Re: TLS based WPA-Enterprise authentication methods on kernel 4.19

Hi Michael,

On 1/10/25 1:35 PM, Michael John wrote:
> Hello,
> 
> I'm running Linux kernel 4.19.231 (embedded, Buildroot build system) and when starting IWD I see the following message:
> 
> Jan 10 19:13:39 cm1sd systemd[1]: Starting Wireless service...
> Jan 10 19:13:40 cm1sd iwd[1537]: No asymmetric key support found.
> Jan 10 19:13:40 cm1sd iwd[1537]: TLS based WPA-Enterprise authentication methods will not function.
> Jan 10 19:13:40 cm1sd iwd[1537]: Kernel 4.20+ is required for this feature.
> Jan 10 19:13:40 cm1sd iwd[1537]: The following options are missing in the kernel:
> Jan 10 19:13:40 cm1sd iwd[1537]:         CONFIG_ASYMMETRIC_KEY_TYPE
> Jan 10 19:13:40 cm1sd iwd[1537]:         CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE
> Jan 10 19:13:40 cm1sd iwd[1537]:         CONFIG_PKCS7_MESSAGE_PARSER
> Jan 10 19:13:40 cm1sd iwd[1537]:         CONFIG_X509_CERTIFICATE_PARSER
> Jan 10 19:13:40 cm1sd iwd[1537]:         CONFIG_PKCS8_PRIVATE_KEY_PARSER
> Jan 10 19:13:40 cm1sd iwd[1537]: Wireless daemon version 2.17
> 
> My kernel has many backports and all of the listed options exist and are enabled.
> 
>> ag 'ASYMMETRIC_KEY|ASYMMETRIC_PUBLIC_KEY|PKCS7_MESSAGE|X509_CERTIFICATE|PKCS8_PRIVATE_KEY' ./buildroot/buildroot/output/cm1sd/build/linux-custom/.config
> 2475:CONFIG_ASYMMETRIC_KEY_TYPE=y
> 2476:CONFIG_ASYMMETRIC_PUBLIC_KEY_SUBTYPE=y
> 2477:CONFIG_X509_CERTIFICATE_PARSER=y
> 2478:CONFIG_PKCS8_PRIVATE_KEY_PARSER=y
> 2479:CONFIG_PKCS7_MESSAGE_PARSER=y
> 
> Even though my 4.19 kernel appears to have the required options I still see this error about missing features.
> Are there additional features that are required but not getting listed?

Nope.  See the logic here for yourself.  iwd invokes this check with 
L_KEY_FEATURE_CRYPTO:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/key.c#n791

You may want to strace iwd (or one of the ell unit tests, such as 
unit/test-key.c) and see what the kernel is reporting.

Regards,
-Denis