Skip to content

Commit d87e59a

Browse files
JasenKolevJasenKolev
committed
change from openssl to esp_tls
1 parent 2780e9f commit d87e59a

6 files changed

Lines changed: 86 additions & 72 deletions

File tree

‎src/ConnectionContext.hpp‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@
55
#include <IPAddress.h>
66

77
// Required for SSL
8-
#include "openssl/ssl.h"
9-
#undef read
10-
8+
//#include "openssl/ssl.h"
9+
//#undef read
10+
#include <esp_tls.h>
1111
namespace httpsserver {
1212

1313
class WebsocketHandler;

‎src/HTTPResponse.hpp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,8 @@
99
#undef write
1010
#include <vector>
1111

12-
#include <openssl/ssl.h>
12+
//#include <openssl/ssl.h>
13+
#include <esp_tls.h>
1314

1415
#include "util.hpp"
1516

‎src/HTTPSConnection.cpp‎

Lines changed: 28 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -22,33 +22,36 @@ bool HTTPSConnection::isSecure() {
2222
*
2323
* The call WILL BLOCK if accept(serverSocketID) blocks. So use select() to check for that in advance.
2424
*/
25-
int HTTPSConnection::initialize(int serverSocketID, SSL_CTX * sslCtx, HTTPHeaders *defaultHeaders) {
25+
int HTTPSConnection::initialize(int serverSocketID, esp_tls_t * sslCtx, esp_tls_cfg_server_t * cfgSrv, HTTPHeaders *defaultHeaders) {
2626
if (_connectionState == STATE_UNDEFINED) {
2727
// Let the base class connect the plain tcp socket
2828
int resSocket = HTTPConnection::initialize(serverSocketID, defaultHeaders);
29-
29+
3030
// Build up SSL Connection context if the socket has been created successfully
3131
if (resSocket >= 0) {
32-
33-
_ssl = SSL_new(sslCtx);
34-
35-
if (_ssl) {
32+
// _ssl = SSL_new(sslCtx);
33+
int res=esp_tls_server_session_create(cfgSrv,resSocket,sslCtx);
34+
if (0==res) {
35+
esp_tls_cfg_server_session_tickets_init(cfgSrv);
36+
_ssl = sslCtx;
37+
_cfg = cfgSrv;
38+
3639
// Bind SSL to the socket
37-
int success = SSL_set_fd(_ssl, resSocket);
38-
if (success) {
39-
40-
// Perform the handshake
41-
success = SSL_accept(_ssl);
42-
if (success) {
40+
// int success = SSL_set_fd(_ssl, resSocket);
41+
if (ESP_OK == esp_tls_get_conn_sockfd(sslCtx,&resSocket)) {
42+
43+
// // Perform the handshake
44+
// success = SSL_accept(_ssl);
45+
// if (success) {
4346
return resSocket;
44-
} else {
45-
HTTPS_LOGE("SSL_accept failed. Aborting handshake. FID=%d", resSocket);
46-
}
4747
} else {
48-
HTTPS_LOGE("SSL_set_fd failed. Aborting handshake. FID=%d", resSocket);
48+
HTTPS_LOGE("SSL_accept failed. Aborting handshake. FID=%d", resSocket);
4949
}
50+
// } else {
51+
// HTTPS_LOGE("SSL_set_fd failed. Aborting handshake. FID=%d", resSocket);
52+
// }
5053
} else {
51-
HTTPS_LOGE("SSL_new failed. Aborting handshake. FID=%d", resSocket);
54+
HTTPS_LOGE("SSL_new failed. Aborting handshake. Error=%d", res);
5255
}
5356

5457
} else {
@@ -84,18 +87,10 @@ void HTTPSConnection::closeConnection() {
8487

8588
// Try to tear down SSL while we are in the _shutdownTS timeout period or if an error occurred
8689
if (_ssl) {
87-
if(_connectionState == STATE_ERROR || SSL_shutdown(_ssl) == 0) {
88-
// SSL_shutdown will return 1 as soon as the client answered with close notify
89-
// This means we are safe to close the socket
90-
SSL_free(_ssl);
91-
_ssl = NULL;
92-
} else if (_shutdownTS + HTTPS_SHUTDOWN_TIMEOUT < millis()) {
93-
// The timeout has been hit, we force SSL shutdown now by freeing the context
94-
SSL_free(_ssl);
95-
_ssl = NULL;
96-
HTTPS_LOGW("SSL_shutdown did not receive close notification from the client");
97-
_connectionState = STATE_ERROR;
98-
}
90+
esp_tls_cfg_server_session_tickets_free(_cfg);
91+
esp_tls_server_session_delete(_ssl);
92+
_ssl = NULL;
93+
_connectionState = STATE_ERROR;
9994
}
10095

10196
// If SSL has been brought down, close the socket
@@ -105,19 +100,19 @@ void HTTPSConnection::closeConnection() {
105100
}
106101

107102
size_t HTTPSConnection::writeBuffer(byte* buffer, size_t length) {
108-
return SSL_write(_ssl, buffer, length);
103+
return esp_tls_conn_write(_ssl,buffer,length);// SSL_write(_ssl, buffer, length);
109104
}
110105

111106
size_t HTTPSConnection::readBytesToBuffer(byte* buffer, size_t length) {
112-
return SSL_read(_ssl, buffer, length);
107+
return esp_tls_conn_read(_ssl, buffer, length);
113108
}
114109

115110
size_t HTTPSConnection::pendingByteCount() {
116-
return SSL_pending(_ssl);
111+
return esp_tls_get_bytes_avail(_ssl);
117112
}
118113

119114
bool HTTPSConnection::canReadData() {
120-
return HTTPConnection::canReadData() || (SSL_pending(_ssl) > 0);
115+
return HTTPConnection::canReadData() || (esp_tls_get_bytes_avail(_ssl) > 0);
121116
}
122117

123118
} /* namespace httpsserver */

‎src/HTTPSConnection.hpp‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,9 @@
66
#include <string>
77

88
// Required for SSL
9-
#include "openssl/ssl.h"
10-
#undef read
9+
//#include "openssl/ssl.h"
10+
//#undef read
11+
#include <esp_tls.h>
1112

1213
// Required for sockets
1314
#include "lwip/netdb.h"
@@ -34,7 +35,7 @@ class HTTPSConnection : public HTTPConnection {
3435
HTTPSConnection(ResourceResolver * resResolver);
3536
virtual ~HTTPSConnection();
3637

37-
virtual int initialize(int serverSocketID, SSL_CTX * sslCtx, HTTPHeaders *defaultHeaders);
38+
virtual int initialize(int serverSocketID, esp_tls_t * sslCtx,esp_tls_cfg_server_t * cfgSrv, HTTPHeaders *defaultHeaders);
3839
virtual void closeConnection();
3940
virtual bool isSecure();
4041

@@ -49,8 +50,8 @@ class HTTPSConnection : public HTTPConnection {
4950

5051
private:
5152
// SSL context for this connection
52-
SSL * _ssl;
53-
53+
esp_tls_t * _ssl;
54+
esp_tls_cfg_server_t * _cfg;
5455
};
5556

5657
} /* namespace httpsserver */

‎src/HTTPSServer.cpp‎

Lines changed: 40 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2,17 +2,24 @@
22

33
namespace httpsserver {
44

5+
constexpr char * alpn_protos[] = { "h2", NULL } ;
56

67
HTTPSServer::HTTPSServer(SSLCert * cert, const uint16_t port, const uint8_t maxConnections, const in_addr_t bindAddress):
78
HTTPServer(port, maxConnections, bindAddress),
89
_cert(cert) {
9-
10+
1011
// Configure runtime data
1112
_sslctx = NULL;
13+
_cfg = new esp_tls_cfg_server();
14+
_cfg->alpn_protos = (const char **)alpn_protos;
15+
_cfg->servercert_buf =cert->getCertData();
16+
_cfg->servercert_bytes = cert->getPKLength();
17+
_cfg->serverkey_buf= cert->getPKData();
18+
_cfg->serverkey_bytes= cert->getPKLength();
1219
}
1320

1421
HTTPSServer::~HTTPSServer() {
15-
22+
free(_cfg);
1623
}
1724

1825
/**
@@ -27,7 +34,7 @@ uint8_t HTTPSServer::setupSocket() {
2734

2835
if (!setupCert()) {
2936
Serial.println("setupCert failed");
30-
SSL_CTX_free(_sslctx);
37+
// SSL_CTX_free(_sslctx);
3138
_sslctx = NULL;
3239
return 0;
3340
}
@@ -36,7 +43,7 @@ uint8_t HTTPSServer::setupSocket() {
3643
return 1;
3744
} else {
3845
Serial.println("setupSockets failed");
39-
SSL_CTX_free(_sslctx);
46+
// SSL_CTX_free(_sslctx);
4047
_sslctx = NULL;
4148
return 0;
4249
}
@@ -50,27 +57,29 @@ void HTTPSServer::teardownSocket() {
5057
HTTPServer::teardownSocket();
5158

5259
// Tear down the SSL context
53-
SSL_CTX_free(_sslctx);
60+
if (NULL != _sslctx)
61+
//SSL_CTX_free(_sslctx);
5462
_sslctx = NULL;
5563
}
5664

5765
int HTTPSServer::createConnection(int idx) {
5866
HTTPSConnection * newConnection = new HTTPSConnection(this);
5967
_connections[idx] = newConnection;
60-
return newConnection->initialize(_socket, _sslctx, &_defaultHeaders);
68+
return newConnection->initialize(_socket, _sslctx, _cfg , &_defaultHeaders);
6169
}
6270

6371
/**
6472
* This method configures the ssl context that is used for the server
6573
*/
6674
uint8_t HTTPSServer::setupSSLCTX() {
67-
_sslctx = SSL_CTX_new(TLSv1_2_server_method());
68-
if (_sslctx) {
75+
76+
// _sslctx = SSL_CTX_new(TLSv1_2_server_method());
77+
_sslctx = esp_tls_init();
78+
if (NULL != _sslctx) {
6979
// Set SSL Timeout to 5 minutes
70-
SSL_CTX_set_timeout(_sslctx, 300);
80+
// SSL_CTX_set_timeout(_sslctx, 300);
7181
return 1;
7282
} else {
73-
_sslctx = NULL;
7483
return 0;
7584
}
7685
}
@@ -81,22 +90,27 @@ uint8_t HTTPSServer::setupSSLCTX() {
8190
*/
8291
uint8_t HTTPSServer::setupCert() {
8392
// Configure the certificate first
84-
uint8_t ret = SSL_CTX_use_certificate_ASN1(
85-
_sslctx,
86-
_cert->getCertLength(),
87-
_cert->getCertData()
88-
);
89-
90-
// Then set the private key accordingly
91-
if (ret) {
92-
ret = SSL_CTX_use_RSAPrivateKey_ASN1(
93-
_sslctx,
94-
_cert->getPKData(),
95-
_cert->getPKLength()
96-
);
97-
}
98-
99-
return ret;
93+
_cfg->servercert_buf= _cert->getCertData();
94+
_cfg->servercert_bytes = _cert->getPKLength();
95+
_cfg->serverkey_buf= _cert->getPKData();
96+
_cfg->serverkey_bytes= _cert->getPKLength();
97+
98+
// uint8_t ret = SSL_CTX_use_certificate_ASN1(
99+
// _sslctx,
100+
// _cert->getCertLength(),
101+
// _cert->getCertData()
102+
// );
103+
104+
// // Then set the private key accordingly
105+
// if (ret) {
106+
// ret = SSL_CTX_use_RSAPrivateKey_ASN1(
107+
// _sslctx,
108+
// _cert->getPKData(),
109+
// _cert->getPKLength()
110+
// );
111+
// }
112+
113+
return 1;
100114
}
101115

102116
} /* namespace httpsserver */

‎src/HTTPSServer.hpp‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@
88
#include <Arduino.h>
99

1010
// Required for SSL
11-
#include "openssl/ssl.h"
12-
#undef read
11+
//#include "openssl/ssl.h"
12+
#include <esp_tls.h>
13+
//#undef read
1314

1415
// Internal includes
1516
#include "HTTPServer.hpp"
@@ -31,14 +32,16 @@ class HTTPSServer : public HTTPServer {
3132
public:
3233
HTTPSServer(SSLCert * cert, const uint16_t portHTTPS = 443, const uint8_t maxConnections = 4, const in_addr_t bindAddress = 0);
3334
virtual ~HTTPSServer();
34-
35+
virtual esp_tls_cfg_server_t *getConfig() {return _cfg;}
3536
private:
3637
// Static configuration. Port, keys, etc. ====================
3738
// Certificate that should be used (includes private key)
3839
SSLCert * _cert;
3940

4041
//// Runtime data ============================================
41-
SSL_CTX * _sslctx;
42+
//SSL_CTX * _sslctx;
43+
esp_tls_t * _sslctx;
44+
esp_tls_cfg_server_t * _cfg;
4245
// Status of the server: Are we running, or not?
4346

4447
// Setup functions

0 commit comments

Comments
 (0)