Enable support for IWD in NM and kernel

[jprestwo]

The IWD package was added to clear recently, but in order for it to work with NetworkManager, NM must be built using the --with-iwd flag. This will not enable IWD as the default wifi daemon, the user will still need to set the wifi backend in NetworkManager.conf.

For 'full' IWD support the kernel also requires some additional features:

CONFIG_CRYPTO_USER_API_SKCIPHER
CONFIG_CRYPTO_USER_API_AEAD
CONFIG_CRYPTO_USER_API_HASH
CONFIG_CRYPTO_RSA
CONFIG_CRYPTO_AES_X86_64
CONFIG_CRYPTO_AES_NI_INTEL
CONFIG_CRYPTO_MD4
CONFIG_CRYPTO_SHA1_SSSE3
CONFIG_CRYPTO_SHA256_SSSE3
CONFIG_CRYPTO_SHA512_SSSE3
CONFIG_CRYPTO_ECB
CONFIG_CRYPTO_CMAC
CONFIG_CRYPTO_DES
CONFIG_CRYPTO_DES3_EDE_X86_64
CONFIG_CRYPTO_ARC4
CONFIG_KEY_DH_OPERATIONS
CONFIG_ASYMMETRIC_KEY_TYPE
CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
CONFIG_X509_CERTIFICATE_PARSER
CONFIG_PKCS7_MESSAGE_PARSER
CONFIG_PKCS8_PRIVATE_KEY_PARSER

Some of these may already be enabled in clear, this is just IWD's complete list of required kernel features. This will enable IWD features such as WPS and Enterprise networks among others.

[ahkok]

I've done the NetworkManager change. NetworkManager-1.16.2-60

The kernel has most of the options enabled. Once the NetworkManager change is available, we can test whether additional kernel changes are needed.

From my checks, only CONFIG_CRYPTO_USER_API_AEAD is currently disabled, and I don't think it's needed for WPA2 etc. since we know that already works, but, that'll be easier to check in 2-3 days.

[jprestwo]

Great, thank you.

I built NM myself and can confirm that WPA2 PSK networks work. Enterprise networks (EAP-TLS at least) do not work though. I didn't get past loading my private key. This makes me think the PKCS7/8 options were not enabled, nor was there a module available on the default clear installation. I do think API_AEAD is needed for TLS though, so that might have to be turned on.

Anyways, I'll wait till NM goes live and try it out again.

[jprestwo]

@ahkok, looks like we are good to go. Just verified IWD works as expected. Thanks for getting this in.

[ahkok]

can you advise on what CONFIG_CRYPTO_USER_API_AEAD is needed for? I think we can just enable it, but, it would help if we had a good reason.

[jprestwo]

ELL appears to use it as a bulk encryption algorithm option for TLS:

https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/tls-suites.c#n1097

[ahkok]

@miguelinux can you enable CONFIG_CRYPTO_USER_API_AEAD in the -native and -lts kernels?

[ahkok]

Close when done.

[miguelinux]

The change is already in the -nativeand -lts
you will find it, in the next public release.

[miguelinux]

The CONFIG_CRYPTO_USER_API_AEAD is enabled in the -native and -lts kernels.

[thiagomacieira]

Please enable for all kernels. It's user API.