Skip to content

Commit 02fc69a

Browse files
pennampennam
committed
wifi ssl: properly handle multiple client certificates
1 parent 4b74777 commit 02fc69a

File tree

3 files changed

+71
-39
lines changed

3 files changed

+71
-39
lines changed

‎UNOR4USBBridge/at_handler.cpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,9 @@ CAtHandler::CAtHandler(HardwareSerial *s) : last_server_client_sock(0) {
9292

9393
for(int i = 0; i < MAX_CLIENT_AVAILABLE; i++) {
9494
sslclients[i] = nullptr;
95+
clients_ca[i].clear();
96+
clients_cert_pem[i].clear();
97+
clients_key_pem[i].clear();
9598
}
9699

97100
/* set up serial */

‎UNOR4USBBridge/at_handler.h‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,9 @@ class CAtHandler {
6363
WiFiClient * clients[MAX_CLIENT_AVAILABLE];
6464
CServerClient serverClients[MAX_CLIENT_AVAILABLE];
6565
WiFiClientSecure * sslclients[MAX_CLIENT_AVAILABLE];
66+
std::vector<std::uint8_t> clients_ca[MAX_CLIENT_AVAILABLE];
67+
std::vector<std::uint8_t> clients_cert_pem[MAX_CLIENT_AVAILABLE];
68+
std::vector<std::uint8_t> clients_key_pem[MAX_CLIENT_AVAILABLE];
6669
int udps_num = 0;
6770
int servers_num = 0;
6871
int clientsToServer_num = 0;
@@ -85,13 +88,6 @@ class CAtHandler {
8588
void add_cmds_preferences();
8689
void add_cmds_se();
8790
public:
88-
/* Used by cmds_wifi_SSL */
89-
std::vector<std::uint8_t> cert_buf;
90-
std::vector<std::uint8_t> client_cert_pem;
91-
std::vector<std::uint8_t> client_key_pem;
92-
bool client_cert = false;
93-
bool ca_root_custom = false;
94-
9591
/* Used by cmds_se */
9692
std::vector<std::uint8_t> se_buf;
9793

‎UNOR4USBBridge/cmds_wifi_SSL.h‎

Lines changed: 65 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,12 @@ void CAtHandler::add_cmds_wifi_SSL() {
6868
return chAT::CommandStatus::ERROR;
6969
}
7070

71+
const int internal_sock = the_client.can_delete;
72+
if (internal_sock == -1) {
73+
return chAT::CommandStatus::ERROR;
74+
}
75+
76+
bool ca_root_custom = false;
7177
int ca_root_size = 0;
7278
if (parser.args.size() >= 2){
7379
auto &ca_root_size_str = parser.args[1];
@@ -79,17 +85,17 @@ void CAtHandler::add_cmds_wifi_SSL() {
7985
}
8086

8187
if(ca_root_custom) {
82-
cert_buf = srv.inhibit_read(ca_root_size);
83-
size_t offset = cert_buf.size();
88+
clients_ca[internal_sock] = srv.inhibit_read(ca_root_size);
89+
size_t offset = clients_ca[internal_sock].size();
8490

8591
if(offset < ca_root_size) {
8692

87-
cert_buf.resize(ca_root_size);
93+
clients_ca[internal_sock].resize(ca_root_size);
8894
do {
89-
offset += serial->read(cert_buf.data() + offset, ca_root_size - offset);
95+
offset += serial->read(clients_ca[internal_sock].data() + offset, ca_root_size - offset);
9096
} while (offset < ca_root_size);
9197
}
92-
the_client.sslclient->setCACert((const char *)cert_buf.data());
98+
the_client.sslclient->setCACert((const char *)clients_ca[internal_sock].data());
9399
srv.continue_read();
94100
} else {
95101
#ifdef BUNDLED_CA_ROOT_CRT
@@ -134,6 +140,11 @@ void CAtHandler::add_cmds_wifi_SSL() {
134140
return chAT::CommandStatus::ERROR;
135141
}
136142

143+
const int internal_sock = the_client.can_delete;
144+
if (internal_sock == -1) {
145+
return chAT::CommandStatus::ERROR;
146+
}
147+
137148
std::vector<unsigned char> client_cert_der;
138149
client_cert_der = srv.inhibit_read(size);
139150
size_t offset = client_cert_der.size();
@@ -152,22 +163,22 @@ void CAtHandler::add_cmds_wifi_SSL() {
152163
#endif
153164

154165
/* Convert client certificate DER buffer into PEM */
155-
client_cert_pem.resize(1024);
166+
clients_cert_pem[internal_sock].resize(1024);
156167
size_t olen;
157168
mbedtls_pem_write_buffer("-----BEGIN CERTIFICATE-----\n",
158169
"-----END CERTIFICATE-----\n",
159170
client_cert_der.data(), size,
160-
client_cert_pem.data(), 1024,
171+
clients_cert_pem[internal_sock].data(), 1024,
161172
&olen);
162-
client_cert_pem.resize(olen);
173+
clients_cert_pem[internal_sock].resize(olen);
163174

164175
#if ECC_DEBUG_ENABLED
165176
log_v("_SETECCSLOT: output cert");
166-
log_v("\n%s", client_cert_pem.data());
177+
log_v("\n%s", clients_cert_pem[internal_sock].data());
167178
#endif
168179

169180
/* Set client certificate */
170-
the_client.sslclient->setCertificate((const char *)client_cert_pem.data());
181+
the_client.sslclient->setCertificate((const char *)clients_cert_pem[internal_sock].data());
171182

172183
/* Read private key from non volatile storage in DER format */
173184
std::vector<unsigned char> client_key_der;
@@ -185,23 +196,21 @@ void CAtHandler::add_cmds_wifi_SSL() {
185196
#endif
186197

187198
/* Convert private key in PEM format */
188-
client_key_pem.resize(1024);
199+
clients_key_pem[internal_sock].resize(1024);
189200
mbedtls_pem_write_buffer("-----BEGIN EC PRIVATE KEY-----\n",
190201
"-----END EC PRIVATE KEY-----\n",
191202
client_key_der.data(), len,
192-
client_key_pem.data(), 1024,
203+
clients_key_pem[internal_sock].data(), 1024,
193204
&olen);
194-
client_key_pem.resize(olen);
205+
clients_key_pem[internal_sock].resize(olen);
195206

196207
#if ECC_DEBUG_ENABLED
197208
log_v("_SETECCSLOT: output key");
198-
log_v("\n%s", client_key_pem.data());
209+
log_v("\n%s", clients_key_pem[internal_sock].data());
199210
#endif
200211

201212
/* Set client key */
202-
the_client.sslclient->setPrivateKey((const char *)client_key_pem.data());
203-
204-
client_cert = true;
213+
the_client.sslclient->setPrivateKey((const char *)clients_key_pem[internal_sock].data());
205214

206215
return chAT::CommandStatus::OK;
207216
}
@@ -266,6 +275,11 @@ void CAtHandler::add_cmds_wifi_SSL() {
266275
return chAT::CommandStatus::ERROR;
267276
}
268277

278+
const int internal_sock = the_client.can_delete;
279+
if (internal_sock == -1) {
280+
return chAT::CommandStatus::ERROR;
281+
}
282+
269283
auto &host = parser.args[1];
270284
if (host.empty()) {
271285
return chAT::CommandStatus::ERROR;
@@ -277,16 +291,18 @@ void CAtHandler::add_cmds_wifi_SSL() {
277291
}
278292

279293
/* Set custom root ca */
280-
if (ca_root_custom) {
281-
the_client.sslclient->setCACert((const char *)cert_buf.data());
294+
if (clients_ca[internal_sock].size()) {
295+
the_client.sslclient->setCACert((const char *)clients_ca[internal_sock].data());
282296
}
283297
/* Default ca bundle is configured automatically on connect by the WiFiSSLClient */
284298

285-
if (client_cert) {
299+
if (clients_cert_pem[internal_sock].size()) {
286300
/* Set client certificate */
287-
the_client.sslclient->setCertificate((const char *)client_cert_pem.data());
301+
the_client.sslclient->setCertificate((const char *)clients_cert_pem[internal_sock].data());
302+
}
303+
if (clients_key_pem[internal_sock].size()) {
288304
/* Set client key */
289-
the_client.sslclient->setPrivateKey((const char *)client_key_pem.data());
305+
the_client.sslclient->setPrivateKey((const char *)clients_key_pem[internal_sock].data());
290306
}
291307

292308
if (!the_client.sslclient->connect(host.c_str(), atoi(port.c_str()))) {
@@ -323,6 +339,11 @@ void CAtHandler::add_cmds_wifi_SSL() {
323339
return chAT::CommandStatus::ERROR;
324340
}
325341

342+
const int internal_sock = the_client.can_delete;
343+
if (internal_sock == -1) {
344+
return chAT::CommandStatus::ERROR;
345+
}
346+
326347
auto &hostip = parser.args[1];
327348
if (hostip.empty()) {
328349
return chAT::CommandStatus::ERROR;
@@ -339,16 +360,18 @@ void CAtHandler::add_cmds_wifi_SSL() {
339360
}
340361

341362
/* Set custom root ca */
342-
if (ca_root_custom) {
343-
the_client.sslclient->setCACert((const char *)cert_buf.data());
363+
if (clients_ca[internal_sock].size()) {
364+
the_client.sslclient->setCACert((const char *)clients_ca[internal_sock].data());
344365
}
345366
/* Default ca bundle is configured automatically on connect by the WiFiSSLClient */
346367

347-
if (client_cert) {
368+
if (clients_cert_pem[internal_sock].size()) {
348369
/* Set client certificate */
349-
the_client.sslclient->setCertificate((const char *)client_cert_pem.data());
370+
the_client.sslclient->setCertificate((const char *)clients_cert_pem[internal_sock].data());
371+
}
372+
if (clients_key_pem[internal_sock].size()) {
350373
/* Set client key */
351-
the_client.sslclient->setPrivateKey((const char *)client_key_pem.data());
374+
the_client.sslclient->setPrivateKey((const char *)clients_key_pem[internal_sock].data());
352375
}
353376

354377
if (!the_client.sslclient->connect(address, atoi(hostport.c_str()))) {
@@ -384,6 +407,11 @@ void CAtHandler::add_cmds_wifi_SSL() {
384407
return chAT::CommandStatus::ERROR;
385408
}
386409

410+
const int internal_sock = the_client.can_delete;
411+
if (internal_sock == -1) {
412+
return chAT::CommandStatus::ERROR;
413+
}
414+
387415
auto &host = parser.args[1];
388416
if (host.empty()) {
389417
return chAT::CommandStatus::ERROR;
@@ -407,16 +435,18 @@ void CAtHandler::add_cmds_wifi_SSL() {
407435
}
408436

409437
/* Set custom root ca */
410-
if (ca_root_custom) {
411-
the_client.sslclient->setCACert((const char *)cert_buf.data());
438+
if (clients_ca[internal_sock].size()) {
439+
the_client.sslclient->setCACert((const char *)clients_ca[internal_sock].data());
412440
}
413441
/* Default ca bundle is configured automatically on connect by the WiFiSSLClient */
414442

415-
if (client_cert) {
443+
if (clients_cert_pem[internal_sock].size()) {
416444
/* Set client certificate */
417-
the_client.sslclient->setCertificate((const char *)client_cert_pem.data());
445+
the_client.sslclient->setCertificate((const char *)clients_cert_pem[internal_sock].data());
446+
}
447+
if (clients_key_pem[internal_sock].size()) {
418448
/* Set client key */
419-
the_client.sslclient->setPrivateKey((const char *)client_key_pem.data());
449+
the_client.sslclient->setPrivateKey((const char *)clients_key_pem[internal_sock].data());
420450
}
421451

422452
if (!the_client.sslclient->connect(host.c_str(), atoi(port.c_str()), timeout)) {
@@ -536,6 +566,9 @@ void CAtHandler::add_cmds_wifi_SSL() {
536566
if(the_client.can_delete >= 0) {
537567
delete sslclients[the_client.can_delete];
538568
sslclients[the_client.can_delete] = nullptr;
569+
clients_ca[the_client.can_delete].clear();
570+
clients_cert_pem[the_client.can_delete].clear();
571+
clients_key_pem[the_client.can_delete].clear();
539572
sslclients_num--;
540573
}
541574
}

0 commit comments

Comments
 (0)