{"action":"created","issue":{"url":"https://api.github.com/repos/esp8266/Arduino/issues/4273","repository_url":"https://api.github.com/repos/esp8266/Arduino","labels_url":"https://api.github.com/repos/esp8266/Arduino/issues/4273/labels{/name}","comments_url":"https://api.github.com/repos/esp8266/Arduino/issues/4273/comments","events_url":"https://api.github.com/repos/esp8266/Arduino/issues/4273/events","html_url":"https://github.com/esp8266/Arduino/pull/4273","id":293765548,"number":4273,"title":"Add BearSSL client and server, support true bidir, lower memory, modern SSL","user":{"login":"earlephilhower","id":11875,"avatar_url":"https://avatars0.githubusercontent.com/u/11875?v=4","gravatar_id":"","url":"https://api.github.com/users/earlephilhower","html_url":"https://github.com/earlephilhower","followers_url":"https://api.github.com/users/earlephilhower/followers","following_url":"https://api.github.com/users/earlephilhower/following{/other_user}","gists_url":"https://api.github.com/users/earlephilhower/gists{/gist_id}","starred_url":"https://api.github.com/users/earlephilhower/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/earlephilhower/subscriptions","organizations_url":"https://api.github.com/users/earlephilhower/orgs","repos_url":"https://api.github.com/users/earlephilhower/repos","events_url":"https://api.github.com/users/earlephilhower/events{/privacy}","received_events_url":"https://api.github.com/users/earlephilhower/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":97,"created_at":"2018-02-02T03:53:31Z","updated_at":"2018-05-11T15:47:59Z","closed_at":null,"author_association":"COLLABORATOR","pull_request":{"url":"https://api.github.com/repos/esp8266/Arduino/pulls/4273","html_url":"https://github.com/esp8266/Arduino/pull/4273","diff_url":"https://github.com/esp8266/Arduino/pull/4273.diff","patch_url":"https://github.com/esp8266/Arduino/pull/4273.patch"},"body":"-edit- No longer WIP, seems stable enough for review and testing use outside my own lab -edit-\r\n\r\nAs discussed in #3490, axTLS has some issues with not checking for OOM, is unidirectional (i.e. some hacks required to support bidir MQTT protocol/etc.), and uses lots of memory.\r\n\r\nThis patch takes BearSSL, ports it to the ESP8266, and creates two new classes to replace the WiFiServerSecure and WiFiClientSecure classes.  BearSSL memory requirements are much lower than axTLS when doing bidirectional (only ~24KB for a client, ~5.5KB for a server) connections since the receive and transmit buffer sizes are independently configurable, allowing for both a bidir SSL client and bidir SSL server to be run at the same time with memory to spare for your own application.  It also does not do any memory allocations at operation time, so you're not likely to get as many random crashes as axTLS when tight on memory.  Finally, BearSSL supports a much wider variety of modern ciphers (and does not do the completely broken RC4, for example) and certificate types.\r\n\r\nBearSSL is MIT licensed by the author.\r\n\r\nWhile the patch here does work and can be used as both a SSL server and Client, it's still a WIP as I expect the API to change and grow, as well as more advanced testing by real users.\r\n\r\nThe Server/Client interface is the same as the existing classes, but the SSL-specific bits are different.  This applies to the way certificates are validated (they are ALWAYS checked against a trust anchor/hardcoded cert *you* supply), and how SSL parameters are set amongst other things, so it's not as simple as just replacing WiFiClientSecure w/WiFiClientBearSSL.\r\n\r\nThe new classes are called (for now) WiFiClientBearSSL/WiFiServerBearSSL.\r\n\r\nSee the new example bearssl/bearssl.ino for a quick example.  See https://bearssl.org for more BearSSL info as well as the tools to generate your own trust anchor structures for your own apps.\r\n\r\nI'm including a precompiled bearssl.a library for now, but the changes to the original sources are quite trivial and will be put up at least in my own repo if not integrated w/the main BearSSL code if they're acceptable to the author.\r\n\r\nhttps://github.com/earlephilhower/bearssl-esp8266 is the port sources.\r\n\r\nThanks very much to the BearSSL author @pornin for his assistance in the original issue."},"comment":{"url":"https://api.github.com/repos/esp8266/Arduino/issues/comments/388403696","html_url":"https://github.com/esp8266/Arduino/pull/4273#issuecomment-388403696","issue_url":"https://api.github.com/repos/esp8266/Arduino/issues/4273","id":388403696,"user":{"login":"whyameye","id":1716966,"avatar_url":"https://avatars0.githubusercontent.com/u/1716966?v=4","gravatar_id":"","url":"https://api.github.com/users/whyameye","html_url":"https://github.com/whyameye","followers_url":"https://api.github.com/users/whyameye/followers","following_url":"https://api.github.com/users/whyameye/following{/other_user}","gists_url":"https://api.github.com/users/whyameye/gists{/gist_id}","starred_url":"https://api.github.com/users/whyameye/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/whyameye/subscriptions","organizations_url":"https://api.github.com/users/whyameye/orgs","repos_url":"https://api.github.com/users/whyameye/repos","events_url":"https://api.github.com/users/whyameye/events{/privacy}","received_events_url":"https://api.github.com/users/whyameye/received_events","type":"User","site_admin":false},"created_at":"2018-05-11T15:47:59Z","updated_at":"2018-05-11T15:47:59Z","author_association":"NONE","body":"FWIW I switched to using this about 3 weeks ago and it's been running like a champ. I think it would be better to get it in master sooner than later so more people will be inclined to play with it, then work with the feedback you get rather than continuing to drag out this conversation with no new data to work with."}}
{"actor":{"display_login":"whyameye"}}