From kshogan  Sun Jul  2 09:48:09 2006
From: kshogan (kshogan at nomadisp.com)
Date: Sun, 2 Jul 2006 10:48:09 -0600 (MDT)
Subject: hostapd and XP Authentication Help Needed (fwd)
Message-ID: <Pine.LNX.4.63.0607021046490.9492@m21.linora.com>

Hello Group,

I've been using hostap for a few years, and it works great!  Thanks Jouni!

Recently started to use hostapd as an authenication for a WPA on an atheros 
chipset using hostapd.  Versions are all 0.4.9 on a 2.6.11 kernel. My problem 
is that I am unable to get win xp to authenticate to the ap. It sees it, and 
shows it as a WPA ap, but the authentication fails.  The dump of the process is 
below.  Seems that the EAPOL Timeout may be an issue.  It connects to begin 
with, but the 4 way handshake seems to be the problem.

Does anyone have a set of working hostapd.conf configs that they would share as 
a starting point for me to customize?  Or, can anyone point to the problems 
that might be causing the errors?

Thanks in advance!
KH

Info below...

# cat hostapd.conf | grep -vh '^#' | grep -v '^$'
interface=ath2
bridge=br1
driver=madwifi
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=0
debug=4
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=ranger_private
macaddr_acl=0
auth_algs=1
wpa=1
wpa_passphrase=letmeinnow
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP

Dump of session with win xp home, sp2 connecting.....

# hostapd -dd hostapd.conf
Configuration file: hostapd.conf
Configure bridge br1 for EAPOL traffic.
madwifi_set_iface_flags: dev_up=0
Using interface ath2 with hwaddr 06:0b:6b:4d:99:61 and ssid 'ranger_private'
madwifi_set_ieee8021x: enabled=1
madwifi_configure_wpa: group key cipher=1
madwifi_configure_wpa: pairwise key ciphers=0xa
madwifi_configure_wpa: key management algorithms=0x2
madwifi_configure_wpa: rsn capabilities=0x0
madwifi_configure_wpa: enable WPA= 0x1
madwifi_set_iface_flags: dev_up=1
madwifi_set_privacy: enabled=1
WPA: group state machine entering state GTK_INIT
GMK - hexdump(len=32): 66 a3 11 43 e3 f2 b7 b1 a8 94 f1 ed c1 37 aa bb 00 35 72 
1f ed d1 eb b6 33 80 6d 10 15 1a eb 2f
GTK - hexdump(len=32): c6 21 68 c1 dc d0 a8 7f f0 35 8d 7b 4e b5 79 f9 68 ca 98 
7d ee 80 5e fe cc 0f 74 c9 56 77 04 e2
WPA: group state machine entering state SETKEYSDONE
madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=1
Flushing old station entries
madwifi_sta_deauth: addr=ff:ff:ff:ff:ff:ff reason_code=3
Deauthenticate all stations
l2_packet_receive - recvfrom: Network is down
Wireless event: cmd=0x8c03 len=20
ath2: STA 00:0c:41:10:94:46 IEEE 802.11: associated
   New STA
ath2: STA 00:0c:41:10:94:46 WPA: event 1 notification
ath2: STA 00:0c:41:10:94:46 WPA: start authentication
WPA: 00:0c:41:10:94:46 WPA_PTK entering state INITIALIZE
madwifi_del_key: addr=00:0c:41:10:94:46 key_idx=0
ath2: STA 00:0c:41:10:94:46 IEEE 802.1X: unauthorizing port
madwifi_set_sta_authorized: addr=00:0c:41:10:94:46 authorized=0
WPA: 00:0c:41:10:94:46 WPA_PTK_GROUP entering state IDLE
WPA: 00:0c:41:10:94:46 WPA_PTK entering state AUTHENTICATION
WPA: 00:0c:41:10:94:46 WPA_PTK entering state AUTHENTICATION2
WPA: 00:0c:41:10:94:46 WPA_PTK entering state INITPSK
WPA: 00:0c:41:10:94:46 WPA_PTK entering state PTKSTART
ath2: STA 00:0c:41:10:94:46 WPA: sending 1/4 msg of 4-Way Handshake
TX EAPOL - hexdump(len=113): 00 0c 41 10 94 46 06 0b 6b 4d 99 61 88 8e 02 03 00 
5f fe 00 89 00 20 00 00 00 00 00 00 00 01 95 88 2e c9 72 51 79 c7 49 2c f5 f3 
0e 55 93 1f d4 02 ab 28 c2 81 fa a9 70 9d 91 17 0f 8d 95 01 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IEEE 802.1X: 99 bytes from 00:0c:41:10:94:46
    IEEE 802.1X: version=1 type=3 length=95
ath2: STA 00:0c:41:10:94:46 WPA: received EAPOL-Key 2/2 Group with unexpected 
replay counter
expected replay counter - hexdump(len=8): 00 00 00 00 00 00 00 01
received replay counter - hexdump(len=8): 00 00 00 00 00 00 00 07
IEEE 802.1X: 5 bytes from 00:0c:41:10:94:46
    IEEE 802.1X: version=1 type=1 length=0
    ignoring 1 extra octets after IEEE 802.1X packet
ath2: STA 00:0c:41:10:94:46 WPA: EAPOL-Key timeout
WPA: 00:0c:41:10:94:46 WPA_PTK entering state PTKSTART
ath2: STA 00:0c:41:10:94:46 WPA: sending 1/4 msg of 4-Way Handshake
TX EAPOL - hexdump(len=113): 00 0c 41 10 94 46 06 0b 6b 4d 99 61 88 8e 02 03 00 
5f fe 00 89 00 20 00 00 00 00 00 00 00 02 95 88 2e c9 72 51 79 c7 49 2c f5 f3 
0e 55 93 1f d4 02 ab 28 c2 81 fa a9 70 9d 91 17 0f 8d 95 01 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
IEEE 802.1X: 125 bytes from 00:0c:41:10:94:46
    IEEE 802.1X: version=1 type=3 length=121
ath2: STA 00:0c:41:10:94:46 WPA: received EAPOL-Key frame (2/4 Pairwise)
WPA: 00:0c:41:10:94:46 WPA_PTK entering state PTKCALCNEGOTIATING
PMK - hexdump(len=32): 7a 91 27 93 a9 c1 0f b0 75 1e aa 7e 06 d0 9a 88 d8 97 f6 
6a 87 ac 6b ff 04 85 1b 30 0f 08 9d 6d
PTK - hexdump(len=64): 12 51 d8 48 2f b4 40 0d 50 b5 79 7e 85 8b a0 1f 65 86 e7 
a6 4b 0f ec 2a a2 bc 65 59 67 77 b8 13 1f a3 2c b3 22 c5 4f 8f 62 18 77 3f e8 
56 80 00 0b bc 29 45 35 d9 f9 12 4f 11 85 8e 25 61 a7 13
WPA: 00:0c:41:10:94:46 WPA_PTK entering state PTKCALCNEGOTIATING2
WPA: 00:0c:41:10:94:46 WPA_PTK entering state PTKINITNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
ath2: STA 00:0c:41:10:94:46 WPA: sending 3/4 msg of 4-Way Handshake
TX EAPOL - hexdump(len=141): 00 0c 41 10 94 46 06 0b 6b 4d 99 61 88 8e 02 03 00 
7b fe 01 c9 00 20 00 00 00 00 00 00 00 03 95 88 2e c9 72 51 79 c7 49 2c f5 f3 
0e 55 93 1f d4 02 ab 28 c2 81 fa a9 70 9d 91 17 0f 8d 95 01 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
9a 54 1a 86 98 f0 1c c2 93 0b f2 db 92 96 b4 5a 00 1c dd 1a 00 50 f2 01 01 00 
00 50 f2 02 02 00 00 50 f2 04 00 50 f2 02 01 00 00 50 f2 02
IEEE 802.1X: 99 bytes from 00:0c:41:10:94:46
    IEEE 802.1X: version=1 type=3 length=95
ath2: STA 00:0c:41:10:94:46 WPA: received EAPOL-Key frame (4/4 Pairwise)
WPA: 00:0c:41:10:94:46 WPA_PTK entering state PTKINITDONE
madwifi_set_key: alg=TKIP addr=00:0c:41:10:94:46 key_idx=0
ath2: STA 00:0c:41:10:94:46 IEEE 802.1X: authorizing port
madwifi_set_sta_authorized: addr=00:0c:41:10:94:46 authorized=1
madwifi_sta_clear_stats: addr=00:0c:41:10:94:46
ath2: STA 00:0c:41:10:94:46 WPA: pairwise key handshake completed (WPA)
madwifi_sta_clear_stats: addr=00:0c:41:10:94:46
WPA: 00:0c:41:10:94:46 WPA_PTK_GROUP entering state REKEYNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
ath2: STA 00:0c:41:10:94:46 WPA: sending 1/2 msg of Group Key Handshake
Plaintext EAPOL-Key Key Data - hexdump(len=32): c6 21 68 c1 dc d0 a8 7f f0 35 
8d 7b 4e b5 79 f9 68 ca 98 7d ee 80 5e fe cc 0f 74 c9 56 77 04 e2
TX EAPOL - hexdump(len=145): 00 0c 41 10 94 46 06 0b 6b 4d 99 61 88 8e 02 03 00 
7f fe 03 91 00 20 00 00 00 00 00 00 00 04 95 88 2e c9 72 51 79 c7 49 2c f5 f3 
0e 55 93 1f d4 02 ab 28 c2 81 fa a9 70 9d 91 17 0f 8d 95 00 d4 02 ab 28 c2 81 
fa a9 70 9d 91 17 0f 8d 95 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
16 a6 14 7a 0b 2a d7 30 94 54 db 69 2c e7 a2 4d 00 20 22 44 a3 f0 b0 f3 04 e5 
7e b2 26 2e 24 70 cc 45 c4 f5 9c c8 d3 3a cb da a7 9b 29 61 6d 2e 3c ba
ath2: STA 00:0c:41:10:94:46 WPA: EAPOL-Key timeout
WPA: 00:0c:41:10:94:46 WPA_PTK_GROUP entering state REKEYNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
ath2: STA 00:0c:41:10:94:46 WPA: sending 1/2 msg of Group Key Handshake
Plaintext EAPOL-Key Key Data - hexdump(len=32): c6 21 68 c1 dc d0 a8 7f f0 35 
8d 7b 4e b5 79 f9 68 ca 98 7d ee 80 5e fe cc 0f 74 c9 56 77 04 e2
TX EAPOL - hexdump(len=145): 00 0c 41 10 94 46 06 0b 6b 4d 99 61 88 8e 02 03 00 
7f fe 03 91 00 20 00 00 00 00 00 00 00 05 95 88 2e c9 72 51 79 c7 49 2c f5 f3 
0e 55 93 1f d4 02 ab 28 c2 81 fa a9 70 9d 91 17 0f 8d 95 00 d4 02 ab 28 c2 81 
fa a9 70 9d 91 17 0f 8d 95 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
e2 1d 8a d7 d3 53 42 40 7e d0 fb 98 f5 16 35 21 00 20 32 a5 b5 54 5f 6d b0 9f 
f3 6a 45 b2 be 64 44 6c 8c cc 2c 40 a1 16 bd 9b 5d 04 6f ce b7 77 fb 6a
ath2: STA 00:0c:41:10:94:46 WPA: EAPOL-Key timeout
WPA: 00:0c:41:10:94:46 WPA_PTK_GROUP entering state REKEYNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
ath2: STA 00:0c:41:10:94:46 WPA: sending 1/2 msg of Group Key Handshake
Plaintext EAPOL-Key Key Data - hexdump(len=32): c6 21 68 c1 dc d0 a8 7f f0 35 
8d 7b 4e b5 79 f9 68 ca 98 7d ee 80 5e fe cc 0f 74 c9 56 77 04 e2
TX EAPOL - hexdump(len=145): 00 0c 41 10 94 46 06 0b 6b 4d 99 61 88 8e 02 03 00 
7f fe 03 91 00 20 00 00 00 00 00 00 00 06 95 88 2e c9 72 51 79 c7 49 2c f5 f3 
0e 55 93 1f d4 02 ab 28 c2 81 fa a9 70 9d 91 17 0f 8d 95 00 d4 02 ab 28 c2 81 
fa a9 70 9d 91 17 0f 8d 95 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
6a a5 96 8c 72 6a ac 9d e8 e9 75 3f f9 29 e0 7f 00 20 00 39 3a 14 8c 8e 85 e6 
2f 20 c4 c5 48 c8 13 b4 89 01 aa 29 e1 cd 27 13 57 b3 ca f6 42 aa 9c fd
ath2: STA 00:0c:41:10:94:46 WPA: EAPOL-Key timeout
WPA: 00:0c:41:10:94:46 WPA_PTK_GROUP entering state REKEYNEGOTIATING
madwifi_get_seqnum: addr=00:00:00:00:00:00 idx=1
ath2: STA 00:0c:41:10:94:46 WPA: sending 1/2 msg of Group Key Handshake
Plaintext EAPOL-Key Key Data - hexdump(len=32): c6 21 68 c1 dc d0 a8 7f f0 35 
8d 7b 4e b5 79 f9 68 ca 98 7d ee 80 5e fe cc 0f 74 c9 56 77 04 e2
TX EAPOL - hexdump(len=145): 00 0c 41 10 94 46 06 0b 6b 4d 99 61 88 8e 02 03 00 
7f fe 03 91 00 20 00 00 00 00 00 00 00 07 95 88 2e c9 72 51 79 c7 49 2c f5 f3 
0e 55 93 1f d4 02 ab 28 c2 81 fa a9 70 9d 91 17 0f 8d 95 00 d4 02 ab 28 c2 81 
fa a9 70 9d 91 17 0f 8d 95 05 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
67 36 bc 02 24 6b 89 3d 72 13 a9 6c fd 17 55 02 00 20 27 cd 47 96 e3 ee 98 c3 
73 b7 31 79 4c 9d 4b 07 cf 8d 28 d7 96 9d 4c 95 3a a7 3c c6 2c e6 8e af
WPA: 00:0c:41:10:94:46 WPA_PTK_GROUP entering state KEYERROR
WPA: 00:0c:41:10:94:46 WPA_PTK entering state DISCONNECT
madwifi_sta_deauth: addr=00:0c:41:10:94:46 reason_code=2
WPA: 00:0c:41:10:94:46 WPA_PTK_GROUP entering state IDLE
WPA: 00:0c:41:10:94:46 WPA_PTK entering state DISCONNECTED
WPA: 00:0c:41:10:94:46 WPA_PTK entering state INITIALIZE
madwifi_del_key: addr=00:0c:41:10:94:46 key_idx=0
ioctl[unknown???]: Invalid argument
ath2: STA 00:0c:41:10:94:46 IEEE 802.1X: unauthorizing port
madwifi_set_sta_authorized: addr=00:0c:41:10:94:46 authorized=0
ioctl[unknown???]: Invalid argument
ath2: STA 00:0c:41:10:94:46 IEEE 802.11: deauthenticated due to local deauth 
request
Wireless event: cmd=0x8c04 len=20
ath2: STA 00:0c:41:10:94:46 IEEE 802.11: disassociated




From kelrin  Mon Jul  3 06:49:42 2006
From: kelrin (Kel Modderman)
Date: Mon, 03 Jul 2006 23:49:42 +1000
Subject: wpa_supplicant.conf manpaged error
Message-ID: <44A92076.70507@tpg.com.au>

Hi,

When the wpa_supplicant.conf sgml document is converted to troff, it 
seems that having a ' as first character in the line causes the rest of 
the line to be omitted. The attached trivial patch "corrects" that flaw.

Thanks, Kel.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: wpa-conf-truncated-sent.patch
Url: http://lists.shmoo.com/pipermail/hostap/attachments/20060703/16f2e283/attachment.txt 


From klaasdc  Mon Jul  3 09:11:06 2006
From: klaasdc (Klaas De Craemer)
Date: Mon, 3 Jul 2006 18:11:06 +0200
Subject: In-kernel-hostap does not find pccard on soekris4511
Message-ID: <f59e60020607030911p349ab213xcd9ff8213671738a@mail.gmail.com>

Hello,

I'm trying to configure my soekris4511-board as a freeradius-server/AP
but I have some trouble getting my Senao NL2511 to work with hostap.
I have already tried the Debian-mini-distro Pebble, which has kernel
2.4. wlan0 is correctly detected in it, but hostapd complains that it
can't interface with the kernel. So i decided to built a complete new
rootfs from scratch based on kernel 2.6.15.6 , in which I enabled
hostap and hostap_cs as a module.
Now, I can load and unload the module(s) (I also tried the PCI and PLX
modules...) as much as I want, nothing is detected.
"ifconfig wlan0 up" keeps saying:
wlan0: ERROR while getting interface flags: No such device

Dmesg also doesn't output anything useful, only the confirmation of the loading:
[...]
hostap_pci: 0.4.4-kernel (Jouni Malinen <jkmaline at cc.hut.fi>)
hostap_cs: 0.4.4-kernel (Jouni Malinen <jkmaline at cc.hut.fi>)
hostap_plx: 0.4.4-kernel (Jouni Malinen <jkmaline at cc.hut.fi>)

Compiling everything in the kernel also yields no result.
Something else I noticed is that the LED on the pc-card goes green
when the PCMCIA-support starts. Normally, it's supposed to stay dark
until after the driver has loaded and wlan0 is enabled...

Sincerly,
Klaas De Craemer



From proski  Mon Jul  3 09:57:09 2006
From: proski (Pavel Roskin)
Date: Mon, 03 Jul 2006 12:57:09 -0400
Subject: [PATCH 9/15] pcmcia: hostap_cs.c - 0xc00f, 0x0000 conflicts
	with pcnet_cs
In-Reply-To: <20060703085603.GA9465@dominikbrodowski.de>
References: <20060630195217.GB9095@dominikbrodowski.de>
	<20060630195255.GC9095@dominikbrodowski.de>
	<20060630195358.GD9095@dominikbrodowski.de>
	<20060630195439.GE9095@dominikbrodowski.de>
	<20060630195501.GF9095@dominikbrodowski.de>
	<20060630195600.GG9095@dominikbrodowski.de>
	<20060630195657.GH9095@dominikbrodowski.de>
	<20060630195753.GI9095@dominikbrodowski.de>
	<20060630195920.GJ9095@dominikbrodowski.de>
	<1151702323.21767.3.camel@dv>
	<20060703085603.GA9465@dominikbrodowski.de>
Message-ID: <1151945829.26514.5.camel@dv>

Hi Dominik,

On Mon, 2006-07-03 at 10:56 +0200, Dominik Brodowski wrote:

> Like this?

Yes, but I usually drop revisions from the matched IDs, especially in
presence of the chip ID.  Why would we exclude "RevB" if it happens to
be ISL37300P based?  So the new entries would be:

	PCMCIA_DEVICE_PROD_ID123(
		"Allied Telesyn", "AT-WCL452 Wireless PCMCIA Radio",
		"Ver. 1.00",
		0x5cd01705, 0x4271660f, 0x9d08ee12),
	PCMCIA_DEVICE_PROD_ID123(
		"corega", "WL PCCL-11", "ISL37300P",
		0xa21501a, 0x59868926, 0xc9049a39),

-- 
Regards,
Pavel Roskin




From ulovecutesun  Wed Jul  5 15:56:42 2006
From: ulovecutesun (Sun Kim)
Date: Wed, 5 Jul 2006 18:56:42 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
Message-ID: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>

 Has anyone compiled hostap 0.4.7 with the 2.6.17 kernel yet?

I got the following errs.

[root at localhost hostap-driver-0.4.9]# make
make -C /lib/modules/2.6.17-1.2139_FC4/buildSUBDIRS=/home/mkim/Desktop/hostap/hostap-
driver-0.4.9/driver/modules \
        MODVERDIR=/home/mkim/Desktop/hostap/hostap-driver-0.4.9/driver/modules
modules
make[1]: Entering directory `/usr/src/kernels/2.6.17-1.2139_FC4-i686'
scripts/Makefile.build:17:
/home/mkim/Desktop/hostap/hostap-driver-0.4.9/driver/modules/Makefile:
No such file or directory
make[2]: *** No rule to make target `/home/mkim/Desktop/hostap/hostap-
driver-0.4.9/driver/modules/Makefile'.  Stop.
make[1]: *** [_module_/home/mkim/Desktop/hostap/hostap-driver-0.4.9/driver/modules]
Error 2
make[1]: Leaving directory `/usr/src/kernels/2.6.17-1.2139_FC4-i686'
make: *** [2.6] Error 2


-- 
Thanks,
Sun
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060705/2cc7ac8b/attachment.htm 


From proski  Wed Jul  5 21:00:47 2006
From: proski (Pavel Roskin)
Date: Thu, 06 Jul 2006 00:00:47 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
Message-ID: <1152158447.10415.22.camel@dv>

Hello!

On Wed, 2006-07-05 at 18:56 -0400, Sun Kim wrote:
> Has anyone compiled hostap 0.4.7 with the 2.6.17 kernel yet?

Compiling stand-alone hostap driver is not supported with the kernels
that already include hostap driver.  Stand-alone compilation was failing
with older kernels, so I'm not surprised it's failing with 2.6.17.

-- 
Regards,
Pavel Roskin




From ulovecutesun  Wed Jul  5 21:20:29 2006
From: ulovecutesun (Sun)
Date: Thu, 06 Jul 2006 00:20:29 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <1152158447.10415.22.camel@dv>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<1152158447.10415.22.camel@dv>
Message-ID: <op.tb82cggcs31rc3@sraker>

On Thu, 06 Jul 2006 00:00:47 -0400, Pavel Roskin <proski at gnu.org> wrote:

> Hello!
>
> On Wed, 2006-07-05 at 18:56 -0400, Sun Kim wrote:
>> Has anyone compiled hostap 0.4.7 with the 2.6.17 kernel yet?
>
> Compiling stand-alone hostap driver is not supported with the kernels
> that already include hostap driver.  Stand-alone compilation was failing
> with older kernels, so I'm not surprised it's failing with 2.6.17.
>

If the kernel that already has hostap driver, 'lsmod' doesn't show  
hostap_crypt_wep, hostap_cs, hostap_crypt, etc. After I issue modprobe  
hostap, only hostap and ieee80211_crypt. Is it normal?

-
Thanks,
SUN




From proski  Wed Jul  5 21:31:10 2006
From: proski (Pavel Roskin)
Date: Thu, 06 Jul 2006 00:31:10 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <op.tb82cggcs31rc3@sraker>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<1152158447.10415.22.camel@dv>  <op.tb82cggcs31rc3@sraker>
Message-ID: <1152160270.10415.36.camel@dv>

On Thu, 2006-07-06 at 00:20 -0400, Sun wrote:
> If the kernel that already has hostap driver, 'lsmod' doesn't show  
> hostap_crypt_wep, hostap_cs, hostap_crypt, etc. After I issue modprobe  
> hostap, only hostap and ieee80211_crypt. Is it normal?

I think it's normal.

Actually, I meant the kernels that have hostap driver in the sources.
Even if the driver in the kernel is not enabled, you still cannot
compile the external hostap against it because the external driver is
not updated for the new kernels.

-- 
Regards,
Pavel Roskin




From ulovecutesun  Wed Jul  5 22:00:18 2006
From: ulovecutesun (Sun Kim)
Date: Thu, 6 Jul 2006 01:00:18 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <1152160270.10415.36.camel@dv>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<1152158447.10415.22.camel@dv> <op.tb82cggcs31rc3@sraker>
	<1152160270.10415.36.camel@dv>
Message-ID: <eb905330607052200t32d0ce00k8f5d72eb49492fad@mail.gmail.com>

On 7/6/06, Pavel Roskin <proski at gnu.org> wrote:
>
> On Thu, 2006-07-06 at 00:20 -0400, Sun wrote:
> > If the kernel that already has hostap driver, 'lsmod' doesn't show
> > hostap_crypt_wep, hostap_cs, hostap_crypt, etc. After I issue modprobe
> > hostap, only hostap and ieee80211_crypt. Is it normal?
>
> I think it's normal.
>
> Actually, I meant the kernels that have hostap driver in the sources.
> Even if the driver in the kernel is not enabled, you still cannot
> compile the external hostap against it because the external driver is
> not updated for the new kernels.
>
> --
> Regards,
> Pavel Roskin
>
>
Then how can I enable it?

[root at localhost mkim]# /sbin/cardctl ident
Socket 0:
  product info: "Lucent Technologies", "WaveLAN/IEEE", "Version 01.01", ""
  manfid: 0x0156, 0x0002
  function: 6 (network)
Socket 1:
  no product info available
[root at localhost mkim]# /sbin/service pcmcia restart
Shutting down PCMCIA services: done.
Starting PCMCIA services: cardmgr[3271]: watching 2 sockets
done.

in /var/log/messages:
Jul  6 00:41:27 localhost cardmgr[3272]: socket 0: Lucent Technologies
WaveLAN/IEEE Adapter
Jul  6 00:41:28 localhost cardmgr[3272]: 'orinoco_cs' already bound to
socket 0

[root at localhost mkim]# /sbin/lsmod | grep hostap
hostap                116425  0
ieee80211_crypt         6721  1 hostap

Actually, I installed 'hostapd-0.4.9-11.rhfc4.at.i386.rpm' with 2.6.17-fc4.
Then I command the following without changing anything in file hostapd.conf.
Could you tell me what's happening here? Thank you.

[root at localhost mkim]# hostapd -B /etc/hostapd/hostapd.conf
Configuration file: /etc/hostapd/hostapd.conf
ioctl(SIOCGIFINDEX): No such device
hostap driver initialization failed.
rmdir[ctrl_interface]: No such file or directory


-- 
Thanks,
Sun
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060706/1ef9a279/attachment.htm 


From proski  Wed Jul  5 22:40:22 2006
From: proski (Pavel Roskin)
Date: Thu, 06 Jul 2006 01:40:22 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <eb905330607052200t32d0ce00k8f5d72eb49492fad@mail.gmail.com>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<1152158447.10415.22.camel@dv> <op.tb82cggcs31rc3@sraker>
	<1152160270.10415.36.camel@dv>
	<eb905330607052200t32d0ce00k8f5d72eb49492fad@mail.gmail.com>
Message-ID: <1152164422.10415.65.camel@dv>

On Thu, 2006-07-06 at 01:00 -0400, Sun Kim wrote:

> Then how can I enable it? 

Enable it in the .config file, e.g. by using "make menuconfig"

> Jul  6 00:41:28 localhost cardmgr[3272]: 'orinoco_cs' already bound to
> socket 0

And while at that, you may want to disable Orinoco support in the
kernel.

> [root at localhost mkim]# /sbin/lsmod | grep hostap
> hostap                116425  0
> ieee80211_crypt         6721  1 hostap

Make sure you have support for PCMCIA hostap (so that you have the
hostap_cs module).

> Actually, I installed 'hostapd-0.4.9-11.rhfc4.at.i386.rpm' with
> 2.6.17-fc4. Then I command the following without changing anything in
> file hostapd.conf. Could you tell me what's happening here? Thank
> you. 
> 
> [root at localhost mkim]# hostapd -B /etc/hostapd/hostapd.conf
> Configuration file: /etc/hostapd/hostapd.conf
> ioctl(SIOCGIFINDEX): No such device
> hostap driver initialization failed.
> rmdir[ctrl_interface]: No such file or directory

hostapd is configured to use hostap driver, but that driver is not used
on the network interface specified in hostapd.conf.  And it looks like
you don't have that such network interface at all.

-- 
Regards,
Pavel Roskin




From john  Wed Jul  5 23:07:38 2006
From: john (John Buttery)
Date: Thu, 6 Jul 2006 01:07:38 -0500
Subject: Using wpa_supplicant with rt2500 driver for auto-roaming
Message-ID: <20060706060738.GA92526@tempest.prismnet.com>

  I'm not sure this is really a hostap-related question, but this page:

http://hostap.epitest.fi/wpa_supplicant/

  ...suggested that this mailing list is "recommended for general
questions about wpa_supplicant", so here I am.  :)

  Anyway, I want to make sure I'm using wpa_supplicant for something
it's even intended to do in the first place, before I put any more
effort into trying to make it work.  I have a wifi card in my laptop
now, that works fine.  I originally installed waproamd because I wanted
to set it up so that my wireless networking would automatically bring
itself up as I roamed between different access points (both open-access
ones, and protected ones for which I have keys/passphrases).  Then, as I
was reading the docs for waproamd, it told me it was obsoleted by
wpa_supplicant.  Anyway, I can do all this up/down/reassociate stuff
manually now...I just want to automate it, and from what I can tell
wpa_supplicant is the best tool for the job.
  My guess was that I should use the "Linux wireless extensions" driver
on the wpa_supplicant command line...this is what I get (sorry if this
is a bit long; I'm not sure what's relevant).  "GuestAccess" is the
ESSID of the access point I'm trying to associate with; it's wide-open
(ie, no WEP/WPA/etc).  The return of the prompt at the end of the output
is the result of my having pressed Ctrl-c.

# wpa_supplicant -i ra0 -D wext -c /etc/wpa_supplicant.conf
ioctl[SIOCSIWPMKSA]: Operation not supported
WEXT auth param 7 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
ioctl[SIOCSIWENCODEEXT]: Operation not supported
ioctl[SIOCSIWENCODEEXT]: Operation not supported
ioctl[SIOCSIWENCODEEXT]: Operation not supported
ioctl[SIOCSIWENCODEEXT]: Operation not supported
WEXT auth param 4 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 5 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
Trying to associate with 00:13:19:31:9c:30 (SSID='GuestAccess' freq=0 MHz)
WEXT auth param 6 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 5 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
ioctl[SIOCSIWGENIE]: Operation not supported
WEXT auth param 0 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 1 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 2 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 3 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 10 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 8 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
Association request to the driver failed
Authentication with 00:00:00:00:00:00 timed out.
Trying to associate with 00:13:19:31:9c:30 (SSID='GuestAccess' freq=0 MHz)
WEXT auth param 6 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 5 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
ioctl[SIOCSIWGENIE]: Operation not supported
WEXT auth param 0 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 1 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 2 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 3 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 10 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 8 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
Association request to the driver failed
Authentication with 00:00:00:00:00:00 timed out.
Trying to associate with 00:13:19:31:9c:30 (SSID='GuestAccess' freq=0 MHz)
WEXT auth param 6 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 5 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
ioctl[SIOCSIWGENIE]: Operation not supported
WEXT auth param 0 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 1 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 2 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 3 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 10 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 8 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
Association request to the driver failed
Authentication with 00:00:00:00:00:00 timed out.
Trying to associate with 00:13:19:31:9c:30 (SSID='GuestAccess' freq=0 MHz)
WEXT auth param 6 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 5 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
ioctl[SIOCSIWGENIE]: Operation not supported
WEXT auth param 0 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 1 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 2 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 3 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 10 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 8 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
Association request to the driver failed
WEXT auth param 7 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
Failed to disable WPA in the driver.
WEXT auth param 5 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
WEXT auth param 4 value 0x0 - ioctl[SIOCSIWAUTH]: Operation not supported
#

-- 
  John  ! Since this email isn't signed, you can't really tell it's from
 Buttery! me; I'll hopefully have my computer working normally again
www.io.c! soon, but until then...gotta love catastrophic drive failure.
om/~john! Mmm, rdiff-backup to the rescue!



From n.anuranjani  Thu Jul  6 03:27:30 2006
From: n.anuranjani (Anuranjani Nandakumar)
Date: Thu, 6 Jul 2006 15:57:30 +0530
Subject: wpa_supplicant (EAP-TLS) + RADIUS (Free radius) + AP
Message-ID: <a2c771a0607060327m4d86877cv92e0ad7956bbc3ff@mail.gmail.com>

Hi all,
I am trying to configure wpa_supplicant in Windows which has a netgear
wg311v2 card. I am using FreeRadius as the backend server. Linksys
WRT54G is the AP.
My configuration are as follows:
In FreeRadius:
	-Edited radiusd.conf to enable "eap" in authenticate.
	-Edited eap.conf:
 	eap {
              	 default_eap_type = tls
               	 timer_expire     = 60
       	 tls {
                       private_key_password = *********
                       private_key_file =   ${raddbdir}/certs/server_keycert.pem
                       certificate_file = ${raddbdir}/certs/server_keycert.pem
                       CA_file = ${raddbdir}/certs/cacert.pem
                       dh_file = ${raddbdir}/certs/dh
                       random_file = ${raddbdir}/certs/random
                       fragment_size = 1024
                     }
                 }

In the Access point:
	Linksys WRT54G has the following wireless security options:
	Security mode:  Disabled
	                          WPA Personal
		     WPA Enterprise
		     WPA2 Personal
		     WPA2 Enterprise
		     RADIUS
		     WEP
			
	From the above options i chose WPA Enterprise which would mean EAP + WPA.
	
	WPA Algorithms: TKIP
                                                 AES
		
	From these i chose TKIP but was not quite sure why i am choosing that.
	
	Radius server:
	Radius port : 1812
	Shared key:
	Key renewal timeout :
	
Please confirm whether the configurations i made are correct for an
EAP-TLS authentication followed by WPA.

In the wpa_supplicant:

The wireless card used is Netgear wg311 v2 and this uses Ndis driver.

I tried configuring the wpa_supplicant in Windows XP. The supplicant
configuration was totally out of context for me. I was wondering on
how i wld replace the path to certificates in Windows. I jus gave a
rough configuration and ran the supplicant. To my surprise supplicant
contacted the AP and the AP inturn sent it to RADIUS. But the RADIUS
server as i expected replied with an access reject.

Please help me out on configuring the wpa_supplicant in windows given
tht my CA cert is cacert.pem and client cert is client_cert.p12

I hope its a detailed description of the set up. Have i left anything
specific tht would make things clear? Do let me know.

Thanks in advance
Regards,
Anuranjani Nandakumar.



From JohnRChamplin  Thu Jul  6 13:19:55 2006
From: JohnRChamplin (John -)
Date: Thu, 6 Jul 2006 16:19:55 -0400
Subject: ioctl[...]: No such device
Message-ID: <20060706201955.GA12100@columbus.rr.com>

I'm trying, and failing, to get a pc card working in my ThinkPad 600X
running Debian sid with a 2.6.16 home-made kernel. The card is identified:

root@~# pccardctl ident
Socket 1:
  product info: "IBM Corporation", "IBM High Rate Wireless LAN PC Card", "Version 01.01", ""
  manfid: 0x0156, 0x0002
  function: 6 (network)

But otherwise it seems invisible: when unplugged and plugged in again,
the only response is:

pccard: card ejected from slot 1
pccard: PCMCIA card inserted into slot 1
pccard: registering new device pcmcia:1.0

(However, when I put back the wired card, it is identified as well: 
PCI ...
eth0 ...)

"ifup wlan0" gets nothing beyond sixteen (16) different ways of
filling in the ... in "ioctl[...]: No such device". The most
important, perhaps, is the one that shows up in response to

strace /etc/init.d/hostapd restart
[snip]
 waitpid(-1, Starting advanced IEEE 802.11 management: hostapdioctl[PRISM2_IOCTL_PRISM2_PARAM]: No s
rmdir[ctrl_interface]: No such file or directory
...failed.

I'm guessing that the problem is something simple and basic that keeps
the card  from being set up from  the start. I won't  inflict the long
list of things that I've tried without success, including reinstalling
hostap*,  moving working  .conf files  from another  laptop,  and even
downgrading.

Please accept my apologies for what is probably a dumb newbie
question, but I'm stumped.

TIA.

-- 
JohnRChamplin at columbus.rr.com
====================================================
PGP key 1024D/99421A63 2005-01-05
EE51 79E9 F244 D734 A012 1CEC 7813 9FE9 9942 1A63
gpg --keyserver subkeys.pgp.net --recv-keys 99421A63
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060706/7460f527/attachment.pgp 


From proski  Thu Jul  6 13:33:31 2006
From: proski (Pavel Roskin)
Date: Thu, 06 Jul 2006 16:33:31 -0400
Subject: ioctl[...]: No such device
In-Reply-To: <20060706201955.GA12100@columbus.rr.com>
References: <20060706201955.GA12100@columbus.rr.com>
Message-ID: <1152218011.13329.7.camel@dv>

On Thu, 2006-07-06 at 16:19 -0400, John - wrote:
> Please accept my apologies for what is probably a dumb newbie
> question, but I'm stumped.

I think you should describe just one problem, the one that happens
first.  In your case, it's probably bringing the interface up.  Try
using low-level commands first (ifconfig, iwconfig) and don't use WEP or
WPA if it's not needed to reproduce the problem.  ifup is a script that
may call ifconfig many times, which is why you are getting so many
messages.

Also, give more details.  Don't rephrase or shorten error messages.  If
the software doesn't behave the way it should, the messages are not
guaranteed to be pure truth.  Exact messages are required to pinpoint
their origins.  Besides, if you are "stumped", why should we trust your
interpretations of the messages and your interpretation of which of them
are important?

-- 
Regards,
Pavel Roskin




From jar  Thu Jul  6 15:26:35 2006
From: jar (Jar)
Date: Fri, 07 Jul 2006 01:26:35 +0300
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
Message-ID: <44AD8E1B.6040100@pcuf.fi>

Sun Kim wrote:
> Has anyone compiled hostap 0.4.7 with the 2.6.17 kernel yet?
> 
> I got the following errs.
> 
> [root at localhost hostap-driver-0.4.9]# make
> make -C /lib/modules/2.6.17-1.2139_FC4/build 
> SUBDIRS=/home/mkim/Desktop/hostap/hostap-driver-0.4.9/driver/modules \
>         
> MODVERDIR=/home/mkim/Desktop/hostap/hostap-driver-0.4.9/driver/modules 
> modules
> make[1]: Entering directory `/usr/src/kernels/2.6.17-1.2139_FC4-i686'
> scripts/Makefile.build:17: 
> /home/mkim/Desktop/hostap/hostap-driver-0.4.9/driver/modules/Makefile: 
> No such file or directory
> make[2]: *** No rule to make target 
> `/home/mkim/Desktop/hostap/hostap-driver-0.4.9/driver/modules/Makefile'.  
> Stop.
> make[1]: *** 
> [_module_/home/mkim/Desktop/hostap/hostap-driver-0.4.9/driver/modules] 
> Error 2
> make[1]: Leaving directory `/usr/src/kernels/2.6.17-1.2139_FC4-i686'
> make: *** [2.6] Error 2

For some reason if you run make with 2.6.17 kernel all files in 
/driver/modules directory are _deleted_. But if do the following change 
to the Makefile:

-       $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules \
-               MODVERDIR=$(PWD)/driver/modules modules
+       $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules

The files are not deleted and the compiling starts and at this point you 
can see the messages:

#error Host AP driver was added into Linux 2.6.14.
#error The version used in the kernel tree should be used instead of this
#error external release which is only maintained for old kernel versions.



-- 
Best Regards, Jar



From jar  Thu Jul  6 15:50:32 2006
From: jar (Jar)
Date: Fri, 07 Jul 2006 01:50:32 +0300
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <eb905330607052200t32d0ce00k8f5d72eb49492fad@mail.gmail.com>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>	<1152158447.10415.22.camel@dv>
	<op.tb82cggcs31rc3@sraker>	<1152160270.10415.36.camel@dv>
	<eb905330607052200t32d0ce00k8f5d72eb49492fad@mail.gmail.com>
Message-ID: <44AD93B8.1070701@pcuf.fi>

Sun Kim wrote:
> [root at localhost mkim]# /sbin/cardctl ident
> Socket 0:
>   product info: "Lucent Technologies", "WaveLAN/IEEE", "Version 01.01", ""
>   manfid: 0x0156, 0x0002
>   function: 6 (network)

Is this card hermes based (driver=orinoco_cs) but not prism 
(driver=hostap_cs) based?

-- 
Best Regards, Jar



From ulovecutesun  Thu Jul  6 16:04:02 2006
From: ulovecutesun (Sun)
Date: Thu, 06 Jul 2006 19:04:02 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <44AD93B8.1070701@pcuf.fi>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<1152158447.10415.22.camel@dv> <op.tb82cggcs31rc3@sraker>
	<1152160270.10415.36.camel@dv>
	<eb905330607052200t32d0ce00k8f5d72eb49492fad@mail.gmail.com>
	<44AD93B8.1070701@pcuf.fi>
Message-ID: <op.tcaic0lks31rc3@sraker>

On Thu, 06 Jul 2006 18:50:32 -0400, Jar <jar at pcuf.fi> wrote:

> Sun Kim wrote:
>> [root at localhost mkim]# /sbin/cardctl ident
>> Socket 0:
>>   product info: "Lucent Technologies", "WaveLAN/IEEE", "Version 01.01",  
>> ""
>>   manfid: 0x0156, 0x0002
>>   function: 6 (network)
>
> Is this card hermes based (driver=orinoco_cs) but not prism  
> (driver=hostap_cs) based?
>

This card is based on prism chipset. In my kernel (2.6.17) this card is  
set to use orinoco. So, I needed to disable orinoco_cs, then to enable  
hostap_cs. Also, I added this card information into hostap_cs.config.
Then it worked. Thank you all for your time.



From proski  Thu Jul  6 16:05:00 2006
From: proski (Pavel Roskin)
Date: Thu, 06 Jul 2006 19:05:00 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <44AD93B8.1070701@pcuf.fi>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<1152158447.10415.22.camel@dv> <op.tb82cggcs31rc3@sraker>
	<1152160270.10415.36.camel@dv>
	<eb905330607052200t32d0ce00k8f5d72eb49492fad@mail.gmail.com>
	<44AD93B8.1070701@pcuf.fi>
Message-ID: <1152227100.16115.0.camel@dv>

On Fri, 2006-07-07 at 01:50 +0300, Jar wrote:
> Sun Kim wrote:
> > [root at localhost mkim]# /sbin/cardctl ident
> > Socket 0:
> >   product info: "Lucent Technologies", "WaveLAN/IEEE", "Version 01.01", ""
> >   manfid: 0x0156, 0x0002
> >   function: 6 (network)
> 
> Is this card hermes based (driver=orinoco_cs) but not prism 
> (driver=hostap_cs) based?

Yes.  I was too concerned with other things to look at that.  Then
hostap becomes totally irrelevant.

-- 
Regards,
Pavel Roskin




From proski  Thu Jul  6 16:18:11 2006
From: proski (Pavel Roskin)
Date: Thu, 06 Jul 2006 19:18:11 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <44AD8E1B.6040100@pcuf.fi>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<44AD8E1B.6040100@pcuf.fi>
Message-ID: <1152227891.16115.12.camel@dv>

On Fri, 2006-07-07 at 01:26 +0300, Jar wrote:
> For some reason if you run make with 2.6.17 kernel all files in 
> /driver/modules directory are _deleted_.

That's the consequence of the "finger of death" patch by Sam Ravnborg.
It used to be even worse in 2.6.17 pre-releases, when the modules
directory would be deleted as well.  The best I could negotiate with Sam
was to spare the directory:

http://lkml.org/lkml/2006/4/30/114

> But if do the following change 
> to the Makefile:
> 
> -       $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules \
> -               MODVERDIR=$(PWD)/driver/modules modules
> +       $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules
> 
> The files are not deleted and the compiling starts and at this point you 
> can see the messages:
> 
> #error Host AP driver was added into Linux 2.6.14.
> #error The version used in the kernel tree should be used instead of this
> #error external release which is only maintained for old kernel versions.

That makes sense.  Defining MODVERDIR was done primarily for cosmetic
reasons to avoid having .tmp_versions directory.  Now that MODVERDIR is
a death sentence to the directory it points to, your patch would be
helpful.

-- 
Regards,
Pavel Roskin




From JohnRChamplin  Thu Jul  6 20:02:40 2006
From: JohnRChamplin (John -)
Date: Thu, 6 Jul 2006 23:02:40 -0400
Subject: ioctl[...]: No such device
Message-ID: <20060707030240.GA6946@columbus.rr.com>

> Subject: Re: ioctl[...]: No such device
> > On Thu, 2006-07-06 at 16:19 -0400, John - wrote:
> > <long snip>
> > Please accept my apologies for what is probably a
> > dumb newbie
> > question, but I'm stumped.
>
> I think you should describe just one problem, the
> one that happens
> first.  In your case, it's probably bringing the
> interface up.  Try
> using low-level commands first (ifconfig, iwconfig)
> and don't use WEP or
> WPA if it's not needed to reproduce the problem.=20
> ifup is a script that
> may call ifconfig many times, which is why you are
> getting so many
> messages.
>
> Also, give more details.  Don't rephrase or shorten
> error messages.  If
> the software doesn't behave the way it should, the
> messages are not
> guaranteed to be pure truth.  Exact messages are
> required to pinpoint
> their origins.  Besides, if you are "stumped", why
> should we trust your
> interpretations of the messages and your
> interpretation of which of them
> are important?

Thanks for the quick answer, Pavel. I agree that the problem's
probably just bringing the interface up. I'm not using WEP or WPA yet.
Here's the information you asked for, including complete error
messages: 

root@~# ifconfig
lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:4 errors:0 dropped:0 overruns:0 frame:0
          TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:280 (280.0 b)  TX bytes:280 (280.0 b)

root@~# iwconfig wlan0
wlan0     No such device

I fear that these two items may not be particularly informative. So
what next?

-- 
JohnRChamplin at columbus.rr.com
====================================================
PGP key 1024D/99421A63 2005-01-05
EE51 79E9 F244 D734 A012 1CEC 7813 9FE9 9942 1A63
gpg --keyserver subkeys.pgp.net --recv-keys 99421A63
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060706/b5ad0546/attachment.pgp 


From proski  Thu Jul  6 21:38:32 2006
From: proski (Pavel Roskin)
Date: Fri,  7 Jul 2006 00:38:32 -0400
Subject: ioctl[...]: No such device
In-Reply-To: <20060707030240.GA6946@columbus.rr.com>
References: <20060707030240.GA6946@columbus.rr.com>
Message-ID: <20060707003832.7tw00kk00sgsc80o@webmail.spamcop.net>

Quoting John - <JohnRChamplin at columbus.rr.com>:

> Thanks for the quick answer, Pavel. I agree that the problem's
> probably just bringing the interface up. I'm not using WEP or WPA yet.
> Here's the information you asked for, including complete error
> messages:
>
> root@~# ifconfig
> lo        Link encap:Local Loopback
>           inet addr:127.0.0.1  Mask:255.0.0.0
>           UP LOOPBACK RUNNING  MTU:16436  Metric:1
>           RX packets:4 errors:0 dropped:0 overruns:0 frame:0
>           TX packets:4 errors:0 dropped:0 overruns:0 carrier:0
>           collisions:0 txqueuelen:0
>           RX bytes:280 (280.0 b)  TX bytes:280 (280.0 b)

"ifconfig -a" would show all interfaces, including those that are down.

> root@~# iwconfig wlan0
> wlan0     No such device

iwconfig without arguments will show all interfaces.  Do you have the driver
loaded at all?  Did it find the hardware?  "dmesg" shows kernel messages,
including those from the driver.

> I fear that these two items may not be particularly informative. So
> what next?

Load the driver are try again.  Try to bring the interface up using ifconfig. 
Check the kernel messages.

Generally, describe what your are doing.  I have no idea from your message if
"iwconfig wlan0" stopped working after you tried to bring wlan0 up or after you
loaded the driver or after clean reboot.

When reporting problems with software, mention versions of the software involved
(hostap, kernel).  In this case, the hardware version of the card may be useful
as well.  If the driver detects the card, it should print some information,
such as the firmware versions.  That would be useful too.

--
Regards,
Pavel Roskin



From jar  Thu Jul  6 23:01:53 2006
From: jar (Jar)
Date: Fri, 07 Jul 2006 09:01:53 +0300
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <1152227891.16115.12.camel@dv>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>	
	<44AD8E1B.6040100@pcuf.fi> <1152227891.16115.12.camel@dv>
Message-ID: <44ADF8D1.3020304@pcuf.fi>

Pavel Roskin wrote:
> That's the consequence of the "finger of death" patch by Sam Ravnborg.
> It used to be even worse in 2.6.17 pre-releases, when the modules
> directory would be deleted as well.  The best I could negotiate with Sam
> was to spare the directory:

OK. Almost deleting all my *.c and *.h files when testing the 
compilation against 2.6.17 for an another module. Fortunately I have 
backups. Very dangerous, deletes all source files without warning.

-- 
Best Regards, Jar



From kelrin  Fri Jul  7 04:16:39 2006
From: kelrin (Kel Modderman)
Date: Fri, 07 Jul 2006 21:16:39 +1000
Subject: [patch]: hostapd PID file
Message-ID: <44AE4297.3060802@tpg.com.au>

Hi Jouni,

It'd be great to have hostapd create a PID file. Patch is attached.

Thanks, Kel.
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: hostapd-pidfile.patch
Url: http://lists.shmoo.com/pipermail/hostap/attachments/20060707/7f4aaf1f/attachment.txt 


From chandramani  Fri Jul  7 04:30:06 2006
From: chandramani (chandramani)
Date: Fri, 07 Jul 2006 17:00:06 +0530
Subject: WDS with WEP
Message-ID: <200607071130.RAA23845@pr10.indiatimes.com>

Hi all,

Using madwifi-ng and two atheros cards, I have configured two AP-WDS as instructed in 

http://madwifi.org/wiki/UserDocs/WirelessBridging 

Each card has two interfaces one ath0 in 'Master' and other ath1 in 'Repeater' mode.
It seems that the set is working fine because I am able to ping one from other. 

But now I want to configure this WDS link for security. How can I achieve that. I am not clear when I ping one WDS from another, packet passes through which interfaces ('ath0' or 'ath1' or both). 

I tried following command to set a key for ath2

iwconfig ath2 key [2] s:secretkey

but setup crashed with following message and I had to reboot.
-------------------------------------------------------------------------------------------------------------
unexpected operating mode 2<0>------------[ cut here ]------------
kernel BUG at <bad filename>:23128!
invalid opcode: 0000 [#1]
PREEMPT
Modules linked in: wlan_wep wlan_acl wlan_tkip wlan_xauth wlan_scan_ap bridge sc
1200 scx200 natsemi crc32 ohci_hcd usbcore ath_pci ath_rate_sample wlan ath_hal
CPU:    0
EIP:    0060:[<c887bb44>]    Tainted: P      VLI
EFLAGS: 00010282   (2.6.16.18 #1)
EIP is at ieee80211_node_leave+0x62/0x196 [wlan]
eax: 0000001e   ebx: c6d22000   ecx: c6defda4   edx: c888d742
esi: c6d22000   edi: c78ba260   ebp: c128a260   esp: c6defda0
ds: 007b   es: 007b   ss: 0068
Process iwconfig (pid: 1806, threadinfo=c6dee000 task=c1246590)
Stack: <0>c888d742 00000002 0000001e c128abdc c6d22000 000000e5 c128abdc c78ba26
0
       c887b374 c6d22000 c6d22000 c888059e c128a260 c6d76000 c78ba260 00000004
       c888083c c128abdc c888059e c78ba260 c7138000 00000001 c128a000 c128a260
Call Trace:
 [<c887b374>] ieee80211_iterate_nodes+0x6c/0xa1 [wlan]
 [<c888059e>] sta_disassoc+0x0/0x34 [wlan]
 [<c888083c>] __ieee80211_newstate+0x211/0x646 [wlan]
 [<c888059e>] sta_disassoc+0x0/0x34 [wlan]
 [<c8880dfc>] ieee80211_newstate+0x18b/0x195 [wlan]
 [<c88a5e62>] ath_newstate+0x4f8/0x5e0 [ath_pci]
 [<c8880619>] ieee80211_new_state+0x26/0x38 [wlan]
 [<c8882373>] ieee80211_ioctl_siwencode+0x221/0x260 [wlan]
 [<c020c046>] wireless_process_ioctl+0x31c/0x62f
 [<c012ab74>] filemap_nopage+0xb7/0x2d6
 [<c8882152>] ieee80211_ioctl_siwencode+0x0/0x260 [wlan]
 [<c0203688>] dev_ioctl+0x247/0x27a
 [<c01fa7c4>] sock_ioctl+0x1cf/0x1d9
 [<c01511b0>] do_ioctl+0x28/0x66
 [<c015145b>] vfs_ioctl+0x17a/0x188
 [<c0151494>] sys_ioctl+0x2b/0x47
 [<c01025e9>] syscall_call+0x7/0xb
Code: 00 00 50 57 e8 94 d5 ff ff 83 c4 14 8b 87 34 02 00 00 83 f8 06 74 18 85 c0
 74 14 83 f8 03 74 0f 50 68 42 d7 88 c8 e8 4d 60 89 f7 <0f> 0b 58 5a 66 83 7e 2c
 00 0f 84 c8 00 00 00 8b 87 14 06 00 00
 <0>Kernel panic - not syncing: Fatal exception in interrupt
--------------------------------------------------------------------------------------------------------
thanking in advance for any sort of help

regards
chandra


 










From kelrin  Fri Jul  7 04:39:02 2006
From: kelrin (Kel Modderman)
Date: Fri, 07 Jul 2006 21:39:02 +1000
Subject: WDS with WEP
In-Reply-To: <200607071130.RAA23845@pr10.indiatimes.com>
References: <200607071130.RAA23845@pr10.indiatimes.com>
Message-ID: <44AE47D6.30406@tpg.com.au>

chandramani wrote:
> Hi all,
>
> Using madwifi-ng and two atheros cards, I have configured two AP-WDS as instructed in 
>
> http://madwifi.org/wiki/UserDocs/WirelessBridging 
>
> Each card has two interfaces one ath0 in 'Master' and other ath1 in 'Repeater' mode.
> It seems that the set is working fine because I am able to ping one from other. 
>
> But now I want to configure this WDS link for security. How can I achieve that. I am not clear when I ping one WDS from another, packet passes through which interfaces ('ath0' or 'ath1' or both). 
>
> I tried following command to set a key for ath2
>
> iwconfig ath2 key [2] s:secretkey
>
> but setup crashed with following message and I had to reboot.
> -------------------------------------------------------------------------------------------------------------
> unexpected operating mode 2<0>------------[ cut here ]------------
> kernel BUG at <bad filename>:23128!
> invalid opcode: 0000 [#1]
> PREEMPT
> Modules linked in: wlan_wep wlan_acl wlan_tkip wlan_xauth wlan_scan_ap bridge sc
> 1200 scx200 natsemi crc32 ohci_hcd usbcore ath_pci ath_rate_sample wlan ath_hal
> CPU:    0
> EIP:    0060:[<c887bb44>]    Tainted: P      VLI
> EFLAGS: 00010282   (2.6.16.18 #1)
> EIP is at ieee80211_node_leave+0x62/0x196 [wlan]
> eax: 0000001e   ebx: c6d22000   ecx: c6defda4   edx: c888d742
> esi: c6d22000   edi: c78ba260   ebp: c128a260   esp: c6defda0
> ds: 007b   es: 007b   ss: 0068
> Process iwconfig (pid: 1806, threadinfo=c6dee000 task=c1246590)
> Stack: <0>c888d742 00000002 0000001e c128abdc c6d22000 000000e5 c128abdc c78ba26
> 0
>        c887b374 c6d22000 c6d22000 c888059e c128a260 c6d76000 c78ba260 00000004
>        c888083c c128abdc c888059e c78ba260 c7138000 00000001 c128a000 c128a260
> Call Trace:
>  [<c887b374>] ieee80211_iterate_nodes+0x6c/0xa1 [wlan]
>  [<c888059e>] sta_disassoc+0x0/0x34 [wlan]
>  [<c888083c>] __ieee80211_newstate+0x211/0x646 [wlan]
>  [<c888059e>] sta_disassoc+0x0/0x34 [wlan]
>  [<c8880dfc>] ieee80211_newstate+0x18b/0x195 [wlan]
>  [<c88a5e62>] ath_newstate+0x4f8/0x5e0 [ath_pci]
>  [<c8880619>] ieee80211_new_state+0x26/0x38 [wlan]
>  [<c8882373>] ieee80211_ioctl_siwencode+0x221/0x260 [wlan]
>  [<c020c046>] wireless_process_ioctl+0x31c/0x62f
>  [<c012ab74>] filemap_nopage+0xb7/0x2d6
>  [<c8882152>] ieee80211_ioctl_siwencode+0x0/0x260 [wlan]
>  [<c0203688>] dev_ioctl+0x247/0x27a
>  [<c01fa7c4>] sock_ioctl+0x1cf/0x1d9
>  [<c01511b0>] do_ioctl+0x28/0x66
>  [<c015145b>] vfs_ioctl+0x17a/0x188
>  [<c0151494>] sys_ioctl+0x2b/0x47
>  [<c01025e9>] syscall_call+0x7/0xb
> Code: 00 00 50 57 e8 94 d5 ff ff 83 c4 14 8b 87 34 02 00 00 83 f8 06 74 18 85 c0
>  74 14 83 f8 03 74 0f 50 68 42 d7 88 c8 e8 4d 60 89 f7 <0f> 0b 58 5a 66 83 7e 2c
>  00 0f 84 c8 00 00 00 8b 87 14 06 00 00
>  <0>Kernel panic - not syncing: Fatal exception in interrupt
> --------------------------------------------------------------------------------------------------------
> thanking in advance for any sort of help
>
>   

Could be related to http://madwifi.org/ticket/575 ?

Thanks, Kel.




From paloseco  Fri Jul  7 08:01:42 2006
From: paloseco (Paloseco)
Date: Fri, 7 Jul 2006 08:01:42 -0700
Subject: wpa_supplicants disconnects randomly
Message-ID: <8242fee30607070801j9081583y18548ca3c692c554@mail.gmail.com>

I am using wpa_supplicant with an wpa-eap with tkip and ttls and I get
this when disconnects:

EAPOL: External notification - portValid=1
EAPOL: SUPP_PAE entering state AUTHENTICATED
EAPOL: authWhile --> 0
EAPOL: idleWhile --> 0
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
Setting scan request: 0 sec 100000 usec

And tries to reconnect again. Sometimes I get this:

wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
wpa_driver_wext_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - portControl=Auto
Wireless event: cmd=0x8b06 len=8
Wireless event: cmd=0x8b1a len=16
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
BSSID 00:00:00:00:00:00 blacklist count incremented to 5
State: ASSOCIATING -> DISCONNECTED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
Authentication with 00:00:00:00:00:00 timed out.
BSSID 00:00:00:00:00:00 blacklist count incremented to 6
State: DISCONNECTED -> DISCONNECTED
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
Scan timeout - try to get results
Received 3063 bytes of scan results (15 BSSes)
Scan results: 15
Selecting BSS from priority group 2

Is this a bug or is ok? Thanks.



From proski  Fri Jul  7 09:44:04 2006
From: proski (Pavel Roskin)
Date: Fri, 07 Jul 2006 12:44:04 -0400
Subject: WDS with WEP
In-Reply-To: <44AE47D6.30406@tpg.com.au>
References: <200607071130.RAA23845@pr10.indiatimes.com>
	<44AE47D6.30406@tpg.com.au>
Message-ID: <1152290644.17553.5.camel@dv>

On Fri, 2006-07-07 at 21:39 +1000, Kel Modderman wrote:
> chandramani wrote:
> > Hi all,
> >
> > Using madwifi-ng and two atheros cards, I have configured two AP-WDS as instructed in 
> >
> > http://madwifi.org/wiki/UserDocs/WirelessBridging

What has this thread doing in the hostap list?  It has nothing to do
with hostap driver or WPA.  Let's move it to the madwifi list.

> >  [<c887b374>] ieee80211_iterate_nodes+0x6c/0xa1 [wlan]
> >  [<c888059e>] sta_disassoc+0x0/0x34 [wlan]
> >  [<c888083c>] __ieee80211_newstate+0x211/0x646 [wlan]
> >  [<c888059e>] sta_disassoc+0x0/0x34 [wlan]
> Could be related to http://madwifi.org/ticket/575 ?

Hardly.  The stack trace is totally different.

-- 
Regards,
Pavel Roskin




From JohnRChamplin  Fri Jul  7 10:10:57 2006
From: JohnRChamplin (John -)
Date: Fri, 7 Jul 2006 13:10:57 -0400
Subject: ioctl[...]: No such device
In-Reply-To: <20060707003832.7tw00kk00sgsc80o@webmail.spamcop.net>
References: <20060707030240.GA6946@columbus.rr.com>
	<20060707003832.7tw00kk00sgsc80o@webmail.spamcop.net>
Message-ID: <20060707171057.GA9033@columbus.rr.com>

On (07/07/06 00:38), Pavel Roskin wrote:
> Quoting John - <JohnRChamplin at columbus.rr.com>:
> > Thanks for the quick answer, Pavel. I agree that the problem's
> > probably just bringing the interface up.
> > ...

> iwconfig without arguments will show all interfaces.

root@~# iwconfig
plip0     no wireless extensions
lo        no wireless extensions
dummy0    no wireless extentions

> Do you have
> the driver
> loaded at all?  Did it find the hardware?  "dmesg" shows kernel messages,
> including those from the driver.

I've got hostap and hostap_pci in /etc/modules.
me@~$ dmesg
...
ieee80211_crypt: registered algorithm 'NULL'
hostap_pci: 0.4.4-kernel (Jouni Malinen <jkmaline at cc.hut.fi>)

But NB, there's NO entry "hostap_pci: Registered netdevice ..." of
any sort. So maybe it didn't find the hardware.

> Load the driver are try again.  Try to bring the interface up using ifconfi
> Check the kernel messages.
Nothing is changed by
root@~#modprobe hostap hostap_pci
It remains
root@~$ lsmod
...
hostap_pci             48912  0
hostap                 99140  1 hostap_pci
ieee80211_crypt         5280  1 hostap

root@~# ifconfig wlan0 up
wlan0: ERROR while getting interface flags: No such device

root@~# ifconfig -a
dummy0    Link encap:Ethernet  HWaddr 26:A3:F5:77:D5:19
...
lo        Link encap:Local Loopback
...
plip0     Link encap:Ethernet  HWaddr FC:FC:FC:FC:FC:FC
...

There are no new messages in /var/log/syslog, messages, or kern.log
after these operations.

> Generally, describe what you are doing.  I have no idea from your message i
> "iwconfig wlan0" stopped working after you tried to bring wlan0 up or after
> loaded the driver or after clean reboot.

Actually, I've tried dozens and dozens of ways of getting wlan0 to
recognize one or another access point, including four or five versions
of /etc/network/interfaces, following one or another of the files in
/usr/share/doc/(various). It would take pages and pages to describe it all.

iwconfig wlan0 didn't *stop* working. Before and after loading
drivers, on clean reboot as well, it is constant:
root@~# iwconfig wlan0
wlan0     No such device.

> When reporting problems with software, mention versions of the software inv
> (hostap, kernel).

me@~$ dpkg -l 'hostap*' pcmciautils wireless-utils
ii  hostap-modules-2.6.15-lapdog  0.4.1-1+2.6.15-lapdog-10.00.C Host AP drive
ii  hostap-source                 0.4.1-1                       Host AP drive
ii  hostap-utils                  0.4.0-1                       Utility progr
iF  hostapd                       0.5.3-1                       user space IE
ii  pcmciautils    014-1          PCMCIA utilities for Linux 2.6
ii  wireless-tools 28-1           Tools for manipulating Linux Wireless Exten

The "iF" regarding hostapd is, I think, because it has consistently
failed to set up with three versions of hostapd: 1%3a0.3.7-2, 0.5.0-1
and 0.5.3-1. (apt -f install fails to get any of them fully installed.)

root@~# uname -a
Linux lapdog 2.6.16-lapdog #1 Sun Jul 2 17:04:48 EDT 2006 i686 GNU/Linux

I get the same (lack of) results with an earlier version 2.6.16
as well as the version of 2.6.15 for which hostap-modules last
built. The .config file for all three kernels reads the same:
root@~# cat /boot/config-2.6.16-lapdog | grep -Ein hostap
963:CONFIG_HOSTAP=m
964:CONFIG_HOSTAP_FIRMWARE=y
965:CONFIG_HOSTAP_FIRMWARE_NVRAM=y
966:CONFIG_HOSTAP_PLX=m
967:CONFIG_HOSTAP_PCI=m
968:CONFIG_HOSTAP_CS=m

> In this case, the hardware version of the card may be useful
> as well.

root@~# pccardctl ident
...
Socket 1:
  product info: "IBM Corporation", "IBM High Rate Wireless LAN PC Card", "Ver
  manfid: 0x0156, 0x0002
  function: 6 (network)

Incidently, the card shows up only once in dmesg:
...
pcmcia: registering new device pcmcia1.0
...

> If the driver detects the card, it should print some information,
> such as the firmware versions.  That would be useful too.

Agreed, but it doesn't.

I hestitate to mention it, but the card works find under Windows XP
Pro.

Pavel, again let me offer thanks for your help.

-- 
JohnRChamplin at columbus.rr.com
====================================================
PGP key 1024D/99421A63 2005-01-05
EE51 79E9 F244 D734 A012 1CEC 7813 9FE9 9942 1A63
gpg --keyserver subkeys.pgp.net --recv-keys 99421A63
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060707/bb207ed7/attachment.pgp 


From parkthwin  Fri Jul  7 13:58:30 2006
From: parkthwin (Danny Kim)
Date: Fri, 07 Jul 2006 16:58:30 -0400
Subject: rogue AP?
Message-ID: <BAY119-F27306D4ACCB9166645720FAB740@phx.gbl>

Hi

For my test purpose, I am using personal AP with hostap driver
along with company wireless networks.
Some how my mobile node could not be connected to this AP.
and ethereal protocol analyzer shows that the  mobile node gets
Deauthentication message from other AP which might be company's wireless 
networks
I am not sure this is the way that prevents rogue AP.
I already asked my system admin for this problem but he doesn't seem to know 
very well.
so my question is how I can fix this problem? Is there any way to enable my 
personal AP?
I am using different essid of course....

Thanks

Danny





From proski  Fri Jul  7 20:01:32 2006
From: proski (Pavel Roskin)
Date: Fri, 07 Jul 2006 23:01:32 -0400
Subject: ioctl[...]: No such device
In-Reply-To: <20060707171057.GA9033@columbus.rr.com>
References: <20060707030240.GA6946@columbus.rr.com>
	<20060707003832.7tw00kk00sgsc80o@webmail.spamcop.net>
	<20060707171057.GA9033@columbus.rr.com>
Message-ID: <1152327692.8319.9.camel@dv>

On Fri, 2006-07-07 at 13:10 -0400, John - wrote:
> ieee80211_crypt: registered algorithm 'NULL'
> hostap_pci: 0.4.4-kernel (Jouni Malinen <jkmaline at cc.hut.fi>)

OK, so you have the driver and it loads.

> But NB, there's NO entry "hostap_pci: Registered netdevice ..." of
> any sort. So maybe it didn't find the hardware.

Sure it didn't.  Now please run "lspci" to see if the device is
connected.

> Actually, I've tried dozens and dozens of ways of getting wlan0 to
> recognize one or another access point, including four or five versions
> of /etc/network/interfaces, following one or another of the files in
> /usr/share/doc/(various). It would take pages and pages to describe it all.

That not needed if you don't have wlan0 :-)

> > When reporting problems with software, mention versions of the software inv
> > (hostap, kernel).
> 
> me@~$ dpkg -l 'hostap*' pcmciautils wireless-utils
> ii  hostap-modules-2.6.15-lapdog  0.4.1-1+2.6.15-lapdog-10.00.C Host AP drive
> ii  hostap-source                 0.4.1-1                       Host AP drive
> ii  hostap-utils                  0.4.0-1                       Utility progr
> iF  hostapd                       0.5.3-1                       user space IE
> ii  pcmciautils    014-1          PCMCIA utilities for Linux 2.6
> ii  wireless-tools 28-1           Tools for manipulating Linux Wireless Exten

That's quite old, but I'm not aware of any major bugs that would prevent
detection of PCI devices.

> root@~# pccardctl ident
> ...
> Socket 1:
>   product info: "IBM Corporation", "IBM High Rate Wireless LAN PC Card", "Ver
>   manfid: 0x0156, 0x0002
>   function: 6 (network)

If you want to use a PCMCIA card, you need hostap_cs, not hostap_pci.
Run "modprobe hostap_cs" and see what happens.  You may need to run
cardmgr if your system is not properly configured to support the new
PCMCIA driver model.

-- 
Regards,
Pavel Roskin




From proski  Fri Jul  7 20:21:49 2006
From: proski (Pavel Roskin)
Date: Fri, 07 Jul 2006 23:21:49 -0400
Subject: ioctl[...]: No such device
In-Reply-To: <20060707171057.GA9033@columbus.rr.com>
References: <20060707030240.GA6946@columbus.rr.com>
	<20060707003832.7tw00kk00sgsc80o@webmail.spamcop.net>
	<20060707171057.GA9033@columbus.rr.com>
Message-ID: <1152328909.8319.16.camel@dv>

On Fri, 2006-07-07 at 13:10 -0400, John - wrote:
> root@~# pccardctl ident
> ...
> Socket 1:
>   product info: "IBM Corporation", "IBM High Rate Wireless LAN PC Card", "Ver

Quick search on Google shows that this card uses Lucent firmware, so
it's not compatible with hostap.  You need orinoco_cs driver.

Unfortunately, orinoco driver doesn't support master mode or WPA yet, so
if you need it (as indicated by your attempts to install and run
hostapd), you probably need different hardware (prism 2/2.5/3, prism54,
atheros).

-- 
Regards,
Pavel Roskin




From JohnRChamplin  Sat Jul  8 15:11:48 2006
From: JohnRChamplin (John -)
Date: Sat, 8 Jul 2006 18:11:48 -0400
Subject: ioctl[...]: No such device
In-Reply-To: <1152328909.8319.16.camel@dv>
References: <20060707030240.GA6946@columbus.rr.com>
	<20060707003832.7tw00kk00sgsc80o@webmail.spamcop.net>
	<20060707171057.GA9033@columbus.rr.com>
	<1152328909.8319.16.camel@dv>
Message-ID: <20060708221148.GA12468@columbus.rr.com>

On (07/07/06 23:21), Pavel Roskin wrote:
> To: John - <JohnRChamplin at columbus.rr.com>
> From: Pavel Roskin <proski at gnu.org>
> Subject: Re: ioctl[...]: No such device
> Date: Fri, 07 Jul 2006 23:21:49 -0400
> X-Spam-Status: No, score=1.0 required=5.0 tests=BAYES_50 autolearn=no 
> 	version=3.1.3
> 
> On Fri, 2006-07-07 at 13:10 -0400, John - wrote:
> > root@~# pccardctl ident
> > ...
> > Socket 1:
> >   product info: "IBM Corporation", "IBM High Rate Wireless LAN PC Card", "Ver
> 
> Quick search on Google shows that this card uses Lucent firmware, so
> it's not compatible with hostap.  You need orinoco_cs driver.
> 
> Unfortunately, orinoco driver doesn't support master mode or WPA yet, so
> if you need it (as indicated by your attempts to install and run
> hostapd), you probably need different hardware (prism 2/2.5/3, prism54,
> atheros).

As your previous note suggested, I tried hostap_cs instead of _pci,
without success.

To complete the story, I recompiled the kernel, taking out hostap
modules and adding hermes/orinoco. And you are completely right; it
now runs fine, with pcmciautils; no need to go back to pcmcia-cs.

I had relied on Thinkwiki
(http://thinkwiki.org/wiki/Wireless_Network_Adapters#PC_Card_.28PCMCIA.29_adapters), quoting,

IBM High Rate Wireless LAN PC Card
Chipset: Prism 2.5
Drivers: orinoco_pci or hostap

My very positive experience with hostap on another ThinkPad led me to
choose hostap.  I should have read the fine print and noted the "2.5".

Pavel, I am really very grateful to you for hanging in and directing
me to the right answer -- on what turned out to be a simple matter,
perhaps, to you, but not to me.  Many thanks.

-- 
JohnRChamplin at columbus.rr.com
====================================================
PGP key 1024D/99421A63 2005-01-05
EE51 79E9 F244 D734 A012 1CEC 7813 9FE9 9942 1A63
gpg --keyserver subkeys.pgp.net --recv-keys 99421A63
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060708/f6d7fe68/attachment.pgp 


From proski  Sat Jul  8 16:43:02 2006
From: proski (Pavel Roskin)
Date: Sat, 08 Jul 2006 19:43:02 -0400
Subject: ioctl[...]: No such device
In-Reply-To: <20060708221148.GA12468@columbus.rr.com>
References: <20060707030240.GA6946@columbus.rr.com>
	<20060707003832.7tw00kk00sgsc80o@webmail.spamcop.net>
	<20060707171057.GA9033@columbus.rr.com> <1152328909.8319.16.camel@dv>
	<20060708221148.GA12468@columbus.rr.com>
Message-ID: <1152402182.2103.4.camel@dv>

On Sat, 2006-07-08 at 18:11 -0400, John - wrote:
> As your previous note suggested, I tried hostap_cs instead of _pci,
> without success.
> 
> To complete the story, I recompiled the kernel, taking out hostap
> modules and adding hermes/orinoco. And you are completely right; it
> now runs fine, with pcmciautils; no need to go back to pcmcia-cs.

Good to know.

> I had relied on Thinkwiki
> (http://thinkwiki.org/wiki/Wireless_Network_Adapters#PC_Card_.28PCMCIA.29_adapters), quoting,
> 
> IBM High Rate Wireless LAN PC Card
> Chipset: Prism 2.5
> Drivers: orinoco_pci or hostap

I have fixed it.  It was totally bogus.  Unfortunately, there is no way
to fix all web pages, so the lesson is not to rely on one source of
information if possible.

-- 
Regards,
Pavel Roskin




From dcbw  Sun Jul  9 07:03:17 2006
From: dcbw (Dan Williams)
Date: Sun, 09 Jul 2006 10:03:17 -0400
Subject: wpa_supplicants disconnects randomly
In-Reply-To: <8242fee30607070801j9081583y18548ca3c692c554@mail.gmail.com>
References: <8242fee30607070801j9081583y18548ca3c692c554@mail.gmail.com>
Message-ID: <1152453798.2519.0.camel@localhost.localdomain>

On Fri, 2006-07-07 at 08:01 -0700, Paloseco wrote:
> I am using wpa_supplicant with an wpa-eap with tkip and ttls and I get
> this when disconnects:
> 
> EAPOL: External notification - portValid=1
> EAPOL: SUPP_PAE entering state AUTHENTICATED
> EAPOL: authWhile --> 0
> EAPOL: idleWhile --> 0
> Wireless event: cmd=0x8b15 len=20
> Wireless event: new AP: 00:00:00:00:00:00
> Setting scan request: 0 sec 100000 usec

That means the driver for your card thinks that it's disconnected from
the access point.  What driver, driver version, card type, and kernel
version do you have?

Dan

> And tries to reconnect again. Sometimes I get this:
> 
> wpa_driver_wext_set_drop_unencrypted
> State: SCANNING -> ASSOCIATING
> wpa_driver_wext_associate
> Setting authentication timeout: 10 sec 0 usec
> EAPOL: External notification - portControl=Auto
> Wireless event: cmd=0x8b06 len=8
> Wireless event: cmd=0x8b1a len=16
> Wireless event: cmd=0x8b15 len=20
> Wireless event: new AP: 00:00:00:00:00:00
> BSSID 00:00:00:00:00:00 blacklist count incremented to 5
> State: ASSOCIATING -> DISCONNECTED
> EAPOL: External notification - portEnabled=0
> EAPOL: External notification - portValid=0
> CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
> wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
> wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
> wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
> wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
> wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
> Authentication with 00:00:00:00:00:00 timed out.
> BSSID 00:00:00:00:00:00 blacklist count incremented to 6
> State: DISCONNECTED -> DISCONNECTED
> No keys have been configured - skip key clearing
> EAPOL: External notification - portEnabled=0
> EAPOL: External notification - portValid=0
> Setting scan request: 0 sec 0 usec
> State: DISCONNECTED -> SCANNING
> Starting AP scan (broadcast SSID)
> Scan timeout - try to get results
> Received 3063 bytes of scan results (15 BSSes)
> Scan results: 15
> Selecting BSS from priority group 2
> 
> Is this a bug or is ok? Thanks.
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap




From pjf  Mon Jul 10 01:40:37 2006
From: pjf (=?UTF-8?B?UGF3ZcWC?= Foremski)
Date: Mon, 10 Jul 2006 10:40:37 +0200
Subject: [patch]: hostapd PID file
References: <44AE4297.3060802@tpg.com.au>
Message-ID: <e8t3q5$1nm$1@sea.gmane.org>

By the way, here's the same functionality for 0.4.9.

-- 
Pawel Foremski  
pjf at asn.pl
-------------- next part --------------
A non-text attachment was scrubbed...
Name: 001-pidfile.diff
Type: text/x-diff
Size: 2153 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060710/2c1b3f08/attachment.diff 


From bonsunny  Mon Jul 10 02:50:55 2006
From: bonsunny (Sun Bon)
Date: Mon, 10 Jul 2006 09:50:55 +0000
Subject: Help:Can wpa_supplicant-0.3.8 work with Madwifi without openssl
	linked? 
Message-ID: <BAY110-F8EE65731B93D0C7EE8417D36B0@phx.gbl>

Dear all,

These days I am porting the wpa-supplicant-0.3.8 on an embeded system which 
is ARM cpu / linux 2.4.22/ Madwifi wireless driver.

I disabled all the EAP functions and didn't give the path to the openssl 
header files and libs (Also compiler didn't ask me for that during make).   


I hope to get sure that wpa_supplicant can work without openssl (tried) and 
any advice about the failure I described below. 
 
All the valid settings in the .config:
CONFIG_DRIVER_MADWIFI=y
CONFIG_DRIVER_WEXT=y
CONFIG_CTRL_IFACE=y


My wpa_supplicant.conf
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
ap_scan=2
# Only WPA-PSK is used. Any valid cipher combination is accepted.
network={
        ssid="test"
        proto=WPA
        scan_ssid=1
        key_mgmt=WPA-PSK
        pairwise=TKIP
        group=TKIP
        
psk=088dfee4e3e2464026f9943ce8fc2a22ce0523955e6d9165780ce119d9609f17
        priority=5
}


After I insmod all the required modules including xauth.o, tkip.o, i run 
the wpa_supplicant as below:

# ./wlanconfig tr create wlandev wifi0 wlanmode sta
tr0
# ifconfig tr0 192.168.2.23 up
# ./wpa_supplicant -i tr0 -c wpa_supplicant-hex.conf -B -w
Trying tioctl essid !!!!!!!!!!!!!!!!!!!!!!
o associate with SSID 'test'
Authentiioctl essid !!!!!!!!!!!!!!!!!!!!!!
cation with 00:00:00:00:00:00 timed out.

notes:
1. An AP called "test" with WPA TKIP enabled is nearby
2. WEP works well 

Debug print:
# ./wpa_supplicant -i tr0 -c wpa_supplicant-hex.conf -dd
Initializing interface 'GPF: pid(64, <wpa_supplicant>) text_offset(0x1bda4) 
(USE
R pc=91412de8 r0=91a6e348 r3=00000005 sp=9141fae4 lr=00000000)
tr0' conf 'wpa_supplicant-hex.conf' driver 'default'
Configuration file 'wpa_supplicant-hex.conf' -> 
'/lib/modules/2.4.22/kernel/drivers/net/wpa_supplicant-hex.conf'
Reading configuration file '/lib/modules/2.4.22/kernel/drivers/
net/wpa_supplicant-hex.conf'
ctrl_interface='/var/run/wpa_supplicant'
ctrl_interface_group=0
ap_scan=2
Priority group 5
   id=0 ssid='test'
Daemonize..
Initializing interface (2) 'tr0'
Own MAC address: 00:03:7f:07:41:d3
wpa_driver_madwifi_set_wpa: enabled=1
wpa_driver_madwifi_del_key: keyidx=0
wpa_driver_madwifi_del_key: keyidx=1
wpa_driver_madwifi_del_key: keyidx=2
wpa_driver_madwifi_del_key: keyidx=3
wpa_driver_madwifi_set_countermeasures: enabled=0
wpa_driver_madwifi_set_drop_unencrypted: enabled=1
Setting scan request: 0 sec 100000 usec
Using existing control interface directory.
SIGSEGV
#


Another question is: which verison of openssl is recommended to work with 
wpa-supplicant-0.3.8.  I've tried openssl-0.9.7g but stopped at 
compiling:openssl used some functions that the my arm-gcc lib not declared 
(some functions in ctype.h). 

I just start to learn wpa_supplicant.Any help from you will be great 
appreciated!


Thanks and Best regards!

Bonsunny

_________________________________________________________________
???? MSN Explorer:   http://explorer.msn.com/lccn/  




From kelrin  Mon Jul 10 03:14:13 2006
From: kelrin (Kel Modderman)
Date: Mon, 10 Jul 2006 20:14:13 +1000
Subject: [patch]: hostapd PID file
In-Reply-To: <e8t3q5$1nm$1@sea.gmane.org>
References: <44AE4297.3060802@tpg.com.au> <e8t3q5$1nm$1@sea.gmane.org>
Message-ID: <44B22875.9020707@tpg.com.au>

Pawe? Foremski wrote:
> By the way, here's the same functionality for 0.4.9.
>
>   
> @@ -815,6 +820,14 @@
>  		goto out;
>  	}
>  
> +	if (pid_file) {
> +		FILE *f = fopen(pid_file, "w");
> +		if (f) {
> +			fprintf(f, "%u\n", getpid());
> +			fclose(f);
> +		}
> +	}
> +
>  	openlog("hostapd", 0, LOG_DAEMON);
>  
>   

why not use the os_daemonize() function to take care of pidfile creation 
and destruction?

Thanks, Kel.



From pjf  Mon Jul 10 03:20:15 2006
From: pjf (=?UTF-8?B?UGF3ZcWC?= Foremski)
Date: Mon, 10 Jul 2006 12:20:15 +0200
Subject: [patch]: hostapd PID file
References: <44AE4297.3060802@tpg.com.au> <e8t3q5$1nm$1@sea.gmane.org>
	<44B22875.9020707@tpg.com.au>
Message-ID: <e8t9ku$jg0$1@sea.gmane.org>

Kel Modderman wrote:
> Pawe? Foremski wrote:
>> By the way, here's the same functionality for 0.4.9.
> 
> why not use the os_daemonize() function to take care of pidfile creation
> and destruction?

Because it's not present in 0.4 branch? BTW, the implementation is
shamelessly copied from wpa_supplicant (0.4 branch, too).

-- 
Pawel Foremski  
pjf at asn.pl




From pjf  Mon Jul 10 03:21:00 2006
From: pjf (=?UTF-8?B?UGF3ZcWC?= Foremski)
Date: Mon, 10 Jul 2006 12:21:00 +0200
Subject: [patch]: hostapd PID file
References: <44AE4297.3060802@tpg.com.au> <e8t3q5$1nm$1@sea.gmane.org>
	<44B22875.9020707@tpg.com.au>
Message-ID: <e8t9mb$kfn$1@sea.gmane.org>

Kel Modderman wrote:
> Pawe? Foremski wrote:
>> By the way, here's the same functionality for 0.4.9.
> 
> why not use the os_daemonize() function to take care of pidfile creation
> and destruction?

Because it's not present in 0.4 branch? BTW, the implementation is
shamelessly copied from wpa_supplicant (0.4 branch, too).

-- 
Pawel Foremski  
pjf at asn.pl




From kelrin  Mon Jul 10 03:40:22 2006
From: kelrin (Kel Modderman)
Date: Mon, 10 Jul 2006 20:40:22 +1000
Subject: [patch]: hostapd PID file
In-Reply-To: <e8t9mb$kfn$1@sea.gmane.org>
References: <44AE4297.3060802@tpg.com.au>
	<e8t3q5$1nm$1@sea.gmane.org>	<44B22875.9020707@tpg.com.au>
	<e8t9mb$kfn$1@sea.gmane.org>
Message-ID: <44B22E96.8000406@tpg.com.au>

Pawe? Foremski wrote:
> Kel Modderman wrote:
>   
>> Pawe? Foremski wrote:
>>     
>>> By the way, here's the same functionality for 0.4.9.
>>>       
>> why not use the os_daemonize() function to take care of pidfile creation
>> and destruction?
>>     
>
> Because it's not present in 0.4 branch? BTW, the implementation is
> shamelessly copied from wpa_supplicant (0.4 branch, too).
>
>   

Ok, that's a good reason ;-) Apologies for not taking the time to look 
before opening the Compose: dialogue.

Thanks, kel.



From pgambhir  Wed Jul 12 02:14:05 2006
From: pgambhir (Gambhir, Pulkit Pulkit** CTR **)
Date: Wed, 12 Jul 2006 14:44:05 +0530
Subject: Problems setting the bit rate
Message-ID: <6117ACCB57BFD4118C0C00508BB1B92007B59BEB@ii3004exch001u.iprc.lucent.com>

Hi

I am working with hostap version 0.2.4 on linux kernel version 2.4.20-8 (Red
Hat 9). I have been trying to set the bit rate on my wireless card to 11Mb/s
but am unable to do so. The following is my
/etc/sysconfig/network-scripts/ifcfg-wlan0 :

DEVICE=wlan0
ONBOOT=yes
NETMASK=255.255.255.0
TYPE=Wireless
USERCTL=no
MODE=Ad-Hoc
CHANNEL=6
RATE=11Mb/s

I also run an initialsation script using /etc/rc.local, this script is
copied below :

ifconfig wlan0 10.1.2.4 netmask 255.255.255.0
iwconfig wlan0 essid boo
iwconfig wlan0 channel 6
iwconfig wlan0 mode Ad-Hoc
iwconfig wlan0 rate 11M fixed
prism2_param wlan0 pseudo_ibss 1
hostap_rid wlan0 set fc85 01 00

I have two machines, both using the same initialisation scripts (except for
the IP address of course). One of the machine always seems to kick back to
2Mb/s (displayed using iwconfig) on booting up while the other continues to
show 11Mb/s. Here is the output of hostap_diag -r wlan0 | grep RATE on the
machine that runs on 2Mb/s :

49:FC84=TXRATECONTROL=8
52:FCB3=CNFBASICRATES=<08><00>
53:FCB4=CNFSUPPORTEDRATES=<08><00>
82:FD44=CURRENTTXRATE=2
101:FDC6=SUPPORTEDDATARATES=<02><04><0b><16>

I have tried to do 'iwconfig wlan0 rate 11M fixed' and also 'hostap_rid
wlan0 set FD44 08 00' but neither seems to be able to change the bit rate
back to 11Mb/s. How can I set this bit rate to a fixed 11Mb/s ?


Thanks,
Pulkit



From gauzence  Thu Jul 13 01:49:25 2006
From: gauzence (Paul-Henri Gauzence de Lastours)
Date: Thu, 13 Jul 2006 10:49:25 +0200
Subject: Having problem on wpa_supplicant with EAP-TTLS
Message-ID: <20060713084925.GA27368@efrei.fr>

Hi,

I'm working on an EAP-TTLS authentication using hostapd and
wpa_supplicant on a wired Ethernet configuration, and I am experiencing
some troubles.
I'm working on ?clinux, with hostapd-0.4.8 and wpa_supplicant-0.4.8.

I first tried an simple MD5 authentication and everything was working
fine. Then I came to an EAP-TTLS authentication which never ends
successfully. The hostapd part should be right, as it is perfectly
working with Windows Xp native supplicant on which I added SecureW2.
But when I'm trying with wpa_supplicant on ?clinux, the SSL handshake
fails between supplicant and authenticator. I made a traffic analysis
with ethereal and here's what I can see:


Supplicant --> Authenticator  :   EAPOL Start
Authenticator --> Supplicant  :   EAP, Request, Identity [RFC3748]
Supplicant --> Authenticator  :   EAP, Response, Identity [RFC3748]
Authenticator --> Supplicant  :   EAP, Request, EAP-TTLS [Funk]


Until there, everything is fine, but the problem is that wpa-supplicant
never answers the last request, which is however correctlly built:

(+) 802.1X Authentication
      Version: 2
      Type: EAP Packet (0)
      Length: 6
  (+) Extensible Authentication Protocol
        Code: Request (1)
        Id: 104
        Length: 6
        Type: EAP-TTLS [Funk] (21)
	Flags(0x20): Start
        TTLS version 0

I'm now trying to debug this by adding some printf, but it's quite long
and I'm posting to know if somebody already got the same problem or
would know where it can come from. All suggestions are welcome.

Here's the debug ouput of wpa_supplicant:

EAPOL: SUPP_BE entering state RECEIVE
RX EAPOL from 00:13:d7:10:00:28
RX EAPOL - hexdump(len=46): 02 00 00 06 01 68 00 06 15 20 00 00 00 00 00
00 00 0
0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00
00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request method=21 id=104
EAP: EAP entering state GET_METHOD
EAP: initialize selected EAP method (21, TTLS)
EAP-TTLS: Phase2 type: EAP
EAP-TTLS: Phase2 EAP types - hexdump(len=2): 04 1a
TLS: Trusted root certificate(s) loaded
CTRL-EVENT-EAP-METHOD EAP method 21 (TTLS) selected
EAP: EAP entering state METHOD
SSL: Received packet(len=6) - Flags 0x20
EAP-TTLS: Start
EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE

Thanks in advance for your help !

Paul-Henri



From hagitk  Thu Jul 13 01:54:48 2006
From: hagitk (Kolatker Hagit-BHK010)
Date: Thu, 13 Jul 2006 11:54:48 +0300
Subject: PMK lifetime
Message-ID: <18C47C3B48E39944AC3EFAA249D70C22FC1F93@zil01exm61.ds.mot.com>


Hi,

*	What is the PMK lifetime for supplicant, is it hard-coded ? And
what does it do when its expires?
*	And same for AP - What is the PMK lifetime for AP, is it
hard-coded, or taken from RADIUS message? And what does it do when its
expires?

Thanks in advanced
Hagit 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060713/ea5f4bec/attachment.htm 


From mike  Thu Jul 13 13:35:00 2006
From: mike (Michael Stevens)
Date: Thu, 13 Jul 2006 15:35:00 -0500
Subject: Hostapd / Macbook Pro 4-way handshake issue
Message-ID: <200607131535.00301.mike@hobnob.com>

We have determined that MacBook Pros connecting to hostapd 0.4.9 have a
problem with the 4-way handshake when wpa=3 (WPA and WPA2 operation). We
have found this condition when using EAP for key management and a Microsoft
Active Directory server for the RADIUS server. The error appears to be that
there is no response to the 3rd packet of the 4-way handshake. We also tested
the Mac Book Pro against an Airport Express in a similar configuration and it
worked. Tcpdumps of both EAPOL exchanges are attached. It seems that the IEs
may have something to do with this bug and when they are sent as that is what
differs between the two.

Here are all the test scenarios for hostap that we tried with the exact same
configuration except for the listed changes and whether they succeded or
failed.

configurations tested
------------------------------------------------------
Y wpa=1 wpa_pairwise=TKIP
Y wpa=1 wpa_pairwise=CCMP
Y wpa=1 wpa_pairwise=TKIP CCMP
Y wpa=2 wpa_pairwise=CCMP
Y wpa=2 wpa_pairwise=TKIP CCMP
N wpa=3 wpa_pairwise=CCMP
N wpa=3 wpa_pairwise=TKIP CCMP

$ cat /etc/hostapd.conf

# Interface to run on, and driver
interface=ath0
driver=bsd

logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2

# Debugging: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = excessive
debug=0

# Dump file for state information (on SIGUSR1)
dump_file=/tmp/hostapd.dump

# Running interface and group
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0

# IEEE 802.11 related configuration
ssid=accesspoint
macaddr_acl=0
auth_algs=1

# IEEE 802.1x-rev related configruation
ieee8021x=1
eapol_key_index_workaround=0

# Integrated EAP server
# currently unused
eap_server=0

# RADIUS client configuration
own_ip_addr=127.0.0.1
auth_server_addr=10.0.0.2
auth_server_port=1812
auth_server_shared_secret=password

# WPA/IEEE 802.11i configuration
wpa=1
wpa_key_mgmt=WPA-EAP
wpa_pairwise=CCMP TKIP
wpa_group_rekey=3600

-------------- next part --------------
A non-text attachment was scrubbed...
Name: filtered-macbook-vs-airport.pcap
Type: application/octet-stream
Size: 849 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060713/fb645e66/attachment.obj 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: filtered-macbook-vs-hostap.pcap
Type: application/octet-stream
Size: 11689 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060713/fb645e66/attachment-0001.obj 


From mike  Thu Jul 13 13:41:03 2006
From: mike (Michael Stevens)
Date: Thu, 13 Jul 2006 15:41:03 -0500
Subject: Hostapd / Macbook Pro 4-way handshake issue
In-Reply-To: <200607131535.00301.mike@hobnob.com>
References: <200607131535.00301.mike@hobnob.com>
Message-ID: <200607131541.03666.mike@hobnob.com>

I have the -ddd output for hostap but it is too large for this list. (28KB 
gzip'ed).

Mike


On Thursday 13 July 2006 15:35, Michael Stevens wrote:
> We have determined that MacBook Pros connecting to hostapd 0.4.9 have a
> problem with the 4-way handshake when wpa=3 (WPA and WPA2 operation). We
> have found this condition when using EAP for key management and a Microsoft
> Active Directory server for the RADIUS server. The error appears to be that
> there is no response to the 3rd packet of the 4-way handshake. We also
> tested the Mac Book Pro against an Airport Express in a similar
> configuration and it worked. Tcpdumps of both EAPOL exchanges are attached.
> It seems that the IEs may have something to do with this bug and when they
> are sent as that is what differs between the two.
>
> Here are all the test scenarios for hostap that we tried with the exact
> same configuration except for the listed changes and whether they succeded
> or failed.
>
> configurations tested
> ------------------------------------------------------
> Y wpa=1 wpa_pairwise=TKIP
> Y wpa=1 wpa_pairwise=CCMP
> Y wpa=1 wpa_pairwise=TKIP CCMP
> Y wpa=2 wpa_pairwise=CCMP
> Y wpa=2 wpa_pairwise=TKIP CCMP
> N wpa=3 wpa_pairwise=CCMP
> N wpa=3 wpa_pairwise=TKIP CCMP
>
> $ cat /etc/hostapd.conf
>
> # Interface to run on, and driver
> interface=ath0
> driver=bsd
>
> logger_syslog=-1
> logger_syslog_level=2
> logger_stdout=-1
> logger_stdout_level=2
>
> # Debugging: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = excessive
> debug=0
>
> # Dump file for state information (on SIGUSR1)
> dump_file=/tmp/hostapd.dump
>
> # Running interface and group
> ctrl_interface=/var/run/hostapd
> ctrl_interface_group=0
>
> # IEEE 802.11 related configuration
> ssid=accesspoint
> macaddr_acl=0
> auth_algs=1
>
> # IEEE 802.1x-rev related configruation
> ieee8021x=1
> eapol_key_index_workaround=0
>
> # Integrated EAP server
> # currently unused
> eap_server=0
>
> # RADIUS client configuration
> own_ip_addr=127.0.0.1
> auth_server_addr=10.0.0.2
> auth_server_port=1812
> auth_server_shared_secret=password
>
> # WPA/IEEE 802.11i configuration
> wpa=1
> wpa_key_mgmt=WPA-EAP
> wpa_pairwise=CCMP TKIP
> wpa_group_rekey=3600



From Ly  Fri Jul 14 03:13:35 2006
From: Ly (Ly Hong)
Date: Fri, 14 Jul 2006 12:13:35 +0200
Subject: wpa-supplicant for adhoc network with more than 2 nodes ?
Message-ID: <BBDE6D332D319548BAAAC70344517B6202BA7C70@exchange03.iabg.de>

Hi Jouni

refer to the mail from Fri May 19 23:41:56 MDT 2006 .

>>wpa_supplicant does not do any per-STA processing in IBSS mode for 
>>WPA-None, so I would be surprised if this were the case. Which driver 
>>are you using?

For your information: I am using the madwifi-driver (Madwifi-old) and I
have the following configuration for wpa_supplicant:

/etc/wpa_supplicant.conf

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
eapol_version=1
ap_scan=2
fast_reauth=1

network={
        ssid="test adhoc"
        mode=1
        proto=WPA
        key_mgmt=WPA-NONE
        pairwise=NONE
        group=TKIP
        psk="secret passphrase"
}



Sorry if I sound a little bit pedantic: What does your above answer
mean? Should WPA-NONE in IBSS mode work with more than two hosts or not?
The question arises from the observation that two hosts work just fine
while a third host can't connect at all.

Could you elaborate on your response that "wpa_supplicant does not do
any per-STA processing in IBSS mode"? Is this a missing piece in
wpa_supplicant or simply not needed at all?


>>This would be IEEE 802.11i IBSS, not WPA. You are talking
>>about WPA TK,
>>so I'm assuming this is indeed WPA-None, not IEEE 802.11i
>>IBSS. Anyway,
>>wpa_supplicant does not currently support IEEE 802.11i IBSS.

Since the standard 802.11i described clearly what is happening in IBSS 
mode. For example:

1. 4-Way Handshake for generation the session-key from the PSK-> each
adhoc link has different session-key
2. The session-key is used as input for data encryption for TKIP

If wpa_supplicant does not support 802.11i IBSS mode, how does WPA-None
work in adhoc-mode?

For example, Is there any 4-Way-handshake for generation the 
session-key from the PSK?

>>WPA-None is sharing the same key with all clients..

But TKIP needs amongst others 2 keys (MIC-key and Temporal-Key) as input
for data encryption. 
So these two keys I guess must being somehow derived from the shared key
mentioned by you. But then again we will have different session keys for
different links.
So can it be that there is no further key derivation and the shared key
will be used directly 
as input for TKIP in order to encrypt the data  ?

In this case all adhoc-link have the same key like WEP in IBSS mode, but
then 
the question arises again why two hosts work just fine while a third
host can't connect at all.

what could be the reason? Has anybody ever tried this? On what hardware?

Thanks in advance for your patience
and kind regards
  Hong



From mistamaila  Mon Jul 17 13:46:34 2006
From: mistamaila (John H.)
Date: Mon, 17 Jul 2006 15:46:34 -0500
Subject: how to use wpa_supplicant on wpa network with peap and credentialing
Message-ID: <5b9417770607171346mebe2a56q24db14abdeb70c94@mail.gmail.com>

my university just switched to wpa, but with tkip, aes, peap and credentialing.

i have used wpa_supplicant repeatedly on tkip/aes networks with
success, but what need i do differently for this network to use peap
and credentialing?  when they showed me how to do it, they did
something like "use windows logon and password"



From andrew.james.barr  Mon Jul 17 13:58:49 2006
From: andrew.james.barr (Andrew Barr)
Date: Mon, 17 Jul 2006 16:58:49 -0400
Subject: how to use wpa_supplicant on wpa network with peap and
	credentialing
In-Reply-To: <5b9417770607171346mebe2a56q24db14abdeb70c94@mail.gmail.com>
References: <5b9417770607171346mebe2a56q24db14abdeb70c94@mail.gmail.com>
Message-ID: <200607171658.49293.andrew.james.barr@gmail.com>

On Monday 17 July 2006 16:46, John H. wrote:
> i have used wpa_supplicant repeatedly on tkip/aes networks with
> success, but what need i do differently for this network to use peap
> and credentialing?  

adding the following lines to your network block:

eap=PEAP
identity="username"
password="password"

should do the trick. You can specify other parameters, but wpa_supplicant 
should be able to autodetect the
m. 

I'm not sure what you mean by credentialing. If you are using certificates 
then you should read the documentation for details, I've never used them. 
Typically these kind of wireless setups ignore certificates.

-- 
Andrew Barr | http://www.oakcourt.dyndns.org/~andrew/ | GPG: 0xAD9AE76A
"Those who would trade liberty for security deserve neither." -- B. Franklin



From mistamaila  Mon Jul 17 14:00:27 2006
From: mistamaila (John H.)
Date: Mon, 17 Jul 2006 16:00:27 -0500
Subject: how to use wpa_supplicant on wpa network with peap and
	credentialing
In-Reply-To: <200607171658.49293.andrew.james.barr@gmail.com>
References: <5b9417770607171346mebe2a56q24db14abdeb70c94@mail.gmail.com>
	<200607171658.49293.andrew.james.barr@gmail.com>
Message-ID: <5b9417770607171400h7416fd23he46a3a76b3a719fb@mail.gmail.com>

sorry, certificates, that's the word they used.  would i need to do
anything for that?

On 7/17/06, Andrew Barr <andrew.james.barr at gmail.com> wrote:
> On Monday 17 July 2006 16:46, John H. wrote:
> > i have used wpa_supplicant repeatedly on tkip/aes networks with
> > success, but what need i do differently for this network to use peap
> > and credentialing?
>
> adding the following lines to your network block:
>
> eap=PEAP
> identity="username"
> password="password"
>
> should do the trick. You can specify other parameters, but wpa_supplicant
> should be able to autodetect the
> m.
>
> I'm not sure what you mean by credentialing. If you are using certificates
> then you should read the documentation for details, I've never used them.
> Typically these kind of wireless setups ignore certificates.
>
> --
> Andrew Barr | http://www.oakcourt.dyndns.org/~andrew/ | GPG: 0xAD9AE76A
> "Those who would trade liberty for security deserve neither." -- B. Franklin
>



From andrew.james.barr  Mon Jul 17 14:14:26 2006
From: andrew.james.barr (Andrew Barr)
Date: Mon, 17 Jul 2006 17:14:26 -0400
Subject: how to use wpa_supplicant on wpa network with peap and
	credentialing
In-Reply-To: <5b9417770607171400h7416fd23he46a3a76b3a719fb@mail.gmail.com>
References: <5b9417770607171346mebe2a56q24db14abdeb70c94@mail.gmail.com>
	<200607171658.49293.andrew.james.barr@gmail.com>
	<5b9417770607171400h7416fd23he46a3a76b3a719fb@mail.gmail.com>
Message-ID: <200607171714.26559.andrew.james.barr@gmail.com>

On Monday 17 July 2006 17:00, John H. wrote:
> sorry, certificates, that's the word they used.  would i need to do
> anything for that?

Well, for PEAP the usual setup is to validate the server certificate to 
prevent rogue APs and password stealing and the like. You don't HAVE to do 
it, and in the case of my university they don't provide a public key 
certificate so I can't (although I understand it might be possible to capture 
it out of the authentication stream). You can ignore the certificate (if it 
is just a server cert validation like I described above), or you can provide 
a certificate public key file (see the documentation for acceptable formats) 
to wpa_supplicant. There is an example configuration file distributed with 
wpa_supplicant that should have the exact parameter name in it.

-- 
Andrew Barr | http://www.oakcourt.dyndns.org/~andrew/ | GPG: 0xAD9AE76A
"Those who would trade liberty for security deserve neither." -- B. Franklin



From eltonyli  Tue Jul 18 00:33:36 2006
From: eltonyli (li tony)
Date: Tue, 18 Jul 2006 15:33:36 +0800
Subject: A question
Message-ID: <94a3f25b0607180033y1baca808j62b2f057a0486cda@mail.gmail.com>

Hi,all,

When I studied some codes of hostap-driver, I was confused about ddev,dev,
apdev and stadev. I found only dev associated with hard ware.Couldyou
differentiate them?

thanks a lot.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060718/6a12d7f3/attachment.htm 


From maccari-thisaintpartofmyaddress-  Tue Jul 18 01:25:08 2006
From: maccari-thisaintpartofmyaddress- (Leonardo Maccari)
Date: Tue, 18 Jul 2006 10:25:08 +0200
Subject: speedtouch 580
Message-ID: <20060718082508.GA26780@lenst.det.unifi.it>

the AP in subj has some strange behaviour that has been discussed in the
list some time ago.

http://lists.shmoo.com/pipermail/hostap/2005-April/010113.html
http://lists.shmoo.com/pipermail/hostap/2005-September/011324.html

has a patch ever been released for this?

ciao,
leonardo.

-- 
   Key fingerprint = 3129 C583 F03B 2E73 0115  C040 3489 0185 B592 19FE
 Obviously -thisaintpartofmyaddress- is not part of my real email address 




From saurav.barik  Tue Jul 18 03:46:36 2006
From: saurav.barik (saurav barik)
Date: Tue, 18 Jul 2006 16:16:36 +0530
Subject: mac based auth with radius problem!
Message-ID: <26b26d180607180346s74774cafi6007d7293633ca4c@mail.gmail.com>

Hi,
I am trying mac based authentication with my hostapd version-0.4.8
running on debian sarge, with radius server.
Its been long I am only able to send accounting information but no
authentication request. In fact, radius log says there is no username
present in the auth req sent from the radius client.
I browsed through the mailing list, but did not get adequate help.
Could anybody tell me what should be the solution for this?
For attaining only mac based authentication with radius server, what
should be the content of hostapd.conf file?

thanks in advance.
saurav

Here is my hostapd.conf file :--
##################################
interface=ath0
driver=madwifi
bridge=br0
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=1
debug=0
ssid=saurav
macaddr_acl=2
accept_mac_file=/etc/network/hostapd/hostapd.accept
auth_algs=1
ieee8021x=1

own_ip_addr=192.168.157.100

auth_server_addr=192.168.157.211
auth_server_port=1812
auth_server_shared_secret=saurav

acct_server_addr=192.168.157.211
acct_server_port=1813
acct_server_shared_secret=saurav
###############################

 hostapd -dd /etc/hostapd.conf output :--

###################################
Configuration file: hostapd-test.conf
Configure bridge br0 for EAPOL traffic.
madwifi_set_iface_flags: dev_up=0
Using interface ath0 with hwaddr xx:xx:xx:xx:xx:xx and ssid 'saurav'
ath0: RADIUS Authentication server 192.168.157.211:1812
ath0: RADIUS Accounting server 192.168.157.211:1813
madwifi_set_ieee8021x: enabled=1
madwifi_set_iface_flags: dev_up=1
ath0: RADIUS Sending RADIUS message to accounting server
ath0: RADIUS Next RADIUS client retransmit in 3 seconds

Flushing old station entries
madwifi_sta_deauth: addr=ff:ff:ff:ff:ff:ff reason_code=3
Deauthenticate all stations
ath0: RADIUS Received 20 bytes from RADIUS server
ath0: RADIUS Received RADIUS message
ath0: STA 00:00:00:00:00:00 RADIUS: Received RADIUS packet matched with a pendin
g request, round trip time 0.05 sec
Wireless event: cmd=0x8b19 len=8
Wireless event: cmd=0x8c03 len=20
ath0: STA 00:20:a6:54:94:32 IEEE 802.11: associated
  New STA
ath0: STA 00:20:a6:54:94:32 WPA: event 1 notification

ath0: STA 00:20:a6:54:94:32 IEEE 802.1X: start authentication
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_KEY_TX entering state NO_KEY_TRANSMIT
IEEE 802.1X: 00:20:a6:54:94:32 KEY_RX entering state NO_KEY_RECEIVE
IEEE 802.1X: 00:20:a6:54:94:32 CTRL_DIR entering state IN_OR_BOTH
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH entering state IDLE
IEEE 802.1X: 00:20:a6:54:94:32 KEY_RX entering state NO_KEY_RECEIVE
IEEE 802.1X: 00:20:a6:54:94:32 CTRL_DIR entering state FORCE_BOTH
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 KEY_RX entering state NO_KEY_RECEIVE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state DISCONNECTED
ath0: STA 00:20:a6:54:94:32 IEEE 802.1X: unauthorizing port
madwifi_set_sta_authorized: addr=00:20:a6:54:94:32 authorized=0
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state RESTART
IEEE 802.1X: station 00:20:a6:54:94:32 - new auth session, clearing State
IEEE 802.1X: Generated EAP Request-Identity for 00:20:a6:54:94:32 (identifier 0,
 timeout 30)
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state CONNECTING
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state CONNECTING
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state AUTHENTICATING
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH entering state REQUEST
IEEE 802.1X: Sending EAP Packet to 00:20:a6:54:94:32 (identifier 0)
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
ath0: STA 00:20:a6:54:94:32 IEEE 802.1X: EAP timeout
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH entering state TIMEOUT
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state ABORTING
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH entering state INITIALIZE
ath0: STA 00:20:a6:54:94:32 IEEE 802.1X: aborting authentication
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state RESTART
IEEE 802.1X: station 00:20:a6:54:94:32 - new auth session, clearing State
IEEE 802.1X: Generated EAP Request-Identity for 00:20:a6:54:94:32 (identifier 1,
 timeout 30)
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH entering state IDLE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state CONNECTING
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state AUTHENTICATING
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH entering state REQUEST
IEEE 802.1X: Sending EAP Packet to 00:20:a6:54:94:32 (identifier 1)
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
.
.
ath0: STA 00:20:a6:54:94:32 IEEE 802.1X: ER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH enntering state ABORTING
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMtering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE eaborting authentication
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH enER entering state INITIALIZE
ath0: STA 00:20:a6:54:94:32 IEEE 802.1X: ntering state RESTART
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMnew auth session, clearing State
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE ety for 00:20:a6:54:94:32 (identifier 2,
IEEE 802.1X: station 00:20:a6:54:94:32 -
IEEE 802.1X: Generated EAP Request-Identitering state IDLE
 timeout 30)                             ER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 BE_AUTH enntering state CONNECTING
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE entering state DISCONNECTED
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMunauthorizing port
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE e:54:94:32 authorized=0
ath0: STA 00:20:a6:54:94:32 IEEE 802.1X: ER entering state INITIALIZE
madwifi_set_sta_authorized: addr=00:20:a6ntering state RESTART
IEEE 802.1X: 00:20:a6:54:94:32 REAUTH_TIMnew auth session, clearing State
IEEE 802.1X: 00:20:a6:54:94:32 AUTH_PAE ety for 00:20:a6:54:94:32 (identifier 3,
IEEE 802.1X: station 00:20:a6:54:94:32 -
IEEE 802.1X: Generated EAP Request-IdentiER entering state INITIALIZE

###############################################################

Radius Log :--
#############################################################

07/12/2005 20:57:03 Proxy Error: no username in request - request not
proxy forwarded
07/12/2005 20:57:03 Sending accounting response
07/12/2005 20:57:03 Sending accounting response
07/12/2005 20:58:24 Proxy Error: no username in request - request not
proxy forwarded
07/12/2005 20:58:24 Sending accounting response
07/12/2005 20:58:24 Sending accounting response
07/12/2005 20:59:23 Proxy Error: no username in request - request not
proxy forwarded
07/12/2005 20:59:23 Sending accounting response
07/12/2005 20:59:23 Sending accounting response
07/12/2005 20:59:40 Proxy Error: no username in request - request not
proxy forwarded
07/12/2005 20:59:40 Sending accounting response
07/12/2005 20:59:40 Sending accounting response
07/12/2005 21:01:01 Proxy Error: no username in request - request not
proxy forwarded



From gslockwood  Tue Jul 18 07:43:54 2006
From: gslockwood (George S. Lockwood)
Date: Tue, 18 Jul 2006 07:43:54 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
Message-ID: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>

Hello everyone,

Anyone have trouble compiling and running a Release version wpa_supplicant
for Windows??

I have been able to configure the Visual Studio 2005 project files to find
openssl and wpdpack but to get it compile for a Release version, I had to
add the preprocessor var: CONFIG_WIN32_DEFAULTS.

However, the compile exe is only 916k compared to the downloaded binary of
~1200k.


The Release version ends (see below), but the same code built for Debug
results in a connection / authentication.

so I believe my Release project settings are off.  Could it be my libs? the
code generation settings?  the addtion of CONFIG_WIN32_DEFAULTS??


The trouble is it didn't compile "out-of-the-box"....


here's some console output from the debug run:

Debug finds 3 adaptors, Release only 2 !!!?????


07:40:05: NDIS: 3 adapter names found
07:40:05: NDIS: 3 adapter descriptions found
07:40:05: NDIS: 0 - \Device\NPF_GenericDialupAdapter - Adapter for generic
dialup and VPN capture
07:40:05: NDIS: 1 - \Device\NPF_{201016AF-B1FE-4CFD-A410-CD2D3F264D07} -
Broadcom NetXtreme Gigabit Ethernet Driver (Microsoft's Packet Schedul
r)
07:40:05: NDIS: 2 - \Device\NPF_{556DEBC4-B686-4A77-A2D8-7F34F3A5708F} -
Intel(R) PRO/Wireless 2200BG Network Connection (Microsoft's Packet Sc
eduler)
07:40:05: NDIS: Adapter description prefix 'Intel(R) PRO/Wireless 2200BG
Network Connection'




Here's the Release version's console output:

ifname: \Device\NPF_GenericDialupAdapter
description: Adapter for generic dialup and VPN capture

ifname: \Device\NPF_{556DEBC4-B686-4A77-A2D8-7F34F3A5708F}
description: Intel(R) PRO/Wireless 2200BG Network Connection (Microsoft's
Packet Scheduler)

ifname: \Device\NPF_{201016AF-B1FE-4CFD-A410-CD2D3F264D07}
description: Broadcom NetXtreme Gigabit Ethernet Driver (Microsoft's Packet
Scheduler)

Press any key to continue . . .
07:32:42: Initializing interface
'\Device\NPF_{556DEBC4-B686-4A77-A2D8-7F34F3A5708F}' conf 'mango.conf.txt'
driver 'default' ctrl_interface '
' bridge 'N/A'
07:32:42: Reading configuration file 'mango.conf.txt'
07:32:42: ap_scan=1
07:32:42: Line: 5 - start of a new network block
ssid - hexdump_ascii(len=5):
     6d 61 6e 67 6f                                    mango
07:32:42: scan_ssid=1 (0x1)
PSK (ASCII passphrase) - hexdump_ascii(len=8): [REMOVED]
07:32:42: key_mgmt: 0x2
07:32:42: pairwise: 0x8
07:32:42: group: 0x8
PSK (from passphrase) - hexdump(len=32): [REMOVED]
07:32:43: Priority group 0
07:32:43:    id=0 ssid='mango'
07:32:43: Initializing interface (2)
'\Device\NPF_{556DEBC4-B686-4A77-A2D8-7F34F3A5708F}'
07:32:43: EAPOL: SUPP_PAE entering state DISCONNECTED
07:32:43: EAPOL: KEY_RX entering state NO_KEY_RECEIVE
07:32:43: EAPOL: SUPP_BE entering state INITIALIZE
07:32:43: EAP: EAP entering state DISABLED
07:32:43: EAPOL: External notification - portEnabled=0
07:32:43: EAPOL: External notification - portValid=0
07:32:43: NDIS: Packet.dll version: 4, 0, 0, 374
07:32:43: NDIS: 2 adapter names found
07:32:43: NDIS: 2 adapter descriptions found
07:32:43: NDIS: 0 - \Device\NPF_GenericDialupAdapter -
07:32:43: NDIS: 1 - Adapter for generic dialup and VPN capture - dummy
description
07:32:43: NDIS: Could not find interface
'{556DEBC4-B686-4A77-A2D8-7F34F3A5708F}'
07:32:43: Failed to initialize driver interface
07:32:43: Failed to add interface
\Device\NPF_{556DEBC4-B686-4A77-A2D8-7F34F3A5708F}
07:32:43: 07:32:43: Cancelling scan request
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060718/026858f2/attachment.htm 


From frank  Tue Jul 18 10:30:33 2006
From: frank (Frank Meerkoetter)
Date: Tue, 18 Jul 2006 19:30:33 +0200
Subject: GET_NETWORK X wep_key0 is inconsistent
Message-ID: <20060718193033.5w27k3jb404g0skk@admin.betaversion.net>

Hi,

i've noticed that the format of the value returned by
GET_NETWORK X wep_key0 is inconsistent.

SET_NETWORK 1 wep_key0 5656565656
GET_NETWORK 1 wep_key0
"VVVVV"

Which is they ascii representation of this 565656565656.

SET_NETWORK 1 wep_key0 9999999999
GET_NETWORK 1 wep_key0
9999999999

Is this a bug or didn't i understand how it is supposed to
work?

Regards,
   Frank





From ivan.tarasov  Tue Jul 18 10:41:09 2006
From: ivan.tarasov (Ivan Tarasov)
Date: Tue, 18 Jul 2006 10:41:09 -0700
Subject: problems connecting to AP using WPA-PSK, Linux 2.6.16,
	ipw2200 card (wext driver)
Message-ID: <e499a45b0607181041l253f7f3v16493bd8a91d352e@mail.gmail.com>

Hello,

I've got persistent problems with using wpa_supplicant to connect to an AP
with WPA authentication. I did an extensive search on mailing lists and
Internet in general and didn't find any solution, although I've seen a lot
of reports of similar problems.

/etc/wpa_supplicant.conf contents is somewhat like this:

# the following 3 lines were changed and this configuration was the most
stable
eapol_version=1
ap_scan=2
fast_reauth=2
network={
    ssid="somessid"
    scan_ssid=1
    key_mgmt=WPA-PSK
    proto=WPA
    pairwise=TKIP
    group=TKIP
    psk="somepassword"
}

The access point is Linksys WRT54G. The WiFi card is Intel IPW2200. I tried
using both wpa_supplicant 0.4.8 and 0.5.4. The attached log is from 0.5.4,
it shows both the unsuccessful attempts to connect to the AP and a
successful attempt, which disconnected mysteriously at last. It seems that
most often situation is that after wpa_supplicant started ASSOCIATING it
receives the 0x8b15 event with AP address 00:00:00:00:00:00, and thus it
simply blacklists the AP.

You might be interested looking at the following lines more thoroughly:
lines 840-965: wpa_supplicant started authenticating, but suddenly received
the 0x8b15 during the 4WAY_HANDSHAKE, which it considered to be the sign of
a wrong password, thus it got disconnected.
lines 1142-1261: same as above, but it passed the 4WAY_HANDSHAKE and
received the 0x8b15 event with zero AP address during the GROUP_HANDSHAKE.
lines 1855-2035: successful connection, I was able to work for some time and
everything worked fine until it received the 0x8b15 event with zero AP
address again.

I tried hacking the sources in some ways but it didn't really help.

I tried connecting to this access point from Windows (using the application
from the Intel driver pack, without wpa_supplicant) and the connection was
very stable and it didn't drop (and it connected almost immediately). While
I was recording the attached log another notebook was connected to the same
access point and had a stable connection (again, from Windows). No changes
were made to the access point configuration during the log recording, so no
side effects could be introduced this way.

I would appreciate any help on this, I can give more information and try
recording more logs (but they all are pretty similar to the one I attached
anyway), or try patching the source if you direct me.

PS: sorry for resending, I forgot to compress the log the first time
-- 
Best regards,
Ivan Tarasov
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060718/15662730/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: supplicant.log.bz2
Type: application/x-bzip2
Size: 4675 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060718/15662730/attachment.bin 


From ivan.tarasov  Tue Jul 18 11:49:15 2006
From: ivan.tarasov (Ivan Tarasov)
Date: Tue, 18 Jul 2006 11:49:15 -0700
Subject: problems connecting to AP using WPA-PSK, Linux 2.6.16,
	ipw2200 card (wext driver)
In-Reply-To: <e499a45b0607181041l253f7f3v16493bd8a91d352e@mail.gmail.com>
References: <e499a45b0607181041l253f7f3v16493bd8a91d352e@mail.gmail.com>
Message-ID: <e499a45b0607181149j53b5f624ue9e83546d37a2d1c@mail.gmail.com>

Hello,

I've got persistent problems with using wpa_supplicant to connect to an AP
with WPA authentication. I did an extensive search on mailing lists and
Internet in general and didn't find any solution, although I've seen a lot
of reports of similar problems.

/etc/wpa_supplicant.conf contents is somewhat like this:

# the following 3 lines were changed and this configuration was the most
stable
eapol_version=1
ap_scan=2
fast_reauth=2
network={
    ssid="somessid"
    scan_ssid=1
    key_mgmt=WPA-PSK
    proto=WPA
    pairwise=TKIP
    group=TKIP
    psk="somepassword"
}

The access point is Linksys WRT54G. The WiFi card is Intel IPW2200. I tried
using both wpa_supplicant 0.4.8 and 0.5.4. The attached log is from 0.5.4,
it shows both the unsuccessful attempts to connect to the AP and a
successful attempt, which disconnected mysteriously at last. It seems that
most often situation is that after wpa_supplicant started ASSOCIATING it
receives the 0x8b15 event with AP address 00:00:00:00:00:00, and thus it
simply blacklists the AP.

You might be interested looking at the following lines more thoroughly:
lines 840-965: wpa_supplicant started authenticating, but suddenly received
the 0x8b15 during the 4WAY_HANDSHAKE, which it considered to be the sign of
a wrong password, thus it got disconnected.
lines 1142-1261: same as above, but it passed the 4WAY_HANDSHAKE and
received the 0x8b15 event with zero AP address during the GROUP_HANDSHAKE.
lines 1855-2035: successful connection, I was able to work for some time and
everything worked fine until it received the 0x8b15 event with zero AP
address again.

I tried hacking the sources in some ways but it didn't really help.

I tried connecting to this access point from Windows (using the application
from the Intel driver pack, without wpa_supplicant) and the connection was
very stable and it didn't drop (and it connected almost immediately). While
I was recording the attached log another notebook was connected to the same
access point and had a stable connection (again, from Windows). No changes
were made to the access point configuration during the log recording, so no
side effects could be introduced this way.

I would appreciate any help on this, I can give more information and try
recording more logs (but they all are pretty similar to the one I attached
anyway), or try patching the source if you direct me.

PS: sorry for resending, I forgot to compress the log the first time
-- 
Best regards,
Ivan Tarasov
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060718/4cacd98c/attachment.htm 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: supplicant.log.gz
Type: application/x-gzip
Size: 4512 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060718/4cacd98c/attachment.bin 


From jhw  Tue Jul 18 11:58:17 2006
From: jhw (james woodyatt)
Date: Tue, 18 Jul 2006 11:58:17 -0700
Subject: Hostapd / Macbook Pro 4-way handshake issue
In-Reply-To: <20060718105016.BE9471344E6@mail.iocaine.com>
References: <20060718105016.BE9471344E6@mail.iocaine.com>
Message-ID: <C5E16C89-BF9A-4546-9D7C-029CD2B718C3@apple.com>

On Thursday 13 July 2006 15:35, Michael Stevens wrote:
> We have determined that MacBook Pros connecting to hostapd 0.4.9  
> have a problem with the 4-way handshake when wpa=3 (WPA and WPA2  
> operation).

Apple engineers are currently analyzing this problem report.   
Regretfully, I can offer no other information at this time.  Read  
into that whatever you will.  <sigh/>


-- 
james woodyatt <jhw at apple.com>
member of technical staff
apple computer, inc.




From mistamaila  Tue Jul 18 19:27:34 2006
From: mistamaila (John H.)
Date: Tue, 18 Jul 2006 21:27:34 -0500
Subject: how to use wpa_supplicant on wpa network with peap and
	credentialing
In-Reply-To: <200607171714.26559.andrew.james.barr@gmail.com>
References: <5b9417770607171346mebe2a56q24db14abdeb70c94@mail.gmail.com>
	<200607171658.49293.andrew.james.barr@gmail.com>
	<5b9417770607171400h7416fd23he46a3a76b3a719fb@mail.gmail.com>
	<200607171714.26559.andrew.james.barr@gmail.com>
Message-ID: <5b9417770607181927g647d836fo95c82a87ff006702@mail.gmail.com>

hmm, i did as i thought i was told to do, but it caused an error in my
config file and not until i commented out the entry could i use
wpa_supplicant for other networks. here is what i had

#network={
#        ssid="schoolssid"
#        proto=WPA
#        key_mgmt=WPA-PSK
#        pairwise=TKIP
#        group=TKIP
#        scan_ssid=1
#        eap=PEAP
#       identity="username"
#       password="password"
#}


On 7/17/06, Andrew Barr <andrew.james.barr at gmail.com> wrote:
> On Monday 17 July 2006 17:00, John H. wrote:
> > sorry, certificates, that's the word they used.  would i need to do
> > anything for that?
>
> Well, for PEAP the usual setup is to validate the server certificate to
> prevent rogue APs and password stealing and the like. You don't HAVE to do
> it, and in the case of my university they don't provide a public key
> certificate so I can't (although I understand it might be possible to capture
> it out of the authentication stream). You can ignore the certificate (if it
> is just a server cert validation like I described above), or you can provide
> a certificate public key file (see the documentation for acceptable formats)
> to wpa_supplicant. There is an example configuration file distributed with
> wpa_supplicant that should have the exact parameter name in it.
>
> --
> Andrew Barr | http://www.oakcourt.dyndns.org/~andrew/ | GPG: 0xAD9AE76A
> "Those who would trade liberty for security deserve neither." -- B. Franklin
>



From maureenlai  Tue Jul 18 20:51:58 2006
From: maureenlai (Maureen Lai)
Date: Wed, 19 Jul 2006 11:51:58 +0800
Subject: how to use wpa_supplicant on wpa network with peap
	andcredentialing
Message-ID: <F7837395FD8E504DA37428E191F439BC011F8243@mis-exchange.allionlab.com>

How about try this configure in wpa_supplicant.conf in wpa_supplicant
tar ball.

# EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new
peaplabel

network={
	ssid="schoolssid"
	key_mgmt=WPA-EAP
	eap=PEAP
	identity="username"
	password="password"
	ca_cert="/etc/cert/ca.pem"
	phase1="peaplabel=1"
	phase2="auth=MSCHAPV2"
}

I think you might need to get a certificate file (ca.pem) from your
radius server first.

-----Original Message-----
From: hostap-bounces+maureenlai=allion.com at shmoo.com
[mailto:hostap-bounces+maureenlai=allion.com at shmoo.com] On Behalf Of
John H.
Sent: Wednesday, July 19, 2006 10:28 AM
To: Andrew Barr
Cc: hostap at shmoo.com
Subject: Re: how to use wpa_supplicant on wpa network with peap
andcredentialing

hmm, i did as i thought i was told to do, but it caused an error in my
config file and not until i commented out the entry could i use
wpa_supplicant for other networks. here is what i had

#network={
#        ssid="schoolssid"
#        proto=WPA
#        key_mgmt=WPA-PSK
#        pairwise=TKIP
#        group=TKIP
#        scan_ssid=1
#        eap=PEAP
#       identity="username"
#       password="password"
#}


On 7/17/06, Andrew Barr <andrew.james.barr at gmail.com> wrote:
> On Monday 17 July 2006 17:00, John H. wrote:
> > sorry, certificates, that's the word they used.  would i need to do
> > anything for that?
>
> Well, for PEAP the usual setup is to validate the server certificate
to
> prevent rogue APs and password stealing and the like. You don't HAVE
to do
> it, and in the case of my university they don't provide a public key
> certificate so I can't (although I understand it might be possible to
capture
> it out of the authentication stream). You can ignore the certificate
(if it
> is just a server cert validation like I described above), or you can
provide
> a certificate public key file (see the documentation for acceptable
formats)
> to wpa_supplicant. There is an example configuration file distributed
with
> wpa_supplicant that should have the exact parameter name in it.
>
> --
> Andrew Barr | http://www.oakcourt.dyndns.org/~andrew/ | GPG:
0xAD9AE76A
> "Those who would trade liberty for security deserve neither." -- B.
Franklin
>
_______________________________________________
HostAP mailing list
HostAP at shmoo.com
http://lists.shmoo.com/mailman/listinfo/hostap




From raymond_kwl  Tue Jul 18 21:56:05 2006
From: raymond_kwl (Raymond Kam)
Date: Wed, 19 Jul 2006 12:56:05 +0800 (CST)
Subject: Need to ping from client everytime
Message-ID: <20060719045605.90634.qmail@web61313.mail.yahoo.com>

Dear all,

I've installed a netgate mini-PCI (prism 2.5 chipset with hostap driver 0.47) card in a linux box (slackware 10.2)

When the linux box startup up, I cannot ping it through my desktop PC, unless I issue a ping comand from the linux box to my desktop PC.

Rgds,
Raymond.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060719/6ee1e9d0/attachment.htm 


From mistamaila  Tue Jul 18 23:30:59 2006
From: mistamaila (John H.)
Date: Wed, 19 Jul 2006 01:30:59 -0500
Subject: how to use wpa_supplicant on wpa network with peap
	andcredentialing
In-Reply-To: <F7837395FD8E504DA37428E191F439BC011F8243@mis-exchange.allionlab.com>
References: <F7837395FD8E504DA37428E191F439BC011F8243@mis-exchange.allionlab.com>
Message-ID: <5b9417770607182330s15204830xafcc0b4c6253b3e8@mail.gmail.com>

so i DO need a certificate?  once i get it working in xp, should the
file be local in XP and i can get it from there?

On 7/18/06, Maureen Lai <maureenlai at allion.com> wrote:
> How about try this configure in wpa_supplicant.conf in wpa_supplicant
> tar ball.
>
> # EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new
> peaplabel
>
> network={
>         ssid="schoolssid"
>         key_mgmt=WPA-EAP
>         eap=PEAP
>         identity="username"
>         password="password"
>         ca_cert="/etc/cert/ca.pem"
>         phase1="peaplabel=1"
>         phase2="auth=MSCHAPV2"
> }
>
> I think you might need to get a certificate file (ca.pem) from your
> radius server first.
>
> -----Original Message-----
> From: hostap-bounces+maureenlai=allion.com at shmoo.com
> [mailto:hostap-bounces+maureenlai=allion.com at shmoo.com] On Behalf Of
> John H.
> Sent: Wednesday, July 19, 2006 10:28 AM
> To: Andrew Barr
> Cc: hostap at shmoo.com
> Subject: Re: how to use wpa_supplicant on wpa network with peap
> andcredentialing
>
> hmm, i did as i thought i was told to do, but it caused an error in my
> config file and not until i commented out the entry could i use
> wpa_supplicant for other networks. here is what i had
>
> #network={
> #        ssid="schoolssid"
> #        proto=WPA
> #        key_mgmt=WPA-PSK
> #        pairwise=TKIP
> #        group=TKIP
> #        scan_ssid=1
> #        eap=PEAP
> #       identity="username"
> #       password="password"
> #}
>
>
> On 7/17/06, Andrew Barr <andrew.james.barr at gmail.com> wrote:
> > On Monday 17 July 2006 17:00, John H. wrote:
> > > sorry, certificates, that's the word they used.  would i need to do
> > > anything for that?
> >
> > Well, for PEAP the usual setup is to validate the server certificate
> to
> > prevent rogue APs and password stealing and the like. You don't HAVE
> to do
> > it, and in the case of my university they don't provide a public key
> > certificate so I can't (although I understand it might be possible to
> capture
> > it out of the authentication stream). You can ignore the certificate
> (if it
> > is just a server cert validation like I described above), or you can
> provide
> > a certificate public key file (see the documentation for acceptable
> formats)
> > to wpa_supplicant. There is an example configuration file distributed
> with
> > wpa_supplicant that should have the exact parameter name in it.
> >
> > --
> > Andrew Barr | http://www.oakcourt.dyndns.org/~andrew/ | GPG:
> 0xAD9AE76A
> > "Those who would trade liberty for security deserve neither." -- B.
> Franklin
> >
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
>



From maureenlai  Wed Jul 19 00:39:47 2006
From: maureenlai (Maureen Lai)
Date: Wed, 19 Jul 2006 15:39:47 +0800
Subject: how to use wpa_supplicant on wpa network with peap
	andcredentialing
Message-ID: <F7837395FD8E504DA37428E191F439BC0125D0F3@mis-exchange.allionlab.com>

I tried it without certificate file on my system right now and it works.

I just commented out "ca_cert="/etc/cert/ca.pem" in wpa_supplicant conf
file.

Now I'm sure you DONOT need a certificate for connection. :)

The certificates need to be installed manually. It wouldn't be generate
automatically in xp. 

-----Original Message-----
From: John H. [mailto:mistamaila at gmail.com] 
Sent: Wednesday, July 19, 2006 2:31 PM
To: Maureen Lai
Cc: Andrew Barr; hostap at shmoo.com
Subject: Re: how to use wpa_supplicant on wpa network with peap
andcredentialing

so i DO need a certificate?  once i get it working in xp, should the
file be local in XP and i can get it from there?


On 7/18/06, Maureen Lai <maureenlai at allion.com> wrote:
> How about try this configure in wpa_supplicant.conf in wpa_supplicant
> tar ball.
>
> # EAP-PEAP/MSCHAPv2 configuration for RADIUS servers that use the new
> peaplabel
>
> network={
>         ssid="schoolssid"
>         key_mgmt=WPA-EAP
>         eap=PEAP
>         identity="username"
>         password="password"
>         ca_cert="/etc/cert/ca.pem"
>         phase1="peaplabel=1"
>         phase2="auth=MSCHAPV2"
> }
>
> I think you might need to get a certificate file (ca.pem) from your
> radius server first.
>




From ulovecutesun  Wed Jul 19 12:14:12 2006
From: ulovecutesun (Sun)
Date: Wed, 19 Jul 2006 15:14:12 -0400
Subject: Where can I get hostapd  source rpm?
Message-ID: <op.tcyadylzs31rc3@sraker>

Hello,

Where can I get hostapd source rpm for
Linux localhost.localdomain 2.6.17-1.2141_FC4 #1 Fri Jun 30 14:53:04 EDT  
2006 i686 i686 i386 GN
U/Linux ?

I tried this one:
hostapd-0.4.9-11.rhfc4.at.src.rpm  
(http://dl.atrpms.net/src/fc4-i386/atrpms/stable/), but it is for x64.

Thanks in advance

--
Sun



From traxtopel  Wed Jul 19 13:01:25 2006
From: traxtopel (Grant Williamson)
Date: Wed, 19 Jul 2006 22:01:25 +0200
Subject: peap-gtc and wpa_supplicant
Message-ID: <44BE8F95.9040500@gmail.com>

Hi,
at my work, we have peap-gtc on cisco 1200 ap's. I am trying to get it 
to connect.
I am running ipw2100 - 1.2.2, ieee80211-1.1.3
I have tried wpa_supplicant 0.4.9 & 0.5.4, to no avail.

The same machine, I can connect using wpa-eap/wpa-psk. Works fine.

My configuration file is as follows.

ctrl_interface=/var/run/wpa_supplicant
ap_scan=2
network={
                ssid="test"
                key_mgmt=IEEE8021X                              
#authentication protocol
                eap=PEAP                              #PEAP or TTLS 
permitted
                phase2="auth=GTC"                        #Force MSCHAPV2
                identity="user"
                password="password"
}

 I am told by the network people I only need a userid/password.
I am also informed that the radous server does not see any requests I 
have made.
It works for winxp users, running the funk client.

When I connect I see.
wpa_supplicant -Dwext -ieth1 -c/etc/eap/wpa_supplicant_peap.conf -dd

Initializing interface 'eth1' conf '/etc/eap/wpa_supplicant_peap.conf' 
driver 'wext' ctrl_interface 'N/A' bridge 'N/A'
Configuration file '/etc/eap/wpa_supplicant_peap.conf' -> 
'/etc/eap/wpa_supplicant_peap.conf'
Reading configuration file '/etc/eap/wpa_supplicant_peap.conf'
ctrl_interface='/var/run/wpa_supplicant'
ap_scan=2
Line: 3 - start of a new network block
ssid - hexdump_ascii(len=10):
key_mgmt: 0x8
eap methods - hexdump(len=16): 00 00 00 00 19 00 00 00 00 00 00 00 00 00 
00 00
phase2 - hexdump_ascii(len=8):
     61 75 74 68 3d 47 54 43                           auth=GTC
identity - hexdump_ascii(len=27):
password - hexdump_ascii(len=8): [REMOVED]
Priority group 0
   id=0 ssid='test'
Initializing interface (2) 'eth1'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
SIOCGIWRANGE: WE(compiled)=18 WE(source)=18 enc_capa=0xf
  capabilities: key_mgmt 0xf enc 0xf
WEXT: Operstate: linkmode=1, operstate=5
Own MAC address: 00:0c:f1:13:0f:3d
wpa_driver_wext_set_wpa
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_countermeasures
wpa_driver_wext_set_drop_unencrypted
Setting scan request: 0 sec 100000 usec
Added interface eth1
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
State: DISCONNECTED -> SCANNING
Trying to associate with SSID 'test'
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_associate
Setting authentication timeout: 60 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
Wireless event: cmd=0x8b06 len=8
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
Added BSSID 00:00:00:00:00:00 into blacklist
State: ASSOCIATING -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
Wireless event: cmd=0x8b1a len=23
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0e:83:50:01:70
State: DISCONNECTED -> ASSOCIATED
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0e:83:50:01:70
No keys have been configured - skip key clearing
Network configuration found for the current AP
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
EAPOL: External notification - portControl=Auto
Associated with 00:0e:83:50:01:70
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
Authentication with 00:0e:83:50:01:70 timed out.
Added BSSID 00:0e:83:50:01:70 into blacklist
State: ASSOCIATED -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_disassociate
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
State: DISCONNECTED -> SCANNING
Trying to associate with SSID 'test'
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_associate
Setting authentication timeout: 60 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
BSSID 00:0e:83:50:01:70 blacklist count incremented to 2
State: ASSOCIATING -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
Wireless event: cmd=0x8b06 len=8
Wireless event: cmd=0x8b1a len=23
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0e:83:50:01:70
State: DISCONNECTED -> ASSOCIATED
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0e:83:50:01:70
No keys have been configured - skip key clearing
Network configuration found for the current AP
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
EAPOL: External notification - portControl=Auto
Associated with 00:0e:83:50:01:70
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
Authentication with 00:0e:83:50:01:70 timed out.
BSSID 00:0e:83:50:01:70 blacklist count incremented to 3
State: ASSOCIATED -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_disassociate
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
State: DISCONNECTED -> SCANNING
Trying to associate with SSID 'test'
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_associate
Setting authentication timeout: 60 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
BSSID 00:0e:83:50:01:70 blacklist count incremented to 4
State: ASSOCIATING -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
Wireless event: cmd=0x8b06 len=8
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
Wireless event: cmd=0x8b1a len=23
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0e:83:50:01:70
State: DISCONNECTED -> ASSOCIATED
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0e:83:50:01:70
No keys have been configured - skip key clearing
Network configuration found for the current AP
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
EAPOL: External notification - portControl=Auto
Associated with 00:0e:83:50:01:70
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
RX ctrl_iface - hexdump_ascii(len=6):
     53 54 41 54 55 53                                 STATUS
Authentication with 00:0e:83:50:01:70 timed out.
BSSID 00:0e:83:50:01:70 blacklist count incremented to 5
State: ASSOCIATED -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_disassociate
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
State: DISCONNECTED -> SCANNING
Trying to associate with SSID 'test'
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_associate
Setting authentication timeout: 60 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
BSSID 00:0e:83:50:01:70 blacklist count incremented to 6
State: ASSOCIATING -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
Wireless event: cmd=0x8b06 len=8
Wireless event: cmd=0x8b1a len=23
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0e:83:50:01:70
State: DISCONNECTED -> ASSOCIATED
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0e:83:50:01:70
No keys have been configured - skip key clearing
Network configuration found for the current AP
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
EAPOL: External notification - portControl=Auto
Associated with 00:0e:83:50:01:70
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
Authentication with 00:0e:83:50:01:70 timed out.
BSSID 00:0e:83:50:01:70 blacklist count incremented to 7
State: ASSOCIATED -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_disassociate
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
State: DISCONNECTED -> SCANNING
Trying to associate with SSID 'test'
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_associate
Setting authentication timeout: 60 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
BSSID 00:0e:83:50:01:70 blacklist count incremented to 8
State: ASSOCIATING -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
Wireless event: cmd=0x8b06 len=8
Wireless event: cmd=0x8b1a len=23
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0e:83:50:01:70
State: DISCONNECTED -> ASSOCIATED
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0e:83:50:01:70
No keys have been configured - skip key clearing
Network configuration found for the current AP
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
EAPOL: External notification - portControl=Auto
Associated with 00:0e:83:50:01:70
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth1' added
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
CTRL-EVENT-TERMINATING - signal 2 received
Removing interface eth1
State: ASSOCIATED -> DISCONNECTED
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_deauthenticate
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
wpa_driver_wext_set_wpa
wpa_driver_wext_set_drop_unencrypted
wpa_driver_wext_set_countermeasures
No keys have been configured - skip key clearing
WEXT: Operstate: linkmode=0, operstate=6
Removed BSSID 00:0e:83:50:01:70 from blacklist (clear)
Removed BSSID 00:00:00:00:00:00 from blacklist (clear)
Cancelling scan request

Can anyone help me, or have any pointers, I must of tried about 50 
different variations on the above config file.



From ivan.tarasov  Wed Jul 19 13:24:54 2006
From: ivan.tarasov (Ivan Tarasov)
Date: Wed, 19 Jul 2006 13:24:54 -0700
Subject: problems connecting to AP using WPA-PSK, Linux 2.6.16,
	ipw2200 card (wext driver)
In-Reply-To: <e499a45b0607181149j53b5f624ue9e83546d37a2d1c@mail.gmail.com>
References: <e499a45b0607181041l253f7f3v16493bd8a91d352e@mail.gmail.com>
	<e499a45b0607181149j53b5f624ue9e83546d37a2d1c@mail.gmail.com>
Message-ID: <e499a45b0607191324m443937eeic21f276e4955b31c@mail.gmail.com>

Hello,

I've got persistent problems with using wpa_supplicant to connect to an AP
with WPA authentication. I did an extensive search on mailing lists and
Internet in general and didn't find any solution, although I've seen a lot
of reports of similar problems.

/etc/wpa_supplicant.conf contents is somewhat like this:

# the following 3 lines were changed and this configuration was the most
stable
eapol_version=1
ap_scan=2
fast_reauth=2
network={
    ssid="somessid"
    scan_ssid=1
    key_mgmt=WPA-PSK
    proto=WPA
    pairwise=TKIP
    group=TKIP
    psk="somepassword"
}

You can find the wpa_supplicant log here:
http://mediacast.sun.com/share/tarasov/supplicant.log.gz
I tried to send it as an attach but my messeges never got through some
filter on the way to the mailing list.

The access point is Linksys WRT54G. The WiFi card is Intel IPW2200. I tried
using both wpa_supplicant 0.4.8 and 0.5.4. This log is from 0.5.4, it shows
both the unsuccessful attempts to connect to the AP and a successful
attempt, which disconnected mysteriously at last. It seems that most often
situation is that after wpa_supplicant started ASSOCIATING it receives the
0x8b15 event with AP address 00:00:00:00:00:00, and thus it simply
blacklists the AP.

You might be interested looking at the following lines more thoroughly:
lines 840-965: wpa_supplicant started authenticating, but suddenly received
the 0x8b15 during the 4WAY_HANDSHAKE, which it considered to be the sign of
a wrong password, thus it got disconnected.
lines 1142-1261: same as above, but it passed the 4WAY_HANDSHAKE and
received the 0x8b15 event with zero AP address during the GROUP_HANDSHAKE.
lines 1855-2035: successful connection, I was able to work for some time and
everything worked fine until it received the 0x8b15 event with zero AP
address again.

I tried hacking the sources in some ways but it didn't really help.

I tried connecting to this access point from Windows (using the application
from the Intel driver pack, without wpa_supplicant) and the connection was
very stable and it didn't drop (and it connected almost immediately). While
I was recording the attached log another notebook was connected to the same
access point and had a stable connection (again, from Windows). No changes
were made to the access point configuration during the log recording, so no
side effects could be introduced this way.

I would appreciate any help on this, I can give more information and try
recording more logs (but they all are pretty similar to the one I attached
anyway), or try patching the source if you direct me.

-- 
Best regards,
Ivan Tarasov
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060719/3449e95e/attachment.htm 


From ulovecutesun  Wed Jul 19 15:01:20 2006
From: ulovecutesun (Sun Kim)
Date: Wed, 19 Jul 2006 18:01:20 -0400
Subject: hostapd 0.4.9 with 2.6.17 kernel
Message-ID: <eb905330607191501j4dc8c64s4d4e9daf5c947246@mail.gmail.com>

Hello,
I've installed hostapd 0.4.9 with 2.6.17 kernel.
When I run hostapd with the following config, i got an error (below the
config).  It seems like not working in my machine if I set enable ieee
802.1x or wpa. Since I tested with simple.conf (no 802.1x and wpa), at least
it didn't show any error.
Any idea?

Many thanks in advance.

I list below used config files ( hostapd.config and simple.config) and some
specs ( uname,  ifconfig, and iwconfig).


[root at localhost Desktop]# cat hostapd.conf | grep ^[a-zA-Z]
interface=wlan0
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2
debug=0
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=test
macaddr_acl=0
auth_algs=3
eapol_key_index_workaround=0
eap_server=0
own_ip_addr=127.0.0.1
wpa=1
wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
wpa_passphrase=secret passphrase
wpa_key_mgmt=WPA-PSK WPA-EAP
wpa_pairwise=TKIP CCMP

[root at localhost Desktop]# hostapd -Bdd hostapd.conf
Configuration file: hostapd.conf
Opening raw packet socket for ifindex 6
Using interface wlan0 with hwaddr 00:02:2d:00:24:44 and ssid 'test'
Warning: both WPA PSK and passphrase set. Using passphrase.
ioctl[PRISM2_IOCTL_PRISM2_PARAM]: Invalid argument
Could not setup host-based encryption in kernel driver.
IEEE 802.1X initialization failed.
rmdir[ctrl_interface]: No such file or directory
ioctl[PRISM2_IOCTL_PRISM2_PARAM]: Invalid argument
Could not disable PrivacyInvoked for interface wlan0
-------------------------------------------------------------------------------------------------------------------------

[root at localhost Desktop]# cat simple.conf | grep ^[a-zA-Z]
interface=wlan0
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2
debug=0
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=test
macaddr_acl=0
auth_algs=3
eapol_key_index_workaround=0
own_ip_addr=127.0.0.1
wpa_pairwise=TKIP CCMP
--------------------------------------------------------------------------------------------------------------------

[root at localhost Desktop]# cat simple.conf | grep ^[a-zA-Z]
interface=wlan0
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2
debug=0
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=test
macaddr_acl=0
auth_algs=3
eapol_key_index_workaround=0
own_ip_addr=127.0.0.1
[root at localhost Desktop]# hostapd -Bdd hostapd.conf
Configuration file: hostapd.conf
Opening raw packet socket for ifindex 7
Using interface wlan0 with hwaddr 00:02:2d:00:24:44 and ssid 'test'
Flushing old station entries
Deauthenticate all stations
------------------------------------------------------------------------------------------------------------------------
Here is my specs:

[root at localhost Desktop]# uname -a
Linux localhost.localdomain 2.6.17-1.2142_FC4 #1 Tue Jul 11 22:41:14 EDT
2006 i686 i686 i386 GNU/Linux

[root at localhost Desktop]# /sbin/lsmod | grep host
hostap_cs              67073  1
hostap                119369  1 hostap_cs
ieee80211_crypt         7105  1 hostap
[root at localhost Desktop]# /sbin/ifconfig
dev11664  Link encap:UNSPEC  HWaddr
00-02-2D-00-24-44-F8-71-00-00-00-00-00-00-00-00
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 b)  TX bytes:312 (312.0 b)
          Interrupt:3 Base address:0x100

eth0      Link encap:Ethernet  HWaddr 00:03:47:0F:63:B0
          inet addr:192.168.1.104  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: fe80::203:47ff:fe0f:63b0/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:731 errors:0 dropped:0 overruns:0 frame:0
          TX packets:704 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:364407 (355.8 KiB)  TX bytes:201098 (196.3 KiB)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1728 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1728 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2012178 (1.9 MiB)  TX bytes:2012178 (1.9 MiB)

wlan0     Link encap:Ethernet  HWaddr 00:02:2D:00:24:44
          inet6 addr: fe80::202:2dff:fe00:2444/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:3 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:312 (312.0 b)
          Interrupt:3 Base address:0x100

[root at localhost Desktop]# /sbin/iwconfig
lo        no wireless extensions.

eth0      no wireless extensions.

sit0      no wireless extensions.

Warning: Driver for device dev11664 has been compiled with version 20
of Wireless Extension, while this program supports up to version 19.
Some things may be broken...

dev11664  IEEE 802.11b  ESSID:"test"
          Mode:Master  Frequency:2.422 GHz  Access Point: 02:02:2D:00:24:44
          Bit Rate:11 Mb/s   Sensitivity=1/3
          Retry limit:4   RTS thr:off
          Encryption key:off
          Power Management:off

wlan0     IEEE 802.11b  ESSID:"test"
          Mode:Master  Frequency:2.422 GHz  Access Point: 02:02:2D:00:24:44
          Bit Rate:11 Mb/s   Sensitivity=1/3
          Retry limit:4   RTS thr:off
          Encryption key:off
          Power Management:off
          Link Quality:0  Signal level:0  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0


-- 
Thanks,
Sun
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060719/80da628c/attachment.htm 


From mike  Wed Jul 19 16:14:20 2006
From: mike (Michael Stevens)
Date: Wed, 19 Jul 2006 18:14:20 -0500
Subject: Hostapd / Macbook Pro 4-way handshake issue
In-Reply-To: <C5E16C89-BF9A-4546-9D7C-029CD2B718C3@apple.com>
References: <20060718105016.BE9471344E6@mail.iocaine.com>
	<C5E16C89-BF9A-4546-9D7C-029CD2B718C3@apple.com>
Message-ID: <200607191814.21082.mike@hobnob.com>

Ta-Chien Lin sent us a link to a previous post at  
http://lists.shmoo.com/pipermail/hostap/2006-May/013235.html. The patch there 
fixes the problem but it appears hostapd is correct in sending out both IEs 
according to Page 83/98 of the 802.11i spec.  
http://standards.ieee.org/getieee802/download/802.11i-2004.pdf

Wireshark has a similar problem and does not decode the data field in all 
cases because of an incorrect conditional in epan/disectors/packet-eapol.c

Mike Stevens
Software Engineer
Hobnob, Inc.


On Tuesday 18 July 2006 13:58, james woodyatt wrote:
> On Thursday 13 July 2006 15:35, Michael Stevens wrote:
> > We have determined that MacBook Pros connecting to hostapd 0.4.9
> > have a problem with the 4-way handshake when wpa=3 (WPA and WPA2
> > operation).
>
> Apple engineers are currently analyzing this problem report.
> Regretfully, I can offer no other information at this time.  Read
> into that whatever you will.  <sigh/>



From proski  Wed Jul 19 17:23:41 2006
From: proski (Pavel Roskin)
Date: Wed, 19 Jul 2006 20:23:41 -0400
Subject: Where can I get hostapd  source rpm?
In-Reply-To: <op.tcyadylzs31rc3@sraker>
References: <op.tcyadylzs31rc3@sraker>
Message-ID: <20060719202341.ydcsc0swgc44sg48@webmail.spamcop.net>

Hello!

Quoting Sun <ulovecutesun at gmail.com>:

> Hello,
>
> Where can I get hostapd source rpm for
> Linux localhost.localdomain 2.6.17-1.2141_FC4 #1 Fri Jun 30 14:53:04 EDT
> 2006 i686 i686 i386 GN
> U/Linux ?

hostapd is not kernel specific.  Any valid source rpm for hostapd should work.

> I tried this one:
> hostapd-0.4.9-11.rhfc4.at.src.rpm
> (http://dl.atrpms.net/src/fc4-i386/atrpms/stable/), but it is for x64.

You are only telling us your interpretation, but not the reasons for your
interpretation.  I could easily compile it for i386.  Since I'm not using
atrpms build system, I had to add this line to my ~/.rpmmacros file:

%atrelease()    %1.fc4

--
Regards,
Pavel Roskin



From ifreebiz  Thu Jul 20 09:22:03 2006
From: ifreebiz (Andrew)
Date: Thu, 20 Jul 2006 09:22:03 -0700
Subject: malloc zero length buffer
In-Reply-To: <20060628020340.GB9503@jm.kir.nu>
References: <1151418740.2817.4.camel@localhost.localdomain>
	<44A14C8B.3000101@errno.com> <20060628020340.GB9503@jm.kir.nu>
Message-ID: <1153412523.27929.266491116@webmail.messagingengine.com>

I am trying to use wpa_supplication on a MIPS embedded system, but I
found a strange problem with function eap_tls_data_reassemble(). 

When the authentication starts, the in_len is 0. 
The statement - "data->tls_in = malloc(in_len);" in this function behave
differently when it on a linux box and when it is the target. On linux,
the malloc return a non-null pointer, but on my target, it return a null
pointer. On the target, null pointer causes the authentication failure
right away.

So I am fixing the problem as follows, but I don't know it is a proper
way to fix it. Any line starts with "=>" is what I added.

Thanks, Andrew

=>                if ((data->tls_in_left == 0)&& (in_len == 0)
&&(data->tls_in == 0))
=>                {
=>                     // work around
=>                     wpa_printf(MSG_DEBUG, "data->tls_in malloc work
around \n");
=>                     data->tls_in = & data->tls_in_left; 
=>                } else
=>                {
		     data->tls_in = malloc(in_len);
=>              } 

		if (data->tls_in == NULL)
                {
		     return NULL;
                }

-- 
http://www.fastmail.fm - The way an email service should be




From ulovecutesun  Thu Jul 20 10:13:55 2006
From: ulovecutesun (Sun Kim)
Date: Thu, 20 Jul 2006 13:13:55 -0400
Subject: Problem with Hostap Can Connect to Wlan but can't exchange data
Message-ID: <eb905330607201013n29c10db3h5db98f2ba236e4e7@mail.gmail.com>

Hello all,

I tried building up an AP (hostapd 0.4.9) with Lucent Technologies pc card
(which is a prism card) on 2.6.17_fc4 machine.
The following error occurs when I started hostapd.

I found similar issue, "Problem with Hostap Can Connect to Wlan but can't
exchange data (
http://lists.shmoo.com/pipermail/hostap/2006-January/012249.html )." But i
still couldn't figure my problem out.

The err message, config file, and dmesg are listed below.

Thanks for your help in advance.

err message:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[root at localhost mkim]# hostapd -dd /etc/hostapd/hostapd.conf
Configuration file: /etc/hostapd/hostapd.conf
Opening raw packet socket for ifindex 7
Using interface wlan0 with hwaddr 00:02:2d:00:24:44 and ssid 'test'
ioctl[PRISM2_IOCTL_PRISM2_PARAM]: Invalid argument
Could not setup host-based encryption in kernel driver.
IEEE 802.1X initialization failed.
rmdir[ctrl_interface]: No such file or directory
ioctl[PRISM2_IOCTL_PRISM2_PARAM]: Invalid argument
Could not disable PrivacyInvoked for interface wlan0
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
config file
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[root at localhost mkim]# cat /etc/hostapd/hostapd.conf | grep ^[a-zA-Z]
interface=wlan0
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2
debug=4
dump_file=/tmp/hostapd.dump
ctrl_interface=/var/run/hostapd
ctrl_interface_group=0
ssid=test
macaddr_acl=0
auth_algs=3
eap_message=hello
wep_key_len_broadcast=5
wep_key_len_unicast=5
eapol_key_index_workaround=0
eap_server=1
wpa=1
wpa_passphrase=xxxxxxxxx
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++


##################################################################
dmesg output after pc card inserted
##################################################################
pccard: PCMCIA card inserted into slot 0
cs: memory probe 0xa0000000-0xa0ffffff: clean.
pcmcia: registering new device pcmcia0.0
ieee80211_crypt: registered algorithm 'NULL'
hostap_cs: 0.4.4-kernel (Jouni Malinen <jkmaline at cc.hut.fi>)
ieee80211_crypt: registered algorithm 'WEP'
ieee80211_crypt: registered algorithm 'TKIP'
hostap_cs: setting Vcc=33 (constant)
Checking CFTABLE_ENTRY 0x01 (default 0x01)
IO window settings: cfg->io.nwin=1 dflt.io.nwin=1
io->flags = 0x0046, io.base=0x0000, len=64
hostap_cs: Registered netdevice wifi0
hostap_cs: index 0x01: , irq 3, io 0x0100-0x013f
prism2_hw_init: initialized in 52 ms
wifi0: NIC: id=0x01 v4.0.1
wifi0: PRI: id=0x15 v4.0.1
wifi0: STA: id=0x1f v7.28.1
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fc33,
len=2)
wifi0: Beacon interval setting to 100 failed
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fc10,
len=2)
wifi0: DTIM period setting to 1 failed
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fcb4,
len=2)
wifi0: cnfSupportedRates setting to 15 failed
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fcb3,
len=2)
wifi0: cnfBasicRates setting to 3 failed
Could not read current WEP flags.
wifi0: encryption setup failed
wifi0: could not configure encryption
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fc2d,
len=2)
wifi0: could not set host roaming
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fc43,
len=2)
wifi0: cnfEnhSecurity setting to 0x0 failed
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fc42,
len=2)
wifi0: cnfThirty2Tally setting failed
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fc2a,
len=2)
wifi0: cnfAuthentication setting to 0x3 failed
wifi0: CMD=0x0121 => res=0x7f, resp0=0x0004
wifi0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fc82,
len=2)
wifi0: setting FragmentationThreshold to 2346 failed
wifi0: registered netdevice wlan0
dev23950: TXEXC - status=0x0004 ([Discon]) tx_control=000c
   retry_count=0 tx_rate=0 fc=0x0208 (Data::0 FromDS)
   A1=33:33:00:00:00:16 A2=00:02:2d:00:24:44 A3=00:02:2d:00:24:44
A4=00:00:00:00:00:00
dev23950: Could not find STA 33:33:00:00:00:16 for this TX error (@1847625)
dev23950: LinkStatus=1 (Connected)
wlan0: no IPv6 routers present
dev23950: LinkStatus=1 (Connected)
                .
                .
                .
dev23950: LinkStatus=1 (Connected)

###################################################################
after hostapd started
###################################################################
dev23950: enabling hostapd mode
dev23950: registered netdevice wlan0ap
Could not read current WEP flags.
dev23950: encryption setup failed
Could not read current WEP flags.
dev23950: encryption setup failed
dev23950: LinkStatus=1 (Connected)
dev23950: CMD=0x0121 => res=0x7f, resp0=0x0004
dev23950: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed (res=127, rid=fc48,
len=2)
dev23950: disabling hostapd mode
###########################################################################

-- 
Thanks,
Sun
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060720/94ce261f/attachment.htm 


From jar  Thu Jul 20 10:29:51 2006
From: jar (Jar)
Date: Thu, 20 Jul 2006 20:29:51 +0300 (EEST)
Subject: Problem with Hostap Can Connect to Wlan but can't exchange data
In-Reply-To: <eb905330607201013n29c10db3h5db98f2ba236e4e7@mail.gmail.com>
References: <eb905330607201013n29c10db3h5db98f2ba236e4e7@mail.gmail.com>
Message-ID: <61278.213.250.74.53.1153416591.squirrel@netlandzone.dyndns.org>


> Hello all,
>
> I tried building up an AP (hostapd 0.4.9) with Lucent Technologies pc card
> (which is a prism card) on 2.6.17_fc4 machine.
> The following error occurs when I started hostapd.

> wifi0: NIC: id=0x01 v4.0.1
> wifi0: PRI: id=0x15 v4.0.1
> wifi0: STA: id=0x1f v7.28.1


Sorry but this is not prism based but hermes based. Orinoco_cs is correct client
driver for this card.

-- 
Best Regards, Jar



From yan  Thu Jul 20 14:25:40 2006
From: yan (Yan Seiner)
Date: Thu, 20 Jul 2006 14:25:40 -0700
Subject: Really poor range in AP mode
Message-ID: <44BFF4D4.1060703@seiner.com>

I am somewhat at a loss on how to proceed.   I have a hostap - driven 
wifi card (linksys WCF12) which works OK, but its range is very poor. In 
managed mode, the card has poor but acceptable range - say 10 -15', not 
great, but OK for a handheld.  In AP mode, the range is really really 
bad - it can be measured in feet, sometimes in inches.  Right now, I 
have to have AP and client < 1' apart - even the width of a desktop will 
cause the connection to fail.

I am convinced this is a driver problem, but I have struck out 
completely with google finding any guidance on how to proceed.

But I am open to any and all suggestions on how to fix this.  I need a 
range of about 5 - 10' for my application.

--Yan




From brix  Thu Jul 20 14:54:17 2006
From: brix (Henrik Brix Andersen)
Date: Thu, 20 Jul 2006 23:54:17 +0200
Subject: wpa_supplicant & ipv6
In-Reply-To: <44A14C8B.3000101@errno.com>
References: <1151418740.2817.4.camel@localhost.localdomain>
	<44A14C8B.3000101@errno.com>
Message-ID: <20060720215417.GA31073@osgiliath.brixandersen.dk>

On Tue, Jun 27, 2006 at 08:19:39AM -0700, Sam Leffler wrote:
> I recently saw a report from a netbsd user (cc'd) of an issue using
> wpa_supplicant over ipv6 but they didn't provide enough details to
> follow-through.  The symptom the user reported was seeing increasing
> rxseq# violations for CCMP--as if the rekeying was not happening
> correctly.  Looking at l2_packet.c I'm wondering if things can work in
> an ipv6-only network.

I am seeing issues with IPv6 here with both Linux and FreeBSD clients
on my hostapd-based access point.

I've reported this as
http://hostap.epitest.fi/bugz/show_bug.cgi?id=130 about 4 months ago
without getting a reply yet...

Regards,
Brix
-- 
Henrik Brix Andersen <brix at gentoo.org>
Gentoo Metadistribution | Mobile computing herd

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 211 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060720/4dda0261/attachment.pgp 


From slafuente  Fri Jul 21 04:08:34 2006
From: slafuente (silvia lafuente)
Date: Fri, 21 Jul 2006 13:08:34 +0200
Subject: Is wifi0 (and not wlan0) in charge of the stablishing the queuing
	disciplines on the interface? 
Message-ID: <44C0B5B2.1080507@ehas.org>


Hi everybody, 
Our problem with hostAP virtual interface (wlan0), and the master radio (wifi0) is quite particular. Usually you have to use wlan0
as I read in the FAQ[6] http://hostap.epitest.fi/cgi-bin/viewcvs.cgi/*checkout*/hostap/FAQ?rev=HEAD&content-type=text/plain <http://hostap.epitest.fi/cgi-bin/viewcvs.cgi/*checkout*/hostap/FAQ?rev=HEAD&content-type=text/plain>
But here is the situation:
We are using queuing disciplines on wireless interfaces to differeciate services (DiffServ), mainly PRIO (to priorize a type of service above the rest)
and HTB (to establish a hierarchy of importance between the services). 
We use the tc command for configuration. 
First we started studying the performance with no queuing discipline (we call it DEFAULT), and after that, we've used PRIO and HTB.
As it turns, the HTB works fine when you configure the behavior on wlan0, but for days the PRIO didn't work. The behavior of the PRIO on wlan0 
was the same as de DEFAULT behavior. Only when we set the queuing discipline on wifi0 instead of setting it on wlan0 the PRIO worked.
So the question is, what is the role of the master interface wifi0? What is it in charge of? In the FAQ says, ignore wifi0 and use wlan0, but in 
this case it didn't work that way for PRIO queuing.
 

Thanks, 

Silvia





From jnessij  Fri Jul 21 07:31:53 2006
From: jnessij (Johanna Maldonado)
Date: Fri, 21 Jul 2006 14:31:53 +0000
Subject: FW: wpa_supplicant/madwifi/802.11i
Message-ID: <BAY121-F20C995E4338CF878AC5EF3AD660@phx.gbl>

An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060721/e6bdde44/attachment.htm 


From jkmaline  Fri Jul 21 20:46:29 2006
From: jkmaline (Jouni Malinen)
Date: Fri, 21 Jul 2006 20:46:29 -0700
Subject: FW: wpa_supplicant/madwifi/802.11i
In-Reply-To: <BAY121-F20C995E4338CF878AC5EF3AD660@phx.gbl>
References: <BAY121-F20C995E4338CF878AC5EF3AD660@phx.gbl>
Message-ID: <20060722034628.GA9516@jm.kir.nu>

On Fri, Jul 21, 2006 at 02:31:53PM +0000, Johanna Maldonado wrote:
> I would like to know if anybody has tried to conneted a Atheros chipset with madwifi driver and a wpa_supplicant with ARUBA equipments that claim to support "opportunistic key caching"&nbsp; I will appreciate any information you can have in this matter.

I have not tested this with Aruba devices since I do not have access to
one, but assuming you enable opportunistic PMKSA caching by setting
proactive_key_caching=1 in wpa_supplicant configuration (it is disabled
by default), I would expect this to work. If not, I would certainly be
interested in getting debug log or more details on what happened.

Opportunistic key caching is not part of the IEEE 802.11i standard, but
it is relatively simple addition and at least the vendors that I have
talked with seemed to implement it in the same way.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Fri Jul 21 20:53:11 2006
From: jkmaline (Jouni Malinen)
Date: Fri, 21 Jul 2006 20:53:11 -0700
Subject: malloc zero length buffer
In-Reply-To: <1153412523.27929.266491116@webmail.messagingengine.com>
References: <1151418740.2817.4.camel@localhost.localdomain>
	<44A14C8B.3000101@errno.com> <20060628020340.GB9503@jm.kir.nu>
	<1153412523.27929.266491116@webmail.messagingengine.com>
Message-ID: <20060722035311.GB9516@jm.kir.nu>

On Thu, Jul 20, 2006 at 09:22:03AM -0700, Andrew wrote:

> I am trying to use wpa_supplication on a MIPS embedded system, but I
> found a strange problem with function eap_tls_data_reassemble(). 
> 
> When the authentication starts, the in_len is 0. 
> The statement - "data->tls_in = malloc(in_len);" in this function behave
> differently when it on a linux box and when it is the target. On linux,
> the malloc return a non-null pointer, but on my target, it return a null
> pointer. On the target, null pointer causes the authentication failure
> right away.

There are malloc() implementations that return NULL for zero length
allocations..

> So I am fixing the problem as follows, but I don't know it is a proper
> way to fix it. Any line starts with "=>" is what I added.

Thanks for reporting this.

> =>                if ((data->tls_in_left == 0)&& (in_len == 0)
> &&(data->tls_in == 0))
> =>                {
> =>                     // work around
> =>                     wpa_printf(MSG_DEBUG, "data->tls_in malloc work
> around \n");
> =>                     data->tls_in = & data->tls_in_left; 

This is not acceptable. data->tls_in need to be non-zero, but pointing
it to tls_in_left (integer) is not very good idea.

> 		     data->tls_in = malloc(in_len);

I changed this to malloc(in_len ? in_len : 1) in order to avoid
malloc(0) call that could return NULL with some C libraries. Similar
construction is used elsewhere in wpa_supplicant to avoid this exact
same issue.
 
-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Fri Jul 21 20:58:50 2006
From: jkmaline (Jouni Malinen)
Date: Fri, 21 Jul 2006 20:58:50 -0700
Subject: peap-gtc and wpa_supplicant
In-Reply-To: <44BE8F95.9040500@gmail.com>
References: <44BE8F95.9040500@gmail.com>
Message-ID: <20060722035850.GC9516@jm.kir.nu>

On Wed, Jul 19, 2006 at 10:01:25PM +0200, Grant Williamson wrote:

> at my work, we have peap-gtc on cisco 1200 ap's. I am trying to get it 
> to connect.

> The same machine, I can connect using wpa-eap/wpa-psk. Works fine.

Did I understand correctly that the network that you are having problems
with is using IEEE 802.1X with dynamic WEP keys (i.e., not WPA at all)?

>  I am told by the network people I only need a userid/password.

Well, if they do not want to make the network secure, that would be
true.. The network is open to man-in-the-middle attacks if the PEAP/TTLS
client does not validate server certificate..

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Fri Jul 21 21:07:21 2006
From: jkmaline (Jouni Malinen)
Date: Fri, 21 Jul 2006 21:07:21 -0700
Subject: Having problem on wpa_supplicant with EAP-TTLS
In-Reply-To: <20060713084925.GA27368@efrei.fr>
References: <20060713084925.GA27368@efrei.fr>
Message-ID: <20060722040721.GD9516@jm.kir.nu>

On Thu, Jul 13, 2006 at 10:49:25AM +0200, Paul-Henri Gauzence de Lastours wrote:

> I first tried an simple MD5 authentication and everything was working
> fine. Then I came to an EAP-TTLS authentication which never ends
> successfully.

> Here's the debug ouput of wpa_supplicant:

Please send the full debug log of the authentication attempt (-dd on
command line and include all lines from the output).

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Fri Jul 21 21:13:44 2006
From: jkmaline (Jouni Malinen)
Date: Fri, 21 Jul 2006 21:13:44 -0700
Subject: PMK lifetime
In-Reply-To: <18C47C3B48E39944AC3EFAA249D70C22FC1F93@zil01exm61.ds.mot.com>
References: <18C47C3B48E39944AC3EFAA249D70C22FC1F93@zil01exm61.ds.mot.com>
Message-ID: <20060722041344.GE9516@jm.kir.nu>

On Thu, Jul 13, 2006 at 11:54:48AM +0300, Kolatker Hagit-BHK010 wrote:

> *	What is the PMK lifetime for supplicant, is it hard-coded ? And
> what does it do when its expires?

In the current implementation, there is no mechanism for using a PMK
lifetime in wpa_supplicant. In addition, neither IEEE 802.1X nor IEEE
802.11i/WPA deliver the key lifetime to the supplicant, so if this were
to be implemented, a value would need to be hardcoded. The current
implementation does not have such a timeout, but if it had, it would
likely try to re-authenticate (EAP authentication) to generate a new PMK
some time before the expiry of the old key.

> *	And same for AP - What is the PMK lifetime for AP, is it
> hard-coded, or taken from RADIUS message? And what does it do when its
> expires?

The RADIUS authentication server can define a re-authentication timeout
by including Session-Timeout attribute. hostapd uses this as the
re-authentication period, if included in the RADIUS message. If not,
eap_reauth_period from the local configuration is used.

This is not strictly PMK lifetime, but in practice, it forces
re-authentication and generation of a new PMK after the session timeout
has been reached.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Fri Jul 21 21:18:34 2006
From: jkmaline (Jouni Malinen)
Date: Fri, 21 Jul 2006 21:18:34 -0700
Subject: mac based auth with radius problem!
In-Reply-To: <26b26d180607180346s74774cafi6007d7293633ca4c@mail.gmail.com>
References: <26b26d180607180346s74774cafi6007d7293633ca4c@mail.gmail.com>
Message-ID: <20060722041834.GF9516@jm.kir.nu>

On Tue, Jul 18, 2006 at 04:16:36PM +0530, saurav barik wrote:

> I am trying mac based authentication with my hostapd version-0.4.8
> running on debian sarge, with radius server.
> Its been long I am only able to send accounting information but no
> authentication request. In fact, radius log says there is no username
> present in the auth req sent from the radius client.

Which authentication request would that be? hostapd debug log you
included did not show any authentication message being sent to the
authentication server..

> For attaining only mac based authentication with radius server, what
> should be the content of hostapd.conf file?

> driver=madwifi

> macaddr_acl=2
> auth_server_addr=192.168.157.211
> auth_server_port=1812
> auth_server_shared_secret=saurav

Those four lines would be the minimal set needed for MAC ACL using
RADIUS. However, I do not think that this would be supported with
madwifi driver.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Fri Jul 21 22:19:56 2006
From: jkmaline (Jouni Malinen)
Date: Fri, 21 Jul 2006 22:19:56 -0700
Subject: Hostapd / Macbook Pro 4-way handshake issue
In-Reply-To: <200607191814.21082.mike@hobnob.com>
References: <20060718105016.BE9471344E6@mail.iocaine.com>
	<C5E16C89-BF9A-4546-9D7C-029CD2B718C3@apple.com>
	<200607191814.21082.mike@hobnob.com>
Message-ID: <20060722051956.GG9516@jm.kir.nu>

On Wed, Jul 19, 2006 at 06:14:20PM -0500, Michael Stevens wrote:
> Ta-Chien Lin sent us a link to a previous post at  
> http://lists.shmoo.com/pipermail/hostap/2006-May/013235.html. The patch there 
> fixes the problem but it appears hostapd is correct in sending out both IEs 
> according to Page 83/98 of the 802.11i spec.  
> http://standards.ieee.org/getieee802/download/802.11i-2004.pdf

Thanks for reminding me about this.. IEEE 802.11i does not actually say
much (well, anything) about WPA, since WPA is not part of any IEEE
standards. This topic has come up when test cases for WPA2 were being
developed and interoperability with WPA-only devices was considered.

Ideally, both IEs would be included in message 3/4, but unfortunately,
that can break connection with some old WPA implementations. This is the
reason for only sending WPA IE in case the client is requesting WPA, not
WPA2. However, similar stripping of WPA IE for WPA2 stations is not
done, since WPA2 clients are expected to be able to handle more than one
IE in the EAPOL-Key message 3/4. In WPA2/IEEE 802.11i, message 3/4
already includes two parts (RSN IE and Group Key KDE), so the parser
will need to be able to handle both.

> On Tuesday 18 July 2006 13:58, james woodyatt wrote:
> > On Thursday 13 July 2006 15:35, Michael Stevens wrote:
> > > We have determined that MacBook Pros connecting to hostapd 0.4.9
> > > have a problem with the 4-way handshake when wpa=3 (WPA and WPA2
> > > operation).
> >
> > Apple engineers are currently analyzing this problem report.
> > Regretfully, I can offer no other information at this time.  Read
> > into that whatever you will.  <sigh/>

Unfortunately, there may be supplicant implementations that do not
process key data field in EAPOL-Key message 3/4 in a way that would
ignore unknown IEs or in this case, maybe get confused with both RSN and
WPA IE being present. If Beacon and Probe Response frames include both
IEs, so should msg 3/4 (with the unfortunate exception of some old WPA
stations which require a workaround). I would rather not change hostapd
to strip these IEs unless it is justified by a large number of client
devices that do not handle both IEs here.

It would be interesting to see debug log from the supplicant to verify
why the message is being rejected. It could also be useful to verify
that the WPA and RSN IEs in Beacon and Probe Response frames are the
exact same ones as the ones hostapd is adding to the EAPOL-Key frames
3/4. I have not tested mixed mode (WPA + WPA2) with BSD, so I don't know
what exactly to wait there. Anyway, I remember some issues with madwifi
driver related to this kind of configuration since the driver was
generating its own IEs and hostapd happened to generate a list of
allowed ciphers in different order and one of the IEs could include an
optional field and the other one did not.

The key data field in EAPOL-Key message 3/4 of WPA2/IEEE 802.11i is
encrypted, so packet capture log alone is not enough to verify whether
the IEs are indeed matching. hostapd debug log should show the plaintext
contents of the field ("Plaintext EAPOL-Key Key Data") and that can then
be compared to the IEs in the Beacon/ProbeRsp frames.

-- 
Jouni Malinen                                            PGP id EFC895FA



From mistamaila  Sat Jul 22 10:49:37 2006
From: mistamaila (John H.)
Date: Sat, 22 Jul 2006 12:49:37 -0500
Subject: after using ndiswrapper for a while,
	internet goes down and programs have problems
Message-ID: <5b9417770607221049n5d5186cco7dea8c1d16de292e@mail.gmail.com>

i thought this was with wpa_supplicant, but apparently not.  after i
use module 1.21 and either wpa_supplicant .4.8 or .4.9 for a while,
the internet goes down and many X programs and even X itself has
problems until i kill wpa_supplicant and renew the connection.


i noticed console says this during that time?

ndiswrapper (iw_set_freq:377): setting configuration failed (00010003)



From jkmaline  Sat Jul 22 11:35:56 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 22 Jul 2006 11:35:56 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
Message-ID: <20060722183556.GA9537@jm.kir.nu>

On Tue, Jul 18, 2006 at 07:43:54AM -0700, George S. Lockwood wrote:

> Anyone have trouble compiling and running a Release version wpa_supplicant
> for Windows??

The project files included in wpa_supplicant v0.5.4 did not include full
configuration for the Release|Win32 target. I fixed this now and the
current snapshot includes proper parameters for both Debug and Release
targets.

> I have been able to configure the Visual Studio 2005 project files to find
> openssl and wpdpack but to get it compile for a Release version, I had to
> add the preprocessor var: CONFIG_WIN32_DEFAULTS.

There are also couple of additional options that need to be set in the
project files (see the today's commit to CVS repository for details).

> However, the compile exe is only 916k compared to the downloaded binary of
> ~1200k.

The release binary is built with completely different compiler
(gcc/MinGW) and different libraries..

> The Release version ends (see below), but the same code built for Debug
> results in a connection / authentication.
> 
> so I believe my Release project settings are off.  Could it be my libs? the
> code generation settings?  the addtion of CONFIG_WIN32_DEFAULTS??

I don't know why the Release version would behave differently. I just
copied the settings from the Debug configuration and was able to build
working wpa_supplicant.exe and wpasvc.exe with Release target.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Jul 22 18:42:00 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 22 Jul 2006 18:42:00 -0700
Subject: GET_NETWORK X wep_key0 is inconsistent
In-Reply-To: <20060718193033.5w27k3jb404g0skk@admin.betaversion.net>
References: <20060718193033.5w27k3jb404g0skk@admin.betaversion.net>
Message-ID: <20060723014159.GA9512@jm.kir.nu>

On Tue, Jul 18, 2006 at 07:30:33PM +0200, Frank Meerkoetter wrote:

> i've noticed that the format of the value returned by
> GET_NETWORK X wep_key0 is inconsistent.
> 
> SET_NETWORK 1 wep_key0 5656565656
> GET_NETWORK 1 wep_key0
> "VVVVV"
> 
> Which is they ascii representation of this 565656565656.

> Is this a bug or didn't i understand how it is supposed to
> work?

This is the expected behavior, i.e., a feature, not a bug.. Most of the
configuration variables that allow either a hexstring of binaries or an
ASCII string are written back in ASCII string is possible (all
characters printable). This happens even if the value was first set as
a hexstring since the format of the original string is not saved in the
runtime configuration.

-- 
Jouni Malinen                                            PGP id EFC895FA



From swenggsri  Sun Jul 23 20:23:13 2006
From: swenggsri (Sriram Chadalavada)
Date: Sun, 23 Jul 2006 22:23:13 -0500
Subject: Bit error rate/Packet error rate measurement
Message-ID: <e78b60ce0607232023i20ccd70fv1f2217f9e547a3ab@mail.gmail.com>

Hi everyone,
  We need to test bit error rates for prism 3 cards at different
802.11bspeeds : 1, 2, 5 and 11 Mbps. My understanding is that this
metric will
characterize link layer errors and is dependent on the SNR at the card
receiver.

While manufacturer/vendor specs provide certain values, are these
verifiable? Is there any software available for this purpose?

Alternatively, are there any tools to measure packet error rate from which
we could derive the BER?

Thanks,
Sriram C.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060723/be9f28c6/attachment.htm 


From dinh107  Mon Jul 24 03:08:01 2006
From: dinh107 (Tran Thanh Dinh)
Date: Mon, 24 Jul 2006 03:08:01 -0700 (PDT)
Subject: Which wireless LAN PCI adapter for HostAP?
Message-ID: <20060724100801.87331.qmail@web31701.mail.mud.yahoo.com>

  Hi,

  I want to use HostAP on my desktop machine. I read
the README file and it says that I need a card based
on Prism 2/2.5/3 chipset. I was looking around online
and found this following list of cards based on Prism
2/2.5/3 chipset: 
http://www.34t.com/box-docs.asp?doc=808

  Finally, I found 2 PCI cards which are:
NETGEAR MA311 - Network adapter - PCI
3COM 3CRWE777A PCI 
But I couldn't find these 2 cards to buy. They seems
to be discontinued.

  Could you recommend me one compatible with HostAP
that I can still find at the market please?

  Thanks a lot for your help,
  Best regards,

Dinh Tran

 



__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 



From saurav.barik  Mon Jul 24 04:32:56 2006
From: saurav.barik (saurav barik)
Date: Mon, 24 Jul 2006 17:02:56 +0530
Subject: mac based auth with radius problem!
In-Reply-To: <20060722041834.GF9516@jm.kir.nu>
References: <26b26d180607180346s74774cafi6007d7293633ca4c@mail.gmail.com>
	<20060722041834.GF9516@jm.kir.nu>
Message-ID: <26b26d180607240432y3eb06b16mf48afbb620d9f393@mail.gmail.com>

Hi,
thanks a lot for the reply.

As you would have seen, i am having the required configuration in my
hostapd.conf file.
Moreover, if this is not supported by the madwifi driver, is it that i can
never use a radius server with madwifi and hostapd, not even for wpa-eap.

thanks again,
saurav


On 7/22/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Tue, Jul 18, 2006 at 04:16:36PM +0530, saurav barik wrote:
>
> > I am trying mac based authentication with my hostapd version-0.4.8
> > running on debian sarge, with radius server.
> > Its been long I am only able to send accounting information but no
> > authentication request. In fact, radius log says there is no username
> > present in the auth req sent from the radius client.
>
> Which authentication request would that be? hostapd debug log you
> included did not show any authentication message being sent to the
> authentication server..
>
> > For attaining only mac based authentication with radius server, what
> > should be the content of hostapd.conf file?
>
> > driver=madwifi
>
> > macaddr_acl=2
> > auth_server_addr=192.168.157.211
> > auth_server_port=1812
> > auth_server_shared_secret=saurav
>
> Those four lines would be the minimal set needed for MAC ACL using
> RADIUS. However, I do not think that this would be supported with
> madwifi driver.
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060724/97210449/attachment.htm 


From gslockwood  Mon Jul 24 06:52:37 2006
From: gslockwood (George S. Lockwood)
Date: Mon, 24 Jul 2006 06:52:37 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <20060722183556.GA9537@jm.kir.nu>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
Message-ID: <e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>

thanks so much.  I download the latest and build it.

you are very helpful.

george

On 7/22/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Tue, Jul 18, 2006 at 07:43:54AM -0700, George S. Lockwood wrote:
>
> > Anyone have trouble compiling and running a Release version
> wpa_supplicant
> > for Windows??
>
> The project files included in wpa_supplicant v0.5.4 did not include full
> configuration for the Release|Win32 target. I fixed this now and the
> current snapshot includes proper parameters for both Debug and Release
> targets.
>
> > I have been able to configure the Visual Studio 2005 project files to
> find
> > openssl and wpdpack but to get it compile for a Release version, I had
> to
> > add the preprocessor var: CONFIG_WIN32_DEFAULTS.
>
> There are also couple of additional options that need to be set in the
> project files (see the today's commit to CVS repository for details).
>
> > However, the compile exe is only 916k compared to the downloaded binary
> of
> > ~1200k.
>
> The release binary is built with completely different compiler
> (gcc/MinGW) and different libraries..
>
> > The Release version ends (see below), but the same code built for Debug
> > results in a connection / authentication.
> >
> > so I believe my Release project settings are off.  Could it be my libs?
> the
> > code generation settings?  the addtion of CONFIG_WIN32_DEFAULTS??
>
> I don't know why the Release version would behave differently. I just
> copied the settings from the Debug configuration and was able to build
> working wpa_supplicant.exe and wpasvc.exe with Release target.
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060724/c3ba37b2/attachment.htm 


From gauzence  Mon Jul 24 07:05:13 2006
From: gauzence (Paul-Henri Gauzence de Lastours)
Date: Mon, 24 Jul 2006 16:05:13 +0200
Subject: Having problem on wpa_supplicant with EAP-TTLS
Message-ID: <20060724140513.GA4211@efrei.fr>

Hi,

Here is the complete debug output for wpa-suplicant:



$ wpa_supplicant -ibr0 -cconf -dd
Initializing interface 'br0' conf 'conf' driver 'default' ctrl_interface
'N/A'
Configuration file 'conf' -> '/root/conf'
Reading configuration file '/root/conf'
ctrl_interface='/var/run/wpa_supplicant'
ctrl_interface_group=0
ap_scan=0
Line: 41 - start of a new network block
key_mgmt: 0x1
eap methods - hexdump(len=2): 15 00
identity - hexdump_ascii(len=4):
     75 73 65 72                                       user
password - hexdump_ascii(len=8): [REMOVED]
ca_cert - hexdump_ascii(len=12):
     2f 72 6f 6f 74 2f 63 61 2e 70 65 6d               /root/ca.pem
phase2 - hexdump_ascii(len=8):
     61 75 74 68 3d 4d 44 35			       auth=MD5
priority=2 (0x2)
Priority group 2
    id=0 ssid=''
Initializing interface (2) 'br0'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
wpa_driver_wired_init: Added multicast membership with packet socket
Own MAC address: 00:ab:cd:ee:00:04
Setting scan request: 0 sec 100000 usec
Added interface br0
EAPOL: External notification - portControl=Auto
Already associated with a configured network - generating associated event
Association info event
State: DISCONNECTED -> ASSOCIATED
Associated to a new BSS: BSSID=01:80:c2:00:00:03
No keys have been configured - skip key clearing
Network configuration found for the current AP
WPA: No WPA/RSN IE available from association info
WPA: Set cipher suites based on configuration
WPA: Selected cipher suites: group 30 pairwise 24 key_mgmt 1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: using GTK CCMP
WPA: using PTK CCMP
WPA: using KEY_MGMT 802.1X
WPA: Set own WPA IE default - hexdump(len=22): 30 14
01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 01 00 00
EAPOL: External notification - portControl=Auto
Associated with 01:80:c2:00:00:03
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
RX EAPOL from 00:ab:cd:10:00:28
RX EAPOL - hexdump(len=46): 02 00 00 12 01 67 00 12 01
64 75 63 6f 6e 6a 65 73 75 69 73 6c 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_PAE entering state RESTART
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request method=1 id=103
EAP: EAP entering state IDENTITY
CTRL-EVENT-EAP-STARTED EAP authentication started
EAP: EAP-Request Identity data - hexdump_ascii(len=5):
     64 75 63 6f 6e 6a 65 73 75 69 73 6c 61	       hello
EAP: using real identity - hexdump_ascii(len=4):
     75 73 65 72	    user
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE
EAPOL: SUPP_BE entering state RESPONSE
EAPOL: txSuppRsp
TX EAPOL - hexdump(len=13): 01 00 00 09 02 67 00 09 01 75 73 65 72
EAPOL: SUPP_BE entering state RECEIVE
RX EAPOL from 00:ab:cd:10:00:28
RX EAPOL - hexdump(len=46): 02 00 00 06 01 68 00 06 15 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00
EAPOL: Received EAP-Packet frame
EAPOL: SUPP_BE entering state REQUEST
EAPOL: getSuppRsp
EAP: EAP entering state RECEIVED
EAP: Received EAP-Request method=21 id=104
EAP: EAP entering state GET_METHOD
EAP: initialize selected EAP method (21, TTLS)
EAP-TTLS: Phase2 type: EAP
EAP-TTLS: Phase2 EAP types - hexdump(len=2): 04 1a
TLS: Trusted root certificate(s) loaded
CTRL-EVENT-EAP-METHOD EAP method 21 (TTLS) selected
EAP: EAP entering state METHOD
SSL: Received packet(len=6) - Flags 0x20
EAP-TTLS: Start
EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
EAP: EAP entering state SEND_RESPONSE
EAP: EAP entering state IDLE

CTRL-EVENT-TERMINATING - signal 2 received
Removing interface br0
State: ASSOCIATED -> DISCONNECTED
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
No keys have been configured - skip key clearing
EAP: deinitialize previously used EAP method (21, TTLS) at EAP deinit
Cancelling scan request
$



Thanks for your help.

Paul-Henri



From gslockwood  Mon Jul 24 09:35:16 2006
From: gslockwood (George S. Lockwood)
Date: Mon, 24 Jul 2006 09:35:16 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
Message-ID: <e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>

The wpa_supplcant code doesn't seem to work with the (external) Linksys
Wireless-g WUSB54GS card.  It can find it and add it, but I have never
gotten it to connect.

Any idea why it does not?  Linksys is a big player.

It does work with the more obsure Ashton digital card I have.  that is good!

george

On 7/24/06, George S. Lockwood <gslockwood at gmail.com> wrote:
>
> thanks so much.  I download the latest and build it.
>
> you are very helpful.
>
> george
>
>
> On 7/22/06, Jouni Malinen < jkmaline at cc.hut.fi> wrote:
> >
> > On Tue, Jul 18, 2006 at 07:43:54AM -0700, George S. Lockwood wrote:
> >
> > > Anyone have trouble compiling and running a Release version
> > wpa_supplicant
> > > for Windows??
> >
> > The project files included in wpa_supplicant v0.5.4 did not include full
> > configuration for the Release|Win32 target. I fixed this now and the
> > current snapshot includes proper parameters for both Debug and Release
> > targets.
> >
> > > I have been able to configure the Visual Studio 2005 project files to
> > find
> > > openssl and wpdpack but to get it compile for a Release version, I had
> > to
> > > add the preprocessor var: CONFIG_WIN32_DEFAULTS.
> >
> > There are also couple of additional options that need to be set in the
> > project files (see the today's commit to CVS repository for details).
> >
> > > However, the compile exe is only 916k compared to the downloaded
> > binary of
> > > ~1200k.
> >
> > The release binary is built with completely different compiler
> > (gcc/MinGW) and different libraries..
> >
> > > The Release version ends (see below), but the same code built for
> > Debug
> > > results in a connection / authentication.
> > >
> > > so I believe my Release project settings are off.  Could it be my
> > libs? the
> > > code generation settings?  the addtion of CONFIG_WIN32_DEFAULTS??
> >
> > I don't know why the Release version would behave differently. I just
> > copied the settings from the Debug configuration and was able to build
> > working wpa_supplicant.exe and wpasvc.exe with Release target.
> >
> > --
> > Jouni Malinen                                            PGP id EFC895FA
> >
> > _______________________________________________
> > HostAP mailing list
> > HostAP at shmoo.com
> > http://lists.shmoo.com/mailman/listinfo/hostap
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060724/410f9072/attachment.htm 


From jkmaline  Mon Jul 24 19:30:56 2006
From: jkmaline (Jouni Malinen)
Date: Mon, 24 Jul 2006 19:30:56 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
	<e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
Message-ID: <20060725023055.GA9504@jm.kir.nu>

On Mon, Jul 24, 2006 at 09:35:16AM -0700, George S. Lockwood wrote:
> The wpa_supplcant code doesn't seem to work with the (external) Linksys
> Wireless-g WUSB54GS card.  It can find it and add it, but I have never
> gotten it to connect.

I don't have such a card, so I haven't tested this. I'm not aware of
any known issues with NDIS drivers with the current code. Could you
please send a detailed debug log showing this failure?

-- 
Jouni Malinen                                            PGP id EFC895FA



From vincent.maurin  Tue Jul 25 03:31:33 2006
From: vincent.maurin (Vincent Maurin)
Date: Tue, 25 Jul 2006 12:31:33 +0200
Subject: Hostapd + WPA PEAP + Win XP SP2 supplicant
Message-ID: <20060725103314.ADC0228003B@smtp-out.completel.net>

Hi,

 

I have set up an access point WPA-PEAP TKIP.

I can connect with Intel PROSet supplicant, and Windows XP SP2 Supplicant.

But with the Windows one, the connection takes more than one minute, and
during this minute,

the supplicant seems to do nothing and I get this kind of debug message from
hostapd

 

IEEE 802.1X: Generated EAP Request-Identity for 00:0c:f1:50:b1:32
(identifier 0, timeout 30)

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 AUTH_PAE entering state CONNECTING

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 AUTH_PAE entering state AUTHENTICATING

IEEE 802.1X: 00:0c:f1:50:b1:32 BE_AUTH entering state REQUEST

IEEE 802.1X: Sending EAP Packet to 00:0c:f1:50:b1:32 (identifier 0)

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

 

.. And 30 s later .

 

ath0: STA 00:0c:f1:50:b1:32 IEEE 802.1X: EAP timeout

 

It loops on this during one minute and after that, the supplicant finally
does somethings

 

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 5 bytes from 00:0c:f1:50:b1:32

   IEEE 802.1X: version=1 type=1 length=0

   ignoring 1 extra octets after IEEE 802.1X packet

ath0: STA 00:0c:f1:50:b1:32 IEEE 802.1X: received EAPOL-Start from STA

ath0: STA 00:0c:f1:50:b1:32 WPA: event 5 notification

WPA: 00:0c:f1:50:b1:32 WPA_PTK entering state AUTHENTICATION2

IEEE 802.1X: 00:0c:f1:50:b1:32 AUTH_PAE entering state ABORTING

IEEE 802.1X: 00:0c:f1:50:b1:32 BE_AUTH entering state INITIALIZE

ath0: STA 00:0c:f1:50:b1:32 IEEE 802.1X: aborting authentication

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 AUTH_PAE entering state RESTART

IEEE 802.1X: station 00:0c:f1:50:b1:32 - new auth session, clearing State

IEEE 802.1X: Generated EAP Request-Identity for 00:0c:f1:50:b1:32
(identifier 4, timeout 30)

IEEE 802.1X: 00:0c:f1:50:b1:32 BE_AUTH entering state IDLE

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 AUTH_PAE entering state CONNECTING

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 AUTH_PAE entering state AUTHENTICATING

IEEE 802.1X: 00:0c:f1:50:b1:32 BE_AUTH entering state REQUEST

IEEE 802.1X: Sending EAP Packet to 00:0c:f1:50:b1:32 (identifier 4)

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 15 bytes from 00:0c:f1:50:b1:32

   IEEE 802.1X: version=1 type=0 length=11

   EAP: code=2 identifier=1 length=11 (response)

ath0: STA 00:0c:f1:50:b1:32 IEEE 802.1X: EAP Identifier of the
Response-Identity does not match (was 1, expected 4) - ignored

IEEE 802.1X: 00:0c:f1:50:b1:32 REAUTH_TIMER entering state INITIALIZE

IEEE 802.1X: 15 bytes from 00:0c:f1:50:b1:32

   IEEE 802.1X: version=1 type=0 length=11

   EAP: code=2 identifier=3 length=11 (response)

 

. the log continues with < normal > trace

 

 

It is clearly a supplicant problem, but I didn't find anything in the
windows support for SP2 (some issues for SP1, but corrected in SP2)

Has someone already had this kind of problem ?

 

 

Thanks

 

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060725/1acdbc35/attachment.htm 


From bryan  Tue Jul 25 04:00:07 2006
From: bryan (Bryan Kadzban)
Date: Tue, 25 Jul 2006 07:00:07 -0400
Subject: Hostapd + WPA PEAP + Win XP SP2 supplicant
In-Reply-To: <20060725103314.ADC0228003B@smtp-out.completel.net>
References: <20060725103314.ADC0228003B@smtp-out.completel.net>
Message-ID: <44C5F9B7.30300@kadzban.is-a-geek.net>

Vincent Maurin wrote:
> Has someone already had this kind of problem ?

I have noticed that XP's supplicant is really slow with EAP-TLS, too --
though that wasn't using hostapd.  I was using a Linksys WRT54G (v2)
running OpenWRT (White Russian RC4), with FreeRADIUS as the RADIUS backend.

No idea what the fix might be...
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060725/adcf8f66/attachment.pgp 


From gslockwood  Tue Jul 25 06:24:18 2006
From: gslockwood (George S. Lockwood)
Date: Tue, 25 Jul 2006 06:24:18 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <20060725023055.GA9504@jm.kir.nu>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
	<e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
	<20060725023055.GA9504@jm.kir.nu>
Message-ID: <e873c8350607250624o3135808x3b68bb308ad3a232@mail.gmail.com>

Jouni,

Ok. Will do shortly.  I saw some diagnostic messaging that led me to think
that it didn't recognize the card to be a wireless card.  words to that
effect.  This card is external (if that matters).  However, the external
Ashton Digital card I tried it with did work properly.

I'm wondering if there is a card setting (outside of wpa_sup) that needs to
be changed?? It does connect using the native Windows user interface.


On another topic, I can seem to find the way to start another thread!! Have
forgotten how and can't seem to find the link to use.  Using my own email
with hostap at shmoo.com bounces back pending approval.  Obviously, I have an
account or I wouldn't be writing to you.

Any help here would be great, Jouni.  Thanks.  BTW, what part of the world
are you in??

george

On 7/24/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Mon, Jul 24, 2006 at 09:35:16AM -0700, George S. Lockwood wrote:
> > The wpa_supplcant code doesn't seem to work with the (external) Linksys
> > Wireless-g WUSB54GS card.  It can find it and add it, but I have never
> > gotten it to connect.
>
> I don't have such a card, so I haven't tested this. I'm not aware of
> any known issues with NDIS drivers with the current code. Could you
> please send a detailed debug log showing this failure?
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060725/dfea33c9/attachment.htm 


From gslockwood  Tue Jul 25 08:58:57 2006
From: gslockwood (George S. Lockwood)
Date: Tue, 25 Jul 2006 08:58:57 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <e873c8350607250624o3135808x3b68bb308ad3a232@mail.gmail.com>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
	<e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
	<20060725023055.GA9504@jm.kir.nu>
	<e873c8350607250624o3135808x3b68bb308ad3a232@mail.gmail.com>
Message-ID: <e873c8350607250858p2fd253e2o621dee3d1a78dc0a@mail.gmail.com>

How does one determine the connection / authentication has been successfully
achieved?

Which console message is the one that one will always see?

george

On 7/25/06, George S. Lockwood <gslockwood at gmail.com> wrote:
>
> Jouni,
>
> Ok. Will do shortly.  I saw some diagnostic messaging that led me to think
> that it didn't recognize the card to be a wireless card.  words to that
> effect.  This card is external (if that matters).  However, the external
> Ashton Digital card I tried it with did work properly.
>
> I'm wondering if there is a card setting (outside of wpa_sup) that needs
> to be changed?? It does connect using the native Windows user interface.
>
>
> On another topic, I can seem to find the way to start another thread!!
> Have forgotten how and can't seem to find the link to use.  Using my own
> email with hostap at shmoo.com bounces back pending approval.  Obviously, I
> have an account or I wouldn't be writing to you.
>
> Any help here would be great, Jouni.  Thanks.  BTW, what part of the world
> are you in??
>
> george
>
>
> On 7/24/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
> >
> > On Mon, Jul 24, 2006 at 09:35:16AM -0700, George S. Lockwood wrote:
> > > The wpa_supplcant code doesn't seem to work with the (external)
> > Linksys
> > > Wireless-g WUSB54GS card.  It can find it and add it, but I have never
> >
> > > gotten it to connect.
> >
> > I don't have such a card, so I haven't tested this. I'm not aware of
> > any known issues with NDIS drivers with the current code. Could you
> > please send a detailed debug log showing this failure?
> >
> > --
> > Jouni Malinen                                            PGP id EFC895FA
> > _______________________________________________
> > HostAP mailing list
> > HostAP at shmoo.com
> > http://lists.shmoo.com/mailman/listinfo/hostap
> >
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060725/a395c00c/attachment.htm 


From gslockwood  Tue Jul 25 14:26:51 2006
From: gslockwood (George S. Lockwood)
Date: Tue, 25 Jul 2006 14:26:51 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <e873c8350607250858p2fd253e2o621dee3d1a78dc0a@mail.gmail.com>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
	<e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
	<20060725023055.GA9504@jm.kir.nu>
	<e873c8350607250624o3135808x3b68bb308ad3a232@mail.gmail.com>
	<e873c8350607250858p2fd253e2o621dee3d1a78dc0a@mail.gmail.com>
Message-ID: <e873c8350607251426h22e876d1ybfca09a3f9f132ca@mail.gmail.com>

One other thing re: the latest snapshot, is only difference in project
settings or code as well?

george

On 7/25/06, George S. Lockwood <gslockwood at gmail.com> wrote:
>
> How does one determine the connection / authentication has been
> successfully achieved?
>
> Which console message is the one that one will always see?
>
> george
>
>
> On 7/25/06, George S. Lockwood <gslockwood at gmail.com> wrote:
> >
> > Jouni,
> >
> > Ok. Will do shortly.  I saw some diagnostic messaging that led me to
> > think that it didn't recognize the card to be a wireless card.  words to
> > that effect.  This card is external (if that matters).  However, the
> > external Ashton Digital card I tried it with did work properly.
> >
> > I'm wondering if there is a card setting (outside of wpa_sup) that needs
> > to be changed?? It does connect using the native Windows user interface.
> >
> >
> > On another topic, I can seem to find the way to start another thread!!
> > Have forgotten how and can't seem to find the link to use.  Using my own
> > email with hostap at shmoo.com bounces back pending approval.  Obviously, I
> > have an account or I wouldn't be writing to you.
> >
> > Any help here would be great, Jouni.  Thanks.  BTW, what part of the
> > world are you in??
> >
> > george
> >
> >
> > On 7/24/06, Jouni Malinen < jkmaline at cc.hut.fi> wrote:
> > >
> > > On Mon, Jul 24, 2006 at 09:35:16AM -0700, George S. Lockwood wrote:
> > > > The wpa_supplcant code doesn't seem to work with the (external)
> > > Linksys
> > > > Wireless-g WUSB54GS card.  It can find it and add it, but I have
> > > never
> > > > gotten it to connect.
> > >
> > > I don't have such a card, so I haven't tested this. I'm not aware of
> > > any known issues with NDIS drivers with the current code. Could you
> > > please send a detailed debug log showing this failure?
> > >
> > > --
> > > Jouni Malinen                                            PGP id
> > > EFC895FA
> > > _______________________________________________
> > > HostAP mailing list
> > > HostAP at shmoo.com
> > > http://lists.shmoo.com/mailman/listinfo/hostap
> > >
> >
> >
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060725/a80f2e6c/attachment.htm 


From jkmaline  Tue Jul 25 20:40:35 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 20:40:35 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <e873c8350607250858p2fd253e2o621dee3d1a78dc0a@mail.gmail.com>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
	<e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
	<20060725023055.GA9504@jm.kir.nu>
	<e873c8350607250624o3135808x3b68bb308ad3a232@mail.gmail.com>
	<e873c8350607250858p2fd253e2o621dee3d1a78dc0a@mail.gmail.com>
Message-ID: <20060726034034.GA9553@jm.kir.nu>

On Tue, Jul 25, 2006 at 08:58:57AM -0700, George S. Lockwood wrote:
> How does one determine the connection / authentication has been successfully
> achieved?

wpa_supplicant debug log shows following message in the end of a
successful authentication:

CTRL-EVENT-CONNECTED - Connection to <bssid> completed ...

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Jul 25 20:41:32 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 20:41:32 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <e873c8350607251426h22e876d1ybfca09a3f9f132ca@mail.gmail.com>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
	<e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
	<20060725023055.GA9504@jm.kir.nu>
	<e873c8350607250624o3135808x3b68bb308ad3a232@mail.gmail.com>
	<e873c8350607250858p2fd253e2o621dee3d1a78dc0a@mail.gmail.com>
	<e873c8350607251426h22e876d1ybfca09a3f9f132ca@mail.gmail.com>
Message-ID: <20060726034132.GB9553@jm.kir.nu>

On Tue, Jul 25, 2006 at 02:26:51PM -0700, George S. Lockwood wrote:
> One other thing re: the latest snapshot, is only difference in project
> settings or code as well?

If you are comparing it to the last release (0.5.4), there are changes
in both project file and number of areas in the source code.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Jul 25 20:46:25 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 20:46:25 -0700
Subject: Hostapd + WPA PEAP + Win XP SP2 supplicant
In-Reply-To: <20060725103314.ADC0228003B@smtp-out.completel.net>
References: <20060725103314.ADC0228003B@smtp-out.completel.net>
Message-ID: <20060726034625.GC9553@jm.kir.nu>

On Tue, Jul 25, 2006 at 12:31:33PM +0200, Vincent Maurin wrote:

> I have set up an access point WPA-PEAP TKIP.
> 
> I can connect with Intel PROSet supplicant, and Windows XP SP2 Supplicant.
> 
> But with the Windows one, the connection takes more than one minute, and
> during this minute,
> 
> the supplicant seems to do nothing and I get this kind of debug message from
> hostapd

Have you tried enabling tracing on the Microsoft supplicant in order to
get more information on what it could be doing? You can do this by
setting EnableFileTracing to 1 in WinXP registry key
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\EAPOL
and the log file will be written to %windir%\tracing\eapol.log. In
addition to EAPOL tracing, there are also other related tracing areas in
WinXP that could provide more information on what exactly is happening.
Based on your description, there is not much that could be observed
outside the supplicant, so taking a look at Windows tracing logs could
be the easiest way of learning more.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Jul 25 20:58:45 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 20:58:45 -0700
Subject: Having problem on wpa_supplicant with EAP-TTLS
In-Reply-To: <20060724140513.GA4211@efrei.fr>
References: <20060724140513.GA4211@efrei.fr>
Message-ID: <20060726035845.GD9553@jm.kir.nu>

On Mon, Jul 24, 2006 at 04:05:13PM +0200, Paul-Henri Gauzence de Lastours wrote:

> Here is the complete debug output for wpa-suplicant:

Which version of wpa_supplicant are you using?

> $ wpa_supplicant -ibr0 -cconf -dd
> Initializing interface 'br0' conf 'conf' driver 'default' ctrl_interface
> 'N/A'

Which interfaces are on that bridge interface? Which kernel version and
CPU are you using? Can you please send .config file used to build
wpa_supplicant?

> CTRL-EVENT-EAP-METHOD EAP method 21 (TTLS) selected
> EAP: EAP entering state METHOD
> SSL: Received packet(len=6) - Flags 0x20
> EAP-TTLS: Start

This line should be followed by OpenSSL generating ClientHello message..
Which version of OpenSSL are you using?

> EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
> EAP: EAP entering state SEND_RESPONSE
> EAP: EAP entering state IDLE

And this should be followed by EAPOL SUPP_BE state machine entering
RESPONSE state where the EAP-Response would be sent out.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Jul 25 21:00:04 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 21:00:04 -0700
Subject: mac based auth with radius problem!
In-Reply-To: <26b26d180607240432y3eb06b16mf48afbb620d9f393@mail.gmail.com>
References: <26b26d180607180346s74774cafi6007d7293633ca4c@mail.gmail.com>
	<20060722041834.GF9516@jm.kir.nu>
	<26b26d180607240432y3eb06b16mf48afbb620d9f393@mail.gmail.com>
Message-ID: <20060726040004.GE9553@jm.kir.nu>

On Mon, Jul 24, 2006 at 05:02:56PM +0530, saurav barik wrote:

> Moreover, if this is not supported by the madwifi driver, is it that i can
> never use a radius server with madwifi and hostapd, not even for wpa-eap.

The current version of hostapd does not support MAC ACL with an external
RADIUS server when using madwifi. There is no such limitation for using
RADIUS authentication with WPA/WPA2-Enterprise or IEEE 802.1X.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Jul 25 21:05:11 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 21:05:11 -0700
Subject: Is wifi0 (and not wlan0) in charge of the stablishing the queuing
	disciplines on the interface?
In-Reply-To: <44C0B5B2.1080507@ehas.org>
References: <44C0B5B2.1080507@ehas.org>
Message-ID: <20060726040511.GF9553@jm.kir.nu>

On Fri, Jul 21, 2006 at 01:08:34PM +0200, silvia lafuente wrote:

> So the question is, what is the role of the master interface wifi0? What is it in charge of? In the FAQ says, ignore wifi0 and use wlan0, but in 
> this case it didn't work that way for PRIO queuing.

Only the master interface has qdisc queues and you have identified one
of the exceptions where the master interface needs to be used instead of
wlan0.. wlan0 is just a virtual interface that sets it queue length to
zero and queues outgoing packets to the wifi0 queue. Because of this,
most queueing discipline configuration must be done on wifi0.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Jul 25 21:09:28 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 21:09:28 -0700
Subject: Really poor range in AP mode
In-Reply-To: <44BFF4D4.1060703@seiner.com>
References: <44BFF4D4.1060703@seiner.com>
Message-ID: <20060726040928.GG9553@jm.kir.nu>

On Thu, Jul 20, 2006 at 02:25:40PM -0700, Yan Seiner wrote:
> I am somewhat at a loss on how to proceed.   I have a hostap - driven 
> wifi card (linksys WCF12) which works OK, but its range is very poor. In 
> managed mode, the card has poor but acceptable range - say 10 -15', not 
> great, but OK for a handheld.  In AP mode, the range is really really 
> bad - it can be measured in feet, sometimes in inches.  Right now, I 
> have to have AP and client < 1' apart - even the width of a desktop will 
> cause the connection to fail.

This is the first time I've heard of such a difference in range. I don't
know whether the firmware would be doing something differently as far as
radio configuration is concerned between client and Host AP mode. Which
firmware version are you using? Are you setting any wireless parameters
with iwconfig/iwpriv? Do you have a wireless sniffer that would report
signal strength on the received frames? It could be useful to compare
the signal strength of the frames send by the device that is using Host
AP driver when in Host AP and client modes.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Jul 25 21:25:19 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 21:25:19 -0700
Subject: problems connecting to AP using WPA-PSK, Linux 2.6.16,
	ipw2200 card (wext driver)
In-Reply-To: <e499a45b0607191324m443937eeic21f276e4955b31c@mail.gmail.com>
References: <e499a45b0607181041l253f7f3v16493bd8a91d352e@mail.gmail.com>
	<e499a45b0607181149j53b5f624ue9e83546d37a2d1c@mail.gmail.com>
	<e499a45b0607191324m443937eeic21f276e4955b31c@mail.gmail.com>
Message-ID: <20060726042519.GH9553@jm.kir.nu>

On Wed, Jul 19, 2006 at 01:24:54PM -0700, Ivan Tarasov wrote:

> I've got persistent problems with using wpa_supplicant to connect to an AP
> with WPA authentication. I did an extensive search on mailing lists and
> Internet in general and didn't find any solution, although I've seen a lot
> of reports of similar problems.
> 
> /etc/wpa_supplicant.conf contents is somewhat like this:
> 
> # the following 3 lines were changed and this configuration was the most
> stable
> eapol_version=1
> ap_scan=2

The debug log was not using ap_scan=2. Could you please send another
debug log with ap_scan=2 and the exact matching configuration file for
that log?

> fast_reauth=2
> network={
>    ssid="somessid"
>    scan_ssid=1

scan_ssid=1 should not be used when ap_scan=2.

>    key_mgmt=WPA-PSK
>    proto=WPA
>    pairwise=TKIP
>    group=TKIP
>    psk="somepassword"
> }

Otherwise the configuration looks fine.

> You can find the wpa_supplicant log here:
> http://mediacast.sun.com/share/tarasov/supplicant.log.gz
> I tried to send it as an attach but my messeges never got through some
> filter on the way to the mailing list.

In addition to setting ap_scan=2, could you please add -t to the command
line in order to add time stamps to the debug log? I would like to see
this from wpa_supplicant 0.5.4.

I've been using wpa_supplicant with Intel ipw2915 (using the same driver
as IPW2200 would use) with quite stable results when using Linux 2.6.16.
2.6.15 had major problems in getting anything to work with Cisco APs,
but with 2.6.16, most of those issues seemed to go away. There is one
issue in the first EAPOL frame being sent out before the interface is
set with carrier(?) enabled. My current assumption is that this is a
driver issue, but I have not yet had chance to debug it in more detail.
I have a workaround for this (sleep two seconds before transmitting the
first EAPOL packet), but this should of course fixed in more proper way.
Anyway, the debug log you sent did not seem to have similar issue.

> You might be interested looking at the following lines more thoroughly:
> lines 840-965: wpa_supplicant started authenticating, but suddenly received
> the 0x8b15 during the 4WAY_HANDSHAKE, which it considered to be the sign of
> a wrong password, thus it got disconnected.
> lines 1142-1261: same as above, but it passed the 4WAY_HANDSHAKE and
> received the 0x8b15 event with zero AP address during the GROUP_HANDSHAKE.
> lines 1855-2035: successful connection, I was able to work for some time and
> everything worked fine until it received the 0x8b15 event with zero AP
> address again.

This sounds somewhat similar to what I saw with Linux 2.6.15.. I would
guess that something is timing out and the AP ends up disconnecting the
client. I did not bother debugging this more since 2.6.16 is working in
my setup. You might ask this question on the ipw2200 driver mailing
lists since this sounds like something that is more related to the
driver than wpa_supplicant.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Jul 25 21:39:45 2006
From: jkmaline (Jouni Malinen)
Date: Tue, 25 Jul 2006 21:39:45 -0700
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <1152227891.16115.12.camel@dv>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<44AD8E1B.6040100@pcuf.fi> <1152227891.16115.12.camel@dv>
Message-ID: <20060726043945.GI9553@jm.kir.nu>

On Thu, Jul 06, 2006 at 07:18:11PM -0400, Pavel Roskin wrote:
> On Fri, 2006-07-07 at 01:26 +0300, Jar wrote:
> > For some reason if you run make with 2.6.17 kernel all files in 
> > /driver/modules directory are _deleted_.
> 
> That's the consequence of the "finger of death" patch by Sam Ravnborg.
> It used to be even worse in 2.6.17 pre-releases, when the modules
> directory would be deleted as well.

Great..

> > But if do the following change 
> > to the Makefile:
> > 
> > -       $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules \
> > -               MODVERDIR=$(PWD)/driver/modules modules
> > +       $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules

Is that removing 'modules' target on purpose? Is that really supposed to
work?

> > The files are not deleted and the compiling starts and at this point you 
> > can see the messages:
> > 
> > #error Host AP driver was added into Linux 2.6.14.
> > #error The version used in the kernel tree should be used instead of this
> > #error external release which is only maintained for old kernel versions.
> 
> That makes sense.  Defining MODVERDIR was done primarily for cosmetic
> reasons to avoid having .tmp_versions directory.  Now that MODVERDIR is
> a death sentence to the directory it points to, your patch would be
> helpful.

I don't know whether making a new release of the external driver would
really help much with this. If people are still trying to use the
external driver tree even though the driver has been in the kernel tree
for quite some time, I would be willing to just give up and let them be
bitten with this kind of issues if kernel makefiles are being modified
to destroy files.. To be honest, I don't really have much interest in
making external releases anymore unless a critical issue is found in the
0.4.7 code.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jar  Wed Jul 26 01:58:04 2006
From: jar (Jar)
Date: Wed, 26 Jul 2006 11:58:04 +0300 (EEST)
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <20060726043945.GI9553@jm.kir.nu>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<44AD8E1B.6040100@pcuf.fi> <1152227891.16115.12.camel@dv>
	<20060726043945.GI9553@jm.kir.nu>
Message-ID: <1099.62.148.193.28.1153904284.squirrel@netlandzone.dyndns.org>


>> > But if do the following change
>> > to the Makefile:
>> >
>> > -       $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules \
>> > -               MODVERDIR=$(PWD)/driver/modules modules
>> > +       $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules
>
> Is that removing 'modules' target on purpose? Is that really supposed to
> work?

It was removed by mistake. But seem to compile at the same way with or without->

$(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules
or
$(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules modules


-- 
Best Regards, Jar



From saurav.barik  Wed Jul 26 02:35:41 2006
From: saurav.barik (saurav barik)
Date: Wed, 26 Jul 2006 15:05:41 +0530
Subject: mac based auth with radius problem!
In-Reply-To: <20060726040004.GE9553@jm.kir.nu>
References: <26b26d180607180346s74774cafi6007d7293633ca4c@mail.gmail.com>
	<20060722041834.GF9516@jm.kir.nu>
	<26b26d180607240432y3eb06b16mf48afbb620d9f393@mail.gmail.com>
	<20060726040004.GE9553@jm.kir.nu>
Message-ID: <26b26d180607260235oe9659c7h64a15d10a755026f@mail.gmail.com>

*Malinen,*

*
Thanks for the inputs.*

*
*

*We desperately need Mac based authentication (Mac ACL) at RADIUS server. *

*
*

*I'm just wondering if any old version of Hostapd has a support to the
feature. Hope you can help us by disclosing the MAC ACL supported Hostapd
release.*

*
*

*I failed to locate the release notes for past releases.*

*
*

*Thanks once again,*

*
*

*Rgds,
Saurav
*


On 7/26/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Mon, Jul 24, 2006 at 05:02:56PM +0530, saurav barik wrote:
>
> > Moreover, if this is not supported by the madwifi driver, is it that i
> can
> > never use a radius server with madwifi and hostapd, not even for
> wpa-eap.
>
> The current version of hostapd does not support MAC ACL with an external
> RADIUS server when using madwifi. There is no such limitation for using
> RADIUS authentication with WPA/WPA2-Enterprise or IEEE 802.1X.
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060726/0b8ed695/attachment.htm 


From jkmaline  Wed Jul 26 06:33:34 2006
From: jkmaline (Jouni Malinen)
Date: Wed, 26 Jul 2006 06:33:34 -0700
Subject: mac based auth with radius problem!
In-Reply-To: <26b26d180607260235oe9659c7h64a15d10a755026f@mail.gmail.com>
References: <26b26d180607180346s74774cafi6007d7293633ca4c@mail.gmail.com>
	<20060722041834.GF9516@jm.kir.nu>
	<26b26d180607240432y3eb06b16mf48afbb620d9f393@mail.gmail.com>
	<20060726040004.GE9553@jm.kir.nu>
	<26b26d180607260235oe9659c7h64a15d10a755026f@mail.gmail.com>
Message-ID: <20060726133334.GA9533@jm.kir.nu>

On Wed, Jul 26, 2006 at 03:05:41PM +0530, saurav barik wrote:

> *We desperately need Mac based authentication (Mac ACL) at RADIUS server. *

> *I'm just wondering if any old version of Hostapd has a support to the
> feature. Hope you can help us by disclosing the MAC ACL supported Hostapd
> release.*

MAC ACL works with the Host AP driver, but it has not been implemented
for madwifi.

-- 
Jouni Malinen                                            PGP id EFC895FA



From gauzence  Wed Jul 26 07:48:41 2006
From: gauzence (Paul-Henri Gauzence de Lastours)
Date: Wed, 26 Jul 2006 16:48:41 +0200
Subject: Having problem on wpa_supplicant with EAP-TTLS
Message-ID: <9b3ba1bb0607260748o21e090d5y39a1ef62a956da71@mail.gmail.com>

Hi Jouni,

I'm using wpa_supplicant-0.4.8.
On the bridge on which I'm working, there are two ethernet interfaces. I
think the problem doesn't come from the bridge, because as I said in a
previous post, everything is working fine with an MD5 authentication.
The version of OpenSSL is 0.9.7j, the latest for branch 0-9-7 (4th may
2006), and I'm working on ARM9 with a 2.6.10 kernel.
According to what you say, the problem should come from OpenSSL, so I'm
gonna have a look on it.


Here's the content of .config file (only the uncommented lines, all others
are set to default):

# Driver interface for wired Ethernet drivers
CONFIG_DRIVER_WIRED=y

# Enable IEEE 802.1X Supplicant (automatically included if any EAP method is
# included)
CONFIG_IEEE8021X_EAPOL=y

# EAP-MD5 (automatically included if EAP-TTLS is enabled)
CONFIG_EAP_MD5=y

# EAP-MSCHAPv2 (automatically included if EAP-PEAP is enabled)
CONFIG_EAP_MSCHAPV2=y

# EAP-TTLS
CONFIG_EAP_TTLS=y

# Include control interface for external programs, e.g, wpa_cli
CONFIG_CTRL_IFACE=y

# Select configuration backend:
# file = text file (e.g., wpa_supplicant.conf)
CONFIG_BACKEND=file





On 26/07/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Mon, Jul 24, 2006 at 04:05:13PM +0200, Paul-Henri Gauzence de Lastours
> wrote:
>
> > Here is the complete debug output for wpa-suplicant:
>
> Which version of wpa_supplicant are you using?
>
> > $ wpa_supplicant -ibr0 -cconf -dd
> > Initializing interface 'br0' conf 'conf' driver 'default' ctrl_interface
> > 'N/A'
>
> Which interfaces are on that bridge interface? Which kernel version and
> CPU are you using? Can you please send .config file used to build
> wpa_supplicant?
>
> > CTRL-EVENT-EAP-METHOD EAP method 21 (TTLS) selected
> > EAP: EAP entering state METHOD
> > SSL: Received packet(len=6) - Flags 0x20
> > EAP-TTLS: Start
>
> This line should be followed by OpenSSL generating ClientHello message..
> Which version of OpenSSL are you using?
>
> > EAP: method process -> ignore=FALSE methodState=MAY_CONT decision=FAIL
> > EAP: EAP entering state SEND_RESPONSE
> > EAP: EAP entering state IDLE
>
> And this should be followed by EAPOL SUPP_BE state machine entering
> RESPONSE state where the EAP-Response would be sent out.
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060726/94d01fb1/attachment.htm 


From anupamabiswas  Thu Jul 27 02:55:37 2006
From: anupamabiswas (anupama biswas)
Date: Thu, 27 Jul 2006 02:55:37 -0700 (PDT)
Subject: not able to connect linux lclient to windows radius server
Message-ID: <20060727095537.79961.qmail@web8401.mail.in.yahoo.com>

hi,
 
 I am trying to connect my wireless FC2 system to Radius Server(Windows 2003 Server) using wpa_supplicant. The authentication type is PEAP-MSCHAPv2.
 
 Following is the entry in the .etc/wpa1.conf file.
 
 network={
     ssid="example"
     key_mgmt=IEEE8021X
     eap=PEAP
     identity="anupama at example.com"
     password="fruit1"
     ca_cert="/etc/cert/linux_wireless.pem"
     phase2="auth=MSCHAPV2"
 }
 
 
 The certificate is generated in Radius Server and ported to the Linux cleint in the specified location.
 
 I started the supplicant :
 
 ./wpa_supplicant -D ipw -c /etc/wpa_supplicant.conf -i wlan0
 I also started the ethereal at my wireless interface to capture any EAP packets
 And used ./wlan0dhcp to get the IP fro the AP
 
 The AP supports 802.1x protocol and the RADIUS Server IP is sepcified.
 
 But still I am not able to connect to the Server
 Also no packets are captured at the Wireless Interface.
 
 Can someone please help me.
 
 Thanks,
 Anupama
 
 
 		
---------------------------------
Do you Yahoo!?
 Next-gen email? Have it all with the  all-new Yahoo! Mail Beta.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060727/da7810c7/attachment.htm 


From alec.waters  Thu Jul 27 04:31:08 2006
From: alec.waters (Alec Waters)
Date: Thu, 27 Jul 2006 12:31:08 +0100
Subject: ioctl[PRISM2_IOCTL_HOSTAPD]: Connection timed out - Could not
	communicate with the kernel driver.
Message-ID: <44C8A3FC.7020501@dataline.co.uk>

Hi all,

I'm trying to get hostap working on the gumstix platform 
(www.gumstix.com). It's running kernel 2.6.17, with the kernel hostap 
driver. I'm using a DLink DCF 660W CF WiFi card.

I think there's something pretty fundamental going wrong here. It's most 
likely the grey stuff between my ears, but on the off-chance it's not, 
here's what I'm seeing.

At boot:

pccard: PCMCIA card inserted into slot 0
pcmcia: registering new device pcmcia0.0
hostap_cs: 0.4.4-kernel (Jouni Malinen <jkmaline at cc.hut.fi>)
hostap_cs: Registered netdevice wifi0
hostap_cs: index 0x01: , irq 49, io 0xc4860000-0xc486003f
wifi0: NIC: id=0x800c v1.0.0
wifi0: PRI: id=0x15 v1.0.7
wifi0: STA: id=0x1f v1.3.6

So far, so good.

Trying to do "hostap" stuff results in:

# hostap_diag wlan0
Host AP driver diagnostics information for 'wlan0'

ioctl[PRISM2_IOCTL_HOSTAPD]: Connection timed out
Could not communicate with the kernel driver.

OK. Let's try to flash the card with newer firmware:

# prism2_srec -p -r wlan0 rf010800.hex
srec summary for rf010800.hex
Included file name: RF010800.hex
Component: 0x001f 1.8.0 (station firmware)

ioctl[PRISM2_IOCTL_HOSTAPD]: Connection timed out
Missing wlan component info
Could not read wlan RIDs

Oh dear. Let's try something else:

# iwconfig wlan0 essid alec
hostap_cs: wlan0: resetting card
hostap_cs: first command failed - assuming card does not have primary 
firmware
hostap_cs: first command failed - assuming card does not have primary 
firmware
wlan0: prism2_enable_aux_port - timeout - reg=0x8010
wlan0: prism2_enable_aux_port - timeout - reg=0x8002
hostap_cs: Initialization failed
Error for wireless request "Set ESSID" (8B1A) :
     SET failed on device wlan0 ; Invalid argument.

Let's try some pcmcia things:

# pccardctl ls
Socket 0 Bridge:        [pxa2xx-pcmcia]         (bus ID: pxa2xx-pcmcia)
Socket 0 Device 0:      [hostap_cs]             (bus ID: 0.0)
# pccardctl info
PRODID_1="D-Link"
PRODID_2="DCF-660W"
PRODID_3=""
PRODID_4=""
MANFID=d601,0005
FUNCID=6
# pccardctl status
Socket 0:
   5.0V 16-bit PC Card
   Subdevice 0 (function 0) bound to driver "hostap_cs"
# pccardctl ident
Socket 0:
   product info: "D-Link", "DCF-660W", "", ""
   manfid: 0xd601, 0x0005
   function: 6 (network)

So far, so good.

# pccardctl reset
cs: pcmcia_socket0: time out after reset.
remove_proc_entry: hostap/wlan0 busy, count=1

This doesn't look good.

# pccardctl suspend
# pccardctl resume
# pccardctl ls
Socket 0 Bridge:        [pxa2xx-pcmcia]         (bus ID: pxa2xx-pcmcia)
cs: pcmcia_socket0: time out after reset.

Nor does this!

And there's loads of this kind of stuff in dmesg:

wlan0: hfa384x_get_rid: CMDCODE_ACCESS failed (res=-110, rid=fc84, len=2)
wlan0: hfa384x_cmd_issue: cmd reg was busy for 5000 usec
wlan0: hfa384x_cmd_issue - timeout - reg=0x8021
wlan0: hfa384x_cmd: entry still in list? (entry=c39a4988, type=0, res=-1)
wlan0: hfa384x_cmd: interrupted; err=-110

...listed for both wlan0 and wifi0.

Am really stuck. Any help or pointers would be most gratefully received!

many thanks,
alec
-- 
Alec Waters CCNP
Dataline Software Ltd
Clarence House, 30-31 North Street, Brighton, BN1 1EB, UK

Tel: +44 (0)1273 324939
Fax: +44 (0)1273 205576
www: http://www.dataline.co.uk
IPv6: http://www.ipv6.dataline.co.uk





From jkmaline  Thu Jul 27 06:44:03 2006
From: jkmaline (Jouni Malinen)
Date: Thu, 27 Jul 2006 06:44:03 -0700
Subject: not able to connect linux lclient to windows radius server
In-Reply-To: <20060727095537.79961.qmail@web8401.mail.in.yahoo.com>
References: <20060727095537.79961.qmail@web8401.mail.in.yahoo.com>
Message-ID: <20060727134403.GA9526@jm.kir.nu>

On Thu, Jul 27, 2006 at 02:55:37AM -0700, anupama biswas wrote:

>  I am trying to connect my wireless FC2 system to Radius Server(Windows 2003 Server) using wpa_supplicant. The authentication type is PEAP-MSCHAPv2.

>  I started the supplicant :
>  
>  ./wpa_supplicant -D ipw -c /etc/wpa_supplicant.conf -i wlan0
>  I also started the ethereal at my wireless interface to capture any EAP packets

>  But still I am not able to connect to the Server
>  Also no packets are captured at the Wireless Interface.

Please add -dd to the wpa_supplicant command line to get verbose debug
information and see if that gives enough details to figure out what is
happening. If the debug output is not clear enough, please send it here
and I'll take a closer look at what could be happening.

-- 
Jouni Malinen                                            PGP id EFC895FA



From proski  Thu Jul 27 15:20:10 2006
From: proski (Pavel Roskin)
Date: Thu, 27 Jul 2006 18:20:10 -0400
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <20060726043945.GI9553@jm.kir.nu>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<44AD8E1B.6040100@pcuf.fi> <1152227891.16115.12.camel@dv>
	<20060726043945.GI9553@jm.kir.nu>
Message-ID: <1154038810.2073.17.camel@dv>

Hi Jouni,

On Tue, 2006-07-25 at 21:39 -0700, Jouni Malinen wrote:
> Is that removing 'modules' target on purpose? Is that really supposed to
> work?

No, it's an artifact of quoting.  What's needed is to remove MODVERDIR.

> I don't know whether making a new release of the external driver would
> really help much with this. If people are still trying to use the
> external driver tree even though the driver has been in the kernel tree
> for quite some time, I would be willing to just give up and let them be
> bitten with this kind of issues if kernel makefiles are being modified
> to destroy files.. To be honest, I don't really have much interest in
> making external releases anymore unless a critical issue is found in the
> 0.4.7 code.

Which PCMCIA API changing radically almost in every new kernel,
releasing another external release would be a problem even if a critical
issue _is_ found.  Either you include PCMCIA drivers for several recent
2.6 kernels and 2.4.x (good luck), or you'll get tons of complaints that
the new driver doesn't compile.

I think the easiest approach would be to drop 2.6 support from the CVS
hostap driver and move all driver-related stuff from
http://hostap.epitest.fi/ to a separate page with a big warning that
standalone hostap should only be used with 2.6 kernels.  Just write that
the driver tends to be suicidal on 2.6 kernels :-)

Once it's done, you can release critical fixes for 2.4 kernels and send
patches to the netdev folks for 2.6.x and 2.6.x.y series.

-- 
Regards,
Pavel Roskin





From jkmaline  Thu Jul 27 19:06:24 2006
From: jkmaline (Jouni Malinen)
Date: Thu, 27 Jul 2006 19:06:24 -0700
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <1154038810.2073.17.camel@dv>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<44AD8E1B.6040100@pcuf.fi> <1152227891.16115.12.camel@dv>
	<20060726043945.GI9553@jm.kir.nu> <1154038810.2073.17.camel@dv>
Message-ID: <20060728020624.GA9516@jm.kir.nu>

On Thu, Jul 27, 2006 at 06:20:10PM -0400, Pavel Roskin wrote:

> Which PCMCIA API changing radically almost in every new kernel,
> releasing another external release would be a problem even if a critical
> issue _is_ found.  Either you include PCMCIA drivers for several recent
> 2.6 kernels and 2.4.x (good luck), or you'll get tons of complaints that
> the new driver doesn't compile.
> 
> I think the easiest approach would be to drop 2.6 support from the CVS
> hostap driver and move all driver-related stuff from
> http://hostap.epitest.fi/ to a separate page with a big warning that
> standalone hostap should only be used with 2.6 kernels.  Just write that
> the driver tends to be suicidal on 2.6 kernels :-)

That's already more or less the case. The external tree refuses to build
on Linux 2.6.14 or newer due to following lines in source code:

#if (LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,14))
#error Host AP driver was added into Linux 2.6.14.
#error The version used in the kernel tree should be used instead of this
#error external release which is only maintained for old kernel versions.
#endif


Unfortunately, it looks like 2.6.17 makes this text disappear from the
build output due to the changes in kernel makefiles. Anyway, same
information is also in the README file and on the web page. Sure, it
could be made even more explicit by hiding the driver pages etc., but I
don't think it's worth the effort at least before the next release is
needed (if that will ever happen).

-- 
Jouni Malinen                                            PGP id EFC895FA



From ben.alb  Fri Jul 28 04:20:42 2006
From: ben.alb (=?iso-8859-1?B?QmVub+50IEFMQkVSVA==?=)
Date: Fri, 28 Jul 2006 13:20:42 +0200
Subject: WPA_Supplicant with EAP-TLS under Windows
Message-ID: <BAY117-F3639CFA6C506511741D5AB92590@phx.gbl>

I try to configure wpa_supplicant to connect to a network that use 802.1x 
and dynamic WEP under windows 2000.
I don't find how to define the certificate I want to use (This one is stored 
in windows registry and not in one or several files).

_________________________________________________________________
Retrouvez tout en un clin d'?il avec Windows Desktop Search ! 
http://desktop.msn.fr/




From gslockwood  Fri Jul 28 06:44:54 2006
From: gslockwood (George S. Lockwood)
Date: Fri, 28 Jul 2006 06:44:54 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <20060726034132.GB9553@jm.kir.nu>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
	<e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
	<20060725023055.GA9504@jm.kir.nu>
	<e873c8350607250624o3135808x3b68bb308ad3a232@mail.gmail.com>
	<e873c8350607250858p2fd253e2o621dee3d1a78dc0a@mail.gmail.com>
	<e873c8350607251426h22e876d1ybfca09a3f9f132ca@mail.gmail.com>
	<20060726034132.GB9553@jm.kir.nu>
Message-ID: <e873c8350607280644w19e60832y9b5356e78abad180@mail.gmail.com>

Many Thanks, Jouni, the VS2005 Release works very well!

I'd like to open a thread on Roaming.  How do I do that?

Or I'll state it here as well:

I'm very interested in the ability to ROAM.  I must understand the technical
aspects better and I'm gathering info on it now (any advice / comments you
might like to share will be warmly welcomed, Jouni).

I see the term "roaming" about 3 times in the wpa_supplicant literature;
either in the list of features or the todo list.  And I'm not really sure
whether this great product presently can handle a roaming wifi unit as is
today or if it needs enhancement or if roaming is out of the scope of the
product.

Could you (or another expert) clear this up for me?

Scenario:  a user uses a wifi client app based upon wpa_supplicant
(7-22-2006) to make the initial connection and authenticate to a network.
That network has many SSIDs covering a geographic area.  Every SSID has the
same name, but of course a unique MAC address.  the User then roams.  As
they move the signal strength of the original SSID they connected to weakens
in comparison to the other SSIDs of the network.

In my view the strongest signal should (always) be used by the users wifi.
So some sort of hand-off must take place.

How would this take place? Must there be a SSID disconnect and then
re-connect (to that SSID with the best signal -that the wifi client software
peforms?

Or is it the networks that handles all of this??


thanks so much and hope you enjoy the question,

george

On 7/25/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Tue, Jul 25, 2006 at 02:26:51PM -0700, George S. Lockwood wrote:
> > One other thing re: the latest snapshot, is only difference in project
> > settings or code as well?
>
> If you are comparing it to the last release (0.5.4), there are changes
> in both project file and number of areas in the source code.
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060728/0cffb38c/attachment.htm 


From mistamaila  Fri Jul 28 12:30:23 2006
From: mistamaila (John H.)
Date: Fri, 28 Jul 2006 14:30:23 -0500
Subject: how to use wpa_supplicant on wpa network with peap and
	credentialing
In-Reply-To: <20060724035808.44731.qmail@web35811.mail.mud.yahoo.com>
References: <5b9417770607220147y2df3295bu5dbfbf4b242023bb@mail.gmail.com>
	<20060724035808.44731.qmail@web35811.mail.mud.yahoo.com>
Message-ID: <5b9417770607281230j6e36e5d7mb7bbe9e3957bd950@mail.gmail.com>

no go, it won't work:(
attached is the debug information, and i replaced my school's ssid
with myssid and my username with myusername

here is what i had to do in windows to get it working
wpa
tkip

in authentication, change eap type to to peap and click on properties
uncheck validate server cert, change select auth method to secured
pass(eap-mschap v2) and check enable fast reconnect

click configure on select auth method, and uncheck automatically use
my windows logon name and password


i then connected, but i specified nothing for domain, only something
for user and password.



On 7/23/06, Ambedkar R <ambedkar_r at yahoo.com> wrote:
> Your configuration file is correct now.
>
>
> "John H." <mistamaila at gmail.com> wrote:
>
> so is this good?
>
>
> network={
> ssid="ssid"
> key_mgmt=WPA-EAP
> pairwise=TKIP
> group=TKIP
> scan_ssid=1
> eap=PEAP
> identity="user"
> password="pass"
> # ca_cert="/etc/cert/ca.pem"
> phase1="peaplabel=1"
> phase2="auth=MSCHAPV2"
> }
>
>
> On 7/22/06, Ambedkar R wrote:
> >
> > Your configuration file seems little wrong,you cant use it for connecting
> > supplicant with AP.One thing you should understand which is either you are
> > going to use WPA-Personal or WPA-Enterprise.If WPA-Personal comes there is
> > no requirement for username and password you should use only
> Passphrase(Here
> > supplicant authenticated by AP).If WPA-Enterprise comes you need to use
> > username,password and certificates(In this case supplicant autheticated by
> > RADIUS server,it may be mutual authetication or only client authetication)
> >
> > When you authenticating your supplicant with RADIUS,just you make small
> > change in your configuration file at 4 th line,it should
> > be:"key_mgmt=WPA-EAP".And also you should include phase 2 authetication.
> >
> > Regards
> >
> > Ambedkar.R
> >
> > "John H." wrote:
> >
> > hmm, i did as i thought i was told to do, but it caused an error in my
> > config file and not until i commented out the entry could i use
> > wpa_supplicant for other networks. here is what i had
> >
> > #network={
> > # ssid="schoolssid"
> > # proto=WPA
> > # key_mgmt=WPA-PSK
> > # pairwise=TKIP
> > # group=TKIP
> > # scan_ssid=1
> > # eap=PEAP
> > # identity="username"
> > # password="password"
> > #}
> >
> >
> > On 7/17/06, Andrew Barr wrote:
> > > On Monday 17 July 2006 17:00, John H. wrote:
> > > > sorry, certificates, that's the word they used. would i need to do
> > > > anything for that?
> > >
> > > Well, for PEAP the usual setup is to validate the server certificate to
> > > prevent rogue APs and password stealing and the like. You don't HAVE to
> do
> > > it, and in the case of my university they don't provide a public key
> > > certificate so I can't (although I understand it might be possible to
> > capture
> > > it out of the authentication stream). You can ignore the certificate (if
> > it
> > > is just a server cert validation like I described above), or you can
> > provide
> > > a certificate public key file (see the documentation for acceptable
> > formats)
> > > to wpa_supplicant. There is an example configuration file distributed
> with
> > > wpa_supplicant that should have the exact parameter name in it.
> > >
> > > --
> > > Andrew Barr | http://www.oakcourt.dyndns.org/~andrew/ |
> > GPG: 0xAD9AE76A
> > > "Those who would trade liberty for security deserve neither." -- B.
> > Franklin
> > >
> > _______________________________________________
> > HostAP mailing list
> > HostAP at shmoo.com
> > http://lists.shmoo.com/mailman/listinfo/hostap
> >
> >
> >
> >
> > ________________________________
> > Do you Yahoo!?
> > Next-gen email? Have it all with the all-new Yahoo! Mail Beta.
> >
> >
>
>
>
>
>  ________________________________
> How low will we go? Check out Yahoo! Messenger's low PC-to-Phone call rates.
>
>



From RGovindarao  Fri Jul 28 13:55:13 2006
From: RGovindarao (Ravi Govindarao)
Date: Fri, 28 Jul 2006 16:55:13 -0400
Subject: pae module from Gunter... problems
Message-ID: <60C9D8B49C2C71459874A1F4F5DEE807021A0030@alfalfa.fortresstech.com>

Hi,

Can one of you please email me the pae module. The below link is not
valid anymore. Also David were U able to get this up and running with
2.6 kernel?
I am in the process of making our 8 port switch which is part of an
access device as 802.1x  authenticator. Our device runs with 2.6.13
kernel so your help is appreciated.
http://www.informatik.uni-rostock.de/~gbur/pae/pae-0.0.2.tar.gz
<http://www.informatik.uni-rostock.de/%7Egbur/pae/pae-0.0.2.tar.gz> 
Thanks,
Ravi..

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20060728/04c8874b/attachment.htm 


From ramalhais  Fri Jul 28 15:23:19 2006
From: ramalhais (Pedro Ramalhais)
Date: Fri, 28 Jul 2006 23:23:19 +0100
Subject: pae module from Gunter... problems
In-Reply-To: <60C9D8B49C2C71459874A1F4F5DEE807021A0030@alfalfa.fortresstech.com>
References: <60C9D8B49C2C71459874A1F4F5DEE807021A0030@alfalfa.fortresstech.com>
Message-ID: <44CA8E57.6080602@serrado.net>

Ravi Govindarao wrote:
> Hi,
> 
> Can one of you please email me the pae module. The below link is not valid anymore. Also David were U able to get this up and running with 2.6 kernel?
> 
> I am in the process of making our 8 port switch which is part of an access device as 802.1x  authenticator. Our device runs with 2.6.13 kernel so your help is appreciated.
> 
> http://www.informatik.uni-rostock.de/~gbur/pae/pae-0.0.2.tar.gz <http://www.informatik.uni-rostock.de/%7Egbur/pae/pae-0.0.2.tar.gz>
> 
> Thanks,
> 
> Ravi..

sourceforge project named "port authentication entity":
http://sourceforge.net/projects/pae

-- 
Pedro Ramalhais



From oshogg  Fri Jul 28 19:33:24 2006
From: oshogg (Osho GG)
Date: Fri, 28 Jul 2006 19:33:24 -0700
Subject: question about network configuration in wpa_supplicant.conf
Message-ID: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>

Hi,

I have configured a network in wpa_supplicant.conf as follows:

network={
        ssid="MyPrivateNetwork"
        scan_ssid=1
        key_mgmt=WPA-EAP
        identity="oshogg"
        password="mypassword"
}

Now, this works great. I can connect to the network fine. My only
problem is that I have my password in plain text in a configuration
file. Unfortunately, I do not have administrative privileges for
configuring the access point and authentication mechanism it uses. Is
there any way I can create a configuration (similar to wpa_passphrase
for psk) that does not require storing the password in plain text?

thanks,
Osho



From ulovecutesun  Fri Jul 28 22:10:12 2006
From: ulovecutesun (Sun)
Date: Sat, 29 Jul 2006 01:10:12 -0400
Subject: does hostap/hostapd work with linksys WPC11 v.4?
Message-ID: <op.tdfpzahns31rc3@sraker.hsd1.nh.comcast.net>

Hello all,
I know xpc11 v2/3/5 is based on prism chipsetm, those must be worked with  
hostapd.
However, I'm wondering hostap/hostapd works with linksys WPC11 v.4?
Anyone achieve to work?

--
Thanks,
Sun



From jkmaline  Sat Jul 29 16:54:23 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 16:54:23 -0700
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
Message-ID: <20060729235422.GA9496@jm.kir.nu>

On Fri, Jul 28, 2006 at 07:33:24PM -0700, Osho GG wrote:
> I have configured a network in wpa_supplicant.conf as follows:
>         identity="oshogg"
>         password="mypassword"

> Now, this works great. I can connect to the network fine. My only
> problem is that I have my password in plain text in a configuration
> file. Unfortunately, I do not have administrative privileges for
> configuring the access point and authentication mechanism it uses. Is
> there any way I can create a configuration (similar to wpa_passphrase
> for psk) that does not require storing the password in plain text?

If you leave out that password line from the configuration,
wpa_supplicant will request the password over the control interface
(e.g., from wpa_cli or wpa_gui).

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Jul 29 18:12:57 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 18:12:57 -0700
Subject: Building a Visual Studio Release wpa_supplicant.exe 0.5.4 (for
	Windows)
In-Reply-To: <e873c8350607280644w19e60832y9b5356e78abad180@mail.gmail.com>
References: <e873c8350607180743k3f531584j7b064f8baac73e9a@mail.gmail.com>
	<20060722183556.GA9537@jm.kir.nu>
	<e873c8350607240652v1882d1a0v5879b07a2a41da78@mail.gmail.com>
	<e873c8350607240935w4a874a2fk30c1b6fda1265451@mail.gmail.com>
	<20060725023055.GA9504@jm.kir.nu>
	<e873c8350607250624o3135808x3b68bb308ad3a232@mail.gmail.com>
	<e873c8350607250858p2fd253e2o621dee3d1a78dc0a@mail.gmail.com>
	<e873c8350607251426h22e876d1ybfca09a3f9f132ca@mail.gmail.com>
	<20060726034132.GB9553@jm.kir.nu>
	<e873c8350607280644w19e60832y9b5356e78abad180@mail.gmail.com>
Message-ID: <20060730011257.GB9496@jm.kir.nu>

On Fri, Jul 28, 2006 at 06:44:54AM -0700, George S. Lockwood wrote:

> I'd like to open a thread on Roaming.  How do I do that?

I'm not sure I understood what you mean.. If this is refering to threads
on the mailing list, that would be done by just sending another message
to the list without replying to an existing message. Just make sure that
you are sending it from the address that you used when subscribing to
the list.

> I see the term "roaming" about 3 times in the wpa_supplicant literature;
> either in the list of features or the todo list.  And I'm not really sure
> whether this great product presently can handle a roaming wifi unit as is
> today or if it needs enhancement or if roaming is out of the scope of the
> product.

It depends on your needs and the driver you are using..

> Scenario:  a user uses a wifi client app based upon wpa_supplicant
> (7-22-2006) to make the initial connection and authenticate to a network.
> That network has many SSIDs covering a geographic area.  Every SSID has the
> same name, but of course a unique MAC address.  the User then roams.  As
> they move the signal strength of the original SSID they connected to weakens
> in comparison to the other SSIDs of the network.

This paragraph is somewhat confusing.. This seems to talk about SSIDs in
plural, but I think that you are actually talking about just one SSID
and multiple BSSes, i.e., multiple access points sharing the same SSID.

> In my view the strongest signal should (always) be used by the users wifi.
> So some sort of hand-off must take place.

Well, with some hysteresis added to avoid jumping between the APs too
frequently, I would agree with this.

> How would this take place? Must there be a SSID disconnect and then
> re-connect (to that SSID with the best signal -that the wifi client software
> peforms?

If you are talking about Windows NDIS drivers, the most common way of
doing this would be to allow the driver take care of AP selection. In
case of wpa_supplicant, that would mean using ap_scan=2 mode. In this
mode, wpa_supplicant is only configuring the SSID for the driver and the
driver will decide when to roam to another AP based on its internal
implementation. All re-associations are signaled to wpa_supplicant as
new connections, but there is no disconnection assuming the client
remains in the coverage area of at least one AP all the time.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Jul 29 18:15:35 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 18:15:35 -0700
Subject: WPA_Supplicant with EAP-TLS under Windows
In-Reply-To: <BAY117-F3639CFA6C506511741D5AB92590@phx.gbl>
References: <BAY117-F3639CFA6C506511741D5AB92590@phx.gbl>
Message-ID: <20060730011535.GC9496@jm.kir.nu>

On Fri, Jul 28, 2006 at 01:20:42PM +0200, Beno?t ALBERT wrote:

> I try to configure wpa_supplicant to connect to a network that use 802.1x 
> and dynamic WEP under windows 2000.
> I don't find how to define the certificate I want to use (This one is stored 
> in windows registry and not in one or several files).

Please see the example wpa_supplicant.conf file for details on how
ca_cert and private_key are configured for the case where Windows
certificate store is used (I'm assuming you mean that, and not only
using registry):

# ca_cert: File path to CA certificate file (PEM/DER). This file can have one
#       or more trusted CA certificates. If ca_cert and ca_path are not
#       included, server certificate will not be verified. This is insecure and
#       a trusted CA certificate should always be configured when using
#       EAP-TLS/TTLS/PEAP. Full path should be used since working directory may
#       change when wpa_supplicant is run in the background.
#       On Windows, trusted CA certificates can be loaded from the system
#       certificate store by setting this to cert_store://<name>, e.g.,
#       ca_cert="cert_store://CA" or ca_cert="cert_store://ROOT".

# private_key: File path to client private key file (PEM/DER/PFX)
#       When PKCS#12/PFX file (.p12/.pfx) is used, client_cert should be
#       commented out. Both the private key and certificate will be read from
#       the PKCS#12 file in this case. Full path should be used since working
#       directory may change when wpa_supplicant is run in the background.
#       Windows certificate store can be used by leaving client_cert out and
#       configuring private_key in one of the following formats:
#       cert://substring_to_match
#       hash://certificate_thumbprint_in_hex
#       for example: private_key="hash://63093aa9c47f56ae88334c7b65a4"
#       Alternatively, a named configuration blob can be used by setting this
#       to blob://<blob name>.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Jul 29 18:22:04 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 18:22:04 -0700
Subject: Having problem on wpa_supplicant with EAP-TTLS
In-Reply-To: <9b3ba1bb0607260748o21e090d5y39a1ef62a956da71@mail.gmail.com>
References: <9b3ba1bb0607260748o21e090d5y39a1ef62a956da71@mail.gmail.com>
Message-ID: <20060730012204.GD9496@jm.kir.nu>

On Wed, Jul 26, 2006 at 04:48:41PM +0200, Paul-Henri Gauzence de Lastours wrote:

> I'm using wpa_supplicant-0.4.8.
> The version of OpenSSL is 0.9.7j, the latest for branch 0-9-7 (4th may
> 2006), and I'm working on ARM9 with a 2.6.10 kernel.

Is this using uClinux? Which C library are you using?

> According to what you say, the problem should come from OpenSSL, so I'm
> gonna have a look on it.

Either something goes wrong in the way OpenSSL library is being called
or something odd happens in OpenSSL. Have you used OpenSSL on that
board with anything else?

I haven't tested OpenSSL 0.9.7j, but I would not expect it to be that
different from earlier 0.9.7 versions that I have tested. It looks like
this issue may require adding some more debug code in eap_tls_common.c
or tls_openssl.c to figure out what exactly is happening when OpenSSL
library gets called.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Jul 29 18:50:53 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 18:50:53 -0700
Subject: hostap 0.4.7 with the 2.6.17 kernel
In-Reply-To: <1099.62.148.193.28.1153904284.squirrel@netlandzone.dyndns.org>
References: <eb905330607051556va74703dp1b55d08555cfc0b4@mail.gmail.com>
	<44AD8E1B.6040100@pcuf.fi> <1152227891.16115.12.camel@dv>
	<20060726043945.GI9553@jm.kir.nu>
	<1099.62.148.193.28.1153904284.squirrel@netlandzone.dyndns.org>
Message-ID: <20060730015053.GE9496@jm.kir.nu>

On Wed, Jul 26, 2006 at 11:58:04AM +0300, Jar wrote:

> It was removed by mistake. But seem to compile at the same way with or without->
> 
> $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules
> or
> $(MAKE) -C $(KERNEL_PATH) SUBDIRS=$(PWD)/driver/modules modules

OK. I removed MODVERDIR from CVS version, so should a new 0.4.x version
of the hostap-driver ever be released, it will hopefully be less likely
to suffer from this change in Linux 2.6.17. Anyway, the driver won't
build from newer kernels and this will only change what will be shown to
the user as an error message.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Jul 29 19:50:33 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 19:50:33 -0700
Subject: speedtouch 580
In-Reply-To: <20060718082508.GA26780@lenst.det.unifi.it>
References: <20060718082508.GA26780@lenst.det.unifi.it>
Message-ID: <20060730025033.GF9496@jm.kir.nu>

On Tue, Jul 18, 2006 at 10:25:08AM +0200, Leonardo Maccari wrote:
> the AP in subj has some strange behaviour that has been discussed in the
> list some time ago.
> 
> http://lists.shmoo.com/pipermail/hostap/2005-April/010113.html
> http://lists.shmoo.com/pipermail/hostap/2005-September/011324.html
> 
> has a patch ever been released for this?

I don't think so. Do you have one of these APs?

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Jul 29 20:02:23 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 20:02:23 -0700
Subject: wpa-supplicant for adhoc network with more than 2 nodes ?
In-Reply-To: <BBDE6D332D319548BAAAC70344517B6202BA7C70@exchange03.iabg.de>
References: <BBDE6D332D319548BAAAC70344517B6202BA7C70@exchange03.iabg.de>
Message-ID: <20060730030223.GG9496@jm.kir.nu>

On Fri, Jul 14, 2006 at 12:13:35PM +0200, Ly Hong wrote:
> >>wpa_supplicant does not do any per-STA processing in IBSS mode for 
> >>WPA-None, so I would be surprised if this were the case. Which driver 
> >>are you using?

> Sorry if I sound a little bit pedantic: What does your above answer
> mean? Should WPA-NONE in IBSS mode work with more than two hosts or not?

Yes, it should. The answer means that wpa_supplicant does not need to do
anything specific for each STA in WPA-None mode.

> The question arises from the observation that two hosts work just fine
> while a third host can't connect at all.

That sounds like a driver bug.

> Could you elaborate on your response that "wpa_supplicant does not do
> any per-STA processing in IBSS mode"? Is this a missing piece in
> wpa_supplicant or simply not needed at all?

It is not needed at all in the supplicant since WPA-None is using the
same key with all stations.

> >>This would be IEEE 802.11i IBSS, not WPA. You are talking
> >>about WPA TK,
> >>so I'm assuming this is indeed WPA-None, not IEEE 802.11i
> >>IBSS. Anyway,
> >>wpa_supplicant does not currently support IEEE 802.11i IBSS.
> 
> Since the standard 802.11i described clearly what is happening in IBSS 
> mode. For example:
> 
> 1. 4-Way Handshake for generation the session-key from the PSK-> each
> adhoc link has different session-key
> 2. The session-key is used as input for data encryption for TKIP
> 
> If wpa_supplicant does not support 802.11i IBSS mode, how does WPA-None
> work in adhoc-mode?

IEEE 802.11i in IBSS mode is completely different from WPA-None.

> For example, Is there any 4-Way-handshake for generation the 
> session-key from the PSK?

Not in WPA-None.

> >>WPA-None is sharing the same key with all clients..
> 
> But TKIP needs amongst others 2 keys (MIC-key and Temporal-Key) as input
> for data encryption. 

Yes, sure. But the same set of keys needed for TKIP is shared with all
clients in WPA-None adhoc mode.

> So these two keys I guess must being somehow derived from the shared key
> mentioned by you. But then again we will have different session keys for
> different links.

No, each link is using the same key.

> So can it be that there is no further key derivation and the shared key
> will be used directly 
> as input for TKIP in order to encrypt the data  ?

Yes.

> In this case all adhoc-link have the same key like WEP in IBSS mode, but
> then 
> the question arises again why two hosts work just fine while a third
> host can't connect at all.

That would be a question to the authors of the driver, not supplicant.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Jul 29 20:09:05 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 20:09:05 -0700
Subject: Help:Can wpa_supplicant-0.3.8 work with Madwifi without openssl
	linked?
In-Reply-To: <BAY110-F8EE65731B93D0C7EE8417D36B0@phx.gbl>
References: <BAY110-F8EE65731B93D0C7EE8417D36B0@phx.gbl>
Message-ID: <20060730030905.GH9496@jm.kir.nu>

On Mon, Jul 10, 2006 at 09:50:55AM +0000, Sun Bon wrote:

> I disabled all the EAP functions and didn't give the path to the openssl 
> header files and libs (Also compiler didn't ask me for that during make).   
> 
> I hope to get sure that wpa_supplicant can work without openssl (tried) and 
> any advice about the failure I described below. 

Yes, wpa_supplicant works fine without OpenSSL as long as you do not
need EAP modes that use TLS. For example, if you are using only
WPA-Personal, there is no need for OpenSSL.

> Debug print:
...

> Daemonize..


Could you please try this without -B on the command line? I would also
be interested in seeing whether you can re-produce the same error with
the latest wpa_supplicant version (i.e., 0.5.4).

> Another question is: which verison of openssl is recommended to work with 
> wpa-supplicant-0.3.8.  I've tried openssl-0.9.7g but stopped at 
> compiling:openssl used some functions that the my arm-gcc lib not declared 
> (some functions in ctype.h). 

Any recent 0.9.7 and 0.9.8 version should be fine. Please include full
error message from the compiler if you cannot get this working.

-- 
Jouni Malinen                                            PGP id EFC895FA



From oshogg  Sat Jul 29 22:24:13 2006
From: oshogg (Osho GG)
Date: Sat, 29 Jul 2006 22:24:13 -0700
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <20060729235422.GA9496@jm.kir.nu>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
	<20060729235422.GA9496@jm.kir.nu>
Message-ID: <126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>

On 7/29/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
> On Fri, Jul 28, 2006 at 07:33:24PM -0700, Osho GG wrote:
> > I have configured a network in wpa_supplicant.conf as follows:
> >         identity="oshogg"
> >         password="mypassword"
>
> > Now, this works great. I can connect to the network fine. My only
> > problem is that I have my password in plain text in a configuration
> > file. Unfortunately, I do not have administrative privileges for
> > configuring the access point and authentication mechanism it uses. Is
> > there any way I can create a configuration (similar to wpa_passphrase
> > for psk) that does not require storing the password in plain text?
>
> If you leave out that password line from the configuration,
> wpa_supplicant will request the password over the control interface
> (e.g., from wpa_cli or wpa_gui).
>
Thanks that will work but that would require me to have to enter the
password every time I have to connect to this network. I don't want to
do that :).

I just want a way this password could be encrypted in some form and
then decrypted later by WPA. Is this possible somehow?

thanks,
Osho



> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>



From jkmaline  Sat Jul 29 22:37:29 2006
From: jkmaline (Jouni Malinen)
Date: Sat, 29 Jul 2006 22:37:29 -0700
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
	<20060729235422.GA9496@jm.kir.nu>
	<126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>
Message-ID: <20060730053729.GI9496@jm.kir.nu>

On Sat, Jul 29, 2006 at 10:24:13PM -0700, Osho GG wrote:

> Thanks that will work but that would require me to have to enter the
> password every time I have to connect to this network. I don't want to
> do that :).
> 
> I just want a way this password could be encrypted in some form and
> then decrypted later by WPA. Is this possible somehow?

Where would the key needed for decrypting the password come from? Would
you rather enter that key than the password every time? ;-)

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sun Jul 30 10:21:06 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 10:21:06 -0700
Subject: Using wpa_supplicant with rt2500 driver for auto-roaming
In-Reply-To: <20060706060738.GA92526@tempest.prismnet.com>
References: <20060706060738.GA92526@tempest.prismnet.com>
Message-ID: <20060730172105.GA9488@jm.kir.nu>

On Thu, Jul 06, 2006 at 01:07:38AM -0500, John Buttery wrote:

>   Anyway, I want to make sure I'm using wpa_supplicant for something
> it's even intended to do in the first place, before I put any more
> effort into trying to make it work.  I have a wifi card in my laptop
> now, that works fine.  I originally installed waproamd because I wanted
> to set it up so that my wireless networking would automatically bring
> itself up as I roamed between different access points (both open-access
> ones, and protected ones for which I have keys/passphrases).

You can configure multiple network blocks in wpa_supplicant.conf and
allow wpa_supplicant to select which network to use based on which APs
are available.

>   My guess was that I should use the "Linux wireless extensions" driver
> on the wpa_supplicant command line...this is what I get (sorry if this
> is a bit long; I'm not sure what's relevant).  "GuestAccess" is the
> ESSID of the access point I'm trying to associate with; it's wide-open
> (ie, no WEP/WPA/etc).  The return of the prompt at the end of the output
> is the result of my having pressed Ctrl-c.

Can you please try the same with more verbose debugging enabled (add -dd
to the command line)? I've newer used rt2500 with wpa_supplicant, so I
don't know what to expect as far as supported functionality is
concerned.

> ioctl[SIOCSIWPMKSA]: Operation not supported
> WEXT auth param 7 value 0x1 - ioctl[SIOCSIWAUTH]: Operation not supported
> ioctl[SIOCSIWENCODEEXT]: Operation not supported

These are most likely okay to ignore. The driver does not seem to
support some of the WPA/WPA2 extensions, but they should not prevent
plaintext mode that you were trying here if I understood correctly.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sun Jul 30 10:30:09 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 10:30:09 -0700
Subject: hostapd and XP Authentication Help Needed (fwd)
In-Reply-To: <Pine.LNX.4.63.0607021046490.9492@m21.linora.com>
References: <Pine.LNX.4.63.0607021046490.9492@m21.linora.com>
Message-ID: <20060730173009.GB9488@jm.kir.nu>

On Sun, Jul 02, 2006 at 10:48:09AM -0600, kshogan at nomadisp.com wrote:

> Recently started to use hostapd as an authenication for a WPA on an atheros 
> chipset using hostapd.  Versions are all 0.4.9 on a 2.6.11 kernel. My problem 
> is that I am unable to get win xp to authenticate to the ap. It sees it, and 
> shows it as a WPA ap, but the authentication fails.  The dump of the process is 
> below.  Seems that the EAPOL Timeout may be an issue.  It connects to begin 
> with, but the 4 way handshake seems to be the problem.
> 
> Does anyone have a set of working hostapd.conf configs that they would share as 
> a starting point for me to customize?  Or, can anyone point to the problems 
> that might be causing the errors?

Your configuration looks fine. Though, I would recommend starting with
just one pairwise cipher (either TKIP or CCMP) enabled. Enabling both of
them may cause problems with some older client implementations.

> ath2: STA 00:0c:41:10:94:46 WPA: sending 1/4 msg of 4-Way Handshake

> IEEE 802.1X: 99 bytes from 00:0c:41:10:94:46
>     IEEE 802.1X: version=1 type=3 length=95
> ath2: STA 00:0c:41:10:94:46 WPA: received EAPOL-Key 2/2 Group with unexpected 
> replay counter

This was somewhat odd frame to receive from the client at this point. I
would assume that this is from an earlier association and the client
just did not complete re-association properly.

> ath2: STA 00:0c:41:10:94:46 WPA: sending 1/4 msg of 4-Way Handshake
> ath2: STA 00:0c:41:10:94:46 WPA: received EAPOL-Key frame (2/4 Pairwise)

Anyway, things got synchronized here, so 4-way handshake can continue.

> ath2: STA 00:0c:41:10:94:46 WPA: received EAPOL-Key frame (4/4 Pairwise)
> madwifi_set_key: alg=TKIP addr=00:0c:41:10:94:46 key_idx=0
> ath2: STA 00:0c:41:10:94:46 WPA: pairwise key handshake completed (WPA)

4-way handshake was completed successfully and the AP configured
encryption for this station.

> ath2: STA 00:0c:41:10:94:46 WPA: sending 1/2 msg of Group Key Handshake

AP is now trying to send out the group key (multiple times).

> ath2: STA 00:0c:41:10:94:46 WPA: EAPOL-Key timeout
> WPA: 00:0c:41:10:94:46 WPA_PTK_GROUP entering state KEYERROR

But there is no response from the client. Either the client did not
receive the message or was unable to send a correctly encrypted
response to it. hostapd did not get any indication of this, so one would
need to either look at the client side debug log or madwifi debug for
more information on what is happening here.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sun Jul 30 10:48:39 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 10:48:39 -0700
Subject: wpa_supplicant.conf manpaged error
In-Reply-To: <44A92076.70507@tpg.com.au>
References: <44A92076.70507@tpg.com.au>
Message-ID: <20060730174839.GC9488@jm.kir.nu>

On Mon, Jul 03, 2006 at 11:49:42PM +1000, Kel Modderman wrote:

> When the wpa_supplicant.conf sgml document is converted to troff, it 
> seems that having a ' as first character in the line causes the rest of 
> the line to be omitted. The attached trivial patch "corrects" that flaw.

Thanks! Applied.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sun Jul 30 10:54:59 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 10:54:59 -0700
Subject: [patch]: hostapd PID file
In-Reply-To: <44AE4297.3060802@tpg.com.au>
References: <44AE4297.3060802@tpg.com.au>
Message-ID: <20060730175459.GD9488@jm.kir.nu>

On Fri, Jul 07, 2006 at 09:16:39PM +1000, Kel Modderman wrote:

> It'd be great to have hostapd create a PID file. Patch is attached.

Thanks, applied.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sun Jul 30 11:01:59 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 11:01:59 -0700
Subject: [patch]: hostapd PID file
In-Reply-To: <e8t3q5$1nm$1@sea.gmane.org>
References: <44AE4297.3060802@tpg.com.au> <e8t3q5$1nm$1@sea.gmane.org>
Message-ID: <20060730180159.GE9488@jm.kir.nu>

On Mon, Jul 10, 2006 at 10:40:37AM +0200, Pawe?? Foremski wrote:
> By the way, here's the same functionality for 0.4.9.

Thanks, applied.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sun Jul 30 11:04:49 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 11:04:49 -0700
Subject: In-kernel-hostap does not find pccard on soekris4511
In-Reply-To: <f59e60020607030911p349ab213xcd9ff8213671738a@mail.gmail.com>
References: <f59e60020607030911p349ab213xcd9ff8213671738a@mail.gmail.com>
Message-ID: <20060730180449.GF9488@jm.kir.nu>

On Mon, Jul 03, 2006 at 06:11:06PM +0200, Klaas De Craemer wrote:

> I'm trying to configure my soekris4511-board as a freeradius-server/AP
> but I have some trouble getting my Senao NL2511 to work with hostap.
> I have already tried the Debian-mini-distro Pebble, which has kernel
> 2.4. wlan0 is correctly detected in it, but hostapd complains that it
> can't interface with the kernel. So i decided to built a complete new
> rootfs from scratch based on kernel 2.6.15.6 , in which I enabled
> hostap and hostap_cs as a module.
> Now, I can load and unload the module(s) (I also tried the PCI and PLX
> modules...) as much as I want, nothing is detected.

Could you please send "pccardctl ident" or "cardctl ident" output to
show more details of the card you are using?

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sun Jul 30 11:06:43 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 11:06:43 -0700
Subject: Hostap and 802.11 sequence numbers
In-Reply-To: <6117ACCB57BFD4118C0C00508BB1B92007B59BE8@ii3004exch001u.iprc.lucent.com>
References: <6117ACCB57BFD4118C0C00508BB1B92007B59BE8@ii3004exch001u.iprc.lucent.com>
Message-ID: <20060730180643.GG9488@jm.kir.nu>

On Thu, Jun 29, 2006 at 10:40:40AM +0530, Gambhir, Pulkit (Pulkit)** CTR ** wrote:

> I have been trying to track the sequence numbers of 802.11 packets (using
> hostap driver level code) at the transmition end. Looking at the hostap
> code, it appears that the sequence numbers (seq_ctrl field in the ieee
> 802.11 header) are not being set by hostap, instead that job is passed on to
> the frameware; is this correct ?

Yes, that's correct.

>  If yes, then is there some way I can
> tarnsfer the job of setting these sequence numbers to the driver level ? or
> alternatively can I find out at the transmition end which packet is
> allocated which sequence number by the firmware ?

I'm not aware of a mechanism for doing either of these options.

-- 
Jouni Malinen                                            PGP id EFC895FA



From the-able  Sun Jul 30 11:50:14 2006
From: the-able (the-able at gmx.net)
Date: Sun, 30 Jul 2006 20:50:14 +0200
Subject: Problem with hostapd config-file
Message-ID: <44CCFF66.9010207@gmx.net>

Hi,

i have a problem when tryring to run hostapd (i tried 0.4.9 and 0.5.4).
i use fedora core 5 and a wlan-card with an atheros-chipset.
madwifi ist installed and configured:

iwconfig:

lo no wireless extensions.
eth0 no wireless extensions.
wifi0 no wireless extensions.
sit0 no wireless extensions.

Warning: Driver for device ath0 has been compiled with version 20
of Wireless Extension, while this program supports up to version 19.
Some things may be broken...

ath0 IEEE 802.11b ESSID:"test"
Mode:Master Frequency:2.412 GHz Access Point: XX.XX.XX....
Bit Rate:0 kb/s Tx-Power:16 dBm Sensitivity=0/3
Retry:off RTS thr:off Fragment thr:off
Encryption key:off
Power Management:off
Link Quality=0/94 Signal level=-95 dBm Noise level=-95 dBm
Rx invalid nwid:5273 Rx invalid crypt:0 Rx invalid frag:0
Tx excessive retries:0 Invalid misc:0 Missed beacon:0

i edited the .config:
# Driver interface for madwifi driver
CONFIG_DRIVER_MADWIFI=y
CFLAGS += -I/home/able/files2/madwifi-0.9.1/madwifi-0.9.1

after the make (no errors) i tried to run hostapd:

hostapd madwifi.conf

with following madwifi.conf:

# AP netdevice name (without 'ap' prefix, i.e., wlan0 uses wlan0ap for
# management frames)
interface=ath0
# In case of madwifi driver, an additional configuration parameter, bridge,
# must be used to notify hostapd if the interface is included in a
bridge. This
# parameter is not used with Host AP driver.
bridge=br0
# Driver interface type (hostap/wired/madwifi; default: hostap)
driver=madwifi
# hostapd event logger configuration
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2
# Debugging: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = excessive
debug=0
# Dump file for state information (on SIGUSR1)
dump_file=/tmp/hostapd.dump
# SSID to be used in IEEE 802.11 management frames
ssid=wpa-test
# EAPOL-Key index workaround (set bit7) for WinXP Supplicant (needed only if
# only broadcast keys are used)
eapol_key_index_workaround=0
# Use integrated EAP server instead of external RADIUS authentication
# server. This is also needed if hostapd is configured to act as a RADIUS
# authentication server.
eap_server=0
# The own IP address of the access point (used as NAS-IP-Address)
own_ip_addr=127.0.0.1


I get the following error:

Configuration file: madwifi.conf
Line 14: invalid/unknown driver 'madwifi'
1 errors found in configuration file 'madwifi.conf'

line 14 is this:
driver=madwifi


i double-checked the CFLAGS-path in the .config.

does anyone have an idea?

thanks,
michael



From jkmaline  Sun Jul 30 11:54:36 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 11:54:36 -0700
Subject: Problem with hostapd config-file
In-Reply-To: <44CCFF66.9010207@gmx.net>
References: <44CCFF66.9010207@gmx.net>
Message-ID: <20060730185436.GH9488@jm.kir.nu>

On Sun, Jul 30, 2006 at 08:50:14PM +0200, the-able at gmx.net wrote:

> i edited the .config:
> # Driver interface for madwifi driver
> CONFIG_DRIVER_MADWIFI=y
> CFLAGS += -I/home/able/files2/madwifi-0.9.1/madwifi-0.9.1

> after the make (no errors) i tried to run hostapd:

> I get the following error:
> 
> Configuration file: madwifi.conf
> Line 14: invalid/unknown driver 'madwifi'

Please make sure that all files were compiled correctly by running "make
clean" followed by "make". If this this does not fix the issue, please
verify that "nm hostapd | grep madwifi" is showing number of functions
with madwifi_ prefix.

-- 
Jouni Malinen                                            PGP id EFC895FA



From the-able  Sun Jul 30 12:10:50 2006
From: the-able (the-able at gmx.net)
Date: Sun, 30 Jul 2006 21:10:50 +0200
Subject: Problem with hostapd config-file
In-Reply-To: <20060730185436.GH9488@jm.kir.nu>
References: <44CCFF66.9010207@gmx.net> <20060730185436.GH9488@jm.kir.nu>
Message-ID: <44CD043A.5030401@gmx.net>

Jouni Malinen wrote:
> 
> Please make sure that all files were compiled correctly by running "make
> clean" followed by "make". If this this does not fix the issue, please
> verify that "nm hostapd | grep madwifi" is showing number of functions
> with madwifi_ prefix.
> 

thanks for your answer i. tried make clean / make several times, i also
tried different hostapd-versions.

nm hostapd shows 24 functions, for example
0806cf60 t madwifi_deinit
08088bc0 r madwifi_driver_ops
0806b0f0 T madwifi_driver_register
0806b630 t madwifi_flush
0806bad0 t madwifi_get_seqnum
0806b1d0 t madwifi_get_ssid
0806cfd0 t madwifi_init

thanks,
michael.



From jkmaline  Sun Jul 30 12:28:20 2006
From: jkmaline (Jouni Malinen)
Date: Sun, 30 Jul 2006 12:28:20 -0700
Subject: Problem with hostapd config-file
In-Reply-To: <44CD043A.5030401@gmx.net>
References: <44CCFF66.9010207@gmx.net> <20060730185436.GH9488@jm.kir.nu>
	<44CD043A.5030401@gmx.net>
Message-ID: <20060730192820.GI9488@jm.kir.nu>

On Sun, Jul 30, 2006 at 09:10:50PM +0200, the-able at gmx.net wrote:

> thanks for your answer i. tried make clean / make several times, i also
> tried different hostapd-versions.

Are you sure that you are running the correct hostapd binary? I cannot
reproduce this with the current source tree.. Could you please send me
the exact same build and run time configuration files (.config and
hostapd.conf) that you are using here? 

-- 
Jouni Malinen                                            PGP id EFC895FA



From oshogg  Sun Jul 30 22:25:24 2006
From: oshogg (Osho GG)
Date: Sun, 30 Jul 2006 22:25:24 -0700
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <20060730053729.GI9496@jm.kir.nu>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
	<20060729235422.GA9496@jm.kir.nu>
	<126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>
	<20060730053729.GI9496@jm.kir.nu>
Message-ID: <126dcc3c0607302225k5ec479ebs43b207a85a268d40@mail.gmail.com>

On 7/29/06, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
> On Sat, Jul 29, 2006 at 10:24:13PM -0700, Osho GG wrote:
>
> > Thanks that will work but that would require me to have to enter the
> > password every time I have to connect to this network. I don't want to
> > do that :).
> >
> > I just want a way this password could be encrypted in some form and
> > then decrypted later by WPA. Is this possible somehow?
>
> Where would the key needed for decrypting the password come from? Would
> you rather enter that key than the password every time? ;-)
>

Well, I was hoping that wpa_supplicant can use the encrypted version
of this password :) (like it does for psk).

The same network is connected by other users of this network (who are
using windows OS) by configuring to get the user credentials by
windows logon. So, basically the password is the same as for the
windows account. This works well for windows users and is reasonably
secure as the password is not saved anywhere in plain text.

I would like to have the same level of convenience and security in
linux. Could wpa be configured in such a manner that it can use my
linux user password (or even root password) - ***but which is not
stored in plain text anywhere in the system*** ?

Many thanks,
Osho

> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>



From bryan  Mon Jul 31 04:08:33 2006
From: bryan (Bryan Kadzban)
Date: Mon, 31 Jul 2006 07:08:33 -0400
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <126dcc3c0607302225k5ec479ebs43b207a85a268d40@mail.gmail.com>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>	<20060729235422.GA9496@jm.kir.nu>	<126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>	<20060730053729.GI9496@jm.kir.nu>
	<126dcc3c0607302225k5ec479ebs43b207a85a268d40@mail.gmail.com>
Message-ID: <44CDE4B1.206@kadzban.is-a-geek.net>

Osho GG wrote:
> Well, I was hoping that wpa_supplicant can use the encrypted version 
> of this password :) (like it does for psk).

The PSK is *NOT* encrypted, it's just in a hex format.  Anyone can use
that string of hex bytes instead of a text passphrase, and still connect
to your PSK network.

(Every supplicant actually uses the hashed (hex-bytes) value in the
4-way handshake, not the text passphrase.  Most allow you to type in
either.  Certainly the XP supplicant allows you to type in either.)

> and is reasonably secure as the password is not saved anywhere in
> plain text.

Except it is stored as a LanMan hash by default (extraordinarily easy to
de-hash)...  but that's a separate issue.

> Could wpa be configured in such a manner that it can use my linux
> user password (or even root password)

Not that I know of, but why would you want to use the same password
anyway?  And if you aren't using the same password, would that make it a
lot less of a problem that it's saved in plain-text, because it isn't
used for anything else?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060731/ef21b8a0/attachment.pgp 


From the-able  Mon Jul 31 05:48:15 2006
From: the-able (the-able at gmx.net)
Date: Mon, 31 Jul 2006 14:48:15 +0200
Subject: Problem with hostapd config-file
In-Reply-To: <20060730192820.GI9488@jm.kir.nu>
References: <44CCFF66.9010207@gmx.net>
	<20060730185436.GH9488@jm.kir.nu>	<44CD043A.5030401@gmx.net>
	<20060730192820.GI9488@jm.kir.nu>
Message-ID: <44CDFC0F.2030903@gmx.net>

Jouni Malinen wrote:

> 
> Are you sure that you are running the correct hostapd binary? I cannot
> reproduce this with the current source tree.. Could you please send me
> the exact same build and run time configuration files (.config and
> hostapd.conf) that you are using here? 
> 

i'm using the files from http://hostap.epitest.fi/hostapd/. right now
the version 0.5.4 (i'm interested in eap-aka), although a hostapd -ver
says v0.4.9.

i attached the two files. i used basically the  default files (defconfig
and madwifi.conf) with a few changes.

thanks a lot,
michael

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: config
Url: http://lists.shmoo.com/pipermail/hostap/attachments/20060731/5c102215/attachment.txt 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: madwifi.conf
Url: http://lists.shmoo.com/pipermail/hostap/attachments/20060731/5c102215/attachment-0001.txt 


From oshogg  Mon Jul 31 06:41:05 2006
From: oshogg (Osho GG)
Date: Mon, 31 Jul 2006 06:41:05 -0700
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <44CDE4B1.206@kadzban.is-a-geek.net>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
	<20060729235422.GA9496@jm.kir.nu>
	<126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>
	<20060730053729.GI9496@jm.kir.nu>
	<126dcc3c0607302225k5ec479ebs43b207a85a268d40@mail.gmail.com>
	<44CDE4B1.206@kadzban.is-a-geek.net>
Message-ID: <126dcc3c0607310641j3f4cee60v53c73c1b464e9fb0@mail.gmail.com>

On 7/31/06, Bryan Kadzban <bryan at kadzban.is-a-geek.net> wrote:
> Osho GG wrote:
> > Well, I was hoping that wpa_supplicant can use the encrypted version
> > of this password :) (like it does for psk).
>
> The PSK is *NOT* encrypted, it's just in a hex format.  Anyone can use
> that string of hex bytes instead of a text passphrase, and still connect
> to your PSK network.
>

Thanks for the explanation :).

> (Every supplicant actually uses the hashed (hex-bytes) value in the
> 4-way handshake, not the text passphrase.  Most allow you to type in
> either.  Certainly the XP supplicant allows you to type in either.)
>
> > and is reasonably secure as the password is not saved anywhere in
> > plain text.
>
> Except it is stored as a LanMan hash by default (extraordinarily easy to
> de-hash)...  but that's a separate issue.
>
> > Could wpa be configured in such a manner that it can use my linux
> > user password (or even root password)
>
> Not that I know of, but why would you want to use the same password
> anyway?

I know it would not be a good idea security wise to do so. However, I
am just trying to find some way to comply with the security guidelines
at where I am (one of the guideline is that no password should be
stored in plain text anywhere).

> And if you aren't using the same password, would that make it a
> lot less of a problem that it's saved in plain-text, because it isn't
> used for anything else?
>

Unfortunately, this password (which has to be same as my windows
password due to the administration's configuration of wireless access
points) is used *everywhere* for all internal websites.

thanks,
Osho



From maccari-thisaintpartofmyaddress-  Mon Jul 31 08:24:45 2006
From: maccari-thisaintpartofmyaddress- (leonardo maccari)
Date: Mon, 31 Jul 2006 17:24:45 +0200
Subject: speedtouch 580
In-Reply-To: <20060730025033.GF9496@jm.kir.nu>
References: <20060718082508.GA26780@lenst.det.unifi.it>
	<20060730025033.GF9496@jm.kir.nu>
Message-ID: <200607311724.45808.maccari-thisaintpartofmyaddress-@lenst.det.unifi.it>

Alle 04:50, domenica 30 luglio 2006, Jouni Malinen ha scritto:
> On Tue, Jul 18, 2006 at 10:25:08AM +0200, Leonardo Maccari wrote:
> > the AP in subj has some strange behaviour that has been discussed in the
> > list some time ago.
> >
> > http://lists.shmoo.com/pipermail/hostap/2005-April/010113.html
> > http://lists.shmoo.com/pipermail/hostap/2005-September/011324.html
> >
> > has a patch ever been released for this?
>
> I don't think so. Do you have one of these APs?

yes. As soon as I find a windows machine I'll post to the list a capture of a 
WPA session done with a (hopefully) working XP laptop. 

ciao,
leonardo.



From alec.waters  Mon Jul 31 08:37:24 2006
From: alec.waters (Alec Waters)
Date: Mon, 31 Jul 2006 16:37:24 +0100
Subject: ioctl[PRISM2_IOCTL_HOSTAPD]: Connection timed out - Could not
	communicate with the kernel driver.
In-Reply-To: <44C8A3FC.7020501@dataline.co.uk>
References: <44C8A3FC.7020501@dataline.co.uk>
Message-ID: <44CE23B4.5060302@dataline.co.uk>

Alec Waters wrote:
> ioctl[PRISM2_IOCTL_HOSTAPD]: Connection timed out
> Could not communicate with the kernel driver.

Short of an outright solution, if anyone could tell me why you might see 
the above error I'd be most grateful!

many thanks,
alec
-- 
Alec Waters CCNP
Dataline Software Ltd
Clarence House, 30-31 North Street, Brighton, BN1 1EB, UK

Tel: +44 (0)1273 324939
Fax: +44 (0)1273 205576
www: http://www.dataline.co.uk
IPv6: http://www.ipv6.dataline.co.uk





From bryan  Mon Jul 31 09:52:40 2006
From: bryan (Bryan Kadzban)
Date: Mon, 31 Jul 2006 12:52:40 -0400
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <126dcc3c0607310641j3f4cee60v53c73c1b464e9fb0@mail.gmail.com>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
	<20060729235422.GA9496@jm.kir.nu>
	<126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>
	<20060730053729.GI9496@jm.kir.nu>
	<126dcc3c0607302225k5ec479ebs43b207a85a268d40@mail.gmail.com>
	<44CDE4B1.206@kadzban.is-a-geek.net>
	<126dcc3c0607310641j3f4cee60v53c73c1b464e9fb0@mail.gmail.com>
Message-ID: <20060731165240.GA4325@kadzban.is-a-geek.net>

On Mon, Jul 31, 2006 at 06:41:05AM -0700, Osho GG wrote:
> I know it would not be a good idea security wise to do so. However, I
> am just trying to find some way to comply with the security guidelines
> at where I am (one of the guideline is that no password should be
> stored in plain text anywhere).

Yikes.

Well, as Jouni said, you could encrypt the password and then also
provide a key.  If according to the guidelines a "key" is something
different from a "password", then you could automatically connect.  But
I would certainly treat them the same way, since with one you can find
the other.

But otherwise, there's no way to do it that I can see, with or without
changes to wpa_supplicant.  You can't store the MSCHAPv2 response,
because it changes depending on what the challenge is.  You can't store
a hash of the password, because that's completely equivalent to storing
the password itself (someone could take the hash and use it to log on,
just like they could do with the password).  This is even a problem on
Windows machines, if the password is stored locally.  (Cached domain
credentials seem to be a favorite target for anyone trying to steal a
valid domain password.  And even the local hash of the password that the
LSA stores, and uses when you lock and unlock your screen, is either
exactly equivalent to the password, or unusable for MSCHAPv2, or both.)

It looks like your requirements have a bug, in other words -- either
"no password should be stored in plaintext anywhere" or "the connection
needs to come up automatically" is impossible to satisfy.  It may be a
small comfort to know that Windows breaks the rules too, though (by
storing the MSCHAPv2-usable hash of a password in supposedly "protected"
memory inside the LSA).

Unless someone has another idea...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 191 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060731/06d3b423/attachment.pgp 


From RGovindarao  Mon Jul 31 11:49:05 2006
From: RGovindarao (Ravi Govindarao)
Date: Mon, 31 Jul 2006 14:49:05 -0400
Subject: pae module from Gunter... problems
Message-ID: <60C9D8B49C2C71459874A1F4F5DEE807021A0037@alfalfa.fortresstech.com>

Hi,
 Does any one have any luck in compiling pae for 2.6.13 kernel. I am
getting lot of compilation errors. Should I have to have any other patch
for kernel. It complains about NF_PACKET_OUT and NF_PACKET_IN.
Ravi..

-----Original Message-----
From: Pedro Ramalhais [mailto:ramalhais at serrado.net] 
Sent: Friday, July 28, 2006 6:23 PM
To: Ravi Govindarao
Cc: hostap at shmoo.com
Subject: Re: pae module from Gunter... problems

Ravi Govindarao wrote:
> Hi,
> 
> Can one of you please email me the pae module. The below link is not
valid anymore. Also David were U able to get this up and running with
2.6 kernel?
> 
> I am in the process of making our 8 port switch which is part of an
access device as 802.1x  authenticator. Our device runs with 2.6.13
kernel so your help is appreciated.
> 
> http://www.informatik.uni-rostock.de/~gbur/pae/pae-0.0.2.tar.gz
<http://www.informatik.uni-rostock.de/%7Egbur/pae/pae-0.0.2.tar.gz>
> 
> Thanks,
> 
> Ravi..

sourceforge project named "port authentication entity":
http://sourceforge.net/projects/pae

-- 
Pedro Ramalhais



From oshogg  Mon Jul 31 11:56:48 2006
From: oshogg (Osho GG)
Date: Mon, 31 Jul 2006 11:56:48 -0700
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <20060731165240.GA4325@kadzban.is-a-geek.net>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
	<20060729235422.GA9496@jm.kir.nu>
	<126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>
	<20060730053729.GI9496@jm.kir.nu>
	<126dcc3c0607302225k5ec479ebs43b207a85a268d40@mail.gmail.com>
	<44CDE4B1.206@kadzban.is-a-geek.net>
	<126dcc3c0607310641j3f4cee60v53c73c1b464e9fb0@mail.gmail.com>
	<20060731165240.GA4325@kadzban.is-a-geek.net>
Message-ID: <126dcc3c0607311156x15f5c14el585b3e217fd44@mail.gmail.com>

On 7/31/06, Bryan Kadzban <bryan at kadzban.is-a-geek.net> wrote:
> On Mon, Jul 31, 2006 at 06:41:05AM -0700, Osho GG wrote:
> > I know it would not be a good idea security wise to do so. However, I
> > am just trying to find some way to comply with the security guidelines
> > at where I am (one of the guideline is that no password should be
> > stored in plain text anywhere).
>
> Yikes.
>
> Well, as Jouni said, you could encrypt the password and then also
> provide a key.  If according to the guidelines a "key" is something
> different from a "password", then you could automatically connect.  But

Thanks. I would give this a try. Do you know how the Network
configuration will look like in wpa_supplicant.conf for using such a
key?

> I would certainly treat them the same way, since with one you can find
> the other.
>
> But otherwise, there's no way to do it that I can see, with or without
> changes to wpa_supplicant.  You can't store the MSCHAPv2 response,
> because it changes depending on what the challenge is.  You can't store
> a hash of the password, because that's completely equivalent to storing
> the password itself (someone could take the hash and use it to log on,
> just like they could do with the password).  This is even a problem on
> Windows machines, if the password is stored locally.  (Cached domain
> credentials seem to be a favorite target for anyone trying to steal a
> valid domain password.  And even the local hash of the password that the
> LSA stores, and uses when you lock and unlock your screen, is either
> exactly equivalent to the password, or unusable for MSCHAPv2, or both.)
>
> It looks like your requirements have a bug, in other words -- either
> "no password should be stored in plaintext anywhere" or "the connection
> needs to come up automatically" is impossible to satisfy.  It may be a
> small comfort to know that Windows breaks the rules too, though (by
> storing the MSCHAPv2-usable hash of a password in supposedly "protected"
> memory inside the LSA).
>

It is indeed a good comfort to have :). I would be happy with as
insecure system as Window (never thought I would say that about Linux
:) ).

> Unless someone has another idea...
>
>
>
>

Thanks for your help,
Osho



From mistamaila  Mon Jul 31 17:44:43 2006
From: mistamaila (John H.)
Date: Mon, 31 Jul 2006 19:44:43 -0500
Subject: how to use wpa_supplicant on wpa network with peap and
	credentialing
In-Reply-To: <5b9417770607291119ua83bfc8kbd3d3cfa8a5c6c03@mail.gmail.com>
References: <5b9417770607220147y2df3295bu5dbfbf4b242023bb@mail.gmail.com>
	<20060724035808.44731.qmail@web35811.mail.mud.yahoo.com>
	<5b9417770607281230j6e36e5d7mb7bbe9e3957bd950@mail.gmail.com>
	<5b9417770607291119ua83bfc8kbd3d3cfa8a5c6c03@mail.gmail.com>
Message-ID: <5b9417770607311744w6798e05ay8495c31ef273cfd7@mail.gmail.com>

i put the debug info in here, but the admin has never either allowed
or not allowed it to be posted.  does the admin of this list look on
here regularly? it said the included debug info was too big.  i want
to be able to supply the correct info to get a solution.



From bryan  Mon Jul 31 19:35:59 2006
From: bryan (Bryan Kadzban)
Date: Mon, 31 Jul 2006 22:35:59 -0400
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <126dcc3c0607311156x15f5c14el585b3e217fd44@mail.gmail.com>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>	
	<20060729235422.GA9496@jm.kir.nu>	
	<126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>	
	<20060730053729.GI9496@jm.kir.nu>	
	<126dcc3c0607302225k5ec479ebs43b207a85a268d40@mail.gmail.com>	
	<44CDE4B1.206@kadzban.is-a-geek.net>	
	<126dcc3c0607310641j3f4cee60v53c73c1b464e9fb0@mail.gmail.com>	
	<20060731165240.GA4325@kadzban.is-a-geek.net>
	<126dcc3c0607311156x15f5c14el585b3e217fd44@mail.gmail.com>
Message-ID: <44CEBE0F.7090100@kadzban.is-a-geek.net>

Osho GG wrote:
> On 7/31/06, Bryan Kadzban <bryan at kadzban.is-a-geek.net> wrote:
> 
>> Well, as Jouni said, you could encrypt the password and then also 
>> provide a key.  If according to the guidelines a "key" is something
>> different from a "password", then you could automatically connect.
> 
> 
> Thanks. I would give this a try. Do you know how the Network 
> configuration will look like in wpa_supplicant.conf for using such a 
> key?

AFAIK there's no support for a setup like this in wpa_supplicant now;
you (or someone) would have to add it.  But I'm not convinced how secure
a setup like this would be; I personally would not consider a decryption
key to be anything different from a password.  If one is not allowed to
be in a config file, I don't see why the other should be -- someone who
steals the config file can still recover the password, by using the key
that'd be stored there.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060731/4f44052e/attachment.pgp 


From jkmaline  Mon Jul 31 21:09:09 2006
From: jkmaline (Jouni Malinen)
Date: Mon, 31 Jul 2006 21:09:09 -0700
Subject: Problem with hostapd config-file
In-Reply-To: <44CDFC0F.2030903@gmx.net>
References: <44CCFF66.9010207@gmx.net> <20060730185436.GH9488@jm.kir.nu>
	<44CD043A.5030401@gmx.net> <20060730192820.GI9488@jm.kir.nu>
	<44CDFC0F.2030903@gmx.net>
Message-ID: <20060801040909.GE8998@jm.kir.nu>

On Mon, Jul 31, 2006 at 02:48:15PM +0200, the-able at gmx.net wrote:

> i'm using the files from http://hostap.epitest.fi/hostapd/. right now
> the version 0.5.4 (i'm interested in eap-aka), although a hostapd -ver
> says v0.4.9.

If "hostapd -v" claims that it is v0.4.9, you are not using the 0.5.4
version that you built here.. Please make sure that you are executing
the correct binary. For example, in the build directory, you should see
following output:

hostapd-0.5.4$ ./hostapd -v
hostapd v0.5.4
User space daemon for IEEE 802.11 AP management,
IEEE 802.1X/WPA/WPA2/EAP/RADIUS Authenticator
Copyright (c) 2002-2006, Jouni Malinen <jkmaline at cc.hut.fi> and
contributors

If you see v0.4.9 on the first line, that was from another hostapd
binary. Maybe you have an older version somewhere on the default
path.

> i attached the two files. i used basically the  default files (defconfig
> and madwifi.conf) with a few changes.

These files work fine in my tests with 0.5.4. No problems parsing the
configuration and madwifi driver interface is selected.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Mon Jul 31 21:10:38 2006
From: jkmaline (Jouni Malinen)
Date: Mon, 31 Jul 2006 21:10:38 -0700
Subject: speedtouch 580
In-Reply-To: <200607311724.45808.maccari-thisaintpartofmyaddress-@lenst.det.unifi.it>
References: <20060718082508.GA26780@lenst.det.unifi.it>
	<20060730025033.GF9496@jm.kir.nu>
	<200607311724.45808.maccari-thisaintpartofmyaddress-@lenst.det.unifi.it>
Message-ID: <20060801041038.GF8998@jm.kir.nu>

On Mon, Jul 31, 2006 at 05:24:45PM +0200, leonardo maccari wrote:

> yes. As soon as I find a windows machine I'll post to the list a capture of a 
> WPA session done with a (hopefully) working XP laptop. 

Thanks! If we can figure out what exactly is causing the authentication
to fail, I could add some kind of configuration option to force
wpa_supplicant to do something else for this particular case.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Mon Jul 31 21:13:19 2006
From: jkmaline (Jouni Malinen)
Date: Mon, 31 Jul 2006 21:13:19 -0700
Subject: how to use wpa_supplicant on wpa network with peap and
	credentialing
In-Reply-To: <5b9417770607311744w6798e05ay8495c31ef273cfd7@mail.gmail.com>
References: <5b9417770607220147y2df3295bu5dbfbf4b242023bb@mail.gmail.com>
	<20060724035808.44731.qmail@web35811.mail.mud.yahoo.com>
	<5b9417770607281230j6e36e5d7mb7bbe9e3957bd950@mail.gmail.com>
	<5b9417770607291119ua83bfc8kbd3d3cfa8a5c6c03@mail.gmail.com>
	<5b9417770607311744w6798e05ay8495c31ef273cfd7@mail.gmail.com>
Message-ID: <20060801041319.GG8998@jm.kir.nu>

On Mon, Jul 31, 2006 at 07:44:43PM -0500, John H. wrote:
> i put the debug info in here, but the admin has never either allowed
> or not allowed it to be posted.  does the admin of this list look on
> here regularly? it said the included debug info was too big.  i want
> to be able to supply the correct info to get a solution.

I would not count on that going through to the list. Feel free to send
the log directly to me if the mailing list does not accept it or
alternatively, copy it to a web site somewhere and send an URL for the
information. If needed, that could also be Bugzilla that is available
for reporting issues at my website (http://hostap.epitest.fi/).. It
allows files to be attached to cases.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Mon Jul 31 21:17:27 2006
From: jkmaline (Jouni Malinen)
Date: Mon, 31 Jul 2006 21:17:27 -0700
Subject: ioctl[PRISM2_IOCTL_HOSTAPD]: Connection timed out - Could not
	communicate with the kernel driver.
In-Reply-To: <44CE23B4.5060302@dataline.co.uk>
References: <44C8A3FC.7020501@dataline.co.uk> <44CE23B4.5060302@dataline.co.uk>
Message-ID: <20060801041727.GH8998@jm.kir.nu>

On Mon, Jul 31, 2006 at 04:37:24PM +0100, Alec Waters wrote:
> Alec Waters wrote:
> > ioctl[PRISM2_IOCTL_HOSTAPD]: Connection timed out
> > Could not communicate with the kernel driver.
> 
> Short of an outright solution, if anyone could tell me why you might see 
> the above error I'd be most grateful!

This is likely caused by the card/firmware/driver being in a state where
commands are not completed. In this particular case, I don't know what
is triggering it, but the debug log did not seem to indicate any sign of
life from the card after it got to this state. The card initialization
itself seemed to work, since firmware versions were printed out. Could
you please send out dmesg output after running the first command (e.g.,
hostap_diag wlan0) with the card? Could you also please check whether
any interrupts are being received? I would hope that the allocated irq
49 is not shared with other devices, so the number of interrupts would
be easily available from /proc/interrupts.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Mon Jul 31 21:30:54 2006
From: jkmaline (Jouni Malinen)
Date: Mon, 31 Jul 2006 21:30:54 -0700
Subject: question about network configuration in wpa_supplicant.conf
In-Reply-To: <20060731165240.GA4325@kadzban.is-a-geek.net>
References: <126dcc3c0607281933s67c8df06v633b27b6af66a94e@mail.gmail.com>
	<20060729235422.GA9496@jm.kir.nu>
	<126dcc3c0607292224j3f4e5c08u3c16d83dd1f7cdf5@mail.gmail.com>
	<20060730053729.GI9496@jm.kir.nu>
	<126dcc3c0607302225k5ec479ebs43b207a85a268d40@mail.gmail.com>
	<44CDE4B1.206@kadzban.is-a-geek.net>
	<126dcc3c0607310641j3f4cee60v53c73c1b464e9fb0@mail.gmail.com>
	<20060731165240.GA4325@kadzban.is-a-geek.net>
Message-ID: <20060801043054.GI8998@jm.kir.nu>

On Mon, Jul 31, 2006 at 12:52:40PM -0400, Bryan Kadzban wrote:
> On Mon, Jul 31, 2006 at 06:41:05AM -0700, Osho GG wrote:
> > I know it would not be a good idea security wise to do so. However, I
> > am just trying to find some way to comply with the security guidelines
> > at where I am (one of the guideline is that no password should be
> > stored in plain text anywhere).
> 
> Yikes.
> 
> Well, as Jouni said, you could encrypt the password and then also
> provide a key.  If according to the guidelines a "key" is something
> different from a "password", then you could automatically connect.  But
> I would certainly treat them the same way, since with one you can find
> the other.

Well, I'm all for not storing keys or passwords in plaintext format on a
harddriver. However, that alone does not allow the desired "no
password/key to be entered for connection" feature.

> But otherwise, there's no way to do it that I can see, with or without
> changes to wpa_supplicant.  You can't store the MSCHAPv2 response,
> because it changes depending on what the challenge is.  You can't store
> a hash of the password, because that's completely equivalent to storing
> the password itself (someone could take the hash and use it to log on,
> just like they could do with the password).

Password hash could be stored for MSCHAPv2 and I think there is an open
case for adding this to wpa_supplicant (hostapd has support for it
already). This would make it unfeasible to figure out the original
password, but as you point out, it would not be any safer for MSCHAPv2
itself. The main difference here is that if someone were to use the same
password for both MSCHAPv2 and something else (which really should not
be done), only storing the hashed version of the password could prevent
the other use of the password being compromised.

> It looks like your requirements have a bug, in other words -- either
> "no password should be stored in plaintext anywhere" or "the connection
> needs to come up automatically" is impossible to satisfy.  It may be a
> small comfort to know that Windows breaks the rules too, though (by
> storing the MSCHAPv2-usable hash of a password in supposedly "protected"
> memory inside the LSA).

Well, automatic connection is not going to work, but there are ways for
making this more user friendly. Windows can use single sign-on for this
kind of authentication. Something similar could be implemented with PAM,
I would guess. I would not use the same password for loging and wireless
access, though. Instead, I would recommend storing the password in a
encrypted (e.g., with GnuPG) file and caching the key needed to decrypt
this password in memory for the session. This would be either directly
derived from the login password or asked separately and then cached in
some kind of agent (similar to ssh-agent).

If I remember correctly, there has been discussion on encrypted password
storage for NetworkManager. I don't know the details for this, so I
cannot estimate whether it would meet the requirements/desires discussed
in this thread.

Anyway, the current wpa_supplicant does not provide any internal
mechanism for this. However, password can be requested over the
ctrl_iface which would allow this kind of password daemon to be
implemented as an external program without requiring changes to
wpa_supplicant.

-- 
Jouni Malinen                                            PGP id EFC895FA



