| Message ID | 20200108190439.459316-1-geomatsi@gmail.com |
|---|---|
| State | Accepted |
| Headers | show |
| Series | [1/1] package/wpa_supplicant: disable TEAP for internal TLS implementation | expand |
On 08/01/2020 20:04, Sergey Matyukevich wrote: > EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal > TLS implementation. This patch disables TEAP support in wpa_supplicant > when internal TLS implementation is selected. Similar fix for hostapd > package has already been merged to Buildroot: see commit 47d14e3b1c20 > ("package/hostapd: disable TEAP for internal TLS implementation"). > > TEAP is still an experimental feature that is not recommmended for > production use. Currently it should not be used for anything else > than experimentation and interoperability testing. Those who needs > experimenting with TEAP are encouraged to enable openssl in their > buildroot configuration. So then why don't we just unconditionally disable this feature? Preferably with a comment in the .mk file that it's disabled due to its experimental nature, so that someone who needs it a couple of years down the line can note that it's not longer experimental. Regards, Arnout > > Fixes: > http://autobuild.buildroot.net/results/e83613c06041a60f89da787f4ebf876245713cd2/ > > Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com> > --- > package/wpa_supplicant/wpa_supplicant.mk | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk > index 4f95ea6276..c87494c2bf 100644 > --- a/package/wpa_supplicant/wpa_supplicant.mk > +++ b/package/wpa_supplicant/wpa_supplicant.mk > @@ -112,7 +112,7 @@ WPA_SUPPLICANT_DEPENDENCIES += host-pkgconf libopenssl > WPA_SUPPLICANT_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs openssl` > WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=openssl\)/\1/' > else > -WPA_SUPPLICANT_CONFIG_DISABLE += CONFIG_EAP_PWD > +WPA_SUPPLICANT_CONFIG_DISABLE += CONFIG_EAP_PWD CONFIG_EAP_TEAP > WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=\).*/\1internal/' > endif > >
> On 08/01/2020 20:04, Sergey Matyukevich wrote: > > EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal > > TLS implementation. This patch disables TEAP support in wpa_supplicant > > when internal TLS implementation is selected. Similar fix for hostapd > > package has already been merged to Buildroot: see commit 47d14e3b1c20 > > ("package/hostapd: disable TEAP for internal TLS implementation"). > > > > TEAP is still an experimental feature that is not recommmended for > > production use. Currently it should not be used for anything else > > than experimentation and interoperability testing. Those who needs > > experimenting with TEAP are encouraged to enable openssl in their > > buildroot configuration. > > So then why don't we just unconditionally disable this feature? Preferably with > a comment in the .mk file that it's disabled due to its experimental nature, so > that someone who needs it a couple of years down the line can note that it's not > longer experimental. Well, this is another possible option. But I don't see why we should disable it completely. TEAP does not build with internal hostapd TLSv1 implementation, which in its turn is also marked as experimental. On the other hand, TEAP successfully builds if OpenSSL is selected as TLS implementation. So why don't we just disable known broken combination, leaving the choice between working combinations to the end user. Regards, Sergey
> > > EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal > > > TLS implementation. This patch disables TEAP support in wpa_supplicant > > > when internal TLS implementation is selected. Similar fix for hostapd > > > package has already been merged to Buildroot: see commit 47d14e3b1c20 > > > ("package/hostapd: disable TEAP for internal TLS implementation"). > > > > > > TEAP is still an experimental feature that is not recommmended for > > > production use. Currently it should not be used for anything else > > > than experimentation and interoperability testing. Those who needs > > > experimenting with TEAP are encouraged to enable openssl in their > > > buildroot configuration. > > > > So then why don't we just unconditionally disable this feature? Preferably with > > a comment in the .mk file that it's disabled due to its experimental nature, so > > that someone who needs it a couple of years down the line can note that it's not > > longer experimental. > > Well, this is another possible option. But I don't see why we should > disable it completely. TEAP does not build with internal hostapd TLSv1 > implementation, which in its turn is also marked as experimental. On > the other hand, TEAP successfully builds if OpenSSL is selected as TLS > implementation. So why don't we just disable known broken combination, > leaving the choice between working combinations to the end user. Hi Thomas, Arnout, It has been a while since my last reply. Do you still have any other concerns regarding suggested approach ? Let me reiterate the idea. TEAP is a farily new and experimental hostapd feature which does not compile with internal hostapd TLS implementation. On the other hand, it can be successfully built with OpenSSL as TLS provider for hostapd. So suggested approach explicitly disables broken configuration, but still lets the users to play with it if they need to. Regards, Sergey
On Wed, Jan 08, 2020 at 10:04:39PM +0300, Sergey Matyukevich wrote: > EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal > TLS implementation. This patch disables TEAP support in wpa_supplicant > when internal TLS implementation is selected. Similar fix for hostapd > package has already been merged to Buildroot: see commit 47d14e3b1c20 > ("package/hostapd: disable TEAP for internal TLS implementation"). > > TEAP is still an experimental feature that is not recommmended for > production use. Currently it should not be used for anything else > than experimentation and interoperability testing. Those who needs > experimenting with TEAP are encouraged to enable openssl in their > buildroot configuration. > > Fixes: > http://autobuild.buildroot.net/results/e83613c06041a60f89da787f4ebf876245713cd2/ Also fixes similar recent autobuild failure: http://autobuild.buildroot.net/results/c52dd7fbb74d8f7bdd0149ce0bd90f89caec5776/ Regards, Sergey
On Wed, 8 Jan 2020 22:04:39 +0300 Sergey Matyukevich <geomatsi@gmail.com> wrote: > EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal > TLS implementation. This patch disables TEAP support in wpa_supplicant > when internal TLS implementation is selected. Similar fix for hostapd > package has already been merged to Buildroot: see commit 47d14e3b1c20 > ("package/hostapd: disable TEAP for internal TLS implementation"). > > TEAP is still an experimental feature that is not recommmended for > production use. Currently it should not be used for anything else > than experimentation and interoperability testing. Those who needs > experimenting with TEAP are encouraged to enable openssl in their > buildroot configuration. > > Fixes: > http://autobuild.buildroot.net/results/e83613c06041a60f89da787f4ebf876245713cd2/ > > Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com> > --- > package/wpa_supplicant/wpa_supplicant.mk | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Applied to master, thanks. Thomas
>>>>> "Thomas" == Thomas Petazzoni <thomas.petazzoni@bootlin.com> writes: > On Wed, 8 Jan 2020 22:04:39 +0300 > Sergey Matyukevich <geomatsi@gmail.com> wrote: >> EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal >> TLS implementation. This patch disables TEAP support in wpa_supplicant >> when internal TLS implementation is selected. Similar fix for hostapd >> package has already been merged to Buildroot: see commit 47d14e3b1c20 >> ("package/hostapd: disable TEAP for internal TLS implementation"). >> >> TEAP is still an experimental feature that is not recommmended for >> production use. Currently it should not be used for anything else >> than experimentation and interoperability testing. Those who needs >> experimenting with TEAP are encouraged to enable openssl in their >> buildroot configuration. >> >> Fixes: >> http://autobuild.buildroot.net/results/e83613c06041a60f89da787f4ebf876245713cd2/ >> >> Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com> >> --- >> package/wpa_supplicant/wpa_supplicant.mk | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) Committed to 2020.02.x and 2020.05.x, thanks.
diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk index 4f95ea6276..c87494c2bf 100644 --- a/package/wpa_supplicant/wpa_supplicant.mk +++ b/package/wpa_supplicant/wpa_supplicant.mk @@ -112,7 +112,7 @@ WPA_SUPPLICANT_DEPENDENCIES += host-pkgconf libopenssl WPA_SUPPLICANT_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs openssl` WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=openssl\)/\1/' else -WPA_SUPPLICANT_CONFIG_DISABLE += CONFIG_EAP_PWD +WPA_SUPPLICANT_CONFIG_DISABLE += CONFIG_EAP_PWD CONFIG_EAP_TEAP WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=\).*/\1internal/' endif
EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal TLS implementation. This patch disables TEAP support in wpa_supplicant when internal TLS implementation is selected. Similar fix for hostapd package has already been merged to Buildroot: see commit 47d14e3b1c20 ("package/hostapd: disable TEAP for internal TLS implementation"). TEAP is still an experimental feature that is not recommmended for production use. Currently it should not be used for anything else than experimentation and interoperability testing. Those who needs experimenting with TEAP are encouraged to enable openssl in their buildroot configuration. Fixes: http://autobuild.buildroot.net/results/e83613c06041a60f89da787f4ebf876245713cd2/ Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com> --- package/wpa_supplicant/wpa_supplicant.mk | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)