esp32/modusocket: Improvments to sockets handling and ssl handshake (#6)

* esp32/modusocket: Improvments to sockets handling and ssl handshake

* esp32/modusocket: minor update

Author: Islam Wahdan

esp32/Makefile

@@ -29,6 +29,8 @@ BUILD = $(BUILD_DIR)/$(BOARD)/$(BTYPE)
 
 RELEASE_DIR ?= build/
 
+COPY_IDF_LIB ?= 1
+
 # by default Secure Boot and Flash Encryption are disabled
 SECURE ?= off
 

esp32/application.mk

@@ -524,8 +524,10 @@ $(BUILD)/bootloader/bootloader.a: $(BOOT_OBJ) sdkconfig.h
 	$(Q) $(AR) cru $@ $^
 
 $(BUILD)/bootloader/bootloader.elf: $(BUILD)/bootloader/bootloader.a $(SECURE_BOOT_VERIFICATION_KEY)
+ifeq ($(COPY_IDF_LIB), 1)
 	$(ECHO) "COPY IDF LIBRARIES $@"
 	$(Q) $(PYTHON) get_idf_libs.py --idflibs $(IDF_PATH)/examples/wifi/scan/build
+endif
 ifeq ($(SECURE), on)
 # unpack libbootloader_support.a, and archive again using the right key for verifying signatures
 	$(ECHO) "Inserting verification key $(SECURE_BOOT_VERIFICATION_KEY) in $@"
@@ -593,8 +595,10 @@ $(BUILD)/application.elf: $(BUILD)/application.a $(BUILD)/esp32_out.ld
 	$(Q) $(SIZE) $@
 else
 $(BUILD)/application.elf: $(BUILD)/application.a $(BUILD)/esp32_out.ld $(SECURE_BOOT_VERIFICATION_KEY)
+ifeq ($(COPY_IDF_LIB), 1)
 	$(ECHO) "COPY IDF LIBRARIES $@"
 	$(Q) $(PYTHON) get_idf_libs.py --idflibs $(IDF_PATH)/examples/wifi/scan/build
+endif
 ifeq ($(SECURE), on)
 # unpack libbootloader_support.a, and archive again using the right key for verifying signatures
 	$(ECHO) "Inserting verification key $(SECURE_BOOT_VERIFICATION_KEY) in $@"

esp32/mods/lwipsocket.c

@@ -33,6 +33,7 @@
 #include "lwip/sockets.h"
 #include "lwip/dns.h"
 #include "lwip/netdb.h"
+#include "lwipsocket.h"
 
 
 #define WLAN_MAX_RX_SIZE                    2048
@@ -162,42 +163,12 @@ int lwipsocket_socket_connect(mod_network_socket_obj_t *s, byte *ip, mp_uint_t p
     // printf("Connected.\n");
 
     if (s->sock_base.is_ssl && (ret == 0)) {
-        mp_obj_ssl_socket_t *ss = (mp_obj_ssl_socket_t *)s;
-
-        if ((ret = mbedtls_net_set_block(&ss->context_fd)) != 0) {
-            // printf("failed! net_set_(non)block() returned -0x%x\n", -ret);
-            *_errno = errno;
-            return -1;
-        }
-
-        mbedtls_ssl_set_bio(&ss->ssl, &ss->context_fd, mbedtls_net_send, NULL, mbedtls_net_recv_timeout);
-
-        // printf("Performing the SSL/TLS handshake...\n");
-
-        while ((ret = mbedtls_ssl_handshake(&ss->ssl)) != 0)
-        {
-            if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE && ret != MBEDTLS_ERR_SSL_TIMEOUT)
-            {
-                // printf("mbedtls_ssl_handshake returned -0x%x\n", -ret);
-                *_errno = errno;
-                return -1;
-            }
-        }
-
-        // printf("Verifying peer X.509 certificate...\n");
 
-        if ((ret = mbedtls_ssl_get_verify_result(&ss->ssl)) != 0) {
-            /* In real life, we probably want to close connection if ret != 0 */
-            // printf("Failed to verify peer certificate!\n");
-            *_errno = errno;
-            return -1;
-        } else {
-            // printf("Certificate verified.\n");
-        }
+        ret = lwipsocket_socket_setup_ssl(s, _errno);
     }
 
     s->sock_base.connected = true;
-    return 0;
+    return ret;
 }
 
 int lwipsocket_socket_send(mod_network_socket_obj_t *s, const byte *buf, mp_uint_t len, int *_errno) {
@@ -392,3 +363,45 @@ int lwipsocket_socket_ioctl (mod_network_socket_obj_t *s, mp_uint_t request, mp_
     }
     return ret;
 }
+
+int lwipsocket_socket_setup_ssl(mod_network_socket_obj_t *s, int *_errno)
+{
+    int ret;
+    uint32_t count = 0;
+    mp_obj_ssl_socket_t *ss = (mp_obj_ssl_socket_t *)s;
+
+    if ((ret = mbedtls_net_set_block(&ss->context_fd)) != 0) {
+        // printf("failed! net_set_(non)block() returned -0x%x\n", -ret);
+        *_errno = ret;
+        return -1;
+    }
+
+    mbedtls_ssl_set_bio(&ss->ssl, &ss->context_fd, mbedtls_net_send, NULL, mbedtls_net_recv_timeout);
+
+    // printf("Performing the SSL/TLS handshake...\n");
+
+    while ((ret = mbedtls_ssl_handshake(&ss->ssl)) != 0)
+    {
+        if ((ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE && ret != MBEDTLS_ERR_SSL_TIMEOUT ) || count >= ss->read_timeout)
+        {
+            // printf("mbedtls_ssl_handshake returned -0x%x\n", -ret);
+            *_errno = ret;
+            return -1;
+        }
+        if(ret == MBEDTLS_ERR_SSL_TIMEOUT)
+        {
+            count++;
+        }
+    }
+
+    // printf("Verifying peer X.509 certificate...\n");
+
+    if ((ret = mbedtls_ssl_get_verify_result(&ss->ssl)) != 0) {
+        /* In real life, we probably want to close connection if ret != 0 */
+        // printf("Failed to verify peer certificate!\n");
+        *_errno = ret;
+        return -1;
+    }
+    // printf("Certificate verified.\n");
+    return 0;
+}

esp32/mods/lwipsocket.h

@@ -40,4 +40,6 @@ extern int lwipsocket_socket_settimeout(mod_network_socket_obj_t *s, mp_int_t ti
 
 extern int lwipsocket_socket_ioctl (mod_network_socket_obj_t *s, mp_uint_t request, mp_uint_t arg, int *_errno);
 
+extern int lwipsocket_socket_setup_ssl(mod_network_socket_obj_t *s, int *_errno);
+
 #endif      // LWIPSOCKET_H_

esp32/mods/modlte.c

@@ -1050,5 +1050,6 @@ const mod_network_nic_type_t mod_network_nic_type_lte = {
     .n_setsockopt = lwipsocket_socket_setsockopt,
     .n_bind = lwipsocket_socket_bind,
     .n_ioctl = lwipsocket_socket_ioctl,
+    .n_setupssl = lwipsocket_socket_setup_ssl,
 	.inf_up = ltepp_is_ppp_conn_up,
 };

esp32/mods/modnetwork.h

@@ -50,6 +50,15 @@
 // forward declarations
 struct _mod_network_socket_obj_t;
 
+typedef enum {
+    SOCKET_CONN_START = 0,
+    SOCKET_CONNECTED,
+    SOCKET_NOT_CONNECTED,
+    SOCKET_CONN_PENDING,
+    SOCKET_CONN_ERROR,
+    SOCKET_CONN_TIMEDOUT
+}mod_network_sock_conn_status_t;
+
 typedef struct _mod_network_nic_type_t {
     mp_obj_type_t base;
 
@@ -70,6 +79,7 @@ typedef struct _mod_network_nic_type_t {
     int (*n_setsockopt)(struct _mod_network_socket_obj_t *socket, mp_uint_t level, mp_uint_t opt, const void *optval, mp_uint_t optlen, int *_errno);
     int (*n_settimeout)(struct _mod_network_socket_obj_t *socket, mp_int_t timeout_ms, int *_errno);
     int (*n_ioctl)(struct _mod_network_socket_obj_t *socket, mp_uint_t request, mp_uint_t arg, int *_errno);
+    int (*n_setupssl)(struct _mod_network_socket_obj_t *socket, int *_errno);
 
     // Interface status
     bool (*inf_up)(void);
@@ -90,6 +100,11 @@ typedef struct _mod_network_socket_base_t {
     int32_t timeout;
     bool is_ssl;
     bool connected;
+    uint8_t ip_addr[MOD_NETWORK_IPV4ADDR_BUF_SIZE];
+    mp_uint_t port;
+    mod_network_sock_conn_status_t conn_status;
+    int err;
+    uint8_t domain;
 } mod_network_socket_base_t;
 
 typedef struct _mod_network_socket_obj_t {