mbtk/libmbtk_lib/net/mbtk_mbedtls.c - T108_Public - Gitiles

 /*-----------------------------------------------------------------------------------------------*/
 /**
   @file mbtk_mbedtls.c
   @brief MBEDTLS API
 */
 /*-----------------------------------------------------------------------------------------------*/

 /*-------------------------------------------------------------------------------------------------
   Copyright (c) 2024 mobiletek Wireless Solution, Co., Ltd. All Rights Reserved.
   mobiletek Wireless Solution Proprietary and Confidential.
 -------------------------------------------------------------------------------------------------*/

 /*-------------------------------------------------------------------------------------------------
   EDIT HISTORY
   This section contains comments describing changes made to the file.
   Notice that changes are listed in reverse chronological order.
   $Header: $
   when       who          what, where, why
   --------   ---------    -----------------------------------------------------------------
   20250409    yq.wang      Created .
 -------------------------------------------------------------------------------------------------*/
 #ifdef MBTK_MBEDTLS_V3_6_2_SUPPORT
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>

 #include "mbtk_log.h"
 #include "mbtk_mbedtls.h"

 #define MBTK_SSL_PERS_STR_DEFAULT "mbtk_ssl"
 #define MBTK_SSL_INFO_FD_DEFAULT -1
 #define MBTK_SSL_BUFFER_SIZE_1024 1024
 #define MBTK_SSL_BUFFER_SIZE_128 128

 static mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_info_free(mbtk_mbedtls_ssl_info_s *ssl_info)
 {
     if(NULL == ssl_info)
     {
         LOGE("[%s] ssl_info [NULL]", __func__);
         return MBTK_MBEDTLS_SSL_RESULT_FAIL;
     }

     if(NULL != ssl_info->entropy)
     {
         free(ssl_info->entropy);
         ssl_info->entropy = NULL;
     }

     if(NULL != ssl_info->ctr_drbg)
     {
         free(ssl_info->ctr_drbg);
         ssl_info->ctr_drbg = NULL;
     }

     if(NULL != ssl_info->ssl)
     {
         free(ssl_info->ssl);
         ssl_info->ssl = NULL;
     }

     if(NULL != ssl_info->conf)
     {
         free(ssl_info->conf);
         ssl_info->conf = NULL;
     }

     if(NULL != ssl_info->cacert)
     {
         free(ssl_info->cacert);
         ssl_info->cacert = NULL;
     }

     if(NULL != ssl_info->clientcert)
     {
         free(ssl_info->clientcert);
         ssl_info->clientcert = NULL;
     }

     if(NULL != ssl_info->clientkey)
     {
         free(ssl_info->clientkey);
         ssl_info->clientkey = NULL;
     }

     return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
 }

 static mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_info_malloc(mbtk_mbedtls_ssl_info_s *ssl_info)
 {
     if(NULL == ssl_info)
     {
         LOGE("[%s] ssl_info [NULL]", __func__);
         return MBTK_MBEDTLS_SSL_RESULT_FAIL;
     }

     ssl_info->entropy = (mbedtls_entropy_context *)malloc(sizeof(mbedtls_entropy_context));
     if(NULL == ssl_info->entropy)
     {
         LOGE("[%s] entropy malloc() fail", __func__);
         goto free_error;
     }

     ssl_info->ctr_drbg = (mbedtls_ctr_drbg_context *)malloc(sizeof(mbedtls_ctr_drbg_context));
     if(NULL == ssl_info->ctr_drbg)
     {
         LOGE("[%s] ctr_drbg malloc() fail", __func__);
         goto free_error;
     }

     ssl_info->ssl = (mbedtls_ssl_context *)malloc(sizeof(mbedtls_ssl_context));
     if(NULL == ssl_info->ssl)
     {
         LOGE("[%s] ssl malloc() fail", __func__);
         goto free_error;
     }

     ssl_info->conf = (mbedtls_ssl_config *)malloc(sizeof(mbedtls_ssl_config));
     if(NULL == ssl_info->conf)
     {
         LOGE("[%s] conf malloc() fail", __func__);
         goto free_error;
     }

     ssl_info->cacert = (mbedtls_x509_crt *)malloc(sizeof(mbedtls_x509_crt));
     if(NULL == ssl_info->cacert)
     {
         LOGE("[%s] cacert malloc() fail", __func__);
         goto free_error;
     }

     ssl_info->clientcert = (mbedtls_x509_crt *)malloc(sizeof(mbedtls_x509_crt));
     if(NULL == ssl_info->clientcert)
     {
         LOGE("[%s] clientcert malloc() fail", __func__);
         goto free_error;
     }

     ssl_info->clientkey = (mbedtls_pk_context *)malloc(sizeof(mbedtls_pk_context));
     if(NULL == ssl_info->clientkey)
     {
         LOGE("[%s] clientkey malloc() fail", __func__);
         goto free_error;
     }

     return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
 free_error:
     mbtk_mbedtls_ssl_info_free(ssl_info);

     return MBTK_MBEDTLS_SSL_RESULT_FAIL;
 }

 mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_options_default(mbtk_mbedtls_ssl_options_s *opt)
 {
     if(NULL == opt)
     {
         LOGE("[%s] opt [NULL]", __func__);
         return MBTK_MBEDTLS_SSL_RESULT_FAIL;
     }

     const mbedtls_x509_crt_profile mbtk_profile = mbedtls_x509_crt_profile_default;

     opt->load_cert = false;
     opt->ca_file = NULL;
     opt->crt_file = NULL;
     opt->key_file = NULL;
     opt->pers_str = (unsigned char*)MBTK_SSL_PERS_STR_DEFAULT;
     opt->pers_str_size = strlen((const char*)opt->pers_str);
     opt->type = MBTK_MBEDTLS_SSL_IS_CLIENT;
     opt->transprot = MBTK_MBEDTLS_SSL_TRANSPROT_STREAM;
     opt->preset = MBTK_MBEDTLS_SSL_PRESET_DEFAULT;
     opt->auth_mode = MBTK_MBEDTLS_SSL_VERIFY_OPTIONAL;
     opt->renegotiation = MBTK_MBEDTLS_SSL_RENEGOTIATION_DISABLED;
     opt->allow_legacy = MBTK_MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION;
     opt->min_version = MBTK_MBEDTLS_SSL_MINOR_VERSION_3;
     opt->max_version = MBTK_MBEDTLS_SSL_MINOR_VERSION_4;
     opt->allowed_mds = mbtk_profile.allowed_mds;

     return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
 }

 int mbtk_mbedtls_ssl_write(mbedtls_ssl_context *ssl, const unsigned char *buf, size_t len )
 {
     return mbedtls_ssl_write(ssl, buf, len);
 }

 int mbtk_mbedtls_ssl_read(mbedtls_ssl_context *ssl, unsigned char *buf, size_t len )
 {
     return mbedtls_ssl_read(ssl, buf, len);
 }

 mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_init(int fd , mbtk_mbedtls_ssl_options_s *opt, mbtk_mbedtls_ssl_info_s* inter_info)
 {
     int ret = -1;
     uint32_t flags = 0;
     char verify_err[MBTK_SSL_BUFFER_SIZE_1024 + 1] = {0};
     char cert_buff[MBTK_SSL_BUFFER_SIZE_1024 + 1] = {0};
     mbtk_mbedtls_ssl_options_s temp_opt = {0};
     mbtk_mbedtls_ssl_info_s temp_ssl_info = {0};
     mbedtls_x509_crt_profile mbtk_profile = mbedtls_x509_crt_profile_default;

     if(NULL == inter_info)
     {
         LOGE("[%s] inter_info [NULL]", __func__);
         return MBTK_MBEDTLS_SSL_RESULT_FAIL;
     }

     if(NULL == opt)
     {
         ret = mbtk_mbedtls_ssl_options_default(&temp_opt);
     }
     else
     {
         memset(&temp_opt, 0x00, sizeof(mbtk_mbedtls_ssl_options_s));
         memcpy(&temp_opt, opt, sizeof(mbtk_mbedtls_ssl_options_s));
     }

     memset(&temp_ssl_info, 0x00, sizeof(mbtk_mbedtls_ssl_info_s));
     ret = mbtk_mbedtls_ssl_info_malloc(&temp_ssl_info);
     if(ret != 0)
     {
         LOGE("[%s] mbtk_mbedtls_ssl_info_malloc() fail", __func__);
         return MBTK_MBEDTLS_SSL_RESULT_FAIL;
     }

     mbedtls_ctr_drbg_init(temp_ssl_info.ctr_drbg);
     mbedtls_entropy_init(temp_ssl_info.entropy);
     mbedtls_ssl_init(temp_ssl_info.ssl);
     mbedtls_ssl_config_init(temp_ssl_info.conf);
     mbedtls_x509_crt_init(temp_ssl_info.cacert);
     mbedtls_x509_crt_init(temp_ssl_info.clientcert);
     mbedtls_pk_init(temp_ssl_info.clientkey);

     //1.Initialize the function for CTR_DRBG pseudorandom number generator
     ret = mbedtls_ctr_drbg_seed(temp_ssl_info.ctr_drbg, mbedtls_entropy_func, temp_ssl_info.entropy, temp_opt.pers_str, temp_opt.pers_str_size);
     if (ret != 0)
     {
         LOGE("[%s] mbedtls_ctr_drbg_seed() fail.[-0x%x]", __func__, -ret);
         goto error;
     }

     //2.Load certificate
     if(temp_opt.load_cert)
     {
         if(NULL == temp_opt.ca_file || NULL == temp_opt.crt_file || NULL == temp_opt.key_file)
         {
             LOGE("[%s] file [NULL]", __func__);
             goto error;
         }

         //2.1-Load root certificate
         ret = mbedtls_x509_crt_parse_file(temp_ssl_info.cacert, temp_opt.ca_file);
         if(ret != 0)
         {
             LOGE("[%s] mbedtls_x509_crt_parse_file() CA fail.[-0x%x]", __func__, -ret);
             goto error;
         }

         //2.2-Load the client public key
         ret = mbedtls_x509_crt_parse_file(temp_ssl_info.clientcert, temp_opt.crt_file);
         if(ret != 0)
         {
             LOGE("[%s] mbedtls_x509_crt_parse_file() CRT fail.[-0x%x]", __func__, -ret);
             goto error;
         }

         //2.3-Load the client private key
         ret = mbedtls_pk_parse_keyfile(temp_ssl_info.clientkey, temp_opt.key_file, NULL, mbedtls_ctr_drbg_random, temp_ssl_info.ctr_drbg);
         if(ret != 0)
         {
             LOGE("[%s] mbedtls_pk_parse_keyfile() KEY fail.[-0x%x]", __func__, -ret);
             goto error;
         }
     }

     LOGD("[%s] Configure the SSL/TLS context...", __func__);
     //3.Configure the SSL/TLS context
     ret = mbedtls_ssl_config_defaults(temp_ssl_info.conf, temp_opt.type, temp_opt.transprot, temp_opt.preset);
     if(ret != 0)
     {
         LOGE("[%s] mbedtls_ssl_config_defaults() fail.[-0x%x]", __func__, -ret);
         goto error;
     }

     mbedtls_ssl_conf_authmode(temp_ssl_info.conf, temp_opt.auth_mode);
     mbedtls_ssl_conf_ca_chain(temp_ssl_info.conf, temp_ssl_info.cacert, NULL);
     if(temp_opt.load_cert)
     {
         ret = mbedtls_ssl_conf_own_cert(temp_ssl_info.conf, temp_ssl_info.clientcert, temp_ssl_info.clientkey);
         if(ret != 0)
         {
             LOGE("[%s] mbedtls_ssl_conf_own_cert() fail.[-0x%x]", __func__, -ret);
             goto error;
         }
     }

     mbedtls_ssl_conf_rng(temp_ssl_info.conf, mbedtls_ctr_drbg_random, temp_ssl_info.ctr_drbg);
     //mbedtls_ssl_conf_renegotiation(&conf, temp_opt.renegotiation);
     mbedtls_ssl_conf_legacy_renegotiation(temp_ssl_info.conf, temp_opt.allow_legacy);
     // TLS 1.2
     mbedtls_ssl_conf_min_version(temp_ssl_info.conf, MBEDTLS_SSL_MAJOR_VERSION_3, temp_opt.min_version);
     // TLS 1.3
     mbedtls_ssl_conf_max_version(temp_ssl_info.conf, MBEDTLS_SSL_MAJOR_VERSION_3, temp_opt.max_version);

     mbtk_profile.allowed_mds = temp_opt.allowed_mds;
     mbedtls_ssl_conf_cert_profile(temp_ssl_info.conf, &mbtk_profile);

     //4.Binding SSL configuration
     ret = mbedtls_ssl_setup(temp_ssl_info.ssl, temp_ssl_info.conf);
     if (ret != 0)
     {
         LOGE("[%s] mbedtls_ssl_setup() fail.[-0x%x]", __func__, -ret);
         goto error;
     }

     mbedtls_ssl_set_bio(temp_ssl_info.ssl, &fd, mbedtls_net_send, mbedtls_net_recv, NULL);

     LOGD("[%s] Performing the SSL/TLS handshake...", __func__);
     //5.Shake hands
     while((ret = mbedtls_ssl_handshake(temp_ssl_info.ssl)) != 0)
     {
         if(ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE)
         {
             LOGE("[%s] mbedtls_ssl_handshake() fail.[-0x%x]", __func__, -ret);
             goto error;
         }
     }

     LOGD("[%s] Handshake ok: Protocol[%s], Ciphersuite[%s]", __func__, mbedtls_ssl_get_version(temp_ssl_info.ssl), mbedtls_ssl_get_ciphersuite(temp_ssl_info.ssl));
     //6.Verification certificate
     flags = mbedtls_ssl_get_verify_result(temp_ssl_info.ssl);
     if(flags != 0)
     {
         memset(verify_err, 0x00, MBTK_SSL_BUFFER_SIZE_1024 + 1);
         mbedtls_x509_crt_verify_info(verify_err, MBTK_SSL_BUFFER_SIZE_1024, "[mbedtls_ssl_get_verify_result] ", flags);
         LOGD("%s", verify_err);
         if(temp_opt.auth_mode == MBTK_MBEDTLS_SSL_VERIFY_REQUIRED)
         {
             LOGE("[%s] mbedtls_ssl_get_verify_result() fail", __func__);
             goto error;
         }
     }

     if(mbedtls_ssl_get_peer_cert(temp_ssl_info.ssl) != NULL)
     {
         LOGD("[%s] Peer certificate information", __func__);
         memset(cert_buff, 0x00, MBTK_SSL_BUFFER_SIZE_1024 + 1);
         mbedtls_x509_crt_info(cert_buff, MBTK_SSL_BUFFER_SIZE_1024, "[mbedtls_ssl_get_verify_result] ", mbedtls_ssl_get_peer_cert(temp_ssl_info.ssl));
         LOGD("%s", cert_buff);
     }

     temp_ssl_info.fd = fd;
     memcpy(inter_info, &temp_ssl_info, sizeof(mbtk_mbedtls_ssl_info_s));

     return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
 error:
     mbedtls_ssl_close_notify(temp_ssl_info.ssl);
     mbedtls_ssl_free(temp_ssl_info.ssl);
     mbedtls_ssl_config_free(temp_ssl_info.conf);
     mbedtls_ctr_drbg_free(temp_ssl_info.ctr_drbg);
     mbedtls_entropy_free(temp_ssl_info.entropy);
     mbedtls_pk_free(temp_ssl_info.clientkey);
     mbedtls_x509_crt_free(temp_ssl_info.clientcert);
     mbedtls_x509_crt_free(temp_ssl_info.cacert);

     mbtk_mbedtls_ssl_info_free(&temp_ssl_info);
     return MBTK_MBEDTLS_SSL_RESULT_FAIL;
 }

 mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_deinit(mbtk_mbedtls_ssl_info_s* inter_info)
 {
     if(NULL == inter_info)
     {
         LOGE("[%s] inter_info [NULL]", __func__);
         return MBTK_MBEDTLS_SSL_RESULT_FAIL;
     }

     int ret = -1;
     char error_buf[MBTK_SSL_BUFFER_SIZE_128 + 1] = {0};

     do {
         ret = mbedtls_ssl_close_notify(inter_info->ssl);
     } while (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE);

     if(ret != 0)
     {
         memset(error_buf, 0x00, MBTK_SSL_BUFFER_SIZE_128 + 1);
         mbedtls_strerror(ret, error_buf, MBTK_SSL_BUFFER_SIZE_128);
         LOGE("[%s] mbedtls_ssl_close_notify() fail.[%s]", __func__, error_buf);
     }

     mbedtls_ssl_close_notify(inter_info->ssl);
     mbedtls_ssl_free(inter_info->ssl);
     mbedtls_ssl_config_free(inter_info->conf);
     mbedtls_ctr_drbg_free(inter_info->ctr_drbg);
     mbedtls_entropy_free(inter_info->entropy);
     mbedtls_pk_free(inter_info->clientkey);
     mbedtls_x509_crt_free(inter_info->clientcert);
     mbedtls_x509_crt_free(inter_info->cacert);
     inter_info->fd = MBTK_SSL_INFO_FD_DEFAULT;

     mbtk_mbedtls_ssl_info_free(inter_info);
     return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
 }

 #endif
	/-----------------------------------------------------------------------------------------------/
	/**
	@file mbtk_mbedtls.c
	@brief MBEDTLS API
	*/
	/-----------------------------------------------------------------------------------------------/

	/*-------------------------------------------------------------------------------------------------
	Copyright (c) 2024 mobiletek Wireless Solution, Co., Ltd. All Rights Reserved.
	mobiletek Wireless Solution Proprietary and Confidential.
	-------------------------------------------------------------------------------------------------*/

	/*-------------------------------------------------------------------------------------------------
	EDIT HISTORY
	This section contains comments describing changes made to the file.
	Notice that changes are listed in reverse chronological order.
	$Header: $
	when who what, where, why
	-------- --------- -----------------------------------------------------------------
	20250409 yq.wang Created .
	-------------------------------------------------------------------------------------------------*/
	#ifdef MBTK_MBEDTLS_V3_6_2_SUPPORT
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>
	#include <unistd.h>

	#include "mbtk_log.h"
	#include "mbtk_mbedtls.h"

	#define MBTK_SSL_PERS_STR_DEFAULT "mbtk_ssl"
	#define MBTK_SSL_INFO_FD_DEFAULT -1
	#define MBTK_SSL_BUFFER_SIZE_1024 1024
	#define MBTK_SSL_BUFFER_SIZE_128 128

	static mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_info_free(mbtk_mbedtls_ssl_info_s *ssl_info)
	{
	if(NULL == ssl_info)
	{
	LOGE("[%s] ssl_info [NULL]", __func__);
	return MBTK_MBEDTLS_SSL_RESULT_FAIL;
	}

	if(NULL != ssl_info->entropy)
	{
	free(ssl_info->entropy);
	ssl_info->entropy = NULL;
	}

	if(NULL != ssl_info->ctr_drbg)
	{
	free(ssl_info->ctr_drbg);
	ssl_info->ctr_drbg = NULL;
	}

	if(NULL != ssl_info->ssl)
	{
	free(ssl_info->ssl);
	ssl_info->ssl = NULL;
	}

	if(NULL != ssl_info->conf)
	{
	free(ssl_info->conf);
	ssl_info->conf = NULL;
	}

	if(NULL != ssl_info->cacert)
	{
	free(ssl_info->cacert);
	ssl_info->cacert = NULL;
	}

	if(NULL != ssl_info->clientcert)
	{
	free(ssl_info->clientcert);
	ssl_info->clientcert = NULL;
	}

	if(NULL != ssl_info->clientkey)
	{
	free(ssl_info->clientkey);
	ssl_info->clientkey = NULL;
	}

	return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
	}

	static mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_info_malloc(mbtk_mbedtls_ssl_info_s *ssl_info)
	{
	if(NULL == ssl_info)
	{
	LOGE("[%s] ssl_info [NULL]", __func__);
	return MBTK_MBEDTLS_SSL_RESULT_FAIL;
	}

	ssl_info->entropy = (mbedtls_entropy_context *)malloc(sizeof(mbedtls_entropy_context));
	if(NULL == ssl_info->entropy)
	{
	LOGE("[%s] entropy malloc() fail", __func__);
	goto free_error;
	}

	ssl_info->ctr_drbg = (mbedtls_ctr_drbg_context *)malloc(sizeof(mbedtls_ctr_drbg_context));
	if(NULL == ssl_info->ctr_drbg)
	{
	LOGE("[%s] ctr_drbg malloc() fail", __func__);
	goto free_error;
	}

	ssl_info->ssl = (mbedtls_ssl_context *)malloc(sizeof(mbedtls_ssl_context));
	if(NULL == ssl_info->ssl)
	{
	LOGE("[%s] ssl malloc() fail", __func__);
	goto free_error;
	}

	ssl_info->conf = (mbedtls_ssl_config *)malloc(sizeof(mbedtls_ssl_config));
	if(NULL == ssl_info->conf)
	{
	LOGE("[%s] conf malloc() fail", __func__);
	goto free_error;
	}

	ssl_info->cacert = (mbedtls_x509_crt *)malloc(sizeof(mbedtls_x509_crt));
	if(NULL == ssl_info->cacert)
	{
	LOGE("[%s] cacert malloc() fail", __func__);
	goto free_error;
	}

	ssl_info->clientcert = (mbedtls_x509_crt *)malloc(sizeof(mbedtls_x509_crt));
	if(NULL == ssl_info->clientcert)
	{
	LOGE("[%s] clientcert malloc() fail", __func__);
	goto free_error;
	}

	ssl_info->clientkey = (mbedtls_pk_context *)malloc(sizeof(mbedtls_pk_context));
	if(NULL == ssl_info->clientkey)
	{
	LOGE("[%s] clientkey malloc() fail", __func__);
	goto free_error;
	}

	return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
	free_error:
	mbtk_mbedtls_ssl_info_free(ssl_info);

	return MBTK_MBEDTLS_SSL_RESULT_FAIL;
	}

	mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_options_default(mbtk_mbedtls_ssl_options_s *opt)
	{
	if(NULL == opt)
	{
	LOGE("[%s] opt [NULL]", __func__);
	return MBTK_MBEDTLS_SSL_RESULT_FAIL;
	}

	const mbedtls_x509_crt_profile mbtk_profile = mbedtls_x509_crt_profile_default;

	opt->load_cert = false;
	opt->ca_file = NULL;
	opt->crt_file = NULL;
	opt->key_file = NULL;
	opt->pers_str = (unsigned char*)MBTK_SSL_PERS_STR_DEFAULT;
	opt->pers_str_size = strlen((const char*)opt->pers_str);
	opt->type = MBTK_MBEDTLS_SSL_IS_CLIENT;
	opt->transprot = MBTK_MBEDTLS_SSL_TRANSPROT_STREAM;
	opt->preset = MBTK_MBEDTLS_SSL_PRESET_DEFAULT;
	opt->auth_mode = MBTK_MBEDTLS_SSL_VERIFY_OPTIONAL;
	opt->renegotiation = MBTK_MBEDTLS_SSL_RENEGOTIATION_DISABLED;
	opt->allow_legacy = MBTK_MBEDTLS_SSL_LEGACY_NO_RENEGOTIATION;
	opt->min_version = MBTK_MBEDTLS_SSL_MINOR_VERSION_3;
	opt->max_version = MBTK_MBEDTLS_SSL_MINOR_VERSION_4;
	opt->allowed_mds = mbtk_profile.allowed_mds;

	return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
	}

	int mbtk_mbedtls_ssl_write(mbedtls_ssl_context ssl, const unsigned char buf, size_t len )
	{
	return mbedtls_ssl_write(ssl, buf, len);
	}

	int mbtk_mbedtls_ssl_read(mbedtls_ssl_context ssl, unsigned char buf, size_t len )
	{
	return mbedtls_ssl_read(ssl, buf, len);
	}

	mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_init(int fd , mbtk_mbedtls_ssl_options_s opt, mbtk_mbedtls_ssl_info_s inter_info)
	{
	int ret = -1;
	uint32_t flags = 0;
	char verify_err[MBTK_SSL_BUFFER_SIZE_1024 + 1] = {0};
	char cert_buff[MBTK_SSL_BUFFER_SIZE_1024 + 1] = {0};
	mbtk_mbedtls_ssl_options_s temp_opt = {0};
	mbtk_mbedtls_ssl_info_s temp_ssl_info = {0};
	mbedtls_x509_crt_profile mbtk_profile = mbedtls_x509_crt_profile_default;

	if(NULL == inter_info)
	{
	LOGE("[%s] inter_info [NULL]", __func__);
	return MBTK_MBEDTLS_SSL_RESULT_FAIL;
	}

	if(NULL == opt)
	{
	ret = mbtk_mbedtls_ssl_options_default(&temp_opt);
	}
	else
	{
	memset(&temp_opt, 0x00, sizeof(mbtk_mbedtls_ssl_options_s));
	memcpy(&temp_opt, opt, sizeof(mbtk_mbedtls_ssl_options_s));
	}

	memset(&temp_ssl_info, 0x00, sizeof(mbtk_mbedtls_ssl_info_s));
	ret = mbtk_mbedtls_ssl_info_malloc(&temp_ssl_info);
	if(ret != 0)
	{
	LOGE("[%s] mbtk_mbedtls_ssl_info_malloc() fail", __func__);
	return MBTK_MBEDTLS_SSL_RESULT_FAIL;
	}

	mbedtls_ctr_drbg_init(temp_ssl_info.ctr_drbg);
	mbedtls_entropy_init(temp_ssl_info.entropy);
	mbedtls_ssl_init(temp_ssl_info.ssl);
	mbedtls_ssl_config_init(temp_ssl_info.conf);
	mbedtls_x509_crt_init(temp_ssl_info.cacert);
	mbedtls_x509_crt_init(temp_ssl_info.clientcert);
	mbedtls_pk_init(temp_ssl_info.clientkey);

	//1.Initialize the function for CTR_DRBG pseudorandom number generator
	ret = mbedtls_ctr_drbg_seed(temp_ssl_info.ctr_drbg, mbedtls_entropy_func, temp_ssl_info.entropy, temp_opt.pers_str, temp_opt.pers_str_size);
	if (ret != 0)
	{
	LOGE("[%s] mbedtls_ctr_drbg_seed() fail.[-0x%x]", __func__, -ret);
	goto error;
	}

	//2.Load certificate
	if(temp_opt.load_cert)
	{
	if(NULL == temp_opt.ca_file \|\| NULL == temp_opt.crt_file \|\| NULL == temp_opt.key_file)
	{
	LOGE("[%s] file [NULL]", __func__);
	goto error;
	}

	//2.1-Load root certificate
	ret = mbedtls_x509_crt_parse_file(temp_ssl_info.cacert, temp_opt.ca_file);
	if(ret != 0)
	{
	LOGE("[%s] mbedtls_x509_crt_parse_file() CA fail.[-0x%x]", __func__, -ret);
	goto error;
	}

	//2.2-Load the client public key
	ret = mbedtls_x509_crt_parse_file(temp_ssl_info.clientcert, temp_opt.crt_file);
	if(ret != 0)
	{
	LOGE("[%s] mbedtls_x509_crt_parse_file() CRT fail.[-0x%x]", __func__, -ret);
	goto error;
	}

	//2.3-Load the client private key
	ret = mbedtls_pk_parse_keyfile(temp_ssl_info.clientkey, temp_opt.key_file, NULL, mbedtls_ctr_drbg_random, temp_ssl_info.ctr_drbg);
	if(ret != 0)
	{
	LOGE("[%s] mbedtls_pk_parse_keyfile() KEY fail.[-0x%x]", __func__, -ret);
	goto error;
	}
	}

	LOGD("[%s] Configure the SSL/TLS context...", __func__);
	//3.Configure the SSL/TLS context
	ret = mbedtls_ssl_config_defaults(temp_ssl_info.conf, temp_opt.type, temp_opt.transprot, temp_opt.preset);
	if(ret != 0)
	{
	LOGE("[%s] mbedtls_ssl_config_defaults() fail.[-0x%x]", __func__, -ret);
	goto error;
	}

	mbedtls_ssl_conf_authmode(temp_ssl_info.conf, temp_opt.auth_mode);
	mbedtls_ssl_conf_ca_chain(temp_ssl_info.conf, temp_ssl_info.cacert, NULL);
	if(temp_opt.load_cert)
	{
	ret = mbedtls_ssl_conf_own_cert(temp_ssl_info.conf, temp_ssl_info.clientcert, temp_ssl_info.clientkey);
	if(ret != 0)
	{
	LOGE("[%s] mbedtls_ssl_conf_own_cert() fail.[-0x%x]", __func__, -ret);
	goto error;
	}
	}

	mbedtls_ssl_conf_rng(temp_ssl_info.conf, mbedtls_ctr_drbg_random, temp_ssl_info.ctr_drbg);
	//mbedtls_ssl_conf_renegotiation(&conf, temp_opt.renegotiation);
	mbedtls_ssl_conf_legacy_renegotiation(temp_ssl_info.conf, temp_opt.allow_legacy);
	// TLS 1.2
	mbedtls_ssl_conf_min_version(temp_ssl_info.conf, MBEDTLS_SSL_MAJOR_VERSION_3, temp_opt.min_version);
	// TLS 1.3
	mbedtls_ssl_conf_max_version(temp_ssl_info.conf, MBEDTLS_SSL_MAJOR_VERSION_3, temp_opt.max_version);

	mbtk_profile.allowed_mds = temp_opt.allowed_mds;
	mbedtls_ssl_conf_cert_profile(temp_ssl_info.conf, &mbtk_profile);

	//4.Binding SSL configuration
	ret = mbedtls_ssl_setup(temp_ssl_info.ssl, temp_ssl_info.conf);
	if (ret != 0)
	{
	LOGE("[%s] mbedtls_ssl_setup() fail.[-0x%x]", __func__, -ret);
	goto error;
	}

	mbedtls_ssl_set_bio(temp_ssl_info.ssl, &fd, mbedtls_net_send, mbedtls_net_recv, NULL);

	LOGD("[%s] Performing the SSL/TLS handshake...", __func__);
	//5.Shake hands
	while((ret = mbedtls_ssl_handshake(temp_ssl_info.ssl)) != 0)
	{
	if(ret != MBEDTLS_ERR_SSL_WANT_READ && ret != MBEDTLS_ERR_SSL_WANT_WRITE)
	{
	LOGE("[%s] mbedtls_ssl_handshake() fail.[-0x%x]", __func__, -ret);
	goto error;
	}
	}

	LOGD("[%s] Handshake ok: Protocol[%s], Ciphersuite[%s]", __func__, mbedtls_ssl_get_version(temp_ssl_info.ssl), mbedtls_ssl_get_ciphersuite(temp_ssl_info.ssl));
	//6.Verification certificate
	flags = mbedtls_ssl_get_verify_result(temp_ssl_info.ssl);
	if(flags != 0)
	{
	memset(verify_err, 0x00, MBTK_SSL_BUFFER_SIZE_1024 + 1);
	mbedtls_x509_crt_verify_info(verify_err, MBTK_SSL_BUFFER_SIZE_1024, "[mbedtls_ssl_get_verify_result] ", flags);
	LOGD("%s", verify_err);
	if(temp_opt.auth_mode == MBTK_MBEDTLS_SSL_VERIFY_REQUIRED)
	{
	LOGE("[%s] mbedtls_ssl_get_verify_result() fail", __func__);
	goto error;
	}
	}

	if(mbedtls_ssl_get_peer_cert(temp_ssl_info.ssl) != NULL)
	{
	LOGD("[%s] Peer certificate information", __func__);
	memset(cert_buff, 0x00, MBTK_SSL_BUFFER_SIZE_1024 + 1);
	mbedtls_x509_crt_info(cert_buff, MBTK_SSL_BUFFER_SIZE_1024, "[mbedtls_ssl_get_verify_result] ", mbedtls_ssl_get_peer_cert(temp_ssl_info.ssl));
	LOGD("%s", cert_buff);
	}

	temp_ssl_info.fd = fd;
	memcpy(inter_info, &temp_ssl_info, sizeof(mbtk_mbedtls_ssl_info_s));

	return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
	error:
	mbedtls_ssl_close_notify(temp_ssl_info.ssl);
	mbedtls_ssl_free(temp_ssl_info.ssl);
	mbedtls_ssl_config_free(temp_ssl_info.conf);
	mbedtls_ctr_drbg_free(temp_ssl_info.ctr_drbg);
	mbedtls_entropy_free(temp_ssl_info.entropy);
	mbedtls_pk_free(temp_ssl_info.clientkey);
	mbedtls_x509_crt_free(temp_ssl_info.clientcert);
	mbedtls_x509_crt_free(temp_ssl_info.cacert);

	mbtk_mbedtls_ssl_info_free(&temp_ssl_info);
	return MBTK_MBEDTLS_SSL_RESULT_FAIL;
	}

	mbtk_mbedtls_ssl_result_e mbtk_mbedtls_ssl_deinit(mbtk_mbedtls_ssl_info_s* inter_info)
	{
	if(NULL == inter_info)
	{
	LOGE("[%s] inter_info [NULL]", __func__);
	return MBTK_MBEDTLS_SSL_RESULT_FAIL;
	}

	int ret = -1;
	char error_buf[MBTK_SSL_BUFFER_SIZE_128 + 1] = {0};

	do {
	ret = mbedtls_ssl_close_notify(inter_info->ssl);
	} while (ret == MBEDTLS_ERR_SSL_WANT_READ \|\| ret == MBEDTLS_ERR_SSL_WANT_WRITE);

	if(ret != 0)
	{
	memset(error_buf, 0x00, MBTK_SSL_BUFFER_SIZE_128 + 1);
	mbedtls_strerror(ret, error_buf, MBTK_SSL_BUFFER_SIZE_128);
	LOGE("[%s] mbedtls_ssl_close_notify() fail.[%s]", __func__, error_buf);
	}

	mbedtls_ssl_close_notify(inter_info->ssl);
	mbedtls_ssl_free(inter_info->ssl);
	mbedtls_ssl_config_free(inter_info->conf);
	mbedtls_ctr_drbg_free(inter_info->ctr_drbg);
	mbedtls_entropy_free(inter_info->entropy);
	mbedtls_pk_free(inter_info->clientkey);
	mbedtls_x509_crt_free(inter_info->clientcert);
	mbedtls_x509_crt_free(inter_info->cacert);
	inter_info->fd = MBTK_SSL_INFO_FD_DEFAULT;

	mbtk_mbedtls_ssl_info_free(inter_info);
	return MBTK_MBEDTLS_SSL_RESULT_SUCCESS;
	}

	#endif