mirror of
https://github.com/esp8266/Arduino.git
synced 2025-08-26 01:44:17 +03:00
794630e068
Due to popular demand, remove the hardcoded dependency on SPIFFS or SD from the CertStore by factoring out the file interface into a new class (CertStoreFile) that the user will need to implement as a thin wrapper around either a SPIFFS.file or a SD.file Combine the downloaded certificates into a UNIX "ar" archive and parse that on-the-fly to allow easy inspection and creation of the Cert Store database. Examples updated with a new certificate downloader that creates the certs.ar archive and with a single sample that can be built for either SPIFFS or SD with a #define. Users can copy the implementation of the CertStoreFile they need to their own code as it is self-contained. Also move the CertStore to the BearSSL namespace and remove the suffix and separate SPIFFS/SD sources. Remove the "deep+" change from the CI build as well (no special options needed on any PIO or makefile build). We'll revisit the filesystem wrapper for 2.5.0, hopefully having a unified template for both filesystem usage at a global level. For current users, be aware the interface may change (simplify!) in release 2.5.0. Fixes #4740
91 lines
2.9 KiB
C++
91 lines
2.9 KiB
C++
/*
|
|
CertStoreBearSSL.h - Library for Arduino ESP8266
|
|
Copyright (c) 2018 Earle F. Philhower, III
|
|
|
|
This library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
This library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with this library; if not, write to the Free Software
|
|
Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*/
|
|
|
|
#ifndef _CERTSTORE_BEARSSL_H
|
|
#define _CERTSTORE_BEARSSL_H
|
|
|
|
#include <Arduino.h>
|
|
#include <BearSSLHelpers.h>
|
|
#include <bearssl/bearssl.h>
|
|
|
|
// Base class for the certificate stores, which allow use
|
|
// of a large set of certificates stored on SPIFFS of SD card to
|
|
// be dynamically used when validating a X509 certificate
|
|
|
|
namespace BearSSL {
|
|
|
|
// Subclass this and provide virtual functions appropriate for your storage.
|
|
// Required because there are conflicting definitions for a "File" in the
|
|
// Arduino setup, and there is no simple way to work around the minor
|
|
// differences.
|
|
// See the examples for implementations to use in your own code.
|
|
//
|
|
// NOTE: This virtual class may migrate to a templated model in a future
|
|
// release. Expect some changes to the interface, no matter what, as the
|
|
// SD and SPIFFS filesystem get unified.
|
|
class CertStoreFile {
|
|
public:
|
|
CertStoreFile() {};
|
|
virtual ~CertStoreFile() {};
|
|
|
|
// The main API
|
|
virtual bool open(bool write=false) = 0;
|
|
virtual bool seek(size_t absolute_pos) = 0;
|
|
virtual ssize_t read(void *dest, size_t bytes) = 0;
|
|
virtual ssize_t write(void *dest, size_t bytes) = 0;
|
|
virtual void close() = 0;
|
|
};
|
|
|
|
|
|
class CertStore {
|
|
public:
|
|
CertStore() { };
|
|
~CertStore() { };
|
|
|
|
// Set the file interface instances, do preprocessing
|
|
int initCertStore(CertStoreFile *index, CertStoreFile *data);
|
|
|
|
// Installs the cert store into the X509 decoder (normally via static function callbacks)
|
|
void installCertStore(br_x509_minimal_context *ctx);
|
|
|
|
protected:
|
|
CertStoreFile *_index = nullptr;
|
|
CertStoreFile *_data = nullptr;
|
|
BearSSLX509List *_x509 = nullptr;
|
|
|
|
// These need to be static as they are callbacks from BearSSL C code
|
|
static const br_x509_trust_anchor *findHashedTA(void *ctx, void *hashed_dn, size_t len);
|
|
static void freeHashedTA(void *ctx, const br_x509_trust_anchor *ta);
|
|
|
|
// The binary format of the index file
|
|
class CertInfo {
|
|
public:
|
|
uint8_t sha256[32];
|
|
uint32_t offset;
|
|
uint32_t length;
|
|
};
|
|
static CertInfo _preprocessCert(uint32_t length, uint32_t offset, const void *raw);
|
|
|
|
};
|
|
|
|
};
|
|
|
|
#endif
|
|
|