mirror of
https://github.com/FreeRTOS/FreeRTOS.git
synced 2026-08-09 14:43:56 +00:00
MbedTLS transport implementation (#175)
This commit is contained in:
leegeth
GitHub
@@ -0,0 +1,286 @@
|
||||
/*
|
||||
* Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
* of this software and associated documentation files (the "Software"), to deal
|
||||
* in the Software without restriction, including without limitation the rights
|
||||
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
* copies of the Software, and to permit persons to whom the Software is
|
||||
* furnished to do so, subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in
|
||||
* all copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||
* SOFTWARE.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @file mbedtls_freertos_port.c
|
||||
* @brief Implements mbed TLS platform functions for FreeRTOS.
|
||||
*/
|
||||
|
||||
/* FreeRTOS includes. */
|
||||
#include "FreeRTOS.h"
|
||||
#include "FreeRTOS_Sockets.h"
|
||||
|
||||
/* mbed TLS includes. */
|
||||
#include "mbedtls_config.h"
|
||||
#include "threading_alt.h"
|
||||
#include "mbedtls/entropy.h"
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Allocates memory for an array of members.
|
||||
*
|
||||
* @param[in] nmemb Number of members that need to be allocated.
|
||||
* @param[in] size Size of each member.
|
||||
*
|
||||
* @return Pointer to the beginning of newly allocated memory.
|
||||
*/
|
||||
void * mbedtls_platform_calloc( size_t nmemb,
|
||||
size_t size )
|
||||
{
|
||||
size_t totalSize = nmemb * size;
|
||||
void * pBuffer = NULL;
|
||||
|
||||
/* Check that neither nmemb nor size were 0. */
|
||||
if( totalSize > 0 )
|
||||
{
|
||||
/* Overflow check. */
|
||||
if( totalSize / size == nmemb )
|
||||
{
|
||||
pBuffer = pvPortMalloc( totalSize );
|
||||
|
||||
if( pBuffer != NULL )
|
||||
{
|
||||
( void ) memset( pBuffer, 0x00, totalSize );
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return pBuffer;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Frees the space previously allocated by calloc.
|
||||
*
|
||||
* @param[in] ptr Pointer to the memory to be freed.
|
||||
*/
|
||||
void mbedtls_platform_free( void * ptr )
|
||||
{
|
||||
vPortFree( ptr );
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Sends data over FreeRTOS+TCP sockets.
|
||||
*
|
||||
* @param[in] ctx The network context containing the socket handle.
|
||||
* @param[in] buf Buffer containing the bytes to send.
|
||||
* @param[in] len Number of bytes to send from the buffer.
|
||||
*
|
||||
* @return Number of bytes sent on success; else a negative value.
|
||||
*/
|
||||
int mbedtls_platform_send( void * ctx,
|
||||
const unsigned char * buf,
|
||||
size_t len )
|
||||
{
|
||||
Socket_t socket;
|
||||
|
||||
configASSERT( ctx != NULL );
|
||||
configASSERT( buf != NULL );
|
||||
|
||||
socket = ( Socket_t ) ctx;
|
||||
|
||||
return ( int ) FreeRTOS_send( socket, buf, len, 0 );
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Receives data from FreeRTOS+TCP socket.
|
||||
*
|
||||
* @param[in] ctx The network context containing the socket handle.
|
||||
* @param[out] buf Buffer to receive bytes into.
|
||||
* @param[in] len Number of bytes to receive from the network.
|
||||
*
|
||||
* @return Number of bytes received if successful; Negative value on error.
|
||||
*/
|
||||
int mbedtls_platform_recv( void * ctx,
|
||||
unsigned char * buf,
|
||||
size_t len )
|
||||
{
|
||||
Socket_t socket;
|
||||
|
||||
configASSERT( ctx != NULL );
|
||||
configASSERT( buf != NULL );
|
||||
|
||||
socket = ( Socket_t ) ctx;
|
||||
|
||||
return ( int ) FreeRTOS_recv( socket, buf, len, 0 );
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Creates a mutex.
|
||||
*
|
||||
* @param[in, out] pMutex mbedtls mutex handle.
|
||||
*/
|
||||
void mbedtls_platform_mutex_init( mbedtls_threading_mutex_t * pMutex )
|
||||
{
|
||||
configASSERT( pMutex != NULL );
|
||||
|
||||
/* Create a statically-allocated FreeRTOS mutex. This should never fail as
|
||||
* storage is provided. */
|
||||
pMutex->mutexHandle = xSemaphoreCreateMutexStatic( &( pMutex->mutexStorage ) );
|
||||
configASSERT( pMutex->mutexHandle != NULL );
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Frees a mutex.
|
||||
*
|
||||
* @param[in] pMutex mbedtls mutex handle.
|
||||
*
|
||||
* @note This function is an empty stub as nothing needs to be done to free
|
||||
* a statically allocated FreeRTOS mutex.
|
||||
*/
|
||||
void mbedtls_platform_mutex_free( mbedtls_threading_mutex_t * pMutex )
|
||||
{
|
||||
/* Nothing needs to be done to free a statically-allocated FreeRTOS mutex. */
|
||||
( void ) pMutex;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Function to lock a mutex.
|
||||
*
|
||||
* @param[in] pMutex mbedtls mutex handle.
|
||||
*
|
||||
* @return 0 (success) is always returned as any other failure is asserted.
|
||||
*/
|
||||
int mbedtls_platform_mutex_lock( mbedtls_threading_mutex_t * pMutex )
|
||||
{
|
||||
BaseType_t mutexStatus = 0;
|
||||
|
||||
configASSERT( pMutex != NULL );
|
||||
|
||||
/* mutexStatus is not used if asserts are disabled. */
|
||||
( void ) mutexStatus;
|
||||
|
||||
/* This function should never fail if the mutex is initialized. */
|
||||
mutexStatus = xSemaphoreTake( pMutex->mutexHandle, portMAX_DELAY );
|
||||
configASSERT( mutexStatus == pdTRUE );
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Function to unlock a mutex.
|
||||
*
|
||||
* @param[in] pMutex mbedtls mutex handle.
|
||||
*
|
||||
* @return 0 is always returned as any other failure is asserted.
|
||||
*/
|
||||
int mbedtls_platform_mutex_unlock( mbedtls_threading_mutex_t * pMutex )
|
||||
{
|
||||
BaseType_t mutexStatus = 0;
|
||||
|
||||
configASSERT( pMutex != NULL );
|
||||
/* mutexStatus is not used if asserts are disabled. */
|
||||
( void ) mutexStatus;
|
||||
|
||||
/* This function should never fail if the mutex is initialized. */
|
||||
mutexStatus = xSemaphoreGive( pMutex->mutexHandle );
|
||||
configASSERT( mutexStatus == pdTRUE );
|
||||
|
||||
return 0;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Function to generate a random number.
|
||||
*
|
||||
* @param[in] data Callback context.
|
||||
* @param[out] output The address of the buffer that receives the random number.
|
||||
* @param[in] len Maximum size of the random number to be generated.
|
||||
* @param[out] olen The size, in bytes, of the #output buffer.
|
||||
*
|
||||
* @return 0 if no critical failures occurred,
|
||||
* MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise.
|
||||
*/
|
||||
int mbedtls_platform_entropy_poll( void * data,
|
||||
unsigned char * output,
|
||||
size_t len,
|
||||
size_t * olen )
|
||||
{
|
||||
int status = 0;
|
||||
NTSTATUS rngStatus = 0;
|
||||
|
||||
configASSERT( output != NULL );
|
||||
configASSERT( olen != NULL );
|
||||
|
||||
/* Context is not used by this function. */
|
||||
( void ) data;
|
||||
|
||||
/* TLS requires a secure random number generator; use the RNG provided
|
||||
* by Windows. This function MUST be re-implemented for other platforms. */
|
||||
rngStatus =
|
||||
BCryptGenRandom( NULL, output, len, BCRYPT_USE_SYSTEM_PREFERRED_RNG );
|
||||
|
||||
if( rngStatus == 0 )
|
||||
{
|
||||
/* All random bytes generated. */
|
||||
*olen = len;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* RNG failure. */
|
||||
*olen = 0;
|
||||
status = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
|
||||
}
|
||||
|
||||
return status;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Function to generate a random number based on a hardware poll.
|
||||
*
|
||||
* For this FreeRTOS Windows port, this function is redirected by calling
|
||||
* #mbedtls_platform_entropy_poll.
|
||||
*
|
||||
* @param[in] data Callback context.
|
||||
* @param[out] output The address of the buffer that receives the random number.
|
||||
* @param[in] len Maximum size of the random number to be generated.
|
||||
* @param[out] olen The size, in bytes, of the #output buffer.
|
||||
*
|
||||
* @return 0 if no critical failures occurred,
|
||||
* MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise.
|
||||
*/
|
||||
int mbedtls_hardware_poll( void * data,
|
||||
unsigned char * output,
|
||||
size_t len,
|
||||
size_t * olen )
|
||||
{
|
||||
return mbedtls_platform_entropy_poll( data, output, len, olen );
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
@@ -0,0 +1,54 @@
|
||||
/*
|
||||
* Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||
* this software and associated documentation files (the "Software"), to deal in
|
||||
* the Software without restriction, including without limitation the rights to
|
||||
* use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
|
||||
* the Software, and to permit persons to whom the Software is furnished to do so,
|
||||
* subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in all
|
||||
* copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
|
||||
* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
||||
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @file threading_alt.h
|
||||
* @brief mbed TLS threading functions implemented for FreeRTOS.
|
||||
*/
|
||||
|
||||
|
||||
#ifndef MBEDTLS_THREADING_ALT_H_
|
||||
#define MBEDTLS_THREADING_ALT_H_
|
||||
|
||||
/* FreeRTOS includes. */
|
||||
#include "FreeRTOS.h"
|
||||
#include "semphr.h"
|
||||
|
||||
/**
|
||||
* @brief mbed TLS mutex type.
|
||||
*
|
||||
* mbed TLS requires platform specific definition for the mutext type. Defining the type for
|
||||
* FreeRTOS with FreeRTOS semaphore
|
||||
* handle and semaphore storage as members.
|
||||
*/
|
||||
typedef struct mbedtls_threading_mutex
|
||||
{
|
||||
SemaphoreHandle_t mutexHandle;
|
||||
StaticSemaphore_t mutexStorage;
|
||||
} mbedtls_threading_mutex_t;
|
||||
|
||||
/* mbed TLS mutex functions. */
|
||||
void mbedtls_platform_mutex_init( mbedtls_threading_mutex_t * pMutex );
|
||||
void mbedtls_platform_mutex_free( mbedtls_threading_mutex_t * pMutex );
|
||||
int mbedtls_platform_mutex_lock( mbedtls_threading_mutex_t * pMutex );
|
||||
int mbedtls_platform_mutex_unlock( mbedtls_threading_mutex_t * pMutex );
|
||||
|
||||
#endif /* ifndef MBEDTLS_THREADING_ALT_H_ */
|
||||
@@ -0,0 +1,85 @@
|
||||
/*
|
||||
* Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||
* this software and associated documentation files (the "Software"), to deal in
|
||||
* the Software without restriction, including without limitation the rights to
|
||||
* use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
|
||||
* the Software, and to permit persons to whom the Software is furnished to do so,
|
||||
* subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in all
|
||||
* copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
|
||||
* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
||||
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @file freertos_sockets_wrapper.h
|
||||
* @brief FreeRTOS Sockets connect and disconnect function wrapper.
|
||||
*/
|
||||
|
||||
#ifndef FREERTOS_SOCKETS_WRAPPER_H_
|
||||
#define FREERTOS_SOCKETS_WRAPPER_H_
|
||||
|
||||
/* FreeRTOS+TCP includes. */
|
||||
#include "FreeRTOS_IP.h"
|
||||
#include "FreeRTOS_Sockets.h"
|
||||
|
||||
/**************************************************/
|
||||
/******* DO NOT CHANGE the following order ********/
|
||||
/**************************************************/
|
||||
|
||||
/* Logging related header files are required to be included in the following order:
|
||||
* 1. Include the header file "logging_levels.h".
|
||||
* 2. Define LIBRARY_LOG_NAME and LIBRARY_LOG_LEVEL.
|
||||
* 3. Include the header file "logging_stack.h".
|
||||
*/
|
||||
|
||||
/* Include header that defines log levels. */
|
||||
#include "logging_levels.h"
|
||||
|
||||
/* Logging configuration for the Sockets. */
|
||||
#ifndef LIBRARY_LOG_NAME
|
||||
#define LIBRARY_LOG_NAME "Sockets"
|
||||
#endif
|
||||
#ifndef LIBRARY_LOG_LEVEL
|
||||
#define LIBRARY_LOG_LEVEL LOG_ERROR
|
||||
#endif
|
||||
|
||||
#include "logging_stack.h"
|
||||
|
||||
/************ End of logging configuration ****************/
|
||||
|
||||
/**
|
||||
* @brief Establish a connection to server.
|
||||
*
|
||||
* @param[out] pTcpSocket The output parameter to return the created socket descriptor.
|
||||
* @param[in] pHostName Server hostname to connect to.
|
||||
* @param[in] pServerInfo Server port to connect to.
|
||||
* @param[in] receiveTimeoutMs Timeout (in milliseconds) for transport receive.
|
||||
* @param[in] sendTimeoutMs Timeout (in milliseconds) for transport send.
|
||||
*
|
||||
* @note A timeout of 0 means infinite timeout.
|
||||
*
|
||||
* @return Non-zero value on error, 0 on success.
|
||||
*/
|
||||
BaseType_t Sockets_Connect( Socket_t * pTcpSocket,
|
||||
const char * pHostName,
|
||||
uint16_t port,
|
||||
uint32_t receiveTimeoutMs,
|
||||
uint32_t sendTimeoutMs );
|
||||
|
||||
/**
|
||||
* @brief End connection to server.
|
||||
*
|
||||
* @param[in] tcpSocket The socket descriptor.
|
||||
*/
|
||||
void Sockets_Disconnect( Socket_t tcpSocket );
|
||||
|
||||
#endif /* ifndef FREERTOS_SOCKETS_WRAPPER_H_ */
|
||||
@@ -0,0 +1,202 @@
|
||||
/*
|
||||
* Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||
* this software and associated documentation files (the "Software"), to deal in
|
||||
* the Software without restriction, including without limitation the rights to
|
||||
* use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
|
||||
* the Software, and to permit persons to whom the Software is furnished to do so,
|
||||
* subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in all
|
||||
* copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
|
||||
* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
||||
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @file tls_freertos.h
|
||||
* @brief TLS transport interface header.
|
||||
*/
|
||||
|
||||
#ifndef TLS_FREERTOS_H_
|
||||
#define TLS_FREERTOS_H_
|
||||
|
||||
/**************************************************/
|
||||
/******* DO NOT CHANGE the following order ********/
|
||||
/**************************************************/
|
||||
|
||||
/* Logging related header files are required to be included in the following order:
|
||||
* 1. Include the header file "logging_levels.h".
|
||||
* 2. Define LIBRARY_LOG_NAME and LIBRARY_LOG_LEVEL.
|
||||
* 3. Include the header file "logging_stack.h".
|
||||
*/
|
||||
|
||||
/* Include header that defines log levels. */
|
||||
#include "logging_levels.h"
|
||||
|
||||
/* Logging configuration for the Sockets. */
|
||||
#ifndef LIBRARY_LOG_NAME
|
||||
#define LIBRARY_LOG_NAME "TlsTransport"
|
||||
#endif
|
||||
#ifndef LIBRARY_LOG_LEVEL
|
||||
#define LIBRARY_LOG_LEVEL LOG_ERROR
|
||||
#endif
|
||||
|
||||
#include "logging_stack.h"
|
||||
|
||||
/************ End of logging configuration ****************/
|
||||
|
||||
/* FreeRTOS+TCP include. */
|
||||
#include "FreeRTOS_Sockets.h"
|
||||
|
||||
/* Transport interface include. */
|
||||
#include "transport_interface.h"
|
||||
|
||||
/* mbed TLS includes. */
|
||||
#include "mbedtls/ctr_drbg.h"
|
||||
#include "mbedtls/entropy.h"
|
||||
#include "mbedtls/ssl.h"
|
||||
#include "mbedtls/threading.h"
|
||||
#include "mbedtls/x509.h"
|
||||
|
||||
/**
|
||||
* @brief Secured connection context.
|
||||
*/
|
||||
typedef struct SSLContext
|
||||
{
|
||||
mbedtls_ssl_config config; /**< @brief SSL connection configuration. */
|
||||
mbedtls_ssl_context context; /**< @brief SSL connection context */
|
||||
mbedtls_x509_crt_profile certProfile; /**< @brief Certificate security profile for this connection. */
|
||||
mbedtls_x509_crt rootCa; /**< @brief Root CA certificate context. */
|
||||
mbedtls_x509_crt clientCert; /**< @brief Client certificate context. */
|
||||
mbedtls_pk_context privKey; /**< @brief Client private key context. */
|
||||
} SSLContext_t;
|
||||
|
||||
/**
|
||||
* @brief Definition of the network context for the transport interface
|
||||
* implementation that uses mbedTLS and FreeRTOS+TLS sockets.
|
||||
*/
|
||||
struct NetworkContext
|
||||
{
|
||||
Socket_t tcpSocket;
|
||||
SSLContext_t sslContext;
|
||||
};
|
||||
|
||||
/**
|
||||
* @brief Contains the credentials necessary for tls connection setup.
|
||||
*/
|
||||
typedef struct NetworkCredentials
|
||||
{
|
||||
/**
|
||||
* @brief Set this to a non-NULL value to use ALPN.
|
||||
*
|
||||
* This string must be NULL-terminated.
|
||||
*
|
||||
* See [this link]
|
||||
* (https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/)
|
||||
* for more information.
|
||||
*/
|
||||
const char * pAlpnProtos;
|
||||
|
||||
/**
|
||||
* @brief Disable server name indication (SNI) for a TLS session.
|
||||
*/
|
||||
BaseType_t disableSni;
|
||||
|
||||
const unsigned char * pRootCa; /**< @brief String representing a trusted server root certificate. */
|
||||
size_t rootCaSize; /**< @brief Size associated with #IotNetworkCredentials.pRootCa. */
|
||||
const unsigned char * pClientCert; /**< @brief String representing the client certificate. */
|
||||
size_t clientCertSize; /**< @brief Size associated with #IotNetworkCredentials.pClientCert. */
|
||||
const unsigned char * pPrivateKey; /**< @brief String representing the client certificate's private key. */
|
||||
size_t privateKeySize; /**< @brief Size associated with #IotNetworkCredentials.pPrivateKey. */
|
||||
const unsigned char * pUserName; /**< @brief String representing the username for MQTT. */
|
||||
size_t userNameSize; /**< @brief Size associated with #IotNetworkCredentials.pUserName. */
|
||||
const unsigned char * pPassword; /**< @brief String representing the password for MQTT. */
|
||||
size_t passwordSize; /**< @brief Size associated with #IotNetworkCredentials.pPassword. */
|
||||
} NetworkCredentials_t;
|
||||
|
||||
/**
|
||||
* @brief TLS Connect / Disconnect return status.
|
||||
*/
|
||||
typedef enum TlsTransportStatus
|
||||
{
|
||||
TLS_TRANSPORT_SUCCESS = 0, /**< Function successfully completed. */
|
||||
TLS_TRANSPORT_INVALID_PARAMETER, /**< At least one parameter was invalid. */
|
||||
TLS_TRANSPORT_INSUFFICIENT_MEMORY, /**< Insufficient memory required to establish connection. */
|
||||
TLS_TRANSPORT_INVALID_CREDENTIALS, /**< Provided credentials were invalid. */
|
||||
TLS_TRANSPORT_HANDSHAKE_FAILED, /**< Performing TLS handshake with server failed. */
|
||||
TLS_TRANSPORT_INTERNAL_ERROR, /**< A call to a system API resulted in an internal error. */
|
||||
TLS_TRANSPORT_CONNECT_FAILURE /**< Initial connection to the server failed. */
|
||||
} TlsTransportStatus_t;
|
||||
|
||||
/**
|
||||
* @brief Create a TLS connection with FreeRTOS sockets.
|
||||
*
|
||||
* @param[out] pNetworkContext Pointer to a network context to contain the
|
||||
* initialized socket handle.
|
||||
* @param[in] pHostName The hostname of the remote endpoint.
|
||||
* @param[in] port The destination port.
|
||||
* @param[in] pNetworkCredentials Credentials for the TLS connection.
|
||||
* @param[in] receiveTimeoutMs Receive socket timeout.
|
||||
* @param[in] sendTimeoutMs Send socket timeout.
|
||||
*
|
||||
* @return #TLS_TRANSPORT_SUCCESS, #TLS_TRANSPORT_INSUFFICIENT_MEMORY, #TLS_TRANSPORT_INVALID_CREDENTIALS,
|
||||
* #TLS_TRANSPORT_HANDSHAKE_FAILED, #TLS_TRANSPORT_INTERNAL_ERROR, or #TLS_TRANSPORT_CONNECT_FAILURE.
|
||||
*/
|
||||
TlsTransportStatus_t TLS_FreeRTOS_Connect( NetworkContext_t * pNetworkContext,
|
||||
const char * pHostName,
|
||||
uint16_t port,
|
||||
const NetworkCredentials_t * pNetworkCredentials,
|
||||
uint32_t receiveTimeoutMs,
|
||||
uint32_t sendTimeoutMs );
|
||||
|
||||
/**
|
||||
* @brief Gracefully disconnect an established TLS connection.
|
||||
*
|
||||
* @param[in] pNetworkContext Network context.
|
||||
*/
|
||||
void TLS_FreeRTOS_Disconnect( NetworkContext_t * pNetworkContext );
|
||||
|
||||
/**
|
||||
* @brief Receives data from an established TLS connection.
|
||||
*
|
||||
* This is the TLS version of the transport interface's
|
||||
* #TransportRecv_t function.
|
||||
*
|
||||
* @param[in] pNetworkContext The Network context.
|
||||
* @param[out] pBuffer Buffer to receive bytes into.
|
||||
* @param[in] bytesToRecv Number of bytes to receive from the network.
|
||||
*
|
||||
* @return Number of bytes (> 0) received if successful;
|
||||
* 0 if the socket times out without reading any bytes;
|
||||
* negative value on error.
|
||||
*/
|
||||
int32_t TLS_FreeRTOS_recv( NetworkContext_t * pNetworkContext,
|
||||
void * pBuffer,
|
||||
size_t bytesToRecv );
|
||||
|
||||
/**
|
||||
* @brief Sends data over an established TLS connection.
|
||||
*
|
||||
* This is the TLS version of the transport interface's
|
||||
* #TransportSend_t function.
|
||||
*
|
||||
* @param[in] pNetworkContext The network context.
|
||||
* @param[in] pBuffer Buffer containing the bytes to send.
|
||||
* @param[in] bytesToSend Number of bytes to send from the buffer.
|
||||
*
|
||||
* @return Number of bytes (> 0) sent on success;
|
||||
* 0 if the socket times out without sending any bytes;
|
||||
* else a negative value to represent error.
|
||||
*/
|
||||
int32_t TLS_FreeRTOS_send( NetworkContext_t * pNetworkContext,
|
||||
const void * pBuffer,
|
||||
size_t bytesToSend );
|
||||
|
||||
#endif /* ifndef TLS_FREERTOS_H_ */
|
||||
@@ -0,0 +1,168 @@
|
||||
/*
|
||||
* Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||
* this software and associated documentation files (the "Software"), to deal in
|
||||
* the Software without restriction, including without limitation the rights to
|
||||
* use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
|
||||
* the Software, and to permit persons to whom the Software is furnished to do so,
|
||||
* subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in all
|
||||
* copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
|
||||
* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
||||
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @file freertos_sockets_wrapper.c
|
||||
* @brief FreeRTOS Sockets connect and disconnect wrapper implementation.
|
||||
*/
|
||||
|
||||
/* Standard includes. */
|
||||
#include <string.h>
|
||||
|
||||
/* FreeRTOS includes. */
|
||||
#include "FreeRTOS.h"
|
||||
|
||||
#include "freertos_sockets_wrapper.h"
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/* Maximum number of times to call FreeRTOS_recv when initiating a graceful shutdown. */
|
||||
#ifndef FREERTOS_SOCKETS_WRAPPER_SHUTDOWN_LOOPS
|
||||
#define FREERTOS_SOCKETS_WRAPPER_SHUTDOWN_LOOPS ( 3 )
|
||||
#endif
|
||||
|
||||
/* A negative error code indicating a network failure. */
|
||||
#define FREERTOS_SOCKETS_WRAPPER_NETWORK_ERROR ( -1 )
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
BaseType_t Sockets_Connect( Socket_t * pTcpSocket,
|
||||
const char * pHostName,
|
||||
uint16_t port,
|
||||
uint32_t receiveTimeoutMs,
|
||||
uint32_t sendTimeoutMs )
|
||||
{
|
||||
Socket_t tcpSocket = FREERTOS_INVALID_SOCKET;
|
||||
BaseType_t socketStatus = 0;
|
||||
struct freertos_sockaddr serverAddress = { 0 };
|
||||
TickType_t transportTimeout = 0;
|
||||
|
||||
/* Create a new TCP socket. */
|
||||
tcpSocket = FreeRTOS_socket( FREERTOS_AF_INET, FREERTOS_SOCK_STREAM, FREERTOS_IPPROTO_TCP );
|
||||
|
||||
if( tcpSocket == FREERTOS_INVALID_SOCKET )
|
||||
{
|
||||
LogError( ( "Failed to create new socket." ) );
|
||||
socketStatus = FREERTOS_SOCKETS_WRAPPER_NETWORK_ERROR;
|
||||
}
|
||||
else
|
||||
{
|
||||
LogDebug( ( "Created new TCP socket." ) );
|
||||
|
||||
/* Connection parameters. */
|
||||
serverAddress.sin_family = FREERTOS_AF_INET;
|
||||
serverAddress.sin_port = FreeRTOS_htons( port );
|
||||
serverAddress.sin_addr = FreeRTOS_gethostbyname( pHostName );
|
||||
serverAddress.sin_len = ( uint8_t ) sizeof( serverAddress );
|
||||
|
||||
/* Check for errors from DNS lookup. */
|
||||
if( serverAddress.sin_addr == 0 )
|
||||
{
|
||||
LogError( ( "Failed to connect to server: DNS resolution failed: Hostname=%s.",
|
||||
pHostName ) );
|
||||
socketStatus = FREERTOS_SOCKETS_WRAPPER_NETWORK_ERROR;
|
||||
}
|
||||
}
|
||||
|
||||
if( socketStatus == 0 )
|
||||
{
|
||||
/* Establish connection. */
|
||||
LogDebug( ( "Creating TCP Connection to %s.", pHostName ) );
|
||||
socketStatus = FreeRTOS_connect( tcpSocket, &serverAddress, sizeof( serverAddress ) );
|
||||
|
||||
if( socketStatus != 0 )
|
||||
{
|
||||
LogError( ( "Failed to connect to server: FreeRTOS_Connect failed: ReturnCode=%d,"
|
||||
" Hostname=%s, Port=%u.",
|
||||
socketStatus,
|
||||
pHostName,
|
||||
port ) );
|
||||
}
|
||||
}
|
||||
|
||||
if( socketStatus == 0 )
|
||||
{
|
||||
/* Set socket receive timeout. */
|
||||
transportTimeout = pdMS_TO_TICKS( receiveTimeoutMs );
|
||||
/* Setting the receive block time cannot fail. */
|
||||
( void ) FreeRTOS_setsockopt( tcpSocket,
|
||||
0,
|
||||
FREERTOS_SO_RCVTIMEO,
|
||||
&transportTimeout,
|
||||
sizeof( TickType_t ) );
|
||||
|
||||
/* Set socket send timeout. */
|
||||
transportTimeout = pdMS_TO_TICKS( sendTimeoutMs );
|
||||
/* Setting the send block time cannot fail. */
|
||||
( void ) FreeRTOS_setsockopt( tcpSocket,
|
||||
0,
|
||||
FREERTOS_SO_SNDTIMEO,
|
||||
&transportTimeout,
|
||||
sizeof( TickType_t ) );
|
||||
}
|
||||
|
||||
/* Clean up on failure. */
|
||||
if( socketStatus != 0 )
|
||||
{
|
||||
if( tcpSocket != FREERTOS_INVALID_SOCKET )
|
||||
{
|
||||
FreeRTOS_closesocket( tcpSocket );
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Set the socket. */
|
||||
*pTcpSocket = tcpSocket;
|
||||
LogInfo( ( "Established TCP connection with %s.", pHostName ) );
|
||||
}
|
||||
|
||||
return socketStatus;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
void Sockets_Disconnect( Socket_t tcpSocket )
|
||||
{
|
||||
BaseType_t waitForShutdownLoopCount = 0;
|
||||
uint8_t pDummyBuffer[ 2 ];
|
||||
|
||||
if( tcpSocket != FREERTOS_INVALID_SOCKET )
|
||||
{
|
||||
/* Initiate graceful shutdown. */
|
||||
( void ) FreeRTOS_shutdown( tcpSocket, FREERTOS_SHUT_RDWR );
|
||||
|
||||
/* Wait for the socket to disconnect gracefully (indicated by FreeRTOS_recv()
|
||||
* returning a FREERTOS_EINVAL error) before closing the socket. */
|
||||
while( FreeRTOS_recv( tcpSocket, pDummyBuffer, sizeof( pDummyBuffer ), 0 ) >= 0 )
|
||||
{
|
||||
/* We don't need to delay since FreeRTOS_recv should already have a timeout. */
|
||||
|
||||
if( ++waitForShutdownLoopCount >= FREERTOS_SOCKETS_WRAPPER_SHUTDOWN_LOOPS )
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
( void ) FreeRTOS_closesocket( tcpSocket );
|
||||
}
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
@@ -0,0 +1,625 @@
|
||||
/*
|
||||
* Copyright (C) 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.
|
||||
*
|
||||
* Permission is hereby granted, free of charge, to any person obtaining a copy of
|
||||
* this software and associated documentation files (the "Software"), to deal in
|
||||
* the Software without restriction, including without limitation the rights to
|
||||
* use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
|
||||
* the Software, and to permit persons to whom the Software is furnished to do so,
|
||||
* subject to the following conditions:
|
||||
*
|
||||
* The above copyright notice and this permission notice shall be included in all
|
||||
* copies or substantial portions of the Software.
|
||||
*
|
||||
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
|
||||
* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
|
||||
* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
|
||||
* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
|
||||
* CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
*/
|
||||
|
||||
/**
|
||||
* @file tls_freertos.c
|
||||
* @brief TLS transport interface implementations. This implementation uses
|
||||
* mbedTLS.
|
||||
*/
|
||||
|
||||
/* Standard includes. */
|
||||
#include <string.h>
|
||||
|
||||
/* FreeRTOS includes. */
|
||||
#include "FreeRTOS.h"
|
||||
|
||||
/* FreeRTOS+TCP includes. */
|
||||
#include "FreeRTOS_IP.h"
|
||||
#include "FreeRTOS_Sockets.h"
|
||||
|
||||
/* TLS transport header. */
|
||||
#include "tls_freertos.h"
|
||||
|
||||
/* FreeRTOS Socket wrapper include. */
|
||||
#include "freertos_sockets_wrapper.h"
|
||||
|
||||
/* mbedTLS util includes. */
|
||||
#include "mbedtls_error.h"
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Represents string to be logged when mbedTLS returned error
|
||||
* does not contain a high-level code.
|
||||
*/
|
||||
static const char * pNoHighLevelMbedTlsCodeStr = "<No-High-Level-Code>";
|
||||
|
||||
/**
|
||||
* @brief Represents string to be logged when mbedTLS returned error
|
||||
* does not contain a low-level code.
|
||||
*/
|
||||
static const char * pNoLowLevelMbedTlsCodeStr = "<No-Low-Level-Code>";
|
||||
|
||||
/**
|
||||
* @brief Utility for converting the high-level code in an mbedTLS error to string,
|
||||
* if the code-contains a high-level code; otherwise, using a default string.
|
||||
*/
|
||||
#define mbedtlsHighLevelCodeOrDefault( mbedTlsCode ) \
|
||||
( mbedtls_strerror_highlevel( mbedTlsCode ) != NULL ) ? \
|
||||
mbedtls_strerror_highlevel( mbedTlsCode ) : pNoHighLevelMbedTlsCodeStr
|
||||
|
||||
/**
|
||||
* @brief Utility for converting the level-level code in an mbedTLS error to string,
|
||||
* if the code-contains a level-level code; otherwise, using a default string.
|
||||
*/
|
||||
#define mbedtlsLowLevelCodeOrDefault( mbedTlsCode ) \
|
||||
( mbedtls_strerror_lowlevel( mbedTlsCode ) != NULL ) ? \
|
||||
mbedtls_strerror_lowlevel( mbedTlsCode ) : pNoLowLevelMbedTlsCodeStr
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief mbed TLS entropy context for generation of random numbers.
|
||||
*/
|
||||
static mbedtls_entropy_context entropyContext;
|
||||
|
||||
/**
|
||||
* @brief mbed TLS CTR DRBG context for generation of random numbers.
|
||||
*/
|
||||
static mbedtls_ctr_drbg_context ctrDrgbContext;
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
/**
|
||||
* @brief Initialize the mbed TLS structures in a network connection.
|
||||
*
|
||||
* @param[in] pSslContext The SSL context to initialize.
|
||||
*/
|
||||
static void sslContextInit( SSLContext_t * pSslContext );
|
||||
|
||||
/**
|
||||
* @brief Free the mbed TLS structures in a network connection.
|
||||
*
|
||||
* @param[in] pSslContext The SSL context to free.
|
||||
*/
|
||||
static void sslContextFree( SSLContext_t * pSslContext );
|
||||
|
||||
/**
|
||||
* @brief Set up TLS on a TCP connection.
|
||||
*
|
||||
* @param[in] pNetworkContext Network context.
|
||||
* @param[in] pHostName Remote host name, used for server name indication.
|
||||
* @param[in] pNetworkCredentials TLS setup parameters.
|
||||
*
|
||||
* @return #TLS_TRANSPORT_SUCCESS, #TLS_TRANSPORT_INSUFFICIENT_MEMORY, #TLS_TRANSPORT_INVALID_CREDENTIALS,
|
||||
* #TLS_TRANSPORT_HANDSHAKE_FAILED, or #TLS_TRANSPORT_INTERNAL_ERROR.
|
||||
*/
|
||||
static TlsTransportStatus_t tlsSetup( NetworkContext_t * pNetworkContext,
|
||||
const char * pHostName,
|
||||
const NetworkCredentials_t * pNetworkCredentials );
|
||||
|
||||
/**
|
||||
* @brief Initialize mbedTLS.
|
||||
*
|
||||
* @return #TLS_TRANSPORT_SUCCESS, or #TLS_TRANSPORT_INTERNAL_ERROR.
|
||||
*/
|
||||
static TlsTransportStatus_t initMbedtls( void );
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
static void sslContextInit( SSLContext_t * pSslContext )
|
||||
{
|
||||
configASSERT( pSslContext != NULL );
|
||||
|
||||
mbedtls_ssl_config_init( &( pSslContext->config ) );
|
||||
mbedtls_x509_crt_init( &( pSslContext->rootCa ) );
|
||||
mbedtls_pk_init( &( pSslContext->privKey ) );
|
||||
mbedtls_x509_crt_init( &( pSslContext->clientCert ) );
|
||||
mbedtls_ssl_init( &( pSslContext->context ) );
|
||||
}
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
static void sslContextFree( SSLContext_t * pSslContext )
|
||||
{
|
||||
configASSERT( pSslContext != NULL );
|
||||
|
||||
mbedtls_ssl_free( &( pSslContext->context ) );
|
||||
mbedtls_x509_crt_free( &( pSslContext->rootCa ) );
|
||||
mbedtls_x509_crt_free( &( pSslContext->clientCert ) );
|
||||
mbedtls_pk_free( &( pSslContext->privKey ) );
|
||||
mbedtls_ssl_config_free( &( pSslContext->config ) );
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
static TlsTransportStatus_t tlsSetup( NetworkContext_t * pNetworkContext,
|
||||
const char * pHostName,
|
||||
const NetworkCredentials_t * pNetworkCredentials )
|
||||
{
|
||||
TlsTransportStatus_t returnStatus = TLS_TRANSPORT_SUCCESS;
|
||||
int mbedtlsError = 0;
|
||||
|
||||
configASSERT( pNetworkContext != NULL );
|
||||
configASSERT( pHostName != NULL );
|
||||
configASSERT( pNetworkCredentials != NULL );
|
||||
configASSERT( pNetworkCredentials->pRootCa != NULL );
|
||||
|
||||
/* Initialize the mbed TLS context structures. */
|
||||
sslContextInit( &( pNetworkContext->sslContext ) );
|
||||
|
||||
mbedtlsError = mbedtls_ssl_config_defaults( &( pNetworkContext->sslContext.config ),
|
||||
MBEDTLS_SSL_IS_CLIENT,
|
||||
MBEDTLS_SSL_TRANSPORT_STREAM,
|
||||
MBEDTLS_SSL_PRESET_DEFAULT );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to set default SSL configuration: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
|
||||
/* Per mbed TLS docs, mbedtls_ssl_config_defaults only fails on memory allocation. */
|
||||
returnStatus = TLS_TRANSPORT_INSUFFICIENT_MEMORY;
|
||||
}
|
||||
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
/* Set up the certificate security profile, starting from the default value. */
|
||||
pNetworkContext->sslContext.certProfile = mbedtls_x509_crt_profile_default;
|
||||
|
||||
/* test.mosquitto.org only provides a 1024-bit RSA certificate, which is
|
||||
* not acceptable by the default mbed TLS certificate security profile.
|
||||
* For the purposes of this demo, allow the use of 1024-bit RSA certificates.
|
||||
* This block should be removed otherwise. */
|
||||
if( strncmp( pHostName, "test.mosquitto.org", strlen( pHostName ) ) == 0 )
|
||||
{
|
||||
pNetworkContext->sslContext.certProfile.rsa_min_bitlen = 1024;
|
||||
}
|
||||
|
||||
/* Set SSL authmode and the RNG context. */
|
||||
mbedtls_ssl_conf_authmode( &( pNetworkContext->sslContext.config ),
|
||||
MBEDTLS_SSL_VERIFY_REQUIRED );
|
||||
mbedtls_ssl_conf_rng( &( pNetworkContext->sslContext.config ),
|
||||
mbedtls_ctr_drbg_random,
|
||||
&ctrDrgbContext );
|
||||
mbedtls_ssl_conf_cert_profile( &( pNetworkContext->sslContext.config ),
|
||||
&( pNetworkContext->sslContext.certProfile ) );
|
||||
|
||||
/* Parse the server root CA certificate into the SSL context. */
|
||||
mbedtlsError = mbedtls_x509_crt_parse( &( pNetworkContext->sslContext.rootCa ),
|
||||
pNetworkCredentials->pRootCa,
|
||||
pNetworkCredentials->rootCaSize );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to parse server root CA certificate: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
|
||||
returnStatus = TLS_TRANSPORT_INVALID_CREDENTIALS;
|
||||
}
|
||||
else
|
||||
{
|
||||
mbedtls_ssl_conf_ca_chain( &( pNetworkContext->sslContext.config ),
|
||||
&( pNetworkContext->sslContext.rootCa ),
|
||||
NULL );
|
||||
}
|
||||
}
|
||||
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
if( ( pNetworkCredentials->pPrivateKey != NULL ) && ( pNetworkCredentials->pClientCert != NULL ) )
|
||||
{
|
||||
/* Setup the client private key. */
|
||||
mbedtlsError = mbedtls_pk_parse_key( &( pNetworkContext->sslContext.privKey ),
|
||||
pNetworkCredentials->pPrivateKey,
|
||||
pNetworkCredentials->privateKeySize,
|
||||
0,
|
||||
0 );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to parse client certificate: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
|
||||
returnStatus = TLS_TRANSPORT_INVALID_CREDENTIALS;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Setup the client certificate. */
|
||||
mbedtlsError = mbedtls_x509_crt_parse( &( pNetworkContext->sslContext.clientCert ),
|
||||
pNetworkCredentials->pClientCert,
|
||||
pNetworkCredentials->clientCertSize );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to parse the client private key: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
|
||||
returnStatus = TLS_TRANSPORT_INVALID_CREDENTIALS;
|
||||
}
|
||||
else
|
||||
{
|
||||
mbedtls_ssl_conf_own_cert( &( pNetworkContext->sslContext.config ),
|
||||
&( pNetworkContext->sslContext.clientCert ),
|
||||
&( pNetworkContext->sslContext.privKey ) );
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if( ( returnStatus == TLS_TRANSPORT_SUCCESS ) && ( pNetworkCredentials->pAlpnProtos != NULL ) )
|
||||
{
|
||||
/* Include an application protocol list in the TLS ClientHello
|
||||
* message. */
|
||||
mbedtlsError = mbedtls_ssl_conf_alpn_protocols( &( pNetworkContext->sslContext.config ),
|
||||
( const char ** ) &( pNetworkCredentials->pAlpnProtos ) );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to configure ALPN protocol in mbed TLS: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
|
||||
returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
|
||||
}
|
||||
}
|
||||
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
/* Initialize the mbed TLS secured connection context. */
|
||||
mbedtlsError = mbedtls_ssl_setup( &( pNetworkContext->sslContext.context ),
|
||||
&( pNetworkContext->sslContext.config ) );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to set up mbed TLS SSL context: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
|
||||
returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Set the underlying IO for the TLS connection. */
|
||||
mbedtls_ssl_set_bio( &( pNetworkContext->sslContext.context ),
|
||||
pNetworkContext->tcpSocket,
|
||||
mbedtls_platform_send,
|
||||
mbedtls_platform_recv,
|
||||
NULL );
|
||||
}
|
||||
}
|
||||
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
/* Enable SNI if requested. */
|
||||
if( pNetworkCredentials->disableSni == pdFALSE )
|
||||
{
|
||||
mbedtlsError = mbedtls_ssl_set_hostname( &( pNetworkContext->sslContext.context ),
|
||||
pHostName );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to set server name: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
|
||||
returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
/* Perform the TLS handshake. */
|
||||
do
|
||||
{
|
||||
mbedtlsError = mbedtls_ssl_handshake( &( pNetworkContext->sslContext.context ) );
|
||||
} while( ( mbedtlsError == MBEDTLS_ERR_SSL_WANT_READ ) ||
|
||||
( mbedtlsError == MBEDTLS_ERR_SSL_WANT_WRITE ) );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to perform TLS handshake: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
|
||||
returnStatus = TLS_TRANSPORT_HANDSHAKE_FAILED;
|
||||
}
|
||||
}
|
||||
|
||||
if( returnStatus != TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
sslContextFree( &( pNetworkContext->sslContext ) );
|
||||
}
|
||||
else
|
||||
{
|
||||
LogInfo( ( "(Network connection %p) TLS handshake successful.",
|
||||
pNetworkContext ) );
|
||||
}
|
||||
|
||||
return returnStatus;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
static TlsTransportStatus_t initMbedtls( void )
|
||||
{
|
||||
TlsTransportStatus_t returnStatus = TLS_TRANSPORT_SUCCESS;
|
||||
int mbedtlsError = 0;
|
||||
|
||||
/* Set the mutex functions for mbed TLS thread safety. */
|
||||
mbedtls_threading_set_alt( mbedtls_platform_mutex_init,
|
||||
mbedtls_platform_mutex_free,
|
||||
mbedtls_platform_mutex_lock,
|
||||
mbedtls_platform_mutex_unlock );
|
||||
|
||||
/* Initialize contexts for random number generation. */
|
||||
mbedtls_entropy_init( &entropyContext );
|
||||
mbedtls_ctr_drbg_init( &ctrDrgbContext );
|
||||
|
||||
/* Add a strong entropy source. At least one is required. */
|
||||
mbedtlsError = mbedtls_entropy_add_source( &entropyContext,
|
||||
mbedtls_platform_entropy_poll,
|
||||
NULL,
|
||||
32,
|
||||
MBEDTLS_ENTROPY_SOURCE_STRONG );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to add entropy source: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
|
||||
}
|
||||
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
/* Seed the random number generator. */
|
||||
mbedtlsError = mbedtls_ctr_drbg_seed( &ctrDrgbContext,
|
||||
mbedtls_entropy_func,
|
||||
&entropyContext,
|
||||
NULL,
|
||||
0 );
|
||||
|
||||
if( mbedtlsError != 0 )
|
||||
{
|
||||
LogError( ( "Failed to seed PRNG: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
|
||||
mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
|
||||
returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
|
||||
}
|
||||
}
|
||||
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
LogDebug( ( "Successfully initialized mbedTLS." ) );
|
||||
}
|
||||
|
||||
return returnStatus;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
TlsTransportStatus_t TLS_FreeRTOS_Connect( NetworkContext_t * pNetworkContext,
|
||||
const char * pHostName,
|
||||
uint16_t port,
|
||||
const NetworkCredentials_t * pNetworkCredentials,
|
||||
uint32_t receiveTimeoutMs,
|
||||
uint32_t sendTimeoutMs )
|
||||
{
|
||||
TlsTransportStatus_t returnStatus = TLS_TRANSPORT_SUCCESS;
|
||||
BaseType_t socketStatus = 0;
|
||||
|
||||
if( ( pNetworkContext == NULL ) ||
|
||||
( pHostName == NULL ) ||
|
||||
( pNetworkCredentials == NULL ) )
|
||||
{
|
||||
LogError( ( "Invalid input parameter(s): Arguments cannot be NULL. pNetworkContext=%p, "
|
||||
"pHostName=%p, pNetworkCredentials=%p.",
|
||||
pNetworkContext,
|
||||
pHostName,
|
||||
pNetworkCredentials ) );
|
||||
returnStatus = TLS_TRANSPORT_INVALID_PARAMETER;
|
||||
}
|
||||
else if( ( pNetworkCredentials->pRootCa == NULL ) )
|
||||
{
|
||||
LogError( ( "pRootCa cannot be NULL." ) );
|
||||
returnStatus = TLS_TRANSPORT_INVALID_PARAMETER;
|
||||
}
|
||||
|
||||
/* Establish a TCP connection with the server. */
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
socketStatus = Sockets_Connect( &( pNetworkContext->tcpSocket ),
|
||||
pHostName,
|
||||
port,
|
||||
receiveTimeoutMs,
|
||||
sendTimeoutMs );
|
||||
|
||||
if( socketStatus != 0 )
|
||||
{
|
||||
LogError( ( "Failed to connect to %s with error %d.",
|
||||
pHostName,
|
||||
socketStatus ) );
|
||||
returnStatus = TLS_TRANSPORT_CONNECT_FAILURE;
|
||||
}
|
||||
}
|
||||
|
||||
/* Initialize mbedtls. */
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
returnStatus = initMbedtls();
|
||||
}
|
||||
|
||||
/* Perform TLS handshake. */
|
||||
if( returnStatus == TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
returnStatus = tlsSetup( pNetworkContext, pHostName, pNetworkCredentials );
|
||||
}
|
||||
|
||||
/* Clean up on failure. */
|
||||
if( returnStatus != TLS_TRANSPORT_SUCCESS )
|
||||
{
|
||||
if( pNetworkContext->tcpSocket != FREERTOS_INVALID_SOCKET )
|
||||
{
|
||||
FreeRTOS_closesocket( pNetworkContext->tcpSocket );
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
LogInfo( ( "(Network connection %p) Connection to %s established.",
|
||||
pNetworkContext,
|
||||
pHostName ) );
|
||||
}
|
||||
|
||||
return returnStatus;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
void TLS_FreeRTOS_Disconnect( NetworkContext_t * pNetworkContext )
|
||||
{
|
||||
BaseType_t tlsStatus = 0;
|
||||
|
||||
/* Attempting to terminate TLS connection. */
|
||||
tlsStatus = ( BaseType_t ) mbedtls_ssl_close_notify( &( pNetworkContext->sslContext.context ) );
|
||||
|
||||
/* Ignore the WANT_READ and WANT_WRITE return values. */
|
||||
if( ( tlsStatus != ( BaseType_t ) MBEDTLS_ERR_SSL_WANT_READ ) &&
|
||||
( tlsStatus != ( BaseType_t ) MBEDTLS_ERR_SSL_WANT_WRITE ) )
|
||||
{
|
||||
if( tlsStatus == 0 )
|
||||
{
|
||||
LogInfo( ( "(Network connection %p) TLS close-notify sent.",
|
||||
pNetworkContext ) );
|
||||
}
|
||||
else
|
||||
{
|
||||
LogError( ( "(Network connection %p) Failed to send TLS close-notify: mbedTLSError= %s : %s.",
|
||||
pNetworkContext,
|
||||
mbedtlsHighLevelCodeOrDefault( tlsStatus ),
|
||||
mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
/* WANT_READ and WANT_WRITE can be ignored. Logging for debugging purposes. */
|
||||
LogInfo( ( "(Network connection %p) TLS close-notify sent; ",
|
||||
"received %s as the TLS status can be ignored for close-notify."
|
||||
( tlsStatus == MBEDTLS_ERR_SSL_WANT_READ ) ? "WANT_READ" : "WANT_WRITE",
|
||||
pNetworkContext ) );
|
||||
}
|
||||
|
||||
/* Call socket shutdown function to close connection. */
|
||||
Sockets_Disconnect( pNetworkContext->tcpSocket );
|
||||
|
||||
/* Free mbed TLS contexts. */
|
||||
sslContextFree( &( pNetworkContext->sslContext ) );
|
||||
|
||||
/* Free the contexts for random number generation. */
|
||||
mbedtls_ctr_drbg_free( &ctrDrgbContext );
|
||||
mbedtls_entropy_free( &entropyContext );
|
||||
|
||||
/* Clear the mutex functions for mbed TLS thread safety. */
|
||||
mbedtls_threading_free_alt();
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
int32_t TLS_FreeRTOS_recv( NetworkContext_t * pNetworkContext,
|
||||
void * pBuffer,
|
||||
size_t bytesToRecv )
|
||||
{
|
||||
int32_t tlsStatus = 0;
|
||||
|
||||
tlsStatus = ( int32_t ) mbedtls_ssl_read( &( pNetworkContext->sslContext.context ),
|
||||
pBuffer,
|
||||
bytesToRecv );
|
||||
|
||||
if( ( tlsStatus == MBEDTLS_ERR_SSL_TIMEOUT ) ||
|
||||
( tlsStatus == MBEDTLS_ERR_SSL_WANT_READ ) ||
|
||||
( tlsStatus == MBEDTLS_ERR_SSL_WANT_WRITE ) )
|
||||
{
|
||||
LogDebug( ( "Failed to read data. However, a read can be retried on this error. "
|
||||
"mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( tlsStatus ),
|
||||
mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
|
||||
|
||||
/* Mark these set of errors as a timeout. The libraries may retry read
|
||||
* on these errors. */
|
||||
tlsStatus = 0;
|
||||
}
|
||||
else if( tlsStatus < 0 )
|
||||
{
|
||||
LogError( ( "Failed to read data: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( tlsStatus ),
|
||||
mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Empty else marker. */
|
||||
}
|
||||
|
||||
return tlsStatus;
|
||||
}
|
||||
|
||||
/*-----------------------------------------------------------*/
|
||||
|
||||
int32_t TLS_FreeRTOS_send( NetworkContext_t * pNetworkContext,
|
||||
const void * pBuffer,
|
||||
size_t bytesToSend )
|
||||
{
|
||||
int32_t tlsStatus = 0;
|
||||
|
||||
tlsStatus = ( int32_t ) mbedtls_ssl_write( &( pNetworkContext->sslContext.context ),
|
||||
pBuffer,
|
||||
bytesToSend );
|
||||
|
||||
if( ( tlsStatus == MBEDTLS_ERR_SSL_TIMEOUT ) ||
|
||||
( tlsStatus == MBEDTLS_ERR_SSL_WANT_READ ) ||
|
||||
( tlsStatus == MBEDTLS_ERR_SSL_WANT_WRITE ) )
|
||||
{
|
||||
LogDebug( ( "Failed to send data. However, send can be retried on this error. "
|
||||
"mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( tlsStatus ),
|
||||
mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
|
||||
|
||||
/* Mark these set of errors as a timeout. The libraries may retry send
|
||||
* on these errors. */
|
||||
tlsStatus = 0;
|
||||
}
|
||||
else if( tlsStatus < 0 )
|
||||
{
|
||||
LogError( ( "Failed to send data: mbedTLSError= %s : %s.",
|
||||
mbedtlsHighLevelCodeOrDefault( tlsStatus ),
|
||||
mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
|
||||
}
|
||||
else
|
||||
{
|
||||
/* Empty else marker. */
|
||||
}
|
||||
|
||||
return tlsStatus;
|
||||
}
|
||||
/*-----------------------------------------------------------*/
|
||||
Reference in New Issue
Block a user