When in basic SSL mode, don't include ciphers for EC for the server by
replacinf the BearSSL "support everything" init call with our own
version which obeys the requested BASIC_SSL.
Saves ~46KB on TLS servers, about the same as basic SSL saves for
clients.
__This is a breaking change, but the header and example did warn
everyone that this API was in flux due to the incompatible SD and SPIFFS
File implementations.__
BearSSL CertStores now simply need a filesystem and the names of the
data (generated on-chip) and archive (uploaded by user) files on it.
No more need to roll your own virtual CertStoreFile class.
Update the library, examples, and device test.
* Use bounded waiting instead of infinite one to avoid deadlock
* Reduce timeout to fail much sooner if server is not acking our data
* Return timeout to 15 seconds on every disconnect
* Add comment to introduced delay to make it super clear
* Drop X509 context after successful server verification to save heap space
After completing handshake in BSSL, server is already verified and X509 context is no longer needed. Depending on verification method it save more or less heap space.
* Bugfix: Report not connected if there is no ready data and TLS connection is broken
Added the change for reporting not connected if TLS session is broken and there is no more buffered decrypted data. TLS can be broken if message authentication (MAC) cannot be verified. BearSSL enters BR_SSL_CLOSED state when processing invalid encrypted application data fragment. In such situation the current implementation get stuck forever unless user has own timeout mechanism build on top of WiFiClientSecureBearSSL. This change introduce fail fast via connected() returning false. Further it imply return -1 from read methods indicating broken channel upon which user should perform reconnect if needed.
Fixes#6005
fix switching to static address with lwip2
For some reason, ip address is not propagated in a visible way for lwip2
when switching to static address (wifi.config()) *after* wifi.begin().
This patch calls lwip-v1.4's netif_set_addr() with the new ip address to set
all things up, just like it is done and right when wifi.begin() is called
after wifi.config().
Also tested when IPv6 is enabled.
fix documentation: It is more natural to set an IP address before starting WiFi
(.. and not after dhcp has started)
fixes#5839fixes#6024
do interleave informations on addresses within reception pbuf chain:
before: (data-pbuf) -> (data-pbuf) -> (data-pbuf) -> ... in the receiving order
now: (address+port-info-pbuf -> data-pbuf) -> (address_port-info-pbuf -> data-pbuf) -> ...
address/port informations are updated along with data exposed to user
Fixes#5996
* Add extensions to probe message for EC, others
probeMFLN was failing on some connection attempts to servers which only
supported EC based ciphers because it did not include the proper TLS
handshake extensions to list what kinds of ECs it supported.
Add those to the probeMFLN ClientHello message to make probes pass.
* Add client.getMFLNStatus method, returns MFLN state
After a connection it is useful to check whether MFLN negotiation
succeeded. getMFLNStatus returns a bool (valid only after
client.connect() succeeds, of course) indicating whether the requested
buffer sizes were negotiated successfully.
* New menu option to minimize BSSL ROM with only RSA
Adds a menu option and define to limit BearSSL to older RSA connection
options. This saves ~45K program memory and can speed up connections
since EC, while more secure, is significantly slower on the chip.
The supported ciphers are identical to the ones that axTLS supported.
Fixes#6005
* Add default SSLFLAGS(blank) to platform.txt
* Fix unused variable warning
* Add clarifying comment to menu items
* fix DEBUG macros
All fmt strings in flash
fix#5658
This also allows to avoid warnings and easy mistakes with (no brace):
if (something)
DEBUGV("blah");
* use newlib unaligned-compatible printf for DEBUGV
* remove useless putprintf since ::printf already uses ets_putc
This commit allows switching SDK firmware:
nonos-sdk-pre-v3 shipped with release 2.5.0 has issues:
* Some boards show erratic behavior (radio connection is quickly lost), with an unknown cause.
These boards work well with previous nonos-sdk-2.2.1 firmware (#5736)
* Overall performances seem to have decreased (#5513)
This PR restores sdk2.2.1 (as in core-2.4.2).
SDK-pre-3.0 - which has brought long awaited fixes (WiFi sleep modes) - is still available through a menu option available only with generic board.
BREAKING
* new define `-DNONOSDK221=1` or `-DNONOSDK3V0=1`
* for external build systems: new library directory: `tools/sdk/lib/<version>/lib`
* PIO: variable `PIO_FRAMEWORK_ARDUINO_ESPRESSIF_SDK3` is needed for sdk-pre-v3.
Fix#5736
Per 'udp_set_multicast_netif_addr()' signature and comments in lwIP sources:
An IPv4 address designating a specific interface must be used.
When an IPv6 address is given, the matching IPv4 in the same interface must be selected.
fix e3bc3c226b (r32235572)
Because the constructors of the BSSL client and server add a reference
count to the stack_thunk, if there is no copy constructor defined then
the stack thunk reference count can get out of sync causing the stack
thunk memory to be freed while still in use. That could cause random
crashes or hangs.
Add a very basic copy constructor to the WiFiClientSecure and
WiFiServerSecure objects, using the default operator= to duplicate
simple types and shared_ptr classes.
The _cipher_list element (used only w/custom ciphers) could be freed
while still in use if copies of the WiFiClientSecure object were made.
Use a shared_ptr which will only free when the last reference is
deleted.
The axTLS compatibility mode calls allocate and store elements needed
for SSL connections (unlike normal BearSSL calls). These elements could
be freed mistakenly while still in use if copies of the WiFiClientSecure
were made by the app.
Convert to a separately managed shared_ptr to ensure they live as long
as any referencing objects before deletion.
Same done for the axTLS compatability for WiFiServerSecure.
Fixes#5701 WDTs and other issues with BearSSL::WiFiServerSecure
The BSSL server was creating the client it returns on a connection in a
way that caused the counter for the stack_thunk to get out of sync and
cause it to be freed improperly by having the destructor be called one
more time than the constructor. Looks like RVO.
Rewrite the ::available() function in order to avoid this issue with
help from @devyte.
* dynamic WiFi.hostname("newname")
* WiFi.hostname() back to String return type
* no silent hostname fix but proceed with debug message and returning false
* weak hook early_setup() #2111#2133#2136
* rename to early_init (more "c" vs early_setup which is more "c++arduino")
* example
* improve earlyWiFi example, slightly change AddrList interface, move WiFi sketches into WiFi examples
* fix CI
* fix local CI runner
* fix local CI runner
* rename early_init() to preinit()
* + static ESP8266WiFiClass::preinit_wifi_off()
* update early disable wifi example
* example update
* IPv6 example update
* Update ESP8266WiFiGeneric.h
camelCase for static method name
* Update ESP8266WiFiGeneric.cpp
camelCase for static method name
* Update EarlyDisableWiFi.ino
Expand comment, fix static method name
* Update core_esp8266_main.cpp
Expanded comment.
* Update core_esp8266_main.cpp
Expanded comment
* Update EarlyDisableWiFi.ino
Expanded comment
Using a pluggable architecture, allow updates delivered via the Update
class to be verified as signed by a certificate. By using plugins, avoid
pulling either axTLS or BearSSL into normal builds.
A signature is appended to a binary image, followed by the size of the
signature as a 32-bit int. The updater takes a verification function
and checks this signature using whatever method it chooses, and if it
fails the update is not applied.
A SHA256 hash class is presently implemented for the signing hash (since
MD5 is a busted algorithm).
A BearSSLPublicKey based verifier is implemented for RSA keys. The
application only needs the Public Key, while to sign you can use
OpenSSL and your private key (which should never leave your control
or be deployed on any endpoints).
An example using automatic signing is included.
Update the docs to show the signing steps and how to use it in the
automatic and manual modes.
Also remove one debugging line from the signing tool.
Saves ~600 bytes when in debug mode by moving strings to PMEM
Windows can't run the signing script, nor does it normally have OpenSSL
installed. When trying to build an automatically signed binary, warn
and don't run the python.
Many objects now expect a WiFiClient* object to be passed to them and
potentially re-used multiple times (HTTPClient, others). Clearing the
authentication options on a ::stop means they can never reconnect.
Remove the option clearing in ::stop
Fixes#5379
