Skip to content

hostapd: Enable DPP support in full TLS variant #18485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

gubertoli
Copy link

@gubertoli gubertoli commented Apr 14, 2025

Enable Device Provisioning Protocol* (DPPv2) in hostapd, but only for full
builds that use external TLS libraries.
* aka Wi-Fi Easy Connect

Signed-off-by: Gustavo Bertoli gubertoli@gmail.com

@gubertoli
Copy link
Author

@robimarko thank you for the clarification and guidance in #18232.

I have now created a clean version of the PR. Only enabling DPPv2 for
full TLS variants of OpenSSL and WolfSSL.

@github-actions github-actions bot added the core packages pull request/issue for core (in-tree) packages label Apr 14, 2025
@robimarko
Copy link
Contributor

Please dont close and open PR-s, just force push with a new version.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the point of even adding them here?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea was to keep aligned with hostapd.conf from hostap.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it's a bad idea to keep some of these around. Might be confusing tho.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is mbedtls not enough?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By #10303 (comment), seems that mbedtls is not working with DPP.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is highly outdated, please test it with mbedtls, it should really work

Copy link
Author

@gubertoli gubertoli Apr 14, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After testing the build for all three variants, I've updated the hostapd Makefile to enable DPP for wpad-openssl and wpad-mbedtls, and dropped it from wpad-wolfssl since it fails to build due to missing PKCS7 and certificate support in the default WolfSSL config.

@systemcrash
Copy link
Contributor

Looks OK.

@systemcrash
Copy link
Contributor

Please don't include merge commits - rebase on main (or master)

Enable Device Provisioning Protocol
(DPPv2) in hostapd, but only for full
builds that use external TLS libraries
(OpenSSL or WolfSSL).

Signed-off-by: Gustavo Bertoli <gubertoli@gmail.com>
The wpad-mbedtls variant now explicitly enables CONFIG_DPP and
CONFIG_DPP2.

Drop DPP support from wpad-wolfssl as it currently fails to build due
to missing PKCS7 and certificate handling features in the default
OpenWrt WolfSSL configuration.

Signed-off-by: Gustavo Bertoli <gubertoli@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
core packages pull request/issue for core (in-tree) packages
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants