Compare commits
15 commits
| Author | SHA1 | Date | |
|---|---|---|---|
|
1fe4894800 | ||
|
|
028e33728d | ||
|
|
978d6020d4 | ||
|
|
f95facc254 | ||
|
|
d5e9c6d1aa | ||
|
|
cbb4493876 | ||
|
|
1f9c1f9088 | ||
|
|
812ff13425 | ||
|
|
7fd3c7ff3e | ||
|
|
22ddeeb19b | ||
|
|
1f1f81fde5 | ||
|
|
f6aa0fd5ad | ||
|
|
a5f4e412cc | ||
|
|
bcceea1c47 | ||
|
|
b8539a88d7 |
15 changed files with 727 additions and 158 deletions
281
.github/workflows/ci.yml
vendored
Normal file
281
.github/workflows/ci.yml
vendored
Normal file
|
|
@ -0,0 +1,281 @@
|
|||
name: CI
|
||||
on:
|
||||
push:
|
||||
tags:
|
||||
- v*
|
||||
branches-ignore:
|
||||
- gh-pages
|
||||
pull_request:
|
||||
|
||||
env:
|
||||
ARDUINO_BOARD_MANAGER_ADDITIONAL_URLS: "https://adafruit.github.io/arduino-board-index/package_adafruit_index.json https://raw.githubusercontent.com/espressif/arduino-esp32/gh-pages/package_esp32_index.json https://github.com/stm32duino/BoardManagerFiles/raw/master/STM32/package_stm_index.json"
|
||||
|
||||
jobs:
|
||||
build-examples-arduino:
|
||||
name: Arduino ${{ matrix.example }} for ${{ matrix.board.fqbn }}
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
example:
|
||||
- EthernetHTTPS
|
||||
- EthernetMultiHTTPS
|
||||
- EthernetMQTT
|
||||
- EthernetAWSIoT
|
||||
board:
|
||||
# Arduino Zero
|
||||
- arduino-platform: arduino:samd
|
||||
fqbn: arduino:samd:mzero_bl
|
||||
# Adafruit Feather M0
|
||||
- arduino-platform: arduino:samd adafruit:samd
|
||||
fqbn: adafruit:samd:adafruit_feather_m0
|
||||
# Arduino Due
|
||||
- arduino-platform: arduino:sam
|
||||
fqbn: arduino:sam:arduino_due_x
|
||||
# ESP32
|
||||
- arduino-platform: esp32:esp32
|
||||
fqbn: esp32:esp32:d32
|
||||
include:
|
||||
# STM32 Nucleo 144
|
||||
- board:
|
||||
arduino-platform: STM32:stm32
|
||||
fqbn: STM32:stm32:Nucleo_144:pnum=NUCLEO_F767ZI
|
||||
pio-platform: nucleo_f767zi
|
||||
example: stm32/EthernetHTTPSstm32
|
||||
steps:
|
||||
# Setup pyserial for esptool.py
|
||||
- name: Setup Python
|
||||
if: matrix.board.arduino-platform == 'esp32:esp32'
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x' # Version range or exact version of a Python version to use, using SemVer's version range syntax
|
||||
- name: Install Pyserial
|
||||
if: matrix.board.arduino-platform == 'esp32:esp32'
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
pip install pyserial
|
||||
|
||||
# Setup Arduino-CLI
|
||||
- name: Install Arduino CLI
|
||||
uses: arduino/setup-arduino-cli@v1.1.1
|
||||
|
||||
# Install Dependencies
|
||||
- name: Install Core(s)
|
||||
run: arduino-cli core install ${{ matrix.board.arduino-platform }} -v
|
||||
- name: Install EthernetLarge
|
||||
run: git clone https://github.com/OPEnSLab-OSU/EthernetLarge.git ~/Arduino/libraries/EthernetLarge
|
||||
- name: Install Other Libraries
|
||||
run: arduino-cli lib install "STM32duino STM32Ethernet" PubSubClient -v
|
||||
|
||||
# Checkout
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
path: SSLClient
|
||||
|
||||
# Compile
|
||||
- name: Compile Sketch
|
||||
run: arduino-cli compile -v --libraries . --warnings all --fqbn ${{ matrix.board.fqbn }} SSLClient/examples/${{ matrix.example }}
|
||||
|
||||
build-examples-platformio:
|
||||
name: PIO ${{ matrix.example }} for ${{ matrix.board.pio-platform }}
|
||||
runs-on: ubuntu-latest
|
||||
strategy:
|
||||
fail-fast: false
|
||||
matrix:
|
||||
# Copy of the above matrix (no anchors :( )
|
||||
example:
|
||||
- EthernetHTTPS
|
||||
- EthernetMultiHTTPS
|
||||
- EthernetMQTT
|
||||
- EthernetAWSIoT
|
||||
board:
|
||||
# Arduino Zero
|
||||
- pio-platform: zeroUSB
|
||||
# Adafruit Feather M0
|
||||
- pio-platform: adafruit_feather_m0
|
||||
# Arduino Due
|
||||
- pio-platform: dueUSB
|
||||
# ESP32
|
||||
- pio-platform: lolin32
|
||||
# Teensy 4.0
|
||||
- pio-platform: teensy40
|
||||
# Teensy 3.6
|
||||
- pio-platform: teensy36
|
||||
# Teensy 3.5
|
||||
- pio-platform: teensy35
|
||||
# Teensy 3.1/3.2
|
||||
- pio-platform: teensy31
|
||||
# Teensy 3.0
|
||||
- pio-platform: teensy30
|
||||
include:
|
||||
# STM32 Nucleo 144
|
||||
- board:
|
||||
pio-platform: nucleo_f767zi
|
||||
example: stm32/EthernetHTTPSstm32
|
||||
# TIVA-C
|
||||
- board:
|
||||
pio-platform: lptm4c1294ncpdt
|
||||
extra-flags: -O "lib_deps=SPI"
|
||||
example: tivac/EthernetHTTPStivac
|
||||
steps:
|
||||
# Setup python for platformio
|
||||
- name: Setup Python
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x' # Version range or exact version of a Python version to use, using SemVer's version range syntax
|
||||
|
||||
# Setup PlatformIO
|
||||
- name: Install Python Dependencies
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
pip install pyserial platformio
|
||||
|
||||
# Install Dependencies
|
||||
- name: Install Libraries
|
||||
run: |
|
||||
pio lib -g install "stm32duino/STM32duino LwIP"
|
||||
pio lib -g install stm32duino/STM32Ethernet
|
||||
pio lib -g install PubSubClient
|
||||
pio lib -g install https://github.com/OPEnSLab-OSU/EthernetLarge.git
|
||||
|
||||
# Checkout
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v2
|
||||
|
||||
# Compile
|
||||
- name: Compile Sketch
|
||||
run: pio ci -l . -b ${{ matrix.board.pio-platform }} ${{ matrix.board.extra-flags }} ${{ github.workspace }}/examples/${{ matrix.example }}
|
||||
|
||||
compile-archives:
|
||||
name: Compile Archives
|
||||
runs-on: ubuntu-latest
|
||||
needs: [build-examples-arduino, build-examples-platformio]
|
||||
if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
|
||||
strategy:
|
||||
fail-fast: true
|
||||
matrix:
|
||||
include:
|
||||
# Adafruit Feather M0
|
||||
- board:
|
||||
arduino-platform: arduino:samd adafruit:samd
|
||||
fqbn: adafruit:samd:adafruit_feather_m0
|
||||
arch: cortex-m0plus
|
||||
example: EthernetHTTPS
|
||||
# Arduino Due
|
||||
- board:
|
||||
arduino-platform: arduino:sam
|
||||
fqbn: arduino:sam:arduino_due_x
|
||||
arch: cortex-m3
|
||||
example: EthernetHTTPS
|
||||
# ESP32
|
||||
- board:
|
||||
arduino-platform: esp32:esp32
|
||||
fqbn: esp32:esp32:d32
|
||||
arch: esp32
|
||||
example: EthernetHTTPS
|
||||
# STM32
|
||||
- board:
|
||||
arduino-platform: STM32:stm32
|
||||
fqbn: STM32:stm32:Nucleo_144:pnum=NUCLEO_F767ZI
|
||||
arch: cortex-m7
|
||||
example: stm32/EthernetHTTPSstm32
|
||||
steps:
|
||||
# Setup pyserial for esptool.py
|
||||
- name: Setup Python
|
||||
if: matrix.board.arduino-platform == 'esp32:esp32'
|
||||
uses: actions/setup-python@v2
|
||||
with:
|
||||
python-version: '3.x' # Version range or exact version of a Python version to use, using SemVer's version range syntax
|
||||
- name: Install Pyserial
|
||||
if: matrix.board.arduino-platform == 'esp32:esp32'
|
||||
run: |
|
||||
python -m pip install --upgrade pip
|
||||
pip install pyserial
|
||||
|
||||
# Setup Arduino-CLI
|
||||
- name: Install Arduino CLI
|
||||
uses: arduino/setup-arduino-cli@v1.1.1
|
||||
|
||||
# Install Dependencies
|
||||
- name: Install Core(s)
|
||||
run: arduino-cli core install ${{ matrix.board.arduino-platform }} -v
|
||||
- name: Install EthernetLarge
|
||||
run: git clone https://github.com/OPEnSLab-OSU/EthernetLarge.git ~/Arduino/libraries/EthernetLarge
|
||||
- name: Install Other Libraries
|
||||
run: arduino-cli lib install "STM32duino STM32Ethernet" PubSubClient -v
|
||||
|
||||
# Checkout
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
path: SSLClient
|
||||
|
||||
# Compile with dot-a-linkage
|
||||
- name: Compile with Archive
|
||||
run: |
|
||||
echo "dot_a_linkage=true" >> SSLClient/library.properties
|
||||
arduino-cli compile -v --build-path ${{ github.workspace }}/build --libraries . --warnings all --fqbn ${{ matrix.board.fqbn }} SSLClient/examples/${{ matrix.example }}
|
||||
|
||||
# Upload as an artifact
|
||||
- name: Emit Compiled SSLClient
|
||||
uses: actions/upload-artifact@v2
|
||||
with:
|
||||
name: ${{ matrix.board.arch }}
|
||||
path: build/libraries/SSLClient/SSLClient.a
|
||||
|
||||
generate-release:
|
||||
name: Generate Release
|
||||
runs-on: ubuntu-latest
|
||||
needs: compile-archives
|
||||
steps:
|
||||
# Checkout
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
# Build the release changelog
|
||||
- name: Build Changelog
|
||||
id: build_changelog
|
||||
uses: heineiuo/create-changelogs@master
|
||||
|
||||
# Create a release
|
||||
- name: Publish Release
|
||||
id: publish_release
|
||||
uses: actions/create-release@v1
|
||||
with:
|
||||
tag_name: ${{ github.ref }}
|
||||
release_name: ${{ github.ref }}
|
||||
body: ${{ steps.build_changelog.outputs.changelogs }}
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
# Create SSLClient-precompiled
|
||||
- name: Convert Library to Precompiled Format
|
||||
run: |
|
||||
echo "precompiled=true" >> library.properties
|
||||
rm -rf .git
|
||||
find src/ -iname "*.c" -delete
|
||||
find src/ -iname "*.cpp" -delete
|
||||
|
||||
# Download all the artifacts
|
||||
- name: Add Precompiled Artifacts
|
||||
uses: actions/download-artifact@v2
|
||||
with:
|
||||
path: src
|
||||
|
||||
# Zip the result
|
||||
- name: Generate SSLClient-precompiled
|
||||
run: zip -r SSLClient-precompiled.zip .
|
||||
|
||||
# Upload SSLClient-precompiled.zip to the release created
|
||||
- name: Upload SSLClient-precompiled
|
||||
uses: actions/upload-release-asset@v1
|
||||
with:
|
||||
upload_url: ${{ steps.publish_release.outputs.upload_url }} # This pulls from the CREATE RELEASE step above, referencing it's ID to get its outputs object, which include a `upload_url`. See this blog post for more info: https://jasonet.co/posts/new-features-of-github-actions/#passing-data-to-future-steps
|
||||
asset_path: ./SSLClient-precompiled.zip
|
||||
asset_name: SSLClient-precompiled.zip
|
||||
asset_content_type: application/zip
|
||||
env:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
26
.github/workflows/docs.yml
vendored
Normal file
26
.github/workflows/docs.yml
vendored
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
name: Documentation
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- master
|
||||
|
||||
jobs:
|
||||
documentation:
|
||||
name: Documentation
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: Build Documentation
|
||||
uses: mattnotmitt/doxygen-action@v1
|
||||
|
||||
- name: Deploy to GitHub Pages
|
||||
uses: JamesIves/github-pages-deploy-action@3.7.1
|
||||
with:
|
||||
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
|
||||
BRANCH: gh-pages # The branch the action should deploy to.
|
||||
FOLDER: docs # The folder the action should deploy.
|
||||
CLEAN: true # Automatically remove deleted files from the deploy branch
|
||||
112
.travis.yml
112
.travis.yml
|
|
@ -1,112 +0,0 @@
|
|||
language: c
|
||||
env:
|
||||
global:
|
||||
# You can uncomment this to explicitly choose an (old) version of the Arduino IDE
|
||||
#- ARDUINO_IDE_VERSION="1.8.7"
|
||||
- ADDITIONAL_URLS="https://adafruit.github.io/arduino-board-index/package_adafruit_index.json,https://raw.githubusercontent.com/espressif/arduino-esp32/gh-pages/package_esp32_index.json,https://github.com/stm32duino/BoardManagerFiles/raw/master/STM32/package_stm_index.json"
|
||||
- DOXYFILE=$TRAVIS_BUILD_DIR/.travis/Doxyfile
|
||||
|
||||
cache:
|
||||
directories:
|
||||
- ~/arduino_ide
|
||||
- ~/.arduino15/packages/
|
||||
|
||||
# Blacklist
|
||||
branches:
|
||||
except:
|
||||
- gh-pages
|
||||
|
||||
# Install dependencies
|
||||
addons:
|
||||
apt:
|
||||
packages:
|
||||
- doxygen
|
||||
|
||||
jobs:
|
||||
include:
|
||||
- stage: "Build"
|
||||
name: "Feather M0"
|
||||
env: CORE="adafruit:samd" BOARD="adafruit:samd:adafruit_feather_m0"
|
||||
- name: "Arduino Zero"
|
||||
env: CORE="arduino:samd" BOARD="arduino:samd:mzero_bl"
|
||||
- name: "Arduino Due"
|
||||
env: CORE="arduino:sam" BOARD="arduino:sam:arduino_due_x"
|
||||
- name: "ESP32"
|
||||
env: CORE="esp32:esp32" BOARD="esp32:esp32:d32"
|
||||
- name: "STM32"
|
||||
env: CORE="STM32:stm32" BOARD="STM32:stm32:Nucleo_144:pnum=NUCLEO_F767ZI"
|
||||
script:
|
||||
- arduino-cli compile --warnings all --fqbn $BOARD $PWD/examples/stm32/EthernetHTTPSstm32
|
||||
|
||||
- stage: "Documentation"
|
||||
if: branch = master
|
||||
install: skip
|
||||
script:
|
||||
- doxygen $DOXYFILE
|
||||
deploy:
|
||||
provider: pages
|
||||
skip_cleanup: true
|
||||
local_dir: docs
|
||||
github_token: $GITHUB_TOKEN
|
||||
|
||||
- stage: "Deploy"
|
||||
if: tag is present
|
||||
env: CORE="arduino:samd arduino:sam esp32:esp32 STM32:stm32"
|
||||
script: skip
|
||||
before_deploy:
|
||||
- mkdir tmp-bin
|
||||
- cp library.properties library.properties.old
|
||||
- echo "dot_a_linkage=true" >> library.properties
|
||||
- rm -rf /tmp/arduino-sketch*
|
||||
# cortex-m0plus
|
||||
- arduino-cli compile --fqbn arduino:samd:mzero_bl $PWD/examples/EthernetHTTPS
|
||||
- mkdir tmp-bin/cortex-m0plus
|
||||
- cp "$(find /tmp/ -maxdepth 1 -type d -name "arduino-sketch*" -print | head -n 1)/libraries/SSLClient/SSLClient.a" tmp-bin/cortex-m0plus/SSLClient.a
|
||||
- rm -rf /tmp/arduino-sketch*
|
||||
# cortex-m3
|
||||
- arduino-cli compile --fqbn arduino:sam:arduino_due_x $PWD/examples/EthernetHTTPS
|
||||
- mkdir tmp-bin/cortex-m3
|
||||
- cp "$(find /tmp/ -maxdepth 1 -type d -name "arduino-sketch*" -print | head -n 1)/libraries/SSLClient/SSLClient.a" tmp-bin/cortex-m3/SSLClient.a
|
||||
- rm -rf /tmp/arduino-sketch*
|
||||
# cortex-m7
|
||||
- arduino-cli compile --fqbn STM32:stm32:Nucleo_144:pnum=NUCLEO_F767ZI $PWD/examples/stm32/EthernetHTTPSstm32
|
||||
- mkdir tmp-bin/cortex-m7
|
||||
- cp "$(find /tmp/ -maxdepth 1 -type d -name "arduino-sketch*" -print | head -n 1)/libraries/SSLClient/SSLClient.a" tmp-bin/cortex-m7/SSLClient.a
|
||||
- rm -rf /tmp/arduino-sketch*
|
||||
# esp32
|
||||
- arduino-cli compile --fqbn esp32:esp32:d32 $PWD/examples/EthernetHTTPS
|
||||
- mkdir tmp-bin/esp32
|
||||
- cp "$(find /tmp/ -maxdepth 1 -type d -name "arduino-sketch*" -print | head -n 1)/libraries/SSLClient/SSLClient.a" tmp-bin/esp32/SSLClient.a
|
||||
# bundle it up!
|
||||
- mv library.properties.old library.properties
|
||||
- echo "precompiled=true" >> library.properties
|
||||
- mv tmp-bin/* src/
|
||||
- rm -rf tmp-bin
|
||||
- rm -rf .git
|
||||
- find src/ -iname "*.c" -delete
|
||||
- find src/ -iname "*.cpp" -delete
|
||||
- zip -r SSLClient-precompiled.zip .
|
||||
deploy:
|
||||
provider: releases
|
||||
api_key: $GITHUB_TOKEN
|
||||
skip_cleanup: true
|
||||
file: "SSLClient-precompiled.zip"
|
||||
on:
|
||||
tags: true
|
||||
|
||||
install:
|
||||
- curl -fsSL https://raw.githubusercontent.com/arduino/arduino-cli/master/install.sh | BINDIR=/usr/bin sudo sh
|
||||
- arduino-cli core update-index --additional-urls $ADDITIONAL_URLS
|
||||
- arduino-cli core install arduino:samd -v
|
||||
- arduino-cli core install $CORE -v --additional-urls $ADDITIONAL_URLS
|
||||
- mkdir -p $HOME/Arduino/libraries
|
||||
- rm -rf $HOME/Arduino/libraries/EthernetLarge
|
||||
- git clone https://github.com/OPEnSLab-OSU/EthernetLarge.git $HOME/Arduino/libraries/EthernetLarge
|
||||
- arduino-cli lib install "STM32duino STM32Ethernet"
|
||||
- arduino-cli lib install "PubSubClient"
|
||||
- ln -s $PWD $HOME/Arduino/libraries/.
|
||||
|
||||
script:
|
||||
- arduino-cli compile --warnings all --fqbn $BOARD $PWD/examples/EthernetHTTPS
|
||||
- arduino-cli compile --warnings all --fqbn $BOARD $PWD/examples/EthernetMultiHTTPS
|
||||
- arduino-cli compile --warnings all --fqbn $BOARD $PWD/examples/EthernetMQTT
|
||||
|
|
@ -38,7 +38,7 @@ PROJECT_NAME = SSLClient
|
|||
# could be handy for archiving the generated documentation or if some version
|
||||
# control system is used.
|
||||
|
||||
PROJECT_NUMBER = v1.6.9
|
||||
PROJECT_NUMBER = v1.6.11
|
||||
|
||||
# Using the PROJECT_BRIEF tag one can provide an optional one line description
|
||||
# for a project that appears at the top of each page and should give viewer a
|
||||
89
README.md
89
README.md
|
|
@ -1,18 +1,18 @@
|
|||
# SSLClient
|
||||
|
||||
[](https://travis-ci.org/OPEnSLab-OSU/SSLClient)
|
||||
|
||||
|
||||
SSLClient adds [TLS 1.2](https://www.websecurity.symantec.com/security-topics/what-is-ssl-tls-https) functionality to any network library implementing the [Arduino Client interface](https://www.arduino.cc/en/Reference/ClientConstructor), including the Arduino [EthernetClient](https://www.arduino.cc/en/Reference/EthernetClient) and [WiFiClient](https://www.arduino.cc/en/Reference/WiFiClient) classes. SSLClient was created to integrate TLS seamlessly with the Arduino infrastructure using [BearSSL](https://bearssl.org/) as an underlying TLS engine. Unlike [ArduinoBearSSL](https://github.com/arduino-libraries/ArduinoBearSSL), SSLClient is completly self-contained, and does not require any additional hardware (other than a network connection).
|
||||
|
||||
SSLClient officially supports SAMD21, SAM3X, ESP32, TIVA C, STM32F7, and Teensy >= 3.0; but it should work on any board with at least 110kB flash and 7kB RAM. SSClient does not currently support ESP8266 (see [this issue](https://github.com/OPEnSLab-OSU/SSLClient/issues/5#issuecomment-569968546)) or AVR due to memory constraints on both platforms.
|
||||
|
||||
You can also view this README in [doxygen](https://openslab-osu.github.io/SSLClient/index.html).
|
||||
|
||||
SSLClient adds [TLS 1.2](https://www.websecurity.symantec.com/security-topics/what-is-ssl-tls-https) functionality to any network library implementing the [Arduino Client interface](https://www.arduino.cc/en/Reference/ClientConstructor), including the Arduino [EthernetClient](https://www.arduino.cc/en/Reference/EthernetClient) and [WiFiClient](https://www.arduino.cc/en/Reference/WiFiClient) classes. Unlike [ArduinoBearSSL](https://github.com/arduino-libraries/ArduinoBearSSL), SSLClient is completly self-contained, and does not require any additional hardware (other than a network connection).
|
||||
|
||||
SSLClient officially supports SAMD21, SAM3X, ESP32, TIVA C, STM32, and Teensy 4.x; but it should work on any board with at least 110kb flash and 7kb RAM. SSClient does not currently support ESP8266 (see [this issue](https://github.com/OPEnSLab-OSU/SSLClient/issues/5#issuecomment-569968546)) or AVR due to memory constraints on both platforms.
|
||||
|
||||
## Overview
|
||||
|
||||
Using SSLClient is similar to using any other Arduino-based Client class, as this library was developed around compatibility with [EthernetClient](https://www.arduino.cc/en/Reference/EthernetClient). There are a few extra things, however, that you will need to get started:
|
||||
|
||||
1. **Board and Network Peripheral** - Your board should have a lot of resources (>110kb flash and >7kb RAM), and your network peripheral should have a large internal buffer (>7kb). This library was tested with the [Adafruit Feather M0](https://www.adafruit.com/product/2772) (256K flash, 32K RAM) and the [Adafruit Ethernet Featherwing](https://www.adafruit.com/product/3201) (16kb Buffer), and we still had to modify the Arduino Ethernet library to support larger internal buffers per socket (see the [Implementation Gotchas](#sslclient-with-ethernet)).
|
||||
1. **Board and Network Peripheral** - Your board should have a lot of resources (>110kB flash and >7kB RAM), and your network peripheral should have a large internal buffer (>7kB). This library was tested with the [Adafruit Feather M0](https://www.adafruit.com/product/2772) (256K flash, 32K RAM) and the [Adafruit Ethernet Featherwing](https://www.adafruit.com/product/3201) (16kB Buffer), and we still had to modify the Arduino Ethernet library to support larger internal buffers per socket (see the [Implementation Gotchas](#sslclient-with-ethernet)).
|
||||
2. **Trust Anchors** - You will need a header containing array of trust anchors ([example](./readme/cert.h)), which are used to verify the SSL connection later on. **This file must generated for every project.** Check out [TrustAnchors.md](./TrustAnchors.md#generating-trust-anchors) on how to generate this file for your project, and for more information about what a trust anchor is.
|
||||
3. **Network Peripheral Driver Implementing `Client`** - Examples include `EthernetClient`, `WiFiClient`, and so on—SSLClient will run on top of any network driver exposing the `Client` interface.
|
||||
4. **Analog Pin** - Used for generating random data at the start of the connection (see the [Implementation Gotchas](#implementation-gotchas)).
|
||||
|
|
@ -49,14 +49,10 @@ client.flush();
|
|||
// read and print the data
|
||||
...
|
||||
```
|
||||
**Note**: `client.connect("www.arduino.cc", 443)` can take 5-15 seconds to finish. This an unavoidable consequence of the SSL protocol, and is detailed in [Implementation Notes](#resources).
|
||||
**Note**: `client.connect("www.arduino.cc", 443)` can take 5-15 seconds to finish on some low-power devices. This an unavoidable consequence of the SSL protocol, and is detailed more in [Implementation Gotchas](#resources).
|
||||
|
||||
For more information on SSLClient, check out the [examples](./examples), [API documentation](https://openslab-osu.github.io/SSLClient/html/index.html), or the rest of this README.
|
||||
|
||||
## How It Works
|
||||
|
||||
SSLClient was created to integrate SSL seamlessly with the Arduino infrastructure, and so it does just that: implementing the brilliant [BearSSL](https://bearssl.org/) as a proxy in front of any Arduino socket library. BearSSL is designed with low flash footprint in mind, and as a result does little verification of improper programming, relying on the developer to ensure the code is correct. Since SSLClient is built specifically for the Arduino ecosystem, most of SSLClient's code adds those programming checks back in, making debugging a fast and simple process.
|
||||
|
||||
## Other Features
|
||||
|
||||
### Logging
|
||||
|
|
@ -68,7 +64,7 @@ SSLClient client(baseClient, TAs, (size_t)2, A7, 1, SSLClient::SSL_INFO);
|
|||
Logging is always outputted through the [Arduino Serial interface](https://www.arduino.cc/reference/en/language/functions/communication/serial/), so you'll need to setup Serial before you can view the SSL logs. Log levels are enumerated in ::DebugLevel. The log level is set to `SSL_WARN` by default.
|
||||
|
||||
### Errors
|
||||
When SSLClient encounters an error, it will attempt to terminate the SSL session gracefully if possible, and then close the socket. Simple error information can be found from SSLClient::getWriteError(), which will return a value from the ::Error enum. For more detailed diagnostics, you can look at the serial logs, which will be displayed if the log level is at `SSL_ERROR` or lower.
|
||||
When SSLClient encounters an error, it will attempt to terminate the SSL session gracefully if possible, and then close the socket. Simple error information can be found from SSLClient::getWriteError, which will return a value from the ::Error enum. For more detailed diagnostics, you can look at the serial logs, which will be displayed if the log level is at `SSL_ERROR` or lower.
|
||||
|
||||
### Write Buffering
|
||||
As you may have noticed in the documentation for SSLClient::write, calling this function does not actually write to the network. Instead, you must call SSLClient::available or SSLClient::flush, which will detect that the buffer is ready and write to the network (see SSLClient::write for details).
|
||||
|
|
@ -88,7 +84,7 @@ client.write("Connection: close\r\n");
|
|||
while (!client.available()) { /* ... */ }
|
||||
// ...
|
||||
```
|
||||
Notice that every single write() call immediately writes to the network, which is fine with most network clients. With SSL, however, if we are encrypting and writing to the network every write() call, this will result in a lot of small encryption tasks. Encryption takes a lot of time and code, so to reduce the overhead of an SSL connection, SSLClient::write implicitly buffers until the developer states that they are waiting for data to be received with SSLClient::available. A simple example can be found below:
|
||||
Notice that every single `client.write()` call immediately writes to the network. This behavior is fine for most network clients; with SSL, however, it results in many small encryption tasks that consume resources. To reduce the overhead of an SSL connection, SSLClient::write implicitly buffers until the developer states that they are waiting for data to be received with SSLClient::available. A simple example can be found below:
|
||||
|
||||
```C++
|
||||
EthernetClient baseClient;
|
||||
|
|
@ -109,18 +105,18 @@ while (!client.available()) { /* ... */ }
|
|||
If you would like to trigger a network write manually without using the SSLClient::available, you can also call SSLClient::flush, which will write all data and return when finished.
|
||||
|
||||
### Session Caching
|
||||
As detailed in the [resources section](#resources), SSL handshakes take an extended period (1-4sec) to negotiate. To remedy this problem, BearSSL is able to keep a [SSL session cache](https://bearssl.org/api1.html#session-cache) of the clients it has connected to. If BearSSL successfully resumes an SSL session, it can reduce connection time to 100-500ms.
|
||||
As detailed in the [resources section](#resources), SSL handshakes take an extended period (1-4sec) to negotiate. BearSSL is able to keep a [SSL session cache](https://bearssl.org/api1.html#session-cache) of the clients it has connected to which can drastically reduce this time: if BearSSL successfully resumes an SSL session, connection time is typically 100-500ms.
|
||||
|
||||
In order to use SSL session resumption:
|
||||
* The website you are connecting to must support it. Support is widespread, but you can verify easily using the [SSLLabs tool](https://www.ssllabs.com/ssltest/).
|
||||
* The website you are connecting to must support it. Support is widespread, and you can verify it using [SSLLabs](https://www.ssllabs.com/ssltest/).
|
||||
* You must reuse the same SSLClient object (SSL Sessions are stored in the object itself).
|
||||
* You must reconnect to the exact same server.
|
||||
* You must reconnect to the exact same server (detailed below).
|
||||
|
||||
SSLClient automatically stores an IP address and hostname in each session, ensuring that if you call `connect("www.google.com")` SSLClient will use the SSL session with that hostname. However, because some websites have multiple servers on a single IP address (github.com being an example), you may find that even if you are connecting to the same host the connection does not resume. This is a flaw in the SSL session protocol — though it has been resolved in TLS 1.3, the lack of widespread adoption of the new protocol prevents it from being used here. SSL sessions can also expire based on server criteria, which will result in a standard 4-10 second connection.
|
||||
> NOTE: SSLClient automatically stores an IP address and hostname in each session, ensuring that if you call `connect("www.google.com")` SSLClient will use the same SSL session for that hostname. Unfortunately some websites have multiple servers on a single IP address (github.com being an example), so you may find that even if you are connecting to the same host the connection will not resume. This is a flaw in the SSL session protocol—though it has been resolved in TLS 1.3, the lack of widespread adoption of the new protocol prevents it from being resolved here.
|
||||
>
|
||||
> SSL sessions can also expire based on server criteria (ex. timeout), which will result in a standard 4-10 second connection.
|
||||
|
||||
You can test whether or not a website can resume SSL Sessions using the [Session Example](./examples/Session_Example/Session_Example.ino) included with this library. Because of all the confounding factors of SSL Sessions, it is generally prudent while programming to assume the session will always fail to resume.
|
||||
|
||||
SSL sessions take a lot of memory to store, so by default SSLClient will only store one at a time. You can change this behavior by adding the following to your SSLClient declaration:
|
||||
SSL sessions take memory to store, so by default SSLClient will only store one at a time. You can change this behavior by adding the following to your SSLClient declaration:
|
||||
```C++
|
||||
EthernetClient baseClient;
|
||||
SSLClient client(baseClient, TAs, (size_t)2, A7, SomeNumber);
|
||||
|
|
@ -136,7 +132,7 @@ If you need to clear a session, you can do so using the SSLSession::removeSessio
|
|||
|
||||
### mTLS
|
||||
|
||||
As of `v1.6.0`, SSLClient supports [mutual TLS authentication](https://developers.cloudflare.com/access/service-auth/mtls/). mTLS is a varient of TLS that verifys both the server and device identities before a connection, and is commonly used in IoT protocols as a secure layer (MQTT over TLS, HTTPS over TLS, etc.).
|
||||
As of `v1.6.0`, SSLClient supports [mutual TLS authentication](https://developers.cloudflare.com/access/service-auth/mtls/). mTLS is a varient of TLS that verifies both the server and device identities before a connection, and is commonly used in IoT protocols as a secure layer (MQTT over TLS, HTTP over TLS, etc.).
|
||||
|
||||
To use mTLS with SSLClient you will need to a client certificate and client private key associated with the server you are attempting to connect to. Depending on your use case, you will either generate these yourself (ex. [Mosquito MQTT setup](http://www.steves-internet-guide.com/creating-and-using-client-certificates-with-mqtt-and-mosquitto/)), or have them generated for you (ex. [AWS IoT Certificate Generation](https://docs.aws.amazon.com/iot/latest/developerguide/create-device-certificate.html)). Given this cryptographic information, you can modify the standard SSLClient connection sketch to enable mTLS authentication:
|
||||
```C++
|
||||
|
|
@ -173,6 +169,9 @@ void setup() {
|
|||
}
|
||||
...
|
||||
```
|
||||
|
||||
> NOTE: Certificates are finicky, and it is easy to make mistakes when generating a certificate chain yourself. If SSLClient raises an error that says `Expected server name not found in chain`, double check that the common name, distinguished name, and issuer name are being set correctly (check out [this article](https://medium.com/@superseb/get-your-certificate-chain-right-4b117a9c0fce) for how to do that).
|
||||
|
||||
The client certificate must be formatted correctly (according to [BearSSL's specification](https://bearssl.org/apidoc/bearssl__pem_8h.html)) in order for mTLS to work. If the certificate is improperly formatted, SSLClient will attempt to make a regular TLS connection instead of an mTLS one, and fail to connect as a result. Because of this, if you are seeing errors similar to `"peer did not send certificate chain"` on your server, check that your certificate and key are formatted correctly (see https://github.com/OPEnSLab-OSU/SSLClient/issues/7#issuecomment-593704969). For more information on SSLClient's mTLS functionality, please see the [SSLClientParameters documentation](https://openslab-osu.github.io/SSLClient/class_s_s_l_client_parameters.html).
|
||||
|
||||
Note that both the above client certificate information *as well as* the correct trust anchors associated with the server are needed for the connection to succeed. Trust anchors will typically be generated from the CA used to generate the server certificate. More information on generating trust anchors can be found in [TrustAnchors.md](./TrustAnchors.md).
|
||||
|
|
@ -182,7 +181,7 @@ Note that both the above client certificate information *as well as* the correct
|
|||
Some ideas that didn't quite fit in the API documentation.
|
||||
|
||||
### SSLClient with Ethernet
|
||||
If you are using the [Arduino Ethernet library](https://github.com/arduino-libraries/Ethernet), you will need to modify the library to support the large buffer sizes required by SSL (detailed in [resources](#resources)). You can either modify the library yourself, or use [this fork of the Ethernet library with the modification](https://github.com/OPEnSLab-OSU/EthernetLarge). To use the fork, simply install the library using the "add a .zip library" button in Arduino, and replace `#include "Ethernet.h"` with `#include "EthernetLarge.h"` in your sketch. Alternatively if for some reason this solution does not work, you can apply the modification using the instructions below.
|
||||
If you are using the [Arduino Ethernet library](https://github.com/arduino-libraries/Ethernet) you will need to modify the library to support the large buffer sizes required by SSL (detailed in [resources](#resources)). You can either modify the library yourself, or use [this fork of the Ethernet library with the modification](https://github.com/OPEnSLab-OSU/EthernetLarge). To use the fork: download a zipped copy of the fork through GiThub, use the "add a .zip library" button in Arduino to install the library, and replace `#include "Ethernet.h"` with `#include "EthernetLarge.h"` in your sketch. Alternatively if for some reason this solution does not work, you can apply the modification manually using the instructions below.
|
||||
|
||||
#### Manual Modification
|
||||
|
||||
|
|
@ -236,24 +235,39 @@ SSLClient uses BearSSL's [minimal x509 verification engine](https://bearssl.org/
|
|||
|
||||
BearSSL also features a [known certificate validation engine](https://bearssl.org/x509.html#the-known-key-engine), which only allows for a single domain in exchange for a significantly reduced resource usage (flash and CPU time). This functionality is planned to be implemented in the future.
|
||||
|
||||
#### Time
|
||||
The minimal x509 verification engine requires an accurate source of time to properly verify the creation and expiration dates of a certificate. As most embedded devices do not have a reliable source of time, by default SSLClient opts to use the compilation timestamp ([`__DATE__` and `__TIME__`](https://gcc.gnu.org/onlinedocs/cpp/Standard-Predefined-Macros.html)) as the "current time" during the verification process. While this approach reduces the complexity of using SSLClient, it is inherently insecure, and can cause errors if certificates are redeployed (see [#27](https://github.com/OPEnSLab-OSU/SSLClient/issues/27)): to accommodate these edge cases, SSLClient::setVerificationTime can be used to update the timestamp before connecting, resolving the above issues.
|
||||
|
||||
### Resources
|
||||
The SSL protocol recommends a device support many different encryption algorithms, as well as protocols for SSL itself. The complexity of both of those components results in many medium sized components forming an extremely large whole. Additionally, most embedded processors lack the sophisticated math hardware commonly found in a modern CPU, and as a result require more instructions to create the encryption algorithms SSL requires. This not only increases size but makes the algorithms slow and memory intensive.
|
||||
The SSL/TLS protocol recommends a device support many different encryption and handshake algorithms. The complexity of these components results in many medium-footprint algorithms forming an extremely large whole. Compilation size of the [EthernetHTTPS](examples/EthernetHTTPS/EthernetHTTPS.ino) example in SSLClient `v1.6.11` for various boards is shown below:
|
||||
|
||||
To illustrate this, I will run some tests on various domains below. I haven't yet, but I will.
|
||||
| Board | Size
|
||||
| :--- | :--- |
|
||||
| Arduino Zero | <pre>`RAM: [=== ] 33.7% (used 11052 bytes from 32768 bytes)`<br/>`Flash: [=== ] 34.7% (used 90988 bytes from 262144 bytes)`</pre> |
|
||||
| Arduino Due | <pre>`RAM: [= ] 11.7% (used 11548 bytes from 98304 bytes)`<br/>`Flash: [== ] 16.7% (used 87572 bytes from 524288 bytes)`</pre> |
|
||||
| Adafruit Feather M0 | <pre>`RAM: [==== ] 40.4% (used 13240 bytes from 32768 bytes)`<br/>`Flash: [==== ] 40.0% (used 104800 bytes from 262144 bytes)`</pre> |
|
||||
| ESP32 (Lolin32) | <pre>`RAM: [= ] 6.9% (used 22476 bytes from 327680 bytes)`<br/>`Flash: [== ] 24.0% (used 314956 bytes from 1310720 bytes)`</pre> |
|
||||
| Teensy 3.0 | <pre>`RAM: [======== ] 78.2% (used 12812 bytes from 16384 bytes)`<br/>`Flash: [======== ] 79.8% (used 104532 bytes from 131072 bytes)`</pre> |
|
||||
| Teensy 3.1 | <pre>`RAM: [== ] 19.9% (used 13020 bytes from 65536 bytes)`<br/>`Flash: [==== ] 40.6% (used 106332 bytes from 262144 bytes)`</pre> |
|
||||
| Teensy 3.5 | <pre>`RAM: [ ] 5.0% (used 12996 bytes from 262136 bytes)`<br/>`Flash: [== ] 20.1% (used 105476 bytes from 524288 bytes)`</pre>
|
||||
| Teensy 3.6 | <pre>`RAM: [ ] 5.0% (used 13060 bytes from 262144 bytes)`<br/>`Flash: [= ] 10.2% (used 106828 bytes from 1048576 bytes)`</pre> |
|
||||
| Teensy 4.0 | <pre>`RAM: [=== ] 25.9% (used 135860 bytes from 524288 bytes)`<br/>`Flash: [= ] 5.7% (used 115344 bytes from 2031616 bytes)`</pre> |
|
||||
|
||||
If flash footprint is becoming a problem, there are numerous debugging strings (~3kb estimated) that can be removed from `SSLClient.h`, `SSLClientImpl.h`, and `SSLClientImpl.cpp`. I have not figured out a way to configure compilation of these strings, so you will need to modify the library to remove them yourself.
|
||||
In addition to the above, most embedded processors lack the sophisticated math hardware commonly found in a modern CPU, which results in slow and memory intensive execution of these algorithms. Because of this, it is recommended that SSLClient have 8kb of memory available on the stack during a connection, and 4-10 seconds should be allowed for the connection to complete. Note that this requirement is based on the SAMD21—more powerful processors (such as the ESP32) will see faster connection times.
|
||||
|
||||
> NOTE: If flash footprint is becoming a problem, there are numerous debugging strings (~3kB estimated) that can be removed from `SSLClient.h`, `SSLClientImpl.h`, and `SSLClientImpl.cpp`. Unfortunately I have not figured out a way to configure compilation of these strings, so you will need to modify the library to remove them yourself.
|
||||
|
||||
### Read Buffer Overflow
|
||||
SSL is a buffered protocol, and since most microcontrollers have limited resources (see [Resources](#resources)), SSLClient is limited in the size of its buffers. A common problem I encountered with SSL connections is buffer overflow, caused by the server sending too much data at once. This problem is caused by the microcontroller being unable to copy and decrypt data faster than it is being received, forcing some data to be discarded. This usually puts BearSSL in an unrecoverable state, forcing SSLClient to close the connection with a write error. If you are experiencing frequent timeout problems, this could be the reason why.
|
||||
SSL is a buffered protocol, and since most microcontrollers have limited resources (see [Resources](#resources)), SSLClient is limited in the size of its buffers. A common problem I encountered with SSL connections is buffer overflow caused by the server sending too much data at once. This problem is caused by the microcontroller being unable to copy and decrypt data faster than it is being received—forcing some data to be discarded. This usually puts BearSSL in an unrecoverable state, forcing SSLClient to close the connection with a write error. If you are experiencing frequent timeout problems this could be the reason why.
|
||||
|
||||
In order to remedy this problem, the device must be able to read the data faster than it is being received, or alternatively have a cache large enough to store the entire payload. Since SSL's encryption forces the device to read slowly, this means we must increase the cache size. Depending on your platform, there are a number of ways this can be done:
|
||||
* Sometimes your communication shield will have an internal buffer, which can be expanded through the driver code. This is the case with the Arduino Ethernet library (in the form of the MAX_SOCK_NUM and ETHERNET_LARGE_BUFFERS macros), however the library must be modified for the change to take effect.
|
||||
* SSLClient has an internal buffer SSLClientImpl::m_iobuf, which can be expanded. BearSSL limits the amount of data that can be processed based on the stage in the SSL handshake, and so this will change will have limited usefulness.
|
||||
* In some cases, a website will send so much data that even with the above solutions, SSLClient will be unable to keep up (a website with a lot of HTML is an example). In these cases you will have to find another method of retrieving the data you need.
|
||||
* If none of the above are viable, it is possible to implement your own Client class which has an internal buffer much larger than both the driver and BearSSL. This would require in-depth knowledge of programming and the communication shield you are working with, as well as a microcontroller with a significant amount of RAM.
|
||||
In order to remedy this problem, the device must be able to read the data faster than it is being received or have a cache large enough to store the entire payload. Since the device is typically already reading as fast as it can, we must increase the cache size in order to resolve this issue. Depending on your platform there are a number of ways this can be done:
|
||||
* Sometimes your communication shield will have an internal buffer which can be expanded through the driver code: this is the case with the Arduino Ethernet library (in the form of the `MAX_SOCK_NUM` and `ETHERNET_LARGE_BUFFERS` macros show [here](#manual-modification)), but mileage may vary with other drivers.
|
||||
* SSLClient has an internal buffer SSLClient::m_iobuf which can be expanded. Unfortunately, BearSSL limits the amount of data that can be put into the buffer based on the stage in the SSL handshake, and so increasing the buffer will have limited usefulness.
|
||||
* In some cases, a website will send so much data that even with the above solutions SSLClient will be unable to keep up. In these cases you will have to find another method of retrieving the data you need.
|
||||
* If none of the above are viable, it is possible to implement your own Client class which has an internal buffer much larger than both the driver and BearSSL. This implementation would require in-depth knowledge of communication shield you are working with and a microcontroller with a significant amount of RAM, but would be the most robust solution available.
|
||||
|
||||
### Cipher Support
|
||||
By default, SSLClient supports only TLS1.2 and the ciphers listed in [this file](./src/TLS12_only_profile.c) under `suites[]`, and the list is relatively small to keep the connection secure and the flash footprint down. These ciphers should work for most applications, however if for some reason you would like to use an older version of TLS or a different cipher, you can change the BearSSL profile being used by SSLClient to an [alternate one with support for older protocols](./src/bearssl/src/ssl/ssl_client_full.c). To do this, edit `SSLClientImpl::SSLClientImpl` to change these lines:
|
||||
By default, SSLClient supports only TLS1.2 and the ciphers listed in [this file](./src/TLS12_only_profile.c) under `suites[]`, and the list is relatively small to keep the connection secure and the flash footprint down. These ciphers should work for most applications, however if for some reason you would like to use an older version of TLS or a different cipher you can change the BearSSL profile being used by SSLClient to an [alternate one with support for older protocols](./src/bearssl/src/ssl/ssl_client_full.c). To do this, edit `SSLClientImpl::SSLClientImpl` to change these lines:
|
||||
```C++
|
||||
br_client_init_TLS12_only(&m_sslctx, &m_x509ctx, m_trust_anchors, m_trust_anchors_num);
|
||||
// comment the above line and uncomment the line below if you're having trouble connecting over SSL
|
||||
|
|
@ -267,9 +281,12 @@ br_ssl_client_init_full(&m_sslctx, &m_x509ctx, m_trust_anchors, m_trust_anchors_
|
|||
```
|
||||
If for some unfortunate reason you need SSL 3.0 or SSL 2.0, you will need to modify the BearSSL profile to enable support. Check out the [BearSSL profiles documentation](https://bearssl.org/api1.html#profiles) and I wish you the best of luck.
|
||||
|
||||
### Security
|
||||
Unlike BearSSL, SSLClient is not rigorously vetted to be secure. If your project has security requirements I recommend you utilize BearSSL directly.
|
||||
|
||||
### Known Issues
|
||||
* In some drivers (Ethernet), calls to `Client::flush` will hang if internet is available but there is no route to the destination. Unfortunately SSLClient cannot correct for this without modifying the driver itself, and as a result the recommended solution is ensuring you choose a driver with built-in timeouts to prevent freezing. [More information here](https://github.com/OPEnSLab-OSU/SSLClient/issues/13#issuecomment-643855923).
|
||||
* When using PubSubClient on the ESP32, a stack overflow will occur if the user does not flush the buffer immediately after writing. The cause of this issue is under active investigation. More information in issue https://github.com/OPEnSLab-OSU/SSLClient/issues/9.
|
||||
* Previous to SSLClient v1.6.7, calls to `SSLClient::stop` would sometimes hang the device. More information in issue https://github.com/OPEnSLab-OSU/SSLClient/issues/13.
|
||||
* Previous to SSLClient v1.6.6, calls to `SSLClient::connect` would fail if the driver indicated that a socket was already opened (`Client::connected` returned true). This behavior created unintentional permanent failures when `Client::stop` would fail to close the socket, and as a result was downgraded to a warning in v1.6.6.
|
||||
* Previous to SSLClient v1.6.3, calling `SSLClient::write` with more than 2Kb of total data before flushing the write buffer would cause a buffer overflow.
|
||||
* Previous to SSLClient `v1.6.11`, `SSLClient::write` would sometimes call `br_ssl_engine_sendapp_ack` with zero bytes, which resulted in a variety of issues including (but not limited to) and infinite recursion loop on the esp32 ([#9](https://github.com/OPEnSLab-OSU/SSLClient/issues/9), [#30](https://github.com/OPEnSLab-OSU/SSLClient/issues/30)).
|
||||
* Previous to SSLClient `v1.6.7`, calls to `SSLClient::stop` would sometimes hang the device. More information in issue https://github.com/OPEnSLab-OSU/SSLClient/issues/13.
|
||||
* Previous to SSLClient `v1.6.6`, calls to `SSLClient::connect` would fail if the driver indicated that a socket was already opened (`Client::connected` returned true). This behavior created unintentional permanent failures when `Client::stop` would fail to close the socket, and as a result was downgraded to a warning in v1.6.6.
|
||||
* Previous to SSLClient `v1.6.3`, calling `SSLClient::write` with more than 2kB of total data before flushing the write buffer would cause a buffer overflow.
|
||||
74
examples/EthernetAWSIoT/AWS_Root_CA.h
Normal file
74
examples/EthernetAWSIoT/AWS_Root_CA.h
Normal file
|
|
@ -0,0 +1,74 @@
|
|||
#ifndef _CERTIFICATES_H_
|
||||
#define _CERTIFICATES_H_
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C"
|
||||
{
|
||||
#endif
|
||||
|
||||
/* This file is auto-generated by the pycert_bearssl tool. Do not change it manually.
|
||||
* Certificates are BearSSL br_x509_trust_anchor format. Included certs:
|
||||
*
|
||||
* Index: 0
|
||||
* Label: Amazon Root CA 1
|
||||
* Subject: CN=Amazon Root CA 1,O=Amazon,C=US
|
||||
*/
|
||||
|
||||
#define TAs_NUM 1
|
||||
|
||||
static const unsigned char TA_DN0[] = {
|
||||
0x30, 0x39, 0x31, 0x0b, 0x30, 0x09, 0x06, 0x03, 0x55, 0x04, 0x06, 0x13,
|
||||
0x02, 0x55, 0x53, 0x31, 0x0f, 0x30, 0x0d, 0x06, 0x03, 0x55, 0x04, 0x0a,
|
||||
0x13, 0x06, 0x41, 0x6d, 0x61, 0x7a, 0x6f, 0x6e, 0x31, 0x19, 0x30, 0x17,
|
||||
0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x10, 0x41, 0x6d, 0x61, 0x7a, 0x6f,
|
||||
0x6e, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x20, 0x31,
|
||||
};
|
||||
|
||||
static const unsigned char TA_RSA_N0[] = {
|
||||
0xb2, 0x78, 0x80, 0x71, 0xca, 0x78, 0xd5, 0xe3, 0x71, 0xaf, 0x47, 0x80,
|
||||
0x50, 0x74, 0x7d, 0x6e, 0xd8, 0xd7, 0x88, 0x76, 0xf4, 0x99, 0x68, 0xf7,
|
||||
0x58, 0x21, 0x60, 0xf9, 0x74, 0x84, 0x01, 0x2f, 0xac, 0x02, 0x2d, 0x86,
|
||||
0xd3, 0xa0, 0x43, 0x7a, 0x4e, 0xb2, 0xa4, 0xd0, 0x36, 0xba, 0x01, 0xbe,
|
||||
0x8d, 0xdb, 0x48, 0xc8, 0x07, 0x17, 0x36, 0x4c, 0xf4, 0xee, 0x88, 0x23,
|
||||
0xc7, 0x3e, 0xeb, 0x37, 0xf5, 0xb5, 0x19, 0xf8, 0x49, 0x68, 0xb0, 0xde,
|
||||
0xd7, 0xb9, 0x76, 0x38, 0x1d, 0x61, 0x9e, 0xa4, 0xfe, 0x82, 0x36, 0xa5,
|
||||
0xe5, 0x4a, 0x56, 0xe4, 0x45, 0xe1, 0xf9, 0xfd, 0xb4, 0x16, 0xfa, 0x74,
|
||||
0xda, 0x9c, 0x9b, 0x35, 0x39, 0x2f, 0xfa, 0xb0, 0x20, 0x50, 0x06, 0x6c,
|
||||
0x7a, 0xd0, 0x80, 0xb2, 0xa6, 0xf9, 0xaf, 0xec, 0x47, 0x19, 0x8f, 0x50,
|
||||
0x38, 0x07, 0xdc, 0xa2, 0x87, 0x39, 0x58, 0xf8, 0xba, 0xd5, 0xa9, 0xf9,
|
||||
0x48, 0x67, 0x30, 0x96, 0xee, 0x94, 0x78, 0x5e, 0x6f, 0x89, 0xa3, 0x51,
|
||||
0xc0, 0x30, 0x86, 0x66, 0xa1, 0x45, 0x66, 0xba, 0x54, 0xeb, 0xa3, 0xc3,
|
||||
0x91, 0xf9, 0x48, 0xdc, 0xff, 0xd1, 0xe8, 0x30, 0x2d, 0x7d, 0x2d, 0x74,
|
||||
0x70, 0x35, 0xd7, 0x88, 0x24, 0xf7, 0x9e, 0xc4, 0x59, 0x6e, 0xbb, 0x73,
|
||||
0x87, 0x17, 0xf2, 0x32, 0x46, 0x28, 0xb8, 0x43, 0xfa, 0xb7, 0x1d, 0xaa,
|
||||
0xca, 0xb4, 0xf2, 0x9f, 0x24, 0x0e, 0x2d, 0x4b, 0xf7, 0x71, 0x5c, 0x5e,
|
||||
0x69, 0xff, 0xea, 0x95, 0x02, 0xcb, 0x38, 0x8a, 0xae, 0x50, 0x38, 0x6f,
|
||||
0xdb, 0xfb, 0x2d, 0x62, 0x1b, 0xc5, 0xc7, 0x1e, 0x54, 0xe1, 0x77, 0xe0,
|
||||
0x67, 0xc8, 0x0f, 0x9c, 0x87, 0x23, 0xd6, 0x3f, 0x40, 0x20, 0x7f, 0x20,
|
||||
0x80, 0xc4, 0x80, 0x4c, 0x3e, 0x3b, 0x24, 0x26, 0x8e, 0x04, 0xae, 0x6c,
|
||||
0x9a, 0xc8, 0xaa, 0x0d,
|
||||
};
|
||||
|
||||
static const unsigned char TA_RSA_E0[] = {
|
||||
0x01, 0x00, 0x01,
|
||||
};
|
||||
|
||||
static const br_x509_trust_anchor TAs[] = {
|
||||
{
|
||||
{ (unsigned char *)TA_DN0, sizeof TA_DN0 },
|
||||
BR_X509_TA_CA,
|
||||
{
|
||||
BR_KEYTYPE_RSA,
|
||||
{ .rsa = {
|
||||
(unsigned char *)TA_RSA_N0, sizeof TA_RSA_N0,
|
||||
(unsigned char *)TA_RSA_E0, sizeof TA_RSA_E0,
|
||||
} }
|
||||
}
|
||||
},
|
||||
};
|
||||
|
||||
#ifdef __cplusplus
|
||||
} /* extern "C" */
|
||||
#endif
|
||||
|
||||
#endif /* ifndef _CERTIFICATES_H_ */
|
||||
167
examples/EthernetAWSIoT/EthernetAWSIoT.ino
Normal file
167
examples/EthernetAWSIoT/EthernetAWSIoT.ino
Normal file
|
|
@ -0,0 +1,167 @@
|
|||
/*
|
||||
Connect to AWS IOT using SSLClient and Wiz850io Ethernet Mdoule
|
||||
AWS_Root_CA.h is the trust anchor created using the Root CA from:
|
||||
https://www.amazontrust.com/repository/AmazonRootCA1.pem
|
||||
You can re-create it again using the python file present
|
||||
in SSLClient/tools/pycert_bearssl/pycert_bearssl.py
|
||||
python pycert_bearssl.py convert --no-search <certificate PEM file>
|
||||
refer: https://github.com/OPEnSLab-OSU/SSLClient/issues/17#issuecomment-700143405
|
||||
|
||||
Circuit:
|
||||
Ethernet shield WIZ850io:
|
||||
CS 10
|
||||
MOSI 11
|
||||
MISO 12
|
||||
SCK 13
|
||||
|
||||
created 10 October 2020
|
||||
by Ram Rohit Gannavarapu
|
||||
*/
|
||||
|
||||
#include <SPI.h>
|
||||
#include <EthernetLarge.h>
|
||||
#include <SSLClient.h>
|
||||
#include <PubSubClient.h>
|
||||
#include "AWS_Root_CA.h" // This file is created using AmazonRootCA1.pem from https://www.amazontrust.com/repository/AmazonRootCA1.pem
|
||||
|
||||
#define THING_NAME "<Thing_Name>"
|
||||
#define MQTT_PACKET_SIZE 1024
|
||||
|
||||
void MQTTPublish(const char *topic, char *payload);
|
||||
void updateThing();
|
||||
|
||||
const char my_cert[] = \
|
||||
"-----BEGIN CERTIFICATE-----\n" \
|
||||
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n" \
|
||||
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n" \
|
||||
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n" \
|
||||
"-----END CERTIFICATE-----\n";
|
||||
|
||||
const char my_key[] = \
|
||||
"-----BEGIN RSA PRIVATE KEY-----\n" \
|
||||
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n" \
|
||||
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n" \
|
||||
"xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\n" \
|
||||
"-----END RSA PRIVATE KEY-----\n";
|
||||
|
||||
SSLClientParameters mTLS = SSLClientParameters::fromPEM(my_cert, sizeof my_cert, my_key, sizeof my_key);
|
||||
|
||||
const char* mqttServer = "xxxxxxxxxxxx-ats.iot.us-east-1.amazonaws.com";
|
||||
const char publishShadowUpdate[] = "$aws/things/" THING_NAME "/shadow/update";
|
||||
char publishPayload[MQTT_PACKET_SIZE];
|
||||
char *subscribeTopic[5] =
|
||||
{
|
||||
"$aws/things/" THING_NAME "/shadow/update/accepted",
|
||||
"$aws/things/" THING_NAME "/shadow/update/rejected",
|
||||
"$aws/things/" THING_NAME "/shadow/update/delta",
|
||||
"$aws/things/" THING_NAME "/shadow/get/accepted",
|
||||
"$aws/things/" THING_NAME "/shadow/get/rejected"
|
||||
};
|
||||
|
||||
void callback(char* topic, byte* payload, unsigned int length)
|
||||
{
|
||||
Serial.print("Message arrived [");
|
||||
Serial.print(topic);
|
||||
Serial.print("] ");
|
||||
for (int i=0;i<length;i++)
|
||||
{
|
||||
Serial.print((char)payload[i]);
|
||||
}
|
||||
Serial.println();
|
||||
}
|
||||
|
||||
|
||||
EthernetClient ethClient;
|
||||
SSLClient ethClientSSL(ethClient, TAs, (size_t)TAs_NUM, A5);
|
||||
PubSubClient mqtt(mqttServer, 8883, callback, ethClientSSL);
|
||||
|
||||
// Enter a MAC address for your controller below.
|
||||
// Newer Ethernet shields have a MAC address printed on a sticker on the shield
|
||||
byte mac[] = {
|
||||
0x00, 0xAA, 0xBB, 0xCC, 0xDE, 0x02
|
||||
};
|
||||
|
||||
void reconnect()
|
||||
{
|
||||
while (!mqtt.connected())
|
||||
{
|
||||
Serial.print("Attempting MQTT connection...");
|
||||
if (mqtt.connect("arduinoClient"))
|
||||
{
|
||||
Serial.println("connected");
|
||||
for (int i = 0; i < 5; i++)
|
||||
{
|
||||
// Serial.println(subscribeTopic[i]);
|
||||
mqtt.subscribe(subscribeTopic[i]);
|
||||
}
|
||||
Serial.println("Started updateThing ");
|
||||
updateThing();
|
||||
Serial.println("Done updateThing ");
|
||||
|
||||
}
|
||||
else
|
||||
{
|
||||
Serial.print("failed, rc=");
|
||||
Serial.print(mqtt.state());
|
||||
Serial.println(" try again in 5 seconds");
|
||||
delay(5000);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void setup() {
|
||||
// You can use Ethernet.init(pin) to configure the CS pin
|
||||
Ethernet.init(10); // Most Arduino shields
|
||||
|
||||
// Open serial communications and wait for port to open:
|
||||
Serial.begin(9600);
|
||||
while (!Serial) {
|
||||
; // wait for serial port to connect. Needed for native USB port only
|
||||
}
|
||||
ethClientSSL.setMutualAuthParams(mTLS);
|
||||
mqtt.setBufferSize(MQTT_PACKET_SIZE);
|
||||
|
||||
// start the Ethernet connection:
|
||||
Serial.println("Initialize Ethernet with DHCP:");
|
||||
if (Ethernet.begin(mac) == 0) {
|
||||
Serial.println("Failed to configure Ethernet using DHCP");
|
||||
if (Ethernet.hardwareStatus() == EthernetNoHardware) {
|
||||
Serial.println("Ethernet shield was not found. Sorry, can't run without hardware. :(");
|
||||
} else if (Ethernet.linkStatus() == LinkOFF) {
|
||||
Serial.println("Ethernet cable is not connected.");
|
||||
}
|
||||
// no point in carrying on, so do nothing forevermore:
|
||||
while (true) {
|
||||
delay(1);
|
||||
}
|
||||
}
|
||||
// print your local IP address:
|
||||
Serial.print("My IP address: ");
|
||||
Serial.println(Ethernet.localIP());
|
||||
|
||||
}
|
||||
|
||||
void loop() {
|
||||
if (!mqtt.connected())
|
||||
{
|
||||
reconnect();
|
||||
}
|
||||
mqtt.loop();
|
||||
}
|
||||
|
||||
|
||||
void updateThing()
|
||||
{
|
||||
strcpy(publishPayload, "{\"state\": {\"reported\": {\"powerState\":\"ON\"}}}");
|
||||
MQTTPublish(publishShadowUpdate, publishPayload);
|
||||
|
||||
}
|
||||
|
||||
void MQTTPublish(const char *topic, char *payload)
|
||||
{
|
||||
mqtt.publish(topic, payload);
|
||||
Serial.print("Published [");
|
||||
Serial.print(topic);
|
||||
Serial.print("] ");
|
||||
Serial.println(payload);
|
||||
}
|
||||
|
|
@ -51,12 +51,8 @@ void reconnect() {
|
|||
Serial.println("connected");
|
||||
// Once connected, publish an announcement...
|
||||
client.publish("outTopic","hello world");
|
||||
// This is a workaround to address https://github.com/OPEnSLab-OSU/SSLClient/issues/9
|
||||
ethClientSSL.flush();
|
||||
// ... and resubscribe
|
||||
client.subscribe("inTopic");
|
||||
// This is a workaround to address https://github.com/OPEnSLab-OSU/SSLClient/issues/9
|
||||
ethClientSSL.flush();
|
||||
} else {
|
||||
Serial.print("failed, rc=");
|
||||
Serial.print(client.state());
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
name=SSLClient
|
||||
version=1.6.9
|
||||
version=1.6.11
|
||||
author=Noah Koontz <koontzn@oregonstate.edu>
|
||||
maintainer=OPEnS Lab
|
||||
sentence=Arduino library to add TLS functionality to any Client class
|
||||
|
|
|
|||
|
|
@ -96,10 +96,19 @@ size_t SSLClient::write(const uint8_t *buf, size_t size) {
|
|||
if (m_debug >= DebugLevel::SSL_DUMP) Serial.write(buf, size);
|
||||
// check if the socket is still open and such
|
||||
if (!m_soft_connected(func_name) || !buf || !size) return 0;
|
||||
// wait until bearssl is ready to send
|
||||
if (m_run_until(BR_SSL_SENDAPP) < 0) {
|
||||
m_error("Failed while waiting for the engine to enter BR_SSL_SENDAPP", func_name);
|
||||
return 0;
|
||||
}
|
||||
// add to the bearssl io buffer, simply appending whatever we want to write
|
||||
size_t alen;
|
||||
unsigned char *br_buf = br_ssl_engine_sendapp_buf(&m_sslctx.eng, &alen);
|
||||
size_t cur_idx = 0;
|
||||
if (alen == 0) {
|
||||
m_error("BearSSL returned zero length buffer for sending, did an internal error occur?", func_name);
|
||||
return 0;
|
||||
}
|
||||
// while there are still elements to write
|
||||
while (cur_idx < size) {
|
||||
// if we're about to fill the buffer, we need to send the data and then wait
|
||||
|
|
@ -296,6 +305,11 @@ void SSLClient::setMutualAuthParams(const SSLClientParameters& params) {
|
|||
}
|
||||
}
|
||||
|
||||
/* see SSLClient.h */
|
||||
void SSLClient::setVerificationTime(uint32_t days, uint32_t seconds) {
|
||||
br_x509_minimal_set_time(&m_x509ctx, days, seconds);
|
||||
}
|
||||
|
||||
bool SSLClient::m_soft_connected(const char* func_name) {
|
||||
// check if the socket is still open and such
|
||||
if (getWriteError()) {
|
||||
|
|
|
|||
|
|
@ -371,6 +371,19 @@ public:
|
|||
*/
|
||||
unsigned int getTimeout() const { return m_timeout; }
|
||||
|
||||
/**
|
||||
* @brief Change the time used during x509 verification to a different value.
|
||||
*
|
||||
* This function directly calls br_x509_minimal_set_time to change the validation
|
||||
* time used by the minimal verification engine. You can use this function if the default value
|
||||
* of the compile time is causing issues. See https://bearssl.org/apidoc/bearssl__x509_8h.html#a7f3558b1999ce904084d578700b1002c
|
||||
* for more information what this function does and how to use it.
|
||||
*
|
||||
* @param days Days are counted in a proleptic Gregorian calendar since January 1st, 0 AD.
|
||||
* @param seconds Seconds are counted since midnight, from 0 to 86400 (a count of 86400 is possible only if a leap second happened).
|
||||
*/
|
||||
void setVerificationTime(uint32_t days, uint32_t seconds);
|
||||
|
||||
private:
|
||||
/** @brief Returns an instance of m_client that is polymorphic and can be used by SSLClientImpl */
|
||||
Client& get_arduino_client() { return m_client; }
|
||||
|
|
|
|||
20
tools/pycert_bearssl/ca.crt
Normal file
20
tools/pycert_bearssl/ca.crt
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
-----BEGIN CERTIFICATE-----
|
||||
MIIDRTCCAi2gAwIBAgIUCn8+KWh0IuIhfze2cfetSV+clcIwDQYJKoZIhvcNAQEL
|
||||
BQAwMjELMAkGA1UEBhMCREUxEDAOBgNVBAgMB1NhY2hzZW4xETAPBgNVBAoMCFpl
|
||||
bnRyYWxlMB4XDTIwMDQyMDE4MTc0MloXDTI1MDQyMDE4MTc0MlowMjELMAkGA1UE
|
||||
BhMCREUxEDAOBgNVBAgMB1NhY2hzZW4xETAPBgNVBAoMCFplbnRyYWxlMIIBIjAN
|
||||
BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAumwRj1qO7pDmbeMG8F3i29v9aM2t
|
||||
wDWz4q9uR8RD2YbDza39yNdRd1p2rbITd7YEic74qWwcuNoLiqOOGdf37L2XGVE/
|
||||
UPv6lrLIrY7ttvKBv4x86WVHUlv3zYDmfdOBvk9hWH7rX6oXc6pg7QjFPhn5qeEV
|
||||
LaRKB92O2IqPyDO84eyB2fgh2/5gKA5SsL56i2iHCYnLIvctXiKHXOA2NTDjvkEA
|
||||
tTRacs4kIcyXd5NSg7upA1oGp4e8Dvv5MCcSxlFyb3qOdF1VbeAIiPPMIzOxkxzC
|
||||
dDgtMFnJviuycOQD0INfEa+vRlxL146TUO2xP8llzMSPgygA+zMBPJI3wwIDAQAB
|
||||
o1MwUTAdBgNVHQ4EFgQUCDqS169brBVfcbjpzo/DVWpyjEswHwYDVR0jBBgwFoAU
|
||||
CDqS169brBVfcbjpzo/DVWpyjEswDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0B
|
||||
AQsFAAOCAQEAqvcCisHUynfNjL6iqOb8ZMkrVb7Xy5deQUj0U0evYKVZc4/kkXKH
|
||||
aD5g5e5mU+9NlXO9yvoSy7tHDdy1AkFrnd/F2m+e1jBnXhLutbrKWcyusOS8uC8f
|
||||
f9f/Z0CckOh1VKU6BDhjX6t2Fn8RoGIkiEdo0QXMqlZwEQC1nTqaSpwF2pJD6J7n
|
||||
3x+QCmVcN6k6speAC9+hGckpSYSWEOmSd0vOz3JBLstkDmQmqDw2KqzgcPIVlKME
|
||||
lgojxziwdIWNBrjSo7fRi9rB5SnzbhQUFvgMB83MLuUbjTYDThXMmw7Wr1uefZKC
|
||||
0qLGE2thUbWmBv4l+1UshfU9VcLRe8zGLA==
|
||||
-----END CERTIFICATE-----
|
||||
|
|
@ -36,6 +36,8 @@ RSA_E_PRE = "TA_RSA_E"
|
|||
EC_CURVE_PRE = "TA_EC_CURVE"
|
||||
# EC curve type enum prefix
|
||||
EC_CURVE_NAME_PRE = "BR_EC_"
|
||||
# CA flag
|
||||
CA_FLAG = "BR_X509_TA_CA"
|
||||
|
||||
|
||||
# Template that defines the C header output format.
|
||||
|
|
@ -95,7 +97,7 @@ static const {ray_type} {ray_name}[] = {{
|
|||
CROOTCA_TEMPLATE = """\
|
||||
{{
|
||||
{{ (unsigned char *){ta_dn_name}, sizeof {ta_dn_name} }},
|
||||
BR_X509_TA_CA,
|
||||
{ca_flag},
|
||||
{{
|
||||
BR_KEYTYPE_RSA,
|
||||
{{ .rsa = {{
|
||||
|
|
@ -135,7 +137,8 @@ CROOTCA_EC_TEMPLATE = """\
|
|||
CCERT_DESC_TEMPLATE = """\
|
||||
* Index: {cert_num}
|
||||
* Label: {cert_label}
|
||||
* Subject: {cert_subject}"""
|
||||
* Subject: {cert_subject}
|
||||
* Type: {cert_type}"""
|
||||
|
||||
def PEM_split(cert_pem):
|
||||
"""Split a certificate / certificate chain in PEM format into multiple
|
||||
|
|
@ -228,12 +231,17 @@ def decribe_cert_object(cert, cert_num, domain=None):
|
|||
label = com[b'OU'].decode("utf-8")
|
||||
elif b'O' in com:
|
||||
label = com[b'O'].decode("utf-8")
|
||||
if cert.get_issuer() == cert.get_subject():
|
||||
cert_type = "Certificate Authority"
|
||||
else:
|
||||
cert_type = "End Entity"
|
||||
# return the formated string
|
||||
crypto = cert.to_cryptography()
|
||||
out_str = CCERT_DESC_TEMPLATE.format(
|
||||
cert_num=cert_num,
|
||||
cert_label=label,
|
||||
cert_subject=crypto.subject.rfc4514_string(),
|
||||
cert_type=cert_type
|
||||
)
|
||||
# if domain, then add domain entry
|
||||
if domain is not None:
|
||||
|
|
@ -279,6 +287,8 @@ def x509_to_header(x509Certs, cert_var, cert_length_var, output_file, keep_dupes
|
|||
cert_desc.append(decribe_cert_object(cert, cert_index))
|
||||
else:
|
||||
cert_desc.append(decribe_cert_object(cert, cert_index, domain=domains[i]))
|
||||
# detect if the cert is a CA
|
||||
is_ca = cert.get_issuer() == cert.get_subject()
|
||||
# build static arrays containing all the keys of the certificate
|
||||
# start with distinguished name
|
||||
# get the distinguished name in bytes
|
||||
|
|
@ -307,6 +317,7 @@ def x509_to_header(x509Certs, cert_var, cert_length_var, output_file, keep_dupes
|
|||
# format the root certificate entry
|
||||
CAs.append(CROOTCA_TEMPLATE.format(
|
||||
ta_dn_name=DN_PRE + str(cert_index),
|
||||
ca_flag=CA_FLAG if is_ca else "0",
|
||||
rsa_number_name=RSA_N_PRE + str(cert_index),
|
||||
rsa_exp_name=RSA_E_PRE + str(cert_index)))
|
||||
elif 'Elliptic' in numbers_typename:
|
||||
|
|
@ -322,6 +333,7 @@ def x509_to_header(x509Certs, cert_var, cert_length_var, output_file, keep_dupes
|
|||
# and then the exponent
|
||||
CAs.append(CROOTCA_EC_TEMPLATE.format(
|
||||
ta_dn_name=DN_PRE + str(cert_index),
|
||||
ca_flag=CA_FLAG if is_ca else "0",
|
||||
ec_number_name=EC_CURVE_PRE + str(cert_index),
|
||||
ec_curve_name=EC_CURVE_NAME_PRE + curve_name
|
||||
))
|
||||
|
|
@ -343,4 +355,6 @@ def x509_to_header(x509Certs, cert_var, cert_length_var, output_file, keep_dupes
|
|||
cert_length_var=cert_length_var,
|
||||
cert_length=str(len(CAs)),
|
||||
cert_data=cert_data_out,
|
||||
))
|
||||
))
|
||||
|
||||
return len(cert_ser)
|
||||
54
tools/pycert_bearssl/certificates.h
Normal file
54
tools/pycert_bearssl/certificates.h
Normal file
|
|
@ -0,0 +1,54 @@
|
|||
#ifndef _CERTIFICATES_H_
|
||||
#define _CERTIFICATES_H_
|
||||
|
||||
#ifdef __cplusplus
|
||||
extern "C"
|
||||
{
|
||||
#endif
|
||||
|
||||
/* This file is auto-generated by the pycert_bearssl tool. Do not change it manually.
|
||||
* Certificates are BearSSL br_x509_trust_anchor format. Included certs:
|
||||
*
|
||||
* Index: 0
|
||||
* Label: GlobalSign
|
||||
* Subject: OU=GlobalSign ECC Root CA - R4,O=GlobalSign,CN=GlobalSign
|
||||
*/
|
||||
|
||||
#define TAs_NUM 1
|
||||
|
||||
static const unsigned char TA_DN0[] = {
|
||||
0x30, 0x50, 0x31, 0x24, 0x30, 0x22, 0x06, 0x03, 0x55, 0x04, 0x0b, 0x13,
|
||||
0x1b, 0x47, 0x6c, 0x6f, 0x62, 0x61, 0x6c, 0x53, 0x69, 0x67, 0x6e, 0x20,
|
||||
0x45, 0x43, 0x43, 0x20, 0x52, 0x6f, 0x6f, 0x74, 0x20, 0x43, 0x41, 0x20,
|
||||
0x2d, 0x20, 0x52, 0x34, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04,
|
||||
0x0a, 0x13, 0x0a, 0x47, 0x6c, 0x6f, 0x62, 0x61, 0x6c, 0x53, 0x69, 0x67,
|
||||
0x6e, 0x31, 0x13, 0x30, 0x11, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x0a,
|
||||
0x47, 0x6c, 0x6f, 0x62, 0x61, 0x6c, 0x53, 0x69, 0x67, 0x6e,
|
||||
};
|
||||
|
||||
static const unsigned char TA_EC_CURVE0[] = {
|
||||
0x04, 0xb8, 0xc6, 0x79, 0xd3, 0x8f, 0x6c, 0x25, 0x0e, 0x9f, 0x2e, 0x39,
|
||||
0x19, 0x1c, 0x03, 0xa4, 0xae, 0x9a, 0xe5, 0x39, 0x07, 0x09, 0x16, 0xca,
|
||||
0x63, 0xb1, 0xb9, 0x86, 0xf8, 0x8a, 0x57, 0xc1, 0x57, 0xce, 0x42, 0xfa,
|
||||
0x73, 0xa1, 0xf7, 0x65, 0x42, 0xff, 0x1e, 0xc1, 0x00, 0xb2, 0x6e, 0x73,
|
||||
0x0e, 0xff, 0xc7, 0x21, 0xe5, 0x18, 0xa4, 0xaa, 0xd9, 0x71, 0x3f, 0xa8,
|
||||
0xd4, 0xb9, 0xce, 0x8c, 0x1d,
|
||||
};
|
||||
|
||||
static const br_x509_trust_anchor TAs[] = {
|
||||
{
|
||||
{ (unsigned char *)TA_DN0, sizeof TA_DN0 },
|
||||
BR_X509_TA_CA,
|
||||
{
|
||||
BR_KEYTYPE_EC,
|
||||
{ .ec = {BR_EC_secp256r1, (unsigned char *)TA_EC_CURVE0, sizeof TA_EC_CURVE0}
|
||||
}
|
||||
}
|
||||
},
|
||||
};
|
||||
|
||||
#ifdef __cplusplus
|
||||
} /* extern "C" */
|
||||
#endif
|
||||
|
||||
#endif /* ifndef _CERTIFICATES_H_ */
|
||||
|
|
@ -136,6 +136,10 @@ def convert(cert_var, cert_length_var, output, use_store, keep_dupes, no_search,
|
|||
else:
|
||||
click.echo('Loaded certificate {0}'.format(c.name))
|
||||
cert_objs.append(cert_parsed)
|
||||
|
||||
if no_search and cert_parsed.get_subject() != cert_parsed.get_issuer():
|
||||
click.echo(f'Warning: certificate {c.name} is an end entity certificate (not a CA). '
|
||||
'SSLClient may fail to validate if the server certificate changes.')
|
||||
# find a root certificate for each
|
||||
root_certs = []
|
||||
if no_search:
|
||||
|
|
@ -149,7 +153,8 @@ def convert(cert_var, cert_length_var, output, use_store, keep_dupes, no_search,
|
|||
root_certs.append(cert_dict[cn_hash])
|
||||
# Combine PEMs and write output header.
|
||||
try:
|
||||
cert_util.x509_to_header(root_certs, cert_var, cert_length_var, output, keep_dupes)
|
||||
written = cert_util.x509_to_header(root_certs, cert_var, cert_length_var, output, keep_dupes)
|
||||
click.echo(f'Wrote {written} trust anchors to {output.name}')
|
||||
except Exception as E:
|
||||
click.echo(f'Recieved error when converting certificate to header: {E}')
|
||||
exit(1)
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue