mirror of
https://github.com/esp8266/Arduino.git
synced 2025-04-25 20:02:37 +03:00
2f4380777e
* Update to BearSSL 0.6+ release, add AES_CCM modes Pull in latest BearSSL head (0.6 + minor additions) release and add AES_CCM modes to the encryption options. * Enable the aes_ccm initialization in client/server * Initial attempt * Working code with second stack thunking * Remove #ifdefs in .S file, not needed. * Clean up thunks and remove separate stack flag * Fix PIO assembler errors * Remove #ifdef code changes, ensure same code as PC Remove "#ifdef ESP8266;...;#else;...;#endif" brackets in BearSSL to ensure the host-tested code is the same as the ESP8266-run code. * Move to latest BearSSL w/EC progmem savings * Merge with master * Add br_thunk_* calls to do ref counting, painting Add reference counting br_thunk_add/del_ref() to replace stack handling code in the class. Add in stack painting and max usage calculation. * Add in postmortem stack dump hooks When a crash occurs while in the second stack, dump the BSSL stack and then also the stack that it was called from (either cont or sys). * Update stack dump to match decoder expectations * Move thunk to code core for linkiage The thunk code needs to be visible to the core routines, so move it to the cores/esp8266 directory. Probably need to refactor the stack setup and the bearssl portion to avoid dependency on bearssl libs in cores/esp8266 * Add 2nd stack dump utility routine * Refactor once more, update stack size, add stress Make stack_thunks generic, remove bearssl include inside of cores/esp8266. Allocate the stack on a WiFiServerSecure object creation to avoid fragmentation since we will need to allocate the stack to do any connected work, anyway. A stress test is now included which checks the total BearSSL second stack usage for a variety of TLS handshake and certificate options from badssl.org. * Update to latest to-thunks branch * Add BearSSL device test using stack stress Run a series of SSL connection and transmission tests that stress BearSSL and its stack usage to the device tests. Modify device tests to include a possible SPIFFS generation and upload when a make_spiffs.py file is present in a test directory. * Use bearssl/master branch, not /to-thunks branch Update to use the merged master branch of bearssl. Should have no code changes.
67 lines
1.8 KiB
Python
Executable File
67 lines
1.8 KiB
Python
Executable File
#!/usr/bin/python
|
|
|
|
# This script pulls the list of Mozilla trusted certificate authorities
|
|
# from the web at the "mozurl" below, parses the file to grab the PEM
|
|
# for each cert, and then generates DER files in a new ./data directory
|
|
# Upload these to a SPIFFS filesystem and use the CertManager to parse
|
|
# and use them for your outgoing SSL connections.
|
|
#
|
|
# Script by Earle F. Philhower, III. Released to the public domain.
|
|
|
|
import csv
|
|
import os
|
|
from subprocess import Popen, PIPE, call
|
|
import urllib2
|
|
try:
|
|
# for Python 2.x
|
|
from StringIO import StringIO
|
|
except ImportError:
|
|
# for Python 3.x
|
|
from io import StringIO
|
|
|
|
# Mozilla's URL for the CSV file with included PEM certs
|
|
mozurl = "https://ccadb-public.secure.force.com/mozilla/IncludedCACertificateReportPEMCSV"
|
|
|
|
# Load the manes[] and pems[] array from the URL
|
|
names = []
|
|
pems = []
|
|
response = urllib2.urlopen(mozurl)
|
|
csvData = response.read()
|
|
csvReader = csv.reader(StringIO(csvData))
|
|
for row in csvReader:
|
|
names.append(row[0]+":"+row[1]+":"+row[2])
|
|
pems.append(row[28])
|
|
del names[0] # Remove headers
|
|
del pems[0] # Remove headers
|
|
|
|
# Try and make ./data, skip if present
|
|
try:
|
|
os.mkdir("data")
|
|
except:
|
|
pass
|
|
|
|
derFiles = []
|
|
idx = 0
|
|
# Process the text PEM using openssl into DER files
|
|
for i in range(0, len(pems)):
|
|
certName = "data/ca_%03d.der" % (idx);
|
|
thisPem = pems[i].replace("'", "")
|
|
print names[i] + " -> " + certName
|
|
ssl = Popen(['openssl','x509','-inform','PEM','-outform','DER','-out', certName], shell = False, stdin = PIPE)
|
|
pipe = ssl.stdin
|
|
pipe.write(thisPem)
|
|
pipe.close()
|
|
ssl.wait()
|
|
if os.path.exists(certName):
|
|
derFiles.append(certName)
|
|
idx = idx + 1
|
|
|
|
if os.path.exists("data/certs.ar"):
|
|
os.unlink("data/certs.ar");
|
|
|
|
arCmd = ['ar', 'q', 'data/certs.ar'] + derFiles;
|
|
call( arCmd )
|
|
|
|
for der in derFiles:
|
|
os.unlink(der)
|