| # WPA Supplicant configuration options |
| # |
| # Copyright (c) 2023 Nordic Semiconductor |
| # |
| # SPDX-License-Identifier: Apache-2.0 |
| # |
| |
| config WIFI_NM_WPA_SUPPLICANT |
| bool "WPA Suplicant from hostap project [EXPERIMENTAL]" |
| select POSIX_TIMERS |
| select POSIX_SIGNALS |
| select POSIX_API |
| select FILE_SYSTEM |
| select NET_SOCKETS |
| select NET_SOCKETS_PACKET |
| select NET_SOCKETPAIR |
| select NET_L2_WIFI_MGMT |
| select WIFI_NM |
| select EXPERIMENTAL |
| select COMMON_LIBC_MALLOC |
| help |
| WPA supplicant as a network management backend for WIFI_NM. |
| |
| if WIFI_NM_WPA_SUPPLICANT |
| |
| config HEAP_MEM_POOL_ADD_SIZE_HOSTAP |
| def_int 85000 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE && !MBEDTLS_ENABLE_HEAP |
| def_int 40000 if WIFI_NM_WPA_SUPPLICANT_AP |
| # 8192 for MbedTLS heap |
| def_int 21808 if MBEDTLS_ENABLE_HEAP |
| # 30K is mandatory, but might need more for long duration use cases |
| def_int 30000 |
| |
| config WIFI_NM_WPA_SUPPLICANT_THREAD_STACK_SIZE |
| int "Stack size for wpa_supplicant thread" |
| default 8192 |
| |
| config WIFI_NM_WPA_SUPPLICANT_WQ_STACK_SIZE |
| int "Stack size for wpa_supplicant iface workqueue" |
| default 6144 |
| |
| config WIFI_NM_WPA_SUPPLICANT_WQ_PRIO |
| int "Thread priority of wpa_supplicant iface workqueue" |
| default 7 |
| |
| config WIFI_NM_WPA_SUPPLICANT_PRIO |
| int "Thread priority of wpa_supplicant" |
| default 0 |
| |
| # Currently we default ZVFS_OPEN_MAX to 16 in lib/posix/Kconfig |
| # l2_packet - 1 |
| # ctrl_iface - 2 * socketpairs = 4(local and global) |
| # z_wpa_event_sock - 1 socketpair = 2 |
| # Remaining left for the applications running in default configuration |
| |
| # Supplicant API is stack heavy (buffers + snprintfs) and control interface |
| # uses socketpair which pushes the stack usage causing overflow for 2048 bytes. |
| # So we set SYSTEM_WORKQUEUE_STACK_SIZE default to 2560 in kernel/Kconfig |
| |
| module = WIFI_NM_WPA_SUPPLICANT |
| module-str = WPA supplicant |
| source "subsys/logging/Kconfig.template.log_config" |
| |
| config WIFI_NM_WPA_SUPPLICANT_DEBUG_LEVEL |
| int "Min compiled-in debug message level for WPA supplicant" |
| default 0 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG # MSG_EXCESSIVE |
| default 3 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_INF # MSG_INFO |
| default 4 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_WRN # MSG_WARNING |
| default 5 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_ERR # MSG_ERROR |
| default 6 |
| help |
| Minimum priority level of a debug message emitted by WPA supplicant that |
| is compiled-in the firmware. See wpa_debug.h file of the supplicant for |
| available levels and functions for emitting the messages. Note that |
| runtime filtering can also be configured in addition to the compile-time |
| filtering. |
| |
| # Memory optimizations |
| config WIFI_NM_WPA_SUPPLICANT_ADVANCED_FEATURES |
| bool "Advanced features" |
| default y |
| |
| if WIFI_NM_WPA_SUPPLICANT_ADVANCED_FEATURES |
| |
| config WIFI_NM_WPA_SUPPLICANT_ROBUST_AV |
| bool "Robust Audio Video streaming support" |
| default y |
| |
| # Hidden as these are mandatory for WFA certification |
| config WIFI_NM_WPA_SUPPLICANT_WMM_AC |
| bool |
| default y |
| |
| config WIFI_NM_WPA_SUPPLICANT_MBO |
| bool |
| default y |
| |
| config WIFI_NM_WPA_SUPPLICANT_WNM |
| bool "Wireless Network Management support" |
| default y |
| |
| config WIFI_NM_WPA_SUPPLICANT_RRM |
| bool "Radio Resource Management support" |
| default y |
| endif |
| |
| config WIFI_NM_WPA_SUPPLICANT_WEP |
| bool "WEP (Legacy crypto) support" |
| |
| choice WIFI_NM_WPA_SUPPLICANT_CRYPTO_BACKEND |
| prompt "WPA supplicant crypto implementation" |
| default WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT |
| help |
| Select the crypto implementation to use for WPA supplicant. |
| WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT supports enterprise mode |
| and DPP. |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO |
| bool "Crypto support for WiFi" |
| select MBEDTLS |
| select MBEDTLS_SHA1 |
| select MBEDTLS_CIPHER |
| select MBEDTLS_CIPHER_MODE_CTR_ENABLED |
| select MBEDTLS_CIPHER_MODE_CBC_ENABLED |
| select MBEDTLS_CIPHER_AES_ENABLED |
| select MBEDTLS_ECP_C |
| select MBEDTLS_ECP_ALL_ENABLED |
| select MBEDTLS_CMAC |
| select MBEDTLS_PKCS5_C |
| select MBEDTLS_PK_WRITE_C |
| select MBEDTLS_ECDH_C |
| select MBEDTLS_ECDSA_C |
| select MBEDTLS_ECJPAKE_C |
| select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED |
| select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED |
| select MBEDTLS_KEY_EXCHANGE_ECJPAKE_ENABLED |
| select MBEDTLS_KEY_EXCHANGE_ALL_ENABLED |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT |
| bool "Crypto Mbedtls alt support for WiFi" |
| select MBEDTLS |
| select MBEDTLS_CIPHER_MODE_CTR_ENABLED |
| select MBEDTLS_CIPHER_MODE_CBC_ENABLED |
| select MBEDTLS_CIPHER_AES_ENABLED |
| select MBEDTLS_CIPHER_DES_ENABLED |
| select MBEDTLS_MD5 |
| select MBEDTLS_SHA1 |
| select MBEDTLS_ENTROPY_C |
| select MBEDTLS_CIPHER |
| select MBEDTLS_ECP_C |
| select MBEDTLS_ECP_ALL_ENABLED |
| select MBEDTLS_CMAC |
| select MBEDTLS_PKCS5_C |
| select MBEDTLS_PK_WRITE_C |
| select MBEDTLS_ECDH_C |
| select MBEDTLS_ECDSA_C |
| select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED |
| select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED |
| select MBEDTLS_NIST_KW_C |
| select MBEDTLS_DHM_C |
| select MBEDTLS_HKDF_C |
| select MBEDTLS_SERVER_NAME_INDICATION |
| select MBEDTLS_X509_CRL_PARSE_C |
| select MBEDTLS_TLS_VERSION_1_2 |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| bool "No Crypto support for WiFi" |
| |
| endchoice |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA |
| bool "Crypto Platform Secure Architecture support for WiFi" |
| help |
| Support Mbedtls 3.x to use PSA apis instead of legacy apis. |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| bool "Enterprise Crypto support for WiFi" |
| select MBEDTLS_PEM_CERTIFICATE_FORMAT |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config EAP_TLS |
| bool "EAP-TLS support" |
| |
| config EAP_TTLS |
| bool "EAP-TTLS support" |
| |
| config EAP_PEAP |
| bool "EAP-PEAP support" |
| |
| config EAP_MD5 |
| bool "EAP-MD5 support" |
| |
| config EAP_GTC |
| bool "EAP-GTC support" |
| |
| config EAP_MSCHAPV2 |
| bool "EAP-MSCHAPv2 support" |
| |
| config EAP_LEAP |
| bool "EAP-LEAP support" |
| |
| config EAP_PSK |
| bool "EAP-PSK support" |
| |
| config EAP_PAX |
| bool "EAP-PAX support" |
| |
| config EAP_SAKE |
| bool "EAP-SAKE support" |
| |
| config EAP_GPSK |
| bool "EAP-GPSK support" |
| |
| config EAP_PWD |
| bool "EAP-PWD support" |
| |
| config EAP_EKE |
| bool "EAP-EKE support" |
| |
| config EAP_IKEV2 |
| bool "EAP-IKEv2 support" |
| |
| config EAP_SIM |
| bool "EAP-SIM support" |
| |
| config EAP_AKA |
| bool "EAP-AKA support" |
| |
| config EAP_ALL |
| bool "All EAP methods support" |
| select EAP_TLS |
| default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| |
| config WIFI_NM_WPA_SUPPLICANT_WPA3 |
| bool "WPA3 support" |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| default y |
| |
| config WIFI_NM_WPA_SUPPLICANT_AP |
| bool "SoftAP mode support based on WPA supplicant" |
| |
| config WIFI_NM_WPA_SUPPLICANT_WPS |
| bool "WPS support" |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config WIFI_NM_WPA_SUPPLICANT_P2P |
| bool "P2P mode support" |
| select WIFI_NM_WPA_SUPPLICANT_AP |
| select WIFI_NM_WPA_SUPPLICANT_WPS |
| select WIFI_NM_WPA_SUPPLICANT_EAPOL |
| |
| config WIFI_NM_WPA_SUPPLICANT_EAPOL |
| bool "EAPoL supplicant" |
| default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| |
| config WIFI_NM_WPA_SUPPLICANT_CLI |
| bool "CLI support for wpa_supplicant" |
| default n |
| |
| config WIFI_NM_WPA_SUPPLICANT_INF_MON |
| bool "Monitor the net mgmt event to add/del interface" |
| default y |
| |
| config WIFI_NM_HOSTAPD_AP |
| bool "FullAP mode support based on Hostapd" |
| depends on !WIFI_NM_WPA_SUPPLICANT_INF_MON |
| |
| config WIFI_NM_WPA_SUPPLICANT_BSS_MAX_IDLE_TIME |
| int "BSS max idle timeout in seconds" |
| range 0 64000 |
| default 300 |
| help |
| BSS max idle timeout is the period for which AP may keep a client |
| in associated state while there is no traffic from that particular |
| client. Set 0 to disable inclusion of BSS max idle time tag in |
| association request. If a non-zero value is set, STA can suggest a |
| timeout by including BSS max idle period in the association request. |
| AP may choose to consider or ignore the STA's preferred value. |
| Ref: Sec 11.21.13 of IEEE Std 802.11™-2020 |
| |
| config WIFI_NM_WPA_SUPPLICANT_NO_DEBUG |
| bool "Disable printing of debug messages, saves code size significantly" |
| |
| |
| config WIFI_NM_WPA_SUPPLICANT_DPP |
| bool "WFA Easy Connect DPP" |
| select DPP |
| select DPP2 |
| select DPP3 |
| select GAS |
| select GAS_SERVER |
| select OFFCHANNEL |
| select MBEDTLS_X509_CSR_WRITE_C |
| select MBEDTLS_X509_CSR_PARSE_C |
| |
| config WIFI_NM_WPA_SUPPLICANT_11AX |
| bool "IEEE 802.11ax HE support" |
| depends on WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP |
| default y |
| |
| config WPA_CLI |
| bool "WPA CLI support" |
| help |
| Enable WPA CLI support for wpa_supplicant. |
| |
| if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| config MBEDTLS_SSL_MAX_CONTENT_LEN |
| default 16384 |
| endif |
| |
| config WIFI_NM_WPA_SUPPLICANT_ROAMING |
| bool "Roaming support" |
| imply IEEE80211R |
| help |
| Enable roaming support with wpa_supplicant. When current BSS RSSI drops, |
| STA will try to find an AP with better RSSI. If found, STA will reassociate |
| to the new AP automatically without losing connection. |
| |
| config WIFI_NM_WPA_SUPPLICANT_SKIP_DHCP_ON_ROAMING |
| bool "Skip DHCP after roaming to new AP" |
| help |
| For L2 roaming, the original AP and new AP are in the same subnet, client |
| can use same IP address and skip DHCP. Enable this to skip DHCP. |
| For L3 roaming, the original AP and new AP are in different subnet, client |
| needs to get new IP address after roaming to new AP. Disable this to keep |
| DHCP after roaming. |
| |
| # Create hidden config options that are used in hostap. This way we do not need |
| # to mark them as allowed for CI checks, and also someone else cannot use the |
| # same name options. |
| |
| config SME |
| bool |
| default y |
| |
| config NO_CONFIG_WRITE |
| bool |
| default y |
| |
| config NO_CONFIG_BLOBS |
| bool |
| default y if !WIFI_NM_WPA_SUPPLICANT_DPP && !WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| |
| config CTRL_IFACE |
| bool |
| default y |
| |
| config CTRL_IFACE_ZEPHYR |
| bool |
| default y |
| |
| config NO_RANDOM_POOL |
| bool |
| default y |
| |
| config WNM |
| bool |
| |
| config NO_WPA |
| bool |
| default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config NO_PBKDF2 |
| bool |
| default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config SAE_PK |
| bool |
| |
| config FST |
| bool |
| |
| config TESTING_OPTIONS |
| bool |
| |
| config AP |
| bool |
| depends on WIFI_NM_WPA_SUPPLICANT_AP |
| default y if WIFI_NM_WPA_SUPPLICANT_AP |
| |
| config NO_RADIUS |
| bool |
| |
| config NO_VLAN |
| bool |
| |
| config NO_ACCOUNTING |
| bool |
| |
| config NEED_AP_MLME |
| bool |
| |
| config IEEE80211AX |
| bool |
| |
| config EAP_SERVER |
| bool |
| |
| config EAP_SERVER_IDENTITY |
| bool |
| |
| config P2P |
| bool |
| |
| config GAS |
| bool |
| |
| config GAS_SERVER |
| bool |
| |
| config OFFCHANNEL |
| bool |
| |
| config WPS |
| bool |
| |
| config WSC |
| bool |
| |
| config EAP_TLS |
| bool |
| |
| config IEEE8021X_EAPOL |
| bool |
| |
| config EAP_PEAP |
| bool |
| |
| config EAP_TTLS |
| bool |
| |
| config EAP_MD5 |
| bool |
| |
| config EAP_MSCHAPv2 |
| bool |
| |
| config EAP_LEAP |
| bool |
| |
| config EAP_PSK |
| bool |
| |
| config EAP_FAST |
| bool |
| |
| config EAP_PAX |
| bool |
| |
| config EAP_SAKE |
| bool |
| |
| config EAP_GPSK |
| bool |
| |
| config EAP_PWD |
| bool |
| |
| config EAP_EKE |
| bool |
| |
| config EAP_IKEv2 |
| bool |
| |
| config CRYPTO_INTERNAL |
| bool |
| |
| config ECC |
| bool |
| |
| config MBO |
| bool |
| |
| config NO_STDOUT_DEBUG |
| bool |
| |
| config SAE |
| bool |
| |
| config SHA256 |
| bool |
| |
| config SHA384 |
| bool |
| |
| config SHA512 |
| bool |
| |
| config SUITEB192 |
| bool |
| |
| config SUITEB |
| bool |
| |
| config WEP |
| bool |
| default y if WIFI_NM_WPA_SUPPLICANT_WEP |
| |
| config WPA_CRYPTO |
| bool |
| |
| config WPA_SUPP_CRYPTO |
| bool |
| |
| config ROBUST_AV |
| bool |
| default y |
| depends on WIFI_NM_WPA_SUPPLICANT_ROBUST_AV |
| |
| config RRM |
| bool |
| default y |
| depends on WIFI_NM_WPA_SUPPLICANT_RRM |
| |
| config WMM_AC |
| bool |
| |
| config DPP |
| bool |
| |
| config DPP2 |
| bool |
| |
| config DPP3 |
| bool |
| |
| config ACS |
| bool |
| |
| config IEEE80211AC |
| bool |
| |
| config IEEE80211R |
| bool |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config NW_SEL_RELIABILITY |
| bool |
| default y |
| depends on WIFI_NM_WPA_SUPPLICANT_NW_SEL_RELIABILITY |
| |
| choice WIFI_NM_WPA_SUPPLICANT_NW_SEL |
| prompt "WPA supplicant Network selection criterion" |
| default WIFI_NM_WPA_SUPPLICANT_NW_SEL_THROUGHPUT |
| help |
| Select the network selection method for the supplicant. |
| |
| config WIFI_NM_WPA_SUPPLICANT_NW_SEL_THROUGHPUT |
| bool "Throughput based network selection" |
| help |
| Select the network based on throughput. |
| |
| config WIFI_NM_WPA_SUPPLICANT_NW_SEL_RELIABILITY |
| bool "Reliability based network selection" |
| help |
| Select the network based on reliability. |
| |
| endchoice |
| |
| config SAE_PWE_EARLY_EXIT |
| bool "Exit early if PWE if found" |
| help |
| In order to mitigate side channel attacks, even if the PWE is found the WPA |
| supplicant goes through full iterations, but in some low-resource systems |
| this can be intensive, so, add an option to exit early. |
| Note that this is highly insecure and shouldn't be used in production |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_TEST |
| bool |
| depends on WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA |
| |
| config WIFI_NM_WPA_CTRL_RESP_TIMEOUT_S |
| int "WPA supplicant control interface response timeout in seconds" |
| default 15 |
| help |
| Timeout for the control interface commands to get a response from the |
| supplicant. |
| |
| endif # WIFI_NM_WPA_SUPPLICANT |
