@@ -33,8 +33,8 @@ TLSSocketWrapper::TLSSocketWrapper(Socket *transport, const char *hostname, cont
33
33
_clicert(NULL ),
34
34
#endif
35
35
_ssl_conf (NULL ),
36
- _connect_transport(control== TRANSPORT_CONNECT || control== TRANSPORT_CONNECT_AND_CLOSE),
37
- _close_transport(control== TRANSPORT_CLOSE || control== TRANSPORT_CONNECT_AND_CLOSE),
36
+ _connect_transport(control == TRANSPORT_CONNECT || control == TRANSPORT_CONNECT_AND_CLOSE),
37
+ _close_transport(control == TRANSPORT_CLOSE || control == TRANSPORT_CONNECT_AND_CLOSE),
38
38
_handshake_completed(false ),
39
39
_cacert_allocated(false ),
40
40
_clicert_allocated(false ),
@@ -50,7 +50,8 @@ TLSSocketWrapper::TLSSocketWrapper(Socket *transport, const char *hostname, cont
50
50
}
51
51
}
52
52
53
- TLSSocketWrapper::~TLSSocketWrapper () {
53
+ TLSSocketWrapper::~TLSSocketWrapper ()
54
+ {
54
55
if (_transport) {
55
56
close ();
56
57
}
@@ -90,7 +91,7 @@ nsapi_error_t TLSSocketWrapper::set_root_ca_cert(const void *root_ca, size_t len
90
91
/* Parse CA certification */
91
92
int ret;
92
93
if ((ret = mbedtls_x509_crt_parse (crt, static_cast <const unsigned char *>(root_ca),
93
- len)) != 0 ) {
94
+ len)) != 0 ) {
94
95
print_mbedtls_error (" mbedtls_x509_crt_parse" , ret);
95
96
return NSAPI_ERROR_PARAMETER;
96
97
}
@@ -111,7 +112,7 @@ nsapi_error_t TLSSocketWrapper::set_client_cert_key(const char *client_cert_pem,
111
112
}
112
113
113
114
nsapi_error_t TLSSocketWrapper::set_client_cert_key (const void *client_cert, size_t client_cert_len,
114
- const void *client_private_key_pem, size_t client_private_key_len)
115
+ const void *client_private_key_pem, size_t client_private_key_len)
115
116
{
116
117
#if !defined(MBEDTLS_X509_CRT_PARSE_C)
117
118
return NSAPI_ERROR_UNSUPPORTED;
@@ -120,14 +121,14 @@ nsapi_error_t TLSSocketWrapper::set_client_cert_key(const void *client_cert, siz
120
121
int ret;
121
122
mbedtls_x509_crt *crt = new mbedtls_x509_crt;
122
123
mbedtls_x509_crt_init (crt);
123
- if ((ret = mbedtls_x509_crt_parse (crt, static_cast <const unsigned char *>(client_cert),
124
- client_cert_len)) != 0 ) {
124
+ if ((ret = mbedtls_x509_crt_parse (crt, static_cast <const unsigned char *>(client_cert),
125
+ client_cert_len)) != 0 ) {
125
126
print_mbedtls_error (" mbedtls_x509_crt_parse" , ret);
126
127
return NSAPI_ERROR_PARAMETER;
127
128
}
128
129
mbedtls_pk_init (&_pkctx);
129
- if ((ret = mbedtls_pk_parse_key (&_pkctx, static_cast <const unsigned char *>(client_private_key_pem),
130
- client_private_key_len, NULL , 0 )) != 0 ) {
130
+ if ((ret = mbedtls_pk_parse_key (&_pkctx, static_cast <const unsigned char *>(client_private_key_pem),
131
+ client_private_key_len, NULL , 0 )) != 0 ) {
131
132
print_mbedtls_error (" mbedtls_pk_parse_key" , ret);
132
133
return NSAPI_ERROR_PARAMETER;
133
134
}
@@ -139,7 +140,8 @@ nsapi_error_t TLSSocketWrapper::set_client_cert_key(const void *client_cert, siz
139
140
}
140
141
141
142
142
- nsapi_error_t TLSSocketWrapper::do_handshake () {
143
+ nsapi_error_t TLSSocketWrapper::do_handshake ()
144
+ {
143
145
nsapi_error_t _error;
144
146
const char DRBG_PERS[] = " mbed TLS client" ;
145
147
@@ -153,8 +155,8 @@ nsapi_error_t TLSSocketWrapper::do_handshake() {
153
155
*/
154
156
int ret;
155
157
if ((ret = mbedtls_ctr_drbg_seed (&_ctr_drbg, mbedtls_entropy_func, &_entropy,
156
- (const unsigned char *) DRBG_PERS,
157
- sizeof (DRBG_PERS))) != 0 ) {
158
+ (const unsigned char *) DRBG_PERS,
159
+ sizeof (DRBG_PERS))) != 0 ) {
158
160
print_mbedtls_error (" mbedtls_crt_drbg_init" , ret);
159
161
_error = ret;
160
162
return _error;
@@ -177,7 +179,7 @@ nsapi_error_t TLSSocketWrapper::do_handshake() {
177
179
return _error;
178
180
}
179
181
180
- mbedtls_ssl_set_bio (&_ssl, this , ssl_send, ssl_recv, NULL );
182
+ mbedtls_ssl_set_bio (&_ssl, this , ssl_send, ssl_recv, NULL );
181
183
182
184
#ifdef MBEDTLS_X509_CRT_PARSE_C
183
185
/* Start the handshake, the rest will be done in onReceive() */
@@ -189,7 +191,7 @@ nsapi_error_t TLSSocketWrapper::do_handshake() {
189
191
do {
190
192
ret = mbedtls_ssl_handshake (&_ssl);
191
193
} while (ret != 0 && (ret == MBEDTLS_ERR_SSL_WANT_READ ||
192
- ret == MBEDTLS_ERR_SSL_WANT_WRITE));
194
+ ret == MBEDTLS_ERR_SSL_WANT_WRITE));
193
195
if (ret < 0 ) {
194
196
print_mbedtls_error (" mbedtls_ssl_handshake" , ret);
195
197
return ret;
@@ -205,13 +207,13 @@ nsapi_error_t TLSSocketWrapper::do_handshake() {
205
207
#ifdef MBEDTLS_X509_CRT_PARSE_C
206
208
/* Prints the server certificate and verify it. */
207
209
const size_t buf_size = 1024 ;
208
- char * buf = new char [buf_size];
210
+ char * buf = new char [buf_size];
209
211
mbedtls_x509_crt_info (buf, buf_size, " \r " ,
210
- mbedtls_ssl_get_peer_cert (&_ssl));
212
+ mbedtls_ssl_get_peer_cert (&_ssl));
211
213
tr_debug (" Server certificate:\r\n %s\r\n " , buf);
212
214
213
215
uint32_t flags = mbedtls_ssl_get_verify_result (&_ssl);
214
- if ( flags != 0 ) {
216
+ if ( flags != 0 ) {
215
217
/* Verification failed. */
216
218
mbedtls_x509_crt_verify_info (buf, buf_size, " \r ! " , flags);
217
219
tr_error (" Certificate verification failed:\r\n %s" , buf);
@@ -228,7 +230,8 @@ nsapi_error_t TLSSocketWrapper::do_handshake() {
228
230
}
229
231
230
232
231
- nsapi_error_t TLSSocketWrapper::send (const void *data, nsapi_size_t size) {
233
+ nsapi_error_t TLSSocketWrapper::send (const void *data, nsapi_size_t size)
234
+ {
232
235
int ret;
233
236
234
237
if (!_transport) {
@@ -239,7 +242,7 @@ nsapi_error_t TLSSocketWrapper::send(const void *data, nsapi_size_t size) {
239
242
ret = mbedtls_ssl_write (&_ssl, (const unsigned char *) data, size);
240
243
241
244
if (ret == MBEDTLS_ERR_SSL_WANT_WRITE ||
242
- ret == MBEDTLS_ERR_SSL_WANT_READ) {
245
+ ret == MBEDTLS_ERR_SSL_WANT_READ) {
243
246
// translate to socket error
244
247
return NSAPI_ERROR_WOULD_BLOCK;
245
248
}
@@ -255,7 +258,8 @@ nsapi_size_or_error_t TLSSocketWrapper::sendto(const SocketAddress &, const void
255
258
return send (data, size);
256
259
}
257
260
258
- nsapi_size_or_error_t TLSSocketWrapper::recv (void *data, nsapi_size_t size) {
261
+ nsapi_size_or_error_t TLSSocketWrapper::recv (void *data, nsapi_size_t size)
262
+ {
259
263
int ret;
260
264
261
265
if (!_transport) {
@@ -265,7 +269,7 @@ nsapi_size_or_error_t TLSSocketWrapper::recv(void *data, nsapi_size_t size) {
265
269
ret = mbedtls_ssl_read (&_ssl, (unsigned char *) data, size);
266
270
267
271
if (ret == MBEDTLS_ERR_SSL_WANT_WRITE ||
268
- ret == MBEDTLS_ERR_SSL_WANT_READ) {
272
+ ret == MBEDTLS_ERR_SSL_WANT_READ) {
269
273
// translate to socket error
270
274
return NSAPI_ERROR_WOULD_BLOCK;
271
275
} else if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY) {
@@ -287,7 +291,8 @@ nsapi_size_or_error_t TLSSocketWrapper::recvfrom(SocketAddress *address, void *d
287
291
return recv (data, size);
288
292
}
289
293
290
- void TLSSocketWrapper::print_mbedtls_error (const char *name, int err) {
294
+ void TLSSocketWrapper::print_mbedtls_error (const char *name, int err)
295
+ {
291
296
#ifdef MBEDTLS_ERROR_C
292
297
char *buf = new char [128 ];
293
298
mbedtls_strerror (err, buf, 128 );
@@ -303,14 +308,14 @@ void TLSSocketWrapper::print_mbedtls_error(const char *name, int err) {
303
308
#if MBED_CONF_TLS_SOCKET_DEBUG_LEVEL > 0
304
309
305
310
void TLSSocketWrapper::my_debug (void *ctx, int level, const char *file, int line,
306
- const char *str)
311
+ const char *str)
307
312
{
308
313
const char *p, *basename;
309
314
(void ) ctx;
310
315
311
316
/* Extract basename from file */
312
- for (p = basename = file; *p != ' \0 ' ; p++) {
313
- if (*p == ' /' || *p == ' \\ ' ) {
317
+ for (p = basename = file; *p != ' \0 ' ; p++) {
318
+ if (*p == ' /' || *p == ' \\ ' ) {
314
319
basename = p + 1 ;
315
320
}
316
321
}
@@ -329,10 +334,9 @@ int TLSSocketWrapper::my_verify(void *data, mbedtls_x509_crt *crt, int depth, ui
329
334
mbedtls_x509_crt_info (buf, buf_size - 1 , " " , crt);
330
335
tr_debug (" %s" , buf);
331
336
332
- if (*flags == 0 )
337
+ if (*flags == 0 ) {
333
338
tr_info (" No verification issue for this certificate\n " );
334
- else
335
- {
339
+ } else {
336
340
mbedtls_x509_crt_verify_info (buf, buf_size, " ! " , *flags);
337
341
tr_info (" %s\n " , buf);
338
342
}
@@ -345,7 +349,8 @@ int TLSSocketWrapper::my_verify(void *data, mbedtls_x509_crt *crt, int depth, ui
345
349
#endif /* MBED_CONF_TLS_SOCKET_DEBUG_LEVEL > 0 */
346
350
347
351
348
- int TLSSocketWrapper::ssl_recv (void *ctx, unsigned char *buf, size_t len) {
352
+ int TLSSocketWrapper::ssl_recv (void *ctx, unsigned char *buf, size_t len)
353
+ {
349
354
int recv;
350
355
351
356
TLSSocketWrapper *my = static_cast <TLSSocketWrapper *>(ctx);
@@ -358,14 +363,15 @@ int TLSSocketWrapper::ssl_recv(void *ctx, unsigned char *buf, size_t len) {
358
363
359
364
if (NSAPI_ERROR_WOULD_BLOCK == recv) {
360
365
return MBEDTLS_ERR_SSL_WANT_READ;
361
- } else if (recv < 0 ) {
366
+ } else if (recv < 0 ) {
362
367
tr_error (" Socket recv error %d" , recv);
363
368
}
364
369
// Propagate also Socket errors to SSL, it allows negative error codes to be returned here.
365
370
return recv;
366
371
}
367
372
368
- int TLSSocketWrapper::ssl_send (void *ctx, const unsigned char *buf, size_t len) {
373
+ int TLSSocketWrapper::ssl_send (void *ctx, const unsigned char *buf, size_t len)
374
+ {
369
375
int size = -1 ;
370
376
TLSSocketWrapper *my = static_cast <TLSSocketWrapper *>(ctx);
371
377
@@ -377,12 +383,12 @@ int TLSSocketWrapper::ssl_send(void *ctx, const unsigned char *buf, size_t len)
377
383
378
384
if (NSAPI_ERROR_WOULD_BLOCK == size) {
379
385
return MBEDTLS_ERR_SSL_WANT_WRITE;
380
- } else if (size < 0 ){
386
+ } else if (size < 0 ) {
381
387
tr_error (" Socket send error %d" , size);
382
388
}
383
389
// Propagate also Socket errors to SSL, it allows negative error codes to be returned here.
384
390
return size;
385
- }
391
+ }
386
392
387
393
#ifdef MBEDTLS_X509_CRT_PARSE_C
388
394
@@ -401,7 +407,7 @@ int TLSSocketWrapper::set_own_cert(mbedtls_x509_crt *crt)
401
407
}
402
408
_clicert = crt;
403
409
if (crt) {
404
- if ((ret = mbedtls_ssl_conf_own_cert (get_ssl_config (), _clicert, &_pkctx)) != 0 ) {
410
+ if ((ret = mbedtls_ssl_conf_own_cert (get_ssl_config (), _clicert, &_pkctx)) != 0 ) {
405
411
print_mbedtls_error (" mbedtls_ssl_conf_own_cert" , ret);
406
412
}
407
413
}
@@ -437,12 +443,12 @@ mbedtls_ssl_config *TLSSocketWrapper::get_ssl_config()
437
443
438
444
tr_info (" mbedtls_ssl_config_defaults()" );
439
445
if ((ret = mbedtls_ssl_config_defaults (_ssl_conf,
440
- MBEDTLS_SSL_IS_CLIENT,
441
- MBEDTLS_SSL_TRANSPORT_STREAM,
442
- MBEDTLS_SSL_PRESET_DEFAULT)) != 0 ) {
446
+ MBEDTLS_SSL_IS_CLIENT,
447
+ MBEDTLS_SSL_TRANSPORT_STREAM,
448
+ MBEDTLS_SSL_PRESET_DEFAULT)) != 0 ) {
443
449
print_mbedtls_error (" mbedtls_ssl_config_defaults" , ret);
444
450
set_ssl_config (NULL );
445
- MBED_ERROR ( MBED_MAKE_ERROR (MBED_MODULE_NETWORK_STACK, MBED_ERROR_CODE_OUT_OF_MEMORY), " mbedtls_ssl_config_defaults() failed" );
451
+ MBED_ERROR (MBED_MAKE_ERROR (MBED_MODULE_NETWORK_STACK, MBED_ERROR_CODE_OUT_OF_MEMORY), " mbedtls_ssl_config_defaults() failed" );
446
452
return NULL ;
447
453
}
448
454
/* It is possible to disable authentication by passing
0 commit comments