WolfSSL
/
wolfssl-examples
mirror of https://github.com/wolfSSL/wolfssl-examples.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-5610: fix ENC28J60 TLS server continuing past a NULL WOLFSSL session, and harden ESP32 socket/string handling

pull/485/merge
Emma Stensland 2026-07-02 09:29:16 -06:00 committed by Paul Adelsbach
parent 99cdfa1e3a
commit b389087ed7
6 changed files with 143 additions and 115 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
ESP32/DTLS13-wifi-station-client/main/client-dtls13.c
View File

@ -156,7 +156,7 @@ WOLFSSL_ESP_TASK dtls13_smp_client_task(void *pvParameters)
ESP_LOGI(TAG, "See ./include/client-dtls13.h to update settings.");
ESP_LOGI(TAG, "Setting server address to %s, port %d.",
TLS_SMP_SERVER_ADDRESS, SERV_PORT);
memset(&servAddr, 0, sizeof(servAddr));
XMEMSET(&servAddr, 0, sizeof(servAddr));
servAddr.sin_family = AF_INET;
servAddr.sin_port = htons(SERV_PORT);
if (inet_pton(AF_INET, TLS_SMP_SERVER_ADDRESS, &servAddr.sin_addr) < 1) {
@ -199,10 +199,11 @@ WOLFSSL_ESP_TASK dtls13_smp_client_task(void *pvParameters)
ESP_LOGI(TAG, "Sending message");
strcpy(sendLine, "Hello World.");
XSTRCPY(sendLine, "Hello World.");
/* Send sendLine to the server */
if (wolfSSL_write(ssl, sendLine, strlen(sendLine)) != strlen(sendLine)) {
if (wolfSSL_write(ssl, sendLine, XSTRLEN(sendLine)) !=
XSTRLEN(sendLine)) {
err = wolfSSL_get_error(ssl, 0);
ESP_LOGE(TAG, "err = %d, %s\n",
err, wolfSSL_ERR_reason_error_string(err));

2
ESP32/DTLS13-wifi-station-server/main/server-dtls13.c
View File

@ -244,7 +244,7 @@ WOLFSSL_ESP_TASK dtls13_smp_server_task(void *pvParameters)
/* initialize network vars */
if (ret == WOLFSSL_SUCCESS) {
memset((char *)&servAddr, 0, sizeof(servAddr));
XMEMSET((char *)&servAddr, 0, sizeof(servAddr));
/* host-to-network-long conversion (htonl) */
/* host-to-network-short conversion (htons) */
servAddr.sin_family = AF_INET;

25
ESP32/TLS13-ENC28J60-client/main/enc28j60_example_main.c
View File

@ -125,6 +125,13 @@ TickType_t DelayTicks = 5000 / portTICK_PERIOD_MS;
**/
static void LogSocketError(const char* fmt, int err)
{
char err_msg[128];
XSNPRINTF(err_msg, sizeof(err_msg), fmt, err);
WOLFSSL_ERROR_MSG(err_msg);
}
int tls_smp_client_task() {
int ret = WOLFSSL_SUCCESS; /* assume success until proven wrong */
int sockfd = 0; /* the socket that will carry our secure connection */
@ -165,7 +172,7 @@ int tls_smp_client_task() {
#endif /* WOLFSSL_TLS13 */
/* Initialize the server address struct with zeros */
memset(&servAddr, 0, sizeof(servAddr));
XMEMSET(&servAddr, 0, sizeof(servAddr));
/* Fill in the server address */
servAddr.sin_family = AF_INET; /* using IPv4 */
@ -220,13 +227,12 @@ int tls_smp_client_task() {
* a non-negative integer, the socket file descriptor.
*/
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd > 0) {
if (sockfd >= 0) {
WOLFSSL_MSG("socket creation successful\n");
}
else {
// TODO show errno
LogSocketError("ERROR: failed to create a socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to create a socket.\n");
}
}
else {
@ -258,8 +264,7 @@ int tls_smp_client_task() {
WOLFSSL_MSG("sockfd connect successful\n");
}
else {
// TODO show errno
WOLFSSL_ERROR_MSG("ERROR: socket connect failed\n");
LogSocketError("ERROR: socket connect failed (errno = %d)\n", errno);
ret = WOLFSSL_FAILURE;
}
}
@ -697,13 +702,13 @@ int tls_smp_client_task() {
*/
if (ret == WOLFSSL_SUCCESS) {
memset(buff, 0, BUFF_SIZE);
XMEMSET(buff, 0, BUFF_SIZE);
/* get the length of our message, never longer than the declared size */
/* TODO check for zero length */
len = strnlen(sendMessage, sendMessageSize);
len = XSTRLEN(sendMessage);
/* write the message over secure connection to the server */
if (wolfSSL_write(ssl, sendMessage, len) == len) {
@ -783,7 +788,7 @@ int tls_smp_client_task() {
if (ret == WOLFSSL_SUCCESS) {
/* even though the result should be a zero-terminated string,
* we'll clear the receive buffer */
memset(buff, 0, BUFF_SIZE);
XMEMSET(buff, 0, BUFF_SIZE);
/* read the response data from our secure connection */
if (wolfSSL_read(ssl, buff, BUFF_SIZE - 1) > 0) {
@ -946,7 +951,7 @@ int set_time() {
int i = 0;
for (i = 0; i < NTP_SERVER_COUNT; i++) {
const char* thisServer = ntpServerList[i];
if (strncmp(thisServer, "\x00", 1)) {
if (XSTRNCMP(thisServer, "\x00", 1)) {
/* just in case we run out of NTP servers */
break;
}

103
ESP32/TLS13-ENC28J60-server/main/enc28j60_example_main.c
View File

@ -154,6 +154,13 @@ static void sig_handler(const int sig) {
}
#endif
static void LogSocketError(const char* fmt, int err)
{
char err_msg[128];
XSNPRINTF(err_msg, sizeof(err_msg), fmt, err);
WOLFSSL_ERROR_MSG(err_msg);
}
int tls_smp_server_task() {
int ret = WOLFSSL_SUCCESS; /* assume success until proven wrong */
int sockfd = 0; /* the socket that will carry our secure connection */
@ -190,7 +197,7 @@ int tls_smp_server_task() {
#endif /* WOLFSSL_TLS13 */
/* Initialize the server address struct with zeros */
memset(&servAddr, 0, sizeof(servAddr));
XMEMSET(&servAddr, 0, sizeof(servAddr));
/* Fill in the server address */
servAddr.sin_family = AF_INET; /* using IPv4 */
@ -280,13 +287,12 @@ int tls_smp_server_task() {
* a non-negative integer, the socket file descriptor.
*/
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd > 0) {
if (sockfd >= 0) {
WOLFSSL_MSG("socket creation successful\n");
}
else {
// TODO show errno
LogSocketError("ERROR: failed to create a socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to create a socket.\n");
}
}
else {
@ -348,9 +354,8 @@ int tls_smp_server_task() {
WOLFSSL_MSG("setsockopt re-use addr successful\n");
}
else {
// TODO show errno
LogSocketError("ERROR: failed to setsockopt addr on socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to setsockopt addr on socket.\n");
}
}
else {
@ -370,10 +375,7 @@ int tls_smp_server_task() {
WOLFSSL_MSG("setsockopt re-use port successful\n");
}
else {
// TODO show errno
// ret = WOLFSSL_FAILURE;
// TODO what's up with the error?
WOLFSSL_ERROR_MSG("ERROR: failed to setsockopt port on socket. >> IGNORED << \n");
LogSocketError("ERROR: failed to setsockopt port on socket (errno = %d). >> IGNORED << \n", errno);
}
}
else {
@ -427,8 +429,8 @@ int tls_smp_server_task() {
WOLFSSL_MSG("socket bind successful\n");
}
else {
LogSocketError("ERROR: failed to bind to socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to bind to socket.\n");
}
}
@ -474,10 +476,10 @@ int tls_smp_server_task() {
WOLFSSL_MSG("socket listen successful\n");
}
else {
LogSocketError("ERROR: failed to listen to socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to listen to socket.\n");
}
}
}
/*
***************************************************************************
@ -738,21 +740,19 @@ int tls_smp_server_task() {
/* Accept client connections */
if ((mConnd = accept(sockfd, (struct sockaddr*)&clientAddr, &size))
== -1) {
// fprintf(stderr, "ERROR: failed to accept the connection\n\n");
ret = -1;
// TODO goto exit;
WOLFSSL_ERROR_MSG("ERROR: failed socket accept\n");
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed socket accept\n");
ret = WOLFSSL_FAILURE;
break;
}
/* Create a WOLFSSL object */
if ((ssl = wolfSSL_new(ctx)) == NULL) {
// fprintf(stderr, "ERROR: failed to create WOLFSSL object\n");
ret = -1;
//TODO goto exit;
WOLFSSL_ERROR_MSG("ERROR: filed wolfSSL_new during loop\n");
WOLFSSL_ERROR_MSG("ERROR: failed wolfSSL_new during loop\n");
ret = WOLFSSL_FAILURE;
}
close(mConnd);
mConnd = SOCKET_INVALID;
break;
}
/* Attach wolfSSL to the socket */
wolfSSL_set_fd(ssl, mConnd);
@ -771,45 +771,42 @@ int tls_smp_server_task() {
if ((ret = wolfSSL_accept(ssl)) != WOLFSSL_SUCCESS) {
WOLFSSL_ERROR_MSG("ERROR: wolfSSL_accept\n");
ret = WOLFSSL_FAILURE;
// fprintf(stderr,
// "wolfSSL_accept error = %d\n",
// wolfSSL_get_error(ssl, ret));
// TODO goto exit;
}
else {
WOLFSSL_MSG("Client connected successfully\n");
}
#ifdef HAVE_SECRET_CALLBACK
wolfSSL_FreeArrays(ssl);
if (ret == WOLFSSL_SUCCESS) {
wolfSSL_FreeArrays(ssl);
}
#endif
/* Read the client data into our buff array */
memset(buff, 0, sizeof(buff));
if ((ret = wolfSSL_read(ssl, buff, sizeof(buff) - 1)) < 0) {
// fprintf(stderr, "ERROR: failed to read\n");
//TODO goto exit;
if (ret == WOLFSSL_SUCCESS) {
XMEMSET(buff, 0, sizeof(buff));
if (wolfSSL_read(ssl, buff, sizeof(buff) - 1) <= 0) {
WOLFSSL_ERROR_MSG("ERROR: failed to read\n");
ret = WOLFSSL_FAILURE;
}
}
/* Print to stdout any data the client sends */
// printf("Client: %s\n", buff);
if (ret == WOLFSSL_SUCCESS) {
/* Check for server shutdown command */
if (XSTRNCMP(buff, "shutdown", 8) == 0) {
mShutdown = 1;
}
/* Check for server shutdown command */
if (strncmp(buff, "shutdown", 8) == 0) {
// printf("Shutdown command issued!\n");
mShutdown = 1;
}
/* Write our reply into buff */
XMEMSET(buff, 0, sizeof(buff));
XMEMCPY(buff, reply, XSTRLEN(reply));
len = XSTRLEN(buff);
/* Write our reply into buff */
memset(buff, 0, sizeof(buff));
memcpy(buff, reply, strlen(reply));
len = strnlen(buff, sizeof(buff));
/* Reply back to the client */
if ((ret = wolfSSL_write(ssl, buff, len)) != len) {
// fprintf(stderr, "ERROR: failed to write\n");
// TODO goto exit;
/* Reply back to the client */
if (wolfSSL_write(ssl, buff, len) != len) {
WOLFSSL_ERROR_MSG("ERROR: failed to write\n");
ret = WOLFSSL_FAILURE;
}
}
/* Cleanup after this connection */
@ -822,6 +819,12 @@ int tls_smp_server_task() {
close(mConnd); /* Close the connection to the client */
mConnd = SOCKET_INVALID;
}
/* A handshake (wolfSSL_accept) or read/write failure on this client's
* connection shouldn't stop the server from accepting the next one.
* Fatal setup failures above (socket accept/wolfSSL_new) already break
* out of the loop. */
ret = WOLFSSL_SUCCESS;
}
WOLFSSL_MSG("Shutdown complete\n");
@ -967,7 +970,7 @@ int set_time() {
int i = 0;
for (i = 0; i < NTP_SERVER_COUNT; i++) {
const char* thisServer = ntpServerList[i];
if (strncmp(thisServer, "\x00", 1)) {
if (XSTRNCMP(thisServer, "\x00", 1)) {
/* just in case we run out of NTP servers */
break;
}

21
ESP32/TLS13-wifi_station-client/main/station_example_main.c
View File

@ -9,6 +9,7 @@
#include <string.h>
#include <errno.h>
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "freertos/event_groups.h"
@ -192,7 +193,7 @@ int set_time() {
int i = 0;
for (i = 0; i < NTP_SERVER_COUNT; i++) {
const char* thisServer = ntpServerList[i];
if (strncmp(thisServer, "\x00", 1)) {
if (XSTRNCMP(thisServer, "\x00", 1)) {
/* just in case we run out of NTP servers */
break;
}
@ -302,7 +303,7 @@ int tls_smp_client_task() {
/* Initialize the server address struct with zeros */
memset(&servAddr, 0, sizeof(servAddr));
XMEMSET(&servAddr, 0, sizeof(servAddr));
/* Fill in the server address */
servAddr.sin_family = AF_INET; /* using IPv4 */
@ -357,13 +358,13 @@ int tls_smp_client_task() {
* a non-negative integer, the socket file descriptor.
*/
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd > 0) {
if (sockfd >= 0) {
ESP_LOGI(TAG,"socket creation successful\n");
}
else {
// TODO show errno
ESP_LOGE(TAG,
"ERROR: failed to create a socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
ESP_LOGE(TAG, "ERROR: failed to create a socket.\n");
}
}
else {
@ -398,8 +399,8 @@ int tls_smp_client_task() {
ESP_LOGI(TAG,"sockfd connect successful\n");
}
else {
// TODO show errno
ESP_LOGE(TAG, "ERROR: socket connect failed\n");
ESP_LOGE(TAG,
"ERROR: socket connect failed (errno = %d)\n", errno);
ret = WOLFSSL_FAILURE;
}
}
@ -837,13 +838,13 @@ int tls_smp_client_task() {
*/
if (ret == WOLFSSL_SUCCESS) {
memset(buff, 0, BUFF_SIZE);
XMEMSET(buff, 0, BUFF_SIZE);
/* get the length of our message, never longer than the declared size */
/* TODO check for zero length */
len = strnlen(sendMessage, sendMessageSize);
len = XSTRLEN(sendMessage);
/* write the message over secure connection to the server */
if (wolfSSL_write(ssl, sendMessage, len) == len) {
@ -923,7 +924,7 @@ int tls_smp_client_task() {
if (ret == WOLFSSL_SUCCESS) {
/* even though the result should be a zero-terminated string,
* we'll clear the receive buffer */
memset(buff, 0, BUFF_SIZE);
XMEMSET(buff, 0, BUFF_SIZE);
/* read the response data from our secure connection */
if (wolfSSL_read(ssl, buff, BUFF_SIZE - 1) > 0) {

100
ESP32/TLS13-wifi_station-server/main/station_example_main.c
View File

@ -9,6 +9,7 @@
#include <string.h>
#include <errno.h>
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "freertos/event_groups.h"
@ -196,7 +197,7 @@ int set_time() {
int i = 0;
for (i = 0; i < NTP_SERVER_COUNT; i++) {
const char* thisServer = ntpServerList[i];
if (strncmp(thisServer, "\x00", 1)) {
if (XSTRNCMP(thisServer, "\x00", 1)) {
/* just in case we run out of NTP servers */
break;
}
@ -291,6 +292,13 @@ void wifi_init_sta(void)
vEventGroupDelete(s_wifi_event_group);
}
static void LogSocketError(const char* fmt, int err)
{
char err_msg[128];
XSNPRINTF(err_msg, sizeof(err_msg), fmt, err);
WOLFSSL_ERROR_MSG(err_msg);
}
int tls_smp_server_task() {
int ret = WOLFSSL_SUCCESS; /* assume success until proven wrong */
int sockfd = 0; /* the socket that will carry our secure connection */
@ -330,7 +338,7 @@ int tls_smp_server_task() {
#endif /* WOLFSSL_TLS13 */
/* Initialize the server address struct with zeros */
memset(&servAddr, 0, sizeof(servAddr));
XMEMSET(&servAddr, 0, sizeof(servAddr));
/* Fill in the server address */
servAddr.sin_family = AF_INET; /* using IPv4 */
@ -427,13 +435,12 @@ int tls_smp_server_task() {
* a non-negative integer, the socket file descriptor.
*/
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd > 0) {
if (sockfd >= 0) {
WOLFSSL_MSG("socket creation successful\n");
}
else {
// TODO show errno
LogSocketError("ERROR: failed to create a socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to create a socket.\n");
}
}
else {
@ -501,9 +508,8 @@ int tls_smp_server_task() {
WOLFSSL_MSG("setsockopt re-use addr successful\n");
}
else {
ESP_LOGE(TAG, "setsockopt failed with code %i", soc_ret);
LogSocketError("ERROR: failed to setsockopt addr on socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to setsockopt addr on socket.\n");
}
}
else {
@ -584,8 +590,8 @@ int tls_smp_server_task() {
WOLFSSL_MSG("socket bind successful\n");
}
else {
LogSocketError("ERROR: failed to bind to socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to bind to socket.\n");
}
}
@ -632,8 +638,8 @@ int tls_smp_server_task() {
WOLFSSL_MSG("socket listen successful\n");
}
else {
LogSocketError("ERROR: failed to listen to socket (errno = %d).\n", errno);
ret = WOLFSSL_FAILURE;
WOLFSSL_ERROR_MSG("ERROR: failed to listen to socket.\n");
}
}
@ -913,20 +919,18 @@ int tls_smp_server_task() {
/* Accept client connections */
if ((mConnd = accept(sockfd, (struct sockaddr*)&clientAddr, &size))
== -1) {
ret = -1;
goto exit;
WOLFSSL_ERROR_MSG("ERROR: failed socket connection accept\n");
ret = WOLFSSL_FAILURE;
break;
}
/* Create a WOLFSSL object */
if ((ssl = wolfSSL_new(ctx)) == NULL) {
WOLFSSL_ERROR_MSG("ERROR: failed to create WOLFSSL object\n");
ret = -1;
goto exit;
WOLFSSL_ERROR_MSG("ERROR: failed wolfSSL_new during loop\n");
ret = WOLFSSL_FAILURE;
close(mConnd);
mConnd = SOCKET_INVALID;
break;
}
/* Attach wolfSSL to the socket */
@ -945,47 +949,56 @@ int tls_smp_server_task() {
/* Establish TLS connection */
if ((ret = wolfSSL_accept(ssl)) != WOLFSSL_SUCCESS) {
WOLFSSL_ERROR_MSG("ERROR: wolfSSL_accept\n");
ret = WOLFSSL_FAILURE;
ESP_LOGE(TAG, "wolfSSL_accept error = %d\n",
wolfSSL_get_error(ssl, ret));
goto exit;
ret = WOLFSSL_FAILURE;
}
else {
WOLFSSL_MSG("Client connected successfully\n");
}
#ifdef HAVE_SECRET_CALLBACK
wolfSSL_FreeArrays(ssl);
if (ret == WOLFSSL_SUCCESS) {
wolfSSL_FreeArrays(ssl);
}
#endif
/* Read the client data into our buff array */
memset(buff, 0, sizeof(buff));
if ((ret = wolfSSL_read(ssl, buff, sizeof(buff) - 1)) < 0) {
ESP_LOGE(TAG, "wolfSSL_read error = %d\n",
wolfSSL_get_error(ssl, ret));
goto exit;
if (ret == WOLFSSL_SUCCESS) {
int readRet;
XMEMSET(buff, 0, sizeof(buff));
readRet = wolfSSL_read(ssl, buff, sizeof(buff) - 1);
if (readRet <= 0) {
ESP_LOGE(TAG, "wolfSSL_read error = %d\n",
wolfSSL_get_error(ssl, readRet));
ret = WOLFSSL_FAILURE;
}
}
/* Print any data the client sends */
ESP_LOGI(TAG, "Client: %s\n", buff);
if (ret == WOLFSSL_SUCCESS) {
/* Print any data the client sends */
ESP_LOGI(TAG, "Client: %s\n", buff);
/* Check for server shutdown command */
if (strncmp(buff, "shutdown", 8) == 0) {
ESP_LOGI(TAG, "Shutdown command issued!\n");
mShutdown = 1;
}
/* Check for server shutdown command */
if (XSTRNCMP(buff, "shutdown", 8) == 0) {
ESP_LOGI(TAG, "Shutdown command issued!\n");
mShutdown = 1;
}
/* Write our reply into buff */
memset(buff, 0, sizeof(buff));
memcpy(buff, reply, strlen(reply));
len = strnlen(buff, sizeof(buff));
/* Write our reply into buff */
XMEMSET(buff, 0, sizeof(buff));
XMEMCPY(buff, reply, XSTRLEN(reply));
len = XSTRLEN(buff);
/* Reply back to the client */
if ((ret = wolfSSL_write(ssl, buff, len)) != len) {
ESP_LOGE(TAG, "wolfSSL_write error = %d\n",
wolfSSL_get_error(ssl, ret));
goto exit;
/* Reply back to the client */
{
int writeRet = wolfSSL_write(ssl, buff, len);
if (writeRet != len) {
ESP_LOGE(TAG, "wolfSSL_write error = %d\n",
wolfSSL_get_error(ssl, writeRet));
ret = WOLFSSL_FAILURE;
}
}
}
/* Cleanup after this connection */
@ -998,6 +1011,12 @@ int tls_smp_server_task() {
close(mConnd); /* Close the connection to the client */
mConnd = SOCKET_INVALID;
}
/* A handshake (wolfSSL_accept) or read/write failure on this client's
* connection shouldn't stop the server from accepting the next one.
* Fatal setup failures above (socket accept/wolfSSL_new) already break
* out of the loop. */
ret = WOLFSSL_SUCCESS;
}
WOLFSSL_MSG("Shutdown complete\n");
@ -1009,7 +1028,6 @@ int tls_smp_server_task() {
*
***************************************************************************
*/
exit:
if (mConnd != SOCKET_INVALID) {
close(mConnd); /* Close the connection to the client */
mConnd = SOCKET_INVALID;