Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2055649/?format=api
{ "id": 2055649, "url": "http://patchwork.ozlabs.org/api/patches/2055649/?format=api", "web_url": "http://patchwork.ozlabs.org/project/uboot/patch/20250305142650.2966738-3-jerome.forissier@linaro.org/", "project": { "id": 18, "url": "http://patchwork.ozlabs.org/api/projects/18/?format=api", "name": "U-Boot", "link_name": "uboot", "list_id": "u-boot.lists.denx.de", "list_email": "u-boot@lists.denx.de", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20250305142650.2966738-3-jerome.forissier@linaro.org>", "list_archive_url": null, "date": "2025-03-05T14:26:43", "name": "[v2,2/6] lwip: tls: enforce checking of server certificates based on CA availability", "commit_ref": "f69f7aef26f797e18d3f2f205f0d3c9c5ad8df99", "pull_url": null, "state": "accepted", "archived": false, "hash": "f5eca02534d6535ddf34539b1249731ad93625dc", "submitter": { "id": 69192, "url": "http://patchwork.ozlabs.org/api/people/69192/?format=api", "name": "Jerome Forissier", "email": "jerome.forissier@linaro.org" }, "delegate": { "id": 157425, "url": "http://patchwork.ozlabs.org/api/users/157425/?format=api", "username": "jforissier", "first_name": "Jerome", "last_name": "Forissier", "email": "jerome.forissier@linaro.org" }, "mbox": "http://patchwork.ozlabs.org/project/uboot/patch/20250305142650.2966738-3-jerome.forissier@linaro.org/mbox/", "series": [ { "id": 447137, "url": "http://patchwork.ozlabs.org/api/series/447137/?format=api", "web_url": "http://patchwork.ozlabs.org/project/uboot/list/?series=447137", "date": "2025-03-05T14:26:41", "name": "net: lwip: root certificates", "version": 2, "mbox": "http://patchwork.ozlabs.org/series/447137/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2055649/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2055649/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<u-boot-bounces@lists.denx.de>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=linaro.org header.i=@linaro.org header.a=rsa-sha256\n header.s=google header.b=kuEi6mBj;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=2a01:238:438b:c500:173d:9f52:ddab:ee01; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)", "phobos.denx.de;\n dmarc=pass (p=none dis=none) header.from=linaro.org", "phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de", "phobos.denx.de;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=linaro.org header.i=@linaro.org header.b=\"kuEi6mBj\";\n\tdkim-atps=neutral", "phobos.denx.de;\n dmarc=pass (p=none dis=none) header.from=linaro.org", "phobos.denx.de;\n spf=pass smtp.mailfrom=jerome.forissier@linaro.org" ], "Received": [ "from phobos.denx.de (phobos.denx.de\n [IPv6:2a01:238:438b:c500:173d:9f52:ddab:ee01])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange X25519 server-signature ECDSA (secp384r1))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4Z7FJG3sv6z1yVg\n\tfor <incoming@patchwork.ozlabs.org>; Thu, 6 Mar 2025 01:27:42 +1100 (AEDT)", "from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id B12F4812C8;\n\tWed, 5 Mar 2025 15:27:19 +0100 (CET)", "by phobos.denx.de (Postfix, from userid 109)\n id A189F811B3; Wed, 5 Mar 2025 15:27:18 +0100 (CET)", "from mail-wr1-x431.google.com (mail-wr1-x431.google.com\n [IPv6:2a00:1450:4864:20::431])\n (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 98866808B6\n for <u-boot@lists.denx.de>; Wed, 5 Mar 2025 15:27:16 +0100 (CET)", "by mail-wr1-x431.google.com with SMTP id\n ffacd0b85a97d-390dd362848so5296697f8f.3\n for <u-boot@lists.denx.de>; Wed, 05 Mar 2025 06:27:16 -0800 (PST)", "from builder.. ([2a01:e0a:3cb:7bb0:369c:9bd8:7c87:9a39])\n by smtp.gmail.com with ESMTPSA id\n ffacd0b85a97d-391188029e0sm5442456f8f.52.2025.03.05.06.27.15\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Wed, 05 Mar 2025 06:27:15 -0800 (PST)" ], "X-Spam-Checker-Version": "SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de", "X-Spam-Level": "", "X-Spam-Status": "No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,\n SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.2", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=linaro.org; s=google; t=1741184836; x=1741789636; darn=lists.denx.de;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:from:to:cc:subject:date\n :message-id:reply-to;\n bh=G2s5Icwnuj6cOD5wt7+DAoUp8NjQQGsscIFURIpb1s8=;\n b=kuEi6mBj9bXqcuummPKsrg24W/QHnadgkZR87J2nD06JyZWAJW+R/TRB7cxOWCv3g1\n zkS0NRTN7Tgd0XkEw7eqkNkimStojUefg9AgRGQu0zJEuyb63vHA1ji9r8EOOhMoG2JT\n Y1JV1alTh79QoDokVcB9TxKAaRiX3D9POoZEq3crVYNXyRFbrpyMlE9DPeFXnSN7/oFF\n g76BIzvmgP7TKYnnIEHzHM4a6/q6q+QLTAiBWMEhXZ/2+eLDUUuj7eGOXjaztB1rRvnV\n oGUzSkSoy4oSOIjkk1jWfkRJvVarlIlQpJYLOd+I4VGU7h5jA4jW1W54QmakXeb6UESB\n 2Zdg==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20230601; t=1741184836; x=1741789636;\n h=content-transfer-encoding:mime-version:references:in-reply-to\n :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc\n :subject:date:message-id:reply-to;\n bh=G2s5Icwnuj6cOD5wt7+DAoUp8NjQQGsscIFURIpb1s8=;\n b=p/ZJgstaITBUwee0/ePtZhrzoI0VlJKFQ5fMNpYUA9ZQEDbvY90H9vQXQcaEcZ+l0z\n Ht9wjGYoUe1QJ0CcD0vtdlE6jb/SEQVObsdSolSnXO3euB2qSkJawLa0yvla6ED3CeEB\n 9btN5Ah7QrCTnfdXWpjzbhmvBQmb5WlElwavpY+XL4/HquKHpr8Y+C3FVWvkq84NOgng\n VZ3aegDUFqeyfJnC0fUUkUWVMkQKvU/ERsdNZDg59jDlSVXzlMbSC6X8R/HXc7uv6fzF\n E5QaFjLwfAXTG6GyIA5mzJYOpBH4hL3tyB4lHFZItCOWJWEWud6XtizIkv5UGd3KC3kA\n 5PFw==", "X-Gm-Message-State": "AOJu0YyQM96dfY64NF4YCycJLDhB4hdFL3zoknWPEPJzehhkPy2q5We5\n DjktIMh76UC7CrCbAxUwSLhPiYUo7o8ANp/s4CeuTJMw8KzoRVmjaseiHa7PnGTgio4doTEZU02\n z", "X-Gm-Gg": "ASbGncvK085JHjTCG3qdIqqf0Ll7HeFfmmGsr7ZFRYQzNkmBh2smk/w8S2Ga6RGO99P\n 8/QQGjgCPjPkj1LErT3uXLUubs5bbV8sHWdGPa+uxd+7vUL8jmXBZFXn15YepUIreuOZ8ZIUmtN\n L9jAyJmEahnrH2uA53W2I+3XVVT4rPYDXx7vCltTw41ZXg3sdK0UHZIUxOOwyQbCsoWK/WHOUU8\n D6vDinphsIQVMTTuJNgS42mYk1tBrpPZrjAxn0Hb2dhqDOBD6pJoVF5v8VbN2R9+JxkytUOPNkj\n MUhBVqzAMkkLbno8yi4AKx99XXPG1JcHCt9fJghJps5EhAqdWMitTg==", "X-Google-Smtp-Source": "\n AGHT+IEBCc11uPzTF97IBxzbAKwsOo65KGVVS5CTTN0uXK+w0is9RQOL6MEEHrGpAiBTxLv5ctkNzQ==", "X-Received": "by 2002:a5d:6da7:0:b0:38f:2766:759f with SMTP id\n ffacd0b85a97d-3911f7a8406mr2848139f8f.41.1741184835910;\n Wed, 05 Mar 2025 06:27:15 -0800 (PST)", "From": "Jerome Forissier <jerome.forissier@linaro.org>", "To": "u-boot@lists.denx.de", "Cc": "Ilias Apalodimas <ilias.apalodimas@linaro.org>,\n Jerome Forissier <jerome.forissier@linaro.org>,\n Tom Rini <trini@konsulko.com>, Javier Tia <javier.tia@linaro.org>,\n Heinrich Schuchardt <xypron.glpk@gmx.de>", "Subject": "[PATCH v2 2/6] lwip: tls: enforce checking of server certificates\n based on CA availability", "Date": "Wed, 5 Mar 2025 15:26:43 +0100", "Message-ID": "<20250305142650.2966738-3-jerome.forissier@linaro.org>", "X-Mailer": "git-send-email 2.43.0", "In-Reply-To": "<20250305142650.2966738-1-jerome.forissier@linaro.org>", "References": "<20250305142650.2966738-1-jerome.forissier@linaro.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-BeenThere": "u-boot@lists.denx.de", "X-Mailman-Version": "2.1.39", "Precedence": "list", "List-Id": "U-Boot discussion <u-boot.lists.denx.de>", "List-Unsubscribe": "<https://lists.denx.de/options/u-boot>,\n <mailto:u-boot-request@lists.denx.de?subject=unsubscribe>", "List-Archive": "<https://lists.denx.de/pipermail/u-boot/>", "List-Post": "<mailto:u-boot@lists.denx.de>", "List-Help": "<mailto:u-boot-request@lists.denx.de?subject=help>", "List-Subscribe": "<https://lists.denx.de/listinfo/u-boot>,\n <mailto:u-boot-request@lists.denx.de?subject=subscribe>", "Errors-To": "u-boot-bounces@lists.denx.de", "Sender": "\"U-Boot\" <u-boot-bounces@lists.denx.de>", "X-Virus-Scanned": "clamav-milter 0.103.8 at phobos.denx.de", "X-Virus-Status": "Clean" }, "content": "Instead of relying on some build time configuration to determine if\nserver certificates need to be checked against CA certificates, do it\nbased on the availability of such certificates. If no CA is configured\nthen no check can succeed; on the other hand if we have CA certs then\nwe should not ignore them. It is always possible to remove the CA certs\n(via 'wget cacert 0 0') to force an HTTPS download that would fail\ncertificate validation.\n\nSigned-off-by: Jerome Forissier <jerome.forissier@linaro.org>\nReviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>\n---\n lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c | 3 ++-\n .../lwip/src/include/lwip/apps/altcp_tls_mbedtls_opts.h | 6 ------\n 2 files changed, 2 insertions(+), 7 deletions(-)", "diff": "diff --git a/lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c b/lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c\nindex 46421588fef..fa3d1d74fed 100644\n--- a/lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c\n+++ b/lib/lwip/lwip/src/apps/altcp_tls/altcp_tls_mbedtls.c\n@@ -786,6 +786,7 @@ altcp_tls_create_config(int is_server, u8_t cert_count, u8_t pkey_count, int hav\n int ret;\n struct altcp_tls_config *conf;\n mbedtls_x509_crt *mem;\n+ int authmode = have_ca ? MBEDTLS_SSL_VERIFY_REQUIRED : MBEDTLS_SSL_VERIFY_NONE;\n \n if (TCP_WND < MBEDTLS_SSL_IN_CONTENT_LEN || TCP_WND < MBEDTLS_SSL_OUT_CONTENT_LEN) {\n LWIP_DEBUGF(ALTCP_MBEDTLS_DEBUG|LWIP_DBG_LEVEL_SERIOUS,\n@@ -840,7 +841,7 @@ altcp_tls_create_config(int is_server, u8_t cert_count, u8_t pkey_count, int hav\n altcp_mbedtls_free_config(conf);\n return NULL;\n }\n- mbedtls_ssl_conf_authmode(&conf->conf, ALTCP_MBEDTLS_AUTHMODE);\n+ mbedtls_ssl_conf_authmode(&conf->conf, authmode);\n \n mbedtls_ssl_conf_rng(&conf->conf, mbedtls_ctr_drbg_random, &altcp_tls_entropy_rng->ctr_drbg);\n #if ALTCP_MBEDTLS_LIB_DEBUG != LWIP_DBG_OFF\ndiff --git a/lib/lwip/lwip/src/include/lwip/apps/altcp_tls_mbedtls_opts.h b/lib/lwip/lwip/src/include/lwip/apps/altcp_tls_mbedtls_opts.h\nindex e41301c061c..71aa5993935 100644\n--- a/lib/lwip/lwip/src/include/lwip/apps/altcp_tls_mbedtls_opts.h\n+++ b/lib/lwip/lwip/src/include/lwip/apps/altcp_tls_mbedtls_opts.h\n@@ -100,12 +100,6 @@\n #define ALTCP_MBEDTLS_SESSION_TICKET_TIMEOUT_SECONDS (60 * 60 * 24)\n #endif\n \n-/** Certificate verification mode: MBEDTLS_SSL_VERIFY_NONE, MBEDTLS_SSL_VERIFY_OPTIONAL (default),\n- * MBEDTLS_SSL_VERIFY_REQUIRED (recommended)*/\n-#ifndef ALTCP_MBEDTLS_AUTHMODE\n-#define ALTCP_MBEDTLS_AUTHMODE MBEDTLS_SSL_VERIFY_OPTIONAL\n-#endif\n-\n #endif /* LWIP_ALTCP */\n \n #endif /* LWIP_HDR_ALTCP_TLS_OPTS_H */\n", "prefixes": [ "v2", "2/6" ] }