Skip to content

Commit ed1de4b

Browse files
nkolbannkolban
committed
Addition of GCP JWT sample
1 parent 2c8b0f2 commit ed1de4b

File tree

3 files changed

+340
-0
lines changed

3 files changed

+340
-0
lines changed

‎cloud/GCP/JWT/base64url.cpp

+136
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,136 @@
1+
// https://raw.githubusercontent.com/zhicheng/base64/master/base64.c
2+
/* This is a public domain base64 implementation written by WEI Zhicheng. */
3+
4+
#include <stdio.h>
5+
6+
#include "base64url.h"
7+
8+
/* BASE 64 encode table */
9+
static const char base64en[] = {
10+
'A', 'B', 'C', 'D', 'E', 'F', 'G', 'H',
11+
'I', 'J', 'K', 'L', 'M', 'N', 'O', 'P',
12+
'Q', 'R', 'S', 'T', 'U', 'V', 'W', 'X',
13+
'Y', 'Z', 'a', 'b', 'c', 'd', 'e', 'f',
14+
'g', 'h', 'i', 'j', 'k', 'l', 'm', 'n',
15+
'o', 'p', 'q', 'r', 's', 't', 'u', 'v',
16+
'w', 'x', 'y', 'z', '0', '1', '2', '3',
17+
'4', '5', '6', '7', '8', '9', '-', '_',
18+
};
19+
20+
#define BASE64_PAD '='
21+
22+
23+
#define BASE64DE_FIRST '+'
24+
#define BASE64DE_LAST 'z'
25+
/* ASCII order for BASE 64 decode, -1 in unused character */
26+
static const signed char base64de[] = {
27+
/* '+', ',', '-', '.', '/', '0', '1', '2', */
28+
62, -1, -1, -1, 63, 52, 53, 54,
29+
30+
/* '3', '4', '5', '6', '7', '8', '9', ':', */
31+
55, 56, 57, 58, 59, 60, 61, -1,
32+
33+
/* ';', '<', '=', '>', '?', '@', 'A', 'B', */
34+
-1, -1, -1, -1, -1, -1, 0, 1,
35+
36+
/* 'C', 'D', 'E', 'F', 'G', 'H', 'I', 'J', */
37+
2, 3, 4, 5, 6, 7, 8, 9,
38+
39+
/* 'K', 'L', 'M', 'N', 'O', 'P', 'Q', 'R', */
40+
10, 11, 12, 13, 14, 15, 16, 17,
41+
42+
/* 'S', 'T', 'U', 'V', 'W', 'X', 'Y', 'Z', */
43+
18, 19, 20, 21, 22, 23, 24, 25,
44+
45+
/* '[', '\', ']', '^', '_', '`', 'a', 'b', */
46+
-1, -1, -1, -1, -1, -1, 26, 27,
47+
48+
/* 'c', 'd', 'e', 'f', 'g', 'h', 'i', 'j', */
49+
28, 29, 30, 31, 32, 33, 34, 35,
50+
51+
/* 'k', 'l', 'm', 'n', 'o', 'p', 'q', 'r', */
52+
36, 37, 38, 39, 40, 41, 42, 43,
53+
54+
/* 's', 't', 'u', 'v', 'w', 'x', 'y', 'z', */
55+
44, 45, 46, 47, 48, 49, 50, 51,
56+
};
57+
58+
int base64url_encode(const unsigned char *in, unsigned int inlen, char *out)
59+
{
60+
unsigned int i, j;
61+
62+
for (i = j = 0; i < inlen; i++) {
63+
int s = i % 3; /* from 6/gcd(6, 8) */
64+
65+
switch (s) {
66+
case 0:
67+
out[j++] = base64en[(in[i] >> 2) & 0x3F];
68+
continue;
69+
case 1:
70+
out[j++] = base64en[((in[i-1] & 0x3) << 4) + ((in[i] >> 4) & 0xF)];
71+
continue;
72+
case 2:
73+
out[j++] = base64en[((in[i-1] & 0xF) << 2) + ((in[i] >> 6) & 0x3)];
74+
out[j++] = base64en[in[i] & 0x3F];
75+
}
76+
}
77+
78+
/* move back */
79+
i -= 1;
80+
81+
/* check the last and add padding */
82+
83+
if ((i % 3) == 0) {
84+
out[j++] = base64en[(in[i] & 0x3) << 4];
85+
//out[j++] = BASE64_PAD;
86+
//out[j++] = BASE64_PAD;
87+
} else if ((i % 3) == 1) {
88+
out[j++] = base64en[(in[i] & 0xF) << 2];
89+
//out[j++] = BASE64_PAD;
90+
}
91+
92+
out[j++] = 0;
93+
94+
return BASE64_OK;
95+
}
96+
97+
int base64url_decode(const char *in, unsigned int inlen, unsigned char *out)
98+
{
99+
unsigned int i, j;
100+
101+
for (i = j = 0; i < inlen; i++) {
102+
int c;
103+
int s = i % 4; /* from 8/gcd(6, 8) */
104+
105+
if (in[i] == '=')
106+
return BASE64_OK;
107+
108+
if (in[i] < BASE64DE_FIRST || in[i] > BASE64DE_LAST ||
109+
(c = base64de[in[i] - BASE64DE_FIRST]) == -1)
110+
return BASE64_INVALID;
111+
112+
switch (s) {
113+
case 0:
114+
out[j] = ((unsigned int)c << 2) & 0xFF;
115+
continue;
116+
case 1:
117+
out[j++] += ((unsigned int)c >> 4) & 0x3;
118+
119+
/* if not last char with padding */
120+
if (i < (inlen - 3) || in[inlen - 2] != '=')
121+
out[j] = ((unsigned int)c & 0xF) << 4;
122+
continue;
123+
case 2:
124+
out[j++] += ((unsigned int)c >> 2) & 0xF;
125+
126+
/* if not last char with padding */
127+
if (i < (inlen - 2) || in[inlen - 1] != '=')
128+
out[j] = ((unsigned int)c & 0x3) << 6;
129+
continue;
130+
case 3:
131+
out[j++] += (unsigned char)c;
132+
}
133+
}
134+
135+
return BASE64_OK;
136+
}

‎cloud/GCP/JWT/base64url.h

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
// https://raw.githubusercontent.com/zhicheng/base64/master/base64.h
2+
#ifndef __BASE64URL_H__
3+
#define __BASE64URL_H__
4+
5+
enum {BASE64_OK = 0, BASE64_INVALID};
6+
7+
#define BASE64_ENCODE_OUT_SIZE(s) (((s) + 2) / 3 * 4)
8+
#define BASE64_DECODE_OUT_SIZE(s) (((s)) / 4 * 3)
9+
10+
int base64url_encode(const unsigned char *in, unsigned int inlen, char *out);
11+
12+
int base64url_decode(const char *in, unsigned int inlen, unsigned char *out);
13+
14+
15+
#endif /* __BASE64URL_H__ */

‎cloud/GCP/JWT/main.cpp

+189
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
#include <stdio.h>
2+
#include <string.h>
3+
#include <stdlib.h>
4+
#include <stdint.h>
5+
#include <mbedtls/pk.h>
6+
#include <mbedtls/error.h>
7+
#include <mbedtls/entropy.h>
8+
#include <mbedtls/ctr_drbg.h>
9+
#include <esp_wifi.h>
10+
#include <esp_system.h>
11+
#include <esp_event.h>
12+
#include <esp_event_loop.h>
13+
#include <nvs_flash.h>
14+
#include <tcpip_adapter.h>
15+
#include <esp_err.h>
16+
#include <freertos/FreeRTOS.h>
17+
#include <freertos/task.h>
18+
#include <apps/sntp/sntp.h>
19+
20+
#include "passwords.h"
21+
#include "base64url.h"
22+
23+
// This is an "xxd" file of the PEM of the private key.
24+
#include "device1_private_pem.h"
25+
26+
27+
extern "C" {
28+
void app_main();
29+
}
30+
31+
/**
32+
* Return a string representation of an mbedtls error code
33+
*/
34+
static char* mbedtlsError(int errnum) {
35+
static char buffer[200];
36+
mbedtls_strerror(errnum, buffer, sizeof(buffer));
37+
return buffer;
38+
} // mbedtlsError
39+
40+
41+
/**
42+
* Create a JWT token for GCP.
43+
* For full details, perform a Google search on JWT. However, in summary, we build two strings. One that represents the
44+
* header and one that represents the payload. Both are JSON and are as described in the GCP and JWT documentation. Next
45+
* we base64url encode both strings. Note that is distinct from normal/simple base64 encoding. Once we have a string for
46+
* the base64url encoding of both header and payload, we concatenate both strings together separated by a ".". This resulting
47+
* string is then signed using RSASSA which basically produces an SHA256 message digest that is then signed. The resulting
48+
* binary is then itself converted into base64url and concatenated with the previously built base64url combined header and
49+
* payload and that is our resulting JWT token.
50+
* @param projectId The GCP project.
51+
* @param privateKey The PEM or DER of the private key.
52+
* @param privateKeySize The size in bytes of the private key.
53+
* @returns A JWT token for transmission to GCP.
54+
*/
55+
char* createGCPJWT(const char* projectId, uint8_t* privateKey, size_t privateKeySize) {
56+
char base64Header[100];
57+
const char header[] = "{\"alg\":\"RS256\",\"typ\":\"JWT\"}";
58+
base64url_encode(
59+
(unsigned char *)header, // Data to encode.
60+
strlen(header), // Length of data to encode.
61+
base64Header); // Base64 encoded data.
62+
63+
time_t now;
64+
time(&now);
65+
uint32_t iat = now; // Set the time now.
66+
uint32_t exp = iat + 60*60; // Set the expiry time.
67+
68+
char payload[100];
69+
sprintf(payload, "{\"iat\":%d,\"exp\":%d,\"aud\":\"%s\"}", iat, exp, projectId);
70+
71+
char base64Payload[100];
72+
base64url_encode(
73+
(unsigned char *)payload, // Data to encode.
74+
strlen(payload), // Length of data to encode.
75+
base64Payload); // Base64 encoded data.
76+
77+
uint8_t headerAndPayload[800];
78+
sprintf((char*)headerAndPayload, "%s.%s", base64Header, base64Payload);
79+
80+
// At this point we have created the header and payload parts, converted both to base64 and concatenated them
81+
// together as a single string. Now we need to sign them using RSASSA
82+
83+
mbedtls_pk_context pk_context;
84+
mbedtls_pk_init(&pk_context);
85+
int rc = mbedtls_pk_parse_key(&pk_context, privateKey, privateKeySize, NULL, 0);
86+
if (rc != 0) {
87+
printf("Failed to mbedtls_pk_parse_key: %d (-0x%x): %s\n", rc, -rc, mbedtlsError(rc));
88+
return nullptr;
89+
}
90+
91+
uint8_t oBuf[5000];
92+
93+
mbedtls_entropy_context entropy;
94+
mbedtls_ctr_drbg_context ctr_drbg;
95+
mbedtls_ctr_drbg_init(&ctr_drbg);
96+
mbedtls_entropy_init(&entropy);
97+
98+
const char* pers="MyEntropy";
99+
100+
mbedtls_ctr_drbg_seed(
101+
&ctr_drbg,
102+
mbedtls_entropy_func,
103+
&entropy,
104+
(const unsigned char*)pers,
105+
strlen(pers));
106+
107+
108+
uint8_t digest[32];
109+
rc = mbedtls_md(mbedtls_md_info_from_type(MBEDTLS_MD_SHA256), headerAndPayload, strlen((char*)headerAndPayload), digest);
110+
if (rc != 0) {
111+
printf("Failed to mbedtls_md: %d (-0x%x): %s\n", rc, -rc, mbedtlsError(rc));
112+
return nullptr;
113+
}
114+
115+
size_t retSize;
116+
rc = mbedtls_pk_sign(&pk_context, MBEDTLS_MD_SHA256, digest, sizeof(digest), oBuf, &retSize, mbedtls_ctr_drbg_random, &ctr_drbg);
117+
if (rc != 0) {
118+
printf("Failed to mbedtls_pk_sign: %d (-0x%x): %s\n", rc, -rc, mbedtlsError(rc));
119+
return nullptr;
120+
}
121+
122+
123+
char base64Signature[600];
124+
base64url_encode((unsigned char *)oBuf, retSize, base64Signature);
125+
126+
char* retData = (char*)malloc(strlen((char*)headerAndPayload) + 1 + strlen((char*)base64Signature) + 1);
127+
128+
sprintf(retData, "%s.%s", headerAndPayload, base64Signature);
129+
130+
mbedtls_pk_free(&pk_context);
131+
return retData;
132+
}
133+
134+
void run(void *) {
135+
printf("Task starting!\n");
136+
const char* projectId = "test-214415";
137+
sntp_setoperatingmode(SNTP_OPMODE_POLL);
138+
sntp_setservername(0, "time-a-g.nist.gov");
139+
sntp_init();
140+
// https://www.epochconverter.com/
141+
time_t now = 0;
142+
time(&now);
143+
while(now < 5000) {
144+
vTaskDelay(1000 * portTICK_RATE_MS);
145+
time(&now);
146+
}
147+
148+
char* jwt = createGCPJWT(projectId, device1_private_pem, device1_private_pem_len);
149+
if (jwt != nullptr) {
150+
printf("JWT: %s\n", jwt);
151+
free(jwt);
152+
}
153+
vTaskDelete(nullptr);
154+
}
155+
156+
esp_err_t event_handler(void *ctx, system_event_t *event)
157+
{
158+
if (event->event_id == SYSTEM_EVENT_STA_GOT_IP) {
159+
printf("Our IP address is " IPSTR "\n",
160+
IP2STR(&event->event_info.got_ip.ip_info.ip));
161+
printf("We have now connected to a station and can do things...\n");
162+
xTaskCreate(run, "run", 16000, nullptr, 0, nullptr);
163+
164+
}
165+
166+
if (event->event_id == SYSTEM_EVENT_STA_START) {
167+
ESP_ERROR_CHECK(esp_wifi_connect());
168+
}
169+
return ESP_OK;
170+
}
171+
172+
void app_main(void)
173+
{
174+
printf("Starting\n");
175+
nvs_flash_init();
176+
tcpip_adapter_init();
177+
ESP_ERROR_CHECK(esp_event_loop_init(event_handler, NULL));
178+
wifi_init_config_t cfg = WIFI_INIT_CONFIG_DEFAULT();
179+
ESP_ERROR_CHECK(esp_wifi_init(&cfg));
180+
ESP_ERROR_CHECK(esp_wifi_set_storage(WIFI_STORAGE_RAM));
181+
ESP_ERROR_CHECK(esp_wifi_set_mode(WIFI_MODE_STA));
182+
wifi_config_t sta_config;
183+
memset(&sta_config, 0, sizeof(sta_config));
184+
strcpy((char*)sta_config.sta.ssid, SSID);
185+
strcpy((char*)sta_config.sta.password, SSID_PASSWORD);
186+
ESP_ERROR_CHECK(esp_wifi_set_config(WIFI_IF_STA, &sta_config));
187+
ESP_ERROR_CHECK(esp_wifi_start());
188+
}
189+

0 commit comments

Comments
 (0)