Skip to content

Commit 885ff3e

Browse files
igrrigrr
committed
Merge pull request esp8266#6 from slaff/feature/lwip-raw
Initial support for LWIP raw tcp mode.
2 parents 514b668 + d78e7a0 commit 885ff3e

File tree

4 files changed

+658
-0
lines changed

4 files changed

+658
-0
lines changed

‎tools/make_certs.sh

+186
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,186 @@
1+
#!/bin/sh
2+
#
3+
# Copyright (c) 2007, Cameron Rich
4+
#
5+
# All rights reserved.
6+
#
7+
# Redistribution and use in source and binary forms, with or without
8+
# modification, are permitted provided that the following conditions are met:
9+
#
10+
# * Redistributions of source code must retain the above copyright notice,
11+
# this list of conditions and the following disclaimer.
12+
# * Redistributions in binary form must reproduce the above copyright
13+
# notice, this list of conditions and the following disclaimer in the
14+
# documentation and/or other materials provided with the distribution.
15+
# * Neither the name of the axTLS project nor the names of its
16+
# contributors may be used to endorse or promote products derived
17+
# from this software without specific prior written permission.
18+
#
19+
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
20+
# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
21+
# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
22+
# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR
23+
# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
24+
# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
25+
# TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26+
# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
27+
# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
28+
# NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29+
# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30+
#
31+
32+
AXDIR=`pwd`/`dirname $0`
33+
CWD=`mktemp -d` && cd $dir
34+
cd $CWD
35+
36+
#
37+
# Generate the certificates and keys for testing.
38+
#
39+
40+
PROJECT_NAME="axTLS Project"
41+
42+
# Generate the openssl configuration files.
43+
cat > ca_cert.conf << EOF
44+
[ req ]
45+
distinguished_name = req_distinguished_name
46+
prompt = no
47+
48+
[ req_distinguished_name ]
49+
O = $PROJECT_NAME Dodgy Certificate Authority
50+
EOF
51+
52+
cat > certs.conf << EOF
53+
[ req ]
54+
distinguished_name = req_distinguished_name
55+
prompt = no
56+
57+
[ req_distinguished_name ]
58+
O = $PROJECT_NAME
59+
CN = 127.0.0.1
60+
EOF
61+
62+
cat > device_cert.conf << EOF
63+
[ req ]
64+
distinguished_name = req_distinguished_name
65+
prompt = no
66+
67+
[ req_distinguished_name ]
68+
O = $PROJECT_NAME Device Certificate
69+
EOF
70+
71+
# private key generation
72+
openssl genrsa -out axTLS.ca_key.pem 1024
73+
openssl genrsa -out axTLS.key_512.pem 512
74+
openssl genrsa -out axTLS.key_1024.pem 1024
75+
openssl genrsa -out axTLS.key_1042.pem 1042
76+
openssl genrsa -out axTLS.key_2048.pem 2048
77+
openssl genrsa -out axTLS.key_4096.pem 4096
78+
openssl genrsa -out axTLS.device_key.pem 1024
79+
openssl genrsa -aes128 -passout pass:abcd -out axTLS.key_aes128.pem 512
80+
openssl genrsa -aes256 -passout pass:abcd -out axTLS.key_aes256.pem 512
81+
82+
83+
# convert private keys into DER format
84+
openssl rsa -in axTLS.key_512.pem -out axTLS.key_512 -outform DER
85+
openssl rsa -in axTLS.key_1024.pem -out axTLS.key_1024 -outform DER
86+
openssl rsa -in axTLS.key_1042.pem -out axTLS.key_1042 -outform DER
87+
openssl rsa -in axTLS.key_2048.pem -out axTLS.key_2048 -outform DER
88+
openssl rsa -in axTLS.key_4096.pem -out axTLS.key_4096 -outform DER
89+
openssl rsa -in axTLS.device_key.pem -out axTLS.device_key -outform DER
90+
91+
# cert requests
92+
openssl req -out axTLS.ca_x509.req -key axTLS.ca_key.pem -new \
93+
-config ./ca_cert.conf
94+
openssl req -out axTLS.x509_512.req -key axTLS.key_512.pem -new \
95+
-config ./certs.conf
96+
openssl req -out axTLS.x509_1024.req -key axTLS.key_1024.pem -new \
97+
-config ./certs.conf
98+
openssl req -out axTLS.x509_1042.req -key axTLS.key_1042.pem -new \
99+
-config ./certs.conf
100+
openssl req -out axTLS.x509_2048.req -key axTLS.key_2048.pem -new \
101+
-config ./certs.conf
102+
openssl req -out axTLS.x509_4096.req -key axTLS.key_4096.pem -new \
103+
-config ./certs.conf
104+
openssl req -out axTLS.x509_device.req -key axTLS.device_key.pem -new \
105+
-config ./device_cert.conf
106+
openssl req -out axTLS.x509_aes128.req -key axTLS.key_aes128.pem \
107+
-new -config ./certs.conf -passin pass:abcd
108+
openssl req -out axTLS.x509_aes256.req -key axTLS.key_aes256.pem \
109+
-new -config ./certs.conf -passin pass:abcd
110+
111+
# generate the actual certs.
112+
openssl x509 -req -in axTLS.ca_x509.req -out axTLS.ca_x509.pem \
113+
-sha1 -days 5000 -signkey axTLS.ca_key.pem
114+
openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_512.pem \
115+
-sha1 -CAcreateserial -days 5000 \
116+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
117+
openssl x509 -req -in axTLS.x509_1024.req -out axTLS.x509_1024.pem \
118+
-sha1 -CAcreateserial -days 5000 \
119+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
120+
openssl x509 -req -in axTLS.x509_1042.req -out axTLS.x509_1042.pem \
121+
-sha1 -CAcreateserial -days 5000 \
122+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
123+
openssl x509 -req -in axTLS.x509_2048.req -out axTLS.x509_2048.pem \
124+
-md5 -CAcreateserial -days 5000 \
125+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
126+
openssl x509 -req -in axTLS.x509_4096.req -out axTLS.x509_4096.pem \
127+
-md5 -CAcreateserial -days 5000 \
128+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
129+
openssl x509 -req -in axTLS.x509_device.req -out axTLS.x509_device.pem \
130+
-sha1 -CAcreateserial -days 5000 \
131+
-CA axTLS.x509_512.pem -CAkey axTLS.key_512.pem
132+
openssl x509 -req -in axTLS.x509_aes128.req \
133+
-out axTLS.x509_aes128.pem \
134+
-sha1 -CAcreateserial -days 5000 \
135+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
136+
openssl x509 -req -in axTLS.x509_aes256.req \
137+
-out axTLS.x509_aes256.pem \
138+
-sha1 -CAcreateserial -days 5000 \
139+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
140+
141+
# note: must be root to do this
142+
DATE_NOW=`date`
143+
if date -s "Jan 1 2025"; then
144+
openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_bad_before.pem \
145+
-sha1 -CAcreateserial -days 365 \
146+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
147+
date -s "$DATE_NOW"
148+
touch axTLS.x509_bad_before.pem
149+
fi
150+
openssl x509 -req -in axTLS.x509_512.req -out axTLS.x509_bad_after.pem \
151+
-sha1 -CAcreateserial -days -365 \
152+
-CA axTLS.ca_x509.pem -CAkey axTLS.ca_key.pem
153+
154+
# some cleanup
155+
rm axTLS*.req
156+
rm axTLS.srl
157+
rm *.conf
158+
159+
# need this for the client tests
160+
openssl x509 -in axTLS.ca_x509.pem -outform DER -out axTLS.ca_x509.cer
161+
openssl x509 -in axTLS.x509_512.pem -outform DER -out axTLS.x509_512.cer
162+
openssl x509 -in axTLS.x509_1024.pem -outform DER -out axTLS.x509_1024.cer
163+
openssl x509 -in axTLS.x509_1042.pem -outform DER -out axTLS.x509_1042.cer
164+
openssl x509 -in axTLS.x509_2048.pem -outform DER -out axTLS.x509_2048.cer
165+
openssl x509 -in axTLS.x509_4096.pem -outform DER -out axTLS.x509_4096.cer
166+
openssl x509 -in axTLS.x509_device.pem -outform DER -out axTLS.x509_device.cer
167+
168+
# generate pkcs8 files (use RC4-128 for encryption)
169+
openssl pkcs8 -in axTLS.key_512.pem -passout pass:abcd -topk8 -v1 PBE-SHA1-RC4-128 -out axTLS.encrypted_pem.p8
170+
openssl pkcs8 -in axTLS.key_512.pem -passout pass:abcd -topk8 -outform DER -v1 PBE-SHA1-RC4-128 -out axTLS.encrypted.p8
171+
openssl pkcs8 -in axTLS.key_512.pem -nocrypt -topk8 -out axTLS.unencrypted_pem.p8
172+
openssl pkcs8 -in axTLS.key_512.pem -nocrypt -topk8 -outform DER -out axTLS.unencrypted.p8
173+
174+
# generate pkcs12 files (use RC4-128 for encryption)
175+
openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -certfile axTLS.ca_x509.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -name "p12_with_CA" -out axTLS.withCA.p12 -password pass:abcd
176+
openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -name "p12_without_CA" -out axTLS.withoutCA.p12 -password pass:abcd
177+
openssl pkcs12 -export -in axTLS.x509_1024.pem -inkey axTLS.key_1024.pem -keypbe PBE-SHA1-RC4-128 -certpbe PBE-SHA1-RC4-128 -out axTLS.noname.p12 -password pass:abcd
178+
179+
# PEM certificate chain
180+
cat axTLS.ca_x509.pem >> axTLS.x509_device.pem
181+
182+
# set default key/cert for use in the server
183+
xxd -i axTLS.x509_1024.cer | sed -e \
184+
"s/axTLS_x509_1024_cer/default_certificate/" > $AXDIR/../ssl/cert.h
185+
xxd -i axTLS.key_1024 | sed -e \
186+
"s/axTLS_key_1024/default_private_key/" > $AXDIR/../ssl/private_key.h

‎util/README.md

+149
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
If you are using [LWIP raw tcp mode](http://lwip.wikia.com/wiki/Raw/TCP) and want to add SSL support below are the steps that can help you to achieve this with the help of [axTLS]( http://axtls.sourceforge.net/ ).
2+
3+
First you have to include the `lwipr_compat.h` header.
4+
5+
```C
6+
#include "util/lwipr_compat.h"
7+
```
8+
9+
Then in the code block where you initialize the tcp raw connection you should call `axl_init`.
10+
Take a look at the example below:
11+
12+
```C
13+
lwip_init();
14+
15+
/*
16+
* The line below should be added AFTER the lwip_init code
17+
* AND BEFORE the call to tcp_new()
18+
* The parameter value 10 specifies how many SSL connections are expected
19+
*/
20+
axl_init(10);
21+
22+
// .. some more code
23+
tcp = tcp_new();
24+
tcp_sent(tcp, staticOnSent);
25+
tcp_recv(tcp, staticOnReceive);
26+
tcp_err(tcp, staticOnError);
27+
tcp_poll(tcp, staticOnPoll, 4);
28+
// ... and even more code
29+
res = tcp_connect(tcp, &addr, port, staticOnConnected);
30+
31+
32+
```
33+
34+
Now we should add in our `staticOnConnected` funciton code to create new ssl context and ssl object.
35+
In the example below the `sslObj` and `sslContext` are defined as global
36+
37+
```C
38+
// global definitions
39+
SSL *sslObj = NULL;
40+
SSLCTX* sslContext = NULL;
41+
42+
// and some more code...
43+
44+
err_t staticOnConnected(void *arg, struct tcp_pcb *tcp, err_t err)
45+
{
46+
int clientfd = -1;
47+
uint32_t options = 0;
48+
49+
if (tcp == NULL) {
50+
/* @TODO: Take care to handle error conditions */
51+
return -1;
52+
}
53+
54+
clientfd = axl_append(tcp);
55+
if(clientfd == -1) {
56+
printf("Unable to add LWIP tcp -> clientfd mapping\n");
57+
return ERR_OK;
58+
}
59+
60+
printf("Connected: ClientId: %d\n", clientfd);
61+
#ifdef SSL_DEBUG
62+
options |= SSL_DISPLAY_STATES | SSL_DISPLAY_BYTES;
63+
#endif
64+
65+
// if you want to verify the server certificate later you can also add the following option
66+
options |= SSL_SERVER_VERIFY_LATER
67+
68+
sslContext = ssl_ctx_new(SSL_CONNECT_IN_PARTS | options, 1); // !!! SSL_CONNECT_IN_PARTS must be in the flags !!!
69+
sslObj = ssl_client_new(sslContext, clientfd, NULL, 0);
70+
71+
return ERR_OK;
72+
}
73+
```
74+
75+
76+
Once we are connected we can send and receive information. For the receiving part we can do the following
77+
78+
```C
79+
err_t staticOnReceive(void *arg, struct tcp_pcb *tcp, struct pbuf *p, err_t err)
80+
{
81+
uint8_t *read_buf = NULL;
82+
int read_bytes = 0;
83+
84+
printf("Err: %d\n", err);
85+
86+
if(tcp == NULL || p == NULL) {
87+
/* @TODO: Take care to handle error conditions */
88+
return -1;
89+
}
90+
91+
read_bytes = axl_ssl_read(sslObj, &read_buf, tcp, p);
92+
if(read_bytes > 0) {
93+
printf("Got data: %s", read_buf);
94+
// @TODO: Do something useful with the read_buf
95+
}
96+
97+
return ERR_OK;
98+
}
99+
```
100+
101+
In the receiving part you can also add debug code to display more information about the SSL handshake, once it was successul.
102+
103+
104+
```C
105+
err_t staticOnReceive(void *arg, struct tcp_pcb *tcp, struct pbuf *p, err_t err)
106+
{
107+
static int show_info = 0;
108+
const char *common_name = NULL;
109+
110+
// ..
111+
read_bytes = axl_ssl_read(sslObj, &read_buf, tcp, p);
112+
if(read_bytes > 0) {
113+
printf("Got data: %s", read_buf);
114+
// @TODO: Do something useful with the read_buf
115+
}
116+
117+
if(!show_info && ssl_handshake_status(sslObj) == SSL_OK) {
118+
common_name = ssl_get_cert_dn(sslObj, SSL_X509_CERT_COMMON_NAME);
119+
if (common_name) {
120+
printf("Common Name:\t\t\t%s\n", common_name);
121+
}
122+
123+
// These two funcitons below can be found in the axtls examples
124+
display_session_id(sslObj);
125+
display_cipher(sslObj);
126+
show_info = 1;
127+
}
128+
129+
return ERR_OK;
130+
}
131+
132+
```
133+
134+
135+
And for the sending part we can use the following code sample as a start
136+
137+
```C
138+
void someSendingfunction() {
139+
uint8_t *out_buf;
140+
int out_bytes = 0;
141+
142+
// ... take care to store something in the out_buf
143+
144+
axl_ssl_write(sslObj, out_buf, out_bytes);
145+
}
146+
147+
```
148+
149+
Good luck and send your success stories at [email protected].

0 commit comments

Comments
 (0)