summaryrefslogtreecommitdiffstatshomepage
path: root/extmod/modssl_mbedtls.c
Commit message (Collapse)AuthorAge
* extmod/modtls: Move the native ssl module to tls.Felix Dörre2024-02-07
| | | | | | | | | | | | | The current `ssl` module has quite a few differences to the CPython implementation. This change moves the MicroPython variant to a new `tls` module and provides a wrapper module for `ssl` (in micropython-lib). Users who only rely on implemented comparible behavior can continue to use `ssl`, while users that rely on non-compatible behavior should switch to `tls`. Then we can make the facade in `ssl` more strictly adhere to CPython. Signed-off-by: Felix Dörre <felix@dogcraft.de>
* extmod/modssl_mbedtls: Fix cipher iteration in SSLContext.get_ciphers.Damien George2024-01-29
| | | | | | | | | | Prior to this commit it would skip every second cipher returned from mbedtls. The corresponding test is also updated and now passes on esp32, rp2, stm32 and unix. Signed-off-by: Damien George <damien@micropython.org>
* extmod/asyncio: Add ssl support with SSLContext.Carlosgg2023-12-14
| | | | | | | | | | | | | | This adds asyncio ssl support with SSLContext and the corresponding tests in `tests/net_inet` and `tests/multi_net`. Note that not doing the handshake on connect will delegate the handshake to the following `mbedtls_ssl_read/write` calls. However if the handshake fails when a client certificate is required and not presented by the peer, it needs to be notified of this handshake error (otherwise it will hang until timeout if any). Finally at MicroPython side raise the proper mbedtls error code and message. Signed-off-by: Carlos Gil <carlosgilglez@gmail.com>
* extmod/modssl_mbedtls: Fix parsing of ciphers in set_ciphers method.Damien George2023-12-14
| | | | | | | | | Fixes two issues: - None should not be allowed in the list, otherwise the corresponding entry in ciphersuites[i] will have an undefined value. - The terminating 0 needs to be put in ciphersuites[len]. Signed-off-by: Damien George <damien@micropython.org>
* extmod/modssl_mbedtls: Make SSLSocket.getpeercert() optional.Damien George2023-12-12
| | | | | | | | | | And only enable this method when the relevant feature is available in mbedtls. Otherwise, if mbedtls doesn't support getting the peer certificate, this method always returns None and it's confusing why it does that. It's better to remove the method altogether, so the error trying to use it is more obvious. Signed-off-by: Damien George <damien@micropython.org>
* extmod/modssl_mbedtls: Add SSLContext certificate methods.Carlosgg2023-12-12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds: 1) Methods to SSLContext class that match CPython signature: - `SSLContext.load_cert_chain(certfile, keyfile)` - `SSLContext.load_verify_locations(cafile=, cadata=)` - `SSLContext.get_ciphers()` --> ["CIPHERSUITE"] - `SSLContext.set_ciphers(["CIPHERSUITE"])` 2) `sslsocket.cipher()` to get current ciphersuite and protocol version. 3) `ssl.MBEDTLS_VERSION` string constant. 4) Certificate verification errors info instead of `MBEDTLS_ERR_X509_CERT_VERIFY_FAILED`. 5) Tests in `net_inet` and `multi_net` to test these new methods. `SSLContext.load_cert_chain` method allows loading key and cert from disk passing a filepath in `certfile` or `keyfile` options. `SSLContext.load_verify_locations`'s `cafile` option enables the same functionality for ca files. Signed-off-by: Carlos Gil <carlosgilglez@gmail.com>
* extmod: Switch to use new event functions.Angus Gratton2023-12-08
| | | | | | | | | See previous commit for details of these functions. As of this commit, these still call the old hook macros on all ports. This work was funded through GitHub Sponsors. Signed-off-by: Angus Gratton <angus@redyak.com.au>
* extmod/modssl_mbedtls: Ignore err ERR_SSL_RECEIVED_NEW_SESSION_TICKET.Mirko Vogt2023-09-03
| | | | | | | | | | It appears a new session ticket being issued by the server right after completed handshake is not uncommon and shouldn't be treated as fatal. mbedtls itself states "This error code is experimental and may be changed or removed without notice." Signed-off-by: Mirko Vogt <mirko-dev|mpy@nanl.de>
* extmod/modssl_mbedtls: Call func psa_crypto_init if PSA is used.Mirko Vogt2023-09-03
| | | | | | | | | | | | | | | | | | Whenever the PSA interface is used (if MBEDTLS_PSA_CRYPTO is defined), psa_crypto_init() needs to be called to initialise the global PSA data struct, before any PSA related operations. TLSv1.3 depends on the PSA interface, TLSv1.2 only uses the PSA stack if MBEDTLS_USE_PSA_CRYPTO is defined. Without psa_crypto_init() every PSA related call will result in -0x6C00/-27648 which translates to "SSL - Internal error (eg, unexpected failure in lower-level module)". The error is misleading, especially since mbedtls in its docs itself advices "to return #PSA_ERROR_BAD_STATE or some other applicable error.". Signed-off-by: Mirko Vogt <mirko-dev|mpy@nanl.de>
* extmod/modssl_mbedtls: Clear sock member if error creating SSLSocket.Damien George2023-08-30
| | | | | | | Otherwise if/when the finaliser runs for this newly created SSLSocket the mbedtls state will be freed again. Signed-off-by: Damien George <damien@micropython.org>
* extmod/modssl_mbedtls: Fix ioctl of a socket in closed/error state.Damien George2023-08-09
| | | | Signed-off-by: Damien George <damien@micropython.org>
* extmod/modssl_mbedtls: Reject ioctls that are not supported.Damien George2023-08-09
| | | | | | | | | | | | An SSL stream can only handle CLOSE and POLL ioctls. Other ones do not make sense, or at least it doesn't make sense to pass the ioctl request directly down to the underlying stream. In particular MP_STREAM_GET_FILENO should not be passed to the underlying stream because the SSL stream is not directly related to a file descriptor, and the SSL stream must handle the polling itself. Signed-off-by: Damien George <damien@micropython.org>
* extmod/modssl_mbedtls: Reference SSLContext from SSLSocket.Jim Mussared2023-08-01
| | | | | | | Prevent the GC cleaning up (and finalising) the SSLContext while the socket is still live. Signed-off-by: Jim Mussared <jim.mussared@gmail.com>
* extmod/modssl: Add SSLContext class.Damien George2023-06-26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit adds the SSLContext class to the ssl module, and retains the existing ssl.wrap_socket() function to maintain backwards compatibility. CPython deprecated the ssl.wrap_socket() function since CPython 3.7 and instead one should use ssl.SSLContext().wrap_socket(). This commit makes that possible. For the axtls implementation: - ssl.SSLContext is added, although it doesn't hold much state because axtls requires calling ssl_ctx_new() for each new socket - ssl.SSLContext.wrap_socket() is added - ssl.PROTOCOL_TLS_CLIENT and ssl.PROTOCOL_TLS_SERVER are added For the mbedtls implementation: - ssl.SSLContext is added, and holds most of the mbedtls state - ssl.verify_mode is added (getter and setter) - ssl.SSLContext.wrap_socket() is added - ssl.PROTOCOL_TLS_CLIENT and ssl.PROTOCOL_TLS_SERVER are added The signatures match CPython: - SSLContext(protocol) - SSLContext.wrap_socket(sock, *, server_side=False, do_handshake_on_connect=True, server_hostname=None) The existing ssl.wrap_socket() functions retain their existing signature. Signed-off-by: Damien George <damien@micropython.org>
* extmod: Update to support mbedtls 3.x.Damien George2023-06-23
| | | | Signed-off-by: Damien George <damien@micropython.org>
* all: Use MP_REGISTER_EXTENSIBLE_MODULE for overrideable built-ins.Jim Mussared2023-06-08
| | | | Signed-off-by: Jim Mussared <jim.mussared@gmail.com>
* all: Rename *umodule*.c to remove the "u" prefix.Jim Mussared2023-06-08
Updates any includes, and references from Makefiles/CMake. This essentially reverts what was done long ago in commit 136b5cbd7669e8318f8455fc2706da97a5b7994c This work was funded through GitHub Sponsors. Signed-off-by: Jim Mussared <jim.mussared@gmail.com>
generated by cgit v1.2.3 (git 2.39.1) at 2025-05-04 12:00:39 +0000