From b09c3e98784b568353aca61a4c0be4866a901532 Mon Sep 17 00:00:00 2001 From: Jitin George Date: Wed, 28 Feb 2018 18:09:43 +0530 Subject: [PATCH] mbedtls integration in esp-tls --- components/esp-tls/esp_tls.c | 200 ++++++++++-------- components/esp-tls/esp_tls.h | 44 ++-- .../http2_request/components/sh2lib/sh2lib.c | 4 +- .../main/https_request_example_main.c | 8 +- 4 files changed, 152 insertions(+), 104 deletions(-) diff --git a/components/esp-tls/esp_tls.c b/components/esp-tls/esp_tls.c index d6e79f54dc..d84cf77bf9 100644 --- a/components/esp-tls/esp_tls.c +++ b/components/esp-tls/esp_tls.c @@ -23,7 +23,6 @@ #include #include "esp_tls.h" - static const char *TAG = "esp-tls"; #ifdef ESP_PLATFORM @@ -63,13 +62,14 @@ static ssize_t tcp_read(esp_tls_t *tls, char *data, size_t datalen) static ssize_t tls_read(esp_tls_t *tls, char *data, size_t datalen) { - ssize_t ret = SSL_read(tls->ssl, data, datalen); + ssize_t ret = mbedtls_ssl_read(&tls->ssl, (unsigned char *)data, datalen); if (ret < 0) { - int err = SSL_get_error(tls->ssl, ret); - if (err != SSL_ERROR_WANT_WRITE && err != SSL_ERROR_WANT_READ) { - ESP_LOGE(TAG, "read error :%d:", ret); - } - return -err; + if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) { + return 0; + } + if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) { + ESP_LOGE(TAG, "read error :%d:", ret); + } } return ret; } @@ -89,17 +89,17 @@ static int esp_tcp_connect(const char *host, int hostlen, int port) void *addr_ptr; if (res->ai_family == AF_INET) { - struct sockaddr_in *p = (struct sockaddr_in *)res->ai_addr; - p->sin_port = htons(port); - addr_ptr = p; + struct sockaddr_in *p = (struct sockaddr_in *)res->ai_addr; + p->sin_port = htons(port); + addr_ptr = p; } else if (res->ai_family == AF_INET6) { - struct sockaddr_in6 *p = (struct sockaddr_in6 *)res->ai_addr; - p->sin6_port = htons(port); - p->sin6_family = AF_INET6; - addr_ptr = p; + struct sockaddr_in6 *p = (struct sockaddr_in6 *)res->ai_addr; + p->sin6_port = htons(port); + p->sin6_family = AF_INET6; + addr_ptr = p; } else { /* Unsupported Protocol Family */ - goto err_freesocket; + goto err_freesocket; } ret = connect(fd, addr_ptr, res->ai_addrlen); @@ -117,74 +117,112 @@ err_freeaddr: return -1; } +static void verify_certificate(esp_tls_t *tls) +{ + int flags; + char buf[100]; + if ((flags = mbedtls_ssl_get_verify_result(&tls->ssl)) != 0) { + ESP_LOGI(TAG, "Failed to verify peer certificate!"); + bzero(buf, sizeof(buf)); + mbedtls_x509_crt_verify_info(buf, sizeof(buf), " ! ", flags); + ESP_LOGI(TAG, "verification info: %s", buf); + } else { + ESP_LOGI(TAG, "Certificate verified."); + } +} + +static void mbedtls_cleanup(esp_tls_t *tls) +{ + if (!tls) { + return; + } + + mbedtls_entropy_free(&tls->entropy); + mbedtls_ssl_config_free(&tls->conf); + mbedtls_ctr_drbg_free(&tls->ctr_drbg); + mbedtls_ssl_free(&tls->ssl); + mbedtls_net_free(&tls->server_fd); +} + static int create_ssl_handle(esp_tls_t *tls, const char *hostname, size_t hostlen, const esp_tls_cfg_t *cfg) { int ret; - const SSL_METHOD *method = cfg->ssl_method!= NULL ? cfg->ssl_method : TLSv1_2_client_method(); - SSL_CTX *ssl_ctx = SSL_CTX_new(method); - if (!ssl_ctx) { - return -1; + mbedtls_net_init(&tls->server_fd); + tls->server_fd.fd = tls->sockfd; + mbedtls_ssl_init(&tls->ssl); + mbedtls_ctr_drbg_init(&tls->ctr_drbg); + mbedtls_ssl_config_init(&tls->conf); + mbedtls_entropy_init(&tls->entropy); + + if ((ret = mbedtls_ctr_drbg_seed(&tls->ctr_drbg, + mbedtls_entropy_func, &tls->entropy, NULL, 0)) != 0) { + ESP_LOGE(TAG, "mbedtls_ctr_drbg_seed returned %d", ret); + goto exit; } -#ifdef __APPLE__ - SSL_CTX_set_options(ssl_ctx, SSL_OP_ALL | SSL_OP_NO_SSLv2); - SSL_CTX_set_mode(ssl_ctx, SSL_MODE_AUTO_RETRY); - SSL_CTX_set_mode(ssl_ctx, SSL_MODE_RELEASE_BUFFERS); -#endif - - if (cfg->cacert_pem_buf != NULL) { - SSL_CTX_set_verify(ssl_ctx, SSL_VERIFY_PEER, NULL); - - BIO *bio; - bio = BIO_new(BIO_s_mem()); - BIO_write(bio, cfg->cacert_pem_buf, cfg->cacert_pem_bytes); - - X509 *ca = PEM_read_bio_X509(bio, NULL, 0, NULL); - - if (!ca) { - ESP_LOGE(TAG, "CA Error"); - X509_free(ca); - BIO_free(bio); - SSL_CTX_free(ssl_ctx); - return -1; - } - ESP_LOGD(TAG, "CA OK"); - - X509_STORE_add_cert(SSL_CTX_get_cert_store(ssl_ctx), ca); - - X509_free(ca); - BIO_free(bio); - } - - if (cfg->alpn_protos) { - SSL_CTX_set_alpn_protos(ssl_ctx, cfg->alpn_protos, strlen((char *)cfg->alpn_protos)); - } - SSL *ssl = SSL_new(ssl_ctx); - if (!ssl) { - SSL_CTX_free(ssl_ctx); - return -1; - } - + + /* Hostname set here should match CN in server certificate */ char *use_host = strndup(hostname, hostlen); if (!use_host) { - SSL_CTX_free(ssl_ctx); - return -1; + goto exit; + } + + if ((ret = mbedtls_ssl_set_hostname(&tls->ssl, use_host)) != 0) { + ESP_LOGE(TAG, "mbedtls_ssl_set_hostname returned -0x%x", -ret); + free(use_host); + goto exit; } - SSL_set_tlsext_host_name(ssl, use_host); free(use_host); - SSL_set_fd(ssl, tls->sockfd); - ret = SSL_connect(ssl); - if (ret < 1) { - ESP_LOGE(TAG, "SSL handshake failed"); - SSL_free(ssl); - SSL_CTX_free(ssl_ctx); - return -1; + if ((ret = mbedtls_ssl_config_defaults(&tls->conf, + MBEDTLS_SSL_IS_CLIENT, + MBEDTLS_SSL_TRANSPORT_STREAM, + MBEDTLS_SSL_PRESET_DEFAULT)) != 0) { + ESP_LOGE(TAG, "mbedtls_ssl_config_defaults returned %d", ret); + goto exit; } - tls->ctx = ssl_ctx; - tls->ssl = ssl; + if (cfg->cacert_pem_buf != NULL) { + mbedtls_x509_crt_init(&tls->cacert); + ret = mbedtls_x509_crt_parse(&tls->cacert, cfg->cacert_pem_buf, cfg->cacert_pem_bytes); + if (ret < 0) { + ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%x\n\n", -ret); + goto exit; + } + mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_REQUIRED); + mbedtls_ssl_conf_ca_chain(&tls->conf, &tls->cacert, NULL); + } else { + mbedtls_ssl_conf_authmode(&tls->conf, MBEDTLS_SSL_VERIFY_NONE); + } + + mbedtls_ssl_conf_rng(&tls->conf, mbedtls_ctr_drbg_random, &tls->ctr_drbg); + +#ifdef CONFIG_MBEDTLS_DEBUG + mbedtls_esp_enable_debug_log(&tls->conf, 4); +#endif + + if ((ret = mbedtls_ssl_setup(&tls->ssl, &tls->conf)) != 0) { + ESP_LOGE(TAG, "mbedtls_ssl_setup returned -0x%x\n\n", -ret); + goto exit; + } + + mbedtls_ssl_set_bio(&tls->ssl, &tls->server_fd, mbedtls_net_send, mbedtls_net_recv, NULL); + + while ((ret = mbedtls_ssl_handshake(&tls->ssl)) != 0) { + if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) { + ESP_LOGE(TAG, "mbedtls_ssl_handshake returned -0x%x", -ret); + if (cfg->cacert_pem_buf != NULL) { + /* This is to check whether handshake failed due to invalid certificate*/ + verify_certificate(tls); + } + goto exit; + } + } + return 0; +exit: + mbedtls_cleanup(tls); + return -1; } /** @@ -192,15 +230,7 @@ static int create_ssl_handle(esp_tls_t *tls, const char *hostname, size_t hostle */ void esp_tls_conn_delete(esp_tls_t *tls) { - if (!tls) { - return; - } - if (tls->ssl) { - SSL_free(tls->ssl); - } - if (tls->ctx) { - SSL_CTX_free(tls->ctx); - } + mbedtls_cleanup(tls); if (tls->sockfd) { close(tls->sockfd); } @@ -214,13 +244,11 @@ static ssize_t tcp_write(esp_tls_t *tls, const char *data, size_t datalen) static ssize_t tls_write(esp_tls_t *tls, const char *data, size_t datalen) { - ssize_t ret = SSL_write(tls->ssl, data, datalen); + ssize_t ret = mbedtls_ssl_write(&tls->ssl, (unsigned char*) data, datalen); if (ret < 0) { - int err = SSL_get_error(tls->ssl, ret); - if (err != SSL_ERROR_WANT_WRITE && err != SSL_ERROR_WANT_READ) { - ESP_LOGE(TAG, "write error :%d:", ret); - } - return -err; + if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) { + ESP_LOGE(TAG, "write error :%d:", ret); + } } return ret; } @@ -253,7 +281,7 @@ esp_tls_t *esp_tls_conn_new(const char *hostname, int hostlen, int port, const e tls->write = tls_write; } - if(cfg->non_block == true) { + if (cfg->non_block == true) { int flags = fcntl(tls->sockfd, F_GETFL, 0); fcntl(tls->sockfd, F_SETFL, flags | O_NONBLOCK); } diff --git a/components/esp-tls/esp_tls.h b/components/esp-tls/esp_tls.h index 182034278a..4f2f35a03a 100644 --- a/components/esp-tls/esp_tls.h +++ b/components/esp-tls/esp_tls.h @@ -16,9 +16,18 @@ #include #include -#include #include + +#include "mbedtls/platform.h" +#include "mbedtls/net_sockets.h" +#include "mbedtls/esp_debug.h" +#include "mbedtls/ssl.h" +#include "mbedtls/entropy.h" +#include "mbedtls/ctr_drbg.h" +#include "mbedtls/error.h" +#include "mbedtls/certs.h" + #ifdef __cplusplus extern "C" { #endif @@ -36,13 +45,12 @@ typedef struct esp_tls_cfg { "\x02h2" - where the first '2' is the length of the protocol and - the subsequent 'h2' is the protocol name */ + const unsigned char *cacert_pem_buf; /*!< Certificate Authority's certificate in a buffer */ + const unsigned int cacert_pem_bytes; /*!< Size of Certificate Authority certificate pointed to by cacert_pem_buf */ - const SSL_METHOD *ssl_method; /*!< SSL method that describes internal ssl library - methods/functions which implements the various protocol - versions. If set to NULL, it defaults to - method returned by TLSv1_2_client_method() API. */ + bool non_block; /*!< Configure non-blocking mode. If set to true the underneath socket will be configured in non blocking mode after tls session is established */ @@ -52,15 +60,27 @@ typedef struct esp_tls_cfg { * @brief ESP-TLS Connection Handle */ typedef struct esp_tls { - SSL_CTX *ctx; /*!< SSL_CTX object is used to establish - TLS/SSL enabled connection */ - SSL *ssl; /*!< SSL object which is needed to hold the data for a - TLS/SSL connection. The new structure inherits the settings of the - underlying context ctx: connection method (SSLv2/v3/TLSv1), - options, verification settings, timeout settings. */ - int sockfd; /*!< Underlying socket file descriptor. */ + mbedtls_ssl_context ssl; /*!< TLS/SSL context */ + + mbedtls_entropy_context entropy; /*!< mbedTLS entropy context structure */ + + mbedtls_ctr_drbg_context ctr_drbg; /*!< mbedTLS ctr drbg context structure. + CTR_DRBG is deterministic random + bit generation based on AES-256 */ + + mbedtls_ssl_config conf; /*!< TLS/SSL configuration to be shared + between mbedtls_ssl_context + structures */ + + mbedtls_net_context server_fd; /*!< mbedTLS wrapper type for sockets */ + + mbedtls_x509_crt cacert; /*!< Container for an X.509 certificate */ + + int sockfd; /*!< Underlying socket file descriptor. */ + ssize_t (*read)(struct esp_tls *tls, char *data, size_t datalen); /*!< Callback function for reading data from TLS/SSL connection. */ + ssize_t (*write)(struct esp_tls *tls, const char *data, size_t datalen); /*!< Callback function for writing data to TLS/SSL connection. */ } esp_tls_t; diff --git a/examples/protocols/http2_request/components/sh2lib/sh2lib.c b/examples/protocols/http2_request/components/sh2lib/sh2lib.c index 5a25f9bc4f..c5bae587be 100644 --- a/examples/protocols/http2_request/components/sh2lib/sh2lib.c +++ b/examples/protocols/http2_request/components/sh2lib/sh2lib.c @@ -75,7 +75,7 @@ static ssize_t callback_send_inner(struct sh2lib_handle *hd, const uint8_t *data { int rv = esp_tls_conn_write(hd->http2_tls, data, length); if (rv <= 0) { - if (rv == -SSL_ERROR_WANT_WRITE || rv == -SSL_ERROR_WANT_READ) { + if (rv == MBEDTLS_ERR_SSL_WANT_READ || rv == MBEDTLS_ERR_SSL_WANT_WRITE) { rv = NGHTTP2_ERR_WOULDBLOCK; } else { rv = NGHTTP2_ERR_CALLBACK_FAILURE; @@ -127,7 +127,7 @@ static ssize_t callback_recv(nghttp2_session *session, uint8_t *buf, int rv; rv = esp_tls_conn_read(hd->http2_tls, (char *)buf, (int)length); if (rv < 0) { - if (rv == -SSL_ERROR_WANT_WRITE || rv == -SSL_ERROR_WANT_READ) { + if (rv == MBEDTLS_ERR_SSL_WANT_READ || rv == MBEDTLS_ERR_SSL_WANT_WRITE) { rv = NGHTTP2_ERR_WOULDBLOCK; } else { rv = NGHTTP2_ERR_CALLBACK_FAILURE; diff --git a/examples/protocols/https_request/main/https_request_example_main.c b/examples/protocols/https_request/main/https_request_example_main.c index 479399a0ae..3964b4ea52 100644 --- a/examples/protocols/https_request/main/https_request_example_main.c +++ b/examples/protocols/https_request/main/https_request_example_main.c @@ -157,7 +157,7 @@ static void https_get_task(void *pvParameters) if (ret >= 0) { ESP_LOGI(TAG, "%d bytes written", ret); written_bytes += ret; - } else if (ret != -SSL_ERROR_WANT_WRITE && ret != -SSL_ERROR_WANT_READ) { + } else if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) { ESP_LOGE(TAG, "esp_tls_conn_write returned 0x%x", ret); goto exit; } @@ -171,12 +171,12 @@ static void https_get_task(void *pvParameters) bzero(buf, sizeof(buf)); ret = esp_tls_conn_read(tls, (char *)buf, len); - if(ret == -SSL_ERROR_WANT_WRITE || ret == -SSL_ERROR_WANT_READ) + if(ret == MBEDTLS_ERR_SSL_WANT_WRITE || ret == MBEDTLS_ERR_SSL_WANT_READ) continue; if(ret < 0) - { - ESP_LOGE(TAG, "esp_tls_conn_read returned 0x%x", ret); + { + ESP_LOGE(TAG, "esp_tls_conn_read returned -0x%x", -ret); break; }