Skip to content

Commit

Permalink
feat(esp_tls): Add support for PSK authentication on server side
Browse files Browse the repository at this point in the history
  • Loading branch information
@david-cermak
david-cermak committed Nov 18, 2024
1 parent e8800ac commit 7ef2379
Show file tree
Hide file tree
Showing 2 changed files with 27 additions and 9 deletions.
22 changes: 14 additions & 8 deletions components/esp-tls/esp_tls.h
View file
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
/*
* SPDX-FileCopyrightText: 2017-2023 Espressif Systems (Shanghai) CO LTD
* SPDX-FileCopyrightText: 2017-2024 Espressif Systems (Shanghai) CO LTD
*
* SPDX-License-Identifier: Apache-2.0
*/
Expand Down Expand Up @@ -322,6 +322,12 @@ typedef struct esp_tls_cfg_server {
TLS extensions, such as ALPN and server_certificate_type . */
#endif

#if defined(CONFIG_ESP_TLS_PSK_VERIFICATION)
const psk_hint_key_t* psk_hint_key; /*!< Pointer to PSK hint and key. if not NULL (and the certificate/key is NULL)
then PSK authentication is enabled with configured setup.
Important note: the pointer must be valid for connection */
#endif

} esp_tls_cfg_server_t;

/**
Expand Down Expand Up @@ -464,7 +470,7 @@ int esp_tls_conn_http_new_async(const char *url, const esp_tls_cfg_t *cfg, esp_t
* - >=0 if write operation was successful, the return value is the number
* of bytes actually written to the TLS/SSL connection.
* - <0 if write operation was not successful, because either an
* error occured or an action must be taken by the calling process.
* error occurred or an action must be taken by the calling process.
* - ESP_TLS_ERR_SSL_WANT_READ/
* ESP_TLS_ERR_SSL_WANT_WRITE.
* if the handshake is incomplete and waiting for data to be available for reading.
Expand All @@ -485,7 +491,7 @@ ssize_t esp_tls_conn_write(esp_tls_t *tls, const void *data, size_t datalen);
* - 0 if read operation was not successful. The underlying
* connection was closed.
* - <0 if read operation was not successful, because either an
* error occured or an action must be taken by the calling process.
* error occurred or an action must be taken by the calling process.
*/
ssize_t esp_tls_conn_read(esp_tls_t *tls, void *data, size_t datalen);

Expand Down Expand Up @@ -537,7 +543,7 @@ esp_err_t esp_tls_get_conn_sockfd(esp_tls_t *tls, int *sockfd);
*
* @param[in] sockfd sockfd value to set.
*
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
* - ESP_ERR_INVALID_ARG if (tls == NULL || sockfd < 0)
*/
esp_err_t esp_tls_set_conn_sockfd(esp_tls_t *tls, int sockfd);
Expand All @@ -549,7 +555,7 @@ esp_err_t esp_tls_set_conn_sockfd(esp_tls_t *tls, int sockfd);
*
* @param[out] conn_state pointer to the connection state value.
*
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
* - ESP_ERR_INVALID_ARG (Invalid arguments)
*/
esp_err_t esp_tls_get_conn_state(esp_tls_t *tls, esp_tls_conn_state_t *conn_state);
Expand All @@ -561,7 +567,7 @@ esp_err_t esp_tls_get_conn_state(esp_tls_t *tls, esp_tls_conn_state_t *conn_stat
*
* @param[in] conn_state connection state value to set.
*
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated withthe provided value
* @return - ESP_OK on success and value of sockfd for the tls connection shall updated with the provided value
* - ESP_ERR_INVALID_ARG (Invalid arguments)
*/
esp_err_t esp_tls_set_conn_state(esp_tls_t *tls, esp_tls_conn_state_t conn_state);
Expand All @@ -586,7 +592,7 @@ void *esp_tls_get_ssl_context(esp_tls_t *tls);
*
* @return
* - ESP_OK if creating global CA store was successful.
* - ESP_ERR_NO_MEM if an error occured when allocating the mbedTLS resources.
* - ESP_ERR_NO_MEM if an error occurred when allocating the mbedTLS resources.
*/
esp_err_t esp_tls_init_global_ca_store(void);

Expand All @@ -605,7 +611,7 @@ esp_err_t esp_tls_init_global_ca_store(void);
*
* @return
* - ESP_OK if adding certificates was successful.
* - Other if an error occured or an action must be taken by the calling process.
* - Other if an error occurred or an action must be taken by the calling process.
*/
esp_err_t esp_tls_set_global_ca_store(const unsigned char *cacert_pem_buf, const unsigned int cacert_pem_bytes);

Expand Down
14 changes: 13 additions & 1 deletion components/esp-tls/esp_tls_mbedtls.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -659,6 +659,18 @@ static esp_err_t set_server_config(esp_tls_cfg_server_t *cfg, esp_tls_t *tls)
ESP_LOGE(TAG, "Failed to set server pki context");
return esp_ret;
}
#if defined(CONFIG_ESP_TLS_PSK_VERIFICATION)
} else if (cfg->psk_hint_key) {
ESP_LOGD(TAG, "PSK authentication");
ret = mbedtls_ssl_conf_psk(&tls->conf, cfg->psk_hint_key->key, cfg->psk_hint_key->key_size,
(const unsigned char *)cfg->psk_hint_key->hint, strlen(cfg->psk_hint_key->hint));
if (ret != 0) {
ESP_LOGE(TAG, "mbedtls_ssl_conf_psk returned -0x%04X", -ret);
mbedtls_print_error_msg(ret);
ESP_INT_EVENT_TRACKER_CAPTURE(tls->error_handle, ESP_TLS_ERR_TYPE_MBEDTLS, -ret);
return ESP_ERR_MBEDTLS_SSL_CONF_PSK_FAILED;
}
#endif
} else {
#if defined(CONFIG_ESP_TLS_SERVER_CERT_SELECT_HOOK)
if (cfg->cert_select_cb == NULL) {
Expand Down Expand Up @@ -789,7 +801,7 @@ esp_err_t set_client_config(const char *hostname, size_t hostlen, esp_tls_cfg_t
#endif
#ifdef CONFIG_ESP_TLS_CLIENT_SESSION_TICKETS
} else if (cfg->client_session != NULL) {
ESP_LOGD(TAG, "Resuing the saved client session");
ESP_LOGD(TAG, "Resuming the saved client session");
#endif
} else {
#ifdef CONFIG_ESP_TLS_SKIP_SERVER_CERT_VERIFY
Expand Down

0 comments on commit 7ef2379

Please sign in to comment.