{"action":"created","comment":{"url":"https://api.github.com/repos/esp8266/Arduino/pulls/comments/176555264","pull_request_review_id":106280910,"id":176555264,"diff_hunk":"@@ -0,0 +1,1203 @@\n+/*\n+  WiFiClientBearSSL- SSL client/server for esp8266 using BearSSL libraries\n+  - Mostly compatible with Arduino WiFi shield library and standard\n+    WiFiClient/ServerSecure (except for certificate handling).\n+\n+  Copyright (c) 2018 Earle F. Philhower, III\n+\n+  This library is free software; you can redistribute it and/or\n+  modify it under the terms of the GNU Lesser General Public\n+  License as published by the Free Software Foundation; either\n+  version 2.1 of the License, or (at your option) any later version.\n+\n+  This library is distributed in the hope that it will be useful,\n+  but WITHOUT ANY WARRANTY; without even the implied warranty of\n+  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU\n+  Lesser General Public License for more details.\n+\n+  You should have received a copy of the GNU Lesser General Public\n+  License along with this library; if not, write to the Free Software\n+  Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA\n+*/\n+\n+#define LWIP_INTERNAL\n+\n+extern \"C\"\n+{\n+#include \"osapi.h\"\n+#include \"ets_sys.h\"\n+}\n+#include <list>\n+#include <errno.h>\n+#include \"debug.h\"\n+#include \"ESP8266WiFi.h\"\n+#include \"WiFiClient.h\"\n+#include \"WiFiClientBearSSL.h\"\n+#include \"lwip/opt.h\"\n+#include \"lwip/ip.h\"\n+#include \"lwip/tcp.h\"\n+#include \"lwip/inet.h\"\n+#include \"lwip/netif.h\"\n+#include \"include/ClientContext.h\"\n+#include \"c_types.h\"\n+\n+// BearSSL needs a very large stack, larger than the entire ESP8266 Arduino\n+// default one.  This shared_pointer is allocated on first use and cleared\n+// on last cleanup, with only one stack no matter how many SSL objects.\n+std::shared_ptr<uint8_t> WiFiClientBearSSL::_bearssl_stack = nullptr;\n+\n+\n+\n+void WiFiClientBearSSL::_clear()\n+{\n+  // TLS handshake may take more than the 5 second default timeout\n+  _timeout = 15000;\n+\n+  _sc = nullptr;\n+  _sc_svr = nullptr;\n+  _eng = nullptr;\n+  _x509_minimal = nullptr;\n+  _x509_insecure = nullptr;\n+  _x509_knownkey = nullptr;\n+  _iobuf_in = nullptr;\n+  _iobuf_out = nullptr;\n+  _now = 0; // You can override or ensure time() is correct w/configTime\n+  _ta = nullptr;\n+  setBufferSizes(16384, 512); // Minimum safe\n+  _handshake_done = false;\n+  _recvapp_buf = nullptr;\n+  _recvapp_len = 0;\n+  _oom_err = false;\n+}\n+\n+void WiFiClientBearSSL::_clearAuthenticationSettings()\n+{\n+  _use_insecure = false;\n+  _use_fingerprint = false;\n+  _use_self_signed = false;\n+  _knownkey = nullptr;\n+  _sk = nullptr;\n+}\n+\n+\n+WiFiClientBearSSL::WiFiClientBearSSL() : WiFiClient()\n+{\n+  _clear();\n+  _clearAuthenticationSettings();\n+  _certStore = nullptr; // Don't want to remove cert store on a clear, should be long lived\n+  if (!_bearssl_stack) {\n+#if 1\n+    const int stacksize = 4500; // Empirically determined stack for EC and RSA connections\n+    _bearssl_stack = std::shared_ptr<uint8_t>(new uint8_t[stacksize], std::default_delete<uint8_t[]>());\n+    br_esp8266_stack_proxy_init(_bearssl_stack.get(), stacksize);\n+#else\n+    // TODO - DANGEROUS - EVIL","path":"libraries/ESP8266WiFi/src/WiFiClientBearSSL.cpp","position":94,"original_position":94,"commit_id":"5c5cd66d85d51f5002bcee0d248c7e8e8c271efe","original_commit_id":"5c5cd66d85d51f5002bcee0d248c7e8e8c271efe","user":{"login":"earlephilhower","id":11875,"avatar_url":"https://avatars0.githubusercontent.com/u/11875?v=4","gravatar_id":"","url":"https://api.github.com/users/earlephilhower","html_url":"https://github.com/earlephilhower","followers_url":"https://api.github.com/users/earlephilhower/followers","following_url":"https://api.github.com/users/earlephilhower/following{/other_user}","gists_url":"https://api.github.com/users/earlephilhower/gists{/gist_id}","starred_url":"https://api.github.com/users/earlephilhower/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/earlephilhower/subscriptions","organizations_url":"https://api.github.com/users/earlephilhower/orgs","repos_url":"https://api.github.com/users/earlephilhower/repos","events_url":"https://api.github.com/users/earlephilhower/events{/privacy}","received_events_url":"https://api.github.com/users/earlephilhower/received_events","type":"User","site_admin":false},"body":"I was actually thinking of doing some magic with the SP itself and removing the STACK_PROXY magic in bearssl libs.  With careful thinking back and forth (and wrapping the optimistic_yield() call in thunks as well) I think it could work.  But it's an optimization I didn't have bandwidth to try out. and it would confuse the stack dumper to no end on crashes.","created_at":"2018-03-22T20:03:12Z","updated_at":"2018-03-22T20:03:12Z","html_url":"https://github.com/esp8266/Arduino/pull/4273#discussion_r176555264","pull_request_url":"https://api.github.com/repos/esp8266/Arduino/pulls/4273","author_association":"COLLABORATOR","_links":{"self":{"href":"https://api.github.com/repos/esp8266/Arduino/pulls/comments/176555264"},"html":{"href":"https://github.com/esp8266/Arduino/pull/4273#discussion_r176555264"},"pull_request":{"href":"https://api.github.com/repos/esp8266/Arduino/pulls/4273"}},"in_reply_to_id":176313631},"pull_request":{"url":"https://api.github.com/repos/esp8266/Arduino/pulls/4273","id":166712618,"html_url":"https://github.com/esp8266/Arduino/pull/4273","diff_url":"https://github.com/esp8266/Arduino/pull/4273.diff","patch_url":"https://github.com/esp8266/Arduino/pull/4273.patch","issue_url":"https://api.github.com/repos/esp8266/Arduino/issues/4273","number":4273,"state":"open","locked":false,"title":"Add BearSSL client and server, support true bidir, lower memory, modern SSL","user":{"login":"earlephilhower","id":11875,"avatar_url":"https://avatars0.githubusercontent.com/u/11875?v=4","gravatar_id":"","url":"https://api.github.com/users/earlephilhower","html_url":"https://github.com/earlephilhower","followers_url":"https://api.github.com/users/earlephilhower/followers","following_url":"https://api.github.com/users/earlephilhower/following{/other_user}","gists_url":"https://api.github.com/users/earlephilhower/gists{/gist_id}","starred_url":"https://api.github.com/users/earlephilhower/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/earlephilhower/subscriptions","organizations_url":"https://api.github.com/users/earlephilhower/orgs","repos_url":"https://api.github.com/users/earlephilhower/repos","events_url":"https://api.github.com/users/earlephilhower/events{/privacy}","received_events_url":"https://api.github.com/users/earlephilhower/received_events","type":"User","site_admin":false},"body":"-edit- No longer WIP, seems stable enough for review and testing use outside my own lab -edit-\r\n\r\nAs discussed in #3490, axTLS has some issues with not checking for OOM, is unidirectional (i.e. some hacks required to support bidir MQTT protocol/etc.), and uses lots of memory.\r\n\r\nThis patch takes BearSSL, ports it to the ESP8266, and creates two new classes to replace the WiFiServerSecure and WiFiClientSecure classes.  BearSSL memory requirements are much lower than axTLS when doing bidirectional (only ~24KB for a client, ~5.5KB for a server) connections since the receive and transmit buffer sizes are independently configurable, allowing for both a bidir SSL client and bidir SSL server to be run at the same time with memory to spare for your own application.  It also does not do any memory allocations at operation time, so you're not likely to get as many random crashes as axTLS when tight on memory.  Finally, BearSSL supports a much wider variety of modern ciphers (and does not do the completely broken RC4, for example) and certificate types.\r\n\r\nBearSSL is MIT licensed by the author.\r\n\r\nWhile the patch here does work and can be used as both a SSL server and Client, it's still a WIP as I expect the API to change and grow, as well as more advanced testing by real users.\r\n\r\nThe Server/Client interface is the same as the existing classes, but the SSL-specific bits are different.  This applies to the way certificates are validated (they are ALWAYS checked against a trust anchor/hardcoded cert *you* supply), and how SSL parameters are set amongst other things, so it's not as simple as just replacing WiFiClientSecure w/WiFiClientBearSSL.\r\n\r\nThe new classes are called (for now) WiFiClientBearSSL/WiFiServerBearSSL.\r\n\r\nSee the new example bearssl/bearssl.ino for a quick example.  See https://bearssl.org for more BearSSL info as well as the tools to generate your own trust anchor structures for your own apps.\r\n\r\nI'm including a precompiled bearssl.a library for now, but the changes to the original sources are quite trivial and will be put up at least in my own repo if not integrated w/the main BearSSL code if they're acceptable to the author.\r\n\r\nhttps://github.com/earlephilhower/bearssl-esp8266 is the port sources.\r\n\r\nThanks very much to the BearSSL author @pornin for his assistance in the original issue.","created_at":"2018-02-02T03:53:31Z","updated_at":"2018-03-22T20:03:12Z","closed_at":null,"merged_at":null,"merge_commit_sha":"998d84c7b1b661362d10276065104e4cba8d5cf5","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/esp8266/Arduino/pulls/4273/commits","review_comments_url":"https://api.github.com/repos/esp8266/Arduino/pulls/4273/comments","review_comment_url":"https://api.github.com/repos/esp8266/Arduino/pulls/comments{/number}","comments_url":"https://api.github.com/repos/esp8266/Arduino/issues/4273/comments","statuses_url":"https://api.github.com/repos/esp8266/Arduino/statuses/5c5cd66d85d51f5002bcee0d248c7e8e8c271efe","head":{"label":"earlephilhower:bearssl_wip","ref":"bearssl_wip","sha":"5c5cd66d85d51f5002bcee0d248c7e8e8c271efe","user":{"login":"earlephilhower","id":11875,"avatar_url":"https://avatars0.githubusercontent.com/u/11875?v=4","gravatar_id":"","url":"https://api.github.com/users/earlephilhower","html_url":"https://github.com/earlephilhower","followers_url":"https://api.github.com/users/earlephilhower/followers","following_url":"https://api.github.com/users/earlephilhower/following{/other_user}","gists_url":"https://api.github.com/users/earlephilhower/gists{/gist_id}","starred_url":"https://api.github.com/users/earlephilhower/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/earlephilhower/subscriptions","organizations_url":"https://api.github.com/users/earlephilhower/orgs","repos_url":"https://api.github.com/users/earlephilhower/repos","events_url":"https://api.github.com/users/earlephilhower/events{/privacy}","received_events_url":"https://api.github.com/users/earlephilhower/received_events","type":"User","site_admin":false},"repo":{"id":83385402,"name":"Arduino","full_name":"earlephilhower/Arduino","owner":{"login":"earlephilhower","id":11875,"avatar_url":"https://avatars0.githubusercontent.com/u/11875?v=4","gravatar_id":"","url":"https://api.github.com/users/earlephilhower","html_url":"https://github.com/earlephilhower","followers_url":"https://api.github.com/users/earlephilhower/followers","following_url":"https://api.github.com/users/earlephilhower/following{/other_user}","gists_url":"https://api.github.com/users/earlephilhower/gists{/gist_id}","starred_url":"https://api.github.com/users/earlephilhower/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/earlephilhower/subscriptions","organizations_url":"https://api.github.com/users/earlephilhower/orgs","repos_url":"https://api.github.com/users/earlephilhower/repos","events_url":"https://api.github.com/users/earlephilhower/events{/privacy}","received_events_url":"https://api.github.com/users/earlephilhower/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/earlephilhower/Arduino","description":"ESP8266 core for Arduino","fork":true,"url":"https://api.github.com/repos/earlephilhower/Arduino","forks_url":"https://api.github.com/repos/earlephilhower/Arduino/forks","keys_url":"https://api.github.com/repos/earlephilhower/Arduino/keys{/key_id}","collaborators_url":"https://api.github.com/repos/earlephilhower/Arduino/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/earlephilhower/Arduino/teams","hooks_url":"https://api.github.com/repos/earlephilhower/Arduino/hooks","issue_events_url":"https://api.github.com/repos/earlephilhower/Arduino/issues/events{/number}","events_url":"https://api.github.com/repos/earlephilhower/Arduino/events","assignees_url":"https://api.github.com/repos/earlephilhower/Arduino/assignees{/user}","branches_url":"https://api.github.com/repos/earlephilhower/Arduino/branches{/branch}","tags_url":"https://api.github.com/repos/earlephilhower/Arduino/tags","blobs_url":"https://api.github.com/repos/earlephilhower/Arduino/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/earlephilhower/Arduino/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/earlephilhower/Arduino/git/refs{/sha}","trees_url":"https://api.github.com/repos/earlephilhower/Arduino/git/trees{/sha}","statuses_url":"https://api.github.com/repos/earlephilhower/Arduino/statuses/{sha}","languages_url":"https://api.github.com/repos/earlephilhower/Arduino/languages","stargazers_url":"https://api.github.com/repos/earlephilhower/Arduino/stargazers","contributors_url":"https://api.github.com/repos/earlephilhower/Arduino/contributors","subscribers_url":"https://api.github.com/repos/earlephilhower/Arduino/subscribers","subscription_url":"https://api.github.com/repos/earlephilhower/Arduino/subscription","commits_url":"https://api.github.com/repos/earlephilhower/Arduino/commits{/sha}","git_commits_url":"https://api.github.com/repos/earlephilhower/Arduino/git/commits{/sha}","comments_url":"https://api.github.com/repos/earlephilhower/Arduino/comments{/number}","issue_comment_url":"https://api.github.com/repos/earlephilhower/Arduino/issues/comments{/number}","contents_url":"https://api.github.com/repos/earlephilhower/Arduino/contents/{+path}","compare_url":"https://api.github.com/repos/earlephilhower/Arduino/compare/{base}...{head}","merges_url":"https://api.github.com/repos/earlephilhower/Arduino/merges","archive_url":"https://api.github.com/repos/earlephilhower/Arduino/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/earlephilhower/Arduino/downloads","issues_url":"https://api.github.com/repos/earlephilhower/Arduino/issues{/number}","pulls_url":"https://api.github.com/repos/earlephilhower/Arduino/pulls{/number}","milestones_url":"https://api.github.com/repos/earlephilhower/Arduino/milestones{/number}","notifications_url":"https://api.github.com/repos/earlephilhower/Arduino/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/earlephilhower/Arduino/labels{/name}","releases_url":"https://api.github.com/repos/earlephilhower/Arduino/releases{/id}","deployments_url":"https://api.github.com/repos/earlephilhower/Arduino/deployments","created_at":"2017-02-28T03:31:42Z","updated_at":"2018-03-16T14:15:28Z","pushed_at":"2018-03-22T14:34:23Z","git_url":"git://github.com/earlephilhower/Arduino.git","ssh_url":"git@github.com:earlephilhower/Arduino.git","clone_url":"https://github.com/earlephilhower/Arduino.git","svn_url":"https://github.com/earlephilhower/Arduino","homepage":"","size":44998,"stargazers_count":5,"watchers_count":5,"language":"C","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"archived":false,"open_issues_count":0,"license":null,"forks":1,"open_issues":0,"watchers":5,"default_branch":"master"}},"base":{"label":"esp8266:master","ref":"master","sha":"f9110f51c200e056947c275dbc3e96ecb80ccdef","user":{"login":"esp8266","id":8943775,"avatar_url":"https://avatars1.githubusercontent.com/u/8943775?v=4","gravatar_id":"","url":"https://api.github.com/users/esp8266","html_url":"https://github.com/esp8266","followers_url":"https://api.github.com/users/esp8266/followers","following_url":"https://api.github.com/users/esp8266/following{/other_user}","gists_url":"https://api.github.com/users/esp8266/gists{/gist_id}","starred_url":"https://api.github.com/users/esp8266/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/esp8266/subscriptions","organizations_url":"https://api.github.com/users/esp8266/orgs","repos_url":"https://api.github.com/users/esp8266/repos","events_url":"https://api.github.com/users/esp8266/events{/privacy}","received_events_url":"https://api.github.com/users/esp8266/received_events","type":"Organization","site_admin":false},"repo":{"id":32969220,"name":"Arduino","full_name":"esp8266/Arduino","owner":{"login":"esp8266","id":8943775,"avatar_url":"https://avatars1.githubusercontent.com/u/8943775?v=4","gravatar_id":"","url":"https://api.github.com/users/esp8266","html_url":"https://github.com/esp8266","followers_url":"https://api.github.com/users/esp8266/followers","following_url":"https://api.github.com/users/esp8266/following{/other_user}","gists_url":"https://api.github.com/users/esp8266/gists{/gist_id}","starred_url":"https://api.github.com/users/esp8266/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/esp8266/subscriptions","organizations_url":"https://api.github.com/users/esp8266/orgs","repos_url":"https://api.github.com/users/esp8266/repos","events_url":"https://api.github.com/users/esp8266/events{/privacy}","received_events_url":"https://api.github.com/users/esp8266/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/esp8266/Arduino","description":"ESP8266 core for Arduino","fork":false,"url":"https://api.github.com/repos/esp8266/Arduino","forks_url":"https://api.github.com/repos/esp8266/Arduino/forks","keys_url":"https://api.github.com/repos/esp8266/Arduino/keys{/key_id}","collaborators_url":"https://api.github.com/repos/esp8266/Arduino/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/esp8266/Arduino/teams","hooks_url":"https://api.github.com/repos/esp8266/Arduino/hooks","issue_events_url":"https://api.github.com/repos/esp8266/Arduino/issues/events{/number}","events_url":"https://api.github.com/repos/esp8266/Arduino/events","assignees_url":"https://api.github.com/repos/esp8266/Arduino/assignees{/user}","branches_url":"https://api.github.com/repos/esp8266/Arduino/branches{/branch}","tags_url":"https://api.github.com/repos/esp8266/Arduino/tags","blobs_url":"https://api.github.com/repos/esp8266/Arduino/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/esp8266/Arduino/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/esp8266/Arduino/git/refs{/sha}","trees_url":"https://api.github.com/repos/esp8266/Arduino/git/trees{/sha}","statuses_url":"https://api.github.com/repos/esp8266/Arduino/statuses/{sha}","languages_url":"https://api.github.com/repos/esp8266/Arduino/languages","stargazers_url":"https://api.github.com/repos/esp8266/Arduino/stargazers","contributors_url":"https://api.github.com/repos/esp8266/Arduino/contributors","subscribers_url":"https://api.github.com/repos/esp8266/Arduino/subscribers","subscription_url":"https://api.github.com/repos/esp8266/Arduino/subscription","commits_url":"https://api.github.com/repos/esp8266/Arduino/commits{/sha}","git_commits_url":"https://api.github.com/repos/esp8266/Arduino/git/commits{/sha}","comments_url":"https://api.github.com/repos/esp8266/Arduino/comments{/number}","issue_comment_url":"https://api.github.com/repos/esp8266/Arduino/issues/comments{/number}","contents_url":"https://api.github.com/repos/esp8266/Arduino/contents/{+path}","compare_url":"https://api.github.com/repos/esp8266/Arduino/compare/{base}...{head}","merges_url":"https://api.github.com/repos/esp8266/Arduino/merges","archive_url":"https://api.github.com/repos/esp8266/Arduino/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/esp8266/Arduino/downloads","issues_url":"https://api.github.com/repos/esp8266/Arduino/issues{/number}","pulls_url":"https://api.github.com/repos/esp8266/Arduino/pulls{/number}","milestones_url":"https://api.github.com/repos/esp8266/Arduino/milestones{/number}","notifications_url":"https://api.github.com/repos/esp8266/Arduino/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/esp8266/Arduino/labels{/name}","releases_url":"https://api.github.com/repos/esp8266/Arduino/releases{/id}","deployments_url":"https://api.github.com/repos/esp8266/Arduino/deployments","created_at":"2015-03-27T05:22:06Z","updated_at":"2018-03-22T18:52:57Z","pushed_at":"2018-03-22T18:06:59Z","git_url":"git://github.com/esp8266/Arduino.git","ssh_url":"git@github.com:esp8266/Arduino.git","clone_url":"https://github.com/esp8266/Arduino.git","svn_url":"https://github.com/esp8266/Arduino","homepage":"","size":41849,"stargazers_count":6966,"watchers_count":6966,"language":"C","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":4300,"mirror_url":null,"archived":false,"open_issues_count":589,"license":{"key":"lgpl-2.1","name":"GNU Lesser General Public License v2.1","spdx_id":"LGPL-2.1","url":"https://api.github.com/licenses/lgpl-2.1"},"forks":4300,"open_issues":589,"watchers":6966,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/esp8266/Arduino/pulls/4273"},"html":{"href":"https://github.com/esp8266/Arduino/pull/4273"},"issue":{"href":"https://api.github.com/repos/esp8266/Arduino/issues/4273"},"comments":{"href":"https://api.github.com/repos/esp8266/Arduino/issues/4273/comments"},"review_comments":{"href":"https://api.github.com/repos/esp8266/Arduino/pulls/4273/comments"},"review_comment":{"href":"https://api.github.com/repos/esp8266/Arduino/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/esp8266/Arduino/pulls/4273/commits"},"statuses":{"href":"https://api.github.com/repos/esp8266/Arduino/statuses/5c5cd66d85d51f5002bcee0d248c7e8e8c271efe"}},"author_association":"COLLABORATOR"}}
{"actor":{"display_login":"earlephilhower"}}