diff mbox series

[1/1] package/wpa_supplicant: disable TEAP for internal TLS implementation

Message ID 20200108190439.459316-1-geomatsi@gmail.com
State New
Headers show
Series [1/1] package/wpa_supplicant: disable TEAP for internal TLS implementation | expand

Commit Message

Sergey Matyukevich Jan. 8, 2020, 7:04 p.m. UTC
EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal
TLS implementation. This patch disables TEAP support in wpa_supplicant
when internal TLS implementation is selected. Similar fix for hostapd
package has already been merged to Buildroot: see commit 47d14e3b1c20
("package/hostapd: disable TEAP for internal TLS implementation").

TEAP is still an experimental feature that is not recommmended for
production use. Currently it should not be used for anything else
than experimentation and interoperability testing. Those who needs
experimenting with TEAP are encouraged to enable openssl in their
buildroot configuration.

Fixes:
http://autobuild.buildroot.net/results/e83613c06041a60f89da787f4ebf876245713cd2/

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
---
 package/wpa_supplicant/wpa_supplicant.mk | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Arnout Vandecappelle Jan. 13, 2020, 11:05 p.m. UTC | #1
On 08/01/2020 20:04, Sergey Matyukevich wrote:
> EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal
> TLS implementation. This patch disables TEAP support in wpa_supplicant
> when internal TLS implementation is selected. Similar fix for hostapd
> package has already been merged to Buildroot: see commit 47d14e3b1c20
> ("package/hostapd: disable TEAP for internal TLS implementation").
> 
> TEAP is still an experimental feature that is not recommmended for
> production use. Currently it should not be used for anything else
> than experimentation and interoperability testing. Those who needs
> experimenting with TEAP are encouraged to enable openssl in their
> buildroot configuration.

 So then why don't we just unconditionally disable this feature? Preferably with
a comment in the .mk file that it's disabled due to its experimental nature, so
that someone who needs it a couple of years down the line can note that it's not
longer experimental.

 Regards,
 Arnout

> 
> Fixes:
> http://autobuild.buildroot.net/results/e83613c06041a60f89da787f4ebf876245713cd2/
> 
> Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
> ---
>  package/wpa_supplicant/wpa_supplicant.mk | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
> index 4f95ea6276..c87494c2bf 100644
> --- a/package/wpa_supplicant/wpa_supplicant.mk
> +++ b/package/wpa_supplicant/wpa_supplicant.mk
> @@ -112,7 +112,7 @@ WPA_SUPPLICANT_DEPENDENCIES += host-pkgconf libopenssl
>  WPA_SUPPLICANT_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs openssl`
>  WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=openssl\)/\1/'
>  else
> -WPA_SUPPLICANT_CONFIG_DISABLE += CONFIG_EAP_PWD
> +WPA_SUPPLICANT_CONFIG_DISABLE += CONFIG_EAP_PWD CONFIG_EAP_TEAP
>  WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=\).*/\1internal/'
>  endif
>  
>
Sergey Matyukevich Jan. 14, 2020, 8:02 a.m. UTC | #2
> On 08/01/2020 20:04, Sergey Matyukevich wrote:
> > EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal
> > TLS implementation. This patch disables TEAP support in wpa_supplicant
> > when internal TLS implementation is selected. Similar fix for hostapd
> > package has already been merged to Buildroot: see commit 47d14e3b1c20
> > ("package/hostapd: disable TEAP for internal TLS implementation").
> > 
> > TEAP is still an experimental feature that is not recommmended for
> > production use. Currently it should not be used for anything else
> > than experimentation and interoperability testing. Those who needs
> > experimenting with TEAP are encouraged to enable openssl in their
> > buildroot configuration.
> 
>  So then why don't we just unconditionally disable this feature? Preferably with
> a comment in the .mk file that it's disabled due to its experimental nature, so
> that someone who needs it a couple of years down the line can note that it's not
> longer experimental.

Well, this is another possible option. But I don't see why we should
disable it completely. TEAP does not build with internal hostapd TLSv1
implementation, which in its turn is also marked as experimental. On
the other hand, TEAP successfully builds if OpenSSL is selected as TLS
implementation. So why don't we just disable known broken combination,
leaving the choice between working combinations to the end user.

Regards,
Sergey
Sergey Matyukevich Feb. 16, 2020, 2:38 p.m. UTC | #3
> > > EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal
> > > TLS implementation. This patch disables TEAP support in wpa_supplicant
> > > when internal TLS implementation is selected. Similar fix for hostapd
> > > package has already been merged to Buildroot: see commit 47d14e3b1c20
> > > ("package/hostapd: disable TEAP for internal TLS implementation").
> > > 
> > > TEAP is still an experimental feature that is not recommmended for
> > > production use. Currently it should not be used for anything else
> > > than experimentation and interoperability testing. Those who needs
> > > experimenting with TEAP are encouraged to enable openssl in their
> > > buildroot configuration.
> > 
> >  So then why don't we just unconditionally disable this feature? Preferably with
> > a comment in the .mk file that it's disabled due to its experimental nature, so
> > that someone who needs it a couple of years down the line can note that it's not
> > longer experimental.
> 
> Well, this is another possible option. But I don't see why we should
> disable it completely. TEAP does not build with internal hostapd TLSv1
> implementation, which in its turn is also marked as experimental. On
> the other hand, TEAP successfully builds if OpenSSL is selected as TLS
> implementation. So why don't we just disable known broken combination,
> leaving the choice between working combinations to the end user.

Hi Thomas, Arnout,

It has been a while since my last reply. Do you still have any other
concerns regarding suggested approach ?

Let me reiterate the idea. TEAP is a farily new and experimental hostapd
feature which does not compile with internal hostapd TLS implementation.
On the other hand, it can be successfully built with OpenSSL as TLS
provider for hostapd.

So suggested approach explicitly disables broken configuration, but still
lets the users to play with it if they need to.

Regards,
Sergey
Sergey Matyukevich March 15, 2020, 8:07 p.m. UTC | #4
On Wed, Jan 08, 2020 at 10:04:39PM +0300, Sergey Matyukevich wrote:
> EAP-TEAP support in hostapd/wpa_supplicant fails to build with internal
> TLS implementation. This patch disables TEAP support in wpa_supplicant
> when internal TLS implementation is selected. Similar fix for hostapd
> package has already been merged to Buildroot: see commit 47d14e3b1c20
> ("package/hostapd: disable TEAP for internal TLS implementation").
> 
> TEAP is still an experimental feature that is not recommmended for
> production use. Currently it should not be used for anything else
> than experimentation and interoperability testing. Those who needs
> experimenting with TEAP are encouraged to enable openssl in their
> buildroot configuration.
> 
> Fixes:
> http://autobuild.buildroot.net/results/e83613c06041a60f89da787f4ebf876245713cd2/

Also fixes similar recent autobuild failure:
http://autobuild.buildroot.net/results/c52dd7fbb74d8f7bdd0149ce0bd90f89caec5776/

Regards,
Sergey
diff mbox series

Patch

diff --git a/package/wpa_supplicant/wpa_supplicant.mk b/package/wpa_supplicant/wpa_supplicant.mk
index 4f95ea6276..c87494c2bf 100644
--- a/package/wpa_supplicant/wpa_supplicant.mk
+++ b/package/wpa_supplicant/wpa_supplicant.mk
@@ -112,7 +112,7 @@  WPA_SUPPLICANT_DEPENDENCIES += host-pkgconf libopenssl
 WPA_SUPPLICANT_LIBS += `$(PKG_CONFIG_HOST_BINARY) --libs openssl`
 WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=openssl\)/\1/'
 else
-WPA_SUPPLICANT_CONFIG_DISABLE += CONFIG_EAP_PWD
+WPA_SUPPLICANT_CONFIG_DISABLE += CONFIG_EAP_PWD CONFIG_EAP_TEAP
 WPA_SUPPLICANT_CONFIG_EDITS += 's/\#\(CONFIG_TLS=\).*/\1internal/'
 endif