Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add option to specify static DPP bootstrap key for role=enrollee #19

Open
abeltrano opened this issue Jun 25, 2021 · 0 comments
Open

Add option to specify static DPP bootstrap key for role=enrollee #19

abeltrano opened this issue Jun 25, 2021 · 0 comments
Assignees
Labels
enhancement New feature or request good first issue Good for newcomers

Comments

@abeltrano
Copy link
Contributor

abeltrano commented Jun 25, 2021

Is your feature request related to a problem? Please describe.
Enrollee configuration currently only supports bootstrapping type qrcode. Internally, this requires/forces the use of the TPM openssl engine which means systems without a TPM cannot be used for testing.

Describe the solution you'd like
An option should be configurable for enrollees to specify a static DPP bootstrapping key for use with bootstrapping type qrcode. For example, the json configuration could look something like this:

{
    "bootstrap.info": {
        "type": "qrcode",
        "keyType": "static",
        "key": "30570201010420777fc55dc51e967c10ec051b91d860b5f1e6c934e48d5daffef98d032c64b170a00a06082a8648ce3d030107a124032200020c804188c7f85beb6e91070d2b3e5e39b90ca77b4d3c5251bc1844d6ca29dcad"
    }
}

There could even be an auto-generation method where ztpd auto-generates a bootstrapping key and outputs it somewhere that is easy to be found (eg. journald logs or a file). Eg.

{
    "bootstrap.info": {
        "type": "qrcode",
        "keyType": "generate"
    }
}

wpa_supplicant already supports this when creating a new bootstrapping key without also providing private key (it get's auto-generated on first use). The public key can be obtained later using the bootstrapping id and the DPP_BOOTSTRAP_GET_URI <ID> control socket command.

Describe alternatives you've considered
Alternatives are currently to program wpa_supplicant manually using cli tools (eg. wpa_cli). This is clunky and disrupts instrumentation between ztpd and wpa_supplicant, and is annoying for our partners to use since they then have to mess with systemd unit configuration resets and custom configuration.

Additional context
Our partner engineering teams need a better method to test their configurator against our enrollee without too much effort/ramp-up/setup. A similar method exists for the configurator, the file based BIP, which allows specification of static DPP URIs for supported enrollees. The request here is to provide an analogous option for enrollee testing.

@abeltrano abeltrano added enhancement New feature or request good first issue Good for newcomers labels Jun 25, 2021
@abeltrano abeltrano self-assigned this Jun 25, 2021
@abeltrano abeltrano changed the title Add option to specify static DPP URI for role=enrollee Add option to specify static DPP bootstrap key for role=enrollee Jul 2, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

1 participant