wpa_supplicant: Basic support for PBSS/PCP

[mech_eap.git] / wpa_supplicant / wpa_supplicant.conf

diff --git a/wpa_supplicant/wpa_supplicant.conf b/wpa_supplicant/wpa_supplicant.conf
index 2ce1cc4..478cb82 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.conf
+++ b/wpa_supplicant/wpa_supplicant.conf
@@ -586,6 +586,8 @@ fast_reauth=1
 #      0 = do not use OCSP stapling (TLS certificate status extension)
 #      1 = try to use OCSP stapling, but not require response
 #      2 = require valid OCSP stapling response
+#      3 = require valid OCSP stapling response for all not-trusted
+#          certificates in the server certificate chain
 #
 # sim_num: Identifier for which SIM to use in multi-SIM devices
 #
@@ -700,6 +702,13 @@ fast_reauth=1
 # an IBSS network with the configured SSID is already present, the frequency of
 # the network will be used instead of this configured value.
 #
+# pbss: Whether to use PBSS. Relevant to IEEE 802.11ad networks only.
+# Used together with mode configuration. When mode is AP, it means to start a
+# PCP instead of a regular AP. When mode is infrastructure it means connect
+# to a PCP instead of AP. P2P_GO and P2P_GROUP_FORMATION modes must use PBSS
+# in IEEE 802.11ad network.
+# For more details, see IEEE Std 802.11ad-2012.
+#
 # scan_freq: List of frequencies to scan
 # Space-separated list of frequencies in MHz to scan when searching for this
 # BSS. If the subset of channels used by the network is known, this option can
@@ -748,8 +757,19 @@ fast_reauth=1
 # IEEE8021X = IEEE 802.1X using EAP authentication and (optionally) dynamically
 #      generated WEP keys
 # NONE = WPA is not used; plaintext or static WEP could be used
+# WPA-NONE = WPA-None for IBSS (deprecated; use proto=RSN key_mgmt=WPA-PSK
+#      instead)
+# FT-PSK = Fast BSS Transition (IEEE 802.11r) with pre-shared key
+# FT-EAP = Fast BSS Transition (IEEE 802.11r) with EAP authentication
 # WPA-PSK-SHA256 = Like WPA-PSK but using stronger SHA256-based algorithms
 # WPA-EAP-SHA256 = Like WPA-EAP but using stronger SHA256-based algorithms
+# SAE = Simultaneous authentication of equals; pre-shared key/password -based
+#      authentication with stronger security than WPA-PSK especially when using
+#      not that strong password
+# FT-SAE = SAE with FT
+# WPA-EAP-SUITE-B = Suite B 128-bit level
+# WPA-EAP-SUITE-B-192 = Suite B 192-bit level
+# OSEN = Hotspot 2.0 Rel 2 online signup connection
 # If not set, this defaults to: WPA-PSK WPA-EAP
 #
 # ieee80211w: whether management frame protection is enabled
@@ -1037,6 +1057,12 @@ fast_reauth=1
 #      that have issues interoperating with updated TLS version)
 # tls_disable_tlsv1_2=1 - disable use of TLSv1.2 (a workaround for AAA servers
 #      that have issues interoperating with updated TLS version)
+# tls_ext_cert_check=0 - No external server certificate validation (default)
+# tls_ext_cert_check=1 - External server certificate validation enabled; this
+#      requires an external program doing validation of server certificate
+#      chain when receiving CTRL-RSP-EXT_CERT_CHECK event from the control
+#      interface and report the result of the validation with
+#      CTRL-RSP_EXT_CERT_CHECK.
 #
 # Following certificate/private key fields are used in inner Phase2
 # authentication when using EAP-TTLS or EAP-PEAP.
@@ -1068,6 +1094,8 @@ fast_reauth=1
 #      0 = do not use OCSP stapling (TLS certificate status extension)
 #      1 = try to use OCSP stapling, but not require response
 #      2 = require valid OCSP stapling response
+#      3 = require valid OCSP stapling response for all not-trusted
+#          certificates in the server certificate chain
 #
 # openssl_ciphers: OpenSSL specific cipher configuration
 #      This can be used to override the global openssl_ciphers configuration
@@ -1101,6 +1129,9 @@ fast_reauth=1
 # number of authentication servers. Strict EAP conformance mode can be
 # configured by disabling workarounds with eap_workaround=0.
 
+# update_identifier: PPS MO ID
+#      (Hotspot 2.0 PerProviderSubscription/UpdateIdentifier)
+
 # Station inactivity limit
 #
 # If a station does not send anything in ap_max_inactivity seconds, an