Skip to content

Commit 5697a4c

Browse files
gojimmypigojimmypi
committed
change(esp-tls): Improve support for wolfssl
1 parent 19b0d6c commit 5697a4c

File tree

10 files changed

+515
-62
lines changed

10 files changed

+515
-62
lines changed

‎components/esp-tls/CMakeLists.txt‎

Lines changed: 90 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,26 +5,113 @@ if(CONFIG_ESP_TLS_USING_MBEDTLS)
55
endif()
66

77
if(CONFIG_ESP_TLS_USING_WOLFSSL)
8+
message(STATUS "esp-tls configured for wolfssl")
89
list(APPEND srcs
910
"esp_tls_wolfssl.c")
11+
set(wolfssl_esp_tls_lib "wolfssl")
12+
else()
13+
unset(wolfssl_esp_tls_lib)
1014
endif()
1115

1216
set(priv_req http_parser esp_timer)
1317
if(NOT ${IDF_TARGET} STREQUAL "linux")
1418
list(APPEND priv_req lwip)
1519
endif()
1620

21+
message(STATUS "idf_component_register wolfssl_esp_tls_lib: ${wolfssl_esp_tls_lib}")
22+
1723
idf_component_register(SRCS "${srcs}"
1824
INCLUDE_DIRS ${CMAKE_CURRENT_SOURCE_DIR} esp-tls-crypto
1925
PRIV_INCLUDE_DIRS "private_include"
2026
# mbedtls is public requirements because esp_tls.h
2127
# includes mbedtls header files.
22-
REQUIRES mbedtls
28+
REQUIRES mbedtls ${wolfssl_esp_tls_lib}
2329
PRIV_REQUIRES ${priv_req})
2430

31+
# When using wolfSSL for the ESP-TLS (see menuconfig),
32+
# There are two options:
33+
# 1) A specified source directory, typically a wolfssl git clone
34+
# 2) The esp-wolfssl
35+
# TODO this is duplicate code. See components/wap_supplicant
36+
message(STATUS "esp-tls config begin")
2537
if(CONFIG_ESP_TLS_USING_WOLFSSL)
26-
idf_component_get_property(wolfssl esp-wolfssl COMPONENT_LIB)
27-
target_link_libraries(${COMPONENT_LIB} PUBLIC ${wolfssl})
38+
message(STATUS "found CONFIG_ESP_TLS_USING_WOLFSSL")
39+
# See https://github.com/wolfSSL/wolfssl/
40+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DWOLFSSL_ESPIDF")
41+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DWOLFSSL_USER_SETTINGS")
42+
43+
# The published wolfSSL 5.7.0 user_settings.h does not include some features that
44+
# might be enabled in Kconfig, so enable them here:
45+
# set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DHAVE_ALPN")
46+
# set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DHAVE_SNI")
47+
# set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DOPENSSL_EXTRA_X509_SMALL")
48+
# this only works for VisualGDB, not idf.py from command-line
49+
50+
message(STATUS "CMAKE_HOME_DIRECTORY = ${CMAKE_HOME_DIRECTORY}")
51+
message(STATUS "CMAKE_PARENT_LIST_FILE = ${CMAKE_PARENT_LIST_FILE}")
52+
message(STATUS "CMAKE_SOURCE_DIR = ${CMAKE_SOURCE_DIR}")
53+
message(STATUS "COMPONENT_DIR = ${CMAKE_HOME_DIRECTORY}")
54+
message(STATUS "COMPONENT_LIB = ${COMPONENT_LIB}")
55+
message(STATUS "FOUND_WOLFSSL = ${FOUND_WOLFSSL}")
56+
message(STATUS "PROJECT_DIR = ${PROJECT_DIR}")
57+
message(STATUS "WOLFSSL_PROJECT_DIR = ${WOLFSSL_PROJECT_DIR}")
58+
message(STATUS "CMAKE_HOME_DIRECTORY = ${CMAKE_HOME_DIRECTORY}")
59+
message(STATUS "WOLFSSL_ROOT = ${WOLFSSL_ROOT}")
60+
61+
if(CONFIG_ESP_TLS_USING_WOLFSSL_SPECIFIED)
62+
get_filename_component(CUSTOM_SETTING_WOLFSSL_ROOT_PATH "${CUSTOM_SETTING_WOLFSSL_ROOT}" ABSOLUTE)
63+
if(EXISTS "${CUSTOM_SETTING_WOLFSSL_ROOT_PATH}/wolfcrypt/src")
64+
message(STATUS "ESP-TLS using wolfSSL in: ${CUSTOM_SETTING_WOLFSSL_ROOT_PATH}")
65+
else()
66+
message(STATUS "ESP-TLS specified directory does not contain wolfSSL: ${CUSTOM_SETTING_WOLFSSL_ROOT_PATH}")
67+
endif()
68+
idf_component_get_property(wolfssl wolfssl COMPONENT_LIB)
69+
target_link_libraries(${COMPONENT_LIB} PUBLIC ${wolfssl})
70+
else()
71+
# Is wolfSSL installed in the local project as a Managed Component?
72+
set(WOLFSSL_COMPONENT_SEARCH "${PROJECT_DIR}/managed_components/wolfssl__wolfssl")
73+
message(STATUS "Searching for wolfSSL in ${WOLFSSL_COMPONENT_SEARCH}")
74+
if(EXISTS "${WOLFSSL_COMPONENT_SEARCH}")
75+
message(STATUS "Configuring ESP-IDF to use wolfssl in Managed Component: ${WOLFSSL_COMPONENT_SEARCH}")
76+
idf_component_get_property(wolfssl wolfssl__wolfssl COMPONENT_LIB)
77+
else()
78+
# Is wolfSSL installed in the local project as a Managed Component
79+
# converted to regular project component?
80+
set(WOLFSSL_COMPONENT_SEARCH "${PROJECT_DIR}/components/wolfssl__wolfssl")
81+
message(STATUS "Searching for wolfSSL in ${WOLFSSL_COMPONENT_SEARCH}")
82+
if(EXISTS "${WOLFSSL_COMPONENT_SEARCH}")
83+
message(STATUS
84+
"Configuring ESP-IDF to use wolfssl in Converted Managed Component: ${WOLFSSL_COMPONENT_SEARCH}")
85+
idf_component_get_property(wolfssl wolfssl__wolfssl COMPONENT_LIB)
86+
else()
87+
# Is wolfSSL installed in the local project as a non-maged, regular component?
88+
set(WOLFSSL_COMPONENT_SEARCH "${PROJECT_DIR}/components/wolfssl")
89+
message(STATUS "Searching for wolfSSL in ${WOLFSSL_COMPONENT_SEARCH}")
90+
if(EXISTS "${WOLFSSL_COMPONENT_SEARCH}")
91+
message(STATUS "Configuring ESP-IDF to use wolfssl in Component: ${WOLFSSL_COMPONENT_SEARCH}")
92+
idf_component_get_property(wolfssl wolfssl COMPONENT_LIB)
93+
else()
94+
set(WOLFSSL_COMPONENT_SEARCH "${THIS_IDF_PATH}/components/esp-wolfssl")
95+
message(STATUS "Searching for wolfSSL in ${WOLFSSL_COMPONENT_SEARCH}")
96+
if(EXISTS "${WOLFSSL_COMPONENT_SEARCH}")
97+
message(STATUS "Configuring ESP-IDF to use wolfssl from: ${WOLFSSL_COMPONENT_SEARCH}")
98+
message(STATUS "Warning: Using legacy esp-wolfssl. Consider using a Managed Component")
99+
# See https://github.com/espressif/esp-idf
100+
message(STATUS "Configuring ESP-TLS to use esp-wolfssl")
101+
idf_component_get_property(wolfssl esp-wolfssl COMPONENT_LIB)
102+
else()
103+
message(STATUS "Consider installing wolfSSL from "
104+
"https://components.espressif.com/components/wolfssl/wolfssl")
105+
message(FATAL_ERROR "Component ${component} not found")
106+
endif() # esp-wolfssl
107+
endif() # project wolfssl
108+
endif() # project converted wolfssl__wolfssl
109+
endif() # project managed component wolfssl__wolfssl
110+
# idf_component_get_property(wolfssl wolfssl__wolfssl COMPONENT_LIB)
111+
target_link_libraries(${COMPONENT_LIB} PUBLIC ${wolfssl})
112+
endif()
113+
else()
114+
message(STATUS "ESP-TLS is not configured to use wolfSSL.")
28115
endif()
29116

30117
if(NOT ${IDF_TARGET} STREQUAL "linux")

‎components/esp-tls/Kconfig‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,17 @@ menu "ESP-TLS"
66
The ESP-TLS APIs support multiple backend TLS libraries. Currently mbedTLS and WolfSSL are
77
supported. Different TLS libraries may support different features and have different resource
88
usage. Consult the ESP-TLS documentation in ESP-IDF Programming guide for more details.
9+
910
config ESP_TLS_USING_MBEDTLS
1011
bool "mbedTLS"
12+
1113
config ESP_TLS_USING_WOLFSSL
12-
depends on TLS_STACK_WOLFSSL
1314
bool "wolfSSL (License info in wolfSSL directory README)"
15+
select TLS_STACK_WOLFSSL
16+
help
17+
This option enables wolfSSL for ESP-TLS.
18+
Note: Ensure TLS_STACK_WOLFSSL is enabled to use this option.
19+
1420
endchoice
1521

1622
config ESP_TLS_USE_SECURE_ELEMENT
@@ -100,6 +106,15 @@ menu "ESP-TLS"
100106
with a server which has a fake identity, provided that the server certificate
101107
is not provided either through API or other mechanism like ca_store etc.
102108

109+
config ESP_WOLFSSL_SMALL_CERT_VERIFY
110+
bool "Enable SMALL_CERT_VERIFY"
111+
depends on ESP_TLS_USING_WOLFSSL
112+
default y
113+
help
114+
Enables server verification with Intermediate CA cert, does not authenticate full chain
115+
of trust upto the root CA cert (After Enabling this option client only needs to have Intermediate
116+
CA certificate of the server to authenticate server, root CA cert is not necessary).
117+
103118
config ESP_DEBUG_WOLFSSL
104119
bool "Enable debug logs for wolfSSL"
105120
depends on ESP_TLS_USING_WOLFSSL

‎components/esp-tls/esp-tls-crypto/esp_tls_crypto.c‎

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,14 @@ __attribute__((unused)) static const char *TAG = "esp_crypto";
1616
#define _esp_crypto_sha1 esp_crypto_sha1_mbedtls
1717
#define _esp_crypto_base64_encode esp_crypto_bas64_encode_mbedtls
1818
#elif CONFIG_ESP_TLS_USING_WOLFSSL
19-
#include "wolfssl/ssl.h" /* SHA functions are listed in wolfssl/ssl.h */
20-
#include "wolfssl/wolfcrypt/coding.h"
21-
#define _esp_crypto_sha1 esp_crypto_sha1_wolfSSL
22-
#define _esp_crypto_base64_encode esp_crypto_base64_encode_woflSSL
19+
#include "wolfssl/wolfcrypt/settings.h"
20+
#include "wolfssl/ssl.h" /* some SHA functions are listed in wolfssl/ssl.h */
21+
#if defined(CONFIG_ESP_WOLFSSL_OPENSSL_EXTRA) || defined(OPENSSL_EXTRA)
22+
#include "wolfssl/openssl/sha.h" /* old SHA functions only available with OpenSSL */
23+
#endif
24+
#include "wolfssl/wolfcrypt/coding.h"
25+
#define _esp_crypto_sha1 esp_crypto_sha1_wolfSSL
26+
#define _esp_crypto_base64_encode esp_crypto_base64_encode_woflSSL
2327
#endif
2428

2529
#ifdef CONFIG_ESP_TLS_USING_MBEDTLS
@@ -81,7 +85,17 @@ static int esp_crypto_base64_encode_woflSSL(unsigned char *dst, size_t dlen, siz
8185
const unsigned char *src, size_t slen)
8286
{
8387
*olen = dlen;
88+
#if defined(CONFIG_ESP_TLS_USING_WOLFSSL) && (defined(WOLFSSL_BASE64_ENCODE) || !defined(OPENSSL_EXTRA))
89+
#if defined(WOLFSSL_BASE64_ENCODE_LINE_LEN)
90+
#error "WOLFSSL_BASE64_ENCODE_LINE_LEN is defined - Base64_Encode() will insert newlines. Rebuild without it."
91+
#endif
92+
#ifndef WOLFSSL_BASE64_ENCODE
93+
#warning "WOLFSSL_BASE64_ENCODE is missing - Base64_Encode() is unavailable."
94+
#endif
95+
return Base64_Encode((const byte *) src, (word32) slen, (byte *) dst, (word32 *) olen);
96+
#else
8497
return Base64_Encode_NoNl((const byte *) src, (word32) slen, (byte *) dst, (word32 *) olen);
98+
#endif
8599
}
86100

87101
#else

‎components/esp-tls/esp_tls.c‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,11 @@ static const char *TAG = "esp-tls";
114114

115115
static esp_err_t create_ssl_handle(const char *hostname, size_t hostlen, const void *cfg, esp_tls_t *tls)
116116
{
117+
#if defined(ESP_IDF_VERSION) && (ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(5, 3, 0))
117118
return _esp_create_ssl_handle(hostname, hostlen, cfg, tls, NULL);
119+
#else
120+
return _esp_create_ssl_handle(hostname, hostlen, cfg, tls);
121+
#endif
118122
}
119123

120124
static esp_err_t esp_tls_handshake(esp_tls_t *tls, const esp_tls_cfg_t *cfg)
@@ -134,7 +138,7 @@ static ssize_t tcp_write(esp_tls_t *tls, const char *data, size_t datalen)
134138

135139
ssize_t esp_tls_conn_read(esp_tls_t *tls, void *data, size_t datalen)
136140
{
137-
if (!tls) {
141+
if (!tls || !data) {
138142
return -1;
139143
}
140144
return tls->read(tls, (char *)data, datalen);
@@ -461,7 +465,10 @@ static inline esp_err_t tcp_connect(const char *host, int hostlen, int port, con
461465

462466
static int esp_tls_low_level_conn(const char *hostname, int hostlen, int port, const esp_tls_cfg_t *cfg, esp_tls_t *tls)
463467
{
464-
468+
if (!tls) {
469+
ESP_LOGE(TAG, "empty esp_tls parameter");
470+
return -1;
471+
}
465472
esp_err_t esp_ret;
466473
/* These states are used to keep a tab on connection progress in case of non-blocking connect,
467474
and in case of blocking connect these cases will get executed one after the other */
@@ -737,11 +744,17 @@ int esp_tls_server_session_create(esp_tls_cfg_server_t *cfg, int sockfd, esp_tls
737744
/**
738745
* @brief Close the server side TLS/SSL connection and free any allocated resources.
739746
*/
747+
#ifdef CONFIG_ESP_TLS_USING_WOLFSSL
748+
int esp_tls_server_session_delete(esp_tls_t *tls)
749+
{
750+
return _esp_tls_server_session_delete(tls);
751+
}
752+
#else
740753
void esp_tls_server_session_delete(esp_tls_t *tls)
741754
{
742755
return _esp_tls_server_session_delete(tls);
743756
}
744-
757+
#endif
745758
ssize_t esp_tls_get_bytes_avail(esp_tls_t *tls)
746759
{
747760
return _esp_tls_get_bytes_avail(tls);

‎components/esp-tls/esp_tls.h‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
#include "mbedtls/ctr_drbg.h"
2020
#endif
2121
#elif CONFIG_ESP_TLS_USING_WOLFSSL
22+
/* ESP_TLS_HAS_WOLFSSL defined only for versions properly supporting wolfSSL */
23+
#define ESP_TLS_HAS_WOLFSSL
2224
#include "wolfssl/wolfcrypt/settings.h"
2325
#include "wolfssl/ssl.h"
2426
#endif
@@ -759,8 +761,11 @@ int esp_tls_server_session_create(esp_tls_cfg_server_t *cfg, int sockfd, esp_tls
759761
*
760762
* @param[in] tls pointer to esp_tls_t
761763
*/
764+
#ifdef CONFIG_ESP_TLS_USING_WOLFSSL
765+
int esp_tls_server_session_delete(esp_tls_t *tls);
766+
#else
762767
void esp_tls_server_session_delete(esp_tls_t *tls);
763-
768+
#endif
764769
/**
765770
* @brief Creates a plain TCP connection, returning a valid socket fd on success or an error handle
766771
*

0 commit comments

Comments
 (0)