Skip to content

Update certificates for RSA-3072 support with NRF security #3045

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 30 commits into
base: main
Choose a base branch
from
Open

Update certificates for RSA-3072 support with NRF security #3045

wants to merge 30 commits into from

Conversation

rado17
Copy link
Contributor

@rado17 rado17 commented Jul 14, 2025

No description provided.

@NordicBuilder NordicBuilder mentioned this pull request Jul 14, 2025
Open
@krish2718
Copy link
Contributor

Why do we still need this noup, it was done last time as were in the release rush. If the certs from upstream don't work out-of-box then we can submit a variant that works out-of-box for nRF platforms.

@rado17
Copy link
Contributor Author

rado17 commented Jul 14, 2025 •
edited
Loading

Why do we still need this noup, it was done last time as were in the release rush. If the certs from upstream don't work out-of-box then we can submit a variant that works out-of-box for nRF platforms.

Nordic specific directory in upstream certs then? RSA-3k certs work fine, but we may have to enable additional configs for RSA-2k certs from upstream.
Also, for MBEDTLS_HEAP_SIZE, the increase is required only with downstream. So, I think, noup is justified for that commit.

@krish2718
Copy link
Contributor

Nordic specific directory in upstream certs then? RSA-3k certs work fine, but we may have to enable additional configs for RSA-2k certs from upstream.

I would put a algo specific directory e.g., rsa2k-no-ebc3, this way it can be reused in case other platforms have similar constraints.

Also, for MBEDTLS_HEAP_SIZE, the increase is required only with downstream. So, I think, noup is justified for that commit.

We don't want to rely on noup unless its absolutely must, why can't we add <increased_heap> if SOC_FAMILY_NORDIC_NRF to upstream?

@rado17
Copy link
Contributor Author

rado17 commented Jul 14, 2025

Nordic specific directory in upstream certs then? RSA-3k certs work fine, but we may have to enable additional configs for RSA-2k certs from upstream.

I would put a algo specific directory e.g., rsa2k-no-ebc3, this way it can be reused in case other platforms have similar constraints.

Also, for MBEDTLS_HEAP_SIZE, the increase is required only with downstream. So, I think, noup is justified for that commit.

We don't want to rely on noup unless its absolutely must, why can't we add <increased_heap> if SOC_FAMILY_NORDIC_NRF to upstream?

Let me check this.

@rado17
Revert "[nrf noup] samples: net: wifi: Update certificates"
5d89afd 
This reverts commit 0d44bac.

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
@github-actions GitHub Actions
Copy link

github-actions bot commented Jul 14, 2025 •
edited
Loading

The following west manifest projects have changed revision in this Pull Request:

Name Old Revision New Revision Diff
hostap zephyrproject-rtos/hostap@8412f4b zephyrproject-rtos/hostap@e942f86 (main) zephyrproject-rtos/hostap@8412f4b2..e942f86e
nrf_wifi zephyrproject-rtos/nrf_wifi@936b502 zephyrproject-rtos/nrf_wifi@5f59c23 (main) zephyrproject-rtos/nrf_wifi@936b502c..5f59c233

✅ All manifest checks OK

Note: This message is automatically posted and updated by the Manifest GitHub Action.

rado17 and others added 15 commits July 15, 2025 01:32
@rado17 @krish2718
[nrf fromlist] snippets: wifi-enterprise: Increase MBEDTLS heap size
c69c7ae 
With NRF security, higher heap requirement is seen for operating
with RSA-3072 based certificates. Add a NRF SoC specific conf in
snippets to handle this.

Upstream PR #: 93096

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
@rado17 @krish2718
[nrf fromlist] samples: net: wifi: Add AES-only certificates
2ae135b 
Add AES-only cipher certificates. Useful for systems which
have only AES support and DES is not enabled.

Upstream PR #: 93096

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
@krish2718
Revert "[nrf fromtree] modules: nrf_wifi: Implement new Raw TX APIs"
1962184 
This reverts commit 366f234.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@kartben @krish2718
[nrf fromtree] drivers: nrf_wifi: put driver ops in flash
0198849 
Add const qualifiers to the driver ops to save on RAM usage.

Signed-off-by: Benjamin Cabé <benjamin@zephyrproject.org>
(cherry picked from commit 8d6316c)
@krish2718
[nrf fromtree] modules: nrf_wifi: Improve power down sequence
b6baae0 
Swap the order, IOVDD should be powered first and then BUCKEN.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit 9cd933e)
@krish2718
[nrf fromtree] modules: nrf_wifi: Remove co-ex GPIOs first
de70a92 
Before powering off remove co-ex GPIOs.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit 2b0876c)
@krish2718
[nrf fromtree] modules: nrf_wifi: Implement QSPI deinit
377ad9d 
By default QSPI is uninitialized after every transaction, so, deinit is
a no-op, but if QSPI_LOW_POWER is disabled, then we need to uninitialize
the QSPI in the deinit.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit 4eb7b9f)
@krish2718
[nrf fromtree] modules: nrf_wifi: Implement SPI deinit
6e96327 
Release the SPI during the deinit to put respective GPIOs in low-power
state or disconnected.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit 945ddf0)
@rado17 @krish2718
[nrf fromtree] drivers: wifi: Introduce option to use K_HEAP
32dc2ed 
Provide option to revert to K_HEAP instead of using
dedicated heaps in Wi-Fi driver.

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
(cherry picked from commit 11a3969)
@krish2718
[nrf fromtree] modules: nrf_wifi: Fix interface down hang
dbeacd7 
When QSPI LPM is enabled, QSPI will already be uninitialized, and during
deinit if uninitialized is being called again then it leads to a hang as
it waits for mem busy check to pass which it won't.

Fix by checking if the device is initialized before calling
uninitialize.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit 1fb2c56e86f2518b67ed56bae1736396afd791c6)
@krish2718
[nrf fromtree] modules: nrf_wifi: Fix accuracy of microseconds API
2231002 
Using ms and converting to us is a bad idea as we still get ms
granualrity in us units. Use the proper API to get us granularity.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit 54573e2a678e607a1367438637bddc0d0ced66ee)
@krish2718
[nrf fromtree] wifi: nrf70: Fix system work queue stack size override
929993c 
Defaults cannot be overidden (even with configdefault extension), they
only work if the original symbol is defined after the override e.g.,
"drivers and then subsys/net" but for kernel symbols,the default value
overrides don't work due "kernel and drivers" order, the kernel defines
the original symbol with the default and then it cannot be overridden.

Move the kernel symbol override to the original definition to make it
affect. Else any sample that uses nRF70 but doesn't enable WPA
supplicant ends up with 1024 and crashes.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit 4bd1d39c67dfb4860fbd4f9ccc17e084aa32d763)
@krish2718
[nrf fromtree] drivers: nrf_wifi: Fix TX drop statistics
4c5e962 
In case FMAC API fails, increment the TX drop counter, helpful in
debug.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit e728f804165e9f8ceb578af2b632aabe530828d7)
@moonlight83340 @krish2718
[nrf fromtree] drivers: wifi: nrf_wifi: wifi_mgmt: remove redundant n…
27a9e1a 
…ull check

Deleted a redundant check for 'rpu_ctx_zep' pointer after it was already
dereferenced.

Clarifies code logic in nrf_wifi_get_power_save_config function.

Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
(cherry picked from commit bac20e419eabf36625c073a366008f1384fcc272)
@krish2718
[nrf fromtree] modules: nrf_wifi: Implement new Raw TX APIs
8db32c5 
The new raw TX handling relies on these APIs, so, implement them for
Zephyr shim.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit b8d31f10d9e7052bbcdad7f68522340d8af17399)
krish2718 and others added 14 commits July 15, 2025 01:41
@krish2718
Revert "[nrf fromlist] manifest: Update nrf_wifi SHA to remove sta mo…
79f1cd2 
…de from monitor"

This reverts commit 926fafb.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@krish2718
[nrf fromtree] manifest: nrf_wifi: Pull fix for raw TX memory leak
a428b5f 
Fixes memory leak seen during continuous raw TX transmission.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit d5c7cb171b21049758f2907ec4b5a85ac73b43eb)
@Qingling-Wu @krish2718
[nrf fromtree] manifest: hostap: sync for coverity fix
0ca446f 
sync for coverity fix in hostap

Signed-off-by: Qingling Wu <qingling.wu@nxp.com>
(cherry picked from commit f089959)
@jukkar @krish2718
[nrf fromtree] manifest: Use k_fifo for IPC in hostap
9543530 
Make sure to use k_fifo for IPC in hostap to save memory.

Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
(cherry picked from commit 03ad3a32a27da098fc697376e2932c36b85c3509)
@krish2718
[nrf fromtree] manifest: hostap: Pull fix for warning in interface down
58a963b 
Fix a warning seen during interface down.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit a869c3e3a31afa893a8c88f8761f8f206769ee27)
@krish2718
Revert "[nrf fromlist] net: wifi: shell: Enable Wi-Fi credentials sup…
ba84b9d 
…port"

This reverts commit e2f9c7b.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
@rado17 @krish2718
[nrf fromtree] net: wifi: shell: Enable Wi-Fi credentials support
85742ab 
Add a snippet for Wi-Fi credentials support. Update the heap sizes as
required for enterprise mode.

Signed-off-by: Ravi Dondaputi <ravi.dondaputi@nordicsemi.no>
(cherry picked from commit 4c14c618f69e8ae0d5ee95a6abbc8a1d5f89afac)
@jukkar @krish2718
[nrf fromtree] hostap: Replace wifi event mechanism by k_fifo
48a8c50 
Earlier we had socketpair to pass wifi event information from
wpa_supplicant side to zephyr adaption layer. This is now replaced
by k_fifo to save some RAM.

Signed-off-by: Jukka Rissanen <jukka.rissanen@nordicsemi.no>
(cherry picked from commit 96818f45a91472cb0eabd5cfe42b5b256860f6a5)
@krish2718
[nrf fromtree] modules: hostap: Fix EAP dependencies
0c6680f 
In case anyone enabled EAP_*_ALL explicitly without enabling the
Enterprise then it leads to a build error.

Fix by adding the dependency.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
(cherry picked from commit 014dee722bcd63391e4a6b95a5f82bf8bc8fa580)
@JordanYates @krish2718
[nrf fromtree] modules: hostap: fix connection termination report
2ca3fdb 
If the disconnect event is raised before the network has been connected,
report the connection result as `WIFI_STATUS_CONN_FAIL`, instead of as
`WIFI_REASON_DISCONN_SUCCESS`, which is interpretted as
`WIFI_STATUS_CONN_SUCCESS`.

Signed-off-by: Jordan Yates <jordan@embeint.com>
(cherry picked from commit 9245f58b4ccf32b261341fdfc09e993b7eba74f0)
@ceolin @krish2718
[nrf fromtree] hostap: Set enterprise crypto insecure
dc431e3 
Set enterprise crypto insecure because certifcate validation
is disabled.

Signed-off-by: Flavio Ceolin <flavio@hubblenetwork.com>
(cherry picked from commit 979fcc0b6e57f0a41ee84ea89045744825c977b1)
@moonlight83340 @krish2718
[nrf fromtree] modules: hostap: supp_api: Fix possible null deference
94d7151 
Ensure 'params' is not NULL before accessing its fields.

Prevents possible null pointer dereference when calling
strlen(params->ssid).

Delay access to ssid->ssid and ssid->ssid_len until after null check.

Prevents potential crash if wpa_s->current_ssid is NULL.

Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
(cherry picked from commit b6a5202e55cf0f010d523f31f642dc5ebf66eeea)
@moonlight83340 @krish2718
[nrf fromtree] modules: hostap: hapd_events: Fix possible null deference
4044ebb 
Move usage of ap_ctx pointers after null checks to prevent potential
crashes.

Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
(cherry picked from commit cd855104f24d06707373b70cd6fa73e645d8e4ce)
@moonlight83340 @krish2718
[nrf fromtree] modules: hostap: supp_events: Fix possible null deference
380a770 
Move usage of ap_ctx pointers after null checks to prevent potential
crashes.

Signed-off-by: Gaetan Perrot <gaetan.perrot@spacecubics.com>
(cherry picked from commit 8a565c0a2b8c12b1ea0298367a0ff525c1ae20b8)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@krish2718 krish2718 Awaiting requested review from krish2718

@bama-nordic bama-nordic Awaiting requested review from bama-nordic

@sachinthegreen sachinthegreen Awaiting requested review from sachinthegreen

@kapbh kapbh Awaiting requested review from kapbh

At least 2 approving reviews are required to merge this pull request.

Assignees
No one assigned
Labels
manifest manifest-hostap manifest-nrf_wifi
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@rado17 @krish2718 @kartben @moonlight83340 @Qingling-Wu @jukkar @JordanYates @ceolin