nodemcu-firmware/app/modules/tls.c

// Module for TLS

#include "module.h"

#if defined(CLIENT_SSL_ENABLE) && defined(LUA_USE_MODULES_NET)

#include "lauxlib.h"
#include "platform.h"
#include "lmem.h"

#include "c_string.h"
#include "c_stdlib.h"

#include "c_types.h"
#include "mem.h"
#include "lwip/ip_addr.h"
#include "espconn.h"
#include "sys/espconn_mbedtls.h"
#include "lwip/err.h"
#include "lwip/dns.h"

#include "mbedtls/debug.h"
#include "user_mbedtls.h"

#ifdef HAVE_SSL_SERVER_CRT
#include HAVE_SSL_SERVER_CRT
#else
__attribute__((section(".servercert.flash"))) unsigned char tls_server_cert_area[INTERNAL_FLASH_SECTOR_SIZE];
#endif

__attribute__((section(".clientcert.flash"))) unsigned char tls_client_cert_area[INTERNAL_FLASH_SECTOR_SIZE];

extern int tls_socket_create( lua_State *L );
extern const LUA_REG_TYPE tls_cert_map[];

typedef struct {
  struct espconn *pesp_conn;
  int self_ref;
  int cb_connect_ref;
  int cb_reconnect_ref;
  int cb_disconnect_ref;
  int cb_sent_ref;
  int cb_receive_ref;
  int cb_dns_ref;
} tls_socket_ud;

int tls_socket_create( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud*) lua_newuserdata(L, sizeof(tls_socket_ud));

  ud->pesp_conn = NULL;
  ud->self_ref =
  ud->cb_connect_ref =
  ud->cb_reconnect_ref =
  ud->cb_disconnect_ref =
  ud->cb_sent_ref =
  ud->cb_receive_ref =
  ud->cb_dns_ref = LUA_NOREF;

  luaL_getmetatable(L, "tls.socket");
  lua_setmetatable(L, -2);

  return 1;
}

static void tls_socket_onconnect( struct espconn *pesp_conn ) {
  tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  if (!ud || ud->self_ref == LUA_NOREF) return;
  if (ud->cb_connect_ref != LUA_NOREF) {
    lua_State *L = lua_getstate();
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_connect_ref);
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
    lua_call(L, 1, 0);
  }
}

static void tls_socket_cleanup(tls_socket_ud *ud) {
  if (ud->pesp_conn) {
    espconn_secure_disconnect(ud->pesp_conn);
    if (ud->pesp_conn->proto.tcp) {
      c_free(ud->pesp_conn->proto.tcp);
      ud->pesp_conn->proto.tcp = NULL;
    }
    c_free(ud->pesp_conn);
    ud->pesp_conn = NULL;
  }
  lua_State *L = lua_getstate();
  lua_gc(L, LUA_GCSTOP, 0);
  luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
  ud->self_ref = LUA_NOREF;
  lua_gc(L, LUA_GCRESTART, 0);
}

static void tls_socket_ondisconnect( struct espconn *pesp_conn ) {
  tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  if (!ud || ud->self_ref == LUA_NOREF) return;
  tls_socket_cleanup(ud);
  if (ud->cb_disconnect_ref != LUA_NOREF) {
    lua_State *L = lua_getstate();
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_disconnect_ref);
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
    tls_socket_cleanup(ud);
    lua_call(L, 1, 0);
  } else tls_socket_cleanup(ud);
}

static void tls_socket_onreconnect( struct espconn *pesp_conn, s8 err ) {
  tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  if (!ud || ud->self_ref == LUA_NOREF) return;
  if (ud->cb_reconnect_ref != LUA_NOREF) {
    const char* reason = NULL;
    switch (err) {
      case(ESPCONN_MEM): reason = "Out of memory"; break;
      case(ESPCONN_TIMEOUT): reason = "Timeout"; break;
      case(ESPCONN_RTE): reason = "Routing problem"; break;
      case(ESPCONN_ABRT): reason = "Connection aborted"; break;
      case(ESPCONN_RST): reason = "Connection reset"; break;
      case(ESPCONN_CLSD): reason = "Connection closed"; break;
      case(ESPCONN_HANDSHAKE): reason = "SSL handshake failed"; break;
      case(ESPCONN_SSL_INVALID_DATA): reason = "SSL application invalid"; break;
    }
    lua_State *L = lua_getstate();
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_reconnect_ref);
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
    if (reason != NULL) {
      lua_pushstring(L, reason);
    } else {
      lua_pushnil(L);
    }
    tls_socket_cleanup(ud);
    lua_call(L, 2, 0);
  } else tls_socket_cleanup(ud);
}

static void tls_socket_onrecv( struct espconn *pesp_conn, char *buf, u16 length ) {
  tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  if (!ud || ud->self_ref == LUA_NOREF) return;
  if (ud->cb_receive_ref != LUA_NOREF) {
    lua_State *L = lua_getstate();
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_receive_ref);
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
    lua_pushlstring(L, buf, length);
    lua_call(L, 2, 0);
  }
}

static void tls_socket_onsent( struct espconn *pesp_conn ) {
  tls_socket_ud *ud = (tls_socket_ud *)pesp_conn->reverse;
  if (!ud || ud->self_ref == LUA_NOREF) return;
  if (ud->cb_sent_ref != LUA_NOREF) {
    lua_State *L = lua_getstate();
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_sent_ref);
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
    lua_call(L, 1, 0);
  }
}

static void tls_socket_dns_cb( const char* domain, const ip_addr_t *ip_addr, tls_socket_ud *ud ) {
  if (ud->self_ref == LUA_NOREF) return;
  ip_addr_t addr;
  if (ip_addr) addr = *ip_addr;
  else addr.addr = 0xFFFFFFFF;
  lua_State *L = lua_getstate();
  if (ud->cb_dns_ref != LUA_NOREF) {
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->cb_dns_ref);
    lua_rawgeti(L, LUA_REGISTRYINDEX, ud->self_ref);
    if (addr.addr == 0xFFFFFFFF) {
      lua_pushnil(L);
    } else {
      char tmp[20];
      c_sprintf(tmp, IPSTR, IP2STR(&addr.addr));
      lua_pushstring(L, tmp);
    }
    lua_call(L, 2, 0);
  }
  if (addr.addr == 0xFFFFFFFF) {
    lua_gc(L, LUA_GCSTOP, 0);
    luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
    ud->self_ref = LUA_NOREF;
    lua_gc(L, LUA_GCRESTART, 0);
  } else {
    os_memcpy(ud->pesp_conn->proto.tcp->remote_ip, &addr.addr, 4);
    espconn_secure_connect(ud->pesp_conn);
  }
}

static int tls_socket_connect( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }

  if (ud->pesp_conn) {
    return luaL_error(L, "already connected");
  }

  u16 port = luaL_checkinteger( L, 2 );
  size_t il;
  const char *domain = "127.0.0.1";
  if( lua_isstring(L, 3) )
    domain = luaL_checklstring( L, 3, &il );
  if (port == 0)
    return luaL_error(L, "invalid port");
  if (domain == NULL)
    return luaL_error(L, "invalid domain");

  ud->pesp_conn = (struct espconn*)c_zalloc(sizeof(struct espconn));
  if(!ud->pesp_conn)
    return luaL_error(L, "not enough memory");
  ud->pesp_conn->proto.udp = NULL;
  ud->pesp_conn->proto.tcp = (esp_tcp *)c_zalloc(sizeof(esp_tcp));
  if(!ud->pesp_conn->proto.tcp){
    c_free(ud->pesp_conn);
    ud->pesp_conn = NULL;
    return luaL_error(L, "not enough memory");
  }
  ud->pesp_conn->type = ESPCONN_TCP;
  ud->pesp_conn->state = ESPCONN_NONE;
  ud->pesp_conn->reverse = ud;
  ud->pesp_conn->proto.tcp->remote_port = port;
  espconn_regist_connectcb(ud->pesp_conn, (espconn_connect_callback)tls_socket_onconnect);
  espconn_regist_disconcb(ud->pesp_conn, (espconn_connect_callback)tls_socket_ondisconnect);
  espconn_regist_reconcb(ud->pesp_conn, (espconn_reconnect_callback)tls_socket_onreconnect);
  espconn_regist_recvcb(ud->pesp_conn, (espconn_recv_callback)tls_socket_onrecv);
  espconn_regist_sentcb(ud->pesp_conn, (espconn_sent_callback)tls_socket_onsent);

  if (ud->self_ref == LUA_NOREF) {
    lua_pushvalue(L, 1);  // copy to the top of stack
    ud->self_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  }

  ip_addr_t addr;
  err_t err = dns_gethostbyname(domain, &addr, (dns_found_callback)tls_socket_dns_cb, ud);
  if (err == ERR_OK) {
    tls_socket_dns_cb(domain, &addr, ud);
  } else if (err != ERR_INPROGRESS) {
    tls_socket_dns_cb(domain, NULL, ud);
  }

  return 0;
}

static int tls_socket_on( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }

  size_t sl;
  const char *method = luaL_checklstring( L, 2, &sl );
  if (method == NULL)
    return luaL_error( L, "wrong arg type" );

  luaL_checkanyfunction(L, 3);
  lua_pushvalue(L, 3);  // copy argument (func) to the top of stack

  if (strcmp(method, "connection") == 0) {
    luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_connect_ref);
    ud->cb_connect_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  } else if (strcmp(method, "disconnection") == 0) {
    luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_disconnect_ref);
    ud->cb_disconnect_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  } else if (strcmp(method, "reconnection") == 0) {
    luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_reconnect_ref);
    ud->cb_reconnect_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  } else if (strcmp(method, "receive") == 0) {
    luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_receive_ref);
    ud->cb_receive_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  } else if (strcmp(method, "sent") == 0) {
    luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_sent_ref);
    ud->cb_sent_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  } else if (strcmp(method, "dns") == 0) {
    luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_dns_ref);
    ud->cb_dns_ref = luaL_ref(L, LUA_REGISTRYINDEX);
  } else {
    return luaL_error(L, "invalid method");
  }
  return 0;
}

static int tls_socket_send( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }

  if(ud->pesp_conn == NULL) {
    NODE_DBG("not connected");
    return 0;
  }

  size_t sl;
  const char* buf = luaL_checklstring(L, 2, &sl);
  if (!buf) {
    return luaL_error(L, "wrong arg type");
  }

  espconn_secure_send(ud->pesp_conn, (void*)buf, sl);

  return 0;
}
static int tls_socket_hold( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }

  if(ud->pesp_conn == NULL) {
    NODE_DBG("not connected");
    return 0;
  }

  espconn_recv_hold(ud->pesp_conn);

  return 0;
}
static int tls_socket_unhold( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }

  if(ud->pesp_conn == NULL) {
    NODE_DBG("not connected");
    return 0;
  }

  espconn_recv_unhold(ud->pesp_conn);

  return 0;
}
static int tls_socket_dns( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }

  return 0;
}
static int tls_socket_getpeer( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }

  if(ud->pesp_conn && ud->pesp_conn->proto.tcp->remote_port != 0){
    char temp[20] = {0};
    c_sprintf(temp, IPSTR, IP2STR( &(ud->pesp_conn->proto.tcp->remote_ip) ) );
    lua_pushstring( L, temp );
    lua_pushinteger( L, ud->pesp_conn->proto.tcp->remote_port );
  } else {
    lua_pushnil( L );
    lua_pushnil( L );
  }
  return 2;
}
static int tls_socket_close( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }

  if (ud->pesp_conn) {
    espconn_secure_disconnect(ud->pesp_conn);
  }

  return 0;
}
static int tls_socket_delete( lua_State *L ) {
  tls_socket_ud *ud = (tls_socket_ud *)luaL_checkudata(L, 1, "tls.socket");
  luaL_argcheck(L, ud, 1, "TLS socket expected");
  if(ud==NULL){
  	NODE_DBG("userdata is nil.\n");
  	return 0;
  }
  if (ud->pesp_conn) {
    espconn_secure_disconnect(ud->pesp_conn);
    if (ud->pesp_conn->proto.tcp) {
      c_free(ud->pesp_conn->proto.tcp);
      ud->pesp_conn->proto.tcp = NULL;
    }
    c_free(ud->pesp_conn);
    ud->pesp_conn = NULL;
  }

  luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_connect_ref);
  ud->cb_connect_ref = LUA_NOREF;
  luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_disconnect_ref);
  ud->cb_disconnect_ref = LUA_NOREF;
  luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_reconnect_ref);
  ud->cb_reconnect_ref = LUA_NOREF;
  luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_dns_ref);
  ud->cb_dns_ref = LUA_NOREF;
  luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_receive_ref);
  ud->cb_receive_ref = LUA_NOREF;
  luaL_unref(L, LUA_REGISTRYINDEX, ud->cb_sent_ref);
  ud->cb_sent_ref = LUA_NOREF;

  lua_gc(L, LUA_GCSTOP, 0);
  luaL_unref(L, LUA_REGISTRYINDEX, ud->self_ref);
  ud->self_ref = LUA_NOREF;
  lua_gc(L, LUA_GCRESTART, 0);

  return 0;
}

// Returns NULL on success, error message otherwise
static const char *append_pem_blob(const char *pem, const char *type, uint8_t **buffer_p, uint8_t *buffer_limit, const char *name) {
  char unb64[256];
  memset(unb64, 0xff, sizeof(unb64));
  int i;
  for (i = 0; i < 64; i++) {
    unb64["ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[i]] = i;
  }

  if (!pem) {
    return "No PEM blob";
  }

  // Scan for -----BEGIN CERT
  pem = strstr(pem, "-----BEGIN ");
  if (!pem) {
    return "No PEM header";
  }

  if (strncmp(pem + 11, type, strlen(type))) {
    return "Wrong PEM type";
  }

  pem = strchr(pem, '\n');
  if (!pem) {
    return "Incorrect PEM format";
  }
  //
  // Base64 encoded data starts here
  // Get all the base64 data into a single buffer....
  // We will use the back end of the buffer....
  //

  uint8_t *buffer = *buffer_p;

  uint8_t *dest = buffer + 32 + 2;  // Leave space for name and length
  int bitcount = 0;
  int accumulator = 0;
  for (; *pem && dest < buffer_limit; pem++) {
    int val = unb64[*(uint8_t*) pem];
    if (val & 0xC0) {
      // not a base64 character
      if (isspace(*(uint8_t*) pem)) {
	continue;
      }
      if (*pem == '=') {
	// just ignore -- at the end
	bitcount = 0;
	continue;
      }
      if (*pem == '-') {
	break;
      }
      return "Invalid character in PEM";
    } else {
      bitcount += 6;
      accumulator = (accumulator << 6) + val;
      if (bitcount >= 8) {
	bitcount -= 8;
	*dest++ = accumulator >> bitcount;
      }
    }
  }
  if (dest >= buffer_limit || strncmp(pem, "-----END ", 9) || strncmp(pem + 9, type, strlen(type)) || bitcount) {
    return "Invalid PEM format data";
  }
  size_t len = dest - (buffer + 32 + 2);

  memset(buffer, 0, 32);
  strcpy(buffer, name);
  buffer[32] = len & 0xff;
  buffer[33] = (len >> 8) & 0xff;
  *buffer_p = dest;
  return NULL;
}

static const char *fill_page_with_pem(lua_State *L, const unsigned char *flash_memory, int flash_offset, const char **types, const char **names) 
{
  uint8_t  *buffer = luaM_malloc(L, INTERNAL_FLASH_SECTOR_SIZE);
  uint8_t  *buffer_base = buffer;
  uint8_t  *buffer_limit = buffer + INTERNAL_FLASH_SECTOR_SIZE;

  int argno;

  for (argno = 1; argno <= lua_gettop(L) && types[argno - 1]; argno++) {
    const char *pem = lua_tostring(L, argno);

    const char *error = append_pem_blob(pem, types[argno - 1], &buffer, buffer_limit, names[argno - 1]);
    if (error) {
      luaM_free(L, buffer_base);
      return error;
    }
  }

  memset(buffer, 0xff, buffer_limit - buffer);

  // Lets see if it matches what is already there....
  if (c_memcmp(buffer_base, flash_memory, INTERNAL_FLASH_SECTOR_SIZE) != 0) {
    // Starts being dangerous
    if (platform_flash_erase_sector(flash_offset / INTERNAL_FLASH_SECTOR_SIZE) != PLATFORM_OK) {
      luaM_free(L, buffer_base);
      return "Failed to erase sector";
    }
    if (platform_s_flash_write(buffer_base, flash_offset, INTERNAL_FLASH_SECTOR_SIZE) != INTERNAL_FLASH_SECTOR_SIZE) {
      luaM_free(L, buffer_base);
      return "Failed to write sector";
    }
    // ends being dangerous
  }

  luaM_free(L, buffer_base);

  return NULL;
}

// Lua: tls.cert.auth(true / false | PEM data [, PEM data] )
static int tls_cert_auth(lua_State *L)
{
  int enable;

  uint32_t flash_offset = platform_flash_mapped2phys((uint32_t) &tls_client_cert_area[0]);
  if ((flash_offset & 0xfff) || flash_offset > 0xff000 || INTERNAL_FLASH_SECTOR_SIZE != 0x1000) {
    // THis should never happen
    return luaL_error( L, "bad offset" );
  }

  if (lua_type(L, 1) == LUA_TSTRING) {
    const char *types[3] = { "CERTIFICATE", "RSA PRIVATE KEY", NULL };
    const char *names[2] = { "certificate", "private_key" };
    const char *error = fill_page_with_pem(L, &tls_client_cert_area[0], flash_offset, types, names);
    if (error) {
      return luaL_error(L, error);
    }

    enable = 1;
  } else {
    enable = lua_toboolean(L, 1);
  }

  bool rc;

  if (enable) {
    // See if there is a cert there
    if (tls_client_cert_area[0] == 0x00 || tls_client_cert_area[0] == 0xff) {
      return luaL_error( L, "no certificates found" );
    }
    rc = espconn_secure_cert_req_enable(1, flash_offset / INTERNAL_FLASH_SECTOR_SIZE);
  } else {
    rc = espconn_secure_cert_req_disable(1);
  }

  lua_pushboolean(L, rc);
  return 1;
}

// Lua: tls.cert.verify(true / false | PEM data [, PEM data] )
static int tls_cert_verify(lua_State *L)
{
  int enable;

  uint32_t flash_offset = platform_flash_mapped2phys((uint32_t) &tls_server_cert_area[0]);
  if ((flash_offset & 0xfff) || flash_offset > 0xff000 || INTERNAL_FLASH_SECTOR_SIZE != 0x1000) {
    // THis should never happen
    return luaL_error( L, "bad offset" );
  }

  if (lua_type(L, 1) == LUA_TSTRING) {
    const char *types[2] = { "CERTIFICATE", NULL };
    const char *names[1] = { "certificate" };

    const char *error = fill_page_with_pem(L, &tls_server_cert_area[0], flash_offset, types, names);
    if (error) {
      return luaL_error(L, error);
    }

    enable = 1;
  } else {
    enable = lua_toboolean(L, 1);
  }

  bool rc;

  if (enable) {
    // See if there is a cert there
    if (tls_server_cert_area[0] == 0x00 || tls_server_cert_area[0] == 0xff) {
      return luaL_error( L, "no certificates found" );
    }
    rc = espconn_secure_ca_enable(1, flash_offset / INTERNAL_FLASH_SECTOR_SIZE);
  } else {
    rc = espconn_secure_ca_disable(1);
  }

  lua_pushboolean(L, rc);
  return 1;
}

#if defined(MBEDTLS_DEBUG_C)
static int tls_set_debug_threshold(lua_State *L) {
  mbedtls_debug_set_threshold(luaL_checkint( L, 1 ));
  return 0;
}
#endif

static const LUA_REG_TYPE tls_socket_map[] = {
  { LSTRKEY( "connect" ), LFUNCVAL( tls_socket_connect ) },
  { LSTRKEY( "close" ),   LFUNCVAL( tls_socket_close ) },
  { LSTRKEY( "on" ),      LFUNCVAL( tls_socket_on ) },
  { LSTRKEY( "send" ),    LFUNCVAL( tls_socket_send ) },
  { LSTRKEY( "hold" ),    LFUNCVAL( tls_socket_hold ) },
  { LSTRKEY( "unhold" ),  LFUNCVAL( tls_socket_unhold ) },
  { LSTRKEY( "dns" ),     LFUNCVAL( tls_socket_dns ) },
  { LSTRKEY( "getpeer" ), LFUNCVAL( tls_socket_getpeer ) },
  { LSTRKEY( "__gc" ),    LFUNCVAL( tls_socket_delete ) },
  { LSTRKEY( "__index" ), LROVAL( tls_socket_map ) },
  { LNILKEY, LNILVAL }
};

const LUA_REG_TYPE tls_cert_map[] = {
  { LSTRKEY( "verify" ),           LFUNCVAL( tls_cert_verify ) },
  { LSTRKEY( "auth" ),             LFUNCVAL( tls_cert_auth ) },
  { LSTRKEY( "__index" ),          LROVAL( tls_cert_map ) },
  { LNILKEY, LNILVAL }
};

static const LUA_REG_TYPE tls_map[] = {
  { LSTRKEY( "createConnection" ), LFUNCVAL( tls_socket_create ) },
#if defined(MBEDTLS_DEBUG_C)
  { LSTRKEY( "setDebug" ),         LFUNCVAL( tls_set_debug_threshold ) },
#endif
  { LSTRKEY( "cert" ),             LROVAL( tls_cert_map ) },
  { LSTRKEY( "__metatable" ),      LROVAL( tls_map ) },
  { LNILKEY, LNILVAL }
};

int luaopen_tls( lua_State *L ) {
  luaL_rometatable(L, "tls.socket", (void *)tls_socket_map);  // create metatable for net.server
  espconn_secure_set_size(ESPCONN_CLIENT, 4096);
  return 0;
}

NODEMCU_MODULE(TLS, "tls", tls_map, luaopen_tls);
#endif