Skip to content

Commit ece1661

Browse files
krish2718krish2718
committed
Revert "[nrf fromlist] net: l2: wifi: Add support for run-time certificates"
This reverts commit d42adf0. Signed-off-by: Chaitanya Tata <[email protected]>
1 parent bbcac0d commit ece1661

File tree

3 files changed

+26
-284
lines changed

3 files changed

+26
-284
lines changed

‎doc/connectivity/networking/api/wifi.rst‎

Lines changed: 4 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -30,15 +30,11 @@ Wi-Fi PSA crypto supported build
3030

3131
To enable PSA crypto API supported Wi-Fi build, the :kconfig:option:`CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT` and the :kconfig:option:`CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA` need to be set.
3232

33-
Wi-Fi Enterprise test: X.509 Certificate management
34-
***************************************************
33+
Wi-Fi Enterprise test: X.509 Certificate header generation
34+
**********************************************************
3535

36-
Wi-Fi enterprise security requires use of X.509 certificates, two methods of installing certificates are supported:
37-
38-
Compile time certificates
39-
-------------------------
40-
41-
Test certificates in PEM format are committed to the repo at :zephyr_file:`samples/net/wifi/test_certs` and the during the
36+
Wi-Fi enterprise security requires use of X.509 certificates, test certificates
37+
in PEM format are committed to the repo at :zephyr_file:`samples/net/wifi/test_certs` and the during the
4238
build process the certificates are converted to a C header file that is included by the Wi-Fi shell
4339
module.
4440

@@ -59,12 +55,6 @@ For using variable size network buffer, the following overlay file can be used:
5955
$ west build -p -b <board> samples/net/wifi -- -DEXTRA_CONF_FILE=overlay-enterprise-variable-bufs.conf
6056
6157
62-
Run time certificates
63-
---------------------
64-
65-
The Wi-Fi shell module uses TLS credentials subsystem to store and manage the certificates. The certificates can be added at runtime using the shell commands, see :ref:`tls_credentials_shell` for more details.
66-
The sample or application need to enable the :kconfig:option:`CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES` option to use this feature.
67-
6858
6959
To initiate Wi-Fi connection, the following command can be used:
7060

‎subsys/net/l2/wifi/Kconfig‎

Lines changed: 0 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -125,26 +125,3 @@ config WIFI_ENT_IDENTITY_MAX_USERS
125125
default 8
126126
help
127127
This option defines the maximum number of identity users allowed connection.
128-
129-
if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
130-
131-
config WIFI_SHELL_RUNTIME_CERTIFICATES
132-
bool "Provide Wi-Fi enterprise security certificates at run-time"
133-
select TLS_CREDENTIALS
134-
select TLS_CREDENTIALS_SHELL
135-
select BASE64
136-
help
137-
This option enables providing Wi-Fi enterprise security certificates at run-time.
138-
Uses the TLS credentials subsystem to store and manage the certificates.
139-
140-
if WIFI_SHELL_RUNTIME_CERTIFICATES
141-
config HEAP_MEM_POOL_ADD_SIZE_WIFI_CERT
142-
int "Wi-Fi enterprise security certificates memory pool size"
143-
# STA - 6 certs and each assume 1500 bytes
144-
default 12000
145-
help
146-
The size of the memory pool used by the Wi-Fi enterprise security certificates.
147-
148-
endif # WIFI_SHELL_RUNTIME_CERTIFICATES
149-
150-
endif # WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE

‎subsys/net/l2/wifi/wifi_shell.c‎

Lines changed: 22 additions & 247 deletions
Original file line numberDiff line numberDiff line change
@@ -30,29 +30,7 @@ LOG_MODULE_REGISTER(net_wifi_shell, LOG_LEVEL_INF);
3030

3131
#include "net_shell_private.h"
3232
#include <math.h>
33-
#if defined CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE || \
34-
defined CONFIG_WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE
35-
#ifdef CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES
36-
#include <zephyr/net/tls_credentials.h>
37-
enum wifi_enterprise_cert_sec_tags {
38-
WIFI_CERT_CA_SEC_TAG = 0x1020001,
39-
WIFI_CERT_CLIENT_KEY_SEC_TAG,
40-
WIFI_CERT_SERVER_KEY_SEC_TAG,
41-
WIFI_CERT_CLIENT_SEC_TAG,
42-
WIFI_CERT_SERVER_SEC_TAG,
43-
/* Phase 2 */
44-
WIFI_CERT_CA_P2_SEC_TAG,
45-
WIFI_CERT_CLIENT_KEY_P2_SEC_TAG,
46-
WIFI_CERT_CLIENT_P2_SEC_TAG,
47-
};
48-
49-
struct wifi_cert_data {
50-
enum tls_credential_type type;
51-
uint32_t sec_tag;
52-
uint8_t **data;
53-
size_t *len;
54-
};
55-
#else
33+
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
5634
static const char ca_cert_test[] = {
5735
#include <wifi_enterprise_test_certs/ca.pem.inc>
5836
'\0'
@@ -89,8 +67,7 @@ static const char server_key_test[] = {
8967
#include <wifi_enterprise_test_certs/server-key.pem.inc>
9068
'\0'
9169
};
92-
#endif /* CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES */
93-
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */
70+
#endif
9471

9572
#define WIFI_SHELL_MODULE "wifi"
9673

@@ -125,12 +102,6 @@ static struct {
125102
};
126103
uint8_t all;
127104
};
128-
#if defined CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE || \
129-
defined CONFIG_WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE
130-
#ifdef CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES
131-
struct wifi_enterprise_creds_params enterprise_creds_params;
132-
#endif /* CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES */
133-
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */
134105
} context;
135106

136107
static struct net_mgmt_event_callback wifi_shell_mgmt_cb;
@@ -146,212 +117,27 @@ static struct wifi_ap_sta_node sta_list[CONFIG_WIFI_SHELL_MAX_AP_STA];
146117

147118
#if defined CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE || \
148119
defined CONFIG_WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE
149-
#ifdef CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES
150-
static int process_certificates(struct wifi_cert_data *certs, size_t cert_count)
151-
{
152-
for (size_t i = 0; i < cert_count; i++) {
153-
int err;
154-
size_t len = 0;
155-
uint8_t *cert_tmp;
156-
157-
err = tls_credential_get(certs[i].sec_tag, certs[i].type, NULL, &len);
158-
if (err != -EFBIG) {
159-
LOG_ERR("Failed to get credential tag: %d length, err: %d",
160-
certs[i].sec_tag, err);
161-
return err;
162-
}
163-
164-
cert_tmp = k_malloc(len);
165-
if (!cert_tmp) {
166-
LOG_ERR("Failed to allocate memory for credential tag: %d",
167-
certs[i].sec_tag);
168-
return -ENOMEM;
169-
}
170-
171-
err = tls_credential_get(certs[i].sec_tag, certs[i].type, cert_tmp, &len);
172-
if (err) {
173-
LOG_ERR("Failed to get credential tag: %d", certs[i].sec_tag);
174-
k_free(cert_tmp);
175-
return err;
176-
}
177-
178-
*certs[i].data = cert_tmp;
179-
*certs[i].len = len;
180-
}
181-
182-
return 0;
183-
}
184-
185-
static void set_enterprise_creds_params(struct wifi_enterprise_creds_params *params,
186-
bool is_ap)
187-
{
188-
struct wifi_cert_data certs_common[] = {
189-
{
190-
.type = TLS_CREDENTIAL_CA_CERTIFICATE,
191-
.sec_tag = WIFI_CERT_CA_SEC_TAG,
192-
.data = &params->ca_cert,
193-
.len = &params->ca_cert_len,
194-
},
195-
};
196-
197-
struct wifi_cert_data certs_sta[] = {
198-
{
199-
.type = TLS_CREDENTIAL_PRIVATE_KEY,
200-
.sec_tag = WIFI_CERT_CLIENT_KEY_SEC_TAG,
201-
.data = &params->client_key,
202-
.len = &params->client_key_len,
203-
},
204-
{
205-
.type = TLS_CREDENTIAL_PUBLIC_CERTIFICATE,
206-
.sec_tag = WIFI_CERT_CLIENT_SEC_TAG,
207-
.data = &params->client_cert,
208-
.len = &params->client_cert_len,
209-
},
210-
{
211-
.type = TLS_CREDENTIAL_CA_CERTIFICATE,
212-
.sec_tag = WIFI_CERT_CA_P2_SEC_TAG,
213-
.data = &params->ca_cert2,
214-
.len = &params->ca_cert2_len,
215-
},
216-
{
217-
.type = TLS_CREDENTIAL_PRIVATE_KEY,
218-
.sec_tag = WIFI_CERT_CLIENT_KEY_P2_SEC_TAG,
219-
.data = &params->client_key2,
220-
.len = &params->client_key2_len,
221-
},
222-
{
223-
.type = TLS_CREDENTIAL_PUBLIC_CERTIFICATE,
224-
.sec_tag = WIFI_CERT_CLIENT_P2_SEC_TAG,
225-
.data = &params->client_cert2,
226-
.len = &params->client_cert2_len,
227-
},
228-
};
229-
230-
struct wifi_cert_data certs_ap[] = {
231-
{
232-
.type = TLS_CREDENTIAL_PUBLIC_CERTIFICATE,
233-
.sec_tag = WIFI_CERT_SERVER_SEC_TAG,
234-
.data = &params->server_cert,
235-
.len = &params->server_cert_len,
236-
},
237-
{
238-
.type = TLS_CREDENTIAL_PRIVATE_KEY,
239-
.sec_tag = WIFI_CERT_SERVER_KEY_SEC_TAG,
240-
.data = &params->server_key,
241-
.len = &params->server_key_len,
242-
},
243-
};
244-
245-
memset(params, 0, sizeof(*params));
246-
247-
/* Process common certificates */
248-
if (process_certificates(certs_common, ARRAY_SIZE(certs_common)) != 0) {
249-
goto cleanup;
250-
}
251-
252-
/* Process STA-specific certificates */
253-
if (!is_ap) {
254-
if (process_certificates(certs_sta, ARRAY_SIZE(certs_sta)) != 0) {
255-
goto cleanup;
256-
}
257-
}
258-
259-
/* Process AP-specific certificates if is_ap is true */
260-
if (is_ap) {
261-
if (process_certificates(certs_ap, ARRAY_SIZE(certs_ap)) != 0) {
262-
goto cleanup;
263-
}
264-
}
265-
266-
memcpy(&context.enterprise_creds_params, params, sizeof(*params));
267-
return;
268-
269-
cleanup:
270-
for (size_t i = 0; i < ARRAY_SIZE(certs_common); i++) {
271-
if (certs_common[i].data) {
272-
k_free(*certs_common[i].data);
273-
}
274-
}
275-
276-
if (!is_ap) {
277-
for (size_t i = 0; i < ARRAY_SIZE(certs_sta); i++) {
278-
if (certs_sta[i].data) {
279-
k_free(*certs_sta[i].data);
280-
}
281-
}
282-
}
283-
284-
if (is_ap) {
285-
for (size_t i = 0; i < ARRAY_SIZE(certs_ap); i++) {
286-
if (certs_ap[i].data) {
287-
k_free(*certs_ap[i].data);
288-
}
289-
}
290-
}
291-
}
292-
293-
static void clear_enterprise_creds_params(struct wifi_enterprise_creds_params *params)
294-
{
295-
size_t i;
296-
297-
if (!params) {
298-
return;
299-
}
300-
301-
const uint8_t *certs[] = {
302-
params->ca_cert,
303-
params->client_cert,
304-
params->client_key,
305-
params->server_cert,
306-
params->server_key,
307-
params->ca_cert2,
308-
params->client_cert2
309-
params->client_key2,
310-
};
311-
312-
for (i = 0; i < ARRAY_SIZE(certs); i++) {
313-
k_free((void *)certs[i]);
314-
}
315-
memset(params, 0, sizeof(*params));
316-
}
317-
#else
318-
static void set_enterprise_creds_params(struct wifi_enterprise_creds_params *params,
319-
bool is_ap)
320-
{
321-
params->ca_cert = (uint8_t *)ca_cert_test;
322-
params->ca_cert_len = ARRAY_SIZE(ca_cert_test);
323-
324-
if (!is_ap) {
325-
params->client_cert = (uint8_t *)client_cert_test;
326-
params->client_cert_len = ARRAY_SIZE(client_cert_test);
327-
params->client_key = (uint8_t *)client_key_test;
328-
params->client_key_len = ARRAY_SIZE(client_key_test);
329-
params->ca_cert2 = (uint8_t *)ca_cert2_test;
330-
params->ca_cert2_len = ARRAY_SIZE(ca_cert2_test);
331-
params->client_cert2 = (uint8_t *)client_cert2_test;
332-
params->client_cert2_len = ARRAY_SIZE(client_cert2_test);
333-
params->client_key2 = (uint8_t *)client_key2_test;
334-
params->client_key2_len = ARRAY_SIZE(client_key2_test);
335-
336-
return;
337-
}
338-
339-
params->server_cert = (uint8_t *)server_cert_test;
340-
params->server_cert_len = ARRAY_SIZE(server_cert_test);
341-
params->server_key = (uint8_t *)server_key_test;
342-
params->server_key_len = ARRAY_SIZE(server_key_test);
343-
}
344-
#endif /* CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES */
345-
346-
static int wifi_set_enterprise_creds(const struct shell *sh, struct net_if *iface,
347-
bool is_ap)
120+
static int cmd_wifi_set_enterprise_creds(const struct shell *sh, struct net_if *iface)
348121
{
349122
struct wifi_enterprise_creds_params params = {0};
350123

351-
#ifdef CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES
352-
clear_enterprise_creds_params(&context.enterprise_creds_params);
353-
#endif /* CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES */
354-
set_enterprise_creds_params(&params, is_ap);
124+
params.ca_cert = (uint8_t *)ca_cert_test;
125+
params.ca_cert_len = ARRAY_SIZE(ca_cert_test);
126+
params.client_cert = (uint8_t *)client_cert_test;
127+
params.client_cert_len = ARRAY_SIZE(client_cert_test);
128+
params.client_key = (uint8_t *)client_key_test;
129+
params.client_key_len = ARRAY_SIZE(client_key_test);
130+
params.ca_cert2 = (uint8_t *)ca_cert2_test;
131+
params.ca_cert2_len = ARRAY_SIZE(ca_cert2_test);
132+
params.client_cert2 = (uint8_t *)client_cert2_test;
133+
params.client_cert2_len = ARRAY_SIZE(client_cert2_test);
134+
params.client_key2 = (uint8_t *)client_key2_test;
135+
params.client_key2_len = ARRAY_SIZE(client_key2_test);
136+
params.server_cert = (uint8_t *)server_cert_test;
137+
params.server_cert_len = ARRAY_SIZE(server_cert_test);
138+
params.server_key = (uint8_t *)server_key_test;
139+
params.server_key_len = ARRAY_SIZE(server_key_test);
140+
355141
if (net_mgmt(NET_REQUEST_WIFI_ENTERPRISE_CREDS, iface, &params, sizeof(params))) {
356142
PR_WARNING("Set enterprise credentials failed\n");
357143
return -1;
@@ -1130,7 +916,7 @@ static int cmd_wifi_connect(const struct shell *sh, size_t argc,
1130916
cnx_params.security == WIFI_SECURITY_TYPE_EAP_PEAP_GTC ||
1131917
cnx_params.security == WIFI_SECURITY_TYPE_EAP_TTLS_MSCHAPV2 ||
1132918
cnx_params.security == WIFI_SECURITY_TYPE_EAP_PEAP_TLS) {
1133-
wifi_set_enterprise_creds(sh, iface, 0);
919+
cmd_wifi_set_enterprise_creds(sh, iface);
1134920
}
1135921
#endif
1136922

@@ -1172,11 +958,6 @@ static int cmd_wifi_disconnect(const struct shell *sh, size_t argc,
1172958
PR("Disconnect requested\n");
1173959
}
1174960

1175-
#ifdef CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES
1176-
/* Clear the certificates */
1177-
clear_enterprise_creds_params(&context.enterprise_creds_params);
1178-
#endif /* CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES */
1179-
1180961
return 0;
1181962
}
1182963

@@ -2143,7 +1924,7 @@ static int cmd_wifi_ap_enable(const struct shell *sh, size_t argc,
21431924
cnx_params.security == WIFI_SECURITY_TYPE_EAP_PEAP_GTC ||
21441925
cnx_params.security == WIFI_SECURITY_TYPE_EAP_TTLS_MSCHAPV2 ||
21451926
cnx_params.security == WIFI_SECURITY_TYPE_EAP_PEAP_TLS) {
2146-
wifi_set_enterprise_creds(sh, iface, 1);
1927+
cmd_wifi_set_enterprise_creds(sh, iface);
21471928
}
21481929
#endif
21491930

@@ -2174,12 +1955,6 @@ static int cmd_wifi_ap_disable(const struct shell *sh, size_t argc,
21741955
}
21751956

21761957
PR("AP mode disable requested\n");
2177-
2178-
#ifdef CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES
2179-
/* Clear the certificates */
2180-
clear_enterprise_creds_params(&context.enterprise_creds_params);
2181-
#endif /* CONFIG_WIFI_SHELL_RUNTIME_CERTIFICATES */
2182-
21831958
return 0;
21841959
}
21851960

0 commit comments

Comments
 (0)