net: lwip: add support for built-in root certificates
Introduce Kconfig symbols WGET_BUILTIN_CACERT and
WGET_BUILTIN_CACERT_PATH to provide root certificates at build time.
Usage example:
wget -O cacert.crt https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt
make qemu_arm64_lwip_defconfig
echo CONFIG_WGET_BUILTIN_CACERT=y >>.config
echo CONFIG_WGET_BUILTIN_CACERT_PATH=cacert.crt >>.config
make olddefconfig
make -j$(nproc) CROSS_COMPILE="ccache aarch64-linux-gnu-"
qemu-system-aarch64 -M virt -nographic -cpu max \
-object rng-random,id=rng0,filename=/dev/urandom \
-device virtio-rng-pci,rng=rng0 -bios u-boot.bin
=> dhcp
# HTTPS transfer using the builtin CA certificates
=> wget https://digicert-tls-ecc-p384-root-g5.chain-demos.digicert.com/
1867 bytes transferred in 1 ms (1.8 MiB/s)
Bytes transferred = 1867 (74b hex)
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
diff --git a/net/lwip/wget.c b/net/lwip/wget.c
index c22843e..ec09814 100644
--- a/net/lwip/wget.c
+++ b/net/lwip/wget.c
@@ -304,28 +304,34 @@
return CMD_RET_SUCCESS;
}
+#endif
-static int set_cacert(char * const saddr, char * const ssz)
+#if CONFIG_IS_ENABLED(WGET_BUILTIN_CACERT)
+extern const char builtin_cacert[];
+extern const size_t builtin_cacert_size;
+static bool cacert_initialized;
+#endif
+
+#if CONFIG_IS_ENABLED(WGET_CACERT) || CONFIG_IS_ENABLED(WGET_BUILTIN_CACERT)
+static int _set_cacert(const void *addr, size_t sz)
{
mbedtls_x509_crt crt;
- ulong addr, sz;
+ void *p;
int ret;
if (cacert)
free(cacert);
- addr = hextoul(saddr, NULL);
- sz = hextoul(ssz, NULL);
-
if (!addr) {
cacert = NULL;
cacert_size = 0;
return CMD_RET_SUCCESS;
}
- cacert = malloc(sz);
- if (!cacert)
+ p = malloc(sz);
+ if (!p)
return CMD_RET_FAILURE;
+ cacert = p;
cacert_size = sz;
memcpy(cacert, (void *)addr, sz);
@@ -340,9 +346,31 @@
return CMD_RET_FAILURE;
}
+#if CONFIG_IS_ENABLED(WGET_BUILTIN_CACERT)
+ cacert_initialized = true;
+#endif
return CMD_RET_SUCCESS;
}
+
+#if CONFIG_IS_ENABLED(WGET_BUILTIN_CACERT)
+static int set_cacert_builtin(void)
+{
+ return _set_cacert(builtin_cacert, builtin_cacert_size);
+}
+#endif
+
+#if CONFIG_IS_ENABLED(WGET_CACERT)
+static int set_cacert(char * const saddr, char * const ssz)
+{
+ ulong addr, sz;
+
+ addr = hextoul(saddr, NULL);
+ sz = hextoul(ssz, NULL);
+
+ return _set_cacert((void *)addr, sz);
+}
#endif
+#endif /* CONFIG_WGET_CACERT || CONFIG_WGET_BUILTIN_CACERT */
static int wget_loop(struct udevice *udev, ulong dst_addr, char *uri)
{
@@ -373,8 +401,15 @@
memset(&conn, 0, sizeof(conn));
#if CONFIG_IS_ENABLED(WGET_HTTPS)
if (is_https) {
- char *ca = cacert;
- size_t ca_sz = cacert_size;
+ char *ca;
+ size_t ca_sz;
+
+#if CONFIG_IS_ENABLED(WGET_BUILTIN_CACERT)
+ if (!cacert_initialized)
+ set_cacert_builtin();
+#endif
+ ca = cacert;
+ ca_sz = cacert_size;
if (cacert_auth_mode == AUTH_REQUIRED) {
if (!ca || !ca_sz) {
@@ -455,6 +490,10 @@
if (argc == 4 && !strncmp(argv[1], "cacert", strlen("cacert")))
return set_cacert(argv[2], argv[3]);
if (argc == 3 && !strncmp(argv[1], "cacert", strlen("cacert"))) {
+#if CONFIG_IS_ENABLED(WGET_BUILTIN_CACERT)
+ if (!strncmp(argv[2], "builtin", strlen("builtin")))
+ return set_cacert_builtin();
+#endif
if (!strncmp(argv[2], "none", strlen("none")))
return set_auth(AUTH_NONE);
if (!strncmp(argv[2], "optional", strlen("optional")))