1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
|
/***************************************************************************/
/* Copyright (c) 2024 Microsoft Corporation */
/* Copyright (c) 2026 Eclipse ThreadX contributors */
/* */
/* This program and the accompanying materials are made available under */
/* the terms of the MIT License which is available at */
/* https://opensource.org/licenses/MIT. */
/* */
/* SPDX-License-Identifier: MIT */
/***************************************************************************/
#include "tls_test_frame.h"
/* Global demo emaphore. */
extern TLS_TEST_SEMAPHORE* semaphore_echo_server_prepared;
/* Define the ThreadX and NetX object control blocks... */
NX_PACKET_POOL pool_0;
NX_IP ip_0;
NX_TCP_SOCKET tcp_socket;
NX_SECURE_TLS_SESSION tls_session;
NX_SECURE_X509_CERT certificate;
NX_SECURE_X509_CERT remote_certificate, remote_issuer;
NX_SECURE_X509_CERT trusted_certificate;
UCHAR tls_packet_buffer[4000];
/* Define the IP thread's stack area. */
ULONG ip_thread_stack[3 * 1024 / sizeof(ULONG)];
/* Define packet pool for the demonstration. */
#define NX_PACKET_POOL_SIZE ((1536 + sizeof(NX_PACKET)) * 32)
ULONG packet_pool_area[NX_PACKET_POOL_SIZE/sizeof(ULONG) + 64 / sizeof(ULONG)];
/* Define the ARP cache area. */
ULONG arp_space_area[512 / sizeof(ULONG)];
/* Define the demo thread. */
ULONG demo_thread_stack[6 * 1024 / sizeof(ULONG)];
TX_THREAD demo_thread;
void server_thread_entry(ULONG thread_input);
extern const NX_SECURE_TLS_CRYPTO nx_crypto_tls_ciphers;
UCHAR remote_cert_buffer[2000];
UCHAR remote_issuer_buffer[2000];
NX_SECURE_X509_CERT device_issuer_certificate;
NX_SECURE_X509_CERT remote_certificate, remote_issuer;
CHAR crypto_metadata[30000]; // 2*sizeof(NX_AES) + sizeof(NX_SHA1_HMAC) + 2*sizeof(NX_CRYPTO_RSA) + (2 * (sizeof(NX_MD5) + sizeof(NX_SHA1) + sizeof(NX_SHA256)))];
#include "ica_test_device_cert.c"
#include "ica_test_ica_cert.c"
/* Define the pointer of current instance control block. */
static TLS_TEST_INSTANCE* demo_instance_ptr;
/* Define external references. */
VOID _nx_pcap_network_driver(NX_IP_DRIVER *driver_req_ptr);
/* Instance one test entry. */
INT nx_secure_echo_server_entry(TLS_TEST_INSTANCE* instance_ptr)
{
#ifndef NX_SECURE_TLS_SERVER_DISABLED
/* Get instance pointer. */
demo_instance_ptr = instance_ptr;
/* Enter the ThreadX kernel. */
tx_kernel_enter();
#else /* ifndef NX_SECURE_TLS_SERVER_DISABLED */
exit(TLS_TEST_NOT_AVAILABLE);
#endif /* ifndef NX_SECURE_TLS_SERVER_DISABLED */
}
/* Define what the initial system looks like. */
void tx_application_define(void *first_unused_memory)
{
ULONG gateway_ipv4_address;
UINT status;
/* Initialize the NetX system. */
nx_system_initialize();
/* Create a packet pool. */
status = nx_packet_pool_create(&pool_0, "NetX Main Packet Pool", 1536, (ULONG*)(((int)packet_pool_area + 64) & ~63) , NX_PACKET_POOL_SIZE);
show_error_message_if_fail( status == NX_SUCCESS);
/* Create an IP instance. */
status = nx_ip_create(&ip_0, "NetX IP Instance 0", TLS_TEST_IP_ADDRESS_NUMBER, 0xFFFFFF00UL, &pool_0, _nx_pcap_network_driver, (UCHAR*)ip_thread_stack, sizeof(ip_thread_stack), 1);
show_error_message_if_fail( status == NX_SUCCESS);
/* Enable ARP and supply ARP cache memory for IP Instance 0. */
status = nx_arp_enable(&ip_0, (void *)arp_space_area, sizeof(arp_space_area));
show_error_message_if_fail( status == NX_SUCCESS);
/* Enable TCP traffic. */
status = nx_tcp_enable(&ip_0);
show_error_message_if_fail( status == NX_SUCCESS);
/* Enable UDP traffic. */
status = nx_udp_enable(&ip_0);
show_error_message_if_fail( status == NX_SUCCESS);
/* Enable ICMP. */
status = nx_icmp_enable(&ip_0);
show_error_message_if_fail( status == NX_SUCCESS);
status = nx_ip_fragment_enable(&ip_0);
show_error_message_if_fail( status == NX_SUCCESS);
tx_thread_create(&demo_thread, "demo thread", server_thread_entry, 0, demo_thread_stack, sizeof(demo_thread_stack), 16, 16, 4, TX_AUTO_START);
}
/* TLS Server example application thread. */
void server_thread_entry(ULONG thread_input)
{
INT i = 0, status = 0;
ULONG actual_status;
NX_PACKET *receive_packet;
NX_PACKET *send_packet;
UCHAR receive_buffer[100];
ULONG bytes;
/* Ensure the IP instance has been initialized. */
status = nx_ip_status_check(&ip_0, NX_IP_INITIALIZE_DONE, &actual_status, NX_IP_PERIODIC_RATE);
show_error_message_if_fail( NX_SUCCESS == status);
/* Create a socket. */
status = nx_tcp_socket_create(&ip_0, &tcp_socket, "Server Socket",
NX_IP_NORMAL, NX_FRAGMENT_OKAY /*NX_DONT_FRAGMENT*/, NX_IP_TIME_TO_LIVE, 8192,
NX_NULL, NX_NULL);
show_error_message_if_fail( NX_SUCCESS == status);
status = nx_secure_tls_session_create(&tls_session,
&nx_crypto_tls_ciphers,
crypto_metadata,
sizeof(crypto_metadata));
show_error_message_if_fail( NX_SUCCESS == status);
/* Allocate space for packet reassembly. */
status = nx_secure_tls_session_packet_buffer_set(&tls_session, tls_packet_buffer, sizeof(tls_packet_buffer));
show_error_message_if_fail( NX_SUCCESS == status);
// Initialize our certificates
nx_secure_tls_remote_certificate_allocate(&tls_session, &remote_certificate, remote_cert_buffer, sizeof(remote_cert_buffer));
nx_secure_tls_remote_certificate_allocate(&tls_session, &remote_issuer, remote_issuer_buffer, sizeof(remote_issuer_buffer));
memset(&certificate, 0, sizeof(certificate));
nx_secure_x509_certificate_initialize(&certificate, test_device_cert_der, test_device_cert_der_len, NX_NULL, 0, test_device_cert_key_der, test_device_cert_key_der_len, NX_SECURE_X509_KEY_TYPE_RSA_PKCS1_DER);
nx_secure_tls_local_certificate_add(&tls_session, &certificate);
// Initialize the Intermediate CA certificate - it does not have a private RSA key
nx_secure_x509_certificate_initialize(&device_issuer_certificate, ica_cert_der, ica_cert_der_len, NX_NULL, 0, NX_NULL, 0, NX_SECURE_X509_KEY_TYPE_NONE);
nx_secure_tls_local_certificate_add(&tls_session, &device_issuer_certificate);
/* Setup this thread to listen. */
status = nx_tcp_server_socket_listen(&ip_0, DEVICE_SERVER_PORT, &tcp_socket, 5, NX_NULL);
show_error_message_if_fail( NX_SUCCESS == status);
/* Post semaphore before accept sockets. */
print_error_message("Connection %d: server is prepared. Post the semaphore.\n", i);
tls_test_semaphore_post(semaphore_echo_server_prepared);
/* Accept a client socket connection. */
print_error_message("Connection %d: wait for connections.\n", i);
status = nx_tcp_server_socket_accept(&tcp_socket, NX_WAIT_FOREVER);
print_error_message("Connection %d: server accept.\n", i);
exit_if_fail( NX_SUCCESS == status, 1);
/* Start the TLS Session now that we have a connected socket. */
status = nx_secure_tls_session_start(&tls_session, &tcp_socket, NX_WAIT_FOREVER);
exit_if_fail( NX_SUCCESS == status, 2);
/* Receive the HTTP request, and print it out. */
status = nx_secure_tls_session_receive(&tls_session, &receive_packet, NX_WAIT_FOREVER);
exit_if_fail( NX_SUCCESS == status, 3);
/* Show received data. */
nx_packet_data_extract_offset(receive_packet, 0, receive_buffer, 100, &bytes);
receive_buffer[bytes] = 0;
print_error_message("Received data: %s\n", receive_buffer);
/* Allocate a return packet and send our HTML data back to the client. */
status = nx_secure_tls_packet_allocate(&tls_session, &pool_0, &send_packet, NX_WAIT_FOREVER);
exit_if_fail( NX_SUCCESS == status, 4);
/* Echo the message received. */
status = nx_packet_data_append(send_packet, receive_buffer, bytes, &pool_0, NX_WAIT_FOREVER);
exit_if_fail( NX_SUCCESS == status, 5);
/* TLS send the HTML/HTTPS data back to the client. */
status = nx_secure_tls_session_send(&tls_session, send_packet, NX_IP_PERIODIC_RATE);
/* Exit the test process directly without release packet. */
exit_if_fail( NX_SUCCESS == status, 6);
/* End the TLS session. This is required to properly shut down the TLS connection. */
status = nx_secure_tls_session_end(&tls_session, NX_WAIT_FOREVER);
exit_if_fail( NX_SUCCESS == status, 7);
/* Disconnect the TCP socket, closing the connection. */
status = nx_tcp_socket_disconnect(&tcp_socket, NX_WAIT_FOREVER);
exit_if_fail( NX_SUCCESS == status, 8);
/* Unaccept the server socket. */
status = nx_tcp_server_socket_unaccept(&tcp_socket);
exit_if_fail( NX_SUCCESS == status, 9);
print_error_message("Connection %d: server unaccept, sleeping...\n", i);
tx_thread_sleep( 500);
/* Setup server socket for listening again. */
status = nx_tcp_server_socket_relisten(&ip_0, DEVICE_SERVER_PORT, &tcp_socket);
exit_if_fail( NX_SUCCESS == status, 10);
exit(0);
}
|
