Commit graph

18 commits

Author SHA1 Message Date
Jerome Forissier
12cc6531a1 net: lwip: add support for built-in root certificates
Introduce Kconfig symbols WGET_BUILTIN_CACERT and
WGET_BUILTIN_CACERT_PATH to provide root certificates at build time.

Usage example:

 wget -O cacert.crt https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt
 make qemu_arm64_lwip_defconfig
 echo CONFIG_WGET_BUILTIN_CACERT=y >>.config
 echo CONFIG_WGET_BUILTIN_CACERT_PATH=cacert.crt >>.config
 make olddefconfig
 make -j$(nproc) CROSS_COMPILE="ccache aarch64-linux-gnu-"
 qemu-system-aarch64 -M virt -nographic -cpu max \
    -object rng-random,id=rng0,filename=/dev/urandom \
    -device virtio-rng-pci,rng=rng0 -bios u-boot.bin
 => dhcp
 # HTTPS transfer using the builtin CA certificates
 => wget https://digicert-tls-ecc-p384-root-g5.chain-demos.digicert.com/
 1867 bytes transferred in 1 ms (1.8 MiB/s)
 Bytes transferred = 1867 (74b hex)

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2025-03-11 14:16:03 +01:00
Jerome Forissier
2df965d385 net: lwip: extend wget to support CA (root) certificates
Add the "cacert" (Certification Authority certificates) subcommand to
wget to pass root certificates to the code handling the HTTPS protocol.
The subcommand is enabled by the WGET_CACERT Kconfig symbol.

Usage example:

 => dhcp
 # Download some root certificates (note: not authenticated!)
 => wget https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt
 # Provide root certificates
 => wget cacert $fileaddr $filesize
 # Enforce verification (it is optional by default)
 => wget cacert required
 # Forget the root certificates
 => wget cacert 0 0
 # Disable verification
 => wget cacert none

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2025-03-11 14:16:03 +01:00
Jerome Forissier
a091d173e3 net: Kconfig: depend on DM_RNG for WGET_HTTPS
net/lwip/wget.c/mbedtls_hardware_poll() is calling dm_rng_read() but
dependency is not recorded anywhere that's why depend on DM_RNG
when WGET_HTTPS is used.

Suggested-by: Michal Simek <michal.simek@amd.com>
Co-developed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Michal Simek <michal.simek@amd.com>
2025-02-12 12:37:24 -06:00
Jerome Forissier
9f6b9f57fe net: lwip: move eth_init() out of new_netif()
Move the initialization of the ethernet devices out of the new_netif()
function. Indeed, new_netif() accepts a struct device argument, which
is expected to be valid and active. The activation and selection of
this device are achieved by eth_init() (on first time the network
stack is used) and eth_set_current(). This is what takes care of the
ethrotate and ethact environment variables. Therefore, move these calls
to a new function: net_lwip_set_current(), and use it whenever a
net-lwip command is run.

This patch hopefully fixes the incorrect net-lwip behavior observed on
boards with multiple ethernet interfaces [1].

Tested on an i.MX8MPlus EVK equipped wih two ethernet ports. The dhcp
command succeeds whether the cable is plugged into the first or second
port.

[1] https://lists.denx.de/pipermail/u-boot/2025-January/576326.html

Reported-by: E Shattow <e@freeshell.de>
Tested-by: E Shattow <e@freeshell.de>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-02-12 12:36:57 -06:00
Tom Rini
9bc62c980d Prepare v2025.01-rc4
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmdXaqUACgkQFHw5/5Y0
 tyzwDQv/W1C47W86RQKdu6LmlaJEQU/LV1wS6AvhxHtWvrWwg85/yIuiIErRbMyk
 +4Nof/grgie2j8lVGMEkABDdLdRwW4J70/TZn/w3NLBVKCU8dYAfCfWPo6mJeJkr
 tYupNkxDCMGA4EUkSNc/wdjH2yubMD2+wEaBf2Hz2Yp0B8BKGJg9Vf09YWQQHof0
 rByq4ThZ41W9njwk03UdcacN3HzVml7iJfoEg8RmqHThomQKD2WMNeCthzQUgRI2
 /sk8jNNyUli+/wzNlFqjYUKPB+V2DWxjVDNnrxvcb2i+Whgrb7+3rPtP7zhR3WVc
 oaHmW8CVe5/fhykrDHKG+IeLc59C1YOF3O9jG5LpjEoWDvTnt9Tnr+Rg4TYcAUdI
 4RhA16RSHmKs5MVnxF9xD9iIZ8x9WSq2cqkTHUAVbes2gyS4ITvXmoP674Khao8C
 qmtEJpz51Ye7g2OmfKB2Nr4C7fOWNkgq0teLjxZ7rdwuPyMRtsurY7j5Sw96AxWY
 HkWm6svP
 =5zS1
 -----END PGP SIGNATURE-----

Merge tag 'v2025.01-rc4' into next

Prepare v2025.01-rc4
2024-12-09 16:29:47 -06:00
Adriano Cordova
e55a4acb54 efi_loader: net: set EFI bootdevice device path to HTTP when loaded from wget
Set the device path of the efi boot device to an HTTP device path
(as formed by efi_dp_from_http) when the next boot stage is loaded
using wget (i.e., when wget is used with wget_info.set_bootdev=1).

When loaded from HTTP, the device path should account for it so that
the next boot stage is aware (e.g. grub only loads its http stack if
it itself was loaded from http, and it checks this from its device path).

Signed-off-by: Adriano Cordova <adrianox@gmail.com>
Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2024-12-04 12:24:37 +01:00
Adriano Cordova
9bab7d2a7c net: wget: let wget_with_dns work with dns disabled
This was marked as TODO in the code:
 - Enable use of wget_with_dns even if CMD_DNS is disabled if
   the given uri has the ip address for the http server.
 - Move the check for CMD_DNS inside wget_with_dns.
 - Rename wget_with_dns to wget_do_request

Signed-off-by: Adriano Cordova <adrianox@gmail.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2024-12-04 12:24:37 +01:00
Adriano Cordova
dc7c8a2532 net-lwip: zero terminate string with headers in wget_lwip_fill_info()
This patch comes as a companion to the same patch but for the legacy
    net stack. Commit 1327c2a8d6 ("net/lwip: wget: integrate struct wget_info
    into wget code") introduced function wget_fill_info() which retrieves
    the headers from the HTTP server response. As we want to parse the
    string in later patches we need to ensure that it is NUL terminated.

    We must further check that wget_info->headers in not NULL.
    Otherwise a crash occurs.

Signed-off-by: Adriano Cordova <adrianox@gmail.com>
2024-12-04 12:24:37 +01:00
Adriano Cordova
ab49ede318 lwip: wget: pass port and server_name via wget_ctx
Commit 5907c81 ("net: lwip: Enable https:// support for wget") was not
  correctly rebased on top of the changes introduced by Commit 6cc4d04
  ("net/lwip: wget: put server_name and port into wget_ctx") in next.
  This commit re-applies a  couple of lines from 6cc4d04.

  Fixes: Commit 5907c81 ("net: lwip: Enable https:// support for wget")

Signed-off-by: Adriano Cordova <adrianox@gmail.com>
2024-12-04 12:24:37 +01:00
Jerome Forissier
a37064cb2e net: lwip: wget: fix legacy syntax
Commit 356011f7ac ("lwip: fix code style issues") has inadvertently
broken the support for the legacy syntax:

 => wget 192.168.0.16:test.bin
 invalid uri, no file path
 Invalid URL. Use http(s)://

The reason is two calls to strncpy() were replaced by strlcpy() without
paying attention to the fact that they are not equivalent in the present
case. Since we are using a character counter (n) and since we do not
depend on having a properly null-terminated string at each step in the
parsing, strlcpy() is not justified and strncpy() is the right tool for
the job. So use it again.

Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2024-11-30 11:52:47 -06:00
Tom Rini
48380f9b2a Prepare v2025.01-rc3
-----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmdFAVQACgkQFHw5/5Y0
 tyyyfQwAuHAoOJ2Q5KnesduF9tkzeSRoziCNig3D+VItbJSxKqnBxPB9U+AxxsZ8
 JVA1e5qSwcblqybyWHrFUVTYVlI4j9oJIOTQKtEmUnDUNY+vd5eT9+V8kmQqnbU0
 mhE8fuH6wSHQ3K+tdVSJuWxcZJfFOE5dZKAxz0z/LysqNfJ/r/iqg2l0YYozId2s
 Kyyq7K25jNilcWAw4zUbGcdvM+H53KNzQ3WcZ36HwenlXWoQJOKCbEEskYxAaa0e
 hSEAQCNeuD1oVoZH1jc9dP6htLx5gmOaSbIScwfaOMqBQHyWQTjv/sMEy8wGSMdA
 PqDGClxU0GCenhbS6waY9GPMLYV0JtyXsAmjrWUOXStLrGMBCrP6Xu6T2Ol7+7pt
 O+ZPZM5Xhmo0UR2sY4sWjDIC1AHVXaLZlbC7vfjadkZ30UZvwIXgDFJemS3nDW96
 /JJo/6sgdLGJGvNYGb4mitKO5+kIiz6kKeMvzcfBj+PWybfYhUbqc/AARtlf9Hzp
 +gvtFlCF
 =Q9hw
 -----END PGP SIGNATURE-----

Merge tag 'v2025.01-rc3' into next

Prepare v2025.01-rc3
2024-11-25 17:34:08 -06:00
Ilias Apalodimas
2cde2f4a00 net: lwip: provide entropy to MBed TLS in one go
We currently provide entropy to mbedTLS using 8b chunks.
Take into account the 'len' parameter passed by MBed TLS to the entropy
gathering function instead. Note that the current code works because len
is always 128 (defined at compile time), therefore mbedtls_hardware_poll()
is called repeatedly and the buffer is filled correctly. But passing 'len'
to dm_rng_read() is both better and simpler.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Suggested-by: Simon Glass <sjg@chromium.org>
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
2024-11-22 14:40:53 -06:00
Heinrich Schuchardt
2071583c8f net: lwip/wget: correct SERVER_NAME_SIZE
The maximum length of a domain name is 253 as defined in RFC 1035.
So SERVER_NAME_SIZE should be 254 including NUL.

Fixes: 3c656c928b ("net: lwip: add wget command")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2024-11-18 13:32:12 -06:00
Adriano Cordova
1327c2a8d6 net/lwip: wget: integrate struct wget_info into wget code
Each wget request now fills the struct wget_info. Also, the
efi bootdevice is now set conditionally to the set_bootdevice
variable in wget_info and a buffer size check is performed if
check_buffer_size is set.

Signed-off-by: Adriano Cordova <adrianox@gmail.com>
2024-11-16 21:35:06 +01:00
Adriano Cordova
6cc4d0492b net/lwip: wget: put server_name and port into wget_ctx
Currently server_name and port are local variables in wget_loop.
This commit puts them inside ctx, so that they are accessible
from the http callbacks.

Signed-off-by: Adriano Cordova <adrianox@gmail.com>
2024-11-16 21:35:05 +01:00
Jerome Forissier
356011f7ac lwip: fix code style issues
Fix various code style issues in the lwIP code.

Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2024-11-14 18:14:05 -06:00
Ilias Apalodimas
5907c81647 net: lwip: Enable https:// support for wget
With the recent changes of lwip & mbedTLS we can now download from
https:// urls instead of just http://.
Adjust our wget lwip version parsing to support both URLs.
While at it adjust the default TCP window for QEMU since https seems to
require at least 16384

Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Reviewed-by: Simon Glass <sjg@chromium.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2024-11-12 19:09:52 -06:00
Jerome Forissier
3c656c928b net: lwip: add wget command
Add support for the wget command with NET_LWIP. The command normally
expects a URL: wget [loadaddr] url, but it also accepts the legacy
syntax: wget [loadaddr] [server:]file.
The server IP may alternatively be supplied via ${httpserverip} which
has higher priority than ${serverip}.

Based on code initially developed by Maxim U.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Co-developed-by: Maxim Uvarov <muvarov@gmail.com>
Cc: Maxim Uvarov <muvarov@gmail.com>
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2024-10-16 11:11:56 -06:00