blob: bf6e646639b4b37b5297cd1bc4013bcb2f0ee895 [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001# Example hostapd build time configuration
2#
3# This file lists the configuration options that are used when building the
4# hostapd binary. All lines starting with # are ignored. Configuration option
5# lines must be commented out complete, if they are not to be included, i.e.,
6# just setting VARIABLE=n is not disabling that variable.
7#
8# This file is included in Makefile, so variables like CFLAGS and LIBS can also
9# be modified from here. In most cass, these lines should use += in order not
10# to override previous values of the variables.
11
12# Driver interface for Host AP driver
13CONFIG_DRIVER_HOSTAP=y
14
15# Driver interface for wired authenticator
16#CONFIG_DRIVER_WIRED=y
17
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070018# Driver interface for drivers using the nl80211 kernel interface
Jouni Malinen87fd2792011-05-16 18:35:42 +030019CONFIG_DRIVER_NL80211=y
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070020
Dmitry Shmidtd80a4012015-11-05 16:35:40 -080021# QCA vendor extensions to nl80211
22#CONFIG_DRIVER_NL80211_QCA=y
23
Dmitry Shmidt344abd32014-01-14 13:17:00 -080024# driver_nl80211.c requires libnl. If you are compiling it yourself
25# you may need to point hostapd to your version of libnl.
26#
27#CFLAGS += -I$<path to libnl include files>
28#LIBS += -L$<path to libnl library files>
29
30# Use libnl v2.0 (or 3.0) libraries.
31#CONFIG_LIBNL20=y
32
33# Use libnl 3.2 libraries (if this is selected, CONFIG_LIBNL20 is ignored)
34#CONFIG_LIBNL32=y
35
36
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070037# Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
38#CONFIG_DRIVER_BSD=y
39#CFLAGS += -I/usr/local/include
40#LIBS += -L/usr/local/lib
41#LIBS_p += -L/usr/local/lib
42#LIBS_c += -L/usr/local/lib
43
44# Driver interface for no driver (e.g., RADIUS server only)
45#CONFIG_DRIVER_NONE=y
46
47# IEEE 802.11F/IAPP
48CONFIG_IAPP=y
49
50# WPA2/IEEE 802.11i RSN pre-authentication
51CONFIG_RSN_PREAUTH=y
52
53# PeerKey handshake for Station to Station Link (IEEE 802.11e DLS)
54CONFIG_PEERKEY=y
55
56# IEEE 802.11w (management frame protection)
Dmitry Shmidtbd14a572014-02-18 10:33:49 -080057CONFIG_IEEE80211W=y
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070058
59# Integrated EAP server
60CONFIG_EAP=y
61
Dmitry Shmidtfb45fd52015-01-05 13:08:17 -080062# EAP Re-authentication Protocol (ERP) in integrated EAP server
63CONFIG_ERP=y
64
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070065# EAP-MD5 for the integrated EAP server
66CONFIG_EAP_MD5=y
67
68# EAP-TLS for the integrated EAP server
69CONFIG_EAP_TLS=y
70
71# EAP-MSCHAPv2 for the integrated EAP server
72CONFIG_EAP_MSCHAPV2=y
73
74# EAP-PEAP for the integrated EAP server
75CONFIG_EAP_PEAP=y
76
77# EAP-GTC for the integrated EAP server
78CONFIG_EAP_GTC=y
79
80# EAP-TTLS for the integrated EAP server
81CONFIG_EAP_TTLS=y
82
83# EAP-SIM for the integrated EAP server
84#CONFIG_EAP_SIM=y
85
86# EAP-AKA for the integrated EAP server
87#CONFIG_EAP_AKA=y
88
89# EAP-AKA' for the integrated EAP server
90# This requires CONFIG_EAP_AKA to be enabled, too.
91#CONFIG_EAP_AKA_PRIME=y
92
93# EAP-PAX for the integrated EAP server
94#CONFIG_EAP_PAX=y
95
96# EAP-PSK for the integrated EAP server (this is _not_ needed for WPA-PSK)
97#CONFIG_EAP_PSK=y
98
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -080099# EAP-pwd for the integrated EAP server (secure authentication with a password)
100#CONFIG_EAP_PWD=y
101
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700102# EAP-SAKE for the integrated EAP server
103#CONFIG_EAP_SAKE=y
104
105# EAP-GPSK for the integrated EAP server
106#CONFIG_EAP_GPSK=y
107# Include support for optional SHA256 cipher suite in EAP-GPSK
108#CONFIG_EAP_GPSK_SHA256=y
109
110# EAP-FAST for the integrated EAP server
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800111# Note: If OpenSSL is used as the TLS library, OpenSSL 1.0 or newer is needed
112# for EAP-FAST support. Older OpenSSL releases would need to be patched, e.g.,
113# with openssl-0.9.8x-tls-extensions.patch, to add the needed functions.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700114#CONFIG_EAP_FAST=y
115
116# Wi-Fi Protected Setup (WPS)
117#CONFIG_WPS=y
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700118# Enable UPnP support for external WPS Registrars
119#CONFIG_WPS_UPNP=y
Dmitry Shmidt04949592012-07-19 12:16:46 -0700120# Enable WPS support with NFC config method
121#CONFIG_WPS_NFC=y
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700122
123# EAP-IKEv2
124#CONFIG_EAP_IKEV2=y
125
126# Trusted Network Connect (EAP-TNC)
127#CONFIG_EAP_TNC=y
128
Dmitry Shmidt34af3062013-07-11 10:46:32 -0700129# EAP-EKE for the integrated EAP server
130#CONFIG_EAP_EKE=y
131
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700132# PKCS#12 (PFX) support (used to read private key and certificate file from
133# a file that usually has extension .p12 or .pfx)
134CONFIG_PKCS12=y
135
136# RADIUS authentication server. This provides access to the integrated EAP
137# server from external hosts using RADIUS.
138#CONFIG_RADIUS_SERVER=y
139
140# Build IPv6 support for RADIUS operations
141CONFIG_IPV6=y
142
143# IEEE Std 802.11r-2008 (Fast BSS Transition)
144#CONFIG_IEEE80211R=y
145
146# Use the hostapd's IEEE 802.11 authentication (ACL), but without
Dmitry Shmidtfb45fd52015-01-05 13:08:17 -0800147# the IEEE 802.11 Management capability (e.g., FreeBSD/net80211)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700148#CONFIG_DRIVER_RADIUS_ACL=y
149
150# IEEE 802.11n (High Throughput) support
151#CONFIG_IEEE80211N=y
152
Dmitry Shmidt04949592012-07-19 12:16:46 -0700153# Wireless Network Management (IEEE Std 802.11v-2011)
154# Note: This is experimental and not complete implementation.
155#CONFIG_WNM=y
156
157# IEEE 802.11ac (Very High Throughput) support
158#CONFIG_IEEE80211AC=y
159
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700160# Remove debugging code that is printing out debug messages to stdout.
161# This can be used to reduce the size of the hostapd considerably if debugging
162# code is not needed.
163#CONFIG_NO_STDOUT_DEBUG=y
164
165# Add support for writing debug log to a file: -f /tmp/hostapd.log
166# Disabled by default.
167#CONFIG_DEBUG_FILE=y
168
Paul Stewart092955c2017-02-06 09:13:09 -0800169# Send debug messages to syslog instead of stdout
170#CONFIG_DEBUG_SYSLOG=y
171
Dmitry Shmidtcce06662013-11-04 18:44:24 -0800172# Add support for sending all debug messages (regardless of debug verbosity)
173# to the Linux kernel tracing facility. This helps debug the entire stack by
174# making it easy to record everything happening from the driver up into the
175# same file, e.g., using trace-cmd.
176#CONFIG_DEBUG_LINUX_TRACING=y
177
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700178# Remove support for RADIUS accounting
179#CONFIG_NO_ACCOUNTING=y
180
181# Remove support for RADIUS
182#CONFIG_NO_RADIUS=y
183
184# Remove support for VLANs
185#CONFIG_NO_VLAN=y
186
187# Enable support for fully dynamic VLANs. This enables hostapd to
188# automatically create bridge and VLAN interfaces if necessary.
189#CONFIG_FULL_DYNAMIC_VLAN=y
190
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700191# Use netlink-based kernel API for VLAN operations instead of ioctl()
192# Note: This requires libnl 3.1 or newer.
193#CONFIG_VLAN_NETLINK=y
194
Dmitry Shmidtfb79edc2014-01-10 10:45:54 -0800195# Remove support for dumping internal state through control interface commands
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700196# This can be used to reduce binary size at the cost of disabling a debugging
197# option.
198#CONFIG_NO_DUMP_STATE=y
199
200# Enable tracing code for developer debugging
201# This tracks use of memory allocations and other registrations and reports
202# incorrect use with a backtrace of call (or allocation) location.
203#CONFIG_WPA_TRACE=y
204# For BSD, comment out these.
205#LIBS += -lexecinfo
206#LIBS_p += -lexecinfo
207#LIBS_c += -lexecinfo
208
209# Use libbfd to get more details for developer debugging
210# This enables use of libbfd to get more detailed symbols for the backtraces
211# generated by CONFIG_WPA_TRACE=y.
212#CONFIG_WPA_TRACE_BFD=y
213# For BSD, comment out these.
214#LIBS += -lbfd -liberty -lz
215#LIBS_p += -lbfd -liberty -lz
216#LIBS_c += -lbfd -liberty -lz
217
218# hostapd depends on strong random number generation being available from the
219# operating system. os_get_random() function is used to fetch random data when
220# needed, e.g., for key generation. On Linux and BSD systems, this works by
221# reading /dev/urandom. It should be noted that the OS entropy pool needs to be
222# properly initialized before hostapd is started. This is important especially
223# on embedded devices that do not have a hardware random number generator and
224# may by default start up with minimal entropy available for random number
225# generation.
226#
227# As a safety net, hostapd is by default trying to internally collect
228# additional entropy for generating random data to mix in with the data
229# fetched from the OS. This by itself is not considered to be very strong, but
230# it may help in cases where the system pool is not initialized properly.
231# However, it is very strongly recommended that the system pool is initialized
232# with enough entropy either by using hardware assisted random number
Jouni Malinen75ecf522011-06-27 15:19:46 -0700233# generator or by storing state over device reboots.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700234#
Jouni Malinen75ecf522011-06-27 15:19:46 -0700235# hostapd can be configured to maintain its own entropy store over restarts to
236# enhance random number generation. This is not perfect, but it is much more
237# secure than using the same sequence of random numbers after every reboot.
238# This can be enabled with -e<entropy file> command line option. The specified
239# file needs to be readable and writable by hostapd.
240#
241# If the os_get_random() is known to provide strong random data (e.g., on
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700242# Linux/BSD, the board in question is known to have reliable source of random
243# data from /dev/urandom), the internal hostapd random pool can be disabled.
244# This will save some in binary size and CPU use. However, this should only be
245# considered for builds that are known to be used on devices that meet the
246# requirements described above.
247#CONFIG_NO_RANDOM_POOL=y
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800248
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800249# Should we use poll instead of select? Select is used by default.
250#CONFIG_ELOOP_POLL=y
251
252# Should we use epoll instead of select? Select is used by default.
253#CONFIG_ELOOP_EPOLL=y
254
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800255# Should we use kqueue instead of select? Select is used by default.
256#CONFIG_ELOOP_KQUEUE=y
257
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800258# Select TLS implementation
259# openssl = OpenSSL (default)
260# gnutls = GnuTLS
261# internal = Internal TLSv1 implementation (experimental)
262# none = Empty template
263#CONFIG_TLS=openssl
264
265# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.1)
266# can be enabled to get a stronger construction of messages when block ciphers
267# are used.
268#CONFIG_TLSV11=y
269
270# TLS-based EAP methods require at least TLS v1.0. Newer version of TLS (v1.2)
271# can be enabled to enable use of stronger crypto algorithms.
272#CONFIG_TLSV12=y
273
274# If CONFIG_TLS=internal is used, additional library and include paths are
275# needed for LibTomMath. Alternatively, an integrated, minimal version of
276# LibTomMath can be used. See beginning of libtommath.c for details on benefits
277# and drawbacks of this option.
278#CONFIG_INTERNAL_LIBTOMMATH=y
279#ifndef CONFIG_INTERNAL_LIBTOMMATH
280#LTM_PATH=/usr/src/libtommath-0.39
281#CFLAGS += -I$(LTM_PATH)
282#LIBS += -L$(LTM_PATH)
283#LIBS_p += -L$(LTM_PATH)
284#endif
285# At the cost of about 4 kB of additional binary size, the internal LibTomMath
286# can be configured to include faster routines for exptmod, sqr, and div to
287# speed up DH and RSA calculation considerably
288#CONFIG_INTERNAL_LIBTOMMATH_FAST=y
289
290# Interworking (IEEE 802.11u)
291# This can be used to enable functionality to improve interworking with
292# external networks.
293#CONFIG_INTERWORKING=y
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700294
295# Hotspot 2.0
296#CONFIG_HS20=y
297
Dmitry Shmidtd5e49232012-12-03 15:08:10 -0800298# Enable SQLite database support in hlr_auc_gw, EAP-SIM DB, and eap_user_file
Dmitry Shmidt61d9df32012-08-29 16:22:06 -0700299#CONFIG_SQLITE=y
Dmitry Shmidt8da800a2013-04-24 12:57:01 -0700300
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800301# Enable Fast Session Transfer (FST)
302#CONFIG_FST=y
303
304# Enable CLI commands for FST testing
305#CONFIG_FST_TEST=y
306
Dmitry Shmidt8da800a2013-04-24 12:57:01 -0700307# Testing options
308# This can be used to enable some testing options (see also the example
309# configuration file) that are really useful only for testing clients that
310# connect to this hostapd. These options allow, for example, to drop a
311# certain percentage of probe requests or auth/(re)assoc frames.
312#
313#CONFIG_TESTING_OPTIONS=y
Dmitry Shmidt391c59f2013-09-03 12:16:28 -0700314
315# Automatic Channel Selection
316# This will allow hostapd to pick the channel automatically when channel is set
317# to "acs_survey" or "0". Eventually, other ACS algorithms can be added in
318# similar way.
319#
320# Automatic selection is currently only done through initialization, later on
321# we hope to do background checks to keep us moving to more ideal channels as
322# time goes by. ACS is currently only supported through the nl80211 driver and
323# your driver must have survey dump capability that is filled by the driver
324# during scanning.
325#
326# You can customize the ACS survey algorithm with the hostapd.conf variable
327# acs_num_scans.
328#
329# Supported ACS drivers:
330# * ath9k
331# * ath5k
332# * ath10k
333#
334# For more details refer to:
335# http://wireless.kernel.org/en/users/Documentation/acs
336#
337#CONFIG_ACS=y
Dmitry Shmidt57c2d392016-02-23 13:40:19 -0800338
339# Multiband Operation support
340# These extentions facilitate efficient use of multiple frequency bands
341# available to the AP and the devices that may associate with it.
342#CONFIG_MBO=y
Dmitry Shmidtaca489e2016-09-28 15:44:14 -0700343
344# Client Taxonomy
345# Has the AP retain the Probe Request and (Re)Association Request frames from
346# a client, from which a signature can be produced which can identify the model
347# of client device like "Nexus 6P" or "iPhone 5s".
348#CONFIG_TAXONOMY=y
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -0800349
350# Fast Initial Link Setup (FILS) (IEEE 802.11ai)
351# Note: This is an experimental and not yet complete implementation. This
352# should not be enabled for production use.
353#CONFIG_FILS=y
354
355# Include internal line edit mode in hostapd_cli. This can be used to provide
356# limited command line editing and history support.
357#CONFIG_WPA_CLI_EDIT=y