hostapd: add support for client taxonomy in the full config
[openwrt/openwrt.git] / package / network / services / hostapd / files / hostapd-full.config
1 # Example hostapd build time configuration
2 #
3 # This file lists the configuration options that are used when building the
4 # hostapd binary. All lines starting with # are ignored. Configuration option
5 # lines must be commented out complete, if they are not to be included, i.e.,
6 # just setting VARIABLE=n is not disabling that variable.
7 #
8 # This file is included in Makefile, so variables like CFLAGS and LIBS can also
9 # be modified from here. In most cass, these lines should use += in order not
10 # to override previous values of the variables.
11
12 # Driver interface for Host AP driver
13 #CONFIG_DRIVER_HOSTAP=y
14
15 # Driver interface for wired authenticator
16 CONFIG_DRIVER_WIRED=y
17
18 # Driver interface for drivers using the nl80211 kernel interface
19 CONFIG_DRIVER_NL80211=y
20
21 # QCA vendor extensions to nl80211
22 #CONFIG_DRIVER_NL80211_QCA=y
23
24 # driver_nl80211.c requires libnl. If you are compiling it yourself
25 # you may need to point hostapd to your version of libnl.
26 #
27 #CFLAGS += -I$<path to libnl include files>
28 #LIBS += -L$<path to libnl library files>
29
30 # Use libnl v2.0 (or 3.0) libraries.
31 #CONFIG_LIBNL20=y
32
33 # Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored)
34 #CONFIG_LIBNL32=y
35
36
37 # Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
38 #CONFIG_DRIVER_BSD=y
39 #CFLAGS += -I/usr/local/include
40 #LIBS += -L/usr/local/lib
41 #LIBS_p += -L/usr/local/lib
42 #LIBS_c += -L/usr/local/lib
43
44 # Driver interface for no driver (e.g., RADIUS server only)
45 #CONFIG_DRIVER_NONE=y
46
47 # IEEE 802.11F/IAPP
48 CONFIG_IAPP=y
49
50 # WPA2/IEEE 802.11i RSN pre-authentication
51 CONFIG_RSN_PREAUTH=y
52
53 # PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
54 CONFIG_PEERKEY=y
55
56 # IEEE 802.11w (management frame protection)
57 # Driver support is also needed for IEEE 802.11w.
58 #CONFIG_IEEE80211W=y
59
60 # Integrated EAP server
61 CONFIG_EAP=y
62
63 # EAP Re-authentication Protocol (ERP) in integrated EAP server
64 #CONFIG_ERP=y
65
66 # EAP-MD5 for the integrated EAP server
67 CONFIG_EAP_MD5=y
68
69 # EAP-TLS for the integrated EAP server
70 CONFIG_EAP_TLS=y
71
72 # EAP-MSCHAPv2 for the integrated EAP server
73 CONFIG_EAP_MSCHAPV2=y
74
75 # EAP-PEAP for the integrated EAP server
76 CONFIG_EAP_PEAP=y
77
78 # EAP-GTC for the integrated EAP server
79 CONFIG_EAP_GTC=y
80
81 # EAP-TTLS for the integrated EAP server
82 CONFIG_EAP_TTLS=y
83
84 # EAP-SIM for the integrated EAP server
85 #CONFIG_EAP_SIM=y
86
87 # EAP-AKA for the integrated EAP server
88 #CONFIG_EAP_AKA=y
89
90 # EAP-AKA' for the integrated EAP server
91 # This requires CONFIG_EAP_AKA to be enabled, too.
92 #CONFIG_EAP_AKA_PRIME=y
93
94 # EAP-PAX for the integrated EAP server
95 #CONFIG_EAP_PAX=y
96
97 # EAP-PSK for the integrated EAP server (this is _not_ needed for WPA-PSK)
98 #CONFIG_EAP_PSK=y
99
100 # EAP-pwd for the integrated EAP server (secure authentication with a password)
101 #CONFIG_EAP_PWD=y
102
103 # EAP-SAKE for the integrated EAP server
104 #CONFIG_EAP_SAKE=y
105
106 # EAP-GPSK for the integrated EAP server
107 #CONFIG_EAP_GPSK=y
108 # Include support for optional SHA256 cipher suite in EAP-GPSK
109 #CONFIG_EAP_GPSK_SHA256=y
110
111 # EAP-FAST for the integrated EAP server
112 # Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed
113 # for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g.,
114 # with openssl-0.9.8x-tls-extensions.patch, to add the needed functions.
115 CONFIG_EAP_FAST=y
116
117 # Wi-Fi Protected Setup (WPS)
118 CONFIG_WPS=y
119 # Enable UPnP support for external WPS Registrars
120 #CONFIG_WPS_UPNP=y
121 # Enable WPS support with NFC config method
122 #CONFIG_WPS_NFC=y
123
124 # EAP-IKEv2
125 #CONFIG_EAP_IKEV2=y
126
127 # Trusted Network Connect (EAP-TNC)
128 #CONFIG_EAP_TNC=y
129
130 # EAP-EKE for the integrated EAP server
131 #CONFIG_EAP_EKE=y
132
133 # PKCS#12 (PFX) support (used to read private key and certificate file from
134 # a file that usually has extension .p12 or .pfx)
135 CONFIG_PKCS12=y
136
137 # RADIUS authentication server. This provides access to the integrated EAP
138 # server from external hosts using RADIUS.
139 #CONFIG_RADIUS_SERVER=y
140
141 # Build IPv6 support for RADIUS operations
142 CONFIG_IPV6=y
143
144 # IEEE Std 802.11r-2008 (Fast BSS Transition)
145 CONFIG_IEEE80211R=y
146
147 # Use the hostapd's IEEE 802.11 authentication (ACL), but without
148 # the IEEE 802.11 Management capability (e.g., FreeBSD/net80211)
149 #CONFIG_DRIVER_RADIUS_ACL=y
150
151 # IEEE 802.11n (High Throughput) support
152 CONFIG_IEEE80211N=y
153
154 # Wireless Network Management (IEEE Std 802.11v-2011)
155 # Note: This is experimental and not complete implementation.
156 CONFIG_WNM=y
157
158 # IEEE 802.11ac (Very High Throughput) support
159 CONFIG_IEEE80211AC=y
160
161 # IEEE 802.11ax HE support
162 # Note: This is experimental and work in progress. The definitions are still
163 # subject to change and this should not be expected to interoperate with the
164 # final IEEE 802.11ax version.
165 #CONFIG_IEEE80211AX=y
166
167 # Remove debugging code that is printing out debug messages to stdout.
168 # This can be used to reduce the size of the hostapd considerably if debugging
169 # code is not needed.
170 #CONFIG_NO_STDOUT_DEBUG=y
171
172 # Add support for writing debug log to a file: -f /tmp/hostapd.log
173 # Disabled by default.
174 #CONFIG_DEBUG_FILE=y
175
176 # Send debug messages to syslog instead of stdout
177 CONFIG_DEBUG_SYSLOG=y
178
179 # Add support for sending all debug messages (regardless of debug verbosity)
180 # to the Linux kernel tracing facility. This helps debug the entire stack by
181 # making it easy to record everything happening from the driver up into the
182 # same file, e.g., using trace-cmd.
183 #CONFIG_DEBUG_LINUX_TRACING=y
184
185 # Remove support for RADIUS accounting
186 #CONFIG_NO_ACCOUNTING=y
187
188 # Remove support for RADIUS
189 #CONFIG_NO_RADIUS=y
190
191 # Remove support for VLANs
192 #CONFIG_NO_VLAN=y
193
194 # Enable support for fully dynamic VLANs. This enables hostapd to
195 # automatically create bridge and VLAN interfaces if necessary.
196 CONFIG_FULL_DYNAMIC_VLAN=y
197
198 # Use netlink-based kernel API for VLAN operations instead of ioctl()
199 # Note: This requires libnl 3.1 or newer.
200 #CONFIG_VLAN_NETLINK=y
201
202 # Remove support for dumping internal state through control interface commands
203 # This can be used to reduce binary size at the cost of disabling a debugging
204 # option.
205 CONFIG_NO_DUMP_STATE=y
206
207 # Enable tracing code for developer debugging
208 # This tracks use of memory allocations and other registrations and reports
209 # incorrect use with a backtrace of call (or allocation) location.
210 #CONFIG_WPA_TRACE=y
211 # For BSD, comment out these.
212 #LIBS += -lexecinfo
213 #LIBS_p += -lexecinfo
214 #LIBS_c += -lexecinfo
215
216 # Use libbfd to get more details for developer debugging
217 # This enables use of libbfd to get more detailed symbols for the backtraces
218 # generated by CONFIG_WPA_TRACE=y.
219 #CONFIG_WPA_TRACE_BFD=y
220 # For BSD, comment out these.
221 #LIBS += -lbfd -liberty -lz
222 #LIBS_p += -lbfd -liberty -lz
223 #LIBS_c += -lbfd -liberty -lz
224
225 # hostapd depends on strong random number generation being available from the
226 # operating system. os_get_random() function is used to fetch random data when
227 # needed, e.g., for key generation. On Linux and BSD systems, this works by
228 # reading /dev/urandom. It should be noted that the OS entropy pool needs to be
229 # properly initialized before hostapd is started. This is important especially
230 # on embedded devices that do not have a hardware random number generator and
231 # may by default start up with minimal entropy available for random number
232 # generation.
233 #
234 # As a safety net, hostapd is by default trying to internally collect
235 # additional entropy for generating random data to mix in with the data
236 # fetched from the OS. This by itself is not considered to be very strong, but
237 # it may help in cases where the system pool is not initialized properly.
238 # However, it is very strongly recommended that the system pool is initialized
239 # with enough entropy either by using hardware assisted random number
240 # generator or by storing state over device reboots.
241 #
242 # hostapd can be configured to maintain its own entropy store over restarts to
243 # enhance random number generation. This is not perfect, but it is much more
244 # secure than using the same sequence of random numbers after every reboot.
245 # This can be enabled with -e<entropy file> command line option. The specified
246 # file needs to be readable and writable by hostapd.
247 #
248 # If the os_get_random() is known to provide strong random data (e.g., on
249 # Linux/BSD, the board in question is known to have reliable source of random
250 # data from /dev/urandom), the internal hostapd random pool can be disabled.
251 # This will save some in binary size and CPU use. However, this should only be
252 # considered for builds that are known to be used on devices that meet the
253 # requirements described above.
254 CONFIG_NO_RANDOM_POOL=y
255
256 # Should we use poll instead of select? Select is used by default.
257 #CONFIG_ELOOP_POLL=y
258
259 # Should we use epoll instead of select? Select is used by default.
260 #CONFIG_ELOOP_EPOLL=y
261
262 # Should we use kqueue instead of select? Select is used by default.
263 #CONFIG_ELOOP_KQUEUE=y
264
265 # Select TLS implementation
266 # openssl = OpenSSL (default)
267 # gnutls = GnuTLS
268 # internal = Internal TLSv1 implementation (experimental)
269 # linux = Linux kernel AF_ALG and internal TLSv1 implementation (experimental)
270 # none = Empty template
271 CONFIG_TLS=internal
272
273 # TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1)
274 # can be enabled to get a stronger construction of messages when block ciphers
275 # are used.
276 #CONFIG_TLSV11=y
277
278 # TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2)
279 # can be enabled to enable use of stronger crypto algorithms.
280 #CONFIG_TLSV12=y
281
282 # Select which ciphers to use by default with OpenSSL if the user does not
283 # specify them.
284 #CONFIG_TLS_DEFAULT_CIPHERS="DEFAULT:!EXP:!LOW"
285
286 # If CONFIG_TLS=internal is used, additional library and include paths are
287 # needed for LibTomMath. Alternatively, an integrated, minimal version of
288 # LibTomMath can be used. See beginning of libtommath.c for details on benefits
289 # and drawbacks of this option.
290 CONFIG_INTERNAL_LIBTOMMATH=y
291 #ifndef CONFIG_INTERNAL_LIBTOMMATH
292 #LTM_PATH=/usr/src/libtommath-0.39
293 #CFLAGS += -I$(LTM_PATH)
294 #LIBS += -L$(LTM_PATH)
295 #LIBS_p += -L$(LTM_PATH)
296 #endif
297 # At the cost of about 4 kB of additional binary size, the internal LibTomMath
298 # can be configured to include faster routines for exptmod, sqr, and div to
299 # speed up DH and RSA calculation considerably
300 #CONFIG_INTERNAL_LIBTOMMATH_FAST=y
301
302 # Interworking (IEEE 802.11u)
303 # This can be used to enable functionality to improve interworking with
304 # external networks.
305 #CONFIG_INTERWORKING=y
306
307 # Hotspot 2.0
308 #CONFIG_HS20=y
309
310 # Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file
311 #CONFIG_SQLITE=y
312
313 # Enable Fast Session Transfer (FST)
314 #CONFIG_FST=y
315
316 # Enable CLI commands for FST testing
317 #CONFIG_FST_TEST=y
318
319 # Testing options
320 # This can be used to enable some testing options (see also the example
321 # configuration file) that are really useful only for testing clients that
322 # connect to this hostapd. These options allow, for example, to drop a
323 # certain percentage of probe requests or auth/(re)assoc frames.
324 #
325 #CONFIG_TESTING_OPTIONS=y
326
327 # Automatic Channel Selection
328 # This will allow hostapd to pick the channel automatically when channel is set
329 # to "acs_survey" or "0". Eventually, other ACS algorithms can be added in
330 # similar way.
331 #
332 # Automatic selection is currently only done through initialization, later on
333 # we hope to do background checks to keep us moving to more ideal channels as
334 # time goes by. ACS is currently only supported through the nl80211 driver and
335 # your driver must have survey dump capability that is filled by the driver
336 # during scanning.
337 #
338 # You can customize the ACS survey algorithm with the hostapd.conf variable
339 # acs_num_scans.
340 #
341 # Supported ACS drivers:
342 # * ath9k
343 # * ath5k
344 # * ath10k
345 #
346 # For more details refer to:
347 # http://wireless.kernel.org/en/users/Documentation/acs
348 #
349 #CONFIG_ACS=y
350
351 # Multiband Operation support
352 # These extentions facilitate efficient use of multiple frequency bands
353 # available to the AP and the devices that may associate with it.
354 #CONFIG_MBO=y
355
356 # Client Taxonomy
357 # Has the AP retain the Probe Request and (Re)Association Request frames from
358 # a client, from which a signature can be produced which can identify the model
359 # of client device like "Nexus 6P" or "iPhone 5s".
360 CONFIG_TAXONOMY=y
361
362 # Fast Initial Link Setup (FILS) (IEEE 802.11ai)
363 # Note: This is an experimental and not yet complete implementation. This
364 # should not be enabled for production use.
365 #CONFIG_FILS=y
366 # FILS shared key authentication with PFS
367 #CONFIG_FILS_SK_PFS=y
368
369 # Include internal line edit mode in hostapd_cli. This can be used to provide
370 # limited command line editing and history support.
371 #CONFIG_WPA_CLI_EDIT=y
372
373 # Opportunistic Wireless Encryption (OWE)
374 # Experimental implementation of draft-harkins-owe-07.txt
375 #CONFIG_OWE=y
376
377 # uBus IPC/RPC System
378 # Services can connect to the bus and provide methods
379 # that can be called by other services or clients.
380 CONFIG_UBUS=y