Is your feature request related to a problem? Please describe.
Enrollee configuration currently only supports bootstrapping type qrcode. Internally, this requires/forces the use of the TPM openssl engine which means systems without a TPM cannot be used for testing.
Describe the solution you'd like
An option should be configurable for enrollees to specify a static DPP bootstrapping key for use with bootstrapping type qrcode. For example, the json configuration could look something like this:
{
"bootstrap.info": {
"type": "qrcode",
"keyType": "static",
"key": "30570201010420777fc55dc51e967c10ec051b91d860b5f1e6c934e48d5daffef98d032c64b170a00a06082a8648ce3d030107a124032200020c804188c7f85beb6e91070d2b3e5e39b90ca77b4d3c5251bc1844d6ca29dcad"
}
}There could even be an auto-generation method where ztpd auto-generates a bootstrapping key and outputs it somewhere that is easy to be found (eg. journald logs or a file). Eg.
{
"bootstrap.info": {
"type": "qrcode",
"keyType": "generate"
}
}wpa_supplicant already supports this when creating a new bootstrapping key without also providing private key (it get's auto-generated on first use). The public key can be obtained later using the bootstrapping id and the DPP_BOOTSTRAP_GET_URI <ID> control socket command.
Describe alternatives you've considered
Alternatives are currently to program wpa_supplicant manually using cli tools (eg. wpa_cli). This is clunky and disrupts instrumentation between ztpd and wpa_supplicant, and is annoying for our partners to use since they then have to mess with systemd unit configuration resets and custom configuration.
Additional context
Our partner engineering teams need a better method to test their configurator against our enrollee without too much effort/ramp-up/setup. A similar method exists for the configurator, the file based BIP, which allows specification of static DPP URIs for supported enrollees. The request here is to provide an analogous option for enrollee testing.
Is your feature request related to a problem? Please describe.
Enrollee configuration currently only supports bootstrapping type
qrcode. Internally, this requires/forces the use of the TPM openssl engine which means systems without a TPM cannot be used for testing.Describe the solution you'd like
An option should be configurable for enrollees to specify a static DPP bootstrapping key for use with bootstrapping type
qrcode. For example, the json configuration could look something like this:{ "bootstrap.info": { "type": "qrcode", "keyType": "static", "key": "30570201010420777fc55dc51e967c10ec051b91d860b5f1e6c934e48d5daffef98d032c64b170a00a06082a8648ce3d030107a124032200020c804188c7f85beb6e91070d2b3e5e39b90ca77b4d3c5251bc1844d6ca29dcad" } }There could even be an auto-generation method where ztpd auto-generates a bootstrapping key and outputs it somewhere that is easy to be found (eg. journald logs or a file). Eg.
{ "bootstrap.info": { "type": "qrcode", "keyType": "generate" } }wpa_supplicant already supports this when creating a new bootstrapping key without also providing private key (it get's auto-generated on first use). The public key can be obtained later using the bootstrapping id and the
DPP_BOOTSTRAP_GET_URI <ID>control socket command.Describe alternatives you've considered
Alternatives are currently to program wpa_supplicant manually using cli tools (eg.
wpa_cli). This is clunky and disrupts instrumentation between ztpd and wpa_supplicant, and is annoying for our partners to use since they then have to mess with systemd unit configuration resets and custom configuration.Additional context
Our partner engineering teams need a better method to test their configurator against our enrollee without too much effort/ramp-up/setup. A similar method exists for the configurator, the
filebased BIP, which allows specification of static DPP URIs for supported enrollees. The request here is to provide an analogous option for enrollee testing.