安全与合规¶

// MCUboot 签名验证流程（简化）
int boot_image_validate(const struct flash_area *fap,
                        struct image_header *hdr)
{
    // 1. 读取镜像头部
    rc = flash_area_read(fap, 0, hdr, sizeof(*hdr));

    // 2. 验证魔数
    if (hdr->ih_magic != IMAGE_MAGIC) {
        return -1;
    }

    // 3. 计算镜像哈希
    rc = bootutil_img_hash(fap, hdr, hash, &hash_len);

    // 4. 验证签名
    rc = bootutil_verify_sig(hash, hash_len, sig, sig_len, key_id);

    return rc;
}

#include <zephyr/kernel.h>
#include <zephyr/dfu/mcuboot.h>
#include <zephyr/storage/flash_map.h>
#include <zephyr/net/http/client.h>

#define FIRMWARE_URL "http://example.com/firmware.bin"
#define DOWNLOAD_BUFFER_SIZE 1024

/* 下载固件到 Secondary Slot */
int download_firmware(const char *url)
{
    const struct flash_area *fap;
    uint8_t buffer[DOWNLOAD_BUFFER_SIZE];
    size_t offset = 0;
    int rc;

    /* 打开 Secondary Slot */
    rc = flash_area_open(FLASH_AREA_IMAGE_SECONDARY, &fap);
    if (rc) {
        printk("Failed to open secondary slot: %d\n", rc);
        return rc;
    }

    /* 擦除 Secondary Slot */
    rc = flash_area_erase(fap, 0, fap->fa_size);
    if (rc) {
        printk("Failed to erase secondary slot: %d\n", rc);
        flash_area_close(fap);
        return rc;
    }

    /* 下载并写入固件 */
    while (/* 还有数据 */) {
        /* 从服务器读取数据到 buffer */
        size_t bytes_read = http_download_chunk(url, buffer, 
                                                 DOWNLOAD_BUFFER_SIZE);

        /* 写入 Flash */
        rc = flash_area_write(fap, offset, buffer, bytes_read);
        if (rc) {
            printk("Failed to write firmware: %d\n", rc);
            flash_area_close(fap);
            return rc;
        }

        offset += bytes_read;

        /* 显示进度 */
        printk("Downloaded: %zu bytes\r", offset);
    }

    flash_area_close(fap);
    printk("\nFirmware download complete\n");

    return 0;
}

/* 标记固件待升级 */
int mark_firmware_upgrade(void)
{
    int rc;

    /* 设置待升级标志 */
    rc = boot_request_upgrade(BOOT_UPGRADE_TEST);
    if (rc) {
        printk("Failed to mark upgrade: %d\n", rc);
        return rc;
    }

    printk("Firmware marked for upgrade\n");
    return 0;
}

/* 确认升级成功 */
int confirm_firmware_upgrade(void)
{
    int rc;

    /* 检查是否需要确认 */
    if (!boot_is_img_confirmed()) {
        /* 确认当前镜像 */
        rc = boot_write_img_confirmed();
        if (rc) {
            printk("Failed to confirm image: %d\n", rc);
            return rc;
        }
        printk("Firmware upgrade confirmed\n");
    }

    return 0;
}

/* OTA 升级主流程 */
void ota_upgrade_task(void)
{
    int rc;

    /* 1. 检查更新 */
    printk("Checking for updates...\n");
    if (!check_update_available()) {
        printk("No update available\n");
        return;
    }

    /* 2. 下载固件 */
    printk("Downloading firmware...\n");
    rc = download_firmware(FIRMWARE_URL);
    if (rc) {
        printk("Download failed: %d\n", rc);
        return;
    }

    /* 3. 验证固件（可选，MCUboot 会验证） */
    printk("Verifying firmware...\n");
    // 可以在这里添加额外的验证逻辑

    /* 4. 标记待升级 */
    rc = mark_firmware_upgrade();
    if (rc) {
        return;
    }

    /* 5. 重启设备 */
    printk("Rebooting to apply update...\n");
    k_sleep(K_SECONDS(2));
    sys_reboot(SYS_REBOOT_COLD);
}

/* 应用启动时确认升级 */
void main(void)
{
    printk("Application started\n");

    /* 如果是升级后首次启动，确认升级 */
    confirm_firmware_upgrade();

    /* 正常应用逻辑 */
    // ...
}

#include <zephyr/drivers/watchdog.h>

#define WDT_TIMEOUT_MS 30000  // 30 秒超时

const struct device *wdt;
int wdt_channel_id;

/* 初始化 Watchdog */
int init_watchdog(void)
{
    struct wdt_timeout_cfg wdt_config = {
        .window.min = 0,
        .window.max = WDT_TIMEOUT_MS,
        .callback = NULL,
        .flags = WDT_FLAG_RESET_SOC,
    };

    wdt = DEVICE_DT_GET(DT_ALIAS(watchdog0));
    if (!device_is_ready(wdt)) {
        printk("Watchdog device not ready\n");
        return -ENODEV;
    }

    wdt_channel_id = wdt_install_timeout(wdt, &wdt_config);
    if (wdt_channel_id < 0) {
        printk("Failed to install watchdog timeout\n");
        return wdt_channel_id;
    }

    wdt_setup(wdt, WDT_OPT_PAUSE_HALTED_BY_DBG);

    printk("Watchdog initialized\n");
    return 0;
}

/* 应用主循环 */
void main(void)
{
    int rc;

    /* 初始化 Watchdog */
    rc = init_watchdog();
    if (rc) {
        printk("Watchdog init failed, continuing without it\n");
    }

    /* 确认升级（如果是升级后首次启动） */
    if (!boot_is_img_confirmed()) {
        /* 运行自检 */
        if (system_self_test()) {
            /* 自检通过，确认升级 */
            boot_write_img_confirmed();
            printk("Upgrade confirmed\n");
        } else {
            /* 自检失败，等待 Watchdog 触发回滚 */
            printk("Self-test failed, waiting for rollback\n");
            while (1) {
                k_sleep(K_FOREVER);
            }
        }
    }

    /* 主循环 */
    while (1) {
        /* 喂狗 */
        if (wdt) {
            wdt_feed(wdt, wdt_channel_id);
        }

        /* 应用逻辑 */
        do_work();

        k_sleep(K_SECONDS(1));
    }
}

#include <zephyr/dfu/mcuboot.h>

/* 应用差分包 */
int apply_delta_update(const uint8_t *patch, size_t patch_size)
{
    const struct flash_area *old_fap, *new_fap;
    int rc;

    /* 打开 Primary Slot（旧固件） */
    rc = flash_area_open(FLASH_AREA_IMAGE_PRIMARY, &old_fap);
    if (rc) return rc;

    /* 打开 Secondary Slot（新固件） */
    rc = flash_area_open(FLASH_AREA_IMAGE_SECONDARY, &new_fap);
    if (rc) {
        flash_area_close(old_fap);
        return rc;
    }

    /* 应用差分包（需要 bspatch 库） */
    rc = bspatch_apply(old_fap, patch, patch_size, new_fap);

    flash_area_close(old_fap);
    flash_area_close(new_fap);

    return rc;
}

#include <zephyr/net/socket.h>
#include <zephyr/net/tls_credentials.h>

/* CA 证书（PEM 格式） */
static const unsigned char ca_certificate[] = {
#include "ca_cert.pem.inc"
};

/* 初始化 TLS */
int init_tls(void)
{
    int rc;

    /* 添加 CA 证书 */
    rc = tls_credential_add(CA_CERTIFICATE_TAG,
                           TLS_CREDENTIAL_CA_CERTIFICATE,
                           ca_certificate,
                           sizeof(ca_certificate));
    if (rc < 0) {
        printk("Failed to add CA certificate: %d\n", rc);
        return rc;
    }

    return 0;
}

/* 创建 TLS 连接 */
int connect_tls(const char *hostname, uint16_t port)
{
    struct sockaddr_in addr;
    int sock;
    int rc;

    /* 创建 socket */
    sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TLS_1_2);
    if (sock < 0) {
        printk("Failed to create socket: %d\n", errno);
        return -errno;
    }

    /* 配置 TLS */
    sec_tag_t sec_tag_list[] = { CA_CERTIFICATE_TAG };
    rc = setsockopt(sock, SOL_TLS, TLS_SEC_TAG_LIST,
                   sec_tag_list, sizeof(sec_tag_list));
    if (rc < 0) {
        printk("Failed to set TLS sec tag: %d\n", errno);
        close(sock);
        return -errno;
    }

    /* 设置主机名（用于 SNI） */
    rc = setsockopt(sock, SOL_TLS, TLS_HOSTNAME,
                   hostname, strlen(hostname));
    if (rc < 0) {
        printk("Failed to set TLS hostname: %d\n", errno);
        close(sock);
        return -errno;
    }

    /* 连接服务器 */
    addr.sin_family = AF_INET;
    addr.sin_port = htons(port);
    inet_pton(AF_INET, hostname, &addr.sin_addr);

    rc = connect(sock, (struct sockaddr *)&addr, sizeof(addr));
    if (rc < 0) {
        printk("Failed to connect: %d\n", errno);
        close(sock);
        return -errno;
    }

    printk("TLS connection established\n");
    return sock;
}

/* 发送数据 */
int send_tls_data(int sock, const char *data, size_t len)
{
    ssize_t sent = send(sock, data, len, 0);
    if (sent < 0) {
        printk("Failed to send data: %d\n", errno);
        return -errno;
    }
    return sent;
}

/* 接收数据 */
int recv_tls_data(int sock, char *buffer, size_t len)
{
    ssize_t received = recv(sock, buffer, len, 0);
    if (received < 0) {
        printk("Failed to receive data: %d\n", errno);
        return -errno;
    }
    return received;
}

#include <zephyr/crypto/crypto.h>

#define AES_KEY_SIZE 16  // AES-128
#define AES_BLOCK_SIZE 16

/* AES 加密 */
int aes_encrypt(const uint8_t *key, const uint8_t *plaintext,
                uint8_t *ciphertext, size_t len)
{
    const struct device *crypto_dev;
    struct cipher_ctx ctx;
    struct cipher_pkt pkt;
    int rc;

    /* 获取加密设备 */
    crypto_dev = device_get_binding(CONFIG_CRYPTO_TINYCRYPT_SHIM_DRV_NAME);
    if (!crypto_dev) {
        printk("Crypto device not found\n");
        return -ENODEV;
    }

    /* 初始化加密上下文 */
    ctx.keylen = AES_KEY_SIZE;
    ctx.key.bit_stream = (uint8_t *)key;
    ctx.flags = CAP_RAW_KEY | CAP_SYNC_OPS;

    rc = cipher_begin_session(crypto_dev, &ctx, CRYPTO_CIPHER_ALGO_AES,
                              CRYPTO_CIPHER_MODE_ECB,
                              CRYPTO_CIPHER_OP_ENCRYPT);
    if (rc) {
        printk("Failed to begin cipher session: %d\n", rc);
        return rc;
    }

    /* 加密数据 */
    pkt.in_buf = (uint8_t *)plaintext;
    pkt.in_len = len;
    pkt.out_buf = ciphertext;
    pkt.out_buf_max = len;

    rc = cipher_block_op(&ctx, &pkt);

    cipher_free_session(crypto_dev, &ctx);

    return rc;
}

/* AES 解密 */
int aes_decrypt(const uint8_t *key, const uint8_t *ciphertext,
                uint8_t *plaintext, size_t len)
{
    const struct device *crypto_dev;
    struct cipher_ctx ctx;
    struct cipher_pkt pkt;
    int rc;

    crypto_dev = device_get_binding(CONFIG_CRYPTO_TINYCRYPT_SHIM_DRV_NAME);
    if (!crypto_dev) {
        return -ENODEV;
    }

    ctx.keylen = AES_KEY_SIZE;
    ctx.key.bit_stream = (uint8_t *)key;
    ctx.flags = CAP_RAW_KEY | CAP_SYNC_OPS;

    rc = cipher_begin_session(crypto_dev, &ctx, CRYPTO_CIPHER_ALGO_AES,
                              CRYPTO_CIPHER_MODE_ECB,
                              CRYPTO_CIPHER_OP_DECRYPT);
    if (rc) {
        return rc;
    }

    pkt.in_buf = (uint8_t *)ciphertext;
    pkt.in_len = len;
    pkt.out_buf = plaintext;
    pkt.out_buf_max = len;

    rc = cipher_block_op(&ctx, &pkt);

    cipher_free_session(crypto_dev, &ctx);

    return rc;
}

#include <zephyr/crypto/crypto.h>

#define SHA256_DIGEST_SIZE 32

/* 计算 SHA-256 哈希 */
int calculate_sha256(const uint8_t *data, size_t len, uint8_t *hash)
{
    const struct device *crypto_dev;
    struct hash_ctx ctx;
    struct hash_pkt pkt;
    int rc;

    crypto_dev = device_get_binding(CONFIG_CRYPTO_TINYCRYPT_SHIM_DRV_NAME);
    if (!crypto_dev) {
        return -ENODEV;
    }

    /* 初始化哈希上下文 */
    ctx.flags = CAP_RAW_KEY | CAP_SYNC_OPS;

    rc = hash_begin_session(crypto_dev, &ctx, CRYPTO_HASH_ALGO_SHA256);
    if (rc) {
        printk("Failed to begin hash session: %d\n", rc);
        return rc;
    }

    /* 计算哈希 */
    pkt.in_buf = (uint8_t *)data;
    pkt.in_len = len;
    pkt.out_buf = hash;

    rc = hash_compute(&ctx, &pkt);

    hash_free_session(crypto_dev, &ctx);

    return rc;
}

/* 验证数据完整性 */
bool verify_integrity(const uint8_t *data, size_t len,
                     const uint8_t *expected_hash)
{
    uint8_t calculated_hash[SHA256_DIGEST_SIZE];
    int rc;

    rc = calculate_sha256(data, len, calculated_hash);
    if (rc) {
        return false;
    }

    return memcmp(calculated_hash, expected_hash, SHA256_DIGEST_SIZE) == 0;
}

#include <zephyr/random/rand32.h>

/* 生成随机数 */
void generate_random_bytes(uint8_t *buffer, size_t len)
{
    sys_rand_get(buffer, len);
}

/* 生成随机密钥 */
void generate_aes_key(uint8_t *key)
{
    generate_random_bytes(key, AES_KEY_SIZE);
}

/* 生成随机 IV */
void generate_iv(uint8_t *iv)
{
    generate_random_bytes(iv, AES_BLOCK_SIZE);
}

#include <zephyr/storage/flash_map.h>

/* 加密存储敏感数据 */
int secure_store(const uint8_t *key, const uint8_t *data, size_t len)
{
    const struct flash_area *fap;
    uint8_t encrypted[256];
    int rc;

    /* 加密数据 */
    rc = aes_encrypt(key, data, encrypted, len);
    if (rc) {
        return rc;
    }

    /* 写入 Flash */
    rc = flash_area_open(FLASH_AREA_STORAGE, &fap);
    if (rc) {
        return rc;
    }

    rc = flash_area_write(fap, 0, encrypted, len);

    flash_area_close(fap);

    return rc;
}

/* 读取加密数据 */
int secure_load(const uint8_t *key, uint8_t *data, size_t len)
{
    const struct flash_area *fap;
    uint8_t encrypted[256];
    int rc;

    /* 从 Flash 读取 */
    rc = flash_area_open(FLASH_AREA_STORAGE, &fap);
    if (rc) {
        return rc;
    }

    rc = flash_area_read(fap, 0, encrypted, len);
    flash_area_close(fap);

    if (rc) {
        return rc;
    }

    /* 解密数据 */
    rc = aes_decrypt(key, encrypted, data, len);

    return rc;
}

#include <zephyr/drivers/watchdog.h>

/* Watchdog 配置 */
struct wdt_timeout_cfg wdt_config = {
    .window.min = 0,
    .window.max = 10000,  // 10 秒
    .callback = wdt_callback,
    .flags = WDT_FLAG_RESET_SOC,
};

/* Watchdog 回调（可选） */
void wdt_callback(const struct device *dev, int channel_id)
{
    printk("Watchdog timeout! System will reset.\n");

    /* 记录故障信息 */
    log_fault_info();
}

/* 初始化 Watchdog */
int init_safety_watchdog(void)
{
    const struct device *wdt;
    int wdt_channel_id;

    wdt = DEVICE_DT_GET(DT_ALIAS(watchdog0));
    if (!device_is_ready(wdt)) {
        return -ENODEV;
    }

    wdt_channel_id = wdt_install_timeout(wdt, &wdt_config);
    if (wdt_channel_id < 0) {
        return wdt_channel_id;
    }

    wdt_setup(wdt, WDT_OPT_PAUSE_HALTED_BY_DBG);

    return 0;
}

#include <zephyr/sys/crc.h>

/* 内存完整性检查 */
bool check_memory_integrity(const uint8_t *data, size_t len,
                            uint32_t expected_crc)
{
    uint32_t calculated_crc = crc32_ieee(data, len);
    return calculated_crc == expected_crc;
}

/* 定期检查关键数据 */
void periodic_integrity_check(void)
{
    static const uint32_t expected_crc = 0x12345678;  // 预计算的 CRC

    if (!check_memory_integrity(critical_data, sizeof(critical_data),
                                expected_crc)) {
        printk("Memory corruption detected!\n");

        /* 进入安全状态 */
        enter_safe_state();
    }
}

/* 启用 ECC（在 prj.conf 中） */
// CONFIG_ARM_MPU=y
// CONFIG_ARM_MPU_REGION_MIN_ALIGN_AND_SIZE=y

/* 配置 MPU 保护关键内存 */
void configure_memory_protection(void)
{
    /* 保护代码段（只读） */
    arm_core_mpu_configure_static_mpu_regions(
        (struct arm_mpu_region[]) {
            {
                .name = "CODE",
                .base = (uint32_t)&_image_rom_start,
                .size = (uint32_t)&_image_rom_end - 
                        (uint32_t)&_image_rom_start,
                .attr = {
                    .rw = MPU_REGION_READ,
                    .xn = MPU_REGION_EXEC,
                },
            },
        },
        1
    );
}

/* 定义安全状态 */
enum safety_state {
    STATE_NORMAL,
    STATE_DEGRADED,
    STATE_SAFE,
    STATE_FAULT,
};

static enum safety_state current_state = STATE_NORMAL;

/* 进入安全状态 */
void enter_safe_state(void)
{
    printk("Entering safe state\n");

    current_state = STATE_SAFE;

    /* 关闭所有输出 */
    disable_all_outputs();

    /* 记录故障 */
    log_fault_event();

    /* 通知监控系统 */
    notify_monitoring_system();

    /* 等待人工干预或自动恢复 */
    while (current_state == STATE_SAFE) {
        k_sleep(K_SECONDS(1));
    }
}

/* 降级运行 */
void enter_degraded_mode(void)
{
    printk("Entering degraded mode\n");

    current_state = STATE_DEGRADED;

    /* 禁用非关键功能 */
    disable_non_critical_features();

    /* 降低性能要求 */
    reduce_performance_requirements();
}

#include <zephyr/storage/flash_map.h>

/* 故障记录结构 */
struct fault_record {
    uint32_t timestamp;
    uint32_t fault_code;
    uint32_t pc;  // 程序计数器
    uint32_t lr;  // 链接寄存器
    char description[64];
};

/* 记录故障信息 */
void log_fault_info(void)
{
    struct fault_record record;
    const struct flash_area *fap;

    /* 填充故障信息 */
    record.timestamp = k_uptime_get_32();
    record.fault_code = get_last_fault_code();
    record.pc = __get_PC();
    record.lr = __get_LR();
    snprintf(record.description, sizeof(record.description),
             "System fault detected");

    /* 写入 Flash */
    flash_area_open(FLASH_AREA_STORAGE, &fap);
    flash_area_write(fap, 0, &record, sizeof(record));
    flash_area_close(fap);
}

/* 验证输入参数 */
int process_user_input(const char *input, size_t len)
{
    /* 检查空指针 */
    if (input == NULL) {
        return -EINVAL;
    }

    /* 检查长度 */
    if (len == 0 || len > MAX_INPUT_SIZE) {
        return -EINVAL;
    }

    /* 检查字符有效性 */
    for (size_t i = 0; i < len; i++) {
        if (!isprint(input[i])) {
            return -EINVAL;
        }
    }

    /* 防止缓冲区溢出 */
    char buffer[MAX_INPUT_SIZE + 1];
    strncpy(buffer, input, MAX_INPUT_SIZE);
    buffer[MAX_INPUT_SIZE] = '\0';

    /* 处理输入 */
    return do_process(buffer);
}

/* 使用用户空间隔离 */
K_APPMEM_PARTITION_DEFINE(app_partition);

/* 定义用户线程 */
void user_thread_entry(void *p1, void *p2, void *p3)
{
    /* 此线程运行在用户空间，权限受限 */

    /* 只能访问授权的内存区域 */
    /* 不能直接访问硬件寄存器 */
    /* 必须通过系统调用访问内核服务 */
}

K_THREAD_DEFINE(user_thread, 1024,
                user_thread_entry, NULL, NULL, NULL,
                5, K_USER, 0);

/* ❌ 错误：缓冲区溢出 */
void bad_copy(const char *src)
{
    char buffer[64];
    strcpy(buffer, src);  // 危险！
}

/* ✅ 正确：使用安全函数 */
void safe_copy(const char *src)
{
    char buffer[64];
    strncpy(buffer, src, sizeof(buffer) - 1);
    buffer[sizeof(buffer) - 1] = '\0';
}

/* ❌ 错误：整数溢出 */
void bad_alloc(size_t count, size_t size)
{
    void *ptr = malloc(count * size);  // 可能溢出
}

/* ✅ 正确：检查溢出 */
void safe_alloc(size_t count, size_t size)
{
    if (count > SIZE_MAX / size) {
        return;  // 溢出检测
    }
    void *ptr = malloc(count * size);
}

/* ❌ 错误：未初始化变量 */
void bad_init(void)
{
    int value;
    if (value > 0) {  // 未定义行为
        do_something();
    }
}

/* ✅ 正确：初始化变量 */
void safe_init(void)
{
    int value = 0;
    if (value > 0) {
        do_something();
    }
}

/* 版本管理 */
#define FIRMWARE_VERSION "1.2.3"
#define SECURITY_PATCH_LEVEL "2026-02"

/* 检查安全补丁 */
bool is_security_patch_current(void)
{
    const char *latest_patch = get_latest_patch_level();
    return strcmp(SECURITY_PATCH_LEVEL, latest_patch) >= 0;
}

/* 强制更新检查 */
void enforce_security_updates(void)
{
    if (!is_security_patch_current()) {
        printk("Security patch outdated, forcing update\n");
        trigger_ota_update();
    }
}

#include <zephyr/mgmt/mcumgr/smp_bt.h>
#include <zephyr/dfu/mcuboot.h>

void main(void)
{
    int rc;

    printk("OTA Demo Application\n");
    printk("Version: %s\n", CONFIG_MCUBOOT_IMAGE_VERSION);

    /* 确认升级（如果是升级后首次启动） */
    if (!boot_is_img_confirmed()) {
        printk("Confirming firmware upgrade\n");
        rc = boot_write_img_confirmed();
        if (rc) {
            printk("Failed to confirm: %d\n", rc);
        }
    }

    /* 初始化 SMP 蓝牙服务 */
    rc = smp_bt_register();
    if (rc) {
        printk("Failed to register SMP BT: %d\n", rc);
        return;
    }

    printk("Ready for OTA update via Bluetooth\n");

    /* 主循环 */
    while (1) {
        k_sleep(K_SECONDS(1));
    }
}

#include <zephyr/net/socket.h>
#include <zephyr/net/tls_credentials.h>

#define SERVER_ADDR "192.168.1.100"
#define SERVER_PORT 8443
#define CA_CERT_TAG 1

static const unsigned char ca_cert[] = {
#include "ca-cert.pem.inc"
};

void tls_client_demo(void)
{
    struct sockaddr_in addr;
    int sock;
    int rc;

    /* 添加 CA 证书 */
    rc = tls_credential_add(CA_CERT_TAG,
                           TLS_CREDENTIAL_CA_CERTIFICATE,
                           ca_cert, sizeof(ca_cert));
    if (rc < 0) {
        printk("Failed to add CA cert: %d\n", rc);
        return;
    }

    /* 创建 TLS socket */
    sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TLS_1_2);
    if (sock < 0) {
        printk("Failed to create socket: %d\n", errno);
        return;
    }

    /* 配置 TLS */
    sec_tag_t sec_tag_list[] = { CA_CERT_TAG };
    rc = setsockopt(sock, SOL_TLS, TLS_SEC_TAG_LIST,
                   sec_tag_list, sizeof(sec_tag_list));
    if (rc < 0) {
        printk("Failed to set TLS options: %d\n", errno);
        close(sock);
        return;
    }

    /* 连接服务器 */
    addr.sin_family = AF_INET;
    addr.sin_port = htons(SERVER_PORT);
    inet_pton(AF_INET, SERVER_ADDR, &addr.sin_addr);

    rc = connect(sock, (struct sockaddr *)&addr, sizeof(addr));
    if (rc < 0) {
        printk("Failed to connect: %d\n", errno);
        close(sock);
        return;
    }

    printk("TLS connection established\n");

    /* 发送数据 */
    const char *msg = "Hello, secure world!";
    send(sock, msg, strlen(msg), 0);

    /* 接收响应 */
    char buffer[128];
    ssize_t len = recv(sock, buffer, sizeof(buffer) - 1, 0);
    if (len > 0) {
        buffer[len] = '\0';
        printk("Received: %s\n", buffer);
    }

    close(sock);
}