Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 00:38:24 -05:00
Code Issues Projects Releases Wiki Activity

Interworking: Add logging to track nai_realm_find_eap failures

Browse Source 
There are lots of reasons we can fail to match an EAP credential, so add
logging to help determine why it is happening in various cases.

Signed-off-by: Ben Greear <greearb@candelatech.com>
This commit is contained in:
Ben Greear 2015-01-12 14:15:47 -08:00 committed by Jouni Malinen
parent 5a5aab7f40
commit f45bae5b81
1 changed files with 68 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
wpa_supplicant/interworking.c
View File

@ -587,56 +587,69 @@ static int nai_realm_match(struct nai_realm *realm, const char *home_realm)
} }
static int nai_realm_cred_username(struct nai_realm_eap *eap) static int nai_realm_cred_username(struct wpa_supplicant *wpa_s,
struct nai_realm_eap *eap)
{ {
if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-username: EAP method not supported: %d",
eap->method);
return 0; /* method not supported */ return 0; /* method not supported */
}
if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP && if (eap->method != EAP_TYPE_TTLS && eap->method != EAP_TYPE_PEAP &&
eap->method != EAP_TYPE_FAST) { eap->method != EAP_TYPE_FAST) {
/* Only tunneled methods with username/password supported */ /* Only tunneled methods with username/password supported */
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-username: Method: %d is not TTLS, PEAP, or FAST",
eap->method);
return 0; return 0;
} }
if (eap->method == EAP_TYPE_PEAP || eap->method == EAP_TYPE_FAST) { if (eap->method == EAP_TYPE_PEAP || eap->method == EAP_TYPE_FAST) {
if (eap->inner_method && if (eap->inner_method &&
eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-username: PEAP/FAST: Inner method not supported: %d",
eap->inner_method);
return 0; return 0;
}
if (!eap->inner_method && if (!eap->inner_method &&
eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL) eap_get_name(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2) == NULL) {
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-username: MSCHAPv2 not supported");
return 0; return 0;
} }
}
if (eap->method == EAP_TYPE_TTLS) { if (eap->method == EAP_TYPE_TTLS) {
if (eap->inner_method == 0 && eap->inner_non_eap == 0) if (eap->inner_method == 0 && eap->inner_non_eap == 0)
return 1; /* Assume TTLS/MSCHAPv2 is used */ return 1; /* Assume TTLS/MSCHAPv2 is used */
if (eap->inner_method && if (eap->inner_method &&
eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) eap_get_name(EAP_VENDOR_IETF, eap->inner_method) == NULL) {
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-username: TTLS, but inner not supported: %d",
eap->inner_method);
return 0; return 0;
}
if (eap->inner_non_eap && if (eap->inner_non_eap &&
eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP && eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_PAP &&
eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP && eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_CHAP &&
eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP && eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAP &&
eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2) eap->inner_non_eap != NAI_REALM_INNER_NON_EAP_MSCHAPV2) {
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-username: TTLS, inner-non-eap not supported: %d",
eap->inner_non_eap);
return 0; return 0;
} }
}
if (eap->inner_method && if (eap->inner_method &&
eap->inner_method != EAP_TYPE_GTC && eap->inner_method != EAP_TYPE_GTC &&
eap->inner_method != EAP_TYPE_MSCHAPV2) eap->inner_method != EAP_TYPE_MSCHAPV2) {
return 0; wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-username: inner-method not GTC or MSCHAPv2: %d",
return 1; eap->inner_method);
}
static int nai_realm_cred_cert(struct nai_realm_eap *eap)
{
if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL)
return 0; /* method not supported */
if (eap->method != EAP_TYPE_TLS) {
/* Only EAP-TLS supported for credential authentication */
return 0; return 0;
} }
@ -644,7 +657,30 @@ static int nai_realm_cred_cert(struct nai_realm_eap *eap)
} }
static struct nai_realm_eap * nai_realm_find_eap(struct wpa_cred *cred, static int nai_realm_cred_cert(struct wpa_supplicant *wpa_s,
struct nai_realm_eap *eap)
{
if (eap_get_name(EAP_VENDOR_IETF, eap->method) == NULL) {
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-cert: Method not supported: %d",
eap->method);
return 0; /* method not supported */
}
if (eap->method != EAP_TYPE_TLS) {
/* Only EAP-TLS supported for credential authentication */
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-cred-cert: Method not TLS: %d",
eap->method);
return 0;
}
return 1;
}
static struct nai_realm_eap * nai_realm_find_eap(struct wpa_supplicant *wpa_s,
struct wpa_cred *cred,
struct nai_realm *realm) struct nai_realm *realm)
{ {
u8 e; u8 e;
@ -654,16 +690,22 @@ static struct nai_realm_eap * nai_realm_find_eap(struct wpa_cred *cred,
((cred->password == NULL || ((cred->password == NULL ||
cred->password[0] == '\0') && cred->password[0] == '\0') &&
(cred->private_key == NULL || (cred->private_key == NULL ||
cred->private_key[0] == '\0'))) cred->private_key[0] == '\0'))) {
wpa_msg(wpa_s, MSG_DEBUG,
"nai-realm-find-eap: incomplete cred info: username: %s password: %s private_key: %s",
cred->username ? cred->username : "NULL",
cred->password ? cred->password : "NULL",
cred->private_key ? cred->private_key : "NULL");
return NULL; return NULL;
}
for (e = 0; e < realm->eap_count; e++) { for (e = 0; e < realm->eap_count; e++) {
struct nai_realm_eap *eap = &realm->eap[e]; struct nai_realm_eap *eap = &realm->eap[e];
if (cred->password && cred->password[0] && if (cred->password && cred->password[0] &&
nai_realm_cred_username(eap)) nai_realm_cred_username(wpa_s, eap))
return eap; return eap;
if (cred->private_key && cred->private_key[0] && if (cred->private_key && cred->private_key[0] &&
nai_realm_cred_cert(eap)) nai_realm_cred_cert(wpa_s, eap))
return eap; return eap;
} }
@ -1643,7 +1685,7 @@ static int interworking_connect_helper(struct wpa_supplicant *wpa_s,
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
if (!nai_realm_match(&realm[i], cred->realm)) if (!nai_realm_match(&realm[i], cred->realm))
continue; continue;
eap = nai_realm_find_eap(cred, &realm[i]); eap = nai_realm_find_eap(wpa_s, cred, &realm[i]);
if (eap) if (eap)
break; break;
} }
@ -1949,7 +1991,7 @@ static struct wpa_cred * interworking_credentials_available_realm(
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
if (!nai_realm_match(&realm[i], cred->realm)) if (!nai_realm_match(&realm[i], cred->realm))
continue; continue;
if (nai_realm_find_eap(cred, &realm[i])) { if (nai_realm_find_eap(wpa_s, cred, &realm[i])) {
if (cred_no_required_oi_match(cred, bss)) if (cred_no_required_oi_match(cred, bss))
continue; continue;
if (!ignore_bw && if (!ignore_bw &&