8000 Add SSL client certificate support (#572) · AlphaHolding/arduinoWebSockets@80bf087 · GitHub
[go: up one dir, main page]
Skip to content

Commit 80bf087

Browse files
itay7564itay7564
authored
Add SSL client certificate support (Links2004#572)
* Add client certificate support allows WiFiClientSecureBearSSL users to use client certificate and private key for the WebSocker. also added SSL functions for socket.io
1 parent 5caff59 commit 80bf087

File tree

5 files changed

+87
-11
lines changed

5 files changed

+87
-11
lines changed

‎examples/esp8266/WebSocketClientSSLWithCA/WebSocketClientSSLWithCA.ino

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -90,6 +90,10 @@ void setup() {
9090
delay(100);
9191
}
9292

93+
//When using BearSSL, client certificate and private key can be set:
94+
//webSocket.setSSLClientCertKey(clientCert, clientPrivateKey);
95+
//clientCert and clientPrivateKey can be of types (const char *, const char *) , or of types (BearSSL::X509List, BearSSL::PrivateKey)
96+
9397
webSocket.beginSslWithCA("echo.websocket.org", 443, "/", ENDPOINT_CA_CERT);
9498
webSocket.onEvent(webSocketEvent);
9599
}

‎src/SocketIOclient.cpp

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,37 @@ void SocketIOclient::begin(String host, uint16_t port, String url, String protoc
2424
WebSocketsClient::beginSocketIO(host, port, url, protocol);
2525
WebSocketsClient::enableHeartbeat(60 * 1000, 90 * 1000, 5);
2626
}
27+
#if defined(HAS_SSL)
28+
void SocketIOclient::beginSSL(const char * host, uint16_t port, const char * url, const char * protocol) {
29+
WebSocketsClient::beginSocketIOSSL(host, port, url, protocol);
30+
WebSocketsClient::enableHeartbeat(60 * 1000, 90 * 1000, 5);
31+
}
32+
33+
void SocketIOclient::beginSSL(String host, uint16_t port, String url, String protocol) {
34+
WebSocketsClient::beginSocketIOSSL(host, port, url, protocol);
35+
WebSocketsClient::enableHeartbeat(60 * 1000, 90 * 1000, 5);
36+
}
37+
#if !defined(SSL_AXTLS)
38+
void SocketIOclient::beginSSLWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
39+
WebSocketsClient::beginSocketIOSSLWithCA(host, port, url, CA_cert, protocol);
40+
WebSocketsClient::enableHeartbeat(60 * 1000, 90 * 1000, 5);
41+
}
42+
43+
void SocketIOclient::beginSSLWithCA(const char * host, uint16_t port, const char * url, BearSSL::X509List * CA_cert, const char * protocol) {
44+
WebSocketsClient::beginSocketIOSSLWithCA(host, port, url, CA_cert, protocol);
45+
WebSocketsClient::enableHeartbeat(60 * 1000, 90 * 1000, 5);
46+
}
47+
48+
void SocketIOclient::setSSLClientCertKey(const char * clientCert, const char * clientPrivateKey) {
49+
WebSocketsClient::setSSLClientCertKey(clientCert, clientPrivateKey);
50+
}
51+
52+
void SocketIOclient::setSSLClientCertKey(BearSSL::X509List * clientCert, BearSSL::PrivateKey * clientPrivateKey) {
53+
WebSocketsClient::setSSLClientCertKey(clientCert, clientPrivateKey);
54+
}
2755

56+
#endif
57+
#endif
2858
/**
2959
* set callback function
3060
* @param cbEvent SocketIOclientEvent

‎src/SocketIOclient.h

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,16 @@ class SocketIOclient : protected WebSocketsClient {
4949
void begin(const char * host, uint16_t port, const char * url = "/socket.io/?EIO=3", const char * protocol = "arduino");
5050
void begin(String host, uint16_t port, String url = "/socket.io/?EIO=3", String protocol = "arduino");
5151

52+
#ifdef HAS_SSL
53+
void beginSSL(const char * host, uint16_t port, const char * url = "/socket.io/?EIO=3", const char * protocol = "arduino");
54+
void beginSSL(String host, uint16_t port, String url = "/socket.io/?EIO=3", String protocol = "arduino");
55+
#ifndef SSL_AXTLS
56+
void beginSSLWithCA(const char * host, uint16_t port, const char * url = "/socket.io/?EIO=3", const char * CA_cert = NULL, const char * protocol = "arduino");
57+
void beginSSLWithCA(const char * host, uint16_t port, const char * url = "/socket.io/?EIO=3", BearSSL::X509List * CA_cert = NULL, const char * protocol = "arduino");
58+
void setSSLClientCertKey(const char * clientCert = NULL, const char * clientPrivateKey = NULL);
59+
void setSSLClientCertKey(BearSSL::X509List * clientCert = NULL, BearSSL::PrivateKey * clientPrivateKey = NULL);
60+
#endif
61+
#endif
5262
bool isConnected(void);
5363

5464
void onEvent(SocketIOclientEvent cbEvent);

‎src/WebSocketsClient.cpp

Lines changed: 34 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -122,19 +122,27 @@ void WebSocketsClient::beginSSL(const char * host, uint16_t port, const char * u
122122
_fingerprint = fingerprint;
123123
_CA_cert = NULL;
124124
}
125-
void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
126-
begin(host, port, url, protocol);
127-
_client.isSSL = true;
128-
_fingerprint = SSL_FINGERPRINT_NULL;
129-
_CA_cert = new BearSSL::X509List(CA_cert);
130-
}
131125

132126
void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, BearSSL::X509List * CA_cert, const char * protocol) {
133127
begin(host, port, url, protocol);
134128
_client.isSSL = true;
135129
_fingerprint = SSL_FINGERPRINT_NULL;
136130
_CA_cert = CA_cert;
137131
}
132+
133+
void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
134+
beginSslWithCA(host, port, url, new BearSSL::X509List(CA_cert), protocol);
135+
}
136+
137+
void WebSocketsClient::setSSLClientCertKey(BearSSL::X509List * clientCert, BearSSL::PrivateKey * clientPrivateKey) {
138+
_client_cert = clientCert;
139+
_client_key = clientPrivateKey;
140+
}
141+
142+
void WebSocketsClient::setSSLClientCertKey(const char * clientCert, const char * clientPrivateKey) {
143+
setSSLClientCertKey(new BearSSL::X509List(clientCert), new BearSSL::PrivateKey(clientPrivateKey));
144+
}
145+
138146
#endif // SSL_AXTLS
139147
#endif // HAS_SSL
140148

@@ -148,7 +156,7 @@ void WebSocketsClient::beginSocketIO(String host, uint16_t port, String url, Str
148156
}
149157

150158
#if defined(HAS_SSL)
151-
void WebSocketsClient::beginSocketIOSSL(const char * host, uint16_t port, const char * url, const char * protocol) {
159+
void WebSocketsClient::beginSocketIOSSL(const char * host, uint16_t port, const char * url, const char * protocol) {
152160
begin(host, port, url, protocol);
153161
_client.isSocketIO = true;
154162
_client.isSSL = true;
@@ -159,17 +167,29 @@ void WebSocketsClient::beginSocketIOSSL(String host, uint16_t port, String url,
159167
beginSocketIOSSL(host.c_str(), port, url.c_str(), protocol.c_str());
160168
}
161169

162-
void WebSocketsClient::beginSocketIOSSLWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
170+
#if defined(SSL_BARESSL)
171+
void WebSocketsClient::beginSocketIOSSLWithCA(const char * host, uint16_t port, const char * url, BearSSL::X509List * CA_cert, const char * protocol) {
163172
begin(host, port, url, protocol);
164173
_client.isSocketIO = true;
165174
_client.isSSL = true;
166175
_fingerprint = SSL_FINGERPRINT_NULL;
167-
#if defined(SSL_AXTLS)
168176
_CA_cert = CA_cert;
169-
#else
177+
}
178+
#endif
179+
180+
void WebSocketsClient::beginSocketIOSSLWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
181+
begin(host, port, url, protocol);
182+
_client.isSocketIO = true;
183+
_client.isSSL = true;
184+
_fingerprint = SSL_FINGERPRINT_NULL;
185+
#if defined(SSL_BARESSL)
170186
_CA_cert = new BearSSL::X509List(CA_cert);
187+
#else
188+
_CA_cert = CA_cert;
171189
#endif
172190
}
191+
192+
173193
#endif
174194

175195
#if(WEBSOCKETS_NETWORK_TYPE != NETWORK_ESP8266_ASYNC)
@@ -213,6 +233,10 @@ void WebSocketsClient::loop(void) {
213233
_client.ssl->setFingerprint(_fingerprint);
214234
} else {
215235
_client.ssl->setInsecure();
236+
}
237+
if(_client_cert && _client_key) {
238+
_client.ssl->setClientRSACert(_client_cert, _client_key);
239+
DEBUG_WEBSOCKETS("[WS-Client] setting client certificate and key");
216240
#endif
217241
}
218242
} else {

‎src/WebSocketsClient.h

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ class WebSocketsClient : protected WebSockets {
4949
#else
5050
void beginSSL(const char * host, uint16_t port, const char * url = "/", const uint8_t * fingerprint = NULL, const char * protocol = "arduino");
5151
void beginSslWithCA(const char * host, uint16_t port, const char * url = "/", BearSSL::X509List * CA_cert = NULL, const char * protocol = "arduino");
52+
void setSSLClientCertKey(BearSSL::X509List * clientCert = NULL, BearSSL::PrivateKey * clientPrivateKey = NULL);
53+
void setSSLClientCertKey(const char * clientCert = NULL, const char * clientPrivateKey = NULL);
5254
#endif
5355
void beginSslWithCA(const char * host, uint16_t port, const char * url = "/", const char * CA_cert = NULL, const char * protocol = "arduino");
5456
#endif
@@ -59,9 +61,13 @@ class WebSocketsClient : protected WebSockets {
5961
#if defined(HAS_SSL)
6062
void beginSocketIOSSL(const char * host, uint16_t port, const char * url = "/socket.io/?EIO=3", const char * protocol = "arduino");
6163
void beginSocketIOSSL(String host, uint16_t port, String url = "/socket.io/?EIO=3", String protocol = "arduino");
64+
6265
void beginSocketIOSSLWithCA(const char * host, uint16_t port, const char * url = "/socket.io/?EIO=3", const char * CA_cert = NULL, const char * protocol = "arduino");
66+
#if defined(SSL_BARESSL)
67+
void beginSocketIOSSLWithCA(const char * host, uint16_t port, const char * url = "/socket.io/?EIO=3", BearSSL::X509List * CA_cert = NULL, const char * protocol = "arduino");
6368
#endif
64-
69+
#endif
70+
6571
#if(WEBSOCKETS_NETWORK_TYPE != NETWORK_ESP8266_ASYNC)
6672
void loop(void);
6773
#else
@@ -110,6 +116,8 @@ class WebSocketsClient : protected WebSockets {
110116
#else
111117
const uint8_t * _fingerprint;
112118
BearSSL::X509List * _CA_cert;
119+
BearSSL::X509List * _client_cert;
120+
BearSSL::PrivateKey * _client_key;
113121
#define SSL_FINGERPRINT_NULL NULL
114122
#endif
115123

0 commit comments

Comments
 (0)
0