From 91b02341baccf2b3b9dbfaed1d916530bace0d6e Mon Sep 17 00:00:00 2001 From: Links Date: Sun, 4 Oct 2020 14:49:22 +0200 Subject: [PATCH] Native BareSSL support for ESP8266 see #557, #509, #492, #555, #352 --- src/WebSockets.h | 7 +++++ src/WebSocketsClient.cpp | 58 ++++++++++++++++++++++++++++++++-------- src/WebSocketsClient.h | 15 ++++++++++- src/WebSocketsServer.cpp | 2 +- 4 files changed, 69 insertions(+), 13 deletions(-) diff --git a/src/WebSockets.h b/src/WebSockets.h index 8e8bba1..3aac838 100644 --- a/src/WebSockets.h +++ b/src/WebSockets.h @@ -126,6 +126,7 @@ #elif defined(ESP32) #include #include +#define SSL_AXTLS #elif defined(ESP31B) #include #else @@ -145,6 +146,11 @@ #ifdef ESP8266 #include +#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h) +#define SSL_BARESSL +#else +#define SSL_AXTLS +#endif #else #include #endif @@ -174,6 +180,7 @@ #include #include +#define SSL_AXTLS #define WEBSOCKETS_NETWORK_CLASS WiFiClient #define WEBSOCKETS_NETWORK_SSL_CLASS WiFiClientSecure #define WEBSOCKETS_NETWORK_SERVER_CLASS WiFiServer diff --git a/src/WebSocketsClient.cpp b/src/WebSocketsClient.cpp index 17cae29..6c5294e 100644 --- a/src/WebSocketsClient.cpp +++ b/src/WebSocketsClient.cpp @@ -46,7 +46,7 @@ void WebSocketsClient::begin(const char * host, uint16_t port, const char * url, _host = host; _port = port; #if defined(HAS_SSL) - _fingerprint = ""; + _fingerprint = SSL_FINGERPRINT_NULL; _CA_cert = NULL; #endif @@ -97,6 +97,7 @@ void WebSocketsClient::begin(IPAddress host, uint16_t port, const char * url, co } #if defined(HAS_SSL) +#if defined(SSL_AXTLS) void WebSocketsClient::beginSSL(const char * host, uint16_t port, const char * url, const char * fingerprint, const char * protocol) { begin(host, port, url, protocol); _client.isSSL = true; @@ -111,10 +112,31 @@ void WebSocketsClient::beginSSL(String host, uint16_t port, String url, String f void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) { begin(host, port, url, protocol); _client.isSSL = true; - _fingerprint = ""; + _fingerprint = SSL_FINGERPRINT_NULL; _CA_cert = CA_cert; } -#endif +#else +void WebSocketsClient::beginSSL(const char * host, uint16_t port, const char * url, const uint8_t * fingerprint, const char * protocol) { + begin(host, port, url, protocol); + _client.isSSL = true; + _fingerprint = fingerprint; + _CA_cert = NULL; +} +void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) { + begin(host, port, url, protocol); + _client.isSSL = true; + _fingerprint = SSL_FINGERPRINT_NULL; + _CA_cert = new BearSSL::X509List(CA_cert); +} + +void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, BearSSL::X509List * CA_cert, const char * protocol) { + begin(host, port, url, protocol); + _client.isSSL = true; + _fingerprint = SSL_FINGERPRINT_NULL; + _CA_cert = CA_cert; +} +#endif // SSL_AXTLS +#endif // HAS_SSL void WebSocketsClient::beginSocketIO(const char * host, uint16_t port, const char * url, const char * protocol) { begin(host, port, url, protocol); @@ -130,7 +152,7 @@ void WebSocketsClient::beginSocketIOSSL(const char * host, uint16_t port, const begin(host, port, url, protocol); _client.isSocketIO = true; _client.isSSL = true; - _fingerprint = ""; + _fingerprint = SSL_FINGERPRINT_NULL; } void WebSocketsClient::beginSocketIOSSL(String host, uint16_t port, String url, String protocol) { @@ -141,8 +163,12 @@ void WebSocketsClient::beginSocketIOSSLWithCA(const char * host, uint16_t port, begin(host, port, url, protocol); _client.isSocketIO = true; _client.isSSL = true; - _fingerprint = ""; - _CA_cert = CA_cert; + _fingerprint = SSL_FINGERPRINT_NULL; +#if defined(SSL_AXTLS) + _CA_cert = CA_cert; +#else + _CA_cert = new BearSSL::X509List(CA_cert); +#endif } #endif @@ -175,14 +201,20 @@ void WebSocketsClient::loop(void) { DEBUG_WEBSOCKETS("[WS-Client] setting CA certificate"); #if defined(ESP32) _client.ssl->setCACert(_CA_cert); -#elif defined(ESP8266) +#elif defined(ESP8266) && defined(SSL_AXTLS) _client.ssl->setCACert((const uint8_t *)_CA_cert, strlen(_CA_cert) + 1); +#elif defined(ESP8266) && defined(SSL_BARESSL) + _client.ssl->setTrustAnchors(_CA_cert); #else #error setCACert not implemented #endif - } else if(_fingerprint.length()) { -#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h) - _client.ssl->setFingerprint(_fingerprint.c_str()); +#if defined(SSL_BARESSL) + } else if(_fingerprint) { + _client.ssl->setFingerprint(_fingerprint); +#endif + } else { +#if defined(SSL_BARESSL) + _client.ssl->setInsecure(); #endif } } else { @@ -774,14 +806,18 @@ void WebSocketsClient::connectedCb() { #endif #if defined(HAS_SSL) +#if defined(SSL_AXTLS) || defined(ESP32) if(_client.isSSL && _fingerprint.length()) { if(!_client.ssl->verify(_fingerprint.c_str(), _host.c_str())) { DEBUG_WEBSOCKETS("[WS-Client] certificate mismatch\n"); WebSockets::clientDisconnect(&_client, 1000); return; } +#else + if(_client.isSSL && _fingerprint) { +#endif } else if(_client.isSSL && !_CA_cert) { -#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h) +#if defined(SSL_BARESSL) _client.ssl->setInsecure(); #endif } diff --git a/src/WebSocketsClient.h b/src/WebSocketsClient.h index 5069875..f99dde7 100644 --- a/src/WebSocketsClient.h +++ b/src/WebSocketsClient.h @@ -43,8 +43,13 @@ class WebSocketsClient : protected WebSockets { void begin(IPAddress host, uint16_t port, const char * url = "/", const char * protocol = "arduino"); #if defined(HAS_SSL) - void beginSSL(const char * host, uint16_t port, const char * url = "/", const char * = "", const char * protocol = "arduino"); +#ifdef SSL_AXTLS + void beginSSL(const char * host, uint16_t port, const char * url = "/", const char * fingerprint = "", const char * protocol = "arduino"); void beginSSL(String host, uint16_t port, String url = "/", String fingerprint = "", String protocol = "arduino"); +#else + void beginSSL(const char * host, uint16_t port, const char * url = "/", const uint8_t * fingerprint = NULL, const char * protocol = "arduino"); + void beginSslWithCA(const char * host, uint16_t port, const char * url = "/", BearSSL::X509List * CA_cert = NULL, const char * protocol = "arduino"); +#endif void beginSslWithCA(const char * host, uint16_t port, const char * url = "/", const char * CA_cert = NULL, const char * protocol = "arduino"); #endif @@ -98,8 +103,16 @@ class WebSocketsClient : protected WebSockets { uint16_t _port; #if defined(HAS_SSL) +#ifdef SSL_AXTLS String _fingerprint; const char * _CA_cert; +#define SSL_FINGERPRINT_NULL "" +#else + const uint8_t * _fingerprint; + BearSSL::X509List * _CA_cert; +#define SSL_FINGERPRINT_NULL NULL +#endif + #endif WSclient_t _client; diff --git a/src/WebSocketsServer.cpp b/src/WebSocketsServer.cpp index 3b76343..336da00 100644 --- a/src/WebSocketsServer.cpp +++ b/src/WebSocketsServer.cpp @@ -424,7 +424,7 @@ int WebSocketsServer::connectedClients(bool ping) { * @param num uint8_t client id */ bool WebSocketsServer::clientIsConnected(uint8_t num) { - if(num >= WEBSOCKETS_SERVER_CLIENT_MAX) { + if(num >= WEBSOCKETS_SERVER_CLIENT_MAX) { return false; } WSclient_t * client = &_clients[num];