samples/net : Adding mbedTLS sample client

/*

 *  Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites

 *

 *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved

 *  SPDX-License-Identifier: Apache-2.0

 *

 *  Licensed under the Apache License, Version 2.0 (the "License"); you may

 *  not use this file except in compliance with the License.

 *  You may obtain a copy of the License at

 *

 *  http://www.apache.org/licenses/LICENSE-2.0

 *

 *  Unless required by applicable law or agreed to in writing, software

 *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT

 *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 *  See the License for the specific language governing permissions and

 *  limitations under the License.

 *

 *  This file is part of mbed TLS (https://tls.mbed.org)

 */

/*

 * Minimal configuration for TLS 1.2 with PSK and AES-CCM ciphersuites

 * Distinguishing features:

 * - no bignum, no PK, no X509

 * - fully modern and secure (provided the pre-shared keys have high entropy)

 * - very low record overhead with CCM-8

 * - optimized for low RAM usage

 *

 * See README.txt for usage instructions.

 */

#ifndef MBEDTLS_CONFIG_H

#define MBEDTLS_CONFIG_H

/* System support */

#define MBEDTLS_HAVE_ASM

#define MBEDTLS_PLATFORM_C

#define MBEDTLS_PLATFORM_MEMORY

#define MBEDTLS_MEMORY_BUFFER_ALLOC_C

#define MBEDTLS_PLATFORM_NO_STD_FUNCTIONS

#define MBEDTLS_PLATFORM_EXIT_ALT

#define MBEDTLS_NO_PLATFORM_ENTROPY

#define MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES

#define MBEDTLS_PLATFORM_PRINTF_ALT

#define MBEDTLS_PLATFORM_TIME_TYPE_MACRO int

#if defined(CONFIG_MBEDTLS_TEST)

#define MBEDTLS_SELF_TEST

#define MBEDTLS_DEBUG_C

#else

#define MBEDTLS_ENTROPY_C

#endif

/* mbed TLS feature support */

#define MBEDTLS_KEY_EXCHANGE_PSK_ENABLED

#define MBEDTLS_SSL_PROTO_TLS1_2

/* mbed TLS modules */

#define MBEDTLS_AES_C

#define MBEDTLS_CCM_C

#define MBEDTLS_CIPHER_C

#define MBEDTLS_CTR_DRBG_C

#define MBEDTLS_MD_C

#define MBEDTLS_SHA256_C

#define MBEDTLS_SSL_CLI_C

#define MBEDTLS_SSL_SRV_C

#define MBEDTLS_SSL_TLS_C

/* Save RAM at the expense of ROM */

#define MBEDTLS_AES_ROM_TABLES

/* Save some RAM by adjusting to your exact needs */

#define MBEDTLS_PSK_MAX_LEN    16 /* 128-bits keys are generally enough */

/*

 * You should adjust this to the exact number of sources you're using: default

 * is the "platform_entropy_poll" source, but you may want to add other ones

 * Minimum is 2 for the entropy test suite.

 */

#define MBEDTLS_ENTROPY_MAX_SOURCES 2

/*

 * Use only CCM_8 ciphersuites, and

 * save ROM and a few bytes of RAM by specifying our own ciphersuite list

 */

#define MBEDTLS_SSL_CIPHERSUITES                        \

        MBEDTLS_TLS_PSK_WITH_AES_256_CCM_8,             \

        MBEDTLS_TLS_PSK_WITH_AES_128_CCM_8

/*

 * Save RAM at the expense of interoperability: do this only if you control

 * both ends of the connection!  (See comments in "mbedtls/ssl.h".)

 * The optimal size here depends on the typical size of records.

 */

#define MBEDTLS_SSL_MAX_CONTENT_LEN             512

#include "mbedtls/check_config.h"

#endif /* MBEDTLS_CONFIG_H */

#

# Copyright (c) 2016 Intel Corporation

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#     http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

#

KERNEL_TYPE = nano

BOARD = galileo

CONF_FILE = prj_galileo.conf

include $(ZEPHYR_BASE)/Makefile.inc

mbed TLS ssl client

+++++++++++

This sample code shows a simple client using mbed TLS on top of Zephyr

Prerequisites

=============

- Galileo Gen 2 Development Board

- USB to UART TTL (CH340, FTDI or equivalent)

- PC with Linux.

- screen command and gcc compiler

- LAN for testing purposes

Procedure

=========

a) Change the server, netmask and client addresses according to your network

   in src/tcp_cfg.h.

b) From a terminal window, type:

    make pristine && make BOARD=galileo

c) Copy the binary (outdir/zephyr.strip) to the Galileo's boot

   device. Insert the boot device.

d) Plug the USB side of the USB-UART cable to the PC.

   Connect the USB-UART cable to the Galileo.

   Connect the Galileo to the LAN.

e) Open a terminal window, type:

    screen /dev/ttyUSB0 115200

f) Obtain the mbed TLS code from and put it in a well know directory, in

   your Linux machine, this will be your server.

	- https://tls.mbed.org/download/start/mbedtls-2.3.0-apache.tgz

g) cd to that directory and start the server using a the preshared key

# tar -xvzf mbedtls-2.3.0-apache.tgz

# cd mbedtls-2.3.0

# CFLAGS="-I$PWD/configs -DMBEDTLS_CONFIG_FILE='<config-ccm-psk-tls1_2.h>'" make

# ./programs/ssl/ssl_server2 psk=000102030405060708090a0b0c0d0e0f

You should see something like this

  . Seeding the random number generator... ok

  . Bind on tcp://*:4433/ ... ok

  . Setting up the SSL/TLS structure... ok

  . Waiting for a remote connection ...

h) Power-up the board

i) 'screen' will show this after a few seconds:

WARNING: no console will be available to OS

error: no suitable video mode found.

  . Seeding the random number generator... ok

  . Setting up the SSL/TLS structure... ok

  . Connecting to tcp/localhost/4433... ok

  . Performing the SSL/TLS handshake... ok

  > Write to server: ok

  . Closing the connection... done

j) The server side should print

  . Waiting for a remote connection ... ok

  . Performing the SSL/TLS handshake... ok

    [ Protocol is TLSv1.2 ]

    [ Ciphersuite is TLS-PSK-WITH-AES-256-CCM-8 ]

    [ Record expansion is 21 ]

  < Read from client: 18 bytes read

GET / HTTP/1.0

  > Write to client: 139 bytes written in 1 fragments

HTTP/1.0 200 OK

Content-Type: text/html

<h2>mbed TLS Test Server</h2>

<p>Successful connection using: TLS-PSK-WITH-AES-256-CCM-8</p>

  . Closing the connection... done

Troubleshooting

===============

- If the server does not receive the  messages, use a network

  traffic analyzer, like Wireshark.

- Reset the board

References

==========

[1] https://www.zephyrproject.org/doc/getting_started/getting_started.html

[2] https://wiki.zephyrproject.org/view/Galileo_Gen1_Gen2

[3] https://tls.mbed.org/

CONFIG_STDOUT_CONSOLE=y

CONFIG_MINIMAL_LIBC_EXTENDED=y

CONFIG_TEST_RANDOM_GENERATOR=y

CONFIG_NETWORKING=y

CONFIG_ETHERNET=y

CONFIG_ETH_DW=y

CONFIG_NANO_TIMEOUTS=y

CONFIG_NETWORKING_WITH_TCP=y

CONFIG_NETWORKING_WITH_IPV4=y

CONFIG_NETWORKING_IPV6_NO_ND=y

CONFIG_IP_BUF_RX_SIZE=4

CONFIG_IP_BUF_TX_SIZE=4

# Uncomment the following variables for debugging

#CONFIG_NETWORKING_WITH_LOGGING=y

#CONFIG_NETWORK_IP_STACK_DEBUG_NET_BUF=y

#CONFIG_NET_BUF_DEBUG=y

#CONFIG_NETWORK_IP_STACK_DEBUG_CONTEXT=y

#CONFIG_NETWORK_IP_STACK_DEBUG_TCP_PSOCK=y

CONFIG_MBEDTLS=y

CONFIG_MBEDTLS_BUILTIN=y

CONFIG_MBEDTLS_CFG_FILE="config-ccm-psk-tls1_2.h"

#

# Copyright (c) 2016 Intel Corporation

#

# Licensed under the Apache License, Version 2.0 (the "License");

# you may not use this file except in compliance with the License.

# You may obtain a copy of the License at

#

#     http://www.apache.org/licenses/LICENSE-2.0

#

# Unless required by applicable law or agreed to in writing, software

# distributed under the License is distributed on an "AS IS" BASIS,

# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

# See the License for the specific language governing permissions and

# limitations under the License.

#

ccflags-y +=-I${ZEPHYR_BASE}/net/ip/contiki

ccflags-y +=-I${ZEPHYR_BASE}/net/ip/contiki/os/lib

ccflags-y +=-I${ZEPHYR_BASE}/net/ip/contiki/os

ccflags-y +=-I${ZEPHYR_BASE}/net/ip

obj-y += mini_client.o tcp.o