Skip to content

Commit 87ca1b2

Browse files
ryanwinterryanwinter
authored
add additional certificates (#301)
1 parent 74d9f22 commit 87ca1b2

File tree

7 files changed

+327
-117
lines changed

7 files changed

+327
-117
lines changed

‎shared/src/azure_iot_cert.c

Lines changed: 223 additions & 59 deletions
Large diffs are not rendered by default.

‎shared/src/azure_iot_cert.h

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,13 @@
44
#ifndef _AZURE_IOT_CERT_H
55
#define _AZURE_IOT_CERT_H
66

7-
extern const unsigned char azure_iot_root_ca[];
8-
extern const unsigned int azure_iot_root_ca_len;
7+
extern const unsigned char azure_iot_root_cert[];
8+
extern const unsigned int azure_iot_root_cert_size;
9+
10+
extern const unsigned char azure_iot_root_cert_2[];
11+
extern const unsigned int azure_iot_root_cert_size_2;
12+
13+
extern const unsigned char azure_iot_root_cert_3[];
14+
extern const unsigned int azure_iot_root_cert_size_3;
915

1016
#endif

‎shared/src/azure_iot_ciphersuites.c

Lines changed: 11 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,5 @@
1-
/**************************************************************************/
2-
/* */
3-
/* Copyright (c) Microsoft Corporation. All rights reserved. */
4-
/* */
5-
/* This software is licensed under the Microsoft Software License */
6-
/* Terms for Microsoft Azure RTOS. Full text of the license can be */
7-
/* found in the LICENSE file at https://aka.ms/AzureRTOS_EULA */
8-
/* and in the root directory of this software. */
9-
/* */
10-
/**************************************************************************/
1+
/* Copyright (c) Microsoft Corporation.
2+
Licensed under the MIT License. */
113

124
#include "azure_iot_ciphersuites.h"
135

@@ -27,8 +19,7 @@ extern NX_CRYPTO_METHOD crypto_method_sha256;
2719
extern NX_CRYPTO_METHOD crypto_method_aes_cbc_128;
2820
extern NX_CRYPTO_METHOD crypto_method_rsa;
2921

30-
const NX_CRYPTO_METHOD *_nx_azure_iot_tls_supported_crypto[] =
31-
{
22+
const NX_CRYPTO_METHOD* _nx_azure_iot_tls_supported_crypto[] = {
3223
&crypto_method_hmac,
3324
&crypto_method_hmac_sha256,
3425
&crypto_method_tls_prf_sha256,
@@ -37,23 +28,20 @@ const NX_CRYPTO_METHOD *_nx_azure_iot_tls_supported_crypto[] =
3728
&crypto_method_rsa,
3829
};
3930

40-
const UINT _nx_azure_iot_tls_supported_crypto_size = sizeof(_nx_azure_iot_tls_supported_crypto) / sizeof(NX_CRYPTO_METHOD*);
31+
const UINT _nx_azure_iot_tls_supported_crypto_size =
32+
sizeof(_nx_azure_iot_tls_supported_crypto) / sizeof(NX_CRYPTO_METHOD*);
4133

42-
43-
/* Define supported TLS ciphersuites. */
34+
// Define supported TLS ciphersuites.
4435
extern const NX_CRYPTO_CIPHERSUITE nx_crypto_tls_rsa_with_aes_128_cbc_sha256;
4536
extern const NX_CRYPTO_CIPHERSUITE nx_crypto_x509_rsa_sha_256;
4637

47-
const NX_CRYPTO_CIPHERSUITE *_nx_azure_iot_tls_ciphersuite_map[] =
48-
{
49-
50-
/* TLS ciphersuites. */
38+
const NX_CRYPTO_CIPHERSUITE* _nx_azure_iot_tls_ciphersuite_map[] = {
39+
// TLS ciphersuites.
5140
&nx_crypto_tls_rsa_with_aes_128_cbc_sha256,
5241

53-
/* X.509 ciphersuites. */
42+
// X.509 ciphersuites.
5443
&nx_crypto_x509_rsa_sha_256,
5544
};
5645

57-
const UINT _nx_azure_iot_tls_ciphersuite_map_size = sizeof(_nx_azure_iot_tls_ciphersuite_map) / sizeof(NX_CRYPTO_CIPHERSUITE*);
58-
59-
46+
const UINT _nx_azure_iot_tls_ciphersuite_map_size =
47+
sizeof(_nx_azure_iot_tls_ciphersuite_map) / sizeof(NX_CRYPTO_CIPHERSUITE*);

‎shared/src/azure_iot_ciphersuites.h

Lines changed: 8 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,19 @@
1-
/**************************************************************************/
2-
/* */
3-
/* Copyright (c) Microsoft Corporation. All rights reserved. */
4-
/* */
5-
/* This software is licensed under the Microsoft Software License */
6-
/* Terms for Microsoft Azure RTOS. Full text of the license can be */
7-
/* found in the LICENSE file at https://aka.ms/AzureRTOS_EULA */
8-
/* and in the root directory of this software. */
9-
/* */
10-
/**************************************************************************/
1+
/* Copyright (c) Microsoft Corporation.
2+
Licensed under the MIT License. */
113

124
#ifndef NX_AZURE_IOT_CIPHERSUITES_H
135
#define NX_AZURE_IOT_CIPHERSUITES_H
146

157
#include "nx_secure_tls_api.h"
168

17-
/* Users can use these ciphersuites as sample, and also can build their own ciphersuite
18-
referring to nx_secure/nx_crypto_generic_ciphersuites.c. */
19-
extern const NX_CRYPTO_METHOD *_nx_azure_iot_tls_supported_crypto[];
9+
// Users can use these ciphersuites as sample, and also can build their own ciphersuite
10+
// referring to nx_secure/nx_crypto_generic_ciphersuites.c.
11+
extern const NX_CRYPTO_METHOD* _nx_azure_iot_tls_supported_crypto[];
2012
extern const UINT _nx_azure_iot_tls_supported_crypto_size;
21-
extern const NX_CRYPTO_CIPHERSUITE *_nx_azure_iot_tls_ciphersuite_map[];
13+
extern const NX_CRYPTO_CIPHERSUITE* _nx_azure_iot_tls_ciphersuite_map[];
2214
extern const UINT _nx_azure_iot_tls_ciphersuite_map_size;
2315

24-
/* Define the metadata size for _nx_azure_iot_tls_ciphers. */
25-
#ifndef NX_AZURE_IOT_TLS_METADATA_BUFFER_SIZE
26-
#define NX_AZURE_IOT_TLS_METADATA_BUFFER_SIZE (9 * 1024)
27-
#endif /* NX_AZURE_IOT_TLS_METADATA_BUFFER_SIZE */
16+
// Define the metadata size for _nx_azure_iot_tls_ciphers.
17+
#define NX_AZURE_IOT_TLS_METADATA_BUFFER_SIZE (9 * 1024)
2818

2919
#endif /* NX_AZURE_IOT_CIPHERSUITES_H */

‎shared/src/azure_iot_mqtt/azure_iot_mqtt.c

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -124,20 +124,20 @@ UINT tls_setup(NXD_MQTT_CLIENT* client,
124124
return status;
125125
}
126126

127-
status = nx_secure_tls_remote_certificate_allocate(tls_session,
128-
&azure_iot_mqtt->mqtt_remote_certificate,
129-
azure_iot_mqtt->mqtt_remote_cert_buffer,
130-
sizeof(azure_iot_mqtt->mqtt_remote_cert_buffer));
131-
if (status != NX_SUCCESS)
132-
{
133-
printf("Failed to create remote certificate buffer (0x%04x)\r\n", status);
134-
return status;
127+
status = nx_secure_tls_remote_certificate_allocate(tls_session,
128+
&azure_iot_mqtt->mqtt_remote_certificate,
129+
azure_iot_mqtt->mqtt_remote_cert_buffer,
130+
sizeof(azure_iot_mqtt->mqtt_remote_cert_buffer));
131+
if (status != NX_SUCCESS)
132+
{
133+
printf("Failed to create remote certificate buffer (0x%04x)\r\n", status);
134+
return status;
135135
}
136136

137137
// Add a CA Certificate to our trusted store for verifying incoming server certificates
138138
status = nx_secure_x509_certificate_initialize(trusted_cert,
139-
(UCHAR*)azure_iot_root_ca,
140-
azure_iot_root_ca_len,
139+
(UCHAR*)azure_iot_root_cert,
140+
azure_iot_root_cert_size,
141141
NX_NULL,
142142
0,
143143
NX_NULL,

‎shared/src/azure_iot_nx_client.c

Lines changed: 64 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -396,8 +396,23 @@ static UINT azure_iot_nx_client_hub_create_internal(AZURE_IOT_NX_CONTEXT* contex
396396
}
397397
}
398398

399+
if (status != NX_AZURE_IOT_SUCCESS)
400+
{
401+
printf("Failed to set auth credentials\r\n");
402+
}
403+
404+
// Add more CA certificates
405+
else if ((status = nx_azure_iot_hub_client_trusted_cert_add(&context->iothub_client, &context->root_ca_cert_2)))
406+
{
407+
printf("Failed on nx_azure_iot_hub_client_trusted_cert_add!: error code = 0x%08x\r\n", status);
408+
}
409+
else if ((status = nx_azure_iot_hub_client_trusted_cert_add(&context->iothub_client, &context->root_ca_cert_3)))
410+
{
411+
printf("Failed on nx_azure_iot_hub_client_trusted_cert_add!: error code = 0x%08x\r\n", status);
412+
}
413+
399414
// Set Model id
400-
if ((status = nx_azure_iot_hub_client_model_id_set(
415+
else if ((status = nx_azure_iot_hub_client_model_id_set(
401416
&context->iothub_client, (UCHAR*)context->azure_iot_model_id, strlen(context->azure_iot_model_id))))
402417
{
403418
printf("Error: nx_azure_iot_hub_client_model_id_set (0x%08x)\r\n", status);
@@ -578,10 +593,38 @@ UINT azure_iot_nx_client_create(AZURE_IOT_NX_CONTEXT* context,
578593
return status;
579594
}
580595

581-
// Initialize CA root certificate
596+
// Initialize CA root certificates
582597
if ((status = nx_secure_x509_certificate_initialize(&context->root_ca_cert,
583-
(UCHAR*)azure_iot_root_ca,
584-
(USHORT)azure_iot_root_ca_len,
598+
(UCHAR*)azure_iot_root_cert,
599+
(USHORT)azure_iot_root_cert_size,
600+
NX_NULL,
601+
0,
602+
NULL,
603+
0,
604+
NX_SECURE_X509_KEY_TYPE_NONE)))
605+
{
606+
printf("Failed to initialize ROOT CA certificate!: error code = 0x%08x\r\n", status);
607+
nx_azure_iot_delete(&context->nx_azure_iot);
608+
return status;
609+
}
610+
611+
if ((status = nx_secure_x509_certificate_initialize(&context->root_ca_cert_2,
612+
(UCHAR*)azure_iot_root_cert_2,
613+
(USHORT)azure_iot_root_cert_size_2,
614+
NX_NULL,
615+
0,
616+
NULL,
617+
0,
618+
NX_SECURE_X509_KEY_TYPE_NONE)))
619+
{
620+
printf("Failed to initialize ROOT CA certificate!: error code = 0x%08x\r\n", status);
621+
nx_azure_iot_delete(&context->nx_azure_iot);
622+
return status;
623+
}
624+
625+
if ((status = nx_secure_x509_certificate_initialize(&context->root_ca_cert_3,
626+
(UCHAR*)azure_iot_root_cert_3,
627+
(USHORT)azure_iot_root_cert_size_3,
585628
NX_NULL,
586629
0,
587630
NULL,
@@ -691,8 +734,24 @@ UINT azure_iot_nx_client_dps_create(AZURE_IOT_NX_CONTEXT* context, CHAR* dps_id_
691734
}
692735
}
693736

737+
if (status != NX_AZURE_IOT_SUCCESS)
738+
{
739+
printf("Failed to set auth credentials\r\n");
740+
}
741+
742+
// Add more CA certificates
743+
else if ((status = nx_azure_iot_provisioning_client_trusted_cert_add(&context->dps_client, &context->root_ca_cert_2)))
744+
{
745+
printf("Failed on nx_azure_iot_provisioning_client_trusted_cert_add!: error code = 0x%08x\r\n", status);
746+
}
747+
else if ((status =
748+
nx_azure_iot_provisioning_client_trusted_cert_add(&context->dps_client, &context->root_ca_cert_3)))
749+
{
750+
printf("Failed on nx_azure_iot_provisioning_client_trusted_cert_add!: error code = 0x%08x\r\n", status);
751+
}
752+
694753
// Set the payload containing the model Id
695-
if ((status = nx_azure_iot_provisioning_client_registration_payload_set(
754+
else if ((status = nx_azure_iot_provisioning_client_registration_payload_set(
696755
&context->dps_client, (UCHAR*)payload, strlen(payload))))
697756
{
698757
printf("Error: nx_azure_iot_provisioning_client_registration_payload_set (0x%08x\r\n", status);

‎shared/src/azure_iot_nx_client.h

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,9 @@ typedef ULONG (*func_ptr_unix_time_get)(VOID);
3737
struct AZURE_IOT_NX_CONTEXT_STRUCT
3838
{
3939
NX_SECURE_X509_CERT root_ca_cert;
40+
NX_SECURE_X509_CERT root_ca_cert_2;
41+
NX_SECURE_X509_CERT root_ca_cert_3;
42+
4043
ULONG nx_azure_iot_tls_metadata_buffer[NX_AZURE_IOT_TLS_METADATA_BUFFER_SIZE / sizeof(ULONG)];
4144
ULONG nx_azure_iot_thread_stack[NX_AZURE_IOT_STACK_SIZE / sizeof(ULONG)];
4245
ULONG azure_iot_thread_stack[AZURE_IOT_STACK_SIZE / sizeof(ULONG)];

0 commit comments

Comments
 (0)