Upgrade axTLS to 2.1.3

[pfalcon]

I've rebased MicroPython axTLS onto 2.1.3 (the latest). The rebasing was pretty clean. 2.1.3 adds support for TLS 1.2 (some sites effectively deprecate/disable anything below) and SNI, both must features. Basic testing on x86 shows that it works. But upgrade increases codesize (x86) by 12K (which is very much by both absolute and relative terms, the latter is by third).

I guess we should upgrade nonetheless, as lack of the features above highly limits TLS support.

I'll try to look at what may have caused code increase (thought that's when it turns from pretty clean upgrade into a time sink).

[pfalcon]

Weird, summarized increase of code size of libxtls.a between new and old version is 36654 - 34643 = 2011 . And yet binary increase is:

 381466	   4652	   1416	 387534	  5e9ce	micropython.axtls_new_no_sni
 368856	   4648	   1416	 374920	  5b888	micropython.axtls_old

[pfalcon]

Ok, got it - TLS 1.2 requires SHA256, and gigantic implementation gets pulled in:

10501	sha256.o (ex libaxtls.a)

[pfalcon]

Ok:

 371106	   4652	   1416	 377174	  5c156	micropython

[dpgeorge]

What is the outcome, were you able to use the existing (minimal) sha256 implementation in extmod/crypto-algorithms instead of the one shipped with axtls?

[pfalcon]

Yup, #3140 (comment) gives the result. "Everything" works.

[pfalcon]

Waiting for #3136 to start pushing it.

[pfalcon]

Update: I see apparent memory corruption with new version, will be investigating. In the meantime, axTLS 2.1.3 + uPy patchset is at https://github.com/pfalcon/axtls/tree/micropython-2.1.3

[pfalcon]

Ok, memory corruption was due to over-optimization on my side which opened Pandora box of issues, so was reverted. Upgrade happened in f01c1c6 and 75c3f2a. Note that upgrades brings (via uPy patchset on top of axTLS) debug dumping in case of TLS buffer overflow (which is a common issue on esp8266): pfalcon/axtls@9b3092e

[pfalcon]

server_hostname parameter (SNI) added in 82b9915

[pfalcon]

In a47b871, TLS record buffer size is bumped to 5K.

[pfalcon]

Announced on the forum: https://forum.micropython.org/viewtopic.php?f=16&t=3469

[pfalcon]

micropython-lib modules updated to support SNI.

Closing.

[switchtrue]

This is great! Will this be on the esp8266 build too? When will it go into a release?

[pfalcon]

esp8266 port was the primary reason of this upgrade. It's available in master, i.e. in daily builds, and will be in the next release (1.9.2, ETA is unknown so far).

[kannan95]

@pfalcon When will be the release of version 1.9.2 firmware ? I want the TLS 1.2 support in micropython. If the release is not public yet, can i build my own to support TLS1.2?. Since i'm getting the ssl_handshake_status: -40 when i send a post request of a https url.

[dpgeorge]

@kannan95 as said above, you can download the "daily builds" from here: https://micropython.org/download/#esp8266 . If you want to include all the extra scripts/modules that come in a stable release then you'll need to build it yourself (which is not that difficult).

[kannan95]

@dpgeorge the daily builds are still v1.9.1. In which build the ssl_handshake_staus:-40 problem got closed? All i wanted for now is sending post request to a https url, where im getting ssl_handshake_status:-40 error. If there is any daily build for this problem, please link the correct build i want to download. If there is no build for the error, then guide me how to build own ^^

[pfalcon]

@kannan95 : To clarify again, you will need to try the daily build, then if you experience issues, submit a separate ticket based on the suggestions in https://www.chiark.greenend.org.uk/~sgtatham/bugs.html .

[kannan95]

Sure! Thanks! @pfalcon

[coolaj86]

I've been trying to figure out how to choose the SNI and my google searches are leading me to these bug reports, but not to documentation.

This is the documentation that I'm finding:
https://docs.micropython.org/en/latest/library/ussl.html

Can someone point me to docs or an example showing how to use Servername Indication?

Many thanks.

[dpgeorge]

Can someone point me to docs or an example showing how to use Servername Indication?

It looks like it's not documented... to use it pass the server_hostname keyword argument to ussl.wrap_socket(). See eg tests/net_inet/test_tls_sites.py and tools/upip.py.

[coolaj86]

@dpgeorge Thanks so much. Unfortunately the implementation from Digi's XCTU ignores it. :-/