net: Add credentials shell #64343

glarsennordic · 2023-10-25T00:34:38Z

These commits introduce a TLS credentials shell allowing credentials to be installed and managed from any shell backend

doc/connectivity/networking/api/tls_credentials_shell.rst

subsys/net/lib/tls_credentials/CMakeLists.txt

subsys/net/lib/tls_credentials/tls_credentials_shell.c

rlubos

There are quite a few compliance reports, please look them over.

subsys/net/lib/tls_credentials/tls_internal.h

subsys/net/lib/tls_credentials/tls_credentials_digest_raw.h

subsys/net/lib/tls_credentials/Kconfig.shell

doc/connectivity/networking/api/tls_credentials_shell.rst

subsys/net/lib/tls_credentials/tls_credentials_shell.c

doc/connectivity/networking/api/tls_credentials_shell.rst

subsys/net/lib/tls_credentials/Kconfig.shell

subsys/net/lib/tls_credentials/tls_credentials.c

subsys/net/lib/tls_credentials/tls_credentials_digest_raw.c

subsys/net/lib/tls_credentials/tls_credentials_trusted.c

subsys/net/lib/tls_credentials/tls_credentials_shell.c

doc/connectivity/networking/api/tls_credentials_shell.rst

subsys/net/lib/tls_credentials/tls_credentials_shell.c

rlubos

Sorry for the delay, I wrote comment yesterday, but messed something up and GH did not publish them...

subsys/net/lib/tls_credentials/tls_credentials_shell.c

glarsennordic · 2023-11-01T22:49:00Z

TBH that's a way better place to cross-link anyways, will do.

glarsennordic · 2023-11-02T00:15:46Z

Did the docs build time out? Gonna try another force push

subsys/net/lib/tls_credentials/tls_credentials_digest_raw.c

Adds an internal credential_digest for generating a string digest of credentials. Such digests would allow users of a prospective TLS credentials shell to verify the contents of a given credential without directly accessing those contents. Offloading the digest process to the underlying backend allows backends for which private portions are not directly accessible to be eventually supported. Signed-off-by: Georges Oates_Larsen <[email protected]>

Add (internal) support for sectag iterating. Also officially marks negative sectag values as reserved for internal use. This will allow a prospective TLS credentials shell to iterate over all available credentials. Signed-off-by: Georges Oates_Larsen <[email protected]>

rlubos · 2023-11-10T09:31:44Z

@glarsennordic Please check the compliance, it reported some nits.

Adds a shell interface for TLS Credentials, allowing management of credentials via the Zephyr shell Signed-off-by: Georges Oates_Larsen <[email protected]>

kartben · 2023-11-14T11:27:37Z

A late comment: @glarsennordic you may want to configure your text editor for enforcing the max 100 char line limit for .rst content, as the added page definitely fell through the cracks. Thanks!

glarsennordic · 2023-11-14T19:43:15Z

@kartben Sorry, it is standard practice where I work for .rst files to exceed 100 chars, and for each sentence to exist on a single line, and for each line to have only a single sentence. I assumed that was the same with Zephyr, is that not the case?

I notice there is inconsistency on this within the Zephyr docs. Some .rst files appear to use multi-line sentences, whereas others do not. Should CI compliance checks be updated to check line length in .rst files?

fabiobaltieri · 2023-11-14T20:02:42Z

I notice there is inconsistency on this within the Zephyr docs. Some .rst files appear to use multi-line sentences, whereas others do not. Should CI compliance checks be updated to check line length in .rst files?

Yeah that'd be a nice thing to have and have one less thing on the reviewer to keep an eye on.

kartben · 2023-11-14T20:52:30Z

I notice there is inconsistency on this within the Zephyr docs. Some .rst files appear to use multi-line sentences, whereas others do not. Should CI compliance checks be updated to check line length in .rst files?

Yeah that'd be a nice thing to have and have one less thing on the reviewer to keep an eye on.

I am not familiar enough with the checkpatch script to evaluate how easy it would be to take exceptions into account. There will always be some tables, really long URLs etc that will have to be treated as exceptions. I should look into https://pypi.org/project/doc8/ linter again though...

fabiobaltieri · 2023-11-14T21:00:17Z

I am not familiar enough with the checkpatch script to evaluate how easy it would be to take exceptions into account. There will always be some tables, really long URLs etc that will have to be treated as exceptions. I should look into https://pypi.org/project/doc8/ linter again though...

Nah forget checkpatch, the idea is to phase it out, look for https://github.com/zephyrproject-rtos/zephyr/blob/main/scripts/ci/check_compliance.py, the KeepSorted one I recently added is prob a good starting point, you can filter for the file you care about (.rst ones I guess) and then cycle through the content and check what you want to check.

kartben · 2023-11-14T21:08:40Z

Nah forget checkpatch, the idea is to phase it out, look for https://github.com/zephyrproject-rtos/zephyr/blob/main/scripts/ci/check_compliance.py, the KeepSorted one I recently added is prob a good starting point, you can filter for the file you care about (.rst ones I guess) and then cycle through the content and check what you want to check.

Thanks for the heads-up! I might give doc8 a serious try (plus, it can be used programmatically which is nice). The only somewhat tricky but will be to only flag the errors that are related to the lines that were touched.

fabiobaltieri · 2023-11-14T21:11:39Z

Thanks for the heads-up! I might give doc8 a serious try (plus, it can be used programmatically which is nice). The only somewhat tricky but will be to only flag the errors that are related to the lines that were touched.

None of our checks does that at the moment, you may have to bite the bullet and fix all files before deploying, that's how it went for yamllint.

kartben · 2023-11-14T21:23:38Z

Thanks for the heads-up! I might give doc8 a serious try (plus, it can be used programmatically which is nice). The only somewhat tricky but will be to only flag the errors that are related to the lines that were touched.

None of our checks does that at the moment, you may have to bite the bullet and fix all files before deploying, that's how it went for yamllint.

Well checkpatch does work on the diff and the diff only, does it not?

fabiobaltieri · 2023-11-14T23:05:58Z

Well checkpatch does work on the diff and the diff only, does it not?

It does, but Perl :-)

glarsennordic requested review from nashif, rlubos, tbursztyka and jukkar as code owners October 25, 2023 00:34

zephyrbot added the area: Networking label Oct 25, 2023

zephyrbot requested a review from ssharks October 25, 2023 00:35

zephyrbot assigned rlubos Oct 25, 2023

uffea reviewed Oct 25, 2023

View reviewed changes

doc/connectivity/networking/api/tls_credentials_shell.rst Outdated Show resolved Hide resolved

jukkar reviewed Oct 25, 2023

View reviewed changes

jukkar requested review from d3zd3z and ceolin October 25, 2023 07:35

rlubos reviewed Oct 25, 2023

View reviewed changes

glarsennordic force-pushed the cred_shell branch from 0e6b7fe to 00a04e9 Compare October 25, 2023 22:51