Skip to content

Commit d4b56c3

Browse files
krish2718rlubos
krish2718
authored and
rlubos
committed
net: lib: Add a new hostap crypto library
This libray is primarily to maintain NCS build for hostap using nRF security. It uses external crypto option in the upstream hostap to overriwde crypto configuration. Signed-off-by: Chaitanya Tata <[email protected]>
1 parent ec4d5bf commit d4b56c3

File tree

5 files changed

+284
-0
lines changed

5 files changed

+284
-0
lines changed

‎CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -678,6 +678,7 @@
678678
/subsys/net/lib/azure_* @nrfconnect/ncs-cia
679679
/subsys/net/lib/aws_* @nrfconnect/ncs-cia
680680
/subsys/net/lib/ftp_client/ @nrfconnect/ncs-iot-oulu
681+
/subsys/net/lib/hostap_crypto/ @krish2718 @jukkar @vivekuppunda
681682
/subsys/net/lib/icalendar_parser/ @lats1980
682683
/subsys/net/lib/lwm2m_client_utils/ @nrfconnect/ncs-co-networking @nrfconnect/ncs-iot-oulu
683684
/subsys/net/lib/nrf_cloud/ @nrfconnect/ncs-nrf-cloud

‎subsys/net/lib/CMakeLists.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,3 +36,4 @@ add_subdirectory_ifdef(CONFIG_MQTT_HELPER mqtt_helper)
3636
add_subdirectory_ifdef(CONFIG_NRF_PROVISIONING nrf_provisioning)
3737
add_subdirectory_ifdef(CONFIG_NRF_MCUMGR_SMP_CLIENT mcumgr_smp_client)
3838
add_subdirectory_ifdef(CONFIG_WIFI_NRF70 nrf70_fw_ext)
39+
add_subdirectory_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT hostap_crypto)

‎subsys/net/lib/Kconfig‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,5 +48,6 @@ rsource "mqtt_helper/Kconfig"
4848
rsource "nrf_provisioning/Kconfig"
4949
rsource "mcumgr_smp_client/Kconfig"
5050
rsource "nrf70_fw_ext/Kconfig"
51+
rsource "hostap_crypto/Kconfig"
5152

5253
endmenu

‎subsys/net/lib/hostap_crypto/CMakeLists.txt‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
#
2+
# Copyright (c) 2024 Nordic Semiconductor
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
zephyr_interface_library_named(hostap_crypto)
8+
9+
set(HOSTAP_BASE ${ZEPHYR_HOSTAP_MODULE_DIR})
10+
set(WIFI_NM_WPA_SUPPLICANT_BASE ${HOSTAP_BASE}/wpa_supplicant)
11+
set(HOSTAP_SRC_BASE ${HOSTAP_BASE}/src)
12+
set(WIFI_NM_HOSTAPD_BASE ${HOSTAP_BASE}/hostapd)
13+
14+
set(CMAKE_EXE_LINKER_FLAGS "--specs=nosys.specs -lnosys")
15+
set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DMISSING_SYSCALL_NAMES")
16+
17+
# For src/utils includes
18+
target_link_libraries(hostap_crypto INTERFACE hostap)
19+
20+
if(DEFINED CONFIG_HOSTAP_CRYPTO_LEGACY OR
21+
DEFINED CONFIG_HOSTAP_CRYPTO_LEGACY_PSA)
22+
zephyr_library_sources(
23+
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls-bignum.c
24+
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls-ec.c
25+
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls.c
26+
${HOSTAP_SRC_BASE}/crypto/aes-internal.c
27+
${HOSTAP_SRC_BASE}/crypto/aes-wrap.c
28+
${HOSTAP_SRC_BASE}/crypto/aes-unwrap.c
29+
${HOSTAP_SRC_BASE}/crypto/rc4.c
30+
${HOSTAP_SRC_BASE}/crypto/sha1-internal.c
31+
${HOSTAP_SRC_BASE}/crypto/sha1-prf.c
32+
${HOSTAP_SRC_BASE}/crypto/sha1-tlsprf.c
33+
${HOSTAP_SRC_BASE}/crypto/sha256-prf.c
34+
${HOSTAP_SRC_BASE}/crypto/sha256-kdf.c
35+
${HOSTAP_SRC_BASE}/crypto/sha384-prf.c
36+
${HOSTAP_SRC_BASE}/crypto/sha384-kdf.c
37+
${HOSTAP_SRC_BASE}/crypto/sha512-internal.c
38+
${HOSTAP_SRC_BASE}/crypto/sha512.c
39+
${HOSTAP_SRC_BASE}/crypto/sha512-prf.c
40+
${HOSTAP_SRC_BASE}/crypto/sha512-kdf.c
41+
)
42+
43+
zephyr_library_sources_ifdef(CONFIG_HOSTAP_WPA3
44+
${HOSTAP_SRC_BASE}/crypto/sha256-kdf.c
45+
)
46+
47+
zephyr_library_sources_ifndef(CONFIG_HOSTAP_CRYPTO_ENTERPRISE
48+
${HOSTAP_SRC_BASE}/crypto/tls_none.c
49+
)
50+
51+
zephyr_library_sources_ifdef(CONFIG_HOSTAP_CRYPTO_ENTERPRISE
52+
# common
53+
${HOSTAP_SRC_BASE}/crypto/sha384-tlsprf.c
54+
${HOSTAP_SRC_BASE}/crypto/sha256-tlsprf.c
55+
${HOSTAP_SRC_BASE}/crypto/sha1-tlsprf.c
56+
${HOSTAP_SRC_BASE}/crypto/sha1-tprf.c
57+
${HOSTAP_SRC_BASE}/crypto/ms_funcs.c
58+
${HOSTAP_SRC_BASE}/crypto/aes-eax.c
59+
# MD4 removed from MbedTLS
60+
${HOSTAP_SRC_BASE}/crypto/md4-internal.c
61+
${HOSTAP_SRC_BASE}/crypto/aes-encblock.c
62+
${HOSTAP_SRC_BASE}/crypto/tls_mbedtls.c
63+
)
64+
endif()
65+
66+
if(DEFINED CONFIG_HOSTAP_CRYPTO_ALT_LEGACY)
67+
zephyr_include_directories(
68+
${HOSTAP_BASE}/port/mbedtls
69+
)
70+
71+
zephyr_library_sources(
72+
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls_alt.c
73+
${HOSTAP_SRC_BASE}/crypto/rc4.c
74+
${HOSTAP_SRC_BASE}/crypto/aes-wrap.c
75+
${HOSTAP_SRC_BASE}/crypto/aes-unwrap.c
76+
${HOSTAP_SRC_BASE}/crypto/aes-internal-dec.c
77+
${HOSTAP_SRC_BASE}/crypto/aes-internal.c
78+
${HOSTAP_SRC_BASE}/crypto/aes-internal-enc.c
79+
)
80+
81+
zephyr_library_sources_ifdef(CONFIG_HOSTAP_CRYPTO_MBEDTLS_PSA
82+
${HOSTAP_BASE}/port/mbedtls/supp_psa_api.c
83+
)
84+
85+
zephyr_library_sources_ifdef(CONFIG_HOSTAP_CRYPTO_ENTERPRISE
86+
${HOSTAP_SRC_BASE}/crypto/ms_funcs.c
87+
${HOSTAP_SRC_BASE}/crypto/aes-eax.c
88+
${HOSTAP_SRC_BASE}/crypto/md4-internal.c
89+
${HOSTAP_SRC_BASE}/crypto/sha1-internal.c
90+
${HOSTAP_SRC_BASE}/crypto/fips_prf_internal.c
91+
${HOSTAP_SRC_BASE}/crypto/milenage.c
92+
${HOSTAP_SRC_BASE}/crypto/tls_mbedtls_alt.c
93+
)
94+
95+
zephyr_library_sources_ifndef(CONFIG_HOSTAP_CRYPTO_ENTERPRISE
96+
${HOSTAP_SRC_BASE}/crypto/tls_none.c
97+
)
98+
99+
100+
zephyr_library_sources_ifdef(CONFIG_HOSTAP_CRYPTO_TEST
101+
${HOSTAP_SRC_BASE}/crypto/crypto_module_tests.c
102+
${HOSTAP_SRC_BASE}/crypto/fips_prf_internal.c
103+
${HOSTAP_SRC_BASE}/crypto/sha1-internal.c
104+
${HOSTAP_SRC_BASE}/crypto/sha1-tlsprf.c
105+
)
106+
endif()
107+
108+
if(DEFINED CONFIG_HOSTAP_CRYPTO_ALT_PSA)
109+
# Source code still uses the original symbol
110+
zephyr_compile_definitions(
111+
CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA
112+
)
113+
114+
zephyr_include_directories(
115+
${HOSTAP_BASE}/port/mbedtls
116+
)
117+
118+
zephyr_library_sources(
119+
${HOSTAP_SRC_BASE}/crypto/aes-wrap.c
120+
${HOSTAP_SRC_BASE}/crypto/aes-unwrap.c
121+
${HOSTAP_SRC_BASE}/crypto/aes-internal-dec.c
122+
${HOSTAP_SRC_BASE}/crypto/aes-internal.c
123+
${HOSTAP_SRC_BASE}/crypto/aes-internal-enc.c
124+
${HOSTAP_SRC_BASE}/crypto/rc4.c
125+
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls_alt.c
126+
${HOSTAP_SRC_BASE}/crypto/sha256-kdf.c
127+
${HOSTAP_BASE}/port/mbedtls/supp_psa_api.c
128+
${HOSTAP_SRC_BASE}/crypto/tls_none.c
129+
)
130+
endif()

‎subsys/net/lib/hostap_crypto/Kconfig‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
#
2+
# Copyright (c) 2024 Nordic Semiconductor
3+
#
4+
# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
5+
#
6+
7+
if WIFI_NM_WPA_SUPPLICANT
8+
9+
choice WIFI_NM_WPA_SUPPLICANT_CRYPTO_BACKEND
10+
default WIFI_NM_WPA_SUPPLICANT_CRYPTO_EXT
11+
endchoice
12+
13+
choice HOSTAP_CRYPTO_BACKEND
14+
prompt "WPA supplicant crypto implementation"
15+
default HOSTAP_CRYPTO_ALT_PSA if SOC_SERIES_NRF54HX
16+
default HOSTAP_CRYPTO_LEGACY_PSA if SOC_SERIES_NRF54LX || BUILD_WITH_TFM
17+
default HOSTAP_CRYPTO_ALT_LEGACY
18+
help
19+
Select the crypto implementation to use for WPA supplicant.
20+
HOSTAP_CRYPTO_ALT supports enterprise mode
21+
and DPP.
22+
23+
config HOSTAP_CRYPTO_LEGACY
24+
bool "Legacy Crypto support for WiFi using nRF security"
25+
select MBEDTLS
26+
select NRF_SECURITY
27+
select MBEDTLS_CIPHER_MODE_CBC
28+
select MBEDTLS_CIPHER_MODE_CTR
29+
select MBEDTLS_LEGACY_CRYPTO_C
30+
select MBEDTLS_SHA1_C
31+
select MBEDTLS_ECP_C
32+
select MBEDTLS_CTR_DRBG_C
33+
select MBEDTLS_PK_C
34+
select MBEDTLS_PKCS5_C
35+
select MBEDTLS_PK_PARSE_C
36+
select MBEDTLS_CMAC_C
37+
select MBEDTLS_CIPHER_PADDING_PKCS7
38+
select MBEDTLS_PK_WRITE_C
39+
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
40+
select MBEDTLS_ECP_DP_SECP256R1_ENABLED
41+
42+
config HOSTAP_CRYPTO_LEGACY_PSA
43+
bool "PSA Crypto support for WiFi using nRF security"
44+
select MBEDTLS
45+
select NRF_SECURITY
46+
select PSA_WANT_GENERATE_RANDOM
47+
# Legacy crypto, still needed
48+
select MBEDTLS_SHA1_C
49+
select MBEDTLS_LEGACY_CRYPTO_C
50+
select MBEDTLS_CMAC_C
51+
select MBEDTLS_GCM_C
52+
select MBEDTLS_TLS_LIBRARY
53+
select MBEDTLS_PK_C
54+
select MBEDTLS_PK_WRITE_C
55+
select MBEDTLS_X509_LIBRARY
56+
select MBEDTLS_X509_CRT_PARSE_C
57+
select MBEDTLS_CIPHER_C
58+
select MBEDTLS_CIPHER_MODE_CTR
59+
select MBEDTLS_CIPHER_MODE_CBC
60+
select MBEDTLS_SSL_TLS_C
61+
select MBEDTLS_ECP_C
62+
select MBEDTLS_CTR_DRBG_C
63+
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
64+
select MBEDTLS_MD_C
65+
select MBEDTLS_CIPHER_PADDING_PKCS7
66+
select MBEDTLS_PKCS5_C
67+
select MBEDTLS_ECP_DP_SECP256R1_ENABLED
68+
69+
config HOSTAP_CRYPTO_ALT_LEGACY
70+
bool "Legacy Crypto support for WiFi using nRF security"
71+
select MBEDTLS
72+
select NRF_SECURITY
73+
select MBEDTLS_CIPHER_MODE_CBC
74+
select MBEDTLS_CIPHER_MODE_CTR
75+
select MBEDTLS_LEGACY_CRYPTO_C
76+
select MBEDTLS_ENTROPY_C
77+
select MBEDTLS_CIPHER
78+
select MBEDTLS_ECP_C
79+
select MBEDTLS_CTR_DRBG_C
80+
select MBEDTLS_PK_WRITE_C
81+
select MBEDTLS_HKDF_C
82+
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
83+
select MBEDTLS_MD_C
84+
select MBEDTLS_MD5_C
85+
select MBEDTLS_ENTROPY_C
86+
select MBEDTLS_CIPHER_PADDING_PKCS7
87+
select MBEDTLS_PKCS5_C
88+
89+
config HOSTAP_CRYPTO_ALT_LEGACY_PSA
90+
bool "Legacy Crypto support for WiFi using nRF security"
91+
select MBEDTLS
92+
select NRF_SECURITY
93+
select PSA_WANT_GENERATE_RANDOM
94+
select MBEDTLS_CIPHER_MODE_CBC
95+
select MBEDTLS_CIPHER_MODE_CTR
96+
select MBEDTLS_LEGACY_CRYPTO_C
97+
select MBEDTLS_SHA1_C
98+
select MBEDTLS_ECP_C
99+
select MBEDTLS_CTR_DRBG_C
100+
select MBEDTLS_PK_C
101+
select MBEDTLS_PKCS5_C
102+
select MBEDTLS_PK_PARSE_C
103+
select MBEDTLS_CMAC_C
104+
select MBEDTLS_CIPHER_PADDING_PKCS7
105+
select MBEDTLS_PK_WRITE_C
106+
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
107+
select MBEDTLS_ENTROPY_C
108+
109+
config HOSTAP_CRYPTO_ALT_PSA
110+
bool "PSA Crypto support for WiFi WPA2 using nRF security"
111+
select MBEDTLS
112+
select NRF_SECURITY
113+
select PSA_WANT_GENERATE_RANDOM
114+
select MBEDTLS_PK_C
115+
select MBEDTLS_MD_C
116+
select MBEDTLS_PK_WRITE_C
117+
select MBEDTLS_ENABLE_HEAP
118+
select MBEDTLS_PSA_CRYPTO_C
119+
select MBEDTLS_USE_PSA_CRYPTO
120+
select PSA_WANT_ALG_HMAC
121+
select PSA_WANT_ALG_CMAC
122+
select PSA_WANT_ALG_ECB_NO_PADDING
123+
select PSA_WANT_ALG_CBC_PKCS7
124+
select PSA_ACCEL_CBC_MAC_AES_128
125+
select PSA_ACCEL_CBC_MAC_AES_192
126+
select PSA_ACCEL_CBC_MAC_AES_256
127+
select PSA_WANT_ALG_CCM
128+
select PSA_WANT_ALG_GCM
129+
select PSA_WANT_ALG_CTR
130+
select PSA_WANT_ALG_MD5
131+
select PSA_ACCEL_MD5
132+
select PSA_WANT_ALG_SHA_1
133+
select PSA_WANT_ALG_SHA_256
134+
select PSA_WANT_ALG_SHA_224
135+
select PSA_WANT_ALG_SHA_384
136+
select PSA_WANT_ALG_SHA_512
137+
select PSA_WANT_ALG_PBKDF2_HMAC
138+
select PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
139+
select PSA_WANT_KEY_TYPE_AES
140+
select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY
141+
142+
endchoice
143+
144+
# PSA crypto is WPA2 only for now
145+
if HOSTAP_CRYPTO_ALT_PSA
146+
config WIFI_NM_WPA_SUPPLICANT_WPA3
147+
default n
148+
config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
149+
default n
150+
endif
151+
endif

0 commit comments

Comments
 (0)