contrib/wpa_supplicant/eapol_test.c

   1 /*
   2  * WPA Supplicant - test code
   3  * Copyright (c) 2003-2005, Jouni Malinen <jkmaline@cc.hut.fi>
   4  *
   5  * IEEE 802.1X Supplicant test code (to be used in place of wpa_supplicant.c.
   6  * Not used in production version.
   7  */
   8
   9 #include <stdio.h>
  10 #include <stdlib.h>
  11 #include <stdarg.h>
  12 #include <unistd.h>
  13 #include <ctype.h>
  14 #include <string.h>
  15 #include <signal.h>
  16 #include <netinet/in.h>
  17 #include <assert.h>
  18 #include <arpa/inet.h>
  19
  20 #include "common.h"
  21 #include "config.h"
  22 #include "eapol_sm.h"
  23 #include "eloop.h"
  24 #include "wpa.h"
  25 #include "eap_i.h"
  26 #include "wpa_supplicant.h"
  27 #include "wpa_supplicant_i.h"
  28 #include "radius.h"
  29 #include "radius_client.h"
  30 #include "l2_packet.h"
  31 #include "ctrl_iface.h"
  32 #include "pcsc_funcs.h"
  33
  34
  35 extern int wpa_debug_level;
  36 extern int wpa_debug_show_keys;
  37 static int eapol_test_num_reauths = 0;
  38 static int no_mppe_keys = 0;
  39 static int num_mppe_ok = 0, num_mppe_mismatch = 0;
  40
  41 static void send_eap_request_identity(void *eloop_ctx, void *timeout_ctx);
  42
  43
  44 void wpa_msg(struct wpa_supplicant *wpa_s, int level, char *fmt, ...)
  45 {
  46         va_list ap;
  47         char *buf;
  48         const int buflen = 2048;
  49         int len;
  50
  51         buf = malloc(buflen);
  52         if (buf == NULL) {
  53                 printf("Failed to allocate message buffer for:\n");
  54                 va_start(ap, fmt);
  55                 vprintf(fmt, ap);
  56                 printf("\n");
  57                 va_end(ap);
  58                 return;
  59         }
  60         va_start(ap, fmt);
  61         len = vsnprintf(buf, buflen, fmt, ap);
  62         va_end(ap);
  63         wpa_printf(level, "%s", buf);
  64         wpa_supplicant_ctrl_iface_send(wpa_s, level, buf, len);
  65         free(buf);
  66 }
  67
  68
  69 void wpa_supplicant_event(struct wpa_supplicant *wpa_s, wpa_event_type event,
  70                           union wpa_event_data *data)
  71 {
  72 }
  73
  74
  75 int rsn_preauth_init(struct wpa_supplicant *wpa_s, u8 *dst)
  76 {
  77         return -1;
  78 }
  79
  80
  81 void rsn_preauth_deinit(struct wpa_supplicant *wpa_s)
  82 {
  83 }
  84
  85
  86 int pmksa_cache_list(struct wpa_supplicant *wpa_s, char *buf, size_t len)
  87 {
  88         return 0;
  89 }
  90
  91
  92 int wpa_get_mib(struct wpa_supplicant *wpa_s, char *buf, size_t buflen)
  93 {
  94         return 0;
  95 }
  96
  97
  98 void wpa_supplicant_req_scan(struct wpa_supplicant *wpa_s, int sec, int usec)
  99 {
 100 }
 101
 102
 103 const char * wpa_ssid_txt(u8 *ssid, size_t ssid_len)
 104 {
 105         return NULL;
 106 }
 107
 108
 109 int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 110 {
 111         return -1;
 112 }
 113
 114
 115 static void ieee802_1x_encapsulate_radius(struct wpa_supplicant *wpa_s,
 116                                           u8 *eap, size_t len)
 117 {
 118         struct radius_msg *msg;
 119         char buf[128];
 120         struct eap_hdr *hdr;
 121         u8 *pos;
 122
 123         wpa_printf(MSG_DEBUG, "Encapsulating EAP message into a RADIUS "
 124                    "packet");
 125
 126         wpa_s->radius_identifier = radius_client_get_id(wpa_s);
 127         msg = radius_msg_new(RADIUS_CODE_ACCESS_REQUEST,
 128                              wpa_s->radius_identifier);
 129         if (msg == NULL) {
 130                 printf("Could not create net RADIUS packet\n");
 131                 return;
 132         }
 133
 134         radius_msg_make_authenticator(msg, (u8 *) wpa_s, sizeof(*wpa_s));
 135
 136         hdr = (struct eap_hdr *) eap;
 137         pos = (u8 *) (hdr + 1);
 138         if (len > sizeof(*hdr) && hdr->code == EAP_CODE_RESPONSE &&
 139             pos[0] == EAP_TYPE_IDENTITY) {
 140                 pos++;
 141                 free(wpa_s->eap_identity);
 142                 wpa_s->eap_identity_len = len - sizeof(*hdr) - 1;
 143                 wpa_s->eap_identity = malloc(wpa_s->eap_identity_len);
 144                 if (wpa_s->eap_identity) {
 145                         memcpy(wpa_s->eap_identity, pos,
 146                                wpa_s->eap_identity_len);
 147                         wpa_hexdump(MSG_DEBUG, "Learned identity from "
 148                                     "EAP-Response-Identity",
 149                                     wpa_s->eap_identity,
 150                                     wpa_s->eap_identity_len);
 151                 }
 152         }
 153
 154         if (wpa_s->eap_identity &&
 155             !radius_msg_add_attr(msg, RADIUS_ATTR_USER_NAME,
 156                                  wpa_s->eap_identity,
 157                                  wpa_s->eap_identity_len)) {
 158                 printf("Could not add User-Name\n");
 159                 goto fail;
 160         }
 161
 162         if (!radius_msg_add_attr(msg, RADIUS_ATTR_NAS_IP_ADDRESS,
 163                                  (u8 *) &wpa_s->own_ip_addr, 4)) {
 164                 printf("Could not add NAS-IP-Address\n");
 165                 goto fail;
 166         }
 167
 168         snprintf(buf, sizeof(buf), RADIUS_802_1X_ADDR_FORMAT,
 169                  MAC2STR(wpa_s->own_addr));
 170         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CALLING_STATION_ID,
 171                                  (u8 *) buf, strlen(buf))) {
 172                 printf("Could not add Calling-Station-Id\n");
 173                 goto fail;
 174         }
 175
 176         /* TODO: should probably check MTU from driver config; 2304 is max for
 177          * IEEE 802.11, but use 1400 to avoid problems with too large packets
 178          */
 179         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_FRAMED_MTU, 1400)) {
 180                 printf("Could not add Framed-MTU\n");
 181                 goto fail;
 182         }
 183
 184         if (!radius_msg_add_attr_int32(msg, RADIUS_ATTR_NAS_PORT_TYPE,
 185                                        RADIUS_NAS_PORT_TYPE_IEEE_802_11)) {
 186                 printf("Could not add NAS-Port-Type\n");
 187                 goto fail;
 188         }
 189
 190         snprintf(buf, sizeof(buf), "CONNECT 11Mbps 802.11b");
 191         if (!radius_msg_add_attr(msg, RADIUS_ATTR_CONNECT_INFO,
 192                                  (u8 *) buf, strlen(buf))) {
 193                 printf("Could not add Connect-Info\n");
 194                 goto fail;
 195         }
 196
 197         if (eap && !radius_msg_add_eap(msg, eap, len)) {
 198                 printf("Could not add EAP-Message\n");
 199                 goto fail;
 200         }
 201
 202         /* State attribute must be copied if and only if this packet is
 203          * Access-Request reply to the previous Access-Challenge */
 204         if (wpa_s->last_recv_radius && wpa_s->last_recv_radius->hdr->code ==
 205             RADIUS_CODE_ACCESS_CHALLENGE) {
 206                 int res = radius_msg_copy_attr(msg, wpa_s->last_recv_radius,
 207                                                RADIUS_ATTR_STATE);
 208                 if (res < 0) {
 209                         printf("Could not copy State attribute from previous "
 210                                "Access-Challenge\n");
 211                         goto fail;
 212                 }
 213                 if (res > 0) {
 214                         wpa_printf(MSG_DEBUG, "  Copied RADIUS State "
 215                                    "Attribute");
 216                 }
 217         }
 218
 219         radius_client_send(wpa_s, msg, RADIUS_AUTH, wpa_s->own_addr);
 220         return;
 221
 222  fail:
 223         radius_msg_free(msg);
 224         free(msg);
 225 }
 226
 227
 228 static int eapol_test_eapol_send(void *ctx, int type, u8 *buf, size_t len)
 229 {
 230         struct wpa_supplicant *wpa_s = ctx;
 231         printf("WPA: wpa_eapol_send(type=%d len=%d)\n", type, len);
 232         if (type == IEEE802_1X_TYPE_EAP_PACKET) {
 233                 wpa_hexdump(MSG_DEBUG, "TX EAP -> RADIUS", buf, len);
 234                 ieee802_1x_encapsulate_radius(wpa_s, buf, len);
 235         }
 236         return 0;
 237 }
 238
 239
 240 static void eapol_test_eapol_done_cb(void *ctx)
 241 {
 242         printf("WPA: EAPOL processing complete\n");
 243 }
 244
 245
 246 static void eapol_sm_reauth(void *eloop_ctx, void *timeout_ctx)
 247 {
 248         struct wpa_supplicant *wpa_s = eloop_ctx;
 249         printf("\n\n\n\n\neapol_test: Triggering EAP reauthentication\n\n");
 250         wpa_s->radius_access_accept_received = 0;
 251         send_eap_request_identity(eloop_ctx, timeout_ctx);
 252 }
 253
 254
 255 static int eapol_test_compare_pmk(struct wpa_supplicant *wpa_s)
 256 {
 257         u8 pmk[PMK_LEN];
 258         int ret = 1;
 259
 260         if (eapol_sm_get_key(wpa_s->eapol, pmk, PMK_LEN) == 0) {
 261                 wpa_hexdump(MSG_DEBUG, "PMK from EAPOL", pmk, PMK_LEN);
 262                 if (memcmp(pmk, wpa_s->authenticator_pmk, PMK_LEN) != 0)
 263                         printf("WARNING: PMK mismatch\n");
 264                 else if (wpa_s->radius_access_accept_received)
 265                         ret = 0;
 266         } else if (wpa_s->authenticator_pmk_len == 16 &&
 267                    eapol_sm_get_key(wpa_s->eapol, pmk, 16) == 0) {
 268                 wpa_hexdump(MSG_DEBUG, "LEAP PMK from EAPOL", pmk, 16);
 269                 if (memcmp(pmk, wpa_s->authenticator_pmk, 16) != 0)
 270                         printf("WARNING: PMK mismatch\n");
 271                 else if (wpa_s->radius_access_accept_received)
 272                         ret = 0;
 273         } else if (wpa_s->radius_access_accept_received && no_mppe_keys) {
 274                 /* No keying material expected */
 275                 ret = 0;
 276         }
 277
 278         if (ret)
 279                 num_mppe_mismatch++;
 280         else if (!no_mppe_keys)
 281                 num_mppe_ok++;
 282
 283         return ret;
 284 }
 285
 286
 287 static void eapol_sm_cb(struct eapol_sm *eapol, int success, void *ctx)
 288 {
 289         struct wpa_supplicant *wpa_s = ctx;
 290         printf("eapol_sm_cb: success=%d\n", success);
 291         eapol_test_num_reauths--;
 292         if (eapol_test_num_reauths < 0)
 293                 eloop_terminate();
 294         else {
 295                 eapol_test_compare_pmk(wpa_s);
 296                 eloop_register_timeout(0, 100000, eapol_sm_reauth,
 297                                        wpa_s, NULL);
 298         }
 299 }
 300
 301
 302 static int test_eapol(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
 303 {
 304         struct eapol_config eapol_conf;
 305         struct eapol_ctx *ctx;
 306
 307         ctx = malloc(sizeof(*ctx));
 308         if (ctx == NULL) {
 309                 printf("Failed to allocate EAPOL context.\n");
 310                 return -1;
 311         }
 312         memset(ctx, 0, sizeof(*ctx));
 313         ctx->ctx = wpa_s;
 314         ctx->msg_ctx = wpa_s;
 315         ctx->scard_ctx = wpa_s->scard;
 316         ctx->cb = eapol_sm_cb;
 317         ctx->cb_ctx = wpa_s;
 318         ctx->preauth = 0;
 319         ctx->eapol_done_cb = eapol_test_eapol_done_cb;
 320         ctx->eapol_send = eapol_test_eapol_send;
 321
 322         wpa_s->eapol = eapol_sm_init(ctx);
 323         if (wpa_s->eapol == NULL) {
 324                 free(ctx);
 325                 printf("Failed to initialize EAPOL state machines.\n");
 326                 return -1;
 327         }
 328
 329         wpa_s->current_ssid = ssid;
 330         memset(&eapol_conf, 0, sizeof(eapol_conf));
 331         eapol_conf.accept_802_1x_keys = 1;
 332         eapol_conf.required_keys = 0;
 333         eapol_conf.fast_reauth = wpa_s->conf->fast_reauth;
 334         eapol_conf.workaround = ssid->eap_workaround;
 335         eapol_sm_notify_config(wpa_s->eapol, ssid, &eapol_conf);
 336         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
 337
 338
 339         eapol_sm_notify_portValid(wpa_s->eapol, FALSE);
 340         /* 802.1X::portControl = Auto */
 341         eapol_sm_notify_portEnabled(wpa_s->eapol, TRUE);
 342
 343         return 0;
 344 }
 345
 346
 347 static void test_eapol_clean(struct wpa_supplicant *wpa_s)
 348 {
 349         radius_client_deinit(wpa_s);
 350         free(wpa_s->last_eap_radius);
 351         if (wpa_s->last_recv_radius) {
 352                 radius_msg_free(wpa_s->last_recv_radius);
 353                 free(wpa_s->last_recv_radius);
 354         }
 355         free(wpa_s->eap_identity);
 356         wpa_s->eap_identity = NULL;
 357         eapol_sm_deinit(wpa_s->eapol);
 358         wpa_s->eapol = NULL;
 359         if (wpa_s->auth_server) {
 360                 free(wpa_s->auth_server->shared_secret);
 361                 free(wpa_s->auth_server);
 362         }
 363         scard_deinit(wpa_s->scard);
 364         wpa_supplicant_ctrl_iface_deinit(wpa_s);
 365         wpa_config_free(wpa_s->conf);
 366 }
 367
 368
 369 static void send_eap_request_identity(void *eloop_ctx, void *timeout_ctx)
 370 {
 371         struct wpa_supplicant *wpa_s = eloop_ctx;
 372         u8 buf[100], *pos;
 373         struct ieee802_1x_hdr *hdr;
 374         struct eap_hdr *eap;
 375
 376         hdr = (struct ieee802_1x_hdr *) buf;
 377         hdr->version = EAPOL_VERSION;
 378         hdr->type = IEEE802_1X_TYPE_EAP_PACKET;
 379         hdr->length = htons(5);
 380
 381         eap = (struct eap_hdr *) (hdr + 1);
 382         eap->code = EAP_CODE_REQUEST;
 383         eap->identifier = 0;
 384         eap->length = htons(5);
 385         pos = (u8 *) (eap + 1);
 386         *pos = EAP_TYPE_IDENTITY;
 387
 388         printf("Sending fake EAP-Request-Identity\n");
 389         eapol_sm_rx_eapol(wpa_s->eapol, wpa_s->bssid, buf,
 390                           sizeof(*hdr) + 5);
 391 }
 392
 393
 394 static void eapol_test_timeout(void *eloop_ctx, void *timeout_ctx)
 395 {
 396         struct wpa_supplicant *wpa_s = eloop_ctx;
 397         printf("EAPOL test timed out\n");
 398         wpa_s->auth_timed_out = 1;
 399         eloop_terminate();
 400 }
 401
 402
 403 static char *eap_type_text(u8 type)
 404 {
 405         switch (type) {
 406         case EAP_TYPE_IDENTITY: return "Identity";
 407         case EAP_TYPE_NOTIFICATION: return "Notification";
 408         case EAP_TYPE_NAK: return "Nak";
 409         case EAP_TYPE_TLS: return "TLS";
 410         case EAP_TYPE_TTLS: return "TTLS";
 411         case EAP_TYPE_PEAP: return "PEAP";
 412         case EAP_TYPE_SIM: return "SIM";
 413         case EAP_TYPE_GTC: return "GTC";
 414         case EAP_TYPE_MD5: return "MD5";
 415         case EAP_TYPE_OTP: return "OTP";
 416         default: return "Unknown";
 417         }
 418 }
 419
 420
 421 static void ieee802_1x_decapsulate_radius(struct wpa_supplicant *wpa_s)
 422 {
 423         u8 *eap;
 424         size_t len;
 425         struct eap_hdr *hdr;
 426         int eap_type = -1;
 427         char buf[64];
 428         struct radius_msg *msg;
 429
 430         if (wpa_s->last_recv_radius == NULL)
 431                 return;
 432
 433         msg = wpa_s->last_recv_radius;
 434
 435         eap = radius_msg_get_eap(msg, &len);
 436         if (eap == NULL) {
 437                 /* draft-aboba-radius-rfc2869bis-20.txt, Chap. 2.6.3:
 438                  * RADIUS server SHOULD NOT send Access-Reject/no EAP-Message
 439                  * attribute */
 440                 wpa_printf(MSG_DEBUG, "could not extract "
 441                                "EAP-Message from RADIUS message");
 442                 free(wpa_s->last_eap_radius);
 443                 wpa_s->last_eap_radius = NULL;
 444                 wpa_s->last_eap_radius_len = 0;
 445                 return;
 446         }
 447
 448         if (len < sizeof(*hdr)) {
 449                 wpa_printf(MSG_DEBUG, "too short EAP packet "
 450                                "received from authentication server");
 451                 free(eap);
 452                 return;
 453         }
 454
 455         if (len > sizeof(*hdr))
 456                 eap_type = eap[sizeof(*hdr)];
 457
 458         hdr = (struct eap_hdr *) eap;
 459         switch (hdr->code) {
 460         case EAP_CODE_REQUEST:
 461                 snprintf(buf, sizeof(buf), "EAP-Request-%s (%d)",
 462                          eap_type >= 0 ? eap_type_text(eap_type) : "??",
 463                          eap_type);
 464                 break;
 465         case EAP_CODE_RESPONSE:
 466                 snprintf(buf, sizeof(buf), "EAP Response-%s (%d)",
 467                          eap_type >= 0 ? eap_type_text(eap_type) : "??",
 468                          eap_type);
 469                 break;
 470         case EAP_CODE_SUCCESS:
 471                 snprintf(buf, sizeof(buf), "EAP Success");
 472                 /* LEAP uses EAP Success within an authentication, so must not
 473                  * stop here with eloop_terminate(); */
 474                 break;
 475         case EAP_CODE_FAILURE:
 476                 snprintf(buf, sizeof(buf), "EAP Failure");
 477                 eloop_terminate();
 478                 break;
 479         default:
 480                 snprintf(buf, sizeof(buf), "unknown EAP code");
 481                 wpa_hexdump(MSG_DEBUG, "Decapsulated EAP packet", eap, len);
 482                 break;
 483         }
 484         wpa_printf(MSG_DEBUG, "decapsulated EAP packet (code=%d "
 485                        "id=%d len=%d) from RADIUS server: %s",
 486                       hdr->code, hdr->identifier, ntohs(hdr->length), buf);
 487
 488         /* sta->eapol_sm->be_auth.idFromServer = hdr->identifier; */
 489
 490         if (wpa_s->last_eap_radius)
 491                 free(wpa_s->last_eap_radius);
 492         wpa_s->last_eap_radius = eap;
 493         wpa_s->last_eap_radius_len = len;
 494
 495         {
 496                 struct ieee802_1x_hdr *hdr;
 497                 hdr = malloc(sizeof(*hdr) + len);
 498                 assert(hdr != NULL);
 499                 hdr->version = EAPOL_VERSION;
 500                 hdr->type = IEEE802_1X_TYPE_EAP_PACKET;
 501                 hdr->length = htons(len);
 502                 memcpy((u8 *) (hdr + 1), eap, len);
 503                 eapol_sm_rx_eapol(wpa_s->eapol, wpa_s->bssid,
 504                                   (u8 *) hdr, sizeof(*hdr) + len);
 505                 free(hdr);
 506         }
 507 }
 508
 509
 510 static void ieee802_1x_get_keys(struct wpa_supplicant *wpa_s,
 511                                 struct radius_msg *msg, struct radius_msg *req,
 512                                 u8 *shared_secret, size_t shared_secret_len)
 513 {
 514         struct radius_ms_mppe_keys *keys;
 515
 516         keys = radius_msg_get_ms_keys(msg, req, shared_secret,
 517                                       shared_secret_len);
 518         if (keys && keys->send == NULL && keys->recv == NULL) {
 519                 free(keys);
 520                 keys = radius_msg_get_cisco_keys(msg, req, shared_secret,
 521                                                  shared_secret_len);
 522         }
 523
 524         if (keys) {
 525                 if (keys->send) {
 526                         wpa_hexdump(MSG_DEBUG, "MS-MPPE-Send-Key (sign)",
 527                                     keys->send, keys->send_len);
 528                 }
 529                 if (keys->recv) {
 530                         wpa_hexdump(MSG_DEBUG, "MS-MPPE-Recv-Key (crypt)",
 531                                     keys->recv, keys->recv_len);
 532                         wpa_s->authenticator_pmk_len =
 533                                 keys->recv_len > PMK_LEN ? PMK_LEN :
 534                                 keys->recv_len;
 535                         memcpy(wpa_s->authenticator_pmk, keys->recv,
 536                                wpa_s->authenticator_pmk_len);
 537                 }
 538
 539                 free(keys->send);
 540                 free(keys->recv);
 541                 free(keys);
 542         }
 543 }
 544
 545
 546 /* Process the RADIUS frames from Authentication Server */
 547 static RadiusRxResult
 548 ieee802_1x_receive_auth(struct wpa_supplicant *wpa_s,
 549                         struct radius_msg *msg, struct radius_msg *req,
 550                         u8 *shared_secret, size_t shared_secret_len,
 551                         void *data)
 552 {
 553         /* RFC 2869, Ch. 5.13: valid Message-Authenticator attribute MUST be
 554          * present when packet contains an EAP-Message attribute */
 555         if (msg->hdr->code == RADIUS_CODE_ACCESS_REJECT &&
 556             radius_msg_get_attr(msg, RADIUS_ATTR_MESSAGE_AUTHENTICATOR, NULL,
 557                                 0) < 0 &&
 558             radius_msg_get_attr(msg, RADIUS_ATTR_EAP_MESSAGE, NULL, 0) < 0) {
 559                 wpa_printf(MSG_DEBUG, "Allowing RADIUS "
 560                               "Access-Reject without Message-Authenticator "
 561                               "since it does not include EAP-Message\n");
 562         } else if (radius_msg_verify(msg, shared_secret, shared_secret_len,
 563                                      req)) {
 564                 printf("Incoming RADIUS packet did not have correct "
 565                        "Message-Authenticator - dropped\n");
 566                 return RADIUS_RX_UNKNOWN;
 567         }
 568
 569         if (msg->hdr->code != RADIUS_CODE_ACCESS_ACCEPT &&
 570             msg->hdr->code != RADIUS_CODE_ACCESS_REJECT &&
 571             msg->hdr->code != RADIUS_CODE_ACCESS_CHALLENGE) {
 572                 printf("Unknown RADIUS message code\n");
 573                 return RADIUS_RX_UNKNOWN;
 574         }
 575
 576         wpa_s->radius_identifier = -1;
 577         wpa_printf(MSG_DEBUG, "RADIUS packet matching with station");
 578
 579         if (wpa_s->last_recv_radius) {
 580                 radius_msg_free(wpa_s->last_recv_radius);
 581                 free(wpa_s->last_recv_radius);
 582         }
 583
 584         wpa_s->last_recv_radius = msg;
 585
 586         switch (msg->hdr->code) {
 587         case RADIUS_CODE_ACCESS_ACCEPT:
 588                 wpa_s->radius_access_accept_received = 1;
 589                 ieee802_1x_get_keys(wpa_s, msg, req, shared_secret,
 590                                     shared_secret_len);
 591                 break;
 592         case RADIUS_CODE_ACCESS_REJECT:
 593                 wpa_s->radius_access_reject_received = 1;
 594                 break;
 595         }
 596
 597         ieee802_1x_decapsulate_radius(wpa_s);
 598
 599         if ((msg->hdr->code == RADIUS_CODE_ACCESS_ACCEPT &&
 600              eapol_test_num_reauths < 0) ||
 601             msg->hdr->code == RADIUS_CODE_ACCESS_REJECT) {
 602                 eloop_terminate();
 603         }
 604
 605         return RADIUS_RX_QUEUED;
 606 }
 607
 608
 609 static void wpa_supplicant_imsi_identity(struct wpa_supplicant *wpa_s,
 610                                          struct wpa_ssid *ssid)
 611 {
 612         int aka = 0;
 613         u8 *pos = ssid->eap_methods;
 614
 615         while (pos && *pos != EAP_TYPE_NONE) {
 616                 if (*pos == EAP_TYPE_AKA) {
 617                         aka = 1;
 618                         break;
 619                 }
 620                 pos++;
 621         }
 622
 623         if (ssid->identity == NULL && wpa_s->imsi) {
 624                 ssid->identity = malloc(1 + wpa_s->imsi_len);
 625                 if (ssid->identity) {
 626                         ssid->identity[0] = aka ? '0' : '1';
 627                         memcpy(ssid->identity + 1, wpa_s->imsi,
 628                                wpa_s->imsi_len);
 629                         ssid->identity_len = 1 + wpa_s->imsi_len;
 630                         wpa_hexdump_ascii(MSG_DEBUG, "permanent identity from "
 631                                           "IMSI", ssid->identity,
 632                                           ssid->identity_len);
 633                 }
 634         }
 635 }
 636
 637
 638 static void wpa_supplicant_scard_init(struct wpa_supplicant *wpa_s,
 639                                       struct wpa_ssid *ssid)
 640 {
 641         char buf[100];
 642         size_t len;
 643
 644         if (ssid->pcsc == NULL)
 645                 return;
 646         if (wpa_s->scard != NULL) {
 647                 wpa_supplicant_imsi_identity(wpa_s, ssid);
 648                 return;
 649         }
 650         wpa_printf(MSG_DEBUG, "Selected network is configured to use SIM - "
 651                    "initialize PCSC");
 652         wpa_s->scard = scard_init(SCARD_TRY_BOTH, ssid->pin);
 653         if (wpa_s->scard == NULL) {
 654                 wpa_printf(MSG_WARNING, "Failed to initialize SIM "
 655                            "(pcsc-lite)");
 656                 /* TODO: what to do here? */
 657                 return;
 658         }
 659         eapol_sm_register_scard_ctx(wpa_s->eapol, wpa_s->scard);
 660
 661         len = sizeof(buf);
 662         if (scard_get_imsi(wpa_s->scard, buf, &len)) {
 663                 wpa_printf(MSG_WARNING, "Failed to get IMSI from SIM");
 664                 /* TODO: what to do here? */
 665                 return;
 666         }
 667
 668         wpa_hexdump(MSG_DEBUG, "IMSI", (u8 *) buf, len);
 669         free(wpa_s->imsi);
 670         wpa_s->imsi = malloc(len);
 671         if (wpa_s->imsi) {
 672                 memcpy(wpa_s->imsi, buf, len);
 673                 wpa_s->imsi_len = len;
 674                 wpa_supplicant_imsi_identity(wpa_s, ssid);
 675         }
 676 }
 677
 678
 679 static void wpa_init_conf(struct wpa_supplicant *wpa_s, const char *authsrv,
 680                           int port, const char *secret)
 681 {
 682         struct hostapd_radius_server *as;
 683         int res;
 684
 685         wpa_s->bssid[5] = 1;
 686         wpa_s->own_addr[5] = 2;
 687         wpa_s->own_ip_addr.s_addr = htonl((127 << 24) | 1);
 688         strncpy(wpa_s->ifname, "test", sizeof(wpa_s->ifname));
 689
 690         wpa_s->num_auth_servers = 1;
 691         as = malloc(sizeof(struct hostapd_radius_server));
 692         assert(as != NULL);
 693         inet_aton(authsrv, &as->addr);
 694         as->port = port;
 695         as->shared_secret = (u8 *) strdup(secret);
 696         as->shared_secret_len = strlen(secret);
 697         wpa_s->auth_server = wpa_s->auth_servers = as;
 698
 699
 700         res = radius_client_init(wpa_s);
 701         assert(res == 0);
 702
 703         res = radius_client_register(wpa_s, RADIUS_AUTH,
 704                                      ieee802_1x_receive_auth, NULL);
 705         assert(res == 0);
 706 }
 707
 708
 709 static int scard_test(void)
 710 {
 711         struct scard_data *scard;
 712         size_t len;
 713         char imsi[20];
 714         unsigned char rand[16];
 715 #ifdef PCSC_FUNCS
 716         unsigned char sres[4];
 717         unsigned char kc[8];
 718 #endif /* PCSC_FUNCS */
 719 #define num_triplets 5
 720         unsigned char rand_[num_triplets][16];
 721         unsigned char sres_[num_triplets][4];
 722         unsigned char kc_[num_triplets][8];
 723         int i, j, res;
 724
 725 #define AKA_RAND_LEN 16
 726 #define AKA_AUTN_LEN 16
 727 #define AKA_AUTS_LEN 14
 728 #define RES_MAX_LEN 16
 729 #define IK_LEN 16
 730 #define CK_LEN 16
 731         unsigned char aka_rand[AKA_RAND_LEN];
 732         unsigned char aka_autn[AKA_AUTN_LEN];
 733         unsigned char aka_auts[AKA_AUTS_LEN];
 734         unsigned char aka_res[RES_MAX_LEN];
 735         size_t aka_res_len;
 736         unsigned char aka_ik[IK_LEN];
 737         unsigned char aka_ck[CK_LEN];
 738
 739         scard = scard_init(SCARD_TRY_BOTH, "1234");
 740         if (scard == NULL)
 741                 return -1;
 742
 743         len = sizeof(imsi);
 744         if (scard_get_imsi(scard, imsi, &len))
 745                 goto failed;
 746         wpa_hexdump_ascii(MSG_DEBUG, "SCARD: IMSI", (u8 *) imsi, len);
 747         /* NOTE: Permanent Username: 1 | IMSI */
 748
 749         memset(rand, 0, sizeof(rand));
 750         if (scard_gsm_auth(scard, rand, sres, kc))
 751                 goto failed;
 752
 753         memset(rand, 0xff, sizeof(rand));
 754         if (scard_gsm_auth(scard, rand, sres, kc))
 755                 goto failed;
 756
 757         for (i = 0; i < num_triplets; i++) {
 758                 memset(rand_[i], i, sizeof(rand_[i]));
 759                 if (scard_gsm_auth(scard, rand_[i], sres_[i], kc_[i]))
 760                         goto failed;
 761         }
 762
 763         for (i = 0; i < num_triplets; i++) {
 764                 printf("1");
 765                 for (j = 0; j < len; j++)
 766                         printf("%c", imsi[j]);
 767                 printf(",");
 768                 for (j = 0; j < 16; j++)
 769                         printf("%02X", rand_[i][j]);
 770                 printf(",");
 771                 for (j = 0; j < 4; j++)
 772                         printf("%02X", sres_[i][j]);
 773                 printf(",");
 774                 for (j = 0; j < 8; j++)
 775                         printf("%02X", kc_[i][j]);
 776                 printf("\n");
 777         }
 778
 779         wpa_printf(MSG_DEBUG, "Trying to use UMTS authentication");
 780
 781         /* seq 39 (0x28) */
 782         memset(aka_rand, 0xaa, 16);
 783         memcpy(aka_autn, "\x86\x71\x31\xcb\xa2\xfc\x61\xdf"
 784                "\xa3\xb3\x97\x9d\x07\x32\xa2\x12", 16);
 785
 786         res = scard_umts_auth(scard, aka_rand, aka_autn, aka_res, &aka_res_len,
 787                               aka_ik, aka_ck, aka_auts);
 788         if (res == 0) {
 789                 wpa_printf(MSG_DEBUG, "UMTS auth completed successfully");
 790                 wpa_hexdump(MSG_DEBUG, "RES", aka_res, aka_res_len);
 791                 wpa_hexdump(MSG_DEBUG, "IK", aka_ik, IK_LEN);
 792                 wpa_hexdump(MSG_DEBUG, "CK", aka_ck, CK_LEN);
 793         } else if (res == -2) {
 794                 wpa_printf(MSG_DEBUG, "UMTS auth resulted in synchronization "
 795                            "failure");
 796                 wpa_hexdump(MSG_DEBUG, "AUTS", aka_auts, AKA_AUTS_LEN);
 797         } else {
 798                 wpa_printf(MSG_DEBUG, "UMTS auth failed");
 799         }
 800
 801 failed:
 802         scard_deinit(scard);
 803
 804         return 0;
 805 #undef num_triplets
 806 }
 807
 808
 809 static int scard_get_triplets(int argc, char *argv[])
 810 {
 811         struct scard_data *scard;
 812         size_t len;
 813         char imsi[20];
 814         unsigned char rand[16];
 815         unsigned char sres[4];
 816         unsigned char kc[8];
 817         int num_triplets;
 818         int i, j;
 819
 820         if (argc < 2 || ((num_triplets = atoi(argv[1])) <= 0)) {
 821                 printf("invalid parameters for sim command\n");
 822                 return -1;
 823         }
 824
 825         if (argc <= 2 || strcmp(argv[2], "debug") != 0) {
 826                 /* disable debug output */
 827                 wpa_debug_level = 99;
 828         }
 829
 830         scard = scard_init(SCARD_GSM_SIM_ONLY, argv[0]);
 831         if (scard == NULL) {
 832                 printf("Failed to open smartcard connection\n");
 833                 return -1;
 834         }
 835
 836         len = sizeof(imsi);
 837         if (scard_get_imsi(scard, imsi, &len)) {
 838                 scard_deinit(scard);
 839                 return -1;
 840         }
 841
 842         for (i = 0; i < num_triplets; i++) {
 843                 memset(rand, i, sizeof(rand));
 844                 if (scard_gsm_auth(scard, rand, sres, kc))
 845                         break;
 846
 847                 /* IMSI:Kc:SRES:RAND */
 848                 for (j = 0; j < len; j++)
 849                         printf("%c", imsi[j]);
 850                 printf(":");
 851                 for (j = 0; j < 8; j++)
 852                         printf("%02X", kc[j]);
 853                 printf(":");
 854                 for (j = 0; j < 4; j++)
 855                         printf("%02X", sres[j]);
 856                 printf(":");
 857                 for (j = 0; j < 16; j++)
 858                         printf("%02X", rand[j]);
 859                 printf("\n");
 860         }
 861
 862         scard_deinit(scard);
 863
 864         return 0;
 865 }
 866
 867
 868 static void eapol_test_terminate(int sig, void *eloop_ctx,
 869                                  void *signal_ctx)
 870 {
 871         struct wpa_supplicant *wpa_s = eloop_ctx;
 872         wpa_msg(wpa_s, MSG_INFO, "Signal %d received - terminating", sig);
 873         eloop_terminate();
 874 }
 875
 876
 877 static void usage(void)
 878 {
 879         printf("usage:\n"
 880                "eapol_test [-n] -c<conf> [-a<AS IP>] [-p<AS port>] "
 881                "[-s<AS secret>] [-r<count>]\n"
 882                "eapol_test scard\n"
 883                "eapol_test sim <PIN> <num triplets> [debug]\n"
 884                "\n"
 885                "options:\n"
 886                "  -c<conf> = configuration file\n"
 887                "  -a<AS IP> = IP address of the authentication server, "
 888                "default 127.0.0.1\n"
 889                "  -p<AS port> = UDP port of the authentication server, "
 890                "default 1812\n"
 891                "  -s<AS secret> = shared secret with the authentication "
 892                "server, default 'radius'\n"
 893                "  -r<count> = number of re-authentications\n"
 894                "  -n = no MPPE keys expected\n");
 895 }
 896
 897
 898 int main(int argc, char *argv[])
 899 {
 900         struct wpa_supplicant wpa_s;
 901         int c, ret = 1;
 902         char *as_addr = "127.0.0.1";
 903         int as_port = 1812;
 904         char *as_secret = "radius";
 905         char *conf = NULL;
 906
 907         wpa_debug_level = 0;
 908         wpa_debug_show_keys = 1;
 909
 910         for (;;) {
 911                 c = getopt(argc, argv, "a:c:np:r:s:");
 912                 if (c < 0)
 913                         break;
 914                 switch (c) {
 915                 case 'a':
 916                         as_addr = optarg;
 917                         break;
 918                 case 'c':
 919                         conf = optarg;
 920                         break;
 921                 case 'n':
 922                         no_mppe_keys++;
 923                         break;
 924                 case 'p':
 925                         as_port = atoi(optarg);
 926                         break;
 927                 case 'r':
 928                         eapol_test_num_reauths = atoi(optarg);
 929                         break;
 930                 case 's':
 931                         as_secret = optarg;
 932                         break;
 933                 default:
 934                         usage();
 935                         return -1;
 936                 }
 937         }
 938
 939         if (argc > optind && strcmp(argv[optind], "scard") == 0) {
 940                 return scard_test();
 941         }
 942
 943         if (argc > optind && strcmp(argv[optind], "sim") == 0) {
 944                 return scard_get_triplets(argc - optind - 1,
 945                                           &argv[optind + 1]);
 946         }
 947
 948         if (conf == NULL) {
 949                 usage();
 950                 printf("Configuration file is required.\n");
 951                 return -1;
 952         }
 953
 954         eloop_init(&wpa_s);
 955
 956         memset(&wpa_s, 0, sizeof(wpa_s));
 957         wpa_s.conf = wpa_config_read(conf);
 958         if (wpa_s.conf == NULL) {
 959                 printf("Failed to parse configuration file '%s'.\n", conf);
 960                 return -1;
 961         }
 962         if (wpa_s.conf->ssid == NULL) {
 963                 printf("No networks defined.\n");
 964                 return -1;
 965         }
 966
 967         wpa_init_conf(&wpa_s, as_addr, as_port, as_secret);
 968         if (wpa_supplicant_ctrl_iface_init(&wpa_s)) {
 969                 printf("Failed to initialize control interface '%s'.\n"
 970                        "You may have another eapol_test process already "
 971                        "running or the file was\n"
 972                        "left by an unclean termination of eapol_test in "
 973                        "which case you will need\n"
 974                        "to manually remove this file before starting "
 975                        "eapol_test again.\n",
 976                        wpa_s.conf->ctrl_interface);
 977                 return -1;
 978         }
 979         wpa_supplicant_scard_init(&wpa_s, wpa_s.conf->ssid);
 980
 981         if (test_eapol(&wpa_s, wpa_s.conf->ssid))
 982                 return -1;
 983
 984         eloop_register_timeout(30, 0, eapol_test_timeout, &wpa_s, NULL);
 985         eloop_register_timeout(0, 0, send_eap_request_identity, &wpa_s, NULL);
 986         eloop_register_signal(SIGINT, eapol_test_terminate, NULL);
 987         eloop_register_signal(SIGTERM, eapol_test_terminate, NULL);
 988         eloop_register_signal(SIGHUP, eapol_test_terminate, NULL);
 989         eloop_run();
 990
 991         if (eapol_test_compare_pmk(&wpa_s) == 0)
 992                 ret = 0;
 993         if (wpa_s.auth_timed_out)
 994                 ret = -2;
 995         if (wpa_s.radius_access_reject_received)
 996                 ret = -3;
 997
 998         test_eapol_clean(&wpa_s);
 999
1000         eloop_destroy();
1001
1002         printf("MPPE keys OK: %d  mismatch: %d\n",
1003                num_mppe_ok, num_mppe_mismatch);
1004         if (num_mppe_mismatch)
1005                 ret = -4;
1006         if (ret)
1007                 printf("FAILURE\n");
1008         else
1009                 printf("SUCCESS\n");
1010
1011         return ret;
1012 }