From 4af1176d153e1de9f62e1d296efad977c2f3b6d8 Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Fri, 11 Jun 2021 07:34:23 +0530 Subject: [PATCH 1/2] esp_tls_mbedtls: Improved the error messages. The error message string for error codes is printedwhen log level is set to debug --- components/esp-tls/esp_tls_mbedtls.c | 92 +++++++++++++++++++--------- 1 file changed, 63 insertions(+), 29 deletions(-) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 999ae559f2..73babb5e68 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -44,6 +44,17 @@ static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki); static const char *TAG = "esp-tls-mbedtls"; static mbedtls_x509_crt *global_cacert = NULL; + +/* This function shall return the error message when appropriate log level has been setotherwise this function will do nothing*/ +static void mbedtls_print_error_msg(int error) +{ +#if (CONFIG_LOG_DEFAULT_LEVEL_DEBUG || CONFIG_LOG_DEFAULT_LEVEL_VERBOSE) + static char error_buf[100]; + mbedtls_strerror(error, error_buf, sizeof(error_buf)); + ESP_LOGI(TAG, "(%04X): %s", error, error_buf); +#endif +} + typedef struct esp_tls_pki_t { mbedtls_x509_crt *public_cert; mbedtls_pk_context *pk_key; @@ -73,14 +84,14 @@ esp_err_t esp_create_mbedtls_handle(const char *hostname, size_t hostlen, const if (tls->role == ESP_TLS_CLIENT) { esp_ret = set_client_config(hostname, hostlen, (esp_tls_cfg_t *)cfg, tls); if (esp_ret != ESP_OK) { - ESP_LOGE(TAG, "Failed to set client configurations"); + ESP_LOGE(TAG, "Failed to set client configurations, returned [0x%04X] (%s)", esp_ret, esp_err_to_name(esp_ret)); goto exit; } } else if (tls->role == ESP_TLS_SERVER) { #ifdef CONFIG_ESP_TLS_SERVER esp_ret = set_server_config((esp_tls_cfg_server_t *) cfg, tls); if (esp_ret != 0) { - ESP_LOGE(TAG, "Failed to set server configurations"); + ESP_LOGE(TAG, "Failed to set server configurations, returned [0x%04X] (%s)", esp_ret, esp_err_to_name(esp_ret)); goto exit; } #else @@ -91,7 +102,8 @@ esp_err_t esp_create_mbedtls_handle(const char *hostname, size_t hostlen, const if ((ret = mbedtls_ctr_drbg_seed(&tls->ctr_drbg, mbedtls_entropy_func, &tls->entropy, NULL, 0)) != 0) { - ESP_LOGE(TAG, "mbedtls_ctr_drbg_seed returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_ctr_drbg_seed returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); esp_ret = ESP_ERR_MBEDTLS_CTR_DRBG_SEED_FAILED; goto exit; @@ -104,7 +116,8 @@ esp_err_t esp_create_mbedtls_handle(const char *hostname, size_t hostlen, const #endif if ((ret = mbedtls_ssl_setup(&tls->ssl, &tls->conf)) != 0) { - ESP_LOGE(TAG, "mbedtls_ssl_setup returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_ssl_setup returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); esp_ret = ESP_ERR_MBEDTLS_SSL_SETUP_FAILED; goto exit; @@ -131,7 +144,8 @@ int esp_mbedtls_handshake(esp_tls_t *tls, const esp_tls_cfg_t *cfg) return 1; } else { if (ret != ESP_TLS_ERR_SSL_WANT_READ && ret != ESP_TLS_ERR_SSL_WANT_WRITE) { - ESP_LOGE(TAG, "mbedtls_ssl_handshake returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_ssl_handshake returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_MBEDTLS_SSL_HANDSHAKE_FAILED); if (cfg->cacert_buf != NULL || cfg->use_global_ca_store == true) { @@ -157,7 +171,8 @@ ssize_t esp_mbedtls_read(esp_tls_t *tls, char *data, size_t datalen) } if (ret != ESP_TLS_ERR_SSL_WANT_READ && ret != ESP_TLS_ERR_SSL_WANT_WRITE) { ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); - ESP_LOGE(TAG, "read error :%d:", ret); + ESP_LOGE(TAG, "read error :-0x%04X:", -ret); + mbedtls_print_error_msg(ret); } } return ret; @@ -179,11 +194,13 @@ ssize_t esp_mbedtls_write(esp_tls_t *tls, const char *data, size_t datalen) if (ret != ESP_TLS_ERR_SSL_WANT_READ && ret != ESP_TLS_ERR_SSL_WANT_WRITE && ret != 0) { ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_MBEDTLS_SSL_WRITE_FAILED); - ESP_LOGE(TAG, "write error :%d:", ret); + ESP_LOGE(TAG, "write error :-0x%04X:", -ret); + mbedtls_print_error_msg(ret); return ret; } else { // Exitting the tls-write process as less than desired datalen are writable - ESP_LOGD(TAG, "mbedtls_ssl_write() returned %d, already written %d, exitting...", ret, written); + ESP_LOGD(TAG, "mbedtls_ssl_write() returned -0x%04X, already written %d, exitting...", -ret, written); + mbedtls_print_error_msg(ret); return written; } } @@ -207,13 +224,16 @@ void esp_mbedtls_conn_delete(esp_tls_t *tls) void esp_mbedtls_verify_certificate(esp_tls_t *tls) { int flags; - char buf[100]; + if ((flags = mbedtls_ssl_get_verify_result(&tls->ssl)) != 0) { ESP_LOGI(TAG, "Failed to verify peer certificate!"); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS_CERT_FLAGS, flags); +#if (CONFIG_LOG_DEFAULT_LEVEL > CONFIG_LOG_DEFAULT_LEVEL_DEBUG) + char buf[100]; bzero(buf, sizeof(buf)); mbedtls_x509_crt_verify_info(buf, sizeof(buf), " ! ", flags); - ESP_LOGI(TAG, "verification info: %s", buf); + ESP_LOGD(TAG, "verification info: %s", buf); +#endif } else { ESP_LOGI(TAG, "Certificate verified."); } @@ -263,7 +283,8 @@ static esp_err_t set_ca_cert(esp_tls_t *tls, const unsigned char *cacert, size_t mbedtls_x509_crt_init(tls->cacert_ptr); int ret = mbedtls_x509_crt_parse(tls->cacert_ptr, cacert, cacert_len); if (ret < 0) { - ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_X509_CRT_PARSE_FAILED; } @@ -292,7 +313,8 @@ static esp_err_t set_pki_context(esp_tls_t *tls, const esp_tls_pki_t *pki) ret = mbedtls_x509_crt_parse(pki->public_cert, pki->publiccert_pem_buf, pki->publiccert_pem_bytes); if (ret < 0) { - ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_X509_CRT_PARSE_FAILED; } @@ -301,7 +323,7 @@ static esp_err_t set_pki_context(esp_tls_t *tls, const esp_tls_pki_t *pki) if (pki->esp_ds_data != NULL) { ret = esp_mbedtls_init_pk_ctx_for_ds(pki); if (ret != ESP_OK) { - ESP_LOGE(TAG, "Failed to initialize pk context for "); + ESP_LOGE(TAG, "Failed to initialize pk context for esp_ds"); return ret; } } else @@ -314,14 +336,16 @@ static esp_err_t set_pki_context(esp_tls_t *tls, const esp_tls_pki_t *pki) } if (ret < 0) { - ESP_LOGE(TAG, "mbedtls_pk_parse_keyfile returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_pk_parse_keyfile returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_PK_PARSE_KEY_FAILED; } ret = mbedtls_ssl_conf_own_cert(&tls->conf, pki->public_cert, pki->pk_key); if (ret < 0) { - ESP_LOGE(TAG, "mbedtls_ssl_conf_own_cert returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_ssl_conf_own_cert returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_SSL_CONF_OWN_CERT_FAILED; } @@ -356,7 +380,8 @@ esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls) MBEDTLS_SSL_IS_SERVER, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT)) != 0) { - ESP_LOGE(TAG, "mbedtls_ssl_config_defaults returned %d", ret); + ESP_LOGE(TAG, "mbedtls_ssl_config_defaults returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_SSL_CONFIG_DEFAULTS_FAILED; } @@ -418,7 +443,8 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t } /* Hostname set here should match CN in server certificate */ if ((ret = mbedtls_ssl_set_hostname(&tls->ssl, use_host)) != 0) { - ESP_LOGE(TAG, "mbedtls_ssl_set_hostname returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_ssl_set_hostname returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); free(use_host); return ESP_ERR_MBEDTLS_SSL_SET_HOSTNAME_FAILED; @@ -430,7 +456,8 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, MBEDTLS_SSL_PRESET_DEFAULT)) != 0) { - ESP_LOGE(TAG, "mbedtls_ssl_config_defaults returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_ssl_config_defaults returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_SSL_CONFIG_DEFAULTS_FAILED; } @@ -442,7 +469,7 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t if (cfg->alpn_protos) { #ifdef CONFIG_MBEDTLS_SSL_ALPN if ((ret = mbedtls_ssl_conf_alpn_protocols(&tls->conf, cfg->alpn_protos)) != 0) { - ESP_LOGE(TAG, "mbedtls_ssl_conf_alpn_protocols returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_ssl_conf_alpn_protocols returned -0x%04X", -ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_SSL_CONF_ALPN_PROTOCOLS_FAILED; } @@ -480,7 +507,8 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t ret = mbedtls_ssl_conf_psk(&tls->conf, cfg->psk_hint_key->key, cfg->psk_hint_key->key_size, (const unsigned char *)cfg->psk_hint_key->hint, strlen(cfg->psk_hint_key->hint)); if (ret != 0) { - ESP_LOGE(TAG, "mbedtls_ssl_conf_psk returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_ssl_conf_psk returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_SSL_CONF_PSK_FAILED; } @@ -529,7 +557,7 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t esp_err_t esp_ret = set_pki_context(tls, &pki); if (esp_ret != ESP_OK) { - ESP_LOGE(TAG, "Failed to set client pki context for the DS peripheral, returned %02x", esp_ret); + ESP_LOGE(TAG, "Failed to set client pki context for the DS peripheral, returned [0x%04X] (%s)", ret, esp_err_to_name(esp_ret)); return esp_ret; } #else @@ -572,7 +600,7 @@ int esp_mbedtls_server_session_create(esp_tls_cfg_server_t *cfg, int sockfd, esp tls->sockfd = sockfd; esp_err_t esp_ret = esp_create_mbedtls_handle(NULL, 0, cfg, tls); if (esp_ret != ESP_OK) { - ESP_LOGE(TAG, "create_ssl_handle failed"); + ESP_LOGE(TAG, "create_ssl_handle failed, returned [0x%04X] (%s)", esp_ret, esp_err_to_name(esp_ret)); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, esp_ret); tls->conn_state = ESP_TLS_FAIL; return -1; @@ -582,7 +610,8 @@ int esp_mbedtls_server_session_create(esp_tls_cfg_server_t *cfg, int sockfd, esp int ret; while ((ret = mbedtls_ssl_handshake(&tls->ssl)) != 0) { if (ret != ESP_TLS_ERR_SSL_WANT_READ && ret != ESP_TLS_ERR_SSL_WANT_WRITE) { - ESP_LOGE(TAG, "mbedtls_ssl_handshake returned %d", ret); + ESP_LOGE(TAG, "mbedtls_ssl_handshake returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); tls->conn_state = ESP_TLS_FAIL; return ret; } @@ -634,7 +663,8 @@ esp_err_t esp_mbedtls_set_global_ca_store(const unsigned char *cacert_pem_buf, c } ret = mbedtls_x509_crt_parse(global_cacert, cacert_pem_buf, cacert_pem_bytes); if (ret < 0) { - ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); mbedtls_x509_crt_free(global_cacert); free(global_cacert); global_cacert = NULL; @@ -666,7 +696,7 @@ static esp_err_t esp_init_atecc608a(uint8_t i2c_addr) cfg_ateccx08a_i2c_default.atcai2c.address = i2c_addr; int ret = atcab_init(&cfg_ateccx08a_i2c_default); if(ret != 0) { - ESP_LOGE(TAG, "Failed\n !atcab_init returned %02x", ret); + ESP_LOGE(TAG, "Failed to initialize atca device, returned -0x%04X", -ret); return ESP_FAIL; } return ESP_OK; @@ -701,7 +731,8 @@ static esp_err_t esp_set_atecc608a_pki_context(esp_tls_t *tls, esp_tls_cfg_t *cf /* Extract the device certificate and convert to mbedtls cert */ ret = atca_mbedtls_cert_add(&tls->clientcert, cert_def); if (ret != 0) { - ESP_LOGE(TAG, "Failed to parse cert from device, return %02x", ret); + ESP_LOGE(TAG, "Failed to parse cert from device, return 0x%04X", ret); + mbedtls_print_error_msg(ret); return ESP_ERR_ESP_TLS_SE_FAILED; } #elif CONFIG_ATECC608A_TCUSTOM @@ -714,7 +745,8 @@ static esp_err_t esp_set_atecc608a_pki_context(esp_tls_t *tls, esp_tls_cfg_t *cf if(cfg->clientcert_buf != NULL) { ret = mbedtls_x509_crt_parse(&tls->clientcert, (const unsigned char*)cfg->clientcert_buf, cfg->clientcert_bytes); if (ret < 0) { - ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%x", -ret); + ESP_LOGE(TAG, "mbedtls_x509_crt_parse returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_MBEDTLS_X509_CRT_PARSE_FAILED; } @@ -732,7 +764,8 @@ static esp_err_t esp_set_atecc608a_pki_context(esp_tls_t *tls, esp_tls_cfg_t *cf ret = mbedtls_ssl_conf_own_cert(&tls->conf, &tls->clientcert, &tls->clientkey); if (ret != 0) { - ESP_LOGE(TAG, "Failed\n ! mbedtls_ssl_conf_own_cert returned -0x%x", ret); + ESP_LOGE(TAG, "Failed to configure client cert, returned -0x%04X", ret); + mbedtls_print_error_msg(ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); return ESP_ERR_ESP_TLS_SE_FAILED; } @@ -749,7 +782,8 @@ static esp_err_t esp_mbedtls_init_pk_ctx_for_ds(const void *pki) mbedtls_rsa_init(&rsakey, MBEDTLS_RSA_PKCS_V15, 0); if ((ret = mbedtls_pk_setup_rsa_alt(((const esp_tls_pki_t*)pki)->pk_key, &rsakey, NULL, esp_ds_rsa_sign, esp_ds_get_keylen )) != 0) { - ESP_LOGE(TAG, "Error in mbedtls_pk_setup_rsa_alt, returned %02x", ret); + ESP_LOGE(TAG, "Error in mbedtls_pk_setup_rsa_alt, returned -0x%04X", -ret); + mbedtls_print_error_msg(ret); return ESP_FAIL; } ret = esp_ds_init_data_ctx(((const esp_tls_pki_t*)pki)->esp_ds_data); From 0e01a22264f27544a082fe3a874623926ff9b082 Mon Sep 17 00:00:00 2001 From: Aditya Patwardhan Date: Fri, 11 Jun 2021 12:52:44 +0530 Subject: [PATCH 2/2] esp_tls_wolfssl: Improved error messages --- components/esp-tls/esp_tls_mbedtls.c | 4 +- components/esp-tls/esp_tls_wolfssl.c | 103 ++++++++++++++++++--------- 2 files changed, 72 insertions(+), 35 deletions(-) diff --git a/components/esp-tls/esp_tls_mbedtls.c b/components/esp-tls/esp_tls_mbedtls.c index 73babb5e68..35064399c9 100644 --- a/components/esp-tls/esp_tls_mbedtls.c +++ b/components/esp-tls/esp_tls_mbedtls.c @@ -45,7 +45,7 @@ static const char *TAG = "esp-tls-mbedtls"; static mbedtls_x509_crt *global_cacert = NULL; -/* This function shall return the error message when appropriate log level has been setotherwise this function will do nothing*/ +/* This function shall return the error message when appropriate log level has been set, otherwise this function shall do nothing */ static void mbedtls_print_error_msg(int error) { #if (CONFIG_LOG_DEFAULT_LEVEL_DEBUG || CONFIG_LOG_DEFAULT_LEVEL_VERBOSE) @@ -471,6 +471,7 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t if ((ret = mbedtls_ssl_conf_alpn_protocols(&tls->conf, cfg->alpn_protos)) != 0) { ESP_LOGE(TAG, "mbedtls_ssl_conf_alpn_protocols returned -0x%04X", -ret); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); + mbedtls_print_error_msg(ret); return ESP_ERR_MBEDTLS_SSL_CONF_ALPN_PROTOCOLS_FAILED; } #else @@ -759,6 +760,7 @@ static esp_err_t esp_set_atecc608a_pki_context(esp_tls_t *tls, esp_tls_cfg_t *cf if (ret != 0) { ESP_LOGE(TAG, "Failed to parse key from device"); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret); + mbedtls_print_error_msg(ret); return ESP_ERR_ESP_TLS_SE_FAILED; } diff --git a/components/esp-tls/esp_tls_wolfssl.c b/components/esp-tls/esp_tls_wolfssl.c index 68561bb6f3..dabcd6225c 100644 --- a/components/esp-tls/esp_tls_wolfssl.c +++ b/components/esp-tls/esp_tls_wolfssl.c @@ -48,6 +48,16 @@ static uint8_t psk_key_max_len = 0; static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls); #endif /* CONFIG_ESP_TLS_SERVER */ + +/* This function shall return the error message when appropriate log level has been set otherwise this function shall do nothing */ +static void wolfssl_print_error_msg(int error) +{ +#if (CONFIG_LOG_DEFAULT_LEVEL_DEBUG || CONFIG_LOG_DEFAULT_LEVEL_VERBOSE) + static char error_buf[100]; + ESP_LOGE(TAG, "(%d) : %s", error, ERR_error_string(error, error_buf)); +#endif +} + typedef enum x509_file_type { FILE_TYPE_CA_CERT = 0, /* CA certificate to authenticate entity at other end */ FILE_TYPE_SELF_CERT, /* Self certificate of the entity */ @@ -119,22 +129,24 @@ esp_err_t esp_create_wolfssl_handle(const char *hostname, size_t hostlen, const ret = wolfSSL_Init(); if (ret != WOLFSSL_SUCCESS) { - ESP_LOGE(TAG, "Init wolfSSL failed: %d", ret); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret); + ESP_LOGE(TAG, "Init wolfSSL failed: 0x%04X", ret); + wolfssl_print_error_msg(ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, err); goto exit; } if (tls->role == ESP_TLS_CLIENT) { esp_ret = set_client_config(hostname, hostlen, (esp_tls_cfg_t *)cfg, tls); if (esp_ret != ESP_OK) { - ESP_LOGE(TAG, "Failed to set client configurations"); + ESP_LOGE(TAG, "Failed to set client configurations, [0x%04X] (%s)", esp_ret, esp_err_to_name(esp_ret)); goto exit; } } else if (tls->role == ESP_TLS_SERVER) { #ifdef CONFIG_ESP_TLS_SERVER esp_ret = set_server_config((esp_tls_cfg_server_t *) cfg, tls); if (esp_ret != ESP_OK) { - ESP_LOGE(TAG, "Failed to set server configurations"); + ESP_LOGE(TAG, "Failed to set server configurations, [0x%04X] (%s)", esp_ret, esp_err_to_name(esp_ret)); goto exit; } #else @@ -159,7 +171,7 @@ static esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls tls->priv_ctx = (void *)wolfSSL_CTX_new(wolfTLSv1_2_client_method()); if (!tls->priv_ctx) { ESP_LOGE(TAG, "Set wolfSSL ctx failed"); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, ret); return ESP_ERR_WOLFSSL_CTX_SETUP_FAILED; } @@ -170,13 +182,17 @@ static esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls if (cfg->use_global_ca_store == true) { if ((esp_load_wolfssl_verify_buffer(tls, global_cacert, global_cacert_pem_bytes, FILE_TYPE_CA_CERT, &ret)) != ESP_OK) { - ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_ERR_WOLFSSL_CERT_VERIFY_SETUP_FAILED; } wolfSSL_CTX_set_verify( (WOLFSSL_CTX *)tls->priv_ctx, WOLFSSL_VERIFY_PEER, NULL); } else if (cfg->cacert_buf != NULL) { if ((esp_load_wolfssl_verify_buffer(tls, cfg->cacert_buf, cfg->cacert_bytes, FILE_TYPE_CA_CERT, &ret)) != ESP_OK) { - ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_ERR_WOLFSSL_CERT_VERIFY_SETUP_FAILED; } wolfSSL_CTX_set_verify( (WOLFSSL_CTX *)tls->priv_ctx, WOLFSSL_VERIFY_PEER, NULL); @@ -222,11 +238,15 @@ static esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls if (cfg->clientcert_buf != NULL && cfg->clientkey_buf != NULL) { if ((esp_load_wolfssl_verify_buffer(tls,cfg->clientcert_buf, cfg->clientcert_bytes, FILE_TYPE_SELF_CERT, &ret)) != ESP_OK) { - ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_ERR_WOLFSSL_CERT_VERIFY_SETUP_FAILED; } if ((esp_load_wolfssl_verify_buffer(tls,cfg->clientkey_buf, cfg->clientkey_bytes, FILE_TYPE_SELF_KEY, &ret)) != ESP_OK) { - ESP_LOGE(TAG, "Error in loading private key verify buffer, returned %d", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "Error in loading private key verify buffer, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_ERR_WOLFSSL_CERT_VERIFY_SETUP_FAILED; } } else if (cfg->clientcert_buf != NULL || cfg->clientkey_buf != NULL) { @@ -237,7 +257,8 @@ static esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls tls->priv_ssl =(void *)wolfSSL_new( (WOLFSSL_CTX *)tls->priv_ctx); if (!tls->priv_ssl) { ESP_LOGE(TAG, "Create wolfSSL failed"); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, err); return ESP_ERR_WOLFSSL_SSL_SETUP_FAILED; } @@ -253,8 +274,9 @@ static esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls } /* Hostname set here should match CN in server certificate */ if ((ret = (wolfSSL_check_domain_name( (WOLFSSL *)tls->priv_ssl, use_host))) != WOLFSSL_SUCCESS) { - ESP_LOGE(TAG, "wolfSSL_check_domain_name returned -0x%x", -ret); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "wolfSSL_check_domain_name returned %d, error code: %d", ret, err); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, err); free(use_host); return ESP_ERR_WOLFSSL_SSL_SET_HOSTNAME_FAILED; } @@ -267,8 +289,10 @@ static esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls for (; *alpn_list != NULL; alpn_list ++) { ESP_LOGD(TAG, "alpn protocol is %s", *alpn_list); if ((ret = wolfSSL_UseALPN( (WOLFSSL *)tls->priv_ssl, *alpn_list, strlen(*alpn_list), WOLFSSL_ALPN_FAILED_ON_MISMATCH)) != WOLFSSL_SUCCESS) { - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret); - ESP_LOGE(TAG, "wolfSSL UseALPN failed, returned %d", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, err); + ESP_LOGE(TAG, "wolfSSL UseALPN failed, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_ERR_WOLFSSL_SSL_CONF_ALPN_PROTOCOLS_FAILED; } } @@ -294,7 +318,9 @@ static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls) if (cfg->cacert_buf != NULL) { if ((esp_load_wolfssl_verify_buffer(tls,cfg->cacert_buf, cfg->cacert_bytes, FILE_TYPE_CA_CERT, &ret)) != ESP_OK) { - ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_ERR_WOLFSSL_CERT_VERIFY_SETUP_FAILED; } wolfSSL_CTX_set_verify( (WOLFSSL_CTX *)tls->priv_ctx, WOLFSSL_VERIFY_PEER | WOLFSSL_VERIFY_FAIL_IF_NO_PEER_CERT, NULL); @@ -306,15 +332,19 @@ static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls) if (cfg->servercert_buf != NULL && cfg->serverkey_buf != NULL) { if ((esp_load_wolfssl_verify_buffer(tls,cfg->servercert_buf, cfg->servercert_bytes, FILE_TYPE_SELF_CERT, &ret)) != ESP_OK) { - ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "Error in loading certificate verify buffer, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_ERR_WOLFSSL_CERT_VERIFY_SETUP_FAILED; } if ((esp_load_wolfssl_verify_buffer(tls,cfg->serverkey_buf, cfg->serverkey_bytes, FILE_TYPE_SELF_KEY, &ret)) != ESP_OK) { - ESP_LOGE(TAG, "Error in loading private key verify buffer, returned %d", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "Error in loading private key verify buffer, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_ERR_WOLFSSL_CERT_VERIFY_SETUP_FAILED; } } else { - ESP_LOGE(TAG, "You have to provide both servercert_buf and serverkey_buf for https_server\n\n"); + ESP_LOGE(TAG, "You have to provide both servercert_buf and serverkey_buf for https_server"); return ESP_FAIL; } @@ -339,8 +369,9 @@ int esp_wolfssl_handshake(esp_tls_t *tls, const esp_tls_cfg_t *cfg) } else { int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); if (err != WOLFSSL_ERROR_WANT_READ && err != WOLFSSL_ERROR_WANT_WRITE) { - ESP_LOGE(TAG, "wolfSSL_connect returned %d, error code: 0x%x", ret, err); - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -err); + ESP_LOGE(TAG, "wolfSSL_connect returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, err); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_WOLFSSL_SSL_HANDSHAKE_FAILED); if (cfg->cacert_buf != NULL || cfg->use_global_ca_store == true) { /* This is to check whether handshake failed due to invalid certificate*/ @@ -359,15 +390,16 @@ ssize_t esp_wolfssl_read(esp_tls_t *tls, char *data, size_t datalen) { ssize_t ret = wolfSSL_read( (WOLFSSL *)tls->priv_ssl, (unsigned char *)data, datalen); if (ret < 0) { - ret = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); /* peer sent close notify */ - if (ret == WOLFSSL_ERROR_ZERO_RETURN) { + if (err == WOLFSSL_ERROR_ZERO_RETURN) { return 0; } if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) { ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret); ESP_LOGE(TAG, "read error :%d:", ret); + wolfssl_print_error_msg(ret); } return esp_tls_convert_wolfssl_err_to_ssize(ret); } @@ -378,12 +410,12 @@ ssize_t esp_wolfssl_write(esp_tls_t *tls, const char *data, size_t datalen) { ssize_t ret = wolfSSL_write( (WOLFSSL *)tls->priv_ssl, (unsigned char *) data, datalen); if (ret < 0) { - ret = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); - if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) { - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + if (err != WOLFSSL_ERROR_WANT_READ && err != WOLFSSL_ERROR_WANT_WRITE) { + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -err); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, ESP_ERR_WOLFSSL_SSL_WRITE_FAILED); - ESP_LOGE(TAG, "write error :%d:", ret); - + ESP_LOGE(TAG, "write error :%d:", err); + wolfssl_print_error_msg(err); } return esp_tls_convert_wolfssl_err_to_ssize(ret); } @@ -394,7 +426,7 @@ void esp_wolfssl_verify_certificate(esp_tls_t *tls) { int flags; if ((flags = wolfSSL_get_verify_result( (WOLFSSL *)tls->priv_ssl)) != X509_V_OK) { - ESP_LOGE(TAG, "Failed to verify peer certificate , returned %d!", flags); + ESP_LOGE(TAG, "Failed to verify peer certificate , returned %d", flags); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL_CERT_FLAGS, flags); } else { ESP_LOGI(TAG, "Certificate verified."); @@ -446,7 +478,7 @@ int esp_wolfssl_server_session_create(esp_tls_cfg_server_t *cfg, int sockfd, esp tls->sockfd = sockfd; esp_err_t esp_ret = esp_create_wolfssl_handle(NULL, 0, cfg, tls); if (esp_ret != ESP_OK) { - ESP_LOGE(TAG, "create_ssl_handle failed"); + ESP_LOGE(TAG, "create_ssl_handle failed, [0x%04X] (%s)", esp_ret, esp_err_to_name(esp_ret)); ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_ESP, esp_ret); tls->conn_state = ESP_TLS_FAIL; return -1; @@ -455,10 +487,11 @@ int esp_wolfssl_server_session_create(esp_tls_cfg_server_t *cfg, int sockfd, esp tls->write = esp_wolfssl_write; int ret; while ((ret = wolfSSL_accept((WOLFSSL *)tls->priv_ssl)) != WOLFSSL_SUCCESS) { - ret = wolfSSL_get_error((WOLFSSL *)tls->priv_ssl, ret); - if (ret != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) { - ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, -ret); - ESP_LOGE(TAG, "wolfSSL_handshake_server returned %d", ret); + int err = wolfSSL_get_error((WOLFSSL *)tls->priv_ssl, ret); + if (err != WOLFSSL_ERROR_WANT_READ && ret != WOLFSSL_ERROR_WANT_WRITE) { + ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_WOLFSSL, err); + ESP_LOGE(TAG, "wolfSSL_accept returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); tls->conn_state = ESP_TLS_FAIL; return -1; } @@ -534,7 +567,9 @@ static esp_err_t esp_wolfssl_set_cipher_list(WOLFSSL_CTX *ctx) ESP_LOGD(TAG, "cipher list is %s", defaultCipherList); if ((ret = wolfSSL_CTX_set_cipher_list(ctx,defaultCipherList)) != WOLFSSL_SUCCESS) { wolfSSL_CTX_free(ctx); - ESP_LOGE(TAG, "can't set cipher list, returned %02x", ret); + int err = wolfSSL_get_error( (WOLFSSL *)tls->priv_ssl, ret); + ESP_LOGE(TAG, "can't set cipher list, returned %d, error code: %d", ret, err); + wolfssl_print_error_msg(err); return ESP_FAIL; } return ESP_OK;