u-boot.git/lib/lwip, branch v2025.07

net, net-lwip: wget: suppress console output when called by EFI

2025-05-20T13:43:08Z

Functions called from EFI applications should not do console output. Refactor the wget code to implement this requirement. The wget_http_info struct is used to hold the boolean that signifies whether the output is allowed or not. Signed-off-by: Jerome Forissier Reported-by: Heinrich Schuchardt

Kbuild: Always use $(PHASE_)

2025-04-11T18:16:44Z

It is confusing to have both "$(PHASE_)" and "$(XPL_)" be used in our Makefiles as part of the macros to determine when to do something in our Makefiles based on what phase of the build we are in. For consistency, bring this down to a single macro and use "$(PHASE_)" only. Signed-off-by: Tom Rini

lwip: tls: warn when no CA exists amd log certificate validation errors

2025-03-11T13:16:03Z

Using HTTPS without root (CA) certificates is a security issue. Print a warning in this case. Also, when certificate verification fail, print an additional message because "HTTP client error 4" is not very informative (4 is HTTPC_RESULT_ERR_CLOSED). Signed-off-by: Jerome Forissier Reviewed-by: Ilias Apalodimas

lwip: tls: enforce checking of server certificates based on CA availability

2025-03-11T13:16:03Z

Instead of relying on some build time configuration to determine if server certificates need to be checked against CA certificates, do it based on the availability of such certificates. If no CA is configured then no check can succeed; on the other hand if we have CA certs then we should not ignore them. It is always possible to remove the CA certs (via 'wget cacert 0 0') to force an HTTPS download that would fail certificate validation. Signed-off-by: Jerome Forissier Reviewed-by: Ilias Apalodimas

net: use strnstr() for lwip_strnstr()

2025-02-12T18:37:19Z

Using strstr() instead of strnstr() creates a security concern. Fixes: 1c41a7afaa15 ("net: lwip: build lwIP") Signed-off-by: Heinrich Schuchardt Reviewed-by: Jerome Forissier Reviewed-by: Ilias Apalodimas Signed-off-by: Jerome Forissier

net: lwip: tftp: fix find_option()

2025-02-12T18:37:05Z

Find_option() is used to retrieve the block size value in an option acknowledgment in response to a request containing a block size option according to RFC2348. The format of an OACK response is described in RFC2347 as +-------+---~~---+---+---~~---+---+---~~---+---+---~~---+---+ | opc | opt1 | 0 | value1 | 0 | optN | 0 | valueN | 0 | +-------+---~~---+---+---~~---+---+---~~---+---+---~~---+---+ The current implementation of find_option() only works if * blksize is the first option * lwip_strnstr() ignores the length parameter, i.e. is implemented via strstr() The OACK messages starts with 0x00 0x06. If 'blksize' is the first option, strstr() reports a match when the first parameter points to 0x06. Adding the string length of 'blksize' plus 2 to the location of the 0x06 byte points to the value. Find_option() would report a match for option 'blksize' if the response contained an option called 'foo_blksize_bar'. In this case find_option() would return 'bar' as the value string. If 'blksize' were the second option, find_option() would return a pointer to the second character of the value string. Furthermore find_option() does not detect if the value string is NUL terminated. This may lead to a buffer overrun. Provide an implementation that correctly steps from option to option. Fixes: 27d7ccda94fa ("net: lwip: tftp: add support of blksize option to client") Signed-off-by: Heinrich Schuchardt Reviewed-by: Jerome Forissier Tested-by: Jerome Forissier (qemu_arm64_lwip) Signed-off-by: Jerome Forissier

mbedtls: remove MBEDTLS_HAVE_TIME

2024-12-06T23:47:23Z

When MbedTLS TLS features were added MBEDTLS_HAVE_TIME was defined as part of enabling https:// support. However that pointed to the wrong function which could crash if it received a NULL pointer. Looking closer that function is not really needed, as it only seems to increase the RNG entropy by using 4b of the current time and date. The reason that was enabled is that lwIP was unconditionally requiring it, although it's configurable and can be turned off. Since lwIP doesn't use that field anywhere else, make it conditional and disable it from our config. Fixes: commit a564f5094f62 ("mbedtls: Enable TLS 1.2 support") Reported-by: Heinrich Schuchardt Signed-off-by: Ilias Apalodimas Reviewed-by: Heinrich Schuchardt Acked-by: Jerome Forissier

net: disable MBEDTLS in SPL

2024-12-06T23:47:23Z

Building SPL fails with MBEDTLS enabled. Currently we don't need it there. Signed-off-by: Heinrich Schuchardt Acked-by: Jerome Forissier

lwip: fix code style issues

2024-11-15T00:14:05Z

Fix various code style issues in the lwIP code. Reported-by: Tom Rini Signed-off-by: Jerome Forissier Acked-by: Ilias Apalodimas

net: lwip: Add Support Server Name Indication support

2024-11-13T01:09:52Z

SNI, or Server Name Indication, is an addition to the TLS encryption protocol that enables a client device to specify the domain name it is trying to reach in the first step of the TLS handshake, preventing common name mismatch errors and not reaching to HTTPS server that enforce this condition. Since most of the websites require it nowadays add support for it. It's worth noting that this is already sent to lwIP [0] [0] https://github.com/lwip-tcpip/lwip/pull/47 Signed-off-by: Javier Tia Reviewed-by: Jerome Forissier Signed-off-by: Ilias Apalodimas