readme

一个Linux下无线网卡的设置工具

   use.

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
network={
	ssid="example"
	scan_ssid=1
	key_mgmt=WPA-EAP WPA-PSK IEEE8021X NONE
	pairwise=CCMP TKIP
	group=CCMP TKIP WEP104 WEP40
	psk="very secret passphrase"
	eap=TTLS PEAP TLS
	identity="[e-mail]"
	password="foobar"
	ca_cert="/etc/cert/ca.pem"
	client_cert="/etc/cert/user.pem"
	private_key="/etc/cert/user.prv"
	private_key_passwd="password"
	phase1="peaplabel=0"
	ca_cert2="/etc/cert/ca2.pem"
	client_cert2="/etc/cer/user.pem"
	private_key2="/etc/cer/user.prv"
	private_key2_passwd="password"
}


6) Authentication for wired Ethernet. This can be used with 'wired' interface
   (-Dwired on command line).

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
ap_scan=0
network={
	key_mgmt=IEEE8021X
	eap=MD5
	identity="user"
	password="password"
	eapol_flags=0
}



Certificates
------------

Some EAP authentication methods require use of certificates. EAP-TLS
uses both server side and client certificates whereas EAP-PEAP and
EAP-TTLS only require the server side certificate. When client
certificate is used, a matching private key file has to also be
included in configuration. If the private key uses a passphrase, this
has to be configured in wpa_supplicant.conf ("private_key_passwd").

wpa_supplicant supports X.509 certificates in PEM and DER
formats. User certificate and private key can be included in the same
file.

If the user certificate and private key is received in PKCS#12/PFX
format, they need to be converted to suitable PEM/DER format for
wpa_supplicant. This can be done, e.g., with following commands:

# convert client certificate and private key to PEM format
openssl pkcs12 -in example.pfx -out user.pem -clcerts
# convert CA certificate (if included in PFX file) to PEM format
openssl pkcs12 -in example.pfx -out ca.pem -cacerts -nokeys



wpa_cli
-------

wpa_cli is a text-based frontend program for interacting with
wpa_supplicant. It is used to query current status, change
configuration, trigger events, and request interactive user input.

wpa_cli can show the current authentication status, selected security
mode, dot11 and dot1x MIBs, etc. In addition, it can configure some
variables like EAPOL state machine parameters and trigger events like
reassociation and IEEE 802.1X logoff/logon. wpa_cli provides a user
interface to request authentication information, like username and
password, if these are not included in the configuration. This can be
used to implement, e.g., one-time-passwords or generic token card
authentication where the authentication is based on a
challenge-response that uses an external device for generating the
response.

The control interface of wpa_supplicant can be configured to allow
non-root user access (ctrl_interface_group in the configuration
file). This makes it possible to run wpa_cli with a normal user
account.

wpa_cli supports two modes: interactive and command line. Both modes
share the same command set and the main difference is in interactive
mode providing access to unsolicited messages (event messages,
username/password requests).

Interactive mode is started when wpa_cli is executed without including
the command as a command line parameter. Commands are then entered on
the wpa_cli prompt. In command line mode, the same commands are
entered as command line arguments for wpa_cli.


Interactive authentication parameters request

When wpa_supplicant need authentication parameters, like username and
password, which are not present in the configuration file, it sends a
request message to all attached frontend programs, e.g., wpa_cli in
interactive mode. wpa_cli shows these requests with
"CTRL-REQ-<type>-<id>:<text>" prefix. <type> is IDENTITY, PASSWORD, or
OTP (one-time-password). <id> is a unique identifier for the current
network. <text> is description of the request. In case of OTP request,
it includes the challenge from the authentication server.

The reply to these requests can be given with 'identity', 'password',
and 'otp' commands. <id> needs to be copied from the the matching
request. 'password' and 'otp' commands can be used regardless of
whether the request was for PASSWORD or OTP. The main difference
between these two commands is that values given with 'password' are
remembered as long as wpa_supplicant is running whereas values given
with 'otp' are used only once and then forgotten, i.e., wpa_supplicant
will ask frontend for a new value for every use. This can be used to
implement one-time-password lists and generic token card -based
authentication.

Example request for password and a matching reply:

CTRL-REQ-PASSWORD-1:Password needed for SSID foobar
> password 1 mysecretpassword

Example request for generic token card challenge-response:

CTRL-REQ-OTP-2:Challenge 1235663 needed for SSID foobar
> otp 2 9876


wpa_cli commands

  status = get current WPA/EAPOL/EAP status
  mib = get MIB variables (dot1x, dot11)
  help = show this usage help
  interface [ifname] = show interfaces/select interface
  level <debug level> = change debug level
  license = show full wpa_cli license
  logoff = IEEE 802.1X EAPOL state machine logoff
  logon = IEEE 802.1X EAPOL state machine logon
  set = set variables (shows list of variables when run without arguments)
  pmksa = show PMKSA cache
  reassociate = force reassociation
  reconfigure = force wpa_supplicant to re-read its configuration file
  preauthenticate <BSSID> = force preauthentication
  identity <network id> <identity> = configure identity for an SSID
  password <network id> <password> = configure password for an SSID
  pin <network id> <pin> = configure pin for an SSID
  otp <network id> <password> = configure one-time-password for an SSID
  passphrase <network id> <passphrase> = configure private key passphrase
    for an SSID
  bssid <network id> <BSSID> = set preferred BSSID for an SSID
  list_networks = list configured networks
  select_network <network id> = select a network (disable others)
  enable_network <network id> = enable a network
  disable_network <network id> = disable a network
  add_network = add a network
  remove_network <network id> = remove a network
  set_network <network id> <variable> <value> = set network variables (shows
    list of variables when run without arguments)
  get_network <network id> <variable> = get network variables
  save_config = save the current configuration
  disconnect = disconnect and wait for reassociate command before connecting
  scan = request new BSS scan
  scan_results = get latest scan results
  get_capability <eap/pairwise/group/key_mgmt/proto/auth_alg> = get capabilies
  terminate = terminate wpa_supplicant
  quit = exit wpa_cli


wpa_cli command line options

wpa_cli [-p<path to ctrl sockets>] [-i<ifname>] [-hvB] [-a<action file>] \
        [-P<pid file>] [-g<global ctrl>]  [command..]
  -h = help (show this usage text)
  -v = shown version information
  -a = run in daemon mode executing the action file based on events from
       wpa_supplicant
  -B = run a daemon in the background
  default path: /var/run/wpa_supplicant
  default interface: first interface found in socket path


Using wpa_cli to run external program on connect/disconnect
-----------------------------------------------------------

wpa_cli can used to run external programs whenever wpa_supplicant
connects or disconnects from a network. This can be used, e.g., to
update network configuration and/or trigget DHCP client to update IP
addresses, etc.

One wpa_cli process in "action" mode needs to be started for each
interface. For example, the following command starts wpa_cli for the
default ingterface (-i can be used to select the interface in case of
more than one interface being used at the same time):

wpa_cli -a/sbin/wpa_action.sh -B

The action file (-a option, /sbin/wpa_action.sh in this example) will
be executed whenever wpa_supplicant completes authentication (connect
event) or detects disconnection). The action script will be called
with two command line arguments: interface name and event (CONNECTED
or DISCONNECTED). If the action script needs to get more information
about the current network, it can use 'wpa_cli status' to query
wpa_supplicant for more information.

Following example can be used as a simple template for an action
script:

#!/bin/sh

IFNAME=$1
CMD=$2

if [ "$CMD" == "CONNECTED" ]; then
    SSID=`wpa_cli -i$IFNAME status | grep ^ssid= | cut -f2- -d=`
    # configure network, signal DHCP client, etc.
fi

if [ "$CMD" == "DISCONNECTED" ]; then
    # remove network configuration, if needed
fi



Integrating with pcmcia-cs/cardmgr scripts
------------------------------------------

wpa_supplicant needs to be running when using a wireless network with
WPA. It can be started either from system startup scripts or from
pcmcia-cs/cardmgr scripts (when using PC Cards). WPA handshake must be
completed before data frames can be exchanged, so wpa_supplicant
should be started before DHCP client.

Command line option '-w' can be used if wpa_supplicant is started
before the wireless LAN interface is present (e.g., before inserting
the PC Card) or is not yet up.

For example, following small changes to pcmcia-cs scripts can be used
to enable WPA support:

Add MODE="Managed" and WPA="y" to the network scheme in
/etc/pcmcia/wireless.opts.

Add the following block to the end of 'start' action handler in
/etc/pcmcia/wireless:

    if [ "$WPA" = "y" -a -x /usr/local/bin/wpa_supplicant ]; then
	/usr/local/bin/wpa_supplicant -Bw -c/etc/wpa_supplicant.conf \
		-i$DEVICE
    fi

Add the following block to the end of 'stop' action handler (may need
to be separated from other actions) in /etc/pcmcia/wireless:

    if [ "$WPA" = "y" -a -x /usr/local/bin/wpa_supplicant ]; then
	killall wpa_supplicant
    fi

This will make cardmgr start wpa_supplicant when the card is plugged
in. wpa_supplicant will wait until the interface is set up--either
when a static IP address is configured or when DHCP client is
started--and will then negotiate keys with the AP.



Dynamic interface add and operation without configuration files
---------------------------------------------------------------

wpa_supplicant can be started without any configuration files or
network interfaces. When used in this way, a global (i.e., per
wpa_supplicant process) control interface is used to add and remove
network interfaces. Each network interface can then be configured
through a per-network interface control interface. For example,
following commands show how to start wpa_supplicant without any
network interfaces and then add a network interface and configure a
network (SSID):

# Start wpa_supplicant in the background
wpa_supplicant -g/var/run/wpa_supplicant-global -B

# Add a new interface (wlan0, no configuration file, driver=wext, and
# enable control interface)
wpa_cli -g/var/run/wpa_supplicant-global interface_add wlan0 \
	"" wext /var/run/wpa_supplicant

# Configure a network using the newly added network interface:
wpa_cli -iwlan0 add_network
wpa_cli -iwlan0 set_network 0 ssid '"test"'
wpa_cli -iwlan0 set_network 0 key_mgmt WPA-PSK
wpa_cli -iwlan0 set_network 0 psk '"12345678"'
wpa_cli -iwlan0 set_network 0 pairwise TKIP
wpa_cli -iwlan0 set_network 0 group TKIP
wpa_cli -iwlan0 set_network 0 proto WPA
wpa_cli -iwlan0 enable_network 0

# At this point, the new network interface should start trying to associate
# with the WPA-PSK network using SSID test.

# Remove network interface
wpa_cli -g/var/run/wpa_supplicant-global interface_remove wlan0