V.06 11/3
Dependencies: FT6206 SDFileSystem SPI_TFT_ILI9341 TFT_fonts
Fork of ATT_AWS_IoT_demo by
AWS_openssl/aws_iot_src/protocol/mqtt/aws_iot_embedded_client_wrapper/platform_mbed_os/mbedtls/network_mbedtls_wrapper.cpp@15:6f2798e45099, 2016-12-01 (annotated)
- Committer:
- ampembeng
- Date:
- Thu Dec 01 18:05:38 2016 +0000
- Revision:
- 15:6f2798e45099
- Child:
- 18:6370da1de572
Initial commit. Demo works with both the FRDM wired Ethernet and the Avnet Shield wireless modem.
Who changed what in which revision?
User | Revision | Line number | New contents of line |
---|---|---|---|
ampembeng | 15:6f2798e45099 | 1 | /* |
ampembeng | 15:6f2798e45099 | 2 | * Copyright 2010-2015 Amazon.com, Inc. or its affiliates. All Rights Reserved. |
ampembeng | 15:6f2798e45099 | 3 | * |
ampembeng | 15:6f2798e45099 | 4 | * Licensed under the Apache License, Version 2.0 (the "License"). |
ampembeng | 15:6f2798e45099 | 5 | * You may not use this file except in compliance with the License. |
ampembeng | 15:6f2798e45099 | 6 | * A copy of the License is located at |
ampembeng | 15:6f2798e45099 | 7 | * |
ampembeng | 15:6f2798e45099 | 8 | * http://aws.amazon.com/apache2.0 |
ampembeng | 15:6f2798e45099 | 9 | * |
ampembeng | 15:6f2798e45099 | 10 | * or in the "license" file accompanying this file. This file is distributed |
ampembeng | 15:6f2798e45099 | 11 | * on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either |
ampembeng | 15:6f2798e45099 | 12 | * express or implied. See the License for the specific language governing |
ampembeng | 15:6f2798e45099 | 13 | * permissions and limitations under the License. |
ampembeng | 15:6f2798e45099 | 14 | */ |
ampembeng | 15:6f2798e45099 | 15 | |
ampembeng | 15:6f2798e45099 | 16 | #include <stdbool.h> |
ampembeng | 15:6f2798e45099 | 17 | #include <string.h> |
ampembeng | 15:6f2798e45099 | 18 | |
ampembeng | 15:6f2798e45099 | 19 | |
ampembeng | 15:6f2798e45099 | 20 | #include "aws_iot_config.h" |
ampembeng | 15:6f2798e45099 | 21 | #include "aws_iot_error.h" |
ampembeng | 15:6f2798e45099 | 22 | #include "aws_iot_log.h" |
ampembeng | 15:6f2798e45099 | 23 | #include "network_interface.h" |
ampembeng | 15:6f2798e45099 | 24 | #include "mbedtls/config.h" |
ampembeng | 15:6f2798e45099 | 25 | |
ampembeng | 15:6f2798e45099 | 26 | #include "mbedtls/net.h" |
ampembeng | 15:6f2798e45099 | 27 | #include "mbedtls/ssl.h" |
ampembeng | 15:6f2798e45099 | 28 | #include "mbedtls/entropy.h" |
ampembeng | 15:6f2798e45099 | 29 | #include "mbedtls/ctr_drbg.h" |
ampembeng | 15:6f2798e45099 | 30 | #include "mbedtls/certs.h" |
ampembeng | 15:6f2798e45099 | 31 | #include "mbedtls/x509.h" |
ampembeng | 15:6f2798e45099 | 32 | #include "mbedtls/error.h" |
ampembeng | 15:6f2798e45099 | 33 | #include "mbedtls/debug.h" |
ampembeng | 15:6f2798e45099 | 34 | #include "mbedtls/timing.h" |
ampembeng | 15:6f2798e45099 | 35 | #include "mbedtls/net_sockets.h" |
ampembeng | 15:6f2798e45099 | 36 | #include "pem.h" |
ampembeng | 15:6f2798e45099 | 37 | |
ampembeng | 15:6f2798e45099 | 38 | #include "platform.h" |
ampembeng | 15:6f2798e45099 | 39 | #include "WNCTCPSocketConnection.h" |
ampembeng | 15:6f2798e45099 | 40 | |
ampembeng | 15:6f2798e45099 | 41 | #ifdef USING_AVNET_SHIELD |
ampembeng | 15:6f2798e45099 | 42 | // Used for BIO connections |
ampembeng | 15:6f2798e45099 | 43 | extern WNCTCPSocketConnection* _tcpsocket; |
ampembeng | 15:6f2798e45099 | 44 | #endif |
ampembeng | 15:6f2798e45099 | 45 | |
ampembeng | 15:6f2798e45099 | 46 | /* |
ampembeng | 15:6f2798e45099 | 47 | * This is a function to do further verification if needed on the cert received |
ampembeng | 15:6f2798e45099 | 48 | */ |
ampembeng | 15:6f2798e45099 | 49 | static int myCertVerify(void *data, mbedtls_x509_crt *crt, int depth, uint32_t *flags) { |
ampembeng | 15:6f2798e45099 | 50 | char buf[1024]; |
ampembeng | 15:6f2798e45099 | 51 | ((void) data); |
ampembeng | 15:6f2798e45099 | 52 | |
ampembeng | 15:6f2798e45099 | 53 | DEBUG("\nVerify requested for (Depth %d):\n", depth); |
ampembeng | 15:6f2798e45099 | 54 | mbedtls_x509_crt_info(buf, sizeof(buf) - 1, "", crt); |
ampembeng | 15:6f2798e45099 | 55 | DEBUG("%s", buf); |
ampembeng | 15:6f2798e45099 | 56 | |
ampembeng | 15:6f2798e45099 | 57 | if ((*flags) == 0) { |
ampembeng | 15:6f2798e45099 | 58 | DEBUG(" This certificate has no flags\n"); |
ampembeng | 15:6f2798e45099 | 59 | } else { |
ampembeng | 15:6f2798e45099 | 60 | DEBUG(buf, sizeof(buf), " ! ", *flags); DEBUG("%s\n", buf); |
ampembeng | 15:6f2798e45099 | 61 | } |
ampembeng | 15:6f2798e45099 | 62 | |
ampembeng | 15:6f2798e45099 | 63 | return (0); |
ampembeng | 15:6f2798e45099 | 64 | } |
ampembeng | 15:6f2798e45099 | 65 | |
ampembeng | 15:6f2798e45099 | 66 | static int ret = 0, i; |
ampembeng | 15:6f2798e45099 | 67 | static mbedtls_entropy_context entropy; |
ampembeng | 15:6f2798e45099 | 68 | static mbedtls_ctr_drbg_context ctr_drbg; |
ampembeng | 15:6f2798e45099 | 69 | static mbedtls_ssl_context ssl; |
ampembeng | 15:6f2798e45099 | 70 | static mbedtls_ssl_config conf; |
ampembeng | 15:6f2798e45099 | 71 | static uint32_t flags; |
ampembeng | 15:6f2798e45099 | 72 | static mbedtls_x509_crt cacert; |
ampembeng | 15:6f2798e45099 | 73 | static mbedtls_x509_crt clicert; |
ampembeng | 15:6f2798e45099 | 74 | static mbedtls_pk_context pkey; |
ampembeng | 15:6f2798e45099 | 75 | static mbedtls_net_context server_fd; |
ampembeng | 15:6f2798e45099 | 76 | |
ampembeng | 15:6f2798e45099 | 77 | // TODO: We can modify these functions to pull certs from an SD card |
ampembeng | 15:6f2798e45099 | 78 | int mbedtls_pk_load_file( const char *path, unsigned char **buf, size_t *n ) |
ampembeng | 15:6f2798e45099 | 79 | { |
ampembeng | 15:6f2798e45099 | 80 | //FILE *f; |
ampembeng | 15:6f2798e45099 | 81 | //long size; |
ampembeng | 15:6f2798e45099 | 82 | |
ampembeng | 15:6f2798e45099 | 83 | // Assign cert/key based on 'path' |
ampembeng | 15:6f2798e45099 | 84 | /* |
ampembeng | 15:6f2798e45099 | 85 | switch (path[0]) |
ampembeng | 15:6f2798e45099 | 86 | { |
ampembeng | 15:6f2798e45099 | 87 | case 'r': |
ampembeng | 15:6f2798e45099 | 88 | *n = (size_t)(sizeof(AWS_IOT_ROOT_CA)/sizeof(AWS_IOT_ROOT_CA[0])); |
ampembeng | 15:6f2798e45099 | 89 | *buf = AWS_IOT_ROOT_CA; |
ampembeng | 15:6f2798e45099 | 90 | break; |
ampembeng | 15:6f2798e45099 | 91 | case 'c': |
ampembeng | 15:6f2798e45099 | 92 | *n = (size_t)(sizeof(AWS_IOT_CERTIFICATE)/sizeof(AWS_IOT_CERTIFICATE[0])); |
ampembeng | 15:6f2798e45099 | 93 | *buf = AWS_IOT_CERTIFICATE; |
ampembeng | 15:6f2798e45099 | 94 | break; |
ampembeng | 15:6f2798e45099 | 95 | case 'p': |
ampembeng | 15:6f2798e45099 | 96 | *n = (size_t)sizeof (AWS_IOT_PRIVATE_KEY); |
ampembeng | 15:6f2798e45099 | 97 | *buf = (unsigned char *) AWS_IOT_PRIVATE_KEY; |
ampembeng | 15:6f2798e45099 | 98 | |
ampembeng | 15:6f2798e45099 | 99 | //ret = mbedtls_pk_parse_key(&pkey, (unsigned char *) AWS_IOT_PRIVATE_KEY, sizeof (AWS_IOT_PRIVATE_KEY), NULL, 0 ); |
ampembeng | 15:6f2798e45099 | 100 | break; |
ampembeng | 15:6f2798e45099 | 101 | default: |
ampembeng | 15:6f2798e45099 | 102 | ERROR(" failed\n ! Unknown option for cert/key\n\r"); |
ampembeng | 15:6f2798e45099 | 103 | }*/ |
ampembeng | 15:6f2798e45099 | 104 | |
ampembeng | 15:6f2798e45099 | 105 | /* |
ampembeng | 15:6f2798e45099 | 106 | if( ( f = fopen( path, "rb" ) ) == NULL ) |
ampembeng | 15:6f2798e45099 | 107 | return( MBEDTLS_ERR_PK_FILE_IO_ERROR ); |
ampembeng | 15:6f2798e45099 | 108 | |
ampembeng | 15:6f2798e45099 | 109 | fseek( f, 0, SEEK_END ); |
ampembeng | 15:6f2798e45099 | 110 | if( ( size = ftell( f ) ) == -1 ) |
ampembeng | 15:6f2798e45099 | 111 | { |
ampembeng | 15:6f2798e45099 | 112 | fclose( f ); |
ampembeng | 15:6f2798e45099 | 113 | return( MBEDTLS_ERR_PK_FILE_IO_ERROR ); |
ampembeng | 15:6f2798e45099 | 114 | } |
ampembeng | 15:6f2798e45099 | 115 | fseek( f, 0, SEEK_SET ); |
ampembeng | 15:6f2798e45099 | 116 | |
ampembeng | 15:6f2798e45099 | 117 | *n = (size_t) size; |
ampembeng | 15:6f2798e45099 | 118 | |
ampembeng | 15:6f2798e45099 | 119 | if( *n + 1 == 0 || |
ampembeng | 15:6f2798e45099 | 120 | ( *buf = mbedtls_calloc( 1, *n + 1 ) ) == NULL ) |
ampembeng | 15:6f2798e45099 | 121 | { |
ampembeng | 15:6f2798e45099 | 122 | //fclose( f ); |
ampembeng | 15:6f2798e45099 | 123 | return( MBEDTLS_ERR_PK_ALLOC_FAILED ); |
ampembeng | 15:6f2798e45099 | 124 | } |
ampembeng | 15:6f2798e45099 | 125 | |
ampembeng | 15:6f2798e45099 | 126 | if( fread( *buf, 1, *n, f ) != *n ) |
ampembeng | 15:6f2798e45099 | 127 | { |
ampembeng | 15:6f2798e45099 | 128 | fclose( f ); |
ampembeng | 15:6f2798e45099 | 129 | mbedtls_free( *buf ); |
ampembeng | 15:6f2798e45099 | 130 | return( MBEDTLS_ERR_PK_FILE_IO_ERROR ); |
ampembeng | 15:6f2798e45099 | 131 | } |
ampembeng | 15:6f2798e45099 | 132 | |
ampembeng | 15:6f2798e45099 | 133 | fclose( f ); |
ampembeng | 15:6f2798e45099 | 134 | |
ampembeng | 15:6f2798e45099 | 135 | (*buf)[*n] = '\0'; |
ampembeng | 15:6f2798e45099 | 136 | |
ampembeng | 15:6f2798e45099 | 137 | if( strstr( (const char *) *buf, "-----BEGIN " ) != NULL ) |
ampembeng | 15:6f2798e45099 | 138 | ++*n; |
ampembeng | 15:6f2798e45099 | 139 | */ |
ampembeng | 15:6f2798e45099 | 140 | |
ampembeng | 15:6f2798e45099 | 141 | return( 0 ); |
ampembeng | 15:6f2798e45099 | 142 | } |
ampembeng | 15:6f2798e45099 | 143 | // Implementation that should never be optimized out by the compiler |
ampembeng | 15:6f2798e45099 | 144 | static void mbedtls_zeroize( unsigned char *v, size_t n ) { |
ampembeng | 15:6f2798e45099 | 145 | volatile unsigned char *p = v; while( n-- ) *p++ = 0; |
ampembeng | 15:6f2798e45099 | 146 | } |
ampembeng | 15:6f2798e45099 | 147 | int mbedtls_x509_crt_parse_file( mbedtls_x509_crt *chain, const char *path ) |
ampembeng | 15:6f2798e45099 | 148 | { |
ampembeng | 15:6f2798e45099 | 149 | int ret; |
ampembeng | 15:6f2798e45099 | 150 | size_t n; |
ampembeng | 15:6f2798e45099 | 151 | unsigned char *buf; |
ampembeng | 15:6f2798e45099 | 152 | |
ampembeng | 15:6f2798e45099 | 153 | if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 ) |
ampembeng | 15:6f2798e45099 | 154 | return( ret ); |
ampembeng | 15:6f2798e45099 | 155 | |
ampembeng | 15:6f2798e45099 | 156 | DEBUG("...CRT Parse"); |
ampembeng | 15:6f2798e45099 | 157 | ret = mbedtls_x509_crt_parse( chain, buf, n ); |
ampembeng | 15:6f2798e45099 | 158 | |
ampembeng | 15:6f2798e45099 | 159 | //mbedtls_zeroize( buf, n ); |
ampembeng | 15:6f2798e45099 | 160 | //mbedtls_free( buf ); |
ampembeng | 15:6f2798e45099 | 161 | |
ampembeng | 15:6f2798e45099 | 162 | return( ret ); |
ampembeng | 15:6f2798e45099 | 163 | } |
ampembeng | 15:6f2798e45099 | 164 | int mbedtls_pk_parse_keyfile( mbedtls_pk_context *ctx, |
ampembeng | 15:6f2798e45099 | 165 | const char *path, const char *pwd ) |
ampembeng | 15:6f2798e45099 | 166 | { |
ampembeng | 15:6f2798e45099 | 167 | int ret; |
ampembeng | 15:6f2798e45099 | 168 | size_t n; |
ampembeng | 15:6f2798e45099 | 169 | unsigned char *buf; |
ampembeng | 15:6f2798e45099 | 170 | |
ampembeng | 15:6f2798e45099 | 171 | if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 ) |
ampembeng | 15:6f2798e45099 | 172 | return( ret ); |
ampembeng | 15:6f2798e45099 | 173 | |
ampembeng | 15:6f2798e45099 | 174 | DEBUG("...Key Parse"); |
ampembeng | 15:6f2798e45099 | 175 | if( pwd == NULL ) { |
ampembeng | 15:6f2798e45099 | 176 | DEBUG("...Using PWD"); |
ampembeng | 15:6f2798e45099 | 177 | ret = mbedtls_pk_parse_key( ctx, buf, n, NULL, 0 ); |
ampembeng | 15:6f2798e45099 | 178 | } |
ampembeng | 15:6f2798e45099 | 179 | else { |
ampembeng | 15:6f2798e45099 | 180 | DEBUG("...No PWD"); |
ampembeng | 15:6f2798e45099 | 181 | ret = mbedtls_pk_parse_key( ctx, buf, n, (const unsigned char *) pwd, strlen( pwd ) ); |
ampembeng | 15:6f2798e45099 | 182 | } |
ampembeng | 15:6f2798e45099 | 183 | |
ampembeng | 15:6f2798e45099 | 184 | //mbedtls_zeroize( buf, n ); |
ampembeng | 15:6f2798e45099 | 185 | //mbedtls_free( buf ); |
ampembeng | 15:6f2798e45099 | 186 | |
ampembeng | 15:6f2798e45099 | 187 | return( ret ); |
ampembeng | 15:6f2798e45099 | 188 | } |
ampembeng | 15:6f2798e45099 | 189 | // TODO: File system functions end |
ampembeng | 15:6f2798e45099 | 190 | |
ampembeng | 15:6f2798e45099 | 191 | /* personalization string for the drbg */ |
ampembeng | 15:6f2798e45099 | 192 | const char *DRBG_PERS = "mbed TLS helloword client"; |
ampembeng | 15:6f2798e45099 | 193 | |
ampembeng | 15:6f2798e45099 | 194 | int iot_tls_init(Network *pNetwork) { |
ampembeng | 15:6f2798e45099 | 195 | IoT_Error_t ret_val = NONE_ERROR; |
ampembeng | 15:6f2798e45099 | 196 | const char *pers = "aws_iot_tls_wrapper"; |
ampembeng | 15:6f2798e45099 | 197 | unsigned char buf[MBEDTLS_SSL_MAX_CONTENT_LEN + 1]; |
ampembeng | 15:6f2798e45099 | 198 | |
ampembeng | 15:6f2798e45099 | 199 | mbedtls_net_init(&server_fd); |
ampembeng | 15:6f2798e45099 | 200 | mbedtls_ssl_init(&ssl); |
ampembeng | 15:6f2798e45099 | 201 | mbedtls_ssl_config_init(&conf); |
ampembeng | 15:6f2798e45099 | 202 | mbedtls_ctr_drbg_init(&ctr_drbg); |
ampembeng | 15:6f2798e45099 | 203 | mbedtls_x509_crt_init(&cacert); |
ampembeng | 15:6f2798e45099 | 204 | mbedtls_x509_crt_init(&clicert); |
ampembeng | 15:6f2798e45099 | 205 | mbedtls_pk_init(&pkey); |
ampembeng | 15:6f2798e45099 | 206 | |
ampembeng | 15:6f2798e45099 | 207 | DEBUG("...Seeding the random number generator"); |
ampembeng | 15:6f2798e45099 | 208 | mbedtls_entropy_init(&entropy); |
ampembeng | 15:6f2798e45099 | 209 | if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char *) DRBG_PERS, sizeof (DRBG_PERS))) != 0) { |
ampembeng | 15:6f2798e45099 | 210 | ERROR(" failed\n ! mbedtls_ctr_drbg_seed returned -0x%x\n", -ret); |
ampembeng | 15:6f2798e45099 | 211 | return ret_val; |
ampembeng | 15:6f2798e45099 | 212 | } |
ampembeng | 15:6f2798e45099 | 213 | DEBUG(" ok\n"); |
ampembeng | 15:6f2798e45099 | 214 | |
ampembeng | 15:6f2798e45099 | 215 | pNetwork->my_socket = 0; |
ampembeng | 15:6f2798e45099 | 216 | pNetwork->connect = iot_tls_connect; |
ampembeng | 15:6f2798e45099 | 217 | pNetwork->mqttread = iot_tls_read; |
ampembeng | 15:6f2798e45099 | 218 | pNetwork->mqttwrite = iot_tls_write; |
ampembeng | 15:6f2798e45099 | 219 | pNetwork->disconnect = iot_tls_disconnect; |
ampembeng | 15:6f2798e45099 | 220 | pNetwork->isConnected = iot_tls_is_connected; |
ampembeng | 15:6f2798e45099 | 221 | pNetwork->destroy = iot_tls_destroy; |
ampembeng | 15:6f2798e45099 | 222 | |
ampembeng | 15:6f2798e45099 | 223 | return ret_val; |
ampembeng | 15:6f2798e45099 | 224 | } |
ampembeng | 15:6f2798e45099 | 225 | |
ampembeng | 15:6f2798e45099 | 226 | int iot_tls_is_connected(Network *pNetwork) { |
ampembeng | 15:6f2798e45099 | 227 | /* Use this to add implementation which can check for physical layer disconnect */ |
ampembeng | 15:6f2798e45099 | 228 | return 1; |
ampembeng | 15:6f2798e45099 | 229 | } |
ampembeng | 15:6f2798e45099 | 230 | |
ampembeng | 15:6f2798e45099 | 231 | int iot_tls_connect(Network *pNetwork, TLSConnectParams params) { |
ampembeng | 15:6f2798e45099 | 232 | const char *pers = "aws_iot_tls_wrapper"; |
ampembeng | 15:6f2798e45099 | 233 | |
ampembeng | 15:6f2798e45099 | 234 | DEBUG("...Loading the CA root certificate"); |
ampembeng | 15:6f2798e45099 | 235 | // TODO: We can pull the cert from an SD card |
ampembeng | 15:6f2798e45099 | 236 | //ret = mbedtls_x509_crt_parse_file(&cacert, params.pRootCALocation); |
ampembeng | 15:6f2798e45099 | 237 | ret = mbedtls_x509_crt_parse(&cacert, (const unsigned char *)AWS_IOT_ROOT_CA, strlen ((const char *)AWS_IOT_ROOT_CA)+1); |
ampembeng | 15:6f2798e45099 | 238 | |
ampembeng | 15:6f2798e45099 | 239 | if (ret < 0) { |
ampembeng | 15:6f2798e45099 | 240 | ERROR(" failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret); |
ampembeng | 15:6f2798e45099 | 241 | return ret; |
ampembeng | 15:6f2798e45099 | 242 | } |
ampembeng | 15:6f2798e45099 | 243 | DEBUG(" ok (%d skipped)", ret); |
ampembeng | 15:6f2798e45099 | 244 | |
ampembeng | 15:6f2798e45099 | 245 | |
ampembeng | 15:6f2798e45099 | 246 | DEBUG("...Loading the client cert"); |
ampembeng | 15:6f2798e45099 | 247 | // TODO: We can pull the cert from an SD card |
ampembeng | 15:6f2798e45099 | 248 | //ret = mbedtls_x509_crt_parse_file(&clicert, params.pDeviceCertLocation); |
ampembeng | 15:6f2798e45099 | 249 | ret = mbedtls_x509_crt_parse(&clicert, (const unsigned char *)AWS_IOT_CERTIFICATE, strlen ((const char *)AWS_IOT_CERTIFICATE)+1); |
ampembeng | 15:6f2798e45099 | 250 | if (ret != 0) { |
ampembeng | 15:6f2798e45099 | 251 | ERROR(" failed\n ! mbedtls_x509_crt_parse returned -0x%x\n\n", -ret); |
ampembeng | 15:6f2798e45099 | 252 | return ret; |
ampembeng | 15:6f2798e45099 | 253 | } |
ampembeng | 15:6f2798e45099 | 254 | DEBUG(" ok"); |
ampembeng | 15:6f2798e45099 | 255 | |
ampembeng | 15:6f2798e45099 | 256 | |
ampembeng | 15:6f2798e45099 | 257 | DEBUG("...Loading the client key"); |
ampembeng | 15:6f2798e45099 | 258 | // TODO: We can pull the cert from an SD card |
ampembeng | 15:6f2798e45099 | 259 | //ret = mbedtls_pk_parse_keyfile(&pkey, params.pDevicePrivateKeyLocation, ""); |
ampembeng | 15:6f2798e45099 | 260 | ret = mbedtls_pk_parse_key(&pkey, (const unsigned char *)AWS_IOT_PRIVATE_KEY, strlen ((const char *)AWS_IOT_PRIVATE_KEY)+1, NULL, 0 ); |
ampembeng | 15:6f2798e45099 | 261 | if (ret != 0) { |
ampembeng | 15:6f2798e45099 | 262 | ERROR(" failed\n ! mbedtls_pk_parse_key returned -0x%x\n\n", -ret); |
ampembeng | 15:6f2798e45099 | 263 | return ret; |
ampembeng | 15:6f2798e45099 | 264 | } |
ampembeng | 15:6f2798e45099 | 265 | DEBUG(" ok"); |
ampembeng | 15:6f2798e45099 | 266 | |
ampembeng | 15:6f2798e45099 | 267 | |
ampembeng | 15:6f2798e45099 | 268 | char portBuffer[6]; |
ampembeng | 15:6f2798e45099 | 269 | sprintf(portBuffer, "%d", params.DestinationPort); |
ampembeng | 15:6f2798e45099 | 270 | DEBUG("...Connecting to %s/%s", params.pDestinationURL, portBuffer); |
ampembeng | 15:6f2798e45099 | 271 | if ((ret = mbedtls_net_connect(&server_fd, params.pDestinationURL, portBuffer, MBEDTLS_NET_PROTO_TCP)) != 0) { |
ampembeng | 15:6f2798e45099 | 272 | ERROR(" failed\n ! mbedtls_net_connect returned -0x%x\n\n", -ret); |
ampembeng | 15:6f2798e45099 | 273 | return ret; |
ampembeng | 15:6f2798e45099 | 274 | } |
ampembeng | 15:6f2798e45099 | 275 | |
ampembeng | 15:6f2798e45099 | 276 | |
ampembeng | 15:6f2798e45099 | 277 | ret = mbedtls_net_set_block(&server_fd); |
ampembeng | 15:6f2798e45099 | 278 | if (ret != 0) { |
ampembeng | 15:6f2798e45099 | 279 | ERROR(" failed\n ! net_set_(non)block() returned -0x%x\n\n", -ret); |
ampembeng | 15:6f2798e45099 | 280 | return ret; |
ampembeng | 15:6f2798e45099 | 281 | } |
ampembeng | 15:6f2798e45099 | 282 | DEBUG(" ok"); |
ampembeng | 15:6f2798e45099 | 283 | |
ampembeng | 15:6f2798e45099 | 284 | |
ampembeng | 15:6f2798e45099 | 285 | DEBUG("...Setting up the SSL/TLS structure"); |
ampembeng | 15:6f2798e45099 | 286 | if ((ret = mbedtls_ssl_config_defaults(&conf, MBEDTLS_SSL_IS_CLIENT, MBEDTLS_SSL_TRANSPORT_STREAM, |
ampembeng | 15:6f2798e45099 | 287 | MBEDTLS_SSL_PRESET_DEFAULT)) != 0) { |
ampembeng | 15:6f2798e45099 | 288 | ERROR(" failed\n ! mbedtls_ssl_config_defaults returned -0x%x\n\n", -ret); |
ampembeng | 15:6f2798e45099 | 289 | return ret; |
ampembeng | 15:6f2798e45099 | 290 | } |
ampembeng | 15:6f2798e45099 | 291 | |
ampembeng | 15:6f2798e45099 | 292 | |
ampembeng | 15:6f2798e45099 | 293 | mbedtls_ssl_conf_verify(&conf, myCertVerify, NULL); |
ampembeng | 15:6f2798e45099 | 294 | if (params.ServerVerificationFlag == true) { |
ampembeng | 15:6f2798e45099 | 295 | mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_REQUIRED); |
ampembeng | 15:6f2798e45099 | 296 | } else { |
ampembeng | 15:6f2798e45099 | 297 | mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_OPTIONAL); |
ampembeng | 15:6f2798e45099 | 298 | } |
ampembeng | 15:6f2798e45099 | 299 | mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg); |
ampembeng | 15:6f2798e45099 | 300 | |
ampembeng | 15:6f2798e45099 | 301 | mbedtls_ssl_conf_ca_chain(&conf, &cacert, NULL); |
ampembeng | 15:6f2798e45099 | 302 | if ((ret = mbedtls_ssl_conf_own_cert(&conf, &clicert, &pkey)) != 0) { |
ampembeng | 15:6f2798e45099 | 303 | ERROR(" failed\n ! mbedtls_ssl_conf_own_cert returned %d\n\n", ret); |
ampembeng | 15:6f2798e45099 | 304 | return ret; |
ampembeng | 15:6f2798e45099 | 305 | } |
ampembeng | 15:6f2798e45099 | 306 | |
ampembeng | 15:6f2798e45099 | 307 | mbedtls_ssl_conf_read_timeout(&conf, params.timeout_ms); |
ampembeng | 15:6f2798e45099 | 308 | |
ampembeng | 15:6f2798e45099 | 309 | if ((ret = mbedtls_ssl_setup(&ssl, &conf)) != 0) { |
ampembeng | 15:6f2798e45099 | 310 | ERROR(" failed\n ! mbedtls_ssl_setup returned -0x%x\n\n", -ret); |
ampembeng | 15:6f2798e45099 | 311 | return ret; |
ampembeng | 15:6f2798e45099 | 312 | } |
ampembeng | 15:6f2798e45099 | 313 | if ((ret = mbedtls_ssl_set_hostname(&ssl, params.pDestinationURL)) != 0) { |
ampembeng | 15:6f2798e45099 | 314 | ERROR(" failed\n ! mbedtls_ssl_set_hostname returned %d\n\n", ret); |
ampembeng | 15:6f2798e45099 | 315 | return ret; |
ampembeng | 15:6f2798e45099 | 316 | } |
ampembeng | 15:6f2798e45099 | 317 | |
ampembeng | 15:6f2798e45099 | 318 | DEBUG("...Set Socket I/O Functions"); |
ampembeng | 15:6f2798e45099 | 319 | mbedtls_ssl_set_bio(&ssl, static_cast<void *>(_tcpsocket), mbedtls_net_send, NULL, mbedtls_net_recv_timeout ); |
ampembeng | 15:6f2798e45099 | 320 | DEBUG(" ok"); |
ampembeng | 15:6f2798e45099 | 321 | |
ampembeng | 15:6f2798e45099 | 322 | |
ampembeng | 15:6f2798e45099 | 323 | DEBUG("...Performing the SSL/TLS handshake"); |
ampembeng | 15:6f2798e45099 | 324 | while ((ret = mbedtls_ssl_handshake(&ssl)) != 0) { |
ampembeng | 15:6f2798e45099 | 325 | if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) { |
ampembeng | 15:6f2798e45099 | 326 | ERROR(" failed\n ! mbedtls_ssl_handshake returned -0x%x\n", -ret); |
ampembeng | 15:6f2798e45099 | 327 | if (ret == MBEDTLS_ERR_X509_CERT_VERIFY_FAILED) { |
ampembeng | 15:6f2798e45099 | 328 | ERROR(" Unable to verify the server's certificate. " |
ampembeng | 15:6f2798e45099 | 329 | "Either it is invalid,\n" |
ampembeng | 15:6f2798e45099 | 330 | " or you didn't set ca_file or ca_path " |
ampembeng | 15:6f2798e45099 | 331 | "to an appropriate value.\n" |
ampembeng | 15:6f2798e45099 | 332 | " Alternatively, you may want to use " |
ampembeng | 15:6f2798e45099 | 333 | "auth_mode=optional for testing purposes.\n"); |
ampembeng | 15:6f2798e45099 | 334 | } |
ampembeng | 15:6f2798e45099 | 335 | return ret; |
ampembeng | 15:6f2798e45099 | 336 | } |
ampembeng | 15:6f2798e45099 | 337 | } |
ampembeng | 15:6f2798e45099 | 338 | |
ampembeng | 15:6f2798e45099 | 339 | |
ampembeng | 15:6f2798e45099 | 340 | DEBUG(" ok\n [ Protocol is %s ]\n [ Ciphersuite is %s ]\n", mbedtls_ssl_get_version(&ssl), mbedtls_ssl_get_ciphersuite(&ssl)); |
ampembeng | 15:6f2798e45099 | 341 | if ((ret = mbedtls_ssl_get_record_expansion(&ssl)) >= 0) { |
ampembeng | 15:6f2798e45099 | 342 | DEBUG(" [ Record expansion is %d ]\n", ret); |
ampembeng | 15:6f2798e45099 | 343 | } else { |
ampembeng | 15:6f2798e45099 | 344 | DEBUG(" [ Record expansion is unknown (compression) ]\n"); |
ampembeng | 15:6f2798e45099 | 345 | } |
ampembeng | 15:6f2798e45099 | 346 | |
ampembeng | 15:6f2798e45099 | 347 | |
ampembeng | 15:6f2798e45099 | 348 | DEBUG("...Verifying peer X.509 certificate"); |
ampembeng | 15:6f2798e45099 | 349 | if (params.ServerVerificationFlag == true) { |
ampembeng | 15:6f2798e45099 | 350 | if ((flags = mbedtls_ssl_get_verify_result(&ssl)) != 0) { |
ampembeng | 15:6f2798e45099 | 351 | char vrfy_buf[512]; |
ampembeng | 15:6f2798e45099 | 352 | ERROR(" failed\n"); |
ampembeng | 15:6f2798e45099 | 353 | mbedtls_x509_crt_verify_info(vrfy_buf, sizeof(vrfy_buf), " ! ", flags); |
ampembeng | 15:6f2798e45099 | 354 | ERROR("%s\n", vrfy_buf); |
ampembeng | 15:6f2798e45099 | 355 | } else { |
ampembeng | 15:6f2798e45099 | 356 | DEBUG(" ok\n"); |
ampembeng | 15:6f2798e45099 | 357 | ret = NONE_ERROR; |
ampembeng | 15:6f2798e45099 | 358 | } |
ampembeng | 15:6f2798e45099 | 359 | } else { |
ampembeng | 15:6f2798e45099 | 360 | DEBUG(" Server Verification skipped\n"); |
ampembeng | 15:6f2798e45099 | 361 | ret = NONE_ERROR; |
ampembeng | 15:6f2798e45099 | 362 | } |
ampembeng | 15:6f2798e45099 | 363 | |
ampembeng | 15:6f2798e45099 | 364 | |
ampembeng | 15:6f2798e45099 | 365 | DEBUG("...SSL get peer cert"); |
ampembeng | 15:6f2798e45099 | 366 | if (mbedtls_ssl_get_peer_cert(&ssl) != NULL) { |
ampembeng | 15:6f2798e45099 | 367 | DEBUG("...Peer certificate information"); |
ampembeng | 15:6f2798e45099 | 368 | const uint32_t buf_size = 1024; |
ampembeng | 15:6f2798e45099 | 369 | char *buf = new char[buf_size]; |
ampembeng | 15:6f2798e45099 | 370 | mbedtls_x509_crt_info(buf, buf_size, " ", mbedtls_ssl_get_peer_cert(&ssl)); |
ampembeng | 15:6f2798e45099 | 371 | DEBUG("...Server certificate:\r\n%s\r", buf); |
ampembeng | 15:6f2798e45099 | 372 | } |
ampembeng | 15:6f2798e45099 | 373 | |
ampembeng | 15:6f2798e45099 | 374 | mbedtls_ssl_conf_read_timeout(&conf, 10); |
ampembeng | 15:6f2798e45099 | 375 | |
ampembeng | 15:6f2798e45099 | 376 | return ret; |
ampembeng | 15:6f2798e45099 | 377 | } |
ampembeng | 15:6f2798e45099 | 378 | |
ampembeng | 15:6f2798e45099 | 379 | int iot_tls_write(Network *pNetwork, unsigned char *pMsg, int len, int timeout_ms) { |
ampembeng | 15:6f2798e45099 | 380 | |
ampembeng | 15:6f2798e45099 | 381 | int written; |
ampembeng | 15:6f2798e45099 | 382 | int frags; |
ampembeng | 15:6f2798e45099 | 383 | |
ampembeng | 15:6f2798e45099 | 384 | for (written = 0, frags = 0; written < len; written += ret, frags++) { |
ampembeng | 15:6f2798e45099 | 385 | while ((ret = mbedtls_ssl_write(&ssl, pMsg + written, len - written)) <= 0) { |
ampembeng | 15:6f2798e45099 | 386 | if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) { |
ampembeng | 15:6f2798e45099 | 387 | ERROR(" failed\n ! mbedtls_ssl_write returned -0x%x\n\n", -ret); |
ampembeng | 15:6f2798e45099 | 388 | return ret; |
ampembeng | 15:6f2798e45099 | 389 | } |
ampembeng | 15:6f2798e45099 | 390 | } |
ampembeng | 15:6f2798e45099 | 391 | } |
ampembeng | 15:6f2798e45099 | 392 | |
ampembeng | 15:6f2798e45099 | 393 | return written; |
ampembeng | 15:6f2798e45099 | 394 | } |
ampembeng | 15:6f2798e45099 | 395 | |
ampembeng | 15:6f2798e45099 | 396 | int iot_tls_read(Network *pNetwork, unsigned char *pMsg, int len, int timeout_ms) { |
ampembeng | 15:6f2798e45099 | 397 | int rxLen = 0; |
ampembeng | 15:6f2798e45099 | 398 | bool isErrorFlag = false; |
ampembeng | 15:6f2798e45099 | 399 | bool isCompleteFlag = false; |
ampembeng | 15:6f2798e45099 | 400 | |
ampembeng | 15:6f2798e45099 | 401 | // TODO check this against base |
ampembeng | 15:6f2798e45099 | 402 | //mbedtls_ssl_conf_read_timeout(&conf, timeout_ms); |
ampembeng | 15:6f2798e45099 | 403 | |
ampembeng | 15:6f2798e45099 | 404 | do { |
ampembeng | 15:6f2798e45099 | 405 | ret = mbedtls_ssl_read(&ssl, pMsg, len); |
ampembeng | 15:6f2798e45099 | 406 | if (ret > 0) { |
ampembeng | 15:6f2798e45099 | 407 | rxLen += ret; |
ampembeng | 15:6f2798e45099 | 408 | } else if (ret != MBEDTLS_ERR_SSL_WANT_READ) { |
ampembeng | 15:6f2798e45099 | 409 | isErrorFlag = true; |
ampembeng | 15:6f2798e45099 | 410 | } |
ampembeng | 15:6f2798e45099 | 411 | if (rxLen >= len) { |
ampembeng | 15:6f2798e45099 | 412 | isCompleteFlag = true; |
ampembeng | 15:6f2798e45099 | 413 | } |
ampembeng | 15:6f2798e45099 | 414 | } while (!isErrorFlag && !isCompleteFlag); |
ampembeng | 15:6f2798e45099 | 415 | |
ampembeng | 15:6f2798e45099 | 416 | return ret; |
ampembeng | 15:6f2798e45099 | 417 | } |
ampembeng | 15:6f2798e45099 | 418 | |
ampembeng | 15:6f2798e45099 | 419 | void iot_tls_disconnect(Network *pNetwork) { |
ampembeng | 15:6f2798e45099 | 420 | do { |
ampembeng | 15:6f2798e45099 | 421 | ret = mbedtls_ssl_close_notify(&ssl); |
ampembeng | 15:6f2798e45099 | 422 | } while (ret == MBEDTLS_ERR_SSL_WANT_WRITE); |
ampembeng | 15:6f2798e45099 | 423 | } |
ampembeng | 15:6f2798e45099 | 424 | |
ampembeng | 15:6f2798e45099 | 425 | int iot_tls_destroy(Network *pNetwork) { |
ampembeng | 15:6f2798e45099 | 426 | |
ampembeng | 15:6f2798e45099 | 427 | mbedtls_net_free(&server_fd); |
ampembeng | 15:6f2798e45099 | 428 | |
ampembeng | 15:6f2798e45099 | 429 | mbedtls_x509_crt_free(&clicert); |
ampembeng | 15:6f2798e45099 | 430 | mbedtls_x509_crt_free(&cacert); |
ampembeng | 15:6f2798e45099 | 431 | mbedtls_pk_free(&pkey); |
ampembeng | 15:6f2798e45099 | 432 | mbedtls_ssl_free(&ssl); |
ampembeng | 15:6f2798e45099 | 433 | mbedtls_ssl_config_free(&conf); |
ampembeng | 15:6f2798e45099 | 434 | mbedtls_ctr_drbg_free(&ctr_drbg); |
ampembeng | 15:6f2798e45099 | 435 | mbedtls_entropy_free(&entropy); |
ampembeng | 15:6f2798e45099 | 436 | |
ampembeng | 15:6f2798e45099 | 437 | return 0; |
ampembeng | 15:6f2798e45099 | 438 | } |
ampembeng | 15:6f2798e45099 | 439 | |
ampembeng | 15:6f2798e45099 | 440 |