payload: {"action":"created","issue":{"url":"https://api.github.com/repos/SmingHub/Sming/issues/2014","repository_url":"https://api.github.com/repos/SmingHub/Sming","labels_url":"https://api.github.com/repos/SmingHub/Sming/issues/2014/labels{/name}","comments_url":"https://api.github.com/repos/SmingHub/Sming/issues/2014/comments","events_url":"https://api.github.com/repos/SmingHub/Sming/issues/2014/events","html_url":"https://github.com/SmingHub/Sming/pull/2014","id":545301449,"node_id":"MDExOlB1bGxSZXF1ZXN0MzU5MjI1MjU1","number":2014,"title":"Revise fingerprint handling and add basic Crypto support library","user":{"login":"mikee47","id":1982774,"node_id":"MDQ6VXNlcjE5ODI3NzQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1982774?v=4","gravatar_id":"","url":"https://api.github.com/users/mikee47","html_url":"https://github.com/mikee47","followers_url":"https://api.github.com/users/mikee47/followers","following_url":"https://api.github.com/users/mikee47/following{/other_user}","gists_url":"https://api.github.com/users/mikee47/gists{/gist_id}","starred_url":"https://api.github.com/users/mikee47/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikee47/subscriptions","organizations_url":"https://api.github.com/users/mikee47/orgs","repos_url":"https://api.github.com/users/mikee47/repos","events_url":"https://api.github.com/users/mikee47/events{/privacy}","received_events_url":"https://api.github.com/users/mikee47/received_events","type":"User","site_admin":false},"labels":[{"id":360286205,"node_id":"MDU6TGFiZWwzNjAyODYyMDU=","url":"https://api.github.com/repos/SmingHub/Sming/labels/3%20-%20Review","name":"3 - Review","color":"CCCCCC","default":false,"description":null}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/SmingHub/Sming/milestones/23","html_url":"https://github.com/SmingHub/Sming/milestone/23","labels_url":"https://api.github.com/repos/SmingHub/Sming/milestones/23/labels","id":4766108,"node_id":"MDk6TWlsZXN0b25lNDc2NjEwOA==","number":23,"title":"4.1.0","description":"","creator":{"login":"slaff","id":247452,"node_id":"MDQ6VXNlcjI0NzQ1Mg==","avatar_url":"https://avatars3.githubusercontent.com/u/247452?v=4","gravatar_id":"","url":"https://api.github.com/users/slaff","html_url":"https://github.com/slaff","followers_url":"https://api.github.com/users/slaff/followers","following_url":"https://api.github.com/users/slaff/following{/other_user}","gists_url":"https://api.github.com/users/slaff/gists{/gist_id}","starred_url":"https://api.github.com/users/slaff/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/slaff/subscriptions","organizations_url":"https://api.github.com/users/slaff/orgs","repos_url":"https://api.github.com/users/slaff/repos","events_url":"https://api.github.com/users/slaff/events{/privacy}","received_events_url":"https://api.github.com/users/slaff/received_events","type":"User","site_admin":false},"open_issues":5,"closed_issues":49,"state":"open","created_at":"2019-10-19T10:54:16Z","updated_at":"2020-01-06T15:37:10Z","due_on":null,"closed_at":null},"comments":9,"created_at":"2020-01-04T16:07:54Z","updated_at":"2020-01-13T16:45:45Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/SmingHub/Sming/pulls/2014","html_url":"https://github.com/SmingHub/Sming/pull/2014","diff_url":"https://github.com/SmingHub/Sming/pull/2014.diff","patch_url":"https://github.com/SmingHub/Sming/pull/2014.patch"},"body":"The purpose of this PR is to simplify and improve fingerprint handling, and by implication how hashes and such are handled within the framework. I've also added a mechanism for selecting SSL cipher suites.\r\n\r\n**crypto library**\r\n\r\nTo this end I've added a separate crypto library with the aim of creating a more consistent and robust C++ interface to commonly used routines, both by SSL and by application code.\r\n\r\nThe library currently uses AxTLS for the algorithms but selects ESP8266 ROM routines where available. \r\n\r\nI've implemented HMAC as a class template, which means it can be used with any supported hash type or block size. It also supports keys larger than the block size (simple enough to do).\r\n\r\n**Fingerprint handling** has been rationalised by moving the validation itself into the validator, which\r\nare now all class-based. The certificate implemention now just returns the hashes it supports.\r\n\r\nOne thing I've noticed is that whilst SHA1 and SHA256 fingerprints are commonly reported by browsers (e.g. firefox) when inspecting the certificate, the PKI fingerprint is not readily available. Also, there is no easy way to get BearSSL to obtain this fingerprint.\r\n\r\n**Cipher Suite selection**\r\n\r\nI've added a mechanism for selecting the cipher suites for BearSSL. These are defined as flash arrays of Suite identifiers. I've defined two standard sets:\r\n\r\n- `basic` (default) intended to provide equivalent behaviour for comparing Axtls with BearSSL (and other implementations)\r\n- `full` to provide maximum functionality, defined by the SSL implementation.\r\n\r\nOnly BearSSL uses these at present - Axtls just uses `basic` and ignores the setting. \r\n\r\nGoals for this PR are:\r\n\r\n1. Ease of use for users. Minimal knowledge of SSL, crypto, etc.\r\n2. Early verification. Having strongly-typed fingerprints and hashes makes code easier to follow and allows the compiler do do more checking, especially that they're the right size.\r\n3. Simplification. Using templates, for example, reduces the amount of code we need to maintain.\r\n4. Isolation of applications and, where possible, other Sming Compnents from the specific crypto implementations. i.e. no direct dependency on axTLS, BearSSL, etc.\r\n5. Avoid, where possible, messing about with pointers, arrays and C-style code. Think 'objects' instead.\r\n\r\nTODO:\r\n\r\n* [ ] Review ROM hash routines and add additional tests and benchmarking to confirm correct operation and evaluate relative performance.\r\n* [ ] Write MD5 and SHA1 hash wrappers for BearSSL.\r\n* [ ] Take another look at the validator/fingerprint interface. Can use a single `bool Certificate::getFingerprint(FingerprintType, Fingerprint&)` method instead of multiple overrides."},"comment":{"url":"https://api.github.com/repos/SmingHub/Sming/issues/comments/573758143","html_url":"https://github.com/SmingHub/Sming/pull/2014#issuecomment-573758143","issue_url":"https://api.github.com/repos/SmingHub/Sming/issues/2014","id":573758143,"node_id":"MDEyOklzc3VlQ29tbWVudDU3Mzc1ODE0Mw==","user":{"login":"mikee47","id":1982774,"node_id":"MDQ6VXNlcjE5ODI3NzQ=","avatar_url":"https://avatars2.githubusercontent.com/u/1982774?v=4","gravatar_id":"","url":"https://api.github.com/users/mikee47","html_url":"https://github.com/mikee47","followers_url":"https://api.github.com/users/mikee47/followers","following_url":"https://api.github.com/users/mikee47/following{/other_user}","gists_url":"https://api.github.com/users/mikee47/gists{/gist_id}","starred_url":"https://api.github.com/users/mikee47/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikee47/subscriptions","organizations_url":"https://api.github.com/users/mikee47/orgs","repos_url":"https://api.github.com/users/mikee47/repos","events_url":"https://api.github.com/users/mikee47/events{/privacy}","received_events_url":"https://api.github.com/users/mikee47/received_events","type":"User","site_admin":false},"created_at":"2020-01-13T16:45:45Z","updated_at":"2020-01-13T16:45:45Z","author_association":"CONTRIBUTOR","body":"The Crypto library now depends on both axtls-8266 and bearssl-esp8266. Also, axtls-8266 depends on crypto so make gives a circular dependency warning. I've updated the build makefiles to handle this.\r\n\r\nThe net effect is that we now have all of these libraries pulled in. The only way around that is to take copies of the appropriate implementations into the Crypto library so it's stand-alone.\r\n"}}
other: {"actor":{"display_login":"mikee47"}}