Skip to content

RDK-57883 [PoC] Access TEE Cert Abstracted By CertSelector #140

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Sidsohail wants to merge 9 commits into from
Closed

RDK-57883 [PoC] Access TEE Cert Abstracted By CertSelector #140

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
6286afc
RDK-57883 [PoC] Access TEE Cert Abstracted By CertSelector
Jul 24, 2025
03c554a
Update curlinterface.c
Sidsohail Jul 24, 2025
3de38f8
Update Makefile.am
Sidsohail Jul 24, 2025
92eec4c
Update curlinterface.c
Sidsohail Jul 24, 2025
993c863
Update curlinterface.c
Sidsohail Jul 25, 2025
a9df9c8
Update curlinterface.c
Sidsohail Jul 25, 2025
1e23f4e
Merge pull request #142 from rdkcentral/develop
Sidsohail Aug 7, 2025
31befe7
Update xconfclient.c
Sidsohail Aug 7, 2025
b9cf7b9
Update xconfclient.c
Sidsohail Aug 11, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion source/protocol/http/Makefile.am
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ libhttp_la_SOURCES = curlinterface.c
libhttp_la_LDFLAGS = -shared -fPIC -lcurl
if IS_LIBRDKCERTSEL_ENABLED
libhttp_la_CFLAGS = $(LIBRDKCERTSEL_FLAG)
libhttp_la_LDFLAGS += -lRdkCertSelector
libhttp_la_LDFLAGS += -lRdkCertSelector -lsetTlsCert
endif
libhttp_la_CPPFLAGS = -fPIC -I${PKG_CONFIG_SYSROOT_DIR}$(includedir)/dbus-1.0 \
-I${PKG_CONFIG_SYSROOT_DIR}$(libdir)/dbus-1.0/include \
Expand Down
45 changes: 11 additions & 34 deletions source/protocol/http/curlinterface.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@
#include "busInterface.h"
#ifdef LIBRDKCERTSEL_BUILD
#include "rdkcertselector.h"
#define FILESCHEME "file://"
#include "rdkSetTlsCert.h"
#endif
#ifdef LIBRDKCONFIG_BUILD
#include "rdkconfig.h"
Expand Down Expand Up @@ -177,6 +177,7 @@ static T2ERROR setHeader(CURL *curl, const char* destURL, struct curl_slist **he
return T2ERROR_SUCCESS;
}

#ifndef LIBRDKCERTSEL_BUILD
static T2ERROR setMtlsHeaders(CURL *curl, const char* certFile, const char* pPasswd, childResponse *childCurlResponse)
{
if(curl == NULL || certFile == NULL || pPasswd == NULL)
Expand All @@ -185,15 +186,13 @@ static T2ERROR setMtlsHeaders(CURL *curl, const char* certFile, const char* pPas
return T2ERROR_FAILURE;
}
CURLcode code = CURLE_OK;
#ifndef LIBRDKCERTSEL_BUILD
code = curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L);
if(code != CURLE_OK)
{
childCurlResponse->curlSetopCode = code;
childCurlResponse->lineNumber = __LINE__;
return T2ERROR_FAILURE;
}
#endif
code = curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "P12");
if(code != CURLE_OK)
{
Expand Down Expand Up @@ -228,7 +227,7 @@ static T2ERROR setMtlsHeaders(CURL *curl, const char* certFile, const char* pPas
childCurlResponse->lineNumber = __LINE__;
return T2ERROR_SUCCESS;
}

#endif
static T2ERROR setPayload(CURL *curl, const char* payload, childResponse *childCurlResponse)
{
if(curl == NULL || payload == NULL)
Expand Down Expand Up @@ -318,17 +317,15 @@ T2ERROR sendReportOverHTTP(char *httpUrl, char *payload, pid_t* outForkedPid)
#ifdef LIBRDKCERTSEL_BUILD
rdkcertselector_h thisCertSel = NULL;
rdkcertselectorStatus_t curlGetCertStatus;
char *pCertURI = NULL;
char *pEngine = NULL;
bool state_red_enable = false;
#endif
char *pCertFile = NULL;
char *pCertPC = NULL;
#ifdef LIBRDKCONFIG_BUILD
size_t sKey = 0;
#endif
long http_code;
#ifndef LIBRDKCERTSEL_BUILD
bool mtls_enable = false;
#endif
pid_t childPid;
int sharedPipeFds[2];

Expand Down Expand Up @@ -381,8 +378,9 @@ T2ERROR sendReportOverHTTP(char *httpUrl, char *payload, pid_t* outForkedPid)
}
#endif
#endif
mtls_enable = isMtlsEnabled();
#ifndef LIBRDKCERTSEL_BUILD
mtls_enable = isMtlsEnabled();
char *pCertFile = NULL;
if(mtls_enable == true && T2ERROR_SUCCESS != getMtlsCerts(&pCertFile, &pCertPC))
{
T2Error("mTLS_cert get failed\n");
Expand Down Expand Up @@ -456,26 +454,9 @@ T2ERROR sendReportOverHTTP(char *httpUrl, char *payload, pid_t* outForkedPid)
goto child_cleanReturn;
}
#ifdef LIBRDKCERTSEL_BUILD
pEngine = rdkcertselector_getEngine(thisCertSel);
if(pEngine != NULL)
{
code = curl_easy_setopt(curl, CURLOPT_SSLENGINE, pEngine);
}
else
{
code = curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L);
}
if(code != CURLE_OK)
{
curl_easy_cleanup(curl);
goto child_cleanReturn;
}
do
{
pCertFile = NULL;
pCertPC = NULL;
pCertURI = NULL;
curlGetCertStatus = rdkcertselector_getCert(thisCertSel, &pCertURI, &pCertPC);
curlGetCertStatus = rdkcertselector_getCertForCurl( curl, curlCertSelector);
if(curlGetCertStatus != certselectorOk)
{
T2Error("%s, T2:Failed to retrieve the certificate.\n", __func__);
Expand All @@ -485,18 +466,14 @@ T2ERROR sendReportOverHTTP(char *httpUrl, char *payload, pid_t* outForkedPid)
}
else
{
// skip past file scheme in URI
pCertFile = pCertURI;
if ( strncmp( pCertFile, FILESCHEME, sizeof(FILESCHEME) - 1 ) == 0 )
{
pCertFile += (sizeof(FILESCHEME) - 1);
}
#endif
#ifndef LIBRDKCERTSEL_BUILD
if((mtls_enable == true) && (setMtlsHeaders(curl, pCertFile, pCertPC, &childCurlResponse) != T2ERROR_SUCCESS))
{
curl_easy_cleanup(curl); // CID 189985: Resource leak
goto child_cleanReturn;
}
#endif
pthread_once(&curlFileMutexOnce, sendOverHTTPInit);
pthread_mutex_lock(&curlFileMutex);

Expand All @@ -515,7 +492,7 @@ T2ERROR sendReportOverHTTP(char *httpUrl, char *payload, pid_t* outForkedPid)
if(curl_code != CURLE_OK || http_code != 200)
{
#ifdef LIBRDKCERTSEL_BUILD
T2Info("%s: Using xpki Certs connection certname: %s\n", __func__, pCertFile);
T2Info("%s: Using xpki Certs connection\n", __func__);
#endif
fprintf(stderr, "curl failed: %s\n", curl_easy_strerror(curl_code));
childCurlResponse.lineNumber = __LINE__;
Expand Down
61 changes: 8 additions & 53 deletions source/xconf-client/xconfclient.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,8 +42,7 @@
#include "telemetry2_0.h"
#include "busInterface.h"
#ifdef LIBRDKCERTSEL_BUILD
#include "rdkcertselector.h"
#define FILESCHEME "file://"
#include "rdkSetTlsCert.h"
#endif
#ifdef LIBRDKCONFIG_BUILD
#include "rdkconfig.h"
Expand Down Expand Up @@ -588,12 +587,10 @@ T2ERROR doHttpGet(char* httpsUrl, char **data)
CURLcode curl_code = CURLE_OK;
#ifdef LIBRDKCERTSEL_BUILD
rdkcertselectorStatus_t xcGetCertStatus;
char *pCertURI = NULL;
char *pEngine = NULL;
#endif
#ifdef LIBRDKCONFIG_BUILD
char *pCertFile = NULL;
char *pPasswd = NULL;
#ifdef LIBRDKCONFIG_BUILD
size_t sPasswdSize = 0;
#endif
// char *pKeyType = "PEM" ;
Expand Down Expand Up @@ -727,25 +724,9 @@ T2ERROR doHttpGet(char* httpsUrl, char **data)
if(mtls_enable == true)
{
#ifdef LIBRDKCERTSEL_BUILD
pEngine = rdkcertselector_getEngine(xcCertSelector);
if(pEngine != NULL)
{
code = curl_easy_setopt(curl, CURLOPT_SSLENGINE, pEngine);
}
else
{
code = curl_easy_setopt(curl, CURLOPT_SSLENGINE_DEFAULT, 1L);
}
if(code != CURLE_OK)
{
T2Error("%s : Curl set opts failed with error %s \n", __FUNCTION__, curl_easy_strerror(code));
}
do
{
pCertFile = NULL;
pPasswd = NULL;
pCertURI = NULL;
xcGetCertStatus = rdkcertselector_getCert(xcCertSelector, &pCertURI, &pPasswd);
xcGetCertStatus = rdkcertselector_getCertForCurl( curl, xcCertSelector);
if(xcGetCertStatus != certselectorOk)
{
T2Error("%s, T2:Failed to retrieve the certificate.\n", __func__);
Expand All @@ -757,47 +738,21 @@ T2ERROR doHttpGet(char* httpsUrl, char **data)
goto status_return;
}
else
{
// skip past file scheme in URI
pCertFile = pCertURI;
if ( strncmp( pCertFile, FILESCHEME, sizeof(FILESCHEME) - 1 ) == 0 )
{
pCertFile += (sizeof(FILESCHEME) - 1);
}
{

#else
if(T2ERROR_SUCCESS == getMtlsCerts(&pCertFile, &pPasswd))
{
#endif
code = curl_easy_setopt(curl, CURLOPT_SSLCERTTYPE, "P12");
if(code != CURLE_OK)
{
T2Error("%s : Curl set opts failed with error %s \n", __FUNCTION__, curl_easy_strerror(code));
}
code = curl_easy_setopt(curl, CURLOPT_SSLCERT, pCertFile);
if(code != CURLE_OK)
{
T2Error("%s : Curl set opts failed with error %s \n", __FUNCTION__, curl_easy_strerror(code));
}
code = curl_easy_setopt(curl, CURLOPT_KEYPASSWD, pPasswd);
if(code != CURLE_OK)
{
T2Error("%s : Curl set opts failed with error %s \n", __FUNCTION__, curl_easy_strerror(code));
}
/* disconnect if authentication fails */
code = curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1L);
if(code != CURLE_OK)
{
T2Error("%s : Curl set opts failed with error %s \n", __FUNCTION__, curl_easy_strerror(code));
}
curl_code = curl_easy_perform(curl);
curl_code = curl_easy_perform(curl);
#ifdef LIBRDKCERTSEL_BUILD
if(curl_code != CURLE_OK)
{
T2Info("%s: Using xpki Certs connection certname : %s \n", __FUNCTION__, pCertFile);
T2Info("%s: Using xpki Certs connection \n", __FUNCTION__);
T2Error("Curl failed : %d \n", curl_code);
}
}
}
}
while(rdkcertselector_setCurlStatus(xcCertSelector, curl_code, (const char*)httpsUrl) == TRY_ANOTHER);
#else
}
Expand Down
Loading