* weak hook early_setup() #2111#2133#2136
* rename to early_init (more "c" vs early_setup which is more "c++arduino")
* example
* improve earlyWiFi example, slightly change AddrList interface, move WiFi sketches into WiFi examples
* fix CI
* fix local CI runner
* fix local CI runner
* rename early_init() to preinit()
* + static ESP8266WiFiClass::preinit_wifi_off()
* update early disable wifi example
* example update
* IPv6 example update
* Update ESP8266WiFiGeneric.h
camelCase for static method name
* Update ESP8266WiFiGeneric.cpp
camelCase for static method name
* Update EarlyDisableWiFi.ino
Expand comment, fix static method name
* Update core_esp8266_main.cpp
Expanded comment.
* Update core_esp8266_main.cpp
Expanded comment
* Update EarlyDisableWiFi.ino
Expanded comment
Using a pluggable architecture, allow updates delivered via the Update
class to be verified as signed by a certificate. By using plugins, avoid
pulling either axTLS or BearSSL into normal builds.
A signature is appended to a binary image, followed by the size of the
signature as a 32-bit int. The updater takes a verification function
and checks this signature using whatever method it chooses, and if it
fails the update is not applied.
A SHA256 hash class is presently implemented for the signing hash (since
MD5 is a busted algorithm).
A BearSSLPublicKey based verifier is implemented for RSA keys. The
application only needs the Public Key, while to sign you can use
OpenSSL and your private key (which should never leave your control
or be deployed on any endpoints).
An example using automatic signing is included.
Update the docs to show the signing steps and how to use it in the
automatic and manual modes.
Also remove one debugging line from the signing tool.
Saves ~600 bytes when in debug mode by moving strings to PMEM
Windows can't run the signing script, nor does it normally have OpenSSL
installed. When trying to build an automatically signed binary, warn
and don't run the python.
Many objects now expect a WiFiClient* object to be passed to them and
potentially re-used multiple times (HTTPClient, others). Clearing the
authentication options on a ::stop means they can never reconnect.
Remove the option clearing in ::stop
Fixes#5379
* WIP compile examples on host with 'make examples'
* WIP bufferize tcp input
* WIP Makefile
* WIP network to rework, tcp/udp to factorize, udp addresses broken
* minor changes to the core
* WIP basic udp working
* WIP mdns
* WIP mcast receiving, not sending
* WIP mdns OK
* beta version
* SSL + doc
* update travis host test command
* licenses
* typo
* doc: arduino builder is not around: declare functions before calling them
* fix with latest SSL PR, compile in 32 bits mode
* fix make clean
* make -m32 optional
* 32bits compiler ability tester
* WIP
* WIP (fix 1 vtable error, still another one to hunt with using spiffs)
* example astyle
* fix os_printf_plus
* load / save mock spiffs
* fix style
* fix using spiffs/mock
* don't mess ram
* update doc
* remove leftover
* optimization -Os except for CI, rename ARCH32 to FORCE32
* revert useless cast (not even compiled)
* remove unused function
* use proper type for pointer arithmetics
* makefile: sketch object and cpp file moved to bin/ directories
easier to clean, and IDE don't like them
* changes for review
* make use of %zd
* less verbose makefile by default (option)
* update readme
* Update to BearSSL 0.6+ release, add AES_CCM modes
Pull in latest BearSSL head (0.6 + minor additions) release and add AES_CCM
modes to the encryption options.
* Enable the aes_ccm initialization in client/server
* Initial attempt
* Working code with second stack thunking
* Remove #ifdefs in .S file, not needed.
* Clean up thunks and remove separate stack flag
* Fix PIO assembler errors
* Remove #ifdef code changes, ensure same code as PC
Remove "#ifdef ESP8266;...;#else;...;#endif" brackets in BearSSL to
ensure the host-tested code is the same as the ESP8266-run code.
* Move to latest BearSSL w/EC progmem savings
* Merge with master
* Add br_thunk_* calls to do ref counting, painting
Add reference counting br_thunk_add/del_ref() to replace stack handling code
in the class.
Add in stack painting and max usage calculation.
* Add in postmortem stack dump hooks
When a crash occurs while in the second stack, dump the BSSL stack and
then also the stack that it was called from (either cont or sys).
* Update stack dump to match decoder expectations
* Move thunk to code core for linkiage
The thunk code needs to be visible to the core routines, so move it to the
cores/esp8266 directory. Probably need to refactor the stack setup and the
bearssl portion to avoid dependency on bearssl libs in cores/esp8266
* Add 2nd stack dump utility routine
* Refactor once more, update stack size, add stress
Make stack_thunks generic, remove bearssl include inside of cores/esp8266.
Allocate the stack on a WiFiServerSecure object creation to avoid
fragmentation since we will need to allocate the stack to do any
connected work, anyway.
A stress test is now included which checks the total BearSSL second
stack usage for a variety of TLS handshake and certificate options
from badssl.org.
* Update to latest to-thunks branch
* Add BearSSL device test using stack stress
Run a series of SSL connection and transmission tests that stress
BearSSL and its stack usage to the device tests.
Modify device tests to include a possible SPIFFS generation and
upload when a make_spiffs.py file is present in a test directory.
* Use bearssl/master branch, not /to-thunks branch
Update to use the merged master branch of bearssl. Should have no code
changes.
BearSSLX509List, BearSSLSession, BearSSLPublicKey, and BearSSLPrivateKey
were all in the global namespace and not in the BearSSL:: one, due to an
oversight when they were originally created. Move them to the proper
namespace with the following mapping:
BearSSLX509List => BearSSL::X509List
BearSSLSession => BearSSL::Session
BearSSLPublicKey => BearSSL::PublicKey
BearSSLPrivateKey => BearSSL::PrivateKey
Fix bug introduced by #5167 which replaced delay() by yield().
That should have been esp_yield() which is the one delay()
calls and is safe from either SYS or CONT contexts.
Fixes#5237.
Allow the unused stack to be reset to the check value at any time in
the application, allowing for delta-stack calculations to be done.
Add ESP.resetFreeContStack() class method for general use.
Add in some dumping in the BearSSL_Validation example to show the
usage for those that care.
* fwupdate
* fw update to latest version:
WPA working, WEP+Open disabled by default. Need API change.
* helpers to follow sdk updates
* remove compare scripts - made a separate PR for them
* add wep api, restore original espressif comment (wep enabled does not prevent wpa)
* libmain was not up to date
* experimental: DTIM setting in WiFi.setSleepMode(WIFI_LIGHT/MODEM_SLEEP, DTIM-value)
with new getter: .getListenInterval() / .isSleepLevelMax()
* fixes
* fix debug message
* when not using listenInterval, set wifi sleep level to min
* update documentation
* update doc
Print a warning when in debug mode when a BearSSL connection tries to
connect without having any defined authentication methods, since it will
fail.
Completely remove the empty axTLS compatibilty method
"::verify(char *fp, char *name)" because it can't be done w/BearSSL w/o
user code changes, and always failed. Better to have a compile failure
when we know at compile time the app won't do what is expected.
Completes the changes started by @d-a-v in PR #4833
Add a method allowing a user to send in a character string for the
fingerprint, like axTLS supported.
Implements part of PR #4833 from @d-a-v with changes requested in
discussion.
The BearSSL second stack, once allocated, was never deallocated. The
reference count of the stack pointer never hit 0 due to the initial
creation counting as one. Now, check to see if there is only one use_count
and if so then delete the stack.
SSL Sessions enable most of the SSL handshake to be skipped when both
client and server agree to use them. Add a BearSSLSession class and
an optional setting to the SSL client to enable this.
Note that SSL sessions are unrelated to HTTP sessions. They are
ephemeral and only relate to the SSL parameters, not anything at
the HTTP protocol level.
The cipher list count/pointer was cleared separately in the three
constructors available. Move this reset to _clear() to reduce code
duplication and keep the semantics.
Pull in latest BearSSL head (0.6 + minor additions) release and add AES_CCM
modes to the encryption options. Enable the aes_ccm initialization in client/server
The EC mul20 and square20 code was identical in two different files,
but because these copies were static, we ended up with an extra 6k of
duplicated code. Updated BearSSL to make them shared, saving 6KB.
The cipher list values were not initialized to NULL appropriately for the
BearSSL::WiFiClientSecure() constructor called by the Server object.
This caused a crash as a random value was free'd when conecting to the
SSL server object.
ClientContext::_wait_for_sent() could dereference a TCP's _pcb after
the connection was dropped by the OS, resulting in a crash.
Move the connection dropped check to catch this case, and replace
a fixed millisecond delay() with a yield and timeout value to minimize
wasted time when transmission completes.
* Allow cipher specification for BearSSL
BearSSL has many more ciphers than axTLS, but they are more compute intensive
and slower. Add an option to use only the same, limited security, axTLS ciphers
as well as allow users to specify any suite of ciphers they want using standard
BearSSL formats.
Fixes#5110
* Rename methods to avoid axtls references.
* Allow std::vector to set a list of allowed ciphers
For C++ afficionados, allow std::vectors to be passed in to the setCipher()
routine.
The BearSSL object will now keep a copy of any set ciphers and free on object
destruction. These custom lists should normally only be 1-4 entries long, so it
is not expected to be a memory hog having this extra copy.
As part of the "clear connection configuration for reused objects"
patch, a ::stop would reset the self-signed, trust anchors, etc.
WiFiClient, unfortunately, calls ::stop as part of the connection
process, so all of these settings were lost.
Now only clear the connection settings on ::stop if we've already
been connected.
Also update the github public key which changed yet again.
Fixes#5086
* Add information about the max_connection constructor argument.
* Correct information about max soft-AP connections.
* Add information about what happens when max_connection is reached.
* Correct terminology
* - Correct the valid range of max_connection to 1 - 8.
- Include reference.
According to the GCC man page, __section__ attributes should only be used
for global variables. However, the PROGMEM and ICACHE_RODATA macros use
this variable decorator even for local variables. Most of the time it works,
but when a static or inlined function tries to use a PROGMEM/PSTR/etc.
variable the compiler can throw an error like:
error: XXX causes a section type conflict with YYY
Change the PROGMEM macro to emit a section name that is unique (a combo
of the file, line, and counter variables to ensure uniqueness). The
standard linker script will place them properly in .IROM without
any changes.
Fixes#5036 and others.
Fixes#4882 and updates GitHub certificate fingerprint to the current one
in BearSSL_Validation example.
When setting a authentication mode or stopping, clear all others out in case
the object is being re-used.
Add in a yield during the SSL handshake to allow a graceful timeout and not
a WDT error when the remote server hiccups. Thanks to @Jeroen88 for
finding and testing this.
Several users have been worried that they need to generate the IDX file,
but don't know how. The CertStore code actually writes this file on object
creation, and the user never needs to explicitly generate or upload it.
Add a comment to the example explicitly noting this.
