ESP32-Mesh-OTA/main/https_mbedtls_example_main.c

#include <string.h>
#include <stdlib.h>
#include "freertos/FreeRTOS.h"
#include "freertos/task.h"
#include "esp_wifi.h"
#include "esp_event.h"
#include "esp_log.h"
#include "esp_system.h"
#include "nvs_flash.h"
#include "protocol_examples_common.h"
#include "esp_netif.h"

#include "lwip/err.h"
#include "lwip/sockets.h"
#include "lwip/sys.h"
#include "lwip/netdb.h"
#include "lwip/dns.h"

#include "mbedtls/platform.h"
#include "mbedtls/net_sockets.h"
#include "mbedtls/esp_debug.h"
#include "mbedtls/ssl.h"
#include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h"
#include "mbedtls/error.h"
#include "mbedtls/certs.h"
#include "esp_crt_bundle.h"


/* Constants that aren't configurable in menuconfig, yet */
#define HTTPS_CLIENT_COMMON_NAME "ota.hendrikschutter.com"
#define HTTPS_CLIENT_PORT "443"
#define HTTPS_CLIENT_URL "https://ota.hendrikschutter.com/hex.txt"
#define HTTPS_CLIENT_AUTH "b3RhOnB3"  //base64("username:password")

#define HTTPS_CLIENT_OK 0
#define HTTPS_CLIENT_ERROR -1
#define HTTPS_CLIENT_ERROR_INIT_EMBEDTLS -2
#define HTTPS_CLIENT_ERROR_INIT_CONNECT_TWO_SERVER -3
#define HTTPS_CLIENT_ERROR_INIT_VALIDATE_SERVER -4
#define HTTPS_CLIENT_ERROR_INIT_SEND_REQUEST -5

struct HTTPS_Client
{
    mbedtls_entropy_context entropy;
    mbedtls_ctr_drbg_context ctr_drbg;
    mbedtls_ssl_context ssl;
    mbedtls_x509_crt cacert;
    mbedtls_ssl_config conf;
    mbedtls_net_context server_fd;
};

typedef int32_t https_client_ret_t;
typedef struct HTTPS_Client HTTPS_Client_t;

static const char *TAG = "https_client";

static const char *REQUEST = "GET " HTTPS_CLIENT_URL " HTTP/1.1\r\n"
                             "Host: "HTTPS_CLIENT_COMMON_NAME"\r\n"
                             "User-Agent: esp-idf/1.0 esp32\r\n"
                             "Authorization: Basic " HTTPS_CLIENT_AUTH "\r\n"
                             "\r\n";

static HTTPS_Client_t sHTTPS_ClientConfig;

https_client_ret_t https_clientInitialize();
https_client_ret_t https_clientRetrieveData();
https_client_ret_t https_clientDeinitialize();

https_client_ret_t https_clientInitEmbedTLS();
https_client_ret_t https_clientConnectToServer();
https_client_ret_t https_clientValidateServer();
https_client_ret_t https_clientSendRequest();

https_client_ret_t https_clientInitialize()
{
    https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;

    i32RetHTTPClient = https_clientInitEmbedTLS();

    /*
        if(i32RetHTTPClient == HTTPS_CLIENT_OK)
        {
            i32RetHTTPClient = https_clientConnectToServer();
        }

        if(i32RetHTTPClient == HTTPS_CLIENT_OK)
        {
            i32RetHTTPClient = https_clientValidateServer();
        }

        if(i32RetHTTPClient == HTTPS_CLIENT_OK)
        {
            i32RetHTTPClient = https_clientSendRequest();
        }
        */
    switch (i32RetHTTPClient)
    {
    case HTTPS_CLIENT_ERROR_INIT_EMBEDTLS:
        ESP_LOGE(TAG, "Unable to initialize EmbedTLS");
        i32RetHTTPClient = HTTPS_CLIENT_ERROR;
        break;
    case HTTPS_CLIENT_ERROR_INIT_CONNECT_TWO_SERVER:
        ESP_LOGE(TAG, "Unable to connect to server");
        i32RetHTTPClient = HTTPS_CLIENT_ERROR;
        break;
    case HTTPS_CLIENT_ERROR_INIT_VALIDATE_SERVER:
        ESP_LOGE(TAG, "Unable to validate the server");
        i32RetHTTPClient = HTTPS_CLIENT_ERROR;
        break;
    case HTTPS_CLIENT_ERROR_INIT_SEND_REQUEST:
        ESP_LOGE(TAG, "Unable to send request to server");
        i32RetHTTPClient = HTTPS_CLIENT_ERROR;
        break;
    case HTTPS_CLIENT_OK:
        ESP_LOGI(TAG, "HTTPS Client successfully initialized");
        i32RetHTTPClient = HTTPS_CLIENT_OK;
        break;
    default:
        i32RetHTTPClient = HTTPS_CLIENT_ERROR;
        ESP_LOGE(TAG, "Unknown error while init");
        break;
    }

    return i32RetHTTPClient;
}

https_client_ret_t https_clientRetrieveData(unsigned char* pu8Data, uint32_t* pu32DataLenght, uint32_t* pu32BytesRead)
{
    https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;
    int32_t i32RetRetrieveData = ESP_OK;
    bzero(pu8Data, *pu32DataLenght);
    bool bRetriveData = true;
    *pu32BytesRead = 0U;

    while (bRetriveData)
    {
        //Reading HTTP response
        mbedtls_ssl_conf_read_timeout(&sHTTPS_ClientConfig.conf, 1000); //mbedtls_ssl_config * 	conf,
        i32RetRetrieveData = mbedtls_ssl_read(&sHTTPS_ClientConfig.ssl, (unsigned char *)(pu8Data+(*pu32BytesRead)), ((*pu32DataLenght)-(*pu32BytesRead))  );

        if(i32RetRetrieveData > 0)
        {
            //Data received
            *pu32BytesRead = *pu32BytesRead + i32RetRetrieveData;

            if(*pu32DataLenght > 0)
            {
                //buffer not full yet --> read some more
                bRetriveData = true;
            }
            else
            {
                //buffer full --> stop reading
                bRetriveData = false;
            }
        }

        if(i32RetRetrieveData == 0)
        {
            //all data read --> stop reading
            bRetriveData = false;
        }

        if(i32RetRetrieveData == MBEDTLS_ERR_SSL_TIMEOUT ) {
            printf("timeout\n");
            bRetriveData = false;
        }



        if(i32RetRetrieveData == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY)
        {
            //connection is going to be closed
            i32RetHTTPClient = HTTPS_CLIENT_ERROR;
            bRetriveData = false;
        }
    }
    return i32RetHTTPClient;
}

https_client_ret_t https_clientDeinitialize()
{
    https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;

    i32RetHTTPClient = mbedtls_ssl_close_notify(&sHTTPS_ClientConfig.ssl);

    if(i32RetHTTPClient != ESP_OK)
    {
        ESP_LOGE(TAG, "mbedtls_ssl_close_notify returned 0x%x", i32RetHTTPClient);
    }

    mbedtls_ssl_session_reset(&sHTTPS_ClientConfig.ssl);
    mbedtls_net_free(&sHTTPS_ClientConfig.server_fd);

    return i32RetHTTPClient;
}

https_client_ret_t https_clientInitEmbedTLS() {

    https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;
    int32_t i32RetEmbedTLS = ESP_OK;

    mbedtls_ssl_init(&sHTTPS_ClientConfig.ssl);
    mbedtls_x509_crt_init(&sHTTPS_ClientConfig.cacert);
    mbedtls_ctr_drbg_init(&sHTTPS_ClientConfig.ctr_drbg);
    mbedtls_ssl_config_init(&sHTTPS_ClientConfig.conf);
    mbedtls_entropy_init(&sHTTPS_ClientConfig.entropy);

    i32RetEmbedTLS = mbedtls_ctr_drbg_seed(&sHTTPS_ClientConfig.ctr_drbg, mbedtls_entropy_func, &sHTTPS_ClientConfig.entropy, NULL, 0);

    if(i32RetEmbedTLS!= ESP_OK)
    {
        ESP_LOGE(TAG, "mbedtls_ctr_drbg_seed returned %d", i32RetEmbedTLS);
    }

    if(i32RetEmbedTLS == ESP_OK)
    {
        //Attaching the certificate bundle
        i32RetEmbedTLS = esp_crt_bundle_attach(&sHTTPS_ClientConfig.conf);
        if(i32RetEmbedTLS != ESP_OK)
        {
            ESP_LOGE(TAG, "esp_crt_bundle_attach returned 0x%x\n\n", i32RetEmbedTLS);
        }
    }

    if(i32RetEmbedTLS == ESP_OK)
    {
        //Setting hostname for TLS session.
        i32RetEmbedTLS = mbedtls_ssl_set_hostname(&sHTTPS_ClientConfig.ssl, HTTPS_CLIENT_COMMON_NAME);
        // Hostname set here should match CN in server certificate
        if(i32RetEmbedTLS != ESP_OK)
        {
            ESP_LOGE(TAG, "mbedtls_ssl_set_hostname returned 0x%x", i32RetEmbedTLS);
        }
    }
    if(i32RetEmbedTLS == ESP_OK)
    {
        //Setting up the SSL/TLS structure
        i32RetEmbedTLS = mbedtls_ssl_config_defaults(&sHTTPS_ClientConfig.conf,
                         MBEDTLS_SSL_IS_CLIENT,
                         MBEDTLS_SSL_TRANSPORT_STREAM,
                         MBEDTLS_SSL_PRESET_DEFAULT);

        if(i32RetEmbedTLS != ESP_OK)
        {
            ESP_LOGE(TAG, "mbedtls_ssl_config_defaults returned %d", i32RetEmbedTLS);
        }
    }

    if(i32RetEmbedTLS == ESP_OK)
    {
        mbedtls_ssl_conf_authmode(&sHTTPS_ClientConfig.conf, MBEDTLS_SSL_VERIFY_REQUIRED);
        mbedtls_ssl_conf_ca_chain(&sHTTPS_ClientConfig.conf, &sHTTPS_ClientConfig.cacert, NULL);
        mbedtls_ssl_conf_rng(&sHTTPS_ClientConfig.conf, mbedtls_ctr_drbg_random, &sHTTPS_ClientConfig.ctr_drbg);

        i32RetEmbedTLS = mbedtls_ssl_setup(&sHTTPS_ClientConfig.ssl, &sHTTPS_ClientConfig.conf);
        if(i32RetEmbedTLS != ESP_OK)
        {
            ESP_LOGE(TAG, "mbedtls_ssl_setup returned -0x%x\n\n", i32RetEmbedTLS);
        }
    }

    if(i32RetEmbedTLS == ESP_OK)
    {
        mbedtls_net_init(&sHTTPS_ClientConfig.server_fd);
    }

    if (i32RetEmbedTLS != ESP_OK)
    {
        i32RetHTTPClient = HTTPS_CLIENT_ERROR_INIT_EMBEDTLS;
    }

    return i32RetHTTPClient;
}

https_client_ret_t https_clientConnectToServer()
{
    https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;
    int32_t i32RetServerConnect = ESP_OK;

    //Connecting to server
    i32RetServerConnect = mbedtls_net_connect(&sHTTPS_ClientConfig.server_fd, HTTPS_CLIENT_COMMON_NAME, HTTPS_CLIENT_PORT, MBEDTLS_NET_PROTO_TCP);
    if (i32RetServerConnect != ESP_OK)
    {
        ESP_LOGE(TAG, "mbedtls_net_connect returned %x", i32RetServerConnect);
    }

    if(i32RetServerConnect == ESP_OK)
    {
        mbedtls_ssl_set_bio(&sHTTPS_ClientConfig.ssl, &sHTTPS_ClientConfig.server_fd, mbedtls_net_send, mbedtls_net_recv, mbedtls_net_recv_timeout);

        //Performing the SSL/TLS handshake
        while ((i32RetServerConnect = mbedtls_ssl_handshake(&sHTTPS_ClientConfig.ssl)) != 0)
        {
            if ((i32RetServerConnect != MBEDTLS_ERR_SSL_WANT_READ) && (i32RetServerConnect != MBEDTLS_ERR_SSL_WANT_WRITE))
            {
                ESP_LOGE(TAG, "mbedtls_ssl_handshake returned 0x%x", i32RetServerConnect);
            }
        }
    }

    if(i32RetServerConnect != ESP_OK)
    {
        i32RetHTTPClient = HTTPS_CLIENT_ERROR_INIT_CONNECT_TWO_SERVER;
    }
    return i32RetHTTPClient;
}

https_client_ret_t https_clientValidateServer()
{
    https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;
    int32_t i32RetValidateServer = ESP_OK;

    //Verifying peer X.509 certificate
    if ((i32RetValidateServer = mbedtls_ssl_get_verify_result(&sHTTPS_ClientConfig.ssl)) != 0)
    {
        ESP_LOGE(TAG, "Failed to verify peer certificate!");
    }

    if(i32RetValidateServer != ESP_OK)
    {
        i32RetHTTPClient = HTTPS_CLIENT_ERROR_INIT_VALIDATE_SERVER;
    }
    return i32RetHTTPClient;
}

https_client_ret_t https_clientSendRequest()
{
    https_client_ret_t i32RetHTTPClient = HTTPS_CLIENT_OK;
    int32_t i32RetSendRequest = ESP_OK;
    uint32_t u32WrittenBytes = 0;
    bool bWrite = true;

    //Writing HTTP request
    while((u32WrittenBytes < strlen(REQUEST)) && bWrite)
    {
        i32RetSendRequest = mbedtls_ssl_write(&sHTTPS_ClientConfig.ssl,
                                              (const unsigned char *)REQUEST + u32WrittenBytes,
                                              strlen(REQUEST) - u32WrittenBytes);
        if (i32RetSendRequest >= 0)
        {
            //bytes written
            u32WrittenBytes += i32RetSendRequest;
        } else if (i32RetSendRequest != MBEDTLS_ERR_SSL_WANT_WRITE && i32RetSendRequest != MBEDTLS_ERR_SSL_WANT_READ) {
            ESP_LOGE(TAG, "mbedtls_ssl_write returned 0x%x", i32RetSendRequest);
            bWrite = false;
        }
    }

    if(bWrite == false)
    {
        i32RetHTTPClient = HTTPS_CLIENT_ERROR_INIT_SEND_REQUEST;
    }
    return i32RetHTTPClient;
}



static void https_get_task(void *pvParameters)
{

    uint32_t u32BufferLenght = 1024U;
    unsigned char buffer[1024U];
    uint32_t u32BytesRead = 0;
    uint32_t u32readCount = 0U;

    uint32_t loops = 0;

    https_clientInitialize();

    while(1)
    {
        u32BytesRead = 0;
        u32readCount = 0U;

        printf("\n START:%i \n", loops);

        https_clientConnectToServer();
        https_clientValidateServer();
        https_clientSendRequest();

        do {

            https_clientRetrieveData(buffer, &u32BufferLenght, &u32BytesRead);
            printf("read: %i\n", u32BytesRead);
            u32readCount++;
        } while(u32BytesRead > 0);
        printf("\n END:%i - %i\n", loops, u32readCount);

        https_clientDeinitialize();

        vTaskDelay( 500/portTICK_PERIOD_MS);

        loops++;
    }

    while(1)
    {
        vTaskDelay( 500/portTICK_PERIOD_MS);
    }

}

void app_main(void)
{
    ESP_ERROR_CHECK( nvs_flash_init() );
    ESP_ERROR_CHECK(esp_netif_init());
    ESP_ERROR_CHECK(esp_event_loop_create_default());

    /* This helper function configures Wi-Fi or Ethernet, as selected in menuconfig.
     * Read "Establishing Wi-Fi or Ethernet Connection" section in
     * examples/protocols/README.md for more information about this function.
     */
    ESP_ERROR_CHECK(example_connect());

    xTaskCreate(&https_get_task, "https_get_task", 8192, NULL, 5, NULL);
}