MbedTLS transport implementation (#175)

6 files changed, 1420 insertions, 0 deletions

diff --git a/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/mbedtls/mbedtls_freertos_port.c b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/mbedtls/mbedtls_freertos_port.c
new file mode 100644
index 000000000..7516c1650
--- /dev/null
+++ b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/mbedtls/mbedtls_freertos_port.c
@@ -0,0 +1,286 @@
+/*
+ * Copyright (C) 2020 Amazon.com, Inc. or its affiliates.  All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+/**
+ * @file mbedtls_freertos_port.c
+ * @brief Implements mbed TLS platform functions for FreeRTOS.
+ */
+
+/* FreeRTOS includes. */
+#include "FreeRTOS.h"
+#include "FreeRTOS_Sockets.h"
+
+/* mbed TLS includes. */
+#include "mbedtls_config.h"
+#include "threading_alt.h"
+#include "mbedtls/entropy.h"
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Allocates memory for an array of members.
+ *
+ * @param[in] nmemb Number of members that need to be allocated.
+ * @param[in] size Size of each member.
+ *
+ * @return Pointer to the beginning of newly allocated memory.
+ */
+void * mbedtls_platform_calloc( size_t nmemb,
+                                size_t size )
+{
+    size_t totalSize = nmemb * size;
+    void * pBuffer = NULL;
+
+    /* Check that neither nmemb nor size were 0. */
+    if( totalSize > 0 )
+    {
+        /* Overflow check. */
+        if( totalSize / size == nmemb )
+        {
+            pBuffer = pvPortMalloc( totalSize );
+
+            if( pBuffer != NULL )
+            {
+                ( void ) memset( pBuffer, 0x00, totalSize );
+            }
+        }
+    }
+
+    return pBuffer;
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Frees the space previously allocated by calloc.
+ *
+ * @param[in] ptr Pointer to the memory to be freed.
+ */
+void mbedtls_platform_free( void * ptr )
+{
+    vPortFree( ptr );
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Sends data over FreeRTOS+TCP sockets.
+ *
+ * @param[in] ctx The network context containing the socket handle.
+ * @param[in] buf Buffer containing the bytes to send.
+ * @param[in] len Number of bytes to send from the buffer.
+ *
+ * @return Number of bytes sent on success; else a negative value.
+ */
+int mbedtls_platform_send( void * ctx,
+                           const unsigned char * buf,
+                           size_t len )
+{
+    Socket_t socket;
+
+    configASSERT( ctx != NULL );
+    configASSERT( buf != NULL );
+
+    socket = ( Socket_t ) ctx;
+
+    return ( int ) FreeRTOS_send( socket, buf, len, 0 );
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Receives data from FreeRTOS+TCP socket.
+ *
+ * @param[in] ctx The network context containing the socket handle.
+ * @param[out] buf Buffer to receive bytes into.
+ * @param[in] len Number of bytes to receive from the network.
+ *
+ * @return Number of bytes received if successful; Negative value on error.
+ */
+int mbedtls_platform_recv( void * ctx,
+                           unsigned char * buf,
+                           size_t len )
+{
+    Socket_t socket;
+
+    configASSERT( ctx != NULL );
+    configASSERT( buf != NULL );
+
+    socket = ( Socket_t ) ctx;
+
+    return ( int ) FreeRTOS_recv( socket, buf, len, 0 );
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Creates a mutex.
+ *
+ * @param[in, out] pMutex mbedtls mutex handle.
+ */
+void mbedtls_platform_mutex_init( mbedtls_threading_mutex_t * pMutex )
+{
+    configASSERT( pMutex != NULL );
+
+    /* Create a statically-allocated FreeRTOS mutex. This should never fail as
+     * storage is provided. */
+    pMutex->mutexHandle = xSemaphoreCreateMutexStatic( &( pMutex->mutexStorage ) );
+    configASSERT( pMutex->mutexHandle != NULL );
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Frees a mutex.
+ *
+ * @param[in] pMutex mbedtls mutex handle.
+ *
+ * @note This function is an empty stub as nothing needs to be done to free
+ * a statically allocated FreeRTOS mutex.
+ */
+void mbedtls_platform_mutex_free( mbedtls_threading_mutex_t * pMutex )
+{
+    /* Nothing needs to be done to free a statically-allocated FreeRTOS mutex. */
+    ( void ) pMutex;
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Function to lock a mutex.
+ *
+ * @param[in] pMutex mbedtls mutex handle.
+ *
+ * @return 0 (success) is always returned as any other failure is asserted.
+ */
+int mbedtls_platform_mutex_lock( mbedtls_threading_mutex_t * pMutex )
+{
+    BaseType_t mutexStatus = 0;
+
+    configASSERT( pMutex != NULL );
+
+    /* mutexStatus is not used if asserts are disabled. */
+    ( void ) mutexStatus;
+
+    /* This function should never fail if the mutex is initialized. */
+    mutexStatus = xSemaphoreTake( pMutex->mutexHandle, portMAX_DELAY );
+    configASSERT( mutexStatus == pdTRUE );
+
+    return 0;
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Function to unlock a mutex.
+ *
+ * @param[in] pMutex mbedtls mutex handle.
+ *
+ * @return 0 is always returned as any other failure is asserted.
+ */
+int mbedtls_platform_mutex_unlock( mbedtls_threading_mutex_t * pMutex )
+{
+    BaseType_t mutexStatus = 0;
+
+    configASSERT( pMutex != NULL );
+    /* mutexStatus is not used if asserts are disabled. */
+    ( void ) mutexStatus;
+
+    /* This function should never fail if the mutex is initialized. */
+    mutexStatus = xSemaphoreGive( pMutex->mutexHandle );
+    configASSERT( mutexStatus == pdTRUE );
+
+    return 0;
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Function to generate a random number.
+ *
+ * @param[in] data Callback context.
+ * @param[out] output The address of the buffer that receives the random number.
+ * @param[in] len Maximum size of the random number to be generated.
+ * @param[out] olen The size, in bytes, of the #output buffer.
+ *
+ * @return 0 if no critical failures occurred,
+ * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise.
+ */
+int mbedtls_platform_entropy_poll( void * data,
+                                   unsigned char * output,
+                                   size_t len,
+                                   size_t * olen )
+{
+    int status = 0;
+    NTSTATUS rngStatus = 0;
+
+    configASSERT( output != NULL );
+    configASSERT( olen != NULL );
+
+    /* Context is not used by this function. */
+    ( void ) data;
+
+    /* TLS requires a secure random number generator; use the RNG provided
+     * by Windows. This function MUST be re-implemented for other platforms. */
+    rngStatus =
+        BCryptGenRandom( NULL, output, len, BCRYPT_USE_SYSTEM_PREFERRED_RNG );
+
+    if( rngStatus == 0 )
+    {
+        /* All random bytes generated. */
+        *olen = len;
+    }
+    else
+    {
+        /* RNG failure. */
+        *olen = 0;
+        status = MBEDTLS_ERR_ENTROPY_SOURCE_FAILED;
+    }
+
+    return status;
+}
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Function to generate a random number based on a hardware poll.
+ *
+ * For this FreeRTOS Windows port, this function is redirected by calling
+ * #mbedtls_platform_entropy_poll.
+ *
+ * @param[in] data Callback context.
+ * @param[out] output The address of the buffer that receives the random number.
+ * @param[in] len Maximum size of the random number to be generated.
+ * @param[out] olen The size, in bytes, of the #output buffer.
+ *
+ * @return 0 if no critical failures occurred,
+ * MBEDTLS_ERR_ENTROPY_SOURCE_FAILED otherwise.
+ */
+int mbedtls_hardware_poll( void * data,
+                           unsigned char * output,
+                           size_t len,
+                           size_t * olen )
+{
+    return mbedtls_platform_entropy_poll( data, output, len, olen );
+}
+
+/*-----------------------------------------------------------*/
diff --git a/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/mbedtls/threading_alt.h b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/mbedtls/threading_alt.h
new file mode 100644
index 000000000..799ca5f5c
--- /dev/null
+++ b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/mbedtls/threading_alt.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2020 Amazon.com, Inc. or its affiliates.  All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+/**
+ * @file threading_alt.h
+ * @brief mbed TLS threading functions implemented for FreeRTOS.
+ */
+
+
+#ifndef MBEDTLS_THREADING_ALT_H_
+#define MBEDTLS_THREADING_ALT_H_
+
+/* FreeRTOS includes. */
+#include "FreeRTOS.h"
+#include "semphr.h"
+
+/**
+ * @brief mbed TLS mutex type.
+ *
+ * mbed TLS requires platform specific definition for the mutext type. Defining the type for
+ * FreeRTOS with FreeRTOS semaphore
+ * handle and semaphore storage as members.
+ */
+typedef struct mbedtls_threading_mutex
+{
+    SemaphoreHandle_t mutexHandle;
+    StaticSemaphore_t mutexStorage;
+} mbedtls_threading_mutex_t;
+
+/* mbed TLS mutex functions. */
+void mbedtls_platform_mutex_init( mbedtls_threading_mutex_t * pMutex );
+void mbedtls_platform_mutex_free( mbedtls_threading_mutex_t * pMutex );
+int mbedtls_platform_mutex_lock( mbedtls_threading_mutex_t * pMutex );
+int mbedtls_platform_mutex_unlock( mbedtls_threading_mutex_t * pMutex );
+
+#endif /* ifndef MBEDTLS_THREADING_ALT_H_ */
diff --git a/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/include/freertos_sockets_wrapper.h b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/include/freertos_sockets_wrapper.h
new file mode 100644
index 000000000..445349862
--- /dev/null
+++ b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/include/freertos_sockets_wrapper.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2020 Amazon.com, Inc. or its affiliates.  All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+/**
+ * @file freertos_sockets_wrapper.h
+ * @brief FreeRTOS Sockets connect and disconnect function wrapper.
+ */
+
+#ifndef FREERTOS_SOCKETS_WRAPPER_H_
+#define FREERTOS_SOCKETS_WRAPPER_H_
+
+/* FreeRTOS+TCP includes. */
+#include "FreeRTOS_IP.h"
+#include "FreeRTOS_Sockets.h"
+
+/**************************************************/
+/******* DO NOT CHANGE the following order ********/
+/**************************************************/
+
+/* Logging related header files are required to be included in the following order:
+ * 1. Include the header file "logging_levels.h".
+ * 2. Define LIBRARY_LOG_NAME and  LIBRARY_LOG_LEVEL.
+ * 3. Include the header file "logging_stack.h".
+ */
+
+/* Include header that defines log levels. */
+#include "logging_levels.h"
+
+/* Logging configuration for the Sockets. */
+#ifndef LIBRARY_LOG_NAME
+    #define LIBRARY_LOG_NAME     "Sockets"
+#endif
+#ifndef LIBRARY_LOG_LEVEL
+    #define LIBRARY_LOG_LEVEL    LOG_ERROR
+#endif
+
+#include "logging_stack.h"
+
+/************ End of logging configuration ****************/
+
+/**
+ * @brief Establish a connection to server.
+ *
+ * @param[out] pTcpSocket The output parameter to return the created socket descriptor.
+ * @param[in] pHostName Server hostname to connect to.
+ * @param[in] pServerInfo Server port to connect to.
+ * @param[in] receiveTimeoutMs Timeout (in milliseconds) for transport receive.
+ * @param[in] sendTimeoutMs Timeout (in milliseconds) for transport send.
+ *
+ * @note A timeout of 0 means infinite timeout.
+ *
+ * @return Non-zero value on error, 0 on success.
+ */
+BaseType_t Sockets_Connect( Socket_t * pTcpSocket,
+                            const char * pHostName,
+                            uint16_t port,
+                            uint32_t receiveTimeoutMs,
+                            uint32_t sendTimeoutMs );
+
+/**
+ * @brief End connection to server.
+ *
+ * @param[in] tcpSocket The socket descriptor.
+ */
+void Sockets_Disconnect( Socket_t tcpSocket );
+
+#endif /* ifndef FREERTOS_SOCKETS_WRAPPER_H_ */
diff --git a/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/include/tls_freertos.h b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/include/tls_freertos.h
new file mode 100644
index 000000000..f6355bea0
--- /dev/null
+++ b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/include/tls_freertos.h
@@ -0,0 +1,202 @@
+/*
+ * Copyright (C) 2020 Amazon.com, Inc. or its affiliates.  All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+/**
+ * @file tls_freertos.h
+ * @brief TLS transport interface header.
+ */
+
+#ifndef TLS_FREERTOS_H_
+#define TLS_FREERTOS_H_
+
+/**************************************************/
+/******* DO NOT CHANGE the following order ********/
+/**************************************************/
+
+/* Logging related header files are required to be included in the following order:
+ * 1. Include the header file "logging_levels.h".
+ * 2. Define LIBRARY_LOG_NAME and  LIBRARY_LOG_LEVEL.
+ * 3. Include the header file "logging_stack.h".
+ */
+
+/* Include header that defines log levels. */
+#include "logging_levels.h"
+
+/* Logging configuration for the Sockets. */
+#ifndef LIBRARY_LOG_NAME
+    #define LIBRARY_LOG_NAME     "TlsTransport"
+#endif
+#ifndef LIBRARY_LOG_LEVEL
+    #define LIBRARY_LOG_LEVEL    LOG_ERROR
+#endif
+
+#include "logging_stack.h"
+
+/************ End of logging configuration ****************/
+
+/* FreeRTOS+TCP include. */
+#include "FreeRTOS_Sockets.h"
+
+/* Transport interface include. */
+#include "transport_interface.h"
+
+/* mbed TLS includes. */
+#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/entropy.h"
+#include "mbedtls/ssl.h"
+#include "mbedtls/threading.h"
+#include "mbedtls/x509.h"
+
+/**
+ * @brief Secured connection context.
+ */
+typedef struct SSLContext
+{
+    mbedtls_ssl_config config;            /**< @brief SSL connection configuration. */
+    mbedtls_ssl_context context;          /**< @brief SSL connection context */
+    mbedtls_x509_crt_profile certProfile; /**< @brief Certificate security profile for this connection. */
+    mbedtls_x509_crt rootCa;              /**< @brief Root CA certificate context. */
+    mbedtls_x509_crt clientCert;          /**< @brief Client certificate context. */
+    mbedtls_pk_context privKey;           /**< @brief Client private key context. */
+} SSLContext_t;
+
+/**
+ * @brief Definition of the network context for the transport interface
+ * implementation that uses mbedTLS and FreeRTOS+TLS sockets.
+ */
+struct NetworkContext
+{
+    Socket_t tcpSocket;
+    SSLContext_t sslContext;
+};
+
+/**
+ * @brief Contains the credentials necessary for tls connection setup.
+ */
+typedef struct NetworkCredentials
+{
+    /**
+     * @brief Set this to a non-NULL value to use ALPN.
+     *
+     * This string must be NULL-terminated.
+     *
+     * See [this link]
+     * (https://aws.amazon.com/blogs/iot/mqtt-with-tls-client-authentication-on-port-443-why-it-is-useful-and-how-it-works/)
+     * for more information.
+     */
+    const char * pAlpnProtos;
+
+    /**
+     * @brief Disable server name indication (SNI) for a TLS session.
+     */
+    BaseType_t disableSni;
+
+    const unsigned char * pRootCa;     /**< @brief String representing a trusted server root certificate. */
+    size_t rootCaSize;                 /**< @brief Size associated with #IotNetworkCredentials.pRootCa. */
+    const unsigned char * pClientCert; /**< @brief String representing the client certificate. */
+    size_t clientCertSize;             /**< @brief Size associated with #IotNetworkCredentials.pClientCert. */
+    const unsigned char * pPrivateKey; /**< @brief String representing the client certificate's private key. */
+    size_t privateKeySize;             /**< @brief Size associated with #IotNetworkCredentials.pPrivateKey. */
+    const unsigned char * pUserName;   /**< @brief String representing the username for MQTT. */
+    size_t userNameSize;               /**< @brief Size associated with #IotNetworkCredentials.pUserName. */
+    const unsigned char * pPassword;   /**< @brief String representing the password for MQTT. */
+    size_t passwordSize;               /**< @brief Size associated with #IotNetworkCredentials.pPassword. */
+} NetworkCredentials_t;
+
+/**
+ * @brief TLS Connect / Disconnect return status.
+ */
+typedef enum TlsTransportStatus
+{
+    TLS_TRANSPORT_SUCCESS = 0,         /**< Function successfully completed. */
+    TLS_TRANSPORT_INVALID_PARAMETER,   /**< At least one parameter was invalid. */
+    TLS_TRANSPORT_INSUFFICIENT_MEMORY, /**< Insufficient memory required to establish connection. */
+    TLS_TRANSPORT_INVALID_CREDENTIALS, /**< Provided credentials were invalid. */
+    TLS_TRANSPORT_HANDSHAKE_FAILED,    /**< Performing TLS handshake with server failed. */
+    TLS_TRANSPORT_INTERNAL_ERROR,      /**< A call to a system API resulted in an internal error. */
+    TLS_TRANSPORT_CONNECT_FAILURE      /**< Initial connection to the server failed. */
+} TlsTransportStatus_t;
+
+/**
+ * @brief Create a TLS connection with FreeRTOS sockets.
+ *
+ * @param[out] pNetworkContext Pointer to a network context to contain the
+ * initialized socket handle.
+ * @param[in] pHostName The hostname of the remote endpoint.
+ * @param[in] port The destination port.
+ * @param[in] pNetworkCredentials Credentials for the TLS connection.
+ * @param[in] receiveTimeoutMs Receive socket timeout.
+ * @param[in] sendTimeoutMs Send socket timeout.
+ *
+ * @return #TLS_TRANSPORT_SUCCESS, #TLS_TRANSPORT_INSUFFICIENT_MEMORY, #TLS_TRANSPORT_INVALID_CREDENTIALS,
+ * #TLS_TRANSPORT_HANDSHAKE_FAILED, #TLS_TRANSPORT_INTERNAL_ERROR, or #TLS_TRANSPORT_CONNECT_FAILURE.
+ */
+TlsTransportStatus_t TLS_FreeRTOS_Connect( NetworkContext_t * pNetworkContext,
+                                           const char * pHostName,
+                                           uint16_t port,
+                                           const NetworkCredentials_t * pNetworkCredentials,
+                                           uint32_t receiveTimeoutMs,
+                                           uint32_t sendTimeoutMs );
+
+/**
+ * @brief Gracefully disconnect an established TLS connection.
+ *
+ * @param[in] pNetworkContext Network context.
+ */
+void TLS_FreeRTOS_Disconnect( NetworkContext_t * pNetworkContext );
+
+/**
+ * @brief Receives data from an established TLS connection.
+ *
+ * This is the TLS version of the transport interface's
+ * #TransportRecv_t function.
+ *
+ * @param[in] pNetworkContext The Network context.
+ * @param[out] pBuffer Buffer to receive bytes into.
+ * @param[in] bytesToRecv Number of bytes to receive from the network.
+ *
+ * @return Number of bytes (> 0) received if successful;
+ * 0 if the socket times out without reading any bytes;
+ * negative value on error.
+ */
+int32_t TLS_FreeRTOS_recv( NetworkContext_t * pNetworkContext,
+                           void * pBuffer,
+                           size_t bytesToRecv );
+
+/**
+ * @brief Sends data over an established TLS connection.
+ *
+ * This is the TLS version of the transport interface's
+ * #TransportSend_t function.
+ *
+ * @param[in] pNetworkContext The network context.
+ * @param[in] pBuffer Buffer containing the bytes to send.
+ * @param[in] bytesToSend Number of bytes to send from the buffer.
+ *
+ * @return Number of bytes (> 0) sent on success;
+ * 0 if the socket times out without sending any bytes;
+ * else a negative value to represent error.
+ */
+int32_t TLS_FreeRTOS_send( NetworkContext_t * pNetworkContext,
+                           const void * pBuffer,
+                           size_t bytesToSend );
+
+#endif /* ifndef TLS_FREERTOS_H_ */
diff --git a/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/src/freertos_sockets_wrapper.c b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/src/freertos_sockets_wrapper.c
new file mode 100644
index 000000000..fc30c9ec7
--- /dev/null
+++ b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/src/freertos_sockets_wrapper.c
@@ -0,0 +1,168 @@
+/*
+ * Copyright (C) 2020 Amazon.com, Inc. or its affiliates.  All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+/**
+ * @file freertos_sockets_wrapper.c
+ * @brief FreeRTOS Sockets connect and disconnect wrapper implementation.
+ */
+
+/* Standard includes. */
+#include <string.h>
+
+/* FreeRTOS includes. */
+#include "FreeRTOS.h"
+
+#include "freertos_sockets_wrapper.h"
+
+/*-----------------------------------------------------------*/
+
+/* Maximum number of times to call FreeRTOS_recv when initiating a graceful shutdown. */
+#ifndef FREERTOS_SOCKETS_WRAPPER_SHUTDOWN_LOOPS
+    #define FREERTOS_SOCKETS_WRAPPER_SHUTDOWN_LOOPS    ( 3 )
+#endif
+
+/* A negative error code indicating a network failure. */
+#define FREERTOS_SOCKETS_WRAPPER_NETWORK_ERROR    ( -1 )
+
+/*-----------------------------------------------------------*/
+
+BaseType_t Sockets_Connect( Socket_t * pTcpSocket,
+                            const char * pHostName,
+                            uint16_t port,
+                            uint32_t receiveTimeoutMs,
+                            uint32_t sendTimeoutMs )
+{
+    Socket_t tcpSocket = FREERTOS_INVALID_SOCKET;
+    BaseType_t socketStatus = 0;
+    struct freertos_sockaddr serverAddress = { 0 };
+    TickType_t transportTimeout = 0;
+
+    /* Create a new TCP socket. */
+    tcpSocket = FreeRTOS_socket( FREERTOS_AF_INET, FREERTOS_SOCK_STREAM, FREERTOS_IPPROTO_TCP );
+
+    if( tcpSocket == FREERTOS_INVALID_SOCKET )
+    {
+        LogError( ( "Failed to create new socket." ) );
+        socketStatus = FREERTOS_SOCKETS_WRAPPER_NETWORK_ERROR;
+    }
+    else
+    {
+        LogDebug( ( "Created new TCP socket." ) );
+
+        /* Connection parameters. */
+        serverAddress.sin_family = FREERTOS_AF_INET;
+        serverAddress.sin_port = FreeRTOS_htons( port );
+        serverAddress.sin_addr = FreeRTOS_gethostbyname( pHostName );
+        serverAddress.sin_len = ( uint8_t ) sizeof( serverAddress );
+
+        /* Check for errors from DNS lookup. */
+        if( serverAddress.sin_addr == 0 )
+        {
+            LogError( ( "Failed to connect to server: DNS resolution failed: Hostname=%s.",
+                        pHostName ) );
+            socketStatus = FREERTOS_SOCKETS_WRAPPER_NETWORK_ERROR;
+        }
+    }
+
+    if( socketStatus == 0 )
+    {
+        /* Establish connection. */
+        LogDebug( ( "Creating TCP Connection to %s.", pHostName ) );
+        socketStatus = FreeRTOS_connect( tcpSocket, &serverAddress, sizeof( serverAddress ) );
+
+        if( socketStatus != 0 )
+        {
+            LogError( ( "Failed to connect to server: FreeRTOS_Connect failed: ReturnCode=%d,"
+                        " Hostname=%s, Port=%u.",
+                        socketStatus,
+                        pHostName,
+                        port ) );
+        }
+    }
+
+    if( socketStatus == 0 )
+    {
+        /* Set socket receive timeout. */
+        transportTimeout = pdMS_TO_TICKS( receiveTimeoutMs );
+        /* Setting the receive block time cannot fail. */
+        ( void ) FreeRTOS_setsockopt( tcpSocket,
+                                      0,
+                                      FREERTOS_SO_RCVTIMEO,
+                                      &transportTimeout,
+                                      sizeof( TickType_t ) );
+
+        /* Set socket send timeout. */
+        transportTimeout = pdMS_TO_TICKS( sendTimeoutMs );
+        /* Setting the send block time cannot fail. */
+        ( void ) FreeRTOS_setsockopt( tcpSocket,
+                                      0,
+                                      FREERTOS_SO_SNDTIMEO,
+                                      &transportTimeout,
+                                      sizeof( TickType_t ) );
+    }
+
+    /* Clean up on failure. */
+    if( socketStatus != 0 )
+    {
+        if( tcpSocket != FREERTOS_INVALID_SOCKET )
+        {
+            FreeRTOS_closesocket( tcpSocket );
+        }
+    }
+    else
+    {
+        /* Set the socket. */
+        *pTcpSocket = tcpSocket;
+        LogInfo( ( "Established TCP connection with %s.", pHostName ) );
+    }
+
+    return socketStatus;
+}
+
+/*-----------------------------------------------------------*/
+
+void Sockets_Disconnect( Socket_t tcpSocket )
+{
+    BaseType_t waitForShutdownLoopCount = 0;
+    uint8_t pDummyBuffer[ 2 ];
+
+    if( tcpSocket != FREERTOS_INVALID_SOCKET )
+    {
+        /* Initiate graceful shutdown. */
+        ( void ) FreeRTOS_shutdown( tcpSocket, FREERTOS_SHUT_RDWR );
+
+        /* Wait for the socket to disconnect gracefully (indicated by FreeRTOS_recv()
+         * returning a FREERTOS_EINVAL error) before closing the socket. */
+        while( FreeRTOS_recv( tcpSocket, pDummyBuffer, sizeof( pDummyBuffer ), 0 ) >= 0 )
+        {
+            /* We don't need to delay since FreeRTOS_recv should already have a timeout. */
+
+            if( ++waitForShutdownLoopCount >= FREERTOS_SOCKETS_WRAPPER_SHUTDOWN_LOOPS )
+            {
+                break;
+            }
+        }
+
+        ( void ) FreeRTOS_closesocket( tcpSocket );
+    }
+}
+
+/*-----------------------------------------------------------*/
diff --git a/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/src/tls_freertos.c b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/src/tls_freertos.c
new file mode 100644
index 000000000..4e3fece8e
--- /dev/null
+++ b/FreeRTOS-Plus/Source/FreeRTOS-IoT-Libraries-LTS-Beta2/c_sdk/platform/freertos/transport/src/tls_freertos.c
@@ -0,0 +1,625 @@
+/*
+ * Copyright (C) 2020 Amazon.com, Inc. or its affiliates.  All Rights Reserved.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy of
+ * this software and associated documentation files (the "Software"), to deal in
+ * the Software without restriction, including without limitation the rights to
+ * use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ * the Software, and to permit persons to whom the Software is furnished to do so,
+ * subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+ * FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+ * COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+ * IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+ * CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+ */
+
+/**
+ * @file tls_freertos.c
+ * @brief TLS transport interface implementations. This implementation uses
+ * mbedTLS.
+ */
+
+/* Standard includes. */
+#include <string.h>
+
+/* FreeRTOS includes. */
+#include "FreeRTOS.h"
+
+/* FreeRTOS+TCP includes. */
+#include "FreeRTOS_IP.h"
+#include "FreeRTOS_Sockets.h"
+
+/* TLS transport header. */
+#include "tls_freertos.h"
+
+/* FreeRTOS Socket wrapper include. */
+#include "freertos_sockets_wrapper.h"
+
+/* mbedTLS util includes. */
+#include "mbedtls_error.h"
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Represents string to be logged when mbedTLS returned error
+ * does not contain a high-level code.
+ */
+static const char * pNoHighLevelMbedTlsCodeStr = "<No-High-Level-Code>";
+
+/**
+ * @brief Represents string to be logged when mbedTLS returned error
+ * does not contain a low-level code.
+ */
+static const char * pNoLowLevelMbedTlsCodeStr = "<No-Low-Level-Code>";
+
+/**
+ * @brief Utility for converting the high-level code in an mbedTLS error to string,
+ * if the code-contains a high-level code; otherwise, using a default string.
+ */
+#define mbedtlsHighLevelCodeOrDefault( mbedTlsCode )        \
+    ( mbedtls_strerror_highlevel( mbedTlsCode ) != NULL ) ? \
+    mbedtls_strerror_highlevel( mbedTlsCode ) : pNoHighLevelMbedTlsCodeStr
+
+/**
+ * @brief Utility for converting the level-level code in an mbedTLS error to string,
+ * if the code-contains a level-level code; otherwise, using a default string.
+ */
+#define mbedtlsLowLevelCodeOrDefault( mbedTlsCode )        \
+    ( mbedtls_strerror_lowlevel( mbedTlsCode ) != NULL ) ? \
+    mbedtls_strerror_lowlevel( mbedTlsCode ) : pNoLowLevelMbedTlsCodeStr
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief mbed TLS entropy context for generation of random numbers.
+ */
+static mbedtls_entropy_context entropyContext;
+
+/**
+ * @brief mbed TLS CTR DRBG context for generation of random numbers.
+ */
+static mbedtls_ctr_drbg_context ctrDrgbContext;
+
+/*-----------------------------------------------------------*/
+
+/**
+ * @brief Initialize the mbed TLS structures in a network connection.
+ *
+ * @param[in] pSslContext The SSL context to initialize.
+ */
+static void sslContextInit( SSLContext_t * pSslContext );
+
+/**
+ * @brief Free the mbed TLS structures in a network connection.
+ *
+ * @param[in] pSslContext The SSL context to free.
+ */
+static void sslContextFree( SSLContext_t * pSslContext );
+
+/**
+ * @brief Set up TLS on a TCP connection.
+ *
+ * @param[in] pNetworkContext Network context.
+ * @param[in] pHostName Remote host name, used for server name indication.
+ * @param[in] pNetworkCredentials TLS setup parameters.
+ *
+ * @return #TLS_TRANSPORT_SUCCESS, #TLS_TRANSPORT_INSUFFICIENT_MEMORY, #TLS_TRANSPORT_INVALID_CREDENTIALS,
+ * #TLS_TRANSPORT_HANDSHAKE_FAILED, or #TLS_TRANSPORT_INTERNAL_ERROR.
+ */
+static TlsTransportStatus_t tlsSetup( NetworkContext_t * pNetworkContext,
+                                      const char * pHostName,
+                                      const NetworkCredentials_t * pNetworkCredentials );
+
+/**
+ * @brief Initialize mbedTLS.
+ *
+ * @return #TLS_TRANSPORT_SUCCESS, or #TLS_TRANSPORT_INTERNAL_ERROR.
+ */
+static TlsTransportStatus_t initMbedtls( void );
+
+/*-----------------------------------------------------------*/
+
+static void sslContextInit( SSLContext_t * pSslContext )
+{
+    configASSERT( pSslContext != NULL );
+
+    mbedtls_ssl_config_init( &( pSslContext->config ) );
+    mbedtls_x509_crt_init( &( pSslContext->rootCa ) );
+    mbedtls_pk_init( &( pSslContext->privKey ) );
+    mbedtls_x509_crt_init( &( pSslContext->clientCert ) );
+    mbedtls_ssl_init( &( pSslContext->context ) );
+}
+/*-----------------------------------------------------------*/
+
+static void sslContextFree( SSLContext_t * pSslContext )
+{
+    configASSERT( pSslContext != NULL );
+
+    mbedtls_ssl_free( &( pSslContext->context ) );
+    mbedtls_x509_crt_free( &( pSslContext->rootCa ) );
+    mbedtls_x509_crt_free( &( pSslContext->clientCert ) );
+    mbedtls_pk_free( &( pSslContext->privKey ) );
+    mbedtls_ssl_config_free( &( pSslContext->config ) );
+}
+
+/*-----------------------------------------------------------*/
+
+static TlsTransportStatus_t tlsSetup( NetworkContext_t * pNetworkContext,
+                                      const char * pHostName,
+                                      const NetworkCredentials_t * pNetworkCredentials )
+{
+    TlsTransportStatus_t returnStatus = TLS_TRANSPORT_SUCCESS;
+    int mbedtlsError = 0;
+
+    configASSERT( pNetworkContext != NULL );
+    configASSERT( pHostName != NULL );
+    configASSERT( pNetworkCredentials != NULL );
+    configASSERT( pNetworkCredentials->pRootCa != NULL );
+
+    /* Initialize the mbed TLS context structures. */
+    sslContextInit( &( pNetworkContext->sslContext ) );
+
+    mbedtlsError = mbedtls_ssl_config_defaults( &( pNetworkContext->sslContext.config ),
+                                                MBEDTLS_SSL_IS_CLIENT,
+                                                MBEDTLS_SSL_TRANSPORT_STREAM,
+                                                MBEDTLS_SSL_PRESET_DEFAULT );
+
+    if( mbedtlsError != 0 )
+    {
+        LogError( ( "Failed to set default SSL configuration: mbedTLSError= %s : %s.",
+                    mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                    mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+
+        /* Per mbed TLS docs, mbedtls_ssl_config_defaults only fails on memory allocation. */
+        returnStatus = TLS_TRANSPORT_INSUFFICIENT_MEMORY;
+    }
+
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        /* Set up the certificate security profile, starting from the default value. */
+        pNetworkContext->sslContext.certProfile = mbedtls_x509_crt_profile_default;
+
+        /* test.mosquitto.org only provides a 1024-bit RSA certificate, which is
+         * not acceptable by the default mbed TLS certificate security profile.
+         * For the purposes of this demo, allow the use of 1024-bit RSA certificates.
+         * This block should be removed otherwise. */
+        if( strncmp( pHostName, "test.mosquitto.org", strlen( pHostName ) ) == 0 )
+        {
+            pNetworkContext->sslContext.certProfile.rsa_min_bitlen = 1024;
+        }
+
+        /* Set SSL authmode and the RNG context. */
+        mbedtls_ssl_conf_authmode( &( pNetworkContext->sslContext.config ),
+                                   MBEDTLS_SSL_VERIFY_REQUIRED );
+        mbedtls_ssl_conf_rng( &( pNetworkContext->sslContext.config ),
+                              mbedtls_ctr_drbg_random,
+                              &ctrDrgbContext );
+        mbedtls_ssl_conf_cert_profile( &( pNetworkContext->sslContext.config ),
+                                       &( pNetworkContext->sslContext.certProfile ) );
+
+        /* Parse the server root CA certificate into the SSL context. */
+        mbedtlsError = mbedtls_x509_crt_parse( &( pNetworkContext->sslContext.rootCa ),
+                                               pNetworkCredentials->pRootCa,
+                                               pNetworkCredentials->rootCaSize );
+
+        if( mbedtlsError != 0 )
+        {
+            LogError( ( "Failed to parse server root CA certificate: mbedTLSError= %s : %s.",
+                        mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                        mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+
+            returnStatus = TLS_TRANSPORT_INVALID_CREDENTIALS;
+        }
+        else
+        {
+            mbedtls_ssl_conf_ca_chain( &( pNetworkContext->sslContext.config ),
+                                       &( pNetworkContext->sslContext.rootCa ),
+                                       NULL );
+        }
+    }
+
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        if( ( pNetworkCredentials->pPrivateKey != NULL ) && ( pNetworkCredentials->pClientCert != NULL ) )
+        {
+            /* Setup the client private key. */
+            mbedtlsError = mbedtls_pk_parse_key( &( pNetworkContext->sslContext.privKey ),
+                                                 pNetworkCredentials->pPrivateKey,
+                                                 pNetworkCredentials->privateKeySize,
+                                                 0,
+                                                 0 );
+
+            if( mbedtlsError != 0 )
+            {
+                LogError( ( "Failed to parse client certificate: mbedTLSError= %s : %s.",
+                            mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                            mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+
+                returnStatus = TLS_TRANSPORT_INVALID_CREDENTIALS;
+            }
+            else
+            {
+                /* Setup the client certificate. */
+                mbedtlsError = mbedtls_x509_crt_parse( &( pNetworkContext->sslContext.clientCert ),
+                                                       pNetworkCredentials->pClientCert,
+                                                       pNetworkCredentials->clientCertSize );
+
+                if( mbedtlsError != 0 )
+                {
+                    LogError( ( "Failed to parse the client private key: mbedTLSError= %s : %s.",
+                                mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                                mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+
+                    returnStatus = TLS_TRANSPORT_INVALID_CREDENTIALS;
+                }
+                else
+                {
+                    mbedtls_ssl_conf_own_cert( &( pNetworkContext->sslContext.config ),
+                                               &( pNetworkContext->sslContext.clientCert ),
+                                               &( pNetworkContext->sslContext.privKey ) );
+                }
+            }
+        }
+    }
+
+    if( ( returnStatus == TLS_TRANSPORT_SUCCESS ) && ( pNetworkCredentials->pAlpnProtos != NULL ) )
+    {
+        /* Include an application protocol list in the TLS ClientHello
+         * message. */
+        mbedtlsError = mbedtls_ssl_conf_alpn_protocols( &( pNetworkContext->sslContext.config ),
+                                                        ( const char ** ) &( pNetworkCredentials->pAlpnProtos ) );
+
+        if( mbedtlsError != 0 )
+        {
+            LogError( ( "Failed to configure ALPN protocol in mbed TLS: mbedTLSError= %s : %s.",
+                        mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                        mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+
+            returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
+        }
+    }
+
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        /* Initialize the mbed TLS secured connection context. */
+        mbedtlsError = mbedtls_ssl_setup( &( pNetworkContext->sslContext.context ),
+                                          &( pNetworkContext->sslContext.config ) );
+
+        if( mbedtlsError != 0 )
+        {
+            LogError( ( "Failed to set up mbed TLS SSL context: mbedTLSError= %s : %s.",
+                        mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                        mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+
+            returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
+        }
+        else
+        {
+            /* Set the underlying IO for the TLS connection. */
+            mbedtls_ssl_set_bio( &( pNetworkContext->sslContext.context ),
+                                 pNetworkContext->tcpSocket,
+                                 mbedtls_platform_send,
+                                 mbedtls_platform_recv,
+                                 NULL );
+        }
+    }
+
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        /* Enable SNI if requested. */
+        if( pNetworkCredentials->disableSni == pdFALSE )
+        {
+            mbedtlsError = mbedtls_ssl_set_hostname( &( pNetworkContext->sslContext.context ),
+                                                     pHostName );
+
+            if( mbedtlsError != 0 )
+            {
+                LogError( ( "Failed to set server name: mbedTLSError= %s : %s.",
+                            mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                            mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+
+                returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
+            }
+        }
+    }
+
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        /* Perform the TLS handshake. */
+        do
+        {
+            mbedtlsError = mbedtls_ssl_handshake( &( pNetworkContext->sslContext.context ) );
+        } while( ( mbedtlsError == MBEDTLS_ERR_SSL_WANT_READ ) ||
+                 ( mbedtlsError == MBEDTLS_ERR_SSL_WANT_WRITE ) );
+
+        if( mbedtlsError != 0 )
+        {
+            LogError( ( "Failed to perform TLS handshake: mbedTLSError= %s : %s.",
+                        mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                        mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+
+            returnStatus = TLS_TRANSPORT_HANDSHAKE_FAILED;
+        }
+    }
+
+    if( returnStatus != TLS_TRANSPORT_SUCCESS )
+    {
+        sslContextFree( &( pNetworkContext->sslContext ) );
+    }
+    else
+    {
+        LogInfo( ( "(Network connection %p) TLS handshake successful.",
+                   pNetworkContext ) );
+    }
+
+    return returnStatus;
+}
+
+/*-----------------------------------------------------------*/
+
+static TlsTransportStatus_t initMbedtls( void )
+{
+    TlsTransportStatus_t returnStatus = TLS_TRANSPORT_SUCCESS;
+    int mbedtlsError = 0;
+
+    /* Set the mutex functions for mbed TLS thread safety. */
+    mbedtls_threading_set_alt( mbedtls_platform_mutex_init,
+                               mbedtls_platform_mutex_free,
+                               mbedtls_platform_mutex_lock,
+                               mbedtls_platform_mutex_unlock );
+
+    /* Initialize contexts for random number generation. */
+    mbedtls_entropy_init( &entropyContext );
+    mbedtls_ctr_drbg_init( &ctrDrgbContext );
+
+    /* Add a strong entropy source. At least one is required. */
+    mbedtlsError = mbedtls_entropy_add_source( &entropyContext,
+                                               mbedtls_platform_entropy_poll,
+                                               NULL,
+                                               32,
+                                               MBEDTLS_ENTROPY_SOURCE_STRONG );
+
+    if( mbedtlsError != 0 )
+    {
+        LogError( ( "Failed to add entropy source: mbedTLSError= %s : %s.",
+                    mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                    mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+        returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
+    }
+
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        /* Seed the random number generator. */
+        mbedtlsError = mbedtls_ctr_drbg_seed( &ctrDrgbContext,
+                                              mbedtls_entropy_func,
+                                              &entropyContext,
+                                              NULL,
+                                              0 );
+
+        if( mbedtlsError != 0 )
+        {
+            LogError( ( "Failed to seed PRNG: mbedTLSError= %s : %s.",
+                        mbedtlsHighLevelCodeOrDefault( mbedtlsError ),
+                        mbedtlsLowLevelCodeOrDefault( mbedtlsError ) ) );
+            returnStatus = TLS_TRANSPORT_INTERNAL_ERROR;
+        }
+    }
+
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        LogDebug( ( "Successfully initialized mbedTLS." ) );
+    }
+
+    return returnStatus;
+}
+
+/*-----------------------------------------------------------*/
+
+TlsTransportStatus_t TLS_FreeRTOS_Connect( NetworkContext_t * pNetworkContext,
+                                           const char * pHostName,
+                                           uint16_t port,
+                                           const NetworkCredentials_t * pNetworkCredentials,
+                                           uint32_t receiveTimeoutMs,
+                                           uint32_t sendTimeoutMs )
+{
+    TlsTransportStatus_t returnStatus = TLS_TRANSPORT_SUCCESS;
+    BaseType_t socketStatus = 0;
+
+    if( ( pNetworkContext == NULL ) ||
+        ( pHostName == NULL ) ||
+        ( pNetworkCredentials == NULL ) )
+    {
+        LogError( ( "Invalid input parameter(s): Arguments cannot be NULL. pNetworkContext=%p, "
+                    "pHostName=%p, pNetworkCredentials=%p.",
+                    pNetworkContext,
+                    pHostName,
+                    pNetworkCredentials ) );
+        returnStatus = TLS_TRANSPORT_INVALID_PARAMETER;
+    }
+    else if( ( pNetworkCredentials->pRootCa == NULL ) )
+    {
+        LogError( ( "pRootCa cannot be NULL." ) );
+        returnStatus = TLS_TRANSPORT_INVALID_PARAMETER;
+    }
+
+    /* Establish a TCP connection with the server. */
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        socketStatus = Sockets_Connect( &( pNetworkContext->tcpSocket ),
+                                        pHostName,
+                                        port,
+                                        receiveTimeoutMs,
+                                        sendTimeoutMs );
+
+        if( socketStatus != 0 )
+        {
+            LogError( ( "Failed to connect to %s with error %d.",
+                        pHostName,
+                        socketStatus ) );
+            returnStatus = TLS_TRANSPORT_CONNECT_FAILURE;
+        }
+    }
+
+    /* Initialize mbedtls. */
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        returnStatus = initMbedtls();
+    }
+
+    /* Perform TLS handshake. */
+    if( returnStatus == TLS_TRANSPORT_SUCCESS )
+    {
+        returnStatus = tlsSetup( pNetworkContext, pHostName, pNetworkCredentials );
+    }
+
+    /* Clean up on failure. */
+    if( returnStatus != TLS_TRANSPORT_SUCCESS )
+    {
+        if( pNetworkContext->tcpSocket != FREERTOS_INVALID_SOCKET )
+        {
+            FreeRTOS_closesocket( pNetworkContext->tcpSocket );
+        }
+    }
+    else
+    {
+        LogInfo( ( "(Network connection %p) Connection to %s established.",
+                   pNetworkContext,
+                   pHostName ) );
+    }
+
+    return returnStatus;
+}
+
+/*-----------------------------------------------------------*/
+
+void TLS_FreeRTOS_Disconnect( NetworkContext_t * pNetworkContext )
+{
+    BaseType_t tlsStatus = 0;
+
+    /* Attempting to terminate TLS connection. */
+    tlsStatus = ( BaseType_t ) mbedtls_ssl_close_notify( &( pNetworkContext->sslContext.context ) );
+
+    /* Ignore the WANT_READ and WANT_WRITE return values. */
+    if( ( tlsStatus != ( BaseType_t ) MBEDTLS_ERR_SSL_WANT_READ ) &&
+        ( tlsStatus != ( BaseType_t ) MBEDTLS_ERR_SSL_WANT_WRITE ) )
+    {
+        if( tlsStatus == 0 )
+        {
+            LogInfo( ( "(Network connection %p) TLS close-notify sent.",
+                       pNetworkContext ) );
+        }
+        else
+        {
+            LogError( ( "(Network connection %p) Failed to send TLS close-notify: mbedTLSError= %s : %s.",
+                        pNetworkContext,
+                        mbedtlsHighLevelCodeOrDefault( tlsStatus ),
+                        mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
+        }
+    }
+    else
+    {
+        /* WANT_READ and WANT_WRITE can be ignored. Logging for debugging purposes. */
+        LogInfo( ( "(Network connection %p) TLS close-notify sent; ",
+                   "received %s as the TLS status can be ignored for close-notify."
+                   ( tlsStatus == MBEDTLS_ERR_SSL_WANT_READ ) ? "WANT_READ" : "WANT_WRITE",
+                   pNetworkContext ) );
+    }
+
+    /* Call socket shutdown function to close connection. */
+    Sockets_Disconnect( pNetworkContext->tcpSocket );
+
+    /* Free mbed TLS contexts. */
+    sslContextFree( &( pNetworkContext->sslContext ) );
+
+    /* Free the contexts for random number generation. */
+    mbedtls_ctr_drbg_free( &ctrDrgbContext );
+    mbedtls_entropy_free( &entropyContext );
+
+    /* Clear the mutex functions for mbed TLS thread safety. */
+    mbedtls_threading_free_alt();
+}
+
+/*-----------------------------------------------------------*/
+
+int32_t TLS_FreeRTOS_recv( NetworkContext_t * pNetworkContext,
+                           void * pBuffer,
+                           size_t bytesToRecv )
+{
+    int32_t tlsStatus = 0;
+
+    tlsStatus = ( int32_t ) mbedtls_ssl_read( &( pNetworkContext->sslContext.context ),
+                                              pBuffer,
+                                              bytesToRecv );
+
+    if( ( tlsStatus == MBEDTLS_ERR_SSL_TIMEOUT ) ||
+        ( tlsStatus == MBEDTLS_ERR_SSL_WANT_READ ) ||
+        ( tlsStatus == MBEDTLS_ERR_SSL_WANT_WRITE ) )
+    {
+        LogDebug( ( "Failed to read data. However, a read can be retried on this error. "
+                    "mbedTLSError= %s : %s.",
+                    mbedtlsHighLevelCodeOrDefault( tlsStatus ),
+                    mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
+
+        /* Mark these set of errors as a timeout. The libraries may retry read
+         * on these errors. */
+        tlsStatus = 0;
+    }
+    else if( tlsStatus < 0 )
+    {
+        LogError( ( "Failed to read data: mbedTLSError= %s : %s.",
+                    mbedtlsHighLevelCodeOrDefault( tlsStatus ),
+                    mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
+    }
+    else
+    {
+        /* Empty else marker. */
+    }
+
+    return tlsStatus;
+}
+
+/*-----------------------------------------------------------*/
+
+int32_t TLS_FreeRTOS_send( NetworkContext_t * pNetworkContext,
+                           const void * pBuffer,
+                           size_t bytesToSend )
+{
+    int32_t tlsStatus = 0;
+
+    tlsStatus = ( int32_t ) mbedtls_ssl_write( &( pNetworkContext->sslContext.context ),
+                                               pBuffer,
+                                               bytesToSend );
+
+    if( ( tlsStatus == MBEDTLS_ERR_SSL_TIMEOUT ) ||
+        ( tlsStatus == MBEDTLS_ERR_SSL_WANT_READ ) ||
+        ( tlsStatus == MBEDTLS_ERR_SSL_WANT_WRITE ) )
+    {
+        LogDebug( ( "Failed to send data. However, send can be retried on this error. "
+                    "mbedTLSError= %s : %s.",
+                    mbedtlsHighLevelCodeOrDefault( tlsStatus ),
+                    mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
+
+        /* Mark these set of errors as a timeout. The libraries may retry send
+         * on these errors. */
+        tlsStatus = 0;
+    }
+    else if( tlsStatus < 0 )
+    {
+        LogError( ( "Failed to send data:  mbedTLSError= %s : %s.",
+                    mbedtlsHighLevelCodeOrDefault( tlsStatus ),
+                    mbedtlsLowLevelCodeOrDefault( tlsStatus ) ) );
+    }
+    else
+    {
+        /* Empty else marker. */
+    }
+
+    return tlsStatus;
+}
+/*-----------------------------------------------------------*/