-
-
Notifications
You must be signed in to change notification settings - Fork 180
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Add target mbedTLS config file. - Add platform CMake to include mbedTLS source in network build. - Add platform implementation of random generator for mbedTLS. - Rework inclusion of ssl stubs and base64 code because network is build as library in ESP32 and weak functions don't get replaced with hard implementation in this case. - Remove inclusion of mbedTLS and OpenSSL libraries from ESP32 IDF build. - Update Azure Pipeline to set security with mbedTLS instead of OpenSSL. Signed-off-by: José Simões <[email protected]>
- Loading branch information
1 parent
de8700f
commit 644d913
Showing
11 changed files
with
231 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| # | ||
| # Copyright (c) 2019 The nanoFramework project contributors | ||
| # See LICENSE file in the project root for full license information. | ||
| # | ||
|
|
||
| # if mbed TLS is enabled add it to the build | ||
| if(NF_SECURITY_MBEDTLS) | ||
|
|
||
| # check if MBEDTLS_SOURCE was specified or if it's empty (default is empty) | ||
| set(NO_MBEDTLS_SOURCE TRUE) | ||
|
|
||
| if(MBEDTLS_SOURCE) | ||
| if(NOT "${MBEDTLS_SOURCE}" STREQUAL "") | ||
| set(NO_MBEDTLS_SOURCE FALSE) | ||
| endif() | ||
| endif() | ||
|
|
||
| # set options for mbed TLS | ||
| option(ENABLE_TESTING "no testing when building mbed TLS." OFF) | ||
|
|
||
| if(NO_MBEDTLS_SOURCE) | ||
| # no mbed TLS source specified, download it from it's repo | ||
|
|
||
| # check for Git (needed here for advanced warning to user if it's not installed) | ||
| find_package(Git) | ||
|
|
||
| # check if Git was found, if not report to user and abort | ||
| if(NOT GIT_EXECUTABLE) | ||
| message(FATAL_ERROR "error: could not find Git, make sure you have it installed.") | ||
| endif() | ||
|
|
||
| # set tag for currently supported version | ||
| set(MBEDTLS_GIT_TAG "mbedtls-2.14") | ||
|
|
||
| # need to setup a separate CMake project to download the code from the GitHub repository | ||
| # otherwise it won't be available before the actual build step | ||
| configure_file("${PROJECT_SOURCE_DIR}/CMake/mbedTLS.CMakeLists.cmake.in" | ||
| "${CMAKE_BINARY_DIR}/mbedTLS_Download/CMakeLists.txt") | ||
|
|
||
| # setup CMake project for mbedTLS download | ||
| execute_process(COMMAND ${CMAKE_COMMAND} -G "${CMAKE_GENERATOR}" . | ||
| RESULT_VARIABLE result | ||
| WORKING_DIRECTORY "${CMAKE_BINARY_DIR}/mbedTLS_Download") | ||
|
|
||
| # run build on mbedTLS download CMake project to perform the download | ||
| execute_process(COMMAND ${CMAKE_COMMAND} --build . | ||
| RESULT_VARIABLE result | ||
| WORKING_DIRECTORY "${CMAKE_BINARY_DIR}/mbedTLS_Download") | ||
|
|
||
| # add mbedTLS as external project | ||
| ExternalProject_Add( | ||
| mbedTLS | ||
| PREFIX mbedTLS | ||
| SOURCE_DIR ${CMAKE_BINARY_DIR}/mbedTLS_Source | ||
| GIT_REPOSITORY https://github.com/nanoframework/mbedtls | ||
| GIT_TAG ${MBEDTLS_GIT_TAG} # target specified branch | ||
| GIT_SHALLOW 1 # download only the tip of the branch, not the complete history | ||
| TIMEOUT 10 | ||
| LOG_DOWNLOAD 1 | ||
|
|
||
| # Disable all other steps | ||
| CONFIGURE_COMMAND "" | ||
| BUILD_COMMAND "" | ||
| INSTALL_COMMAND "" | ||
| ) | ||
|
|
||
| else() | ||
| # mbedTLS source was specified | ||
|
|
||
| # sanity check is source path exists | ||
| if(EXISTS "${MBEDTLS_SOURCE}/") | ||
|
|
||
| # check if we already have the sources, no need to copy again | ||
| if(NOT EXISTS "${CMAKE_BINARY_DIR}/mbedTLS_Source") | ||
| message(STATUS "mbedTLS source from: ${MBEDTLS_SOURCE}") | ||
| file(COPY "${MBEDTLS_SOURCE}/" DESTINATION "${CMAKE_BINARY_DIR}/mbedTLS_Source") | ||
| else() | ||
| message(STATUS "Using local cache of mbedTLS source from ${MBEDTLS_SOURCE}") | ||
| endif() | ||
|
|
||
| set(MBEDTLS_INCLUDE_DIR ${CMAKE_BINARY_DIR}/mbedTLS_Source/include) | ||
| else() | ||
| message(FATAL_ERROR "Couldn't find mbedTLS source at ${MBEDTLS_SOURCE}/") | ||
| endif() | ||
|
|
||
| # add mbedTLS as external project | ||
| ExternalProject_Add( | ||
| mbedTLS | ||
| PREFIX mbedTLS | ||
| SOURCE_DIR ${CMAKE_BINARY_DIR}/mbedTLS_Source | ||
|
|
||
| # Disable all other steps | ||
| CONFIGURE_COMMAND "" | ||
| BUILD_COMMAND "" | ||
| INSTALL_COMMAND "" | ||
| ) | ||
|
|
||
| endif() | ||
|
|
||
| # get source dir for mbedTLS CMake project | ||
| ExternalProject_Get_Property(mbedTLS SOURCE_DIR) | ||
|
|
||
| set(mbedTLS_INCLUDE_DIRS "${CMAKE_SOURCE_DIR}/3rdparty/humblelogging/include") | ||
| set(mbedTLS_LIBRARIES "${CMAKE_SHARED_LIBRARY_PREFIX}mbedTLS${CMAKE_SHARED_LIBRARY_SUFFIX}") | ||
| include_directories(${mbedTLS_INCLUDE_DIRS}) | ||
|
|
||
| endif() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
25 changes: 25 additions & 0 deletions
25
targets/FreeRTOS_ESP32/ESP32_WROOM_32/common/mbedtls_entropy_hardware_pool.c
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| // | ||
| // Copyright (c) 2017 The nanoFramework project contributors | ||
| // See LICENSE file in the project root for full license information. | ||
| // | ||
|
|
||
| #include <Esp32_os.h> | ||
|
|
||
| // Get len bytes of entropy from the hardware RNG. | ||
| int mbedtls_hardware_poll( void *data, unsigned char *output, size_t len, size_t *olen ) | ||
| { | ||
| (void)data; | ||
|
|
||
| for(size_t i = 0; i < len; i++) | ||
| { | ||
| // our generator returns 32bits numbers | ||
| *output = (unsigned char)esp_random(); | ||
|
|
||
| output++; | ||
| } | ||
|
|
||
| // callers require this to be set | ||
| *olen = len; | ||
|
|
||
| return 0; | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| // | ||
| // Copyright (c) 2018 The nanoFramework project contributors | ||
| // Portions Copyright (c) 2006-2015, ARM Limited, All Rights Reserved | ||
| // See LICENSE file in the project root for full license information. | ||
| // | ||
|
|
||
| #ifndef MBEDTLS_CONFIG_H | ||
| #define MBEDTLS_CONFIG_H | ||
|
|
||
| /* For test certificates */ | ||
| // #define MBEDTLS_CERTS_C | ||
| // #define MBEDTLS_PEM_PARSE_C | ||
|
|
||
| // #define SSL_DEBUG_BUF MBEDTLS_SSL_DEBUG_BUF | ||
| // #define SSL_DEBUG_CRT MBEDTLS_SSL_DEBUG_CRT | ||
| // #define SSL_DEBUG_ECP MBEDTLS_SSL_DEBUG_ECP | ||
| // #define SSL_DEBUG_MPI MBEDTLS_SSL_DEBUG_MPI | ||
| // #define SSL_DEBUG_MSG MBEDTLS_SSL_DEBUG_MSG | ||
| // #define SSL_DEBUG_RET MBEDTLS_SSL_DEBUG_RET | ||
|
|
||
| // #define MBEDTLS_SSL_ALL_ALERT_MESSAGES | ||
| // #define MBEDTLS_SSL_DEBUG_ALL | ||
| // #define MBEDTLS_VERSION_FEATURES | ||
| // #define MBEDTLS_CERTS_C | ||
| // #define MBEDTLS_ERROR_C | ||
| // #define MBEDTLS_VERSION_C | ||
|
|
||
| // uncomment the defines below to enable static memory allocation feature | ||
| #if 0 | ||
| #define MBEDTLS_MEMORY_BUFFER_ALLOC_C | ||
| #define MBEDTLS_PLATFORM_MEMORY | ||
| #endif | ||
|
|
||
| #ifdef USE_LCD | ||
| #include "lcd_log.h" | ||
| #define MBEDTLS_PLATFORM_PRINTF_MACRO LCD_UsrLog | ||
| #endif | ||
|
|
||
| // uncomment the defines bellow to generate debug output | ||
| // set below the threshold level for debug messages | ||
| // check mbed TLS mbedtls/debug.h header for details. | ||
| // Debug levels: | ||
| // 0 No debug | ||
| // 1 Error | ||
| // 2 State change | ||
| // 3 Informational | ||
| // 4 Verbose | ||
|
|
||
| // #define MBEDTLS_DEBUG_C | ||
| // #define MBEDTLS_SSL_ALL_ALERT_MESSAGES | ||
| #define MBEDTLS_DEBUG_THRESHOLD 2 | ||
|
|
||
| #endif // MBEDTLS_CONFIG_H |