sslclient.c

Go to the documentation of this file.

/*
 * Copyright 2023 Morse Micro
 *
 * SPDX-License-Identifier: Apache-2.0
 */
 
#include <string.h>
#include "mmosal.h"
#include "mmwlan.h"
#include "mmconfig.h"
#include "mmipal.h"
#include "mbedtls/build_info.h"
#include "mbedtls/platform.h"
#include "mbedtls/net.h"
#include "mbedtls/ssl.h"
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"
#include "mbedtls/debug.h"
#include "mm_app_common.h"
#include "default_certs.h"
 
#define DEFAULT_PORT "443"
#define DEFAULT_SERVER "www.google.com"
#define GET_REQUEST "GET / HTTP/1.0\r\n\r\n"
 
char buf[1408];
 
void my_debug(void *ctx, int level, const char *file, int line, const char *str)
{
    ((void)level);
    ((void)ctx);
 
    printf("%s:%04d: %s", file, line, str);
}
 
void app_init(void)
{
    uint8_t *allocptr = NULL;
 
    printf("\n\nMorse SSL Client Demo (Built " __DATE__ " " __TIME__ ")\n\n");
 
    /* Initialize and connect to Wi-Fi, blocks till connected */
    app_wlan_init();
    app_wlan_start();
 
    int ret = 0;
    int len = 0;
    size_t total = 0;
    mbedtls_net_context server_fd;
    const char *pers = "sslclient";
 
    mbedtls_entropy_context entropy;
    mbedtls_ctr_drbg_context ctr_drbg;
    mbedtls_ssl_context ssl;
    mbedtls_ssl_config conf;
    mbedtls_x509_crt cacert;
    mbedtls_x509_crt clicert;
    mbedtls_pk_context pkey;
 
    /*
     * 0. Initialize and setup mbedtls
     */
    printf("Initialising MbedTLS...");
    mbedtls_net_init(&server_fd);
    mbedtls_ssl_init(&ssl);
    mbedtls_ssl_config_init(&conf);
 
    /* Uncomment the following lines to enable verbose debugging */
    // mbedtls_ssl_conf_dbg(&conf, my_debug, NULL);
    // mbedtls_debug_set_threshold(4);
 
    mbedtls_x509_crt_init(&cacert);
    mbedtls_x509_crt_init(&clicert);
    mbedtls_pk_init(&pkey);
    mbedtls_ctr_drbg_init(&ctr_drbg);
    mbedtls_entropy_init(&entropy);
 
    ret = mbedtls_ctr_drbg_seed(&ctr_drbg,
                                mbedtls_entropy_func,
                                &entropy,
                                (const unsigned char *)pers,
                                strlen(pers));
    if (ret != 0)
    {
        printf(" failed %d in mbedtls_ctr_drbg_seed()\n\n", ret);
        goto exit;
    }
    printf(" ok\n");
 
    /*
     * 1. Load & setup certificates
     */
    allocptr = (uint8_t *)DEFAULT_ROOT_CERT;
    len = mmconfig_read_bytes("sslclient.rootca", NULL, 0, 0);
    if (len > 0)
    {
        /* Looks like we have a valid certificate */
        allocptr = (uint8_t *)mmosal_malloc(len + 1);
        if (allocptr)
        {
            /* Now read the bytes in */
            mmconfig_read_bytes("sslclient.rootca", allocptr, len, 0);
            /* Add NULL terminator as MbedTLS expects this, we already allocated +1 bytes */
            allocptr[len++] = 0;
        }
        else
        {
            printf("Failed to allocate memory for root certificate!\n\n");
            goto exit;
        }
    }
    else
    {
        len = sizeof(DEFAULT_ROOT_CERT);
    }
    printf("Loading the CA root certificate ...");
    ret = mbedtls_x509_crt_parse(&cacert, allocptr, len);
    if (ret < 0)
    {
        printf(" failed %d\n\n", ret);
        goto exit;
    }
    printf(" ok\n");
 
    allocptr = (uint8_t *)DEFAULT_CLIENT_CERT;
    len = mmconfig_read_bytes("sslclient.clientcert", NULL, 0, 0);
    if (len > 0)
    {
        /* Looks like we have a valid certificate */
        allocptr = (uint8_t *)mmosal_malloc(len + 1);
        if (allocptr)
        {
            /* Now read the bytes in */
            mmconfig_read_bytes("sslclient.clientcert", allocptr, len, 0);
            /* Add NULL terminator as MbedTLS expects this, we already allocated +1 bytes */
            allocptr[len++] = 0;
        }
        else
        {
            printf("Failed to allocate memory for client certificate!\n\n");
            goto exit;
        }
    }
    else
    {
        len = sizeof(DEFAULT_CLIENT_CERT);
    }
    printf("Loading the client cert...");
    ret = mbedtls_x509_crt_parse(&clicert, allocptr, len);
    if (ret != 0)
    {
        printf(" failed %d\n\n", ret);
        goto exit;
    }
    printf(" ok\n");
 
    allocptr = (uint8_t *)DEFAULT_CLIENT_KEY;
    len = mmconfig_read_bytes("sslclient.clientkey", NULL, 0, 0);
    if (len > 0)
    {
        /* Looks like we have a valid certificate */
        allocptr = (uint8_t *)mmosal_malloc(len + 1);
        if (allocptr)
        {
            /* Now read the bytes in */
            mmconfig_read_bytes("sslclient.clientkey", allocptr, len, 0);
            /* Add NULL terminator as MbedTLS expects this, we already allocated +1 bytes */
            allocptr[len++] = 0;
        }
        else
        {
            printf("Failed to allocate memory for client key!\n\n");
            goto exit;
        }
    }
    else
    {
        len = sizeof(DEFAULT_CLIENT_KEY);
    }
    printf("Loading the client key...");
    ret = mbedtls_pk_parse_key(&pkey, allocptr, len, NULL, 0, mbedtls_ctr_drbg_random, &ctr_drbg);
    if (ret != 0)
    {
        printf(" failed %d\n\n", ret);
        goto exit;
    }
    printf(" ok\n");
 
    printf("Setting up client certs/key...");
    if ((ret = mbedtls_ssl_conf_own_cert(&conf, &clicert, &pkey)) != 0)
    {
        printf(" failed %d\n\n", ret);
        goto exit;
    }
    printf(" ok\n");
 
    /*
     * 2. Setup SSL
     */
    printf("Setting up SSL...");
    ret = mbedtls_ssl_config_defaults(&conf,
                                      MBEDTLS_SSL_IS_CLIENT,
                                      MBEDTLS_SSL_TRANSPORT_STREAM,
                                      MBEDTLS_SSL_PRESET_DEFAULT);
    if (ret != 0)
    {
        printf(" failed %d in mbedtls_ssl_config_defaults()\n\n", ret);
        goto exit;
    }
    mbedtls_ssl_conf_authmode(&conf, MBEDTLS_SSL_VERIFY_OPTIONAL);
    mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg);
    mbedtls_ssl_conf_ca_chain(&conf, &cacert, NULL);
    ret = mbedtls_ssl_setup(&ssl, &conf);
    if (ret != 0)
    {
        printf(" failed %d in mbedtls_ssl_setup()\n\n", ret);
        goto exit;
    }
 
    static char sslclient_server[64];
    strncpy(sslclient_server, DEFAULT_SERVER, sizeof(sslclient_server));
    (void)mmconfig_read_string("sslclient.server", sslclient_server, sizeof(sslclient_server));
    if ((ret = mbedtls_ssl_set_hostname(&ssl, sslclient_server)) != 0)
    {
        printf(" failed %d\n\n", ret);
        goto exit;
    }
    printf(" ok\n");
 
    /*
     * 3. Start the connection
     */
    /* First parse the URL to extract the server, port and resource */
    static char sslclient_port[8];
    strncpy(sslclient_port, DEFAULT_PORT, sizeof(sslclient_port));
    (void)mmconfig_read_string("sslclient.port", sslclient_port, sizeof(sslclient_port));
 
    printf("Connecting to %s:%s...", sslclient_server, sslclient_port);
    fflush(stdout);
    ret = mbedtls_net_connect(&server_fd, sslclient_server, sslclient_port, MBEDTLS_NET_PROTO_TCP);
    if (ret != 0)
    {
        printf(" failed %d\n\n", ret);
        goto exit;
    }
    printf(" ok\n");
 
    mbedtls_ssl_set_bio(&ssl, &server_fd, mbedtls_net_send, NULL, mbedtls_net_recv_timeout);
 
    /*
     * 4. Handshake
     */
    printf("Performing the SSL/TLS handshake...");
    ret = mbedtls_ssl_handshake(&ssl);
    if (ret != 0)
    {
        printf(" failed %d\n\n", ret);
        goto exit;
    }
    printf(" ok\n");
 
    /*
     * 5. Verify the server certificate
     */
    printf("Verifying peer X.509 certificate...");
    ret = mbedtls_ssl_get_verify_result(&ssl);
    if (ret != 0)
    {
        /* In real life, we probably want to bail out when ret != 0 */
        printf(" failed %d, did you set the time?\n\n", ret);
    }
    else
    {
        printf(" ok\n");
    }
 
    /*
     * 6. Write the GET request
     */
    printf("Write to server:");
    ret = mbedtls_ssl_write(&ssl, (const unsigned char *)GET_REQUEST, sizeof(GET_REQUEST) - 1);
    if (ret <= 0)
    {
        // mbedtls_ssl_write failed
        printf(" failed %d\n\n", ret);
        goto exit;
    }
    printf(" %d bytes written\n\n%s", ret, GET_REQUEST);
 
    /*
     * 7. Read the HTTP response
     */
    printf("Reading response from server:\n");
    memset(buf, 0, sizeof(buf));
    ret = mbedtls_ssl_read(&ssl, (unsigned char *)buf, sizeof(buf) - 1);
 
    if (ret > 0)
    {
        total = ret;
        printf("Printing headers only:\n\n");
 
        /* Search for blank line signifying end of headers */
        char *end_headers = strstr(buf, "\n\n");
        if (end_headers)
        {
            /* terminate the string at end of headers */
            *end_headers = 0;
        }
        end_headers = strstr(buf, "\r\n\r\n");
        if (end_headers)
        {
            /* terminate the string at end of headers */
            *end_headers = 0;
        }
 
        /* Print headers */
        puts(buf);
 
        /* Read the rest */
        while (1)
        {
            ret = mbedtls_ssl_read(&ssl, (unsigned char *)buf, sizeof(buf));
 
            if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE)
            {
                continue;
            }
 
            if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)
            {
                break;
            }
 
            if (ret < 0)
            {
                printf(" failed with error code %d\n\n", ret);
                break;
            }
 
            if (ret == 0)
            {
                /* No more data to read */
                break;
            }
 
            total += ret;
        }
    }
 
    if (total > 0)
    {
        printf("\nSuccess! %u bytes read in total.\n", total);
    }
    else
    {
        printf("\nFailed to read response from server!\n");
    }
 
    /*
     * 8. Close the connection
     */
    mbedtls_ssl_close_notify(&ssl);
 
exit:
    mbedtls_net_free(&server_fd);
 
    mbedtls_ssl_free(&ssl);
    mbedtls_ssl_config_free(&conf);
    mbedtls_ctr_drbg_free(&ctr_drbg);
    mbedtls_entropy_free(&entropy);
}