mirror of
https://github.com/espressif/esp-idf.git
synced 2024-10-05 20:47:46 -04:00
45122533e0
1) Fix build issue in mbedtls 2) skip the public headers check in IDF 3)Update Kconfig Macros 4)Remove deprecated config options 5) Update the sha API according to new nomenclature 6) Update mbedtls_rsa_init usage 7) Include mbedtls/build_info.h instead of mbedtls/config.h 8) Dont include check_config.h 9) Add additional error message in esp_blufi_api.h
288 lines
8.1 KiB
C
288 lines
8.1 KiB
C
/*
|
|
* SPDX-FileCopyrightText: 2020-2022 Espressif Systems (Shanghai) CO LTD
|
|
*
|
|
* SPDX-License-Identifier: Apache-2.0
|
|
*/
|
|
|
|
#include <sys/param.h>
|
|
#include "esp_mbedtls_dynamic_impl.h"
|
|
|
|
int __real_mbedtls_ssl_write(mbedtls_ssl_context *ssl, unsigned char *buf, size_t len);
|
|
int __real_mbedtls_ssl_read(mbedtls_ssl_context *ssl, unsigned char *buf, size_t len);
|
|
void __real_mbedtls_ssl_free(mbedtls_ssl_context *ssl);
|
|
int __real_mbedtls_ssl_session_reset(mbedtls_ssl_context *ssl);
|
|
int __real_mbedtls_ssl_setup(mbedtls_ssl_context *ssl, const mbedtls_ssl_config *conf);
|
|
int __real_mbedtls_ssl_send_alert_message(mbedtls_ssl_context *ssl, unsigned char level, unsigned char message);
|
|
int __real_mbedtls_ssl_close_notify(mbedtls_ssl_context *ssl);
|
|
|
|
int __wrap_mbedtls_ssl_write(mbedtls_ssl_context *ssl, unsigned char *buf, size_t len);
|
|
int __wrap_mbedtls_ssl_read(mbedtls_ssl_context *ssl, unsigned char *buf, size_t len);
|
|
void __wrap_mbedtls_ssl_free(mbedtls_ssl_context *ssl);
|
|
int __wrap_mbedtls_ssl_session_reset(mbedtls_ssl_context *ssl);
|
|
int __wrap_mbedtls_ssl_setup(mbedtls_ssl_context *ssl, const mbedtls_ssl_config *conf);
|
|
int __wrap_mbedtls_ssl_send_alert_message(mbedtls_ssl_context *ssl, unsigned char level, unsigned char message);
|
|
int __wrap_mbedtls_ssl_close_notify(mbedtls_ssl_context *ssl);
|
|
|
|
static const char *TAG = "SSL TLS";
|
|
|
|
static int tx_done(mbedtls_ssl_context *ssl)
|
|
{
|
|
if (!ssl->out_left)
|
|
return 1;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static int rx_done(mbedtls_ssl_context *ssl)
|
|
{
|
|
if (!ssl->in_msglen) {
|
|
return 1;
|
|
}
|
|
|
|
ESP_LOGD(TAG, "RX left %zu bytes", ssl->MBEDTLS_PRIVATE(in_msglen));
|
|
return 0;
|
|
}
|
|
|
|
static void ssl_update_checksum_start( mbedtls_ssl_context *ssl,
|
|
const unsigned char *buf, size_t len )
|
|
{
|
|
#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
|
|
defined(MBEDTLS_SSL_PROTO_TLS1_1)
|
|
mbedtls_md5_update( &ssl->handshake->fin_md5 , buf, len );
|
|
mbedtls_sha1_update( &ssl->handshake->fin_sha1, buf, len );
|
|
#endif
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
|
#if defined(MBEDTLS_SHA256_C)
|
|
mbedtls_sha256_update( &ssl->handshake->fin_sha256, buf, len );
|
|
#endif
|
|
#if defined(MBEDTLS_SHA512_C)
|
|
mbedtls_sha512_update( &ssl->handshake->fin_sha512, buf, len );
|
|
#endif
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
|
}
|
|
|
|
static void ssl_handshake_params_init( mbedtls_ssl_handshake_params *handshake )
|
|
{
|
|
memset( handshake, 0, sizeof( mbedtls_ssl_handshake_params ) );
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_SSL3) || defined(MBEDTLS_SSL_PROTO_TLS1) || \
|
|
defined(MBEDTLS_SSL_PROTO_TLS1_1)
|
|
mbedtls_md5_init( &handshake->fin_md5 );
|
|
mbedtls_sha1_init( &handshake->fin_sha1 );
|
|
mbedtls_md5_starts( &handshake->fin_md5 );
|
|
mbedtls_sha1_starts( &handshake->fin_sha1 );
|
|
#endif
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2)
|
|
#if defined(MBEDTLS_SHA256_C)
|
|
mbedtls_sha256_init( &handshake->fin_sha256 );
|
|
mbedtls_sha256_starts( &handshake->fin_sha256, 0 );
|
|
#endif
|
|
#if defined(MBEDTLS_SHA512_C)
|
|
mbedtls_sha512_init( &handshake->fin_sha512 );
|
|
mbedtls_sha512_starts( &handshake->fin_sha512, 1 );
|
|
#endif
|
|
#endif /* MBEDTLS_SSL_PROTO_TLS1_2 */
|
|
|
|
handshake->update_checksum = ssl_update_checksum_start;
|
|
|
|
#if defined(MBEDTLS_SSL_PROTO_TLS1_2) && \
|
|
defined(MBEDTLS_KEY_EXCHANGE_WITH_CERT_ENABLED)
|
|
mbedtls_ssl_sig_hash_set_init( &handshake->hash_algs );
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_DHM_C)
|
|
mbedtls_dhm_init( &handshake->dhm_ctx );
|
|
#endif
|
|
#if defined(MBEDTLS_ECDH_C)
|
|
mbedtls_ecdh_init( &handshake->ecdh_ctx );
|
|
#endif
|
|
#if defined(MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED)
|
|
mbedtls_ecjpake_init( &handshake->ecjpake_ctx );
|
|
#if defined(MBEDTLS_SSL_CLI_C)
|
|
handshake->ecjpake_cache = NULL;
|
|
handshake->ecjpake_cache_len = 0;
|
|
#endif
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_SSL_ECP_RESTARTABLE)
|
|
mbedtls_x509_crt_restart_init( &handshake->ecrs_ctx );
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_SSL_SERVER_NAME_INDICATION)
|
|
handshake->sni_authmode = MBEDTLS_SSL_VERIFY_UNSET;
|
|
#endif
|
|
|
|
#if defined(MBEDTLS_X509_CRT_PARSE_C) && \
|
|
!defined(MBEDTLS_SSL_KEEP_PEER_CERTIFICATE)
|
|
mbedtls_pk_init( &handshake->peer_pubkey );
|
|
#endif
|
|
}
|
|
|
|
static int ssl_handshake_init( mbedtls_ssl_context *ssl )
|
|
{
|
|
/* Clear old handshake information if present */
|
|
if( ssl->transform_negotiate )
|
|
mbedtls_ssl_transform_free( ssl->transform_negotiate );
|
|
if( ssl->session_negotiate )
|
|
mbedtls_ssl_session_free( ssl->session_negotiate );
|
|
if( ssl->handshake )
|
|
mbedtls_ssl_handshake_free( ssl );
|
|
|
|
/*
|
|
* Either the pointers are now NULL or cleared properly and can be freed.
|
|
* Now allocate missing structures.
|
|
*/
|
|
if( ssl->transform_negotiate == NULL )
|
|
{
|
|
ssl->transform_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_transform) );
|
|
}
|
|
|
|
if( ssl->session_negotiate == NULL )
|
|
{
|
|
ssl->session_negotiate = mbedtls_calloc( 1, sizeof(mbedtls_ssl_session) );
|
|
}
|
|
|
|
if( ssl->handshake == NULL )
|
|
{
|
|
ssl->handshake = mbedtls_calloc( 1, sizeof(mbedtls_ssl_handshake_params) );
|
|
}
|
|
|
|
/* All pointers should exist and can be directly freed without issue */
|
|
if( ssl->handshake == NULL ||
|
|
ssl->transform_negotiate == NULL ||
|
|
ssl->session_negotiate == NULL )
|
|
{
|
|
ESP_LOGD(TAG, "alloc() of ssl sub-contexts failed");
|
|
|
|
mbedtls_free( ssl->handshake );
|
|
mbedtls_free( ssl->transform_negotiate );
|
|
mbedtls_free( ssl->session_negotiate );
|
|
|
|
ssl->handshake = NULL;
|
|
ssl->transform_negotiate = NULL;
|
|
ssl->session_negotiate = NULL;
|
|
|
|
return( MBEDTLS_ERR_SSL_ALLOC_FAILED );
|
|
}
|
|
|
|
/* Initialize structures */
|
|
mbedtls_ssl_session_init( ssl->session_negotiate );
|
|
mbedtls_ssl_transform_init( ssl->transform_negotiate );
|
|
ssl_handshake_params_init( ssl->handshake );
|
|
|
|
return( 0 );
|
|
}
|
|
|
|
int __wrap_mbedtls_ssl_setup(mbedtls_ssl_context *ssl, const mbedtls_ssl_config *conf)
|
|
{
|
|
ssl->conf = conf;
|
|
CHECK_OK(ssl_handshake_init(ssl));
|
|
|
|
ssl->out_buf = NULL;
|
|
CHECK_OK(esp_mbedtls_setup_tx_buffer(ssl));
|
|
|
|
ssl->in_buf = NULL;
|
|
esp_mbedtls_setup_rx_buffer(ssl);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int __wrap_mbedtls_ssl_write(mbedtls_ssl_context *ssl, unsigned char *buf, size_t len)
|
|
{
|
|
int ret;
|
|
|
|
CHECK_OK(esp_mbedtls_add_tx_buffer(ssl, 0));
|
|
|
|
ret = __real_mbedtls_ssl_write(ssl, buf, len);
|
|
|
|
if (tx_done(ssl)) {
|
|
CHECK_OK(esp_mbedtls_free_tx_buffer(ssl));
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
int __wrap_mbedtls_ssl_read(mbedtls_ssl_context *ssl, unsigned char *buf, size_t len)
|
|
{
|
|
int ret;
|
|
|
|
ESP_LOGD(TAG, "add mbedtls RX buffer");
|
|
ret = esp_mbedtls_add_rx_buffer(ssl);
|
|
if (ret == MBEDTLS_ERR_SSL_CONN_EOF) {
|
|
ESP_LOGD(TAG, "fail, the connection indicated an EOF");
|
|
return 0;
|
|
} else if (ret < 0) {
|
|
ESP_LOGD(TAG, "fail, error=%d", -ret);
|
|
return ret;
|
|
}
|
|
ESP_LOGD(TAG, "end");
|
|
|
|
ret = __real_mbedtls_ssl_read(ssl, buf, len);
|
|
|
|
if (rx_done(ssl)) {
|
|
CHECK_OK(esp_mbedtls_free_rx_buffer(ssl));
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
void __wrap_mbedtls_ssl_free(mbedtls_ssl_context *ssl)
|
|
{
|
|
if (ssl->out_buf) {
|
|
esp_mbedtls_free_buf(ssl->out_buf);
|
|
ssl->out_buf = NULL;
|
|
}
|
|
|
|
if (ssl->in_buf) {
|
|
esp_mbedtls_free_buf(ssl->in_buf);
|
|
ssl->in_buf = NULL;
|
|
}
|
|
|
|
__real_mbedtls_ssl_free(ssl);
|
|
}
|
|
|
|
int __wrap_mbedtls_ssl_session_reset(mbedtls_ssl_context *ssl)
|
|
{
|
|
CHECK_OK(esp_mbedtls_reset_add_tx_buffer(ssl));
|
|
|
|
CHECK_OK(esp_mbedtls_reset_add_rx_buffer(ssl));
|
|
|
|
CHECK_OK(__real_mbedtls_ssl_session_reset(ssl));
|
|
|
|
CHECK_OK(esp_mbedtls_reset_free_tx_buffer(ssl));
|
|
|
|
esp_mbedtls_reset_free_rx_buffer(ssl);
|
|
|
|
return 0;
|
|
}
|
|
|
|
int __wrap_mbedtls_ssl_send_alert_message(mbedtls_ssl_context *ssl, unsigned char level, unsigned char message)
|
|
{
|
|
int ret;
|
|
|
|
CHECK_OK(esp_mbedtls_add_tx_buffer(ssl, 0));
|
|
|
|
ret = __real_mbedtls_ssl_send_alert_message(ssl, level, message);
|
|
|
|
if (tx_done(ssl)) {
|
|
CHECK_OK(esp_mbedtls_free_tx_buffer(ssl));
|
|
}
|
|
|
|
return ret;
|
|
}
|
|
|
|
int __wrap_mbedtls_ssl_close_notify(mbedtls_ssl_context *ssl)
|
|
{
|
|
int ret;
|
|
|
|
CHECK_OK(esp_mbedtls_add_tx_buffer(ssl, 0));
|
|
|
|
ret = __real_mbedtls_ssl_close_notify(ssl);
|
|
|
|
if (tx_done(ssl)) {
|
|
CHECK_OK(esp_mbedtls_free_tx_buffer(ssl));
|
|
}
|
|
|
|
return ret;
|
|
}
|