1# WPA Supplicant configuration options 2# 3# Copyright (c) 2023 Nordic Semiconductor 4# 5# SPDX-License-Identifier: Apache-2.0 6# 7 8config WIFI_NM_WPA_SUPPLICANT 9 bool "WPA Suplicant from hostap project [EXPERIMENTAL]" 10 select POSIX_TIMERS 11 select POSIX_SIGNALS 12 select POSIX_API 13 select XSI_SINGLE_PROCESS 14 select NET_SOCKETS 15 select NET_SOCKETS_PACKET 16 select NET_L2_WIFI_MGMT 17 select WIFI_NM 18 select EXPERIMENTAL 19 select COMMON_LIBC_MALLOC 20 select ZVFS 21 select ZVFS_EVENTFD 22 help 23 WPA supplicant as a network management backend for WIFI_NM. 24 25if WIFI_NM_WPA_SUPPLICANT 26 27config WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP 28 bool "Use Zephyr kernel heap for Wi-Fi driver" 29 default y 30 help 31 Enable this option to use K_HEAP for memory allocations in supplicant. 32 33if !WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP 34config WIFI_NM_WPA_SUPPLICANT_HEAP 35 int "Dedicated memory pool for wpa_supplicant" 36 def_int 66560 if WIFI_NM_HOSTAPD_AP 37 def_int 55000 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE && WIFI_CREDENTIALS 38 def_int 48000 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 39 def_int 41808 if WIFI_NM_WPA_SUPPLICANT_AP 40 # 30K is mandatory, but might need more for long duration use cases 41 def_int 30000 42endif # !WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP 43 44if WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP 45config HEAP_MEM_POOL_ADD_SIZE_HOSTAP 46 def_int 66560 if WIFI_NM_HOSTAPD_AP 47 def_int 55000 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE && WIFI_CREDENTIALS 48 def_int 48000 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 49 def_int 41808 if WIFI_NM_WPA_SUPPLICANT_AP 50 # 30K is mandatory, but might need more for long duration use cases 51 def_int 30000 52endif # WIFI_NM_WPA_SUPPLICANT_GLOBAL_HEAP 53 54 55config WIFI_NM_WPA_SUPPLICANT_THREAD_STACK_SIZE 56 int "Stack size for wpa_supplicant thread" 57 # TODO: Providing higher stack size for Enterprise mode to fix stack 58 # overflow issues. Need to identify the cause for higher stack usage. 59 default 8192 if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 60 # This is needed to handle stack overflow issues on nRF Wi-Fi drivers. 61 default 5900 if WIFI_NM_WPA_SUPPLICANT_AP 62 default 5800 63 64config WIFI_NM_WPA_SUPPLICANT_WQ_STACK_SIZE 65 int "Stack size for wpa_supplicant iface workqueue" 66 default 4400 67 68config WIFI_NM_WPA_SUPPLICANT_WQ_PRIO 69 int "Thread priority of wpa_supplicant iface workqueue" 70 default 7 71 72config WIFI_NM_WPA_SUPPLICANT_PRIO 73 int "Thread priority of wpa_supplicant" 74 default 0 75 76# Currently we default ZVFS_OPEN_MAX to 16 in lib/posix/Kconfig 77# l2_packet - 1 78# ctrl_iface - 2 * socketpairs = 4(local and global) 79# z_wpa_event_sock - 1 socketpair = 2 80# Remaining left for the applications running in default configuration 81 82# Supplicant API is stack heavy (buffers + snprintfs) and control interface 83# uses socketpair which pushes the stack usage causing overflow for 2048 bytes. 84# So we set SYSTEM_WORKQUEUE_STACK_SIZE default to 2560 in kernel/Kconfig 85 86module = WIFI_NM_WPA_SUPPLICANT 87module-str = WPA supplicant 88source "subsys/logging/Kconfig.template.log_config" 89 90config WIFI_NM_WPA_SUPPLICANT_DEBUG_LEVEL 91 int "Min compiled-in debug message level for WPA supplicant" 92 default 0 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG # MSG_EXCESSIVE 93 default 3 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_INF # MSG_INFO 94 default 4 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_WRN # MSG_WARNING 95 default 5 if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_ERR # MSG_ERROR 96 default 5 97 help 98 Minimum priority level of a debug message emitted by WPA supplicant that 99 is compiled-in the firmware. See wpa_debug.h file of the supplicant for 100 available levels and functions for emitting the messages. Note that 101 runtime filtering can also be configured in addition to the compile-time 102 filtering. 103 104config WIFI_NM_WPA_SUPPLICANT_DEBUG_SHOW_KEYS 105 bool "Include key material in debug output" 106 help 107 This option enables inclusion of key material (passwords, encryption keys, 108 etc.) in debug output. This is equivalent to the -K command line flag 109 in wpa_supplicant. 110 111 WARNING: This is a security risk and should only be enabled during 112 development or debugging. Key material should never be logged in production 113 systems as it can compromise network security. 114 115if WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG 116# hostap debug is very verbose and despite large log buffer sizes 117# log messages can be lost. So, we set the log mode to immediate 118# to avoid losing any debug messages. 119choice LOG_MODE 120 default LOG_MODE_IMMEDIATE 121endchoice 122endif # WIFI_NM_WPA_SUPPLICANT_LOG_LEVEL_DBG 123 124# Memory optimizations 125config WIFI_NM_WPA_SUPPLICANT_ADVANCED_FEATURES 126 bool "Advanced features" 127 default y if !SOC_FAMILY_NORDIC_NRF 128 129if WIFI_NM_WPA_SUPPLICANT_ADVANCED_FEATURES 130 131config WIFI_NM_WPA_SUPPLICANT_ROBUST_AV 132 bool "Robust Audio Video streaming support" 133 default y 134 135# Hidden as these are mandatory for WFA certification 136config WIFI_NM_WPA_SUPPLICANT_WMM_AC 137 bool 138 default y 139 140config WIFI_NM_WPA_SUPPLICANT_MBO 141 bool 142 default y 143 144config WIFI_NM_WPA_SUPPLICANT_WNM 145 bool "Wireless Network Management support" 146 default y 147 148config WIFI_NM_WPA_SUPPLICANT_RRM 149 bool "Radio Resource Management support" 150 default y 151endif 152 153config WIFI_NM_WPA_SUPPLICANT_WEP 154 bool "WEP (Legacy crypto) support" 155 156choice WIFI_NM_WPA_SUPPLICANT_CRYPTO_BACKEND 157 prompt "WPA supplicant crypto implementation" 158 default WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT 159 help 160 Select the crypto implementation to use for WPA supplicant. 161 WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT supports enterprise mode 162 and DPP. 163 164config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ALT 165 bool "Crypto Mbedtls alt support for WiFi" 166 select MBEDTLS 167 select MBEDTLS_CIPHER_MODE_CTR_ENABLED 168 select MBEDTLS_CIPHER_MODE_CBC_ENABLED 169 select MBEDTLS_CIPHER_AES_ENABLED 170 select MBEDTLS_CIPHER_DES_ENABLED 171 select MBEDTLS_MD5 172 select MBEDTLS_SHA1 173 select MBEDTLS_SHA384 174 select MBEDTLS_ENTROPY_C 175 select MBEDTLS_CIPHER 176 select MBEDTLS_ECP_C 177 select MBEDTLS_ECP_ALL_ENABLED 178 select MBEDTLS_CMAC 179 select MBEDTLS_PKCS5_C 180 select MBEDTLS_PK_WRITE_C 181 select MBEDTLS_ECDH_C 182 select MBEDTLS_ECDSA_C 183 select MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED 184 select MBEDTLS_RSA_C 185 select MBEDTLS_PKCS1_V15 186 select MBEDTLS_PKCS1_V21 187 select MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED 188 select MBEDTLS_NIST_KW_C 189 select MBEDTLS_DHM_C 190 select MBEDTLS_HKDF_C 191 192config WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE 193 bool "No Crypto support for WiFi" 194 195config WIFI_NM_WPA_SUPPLICANT_CRYPTO_EXT 196 bool "External Crypto support for hostap" 197 help 198 Use external crypto implementation for hostp, this is useful for 199 platforms where the crypto implementation is provided by the platform 200 and not by Zephyr. The external crypto implementation should provide 201 the required APIs and any other dependencies required by hostap. 202 203endchoice 204 205config WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA 206 bool "Crypto Platform Secure Architecture support for WiFi" 207 imply MBEDTLS_PSA_CRYPTO_C 208 select MBEDTLS_USE_PSA_CRYPTO 209 select PSA_WANT_ALG_ECDH 210 select PSA_WANT_ALG_HMAC 211 select PSA_WANT_ALG_CCM 212 select PSA_WANT_ALG_CTR 213 select PSA_WANT_ALG_MD5 214 select PSA_WANT_ALG_SHA_1 215 select PSA_WANT_ALG_SHA_256 216 select PSA_WANT_ALG_SHA_224 217 select PSA_WANT_ALG_SHA_384 218 select PSA_WANT_ALG_SHA_512 219 select PSA_WANT_ALG_PBKDF2_HMAC 220 select PSA_WANT_ALG_CMAC 221 select PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128 222 select PSA_WANT_KEY_TYPE_AES 223 select PSA_WANT_KEY_TYPE_ECC_PUBLIC_KEY 224 select PSA_WANT_KEY_TYPE_RSA_PUBLIC_KEY 225 help 226 Support Mbedtls 3.x to use PSA apis instead of legacy apis. 227 228config WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 229 bool "Enterprise Crypto support for WiFi" 230 select MBEDTLS_PEM_CERTIFICATE_FORMAT if MBEDTLS_BUILTIN 231 select MBEDTLS_SERVER_NAME_INDICATION if MBEDTLS_BUILTIN 232 select MBEDTLS_X509_CRL_PARSE_C 233 select MBEDTLS_TLS_VERSION_1_2 234 select NOT_SECURE 235 select WIFI_CERTIFICATE_LIB 236 depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE 237 help 238 Enable Enterprise Crypto support for WiFi. This feature 239 is considered NOT SECURE due the lack of certificate 240 validation. 241 242if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 243config EAP_TLS 244 bool "EAP-TLS support" 245 246config EAP_TTLS 247 bool "EAP-TTLS support" 248 249config EAP_PEAP 250 bool "EAP-PEAP support" 251 252config EAP_MD5 253 bool "EAP-MD5 support" 254 255config EAP_GTC 256 bool "EAP-GTC support" 257 258config EAP_MSCHAPV2 259 bool "EAP-MSCHAPv2 support" 260 261config EAP_LEAP 262 bool "EAP-LEAP support" 263 264config EAP_PSK 265 bool "EAP-PSK support" 266 267config EAP_PAX 268 bool "EAP-PAX support" 269 270config EAP_SAKE 271 bool "EAP-SAKE support" 272 273config EAP_GPSK 274 bool "EAP-GPSK support" 275 276config EAP_PWD 277 bool "EAP-PWD support" 278 279config EAP_EKE 280 bool "EAP-EKE support" 281 282config EAP_IKEV2 283 bool "EAP-IKEv2 support" 284 285config EAP_SIM 286 bool "EAP-SIM support" 287 288config EAP_AKA 289 bool "EAP-AKA support" 290 291config EAP_FAST 292 bool "EAP-FAST support" 293 294config EAP_ALL 295 bool "All EAP methods support" 296 select EAP_TLS 297 select EAP_PEAP 298 select EAP_GTC 299 select EAP_TTLS 300 select EAP_MSCHAPV2 301 default y 302endif # WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 303 304config WIFI_NM_WPA_SUPPLICANT_WPA3 305 bool "WPA3 support" 306 depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE 307 default y 308 309config WIFI_NM_WPA_SUPPLICANT_AP 310 bool "SoftAP mode support based on WPA supplicant" 311 312config WIFI_NM_WPA_SUPPLICANT_WPS 313 bool "WPS support" 314 depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE 315 316config WIFI_NM_HOSTAPD_WPS 317 bool "WPS hostapd support" 318 depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE 319 depends on WIFI_NM_HOSTAPD_AP 320 321config WIFI_NM_WPA_SUPPLICANT_P2P 322 bool "P2P mode support" 323 select WIFI_NM_WPA_SUPPLICANT_AP 324 select WIFI_NM_WPA_SUPPLICANT_WPS 325 select WIFI_NM_WPA_SUPPLICANT_EAPOL 326 327config WIFI_NM_WPA_SUPPLICANT_EAPOL 328 bool "EAPoL supplicant" 329 default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 330 331config WIFI_NM_WPA_SUPPLICANT_CLI 332 bool "CLI support for wpa_supplicant" 333 334config WIFI_NM_WPA_SUPPLICANT_INF_MON 335 bool "Monitor the net mgmt event to add/del interface" 336 default y 337 338config WIFI_NM_HOSTAPD_AP 339 bool "FullAP mode support based on Hostapd" 340 depends on !WIFI_NM_WPA_SUPPLICANT_INF_MON 341 342config WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE 343 bool "Hostapd crypto enterprise support" 344 select WIFI_CERTIFICATE_LIB 345 depends on WIFI_NM_HOSTAPD_AP 346 347if WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE 348config EAP_SERVER_TLS 349 bool "EAP-TLS server support" 350 351config EAP_SERVER_IDENTITY 352 bool "EAP-IDENTITY server support" 353 354config EAP_SERVER_MD5 355 bool "EAP-MD5 server support" 356 357config EAP_SERVER_MSCHAPV2 358 bool "EAP-MSCHAPV2 server support" 359 360config EAP_SERVER_PEAP 361 bool "EAP-PEAP server support" 362 363config EAP_SERVER_GTC 364 bool "EAP-GTC server support" 365 366config EAP_SERVER_TTLS 367 bool "EAP-TTLS server support" 368 369config EAP_SERVER_ALL 370 bool "All EAP methods support" 371 select EAP_SERVER_TLS 372 select EAP_SERVER_MSCHAPV2 373 select EAP_SERVER_PEAP 374 select EAP_SERVER_GTC 375 select EAP_SERVER_TTLS 376 default y 377 378endif # WIFI_NM_HOSTAPD_CRYPTO_ENTERPRISE 379 380config WIFI_NM_WPA_SUPPLICANT_BSS_MAX_IDLE_TIME 381 int "BSS max idle timeout in seconds" 382 range 0 64000 383 default 300 384 help 385 BSS max idle timeout is the period for which AP may keep a client 386 in associated state while there is no traffic from that particular 387 client. Set 0 to disable inclusion of BSS max idle time tag in 388 association request. If a non-zero value is set, STA can suggest a 389 timeout by including BSS max idle period in the association request. 390 AP may choose to consider or ignore the STA's preferred value. 391 Ref: Sec 11.21.13 of IEEE Std 802.11™-2020 392 393config WIFI_NM_WPA_SUPPLICANT_NO_DEBUG 394 bool "Disable printing of debug messages, saves code size significantly" 395 396 397config WIFI_NM_WPA_SUPPLICANT_DPP 398 bool "WFA Easy Connect DPP" 399 select DPP 400 select DPP2 401 select DPP3 402 select GAS 403 select GAS_SERVER 404 select OFFCHANNEL 405 select MBEDTLS_X509_CSR_WRITE_C 406 select MBEDTLS_X509_CSR_PARSE_C 407 408config WIFI_NM_WPA_SUPPLICANT_11AC 409 bool "IEEE 802.11ac VHT support" 410 depends on WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP 411 default y 412 413config WIFI_NM_WPA_SUPPLICANT_11AX 414 bool "IEEE 802.11ax HE support" 415 depends on WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP 416 default y 417 418config WPA_CLI 419 bool "WPA CLI support" 420 default y if WIFI_NM_WPA_SUPPLICANT_CLI 421 help 422 Enable WPA CLI support for wpa_supplicant. 423 424if WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 425 config MBEDTLS_SSL_MAX_CONTENT_LEN 426 default 16384 427endif 428 429config WIFI_NM_WPA_SUPPLICANT_ROAMING 430 bool "Roaming support" 431 imply IEEE80211R 432 help 433 Enable roaming support with wpa_supplicant. When current BSS RSSI drops, 434 STA will try to find an AP with better RSSI. If found, STA will reassociate 435 to the new AP automatically without losing connection. 436 437config WIFI_NM_WPA_SUPPLICANT_SKIP_DHCP_ON_ROAMING 438 bool "Skip DHCP after roaming to new AP" 439 help 440 For L2 roaming, the original AP and new AP are in the same subnet, client 441 can use same IP address and skip DHCP. Enable this to skip DHCP. 442 For L3 roaming, the original AP and new AP are in different subnet, client 443 needs to get new IP address after roaming to new AP. Disable this to keep 444 DHCP after roaming. 445 446# Create hidden config options that are used in hostap. This way we do not need 447# to mark them as allowed for CI checks, and also someone else cannot use the 448# same name options. 449 450config SME 451 bool 452 default y 453 454config NO_CONFIG_WRITE 455 bool 456 default y 457 458config NO_CONFIG_BLOBS 459 bool 460 default y if !WIFI_NM_WPA_SUPPLICANT_DPP && !WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE 461 462config CTRL_IFACE 463 bool 464 default y 465 466config CTRL_IFACE_ZEPHYR 467 bool 468 default y 469 470config NO_RANDOM_POOL 471 bool 472 default y 473 474config WNM 475 bool 476 477config NO_WPA 478 bool 479 default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE 480 481config NO_PBKDF2 482 bool 483 default y if WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE 484 485config SAE_PK 486 bool 487 488config FST 489 bool 490 491config TESTING_OPTIONS 492 bool 493 494config AP 495 bool 496 depends on WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP 497 default y if WIFI_NM_WPA_SUPPLICANT_AP || WIFI_NM_HOSTAPD_AP 498 499config NO_RADIUS 500 bool 501 502config NO_VLAN 503 bool 504 505config NO_ACCOUNTING 506 bool 507 508config NEED_AP_MLME 509 bool 510 511config IEEE80211AX 512 bool 513 514config EAP_SERVER 515 bool 516 517config EAP_SERVER_IDENTITY 518 bool 519 520config P2P 521 bool 522 523config GAS 524 bool 525 526config GAS_SERVER 527 bool 528 529config OFFCHANNEL 530 bool 531 532config WPS 533 bool 534 535config WSC 536 bool 537 538config IEEE8021X_EAPOL 539 bool 540 541config CRYPTO_INTERNAL 542 bool 543 544config ECC 545 bool 546 547config MBO 548 bool 549 550config NO_STDOUT_DEBUG 551 bool 552 553config SAE 554 bool 555 556config SHA256 557 bool 558 559config SHA384 560 bool 561 562config SHA512 563 bool 564 565config SUITEB192 566 bool 567 568config SUITEB 569 bool 570 571config WEP 572 bool 573 default y if WIFI_NM_WPA_SUPPLICANT_WEP 574 575config WPA_CRYPTO 576 bool 577 578config WPA_SUPP_CRYPTO 579 bool 580 581config NO_ROBUST_AV 582 bool 583 584config NO_RRM 585 bool 586 587config NO_WMM_AC 588 bool 589 590config DPP 591 bool 592 593config DPP2 594 bool 595 596config DPP3 597 bool 598 599config ACS 600 bool 601 602config IEEE80211AC 603 bool 604 605config HS20 606 bool 607 608config IEEE80211R 609 bool 610 depends on !WIFI_NM_WPA_SUPPLICANT_CRYPTO_NONE 611 612config NW_SEL_RELIABILITY 613 bool 614 default y 615 depends on WIFI_NM_WPA_SUPPLICANT_NW_SEL_RELIABILITY 616 617choice WIFI_NM_WPA_SUPPLICANT_NW_SEL 618 prompt "WPA supplicant Network selection criterion" 619 default WIFI_NM_WPA_SUPPLICANT_NW_SEL_THROUGHPUT 620 help 621 Select the network selection method for the supplicant. 622 623config WIFI_NM_WPA_SUPPLICANT_NW_SEL_THROUGHPUT 624 bool "Throughput based network selection" 625 help 626 Select the network based on throughput. 627 628config WIFI_NM_WPA_SUPPLICANT_NW_SEL_RELIABILITY 629 bool "Reliability based network selection" 630 help 631 Select the network based on reliability. 632 633endchoice 634 635config SAE_PWE_EARLY_EXIT 636 bool "Exit early if PWE if found" 637 help 638 In order to mitigate side channel attacks, even if the PWE is found the WPA 639 supplicant goes through full iterations, but in some low-resource systems 640 this can be intensive, so, add an option to exit early. 641 Note that this is highly insecure and shouldn't be used in production 642 643config WIFI_NM_WPA_SUPPLICANT_CRYPTO_TEST 644 bool 645 depends on WIFI_NM_WPA_SUPPLICANT_CRYPTO_MBEDTLS_PSA 646 647config WIFI_NM_WPA_CTRL_RESP_TIMEOUT_S 648 int "WPA supplicant control interface response timeout in seconds" 649 default 15 650 help 651 Timeout for the control interface commands to get a response from the 652 supplicant. 653 654config WIFI_NM_HOSTAPD_REGULATORY_REGION 655 string "Select Wi-Fi Regulatory Domain" 656 default "00" 657 depends on WIFI_NM_HOSTAPD_AP 658 help 659 Region/Country code (ISO/IEC 3166-1).Used to set regulatory domain. 660 Set as needed to indicate country in which device is operating. 661 This can limit available channels and transmit power. 662 These two octets are used as the first two octets of the Country String 663 (dot11CountryString). "00" stands for World Wide mode. 664 665config WIFI_NM_HOSTAPD_REGULATORY_ENV 666 int "Select Wi-Fi Regulatory Environment" 667 default 32 668 depends on WIFI_NM_HOSTAPD_AP 669 help 670 The third octet of the Country String (dot11CountryString) 671 This parameter is used to set the third octet of the country string. 672 All supported environments of current region can be used with 673 default value of 0x20 or 32. 674 675endif # WIFI_NM_WPA_SUPPLICANT 676