Skip to content

subsys: net: lib: websocket: remove usage of legacy Mbed TLS crypto #102037

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
henrikbrixandersen merged 3 commits into from
Jan 13, 2026
Merged

subsys: net: lib: websocket: remove usage of legacy Mbed TLS crypto #102037

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
277d79a
net: lib: websocket: remove usage of legacy Mbed TLS crypto
valeriosetti Jan 9, 2026
e50ad2a
net: lib: http: http_server: replace usage of legacy Mbed TLS crypto
valeriosetti Jan 9, 2026
af1e4e5
net: lib: shell: make header file inclusion conditional
valeriosetti Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion subsys/net/lib/http/http_server_ws.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
#include <zephyr/sys/base64.h>
#include <mbedtls/sha1.h>
Copy link
Copy Markdown
Member

@maass-hamburg maass-hamburg Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is probably no longer needed or?

Copy link
Copy Markdown
Contributor Author

@valeriosetti valeriosetti Jan 13, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ouch, right :(
I guess I'll solve that in another PR

#include <zephyr/net/websocket.h>
#include <psa/crypto.h>

LOG_MODULE_DECLARE(net_http_server, CONFIG_NET_HTTP_SERVER_LOG_LEVEL);

Expand All @@ -40,6 +41,7 @@ int handle_http1_to_websocket_upgrade(struct http_client_ctx *client)
"Sec-WebSocket-Accept: ";
char key_accept[HTTP_SERVER_WS_MAX_SEC_KEY_LEN + sizeof(WS_MAGIC)];
char accept[20];
size_t accept_len;
char tmp[64];
size_t key_len;
size_t olen;
Expand All @@ -52,7 +54,8 @@ int handle_http1_to_websocket_upgrade(struct http_client_ctx *client)
olen = MIN(sizeof(key_accept) - 1 - key_len, sizeof(WS_MAGIC) - 1);
memcpy(key_accept + key_len, WS_MAGIC, olen);

mbedtls_sha1(key_accept, olen + key_len, accept);
psa_hash_compute(PSA_ALG_SHA_1, key_accept, olen + key_len,
accept, sizeof(accept), &accept_len);

ret = base64_encode(tmp, sizeof(tmp) - 1, &olen, accept, sizeof(accept));
if (ret) {
Expand Down
5 changes: 3 additions & 2 deletions subsys/net/lib/shell/websocket.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,11 +14,12 @@ LOG_MODULE_DECLARE(net_shell);

#include "net_shell_private.h"

#include "websocket/websocket_internal.h"

#include <zephyr/sys/fdtable.h>

#if defined(CONFIG_WEBSOCKET_CLIENT)

#include "websocket/websocket_internal.h"

static void websocket_context_cb(struct websocket_context *context,
void *user_data)
{
Expand Down
4 changes: 2 additions & 2 deletions subsys/net/lib/websocket/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,9 +7,9 @@ config WEBSOCKET_CLIENT
select HTTP_PARSER
select HTTP_PARSER_URL
select HTTP_CLIENT
select MBEDTLS
select BASE64
select MBEDTLS_SHA1 if MBEDTLS_BUILTIN
select PSA_CRYPTO
select PSA_WANT_ALG_SHA_256
select EXPERIMENTAL
help
Enable Websocket client library.
Expand Down
25 changes: 0 additions & 25 deletions subsys/net/lib/websocket/websocket.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,7 @@ LOG_MODULE_REGISTER(net_websocket, CONFIG_NET_WEBSOCKET_LOG_LEVEL);
#include <zephyr/sys/byteorder.h>
#include <zephyr/sys/base64.h>

#ifdef CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT
#include <psa/crypto.h>
#else
#include <mbedtls/sha1.h>
#endif /* CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT */

#include "net_private.h"
#include "sockets_internal.h"
Expand Down Expand Up @@ -253,10 +249,8 @@ int websocket_connect(int sock, struct websocket_request *wreq,
"Sec-WebSocket-Version: 13\r\n",
NULL
};
#ifdef CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT
psa_status_t psa_status;
size_t hash_length;
#endif /* CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT */

fd = -1;

Expand Down Expand Up @@ -284,23 +278,13 @@ int websocket_connect(int sock, struct websocket_request *wreq,
ctx->http_cb = wreq->http_cb;
ctx->is_client = 1;

#ifdef CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT
psa_status = psa_hash_compute(PSA_ALG_SHA_1, (const uint8_t *)&rnd_value, sizeof(rnd_value),
sec_accept_key, sizeof(sec_accept_key), &hash_length);
if (psa_status != PSA_SUCCESS) {
NET_DBG("[%p] Cannot calculate sha1 (%d)", ctx, psa_status);
ret = -EPROTO;
goto out;
}
#else
ret = mbedtls_sha1((const unsigned char *)&rnd_value, sizeof(rnd_value), sec_accept_key);
if (ret != 0) {
NET_DBG("[%p] Cannot calculate sha1 (%d)", ctx, ret);
ret = -EPROTO;
goto out;
}
#endif /* CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT */


ret = base64_encode(sec_ws_key + sizeof("Sec-Websocket-Key: ") - 1,
sizeof(sec_ws_key) -
Expand Down Expand Up @@ -363,22 +347,13 @@ int websocket_connect(int sock, struct websocket_request *wreq,
memcpy(key_accept + key_len, WS_MAGIC, olen);

/* This SHA-1 value is then checked when we receive the response */
#ifdef CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT
psa_status = psa_hash_compute(PSA_ALG_SHA_1, (const uint8_t *)key_accept, olen + key_len,
sec_accept_key, sizeof(sec_accept_key), &hash_length);
if (psa_status != PSA_SUCCESS) {
NET_DBG("[%p] Cannot calculate sha1 (%d)", ctx, psa_status);
ret = -EPROTO;
goto out;
}
#else
ret = mbedtls_sha1(key_accept, olen + key_len, sec_accept_key);
if (ret != 0) {
NET_DBG("[%p] Cannot calculate sha1 (%d)", ctx, ret);
ret = -EPROTO;
goto out;
}
#endif /* CONFIG_MBEDTLS_PSA_CRYPTO_CLIENT */

ret = http_client_req(sock, &req, timeout, ctx);
if (ret < 0) {
Expand Down
3 changes: 2 additions & 1 deletion subsys/net/lib/websocket/websocket_internal.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,8 +11,9 @@
*/

#include <zephyr/toolchain/common.h>
#include <psa/crypto.h>

#define WS_SHA1_OUTPUT_LEN 20
#define WS_SHA1_OUTPUT_LEN PSA_HASH_LENGTH(PSA_ALG_SHA_1)

/* Min Websocket header length */
#define MIN_HEADER_LEN 2
Expand Down