Re: [Buildroot] [PATCH 1/2] package/wpa_supplicant: bump version to 2.10

[Sergey Matyukevich <geomatsi@gmail.com>]

Hi Yegor,

> On Mon, Jan 31, 2022 at 9:38 PM Sergey Matyukevich <geomatsi@gmail.com> wrote:
> >
> > Hello Yegor,
> >
> > > Hi Sergey,
> > >
> > > On Mon, Jan 31, 2022 at 8:48 PM Sergey Matyukevich <geomatsi@gmail.com> wrote:
> > > >
> > > > Update wpa_supplicant to the latest release v2.10. Drop all the patches
> > > > as they have already been upstreamed. Remove from .mk file all the
> > > > WPA_SUPPLICANT_IGNORE_CVES records since those CVEs will not be
> > > > reported against the new version.
> > > >
> > > > Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> >
> > ...
> >
> > > Have you tried to build wpa_supplicant without
> > > BR2_PACKAGE_WPA_SUPPLICANT_WPA3 and enabled
> > > BR2_PACKAGE_WPA_SUPPLICANT_MESH_NETWORKING? I've got a linking error.
> > > I have also sent a quick and dirty patch to the hostap mailing list
> > > [1] but still got no answer.
> > >
> > > [1] http://lists.infradead.org/pipermail/hostap/2022-January/040181.html
> >
> > So far I have not observed that problem. I think we can handle it
> > independently from the revision update, adding fixup patches if needed.
> >
> > I tried to reproduce it using the following wpa_supplicant configuration:
> >
> > BR2_PACKAGE_WPA_SUPPLICANT=y
> > BR2_PACKAGE_WPA_SUPPLICANT_NL80211=y
> > BR2_PACKAGE_WPA_SUPPLICANT_AP_SUPPORT=y
> > BR2_PACKAGE_WPA_SUPPLICANT_MESH_NETWORKING=y
> >
> > However build succeeded. Could you please post your wpa_supplicant
> > configuration snippet ? Probably the root cause is in openssl and some
> > of its features need to be enabled in package/wpa_supplicant/Config.in.
> 
> I have pinned it down:
> 
> BR2_PACKAGE_WPA_SUPPLICANT=y
> BR2_PACKAGE_WPA_SUPPLICANT_NL80211=y
> BR2_PACKAGE_WPA_SUPPLICANT_AP_SUPPORT=y
> BR2_PACKAGE_WPA_SUPPLICANT_MESH_NETWORKING=y
> BR2_PACKAGE_WPA_SUPPLICANT_EAP=y
> 
> It is BR2_PACKAGE_WPA_SUPPLICANT_EAP option the selects NEED_SHA384.

Thanks ! I reproduced the problem using your wpa_supplicant config snippet.
Looking into Makefile of wpa_supplicant:
- CONFIG_MESH for some reason needs SAE, so it enables CONFIG_SAE
- CONFIG_SAE enables only HMAC_SHA256_KDF, which is apparently not enough

It turns out that at least HMAC_SHA384_KDF is required for successful build.
Here is a minimal patch for wpa_supplicant that fixes build for your snippet:

diff --git a/wpa_supplicant/Makefile b/wpa_supplicant/Makefile
index cb66defac..c8e53a3c9 100644
--- a/wpa_supplicant/Makefile
+++ b/wpa_supplicant/Makefile
@@ -246,6 +246,7 @@ endif
 ifdef CONFIG_MESH
 NEED_80211_COMMON=y
 NEED_AES_SIV=y
+NEED_HMAC_SHA384_KDF=y
 CONFIG_SAE=y
 CONFIG_AP=y
 CFLAGS += -DCONFIG_MESH


In fact, it looks like wpa_supplicant build would fail for any configuration
when we enable SAE without DPP. However in Buildroot we enable all WPA3
support at once which includes OWE/SAE/DPP. Meanwhile DPP enables all
the NEED_HMAC_SHA***_KDF options.

Regards,
Sergey
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot