mirror of
https://github.com/esp8266/Arduino.git
synced 2025-04-27 21:16:50 +03:00
e3c970210f
BearSSL (https://www.bearssl.org) is a TLS(SSL) library written by Thomas Pornin that is optimized for lower-memory embedded systems like the ESP8266. It supports a wide variety of modern ciphers and is unique in that it doesn't perform any memory allocations during operation (which is the unfortunate bane of the current axTLS). BearSSL is also absolutely focused on security and by default performs all its security checks on x.509 certificates during the connection phase (but if you want to be insecure and dangerous, that's possible too). While it does support unidirectional SSL buffers, like axTLS, as implemented the ESP8266 wrappers only support bidirectional buffers. These bidirectional buffers avoid deadlocks in protocols which don't have well separated receive and transmit periods. This patch adds several classes which allow connecting to TLS servers using this library in almost the same way as axTLS: BearSSL::WiFiClientSecure - WiFiClient that supports TLS BearSSL::WiFiServerSecure - WiFiServer supporting TLS and client certs It also introduces objects for PEM/DER encoded keys and certificates: BearSSLX509List - x.509 Certificate (list) for general use BearSSLPrivateKey - RSA or EC private key BearSSLPublicKey - RSA or EC public key (i.e. from a public website) Finally, it adds a Certificate Authority store object which lets BearSSL access a set of trusted CA certificates on SPIFFS to allow it to verify the identity of any remote site on the Internet, without requiring RAM except for the single matching certificate. CertStoreSPIFFSBearSSL - Certificate store utility Client certificates are supported for the BearSSL::WiFiClientSecure, and what's more the BearSSL::WiFiServerSecure can also *require* remote clients to have a trusted certificate signed by a specific CA (or yourself with self-signing CAs). Maximum Fragment Length Negotiation probing and usage are supported, but be aware that most sites on the Internet don't support it yet. When available, you can reduce the memory footprint of the SSL client or server dramatically (i.e. down to 2-8KB vs. the ~22KB required for a full 16K receive fragment and 512b send fragment). You can also manually set a smaller fragment size and guarantee at your protocol level all data will fit within it. Examples are included to show the usage of these new features. axTLS has been moved to its own namespace, "axtls". A default "using" clause allows existing apps to run using axTLS without any changes. The BearSSL::WiFi{client,server}Secure implements the axTLS client/server API which lets many end user applications take advantage of BearSSL with few or no changes. The BearSSL static library used presently is stored at https://github.com/earlephilhower/bearssl-esp8266 and can be built using the standard ESP8266 toolchain.
121 lines
4.7 KiB
C++
121 lines
4.7 KiB
C++
/**
|
|
*
|
|
* @file ESP8266HTTPUpdate.h
|
|
* @date 21.06.2015
|
|
* @author Markus Sattler
|
|
*
|
|
* Copyright (c) 2015 Markus Sattler. All rights reserved.
|
|
* This file is part of the ESP8266 Http Updater.
|
|
*
|
|
* This library is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU Lesser General Public
|
|
* License as published by the Free Software Foundation; either
|
|
* version 2.1 of the License, or (at your option) any later version.
|
|
*
|
|
* This library is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
* Lesser General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Lesser General Public
|
|
* License along with this library; if not, write to the Free Software
|
|
* Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
|
|
*
|
|
*/
|
|
|
|
#ifndef ESP8266HTTPUPDATE_H_
|
|
#define ESP8266HTTPUPDATE_H_
|
|
|
|
#include <Arduino.h>
|
|
#include <ESP8266WiFi.h>
|
|
#include <WiFiClient.h>
|
|
#include <WiFiUdp.h>
|
|
#include <ESP8266HTTPClient.h>
|
|
|
|
#ifdef DEBUG_ESP_HTTP_UPDATE
|
|
#ifdef DEBUG_ESP_PORT
|
|
#define DEBUG_HTTP_UPDATE(...) DEBUG_ESP_PORT.printf( __VA_ARGS__ )
|
|
#endif
|
|
#endif
|
|
|
|
#ifndef DEBUG_HTTP_UPDATE
|
|
#define DEBUG_HTTP_UPDATE(...)
|
|
#endif
|
|
|
|
/// note we use HTTP client errors too so we start at 100
|
|
#define HTTP_UE_TOO_LESS_SPACE (-100)
|
|
#define HTTP_UE_SERVER_NOT_REPORT_SIZE (-101)
|
|
#define HTTP_UE_SERVER_FILE_NOT_FOUND (-102)
|
|
#define HTTP_UE_SERVER_FORBIDDEN (-103)
|
|
#define HTTP_UE_SERVER_WRONG_HTTP_CODE (-104)
|
|
#define HTTP_UE_SERVER_FAULTY_MD5 (-105)
|
|
#define HTTP_UE_BIN_VERIFY_HEADER_FAILED (-106)
|
|
#define HTTP_UE_BIN_FOR_WRONG_FLASH (-107)
|
|
|
|
enum HTTPUpdateResult {
|
|
HTTP_UPDATE_FAILED,
|
|
HTTP_UPDATE_NO_UPDATES,
|
|
HTTP_UPDATE_OK
|
|
};
|
|
|
|
typedef HTTPUpdateResult t_httpUpdate_return; // backward compatibility
|
|
|
|
class ESP8266HTTPUpdate
|
|
{
|
|
public:
|
|
ESP8266HTTPUpdate(void);
|
|
ESP8266HTTPUpdate(int httpClientTimeout);
|
|
~ESP8266HTTPUpdate(void);
|
|
|
|
void rebootOnUpdate(bool reboot)
|
|
{
|
|
_rebootOnUpdate = reboot;
|
|
}
|
|
|
|
// This function is deprecated, use rebootOnUpdate and the next one instead
|
|
t_httpUpdate_return update(const String& url, const String& currentVersion,
|
|
const String& httpsFingerprint, bool reboot) __attribute__((deprecated));
|
|
t_httpUpdate_return update(const String& url, const String& currentVersion = "");
|
|
t_httpUpdate_return update(const String& url, const String& currentVersion,
|
|
const String& httpsFingerprint);
|
|
t_httpUpdate_return update(const String& url, const String& currentVersion,
|
|
const uint8_t httpsFingerprint[20]); // BearSSL
|
|
|
|
// This function is deprecated, use one of the overloads below along with rebootOnUpdate
|
|
t_httpUpdate_return update(const String& host, uint16_t port, const String& uri, const String& currentVersion,
|
|
bool https, const String& httpsFingerprint, bool reboot) __attribute__((deprecated));
|
|
|
|
t_httpUpdate_return update(const String& host, uint16_t port, const String& uri = "/",
|
|
const String& currentVersion = "");
|
|
t_httpUpdate_return update(const String& host, uint16_t port, const String& url,
|
|
const String& currentVersion, const String& httpsFingerprint);
|
|
t_httpUpdate_return update(const String& host, uint16_t port, const String& url,
|
|
const String& currentVersion, const uint8_t httpsFingerprint[20]); // BearSSL
|
|
|
|
// This function is deprecated, use rebootOnUpdate and the next one instead
|
|
t_httpUpdate_return updateSpiffs(const String& url, const String& currentVersion,
|
|
const String& httpsFingerprint, bool reboot) __attribute__((deprecated));
|
|
t_httpUpdate_return updateSpiffs(const String& url, const String& currentVersion = "");
|
|
t_httpUpdate_return updateSpiffs(const String& url, const String& currentVersion, const String& httpsFingerprint);
|
|
t_httpUpdate_return updateSpiffs(const String& url, const String& currentVersion, const uint8_t httpsFingerprint[20]); // BearSSL
|
|
|
|
|
|
int getLastError(void);
|
|
String getLastErrorString(void);
|
|
|
|
protected:
|
|
t_httpUpdate_return handleUpdate(HTTPClient& http, const String& currentVersion, bool spiffs = false);
|
|
bool runUpdate(Stream& in, uint32_t size, String md5, int command = U_FLASH);
|
|
|
|
int _lastError;
|
|
bool _rebootOnUpdate = true;
|
|
private:
|
|
int _httpClientTimeout;
|
|
};
|
|
|
|
#if !defined(NO_GLOBAL_INSTANCES) && !defined(NO_GLOBAL_HTTPUPDATE)
|
|
extern ESP8266HTTPUpdate ESPhttpUpdate;
|
|
#endif
|
|
|
|
#endif /* ESP8266HTTPUPDATE_H_ */
|