Native BareSSL support for ESP8266

see #557, #509, #492, #555, #352

src/WebSockets.h

@@ -126,6 +126,7 @@
 #elif defined(ESP32)
 #include <WiFi.h>
 #include <WiFiClientSecure.h>
+#define SSL_AXTLS
 #elif defined(ESP31B)
 #include <ESP31BWiFi.h>
 #else
@@ -145,6 +146,11 @@
 
 #ifdef ESP8266
 #include <ESP8266WiFi.h>
+#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h)
+#define SSL_BARESSL
+#else
+#define SSL_AXTLS
+#endif
 #else
 #include <ESP31BWiFi.h>
 #endif
@@ -174,6 +180,7 @@
 
 #include <WiFi.h>
 #include <WiFiClientSecure.h>
+#define SSL_AXTLS
 #define WEBSOCKETS_NETWORK_CLASS WiFiClient
 #define WEBSOCKETS_NETWORK_SSL_CLASS WiFiClientSecure
 #define WEBSOCKETS_NETWORK_SERVER_CLASS WiFiServer

src/WebSocketsClient.cpp

@@ -46,7 +46,7 @@ void WebSocketsClient::begin(const char * host, uint16_t port, const char * url,
     _host = host;
     _port = port;
 #if defined(HAS_SSL)
-    _fingerprint = "";
+    _fingerprint = SSL_FINGERPRINT_NULL;
     _CA_cert     = NULL;
 #endif
 
@@ -97,6 +97,7 @@ void WebSocketsClient::begin(IPAddress host, uint16_t port, const char * url, co
 }
 
 #if defined(HAS_SSL)
+#if defined(SSL_AXTLS)
 void WebSocketsClient::beginSSL(const char * host, uint16_t port, const char * url, const char * fingerprint, const char * protocol) {
     begin(host, port, url, protocol);
     _client.isSSL = true;
@@ -111,10 +112,31 @@ void WebSocketsClient::beginSSL(String host, uint16_t port, String url, String f
 void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
     begin(host, port, url, protocol);
     _client.isSSL = true;
-    _fingerprint  = "";
+    _fingerprint  = SSL_FINGERPRINT_NULL;
     _CA_cert      = CA_cert;
 }
-#endif
+#else
+void WebSocketsClient::beginSSL(const char * host, uint16_t port, const char * url, const uint8_t * fingerprint, const char * protocol) {
+    begin(host, port, url, protocol);
+    _client.isSSL = true;
+    _fingerprint  = fingerprint;
+    _CA_cert      = NULL;
+}
+void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
+    begin(host, port, url, protocol);
+    _client.isSSL = true;
+    _fingerprint  = SSL_FINGERPRINT_NULL;
+    _CA_cert      = new BearSSL::X509List(CA_cert);
+}
+
+void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, BearSSL::X509List * CA_cert, const char * protocol) {
+    begin(host, port, url, protocol);
+    _client.isSSL = true;
+    _fingerprint  = SSL_FINGERPRINT_NULL;
+    _CA_cert      = CA_cert;
+}
+#endif    // SSL_AXTLS
+#endif    // HAS_SSL
 
 void WebSocketsClient::beginSocketIO(const char * host, uint16_t port, const char * url, const char * protocol) {
     begin(host, port, url, protocol);
@@ -130,7 +152,7 @@ void WebSocketsClient::beginSocketIOSSL(const char * host, uint16_t port, const
     begin(host, port, url, protocol);
     _client.isSocketIO = true;
     _client.isSSL      = true;
-    _fingerprint       = "";
+    _fingerprint       = SSL_FINGERPRINT_NULL;
 }
 
 void WebSocketsClient::beginSocketIOSSL(String host, uint16_t port, String url, String protocol) {
@@ -141,8 +163,12 @@ void WebSocketsClient::beginSocketIOSSLWithCA(const char * host, uint16_t port,
     begin(host, port, url, protocol);
     _client.isSocketIO = true;
     _client.isSSL      = true;
-    _fingerprint       = "";
+    _fingerprint       = SSL_FINGERPRINT_NULL;
-    _CA_cert           = CA_cert;
+#if defined(SSL_AXTLS)
+    _CA_cert = CA_cert;
+#else
+    _CA_cert = new BearSSL::X509List(CA_cert);
+#endif
 }
 #endif
 
@@ -175,14 +201,20 @@ void WebSocketsClient::loop(void) {
                 DEBUG_WEBSOCKETS("[WS-Client] setting CA certificate");
 #if defined(ESP32)
                 _client.ssl->setCACert(_CA_cert);
-#elif defined(ESP8266)
+#elif defined(ESP8266) && defined(SSL_AXTLS)
                 _client.ssl->setCACert((const uint8_t *)_CA_cert, strlen(_CA_cert) + 1);
+#elif defined(ESP8266) && defined(SSL_BARESSL)
+                _client.ssl->setTrustAnchors(_CA_cert);
 #else
 #error setCACert not implemented
 #endif
-            } else if(_fingerprint.length()) {
+#if defined(SSL_BARESSL)
-#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h)
+            } else if(_fingerprint) {
-                _client.ssl->setFingerprint(_fingerprint.c_str());
+                _client.ssl->setFingerprint(_fingerprint);
+#endif
+            } else {
+#if defined(SSL_BARESSL)
+                _client.ssl->setInsecure();
 #endif
             }
         } else {
@@ -774,14 +806,18 @@ void WebSocketsClient::connectedCb() {
 #endif
 
 #if defined(HAS_SSL)
+#if defined(SSL_AXTLS) || defined(ESP32)
     if(_client.isSSL && _fingerprint.length()) {
         if(!_client.ssl->verify(_fingerprint.c_str(), _host.c_str())) {
             DEBUG_WEBSOCKETS("[WS-Client] certificate mismatch\n");
             WebSockets::clientDisconnect(&_client, 1000);
             return;
         }
+#else
+    if(_client.isSSL && _fingerprint) {
+#endif
     } else if(_client.isSSL && !_CA_cert) {
-#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h)
+#if defined(SSL_BARESSL)
         _client.ssl->setInsecure();
 #endif
     }

src/WebSocketsClient.h

@@ -43,8 +43,13 @@ class WebSocketsClient : protected WebSockets {
     void begin(IPAddress host, uint16_t port, const char * url = "/", const char * protocol = "arduino");
 
 #if defined(HAS_SSL)
-    void beginSSL(const char * host, uint16_t port, const char * url = "/", const char * = "", const char * protocol = "arduino");
+#ifdef SSL_AXTLS
+    void beginSSL(const char * host, uint16_t port, const char * url = "/", const char * fingerprint = "", const char * protocol = "arduino");
     void beginSSL(String host, uint16_t port, String url = "/", String fingerprint = "", String protocol = "arduino");
+#else
+    void beginSSL(const char * host, uint16_t port, const char * url = "/", const uint8_t * fingerprint = NULL, const char * protocol = "arduino");
+    void beginSslWithCA(const char * host, uint16_t port, const char * url = "/", BearSSL::X509List * CA_cert = NULL, const char * protocol = "arduino");
+#endif
     void beginSslWithCA(const char * host, uint16_t port, const char * url = "/", const char * CA_cert = NULL, const char * protocol = "arduino");
 #endif
 
@@ -98,8 +103,16 @@ class WebSocketsClient : protected WebSockets {
     uint16_t _port;
 
 #if defined(HAS_SSL)
+#ifdef SSL_AXTLS
     String _fingerprint;
     const char * _CA_cert;
+#define SSL_FINGERPRINT_NULL ""
+#else
+    const uint8_t * _fingerprint;
+    BearSSL::X509List * _CA_cert;
+#define SSL_FINGERPRINT_NULL NULL
+#endif
+
 #endif
     WSclient_t _client;
 

src/WebSocketsServer.cpp

@@ -424,7 +424,7 @@ int WebSocketsServer::connectedClients(bool ping) {
  * @param num uint8_t client id
  */
 bool WebSocketsServer::clientIsConnected(uint8_t num) {
-     if(num >= WEBSOCKETS_SERVER_CLIENT_MAX) {
+    if(num >= WEBSOCKETS_SERVER_CLIENT_MAX) {
         return false;
     }
     WSclient_t * client = &_clients[num];