Skip to content

wifi: hostap: Pull external crypto support #2253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Dec 2, 2024
Merged

wifi: hostap: Pull external crypto support #2253

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
e419a6b
Revert "[nrf noup] hostap: Fix PSA config"
rlubos Nov 27, 2024
3cad483
Revert "[nrf noup] modules: hostap: Add NCS PSA for hostap crypto ALT"
rlubos Nov 27, 2024
e2d65e9
Revert "[nrf noup] modules: hostap: Fix NS build"
rlubos Nov 27, 2024
f883913
Revert "[nrf noup] modules: hostap: Fix duplicate define warning"
rlubos Nov 27, 2024
88acae6
Revert "[nrf noup] modules: hostap: Add NCS PSA for hostap crypto ALT"
rlubos Nov 27, 2024
820eba2
Revert "[nrf noup] modules: hostap: Support Wi-Fi EAP-TLS mode"
rlubos Nov 27, 2024
d524d70
Revert "[nrf noup] hostap: Support legacy dependency checkup for nrf_…
rlubos Nov 27, 2024
b83e2f3
Revert "[nrf noup] modules: hostap: Use nRF security"
rlubos Nov 27, 2024
90e9f11
[nrf fromtree] modules: hostap: Add external crypto support
krish2718 Nov 11, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 4 additions & 36 deletions modules/hostap/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -564,10 +564,8 @@ zephyr_library_sources_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT_DPP
${HOSTAP_SRC_BASE}/tls/asn1.c
)

# crypto mbedtls related CRYPTO OR LEGACY_NCS
if(DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO OR
DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS OR
DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS_PSA)
# crypto mbedtls related
if(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO)
zephyr_library_sources(
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls-bignum.c
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls-ec.c
Expand Down Expand Up @@ -612,20 +610,15 @@ zephyr_library_sources_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
)
endif()

if(DEFINED ONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT OR
DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_LEGACY_NCS)
if(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT)
zephyr_include_directories(
${HOSTAP_BASE}/port/mbedtls
)

zephyr_library_sources(
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls_alt.c
${HOSTAP_SRC_BASE}/crypto/tls_mbedtls_alt.c
${HOSTAP_SRC_BASE}/crypto/rc4.c
${HOSTAP_SRC_BASE}/crypto/aes-wrap.c
${HOSTAP_SRC_BASE}/crypto/aes-unwrap.c
${HOSTAP_SRC_BASE}/crypto/aes-internal-dec.c
${HOSTAP_SRC_BASE}/crypto/aes-internal.c
${HOSTAP_SRC_BASE}/crypto/aes-internal-enc.c
)

zephyr_library_sources_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA
Expand All @@ -639,14 +632,8 @@ zephyr_library_sources_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
${HOSTAP_SRC_BASE}/crypto/sha1-internal.c
${HOSTAP_SRC_BASE}/crypto/fips_prf_internal.c
${HOSTAP_SRC_BASE}/crypto/milenage.c
${HOSTAP_SRC_BASE}/crypto/tls_mbedtls_alt.c
)

zephyr_library_sources_ifndef(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
${HOSTAP_SRC_BASE}/crypto/tls_none.c
)


zephyr_library_sources_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_TEST
${HOSTAP_SRC_BASE}/crypto/crypto_module_tests.c
${HOSTAP_SRC_BASE}/crypto/fips_prf_internal.c
Expand All @@ -655,25 +642,6 @@ zephyr_library_sources_ifdef(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_TEST
)
endif()

if(DEFINED CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_NCS_PSA)
zephyr_include_directories(
${HOSTAP_BASE}/port/mbedtls
)

zephyr_library_sources(
${HOSTAP_SRC_BASE}/crypto/aes-wrap.c
${HOSTAP_SRC_BASE}/crypto/aes-unwrap.c
${HOSTAP_SRC_BASE}/crypto/aes-internal-dec.c
${HOSTAP_SRC_BASE}/crypto/aes-internal.c
${HOSTAP_SRC_BASE}/crypto/aes-internal-enc.c
${HOSTAP_SRC_BASE}/crypto/rc4.c
${HOSTAP_SRC_BASE}/crypto/crypto_mbedtls_alt.c
${HOSTAP_SRC_BASE}/crypto/sha256-kdf.c
${HOSTAP_BASE}/port/mbedtls/supp_psa_api.c
${HOSTAP_SRC_BASE}/crypto/tls_none.c
)
endif()

zephyr_library_link_libraries_ifndef(CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE
mbedTLS)

Expand Down
153 changes: 14 additions & 139 deletions modules/hostap/Kconfig
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -109,9 +109,7 @@ config WIFI_NM_WPA_SUPPLICANT_WEP

choice WIFI_NM_WPA_SUPPLICANT_CRYPTO_BACKEND
prompt "WPA supplicant crypto implementation"
default WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_NCS_PSA if SOC_SERIES_NRF54HX
default WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS_PSA if SOC_SERIES_NRF54LX || BUILD_WITH_TFM
default WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_LEGACY_NCS
default WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
help
Select the crypto implementation to use for WPA supplicant.
WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT supports enterprise mode
Expand All @@ -137,7 +135,6 @@ config WIFI_NM_WPA_SUPPLICANT_CRYPTO
select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
select MBEDTLS_ECP_DP_SECP256R1_ENABLED

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
bool "Crypto Mbedtls alt support for WiFi"
Expand All @@ -152,164 +149,42 @@ config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT
select MBEDTLS_CIPHER
select MBEDTLS_ECP_C
select MBEDTLS_ECP_ALL_ENABLED
select MBEDTLS_CMAC_C
select MBEDTLS_CMAC
select MBEDTLS_PKCS5_C
select MBEDTLS_PK_WRITE_C
select MBEDTLS_ECDH_C
select MBEDTLS_ECDSA_C
select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
select MBEDTLS_NIST_KW_C
select MBEDTLS_DHM_C
select MBEDTLS_HKDF_C
select MBEDTLS_SERVER_NAME_INDICATION
select MBEDTLS_X509_CRL_PARSE_C
select MBEDTLS_TLS_VERSION_1_2
select MBEDTLS_ECP_DP_SECP256R1_ENABLED

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS
bool "Legacy Crypto support for WiFi using nRF security"
select MBEDTLS
select NRF_SECURITY
select MBEDTLS_CIPHER_MODE_CBC
select MBEDTLS_CIPHER_MODE_CTR
select MBEDTLS_LEGACY_CRYPTO_C
select MBEDTLS_SHA1_C
select MBEDTLS_ECP_C
select MBEDTLS_CTR_DRBG_C
select MBEDTLS_PK_C
select MBEDTLS_PKCS5_C
select MBEDTLS_PK_PARSE_C
select MBEDTLS_CMAC_C
select MBEDTLS_CIPHER_PADDING_PKCS7
select MBEDTLS_PK_WRITE_C
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
select MBEDTLS_ECP_DP_SECP256R1_ENABLED

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_LEGACY_NCS_PSA
bool "PSA Crypto support for WiFi using nRF security"
select MBEDTLS
select NRF_SECURITY
select PSA_WANT_GENERATE_RANDOM
# Legacy crypto, still needed
select MBEDTLS_SHA1_C
select MBEDTLS_LEGACY_CRYPTO_C
select MBEDTLS_CMAC_C
select MBEDTLS_GCM_C
select MBEDTLS_TLS_LIBRARY
select MBEDTLS_PK_C
select MBEDTLS_PK_WRITE_C
select MBEDTLS_X509_LIBRARY
select MBEDTLS_X509_CRT_PARSE_C
select MBEDTLS_CIPHER_C
select MBEDTLS_CIPHER_MODE_CTR
select MBEDTLS_CIPHER_MODE_CBC
select MBEDTLS_SSL_TLS_C
select MBEDTLS_ECP_C
select MBEDTLS_CTR_DRBG_C
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
select MBEDTLS_MD_C
select MBEDTLS_CIPHER_PADDING_PKCS7
select MBEDTLS_PKCS5_C
select MBEDTLS_ECP_DP_SECP256R1_ENABLED

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_LEGACY_NCS
bool "Legacy Crypto support for WiFi using nRF security"
select MBEDTLS
select NRF_SECURITY
select MBEDTLS_CIPHER_MODE_CBC
select MBEDTLS_CIPHER_MODE_CTR
select MBEDTLS_LEGACY_CRYPTO_C
select MBEDTLS_ENTROPY_C
select MBEDTLS_CIPHER
select MBEDTLS_ECP_C
select MBEDTLS_CTR_DRBG_C
select MBEDTLS_PK_WRITE_C
select MBEDTLS_HKDF_C
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
select MBEDTLS_MD_C
select MBEDTLS_MD5_C
select MBEDTLS_ENTROPY_C
select MBEDTLS_CIPHER_PADDING_PKCS7
select MBEDTLS_PKCS5_C

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_LEGACY_NCS_PSA
bool "Legacy Crypto support for WiFi using nRF security"
select MBEDTLS
select NRF_SECURITY
select PSA_WANT_GENERATE_RANDOM
select MBEDTLS_CIPHER_MODE_CBC
select MBEDTLS_CIPHER_MODE_CTR
select MBEDTLS_LEGACY_CRYPTO_C
select MBEDTLS_SHA1_C
select MBEDTLS_ECP_C
select MBEDTLS_CTR_DRBG_C
select MBEDTLS_PK_C
select MBEDTLS_PKCS5_C
select MBEDTLS_PK_PARSE_C
select MBEDTLS_CMAC_C
select MBEDTLS_CIPHER_PADDING_PKCS7
select MBEDTLS_PK_WRITE_C
select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED
select MBEDTLS_ENTROPY_C

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_NCS_PSA
bool "PSA Crypto support for WiFi WPA2 using nRF security"
select MBEDTLS
select NRF_SECURITY
select PSA_WANT_GENERATE_RANDOM
select MBEDTLS_PK_C
select MBEDTLS_MD_C
select MBEDTLS_PK_WRITE_C
select MBEDTLS_ENABLE_HEAP
select MBEDTLS_PSA_CRYPTO_C
select MBEDTLS_USE_PSA_CRYPTO
select PSA_WANT_ALG_HMAC
select PSA_WANT_ALG_CMAC
select PSA_WANT_ALG_ECB_NO_PADDING
select PSA_WANT_ALG_CBC_PKCS7
select PSA_ACCEL_CBC_MAC_AES_128
select PSA_ACCEL_CBC_MAC_AES_192
select PSA_ACCEL_CBC_MAC_AES_256
select PSA_WANT_ALG_CCM
select PSA_WANT_ALG_GCM
select PSA_WANT_ALG_CTR
select PSA_WANT_ALG_MD5
select PSA_ACCEL_MD5
select PSA_WANT_ALG_SHA_1
select PSA_WANT_ALG_SHA_256
select PSA_WANT_ALG_SHA_224
select PSA_WANT_ALG_SHA_384
select PSA_WANT_ALG_SHA_512
select PSA_WANT_ALG_PBKDF2_HMAC
select PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
select PSA_WANT_KEY_TYPE_AES
select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE
bool "No Crypto support for WiFi"

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_EXT
bool "External Crypto support for hostap"
help
Use external crypto implementation for hostp, this is useful for
platforms where the crypto implementation is provided by the platform
and not by Zephyr. The external crypto implementation should provide
the required APIs and any other dependencies required by hostap.

endchoice

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA
bool "Crypto Platform Secure Architecture support for WiFi"
default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_NCS_PSA
help
Support Mbedtls 3.x to use PSA apis instead of legacy apis.

config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
bool "Enterprise Crypto support for WiFi"
select MBEDTLS_ECDH_C
select MBEDTLS_ECDSA_C
select MBEDTLS_DHM_C
select MBEDTLS_SSL_TLS_C
select MBEDTLS_SSL_SRV_C
select MBEDTLS_SSL_CLI_C
select MBEDTLS_X509_LIBRARY
select MBEDTLS_TLS_LIBRARY
select MBEDTLS_X509_CRL_PARSE_C
select MBEDTLS_TLS_VERSION_1_2
select MBEDTLS_RSA_C
depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE && !WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_NCS_PSA
select MBEDTLS_PEM_CERTIFICATE_FORMAT
depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE

config EAP_TLS
bool "EAP-TLS support"
Expand Down Expand Up @@ -366,7 +241,7 @@ config EAP_ALL

config WIFI_NM_WPA_SUPPLICANT_WPA3
bool "WPA3 support"
depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE && !WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT_NCS_PSA
depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE
default y

config WIFI_NM_WPA_SUPPLICANT_AP
Expand Down