Skip to content

Commit 5beb1a3

Browse files
devytedevyte
authored
Merge branch 'master' into pgmspace_to_libc
2 parents f6da831 + 055748f commit 5beb1a3

33 files changed

+592
-250
lines changed

‎cores/esp8266/core_esp8266_waveform.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -282,7 +282,7 @@ static ICACHE_RAM_ATTR void timer1Interrupt() {
282282
// Check for timed-out waveforms out of the high-frequency toggle loop
283283
for (size_t i = 0; i < countof(waveform); i++) {
284284
Waveform *wave = &waveform[i];
285-
if (wave->timeLeftCycles) {
285+
if (wave->enabled && wave->timeLeftCycles) {
286286
// Check for unsigned underflow with new > old
287287
if (deltaCycles >= wave->timeLeftCycles) {
288288
// Done, remove!

‎doc/esp8266wifi/bearssl-client-secure-class.rst

Lines changed: 214 additions & 0 deletions
Large diffs are not rendered by default.

‎doc/esp8266wifi/bearssl-server-secure-class.rst

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
:orphan:
2+
3+
BearSSL Secure Server Class
4+
---------------------------
5+
6+
Implements a TLS encrypted server with optional client certificate validation. See `Server Class <server-class.rst>`__ for general information and `BearSSL Secure Client Class <bearssl-secure-client-class.rst>`__ for basic server and BearSSL concepts.
7+
8+
setBufferSizes(int recv, int xmit)
9+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
10+
11+
Similar to the `BearSSL::WiFiClientSecure` method, sets the receive and transmit buffer sizes. Note that servers cannot request a buffer size from the client, so if these are shrunk and the client tries to send a chunk larger than the receive buffer, it will always fail. This must be called before the server is
12+
13+
Setting Server Certificates
14+
~~~~~~~~~~~~~~~~~~~~~~~~~~~
15+
16+
TLS servers require a certificate identifying itself and containing its public key, and a private key they will use to encrypt information with. The application author is responsible for generating this certificate and key, either using a self-signed generator or using a commercial certification authority. **Do not re-use the certificates included in the examples provided.**
17+
18+
This example command will generate a RSA 2048-bit key and certificate:
19+
20+
.. code::
21+
22+
openssl req -x509 -nodes -newkey rsa:2048 -keyout key.pem -out cert.pem -days 4096
23+
24+
Again, it is up to the application author to generate this certificate and key and keep the private key safe and **private.**
25+
26+
setRSACert(const BearSSL::X509List *chain, const BearSSL::PrivateKey *sk)
27+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
28+
29+
Sets a RSA certificate and key to be used by the server when connections are received. Needs to be called before `begin()`
30+
31+
setECCert(const BearSSL::X509List *chain, unsigned cert_issuer_key_type, const BearSSL::PrivateKey *sk)
32+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
33+
34+
Sets an elliptic curve certificate and key for the server. Needs to be called before `begin()`.
35+
36+
Requiring Client Certificates
37+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
38+
39+
TLS servers can request the client to identify itself by transmitting a certificate during handshake. If the client cannot transmit the certificate, the connection will be dropped by the server.
40+
41+
setClientTrustAnchor(const BearSSL::X509List *client_CA_ta)
42+
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
43+
44+
Sets the trust anchor (normally a self-signing CA) that all received certificates will be verified against. Needs to be called before `begin()`.

‎doc/esp8266wifi/client-secure-examples.rst

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ In the next steps we should execute GET command. This is done is similar way as
117117
118118
After sending the request we should wait for a reply and then process received information.
119119

120-
Out of received replay we can skip response header. This can be done by reading until an empty line ``"\r"`` that marks the end of the header:
120+
Out of received reply we can skip response header. This can be done by reading until an empty line ``"\r"`` that marks the end of the header:
121121

122122
.. code:: cpp
123123

‎doc/esp8266wifi/readme.rst

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -157,18 +157,32 @@ The Client class creates `clients <https://en.wikipedia.org/wiki/Client_(computi
157157

158158
Check out separate section with `examples <client-examples.rst>`__ / `list of functions <client-class.rst>`__
159159

160-
Client Secure
161-
~~~~~~~~~~~~~
160+
axTLS Client Secure - DEPRECATED
161+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
162162

163-
The Client Secure is an extension of `Client Class <#client>`__ where connection and data exchange with servers is done using a `secure protocol <https://en.wikipedia.org/wiki/Transport_Layer_Security>`__. It supports `TLS 1.1 <https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.1>`__. The `TLS 1.2 <https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2>`__ is not supported.
163+
The following section details axTLS, the older TLS library used by the project. It is still supported, but additional fixes and documentation will generally not be undertaken. See the following section for the updated TLS client object.
164164

165-
.. figure:: pictures/esp8266-client-secure.png
166-
:alt: ESP8266 operating as the Client Secure
165+
The axTLS Client Secure is an extension of `Client Class <#client>`__ where connection and data exchange with servers is done using a `secure protocol <https://en.wikipedia.org/wiki/Transport_Layer_Security>`__. It supports `TLS 1.1 <https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.1>`__. The `TLS 1.2 <https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2>`__ is not supported.
167166

168167
Secure applications have additional memory (and processing) overhead due to the need to run cryptography algorithms. The stronger the certificate's key, the more overhead is needed. In practice it is not possible to run more than a single secure client at a time. The problem concerns RAM memory we can not add, the flash memory size is usually not the issue. If you like to learn how `client secure library <https://github.com/esp8266/Arduino/blob/master/libraries/ESP8266WiFi/src/WiFiClientSecure.h>`__ has been developed, access to what servers have been tested, and how memory limitations have been overcame, read fascinating issue report `#43 <https://github.com/esp8266/Arduino/issues/43>`__.
169168

170169
Check out separate section with `examples <client-secure-examples.rst>`__ / `list of functions <client-secure-class.rst>`__
171170

171+
172+
BearSSL Client Secure and Server Secure
173+
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
174+
175+
`BearSSL::WiFiClientSecure` and `BearSSL::WiFiServerSecure` are extensions of the standard `Client <#client>`__ and `Server <#server>`__ classes where connection and data exchange with servers and clients using `secure protocol <https://en.wikipedia.org/wiki/Transport_Layer_Security>`__. It supports `TLS 1.2 <https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.2>`__ using a wide variety of modern ciphers, hashes, and key types.
176+
177+
.. figure:: pictures/esp8266-client-secure.png
178+
:alt: ESP8266 operating as the Client Secure
179+
180+
Secure clients and servers require siginificant amounts of additional memory and processing to enable their cryptographic algorithms. In general only a single secure client or server connection at a time can be processed given the little RAM present on the ESP8266, but there are methods of reducing this RAM requirement detailed in the relevant sections.
181+
182+
`BearSSL::WiFiClientSecure <bearssl-client-secure-class.rst>`__ contains more information on using and configuring TLS connections.
183+
184+
`BearSSL::WiFiServerSecure <bearssl-server-secure-class.rst>`__ discusses the TLS server mode available. Please read and understand the `BearSSL::WiFiClientSecure <bearssl-client-secure-class.rst>`__ first as the server uses most of the same concepts.
185+
172186
Server
173187
~~~~~~
174188

‎doc/esp8266wifi/soft-access-point-class.rst

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,8 @@ The first parameter of this function is required, remaining four are optional.
5050

5151
Meaning of all parameters is as follows:
5252

53-
- ``ssid`` - character string containing network SSID (max. 63 characters)
54-
- ``password`` - optional character string with a password. For WPA2-PSK network it should be at least 8 character long. If not specified, the access point will be open for anybody to connect.
53+
- ``ssid`` - character string containing network SSID (max. 31 characters)
54+
- ``password`` - optional character string with a password. For WPA2-PSK network it should be at least 8 character long. If not specified, the access point will be open for anybody to connect, (max. 63 characters).
5555
- ``channel`` - optional parameter to set Wi-Fi channel, from 1 to 13. Default channel = 1.
5656
- ``hidden`` - optional parameter, if set to ``true`` will hide SSID.
5757
- ``max_connection`` - optional parameter to set max simultaneous connected stations, `from 0 to 8 <https://bbs.espressif.com/viewtopic.php?f=46&t=481&p=1832&hilit=max_connection#p1832>`__. Defaults to 4. Once the max number has been reached, any other station that wants to connect will be forced to wait until an already connected station disconnects.

‎doc/libraries.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ Libraries that don't rely on low-level access to AVR registers should work well.
164164
- `DimSwitch <https://github.com/krzychb/DimSwitch>`__ - Control electronic dimmable ballasts for fluorescent light tubes remotely as if using a wall switch.
165165
- `Encoder <https://github.com/PaulStoffregen/Encoder>`__ - Arduino library for rotary encoders. Version 1.4 supports ESP8266.
166166
- `esp8266\_mdns <https://github.com/mrdunk/esp8266_mdns>`__ - mDNS queries and responses on esp8266. Or to describe it another way: An mDNS Client or Bonjour Client library for the esp8266.
167+
- `ESP-NOW <https://github.com/yoursunny/WifiEspNow>`__ - Wrapper lib for ESP-NOW (See `#2227 <https://github.com/esp8266/Arduino/issues/2227>`__)
167168
- `ESPAsyncTCP <https://github.com/me-no-dev/ESPAsyncTCP>`__ - Asynchronous TCP Library for ESP8266 and ESP32/31B
168169
- `ESPAsyncWebServer <https://github.com/me-no-dev/ESPAsyncWebServer>`__ - Asynchronous Web Server Library for ESP8266 and ESP32/31B
169170
- `Homie for ESP8266 <https://github.com/marvinroger/homie-esp8266>`__ - Arduino framework for ESP8266 implementing Homie, an MQTT convention for the IoT.

‎libraries/DNSServer/src/DNSServer.cpp

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,11 @@
22
#include <lwip/def.h>
33
#include <Arduino.h>
44

5+
#ifdef DEBUG_ESP_PORT
6+
#define DEBUG_OUTPUT DEBUG_ESP_PORT
7+
#else
8+
#define DEBUG_OUTPUT Serial
9+
#endif
510

611
DNSServer::DNSServer()
712
{
@@ -165,7 +170,7 @@ void DNSServer::replyWithIP(uint8_t* buffer, size_t packetSize)
165170
_udp.endPacket();
166171

167172
#ifdef DEBUG_ESP_DNS
168-
DEBUG_ESP_PORT.printf("DNS responds: %s for %s\n",
173+
DEBUG_OUTPUT.printf("DNS responds: %s for %s\n",
169174
IPAddress(_resolvedIP).toString().c_str(), getDomainNameWithoutWwwPrefix(buffer, packetSize).c_str() );
170175
#endif
171176
}

‎libraries/ESP8266HTTPClient/src/ESP8266HTTPClient.cpp

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1036,7 +1036,7 @@ bool HTTPClient::connect(void)
10361036
}
10371037

10381038
#ifdef HTTPCLIENT_1_1_COMPATIBLE
1039-
if(!_client) {
1039+
if(!_client && _transportTraits) {
10401040
_tcpDeprecated = _transportTraits->create();
10411041
_client = _tcpDeprecated.get();
10421042
}

‎libraries/ESP8266HTTPUpdateServer/examples/SecureBearSSLUpdater/SecureBearSSLUpdater.ino

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ void setup()
101101

102102
MDNS.begin(host);
103103

104-
httpServer.setRSACert(new BearSSLX509List(serverCert), new BearSSLPrivateKey(serverKey));
104+
httpServer.setRSACert(new BearSSL::X509List(serverCert), new BearSSL::PrivateKey(serverKey));
105105
httpUpdater.setup(&httpServer, update_path, update_username, update_password);
106106
httpServer.begin();
107107

‎libraries/ESP8266WebServer/examples/HelloServerBearSSL/HelloServerBearSSL.ino

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ void setup(void){
123123
Serial.println("MDNS responder started");
124124
}
125125

126-
server.setRSACert(new BearSSLX509List(serverCert), new BearSSLPrivateKey(serverKey));
126+
server.setRSACert(new BearSSL::X509List(serverCert), new BearSSL::PrivateKey(serverKey));
127127

128128
server.on("/", handleRoot);
129129

‎libraries/ESP8266WebServer/src/ESP8266WebServerSecureBearSSL.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -46,12 +46,12 @@ ESP8266WebServerSecure::ESP8266WebServerSecure(int port)
4646
{
4747
}
4848

49-
void ESP8266WebServerSecure::setRSACert(const BearSSLX509List *chain, const BearSSLPrivateKey *sk)
49+
void ESP8266WebServerSecure::setRSACert(const X509List *chain, const PrivateKey *sk)
5050
{
5151
_serverSecure.setRSACert(chain, sk);
5252
}
5353

54-
void ESP8266WebServerSecure::setECCert(const BearSSLX509List *chain, unsigned cert_issuer_key_type, const BearSSLPrivateKey *sk)
54+
void ESP8266WebServerSecure::setECCert(const X509List *chain, unsigned cert_issuer_key_type, const PrivateKey *sk)
5555
{
5656
_serverSecure.setECCert(chain, cert_issuer_key_type, sk);
5757
}
@@ -83,7 +83,7 @@ void ESP8266WebServerSecure::begin() {
8383

8484
void ESP8266WebServerSecure::handleClient() {
8585
if (_currentStatus == HC_NONE) {
86-
BearSSL::WiFiClientSecure client = _serverSecure.available();
86+
WiFiClientSecure client = _serverSecure.available();
8787
if (!client) {
8888
return;
8989
}
@@ -136,7 +136,7 @@ void ESP8266WebServerSecure::handleClient() {
136136
}
137137

138138
if (!keepCurrentClient) {
139-
_currentClientSecure = BearSSL::WiFiClientSecure();
139+
_currentClientSecure = WiFiClientSecure();
140140
_currentStatus = HC_NONE;
141141
_currentUpload.reset();
142142
}

‎libraries/ESP8266WebServer/src/ESP8266WebServerSecureBearSSL.h

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,8 @@ class ESP8266WebServerSecure : public ESP8266WebServer
3737
virtual ~ESP8266WebServerSecure();
3838

3939
void setBufferSizes(int recv, int xmit);
40-
void setRSACert(const BearSSLX509List *chain, const BearSSLPrivateKey *sk);
41-
void setECCert(const BearSSLX509List *chain, unsigned cert_issuer_key_type, const BearSSLPrivateKey *sk);
40+
void setRSACert(const X509List *chain, const PrivateKey *sk);
41+
void setECCert(const X509List *chain, unsigned cert_issuer_key_type, const PrivateKey *sk);
4242

4343
WiFiClient client() override { return _currentClientSecure; }
4444

@@ -61,8 +61,8 @@ class ESP8266WebServerSecure : public ESP8266WebServer
6161
size_t _currentClientWrite_P (PGM_P bytes, size_t len) override { return _currentClientSecure.write_P(bytes, len); }
6262

6363
protected:
64-
BearSSL::WiFiServerSecure _serverSecure;
65-
BearSSL::WiFiClientSecure _currentClientSecure;
64+
WiFiServerSecure _serverSecure;
65+
WiFiClientSecure _currentClientSecure;
6666
};
6767

6868
};

‎libraries/ESP8266WiFi/examples/BearSSL_Server/BearSSL_Server.ino

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,8 @@ void setup() {
121121
Serial.println(WiFi.localIP());
122122

123123
// Attach the server private cert/key combo
124-
BearSSLX509List *serverCertList = new BearSSLX509List(server_cert);
125-
BearSSLPrivateKey *serverPrivKey = new BearSSLPrivateKey(server_private_key);
124+
BearSSL::X509List *serverCertList = new BearSSL::X509List(server_cert);
125+
BearSSL::PrivateKey *serverPrivKey = new BearSSL::PrivateKey(server_private_key);
126126
server.setRSACert(serverCertList, serverPrivKey);
127127

128128
// Actually start accepting connections

‎libraries/ESP8266WiFi/examples/BearSSL_ServerClientCert/BearSSL_ServerClientCert.ino

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -197,12 +197,12 @@ void setup() {
197197
setClock(); // Required for X.509 validation
198198

199199
// Attach the server private cert/key combo
200-
BearSSLX509List *serverCertList = new BearSSLX509List(server_cert);
201-
BearSSLPrivateKey *serverPrivKey = new BearSSLPrivateKey(server_private_key);
200+
BearSSL::X509List *serverCertList = new BearSSL::X509List(server_cert);
201+
BearSSL::PrivateKey *serverPrivKey = new BearSSL::PrivateKey(server_private_key);
202202
server.setRSACert(serverCertList, serverPrivKey);
203203

204204
// Require a certificate validated by the trusted CA
205-
BearSSLX509List *serverTrustedCA = new BearSSLX509List(ca_cert);
205+
BearSSL::X509List *serverTrustedCA = new BearSSL::X509List(ca_cert);
206206
server.setClientTrustAnchor(serverTrustedCA);
207207

208208
// Actually start accepting connections

‎libraries/ESP8266WiFi/examples/BearSSL_Sessions/BearSSL_Sessions.ino

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -119,7 +119,7 @@ vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
119119
)EOF";
120120
uint32_t start, finish;
121121
BearSSL::WiFiClientSecure client;
122-
BearSSLX509List cert(digicert);
122+
BearSSL::X509List cert(digicert);
123123

124124
Serial.printf("Connecting without sessions...");
125125
start = millis();
@@ -128,7 +128,7 @@ vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep
128128
finish = millis();
129129
Serial.printf("Total time: %dms\n", finish - start);
130130

131-
BearSSLSession session;
131+
BearSSL::Session session;
132132
client.setSession(&session);
133133
Serial.printf("Connecting with an unitialized session...");
134134
start = millis();

‎libraries/ESP8266WiFi/examples/BearSSL_Validation/BearSSL_Validation.ino

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -144,7 +144,7 @@ wQIDAQAB
144144
-----END PUBLIC KEY-----
145145
)KEY";
146146
BearSSL::WiFiClientSecure client;
147-
BearSSLPublicKey key(pubkey);
147+
BearSSL::PublicKey key(pubkey);
148148
client.setKnownKey(&key);
149149
fetchURL(&client, host, port, path);
150150
}
@@ -186,7 +186,7 @@ BearSSL does verify the notValidBefore/After fields.
186186
)EOF");
187187

188188
BearSSL::WiFiClientSecure client;
189-
BearSSLX509List cert(digicert);
189+
BearSSL::X509List cert(digicert);
190190
client.setTrustAnchors(&cert);
191191
Serial.printf("Try validating without setting the time (should fail)\n");
192192
fetchURL(&client, host, port, path);

‎libraries/ESP8266WiFi/keywords.txt

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,11 +19,14 @@ WiFiServerSecure KEYWORD1
1919
WiFiUDP KEYWORD1
2020
WiFiClientSecure KEYWORD1
2121
ESP8266WiFiMulti KEYWORD1
22-
BearSSLX509List KEYWORD1
23-
BearSSLPrivateKey KEYWORD1
24-
BearSSLPublicKey KEYWORD1
22+
BearSSL KEYWORD1
23+
X509List KEYWORD1
24+
PrivateKey KEYWORD1
25+
PublicKey KEYWORD1
2526
CertStoreSPIFFSBearSSL KEYWORD1
2627
CertStoreSDBearSSL KEYWORD1
28+
Session KEYWORD1
29+
2730

2831
#######################################
2932
# Methods and Functions (KEYWORD2)

0 commit comments

Comments
 (0)