adafruit-mirror/zephyr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 9

net: wifi: shell: add enterprise support for station

Browse source 
Add EAP-TLS, EAP-PEAP-MSCHAPv2, EAP-PEAP-GTC, EAP-TTLS-MSCHAPv2,
EAP-PEAP-TLS, EAP-TLS-SHA256  enterprise wpa2 and wpa3 suiteb
support for station.

Signed-off-by: Rex Chen <rex.chen_1@nxp.com>
This commit is contained in:
Rex Chen 2024-09-24 17:15:56 +09:00 committed by Carles Cufí
parent 7dbcf65562
commit be151908d8
10 changed files with 488 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
doc/connectivity/networking/api/wifi.rst
View file

@ -38,6 +38,9 @@ module.
$ cp client.pem samples/net/wifi/test_certs/
$ cp client-key.pem samples/net/wifi/test_certs/
$ cp ca.pem samples/net/wifi/test_certs/
$ cp client2.pem samples/net/wifi/test_certs/
$ cp client-key2.pem samples/net/wifi/test_certs/
$ cp ca2.pem samples/net/wifi/test_certs/
$ west build -p -b <board> samples/net/wifi -- -DEXTRA_CONF_FILE=overlay-enterprise.conf
For using variable size network buffer, the following overlay file can be used:
@ -52,15 +55,11 @@ To initiate Wi-Fi connection, the following command can be used:
.. code-block:: console
uart:~$ wifi connect -s <SSID> -k 7 -a anon -K whatever
uart:~$ wifi connect -s <SSID> -c 149 -k 17 -w 2 -a client1 --key1-pwd whatever --key2-pwd whatever --eap-id1 id1 --eap-pwd1 pwd1
Server certificate is also provided in the same directory for testing purposes.
Any AAA server can be used for testing purposes, for example, ``FreeRADIUS`` or ``hostapd``.
.. important::
The passphrase for the :file:`client-key.pem`` and the :file:`server-key.pem` is ``whatever``.
.. note::
The certificates are for testing purposes only and should not be used in production.

95
include/zephyr/net/wifi.h
View file

@ -68,6 +68,16 @@ enum wifi_security_type {
WIFI_SECURITY_TYPE_WPA_AUTO_PERSONAL,
/** DPP security */
WIFI_SECURITY_TYPE_DPP,
/** EAP PEAP MSCHAPV2 security - Enterprise. */
WIFI_SECURITY_TYPE_EAP_PEAP_MSCHAPV2,
/** EAP PEAP GTC security - Enterprise. */
WIFI_SECURITY_TYPE_EAP_PEAP_GTC,
/** EAP TTLS MSCHAPV2 security - Enterprise. */
WIFI_SECURITY_TYPE_EAP_TTLS_MSCHAPV2,
/** EAP PEAP security - Enterprise. */
WIFI_SECURITY_TYPE_EAP_PEAP_TLS,
/** EAP TLS SHA256 security - Enterprise. */
WIFI_SECURITY_TYPE_EAP_TLS_SHA256,
/** @cond INTERNAL_HIDDEN */
__WIFI_SECURITY_TYPE_AFTER_LAST,
@ -76,6 +86,91 @@ enum wifi_security_type {
/** @endcond */
};
/** @brief EPA method Types. */
enum wifi_eap_type {
/** No EPA security. */
WIFI_EAP_TYPE_NONE = 0,
/** EPA GTC security, refer to rfc3748 chapter 5. */
WIFI_EAP_TYPE_GTC = 6,
/** EPA TLS security, refer to rfc5216. */
WIFI_EAP_TYPE_TLS = 13,
/** EPA TTLS security, refer to rfc5281. */
WIFI_EAP_TYPE_TTLS = 21,
/** EPA PEAP security, refer to draft-josefsson-pppext-eap-tls-eap-06.txt. */
WIFI_EAP_TYPE_PEAP = 25,
/** EPA MSCHAPV2 security, refer to draft-kamath-pppext-eap-mschapv2-00.txt. */
WIFI_EAP_TYPE_MSCHAPV2 = 26,
};
/** @brief Enterprise security WPA3 suiteb types. */
enum wifi_suiteb_type {
/** suiteb. */
WIFI_SUITEB = 1,
/** suiteb-192. */
WIFI_SUITEB_192,
};
/** @brief Group cipher and pairwise cipher types. */
enum wifi_cipher_type {
/** AES in counter mode with CBC-MAC (CCMP-128). */
WPA_CAPA_ENC_CCMP,
/** 128-bit Galois/Counter Mode Protocol. */
WPA_CAPA_ENC_GCMP,
/** 256-bit Galois/Counter Mode Protocol. */
WPA_CAPA_ENC_GCMP_256,
};
/** @brief group mgmt cipher types. */
enum wifi_group_mgmt_cipher_type {
/** 128-bit Broadcast/Multicast Integrity Protocol
* Cipher-based Message Authentication Code .
*/
WPA_CAPA_ENC_BIP,
/** 128-bit Broadcast/Multicast Integrity Protocol
* Galois Message Authentication Code .
*/
WPA_CAPA_ENC_BIP_GMAC_128,
/** 256-bit Broadcast/Multicast Integrity Protocol
* Galois Message Authentication Code .
*/
WPA_CAPA_ENC_BIP_GMAC_256,
};
struct wifi_cipher_desc {
/** Cipher capability. */
unsigned int capa;
/** Cipher name string. */
char *name;
};
struct wifi_eap_cipher_config {
/** Key management type string. */
char *key_mgmt;
/** OpenSSL cipher string. */
char *openssl_ciphers;
/** Group cipher cipher string. */
char *group_cipher;
/** Pairwise_cipher cipher string. */
char *pairwise_cipher;
/** Group management cipher string. */
char *group_mgmt_cipher;
/** Used to confiure TLS features. */
char *tls_flags;
};
struct wifi_eap_config {
/** Security type. */
unsigned int type;
/** EPA method type of phase1. */
enum wifi_eap_type eap_type_phase1;
/** EPA method type of phase2. */
enum wifi_eap_type eap_type_phase2;
/** EPA method string. */
char *method;
/** Phase2 setting string. */
char *phase2;
};
/** Helper function to get user-friendly security type name. */
const char *wifi_security_txt(enum wifi_security_type security);

36
include/zephyr/net/wifi_mgmt.h
View file

@ -466,12 +466,28 @@ struct wifi_connect_req_params {
int timeout;
/** anonymous identity */
const uint8_t *anon_id;
/** anon_id length */
uint8_t aid_length; /* Max 64 */
/** anon_id length, max 64 */
uint8_t aid_length;
/** Private key passwd for enterprise mode */
const uint8_t *key_passwd;
/** Private key passwd length */
uint8_t key_passwd_length; /* Max 128 */
/** Private key passwd length, max 128 */
uint8_t key_passwd_length;
/** private key2 passwd */
const uint8_t *key2_passwd;
/** key2 passwd length, max 128 */
uint8_t key2_passwd_length;
/** suiteb or suiteb-192 */
uint8_t suiteb_type;
/** eap version */
uint8_t eap_ver;
/** Identity for EAP */
const uint8_t *eap_identity;
/** eap identity length, max 64 */
uint8_t eap_id_length;
/** Password string for EAP. */
const uint8_t *eap_password;
/** eap passwd length, max 128 */
uint8_t eap_passwd_length;
};
/** @brief Wi-Fi connect result codes. To be overlaid on top of \ref wifi_status
@ -711,6 +727,18 @@ struct wifi_enterprise_creds_params {
uint8_t *client_key;
/** Client key length */
uint32_t client_key_len;
/** CA certification of phase2*/
uint8_t *ca_cert2;
/** Phase2 CA certification length */
uint32_t ca_cert2_len;
/** Client certification of phase2*/
uint8_t *client_cert2;
/** Phase2 Client certification length */
uint32_t client_cert2_len;
/** Client key of phase2*/
uint8_t *client_key2;
/** Phase2 Client key length */
uint32_t client_key2_len;
};
/** @brief Wi-Fi power save configuration */

9
modules/hostap/CMakeLists.txt
View file

@ -46,6 +46,7 @@ zephyr_library_compile_definitions(
CONFIG_SHA512
CONFIG_CTRL_IFACE_ZEPHYR
CONFIG_SUITEB192
CONFIG_SUITEB
)
@ -366,6 +367,14 @@ zephyr_library_compile_definitions_ifdef(CONFIG_EAP_MD5
EAP_MD5
)
zephyr_library_sources_ifdef(CONFIG_EAP_GTC
${HOSTAP_SRC_BASE}/eap_peer/eap_gtc.c
)
zephyr_library_compile_definitions_ifdef(CONFIG_EAP_GTC
EAP_GTC
)
zephyr_library_sources_ifdef(CONFIG_EAP_MSCHAPV2
${HOSTAP_SRC_BASE}/eap_peer/eap_mschapv2.c
${HOSTAP_SRC_BASE}/eap_peer/mschapv2.c

6
modules/hostap/Kconfig
View file

@ -190,6 +190,9 @@ config EAP_PEAP
config EAP_MD5
bool "EAP-MD5 support"
config EAP_GTC
bool "EAP-GTC support"
config EAP_MSCHAPV2
bool "EAP-MSCHAPv2 support"
@ -466,6 +469,9 @@ config SHA512
config SUITEB192
bool
config SUITEB
bool
config WEP
bool
default y if WIFI_NM_WPA_SUPPLICANT_WEP

221
modules/hostap/src/supp_api.c
View file

@ -438,6 +438,100 @@ static int wpas_config_process_blob(struct wpa_config *config, char *name, uint8
return 0;
}
static const struct wifi_cipher_desc ciphers[] = {
{WPA_CAPA_ENC_GCMP_256, "GCMP-256"},
{WPA_CAPA_ENC_CCMP, "CCMP"},
{WPA_CAPA_ENC_GCMP, "GCMP"},
};
static const struct wifi_cipher_desc ciphers_group_mgmt[] = {
{WPA_CAPA_ENC_BIP, "AES-128-CMAC"},
{WPA_CAPA_ENC_BIP_GMAC_128, "BIP-GMAC-128"},
{WPA_CAPA_ENC_BIP_GMAC_256, "BIP-GMAC-256"},
};
static struct wifi_eap_config eap_config[] = {
{WIFI_SECURITY_TYPE_EAP_TLS, WIFI_EAP_TYPE_TLS, WIFI_EAP_TYPE_NONE, "TLS", NULL},
{WIFI_SECURITY_TYPE_EAP_PEAP_MSCHAPV2, WIFI_EAP_TYPE_PEAP, WIFI_EAP_TYPE_MSCHAPV2, "PEAP",
"auth=MSCHAPV2"},
{WIFI_SECURITY_TYPE_EAP_PEAP_GTC, WIFI_EAP_TYPE_PEAP, WIFI_EAP_TYPE_GTC, "PEAP",
"auth=GTC"},
{WIFI_SECURITY_TYPE_EAP_TTLS_MSCHAPV2, WIFI_EAP_TYPE_TTLS, WIFI_EAP_TYPE_NONE, "TTLS",
"auth=MSCHAPV2"},
{WIFI_SECURITY_TYPE_EAP_PEAP_TLS, WIFI_EAP_TYPE_PEAP, WIFI_EAP_TYPE_TLS, "PEAP",
"auth=TLS"},
{WIFI_SECURITY_TYPE_EAP_TLS_SHA256, WIFI_EAP_TYPE_TLS, WIFI_EAP_TYPE_NONE, "TLS", NULL},
};
int process_cipher_config(struct wifi_connect_req_params *params,
struct wifi_eap_cipher_config *cipher_config)
{
unsigned int cipher_capa;
unsigned int gropu_mgmt_cipher_capa;
unsigned int index;
if (params->suiteb_type == WIFI_SUITEB) {
cipher_capa = WPA_CAPA_ENC_GCMP;
gropu_mgmt_cipher_capa = WPA_CAPA_ENC_BIP_GMAC_128;
cipher_config->key_mgmt = "WPA-EAP-SUITE-B";
cipher_config->openssl_ciphers = "SUITEB128";
cipher_config->tls_flags = "[SUITEB]";
} else if (params->suiteb_type == WIFI_SUITEB_192) {
cipher_capa = WPA_CAPA_ENC_GCMP_256;
gropu_mgmt_cipher_capa = WPA_CAPA_ENC_BIP_GMAC_256;
cipher_config->key_mgmt = "WPA-EAP-SUITE-B-192";
cipher_config->openssl_ciphers = "SUITEB192";
cipher_config->tls_flags = "[SUITEB]";
} else {
cipher_capa = WPA_CAPA_ENC_CCMP;
gropu_mgmt_cipher_capa = WPA_CAPA_ENC_BIP;
cipher_config->key_mgmt = "WPA-EAP";
}
if (params->security == WIFI_SECURITY_TYPE_EAP_TLS_SHA256) {
cipher_config->key_mgmt = "WPA-EAP-SHA256";
}
for (index = 0; index < ARRAY_SIZE(ciphers); index++) {
if (cipher_capa == ciphers[index].capa) {
cipher_config->group_cipher = ciphers[index].name;
cipher_config->pairwise_cipher = ciphers[index].name;
break;
}
}
if (index == ARRAY_SIZE(ciphers)) {
wpa_printf(MSG_ERROR, "Get ciphers error");
goto out;
}
for (index = 0; index < ARRAY_SIZE(ciphers_group_mgmt); index++) {
if (gropu_mgmt_cipher_capa == ciphers_group_mgmt[index].capa) {
cipher_config->group_mgmt_cipher = ciphers_group_mgmt[index].name;
break;
}
}
if (index == ARRAY_SIZE(ciphers_group_mgmt)) {
wpa_printf(MSG_ERROR, "Get group mgmt ciphers error");
goto out;
}
return 0;
out:
return -EINVAL;
}
static int is_eap_valid_security(int security)
{
return (security == WIFI_SECURITY_TYPE_EAP_TLS ||
security == WIFI_SECURITY_TYPE_EAP_PEAP_MSCHAPV2 ||
security == WIFI_SECURITY_TYPE_EAP_PEAP_GTC ||
security == WIFI_SECURITY_TYPE_EAP_TTLS_MSCHAPV2 ||
security == WIFI_SECURITY_TYPE_EAP_PEAP_TLS ||
security == WIFI_SECURITY_TYPE_EAP_TLS_SHA256);
}
#endif
static int wpas_add_and_config_network(struct wpa_supplicant *wpa_s,
@ -451,6 +545,14 @@ static int wpas_add_and_config_network(struct wpa_supplicant *wpa_s,
uint8_t ssid_null_terminated[WIFI_SSID_MAX_LEN + 1];
uint8_t psk_null_terminated[WIFI_PSK_MAX_LEN + 1];
uint8_t sae_null_terminated[WIFI_SAE_PSWD_MAX_LEN + 1];
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
struct wifi_eap_cipher_config cipher_config = {NULL, "DEFAULT:!EXP:!LOW", "CCMP",
"CCMP", "AES-128-CMAC", NULL};
char *method;
char phase1[128] = {0};
char *phase2 = NULL;
unsigned int index;
#endif
if (!wpa_cli_cmd_v("remove_network all")) {
goto out;
@ -634,9 +736,47 @@ static int wpas_add_and_config_network(struct wpa_supplicant *wpa_s,
goto out;
}
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
} else if (params->security == WIFI_SECURITY_TYPE_EAP_TLS) {
if (!wpa_cli_cmd_v("set_network %d key_mgmt WPA-EAP",
resp.network_id)) {
} else if (is_eap_valid_security(params->security)) {
if (process_cipher_config(params, &cipher_config)) {
goto out;
}
for (index = 0; index < ARRAY_SIZE(eap_config); index++) {
if (params->security == eap_config[index].type) {
method = eap_config[index].method;
phase2 = eap_config[index].phase2;
break;
}
}
if (index == ARRAY_SIZE(eap_config)) {
wpa_printf(MSG_ERROR, "Get eap method error with security type: %d",
params->security);
goto out;
}
if (!wpa_cli_cmd_v("set_network %d key_mgmt %s", resp.network_id,
cipher_config.key_mgmt)) {
goto out;
}
if (!wpa_cli_cmd_v("set openssl_ciphers \"%s\"",
cipher_config.openssl_ciphers)) {
goto out;
}
if (!wpa_cli_cmd_v("set_network %d group %s", resp.network_id,
cipher_config.group_cipher)) {
goto out;
}
if (!wpa_cli_cmd_v("set_network %d pairwise %s", resp.network_id,
cipher_config.pairwise_cipher)) {
goto out;
}
if (!wpa_cli_cmd_v("set_network %d group_mgmt %s", resp.network_id,
cipher_config.group_mgmt_cipher)) {
goto out;
}
@ -645,11 +785,44 @@ static int wpas_add_and_config_network(struct wpa_supplicant *wpa_s,
goto out;
}
if (!wpa_cli_cmd_v("set_network %d eap TLS",
resp.network_id)) {
if (!wpa_cli_cmd_v("set_network %d eap %s", resp.network_id, method)) {
goto out;
}
if (params->security == WIFI_SECURITY_TYPE_EAP_PEAP_MSCHAPV2 ||
params->security == WIFI_SECURITY_TYPE_EAP_PEAP_GTC ||
params->security == WIFI_SECURITY_TYPE_EAP_PEAP_TLS) {
snprintk(phase1, sizeof(phase1),
"peapver=%d peaplabel=0 crypto_binding=0",
params->eap_ver);
if (!wpa_cli_cmd_v("set_network %d phase1 \"%s\"", resp.network_id,
&phase1[0])) {
goto out;
}
}
if (phase2 != NULL) {
if (!wpa_cli_cmd_v("set_network %d phase2 \"%s\"", resp.network_id,
phase2)) {
goto out;
}
}
if (params->eap_id_length > 0) {
if (!wpa_cli_cmd_v("set_network %d identity \"%s\"",
resp.network_id, params->eap_identity)) {
goto out;
}
}
if (params->eap_passwd_length > 0) {
if (!wpa_cli_cmd_v("set_network %d password \"%s\"",
resp.network_id, params->eap_password)) {
goto out;
}
}
if (!wpa_cli_cmd_v("set_network %d anonymous_identity \"%s\"",
resp.network_id, params->anon_id)) {
goto out;
@ -692,6 +865,44 @@ static int wpas_add_and_config_network(struct wpa_supplicant *wpa_s,
resp.network_id, params->key_passwd)) {
goto out;
}
if (wpas_config_process_blob(wpa_s->conf, "ca_cert2",
enterprise_creds.ca_cert2,
enterprise_creds.ca_cert2_len)) {
goto out;
}
if (!wpa_cli_cmd_v("set_network %d ca_cert2 \"blob://ca_cert2\"",
resp.network_id)) {
goto out;
}
if (wpas_config_process_blob(wpa_s->conf, "client_cert2",
enterprise_creds.client_cert2,
enterprise_creds.client_cert2_len)) {
goto out;
}
if (!wpa_cli_cmd_v("set_network %d client_cert2 \"blob://client_cert2\"",
resp.network_id)) {
goto out;
}
if (wpas_config_process_blob(wpa_s->conf, "private_key2",
enterprise_creds.client_key2,
enterprise_creds.client_key2_len)) {
goto out;
}
if (!wpa_cli_cmd_v("set_network %d private_key2 \"blob://private_key2\"",
resp.network_id)) {
goto out;
}
if (!wpa_cli_cmd_v("set_network %d private_key2_passwd \"%s\"",
resp.network_id, params->key2_passwd)) {
goto out;
}
#endif
} else {
ret = -1;

3
modules/hostap/src/supp_main.h
View file

@ -15,7 +15,7 @@
!defined(CONFIG_EAP_PSK) && !defined(CONFIG_EAP_PAX) && \
!defined(CONFIG_EAP_SAKE) && !defined(CONFIG_EAP_GPSK) && \
!defined(CONFIG_EAP_PWD) && !defined(CONFIG_EAP_EKE) && \
!defined(CONFIG_EAP_IKEV2)
!defined(CONFIG_EAP_IKEV2 && !defined(CONFIG_EAP_GTC)
#error "At least one of the following EAP methods need to be defined \
CONFIG_EAP_TLS \
CONFIG_EAP_TTLS \
@ -32,6 +32,7 @@
CONFIG_EAP_IKEV2 \
CONFIG_EAP_SIM \
CONFIG_EAP_AKA \
CONFIG_EAP_GTC \
CONFIG_EAP_ALL "
#endif /* EAP METHODS */
#endif /* CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE */

1
samples/net/wifi/boards/rd_rw612_bga.conf
View file

@ -28,6 +28,7 @@ CONFIG_ZVFS_OPEN_MAX=30
CONFIG_SHELL_ARGC_MAX=48
CONFIG_WIFI_SHELL_MAX_AP_STA=8
CONFIG_WIFI_MGMT_AP_MAX_NUM_STA=8
CONFIG_SHELL_CMD_BUFF_SIZE=512
# net
CONFIG_NET_L2_ETHERNET=y

18
subsys/net/l2/wifi/CMakeLists.txt
View file

@ -49,3 +49,21 @@ generate_inc_file_for_target(
${ZEPHYR_BASE}/samples/net/wifi/test_certs/ca.pem
${gen_dir}/ca.pem.inc
)
generate_inc_file_for_target(
app
${ZEPHYR_BASE}/samples/net/wifi/test_certs/client2.pem
${gen_dir}/client2.pem.inc
)
generate_inc_file_for_target(
app
${ZEPHYR_BASE}/samples/net/wifi/test_certs/client-key2.pem
${gen_dir}/client-key2.pem.inc
)
generate_inc_file_for_target(
app
${ZEPHYR_BASE}/samples/net/wifi/test_certs/ca2.pem
${gen_dir}/ca2.pem.inc
)

115
subsys/net/l2/wifi/wifi_shell.c
View file

@ -44,6 +44,18 @@ static const char client_key_test[] = {
#include <wifi_enterprise_test_certs/client-key.pem.inc>
'\0'
};
static const char ca_cert2_test[] = {
#include <wifi_enterprise_test_certs/ca2.pem.inc>
'\0'};
static const char client_cert2_test[] = {
#include <wifi_enterprise_test_certs/client2.pem.inc>
'\0'};
static const char client_key2_test[] = {
#include <wifi_enterprise_test_certs/client-key2.pem.inc>
'\0'};
#endif
#define WIFI_SHELL_MODULE "wifi"
@ -103,6 +115,12 @@ static int cmd_wifi_set_enterprise_creds(const struct shell *sh, struct net_if *
params.client_cert_len = ARRAY_SIZE(client_cert_test);
params.client_key = (uint8_t *)client_key_test;
params.client_key_len = ARRAY_SIZE(client_key_test);
params.ca_cert2 = (uint8_t *)ca_cert2_test;
params.ca_cert2_len = ARRAY_SIZE(ca_cert2_test);
params.client_cert2 = (uint8_t *)client_cert2_test;
params.client_cert2_len = ARRAY_SIZE(client_cert2_test);
params.client_key2 = (uint8_t *)client_key2_test;
params.client_key2_len = ARRAY_SIZE(client_key2_test);
if (net_mgmt(NET_REQUEST_WIFI_ENTERPRISE_CREDS, iface, &params, sizeof(params))) {
PR_WARNING("Set enterprise credentials failed\n");
@ -503,7 +521,26 @@ static int __wifi_args_to_params(const struct shell *sh, size_t argc, char *argv
{"channel", required_argument, 0, 'c'},
{"timeout", required_argument, 0, 't'},
{"anon-id", required_argument, 0, 'a'},
{"key-passwd", required_argument, 0, 'K'},
{"key1-pwd", required_argument, 0, 'K'},
{"key2-pwd", required_argument, 0, 'K'},
{"suiteb-type", required_argument, 0, 'S'},
{"eap-version", required_argument, 0, 'V'},
{"eap-id1", required_argument, 0, 'I'},
{"eap-id2", required_argument, 0, 'I'},
{"eap-id3", required_argument, 0, 'I'},
{"eap-id4", required_argument, 0, 'I'},
{"eap-id5", required_argument, 0, 'I'},
{"eap-id6", required_argument, 0, 'I'},
{"eap-id7", required_argument, 0, 'I'},
{"eap-id8", required_argument, 0, 'I'},
{"eap-pwd1", required_argument, 0, 'P'},
{"eap-pwd2", required_argument, 0, 'P'},
{"eap-pwd3", required_argument, 0, 'P'},
{"eap-pwd4", required_argument, 0, 'P'},
{"eap-pwd5", required_argument, 0, 'P'},
{"eap-pwd6", required_argument, 0, 'P'},
{"eap-pwd7", required_argument, 0, 'P'},
{"eap-pwd8", required_argument, 0, 'P'},
{"help", no_argument, 0, 'h'},
{0, 0, 0, 0}};
char *endptr;
@ -519,14 +556,16 @@ static int __wifi_args_to_params(const struct shell *sh, size_t argc, char *argv
char bands_str[MAX_BANDS_STR_LEN] = {0};
size_t offset = 0;
long channel;
int key_passwd_cnt = 0;
/* Defaults */
params->band = WIFI_FREQ_BAND_UNKNOWN;
params->channel = WIFI_CHANNEL_ANY;
params->security = WIFI_SECURITY_TYPE_NONE;
params->mfp = WIFI_MFP_OPTIONAL;
params->eap_ver = 1;
while ((opt = getopt_long(argc, argv, "s:p:k:w:b:c:m:t:a:K:h",
while ((opt = getopt_long(argc, argv, "s:p:k:e:w:b:c:m:t:a:K:S:V:I:P:h",
long_options, &opt_index)) != -1) {
state = getopt_state_get();
switch (opt) {
@ -640,10 +679,54 @@ static int __wifi_args_to_params(const struct shell *sh, size_t argc, char *argv
}
break;
case 'K':
params->key_passwd = optarg;
params->key_passwd_length = strlen(params->key_passwd);
if (params->key_passwd_length > WIFI_ENT_PSWD_MAX_LEN) {
PR_WARNING("key_passwd too long (max %d characters)\n",
if (key_passwd_cnt >= 2) {
PR_WARNING("too many key_passwd (max 2 key_passwd)\n");
return -EINVAL;
}
if (key_passwd_cnt == 0) {
params->key_passwd = optarg;
params->key_passwd_length = strlen(params->key_passwd);
if (params->key_passwd_length > WIFI_ENT_PSWD_MAX_LEN) {
PR_WARNING("key_passwd too long (max %d characters)\n",
WIFI_ENT_PSWD_MAX_LEN);
return -EINVAL;
}
} else if (key_passwd_cnt == 1) {
params->key2_passwd = optarg;
params->key2_passwd_length = strlen(params->key2_passwd);
if (params->key2_passwd_length > WIFI_ENT_PSWD_MAX_LEN) {
PR_WARNING("key2_passwd too long (max %d characters)\n",
WIFI_ENT_PSWD_MAX_LEN);
return -EINVAL;
}
}
key_passwd_cnt++;
break;
case 'S':
params->suiteb_type = atoi(optarg);
break;
case 'V':
params->eap_ver = atoi(optarg);
if (params->eap_ver != 0U && params->eap_ver != 1U) {
PR_WARNING("eap_ver error %d\n", params->eap_ver);
return -EINVAL;
}
break;
case 'I':
params->eap_identity = optarg;
params->eap_id_length = strlen(params->eap_identity);
if (params->eap_id_length > WIFI_ENT_IDENTITY_MAX_LEN) {
PR_WARNING("eap identity too long (max %d characters)\n",
WIFI_ENT_IDENTITY_MAX_LEN);
return -EINVAL;
}
break;
case 'P':
params->eap_password = optarg;
params->eap_passwd_length = strlen(params->eap_password);
if (params->eap_passwd_length > WIFI_ENT_PSWD_MAX_LEN) {
PR_WARNING("eap password length too long (max %d characters)\n",
WIFI_ENT_PSWD_MAX_LEN);
return -EINVAL;
}
@ -710,7 +793,12 @@ static int cmd_wifi_connect(const struct shell *sh, size_t argc,
#ifdef CONFIG_WIFI_NM_WPA_SUPPLICANT_CRYPTO_ENTERPRISE
/* Load the enterprise credentials if needed */
if (cnx_params.security == WIFI_SECURITY_TYPE_EAP_TLS) {
if (cnx_params.security == WIFI_SECURITY_TYPE_EAP_TLS ||
cnx_params.security == WIFI_SECURITY_TYPE_EAP_PEAP_MSCHAPV2 ||
cnx_params.security == WIFI_SECURITY_TYPE_EAP_PEAP_GTC ||
cnx_params.security == WIFI_SECURITY_TYPE_EAP_TTLS_MSCHAPV2 ||
cnx_params.security == WIFI_SECURITY_TYPE_EAP_PEAP_TLS ||
cnx_params.security == WIFI_SECURITY_TYPE_EAP_TLS_SHA256) {
cmd_wifi_set_enterprise_creds(sh, iface);
}
#endif
@ -2997,16 +3085,23 @@ SHELL_SUBCMD_ADD((wifi), connect, &wifi_commands,
"[-p, --psk]: Passphrase (valid only for secure SSIDs)\n"
"[-k, --key-mgmt]: Key Management type (valid only for secure SSIDs)\n"
"0:None, 1:WPA2-PSK, 2:WPA2-PSK-256, 3:SAE-HNP, 4:SAE-H2E, 5:SAE-AUTO, 6:WAPI,"
" 7:EAP-TLS, 8:WEP, 9: WPA-PSK, 10: WPA-Auto-Personal, 11: DPP\n"
"7:EAP-TLS, 8:WEP, 9: WPA-PSK, 10: WPA-Auto-Personal, 11: DPP\n"
"12: EAP-PEAP-MSCHAPv2, 13: EAP-PEAP-GTC, 14: EAP-TTLS-MSCHAPv2, 15: EAP-PEAP-TLS\n"
"[-w, --ieee-80211w]: MFP (optional: needs security type to be specified)\n"
": 0:Disable, 1:Optional, 2:Required.\n"
"[-m, --bssid]: MAC address of the AP (BSSID).\n"
"[-t, --timeout]: Timeout for the connection attempt (in seconds).\n"
"[-a, --anon-id]: Anonymous identity for enterprise mode.\n"
"[-K, --key-passwd]: Private key passwd for enterprise mode.\n"
"[-K, --key1-pwd for eap phase1 or --key2-pwd for eap phase2]:\n"
"Private key passwd for enterprise mode. Default no password for private key.\n"
"[-S, --suiteb-type]: 1:suiteb, 2:suiteb-192. Default 0: not suiteb mode.\n"
"[-V, --eap-version]: 0 or 1. Default 1: eap version 1.\n"
"[-I, --eap-id1]: Client Identity. Default no eap identity.\n"
"[-P, --eap-pwd1]: Client Password.\n"
"Default no password for eap user.\n"
"[-h, --help]: Print out the help for the connect command.\n",
cmd_wifi_connect,
2, 13);
2, 19);
SHELL_SUBCMD_ADD((wifi), disconnect, &wifi_commands,
"Disconnect from the Wi-Fi AP.\n",