Merge branch 'task/led_light_server_crt' into 'master'

ssl_server_cert: Use mbedtls certificate bundle for server authentication

See merge request app-frameworks/esp-rainmaker!298

Author: shahpiyushv

components/esp_rainmaker/Kconfig.projbuild

@@ -132,6 +132,15 @@ menu "ESP RainMaker Config"
         default 0 if ESP_RMAKER_CONSOLE_UART_NUM_0
         default 1 if ESP_RMAKER_CONSOLE_UART_NUM_1
 
+    config ESP_RMAKER_USE_CERT_BUNDLE
+        bool "Use Certificate Bundle"
+        default y
+        select ESP_RMAKER_MQTT_USE_CERT_BUNDLE
+        help
+            Use Certificate Bundle for server authentication. Enabling this is recommended to safeguard
+            against any changes in the server certificates in future. This has an impact on the binary
+            size as well as heap requirement.
+
     menu "ESP RainMaker OTA Config"
 
         config ESP_RMAKER_OTA_AUTOFETCH

components/esp_rainmaker/src/core/esp_rmaker_claim.c

@@ -54,6 +54,21 @@
 #include "esp_rmaker_client_data.h"
 #include "esp_rmaker_claim.h"
 
+#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(4, 4, 0)
+// Features supported in 4.4+
+
+#ifdef CONFIG_ESP_RMAKER_USE_CERT_BUNDLE
+#define ESP_RMAKER_USE_CERT_BUNDLE
+#include <esp_crt_bundle.h>
+#endif
+
+#else
+
+#ifdef CONFIG_ESP_RMAKER_USE_CERT_BUNDLE
+#warning "Certificate Bundle not supported below IDF v4.4. Using provided certificate instead."
+#endif
+
+#endif /* !IDF4.4 */
 
 static const char *TAG = "esp_claim";
 
@@ -370,7 +385,11 @@ static esp_err_t esp_rmaker_claim_perform_common(esp_rmaker_claim_data_t *claim_
         .url = url,
         .transport_type = HTTP_TRANSPORT_OVER_SSL,
         .buffer_size = 1024,
+#ifdef ESP_RMAKER_USE_CERT_BUNDLE
+        .crt_bundle_attach = esp_crt_bundle_attach,
+#else
         .cert_pem = (const char *)claim_service_server_root_ca_pem_start,
+#endif
         .skip_cert_common_name_check = false
     };
     esp_http_client_handle_t client = esp_http_client_init(&config);

components/esp_rainmaker/src/ota/esp_rmaker_ota.c

@@ -28,6 +28,21 @@
 #include <esp_rmaker_utils.h>
 #include "esp_rmaker_ota_internal.h"
 
+#if ESP_IDF_VERSION >= ESP_IDF_VERSION_VAL(4, 4, 0)
+// Features supported in 4.4+
+
+#ifdef CONFIG_ESP_RMAKER_USE_CERT_BUNDLE
+#define ESP_RMAKER_USE_CERT_BUNDLE
+#include <esp_crt_bundle.h>
+#endif
+
+#else
+
+#ifdef CONFIG_ESP_RMAKER_USE_CERT_BUNDLE
+#warning "Certificate Bundle not supported below IDF v4.4. Using provided certificate instead."
+#endif
+
+#endif /* !IDF4.4 */
 static const char *TAG = "esp_rmaker_ota";
 
 #define OTA_REBOOT_TIMER_SEC    10
@@ -146,7 +161,11 @@ esp_err_t esp_rmaker_ota_default_cb(esp_rmaker_ota_handle_t ota_handle, esp_rmak
     esp_err_t ota_finish_err = ESP_OK;
     esp_http_client_config_t config = {
         .url = ota_data->url,
+#ifdef CONFIG_ESP_RMAKER_USE_CERT_BUNDLE
+        .crt_bundle_attach = esp_crt_bundle_attach,
+#else
         .cert_pem = ota_data->server_cert,
+#endif
         .timeout_ms = 5000,
         .buffer_size = DEF_HTTP_RX_BUFFER_SIZE,
         .buffer_size_tx = buffer_size_tx,

components/rmaker_common

@@ -11,6 +11,7 @@ CONFIG_PARTITION_TABLE_MD5=y
 CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
 CONFIG_MBEDTLS_DYNAMIC_FREE_PEER_CERT=y
 CONFIG_MBEDTLS_DYNAMIC_FREE_CONFIG_DATA=y
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN=y
 
 # For BLE Provisioning using NimBLE stack (Not applicable for ESP32-S2)
 CONFIG_BT_ENABLED=y

examples/fan/sdkconfig.defaults

@@ -11,6 +11,7 @@ CONFIG_PARTITION_TABLE_MD5=y
 CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
 CONFIG_MBEDTLS_DYNAMIC_FREE_PEER_CERT=y
 CONFIG_MBEDTLS_DYNAMIC_FREE_CONFIG_DATA=y
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN=y
 
 # For BLE Provisioning using NimBLE stack (Not applicable for ESP32-S2)
 CONFIG_BT_ENABLED=y

examples/gpio/sdkconfig.defaults

@@ -12,6 +12,7 @@ CONFIG_MBEDTLS_DYNAMIC_BUFFER=y
 CONFIG_MBEDTLS_DYNAMIC_FREE_PEER_CERT=y
 CONFIG_MBEDTLS_DYNAMIC_FREE_CONFIG_DATA=y
 CONFIG_MBEDTLS_HARDWARE_MPI=y
+CONFIG_MBEDTLS_CERTIFICATE_BUNDLE_DEFAULT_CMN=y
 
 #LWIP
 CONFIG_LWIP_MAX_SOCKETS=16

examples/homekit_switch/sdkconfig.defaults

@@ -1,4 +1,2 @@
 idf_component_register(SRCS ./app_driver.c ./app_main.c
                        INCLUDE_DIRS ".")
-
-target_add_binary_data(${COMPONENT_TARGET} "server.crt" TEXT)

examples/led_light/main/CMakeLists.txt

@@ -29,8 +29,6 @@ static const char *TAG = "app_main";
 
 esp_rmaker_device_t *light_device;
 
-extern const char ota_server_cert[] asm("_binary_server_crt_start");
-
 /* Callback to handle commands received from the RainMaker cloud */
 static esp_err_t write_cb(const esp_rmaker_device_t *device, const esp_rmaker_param_t *param,
             const esp_rmaker_param_val_t val, void *priv_data, esp_rmaker_write_ctx_t *ctx)
@@ -108,7 +106,7 @@ void app_main()
 
     /* Enable OTA */
     esp_rmaker_ota_config_t ota_config = {
-        .server_cert = ota_server_cert,
+        .server_cert = ESP_RMAKER_OTA_DEFAULT_SERVER_CERT,
     };
     esp_rmaker_ota_enable(&ota_config, OTA_USING_PARAMS);