Skip to content

Commit fa9f025

Browse files
david-cermakdavid-cermak
committed
Merge branch 'feature/asio_ssl_support' into 'master'
asio: basic support of SSL/TLS transport Closes IDFGH-1085 and IDFGH-2138 See merge request espressif/esp-idf!8797
2 parents 1c4d475 + b2150f8 commit fa9f025

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+2484
-152
lines changed

‎components/asio/CMakeLists.txt

Lines changed: 31 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,33 @@
1-
idf_component_register(SRCS "asio/asio/src/asio.cpp"
1+
set(asio_sources "asio/asio/src/asio.cpp")
2+
3+
if (CONFIG_ASIO_SSL_SUPPORT)
4+
if(CONFIG_ASIO_USE_ESP_OPENSSL)
5+
list(APPEND asio_sources
6+
"asio/asio/src/asio_ssl.cpp"
7+
"port/src/esp_asio_openssl_stubs.c")
8+
endif()
9+
10+
if(CONFIG_ASIO_USE_ESP_WOLFSSL)
11+
list(APPEND asio_sources
12+
"asio/asio/src/asio_ssl.cpp")
13+
endif()
14+
endif()
15+
16+
idf_component_register(SRCS ${asio_sources}
217
INCLUDE_DIRS "asio/asio/include" "port/include"
318
REQUIRES lwip)
19+
20+
if (CONFIG_ASIO_SSL_SUPPORT)
21+
if(CONFIG_ASIO_USE_ESP_WOLFSSL)
22+
idf_component_get_property(wolflib esp-wolfssl COMPONENT_LIB)
23+
idf_component_get_property(wolfdir esp-wolfssl COMPONENT_DIR)
24+
25+
target_link_libraries(${COMPONENT_LIB} PUBLIC ${wolflib})
26+
target_include_directories(${COMPONENT_LIB} PUBLIC ${wolfdir}/wolfssl/wolfssl)
27+
endif()
28+
29+
if(CONFIG_ASIO_USE_ESP_OPENSSL)
30+
idf_component_get_property(esp_openssl openssl COMPONENT_LIB)
31+
target_link_libraries(${COMPONENT_LIB} PUBLIC ${esp_openssl})
32+
endif()
33+
endif()

‎components/asio/Kconfig

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
menu "ESP-ASIO"
2+
config ASIO_SSL_SUPPORT
3+
bool "Enable SSL/TLS support of ASIO"
4+
default n
5+
help
6+
Enable support for basic SSL/TLS features, available for mbedTLS/OpenSSL
7+
as well as wolfSSL TLS library.
8+
9+
choice ASIO_SSL_LIBRARY_CHOICE
10+
prompt "Choose SSL/TLS library for ESP-TLS (See help for more Info)"
11+
default ASIO_USE_ESP_OPENSSL
12+
depends on ASIO_SSL_SUPPORT
13+
help
14+
The ASIO support multiple backend TLS libraries. Currently the mbedTLS with a thin ESP-OpenSSL
15+
port layer (default choice) and WolfSSL are supported.
16+
Different TLS libraries may support different features and have different resource
17+
usage. Consult the ESP-TLS documentation in ESP-IDF Programming guide for more details.
18+
config ASIO_USE_ESP_OPENSSL
19+
bool "esp-openssl"
20+
config ASIO_USE_ESP_WOLFSSL
21+
depends on TLS_STACK_WOLFSSL
22+
bool "wolfSSL (License info in wolfSSL directory README)"
23+
endchoice
24+
25+
endmenu

‎components/asio/asio

‎components/asio/component.mk

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
COMPONENT_ADD_INCLUDEDIRS := asio/asio/include port/include
22
COMPONENT_PRIV_INCLUDEDIRS := private_include
3-
COMPONENT_SRCDIRS := asio/asio/src
4-
COMPONENT_OBJEXCLUDE := asio/asio/src/asio_ssl.o
3+
COMPONENT_SRCDIRS := asio/asio/src port/src
4+
5+
ifeq ($(CONFIG_ASIO_SSL_SUPPORT), )
6+
COMPONENT_OBJEXCLUDE := asio/asio/src/asio_ssl.o port/src/esp_asio_openssl_stubs.o
7+
endif
58

69
COMPONENT_SUBMODULES += asio

‎components/asio/port/include/esp_asio_config.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,4 +40,11 @@
4040
# define ASIO_STANDALONE
4141
# define ASIO_HAS_PTHREADS
4242

43+
# ifdef CONFIG_ASIO_USE_ESP_OPENSSL
44+
# define ASIO_USE_ESP_OPENSSL
45+
# define OPENSSL_NO_ENGINE
46+
# elif CONFIG_ASIO_USE_ESP_WOLFSSL
47+
# define ASIO_USE_WOLFSSL
48+
# endif // CONFIG_ASIO_USE_ESP_OPENSSL
49+
4350
#endif // _ESP_ASIO_CONFIG_H_

‎components/asio/port/include/openssl/conf.h

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#ifndef _ESP_ASIO_OPENSSL_CONF_H
16+
#define _ESP_ASIO_OPENSSL_CONF_H
17+
#include "esp_asio_config.h"
18+
#include "openssl/esp_asio_openssl_stubs.h"
19+
20+
#if defined(ASIO_USE_WOLFSSL)
21+
// SSLv3 Methods not present in current wolfSSL library
22+
#define OPENSSL_NO_SSL3
23+
#include_next "openssl/conf.h"
24+
#endif // ASIO_USE_WOLFSSL
25+
26+
#endif // _ESP_ASIO_OPENSSL_CONF_H

‎components/asio/port/include/openssl/dh.h

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#ifndef _ESP_ASIO_OPENSSL_DH_STUB_H
16+
#define _ESP_ASIO_OPENSSL_DH_STUB_H
17+
// Dummy header needed for ASIO compilation with esp-openssl
18+
19+
#if defined(ASIO_USE_WOLFSSL)
20+
#include_next "openssl/dh.h"
21+
#endif // ASIO_USE_WOLFSSL
22+
23+
#endif // _ESP_ASIO_OPENSSL_DH_STUB_H

‎components/asio/port/include/openssl/esp_asio_openssl_stubs.h

Lines changed: 209 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,209 @@
1+
// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#ifndef _ESP_ASIO_OPENSSL_STUBS_H
16+
#define _ESP_ASIO_OPENSSL_STUBS_H
17+
18+
/**
19+
* @note This header contains openssl API which are NOT implemented, and are only provided
20+
* as stubs or no-operations to get the ASIO library compiled and working with most
21+
* practical use cases as an embedded application on ESP platform
22+
*/
23+
24+
#if defined(ASIO_USE_WOLFSSL)
25+
26+
#include "wolfssl/ssl.h"
27+
// esp-wolfssl disables filesystem by default, but the ssl filesystem functions are needed for the ASIO to compile
28+
// - so we could either configure wolfSSL to use filesystem
29+
// - or use the default wolfSSL and declare the filesystem functions -- preferred option, as whenever
30+
// the filesystem functions are used from app code (potential security impact if private keys in a filesystem)
31+
// compilation fails with linking errors.
32+
33+
#if defined(NO_FILESYSTEM)
34+
// WolfSSL methods that are not included in standard esp-wolfssl config, must be defined here
35+
// as function stubs, so ASIO compiles, but would get link errors, if these functions were used.
36+
37+
#ifdef __cplusplus
38+
extern "C" {
39+
#endif
40+
41+
typedef struct WOLFSSL_CTX WOLFSSL_CTX;
42+
43+
void wolfSSL_CTX_set_verify_depth(WOLFSSL_CTX *ctx,int depth);
44+
int SSL_CTX_load_verify_locations(WOLFSSL_CTX*, const char*, const char*);
45+
int SSL_CTX_use_certificate_file(WOLFSSL_CTX*, const char*, int);
46+
int SSL_CTX_use_certificate_chain_file(WOLFSSL_CTX*, const char*);
47+
int SSL_CTX_use_PrivateKey_file(WOLFSSL_CTX*, const char*, int);
48+
int SSL_CTX_use_RSAPrivateKey_file(WOLFSSL_CTX*, const char*, int);
49+
50+
#if defined(__cplusplus)
51+
} /* extern C */
52+
#endif
53+
54+
#endif // NO_FILESYSTEM
55+
56+
#elif defined(ASIO_USE_ESP_OPENSSL)
57+
58+
#include "internal/ssl_x509.h"
59+
#include "internal/ssl_pkey.h"
60+
#include "mbedtls/pem.h"
61+
#include <stdint.h>
62+
63+
64+
#ifdef __cplusplus
65+
extern "C" {
66+
#endif
67+
68+
69+
// The most applicable OpenSSL version wrtt ASIO usage
70+
#define OPENSSL_VERSION_NUMBER 0x10100001L
71+
// SSLv2 methods not supported
72+
// OpenSSL port supports: TLS_ANY, TLS_1, TLS_1_1, TLS_1_2, SSL_3
73+
#define OPENSSL_NO_SSL2
74+
#define SSL2_VERSION 0x0002
75+
76+
#define SSL_R_SHORT_READ 219
77+
#define SSL_OP_ALL 0
78+
#define SSL_OP_SINGLE_DH_USE 0
79+
#define SSL_OP_NO_COMPRESSION 0
80+
// Translates mbedTLS PEM parse error, used by ASIO
81+
#define PEM_R_NO_START_LINE -MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT
82+
83+
#define SSL_OP_NO_SSLv2 0x01000000L
84+
#define SSL_OP_NO_SSLv3 0x02000000L
85+
#define SSL_OP_NO_TLSv1 0x04000000L
86+
87+
#define X509_FILETYPE_PEM 1
88+
#define X509_FILETYPE_ASN1 2
89+
#define SSL_FILETYPE_ASN1 X509_FILETYPE_ASN1
90+
#define SSL_FILETYPE_PEM X509_FILETYPE_PEM
91+
92+
#define NID_subject_alt_name 85
93+
94+
95+
#define GEN_DNS 2
96+
#define GEN_IPADD 7
97+
#define V_ASN1_OCTET_STRING 4
98+
#define V_ASN1_IA5STRING 22
99+
#define NID_commonName 13
100+
101+
#define SSL_CTX_get_app_data(ctx) ((void*)SSL_CTX_get_ex_data(ctx, 0))
102+
103+
/**
104+
* @brief Frees DH object -- not implemented
105+
*
106+
* Current implementation calls SSL_ASSERT
107+
*
108+
* @param r DH object
109+
*/
110+
void DH_free(DH *r);
111+
112+
/**
113+
* @brief Frees GENERAL_NAMES -- not implemented
114+
*
115+
* Current implementation calls SSL_ASSERT
116+
*
117+
* @param r GENERAL_NAMES object
118+
*/
119+
void GENERAL_NAMES_free(GENERAL_NAMES * gens);
120+
121+
/**
122+
* @brief Returns subject name from X509 -- not implemented
123+
*
124+
* Current implementation calls SSL_ASSERT
125+
*
126+
* @param r X509 object
127+
*/
128+
X509_NAME *X509_get_subject_name(X509 *a);
129+
130+
/**
131+
* @brief API provaded as declaration only
132+
*
133+
*/
134+
int X509_STORE_CTX_get_error_depth(X509_STORE_CTX *ctx);
135+
136+
/**
137+
* @brief API provaded as declaration only
138+
*
139+
*/
140+
int X509_NAME_get_index_by_NID(X509_NAME *name, int nid, int lastpos);
141+
142+
/**
143+
* @brief API provaded as declaration only
144+
*
145+
*/
146+
X509_NAME_ENTRY *X509_NAME_get_entry(X509_NAME *name, int loc);
147+
148+
/**
149+
* @brief API provaded as declaration only
150+
*
151+
*/
152+
ASN1_STRING *X509_NAME_ENTRY_get_data(X509_NAME_ENTRY *ne);
153+
154+
/**
155+
* @brief API provaded as declaration only
156+
*
157+
*/
158+
void *X509_get_ext_d2i(X509 *x, int nid, int *crit, int *idx);
159+
160+
/**
161+
* @brief API provaded as declaration only
162+
*
163+
*/
164+
X509 * X509_STORE_CTX_get_current_cert(X509_STORE_CTX *ctx);
165+
166+
/**
167+
* @brief Reads DH params from a bio object -- not implemented
168+
*
169+
* Current implementation calls SSL_ASSERT
170+
*/
171+
DH *PEM_read_bio_DHparams(BIO *bp, DH **x, pem_password_cb *cb, void *u);
172+
173+
/**
174+
* @brief API provaded as declaration only
175+
*
176+
*/
177+
void * X509_STORE_CTX_get_ex_data(X509_STORE_CTX *ctx,int idx);
178+
179+
/**
180+
* @brief Sets DH params to ssl ctx -- not implemented
181+
*
182+
* Current implementation calls SSL_ASSERT
183+
*/
184+
int SSL_CTX_set_tmp_dh(SSL_CTX *ctx, const DH *dh);
185+
186+
/**
187+
* @brief API provaded as declaration only
188+
*
189+
*/
190+
void SSL_CTX_set_default_passwd_cb_userdata(SSL_CTX *ctx, void *data);
191+
192+
/**
193+
* @brief API provaded as declaration only
194+
*
195+
*/
196+
void SSL_CTX_set_default_passwd_cb(SSL_CTX *ctx, pem_password_cb *cb);
197+
198+
/**
199+
* @brief Clears any existing chain associated with the current certificate of ctx.
200+
*
201+
*/
202+
int SSL_CTX_clear_chain_certs(SSL_CTX *ctx);
203+
204+
#if defined(__cplusplus)
205+
} /* extern C */
206+
#endif
207+
208+
#endif /* ASIO_USE_ESP_OPENSSL, ASIO_USE_WOLFSSL */
209+
#endif /* _ESP_ASIO_OPENSSL_STUBS_H */

‎components/asio/port/include/openssl/rsa.h

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#ifndef _ESP_ASIO_OPENSSL_RSA_STUB_H
16+
#define _ESP_ASIO_OPENSSL_RSA_STUB_H
17+
// Dummy header needed for ASIO compilation with esp-openssl
18+
19+
#if defined(ASIO_USE_WOLFSSL)
20+
#include_next "openssl/rsa.h"
21+
#endif // ASIO_USE_WOLFSSL
22+
23+
#endif // _ESP_ASIO_OPENSSL_RSA_STUB_H

‎components/asio/port/include/openssl/x509v3.h

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
// Copyright 2020 Espressif Systems (Shanghai) PTE LTD
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
#ifndef _ESP_ASIO_OPENSSL_X509V3_STUB_H
16+
#define _ESP_ASIO_OPENSSL_X509V3_STUB_H
17+
// Dummy header needed for ASIO compilation with esp-openssl
18+
19+
#if defined(ASIO_USE_WOLFSSL)
20+
#include_next "openssl/x509v3.h"
21+
#endif // ASIO_USE_WOLFSSL
22+
23+
#endif // _ESP_ASIO_OPENSSL_X509V3_STUB_H

0 commit comments

Comments
 (0)