微控制器應用實驗室: Raspberry Pi Pico W || LwIP || MbedTLS: EP.1 HTTPS server self-signed Certificate setup & web page files in SD

本篇文章介紹使用Pico-SDK 結合LwIP and MbedTLS 在Raspberry Pi Pico W上建立HTTPS(Secure HTTP) server。本專案會使用LwIP 中SNTP and HTTP Application。詳細步驟如下說明：

一、連線WiFi並設定static IP:

cyw43_arch_enable_sta_mode();
netif_set_status_callback(netif_default, netif_status_cb);
cyw43_arch_wifi_connect_timeout_ms(WIFI_SSID, WIFI_PASSWORD, CYW43_AUTH_WPA2_AES_PSK, 30000);

使用netif_set_status_callback當成功連上WiFi時呼叫netif_status_cb設定Static IP。

二、以LwIP SNTP application設定系統時間。
在CMakeLists.txt加入：

add_definitions(
-DSNTP_SERVER_DNS=1
-DSNTP_SERVER_ADDRESS="pool.ntp.org"
-DSNTP_SET_SYSTEM_TIME=sntp_set_system_time
-DSNTP_STARTUP_DELAY=0
)

sntp_set_system_time為SNTP client取得資料時呼叫的callback function。

在程式中呼叫

sntp_setoperatingmode(SNTP_OPMODE_POLL);
sntp_init();

以啟用SNTP client。

三、建立self-signed Server Side Certificates:

openssl genrsa -des3 -out ca.key 2048:
建立Root CA key。
openssl req -new -x509 -days 3650 -key ca.key -out ca.cert:
建立self-signed root Certificate。
openssl genrsa -out server.key 2048:
建立server side private key。
openssl req -new -out server.csr -key server.key
使用server key製作server憑證需求(certificate request)
openssl x509 -req -in server.csr -CA ca.cert -CAkey ca.key -CAcreateserial -out server.cert -days 365
使用root CA ca.cert簽署server side certificate。

四、設定MbedTLS的TLS connection參數：

將ca.cert, server.cert與server.key加入在專案picow_https_cert.h中。
CMakeLists.txt加入：
target_link_libraries(picow_https_server
pico_cyw43_arch_lwip_poll
pico_lwip_sntp
pico_lwip_http
pico_mbedtls
pico_lwip_mbedtls
)

在lwipopts.conf加入：

 /*  in Pico-SDK above 1.5.0 */
#define MEMP_NUM_SYS_TIMEOUT            (LWIP_NUM_SYS_TIMEOUT_INTERNAL+1)
/* TCP WND must be at least 16 kb to match TLS record size
   or you will get a warning "altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!" */
// tls
#undef TCP_WND
#define TCP_WND  16384
 
#define LWIP_ALTCP               1
#define LWIP_ALTCP_TLS           1
#define LWIP_ALTCP_TLS_MBEDTLS   1
 
#define LWIP_DEBUG 1
#define ALTCP_MBEDTLS_DEBUG  LWIP_DBG_ON
 
/* set authmode */
#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_NONE
//#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_REQUIRED

設定tls config:
加入self-signed root CA certificate, server certificate and server private key
tls_config = altcp_tls_create_config_server_privkey_cert(SERVER_KEY, sizeof(SERVER_KEY), NULL, 0, SERVER_CERT, sizeof(SERVER_CERT));
mbedtls_x509_crt_parse(tls_config->cert, CA_CERT, sizeof(CA_CERT));

五、設定https server:

這個專案將web page files放在SD卡上，先mount SD在設定root path
有關pico SD storage driver請參閱前面文章
https server如何讀取page file,修改自LwIP的fs_example.c範例程式。

mount SD:
if (f_mount(&fs, SDMMC_PATH, 1) != FR_OK) {
printf("mount error\n");
return 0;
}
設定web server root path:
fs_ex_init(SDMMC_PATH"/");
啟用https:
httpd_inits(tls_config);

使用broswer, curl與wget使令測試，過程如下列影片。

六、成果影片

七、程式碼

CMakeLists.txt

  
# Generated Cmake Pico project file
 
cmake_minimum_required(VERSION 3.13)
 
set(CMAKE_C_STANDARD 11)
set(CMAKE_CXX_STANDARD 17)
 
# Initialise pico_sdk from installed location
# (note this can come from environment, CMake cache etc)
set(PICO_SDK_PATH "/home/duser/pico/pico-sdk")
 
set(PICO_BOARD pico_w CACHE STRING "Board type")
 
# Pull in Raspberry Pi Pico SDK (must be before project)
include(pico_sdk_import.cmake)
 
if (PICO_SDK_VERSION_STRING VERSION_LESS "1.4.0")
  message(FATAL_ERROR "Raspberry Pi Pico SDK version 1.4.0 (or later) required. Your version is ${PICO_SDK_VERSION_STRING}")
endif()
 
project(picow_https_server C CXX ASM)
 
# Initialise the Raspberry Pi Pico SDK
pico_sdk_init()
 
# Add executable. Default name is the project name, version 0.1
 
add_executable(picow_https_server 
        picow_https_server.c 
        fs_example.c)
 
add_definitions(
        -DSNTP_SERVER_DNS=1
        -DSNTP_SERVER_ADDRESS="pool.ntp.org"
        -DSNTP_SET_SYSTEM_TIME=sntp_set_system_time
        -DSNTP_STARTUP_DELAY=0
)
 
pico_set_program_name(picow_https_server "picow_https_server")
pico_set_program_version(picow_https_server "0.1")
 
pico_enable_stdio_uart(picow_https_server 1)
pico_enable_stdio_usb(picow_https_server 0)
 
# Add the standard library to the build
target_link_libraries(picow_https_server
        pico_stdlib)
 
# Add the standard include files to the build
target_include_directories(picow_https_server PRIVATE
  ${CMAKE_CURRENT_LIST_DIR}
  ${CMAKE_CURRENT_LIST_DIR}/.. # for our common lwipopts or any other standard includes, if required
)
 
# Add any user requested libraries
target_link_libraries(picow_https_server 
        pico_cyw43_arch_lwip_poll
        pico_lwip_sntp
        pico_lwip_http
        pico_mbedtls
        pico_lwip_mbedtls
        )
 
add_subdirectory(pico_storage_drv)
target_link_libraries(picow_https_server
        pico_storage_drv
        )
 
pico_add_extra_outputs(picow_https_server)

picow_https_server.c

  
#include < stdio.h >
#include "pico/stdlib.h"
#include "pico/cyw43_arch.h"
 
#include "lwip/altcp_tls.h"
#include "lwip/altcp_tcp.h"
#include "lwip/altcp.h"
#include "lwip/apps/httpd.h"
#include "lwip/apps/sntp.h"
 
#include "picow_https_cert.h"
#include "ff.h"
#include "pico_storage.h"
 
 
#define WIFI_SSID "your-ssid"
#define WIFI_PASSWORD "your-password"
 
struct altcp_tls_config {
  mbedtls_ssl_config conf;
  mbedtls_x509_crt *cert;
  mbedtls_pk_context *pkey;
  u8_t cert_count;
  u8_t cert_max;
  u8_t pkey_count;
  u8_t pkey_max;
  mbedtls_x509_crt *ca;
#if defined(MBEDTLS_SSL_CACHE_C) && ALTCP_MBEDTLS_USE_SESSION_CACHE
  /** Inter-connection cache for fast connection startup */
  struct mbedtls_ssl_cache_context cache;
#endif
#if defined(MBEDTLS_SSL_SESSION_TICKETS) && ALTCP_MBEDTLS_USE_SESSION_TICKETS
  mbedtls_ssl_ticket_context ticket_ctx;
#endif
};
 
struct altcp_tls_config *tls_config = NULL;
 
void fs_ex_init(const char *httpd_root_dir);
 
void netif_status_cb(struct netif *netif) {
    if (netif_is_link_up(netif)) {
        ip_addr_t ipaddr;
        ip_addr_t netmask;
        ip_addr_t gateway;
        ipaddr_aton("192.168.1.70", &ipaddr); 
        ipaddr_aton("255.255.255.0", &netmask);
        ipaddr_aton("192.168.1.1", &gateway);
    
        netif_set_addr(netif, &ipaddr, &netmask, &gateway);
    }   
}
 
void sntp_set_system_time(uint32_t sec, uint32_t us)
{
  struct tm info;
  time_t tim = sec;
  struct timeval tmv;
  tmv.tv_sec=sec;
  tmv.tv_usec=us;
  settimeofday(&tmv, 0);
  printf("set time :%s\n", ctime(&tim));
  sntp_stop();
}
 
int main()
{
    stdio_init_all();
 
    if (cyw43_arch_init()) {
        printf("cyw43 arch init error\n");
        return 0;
    }
    //1. connect to WiFi network and set static IP
    cyw43_arch_enable_sta_mode();
    netif_set_status_callback(netif_default, netif_status_cb);
    int wifi_stat = cyw43_arch_wifi_connect_timeout_ms(WIFI_SSID, WIFI_PASSWORD, CYW43_AUTH_WPA2_AES_PSK, 30000);
    if (wifi_stat) {
        printf("wifi connect error:%d\n", wifi_stat);
        return 0;
    }
    printf("Wifi connected\n");
    printf("get ip addr:%s\n",ipaddr_ntoa(&(cyw43_state.netif[0].ip_addr)));
    
    // 2. set SNTP
    sntp_setoperatingmode(SNTP_OPMODE_POLL);
    sntp_init();
 
    // 3. set TLS connection
    tls_config = altcp_tls_create_config_server_privkey_cert(SERVER_KEY, sizeof(SERVER_KEY), NULL, 0, SERVER_CERT, sizeof(SERVER_CERT));
    mbedtls_x509_crt_parse(tls_config->cert, CA_CERT, sizeof(CA_CERT));
    
    //4. mount FS in SD card and start https server
    FATFS fs;
    FIL fil;
    FRESULT res;
    if (f_mount(&fs, SDMMC_PATH, 1) != FR_OK) {
      printf("mount error\n");
      return 0;
    }
    fs_ex_init(SDMMC_PATH"/");
    httpd_inits(tls_config);
    
    time_t tm;
    while(1) {
      cyw43_arch_poll();
      sleep_ms(50);
 
    }
 
 
    return 0;
}

fs_example.c

  
/**
 * @file
 * HTTPD custom file system example
 *
 * This file demonstrates how to add support for an external file system to httpd.
 * It provides access to the specified root directory and uses stdio.h file functions
 * to read files.
 *
 * ATTENTION: This implementation is *not* secure: no checks are added to ensure
 * files are only read below the specified root directory!
 */
 
 /*
 * Copyright (c) 2017 Simon Goldschmidt
 * All rights reserved.
 * 
 * Redistribution and use in source and binary forms, with or without modification, 
 * are permitted provided that the following conditions are met:
 *
 * 1. Redistributions of source code must retain the above copyright notice,
 *    this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright notice,
 *    this list of conditions and the following disclaimer in the documentation
 *    and/or other materials provided with the distribution.
 * 3. The name of the author may not be used to endorse or promote products
 *    derived from this software without specific prior written permission. 
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED 
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF 
 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT 
 * SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, 
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT 
 * OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING 
 * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY 
 * OF SUCH DAMAGE.
 *
 * This file is part of the lwIP TCP/IP stack.
 * 
 * Author: Simon Goldschmidt < goldsimon@gmx.de > 
 *
 */
 
#include "lwip/opt.h"
 
 
#include "lwip/apps/fs.h"
#include "lwip/def.h"
#include "lwip/mem.h"
 
#include "stdio.h"
#include "string.h"
#include "ff.h"
#include "pico_storage.h"
 
/** define LWIP_HTTPD_EXAMPLE_CUSTOMFILES to 1 to enable this file system */
#ifndef LWIP_HTTPD_EXAMPLE_CUSTOMFILES
#define LWIP_HTTPD_EXAMPLE_CUSTOMFILES 1
#endif
 
/** define LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED to 1 to delay open and read
 * as if e.g. reading from external SPI flash */
#ifndef LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
#define LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED 0
#endif
 
/** define LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ to the number of bytes
 * to read to emulate limited transfer buffers and don't read whole files in
 * one chunk.
 * WARNING: lowering this slows down the connection!
 */
#ifndef LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ
#define LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ 0
#endif
 
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES
 
#if !LWIP_HTTPD_CUSTOM_FILES
#error This needs LWIP_HTTPD_CUSTOM_FILES
#endif
#if !LWIP_HTTPD_DYNAMIC_HEADERS
#error This needs LWIP_HTTPD_DYNAMIC_HEADERS
#endif
#if !LWIP_HTTPD_DYNAMIC_FILE_READ
#error This wants to demonstrate read-after-open, so LWIP_HTTPD_DYNAMIC_FILE_READ is required!
#endif
#if !LWIP_HTTPD_FS_ASYNC_READ
#error This needs LWIP_HTTPD_FS_ASYNC_READ
#endif
#if !LWIP_HTTPD_FILE_EXTENSION
#error This needs LWIP_HTTPD_FILE_EXTENSION
#endif
 
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
#include "lwip/tcpip.h"
#endif
 
struct fs_custom_data {
  //FILE *f;
  FIL *f;
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
  int delay_read;
  fs_wait_cb callback_fn;
  void *callback_arg;
#endif
};
 
const char* fs_ex_root_dir;
 
void
fs_ex_init(const char *httpd_root_dir)
{
  fs_ex_root_dir = strdup(httpd_root_dir);
}
 
#if LWIP_HTTPD_CUSTOM_FILES
int
fs_open_custom(struct fs_file *file, const char *name)
{
  char full_filename[256];
  //FILE *f;
  FIL f;
  FRESULT res;
  snprintf(full_filename, 255, "%s%s", fs_ex_root_dir, name);
  full_filename[255] = 0;
 
  //f = fopen(full_filename, "rb");
  res =f_open(&f, full_filename, FA_READ);
  //if (f != NULL) {
  if (res == FR_OK) {
    //if (!fseek(f, 0, SEEK_END)) {
    if (f_lseek(&f, 0) == FR_OK) { 
      //int len = (int)ftell(f);
      int len = (int)f_size(&f);
      //if(!fseek(f, 0, SEEK_SET)) {
        struct fs_custom_data *data = (struct fs_custom_data *)mem_malloc(sizeof(struct fs_custom_data));
        LWIP_ASSERT("out of memory?", data != NULL);
        memset(file, 0, sizeof(struct fs_file));
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
        file->len = 0; /* read size delayed */
        data->delay_read = 3;
        LWIP_UNUSED_ARG(len);
#else
        file->len = len;
#endif
        file->flags = FS_FILE_FLAGS_HEADER_PERSISTENT;
        data->f = &f;
        file->pextension = data;
        return 1;
      //}
    }
    //fclose(f);
    f_close(&f);
  }
  return 0;
}
 
void
fs_close_custom(struct fs_file *file)
{
  if (file && file->pextension) {
    struct fs_custom_data *data = (struct fs_custom_data *)file->pextension;
    if (data->f != NULL) {
      //fclose(data->f);
      f_close(data->f);
      data->f = NULL;
    }
    mem_free(data);
  }
}
 
#if LWIP_HTTPD_FS_ASYNC_READ
u8_t
fs_canread_custom(struct fs_file *file)
{
  /* This function is only necessary for asynchronous I/O:
     If reading would block, return 0 and implement fs_wait_read_custom() to call the
     supplied callback if reading works. */
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
  struct fs_custom_data *data;
  LWIP_ASSERT("file != NULL", file != NULL);
  data = (struct fs_custom_data *)file->pextension;
  if (data == NULL) {
    /* file transfer has been completed already */
    LWIP_ASSERT("transfer complete", file->index == file->len);
    return 1;
  }
  LWIP_ASSERT("data != NULL", data != NULL);
  /* This just simulates a simple delay. This delay would normally come e.g. from SPI transfer */
  if (data->delay_read == 3) {
    /* delayed file size mode */
    data->delay_read = 1;
    LWIP_ASSERT("", file->len == 0);
    if (!fseek(data->f, 0, SEEK_END)) {
      int len = (int)ftell(data->f);
      if(!fseek(data->f, 0, SEEK_SET)) {
        file->len = len; /* read size delayed */
        data->delay_read = 1;
        return 0;
      }
    }
    /* if we come here, something is wrong with the file */
    LWIP_ASSERT("file error", 0);
  }
  if (data->delay_read == 1) {
    /* tell read function to delay further */
  }
#endif
  LWIP_UNUSED_ARG(file);
  return 1;
}
 
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
static void
fs_example_read_cb(void *arg)
{
  struct fs_custom_data *data = (struct fs_custom_data *)arg;
  fs_wait_cb callback_fn = data->callback_fn;
  void *callback_arg = data->callback_arg;
  data->callback_fn = NULL;
  data->callback_arg = NULL;
 
  LWIP_ASSERT("no callback_fn", callback_fn != NULL);
 
  callback_fn(callback_arg);
}
#endif
 
u8_t
fs_wait_read_custom(struct fs_file *file, fs_wait_cb callback_fn, void *callback_arg)
{
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
  err_t err;
  struct fs_custom_data *data = (struct fs_custom_data *)file->pextension;
  LWIP_ASSERT("data not set", data != NULL);
  data->callback_fn = callback_fn;
  data->callback_arg = callback_arg;
  err = tcpip_try_callback(fs_example_read_cb, data);
  LWIP_ASSERT("out of queue elements?", err == ERR_OK);
  LWIP_UNUSED_ARG(err);
#else
  LWIP_ASSERT("not implemented in this example configuration", 0);
#endif
  LWIP_UNUSED_ARG(file);
  LWIP_UNUSED_ARG(callback_fn);
  LWIP_UNUSED_ARG(callback_arg);
  /* Return
     - 0 if ready to read (at least one byte)
     - 1 if reading should be delayed (call 'tcpip_callback(callback_fn, callback_arg)' when ready) */
  return 1;
}
 
int
fs_read_async_custom(struct fs_file *file, char *buffer, int count, fs_wait_cb callback_fn, void *callback_arg)
{
  struct fs_custom_data *data = (struct fs_custom_data *)file->pextension;
  //FILE *f;
  FIL *f;
  int len;
  int read_count = count;
  LWIP_ASSERT("data not set", data != NULL);
 
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
  /* This just simulates a delay. This delay would normally come e.g. from SPI transfer */
  LWIP_ASSERT("invalid state", data->delay_read >= 0 && data->delay_read <= 2);
  if (data->delay_read == 2) {
    /* no delay next time */
    data->delay_read = 0;
    return FS_READ_DELAYED;
  } else if (data->delay_read == 1) {
    err_t err;
    /* execute requested delay */
    data->delay_read = 2;
    LWIP_ASSERT("duplicate callback request", data->callback_fn == NULL);
    data->callback_fn = callback_fn;
    data->callback_arg = callback_arg;
    err = tcpip_try_callback(fs_example_read_cb, data);
    LWIP_ASSERT("out of queue elements?", err == ERR_OK);
    LWIP_UNUSED_ARG(err);
    return FS_READ_DELAYED;
  }
  /* execute this read but delay the next one */
  data->delay_read = 1;
#endif
 
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ
  read_count = LWIP_MIN(read_count, LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ);
#endif
 
  f = data->f;
  //len = (int)fread(buffer, 1, read_count, f);
  f_read(f, buffer,read_count, &len);
 
  LWIP_UNUSED_ARG(callback_fn);
  LWIP_UNUSED_ARG(callback_arg);
 
  file->index += len;
 
  /* Return
     - FS_READ_EOF if all bytes have been read
     - FS_READ_DELAYED if reading is delayed (call 'tcpip_callback(callback_fn, callback_arg)' when done) */
  if (len == 0) {
    /* all bytes read already */
    return FS_READ_EOF;
  }
  return len;
}
 
#else /* LWIP_HTTPD_FS_ASYNC_READ */
int
fs_read_custom(struct fs_file *file, char *buffer, int count)
{
  struct fs_custom_data *data = (struct fs_custom_data *)file->pextension;
  FILE *f;
  int len;
  int read_count = count;
  LWIP_ASSERT("data not set", data != NULL);
 
#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ
  read_count = LWIP_MIN(read_count, LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ);
#endif
 
  f = data->f;
  len = (int)fread(buffer, 1, read_count, f);
 
  file->index += len;
 
  /* Return FS_READ_EOF if all bytes have been read */
  return len;
}
 
#endif /* LWIP_HTTPD_FS_ASYNC_READ */
#endif /* LWIP_HTTPD_CUSTOM_FILES */
 
#endif /* LWIP_HTTPD_EXAMPLE_CUSTOMFILES */

lwipopts.h

  
#ifndef __LWIPOPTS_H__
#define __LWIPOPTS_H__
 
// Common settings used in most of the pico_w examples
// (see https://www.nongnu.org/lwip/2_1_x/group__lwip__opts.html for details)
 
// allow override in some examples
#ifndef NO_SYS
#define NO_SYS                      1
#endif
// allow override in some examples
#ifndef LWIP_SOCKET
#define LWIP_SOCKET                 0
#endif
#if PICO_CYW43_ARCH_POLL
#define MEM_LIBC_MALLOC             1
#else
// MEM_LIBC_MALLOC is incompatible with non polling versions
#define MEM_LIBC_MALLOC             0
#endif
#define MEM_ALIGNMENT               4
#define MEM_SIZE                    4000
#define MEMP_NUM_TCP_SEG            32
#define MEMP_NUM_ARP_QUEUE          10
#define PBUF_POOL_SIZE              24
#define LWIP_ARP                    1
#define LWIP_ETHERNET               1
#define LWIP_ICMP                   1
#define LWIP_RAW                    1
#define TCP_WND                     (8 * TCP_MSS)
#define TCP_MSS                     1460
#define TCP_SND_BUF                 (8 * TCP_MSS)
#define TCP_SND_QUEUELEN            ((4 * (TCP_SND_BUF) + (TCP_MSS - 1)) / (TCP_MSS))
#define LWIP_NETIF_STATUS_CALLBACK  1
#define LWIP_NETIF_LINK_CALLBACK    1
#define LWIP_NETIF_HOSTNAME         1
#define LWIP_NETCONN                0
#define MEM_STATS                   0
#define SYS_STATS                   0
#define MEMP_STATS                  0
#define LINK_STATS                  0
// #define ETH_PAD_SIZE                2
#define LWIP_CHKSUM_ALGORITHM       3
#define LWIP_DHCP                   1
#define LWIP_IPV4                   1
#define LWIP_TCP                    1
#define LWIP_UDP                    1
#define LWIP_DNS                    1
#define LWIP_TCP_KEEPALIVE          1
#define LWIP_NETIF_TX_SINGLE_PBUF   1
#define DHCP_DOES_ARP_CHECK         0
#define LWIP_DHCP_DOES_ACD_CHECK    0
 
#ifndef NDEBUG
#define LWIP_DEBUG                  1
#define LWIP_STATS                  1
#define LWIP_STATS_DISPLAY          1
#endif
 
#define ETHARP_DEBUG                LWIP_DBG_OFF
#define NETIF_DEBUG                 LWIP_DBG_OFF
#define PBUF_DEBUG                  LWIP_DBG_OFF
#define API_LIB_DEBUG               LWIP_DBG_OFF
#define API_MSG_DEBUG               LWIP_DBG_OFF
#define SOCKETS_DEBUG               LWIP_DBG_OFF
#define ICMP_DEBUG                  LWIP_DBG_OFF
#define INET_DEBUG                  LWIP_DBG_OFF
#define IP_DEBUG                    LWIP_DBG_OFF
#define IP_REASS_DEBUG              LWIP_DBG_OFF
#define RAW_DEBUG                   LWIP_DBG_OFF
#define MEM_DEBUG                   LWIP_DBG_OFF
#define MEMP_DEBUG                  LWIP_DBG_OFF
#define SYS_DEBUG                   LWIP_DBG_OFF
#define TCP_DEBUG                   LWIP_DBG_OFF
#define TCP_INPUT_DEBUG             LWIP_DBG_OFF
#define TCP_OUTPUT_DEBUG            LWIP_DBG_OFF
#define TCP_RTO_DEBUG               LWIP_DBG_OFF
#define TCP_CWND_DEBUG              LWIP_DBG_OFF
#define TCP_WND_DEBUG               LWIP_DBG_OFF
#define TCP_FR_DEBUG                LWIP_DBG_OFF
#define TCP_QLEN_DEBUG              LWIP_DBG_OFF
#define TCP_RST_DEBUG               LWIP_DBG_OFF
#define UDP_DEBUG                   LWIP_DBG_OFF
#define TCPIP_DEBUG                 LWIP_DBG_OFF
#define PPP_DEBUG                   LWIP_DBG_OFF
#define SLIP_DEBUG                  LWIP_DBG_OFF
#define DHCP_DEBUG                  LWIP_DBG_OFF
 
/*  in Pico-SDK above 1.5.0 */
#define MEMP_NUM_SYS_TIMEOUT            (LWIP_NUM_SYS_TIMEOUT_INTERNAL+1)
/* TCP WND must be at least 16 kb to match TLS record size
   or you will get a warning "altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!" */
// tls
#undef TCP_WND
#define TCP_WND  16384
 
#define LWIP_ALTCP               1
#define LWIP_ALTCP_TLS           1
#define LWIP_ALTCP_TLS_MBEDTLS   1
 
#define LWIP_DEBUG 1
#define ALTCP_MBEDTLS_DEBUG  LWIP_DBG_ON
 
/* set authmode */
#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_NONE
//#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_REQUIRED
 
// httpd
#define HTTPD_ENABLE_HTTPS          1   // enable https
 
#define LWIP_HTTPD 1
//#define LWIP_HTTPD_SSI 1
//#define LWIP_HTTPD_CGI 1
//#define LWIP_HTTPD_SSI_MULTIPART 1
//#define LWIP_HTTPD_SUPPORT_POST 1
//#define LWIP_HTTPD_SSI_INCLUDE_TAG 0
// extern wbe page files
#define LWIP_HTTPD_CUSTOM_FILES 1
#define LWIP_HTTPD_DYNAMIC_HEADERS 1
#define LWIP_HTTPD_FS_ASYNC_READ 1
#define LWIP_HTTPD_DYNAMIC_FILE_READ 1
#define LWIP_HTTPD_FILE_EXTENSION 1
 
#endif /* __LWIPOPTS_H__ */

mbedtls_config.h

  
/* Workaround for some mbedtls source files using INT_MAX without including limits.h */
#include <limits.h>
 
#define MBEDTLS_NO_PLATFORM_ENTROPY
#define MBEDTLS_ENTROPY_HARDWARE_ALT
 
#define MBEDTLS_SSL_OUT_CONTENT_LEN    2048
 
#define MBEDTLS_ALLOW_PRIVATE_ACCESS
#define MBEDTLS_HAVE_TIME
#define MBEDTLS_HAVE_TIME_DATE
 
#define MBEDTLS_CIPHER_MODE_CBC
#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
#define MBEDTLS_ECP_DP_BP256R1_ENABLED
#define MBEDTLS_ECP_DP_BP384R1_ENABLED
#define MBEDTLS_ECP_DP_BP512R1_ENABLED
#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
#define MBEDTLS_PKCS1_V15
#define MBEDTLS_SHA256_SMALLER
#define MBEDTLS_SSL_SERVER_NAME_INDICATION
#define MBEDTLS_AES_C
#define MBEDTLS_ASN1_PARSE_C
#define MBEDTLS_BIGNUM_C
#define MBEDTLS_CIPHER_C
#define MBEDTLS_CTR_DRBG_C
#define MBEDTLS_ENTROPY_C
#define MBEDTLS_ERROR_C
#define MBEDTLS_MD_C
#define MBEDTLS_MD5_C
#define MBEDTLS_OID_C
#define MBEDTLS_PKCS5_C
#define MBEDTLS_PK_C
#define MBEDTLS_PK_PARSE_C
#define MBEDTLS_PLATFORM_C
#define MBEDTLS_RSA_C
#define MBEDTLS_SHA1_C
#define MBEDTLS_SHA224_C
#define MBEDTLS_SHA256_C
#define MBEDTLS_SHA512_C
#define MBEDTLS_SSL_CLI_C
#define MBEDTLS_SSL_SRV_C
#define MBEDTLS_SSL_TLS_C
#define MBEDTLS_X509_CRT_PARSE_C
#define MBEDTLS_X509_USE_C
#define MBEDTLS_AES_FEWER_TABLES
 
/* TLS 1.2 */
#define MBEDTLS_SSL_PROTO_TLS1_2
#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
#define MBEDTLS_GCM_C
#define MBEDTLS_ECDH_C
#define MBEDTLS_ECP_C
#define MBEDTLS_ECDSA_C
#define MBEDTLS_ASN1_WRITE_C
 
// The following is needed to parse a certificate
#define MBEDTLS_PEM_PARSE_C
#define MBEDTLS_BASE64_C

微控制器應用實驗室

prettyprint

2023年12月7日星期四

Raspberry Pi Pico W || LwIP || MbedTLS: EP.1 HTTPS server self-signed Certificate setup & web page files in SD

沒有留言:

張貼留言

	/* in Pico-SDK above 1.5.0 */
	#define MEMP_NUM_SYS_TIMEOUT (LWIP_NUM_SYS_TIMEOUT_INTERNAL+1)
	/* TCP WND must be at least 16 kb to match TLS record size
	or you will get a warning "altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!" */
	// tls
	#undef TCP_WND
	#define TCP_WND 16384

	#define LWIP_ALTCP 1
	#define LWIP_ALTCP_TLS 1
	#define LWIP_ALTCP_TLS_MBEDTLS 1

	#define LWIP_DEBUG 1
	#define ALTCP_MBEDTLS_DEBUG LWIP_DBG_ON

	/* set authmode */
	#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_NONE
	//#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_REQUIRED


	# Generated Cmake Pico project file

	cmake_minimum_required(VERSION 3.13)

	set(CMAKE_C_STANDARD 11)
	set(CMAKE_CXX_STANDARD 17)

	# Initialise pico_sdk from installed location
	# (note this can come from environment, CMake cache etc)
	set(PICO_SDK_PATH "/home/duser/pico/pico-sdk")

	set(PICO_BOARD pico_w CACHE STRING "Board type")

	# Pull in Raspberry Pi Pico SDK (must be before project)
	include(pico_sdk_import.cmake)

	if (PICO_SDK_VERSION_STRING VERSION_LESS "1.4.0")
	message(FATAL_ERROR "Raspberry Pi Pico SDK version 1.4.0 (or later) required. Your version is ${PICO_SDK_VERSION_STRING}")
	endif()

	project(picow_https_server C CXX ASM)

	# Initialise the Raspberry Pi Pico SDK
	pico_sdk_init()

	# Add executable. Default name is the project name, version 0.1

	add_executable(picow_https_server
	picow_https_server.c
	fs_example.c)

	add_definitions(
	-DSNTP_SERVER_DNS=1
	-DSNTP_SERVER_ADDRESS="pool.ntp.org"
	-DSNTP_SET_SYSTEM_TIME=sntp_set_system_time
	-DSNTP_STARTUP_DELAY=0
	)

	pico_set_program_name(picow_https_server "picow_https_server")
	pico_set_program_version(picow_https_server "0.1")

	pico_enable_stdio_uart(picow_https_server 1)
	pico_enable_stdio_usb(picow_https_server 0)

	# Add the standard library to the build
	target_link_libraries(picow_https_server
	pico_stdlib)

	# Add the standard include files to the build
	target_include_directories(picow_https_server PRIVATE
	${CMAKE_CURRENT_LIST_DIR}
	${CMAKE_CURRENT_LIST_DIR}/.. # for our common lwipopts or any other standard includes, if required
	)

	# Add any user requested libraries
	target_link_libraries(picow_https_server
	pico_cyw43_arch_lwip_poll
	pico_lwip_sntp
	pico_lwip_http
	pico_mbedtls
	pico_lwip_mbedtls
	)

	add_subdirectory(pico_storage_drv)
	target_link_libraries(picow_https_server
	pico_storage_drv
	)

	pico_add_extra_outputs(picow_https_server)


	#include < stdio.h >
	#include "pico/stdlib.h"
	#include "pico/cyw43_arch.h"

	#include "lwip/altcp_tls.h"
	#include "lwip/altcp_tcp.h"
	#include "lwip/altcp.h"
	#include "lwip/apps/httpd.h"
	#include "lwip/apps/sntp.h"

	#include "picow_https_cert.h"
	#include "ff.h"
	#include "pico_storage.h"


	#define WIFI_SSID "your-ssid"
	#define WIFI_PASSWORD "your-password"

	struct altcp_tls_config {
	mbedtls_ssl_config conf;
	mbedtls_x509_crt *cert;
	mbedtls_pk_context *pkey;
	u8_t cert_count;
	u8_t cert_max;
	u8_t pkey_count;
	u8_t pkey_max;
	mbedtls_x509_crt *ca;
	#if defined(MBEDTLS_SSL_CACHE_C) && ALTCP_MBEDTLS_USE_SESSION_CACHE
	/** Inter-connection cache for fast connection startup */
	struct mbedtls_ssl_cache_context cache;
	#endif
	#if defined(MBEDTLS_SSL_SESSION_TICKETS) && ALTCP_MBEDTLS_USE_SESSION_TICKETS
	mbedtls_ssl_ticket_context ticket_ctx;
	#endif
	};

	struct altcp_tls_config *tls_config = NULL;

	void fs_ex_init(const char *httpd_root_dir);

	void netif_status_cb(struct netif *netif) {
	if (netif_is_link_up(netif)) {
	ip_addr_t ipaddr;
	ip_addr_t netmask;
	ip_addr_t gateway;
	ipaddr_aton("192.168.1.70", &ipaddr);
	ipaddr_aton("255.255.255.0", &netmask);
	ipaddr_aton("192.168.1.1", &gateway);

	netif_set_addr(netif, &ipaddr, &netmask, &gateway);
	}
	}

	void sntp_set_system_time(uint32_t sec, uint32_t us)
	{
	struct tm info;
	time_t tim = sec;
	struct timeval tmv;
	tmv.tv_sec=sec;
	tmv.tv_usec=us;
	settimeofday(&tmv, 0);
	printf("set time :%s\n", ctime(&tim));
	sntp_stop();
	}

	int main()
	{
	stdio_init_all();

	if (cyw43_arch_init()) {
	printf("cyw43 arch init error\n");
	return 0;
	}
	//1. connect to WiFi network and set static IP
	cyw43_arch_enable_sta_mode();
	netif_set_status_callback(netif_default, netif_status_cb);
	int wifi_stat = cyw43_arch_wifi_connect_timeout_ms(WIFI_SSID, WIFI_PASSWORD, CYW43_AUTH_WPA2_AES_PSK, 30000);
	if (wifi_stat) {
	printf("wifi connect error:%d\n", wifi_stat);
	return 0;
	}
	printf("Wifi connected\n");
	printf("get ip addr:%s\n",ipaddr_ntoa(&(cyw43_state.netif[0].ip_addr)));

	// 2. set SNTP
	sntp_setoperatingmode(SNTP_OPMODE_POLL);
	sntp_init();

	// 3. set TLS connection
	tls_config = altcp_tls_create_config_server_privkey_cert(SERVER_KEY, sizeof(SERVER_KEY), NULL, 0, SERVER_CERT, sizeof(SERVER_CERT));
	mbedtls_x509_crt_parse(tls_config->cert, CA_CERT, sizeof(CA_CERT));

	//4. mount FS in SD card and start https server
	FATFS fs;
	FIL fil;
	FRESULT res;
	if (f_mount(&fs, SDMMC_PATH, 1) != FR_OK) {
	printf("mount error\n");
	return 0;
	}
	fs_ex_init(SDMMC_PATH"/");
	httpd_inits(tls_config);

	time_t tm;
	while(1) {
	cyw43_arch_poll();
	sleep_ms(50);

	}


	return 0;
	}


	/**
	* @file
	* HTTPD custom file system example
	*
	* This file demonstrates how to add support for an external file system to httpd.
	* It provides access to the specified root directory and uses stdio.h file functions
	* to read files.
	*
	* ATTENTION: This implementation is not secure: no checks are added to ensure
	* files are only read below the specified root directory!
	*/

	/*
	* Copyright (c) 2017 Simon Goldschmidt
	* All rights reserved.
	*
	* Redistribution and use in source and binary forms, with or without modification,
	* are permitted provided that the following conditions are met:
	*
	* 1. Redistributions of source code must retain the above copyright notice,
	* this list of conditions and the following disclaimer.
	* 2. Redistributions in binary form must reproduce the above copyright notice,
	* this list of conditions and the following disclaimer in the documentation
	* and/or other materials provided with the distribution.
	* 3. The name of the author may not be used to endorse or promote products
	* derived from this software without specific prior written permission.
	*
	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED
	* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
	* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT
	* SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
	* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT
	* OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
	* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
	* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
	* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
	* OF SUCH DAMAGE.
	*
	* This file is part of the lwIP TCP/IP stack.
	*
	* Author: Simon Goldschmidt < goldsimon@gmx.de >
	*
	*/

	#include "lwip/opt.h"


	#include "lwip/apps/fs.h"
	#include "lwip/def.h"
	#include "lwip/mem.h"

	#include "stdio.h"
	#include "string.h"
	#include "ff.h"
	#include "pico_storage.h"

	/** define LWIP_HTTPD_EXAMPLE_CUSTOMFILES to 1 to enable this file system */
	#ifndef LWIP_HTTPD_EXAMPLE_CUSTOMFILES
	#define LWIP_HTTPD_EXAMPLE_CUSTOMFILES 1
	#endif

	/** define LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED to 1 to delay open and read
	* as if e.g. reading from external SPI flash */
	#ifndef LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
	#define LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED 0
	#endif

	/** define LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ to the number of bytes
	* to read to emulate limited transfer buffers and don't read whole files in
	* one chunk.
	* WARNING: lowering this slows down the connection!
	*/
	#ifndef LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ
	#define LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ 0
	#endif

	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES

	#if !LWIP_HTTPD_CUSTOM_FILES
	#error This needs LWIP_HTTPD_CUSTOM_FILES
	#endif
	#if !LWIP_HTTPD_DYNAMIC_HEADERS
	#error This needs LWIP_HTTPD_DYNAMIC_HEADERS
	#endif
	#if !LWIP_HTTPD_DYNAMIC_FILE_READ
	#error This wants to demonstrate read-after-open, so LWIP_HTTPD_DYNAMIC_FILE_READ is required!
	#endif
	#if !LWIP_HTTPD_FS_ASYNC_READ
	#error This needs LWIP_HTTPD_FS_ASYNC_READ
	#endif
	#if !LWIP_HTTPD_FILE_EXTENSION
	#error This needs LWIP_HTTPD_FILE_EXTENSION
	#endif

	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
	#include "lwip/tcpip.h"
	#endif

	struct fs_custom_data {
	//FILE *f;
	FIL *f;
	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
	int delay_read;
	fs_wait_cb callback_fn;
	void *callback_arg;
	#endif
	};

	const char* fs_ex_root_dir;

	void
	fs_ex_init(const char *httpd_root_dir)
	{
	fs_ex_root_dir = strdup(httpd_root_dir);
	}

	#if LWIP_HTTPD_CUSTOM_FILES
	int
	fs_open_custom(struct fs_file file, const char name)
	{
	char full_filename[256];
	//FILE *f;
	FIL f;
	FRESULT res;
	snprintf(full_filename, 255, "%s%s", fs_ex_root_dir, name);
	full_filename[255] = 0;

	//f = fopen(full_filename, "rb");
	res =f_open(&f, full_filename, FA_READ);
	//if (f != NULL) {
	if (res == FR_OK) {
	//if (!fseek(f, 0, SEEK_END)) {
	if (f_lseek(&f, 0) == FR_OK) {
	//int len = (int)ftell(f);
	int len = (int)f_size(&f);
	//if(!fseek(f, 0, SEEK_SET)) {
	struct fs_custom_data data = (struct fs_custom_data )mem_malloc(sizeof(struct fs_custom_data));
	LWIP_ASSERT("out of memory?", data != NULL);
	memset(file, 0, sizeof(struct fs_file));
	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
	file->len = 0; /* read size delayed */
	data->delay_read = 3;
	LWIP_UNUSED_ARG(len);
	#else
	file->len = len;
	#endif
	file->flags = FS_FILE_FLAGS_HEADER_PERSISTENT;
	data->f = &f;
	file->pextension = data;
	return 1;
	//}
	}
	//fclose(f);
	f_close(&f);
	}
	return 0;
	}

	void
	fs_close_custom(struct fs_file *file)
	{
	if (file && file->pextension) {
	struct fs_custom_data data = (struct fs_custom_data )file->pextension;
	if (data->f != NULL) {
	//fclose(data->f);
	f_close(data->f);
	data->f = NULL;
	}
	mem_free(data);
	}
	}

	#if LWIP_HTTPD_FS_ASYNC_READ
	u8_t
	fs_canread_custom(struct fs_file *file)
	{
	/* This function is only necessary for asynchronous I/O:
	If reading would block, return 0 and implement fs_wait_read_custom() to call the
	supplied callback if reading works. */
	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
	struct fs_custom_data *data;
	LWIP_ASSERT("file != NULL", file != NULL);
	data = (struct fs_custom_data *)file->pextension;
	if (data == NULL) {
	/* file transfer has been completed already */
	LWIP_ASSERT("transfer complete", file->index == file->len);
	return 1;
	}
	LWIP_ASSERT("data != NULL", data != NULL);
	/* This just simulates a simple delay. This delay would normally come e.g. from SPI transfer */
	if (data->delay_read == 3) {
	/* delayed file size mode */
	data->delay_read = 1;
	LWIP_ASSERT("", file->len == 0);
	if (!fseek(data->f, 0, SEEK_END)) {
	int len = (int)ftell(data->f);
	if(!fseek(data->f, 0, SEEK_SET)) {
	file->len = len; /* read size delayed */
	data->delay_read = 1;
	return 0;
	}
	}
	/* if we come here, something is wrong with the file */
	LWIP_ASSERT("file error", 0);
	}
	if (data->delay_read == 1) {
	/* tell read function to delay further */
	}
	#endif
	LWIP_UNUSED_ARG(file);
	return 1;
	}

	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
	static void
	fs_example_read_cb(void *arg)
	{
	struct fs_custom_data data = (struct fs_custom_data )arg;
	fs_wait_cb callback_fn = data->callback_fn;
	void *callback_arg = data->callback_arg;
	data->callback_fn = NULL;
	data->callback_arg = NULL;

	LWIP_ASSERT("no callback_fn", callback_fn != NULL);

	callback_fn(callback_arg);
	}
	#endif

	u8_t
	fs_wait_read_custom(struct fs_file file, fs_wait_cb callback_fn, void callback_arg)
	{
	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
	err_t err;
	struct fs_custom_data data = (struct fs_custom_data )file->pextension;
	LWIP_ASSERT("data not set", data != NULL);
	data->callback_fn = callback_fn;
	data->callback_arg = callback_arg;
	err = tcpip_try_callback(fs_example_read_cb, data);
	LWIP_ASSERT("out of queue elements?", err == ERR_OK);
	LWIP_UNUSED_ARG(err);
	#else
	LWIP_ASSERT("not implemented in this example configuration", 0);
	#endif
	LWIP_UNUSED_ARG(file);
	LWIP_UNUSED_ARG(callback_fn);
	LWIP_UNUSED_ARG(callback_arg);
	/* Return
	- 0 if ready to read (at least one byte)
	- 1 if reading should be delayed (call 'tcpip_callback(callback_fn, callback_arg)' when ready) */
	return 1;
	}

	int
	fs_read_async_custom(struct fs_file file, char buffer, int count, fs_wait_cb callback_fn, void *callback_arg)
	{
	struct fs_custom_data data = (struct fs_custom_data )file->pextension;
	//FILE *f;
	FIL *f;
	int len;
	int read_count = count;
	LWIP_ASSERT("data not set", data != NULL);

	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_DELAYED
	/* This just simulates a delay. This delay would normally come e.g. from SPI transfer */
	LWIP_ASSERT("invalid state", data->delay_read >= 0 && data->delay_read <= 2);
	if (data->delay_read == 2) {
	/* no delay next time */
	data->delay_read = 0;
	return FS_READ_DELAYED;
	} else if (data->delay_read == 1) {
	err_t err;
	/* execute requested delay */
	data->delay_read = 2;
	LWIP_ASSERT("duplicate callback request", data->callback_fn == NULL);
	data->callback_fn = callback_fn;
	data->callback_arg = callback_arg;
	err = tcpip_try_callback(fs_example_read_cb, data);
	LWIP_ASSERT("out of queue elements?", err == ERR_OK);
	LWIP_UNUSED_ARG(err);
	return FS_READ_DELAYED;
	}
	/* execute this read but delay the next one */
	data->delay_read = 1;
	#endif

	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ
	read_count = LWIP_MIN(read_count, LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ);
	#endif

	f = data->f;
	//len = (int)fread(buffer, 1, read_count, f);
	f_read(f, buffer,read_count, &len);

	LWIP_UNUSED_ARG(callback_fn);
	LWIP_UNUSED_ARG(callback_arg);

	file->index += len;

	/* Return
	- FS_READ_EOF if all bytes have been read
	- FS_READ_DELAYED if reading is delayed (call 'tcpip_callback(callback_fn, callback_arg)' when done) */
	if (len == 0) {
	/* all bytes read already */
	return FS_READ_EOF;
	}
	return len;
	}

	#else /* LWIP_HTTPD_FS_ASYNC_READ */
	int
	fs_read_custom(struct fs_file file, char buffer, int count)
	{
	struct fs_custom_data data = (struct fs_custom_data )file->pextension;
	FILE *f;
	int len;
	int read_count = count;
	LWIP_ASSERT("data not set", data != NULL);

	#if LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ
	read_count = LWIP_MIN(read_count, LWIP_HTTPD_EXAMPLE_CUSTOMFILES_LIMIT_READ);
	#endif

	f = data->f;
	len = (int)fread(buffer, 1, read_count, f);

	file->index += len;

	/* Return FS_READ_EOF if all bytes have been read */
	return len;
	}

	#endif /* LWIP_HTTPD_FS_ASYNC_READ */
	#endif /* LWIP_HTTPD_CUSTOM_FILES */

	#endif /* LWIP_HTTPD_EXAMPLE_CUSTOMFILES */


	#ifndef __LWIPOPTS_H__
	#define __LWIPOPTS_H__

	// Common settings used in most of the pico_w examples
	// (see https://www.nongnu.org/lwip/2_1_x/group__lwip__opts.html for details)

	// allow override in some examples
	#ifndef NO_SYS
	#define NO_SYS 1
	#endif
	// allow override in some examples
	#ifndef LWIP_SOCKET
	#define LWIP_SOCKET 0
	#endif
	#if PICO_CYW43_ARCH_POLL
	#define MEM_LIBC_MALLOC 1
	#else
	// MEM_LIBC_MALLOC is incompatible with non polling versions
	#define MEM_LIBC_MALLOC 0
	#endif
	#define MEM_ALIGNMENT 4
	#define MEM_SIZE 4000
	#define MEMP_NUM_TCP_SEG 32
	#define MEMP_NUM_ARP_QUEUE 10
	#define PBUF_POOL_SIZE 24
	#define LWIP_ARP 1
	#define LWIP_ETHERNET 1
	#define LWIP_ICMP 1
	#define LWIP_RAW 1
	#define TCP_WND (8 * TCP_MSS)
	#define TCP_MSS 1460
	#define TCP_SND_BUF (8 * TCP_MSS)
	#define TCP_SND_QUEUELEN ((4 * (TCP_SND_BUF) + (TCP_MSS - 1)) / (TCP_MSS))
	#define LWIP_NETIF_STATUS_CALLBACK 1
	#define LWIP_NETIF_LINK_CALLBACK 1
	#define LWIP_NETIF_HOSTNAME 1
	#define LWIP_NETCONN 0
	#define MEM_STATS 0
	#define SYS_STATS 0
	#define MEMP_STATS 0
	#define LINK_STATS 0
	// #define ETH_PAD_SIZE 2
	#define LWIP_CHKSUM_ALGORITHM 3
	#define LWIP_DHCP 1
	#define LWIP_IPV4 1
	#define LWIP_TCP 1
	#define LWIP_UDP 1
	#define LWIP_DNS 1
	#define LWIP_TCP_KEEPALIVE 1
	#define LWIP_NETIF_TX_SINGLE_PBUF 1
	#define DHCP_DOES_ARP_CHECK 0
	#define LWIP_DHCP_DOES_ACD_CHECK 0

	#ifndef NDEBUG
	#define LWIP_DEBUG 1
	#define LWIP_STATS 1
	#define LWIP_STATS_DISPLAY 1
	#endif

	#define ETHARP_DEBUG LWIP_DBG_OFF
	#define NETIF_DEBUG LWIP_DBG_OFF
	#define PBUF_DEBUG LWIP_DBG_OFF
	#define API_LIB_DEBUG LWIP_DBG_OFF
	#define API_MSG_DEBUG LWIP_DBG_OFF
	#define SOCKETS_DEBUG LWIP_DBG_OFF
	#define ICMP_DEBUG LWIP_DBG_OFF
	#define INET_DEBUG LWIP_DBG_OFF
	#define IP_DEBUG LWIP_DBG_OFF
	#define IP_REASS_DEBUG LWIP_DBG_OFF
	#define RAW_DEBUG LWIP_DBG_OFF
	#define MEM_DEBUG LWIP_DBG_OFF
	#define MEMP_DEBUG LWIP_DBG_OFF
	#define SYS_DEBUG LWIP_DBG_OFF
	#define TCP_DEBUG LWIP_DBG_OFF
	#define TCP_INPUT_DEBUG LWIP_DBG_OFF
	#define TCP_OUTPUT_DEBUG LWIP_DBG_OFF
	#define TCP_RTO_DEBUG LWIP_DBG_OFF
	#define TCP_CWND_DEBUG LWIP_DBG_OFF
	#define TCP_WND_DEBUG LWIP_DBG_OFF
	#define TCP_FR_DEBUG LWIP_DBG_OFF
	#define TCP_QLEN_DEBUG LWIP_DBG_OFF
	#define TCP_RST_DEBUG LWIP_DBG_OFF
	#define UDP_DEBUG LWIP_DBG_OFF
	#define TCPIP_DEBUG LWIP_DBG_OFF
	#define PPP_DEBUG LWIP_DBG_OFF
	#define SLIP_DEBUG LWIP_DBG_OFF
	#define DHCP_DEBUG LWIP_DBG_OFF

	/* in Pico-SDK above 1.5.0 */
	#define MEMP_NUM_SYS_TIMEOUT (LWIP_NUM_SYS_TIMEOUT_INTERNAL+1)
	/* TCP WND must be at least 16 kb to match TLS record size
	or you will get a warning "altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!" */
	// tls
	#undef TCP_WND
	#define TCP_WND 16384

	#define LWIP_ALTCP 1
	#define LWIP_ALTCP_TLS 1
	#define LWIP_ALTCP_TLS_MBEDTLS 1

	#define LWIP_DEBUG 1
	#define ALTCP_MBEDTLS_DEBUG LWIP_DBG_ON

	/* set authmode */
	#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_NONE
	//#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_REQUIRED

	// httpd
	#define HTTPD_ENABLE_HTTPS 1 // enable https

	#define LWIP_HTTPD 1
	//#define LWIP_HTTPD_SSI 1
	//#define LWIP_HTTPD_CGI 1
	//#define LWIP_HTTPD_SSI_MULTIPART 1
	//#define LWIP_HTTPD_SUPPORT_POST 1
	//#define LWIP_HTTPD_SSI_INCLUDE_TAG 0
	// extern wbe page files
	#define LWIP_HTTPD_CUSTOM_FILES 1
	#define LWIP_HTTPD_DYNAMIC_HEADERS 1
	#define LWIP_HTTPD_FS_ASYNC_READ 1
	#define LWIP_HTTPD_DYNAMIC_FILE_READ 1
	#define LWIP_HTTPD_FILE_EXTENSION 1

	#endif /* __LWIPOPTS_H__ */


	/* Workaround for some mbedtls source files using INT_MAX without including limits.h */
	#include <limits.h>

	#define MBEDTLS_NO_PLATFORM_ENTROPY
	#define MBEDTLS_ENTROPY_HARDWARE_ALT

	#define MBEDTLS_SSL_OUT_CONTENT_LEN 2048

	#define MBEDTLS_ALLOW_PRIVATE_ACCESS
	#define MBEDTLS_HAVE_TIME
	#define MBEDTLS_HAVE_TIME_DATE

	#define MBEDTLS_CIPHER_MODE_CBC
	#define MBEDTLS_ECP_DP_SECP192R1_ENABLED
	#define MBEDTLS_ECP_DP_SECP224R1_ENABLED
	#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
	#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
	#define MBEDTLS_ECP_DP_SECP521R1_ENABLED
	#define MBEDTLS_ECP_DP_SECP192K1_ENABLED
	#define MBEDTLS_ECP_DP_SECP224K1_ENABLED
	#define MBEDTLS_ECP_DP_SECP256K1_ENABLED
	#define MBEDTLS_ECP_DP_BP256R1_ENABLED
	#define MBEDTLS_ECP_DP_BP384R1_ENABLED
	#define MBEDTLS_ECP_DP_BP512R1_ENABLED
	#define MBEDTLS_ECP_DP_CURVE25519_ENABLED
	#define MBEDTLS_KEY_EXCHANGE_RSA_ENABLED
	#define MBEDTLS_PKCS1_V15
	#define MBEDTLS_SHA256_SMALLER
	#define MBEDTLS_SSL_SERVER_NAME_INDICATION
	#define MBEDTLS_AES_C
	#define MBEDTLS_ASN1_PARSE_C
	#define MBEDTLS_BIGNUM_C
	#define MBEDTLS_CIPHER_C
	#define MBEDTLS_CTR_DRBG_C
	#define MBEDTLS_ENTROPY_C
	#define MBEDTLS_ERROR_C
	#define MBEDTLS_MD_C
	#define MBEDTLS_MD5_C
	#define MBEDTLS_OID_C
	#define MBEDTLS_PKCS5_C
	#define MBEDTLS_PK_C
	#define MBEDTLS_PK_PARSE_C
	#define MBEDTLS_PLATFORM_C
	#define MBEDTLS_RSA_C
	#define MBEDTLS_SHA1_C
	#define MBEDTLS_SHA224_C
	#define MBEDTLS_SHA256_C
	#define MBEDTLS_SHA512_C
	#define MBEDTLS_SSL_CLI_C
	#define MBEDTLS_SSL_SRV_C
	#define MBEDTLS_SSL_TLS_C
	#define MBEDTLS_X509_CRT_PARSE_C
	#define MBEDTLS_X509_USE_C
	#define MBEDTLS_AES_FEWER_TABLES

	/* TLS 1.2 */
	#define MBEDTLS_SSL_PROTO_TLS1_2
	#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
	#define MBEDTLS_GCM_C
	#define MBEDTLS_ECDH_C
	#define MBEDTLS_ECP_C
	#define MBEDTLS_ECDSA_C
	#define MBEDTLS_ASN1_WRITE_C

	// The following is needed to parse a certificate
	#define MBEDTLS_PEM_PARSE_C
	#define MBEDTLS_BASE64_C

prettyprint

2023年12月7日 星期四

Raspberry Pi Pico W || LwIP || MbedTLS: EP.1 HTTPS server self-signed Certificate setup & web page files in SD

沒有留言:

張貼留言

2023年12月7日星期四