mbox series

[v2,0/6] net: lwip: root certificates

Message ID 20250305142650.2966738-1-jerome.forissier@linaro.org
Headers show
Series net: lwip: root certificates | expand

Message

Jerome Forissier March 5, 2025, 2:26 p.m. UTC 
This series adds support for HTTP server authentication using root (CA)
certificates.

As a first step, the wget command is extended to support a sub-command:
cacert <addr> <size>. The memory region shall contain the CA
certificates. With this, it is possible to load the certificates from
storage or get them from the network for example, which is convenient
for testing at least. The Kconfig symbol for this feature is
WGET_CACERT=y.

Then new Kconfig symbols are added to support providing the certificates
at build time as a DER encoded X509 collection: WGET_BUILTIN_CACERT=y
and WGET_BUILTIN_CACERT_PATH=<some path>.

An example of how to use this feature is given in patch "doc: cmd: wget:
document cacert subcommand".

Changes in v2:
- Drop PEM support. It is unnecessary since conversion from PEM to DER
is easy, and PEM takes more space in memory. Another reason is the ugly
hack requiring to allocate one more byte for the null terminator in
case the file is PEM (therefore, text).
- Add 'wget cacert none|optional|required'
- Replace '#if defined CONFIG_X' with '#if CONFIG_IS_ENABLED(X)' in
net/lwip/wget.c Do NOT replace '#if defined(CONFIG_X)' in net/net-lwip.c
for consistency with how other symbols are treated in that file.
- Make builtin_cacert const
- Make cacert_size static
- BUILTIN_CACERT selects BUILD_BIN2C
- Add documentation in doc/cmd/wget.rst
- Apply review tags

Jerome Forissier (6):
  net: lwip: extend wget to support CA (root) certificates
  lwip: tls: enforce checking of server certificates based on CA
    availability
  lwip: tls: warn when no CA exists amd log certificate validation
    errors
  net: lwip: add support for built-in root certificates
  doc: cmd: wget: document cacert subcommand
  configs: qemu_arm64_lwip_defconfig: enable WGET_CACERT

 cmd/Kconfig                                   |  22 +++
 cmd/net-lwip.c                                |  21 ++-
 configs/qemu_arm64_lwip_defconfig             |   1 +
 doc/usage/cmd/wget.rst                        |  82 +++++++++-
 .../src/apps/altcp_tls/altcp_tls_mbedtls.c    |   9 +-
 .../lwip/apps/altcp_tls_mbedtls_opts.h        |   6 -
 net/lwip/Makefile                             |   6 +
 net/lwip/wget.c                               | 141 +++++++++++++++++-
 8 files changed, 273 insertions(+), 15 deletions(-)