Topic: Wired WPA testing (BCM5365)

The content of this topic has been archived on 5 May 2018. There are no obvious gaps in this topic, but there may still be some posts missing at the end.

Page 1 of 1

Post #1

jouke

10 Feb 2009, 20:32

Since I do not have a BCM5365 device (ie Asus WL-500g Deluxe) myself, I need someone to test my wired-wpa code.

I want to know whether authentication is possible using the all-new roboswitch driver I wrote. I know it is possible with a BCM5325 switch chip, but others I cannot test.

More specifically I want to test wpa_supplicant from trunk (pre-0.6.8) with the following patch against driver_roboswitch.c:

@@ -46,8 +46,8 @@
 #define ROBO_ARLCTRL_VEC_2    0x26    /* Multiport vector 2 */
 
 /* VLAN page registers */
-#define ROBO_VLAN_ACCESS    0x06    /* VLAN table Access register */
-#define ROBO_VLAN_ACCESS_5365    0x08    /* VLAN table Access register (5365) */
+#define ROBO_VLAN_ACCESS    0x08    /* VLAN table Access register */
+#define ROBO_VLAN_ACCESS_5350    0x06    /* VLAN table Access register (5350) */
 #define ROBO_VLAN_READ        0x0C    /* VLAN read register */
 #define ROBO_VLAN_MAX        0xFF    /* Maximum number of VLANs */
 
@@ -60,7 +60,7 @@ struct wpa_driver_roboswitch_data {
     void *ctx;
     char ifname[IFNAMSIZ + 1];
     struct ifreq ifr;
-    int fd;
+    int fd, is_5350;
     u16 ports;
 };
 
@@ -195,7 +195,6 @@ static int wpa_driver_roboswitch_join(st
     if (wpa_driver_roboswitch_read(drv, ROBO_ARLCTRL_PAGE,
                        ROBO_ARLCTRL_CONF, &_read, 1) < 0)
         return -1;
-
     if (!(_read & (1 << 4))) {
         _read |= 1 << 4;
         wpa_driver_roboswitch_write(drv, ROBO_ARLCTRL_PAGE,
@@ -261,7 +260,6 @@ static int wpa_driver_roboswitch_leave(s
             goto clean_up;
         }
     }
-
     /* check if multiport address 2 was used */
     wpa_driver_roboswitch_read(drv, ROBO_ARLCTRL_PAGE, ROBO_ARLCTRL_VEC_2,
                    _read, 1);
@@ -320,7 +318,7 @@ static void * wpa_driver_roboswitch_init
 {
     struct wpa_driver_roboswitch_data *drv;
     int len = -1, sep = -1;
-    u16 vlan_max = ROBO_VLAN_MAX, vlan = 0, vlan_read[2];
+    u16 vlan = 0, _read[2];
 
     drv = os_zalloc(sizeof(*drv));
     if (drv == NULL) return NULL;
@@ -385,25 +383,25 @@ static void * wpa_driver_roboswitch_init
     /* set the read bit */
     vlan |= 1 << 13;
     /* set and read back to see if the register can be used */
-    wpa_driver_roboswitch_write(drv, ROBO_VLAN_PAGE, ROBO_VLAN_ACCESS,
-                    &vlan_max, 1);
-    wpa_driver_roboswitch_read(drv, ROBO_VLAN_PAGE, ROBO_VLAN_ACCESS,
-                   &vlan_max, 1);
-    if (vlan_max == ROBO_VLAN_MAX) /* pre-5365 */
-        wpa_driver_roboswitch_write(drv, ROBO_VLAN_PAGE,
-                        ROBO_VLAN_ACCESS, &vlan, 1);
-    else /* 5365 uses a different register */
-        wpa_driver_roboswitch_write(drv, ROBO_VLAN_PAGE,
-                        ROBO_VLAN_ACCESS_5365, &vlan, 1);
+    _read[0] = ROBO_VLAN_MAX;
+    wpa_driver_roboswitch_write(drv, ROBO_VLAN_PAGE, ROBO_VLAN_ACCESS_5350,
+                    _read, 1);
+    wpa_driver_roboswitch_read(drv, ROBO_VLAN_PAGE, ROBO_VLAN_ACCESS_5350,
+                   _read + 1, 1);
+    drv->is_5350 = (_read[0] == _read[1]);
+    wpa_driver_roboswitch_write(drv, ROBO_VLAN_PAGE,
+                    drv->is_5350 ? ROBO_VLAN_ACCESS_5350
+                         : ROBO_VLAN_ACCESS,
+                    &vlan, 1);
     wpa_driver_roboswitch_read(drv, ROBO_VLAN_PAGE, ROBO_VLAN_READ,
-                   vlan_read, 2);
-    if (!(vlan_read[1] & (1 << 4))) {
+                   _read, drv->is_5350 ? 2 : 1);
+    if (!(drv->is_5350 ? _read[1] & (1 << 4) : _read[0] & (1 << 14))) {
         wpa_printf(MSG_INFO, "%s: Could not get port information for "
                      "VLAN %d", __func__, vlan & ~(1 << 13));
         os_free(drv);
         return NULL;
     }
-    drv->ports = vlan_read[0] & 0x001F;
+    drv->ports = _read[0] & 0x001F;
     /* add the MII port */
     drv->ports |= 1 << 8;
     if (wpa_driver_roboswitch_join(drv, pae_group_addr) < 0) {

When things don't work for you, please include wpa_supplicant's debug output (using the '-dd' switch).

Post #2

LinuxInside

11 Feb 2009, 04:12

I have a wl500gx. Can you give a short description on how to test?

Never used wired wpa myself, but if you could write down what steps to take in the test I will give it a go...

(Last edited by LinuxInside on 11 Feb 2009, 04:17)

Post #3

jouke

11 Feb 2009, 10:52

I am afraid you need an authenticator and it is beyond the scope of this thread to explain how to setup an authenticator for wired wpa. In case you have access to an authenticator I can provide all the needed information on building and (test-)running wpa_supplicant.

Post #4

LinuxInside

12 Feb 2009, 20:36

jouke wrote:

I am afraid you need an authenticator and it is beyond the scope of this thread to explain how to setup an authenticator for wired wpa. In case you have access to an authenticator I can provide all the needed information on building and (test-)running wpa_supplicant.

I have hostapd running on the server will that do?

Post #5

jouke

13 Feb 2009, 18:18

Be sure to let hostapd use the pae_goup_addr and you will probably be fine. My personal experience with hostapd/wired is very limited, since I usually test against my providers authenticator .

Next it is easiest to include wpa_supplicant in the build configuration and trick the whole OpenWRT build process as follows:
- execute `make download`
- navigate to build_dir/mipsel/wpa_supplicant-0.6.7 (or equivalent for your personal situation)
- remove all files and replace with the contents of http://w1.fi/releases/wpa_supplicant-0.6.7.tar.gz
- apply the above patch to src/drivers/driver_roboswitch.c using standard patching procedures
- be sure to include "CONFIG_DRIVER_ROBOSWITCH=y" in your wpa_supplicant/.config
- execute `make package/wpa_supplicant-compile`

There might be an easier way I don't know of and even some errors in these steps, but chances are you'll end up with a wpa_supplicant_xxx.ipk. Note that it isn't realy suitable for normal usage, but it is the testing we're after. After copying and installing to the router we're intereseted in the output of the following command:

wpa_supplicant -i eth0.<vlan> -D roboswitch -c <config> -dd

where:
- <vlan> is the vlan on which hostapd is listening
- <config> is the location of some minimal configuration file, for example:

ap_scan=0
network={
    key_mgmt=IEEE8021X
    eap=TTLS
    eapol_flags=0
}

Good luck!

Post #6

jouke

17 Feb 2009, 13:25

Alternatively you could do without an authenticator after all. My first concern is whether packets get out of the router using the driver.

To test whether packets get out, connect the router to a unix machine and monitor for incomming packets:

tcpdump -i eth0 ether proto 0x888e

This command must be executed on the unix machine (replace eth0 as needed).

Next run wpa_supplicant on the router (be sure to use the right vlan).

If packets come in at the unix end, I would be happy to know so!

The discussion might have continued from here.

Page 1 of 1