From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michael Tremer To: development@lists.ipfire.org Subject: [PATCH 2/3] hostapd: Import default configuration from hostapd 2.9 Date: Mon, 19 Oct 2020 14:48:56 +0000 Message-ID: <20201019144857.22211-2-michael.tremer@ipfire.org> In-Reply-To: <20201019144857.22211-1-michael.tremer@ipfire.org> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="===============6644127214804085095==" List-Id: --===============6644127214804085095== Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable This change removes a couple of removed options and adds new ones. Notable changes are: * Enable SAE (for WPA3) * Enable Airtime Policy * Enable Client Taxonomy * Enable using the new getrandom() syscall * Enable using epoll instead of select Signed-off-by: Michael Tremer --- config/hostapd/config | 127 ++++++++++++++++++++++++++++++++++-------- 1 file changed, 105 insertions(+), 22 deletions(-) diff --git a/config/hostapd/config b/config/hostapd/config index 66ebbf1ce..78206ed78 100644 --- a/config/hostapd/config +++ b/config/hostapd/config @@ -15,22 +15,31 @@ CONFIG_DRIVER_HOSTAP=3Dy # Driver interface for wired authenticator #CONFIG_DRIVER_WIRED=3Dy =20 -# Driver interface for Prism54 driver -CONFIG_DRIVER_PRISM54=3Dy - # Driver interface for drivers using the nl80211 kernel interface CONFIG_DRIVER_NL80211=3Dy -# driver_nl80211.c requires a rather new libnl (version 1.1) which may not be -# shipped with your distribution yet. If that is the case, you need to build -# newer libnl version and point the hostapd build to use it. -#LIBNL=3D/usr/src/libnl -#CFLAGS +=3D -I$(LIBNL)/include -#LIBS +=3D -L$(LIBNL)/lib + +# QCA vendor extensions to nl80211 +#CONFIG_DRIVER_NL80211_QCA=3Dy + +# driver_nl80211.c requires libnl. If you are compiling it yourself +# you may need to point hostapd to your version of libnl. +# +#CFLAGS +=3D -I$ +#LIBS +=3D -L$ + +# Use libnl v2.0 (or 3.0) libraries. +#CONFIG_LIBNL20=3Dy + +# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored) +CONFIG_LIBNL32=3Dy + =20 # Driver interface for FreeBSD net80211 layer (e.g., Atheros driver) #CONFIG_DRIVER_BSD=3Dy #CFLAGS +=3D -I/usr/local/include #LIBS +=3D -L/usr/local/lib +#LIBS_p +=3D -L/usr/local/lib +#LIBS_c +=3D -L/usr/local/lib =20 # Driver interface for no driver (e.g., RADIUS server only) #CONFIG_DRIVER_NONE=3Dy @@ -41,12 +50,12 @@ CONFIG_IAPP=3Dy # WPA2/IEEE 802.11i RSN pre-authentication CONFIG_RSN_PREAUTH=3Dy =20 -# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS) -CONFIG_PEERKEY=3Dy - # IEEE 802.11w (management frame protection) CONFIG_IEEE80211W=3Dy =20 +# Support Operating Channel Validation +#CONFIG_OCV=3Dy + # Integrated EAP server CONFIG_EAP=3Dy =20 @@ -99,24 +108,30 @@ CONFIG_EAP_TTLS=3Dy #CONFIG_EAP_GPSK_SHA256=3Dy =20 # EAP-FAST for the integrated EAP server -# Note: Default OpenSSL package does not include support for all the -# functionality needed for EAP-FAST. If EAP-FAST is enabled with OpenSSL, -# the OpenSSL library must be patched (openssl-0.9.9-session-ticket.patch) -# to add the needed functions. #CONFIG_EAP_FAST=3Dy =20 +# EAP-TEAP for the integrated EAP server +# Note: The current EAP-TEAP implementation is experimental and should not be +# enabled for production use. The IETF RFC 7170 that defines EAP-TEAP has nu= mber +# of conflicting statements and missing details and the implementation has +# vendor specific workarounds for those and as such, may not interoperate wi= th +# any other implementation. This should not be used for anything else than +# experimentation and interoperability testing until those issues has been +# resolved. +#CONFIG_EAP_TEAP=3Dy + # Wi-Fi Protected Setup (WPS) -CONFIG_WPS=3Dy +#CONFIG_WPS=3Dy # Enable UPnP support for external WPS Registrars -CONFIG_WPS_UPNP=3Dy +#CONFIG_WPS_UPNP=3Dy # Enable WPS support with NFC config method #CONFIG_WPS_NFC=3Dy =20 # EAP-IKEv2 -CONFIG_EAP_IKEV2=3Dy +#CONFIG_EAP_IKEV2=3Dy =20 # Trusted Network Connect (EAP-TNC) -CONFIG_EAP_TNC=3Dy +#CONFIG_EAP_TNC=3Dy =20 # EAP-EKE for the integrated EAP server #CONFIG_EAP_EKE=3Dy @@ -133,10 +148,10 @@ CONFIG_PKCS12=3Dy #CONFIG_IPV6=3Dy =20 # IEEE Std 802.11r-2008 (Fast BSS Transition) -CONFIG_IEEE80211R=3Dy +#CONFIG_IEEE80211R=3Dy =20 # Use the hostapd's IEEE 802.11 authentication (ACL), but without -# the IEEE 802.11 Management capability (e.g., madwifi or FreeBSD/net80211) +# the IEEE 802.11 Management capability (e.g., FreeBSD/net80211) #CONFIG_DRIVER_RADIUS_ACL=3Dy =20 # IEEE 802.11n (High Throughput) support @@ -149,6 +164,12 @@ CONFIG_IEEE80211N=3Dy # IEEE 802.11ac (Very High Throughput) support CONFIG_IEEE80211AC=3Dy =20 +# IEEE 802.11ax HE support +# Note: This is experimental and work in progress. The definitions are still +# subject to change and this should not be expected to interoperate with the +# final IEEE 802.11ax version. +#CONFIG_IEEE80211AX=3Dy + # Remove debugging code that is printing out debug messages to stdout. # This can be used to reduce the size of the hostapd considerably if debuggi= ng # code is not needed. @@ -158,6 +179,9 @@ CONFIG_IEEE80211AC=3Dy # Disabled by default. #CONFIG_DEBUG_FILE=3Dy =20 +# Send debug messages to syslog instead of stdout +#CONFIG_DEBUG_SYSLOG=3Dy + # Add support for sending all debug messages (regardless of debug verbosity) # to the Linux kernel tracing facility. This helps debug the entire stack by # making it easy to record everything happening from the driver up into the @@ -235,10 +259,25 @@ CONFIG_IEEE80211AC=3Dy # requirements described above. #CONFIG_NO_RANDOM_POOL=3Dy =20 +# Should we attempt to use the getrandom(2) call that provides more reliable +# yet secure randomness source than /dev/random on Linux 3.17 and newer. +# Requires glibc 2.25 to build, falls back to /dev/random if unavailable. +CONFIG_GETRANDOM=3Dy + +# Should we use poll instead of select? Select is used by default. +#CONFIG_ELOOP_POLL=3Dy + +# Should we use epoll instead of select? Select is used by default. +CONFIG_ELOOP_EPOLL=3Dy + +# Should we use kqueue instead of select? Select is used by default. +#CONFIG_ELOOP_KQUEUE=3Dy + # Select TLS implementation # openssl =3D OpenSSL (default) # gnutls =3D GnuTLS # internal =3D Internal TLSv1 implementation (experimental) +# linux =3D Linux kernel AF_ALG and internal TLSv1 implementation (experimen= tal) # none =3D Empty template #CONFIG_TLS=3Dopenssl =20 @@ -251,6 +290,10 @@ CONFIG_IEEE80211AC=3Dy # can be enabled to enable use of stronger crypto algorithms. #CONFIG_TLSV12=3Dy =20 +# Select which ciphers to use by default with OpenSSL if the user does not +# specify them. +#CONFIG_TLS_DEFAULT_CIPHERS=3D"DEFAULT:!EXP:!LOW" + # If CONFIG_TLS=3Dinternal is used, additional library and include paths are # needed for LibTomMath. Alternatively, an integrated, minimal version of # LibTomMath can be used. See beginning of libtommath.c for details on benef= its @@ -278,6 +321,12 @@ CONFIG_IEEE80211AC=3Dy # Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file #CONFIG_SQLITE=3Dy =20 +# Enable Fast Session Transfer (FST) +#CONFIG_FST=3Dy + +# Enable CLI commands for FST testing +#CONFIG_FST_TEST=3Dy + # Testing options # This can be used to enable some testing options (see also the example # configuration file) that are really useful only for testing clients that @@ -309,3 +358,37 @@ CONFIG_IEEE80211AC=3Dy # http://wireless.kernel.org/en/users/Documentation/acs # CONFIG_ACS=3Dy + +# Multiband Operation support +# These extentions facilitate efficient use of multiple frequency bands +# available to the AP and the devices that may associate with it. +#CONFIG_MBO=3Dy + +# Client Taxonomy +# Has the AP retain the Probe Request and (Re)Association Request frames from +# a client, from which a signature can be produced which can identify the mo= del +# of client device like "Nexus 6P" or "iPhone 5s". +CONFIG_TAXONOMY=3Dy + +# Fast Initial Link Setup (FILS) (IEEE 802.11ai) +#CONFIG_FILS=3Dy +# FILS shared key authentication with PFS +#CONFIG_FILS_SK_PFS=3Dy + +# Include internal line edit mode in hostapd_cli. This can be used to provide +# limited command line editing and history support. +#CONFIG_WPA_CLI_EDIT=3Dy + +# Opportunistic Wireless Encryption (OWE) +# Experimental implementation of draft-harkins-owe-07.txt +#CONFIG_OWE=3Dy + +# Airtime policy support +CONFIG_AIRTIME_POLICY=3Dy + +# Override default value for the wpa_disable_eapol_key_retries configuration +# parameter. See that parameter in hostapd.conf for more details. +#CFLAGS +=3D -DDEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES=3D1 + +# Custom configuration +CONFIG_SAE=3Dy --=20 2.20.1 --===============6644127214804085095==--