|
| 1 | +If you are using [LWIP raw tcp mode](http://lwip.wikia.com/wiki/Raw/TCP) and want to add SSL support below are the steps that can help you to achieve this with the help of [axTLS]( http://axtls.sourceforge.net/ ). |
| 2 | + |
| 3 | +First you have to include the `lwipr_compat.h` header. |
| 4 | + |
| 5 | +```C |
| 6 | +#include "compat/lwipr_compat.h" |
| 7 | +``` |
| 8 | + |
| 9 | +Then in the code block where you initialize the tcp raw connection you should call `axl_init`. |
| 10 | +Take a look at the example below: |
| 11 | + |
| 12 | +```C |
| 13 | +lwip_init(); |
| 14 | + |
| 15 | +/* |
| 16 | + * The line below should be added AFTER the lwip_init code |
| 17 | + * AND BEFORE the call to tcp_new() |
| 18 | + * The parameter value 10 specifies how many SSL connections are expected |
| 19 | + */ |
| 20 | +axl_init(10); |
| 21 | + |
| 22 | +// .. some more code |
| 23 | +tcp = tcp_new(); |
| 24 | +tcp_sent(tcp, staticOnSent); |
| 25 | +tcp_recv(tcp, staticOnReceive); |
| 26 | +tcp_err(tcp, staticOnError); |
| 27 | +tcp_poll(tcp, staticOnPoll, 4); |
| 28 | +// ... and even more code |
| 29 | +res = tcp_connect(tcp, &addr, port, staticOnConnected); |
| 30 | + |
| 31 | + |
| 32 | +``` |
| 33 | +
|
| 34 | +Now we should add in our `staticOnConnected` funciton code to create new ssl context and ssl object. |
| 35 | +In the example below the `sslObj` and `sslContext` are defined as global |
| 36 | +
|
| 37 | +```C |
| 38 | +// global definitions |
| 39 | +SSL *sslObj = NULL; |
| 40 | +SSLCTX* sslContext = NULL; |
| 41 | +
|
| 42 | +// and some more code... |
| 43 | +
|
| 44 | +err_t staticOnConnected(void *arg, struct tcp_pcb *tcp, err_t err) |
| 45 | +{ |
| 46 | + int clientfd = -1; |
| 47 | + uint32_t options = 0; |
| 48 | +
|
| 49 | + if (tcp == NULL) { |
| 50 | + /* @TODO: Take care to handle error conditions */ |
| 51 | + return -1; |
| 52 | + } |
| 53 | +
|
| 54 | + clientfd = axl_append(tcp); |
| 55 | + if(clientfd == -1) { |
| 56 | + printf("Unable to add LWIP tcp -> clientfd mapping\n"); |
| 57 | + return ERR_OK; |
| 58 | + } |
| 59 | + |
| 60 | + printf("Connected: ClientId: %d\n", clientfd); |
| 61 | +#ifdef SSL_DEBUG |
| 62 | + options |= SSL_DISPLAY_STATES | SSL_DISPLAY_BYTES; |
| 63 | +#endif |
| 64 | + |
| 65 | + // if you want to verify the server certificate later you can also add the following option |
| 66 | + options |= SSL_SERVER_VERIFY_LATER |
| 67 | + |
| 68 | + sslContext = ssl_ctx_new(SSL_CONNECT_IN_PARTS | options, 1); // !!! SSL_CONNECT_IN_PARTS must be in the flags !!! |
| 69 | + sslObj = ssl_client_new(sslContext, clientfd, NULL, 0); |
| 70 | +
|
| 71 | + return ERR_OK; |
| 72 | +} |
| 73 | +``` |
| 74 | + |
| 75 | + |
| 76 | +Once we are connected we can send and receive information. For the receiving part we can do the following |
| 77 | + |
| 78 | +```C |
| 79 | +err_t staticOnReceive(void *arg, struct tcp_pcb *tcp, struct pbuf *p, err_t err) |
| 80 | +{ |
| 81 | + uint8_t *read_buf = NULL; |
| 82 | + int read_bytes = 0; |
| 83 | + |
| 84 | + printf("Err: %d\n", err); |
| 85 | + |
| 86 | + if(tcp == NULL || p == NULL) { |
| 87 | + /* @TODO: Take care to handle error conditions */ |
| 88 | + return -1; |
| 89 | + } |
| 90 | + |
| 91 | + read_bytes = axl_ssl_read(sslObj, &read_buf, tcp, p); |
| 92 | + if(read_bytes > 0) { |
| 93 | + printf("Got data: %s", read_buf); |
| 94 | + // @TODO: Do something useful with the read_buf |
| 95 | + } |
| 96 | + |
| 97 | + return ERR_OK; |
| 98 | +} |
| 99 | +``` |
| 100 | +
|
| 101 | +In the receiving part you can also add debug code to display more information about the SSL handshake, once it was successul. |
| 102 | +
|
| 103 | +
|
| 104 | +```C |
| 105 | +err_t staticOnReceive(void *arg, struct tcp_pcb *tcp, struct pbuf *p, err_t err) |
| 106 | +{ |
| 107 | + static int show_info = 0; |
| 108 | + const char *common_name = NULL; |
| 109 | + |
| 110 | + // .. |
| 111 | + read_bytes = axl_ssl_read(sslObj, &read_buf, tcp, p); |
| 112 | + if(read_bytes > 0) { |
| 113 | + printf("Got data: %s", read_buf); |
| 114 | + // @TODO: Do something useful with the read_buf |
| 115 | + } |
| 116 | + |
| 117 | + if(!show_info && ssl_handshake_status(sslObj) == SSL_OK) { |
| 118 | + common_name = ssl_get_cert_dn(sslObj, SSL_X509_CERT_COMMON_NAME); |
| 119 | + if (common_name) { |
| 120 | + printf("Common Name:\t\t\t%s\n", common_name); |
| 121 | + } |
| 122 | +
|
| 123 | + // These two funcitons below can be found in the axtls examples |
| 124 | + display_session_id(sslObj); |
| 125 | + display_cipher(sslObj); |
| 126 | + show_info = 1; |
| 127 | + } |
| 128 | + |
| 129 | + return ERR_OK; |
| 130 | +} |
| 131 | +
|
| 132 | +``` |
| 133 | + |
| 134 | + |
| 135 | +And for the sending part we can use the following code sample as a start |
| 136 | + |
| 137 | +```C |
| 138 | +void someSendingfunction() { |
| 139 | + uint8_t *out_buf; |
| 140 | + int out_bytes = 0; |
| 141 | + |
| 142 | + // ... take care to store something in the out_buf |
| 143 | + |
| 144 | + axl_ssl_write(sslObj, out_buf, out_bytes); |
| 145 | +} |
| 146 | + |
| 147 | +``` |
| 148 | + |
| 149 | +Good luck and send your success stories at [email protected]. |
0 commit comments