Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Make lwip to work on u-boot and mbedtl v3.6 #47

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Make lwip to work on u-boot and mbedtl v3.6 #47

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0ccd09d
altcp_tls_mbedtls: Add compatibility with mbedTLS 3.6.x branch
jetm Apr 26, 2024
2e7fb97
altcp_tls_mbedtls: tcp_out: Fix handshake when called from u-boot
jetm Apr 26, 2024
c53c9d0
altcp_tls_mbedtls: Support Server Name Indication
jetm Sep 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 25 additions & 20 deletions src/apps/altcp_tls/altcp_tls_mbedtls.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@
* Application layered TCP/TLS connection API (to be used from TCPIP thread)
*
* This file provides a TLS layer using mbedTLS
*
* This version is currently compatible with the 2.x.x branch (current LTS).
*
* This version is currently compatible with the 3.6.x branch (latest LTS).
*/

/*
Expand Down Expand Up @@ -70,7 +70,6 @@
/* @todo: which includes are really needed? */
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"
#include "mbedtls/certs.h"
#include "mbedtls/x509.h"
#include "mbedtls/ssl.h"
#include "mbedtls/net_sockets.h"
Expand All @@ -81,8 +80,6 @@
#include "mbedtls/ssl_cache.h"
#include "mbedtls/ssl_ticket.h"

#include "mbedtls/ssl_internal.h" /* to call mbedtls_flush_output after ERR_MEM */

#include <string.h>

#ifndef ALTCP_MBEDTLS_ENTROPY_PTR
Expand All @@ -109,6 +106,7 @@ struct altcp_tls_config {
u8_t pkey_count;
u8_t pkey_max;
mbedtls_x509_crt *ca;
char host[256];
#if defined(MBEDTLS_SSL_CACHE_C) && ALTCP_MBEDTLS_USE_SESSION_CACHE
/** Inter-connection cache for fast connection startup */
struct mbedtls_ssl_cache_context cache;
Expand Down Expand Up @@ -136,9 +134,11 @@ static int altcp_mbedtls_bio_send(void *ctx, const unsigned char *dataptr, size_
static void
altcp_mbedtls_flush_output(altcp_mbedtls_state_t* state)
{
int flushed = mbedtls_ssl_flush_output(&state->ssl_context);
if (flushed) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_ssl_flush_output failed: %d\n", flushed));
if (state->ssl_context.MBEDTLS_PRIVATE(out_left) != 0) {
int flushed = mbedtls_ssl_send_alert_message(&state->ssl_context, 0, 0);
if (flushed) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_ssl_send_alert_message failed: %d\n", flushed));
}
}
}

Expand Down Expand Up @@ -533,7 +533,7 @@ altcp_mbedtls_lower_sent(void *arg, struct altcp_pcb *inner_conn, u16_t len)
LWIP_ASSERT("state", state != NULL);
LWIP_ASSERT("pcb mismatch", conn->inner_conn == inner_conn);
/* calculate TLS overhead part to not send it to application */
overhead = state->overhead_bytes_adjust + state->ssl_context.out_left;
overhead = state->overhead_bytes_adjust + state->ssl_context.MBEDTLS_PRIVATE(out_left);
if ((unsigned)overhead > len) {
overhead = len;
}
Expand Down Expand Up @@ -644,6 +644,7 @@ altcp_mbedtls_setup(void *conf, struct altcp_pcb *conn, struct altcp_pcb *inner_
/* tell mbedtls about our I/O functions */
mbedtls_ssl_set_bio(&state->ssl_context, conn, altcp_mbedtls_bio_send, altcp_mbedtls_bio_recv, NULL);

mbedtls_ssl_set_hostname(&state->ssl_context, config->host);
altcp_mbedtls_setup_callbacks(conn, inner_conn);
conn->inner_conn = inner_conn;
conn->fns = &altcp_mbedtls_functions;
Expand Down Expand Up @@ -692,7 +693,7 @@ altcp_tls_set_session(struct altcp_pcb *conn, struct altcp_tls_session *session)
if (session && conn && conn->state) {
altcp_mbedtls_state_t *state = (altcp_mbedtls_state_t *)conn->state;
int ret = -1;
if (session->data.start)
if (session->data.MBEDTLS_PRIVATE(start))
ret = mbedtls_ssl_set_session(&state->ssl_context, &session->data);
return ret < 0 ? ERR_VAL : ERR_OK;
}
Expand Down Expand Up @@ -785,7 +786,7 @@ altcp_tls_create_config(int is_server, u8_t cert_count, u8_t pkey_count, int hav
struct altcp_tls_config *conf;
mbedtls_x509_crt *mem;

if (TCP_WND < MBEDTLS_SSL_MAX_CONTENT_LEN) {
if (TCP_WND < MBEDTLS_SSL_IN_CONTENT_LEN || TCP_WND < MBEDTLS_SSL_OUT_CONTENT_LEN) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG|LWIP_DBG_LEVEL_SERIOUS,
("altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!\n"));
}
Expand Down Expand Up @@ -909,7 +910,7 @@ err_t altcp_tls_config_server_add_privkey_cert(struct altcp_tls_config *config,
return ERR_VAL;
}

ret = mbedtls_pk_parse_key(pkey, (const unsigned char *) privkey, privkey_len, privkey_pass, privkey_pass_len);
ret = mbedtls_pk_parse_key(pkey, (const unsigned char *) privkey, privkey_len, privkey_pass, privkey_pass_len, mbedtls_ctr_drbg_random, &altcp_tls_entropy_rng->ctr_drbg);
if (ret != 0) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_pk_parse_public_key failed: %d\n", ret));
mbedtls_x509_crt_free(srvcert);
Expand Down Expand Up @@ -953,7 +954,7 @@ altcp_tls_create_config_server_privkey_cert(const u8_t *privkey, size_t privkey_
}

static struct altcp_tls_config *
altcp_tls_create_config_client_common(const u8_t *ca, size_t ca_len, int is_2wayauth)
altcp_tls_create_config_client_common(const u8_t *ca, size_t ca_len, int is_2wayauth, char *host)
{
int ret;
struct altcp_tls_config *conf = altcp_tls_create_config(0, (is_2wayauth) ? 1 : 0, (is_2wayauth) ? 1 : 0, ca != NULL);
Expand All @@ -975,13 +976,15 @@ altcp_tls_create_config_client_common(const u8_t *ca, size_t ca_len, int is_2way

mbedtls_ssl_conf_ca_chain(&conf->conf, conf->ca, NULL);
}

memcpy(conf->host, host, sizeof(conf->host));
return conf;
}

struct altcp_tls_config *
altcp_tls_create_config_client(const u8_t *ca, size_t ca_len)
altcp_tls_create_config_client(const u8_t *ca, size_t ca_len, char *host)
{
return altcp_tls_create_config_client_common(ca, ca_len, 0);
return altcp_tls_create_config_client_common(ca, ca_len, 0, host);
}

struct altcp_tls_config *
Expand All @@ -997,7 +1000,7 @@ altcp_tls_create_config_client_2wayauth(const u8_t *ca, size_t ca_len, const u8_
return NULL;
}

conf = altcp_tls_create_config_client_common(ca, ca_len, 1);
conf = altcp_tls_create_config_client_common(ca, ca_len, 1, NULL);
if (conf == NULL) {
return NULL;
}
Expand All @@ -1012,7 +1015,7 @@ altcp_tls_create_config_client_2wayauth(const u8_t *ca, size_t ca_len, const u8_
}

mbedtls_pk_init(conf->pkey);
ret = mbedtls_pk_parse_key(conf->pkey, privkey, privkey_len, privkey_pass, privkey_pass_len);
ret = mbedtls_pk_parse_key(conf->pkey, privkey, privkey_len, privkey_pass, privkey_pass_len, mbedtls_ctr_drbg_random, &altcp_tls_entropy_rng->ctr_drbg);
if (ret != 0) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_pk_parse_key failed: %d 0x%x\n", ret, -1*ret));
altcp_tls_free_config(conf);
Expand Down Expand Up @@ -1198,7 +1201,7 @@ altcp_mbedtls_sndbuf(struct altcp_pcb *conn)
size_t ret;
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
/* @todo: adjust ssl_added to real value related to negotiated cipher */
size_t max_frag_len = mbedtls_ssl_get_max_frag_len(&state->ssl_context);
size_t max_frag_len = mbedtls_ssl_get_max_in_record_payload(&state->ssl_context);
max_len = LWIP_MIN(max_frag_len, max_len);
#endif
/* Adjust sndbuf of inner_conn with what added by SSL */
Expand Down Expand Up @@ -1241,9 +1244,9 @@ altcp_mbedtls_write(struct altcp_pcb *conn, const void *dataptr, u16_t len, u8_t
/* HACK: if there is something left to send, try to flush it and only
allow sending more if this succeeded (this is a hack because neither
returning 0 nor MBEDTLS_ERR_SSL_WANT_WRITE worked for me) */
if (state->ssl_context.out_left) {
if (state->ssl_context.MBEDTLS_PRIVATE(out_left)) {
altcp_mbedtls_flush_output(state);
if (state->ssl_context.out_left) {
if (state->ssl_context.MBEDTLS_PRIVATE(out_left)) {
return ERR_MEM;
}
}
Expand Down Expand Up @@ -1293,6 +1296,8 @@ altcp_mbedtls_bio_send(void *ctx, const unsigned char *dataptr, size_t size)
while (size_left) {
u16_t write_len = (u16_t)LWIP_MIN(size_left, 0xFFFF);
err_t err = altcp_write(conn->inner_conn, (const void *)dataptr, write_len, apiflags);
/* try to send data... */
altcp_output(conn->inner_conn);
if (err == ERR_OK) {
written += write_len;
size_left -= write_len;
Expand Down
10 changes: 1 addition & 9 deletions src/core/tcp_out.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1255,14 +1255,6 @@ tcp_output(struct tcp_pcb *pcb)
LWIP_ASSERT("don't call tcp_output for listen-pcbs",
pcb->state != LISTEN);

/* First, check if we are invoked by the TCP input processing
code. If so, we do not output anything. Instead, we rely on the
input processing code to call us when input processing is done
with. */
if (tcp_input_pcb == pcb) {
return ERR_OK;
}

wnd = LWIP_MIN(pcb->snd_wnd, pcb->cwnd);

seg = pcb->unsent;
Expand Down Expand Up @@ -2039,7 +2031,7 @@ tcp_rst(const struct tcp_pcb *pcb, u32_t seqno, u32_t ackno,
u16_t local_port, u16_t remote_port)
{
struct pbuf *p;

p = tcp_rst_common(pcb, seqno, ackno, local_ip, remote_ip, local_port, remote_port);
if (p != NULL) {
tcp_output_control_segment(pcb, p, local_ip, remote_ip);
Expand Down
2 changes: 1 addition & 1 deletion src/include/lwip/altcp_tls.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ struct altcp_tls_config *altcp_tls_create_config_server_privkey_cert(const u8_t
/** @ingroup altcp_tls
* Create an ALTCP_TLS client configuration handle
*/
struct altcp_tls_config *altcp_tls_create_config_client(const u8_t *cert, size_t cert_len);
struct altcp_tls_config *altcp_tls_create_config_client(const u8_t *cert, size_t cert_len, char *host);

/** @ingroup altcp_tls
* Create an ALTCP_TLS client configuration handle with two-way server/client authentication
Expand Down