summaryrefslogtreecommitdiff
path: root/net/lwip
AgeCommit message (Collapse)Author
2026-02-06net: lwip: wget: rework the '#' printingMarek Vasut
Currently, the LWIP wget command prints excessive amount of progress indicator '#' for very long file downloads, limit this to one line that scales according to transfer size. The HTTP server does report the size of the entire file in protocol headers, which are received before the actual data transfer. Cache this information and use it to adaptively print progress indicator '#' until it fills one entire line worth of '#', which indicates the transfer has completed. This way, long transfers don't print pages of '#', but every transfer will print exactly one line worth of '#'. The algorithm for '#' printing is the same as TFTP tsize one. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Acked-by: Jerome Forissier <jerome.forissier@rm.com>
2026-02-06net: lwip: tftp: add support of tsize option to clientMarek Vasut
The TFTP server can report the size of the entire file that is about to be received in the Transfer Size Option, this is described in RFC 2349. This functionality is optional and the server may not report tsize in case it is not supported. Always send tsize request to the server to query the transfer size, and in case the server does respond, cache that information locally in tftp_state.tsize, otherwise cache size 0. Introduce new function tftp_client_get_tsize() which returns the cached tftp_state.tsize so clients can determine the transfer size and use it. Update net/lwip/tftp.c to make use of tftp_client_get_tsize() and avoid excessive printing of '#' during TFTP transfers in case the transfer size is reported by the server. Submitted upstream: https://savannah.nongnu.org/patch/index.php?item_id=10557 Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Acked-by: Jerome Forissier <jerome.forissier@arm.com>
2026-02-04net: lwip: nfs: Prefer nfsserverip over serverip when setJonas Karlman
Prefer use of a 'nfsserverip' env var before falling back to 'serverip' when using the nfs command. Similar to how the 'tftpserverip' env var is preferred over 'serverip' by the tftp command. This also updates the error message to closer match the error message used by the lwIP tftp command when a server ip is not set. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-02-04net: lwip: dhcp: Save DHCP siaddr field to tftpserverip env varJonas Karlman
The DHCP siaddr field contains the IP address of next server to use in bootstrap. Typically this will be the IP address of a TFTP server or the IP address of the DHCP server itself. RFC 2131, 2. Protocol Summary, Page 10: DHCP clarifies the interpretation of the 'siaddr' field as the address of the server to use in the next step of the client's bootstrap process. A DHCP server may return its own address in the 'siaddr' field, if the server is prepared to supply the next bootstrap service (e.g., delivery of an operating system executable image). A DHCP server always returns its own address in the 'server identifier' option. Set the 'tftpserverip' env variable when the siaddr field contains an IP address that is different compared to the DHCP server IP address. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-02-04net: lwip: Use ipaddr helpersJonas Karlman
The ip_addr_t of lwIP has support for both IPv6 and IPv4 addresses. Some lwIP commans is directly accessing the internal addr field of the ip_addr_t instead of using ipaddr helper functions. Change to use ipaddr helper functions where appropriate to remove direct access of the internal addr field. Also change a few instances from ip4 to the version less ipaddr helpers. There is no intended functional change, besides the change from using ip4 addr helper to using version less ipaddr helper. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-02-04net: lwip: dns: Call env_set() from dns loop instead of found callbackJonas Karlman
The lwIP dns command handle env_set() calls from the found callback and printf() to console in the dns loop. Making it more complex than it needs to be. Simplify and ensure any environment variable that is being set is the same value that would have been printed on console. There should not be any intended change in behavior, besides the change from using ip4addr helper to using version less ipaddr helper. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-02-04net: lwip: nfs: Print device name based on current udeviceJonas Karlman
Use udevice name, similar to other lwip commands, instead of using the legacy eth_get_name() when printing out the device being used. Fixes: 230cf3bc2776 ("net: lwip: nfs: Port the NFS code to work with lwIP") Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-02-04net: lwip: dns: Fix print of resolved IP addressJonas Karlman
The lwIP dns command only prints out cached resolved IP addresses. When a hostname is first resolved and ERR_INPROGRESS is returned the dns command prints out 0.0.0.0 instead of the resolved IP address. Fix this by printing out host_ipaddr instead of the temporary ipaddr that only is valid when ERR_OK is returned. Fixes: 1361d9f4f00a ("lwip: dns: do not print IP address when a variable is specified") Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-02-04net: lwip: add TFTPSERVERIP Kconfig optionJonas Karlman
With the legacy networking stack, it is possible to use USE_SERVERIP, SERVERIP and BOOTP_PREFER_SERVERIP Kconfg options to force use of a specific TFTP server ip. Using the lwIP networking stack use of the 'tftpserverip' environment variable provide the closest equivalent functionality. Add USE_TFTPSERVERIP and TFTPSERVERIP Kconfig options that can be used to add the 'tftpserverip' environment variable to force use of a specific TFTP server ip. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Acked-by: Jerome Forissier <jerome.forissier@arm.com>
2026-02-04net: lwip: dhcp: Do not write past end of bufferAndrew Goodbody
sprintf will write a trailing \0 at the end of the string so when writing into a buffer, that buffer must be sized to allow for that trailing zero. In the DHCP code when the index is a number needing two digits to express the index would use up the two \0 bytes in the buffer and the trailing \0 from sprintf would be beyond the end of the allocation. Fix this by adding a third \0 in the buffer. This was found by code inspection when looking for an issue reported by Michal Simek, but I do not have the hardware to reproduce, so cannot confirm if this addresses that issue or not. Fixes: 98ad145db61a ("net: lwip: add DHCP support and dhcp commmand") Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Reviewed-by: Jerome Forissier <jerome.forissier@arm.com>
2026-01-15net: lwip: nfs: Port the NFS code to work with lwIPAndrew Goodbody
After the preparatory patches moved most of the NFS code into common files we now add the code to enable NFS support with lwIP. Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
2026-01-15net: Move some variables to net-common filesAndrew Goodbody
Make some variables available to be used by either the legacy network code or lwIP by moving them into the net-common files. This also allowed removing a small number of duplicated variables from the lwIP code. Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2026-01-15net:lwip: Add debug line to net-lwipAndrew Goodbody
When debugging the LWIP NFS implementation this debug line helped to show the cause of an error. This could be useful to someone in the future. Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-12-18net: lwip: tftp: Fix filename handlingAndrew Goodbody
The code to choose the filename to use does not cope with no name set at all. Firstly the test for a name in net_boot_file_name tests the pointer rather than the string it points to. Secondly the cleanup on exit in this case attempts to free a global variable. Fix both issues. Signed-off-by: Andrew Goodbody <andrew.goodbody@linaro.org> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-10-22net: make dhcp_run() common for NET and NET_LWIPJerome Forissier
There are currently two implementations of dhcp_run(): one in cmd/net.c for NET and one in net/lwip/dhcp.c for NET_LWIP. There is no justification for that. Therefore, move the NET version into net/net-common.c to be used by both stacks, and drop the NET_LWIP version which by the way does not look totally correct. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Suggested-by: Tom Rini <trini@konsulko.com> Acked-by: Benjamin Hahn <B.Hahn@phytec.de>
2025-09-30net: lwip: ensure alignment of packet buffersTim Harvey
Network packet buffers should be aligned to PKTALIGN. Add a compiler attribute to ensure this. Signed-off-by: Tim Harvey <tharvey@gateworks.com> [jf: use __aligned(x) from <linux/compiler_attributes.h>] Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-09-30net: lwip: dhcp: set ntpserverip environment variableJerome Forissier
Once the DHCP exchange is complete, if we have an IP address for an NTP server, set the ntpserverip environment variable accordingly. Although not necessary to make the sntp command use that server (since it is known internally to the lwIP stack), this makes the behavior in line with the legacy NET stack. This is also consistent with exporting the DNS servers etc. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Suggested-by: Michal Simek <michal.simek@amd.com>
2025-09-30net: lwip: dhcp: make NTP servers usable by the sntp commandJerome Forissier
When both CMD_DHCP and CMD_SNTP are enabled, one would expect the NTP servers received by DHCP to be used by the sntp command by default. Fix dhcp_loop() so that it is indeed the case. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reported-by: Michal Simek <michal.simek@amd.com>
2025-08-18net: lwip: ping: set net_try_count to 1Jerome Forissier
The legacy network stack sets net_try_count to 1 at the beginning of the net_loop() function. This is required for net_start_again() to work properly. Therefore, set the variable accordingly in the do_ping() function when NET_LWIP=y. This fixes an issue where a ping to an unreachable destination would run twice on the same network device. For example with qemu_arm64_lwip_defconfig: => dhcp DHCP client bound to address 10.0.2.15 (3 ms) => ping 10.0.0.1 Using virtio-net#32 device ping failed; host 10.0.0.1 is not alive Using virtio-net#32 device ping failed; host 10.0.0.1 is not alive => QEMU: Terminated Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-08-18net: introduce CONFIG_DNSJerome Forissier
Introduce the DNS Kconfig symbol so that various network commands may use host names without the dns command (CMD_DNS) being selected. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> CC: E Shattow <e@freeshell.de>
2025-08-18net: lwip: add Kconfig option to show ICMP unreachable errorsJerome Forissier
Add Kconfig symbol LWIP_ICMP_SHOW_UNREACH which, when enabled, prints a message to the console upon reception of ICMP unreachable messages. For example: $ make qemu_arm64_lwip_defconfig $ qemu-system-aarch64 -M virt -cpu max -nographic -bios u-boot.bin [...] => dhcp DHCP client bound to address 10.0.2.15 (0 ms) => tftp 192.168.0.100:69:Image Using virtio-net#32 device TFTP from server 192.168.0.100; our IP address is 10.0.2.15 Filename 'Image'. Load address: 0x40200000 Loading: ICMP destination unreachable (host unreachable) from 192.168.0.16 Timeout! => tftp 192.168.0.16:69:Image Using virtio-net#32 device TFTP from server 192.168.0.16; our IP address is 10.0.2.15 Filename 'Image'. Load address: 0x40200000 Loading: ICMP destination unreachable (port unreachable) from 192.168.0.16 Timeout! => Submitted upstream as https://github.com/lwip-tcpip/lwip/pull/73. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-08-01net: lwip: remove eth_init from net_init as it is called laterTim Harvey
The call to eth_init within net_init causes the network interface to start, stop, start again which can cause issues with certain network device drivers. Remove it to make it behave like the legacy network path. Fixes: 5666865decb8 ("net: lwip: fix initialization sequence before a command") Signed-off-by: Tim Harvey <tharvey@gateworks.com> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-08-01net: lwip: simplify net_lwip_eth_startTim Harvey
For NET_LWIP eth_is_on_demand_init() is always 1 so remove the check and simplify the code. Suggested-by: Jerome Forissier <jerome.forissier@linaro.org> Signed-off-by: Tim Harvey <tharvey@gateworks.com> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08lwip: add net_lwip_dns_resolve()Jerome Forissier
Add a helper fonction to convert an IP address (supplied as a text string) or a host name to an ip_addr_t. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08lwip: split net/lwip/wget.cJerome Forissier
Split net/lwip/wget.c in two: one part which implements CONFIG_WGET stays in net/ while the part that implements CONFIG_CMD_WGET is moved into cmd/. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08lwip: move net/lwip/ping.c to cmd/lwipJerome Forissier
Prepare to split the ping command from cmd/net-lwip.c by moving the implementation from net/lwip/dns.c to cmd/lwip. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08lwip: move net/lwip/dns.c to cmd/lwipJerome Forissier
Prepare to split the dns command from cmd/net-lwip.c by moving the implementation from net/lwip/dns.c to cmd/lwip. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08lwip: remove net/lwip/eth_internal.hJerome Forissier
net/lwip/eth_internal.h is not used. Remove it. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08net: lwip: wget: initialize dns if a hostname is used in a URLTim Harvey
Initialize dns servers if a hostname (vs ipaddr) is used in a URL. Otherwise the wget will fail without displaying an error due to dns_gethostbyname failing silently when no DNS servers are set unless you have previously performed a 'dns <arg>' command. Signed-off-by: Tim Harvey <tharvey@gateworks.com> Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08net: lwip: move dns init to common functionTim Harvey
move the dns init including setting the dns servers from env vars to a common function as other commands that support hostname lookups will need this. Signed-off-by: Tim Harvey <tharvey@gateworks.com> [jf: add CMD_DNS conditional to support NET_LWIP && !CMD_DNS] Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08net: lwip: tftp: add support for setting blocksize at runtimeTim Harvey
Add support for setting the blocksize at runtime via the tftpblocksize env variable as such is done with the legacy stack (CONFIG_NET). Signed-off-by: Tim Harvey <tharvey@gateworks.com> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-07-08net: lwip: call sys_check_timeouts and schedule on rxTim Harvey
Call schedule() in net_lwip_rx() to service U-Boot tasks and actions during packet rx. As a cleanup also move sys_check_timeouts() here and remove it from the functions that call net_lwip_rx(). This resolves the issue of an active watchdog resetting the board on long network activities. Suggested-by: Jerome Forissier <jerome.forissier@linaro.org> Signed-off-by: Tim Harvey <tharvey@gateworks.com> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-05-29Merge patch series "Remove <env.h> from <net.h>"Tom Rini
Tom Rini <trini@konsulko.com> says: Hey all, This is a v3 of Simon's series[1] and depends on the series[2] I posted the other day that removes <env.h> from <command.h>. With this series done, I believe we've tackled all of the current cases of headers which include <env.h> without directly needing it. Much of this series is in fact Simon's v2 with the main differneces being: - Removing <env.h> from <net.h> at the end - Removing env_to_ip() given how little it's used rather than shuffling around where it's declared and un-inline'ing it. For a rarely used helper, this ends up being cleaner I think. Especially looking at some of the users (which called env_get repeatedly). If there's strong opinion here about using the other method[3] we can do that instead. - Setting aside for now how to handle CMD_ELF=y and NO_NET=y because today it's actually fine as we unconditionally build lib/net_utils.c where string_to_ip() is defined. I'm unsure if a further series is warranted here or not. We rely on link-time optimization to keep code readable too. [1]: https://lore.kernel.org/all/20250501010456.3930701-1-sjg@chromium.org [2]: https://lore.kernel.org/all/20250514225002.15361-1-trini@konsulko.com [3]: https://lore.kernel.org/all/20250501010456.3930701-23-sjg@chromium.org Link: https://lore.kernel.org/r/20250515234154.1859366-1-trini@konsulko.com
2025-05-29global: Avoid indirect inclusion of <env.h> from <net.h>Tom Rini
Now that env_get_ip() has been removed, the include file <net.h> does not need anything from <env.h>. Furthermore, include/env.h itself includes other headers which can lead to longer indirect inclusion paths. To prepare to remove <env.h> from <net.h> fix all of the remaining places which had relied on this indirect inclusion to instead include <env.h> directly. Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org> # net/lwip Acked-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Reviewed-by: Wolfgang Wallner <wolfgang.wallner@br-automation.com> Reviewed-by: Martyn Welch <martyn.welch@collabora.com> Signed-off-by: Tom Rini <trini@konsulko.com>
2025-05-20net: lwip: tftp: time out if there is no reply from serverJerome Forissier
When there is no reply from the TFTP server, do_tftpb() should eventually time out. Add a 10 second timer for that purpose. Reported-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com> Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-05-20net-lwip: tftp: add LMB and buffer checksJerome Forissier
Legacy NET tftp invokes a store_block() function which performs buffer validation (LMB, address wrapping). Do the same with NET_LWIP. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Suggested-by: Sughosh Ganu <sughosh.ganu@linaro.org> Acked-by: Sughosh Ganu <sughosh.ganu@linaro.org> Tested-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2025-05-20net-lwip: wget: add LMB and buffer checksJerome Forissier
Legacy NET wget invokes a store_block() function which performs buffer validation (LMB, address wrapping). Do the same with NET_LWIP. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Suggested-by: Sughosh Ganu <sughosh.ganu@linaro.org> Acked-by: Sughosh Ganu <sughosh.ganu@linaro.org> Tested-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2025-05-20net, net-lwip: wget: suppress console output when called by EFIJerome Forissier
Functions called from EFI applications should not do console output. Refactor the wget code to implement this requirement. The wget_http_info struct is used to hold the boolean that signifies whether the output is allowed or not. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reported-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
2025-05-20net-lwip: change static function wget_loop() to be wget_do_request()Jerome Forissier
wget_do_request() currently does so little before calling the static function wget_loop() that we may as well rename wget_loop() to wget_do_request() and put everything in one function. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Acked-by: Sughosh Ganu <sughosh.ganu@linaro.org>
2025-04-23net: lwip: use timer_early_get_count() when CONFIG_SANDBOX_TIMER=yJerome Forissier
When the sandbox timer is available, use it. This allows skipping time in the tests (sandbox_eth_skip_timeout()). Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Simon Glass <sjg@chromium.org>
2025-04-23net: lwip: add restart support to pingJerome Forissier
Use net_start_again() in do_ping() to determine if a failed ping should be restarted on a different interface. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Simon Glass <sjg@chromium.org>
2025-04-23net: lwip: provide net_start_again()Jerome Forissier
Implement net_start_again() when NET_LWIP=y in a very similar way to NET. This will be used in a future commit to determine if a failed ping needs to be tried again on a different interface. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Simon Glass <sjg@chromium.org>
2025-04-23net: lwip: fix initialization sequence before a commandJerome Forissier
The things that are done prior to executing a network command with NET_LWIP are not consistent with what is done with NET. It impacts the selection of the current device, and more precisely if the active device is invalid NET would return an error while NET_LWIP would try to pick a new device. This incorrect behavior was detected thanks to the eth_rotate sandbox test (dm_test_eth_rotate()). Fix it by re-using a sequence similar to what NET has in net_loop(). This piece of code is inserted in a function called net_lwip_eth_start() renamed from net_lwip_eth_set_current(). Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Simon Glass <sjg@chromium.org>
2025-04-11Merge patch series "Switch to using $(PHASE_) in Makefiles"Tom Rini
Tom Rini <trini@konsulko.com> says: This series switches to always using $(PHASE_) in Makefiles when building rather than $(PHASE_) or $(XPL_). It also starts on documenting this part of the build, but as a follow-up we need to rename doc/develop/spl.rst and expand on explaining things a bit. Link: https://lore.kernel.org/r/20250401225851.1125678-1-trini@konsulko.com
2025-04-11Kbuild: Always use $(PHASE_)Tom Rini
It is confusing to have both "$(PHASE_)" and "$(XPL_)" be used in our Makefiles as part of the macros to determine when to do something in our Makefiles based on what phase of the build we are in. For consistency, bring this down to a single macro and use "$(PHASE_)" only. Signed-off-by: Tom Rini <trini@konsulko.com>
2025-04-08Merge branch 'next'Tom Rini
Note that this undoes the changes of commit cf6d4535cc4c ("x86: emulation: Disable bloblist for now") as that was intended only for the release due to time.
2025-03-31net: lwip: Remove error print on failed txIlias Apalodimas
When an ethernet driver fails to send a frame we print an error in lwIP. But depending on how often that error is it might significantly delay transmissions. For example downloading a big file with the rpi4 spams the console with 'send error: -101', but removing the print makes the file download with an average speed of ~8.5MiB/s since the packets are retransmitted. So let's move it to a 'debug' in lwIP and expect ethernet drivers to handle the failure if it's severe. Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org> Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
2025-03-31net: lwip: do_ping() should return CMD_RET_FAILURE when no deviceJerome Forissier
do_ping() expects ping_loop() to return a negative value on error, so that it can propagate it to the caller as CMD_RET_FAILURE. This is not the case when no ethernet device is found, so fix that. Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2025-03-11net: lwip: add support for built-in root certificatesJerome Forissier
Introduce Kconfig symbols WGET_BUILTIN_CACERT and WGET_BUILTIN_CACERT_PATH to provide root certificates at build time. Usage example: wget -O cacert.crt https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt make qemu_arm64_lwip_defconfig echo CONFIG_WGET_BUILTIN_CACERT=y >>.config echo CONFIG_WGET_BUILTIN_CACERT_PATH=cacert.crt >>.config make olddefconfig make -j$(nproc) CROSS_COMPILE="ccache aarch64-linux-gnu-" qemu-system-aarch64 -M virt -nographic -cpu max \ -object rng-random,id=rng0,filename=/dev/urandom \ -device virtio-rng-pci,rng=rng0 -bios u-boot.bin => dhcp # HTTPS transfer using the builtin CA certificates => wget https://digicert-tls-ecc-p384-root-g5.chain-demos.digicert.com/ 1867 bytes transferred in 1 ms (1.8 MiB/s) Bytes transferred = 1867 (74b hex) Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
2025-03-11net: lwip: extend wget to support CA (root) certificatesJerome Forissier
Add the "cacert" (Certification Authority certificates) subcommand to wget to pass root certificates to the code handling the HTTPS protocol. The subcommand is enabled by the WGET_CACERT Kconfig symbol. Usage example: => dhcp # Download some root certificates (note: not authenticated!) => wget https://cacerts.digicert.com/DigiCertTLSECCP384RootG5.crt # Provide root certificates => wget cacert $fileaddr $filesize # Enforce verification (it is optional by default) => wget cacert required # Forget the root certificates => wget cacert 0 0 # Disable verification => wget cacert none Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org> Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>