[Buildroot] [PATCH v2] package/wpa_supplicant: add Smart card option

[Buildroot] [PATCH v2] package/wpa_supplicant: add Smart card option

[Lars Wikman]

CONFIG_SMARTCARD was unconditionally disabled which has meant that
even if OpenSSL is compiled with engine support and the supplicant
is configured to use an engine it would warn that it was compiled
without engine support.

This mechanism is used to enable the more secure forms of 802.1x
networking authentication such as EAP-TLS with hardware-delegated
cryptography and private keys protected in hardware.

It is still disabled by default in case there was an original reason.

Enabling the option will allow delegating private key access to TPM2,
ARM TrustZone and other specialized secure hardware for establishing
a network connection.

Signed-off-by: Lars Wikman <lars@underjord.io>

---
Changes v1 -> v2:
  - Change option name to focus on smartcard  (suggested by Sergey)

Signed-off-by: Lars Wikman <lars@underjord.io>
---
 package/wpa_supplicant/Config.in         | 6 ++++++
 package/wpa_supplicant/wpa_supplicant.mk | 7 +++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/package/wpa_supplicant/Config.in b/package/wpa_supplicant/Config.in
index 92953f69f0..2aee108fc1 100644
--- a/package/wpa_supplicant/Config.in
+++ b/package/wpa_supplicant/Config.in
@@ -175,4 +175,10 @@ config BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION
 	help
 	  Add introspection support for the DBus control interface.
 
+config BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD
+	bool "Smartcard support"
+	help
+	  Enable the smart card support. Required for OpenSSL engines
+	  to work using PKCS11 and 802.1x
+
 endif
diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
index 984959f679..a7b7800c99 100644
--- a/package/wpa_supplicant/wpa_supplicant.mk
+++ b/package/wpa_supplicant/wpa_supplicant.mk
@@ -24,8 +24,11 @@ WPA_SUPPLICANT_CONFIG_ENABLE = \
 	CONFIG_INTERNAL_LIBTOMMATH \
 	CONFIG_MATCH_IFACE
 
-WPA_SUPPLICANT_CONFIG_DISABLE = \
-	CONFIG_SMARTCARD
+ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD),y)
+WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_SMARTCARD
+else
+WPA_SUPPLICANT_CONFIG_DISABLE = CONFIG_SMARTCARD
+endif
 
 # libnl-3 needs -lm (for rint) and -lpthread if linking statically
 # And library order matters hence stick -lnl-3 first since it's appended
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/wpa_supplicant: add Smart card option

[Baruch Siach via buildroot]

Hi Lars,

On Tue, Sep 03 2024, Lars Wikman wrote:
> diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
> index 984959f679..a7b7800c99 100644
> --- a/package/wpa_supplicant/wpa_supplicant.mk
> +++ b/package/wpa_supplicant/wpa_supplicant.mk
> @@ -24,8 +24,11 @@ WPA_SUPPLICANT_CONFIG_ENABLE = \
>  	CONFIG_INTERNAL_LIBTOMMATH \
>  	CONFIG_MATCH_IFACE
>  
> -WPA_SUPPLICANT_CONFIG_DISABLE = \
> -	CONFIG_SMARTCARD
> +ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD),y)
> +WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_SMARTCARD
> +else
> +WPA_SUPPLICANT_CONFIG_DISABLE = CONFIG_SMARTCARD

Should be += here. Otherwise WPA_SUPPLICANT_CONFIG_DISABLE is
overwritten.

baruch

> +endif
>  
>  # libnl-3 needs -lm (for rint) and -lpthread if linking statically
>  # And library order matters hence stick -lnl-3 first since it's appended

-- 
                                                     ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/wpa_supplicant: add Smart card option

[Lars Wikman]

[-- Attachment #1.1: Type: text/plain, Size: 1516 bytes --]

Hi Baruch

The existing line was = as it was the first reference to
WPA_SUPPLICANT_CONFIG_DISABLE.
So I kept it that way.

Happy to change it if I should still. I'm not particularly used to these
files or conventions.

- Lars

On Tue, Sep 3, 2024 at 9:51 AM Baruch Siach <baruch@tkos.co.il> wrote:

> Hi Lars,
>
> On Tue, Sep 03 2024, Lars Wikman wrote:
> > diff --git a/package/wpa_supplicant/wpa_supplicant.mk
> b/package/wpa_supplicant/wpa_supplicant.mk
> > index 984959f679..a7b7800c99 100644
> > --- a/package/wpa_supplicant/wpa_supplicant.mk
> > +++ b/package/wpa_supplicant/wpa_supplicant.mk
> > @@ -24,8 +24,11 @@ WPA_SUPPLICANT_CONFIG_ENABLE = \
> >       CONFIG_INTERNAL_LIBTOMMATH \
> >       CONFIG_MATCH_IFACE
> >
> > -WPA_SUPPLICANT_CONFIG_DISABLE = \
> > -     CONFIG_SMARTCARD
> > +ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD),y)
> > +WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_SMARTCARD
> > +else
> > +WPA_SUPPLICANT_CONFIG_DISABLE = CONFIG_SMARTCARD
>
> Should be += here. Otherwise WPA_SUPPLICANT_CONFIG_DISABLE is
> overwritten.
>
> baruch
>
> > +endif
> >
> >  # libnl-3 needs -lm (for rint) and -lpthread if linking statically
> >  # And library order matters hence stick -lnl-3 first since it's appended
>
> --
>                                                      ~. .~   Tk Open
> Systems
> =}------------------------------------------------ooO--U--Ooo------------{=
>    - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
>

[-- Attachment #1.2: Type: text/html, Size: 2447 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/wpa_supplicant: add Smart card option

[Baruch Siach via buildroot]

Hi Lars,

On Tue, Sep 03 2024, Lars Wikman wrote:
> The existing line was = as it was the first reference to WPA_SUPPLICANT_CONFIG_DISABLE.
> So I kept it that way.

The existing line is first assignment that initializes
WPA_SUPPLICANT_CONFIG_DISABLE. All initial assignments use = in this
file and others.

Following conditional assignments should only add to existing value, not
overwrite it.

baruch

> Happy to change it if I should still. I'm not particularly used to
> these files or conventions.
>
> - Lars
>
> On Tue, Sep 3, 2024 at 9:51 AM Baruch Siach <baruch@tkos.co.il> wrote:
>  On Tue, Sep 03 2024, Lars Wikman wrote:
>  > diff --git a/package/wpa_supplicant/wpa_supplicant.mk⚠️ b/package/wpa_supplicant/wpa_supplicant.mk⚠️
>  > index 984959f679..a7b7800c99 100644
>  > --- a/package/wpa_supplicant/wpa_supplicant.mk⚠️
>  > +++ b/package/wpa_supplicant/wpa_supplicant.mk⚠️
>  > @@ -24,8 +24,11 @@ WPA_SUPPLICANT_CONFIG_ENABLE = \
>  >       CONFIG_INTERNAL_LIBTOMMATH \
>  >       CONFIG_MATCH_IFACE
>  >  
>  > -WPA_SUPPLICANT_CONFIG_DISABLE = \
>  > -     CONFIG_SMARTCARD
>  > +ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD),y)
>  > +WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_SMARTCARD
>  > +else
>  > +WPA_SUPPLICANT_CONFIG_DISABLE = CONFIG_SMARTCARD
>
>  Should be += here. Otherwise WPA_SUPPLICANT_CONFIG_DISABLE is
>  overwritten.
>
>  baruch
>
>  > +endif
>  >  
>  >  # libnl-3 needs -lm (for rint) and -lpthread if linking statically
>  >  # And library order matters hence stick -lnl-3 first since it's appended

-- 
                                                     ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/wpa_supplicant: add Smart card option

[Lars Wikman]

[-- Attachment #1.1: Type: text/plain, Size: 2346 bytes --]

Hi

This was the only initial assignment for DISABLE being made. And now it is
conditional on the new option. What would be the preferred way to do it?

Can DISABLE be left blank? Or left out until it is conditionally set?

Happy to do it either way, it was not obvious to me how it should be
handled so I did this.

-Lars

On Tue, 3 Sep 2024 at 10:13, Baruch Siach <baruch@tkos.co.il> wrote:

> Hi Lars,
>
> On Tue, Sep 03 2024, Lars Wikman wrote:
> > The existing line was = as it was the first reference to
> WPA_SUPPLICANT_CONFIG_DISABLE.
> > So I kept it that way.
>
> The existing line is first assignment that initializes
> WPA_SUPPLICANT_CONFIG_DISABLE. All initial assignments use = in this
> file and others.
>
> Following conditional assignments should only add to existing value, not
> overwrite it.
>
> baruch
>
> > Happy to change it if I should still. I'm not particularly used to
> > these files or conventions.
> >
> > - Lars
> >
> > On Tue, Sep 3, 2024 at 9:51 AM Baruch Siach <baruch@tkos.co.il> wrote:
> >  On Tue, Sep 03 2024, Lars Wikman wrote:
> >  > diff --git a/package/wpa_supplicant/wpa_supplicant.mk⚠️
> b/package/wpa_supplicant/wpa_supplicant.mk⚠️
> >  > index 984959f679..a7b7800c99 100644
> >  > --- a/package/wpa_supplicant/wpa_supplicant.mk⚠️
> >  > +++ b/package/wpa_supplicant/wpa_supplicant.mk⚠️
> >  > @@ -24,8 +24,11 @@ WPA_SUPPLICANT_CONFIG_ENABLE = \
> >  >       CONFIG_INTERNAL_LIBTOMMATH \
> >  >       CONFIG_MATCH_IFACE
> >  >
> >  > -WPA_SUPPLICANT_CONFIG_DISABLE = \
> >  > -     CONFIG_SMARTCARD
> >  > +ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD),y)
> >  > +WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_SMARTCARD
> >  > +else
> >  > +WPA_SUPPLICANT_CONFIG_DISABLE = CONFIG_SMARTCARD
> >
> >  Should be += here. Otherwise WPA_SUPPLICANT_CONFIG_DISABLE is
> >  overwritten.
> >
> >  baruch
> >
> >  > +endif
> >  >
> >  >  # libnl-3 needs -lm (for rint) and -lpthread if linking statically
> >  >  # And library order matters hence stick -lnl-3 first since it's
> appended
>
> --
>                                                      ~. .~   Tk Open
> Systems
> =}------------------------------------------------ooO--U--Ooo------------{=
>    - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
>

[-- Attachment #1.2: Type: text/html, Size: 3647 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/wpa_supplicant: add Smart card option

[Baruch Siach via buildroot]

Hi Lars,

On Tue, Sep 03 2024, Lars Wikman wrote:
> This was the only initial assignment for DISABLE being made. And now
> it is conditional on the new option. What would be the preferred way
> to do it?
>
> Can DISABLE be left blank? Or left out until it is conditionally set?
>
> Happy to do it either way, it was not obvious to me how it should be
> handled so I did this.

Just remove the initial assignment as you did. No need to initialize to
blank. This is the common convention in Buildroot.

Thanks,
baruch

> On Tue, 3 Sep 2024 at 10:13, Baruch Siach <baruch@tkos.co.il> wrote:
>  On Tue, Sep 03 2024, Lars Wikman wrote:
>  > The existing line was = as it was the first reference to WPA_SUPPLICANT_CONFIG_DISABLE.
>  > So I kept it that way.
>
>  The existing line is first assignment that initializes
>  WPA_SUPPLICANT_CONFIG_DISABLE. All initial assignments use = in this
>  file and others.
>
>  Following conditional assignments should only add to existing value, not
>  overwrite it.
>
>  baruch
>
>  > Happy to change it if I should still. I'm not particularly used to
>  > these files or conventions.
>  >
>  > - Lars
>  >
>  > On Tue, Sep 3, 2024 at 9:51 AM Baruch Siach <baruch@tkos.co.il> wrote:
>  >  On Tue, Sep 03 2024, Lars Wikman wrote:
>  >  > diff --git a/package/wpa_supplicant/wpa_supplicant.mk⚠️⚠️ b/package/wpa_supplicant/wpa_supplicant.mk⚠️⚠️
>  >  > index 984959f679..a7b7800c99 100644
>  >  > --- a/package/wpa_supplicant/wpa_supplicant.mk⚠️⚠️
>  >  > +++ b/package/wpa_supplicant/wpa_supplicant.mk⚠️⚠️
>  >  > @@ -24,8 +24,11 @@ WPA_SUPPLICANT_CONFIG_ENABLE = \
>  >  >       CONFIG_INTERNAL_LIBTOMMATH \
>  >  >       CONFIG_MATCH_IFACE
>  >  >  
>  >  > -WPA_SUPPLICANT_CONFIG_DISABLE = \
>  >  > -     CONFIG_SMARTCARD
>  >  > +ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD),y)
>  >  > +WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_SMARTCARD
>  >  > +else
>  >  > +WPA_SUPPLICANT_CONFIG_DISABLE = CONFIG_SMARTCARD
>  >
>  >  Should be += here. Otherwise WPA_SUPPLICANT_CONFIG_DISABLE is
>  >  overwritten.
>  >
>  >  baruch
>  >
>  >  > +endif
>  >  >  
>  >  >  # libnl-3 needs -lm (for rint) and -lpthread if linking statically
>  >  >  # And library order matters hence stick -lnl-3 first since it's appended

-- 
                                                     ~. .~   Tk Open Systems
=}------------------------------------------------ooO--U--Ooo------------{=
   - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2] package/wpa_supplicant: add Smart card option

[Lars Wikman]

[-- Attachment #1.1: Type: text/plain, Size: 2850 bytes --]

Hi

Great. Appreciate the clarification :)

-L

On Tue, Sep 3, 2024 at 10:44 AM Baruch Siach <baruch@tkos.co.il> wrote:

> Hi Lars,
>
> On Tue, Sep 03 2024, Lars Wikman wrote:
> > This was the only initial assignment for DISABLE being made. And now
> > it is conditional on the new option. What would be the preferred way
> > to do it?
> >
> > Can DISABLE be left blank? Or left out until it is conditionally set?
> >
> > Happy to do it either way, it was not obvious to me how it should be
> > handled so I did this.
>
> Just remove the initial assignment as you did. No need to initialize to
> blank. This is the common convention in Buildroot.
>
> Thanks,
> baruch
>
> > On Tue, 3 Sep 2024 at 10:13, Baruch Siach <baruch@tkos.co.il> wrote:
> >  On Tue, Sep 03 2024, Lars Wikman wrote:
> >  > The existing line was = as it was the first reference to
> WPA_SUPPLICANT_CONFIG_DISABLE.
> >  > So I kept it that way.
> >
> >  The existing line is first assignment that initializes
> >  WPA_SUPPLICANT_CONFIG_DISABLE. All initial assignments use = in this
> >  file and others.
> >
> >  Following conditional assignments should only add to existing value, not
> >  overwrite it.
> >
> >  baruch
> >
> >  > Happy to change it if I should still. I'm not particularly used to
> >  > these files or conventions.
> >  >
> >  > - Lars
> >  >
> >  > On Tue, Sep 3, 2024 at 9:51 AM Baruch Siach <baruch@tkos.co.il>
> wrote:
> >  >  On Tue, Sep 03 2024, Lars Wikman wrote:
> >  >  > diff --git a/package/wpa_supplicant/wpa_supplicant.mk⚠️⚠️
> b/package/wpa_supplicant/wpa_supplicant.mk⚠️⚠️
> >  >  > index 984959f679..a7b7800c99 100644
> >  >  > --- a/package/wpa_supplicant/wpa_supplicant.mk⚠️⚠️
> >  >  > +++ b/package/wpa_supplicant/wpa_supplicant.mk⚠️⚠️
> >  >  > @@ -24,8 +24,11 @@ WPA_SUPPLICANT_CONFIG_ENABLE = \
> >  >  >       CONFIG_INTERNAL_LIBTOMMATH \
> >  >  >       CONFIG_MATCH_IFACE
> >  >  >
> >  >  > -WPA_SUPPLICANT_CONFIG_DISABLE = \
> >  >  > -     CONFIG_SMARTCARD
> >  >  > +ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_SMARTCARD),y)
> >  >  > +WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_SMARTCARD
> >  >  > +else
> >  >  > +WPA_SUPPLICANT_CONFIG_DISABLE = CONFIG_SMARTCARD
> >  >
> >  >  Should be += here. Otherwise WPA_SUPPLICANT_CONFIG_DISABLE is
> >  >  overwritten.
> >  >
> >  >  baruch
> >  >
> >  >  > +endif
> >  >  >
> >  >  >  # libnl-3 needs -lm (for rint) and -lpthread if linking statically
> >  >  >  # And library order matters hence stick -lnl-3 first since it's
> appended
>
> --
>                                                      ~. .~   Tk Open
> Systems
> =}------------------------------------------------ooO--U--Ooo------------{=
>    - baruch@tkos.co.il - tel: +972.52.368.4656, http://www.tkos.co.il -
>

[-- Attachment #1.2: Type: text/html, Size: 4257 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot