From me  Thu Feb  1 06:21:39 2007
From: me (Jay Strauss)
Date: Thu, 1 Feb 2007 08:21:39 -0600
Subject: Weird issue: hostap, prism2.5 card, wpa2, network-manager,
	kubuntu ubuntu 6.1
Message-ID: <aabc51b60702010621o2d37b3cfs6a50f16ea261c6f3@mail.gmail.com>

Hi,

I have found an weird issue.  I'm double posting (I know this is not
proper nettiquette), but the issue seems to fall squarely between the
2 lists.

IBM Thinkpad A30
Prism 2.5 card
Kubuntu & Ubuntu 6.10 (Edgy)
package: hostap-utils v1:0.4.0-1
package: network-manager v0.6.3-2ubuntu6

hostap fails to create an adapter when loaded, unless i also install
the network-manager-gnome (maybe just network-manager (although I
never tried)).

That is, if I do a fresh install of either Ubuntu or Kubuntu, then
aptitude upgrade, install hostap-utils, blacklist orinoco_pci,
orinoco, prism2_pci, and reboot.

When the box comes up I only have eth0 and lo adapters under ifconfig.
 Then I install network-manager-gnome.  rmmod hostap_pci, hostap,
modprobe hostap, hostap_pci (or just reboot) and I get all the proper
adapters and can connect to a WPA2 ap.

It seems like something is missing from the hostap-utils distribution,
or some other weird interaction is going on.

Thanks
Jay



From est2one  Thu Feb  1 12:23:19 2007
From: est2one (J Esta)
Date: Fri, 2 Feb 2007 00:23:19 +0400
Subject: Is it possible to force BSSID?
Message-ID: <2cdedceb0702011223s2f684e63x1b0608422984ef8c@mail.gmail.com>

Hello,


First thank you for developing this wonderful software, as it allows
pain free way to connect to wireless connectivity.
I was wondering if it is possible to force wpa_supplicant to only use
a certain bssid?

Here's my configuration

Windows 2000 SP4 Celeron 466 128MB RAM
Senao NUB362 USB adapter
I've compiled the wpa_supplicant 0.5.7 with MINGW without
ctrl_interface and ndis/WMI events (these didn't seem to work). Also
turned off the blacklist as it was causing some problems. Here is the
conf file

#ctrl_interface=
#ap_scan=2
ap_scan=2
fast_reauth=1

network={
	scan_ssid=0
	ssid=""
	#ssid=
	#ssid="00:c0:02:d8:ca:b7"
	bssid=00:c0:02:d8:ca:b7
	key_mgmt=IEEE8021X
	eap=PEAP
#	phase1="include_tls_length=1 peaplabel=0"
	phase2="auth=MSCHAPV2"
	priority=0
}


Note that I'm using ap_scan=2 since ap_scan=1 creates problems with
the USB adapter.

I'm using the wpa_supplicant to connect to city wide Internet
provider. Now this provider has multiple APs with same ssid installed
usually they're too far away from each other. However, sometimes the
distant APs show up in the Atheros configuration utility. So during
these times wpa_supplicant gets confused and tries to associate with
the more distant APs. I entered the bssid option and it seemed to work
for two days however today I again saw in the log the same problem.
Below is the portion of the log. At around 08:53 it receives a new WEP
key from the AP and starts the authentication process. After finishing
it, however, it shows that it has associated with the more distant AP,
whose signal is too weak for authentication.

I looked into events.c wpa_supplicant.c and driver_ndis.c but unsure
as to what to change as it seems to ask for bssid from the driver,
even though the bssid is specified in the conf file. Perhaps it's
possible to feed the driver the bssid and tell it to connect only to
AP with that MAC address?

This also doesn't seem to be a driver issue, since the Atheros
Configuration Utility worked for days without mixing the APs. Perhaps
though they know about this issue ( since they wrote the driver ) and
have made a workaround. So perhaps it's possible to add a check in the
code if wpa_s->bssid!=drv->bssid clean the WEP keys, and restart the
connection. Right now it goes into a loop so the program has to be
restarted.

TIA

----------------------
Feb 01 08:47:59 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:47:59 - RX EAPOL - hexdump(len=8): 01 00 00 04 03 06 00 04
Feb 01 08:47:59 - EAPOL: Received EAP-Packet frame
Feb 01 08:47:59 - EAPOL: SUPP_BE entering state REQUEST
Feb 01 08:47:59 - EAPOL: getSuppRsp
Feb 01 08:47:59 - EAP: EAP entering state RECEIVED
Feb 01 08:47:59 - EAP: Received EAP-Success
Feb 01 08:47:59 - EAP: Workaround for unexpected identifier field in
EAP Success: reqId=6 lastId=5 (these are supposed to be same)
Feb 01 08:47:59 - EAP: EAP entering state SUCCESS
Feb 01 08:47:59 - CTRL-EVENT-EAP-SUCCESS EAP authentication completed
successfully
Feb 01 08:47:59 - EAPOL: SUPP_PAE entering state AUTHENTICATED
Feb 01 08:47:59 - EAPOL: SUPP_BE entering state RECEIVE
Feb 01 08:47:59 - EAPOL: SUPP_BE entering state SUCCESS
Feb 01 08:47:59 - EAPOL: SUPP_BE entering state IDLE
Feb 01 08:47:59 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:47:59 - RX EAPOL - hexdump(len=61): 01 03 00 39 01 00 0d 00
00 00 00 c3 12 43 d2 65 2d d5 4b 38 db 0c 17 97 d4 2c c9 06 58 55 57
01 3c 93 1e ad d7 e6 1d 16 99 c7 10 30 44 45 d6 bc 32 27 a1 af 1d d2
ab 02 97 68 52 ad df
Feb 01 08:47:59 - EAPOL: Received EAPOL-Key frame
Feb 01 08:47:59 - EAPOL: KEY_RX entering state KEY_RECEIVE
Feb 01 08:47:59 - EAPOL: processKey
Feb 01 08:47:59 - EAPOL: RX IEEE 802.1X ver=1 type=3 len=57 EAPOL-Key:
type=1 key_length=13 key_index=0x1
Feb 01 08:47:59 - EAPOL: EAPOL-Key key signature verified
Feb 01 08:47:59 - EAPOL: Decrypted(RC4) key - hexdump(len=13): [REMOVED]
Feb 01 08:47:59 - EAPOL: Setting dynamic WEP key: broadcast keyidx 1 len 13
Feb 01 08:47:59 - NDIS: OID_802_11_ADD_WEP - hexdump(len=25): [REMOVED]
Feb 01 08:47:59 - NDIS: Set OID 0d010113 - hexdump(len=25): [REMOVED]
Feb 01 08:47:59 - EAPOL: all required EAPOL-Key frames received
Feb 01 08:47:59 - WPA: EAPOL processing complete
Feb 01 08:47:59 - Cancelling authentication timeout
Feb 01 08:47:59 - State: COMPLETED -> COMPLETED
Feb 01 08:47:59 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:47:59 - RX EAPOL - hexdump(len=61): 01 03 00 39 01 00 0d 00
00 00 00 c3 12 43 d3 6f 4d 20 08 21 21 07 99 ff e1 1c 26 e6 67 53 34
80 2e 3f 11 75 ca 58 d8 6a 81 e3 94 95 8d 19 40 78 82 93 3c 3e 35 93
6a ff 30 f1 2b 7f 54
Feb 01 08:47:59 - EAPOL: Received EAPOL-Key frame
Feb 01 08:47:59 - EAPOL: KEY_RX entering state KEY_RECEIVE
Feb 01 08:47:59 - EAPOL: processKey
Feb 01 08:47:59 - EAPOL: RX IEEE 802.1X ver=1 type=3 len=57 EAPOL-Key:
type=1 key_length=13 key_index=0x80
Feb 01 08:47:59 - EAPOL: EAPOL-Key key signature verified
Feb 01 08:47:59 - EAPOL: Decrypted(RC4) key - hexdump(len=13): [REMOVED]
Feb 01 08:47:59 - EAPOL: Setting dynamic WEP key: unicast keyidx 0 len 13
Feb 01 08:47:59 - NDIS: OID_802_11_ADD_WEP - hexdump(len=25): [REMOVED]
Feb 01 08:47:59 - NDIS: Set OID 0d010113 - hexdump(len=25): [REMOVED]
Feb 01 08:47:59 - EAPOL: all required EAPOL-Key frames received
Feb 01 08:47:59 - WPA: EAPOL processing complete
Feb 01 08:47:59 - Cancelling authentication timeout
Feb 01 08:47:59 - State: COMPLETED -> COMPLETED
Feb 01 08:48:29 - EAPOL: authWhile --> 0
Feb 01 08:48:59 - EAPOL: idleWhile --> 0
Feb 01 08:53:04 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:53:04 - RX EAPOL - hexdump(len=9): 01 00 00 05 01 00 00 05 01
Feb 01 08:53:04 - EAPOL: Received EAP-Packet frame
Feb 01 08:53:04 - EAPOL: SUPP_PAE entering state RESTART
Feb 01 08:53:04 - EAP: EAP entering state INITIALIZE
Feb 01 08:53:04 - EAP: maintaining EAP method data for fast reauthentication
Feb 01 08:53:04 - EAP: EAP entering state IDLE
Feb 01 08:53:04 - EAPOL: SUPP_PAE entering state AUTHENTICATING
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state REQUEST
Feb 01 08:53:04 - EAPOL: getSuppRsp
Feb 01 08:53:04 - EAP: EAP entering state RECEIVED
Feb 01 08:53:04 - EAP: Received EAP-Request id=0 method=1 vendor=0
vendorMethod=0
Feb 01 08:53:04 - EAP: EAP entering state IDENTITY
Feb 01 08:53:04 - CTRL-EVENT-EAP-STARTED EAP authentication started
Feb 01 08:53:04 - EAP: EAP-Request Identity data - hexdump_ascii(len=0):
Feb 01 08:53:04 - EAP: using real identity - hexdump_ascii(len=8):
     6f 6c 6b 30 30 38 39 33                           [removed]
Feb 01 08:53:04 - EAP: EAP entering state SEND_RESPONSE
Feb 01 08:53:04 - EAP: EAP entering state IDLE
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RESPONSE
Feb 01 08:53:04 - EAPOL: txSuppRsp
Feb 01 08:53:04 - TX EAPOL - hexdump(len=17): 01 00 00 0d 02 00 00 0d
01 6f 6c 6b 30 30 38 39 33
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RECEIVE
Feb 01 08:53:04 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:53:04 - RX EAPOL - hexdump(len=10): 01 00 00 06 01 01 00 06 19 20
Feb 01 08:53:04 - EAPOL: Received EAP-Packet frame
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state REQUEST
Feb 01 08:53:04 - EAPOL: getSuppRsp
Feb 01 08:53:04 - EAP: EAP entering state RECEIVED
Feb 01 08:53:04 - EAP: Received EAP-Request id=1 method=25 vendor=0
vendorMethod=0
Feb 01 08:53:04 - EAP: EAP entering state GET_METHOD
Feb 01 08:53:04 - EAP: Using previous method data for fast re-authentication
Feb 01 08:53:04 - EAP: Initialize selected EAP method: vendor 0 method 25 (PEAP)
Feb 01 08:53:04 - CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected
Feb 01 08:53:04 - EAP: EAP entering state METHOD
Feb 01 08:53:04 - SSL: Received packet(len=6) - Flags 0x20
Feb 01 08:53:04 - EAP-PEAP: Start (server ver=0, own ver=0)
Feb 01 08:53:04 - EAP-PEAP: Using PEAP version 0
Feb 01 08:53:04 - SSL: (where=0x10 ret=0x1)
Feb 01 08:53:04 - SSL: (where=0x1001 ret=0x1)
Feb 01 08:53:04 - SSL: SSL_connect:before/connect initialization
Feb 01 08:53:04 - SSL: (where=0x1001 ret=0x1)
Feb 01 08:53:04 - SSL: SSL_connect:SSLv3 write client hello A
Feb 01 08:53:04 - SSL: (where=0x1002 ret=0xffffffff)
Feb 01 08:53:04 - SSL: SSL_connect:error in SSLv3 read server hello A
Feb 01 08:53:04 - SSL: SSL_connect - want more data
Feb 01 08:53:04 - SSL: 120 bytes pending from ssl_out
Feb 01 08:53:04 - SSL: 120 bytes left to be sent out (of total 120 bytes)
Feb 01 08:53:04 - EAP: method process -> ignore=FALSE
methodState=MAY_CONT decision=FAIL
Feb 01 08:53:04 - EAP: EAP entering state SEND_RESPONSE
Feb 01 08:53:04 - EAP: EAP entering state IDLE
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RESPONSE
Feb 01 08:53:04 - EAPOL: txSuppRsp
Feb 01 08:53:04 - TX EAPOL - hexdump(len=130): 01 00 00 7e 02 01 00 7e
19 00 16 03 01 00 73 01 00 00 6f 03 01 45 c1 72 30 a2 9e 34 d7 64 fb
f0 7a 3e 2e d2 b9 d8 66 d5 92 a0 f2 01 4f 5b d6 53 df 80 05 b5 ed 20
a9 08 00 00 ec e6 b1 72 ec d2 e6 18 73 07 42 73 8d 73 70 2d 4a 3f 97
36 eb 5b 99 bb 34 92 01 e8 00 28 00 39 00 38 00 35 00 16 00 13 00 0a
00 33 00 32 00 2f 00 07 00 05 00 04 00 15 00 12 00 09 00 14 00 11 00
08 00 06 00 03 01 00
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RECEIVE
Feb 01 08:53:04 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:53:04 - RX EAPOL - hexdump(len=136): 01 00 00 84 01 02 00 84
19 80 00 00 00 7a 16 03 01 00 4a 02 00 00 46 03 01 45 c1 70 b5 c0 18
5a f8 01 d0 6b b0 53 db bd 38 62 22 13 fb bc a5 0a a6 ef a8 30 1f 50
19 30 39 20 a9 08 00 00 ec e6 b1 72 ec d2 e6 18 73 07 42 73 8d 73 70
2d 4a 3f 97 36 eb 5b 99 bb 34 92 01 e8 00 04 00 14 03 01 00 01 01 16
03 01 00 20 ce cc 68 39 fd 52 60 41 b0 fa 70 62 5e 22 7b 34 6c 0e f6
f8 78 df 39 4b 30 da 9f e6 68 04 b0 11
Feb 01 08:53:04 - EAPOL: Received EAP-Packet frame
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state REQUEST
Feb 01 08:53:04 - EAPOL: getSuppRsp
Feb 01 08:53:04 - EAP: EAP entering state RECEIVED
Feb 01 08:53:04 - EAP: Received EAP-Request id=2 method=25 vendor=0
vendorMethod=0
Feb 01 08:53:04 - EAP: EAP entering state METHOD
Feb 01 08:53:04 - SSL: Received packet(len=132) - Flags 0x80
Feb 01 08:53:04 - SSL: TLS Message Length: 122
Feb 01 08:53:04 - SSL: (where=0x1001 ret=0x1)
Feb 01 08:53:04 - SSL: SSL_connect:SSLv3 read server hello A
Feb 01 08:53:04 - SSL: (where=0x1001 ret=0x1)
Feb 01 08:53:04 - SSL: SSL_connect:SSLv3 read finished A
Feb 01 08:53:04 - SSL: (where=0x1001 ret=0x1)
Feb 01 08:53:04 - SSL: SSL_connect:SSLv3 write change cipher spec A
Feb 01 08:53:04 - SSL: (where=0x1001 ret=0x1)
Feb 01 08:53:04 - SSL: SSL_connect:SSLv3 write finished A
Feb 01 08:53:04 - SSL: (where=0x1001 ret=0x1)
Feb 01 08:53:04 - SSL: SSL_connect:SSLv3 flush data
Feb 01 08:53:04 - SSL: (where=0x20 ret=0x1)
Feb 01 08:53:04 - SSL: (where=0x1002 ret=0x1)
Feb 01 08:53:04 - SSL: 43 bytes pending from ssl_out
Feb 01 08:53:04 - OpenSSL: tls_connection_handshake - Failed to read
possible Application Data error:00000000:lib(0):func(0):reason(0)
Feb 01 08:53:04 - SSL: 43 bytes left to be sent out (of total 43 bytes)
Feb 01 08:53:04 - EAP-PEAP: TLS done, proceed to Phase 2
Feb 01 08:53:04 - EAP-PEAP: using label 'client EAP encryption' in key
derivation
Feb 01 08:53:04 - EAP-PEAP: Derived key - hexdump(len=64): [REMOVED]
Feb 01 08:53:04 - EAP-PEAP: Workaround - allow outer EAP-Success to
terminate PEAP resumption
Feb 01 08:53:04 - EAP: method process -> ignore=FALSE
methodState=MAY_CONT decision=COND_SUCC
Feb 01 08:53:04 - EAP: EAP entering state SEND_RESPONSE
Feb 01 08:53:04 - EAP: EAP entering state IDLE
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RESPONSE
Feb 01 08:53:04 - EAPOL: txSuppRsp
Feb 01 08:53:04 - TX EAPOL - hexdump(len=53): 01 00 00 31 02 02 00 31
19 00 14 03 01 00 01 01 16 03 01 00 20 df 42 02 8e 95 0a 1d 37 02 45
2b ed 85 b7 b1 2e 5c 57 a5 75 dd 48 9b e1 6b 2d ac af 24 2b f0 2f
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RECEIVE
Feb 01 08:53:04 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:53:04 - RX EAPOL - hexdump(len=42): 01 00 00 26 01 05 00 26
19 00 17 03 01 00 1b d2 b6 93 3d ad a3 9c c4 3e 46 7f a5 ed 83 9e 8a
e9 17 3a ca 05 3a b1 ac 8f c4 39
Feb 01 08:53:04 - EAPOL: Received EAP-Packet frame
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state REQUEST
Feb 01 08:53:04 - EAPOL: getSuppRsp
Feb 01 08:53:04 - EAP: EAP entering state RECEIVED
Feb 01 08:53:04 - EAP: Received EAP-Request id=5 method=25 vendor=0
vendorMethod=0
Feb 01 08:53:04 - EAP: EAP entering state METHOD
Feb 01 08:53:04 - SSL: Received packet(len=38) - Flags 0x00
Feb 01 08:53:04 - EAP-PEAP: received 32 bytes encrypted data for Phase 2
Feb 01 08:53:04 - EAP-PEAP: Decrypted Phase 2 EAP - hexdump(len=11):
01 05 00 0b 21 80 03 00 02 00 01
Feb 01 08:53:04 - EAP-PEAP: received Phase 2: code=1 identifier=5 length=11
Feb 01 08:53:04 - EAP-PEAP: Phase 2 Request: type=33
Feb 01 08:53:04 - EAP-TLV: Received TLVs - hexdump(len=6): 80 03 00 02 00 01
Feb 01 08:53:04 - EAP-TLV: Result TLV - hexdump(len=2): 00 01
Feb 01 08:53:04 - EAP-TLV: TLV Result - Success - EAP-TLV/Phase2 Completed
Feb 01 08:53:04 - EAP-PEAP: Encrypting Phase 2 data - hexdump(len=11): [REMOVED]
Feb 01 08:53:04 - EAP: method process -> ignore=FALSE methodState=DONE
decision=UNCOND_SUCC
Feb 01 08:53:04 - EAP: EAP entering state SEND_RESPONSE
Feb 01 08:53:04 - EAP: EAP entering state IDLE
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RESPONSE
Feb 01 08:53:04 - EAPOL: txSuppRsp
Feb 01 08:53:04 - TX EAPOL - hexdump(len=42): 01 00 00 26 02 05 00 26
19 00 17 03 01 00 1b 4e 69 13 7d 0f 30 e7 38 46 a5 0a ec a1 a2 bf a4
ee 26 be 7a 8d ee 91 78 3e 6f 3a
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RECEIVE
Feb 01 08:53:04 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:53:04 - RX EAPOL - hexdump(len=8): 01 00 00 04 03 06 00 04
Feb 01 08:53:04 - EAPOL: Received EAP-Packet frame
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state REQUEST
Feb 01 08:53:04 - EAPOL: getSuppRsp
Feb 01 08:53:04 - EAP: EAP entering state RECEIVED
Feb 01 08:53:04 - EAP: Received EAP-Success
Feb 01 08:53:04 - EAP: Workaround for unexpected identifier field in
EAP Success: reqId=6 lastId=5 (these are supposed to be same)
Feb 01 08:53:04 - EAP: EAP entering state SUCCESS
Feb 01 08:53:04 - CTRL-EVENT-EAP-SUCCESS EAP authentication completed
successfully
Feb 01 08:53:04 - EAPOL: SUPP_PAE entering state AUTHENTICATED
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state RECEIVE
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state SUCCESS
Feb 01 08:53:04 - EAPOL: SUPP_BE entering state IDLE
Feb 01 08:53:04 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:53:04 - RX EAPOL - hexdump(len=61): 01 03 00 39 01 00 0d 00
00 00 00 c3 12 8b 3f 4d 33 50 68 a8 a0 72 72 24 c7 4c e7 3f 35 dd d5
01 2a 4d a8 8e d0 ea 71 48 dc a9 bd f1 6e db 4b 87 e7 d2 5c f2 8b 5e
39 86 2f 4e 82 8c 2b
Feb 01 08:53:04 - EAPOL: Received EAPOL-Key frame
Feb 01 08:53:04 - EAPOL: KEY_RX entering state KEY_RECEIVE
Feb 01 08:53:04 - EAPOL: processKey
Feb 01 08:53:04 - EAPOL: RX IEEE 802.1X ver=1 type=3 len=57 EAPOL-Key:
type=1 key_length=13 key_index=0x1
Feb 01 08:53:04 - EAPOL: EAPOL-Key key signature verified
Feb 01 08:53:04 - EAPOL: Decrypted(RC4) key - hexdump(len=13): [REMOVED]
Feb 01 08:53:04 - EAPOL: Setting dynamic WEP key: broadcast keyidx 1 len 13
Feb 01 08:53:04 - NDIS: OID_802_11_ADD_WEP - hexdump(len=25): [REMOVED]
Feb 01 08:53:04 - NDIS: Set OID 0d010113 - hexdump(len=25): [REMOVED]
Feb 01 08:53:04 - EAPOL: all required EAPOL-Key frames received
Feb 01 08:53:04 - WPA: EAPOL processing complete
Feb 01 08:53:04 - Cancelling authentication timeout
Feb 01 08:53:04 - State: COMPLETED -> COMPLETED
Feb 01 08:53:04 - RX EAPOL from 00:c0:02:d8:ca:b7
Feb 01 08:53:04 - RX EAPOL - hexdump(len=61): 01 03 00 39 01 00 0d 00
00 00 00 c3 12 8b 40 dd 17 17 ce aa f4 76 bc 13 29 28 09 13 b1 fd c9
80 57 1c 09 17 83 81 27 d9 e7 02 50 42 48 09 ef 9a 29 b2 a3 8b b5 b0
e2 ba ba 09 7e 0a ba
Feb 01 08:53:04 - EAPOL: Received EAPOL-Key frame
Feb 01 08:53:04 - EAPOL: KEY_RX entering state KEY_RECEIVE
Feb 01 08:53:04 - EAPOL: processKey
Feb 01 08:53:04 - EAPOL: RX IEEE 802.1X ver=1 type=3 len=57 EAPOL-Key:
type=1 key_length=13 key_index=0x80
Feb 01 08:53:04 - EAPOL: EAPOL-Key key signature verified
Feb 01 08:53:04 - EAPOL: Decrypted(RC4) key - hexdump(len=13): [REMOVED]
Feb 01 08:53:04 - EAPOL: Setting dynamic WEP key: unicast keyidx 0 len 13
Feb 01 08:53:04 - NDIS: OID_802_11_ADD_WEP - hexdump(len=25): [REMOVED]
Feb 01 08:53:04 - NDIS: Set OID 0d010113 - hexdump(len=25): [REMOVED]
Feb 01 08:53:04 - EAPOL: all required EAPOL-Key frames received
Feb 01 08:53:04 - WPA: EAPOL processing complete
Feb 01 08:53:04 - Cancelling authentication timeout
Feb 01 08:53:04 - State: COMPLETED -> COMPLETED
Feb 01 08:53:33 - EAPOL: authWhile --> 0
Feb 01 08:54:03 - EAPOL: idleWhile --> 0
Feb 01 08:58:14 - NDIS: association information - hexdump(len=0):
Feb 01 08:58:14 - NDIS: too short association information
Feb 01 08:58:14 - State: COMPLETED -> ASSOCIATED
Feb 01 08:58:14 - Associated to a new BSS: BSSID=00:c0:02:d8:ca:ac
Feb 01 08:58:14 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:14 - NDIS: Set OID 0d010114 - hexdump(len=4): [REMOVED]
Feb 01 08:58:14 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:14 - NDIS: Set OID 0d010114 - hexdump(len=4): [REMOVED]
Feb 01 08:58:14 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:14 - NDIS: Set OID 0d010114 - hexdump(len=4): [REMOVED]
Feb 01 08:58:14 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:14 - NDIS: Set OID 0d010114 - hexdump(len=4): [REMOVED]
Feb 01 08:58:14 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:14 - No network configuration found for the current AP
Feb 01 08:58:14 - State: ASSOCIATED -> DISCONNECTED
Feb 01 08:58:14 - NDIS: Set OID 0d010102 - hexdump(len=36): [REMOVED]
Feb 01 08:58:14 - No keys have been configured - skip key clearing
Feb 01 08:58:14 - EAPOL: External notification - portEnabled=0
Feb 01 08:58:14 - EAPOL: SUPP_PAE entering state DISCONNECTED
Feb 01 08:58:14 - EAPOL: KEY_RX entering state NO_KEY_RECEIVE
Feb 01 08:58:14 - EAPOL: SUPP_BE entering state INITIALIZE
Feb 01 08:58:14 - EAP: EAP entering state DISABLED
Feb 01 08:58:14 - EAPOL: External notification - portValid=0
Feb 01 08:58:15 - ndis_get_oid: oid=0xd010101 len (6) failed
Feb 01 08:58:20 - CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
Feb 01 08:58:20 - ndis_get_oid: oid=0xd010101 len (6) failed
Feb 01 08:58:20 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:20 - NDIS: Set OID 0d010114 - hexdump(len=4): [REMOVED]
Feb 01 08:58:20 - ndis_get_oid: oid=0xd010101 len (6) failed
Feb 01 08:58:20 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:20 - NDIS: Set OID 0d010114 - hexdump(len=4): [REMOVED]
Feb 01 08:58:20 - ndis_get_oid: oid=0xd010101 len (6) failed
Feb 01 08:58:20 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:20 - NDIS: Set OID 0d010114 - hexdump(len=4): [REMOVED]
Feb 01 08:58:20 - ndis_get_oid: oid=0xd010101 len (6) failed
Feb 01 08:58:20 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:20 - NDIS: Set OID 0d010114 - hexdump(len=4): [REMOVED]
Feb 01 08:58:20 - NDIS: Set OID 0d01011e - hexdump(len=16): [REMOVED]
Feb 01 08:58:20 - State: DISCONNECTED -> DISCONNECTED
Feb 01 08:58:20 - EAPOL: External notification - portEnabled=0
Feb 01 08:58:20 - EAPOL: External notification - portValid=0
Feb 01 08:58:21 - ndis_get_oid: oid=0xd010101 len (6) failed
Feb 01 08:58:22 - ndis_get_oid: oid=0xd010101 len (6) failed
Feb 01 08:58:23 - ndis_get_oid: oid=0xd010101 len (6) failed
Feb 01 08:58:24 - ndis_get_oid: oid=0xd010101 len (6) failed
And the last message repeats till 10:00 when I restarted the program
------------------------------------------



From salatiel.filho  Fri Feb  2 04:05:24 2007
From: salatiel.filho (Salatiel Filho)
Date: Fri, 2 Feb 2007 09:05:24 -0300
Subject: Doubt Ad hoc mode
Message-ID: <beb91d720702020405m5f3ea7bu70e6d81da306e45@mail.gmail.com>

Hi , i  am trying to make a adhoc network between my linux pc and a windows pc.
I have wpa_supplicant.conf similar to this:

 network={
     ssid="adhoc"
     mode=1
     proto=WPA
     key_mgmt=WPA-NONE
     pairwise=NONE
     group=CCMP
     psk="some-key"
 }


Well , the problem is:
When my linux start , it starts automatically my eth1 wireless
interface  [ipw3945] and start  wpa_supplicant with the correct
parameters. If the windows machine is already ON the connection is
established successfully. But if the windows machine is down when my
machine starts , even after i power on the windows i do not get
connection. I need to kill wpa_supplicant and restart it. Is there a
way to wpa_supplicant keep trying to connect until it finds the
windows machine ? My linux machine is a server and it is not good need
to go there every time i reboot windows or something like it.

thanks ...
-- 
[]'s
Salatiel

"O maior prazer do inteligente ? bancar o  idiota
   diante de um  idiota que banca o inteligente".



From jkmaline  Sat Feb  3 17:11:55 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 3 Feb 2007 17:11:55 -0800
Subject: Doubt Ad hoc mode
In-Reply-To: <beb91d720702020405m5f3ea7bu70e6d81da306e45@mail.gmail.com>
References: <beb91d720702020405m5f3ea7bu70e6d81da306e45@mail.gmail.com>
Message-ID: <20070204011155.GA6636@jm.kir.nu>

On Fri, Feb 02, 2007 at 09:05:24AM -0300, Salatiel Filho wrote:

> Hi , i  am trying to make a adhoc network between my linux pc and a windows pc.
> I have wpa_supplicant.conf similar to this:
> 
>  network={
>      ssid="adhoc"
>      mode=1
>      proto=WPA
>      key_mgmt=WPA-NONE

> When my linux start , it starts automatically my eth1 wireless
> interface  [ipw3945] and start  wpa_supplicant with the correct
> parameters. If the windows machine is already ON the connection is
> established successfully. But if the windows machine is down when my
> machine starts , even after i power on the windows i do not get
> connection. I need to kill wpa_supplicant and restart it. Is there a
> way to wpa_supplicant keep trying to connect until it finds the
> windows machine ? My linux machine is a server and it is not good need
> to go there every time i reboot windows or something like it.

In WPA-NONE mode, wpa_supplicant is only configuring the key and
everything else is done by the driver. In other words, this question
should be directed to the ipw3945 maintainers.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sun Feb  4 12:05:47 2007
From: jkmaline (Jouni Malinen)
Date: Sun, 4 Feb 2007 12:05:47 -0800
Subject: Is it possible to force BSSID?
In-Reply-To: <2cdedceb0702011223s2f684e63x1b0608422984ef8c@mail.gmail.com>
References: <2cdedceb0702011223s2f684e63x1b0608422984ef8c@mail.gmail.com>
Message-ID: <20070204200547.GF6632@jm.kir.nu>

On Fri, Feb 02, 2007 at 12:23:19AM +0400, J Esta wrote:

> I was wondering if it is possible to force wpa_supplicant to only use
> a certain bssid?

Should be.

> Note that I'm using ap_scan=2 since ap_scan=1 creates problems with
> the USB adapter.

Currently, BSSID is only forced for ap_scan=1 mode, i.e., in ap_scan=2
the bssid value in configuration may end up being ignored. I have not
tested this, but it might be enough add following line into 
wpa_supplicant_associate() to do this for ap_scan=2:

if (ssid->bssid_set)
	params.bssid = ssid->bssid;

This would be added to the !bss case which is used in ap_scan=2:

    if (bss) {
	params.bssid = bss->bssid;
	params.ssid = bss->ssid;
	params.ssid_len = bss->ssid_len;
	params.freq = bss->freq;
    } else {
	/* add here.. */
	if (ssid->bssid_set)
	    params.bssid = ssid->bssid;
	params.ssid = ssid->ssid;
	params.ssid_len = ssid->ssid_len;
    }

-- 
Jouni Malinen                                            PGP id EFC895FA



From jobi  Mon Feb  5 12:44:32 2007
From: jobi (Johan Bilien)
Date: Mon, 5 Feb 2007 21:44:32 +0100
Subject: Prism card not recognized
Message-ID: <20070205204431.GB30495@via.ecp.fr>

Hi,

I've been trying to remotely help someone to setup her PCMCIA wireless
card and connect to the WPA network. The card uses by default the
orinoco_cs driver, which will not work with wpa_supplicant if I
understand correctly. So I told her to remove the orinoco driver hoping
the hostap driver would be picked. But no driver is loaded. modprobing
hostap_cs works fine but the card is still not available (listed as no
driver is lspcmcia).

The card is apparently a bit of an exotic one:

Socket 0 Device 0:      [-- no driver --]       (bus ID: 0.0)
        Configuration:  state: on
        Product Name:   AboveCable ACPC2010-11/PCMCIA Card Version 01.02
        Identification: manf_id: 0x0156 card_id: 0x0002
                        function: 6 (network)
                        prod_id(1): "AboveCable" (0xfead109e)
                        prod_id(2): "ACPC2010-11/PCMCIA Card"
(0x0190b27e)
                        prod_id(3): "Version 01.02" (0x4b74baa0)
                        prod_id(4): --- (---)


>From what I read in hostap_cs.c, the card has the same ID as the
intersil cards, which seems to confirm it would be supported, but if I
understand correctly only the card with this ID who are listed as
manufactured by Intersil or INTERSIL will be drived by hostap.

Am I correct? Would adding something like:

 PCMCIA_DEVICE_MANF_CARD_PROD_ID1(0x0156, 0x0002, "AboveCable",
                                         0xfead109e),

solve the problem? Is there a way to override the driver's list of
supported hardware without recompiling the module?

Thanks,

BR
-- 
Johan Bilien
<jobi at via.ecp.fr>



From ramprasad.rajendran  Mon Feb  5 23:43:03 2007
From: ramprasad.rajendran (ramprasad.rajendran at wipro.com)
Date: Tue, 6 Feb 2007 13:13:03 +0530
Subject: 4Way Handshake Failure
Message-ID: <52E5BF168B8CA143A198D856F73D5A9D0F6B28@blr-m3-msg.wipro.com>


Hi,

I am using EAP-FAST as the authentication on a custom built board.
Authentication suceeds, but the 4 Way Handshake Fails.

I am using a Linksys AP(WRT54G) and wpa_supplicant 0.5.7 version.
I've made some changes to port it to our platform.(OS, timer and the
configuration params, removed certificate processing)

Attached is the dump from the sniffer. Any reasons as to why?

----
ram



The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. 

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
 
www.wipro.com
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: packet_dmp.txt
Url: http://lists.shmoo.com/pipermail/hostap/attachments/20070206/368c6dcc/attachment.txt 


From rjc  Tue Feb  6 09:06:41 2007
From: rjc (Bob Carlson)
Date: Tue, 6 Feb 2007 10:06:41 -0700
Subject: APs and multiple BSSID support (OT?)
In-Reply-To: <2cdedceb0702011223s2f684e63x1b0608422984ef8c@mail.gmail.com>
Message-ID: <20070206170647.89C5CBF8E@smtp-auth.no-ip.com>

Perhaps this is a little OT, but this seems like a good community to which
to address this question. I'm using wpa_s in a Wifi client device that acts
like multiple virtual clients. One key problem is APs that support multiple
SSIDs. Atheros calls these virtual APs. Cisco doesn't call them anything,
they just refer to "multiple SSIDs". Unlike the Atheros code that I am
familiar with, Cisco allows multiple SSIDs on a single BSSID, but you can
enable multiple BSSIDs.

In the Atheros case, when more than one BSSID is needed, they generate it
using the private mac address space. They set the 0x02 bit in byte 0 of the
address to make it private and then add 1, 2 or 3 to the 0x0c bits in byte
0 to make up to 3 additional addresses. So you would have
06:06:C7:1F:0C:EC, and 00:06:C7:1F:0C:EC for example.

Cisco uses a more straightforward approach, just adding 1 to byte 5.
Presumably this means that they allocate many mac addresses to each device.
The device I am familiar with supports 8 BSSIDs and so would use the 0x07
bits in byte 5 for it's BSSIDs. For example, 2 BSSIDs would be
00:16:46:B8:97:60 and 00:16:46:B8:97:61.

Does anyone know of any other different methods of generating multiple
BSSID?

Thanks, Bob




From bunny_shi2004  Tue Feb  6 19:37:03 2007
From: bunny_shi2004 (bunny shi)
Date: Wed, 7 Feb 2007 11:37:03 +0800 (CST)
Subject: any plan to support EAP-WSC in wpa supplicant?
Message-ID: <837538.88279.qm@web15803.mail.cnb.yahoo.com>

Hi, Jouni Malinen:
   current wpa supplicant does not support EAP-WSC, is there any plan to support EAP-WSC in wpa supplicant? 
   
  Thanks
  Bunny

 		
---------------------------------
????????-3.5G???20M??? 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070207/7fac1f61/attachment.htm 


From jkmaline  Tue Feb  6 19:53:38 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 6 Feb 2007 19:53:38 -0800
Subject: any plan to support EAP-WSC in wpa supplicant?
In-Reply-To: <837538.88279.qm@web15803.mail.cnb.yahoo.com>
References: <837538.88279.qm@web15803.mail.cnb.yahoo.com>
Message-ID: <20070207035338.GD6702@jm.kir.nu>

On Wed, Feb 07, 2007 at 11:37:03AM +0800, bunny shi wrote:

>    current wpa supplicant does not support EAP-WSC, is there any plan to support EAP-WSC in wpa supplicant? 

I don't have any concrete plans for this, but I would expect that
support for it would be added at some point. There are already couple of
WPS implementations based on wpa_supplicant, but none of the freely
available ones (or one) are in a good enough state to be merged into the
main wpa_supplicant distribution without major cleanup.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Feb  6 20:01:27 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 6 Feb 2007 20:01:27 -0800
Subject: APs and multiple BSSID support (OT?)
In-Reply-To: <20070206170647.89C5CBF8E@smtp-auth.no-ip.com>
References: <2cdedceb0702011223s2f684e63x1b0608422984ef8c@mail.gmail.com>
	<20070206170647.89C5CBF8E@smtp-auth.no-ip.com>
Message-ID: <20070207040127.GE6702@jm.kir.nu>

On Tue, Feb 06, 2007 at 10:06:41AM -0700, Bob Carlson wrote:
> Perhaps this is a little OT, but this seems like a good community to which
> to address this question. I'm using wpa_s in a Wifi client device that acts
> like multiple virtual clients. One key problem is APs that support multiple
> SSIDs. Atheros calls these virtual APs. Cisco doesn't call them anything,
> they just refer to "multiple SSIDs". Unlike the Atheros code that I am
> familiar with, Cisco allows multiple SSIDs on a single BSSID, but you can
> enable multiple BSSIDs.

Could you please describe the problem in bit more detail than it just
existing.. Rest of your email seems to be about the AP side, but if I
understood correctly, the problem you are describing is for the virtual
client device.

> In the Atheros case, when more than one BSSID is needed, they generate it
> using the private mac address space.

> Cisco uses a more straightforward approach, just adding 1 to byte 5.

> Does anyone know of any other different methods of generating multiple
> BSSID?

Yes.. Depending on the hw design, one could use any of the BSSID bits
(apart from local and broadcast) to generate new addresses. Local
address space makes it easier to get large number of addresses, but if
one happens to have a large space of addresses available, it would be
possible to allocate set of addresses for each device (though, IEEE
might get somewhat unwilling to allocate more OUIs for this kind of
address use if large portion of the addresses are not really used).

Different designs might support list of arbitrary addresses or some sort
of bitmask on the addresses, so at least in theory, the sets of
addresses could be quite diverse.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Feb  6 20:05:15 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 6 Feb 2007 20:05:15 -0800
Subject: 4Way Handshake Failure
In-Reply-To: <52E5BF168B8CA143A198D856F73D5A9D0F6B28@blr-m3-msg.wipro.com>
References: <52E5BF168B8CA143A198D856F73D5A9D0F6B28@blr-m3-msg.wipro.com>
Message-ID: <20070207040515.GF6702@jm.kir.nu>

On Tue, Feb 06, 2007 at 01:13:03PM +0530, ramprasad.rajendran at wipro.com wrote:

> I am using EAP-FAST as the authentication on a custom built board.
> Authentication suceeds, but the 4 Way Handshake Fails.

Which authentication server are you using?

> I've made some changes to port it to our platform.(OS, timer and the
> configuration params, removed certificate processing)

What exactly do you mean by removing certificate processing? With TLS
implementation are you using?

> Attached is the dump from the sniffer. Any reasons as to why?

That file did not include any EAP-FAST messages.. Would it be possible
to get debug log from wpa_supplicant showing this issue?

-- 
Jouni Malinen                                            PGP id EFC895FA



From proski  Tue Feb  6 20:05:47 2007
From: proski (Pavel Roskin)
Date: Tue, 06 Feb 2007 23:05:47 -0500
Subject: Prism card not recognized
In-Reply-To: <20070205204431.GB30495@via.ecp.fr>
References: <20070205204431.GB30495@via.ecp.fr>
Message-ID: <1170821147.11150.21.camel@dv>

On Mon, 2007-02-05 at 21:44 +0100, Johan Bilien wrote:
> Am I correct? Would adding something like:
> 
>  PCMCIA_DEVICE_MANF_CARD_PROD_ID1(0x0156, 0x0002, "AboveCable",
>                                          0xfead109e),
> 
> solve the problem?

Yes, I think so.

>  Is there a way to override the driver's list of
> supported hardware without recompiling the module?

I believe a patch that would allow that for PCMCIA devices was posted
but never applied to the official kernel.

-- 
Regards,
Pavel Roskin




From craigwharding  Tue Feb  6 20:14:10 2007
From: craigwharding (Craig Harding)
Date: Wed, 7 Feb 2007 00:44:10 -0330
Subject: timeout var for conf file?
Message-ID: <be5b6b210702062014u560e4a38lc9a6435cbe6a83b4@mail.gmail.com>

Hi, I have multiple networks in my conf file and I was wondering if there is
a timeout variable that I can put in my network { } directive so that I can
specify certain timeouts (in seconds) for certain networks. For example if I
know I will defintely not connect to my highest priority network in my conf
file (because I am hundreds of miles away) it will take approximately 30
seconds (I'm guessing) to try to associate with that SSID and then it will
try the next network and then next network (and so on) until it connects
successfully, giving a long timeout for each separate network..

I tried to find the documentation on the website but the developer doc link
does not work.

Craig.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070207/4d084151/attachment.htm 


From rjc  Tue Feb  6 22:05:50 2007
From: rjc (Bob Carlson)
Date: Tue, 6 Feb 2007 23:05:50 -0700
Subject: APs and multiple BSSID support (OT?)
In-Reply-To: <20070207040127.GE6702@jm.kir.nu>
Message-ID: <20070207060601.C5A8ABF03@smtp-auth.no-ip.com>

> -----Original Message-----
> From: hostap-bounces+bob.carlson=sigpro.com at shmoo.com [mailto:hostap-
> bounces+bob.carlson=sigpro.com at shmoo.com] On Behalf Of Jouni Malinen
> Sent: Tuesday, February 06, 2007 9:01 PM
> To: hostap at shmoo.com
> Subject: Re: APs and multiple BSSID support (OT?)
> 
> On Tue, Feb 06, 2007 at 10:06:41AM -0700, Bob Carlson wrote:
> > Perhaps this is a little OT, but this seems like a good community to
> which
> > to address this question. I'm using wpa_s in a Wifi client device that
> acts
> > like multiple virtual clients. One key problem is APs that support
> multiple
> > SSIDs. Atheros calls these virtual APs. Cisco doesn't call them
> anything,
> > they just refer to "multiple SSIDs". Unlike the Atheros code that I am
> > familiar with, Cisco allows multiple SSIDs on a single BSSID, but you
> can
> > enable multiple BSSIDs.
> 
> Could you please describe the problem in bit more detail than it just
> existing.. Rest of your email seems to be about the AP side, but if I
> understood correctly, the problem you are describing is for the virtual
> client device.

I am trying to make hardware designed to be either an AP with virtual APs
or a single client into a client that can act as if it is two virtual
clients. The client type functions in the hardware are not fully suited to
this. For example, the source address is used to select the key for
hardware decryption, so I do software decryption.

The problem with mult. SSID/BSSIDs is that there is no way to make the
hardware aware of 2 different BSSIDs for things like timing derived from
the beacons. I believe I can connect to two different BSSIDs if they are
supported by the same physical AP. Beacons from the same physical AP will
share many attributes such as timing, channel, rates, etc.

That's a long winded explanation for a simple need. Because I can only
successfully connect to 2 different BSSIDs if they are supported by the
same physical AP, I would like a way to determine that. The Atheros and
Cisco address methods allow me to do that. However, if other vendors choose
their multiple BSSIDs differently (I have seen a proposal that the BSSID be
generated randomly in the local space) I don't see any way to determine
"same physical AP."

If there is another way to determine whether 2 beacons or probe responses
with different BSSIDs come from the same physical AP, I would love to hear
of it.
 
> > In the Atheros case, when more than one BSSID is needed, they generate
> it
> > using the private mac address space.
> 
> > Cisco uses a more straightforward approach, just adding 1 to byte 5.
> 
> > Does anyone know of any other different methods of generating multiple
> > BSSID?
> 
> Yes.. Depending on the hw design, one could use any of the BSSID bits
> (apart from local and broadcast) to generate new addresses. Local
> address space makes it easier to get large number of addresses, but if
> one happens to have a large space of addresses available, it would be
> possible to allocate set of addresses for each device (though, IEEE
> might get somewhat unwilling to allocate more OUIs for this kind of
> address use if large portion of the addresses are not really used).
> 
> Different designs might support list of arbitrary addresses or some sort
> of bitmask on the addresses, so at least in theory, the sets of
> addresses could be quite diverse.

Yes, I know that theoretically the addresses could be anything including
random. I was hoping to find information on what specific vendors do.

> --
> Jouni Malinen                                            PGP id EFC895FA


Thanks, Bob




From amin.benabdallah  Tue Feb  6 23:34:59 2007
From: amin.benabdallah (Amin BEN ABDALLAH)
Date: Wed, 07 Feb 2007 08:34:59 +0100
Subject: USB wireless cards
Message-ID: <1170833699.3153.6.camel@amin>

Hi,

I am a new user of HostAP and I would like to use it in order to test a
new EAP method. 

The problem is that my wireless device (ipw2200) doesn't support master
mode. is it possible to use an USB wireless adaptor with hostAP (is mode
master supported, is there any linux driver) ?

Finally, having 2 wireless cards (for example ipw2200 & usb adaptor), is
it possible to use the XSupplicant and Authenticator on the same
machine.


Thanks in advance

Amin




From bryan  Wed Feb  7 04:09:48 2007
From: bryan (Bryan Kadzban)
Date: Wed, 07 Feb 2007 07:09:48 -0500
Subject: APs and multiple BSSID support (OT?)
In-Reply-To: <20070207060601.C5A8ABF03@smtp-auth.no-ip.com>
References: <20070207060601.C5A8ABF03@smtp-auth.no-ip.com>
Message-ID: <45C9C18C.8030804@kadzban.is-a-geek.net>

Bob Carlson wrote:
> The problem with mult. SSID/BSSIDs is that there is no way to make
> the hardware aware of 2 different BSSIDs for things like timing
> derived from the beacons.

Your multiple-BSSID APs don't send out different beacons for each
virtual BSSID?  Ours do (Cisco 1100s and 1231s).  I suspect it's an
option in the AP setup, but I'm not sure why you'd turn that option off.

> That's a long winded explanation for a simple need. Because I can
> only successfully connect to 2 different BSSIDs if they are supported
> by the same physical AP,

I guess I don't see why this is necessary from your explanation.  It
should work whether your client is connecting to two BSSIDs on one AP or
on two APs; the client shouldn't care.

Unless you mean that a single client radio can't operate on multiple
frequencies at once?  In that case, just look at the channel number
given in the beacons, and refuse to connect to multiple BSSIDs that are
on different channels.  Do the same for other parameters that affect
whether your code works or not (e.g. maybe DTIM interval matters).

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20070207/a0c2e19a/attachment.pgp 


From fredl  Wed Feb  7 06:36:11 2007
From: fredl (Fred Leeflang)
Date: Wed, 07 Feb 2007 15:36:11 +0100
Subject: Intel 2200 Mini-PCI + hostapd
Message-ID: <45C9E3DB.3020703@3dn.nl>

Hi,

 From http://hostap.epitest.fi/hostapd/ I read that hostapd
supports:

    * Host AP driver for Prism2/2.5/3 <http://hostap.epitest.fi/>
    * madwifi (Atheros ar521x) <http://sourceforge.net/projects/madwifi/>
    * Prism54.org (Prism GT/Duette/Indigo) <http://www.prism54.org/>
    * BSD net80211 layer (e.g., Atheros driver) (FreeBSD 6-CURRENT)

I recently purchased an Asus WL-500gP, which has a Broadcom
mini-pci. I installed openwrt on it and got it all to work quite well,
using the 'nas' binary that comes with OpenWRT. The 'nas' binary
handles the WPA-EAP which I've set up, so I'm actually running
EAP-TTLS with inner PAP authentication on it.

There's only one 'but'; the nas binary doesn't support 802.1x accounting
it seems. So in order to fix that I was looking into installing hostapd
on the Asus. The list of supported cards is very slim though and I am
not very optimistic that I'll get the Broadcom driver to work as that's
still very experimental. So another option I have is to install an Intel
Pro 2200 mini pci card. This card seems to be pretty stable, and what's
more, I also use wpa_supplicant on it with the -Dwext option.

Is it possible to run hostapd on an Intel Pro 2200 mini-pci card?

Thanks a lot,
Fred Leeflang



From rjc  Wed Feb  7 08:53:56 2007
From: rjc (Bob Carlson)
Date: Wed, 7 Feb 2007 09:53:56 -0700
Subject: APs and multiple BSSID support (OT?)
In-Reply-To: <45C9C18C.8030804@kadzban.is-a-geek.net>
Message-ID: <20070207165411.21F6FBF43@smtp-auth.no-ip.com>

> -----Original Message-----
> From: Bryan Kadzban [mailto:bryan at kadzban.is-a-geek.net]
> Sent: Wednesday, February 07, 2007 5:10 AM
> To: bob.carlson at sigpro.com
> Cc: 'Jouni Malinen'; hostap at shmoo.com
> Subject: Re: APs and multiple BSSID support (OT?)
> 
> Bob Carlson wrote:
> > The problem with mult. SSID/BSSIDs is that there is no way to make
> > the hardware aware of 2 different BSSIDs for things like timing
> > derived from the beacons.
> 
> Your multiple-BSSID APs don't send out different beacons for each
> virtual BSSID?  Ours do (Cisco 1100s and 1231s).  I suspect it's an
> option in the AP setup, but I'm not sure why you'd turn that option off.

On the Ciscos, multiple BSSIDs can be enabled or not. When enabled, I
believe they send a beacon for each BSSID in all cases. Since they come
from the same radio and mac, certain items will always be in sync, the
channel of course, the TSF, supported rates, WMM, etc. At least I believe
this pretty much has to be the case. My hardware, I'm pretty sure, can only
be set up to notice one set of beacons, even though I am connected to two
BSSIDs. It is the timing and WMM I am most worried about, but there may be
other subtleties of which I am ignorant. As long as the timing between the
BSSIDs is the same, I think I should be alright. If the BSSIDs are on
different APs, I have little confidence that it would work, since the HW
would not be aware of one of the beacons. Luckily I do not need to support
power same mode or things would get MUCH more complicated.

I need to support 2 virtual clients in 3 cases. Case 1 is 1 SSID/1 BSSID/1
AP. That's working. Second is 2 SSID/1 BSSID/1 AP. This should be a pretty
straightforward enhancement of the first case. Third is 2 SSID/2 BSSID/1
AP. That's the one I am worried about. Another case, 2 SSID/2 BSSID/2 AP, I
don't believe I can support. I might also see 1 SSID/2 BSSID/2 AP. I don't
ever want to connect the virtual clients to 2 different APs in this case
either. I believe 1 SSID/2 BSSID/1 AP is not legal or reasonable.

Cheers, Bob

> 
> > That's a long winded explanation for a simple need. Because I can
> > only successfully connect to 2 different BSSIDs if they are supported
> > by the same physical AP,
> 
> I guess I don't see why this is necessary from your explanation.  It
> should work whether your client is connecting to two BSSIDs on one AP or
> on two APs; the client shouldn't care.
> 
> Unless you mean that a single client radio can't operate on multiple
> frequencies at once?  In that case, just look at the channel number
> given in the beacons, and refuse to connect to multiple BSSIDs that are
> on different channels.  Do the same for other parameters that affect
> whether your code works or not (e.g. maybe DTIM interval matters).





From jobi  Wed Feb  7 13:22:25 2007
From: jobi (Johan Bilien)
Date: Wed, 7 Feb 2007 22:22:25 +0100
Subject: Prism card not recognized
In-Reply-To: <1170821147.11150.21.camel@dv>
References: <20070205204431.GB30495@via.ecp.fr> <1170821147.11150.21.camel@dv>
Message-ID: <20070207212225.GB15751@via.ecp.fr>

On Tue, Feb 06, 2007, Pavel Roskin wrote:
> On Mon, 2007-02-05 at 21:44 +0100, Johan Bilien wrote:
> > Am I correct? Would adding something like:
> > 
> >  PCMCIA_DEVICE_MANF_CARD_PROD_ID1(0x0156, 0x0002, "AboveCable",
> >                                          0xfead109e),
> > 
> > solve the problem?
> 
> Yes, I think so.

Thanks,

so I did this and hostap gets loaded and the card gets listed as an eth0
and a wlan0_rename (udev quirks it seems).

Unfortunately wpa_supplicant won't authenticate to the network. It seems
to scan successfully, receive the EAP messages successfully, but seems
to stop the authentication process shortly after and start a new scan.
(log attached)

kernel log shows a worrying
localhost kernel: eth0: hfa384x_set_rid: CMDCODE_ACCESS_WRITE failed
(res=127, rid=fc48, len=2)

which has me wonder if the card actually has a PRISM2 chipset. It does
have the exact same ID as the Intersil and hostap seems to work
to some extent though.

Is there a way to be sure? Would the card not have a PRISM chipset, is
there any chance to get wpa_supplicant working? The network uses WEP
(not WPA) with 802.1X EAP/MSChap.

Best regards
-- 
Johan Bilien
<jobi at via.ecp.fr>
-------------- next part --------------
Initializing interface 'eth0' conf '/etc/wpa_supplicant/wpa_supplicant.conf' driver 'hostap' ctrl_interface 'N/A' bridge 'N/A'
Configuration file '/etc/wpa_supplicant/wpa_supplicant.conf' -> '/etc/wpa_supplicant/wpa_supplicant.conf'
Reading configuration file '/etc/wpa_supplicant/wpa_supplicant.conf'
Line: 4 - start of a new network block
ssid - hexdump_ascii(len=2):
     6c 75                                             lu              
key_mgmt: 0x8
eap methods - hexdump(len=16): 00 00 00 00 19 00 00 00 00 00 00 00 00 00 00 00
phase2 - hexdump_ascii(len=13):
     61 75 74 68 3d 4d 53 43 48 41 50 56 32            auth=MSCHAPV2   
identity - hexdump_ascii(len=6):
     79 61 77 32 30 36                                 yaw206          
password - hexdump_ascii(len=9): [REMOVED]
Priority group 0
   id=0 ssid='lu'
Initializing interface (2) 'eth0'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
SIOCGIWRANGE: WE(compiled)=20 WE(source)=18 enc_capa=0xf
  capabilities: key_mgmt 0xf enc 0xf
WEXT: Operstate: linkmode=1, operstate=5
Own MAC address: 00:02:6f:03:7c:39
wpa_driver_hostap_set_wpa: enabled=1
Driver does not support WPA.
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_countermeasures: enabled=0
wpa_driver_hostap_set_drop_unencrypted: enabled=1
Setting scan request: 0 sec 100000 usec
Added interface eth0
RTM_NEWLINK: operstate=0 ifi_flags=0x1002 ()
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
Trying to get current scan results first without requesting a new scan to speed up initial association
Received 878 bytes of scan results (6 BSSes)
Scan results: 6
Selecting BSS from priority group 0
0: 00:0d:bd:da:b9:4e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
1: 00:0d:bd:da:b9:b9 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
2: 00:12:d9:a7:a6:40 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
3: 00:0d:bd:da:b9:8e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
4: 00:0d:bd:da:b9:cf ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
5: 00:0d:bc:25:fa:df ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
   selected non-WPA AP 00:0d:bd:da:b9:4e ssid='lu'
Trying to associate with 00:0d:bd:da:b9:4e (SSID='lu' freq=2412 MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_hostap_set_drop_unencrypted: enabled=1
State: SCANNING -> ASSOCIATING
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_hostap_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b04 len=12
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b1a len=11
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0d:bd:da:b9:4e
State: ASSOCIATING -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0d:bd:da:b9:4e
No keys have been configured - skip key clearing
Associated with 00:0d:bd:da:b9:4e
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b19 len=8
Received 1256 bytes of scan results (8 BSSes)
Scan results: 8
Selecting BSS from priority group 0
0: 00:0d:bd:da:b9:4e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
1: 00:0d:bd:da:b9:8e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
2: 00:12:d9:a7:a6:40 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
3: 00:0d:bd:da:b9:b9 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
4: 00:14:a8:5f:48:a0 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
5: 00:13:19:f2:24:90 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
6: 00:0d:bc:25:fa:df ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
7: 00:13:19:f2:28:60 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x1
   skip - no WPA/RSN IE
   selected non-WPA AP 00:0d:bd:da:b9:4e ssid='lu'
Already associated with the selected AP.
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
Setting scan request: 0 sec 100000 usec
Added BSSID 00:0d:bd:da:b9:4e into blacklist
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
State: ASSOCIATED -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
Ignore event for foreign ifindex 12
Ignore event for foreign ifindex 12
Ignore event for foreign ifindex 12
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0d:bd:da:b9:8e
State: DISCONNECTED -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0d:bd:da:b9:8e
No keys have been configured - skip key clearing
Associated with 00:0d:bd:da:b9:8e
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
Setting scan request: 0 sec 100000 usec
Added BSSID 00:0d:bd:da:b9:8e into blacklist
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
State: ASSOCIATED -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
Ignore event for foreign ifindex 12
Ignore event for foreign ifindex 12
Ignore event for foreign ifindex 12
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b19 len=8
Received 423 bytes of scan results (3 BSSes)
Scan results: 3
Selecting BSS from priority group 0
0: 00:0d:bd:da:b9:8e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
1: 00:0d:bd:da:b9:b9 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
2: 00:0d:bd:da:b9:cf ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
   selected non-WPA AP 00:0d:bd:da:b9:8e ssid='lu'
Trying to associate with 00:0d:bd:da:b9:8e (SSID='lu' freq=2437 MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_hostap_set_drop_unencrypted: enabled=1
State: SCANNING -> ASSOCIATING
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_hostap_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b04 len=12
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b1a len=11
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0d:bd:da:b9:8e
State: ASSOCIATING -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0d:bd:da:b9:8e
No keys have been configured - skip key clearing
Associated with 00:0d:bd:da:b9:8e
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b19 len=8
Received 942 bytes of scan results (6 BSSes)
Scan results: 6
Selecting BSS from priority group 0
0: 00:0d:bd:da:b9:4e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
1: 00:0d:bd:da:b9:8e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
2: 00:0d:bd:da:b9:b9 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
3: 00:13:19:f2:24:90 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
4: 00:13:19:f2:26:70 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
5: 00:13:19:f2:28:60 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x1
   skip - no WPA/RSN IE
   selected non-WPA AP 00:0d:bd:da:b9:4e ssid='lu'
Trying to associate with 00:0d:bd:da:b9:4e (SSID='lu' freq=2412 MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_hostap_set_drop_unencrypted: enabled=1
State: ASSOCIATED -> ASSOCIATING
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_hostap_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
BSSID 00:0d:bd:da:b9:4e blacklist count incremented to 2
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
State: ASSOCIATING -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b04 len=12
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b1a len=11
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0d:bd:da:b9:4e
State: DISCONNECTED -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0d:bd:da:b9:4e
No keys have been configured - skip key clearing
Associated with 00:0d:bd:da:b9:4e
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
Setting scan request: 0 sec 100000 usec
BSSID 00:0d:bd:da:b9:4e blacklist count incremented to 3
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
State: ASSOCIATED -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
Ignore event for foreign ifindex 12
Ignore event for foreign ifindex 12
Ignore event for foreign ifindex 12
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b19 len=8
Received 737 bytes of scan results (5 BSSes)
Scan results: 5
Selecting BSS from priority group 0
0: 00:0d:bd:da:b9:8e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
1: 00:0d:bd:da:b9:b9 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
2: 00:0d:bd:da:b9:cf ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
3: 00:13:19:f2:26:70 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
4: 00:0d:bd:af:d2:3a ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
   selected non-WPA AP 00:0d:bd:da:b9:8e ssid='lu'
Trying to associate with 00:0d:bd:da:b9:8e (SSID='lu' freq=2437 MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_hostap_set_drop_unencrypted: enabled=1
State: SCANNING -> ASSOCIATING
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_hostap_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - portControl=Auto
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b04 len=12
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b1a len=11
EAPOL: startWhen --> 0
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0d:bd:da:b9:8e
State: ASSOCIATING -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0d:bd:da:b9:8e
No keys have been configured - skip key clearing
Associated with 00:0d:bd:da:b9:8e
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b19 len=8
Received 737 bytes of scan results (5 BSSes)
Scan results: 5
Selecting BSS from priority group 0
0: 00:0d:bd:da:b9:4e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - blacklisted
1: 00:0d:bd:da:b9:8e ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
2: 00:0d:bc:25:fa:df ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
3: 00:0d:bd:da:b9:cf ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
4: 00:13:19:f2:28:60 ssid='lu' wpa_ie_len=0 rsn_ie_len=0 caps=0x1
   skip - no WPA/RSN IE
   selected non-WPA AP 00:0d:bd:da:b9:8e ssid='lu'
Already associated with the selected AP.
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
Setting scan request: 0 sec 100000 usec
BSSID 00:0d:bd:da:b9:8e blacklist count incremented to 2
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
State: ASSOCIATED -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
Ignore event for foreign ifindex 12
Ignore event for foreign ifindex 12
Ignore event for foreign ifindex 12
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:0d:bc:25:fa:df
State: DISCONNECTED -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:0d:bc:25:fa:df
No keys have been configured - skip key clearing
Associated with 00:0d:bc:25:fa:df
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'eth0' added
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
CTRL-EVENT-TERMINATING - signal 2 received
Removing interface eth0
State: ASSOCIATED -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_hostap_deauthenticate
wpa_driver_hostap_reset: type=2
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
wpa_driver_hostap_set_wpa: enabled=0
Failed to disable WPA in the driver.
wpa_driver_hostap_set_drop_unencrypted: enabled=0
wpa_driver_hostap_set_countermeasures: enabled=0
No keys have been configured - skip key clearing
WEXT: Operstate: linkmode=0, operstate=6
Removed BSSID 00:0d:bd:da:b9:8e from blacklist (clear)
Removed BSSID 00:0d:bd:da:b9:4e from blacklist (clear)
Cancelling scan request


From paris_ste_82  Thu Feb  8 08:20:38 2007
From: paris_ste_82 (Stefano Paris)
Date: Thu, 8 Feb 2007 17:20:38 +0100 (CET)
Subject: frame cryptography
Message-ID: <20070208162038.45117.qmail@web28113.mail.ukl.yahoo.com>

Hi all,

Could someone suggest me, what part of wpa_supplicant (and hostapd) deal with frame cryptography and authentication?

Is wpa_supplicant that encrypt (or decrypt) every frame before sending it, or this job is performed by the driver (i.e. what software implements the cipher suites)?

Thanks a lot.

Sincerely,
Stefno Paris

 		
---------------------------------
 L'email della prossima generazione? Puoi averla con la  nuova Yahoo! Mail
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070208/3d82d205/attachment.htm 


From dcbw  Thu Feb  8 09:17:14 2007
From: dcbw (Dan Williams)
Date: Thu, 08 Feb 2007 12:17:14 -0500
Subject: frame cryptography
In-Reply-To: <20070208162038.45117.qmail@web28113.mail.ukl.yahoo.com>
References: <20070208162038.45117.qmail@web28113.mail.ukl.yahoo.com>
Message-ID: <1170955034.17999.6.camel@localhost.localdomain>

On Thu, 2007-02-08 at 17:20 +0100, Stefano Paris wrote:
> Hi all,
> 
> Could someone suggest me, what part of wpa_supplicant (and hostapd)
> deal with frame cryptography and authentication?
> 
> Is wpa_supplicant that encrypt (or decrypt) every frame before sending
> it, or this job is performed by the driver (i.e. what software
> implements the cipher suites)?

The drivers encrypt the frames.  Depending on how much functionality
eventually gets pushed up to wpa_supplicant/userspace MLME, that may
change, but I doubt it.

Dan





From f.bianchi  Fri Feb  9 00:27:08 2007
From: f.bianchi (Federico Bianchi)
Date: Fri, 9 Feb 2007 09:27:08 +0100 (CET)
Subject: [semi-OT] "virtual AP" (multiple beacon, multiple BSSID) on Linksys
	h/w
In-Reply-To: <1170821147.11150.21.camel@dv>
References: <20070205204431.GB30495@via.ecp.fr> <1170821147.11150.21.camel@dv>
Message-ID: <0702090920350.28573@www.arte.unipi.it>


Does anyone know whether there is any way of getting a so-called "virtual
AP" out of a Linksys WRT54GS (I also have a "spare" WRV54G, which might be
a better choice)? Having a single WLAN network in my work environment (an
humanities department, with a public access library; all in a XVII century
building), with both an open Intranet and a sealed 802.1X Internet access
would be much simpler for users.

Best regards, and thanks a lot for your help

	 		Federico Bianchi
			Dipartimento di Storia delle Arti
			Universita` di Pisa
			piazza S.Matteo in Soarta, 2 - I56127 Pisa (Italy)
			tel.+39-050-587111 (cent.), +39-050-587224 (uff.)
			fax.+39-050-580128; e-mail: <f.bianchi at arte.unipi.it>
			===================================================
			!DISCLAIMER!: my e-mail reflects _my_own_ opinions!
			===================================================




From philippe.dhont  Fri Feb  9 00:36:43 2007
From: philippe.dhont (Philippe Dhont  Sea-ro)
Date: Fri, 9 Feb 2007 09:36:43 +0100
Subject: WEP is possible, WPA not
Message-ID: <EB998357DB660742877807C9BD7D251BA3596E@SRVR1.searo.local>

Hello,

I have an intel 3945 wireless card, installed wpa_supplicant (via apt-get, debian etch installation).
I want to use it with my dlink router but i am not able to use WPA.
The configuration for WEP works, but for WPA I never get an ip address from the DHCP server.

This is my /etc/network/interfaces configuration:

iface eth2 inet dhcp
wpa-driver wext
wpa-conf /etc/network/wpa_home.conf


then, my /etc/network/wpa_home.conf


ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0

eapol_version=1
ap_scan=2
fast_reauth=1

network={
       ssid="ZWERVELWPA"
       proto=WPA
       key_mgmt=WPA-PSK
       pairwise=TKIP
       psk="1234567890"
#      psk=b77c11d7a3bdd1b1f19e06c2b26128b25ba51719d165e557335157822bb8affc
       priority=5

}


Via iwconfig I can see that eth2 is the right essid.
If I configure it for WEP, then it works but not via WPA


To start I type :

Ifup eth2


Is that correct to start like that ? please help, how can I make WPA working.
Thnx,
Phil.









From gondi_vamsi  Fri Feb  9 03:13:57 2007
From: gondi_vamsi (vamsi krishna)
Date: Fri, 9 Feb 2007 03:13:57 -0800 (PST)
Subject: invalid authenticator packet droped
Message-ID: <709505.50129.qm@web30901.mail.mud.yahoo.com>

hi,

i am receiving an error on hostap

No message-authenticator attribute found
Incoming radius packet did not have correct message authenticator - droped


here is my scenario,

a computer is equiped with hostap and with a radius server, this radius server acts as a proxy to the home network,

      
freeradius server as radius server
                                    ____________________________
WPA supplicant ---->     | Hostapd + visiting Radius server|    ------------ home radius server
                                    |-----------------------------------------------|
when hostap recievs request for authentication from the WPA supplicant it sends request to the visiting radius server on the computer, visiting radius checks the realm and forwards the request to the Home AAA server. the home radius server checks the realm and sends the challenge as a reply, the visiting radius server recives challenges and forward the request to HOSTAP, hostap receives the packet and then i find this error.  

No message-authenticator attribute found
Incoming radius packet did not have correct message authenticator - droped

if anyone knows the error and where the problem is (hostap or visiting radius server or home radius server)please let me know 


thanking you,
gondi.
Vamsi Krishna GONDI,
16 rue Jean Pierre Laurens,
Fontenay Aux Roses, 92260,
France.
Ph no. +33 (0)6 20 38 51 53


 
____________________________________________________________________________________
Do you Yahoo!?
Everyone is raving about the all-new Yahoo! Mail beta.
http://new.mail.yahoo.com



From fredl  Fri Feb  9 03:35:33 2007
From: fredl (Fred Leeflang)
Date: Fri, 09 Feb 2007 12:35:33 +0100
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <45C9E3DB.3020703@3dn.nl>
References: <45C9E3DB.3020703@3dn.nl>
Message-ID: <45CC5C85.9070707@3dn.nl>

Uhm.

Was my question that difficult? I'll rephrase it.
Can hostapd to be made to run on an Intel Pro
2200?

-Fred

Fred Leeflang wrote:
> Hi,
>
>  From http://hostap.epitest.fi/hostapd/ I read that hostapd
> supports:
>
>     * Host AP driver for Prism2/2.5/3 <http://hostap.epitest.fi/>
>     * madwifi (Atheros ar521x) <http://sourceforge.net/projects/madwifi/>
>     * Prism54.org (Prism GT/Duette/Indigo) <http://www.prism54.org/>
>     * BSD net80211 layer (e.g., Atheros driver) (FreeBSD 6-CURRENT)
>
> I recently purchased an Asus WL-500gP, which has a Broadcom
> mini-pci. I installed openwrt on it and got it all to work quite well,
> using the 'nas' binary that comes with OpenWRT. The 'nas' binary
> handles the WPA-EAP which I've set up, so I'm actually running
> EAP-TTLS with inner PAP authentication on it.
>
> There's only one 'but'; the nas binary doesn't support 802.1x accounting
> it seems. So in order to fix that I was looking into installing hostapd
> on the Asus. The list of supported cards is very slim though and I am
> not very optimistic that I'll get the Broadcom driver to work as that's
> still very experimental. So another option I have is to install an Intel
> Pro 2200 mini pci card. This card seems to be pretty stable, and what's
> more, I also use wpa_supplicant on it with the -Dwext option.
>
> Is it possible to run hostapd on an Intel Pro 2200 mini-pci card?
>
> Thanks a lot,
> Fred Leeflang
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>   




From zarhan  Fri Feb  9 05:04:47 2007
From: zarhan (=?ISO-8859-1?Q?Antti_M=E4kel=E4?=)
Date: Fri, 9 Feb 2007 15:04:47 +0200 (EET)
Subject: Wpa_supplicant in a shaky network environment
Message-ID: <Pine.GSO.4.64.0702091504270.3688@viherkiuru.cs.tut.fi>

Hi,

   could you take a look at a bug I filed at Gentoo (and got suggestions that 
this should be addressed at wpa_cli or wpa_supplicant):

http://bugs.gentoo.org/show_bug.cgi?id=164965

   Yes, I read TODO.TXT. The only reference to this kind of issue I see is the

- on disconnect event, could try to associate with another AP if one is
   present in scan results; would need to update scan results periodically..

   Anyway - it seems that at least wpa_cli.c has quite a lot of similarities to 
ifplugd code, but, if I had interpreted things correctly, parsing events and 
executing action scripts happens within the same function 
(wpa_cli_action_process()), on the same call.

   Thus, any patch to include a "downtime threshold" would change the entire 
structure a bit - separate parsing of wpa events from executing the actions, 
and including a timer.

   Personally, I've found this problem annoying enough recently (the office 
building I frequently visit must have a gazillion access points) that I'll 
probably have enough motivation to try to write something to fix this, at least 
eventually.

   However - I'd rather not reinvent the wheel again - so - is somebody else 
already taking a look at this issue and working on a fix?

   Anyway, what I'd like to change is

   the current functionality of

static void wpa_cli_action_process(const char *msg)

   should be split to

static char* wpa_cli_action_process_parse(const char *msg)

   and

static void wpa_cli_action_process_exec(char *event)

   where the first would simply get the event (connect or disconnect) and upon 
return, start a timer. The latter would then be executed when the timer goes 
off. A newly received re-connect to the same network (including re-completing 
802.1X) within a threshold time would not cause the action script to be 
executed.

   What do you think?

-- 
- Antti M?kel? - http://www.cs.tut.fi/~zarhan - zarhan at cs.tut.fi -
There is a theory which states that if ever anyone discovers exactly
what the Universe is for and why it is here,it will instantly disappear
and be replaced by something even more bizarre and inexplicable.


From jan.ceuleers  Fri Feb  9 07:50:12 2007
From: jan.ceuleers (Jan Ceuleers)
Date: Fri, 09 Feb 2007 16:50:12 +0100
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <45CC5C85.9070707@3dn.nl>
References: <45C9E3DB.3020703@3dn.nl> <45CC5C85.9070707@3dn.nl>
Message-ID: <45CC9834.2060501@computer.org>

Fred,

Fred Leeflang wrote:
> Uhm.
> 
> Was my question that difficult? I'll rephrase it.
> Can hostapd to be made to run on an Intel Pro
> 2200?
> 
> -Fred

Jouni makes available two pieces of software with very nearly the same 
name but with radically different purposes. Hostap is a driver for a 
specific series of chipsets (Prism), whereas hostapd is what you need to 
create a wireless access point that supports WPA(2).

I have no experience with the Intel chipset that you mention, but if you 
have a driver for it that is compatible with the Linux wireless 
extensions then you should be able to use hostapd with it (compile it 
for wext). Or select whichever API to your wireless driver is 
appropriate and compile/configure hostapd to use that (I only use 
Atheros chipsets and therefore use the madwifi driver and hostapd 
interface).

Hope this helps.

Regards, Jan



From fredl  Fri Feb  9 07:55:02 2007
From: fredl (Fred Leeflang)
Date: Fri, 09 Feb 2007 16:55:02 +0100
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <45CC9834.2060501@computer.org>
References: <45C9E3DB.3020703@3dn.nl> <45CC5C85.9070707@3dn.nl>
	<45CC9834.2060501@computer.org>
Message-ID: <45CC9956.2010401@3dn.nl>

Jan Ceuleers wrote:
> Fred,
>
> Fred Leeflang wrote:
>> Uhm.
>>
>> Was my question that difficult? I'll rephrase it.
>> Can hostapd to be made to run on an Intel Pro
>> 2200?
>>
>> -Fred
>
> Jouni makes available two pieces of software with very nearly the same 
> name but with radically different purposes. Hostap is a driver for a 
> specific series of chipsets (Prism), whereas hostapd is what you need 
> to create a wireless access point that supports WPA(2).
>
> I have no experience with the Intel chipset that you mention, but if 
> you have a driver for it that is compatible with the Linux wireless 
> extensions then you should be able to use hostapd with it (compile it 
> for wext). Or select whichever API to your wireless driver is 
> appropriate and compile/configure hostapd to use that (I only use 
> Atheros chipsets and therefore use the madwifi driver and hostapd 
> interface).
>
> Hope this helps.
Hi Jan,

This helps a lot, thanks! As I have already gotten an Intel Pro 2200 
MiniPCI (one's in my laptop)
to work together with wpa_supplicant, I feel comfortable enough now to 
purchase one of
those cards and install it in my OpenWRT Asus WL500gP box, replacing the 
Broadcom
miniPCI.

Thank you!
Fred Leeflang



From gondi_vamsi  Fri Feb  9 08:36:46 2007
From: gondi_vamsi (vamsi krishna)
Date: Fri, 9 Feb 2007 08:36:46 -0800 (PST)
Subject: error on hostap in the proxy scenario
Message-ID: <999291.93667.qm@web30902.mail.mud.yahoo.com>

hi,

i am receiving an error on hostap

No message-authenticator attribute found
Incoming radius packet did not have correct message authenticator - droped


here is my scenario,

a computer is equiped with hostap and with a radius server, this radius server acts as a proxy to the home network,

      
freeradius server as radius server
                                    ____________________________
WPA supplicant ---->     | Hostapd + visiting Radius server|    ------------ home radius server
                                    |-----------------------------------------------|
when hostap recievs request for authentication from the WPA supplicant it sends request to the visiting radius server on the computer, visiting radius checks the realm and forwards the request to the Home AAA server. the home radius server checks the realm and sends the challenge as a reply, the visiting radius server recives challenges and forward the request to HOSTAP, hostap receives the packet and then i find this error.  

No message-authenticator attribute found
Incoming radius packet did not have correct message authenticator - droped

if anyone knows the error and where the problem is (hostap or visiting radius server or home radius server)please let me know 
 

Here are the log files

HOSTAPD

ath0: STA 00:0c:41:63:9e:37 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1)
ath0: STA 00:0c:41:63:9e:37 IEEE 802.1X: STA identity 'vamsi at example.com'
IEEE 802.1X: 00:0c:41:63:9e:37 BE_AUTH entering state RESPONSE
Encapsulating EAP message into a RADIUS packet
ath0: RADIUS Sending RADIUS message to authentication server
RADIUS message: code=1 (Access-Request) identifier=84 length=172
Attribute 1 (User-Name) length=19
Value: 'vamsi at example.com'
Attribute 4 (NAS-IP-Address) length=6
Value: 127.0.0.1
Attribute 5 (NAS-Port) length=6
Value: 0
Attribute 30 (Called-Station-Id) length=24
Value: '00-14-6C-2D-96-68:test'
Attribute 31 (Calling-Station-Id) length=19
Value: '00-0C-41-63-9E-37'
Attribute 12 (Framed-MTU) length=6
Value: 1400
Attribute 61 (NAS-Port-Type) length=6
Value: 19
Attribute 77 (Connect-Info) length=24
Value: 'CONNECT 11Mbps 802.11b'
Attribute 79 (EAP-Message) length=24
Value: 02 00 00 16 01 76 61 6d 73 69 40 65 78 61 6d 70 6c 65 2e 63 6f 6d
Attribute 80 (Message-Authenticator) length=18
Value: 30 d6 66 48 69 e3 ad 7d e1 df 3d 25 58 b3 47 e5
ath0: RADIUS Next RADIUS client retransmit in 3 seconds
IEEE 802.1X: 00:0c:41:63:9e:37 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:0c:41:63:9e:37 REAUTH_TIMER entering state INITIALIZE
ath0: RADIUS Received 20 bytes from RADIUS server
ath0: RADIUS Received RADIUS message
RADIUS message: code=11 (Access-Challenge) identifier=84 length=20
ath0: STA 00:0c:41:63:9e:37 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.04 sec
No Message-Authenticator attribute found
Incoming RADIUS packet did not have correct Message-Authenticator - dropped
ath0: STA 00:0c:41:63:9e:37 RADIUS: No RADIUS RX handler found (type=0 code=11 id=84) [INVALID AUTHENTICATOR] - dropping packet
 


Freeradius proxy server Log

Module: Loaded files
files: usersfile = "/usr/local/radius/etc/raddb/users"
files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users"
files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: header = "%t"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/usr/local/radius/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Module: Loaded attr_filter
attr_filter: attrsfile = "/usr/local/radius/etc/raddb/attrs"
Module: Instantiated attr_filter (attr_filter.post-proxy)
Initializing the thread pool...
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
Nothing to do. Sleeping until we see a request.
rad_recv: Access-Request packet from host 192.168.2.1 port 32797, id=6, length=172
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020100160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0xfc294d717766228ca192244fb7fb4fdd
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
modcall[authorize]: module "unix" returns notfound for request 0
rlm_realm: Looking up realm "example.com" for User-Name = "vamsi at example.com"
rlm_realm: Found realm "example.com"
rlm_realm: Proxying request from user vamsi to realm example.com
rlm_realm: Adding Realm = "example.com"
rlm_realm: Preparing to proxy authentication request to realm "example.com"
modcall[authorize]: module "suffix" returns updated for request 0
rlm_eap: Request is supposed to be proxied to Realm example.com. Not doing EAP.
modcall[authorize]: module "eap" returns noop for request 0
modcall[authorize]: module "files" returns noop for request 0
modcall[authorize]: module "expiration" returns noop for request 0
modcall[authorize]: module "logintime" returns noop for request 0
modcall[authorize]: module "pap" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
Sending Access-Request of id 0 to 192.168.2.2 port 1812
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020100160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x36
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Challenge packet from host 192.168.2.2 port 1812, id=0, length=67
EAP-Message = 0x010200060d20
Message-Authenticator = 0x288ae9dc209ee56b770989b732866ea3
State = 0x65d253b8c2a41a0199caf4238686c5ac
Proxy-State = 0x36
Processing the post-proxy section of radiusd.conf
modcall: entering group post-proxy for request 0
attr_filter: Matched entry example.com at line 78
modcall[post-proxy]: module "attr_filter.post-proxy" returns updated for request 0
modcall[post-proxy]: module "eap" returns noop for request 0
modcall: leaving group post-proxy (returns updated) for request 0
Sending Access-Challenge of id 6 to 192.168.2.1 port 32797
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 5 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 6 with timestamp 45cca049
Nothing to do. Sleeping until we see a request.
rad_recv: Access-Request packet from host 192.168.2.1 port 32797, id=7, length=172
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020300160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0xcddafa7bac6b4588863f37ac2f2c8f64
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
modcall[authorize]: module "mschap" returns noop for request 1
modcall[authorize]: module "unix" returns notfound for request 1
rlm_realm: Looking up realm "example.com" for User-Name = "vamsi at example.com"
rlm_realm: Found realm "example.com"
rlm_realm: Proxying request from user vamsi to realm example.com
rlm_realm: Adding Realm = "example.com"
rlm_realm: Preparing to proxy authentication request to realm "example.com"
modcall[authorize]: module "suffix" returns updated for request 1
rlm_eap: Request is supposed to be proxied to Realm example.com. Not doing EAP.
modcall[authorize]: module "eap" returns noop for request 1
modcall[authorize]: module "files" returns noop for request 1
modcall[authorize]: module "expiration" returns noop for request 1
modcall[authorize]: module "logintime" returns noop for request 1
modcall[authorize]: module "pap" returns noop for request 1
modcall: leaving group authorize (returns updated) for request 1
Sending Access-Request of id 1 to 192.168.2.2 port 1812
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020300160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x37
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Challenge packet from host 192.168.2.2 port 1812, id=1, length=67
EAP-Message = 0x010400060d20
Message-Authenticator = 0xbd8c0c961b4776663862e485580916cc
State = 0xe268b49f14e466fa6c110c25a9d37ba1
Proxy-State = 0x37
Processing the post-proxy section of radiusd.conf
modcall: entering group post-proxy for request 1
attr_filter: Matched entry example.com at line 78
modcall[post-proxy]: module "attr_filter.post-proxy" returns updated for request 1
modcall[post-proxy]: module "eap" returns noop for request 1
modcall: leaving group post-proxy (returns updated) for request 1
Sending Access-Challenge of id 7 to 192.168.2.1 port 32797
Finished request 1
Going to the next request
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 1 ID 7 with timestamp 45cca062
Nothing to do. Sleeping until we see a request.
rad_recv: Access-Request packet from host 192.168.2.1 port 32797, id=8, length=172
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020400160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x5ab02f96858376f10932ff80039a8a38
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module "preprocess" returns ok for request 2
modcall[authorize]: module "chap" returns noop for request 2
modcall[authorize]: module "mschap" returns noop for request 2
modcall[authorize]: module "unix" returns notfound for request 2
rlm_realm: Looking up realm "example.com" for User-Name = "vamsi at example.com"
rlm_realm: Found realm "example.com"
rlm_realm: Proxying request from user vamsi to realm example.com
rlm_realm: Adding Realm = "example.com"
rlm_realm: Preparing to proxy authentication request to realm "example.com"
modcall[authorize]: module "suffix" returns updated for request 2
rlm_eap: Request is supposed to be proxied to Realm example.com. Not doing EAP.
modcall[authorize]: module "eap" returns noop for request 2
modcall[authorize]: module "files" returns noop for request 2
modcall[authorize]: module "expiration" returns noop for request 2
modcall[authorize]: module "logintime" returns noop for request 2
modcall[authorize]: module "pap" returns noop for request 2
modcall: leaving group authorize (returns updated) for request 2
Sending Access-Request of id 2 to 192.168.2.2 port 1812
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020400160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x38
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Challenge packet from host 192.168.2.2 port 1812, id=2, length=67
EAP-Message = 0x010500060d20
Message-Authenticator = 0x7a4d7c7be2ee2496a775e196a2eb7917
State = 0x7434f3c23d39bd4e387f775b92f550fd
Proxy-State = 0x38
Processing the post-proxy section of radiusd.conf
modcall: entering group post-proxy for request 2
attr_filter: Matched entry example.com at line 78
modcall[post-proxy]: module "attr_filter.post-proxy" returns updated for request 2
modcall[post-proxy]: module "eap" returns noop for request 2
modcall: leaving group post-proxy (returns updated) for request 2
Sending Access-Challenge of id 8 to 192.168.2.1 port 32797
Finished request 2
Going to the next request
Waking up in 1 seconds...
--- Walking the entire request list ---
 

Home Freeradius log

rlm_eap: Loaded and initialized type gtc
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = "(null)"
tls: pem_file_type = yes
tls: private_key_file = "/root/ssl/serverkey.pem"
tls: certificate_file = "/root/ssl/servercert.pem"
tls: CA_file = "/root/ssl/CA_nlab/cacert.pem"
tls: private_key_password = "pw4server"
tls: dh_file = "/usr/local/etc/raddb/cert/dh"
tls: random_file = "/usr/local/etc/raddb/cert/random"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = "(null)"
tls: cipher_list = "(null)"
tls: check_cert_issuer = "(null)"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
preprocess: hints = "/usr/local/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/usr/local/etc/raddb/users"
files: acctusersfile = "/usr/local/etc/raddb/acct_users"
files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
files: compat = "no"
[/usr/local/etc/raddb/users]:97 WARNING! Changing 'User-Password =' to 'User-Password ==' ?for comparing RADIUS attribute in check item list for user adam
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/usr/local/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication 192.168.2.2:1812
Listening on accounting 192.168.2.2:1813
Listening on proxy 192.168.2.2:1814
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.2.1:1814, id=0, length=175
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020100160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x10ea46dd1ac88f57ad11aef57787cb42
Proxy-State = 0x36
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_realm: Looking up realm "example.com" for User-Name = "vamsi at example.com"
rlm_realm: Found realm "example.com"
rlm_realm: Adding Stripped-User-Name = "vamsi"
rlm_realm: Proxying request from user vamsi to realm example.com
rlm_realm: Adding Realm = "example.com"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "suffix" returns noop for request 0
rlm_eap: EAP packet type response id 1 length 22
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 0
users: Matched entry vamsi at line 98
modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns updated) for request 0
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type tls
rlm_eap_tls: Requiring client certificate
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 0 to 192.168.2.1 port 1814
EAP-Message = 0x010200060d20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x65d253b8c2a41a0199caf4238686c5ac
Proxy-State = 0x36
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 0 with timestamp 45cca457
Nothing to do. Sleeping until we see a request.
 



thanking you,
gondi.

Vamsi Krishna GONDI,
16 rue Jean Pierre Laurens,
Fontenay Aux Roses, 92260,
France.
Ph no. +33 (0)6 20 38 51 53


 
____________________________________________________________________________________
Never Miss an Email
Stay connected with Yahoo! Mail on your mobile.  Get started!
http://mobile.yahoo.com/services?promote=mail



From gondi_vamsi  Fri Feb  9 08:42:10 2007
From: gondi_vamsi (vamsi krishna)
Date: Fri, 9 Feb 2007 08:42:10 -0800 (PST)
Subject: error on hostap while proxying
Message-ID: <643314.22660.qm@web30915.mail.mud.yahoo.com>

hi,

i am receiving an error on hostap

No message-authenticator attribute found
Incoming radius packet did not have correct message authenticator - droped


here is my scenario,

a computer is equiped with hostap and with a radius server, this radius server acts as a proxy to the home network,

      
freeradius server as radius server
                                    ____________________________
WPA supplicant ---->     | Hostapd + visiting Radius server|    ------------ home radius server
                                    |-----------------------------------------------|
when hostap recievs request for authentication from the WPA supplicant it sends request to the visiting radius server on the computer, visiting radius checks the realm and forwards the request to the Home AAA server. the home radius server checks the realm and sends the challenge as a reply, the visiting radius server recives challenges and forward the request to HOSTAP, hostap receives the packet and then i find this error.  

No message-authenticator attribute found
Incoming radius packet did not have correct message authenticator - droped

if anyone knows the error and where the problem is (hostap or visiting radius server or home radius server)please let me know 


Here are the log files

HOSTAPD

ath0: STA 00:0c:41:63:9e:37 IEEE 802.1X: received EAP packet (code=2 id=0 len=22) from STA: EAP Response-Identity (1)
ath0: STA 00:0c:41:63:9e:37 IEEE 802.1X: STA identity 'vamsi at example.com'
IEEE 802.1X: 00:0c:41:63:9e:37 BE_AUTH entering state RESPONSE
Encapsulating EAP message into a RADIUS packet
ath0: RADIUS Sending RADIUS message to authentication server
RADIUS message: code=1 (Access-Request) identifier=84 length=172
Attribute 1 (User-Name) length=19
Value: 'vamsi at example.com'
Attribute 4 (NAS-IP-Address) length=6
Value: 127.0.0.1
Attribute 5 (NAS-Port) length=6
Value: 0
Attribute 30 (Called-Station-Id) length=24
Value: '00-14-6C-2D-96-68:test'
Attribute 31 (Calling-Station-Id) length=19
Value: '00-0C-41-63-9E-37'
Attribute 12 (Framed-MTU) length=6
Value: 1400
Attribute 61 (NAS-Port-Type) length=6
Value: 19
Attribute 77 (Connect-Info) length=24
Value: 'CONNECT 11Mbps 802.11b'
Attribute 79 (EAP-Message) length=24
Value: 02 00 00 16 01 76 61 6d 73 69 40 65 78 61 6d 70 6c 65 2e 63 6f 6d
Attribute 80 (Message-Authenticator) length=18
Value: 30 d6 66 48 69 e3 ad 7d e1 df 3d 25 58 b3 47 e5
ath0: RADIUS Next RADIUS client retransmit in 3 seconds
IEEE 802.1X: 00:0c:41:63:9e:37 REAUTH_TIMER entering state INITIALIZE
IEEE 802.1X: 00:0c:41:63:9e:37 REAUTH_TIMER entering state INITIALIZE
ath0: RADIUS Received 20 bytes from RADIUS server
ath0: RADIUS Received RADIUS message
RADIUS message: code=11 (Access-Challenge) identifier=84 length=20
ath0: STA 00:0c:41:63:9e:37 RADIUS: Received RADIUS packet matched with a pending request, round trip time 0.04 sec
No Message-Authenticator attribute found
Incoming RADIUS packet did not have correct Message-Authenticator - dropped
ath0: STA 00:0c:41:63:9e:37 RADIUS: No RADIUS RX handler found (type=0 code=11 id=84) [INVALID AUTHENTICATOR] - dropping packet



Freeradius proxy server Log

Module: Loaded files
files: usersfile = "/usr/local/radius/etc/raddb/users"
files: acctusersfile = "/usr/local/radius/etc/raddb/acct_users"
files: preproxy_usersfile = "/usr/local/radius/etc/raddb/preproxy_users"
files: compat = "no"
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/usr/local/radius/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: header = "%t"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/usr/local/radius/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Module: Loaded attr_filter
attr_filter: attrsfile = "/usr/local/radius/etc/raddb/attrs"
Module: Instantiated attr_filter (attr_filter.post-proxy)
Initializing the thread pool...
Listening on authentication address * port 1812
Listening on accounting address * port 1813
Listening on proxy address * port 1814
Ready to process requests.
Nothing to do. Sleeping until we see a request.
rad_recv: Access-Request packet from host 192.168.2.1 port 32797, id=6, length=172
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020100160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0xfc294d717766228ca192244fb7fb4fdd
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
modcall[authorize]: module "unix" returns notfound for request 0
rlm_realm: Looking up realm "example.com" for User-Name = "vamsi at example.com"
rlm_realm: Found realm "example.com"
rlm_realm: Proxying request from user vamsi to realm example.com
rlm_realm: Adding Realm = "example.com"
rlm_realm: Preparing to proxy authentication request to realm "example.com"
modcall[authorize]: module "suffix" returns updated for request 0
rlm_eap: Request is supposed to be proxied to Realm example.com. Not doing EAP.
modcall[authorize]: module "eap" returns noop for request 0
modcall[authorize]: module "files" returns noop for request 0
modcall[authorize]: module "expiration" returns noop for request 0
modcall[authorize]: module "logintime" returns noop for request 0
modcall[authorize]: module "pap" returns noop for request 0
modcall: leaving group authorize (returns updated) for request 0
Sending Access-Request of id 0 to 192.168.2.2 port 1812
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020100160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x36
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Challenge packet from host 192.168.2.2 port 1812, id=0, length=67
EAP-Message = 0x010200060d20
Message-Authenticator = 0x288ae9dc209ee56b770989b732866ea3
State = 0x65d253b8c2a41a0199caf4238686c5ac
Proxy-State = 0x36
Processing the post-proxy section of radiusd.conf
modcall: entering group post-proxy for request 0
attr_filter: Matched entry example.com at line 78
modcall[post-proxy]: module "attr_filter.post-proxy" returns updated for request 0
modcall[post-proxy]: module "eap" returns noop for request 0
modcall: leaving group post-proxy (returns updated) for request 0
Sending Access-Challenge of id 6 to 192.168.2.1 port 32797
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 5 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 6 with timestamp 45cca049
Nothing to do. Sleeping until we see a request.
rad_recv: Access-Request packet from host 192.168.2.1 port 32797, id=7, length=172
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020300160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0xcddafa7bac6b4588863f37ac2f2c8f64
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 1
modcall[authorize]: module "preprocess" returns ok for request 1
modcall[authorize]: module "chap" returns noop for request 1
modcall[authorize]: module "mschap" returns noop for request 1
modcall[authorize]: module "unix" returns notfound for request 1
rlm_realm: Looking up realm "example.com" for User-Name = "vamsi at example.com"
rlm_realm: Found realm "example.com"
rlm_realm: Proxying request from user vamsi to realm example.com
rlm_realm: Adding Realm = "example.com"
rlm_realm: Preparing to proxy authentication request to realm "example.com"
modcall[authorize]: module "suffix" returns updated for request 1
rlm_eap: Request is supposed to be proxied to Realm example.com. Not doing EAP.
modcall[authorize]: module "eap" returns noop for request 1
modcall[authorize]: module "files" returns noop for request 1
modcall[authorize]: module "expiration" returns noop for request 1
modcall[authorize]: module "logintime" returns noop for request 1
modcall[authorize]: module "pap" returns noop for request 1
modcall: leaving group authorize (returns updated) for request 1
Sending Access-Request of id 1 to 192.168.2.2 port 1812
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020300160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x37
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Challenge packet from host 192.168.2.2 port 1812, id=1, length=67
EAP-Message = 0x010400060d20
Message-Authenticator = 0xbd8c0c961b4776663862e485580916cc
State = 0xe268b49f14e466fa6c110c25a9d37ba1
Proxy-State = 0x37
Processing the post-proxy section of radiusd.conf
modcall: entering group post-proxy for request 1
attr_filter: Matched entry example.com at line 78
modcall[post-proxy]: module "attr_filter.post-proxy" returns updated for request 1
modcall[post-proxy]: module "eap" returns noop for request 1
modcall: leaving group post-proxy (returns updated) for request 1
Sending Access-Challenge of id 7 to 192.168.2.1 port 32797
Finished request 1
Going to the next request
Waking up in 1 seconds...
--- Walking the entire request list ---
Waking up in 4 seconds...
--- Walking the entire request list ---
Cleaning up request 1 ID 7 with timestamp 45cca062
Nothing to do. Sleeping until we see a request.
rad_recv: Access-Request packet from host 192.168.2.1 port 32797, id=8, length=172
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020400160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x5ab02f96858376f10932ff80039a8a38
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 2
modcall[authorize]: module "preprocess" returns ok for request 2
modcall[authorize]: module "chap" returns noop for request 2
modcall[authorize]: module "mschap" returns noop for request 2
modcall[authorize]: module "unix" returns notfound for request 2
rlm_realm: Looking up realm "example.com" for User-Name = "vamsi at example.com"
rlm_realm: Found realm "example.com"
rlm_realm: Proxying request from user vamsi to realm example.com
rlm_realm: Adding Realm = "example.com"
rlm_realm: Preparing to proxy authentication request to realm "example.com"
modcall[authorize]: module "suffix" returns updated for request 2
rlm_eap: Request is supposed to be proxied to Realm example.com. Not doing EAP.
modcall[authorize]: module "eap" returns noop for request 2
modcall[authorize]: module "files" returns noop for request 2
modcall[authorize]: module "expiration" returns noop for request 2
modcall[authorize]: module "logintime" returns noop for request 2
modcall[authorize]: module "pap" returns noop for request 2
modcall: leaving group authorize (returns updated) for request 2
Sending Access-Request of id 2 to 192.168.2.2 port 1812
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020400160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x00000000000000000000000000000000
Proxy-State = 0x38
--- Walking the entire request list ---
Waking up in 1 seconds...
rad_recv: Access-Challenge packet from host 192.168.2.2 port 1812, id=2, length=67
EAP-Message = 0x010500060d20
Message-Authenticator = 0x7a4d7c7be2ee2496a775e196a2eb7917
State = 0x7434f3c23d39bd4e387f775b92f550fd
Proxy-State = 0x38
Processing the post-proxy section of radiusd.conf
modcall: entering group post-proxy for request 2
attr_filter: Matched entry example.com at line 78
modcall[post-proxy]: module "attr_filter.post-proxy" returns updated for request 2
modcall[post-proxy]: module "eap" returns noop for request 2
modcall: leaving group post-proxy (returns updated) for request 2
Sending Access-Challenge of id 8 to 192.168.2.1 port 32797
Finished request 2
Going to the next request
Waking up in 1 seconds...
--- Walking the entire request list ---


Home Freeradius log

rlm_eap: Loaded and initialized type gtc
tls: rsa_key_exchange = no
tls: dh_key_exchange = yes
tls: rsa_key_length = 512
tls: dh_key_length = 512
tls: verify_depth = 0
tls: CA_path = "(null)"
tls: pem_file_type = yes
tls: private_key_file = "/root/ssl/serverkey.pem"
tls: certificate_file = "/root/ssl/servercert.pem"
tls: CA_file = "/root/ssl/CA_nlab/cacert.pem"
tls: private_key_password = "pw4server"
tls: dh_file = "/usr/local/etc/raddb/cert/dh"
tls: random_file = "/usr/local/etc/raddb/cert/random"
tls: fragment_size = 1024
tls: include_length = yes
tls: check_crl = no
tls: check_cert_cn = "(null)"
tls: cipher_list = "(null)"
tls: check_cert_issuer = "(null)"
rlm_eap_tls: Loading the certificate file as a chain
rlm_eap: Loaded and initialized type tls
mschapv2: with_ntdomain_hack = no
rlm_eap: Loaded and initialized type mschapv2
Module: Instantiated eap (eap)
Module: Loaded preprocess
preprocess: huntgroups = "/usr/local/etc/raddb/huntgroups"
preprocess: hints = "/usr/local/etc/raddb/hints"
preprocess: with_ascend_hack = no
preprocess: ascend_channels_per_line = 23
preprocess: with_ntdomain_hack = no
preprocess: with_specialix_jetstream_hack = no
preprocess: with_cisco_vsa_hack = no
preprocess: with_alvarion_vsa_hack = no
Module: Instantiated preprocess (preprocess)
Module: Loaded realm
realm: format = "suffix"
realm: delimiter = "@"
realm: ignore_default = no
realm: ignore_null = no
Module: Instantiated realm (suffix)
Module: Loaded files
files: usersfile = "/usr/local/etc/raddb/users"
files: acctusersfile = "/usr/local/etc/raddb/acct_users"
files: preproxy_usersfile = "/usr/local/etc/raddb/preproxy_users"
files: compat = "no"
[/usr/local/etc/raddb/users]:97 WARNING! Changing 'User-Password =' to 'User-Password ==' ?for comparing RADIUS attribute in check item list for user adam
Module: Instantiated files (files)
Module: Loaded Acct-Unique-Session-Id
acct_unique: key = "User-Name, Acct-Session-Id, NAS-IP-Address, Client-IP-Address, NAS-Port"
Module: Instantiated acct_unique (acct_unique)
Module: Loaded detail
detail: detailfile = "/usr/local/var/log/radius/radacct/%{Client-IP-Address}/detail-%Y%m%d"
detail: detailperm = 384
detail: dirperm = 493
detail: locking = no
Module: Instantiated detail (detail)
Module: Loaded radutmp
radutmp: filename = "/usr/local/var/log/radius/radutmp"
radutmp: username = "%{User-Name}"
radutmp: case_sensitive = yes
radutmp: check_with_nas = yes
radutmp: perm = 384
radutmp: callerid = yes
Module: Instantiated radutmp (radutmp)
Listening on authentication 192.168.2.2:1812
Listening on accounting 192.168.2.2:1813
Listening on proxy 192.168.2.2:1814
Ready to process requests.
rad_recv: Access-Request packet from host 192.168.2.1:1814, id=0, length=175
User-Name = "vamsi at example.com"
NAS-IP-Address = 192.168.2.1
NAS-Port = 0
Called-Station-Id = "00-14-6C-2D-96-68:test"
Calling-Station-Id = "00-0C-41-63-9E-37"
Framed-MTU = 1400
NAS-Port-Type = Wireless-802.11
Connect-Info = "CONNECT 11Mbps 802.11b"
EAP-Message = 0x020100160176616d7369406578616d706c652e636f6d
Message-Authenticator = 0x10ea46dd1ac88f57ad11aef57787cb42
Proxy-State = 0x36
Processing the authorize section of radiusd.conf
modcall: entering group authorize for request 0
modcall[authorize]: module "preprocess" returns ok for request 0
modcall[authorize]: module "chap" returns noop for request 0
modcall[authorize]: module "mschap" returns noop for request 0
rlm_realm: Looking up realm "example.com" for User-Name = "vamsi at example.com"
rlm_realm: Found realm "example.com"
rlm_realm: Adding Stripped-User-Name = "vamsi"
rlm_realm: Proxying request from user vamsi to realm example.com
rlm_realm: Adding Realm = "example.com"
rlm_realm: Authentication realm is LOCAL.
modcall[authorize]: module "suffix" returns noop for request 0
rlm_eap: EAP packet type response id 1 length 22
rlm_eap: No EAP Start, assuming it's an on-going EAP conversation
modcall[authorize]: module "eap" returns updated for request 0
users: Matched entry vamsi at line 98
modcall[authorize]: module "files" returns ok for request 0
modcall: leaving group authorize (returns updated) for request 0
rad_check_password: Found Auth-Type EAP
auth: type "EAP"
Processing the authenticate section of radiusd.conf
modcall: entering group authenticate for request 0
rlm_eap: EAP Identity
rlm_eap: processing type tls
rlm_eap_tls: Requiring client certificate
rlm_eap_tls: Initiate
rlm_eap_tls: Start returned 1
modcall[authenticate]: module "eap" returns handled for request 0
modcall: leaving group authenticate (returns handled) for request 0
Sending Access-Challenge of id 0 to 192.168.2.1 port 1814
EAP-Message = 0x010200060d20
Message-Authenticator = 0x00000000000000000000000000000000
State = 0x65d253b8c2a41a0199caf4238686c5ac
Proxy-State = 0x36
Finished request 0
Going to the next request
--- Walking the entire request list ---
Waking up in 6 seconds...
--- Walking the entire request list ---
Cleaning up request 0 ID 0 with timestamp 45cca457
Nothing to do. Sleeping until we see a request.



thanking you,
gondi.
Vamsi Krishna GONDI,
16 rue Jean Pierre Laurens,
Fontenay Aux Roses, 92260,
France.
Ph no. +33 (0)6 20 38 51 53


 
____________________________________________________________________________________
No need to miss a message. Get email on-the-go 
with Yahoo! Mail for Mobile. Get started.
http://mobile.yahoo.com/mail 



From sj_qiu  Fri Feb  9 08:49:39 2007
From: sj_qiu (Sheng_Jun)
Date: Sat, 10 Feb 2007 00:49:39 +0800
Subject: Dear All,
Message-ID: <10702100049.AA01336@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From henrik  Fri Feb  9 09:10:26 2007
From: henrik (Henrik Brix Andersen)
Date: Fri, 9 Feb 2007 18:10:26 +0100
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <45CC9956.2010401@3dn.nl>
References: <45C9E3DB.3020703@3dn.nl> <45CC5C85.9070707@3dn.nl>
	<45CC9834.2060501@computer.org> <45CC9956.2010401@3dn.nl>
Message-ID: <20070209171026.GA96899@tirith.brixandersen.dk>

On Fri, Feb 09, 2007 at 04:55:02PM +0100, Fred Leeflang wrote:
> This helps a lot, thanks! As I have already gotten an Intel Pro 2200 
> MiniPCI (one's in my laptop)
> to work together with wpa_supplicant, I feel comfortable enough now to 
> purchase one of
> those cards and install it in my OpenWRT Asus WL500gP box, replacing the 
> Broadcom
> miniPCI.

That won't work. There is no support for HostAP mode in the current
versions of the ipw2200 Linux and *BSD drivers.

There is, however, a project which aims for making a Linux driver with
HostAP support, but it seems dead:

http://sourceforge.net/projects/ipw2200-ap

Regards,
Brix
-- 
Henrik Brix Andersen <henrik at brixandersen.dk>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 209 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20070209/0da575ec/attachment.pgp 


From proski  Fri Feb  9 09:57:35 2007
From: proski (Pavel Roskin)
Date: Fri, 09 Feb 2007 12:57:35 -0500
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <45CC9834.2060501@computer.org>
References: <45C9E3DB.3020703@3dn.nl> <45CC5C85.9070707@3dn.nl>
	<45CC9834.2060501@computer.org>
Message-ID: <1171043855.6306.3.camel@dv>

On Fri, 2007-02-09 at 16:50 +0100, Jan Ceuleers wrote:
> I have no experience with the Intel chipset that you mention, but if you 
> have a driver for it that is compatible with the Linux wireless 
> extensions then you should be able to use hostapd with it (compile it 
> for wext).

This is not true.  There is no such thing as hostapd for wext.

-- 
Regards,
Pavel Roskin




From proski  Fri Feb  9 10:12:47 2007
From: proski (Pavel Roskin)
Date: Fri, 09 Feb 2007 13:12:47 -0500
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <45C9E3DB.3020703@3dn.nl>
References: <45C9E3DB.3020703@3dn.nl>
Message-ID: <1171044767.6306.15.camel@dv>

On Wed, 2007-02-07 at 15:36 +0100, Fred Leeflang wrote:
> Hi,
> 
>  From http://hostap.epitest.fi/hostapd/ I read that hostapd
> supports:
> 
>     * Host AP driver for Prism2/2.5/3 <http://hostap.epitest.fi/>
>     * madwifi (Atheros ar521x) <http://sourceforge.net/projects/madwifi/>
>     * Prism54.org (Prism GT/Duette/Indigo) <http://www.prism54.org/>
>     * BSD net80211 layer (e.g., Atheros driver) (FreeBSD 6-CURRENT)

There is also support for Devicescape stack (d80211) based drivers, but
it's hard to compile to put it mildly.  The best bet would be to compile
hostapd against an older kernel that actually had the headers hostapd
needs.  Or take the current wireless-dev.git kernel and pick the stuff
needed for compilation one-by-one.

> I recently purchased an Asus WL-500gP, which has a Broadcom
> mini-pci. I installed openwrt on it and got it all to work quite well,
> using the 'nas' binary that comes with OpenWRT. The 'nas' binary
> handles the WPA-EAP which I've set up, so I'm actually running
> EAP-TTLS with inner PAP authentication on it.
> 
> There's only one 'but'; the nas binary doesn't support 802.1x accounting
> it seems. So in order to fix that I was looking into installing hostapd
> on the Asus. The list of supported cards is very slim though and I am
> not very optimistic that I'll get the Broadcom driver to work as that's
> still very experimental.

The Broadcom driver for d80211 supports the AP mode, but I've never had
any success with it.

> So another option I have is to install an Intel
> Pro 2200 mini pci card. This card seems to be pretty stable, and what's
> more, I also use wpa_supplicant on it with the -Dwext option.
> 
> Is it possible to run hostapd on an Intel Pro 2200 mini-pci card?

No.  The driver doesn't support the AP mode, and experimental AP driver
doesn't work with hostap.

I'm afraid the best bet for now would be MadWifi if you don't mind a
non-free HAL module and Prism 2.5 card if you can give up on 802.11g.

Prism54 and Broadcom would require some hacking and bugfixing.

Intel cards would likely require some serious coding.

-- 
Regards,
Pavel Roskin




From sj_qiu  Fri Feb  9 10:27:38 2007
From: sj_qiu (Sheng_Jun)
Date: Sat, 10 Feb 2007 02:27:38 +0800
Subject: Dear All,
Message-ID: <10702100227.AA00396@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From fredl  Fri Feb  9 11:04:34 2007
From: fredl (Fred Leeflang)
Date: Fri, 09 Feb 2007 20:04:34 +0100
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <1171044767.6306.15.camel@dv>
References: <45C9E3DB.3020703@3dn.nl> <1171044767.6306.15.camel@dv>
Message-ID: <45CCC5C2.2070609@3dn.nl>

Pavel Roskin wrote:
> There is also support for Devicescape stack (d80211) based drivers, but
> it's hard to compile to put it mildly.  The best bet would be to compile
> hostapd against an older kernel that actually had the headers hostapd
> needs.  Or take the current wireless-dev.git kernel and pick the stuff
> needed for compilation one-by-one.
>
>   
That's interesting that you'd say that. Older kernel? Am I
interpreting that wrong or is hostapd kind of obsoleted?
> The Broadcom driver for d80211 supports the AP mode, but I've never had
> any success with it.
>
>   
Hmm, so that's the criterium is it, that the NIC driver
supports AP mode. Well at least that makes asking for
something in a kernel developers list easier then.

I just replied earlier to Brix that I misunderstood
about the card I ordered being a 2200, since it's a
2100. I guess that doesn't make a huge difference?

Thanks,
Fred



From proski  Fri Feb  9 12:10:08 2007
From: proski (Pavel Roskin)
Date: Fri, 09 Feb 2007 15:10:08 -0500
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <45CCC5C2.2070609@3dn.nl>
References: <45C9E3DB.3020703@3dn.nl> <1171044767.6306.15.camel@dv>
	<45CCC5C2.2070609@3dn.nl>
Message-ID: <1171051808.6833.8.camel@dv>

On Fri, 2007-02-09 at 20:04 +0100, Fred Leeflang wrote:
> Pavel Roskin wrote:
> > There is also support for Devicescape stack (d80211) based drivers, but
> > it's hard to compile to put it mildly.  The best bet would be to compile
> > hostapd against an older kernel that actually had the headers hostapd
> > needs.  Or take the current wireless-dev.git kernel and pick the stuff
> > needed for compilation one-by-one.
> >
> >   
> That's interesting that you'd say that. Older kernel? Am I
> interpreting that wrong or is hostapd kind of obsoleted?

No, it's not obsoleted, but apparently the devicescape support in
hostapd fell behind the rapid changes on the kernel side.

I'll give it another try today, and I'll post a patch if I make one.  If
you don't hear from me, it means that it would take a bigger effort than
I can give it right now.

> > The Broadcom driver for d80211 supports the AP mode, but I've never had
> > any success with it.
> >
> >   
> Hmm, so that's the criterium is it, that the NIC driver
> supports AP mode. Well at least that makes asking for
> something in a kernel developers list easier then.

That's a necessary condition.

> I just replied earlier to Brix that I misunderstood
> about the card I ordered being a 2200, since it's a
> 2100. I guess that doesn't make a huge difference?

Not really huge.  ipw2200 has a very experimental driver with AP
support, so it could be made compatible with hostapd.  In case of
ipw2100, we don't have even that (as far as I know).

-- 
Regards,
Pavel Roskin




From rjc  Fri Feb  9 13:15:56 2007
From: rjc (Bob Carlson)
Date: Fri, 9 Feb 2007 14:15:56 -0700
Subject: [semi-OT] "virtual AP" (multiple beacon,
	multiple BSSID) on Linksysh/w
In-Reply-To: <0702090920350.28573@www.arte.unipi.it>
Message-ID: <20070209211604.960ACBEFE@smtp-auth.no-ip.com>

If that Linksys is an Atheros device, the hardware should be capable. Is
there an enabled telnet interface? If so, you may be able to configure VAPs
that way.

You may also find alternative load images that might have that capability.

Cheers, Bob


> -----Original Message-----
> From: hostap-bounces+bob.carlson=sigpro.com at shmoo.com [mailto:hostap-
> bounces+bob.carlson=sigpro.com at shmoo.com] On Behalf Of Federico Bianchi
> Sent: Friday, February 09, 2007 1:27 AM
> To: hostap at shmoo.com
> Subject: [semi-OT] "virtual AP" (multiple beacon, multiple BSSID) on
> Linksysh/w
> 
> 
> Does anyone know whether there is any way of getting a so-called "virtual
> AP" out of a Linksys WRT54GS (I also have a "spare" WRV54G, which might
> be
> a better choice)? Having a single WLAN network in my work environment (an
> humanities department, with a public access library; all in a XVII
> century
> building), with both an open Intranet and a sealed 802.1X Internet access
> would be much simpler for users.
> 
> Best regards, and thanks a lot for your help
> 
> 	 		Federico Bianchi
> 			Dipartimento di Storia delle Arti
> 			Universita` di Pisa
> 			piazza S.Matteo in Soarta, 2 - I56127 Pisa (Italy)
> 			tel.+39-050-587111 (cent.), +39-050-587224 (uff.)
> 			fax.+39-050-580128; e-mail:
<f.bianchi at arte.unipi.it>
> 			===================================================
> 			!DISCLAIMER!: my e-mail reflects _my_own_ opinions!
> 			===================================================
> 
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap




From proski  Fri Feb  9 16:17:23 2007
From: proski (Pavel Roskin)
Date: Fri, 09 Feb 2007 19:17:23 -0500
Subject: [PATCH] hostapd: update driver_devicescape for current
	wireless-dev.git
Message-ID: <1171066643.7039.29.camel@dv>

Don't add kernel includes to the include path - it can cause collisions
with sanitized Linux headers used by libc.  Don't define _LINUX_TYPES_H
in CFLAGS - it should not affect drivers other than driver_devicescape,
and it can be avoided now.

Don't include net/d80211_common.h and net/d80211_shared.h - they are
gone.  Include ieee80211_common.h instead.

Copy mode enum from net/d80211.h.  Including net/d80211.h would be too
much trouble as it includes other kernel headers.

Signed-off-by: Pavel Roskin <proski at gnu.org>

--- defconfig
+++ defconfig
@@ -29,9 +29,7 @@
 # be used to set these (WIRELESS_DEV must point to the root directory of the
 # wireless-dev.git tree).
 #WIRELESS_DEV=/usr/src/wireless-dev
-#CFLAGS += -I$(WIRELESS_DEV)/include
 #CFLAGS += -I$(WIRELESS_DEV)/net/d80211
-#CFLAGS += -D_LINUX_TYPES_H
 
 # Driver interface for FreeBSD net80211 layer (e.g., Atheros driver)
 #CONFIG_DRIVER_BSD=y
--- driver_devicescape.c
+++ driver_devicescape.c
@@ -38,11 +38,20 @@
 #include "sta_info.h"
 #include "hw_features.h"
 #include <hostapd_ioctl.h>
-#include <net/d80211_common.h>
-#include <net/d80211_shared.h>
+#include <ieee80211_common.h>
 #include "mlme.h"
 
 
+/* Copied from net/d80211.h */
+enum {
+	MODE_IEEE80211A = 0 /* IEEE 802.11a */,
+	MODE_IEEE80211B = 1 /* IEEE 802.11b only */,
+	MODE_ATHEROS_TURBO = 2 /* Atheros Turbo mode (2x.11a at 5 GHz) */,
+	MODE_IEEE80211G = 3 /* IEEE 802.11g (and 802.11b compatibility) */,
+	MODE_ATHEROS_TURBOG = 4 /* Atheros Turbo mode (2x.11g at 2.4 GHz) */,
+	NUM_IEEE80211_MODES = 5
+};
+
 struct i802_driver_data {
 	struct driver_ops ops;
 	struct hostapd_data *hapd;


-- 
Regards,
Pavel Roskin




From craigwharding  Sat Feb 10 06:23:23 2007
From: craigwharding (Craig Harding)
Date: Sat, 10 Feb 2007 10:53:23 -0330
Subject: Losing connection then reassociating to a different network in conf
	file
Message-ID: <be5b6b210702100623t5a8260fx92f83a1a2a78aad1@mail.gmail.com>

I find that if I have two network blocks in my conf file and if I lose the
connection to the primary network I would assume it should try to
re-associate with that same network but this isn't the case - it tries to
associate with the next lower priority network in the conf file.

Should this be addressed as a bug or is this the intended way that
wpa_supplicant should work...?

Craig.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070210/00da2a98/attachment.htm 


From gianko  Sat Feb 10 09:00:15 2007
From: gianko (Gianko)
Date: Sat, 10 Feb 2007 18:00:15 +0100
Subject: wpa_supplicant and hostap 0.4.4 on prism 2.5
Message-ID: <45CDFA1F.20803@trouge.net>

Hi all,
I'm trying to use wpa_supplicant with Intel PRO/Wireless (Prism 2.5)
using hostap driver 0.4.4 built-in source kernel 2.6.18 on debian
unstable:

wpa_driver_hostap_set_wpa: enabled=1
ioctl[PRISM2_IOCTL_PRISM2_PARAM]: Operation not supported
Driver does not support WPA.

Detailed infos:

# lspci -vv
[...]
02:08.0 Network controller: Intersil Corporation Prism 2.5 Wavelan
chipset (rev 01)
        Subsystem: Intel Corporation Unknown device 2510

# modinfo hostap_pci
filename:      
/lib/modules/2.6.18-ego/kernel/drivers/net/wireless/hostap/hostap_pci.ko
author:         Jouni Malinen
description:    Support for Intersil Prism2.5-based 802.11 wireless
LAN PCI cards.
license:        GPL
version:        0.4.4-kernel

# wpa_supplicant -c /etc/wpa_supplicant/wpa_supplicant.conf -D hostap
-i wlan0 -d
Initializing interface 'wlan0' conf
'/etc/wpa_supplicant/wpa_supplicant.conf' driver 'hostap'
ctrl_interface 'N/A' bridge 'N/A'
Configuration file '/etc/wpa_supplicant/wpa_supplicant.conf' ->
'/etc/wpa_supplicant/wpa_supplicant.conf'
Reading configuration file '/etc/wpa_supplicant/wpa_supplicant.conf'
Priority group 0
   id=0 ssid='myssid'
Initializing interface (2) 'wlan0'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
SIOCGIWRANGE: WE(compiled)=20 WE(source)=18 enc_capa=0xf
  capabilities: key_mgmt 0xf enc 0xf
Added alternative ifindex 14 (wifi0) for wireless events
WEXT: Operstate: linkmode=1, operstate=5
Added alternative ifindex 14 (wifi0) for wireless events
Own MAC address: 00:05:3c:08:fa:70
wpa_driver_hostap_set_wpa: enabled=1
ioctl[PRISM2_IOCTL_PRISM2_PARAM]: Operation not supported
Driver does not support WPA.
wpa_driver_hostap_set_key: alg=none key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_key: alg=none key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_hostap_set_countermeasures: enabled=0
wpa_driver_hostap_set_drop_unencrypted: enabled=1
Setting scan request: 0 sec 100000 usec
Added interface wlan0
RTM_NEWLINK: operstate=0 ifi_flags=0x1002 ()
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wifi0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x11043 ([UP][RUNNING][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x11003 ([UP][LOWER_UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wifi0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
State: DISCONNECTED -> SCANNING
Starting AP scan (specific SSID)
Scan SSID - hexdump_ascii(len=17):
     [cut]
Trying to get current scan results first without requesting a new scan
to speed up initial association
Received 0 bytes of scan results (0 BSSes)
Scan results: 0
Selecting BSS from priority group 0
No suitable AP found.
Setting scan request: 0 sec 0 usec
Starting AP scan (broadcast SSID)
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b19 len=8
Received 0 bytes of scan results (0 BSSes)
Scan results: 0
Selecting BSS from priority group 0
No suitable AP found.
Setting scan request: 5 sec 0 usec
CTRL-EVENT-TERMINATING - signal 2 received
Removing interface wlan0
State: SCANNING -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
wpa_driver_hostap_set_wpa: enabled=0
ioctl[PRISM2_IOCTL_PRISM2_PARAM]: Operation not supported
Failed to disable WPA in the driver.
wpa_driver_hostap_set_drop_unencrypted: enabled=0
wpa_driver_hostap_set_countermeasures: enabled=0
No keys have been configured - skip key clearing
WEXT: Operstate: linkmode=0, operstate=6
Cancelling scan request

# cat /etc/wpa_supplicant/wpa_supplicant.conf
network={
 ssid="nyssid"
 proto=WPA
 key_mgmt=WPA-PSK
 pairwise=TKIP
 group=TKIP
 psk="questaelamiabellachiave"
 scan_ssid=1
}

# grep -i tkip .config
CONFIG_IEEE80211_CRYPT_TKIP=y



thanks in advance
gianko

--




From jkmaline  Sat Feb 10 10:12:46 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 10:12:46 -0800
Subject: wpa_supplicant and hostap 0.4.4 on prism 2.5
In-Reply-To: <45CDFA1F.20803@trouge.net>
References: <45CDFA1F.20803@trouge.net>
Message-ID: <20070210181246.GD5066@jm.kir.nu>

On Sat, Feb 10, 2007 at 06:00:15PM +0100, Gianko wrote:

> I'm trying to use wpa_supplicant with Intel PRO/Wireless (Prism 2.5)
> using hostap driver 0.4.4 built-in source kernel 2.6.18 on debian
> unstable:
> 
> wpa_driver_hostap_set_wpa: enabled=1
> ioctl[PRISM2_IOCTL_PRISM2_PARAM]: Operation not supported
> Driver does not support WPA.

It is likely that the card you have has too old station firmware
(version 1.7.x or newer is needed for WPA). If that is the case (see,
e.g., dmesg output for STA f/w version), you would need to update the
firmware to be able to use WPA.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 10:17:27 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 10:17:27 -0800
Subject: [PATCH] hostapd: update driver_devicescape for
	current	wireless-dev.git
In-Reply-To: <1171066643.7039.29.camel@dv>
References: <1171066643.7039.29.camel@dv>
Message-ID: <20070210181727.GE5066@jm.kir.nu>

On Fri, Feb 09, 2007 at 07:17:23PM -0500, Pavel Roskin wrote:

> Don't add kernel includes to the include path - it can cause collisions
> with sanitized Linux headers used by libc.  Don't define _LINUX_TYPES_H
> in CFLAGS - it should not affect drivers other than driver_devicescape,
> and it can be avoided now.

Thanks, I had missed this part when fixing the build. There is indeed no
need for these anymore. Applied.

> Don't include net/d80211_common.h and net/d80211_shared.h - they are
> gone.  Include ieee80211_common.h instead.
> 
> Copy mode enum from net/d80211.h.  Including net/d80211.h would be too
> much trouble as it includes other kernel headers.

These are already in the development branch (which admittedly is
currently not available from hostap.epitest.fi; I'll try to add a 0.6
snapshot to the server at some point).

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 10:31:45 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 10:31:45 -0800
Subject: [PATCH] Fix gnutls usage
In-Reply-To: <20070123134925.3517a253@uberlaptop.development.ltl>
References: <20070123134925.3517a253@uberlaptop.development.ltl>
Message-ID: <20070210183145.GF5066@jm.kir.nu>

On Tue, Jan 23, 2007 at 01:49:25PM +0000, Roy Marples wrote:

> Attach patch enables compilation using gnu_tls-1.6.1
> It seems to work, but I can't claim credit for it as I nabbed it off a
> linuxtogo mailing list. Probably wasn't sent upstream as it was for
> wpa_supplicant-0.5.5

This patch is not correct for 0.5.7 since tls_connection_handshake()
interface has changed. Anyway, the issue is valid and I fixed this in
0.5.x and 0.6.x branches.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 10:42:23 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 10:42:23 -0800
Subject: invalid authenticator packet droped
In-Reply-To: <709505.50129.qm@web30901.mail.mud.yahoo.com>
References: <709505.50129.qm@web30901.mail.mud.yahoo.com>
Message-ID: <20070210184223.GG5066@jm.kir.nu>

On Fri, Feb 09, 2007 at 03:13:57AM -0800, vamsi krishna wrote:

> No message-authenticator attribute found
> Incoming radius packet did not have correct message authenticator - droped

> a computer is equiped with hostap and with a radius server, this radius server acts as a proxy to the home network,

> if anyone knows the error and where the problem is (hostap or visiting radius server or home radius server)please let me know 

It looks like either the proxy RADIUS server is not sending
Message-Authenticator attribute in the messages to hostapd. I've never
used FreeRADIUS as a proxy server so I do not know how it behaves
normally in this kind of configuration, but I would suggest verifying
that it is configured to include the authenticator in all RADIUS
messages to hostapd.
 
-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 10:44:03 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 10:44:03 -0800
Subject: WEP is possible, WPA not
In-Reply-To: <EB998357DB660742877807C9BD7D251BA3596E@SRVR1.searo.local>
References: <EB998357DB660742877807C9BD7D251BA3596E@SRVR1.searo.local>
Message-ID: <20070210184403.GH5066@jm.kir.nu>

On Fri, Feb 09, 2007 at 09:36:43AM +0100, Philippe Dhont  (Sea-ro) wrote:

> I have an intel 3945 wireless card, installed wpa_supplicant (via apt-get, debian etch installation).

Which versions of ipw3945 driver and wpa_supplicant are you using?

> The configuration for WEP works, but for WPA I never get an ip address from the DHCP server.

Could you please send debug log from wpa_supplicant for the WPA case?

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 10:46:10 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 10:46:10 -0800
Subject: frame cryptography
In-Reply-To: <1170955034.17999.6.camel@localhost.localdomain>
References: <20070208162038.45117.qmail@web28113.mail.ukl.yahoo.com>
	<1170955034.17999.6.camel@localhost.localdomain>
Message-ID: <20070210184610.GI5066@jm.kir.nu>

On Thu, Feb 08, 2007 at 12:17:14PM -0500, Dan Williams wrote:

> The drivers encrypt the frames.  Depending on how much functionality
> eventually gets pushed up to wpa_supplicant/userspace MLME, that may
> change, but I doubt it.

In theory, management frame encryption could be pushed to userspace for
IEEE 802.11w, but my current plans are that even that will remain in
driver/firmware/hardware. In other words, no frames are (and will likely
not be) encrypted in userspace.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 10:50:29 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 10:50:29 -0800
Subject: Intel 2200 Mini-PCI + hostapd
In-Reply-To: <1171044767.6306.15.camel@dv>
References: <45C9E3DB.3020703@3dn.nl> <1171044767.6306.15.camel@dv>
Message-ID: <20070210185029.GJ5066@jm.kir.nu>

On Fri, Feb 09, 2007 at 01:12:47PM -0500, Pavel Roskin wrote:

> The Broadcom driver for d80211 supports the AP mode, but I've never had
> any success with it.

The last time I tried this, I was able to complete WPA-PSK
authentication against this.. I do not think that the driver was sending
out beacon frames correctly, so some clients will not use it. Anyway,
this was quite long time ago, so that may have been fixed.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 10:55:48 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 10:55:48 -0800
Subject: USB wireless cards
In-Reply-To: <1170833699.3153.6.camel@amin>
References: <1170833699.3153.6.camel@amin>
Message-ID: <20070210185548.GK5066@jm.kir.nu>

On Wed, Feb 07, 2007 at 08:34:59AM +0100, Amin BEN ABDALLAH wrote:

> I am a new user of HostAP and I would like to use it in order to test a
> new EAP method. 

Do you just want to be able to test the EAP authentication part or the
full wireless setup? EAP methods can be tested with
wpa_supplicant/hostapd driver_test "emulation" that does not require any
wireless hardware.

> The problem is that my wireless device (ipw2200) doesn't support master
> mode. is it possible to use an USB wireless adaptor with hostAP (is mode
> master supported, is there any linux driver) ?

Are you talking about the Host AP driver or hostapd? Host AP driver
supports only Prism2/2.5/3-based cards in AP mode. hostapd can also be
used with some other drivers (madwifi, d80211 (the drivers that support
AP mode, like dadwifi), BSD). I don't know whether there are any USB
adapters that would support AP mode with any of the supported drivers.

> Finally, having 2 wireless cards (for example ipw2200 & usb adaptor), is
> it possible to use the XSupplicant and Authenticator on the same
> machine.

It should be possible to use a client and AP in the same host if you
have multiple wireless adapters.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 11:00:16 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 11:00:16 -0800
Subject: EAP-FAST Internal Crypto Libraries take a lot of time
In-Reply-To: <52E5BF168B8CA143A198D856F73D5A9D0F6AE4@blr-m3-msg.wipro.com>
References: <52E5BF168B8CA143A198D856F73D5A9D0F6AE4@blr-m3-msg.wipro.com>
Message-ID: <20070210190016.GL5066@jm.kir.nu>

On Fri, Jan 19, 2007 at 08:15:39PM +0530, ramprasad.rajendran at wipro.com wrote:

> The processor we are using is a 44MHz processor and it takes 6 mins to
> execute.
> I find that it is the operation a**b mod n. I tried using TomFastMath,
> but the size is too huge atleast 100kB extra
> Are there algorithms that are faster and smaller.

I would expect that not all of TFM would need to be added, i.e., what is
needed is just couple of more optimized algorithms for modular
multiplication. That should not increase size by 100 kB, but it may take
some effort to find the exact parts from LTM that would need to be
merged into libtommath.c. Based on my notes in libtommath.c, some set of
optimized algorithms increased the size by 15 kB.

-- 
Jouni Malinen                                            PGP id EFC895FA



From sj_qiu  Sat Feb 10 11:00:23 2007
From: sj_qiu (Sheng_Jun)
Date: Sun, 11 Feb 2007 03:00:23 +0800
Subject: Dear All,
Message-ID: <10702110300.AA01924@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From gianko  Sat Feb 10 12:08:36 2007
From: gianko (Gianko)
Date: Sat, 10 Feb 2007 21:08:36 +0100
Subject: wpa_supplicant and hostap 0.4.4 on prism 2.5
In-Reply-To: <20070210181246.GD5066@jm.kir.nu>
References: <45CDFA1F.20803@trouge.net> <20070210181246.GD5066@jm.kir.nu>
Message-ID: <45CE2644.9080708@trouge.net>

Jouni Malinen ha scritto:
> It is likely that the card you have has too old station firmware
> (version 1.7.x or newer is needed for WPA). If that is the case
> (see, e.g., dmesg output for STA f/w version), you would need to
> update the firmware to be able to use WPA.
You're right, I've 1.3.6 firmware version

# dmesg | grep STA
[20497.108000] wifi0: STA: id=0x1f v1.3.6

I found this:
http://lists.shmoo.com/pipermail/hostap/2003-March/001746.html
Can I follow the same way to upgrade firmware?

gianko





From jkmaline  Sat Feb 10 19:38:44 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 19:38:44 -0800
Subject: APs and multiple BSSID support (OT?)
In-Reply-To: <20070207060601.C5A8ABF03@smtp-auth.no-ip.com>
References: <20070207040127.GE6702@jm.kir.nu>
	<20070207060601.C5A8ABF03@smtp-auth.no-ip.com>
Message-ID: <20070211033844.GM5066@jm.kir.nu>

On Tue, Feb 06, 2007 at 11:05:50PM -0700, Bob Carlson wrote:

> The problem with mult. SSID/BSSIDs is that there is no way to make the
> hardware aware of 2 different BSSIDs for things like timing derived from
> the beacons. I believe I can connect to two different BSSIDs if they are
> supported by the same physical AP. Beacons from the same physical AP will
> share many attributes such as timing, channel, rates, etc.

There is no guarantee that Beacons from the same physical radio will
share these attributes.. As far as channel is concerned, it will most
likely be the same and also TSF is likely to be shared. However,
advertised rate sets could be different..

Which timing problems are you worried about? If I understood correctly,
you did not require power save support which makes this much easier..
Even WMM could be mostly doable assuming the APs are using more or less
compatible settings (or the client radio supports large enough set of TX
queues).

I would expect that this type of virtual client could associate with
multiple BSSes from multiple APs as long as these BSSes are using the
same channel. Whether everything works exactly in the same way as it
would with multiple radios (one per client STA) is another question and
how important this is depends on the use.

> That's a long winded explanation for a simple need. Because I can only
> successfully connect to 2 different BSSIDs if they are supported by the
> same physical AP, I would like a way to determine that. The Atheros and
> Cisco address methods allow me to do that. However, if other vendors choose
> their multiple BSSIDs differently (I have seen a proposal that the BSSID be
> generated randomly in the local space) I don't see any way to determine
> "same physical AP."

I don't think there is generic mechanism for determining whether there
is single physical radio or not.. As an example, I'm aware of multiple
different ways of doing this with Atheros hardware and I know that more
than one mechanism has been deployed.

> If there is another way to determine whether 2 beacons or probe responses
> with different BSSIDs come from the same physical AP, I would love to hear
> of it.

This would get complex if all cases would need to be caught without
co-operation from the APs. I'm not sure whether this is worth the
problem taken into account the virtual clients are likely to work well
enough with multiple APs for most uses.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 19:48:31 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 19:48:31 -0800
Subject: TX rate changes in a non-AP mode
In-Reply-To: <11cc02d70701171751o36c0da01ra331a2fcbe38a312@mail.gmail.com>
References: <11cc02d70701171751o36c0da01ra331a2fcbe38a312@mail.gmail.com>
Message-ID: <20070211034831.GN5066@jm.kir.nu>

On Wed, Jan 17, 2007 at 05:51:25PM -0800, Vinayak Naik wrote:

> We are using the driver (3.7) in psuedo_ibss mode on a SMC 2532W-B
> card. But we are still seeing that the TX rate changes. I understand
> that the firmware may also adapt the rate. By looking at
> "/proc/net/hostap/wlan0/debug", I confirmed that the firmware is not
> in-charge of the rate control.

"FW TX rate control" in that procfs file is only valid for master mode.
Firmware is taking care of rate control for client modes (both
managed/infra and all adhoc modes).

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 19:52:31 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 19:52:31 -0800
Subject: Configuration of hostapd for: EAP-PEAP/TLS (outer PEAP and inner
	TLS configuration)
In-Reply-To: <6515B0F6EA9C7641B54C65BA944CC41503E12197@ABGEX01E.abg.fsc.net>
References: <6515B0F6EA9C7641B54C65BA944CC41503E12197@ABGEX01E.abg.fsc.net>
Message-ID: <20070211035231.GO5066@jm.kir.nu>

On Wed, Jan 17, 2007 at 09:26:56AM +0100, Heiss, Stefan wrote:
> I want to configure hostapd in such a way that it will do outer PEAP and inner TLS configuraiton. 

hostapd does not support this.

> There is actually a example for using TTLS/TLS(outer TTLS and inner TLS authentication) which is:
>  # WPA-EAP, EAP-TTLS with different CA certificate used for outer and inner authentication.
> network={
> ssid="example"

..

This is not for hostapd, but for wpa_supplicant..

> From this example, I would like to derive the PEAP/TLS configuration, and version one would be: 
> network={
> ssid="example"
> key_mgmt=WPA-EAP
> eap=PEAP
> # Phase1 / outer authentication
> #anonymous_identity=anonymous at example.com <mailto:>  => anonymous identitiy is not required for PEAP therefore leave it out
> ca_cert="/etc/cert/ca.pem"
> # Phase 2 / inner authentication
> phase2="autheap=TLS"

That should be auth=TLS for PEAP (only TTLS has two different types of
inner methods, auth=PAP/CHAP/MSCHAP/MSCHAPV2 and autheap=<eap method>;
that autheap for TTLS is similar to auth with PEAP).

> ca_cert2="/etc/cert/ca2.pem"
> client_cert2="/etc/cer/user.pem"
> private_key2="/etc/cer/user.prv"
> private_key2_passwd="password"
> priority=2

> I wonder which version would do the configuration correct for PEAP/TLS.

The first one was closer. phase2 should be changed, but other than that,
it looked file.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 19:58:36 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 19:58:36 -0800
Subject: Where to start?
In-Reply-To: <1169315621.8119.27.camel@Flunder>
References: <1168718968.13531.6.camel@Flunder> <1168893693.4130.6.camel@dv>
	<1169315621.8119.27.camel@Flunder>
Message-ID: <20070211035836.GP5066@jm.kir.nu>

On Sat, Jan 20, 2007 at 06:53:41PM +0100, haldor wrote:

> I want to download the latest firmware to my mini pci card, but when i
> type
> 
> [root at blubb 1.7.4]#  prism2_srec -v eth3 pk010101.hex sf010704.hex
> Could not read wlan PDA. This requires PRISM2_DOWNLOAD_SUPPORT
> definition in driver/module/hostap_config.h.

This message is getting bit obsolete.. It is referring to the external
Host AP driver source code package and is not the best way of doing this
with the version included in the current Linux 2.6.x kernel versions. It
should now be possible to enable firmware download in kernel
configuration (CONFIG_HOSTAP_FIRMWARE=y and
CONFIG_HOSTAP_FIRMWARE_NVRAM=y in .config).

> I guess the downloaded hostap driver package just is the same as i the
> kernel sources, so i stayes with the kernel sources.

It is not; the external package is older. Only the version included in
the kernel source should be used with current 2.6.x kernels.

> there i find the following files
> 
> hostap_cs.ko  hostap.ko  hostap_pci.ko  hostap_plx.ko
> 
> In this directory, i typed
> 
> # modprobe ./hostap.ko 
> 
> but i says
> 
> FATAL: Module ./hostap.ko not found.

modprobe tries to load the module automatically. If you want to force a
specific module file to be loaded, you would need to use insmod instead.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 20:01:36 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 20:01:36 -0800
Subject: wpa_supplicant, PEAP and SSL
In-Reply-To: <454110.86300.qm@web56810.mail.re3.yahoo.com>
References: <454110.86300.qm@web56810.mail.re3.yahoo.com>
Message-ID: <20070211040136.GQ5066@jm.kir.nu>

On Mon, Jan 15, 2007 at 08:30:48AM -0800, rolando david wrote:

> I have been trying to figure out why I cannot connect to my network via RADIUS and PEAP. I can connect using fine using several W2K clients but when I attempt to connect a linux client I cannot. I logged the errors and have noticed that there is an issue with SSL and my client server handshake:

I did not notice any problems in this debug output.. Can you be more
specific on what you believe would an issue in the log? Please send more
complete log file if this is still an open issue.

> My wpa_supplicant.conf:
> phase1="peaplabel=1" 

This is most likely incorrect and I would recommend removing this line
from the configuration unless you are absolutely sure it is needed with
the authentication server you are using.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 20:04:51 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 20:04:51 -0800
Subject: wpa_supplicant,PEAP and WEP Error
In-Reply-To: <667213.30083.qm@web56805.mail.re3.yahoo.com>
References: <667213.30083.qm@web56805.mail.re3.yahoo.com>
Message-ID: <20070211040451.GR5066@jm.kir.nu>

On Mon, Jan 15, 2007 at 09:05:19AM -0800, rolando david wrote:
> I have made another attempt at seting PEAP using FREERADIUS ( I do not use Dynamic WEP). My windows clients are fine but  my linux clients cannot connect: here is my new configured wpa_supplicant:

What exactly do you mean with not using dynamic WEP? The configuration
you use with wpa_supplicant is set to use dynamic WEP and the AP seems
to also be trying to use dynamic WEP..

> network={
>              ssid="my ssid"
>              key_mgmt=IEEE8021x
>              eap=PEAP
>              auth_alg=OPEN
>              identity="OPENRADIUS ID"
>              password="PASSWORD"
>              ca_cert="/path/to/cert/cacert.pem    
>              phase1="peaplabel=1"

peaplabel=1 must not be used with FreeRADIUS.

>              phase2="auth=MSCHAPV2"
>              priority=10
> }  

If you really want to disable dynamic WEP, you would need to add
eapol_flags=0 line into the network block. Please note that you will
also need to configure the AP not to use this.

> I get this error  from my debug and then it fails:
> 
> CTRL-EVENT-EAP-SUCCESS EAP authentication completed successfully 
> EAPOL: Invalid key signature in EAPOL-key packet 

I would guess that this happens because of the peaplabel=1 parameter. If
removing that line does not fix this, please send full debug log from
wpa_supplicant (-dd on command line).

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 20:07:50 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 20:07:50 -0800
Subject: Trouble connecting to wpa tkip peap network
In-Reply-To: <be5b6b210701171250wc2a1bd7r26fbcd3696b998ad@mail.gmail.com>
References: <be5b6b210701171250wc2a1bd7r26fbcd3696b998ad@mail.gmail.com>
Message-ID: <20070211040750.GS5066@jm.kir.nu>

On Wed, Jan 17, 2007 at 05:20:08PM -0330, Craig Harding wrote:

> My config file (from school computing center):
> 
> # BEGIN CONFIG FILE
> ctrl_interface=/var/run/wpa_supplicant
> ctrl_interface_group=users
> eapol_version=1
> ap_scan=2
> fast_reauth=1
> 
> network={
>        ssid="stu"
>        proto=WPA
>        scan_ssid=1
>        key_mgmt=WPA-EAP
>        eap=PEAP
>        identity="USERNAME"
>        password="PASSWORD"
>        phase1="include_tls_length=1 peaplabel=0"
>        phase2="auth=MSCHAPV2"
> }
> # END CONFIG FILE

Are you sure this is the exact same configuration file that you used to
generate the debug log?

> The wpa_supplicant command I'm using:
>   wpa_supplicant -Dwext -iwlan0 -c/etc/wpa_supplicant.conf -ddd

> OpenSSL: tls_connection_ca_cert - Failed to load root certificates
> error:02001002:system library:fopen:No such file or directory

This should not show up here if the configuration file does not set
ca_cert.. Please send full debug log from wpa_supplicant (i.e.,
including configuration parsing) if this is still an open issue.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Sat Feb 10 20:12:17 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 10 Feb 2007 20:12:17 -0800
Subject: How hostapd get frames from Driver??
In-Reply-To: <58803.203.143.168.101.1168739107.squirrel@mailbag.nicta.com.au>
References: <58803.203.143.168.101.1168739107.squirrel@mailbag.nicta.com.au>
Message-ID: <20070211041217.GT5066@jm.kir.nu>

On Sun, Jan 14, 2007 at 12:45:07PM +1100, Nazeer Khan wrote:

> I just wanted to ask how hostapd get frames from the driver. I am
> interested about wireless (madwifi). I am a bit confused. Is madwifi
> stripping off the 802.11 header and giving the resultant to hostapd or
> hostapd itself stips off the 802.11 header??

In case of madwifi driver, yes, the driver/net80211 is taking care of
802.11 management frames (i.e., hostapd does not receive them) and the
driver converts the 802.11 header in data frames to Ethernet headers.

> I am not sure but wat i understand by looking at the code in "l2_packet.h"
> and "l2_packet_linux.c" is that hostapd deals with ethernet frames not
> 802.11 frames. Am i right??

Yes, l2_packet is used to receive data frames with Ethernet header. In
case of madwifi, this is used to receive EAPOL frames from IEEE
802.1X/WPA authentication.

> I wanted to ask how hostapd is getting frames from the driver. (Whether
> they are ethernet or wireless)

Depends on the driver.. The description above is for madwifi. In case of
Host AP driver and net/d80211 (Devicescape stack), frames are delivered
differently and hostapd is actually receiving them with 802.11 headers.

-- 
Jouni Malinen                                            PGP id EFC895FA



From sj_qiu  Sat Feb 10 20:43:42 2007
From: sj_qiu (Sheng_Jun)
Date: Sun, 11 Feb 2007 12:43:42 +0800
Subject: Dear All,
Message-ID: <10702111243.AA01912@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From craigwharding  Sun Feb 11 06:49:02 2007
From: craigwharding (Craig Harding)
Date: Sun, 11 Feb 2007 11:19:02 -0330
Subject: Trouble connecting to wpa tkip peap network
In-Reply-To: <20070211040750.GS5066@jm.kir.nu>
References: <be5b6b210701171250wc2a1bd7r26fbcd3696b998ad@mail.gmail.com>
	<20070211040750.GS5066@jm.kir.nu>
Message-ID: <be5b6b210702110649w5ddca748p90782145b9e8d2c0@mail.gmail.com>

This has been corrected (I later sent a separate email to the list) because
the 'pairwise=TKIP' was not set in my network block. It was using (by
default CCMP).

Craig.

On 2/11/07, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Wed, Jan 17, 2007 at 05:20:08PM -0330, Craig Harding wrote:
>
> > My config file (from school computing center):
> >
> > # BEGIN CONFIG FILE
> > ctrl_interface=/var/run/wpa_supplicant
> > ctrl_interface_group=users
> > eapol_version=1
> > ap_scan=2
> > fast_reauth=1
> >
> > network={
> >        ssid="stu"
> >        proto=WPA
> >        scan_ssid=1
> >        key_mgmt=WPA-EAP
> >        eap=PEAP
> >        identity="USERNAME"
> >        password="PASSWORD"
> >        phase1="include_tls_length=1 peaplabel=0"
> >        phase2="auth=MSCHAPV2"
> > }
> > # END CONFIG FILE
>
> Are you sure this is the exact same configuration file that you used to
> generate the debug log?
>
> > The wpa_supplicant command I'm using:
> >   wpa_supplicant -Dwext -iwlan0 -c/etc/wpa_supplicant.conf -ddd
>
> > OpenSSL: tls_connection_ca_cert - Failed to load root certificates
> > error:02001002:system library:fopen:No such file or directory
>
> This should not show up here if the configuration file does not set
> ca_cert.. Please send full debug log from wpa_supplicant (i.e.,
> including configuration parsing) if this is still an open issue.
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070211/2e5cbf99/attachment.htm 


From jkmaline  Sun Feb 11 10:19:14 2007
From: jkmaline (Jouni Malinen)
Date: Sun, 11 Feb 2007 10:19:14 -0800
Subject: New hostap.epitest.fi server at Hosted@ISC
Message-ID: <20070211181913.GA5067@jm.kir.nu>

Thanks to Internet Systems Consortium (ISC, http://www.isc.org/),
hostap.epitest.fi has a new server at the ISC's data center. This is a
major improvement for the hostap.epitest.fi site and hopefully the
problems that showed up during the last month or so are now gone. ISC
hosts number of open source projects (e.g., kernel.org) and has quite
good connections to major networks, so accessing the server should now
be quite a bit faster (especially when compared to the last days when I
ran a temporary server on a very limited embedded device on my DSL line
with quite limited uplink speed.. ;-).

I just changed the DNS records for hostap.epitest.fi, so it may take
some time for the changes to propagate to other DNS servers that may
still cache the old address. Anyway, the new address should be available
within next couple of hours.

-- 
Jouni Malinen                                            PGP id EFC895FA



From mikhail.kostousov  Sun Feb 11 15:38:38 2007
From: mikhail.kostousov (Mikhail Kostousov)
Date: Mon, 12 Feb 2007 00:38:38 +0100
Subject: wired 802.1X authorization for Asus wl500gx router
Message-ID: <ad9d3dbd0702111538h6769b731v9a67c38f59eda5e1@mail.gmail.com>

Hello!
My provider required 802.1X authorization with dynamic WEP keys for wired
network. I've got it from my desktop computer, with next config:
##################################
### wpa_supplicant_wired.conf
ctrl_interface=/var/run/wpa_supplicant
ap_scan=0
network={
        key_mgmt=IEEE8021X WPA-EAP
        eap=PEAP
        phase2="auth=MSCHAPV2"
        identity= (my user)
        password= (my password)
}
##################################

With command:
wpa_supplicant -ieth0 -Dwired -c wpa_supplicant_wired.conf -dd

After that I compiled wpa_supplicant for my router, and tried to do such
thing with router. I got following log:

Initializing interface 'vlan1' conf 'wpa_supplicant.conf' driver 'wired'
ctrl_interface 'N/A' bridge 'N/A'
Configuration file 'wpa_supplicant.conf' ->
'/tmp/harddisk/wpa_supplicant.conf'
Reading configuration file '/tmp/harddisk/wpa_supplicant.conf'
ctrl_interface='/var/run/wpa_supplicant'
ap_scan=0
Line: 5 - start of a new network block
key_mgmt: 0x9
eap methods - hexdump(len=16): 00 00 00 00 19 00 00 00 00 00 00 00 00 00 00
00
phase2 - hexdump_ascii(len=13):
     XX XX XX XX XX XX XX XX XX XX XX XX            auth=MSCHAPV2
identity - hexdump_ascii(len=7):
     XX XX XX XX XX XX XX                              aaaaaaa
password - hexdump_ascii(len=8): [REMOVED]
Priority group 0
   id=0 ssid=''
Initializing interface (2) 'vlan1'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
wpa_driver_wired_init: Added multicast membership with packet socket
Own MAC address: 00:15:f2:88:fb:31
Setting scan request: 0 sec 100000 usec
Added interface vlan1
EAPOL: External notification - portControl=Auto
Already associated with a configured network - generating associated event
Association info event
State: DISCONNECTED -> ASSOCIATED
Associated to a new BSS: BSSID=01:80:c2:00:00:03
No keys have been configured - skip key clearing
Network configuration found for the current AP
WPA: No WPA/RSN IE available from association info
WPA: Set cipher suites based on configuration
WPA: Selected cipher suites: group 30 pairwise 24 key_mgmt 9 proto 2
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: using GTK CCMP
WPA: using PTK CCMP
WPA: using KEY_MGMT 802.1X
WPA: Set own WPA IE default - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00
00 0f ac 04 01 00 00 0f ac 01 00 00
EAPOL: External notification - portControl=Auto
Associated with 01:80:c2:00:00:03
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Cancelling scan request
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
EAPOL: idleWhile --> 0
EAP: EAP entering state FAILURE
CTRL-EVENT-EAP-FAILURE EAP authentication failed
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state FAIL
EAPOL: SUPP_PAE entering state HELD
EAPOL: SUPP_BE entering state IDLE
EAPOL: startWhen --> 0
CTRL-EVENT-TERMINATING - signal 2 received
Removing interface vlan1
State: ASSOCIATED -> DISCONNECTED
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portValid=0
No keys have been configured - skip key clearing
Cancelling scan request
Cancelling authentication timeout


I've tried to compare log of router and of desktop, and I found that
difference begin from line "EAPOL: idleWhile --> 0". Desktop doesn't have
this line. It has "RX EAPOL from 00:15:62:a3:53:86".

I cannot understand, why it happens on router. I am using the same
configuration of wpa_supplicant, the same configuration of compilation
(exclude options for CC compiler).
Where is the problem?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070212/4d1ce55d/attachment.htm 


From sj_qiu  Sun Feb 11 15:54:12 2007
From: sj_qiu (Sheng_Jun)
Date: Mon, 12 Feb 2007 07:54:12 +0800
Subject: Dear All,
Message-ID: <10702120754.AA01888@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From david.goodenough  Mon Feb 12 03:35:55 2007
From: david.goodenough (David Goodenough)
Date: Mon, 12 Feb 2007 11:35:55 +0000
Subject: wpa_supplicant problem with Prism card
Message-ID: <200702121135.59184.david.goodenough@btconnect.com>

I have a need to be able to connect to a number of different APs, so I 
thought using wpa_supplicant and its wpa_roam function.  But I am 
obviously doing something wrong.

In order to keep things simple I have turned off security on the AP
I am trying to connect to.

I have a /etc/wpa_supplicant.conf which has the following entries:-

<<<<<<<<<<<<<
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0

eapol_version=1
ap_scan=1
fast_reauth=1

network={
        ssid="21highst"
        key_mgmt=NONE
        id_str="21highst"
}
<<<<<<<<<<<<<

My /etc/network/interfaces (yes I am a Debian sid user) reads:-

<<<<<<<<<<<
auto wlan0
iface wlan0 inet manual
        wpa-roam /etc/wpa_supplicant.conf

iface 21highst inet dhcp
<<<<<<<<<<<

and it never manages to associate with the AP.

However if my /etc/network/interfaces file reads:-

<<<<<<<<<<<
auto wlan0
iface wlan0 inet dhcp
	wireless-essid 21highst
	wireless-mode Managed
<<<<<<<<<<<

it works a treat.

I assume (maybe wrongly) that it takes the ssid from the one it has
selected (and iwconfig supports this), and the mode (managed in this
case) from the fact that it is an AP it is associating with (not an
ad-hoc) and again iwconfig looks good.  iwconfig also reports adequate
signal and the right channel.

I tried using --verbose on the ifup command, but that did not tell me
anything useful.  Can I tell wpa_supplicant to be a bit more chatty and
tell me what is going on?

Any ideas?

David



From egrumbach  Mon Feb 12 05:18:07 2007
From: egrumbach (Emmanuel Grumbach)
Date: Mon, 12 Feb 2007 15:18:07 +0200
Subject: Troubles with beacon_settings
Message-ID: <8704f27d0702120518w41c5df1aoa082c3827cb700a4@mail.gmail.com>

I am trying to develop a driver for a WLAN NIC using D80211, and to have it
working as an AP with Hostapd on top of D80211. Logically, I need a new
beacon every DTIM period since the TIM Information Element gets changed
every DTIM period. In my hostapd.conf:

beacon_int = 100
dtim_period = 2

I thought that hostapd should send an ioctl to set the beacon, this ioctl
would be translated to ieee80211_config_interface by D80211 with the beacon
set by hostapd. At least, according to my understanding of
driver_devicescape.c, this is what should happen. My problem is that this
ioctl comes very late in the init process. Here is a short description of
the init flow of D80211 (when hostapd sends its instructions), this is a
list of handlers that I implement, and that D80211 calls:

   1. add_interface
   2. open (here I should be already able to send beacons according to
   d80211.h)
   3. config_interface (several times with beacon NULL)

And much later, config_interface is called again with a non-null beacon.

All this when I register as a driver that needs a beacon template. When I
register as a driver that needs a full beacon frame, I should be able to
call ieee80211_beacon_get to get a beacon, but this does not work (beacon is
NULL).

Questions:
1) Am I right with I thought ?
2) Why does Hostapd begins to open and start my device before being able to
give me a valid beacon ?
3) Is this a problem in Hostapd or D80211 or neither ?

thanks

-- 
Emmanuel Grumbach
egrumbach at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070212/f9dd5d07/attachment.htm 


From egrumbach  Mon Feb 12 05:29:08 2007
From: egrumbach (Emmanuel Grumbach)
Date: Mon, 12 Feb 2007 15:29:08 +0200
Subject: Hostapd / D802111
Message-ID: <8704f27d0702120529t657565fcr7603085a624942b@mail.gmail.com>

Sorry, I forgot to say that:

hostapd -version returns v0.5.7
I use the latest kernel from wireless-dev, after the sync with 2.6.20

thanks

-- 
Emmanuel Grumbach
egrumbach at gmail.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070212/9d987d8f/attachment.htm 


From rjc  Mon Feb 12 14:55:53 2007
From: rjc (Bob Carlson)
Date: Mon, 12 Feb 2007 15:55:53 -0700
Subject: APs and multiple BSSID support (OT?)
In-Reply-To: <20070211033844.GM5066@jm.kir.nu>
Message-ID: <20070212225627.11310C01D@smtp-auth.no-ip.com>

> -----Original Message-----
> Jouni Malinen
...
> > share many attributes such as timing, channel, rates, etc.
> 
> There is no guarantee that Beacons from the same physical radio will
> share these attributes.. As far as channel is concerned, it will most
> likely be the same and also TSF is likely to be shared. However,
> advertised rate sets could be different..
> 
> Which timing problems are you worried about? If I understood correctly,
> you did not require power save support which makes this much easier..
> Even WMM could be mostly doable assuming the APs are using more or less
> compatible settings (or the client radio supports large enough set of TX
> queues).

I pretty much agree with everything you said. My worry is pretty general.
The entire .11 protocol depends on exquisite timing and I worry that there
are subtleties that I'm unaware of. I prefer not to take the risk of
committing to the completely general implementation. As it is, I have had
to make changes that involve hundreds of references to data structures
whose usage pattern I am changing. Having two completely unrelated virtual
clients would require much more extensive changes. Handling different WMM
settings is far beyond what I can do in a reasonable amount of time.
Another engineer is doing the UI for the project, but I'm doing everything
else.
 
> I would expect that this type of virtual client could associate with
> multiple BSSes from multiple APs as long as these BSSes are using the
> same channel. Whether everything works exactly in the same way as it
> would with multiple radios (one per client STA) is another question and
> how important this is depends on the use.
>
> I don't think there is generic mechanism for determining whether there
> is single physical radio or not.. As an example, I'm aware of multiple
> different ways of doing this with Atheros hardware and I know that more
> than one mechanism has been deployed.
> 
> > If there is another way to determine whether 2 beacons or probe
> > responses with different BSSIDs come from the same physical AP, I 
> > would love to hear of it.
> 
> This would get complex if all cases would need to be caught without
> co-operation from the APs. I'm not sure whether this is worth the
> problem taken into account the virtual clients are likely to work well
> enough with multiple APs for most uses.

Again, I pretty much agree with you. That's why I asked the question. If I
know of many specific and incompatible methods, I may have to allow
connection to 2 apparently unrelated SSIDs.

I know exactly what the Atheros HW can do regarding BSSIDs. I know that any
of the 47 bits (other than the broadcast/multicast bit) in the address
might be used in the multiple bssids for a set of virtual APs.

You say you are aware of multiple ways BSSIDs have been deployed with
Atheros hardware. Could you please tell me the vendors and the methods each
used? This information would help. I have only seen the two methods I have
described.

Thanks, Bob




From uglymouse  Mon Feb 12 16:01:59 2007
From: uglymouse (kstauffer)
Date: Tue, 13 Feb 2007 02:01:59 +0200
Subject: WPA2-PSK with TKIP fails to set GTK/PTK to driver:
	ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
Message-ID: <45D0FFF7.9020507@saunalahti.fi>

Hi,
For some reason GTK or PTK cannot be installed to driver and 
authentication to WPA2 AP fails when TKIP is used.
If switched to CCMP, authentication is successfull according to 
wpa_supplicant logs but immediately after authentication 4Way Handshake 
is restarted and it fails.
"WPA: 4-Way Handshake failed - pre-shared key may be incorrect" message 
appears, though PSK is correct.

Any idea why?

Thanks in advanced!

-Kristian

AP Beacon as attachement.

wpa_supplicant configuration:
ctrl_interface=/var/run/wpa_supplicant
ap_scan=1
network={
 ssid="DEVPROST"
 key_mgmt=WPA-PSK
 group=TKIP
 pairwise=TKIP
#  group=CCMP
#  pairwise=CCMP
 proto=RSN
 psk="12345678"
}

#wpa_supplicant -Dmadwifi -iwlan0 -c /etc/wpa_supplicant_wlan0.conf -dd

wpa_supplicant log(TKIP):

WPA: RX message 3 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=1)
WPA: IE KeyData - hexdump(len=62): 30 14 01 00 00 0f ac 02 01 00 00 0f 
ac 02 01 00 00 0f ac 02 05 00 dd 26 00 0f ac 01 02 00 d0 9c 7a bc 49 ae 
9e 50 f1 bd 1e 9b 94 b2 a6 9e 25 7e 9a 99 ed 71 bb a2 a9 c1 24 b0 27 15 
83 9c
WPA: Sending EAPOL-Key 4/4
WPA: TX EAPOL-Key - hexdump(len=99): 01 03 00 5f 02 03 09 00 00 00 00 00 
00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 0c 2e 
12 83 ea 10 d5 03 11 aa eb 71 60 e3 f5 00 00
WPA: Installing PTK to the driver.
wpa_driver_madwifi_set_key: alg=TKIP key_idx=0 set_tx=1 seq_len=6 
key_len=32
ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
WPA: Failed to set PTK to the driver.
EAPOL: External notification - portValid=1
State: 4WAY_HANDSHAKE -> GROUP_HANDSHAKE
RSN: received GTK in pairwise handshake - hexdump(len=34): [REMOVED]
WPA: Group Key - hexdump(len=32): [REMOVED]
WPA: Installing GTK to the driver (keyidx=2 tx=0).
WPA: RSC - hexdump(len=6): 00 00 00 00 00 00
wpa_driver_madwifi_set_key: alg=TKIP key_idx=2 set_tx=0 seq_len=6 
key_len=32
ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
WPA: Failed to set GTK to the driver.
RSN: Failed to install GTK
RSN: Failed to configure GTK

wpa_supplicant log(CCMP)

Removed BSSID 00:a0:0a:a8:93:6c from blacklist (clear)
Selecting BSS from priority group 0
0: 00:a0:0a:a8:93:6c ssid='DEVPROST' wpa_ie_len=0 rsn_ie_len=22 caps=0x11
  selected based on RSN IE
Trying to associate with 00:a0:0a:a8:93:6c (SSID='DEVPROST' freq=2412 MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
RSN: using IEEE 802.11i/D9.0
WPA: Selected cipher suites: group 16 pairwise 16 key_mgmt 2 proto 2
WPA: clearing AP WPA IE
WPA: set AP RSN IE - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 
0f ac 04 01 00 00 0f ac 02 05 00
WPA: using GTK CCMP
WPA: using PTK CCMP
WPA: using KEY_MGMT WPA-PSK
WPA: Set own WPA IE default - hexdump(len=22): 30 14 01 00 00 0f ac 04 
01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
No keys have been configured - skip key clearing
wpa_driver_madwifi_set_drop_unencrypted: enabled=1
State: SCANNING -> ASSOCIATING
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_madwifi_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - EAP success=0
EAPOL: External notification - EAP fail=0
EAPOL: External notification - portControl=Auto
RSN: added PMKSA cache candidate 00:a0:0a:a8:93:6c prio 1000
RSN: processing PMKSA candidate list
RSN: not in suitable state for new pre-authentication
RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
Wireless event: cmd=0x8b1a len=21
RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:a0:0a:a8:93:6c
State: ASSOCIATING -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:a0:0a:a8:93:6c
No keys have been configured - skip key clearing
Associated with 00:a0:0a:a8:93:6c
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - EAP success=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
RX EAPOL from 00:a0:0a:a8:93:6c
RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
00 00 01 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 89 
d1 fc 23 fc f4 15 64 ec c4 a9 65 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00
Setting authentication timeout: 10 sec 0 usec
IEEE 802.1X RX: version=1 type=3 length=117
 EAPOL-Key type=2
 key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
 key_length=16 key_data_length=22
 replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 01
 key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 65
 key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
00 00 00 00 00 01 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e 
f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 65 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00
State: ASSOCIATED -> 4WAY_HANDSHAKE
WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00
RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00
RSN: no matching PMKID found
WPA: Renewed SNonce - hexdump(len=32): 7f 10 23 26 e6 9a d7 a1 9b 04 94 
41 df ee b4 6f fa f8 ff 84 b1 24 cb 22 91 09 0a 97 ce 0d 30 5d
WPA: PMK - hexdump(len=32): [REMOVED]
WPA: PTK - hexdump(len=64): [REMOVED]
WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 
00 0f ac 04 01 00 00 0f ac 02 00 00
WPA: Sending EAPOL-Key 2/4
WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
00 00 00 00 00 01 7f 10 23 26 e6 9a d7 a1 9b 04 94 41 df ee b4 6f fa f8 
ff 84 b1 24 cb 22 91 09 0a 97 ce 0d 30 5d 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 dd 
e3 b3 5f 8c 2e d9 b3 bb c0 fb 63 0e eb b1 00 16 30 14 01 00 00 0f ac 04 
01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
RX EAPOL from 00:a0:0a:a8:93:6c
RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
00 00 01 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 89 
d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00
IEEE 802.1X RX: version=1 type=3 length=117
 EAPOL-Key type=2
 key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
 key_length=16 key_data_length=22
 replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 01
 key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
 key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
00 00 00 00 00 01 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e 
f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00
State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00
RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00
RSN: no matching PMKID found
WPA: PMK - hexdump(len=32): [REMOVED]
WPA: PTK - hexdump(len=64): [REMOVED]
WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 
00 0f ac 04 01 00 00 0f ac 02 00 00
WPA: Sending EAPOL-Key 2/4
WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
00 00 00 00 00 01 7f 10 23 26 e6 9a d7 a1 9b 04 94 41 df ee b4 6f fa f8 
ff 84 b1 24 cb 22 91 09 0a 97 ce 0d 30 5d 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 ca 
7a ba 01 89 db cd a0 cd fa 5a c7 3d 96 90 00 16 30 14 01 00 00 0f ac 04 
01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
RX EAPOL from 00:a0:0a:a8:93:6c
RX EAPOL - hexdump(len=155): 01 03 00 97 02 13 ca 00 10 00 00 00 00 00 
00 00 02 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 89 
d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 e1 2c 6b 24 
66 1e fd 71 52 3e c8 cd 60 19 04 00 38 76 4a c4 9d 67 38 4c 42 ce 15 4e 
db ed d0 9d 3f f8 12 c2 20 c5 6b fd 5a 51 31 2b a6 87 28 49 02 29 95 b8 
95 7a 5d b0 77 09 04 d8 37 be ae 37 6f a3 5a b2 1a d5 dc ab 18
IEEE 802.1X RX: version=1 type=3 length=151
 EAPOL-Key type=2
 key_info 0x13ca (ver=2 keyidx=0 rsvd=0 Pairwise Install Ack MIC Secure 
Encr)
 key_length=16 key_data_length=56
 replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 02
 key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
 key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_mic - hexdump(len=16): c7 e1 2c 6b 24 66 1e fd 71 52 3e c8 cd 60 19 04
WPA: RX EAPOL-Key - hexdump(len=155): 01 03 00 97 02 13 ca 00 10 00 00 
00 00 00 00 00 02 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e 
f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 e1 
2c 6b 24 66 1e fd 71 52 3e c8 cd 60 19 04 00 38 76 4a c4 9d 67 38 4c 42 
ce 15 4e db ed d0 9d 3f f8 12 c2 20 c5 6b fd 5a 51 31 2b a6 87 28 49 02 
29 95 b8 95 7a 5d b0 77 09 04 d8 37 be ae 37 6f a3 5a b2 1a d5 dc ab 18
RSN: encrypted key data - hexdump(len=56): 76 4a c4 9d 67 38 4c 42 ce 15 
4e db ed d0 9d 3f f8 12 c2 20 c5 6b fd 5a 51 31 2b a6 87 28 49 02 29 95 
b8 95 7a 5d b0 77 09 04 d8 37 be ae 37 6f a3 5a b2 1a d5 dc ab 18
WPA: decrypted EAPOL-Key key data - hexdump(len=48): [REMOVED]
State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
WPA: RX message 3 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
WPA: IE KeyData - hexdump(len=48): 30 14 01 00 00 0f ac 04 01 00 00 0f 
ac 04 01 00 00 0f ac 02 05 00 dd 16 00 0f ac 01 02 00 b0 e5 51 59 59 ba 
c2 4a f0 3d 0d f3 70 25 c8 3c dd 00
WPA: Sending EAPOL-Key 4/4
WPA: TX EAPOL-Key - hexdump(len=99): 01 03 00 5f 02 03 0a 00 00 00 00 00 
00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 5b 51 
90 a8 96 15 90 f0 0d 21 be 8a 57 44 3e 00 00
WPA: Installing PTK to the driver.
wpa_driver_madwifi_set_key: alg=CCMP key_idx=0 set_tx=1 seq_len=6 
key_len=16
EAPOL: External notification - portValid=1
State: 4WAY_HANDSHAKE -> GROUP_HANDSHAKE
RSN: received GTK in pairwise handshake - hexdump(len=18): [REMOVED]
WPA: Group Key - hexdump(len=16): [REMOVED]
WPA: Installing GTK to the driver (keyidx=2 tx=0).
WPA: RSC - hexdump(len=6): 00 00 00 00 00 00
wpa_driver_madwifi_set_key: alg=CCMP key_idx=2 set_tx=0 seq_len=6 
key_len=16
WPA: Key negotiation completed with 00:a0:0a:a8:93:6c [PTK=CCMP GTK=CCMP]
Cancelling authentication timeout
State: GROUP_HANDSHAKE -> COMPLETED
CTRL-EVENT-CONNECTED - Connection to 00:a0:0a:a8:93:6c completed (auth) 
[id=0 id_str=]
wpa_driver_wext_set_operstate: operstate 0->1 (UP)
WEXT: Operstate: linkmode=-1, operstate=6
EAPOL: External notification - portValid=1
EAPOL: External notification - EAP success=1
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state SUCCESS
EAP: EAP entering state DISABLED
EAPOL: SUPP_PAE entering state AUTHENTICATED
EAPOL: SUPP_BE entering state IDLE
RSN: processing PMKSA candidate list
RSN: not in suitable state for new pre-authentication
EAPOL: startWhen --> 0
RX EAPOL from 00:a0:0a:a8:93:6c
RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
00 00 03 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 89 
d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00
IEEE 802.1X RX: version=1 type=3 length=117
 EAPOL-Key type=2
 key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
 key_length=16 key_data_length=22
 replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 03
 key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
 key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
00 00 00 00 00 03 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e 
f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00
State: COMPLETED -> 4WAY_HANDSHAKE
WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00
RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00
RSN: no matching PMKID found
WPA: Renewed SNonce - hexdump(len=32): 1a a5 39 88 eb 82 a0 f2 a1 1c e4 
af 09 79 cd b1 b3 27 b7 60 69 fa 0f 39 f2 a8 94 87 88 cc 93 da
WPA: PMK - hexdump(len=32): [REMOVED]
WPA: PTK - hexdump(len=64): [REMOVED]
WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 
00 0f ac 04 01 00 00 0f ac 02 00 00
WPA: Sending EAPOL-Key 2/4
WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
00 00 00 00 00 03 1a a5 39 88 eb 82 a0 f2 a1 1c e4 af 09 79 cd b1 b3 27 
b7 60 69 fa 0f 39 f2 a8 94 87 88 cc 93 da 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 91 
22 14 da 93 85 49 8f 43 b3 ff ee ce 23 1e 00 16 30 14 01 00 00 0f ac 04 
01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
RX EAPOL from 00:a0:0a:a8:93:6c
RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
00 00 04 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 89 
d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00
IEEE 802.1X RX: version=1 type=3 length=117
 EAPOL-Key type=2
 key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
 key_length=16 key_data_length=22
 replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 04
 key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
 key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
00 00 00 00 00 04 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e 
f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00
State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00
RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00
RSN: no matching PMKID found
WPA: PMK - hexdump(len=32): [REMOVED]
WPA: PTK - hexdump(len=64): [REMOVED]
WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 
00 0f ac 04 01 00 00 0f ac 02 00 00
WPA: Sending EAPOL-Key 2/4
WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
00 00 00 00 00 04 1a a5 39 88 eb 82 a0 f2 a1 1c e4 af 09 79 cd b1 b3 27 
b7 60 69 fa 0f 39 f2 a8 94 87 88 cc 93 da 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 3d 
61 5f 4d 40 a0 d6 62 2b 74 4b 37 18 b4 f2 00 16 30 14 01 00 00 0f ac 04 
01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
RX EAPOL from 00:a0:0a:a8:93:6c
RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
00 00 05 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 89 
d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00
IEEE 802.1X RX: version=1 type=3 length=117
 EAPOL-Key type=2
 key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
 key_length=16 key_data_length=22
 replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 05
 key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
 key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
 key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
00 00 00 00 00 05 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e 
f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00
State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00
RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00
RSN: no matching PMKID found
WPA: PMK - hexdump(len=32): [REMOVED]
WPA: PTK - hexdump(len=64): [REMOVED]
WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 
00 0f ac 04 01 00 00 0f ac 02 00 00
WPA: Sending EAPOL-Key 2/4
WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
00 00 00 00 00 05 1a a5 39 88 eb 82 a0 f2 a1 1c e4 af 09 79 cd b1 b3 27 
b7 60 69 fa 0f 39 f2 a8 94 87 88 cc 93 da 00 00 00 00 00 00 00 00 00 00 
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 83 21 
b3 1d 49 70 f5 72 4e eb 59 5b 13 a5 f3 1c 00 16 30 14 01 00 00 0f ac 04 
01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
RTM_NEWLINK: operstate=1 ifi_flags=0x1043 ([UP][RUNNING])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:00:00:00:00:00
WPA: 4-Way Handshake failed - pre-shared key may be incorrect
Setting scan request: 0 sec 100000 usec
Added BSSID 00:a0:0a:a8:93:6c into blacklist
CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
wpa_driver_madwifi_del_key: keyidx=0
wpa_driver_madwifi_del_key: keyidx=1
wpa_driver_madwifi_del_key: keyidx=2
wpa_driver_madwifi_del_key: keyidx=3
wpa_driver_madwifi_del_key: keyidx=0
State: 4WAY_HANDSHAKE -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 1->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAPOL: External notification - portValid=0
EAPOL: External notification - EAP success=0
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
Wireless event: cmd=0x8b15 len=20
Wireless event: new AP: 00:a0:0a:a8:93:6c
State: DISCONNECTED -> ASSOCIATED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
Associated to a new BSS: BSSID=00:a0:0a:a8:93:6c
No keys have been configured - skip key clearing
Associated with 00:a0:0a:a8:93:6c
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - EAP success=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
Setting authentication timeout: 10 sec 0 usec
Cancelling scan request
RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
WPA: drop TX EAPOL in non-IEEE 802.1X mode (type=1 len=0)
CTRL-EVENT-TERMINATING - signal 2 received
Removing interface wlan0
State: ASSOCIATED -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_madwifi_deauthenticate
No keys have been configured - skip key clearing
EAPOL: External notification - portEnabled=0
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: SUPP_BE entering state INITIALIZE
EAPOL: External notification - portValid=0
wpa_driver_madwifi_set_drop_unencrypted: enabled=0
wpa_driver_madwifi_set_countermeasures: enabled=0
No keys have been configured - skip key clearing
Removed BSSID 00:a0:0a:a8:93:6c from blacklist (clear)
Cancelling scan request
Cancelling authentication timeout
WEXT: Operstate: linkmode=0, operstate=6

-------------- next part --------------
A non-text attachment was scrubbed...
Name: AP_capabilities_rsn.cap
Type: application/octet-stream
Size: 313 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20070213/dab04a65/attachment.obj 


From sj_qiu  Mon Feb 12 16:20:54 2007
From: sj_qiu (Sheng_Jun)
Date: Tue, 13 Feb 2007 08:20:54 +0800
Subject: Dear All,
Message-ID: <10702130820.AA01776@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From uglymouse  Mon Feb 12 17:00:53 2007
From: uglymouse (kstauffer)
Date: Tue, 13 Feb 2007 03:00:53 +0200
Subject: WPA2-PSK with TKIP fails to set GTK/PTK to
	driver:	ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
In-Reply-To: <45D0FFF7.9020507@saunalahti.fi>
References: <45D0FFF7.9020507@saunalahti.fi>
Message-ID: <45D10DC5.7020203@saunalahti.fi>

I made some further investigations.
Also hostapd have this GTK or PTK cannot be installed problem with TKIP 
if WPA2 Only mode is used.

WPA2-PSK CCMP Only mode works nicely between wpa_supplicant and hostapd 
0.5.7.
I noticed that ProST AP has some differences in RSN caps comparing to my 
hostapd RSN caps.
RSN pre-authentication seems to be enabled in ProST AP and RSN PTKSA 
Reply Counter is 1.
I enabled pre-authentication from hostapd and checked if it  behaves the 
same as ProST board, but it worked nicely.

Could it be that the RSN PTKSA Reply Counter is causing 4way Handshake 
to be restarted, even Authentication were succesfull?

What is the meaning of those PTKSA/GTKSA Reply Counter capabilities?
 
-Kristian
> Hi,
> For some reason GTK or PTK cannot be installed to driver and 
> authentication to WPA2 AP fails when TKIP is used.
> If switched to CCMP, authentication is successfull according to 
> wpa_supplicant logs but immediately after authentication 4Way 
> Handshake is restarted and it fails.
> "WPA: 4-Way Handshake failed - pre-shared key may be incorrect" 
> message appears, though PSK is correct.
>
> Any idea why?
>
> Thanks in advanced!
>
> -Kristian
>
> AP Beacon as attachement.
>
> wpa_supplicant configuration:
> ctrl_interface=/var/run/wpa_supplicant
> ap_scan=1
> network={
> ssid="DEVPROST"
> key_mgmt=WPA-PSK
> group=TKIP
> pairwise=TKIP
> #  group=CCMP
> #  pairwise=CCMP
> proto=RSN
> psk="12345678"
> }
>
> #wpa_supplicant -Dmadwifi -iwlan0 -c /etc/wpa_supplicant_wlan0.conf -dd
>
> wpa_supplicant log(TKIP):
>
> WPA: RX message 3 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=1)
> WPA: IE KeyData - hexdump(len=62): 30 14 01 00 00 0f ac 02 01 00 00 0f 
> ac 02 01 00 00 0f ac 02 05 00 dd 26 00 0f ac 01 02 00 d0 9c 7a bc 49 
> ae 9e 50 f1 bd 1e 9b 94 b2 a6 9e 25 7e 9a 99 ed 71 bb a2 a9 c1 24 b0 
> 27 15 83 9c
> WPA: Sending EAPOL-Key 4/4
> WPA: TX EAPOL-Key - hexdump(len=99): 01 03 00 5f 02 03 09 00 00 00 00 
> 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 1a 0c 2e 12 83 ea 10 d5 03 11 aa eb 71 60 e3 f5 00 00
> WPA: Installing PTK to the driver.
> wpa_driver_madwifi_set_key: alg=TKIP key_idx=0 set_tx=1 seq_len=6 
> key_len=32
> ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
> WPA: Failed to set PTK to the driver.
> EAPOL: External notification - portValid=1
> State: 4WAY_HANDSHAKE -> GROUP_HANDSHAKE
> RSN: received GTK in pairwise handshake - hexdump(len=34): [REMOVED]
> WPA: Group Key - hexdump(len=32): [REMOVED]
> WPA: Installing GTK to the driver (keyidx=2 tx=0).
> WPA: RSC - hexdump(len=6): 00 00 00 00 00 00
> wpa_driver_madwifi_set_key: alg=TKIP key_idx=2 set_tx=0 seq_len=6 
> key_len=32
> ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
> WPA: Failed to set GTK to the driver.
> RSN: Failed to install GTK
> RSN: Failed to configure GTK
>
> wpa_supplicant log(CCMP)
>
> Removed BSSID 00:a0:0a:a8:93:6c from blacklist (clear)
> Selecting BSS from priority group 0
> 0: 00:a0:0a:a8:93:6c ssid='DEVPROST' wpa_ie_len=0 rsn_ie_len=22 caps=0x11
>  selected based on RSN IE
> Trying to associate with 00:a0:0a:a8:93:6c (SSID='DEVPROST' freq=2412 
> MHz)
> Cancelling scan request
> WPA: clearing own WPA/RSN IE
> Automatic auth_alg selection: 0x1
> RSN: using IEEE 802.11i/D9.0
> WPA: Selected cipher suites: group 16 pairwise 16 key_mgmt 2 proto 2
> WPA: clearing AP WPA IE
> WPA: set AP RSN IE - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 
> 0f ac 04 01 00 00 0f ac 02 05 00
> WPA: using GTK CCMP
> WPA: using PTK CCMP
> WPA: using KEY_MGMT WPA-PSK
> WPA: Set own WPA IE default - hexdump(len=22): 30 14 01 00 00 0f ac 04 
> 01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> No keys have been configured - skip key clearing
> wpa_driver_madwifi_set_drop_unencrypted: enabled=1
> State: SCANNING -> ASSOCIATING
> wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
> WEXT: Operstate: linkmode=-1, operstate=5
> wpa_driver_madwifi_associate
> Setting authentication timeout: 10 sec 0 usec
> EAPOL: External notification - EAP success=0
> EAPOL: External notification - EAP fail=0
> EAPOL: External notification - portControl=Auto
> RSN: added PMKSA cache candidate 00:a0:0a:a8:93:6c prio 1000
> RSN: processing PMKSA candidate list
> RSN: not in suitable state for new pre-authentication
> RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
> Wireless event: cmd=0x8b1a len=21
> RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
> Wireless event: cmd=0x8b15 len=20
> Wireless event: new AP: 00:a0:0a:a8:93:6c
> State: ASSOCIATING -> ASSOCIATED
> wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
> WEXT: Operstate: linkmode=-1, operstate=5
> Associated to a new BSS: BSSID=00:a0:0a:a8:93:6c
> No keys have been configured - skip key clearing
> Associated with 00:a0:0a:a8:93:6c
> WPA: Association event - clear replay counter
> EAPOL: External notification - portEnabled=0
> EAPOL: External notification - portValid=0
> EAPOL: External notification - EAP success=0
> EAPOL: External notification - portEnabled=1
> EAPOL: SUPP_PAE entering state CONNECTING
> EAPOL: SUPP_BE entering state IDLE
> Setting authentication timeout: 10 sec 0 usec
> Cancelling scan request
> RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
> RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
> RX EAPOL from 00:a0:0a:a8:93:6c
> RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
> 00 00 01 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 
> 89 d1 fc 23 fc f4 15 64 ec c4 a9 65 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> Setting authentication timeout: 10 sec 0 usec
> IEEE 802.1X RX: version=1 type=3 length=117
> EAPOL-Key type=2
> key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
> key_length=16 key_data_length=22
> replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 01
> key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
> 91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 65
> key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00
> WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
> 00 00 00 00 00 01 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 
> 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 65 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f 
> ac 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> State: ASSOCIATED -> 4WAY_HANDSHAKE
> WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
> RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00
> RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00
> RSN: no matching PMKID found
> WPA: Renewed SNonce - hexdump(len=32): 7f 10 23 26 e6 9a d7 a1 9b 04 
> 94 41 df ee b4 6f fa f8 ff 84 b1 24 cb 22 91 09 0a 97 ce 0d 30 5d
> WPA: PMK - hexdump(len=32): [REMOVED]
> WPA: PTK - hexdump(len=64): [REMOVED]
> WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 
> 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> WPA: Sending EAPOL-Key 2/4
> WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
> 00 00 00 00 00 01 7f 10 23 26 e6 9a d7 a1 9b 04 94 41 df ee b4 6f fa 
> f8 ff 84 b1 24 cb 22 91 09 0a 97 ce 0d 30 5d 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 f8 dd e3 b3 5f 8c 2e d9 b3 bb c0 fb 63 0e eb b1 00 16 30 14 01 00 
> 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> RX EAPOL from 00:a0:0a:a8:93:6c
> RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
> 00 00 01 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 
> 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> IEEE 802.1X RX: version=1 type=3 length=117
> EAPOL-Key type=2
> key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
> key_length=16 key_data_length=22
> replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 01
> key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
> 91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
> key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00
> WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
> 00 00 00 00 00 01 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 
> 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f 
> ac 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
> WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
> RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00
> RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00
> RSN: no matching PMKID found
> WPA: PMK - hexdump(len=32): [REMOVED]
> WPA: PTK - hexdump(len=64): [REMOVED]
> WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 
> 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> WPA: Sending EAPOL-Key 2/4
> WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
> 00 00 00 00 00 01 7f 10 23 26 e6 9a d7 a1 9b 04 94 41 df ee b4 6f fa 
> f8 ff 84 b1 24 cb 22 91 09 0a 97 ce 0d 30 5d 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 30 ca 7a ba 01 89 db cd a0 cd fa 5a c7 3d 96 90 00 16 30 14 01 00 
> 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> RX EAPOL from 00:a0:0a:a8:93:6c
> RX EAPOL - hexdump(len=155): 01 03 00 97 02 13 ca 00 10 00 00 00 00 00 
> 00 00 02 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 
> 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c7 e1 
> 2c 6b 24 66 1e fd 71 52 3e c8 cd 60 19 04 00 38 76 4a c4 9d 67 38 4c 
> 42 ce 15 4e db ed d0 9d 3f f8 12 c2 20 c5 6b fd 5a 51 31 2b a6 87 28 
> 49 02 29 95 b8 95 7a 5d b0 77 09 04 d8 37 be ae 37 6f a3 5a b2 1a d5 
> dc ab 18
> IEEE 802.1X RX: version=1 type=3 length=151
> EAPOL-Key type=2
> key_info 0x13ca (ver=2 keyidx=0 rsvd=0 Pairwise Install Ack MIC Secure 
> Encr)
> key_length=16 key_data_length=56
> replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 02
> key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
> 91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
> key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_mic - hexdump(len=16): c7 e1 2c 6b 24 66 1e fd 71 52 3e c8 cd 60 
> 19 04
> WPA: RX EAPOL-Key - hexdump(len=155): 01 03 00 97 02 13 ca 00 10 00 00 
> 00 00 00 00 00 02 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 
> 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 c7 e1 2c 6b 24 66 1e fd 71 52 3e c8 cd 60 19 04 00 38 76 4a c4 9d 
> 67 38 4c 42 ce 15 4e db ed d0 9d 3f f8 12 c2 20 c5 6b fd 5a 51 31 2b 
> a6 87 28 49 02 29 95 b8 95 7a 5d b0 77 09 04 d8 37 be ae 37 6f a3 5a 
> b2 1a d5 dc ab 18
> RSN: encrypted key data - hexdump(len=56): 76 4a c4 9d 67 38 4c 42 ce 
> 15 4e db ed d0 9d 3f f8 12 c2 20 c5 6b fd 5a 51 31 2b a6 87 28 49 02 
> 29 95 b8 95 7a 5d b0 77 09 04 d8 37 be ae 37 6f a3 5a b2 1a d5 dc ab 18
> WPA: decrypted EAPOL-Key key data - hexdump(len=48): [REMOVED]
> State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
> WPA: RX message 3 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
> WPA: IE KeyData - hexdump(len=48): 30 14 01 00 00 0f ac 04 01 00 00 0f 
> ac 04 01 00 00 0f ac 02 05 00 dd 16 00 0f ac 01 02 00 b0 e5 51 59 59 
> ba c2 4a f0 3d 0d f3 70 25 c8 3c dd 00
> WPA: Sending EAPOL-Key 4/4
> WPA: TX EAPOL-Key - hexdump(len=99): 01 03 00 5f 02 03 0a 00 00 00 00 
> 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 c7 5b 51 90 a8 96 15 90 f0 0d 21 be 8a 57 44 3e 00 00
> WPA: Installing PTK to the driver.
> wpa_driver_madwifi_set_key: alg=CCMP key_idx=0 set_tx=1 seq_len=6 
> key_len=16
> EAPOL: External notification - portValid=1
> State: 4WAY_HANDSHAKE -> GROUP_HANDSHAKE
> RSN: received GTK in pairwise handshake - hexdump(len=18): [REMOVED]
> WPA: Group Key - hexdump(len=16): [REMOVED]
> WPA: Installing GTK to the driver (keyidx=2 tx=0).
> WPA: RSC - hexdump(len=6): 00 00 00 00 00 00
> wpa_driver_madwifi_set_key: alg=CCMP key_idx=2 set_tx=0 seq_len=6 
> key_len=16
> WPA: Key negotiation completed with 00:a0:0a:a8:93:6c [PTK=CCMP GTK=CCMP]
> Cancelling authentication timeout
> State: GROUP_HANDSHAKE -> COMPLETED
> CTRL-EVENT-CONNECTED - Connection to 00:a0:0a:a8:93:6c completed 
> (auth) [id=0 id_str=]
> wpa_driver_wext_set_operstate: operstate 0->1 (UP)
> WEXT: Operstate: linkmode=-1, operstate=6
> EAPOL: External notification - portValid=1
> EAPOL: External notification - EAP success=1
> EAPOL: SUPP_PAE entering state AUTHENTICATING
> EAPOL: SUPP_BE entering state SUCCESS
> EAP: EAP entering state DISABLED
> EAPOL: SUPP_PAE entering state AUTHENTICATED
> EAPOL: SUPP_BE entering state IDLE
> RSN: processing PMKSA candidate list
> RSN: not in suitable state for new pre-authentication
> EAPOL: startWhen --> 0
> RX EAPOL from 00:a0:0a:a8:93:6c
> RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
> 00 00 03 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 
> 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> IEEE 802.1X RX: version=1 type=3 length=117
> EAPOL-Key type=2
> key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
> key_length=16 key_data_length=22
> replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 03
> key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
> 91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
> key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00
> WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
> 00 00 00 00 00 03 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 
> 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f 
> ac 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> State: COMPLETED -> 4WAY_HANDSHAKE
> WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
> RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00
> RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00
> RSN: no matching PMKID found
> WPA: Renewed SNonce - hexdump(len=32): 1a a5 39 88 eb 82 a0 f2 a1 1c 
> e4 af 09 79 cd b1 b3 27 b7 60 69 fa 0f 39 f2 a8 94 87 88 cc 93 da
> WPA: PMK - hexdump(len=32): [REMOVED]
> WPA: PTK - hexdump(len=64): [REMOVED]
> WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 
> 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> WPA: Sending EAPOL-Key 2/4
> WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
> 00 00 00 00 00 03 1a a5 39 88 eb 82 a0 f2 a1 1c e4 af 09 79 cd b1 b3 
> 27 b7 60 69 fa 0f 39 f2 a8 94 87 88 cc 93 da 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 50 91 22 14 da 93 85 49 8f 43 b3 ff ee ce 23 1e 00 16 30 14 01 00 
> 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> RX EAPOL from 00:a0:0a:a8:93:6c
> RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
> 00 00 04 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 
> 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> IEEE 802.1X RX: version=1 type=3 length=117
> EAPOL-Key type=2
> key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
> key_length=16 key_data_length=22
> replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 04
> key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
> 91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
> key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00
> WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
> 00 00 00 00 00 04 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 
> 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f 
> ac 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
> WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
> RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00
> RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00
> RSN: no matching PMKID found
> WPA: PMK - hexdump(len=32): [REMOVED]
> WPA: PTK - hexdump(len=64): [REMOVED]
> WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 
> 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> WPA: Sending EAPOL-Key 2/4
> WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
> 00 00 00 00 00 04 1a a5 39 88 eb 82 a0 f2 a1 1c e4 af 09 79 cd b1 b3 
> 27 b7 60 69 fa 0f 39 f2 a8 94 87 88 cc 93 da 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 47 3d 61 5f 4d 40 a0 d6 62 2b 74 4b 37 18 b4 f2 00 16 30 14 01 00 
> 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> RX EAPOL from 00:a0:0a:a8:93:6c
> RX EAPOL - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 00 00 00 
> 00 00 05 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 5e f6 e2 
> 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f ac 04 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> IEEE 802.1X RX: version=1 type=3 length=117
> EAPOL-Key type=2
> key_info 0x8a (ver=2 keyidx=0 rsvd=0 Pairwise Ack)
> key_length=16 key_data_length=22
> replay_counter - hexdump(len=8): 00 00 00 00 00 00 00 05
> key_nonce - hexdump(len=32): 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 
> 91 10 65 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67
> key_iv - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> key_rsc - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_id (reserved) - hexdump(len=8): 00 00 00 00 00 00 00 00
> key_mic - hexdump(len=16): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00
> WPA: RX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 00 8a 00 10 00 00 
> 00 00 00 00 00 05 00 b0 96 45 16 63 76 11 97 cd 76 ea 4d 39 91 10 65 
> 5e f6 e2 89 d1 fc 23 fc f4 15 64 ec c4 a9 67 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 16 dd 14 00 0f 
> ac 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> State: 4WAY_HANDSHAKE -> 4WAY_HANDSHAKE
> WPA: RX message 1 of 4-Way Handshake from 00:a0:0a:a8:93:6c (ver=2)
> RSN: msg 1/4 key data - hexdump(len=22): dd 14 00 0f ac 04 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00
> RSN: PMKID from Authenticator - hexdump(len=16): 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00
> RSN: no matching PMKID found
> WPA: PMK - hexdump(len=32): [REMOVED]
> WPA: PTK - hexdump(len=64): [REMOVED]
> WPA: WPA IE for msg 2/4 - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 
> 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> WPA: Sending EAPOL-Key 2/4
> WPA: TX EAPOL-Key - hexdump(len=121): 01 03 00 75 02 01 0a 00 00 00 00 
> 00 00 00 00 00 05 1a a5 39 88 eb 82 a0 f2 a1 1c e4 af 09 79 cd b1 b3 
> 27 b7 60 69 fa 0f 39 f2 a8 94 87 88 cc 93 da 00 00 00 00 00 00 00 00 
> 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
> 00 83 21 b3 1d 49 70 f5 72 4e eb 59 5b 13 a5 f3 1c 00 16 30 14 01 00 
> 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 00 00
> RTM_NEWLINK: operstate=1 ifi_flags=0x1043 ([UP][RUNNING])
> Wireless event: cmd=0x8b15 len=20
> Wireless event: new AP: 00:00:00:00:00:00
> WPA: 4-Way Handshake failed - pre-shared key may be incorrect
> Setting scan request: 0 sec 100000 usec
> Added BSSID 00:a0:0a:a8:93:6c into blacklist
> CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys
> wpa_driver_madwifi_del_key: keyidx=0
> wpa_driver_madwifi_del_key: keyidx=1
> wpa_driver_madwifi_del_key: keyidx=2
> wpa_driver_madwifi_del_key: keyidx=3
> wpa_driver_madwifi_del_key: keyidx=0
> State: 4WAY_HANDSHAKE -> DISCONNECTED
> wpa_driver_wext_set_operstate: operstate 1->0 (DORMANT)
> WEXT: Operstate: linkmode=-1, operstate=5
> EAPOL: External notification - portEnabled=0
> EAPOL: SUPP_PAE entering state DISCONNECTED
> EAPOL: SUPP_BE entering state INITIALIZE
> EAPOL: External notification - portValid=0
> EAPOL: External notification - EAP success=0
> RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
> RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
> RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
> Wireless event: cmd=0x8b15 len=20
> Wireless event: new AP: 00:a0:0a:a8:93:6c
> State: DISCONNECTED -> ASSOCIATED
> wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
> WEXT: Operstate: linkmode=-1, operstate=5
> Associated to a new BSS: BSSID=00:a0:0a:a8:93:6c
> No keys have been configured - skip key clearing
> Associated with 00:a0:0a:a8:93:6c
> WPA: Association event - clear replay counter
> EAPOL: External notification - portEnabled=0
> EAPOL: External notification - portValid=0
> EAPOL: External notification - EAP success=0
> EAPOL: External notification - portEnabled=1
> EAPOL: SUPP_PAE entering state CONNECTING
> EAPOL: SUPP_BE entering state IDLE
> Setting authentication timeout: 10 sec 0 usec
> Cancelling scan request
> RTM_NEWLINK: operstate=0 ifi_flags=0x1043 ([UP][RUNNING])
> RTM_NEWLINK, IFLA_IFNAME: Interface 'wlan0' added
> EAPOL: startWhen --> 0
> EAPOL: SUPP_PAE entering state CONNECTING
> EAPOL: txStart
> WPA: drop TX EAPOL in non-IEEE 802.1X mode (type=1 len=0)
> CTRL-EVENT-TERMINATING - signal 2 received
> Removing interface wlan0
> State: ASSOCIATED -> DISCONNECTED
> wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
> WEXT: Operstate: linkmode=-1, operstate=5
> wpa_driver_madwifi_deauthenticate
> No keys have been configured - skip key clearing
> EAPOL: External notification - portEnabled=0
> EAPOL: SUPP_PAE entering state DISCONNECTED
> EAPOL: SUPP_BE entering state INITIALIZE
> EAPOL: External notification - portValid=0
> wpa_driver_madwifi_set_drop_unencrypted: enabled=0
> wpa_driver_madwifi_set_countermeasures: enabled=0
> No keys have been configured - skip key clearing
> Removed BSSID 00:a0:0a:a8:93:6c from blacklist (clear)
> Cancelling scan request
> Cancelling authentication timeout
> WEXT: Operstate: linkmode=0, operstate=6
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>   




From jkmaline  Mon Feb 12 19:21:27 2007
From: jkmaline (Jouni Malinen)
Date: Mon, 12 Feb 2007 19:21:27 -0800
Subject: wpa_supplicant problem with Prism card
In-Reply-To: <200702121135.59184.david.goodenough@btconnect.com>
References: <200702121135.59184.david.goodenough@btconnect.com>
Message-ID: <20070213032127.GA5068@jm.kir.nu>

On Mon, Feb 12, 2007 at 11:35:55AM +0000, David Goodenough wrote:

> I have a need to be able to connect to a number of different APs, so I 
> thought using wpa_supplicant and its wpa_roam function.  But I am 
> obviously doing something wrong.

I have no idea what this "wpa_roam function" is referring to..

> My /etc/network/interfaces (yes I am a Debian sid user) reads:-

> I tried using --verbose on the ifup command, but that did not tell me
> anything useful.  Can I tell wpa_supplicant to be a bit more chatty and
> tell me what is going on?

That would be a guestion for Debian maintainers if you are doing this by
running ifup. If you run wpa_supplicant manually, you can add -dd on the
command line to make it quite verbose.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Mon Feb 12 20:20:53 2007
From: jkmaline (Jouni Malinen)
Date: Mon, 12 Feb 2007 20:20:53 -0800
Subject: CVS pserver for hostap
Message-ID: <20070213042053.GC5068@jm.kir.nu>

Read-only CVS pserver is again available at the old location:

export CVSROOT=":pserver:anonymous at hostap.epitest.fi:/cvs"
cvs login
    # password is empty, so just hit enter when prompted for it
cvs checkout hostap


With this, I believe that all the previously available hostap.epitest.fi
contents has been restored on the new server. Please let me know if
something is not working.

-- 
Jouni Malinen                                            PGP id EFC895FA



From sj_qiu  Mon Feb 12 20:30:47 2007
From: sj_qiu (Sheng_Jun)
Date: Tue, 13 Feb 2007 12:30:47 +0800
Subject: Dear All,
Message-ID: <10702131230.AA01820@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From AssafH  Tue Feb 13 00:36:32 2007
From: AssafH (Assaf Harel)
Date: Tue, 13 Feb 2007 10:36:32 +0200
Subject: Dear All -- Annoying Out of Office message
In-Reply-To: <10702131230.AA01820@compex.com.sg>
References: <10702131230.AA01820@compex.com.sg>
Message-ID: <5002BD9FB045734DB9F20119530FB017F98514@ilmail2.metalink.dsl>


Jouni,

Can you block this e-mail from the list?
I think that I'm speaking in the name of many readers, that this daily
Out Of Office message is quite annoying...

Best Regards,
Assaf

-----Original Message-----
From: hostap-bounces+assafh=metalinkbb.com at shmoo.com
[mailto:hostap-bounces+assafh=metalinkbb.com at shmoo.com] On Behalf Of
Sheng_Jun
Sent: Tuesday, February 13, 2007 06:31
To: hostap at shmoo.com
Subject: Dear All,

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support:


support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.
_______________________________________________
HostAP mailing list
HostAP at shmoo.com
http://lists.shmoo.com/mailman/listinfo/hostap

-- Disclaimer: --
This e-mail is intended solely for the person to whom it is addressed and may contain confidential or legally privileged information. Access to this e-mail by anyone else is unauthorized. If an addressing or transmission error has misdirected this e-mail, please notify the author by replying to this e-mail and destroy this e-mail and any attachments.
E-mail may be susceptible to data corruption, interception, unauthorized amendment, viruses and delays or the consequences thereof. If you are not the intended recipient, be advised that you have received this email in error and that any use, dissemination, forwarding, printing or copying of this email is strictly prohibited.



From david.goodenough  Tue Feb 13 02:21:07 2007
From: david.goodenough (David Goodenough)
Date: Tue, 13 Feb 2007 10:21:07 +0000
Subject: wpa_supplicant problem with Prism card
In-Reply-To: <20070213032127.GA5068@jm.kir.nu>
References: <200702121135.59184.david.goodenough@btconnect.com>
	<20070213032127.GA5068@jm.kir.nu>
Message-ID: <200702131021.08411.david.goodenough@btconnect.com>

On Tuesday 13 February 2007 03:21, Jouni Malinen wrote:
> On Mon, Feb 12, 2007 at 11:35:55AM +0000, David Goodenough wrote:
> > I have a need to be able to connect to a number of different APs, so I
> > thought using wpa_supplicant and its wpa_roam function.  But I am
> > obviously doing something wrong.
>
> I have no idea what this "wpa_roam function" is referring to..
I had assumed that this came with the basic package, obviously it is a 
Debianism, I will raise it there,
>
> > My /etc/network/interfaces (yes I am a Debian sid user) reads:-
> >
> > I tried using --verbose on the ifup command, but that did not tell me
> > anything useful.  Can I tell wpa_supplicant to be a bit more chatty and
> > tell me what is going on?
>
> That would be a guestion for Debian maintainers if you are doing this by
> running ifup. If you run wpa_supplicant manually, you can add -dd on the
> command line to make it quite verbose.
Thank you, I will again ask the Debian maintainers.  Thank you for your time.

David



From srinivas_gbecs  Tue Feb 13 03:37:20 2007
From: srinivas_gbecs (srinivas G)
Date: Tue, 13 Feb 2007 03:37:20 -0800 (PST)
Subject: Does WPA supplicant supports this
Message-ID: <569636.72908.qm@web54005.mail.yahoo.com>

Hi 

I am working on WPS(WiFi Protected setup) feature. I wanted to know whether the current WPA supplicant supports the following or not.





?

1. Hashing Algorithm
2. Diffie Hellman mod algorithm
3. HMAC-SHA-256 per FIPS 180-2 and RFC-2104 
4. AES-CBC per FIPS 197, with PKCS#5 v2.0 padding

Please help in this regard

-Thanks
Srinivas




 
____________________________________________________________________________________
Do you Yahoo!?
Everyone is raving about the all-new Yahoo! Mail beta.
http://new.mail.yahoo.com
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070213/74b85d76/attachment.htm 


From jkmaline  Tue Feb 13 19:16:07 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 13 Feb 2007 19:16:07 -0800
Subject: Troubles with beacon_settings
In-Reply-To: <8704f27d0702120518w41c5df1aoa082c3827cb700a4@mail.gmail.com>
References: <8704f27d0702120518w41c5df1aoa082c3827cb700a4@mail.gmail.com>
Message-ID: <20070214031607.GA5079@jm.kir.nu>

On Mon, Feb 12, 2007 at 03:18:07PM +0200, Emmanuel Grumbach wrote:

> I am trying to develop a driver for a WLAN NIC using D80211, and to have it
> working as an AP with Hostapd on top of D80211. Logically, I need a new
> beacon every DTIM period since the TIM Information Element gets changed
> every DTIM period. In my hostapd.conf:

TIM can change in every Beacon, not only once every DTIM period..

> I thought that hostapd should send an ioctl to set the beacon, this ioctl
> would be translated to ieee80211_config_interface by D80211 with the beacon
> set by hostapd.

hostapd does indeed configure the beacon template for d80211. I haven't
tested the current net/d80211 code on a system that would need the
beacon template in the radio driver, so I'm not completely sure about
the exact behavior of this part.

> driver_devicescape.c, this is what should happen. My problem is that this
> ioctl comes very late in the init process. Here is a short description of
> the init flow of D80211 (when hostapd sends its instructions), this is a
> list of handlers that I implement, and that D80211 calls:
> 
>   1. add_interface
>   2. open (here I should be already able to send beacons according to
>   d80211.h)
>   3. config_interface (several times with beacon NULL)
> 
> And much later, config_interface is called again with a non-null beacon.

It looks like the driver would need to be prepared for this and only
start beacon transmission once the beacon template is available.

> All this when I register as a driver that needs a beacon template. When I
> register as a driver that needs a full beacon frame, I should be able to
> call ieee80211_beacon_get to get a beacon, but this does not work (beacon is
> NULL).

This worked fine the last time I tried it..

> 2) Why does Hostapd begins to open and start my device before being able to
> give me a valid beacon ?

Why wouldn't it? Configuration is done in parts and I don't see any
clear requirement of beacon template being the first thing that would
need to be configured even before opening the netdev.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Feb 13 19:20:09 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 13 Feb 2007 19:20:09 -0800
Subject: wired 802.1X authorization for Asus wl500gx router
In-Reply-To: <ad9d3dbd0702111538h6769b731v9a67c38f59eda5e1@mail.gmail.com>
References: <ad9d3dbd0702111538h6769b731v9a67c38f59eda5e1@mail.gmail.com>
Message-ID: <20070214032009.GB5079@jm.kir.nu>

On Mon, Feb 12, 2007 at 12:38:38AM +0100, Mikhail Kostousov wrote:

> My provider required 802.1X authorization with dynamic WEP keys for wired
> network. I've got it from my desktop computer, with next config:

Dynamic WEP keys for wired network?? I've never heard of anyone using
WEP on wired network nor am I aware of any driver supporting such a
thing..

> ap_scan=0
> network={
>        key_mgmt=IEEE8021X WPA-EAP

WPA-EAP should not be here; WPA is only used with wireless networks.

>        eap=PEAP
>        phase2="auth=MSCHAPV2"
>        identity= (my user)
>        password= (my password)

I would assume the dynamic WEP part is bogus and you would need to add
eapol_flags=0 to make wpa_supplicant not wait for dynamic keys.

> With command:
> wpa_supplicant -ieth0 -Dwired -c wpa_supplicant_wired.conf -dd
> 
> After that I compiled wpa_supplicant for my router, and tried to do such
> thing with router. I got following log:
> 
> Initializing interface 'vlan1' conf 'wpa_supplicant.conf' driver 'wired'

This does not match with your command line above (eth0 vs. vlan1). Which
one it is? Is this with a created from eth0?

> I've tried to compare log of router and of desktop, and I found that
> difference begin from line "EAPOL: idleWhile --> 0". Desktop doesn't have
> this line. It has "RX EAPOL from 00:15:62:a3:53:86".
> 
> I cannot understand, why it happens on router. I am using the same
> configuration of wpa_supplicant, the same configuration of compilation
> (exclude options for CC compiler).

Are you using the same ethernet configuration (vlan vs. no vlan)?

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Feb 13 19:22:32 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 13 Feb 2007 19:22:32 -0800
Subject: Losing connection then reassociating to a different network in
	conf file
In-Reply-To: <be5b6b210702100623t5a8260fx92f83a1a2a78aad1@mail.gmail.com>
References: <be5b6b210702100623t5a8260fx92f83a1a2a78aad1@mail.gmail.com>
Message-ID: <20070214032232.GC5079@jm.kir.nu>

On Sat, Feb 10, 2007 at 10:53:23AM -0330, Craig Harding wrote:
> I find that if I have two network blocks in my conf file and if I lose the
> connection to the primary network I would assume it should try to
> re-associate with that same network but this isn't the case - it tries to
> associate with the next lower priority network in the conf file.
> 
> Should this be addressed as a bug or is this the intended way that
> wpa_supplicant should work...?

That's a feature. If the connection fails for any reason (and losing
connection is considered failure in this case), the current AP is added
to a blacklist so that other networks can be tried, i.e., to avoid only
trying to use the same broken AP over and over when there could be other
APs available.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Feb 13 19:26:44 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 13 Feb 2007 19:26:44 -0800
Subject: timeout var for conf file?
In-Reply-To: <be5b6b210702062014u560e4a38lc9a6435cbe6a83b4@mail.gmail.com>
References: <be5b6b210702062014u560e4a38lc9a6435cbe6a83b4@mail.gmail.com>
Message-ID: <20070214032644.GD5079@jm.kir.nu>

On Wed, Feb 07, 2007 at 12:44:10AM -0330, Craig Harding wrote:

> Hi, I have multiple networks in my conf file and I was wondering if there is
> a timeout variable that I can put in my network { } directive so that I can
> specify certain timeouts (in seconds) for certain networks. For example if I
> know I will defintely not connect to my highest priority network in my conf
> file (because I am hundreds of miles away) it will take approximately 30
> seconds (I'm guessing) to try to associate with that SSID and then it will
> try the next network and then next network (and so on) until it connects
> successfully, giving a long timeout for each separate network..

No, there is no option for doing this in the current code. I would
assume you are using ap_scan=2(?) With ap_scan=1, wpa_supplicant would
request scan result and select AP from the list of available APs without
having to try each network block separately. It may help in this kind of
case (but then again, ap_scan=2 is better for some other cases).

Setting the timeout to a lower value in ap_scan=2 may not be desirable
in general, since some cards take very long time ito associate. Still,
it might indeed be useful to allow this to be configured since at least
one of the timeouts could be overly long (60 seconds) for some cases.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Tue Feb 13 19:30:11 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 13 Feb 2007 19:30:11 -0800
Subject: HOSTAP on linux 2.6
In-Reply-To: <45AFA974.9000100@on-go.com>
References: <41553A61.8030108@pl.net> <45AFA974.9000100@on-go.com>
Message-ID: <20070214033011.GE5079@jm.kir.nu>

On Thu, Jan 18, 2007 at 12:08:04PM -0500, thomas chen wrote:

> can someone enlighten me on which version of hostap driver works with 
> which version of linux 2.6.x ??

0.4.9 should be used with all Linux versions up to and including 2.6.13.
The version included in the kernel tree should be used for all Linux
versions starting from 2.6.14.

> i tried hostap 0.4.7 and 0.4.9, and neither seem to work for 2.6.13

I would assume that I tested 0.4.9 with 2.6.13, but I cannot remember
anymore. Could you please be more specific on what you mean by it not
working?

> 0.4.7 does work for 2.6.19 is very different (bunch of stuff in 
> net/ieee80211 which was non-existence in 2.6.13 kernel)...

I wouldn't event expect Host AP driver 0.4.7 to build for Linux 2.6.19..

-- 
Jouni Malinen                                            PGP id EFC895FA



From tchen  Tue Feb 13 19:41:34 2007
From: tchen (thomas chen)
Date: Tue, 13 Feb 2007 22:41:34 -0500
Subject: HOSTAP question.....
Message-ID: <45D284EE.3000503@on-go.com>

i am not clear on hostapd vs iwconfig usage.....

i have the following modules loaded (2.6.16)

hostap_cs
hostap
ieee80211_crypt


and with iwconfig (v 28)
i can see
wifi0
and wlan0
interface

however, if i do a

iwconfig wlan0 essid "foobar" channel 6 mode master

i can see that mode is master with iwconfig command, but on spectrum 
analyzer, there is NOTHING....
at all

now, if i run hostapd -B /etc/hostapd.conf,  i suddenly can see the 
signal on
spectrum analyzer...

however, i am not sure whether hostapd (0.5.7)  is actually doing the 
right thing
becuase there is

hw_mode=b
channel=3

in hostapd.conf file, but the signal is showing on channel 6 (probably 
set by iwconfig earlier)...

furthermore, the CLIENT PC cannot seem to make the association.....

can any one help ?

thanks

tom






From jkmaline  Tue Feb 13 19:58:36 2007
From: jkmaline (Jouni Malinen)
Date: Tue, 13 Feb 2007 19:58:36 -0800
Subject: Sequences for PTK rekeying
In-Reply-To: <45756758.7080001@csr.com>
References: <45756758.7080001@csr.com>
Message-ID: <20070214035836.GF5079@jm.kir.nu>

On Tue, Dec 05, 2006 at 12:34:32PM +0000, Mark Powell wrote:

> We are trying to understand the possible message sequences for PTK/GTK
> establishment and rekeying that wpa_supplicant uses via the
> Wireless Extensions API, and the interaction with the driver.

Are you looking this for WPA or IEEE 802.11i/WPA2? The main difference
is in when the GTK is configured during the initial association.

> Looking at PTKs first, it seems to me that there are six possible
> scenarios:

> 1) Us initiator, success.
> The sequence is:
> 
>     Tx EAPOL Auth 1
>     Rx EAPOL Auth 2
>     Tx EAPOL Auth 3
>     Rx EAPOL Auth 4
>     Set keys

'Us' would be an authenticator here and "EAPOL Auth" would be an
EAPOL-Key frame. This seems to match with the expected behavior for IEEE
802.11i authenticator.

> 2) Us responder, success.
> 
>     Rx EAPOL Auth 1
>     Tx EAPOL Auth 2
>     Rx EAPOL Auth 3
>     Tx EAPOL Auth 4
>     Set keys

> Particularly, does the SetKeys happen after the Tx EAPOL Auth 4 or could
> it happen after the Rx EAPOL Auth 3?

'Us' would be a supplicant. If the implementation were to follow the
"state machine" (in practice, the pseudo-code part of it) in IEEE
802.11i, PTK would actually be set before sending out msg 4/4. However,
msg 4/4 would not be encrypted, because MLME-SETPROTECTION.request() is
used only after this to enable encryption. In practice, I would expect
many implementations to do this by sending msg 4/4 before setting PTK
since MLME-SETPROTECTION.request primitive is not commonly implemented.

> Does the system wait for acknowledgement of the second tx before setting
> the keys?

There is no such requirement in IEEE 802.11 if I remember correctly. In
practice, there is a race condition with msg 4/4 and even if there were
a wait for ACK here, the AP might have ACK'ed the frame in very low
layer and then dropped it for some other reason after which it would
just retry msg 3/4 and would eventually fail to receive msg 4/4 since
that would now be encrypted. If I remember correctly, WPA resolved this
race by allowing authenticator state machine to ignore the lack of msg
4/4 and just configure PTK if all retries of msg 3/4 fail. IEEE 802.11i
does not have this workaround, but some implementations may still do it.

It would be kind of nice to wait for acknowledgement here, but I don't
know whether any implementation does that. At least wpa_supplicant does
not have code for doing it nor is there an interface to the driver that
would allow this to be done in most cases. With net/d80211 and userspace
MLME implementation, this could be a change that could be considered.

> 3) Us initiator, fails at second stage.
> 
>     Tx EAPOL Auth 1
>     Rx EAPOL Auth 2
>     Tx EAPOL Auth 3
>     Timeout or rx bad EAPOL Auth 4
> 
> Is there any indication to the driver that the key
> establishment/rekeying has failed?

Not at this point. Authenticator would re-transmit msg 3/4 couple of
times and then disconnect the client which would show up as an
indication to the driver.

> 4) Us responder, fails at second stage.
> 
>     Rx EAPOL Auth 1
>     Tx EAPOL Auth 2
>     Timeout or rx bad EAPOL Auth 3
> 
> Is there any indication to the driver that the key
> establishment/rekeying has failed?

Not explicitly for this case, but at least wpa_supplicant would try to
association again after the timeout.

> 5) Us initiator, fails at first stage.
> 
>     Tx EAPOL Auth 1
>     Timeout or rx bad EAPOL Auth 2
> 
> Is there any indication to the driver that the key
> establishment/rekeying has failed?

Same as case 3 (re-transmit of msg 1/4).

> 6) Us responder, fails at first stage.
> 
>     Rx bad EAPOL Auth 1
> 
> 
> Well, at least this one is easy!

Same as case 4.

> Is there any difference between initial PTK establishment and
> rekeying?

The main difference is in EAPOL-Key frames being encrypted in rekeying
case. This may change the race between 4/4 and retries of 3/4 a bit, but
the same issue may show up due to different PTK being configured at
before the authenticator has received msg 4/4.

> Similarly, for GTKs there seem to be four possible scenarios:

> 1) Us initiator, success.
> 
>     Tx EAPOL Auth 1
>     Rx EAPOL Auth 2
>     Set keys
> 
> Correct?

This is more complex. Authenticator uses multiple GTKs (usually two with
key indexes 1 and 2 (0-based index, i.e., 0..3). Authenticator wcan set
the GTK even before sending the update since the old key is using
another key index. However, the new GTK is taken into use (i.e., AP
starts transmitting multicast/broadcast frames using it) only after the
GTK has been sent to all associated STAs (i.e., only after having
received msg 2/2 from all STAs or after this has timed out(.

> 2) Us responder, success.
> 
>     Rx EAPOL Auth 1
>     Tx EAPOL Auth 2
>     Set keys
> 
> Is this correct?
> Particularly, does the SetKeys happen after the Tx or could it happen
> after the Rx?

GTK should be set before transmitting 2/2. Though, doing it after TX
would not really matter much in most cases unless the key configuration
is going to take long time. The AP will not be using the new GTK before
having received msg 2/2 from all STAs.

> Does the system wait for acknowledgement of the tx before setting the keys?

No and not much for this either since GTK is not used for encrypting
msg 1/2 or 2/2.

> 3) Us initiator, fails.
> 
>     Tx EAPOL Auth 1
>     Timeout or rx bad EAPOL Auth 2
> 
> Is there any indication to the driver that the key
> establishment/rekeying has failed?

Not at this point, but if retries of 1/2 fail, the client will be
disconnected.

> Again, is there any difference between the initial GTK establishment and
> GTK rekeying?

Yes, initial GTK establishment in IEEE 802.11i/WPA2 happens as part of
the 4-way handshake, i.e., there will not be msg 1/2 and 2/2 for it. In
case of WPA, both the initial GTK establishment and GTK rekeying is
using group key handshake (msgs 1/2 and 2/2), so they are more alike.

-- 
Jouni Malinen                                            PGP id EFC895FA



From sj_qiu  Tue Feb 13 20:55:37 2007
From: sj_qiu (Sheng_Jun)
Date: Wed, 14 Feb 2007 12:55:37 +0800
Subject: Dear All,
Message-ID: <10702141255.AA01856@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From LTI  Wed Feb 14 04:08:55 2007
From: LTI (LTI. - Ticmanis, Linards)
Date: Wed, 14 Feb 2007 13:08:55 +0100
Subject: State of roaming support in wpa_supplicant 0.5.7
Message-ID: <170101C0D451DA4CA619907982FF93BD0901D8@hw-mail.hannover.huwag.net>

Hello all,

I would like to know, what is the state of seamless roaming support in wpa_supplicant 0.5.7 if the driver does not do its own roaming.

Specifically, I would like the following to happen in WPA-PSK mode:

1.) Scan regularly even while associated.
2.) If another AP has decidedly better signal level than the one we're on, reassociate with that other AP. Don't wait until the first AP is totally out of range.
3.) Do a decent handoff that minimizes the amount of lost pings (or other lost data).

I'm using the following configuration:

ctrl_interface=/var/run/wpa_supplicant
eapol_version=1
ap_scan=1
fast_reauth=1
network={
	ssid="hidden_stuff"
	mode=0
	scan_ssid=1
	key_mgmt=WPA-PSK
	psk="stuff"
}

With this configuration, the supplicant issues scans regularly, but doesn't switch APs until the connection has been lost, which means a good number of lost pings, about 5-10 seconds without any connectivity, and of course frequent retransmits in the case where the first AP never goes out of range completely but the signal gets pretty bad.

Is it possible to do what I want to do with wpa_supplicant? Or do I need to implement roaming in the driver in this case?

On first glance, the function wpa_supplicant_select_bss() in events.c doesn't seem to contain any prioritizing by signal quality. Am I correct that no such prioritizing takes place in the supplicant at this time?

I'd be glad for any help.

Best wishes,
-- 
Linards Ticmanis
H?ft & Wessel Aktiengesellschaft, Sitz Hannover
Handelsregister (Commercial register) : Amtsgericht Hannover HRB 57006
USt-ID (VAT) : DE 115681962 - WEEE-Reg.-Nr. DE 68170458
Vorstand (Board of Management) : Hansjoachim Oehmen (Vorsitzender / CEO), 
Peter Claussen (stv. Vorsitzender / COO), Thomas Wolf
Vorsitzender des Aufsichtsrates (Chairman of the Supervisory Board) : Prof. Dr. Dr. h.c. Klaus E. Goehrmann



From mikhail.kostousov  Wed Feb 14 04:12:28 2007
From: mikhail.kostousov (Mikhail Kostousov)
Date: Wed, 14 Feb 2007 13:12:28 +0100
Subject: wired 802.1X authorization for Asus wl500gx router
In-Reply-To: <20070214032009.GB5079@jm.kir.nu>
References: <ad9d3dbd0702111538h6769b731v9a67c38f59eda5e1@mail.gmail.com>
	<20070214032009.GB5079@jm.kir.nu>
Message-ID: <ad9d3dbd0702140412w18d45202u2dc9415e5ea07081@mail.gmail.com>

Thanks for answer!

On 2/14/07, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Mon, Feb 12, 2007 at 12:38:38AM +0100, Mikhail Kostousov wrote:
>
> > My provider required 802.1X authorization with dynamic WEP keys for
> wired
> > network. I've got it from my desktop computer, with next config:
>
> Dynamic WEP keys for wired network?? I've never heard of anyone using
> WEP on wired network nor am I aware of any driver supporting such a
> thing..
>
> > ap_scan=0
> > network={
> >        key_mgmt=IEEE8021X WPA-EAP
>
> WPA-EAP should not be here; WPA is only used with wireless networks.


Ok. I removed it.

>        eap=PEAP
> >        phase2="auth=MSCHAPV2"
> >        identity= (my user)
> >        password= (my password)
>
> I would assume the dynamic WEP part is bogus and you would need to add
> eapol_flags=0 to make wpa_supplicant not wait for dynamic keys.


I've added eapol_flags=0

> With command:
> > wpa_supplicant -ieth0 -Dwired -c wpa_supplicant_wired.conf -dd
> >
> > After that I compiled wpa_supplicant for my router, and tried to do such
> > thing with router. I got following log:
> >
> > Initializing interface 'vlan1' conf 'wpa_supplicant.conf' driver 'wired'

This does not match with your command line above (eth0 vs. vlan1). Which
> one it is? Is this with a created from eth0?


eth0 is ethernet adapter on my laptop (which connects with this
configuration perfectly),
vlan1 is VAN interface of my router (it is wired interface).
I tried new configuration on laptop and on router:

ctrl_interface=/var/run/wpa_supplicant
ap_scan=0
network={
        key_mgmt=IEEE8021X
        eap=PEAP
        eapol_flags=0
        phase2="auth=MSCHAPV2"
        identity="xxxxx"
        password="xxxxx"

}

Laptop connected fine, by router has the same problem... :( I don't know
why... The log from router:




Initializing interface 'vlan1' conf 'wpa_supplicant.conf.1' driver 'wired'
ctrl_interface 'N/A' bridge 'N/A'
Configuration file 'wpa_supplicant.conf.1' ->
'/tmp/harddisk/wpa_supplicant.conf.1'
Reading configuration file '/tmp/harddisk/wpa_supplicant.conf.1'
ctrl_interface='/var/run/wpa_supplicant'
ap_scan=0
Line: 5 - start of a new network block
key_mgmt: 0x8
eap methods - hexdump(len=16): 00 00 00 00 19 00 00 00 00 00 00 00 00 00 00
00
eapol_flags=0 (0x0)
phase2 - hexdump_ascii(len=13):
     xx xx xx xx xx xx xx xx xx xx xx xx xx            auth=MSCHAPV2
identity - hexdump_ascii(len=7):
     xx xx xx xx xx xx xx                              xxxxxx
password - hexdump_ascii(len=8): [REMOVED]
Priority group 0
   id=0 ssid=''
Initializing interface (2) 'vlan1'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
wpa_driver_wired_init: Added multicast membership with packet socket
Own MAC address: 00:15:f2:88:fb:31
Setting scan request: 0 sec 100000 usec
Added interface vlan1
EAPOL: External notification - portControl=Auto
Already associated with a configured network - generating associated event
Association info event
State: DISCONNECTED -> ASSOCIATED
Associated to a new BSS: BSSID=01:80:c2:00:00:03
No keys have been configured - skip key clearing
Network configuration found for the current AP
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
EAPOL: External notification - portControl=Auto
Associated with 01:80:c2:00:00:03
WPA: Association event - clear replay counter
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
EAPOL: External notification - portEnabled=1
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_BE entering state IDLE
EAP: EAP entering state INITIALIZE
EAP: EAP entering state IDLE
Cancelling scan request
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
EAPOL: startWhen --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: txStart
TX EAPOL - hexdump(len=4): 01 01 00 00
EAPOL: idleWhile --> 0
EAP: EAP entering state FAILURE
CTRL-EVENT-EAP-FAILURE EAP authentication failed
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state FAIL
EAPOL: SUPP_PAE entering state HELD
EAPOL: SUPP_BE entering state IDLE
EAPOL: startWhen --> 0
EAPOL: heldWhile --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state FAIL
EAPOL: SUPP_PAE entering state HELD
EAPOL: SUPP_BE entering state IDLE
EAPOL: startWhen --> 0
EAPOL: heldWhile --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state FAIL
EAPOL: SUPP_PAE entering state HELD
EAPOL: SUPP_BE entering state IDLE
EAPOL: startWhen --> 0
EAPOL: heldWhile --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state FAIL
EAPOL: SUPP_PAE entering state HELD
EAPOL: SUPP_BE entering state IDLE
EAPOL: startWhen --> 0
EAPOL: heldWhile --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state FAIL
EAPOL: SUPP_PAE entering state HELD
EAPOL: SUPP_BE entering state IDLE
EAPOL: startWhen --> 0
EAPOL: heldWhile --> 0
EAPOL: SUPP_PAE entering state CONNECTING
EAPOL: SUPP_PAE entering state AUTHENTICATING
EAPOL: SUPP_BE entering state FAIL
EAPOL: SUPP_PAE entering state HELD
EAPOL: SUPP_BE entering state IDLE




> I've tried to compare log of router and of desktop, and I found that
> > difference begin from line "EAPOL: idleWhile --> 0". Desktop doesn't
> have
> > this line. It has "RX EAPOL from 00:15:62:a3:53:86".
> >
> > I cannot understand, why it happens on router. I am using the same
> > configuration of wpa_supplicant, the same configuration of compilation
> > (exclude options for CC compiler).
>
> Are you using the same ethernet configuration (vlan vs. no vlan)?
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070214/e802d68b/attachment.htm 


From jkmaline  Wed Feb 14 19:17:58 2007
From: jkmaline (Jouni Malinen)
Date: Wed, 14 Feb 2007 19:17:58 -0800
Subject: wired 802.1X authorization for Asus wl500gx router
In-Reply-To: <ad9d3dbd0702140412w18d45202u2dc9415e5ea07081@mail.gmail.com>
References: <ad9d3dbd0702111538h6769b731v9a67c38f59eda5e1@mail.gmail.com>
	<20070214032009.GB5079@jm.kir.nu>
	<ad9d3dbd0702140412w18d45202u2dc9415e5ea07081@mail.gmail.com>
Message-ID: <20070215031758.GD5108@jm.kir.nu>

On Wed, Feb 14, 2007 at 01:12:28PM +0100, Mikhail Kostousov wrote:

> eth0 is ethernet adapter on my laptop (which connects with this
> configuration perfectly),
> vlan1 is VAN interface of my router (it is wired interface).

It looks like wpa_supplicant does not receive any of the EAPOL frames
from vlan1. Could you run a sniffer (tcpdump/tethereal/etc.) on the
router and verify whether you actually see any of the EAPOL frames that
way (ethertype==0x888e)? Which Ethernet driver (and/or Ethernet adapter
hw) is used in that device?

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Wed Feb 14 19:32:15 2007
From: jkmaline (Jouni Malinen)
Date: Wed, 14 Feb 2007 19:32:15 -0800
Subject: State of roaming support in wpa_supplicant 0.5.7
In-Reply-To: <170101C0D451DA4CA619907982FF93BD0901D8@hw-mail.hannover.huwag.net>
References: <170101C0D451DA4CA619907982FF93BD0901D8@hw-mail.hannover.huwag.net>
Message-ID: <20070215033215.GE5108@jm.kir.nu>

On Wed, Feb 14, 2007 at 01:08:55PM +0100, LTI. - Ticmanis, Linards wrote:

> I would like to know, what is the state of seamless roaming support in wpa_supplicant 0.5.7 if the driver does not do its own roaming.

Non-existent with ap_scan=1..

> Specifically, I would like the following to happen in WPA-PSK mode:
> 
> 1.) Scan regularly even while associated.
> 2.) If another AP has decidedly better signal level than the one we're on, reassociate with that other AP. Don't wait until the first AP is totally out of range.
> 3.) Do a decent handoff that minimizes the amount of lost pings (or other lost data).

> Is it possible to do what I want to do with wpa_supplicant? Or do I need to implement roaming in the driver in this case?

Yes, this has been done in some customer projects, i.e., wpa_supplicant
has been modified to do background scanning (with the help of the
driver) and allow it to roam even if not strictly necessary (i.e.,
before running out of range). For a simple test on Linux, it could be
enough to just run 'iwlist <iface> scan' from an external script every N
seconds and see what happens.. wpa_supplicant should notice the new scan
results and select an AP based on them.

> On first glance, the function wpa_supplicant_select_bss() in events.c doesn't seem to contain any prioritizing by signal quality. Am I correct that no such prioritizing takes place in the supplicant at this time?

The driver interface is expected to provide results in priority order.
In case of any Linux driver that uses wireless extensions for scan
results this sorting is done in driver_wext.c.
 
-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Wed Feb 14 19:38:39 2007
From: jkmaline (Jouni Malinen)
Date: Wed, 14 Feb 2007 19:38:39 -0800
Subject: Username on EAP-MSCHAPv2
In-Reply-To: <52E5BF168B8CA143A198D856F73D5A9D0F692B@blr-m3-msg.wipro.com>
References: <52E5BF168B8CA143A198D856F73D5A9D0F692B@blr-m3-msg.wipro.com>
Message-ID: <20070215033839.GF5108@jm.kir.nu>

On Mon, Dec 04, 2006 at 11:31:29AM +0530, ramprasad.rajendran at wipro.com wrote:

> I am using wpa_supplicant version 0.5.5 and hostapd 0.4.9 as the
> authenticator cum RADIUS.
> I am testing with EAP-MSCHAPv2

Only with EAP-MSCHAPv2 or with protected tunnel, e.g.,
EAP-PEAP/MSCHAPv2? If you are using only EAP-MSCHAPv2, please note that
it does not generate long enough key by default and may not be useful if
you need dynamic keying (and I would not really recommend using MSCHAPv2
without the encrypted tunnel anyway).

> The username in the hostapd's user and password file has the format
> DOMAIN\user.
> 
> I tried setting the username at the configuration file at the supplicant
> to user at DOMAIN, DOMAIN\user, but gets rejected.
> Is there any particular format in which the user name must be used for
> MSCHAPV2.

Yes, DOMAIN\user is the only format currently supported for the case
where domain part needs to be removed for challenge/response validation.
I did a quick test with EAP-PEAP with EAP-MSCHAPv2 as the inner
authentication method and it seemed to work fine between wpa_supplicant
0.5.x and hostapd 0.4.x when using DOMAIN\user format for the user name.

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Wed Feb 14 19:45:34 2007
From: jkmaline (Jouni Malinen)
Date: Wed, 14 Feb 2007 19:45:34 -0800
Subject: HOSTAP question.....
In-Reply-To: <45D284EE.3000503@on-go.com>
References: <45D284EE.3000503@on-go.com>
Message-ID: <20070215034534.GG5108@jm.kir.nu>

On Tue, Feb 13, 2007 at 10:41:34PM -0500, thomas chen wrote:

> however, if i do a
> 
> iwconfig wlan0 essid "foobar" channel 6 mode master
> 
> i can see that mode is master with iwconfig command, but on spectrum 
> analyzer, there is NOTHING....
> at all

Did you set the wlan0 interface up (ifconfig wlan0 up)? If not, the card
is not fully enabled.

> however, i am not sure whether hostapd (0.5.7)  is actually doing the 
> right thing
> becuase there is
> 
> hw_mode=b
> channel=3
> 
> in hostapd.conf file, but the signal is showing on channel 6 (probably 
> set by iwconfig earlier)...

I do not think that the Host AP driver interface would actually support
channel configuration. This was added for Linux net/d80211
(driver_devicescape.c). With Host AP driver, you will need to configure
the channel first with iwconfig.

> furthermore, the CLIENT PC cannot seem to make the association.....

That is of course not expected.. What kind of security configuration are
you trying to use? WPA? WEP? No encryption at all?

-- 
Jouni Malinen                                            PGP id EFC895FA



From sj_qiu  Wed Feb 14 19:48:08 2007
From: sj_qiu (Sheng_Jun)
Date: Thu, 15 Feb 2007 11:48:08 +0800
Subject: Dear All,
Message-ID: <10702151148.AA01104@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From jkmaline  Wed Feb 14 19:53:54 2007
From: jkmaline (Jouni Malinen)
Date: Wed, 14 Feb 2007 19:53:54 -0800
Subject: WPA2-PSK with TKIP fails to set GTK/PTK to driver:
	ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
In-Reply-To: <45D0FFF7.9020507@saunalahti.fi>
References: <45D0FFF7.9020507@saunalahti.fi>
Message-ID: <20070215035354.GH5108@jm.kir.nu>

On Tue, Feb 13, 2007 at 02:01:59AM +0200, kstauffer wrote:

> For some reason GTK or PTK cannot be installed to driver and 
> authentication to WPA2 AP fails when TKIP is used.

Please make sure that wlan_tkip module is loaded (e.g., try to run
"modprobe wlan_tkip" to load it). I would also recommend testing this
with WMM disabled since there are some special cases with Atheros
hardware when using TKIP with WMM and I don't know whether madwifi
supports all of them.

> If switched to CCMP, authentication is successfull according to 
> wpa_supplicant logs but immediately after authentication 4Way Handshake 
> is restarted and it fails.
> "WPA: 4-Way Handshake failed - pre-shared key may be incorrect" message 
> appears, though PSK is correct.

Can you please test this, too, with WMM disabled? The AP operations in
WPA2+WMM mode is somewhat suspicious since it claims to only support two
replay counters, but WMM would usually use four..

-- 
Jouni Malinen                                            PGP id EFC895FA



From jkmaline  Wed Feb 14 19:57:44 2007
From: jkmaline (Jouni Malinen)
Date: Wed, 14 Feb 2007 19:57:44 -0800
Subject: WPA2-PSK with TKIP fails to set GTK/PTK to	driver:
	ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
In-Reply-To: <45D10DC5.7020203@saunalahti.fi>
References: <45D0FFF7.9020507@saunalahti.fi> <45D10DC5.7020203@saunalahti.fi>
Message-ID: <20070215035744.GI5108@jm.kir.nu>

On Tue, Feb 13, 2007 at 03:00:53AM +0200, kstauffer wrote:

> RSN pre-authentication seems to be enabled in ProST AP and RSN PTKSA 
> Reply Counter is 1.
> I enabled pre-authentication from hostapd and checked if it  behaves the 
> same as ProST board, but it worked nicely.
> 
> Could it be that the RSN PTKSA Reply Counter is causing 4way Handshake 
> to be restarted, even Authentication were succesfull?

In theory, but at least wpa_supplicant does not care about it.

> What is the meaning of those PTKSA/GTKSA Reply Counter capabilities?

It tells how many replay counters are supported. When WMM is used, there
are multiple transmit queues and packets may be re-ordered (i.e., high
priority packets can be sent out before low priority once) and this
re-ordering can happen after packet numbers has been assigned to the
frames. WPA/WPA2 need multiple replay counters to handle such
re-ordering without dropping packets as replay attacks. I don't know
whether any driver really uses these values, but anyway, I would expect
devices that support WPA/WPA2 with WMM to support at least four replay
counters.

-- 
Jouni Malinen                                            PGP id EFC895FA



From ramprasad.rajendran  Wed Feb 14 21:39:02 2007
From: ramprasad.rajendran (ramprasad.rajendran at wipro.com)
Date: Thu, 15 Feb 2007 11:09:02 +0530
Subject: 4Way Handshake Failure
Message-ID: <52E5BF168B8CA143A198D856F73D5A9D0F6B55@blr-m3-msg.wipro.com>



>-----Original Message-----
>From: hostap-bounces+ramprasad.rajendran=wipro.com at shmoo.com 
>[mailto:hostap-bounces+ramprasad.rajendran=wipro.com at shmoo.com]
> On Behalf Of Jouni Malinen
>Sent: Wednesday, February 07, 2007 9:35 AM
>To: hostap at shmoo.com
>Subject: Re: 4Way Handshake Failure
>
>
>On Tue, Feb 06, 2007 at 01:13:03PM +0530, 
>ramprasad.rajendran at wipro.com wrote:
>
>> I am using EAP-FAST as the authentication on a custom built board. 
>> Authentication suceeds, but the 4 Way Handshake Fails.
>
>Which authentication server are you using?

>> I've made some changes to port it to our platform.(OS, timer and the 
>> configuration params, removed certificate processing)
>
>What exactly do you mean by removing certificate processing? 
>With TLS implementation are you using?

Thanks!
There were some problems in my changes. I had removed the scanning and
association code as it was taken care by the driver so as to reduce
size. I wasn't sending the proper RSNIE information element in msg 3/4.

Just to answer the above questions, I am using the internal crypto and
TLS libraries. I had removed the part of code that processes
certificates(to reduce size) because we were using PAC for
authentication and Steel Belted Radius as the RADIUS Server.

----
ram



The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. 

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
 
www.wipro.com



From jpaulo  Thu Feb 15 04:09:33 2007
From: jpaulo (Joao Paulo Pereira de Sousa)
Date: Thu, 15 Feb 2007 12:09:33 +0000
Subject: Problems to autenticat with EAP-TTLS and broadcom driver -
	"wpa_parse_wpa_ie_wpa: malformed ie or unknown version"
Message-ID: <20070215121112.153BDB39A6@mail.iocaine.com>

Hi,

I want authenticate my linksys WRT54GL router in client mode
withEAP-TTLS. I have instaled whiterussian 0.9 and the
wpa_supplicantpackage with libssl. This is my wpa_supplicant.conf file:

#ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
eapol_version=1
ap_scan=1
fast_reauth=1
# se a placa nao suporta scanning, usar ap_scan=0
ap_scan=1
network={
?ssid="e-U"
?scan_ssid=1
?key_mgmt=IEEE8021X
?eap=TTLS
?anonymous_identity="anonymous at utad.pt"
?identity="jp at utad.pt"
?password="xxxxxx"
?phase2="auth=PAP"
}


And I have this debug:

root at Freifunk:~# more debug.txt 
Initializing interface 'eth1' conf '/etc/wpa_supplicant.conf' driver
'broadcom' ctrl_interface 'N/A'
Configuration file '/etc/wpa_supplicant.conf' ->
'/etc/wpa_supplicant.conf'
Reading configuration file '/etc/wpa_supplicant.conf'
ctrl_interface_group=0
eapol_version=1
ap_scan=1
fast_reauth=1
ap_scan=1
Line: 8 - start of a new network block
ssid - hexdump_ascii(len=3):
???? 65 2d 55????????????????????????????????????????? e-U???????????? 
scan_ssid=1 (0x1)
key_mgmt: 0x8
eap methods - hexdump(len=2): 15 00
anonymous_identity - hexdump_ascii(len=17):
???? 61 6e 6f 6e 79 6d 6f 75 73 40 75 74 61 64 2e 70?? anonymous at utad.p
???? 74??????????????????????????????????????????????? t?????????????? 
identity - hexdump_ascii(len=10):
???? 6a 70 40 75 74 61 64 2e 70 74???????????????????? jp at utad.pt????? 
password - hexdump_ascii(len=10): [REMOVED]
phase2 - hexdump_ascii(len=8):
???? 61 75 74 68 3d 50 41 50?????????????????????????? auth=PAP??????? 
Priority group 0
?? id=0 ssid='e-U'
Initializing interface (2) 'eth1'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
Own MAC address: 00:18:f8:e5:fe:4b
BROADCOM: wlioctl(eth1,164,len=4,val=0x7fff7c68)
BROADCOM: wlioctl(eth1,133,len=4,val=0x7fff7c6c)
BROADCOM: wlioctl(eth1,165,len=4,val=0x7fff7c68)
BROADCOM: wlioctl(eth1,134,len=4,val=0x7fff7c6c)
BROADCOM: wlioctl(eth1,122,len=6,val=0x7fff7c60)
BROADCOM: SET KEY[0] alg=0
BROADCOM: addr - hexdump(len=6): ff ff ff ff ff ff
BROADCOM: wlioctl(eth1,45,len=164,val=0x7fff7b80)
BROADCOM: SET KEY[1] alg=0
BROADCOM: addr - hexdump(len=6): ff ff ff ff ff ff
BROADCOM: wlioctl(eth1,45,len=164,val=0x7fff7b80)
BROADCOM: SET KEY[2] alg=0
BROADCOM: addr - hexdump(len=6): ff ff ff ff ff ff
BROADCOM: wlioctl(eth1,45,len=164,val=0x7fff7b80)
BROADCOM: SET KEY[3] alg=0
BROADCOM: addr - hexdump(len=6): ff ff ff ff ff ff
BROADCOM: wlioctl(eth1,45,len=164,val=0x7fff7b80)
BROADCOM: wlioctl(eth1,82,len=4,val=0x7fff7c78)
BROADCOM: wlioctl(eth1,120,len=4,val=0x7fff7c78)
Setting scan request: 0 sec 100000 usec
Added interface eth1
State: DISCONNECTED -> SCANNING
Starting AP scan (specific SSID)
Scan SSID - hexdump_ascii(len=3):
???? 65 2d 55????????????????????????????????????????? e-U???????????? 
BROADCOM: wlioctl(eth1,50,len=36,val=0x7fff7c40)
Scan timeout - try to get results
BROADCOM: wlioctl(eth1,51,len=8192,val=0x10007840)
BROADCOM: AP IEs - hexdump(len=123): 00 03 65 2d 55 01 08 82 84 8b 0c12
96 18 24 03 01 0d 2a 01 02 32 03 30 48 60 85 1e 00 00 84 00 0f 00 ff03
19 00 43 49 46 4f 50 5f 30 33 00 00 00 00 00 00 00 00 00 00 00 25 dd06
00 40 96 01 01 00 dd 05 00 40 96 03 03 dd 16 00 40 96 04 00 02 07 a400
00 23 a4 00 00 42 43 00 00 62 32 00 00 dd 18 00 50 f2 02 01 01 02 0003
a4 00 00 27 a4 00 00 42 43 5e 00 62 32 2f 00
BROADCOM: IE: id:0, len:3
BROADCOM: oui:652d55
BROADCOM: IE: id:1, len:8
BROADCOM: oui:82848b
BROADCOM: IE: id:3, len:1
BROADCOM: IE: id:2a, len:1
BROADCOM: IE: id:32, len:3
BROADCOM: oui:304860
BROADCOM: IE: id:85, len:30
BROADCOM: oui:000084
BROADCOM: IE: id:dd, len:6
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:5
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:22
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:24
BROADCOM: oui:0050f2
BROADCOM: AP IEs - hexdump(len=123): 00 03 65 2d 55 01 08 82 84 8b 0c12
96 18 24 03 01 04 2a 01 00 32 03 30 48 60 85 1e 00 00 84 00 0f 00 ff03
19 00 43 49 46 4f 50 5f 30 32 00 00 00 00 00 00 00 00 01 00 00 25 dd06
00 40 96 01 01 00 dd 05 00 40 96 03 03 dd 16 00 40 96 04 00 05 07 a400
00 23 a4 00 00 42 43 00 00 62 32 00 00 dd 18 00 50 f2 02 01 01 05 0003
a4 00 00 27 a4 00 00 42 43 5e 00 62 32 2f 00
BROADCOM: IE: id:0, len:3
BROADCOM: oui:652d55
BROADCOM: IE: id:1, len:8
BROADCOM: oui:82848b
BROADCOM: IE: id:3, len:1
BROADCOM: IE: id:2a, len:1
BROADCOM: IE: id:32, len:3
BROADCOM: oui:304860
BROADCOM: IE: id:85, len:30
BROADCOM: oui:000084
BROADCOM: IE: id:dd, len:6
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:5
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:22
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:24
BROADCOM: oui:0050f2
BROADCOM: AP IEs - hexdump(len=123): 00 03 65 2d 55 01 08 82 84 8b 0c12
96 18 24 03 01 09 2a 01 00 32 03 30 48 60 85 1e 00 00 84 00 0f 00 ff03
19 00 43 49 46 4f 50 5f 30 36 00 00 00 00 00 00 00 00 00 00 00 25 dd06
00 40 96 01 01 00 dd 05 00 40 96 03 03 dd 16 00 40 96 04 00 02 07 a400
00 23 a4 00 00 42 43 00 00 62 32 00 00 dd 18 00 50 f2 02 01 01 02 0003
a4 00 00 27 a4 00 00 42 43 5e 00 62 32 2f 00
BROADCOM: IE: id:0, len:3
BROADCOM: oui:652d55
BROADCOM: IE: id:1, len:8
BROADCOM: oui:82848b
BROADCOM: IE: id:3, len:1
BROADCOM: IE: id:2a, len:1
BROADCOM: IE: id:32, len:3
BROADCOM: oui:304860
BROADCOM: IE: id:85, len:30 
BROADCOM: oui:000084
BROADCOM: IE: id:dd, len:6
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:5
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:22
BROADCOM: oui:004096
BROADCOM: IE: id:dd, len:24
BROADCOM: oui:0050f2
Received 648 bytes of scan results (3 BSSes)
Scan results: 3
Selecting BSS from priority group 0
0: 00:12:d9:42:ae:10 ssid='e-U' wpa_ie_len=26 rsn_ie_len=0 caps=0x0
wpa_parse_wpa_ie_wpa: malformed ie or unknown version
?? skip WPA IE - parse failed
1: 00:12:d9:4a:1b:a0 ssid='e-U' wpa_ie_len=26 rsn_ie_len=0 caps=0x0
wpa_parse_wpa_ie_wpa: malformed ie or unknown version
?? skip WPA IE - parse failed
2: 00:12:d9:42:ae:00 ssid='e-U' wpa_ie_len=26 rsn_ie_len=0 caps=0x0
wpa_parse_wpa_ie_wpa: malformed ie or unknown version
?? skip WPA IE - parse failed
No suitable AP found.
Setting scan request: 5 sec 0 usec
Starting AP scan (broadcast SSID)
BROADCOM: wlioctl(eth1,50,len=36,val=0x7fff7c40)
Scan timeout - try to get results
BROADCOM: wlioctl(eth1,51,len=8192,val=0x10007a18)
BROADCOM: AP IEs - hexdump(len=129): 00 09 67 75 65 73 74 2d 65 2d 5501
08 82 84 8b 0c 12 96 18 24 03 01 0d 2a 01 02 32 03 30 48 60 85 1e 0000
84 00 0f 00 ff 03 19 00 43 49 46 4f 50 5f 30 33 00 00 00 00 00 00 0000
00 00 00 25 dd 06 00 40 96 01 01 00 dd 05 00 40 96 03 03 dd 16 00 4096
04 00 02 07 a4 00 00 23 a4 00 00 42 43 00 00 62 32 00 00 dd 18 00 50f2
02 01 01 02 00 03 a4 00 00 27 a4 00 00 42 43 5e 00 62 32 2f 00
BROADCOM: IE: id:0, len:9


This is a problem of broadcom driver? Anybody can help me to solve this
problem?

Regards

-- 
							<!--		@page { size: 21.59cm 27.94cm; margin: 2cm }		P {
margin-bottom: 0.21cm }	-->	
Jo?oPaulo


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070215/0b3c6848/attachment.htm 


From sj_qiu  Thu Feb 15 04:29:07 2007
From: sj_qiu (Sheng_Jun)
Date: Thu, 15 Feb 2007 20:29:07 +0800
Subject: Dear All,
Message-ID: <10702152029.AA01572@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From LTI  Thu Feb 15 10:41:36 2007
From: LTI (LTI. - Ticmanis, Linards)
Date: Thu, 15 Feb 2007 19:41:36 +0100
Subject: State of roaming support in wpa_supplicant 0.5.7
Message-ID: <170101C0D451DA4CA619907982FF93BD0901DB@hw-mail.hannover.huwag.net>

> -----Original Message-----
> From: hostap-bounces+lti=hoeft-wessel.de at shmoo.com
> Sent: Thursday, February 15, 2007 4:32 AM
> To: hostap at shmoo.com

> Yes, this has been done in some customer projects, i.e., 
> wpa_supplicant
> has been modified to do background scanning (with the help of the
> driver) and allow it to roam even if not strictly necessary (i.e.,
> before running out of range).

Ok, thanks, probably we will go that way too then.

> For a simple test on Linux, it could be
> enough to just run 'iwlist <iface> scan' from an external 
> script every N
> seconds and see what happens.. wpa_supplicant should notice 
> the new scan
> results and select an AP based on them.


Hmmm... wpa_supplicant (or *something*) does sent scans at regular intervals 
anyway. As I see the mesage from the supplicant in the syslog that it got new 
scan results. The problem seemingly comes down to rewriting the selection 
algorithm.

> The driver interface is expected to provide results in priority order.
> In case of any Linux driver that uses wireless extensions for scan
> results this sorting is done in driver_wext.c.

Ok, cool, the driver interface I'm using (third-party addition) isn't 
driver_wext.c as such, but many of its functions are implemented as calls 
into driver_wext.c, including the "get scan results" function. So this should 
already work.

Thanks for your help,
-- 
Linards Ticmanis



From hlmuller  Thu Feb 15 13:10:53 2007
From: hlmuller (Harvey Muller)
Date: Thu, 15 Feb 2007 13:10:53 -0800 (PST)
Subject: wpa_supplicant-0.5.7 make failure
Message-ID: <564913.797.qm@web53607.mail.yahoo.com>


'make install' fails at the 'for i' loop.
It is specifically choking on 

dynamic_eap_methods' which isn't present
after running make. 




It looks like
dynamic_eap_methods is intentionally absent, in which 

case the solution
is to merely remove it from the ALL= statement in the Makefile. 




Regards, 




Harvey





From jkmaline  Sat Feb 17 09:36:47 2007
From: jkmaline (Jouni Malinen)
Date: Sat, 17 Feb 2007 09:36:47 -0800
Subject: wpa_supplicant-0.5.7 make failure
In-Reply-To: <564913.797.qm@web53607.mail.yahoo.com>
References: <564913.797.qm@web53607.mail.yahoo.com>
Message-ID: <20070217173646.GA5120@jm.kir.nu>

On Thu, Feb 15, 2007 at 01:10:53PM -0800, Harvey Muller wrote:

> 'make install' fails at the 'for i' loop.
> It is specifically choking on 
> 
> dynamic_eap_methods' which isn't present
> after running make. 

> It looks like dynamic_eap_methods is intentionally absent, in which 
> case the solution is to merely remove it from the ALL= statement in the Makefile. 

Thanks! I moved dynamic_eap_methods to the 'all' target instead of ALL
variable.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Sat Feb 17 11:00:11 2007
From: j (Jouni Malinen)
Date: Sat, 17 Feb 2007 11:00:11 -0800
Subject: Shorter URL for the Host AP web site - http://w1.fi/
Message-ID: <20070217190011.GA14430@jm.kir.nu>

I couldn't resist getting this domain since it was apparently still
available.. ;-)  Maybe this is a bit easier to remember (or if not
remember, at least shorter to type). As far as domain names and email
addresses are concerned, this cannot get much shorter anymore since most
TLDs do not like giving out one character domains.

So http://w1.fi/ for the web site and j at w1.fi for reaching me by email..
And yes, that is '1' as in digit one; 'i' was already taken. This is
more on the vanity plate category and old addresses will of course
continue to work.

-- 
Jouni Malinen                                            PGP id EFC895FA



From mikhail.kostousov  Sat Feb 17 13:37:07 2007
From: mikhail.kostousov (Mikhail Kostousov)
Date: Sat, 17 Feb 2007 22:37:07 +0100
Subject: wired 802.1X authorization for Asus wl500gx router
In-Reply-To: <20070215031758.GD5108@jm.kir.nu>
References: <ad9d3dbd0702111538h6769b731v9a67c38f59eda5e1@mail.gmail.com>
	<20070214032009.GB5079@jm.kir.nu>
	<ad9d3dbd0702140412w18d45202u2dc9415e5ea07081@mail.gmail.com>
	<20070215031758.GD5108@jm.kir.nu>
Message-ID: <ad9d3dbd0702171337j1e6f777cmc578b6e623527d3@mail.gmail.com>

I've compiled tcpdump for router, but I cannot find information how to
define ethertype :( Can you help me a bit?
I have also tried tcpdump on desktop, and it is visible that there is EAP
packets. But, router is in the same net and connected to net via usual hub.
I am not sure, must router's tcpdump also show EAP frames or not?

On 2/15/07, Jouni Malinen <jkmaline at cc.hut.fi> wrote:
>
> On Wed, Feb 14, 2007 at 01:12:28PM +0100, Mikhail Kostousov wrote:
>
> > eth0 is ethernet adapter on my laptop (which connects with this
> > configuration perfectly),
> > vlan1 is VAN interface of my router (it is wired interface).
>
> It looks like wpa_supplicant does not receive any of the EAPOL frames
> from vlan1. Could you run a sniffer (tcpdump/tethereal/etc.) on the
> router and verify whether you actually see any of the EAPOL frames that
> way (ethertype==0x888e)? Which Ethernet driver (and/or Ethernet adapter
> hw) is used in that device?
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070217/49b5ddf7/attachment.htm 


From uglymouse  Sun Feb 18 03:57:17 2007
From: uglymouse (kstauffer)
Date: Sun, 18 Feb 2007 13:57:17 +0200
Subject: WPA2-PSK with TKIP fails to set GTK/PTK to
	driver:	ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
In-Reply-To: <20070215035354.GH5108@jm.kir.nu>
References: <45D0FFF7.9020507@saunalahti.fi> <20070215035354.GH5108@jm.kir.nu>
Message-ID: <45D83F1D.1040900@saunalahti.fi>

You were right, tkip module was not loaded.
Thanks for that!

WPA/WPA2 Problems still remains though.

I tried wpa/wpa2 without wmm and it did not make any difference(I've 
heard that ar5213 based chips have some problems with WMM even they have 
support).
Also using CCMP/TKIP encryption doesn't make any difference.
In WPA2 mode, wpa_supplicant reports Authentication to be successfull but
right after that, 4way handshake is restarted.

I managed to get debug logs from AP and it discards 4th eapol frame with
following message when WPA2 is used:
AP:
paed: w 0-DEVPR eapol_rsn_  Replay counter mismatch (got 16777216 exp 2,
discarding EAPOL-Key.

I'm very confused at the moment, where does it get that 16777216?

Full wpa_supplicant, AP logs can be found from:
http://www.saunalahti.fi/~krisst/WPA2_FAIL.rar

I also attached .cap file of wireless traffic.

I appreciate any help I get and thanks for your last answer

-Kristian
Jouni Malinen kirjoitti:
> On Tue, Feb 13, 2007 at 02:01:59AM +0200, kstauffer wrote:
>
>   
>> For some reason GTK or PTK cannot be installed to driver and 
>> authentication to WPA2 AP fails when TKIP is used.
>>     
>
> Please make sure that wlan_tkip module is loaded (e.g., try to run
> "modprobe wlan_tkip" to load it). I would also recommend testing this
> with WMM disabled since there are some special cases with Atheros
> hardware when using TKIP with WMM and I don't know whether madwifi
> supports all of them.
>
>   
>> If switched to CCMP, authentication is successfull according to 
>> wpa_supplicant logs but immediately after authentication 4Way Handshake 
>> is restarted and it fails.
>> "WPA: 4-Way Handshake failed - pre-shared key may be incorrect" message 
>> appears, though PSK is correct.
>>     
>
> Can you please test this, too, with WMM disabled? The AP operations in
> WPA2+WMM mode is somewhat suspicious since it claims to only support two
> replay counters, but WMM would usually use four..
>
>   




From supersayangras  Sun Feb 18 07:12:42 2007
From: supersayangras (simone grassilli)
Date: Sun, 18 Feb 2007 16:12:42 +0100 (CET)
Subject: Host AP and hostapd interaction
Message-ID: <20070218151242.32856.qmail@web27315.mail.ukl.yahoo.com>

Hi,
I'm working with the Host AP driver, hostapd and
wpa_supplicant. In the system we've implemented, the
client side, in which we've installed wpa_supplicant,
sends association requests to the server side, in
which we've installed the Host AP driver and the
hostapd daemon.
I'd like to know, if possibile, when association
requests arrive in the server side, what happens?
1) requests are captured by the Host AP driver first
and then it sends them to the hostapd daemon which
satisfies the request and then sends a response to the
Host AP driver, which at the end sends a response to
client;
2) requests are captured by the hostapd daemon first
and then it satisfies the request by using the Host AP
driver, and then hostapd sends a response to client;
in this case the Host AP driver never interacts
directly with the client;
3) other?

Thanks in advance for your answer.
Simone


	

	
		
___________________________________ 
L'email della prossima generazione? Puoi averla con la nuova Yahoo! Mail: 
http://it.docs.yahoo.com/nowyoucan.html



From j  Sun Feb 18 10:06:15 2007
From: j (Jouni Malinen)
Date: Sun, 18 Feb 2007 10:06:15 -0800
Subject: WPA2-PSK with TKIP fails to set GTK/PTK to	driver:
	ioctl[IEEE80211_IOCTL_SETMODE]: No such device or address
In-Reply-To: <45D83F1D.1040900@saunalahti.fi>
References: <45D0FFF7.9020507@saunalahti.fi> <20070215035354.GH5108@jm.kir.nu>
	<45D83F1D.1040900@saunalahti.fi>
Message-ID: <20070218180614.GA5096@jm.kir.nu>

On Sun, Feb 18, 2007 at 01:57:17PM +0200, kstauffer wrote:

> I managed to get debug logs from AP and it discards 4th eapol frame with
> following message when WPA2 is used:
> AP:
> paed: w 0-DEVPR eapol_rsn_  Replay counter mismatch (got 16777216 exp 2,
> discarding EAPOL-Key.
> 
> I'm very confused at the moment, where does it get that 16777216?

That could be just a byteorder bug (though a bit odd one) in the AP's
debug output (16777216 = 0x1000000 and the replay counter was actually
0x0000000000000001 in that case).. The debug log seems to indicate that
the AP was receiving msg 2/4 again after having sent out 3/4. Supplicant
log did not show msg 2/4 being retransmitted, so this looks like a some
sort of bug in lower layer (e.g., if an ACK was not received for the
frame, it would have been retransmitted and for some reason the AP would
not have discarded it as a duplicate).

At this point, the AP state machine seems to get very confused.. It
drops back to an earlier state and only at that point, the real
message 4/4 is processed. Though, since the AP state is now in
incorrect, it drops the frame with claimed MIC failure (it was trying ot
parse this as msg 2/4, so no surprise in this failing)..

Looking at the capture log, it looks like there are some major problems
in trying to get frames through.. The client (00:12:bf:19:76:69) seems
to be retransmitting the message 2/4 even though the sniffer is seeing
acknowledgement frames from the AP. Maybe the client was further away
from the AP or there were some other issues in it receiving the frames.
Anyway, this type of retransmissions should be fine if the
implementations are following the standard correctly..

Based on the comparison of the capture log and the AP debug log, it
looks like the AP does not implement IEEE 802.11 duplicate filtering
correctly (or at all). Because of this, it sends the retransmitted
EAPOL-Key frames to the state machine and this breaks the state machine
(which itself is somewhat questionable, too, but the main issue is in
the duplicate filtering). In other words, it looks like this AP breaks
down if the second message of 4-way handshake is retransmitted due to
client not receive ACK frame.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Sun Feb 18 10:13:30 2007
From: j (Jouni Malinen)
Date: Sun, 18 Feb 2007 10:13:30 -0800
Subject: wired 802.1X authorization for Asus wl500gx router
In-Reply-To: <ad9d3dbd0702171337j1e6f777cmc578b6e623527d3@mail.gmail.com>
References: <ad9d3dbd0702111538h6769b731v9a67c38f59eda5e1@mail.gmail.com>
	<20070214032009.GB5079@jm.kir.nu>
	<ad9d3dbd0702140412w18d45202u2dc9415e5ea07081@mail.gmail.com>
	<20070215031758.GD5108@jm.kir.nu>
	<ad9d3dbd0702171337j1e6f777cmc578b6e623527d3@mail.gmail.com>
Message-ID: <20070218181330.GB5096@jm.kir.nu>

On Sat, Feb 17, 2007 at 10:37:07PM +0100, Mikhail Kostousov wrote:
> I've compiled tcpdump for router, but I cannot find information how to
> define ethertype :( Can you help me a bit?

"tcpdump -ni <ifname> -ex ether proto 0x888e" shows only EAPOL frames
(with header information and hex dump).

> I have also tried tcpdump on desktop, and it is visible that there is EAP
> packets. But, router is in the same net and connected to net via usual hub.

Yes, this is expected behavior. These are EAPOL packets for the
authentication. You should be able to verify that the MAC addresses
shown are the addresses of the authenticator and the supplicant and in
casde of wired authentiation, the destination address should be a group
address reserved for EAPOL (01:80:c2:00:00:03). The main question is in
whether the router is receiving these multicast frames.

> I am not sure, must router's tcpdump also show EAP frames or not?

Yes.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Sun Feb 18 10:16:12 2007
From: j (Jouni Malinen)
Date: Sun, 18 Feb 2007 10:16:12 -0800
Subject: Host AP and hostapd interaction
In-Reply-To: <20070218151242.32856.qmail@web27315.mail.ukl.yahoo.com>
References: <20070218151242.32856.qmail@web27315.mail.ukl.yahoo.com>
Message-ID: <20070218181612.GC5096@jm.kir.nu>

On Sun, Feb 18, 2007 at 04:12:42PM +0100, simone grassilli wrote:

> I'm working with the Host AP driver, hostapd and
> wpa_supplicant.

> I'd like to know, if possibile, when association
> requests arrive in the server side, what happens?
> 1) requests are captured by the Host AP driver first
> and then it sends them to the hostapd daemon which
> satisfies the request and then sends a response to the
> Host AP driver, which at the end sends a response to
> client;
> 2) requests are captured by the hostapd daemon first
> and then it satisfies the request by using the Host AP
> driver, and then hostapd sends a response to client;
> in this case the Host AP driver never interacts
> directly with the client;

2) is closer. When hostapd is used, association request is processed in
hostapd, not in the driver. In other words, the driver is only used to
deliver packets and it does not process the frames in either direction
apart from just taking care of transmitting/receiving them.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Sun Feb 18 10:17:35 2007
From: j (Jouni Malinen)
Date: Sun, 18 Feb 2007 10:17:35 -0800
Subject: State of roaming support in wpa_supplicant 0.5.7
In-Reply-To: <170101C0D451DA4CA619907982FF93BD0901DB@hw-mail.hannover.huwag.net>
References: <170101C0D451DA4CA619907982FF93BD0901DB@hw-mail.hannover.huwag.net>
Message-ID: <20070218181735.GD5096@jm.kir.nu>

On Thu, Feb 15, 2007 at 07:41:36PM +0100, LTI. - Ticmanis, Linards wrote:

> Hmmm... wpa_supplicant (or *something*) does sent scans at regular intervals 
> anyway. As I see the mesage from the supplicant in the syslog that it got new 
> scan results. The problem seemingly comes down to rewriting the selection 
> algorithm.

Something else in this most likely.. For example, madwifi driver is
doing background scans and whenever it reports that with WEXT,
wpa_supplicant is going through the results, too.

> Ok, cool, the driver interface I'm using (third-party addition) isn't 
> driver_wext.c as such, but many of its functions are implemented as calls 
> into driver_wext.c, including the "get scan results" function. So this should 
> already work.

Yes.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Sun Feb 18 10:28:35 2007
From: j (Jouni Malinen)
Date: Sun, 18 Feb 2007 10:28:35 -0800
Subject: Problems to autenticat with EAP-TTLS and broadcom driver -
	"wpa_parse_wpa_ie_wpa: malformed ie or unknown version"
In-Reply-To: <20070215121112.153BDB39A6@mail.iocaine.com>
References: <20070215121112.153BDB39A6@mail.iocaine.com>
Message-ID: <20070218182835.GE5096@jm.kir.nu>

On Thu, Feb 15, 2007 at 12:09:33PM +0000, Joao Paulo Pereira de Sousa wrote:

> I want authenticate my linksys WRT54GL router in client mode
> withEAP-TTLS. I have instaled whiterussian 0.9 and the
> wpa_supplicantpackage with libssl.

> BROADCOM: AP IEs - hexdump(len=123): 00 03 65 2d 55 01 08 82 84 8b 0c12
> 96 18 24 03 01 09 2a 01 00 32 03 30 48 60 85 1e 00 00 84 00 0f 00 ff03
> 19 00 43 49 46 4f 50 5f 30 36 00 00 00 00 00 00 00 00 00 00 00 25 dd06
> 00 40 96 01 01 00 dd 05 00 40 96 03 03 dd 16 00 40 96 04 00 02 07 a400
> 00 23 a4 00 00 42 43 00 00 62 32 00 00 dd 18 00 50 f2 02 01 01 02 0003
> a4 00 00 27 a4 00 00 42 43 5e 00 62 32 2f 00

> Selecting BSS from priority group 0
> 0: 00:12:d9:42:ae:10 ssid='e-U' wpa_ie_len=26 rsn_ie_len=0 caps=0x0
> wpa_parse_wpa_ie_wpa: malformed ie or unknown version
> ?? skip WPA IE - parse failed

This looks like a bug in driver_broadcom.c.. The AP is confured to use
WMM and the IE parser in driver_broadcom.c is confusing the WMM IE with
WPA IE and refuses to use the AP because of this.

I opened a Bugzilla case to track this issue:
http://hostap.epitest.fi/bugz/show_bug.cgi?id=202

-- 
Jouni Malinen                                            PGP id EFC895FA



From sj_qiu  Sun Feb 18 10:48:29 2007
From: sj_qiu (Sheng_Jun)
Date: Mon, 19 Feb 2007 02:48:29 +0800
Subject: Dear All,
Message-ID: <10702190248.AA01960@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From j  Mon Feb 19 09:00:18 2007
From: j (Jouni Malinen)
Date: Mon, 19 Feb 2007 09:00:18 -0800
Subject: hostapd/wpa_supplicant - stable release v0.4.10
Message-ID: <20070219170018.GB8750@jm.kir.nu>

New versions of wpa_supplicant and hostapd were just released and are
now available from http://w1.fi/

This release is a bug fix version from the old stable (0.4.x) branch
and it replaces 0.4.9 as the recommended stable version if you have
not yet updated to the current stable branch (0.5.x).

If you are already using 0.5.7, you have all the fixes included in
this 0.4.10 release. If you are still using 0.3.x versions, I would
recommend upgrading to either 0.5.7 or this 0.4.10 release. There will
likely be one more 0.3.x bug fix release, but the 0.3.x branch is
getting close to reaching its end.


hostapd:
* added -P<pid file> argument for wpa_supplicant to write the current
  process id into a file
* fixed hostapd to add PMKID KDE into 4-Way Handshake Message 1 when
  using WPA2 even if PMKSA caching is not used
* driver_madwifi: fixed configuration of unencrypted modes (plaintext
  and IEEE 802.1X without WEP)
* fixed session timeout processing with drivers that do not use
  ieee802_11.c (e.g., madwifi)
* fixed EAP-PSK bit ordering of the Flags field
* fixed configuration reloading (SIGHUP) to re-initialize WPA PSKs
  by reading wpa_psk_file [Bug 181]
* fixed EAP-TTLS AVP parser processing for too short AVP lengths
* fixed IPv6 connection to RADIUS accounting server

wpa_supplicant:
* driver_madwifi: fixed TKIP and CCMP sequence number configuration on
  big endian hosts [Bug 146]
* Windows: added a workaround for UDP-based control interface to
  prevent packets with forged addresses from being accepted as local
  control requests
* fixed EAP-SIM/AKA key derivation for re-authentication case (only
  affects IEEE 802.1X with dynamic WEP keys)
* fixed WPA PSK update through ctrl_iface for the case where the old
  PSK was derived from an ASCII passphrase and the new PSK is set as
  a raw PSK (hex string)
* fixed configuration parser not to remove CCMP from group cipher list
  if WPA-None (adhoc) is used (pairwise=NONE in that case)
* driver_ndis: fixed static WEP configuration to avoid race condition
  issues with some NDIS drivers between association and setting WEP
  keys
* driver_ndis: added validation for IELength value in scan results to
  avoid crashes when using buggy NDIS drivers [Bug 165]
* fixed selection of the first network in ap_scan=2 mode; previously,
  wpa_supplicant could get stuck in SCANNING state when only the first
  network for enabled (e.g., after 'wpa_cli select_network 0')
* driver_ndis: added support for selecting AP based on BSSID
* fixed USIM PIN status determination for the case that PIN is not
  needed (this allows EAP-AKA to be used with USIM cards that do not
  use PIN)
* added support for reading 3G USIM AID from EF_DIR to allow EAP-AKA to
  be used with cards that do not support file selection based on
  partial AID
* fixed EAP-PSK bit ordering of the Flags field
* fixed EAP-PEAP/TTLS/FAST to use the correct EAP identifier in
  tunnelled identity request (previously, the identifier from the outer
  method was used, not the tunnelled identifier which could be
  different)
* fixed EAP-TTLS AVP parser processing for too short AVP lengths
* updated Windows binary build to link against OpenSSL 0.9.8d and
  added support for EAP-FAST
* added a workaround for a case where the AP is using unknown address
  (e.g., MAC address of the wired interface) as the source address for
  EAPOL-Key frames; previously, that source address was used as the
  destination for EAPOL-Key frames and in key derivation; now, BSSID is
  used even if the source address does not match with it
  (this resolves an interoperability issue with Thomson SpeedTouch 580)

-- 
Jouni Malinen                                            PGP id EFC895FA



From preining  Mon Feb 19 09:23:18 2007
From: preining (Norbert Preining)
Date: Mon, 19 Feb 2007 18:23:18 +0100
Subject: Problems: associating ipw3945 wpa_supplicant
Message-ID: <20070219172318.GA29875@gamma.logic.tuwien.ac.at>

Hi all!

Short description: I found an AP which I cannot associate to at all. All
other AP in my surroundings do work without problems.

hardware: ipw3945
software:
kernel 2.6.20
ipw3945 1.2.0 (latest)
(also tried with iwlwifi svn checkout)
wpa_supplicant 0.5.5
debian/sid

The AP is the only configured in the wpa_supplicant.conf file:
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
eapol_version=1
ap_scan=2	# also tried with =0 and =1

network={
	ssid="Hotel NoName"
	key_mgmt=NONE
	auth_alg=SHARED
	wep_key0="5570441089532"
	wep_tx_keyidx=0
	priority=3
}

With the same configuration (well with some more networks) y laptop
associates without problems to various AP (home, university, internet
cafe), only this one does not work atall.

It seems that it is associated:
wireless  unassociated  ESSID:"Hotel NoName"  
          Mode:Managed  Frequency=2.437 GHz  Access Point: 00:04:0E:95:B3:37   
          Bit Rate:0 kb/s   Tx-Power:16 dBm   
          Retry limit:15   RTS thr:off   Fragment thr:off
          Encryption key:3535-3730-3434-3130-3839-3533-32   Security mode:restricted
          Power Management:off
          Link Quality:0  Signal level:0  Noise level:0
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:7   Missed beacon:0
But no conection, no response, and disassociating ...

I started wpa_supplicant with -dd and captured the output, it is
attached

Thanks a lot for any suggestions and ideas what else I could do to get
it working.

One more data point: With WindowsXP on my laptop and with my Palm T|X it
is working without any problems

Thanks a lot and all the best

Norbert

-------------------------------------------------------------------------------
Dr. Norbert Preining <preining at logic.at>                    Universit? di Siena
Debian Developer <preining at debian.org>                         Debian TeX Group
gpg DSA: 0x09C5B094      fp: 14DF 2E6C 0307 BE6D AD76  A9C0 D2BF 4AA3 09C5 B094
-------------------------------------------------------------------------------
ARAGLIN (n. archaic)
A medieval practical joke played by young squires on a knight aspirant
the afternoon he is due to start his vigil. As the knight arrives at
the castle the squires attempt to raise the drawbridge very suddenly
as the knight and his charger step on to it.
			--- Douglas Adams, The Meaning of Liff
-------------- next part --------------
Initializing interface 'wireless' conf '/etc/wpa_supplicant/wpa_supplicant.conf' driver 'wext' ctrl_interface 'N/A' bridge 'N/A'
Configuration file '/etc/wpa_supplicant/wpa_supplicant.conf' -> '/etc/wpa_supplicant/wpa_supplicant.conf'
Reading configuration file '/etc/wpa_supplicant/wpa_supplicant.conf'
ctrl_interface='/var/run/wpa_supplicant'
ctrl_interface_group='0' (DEPRECATED)
eapol_version=1
Line: 5 - start of a new network block
ssid - hexdump_ascii(len=11):
     48 6f 74 65 6c 20 41 6c 70 73 75                  Hotel NoName     
key_mgmt: 0x4
auth_alg: 0x2
wep_key0 - hexdump(len=13): [REMOVED]
Priority group 0
   id=0 ssid='Hotel NoName'
Initializing interface (2) 'wireless'
EAPOL: SUPP_PAE entering state DISCONNECTED
EAPOL: KEY_RX entering state NO_KEY_RECEIVE
EAPOL: SUPP_BE entering state INITIALIZE
EAP: EAP entering state DISABLED
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
SIOCGIWRANGE: WE(compiled)=21 WE(source)=16 enc_capa=0xf
  capabilities: key_mgmt 0xf enc 0xf
WEXT: Operstate: linkmode=1, operstate=5
Own MAC address: 00:13:02:2e:eb:09
wpa_driver_wext_set_wpa
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_countermeasures
wpa_driver_wext_set_drop_unencrypted
Setting scan request: 0 sec 100000 usec
ctrl_interface_group=0
Added interface wireless
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b06 len=8
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
Trying to get current scan results first without requesting a new scan to speed up initial association
Received 233 bytes of scan results (1 BSSes)
Scan results: 1
Selecting BSS from priority group 0
0: 00:04:0e:95:b3:37 ssid='Hotel NoName' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
   selected non-WPA AP 00:04:0e:95:b3:37 ssid='Hotel NoName'
Trying to associate with 00:04:0e:95:b3:37 (SSID='Hotel NoName' freq=0 MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
Overriding auth_alg selection: 0x2
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_wext_set_key: alg=1 key_idx=0 set_tx=1 seq_len=0 key_len=13
wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - portControl=ForceAuthorized
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b1a len=19
Authentication with 00:00:00:00:00:00 timed out.
Added BSSID 00:04:0e:95:b3:37 into blacklist
State: ASSOCIATING -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
Scan timeout - try to get results
Received 233 bytes of scan results (1 BSSes)
Scan results: 1
Selecting BSS from priority group 0
0: 00:04:0e:95:b3:37 ssid='Hotel NoName' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
   selected non-WPA AP 00:04:0e:95:b3:37 ssid='Hotel NoName'
Trying to associate with 00:04:0e:95:b3:37 (SSID='Hotel NoName' freq=0 MHz)
Cancelling scan request
WPA: clearing own WPA/RSN IE
Automatic auth_alg selection: 0x1
Overriding auth_alg selection: 0x2
WPA: clearing AP WPA IE
WPA: clearing AP RSN IE
WPA: clearing own WPA/RSN IE
No keys have been configured - skip key clearing
wpa_driver_wext_set_key: alg=1 key_idx=0 set_tx=1 seq_len=0 key_len=13
wpa_driver_wext_set_drop_unencrypted
State: SCANNING -> ASSOCIATING
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_associate
Setting authentication timeout: 10 sec 0 usec
EAPOL: External notification - portControl=ForceAuthorized
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b06 len=8
RTM_NEWLINK: operstate=0 ifi_flags=0x1003 ([UP])
Wireless event: cmd=0x8b1a len=19
Authentication with 00:00:00:00:00:00 timed out.
BSSID 00:04:0e:95:b3:37 blacklist count incremented to 2
State: ASSOCIATING -> DISCONNECTED
wpa_driver_wext_set_operstate: operstate 0->0 (DORMANT)
WEXT: Operstate: linkmode=-1, operstate=5
wpa_driver_wext_set_key: alg=0 key_idx=0 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=1 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=2 set_tx=0 seq_len=0 key_len=0
wpa_driver_wext_set_key: alg=0 key_idx=3 set_tx=0 seq_len=0 key_len=0
EAPOL: External notification - portEnabled=0
EAPOL: External notification - portValid=0
Setting scan request: 0 sec 0 usec
State: DISCONNECTED -> SCANNING
Starting AP scan (broadcast SSID)
Scan timeout - try to get results
Received 233 bytes of scan results (1 BSSes)
Scan results: 1
Selecting BSS from priority group 0
0: 00:04:0e:95:b3:37 ssid='Hotel NoName' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - blacklisted
No APs found - clear blacklist and try again
Removed BSSID 00:04:0e:95:b3:37 from blacklist (clear)
Selecting BSS from priority group 0
0: 00:04:0e:95:b3:37 ssid='Hotel NoName' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE
   selected non-WPA AP 00:04:0e:95:b3:37 ssid='Hotel NoName'
Trying to associate with 00:04:0e:95:b3:37 (SSID='Hotel NoName' freq=0 MHz)
Cancelling scan request
.... and so it continues


From alex  Mon Feb 19 11:10:03 2007
From: alex (Alex Pounds)
Date: Mon, 19 Feb 2007 19:10:03 +0000
Subject: WPA failing to associate OK with Intersil chipset (redux)
Message-ID: <20070219191003.GC11619@localhost.localdomain>

Hello, 

Back in December I reported a problem I was having with my laptop's wifi
and WPA2. To date, I am unable to get it to hold a connection with my
wireless router, a Linksys WRT54GL, despite it working perfectly fine with
my desktop PC (also using wpa_supplicant). Details are available from the
thread here: 
http://lists.shmoo.com/pipermail/hostap/2006-December/014698.html
http://www.ethicsgirls.com/stuff/lspci.txt and
http://www.ethicsgirls.com/stuff/dmesg.txt may also be useful. 

I'm not entirely sure that the wifi card has the hardware to support WPA,
so that would probably be a good thing to check. Presuming that it does,
however, let me outline the current symptoms and see if anyone has any
bright ideas. 

Since last time I've upgraded the firmware, which should provide WPA
support. On startup, the card reports as follows: 

hostap_pci: Registered netdevice wifi0
wifi0: Original COR value: 0x0
prism2_hw_init: initialized in 196 ms
wifi0: NIC: id=0x8013 v1.0.0
wifi0: PRI: id=0x15 v1.1.1
wifi0: STA: id=0x1f v1.7.4
wifi0: Intersil Prism2.5 PCI: mem=0xf8000000, irq=11
wifi0: registered netdevice wlan0

The (abridged) dmesg log shows that my card flip-flops between associating
and non-associating (as well as having a weird thing for a 44:44:44
address): 

eth0: Trying to join BSSID 00:16:b6:xx:xx:xx
eth0: LinkStatus=1 (Connected)
eth0: LinkStatus: BSSID=00:16:b6:xx:xx:xx
eth0: invalid skb->cb magic (0x00000000, expected 0xf08a36a2)
eth0: LinkStatus=2 (Disconnected)
eth0: LinkStatus: BSSID=00:16:b6:xx:xx:xx
eth0: LinkStatus=2 (Disconnected)
eth0: LinkStatus: BSSID=00:16:b6:xx:xx:xx
eth0: LinkStatus=2 (Disconnected)
eth0: LinkStatus: BSSID=44:44:44:44:44:44
eth0: LinkStatus=2 (Disconnected)
eth0: LinkStatus: BSSID=44:44:44:44:44:44
eth0: manual reset request(2)
eth0: LinkStatus=2 (Disconnected)
eth0: LinkStatus: BSSID=00:16:b6:xx:xx:xx
eth0: LinkStatus=2 (Disconnected)


My wpa_supplicant.conf looks like this: 

network={
	#scan_ssid=1
	#priority=5
	#ssid="ourwifi"
	#psk="password"
	#psk=[hex string of 'password']


	ssid="ourwifi"
	bssid=00:16:B6:xx:xx:xx
	psk="password"
	priority=0
	scan_ssid=1
}


This compares to my desktop's wpa_supplicant.conf, that looks like this: 

network={
        ssid="ourwifi"
        #psk="password"
        psk=[hex string of 'password']
}


I've stuck a log of the wpa_supplicant output at
http://www.ethicsgirls.com/stuff/wifilog.txt . This was run by doing: 

wpa_supplicant -c /etc/wpa_supplicant.conf -dd -w -Dhostap -ieth0 | tee wifilog.txt


I'm on wpa_supplicant version 0.5.5. Any ideas? 

Thank you, 

-- 
Alex Pounds (Creature)                  .~.         http://www.alexpounds.com/
                                        /V\        http://www.ethicsgirls.com/
                                       // \\
"Variables won't; Constants aren't"   /(   )\
                                       ^`~'^



From j  Mon Feb 19 17:01:40 2007
From: j (Jouni Malinen)
Date: Mon, 19 Feb 2007 17:01:40 -0800
Subject: Problems: associating ipw3945 wpa_supplicant
In-Reply-To: <20070219172318.GA29875@gamma.logic.tuwien.ac.at>
References: <20070219172318.GA29875@gamma.logic.tuwien.ac.at>
Message-ID: <20070220010140.GC5279@jm.kir.nu>

On Mon, Feb 19, 2007 at 06:23:18PM +0100, Norbert Preining wrote:

> hardware: ipw3945

> network={
> 	ssid="Hotel NoName"
> 	key_mgmt=NONE
> 	auth_alg=SHARED
> 	wep_key0="5570441089532"

Hmm.. Is this AP configured to require Shard Key authentication for WEP?
Have you been able to use WEP with Open System authentication with
other APs? I've done very limited testing with ipw3945 and have never
tested Shared Key authentication with it, so I do not know what kind of
behavior to expect from it.

Have you tried associating with this AP using just iwconfig?

> It seems that it is associated:
> wireless  unassociated  ESSID:"Hotel NoName"  
>           Mode:Managed  Frequency=2.437 GHz  Access Point: 00:04:0E:95:B3:37   

That "unassociated" text does not look very associated to me.. My first
guess would be that the client is trying to associate, but fails in
Shared Key authentication before association.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Mon Feb 19 17:12:24 2007
From: j (Jouni Malinen)
Date: Mon, 19 Feb 2007 17:12:24 -0800
Subject: WPA failing to associate OK with Intersil chipset (redux)
In-Reply-To: <20070219191003.GC11619@localhost.localdomain>
References: <20070219191003.GC11619@localhost.localdomain>
Message-ID: <20070220011223.GD5279@jm.kir.nu>

On Mon, Feb 19, 2007 at 07:10:03PM +0000, Alex Pounds wrote:

> I'm not entirely sure that the wifi card has the hardware to support WPA,
> so that would probably be a good thing to check. Presuming that it does,
> however, let me outline the current symptoms and see if anyone has any
> bright ideas. 

Well, I don't know whether I would call it hardware support for WPA, but
all Prism2/2.5/3 cards should work with WPA if they are using new enough
station firmware (v1.7.x or newer). Most of the WPA related
functionality is implemented in the driver/supplicant, though.

> The (abridged) dmesg log shows that my card flip-flops between associating
> and non-associating (as well as having a weird thing for a 44:44:44
> address): 

That 44:44:44:44:44:44 address is just the default address that the
firmware uses when it is not associated with any AP.
> 
> eth0: Trying to join BSSID 00:16:b6:xx:xx:xx
> eth0: LinkStatus=1 (Connected)
> eth0: LinkStatus: BSSID=00:16:b6:xx:xx:xx

This should indicate that the firmware was able to complete association.

> I've stuck a log of the wpa_supplicant output at
> http://www.ethicsgirls.com/stuff/wifilog.txt . This was run by doing: 

This is somewhat confusing:

0: 00:16:b6:xx:xx:xx ssid='ourwifi' wpa_ie_len=0 rsn_ie_len=0 caps=0x11
   skip - no WPA/RSN IE

The first scan result comes with no WPA or RSN(WPA2) being advertised..

0: 00:16:b6:xx:xx:xx ssid='ourwifi' wpa_ie_len=0 rsn_ie_len=22 caps=0x11
   selected based on RSN IE

But the second scan shows WPA2 being advertised..

Rest of the log shows successful associations happening with the AP, but
no EAPOL frames (the key handshake for WPA2) are received. Based on this
information, I do not know what could be causing such behavior. Would
you by any chance be able to capture the 802.11 packets exchanged during
the authentication attempt with a wireless sniffer? That would be the
best way of getting more information to figure out what exactly is
happening here.

-- 
Jouni Malinen                                            PGP id EFC895FA



From sj_qiu  Mon Feb 19 17:13:07 2007
From: sj_qiu (Sheng_Jun)
Date: Tue, 20 Feb 2007 09:13:07 +0800
Subject: Dear All,
Message-ID: <10702200913.AA01844@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From ramprasad.rajendran  Mon Feb 19 20:58:00 2007
From: ramprasad.rajendran (ramprasad.rajendran at wipro.com)
Date: Tue, 20 Feb 2007 10:28:00 +0530
Subject: Size of PAC  in EAP-FAST
Message-ID: <52E5BF168B8CA143A198D856F73D5A9D0F6B60@blr-m3-msg.wipro.com>


Hi,
What is the maximum size of PAC that can be used for EAP-FAST.
I read that the PAC-Key is 32 bytes and PAC-Opaque and PAC-Info are
variable.

We are using Supplicant on a custom built board and we need to know the
max size that the PAC can be.
Any inputs would be great. Thanks

----
ram


The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. 

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.
 
www.wipro.com



From j  Mon Feb 19 21:53:48 2007
From: j (Jouni Malinen)
Date: Mon, 19 Feb 2007 21:53:48 -0800
Subject: Size of PAC  in EAP-FAST
In-Reply-To: <52E5BF168B8CA143A198D856F73D5A9D0F6B60@blr-m3-msg.wipro.com>
References: <52E5BF168B8CA143A198D856F73D5A9D0F6B60@blr-m3-msg.wipro.com>
Message-ID: <20070220055347.GF5279@jm.kir.nu>

On Tue, Feb 20, 2007 at 10:28:00AM +0530, ramprasad.rajendran at wipro.com wrote:

> What is the maximum size of PAC that can be used for EAP-FAST.
> I read that the PAC-Key is 32 bytes and PAC-Opaque and PAC-Info are
> variable.

I don't think that there is any explicit limit on PAC length. Since the
length field for the PAC components and even for the full PAC TLV is
using 2 octets, the PAC could, in theory, be up to 64 KB. In other
words, authentication server could generate a very long PAC-Opaque, but
I would be quite surprised if this were to be increased much over 500
bytes due to PAC-Opaque being sent as part of the tunnel establishment.

-- 
Jouni Malinen                                            PGP id EFC895FA



From dcbw  Tue Feb 20 03:13:15 2007
From: dcbw (Dan Williams)
Date: Tue, 20 Feb 2007 06:13:15 -0500
Subject: Problems: associating ipw3945 wpa_supplicant
In-Reply-To: <20070220010140.GC5279@jm.kir.nu>
References: <20070219172318.GA29875@gamma.logic.tuwien.ac.at>
	<20070220010140.GC5279@jm.kir.nu>
Message-ID: <1171969995.2851.5.camel@localhost.localdomain>

On Mon, 2007-02-19 at 17:01 -0800, Jouni Malinen wrote:
> On Mon, Feb 19, 2007 at 06:23:18PM +0100, Norbert Preining wrote:
> 
> > hardware: ipw3945
> 
> > network={
> > 	ssid="Hotel NoName"
> > 	key_mgmt=NONE
> > 	auth_alg=SHARED
> > 	wep_key0="5570441089532"
> 
> Hmm.. Is this AP configured to require Shard Key authentication for WEP?
> Have you been able to use WEP with Open System authentication with
> other APs? I've done very limited testing with ipw3945 and have never
> tested Shared Key authentication with it, so I do not know what kind of
> behavior to expect from it.
> 
> Have you tried associating with this AP using just iwconfig?
> 
> > It seems that it is associated:
> > wireless  unassociated  ESSID:"Hotel NoName"  
> >           Mode:Managed  Frequency=2.437 GHz  Access Point: 00:04:0E:95:B3:37   
> 
> That "unassociated" text does not look very associated to me.. My first
> guess would be that the client is trying to associate, but fails in
> Shared Key authentication before association.

Furthermore, if it's unassociated, it shouldn't have a valid MAC address
in the access point field.  Seems like a driver bug to me as well.

Dan





From preining  Tue Feb 20 07:46:27 2007
From: preining (Norbert Preining)
Date: Tue, 20 Feb 2007 16:46:27 +0100
Subject: Problems: associating ipw3945 wpa_supplicant
In-Reply-To: <20070220010140.GC5279@jm.kir.nu>
References: <20070219172318.GA29875@gamma.logic.tuwien.ac.at> 
	<20070220010140.GC5279@jm.kir.nu>
Message-ID: <1037-SnapperMsgD65F34B6C200C99A@[192.168.178.38]>

Hi Jouni!

On Mon, 19 Feb 2007 17:01:40 -0800 "Jouni Malinen" <j at w1.fi> wrote:
> > network={
> > 	ssid="Hotel NoName"
> > 	key_mgmt=NONE
> > 	auth_alg=SHARED
> > 	wep_key0="5570441089532"
> 
> Hmm.. Is this AP configured to require Shard Key authentication for WEP?
> Have you been able to use WEP with Open System authentication with
> other APs? I've done very limited testing with ipw3945 and have never
> tested Shared Key authentication with it, so I do not know what kind of
> behavior to expect from it.

Aemm ... sorry I don't understand completely: I have a AP which only requires knowing the WEP key, no other authentication whatsoever.

Do you want to say that this configuration is wrong for this setup? If yes, what would be the right one?

> Have you tried associating with this AP using just iwconfig?

Yes, I set the AP and the key, and it didn't associate.

> That "unassociated" text does not look very associated to me.. My first
> guess would be that the client is trying to associate, but fails in
> Shared Key authentication before association.

Any suggestions what to change in the config file?

Thanks a lot and all the best

Norbert
-------------------------------------------------------------------------------
Dr. Norbert Preining <preining at logic.at>                    Universit? di Siena
Debian Developer <preining at debian.org>                         Debian TeX Group
gpg DSA: 0x09C5B094      fp: 14DF 2E6C 0307 BE6D AD76  A9C0 D2BF 4AA3 09C5 B094
-------------------------------------------------------------------------------




From dcbw  Tue Feb 20 09:22:33 2007
From: dcbw (Dan Williams)
Date: Tue, 20 Feb 2007 12:22:33 -0500
Subject: Problems: associating ipw3945 wpa_supplicant
In-Reply-To: <1037-SnapperMsgD65F34B6C200C99A@[192.168.178.38]>
References: <20070219172318.GA29875@gamma.logic.tuwien.ac.at>
	<20070220010140.GC5279@jm.kir.nu>
	<1037-SnapperMsgD65F34B6C200C99A@[192.168.178.38]>
Message-ID: <1171992153.6735.1.camel@localhost.localdomain>

On Tue, 2007-02-20 at 16:46 +0100, Norbert Preining wrote:
> Hi Jouni!
> 
> On Mon, 19 Feb 2007 17:01:40 -0800 "Jouni Malinen" <j at w1.fi> wrote:
> > > network={
> > > 	ssid="Hotel NoName"
> > > 	key_mgmt=NONE
> > > 	auth_alg=SHARED
> > > 	wep_key0="5570441089532"
> > 
> > Hmm.. Is this AP configured to require Shard Key authentication for WEP?
> > Have you been able to use WEP with Open System authentication with
> > other APs? I've done very limited testing with ipw3945 and have never
> > tested Shared Key authentication with it, so I do not know what kind of
> > behavior to expect from it.
> 
> Aemm ... sorry I don't understand completely: I have a AP which only requires knowing the WEP key, no other authentication whatsoever.

Ah, but all WEP _does_ require authentication:  either Shared Key or
Open System (which is actually NULL authentication).  You've got Shared
Key auth specified in the wpa_supplicant network block, try removing
auth_alg=SHARED and see what happens.

Dan

> Do you want to say that this configuration is wrong for this setup? If yes, what would be the right one?
> 
> > Have you tried associating with this AP using just iwconfig?
> 
> Yes, I set the AP and the key, and it didn't associate.
> 
> > That "unassociated" text does not look very associated to me.. My first
> > guess would be that the client is trying to associate, but fails in
> > Shared Key authentication before association.
> 
> Any suggestions what to change in the config file?
> 
> Thanks a lot and all the best
> 
> Norbert
> -------------------------------------------------------------------------------
> Dr. Norbert Preining <preining at logic.at>                    Universit? di Siena
> Debian Developer <preining at debian.org>                         Debian TeX Group
> gpg DSA: 0x09C5B094      fp: 14DF 2E6C 0307 BE6D AD76  A9C0 D2BF 4AA3 09C5 B094
> -------------------------------------------------------------------------------
> 
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap




From preining  Tue Feb 20 13:17:47 2007
From: preining (Norbert Preining)
Date: Tue, 20 Feb 2007 22:17:47 +0100
Subject: Problems: associating ipw3945 wpa_supplicant
In-Reply-To: <1171992153.6735.1.camel@localhost.localdomain>
References: <20070219172318.GA29875@gamma.logic.tuwien.ac.at>
	<20070220010140.GC5279@jm.kir.nu>
	<1037-SnapperMsgD65F34B6C200C99A@[192.168.178.38]>
	<1171992153.6735.1.camel@localhost.localdomain>
Message-ID: <20070220211747.GF16297@gamma.logic.tuwien.ac.at>

On Die, 20 Feb 2007, Dan Williams wrote:
> Ah, but all WEP _does_ require authentication:  either Shared Key or
> Open System (which is actually NULL authentication).  You've got Shared
> Key auth specified in the wpa_supplicant network block, try removing
> auth_alg=SHARED and see what happens.

Big big thanks! This did the trick, sorry for the noise.

But, what I don't udnerstand AT ALL is why it worked with all my other
AP, only with this one I found the configuration error ....

Best wishes

Norbert

-------------------------------------------------------------------------------
Dr. Norbert Preining <preining at logic.at>                    Universit? di Siena
Debian Developer <preining at debian.org>                         Debian TeX Group
gpg DSA: 0x09C5B094      fp: 14DF 2E6C 0307 BE6D AD76  A9C0 D2BF 4AA3 09C5 B094
-------------------------------------------------------------------------------
BRADFORD
A school teacher's old hairy jacket, now severely discoloured by chalk
dust, ink, egg and the precipitations of unedifying chemical
reactions.
			--- Douglas Adams, The Meaning of Liff



From henryzhang  Tue Feb 20 14:49:07 2007
From: henryzhang (hong zhang)
Date: Tue, 20 Feb 2007 14:49:07 -0800 (PST)
Subject: which ioctl in driver takes WPA-TKIP passphrase?
Message-ID: <20070220224907.75816.qmail@web813.biz.mail.mud.yahoo.com>

  List,
   
  I konw WEP key is passed through ieee80211_ioctl_setkey() in madwifi driver.
  Could anyone please tell me which ioctl function in madwifi driver takes
  wpa-tkip passphrase?
   
  I try to pass a wpa-tkip passphrase down to madwifi driver but I do not know which ioctl() should take it.
  Thanks.
   
  ----henry 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070220/944e10bb/attachment.htm 


From dcbw  Tue Feb 20 18:10:16 2007
From: dcbw (Dan Williams)
Date: Tue, 20 Feb 2007 21:10:16 -0500
Subject: which ioctl in driver takes WPA-TKIP passphrase?
In-Reply-To: <20070220224907.75816.qmail@web813.biz.mail.mud.yahoo.com>
References: <20070220224907.75816.qmail@web813.biz.mail.mud.yahoo.com>
Message-ID: <1172023816.8599.1.camel@localhost.localdomain>

On Tue, 2007-02-20 at 14:49 -0800, hong zhang wrote:
> List,
>  
> I konw WEP key is passed through ieee80211_ioctl_setkey() in madwifi
> driver.
> Could anyone please tell me which ioctl function in madwifi driver
> takes
> wpa-tkip passphrase?
>  
> I try to pass a wpa-tkip passphrase down to madwifi driver but I do
> not know which ioctl() should take it.

You don't push the passphrase to the driver, you hash the passphrase
with wpa_passphrase to get the key and you push the key down to the
driver using SIOCSIWENCODEEXT.  Drivers certainly shouldn't be accepting
passphrases unless they are smoking really, really unholy crack.

Dan





From dcbw  Tue Feb 20 18:11:33 2007
From: dcbw (Dan Williams)
Date: Tue, 20 Feb 2007 21:11:33 -0500
Subject: Problems: associating ipw3945 wpa_supplicant
In-Reply-To: <20070220211747.GF16297@gamma.logic.tuwien.ac.at>
References: <20070219172318.GA29875@gamma.logic.tuwien.ac.at>
	<20070220010140.GC5279@jm.kir.nu>
	<1037-SnapperMsgD65F34B6C200C99A@[192.168.178.38]>
	<1171992153.6735.1.camel@localhost.localdomain>
	<20070220211747.GF16297@gamma.logic.tuwien.ac.at>
Message-ID: <1172023893.8599.3.camel@localhost.localdomain>

On Tue, 2007-02-20 at 22:17 +0100, Norbert Preining wrote:
> On Die, 20 Feb 2007, Dan Williams wrote:
> > Ah, but all WEP _does_ require authentication:  either Shared Key or
> > Open System (which is actually NULL authentication).  You've got Shared
> > Key auth specified in the wpa_supplicant network block, try removing
> > auth_alg=SHARED and see what happens.
> 
> Big big thanks! This did the trick, sorry for the noise.
> 
> But, what I don't udnerstand AT ALL is why it worked with all my other
> AP, only with this one I found the configuration error ....

Some APs allow you to specify in their configuration to accept both
shared key and open system authentication.  Others allow you to specify
only one or the other.  So it most likely depends on how the AP itself
is configured.

Dan

> Best wishes
> 
> Norbert
> 
> -------------------------------------------------------------------------------
> Dr. Norbert Preining <preining at logic.at>                    Universit? di Siena
> Debian Developer <preining at debian.org>                         Debian TeX Group
> gpg DSA: 0x09C5B094      fp: 14DF 2E6C 0307 BE6D AD76  A9C0 D2BF 4AA3 09C5 B094
> -------------------------------------------------------------------------------
> BRADFORD
> A school teacher's old hairy jacket, now severely discoloured by chalk
> dust, ink, egg and the precipitations of unedifying chemical
> reactions.
> 			--- Douglas Adams, The Meaning of Liff




From henryzhang  Tue Feb 20 19:00:51 2007
From: henryzhang (hong zhang)
Date: Tue, 20 Feb 2007 19:00:51 -0800 (PST)
Subject: which ioctl in driver takes WPA-TKIP passphrase?
In-Reply-To: <1172023816.8599.1.camel@localhost.localdomain>
Message-ID: <20070221030054.77302.qmail@web810.biz.mail.mud.yahoo.com>

Don,
   
  Thanks.
  I have  package can translate wep passphrase to wep key.
  May I use it for wpa passphrase or I have to copy codes from wpa_passphrase and let wpa_passphrase to translate to wpa key?
   
  ----henry

Dan Williams <dcbw at redhat.com> wrote:
  On Tue, 2007-02-20 at 14:49 -0800, hong zhang wrote:
> List,
> 
> I konw WEP key is passed through ieee80211_ioctl_setkey() in madwifi
> driver.
> Could anyone please tell me which ioctl function in madwifi driver
> takes
> wpa-tkip passphrase?
> 
> I try to pass a wpa-tkip passphrase down to madwifi driver but I do
> not know which ioctl() should take it.

You don't push the passphrase to the driver, you hash the passphrase
with wpa_passphrase to get the key and you push the key down to the
driver using SIOCSIWENCODEEXT. Drivers certainly shouldn't be accepting
passphrases unless they are smoking really, really unholy crack.

Dan



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070220/e3a08975/attachment.htm 


From sj_qiu  Tue Feb 20 19:01:52 2007
From: sj_qiu (Sheng_Jun)
Date: Wed, 21 Feb 2007 11:01:52 +0800
Subject: Dear All,
Message-ID: <10702211101.AA01972@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From bryan  Tue Feb 20 19:06:30 2007
From: bryan (Bryan Kadzban)
Date: Tue, 20 Feb 2007 22:06:30 -0500
Subject: which ioctl in driver takes WPA-TKIP passphrase?
In-Reply-To: <1172023816.8599.1.camel@localhost.localdomain>
References: <20070220224907.75816.qmail@web813.biz.mail.mud.yahoo.com>
	<1172023816.8599.1.camel@localhost.localdomain>
Message-ID: <45DBB736.3050208@kadzban.is-a-geek.net>

Dan Williams wrote:
> You don't push the passphrase to the driver, you hash the passphrase 
> with wpa_passphrase to get the key and you push the key down to the 
> driver using SIOCSIWENCODEEXT.  Drivers certainly shouldn't be
> accepting passphrases unless they are smoking really, really unholy
> crack.

Is even the key accepted by the driver?  I thought the client needed to
generate a key from the passphrase, then do a 4-way handshake with the
AP using that key, to get a temporal key, and then finally program the
temporal key into the driver.  (Then it has to do a group handshake to
get the group key as well, although WPA2 does this during the second
half of the 4-way handshake.  Either way, the client needs to program
the group temporal key into the driver as well.)

And in any case, if you don't do the 4-way handshake after associating,
then the AP will either disconnect you, or not let you pass any traffic.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 252 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20070220/f53f3c86/attachment.pgp 


From k_henry  Tue Feb 20 21:14:15 2007
From: k_henry (kemas)
Date: Wed, 21 Feb 2007 12:14:15 +0700
Subject: WPA-PSK for Aironet
In-Reply-To: <10731f310702200516l4dcd2330w342e17798601c9d6@mail.gmail.com>
References: <60D839F897E571458DEEFEE669C5546C05D9EB@ZMY16EXM70.ds.mot.com>
	<1167758039.459a92d7efb52@imp1-g19.free.fr>
	<1167790853.29711.2.camel@ps01.intern.ramayana.co.id>
	<1167874657.3129.10.camel@localhost.localdomain>
	<10731f310701032147t307994aavf44fd32ee8173e0e@mail.gmail.com>
	<1167922636.3176.8.camel@wireless-63.media.mit.edu>
	<10731f310701042121n4869dabeg1fca3a3a767d4676@mail.gmail.com>
	<1171964385.23250.6.camel@localhost>
	<10731f310702200516l4dcd2330w342e17798601c9d6@mail.gmail.com>
Message-ID: <1172034855.28961.12.camel@localhost>


cisco said that aironet 340 or 350 can do EAP-TLS, but doesn't provide
the tools to do it.  
anyone tried aironet 340 or 350 with XP (or any other OS) to do EAP-TLS,
is it really work?

I tried but has no luck, because when the radius server send access-
challenge, the card seems to ignore it or maybe XP ignore it so
authentication failed.



thanks

On Tue, 2007-02-20 at 18:46 +0530, Basavaraj Arani wrote:
> Hi,
> 
> I couldn't do wpa_supplicant with aironet at all.
> 
> Basavaraj
> 
> On 2/20/07, kemas <k_henry at ramayana.co.id> wrote:
>         hi all,
>         
>         I'm still can't not do wpa with aironet, is there any new
>         wpa_supplicant
>         release for this issue?
>         
>         thanks
>         
>         
>         On Fri, 2007-01-05 at 10:51 +0530, Basavaraj Arani wrote:
>         > ----------------(on VirusWall Server )------------------- 
>         >
>         > email-body was scanned and no virus found
>         >
>         -----------------------------------------------------------------
>         > Hi Dan,
>         >
>         > Earlier I also tried IW_ENCODE_ALG_TKIP. But it dint work.
>         Then I 
>         > triend the ALG_WEP. But was no use.
>         >
>         > Regards,
>         > Basu
>         >
>         > On 1/4/07, Dan Williams <dcbw at redhat.com> wrote:
>         >         On Thu, 2007-01-04 at 11:17 +0530, Basavaraj Arani
>         wrote: 
>         >         > Hi Dan,
>         >         >
>         >         > I am using the Firmware 5.6.08. But whenever I set
>         the WPA
>         >         key, the
>         >         > card somehow doesn't get associated with the
>         Access Point. 
>         >         > I am using the DLink-DWL-7100AP access point.
>         >
>         >         Well, note that the driver modifications Matthieu
>         made aren't
>         >         fully
>         >         debugged and aren't integrated upstream into the
>         kernel, so 
>         >         there are no
>         >         guarantees that everything works in the driver
>         yet.  I'm
>         >         working on
>         >         cleaning it up and integrating the WPA code into the
>         existing
>         >         Airo 
>         >         driver, but it's a slow process since we want the
>         same driver
>         >         to be used
>         >         for all modes.
>         >
>         >         > Here is the code for setting the WPA on/off
>         >         > ........ 
>         >         >     if(!strcasecmp(args[0], "on"))
>         >         >     {
>         >         >         //wrq.u.param.flags = IW_AUTH_WPA_ENABLED
>         &
>         >         IW_AUTH_INDEX;
>         >         >         wrq.u.param.flags =
>         IW_AUTH_DROP_UNENCRYPTED &
>         >         IW_AUTH_INDEX;
>         >         >         wrq.u.param.value = 1;
>         >         >
>         >         >         if(iw_set_ext(skfd, ifname, SIOCSIWAUTH,
>         &wrq) < 0)
>         >         >                 return(IWERR_SET_EXT);
>         >         >
>         >         >     }
>         >         >     else if(!strcasecmp(args[0], "off"))
>         >         >     {
>         >         >         wrq.u.param.flags = IW_AUTH_WPA_ENABLED &
>         >         IW_AUTH_INDEX;
>         >         >         wrq.u.param.value = 0;
>         >         >
>         >         >         if(iw_set_ext(skfd, ifname, SIOCSIWAUTH,
>         &wrq) < 0)
>         >         >                 return(IWERR_SET_EXT);
>         >         >     }
>         >         > ........
>         >         >
>         >         > and for setting the WPA keys, I have the following
>         code.
>         >         >
>         >         > static int 
>         >         > set_wpakey_info(int             skfd,
>         >         >              char *             ifname,
>         >         >              char *             args[],
>         >         >              int                count)
>         >         > {
>         >         >     struct iwreq wrq;
>         >         >     struct iw_encode_ext *iwee;
>         >         >     unsigned char key[IW_ENCODING_TOKEN_MAX]; 
>         >         >     int keylen = strlen(args[0]);
>         >         >
>         >         >     memset(&wrq, 0x00, sizeof(wrq));
>         >         >
>         >         >     memcpy(key, args[0], keylen);
>         >         >     iwee = (struct iw_encode_ext *)malloc(sizeof
>         (struct
>         >         iw_encode_ext)
>         >         > + IW_ENCODING_TOKEN_MAX);
>         >         >
>         >         >     iwee->alg = IW_ENCODE_ALG_WEP;
>         >
>         >         You appear to be telling the driver to use a WEP
>         key, not a 
>         >         WPA key.
>         >         You probably want IW_ENCODE_ALG_TKIP here.
>         >
>         >         Dan
>         >
>         >         >     iwee->key_len = keylen;
>         >         >     iwee->ext_flags = 1; 
>         >         >     memcpy(iwee->key, key, keylen);
>         >         >
>         >         >     wrq.u.encoding.pointer = (caddr_t)iwee;
>         >         >     wrq.u.encoding.flags =  1;
>         >         >     wrq.u.encoding.length = sizeof(struct
>         iw_encode_ext) +
>         >         keylen;
>         >         >     if(iw_set_ext(skfd, ifname,SIOCSIWENCODEEXT,
>         &wrq) < 0)
>         >         >     {
>         >         >        return(IWERR_SET_EXT);
>         >         >     }
>         >         >     return(1);
>         >         > }
>         >         > 
>         >         > I tried to set a key of length 32.
>         >         > The key I set at both the ends (AP/ client
>         adapater) is
>         >         > abcdefghijklmnopqrstuvwxyzabcdef.
>         >         >
>         >         > But the card doesn't get associated with the AP. 
>         >         >
>         >         > Please help me in resolving this problem.
>         >         >
>         >         > Many thanks in advance.
>         >         >
>         >         > Regards,
>         >         > Basu 
>         >         >
>         >         >
>         >         > On 1/4/07, Dan Williams <dcbw at redhat.com> wrote:
>         >         >         On Wed, 2007-01-03 at 09:20 +0700, kemas
>         henry
>         >         wrote:
>         >         >         > On Tue, 2007-01-02 at 18:13 +0100,
>         >         castet.matthieu at free.fr
>         >         >         wrote:
>         >         >         > > Selon R Arani Basavaraj-a24052
>         >         <basavaraj at motorola.com>:
>         >         >         > >
>         >         >         > > >
>         >         >         > > > Hi, 
>         >         >         > > Hi,
>         >         >         > >
>         >         >         > > >
>         >         >         > > > Is the current Linux driver for
>         aironet pc4500
>         >         driver
>         >         >         supports WPA-PSK?
>         >         >         > > > I downloaded the airo driver which
>         claims to
>         >         support
>         >         >         WPA-PSK from
>         >         >         > > > http://castet.matthieu.free.fr/airo,
>         but it
>         >         doesn't
>         >         >         seems to be working well
>         >         >         > > > for me.
>         >         >         > > AFAIK, only 340 and 350 series with a
>         recent
>         >         firmware
>         >         >         support wpa. The older
>         >         >         > > cards don't.
>         >         >         >
>         >         >         > did you mean cisco 340 and 350 pcmcia ?
>         >         >
>         >         >         Correct, only the 340 and 350 versions, in
>         both
>         >         MiniPCI and
>         >         >         PCMCIA.
>         >         >         You'll need firmware version 5.30.17 or
>         later to do
>         >         WPA.
>         >         >
>         >         >         > what kind of WPA that this card
>         support ?
>         >         >
>         >         >         TKIP encryption only, with either WPA or
>         WPA2.  The
>         >         hardware
>         >         >         just cannot
>         >         >         do AES/CCMP.
>         >         >
>         >         >         Dan
>         >         >
>         >         >
>         >         >
>         >         >
>         _______________________________________________
>         >         >         HostAP mailing list
>         >         >         HostAP at shmoo.com
>         >         >
>         http://lists.shmoo.com/mailman/listinfo/hostap
>         >         >
>         >
>         >
>         > _______________________________________________
>         > HostAP mailing list 
>         > HostAP at shmoo.com
>         > http://lists.shmoo.com/mailman/listinfo/hostap
>         
> 




From nix.bh.tan  Wed Feb 21 00:01:49 2007
From: nix.bh.tan (nix.bh.tan at sg.pwc.com)
Date: Wed, 21 Feb 2007 16:01:49 +0800
Subject: Nix Tan is Out Of Office..
Message-ID: <OF17C6B91F.55C0386A-ON48257289.002C1CCB-48257289.002C1CCC@pwc.com>

I will be out of the office starting  21/02/2007 and will not return until
22/02/2007.

For issues on Notes, please contact either Mary Heng or Daniel Kwok @ 4137
and 4147 respectively.

For other network related issues, please contact either Tiong Hwee Tan or
Mary Heng @ 4135 and 4137 respectively.
_________________________________________________________________
The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential and/or privileged
material.  Any review, retransmission, dissemination or other use of, or
taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.   If you received
this in error, please contact the sender and delete the material from any
computer.




From dcbw  Wed Feb 21 02:56:19 2007
From: dcbw (Dan Williams)
Date: Wed, 21 Feb 2007 05:56:19 -0500
Subject: which ioctl in driver takes WPA-TKIP passphrase?
In-Reply-To: <45DBB736.3050208@kadzban.is-a-geek.net>
References: <20070220224907.75816.qmail@web813.biz.mail.mud.yahoo.com>
	<1172023816.8599.1.camel@localhost.localdomain>
	<45DBB736.3050208@kadzban.is-a-geek.net>
Message-ID: <1172055379.2844.11.camel@localhost.localdomain>

On Tue, 2007-02-20 at 22:06 -0500, Bryan Kadzban wrote:
> Dan Williams wrote:
> > You don't push the passphrase to the driver, you hash the passphrase 
> > with wpa_passphrase to get the key and you push the key down to the 
> > driver using SIOCSIWENCODEEXT.  Drivers certainly shouldn't be
> > accepting passphrases unless they are smoking really, really unholy
> > crack.
> 
> Is even the key accepted by the driver?  I thought the client needed to
> generate a key from the passphrase, then do a 4-way handshake with the
> AP using that key, to get a temporal key, and then finally program the
> temporal key into the driver.  (Then it has to do a group handshake to
> get the group key as well, although WPA2 does this during the second
> half of the 4-way handshake.  Either way, the client needs to program
> the group temporal key into the driver as well.)
> 
> And in any case, if you don't do the 4-way handshake after associating,
> then the AP will either disconnect you, or not let you pass any traffic.

Right; drivers have ioctls that let wpa_supplicant (or any other
supplicant) send the key to the driver after it's completed the 4 way
handshake, otherwise the driver wouldn't know how to decrypt the packets
after the handshake had taken place.

Dan





From henryzhang  Wed Feb 21 11:24:32 2007
From: henryzhang (hong zhang)
Date: Wed, 21 Feb 2007 11:24:32 -0800 (PST)
Subject: which ioctl in driver takes WPA-TKIP passphrase?
In-Reply-To: <1172055379.2844.11.camel@localhost.localdomain>
Message-ID: <20070221192435.68934.qmail@web810.biz.mail.mud.yahoo.com>

Dan, Bryan,
   
  Beside key, should I also enable countermeasurement inside driver?
   
  ---henry


Dan Williams <dcbw at redhat.com> wrote:
  On Tue, 2007-02-20 at 22:06 -0500, Bryan Kadzban wrote:
> Dan Williams wrote:
> > You don't push the passphrase to the driver, you hash the passphrase 
> > with wpa_passphrase to get the key and you push the key down to the 
> > driver using SIOCSIWENCODEEXT. Drivers certainly shouldn't be
> > accepting passphrases unless they are smoking really, really unholy
> > crack.
> 
> Is even the key accepted by the driver? I thought the client needed to
> generate a key from the passphrase, then do a 4-way handshake with the
> AP using that key, to get a temporal key, and then finally program the
> temporal key into the driver. (Then it has to do a group handshake to
> get the group key as well, although WPA2 does this during the second
> half of the 4-way handshake. Either way, the client needs to program
> the group temporal key into the driver as well.)
> 
> And in any case, if you don't do the 4-way handshake after associating,
> then the AP will either disconnect you, or not let you pass any traffic.

Right; drivers have ioctls that let wpa_supplicant (or any other
supplicant) send the key to the driver after it's completed the 4 way
handshake, otherwise the driver wouldn't know how to decrypt the packets
after the handshake had taken place.

Dan



-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070221/63f0b33a/attachment.htm 


From ganglu28  Wed Feb 21 19:55:21 2007
From: ganglu28 (Gang Lu)
Date: Wed, 21 Feb 2007 19:55:21 -0800 (PST)
Subject: commercial use of hostapd ?
Message-ID: <617736.66683.qm@web43139.mail.sp1.yahoo.com>

Hi,

Does anybody know if hostapd is used by any commercial
product at all other than it is an excellent oper
source project and if hostapd receives patch updates
based on the commercial use? 

Thanks

Gang



From j  Fri Feb 23 17:40:19 2007
From: j (Jouni Malinen)
Date: Fri, 23 Feb 2007 17:40:19 -0800
Subject: commercial use of hostapd ?
In-Reply-To: <617736.66683.qm@web43139.mail.sp1.yahoo.com>
References: <617736.66683.qm@web43139.mail.sp1.yahoo.com>
Message-ID: <20070224014019.GA5061@jm.kir.nu>

On Wed, Feb 21, 2007 at 07:55:21PM -0800, Gang Lu wrote:

> Does anybody know if hostapd is used by any commercial
> product at all other than it is an excellent oper
> source project and if hostapd receives patch updates
> based on the commercial use? 

Yes, it is used in number of commercial products, and yes, patches have
been received based on commercial use.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Fri Feb 23 17:52:05 2007
From: j (Jouni Malinen)
Date: Fri, 23 Feb 2007 17:52:05 -0800
Subject: WPA-PSK for Aironet
In-Reply-To: <1172034855.28961.12.camel@localhost>
References: <60D839F897E571458DEEFEE669C5546C05D9EB@ZMY16EXM70.ds.mot.com>
	<1167758039.459a92d7efb52@imp1-g19.free.fr>
	<1167790853.29711.2.camel@ps01.intern.ramayana.co.id>
	<1167874657.3129.10.camel@localhost.localdomain>
	<10731f310701032147t307994aavf44fd32ee8173e0e@mail.gmail.com>
	<1167922636.3176.8.camel@wireless-63.media.mit.edu>
	<10731f310701042121n4869dabeg1fca3a3a767d4676@mail.gmail.com>
	<1171964385.23250.6.camel@localhost>
	<10731f310702200516l4dcd2330w342e17798601c9d6@mail.gmail.com>
	<1172034855.28961.12.camel@localhost>
Message-ID: <20070224015205.GC5061@jm.kir.nu>

On Wed, Feb 21, 2007 at 12:14:15PM +0700, kemas wrote:

> cisco said that aironet 340 or 350 can do EAP-TLS, but doesn't provide
> the tools to do it.  
> anyone tried aironet 340 or 350 with XP (or any other OS) to do EAP-TLS,
> is it really work?

Sure it works. EAP methods are really transparent to the driver/firmware
and if any of them works, so would EAP-TLS. I don't know what this has
to do with this mailing list (or even the subject line with is talking
about PSK, not EAP), but yes, I've seen Aironet 340 and 350 cards work
on WinXP using EAP-TLS.

-- 
Jouni Malinen                                            PGP id EFC895FA



From sj_qiu  Fri Feb 23 17:52:44 2007
From: sj_qiu (Sheng_Jun)
Date: Sat, 24 Feb 2007 09:52:44 +0800
Subject: Dear All,
Message-ID: <10702240952.AA01948@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From kel  Sat Feb 24 07:18:08 2007
From: kel (Kel Modderman)
Date: Sun, 25 Feb 2007 01:18:08 +1000
Subject: seg fault when interface does not exist
In-Reply-To: <20061219032557.GB6633@jm.kir.nu>
References: <200612180715.42193.kelmo@kanotixguide.org>
	<200612181613.33888.kelmo@kanotixguide.org>
	<20061219032557.GB6633@jm.kir.nu>
Message-ID: <200702250118.09070.kel@otaku42.de>

Hi Jouni,

On Tuesday 19 December 2006 13:25, Jouni Malinen wrote:
> On Mon, Dec 18, 2006 at 04:13:33PM +1000, Kel Modderman wrote:
> > Debian 0.5.6-1 binary. No modification to your tarball apart from a patch
> > that points to specific doc's. The following config is used (madwifi
> > headers are activated via another patch):
>
> OK, I was able to reproduce this with 0.5.6 using the included .config.
> This was fixed couple of weeks ago and I merged the fix into 0.5.x
> branch a week ago, so I believe the issue is resolved.

This issue looks like it is still there with snapshot of 0.6, 2007-02-11.

# /sbin/wpa_supplicant -i eth5 -D wext -c /etc/wpa_supplicant/wpa_supplicant-dummy.conf
ioctl[SIOCGIFFLAGS]: No such device
Could not get interface 'eth5' flags
ioctl[SIOCSIWPMKSA]: No such device
ioctl[SIOCSIWMODE]: No such device
Could not configure driver to use managed mode
ioctl[SIOCGIWRANGE]: No such device
ioctl[SIOCGIFINDEX]: No such device
ioctl[SIOCSIWENCODEEXT]: No such device
ioctl[SIOCSIWENCODE]: No such device
ioctl[SIOCSIWENCODEEXT]: No such device
ioctl[SIOCSIWENCODE]: No such device
ioctl[SIOCSIWENCODEEXT]: No such device
ioctl[SIOCSIWENCODE]: No such device
ioctl[SIOCSIWENCODEEXT]: No such device
ioctl[SIOCSIWENCODE]: No such device
ioctl[SIOCSIWAUTH]: No such device
WEXT auth param 7 value 0x0 - Failed to disable WPA in the driver.
ioctl[SIOCSIWAUTH]: No such device
WEXT auth param 5 value 0x0 - ioctl[SIOCSIWAUTH]: No such device
WEXT auth param 4 value 0x0 - Segmentation fault

# wpa_supplicant -v
wpa_supplicant v0.6.0

Thanks, Kel.



From j  Sat Feb 24 08:10:43 2007
From: j (Jouni Malinen)
Date: Sat, 24 Feb 2007 08:10:43 -0800
Subject: seg fault when interface does not exist
In-Reply-To: <200702250118.09070.kel@otaku42.de>
References: <200612180715.42193.kelmo@kanotixguide.org>
	<200612181613.33888.kelmo@kanotixguide.org>
	<20061219032557.GB6633@jm.kir.nu>
	<200702250118.09070.kel@otaku42.de>
Message-ID: <20070224160925.GB5060@jm.kir.nu>

On Sun, Feb 25, 2007 at 01:18:08AM +1000, Kel Modderman wrote:

> On Tuesday 19 December 2006 13:25, Jouni Malinen wrote:
> > OK, I was able to reproduce this with 0.5.6 using the included .config.
> > This was fixed couple of weeks ago and I merged the fix into 0.5.x
> > branch a week ago, so I believe the issue is resolved.
> 
> This issue looks like it is still there with snapshot of 0.6, 2007-02-11.

> WEXT auth param 4 value 0x0 - Segmentation fault

I don't think this is the same issue, but anyway, dbus deinit was
triggering segfault. This is now fixed in 0.6 and 0.5 branches.

-- 
Jouni Malinen                                            PGP id EFC895FA



From kel  Sat Feb 24 14:25:29 2007
From: kel (Kel Modderman)
Date: Sun, 25 Feb 2007 08:25:29 +1000
Subject: seg fault when interface does not exist
In-Reply-To: <20070224160925.GB5060@jm.kir.nu>
References: <200612180715.42193.kelmo@kanotixguide.org>
	<200702250118.09070.kel@otaku42.de>
	<20070224160925.GB5060@jm.kir.nu>
Message-ID: <200702250825.29339.kel@otaku42.de>

On Sunday 25 February 2007 02:10, Jouni Malinen wrote:
> On Sun, Feb 25, 2007 at 01:18:08AM +1000, Kel Modderman wrote:
> > On Tuesday 19 December 2006 13:25, Jouni Malinen wrote:
> > > OK, I was able to reproduce this with 0.5.6 using the included .config.
> > > This was fixed couple of weeks ago and I merged the fix into 0.5.x
> > > branch a week ago, so I believe the issue is resolved.
> >
> > This issue looks like it is still there with snapshot of 0.6, 2007-02-11.
> >
> > WEXT auth param 4 value 0x0 - Segmentation fault
>
> I don't think this is the same issue, but anyway, dbus deinit was
> triggering segfault. This is now fixed in 0.6 and 0.5 branches.

Yep, fixed now.

Thanks, Kel.



From Nazeer.Khan  Sat Feb 24 15:11:03 2007
From: Nazeer.Khan (Nazeer Khan)
Date: Sun, 25 Feb 2007 10:11:03 +1100 (EST)
Subject: ioctl[unknown???]: No such file or directory
Message-ID: <33886.203.143.168.209.1172358663.squirrel@mailbag.nicta.com.au>


Hi,

I am using hostapd-0.4.9 to configure EAP-TLS with madwifi. I am getting
the following error.

ioctl[unknown???]: No such file or directory

I get this for

madwifi_set_key (priv=0x8081c30, alg=0x8081b40 "TKIP", addr=0x0,
key_idx=1, key=0x8082020
"???}?\201h$W\224:Z2P?\214Zh???xZ?R?\030?\225Z?\211", key_len=32)

I have checked if addr = NULL => It is changed to ff:ff:ff:ff:ff:ff in
this function. So the error is not due to the address. Any idea why am i
getting this error.

I get this when the GMK and GTK is generated in "wpa_init()" (called in
hostapd_setup_interface) and key is needed to be set.

Why am i getting this error?

Thank you.

Nazeer


--------------------------------------------------------------------------
This email and any attachments may be confidential. They may contain legally
privileged information or copyright material. You should not read, copy,
use or disclose them without authorisation. If you are not an intended
recipient, please contact us at once by return email and then delete both
messages. We do not accept liability in connection with computer virus,
data corruption, delay, interruption, unauthorised access or unauthorised
amendment. This notice should not be removed.



From j  Sat Feb 24 15:32:50 2007
From: j (Jouni Malinen)
Date: Sat, 24 Feb 2007 15:32:50 -0800
Subject: ioctl[unknown???]: No such file or directory
In-Reply-To: <33886.203.143.168.209.1172358663.squirrel@mailbag.nicta.com.au>
References: <33886.203.143.168.209.1172358663.squirrel@mailbag.nicta.com.au>
Message-ID: <20070224233250.GA5041@jm.kir.nu>

On Sun, Feb 25, 2007 at 10:11:03AM +1100, Nazeer Khan wrote:

> I am using hostapd-0.4.9 to configure EAP-TLS with madwifi. I am getting
> the following error.
> 
> ioctl[unknown???]: No such file or directory

Which version of madwifi and Linux kernel are you using? Could you
please re-test this with the latest hostapd release (either 0.4.10 or
0.5.7) since there have been some fixes to the driver_madwifi.c after
0.4.9, if I remember correctly.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Sat Feb 24 18:31:42 2007
From: j (Jouni Malinen)
Date: Sat, 24 Feb 2007 18:31:42 -0800
Subject: Git repository for hostapd/wpa_supplicant
Message-ID: <20070225023142.GA6004@jm.kir.nu>

I imported the full CVS repository of the Host AP project into a Git
repository and made this available at w1.fi:

Using git protocol:
git://w1.fi/srv/git/hostap.git

Using HTTP (if git protocol is firewalled):
http://w1.fi/hostap.git


(e.g., to get a clone of the repository you can use cogito with
"cg-clone git://w1.fi/srv/git/hostap.git" or directly with git:
"git-clone git://w1.fi/srv/git/hostap.git")


WWW interface (gitweb) to the repository:
http://w1.fi/gitweb/gitweb.cgi


For the time being, this repository is somewhat experimental. In other
words, if anything is found to be wrong with it, I may end up
re-importing it from CVS and that will mean that clones of the
repository would likely need to be re-cloned from scratch.

The goal here is to be able to do future 0.6.x releases from the Git
repository. Older branches may end up being built from CVS repository
which will continue to be available for some time. It's also possible,
that I end up moving only Git for all branches, but this is still
somewhat open. I may also end up keeping both the git and cvs
repositories in sync for some time by committing the same changes to
both, but at some point in the future, only git repository will be used.

-- 
Jouni Malinen                                            PGP id EFC895FA



From proski  Sat Feb 24 19:57:59 2007
From: proski (Pavel Roskin)
Date: Sat, 24 Feb 2007 22:57:59 -0500
Subject: Git repository for hostapd/wpa_supplicant
In-Reply-To: <20070225023142.GA6004@jm.kir.nu>
References: <20070225023142.GA6004@jm.kir.nu>
Message-ID: <20070224225759.kkcw8sgcs0w0owgo@webmail.spamcop.net>

Quoting Jouni Malinen <j at w1.fi>:

> I imported the full CVS repository of the Host AP project into a Git
> repository and made this available at w1.fi:
>
> Using git protocol:
> git://w1.fi/srv/git/hostap.git

Thanks!  It was one of the last CVS repositories I was tracking.  I won't need
to use tools like cvs2cl just to find out what the recent changes were.  tig
and qgit do it much better.

> Using HTTP (if git protocol is firewalled):
> http://w1.fi/hostap.git

The funny thing is that it crashes git:

$ git clone http://w1.fi/hostap.git
Initialized empty Git repository in /home/proski/tmp/hostap/.git/
got d3c506b2ab0c8b0f0b649866c44c2af9afa5fdeb
walk d3c506b2ab0c8b0f0b649866c44c2af9afa5fdeb
got abb1e4981d831aab57b5172cb2bd8ed1014e1544
Getting alternates list for http://w1.fi/hostap.git/
got ddfb47766d8b188c2149aed43afc17181677fdea
got 5ad3352189c6fdc1aa771592ec2765335fc255fe
/home/proski/bin/git-clone: line 33: 14151 Segmentation fault      (core dumped)
git-http-fetch -v -a -w "$tname" "$name" "$1/"

Retrying the fetch manually gives:

$ git-http-fetch -v -a d3c506b2ab0c8b0f0b649866c44c2af9afa5fdeb
http://w1.fi/host
walk d3c506b2ab0c8b0f0b649866c44c2af9afa5fdeb
Resuming fetch of object 5ad3352189c6fdc1aa771592ec2765335fc255fe at byte 4060
walk ddfb47766d8b188c2149aed43afc17181677fdea
Getting alternates list for http://w1.fi/host
Getting pack list for http://w1.fi/host
error: Unable to find 60549be514af76c5db0c17ce6bbe01b2f81e2d9e under
http://w1.fi/host
Cannot obtain needed blob 60549be514af76c5db0c17ce6bbe01b2f81e2d9e
while processing commit ddfb47766d8b188c2149aed43afc17181677fdea.
Waiting for http://w1.fi/hostobjects/33/91c363949560fb26de79232fe44bb43b66c3a3
Waiting for http://w1.fi/hostobjects/92/490442d960562168c1a373838b0e0c51903b03

The object starting with 60549 is indeed missing.  The crash is in the curl
library, which has been a problem before.  I don't want hostap to be the
testbed, so please go ahead and fix it.

You could try running git-gc, which does many maintenance operations on the
repository.  Please let me know if you need help fixing this problem.

> WWW interface (gitweb) to the repository:
> http://w1.fi/gitweb/gitweb.cgi

That's fine.

> For the time being, this repository is somewhat experimental. In other
> words, if anything is found to be wrong with it, I may end up
> re-importing it from CVS and that will mean that clones of the
> repository would likely need to be re-cloned from scratch.

If you have problems with git, the git community will be ready to help you. 
Some people would hate to hear about anyone abandoning git for whatever reason.

--
Regards,
Pavel Roskin



From j  Sat Feb 24 21:35:37 2007
From: j (Jouni Malinen)
Date: Sat, 24 Feb 2007 21:35:37 -0800
Subject: Git repository for hostapd/wpa_supplicant
In-Reply-To: <20070224225759.kkcw8sgcs0w0owgo@webmail.spamcop.net>
References: <20070225023142.GA6004@jm.kir.nu>
	<20070224225759.kkcw8sgcs0w0owgo@webmail.spamcop.net>
Message-ID: <20070225053536.GB6004@jm.kir.nu>

On Sat, Feb 24, 2007 at 10:57:59PM -0500, Pavel Roskin wrote:

> > Using HTTP (if git protocol is firewalled):
> > http://w1.fi/hostap.git
> 
> The funny thing is that it crashes git:

> $ git clone http://w1.fi/hostap.git
> Initialized empty Git repository in /home/proski/tmp/hostap/.git/
> got d3c506b2ab0c8b0f0b649866c44c2af9afa5fdeb
> walk d3c506b2ab0c8b0f0b649866c44c2af9afa5fdeb
> got abb1e4981d831aab57b5172cb2bd8ed1014e1544
> Getting alternates list for http://w1.fi/hostap.git/
> got ddfb47766d8b188c2149aed43afc17181677fdea
> got 5ad3352189c6fdc1aa771592ec2765335fc255fe
> /home/proski/bin/git-clone: line 33: 14151 Segmentation fault      (core dumped)
> git-http-fetch -v -a -w "$tname" "$name" "$1/"

Interesting.. Which version of git are you using? I used quite recent
version (as in 1.5.0) to import the repository and also for pushing it
to the server. I cannot reproduce this segfault.

> The object starting with 60549 is indeed missing.  The crash is in the curl
> library, which has been a problem before.  I don't want hostap to be the
> testbed, so please go ahead and fix it.

Hmm.. Can you clone the repository from git://w1.fi/srv/git/hostap.git
without this issue? I don't see any problems in my tests and I don't
really know what to fix or how even if there were something wrong here.
Unless this is more widespread issue, I have no problems with keeping
this as a testbed if someone is interested in fixing git not to crash
here.. Anyway, I made a copy of the current version to
http://w1.fi/hostap-test.git so that the version that triggered segfault
remain available.

> You could try running git-gc, which does many maintenance operations on the
> repository.  Please let me know if you need help fixing this problem.

git-fsck did not complain about anything and neither did git-gc. Anyway,
git-gc was now run, so you could re-try cloning this over HTTP to verify
whether that had any affect to the crash.

-- 
Jouni Malinen                                            PGP id EFC895FA



From Nazeer.Khan  Sat Feb 24 21:37:48 2007
From: Nazeer.Khan (Nazeer Khan)
Date: Sun, 25 Feb 2007 16:37:48 +1100 (EST)
Subject: FW: ioctl[unknown???]: No such file or directory
In-Reply-To: <20070224233250.GA5041@jm.kir.nu>
References: <33886.203.143.168.209.1172358663.squirrel@mailbag.nicta.com.au>
	<20070224233250.GA5041@jm.kir.nu>
Message-ID: <61956.58.165.190.177.1172381868.squirrel@mailbag.nicta.com.au>


Hi,

Following is the information about the linux.

Linux nazeer-laptop 2.6.17-11-generic #2 SMP Thu Feb 1 19:52:28 UTC 2007
i686 GNU/Linux

I am using madwifi-ng-r1968.

I will try the latest version of hostapd and then hit back with results.

Thank you

Nazeer

> On Sun, Feb 25, 2007 at 10:11:03AM +1100, Nazeer Khan wrote:
>
>> I am using hostapd-0.4.9 to configure EAP-TLS with madwifi. I am getting
>> the following error.
>>
>> ioctl[unknown???]: No such file or directory
>
> Which version of madwifi and Linux kernel are you using? Could you
> please re-test this with the latest hostapd release (either 0.4.10 or
> 0.5.7) since there have been some fixes to the driver_madwifi.c after
> 0.4.9, if I remember correctly.
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>





--------------------------------------------------------------------------
This email and any attachments may be confidential. They may contain legally
privileged information or copyright material. You should not read, copy,
use or disclose them without authorisation. If you are not an intended
recipient, please contact us at once by return email and then delete both
messages. We do not accept liability in connection with computer virus,
data corruption, delay, interruption, unauthorised access or unauthorised
amendment. This notice should not be removed.



From Nazeer.Khan  Sun Feb 25 00:55:03 2007
From: Nazeer.Khan (Nazeer Khan)
Date: Sun, 25 Feb 2007 19:55:03 +1100 (EST)
Subject: FW: ioctl[unknown???]: No such file or directory
In-Reply-To: <20070224233250.GA5041@jm.kir.nu>
References: <33886.203.143.168.209.1172358663.squirrel@mailbag.nicta.com.au>
	<20070224233250.GA5041@jm.kir.nu>
Message-ID: <60107.58.165.190.177.1172393703.squirrel@mailbag.nicta.com.au>


Hi,

Just want to give a little more information abt what i am doing. Actually
i am running hostapd on two machines. On one i am generating the keys and
sending the key and mac addr to another machine. Then i give this key to
function,

"hostapd_set_encryption(struct hostapd_data *hapd, const char *alg, u8
*addr, int idx, u8 *key, size_t key_len)"

I am sending all the parameters from remote computer except "hapd" which
is already there. But i get the error from

static int
set80211priv(struct madwifi_driver_data *drv, int op, void *data, int len)

Which is called by "madwifi_set_key".

I can't understand, when is generated on the same machine i don't get the
error, but when i send it remotely i get an error.

Following are the debug messages:

---------------

root at nazeer-laptop:/usr/src/hostapd-0.4.9# ./hostapd EAP_TLS.conf -dd
This is not fair: Configuration file: EAP_TLS.conf
Configure bridge br0 for EAPOL traffic.
madwifi_set_iface_flags: dev_up=0
Using interface ath0 with hwaddr 00:11:95:f2:86:2d and ssid
'NK_WPA_EAP_Enabled'
ath0: RADIUS Authentication server 127.0.0.1:1812
madwifi_set_ieee8021x: enabled=1
madwifi_configure_wpa: group key cipher=1
madwifi_configure_wpa: pairwise key ciphers=0xa
madwifi_configure_wpa: key management algorithms=0x1
madwifi_configure_wpa: rsn capabilities=0x0
madwifi_configure_wpa: enable WPA= 0x1
madwifi_set_iface_flags: dev_up=1
madwifi_set_privacy: enabled=1
WPA: group state machine entering state GTK_INIT
GMK - hexdump(len=32): 23 9d 13 a9 a6 15 73 13 14 73 8b 35 0a b0 f2 3a fd
7c 38 c9 eb 9f 75 47 35 4f 29 2d bf 7d 17 14
GTK - hexdump(len=32): f3 4b 12 01 a4 ed d0 c1 c5 5e d8 53 65 b7 24 1c c9
6d 83 ea 10 7e 7c 58 14 9a a5 b0 4f 91 85 d0
WPA: group state machine entering state SETKEYSDONE
madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=1
Flushing old station entries
madwifi_sta_deauth: addr=ff:ff:ff:ff:ff:ff reason_code=3
Deauthenticate all stations

Initializing UDP Server on Port 4955

l2_packet_receive - recvfrom: Network is down

Number of bytes Received = 58
Function Code = 5
madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=1
ioctl[unknown???]: No such file or directory

ath0: WPA rekeying GTK
WPA: group state machine entering state SETKEYS
GMK - hexdump(len=32): 23 9d 13 a9 a6 15 73 13 14 73 8b 35 0a b0 f2 3a fd
7c 38 c9 eb 9f 75 47 35 4f 29 2d bf 7d 17 14
GTK - hexdump(len=32): 56 af f9 9d 72 8d 0b 16 40 92 5a 06 ce 70 ec bf e6
c0 e3 9e e4 f2 85 fb 0d 3d e2 3b 1e 68 79 3c
WPA: group state machine entering state SETKEYSDONE
madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=2

-------------------------------------------


It can be seen tht when i try to set key remotely i get the error, but
when generated on the same PC, its working fine.

Any idea why i am getting this error ???

I am using hostapd-0.4.9, with Linux 2.6.17-11 and madwifi-ng-r1968.

I tried hostapd-0.5.7 but am getting the same error as shown below.

-------------------
Number of bytes Received = 58
Function Code = 5
madwifi_set_key: alg=TKIP addr=00:00:00:00:00:00 key_idx=1
ioctl[IEEE80211_IOCTL_SETKEY]: No such file or directory
madwifi_set_key: Failed to set key (addr 00:00:00:00:00:00 key_idx 1 alg
'TKIP' key_len 32 txkey 0)
--------------------------


Can anyone help why can't i set the keys remotely. Why am i getting this
error when doing remotely??

Thank You

Nazeer



> On Sun, Feb 25, 2007 at 10:11:03AM +1100, Nazeer Khan wrote:
>
>> I am using hostapd-0.4.9 to configure EAP-TLS with madwifi. I am getting
>> the following error.
>>
>> ioctl[unknown???]: No such file or directory
>
> Which version of madwifi and Linux kernel are you using? Could you
> please re-test this with the latest hostapd release (either 0.4.10 or
> 0.5.7) since there have been some fixes to the driver_madwifi.c after
> 0.4.9, if I remember correctly.
>
> --
> Jouni Malinen                                            PGP id EFC895FA
> _______________________________________________
> HostAP mailing list
> HostAP at shmoo.com
> http://lists.shmoo.com/mailman/listinfo/hostap
>



--------------------------------------------------------------------------
This email and any attachments may be confidential. They may contain legally
privileged information or copyright material. You should not read, copy,
use or disclose them without authorisation. If you are not an intended
recipient, please contact us at once by return email and then delete both
messages. We do not accept liability in connection with computer virus,
data corruption, delay, interruption, unauthorised access or unauthorised
amendment. This notice should not be removed.



From sj_qiu  Sun Feb 25 00:56:13 2007
From: sj_qiu (Sheng_Jun)
Date: Sun, 25 Feb 2007 16:56:13 +0800
Subject: Dear All,
Message-ID: <10702251656.AA01516@compex.com.sg>

Dear All,

I will be on leave from 12/Feb to 26/Feb.
If you have any technical problem, please contact our technical support: 

support at compex.com.sg


Have a nice day !

Simon
Compex Product Engineer.



From proski  Sun Feb 25 07:42:25 2007
From: proski (Pavel Roskin)
Date: Sun, 25 Feb 2007 10:42:25 -0500
Subject: Git repository for hostapd/wpa_supplicant
In-Reply-To: <20070225053536.GB6004@jm.kir.nu>
References: <20070225023142.GA6004@jm.kir.nu>
	<20070224225759.kkcw8sgcs0w0owgo@webmail.spamcop.net>
	<20070225053536.GB6004@jm.kir.nu>
Message-ID: <20070225104225.ccag9w4sgowoggcc@webmail.spamcop.net>

Quoting Jouni Malinen <j at w1.fi>:

> Interesting.. Which version of git are you using? I used quite recent
> version (as in 1.5.0) to import the repository and also for pushing it
> to the server. I cannot reproduce this segfault.

It's likely because of the way how the curl library was built.  My git is
current from its own git repository, but it didn't change much since 1.5.0.

> Hmm.. Can you clone the repository from git://w1.fi/srv/git/hostap.git
> without this issue?

Yes, I can.

> git-fsck did not complain about anything and neither did git-gc. Anyway,
> git-gc was now run, so you could re-try cloning this over HTTP to verify
> whether that had any affect to the crash.

It's fine now.  Thank you!

--
Regards,
Pavel Roskin



From sukhdeep  Mon Feb 26 00:22:55 2007
From: sukhdeep (Sukhdeep Johar)
Date: Mon, 26 Feb 2007 13:52:55 +0530
Subject: wpa_s->bssid not getting cleared.
Message-ID: <2ef564dc0702260022t15b61e23kf9014827f0f39e1b@mail.gmail.com>

Hi All,

Why is wpa_s->bssid not being cleared in the wpa_supplicant_event_disassoc()
and wpa_supplicant_disassociate () ??

Due to this, I notice that the supplicant is not able to set the cipher-id
properly in the wpa_supplicant_event_assoc(), since the function doesn't
make a call to wpa_supplicant_select_config() when the wpa_s->bssid is
already configured.

The association/authentication goes through fine the first time, since the
wpa_s->bssid is NULL, and the proper configuration is set. But on later
invocations, when I remove the AP and bring it back to the network, I
observed the above.

Any inputs will be very helpful.

regards,
Sukhdeep
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070226/ddd53562/attachment.htm 


From patrick.holthaus  Mon Feb 26 08:57:15 2007
From: patrick.holthaus (Patrick Holthaus)
Date: Mon, 26 Feb 2007 17:57:15 +0100
Subject: wpa_supplicant IEEE802.1X questions
Message-ID: <200702261757.16031.patrick.holthaus@uni-bielefeld.de>

Hello everybody,

I am new to this list so please forgive me if I am posting something wrong.
There are two questions in my mind about the way wpa_supplicant works:

1)
Is it possible to have two networks managed by wpa_supplicant where the first
one is wired and secured by IEEE 802.1X and the second one is a WPA secured
wireless connection? I am asking that because i think ap_scan is needed to set 
to "0" for IEEE 802.1X authentication while for wireless it is needed to set 
to "1".
I manage to get it to work with the 
below /etc/wpa_supplicant/wpa_supplicant.conf , later running wpa_cli -i eth0 
(the wired connection), and setting ap_scan to 0 manually. But it would be 
nice to have the connection up automatically.

ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=wheel
update_config=1
ap_scan=1
fast_reauth=0
eapol_version=1
network={
        key_mgmt=IEEE8021X
        eap=MD5
        identity="username"
        password="password"
        eapol_flags=0
        priority=4
}
network={
        ssid="somessid"
        key_mgmt=WPA-PSK
        psk="my-very-secret=passphrase"
        priority=5
}

I am running Gentoo with the following /etc/conf.d/net :

modules=( "wpa_supplicant" )
wpa_supplicant_eth1="-Dwext"
wpa_supplicant_eth0="-Dwired"


2)
The topology of the wired connection above is as follows:

a) switch (at the university, not reachable for me)
b) ethernet-cable (coming out of the wall ;) )
c) switch (personal D-Link 10/100 fast ethernet model: des-1005d)
d) ethernet-cable
e) my computer, eventually some more computers

Everything works OK if i connect my PC directly to b) but i like to have it 
connected to my own switch (at e)), because the cable coming out of the wall 
is too short and i would like to have some other computers connected, too. 
The question is: Does this work at all? (If you need more information, let me 
know, i just don't know what exactly to tell you)

Any help is very much appreciated.

Thank you
Patrick
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20070226/4df7cf4a/attachment.pgp 


From Jens.Rutschmann  Mon Feb 26 13:35:03 2007
From: Jens.Rutschmann (Jens Rutschmann)
Date: Mon, 26 Feb 2007 22:35:03 +0100
Subject: Howto plug wpa_supplicant and dhcdbd
Message-ID: <45E35287.4000304@online.de>

Hi all,

is there any way to let wpa_supplicant initiate a DHCP request ?
Do I just have to configure dhcdbd and wpa_supplicant correctly?

Or do I need some other software that observes wpa_supplicant and calls 
dhcdbd / dhcpcd / dhclient after the computer is connected to a wireless 
network?
Perhaps something like networkmanager...

Any hints would be greatly appreciated.

-- 
Regards,
Jens Rutschmann



From dcbw  Mon Feb 26 13:47:24 2007
From: dcbw (Dan Williams)
Date: Mon, 26 Feb 2007 16:47:24 -0500
Subject: Howto plug wpa_supplicant and dhcdbd
In-Reply-To: <45E35287.4000304@online.de>
References: <45E35287.4000304@online.de>
Message-ID: <1172526444.2430.16.camel@localhost.localdomain>

On Mon, 2007-02-26 at 22:35 +0100, Jens Rutschmann wrote:
> Hi all,
> 
> is there any way to let wpa_supplicant initiate a DHCP request ?
> Do I just have to configure dhcdbd and wpa_supplicant correctly?
> 
> Or do I need some other software that observes wpa_supplicant and calls 
> dhcdbd / dhcpcd / dhclient after the computer is connected to a wireless 
> network?
> Perhaps something like networkmanager...

Well, I'd say NetworkManager.  But I think wpa_cli also has scripts that
can be called at various times?  It seems that people want to pack more
and more functionality into wpa_supplicant itself when I'd argue that
functionality doesn't belong there.

Dan




From uberlord  Mon Feb 26 13:59:05 2007
From: uberlord (Roy Marples)
Date: Mon, 26 Feb 2007 21:59:05 +0000
Subject: Howto plug wpa_supplicant and dhcdbd
In-Reply-To: <1172526444.2430.16.camel@localhost.localdomain>
References: <45E35287.4000304@online.de>
	<1172526444.2430.16.camel@localhost.localdomain>
Message-ID: <20070226215905.551e2667@uberlaptop.marples.name>

On Mon, 26 Feb 2007 16:47:24 -0500
Dan Williams <dcbw at redhat.com> wrote:

> Well, I'd say NetworkManager.  But I think wpa_cli also has scripts
> that can be called at various times?  It seems that people want to
> pack more and more functionality into wpa_supplicant itself when I'd
> argue that functionality doesn't belong there.

wpa_cli can all a script when link goes up or down.
This is perfect for Gentoo as services can then be started or stopped
depending on runlevel and the net dependency being satisfied. We rely
on various small daemons to do things like this and just call our net
scripts. Makes it very easy to integrate alternative software and new
interface daemons, such as ifplugd vs netplugd.

You're just looking at it from the perspective of NetworkManager
controlling everything, which is fair enough as I think you're it's
main author.

That reminds me, can I bug you off list about how to integrate dhcpcd
into NetworkManager so it could optionally be used instead of dhclient?

Thanks

Roy



From Jens.Rutschmann  Mon Feb 26 14:13:50 2007
From: Jens.Rutschmann (Jens Rutschmann)
Date: Mon, 26 Feb 2007 23:13:50 +0100
Subject: Howto plug wpa_supplicant and dhcdbd
In-Reply-To: <20070226215905.551e2667@uberlaptop.marples.name>
References: <45E35287.4000304@online.de>	<1172526444.2430.16.camel@localhost.localdomain>
	<20070226215905.551e2667@uberlaptop.marples.name>
Message-ID: <45E35B9E.5020504@online.de>

Tank you very much for those *very* fast replies !

I think I'll try both methods. :-)

-- 
Regards,
Jens Rutschmann



From joerg  Mon Feb 26 03:43:54 2007
From: joerg (=?iso-8859-1?Q?J=F6rg?= Sommer)
Date: Mon, 26 Feb 2007 12:43:54 +0100
Subject: Why wpa_supplicant does not connect to a -61dbm access point?
Message-ID: <20070226114354.GD29855@alea.gnuu.de>

Hi,

I've an Airport Extreme card (bcm4306) and I use wpa_supplicant 0.5.7
with a Debian unstable on PowerPC. My config is available at
http://www.uni-jena.de/Linux_Fedora_Core___Scientific_Linux_4_x_mit_WPA_EAP_TTLS_PAP.html

# lspci -s 10:12 -v
0001:10:12.0 Network controller: Broadcom Corporation BCM4306 802.11b/g Wireless LAN Controller (rev 03)
        Subsystem: Apple Computer Inc. AirPort Extreme
        Flags: bus master, fast devsel, latency 16, IRQ 52
        Memory at 80084000 (32-bit, non-prefetchable) [size=8K]
        Capabilities: [40] Power Management version 2

% wpa_supplicant -D wext -i eth1
Trying to associate with 00:14:1b:60:6a:40 (SSID='802.1X' freq=2472 MHz)
Authentication with 00:00:00:00:00:00 timed out.
Trying to associate with 00:14:1b:60:6a:40 (SSID='802.1X' freq=2472 MHz)
Authentication with 00:00:00:00:00:00 timed out.
Trying to associate with 00:14:1b:5b:be:c0 (SSID='802.1X' freq=2452 MHz)
Authentication with 00:00:00:00:00:00 timed out.

Why is it 00:00:00:00:00:00?

% iwlist eth1 sc
  Cell 03 - Address: 00:14:1B:60:6A:40
            ESSID:"802.1X"
            Protocol:IEEE 802.11bg
            Mode:Master
            Channel:13
            Encryption key:on
            Bit Rates:1 Mb/s; 2 Mb/s; 5.5 Mb/s; 6 Mb/s; 9 Mb/s
                      11 Mb/s; 12 Mb/s; 18 Mb/s; 24 Mb/s; 36 Mb/s
                      48 Mb/s; 54 Mb/s
            Quality=89/100  Signal level=-61 dBm  Noise level=-67 dBm
            IE: WPA Version 1
                Group Cipher : TKIP 
                Pairwise Ciphers (1) : TKIP 
                Authentication Suites (1) : 802.1X  
            IE: IEEE 802.11i/WPA2 Version 1
                Group Cipher : TKIP 
                Pairwise Ciphers (1) : CCMP 
                Authentication Suites (1) : 802.1X  
            Extra: Last beacon: 2324ms ago

% iwevent
12:29:08.536222   eth1     Set Mode:Managed
12:29:08.866442   eth1     Scan request completed
12:29:08.866542   eth1     Set Mode:Managed
12:29:08.877978   eth1     Set Frequency:2.472 GHz (Channel 13)
12:29:08.878259   eth1     Set ESSID:"802.1X"
12:29:09.222180   eth1     Scan request completed
12:29:09.224278   eth1     Custom driver event:authenticated
12:29:19.242191   eth1     Scan request completed
12:29:19.242266   eth1     Set Mode:Managed
12:29:19.245092   eth1     Set Frequency:2.472 GHz (Channel 13)
12:29:19.245244   eth1     Set ESSID:"802.1X"
12:29:29.606026   eth1     Scan request completed
12:29:29.606101   eth1     Set Mode:Managed
12:29:29.617045   eth1     Set Frequency:2.452 GHz (Channel 9)

Does wpa_supplicant understand the "authenticated" event?

% dmesg
[371477.004914] bcm43xx: Keys cleared
[371477.004957] bcm43xx: Selected 802.11 core (phytype 2)
[371477.022872] SoftMAC: Associate: Scanning for networks first.
[371477.086927] bcm43xx: set security called, .level = 0, .enabled = 0, .encrypt = 0
[371477.087472] bcm43xx: set security called, .level = 0, .enabled = 0, .encrypt = 0
[371477.087701] bcm43xx: set security called, .level = 0, .enabled = 0, .encrypt = 0
[371477.087911] bcm43xx: set security called, .level = 0, .enabled = 0, .encrypt = 0
[371477.374209] SoftMAC: Scanning finished: scanned 14 channels starting with channel 1
[371477.374290] SoftMAC: Queueing Authentication Request to 00:14:1b:5b:b0:f0
[371477.382170] SoftMAC: Sent Authentication Request to 00:14:1b:5b:b0:f0.
[371477.382915] SoftMAC: generic IE set to dd160050f20101000050f20201000050f20201000050f201
[371477.382979] bcm43xx: Request to set channel/freq: 13/2472
[371477.394331] SoftMAC: Already associating or associated to 00:14:1b:5b:b0:f0
[371477.394379] SoftMAC: Associate: Scanning for networks first.
[371477.738216] SoftMAC: Scanning finished: scanned 14 channels starting with channel 1
[371477.738305] SoftMAC: Queueing Authentication Request to 00:14:1b:60:6a:40
[371477.746191] SoftMAC: Sent Authentication Request to 00:14:1b:60:6a:40.
[371477.747539] SoftMAC: Open Authentication completed with 00:14:1b:60:6a:40
[371487.346208] eth1: no IPv6 routers present
[371487.750219] SoftMAC: Scanning finished: scanned 14 channels starting with channel 1
[371487.759142] SoftMAC: generic IE set to dd160050f20101000050f20201000050f20201000050f201
[371487.759212] bcm43xx: Request to set channel/freq: 13/2472
[371487.768420] SoftMAC: Already associating or associated to 00:14:1b:60:6a:40
[371489.386104] SoftMAC: Sent Authentication Request to 00:14:1b:5b:b0:f0.
[371498.114219] SoftMAC: Scanning finished: scanned 14 channels starting with channel 1
[371498.122988] SoftMAC: generic IE set to dd160050f20101000050f20201000050f20201000050f201
[371498.123059] bcm43xx: Request to set channel/freq: 9/2452
[371498.132264] SoftMAC: Already associating or associated to 00:14:1b:60:6a:40
[371498.132310] SoftMAC: Associate: Scanning for networks first.
[371498.470210] SoftMAC: Scanning finished: scanned 14 channels starting with channel 1
[371498.470295] SoftMAC: Queueing Authentication Request to 00:14:1b:5b:be:c0
[371498.478169] SoftMAC: Sent Authentication Request to 00:14:1b:5b:be:c0.

What goes wrong? Why wpa_supplicant does not connect to the network? Do
you need more informations? Which?

Bye, J?rg.
-- 
And 1.1.81 is officially BugFree(tm), so if you receive any bug-reports
on it, you know they are just evil lies.
            (Linus Torvalds)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 481 bytes
Desc: not available
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20070226/fbe78219/attachment.pgp 


From preining  Mon Feb 26 16:10:06 2007
From: preining (Norbert Preining)
Date: Tue, 27 Feb 2007 01:10:06 +0100
Subject: Howto plug wpa_supplicant and dhcdbd
In-Reply-To: <45E35287.4000304@online.de>
References: <45E35287.4000304@online.de>
Message-ID: <20070227001006.GA13382@gamma.logic.tuwien.ac.at>

On Mon, 26 Feb 2007, Jens Rutschmann wrote:
> is there any way to let wpa_supplicant initiate a DHCP request ?
> Do I just have to configure dhcdbd and wpa_supplicant correctly?

I use wpa_supplicant for setting up all the wireless parameters, and
ifplugd for doing the rest of the ip configurations. Works like a charm.
My ifplugd on my laptop listens on eth0 (cable) and wireless (wlan)
interfaces and as soon as a cable is plugged (eth0) or we got associated
it ifups the respective interface. 

Best wishes

Norbert

-------------------------------------------------------------------------------
Dr. Norbert Preining <preining at logic.at>                    Universit? di Siena
Debian Developer <preining at debian.org>                         Debian TeX Group
gpg DSA: 0x09C5B094      fp: 14DF 2E6C 0307 BE6D AD76  A9C0 D2BF 4AA3 09C5 B094
-------------------------------------------------------------------------------
WIGAN (n.)
If, when talking to someone you know has only one leg, you're trying
to treat then perfectly casually and normally, but find to your horror
that your conversion is liberally studded with references to (a) Long
John Silver, (b) Hopalong Cassidy, (c) The Hockey Cokey, (d) 'putting
your foot in it', (e) 'the last leg of the UEFA competition', you are
said to have committed a wigan. The word is derived from the fact that
sub-editors at ITN used to manage to mention the name of either the
town Wigan, or Lord Wigg, in every fourth script that Reginald
Bosanquet was given to read.
			--- Douglas Adams, The Meaning of Liff



From j  Mon Feb 26 19:10:04 2007
From: j (Jouni Malinen)
Date: Mon, 26 Feb 2007 19:10:04 -0800
Subject: wpa_supplicant IEEE802.1X questions
In-Reply-To: <200702261757.16031.patrick.holthaus@uni-bielefeld.de>
References: <200702261757.16031.patrick.holthaus@uni-bielefeld.de>
Message-ID: <20070227031003.GA5095@jm.kir.nu>

On Mon, Feb 26, 2007 at 05:57:15PM +0100, Patrick Holthaus wrote:

> Is it possible to have two networks managed by wpa_supplicant where the first
> one is wired and secured by IEEE 802.1X and the second one is a WPA secured
> wireless connection? I am asking that because i think ap_scan is needed to set 
> to "0" for IEEE 802.1X authentication while for wireless it is needed to set 
> to "1".

Yes, but you would need to use two configuration files. In that case,
you can either run two wpa_supplicant processes or use a single process.
For example:

wpa_supplicant -ieth0 -c/etc/wpa_supplicant-wired.conf -Dwired \
    -N -i wlan0 -c/etc/wpa_supplicant-wireless.conf -Dwext

> The topology of the wired connection above is as follows:
> 
> a) switch (at the university, not reachable for me)
> b) ethernet-cable (coming out of the wall ;) )
> c) switch (personal D-Link 10/100 fast ethernet model: des-1005d)
> d) ethernet-cable
> e) my computer, eventually some more computers
> 
> Everything works OK if i connect my PC directly to b) but i like to have it 
> connected to my own switch (at e)), because the cable coming out of the wall 
> is too short and i would like to have some other computers connected, too. 
> The question is: Does this work at all? (If you need more information, let me 
> know, i just don't know what exactly to tell you)

Switch may or may not filter out some frames or link events that may
make this a bit difficult.. Hub would be more likely to work, but that
would get quite confusing if there were multiple hosts behind the single
switch (a) port.

You should be able to run a sniffer (e.g., ethereal) on the ethernet
port and see whether EAPOL frames from the switch (a) are visible begind
the switch (c). You can try to trigger switch (a) to start
authentication by unplugging and replugging the cable (b) from (c).

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Mon Feb 26 19:14:16 2007
From: j (Jouni Malinen)
Date: Mon, 26 Feb 2007 19:14:16 -0800
Subject: Howto plug wpa_supplicant and dhcdbd
In-Reply-To: <45E35287.4000304@online.de>
References: <45E35287.4000304@online.de>
Message-ID: <20070227031416.GB5095@jm.kir.nu>

On Mon, Feb 26, 2007 at 10:35:03PM +0100, Jens Rutschmann wrote:

> is there any way to let wpa_supplicant initiate a DHCP request ?

Not directly. One way would be to use connection events (e.g., though
wpa_cli) to run external events, but in general, I would think using a
DHCP client that follows new IFLA_OPERSTATE events or link status would
be even better. That should allow wpa_supplicant to mark the interface
in working state after the authentication and DHCP client would
automatically be triggered based on this without needed wpa_cli (etc.)
running it separately. However, I do not know whether such a DHCP client
is currently available or at least whether it is included in any of the
distros by default.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Mon Feb 26 19:17:52 2007
From: j (Jouni Malinen)
Date: Mon, 26 Feb 2007 19:17:52 -0800
Subject: Why wpa_supplicant does not connect to a -61dbm access point?
In-Reply-To: <20070226114354.GD29855@alea.gnuu.de>
References: <20070226114354.GD29855@alea.gnuu.de>
Message-ID: <20070227031752.GC5095@jm.kir.nu>

On Mon, Feb 26, 2007 at 12:43:54PM +0100, J?rg Sommer wrote:

> http://www.uni-jena.de/Linux_Fedora_Core___Scientific_Linux_4_x_mit_WPA_EAP_TTLS_PAP.html

> % wpa_supplicant -D wext -i eth1
> Trying to associate with 00:14:1b:60:6a:40 (SSID='802.1X' freq=2472 MHz)
> Authentication with 00:00:00:00:00:00 timed out.

> Why is it 00:00:00:00:00:00?

Sign of the driver never reporting association.

> % iwevent
> 12:29:08.536222   eth1     Set Mode:Managed
> 12:29:08.866442   eth1     Scan request completed
> 12:29:08.866542   eth1     Set Mode:Managed
> 12:29:08.877978   eth1     Set Frequency:2.472 GHz (Channel 13)
> 12:29:08.878259   eth1     Set ESSID:"802.1X"
> 12:29:09.222180   eth1     Scan request completed
> 12:29:09.224278   eth1     Custom driver event:authenticated

> Does wpa_supplicant understand the "authenticated" event?

No, that is of no importance to wpa_supplicant. This issue is not at the
supplicant level, but at the driver/SoftMAC. wpa_supplicant is just
waiting for the driver to report association here and that does not seem
to happen.

> [371477.746191] SoftMAC: Sent Authentication Request to 00:14:1b:60:6a:40.
> [371477.747539] SoftMAC: Open Authentication completed with 00:14:1b:60:6a:40

SoftMAC seems to be able to complete authentication (that is the
"authenticated" event above), but for some reason, it does not seem to
even try to associate after this. I would recommend directing this
question to SoftMAC maintainers.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Mon Feb 26 19:40:10 2007
From: j (Jouni Malinen)
Date: Mon, 26 Feb 2007 19:40:10 -0800
Subject: wpa_s->bssid not getting cleared.
In-Reply-To: <2ef564dc0702260022t15b61e23kf9014827f0f39e1b@mail.gmail.com>
References: <2ef564dc0702260022t15b61e23kf9014827f0f39e1b@mail.gmail.com>
Message-ID: <20070227034010.GE5095@jm.kir.nu>

On Mon, Feb 26, 2007 at 01:52:55PM +0530, Sukhdeep Johar wrote:

> Why is wpa_s->bssid not being cleared in the wpa_supplicant_event_disassoc()
> and wpa_supplicant_disassociate () ??

Which version of wpa_supplicant are you looking at?
wpa_supplicant_event_disassoc() clears wpa_s->bssid by calling
wpa_supplicant_mark_disassoc(). wpa_supplicant_disassociate() does not
seem to do this, though. I think it would be reasonable to modify
wpa_supplicant_disassociate() to use wpa_supplicant_mark_disassoc() for
this (after having called wpa_clear_keys() which needs the
wpa_s->bssid).

> Due to this, I notice that the supplicant is not able to set the cipher-id
> properly in the wpa_supplicant_event_assoc(), since the function doesn't
> make a call to wpa_supplicant_select_config() when the wpa_s->bssid is
> already configured.

That's interesting.. I haven't seen this myself, but this looks like a
possible path in the case when wpa_supplicant_disassociate() is used.

> The association/authentication goes through fine the first time, since the
> wpa_s->bssid is NULL, and the proper configuration is set. But on later
> invocations, when I remove the AP and bring it back to the network, I
> observed the above.

Are you doing anything with the client (e.g., wpa_cli commands) or just
remove the AP and after some time bring it back?

-- 
Jouni Malinen                                            PGP id EFC895FA



From henryzhang  Mon Feb 26 20:22:06 2007
From: henryzhang (hong zhang)
Date: Mon, 26 Feb 2007 20:22:06 -0800 (PST)
Subject: settings for wpa of madwifi
In-Reply-To: <20070227001326.13BE9C1F6B@mail.iocaine.com>
Message-ID: <20070227042206.66431.qmail@web808.biz.mail.mud.yahoo.com>

List,
   
  I try to setup WPA with tkip on madwifi. Here is what I did before wpa key is set,
   
  1. iwpriv ath0 wpa 1   ----- enable wpa.
  2. iwpriv ath0 countermeasures 1 ---- failed
  3. iwpriv ath0 authmode 4 or 5   ----- auto or wpa authentication
  4. iwpriv ath0 keymgtalgs 2 ---- tkip algorithm
   
   
  But item 2 failed, should I set ie as well?
  Please help me out.
   
  Thanks.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070226/b4b80261/attachment.htm 


From mailshark  Tue Feb 27 00:55:50 2007
From: mailshark (Shanta Ravi Kumar P)
Date: Tue, 27 Feb 2007 14:25:50 +0530
Subject: Test Code for triggering 802.1X auth wihout Wireless Client Card
Message-ID: <2d4118ff0702270055m1c809866u533db5523a75573a@mail.gmail.com>

Hi,

I am trying to use wpa_supplicant on Linux.

I was going through the following link (
http://hostap.epitest.fi/wpa_supplicant/ ) and found that there has been a
test code done on wpa_supplicant for triggering 802.1X authentication
automatically without need for Wireless Client Card or AP.
Could anyone please provide me with the files for the same?
Has anyone tested the EAP-AKA functionality with the hostapd Radius Server?

Thanks in advance,
Regards,
Ravi
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070227/18811a48/attachment.htm 


From dcbw  Tue Feb 27 08:48:13 2007
From: dcbw (Dan Williams)
Date: Tue, 27 Feb 2007 11:48:13 -0500
Subject: Howto plug wpa_supplicant and dhcdbd
In-Reply-To: <20070226215905.551e2667@uberlaptop.marples.name>
References: <45E35287.4000304@online.de>
	<1172526444.2430.16.camel@localhost.localdomain>
	<20070226215905.551e2667@uberlaptop.marples.name>
Message-ID: <1172594893.533.0.camel@localhost.localdomain>

On Mon, 2007-02-26 at 21:59 +0000, Roy Marples wrote:
> On Mon, 26 Feb 2007 16:47:24 -0500
> Dan Williams <dcbw at redhat.com> wrote:
> 
> > Well, I'd say NetworkManager.  But I think wpa_cli also has scripts
> > that can be called at various times?  It seems that people want to
> > pack more and more functionality into wpa_supplicant itself when I'd
> > argue that functionality doesn't belong there.
> 
> wpa_cli can all a script when link goes up or down.
> This is perfect for Gentoo as services can then be started or stopped
> depending on runlevel and the net dependency being satisfied. We rely
> on various small daemons to do things like this and just call our net
> scripts. Makes it very easy to integrate alternative software and new
> interface daemons, such as ifplugd vs netplugd.
> 
> You're just looking at it from the perspective of NetworkManager
> controlling everything, which is fair enough as I think you're it's
> main author.
> 
> That reminds me, can I bug you off list about how to integrate dhcpcd
> into NetworkManager so it could optionally be used instead of dhclient?

Sure, but we'd generally like to kill dhcdbd entirely.  It doesn't have
much of a future in my mind.

Dan





From j  Tue Feb 27 18:55:13 2007
From: j (Jouni Malinen)
Date: Tue, 27 Feb 2007 18:55:13 -0800
Subject: Test Code for triggering 802.1X auth wihout Wireless Client Card
In-Reply-To: <2d4118ff0702270055m1c809866u533db5523a75573a@mail.gmail.com>
References: <2d4118ff0702270055m1c809866u533db5523a75573a@mail.gmail.com>
Message-ID: <20070228025512.GA5574@jm.kir.nu>

On Tue, Feb 27, 2007 at 02:25:50PM +0530, Shanta Ravi Kumar P wrote:

> I was going through the following link (
> http://hostap.epitest.fi/wpa_supplicant/ ) and found that there has been a
> test code done on wpa_supplicant for triggering 802.1X authentication
> automatically without need for Wireless Client Card or AP.
> Could anyone please provide me with the files for the same?

All test files are included in the wpa_supplicant source code package.

> Has anyone tested the EAP-AKA functionality with the hostapd Radius Server?

Yes.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Tue Feb 27 19:01:44 2007
From: j (Jouni Malinen)
Date: Tue, 27 Feb 2007 19:01:44 -0800
Subject: settings for wpa of madwifi
In-Reply-To: <20070227042206.66431.qmail@web808.biz.mail.mud.yahoo.com>
References: <20070227001326.13BE9C1F6B@mail.iocaine.com>
	<20070227042206.66431.qmail@web808.biz.mail.mud.yahoo.com>
Message-ID: <20070228030144.GB5074@jm.kir.nu>

On Mon, Feb 26, 2007 at 08:22:06PM -0800, hong zhang wrote:

>   I try to setup WPA with tkip on madwifi. Here is what I did before wpa key is set,
>    
>   1. iwpriv ath0 wpa 1   ----- enable wpa.
>   2. iwpriv ath0 countermeasures 1 ---- failed
>   3. iwpriv ath0 authmode 4 or 5   ----- auto or wpa authentication
>   4. iwpriv ath0 keymgtalgs 2 ---- tkip algorithm

What exactly are you trying to do? wpa_supplicant takes care of setting
these parameters automatically and you do not need to use iwpriv
manually for this.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Tue Feb 27 20:01:51 2007
From: j (Jouni Malinen)
Date: Tue, 27 Feb 2007 20:01:51 -0800
Subject: Partial progress, but now all firmwares fail on dlink dwl-650p
In-Reply-To: <N1-HbkPhUzFiL@Safe-mail.net>
References: <N1-HbkPhUzFiL@Safe-mail.net>
Message-ID: <20070228040151.GE5074@jm.kir.nu>

On Sun, Jan 14, 2007 at 12:45:29PM +0000, re2823 at Safe-mail.net wrote:

> I'm now trying to work out what to do next. If I try to bring up the
> interface (ifconfig wlan0 up), the command fails silently (on the
> command line) but the following is appended to the syslog:
> 
> kernel: wlan0: could not set interface UP - no PRI f/w

See hostap_fw_load in hostap-utils for an example script that loads the
needed firmware files.

> 1) Am i going about this the right way?

More or less, but the exact prism2_srec commands may not have been
correct.

> 2) Which firmware file should I use and, more importantly, how do you
> know/how am I supposed to find out?

Well.. Either one "just knows" the coding mechanism Intersil used for
the file names to indicate which card type they were for or one can try
with prism2_srec whether any given firmware image is suitable (before
asking it to actually download it). In case of D-Link DWL-650 Rev P1 the
files are PM*.HEX as the primary firmware and RF*.HEX as the
secondary/STA firmeare.

> 3) How come there's no "master list" of firmwares vs. pci/pcmcia card id
> (this is really linked to question 2).

There is documentation for this, but not publicly available.. I would
assume that someone has made such a list available somewhere, though.

> 4) Is this supposed to be this difficult? Shouldn't this all be setup as
> a udev rule, or some suitable pcmcia equivalent, so that plugging in my
> pcmcia produces a useable wifi interface? (see question 3!)

Well.. This was done before udev, if I remember correctly and anyway,
all that is needed is running "hostap_fw_load wlan0". I believe this was
discussed long time ago on this list (i.e., is archived somewhere) with
examples on how to do this automatically with cardmgr.

I'm not familiar with udev, so I don't know how to do this with more
modern kernels, but if someone is interested in doing that and
documenting the process, I can add the document somewhere..

-- 
Jouni Malinen                                            PGP id EFC895FA



From j  Tue Feb 27 20:11:42 2007
From: j (Jouni Malinen)
Date: Tue, 27 Feb 2007 20:11:42 -0800
Subject: Loading driver on DWL-650 revP with kernel 2.6.19.2
In-Reply-To: <7d88d3260701200053p407c0db5hb803c2104d70d9d6@mail.gmail.com>
References: <7d88d3260701200053p407c0db5hb803c2104d70d9d6@mail.gmail.com>
Message-ID: <20070228041142.GF5074@jm.kir.nu>

On Sat, Jan 20, 2007 at 03:53:43AM -0500, Andrew Shaffer wrote:

>      I've been doing a little more poking around and from what I can
> tell, the problem that I mentioned in my previous message is actually
> ocurring around line 705 of hostap_cs.c (the big block comment
> starting "Allocate an interrupt line,") which calls
> 
> CS_CHECK(RequestIRQ,
>                          pcmcia_request_irq(link, &link->irq));
> 
> I've inserted the following code both before and after the enclosing
> if statement to see where exactly jiffies stops updating:

> same, so it's somewhere in there that jiffies stops updating.  I
> suppose what is happening is that somewhere in that block the timer
> interrupt that updates jiffies is getting disabled and not reenabled.

Yes, that looks more reasonable explanation for what you were reporting
in the previous message. I'm actually still using older kernel version
(2.6.17) and at least that seems to be working with DWL-650 RevP (with
the product id added to hostap_cs.c). Looks like I need to update my
kernel for the test system I use with Prism2/2.5/3 cards at some point..
I don't think that anything has really changed in the Host AP driver, so
this may involve changes isomewhere else if the initialization of this
card has indeed been broken completely between 2.6.17 and 2.6.19.

-- 
Jouni Malinen                                            PGP id EFC895FA



From j.witteveen  Wed Feb 28 02:14:05 2007
From: j.witteveen (Jouke Witteveen)
Date: Wed, 28 Feb 2007 11:14:05 +0100
Subject: FreeBSD version of wired wpa_supplicant driver
Message-ID: <3993a4980702280214uf7deddfr4660b0cbdff4d3d1@mail.gmail.com>

Dear mister Leffler,
Hello all,

Lately I have been trying to make wpa_supplicant work for wired
interfaces on FreeBSD. The driver_wired.c code of the supplicant has
been corrected to ask for multicast membership the right way, and if.c
has been updated to handle multicast requests properly (special thanks
to Bruce Simpson).
Some testing with wpa_supplicant 0.5.7 show that a little more work
needs to be done.
Monitoring traffic with tcpdump (*not* going promiscious) I can see
how, on FreeBSD, wpa authentication is started properly, but a
response to the server's 'Request Identity' is not sent. In Linux this
response is sent immediately. I suspect l2_packet_freebsd.c to not
properly receive the packages (ie l2_packet_receive fails to work)
because the initial frame is sent out correctly.
As I can think of now there are two possible solutions. One being a
revision of the existing l2-freebsd code, the other a override on
receiving frames for the wired driver.
As I'm not a fast programmer on these matters I send out this e-mail
as a request for help and an assurance for me that I am not
duplicating someone else's efforts.

Regards,
- Jouke



From stefan  Wed Feb 28 03:45:13 2007
From: stefan (Stefan Rompf)
Date: Wed, 28 Feb 2007 12:45:13 +0100
Subject: Howto plug wpa_supplicant and dhcdbd
In-Reply-To: <45E35287.4000304@online.de>
References: <45E35287.4000304@online.de>
Message-ID: <200702281245.13494.stefan@loplof.de>

Am Montag, 26. Februar 2007 22:35 schrieb Jens Rutschmann:

> Or do I need some other software that observes wpa_supplicant and calls
> dhcdbd / dhcpcd / dhclient after the computer is connected to a wireless
> network?
> Perhaps something like networkmanager...

You may want to try my dhcpclient at 
http://www.flamewarmaster.de/software/dhcpclient/ . It should be started 
parallel to wpa_supplicant and will acquire an address whenever 
wpa_supplicant signals a working connection to the kernel.

Stefan



From henryzhang  Wed Feb 28 12:42:21 2007
From: henryzhang (hong zhang)
Date: Wed, 28 Feb 2007 12:42:21 -0800 (PST)
Subject: if PA is hidden and client cannot see AP's ssid,
	what should put for wpa_passphrase?
Message-ID: <621930.91931.qm@web801.biz.mail.mud.yahoo.com>

List,
   
  wpa_passphrase requires ssidname and passphrase as input. But if one client/station wants to associate an hidden AP. That means client could not see AP's ssid name (empty). How can we run wpa_passphrase without ssid input and wpa_passphrase would not work.
   
   
  ----henry
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070228/06ad2880/attachment.htm 


From dcbw  Wed Feb 28 18:09:22 2007
From: dcbw (Dan Williams)
Date: Wed, 28 Feb 2007 21:09:22 -0500
Subject: if PA is hidden and client cannot see AP's ssid, what should
	put for wpa_passphrase?
In-Reply-To: <621930.91931.qm@web801.biz.mail.mud.yahoo.com>
References: <621930.91931.qm@web801.biz.mail.mud.yahoo.com>
Message-ID: <1172714962.20958.13.camel@localhost.localdomain>

On Wed, 2007-02-28 at 12:42 -0800, hong zhang wrote:
> List,
>  
> wpa_passphrase requires ssidname and passphrase as input. But if one
> client/station wants to associate an hidden AP. That means client
> could not see AP's ssid name (empty). How can we run
> wpa_passphrase without ssid input and wpa_passphrase would not work.

You just have to know the SSID, even if the AP is hidden.  You cannot
connect to a hidden AP unless you know the SSID, so you'll have the SSID
for the passphrase anyway.

Dan






From henryzhang  Wed Feb 28 20:04:12 2007
From: henryzhang (hong zhang)
Date: Wed, 28 Feb 2007 20:04:12 -0800 (PST)
Subject: if PA is hidden and client cannot see AP's ssid,
	what should put for wpa_passphrase?
In-Reply-To: <1172714962.20958.13.camel@localhost.localdomain>
Message-ID: <20070301040412.57027.qmail@web804.biz.mail.mud.yahoo.com>

Dan,
   
  If I put authentication as auto which disable wpa in madwifi, ping works.
  But if I put auth mode as WPA, ping does not work.
   
  command is
  iwpriv ifname authmdoe 4 ----auto
  iwpriv ifname authmode 5 --- wpa.
   
  What difference between auto and wpa?
   
  ----henry

Dan Williams <dcbw at redhat.com> wrote:
  On Wed, 2007-02-28 at 12:42 -0800, hong zhang wrote:
> List,
> 
> wpa_passphrase requires ssidname and passphrase as input. But if one
> client/station wants to associate an hidden AP. That means client
> could not see AP's ssid name (empty). How can we run
> wpa_passphrase without ssid input and wpa_passphrase would not work.

You just have to know the SSID, even if the AP is hidden. You cannot
connect to a hidden AP unless you know the SSID, so you'll have the SSID
for the passphrase anyway.

Dan




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070228/7a7e6f3a/attachment.htm 


From henryzhang  Wed Feb 28 21:49:22 2007
From: henryzhang (hong zhang)
Date: Wed, 28 Feb 2007 21:49:22 -0800 (PST)
Subject: if PA is hidden and client cannot see AP's ssid,
	what should put for wpa_passphrase?
In-Reply-To: <1172714962.20958.13.camel@localhost.localdomain>
Message-ID: <188320.20881.qm@web803.biz.mail.mud.yahoo.com>

Dan,
   
  I look at my AP beacon and find two ucastcipher. One is tkip and another one is ccmp. I can not make it as only one ucastcipher ---tkip. I do not want to have ccmp.
   
  Also, how to decide wpa_ie value?
   
  ---henry

Dan Williams <dcbw at redhat.com> wrote:
  On Wed, 2007-02-28 at 12:42 -0800, hong zhang wrote:
> List,
> 
> wpa_passphrase requires ssidname and passphrase as input. But if one
> client/station wants to associate an hidden AP. That means client
> could not see AP's ssid name (empty). How can we run
> wpa_passphrase without ssid input and wpa_passphrase would not work.

You just have to know the SSID, even if the AP is hidden. You cannot
connect to a hidden AP unless you know the SSID, so you'll have the SSID
for the passphrase anyway.

Dan




-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.shmoo.com/pipermail/hostap/attachments/20070228/b50fb93e/attachment.htm 


