Skip to content

hostapd: Enable DPP support in full TLS variant #18485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
+11 −3
Open

hostapd: Enable DPP support in full TLS variant #18485

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
15a6c61
hostapd: Enable DPPv2 support in full TLS variant
gubertoli Mar 12, 2025
1381c88
hostapd: enable DPP in wpad-mbedtls, drop from wpad-wolfssl
gubertoli Apr 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions package/network/services/hostapd/Makefile
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is mbedtls not enough?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

By #10303 (comment), seems that mbedtls is not working with DPP.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is highly outdated, please test it with mbedtls, it should really work

Copy link
Author

@gubertoli gubertoli Apr 14, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After testing the build for all three variants, I've updated the hostapd Makefile to enable DPP for wpad-openssl and wpad-mbedtls, and dropped it from wpad-wolfssl since it fails to build due to missing PKCS7 and certificate support in the default WolfSSL config.

Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@
include $(TOPDIR)/rules.mk

PKG_NAME:=hostapd
PKG_RELEASE:=1
PKG_RELEASE:=2

PKG_SOURCE_URL:=https://w1.fi/hostap.git
PKG_SOURCE_PROTO:=git
Expand Down Expand Up @@ -110,7 +110,7 @@ ifeq ($(SSL_VARIANT),openssl)
DRIVER_MAKEOPTS += CONFIG_AP=y CONFIG_MESH=y
endif
ifeq ($(LOCAL_VARIANT),full)
DRIVER_MAKEOPTS += CONFIG_OWE=y CONFIG_SUITEB192=y CONFIG_AP=y CONFIG_MESH=y CONFIG_EAP_PWD=y
DRIVER_MAKEOPTS += CONFIG_OWE=y CONFIG_SUITEB192=y CONFIG_AP=y CONFIG_MESH=y CONFIG_EAP_PWD=y CONFIG_DPP=y CONFIG_DPP2=y
endif
endif

Expand Down Expand Up @@ -140,7 +140,7 @@ ifeq ($(SSL_VARIANT),mbedtls)
DRIVER_MAKEOPTS += CONFIG_AP=y CONFIG_MESH=y CONFIG_WPS_NFC=1
endif
ifeq ($(LOCAL_VARIANT),full)
DRIVER_MAKEOPTS += CONFIG_OWE=y CONFIG_SUITEB192=y CONFIG_AP=y CONFIG_MESH=y CONFIG_WPS_NFC=1 CONFIG_EAP_PWD=y
DRIVER_MAKEOPTS += CONFIG_OWE=y CONFIG_SUITEB192=y CONFIG_AP=y CONFIG_MESH=y CONFIG_WPS_NFC=1 CONFIG_EAP_PWD=y CONFIG_DPP=y CONFIG_DPP2=y
endif
endif

Expand Down
8 changes: 8 additions & 0 deletions package/network/services/hostapd/files/hostapd-full.config
View file
Open in desktop
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What is the point of even adding them here?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The idea was to keep aligned with hostapd.conf from hostap.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think it's a bad idea to keep some of these around. Might be confusing tho.

Original file line number Diff line number Diff line change
Expand Up @@ -402,3 +402,11 @@ CONFIG_UBUS=y
# leads to the MIB only being compiled in if
# CONFIG_CTRL_IFACE_MIB is enabled.
CONFIG_CTRL_IFACE_MIB=y

# Device Provisioning Protocol (DPP) (also known as Wi-Fi Easy Connect)
#CONFIG_DPP=y
# DPP version 2 support
#CONFIG_DPP2=y
# DPP version 3 support (experimental and still changing; do not enable for
# production use)
#CONFIG_DPP3=y