8000 Native BareSSL support for ESP8266 · IceWalnut/arduinoWebSockets@91b0234 · GitHub
[go: up one dir, main page]
Skip to content

Commit 91b0234

Browse files
Links2004Links2004
committed
Native BareSSL support for ESP8266
see Links2004#557, Links2004#509, Links2004#492, Links2004#555, Links2004#352
1 parent a00d3ed commit 91b0234

File tree

4 files changed

+69
-13
lines changed

4 files changed

+69
-13
lines changed

‎src/WebSockets.h

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,7 @@
126126
#elif defined(ESP32)
127127
#include <WiFi.h>
128128
#include <WiFiClientSecure.h>
129+
#define SSL_AXTLS
129130
#elif defined(ESP31B)
130131
#include <ESP31BWiFi.h>
131132
#else
@@ -145,6 +146,11 @@
145146

146147
#ifdef ESP8266
147148
#include <ESP8266WiFi.h>
149+
#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h)
150+
#define SSL_BARESSL
151+
#else
152+
#define SSL_AXTLS
153+
#endif
148154
#else
149155
#include <ESP31BWiFi.h>
150156
#endif
@@ -174,6 +180,7 @@
174180

175181
#include <WiFi.h>
176182
#include <WiFiClientSecure.h>
183+
#define SSL_AXTLS
177184
#define WEBSOCKETS_NETWORK_CLASS WiFiClient
178185
#define WEBSOCKETS_NETWORK_SSL_CLASS WiFiClientSecure
179186
#define WEBSOCKETS_NETWORK_SERVER_CLASS WiFiServer

‎src/WebSocketsClient.cpp

Lines changed: 47 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ void WebSocketsClient::begin(const char * host, uint16_t port, const char * url,
4646
_host = host;
4747
_port = port;
4848
#if defined(HAS_SSL)
49-
_fingerprint = "";
49+
_fingerprint = SSL_FINGERPRINT_NULL;
5050
_CA_cert = NULL;
5151
#endif
5252

@@ -97,6 +97,7 @@ void WebSocketsClient::begin(IPAddress host, uint16_t port, const char * url, co
9797
}
9898

9999
#if defined(HAS_SSL)
100+
#if defined(SSL_AXTLS)
100101
void WebSocketsClient::beginSSL(const char * host, uint16_t port, const char * url, const char * fingerprint, const char * protocol) {
101102
begin(host, port, url, protocol);
102103
_client.isSSL = true;
@@ -111,10 +112,31 @@ void WebSocketsClient::beginSSL(String host, uint16_t port, String url, String f
111112
void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
112113
begin(host, port, url, protocol);
113114
_client.isSSL = true;
114-
_fingerprint = "";
115+
_fingerprint = SSL_FINGERPRINT_NULL;
115116
_CA_cert = CA_cert;
116117
}
117-
#endif
118+
#else
119+
void WebSocketsClient::beginSSL(const char * host, uint16_t port, const char * url, const uint8_t * fingerprint, const char * protocol) {
120+
begin(host, port, url, protocol);
121+
_client.isSSL = true;
122+
_fingerprint = fingerprint;
123+
_CA_cert = NULL;
124+
}
125+
void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, const char * CA_cert, const char * protocol) {
126+
begin(host, port, url, protocol);
127+
_client.isSSL = true;
128+
_fingerprint = SSL_FINGERPRINT_NULL;
129+
_CA_cert = new BearSSL::X509List(CA_cert);
130+
}
131+
132+
void WebSocketsClient::beginSslWithCA(const char * host, uint16_t port, const char * url, BearSSL::X509List * CA_cert, const char * protocol) {
133+
begin(host, port, url, protocol);
134+
_client.isSSL = true;
135+
_fingerprint = SSL_FINGERPRINT_NULL;
136+
_CA_cert = CA_cert;
137+
}
138+
#endif // SSL_AXTLS
139+
#endif // HAS_SSL
118140

119141
void WebSocketsClient::beginSocketIO(const char * host, uint16_t port, const char * url, const char * protocol) {
120142
begin(host, port, url, protocol);
@@ -130,7 +152,7 @@ void WebSocketsClient::beginSocketIOSSL(const char * host, uint16_t port, const
130152
begin(host, port, url, protocol);
131153
_client.isSocketIO = true;
132154
_client.isSSL = true;
133-
_fingerprint = "";
155+
_fingerprint = SSL_FINGERPRINT_NULL;
134156
}
135157

136158
void WebSocketsClient::beginSocketIOSSL(String host, uint16_t port, String url, String protocol) {
@@ -141,8 +163,12 @@ void WebSocketsClient::beginSocketIOSSLWithCA(const char * host, uint16_t port,
141163
begin(host, port, url, protocol);
142164
_client.isSocketIO = true;
143165
_client.isSSL = true;
144-
_fingerprint = "";
145-
_CA_cert = CA_cert;
166+
_fingerprint = SSL_FINGERPRINT_NULL;
167+
#if defined(SSL_AXTLS)
168+
_CA_cert = CA_cert;
169+
#else
170+
_CA_cert = new BearSSL::X509List(CA_cert);
171+
#endif
146172
}
147173
#endif
148174

@@ -175,14 +201,20 @@ void WebSocketsClient::loop(void) {
175201
DEBUG_WEBSOCKETS("[WS-Client] setting CA certificate");
176202
#if defined(ESP32)
177203
_client.ssl->setCACert(_CA_cert);
178-
#elif defined(ESP8266)
204+
#elif defined(ESP8266) && defined(SSL_AXTLS)
179205
_client.ssl->setCACert((const uint8_t *)_CA_cert, strlen(_CA_cert) + 1);
206+
#elif defined(ESP8266) && defined(SSL_BARESSL)
207+
_client.ssl->setTrustAnchors(_CA_cert);
180208
#else
181209
#error setCACert not implemented
182210
#endif
183-
} else if(_fingerprint.length()) {
184-
#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h)
185-
_client.ssl->setFingerprint(_fingerprint.c_str());
211+
#if defined(SSL_BARESSL)
212+
} else if(_fingerprint) {
213+
_client.ssl->setFingerprint(_fingerprint);
214+
#endif
215+
} else {
216+
#if defined(SSL_BARESSL)
217+
_client.ssl->setInsecure();
186218
#endif
187219
}
188220
} else {
@@ -774,14 +806,18 @@ void WebSocketsClient::connectedCb() {
774806
#endif
775807

776808
#if defined(HAS_SSL)
809+
#if defined(SSL_AXTLS) || defined(ESP32)
777810
if(_client.isSSL && _fingerprint.length()) {
778811
if(!_client.ssl->verify(_fingerprint.c_str(), _host.c_str())) {
779812
DEBUG_WEBSOCKETS("[WS-Client] certificate mismatch\n");
780813
WebSockets::clientDisconnect(&_client, 1000);
781814
return;
782815
}
816+
#else
817+
if(_client.isSSL && _fingerprint) {
818+
#endif
783819
} else if(_client.isSSL && !_CA_cert) {
784-
#if defined(wificlientbearssl_h) && !defined(USING_AXTLS) && !defined(wificlientsecure_h)
820+
#if defined(SSL_BARESSL)
785821
_client.ssl->setInsecure();
786822
#endif
787823
}

‎src/WebSocketsClient.h

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,13 @@ class WebSocketsClient : protected WebSockets {
4343
void begin(IPAddress host, uint16_t port, const char * url = "/", const char * protocol = "arduino");
4444

4545
#if defined(HAS_SSL)
46-
void beginSSL(const char * host, uint16_t port, const char * url = "/", const char * = "", const char * protocol = "arduino");
46+
#ifdef SSL_AXTLS
47+
void beginSSL(const char * host, uint16_t port, const char * url = "/", const char * fingerprint = "", const char * protocol = "arduino");
4748
void beginSSL(String host, uint16_t port, String url = "/", String fingerprint = "", String protocol = "arduino");
49+
#else
50+
void beginSSL(const char * host, uint16_t port, const char * url = "/", const uint8_t * fingerprint = NULL, const char * protocol = "arduino");
51+
void beginSslWithCA(const char * host, uint16_t port, const char * url = "/", BearSSL::X509List * CA_cert = NULL, const char * protocol = "arduino");
52+
#endif
4853
void beginSslWithCA(const char * host, uint16_t port, const char * url = "/", const char * CA_cert = NULL, const char * protocol = "arduino");
4954
#endif
5055

@@ -98,8 +103,16 @@ class WebSocketsClient : protected WebSockets {
98103
uint16_t _port;
99104

100105
#if defined(HAS_SSL)
106+
#ifdef SSL_AXTLS
101107
String _fingerprint;
102108
const char * _CA_cert;
109+
#define SSL_FINGERPRINT_NULL ""
110+
#else
111+
const uint8_t * _fingerprint;
112+
BearSSL::X509List * _CA_cert;
113+
#define SSL_FINGERPRINT_NULL NULL
114+
#endif
115+
103116
#endif
104117
WSclient_t _client;
105118

‎src/WebSocketsServer.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -424,7 +424,7 @@ int WebSocketsServer::connectedClients(bool ping) {
424424
* @param num uint8_t client id
425425
*/
426426
bool WebSocketsServer::clientIsConnected(uint8_t num) {
427-
if(num >= WEBSOCKETS_SERVER_CLIENT_MAX) {
427+
if(num >= WEBSOCKETS_SERVER_CLIENT_MAX) {
428428
return false;
429429
}
430430
WSclient_t * client = &_clients[num];

0 commit comments

Comments
 (0)
0