* interactive example: update with option for using DHCP again after using static IP
* lwip2: avoid crash when IP address is set to 0(any) by dhcp not getting its lease renewal in due time
* lwip2: automatically remove oldest PCBs in time-wait state, limit their number
thanks to @me-no-dev 07f4d4c241 (diff-f8258e71e25fb9985ca3799e3d8b88ecR399)
* faq: update about tcpCleanup()
* lwip2: add a macro HAS_PHY_CAPTURE=1 indicating capture facility is available
BearSSL (https://www.bearssl.org) is a TLS(SSL) library written by
Thomas Pornin that is optimized for lower-memory embedded systems
like the ESP8266. It supports a wide variety of modern ciphers and
is unique in that it doesn't perform any memory allocations during
operation (which is the unfortunate bane of the current axTLS).
BearSSL is also absolutely focused on security and by default performs
all its security checks on x.509 certificates during the connection
phase (but if you want to be insecure and dangerous, that's possible
too).
While it does support unidirectional SSL buffers, like axTLS,
as implemented the ESP8266 wrappers only support bidirectional
buffers. These bidirectional buffers avoid deadlocks in protocols
which don't have well separated receive and transmit periods.
This patch adds several classes which allow connecting to TLS servers
using this library in almost the same way as axTLS:
BearSSL::WiFiClientSecure - WiFiClient that supports TLS
BearSSL::WiFiServerSecure - WiFiServer supporting TLS and client certs
It also introduces objects for PEM/DER encoded keys and certificates:
BearSSLX509List - x.509 Certificate (list) for general use
BearSSLPrivateKey - RSA or EC private key
BearSSLPublicKey - RSA or EC public key (i.e. from a public website)
Finally, it adds a Certificate Authority store object which lets
BearSSL access a set of trusted CA certificates on SPIFFS to allow it
to verify the identity of any remote site on the Internet, without
requiring RAM except for the single matching certificate.
CertStoreSPIFFSBearSSL - Certificate store utility
Client certificates are supported for the BearSSL::WiFiClientSecure, and
what's more the BearSSL::WiFiServerSecure can also *require* remote clients
to have a trusted certificate signed by a specific CA (or yourself with
self-signing CAs).
Maximum Fragment Length Negotiation probing and usage are supported, but
be aware that most sites on the Internet don't support it yet. When
available, you can reduce the memory footprint of the SSL client or server
dramatically (i.e. down to 2-8KB vs. the ~22KB required for a full 16K
receive fragment and 512b send fragment). You can also manually set a
smaller fragment size and guarantee at your protocol level all data will
fit within it.
Examples are included to show the usage of these new features.
axTLS has been moved to its own namespace, "axtls". A default "using"
clause allows existing apps to run using axTLS without any changes.
The BearSSL::WiFi{client,server}Secure implements the axTLS
client/server API which lets many end user applications take advantage
of BearSSL with few or no changes.
The BearSSL static library used presently is stored at
https://github.com/earlephilhower/bearssl-esp8266 and can be built
using the standard ESP8266 toolchain.
- Fixes WiFi not being able to reconnect after SDK update (#4398)
- Fixes increased current in light sleep mode
- Fixes return value documentation for wifi_{get,set}_country
- recompile liblwip_gcc.a with new err_t definitions
- update espconn.h (function signature change, new function)
- add option to build lwip with debug-prefix-map
SHA512 module stored padding in PROGMEM, but would then pass the pointer
to padding into Update function which would do a memcpy. Use the same
approach as with SHA256, that is to copy padding to the stack first, and
then pass it to Update.
- update ssl_client_new signature
- add max fragment length negotiation support (hardcoded to 4096 bytes)
- build axtls with -f{function,data}-sections, ~1k less DRAM usage,
~3k less flash
- strip prefix from build paths in debug symbols
- Update SDK header files and libraries to SDK 2.0.0 plus 2.0.0_16_08_09
patch
- Remove mem_manager.o from libmain.a (replaced with umm_malloc)
- Disable switch from DIO to QIO mode for certain flash chips (saves
IRAM space)
- Add user_rf_cal_sector_set; it points to rf_init_data sector.
- Change the way rf_init_data is spoofed.
This is now done by wrapping spi_flash_read and returning the data we
need during startup sequence.
- Place lwip library into flash using linker script instead of section
attributes (saves IRAM space)
* Add multicast TTL to UDP and rework UdpContext
* Add limit for TCP TIME_WAIT pcbs
* Add liblwip_gcc.a
* Make the changes be backward compatible with the current xcc version
* Use newlib libc library
This change adds libcmin.a, which is created from newlib libc by selectively removing some of the object files (mostly related to heap management).
The list of files is available in tools/sdk/lib/make_libcmin.sh. Files which are not needed are commented out.
This change adds support for various functions which were missing, like sscanf, strftime, etc.
* Fix some of the time functions
* Redirect stdout to serial
* Implement __putc_r
* Switch to custom newlib build
Built from https://github.com/igrr/newlib-xtensa using:
./configure --with-newlib --enable-multilib --disable-newlib-io-c99-formats --enable-newlib-supplied-syscalls --enable-target-optspace --program-transform-name="s&^&xtensa-lx106-elf-&" --disable-option-checking --with-target-subdir=xtensa-lx106-elf --target=xtensa-lx106-elf --enable-newlib-nano-formatted-io --enable-newlib-reent-small --prefix=path-to-arduino-core/tools/sdk/libc
CROSS_CFLAGS="-DMALLOC_PROVIDED -DSIGNAL_PROVIDED -DABORT_PROVIDED" make
make install
* Update tests
Changes:
5b4be7d2738de5874f2e302157a0b726fe7bd4a6 Reserve 16k fragment buffer only when it is actually required.
b33ef68e6a3e2be1171e5a9f5b6156af424489ec Fix handshake status not being set if increase_bm_data_size fails
Changelog:
324c2fdade3f39b4c7fb7fbe707f4a313023ecd3 Terminate connection if increase_bm_data_size fails
96fbb39f21d3af7ca3e4dee78f8c45c4e2e652b5 Update README.md
c18bb56e6100177cfa0bef3c90708efb9d7a071d Add travis CI
9eaeca3a030692bdf949b89d80705061b516f70b Postpone freeing of X509 context to the first data exchange after handshake
28869ea94b3b1cabfbe8679d962adc12ba0b28db Use free followed by malloc instead of realloc when increasing raw buffer
43a90bcf3559ed145db9286f28bdcd8b07832b51 Merge pull request #8 from slaff/feature/lwipr-compat
66e1a5f423c0ee25d4318968ea14384887d287aa Merge pull request #7 from slaff/feature/sni
1154d0a985cc442f39f5e6b3678a7d4ffca5db31 Changed the code to reserve bytes for hostname only if needed.
63da8991c2878f2a7cd526667f9e23adc9dca1c9 Added SNI ( https://en.wikipedia.org/wiki/Server_Name_Indication ) support.
7c38865f66cfdd0884183619b0d1e89b8717cb01 Restructured the lwip raw comat code. Added replacements for the time functions on ESP8266.
885ff3e8f0455d48acbc5e67557602e9d548fd81 Merge pull request #6 from slaff/feature/lwip-raw
d78e7a07998f456d452a760d478d1518b009fd4a Initial version of axTLS integration with lwip raw tcp mode (http://lwip.wikia.com/wiki/Raw/TCP).
