Skip to content

Commit 6a5b765

Browse files
kinafukinafu
committed
Add esp_crt_bundle from ESP-IDF
fetched from https://github.com/espressif/esp-idf/tree/release/v4.2/components/mbedtls/esp_crt_bundle
1 parent b92c58d commit 6a5b765

File tree

2 files changed

+290
-0
lines changed

2 files changed

+290
-0
lines changed

Diff for: ‎libraries/WiFiClientSecure/src/esp_crt_bundle.c

+223
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,223 @@
1+
// Copyright 2018-2019 Espressif Systems (Shanghai) PTE LTD
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
16+
#include <string.h>
17+
#include <esp_system.h>
18+
#include "esp_crt_bundle.h"
19+
#include "esp_log.h"
20+
#include "esp_err.h"
21+
22+
#define BUNDLE_HEADER_OFFSET 2
23+
#define CRT_HEADER_OFFSET 4
24+
25+
static const char *TAG = "esp-x509-crt-bundle";
26+
27+
/* a dummy certificate so that
28+
* cacert_ptr passes non-NULL check during handshake */
29+
static mbedtls_x509_crt s_dummy_crt;
30+
31+
32+
extern const uint8_t x509_crt_imported_bundle_bin_start[] asm("_binary_x509_crt_bundle_start");
33+
extern const uint8_t x509_crt_imported_bundle_bin_end[] asm("_binary_x509_crt_bundle_end");
34+
35+
36+
typedef struct crt_bundle_t {
37+
const uint8_t **crts;
38+
uint16_t num_certs;
39+
size_t x509_crt_bundle_len;
40+
} crt_bundle_t;
41+
42+
static crt_bundle_t s_crt_bundle;
43+
44+
static int esp_crt_verify_callback(void *buf, mbedtls_x509_crt *crt, int data, uint32_t *flags);
45+
static int esp_crt_check_signature(mbedtls_x509_crt *child, const uint8_t *pub_key_buf, size_t pub_key_len);
46+
47+
48+
static int esp_crt_check_signature(mbedtls_x509_crt *child, const uint8_t *pub_key_buf, size_t pub_key_len)
49+
{
50+
int ret = 0;
51+
mbedtls_x509_crt parent;
52+
const mbedtls_md_info_t *md_info;
53+
unsigned char hash[MBEDTLS_MD_MAX_SIZE];
54+
55+
mbedtls_x509_crt_init(&parent);
56+
57+
if ( (ret = mbedtls_pk_parse_public_key(&parent.pk, pub_key_buf, pub_key_len) ) != 0) {
58+
ESP_LOGE(TAG, "PK parse failed with error %X", ret);
59+
goto cleanup;
60+
}
61+
62+
63+
// Fast check to avoid expensive computations when not necessary
64+
if (!mbedtls_pk_can_do(&parent.pk, child->sig_pk)) {
65+
ESP_LOGE(TAG, "Simple compare failed");
66+
ret = -1;
67+
goto cleanup;
68+
}
69+
70+
md_info = mbedtls_md_info_from_type(child->sig_md);
71+
if ( (ret = mbedtls_md( md_info, child->tbs.p, child->tbs.len, hash )) != 0 ) {
72+
ESP_LOGE(TAG, "Internal mbedTLS error %X", ret);
73+
goto cleanup;
74+
}
75+
76+
if ( (ret = mbedtls_pk_verify_ext( child->sig_pk, child->sig_opts, &parent.pk,
77+
child->sig_md, hash, mbedtls_md_get_size( md_info ),
78+
child->sig.p, child->sig.len )) != 0 ) {
79+
80+
ESP_LOGE(TAG, "PK verify failed with error %X", ret);
81+
goto cleanup;
82+
}
83+
cleanup:
84+
mbedtls_x509_crt_free(&parent);
85+
86+
return ret;
87+
}
88+
89+
90+
/* This callback is called for every certificate in the chain. If the chain
91+
* is proper each intermediate certificate is validated through its parent
92+
* in the x509_crt_verify_chain() function. So this callback should
93+
* only verify the first untrusted link in the chain is signed by the
94+
* root certificate in the trusted bundle
95+
*/
96+
int esp_crt_verify_callback(void *buf, mbedtls_x509_crt *crt, int data, uint32_t *flags)
97+
{
98+
mbedtls_x509_crt *child = crt;
99+
100+
if (*flags != MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
101+
return 0;
102+
}
103+
104+
105+
if (s_crt_bundle.crts == NULL) {
106+
ESP_LOGE(TAG, "No certificates in bundle");
107+
return MBEDTLS_ERR_X509_FATAL_ERROR;
108+
}
109+
110+
ESP_LOGD(TAG, "%d certificates in bundle", s_crt_bundle.num_certs);
111+
112+
size_t name_len = 0;
113+
const uint8_t *crt_name;
114+
115+
bool crt_found = false;
116+
int start = 0;
117+
int end = s_crt_bundle.num_certs - 1;
118+
int middle = (end - start) / 2;
119+
120+
/* Look for the certificate using binary search on subject name */
121+
while (start <= end) {
122+
name_len = s_crt_bundle.crts[middle][0] << 8 | s_crt_bundle.crts[middle][1];
123+
crt_name = s_crt_bundle.crts[middle] + CRT_HEADER_OFFSET;
124+
125+
int cmp_res = memcmp(child->issuer_raw.p, crt_name, name_len );
126+
if (cmp_res == 0) {
127+
crt_found = true;
128+
break;
129+
} else if (cmp_res < 0) {
130+
end = middle - 1;
131+
} else {
132+
start = middle + 1;
133+
}
134+
middle = (start + end) / 2;
135+
}
136+
137+
int ret = MBEDTLS_ERR_X509_FATAL_ERROR;
138+
if (crt_found) {
139+
size_t key_len = s_crt_bundle.crts[middle][2] << 8 | s_crt_bundle.crts[middle][3];
140+
ret = esp_crt_check_signature(child, s_crt_bundle.crts[middle] + CRT_HEADER_OFFSET + name_len, key_len);
141+
}
142+
143+
if (ret == 0) {
144+
ESP_LOGI(TAG, "Certificate validated");
145+
*flags = 0;
146+
return 0;
147+
}
148+
149+
ESP_LOGE(TAG, "Failed to verify certificate");
150+
return MBEDTLS_ERR_X509_FATAL_ERROR;
151+
}
152+
153+
154+
/* Initialize the bundle into an array so we can do binary search for certs,
155+
the bundle generated by the python utility is already presorted by subject name
156+
*/
157+
static esp_err_t esp_crt_bundle_init(const uint8_t *x509_bundle)
158+
{
159+
s_crt_bundle.num_certs = (x509_bundle[0] << 8) | x509_bundle[1];
160+
s_crt_bundle.crts = calloc(s_crt_bundle.num_certs, sizeof(x509_bundle));
161+
162+
if (s_crt_bundle.crts == NULL) {
163+
ESP_LOGE(TAG, "Unable to allocate memory for bundle");
164+
return ESP_ERR_NO_MEM;
165+
}
166+
167+
const uint8_t *cur_crt;
168+
cur_crt = x509_bundle + BUNDLE_HEADER_OFFSET;
169+
170+
for (int i = 0; i < s_crt_bundle.num_certs; i++) {
171+
s_crt_bundle.crts[i] = cur_crt;
172+
173+
size_t name_len = cur_crt[0] << 8 | cur_crt[1];
174+
size_t key_len = cur_crt[2] << 8 | cur_crt[3];
175+
cur_crt = cur_crt + CRT_HEADER_OFFSET + name_len + key_len;
176+
}
177+
178+
return ESP_OK;
179+
}
180+
181+
esp_err_t esp_crt_bundle_attach(void *conf)
182+
{
183+
esp_err_t ret = ESP_OK;
184+
// If no bundle has been set by the user then use the bundle embedded in the binary
185+
if (s_crt_bundle.crts == NULL) {
186+
ret = esp_crt_bundle_init(x509_crt_imported_bundle_bin_start);
187+
}
188+
189+
if (ret != ESP_OK) {
190+
ESP_LOGE(TAG, "Failed to attach bundle");
191+
return ret;
192+
}
193+
194+
if (conf) {
195+
/* point to a dummy certificate
196+
* This is only required so that the
197+
* cacert_ptr passes non-NULL check during handshake
198+
*/
199+
mbedtls_ssl_config *ssl_conf = (mbedtls_ssl_config *)conf;
200+
mbedtls_x509_crt_init(&s_dummy_crt);
201+
mbedtls_ssl_conf_ca_chain(ssl_conf, &s_dummy_crt, NULL);
202+
mbedtls_ssl_conf_verify(ssl_conf, esp_crt_verify_callback, NULL);
203+
}
204+
205+
return ret;
206+
}
207+
208+
void esp_crt_bundle_detach(mbedtls_ssl_config *conf)
209+
{
210+
free(s_crt_bundle.crts);
211+
s_crt_bundle.crts = NULL;
212+
if (conf) {
213+
mbedtls_ssl_conf_verify(conf, NULL, NULL);
214+
}
215+
}
216+
217+
void esp_crt_bundle_set(const uint8_t *x509_bundle)
218+
{
219+
// Free any previously used bundle
220+
free(s_crt_bundle.crts);
221+
esp_crt_bundle_init(x509_bundle);
222+
}
223+

Diff for: ‎libraries/WiFiClientSecure/src/esp_crt_bundle.h

+67
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
16+
#ifndef _ESP_CRT_BUNDLE_H_
17+
#define _ESP_CRT_BUNDLE_H_
18+
19+
#include "mbedtls/ssl.h"
20+
21+
#ifdef __cplusplus
22+
extern "C" {
23+
#endif
24+
25+
26+
/**
27+
* @brief Attach and enable use of a bundle for certificate verification
28+
*
29+
* Attach and enable use of a bundle for certificate verification through a verification callback.
30+
* If no specific bundle has been set through esp_crt_bundle_set() it will default to the
31+
* bundle defined in menuconfig and embedded in the binary.
32+
*
33+
* @param[in] conf The config struct for the SSL connection.
34+
*
35+
* @return
36+
* - ESP_OK if adding certificates was successful.
37+
* - Other if an error occured or an action must be taken by the calling process.
38+
*/
39+
esp_err_t esp_crt_bundle_attach(void *conf);
40+
41+
42+
/**
43+
* @brief Disable and dealloc the certification bundle
44+
*
45+
* Removes the certificate verification callback and deallocates used resources
46+
*
47+
* @param[in] conf The config struct for the SSL connection.
48+
*/
49+
void esp_crt_bundle_detach(mbedtls_ssl_config *conf);
50+
51+
52+
/**
53+
* @brief Set the default certificate bundle used for verification
54+
*
55+
* Overrides the default certificate bundle. In most use cases the bundle should be
56+
* set through menuconfig. The bundle needs to be sorted by subject name since binary search is
57+
* used to find certificates.
58+
*
59+
* @param[in] x509_bundle A pointer to the certificate bundle.
60+
*/
61+
void esp_crt_bundle_set(const uint8_t *x509_bundle);
62+
63+
#ifdef __cplusplus
64+
}
65+
#endif
66+
67+
#endif //_ESP_CRT_BUNDLE_H_

0 commit comments

Comments
 (0)