eapol_test.c revision 1.1.1.2
1 /* 2 * WPA Supplicant - test code 3 * Copyright (c) 2003-2011, Jouni Malinen <j (at) w1.fi> 4 * 5 * This program is free software; you can redistribute it and/or modify 6 * it under the terms of the GNU General Public License version 2 as 7 * published by the Free Software Foundation. 8 * 9 * Alternatively, this software may be distributed under the terms of BSD 10 * license. 11 * 12 * See README and COPYING for more details. 13 * 14 * IEEE 802.1X Supplicant test code (to be used in place of wpa_supplicant.c. 15 * Not used in production version. 16 */ 17 18 #include "includes.h" 19 #include <assert.h> 20 21 #include "common.h" 22 #include "config.h" 23 #include "eapol_supp/eapol_supp_sm.h" 24 #include "eap_peer/eap.h" 25 #include "eap_server/eap_methods.h" 26 #include "eloop.h" 27 #include "utils/base64.h" 28 #include "rsn_supp/wpa.h" 29 #include "eap_peer/eap_i.h" 30 #include "wpa_supplicant_i.h" 31 #include "radius/radius.h" 32 #include "radius/radius_client.h" 33 #include "common/wpa_ctrl.h" 34 #include "ctrl_iface.h" 35 #include "pcsc_funcs.h" 36 37 38 extern int wpa_debug_level; 39 extern int wpa_debug_show_keys; 40 41 struct wpa_driver_ops *wpa_drivers[] = { NULL }; 42 43 44 struct extra_radius_attr { 45 u8 type; 46 char syntax; 47 char *data; 48 struct extra_radius_attr *next; 49 }; 50 51 struct eapol_test_data { 52 struct wpa_supplicant *wpa_s; 53 54 int eapol_test_num_reauths; 55 int no_mppe_keys; 56 int num_mppe_ok, num_mppe_mismatch; 57 58 u8 radius_identifier; 59 struct radius_msg *last_recv_radius; 60 struct in_addr own_ip_addr; 61 struct radius_client_data *radius; 62 struct hostapd_radius_servers *radius_conf; 63 64 u8 *last_eap_radius; /* last received EAP Response from Authentication 65 * Server */ 66 size_t last_eap_radius_len; 67 68 u8 authenticator_pmk[PMK_LEN]; 69 size_t authenticator_pmk_len; 70 int radius_access_accept_received; 71 int radius_access_reject_received; 72 int auth_timed_out; 73 74 u8 *eap_identity; 75 size_t eap_identity_len; 76 77 char *connect_info; 78 u8 own_addr[ETH_ALEN]; 79 struct extra_radius_attr *extra_attrs; 80 81 FILE *server_cert_file; 82 }; 83 84 static struct eapol_test_data eapol_test; 85 86 87 static void send_eap_request_identity(void *eloop_ctx, void *timeout_ctx); 88 89 90 static void hostapd_logger_cb(void *ctx, const u8 *addr, unsigned int module, 91 int level, const char *txt, size_t len) 92 { 93 if (addr) 94 wpa_printf(MSG_DEBUG, "STA " MACSTR ": %s\n", 95 MAC2STR(addr), txt); 96 else 97 wpa_printf(MSG_DEBUG, "%s", txt); 98 } 99 100 101 static int add_extra_attr(struct radius_msg *msg, 102 struct extra_radius_attr *attr) 103 { 104 size_t len; 105 char *pos; 106 u32 val; 107 char buf[128]; 108 109 switch (attr->syntax) { 110 case 's': 111 os_snprintf(buf, sizeof(buf), "%s", attr->data); 112 len = os_strlen(buf); 113 break; 114 case 'n': 115 buf[0] = '\0'; 116 len = 1; 117 break; 118 case 'x': 119 pos = attr->data; 120 if (pos[0] == '0' && pos[1] == 'x') 121 pos += 2; 122 len = os_strlen(pos); 123 if ((len & 1) || (len / 2) > sizeof(buf)) { 124 printf("Invalid extra attribute hexstring\n"); 125 return -1; 126 } 127 len /= 2; 128 if (hexstr2bin(pos, (u8 *) buf, len) < 0) { 129 printf("Invalid extra attribute hexstring\n"); 130 return -1; 131 } 132 break; 133 case 'd': 134 val = htonl(atoi(attr->data)); 135 os_memcpy(buf, &val, 4); 136 len = 4; 137 break; 138 default: 139 printf("Incorrect extra attribute syntax specification\n"); 140 return -1; 141 } 142 143 if (!radius_msg_add_attr(msg, attr->type, (u8 *) buf, len)) { 144 printf("Could not add attribute %d\n", attr->type); 145 return -1; 146 } 147 148 return 0; 149 } 150 151 152 static int add_extra_attrs(struct radius_msg *msg, 153 struct extra_radius_attr *attrs) 154 { 155 struct extra_radius_attr *p; 156 for (p = attrs; p; p = p->next) { 157 if (add_extra_attr(msg, p) < 0) 158 return -1; 159 } 160 return 0; 161 } 162 163 164 static struct extra_radius_attr * 165 find_extra_attr(struct extra_radius_attr *attrs, u8 type) 166 { 167 struct extra_radius_attr *p; 168 for (p = attrs; p; p = p->next) { 169 if (p->type == type) 170 return p; 171 } 172 return NULL; 173 } 174 175 176 static void ieee802_1x_encapsulate_radius(struct eapol_test_data *e, 177 const u8 *eap, size_t len) 178 { 179 struct radius_msg *msg; 180 char buf[128]; 181 const struct eap_hdr *hdr; 182 const u8 *pos; 183 184 wpa_printf(MSG_DEBUG, "Encapsulating EAP message into a RADIUS " 185 "packet"); 186 187 e->radius_identifier = radius_client_get_id(e->radius); 188 msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST, 189 e->radius_identifier); 190 if (msg == NULL) { 191 printf("Could not create net RADIUS packet\n"); 192 return; 193 } 194 195 radius_msg_make_authenticator(msg, (u8 *) e, sizeof(*e)); 196 197 hdr = (const struct eap_hdr *) eap; 198 pos = (const u8 *) (hdr + 1); 199 if (len > sizeof(*hdr) && hdr->code == EAP_CODE_RESPONSE && 200 pos[0] == EAP_TYPE_IDENTITY) { 201 pos++; 202 os_free(e->eap_identity); 203 e->eap_identity_len = len - sizeof(*hdr) - 1; 204 e->eap_identity = os_malloc(e->eap_identity_len); 205 if (e->eap_identity) { 206 os_memcpy(e->eap_identity, pos, e->eap_identity_len); 207 wpa_hexdump(MSG_DEBUG, "Learned identity from " 208 "EAP-Response-Identity", 209 e->eap_identity, e->eap_identity_len); 210 } 211 } 212 213 if (e->eap_identity && 214 !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME, 215 e->eap_identity, e->eap_identity_len)) { 216 printf("Could not add User-Name\n"); 217 goto fail; 218 } 219 220 if (!find_extra_attr(e->extra_attrs, RADIUS_ATTR_NAS_IP_ADDRESS) && 221 !radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS, 222 (u8 *) &e->own_ip_addr, 4)) { 223 printf("Could not add NAS-IP-Address\n"); 224 goto fail; 225 } 226 227 os_snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT, 228 MAC2STR(e->wpa_s->own_addr)); 229 if (!find_extra_attr(e->extra_attrs, RADIUS_ATTR_CALLING_STATION_ID) 230 && 231 !radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID, 232 (u8 *) buf, os_strlen(buf))) { 233 printf("Could not add Calling-Station-Id\n"); 234 goto fail; 235 } 236 237 /* TODO: should probably check MTU from driver config; 2304 is max for 238 * IEEE 802.11, but use 1400 to avoid problems with too large packets 239 */ 240 if (!find_extra_attr(e->extra_attrs, RADIUS_ATTR_FRAMED_MTU) && 241 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) { 242 printf("Could not add Framed-MTU\n"); 243 goto fail; 244 } 245 246 if (!find_extra_attr(e->extra_attrs, RADIUS_ATTR_NAS_PORT_TYPE) && 247 !radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE, 248 RADIUS_NAS_PORT_TYPE_IEEE_802_11)) { 249 printf("Could not add NAS-Port-Type\n"); 250 goto fail; 251 } 252 253 os_snprintf(buf, sizeof(buf), "%s", e->connect_info); 254 if (!find_extra_attr(e->extra_attrs, RADIUS_ATTR_CONNECT_INFO) && 255 !radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO, 256 (u8 *) buf, os_strlen(buf))) { 257 printf("Could not add Connect-Info\n"); 258 goto fail; 259 } 260 261 if (add_extra_attrs(msg, e->extra_attrs) < 0) 262 goto fail; 263 264 if (eap && !radius_msg_add_eap(msg, eap, len)) { 265 printf("Could not add EAP-Message\n"); 266 goto fail; 267 } 268 269 /* State attribute must be copied if and only if this packet is 270 * Access-Request reply to the previous Access-Challenge */ 271 if (e->last_recv_radius && 272 radius_msg_get_hdr(e->last_recv_radius)->code == 273 RADIUS_CODE_ACCESS_CHALLENGE) { 274 int res = radius_msg_copy_attr(msg, e->last_recv_radius, 275 RADIUS_ATTR_STATE); 276 if (res < 0) { 277 printf("Could not copy State attribute from previous " 278 "Access-Challenge\n"); 279 goto fail; 280 } 281 if (res > 0) { 282 wpa_printf(MSG_DEBUG, " Copied RADIUS State " 283 "Attribute"); 284 } 285 } 286 287 if (radius_client_send(e->radius, msg, RADIUS_AUTH, e->wpa_s->own_addr) 288 < 0) 289 goto fail; 290 return; 291 292 fail: 293 radius_msg_free(msg); 294 } 295 296 297 static int eapol_test_eapol_send(void *ctx, int type, const u8 *buf, 298 size_t len) 299 { 300 printf("WPA: eapol_test_eapol_send(type=%d len=%lu)\n", 301 type, (unsigned long) len); 302 if (type == IEEE802_1X_TYPE_EAP_PACKET) { 303 wpa_hexdump(MSG_DEBUG, "TX EAP -> RADIUS", buf, len); 304 ieee802_1x_encapsulate_radius(&eapol_test, buf, len); 305 } 306 return 0; 307 } 308 309 310 static void eapol_test_set_config_blob(void *ctx, 311 struct wpa_config_blob *blob) 312 { 313 struct eapol_test_data *e = ctx; 314 wpa_config_set_blob(e->wpa_s->conf, blob); 315 } 316 317 318 static const struct wpa_config_blob * 319 eapol_test_get_config_blob(void *ctx, const char *name) 320 { 321 struct eapol_test_data *e = ctx; 322 return wpa_config_get_blob(e->wpa_s->conf, name); 323 } 324 325 326 static void eapol_test_eapol_done_cb(void *ctx) 327 { 328 printf("WPA: EAPOL processing complete\n"); 329 } 330 331 332 static void eapol_sm_reauth(void *eloop_ctx, void *timeout_ctx) 333 { 334 struct eapol_test_data *e = eloop_ctx; 335 printf("\n\n\n\n\neapol_test: Triggering EAP reauthentication\n\n"); 336 e->radius_access_accept_received = 0; 337 send_eap_request_identity(e->wpa_s, NULL); 338 } 339 340 341 static int eapol_test_compare_pmk(struct eapol_test_data *e) 342 { 343 u8 pmk[PMK_LEN]; 344 int ret = 1; 345 346 if (eapol_sm_get_key(e->wpa_s->eapol, pmk, PMK_LEN) == 0) { 347 wpa_hexdump(MSG_DEBUG, "PMK from EAPOL", pmk, PMK_LEN); 348 if (os_memcmp(pmk, e->authenticator_pmk, PMK_LEN) != 0) { 349 printf("WARNING: PMK mismatch\n"); 350 wpa_hexdump(MSG_DEBUG, "PMK from AS", 351 e->authenticator_pmk, PMK_LEN); 352 } else if (e->radius_access_accept_received) 353 ret = 0; 354 } else if (e->authenticator_pmk_len == 16 && 355 eapol_sm_get_key(e->wpa_s->eapol, pmk, 16) == 0) { 356 wpa_hexdump(MSG_DEBUG, "LEAP PMK from EAPOL", pmk, 16); 357 if (os_memcmp(pmk, e->authenticator_pmk, 16) != 0) { 358 printf("WARNING: PMK mismatch\n"); 359 wpa_hexdump(MSG_DEBUG, "PMK from AS", 360 e->authenticator_pmk, 16); 361 } else if (e->radius_access_accept_received) 362 ret = 0; 363 } else if (e->radius_access_accept_received && e->no_mppe_keys) { 364 /* No keying material expected */ 365 ret = 0; 366 } 367 368 if (ret && !e->no_mppe_keys) 369 e->num_mppe_mismatch++; 370 else if (!e->no_mppe_keys) 371 e->num_mppe_ok++; 372 373 return ret; 374 } 375 376 377 static void eapol_sm_cb(struct eapol_sm *eapol, int success, void *ctx) 378 { 379 struct eapol_test_data *e = ctx; 380 printf("eapol_sm_cb: success=%d\n", success); 381 e->eapol_test_num_reauths--; 382 if (e->eapol_test_num_reauths < 0) 383 eloop_terminate(); 384 else { 385 eapol_test_compare_pmk(e); 386 eloop_register_timeout(0, 100000, eapol_sm_reauth, e, NULL); 387 } 388 } 389 390 391 static void eapol_test_write_cert(FILE *f, const char *subject, 392 const struct wpabuf *cert) 393 { 394 unsigned char *encoded; 395 396 encoded = base64_encode(wpabuf_head(cert), wpabuf_len(cert), NULL); 397 if (encoded == NULL) 398 return; 399 fprintf(f, "%s\n-----BEGIN CERTIFICATE-----\n%s" 400 "-----END CERTIFICATE-----\n\n", subject, encoded); 401 os_free(encoded); 402 } 403 404 405 static void eapol_test_cert_cb(void *ctx, int depth, const char *subject, 406 const char *cert_hash, 407 const struct wpabuf *cert) 408 { 409 struct eapol_test_data *e = ctx; 410 411 wpa_msg(e->wpa_s, MSG_INFO, WPA_EVENT_EAP_PEER_CERT 412 "depth=%d subject='%s'%s%s", 413 depth, subject, 414 cert_hash ? " hash=" : "", 415 cert_hash ? cert_hash : ""); 416 417 if (cert) { 418 char *cert_hex; 419 size_t len = wpabuf_len(cert) * 2 + 1; 420 cert_hex = os_malloc(len); 421 if (cert_hex) { 422 wpa_snprintf_hex(cert_hex, len, wpabuf_head(cert), 423 wpabuf_len(cert)); 424 wpa_msg_ctrl(e->wpa_s, MSG_INFO, 425 WPA_EVENT_EAP_PEER_CERT 426 "depth=%d subject='%s' cert=%s", 427 depth, subject, cert_hex); 428 os_free(cert_hex); 429 } 430 431 if (e->server_cert_file) 432 eapol_test_write_cert(e->server_cert_file, 433 subject, cert); 434 } 435 } 436 437 438 static int test_eapol(struct eapol_test_data *e, struct wpa_supplicant *wpa_s, 439 struct wpa_ssid *ssid) 440 { 441 struct eapol_config eapol_conf; 442 struct eapol_ctx *ctx; 443 444 ctx = os_zalloc(sizeof(*ctx)); 445 if (ctx == NULL) { 446 printf("Failed to allocate EAPOL context.\n"); 447 return -1; 448 } 449 ctx->ctx = e; 450 ctx->msg_ctx = wpa_s; 451 ctx->scard_ctx = wpa_s->scard; 452 ctx->cb = eapol_sm_cb; 453 ctx->cb_ctx = e; 454 ctx->eapol_send_ctx = wpa_s; 455 ctx->preauth = 0; 456 ctx->eapol_done_cb = eapol_test_eapol_done_cb; 457 ctx->eapol_send = eapol_test_eapol_send; 458 ctx->set_config_blob = eapol_test_set_config_blob; 459 ctx->get_config_blob = eapol_test_get_config_blob; 460 ctx->opensc_engine_path = wpa_s->conf->opensc_engine_path; 461 ctx->pkcs11_engine_path = wpa_s->conf->pkcs11_engine_path; 462 ctx->pkcs11_module_path = wpa_s->conf->pkcs11_module_path; 463 ctx->cert_cb = eapol_test_cert_cb; 464 ctx->cert_in_cb = 1; 465 466 wpa_s->eapol = eapol_sm_init(ctx); 467 if (wpa_s->eapol == NULL) { 468 os_free(ctx); 469 printf("Failed to initialize EAPOL state machines.\n"); 470 return -1; 471 } 472 473 wpa_s->current_ssid = ssid; 474 os_memset(&eapol_conf, 0, sizeof(eapol_conf)); 475 eapol_conf.accept_802_1x_keys = 1; 476 eapol_conf.required_keys = 0; 477 eapol_conf.fast_reauth = wpa_s->conf->fast_reauth; 478 eapol_conf.workaround = ssid->eap_workaround; 479 eapol_sm_notify_config(wpa_s->eapol, &ssid->eap, &eapol_conf); 480 eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard); 481 482 483 eapol_sm_notify_portValid(wpa_s->eapol, FALSE); 484 /* 802.1X::portControl = Auto */ 485 eapol_sm_notify_portEnabled(wpa_s->eapol, TRUE); 486 487 return 0; 488 } 489 490 491 static void test_eapol_clean(struct eapol_test_data *e, 492 struct wpa_supplicant *wpa_s) 493 { 494 struct extra_radius_attr *p, *prev; 495 496 radius_client_deinit(e->radius); 497 os_free(e->last_eap_radius); 498 radius_msg_free(e->last_recv_radius); 499 e->last_recv_radius = NULL; 500 os_free(e->eap_identity); 501 e->eap_identity = NULL; 502 eapol_sm_deinit(wpa_s->eapol); 503 wpa_s->eapol = NULL; 504 if (e->radius_conf && e->radius_conf->auth_server) { 505 os_free(e->radius_conf->auth_server->shared_secret); 506 os_free(e->radius_conf->auth_server); 507 } 508 os_free(e->radius_conf); 509 e->radius_conf = NULL; 510 scard_deinit(wpa_s->scard); 511 if (wpa_s->ctrl_iface) { 512 wpa_supplicant_ctrl_iface_deinit(wpa_s->ctrl_iface); 513 wpa_s->ctrl_iface = NULL; 514 } 515 wpa_config_free(wpa_s->conf); 516 517 p = e->extra_attrs; 518 while (p) { 519 prev = p; 520 p = p->next; 521 os_free(prev); 522 } 523 } 524 525 526 static void send_eap_request_identity(void *eloop_ctx, void *timeout_ctx) 527 { 528 struct wpa_supplicant *wpa_s = eloop_ctx; 529 u8 buf[100], *pos; 530 struct ieee802_1x_hdr *hdr; 531 struct eap_hdr *eap; 532 533 hdr = (struct ieee802_1x_hdr *) buf; 534 hdr->version = EAPOL_VERSION; 535 hdr->type = IEEE802_1X_TYPE_EAP_PACKET; 536 hdr->length = htons(5); 537 538 eap = (struct eap_hdr *) (hdr + 1); 539 eap->code = EAP_CODE_REQUEST; 540 eap->identifier = 0; 541 eap->length = htons(5); 542 pos = (u8 *) (eap + 1); 543 *pos = EAP_TYPE_IDENTITY; 544 545 printf("Sending fake EAP-Request-Identity\n"); 546 eapol_sm_rx_eapol(wpa_s->eapol, wpa_s->bssid, buf, 547 sizeof(*hdr) + 5); 548 } 549 550 551 static void eapol_test_timeout(void *eloop_ctx, void *timeout_ctx) 552 { 553 struct eapol_test_data *e = eloop_ctx; 554 printf("EAPOL test timed out\n"); 555 e->auth_timed_out = 1; 556 eloop_terminate(); 557 } 558 559 560 static char *eap_type_text(u8 type) 561 { 562 switch (type) { 563 case EAP_TYPE_IDENTITY: return "Identity"; 564 case EAP_TYPE_NOTIFICATION: return "Notification"; 565 case EAP_TYPE_NAK: return "Nak"; 566 case EAP_TYPE_TLS: return "TLS"; 567 case EAP_TYPE_TTLS: return "TTLS"; 568 case EAP_TYPE_PEAP: return "PEAP"; 569 case EAP_TYPE_SIM: return "SIM"; 570 case EAP_TYPE_GTC: return "GTC"; 571 case EAP_TYPE_MD5: return "MD5"; 572 case EAP_TYPE_OTP: return "OTP"; 573 case EAP_TYPE_FAST: return "FAST"; 574 case EAP_TYPE_SAKE: return "SAKE"; 575 case EAP_TYPE_PSK: return "PSK"; 576 default: return "Unknown"; 577 } 578 } 579 580 581 static void ieee802_1x_decapsulate_radius(struct eapol_test_data *e) 582 { 583 u8 *eap; 584 size_t len; 585 struct eap_hdr *hdr; 586 int eap_type = -1; 587 char buf[64]; 588 struct radius_msg *msg; 589 590 if (e->last_recv_radius == NULL) 591 return; 592 593 msg = e->last_recv_radius; 594 595 eap = radius_msg_get_eap(msg, &len); 596 if (eap == NULL) { 597 /* draft-aboba-radius-rfc2869bis-20.txt, Chap. 2.6.3: 598 * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message 599 * attribute */ 600 wpa_printf(MSG_DEBUG, "could not extract " 601 "EAP-Message from RADIUS message"); 602 os_free(e->last_eap_radius); 603 e->last_eap_radius = NULL; 604 e->last_eap_radius_len = 0; 605 return; 606 } 607 608 if (len < sizeof(*hdr)) { 609 wpa_printf(MSG_DEBUG, "too short EAP packet " 610 "received from authentication server"); 611 os_free(eap); 612 return; 613 } 614 615 if (len > sizeof(*hdr)) 616 eap_type = eap[sizeof(*hdr)]; 617 618 hdr = (struct eap_hdr *) eap; 619 switch (hdr->code) { 620 case EAP_CODE_REQUEST: 621 os_snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)", 622 eap_type >= 0 ? eap_type_text(eap_type) : "??", 623 eap_type); 624 break; 625 case EAP_CODE_RESPONSE: 626 os_snprintf(buf, sizeof(buf), "EAP Response-%s (%d)", 627 eap_type >= 0 ? eap_type_text(eap_type) : "??", 628 eap_type); 629 break; 630 case EAP_CODE_SUCCESS: 631 os_strlcpy(buf, "EAP Success", sizeof(buf)); 632 /* LEAP uses EAP Success within an authentication, so must not 633 * stop here with eloop_terminate(); */ 634 break; 635 case EAP_CODE_FAILURE: 636 os_strlcpy(buf, "EAP Failure", sizeof(buf)); 637 eloop_terminate(); 638 break; 639 default: 640 os_strlcpy(buf, "unknown EAP code", sizeof(buf)); 641 wpa_hexdump(MSG_DEBUG, "Decapsulated EAP packet", eap, len); 642 break; 643 } 644 wpa_printf(MSG_DEBUG, "decapsulated EAP packet (code=%d " 645 "id=%d len=%d) from RADIUS server: %s", 646 hdr->code, hdr->identifier, ntohs(hdr->length), buf); 647 648 /* sta->eapol_sm->be_auth.idFromServer = hdr->identifier; */ 649 650 os_free(e->last_eap_radius); 651 e->last_eap_radius = eap; 652 e->last_eap_radius_len = len; 653 654 { 655 struct ieee802_1x_hdr *dot1x; 656 dot1x = os_malloc(sizeof(*dot1x) + len); 657 assert(dot1x != NULL); 658 dot1x->version = EAPOL_VERSION; 659 dot1x->type = IEEE802_1X_TYPE_EAP_PACKET; 660 dot1x->length = htons(len); 661 os_memcpy((u8 *) (dot1x + 1), eap, len); 662 eapol_sm_rx_eapol(e->wpa_s->eapol, e->wpa_s->bssid, 663 (u8 *) dot1x, sizeof(*dot1x) + len); 664 os_free(dot1x); 665 } 666 } 667 668 669 static void ieee802_1x_get_keys(struct eapol_test_data *e, 670 struct radius_msg *msg, struct radius_msg *req, 671 const u8 *shared_secret, 672 size_t shared_secret_len) 673 { 674 struct radius_ms_mppe_keys *keys; 675 676 keys = radius_msg_get_ms_keys(msg, req, shared_secret, 677 shared_secret_len); 678 if (keys && keys->send == NULL && keys->recv == NULL) { 679 os_free(keys); 680 keys = radius_msg_get_cisco_keys(msg, req, shared_secret, 681 shared_secret_len); 682 } 683 684 if (keys) { 685 if (keys->send) { 686 wpa_hexdump(MSG_DEBUG, "MS-MPPE-Send-Key (sign)", 687 keys->send, keys->send_len); 688 } 689 if (keys->recv) { 690 wpa_hexdump(MSG_DEBUG, "MS-MPPE-Recv-Key (crypt)", 691 keys->recv, keys->recv_len); 692 e->authenticator_pmk_len = 693 keys->recv_len > PMK_LEN ? PMK_LEN : 694 keys->recv_len; 695 os_memcpy(e->authenticator_pmk, keys->recv, 696 e->authenticator_pmk_len); 697 if (e->authenticator_pmk_len == 16 && keys->send && 698 keys->send_len == 16) { 699 /* MS-CHAP-v2 derives 16 octet keys */ 700 wpa_printf(MSG_DEBUG, "Use MS-MPPE-Send-Key " 701 "to extend PMK to 32 octets"); 702 os_memcpy(e->authenticator_pmk + 703 e->authenticator_pmk_len, 704 keys->send, keys->send_len); 705 e->authenticator_pmk_len += keys->send_len; 706 } 707 } 708 709 os_free(keys->send); 710 os_free(keys->recv); 711 os_free(keys); 712 } 713 } 714 715 716 /* Process the RADIUS frames from Authentication Server */ 717 static RadiusRxResult 718 ieee802_1x_receive_auth(struct radius_msg *msg, struct radius_msg *req, 719 const u8 *shared_secret, size_t shared_secret_len, 720 void *data) 721 { 722 struct eapol_test_data *e = data; 723 struct radius_hdr *hdr = radius_msg_get_hdr(msg); 724 725 /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be 726 * present when packet contains an EAP-Message attribute */ 727 if (hdr->code == RADIUS_CODE_ACCESS_REJECT && 728 radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL, 729 0) < 0 && 730 radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) { 731 wpa_printf(MSG_DEBUG, "Allowing RADIUS " 732 "Access-Reject without Message-Authenticator " 733 "since it does not include EAP-Message\n"); 734 } else if (radius_msg_verify(msg, shared_secret, shared_secret_len, 735 req, 1)) { 736 printf("Incoming RADIUS packet did not have correct " 737 "Message-Authenticator - dropped\n"); 738 return RADIUS_RX_UNKNOWN; 739 } 740 741 if (hdr->code != RADIUS_CODE_ACCESS_ACCEPT && 742 hdr->code != RADIUS_CODE_ACCESS_REJECT && 743 hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) { 744 printf("Unknown RADIUS message code\n"); 745 return RADIUS_RX_UNKNOWN; 746 } 747 748 e->radius_identifier = -1; 749 wpa_printf(MSG_DEBUG, "RADIUS packet matching with station"); 750 751 radius_msg_free(e->last_recv_radius); 752 e->last_recv_radius = msg; 753 754 switch (hdr->code) { 755 case RADIUS_CODE_ACCESS_ACCEPT: 756 e->radius_access_accept_received = 1; 757 ieee802_1x_get_keys(e, msg, req, shared_secret, 758 shared_secret_len); 759 break; 760 case RADIUS_CODE_ACCESS_REJECT: 761 e->radius_access_reject_received = 1; 762 break; 763 } 764 765 ieee802_1x_decapsulate_radius(e); 766 767 if ((hdr->code == RADIUS_CODE_ACCESS_ACCEPT && 768 e->eapol_test_num_reauths < 0) || 769 hdr->code == RADIUS_CODE_ACCESS_REJECT) { 770 eloop_terminate(); 771 } 772 773 return RADIUS_RX_QUEUED; 774 } 775 776 777 static void wpa_init_conf(struct eapol_test_data *e, 778 struct wpa_supplicant *wpa_s, const char *authsrv, 779 int port, const char *secret, 780 const char *cli_addr) 781 { 782 struct hostapd_radius_server *as; 783 int res; 784 785 wpa_s->bssid[5] = 1; 786 os_memcpy(wpa_s->own_addr, e->own_addr, ETH_ALEN); 787 e->own_ip_addr.s_addr = htonl((127 << 24) | 1); 788 os_strlcpy(wpa_s->ifname, "test", sizeof(wpa_s->ifname)); 789 790 e->radius_conf = os_zalloc(sizeof(struct hostapd_radius_servers)); 791 assert(e->radius_conf != NULL); 792 e->radius_conf->num_auth_servers = 1; 793 as = os_zalloc(sizeof(struct hostapd_radius_server)); 794 assert(as != NULL); 795 #if defined(CONFIG_NATIVE_WINDOWS) || defined(CONFIG_ANSI_C_EXTRA) 796 { 797 int a[4]; 798 u8 *pos; 799 sscanf(authsrv, "%d.%d.%d.%d", &a[0], &a[1], &a[2], &a[3]); 800 pos = (u8 *) &as->addr.u.v4; 801 *pos++ = a[0]; 802 *pos++ = a[1]; 803 *pos++ = a[2]; 804 *pos++ = a[3]; 805 } 806 #else /* CONFIG_NATIVE_WINDOWS or CONFIG_ANSI_C_EXTRA */ 807 inet_aton(authsrv, &as->addr.u.v4); 808 #endif /* CONFIG_NATIVE_WINDOWS or CONFIG_ANSI_C_EXTRA */ 809 as->addr.af = AF_INET; 810 as->port = port; 811 as->shared_secret = (u8 *) os_strdup(secret); 812 as->shared_secret_len = os_strlen(secret); 813 e->radius_conf->auth_server = as; 814 e->radius_conf->auth_servers = as; 815 e->radius_conf->msg_dumps = 1; 816 if (cli_addr) { 817 if (hostapd_parse_ip_addr(cli_addr, 818 &e->radius_conf->client_addr) == 0) 819 e->radius_conf->force_client_addr = 1; 820 else { 821 wpa_printf(MSG_ERROR, "Invalid IP address '%s'", 822 cli_addr); 823 assert(0); 824 } 825 } 826 827 e->radius = radius_client_init(wpa_s, e->radius_conf); 828 assert(e->radius != NULL); 829 830 res = radius_client_register(e->radius, RADIUS_AUTH, 831 ieee802_1x_receive_auth, e); 832 assert(res == 0); 833 } 834 835 836 static int scard_test(void) 837 { 838 struct scard_data *scard; 839 size_t len; 840 char imsi[20]; 841 unsigned char _rand[16]; 842 #ifdef PCSC_FUNCS 843 unsigned char sres[4]; 844 unsigned char kc[8]; 845 #endif /* PCSC_FUNCS */ 846 #define num_triplets 5 847 unsigned char rand_[num_triplets][16]; 848 unsigned char sres_[num_triplets][4]; 849 unsigned char kc_[num_triplets][8]; 850 int i, res; 851 size_t j; 852 853 #define AKA_RAND_LEN 16 854 #define AKA_AUTN_LEN 16 855 #define AKA_AUTS_LEN 14 856 #define RES_MAX_LEN 16 857 #define IK_LEN 16 858 #define CK_LEN 16 859 unsigned char aka_rand[AKA_RAND_LEN]; 860 unsigned char aka_autn[AKA_AUTN_LEN]; 861 unsigned char aka_auts[AKA_AUTS_LEN]; 862 unsigned char aka_res[RES_MAX_LEN]; 863 size_t aka_res_len; 864 unsigned char aka_ik[IK_LEN]; 865 unsigned char aka_ck[CK_LEN]; 866 867 scard = scard_init(SCARD_TRY_BOTH); 868 if (scard == NULL) 869 return -1; 870 if (scard_set_pin(scard, "1234")) { 871 wpa_printf(MSG_WARNING, "PIN validation failed"); 872 scard_deinit(scard); 873 return -1; 874 } 875 876 len = sizeof(imsi); 877 if (scard_get_imsi(scard, imsi, &len)) 878 goto failed; 879 wpa_hexdump_ascii(MSG_DEBUG, "SCARD: IMSI", (u8 *) imsi, len); 880 /* NOTE: Permanent Username: 1 | IMSI */ 881 882 os_memset(_rand, 0, sizeof(_rand)); 883 if (scard_gsm_auth(scard, _rand, sres, kc)) 884 goto failed; 885 886 os_memset(_rand, 0xff, sizeof(_rand)); 887 if (scard_gsm_auth(scard, _rand, sres, kc)) 888 goto failed; 889 890 for (i = 0; i < num_triplets; i++) { 891 os_memset(rand_[i], i, sizeof(rand_[i])); 892 if (scard_gsm_auth(scard, rand_[i], sres_[i], kc_[i])) 893 goto failed; 894 } 895 896 for (i = 0; i < num_triplets; i++) { 897 printf("1"); 898 for (j = 0; j < len; j++) 899 printf("%c", imsi[j]); 900 printf(","); 901 for (j = 0; j < 16; j++) 902 printf("%02X", rand_[i][j]); 903 printf(","); 904 for (j = 0; j < 4; j++) 905 printf("%02X", sres_[i][j]); 906 printf(","); 907 for (j = 0; j < 8; j++) 908 printf("%02X", kc_[i][j]); 909 printf("\n"); 910 } 911 912 wpa_printf(MSG_DEBUG, "Trying to use UMTS authentication"); 913 914 /* seq 39 (0x28) */ 915 os_memset(aka_rand, 0xaa, 16); 916 os_memcpy(aka_autn, "\x86\x71\x31\xcb\xa2\xfc\x61\xdf" 917 "\xa3\xb3\x97\x9d\x07\x32\xa2\x12", 16); 918 919 res = scard_umts_auth(scard, aka_rand, aka_autn, aka_res, &aka_res_len, 920 aka_ik, aka_ck, aka_auts); 921 if (res == 0) { 922 wpa_printf(MSG_DEBUG, "UMTS auth completed successfully"); 923 wpa_hexdump(MSG_DEBUG, "RES", aka_res, aka_res_len); 924 wpa_hexdump(MSG_DEBUG, "IK", aka_ik, IK_LEN); 925 wpa_hexdump(MSG_DEBUG, "CK", aka_ck, CK_LEN); 926 } else if (res == -2) { 927 wpa_printf(MSG_DEBUG, "UMTS auth resulted in synchronization " 928 "failure"); 929 wpa_hexdump(MSG_DEBUG, "AUTS", aka_auts, AKA_AUTS_LEN); 930 } else { 931 wpa_printf(MSG_DEBUG, "UMTS auth failed"); 932 } 933 934 failed: 935 scard_deinit(scard); 936 937 return 0; 938 #undef num_triplets 939 } 940 941 942 static int scard_get_triplets(int argc, char *argv[]) 943 { 944 struct scard_data *scard; 945 size_t len; 946 char imsi[20]; 947 unsigned char _rand[16]; 948 unsigned char sres[4]; 949 unsigned char kc[8]; 950 int num_triplets; 951 int i; 952 size_t j; 953 954 if (argc < 2 || ((num_triplets = atoi(argv[1])) <= 0)) { 955 printf("invalid parameters for sim command\n"); 956 return -1; 957 } 958 959 if (argc <= 2 || os_strcmp(argv[2], "debug") != 0) { 960 /* disable debug output */ 961 wpa_debug_level = 99; 962 } 963 964 scard = scard_init(SCARD_GSM_SIM_ONLY); 965 if (scard == NULL) { 966 printf("Failed to open smartcard connection\n"); 967 return -1; 968 } 969 if (scard_set_pin(scard, argv[0])) { 970 wpa_printf(MSG_WARNING, "PIN validation failed"); 971 scard_deinit(scard); 972 return -1; 973 } 974 975 len = sizeof(imsi); 976 if (scard_get_imsi(scard, imsi, &len)) { 977 scard_deinit(scard); 978 return -1; 979 } 980 981 for (i = 0; i < num_triplets; i++) { 982 os_memset(_rand, i, sizeof(_rand)); 983 if (scard_gsm_auth(scard, _rand, sres, kc)) 984 break; 985 986 /* IMSI:Kc:SRES:RAND */ 987 for (j = 0; j < len; j++) 988 printf("%c", imsi[j]); 989 printf(":"); 990 for (j = 0; j < 8; j++) 991 printf("%02X", kc[j]); 992 printf(":"); 993 for (j = 0; j < 4; j++) 994 printf("%02X", sres[j]); 995 printf(":"); 996 for (j = 0; j < 16; j++) 997 printf("%02X", _rand[j]); 998 printf("\n"); 999 } 1000 1001 scard_deinit(scard); 1002 1003 return 0; 1004 } 1005 1006 1007 static void eapol_test_terminate(int sig, void *signal_ctx) 1008 { 1009 struct wpa_supplicant *wpa_s = signal_ctx; 1010 wpa_msg(wpa_s, MSG_INFO, "Signal %d received - terminating", sig); 1011 eloop_terminate(); 1012 } 1013 1014 1015 static void usage(void) 1016 { 1017 printf("usage:\n" 1018 "eapol_test [-nWS] -c<conf> [-a<AS IP>] [-p<AS port>] " 1019 "[-s<AS secret>]\\\n" 1020 " [-r<count>] [-t<timeout>] [-C<Connect-Info>] \\\n" 1021 " [-M<client MAC address>] [-o<server cert file] \\\n" 1022 " [-N<attr spec>] \\\n" 1023 " [-A<client IP>]\n" 1024 "eapol_test scard\n" 1025 "eapol_test sim <PIN> <num triplets> [debug]\n" 1026 "\n"); 1027 printf("options:\n" 1028 " -c<conf> = configuration file\n" 1029 " -a<AS IP> = IP address of the authentication server, " 1030 "default 127.0.0.1\n" 1031 " -p<AS port> = UDP port of the authentication server, " 1032 "default 1812\n" 1033 " -s<AS secret> = shared secret with the authentication " 1034 "server, default 'radius'\n" 1035 " -A<client IP> = IP address of the client, default: select " 1036 "automatically\n" 1037 " -r<count> = number of re-authentications\n" 1038 " -W = wait for a control interface monitor before starting\n" 1039 " -S = save configuration after authentication\n" 1040 " -n = no MPPE keys expected\n" 1041 " -t<timeout> = sets timeout in seconds (default: 30 s)\n" 1042 " -C<Connect-Info> = RADIUS Connect-Info (default: " 1043 "CONNECT 11Mbps 802.11b)\n" 1044 " -M<client MAC address> = Set own MAC address " 1045 "(Calling-Station-Id,\n" 1046 " default: 02:00:00:00:00:01)\n" 1047 " -o<server cert file> = Write received server certificate\n" 1048 " chain to the specified file\n" 1049 " -N<attr spec> = send arbitrary attribute specified by:\n" 1050 " attr_id:syntax:value or attr_id\n" 1051 " attr_id - number id of the attribute\n" 1052 " syntax - one of: s, d, x\n" 1053 " s = string\n" 1054 " d = integer\n" 1055 " x = octet string\n" 1056 " value - attribute value.\n" 1057 " When only attr_id is specified, NULL will be used as " 1058 "value.\n" 1059 " Multiple attributes can be specified by using the " 1060 "option several times.\n"); 1061 } 1062 1063 1064 int main(int argc, char *argv[]) 1065 { 1066 struct wpa_supplicant wpa_s; 1067 int c, ret = 1, wait_for_monitor = 0, save_config = 0; 1068 char *as_addr = "127.0.0.1"; 1069 int as_port = 1812; 1070 char *as_secret = "radius"; 1071 char *cli_addr = NULL; 1072 char *conf = NULL; 1073 int timeout = 30; 1074 char *pos; 1075 struct extra_radius_attr *p = NULL, *p1; 1076 1077 if (os_program_init()) 1078 return -1; 1079 1080 hostapd_logger_register_cb(hostapd_logger_cb); 1081 1082 os_memset(&eapol_test, 0, sizeof(eapol_test)); 1083 eapol_test.connect_info = "CONNECT 11Mbps 802.11b"; 1084 os_memcpy(eapol_test.own_addr, "\x02\x00\x00\x00\x00\x01", ETH_ALEN); 1085 1086 wpa_debug_level = 0; 1087 wpa_debug_show_keys = 1; 1088 1089 for (;;) { 1090 c = getopt(argc, argv, "a:A:c:C:M:nN:o:p:r:s:St:W"); 1091 if (c < 0) 1092 break; 1093 switch (c) { 1094 case 'a': 1095 as_addr = optarg; 1096 break; 1097 case 'A': 1098 cli_addr = optarg; 1099 break; 1100 case 'c': 1101 conf = optarg; 1102 break; 1103 case 'C': 1104 eapol_test.connect_info = optarg; 1105 break; 1106 case 'M': 1107 if (hwaddr_aton(optarg, eapol_test.own_addr)) { 1108 usage(); 1109 return -1; 1110 } 1111 break; 1112 case 'n': 1113 eapol_test.no_mppe_keys++; 1114 break; 1115 case 'o': 1116 if (eapol_test.server_cert_file) 1117 fclose(eapol_test.server_cert_file); 1118 eapol_test.server_cert_file = fopen(optarg, "w"); 1119 if (eapol_test.server_cert_file == NULL) { 1120 printf("Could not open '%s' for writing\n", 1121 optarg); 1122 return -1; 1123 } 1124 break; 1125 case 'p': 1126 as_port = atoi(optarg); 1127 break; 1128 case 'r': 1129 eapol_test.eapol_test_num_reauths = atoi(optarg); 1130 break; 1131 case 's': 1132 as_secret = optarg; 1133 break; 1134 case 'S': 1135 save_config++; 1136 break; 1137 case 't': 1138 timeout = atoi(optarg); 1139 break; 1140 case 'W': 1141 wait_for_monitor++; 1142 break; 1143 case 'N': 1144 p1 = os_zalloc(sizeof(p1)); 1145 if (p1 == NULL) 1146 break; 1147 if (!p) 1148 eapol_test.extra_attrs = p1; 1149 else 1150 p->next = p1; 1151 p = p1; 1152 1153 p->type = atoi(optarg); 1154 pos = os_strchr(optarg, ':'); 1155 if (pos == NULL) { 1156 p->syntax = 'n'; 1157 p->data = NULL; 1158 break; 1159 } 1160 1161 pos++; 1162 if (pos[0] == '\0' || pos[1] != ':') { 1163 printf("Incorrect format of attribute " 1164 "specification\n"); 1165 break; 1166 } 1167 1168 p->syntax = pos[0]; 1169 p->data = pos + 2; 1170 break; 1171 default: 1172 usage(); 1173 return -1; 1174 } 1175 } 1176 1177 if (argc > optind && os_strcmp(argv[optind], "scard") == 0) { 1178 return scard_test(); 1179 } 1180 1181 if (argc > optind && os_strcmp(argv[optind], "sim") == 0) { 1182 return scard_get_triplets(argc - optind - 1, 1183 &argv[optind + 1]); 1184 } 1185 1186 if (conf == NULL) { 1187 usage(); 1188 printf("Configuration file is required.\n"); 1189 return -1; 1190 } 1191 1192 if (eap_register_methods()) { 1193 wpa_printf(MSG_ERROR, "Failed to register EAP methods"); 1194 return -1; 1195 } 1196 1197 if (eloop_init()) { 1198 wpa_printf(MSG_ERROR, "Failed to initialize event loop"); 1199 return -1; 1200 } 1201 1202 os_memset(&wpa_s, 0, sizeof(wpa_s)); 1203 eapol_test.wpa_s = &wpa_s; 1204 wpa_s.conf = wpa_config_read(conf); 1205 if (wpa_s.conf == NULL) { 1206 printf("Failed to parse configuration file '%s'.\n", conf); 1207 return -1; 1208 } 1209 if (wpa_s.conf->ssid == NULL) { 1210 printf("No networks defined.\n"); 1211 return -1; 1212 } 1213 1214 wpa_init_conf(&eapol_test, &wpa_s, as_addr, as_port, as_secret, 1215 cli_addr); 1216 wpa_s.ctrl_iface = wpa_supplicant_ctrl_iface_init(&wpa_s); 1217 if (wpa_s.ctrl_iface == NULL) { 1218 printf("Failed to initialize control interface '%s'.\n" 1219 "You may have another eapol_test process already " 1220 "running or the file was\n" 1221 "left by an unclean termination of eapol_test in " 1222 "which case you will need\n" 1223 "to manually remove this file before starting " 1224 "eapol_test again.\n", 1225 wpa_s.conf->ctrl_interface); 1226 return -1; 1227 } 1228 if (wpa_supplicant_scard_init(&wpa_s, wpa_s.conf->ssid)) 1229 return -1; 1230 1231 if (test_eapol(&eapol_test, &wpa_s, wpa_s.conf->ssid)) 1232 return -1; 1233 1234 if (wait_for_monitor) 1235 wpa_supplicant_ctrl_iface_wait(wpa_s.ctrl_iface); 1236 1237 eloop_register_timeout(timeout, 0, eapol_test_timeout, &eapol_test, 1238 NULL); 1239 eloop_register_timeout(0, 0, send_eap_request_identity, &wpa_s, NULL); 1240 eloop_register_signal_terminate(eapol_test_terminate, &wpa_s); 1241 eloop_register_signal_reconfig(eapol_test_terminate, &wpa_s); 1242 eloop_run(); 1243 1244 eloop_cancel_timeout(eapol_test_timeout, &eapol_test, NULL); 1245 eloop_cancel_timeout(eapol_sm_reauth, &eapol_test, NULL); 1246 1247 if (eapol_test_compare_pmk(&eapol_test) == 0 || 1248 eapol_test.no_mppe_keys) 1249 ret = 0; 1250 if (eapol_test.auth_timed_out) 1251 ret = -2; 1252 if (eapol_test.radius_access_reject_received) 1253 ret = -3; 1254 1255 if (save_config) 1256 wpa_config_write(conf, wpa_s.conf); 1257 1258 test_eapol_clean(&eapol_test, &wpa_s); 1259 1260 eap_peer_unregister_methods(); 1261 #ifdef CONFIG_AP 1262 eap_server_unregister_methods(); 1263 #endif /* CONFIG_AP */ 1264 1265 eloop_destroy(); 1266 1267 if (eapol_test.server_cert_file) 1268 fclose(eapol_test.server_cert_file); 1269 1270 printf("MPPE keys OK: %d mismatch: %d\n", 1271 eapol_test.num_mppe_ok, eapol_test.num_mppe_mismatch); 1272 if (eapol_test.num_mppe_mismatch) 1273 ret = -4; 1274 if (ret) 1275 printf("FAILURE\n"); 1276 else 1277 printf("SUCCESS\n"); 1278 1279 os_program_deinit(); 1280 1281 return ret; 1282 } 1283
Indexes created Mon Mar 30 00:23:01 UTC 2026