Re: [Buildroot] [PATCH v3] package/wpa_supplicant: add Smart card option

From: Thomas Petazzoni via buildroot <buildroot@buildroot.org>
To: Lars Wikman <lars@underjord.io>
Cc: buildroot@buildroot.org, Sergey Matyukevich <geomatsi@gmail.com>
Subject: Re: [Buildroot] [PATCH v3] package/wpa_supplicant: add Smart card option
Date: Tue, 29 Oct 2024 23:06:30 +0100	[thread overview]
Message-ID: <20241029230630.5e4d6805@windsurf> (raw)
In-Reply-To: <20240903100952.3789698-1-lars@underjord.io>

Hello Lars,

On Tue,  3 Sep 2024 12:09:52 +0200
Lars Wikman <lars@underjord.io> wrote:

> CONFIG_SMARTCARD was unconditionally disabled which has meant that
> even if OpenSSL is compiled with engine support and the supplicant
> is configured to use an engine it would warn that it was compiled
> without engine support.
> 
> This mechanism is used to enable the more secure forms of 802.1x
> networking authentication such as EAP-TLS with hardware-delegated
> cryptography and private keys protected in hardware.
> 
> It is still disabled by default in case there was an original reason.
> 
> Enabling the option will allow delegating private key access to TPM2,
> ARM TrustZone and other specialized secure hardware for establishing
> a network connection.
> 
> Signed-off-by: Lars Wikman <lars@underjord.io>
> 
> ---
> Changes v1 -> v2:
>   - Change option name to focus on smartcard  (suggested by Sergey)
> Changes v2 -> v3:
>   - Change setting disabled to match convention (suggested by Baruch)

Sorry for the delay in getting back to you. I reviewed/tested your
patch, but I believe something needs to be improved, but I wasn't sure
so I wasn't confident to do it myself.

I built the following configuration:

BR2_arm=y
BR2_cortex_a9=y
BR2_ARM_ENABLE_VFP=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_INIT_NONE=y
BR2_SYSTEM_BIN_SH_NONE=y
# BR2_PACKAGE_BUSYBOX is not set
BR2_PACKAGE_WPA_SUPPLICANT=y
# BR2_PACKAGE_WPA_SUPPLICANT_NL80211 is not set
BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD=y
# BR2_TARGET_ROOTFS_TAR is not set

which really has just wpa_supplicant with all options disabled except
smartcard. And my understanding is that in this configuration...
enabling the smartcard option is a no-op, because I don't even have
OpenSSL enabled in my configuration.

Since the smartcard option only affects the OpenSSL integration in
wpa_supplicant, shouldn't this option have:

        select BR2_PACKAGE_OPENSSL
        select BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL

like the other options that need OpenSSL support?

Thanks in advance for your feedback,

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot