Implement ServerConfig

src/tls.rs

@@ -120,6 +120,7 @@ impl<'a> Debug for X509<'a> {
     any(esp_idf_esp_tls_using_mbedtls, esp_idf_esp_tls_using_wolfssl)
 ))]
 mod esptls {
+    use core::ffi::c_int;
     use core::task::{Context, Poll};
     use core::time::Duration;
 
@@ -300,6 +301,96 @@ mod esptls {
         pub hint: &'a CStr,
     }
 
+    #[cfg(esp_idf_esp_tls_server)]
+    pub struct ServerConfig<'a> {
+        /// up to 9 ALPNs allowed, with avg 10 bytes for each name
+        pub alpn_protos: Option<&'a [&'a str]>,
+        pub ca_cert: Option<X509<'a>>,
+        pub server_cert: Option<X509<'a>>,
+        pub server_key: Option<X509<'a>>,
+        pub server_key_password: Option<&'a str>,
+        pub use_secure_element: bool,
+        pub handshake_callback: Option<extern "C" fn(*mut sys::mbedtls_ssl_context) -> c_int>,
+    }
+
+    #[cfg(esp_idf_esp_tls_server)]
+    impl<'a> ServerConfig<'a> {
+        pub const fn new() -> Self {
+            Self {
+                alpn_protos: None,
+                ca_cert: None,
+                server_cert: None,
+                server_key: None,
+                server_key_password: None,
+                use_secure_element: false,
+                handshake_callback: None,
+            }
+        }
+
+        fn try_into_raw(
+            &self,
+            bufs: &mut RawConfigBufs,
+        ) -> Result<sys::esp_tls_cfg_server, EspError> {
+            let mut rcfg: sys::esp_tls_cfg_server = Default::default();
+
+            if let Some(ca_cert) = self.ca_cert {
+                rcfg.__bindgen_anon_1.cacert_buf = ca_cert.data().as_ptr();
+                rcfg.__bindgen_anon_2.cacert_bytes = ca_cert.data().len() as u32;
+            }
+
+            if let Some(server_cert) = self.server_cert {
+                rcfg.__bindgen_anon_3.servercert_buf = server_cert.data().as_ptr();
+                rcfg.__bindgen_anon_4.servercert_bytes = server_cert.data().len() as u32;
+            }
+
+            if let Some(server_key) = self.server_key {
+                rcfg.__bindgen_anon_5.serverkey_buf = server_key.data().as_ptr();
+                rcfg.__bindgen_anon_6.serverkey_bytes = server_key.data().len() as u32;
+            }
+
+            if let Some(ckp) = self.server_key_password {
+                rcfg.serverkey_password = ckp.as_ptr();
+                rcfg.serverkey_password_len = ckp.len() as u32;
+            }
+
+            // allow up to 9 protocols
+            if let Some(protos) = self.alpn_protos {
+                bufs.alpn_protos = cstr_arr_from_str_slice(protos, &mut bufs.alpn_protos_cbuf)?;
+                rcfg.alpn_protos = bufs.alpn_protos.as_mut_ptr();
+            }
+
+            rcfg.use_secure_element = self.use_secure_element;
+
+            if let Some(cb) = self.handshake_callback {
+                rcfg.cert_select_cb = cb;
+            }
+
+            Ok(rcfg)
+        }
+    }
+
+    impl<'a> Default for ServerConfig<'a> {
+        fn default() -> Self {
+            Self::new()
+        }
+    }
+
+    struct RawConfigBufs {
+        alpn_protos: [*const i8; 10],
+        alpn_protos_cbuf: [u8; 99],
+        common_name_buf: [u8; MAX_COMMON_NAME_LENGTH + 1],
+    }
+
+    impl Default for RawConfigBufs {
+        fn default() -> Self {
+            RawConfigBufs {
+                alpn_protos: [core::ptr::null(); 10],
+                alpn_protos_cbuf: [0; 99],
+                common_name_buf: [0; MAX_COMMON_NAME_LENGTH + 1],
+            }
+        }
+    }
+
     pub trait Socket {
         fn handle(&self) -> i32;
         fn release(&mut self) -> Result<(), EspError>;
@@ -442,18 +533,18 @@ mod esptls {
         /// * `ESP_TLS_ERR_SSL_WANT_READ` if the socket is in non-blocking mode and it is not ready for reading
         /// * `ESP_TLS_ERR_SSL_WANT_WRITE` if the socket is in non-blocking mode and it is not ready for writing
         /// * `EWOULDBLOCK` if the socket is in non-blocking mode and it is not ready either for reading or writing (a peculiarity/bug of the `esp-tls` C module)
-        #[cfg(all(
-            not(esp_idf_version_major = "4"),
-            any(not(esp_idf_version_major = "5"), not(esp_idf_version_minor = "0")),
-            esp_idf_esp_tls_server
-        ))]
+        #[cfg(esp_idf_esp_tls_server)]
         pub fn negotiate_server(&mut self, cfg: &ServerConfig) -> Result<(), EspError> {
             let mut bufs = RawConfigBufs::default();
             let rcfg = cfg.try_into_raw(&mut bufs)?;
 
             unsafe {
-                sys::esp_tls_server_session_create(&rcfg, self.socket.handle(), self.raw);
-                // TODO handle error
+                let error =
+                    sys::esp_tls_server_session_create(&rcfg, self.socket.handle(), self.raw);
+                if error != 0 {
+                    log::error!("failed to create tls server session (error {error})");
+                    return EspError::from_infallible::<ESP_FAIL>();
+                }
             }
             self.server_session = true;