Add hostapd patches for EAP-TLS pinning and TLS 1.3 on mbedTLS

[ksperling-apple]

This adds a series of hostapd patches implementing various aspects required for Matter PDC, primarily the ability to authorize client certificates via a direct allow list (eap_tls_cert_pinning). This requires some small additions to the hostap TLS backend API, which are implemented for OpenSSL, wolfSSL, and MbedTLS.

Additionally a number of changes / bug fixes are necessary for the MbedTLS backend (used by default on OpenWrt) to correctly handle EAP-TLS 1.3; this includes using the correct key export API that supports both TLS 1.2 and TLS 1.3, as well as the processing of post-handshake application data, which is required for the EAP TLS 1.3 protected success indication. Additional patches address configurability of cipher suites and ECDH curves on OpenSSL.

Example config snippets:

/etc/config/wireless

config wifi-iface 'default_radio0'
        ...
	list hostapd_bss_options 'rsn_override_key_mgmt=SAE WPA-EAP-SHA256'
	list hostapd_bss_options 'rsn_override_pairwise=CCMP'
	list hostapd_bss_options 'rsn_override_mfp=2'
	list hostapd_bss_options 'ieee8021x=1'
	list hostapd_bss_options 'eap_server=1'
	list hostapd_bss_options 'tls_flags=[DISABLE-TLSv1.0][DISABLE-TLSv1.1][DISABLE-TLSv1.2][ENABLE-TLSv1.3]'
	list hostapd_bss_options 'openssl_ciphers=TLS_AES_128_CCM_SHA256'
	list hostapd_bss_options 'openssl_ecdh_curves=P-256'
	list hostapd_bss_options 'eap_user_file=/etc/matter-eap-users.conf'
	list hostapd_bss_options 'server_cert=/etc/matter-network.cert'
	list hostapd_bss_options 'private_key=/etc/matter-network.key'
	list hostapd_bss_options 'eap_tls_cert_pinning=2'

/etc/matter-eap-users.conf

/etc/matter-eap.conf 
"cert-sha256-57665c49b7c1a035bc452913e7c08d1b32b4a741365228d7d1ad8bdcd2c2bdef" TLS
* TLS

[gemini-code-assist]

Code Review

This pull request introduces support for EAP-TLS client certificate pinning in hostapd, along with several patches to improve TLS 1.3 configuration, key export, and compatibility for both OpenSSL and MbedTLS backends. It also updates the OpenWrt overlay build system to support build configuration injection. The review feedback highlights three important issues: a potential compilation failure on MbedTLS 2.x due to missing TLS 1.3 ciphersuite macros, undefined behavior in pointer arithmetic when parsing the combined cipher list in the OpenSSL patch, and a missing explicit initialization of the application data pointer in the MbedTLS TLS 1.3 patch.

[Copilot]

Pull request overview

This PR adds hostapd/wpa_supplicant overlay patches to support Matter PDC requirements: EAP-TLS client-certificate allow-list (“pinning”) and improved TLS 1.3 behavior on the MbedTLS backend (OpenWrt default), plus TLS cipher/curve configurability improvements for OpenSSL.

Changes:

• Add EAP-TLS server client-certificate pinning (allow-list authorization) with new TLS backend API support across OpenSSL/wolfSSL/MbedTLS, plus new hwsim coverage.
• Fix/extend MbedTLS backend behavior for TLS 1.3 EAP-TLS (key export and post-handshake application data handling), and harden TLS version flag handling.
• Improve OpenSSL configuration to accept TLS 1.3 suite names via the existing cipher list path; add per-network OpenSSL ECDH curve configuration; enhance overlay build injection support.

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
overlay/hostapd/patches/o220-mbedtls-cert-pinning.patch	Implements peer cert retrieval and chain-validation disable flag handling in the MbedTLS TLS backend to enable cert pinning.
overlay/hostapd/patches/o210-mbedtls-tls-flags.patch	Refactors MbedTLS TLS version range derivation to avoid mutating shared config and to hard-fail unsupported/invalid flag combos.
overlay/hostapd/patches/o202-mbedtls-tls13-suite-names.patch	Accepts standardized IANA/OpenSSL TLS 1.3 ciphersuite names in the MbedTLS cipher parser.
overlay/hostapd/patches/o201-mbedtls-tls13.patch	Enables TLS 1.3-compatible key export on MbedTLS and processes post-handshake application data required by EAP-TLS 1.3.
overlay/hostapd/patches/o200-mbedtls-clear-hostname.patch	Ensures hostname is explicitly cleared for newer MbedTLS versions to avoid verification failures in supplicant mode.
overlay/hostapd/patches/o104-eapol-eap-type-authsrv.patch	Correctly populates eap_type_authsrv for integrated EAP server and avoids miscounting non-request EAP frames.
overlay/hostapd/patches/o103-eap-tls-server-cert-pinning.patch	Adds the core EAP-TLS server pinning feature, config surface, backend hooks, and new hwsim tests.
overlay/hostapd/patches/o102-openssl-ecdh-curves.patch	Adds per-network openssl_ecdh_curves passthrough/configuration for wpa_supplicant.
overlay/hostapd/patches/o101-openssl-configure-tls-1.3-ciphersuites.patch	Splits combined cipher lists into legacy vs TLS 1.3 suites for OpenSSL’s separate APIs.
overlay/hostapd/patches/o100-authserv-tls-flags.patch	Propagates per-BSS tls_flags into tls_global_set_params to avoid backend-specific clobbering.
overlay/hostapd/Makefile	Enables the pinning build flag for the overlay hostapd package (via injected build config).
include/overlay.sh	Updates overlay materialization to inject Makefile text instead of symlinking .base/Makefile.
include/overlay.mk	Documents overlay usage, adds injection plumbing, and adjusts hashing behavior to use OpenWrt helper macros.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.