failure after 4 way handshake

[matthieu castet]

Hi,

I am trying to add native support for WPA for Aironet WPA cards.

For that I use ndiswrapper with the windows binary and I trace the IO
done by the driver.

I have found near all the command needed.

But I have a problem in the "4 way handshake".

With ndiswrapper everything works correctly, but with my implementation
the master don't send anything after the "4 way handshake" (I have check
that with a card in monitor mode) and the Managed client fails with
timeout failure. See the ethereal dump (ether file) and wpa_supplicant 
log (case1)

Sometimes the Master send a packet and is received by the client. But
this packet seems incorrect : the size is too long (wpa_supplicant
ignore the end) and the key seems wrong : after an exchange of 2-4 
packets the client is disassociated. [2]

Why the master don't send an encrypted packet after the '4 way handshake' ?
Is it because of some failure in '4 way handshake' ?
How could I detect it ?



When it sends an encrypted packet why it is the decrypted version is too 
long ?
What happen if the key is wrong ?
Does the packet is skipped or it is given like junk that seems like a 
normal IEEE 802.1X packet ?


[2]
status : 400 <- were associated
send pack 0
send pack 0
Setting key 0
len 48, idx 0, mac 1, key ac
Setting transmit key to 0
Setting key 1
len 48, idx 1, mac 1, key fd
send pack 0
Setting key 1
len 48, idx 1, mac 1, key fd
send pack 0
Setting key 1
len 48, idx 1, mac 1, key fd
send pack 0
status : 810e <- Deauthentication mic failure

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: case1
Url: http://lists.shmoo.com/pipermail/hostap/attachments/20051015/a33ecf36/attachment.txt 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: ether
Url: http://lists.shmoo.com/pipermail/hostap/attachments/20051015/a33ecf36/attachment-0001.txt