Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

wifi: enterprise: Add support for runtime certificates #87656

Open
wants to merge 10 commits into
base: main
Choose a base branch
from
Open

wifi: enterprise: Add support for runtime certificates #87656

wants to merge 10 commits into from
+759 −97

Conversation

krish2718
Copy link
Collaborator

@krish2718 krish2718 commented Mar 25, 2025 •
edited
Loading

Implements #79564

  • Move enterprise configs to a snippet
  • Add TLS credentials configs to the new snippet
  • Implement runtime certificate management using TLS credentials module
  • Fix a bug in TLS credentials shell

The certificate installation is handled by a helper script which simplifies installation process, but even without that PR cred shell can be used manually but it's cumbersome.

@krish2718 krish2718 force-pushed the wifi_ent_rejig branch 2 times, most recently from 37adaa1 to c167779 Compare March 26, 2025 20:01
@krish2718 krish2718 marked this pull request as ready for review March 26, 2025 20:02
@krish2718 krish2718 changed the title wifi: Enterprise security rejig wifi: enterprise: Add support for runtime certificates Mar 26, 2025
@krish2718
Copy link
Collaborator Author

@MaochenWang1 I have not done any AP mode testing on this as nRF70 doesn't support AP + Enterprise mode, it would e good if NXP can do some tests.

@MaochenWang1
Copy link
Collaborator

@MaochenWang1 I have not done any AP mode testing on this as nRF70 doesn't support AP + Enterprise mode, it would e good if NXP can do some tests.

Sure, will review, test and feedback

@krish2718
Copy link
Collaborator Author

@MaochenWang1 I have not done any AP mode testing on this as nRF70 doesn't support AP + Enterprise mode, it would e good if NXP can do some tests.

Sure, will review, test and feedback

FYI, I am seeing issues even with build time certs, debugging now will push fixes soon.

jukkar
jukkar reviewed Mar 27, 2025
View reviewed changes
@krish2718
Copy link
Collaborator Author

krish2718 commented Mar 27, 2025 •
edited
Loading

I have resolved the compliance except for below: I tried to get checkpatch ignore using --ignore FILE_PATH=a/samples/net/wifi/test_certs/ but looking at the perl script there is no such provision, it is trying to find typo in cert data :)

Running Checkpatch       tests in /home/tach/work/zephyr/zephyr ...
1 checks failed
ERROR   : Test Checkpatch failed: 
TYPO_SPELLING: 'jUs' may be misspelled - perhaps 'just'?
File:samples/net/wifi/test_certs/rsa2k/server.pem
Line:26

Complete results in compliance.xml

@krish2718
Copy link
Collaborator Author

@MaochenWang1 I have not done any AP mode testing on this as nRF70 doesn't support AP + Enterprise mode, it would e good if NXP can do some tests.

Sure, will review, test and feedback

FYI, I am seeing issues even with build time certs, debugging now will push fixes soon.

Tested end-end, it is working fine.

jukkar
jukkar reviewed Mar 28, 2025
View reviewed changes
jukkar
jukkar previously approved these changes Mar 28, 2025
View reviewed changes
rlubos
rlubos previously approved these changes Apr 4, 2025
View reviewed changes
jukkar
jukkar previously approved these changes Apr 4, 2025
View reviewed changes
MaochenWang1
MaochenWang1 previously approved these changes Apr 4, 2025
View reviewed changes
krish2718 added 6 commits April 7, 2025 23:29
@krish2718
net: l2: wifi: Add support for run-time certificates
89030c6 
Using TLS credentials library add support for run-time certificates where
the installed certs are retrieved from the credential store (as of now
only volatile backend is tested).

This helps in production environments.

Implements zephyrproject-rtos#79564.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
net: lib: tls_credentials_shell: Add a config for heap
dd04a97 
The volatile backend stores the credentials on the heap, so, explicitly
add a config option that can be overridden in case there are more certs
than the default.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
wifi: Move Wi-Fi enterprise configs to a snippet
97ede0e 
Instead of having an overlay move the Enterprise configurations to a
dedicated snippet so that it can be enabled with any sample.

Can be used along with Wi-Fi snippet e.g., `-S
"wifi-ipv4;wifi-enterprise"`.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
snippets: wifi-enterprise: Add support for TLS credentials
2f34f55 
Enable TLS credentials shell to manager Wi-Fi enterprise certs.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
net: lib: tls_credentials_shell: Fix crash during delete
17d2bec 
Deletion of credential should use the pointer from the reference slot
not the temporary buffer, this causes a crash (unknown error).

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
net: l2: wifi: Make build time certs as optional
06ec4d6 
Certificates usage depends on STA/AP mode, but we don't have that
information at a build time, so, make all certs as optional and if a
file isn't found then generate an empty header so that corresponding C
code will be built.

Any missing mandatory certificates will be validated before connection
and connection is failed.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718 krish2718 added the DNM This PR should not be merged (Do Not Merge) label Apr 7, 2025
@krish2718
Copy link
Collaborator Author

Need to fix a build error and also add a test case to catch build errors and convert the script from shell->python for cross-platform support.

krish2718 added 4 commits April 7, 2025 23:52
@krish2718
samples: net: wifi: Add two variants of certs
2b2d9af 
RSA3K based certs are not supported on all platforms, so, keep both
variants, rsa2k (the older certs but with longer expiry 9999 days) and
rsa3k (latest ones) and we can have more variants in this folders.

Also, add a cmake variable to override the path with default as rsa3k.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
doc: net: wifi: Fix the connect command
1f5de84 
The command should work with existing certs rather than a generic
example, also fix the key-management.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
samples: net: wifi: Add a script to install certs
5df9eeb 
For enterprise mode we need to install multiple certs to the TLS
credentials store, so, add a helper script in python to make it work
cross-platforms.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
tests: net: wifi: Add a test for Enterprise with run-time certs
Loading
Loading status checks…
a8df6df 
This is needed to ensure run-time certs feature builds.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718 krish2718 dismissed stale reviews from MaochenWang1, jukkar, and rlubos via a8df6df April 7, 2025 18:40
@krish2718 krish2718 removed the DNM This PR should not be merged (Do Not Merge) label Apr 7, 2025
@github-actions github-actions bot requested review from 57300 and jeremybettis April 7, 2025 18:41
nordicjm
nordicjm approved these changes Apr 9, 2025
View reviewed changes
Copy link
Collaborator

@nordicjm nordicjm left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Build system changes OK

kartben
kartben requested changes Apr 9, 2025
View reviewed changes
samples/net/wifi/test_certs/install_certs.py

def check_requirements():
try:
installed_version = version('nrfcloud-utils')
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is a generic wifi sample pulling in nrf cloud stuff? This sounds wrong.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Though it's named nrfcloud it does work with non-nRF boards too, I have tested with STM32 Nucleo board. The reason for using nrfcloud util is it already supports TLS credential shell based device access. In the future we can write up a standalone tool part of Zephyr repo itself.

doc/connectivity/networking/api/wifi.rst
Comment on lines +76 to +82
To facilitate installation of the certificates, a helper script is provided in the ``samples/net/wifi/test_certs`` directory. The script can be used to install the certificates at runtime.

.. code-block:: bash

$ west build -p -b <board> samples/net/wifi -- -DEXTRA_CONF_FILE=overlay-enterprise-variable-bufs.conf
$ samples/net/wifi/test_certs/install_certs.py -p samples/net/wifi/test_certs/rsa2k

The script will install the certificates in the ``rsa2k`` directory to the TLS credentials store in the device over UART and using TLS credentials shell commands.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

so all devices are supporting the AT commands this tool seems to be using?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't use AT command, but TLS credentials shell (part of Zephyr)

doc/connectivity/networking/api/wifi.rst
Compile time certificates
-------------------------

Test certificates in PEM format are committed to the repo at :zephyr_file:`samples/net/wifi/test_certs` and the during the
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

really not a fan of the proliferation of binary certificates in-tree. Can't we just have instructions on what steps people sjhould take to generate them? It seems to me as this would be much more useful, too.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, but for a quick testing it's useful to have a golden certs that just work. Else any mistakes in cert generation are tough to debug.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kartben kartben

@jukkar jukkar

@rlubos rlubos

@nordicjm nordicjm

@sachinthegreen sachinthegreen

@MaochenWang1 MaochenWang1

@nashif nashif

@tejlmand tejlmand

@57300 57300

@jeremybettis jeremybettis

Requested changes must be addressed to merge this pull request.

Assignees

@jukkar jukkar

Labels
area: Build System area: Networking area: Samples Samples area: Wi-Fi Wi-Fi Override Required
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@krish2718 @MaochenWang1 @jukkar @kartben @rlubos @nordicjm @sachinthegreen