Prvni ulozeni z chegewara githubu

libraries/WiFiClientSecure/src/WiFiClientSecure.cpp

@@ -0,0 +1,391 @@
+/*
+  WiFiClientSecure.cpp - Client Secure class for ESP32
+  Copyright (c) 2016 Hristo Gochkov  All right reserved.
+  Additions Copyright (C) 2017 Evandro Luis Copercini.
+
+  This library is free software; you can redistribute it and/or
+  modify it under the terms of the GNU Lesser General Public
+  License as published by the Free Software Foundation; either
+  version 2.1 of the License, or (at your option) any later version.
+
+  This library is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public
+  License along with this library; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+#include "WiFiClientSecure.h"
+#include "esp_crt_bundle.h"
+#include <lwip/sockets.h>
+#include <lwip/netdb.h>
+#include <errno.h>
+
+#undef connect
+#undef write
+#undef read
+
+
+WiFiClientSecure::WiFiClientSecure()
+{
+    _connected = false;
+    _timeout = 30000; // Same default as ssl_client
+
+    sslclient = new sslclient_context;
+    ssl_init(sslclient);
+    sslclient->socket = -1;
+    sslclient->handshake_timeout = 120000;
+    _use_insecure = false;
+    _CA_cert = NULL;
+    _cert = NULL;
+    _private_key = NULL;
+    _pskIdent = NULL;
+    _psKey = NULL;
+    next = NULL;
+    _alpn_protos = NULL;
+    _use_ca_bundle = false;
+}
+
+
+WiFiClientSecure::WiFiClientSecure(int sock)
+{
+    _connected = false;
+    _timeout = 30000; // Same default as ssl_client
+
+    sslclient = new sslclient_context;
+    ssl_init(sslclient);
+    sslclient->socket = sock;
+    sslclient->handshake_timeout = 120000;
+
+    if (sock >= 0) {
+        _connected = true;
+    }
+
+    _CA_cert = NULL;
+    _cert = NULL;
+    _private_key = NULL;
+    _pskIdent = NULL;
+    _psKey = NULL;
+    next = NULL;
+    _alpn_protos = NULL;
+}
+
+WiFiClientSecure::~WiFiClientSecure()
+{
+    stop();
+    delete sslclient;
+}
+
+WiFiClientSecure &WiFiClientSecure::operator=(const WiFiClientSecure &other)
+{
+    stop();
+    sslclient->socket = other.sslclient->socket;
+    _connected = other._connected;
+    return *this;
+}
+
+void WiFiClientSecure::stop()
+{
+    if (sslclient->socket >= 0) {
+        close(sslclient->socket);
+        sslclient->socket = -1;
+        _connected = false;
+        _peek = -1;
+    }
+    stop_ssl_socket(sslclient, _CA_cert, _cert, _private_key);
+}
+
+int WiFiClientSecure::connect(IPAddress ip, uint16_t port)
+{
+    if (_pskIdent && _psKey)
+        return connect(ip, port, _pskIdent, _psKey);
+    return connect(ip, port, _CA_cert, _cert, _private_key);
+}
+
+int WiFiClientSecure::connect(IPAddress ip, uint16_t port, int32_t timeout){
+    _timeout = timeout;
+    return connect(ip, port);
+}
+
+int WiFiClientSecure::connect(const char *host, uint16_t port)
+{
+    if (_pskIdent && _psKey)
+        return connect(host, port, _pskIdent, _psKey);
+    return connect(host, port, _CA_cert, _cert, _private_key);
+}
+
+int WiFiClientSecure::connect(const char *host, uint16_t port, int32_t timeout){
+    _timeout = timeout;
+    return connect(host, port);
+}
+
+int WiFiClientSecure::connect(IPAddress ip, uint16_t port, const char *CA_cert, const char *cert, const char *private_key)
+{
+    return connect(ip.toString().c_str(), port, CA_cert, cert, private_key);
+}
+
+int WiFiClientSecure::connect(const char *host, uint16_t port, const char *CA_cert, const char *cert, const char *private_key)
+{
+    int ret = start_ssl_client(sslclient, host, port, _timeout, CA_cert, _use_ca_bundle, cert, private_key, NULL, NULL, _use_insecure, _alpn_protos);
+    _lastError = ret;
+    if (ret < 0) {
+        log_e("start_ssl_client: %d", ret);
+        stop();
+        return 0;
+    }
+    _connected = true;
+    return 1;
+}
+
+int WiFiClientSecure::connect(IPAddress ip, uint16_t port, const char *pskIdent, const char *psKey) {
+    return connect(ip.toString().c_str(), port, pskIdent, psKey);
+}
+
+int WiFiClientSecure::connect(const char *host, uint16_t port, const char *pskIdent, const char *psKey) {
+    log_v("start_ssl_client with PSK");
+    int ret = start_ssl_client(sslclient, host, port, _timeout, NULL, false, NULL, NULL, pskIdent, psKey, _use_insecure, _alpn_protos);
+    _lastError = ret;
+    if (ret < 0) {
+        log_e("start_ssl_client: %d", ret);
+        stop();
+        return 0;
+    }
+    _connected = true;
+    return 1;
+}
+
+int WiFiClientSecure::peek(){
+    if(_peek >= 0){
+        return _peek;
+    }
+    _peek = timedRead();
+    return _peek;
+}
+
+size_t WiFiClientSecure::write(uint8_t data)
+{
+    return write(&data, 1);
+}
+
+int WiFiClientSecure::read()
+{
+    uint8_t data = -1;
+    int res = read(&data, 1);
+    if (res < 0) {
+        return res;
+    }
+    return data;
+}
+
+size_t WiFiClientSecure::write(const uint8_t *buf, size_t size)
+{
+    if (!_connected) {
+        return 0;
+    }
+    int res = send_ssl_data(sslclient, buf, size);
+    if (res < 0) {
+        stop();
+        res = 0;
+    }
+    return res;
+}
+
+int WiFiClientSecure::read(uint8_t *buf, size_t size)
+{
+    int peeked = 0;
+    int avail = available();
+    if ((!buf && size) || avail <= 0) {
+        return -1;
+    }
+    if(!size){
+        return 0;
+    }
+    if(_peek >= 0){
+        buf[0] = _peek;
+        _peek = -1;
+        size--;
+        avail--;
+        if(!size || !avail){
+            return 1;
+        }
+        buf++;
+        peeked = 1;
+    }
+    
+    int res = get_ssl_receive(sslclient, buf, size);
+    if (res < 0) {
+        stop();
+        return peeked?peeked:res;
+    }
+    return res + peeked;
+}
+
+int WiFiClientSecure::available()
+{
+    int peeked = (_peek >= 0);
+    if (!_connected) {
+        return peeked;
+    }
+    int res = data_to_read(sslclient);
+    if (res < 0) {
+        stop();
+        return peeked?peeked:res;
+    }
+    return res+peeked;
+}
+
+uint8_t WiFiClientSecure::connected()
+{
+    uint8_t dummy = 0;
+    read(&dummy, 0);
+
+    return _connected;
+}
+
+void WiFiClientSecure::setInsecure()
+{
+    _CA_cert = NULL;
+    _cert = NULL;
+    _private_key = NULL;
+    _pskIdent = NULL;
+    _psKey = NULL;
+    _use_insecure = true;
+}
+
+void WiFiClientSecure::setCACert (const char *rootCA)
+{
+    _CA_cert = rootCA;
+}
+
+ void WiFiClientSecure::setCACertBundle(const uint8_t * bundle)
+ {
+    if (bundle != NULL)
+    {
+        esp_crt_bundle_set(bundle);
+        _use_ca_bundle = true;
+    } else {
+        esp_crt_bundle_detach(NULL);
+        _use_ca_bundle = false;
+    }
+ }
+
+void WiFiClientSecure::setCertificate (const char *client_ca)
+{
+    _cert = client_ca;
+}
+
+void WiFiClientSecure::setPrivateKey (const char *private_key)
+{
+    _private_key = private_key;
+}
+
+void WiFiClientSecure::setPreSharedKey(const char *pskIdent, const char *psKey) {
+    _pskIdent = pskIdent;
+    _psKey = psKey;
+}
+
+bool WiFiClientSecure::verify(const char* fp, const char* domain_name)
+{
+    if (!sslclient)
+        return false;
+
+    return verify_ssl_fingerprint(sslclient, fp, domain_name);
+}
+
+char *WiFiClientSecure::_streamLoad(Stream& stream, size_t size) {
+  char *dest = (char*)malloc(size+1);
+  if (!dest) {
+    return nullptr;
+  }
+  if (size != stream.readBytes(dest, size)) {
+    free(dest);
+    dest = nullptr;
+    return nullptr;
+  }
+  dest[size] = '\0';
+  return dest;
+}
+
+bool WiFiClientSecure::loadCACert(Stream& stream, size_t size) {
+  if (_CA_cert != NULL) free(const_cast<char*>(_CA_cert));
+  char *dest = _streamLoad(stream, size);
+  bool ret = false;
+  if (dest) {
+    setCACert(dest);
+    ret = true;
+  }
+  return ret;
+}
+
+bool WiFiClientSecure::loadCertificate(Stream& stream, size_t size) {
+  if (_cert != NULL) free(const_cast<char*>(_cert));
+  char *dest = _streamLoad(stream, size);
+  bool ret = false;
+  if (dest) {
+    setCertificate(dest);
+    ret = true;
+  }
+  return ret;
+}
+
+bool WiFiClientSecure::loadPrivateKey(Stream& stream, size_t size) {
+  if (_private_key != NULL) free(const_cast<char*>(_private_key));
+  char *dest = _streamLoad(stream, size);
+  bool ret = false;
+  if (dest) {
+    setPrivateKey(dest);
+    ret = true;
+  }
+  return ret;
+}
+
+int WiFiClientSecure::lastError(char *buf, const size_t size)
+{
+    if (!_lastError) {
+        return 0;
+    }
+    mbedtls_strerror(_lastError, buf, size);
+    return _lastError;
+}
+
+void WiFiClientSecure::setHandshakeTimeout(unsigned long handshake_timeout)
+{
+    sslclient->handshake_timeout = handshake_timeout * 1000;
+}
+
+void WiFiClientSecure::setAlpnProtocols(const char **alpn_protos)
+{
+    _alpn_protos = alpn_protos;
+}
+int WiFiClientSecure::setTimeout(uint32_t seconds)
+{
+    _timeout = seconds * 1000;
+    if (sslclient->socket >= 0) {
+        struct timeval tv;
+        tv.tv_sec = seconds;
+        tv.tv_usec = 0;
+        if(setSocketOption(SO_RCVTIMEO, (char *)&tv, sizeof(struct timeval)) < 0) {
+            return -1;
+        }
+        return setSocketOption(SO_SNDTIMEO, (char *)&tv, sizeof(struct timeval));
+    }
+    else {
+        return 0;
+    }
+}
+int WiFiClientSecure::setSocketOption(int option, char* value, size_t len)
+{
+    return setSocketOption(SOL_SOCKET, option, (const void*)value, len);
+}
+
+int WiFiClientSecure::setSocketOption(int level, int option, const void* value, size_t len)
+{
+    int res = setsockopt(sslclient->socket, level, option, value, len);
+    if(res < 0) {
+        log_e("fail on %d, errno: %d, \"%s\"", sslclient->socket, errno, strerror(errno));
+    }
+    return res;
+}

libraries/WiFiClientSecure/src/WiFiClientSecure.h

@@ -0,0 +1,117 @@
+/*
+  WiFiClientSecure.h - Base class that provides Client SSL to ESP32
+  Copyright (c) 2011 Adrian McEwen.  All right reserved.
+  Additions Copyright (C) 2017 Evandro Luis Copercini.
+
+  This library is free software; you can redistribute it and/or
+  modify it under the terms of the GNU Lesser General Public
+  License as published by the Free Software Foundation; either
+  version 2.1 of the License, or (at your option) any later version.
+
+  This library is distributed in the hope that it will be useful,
+  but WITHOUT ANY WARRANTY; without even the implied warranty of
+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+  Lesser General Public License for more details.
+
+  You should have received a copy of the GNU Lesser General Public
+  License along with this library; if not, write to the Free Software
+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+*/
+
+#ifndef WiFiClientSecure_h
+#define WiFiClientSecure_h
+#include "Arduino.h"
+#include "IPAddress.h"
+#include <WiFi.h>
+#include "ssl_client.h"
+
+class WiFiClientSecure : public WiFiClient
+{
+protected:
+    sslclient_context *sslclient;
+ 
+    int _lastError = 0;
+    int _peek = -1;
+    int _timeout;
+    bool _use_insecure;
+    const char *_CA_cert;
+    const char *_cert;
+    const char *_private_key;
+    const char *_pskIdent; // identity for PSK cipher suites
+    const char *_psKey; // key in hex for PSK cipher suites
+    const char **_alpn_protos;
+    bool _use_ca_bundle;
+
+public:
+    WiFiClientSecure *next;
+    WiFiClientSecure();
+    WiFiClientSecure(int socket);
+    ~WiFiClientSecure();
+    int connect(IPAddress ip, uint16_t port);
+    int connect(IPAddress ip, uint16_t port, int32_t timeout);
+    int connect(const char *host, uint16_t port);
+    int connect(const char *host, uint16_t port, int32_t timeout);
+    int connect(IPAddress ip, uint16_t port, const char *rootCABuff, const char *cli_cert, const char *cli_key);
+    int connect(const char *host, uint16_t port, const char *rootCABuff, const char *cli_cert, const char *cli_key);
+    int connect(IPAddress ip, uint16_t port, const char *pskIdent, const char *psKey);
+    int connect(const char *host, uint16_t port, const char *pskIdent, const char *psKey);
+    int peek();
+    size_t write(uint8_t data);
+    size_t write(const uint8_t *buf, size_t size);
+    int available();
+    int read();
+    int read(uint8_t *buf, size_t size);
+    void flush() {}
+    void stop();
+    uint8_t connected();
+    int lastError(char *buf, const size_t size);
+    void setInsecure(); // Don't validate the chain, just accept whatever is given.  VERY INSECURE!
+    void setPreSharedKey(const char *pskIdent, const char *psKey); // psKey in Hex
+    void setCACert(const char *rootCA);
+    void setCertificate(const char *client_ca);
+    void setPrivateKey (const char *private_key);
+    bool loadCACert(Stream& stream, size_t size);
+    void setCACertBundle(const uint8_t * bundle);
+    bool loadCertificate(Stream& stream, size_t size);
+    bool loadPrivateKey(Stream& stream, size_t size);
+    bool verify(const char* fingerprint, const char* domain_name);
+    void setHandshakeTimeout(unsigned long handshake_timeout);
+    void setAlpnProtocols(const char **alpn_protos);
+    const mbedtls_x509_crt* getPeerCertificate() { return mbedtls_ssl_get_peer_cert(&sslclient->ssl_ctx); };
+    bool getFingerprintSHA256(uint8_t sha256_result[32]) { return get_peer_fingerprint(sslclient, sha256_result); };
+    int setTimeout(uint32_t seconds);
+    int setSocketOption(int option, char* value, size_t len);
+    int setSocketOption(int level, int option, const void* value, size_t len);
+
+    operator bool()
+    {
+        return connected();
+    }
+    WiFiClientSecure &operator=(const WiFiClientSecure &other);
+    bool operator==(const bool value)
+    {
+        return bool() == value;
+    }
+    bool operator!=(const bool value)
+    {
+        return bool() != value;
+    }
+    bool operator==(const WiFiClientSecure &);
+    bool operator!=(const WiFiClientSecure &rhs)
+    {
+        return !this->operator==(rhs);
+    };
+
+    int socket()
+    {
+        return sslclient->socket = -1;
+    }
+
+private:
+    char *_streamLoad(Stream& stream, size_t size);
+
+    //friend class WiFiServer;
+    using Print::write;
+};
+
+#endif /* _WIFICLIENT_H_ */

libraries/WiFiClientSecure/src/esp_crt_bundle.c

@@ -0,0 +1,216 @@
+// Copyright 2018-2019 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+#include <string.h>
+#include <esp_system.h>
+#include <esp32-hal-log.h>
+#include "esp_crt_bundle.h"
+#include "esp_err.h"
+
+#define BUNDLE_HEADER_OFFSET 2
+#define CRT_HEADER_OFFSET 4
+
+/* a dummy certificate so that
+ * cacert_ptr passes non-NULL check during handshake */
+static mbedtls_x509_crt s_dummy_crt;
+
+
+typedef struct crt_bundle_t {
+    const uint8_t **crts;
+    uint16_t num_certs;
+    size_t x509_crt_bundle_len;
+} crt_bundle_t;
+
+static crt_bundle_t s_crt_bundle;
+
+static int esp_crt_verify_callback(void *buf, mbedtls_x509_crt *crt, int data, uint32_t *flags);
+static int esp_crt_check_signature(mbedtls_x509_crt *child, const uint8_t *pub_key_buf, size_t pub_key_len);
+
+
+static int esp_crt_check_signature(mbedtls_x509_crt *child, const uint8_t *pub_key_buf, size_t pub_key_len)
+{
+    int ret = 0;
+    mbedtls_x509_crt parent;
+    const mbedtls_md_info_t *md_info;
+    unsigned char hash[MBEDTLS_MD_MAX_SIZE];
+
+    mbedtls_x509_crt_init(&parent);
+
+    if ( (ret = mbedtls_pk_parse_public_key(&parent.pk, pub_key_buf, pub_key_len) ) != 0) {
+        log_e("PK parse failed with error %X", ret);
+        goto cleanup;
+    }
+
+
+    // Fast check to avoid expensive computations when not necessary
+    if (!mbedtls_pk_can_do(&parent.pk, child->sig_pk)) {
+        log_e("Simple compare failed");
+        ret = -1;
+        goto cleanup;
+    }
+
+    md_info = mbedtls_md_info_from_type(child->sig_md);
+    if ( (ret = mbedtls_md( md_info, child->tbs.p, child->tbs.len, hash )) != 0 ) {
+        log_e("Internal mbedTLS error %X", ret);
+        goto cleanup;
+    }
+
+    if ( (ret = mbedtls_pk_verify_ext( child->sig_pk, child->sig_opts, &parent.pk,
+                                       child->sig_md, hash, mbedtls_md_get_size( md_info ),
+                                       child->sig.p, child->sig.len )) != 0 ) {
+
+        log_e("PK verify failed with error %X", ret);
+        goto cleanup;
+    }
+cleanup:
+    mbedtls_x509_crt_free(&parent);
+
+    return ret;
+}
+
+
+/* This callback is called for every certificate in the chain. If the chain
+ * is proper each intermediate certificate is validated through its parent
+ * in the x509_crt_verify_chain() function. So this callback should
+ * only verify the first untrusted link in the chain is signed by the
+ * root certificate in the trusted bundle
+*/
+int esp_crt_verify_callback(void *buf, mbedtls_x509_crt *crt, int depth, uint32_t *flags)
+{
+    mbedtls_x509_crt *child = crt;
+
+    /* It's OK for a trusted cert to have a weak signature hash alg.
+       as we already trust this certificate */
+    uint32_t flags_filtered = *flags & ~(MBEDTLS_X509_BADCERT_BAD_MD);
+
+    if (flags_filtered != MBEDTLS_X509_BADCERT_NOT_TRUSTED) {
+        return 0;
+    }
+
+
+    if (s_crt_bundle.crts == NULL) {
+        log_e("No certificates in bundle");
+        return MBEDTLS_ERR_X509_FATAL_ERROR;
+    }
+
+    log_d("%d certificates in bundle", s_crt_bundle.num_certs);
+
+    size_t name_len = 0;
+    const uint8_t *crt_name;
+
+    bool crt_found = false;
+    int start = 0;
+    int end = s_crt_bundle.num_certs - 1;
+    int middle = (end - start) / 2;
+
+    /* Look for the certificate using binary search on subject name */
+    while (start <= end) {
+        name_len = s_crt_bundle.crts[middle][0] << 8 | s_crt_bundle.crts[middle][1];
+        crt_name = s_crt_bundle.crts[middle] + CRT_HEADER_OFFSET;
+
+        int cmp_res = memcmp(child->issuer_raw.p, crt_name, name_len );
+        if (cmp_res == 0) {
+            crt_found = true;
+            break;
+        } else if (cmp_res < 0) {
+            end = middle - 1;
+        } else {
+            start = middle + 1;
+        }
+        middle = (start + end) / 2;
+    }
+
+    int ret = MBEDTLS_ERR_X509_FATAL_ERROR;
+    if (crt_found) {
+        size_t key_len = s_crt_bundle.crts[middle][2] << 8 | s_crt_bundle.crts[middle][3];
+        ret = esp_crt_check_signature(child, s_crt_bundle.crts[middle] + CRT_HEADER_OFFSET + name_len, key_len);
+    }
+
+    if (ret == 0) {
+        log_i("Certificate validated");
+        *flags = 0;
+        return 0;
+    }
+
+    log_e("Failed to verify certificate");
+    return MBEDTLS_ERR_X509_FATAL_ERROR;
+}
+
+
+/* Initialize the bundle into an array so we can do binary search for certs,
+   the bundle generated by the python utility is already presorted by subject name
+ */
+static esp_err_t esp_crt_bundle_init(const uint8_t *x509_bundle)
+{
+    s_crt_bundle.num_certs = (x509_bundle[0] << 8) | x509_bundle[1];
+    s_crt_bundle.crts = calloc(s_crt_bundle.num_certs, sizeof(x509_bundle));
+
+    if (s_crt_bundle.crts == NULL) {
+        log_e("Unable to allocate memory for bundle");
+        return ESP_ERR_NO_MEM;
+    }
+
+    const uint8_t *cur_crt;
+    cur_crt = x509_bundle + BUNDLE_HEADER_OFFSET;
+
+    for (int i = 0; i < s_crt_bundle.num_certs; i++) {
+        s_crt_bundle.crts[i] = cur_crt;
+
+        size_t name_len = cur_crt[0] << 8 | cur_crt[1];
+        size_t key_len = cur_crt[2] << 8 | cur_crt[3];
+        cur_crt = cur_crt + CRT_HEADER_OFFSET + name_len + key_len;
+    }
+
+    return ESP_OK;
+}
+
+esp_err_t esp_crt_bundle_attach(void *conf)
+{
+    esp_err_t ret = ESP_OK;
+    // If no bundle has been set by the user then use the bundle embedded in the binary
+    if (s_crt_bundle.crts == NULL) {
+        log_e("Failed to attach bundle");
+        return ret;
+    }
+
+    if (conf) {
+        /* point to a dummy certificate
+         * This is only required so that the
+         * cacert_ptr passes non-NULL check during handshake
+         */
+        mbedtls_ssl_config *ssl_conf = (mbedtls_ssl_config *)conf;
+        mbedtls_x509_crt_init(&s_dummy_crt);
+        mbedtls_ssl_conf_ca_chain(ssl_conf, &s_dummy_crt, NULL);
+        mbedtls_ssl_conf_verify(ssl_conf, esp_crt_verify_callback, NULL);
+    }
+
+    return ret;
+}
+
+void esp_crt_bundle_detach(mbedtls_ssl_config *conf)
+{
+    free(s_crt_bundle.crts);
+    s_crt_bundle.crts = NULL;
+    if (conf) {
+        mbedtls_ssl_conf_verify(conf, NULL, NULL);
+    }
+}
+
+void esp_crt_bundle_set(const uint8_t *x509_bundle)
+{
+    // Free any previously used bundle
+    free(s_crt_bundle.crts);
+    esp_crt_bundle_init(x509_bundle);
+}

libraries/WiFiClientSecure/src/esp_crt_bundle.h

@@ -0,0 +1,68 @@
+// Copyright 2017-2019 Espressif Systems (Shanghai) PTE LTD
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+
+#ifndef _ESP_CRT_BUNDLE_H_
+#define _ESP_CRT_BUNDLE_H_
+
+#include "mbedtls/ssl.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+
+/**
+ * @brief      Attach and enable use of a bundle for certificate verification
+ *
+ * Attach and enable use of a bundle for certificate verification through a verification callback.
+ * If no specific bundle has been set through esp_crt_bundle_set() it will default to the
+ * bundle defined in menuconfig and embedded in the binary.
+ *
+ * @param[in]  conf      The config struct for the SSL connection.
+ *
+ * @return
+ *             - ESP_OK  if adding certificates was successful.
+ *             - Other   if an error occured or an action must be taken by the calling process.
+ */
+esp_err_t esp_crt_bundle_attach(void *conf);
+
+
+/**
+ * @brief      Disable and dealloc the certification bundle
+ *
+ * Removes the certificate verification callback and deallocates used resources
+ *
+ * @param[in]  conf      The config struct for the SSL connection.
+ */
+void esp_crt_bundle_detach(mbedtls_ssl_config *conf);
+
+
+/**
+ * @brief      Set the default certificate bundle used for verification
+ *
+ * Overrides the default certificate bundle. In most use cases the bundle should be
+ * set through menuconfig. The bundle needs to be sorted by subject name since binary search is
+ * used to find certificates.
+ *
+ * @param[in]  x509_bundle     A pointer to the certificate bundle.
+ */
+void esp_crt_bundle_set(const uint8_t *x509_bundle);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif //_ESP_CRT_BUNDLE_H_

libraries/WiFiClientSecure/src/ssl_client.cpp

@@ -0,0 +1,547 @@
+/* Provide SSL/TLS functions to ESP32 with Arduino IDE
+*
+* Adapted from the ssl_client1 example of mbedtls.
+*
+* Original Copyright (C) 2006-2015, ARM Limited, All Rights Reserved, Apache 2.0 License.
+* Additions Copyright (C) 2017 Evandro Luis Copercini, Apache 2.0 License.
+*/
+
+#include "Arduino.h"
+#include <esp32-hal-log.h>
+#include <lwip/err.h>
+#include <lwip/sockets.h>
+#include <lwip/sys.h>
+#include <lwip/netdb.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/oid.h>
+#include <algorithm>
+#include <string>
+#include "ssl_client.h"
+#include "esp_crt_bundle.h"
+#include "WiFi.h"
+
+#if !defined(MBEDTLS_KEY_EXCHANGE__SOME__PSK_ENABLED) && !defined(MBEDTLS_KEY_EXCHANGE_SOME_PSK_ENABLED)
+#  warning "Please call `idf.py menuconfig` then go to Component config -> mbedTLS -> TLS Key Exchange Methods -> Enable pre-shared-key ciphersuites and then check `Enable PSK based cyphersuite modes`. Save and Quit."
+#else
+
+const char *pers = "esp32-tls";
+
+static int _handle_error(int err, const char * function, int line)
+{
+    if(err == -30848){
+        return err;
+    }
+#ifdef MBEDTLS_ERROR_C
+    char error_buf[100];
+    mbedtls_strerror(err, error_buf, 100);
+    log_e("[%s():%d]: (%d) %s", function, line, err, error_buf);
+#else
+    log_e("[%s():%d]: code %d", function, line, err);
+#endif
+    return err;
+}
+
+#define handle_error(e) _handle_error(e, __FUNCTION__, __LINE__)
+
+
+void ssl_init(sslclient_context *ssl_client)
+{
+    // reset embedded pointers to zero
+    memset(ssl_client, 0, sizeof(sslclient_context));
+    mbedtls_ssl_init(&ssl_client->ssl_ctx);
+    mbedtls_ssl_config_init(&ssl_client->ssl_conf);
+    mbedtls_ctr_drbg_init(&ssl_client->drbg_ctx);
+}
+
+
+int start_ssl_client(sslclient_context *ssl_client, const char *host, uint32_t port, int timeout, const char *rootCABuff, bool useRootCABundle, const char *cli_cert, const char *cli_key, const char *pskIdent, const char *psKey, bool insecure, const char **alpn_protos)
+{
+    char buf[512];
+    int ret, flags;
+    int enable = 1;
+    log_v("Free internal heap before TLS %u", ESP.getFreeHeap());
+
+    if (rootCABuff == NULL && pskIdent == NULL && psKey == NULL && !insecure && !useRootCABundle) {
+        return -1;
+    }
+
+    log_v("Starting socket");
+    ssl_client->socket = -1;
+
+    ssl_client->socket = lwip_socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
+    if (ssl_client->socket < 0) {
+        log_e("ERROR opening socket");
+        return ssl_client->socket;
+    }
+
+    IPAddress srv((uint32_t)0);
+    if(!WiFiGenericClass::hostByName(host, srv)){
+        return -1;
+    }
+
+    fcntl( ssl_client->socket, F_SETFL, fcntl( ssl_client->socket, F_GETFL, 0 ) | O_NONBLOCK );
+    struct sockaddr_in serv_addr;
+    memset(&serv_addr, 0, sizeof(serv_addr));
+    serv_addr.sin_family = AF_INET;
+    serv_addr.sin_addr.s_addr = srv;
+    serv_addr.sin_port = htons(port);
+
+    if(timeout <= 0){
+        timeout = 30000; // Milli seconds.
+    }
+
+    fd_set fdset;
+    struct timeval tv;
+    FD_ZERO(&fdset);
+    FD_SET(ssl_client->socket, &fdset);
+    tv.tv_sec = timeout / 1000;
+    tv.tv_usec = (timeout % 1000) * 1000;
+
+    int res = lwip_connect(ssl_client->socket, (struct sockaddr*)&serv_addr, sizeof(serv_addr));
+    if (res < 0 && errno != EINPROGRESS) {
+        log_e("connect on fd %d, errno: %d, \"%s\"", ssl_client->socket, errno, strerror(errno));
+        lwip_close(ssl_client->socket);
+        ssl_client->socket = -1;
+        return -1;
+    }
+
+    res = select(ssl_client->socket + 1, nullptr, &fdset, nullptr, timeout<0 ? nullptr : &tv);
+    if (res < 0) {
+        log_e("select on fd %d, errno: %d, \"%s\"", ssl_client->socket, errno, strerror(errno));
+        lwip_close(ssl_client->socket);
+        ssl_client->socket = -1;
+        return -1;
+    } else if (res == 0) {
+        log_i("select returned due to timeout %d ms for fd %d", timeout, ssl_client->socket);
+        lwip_close(ssl_client->socket);
+        ssl_client->socket = -1;
+        return -1;
+    } else {
+        int sockerr;
+        socklen_t len = (socklen_t)sizeof(int);
+        res = getsockopt(ssl_client->socket, SOL_SOCKET, SO_ERROR, &sockerr, &len);
+
+        if (res < 0) {
+            log_e("getsockopt on fd %d, errno: %d, \"%s\"", ssl_client->socket, errno, strerror(errno));
+            lwip_close(ssl_client->socket);
+            ssl_client->socket = -1;
+            return -1;
+        }
+
+        if (sockerr != 0) {
+            log_e("socket error on fd %d, errno: %d, \"%s\"", ssl_client->socket, sockerr, strerror(sockerr));
+            lwip_close(ssl_client->socket);
+            ssl_client->socket = -1;
+            return -1;
+        }
+    }
+
+
+#define ROE(x,msg) { if (((x)<0)) { log_e("LWIP Socket config of " msg " failed."); return -1; }}
+     ROE(lwip_setsockopt(ssl_client->socket, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv)),"SO_RCVTIMEO");
+     ROE(lwip_setsockopt(ssl_client->socket, SOL_SOCKET, SO_SNDTIMEO, &tv, sizeof(tv)),"SO_SNDTIMEO");
+
+     ROE(lwip_setsockopt(ssl_client->socket, IPPROTO_TCP, TCP_NODELAY, &enable, sizeof(enable)),"TCP_NODELAY");
+     ROE(lwip_setsockopt(ssl_client->socket, SOL_SOCKET, SO_KEEPALIVE, &enable, sizeof(enable)),"SO_KEEPALIVE");
+
+
+
+    log_v("Seeding the random number generator");
+    mbedtls_entropy_init(&ssl_client->entropy_ctx);
+
+    ret = mbedtls_ctr_drbg_seed(&ssl_client->drbg_ctx, mbedtls_entropy_func,
+                                &ssl_client->entropy_ctx, (const unsigned char *) pers, strlen(pers));
+    if (ret < 0) {
+        return handle_error(ret);
+    }
+
+    log_v("Setting up the SSL/TLS structure...");
+
+    if ((ret = mbedtls_ssl_config_defaults(&ssl_client->ssl_conf,
+                                           MBEDTLS_SSL_IS_CLIENT,
+                                           MBEDTLS_SSL_TRANSPORT_STREAM,
+                                           MBEDTLS_SSL_PRESET_DEFAULT)) != 0) {
+        return handle_error(ret);
+    }
+
+    if (alpn_protos != NULL) {
+        log_v("Setting ALPN protocols");
+        if ((ret = mbedtls_ssl_conf_alpn_protocols(&ssl_client->ssl_conf, alpn_protos) ) != 0) {
+            return handle_error(ret);
+        }
+    }
+
+    // MBEDTLS_SSL_VERIFY_REQUIRED if a CA certificate is defined on Arduino IDE and
+    // MBEDTLS_SSL_VERIFY_NONE if not.
+
+    if (insecure) {
+        mbedtls_ssl_conf_authmode(&ssl_client->ssl_conf, MBEDTLS_SSL_VERIFY_NONE);
+        log_d("WARNING: Skipping SSL Verification. INSECURE!");
+    } else if (rootCABuff != NULL) {
+        log_v("Loading CA cert");
+        mbedtls_x509_crt_init(&ssl_client->ca_cert);
+        mbedtls_ssl_conf_authmode(&ssl_client->ssl_conf, MBEDTLS_SSL_VERIFY_REQUIRED);
+        ret = mbedtls_x509_crt_parse(&ssl_client->ca_cert, (const unsigned char *)rootCABuff, strlen(rootCABuff) + 1);
+        mbedtls_ssl_conf_ca_chain(&ssl_client->ssl_conf, &ssl_client->ca_cert, NULL);
+        //mbedtls_ssl_conf_verify(&ssl_client->ssl_ctx, my_verify, NULL );
+        if (ret < 0) {
+            // free the ca_cert in the case parse failed, otherwise, the old ca_cert still in the heap memory, that lead to "out of memory" crash.
+            mbedtls_x509_crt_free(&ssl_client->ca_cert);
+            return handle_error(ret);
+        }
+    } else if (useRootCABundle) {
+        log_v("Attaching root CA cert bundle");
+        ret = esp_crt_bundle_attach(&ssl_client->ssl_conf);
+
+        if (ret < 0) {
+            return handle_error(ret);
+        }
+    } else if (pskIdent != NULL && psKey != NULL) {
+        log_v("Setting up PSK");
+        // convert PSK from hex to binary
+        if ((strlen(psKey) & 1) != 0 || strlen(psKey) > 2*MBEDTLS_PSK_MAX_LEN) {
+            log_e("pre-shared key not valid hex or too long");
+            return -1;
+        }
+        unsigned char psk[MBEDTLS_PSK_MAX_LEN];
+        size_t psk_len = strlen(psKey)/2;
+        for (int j=0; j<strlen(psKey); j+= 2) {
+            char c = psKey[j];
+            if (c >= '0' && c <= '9') c -= '0';
+            else if (c >= 'A' && c <= 'F') c -= 'A' - 10;
+            else if (c >= 'a' && c <= 'f') c -= 'a' - 10;
+            else return -1;
+            psk[j/2] = c<<4;
+            c = psKey[j+1];
+            if (c >= '0' && c <= '9') c -= '0';
+            else if (c >= 'A' && c <= 'F') c -= 'A' - 10;
+            else if (c >= 'a' && c <= 'f') c -= 'a' - 10;
+            else return -1;
+            psk[j/2] |= c;
+        }
+        // set mbedtls config
+        ret = mbedtls_ssl_conf_psk(&ssl_client->ssl_conf, psk, psk_len,
+                 (const unsigned char *)pskIdent, strlen(pskIdent));
+        if (ret != 0) {
+            log_e("mbedtls_ssl_conf_psk returned %d", ret);
+            return handle_error(ret);
+        }
+    } else {
+        return -1;
+    }
+
+    if (!insecure && cli_cert != NULL && cli_key != NULL) {
+        mbedtls_x509_crt_init(&ssl_client->client_cert);
+        mbedtls_pk_init(&ssl_client->client_key);
+
+        log_v("Loading CRT cert");
+
+        ret = mbedtls_x509_crt_parse(&ssl_client->client_cert, (const unsigned char *)cli_cert, strlen(cli_cert) + 1);
+        if (ret < 0) {
+        // free the client_cert in the case parse failed, otherwise, the old client_cert still in the heap memory, that lead to "out of memory" crash.
+        mbedtls_x509_crt_free(&ssl_client->client_cert);
+            return handle_error(ret);
+        }
+
+        log_v("Loading private key");
+        ret = mbedtls_pk_parse_key(&ssl_client->client_key, (const unsigned char *)cli_key, strlen(cli_key) + 1, NULL, 0);
+
+        if (ret != 0) {
+            mbedtls_x509_crt_free(&ssl_client->client_cert); // cert+key are free'd in pair
+            return handle_error(ret);
+        }
+
+        mbedtls_ssl_conf_own_cert(&ssl_client->ssl_conf, &ssl_client->client_cert, &ssl_client->client_key);
+    }
+
+    log_v("Setting hostname for TLS session...");
+
+    // Hostname set here should match CN in server certificate
+    if((ret = mbedtls_ssl_set_hostname(&ssl_client->ssl_ctx, host)) != 0){
+        return handle_error(ret);
+    }
+
+    mbedtls_ssl_conf_rng(&ssl_client->ssl_conf, mbedtls_ctr_drbg_random, &ssl_client->drbg_ctx);
+
+    if ((ret = mbedtls_ssl_setup(&ssl_client->ssl_ctx, &ssl_client->ssl_conf)) != 0) {
+        return handle_error(ret);
+    }
+
+    mbedtls_ssl_set_bio(&ssl_client->ssl_ctx, &ssl_client->socket, mbedtls_net_send, mbedtls_net_recv, NULL );
+
+    log_v("Performing the SSL/TLS handshake...");
+    unsigned long handshake_start_time=millis();
+    while ((ret = mbedtls_ssl_handshake(&ssl_client->ssl_ctx)) != 0) {
+        if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE) {
+            return handle_error(ret);
+        }
+        if((millis()-handshake_start_time)>ssl_client->handshake_timeout)
+            return -1;
+        vTaskDelay(2);//2 ticks
+    }
+
+
+    if (cli_cert != NULL && cli_key != NULL) {
+        log_d("Protocol is %s Ciphersuite is %s", mbedtls_ssl_get_version(&ssl_client->ssl_ctx), mbedtls_ssl_get_ciphersuite(&ssl_client->ssl_ctx));
+        if ((ret = mbedtls_ssl_get_record_expansion(&ssl_client->ssl_ctx)) >= 0) {
+            log_d("Record expansion is %d", ret);
+        } else {
+            log_w("Record expansion is unknown (compression)");
+        }
+    }
+
+    log_v("Verifying peer X.509 certificate...");
+
+    if ((flags = mbedtls_ssl_get_verify_result(&ssl_client->ssl_ctx)) != 0) {
+        memset(buf, 0, sizeof(buf));
+        mbedtls_x509_crt_verify_info(buf, sizeof(buf), "  ! ", flags);
+        log_e("Failed to verify peer certificate! verification info: %s", buf);
+        return handle_error(ret);
+    } else {
+        log_v("Certificate verified.");
+    }
+    
+    if (rootCABuff != NULL) {
+        mbedtls_x509_crt_free(&ssl_client->ca_cert);
+    }
+
+    if (cli_cert != NULL) {
+        mbedtls_x509_crt_free(&ssl_client->client_cert);
+    }
+
+    if (cli_key != NULL) {
+        mbedtls_pk_free(&ssl_client->client_key);
+    }    
+
+    log_v("Free internal heap after TLS %u", ESP.getFreeHeap());
+
+    return ssl_client->socket;
+}
+
+
+void stop_ssl_socket(sslclient_context *ssl_client, const char *rootCABuff, const char *cli_cert, const char *cli_key)
+{
+    log_v("Cleaning SSL connection.");
+
+    if (ssl_client->socket >= 0) {
+        lwip_close(ssl_client->socket);
+        ssl_client->socket = -1;
+    }
+
+    // avoid memory leak if ssl connection attempt failed
+    if (ssl_client->ssl_conf.ca_chain != NULL) {
+        mbedtls_x509_crt_free(&ssl_client->ca_cert);
+    }
+    if (ssl_client->ssl_conf.key_cert != NULL) {
+        mbedtls_x509_crt_free(&ssl_client->client_cert);
+        mbedtls_pk_free(&ssl_client->client_key);
+    }
+    mbedtls_ssl_free(&ssl_client->ssl_ctx);
+    mbedtls_ssl_config_free(&ssl_client->ssl_conf);
+    mbedtls_ctr_drbg_free(&ssl_client->drbg_ctx);
+    mbedtls_entropy_free(&ssl_client->entropy_ctx);
+    
+    // save only interesting field
+    int timeout = ssl_client->handshake_timeout;
+    // reset embedded pointers to zero
+    memset(ssl_client, 0, sizeof(sslclient_context));
+    
+    ssl_client->handshake_timeout = timeout;
+}
+
+
+int data_to_read(sslclient_context *ssl_client)
+{
+    int ret, res;
+    ret = mbedtls_ssl_read(&ssl_client->ssl_ctx, NULL, 0);
+    //log_e("RET: %i",ret);   //for low level debug
+    res = mbedtls_ssl_get_bytes_avail(&ssl_client->ssl_ctx);
+    //log_e("RES: %i",res);    //for low level debug
+    if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE && ret < 0) {
+        return handle_error(ret);
+    }
+
+    return res;
+}
+
+int send_ssl_data(sslclient_context *ssl_client, const uint8_t *data, size_t len)
+{
+    log_v("Writing HTTP request with %d bytes...", len); //for low level debug
+    int ret = -1;
+
+    while ((ret = mbedtls_ssl_write(&ssl_client->ssl_ctx, data, len)) <= 0) {
+        if (ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE && ret < 0) {
+            log_v("Handling error %d", ret); //for low level debug
+            return handle_error(ret);
+        }
+        //wait for space to become available
+        vTaskDelay(2);
+    }
+
+    return ret;
+}
+
+int get_ssl_receive(sslclient_context *ssl_client, uint8_t *data, int length)
+{
+    //log_d( "Reading HTTP response...");   //for low level debug
+    int ret = -1;
+
+    ret = mbedtls_ssl_read(&ssl_client->ssl_ctx, data, length);
+
+    //log_v( "%d bytes read", ret);   //for low level debug
+    return ret;
+}
+
+static bool parseHexNibble(char pb, uint8_t* res)
+{
+    if (pb >= '0' && pb <= '9') {
+        *res = (uint8_t) (pb - '0'); return true;
+    } else if (pb >= 'a' && pb <= 'f') {
+        *res = (uint8_t) (pb - 'a' + 10); return true;
+    } else if (pb >= 'A' && pb <= 'F') {
+        *res = (uint8_t) (pb - 'A' + 10); return true;
+    }
+    return false;
+}
+
+// Compare a name from certificate and domain name, return true if they match
+static bool matchName(const std::string& name, const std::string& domainName)
+{
+    size_t wildcardPos = name.find('*');
+    if (wildcardPos == std::string::npos) {
+        // Not a wildcard, expect an exact match
+        return name == domainName;
+    }
+
+    size_t firstDotPos = name.find('.');
+    if (wildcardPos > firstDotPos) {
+        // Wildcard is not part of leftmost component of domain name
+        // Do not attempt to match (rfc6125 6.4.3.1)
+        return false;
+    }
+    if (wildcardPos != 0 || firstDotPos != 1) {
+        // Matching of wildcards such as baz*.example.com and b*z.example.com
+        // is optional. Maybe implement this in the future?
+        return false;
+    }
+    size_t domainNameFirstDotPos = domainName.find('.');
+    if (domainNameFirstDotPos == std::string::npos) {
+        return false;
+    }
+    return domainName.substr(domainNameFirstDotPos) == name.substr(firstDotPos);
+}
+
+// Verifies certificate provided by the peer to match specified SHA256 fingerprint
+bool verify_ssl_fingerprint(sslclient_context *ssl_client, const char* fp, const char* domain_name)
+{
+    // Convert hex string to byte array
+    uint8_t fingerprint_local[32];
+    int len = strlen(fp);
+    int pos = 0;
+    for (size_t i = 0; i < sizeof(fingerprint_local); ++i) {
+        while (pos < len && ((fp[pos] == ' ') || (fp[pos] == ':'))) {
+            ++pos;
+        }
+        if (pos > len - 2) {
+            log_d("pos:%d len:%d fingerprint too short", pos, len);
+            return false;
+        }
+        uint8_t high, low;
+        if (!parseHexNibble(fp[pos], &high) || !parseHexNibble(fp[pos+1], &low)) {
+            log_d("pos:%d len:%d invalid hex sequence: %c%c", pos, len, fp[pos], fp[pos+1]);
+            return false;
+        }
+        pos += 2;
+        fingerprint_local[i] = low | (high << 4);
+    }
+
+    // Calculate certificate's SHA256 fingerprint
+    uint8_t fingerprint_remote[32];
+    if(!get_peer_fingerprint(ssl_client, fingerprint_remote)) 
+        return false;
+
+    // Check if fingerprints match
+    if (memcmp(fingerprint_local, fingerprint_remote, 32))
+    {
+        log_d("fingerprint doesn't match");
+        return false;
+    }
+
+    // Additionally check if certificate has domain name if provided
+    if (domain_name)
+        return verify_ssl_dn(ssl_client, domain_name);
+    else
+        return true;
+}
+
+bool get_peer_fingerprint(sslclient_context *ssl_client, uint8_t sha256[32]) 
+{
+    if (!ssl_client) {
+        log_d("Invalid ssl_client pointer");
+        return false;
+    };
+
+    const mbedtls_x509_crt* crt = mbedtls_ssl_get_peer_cert(&ssl_client->ssl_ctx);
+    if (!crt) {
+        log_d("Failed to get peer cert.");
+        return false;
+    };
+
+    mbedtls_sha256_context sha256_ctx;
+    mbedtls_sha256_init(&sha256_ctx);
+    mbedtls_sha256_starts(&sha256_ctx, false);
+    mbedtls_sha256_update(&sha256_ctx, crt->raw.p, crt->raw.len);
+    mbedtls_sha256_finish(&sha256_ctx, sha256);
+
+    return true;
+}
+
+// Checks if peer certificate has specified domain in CN or SANs
+bool verify_ssl_dn(sslclient_context *ssl_client, const char* domain_name)
+{
+    log_d("domain name: '%s'", (domain_name)?domain_name:"(null)");
+    std::string domain_name_str(domain_name);
+    std::transform(domain_name_str.begin(), domain_name_str.end(), domain_name_str.begin(), ::tolower);
+
+    // Get certificate provided by the peer
+    const mbedtls_x509_crt* crt = mbedtls_ssl_get_peer_cert(&ssl_client->ssl_ctx);
+
+    // Check for domain name in SANs
+    const mbedtls_x509_sequence* san = &crt->subject_alt_names;
+    while (san != nullptr)
+    {
+        std::string san_str((const char*)san->buf.p, san->buf.len);
+        std::transform(san_str.begin(), san_str.end(), san_str.begin(), ::tolower);
+
+        if (matchName(san_str, domain_name_str))
+            return true;
+
+        log_d("SAN '%s': no match", san_str.c_str());
+
+        // Fetch next SAN
+        san = san->next;
+    }
+
+    // Check for domain name in CN
+    const mbedtls_asn1_named_data* common_name = &crt->subject;
+    while (common_name != nullptr)
+    {
+        // While iterating through DN objects, check for CN object
+        if (!MBEDTLS_OID_CMP(MBEDTLS_OID_AT_CN, &common_name->oid))
+        {
+            std::string common_name_str((const char*)common_name->val.p, common_name->val.len);
+
+            if (matchName(common_name_str, domain_name_str))
+                return true;
+
+            log_d("CN '%s': not match", common_name_str.c_str());
+        }
+
+        // Fetch next DN object
+        common_name = common_name->next;
+    }
+
+    return false;
+}
+#endif
+

libraries/WiFiClientSecure/src/ssl_client.h

@@ -0,0 +1,40 @@
+/* Provide SSL/TLS functions to ESP32 with Arduino IDE
+ * by Evandro Copercini - 2017 - Apache 2.0 License
+ */
+
+#ifndef ARD_SSL_H
+#define ARD_SSL_H
+#include "mbedtls/platform.h"
+#include "mbedtls/net.h"
+#include "mbedtls/debug.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/error.h"
+
+typedef struct sslclient_context {
+    int socket;
+    mbedtls_ssl_context ssl_ctx;
+    mbedtls_ssl_config ssl_conf;
+
+    mbedtls_ctr_drbg_context drbg_ctx;
+    mbedtls_entropy_context entropy_ctx;
+
+    mbedtls_x509_crt ca_cert;
+    mbedtls_x509_crt client_cert;
+    mbedtls_pk_context client_key;
+
+    unsigned long handshake_timeout;
+} sslclient_context;
+
+
+void ssl_init(sslclient_context *ssl_client);
+int start_ssl_client(sslclient_context *ssl_client, const char *host, uint32_t port, int timeout, const char *rootCABuff, bool useRootCABundle, const char *cli_cert, const char *cli_key, const char *pskIdent, const char *psKey, bool insecure, const char **alpn_protos);
+void stop_ssl_socket(sslclient_context *ssl_client, const char *rootCABuff, const char *cli_cert, const char *cli_key);
+int data_to_read(sslclient_context *ssl_client);
+int send_ssl_data(sslclient_context *ssl_client, const uint8_t *data, size_t len);
+int get_ssl_receive(sslclient_context *ssl_client, uint8_t *data, int length);
+bool verify_ssl_fingerprint(sslclient_context *ssl_client, const char* fp, const char* domain_name);
+bool verify_ssl_dn(sslclient_context *ssl_client, const char* domain_name);
+bool get_peer_fingerprint(sslclient_context *ssl_client, uint8_t sha256[32]);
+#endif