Greengrass discovery feature

Common/app/greengrass/greengrass_discovery_task.h

@@ -0,0 +1,15 @@
+#ifndef _GREENGRASS_DISCOVERY_TASK_H_
+#define _GREENGRASS_DISCOVERY_TASK_H_
+
+#include "FreeRTOS.h"
+#include <stdbool.h>
+
+typedef struct
+{
+    bool ggDiscoverySuccess;        /* Boolean flag indicating if the GG Discovery was successful */
+} GGDiscoveryContext;
+
+void vGGDiscoveryTask( void * pvParameters );
+
+
+#endif /* ifndef _GREENGRASS_DISCOVERY_TASK_H_ */

Common/app/greengrass/x509_crt_ip_addr_san_verif.patch

@@ -0,0 +1,271 @@
+diff --git a/Middleware/ARM/mbedtls/library/x509_crt.c b/Middleware/ARM/mbedtls/library/x509_crt.c
+index c8654445dd..7b90a4858f 100644
+--- a/Middleware/ARM/mbedtls/library/x509_crt.c
++++ b/Middleware/ARM/mbedtls/library/x509_crt.c
+@@ -2996,9 +2996,258 @@ static int x509_crt_check_cn( const mbedtls_x509_buf *name,
+     return( -1 );
+ }
+
++#ifdef MBEDTLS_CUSTOM_SAN_IP_VERIF
++ /* Use whether or not AF_INET6 is defined to indicate whether or not to use
++ * the platform inet_pton() or a local implementation (below).  The local
++ * implementation may be used even in cases where the platform provides
++ * inet_pton(), e.g. when there are different includes required and/or the
++ * platform implementation requires dependencies on additional libraries.
++ * Specifically, Windows requires custom includes and additional link
++ * dependencies, and Solaris requires additional link dependencies.
++ * Also, as a coarse heuristic, use the local implementation if the compiler
++ * does not support __has_include(), or if the definition of AF_INET6 is not
++ * provided by headers included (or not) via __has_include() above.
++ * MBEDTLS_TEST_SW_INET_PTON is a bypass define to force testing of this code //no-check-names
++ * despite having a platform that has inet_pton. */
++#if !defined(AF_INET6) || defined(MBEDTLS_TEST_SW_INET_PTON) //no-check-names
++/* Definition located further below to possibly reduce compiler inlining */
++static int x509_inet_pton_ipv4(const char *src, void *dst);
++
++#define li_cton(c, n) \
++    (((n) = (c) - '0') <= 9 || (((n) = ((c)&0xdf) - 'A') <= 5 ? ((n) += 10) : 0))
++
++static int x509_inet_pton_ipv6(const char *src, void *dst)
++{
++    const unsigned char *p = (const unsigned char *) src;
++    int nonzero_groups = 0, num_digits, zero_group_start = -1;
++    uint16_t addr[8];
++    do {
++        /* note: allows excess leading 0's, e.g. 1:0002:3:... */
++        uint16_t group = num_digits = 0;
++        for (uint8_t digit; num_digits < 4; num_digits++) {
++            if (li_cton(*p, digit) == 0) {
++                break;
++            }
++            group = (group << 4) | digit;
++            p++;
++        }
++        if (num_digits != 0) {
++            MBEDTLS_PUT_UINT16_BE(group, addr, nonzero_groups);
++            nonzero_groups++;
++            if (*p == '\0') {
++                break;
++            } else if (*p == '.') {
++                /* Don't accept IPv4 too early or late */
++                if ((nonzero_groups == 0 && zero_group_start == -1) ||
++                    nonzero_groups >= 7) {
++                    break;
++                }
++
++                /* Walk back to prior ':', then parse as IPv4-mapped */
++                int steps = 4;
++                do {
++                    p--;
++                    steps--;
++                } while (*p != ':' && steps > 0);
++
++                if (*p != ':') {
++                    break;
++                }
++                p++;
++                nonzero_groups--;
++                if (x509_inet_pton_ipv4((const char *) p,
++                                        addr + nonzero_groups) != 0) {
++                    break;
++                }
++
++                nonzero_groups += 2;
++                p = (const unsigned char *) "";
++                break;
++            } else if (*p != ':') {
++                return -1;
++            }
++        } else {
++            /* Don't accept a second zero group or an invalid delimiter */
++            if (zero_group_start != -1 || *p != ':') {
++                return -1;
++            }
++            zero_group_start = nonzero_groups;
++
++            /* Accept a zero group at start, but it has to be a double colon */
++            if (zero_group_start == 0 && *++p != ':') {
++                return -1;
++            }
++
++            if (p[1] == '\0') {
++                ++p;
++                break;
++            }
++        }
++        ++p;
++    } while (nonzero_groups < 8);
++
++    if (*p != '\0') {
++        return -1;
++    }
++
++    if (zero_group_start != -1) {
++        if (nonzero_groups > 6) {
++            return -1;
++        }
++        int zero_groups = 8 - nonzero_groups;
++        int groups_after_zero = nonzero_groups - zero_group_start;
++
++        /* Move the non-zero part to after the zeroes */
++        if (groups_after_zero) {
++            memmove(addr + zero_group_start + zero_groups,
++                    addr + zero_group_start,
++                    groups_after_zero * sizeof(*addr));
++        }
++        memset(addr + zero_group_start, 0, zero_groups * sizeof(*addr));
++    } else {
++        if (nonzero_groups != 8) {
++            return -1;
++        }
++    }
++    memcpy(dst, addr, sizeof(addr));
++    return 0;
++}
++
++static int x509_inet_pton_ipv4(const char *src, void *dst)
++{
++    const unsigned char *p = (const unsigned char *) src;
++    uint8_t *res = (uint8_t *) dst;
++    uint8_t digit, num_digits = 0;
++    uint8_t num_octets = 0;
++    uint16_t octet;
++
++    do {
++        octet = num_digits = 0;
++        do {
++            digit = *p - '0';
++            if (digit > 9) {
++                break;
++            }
++
++            /* Don't allow leading zeroes. These might mean octal format,
++             * which this implementation does not support. */
++            if (octet == 0 && num_digits > 0) {
++                return -1;
++            }
++
++            octet = octet * 10 + digit;
++            num_digits++;
++            p++;
++        } while (num_digits < 3);
++
++        if (octet >= 256 || num_digits > 3 || num_digits == 0) {
++            return -1;
++        }
++        *res++ = (uint8_t) octet;
++        num_octets++;
++    } while (num_octets < 4 && *p++ == '.');
++    return num_octets == 4 && *p == '\0' ? 0 : -1;
++}
++
++#else
++
++static int x509_inet_pton_ipv6(const char *src, void *dst)
++{
++    return inet_pton(AF_INET6, src, dst) == 1 ? 0 : -1;
++}
++
++static int x509_inet_pton_ipv4(const char *src, void *dst)
++{
++    return inet_pton(AF_INET, src, dst) == 1 ? 0 : -1;
++}
++
++#endif /* !AF_INET6 || MBEDTLS_TEST_SW_INET_PTON */ //no-check-names
++
++size_t mbedtls_x509_crt_parse_cn_inet_pton(const char *cn, void *dst)
++{
++    return strchr(cn, ':') == NULL
++            ? x509_inet_pton_ipv4(cn, dst) == 0 ? 4 : 0
++            : x509_inet_pton_ipv6(cn, dst) == 0 ? 16 : 0;
++}
++
++static int x509_crt_check_san_ip(const mbedtls_x509_sequence *san,
++                                 const char *cn, size_t cn_len)
++{
++    uint32_t ip[4];
++    cn_len = mbedtls_x509_crt_parse_cn_inet_pton(cn, ip);
++    if (cn_len == 0) {
++        return -1;
++    }
++
++    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
++        const unsigned char san_type = (unsigned char) cur->buf.tag &
++                                       MBEDTLS_ASN1_TAG_VALUE_MASK;
++        if (san_type == MBEDTLS_X509_SAN_IP_ADDRESS &&
++            cur->buf.len == cn_len && memcmp(cur->buf.p, ip, cn_len) == 0) {
++            return 0;
++        }
++    }
++
++    return -1;
++}
++
++static int x509_crt_check_san_uri(const mbedtls_x509_sequence *san,
++                                  const char *cn, size_t cn_len)
++{
++    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
++        const unsigned char san_type = (unsigned char) cur->buf.tag &
++                                       MBEDTLS_ASN1_TAG_VALUE_MASK;
++        if (san_type == MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER &&
++            cur->buf.len == cn_len && memcmp(cur->buf.p, cn, cn_len) == 0) {
++            return 0;
++        }
++    }
++
++    return -1;
++}
++
+ /*
+  * Check for SAN match, see RFC 5280 Section 4.2.1.6
+  */
++
++static int x509_crt_check_san(const mbedtls_x509_sequence *san,
++                              const char *cn, size_t cn_len)
++{
++    int san_ip = 0;
++    int san_uri = 0;
++    /* Prioritize DNS name over other subtypes due to popularity */
++    for (const mbedtls_x509_sequence *cur = san; cur != NULL; cur = cur->next) {
++        switch ((unsigned char) cur->buf.tag & MBEDTLS_ASN1_TAG_VALUE_MASK) {
++            case MBEDTLS_X509_SAN_DNS_NAME:
++                if (x509_crt_check_cn(&cur->buf, cn, cn_len) == 0) {
++                    return 0;
++                }
++                break;
++            case MBEDTLS_X509_SAN_IP_ADDRESS:
++                san_ip = 1;
++                break;
++            case MBEDTLS_X509_SAN_UNIFORM_RESOURCE_IDENTIFIER:
++                san_uri = 1;
++                break;
++            /* (We may handle other types here later.) */
++            default: /* Unrecognized type */
++                break;
++        }
++    }
++    if (san_ip) {
++        if (x509_crt_check_san_ip(san, cn, cn_len) == 0) {
++            return 0;
++        }
++    }
++    if (san_uri) {
++        if (x509_crt_check_san_uri(san, cn, cn_len) == 0) {
++            return 0;
++        }
++    }
++
++    return -1;
++}
++#else
+ static int x509_crt_check_san( const mbedtls_x509_buf *name,
+                                const char *cn, size_t cn_len )
+ {
+@@ -3014,6 +3263,7 @@ static int x509_crt_check_san( const mbedtls_x509_buf *name,
+     /* Unrecognized type */
+     return( -1 );
+ }
++#endif /* MBEDTLS_CUSTOM_SAN_IP_VERIF */
+
+ /*
+  * Verify the requested CN - only call this if cn is not NULL!