Pull in latest BearSSL head (0.6 + minor additions) release and add AES_CCM
modes to the encryption options. Enable the aes_ccm initialization in client/server
The EC mul20 and square20 code was identical in two different files,
but because these copies were static, we ended up with an extra 6k of
duplicated code. Updated BearSSL to make them shared, saving 6KB.
* Move ICACHE_* to unique sections, local LD script
Similar to PROGMEM changes, make the name of each ICACHE_* variable/fuction
unique to avoid issues with section conflicts.
Also rename the generated LD linker script to avoid issue with older copies
of the eagle.app.v6.common.ld which were generated by the build process
in a global directory before being moved to the {build.path}. The linker
would use the older, generated *.ld file instead of the generated one, which
would lead to runtime failures on some systems and cause the VTABLE location
to not correspond to the IDE menu selection.
Fixes#5115, and is an update to #5117 and #5116.
* Update boards.txt.py and platform.io build
With the changes in PR #5117, blink and other examples compile but the 8266
gets stuck in a reset loop. Undo the changes from that commit until we can
figure out the root cause and fix it.
boards generator updates:
* simplified mapping description: only flash and spiffs sizes are needed
* some ldscripts are renamed due to autogenerated names
* +2M/0, +2M/512K spiffs, +4M0
* reduce length of hidden strings in boards.txt (#5100, https://github.com/arduino/arduino-builder/issues/284)
* give more details in ldscripts (address, size, +rf-cal, +sdk-wifi-settings)
arduino-builder 1.3.25 (shipped with Arduino 1.8.5) forces full
recompilation when any file in the core directory is modified. Avoid
full recompilation by placing generated ld script into build
directory, not source directory.
Also fix an issue where git version description would not be generated
if there were spaces in build path.
* interactive example: update with option for using DHCP again after using static IP
* lwip2: avoid crash when IP address is set to 0(any) by dhcp not getting its lease renewal in due time
* lwip2: automatically remove oldest PCBs in time-wait state, limit their number
thanks to @me-no-dev 07f4d4c241 (diff-f8258e71e25fb9985ca3799e3d8b88ecR399)
* faq: update about tcpCleanup()
* lwip2: add a macro HAS_PHY_CAPTURE=1 indicating capture facility is available
BearSSL (https://www.bearssl.org) is a TLS(SSL) library written by
Thomas Pornin that is optimized for lower-memory embedded systems
like the ESP8266. It supports a wide variety of modern ciphers and
is unique in that it doesn't perform any memory allocations during
operation (which is the unfortunate bane of the current axTLS).
BearSSL is also absolutely focused on security and by default performs
all its security checks on x.509 certificates during the connection
phase (but if you want to be insecure and dangerous, that's possible
too).
While it does support unidirectional SSL buffers, like axTLS,
as implemented the ESP8266 wrappers only support bidirectional
buffers. These bidirectional buffers avoid deadlocks in protocols
which don't have well separated receive and transmit periods.
This patch adds several classes which allow connecting to TLS servers
using this library in almost the same way as axTLS:
BearSSL::WiFiClientSecure - WiFiClient that supports TLS
BearSSL::WiFiServerSecure - WiFiServer supporting TLS and client certs
It also introduces objects for PEM/DER encoded keys and certificates:
BearSSLX509List - x.509 Certificate (list) for general use
BearSSLPrivateKey - RSA or EC private key
BearSSLPublicKey - RSA or EC public key (i.e. from a public website)
Finally, it adds a Certificate Authority store object which lets
BearSSL access a set of trusted CA certificates on SPIFFS to allow it
to verify the identity of any remote site on the Internet, without
requiring RAM except for the single matching certificate.
CertStoreSPIFFSBearSSL - Certificate store utility
Client certificates are supported for the BearSSL::WiFiClientSecure, and
what's more the BearSSL::WiFiServerSecure can also *require* remote clients
to have a trusted certificate signed by a specific CA (or yourself with
self-signing CAs).
Maximum Fragment Length Negotiation probing and usage are supported, but
be aware that most sites on the Internet don't support it yet. When
available, you can reduce the memory footprint of the SSL client or server
dramatically (i.e. down to 2-8KB vs. the ~22KB required for a full 16K
receive fragment and 512b send fragment). You can also manually set a
smaller fragment size and guarantee at your protocol level all data will
fit within it.
Examples are included to show the usage of these new features.
axTLS has been moved to its own namespace, "axtls". A default "using"
clause allows existing apps to run using axTLS without any changes.
The BearSSL::WiFi{client,server}Secure implements the axTLS
client/server API which lets many end user applications take advantage
of BearSSL with few or no changes.
The BearSSL static library used presently is stored at
https://github.com/earlephilhower/bearssl-esp8266 and can be built
using the standard ESP8266 toolchain.
* Add flash for vtable destination, make it default
Add an option for placing vtables in flash to complement the existing
iram and heap options. "make flash"
Now that there is a way to change it, move to vtables in flash as default
as only users with interrupts which use vtables require the vtable to
be in RAM. For those users, if the tables are small enough they can put
them in IRAM and save heap space for their app. If not, then the vtables
can be placed in HEAP which supports much larger tables.
* Add VTable menu, FLASH as default, remove Makefile
Convert from manual "make" operated app.ld creation to runtime creation
whose options are selected from the build menu.
Use a prelink recipe to create the output app.ld file each run, without
need for any special tools.
Update the boards.txt.py script to generate this new config.
Move all exception strings to IRAM and out of both PMEM (illegal) and add
output of any assert() failinf conditions.
The exception handler may be called while the SPI interface is in a bad
state. This means no PROGMEM reads are allowed, and all data and functions
used must be in system RAM or IRAM.
Add a new helper macro, ets_printf_P(), which places a constant string in
IRAM and copies it to the stack before calling the real ets_printf().
This makes the code simpler to read as no unwieldy combinations of
ets_putc/ets_printf/... are required to output anything.
The old handler also mistakenly used PSTR() strings in some places, so
fix those with this patch as well.
Gives back ~180 bytes of heap to every sketch built as the exception handler
is always included an application.
- Fixes WiFi not being able to reconnect after SDK update (#4398)
- Fixes increased current in light sleep mode
- Fixes return value documentation for wifi_{get,set}_country
GCC places vtables in .rodata, with a mangled name of "_ZTV*." Because
these are simply address jump tables, there is no need to place them in
RAM. Instead, have the linker place them in the .text (aka IRAM) section.
This will free up a variable amount of heap space, depending on the number
of classes with virtual functions used in any particular project.
+ generates boards.rst
+ generate and replace boards section in package.json
+ generate ldscripts
+ new debug option: OOM
+ new led menu for generic board
