Add Native SSL Library

[brentru]

We're currently using the mbedTLS implementation of the TLS and SSL protocols on the ESP32 Co-Processor/AirLifts by communicating with an ESP32 running nina-fw from CircuitPython. While this solution is stable, a native CircuitPython SSL/TLS library would be faster, remove the hardware dependency for an ESP32 and allow for different transports (not just wifi).

Some embedded ssl/tls implementations:
BearSSL: https://bearssl.org
AxTLS: http://axtls.sourceforge.net

[moto-timo]

Would be great to have a common TLS approach.

[tannewt]

We could have the ssl module actually do SSL over the wrapped socket.

[timonsku]

This would be great to have so Wiznet and potentially other Ethernet MACs like in the i.MX RT can support SSL too. Are there any plans yet?

[askpatrickw]

There are MicroPython SSL implementations, could they be used as a starting point?

[tannewt]

@timonsku No plans for Adafruit-funded folks.

@askpatrickw Yup! Definitely. Their code is usually well done and a good reference.

[nabber00]

Seems like WolfSSL Python should be pretty easy to add?

[dhalbert]

Seems like WolfSSL Python should be pretty easy to add?

The WolfSSL library is GPL2 and commercial. We don't put GPL code in CircuitPython so as not to GPL-ize the whole thing, and the commercial restrictions are also an issue.

[anecdata]

I think the CircuitPython core elements are now in place for this, but it needs some changes in the ESP32SPI-related libraries (and possibly NINA) to make the ESP32 sockets compatible. There's a compatibility checklist in #8954. The native ssl module is only installed on certain boards though.

Tested config:

• UnexpectedMaker FeatherS3 Adafruit CircuitPython 9.1.0-beta.2 on 2024-05-15; FeatherS3 with ESP32S3
• Adafruit Airlift FeatherWing (NINA v1.7.1)
• libraries are current release ...9.x-mpy-20240516

This code tries to simulate an HTTPS Request over ESP32SPI using a native-ssl-wrapped socket (the socket comes from NINA, the wrapper comes from the ESP32-S3):

import time
import os
import board
import digitalio
import socketpool
import ssl
import wifi
import adafruit_connection_manager
from adafruit_esp32spi import adafruit_esp32spi

HOST = "httpbin.org"
PATH = "/get"
PORT = 443

time.sleep(3)  # wait for serial

buf = bytearray(1024)

spi = board.SPI()
esp32_cs = digitalio.DigitalInOut(board.D13)
esp32_reset = digitalio.DigitalInOut(board.D12)
esp32_ready = digitalio.DigitalInOut(board.D11)
radio = adafruit_esp32spi.ESP_SPIcontrol(spi, esp32_cs, esp32_ready, esp32_reset)

radio2 = wifi.radio

pool = adafruit_connection_manager.get_radio_socketpool(radio)  # ESP32SPI
ssl_context = adafruit_connection_manager.get_radio_ssl_context(radio2)  # native wifi

print(f'Connecting to wifi... ', end='')
radio.connect(os.getenv("WIFI_SSID"), os.getenv("WIFI_PASSWORD"))
print(f'{radio.ipv4_address}')

for _ in range(0, 10):
    print(f'{"-"*25}')
    print('Creating TCP client socket...')
    s = pool.socket(pool.AF_INET, pool.SOCK_STREAM)
    ss = ssl_context.wrap_socket(s, server_hostname=HOST)
    print('Connecting to remote socket...')
    ss.connect((HOST, PORT))

    sbytes = f'GET {PATH} HTTP/1.1\r\nHost: {HOST}:{PORT}\r\n\r\n'.encode()
    # note that esp32spi doesn't return the number of bytes sent like CPython:
    ssize = ss.send(sbytes)
    print(f'Sent {ssize} bytes: {sbytes}')

    rsize = ss.recv_into(buf)
    print(f'Received {rsize} bytes: {buf[:rsize]}')

    ss.close()
    time.sleep(1)

code.py output:
Connecting to wifi... 192.168.6.74
-------------------------
Creating TCP client socket...
Traceback (most recent call last):
  File "code.py", line 38, in <module>
AttributeError: 'Socket' object has no attribute 'type'