Experimental support of HTTPUpdate for OTA

code/espurna/config/dependencies.h

@@ -71,3 +71,8 @@
 #undef NTP_SUPPORT
 #define NTP_SUPPORT                 1           // Scheduler needs NTP
 #endif
+
+#if (SECURE_CLIENT == SECURE_CLIENT_BEARSSL)
+#undef OTA_CLIENT_HTTPUPDATE_2_3_0_COMPATIBLE
+#define OTA_CLIENT_HTTPUPDATE_2_3_0_COMPATIBLE 0   // Use new HTTPUpdate API with BearSSL
+#endif

code/espurna/config/general.h

@@ -682,19 +682,99 @@
 #define SPIFFS_SUPPORT              0           // Do not add support for SPIFFS by default
 #endif
 
+// -----------------------------------------------------------------------------
+// SSL Client                                                 ** EXPERIMENTAL **
+// -----------------------------------------------------------------------------
+
+#ifndef SECURE_CLIENT
+#define SECURE_CLIENT                          SECURE_CLIENT_NONE     // What variant of WiFiClient to use
+                                                                      // SECURE_CLIENT_NONE    - No secure client support (default)
+                                                                      // SECURE_CLIENT_AXTLS   - axTLS client secure support (All Core versions, ONLY TLS 1.1)
+                                                                      // SECURE_CLIENT_BEARSSL - BearSSL client secure support (starting with 2.5.0, TLS 1.2)
+                                                                      //
+                                                                      // axTLS marked for derecation since Arduino Core 2.4.2 and **will** be removed in the future
+#endif
+
+// Security check that is performed when the connection is established:
+// SECURE_CLIENT_CHECK_CA           - Use Trust Anchor / Root Certificate
+//                                    Supported only by the SECURE_CLIENT_BEARSSL
+//                                    (See respective ..._SECURE_CLIENT_INCLUDE_CA options per-module)
+// SECURE_CLIENT_CHECK_FINGERPRINT  - Check certificate fingerprint
+// SECURE_CLIENT_CHECK_NONE         - Allow insecure connections
+
+#ifndef SECURE_CLIENT_CHECK
+
+#if SECURE_CLIENT == SECURE_CLIENT_BEARSSL
+#define SECURE_CLIENT_CHECK                    SECURE_CLIENT_CHECK_CA
+
+#else
+#define SECURE_CLIENT_CHECK                    SECURE_CLIENT_CHECK_FINGERPRINT
+
+#endif
+
+
+#endif // SECURE_CLIENT_CHECK
+
+// Support Maximum Fragment Length Negotiation TLS extension
+// "...negotiate a smaller maximum fragment length due to memory limitations or bandwidth limitations."
+// - https://arduino-esp8266.readthedocs.io/en/latest/esp8266wifi/bearssl-client-secure-class.html#mfln-or-maximum-fragment-length-negotiation-saving-ram
+// - https://tools.ietf.org/html/rfc6066#section-4
+#ifndef SECURE_CLIENT_MFLN
+#define SECURE_CLIENT_MFLN                     0                      // The only possible values are: 512, 1024, 2048 and 4096
+                                                                      // Set to 0 to disable (default)
+#endif
+
 // -----------------------------------------------------------------------------
 // OTA
 // -----------------------------------------------------------------------------
 
 #ifndef OTA_PORT
-#define OTA_PORT                    8266        // OTA port
+#define OTA_PORT                    8266        // Port for ArduinoOTA
 #endif
 
 #ifndef OTA_MQTT_SUPPORT
-#define OTA_MQTT_SUPPORT           0            // No support by default
+#define OTA_MQTT_SUPPORT            0           // Listen for HTTP(s) URLs at '<root topic>/ota'. Depends on OTA_CLIENT
+#endif
+
+#ifndef OTA_ARDUINOOTA_SUPPORT
+#define OTA_ARDUINOOTA_SUPPORT      1           // Support ArduinoOTA by default (4.2Kb)
+                                                // Implicitly depends on ESP8266mDNS library, thus increasing firmware size
+#endif
+
+#ifndef OTA_CLIENT
+#define OTA_CLIENT                  OTA_CLIENT_ASYNCTCP     // Terminal / MQTT OTA support
+                                                            // OTA_CLIENT_ASYNCTCP   (ESPAsyncTCP library)
+                                                            // OTA_CLIENT_HTTPUPDATE (Arduino Core library)
+#endif
+
+#ifndef OTA_CLIENT_HTTPUPDATE_2_3_0_COMPATIBLE
+#define OTA_CLIENT_HTTPUPDATE_2_3_0_COMPATIBLE    1   // Use old HTTPUpdate API by default
+#endif
+
+#define OTA_GITHUB_FP               "CA:06:F5:6B:25:8B:7A:0D:4F:2B:05:47:09:39:47:86:51:15:19:84"
+
+#ifndef OTA_FINGERPRINT
+#define OTA_FINGERPRINT             OTA_GITHUB_FP
+#endif
+
+#ifndef OTA_SECURE_CLIENT_CHECK
+#define OTA_SECURE_CLIENT_CHECK                SECURE_CLIENT_CHECK
+#endif
+
+#ifndef OTA_SECURE_CLIENT_MFLN
+#define OTA_SECURE_CLIENT_MFLN                 SECURE_CLIENT_MFLN
+#endif
+
+#ifndef OTA_SECURE_CLIENT_INCLUDE_CA
+#define OTA_SECURE_CLIENT_INCLUDE_CA        0            // Use user-provided CA. Only PROGMEM PEM option is supported.
+                                                         // TODO: eventually should be replaced with pre-parsed structs, read directly from flash
+                                                         // (ref: https://github.com/earlephilhower/bearssl-esp8266/pull/14)
+                                                         //
+                                                         // When enabled, current implementation includes "static/ota_secure_client_ca.h" with
+                                                         // const char _ota_client_http_update_ca[] PROGMEM = "...PEM data...";
+                                                         // By default, using DigiCert root in "static/digicert_evroot_pem.h" (for https://github.com)
 #endif
 
-#define OTA_GITHUB_FP               "D7:9F:07:61:10:B3:92:93:E3:49:AC:89:84:5B:03:80:C1:9E:2F:8B"
 
 // -----------------------------------------------------------------------------
 // NOFUSS
@@ -1330,6 +1410,8 @@
 #endif
 
 // Enable RCSwitch support
+// Originally implemented for SONOFF BASIC
+// https://tinkerman.cat/adding-rf-to-a-non-rf-itead-sonoff/
 // Also possible to use with SONOFF RF BRIDGE, thanks to @wildwiz
 // https://github.com/xoseperez/espurna/wiki/Hardware-Itead-Sonoff-RF-Bridge---Direct-Hack
 #ifndef RFB_DIRECT

code/espurna/config/hardware.h

@@ -3975,6 +3975,7 @@
     #define INFLUXDB_SUPPORT    1
     #define IR_SUPPORT          1
     #define RF_SUPPORT          1
+    #define OTA_MQTT_SUPPORT    1
 
     #define RFB_DIRECT          1
     #define RFB_RX_PIN          4

code/espurna/config/progmem.h

@@ -135,6 +135,32 @@ PROGMEM const char espurna_modules[] =
     #endif
     "";
 
+PROGMEM const char espurna_ota_modules[] =
+    #if OTA_ARDUINOOTA_SUPPORT
+        "ARDUINO "
+    #endif
+    #if (OTA_CLIENT == OTA_CLIENT_ASYNCTCP)
+        "ASYNCTCP "
+    #endif
+    #if (OTA_CLIENT == OTA_CLIENT_HTTPUPDATE)
+    #if (SECURE_CLIENT == SECURE_CLIENT_NONE)
+        "*HTTPUPDATE "
+    #endif
+    #if (SECURE_CLIENT == SECURE_CLIENT_AXTLS)
+        "*HTTPUPDATE_AXTLS "
+    #endif
+    #if (SECURE_CLIENT == SECURE_CLIENT_BEARSSL)
+        "*HTTPUPDATE_BEARSSL "
+    #endif
+    #endif // OTA_CLIENT_HTTPUPDATE
+    #if OTA_MQTT_SUPPORT
+        "MQTT "
+    #endif
+    #if WEB_SUPPORT
+        "WEB "
+    #endif
+    "";
+
 //--------------------------------------------------------------------------------
 // Sensors
 //--------------------------------------------------------------------------------

code/espurna/config/prototypes.h

@@ -1,6 +1,7 @@
 #include <Arduino.h>
 #include <ArduinoJson.h>
 #include <functional>
+#include <memory>
 #include <core_version.h>
 
 extern "C" {
@@ -168,7 +169,30 @@ void i2c_read_buffer(uint8_t address, uint8_t * buffer, size_t len);
 // -----------------------------------------------------------------------------
 // OTA
 // -----------------------------------------------------------------------------
-#include "ESPAsyncTCP.h"
+
+#include <ArduinoOTA.h>
+
+#if OTA_CLIENT == OTA_CLIENT_ASYNCTCP
+    #include <ESPAsyncTCP.h>
+#endif
+
+#if OTA_CLIENT == OTA_CLIENT_HTTPUPDATE
+    #include <ESP8266HTTPClient.h>
+    #include <ESP8266httpUpdate.h>
+#endif
+
+#if SECURE_CLIENT != SECURE_CLIENT_NONE
+
+    #include <WiFiClientSecure.h>
+
+    #if OTA_SECURE_CLIENT_INCLUDE_CA
+    #include "static/ota_secure_client_ca.h"
+    #else
+    #include "static/digicert_evroot_pem.h"
+    #define _ota_client_http_update_ca _ssl_digicert_ev_root_ca
+    #endif
+
+#endif // SECURE_CLIENT_SUPPORT
 
 // -----------------------------------------------------------------------------
 // RFM69
@@ -285,3 +309,14 @@ bool wifiConnected();
 // -----------------------------------------------------------------------------
 #include "rtcmem.h"
 
+// -----------------------------------------------------------------------------
+// std::make_unique backport for C++11
+// -----------------------------------------------------------------------------
+#if 201103L >= __cplusplus
+namespace std {
+    template<typename T, typename... Args>
+    std::unique_ptr<T> make_unique(Args&&... args) {
+        return std::unique_ptr<T>(new T(std::forward<Args>(args)...));
+    }
+}
+#endif

code/espurna/config/types.h

@@ -348,4 +348,25 @@
 // Telnet server
 //------------------------------------------------------------------------------
 #define TELNET_SERVER_ASYNC        0
-#define TELNET_SERVER_WIFISERVER   1
+#define TELNET_SERVER_WIFISERVER   1
+
+//------------------------------------------------------------------------------
+// OTA Client (not related to the Web OTA support)
+//------------------------------------------------------------------------------
+
+#define OTA_CLIENT_NONE             0
+#define OTA_CLIENT_ASYNCTCP         1
+#define OTA_CLIENT_HTTPUPDATE       2
+
+//------------------------------------------------------------------------------
+// Secure Client
+//------------------------------------------------------------------------------
+
+#define SECURE_CLIENT_NONE                0
+#define SECURE_CLIENT_AXTLS               1
+#define SECURE_CLIENT_BEARSSL             2
+
+#define SECURE_CLIENT_CHECK_NONE          0 // !!! INSECURE CONNECTION !!!
+#define SECURE_CLIENT_CHECK_FINGERPRINT   1 // legacy fingerprint validation
+#define SECURE_CLIENT_CHECK_CA            2 // set trust anchor from PROGMEM CA certificate
+

code/espurna/espurna.ino

@@ -110,10 +110,15 @@ void setup() {
     info();
 
     wifiSetup();
-    otaSetup();
+    #if OTA_ARDUINOOTA_SUPPORT
+        arduinoOtaSetup();
+    #endif
     #if TELNET_SUPPORT
         telnetSetup();
     #endif
+    #if OTA_CLIENT != OTA_CLIENT_NONE
+        otaClientSetup();
+    #endif
 
     // -------------------------------------------------------------------------
     // Check if system is stable

code/espurna/libs/URL.h

@@ -0,0 +1,68 @@
+// -----------------------------------------------------------------------------
+// Parse char string as URL
+//
+// Adapted from HTTPClient::beginInternal()
+// https://github.com/esp8266/Arduino/blob/master/libraries/ESP8266HTTPClient/src/ESP8266HTTPClient.cpp
+//
+// -----------------------------------------------------------------------------
+
+#pragma once
+
+struct URL {
+    String value;
+    String protocol;
+    String host;
+    String path;
+    uint16_t port;
+
+    URL(const char* url) { init(url); }
+    URL(const String& url) { init(url); }
+
+    void init(String url);
+};
+
+void URL::init(String url) {
+
+    this->value = url;
+
+    // cut the protocol part
+    int index = url.indexOf("://");
+    if (index > 0) {
+        this->protocol = url.substring(0, index);
+        url.remove(0, (index + 3));
+    }
+
+    if (this->protocol == "http") {
+        this->port = 80;
+    } else if (this->protocol == "https") {
+        this->port = 443;
+    }
+
+    // cut the host part
+    String _host;
+
+    index = url.indexOf('/');
+    if (index >= 0) {
+        _host = url.substring(0, index);
+    } else {
+        _host = url;
+    }
+
+    // store the remaining part as path
+    if (index >= 0) {
+        url.remove(0, index);
+        this->path = url;
+    } else {
+        this->path = "/";
+    }
+
+    // separate host from port, when present
+    index = _host.indexOf(':');
+    if (index >= 0) {
+        this->port = _host.substring(index + 1).toInt();
+        this->host = _host.substring(0, index);
+    } else {
+        this->host = _host;
+    }
+
+}