Compare commits

...

3 Commits

Author SHA1 Message Date
jackcybertan
5df32992a0 WIFI-14904: Switch to mount-and-copy flow for /certificates
Update the certificates handling logic per reviewer feedback.

The updated flow:
- Mount /dev/mtdblock* (the certificates partition) to /mnt
- Copy its contents to /certificates
- Unmount /mnt
- Extract the PKI 2.0 certificates into /certificates

Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
2025-07-29 16:18:20 +08:00
jackcybertan
4c689da610 WIFI-14904 Refactor: remove dd usage and replace mount copy with overlayfs
This patch addresses reviewer feedback:

- Replaces dd with direct tar extraction from the mtdblock device, avoiding unnecessary intermediate steps.
- Removes the manual copy/restore flow for /certificates mount by switching to an OverlayFS-based solution when a read-only squashfs or ubifs is detected.

Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
2025-07-29 11:03:11 +08:00
jackcybertan
9919fded0f WIFI-14904 Enhance PKI enrollment on squashfs (SonicFi RAP6* series)
Ensure PKI2.0 certificates are properly backed up when /certificates is mounted as squashfs (read-only).
Enhance the persistent storage mechanism to retain PKI2.0 certificates across factory resets.

Following the current enrollment behavior, `operational.ca` and `operational.pem` - though restored to `/certificates` after a factory reset - are not directly used during enrollment.
The `est_client` will still download both certificates again as part of the enrollment process.
This patch does not modify that behavior, but simply ensures the certificates are persistently stored across resets.

Impacted models: SonicFi RAP6* series.

Signed-off-by: jackcybertan <jack.tsai@cybertan.com.tw>
2025-07-29 11:03:02 +08:00
2 changed files with 25 additions and 0 deletions

View File

@@ -58,6 +58,19 @@ udaya,a5-id2)
[ -n "$mtd" ] && tar xf /dev/mtdblock$mtd -C /certificates
fi
;;
sonicfi,rap6*)
mtd=$(find_mtd_index certificates)
if [ "$(head -c 4 /dev/mtd$mtd)" == "hsqs" ]; then
mount -t squashfs /dev/mtdblock$mtd /mnt
cp /mnt/* /certificates
umount /mnt
fi
part=$(tar_part_lookup "0:BOOTCONFIG" "0:BOOTCONFIG1")
if [ -n "$part" ]; then
mtd=$(find_mtd_index $part)
[ -n "$mtd" ] && tar xf /dev/mtdblock$mtd -C /certificates
fi
;;
*)
mtd=$(find_mtd_index certificates)

View File

@@ -28,4 +28,16 @@ udaya,a5-id2)
mtd=$(find_mtd_index $part)
dd if=/tmp/certs.tar of=/dev/mtdblock$mtd
;;
sonicfi,rap6*)
if [ "$(fw_printenv -n store_certs_disabled)" != "1" ]; then
cd /certificates
tar cf /tmp/certs.tar .
part=$(tar_part_lookup "0:BOOTCONFIG" "0:BOOTCONFIG1")
mtd=$(find_mtd_index $part)
block_size=$(cat /sys/class/mtd/mtd$mtd/size)
dd if=/tmp/certs.tar of=/tmp/certs_pad.tar bs=$block_size conv=sync
mtd write /tmp/certs_pad.tar /dev/mtd$mtd
rm -f /tmp/certs.tar /tmp/certs_pad.tar
fi
;;
esac