詳細步驟：
- 使用rpi-imager建立Raspberry Pi 3+作業系統，使用不含Desktop。
設定WiFi連線與enable SSH。 - 安裝NODE-RED:
~$ sudo apt install build-essential git curl
~$ bash <(curl -sL https://raw.githubusercontent.com/node-red/linux-installers/master/deb/update-nodejs-and-nodered) - 安裝self signed CA certificates:
1.產生一組CA key:
openssl genrsa -des3 -out ca.key 2048
2.製作一組CA 憑證:
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt
3.製作 server key:
openssl genrsa -out node_red_tls.key 2048
4. 使用server key製作server憑證需求(certificate request):
openssl req -new -out node_red_tls.csr -key node_red_tls.key
5.製作server憑證:
openssl x509 -req -in node_red_tls.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out node_red_tls.crt -days 360 - 建立NODE-RED flow:輸入剛剛建立的憑證。
- PicoW Client端：
在lwipopts.h加入啟用mbedtls:
加入ca.crt憑證。
/* TCP WND must be at least 16 kb to match TLS record size or you will get a warning "altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!" */ // tls #undef TCP_WND #define TCP_WND 16384 #define LWIP_ALTCP 1 #define LWIP_ALTCP_TLS 1 #define LWIP_ALTCP_TLS_MBEDTLS 1 #define LWIP_DEBUG 1 #define ALTCP_MBEDTLS_DEBUG LWIP_DBG_ON #define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_REQUIRED
詳細步驟請參閱下列影片：
程式碼：
- picow_tls_client.c
#include < stdio.h > #include "pico/stdlib.h" #include "pico/cyw43_arch.h" #include "picow_tls_client.h" #include "picow_tls_cert.h" #define TCP_POLL_INTERVAL 10 #define LED_RED_PIN 13 #define LED_GREEN_PIN 14 #define LED_BLUE_PIN 15 #define WIFI_SSID "your-ssid" #define WIFI_PASSWORD "your-password" #define SERVER_IP "your-server-ip" #define SERVER_PORT 20000 static struct altcp_tls_config *tls_config = NULL; err_t tcp_connect_close(TLS_CLIENT_T * tls_client) { tls_client->connected=false; tls_client->dns_found=false; return altcp_close(tls_client->tpcb); } static int32_t buff_remain_len=0; err_t tcp_recv_cb(void *arg, struct altcp_pcb *tpcb, struct pbuf *p, err_t err) { TLS_CLIENT_T *tls_client = (TLS_CLIENT_T*)arg; if (!p) { printf("pbuf null\n"); return tcp_connect_close(tls_client); } if (p->tot_len > 0) { // for test only int32_t len; int32_t offset=0; buff_remain_len = p->tot_len; while (buff_remain_len > 0) { len = buff_remain_len > RECV_BUFF_MAX_LEN ? RECV_BUFF_MAX_LEN : buff_remain_len; pbuf_copy_partial(p, tls_client->recv_buff, len,offset); tls_client->recv_buff[len]=0; printf("%s\n", tls_client->recv_buff); buff_remain_len -= len; offset+=len; } altcp_recved(tpcb, p->tot_len); } gpio_put(LED_GREEN_PIN, !gpio_get(LED_GREEN_PIN)); pbuf_free(p); return ERR_OK; } err_t tcp_sent_cb(void *arg, struct altcp_pcb *tpcb, u16_t len) { return ERR_OK; } err_t tcp_poll_cb(void *arg, struct altcp_pcb *tpcb) { TLS_CLIENT_T *tls_client = (TLS_CLIENT_T*)arg; return tcp_connect_close(tls_client); } void tcp_err_cb(void *arg, err_t err) { printf("tcp error:%d\n"); tcp_connect_close(arg); } err_t tcp_connected_cb(void *arg, struct altcp_pcb *tpcb, err_t err) { TLS_CLIENT_T *tls_client = (TLS_CLIENT_T*)arg; if (err == ERR_OK) { printf("tls server connected \n"); tls_client->connected = true; } return err; } void tls_client_dns_found(const char *name, const ip_addr_t *ipaddr, void *callback_arg) { TLS_CLIENT_T *tls_client = (TLS_CLIENT_T*)callback_arg; if (ipaddr) { printf("DNS resolving complete\n"); tls_client->dns_found=true; tls_client->server_addr = *ipaddr; } else { printf("error resolving hostname %s\n", name); tls_client->dns_found=false; } } int main() { int wifi_stat; err_t tcp_stat; stdio_init_all(); printf("Starting \n"); if (cyw43_arch_init()) { printf("cyw43 init error\n"); return 0; } gpio_init_mask(1 << LED_BLUE_PIN | 1 << LED_GREEN_PIN | 1 << LED_RED_PIN); gpio_set_dir_out_masked(1 << LED_BLUE_PIN | 1 << LED_GREEN_PIN | 1 << LED_RED_PIN); tls_config = altcp_tls_create_config_client(ca_cert, sizeof(ca_cert)); //tls_config = altcp_tls_create_config_client(NULL, 0); assert(tls_config); //led: red gpio_put_masked(1 << LED_BLUE_PIN | 1 << LED_GREEN_PIN | 1 << LED_RED_PIN, 0); gpio_put(LED_RED_PIN, true); // connect to WiFi cyw43_arch_enable_sta_mode(); wifi_stat = cyw43_arch_wifi_connect_timeout_ms(WIFI_SSID, WIFI_PASSWORD, CYW43_AUTH_WPA2_AES_PSK, 30000); if (wifi_stat) { printf("wifi connect error:%d\n", wifi_stat); return 0; } printf("Wifi connected\n"); //led: blue gpio_put_masked(1 << LED_BLUE_PIN | 1 << LED_GREEN_PIN | 1 << LED_RED_PIN, 0); gpio_put(LED_BLUE_PIN, true); // connect to tcp server TLS_CLIENT_T* tls_client = (TLS_CLIENT_T*)calloc(1, sizeof(TLS_CLIENT_T)); // set callback tls_client->tpcb = altcp_tls_new(tls_config, IPADDR_TYPE_ANY); altcp_arg(tls_client->tpcb, tls_client); altcp_sent(tls_client->tpcb, tcp_sent_cb); altcp_recv(tls_client->tpcb, tcp_recv_cb); altcp_poll(tls_client->tpcb, tcp_poll_cb, TCP_POLL_INTERVAL); altcp_err(tls_client->tpcb, tcp_err_cb); /* // if DNS query mbedtls_ssl_set_hostname(altcp_tls_context(tcp_client.tpcb), SERVER_NAME); tls_client->dns_found=false; cyw43_arch_lwip_begin(); tcp_stat = dns_gethostbyname(SERVER_NAME, &tls_client->server_addr, tls_client_dns_found, &tls_client); while(!tls_client->dns_found) { cyw43_arch_poll(); sleep_ms(10); } */ // if not by dns ipaddr_aton(SERVER_IP, &tls_client->server_addr); // connect to server; tls_client->connected = false; tcp_stat = altcp_connect(tls_client->tpcb, &tls_client->server_addr, SERVER_PORT, tcp_connected_cb); if (tcp_stat != ERR_OK) { printf("connect TCP server error:%d\n", tcp_stat); return 0; } absolute_time_t timeout = make_timeout_time_ms(20000); while(!tls_client->connected && absolute_time_diff_us(get_absolute_time(), timeout)>0){ printf("."); cyw43_arch_poll(); sleep_ms(10); } printf("\n"); if (!tls_client->connected) { printf("connection timeout\n"); free(tls_client); return 0; } // led : green gpio_put_masked(1 << LED_BLUE_PIN | 1 << LED_GREEN_PIN | 1 << LED_RED_PIN, 0); gpio_put(LED_GREEN_PIN, true); uint8_t buff[100]; uint32_t idx=0; while(1) { sprintf(buff, "test from PicoW:%020d", idx++); altcp_write(tls_client->tpcb, buff, strlen(buff), TCP_WRITE_FLAG_COPY); cyw43_arch_poll(); cyw43_arch_wait_for_work_until(make_timeout_time_ms(1000)); //sleep_ms(50); } altcp_close(tls_client->tpcb); free(tls_client); cyw43_arch_deinit(); return 0; }
- CMakeLists.txt
# Generated Cmake Pico project file cmake_minimum_required(VERSION 3.13) set(CMAKE_C_STANDARD 11) set(CMAKE_CXX_STANDARD 17) # Initialise pico_sdk from installed location # (note this can come from environment, CMake cache etc) set(PICO_SDK_PATH "/home/duser/pico/pico-sdk") set(PICO_BOARD pico_w CACHE STRING "Board type") # Pull in Raspberry Pi Pico SDK (must be before project) include(pico_sdk_import.cmake) if (PICO_SDK_VERSION_STRING VERSION_LESS "1.4.0") message(FATAL_ERROR "Raspberry Pi Pico SDK version 1.4.0 (or later) required. Your version is ${PICO_SDK_VERSION_STRING}") endif() project(picow_tls_client C CXX ASM) # Initialise the Raspberry Pi Pico SDK pico_sdk_init() # Add executable. Default name is the project name, version 0.1 add_executable(picow_tls_client picow_tls_client.c ) pico_set_program_name(picow_tls_client "picow_tls_client") pico_set_program_version(picow_tls_client "0.1") pico_enable_stdio_uart(picow_tls_client 1) pico_enable_stdio_usb(picow_tls_client 0) # Add the standard library to the build target_link_libraries(picow_tls_client pico_stdlib) # Add the standard include files to the build target_include_directories(picow_tls_client PRIVATE ${CMAKE_CURRENT_LIST_DIR} ${CMAKE_CURRENT_LIST_DIR}/.. # for our common lwipopts or any other standard includes, if required ) # Add any user requested libraries target_link_libraries(picow_tls_client pico_cyw43_arch_lwip_poll pico_lwip_mbedtls pico_mbedtls ) pico_add_extra_outputs(picow_tls_client)
- picow_tls_client.h
#ifndef __PICOW_TLS_CLIENT_H__ #define __PICOW_TLS_CLIENT_H__ #include "lwip/pbuf.h" #include "lwip/altcp_tcp.h" #include "lwip/altcp_tcp.h" #include "lwip/altcp_tls.h" #include "lwip/dns.h" #define RECV_BUFF_MAX_LEN 1024 typedef struct { struct altcp_pcb *tpcb; ip_addr_t server_addr; bool connected; bool dns_found; uint8_t recv_buff[RECV_BUFF_MAX_LEN+1]; } TLS_CLIENT_T; #endif
- lwipopts.h
#ifndef __LWIPOPTS_H__ #define __LWIPOPTS_H__ // Common settings used in most of the pico_w examples // (see https://www.nongnu.org/lwip/2_1_x/group__lwip__opts.html for details) // allow override in some examples #ifndef NO_SYS #define NO_SYS 1 #endif // allow override in some examples #ifndef LWIP_SOCKET #define LWIP_SOCKET 0 #endif #if PICO_CYW43_ARCH_POLL #define MEM_LIBC_MALLOC 1 #else // MEM_LIBC_MALLOC is incompatible with non polling versions #define MEM_LIBC_MALLOC 0 #endif #define MEM_ALIGNMENT 4 #define MEM_SIZE 4000 #define MEMP_NUM_TCP_SEG 32 #define MEMP_NUM_ARP_QUEUE 10 #define PBUF_POOL_SIZE 24 #define LWIP_ARP 1 #define LWIP_ETHERNET 1 #define LWIP_ICMP 1 #define LWIP_RAW 1 #define TCP_WND (8 * TCP_MSS) #define TCP_MSS 1460 #define TCP_SND_BUF (8 * TCP_MSS) #define TCP_SND_QUEUELEN ((4 * (TCP_SND_BUF) + (TCP_MSS - 1)) / (TCP_MSS)) #define LWIP_NETIF_STATUS_CALLBACK 1 #define LWIP_NETIF_LINK_CALLBACK 1 #define LWIP_NETIF_HOSTNAME 1 #define LWIP_NETCONN 0 #define MEM_STATS 0 #define SYS_STATS 0 #define MEMP_STATS 0 #define LINK_STATS 0 // #define ETH_PAD_SIZE 2 #define LWIP_CHKSUM_ALGORITHM 3 #define LWIP_DHCP 1 #define LWIP_IPV4 1 #define LWIP_TCP 1 #define LWIP_UDP 1 #define LWIP_DNS 1 #define LWIP_TCP_KEEPALIVE 1 #define LWIP_NETIF_TX_SINGLE_PBUF 1 #define DHCP_DOES_ARP_CHECK 0 #define LWIP_DHCP_DOES_ACD_CHECK 0 #ifndef NDEBUG #define LWIP_DEBUG 1 #define LWIP_STATS 1 #define LWIP_STATS_DISPLAY 1 #endif #define ETHARP_DEBUG LWIP_DBG_OFF #define NETIF_DEBUG LWIP_DBG_OFF #define PBUF_DEBUG LWIP_DBG_OFF #define API_LIB_DEBUG LWIP_DBG_OFF #define API_MSG_DEBUG LWIP_DBG_OFF #define SOCKETS_DEBUG LWIP_DBG_OFF #define ICMP_DEBUG LWIP_DBG_OFF #define INET_DEBUG LWIP_DBG_OFF #define IP_DEBUG LWIP_DBG_OFF #define IP_REASS_DEBUG LWIP_DBG_OFF #define RAW_DEBUG LWIP_DBG_OFF #define MEM_DEBUG LWIP_DBG_OFF #define MEMP_DEBUG LWIP_DBG_OFF #define SYS_DEBUG LWIP_DBG_OFF #define TCP_DEBUG LWIP_DBG_OFF #define TCP_INPUT_DEBUG LWIP_DBG_OFF #define TCP_OUTPUT_DEBUG LWIP_DBG_OFF #define TCP_RTO_DEBUG LWIP_DBG_OFF #define TCP_CWND_DEBUG LWIP_DBG_OFF #define TCP_WND_DEBUG LWIP_DBG_OFF #define TCP_FR_DEBUG LWIP_DBG_OFF #define TCP_QLEN_DEBUG LWIP_DBG_OFF #define TCP_RST_DEBUG LWIP_DBG_OFF #define UDP_DEBUG LWIP_DBG_OFF #define TCPIP_DEBUG LWIP_DBG_OFF #define PPP_DEBUG LWIP_DBG_OFF #define SLIP_DEBUG LWIP_DBG_OFF #define DHCP_DEBUG LWIP_DBG_OFF /* TCP WND must be at least 16 kb to match TLS record size or you will get a warning "altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!" */ // tls #undef TCP_WND #define TCP_WND 16384 #define LWIP_ALTCP 1 #define LWIP_ALTCP_TLS 1 #define LWIP_ALTCP_TLS_MBEDTLS 1 #define LWIP_DEBUG 1 #define ALTCP_MBEDTLS_DEBUG LWIP_DBG_ON #define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_REQUIRED #endif /* __LWIPOPTS_H__ */
- mbedtls_config.h
/* Workaround for some mbedtls source files using INT_MAX without including limits.h */ #include < limits.h > #define MBEDTLS_NO_PLATFORM_ENTROPY #define MBEDTLS_ENTROPY_HARDWARE_ALT #define MBEDTLS_SSL_OUT_CONTENT_LEN 2048 #define MBEDTLS_ALLOW_PRIVATE_ACCESS #define MBEDTLS_HAVE_TIME #define MBEDTLS_CIPHER_MODE_CBC #define MBEDTLS_ECP_DP_SECP192R1_ENABLED #define MBEDTLS_ECP_DP_SECP224R1_ENABLED #define MBEDTLS_ECP_DP_SECP256R1_ENABLED #define MBEDTLS_ECP_DP_SECP384R1_ENABLED #define MBEDTLS_ECP_DP_SECP521R1_ENABLED #define MBEDTLS_ECP_DP_SECP192K1_ENABLED #define MBEDTLS_ECP_DP_SECP224K1_ENABLED #define MBEDTLS_ECP_DP_SECP256K1_ENABLED #define MBEDTLS_ECP_DP_BP256R1_ENABLED #define MBEDTLS_ECP_DP_BP384R1_ENABLED #define MBEDTLS_ECP_DP_BP512R1_ENABLED #define MBEDTLS_ECP_DP_CURVE25519_ENABLED #define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED #define MBEDTLS_PKCS1_V15 #define MBEDTLS_SHA256_SMALLER #define MBEDTLS_SSL_SERVER_NAME_INDICATION #define MBEDTLS_AES_C #define MBEDTLS_ASN1_PARSE_C #define MBEDTLS_BIGNUM_C #define MBEDTLS_CIPHER_C #define MBEDTLS_CTR_DRBG_C #define MBEDTLS_ENTROPY_C #define MBEDTLS_ERROR_C #define MBEDTLS_MD_C #define MBEDTLS_MD5_C #define MBEDTLS_OID_C #define MBEDTLS_PKCS5_C #define MBEDTLS_PK_C #define MBEDTLS_PK_PARSE_C #define MBEDTLS_PLATFORM_C #define MBEDTLS_RSA_C #define MBEDTLS_SHA1_C #define MBEDTLS_SHA224_C #define MBEDTLS_SHA256_C #define MBEDTLS_SHA512_C #define MBEDTLS_SSL_CLI_C #define MBEDTLS_SSL_SRV_C #define MBEDTLS_SSL_TLS_C #define MBEDTLS_X509_CRT_PARSE_C #define MBEDTLS_X509_USE_C #define MBEDTLS_AES_FEWER_TABLES /* TLS 1.2 */ #define MBEDTLS_SSL_PROTO_TLS1_2 #define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED #define MBEDTLS_GCM_C #define MBEDTLS_ECDH_C #define MBEDTLS_ECP_C #define MBEDTLS_ECDSA_C #define MBEDTLS_ASN1_WRITE_C // The following is needed to parse a certificate #define MBEDTLS_PEM_PARSE_C #define MBEDTLS_BASE64_C
- picow_tls_cert.h
#define ca_cert "-----BEGIN CERTIFICATE-----\n\ . . . -----END CERTIFICATE-----\n"
沒有留言:
張貼留言