Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-04-19 11:24:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

net: lwip: Update lwIP for mbedTLS > 3.0 support and enable https

Browse source 
The current code support mbedTLS 2.28. Since we are using a newer
version in U-Boot, update the necessary accessors and the lwIP codebase
to work with mbedTLS 3.6.0. It's worth noting that the patches are
already sent to lwIP [0]

While at it enable LWIP_ALTCP_TLS and enable TLS support in lwIP

[0] https://github.com/lwip-tcpip/lwip/pull/47

Signed-off-by: Javier Tia <javier.tia@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
This commit is contained in:
Javier Tia 2024-11-10 10:28:38 +02:00 • committed by Tom Rini
parent a564f5094f
commit 514f18f8dc
4 changed files with 34 additions and 24 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/lwip/Makefile
View file

@ -53,3 +53,6 @@ obj-y += \
lwip/src/core/timeouts.o \ lwip/src/core/timeouts.o \
lwip/src/core/udp.o \ lwip/src/core/udp.o \
lwip/src/netif/ethernet.o lwip/src/netif/ethernet.o
obj-$(CONFIG_MBEDTLS_LIB_TLS) += lwip/src/apps/altcp_tls/altcp_tls_mbedtls.o \
lwip/src/apps/altcp_tls/altcp_tls_mbedtls_mem.o

37
lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c
View file

@ -70,7 +70,6 @@
/* @todo: which includes are really needed? */ /* @todo: which includes are really needed? */
#include "mbedtls/entropy.h" #include "mbedtls/entropy.h"
#include "mbedtls/ctr_drbg.h" #include "mbedtls/ctr_drbg.h"
#include "mbedtls/certs.h"
#include "mbedtls/x509.h" #include "mbedtls/x509.h"
#include "mbedtls/ssl.h" #include "mbedtls/ssl.h"
#include "mbedtls/net_sockets.h" #include "mbedtls/net_sockets.h"
@ -81,8 +80,6 @@
#include "mbedtls/ssl_cache.h" #include "mbedtls/ssl_cache.h"
#include "mbedtls/ssl_ticket.h" #include "mbedtls/ssl_ticket.h"
#include "mbedtls/ssl_internal.h" /* to call mbedtls_flush_output after ERR_MEM */
#include <string.h> #include <string.h>
#ifndef ALTCP_MBEDTLS_ENTROPY_PTR #ifndef ALTCP_MBEDTLS_ENTROPY_PTR
@ -132,6 +129,16 @@ static err_t altcp_mbedtls_lower_recv_process(struct altcp_pcb *conn, altcp_mbed
static err_t altcp_mbedtls_handle_rx_appldata(struct altcp_pcb *conn, altcp_mbedtls_state_t *state); static err_t altcp_mbedtls_handle_rx_appldata(struct altcp_pcb *conn, altcp_mbedtls_state_t *state);
static int altcp_mbedtls_bio_send(void *ctx, const unsigned char *dataptr, size_t size); static int altcp_mbedtls_bio_send(void *ctx, const unsigned char *dataptr, size_t size);
static void
altcp_mbedtls_flush_output(altcp_mbedtls_state_t *state)
{
if (state->ssl_context.MBEDTLS_PRIVATE(out_left) != 0) {
int flushed = mbedtls_ssl_send_alert_message(&state->ssl_context, 0, 0);
if (flushed) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_ssl_send_alert_message failed: %d\n", flushed));
}
}
}
/* callback functions from inner/lower connection: */ /* callback functions from inner/lower connection: */
@ -524,14 +531,14 @@ altcp_mbedtls_lower_sent(void *arg, struct altcp_pcb *inner_conn, u16_t len)
LWIP_ASSERT("state", state != NULL); LWIP_ASSERT("state", state != NULL);
LWIP_ASSERT("pcb mismatch", conn->inner_conn == inner_conn); LWIP_ASSERT("pcb mismatch", conn->inner_conn == inner_conn);
/* calculate TLS overhead part to not send it to application */ /* calculate TLS overhead part to not send it to application */
overhead = state->overhead_bytes_adjust + state->ssl_context.out_left; overhead = state->overhead_bytes_adjust + state->ssl_context.MBEDTLS_PRIVATE(out_left);
if ((unsigned)overhead > len) { if ((unsigned)overhead > len) {
overhead = len; overhead = len;
} }
/* remove ACKed bytes from overhead adjust counter */ /* remove ACKed bytes from overhead adjust counter */
state->overhead_bytes_adjust -= len; state->overhead_bytes_adjust -= len;
/* try to send more if we failed before (may increase overhead adjust counter) */ /* try to send more if we failed before (may increase overhead adjust counter) */
mbedtls_ssl_flush_output(&state->ssl_context); altcp_mbedtls_flush_output(state);
/* remove calculated overhead from ACKed bytes len */ /* remove calculated overhead from ACKed bytes len */
app_len = len - (u16_t)overhead; app_len = len - (u16_t)overhead;
/* update application write counter and inform application */ /* update application write counter and inform application */
@ -559,7 +566,7 @@ altcp_mbedtls_lower_poll(void *arg, struct altcp_pcb *inner_conn)
if (conn->state) { if (conn->state) {
altcp_mbedtls_state_t *state = (altcp_mbedtls_state_t *)conn->state; altcp_mbedtls_state_t *state = (altcp_mbedtls_state_t *)conn->state;
/* try to send more if we failed before */ /* try to send more if we failed before */
mbedtls_ssl_flush_output(&state->ssl_context); altcp_mbedtls_flush_output(state);
if (altcp_mbedtls_handle_rx_appldata(conn, state) == ERR_ABRT) { if (altcp_mbedtls_handle_rx_appldata(conn, state) == ERR_ABRT) {
return ERR_ABRT; return ERR_ABRT;
} }
@ -683,7 +690,7 @@ altcp_tls_set_session(struct altcp_pcb *conn, struct altcp_tls_session *session)
if (session && conn && conn->state) { if (session && conn && conn->state) {
altcp_mbedtls_state_t *state = (altcp_mbedtls_state_t *)conn->state; altcp_mbedtls_state_t *state = (altcp_mbedtls_state_t *)conn->state;
int ret = -1; int ret = -1;
if (session->data.start) if (session->data.MBEDTLS_PRIVATE(start))
ret = mbedtls_ssl_set_session(&state->ssl_context, &session->data); ret = mbedtls_ssl_set_session(&state->ssl_context, &session->data);
return ret < 0 ? ERR_VAL : ERR_OK; return ret < 0 ? ERR_VAL : ERR_OK;
} }
@ -776,7 +783,7 @@ altcp_tls_create_config(int is_server, u8_t cert_count, u8_t pkey_count, int hav
struct altcp_tls_config *conf; struct altcp_tls_config *conf;
mbedtls_x509_crt *mem; mbedtls_x509_crt *mem;
if (TCP_WND < MBEDTLS_SSL_MAX_CONTENT_LEN) { if (TCP_WND < MBEDTLS_SSL_IN_CONTENT_LEN || TCP_WND < MBEDTLS_SSL_OUT_CONTENT_LEN) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG|LWIP_DBG_LEVEL_SERIOUS, LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG|LWIP_DBG_LEVEL_SERIOUS,
("altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!\n")); ("altcp_tls: TCP_WND is smaller than the RX decrypion buffer, connection RX might stall!\n"));
} }
@ -900,7 +907,7 @@ err_t altcp_tls_config_server_add_privkey_cert(struct altcp_tls_config *config,
return ERR_VAL; return ERR_VAL;
} }
ret = mbedtls_pk_parse_key(pkey, (const unsigned char *) privkey, privkey_len, privkey_pass, privkey_pass_len); ret = mbedtls_pk_parse_key(pkey, (const unsigned char *) privkey, privkey_len, privkey_pass, privkey_pass_len, mbedtls_ctr_drbg_random, &altcp_tls_entropy_rng->ctr_drbg);
if (ret != 0) { if (ret != 0) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_pk_parse_public_key failed: %d\n", ret)); LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_pk_parse_public_key failed: %d\n", ret));
mbedtls_x509_crt_free(srvcert); mbedtls_x509_crt_free(srvcert);
@ -1003,7 +1010,7 @@ altcp_tls_create_config_client_2wayauth(const u8_t *ca, size_t ca_len, const u8_
} }
mbedtls_pk_init(conf->pkey); mbedtls_pk_init(conf->pkey);
ret = mbedtls_pk_parse_key(conf->pkey, privkey, privkey_len, privkey_pass, privkey_pass_len); ret = mbedtls_pk_parse_key(conf->pkey, privkey, privkey_len, privkey_pass, privkey_pass_len, mbedtls_ctr_drbg_random, &altcp_tls_entropy_rng->ctr_drbg);
if (ret != 0) { if (ret != 0) {
LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_pk_parse_key failed: %d 0x%x\n", ret, -1*ret)); LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG, ("mbedtls_pk_parse_key failed: %d 0x%x\n", ret, -1*ret));
altcp_tls_free_config(conf); altcp_tls_free_config(conf);
@ -1189,7 +1196,7 @@ altcp_mbedtls_sndbuf(struct altcp_pcb *conn)
size_t ret; size_t ret;
#if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH) #if defined(MBEDTLS_SSL_MAX_FRAGMENT_LENGTH)
/* @todo: adjust ssl_added to real value related to negotiated cipher */ /* @todo: adjust ssl_added to real value related to negotiated cipher */
size_t max_frag_len = mbedtls_ssl_get_max_frag_len(&state->ssl_context); size_t max_frag_len = mbedtls_ssl_get_max_in_record_payload(&state->ssl_context);
max_len = LWIP_MIN(max_frag_len, max_len); max_len = LWIP_MIN(max_frag_len, max_len);
#endif #endif
/* Adjust sndbuf of inner_conn with what added by SSL */ /* Adjust sndbuf of inner_conn with what added by SSL */
@ -1232,9 +1239,9 @@ altcp_mbedtls_write(struct altcp_pcb *conn, const void *dataptr, u16_t len, u8_t
/* HACK: if there is something left to send, try to flush it and only /* HACK: if there is something left to send, try to flush it and only
allow sending more if this succeeded (this is a hack because neither allow sending more if this succeeded (this is a hack because neither
returning 0 nor MBEDTLS_ERR_SSL_WANT_WRITE worked for me) */ returning 0 nor MBEDTLS_ERR_SSL_WANT_WRITE worked for me) */
if (state->ssl_context.out_left) { if (state->ssl_context.MBEDTLS_PRIVATE(out_left)) {
mbedtls_ssl_flush_output(&state->ssl_context); altcp_mbedtls_flush_output(state);
if (state->ssl_context.out_left) { if (state->ssl_context.MBEDTLS_PRIVATE(out_left)) {
return ERR_MEM; return ERR_MEM;
} }
} }
@ -1284,6 +1291,8 @@ altcp_mbedtls_bio_send(void *ctx, const unsigned char *dataptr, size_t size)
while (size_left) { while (size_left) {
u16_t write_len = (u16_t)LWIP_MIN(size_left, 0xFFFF); u16_t write_len = (u16_t)LWIP_MIN(size_left, 0xFFFF);
err_t err = altcp_write(conn->inner_conn, (const void *)dataptr, write_len, apiflags); err_t err = altcp_write(conn->inner_conn, (const void *)dataptr, write_len, apiflags);
/* try to send data... */
altcp_output(conn->inner_conn);
if (err == ERR_OK) { if (err == ERR_OK) {
written += write_len; written += write_len;
size_left -= write_len; size_left -= write_len;

8
lib/lwip/lwip/src/core/tcp_out.c
View file

@ -1255,14 +1255,6 @@ tcp_output(struct tcp_pcb *pcb)
LWIP_ASSERT("don't call tcp_output for listen-pcbs", LWIP_ASSERT("don't call tcp_output for listen-pcbs",
pcb->state != LISTEN); pcb->state != LISTEN);
/* First, check if we are invoked by the TCP input processing
code. If so, we do not output anything. Instead, we rely on the
input processing code to call us when input processing is done
with. */
if (tcp_input_pcb == pcb) {
return ERR_OK;
}
wnd = LWIP_MIN(pcb->snd_wnd, pcb->cwnd); wnd = LWIP_MIN(pcb->snd_wnd, pcb->cwnd);
seg = pcb->unsent; seg = pcb->unsent;

6
lib/lwip/u-boot/lwipopts.h
View file

@ -154,4 +154,10 @@
#define MEMP_MEM_INIT 1 #define MEMP_MEM_INIT 1
#define MEM_LIBC_MALLOC 1 #define MEM_LIBC_MALLOC 1
#if defined(CONFIG_MBEDTLS_LIB_TLS)
#define LWIP_ALTCP 1
#define LWIP_ALTCP_TLS 1
#define LWIP_ALTCP_TLS_MBEDTLS 1
#endif
#endif /* LWIP_UBOOT_LWIPOPTS_H */ #endif /* LWIP_UBOOT_LWIPOPTS_H */