| # WPA Supplicant configuration options |
| # |
| # Copyright (c) 2023 Nordic Semiconductor |
| # |
| # SPDX-License-Identifier: Apache-2.0 |
| # |
| |
| config WIFI_NM_WPA_SUPPLICANT |
| bool "WPA Supplicant from hostap project [EXPERIMENTAL]" |
| select POSIX_TIMERS |
| select POSIX_SIGNALS |
| select POSIX_API |
| select XSI_SINGLE_PROCESS |
| select NET_SOCKETS |
| select NET_SOCKETS_PACKET |
| select NET_L2_WIFI_MGMT |
| select WIFI_NM |
| select EXPERIMENTAL |
| select COMMON_LIBC_MALLOC |
| select ZVFS |
| select ZVFS_EVENTFD |
| help |
| WPA supplicant as a network management backend for WIFI_NM. |
| |
| if WIFI_NM_WPA_SUPPLICANT |
| |
| config ZVFS_OPEN_ADD_SIZE_WIFI_NM_WPA_SUPPLICANT |
| int "Number of socket descriptors needed by hostap" |
| default 12 |
| |
| config ZVFS_EVENTFD_ADD_SIZE_WIFI_NM_WPA_SUPPLICANT |
| int "Number of eventfds needed by hostap" |
| default 8 |
| help |
| The WPA supplicant and hostapd allocate several zvfs eventfds, e.g. for |
| the supplicant event socket and the local/global control interface |
| socket pairs. |
| |
| config WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP |
| bool "Use Zephyr kernel heap for Wi-Fi driver" |
| default y |
| help |
| Enable this option to use K_HEAP for memory allocations in supplicant. |
| |
| if !WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP |
| config WIFI_NM_WPA_SUPPLICANT_HEAP |
| int "Dedicated memory pool for wpa_supplicant" |
| def_int 66560 if WIFI_NM_HOSTAPD_AP |
| def_int 60000 if WIFI_USAGE_MODE_STA_AP |
| def_int 55000 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| def_int 41808 if WIFI_NM_WPA_SUPPLICANT_AP |
| def_int 40000 if WIFI_NM_MAX_MANAGED_INTERFACES=2 |
| # 30K is mandatory, but might need more for long duration use cases |
| def_int 30000 |
| endif # !WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP |
| |
| if WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP |
| config HEAP_MEM_POOL_ADD_SIZE_HOSTAP |
| def_int 66560 if WIFI_NM_HOSTAPD_AP |
| def_int 60000 if WIFI_USAGE_MODE_STA_AP |
| def_int 55000 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| def_int 80000 if WIFI_NM_WPA_SUPPLICANT_P2P |
| def_int 41808 if WIFI_NM_WPA_SUPPLICANT_AP |
| # 30K is mandatory, but might need more for long duration use cases |
| def_int 30000 |
| endif # WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP |
| |
| |
| config WIFI_NM_WPA_SUPPLICANT_THREAD_STACK_SIZE |
| int "Stack size for wpa_supplicant thread" |
| # TODO: Providing higher stack size for Enterprise mode to fix stack |
| # overflow issues. Need to identify the cause for higher stack usage. |
| default 8600 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE || WIFI_USAGE_MODE_STA_AP |
| default 8000 if WIFI_NM_WPA_SUPPLICANT_P2P |
| default 6300 |
| |
| config WIFI_NM_WPA_SUPPLICANT_WQ_STACK_SIZE |
| int "Stack size for wpa_supplicant iface workqueue" |
| default 4400 |
| |
| config WIFI_NM_WPA_SUPPLICANT_WQ_PRIO |
| int "Thread priority of wpa_supplicant iface workqueue" |
| default 7 |
| |
| config WIFI_NM_WPA_SUPPLICANT_PRIO |
| int "Thread priority of wpa_supplicant" |
| default 0 |
| |
| # Currently we default ZVFS_OPEN_MAX to 16 in subsys/portability/posix/Kconfig |
| # l2_packet - 1 |
| # ctrl_iface - 2 * socketpairs = 4(local and global) |
| # z_wpa_event_sock - 1 socketpair = 2 |
| # Remaining left for the applications running in default configuration |
| |
| # Supplicant API is stack heavy (buffers + snprintfs) and control interface |
| # uses socketpair which pushes the stack usage causing overflow for 2048 bytes. |
| # So we set SYSTEM_WORKQUEUE_STACK_SIZE default to 2560 in kernel/Kconfig |
| |
| module = WIFI_NM_WPA_SUPPLICANT |
| module-str = WPA supplicant |
| source "subsys/logging/Kconfig.template.log_config" |
| |
| config WIFI_NM_WPA_SUPPLICANT_DEBUG_LEVEL |
| int "Min compiled-in debug message level for WPA supplicant" |
| default 0 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG # MSG_EXCESSIVE |
| default 3 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_INF # MSG_INFO |
| default 4 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_WRN # MSG_WARNING |
| default 5 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_ERR # MSG_ERROR |
| default 5 |
| help |
| Minimum priority level of a debug message emitted by WPA supplicant that |
| is compiled-in the firmware. See wpa_debug.h file of the supplicant for |
| available levels and functions for emitting the messages. Note that |
| runtime filtering can also be configured in addition to the compile-time |
| filtering. |
| |
| config WIFI_NM_WPA_SUPPLICANT_DEBUG_SHOW_KEYS |
| bool "Include key material in debug output" |
| help |
| This option enables inclusion of key material (passwords, encryption keys, |
| etc.) in debug output. This is equivalent to the -K command line flag |
| in wpa_supplicant. |
| |
| WARNING: This is a security risk and should only be enabled during |
| development or debugging. Key material should never be logged in production |
| systems as it can compromise network security. |
| |
| config WIFI_NM_WPA_SUPPLICANT_PRINT_PMK |
| bool "Print PMK once per successful handshake" |
| select EXPERIMENTAL |
| help |
| Prints the PMK (as a hex string) once per completed 4-way handshake, |
| independent of WIFI_NM_WPA_SUPPLICANT_DEBUG_LEVEL and |
| WIFI_NM_WPA_SUPPLICANT_DEBUG_SHOW_KEYS. Intended for capturing the PMK |
| needed to decrypt an over-the-air Wi-Fi capture, without the log |
| volume that comes with enabling full supplicant debug output. |
| |
| WARNING: This is a security risk and should only be enabled during |
| development or debugging. |
| |
| if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG |
| # hostap debug is very verbose and despite large log buffer sizes |
| # log messages can be lost. So, we set the log mode to immediate |
| # to avoid losing any debug messages. |
| choice LOG_MODE |
| default LOG_MODE_IMMEDIATE |
| endchoice |
| endif # WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG |
| |
| # Memory optimizations |
| config WIFI_NM_WPA_SUPPLICANT_ADVANCED_FEATURES |
| bool "Advanced features" |
| default y if !SOC_FAMILY_NORDIC_NRF |
| |
| if WIFI_NM_WPA_SUPPLICANT_ADVANCED_FEATURES |
| |
| config WIFI_NM_WPA_SUPPLICANT_ROBUST_AV |
| bool "Robust Audio Video streaming support" |
| default y |
| |
| # Hidden as these are mandatory for WFA certification |
| config WIFI_NM_WPA_SUPPLICANT_WMM_AC |
| bool |
| default y |
| |
| config WIFI_NM_WPA_SUPPLICANT_MBO |
| bool |
| default y |
| |
| config WIFI_NM_WPA_SUPPLICANT_WNM |
| bool "Wireless Network Management support" |
| default y |
| |
| config WIFI_NM_WPA_SUPPLICANT_RRM |
| bool "Radio Resource Management support" |
| default y |
| endif |
| |
| config WIFI_NM_WPA_SUPPLICANT_LEGACY_CRYPTO |
| bool "Legacy (non-FIPS) crypto for backward compatibility" |
| default y |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| imply WIFI_NM_WPA_SUPPLICANT_WEP |
| select DEPRECATED |
| select NOT_SECURE |
| help |
| Drop CONFIG_FIPS from the supplicant build to re-enable the legacy |
| and broken crypto call sites. CONFIG_FIPS is not real FIPS validation |
| (MbedTLS is not FIPS validated); it is just a switch to strip these |
| algorithms from the default build. |
| |
| Also links hostap rc4.c for group-key unwrap. When PSA_WANT_ALG_MD5 |
| is off, CMake links md5-internal.c and md5.c so EAPOL-Key v1 |
| HMAC-MD5 does not depend on PSA. |
| |
| Implies WIFI_NM_WPA_SUPPLICANT_WEP by default (merged legacy option, |
| kept for prj.conf compatibility). Set CONFIG_WIFI_NM_WPA_SUPPLICANT_WEP=n |
| to strip WEP while keeping WPA/TKIP interop. |
| |
| Enabled by default so WPA/TKIP and other legacy AP interop works |
| out of the box. This is NOT a TKIP-only switch: it disables CONFIG_FIPS |
| wholesale and brings back the whole legacy crypto surface, including: |
| - WPA1/TKIP EAPOL-Key descriptor version 1 (HMAC-MD5 4-way MIC and |
| RC4 group-key unwrap) |
| - MD5/RC4/DES based paths (e.g. EAP-FAST key export, IKEv2 MD5 PRF, |
| EAP-PWD MD5) |
| |
| The main reason to enable it is interoperability with legacy |
| WPA-PSK/TKIP access points still seen in the field and legacy |
| interop/QuickTrack test cases. TKIP is deprecated and not allowed in |
| current Wi-Fi Alliance certification programs. Turn this off if you |
| need a build with legacy algorithms stripped entirely. |
| |
| Enabled by default for now. The default will change to disabled in a |
| future Zephyr release, which will also disable WEP and TKIP interop |
| unless LEGACY_CRYPTO is set explicitly. |
| |
| config WIFI_NM_WPA_SUPPLICANT_WEP |
| bool "WEP support (deprecated)" |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| select DEPRECATED |
| select NOT_SECURE |
| help |
| Deprecated: merged under WIFI_NM_WPA_SUPPLICANT_LEGACY_CRYPTO. |
| Symbol retained for backward compatibility with existing prj.conf |
| files that set CONFIG_WIFI_NM_WPA_SUPPLICANT_WEP. WEP is enabled by |
| default via LEGACY_CRYPTO imply; set CONFIG_WIFI_NM_WPA_SUPPLICANT_WEP=n |
| to strip WEP while keeping WPA/TKIP interop. Has no effect unless |
| LEGACY_CRYPTO is enabled. |
| |
| choice WIFI_NM_WPA_SUPPLICANT_CRYPTO_BACKEND |
| prompt "WPA supplicant crypto implementation" |
| default WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT |
| help |
| Select the crypto implementation to use for WPA supplicant. |
| WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT supports enterprise mode |
| and DPP. |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT |
| bool "Crypto Mbedtls alt support for WiFi" |
| select MBEDTLS |
| select MBEDTLS_CIPHER |
| select MBEDTLS_PKCS5_C |
| select MBEDTLS_MD_C |
| select MBEDTLS_PK_WRITE_C |
| select MBEDTLS_CIPHERSUITE_TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA384 |
| select MBEDTLS_CIPHERSUITE_TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 |
| select MBEDTLS_NIST_KW_C |
| select MBEDTLS_HAVE_ASM |
| select MBEDTLS_CTR_DRBG_C |
| select PSA_WANT_ALG_HKDF |
| select PSA_WANT_ALG_HKDF_EXTRACT |
| select PSA_WANT_ALG_HKDF_EXPAND |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| bool "No Crypto support for WiFi" |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_EXT |
| bool "External Crypto support for hostap" |
| help |
| Use external crypto implementation for hostp, this is useful for |
| platforms where the crypto implementation is provided by the platform |
| and not by Zephyr. The external crypto implementation should provide |
| the required APIs and any other dependencies required by hostap. |
| |
| endchoice |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA |
| bool "Crypto Platform Secure Architecture support for WiFi" |
| default y |
| depends on WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT |
| select PSA_CRYPTO |
| select MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS |
| select PSA_WANT_ALG_ECDH |
| select PSA_WANT_ALG_HMAC |
| select PSA_WANT_ALG_CCM |
| select PSA_WANT_ALG_CTR |
| select PSA_WANT_ALG_SHA_1 |
| select PSA_WANT_ALG_SHA_256 |
| select PSA_WANT_ALG_SHA_224 |
| select PSA_WANT_ALG_SHA_384 |
| select PSA_WANT_ALG_SHA_512 |
| select PSA_WANT_ALG_PBKDF2_HMAC |
| select PSA_WANT_ALG_CMAC |
| select PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 |
| select PSA_WANT_KEY_TYPE_AES |
| select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT |
| select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT |
| select PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_GENERATE |
| select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY |
| select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT |
| select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT |
| select PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE |
| select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY |
| select PSA_WANT_KEY_TYPE_DERIVE |
| select PSA_WANT_KEY_TYPE_HMAC |
| help |
| Support Mbedtls 3.x to use PSA apis instead of legacy apis. |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| bool "Enterprise Crypto support for WiFi" |
| select MBEDTLS_PEM_PARSE_C |
| select MBEDTLS_PEM_WRITE_C |
| select MBEDTLS_SSL_SERVER_NAME_INDICATION |
| select MBEDTLS_X509_CRL_PARSE_C |
| select MBEDTLS_SSL_PROTO_TLS1_2 |
| select MBEDTLS_SSL_KEYING_MATERIAL_EXPORT |
| select NOT_SECURE |
| select WIFI_CERTIFICATE_LIB |
| select MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED |
| select MBEDTLS_SSL_EXTENDED_MASTER_SECRET |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| help |
| Enable Enterprise Crypto support for WiFi. This feature |
| is considered NOT SECURE due the lack of certificate |
| validation. |
| |
| if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| config EAP_TLS |
| bool "EAP-TLS support" |
| |
| config EAP_TTLS |
| bool "EAP-TTLS support" |
| |
| config EAP_PEAP |
| bool "EAP-PEAP support" |
| |
| config EAP_GTC |
| bool "EAP-GTC support" |
| |
| config EAP_MSCHAPV2 |
| bool "EAP-MSCHAPv2 support" |
| |
| config EAP_PSK |
| bool "EAP-PSK support" |
| |
| config EAP_PAX |
| bool "EAP-PAX support" |
| |
| config EAP_SAKE |
| bool "EAP-SAKE support" |
| |
| config EAP_GPSK |
| bool "EAP-GPSK support" |
| |
| config EAP_PWD |
| bool "EAP-PWD support" |
| |
| config EAP_EKE |
| bool "EAP-EKE support" |
| |
| config EAP_IKEV2 |
| bool "EAP-IKEv2 support" |
| |
| config EAP_SIM |
| bool "EAP-SIM support" |
| |
| config EAP_AKA |
| bool "EAP-AKA support" |
| |
| config EAP_FAST |
| bool "EAP-FAST support" |
| |
| config EAP_ALL |
| bool "All EAP methods support" |
| select EAP_TLS |
| select EAP_PEAP |
| select EAP_GTC |
| select EAP_TTLS |
| select EAP_MSCHAPV2 |
| default y |
| |
| config EAP_TLSV1_3 |
| bool "EAP TLSv1.3 support" |
| select MBEDTLS_X509_CRT_PARSE_C |
| select MBEDTLS_X509_RSASSA_PSS_SUPPORT |
| select MBEDTLS_SSL_PROTO_TLS1_3 |
| select MBEDTLS_SSL_SESSION_TICKETS |
| select MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED |
| select MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_EPHEMERAL_ENABLED |
| select MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED |
| select PSA_WANT_ALG_GCM |
| select PSA_WANT_ALG_RSA_OAEP |
| |
| endif # WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| |
| choice WIFI_NM_WPA_SUPPLICANT_WPA3_IMPLEMENTATION |
| prompt "WPA3 implementation" |
| default WIFI_NM_WPA_SUPPLICANT_WPA3_IMPLEMENTATION_INT |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| help |
| Select how WPA3/SAE is provided. Internal uses the supplicant |
| bignum-based implementation. External uses an out-of-tree |
| implementation (e.g. PSA crypto). None disables WPA3. |
| |
| config WIFI_NM_WPA_SUPPLICANT_WPA3_IMPLEMENTATION_NONE |
| bool "None" |
| help |
| WPA3 is disabled. Only WPA2 and earlier are available. |
| |
| config WIFI_NM_WPA_SUPPLICANT_WPA3_IMPLEMENTATION_INT |
| bool "Internal" |
| select WIFI_NM_WPA_SUPPLICANT_WPA3 |
| |
| config WIFI_NM_WPA_SUPPLICANT_WPA3_IMPLEMENTATION_EXT |
| bool "External" |
| |
| endchoice |
| |
| config WIFI_NM_WPA_SUPPLICANT_WPA3 |
| bool |
| help |
| Internal WPA3/SAE implementation (bignum-based). Selected by |
| WIFI_NM_WPA_SUPPLICANT_WPA3_IMPLEMENTATION_INT. |
| |
| config WIFI_NM_WPA_SUPPLICANT_WPA3_COMMON |
| bool |
| default y if WIFI_NM_WPA_SUPPLICANT_WPA3_IMPLEMENTATION_INT || \ |
| WIFI_NM_WPA_SUPPLICANT_WPA3_IMPLEMENTATION_EXT |
| help |
| WPA3/SAE is available (either internal or external implementation). |
| Use this in code to gate WPA3 functionality regardless of backend. |
| |
| config WIFI_NM_WPA_SUPPLICANT_OWE |
| bool "OWE support in wpa_supplicant wrapper" |
| depends on WIFI_NM_WPA_SUPPLICANT_WPA3 |
| depends on WIFI_NM_WPA_SUPPLICANT_WPA3_COMMON |
| help |
| OWE support via the wpa_supplicant network manager. |
| |
| config WIFI_NM_WPA_SUPPLICANT_AP |
| bool "SoftAP mode support based on WPA supplicant" |
| default y if WIFI_USAGE_MODE_AP || WIFI_USAGE_MODE_STA_AP |
| |
| config WIFI_NM_WPA_SUPPLICANT_WPS |
| bool "WPS support" |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config WIFI_NM_HOSTAPD_WPS |
| bool "WPS hostapd support" |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| depends on WIFI_NM_HOSTAPD_AP |
| |
| config WIFI_NM_WPA_SUPPLICANT_P2P |
| bool "P2P mode support" |
| select WIFI_NM_WPA_SUPPLICANT_AP |
| select WIFI_NM_WPA_SUPPLICANT_WPS |
| select WIFI_NM_WPA_SUPPLICANT_EAPOL |
| |
| if WIFI_NM_WPA_SUPPLICANT_P2P |
| |
| config WIFI_NM_WPA_SUPPLICANT_P2P_PROV_DISC_REQ_RETRIES |
| int "P2P provision discovery request retries" |
| default 120 |
| help |
| Maximum number of retries for P2P provision discovery requests |
| when the peer is not listening. |
| |
| endif # WIFI_NM_WPA_SUPPLICANT_P2P |
| |
| config WIFI_NM_WPA_SUPPLICANT_EAPOL |
| bool "EAPoL supplicant" |
| default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| |
| config WIFI_NM_WPA_SUPPLICANT_CLI |
| bool "CLI support for wpa_supplicant" |
| |
| config WIFI_NM_HOSTAPD_AP |
| bool "FullAP mode support based on Hostapd" |
| |
| config WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE |
| bool "Hostapd crypto enterprise support" |
| select WIFI_CERTIFICATE_LIB |
| depends on WIFI_NM_HOSTAPD_AP |
| |
| if WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE |
| config EAP_SERVER_TLS |
| bool "EAP-TLS server support" |
| |
| config EAP_SERVER_IDENTITY |
| bool "EAP-IDENTITY server support" |
| |
| config EAP_SERVER_MSCHAPV2 |
| bool "EAP-MSCHAPV2 server support" |
| |
| config EAP_SERVER_PEAP |
| bool "EAP-PEAP server support" |
| |
| config EAP_SERVER_GTC |
| bool "EAP-GTC server support" |
| |
| config EAP_SERVER_TTLS |
| bool "EAP-TTLS server support" |
| |
| config EAP_SERVER_ALL |
| bool "All EAP methods support" |
| select EAP_SERVER_TLS |
| select EAP_SERVER_MSCHAPV2 |
| select EAP_SERVER_PEAP |
| select EAP_SERVER_GTC |
| select EAP_SERVER_TTLS |
| default y |
| |
| endif # WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE |
| |
| config WIFI_NM_WPA_SUPPLICANT_BSS_MAX_IDLE_TIME |
| int "BSS max idle timeout in seconds" |
| range 0 64000 |
| default 300 |
| help |
| BSS max idle timeout is the period for which AP may keep a client |
| in associated state while there is no traffic from that particular |
| client. Set 0 to disable inclusion of BSS max idle time tag in |
| association request. If a non-zero value is set, STA can suggest a |
| timeout by including BSS max idle period in the association request. |
| AP may choose to consider or ignore the STA's preferred value. |
| Ref: Sec 11.21.13 of IEEE Std 802.11™-2020 |
| |
| config WIFI_NM_WPA_SUPPLICANT_NO_DEBUG |
| bool "Disable printing of debug messages, saves code size significantly" |
| |
| |
| config WIFI_NM_WPA_SUPPLICANT_DPP |
| bool "WFA Easy Connect DPP" |
| select DPP |
| select DPP2 |
| select DPP3 |
| select GAS |
| select GAS_SERVER |
| select OFFCHANNEL |
| select MBEDTLS_X509_CSR_WRITE_C |
| select MBEDTLS_X509_CSR_PARSE_C |
| select MBEDTLS_ECP_NIST_OPTIM |
| select PSA_WANT_ECC_SECP_R1_384 |
| |
| config WIFI_NM_WPA_SUPPLICANT_NAN |
| bool "NAN (Neighbor Awareness Networking) support" |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config WIFI_NAN_MAX_SSI_LEN |
| int "Maximum length of NAN service specific info" |
| depends on WIFI_NM_WPA_SUPPLICANT_NAN |
| range 1 65535 |
| default 128 |
| help |
| Maximum NAN Service Specific Info (SSI) payload length in bytes. |
| This value is stored inline in NAN event and request structures, |
| so increasing it raises the net_mgmt event queue footprint by |
| roughly CONFIG_NET_MGMT_EVENT_QUEUE_SIZE times this value. |
| Users needing larger SSI payloads (e.g. Matter PAF commissioning |
| with MTU=350) should set this to the required size. |
| |
| config WIFI_NM_WPA_SUPPLICANT_11AC |
| bool "IEEE 802.11ac VHT support" |
| depends on WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP |
| default y |
| |
| config WIFI_NM_WPA_SUPPLICANT_11AX |
| bool "IEEE 802.11ax HE support" |
| depends on WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP |
| default y |
| |
| config WPA_CLI |
| bool "WPA CLI support" |
| default y if WIFI_NM_WPA_SUPPLICANT_CLI |
| help |
| Enable WPA CLI support for wpa_supplicant. |
| |
| if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| config MBEDTLS_SSL_IN_CONTENT_LEN |
| default 16384 |
| config MBEDTLS_SSL_OUT_CONTENT_LEN |
| default 16384 |
| endif |
| |
| config WIFI_NM_WPA_SUPPLICANT_ROAMING |
| bool "Roaming support" |
| imply IEEE80211R |
| help |
| Enable roaming support with wpa_supplicant. When current BSS RSSI drops, |
| STA will try to find an AP with better RSSI. If found, STA will reassociate |
| to the new AP automatically without losing connection. |
| |
| config WIFI_NM_WPA_SUPPLICANT_ROAMING_RETRY |
| int "Retry count on every roaming method" |
| depends on WIFI_NM_WPA_SUPPLICANT_ROAMING |
| default 1 |
| help |
| Number of times each of 11K and 11V roaming is attempted. |
| When reaches this count, fall back to next roaming method. |
| If both reaches this count, fall back to legacy roaming, |
| which scans full channel. |
| |
| config WIFI_NM_WPA_SUPPLICANT_SKIP_DHCP_ON_ROAMING |
| bool "Skip DHCP after roaming to new AP" |
| help |
| For L2 roaming, the original AP and new AP are in the same subnet, client |
| can use same IP address and skip DHCP. Enable this to skip DHCP. |
| For L3 roaming, the original AP and new AP are in different subnet, client |
| needs to get new IP address after roaming to new AP. Disable this to keep |
| DHCP after roaming. |
| |
| config WIFI_NM_WPA_SUPPLICANT_BGSCAN |
| bool "Background scanning (for legacy roaming), recommended if 802.11r is not supported" |
| depends on WIFI_NM_WPA_SUPPLICANT_WNM |
| depends on !WIFI_NM_WPA_SUPPLICANT_ROAMING |
| |
| if WIFI_NM_WPA_SUPPLICANT_BGSCAN |
| |
| config WIFI_NM_WPA_SUPPLICANT_BGSCAN_SIMPLE |
| bool "Simple background scanning" |
| default y |
| help |
| Periodic background scans based on signal strength. |
| |
| config WIFI_NM_WPA_SUPPLICANT_BGSCAN_LEARN |
| bool "Learning" |
| help |
| Learn channels used by the network and try to avoid |
| background scans on other channels (experimental). |
| |
| endif # WIFI_NM_WPA_SUPPLICANT_BGSCAN |
| |
| config WIFI_NM_WPA_SUPPLICANT_CLEANUP_INTERVAL |
| int "WPA supplicant cleanup interval (seconds)" |
| default 10 |
| help |
| WPA supplicant cleanup interval. Increase this interval to avoid constant wakeup |
| and save power when device in low power mode. |
| |
| config WIFI_NM_HOSTAPD_CLEANUP_INTERVAL |
| int "Hostapd cleanup interval (seconds)" |
| default 10 |
| depends on WIFI_NM_HOSTAPD_AP |
| help |
| Hostapd cleanup interval. Increase this interval to avoid constant wakeup |
| and save power when device in low power mode. |
| |
| # Create hidden config options that are used in hostap. This way we do not need |
| # to mark them as allowed for CI checks, and also someone else cannot use the |
| # same name options. |
| |
| config SME |
| bool |
| default y |
| |
| config NO_CONFIG_WRITE |
| bool |
| default y |
| |
| config NO_CONFIG_BLOBS |
| bool |
| default y if !WIFI_NM_WPA_SUPPLICANT_DPP && !WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE |
| |
| config CTRL_IFACE |
| bool |
| default y |
| |
| config CTRL_IFACE_ZEPHYR |
| bool |
| default y |
| |
| config NO_RANDOM_POOL |
| bool |
| default y |
| |
| config WNM |
| bool |
| |
| config BGSCAN |
| bool |
| |
| config BGSCAN_SIMPLE |
| bool |
| |
| config BGSCAN_LEARN |
| bool |
| |
| config NO_WPA |
| bool |
| default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config NO_PBKDF2 |
| bool |
| default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config SAE_PK |
| bool |
| |
| config FST |
| bool |
| |
| config TESTING_OPTIONS |
| bool |
| |
| config AP |
| bool |
| depends on WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP |
| default y if WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP |
| |
| config NO_RADIUS |
| bool |
| |
| config NO_VLAN |
| bool |
| |
| config NO_ACCOUNTING |
| bool |
| |
| config NEED_AP_MLME |
| bool |
| |
| config IEEE80211AX |
| bool |
| |
| config EAP_SERVER |
| bool |
| |
| config EAP_SERVER_IDENTITY |
| bool |
| |
| config P2P |
| bool |
| |
| config GAS |
| bool |
| |
| config GAS_SERVER |
| bool |
| |
| config OFFCHANNEL |
| bool |
| |
| config WPS |
| bool |
| |
| config WSC |
| bool |
| |
| config IEEE8021X_EAPOL |
| bool |
| |
| config CRYPTO_INTERNAL |
| bool |
| |
| config ECC |
| bool |
| |
| config OWE |
| bool |
| |
| config MBO |
| bool |
| |
| config NO_STDOUT_DEBUG |
| bool |
| |
| config SAE |
| bool |
| |
| config SHA256 |
| bool |
| |
| config SHA384 |
| bool |
| |
| config SHA512 |
| bool |
| |
| config SUITEB192 |
| bool |
| |
| config SUITEB |
| bool |
| |
| config WEP |
| bool |
| default y if WIFI_NM_WPA_SUPPLICANT_WEP |
| |
| config WPA_CRYPTO |
| bool |
| |
| config WPA_SUPP_CRYPTO |
| bool |
| |
| config NO_ROBUST_AV |
| bool |
| |
| config NO_RRM |
| bool |
| |
| config NO_WMM_AC |
| bool |
| |
| config DPP |
| bool |
| |
| config DPP2 |
| bool |
| |
| config DPP3 |
| bool |
| |
| config NAN |
| bool |
| |
| config NAN_USD |
| bool |
| |
| config ACS |
| bool |
| |
| config IEEE80211AC |
| bool |
| |
| config HS20 |
| bool |
| |
| config IEEE80211R |
| bool |
| depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE |
| |
| config NW_SEL_RELIABILITY |
| bool |
| default y |
| depends on WIFI_NM_WPA_SUPPLICANT_NW_SEL_RELIABILITY |
| |
| config FIPS |
| bool |
| |
| choice WIFI_NM_WPA_SUPPLICANT_NW_SEL |
| prompt "WPA supplicant Network selection criterion" |
| default WIFI_NM_WPA_SUPPLICANT_NW_SEL_RELIABILITY |
| help |
| Select the network selection method for the supplicant. |
| |
| config WIFI_NM_WPA_SUPPLICANT_NW_SEL_THROUGHPUT |
| bool "Throughput based network selection" |
| help |
| Select the network based on throughput. |
| |
| config WIFI_NM_WPA_SUPPLICANT_NW_SEL_RELIABILITY |
| bool "Reliability based network selection" |
| help |
| Select the network based on reliability. |
| |
| endchoice |
| |
| config SAE_PWE_EARLY_EXIT |
| bool "Exit early if PWE if found" |
| help |
| In order to mitigate side channel attacks, even if the PWE is found the WPA |
| supplicant goes through full iterations, but in some low-resource systems |
| this can be intensive, so, add an option to exit early. |
| Note that this is highly insecure and shouldn't be used in production |
| |
| config WIFI_NM_WPA_SUPPLICANT_CRYPTO_TEST |
| bool "Test crypto in HostAP" |
| depends on WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA |
| |
| config WIFI_NM_WPA_CTRL_RESP_TIMEOUT_S |
| int "WPA supplicant control interface response timeout in seconds" |
| default 15 |
| help |
| Timeout for the control interface commands to get a response from the |
| supplicant. |
| |
| config WIFI_NM_HOSTAPD_REGULATORY_REGION |
| string "Select Wi-Fi Regulatory Domain" |
| default "00" |
| depends on WIFI_NM_HOSTAPD_AP |
| help |
| Region/Country code (ISO/IEC 3166-1).Used to set regulatory domain. |
| Set as needed to indicate country in which device is operating. |
| This can limit available channels and transmit power. |
| These two octets are used as the first two octets of the Country String |
| (dot11CountryString). "00" stands for World Wide mode. |
| |
| config WIFI_NM_HOSTAPD_REGULATORY_ENV |
| int "Select Wi-Fi Regulatory Environment" |
| default 32 |
| depends on WIFI_NM_HOSTAPD_AP |
| help |
| The third octet of the Country String (dot11CountryString) |
| This parameter is used to set the third octet of the country string. |
| All supported environments of current region can be used with |
| default value of 0x20 or 32. |
| |
| config WIFI_NM_WPA_SUPPLICANT_BTM_PRE_SCAN_CHECK |
| bool "Pre-scan check for BTM" |
| default y if !SOC_FAMILY_NORDIC_NRF |
| help |
| This option is used to enable the pre-scan check for BTM. |
| When no candidate is found, a new scan is performed. |
| Disable this if the chip takes too long to perform a scan causing |
| disassociations in WFA QT tests. |
| |
| endif # WIFI_NM_WPA_SUPPLICANT |
