Skip to content

Commit 76fb4b9

Browse files
D-TriveniD-Triveni
committed
[nrf fromtree] wifi: shell: Add support for EAP-TLS method
Add support to read identity and private key password if configured in Enterprise mode. Signed-off-by: Triveni Danda <[email protected]> (cherry picked from commit 589333e)
1 parent aa1855c commit 76fb4b9

File tree

4 files changed

+161
-0
lines changed

4 files changed

+161
-0
lines changed

‎subsys/net/l2/wifi/wifi_mgmt.c‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1312,6 +1312,9 @@ static int __stored_creds_to_params(struct wifi_credentials_personal *creds,
13121312
{
13131313
char *ssid = NULL;
13141314
char *psk = NULL;
1315+
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
1316+
char *key_passwd = NULL;
1317+
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */
13151318
int ret;
13161319

13171320
/* SSID */
@@ -1357,6 +1360,29 @@ static int __stored_creds_to_params(struct wifi_credentials_personal *creds,
13571360
/* Defaults */
13581361
params->security = creds->header.type;
13591362

1363+
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
1364+
if (params->security == WIFI_SECURITY_TYPE_EAP_TLS) {
1365+
if (creds->header.key_passwd_length > 0) {
1366+
key_passwd = (char *)k_malloc(creds->header.key_passwd_length + 1);
1367+
if (!key_passwd) {
1368+
LOG_ERR("Failed to allocate memory for key_passwd\n");
1369+
ret = -ENOMEM;
1370+
goto err_out;
1371+
}
1372+
memset(key_passwd, 0, creds->header.key_passwd_length + 1);
1373+
ret = snprintf(key_passwd, creds->header.key_passwd_length + 1, "%s",
1374+
creds->header.key_passwd);
1375+
if (ret > creds->header.key_passwd_length) {
1376+
LOG_ERR("key_passwd string truncated\n");
1377+
ret = -EINVAL;
1378+
goto err_out;
1379+
}
1380+
params->key_passwd = key_passwd;
1381+
params->key_passwd_length = creds->header.key_passwd_length;
1382+
}
1383+
}
1384+
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */
1385+
13601386
/* If channel is set to 0 we default to ANY. 0 is not a valid Wi-Fi channel. */
13611387
params->channel = (creds->header.channel != 0) ? creds->header.channel : WIFI_CHANNEL_ANY;
13621388
params->timeout = (creds->header.timeout != 0)
@@ -1397,6 +1423,13 @@ static int __stored_creds_to_params(struct wifi_credentials_personal *creds,
13971423
psk = NULL;
13981424
}
13991425

1426+
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
1427+
if (key_passwd) {
1428+
k_free(key_passwd);
1429+
key_passwd = NULL;
1430+
}
1431+
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */
1432+
14001433
return ret;
14011434
}
14021435

‎subsys/net/lib/wifi_credentials/CMakeLists.txt‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,3 +34,43 @@ if(WIFI_CREDENTIALS_STATIC_SSID)
3434
"Static Wi-Fi configuration is used, please remove before deployment!"
3535
)
3636
endif()
37+
38+
if(DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE AND NOT DEFINED CONFIG_NET_L2_WIFI_SHELL)
39+
# Wi-Fi Enterprise test certificates handling
40+
set(gen_inc_dir ${ZEPHYR_BINARY_DIR}/misc/generated)
41+
set(gen_dir ${gen_inc_dir}/wifi_enterprise_test_certs)
42+
if(NOT DEFINED WIFI_TEST_CERTS_DIR)
43+
set(WIFI_TEST_CERTS_DIR ${ZEPHYR_BASE}/samples/net/wifi/test_certs/rsa3k)
44+
endif()
45+
# Create output directory for test certs
46+
file(MAKE_DIRECTORY ${gen_dir})
47+
48+
# convert .pem files to array data at build time
49+
zephyr_include_directories(${gen_inc_dir})
50+
51+
foreach(cert_file IN ITEMS
52+
${WIFI_TEST_CERTS_DIR}/client.pem
53+
${WIFI_TEST_CERTS_DIR}/client-key.pem
54+
${WIFI_TEST_CERTS_DIR}/ca.pem
55+
${WIFI_TEST_CERTS_DIR}/client2.pem
56+
${WIFI_TEST_CERTS_DIR}/client-key2.pem
57+
${WIFI_TEST_CERTS_DIR}/ca2.pem
58+
)
59+
60+
if(EXISTS ${cert_file})
61+
get_filename_component(cert_name ${cert_file} NAME)
62+
generate_inc_file_for_target(
63+
app
64+
${cert_file}
65+
${gen_dir}/${cert_name}.inc
66+
)
67+
else()
68+
get_filename_component(cert_name ${cert_file} NAME)
69+
file(WRITE ${gen_dir}/${cert_name}.inc "// Empty file generated because ${cert_file} does not exist\n")
70+
endif()
71+
endforeach()
72+
73+
# Add explicit dependency on app target for ZEPHYR_CURRENT_LIBRARY, so these
74+
# headers are generated at the correct point in the build
75+
add_dependencies(${ZEPHYR_CURRENT_LIBRARY} app)
76+
endif()

‎subsys/net/lib/wifi_credentials/wifi_credentials.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,7 @@ int wifi_credentials_get_by_ssid_personal_struct(const char *ssid, size_t ssid_l
136136
buf->header.type != WIFI_SECURITY_TYPE_PSK &&
137137
buf->header.type != WIFI_SECURITY_TYPE_PSK_SHA256 &&
138138
buf->header.type != WIFI_SECURITY_TYPE_SAE &&
139+
buf->header.type != WIFI_SECURITY_TYPE_EAP_TLS &&
139140
buf->header.type != WIFI_SECURITY_TYPE_WPA_PSK) {
140141
LOG_ERR("Requested WiFi credentials entry is corrupted");
141142
ret = -EPROTO;

‎subsys/net/lib/wifi_credentials/wifi_credentials_shell.c‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,63 @@
2525
#define MAX_BANDS_STR_LEN 64
2626
#define MACSTR "%02hhx:%02hhx:%02hhx:%02hhx:%02hhx:%02hhx"
2727

28+
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
29+
static const char ca_cert_test[] = {
30+
#include <wifi_enterprise_test_certs/ca.pem.inc>
31+
'\0'
32+
};
33+
34+
static const char client_cert_test[] = {
35+
#include <wifi_enterprise_test_certs/client.pem.inc>
36+
'\0'
37+
};
38+
39+
static const char client_key_test[] = {
40+
#include <wifi_enterprise_test_certs/client-key.pem.inc>
41+
'\0'
42+
};
43+
44+
static const char ca_cert2_test[] = {
45+
#include <wifi_enterprise_test_certs/ca2.pem.inc>
46+
'\0'};
47+
48+
static const char client_cert2_test[] = {
49+
#include <wifi_enterprise_test_certs/client2.pem.inc>
50+
'\0'};
51+
52+
static const char client_key2_test[] = {
53+
#include <wifi_enterprise_test_certs/client-key2.pem.inc>
54+
'\0'};
55+
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */
56+
57+
#if defined CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE || \
58+
defined CONFIG_WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE
59+
static int cmd_wifi_set_enterprise_creds(const struct shell *sh, struct net_if *iface)
60+
{
61+
struct wifi_enterprise_creds_params params = {0};
62+
63+
params.ca_cert = (uint8_t *)ca_cert_test;
64+
params.ca_cert_len = ARRAY_SIZE(ca_cert_test);
65+
params.client_cert = (uint8_t *)client_cert_test;
66+
params.client_cert_len = ARRAY_SIZE(client_cert_test);
67+
params.client_key = (uint8_t *)client_key_test;
68+
params.client_key_len = ARRAY_SIZE(client_key_test);
69+
params.ca_cert2 = (uint8_t *)ca_cert2_test;
70+
params.ca_cert2_len = ARRAY_SIZE(ca_cert2_test);
71+
params.client_cert2 = (uint8_t *)client_cert2_test;
72+
params.client_cert2_len = ARRAY_SIZE(client_cert2_test);
73+
params.client_key2 = (uint8_t *)client_key2_test;
74+
params.client_key2_len = ARRAY_SIZE(client_key2_test);
75+
76+
if (net_mgmt(NET_REQUEST_WIFI_ENTERPRISE_CREDS, iface, &params, sizeof(params))) {
77+
shell_warn(sh, "Set enterprise credentials failed\n");
78+
return -1;
79+
}
80+
81+
return 0;
82+
}
83+
#endif
84+
2885
static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
2986
{
3087
int ret = 0;
@@ -53,6 +110,23 @@ static void print_network_info(void *cb_arg, const char *ssid, size_t ssid_len)
53110
creds.password, creds.password_len);
54111
}
55112

113+
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
114+
if (creds.header.type == WIFI_SECURITY_TYPE_EAP_TLS) {
115+
if (creds.header.key_passwd_length > 0) {
116+
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
117+
", key_passwd: \"%.*s\", key_passwd_len: %d",
118+
creds.header.key_passwd_length, creds.header.key_passwd,
119+
creds.header.key_passwd_length);
120+
}
121+
if (creds.header.aid_length > 0) {
122+
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT,
123+
", anon_id: \"%.*s\", anon_id_len: %d",
124+
creds.header.aid_length, creds.header.anon_id,
125+
creds.header.aid_length);
126+
}
127+
}
128+
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */
129+
56130
if (creds.header.flags & WIFI_CREDENTIALS_FLAG_BSSID) {
57131
shell_fprintf(sh, SHELL_VT100_COLOR_DEFAULT, ", bssid: " MACSTR,
58132
creds.header.bssid[0], creds.header.bssid[1], creds.header.bssid[2],
@@ -266,6 +340,19 @@ static int cmd_add_network(const struct shell *sh, size_t argc, char *argv[])
266340
return -EINVAL;
267341
}
268342

343+
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
344+
struct net_if *iface = net_if_get_first_by_type(&NET_L2_GET_NAME(ETHERNET));
345+
346+
/* Load the enterprise credentials if needed */
347+
if (creds.header.type == WIFI_SECURITY_TYPE_EAP_TLS ||
348+
creds.header.type == WIFI_SECURITY_TYPE_EAP_PEAP_MSCHAPV2 ||
349+
creds.header.type == WIFI_SECURITY_TYPE_EAP_PEAP_GTC ||
350+
creds.header.type == WIFI_SECURITY_TYPE_EAP_TTLS_MSCHAPV2 ||
351+
creds.header.type == WIFI_SECURITY_TYPE_EAP_PEAP_TLS) {
352+
cmd_wifi_set_enterprise_creds(sh, iface);
353+
}
354+
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */
355+
269356
return wifi_credentials_set_personal_struct(&creds);
270357
}
271358

0 commit comments

Comments
 (0)