookie_len; /*!< Cli: cookie length
Srv: flag for sending a cookie */ Srv: flag for sending a cookie */
unsigned char *hs_msg; /*!< Reassembled handshake message */
uint32_t retransmit_timeout; /*!< Current value of timeout */ uint32_t retransmit_timeout; /*!< Current value of timeout */
unsigned char retransmit_state; /*!< Retransmission state */ unsigned char retransmit_state; /*!< Retransmission state */
mbedtls_ssl_flight_item *flight; /*!< Current outgoing flight */ mbedtls_ssl_flight_item *flight; /*!< Current outgoing flight */
mbedtls_ssl_flight_item *cur_msg; /*!< Current message in flight */ mbedtls_ssl_flight_item *cur_msg; /*!< Current message in flight */
unsigned char *cur_msg_p; /*!< Position in current message */
unsigned int in_flight_start_seq; /*!< Minimum message sequence in the unsigned int in_flight_start_seq; /*!< Minimum message sequence in the
flight being received */ flight being received */
mbedtls_ssl_transform *alt_transform_out; /*!< Alternative transform for mbedtls_ssl_transform *alt_transform_out; /*!< Alternative transform for
resending messages */ resending messages */
unsigned char alt_out_ctr[8]; /*!< Alternative record epoch/counter unsigned char alt_out_ctr[8]; /*!< Alternative record epoch/counter
for resending messages */ for resending messages */
struct
{
size_t total_bytes_buffered; /*!< Cumulative size of heap allocated
* buffers used for message buffering. */
uint8_t seen_ccs; /*!< Indicates if a CCS message has
* been seen in the current flight. */
struct mbedtls_ssl_hs_buffer
{
unsigned is_valid : 1;
unsigned is_fragmented : 1;
unsigned is_complete : 1;
unsigned char *data;
size_t data_len;
} hs[MBEDTLS_SSL_MAX_BUFFERED_HS];
struct
{
unsigned char *data;
size_t len;
unsigned epoch;
} future_record;
} buffering;
uint16_t mtu; /*!< Handshake mtu, used to fragment outgoing messages */
#endif /* MBEDTLS_SSL_PROTO_DTLS */ #endif /* MBEDTLS_SSL_PROTO_DTLS */
/* /*
...@@ -307,8 +404,23 @@ struct mbedtls_ssl_handshake_params ...@@ -307,8 +404,23 @@ struct mbedtls_ssl_handshake_params
#if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET) #if defined(MBEDTLS_SSL_EXTENDED_MASTER_SECRET)
int extended_ms; /*!< use Extended Master Secret? */ int extended_ms; /*!< use Extended Master Secret? */
#endif #endif
#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
unsigned int async_in_progress : 1; /*!< an asynchronous operation is in progress */
#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
#if defined(MBEDTLS_SSL_ASYNC_PRIVATE)
/** Asynchronous operation context. This field is meant for use by the
* asynchronous operation callbacks (mbedtls_ssl_config::f_async_sign_start,
* mbedtls_ssl_config::f_async_decrypt_start,
* mbedtls_ssl_config::f_async_resume, mbedtls_ssl_config::f_async_cancel).
* The library does not use it internally. */
void *user_async_ctx;
#endif /* MBEDTLS_SSL_ASYNC_PRIVATE */
}; };
typedef struct mbedtls_ssl_hs_buffer mbedtls_ssl_hs_buffer;
/* /*
* This structure contains a full set of runtime transform parameters * This structure contains a full set of runtime transform parameters
* either in negotiation or active. * either in negotiation or active.
...@@ -410,9 +522,9 @@ void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform ); ...@@ -410,9 +522,9 @@ void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform );
* \brief Free referenced items in an SSL handshake context and clear * \brief Free referenced items in an SSL handshake context and clear
* memory * memory
* *
* \param handshake SSL handshake context * \param ssl SSL context
*/ */
void mbedtls_ssl_handshake_free( mbedtls_ssl_handshake_params *handshake ); void mbedtls_ssl_handshake_free( mbedtls_ssl_context *ssl );
int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl ); int mbedtls_ssl_handshake_client_step( mbedtls_ssl_context *ssl );
int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl ); int mbedtls_ssl_handshake_server_step( mbedtls_ssl_context *ssl );
...@@ -423,7 +535,6 @@ int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl ); ...@@ -423,7 +535,6 @@ int mbedtls_ssl_send_fatal_handshake_failure( mbedtls_ssl_context *ssl );
void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl ); void mbedtls_ssl_reset_checksum( mbedtls_ssl_context *ssl );
int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl ); int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl );
int mbedtls_ssl_read_record_layer( mbedtls_ssl_context *ssl );
int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl ); int mbedtls_ssl_handle_message_type( mbedtls_ssl_context *ssl );
int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl ); int mbedtls_ssl_prepare_handshake_record( mbedtls_ssl_context *ssl );
void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl ); void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl );
...@@ -435,7 +546,10 @@ void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl ); ...@@ -435,7 +546,10 @@ void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl );
* of the logic of (D)TLS from the implementation * of the logic of (D)TLS from the implementation
* of the secure transport. * of the secure transport.
* *
* \param ssl SSL context to use * \param ssl The SSL context to use.
* \param update_hs_digest This indicates if the handshake digest
* should be automatically updated in case
* a handshake message is found.
* *
* \return 0 or non-zero error code. * \return 0 or non-zero error code.
* *
...@@ -501,10 +615,12 @@ void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl ); ...@@ -501,10 +615,12 @@ void mbedtls_ssl_update_handshake_status( mbedtls_ssl_context *ssl );
* following the above definition. * following the above definition.
* *
*/ */
int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl ); int mbedtls_ssl_read_record( mbedtls_ssl_context *ssl,
unsigned update_hs_digest );
int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want ); int mbedtls_ssl_fetch_input( mbedtls_ssl_context *ssl, size_t nb_want );
int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl ); int mbedtls_ssl_write_handshake_msg( mbedtls_ssl_context *ssl );
int mbedtls_ssl_write_record( mbedtls_ssl_context *ssl, uint8_t force_flush );
int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl ); int mbedtls_ssl_flush_output( mbedtls_ssl_context *ssl );
int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl ); int mbedtls_ssl_parse_certificate( mbedtls_ssl_context *ssl );
...@@ -613,6 +729,7 @@ static inline size_t mbedtls_ssl_hs_hdr_len( const mbedtls_ssl_context *ssl ) ...@@ -613,6 +729,7 @@ static inline size_t mbedtls_ssl_hs_hdr_len( const mbedtls_ssl_context *ssl )
void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl ); void mbedtls_ssl_send_flight_completed( mbedtls_ssl_context *ssl );
void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl ); void mbedtls_ssl_recv_flight_completed( mbedtls_ssl_context *ssl );
int mbedtls_ssl_resend( mbedtls_ssl_context *ssl ); int mbedtls_ssl_resend( mbedtls_ssl_context *ssl );
int mbedtls_ssl_flight_transmit( mbedtls_ssl_context *ssl );
#endif #endif
/* Visible for testing purposes only */ /* Visible for testing purposes only */
...@@ -652,9 +769,9 @@ int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl, ...@@ -652,9 +769,9 @@ int mbedtls_ssl_get_key_exchange_md_ssl_tls( mbedtls_ssl_context *ssl,
#if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \ #if defined(MBEDTLS_SSL_PROTO_TLS1) || defined(MBEDTLS_SSL_PROTO_TLS1_1) || \
defined(MBEDTLS_SSL_PROTO_TLS1_2) defined(MBEDTLS_SSL_PROTO_TLS1_2)
int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl, int mbedtls_ssl_get_key_exchange_md_tls1_2( mbedtls_ssl_context *ssl,
unsigned char *output, unsigned char *hash, size_t *hashlen,
unsigned char *data, size_t data_len, unsigned char *data, size_t data_len,
mbedtls_md_type_t md_alg ); mbedtls_md_type_t md_alg );
#endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \ #endif /* MBEDTLS_SSL_PROTO_TLS1 || MBEDTLS_SSL_PROTO_TLS1_1 || \
MBEDTLS_SSL_PROTO_TLS1_2 */ MBEDTLS_SSL_PROTO_TLS1_2 */
......
...@@ -24,6 +24,12 @@ ...@@ -24,6 +24,12 @@
#ifndef MBEDTLS_SSL_TICKET_H #ifndef MBEDTLS_SSL_TICKET_H
#define MBEDTLS_SSL_TICKET_H #define MBEDTLS_SSL_TICKET_H
#if !defined(MBEDTLS_CONFIG_FILE)
#include "config.h"
#else
#include MBEDTLS_CONFIG_FILE
#endif
/* /*
* This implementation of the session ticket callbacks includes key * This implementation of the session ticket callbacks includes key
* management, rotating the keys periodically in order to preserve forward * management, rotating the keys periodically in order to preserve forward
...@@ -44,7 +50,7 @@ extern "C" { ...@@ -44,7 +50,7 @@ extern "C" {
/** /**
* \brief Information for session ticket protection * \brief Information for session ticket protection
*/ */
typedef struct typedef struct mbedtls_ssl_ticket_key
{ {
unsigned char name[4]; /*!< random key identifier */ unsigned char name[4]; /*!< random key identifier */
uint32_t generation_time; /*!< key generation timestamp (seconds) */ uint32_t generation_time; /*!< key generation timestamp (seconds) */
...@@ -55,7 +61,7 @@ mbedtls_ssl_ticket_key; ...@@ -55,7 +61,7 @@ mbedtls_ssl_ticket_key;
/** /**
* \brief Context for session ticket handling functions * \brief Context for session ticket handling functions
*/ */
typedef struct typedef struct mbedtls_ssl_ticket_context
{ {
mbedtls_ssl_ticket_key keys[2]; /*!< ticket protection keys */ mbedtls_ssl_ticket_key keys[2]; /*!< ticket protection keys */
unsigned char active; /*!< index of the currently active key */ unsigned char active; /*!< index of the currently active key */
...@@ -111,14 +117,14 @@ int mbedtls_ssl_ticket_setup( mbedtls_ssl_ticket_context *ctx, ...@@ -111,14 +117,14 @@ int mbedtls_ssl_ticket_setup( mbedtls_ssl_ticket_context *ctx,
/** /**
* \brief Implementation of the ticket write callback * \brief Implementation of the ticket write callback
* *
* \note See \c mbedlts_ssl_ticket_write_t for description * \note See \c mbedtls_ssl_ticket_write_t for description
*/ */
mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write; mbedtls_ssl_ticket_write_t mbedtls_ssl_ticket_write;
/** /**
* \brief Implementation of the ticket parse callback * \brief Implementation of the ticket parse callback
* *
* \note See \c mbedlts_ssl_ticket_parse_t for description * \note See \c mbedtls_ssl_ticket_parse_t for description
*/ */
mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse; mbedtls_ssl_ticket_parse_t mbedtls_ssl_ticket_parse;
......
...@@ -36,13 +36,16 @@ ...@@ -36,13 +36,16 @@
extern "C" { extern "C" {
#endif #endif
/* MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE is deprecated and should not be
* used. */
#define MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE -0x001A /**< The selected feature is not available. */ #define MBEDTLS_ERR_THREADING_FEATURE_UNAVAILABLE -0x001A /**< The selected feature is not available. */
#define MBEDTLS_ERR_THREADING_BAD_INPUT_DATA -0x001C /**< Bad input parameters to function. */ #define MBEDTLS_ERR_THREADING_BAD_INPUT_DATA -0x001C /**< Bad input parameters to function. */
#define MBEDTLS_ERR_THREADING_MUTEX_ERROR -0x001E /**< Locking / unlocking / free failed with error code. */ #define MBEDTLS_ERR_THREADING_MUTEX_ERROR -0x001E /**< Locking / unlocking / free failed with error code. */
#if defined(MBEDTLS_THREADING_PTHREAD) #if defined(MBEDTLS_THREADING_PTHREAD)
#include <pthread.h> #include <pthread.h>
typedef struct typedef struct mbedtls_threading_mutex_t
{ {
pthread_mutex_t mutex; pthread_mutex_t mutex;
char is_valid; char is_valid;
...@@ -99,9 +102,17 @@ extern int (*mbedtls_mutex_unlock)( mbedtls_threading_mutex_t *mutex ); ...@@ -99,9 +102,17 @@ extern int (*mbedtls_mutex_unlock)( mbedtls_threading_mutex_t *mutex );
#if defined(MBEDTLS_FS_IO) #if defined(MBEDTLS_FS_IO)
extern mbedtls_threading_mutex_t mbedtls_threading_readdir_mutex; extern mbedtls_threading_mutex_t mbedtls_threading_readdir_mutex;
#endif #endif
#if defined(MBEDTLS_HAVE_TIME_DATE)
#if defined(MBEDTLS_HAVE_TIME_DATE) && !defined(MBEDTLS_PLATFORM_GMTIME_R_ALT)
/* This mutex may or may not be used in the default definition of
* mbedtls_platform_gmtime_r(), but in order to determine that,
* we need to check POSIX features, hence modify _POSIX_C_SOURCE.
* With the current approach, this declaration is orphaned, lacking
* an accompanying definition, in case mbedtls_platform_gmtime_r()
* doesn't need it, but that's not a problem. */
extern mbedtls_threading_mutex_t mbedtls_threading_gmtime_mutex; extern mbedtls_threading_mutex_t mbedtls_threading_gmtime_mutex;
#endif #endif /* MBEDTLS_HAVE_TIME_DATE && !MBEDTLS_PLATFORM_GMTIME_R_ALT */
#endif /* MBEDTLS_THREADING_C */ #endif /* MBEDTLS_THREADING_C */
#ifdef __cplusplus #ifdef __cplusplus
......
...@@ -30,16 +30,16 @@ ...@@ -30,16 +30,16 @@
#include MBEDTLS_CONFIG_FILE #include MBEDTLS_CONFIG_FILE
#endif #endif
#if !defined(MBEDTLS_TIMING_ALT)
// Regular implementation
//
#include <stdint.h> #include <stdint.h>
#ifdef __cplusplus #ifdef __cplusplus
extern "C" { extern "C" {
#endif #endif
#if !defined(MBEDTLS_TIMING_ALT)
// Regular implementation
//
/** /**
* \brief timer structure * \brief timer structure
*/ */
...@@ -51,13 +51,17 @@ struct mbedtls_timing_hr_time ...@@ -51,13 +51,17 @@ struct mbedtls_timing_hr_time
/** /**
* \brief Context for mbedtls_timing_set/get_delay() * \brief Context for mbedtls_timing_set/get_delay()
*/ */
typedef struct typedef struct mbedtls_timing_delay_context
{ {
struct mbedtls_timing_hr_time timer; struct mbedtls_timing_hr_time timer;
uint32_t int_ms; uint32_t int_ms;
uint32_t fin_ms; uint32_t fin_ms;
} mbedtls_timing_delay_context; } mbedtls_timing_delay_context;
#else /* MBEDTLS_TIMING_ALT */
#include "timing_alt.h"
#endif /* MBEDTLS_TIMING_ALT */
extern volatile int mbedtls_timing_alarmed; extern volatile int mbedtls_timing_alarmed;
/** /**
...@@ -133,18 +137,6 @@ void mbedtls_timing_set_delay( void *data, uint32_t int_ms, uint32_t fin_ms ); ...@@ -133,18 +137,6 @@ void mbedtls_timing_set_delay( void *data, uint32_t int_ms, uint32_t fin_ms );
*/ */
int mbedtls_timing_get_delay( void *data ); int mbedtls_timing_get_delay( void *data );
#ifdef __cplusplus
}
#endif
#else /* MBEDTLS_TIMING_ALT */
#include "timing_alt.h"
#endif /* MBEDTLS_TIMING_ALT */
#ifdef __cplusplus
extern "C" {
#endif
#if defined(MBEDTLS_SELF_TEST) #if defined(MBEDTLS_SELF_TEST)
/** /**
* \brief Checkup routine * \brief Checkup routine
......
...@@ -39,17 +39,17 @@ ...@@ -39,17 +39,17 @@
* Major, Minor, Patchlevel * Major, Minor, Patchlevel
*/ */
#define MBEDTLS_VERSION_MAJOR 2 #define MBEDTLS_VERSION_MAJOR 2
#define MBEDTLS_VERSION_MINOR 7 #define MBEDTLS_VERSION_MINOR 16
#define MBEDTLS_VERSION_PATCH 9 #define MBEDTLS_VERSION_PATCH 3
/** /**
* The single version number has the following structure: * The single version number has the following structure:
* MMNNPP00 * MMNNPP00
* Major version | Minor version | Patch version * Major version | Minor version | Patch version
*/ */
#define MBEDTLS_VERSION_NUMBER 0x02070900 #define MBEDTLS_VERSION_NUMBER 0x02100300
#define MBEDTLS_VERSION_STRING "2.7.9" #define MBEDTLS_VERSION_STRING "2.16.3"
#define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.7.9" #define MBEDTLS_VERSION_STRING_FULL "mbed TLS 2.16.3"
#if defined(MBEDTLS_VERSION_C) #if defined(MBEDTLS_VERSION_C)
......
...@@ -77,7 +77,7 @@ ...@@ -77,7 +77,7 @@
#define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880 /**< Allocation of memory failed. */ #define MBEDTLS_ERR_X509_ALLOC_FAILED -0x2880 /**< Allocation of memory failed. */
#define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900 /**< Read/write of file failed. */ #define MBEDTLS_ERR_X509_FILE_IO_ERROR -0x2900 /**< Read/write of file failed. */
#define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980 /**< Destination buffer is too small. */ #define MBEDTLS_ERR_X509_BUFFER_TOO_SMALL -0x2980 /**< Destination buffer is too small. */
#define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 /**< A fatal error occured, eg the chain is too long or the vrfy callback failed. */ #define MBEDTLS_ERR_X509_FATAL_ERROR -0x3000 /**< A fatal error occurred, eg the chain is too long or the vrfy callback failed. */
/* \} name */ /* \} name */
/** /**
...@@ -250,7 +250,7 @@ int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *se ...@@ -250,7 +250,7 @@ int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *se
* *
* \param to mbedtls_x509_time to check * \param to mbedtls_x509_time to check
* *
* \return 1 if the given time is in the past or an error occured, * \return 1 if the given time is in the past or an error occurred,
* 0 otherwise. * 0 otherwise.
*/ */
int mbedtls_x509_time_is_past( const mbedtls_x509_time *to ); int mbedtls_x509_time_is_past( const mbedtls_x509_time *to );
...@@ -264,11 +264,13 @@ int mbedtls_x509_time_is_past( const mbedtls_x509_time *to ); ...@@ -264,11 +264,13 @@ int mbedtls_x509_time_is_past( const mbedtls_x509_time *to );
* *
* \param from mbedtls_x509_time to check * \param from mbedtls_x509_time to check
* *
* \return 1 if the given time is in the future or an error occured, * \return 1 if the given time is in the future or an error occurred,
* 0 otherwise. * 0 otherwise.
*/ */
int mbedtls_x509_time_is_future( const mbedtls_x509_time *from ); int mbedtls_x509_time_is_future( const mbedtls_x509_time *from );
#if defined(MBEDTLS_SELF_TEST)
/** /**
* \brief Checkup routine * \brief Checkup routine
* *
...@@ -276,6 +278,8 @@ int mbedtls_x509_time_is_future( const mbedtls_x509_time *from ); ...@@ -276,6 +278,8 @@ int mbedtls_x509_time_is_future( const mbedtls_x509_time *from );
*/ */
int mbedtls_x509_self_test( int verbose ); int mbedtls_x509_self_test( int verbose );
#endif /* MBEDTLS_SELF_TEST */
/* /*
* Internal module functions. You probably do not want to use these unless you * Internal module functions. You probably do not want to use these unless you
* know you do. * know you do.
......
...@@ -111,7 +111,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain, ...@@ -111,7 +111,7 @@ int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
/** /**
* \brief Parse one or more CRLs and append them to the chained list * \brief Parse one or more CRLs and append them to the chained list
* *
* \note Mutliple CRLs are accepted only if using PEM format * \note Multiple CRLs are accepted only if using PEM format
* *
* \param chain points to the start of the chain * \param chain points to the start of the chain
* \param buf buffer holding the CRL data in PEM or DER format * \param buf buffer holding the CRL data in PEM or DER format
...@@ -126,7 +126,7 @@ int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, s ...@@ -126,7 +126,7 @@ int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, s
/** /**
* \brief Load one or more CRLs and append them to the chained list * \brief Load one or more CRLs and append them to the chained list
* *
* \note Mutliple CRLs are accepted only if using PEM format * \note Multiple CRLs are accepted only if using PEM format
* *
* \param chain points to the start of the chain * \param chain points to the start of the chain
* \param path filename to read the CRLs from (in PEM or DER encoding) * \param path filename to read the CRLs from (in PEM or DER encoding)
......
...@@ -98,14 +98,14 @@ mbedtls_x509_crt; ...@@ -98,14 +98,14 @@ mbedtls_x509_crt;
* Build flag from an algorithm/curve identifier (pk, md, ecp) * Build flag from an algorithm/curve identifier (pk, md, ecp)
* Since 0 is always XXX_NONE, ignore it. * Since 0 is always XXX_NONE, ignore it.
*/ */
#define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( id - 1 ) ) #define MBEDTLS_X509_ID_FLAG( id ) ( 1 << ( (id) - 1 ) )
/** /**
* Security profile for certificate verification. * Security profile for certificate verification.
* *
* All lists are bitfields, built by ORing flags from MBEDTLS_X509_ID_FLAG(). * All lists are bitfields, built by ORing flags from MBEDTLS_X509_ID_FLAG().
*/ */
typedef struct typedef struct mbedtls_x509_crt_profile
{ {
uint32_t allowed_mds; /**< MDs for signatures */ uint32_t allowed_mds; /**< MDs for signatures */
uint32_t allowed_pks; /**< PK algs for signatures */ uint32_t allowed_pks; /**< PK algs for signatures */
...@@ -143,6 +143,63 @@ typedef struct mbedtls_x509write_cert ...@@ -143,6 +143,63 @@ typedef struct mbedtls_x509write_cert
} }
mbedtls_x509write_cert; mbedtls_x509write_cert;
/**
* Item in a verification chain: cert and flags for it
*/
typedef struct {
mbedtls_x509_crt *crt;
uint32_t flags;
} mbedtls_x509_crt_verify_chain_item;
/**
* Max size of verification chain: end-entity + intermediates + trusted root
*/
#define MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE ( MBEDTLS_X509_MAX_INTERMEDIATE_CA + 2 )
/**
* Verification chain as built by \c mbedtls_crt_verify_chain()
*/
typedef struct
{
mbedtls_x509_crt_verify_chain_item items[MBEDTLS_X509_MAX_VERIFY_CHAIN_SIZE];
unsigned len;
} mbedtls_x509_crt_verify_chain;
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
/**
* \brief Context for resuming X.509 verify operations
*/
typedef struct
{
/* for check_signature() */
mbedtls_pk_restart_ctx pk;
/* for find_parent_in() */
mbedtls_x509_crt *parent; /* non-null iff parent_in in progress */
mbedtls_x509_crt *fallback_parent;
int fallback_signature_is_good;
/* for find_parent() */
int parent_is_trusted; /* -1 if find_parent is not in progress */
/* for verify_chain() */
enum {
x509_crt_rs_none,
x509_crt_rs_find_parent,
} in_progress; /* none if no operation is in progress */
int self_cnt;
mbedtls_x509_crt_verify_chain ver_chain;
} mbedtls_x509_crt_restart_ctx;
#else /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
/* Now we can declare functions that take a pointer to that */
typedef void mbedtls_x509_crt_restart_ctx;
#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
#if defined(MBEDTLS_X509_CRT_PARSE_C) #if defined(MBEDTLS_X509_CRT_PARSE_C)
/** /**
* Default security profile. Should provide a good balance between security * Default security profile. Should provide a good balance between security
...@@ -368,6 +425,37 @@ int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt, ...@@ -368,6 +425,37 @@ int mbedtls_x509_crt_verify_with_profile( mbedtls_x509_crt *crt,
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *), int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
void *p_vrfy ); void *p_vrfy );
/**
* \brief Restartable version of \c mbedtls_crt_verify_with_profile()
*
* \note Performs the same job as \c mbedtls_crt_verify_with_profile()
* but can return early and restart according to the limit
* set with \c mbedtls_ecp_set_max_ops() to reduce blocking.
*
* \param crt a certificate (chain) to be verified
* \param trust_ca the list of trusted CAs
* \param ca_crl the list of CRLs for trusted CAs
* \param profile security profile for verification
* \param cn expected Common Name (can be set to
* NULL if the CN must not be verified)
* \param flags result of the verification
* \param f_vrfy verification function
* \param p_vrfy verification parameter
* \param rs_ctx restart context (NULL to disable restart)
*
* \return See \c mbedtls_crt_verify_with_profile(), or
* \return #MBEDTLS_ERR_ECP_IN_PROGRESS if maximum number of
* operations was reached: see \c mbedtls_ecp_set_max_ops().
*/
int mbedtls_x509_crt_verify_restartable( mbedtls_x509_crt *crt,
mbedtls_x509_crt *trust_ca,
mbedtls_x509_crl *ca_crl,
const mbedtls_x509_crt_profile *profile,
const char *cn, uint32_t *flags,
int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
void *p_vrfy,
mbedtls_x509_crt_restart_ctx *rs_ctx );
#if defined(MBEDTLS_X509_CHECK_KEY_USAGE) #if defined(MBEDTLS_X509_CHECK_KEY_USAGE)
/** /**
* \brief Check usage of certificate against keyUsage extension. * \brief Check usage of certificate against keyUsage extension.
...@@ -439,6 +527,18 @@ void mbedtls_x509_crt_init( mbedtls_x509_crt *crt ); ...@@ -439,6 +527,18 @@ void mbedtls_x509_crt_init( mbedtls_x509_crt *crt );
* \param crt Certificate chain to free * \param crt Certificate chain to free
*/ */
void mbedtls_x509_crt_free( mbedtls_x509_crt *crt ); void mbedtls_x509_crt_free( mbedtls_x509_crt *crt );
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
/**
* \brief Initialize a restart context
*/
void mbedtls_x509_crt_restart_init( mbedtls_x509_crt_restart_ctx *ctx );
/**
* \brief Free the components of a restart context
*/
void mbedtls_x509_crt_restart_free( mbedtls_x509_crt_restart_ctx *ctx );
#endif /* MBEDTLS_ECDSA_C && MBEDTLS_ECP_RESTARTABLE */
#endif /* MBEDTLS_X509_CRT_PARSE_C */ #endif /* MBEDTLS_X509_CRT_PARSE_C */
/* \} name */ /* \} name */
......
...@@ -205,6 +205,14 @@ void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_ty ...@@ -205,6 +205,14 @@ void mbedtls_x509write_csr_set_md_alg( mbedtls_x509write_csr *ctx, mbedtls_md_ty
* \param key_usage key usage flags to set * \param key_usage key usage flags to set
* *
* \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED * \return 0 if successful, or MBEDTLS_ERR_X509_ALLOC_FAILED
*
* \note The <code>decipherOnly</code> flag from the Key Usage
* extension is represented by bit 8 (i.e.
* <code>0x8000</code>), which cannot typically be represented
* in an unsigned char. Therefore, the flag
* <code>decipherOnly</code> (i.e.
* #MBEDTLS_X509_KU_DECIPHER_ONLY) cannot be set using this
* function.
*/ */
int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage ); int mbedtls_x509write_csr_set_key_usage( mbedtls_x509write_csr *ctx, unsigned char key_usage );
......
...@@ -37,25 +37,31 @@ ...@@ -37,25 +37,31 @@
#define MBEDTLS_XTEA_DECRYPT 0 #define MBEDTLS_XTEA_DECRYPT 0
#define MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH -0x0028 /**< The data input has an invalid length. */ #define MBEDTLS_ERR_XTEA_INVALID_INPUT_LENGTH -0x0028 /**< The data input has an invalid length. */
#define MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED -0x0029 /**< XTEA hardware accelerator failed. */
#if !defined(MBEDTLS_XTEA_ALT) /* MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED is deprecated and should not be used. */
// Regular implementation #define MBEDTLS_ERR_XTEA_HW_ACCEL_FAILED -0x0029 /**< XTEA hardware accelerator failed. */
//
#ifdef __cplusplus #ifdef __cplusplus
extern "C" { extern "C" {
#endif #endif
#if !defined(MBEDTLS_XTEA_ALT)
// Regular implementation
//
/** /**
* \brief XTEA context structure * \brief XTEA context structure
*/ */
typedef struct typedef struct mbedtls_xtea_context
{ {
uint32_t k[4]; /*!< key */ uint32_t k[4]; /*!< key */
} }
mbedtls_xtea_context; mbedtls_xtea_context;
#else /* MBEDTLS_XTEA_ALT */
#include "xtea_alt.h"
#endif /* MBEDTLS_XTEA_ALT */
/** /**
* \brief Initialize XTEA context * \brief Initialize XTEA context
* *
...@@ -115,17 +121,7 @@ int mbedtls_xtea_crypt_cbc( mbedtls_xtea_context *ctx, ...@@ -115,17 +121,7 @@ int mbedtls_xtea_crypt_cbc( mbedtls_xtea_context *ctx,
unsigned char *output); unsigned char *output);
#endif /* MBEDTLS_CIPHER_MODE_CBC */ #endif /* MBEDTLS_CIPHER_MODE_CBC */
#ifdef __cplusplus #if defined(MBEDTLS_SELF_TEST)
}
#endif
#else /* MBEDTLS_XTEA_ALT */
#include "xtea_alt.h"
#endif /* MBEDTLS_XTEA_ALT */
#ifdef __cplusplus
extern "C" {
#endif
/** /**
* \brief Checkup routine * \brief Checkup routine
...@@ -134,6 +130,8 @@ extern "C" { ...@@ -134,6 +130,8 @@ extern "C" {
*/ */
int mbedtls_xtea_self_test( int verbose ); int mbedtls_xtea_self_test( int verbose );
#endif /* MBEDTLS_SELF_TEST */
#ifdef __cplusplus #ifdef __cplusplus
} }
#endif #endif
......
/*
* ESPRSSIF MIT License
*
* Copyright (c) 2016 <ESPRESSIF SYSTEMS (SHANGHAI) PTE LTD>
*
* Permission is hereby granted for use on ESPRESSIF SYSTEMS ESP8266 only, in which case,
* it is free of charge, to any person obtaining a copy of this software and associated
* documentation files (the "Software"), to deal in the Software without restriction, including
* without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
* and/or sell copies of the Software, and to permit persons to whom the Software is furnished
* to do so, subject to the following conditions:
*
* The above copyright notice and this permission notice shall be included in all copies or
* substantial portions of the Software.
*
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
*
*/
#ifndef ESPCONN_MEM_H_
#define ESPCONN_MEM_H_
void *espconn_memzalloc(size_t size);
void espconn_memfree(void *fp);
void *espconn_memcpy(void *dst, const void *src, size_t size);
#endif
...@@ -38,16 +38,6 @@ ...@@ -38,16 +38,6 @@
#include "mbedtls/ctr_drbg.h" #include "mbedtls/ctr_drbg.h"
typedef struct espconn *pmbedtls_espconn; typedef struct espconn *pmbedtls_espconn;
typedef struct espconn mbedtls_espconn; typedef struct espconn mbedtls_espconn;
typedef struct{
int record_len;
}mbedtls_record;
#if defined(ESP8266_PLATFORM)
typedef struct{
uint8* finished_buf;
int finished_len;
}mbedtls_finished, *pmbedtls_finished;
#endif
typedef struct{ typedef struct{
// mbedtls_entropy_context entropy; // mbedtls_entropy_context entropy;
...@@ -58,10 +48,7 @@ typedef struct{ ...@@ -58,10 +48,7 @@ typedef struct{
typedef struct{ typedef struct{
bool quiet; bool quiet;
mbedtls_record record; int record_len;
#if defined(ESP8266_PLATFORM)
pmbedtls_finished pfinished;
#endif
pmbedtls_session psession; pmbedtls_session psession;
mbedtls_net_context fd; mbedtls_net_context fd;
mbedtls_net_context listen_fd; mbedtls_net_context listen_fd;
......
...@@ -102,20 +102,10 @@ typedef enum{ ...@@ -102,20 +102,10 @@ typedef enum{
}\ }\
}while(0) }while(0)
#define lwIP_EVENT_PARSE(s, error) \
do { \
mbedtls_parse_internal(s, error); \
} while (0)
#define lwIP_EVENT_THREAD(s, event, error) \
do { \
mbedtls_parse_thread(s, event, error); \
}while(0)
typedef enum{ typedef enum{
ENTCONN_EVENT_NONE = 0, NETCONN_EVENT_NONE = 0,
NETCONN_EVENT_ESTABLISHED = 1, NETCONN_EVENT_ESTABLISHED = 1,
ENTCONN_EVENT_RECV = 2, NETCONN_EVENT_RECV = 2,
NETCONN_EVENT_SEND = 3, NETCONN_EVENT_SEND = 3,
NETCONN_EVENT_ERROR = 4, NETCONN_EVENT_ERROR = 4,
NETCONN_EVENT_CLOSE = 5, NETCONN_EVENT_CLOSE = 5,
......
...@@ -94,7 +94,6 @@ ...@@ -94,7 +94,6 @@
// are by firmware code, and can be enabled if you need this functionality. // are by firmware code, and can be enabled if you need this functionality.
//#define CLIENT_SSL_ENABLE //#define CLIENT_SSL_ENABLE
//#define MD2_ENABLE
#define SHA2_ENABLE #define SHA2_ENABLE
#define SSL_BUFFER_SIZE 4096 #define SSL_BUFFER_SIZE 4096
#define SSL_MAX_FRAGMENT_LENGTH_CODE MBEDTLS_SSL_MAX_FRAG_LEN_4096 #define SSL_MAX_FRAGMENT_LENGTH_CODE MBEDTLS_SSL_MAX_FRAG_LEN_4096
......
...@@ -151,7 +151,7 @@ ...@@ -151,7 +151,7 @@
#undef MBEDTLS_SSL_PROTO_SSL3 #undef MBEDTLS_SSL_PROTO_SSL3
#undef MBEDTLS_SSL_PROTO_TLS1 #undef MBEDTLS_SSL_PROTO_TLS1
#define MBEDTLS_SSL_PROTO_TLS1_1 #undef MBEDTLS_SSL_PROTO_TLS1_1
#define MBEDTLS_SSL_PROTO_TLS1_2 #define MBEDTLS_SSL_PROTO_TLS1_2
#undef MBEDTLS_SSL_PROTO_DTLS #undef MBEDTLS_SSL_PROTO_DTLS
...@@ -214,7 +214,7 @@ ...@@ -214,7 +214,7 @@
#define MBEDTLS_MD_C #define MBEDTLS_MD_C
#undef MBEDTLS_MD2_C #undef MBEDTLS_MD2_C
#undef MBEDTLS_MD4_C #undef MBEDTLS_MD4_C
#define MBEDTLS_MD5_C /* Remove when we drop support for TLS 1.1 */ #undef MBEDTLS_MD5_C
#undef MBEDTLS_MEMORY_BUFFER_ALLOC_C #undef MBEDTLS_MEMORY_BUFFER_ALLOC_C
#define MBEDTLS_NET_C #define MBEDTLS_NET_C
#define MBEDTLS_OID_C #define MBEDTLS_OID_C
......
#include <stdint.h>
#include "mem.h"
#include "user_interface.h"
void *espconn_memzalloc(size_t size, char* file, int line)
{
void *mp = NULL;
if ((mp = (void*)os_malloc(size)) == NULL){
} else{
//os_printf("%s %d %p %d\n",file, line, mp, size);
os_memset(mp, 0, size);
}
return mp;
}
void espconn_memfree(void *fp, char* file, int line)
{
//os_printf("%s %d %p\n",file, line, fp);
os_free(fp);
fp = NULL;
}
void *espconn_memcpy(void *dst, const void *src, size_t size, char *file, int line)
{
char *psrc = NULL;
char *pdst = NULL;
if(NULL == dst || NULL == src)
{
return NULL;
}
//os_printf("%s %d %p %p %d\n",file, line, dst, src, size);
if((src < dst) && (char *)src + size > (char *)dst)
{
psrc = (char *)src + size - 1;
pdst = (char *)dst + size - 1;
while(size--)
{
*pdst-- = *psrc--;
}
}
else
{
psrc = (char *)src;
pdst = (char *)dst;
while(size--)
{
*pdst++ = *psrc++;
}
}
return dst;
}
void *espconn_memcalloc(size_t count, size_t size)
{
void *cp = NULL;
cp = espconn_memzalloc(count * size, __FILE__, __LINE__);
return cp;
}
void espconn_memFree(void *fp)
{
espconn_memfree(fp, __FILE__, __LINE__);
}
void *espconn_memCpy(void *dst, const void *src, size_t size)
{
return espconn_memcpy(dst, src, size, __FILE__, __LINE__);
}
...@@ -48,29 +48,21 @@ static espconn_msg *plink_server = NULL; ...@@ -48,29 +48,21 @@ static espconn_msg *plink_server = NULL;
static pmbedtls_parame def_certificate = NULL; static pmbedtls_parame def_certificate = NULL;
static pmbedtls_parame def_private_key = NULL; static pmbedtls_parame def_private_key = NULL;
#if defined(ESP8266_PLATFORM)
#define MBEDTLS_SSL_OUTBUFFER_LEN ( MBEDTLS_SSL_PLAIN_ADD \
+ MBEDTLS_SSL_COMPRESSION_ADD \
+ 29 /* counter + header + IV */ \
+ MBEDTLS_SSL_MAC_ADD \
+ MBEDTLS_SSL_PADDING_ADD \
)
#endif
/* Implementation that should never be optimized out by the compiler */ /* Implementation that should never be optimized out by the compiler */
static void mbedtls_zeroize( void *v, size_t n ) { static void mbedtls_zeroize( void *v, size_t n ) {
volatile unsigned char *p = v; while( n-- ) *p++ = 0; volatile unsigned char *p = v;
while( n-- ) *p++ = 0;
} }
static pmbedtls_parame mbedtls_parame_new(size_t capacity) static pmbedtls_parame mbedtls_parame_new(size_t capacity)
{ {
pmbedtls_parame rb = (pmbedtls_parame)os_zalloc(sizeof(mbedtls_parame)); pmbedtls_parame rb = (pmbedtls_parame)os_zalloc(sizeof(mbedtls_parame));
if (rb && capacity != 0){ if (rb && capacity != 0) {
rb->parame_datalen = capacity; rb->parame_datalen = capacity;
rb->parame_data = (uint8*)os_zalloc(rb->parame_datalen + 1); rb->parame_data = (uint8*)os_zalloc(rb->parame_datalen + 1);
if (rb->parame_data){ if (rb->parame_data) {
} else{ } else {
os_free(rb); os_free(rb);
rb = NULL; rb = NULL;
} }
...@@ -94,44 +86,44 @@ bool mbedtls_load_default_obj(uint32 flash_sector, int obj_type, const unsigned ...@@ -94,44 +86,44 @@ bool mbedtls_load_default_obj(uint32 flash_sector, int obj_type, const unsigned
uint32 mbedtls_head = 0; uint32 mbedtls_head = 0;
bool mbedtls_load_flag = false; bool mbedtls_load_flag = false;
if (flash_sector != 0){ if (flash_sector != 0) {
spi_flash_read(flash_sector * FLASH_SECTOR_SIZE, (uint32*)&mbedtls_head, 4); spi_flash_read(flash_sector * FLASH_SECTOR_SIZE, (uint32*)&mbedtls_head, 4);
if (mbedtls_head != ESPCONN_INVALID_TYPE){ if (mbedtls_head != ESPCONN_INVALID_TYPE) {
mbedtls_write = mbedtls_parame_new(0); mbedtls_write = mbedtls_parame_new(0);
mbedtls_write->parame_datalen = length; mbedtls_write->parame_datalen = length;
} }
} else{ } else {
const char* const begin = "-----BEGIN"; const char* const begin = "-----BEGIN";
int format_type = ESPCONN_FORMAT_INIT; int format_type = ESPCONN_FORMAT_INIT;
/* /*
* Determine data content. data contains either one DER certificate or * Determine data content. data contains either one DER certificate or
* one or more PEM certificates. * one or more PEM certificates.
*/ */
if ((char*)os_strstr(load_buf, begin) != NULL){ if ((char*)os_strstr(load_buf, begin) != NULL) {
format_type = ESPCONN_FORMAT_PEM; format_type = ESPCONN_FORMAT_PEM;
}else{ } else {
format_type = ESPCONN_FORMAT_DER; format_type = ESPCONN_FORMAT_DER;
} }
if (format_type == ESPCONN_FORMAT_PEM){ if (format_type == ESPCONN_FORMAT_PEM) {
length += 1; length += 1;
} }
mbedtls_write = mbedtls_parame_new(length); mbedtls_write = mbedtls_parame_new(length);
if (mbedtls_write){ if (mbedtls_write) {
os_memcpy(mbedtls_write->parame_data, load_buf, length); os_memcpy(mbedtls_write->parame_data, load_buf, length);
if (format_type == ESPCONN_FORMAT_PEM) if (format_type == ESPCONN_FORMAT_PEM)
mbedtls_write->parame_data[length - 1] = '\0'; mbedtls_write->parame_data[length - 1] = '\0';
} }
} }
if (mbedtls_write){ if (mbedtls_write) {
mbedtls_load_flag = true; mbedtls_load_flag = true;
mbedtls_write->parame_type = obj_type; mbedtls_write->parame_type = obj_type;
mbedtls_write->parame_sec = flash_sector; mbedtls_write->parame_sec = flash_sector;
if (obj_type == ESPCONN_PK){ if (obj_type == ESPCONN_PK) {
def_private_key = mbedtls_write; def_private_key = mbedtls_write;
} else{ } else {
def_certificate = mbedtls_write; def_certificate = mbedtls_write;
} }
} }
...@@ -144,29 +136,29 @@ static unsigned char* mbedtls_get_default_obj(uint32 *sec, uint32 type, uint32 * ...@@ -144,29 +136,29 @@ static unsigned char* mbedtls_get_default_obj(uint32 *sec, uint32 type, uint32 *
unsigned char *parame_data = NULL; unsigned char *parame_data = NULL;
pmbedtls_parame mbedtls_obj = NULL; pmbedtls_parame mbedtls_obj = NULL;
if (type == ESPCONN_PK){ if (type == ESPCONN_PK) {
mbedtls_obj = def_private_key; mbedtls_obj = def_private_key;
} else{ } else {
mbedtls_obj = def_certificate; mbedtls_obj = def_certificate;
} }
if (mbedtls_obj->parame_sec != 0){ if (mbedtls_obj->parame_sec != 0) {
#define DATA_OFFSET 4 #define DATA_OFFSET 4
uint32 data_len = mbedtls_obj->parame_datalen; uint32 data_len = mbedtls_obj->parame_datalen;
parame_data = (unsigned char *)os_zalloc(data_len + DATA_OFFSET); parame_data = (unsigned char *)os_zalloc(data_len + DATA_OFFSET);
if (parame_data){ if (parame_data) {
spi_flash_read(mbedtls_obj->parame_sec * FLASH_SECTOR_SIZE, (uint32*)parame_data, data_len); spi_flash_read(mbedtls_obj->parame_sec * FLASH_SECTOR_SIZE, (uint32*)parame_data, data_len);
/* /*
* Determine buffer content. Buffer contains either one DER certificate or * Determine buffer content. Buffer contains either one DER certificate or
* one or more PEM certificates. * one or more PEM certificates.
*/ */
if ((char*)os_strstr(parame_data, begin) != NULL){ if ((char*)os_strstr(parame_data, begin) != NULL) {
data_len ++; data_len ++;
parame_data[data_len - 1] = '\0'; parame_data[data_len - 1] = '\0';
} }
} }
*len = data_len; *len = data_len;
} else{ } else {
parame_data = mbedtls_obj->parame_data; parame_data = mbedtls_obj->parame_data;
*len = mbedtls_obj->parame_datalen; *len = mbedtls_obj->parame_datalen;
} }
...@@ -201,43 +193,13 @@ exit: ...@@ -201,43 +193,13 @@ exit:
return ret; return ret;
} }
#if defined(ESP8266_PLATFORM)
static pmbedtls_finished mbedtls_finished_new(int len)
{
pmbedtls_finished finished = (pmbedtls_finished)os_zalloc(sizeof(mbedtls_finished));
if (finished)
{
finished->finished_len = len;
finished->finished_buf = (uint8*)os_zalloc(finished->finished_len + 1);
if (finished->finished_buf)
{
}
else
{
os_free(finished);
finished = NULL;
}
}
return finished;
}
static void mbedtls_finished_free(pmbedtls_finished *pfinished)
{
lwIP_ASSERT(pfinished);
lwIP_ASSERT(*pfinished);
os_free((*pfinished)->finished_buf);
os_free(*pfinished);
*pfinished = NULL;
}
#endif
static pmbedtls_espconn mbedtls_espconn_new(void) static pmbedtls_espconn mbedtls_espconn_new(void)
{ {
pmbedtls_espconn mbedtls_conn = NULL; pmbedtls_espconn mbedtls_conn = NULL;
mbedtls_conn = (pmbedtls_espconn)os_zalloc(sizeof(mbedtls_espconn)); mbedtls_conn = (pmbedtls_espconn)os_zalloc(sizeof(mbedtls_espconn));
if (mbedtls_conn){ if (mbedtls_conn) {
mbedtls_conn->proto.tcp = (esp_tcp *)os_zalloc(sizeof(esp_tcp)); mbedtls_conn->proto.tcp = (esp_tcp *)os_zalloc(sizeof(esp_tcp));
if (mbedtls_conn->proto.tcp == NULL){ if (mbedtls_conn->proto.tcp == NULL) {
os_free(mbedtls_conn); os_free(mbedtls_conn);
mbedtls_conn = NULL; mbedtls_conn = NULL;
} }
...@@ -261,7 +223,7 @@ static void mbedtls_espconn_free(pmbedtls_espconn *mbedtlsconn) ...@@ -261,7 +223,7 @@ static void mbedtls_espconn_free(pmbedtls_espconn *mbedtlsconn)
static pmbedtls_session mbedtls_session_new(void) static pmbedtls_session mbedtls_session_new(void)
{ {
pmbedtls_session session = (pmbedtls_session)os_zalloc(sizeof(mbedtls_session)); pmbedtls_session session = (pmbedtls_session)os_zalloc(sizeof(mbedtls_session));
if (session){ if (session) {
mbedtls_x509_crt_init(&session->cacert); mbedtls_x509_crt_init(&session->cacert);
mbedtls_x509_crt_init(&session->clicert); mbedtls_x509_crt_init(&session->clicert);
mbedtls_pk_init(&session->pkey); mbedtls_pk_init(&session->pkey);
...@@ -289,7 +251,7 @@ static pmbedtls_msg mbedtls_msg_new(void) ...@@ -289,7 +251,7 @@ static pmbedtls_msg mbedtls_msg_new(void)
if (msg) { if (msg) {
os_bzero(msg, sizeof(mbedtls_msg)); os_bzero(msg, sizeof(mbedtls_msg));
msg->psession = mbedtls_session_new(); msg->psession = mbedtls_session_new();
if (msg->psession){ if (msg->psession) {
mbedtls_net_init(&msg->listen_fd); mbedtls_net_init(&msg->listen_fd);
mbedtls_net_init(&msg->fd); mbedtls_net_init(&msg->fd);
mbedtls_ssl_init(&msg->ssl); mbedtls_ssl_init(&msg->ssl);
...@@ -299,7 +261,7 @@ static pmbedtls_msg mbedtls_msg_new(void) ...@@ -299,7 +261,7 @@ static pmbedtls_msg mbedtls_msg_new(void)
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && defined(SSL_MAX_FRAGMENT_LENGTH_CODE) #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) && defined(SSL_MAX_FRAGMENT_LENGTH_CODE)
mbedtls_ssl_conf_max_frag_len(&msg->conf, SSL_MAX_FRAGMENT_LENGTH_CODE); mbedtls_ssl_conf_max_frag_len(&msg->conf, SSL_MAX_FRAGMENT_LENGTH_CODE);
#endif #endif
} else{ } else {
os_free(msg); os_free(msg);
msg = NULL; msg = NULL;
} }
...@@ -312,17 +274,9 @@ static void mbedtls_msg_server_step(pmbedtls_msg msg) ...@@ -312,17 +274,9 @@ static void mbedtls_msg_server_step(pmbedtls_msg msg)
lwIP_ASSERT(msg); lwIP_ASSERT(msg);
/*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/ /*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/
if (msg->psession){ if (msg->psession) {
mbedtls_session_free(&msg->psession); mbedtls_session_free(&msg->psession);
} }
#if defined(ESP8266_PLATFORM)
if (msg->quiet && msg->ssl.out_buf)
{
mbedtls_zeroize(msg->ssl.out_buf, MBEDTLS_SSL_OUTBUFFER_LEN);
os_free(msg->ssl.out_buf);
msg->ssl.out_buf = NULL;
}
#endif
mbedtls_entropy_free(&msg->entropy); mbedtls_entropy_free(&msg->entropy);
mbedtls_ssl_free(&msg->ssl); mbedtls_ssl_free(&msg->ssl);
mbedtls_ssl_config_free(&msg->conf); mbedtls_ssl_config_free(&msg->conf);
...@@ -331,7 +285,7 @@ static void mbedtls_msg_server_step(pmbedtls_msg msg) ...@@ -331,7 +285,7 @@ static void mbedtls_msg_server_step(pmbedtls_msg msg)
/*New connection ensure that each initial for next handshake */ /*New connection ensure that each initial for next handshake */
os_bzero(msg, sizeof(mbedtls_msg)); os_bzero(msg, sizeof(mbedtls_msg));
msg->psession = mbedtls_session_new(); msg->psession = mbedtls_session_new();
if (msg->psession){ if (msg->psession) {
mbedtls_net_init(&msg->fd); mbedtls_net_init(&msg->fd);
mbedtls_ssl_init(&msg->ssl); mbedtls_ssl_init(&msg->ssl);
mbedtls_ssl_config_init(&msg->conf); mbedtls_ssl_config_init(&msg->conf);
...@@ -346,19 +300,9 @@ static void mbedtls_msg_free(pmbedtls_msg *msg) ...@@ -346,19 +300,9 @@ static void mbedtls_msg_free(pmbedtls_msg *msg)
lwIP_ASSERT(*msg); lwIP_ASSERT(*msg);
/*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/ /*to prevent memory leaks, ensure that each allocated is deleted at every handshake*/
if ((*msg)->psession){ if ((*msg)->psession) {
mbedtls_session_free(&((*msg)->psession)); mbedtls_session_free(&((*msg)->psession));
} }
#if defined(ESP8266_PLATFORM)
if ((*msg)->quiet && (*msg)->ssl.out_buf)
{
mbedtls_zeroize((*msg)->ssl.out_buf, MBEDTLS_SSL_OUTBUFFER_LEN);
os_free((*msg)->ssl.out_buf);
(*msg)->ssl.out_buf = NULL;
}
if((*msg)->pfinished != NULL)
mbedtls_finished_free(&(*msg)->pfinished);
#endif
mbedtls_entropy_free(&(*msg)->entropy); mbedtls_entropy_free(&(*msg)->entropy);
mbedtls_ssl_free(&(*msg)->ssl); mbedtls_ssl_free(&(*msg)->ssl);
mbedtls_ssl_config_free(&(*msg)->conf); mbedtls_ssl_config_free(&(*msg)->conf);
...@@ -374,15 +318,15 @@ static espconn_msg* mbedtls_msg_find(int sock) ...@@ -374,15 +318,15 @@ static espconn_msg* mbedtls_msg_find(int sock)
pmbedtls_msg msg = NULL; pmbedtls_msg msg = NULL;
for (plist = plink_active; plist != NULL; plist = plist->pnext) { for (plist = plink_active; plist != NULL; plist = plist->pnext) {
if(plist->pssl != NULL){ if(plist->pssl != NULL) {
msg = plist->pssl; msg = plist->pssl;
if (msg->fd.fd == sock) if (msg->fd.fd == sock)
return plist; return plist;
} }
} }
for (plist = plink_server; plist != NULL; plist = plist->pnext){ for (plist = plink_server; plist != NULL; plist = plist->pnext) {
if(plist->pssl != NULL){ if(plist->pssl != NULL) {
msg = plist->pssl; msg = plist->pssl;
if (msg->listen_fd.fd == sock) if (msg->listen_fd.fd == sock)
return plist; return plist;
...@@ -408,7 +352,7 @@ static bool mbedtls_handshake_result(const pmbedtls_msg Threadmsg) ...@@ -408,7 +352,7 @@ static bool mbedtls_handshake_result(const pmbedtls_msg Threadmsg)
else else
ret = ssl_option.server.cert_ca_sector.flag; ret = ssl_option.server.cert_ca_sector.flag;
if (ret == 1){ if (ret == 1) {
ret = mbedtls_ssl_get_verify_result(&Threadmsg->ssl); ret = mbedtls_ssl_get_verify_result(&Threadmsg->ssl);
if (ret != 0) { if (ret != 0) {
char vrfy_buf[512]; char vrfy_buf[512];
...@@ -421,7 +365,7 @@ static bool mbedtls_handshake_result(const pmbedtls_msg Threadmsg) ...@@ -421,7 +365,7 @@ static bool mbedtls_handshake_result(const pmbedtls_msg Threadmsg)
return true; return true;
} else } else
return true; return true;
}else } else
return false; return false;
} }
...@@ -436,14 +380,14 @@ static void mbedtls_fail_info(espconn_msg *pinfo, int ret) ...@@ -436,14 +380,14 @@ static void mbedtls_fail_info(espconn_msg *pinfo, int ret)
* up. That's entirely normal and not worthy of the confusion it sows! * up. That's entirely normal and not worthy of the confusion it sows!
*/ */
if (ret != MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) { if (ret != MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
if (TLSmsg->quiet){ if (TLSmsg->quiet) {
if (pinfo->preverse != NULL) { if (pinfo->preverse != NULL) {
os_printf("server's data invalid protocol\n"); os_printf("server's data invalid protocol\n");
} else { } else {
os_printf("client's data invalid protocol\n"); os_printf("client's data invalid protocol\n");
} }
mbedtls_ssl_close_notify(&TLSmsg->ssl); mbedtls_ssl_close_notify(&TLSmsg->ssl);
} else{ } else {
if (pinfo->preverse != NULL) { if (pinfo->preverse != NULL) {
os_printf("server handshake failed!\n"); os_printf("server handshake failed!\n");
} else { } else {
...@@ -455,9 +399,9 @@ static void mbedtls_fail_info(espconn_msg *pinfo, int ret) ...@@ -455,9 +399,9 @@ static void mbedtls_fail_info(espconn_msg *pinfo, int ret)
os_printf("Reason:[-0x%2x]\n",-ret); os_printf("Reason:[-0x%2x]\n",-ret);
/*Error code convert*/ /*Error code convert*/
ret = -ret; ret = -ret;
if ((ret & 0xFF) != 0){ if ((ret & 0xFF) != 0) {
ret = ((ret >> 8) + ret); ret = ((ret >> 8) + ret);
} else{ } else {
ret >>= 8; ret >>= 8;
} }
pinfo->hs_status = -ret; pinfo->hs_status = -ret;
...@@ -469,82 +413,37 @@ exit: ...@@ -469,82 +413,37 @@ exit:
return; return;
} }
#if defined(ESP8266_PLATFORM)
int mbedtls_write_finished(mbedtls_ssl_context *ssl)
{
lwIP_ASSERT(ssl);
lwIP_ASSERT(ssl->p_bio);
int ret = ERR_OK;
int fd = ((mbedtls_net_context *) ssl->p_bio)->fd;
espconn_msg *Threadmsg = mbedtls_msg_find(fd);
lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
pmbedtls_msg TLSmsg = Threadmsg->pssl;
lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
TLSmsg->pfinished = mbedtls_finished_new(ssl->out_msglen + 29);
lwIP_REQUIRE_ACTION(TLSmsg->pfinished, exit, ret = ERR_MEM);
os_memcpy(TLSmsg->pfinished->finished_buf, ssl->out_ctr, TLSmsg->pfinished->finished_len);
exit:
return ret;
}
static int mbedtls_hanshake_finished(mbedtls_msg *msg)
{
lwIP_ASSERT(msg);
int ret = ERR_OK;
const size_t len = MBEDTLS_SSL_OUTBUFFER_LEN;
mbedtls_ssl_context *ssl = &msg->ssl;
lwIP_REQUIRE_ACTION(ssl, exit, ret = ERR_MEM);
pmbedtls_finished finished = msg->pfinished;
lwIP_REQUIRE_ACTION(finished, exit, ret = ERR_MEM);
ssl->out_buf = (unsigned char*)os_zalloc(len);
lwIP_REQUIRE_ACTION(ssl->out_buf, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
ssl->out_ctr = ssl->out_buf;
ssl->out_hdr = ssl->out_buf + 8;
ssl->out_len = ssl->out_buf + 11;
ssl->out_iv = ssl->out_buf + 13;
ssl->out_msg = ssl->out_buf + 29;
os_memcpy(ssl->out_ctr, finished->finished_buf, finished->finished_len);
mbedtls_finished_free(&msg->pfinished);
exit:
return ret;
}
#endif
static void mbedtls_handshake_succ(mbedtls_ssl_context *ssl) static void mbedtls_handshake_succ(mbedtls_ssl_context *ssl)
{ {
lwIP_ASSERT(ssl); lwIP_ASSERT(ssl);
if( ssl->handshake ) if( ssl->handshake )
{ {
mbedtls_ssl_handshake_free( ssl->handshake ); mbedtls_ssl_handshake_free( ssl );
mbedtls_ssl_transform_free( ssl->transform_negotiate ); mbedtls_ssl_transform_free( ssl->transform_negotiate );
mbedtls_ssl_session_free( ssl->session_negotiate ); mbedtls_ssl_session_free( ssl->session_negotiate );
os_free( ssl->handshake ); os_free( ssl->handshake );
os_free( ssl->transform_negotiate ); os_free( ssl->transform_negotiate );
os_free( ssl->session_negotiate ); os_free( ssl->session_negotiate );
ssl->handshake = NULL; ssl->handshake = NULL;
ssl->transform_negotiate = NULL; ssl->transform_negotiate = NULL;
ssl->session_negotiate = NULL; ssl->session_negotiate = NULL;
} }
if( ssl->session ) if( ssl->session )
{ {
mbedtls_ssl_session_free( ssl->session ); mbedtls_ssl_session_free( ssl->session );
os_free( ssl->session ); os_free( ssl->session );
ssl->session = NULL; ssl->session = NULL;
} }
#if defined(MBEDTLS_X509_CRT_PARSE_C) #if defined(MBEDTLS_X509_CRT_PARSE_C)
if( ssl->hostname != NULL ) if( ssl->hostname != NULL )
{ {
mbedtls_zeroize( ssl->hostname, os_strlen( ssl->hostname ) ); mbedtls_zeroize( ssl->hostname, os_strlen( ssl->hostname ) );
os_free( ssl->hostname ); os_free( ssl->hostname );
ssl->hostname = NULL; ssl->hostname = NULL;
} }
#endif #endif
} }
...@@ -557,10 +456,10 @@ static void mbedtls_handshake_succ(mbedtls_ssl_context *ssl) ...@@ -557,10 +456,10 @@ static void mbedtls_handshake_succ(mbedtls_ssl_context *ssl)
static void espconn_close_internal(void *arg, netconn_event event_type) static void espconn_close_internal(void *arg, netconn_event event_type)
{ {
espconn_msg *pssl_recon = arg; espconn_msg *pssl_recon = arg;
struct espconn *espconn = NULL; struct espconn *espconn = NULL;
sint8 ssl_reerr = 0; sint8 ssl_reerr = 0;
sint16 hs_status = 0; sint16 hs_status = 0;
lwIP_ASSERT(pssl_recon); lwIP_ASSERT(pssl_recon);
espconn = pssl_recon->preverse; espconn = pssl_recon->preverse;
ssl_reerr = pssl_recon->pcommon.err; ssl_reerr = pssl_recon->pcommon.err;
...@@ -579,21 +478,21 @@ static void espconn_close_internal(void *arg, netconn_event event_type) ...@@ -579,21 +478,21 @@ static void espconn_close_internal(void *arg, netconn_event event_type)
} }
espconn_kill_oldest_pcb(); espconn_kill_oldest_pcb();
switch (event_type){ switch (event_type) {
case NETCONN_EVENT_ERROR: case NETCONN_EVENT_ERROR:
if (hs_status == ESPCONN_OK) if (hs_status == ESPCONN_OK)
ESPCONN_EVENT_ERROR(espconn, ssl_reerr); ESPCONN_EVENT_ERROR(espconn, ssl_reerr);
else else
ESPCONN_EVENT_ERROR(espconn, hs_status); ESPCONN_EVENT_ERROR(espconn, hs_status);
break; break;
case NETCONN_EVENT_CLOSE: case NETCONN_EVENT_CLOSE:
if (hs_status == ESPCONN_OK) if (hs_status == ESPCONN_OK)
ESPCONN_EVENT_CLOSED(espconn); ESPCONN_EVENT_CLOSED(espconn);
else else
ESPCONN_EVENT_ERROR(espconn, hs_status); ESPCONN_EVENT_ERROR(espconn, hs_status);
break; break;
default: default:
break; break;
} }
} }
...@@ -611,35 +510,35 @@ static bool espconn_ssl_read_param_from_flash(void *param, uint16 len, int32 off ...@@ -611,35 +510,35 @@ static bool espconn_ssl_read_param_from_flash(void *param, uint16 len, int32 off
uint32 FILE_PARAM_START_SEC = 0x3B; uint32 FILE_PARAM_START_SEC = 0x3B;
switch (auth_info->auth_level) { switch (auth_info->auth_level) {
case ESPCONN_CLIENT: case ESPCONN_CLIENT:
switch (auth_info->auth_type) { switch (auth_info->auth_type) {
case ESPCONN_CERT_AUTH: case ESPCONN_CERT_AUTH:
FILE_PARAM_START_SEC = ssl_option.client.cert_ca_sector.sector; FILE_PARAM_START_SEC = ssl_option.client.cert_ca_sector.sector;
break;
case ESPCONN_CERT_OWN:
case ESPCONN_PK:
FILE_PARAM_START_SEC = ssl_option.client.cert_req_sector.sector;
break;
default:
return false;
}
break; break;
case ESPCONN_SERVER: case ESPCONN_CERT_OWN:
switch (auth_info->auth_type) { case ESPCONN_PK:
case ESPCONN_CERT_AUTH: FILE_PARAM_START_SEC = ssl_option.client.cert_req_sector.sector;
FILE_PARAM_START_SEC = ssl_option.server.cert_ca_sector.sector;
break;
case ESPCONN_CERT_OWN:
case ESPCONN_PK:
FILE_PARAM_START_SEC = ssl_option.server.cert_req_sector.sector;
break;
default:
return false;
}
break; break;
default: default:
return false; return false;
}
break;
case ESPCONN_SERVER:
switch (auth_info->auth_type) {
case ESPCONN_CERT_AUTH:
FILE_PARAM_START_SEC = ssl_option.server.cert_ca_sector.sector;
break;
case ESPCONN_CERT_OWN:
case ESPCONN_PK:
FILE_PARAM_START_SEC = ssl_option.server.cert_req_sector.sector;
break; break;
default:
return false;
}
break;
default:
return false;
break;
} }
spi_flash_read(FILE_PARAM_START_SEC * 4096 + offset, param, len); spi_flash_read(FILE_PARAM_START_SEC * 4096 + offset, param, len);
...@@ -651,53 +550,50 @@ static bool mbedtls_msg_info_load(mbedtls_msg *msg, mbedtls_auth_info *auth_info ...@@ -651,53 +550,50 @@ static bool mbedtls_msg_info_load(mbedtls_msg *msg, mbedtls_auth_info *auth_info
{ {
const char* const begin = "-----BEGIN"; const char* const begin = "-----BEGIN";
const char* const type_name = "private_key"; const char* const type_name = "private_key";
#define FILE_OFFSET 4 #define FILE_OFFSET 4
int ret = 0; int ret = 0;
int32 offerset = 0; int32 offerset = 0;
uint8* load_buf = NULL; uint8* load_buf = NULL;
size_t load_len = 0; size_t load_len = 0;
file_param *pfile_param = NULL; file_param file_param;
pfile_param = (file_param *)os_zalloc( sizeof(file_param));
if (pfile_param==NULL) bzero(&file_param, sizeof(file_param));
return false;
again: again:
espconn_ssl_read_param_from_flash(&pfile_param->file_head, sizeof(file_head), offerset, auth_info); espconn_ssl_read_param_from_flash(&file_param.file_head, sizeof(file_head), offerset, auth_info);
pfile_param->file_offerset = offerset; file_param.file_offerset = offerset;
os_printf("%s %d, type[%s],length[%d]\n", __FILE__, __LINE__, pfile_param->file_head.file_name, pfile_param->file_head.file_length); os_printf("%s %d, type[%s],length[%d]\n", __FILE__, __LINE__, file_param.file_head.file_name, file_param.file_head.file_length);
if (pfile_param->file_head.file_length == 0xFFFF){ if (file_param.file_head.file_length == 0xFFFF) {
os_free(pfile_param);
return false; return false;
} else{ } else {
/*Optional is load the private key*/ /*Optional is load the private key*/
if (auth_info->auth_type == ESPCONN_PK && os_memcmp(pfile_param->file_head.file_name, type_name, os_strlen(type_name)) != 0){ if (auth_info->auth_type == ESPCONN_PK && os_memcmp(&file_param.file_head.file_name, type_name, os_strlen(type_name)) != 0) {
offerset += sizeof(file_head) + pfile_param->file_head.file_length; offerset += sizeof(file_head) + file_param.file_head.file_length;
goto again; goto again;
} }
/*Optional is load the cert*/ /*Optional is load the cert*/
if (auth_info->auth_type == ESPCONN_CERT_OWN && os_memcmp(pfile_param->file_head.file_name, "certificate", os_strlen("certificate")) != 0){ if (auth_info->auth_type == ESPCONN_CERT_OWN && os_memcmp(file_param.file_head.file_name, "certificate", os_strlen("certificate")) != 0) {
offerset += sizeof(file_head) + pfile_param->file_head.file_length; offerset += sizeof(file_head) + file_param.file_head.file_length;
goto again; goto again;
} }
load_buf = (uint8_t *) os_zalloc( pfile_param->file_head.file_length + FILE_OFFSET); load_buf = (uint8_t *) os_zalloc( file_param.file_head.file_length + FILE_OFFSET);
if (load_buf == NULL){ if (load_buf == NULL) {
os_free(pfile_param);
return false; return false;
} }
offerset = sizeof(file_head) + pfile_param->file_offerset; offerset = sizeof(file_head) + file_param.file_offerset;
espconn_ssl_read_param_from_flash(load_buf, pfile_param->file_head.file_length, offerset, auth_info); espconn_ssl_read_param_from_flash(load_buf, file_param.file_head.file_length, offerset, auth_info);
} }
load_len = pfile_param->file_head.file_length; load_len = file_param.file_head.file_length;
/* /*
* Determine buffer content. Buffer contains either one DER certificate or * Determine buffer content. Buffer contains either one DER certificate or
* one or more PEM certificates. * one or more PEM certificates.
*/ */
if ((char*)os_strstr(load_buf, begin) != NULL){ if ((char*)os_strstr(load_buf, begin) != NULL) {
load_len += 1; load_len += 1;
load_buf[load_len - 1] = '\0'; load_buf[load_len - 1] = '\0';
} }
switch (auth_info->auth_type){ switch (auth_info->auth_type) {
case ESPCONN_CERT_AUTH: case ESPCONN_CERT_AUTH:
/*Optional is not optimal for security*/ /*Optional is not optimal for security*/
ret = mbedtls_x509_crt_parse(&msg->psession->cacert, (const uint8*) load_buf,load_len); ret = mbedtls_x509_crt_parse(&msg->psession->cacert, (const uint8*) load_buf,load_len);
...@@ -716,10 +612,9 @@ again: ...@@ -716,10 +612,9 @@ again:
} }
exit: exit:
os_free(load_buf); os_free(load_buf);
os_free(pfile_param); if (ret < 0) {
if (ret < 0){
return false; return false;
}else{ } else {
return true; return true;
} }
} }
...@@ -739,7 +634,7 @@ static bool mbedtls_msg_config(mbedtls_msg *msg) ...@@ -739,7 +634,7 @@ static bool mbedtls_msg_config(mbedtls_msg *msg)
mbedtls_auth_info auth_info; mbedtls_auth_info auth_info;
/*end_point mode*/ /*end_point mode*/
if (msg->listen_fd.fd == -1){ if (msg->listen_fd.fd == -1) {
pers = "client"; pers = "client";
auth_type = MBEDTLS_SSL_IS_CLIENT; auth_type = MBEDTLS_SSL_IS_CLIENT;
} else { } else {
...@@ -751,10 +646,11 @@ static bool mbedtls_msg_config(mbedtls_msg *msg) ...@@ -751,10 +646,11 @@ static bool mbedtls_msg_config(mbedtls_msg *msg)
ret = mbedtls_ctr_drbg_seed(&msg->ctr_drbg, mbedtls_entropy_func, &msg->entropy, (const unsigned char*) pers, os_strlen(pers)); ret = mbedtls_ctr_drbg_seed(&msg->ctr_drbg, mbedtls_entropy_func, &msg->entropy, (const unsigned char*) pers, os_strlen(pers));
lwIP_REQUIRE_NOERROR(ret, exit); lwIP_REQUIRE_NOERROR(ret, exit);
if (auth_type == MBEDTLS_SSL_IS_SERVER){ if (auth_type == MBEDTLS_SSL_IS_SERVER) {
uint32 flash_sector = 0; uint32 flash_sector = 0;
/*Load the certificate*/ /*Load the certificate*/
unsigned int def_certificate_len = 0;unsigned char *def_certificate = NULL; unsigned int def_certificate_len = 0;
unsigned char *def_certificate = NULL;
def_certificate = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_CERT_OWN, &def_certificate_len); def_certificate = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_CERT_OWN, &def_certificate_len);
lwIP_REQUIRE_ACTION(def_certificate, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED); lwIP_REQUIRE_ACTION(def_certificate, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
ret = mbedtls_x509_crt_parse(&msg->psession->clicert, (const unsigned char *)def_certificate, def_certificate_len); ret = mbedtls_x509_crt_parse(&msg->psession->clicert, (const unsigned char *)def_certificate, def_certificate_len);
...@@ -763,7 +659,8 @@ static bool mbedtls_msg_config(mbedtls_msg *msg) ...@@ -763,7 +659,8 @@ static bool mbedtls_msg_config(mbedtls_msg *msg)
lwIP_REQUIRE_NOERROR(ret, exit); lwIP_REQUIRE_NOERROR(ret, exit);
/*Load the private RSA key*/ /*Load the private RSA key*/
unsigned int def_private_key_len = 0;unsigned char *def_private_key = NULL; unsigned int def_private_key_len = 0;
unsigned char *def_private_key = NULL;
def_private_key = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_PK, &def_private_key_len); def_private_key = (unsigned char *)mbedtls_get_default_obj(&flash_sector,ESPCONN_PK, &def_private_key_len);
lwIP_REQUIRE_ACTION(def_private_key, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED); lwIP_REQUIRE_ACTION(def_private_key, exit, ret = MBEDTLS_ERR_SSL_ALLOC_FAILED);
ret = mbedtls_pk_parse_key(&msg->psession->pkey, (const unsigned char *)def_private_key, def_private_key_len, NULL, 0); ret = mbedtls_pk_parse_key(&msg->psession->pkey, (const unsigned char *)def_private_key, def_private_key_len, NULL, 0);
...@@ -780,7 +677,7 @@ static bool mbedtls_msg_config(mbedtls_msg *msg) ...@@ -780,7 +677,7 @@ static bool mbedtls_msg_config(mbedtls_msg *msg)
load_flag = mbedtls_msg_info_load(msg, &auth_info); load_flag = mbedtls_msg_info_load(msg, &auth_info);
lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM); lwIP_REQUIRE_ACTION(load_flag, exit, ret = ESPCONN_MEM);
} }
} else{ } else {
/*Load the certificate and private RSA key*/ /*Load the certificate and private RSA key*/
if (ssl_option.client.cert_req_sector.flag) { if (ssl_option.client.cert_req_sector.flag) {
auth_info.auth_level = ESPCONN_CLIENT; auth_info.auth_level = ESPCONN_CLIENT;
...@@ -793,7 +690,7 @@ static bool mbedtls_msg_config(mbedtls_msg *msg) ...@@ -793,7 +690,7 @@ static bool mbedtls_msg_config(mbedtls_msg *msg)
} }
/*Load the trusted CA*/ /*Load the trusted CA*/
if(ssl_option.client.cert_ca_sector.flag){ if(ssl_option.client.cert_ca_sector.flag) {
auth_info.auth_level = ESPCONN_CLIENT; auth_info.auth_level = ESPCONN_CLIENT;
auth_info.auth_type = ESPCONN_CERT_AUTH; auth_info.auth_type = ESPCONN_CERT_AUTH;
load_flag = mbedtls_msg_info_load(msg, &auth_info); load_flag = mbedtls_msg_info_load(msg, &auth_info);
...@@ -806,7 +703,7 @@ static bool mbedtls_msg_config(mbedtls_msg *msg) ...@@ -806,7 +703,7 @@ static bool mbedtls_msg_config(mbedtls_msg *msg)
lwIP_REQUIRE_NOERROR(ret, exit); lwIP_REQUIRE_NOERROR(ret, exit);
/*OPTIONAL is not optimal for security, but makes interop easier in this session*/ /*OPTIONAL is not optimal for security, but makes interop easier in this session*/
if (auth_type == MBEDTLS_SSL_IS_CLIENT && ssl_option.client.cert_ca_sector.flag == false){ if (auth_type == MBEDTLS_SSL_IS_CLIENT && ssl_option.client.cert_ca_sector.flag == false) {
mbedtls_ssl_conf_authmode(&msg->conf, MBEDTLS_SSL_VERIFY_NONE); mbedtls_ssl_conf_authmode(&msg->conf, MBEDTLS_SSL_VERIFY_NONE);
} }
mbedtls_ssl_conf_rng(&msg->conf, mbedtls_ctr_drbg_random, &msg->ctr_drbg); mbedtls_ssl_conf_rng(&msg->conf, mbedtls_ctr_drbg_random, &msg->ctr_drbg);
...@@ -818,14 +715,14 @@ static bool mbedtls_msg_config(mbedtls_msg *msg) ...@@ -818,14 +715,14 @@ static bool mbedtls_msg_config(mbedtls_msg *msg)
mbedtls_ssl_set_bio(&msg->ssl, &msg->fd, mbedtls_net_send, mbedtls_net_recv, NULL); mbedtls_ssl_set_bio(&msg->ssl, &msg->fd, mbedtls_net_send, mbedtls_net_recv, NULL);
exit: exit:
if (ret != 0){ if (ret != 0) {
return false; return false;
} else{ } else {
return true; return true;
} }
} }
int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) int espconn_mbedtls_parse_internal(int socket, sint8 error)
{ {
int ret = ERR_OK; int ret = ERR_OK;
bool config_flag = false; bool config_flag = false;
...@@ -836,8 +733,8 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) ...@@ -836,8 +733,8 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
TLSmsg = Threadmsg->pssl; TLSmsg = Threadmsg->pssl;
lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM); lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
if (error == ERR_OK){ if (error == ERR_OK) {
if (TLSmsg->quiet){ if (TLSmsg->quiet) {
uint8 *TheadBuff = NULL; uint8 *TheadBuff = NULL;
size_t ThreadLen = MBEDTLS_SSL_PLAIN_ADD; size_t ThreadLen = MBEDTLS_SSL_PLAIN_ADD;
TheadBuff = (uint8 *)os_zalloc(ThreadLen + 1); TheadBuff = (uint8 *)os_zalloc(ThreadLen + 1);
...@@ -845,16 +742,16 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) ...@@ -845,16 +742,16 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
do { do {
os_memset(TheadBuff, 0, ThreadLen); os_memset(TheadBuff, 0, ThreadLen);
ret = mbedtls_ssl_read(&TLSmsg->ssl, TheadBuff, ThreadLen); ret = mbedtls_ssl_read(&TLSmsg->ssl, TheadBuff, ThreadLen);
if (ret > 0){ if (ret > 0) {
ESPCONN_EVENT_RECV(Threadmsg->pespconn, TheadBuff, ret); ESPCONN_EVENT_RECV(Threadmsg->pespconn, TheadBuff, ret);
} else{ } else {
if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == 0){ if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == 0) {
ret = ESPCONN_OK; ret = ESPCONN_OK;
break; break;
} else if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY){ } else if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
ret = ESPCONN_OK; ret = ESPCONN_OK;
mbedtls_ssl_close_notify(&TLSmsg->ssl); mbedtls_ssl_close_notify(&TLSmsg->ssl);
} else{ } else {
break; break;
} }
} }
...@@ -862,15 +759,15 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) ...@@ -862,15 +759,15 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
os_free(TheadBuff); os_free(TheadBuff);
TheadBuff = NULL; TheadBuff = NULL;
lwIP_REQUIRE_NOERROR(ret, exit); lwIP_REQUIRE_NOERROR(ret, exit);
} else{ } else {
if (TLSmsg->ssl.state == MBEDTLS_SSL_HELLO_REQUEST){ if (TLSmsg->ssl.state == MBEDTLS_SSL_HELLO_REQUEST) {
if (Threadmsg->preverse != NULL){ if (Threadmsg->preverse != NULL) {
struct espconn *accept_conn = NULL; struct espconn *accept_conn = NULL;
struct espconn *espconn = Threadmsg->preverse; struct espconn *espconn = Threadmsg->preverse;
struct sockaddr_in name; struct sockaddr_in name;
socklen_t name_len = sizeof(name); socklen_t name_len = sizeof(name);
remot_info *pinfo = NULL; remot_info *pinfo = NULL;
espconn_get_connection_info(espconn, &pinfo , ESPCONN_SSL); espconn_get_connection_info(espconn, &pinfo, ESPCONN_SSL);
if (espconn->link_cnt == 0x01) if (espconn->link_cnt == 0x01)
return ERR_ISCONN; return ERR_ISCONN;
...@@ -892,14 +789,14 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) ...@@ -892,14 +789,14 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
/*insert the node to the active connection list*/ /*insert the node to the active connection list*/
espconn_list_creat(&plink_active, Threadmsg); espconn_list_creat(&plink_active, Threadmsg);
os_printf("server handshake start.\n"); os_printf("server handshake start.\n");
} else{ } else {
os_printf("client handshake start.\n"); os_printf("client handshake start.\n");
} }
config_flag = mbedtls_msg_config(TLSmsg); config_flag = mbedtls_msg_config(TLSmsg);
if (config_flag){ if (config_flag) {
// mbedtls_keep_alive(TLSmsg->fd.fd, 1, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT); // mbedtls_keep_alive(TLSmsg->fd.fd, 1, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT);
system_overclock(); system_overclock();
} else{ } else {
ret = MBEDTLS_ERR_SSL_ALLOC_FAILED; ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
lwIP_REQUIRE_NOERROR(ret, exit); lwIP_REQUIRE_NOERROR(ret, exit);
} }
...@@ -914,7 +811,7 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) ...@@ -914,7 +811,7 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) { if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE) {
ret = ESPCONN_OK; ret = ESPCONN_OK;
break; break;
} else{ } else {
break; break;
} }
} }
...@@ -923,7 +820,7 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) ...@@ -923,7 +820,7 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
lwIP_REQUIRE_NOERROR(ret, exit); lwIP_REQUIRE_NOERROR(ret, exit);
/**/ /**/
TLSmsg->quiet = mbedtls_handshake_result(TLSmsg); TLSmsg->quiet = mbedtls_handshake_result(TLSmsg);
if (TLSmsg->quiet){ if (TLSmsg->quiet) {
if (Threadmsg->preverse != NULL) { if (Threadmsg->preverse != NULL) {
os_printf("server handshake ok!\n"); os_printf("server handshake ok!\n");
} else { } else {
...@@ -932,18 +829,15 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) ...@@ -932,18 +829,15 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
// mbedtls_keep_alive(TLSmsg->fd.fd, 0, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT); // mbedtls_keep_alive(TLSmsg->fd.fd, 0, SSL_KEEP_IDLE, SSL_KEEP_INTVL, SSL_KEEP_CNT);
mbedtls_session_free(&TLSmsg->psession); mbedtls_session_free(&TLSmsg->psession);
mbedtls_handshake_succ(&TLSmsg->ssl); mbedtls_handshake_succ(&TLSmsg->ssl);
#if defined(ESP8266_PLATFORM)
mbedtls_hanshake_finished(TLSmsg);
#endif
system_restoreclock(); system_restoreclock();
TLSmsg->SentFnFlag = true; TLSmsg->SentFnFlag = true;
ESPCONN_EVENT_CONNECTED(Threadmsg->pespconn); ESPCONN_EVENT_CONNECTED(Threadmsg->pespconn);
} else{ } else {
lwIP_REQUIRE_NOERROR_ACTION(TLSmsg->verify_result, exit, ret = TLSmsg->verify_result); lwIP_REQUIRE_NOERROR_ACTION(TLSmsg->verify_result, exit, ret = TLSmsg->verify_result);
} }
} }
} else if (error < 0){ } else if (error < 0) {
Threadmsg->pcommon.err = error; Threadmsg->pcommon.err = error;
Threadmsg->pespconn->state = ESPCONN_CLOSE; Threadmsg->pespconn->state = ESPCONN_CLOSE;
mbedtls_net_free(&TLSmsg->fd); mbedtls_net_free(&TLSmsg->fd);
...@@ -954,9 +848,9 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error) ...@@ -954,9 +848,9 @@ int __attribute__((weak)) mbedtls_parse_internal(int socket, sint8 error)
} }
exit: exit:
if (ret != ESPCONN_OK){ if (ret != ESPCONN_OK) {
mbedtls_fail_info(Threadmsg, ret); mbedtls_fail_info(Threadmsg, ret);
if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY){ if(ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
Threadmsg->hs_status = ESPCONN_OK; Threadmsg->hs_status = ESPCONN_OK;
} }
ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg); ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg);
...@@ -964,7 +858,7 @@ exit: ...@@ -964,7 +858,7 @@ exit:
return ret; return ret;
} }
int __attribute__((weak)) mbedtls_parse_thread(int socket, int event, int error) int espconn_mbedtls_parse_thread(int socket, int event, int error)
{ {
int ret = ERR_OK; int ret = ERR_OK;
espconn_msg *Threadmsg = NULL; espconn_msg *Threadmsg = NULL;
...@@ -973,25 +867,21 @@ int __attribute__((weak)) mbedtls_parse_thread(int socket, int event, int error) ...@@ -973,25 +867,21 @@ int __attribute__((weak)) mbedtls_parse_thread(int socket, int event, int error)
lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM); lwIP_REQUIRE_ACTION(Threadmsg, exit, ret = ERR_MEM);
TLSmsg = Threadmsg->pssl; TLSmsg = Threadmsg->pssl;
lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM); lwIP_REQUIRE_ACTION(TLSmsg, exit, ret = ERR_MEM);
if (TLSmsg->quiet){ if (TLSmsg->quiet) {
int out_msglen = TLSmsg->ssl.out_msglen + 5; int out_msglen = TLSmsg->ssl.out_msglen + 5;
if (Threadmsg->pcommon.write_flag) if (Threadmsg->pcommon.write_flag)
TLSmsg->record.record_len += error; TLSmsg->record_len += error;
if (TLSmsg->record.record_len == out_msglen){ if (TLSmsg->record_len == out_msglen) {
TLSmsg->record.record_len = 0; TLSmsg->record_len = 0;
Threadmsg->pcommon.write_flag = false; Threadmsg->pcommon.write_flag = false;
if (Threadmsg->pcommon.cntr != 0){ if (Threadmsg->pcommon.cntr != 0) {
espconn_ssl_sent(Threadmsg, Threadmsg->pcommon.ptrbuf, Threadmsg->pcommon.cntr); espconn_ssl_sent(Threadmsg, Threadmsg->pcommon.ptrbuf, Threadmsg->pcommon.cntr);
} else{ } else {
TLSmsg->SentFnFlag = true; TLSmsg->SentFnFlag = true;
ESPCONN_EVENT_SEND(Threadmsg->pespconn); ESPCONN_EVENT_SEND(Threadmsg->pespconn);
} }
} else{
} }
} else{
} }
exit: exit:
return ret; return ret;
...@@ -1017,34 +907,34 @@ mbedtls_thread(os_event_t *events) ...@@ -1017,34 +907,34 @@ mbedtls_thread(os_event_t *events)
lwIP_REQUIRE_ACTION(Threadmsg->pespconn,exit,ret = ERR_ARG); lwIP_REQUIRE_ACTION(Threadmsg->pespconn,exit,ret = ERR_ARG);
/*find the active connection*/ /*find the active connection*/
for (ListMsg = plink_active; ListMsg != NULL; ListMsg = ListMsg->pnext){ for (ListMsg = plink_active; ListMsg != NULL; ListMsg = ListMsg->pnext) {
if (Threadmsg == ListMsg){ if (Threadmsg == ListMsg) {
active_flag = true; active_flag = true;
break; break;
} }
} }
if (active_flag){ if (active_flag) {
/*remove the node from the active connection list*/ /*remove the node from the active connection list*/
espconn_list_delete(&plink_active, Threadmsg); espconn_list_delete(&plink_active, Threadmsg);
if (TLSmsg->listen_fd.fd != -1){ if (TLSmsg->listen_fd.fd != -1) {
mbedtls_msg_server_step(TLSmsg); mbedtls_msg_server_step(TLSmsg);
espconn_copy_partial(Threadmsg->preverse, Threadmsg->pespconn); espconn_copy_partial(Threadmsg->preverse, Threadmsg->pespconn);
mbedtls_espconn_free(&Threadmsg->pespconn); mbedtls_espconn_free(&Threadmsg->pespconn);
} else{ } else {
mbedtls_msg_free(&TLSmsg); mbedtls_msg_free(&TLSmsg);
Threadmsg->pssl = NULL; Threadmsg->pssl = NULL;
} }
switch (events->sig){ switch (events->sig) {
case NETCONN_EVENT_ERROR: case NETCONN_EVENT_ERROR:
espconn_close_internal(Threadmsg, NETCONN_EVENT_ERROR); espconn_close_internal(Threadmsg, NETCONN_EVENT_ERROR);
break; break;
case NETCONN_EVENT_CLOSE: case NETCONN_EVENT_CLOSE:
espconn_close_internal(Threadmsg, NETCONN_EVENT_CLOSE); espconn_close_internal(Threadmsg, NETCONN_EVENT_CLOSE);
break; break;
default: default:
break; break;
} }
} }
exit: exit:
...@@ -1074,7 +964,7 @@ sint8 espconn_ssl_client(struct espconn *espconn) ...@@ -1074,7 +964,7 @@ sint8 espconn_ssl_client(struct espconn *espconn)
mbedTLSMsg = mbedtls_msg_new(); mbedTLSMsg = mbedtls_msg_new();
lwIP_REQUIRE_ACTION(mbedTLSMsg, exit, ret = ESPCONN_MEM); lwIP_REQUIRE_ACTION(mbedTLSMsg, exit, ret = ESPCONN_MEM);
IP4_ADDR(&ipaddr, espconn->proto.tcp->remote_ip[0],espconn->proto.tcp->remote_ip[1], IP4_ADDR(&ipaddr, espconn->proto.tcp->remote_ip[0],espconn->proto.tcp->remote_ip[1],
espconn->proto.tcp->remote_ip[2],espconn->proto.tcp->remote_ip[3]); espconn->proto.tcp->remote_ip[2],espconn->proto.tcp->remote_ip[3]);
server_name = ipaddr_ntoa(&ipaddr); server_name = ipaddr_ntoa(&ipaddr);
server_port = (const char *)sys_itoa(espconn->proto.tcp->remote_port); server_port = (const char *)sys_itoa(espconn->proto.tcp->remote_port);
...@@ -1088,7 +978,7 @@ sint8 espconn_ssl_client(struct espconn *espconn) ...@@ -1088,7 +978,7 @@ sint8 espconn_ssl_client(struct espconn *espconn)
/*insert the node to the active connection list*/ /*insert the node to the active connection list*/
espconn_list_creat(&plink_active, pclient); espconn_list_creat(&plink_active, pclient);
exit: exit:
if (ret != ESPCONN_OK){ if (ret != ESPCONN_OK) {
if (mbedTLSMsg != NULL) if (mbedTLSMsg != NULL)
mbedtls_msg_free(&mbedTLSMsg); mbedtls_msg_free(&mbedTLSMsg);
if (pclient != NULL) if (pclient != NULL)
...@@ -1204,19 +1094,19 @@ void espconn_ssl_sent(void *arg, uint8 *psent, uint16 length) ...@@ -1204,19 +1094,19 @@ void espconn_ssl_sent(void *arg, uint8 *psent, uint16 length)
pmbedtls_msg mbedTLSMsg = Threadmsg->pssl; pmbedtls_msg mbedTLSMsg = Threadmsg->pssl;
lwIP_ASSERT(mbedTLSMsg); lwIP_ASSERT(mbedTLSMsg);
if (length > MBEDTLS_SSL_PLAIN_ADD){ if (length > MBEDTLS_SSL_PLAIN_ADD) {
out_msglen = MBEDTLS_SSL_PLAIN_ADD; out_msglen = MBEDTLS_SSL_PLAIN_ADD;
} }
Threadmsg->pcommon.write_flag = true; Threadmsg->pcommon.write_flag = true;
ret = mbedtls_ssl_write(&mbedTLSMsg->ssl, psent, out_msglen); ret = mbedtls_ssl_write(&mbedTLSMsg->ssl, psent, out_msglen);
if (ret > 0){ if (ret > 0) {
Threadmsg->pcommon.ptrbuf = psent + ret; Threadmsg->pcommon.ptrbuf = psent + ret;
Threadmsg->pcommon.cntr = length - ret; Threadmsg->pcommon.cntr = length - ret;
} else{ } else {
if (ret == MBEDTLS_ERR_SSL_WANT_WRITE || ret == 0) { if (ret == MBEDTLS_ERR_SSL_WANT_WRITE || ret == 0) {
} else{ } else {
mbedtls_fail_info(Threadmsg, ret); mbedtls_fail_info(Threadmsg, ret);
ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg); ets_post(lwIPThreadPrio, NETCONN_EVENT_CLOSE,(uint32)Threadmsg);
} }
...@@ -1246,60 +1136,60 @@ void espconn_ssl_disconnect(espconn_msg *Threadmsg) ...@@ -1246,60 +1136,60 @@ void espconn_ssl_disconnect(espconn_msg *Threadmsg)
int mbedtls_x509_test(int verbose, char *ca_crt, size_t ca_crt_len, char *cli_crt, size_t cli_crt_len) int mbedtls_x509_test(int verbose, char *ca_crt, size_t ca_crt_len, char *cli_crt, size_t cli_crt_len)
{ {
#if defined(MBEDTLS_SHA1_C) #if defined(MBEDTLS_SHA1_C)
int ret; int ret;
uint32_t flags; uint32_t flags;
mbedtls_x509_crt cacert; mbedtls_x509_crt cacert;
mbedtls_x509_crt clicert; mbedtls_x509_crt clicert;
if( verbose != 0 ) if( verbose != 0 )
os_printf( " X.509 certificate load: " ); os_printf( " X.509 certificate load: " );
mbedtls_x509_crt_init( &clicert ); mbedtls_x509_crt_init( &clicert );
ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) cli_crt, ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) cli_crt,
cli_crt_len ); cli_crt_len );
if( ret != 0 ) if( ret != 0 )
{ {
if( verbose != 0 ) if( verbose != 0 )
os_printf( "failed\n" ); os_printf( "failed\n" );
return( ret ); return( ret );
} }
mbedtls_x509_crt_init( &cacert ); mbedtls_x509_crt_init( &cacert );
ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) ca_crt, ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) ca_crt,
ca_crt_len ); ca_crt_len );
if( ret != 0 ) if( ret != 0 )
{ {
if( verbose != 0 ) if( verbose != 0 )
os_printf( "failed\n" ); os_printf( "failed\n" );
return( ret ); return( ret );
} }
if( verbose != 0 ) if( verbose != 0 )
os_printf( "passed\n X.509 signature verify: "); os_printf( "passed\n X.509 signature verify: ");
ret = mbedtls_x509_crt_verify( &clicert, &cacert, NULL, NULL, &flags, NULL, NULL ); ret = mbedtls_x509_crt_verify( &clicert, &cacert, NULL, NULL, &flags, NULL, NULL );
if( ret != 0 ) if( ret != 0 )
{ {
if( verbose != 0 ) if( verbose != 0 )
os_printf( "failed\n" ); os_printf( "failed\n" );
return( ret ); return( ret );
} }
if( verbose != 0 ) if( verbose != 0 )
os_printf( "passed\n\n"); os_printf( "passed\n\n");
mbedtls_x509_crt_free( &cacert ); mbedtls_x509_crt_free( &cacert );
mbedtls_x509_crt_free( &clicert ); mbedtls_x509_crt_free( &clicert );
return( 0 ); return( 0 );
#else #else
((void) verbose); ((void) verbose);
return( 0 ); return( 0 );
#endif /* MBEDTLS_CERTS_C && MBEDTLS_SHA1_C */ #endif /* MBEDTLS_CERTS_C && MBEDTLS_SHA1_C */
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment