[Buildroot] [PATCH 1/1] package/wpa_supplicant: add OpenSSL engine option

[Buildroot] [PATCH 1/1] package/wpa_supplicant: add OpenSSL engine option

[Lars Wikman]

CONFIG_SMARTCARD was unconditionally disabled which has meant that
even if OpenSSL is compiled with engine support and the supplicant
is configured to use an engine it would warn that it was compiled
without engine support.

This mechanism is used to enable the more secure forms of 802.1x
networking authentication such as EAP-TLS with hardware-delegated
cryptography and private keys protected in hardware.

It is still disabled by default in case there was an original reason.

Enabling the option will allow delegating private key access to TPM2,
ARM TrustZone and other specialized secure hardware for establishing
a network connection.

Signed-off-by: Lars Wikman <lars@underjord.io>
---
 package/wpa_supplicant/Config.in         | 6 ++++++
 package/wpa_supplicant/wpa_supplicant.mk | 7 +++++--
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/package/wpa_supplicant/Config.in b/package/wpa_supplicant/Config.in
index 92953f69f0..5ed5828bb1 100644
--- a/package/wpa_supplicant/Config.in
+++ b/package/wpa_supplicant/Config.in
@@ -175,4 +175,10 @@ config BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION
 	help
 	  Add introspection support for the DBus control interface.
 
+config BR2_PACKAGE_WPA_SUPPLICANT_OPENSSL_ENGINE
+	bool "OpenSSL engine support"
+	help
+	  Enable the smart card support which enables OpenSSL engines
+	  using PKCS11 and 802.1x
+
 endif
diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
index 984959f679..b986cfe643 100644
--- a/package/wpa_supplicant/wpa_supplicant.mk
+++ b/package/wpa_supplicant/wpa_supplicant.mk
@@ -24,8 +24,11 @@ WPA_SUPPLICANT_CONFIG_ENABLE = \
 	CONFIG_INTERNAL_LIBTOMMATH \
 	CONFIG_MATCH_IFACE
 
-WPA_SUPPLICANT_CONFIG_DISABLE = \
-	CONFIG_SMARTCARD
+ifeq ($(BR2_PACKAGE_WPA_SUPPLICANT_OPENSSL_ENGINE),y)
+WPA_SUPPLICANT_CONFIG_ENABLE += CONFIG_SMARTCARD
+else
+WPA_SUPPLICANT_CONFIG_DISABLE = CONFIG_SMARTCARD
+endif
 
 # libnl-3 needs -lm (for rint) and -lpthread if linking statically
 # And library order matters hence stick -lnl-3 first since it's appended
-- 
2.34.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/wpa_supplicant: add OpenSSL engine option

[Sergey Matyukevich]

Hello Lars,

On Mon, Sep 02, 2024 at 09:45:27AM +0200, Lars Wikman wrote:
> CONFIG_SMARTCARD was unconditionally disabled which has meant that
> even if OpenSSL is compiled with engine support and the supplicant
> is configured to use an engine it would warn that it was compiled
> without engine support.
> 
> This mechanism is used to enable the more secure forms of 802.1x
> networking authentication such as EAP-TLS with hardware-delegated
> cryptography and private keys protected in hardware.
> 
> It is still disabled by default in case there was an original reason.
> 
> Enabling the option will allow delegating private key access to TPM2,
> ARM TrustZone and other specialized secure hardware for establishing
> a network connection.
> 
> Signed-off-by: Lars Wikman <lars@underjord.io>
> ---
>  package/wpa_supplicant/Config.in         | 6 ++++++
>  package/wpa_supplicant/wpa_supplicant.mk | 7 +++++--
>  2 files changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/package/wpa_supplicant/Config.in b/package/wpa_supplicant/Config.in
> index 92953f69f0..5ed5828bb1 100644
> --- a/package/wpa_supplicant/Config.in
> +++ b/package/wpa_supplicant/Config.in
> @@ -175,4 +175,10 @@ config BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION
>  	help
>  	  Add introspection support for the DBus control interface.
>  
> +config BR2_PACKAGE_WPA_SUPPLICANT_OPENSSL_ENGINE
> +	bool "OpenSSL engine support"
> +	help
> +	  Enable the smart card support which enables OpenSSL engines
> +	  using PKCS11 and 802.1x
> +
>  endif

IIUC this option is used to enable smartcard support in wpa_supplicant,
not to select TLS engine. So suggested name looks a bit confusing in
this context. Maybe just 'BR2_PACKAGE_WPA_SUPPLICANT_SMART_CARD' or
something like that ?

Buildroot allows to use two TLS engines in wpa_supplicant: OpenSSL and
internal experimental TLSv1 implementation. Does smartcard support in
wpa_supplicant requires OpenSSL ? If so, then it should be explicitly
selected, e.g. see WPA3 or MESH_NETWORKING options in Config.in.

Regards,
Sergey
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/wpa_supplicant: add OpenSSL engine option

[Lars Wikman]

[-- Attachment #1.1: Type: text/plain, Size: 3172 bytes --]

Hello

Looking closer at other options I agree. I’ll change the name of the
option. I was under the impression that it only actually affected the
OpenSSL engine functionality but it looks like there are EAP-SIM and other
bits of SmartCard functionality that I don’t know how they operate. I think
the documentation string might need to mention the association to OpenSSL
engine support as unless you know the connection between PKCS11 and
SmartCard you will only find out by reading Makefiles and source.

I don’t know if it requires OpenSSL. The use-cases I know off will use
OpenSSL but there are some CONFIG_ options, such as the EAP-SIM stuff where
I don’t know what it entails. Maybe they work without OpenSSL. I can’t
exhaustively say that it only works with OpenSSL.

I will change the option name as suggested.

Thanks
Lars

On Mon, 2 Sep 2024 at 19:47, Sergey Matyukevich <geomatsi@gmail.com> wrote:

> Hello Lars,
>
> On Mon, Sep 02, 2024 at 09:45:27AM +0200, Lars Wikman wrote:
> > CONFIG_SMARTCARD was unconditionally disabled which has meant that
> > even if OpenSSL is compiled with engine support and the supplicant
> > is configured to use an engine it would warn that it was compiled
> > without engine support.
> >
> > This mechanism is used to enable the more secure forms of 802.1x
> > networking authentication such as EAP-TLS with hardware-delegated
> > cryptography and private keys protected in hardware.
> >
> > It is still disabled by default in case there was an original reason.
> >
> > Enabling the option will allow delegating private key access to TPM2,
> > ARM TrustZone and other specialized secure hardware for establishing
> > a network connection.
> >
> > Signed-off-by: Lars Wikman <lars@underjord.io>
> > ---
> >  package/wpa_supplicant/Config.in         | 6 ++++++
> >  package/wpa_supplicant/wpa_supplicant.mk | 7 +++++--
> >  2 files changed, 11 insertions(+), 2 deletions(-)
> >
> > diff --git a/package/wpa_supplicant/Config.in
> b/package/wpa_supplicant/Config.in
> > index 92953f69f0..5ed5828bb1 100644
> > --- a/package/wpa_supplicant/Config.in
> > +++ b/package/wpa_supplicant/Config.in
> > @@ -175,4 +175,10 @@ config BR2_PACKAGE_WPA_SUPPLICANT_DBUS_INTROSPECTION
> >       help
> >         Add introspection support for the DBus control interface.
> >
> > +config BR2_PACKAGE_WPA_SUPPLICANT_OPENSSL_ENGINE
> > +     bool "OpenSSL engine support"
> > +     help
> > +       Enable the smart card support which enables OpenSSL engines
> > +       using PKCS11 and 802.1x
> > +
> >  endif
>
> IIUC this option is used to enable smartcard support in wpa_supplicant,
> not to select TLS engine. So suggested name looks a bit confusing in
> this context. Maybe just 'BR2_PACKAGE_WPA_SUPPLICANT_SMART_CARD' or
> something like that ?
>
> Buildroot allows to use two TLS engines in wpa_supplicant: OpenSSL and
> internal experimental TLSv1 implementation. Does smartcard support in
> wpa_supplicant requires OpenSSL ? If so, then it should be explicitly
> selected, e.g. see WPA3 or MESH_NETWORKING options in Config.in.
>
> Regards,
> Sergey
>

[-- Attachment #1.2: Type: text/html, Size: 4088 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot