Skip to content

Flag certificate verification functions with MBEDTLS_X509_CRT_PARSE_C. #8465

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Oct 22, 2018
Merged

Flag certificate verification functions with MBEDTLS_X509_CRT_PARSE_C. #8465

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 22 additions & 3 deletions features/netsocket/TLSSocketWrapper.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,8 +28,10 @@

TLSSocketWrapper::TLSSocketWrapper(Socket *transport, const char *hostname, control_transport control) :
_transport(transport),
#ifdef MBEDTLS_X509_CRT_PARSE_C
_cacert(NULL),
_clicert(NULL),
#endif
_ssl_conf(NULL),
_connect_transport(control==TRANSPORT_CONNECT || control==TRANSPORT_CONNECT_AND_CLOSE),
_close_transport(control==TRANSPORT_CLOSE || control==TRANSPORT_CONNECT_AND_CLOSE),
Expand Down Expand Up @@ -57,20 +59,24 @@ TLSSocketWrapper::~TLSSocketWrapper() {
mbedtls_ssl_free(&_ssl);
mbedtls_pk_free(&_pkctx);

#ifdef MBEDTLS_X509_CRT_PARSE_C
set_own_cert(NULL);
set_ca_chain(NULL);
#endif
set_ssl_config(NULL);
}

void TLSSocketWrapper::set_hostname(const char *hostname)
{
#ifdef MBEDTLS_X509_CRT_PARSE_C
mbedtls_ssl_set_hostname(&_ssl, hostname);
#endif
}

nsapi_error_t TLSSocketWrapper::set_root_ca_cert(const void *root_ca, size_t len)
{
#if !defined(MBEDTLS_X509_CRT_PARSE_C)
return NSAPI_ERROR_UNSUPPORTED
return NSAPI_ERROR_UNSUPPORTED;
#else
mbedtls_x509_crt *crt;

Expand Down Expand Up @@ -108,7 +114,7 @@ nsapi_error_t TLSSocketWrapper::set_client_cert_key(const void *client_cert, siz
const void *client_private_key_pem, size_t client_private_key_len)
{
#if !defined(MBEDTLS_X509_CRT_PARSE_C)
return NSAPI_ERROR_UNSUPPORTED
return NSAPI_ERROR_UNSUPPORTED;
#else

int ret;
Expand Down Expand Up @@ -173,8 +179,12 @@ nsapi_error_t TLSSocketWrapper::do_handshake() {

mbedtls_ssl_set_bio(&_ssl, this, ssl_send, ssl_recv, NULL );

#ifdef MBEDTLS_X509_CRT_PARSE_C
/* Start the handshake, the rest will be done in onReceive() */
tr_info("Starting TLS handshake with %s", _ssl.hostname);
#else
tr_info("Starting TLS handshake");
#endif

do {
ret = mbedtls_ssl_handshake(&_ssl);
Expand All @@ -185,9 +195,14 @@ nsapi_error_t TLSSocketWrapper::do_handshake() {
return ret;
}

#ifdef MBEDTLS_X509_CRT_PARSE_C
/* It also means the handshake is done, time to print info */
tr_info("TLS connection to %s established\r\n", _ssl.hostname);
tr_info("TLS connection to %s established", _ssl.hostname);
#else
tr_info("TLS connection established");
#endif

#ifdef MBEDTLS_X509_CRT_PARSE_C
/* Prints the server certificate and verify it. */
const size_t buf_size = 1024;
char* buf = new char[buf_size];
Expand All @@ -205,6 +220,7 @@ nsapi_error_t TLSSocketWrapper::do_handshake() {
tr_info("Certificate verification passed");
}
delete[] buf;
#endif

_handshake_completed = true;

Expand Down Expand Up @@ -368,6 +384,7 @@ int TLSSocketWrapper::ssl_send(void *ctx, const unsigned char *buf, size_t len)
return size;
}

#ifdef MBEDTLS_X509_CRT_PARSE_C

mbedtls_x509_crt *TLSSocketWrapper::get_own_cert()
{
Expand Down Expand Up @@ -408,6 +425,8 @@ void TLSSocketWrapper::set_ca_chain(mbedtls_x509_crt *crt)
mbedtls_ssl_conf_ca_chain(get_ssl_config(), _cacert, NULL);
}

#endif /* MBEDTLS_X509_CRT_PARSE_C */

mbedtls_ssl_config *TLSSocketWrapper::get_ssl_config()
{
if (!_ssl_conf) {
Expand Down
4 changes: 4 additions & 0 deletions features/netsocket/TLSSocketWrapper.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,6 +133,7 @@ class TLSSocketWrapper : public Socket {
virtual Socket *accept(nsapi_error_t *error = NULL);
virtual nsapi_error_t listen(int backlog = 1);

#if defined(MBEDTLS_X509_CRT_PARSE_C) || defined(DOXYGEN)
/** Get own certificate directly from Mbed TLS
* @return internal Mbed TLS X509 structure
*/
Expand All @@ -153,6 +154,7 @@ class TLSSocketWrapper : public Socket {
* @param crt Mbed TLS X509 certificate chain.
*/
void set_ca_chain(mbedtls_x509_crt *crt);
#endif

/** Get internal Mbed TLS configuration structure
* @return Mbed TLS SSL config
Expand Down Expand Up @@ -216,8 +218,10 @@ class TLSSocketWrapper : public Socket {

Socket *_transport;

#ifdef MBEDTLS_X509_CRT_PARSE_C
mbedtls_x509_crt* _cacert;
mbedtls_x509_crt* _clicert;
#endif
mbedtls_ssl_config* _ssl_conf;

bool _connect_transport:1;
Expand Down