mirror of
https://git.FreeBSD.org/src.git
synced 2024-12-20 11:11:24 +00:00
02b5aa59ff
Changes: 2010-09-07 - v0.7.3 * fixed fallback from failed PMKSA caching into full EAP authentication [Bug 355] * fixed issue with early D-Bus signals during initialization * fixed X.509 name handling in internal TLS * fixed WPS ER to use corrent Enrollee MAC Address in Credential * fixed scanning routines ot improve AP selection for WPS * added WPS workaround for open networks * fixed WPS Diffie-Hellman derivation to use correct public key length * fixed wpa_supplicant AP mode operations to ignore Supplicant and scan result events * improved SME operations with nl80211 * fixed WPS ER event_id handling in some cases * fixed some issues with bgscan simple to avoid unnecessary scans * fixed issue with l2_packet_ndis overlapped writes corrupting stack [Bug 328] * updated WinPcap to the latest stable version 4.1.2 in Windows installer 2010-04-18 - v0.7.2 * nl80211: fixed number of issues with roaming * avoid unnecessary roaming if multiple APs with similar signal strength are present in scan results * add TLS client events and server probing to ease design of automatic detection of EAP parameters * add option for server certificate matching (SHA256 hash of the certificate) instead of trusted CA certificate configuration * bsd: Cleaned up driver wrapper and added various low-level configuration options * wpa_gui-qt4: do not show too frequent WPS AP available events as tray messages * TNC: fixed issues with fragmentation * EAP-TNC: add Flags field into fragment acknowledgement (needed to interoperate with other implementations; may potentially breaks compatibility with older wpa_supplicant/hostapd versions) * wpa_cli: added option for using a separate process to receive event messages to reduce latency in showing these (CFLAGS += -DCONFIG_WPA_CLI_FORK=y in .config to enable this) * maximum BSS table size can now be configured (bss_max_count) * BSSes to be included in the BSS table can be filtered based on configured SSIDs to save memory (filter_ssids) * fix number of issues with IEEE 802.11r/FT; this version is not backwards compatible with old versions * nl80211: add support for IEEE 802.11r/FT protocol (both over-the-air and over-the-DS) * add freq_list network configuration parameter to allow the AP selection to filter out entries based on the operating channel * add signal strength change events for bgscan; this allows more dynamic changes to background scanning interval based on changes in the signal strength with the current AP; this improves roaming within ESS quite a bit, e.g., with bgscan="simple:30:-45:300" in the network configuration block to request background scans less frequently when signal strength remains good and to automatically trigger background scans whenever signal strength drops noticeably (this is currently only available with nl80211) * add BSSID and reason code (if available) to disconnect event messages * wpa_gui-qt4: more complete support for translating the GUI with linguist and add German translation * fix DH padding with internal crypto code (mainly, for WPS) * do not trigger initial scan automatically anymore if there are no enabled networks 2010-01-16 - v0.7.1 * cleaned up driver wrapper API (struct wpa_driver_ops); the new API is not fully backwards compatible, so out-of-tree driver wrappers will need modifications * cleaned up various module interfaces * merge hostapd and wpa_supplicant developers' documentation into a single document * nl80211: use explicit deauthentication to clear cfg80211 state to avoid issues when roaming between APs * dbus: major design changes in the new D-Bus API (fi.w1.wpa_supplicant1) * nl80211: added support for IBSS networks * added internal debugging mechanism with backtrace support and memory allocation/freeing validation, etc. tests (CONFIG_WPA_TRACE=y) * added WPS ER unsubscription command to more cleanly unregister from receiving UPnP events when ER is terminated * cleaned up AP mode operations to avoid need for virtual driver_ops wrapper * added BSS table to maintain more complete scan result information over multiple scans (that may include only partial results) * wpa_gui-qt4: update Peers dialog information more dynamically while the dialog is kept open * fixed PKCS#12 use with OpenSSL 1.0.0 * driver_wext: Added cfg80211-specific optimization to avoid some unnecessary scans and to speed up association 2009-11-21 - v0.7.0 * increased wpa_cli ping interval to 5 seconds and made this configurable with a new command line options (-G<seconds>) * fixed scan buffer processing with WEXT to handle up to 65535 byte result buffer (previously, limited to 32768 bytes) * allow multiple driver wrappers to be specified on command line (e.g., -Dnl80211,wext); the first one that is able to initialize the interface will be used * added support for multiple SSIDs per scan request to optimize scan_ssid=1 operations in ap_scan=1 mode (i.e., search for hidden SSIDs); this requires driver support and can currently be used only with nl80211 * added support for WPS USBA out-of-band mechanism with USB Flash Drives (UFD) (CONFIG_WPS_UFD=y) * driver_ndis: add PAE group address to the multicast address list to fix wired IEEE 802.1X authentication * fixed IEEE 802.11r key derivation function to match with the standard (note: this breaks interoperability with previous version) [Bug 303] * added better support for drivers that allow separate authentication and association commands (e.g., mac80211-based Linux drivers with nl80211; SME in wpa_supplicant); this allows over-the-air FT protocol to be used (IEEE 802.11r) * fixed SHA-256 based key derivation function to match with the standard when using CCMP (for IEEE 802.11r and IEEE 802.11w) (note: this breaks interoperability with previous version) [Bug 307] * use shared driver wrapper files with hostapd * added AP mode functionality (CONFIG_AP=y) with mode=2 in the network block; this can be used for open and WPA2-Personal networks (optionally, with WPS); this links in parts of hostapd functionality into wpa_supplicant * wpa_gui-qt4: added new Peers dialog to show information about peers (other devices, including APs and stations, etc. in the neighborhood) * added support for WPS External Registrar functionality (configure APs and enroll new devices); can be used with wpa_gui-qt4 Peers dialog and wpa_cli commands wps_er_start, wps_er_stop, wps_er_pin, wps_er_pbc, wps_er_learn (this can also be used with a new 'none' driver wrapper if no wireless device or IEEE 802.1X on wired is needed) * driver_nl80211: multiple updates to provide support for new Linux nl80211/mac80211 functionality * updated management frame protection to use IEEE Std 802.11w-2009 * fixed number of small WPS issues and added workarounds to interoperate with common deployed broken implementations * added support for NFC out-of-band mechanism with WPS * driver_ndis: fixed wired IEEE 802.1X authentication with PAE group address frames * added preliminary support for IEEE 802.11r RIC processing * added support for specifying subset of enabled frequencies to scan (scan_freq option in the network configuration block); this can speed up scanning process considerably if it is known that only a small subset of channels is actually used in the network (this is currently supported only with -Dnl80211) * added a workaround for race condition between receiving the association event and the following EAPOL-Key * added background scan and roaming infrastructure to allow network-specific optimizations to be used to improve roaming within an ESS (same SSID) * added new DBus interface (fi.w1.wpa_supplicant1)
377 lines
8.8 KiB
C
377 lines
8.8 KiB
C
/*
|
|
* WPA Supplicant - test code for pre-authentication
|
|
* Copyright (c) 2003-2007, Jouni Malinen <j@w1.fi>
|
|
*
|
|
* This program is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License version 2 as
|
|
* published by the Free Software Foundation.
|
|
*
|
|
* Alternatively, this software may be distributed under the terms of BSD
|
|
* license.
|
|
*
|
|
* See README and COPYING for more details.
|
|
*
|
|
* IEEE 802.1X Supplicant test code (to be used in place of wpa_supplicant.c.
|
|
* Not used in production version.
|
|
*/
|
|
|
|
#include "includes.h"
|
|
#include <assert.h>
|
|
|
|
#include "common.h"
|
|
#include "config.h"
|
|
#include "eapol_supp/eapol_supp_sm.h"
|
|
#include "eloop.h"
|
|
#include "rsn_supp/wpa.h"
|
|
#include "eap_peer/eap.h"
|
|
#include "wpa_supplicant_i.h"
|
|
#include "l2_packet/l2_packet.h"
|
|
#include "ctrl_iface.h"
|
|
#include "pcsc_funcs.h"
|
|
#include "rsn_supp/preauth.h"
|
|
#include "rsn_supp/pmksa_cache.h"
|
|
#include "drivers/driver.h"
|
|
|
|
|
|
extern int wpa_debug_level;
|
|
extern int wpa_debug_show_keys;
|
|
|
|
struct wpa_driver_ops *wpa_drivers[] = { NULL };
|
|
|
|
|
|
struct preauth_test_data {
|
|
int auth_timed_out;
|
|
};
|
|
|
|
|
|
static void _wpa_supplicant_disassociate(void *wpa_s, int reason_code)
|
|
{
|
|
wpa_supplicant_disassociate(wpa_s, reason_code);
|
|
}
|
|
|
|
|
|
static void _wpa_supplicant_deauthenticate(void *wpa_s, int reason_code)
|
|
{
|
|
wpa_supplicant_deauthenticate(wpa_s, reason_code);
|
|
}
|
|
|
|
|
|
static u8 * wpa_alloc_eapol(const struct wpa_supplicant *wpa_s, u8 type,
|
|
const void *data, u16 data_len,
|
|
size_t *msg_len, void **data_pos)
|
|
{
|
|
struct ieee802_1x_hdr *hdr;
|
|
|
|
*msg_len = sizeof(*hdr) + data_len;
|
|
hdr = os_malloc(*msg_len);
|
|
if (hdr == NULL)
|
|
return NULL;
|
|
|
|
hdr->version = wpa_s->conf->eapol_version;
|
|
hdr->type = type;
|
|
hdr->length = htons(data_len);
|
|
|
|
if (data)
|
|
os_memcpy(hdr + 1, data, data_len);
|
|
else
|
|
os_memset(hdr + 1, 0, data_len);
|
|
|
|
if (data_pos)
|
|
*data_pos = hdr + 1;
|
|
|
|
return (u8 *) hdr;
|
|
}
|
|
|
|
|
|
static u8 * _wpa_alloc_eapol(void *wpa_s, u8 type,
|
|
const void *data, u16 data_len,
|
|
size_t *msg_len, void **data_pos)
|
|
{
|
|
return wpa_alloc_eapol(wpa_s, type, data, data_len, msg_len, data_pos);
|
|
}
|
|
|
|
|
|
static void _wpa_supplicant_set_state(void *ctx, enum wpa_states state)
|
|
{
|
|
struct wpa_supplicant *wpa_s = ctx;
|
|
wpa_s->wpa_state = state;
|
|
}
|
|
|
|
|
|
static enum wpa_states _wpa_supplicant_get_state(void *ctx)
|
|
{
|
|
struct wpa_supplicant *wpa_s = ctx;
|
|
return wpa_s->wpa_state;
|
|
}
|
|
|
|
|
|
static int wpa_ether_send(void *wpa_s, const u8 *dest, u16 proto,
|
|
const u8 *buf, size_t len)
|
|
{
|
|
printf("%s - not implemented\n", __func__);
|
|
return -1;
|
|
}
|
|
|
|
|
|
static void * wpa_supplicant_get_network_ctx(void *wpa_s)
|
|
{
|
|
return wpa_supplicant_get_ssid(wpa_s);
|
|
}
|
|
|
|
|
|
static void _wpa_supplicant_cancel_auth_timeout(void *wpa_s)
|
|
{
|
|
wpa_supplicant_cancel_auth_timeout(wpa_s);
|
|
}
|
|
|
|
|
|
static int wpa_supplicant_get_beacon_ie(void *wpa_s)
|
|
{
|
|
printf("%s - not implemented\n", __func__);
|
|
return -1;
|
|
}
|
|
|
|
|
|
static int wpa_supplicant_get_bssid(void *wpa_s, u8 *bssid)
|
|
{
|
|
printf("%s - not implemented\n", __func__);
|
|
return -1;
|
|
}
|
|
|
|
|
|
static int wpa_supplicant_set_key(void *wpa_s, enum wpa_alg alg,
|
|
const u8 *addr, int key_idx, int set_tx,
|
|
const u8 *seq, size_t seq_len,
|
|
const u8 *key, size_t key_len)
|
|
{
|
|
printf("%s - not implemented\n", __func__);
|
|
return -1;
|
|
}
|
|
|
|
|
|
static int wpa_supplicant_mlme_setprotection(void *wpa_s, const u8 *addr,
|
|
int protection_type,
|
|
int key_type)
|
|
{
|
|
printf("%s - not implemented\n", __func__);
|
|
return -1;
|
|
}
|
|
|
|
|
|
static int wpa_supplicant_add_pmkid(void *wpa_s,
|
|
const u8 *bssid, const u8 *pmkid)
|
|
{
|
|
printf("%s - not implemented\n", __func__);
|
|
return -1;
|
|
}
|
|
|
|
|
|
static int wpa_supplicant_remove_pmkid(void *wpa_s,
|
|
const u8 *bssid, const u8 *pmkid)
|
|
{
|
|
printf("%s - not implemented\n", __func__);
|
|
return -1;
|
|
}
|
|
|
|
|
|
static void wpa_supplicant_set_config_blob(void *ctx,
|
|
struct wpa_config_blob *blob)
|
|
{
|
|
struct wpa_supplicant *wpa_s = ctx;
|
|
wpa_config_set_blob(wpa_s->conf, blob);
|
|
}
|
|
|
|
|
|
static const struct wpa_config_blob *
|
|
wpa_supplicant_get_config_blob(void *ctx, const char *name)
|
|
{
|
|
struct wpa_supplicant *wpa_s = ctx;
|
|
return wpa_config_get_blob(wpa_s->conf, name);
|
|
}
|
|
|
|
|
|
static void test_eapol_clean(struct wpa_supplicant *wpa_s)
|
|
{
|
|
rsn_preauth_deinit(wpa_s->wpa);
|
|
pmksa_candidate_free(wpa_s->wpa);
|
|
wpa_sm_deinit(wpa_s->wpa);
|
|
scard_deinit(wpa_s->scard);
|
|
if (wpa_s->ctrl_iface) {
|
|
wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface);
|
|
wpa_s->ctrl_iface = NULL;
|
|
}
|
|
wpa_config_free(wpa_s->conf);
|
|
}
|
|
|
|
|
|
static void eapol_test_timeout(void *eloop_ctx, void *timeout_ctx)
|
|
{
|
|
struct preauth_test_data *p = eloop_ctx;
|
|
printf("EAPOL test timed out\n");
|
|
p->auth_timed_out = 1;
|
|
eloop_terminate();
|
|
}
|
|
|
|
|
|
static void eapol_test_poll(void *eloop_ctx, void *timeout_ctx)
|
|
{
|
|
struct wpa_supplicant *wpa_s = eloop_ctx;
|
|
if (!rsn_preauth_in_progress(wpa_s->wpa))
|
|
eloop_terminate();
|
|
else {
|
|
eloop_register_timeout(0, 100000, eapol_test_poll, eloop_ctx,
|
|
timeout_ctx);
|
|
}
|
|
}
|
|
|
|
|
|
static struct wpa_driver_ops dummy_driver;
|
|
|
|
|
|
static void wpa_init_conf(struct wpa_supplicant *wpa_s, const char *ifname)
|
|
{
|
|
struct l2_packet_data *l2;
|
|
struct wpa_sm_ctx *ctx;
|
|
|
|
os_memset(&dummy_driver, 0, sizeof(dummy_driver));
|
|
wpa_s->driver = &dummy_driver;
|
|
|
|
ctx = os_zalloc(sizeof(*ctx));
|
|
assert(ctx != NULL);
|
|
|
|
ctx->ctx = wpa_s;
|
|
ctx->msg_ctx = wpa_s;
|
|
ctx->set_state = _wpa_supplicant_set_state;
|
|
ctx->get_state = _wpa_supplicant_get_state;
|
|
ctx->deauthenticate = _wpa_supplicant_deauthenticate;
|
|
ctx->disassociate = _wpa_supplicant_disassociate;
|
|
ctx->set_key = wpa_supplicant_set_key;
|
|
ctx->get_network_ctx = wpa_supplicant_get_network_ctx;
|
|
ctx->get_bssid = wpa_supplicant_get_bssid;
|
|
ctx->ether_send = wpa_ether_send;
|
|
ctx->get_beacon_ie = wpa_supplicant_get_beacon_ie;
|
|
ctx->alloc_eapol = _wpa_alloc_eapol;
|
|
ctx->cancel_auth_timeout = _wpa_supplicant_cancel_auth_timeout;
|
|
ctx->add_pmkid = wpa_supplicant_add_pmkid;
|
|
ctx->remove_pmkid = wpa_supplicant_remove_pmkid;
|
|
ctx->set_config_blob = wpa_supplicant_set_config_blob;
|
|
ctx->get_config_blob = wpa_supplicant_get_config_blob;
|
|
ctx->mlme_setprotection = wpa_supplicant_mlme_setprotection;
|
|
|
|
wpa_s->wpa = wpa_sm_init(ctx);
|
|
assert(wpa_s->wpa != NULL);
|
|
wpa_sm_set_param(wpa_s->wpa, WPA_PARAM_PROTO, WPA_PROTO_RSN);
|
|
|
|
os_strlcpy(wpa_s->ifname, ifname, sizeof(wpa_s->ifname));
|
|
wpa_sm_set_ifname(wpa_s->wpa, wpa_s->ifname, NULL);
|
|
|
|
l2 = l2_packet_init(wpa_s->ifname, NULL, ETH_P_RSN_PREAUTH, NULL,
|
|
NULL, 0);
|
|
assert(l2 != NULL);
|
|
if (l2_packet_get_own_addr(l2, wpa_s->own_addr)) {
|
|
wpa_printf(MSG_WARNING, "Failed to get own L2 address\n");
|
|
exit(-1);
|
|
}
|
|
l2_packet_deinit(l2);
|
|
wpa_sm_set_own_addr(wpa_s->wpa, wpa_s->own_addr);
|
|
}
|
|
|
|
|
|
static void eapol_test_terminate(int sig, void *signal_ctx)
|
|
{
|
|
struct wpa_supplicant *wpa_s = signal_ctx;
|
|
wpa_msg(wpa_s, MSG_INFO, "Signal %d received - terminating", sig);
|
|
eloop_terminate();
|
|
}
|
|
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
struct wpa_supplicant wpa_s;
|
|
int ret = 1;
|
|
u8 bssid[ETH_ALEN];
|
|
struct preauth_test_data preauth_test;
|
|
|
|
if (os_program_init())
|
|
return -1;
|
|
|
|
os_memset(&preauth_test, 0, sizeof(preauth_test));
|
|
|
|
wpa_debug_level = 0;
|
|
wpa_debug_show_keys = 1;
|
|
|
|
if (argc != 4) {
|
|
printf("usage: preauth_test <conf> <target MAC address> "
|
|
"<ifname>\n");
|
|
return -1;
|
|
}
|
|
|
|
if (hwaddr_aton(argv[2], bssid)) {
|
|
printf("Failed to parse target address '%s'.\n", argv[2]);
|
|
return -1;
|
|
}
|
|
|
|
if (eap_register_methods()) {
|
|
wpa_printf(MSG_ERROR, "Failed to register EAP methods");
|
|
return -1;
|
|
}
|
|
|
|
if (eloop_init()) {
|
|
wpa_printf(MSG_ERROR, "Failed to initialize event loop");
|
|
return -1;
|
|
}
|
|
|
|
os_memset(&wpa_s, 0, sizeof(wpa_s));
|
|
wpa_s.conf = wpa_config_read(argv[1]);
|
|
if (wpa_s.conf == NULL) {
|
|
printf("Failed to parse configuration file '%s'.\n", argv[1]);
|
|
return -1;
|
|
}
|
|
if (wpa_s.conf->ssid == NULL) {
|
|
printf("No networks defined.\n");
|
|
return -1;
|
|
}
|
|
|
|
wpa_init_conf(&wpa_s, argv[3]);
|
|
wpa_s.ctrl_iface = wpa_supplicant_ctrl_iface_init(&wpa_s);
|
|
if (wpa_s.ctrl_iface == NULL) {
|
|
printf("Failed to initialize control interface '%s'.\n"
|
|
"You may have another preauth_test process already "
|
|
"running or the file was\n"
|
|
"left by an unclean termination of preauth_test in "
|
|
"which case you will need\n"
|
|
"to manually remove this file before starting "
|
|
"preauth_test again.\n",
|
|
wpa_s.conf->ctrl_interface);
|
|
return -1;
|
|
}
|
|
if (wpa_supplicant_scard_init(&wpa_s, wpa_s.conf->ssid))
|
|
return -1;
|
|
|
|
if (rsn_preauth_init(wpa_s.wpa, bssid, &wpa_s.conf->ssid->eap))
|
|
return -1;
|
|
|
|
eloop_register_timeout(30, 0, eapol_test_timeout, &preauth_test, NULL);
|
|
eloop_register_timeout(0, 100000, eapol_test_poll, &wpa_s, NULL);
|
|
eloop_register_signal_terminate(eapol_test_terminate, &wpa_s);
|
|
eloop_register_signal_reconfig(eapol_test_terminate, &wpa_s);
|
|
eloop_run();
|
|
|
|
if (preauth_test.auth_timed_out)
|
|
ret = -2;
|
|
else {
|
|
ret = pmksa_cache_set_current(wpa_s.wpa, NULL, bssid, NULL, 0)
|
|
? 0 : -3;
|
|
}
|
|
|
|
test_eapol_clean(&wpa_s);
|
|
|
|
eap_peer_unregister_methods();
|
|
|
|
eloop_destroy();
|
|
|
|
os_program_deinit();
|
|
|
|
return ret;
|
|
}
|