Add TLS to pico-w5500 baremetal example

examples/rp2040/pico-rndis-dashboard/main.c

@@ -69,7 +69,7 @@ int main(void) {
 
   MG_INFO(("Initialising application..."));
   extern void device_dashboard_fn(struct mg_connection *, int, void *, void *);
-  mg_http_listen(&mgr, "http://0.0.0.0", device_dashboard_fn, &mgr);
+  mg_http_listen(&mgr, "http://0.0.0.0", device_dashboard_fn, NULL);
 
   MG_INFO(("Starting event loop"));
   for (;;) {

examples/rp2040/pico-w5500/CMakeLists.txt

@@ -4,12 +4,15 @@ include(pico-sdk/pico_sdk_init.cmake)
 project(firmware)
 pico_sdk_init()
 
+file(GLOB TLS_SOURCES "mbedtls/library/*.c")
 add_executable(firmware
   main.c
   ../../../mongoose.c
   ../../device-dashboard/net.c
-  ../../device-dashboard/packed_fs.c)
-target_include_directories(firmware PUBLIC ../../..)
+  ../../device-dashboard/packed_fs.c
+  ${TLS_SOURCES})
+
+target_include_directories(firmware PUBLIC . ../../.. mbedtls/include)
 target_link_libraries(firmware pico_stdlib hardware_spi)
 pico_add_extra_outputs(firmware)
 
@@ -21,3 +24,7 @@ pico_enable_stdio_uart(firmware 1)
 add_definitions(-DMG_ENABLE_MIP=1)
 add_definitions(-DMG_ENABLE_PACKED_FS=1)
 add_definitions(-DMG_ENABLE_FILE=0)
+
+add_definitions(-DMG_ENABLE_MBEDTLS=1)
+add_definitions(-DMBEDTLS_CONFIG_FILE=\"tlsconf.h\")
+#add_definitions(-DMG_MBEDTLS_DEBUG_LEVEL=1)

examples/rp2040/pico-w5500/Makefile

@@ -1,7 +1,9 @@
 SDK_VERSION ?= 1.4.0
 SDK_REPO ?= https://github.com/raspberrypi/pico-sdk
+MBEDTLS_VERSION ?= v2.27.0
+MBEDTLS_REPO ?= https://github.com/Mbed-TLS/mbedtls
 
-all example build build/firmware.uf2: pico-sdk main.c
+all example build build/firmware.uf2: pico-sdk mbedtls main.c
 	test -d build || mkdir build
 	cd build && cmake .. && make
 
@@ -9,6 +11,9 @@ pico-sdk:
 	git clone --depth 1 -b $(SDK_VERSION) $(SDK_REPO) $@
 	cd $@ && git submodule update --init
 
+mbedtls:
+	git clone --depth 1 -b $(MBEDTLS_VERSION) $(MBEDTLS_REPO) $@
+
 # Requires env variable VCON_API_KEY set
 DEVICE_URL ?= https://dash.vcon.io/api/v3/devices/3
 test: update
@@ -20,4 +25,4 @@ update: build/firmware.uf2
 	curl --fail -su :$(VCON_API_KEY) $(DEVICE_URL)/ota?uf2=1 --data-binary @$<
 
 clean:
-	rm -rf pico-sdk build
+	rm -rf pico-sdk mbedtls build

examples/rp2040/pico-w5500/main.c

@@ -60,7 +60,8 @@ int main(void) {
 
   MG_INFO(("Initialising application..."));
   extern void device_dashboard_fn(struct mg_connection *, int, void *, void *);
-  mg_http_listen(&mgr, "http://0.0.0.0", device_dashboard_fn, &mgr);
+  mg_http_listen(&mgr, "http://0.0.0.0:80", device_dashboard_fn, NULL);
+  mg_http_listen(&mgr, "https://0.0.0.0:443", device_dashboard_fn, "");  // SSL
 
   MG_INFO(("Starting event loop"));
   for (;;) {

examples/rp2040/pico-w5500/tlsconf.h

@@ -0,0 +1,81 @@
+// #define MBEDTLS_HAVE_ASM
+// #define MBEDTLS_HAVE_TIME
+
+/* mbed TLS feature support */
+#define MBEDTLS_ECP_DP_SECP256R1_ENABLED
+#define MBEDTLS_ECP_DP_SECP384R1_ENABLED
+#define MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
+#define MBEDTLS_SSL_PROTO_TLS1_2
+
+/* mbed TLS modules */
+#define MBEDTLS_AES_C
+#define MBEDTLS_ASN1_PARSE_C
+#define MBEDTLS_ASN1_WRITE_C
+#define MBEDTLS_BIGNUM_C
+#define MBEDTLS_CIPHER_C
+#define MBEDTLS_CTR_DRBG_C
+#define MBEDTLS_ECDH_C
+#define MBEDTLS_ECDSA_C
+#define MBEDTLS_ECP_C
+//#define MBEDTLS_ENTROPY_C
+#define MBEDTLS_GCM_C
+#define MBEDTLS_MD_C
+//#define MBEDTLS_NET_C
+#define MBEDTLS_OID_C
+#define MBEDTLS_PK_C
+#define MBEDTLS_PK_PARSE_C
+
+#define MBEDTLS_SHA224_C
+#define MBEDTLS_SHA256_C
+#define MBEDTLS_SHA384_C
+#define MBEDTLS_SHA512_C
+#define MBEDTLS_SSL_CLI_C
+#define MBEDTLS_SSL_SRV_C
+#define MBEDTLS_SSL_TLS_C
+#define MBEDTLS_X509_CRT_PARSE_C
+#define MBEDTLS_X509_USE_C
+
+/* For test certificates */
+#define MBEDTLS_BASE64_C
+#define MBEDTLS_PEM_PARSE_C
+
+/* Save RAM at the expense of ROM */
+#define MBEDTLS_AES_ROM_TABLES
+
+/* Save RAM by adjusting to our exact needs */
+#define MBEDTLS_MPI_MAX_SIZE 48  // 384-bit EC curve = 48 bytes
+
+/* Save RAM at the expense of speed, see ecp.h */
+#define MBEDTLS_ECP_WINDOW_SIZE 2
+#define MBEDTLS_ECP_FIXED_POINT_OPTIM 0
+
+/* Significant speed benefit at the expense of some ROM */
+#define MBEDTLS_ECP_NIST_OPTIM
+
+/*
+ * You should adjust this to the exact number of sources you're using: default
+ * is the "mbedtls_platform_entropy_poll" source, but you may want to add other
+ * ones. Minimum is 2 for the entropy test suite.
+ */
+#define MBEDTLS_ENTROPY_MAX_SOURCES 2
+
+/* Save ROM and a few bytes of RAM by specifying our own ciphersuite list */
+#define MBEDTLS_SSL_CIPHERSUITES                   \
+  MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, \
+      MBEDTLS_TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+
+#define MBEDTLS_SSL_IN_CONTENT_LEN 1024
+#define MBEDTLS_SSL_OUT_CONTENT_LEN 1024
+
+/* These defines are present so that the config modifying scripts can enable
+ * them during tests/scripts/test-ref-configs.pl */
+//#define MBEDTLS_USE_PSA_CRYPTO
+//#define MBEDTLS_PSA_CRYPTO_C
+
+/* Error messages and TLS debugging traces
+ * (huge code size increase, needed for tests/ssl-opt.sh) */
+//#define MBEDTLS_DEBUG_C
+//#define MBEDTLS_ERROR_C
+
+#include <limits.h>
+#include "mongoose.h"