daniel/MontaukOS
1
Fork 0
Code Issues 3 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
51a2b3a9324716711ab832cf3e620ef273643705
MontaukOS/tests/wifi/brcmf_harness.cpp
T

770 lines
31 KiB
C++
Raw Blame History

/*
* brcmf_harness.cpp
* Host harness for the Broadcom FullMAC driver's protocol and connection
* layers (BrcmfProto.cpp, BrcmfConnect.cpp, with the real supplicant).
*
* The SDIO bus and the backplane are replaced by a simulated CYW4345x
* firmware: it decodes every SDPCM frame the driver writes to function 2
* (CDC ioctls, BDC data), answers ioctls the way the firmware does, and
* feeds back events and data frames through the same framing. The access
* point side of the WPA2 handshake is written here independently of
* Wpa.cpp, on the crypto primitives crypto_vectors checks against the
* published vectors.
*
* What stays untested is everything that needs the chip: the SDIO host,
* the backplane, firmware download (BrcmfSdio.cpp, BrcmfChip.cpp), and
* the firmware's own opinion of the structures it is sent.
*
* Copyright (c) 2026 Daniel Hammer
*/
#include <cstdio>
#include <cstring>
#include <cstdint>
#include <cstdlib>
#include <deque>
#include <string>
#include <vector>
#include "Drivers/Net/Wifi/Brcmf.hpp"
#include "Drivers/Net/Wifi/BrcmfSdio.hpp"
#include "Drivers/Net/Wifi/Ieee80211.hpp"
#include "Drivers/Net/Wifi/Wpa.hpp"
#include "Drivers/Platform/RpiFirmware.hpp"
#include "Libraries/Crypto.hpp"
using namespace Drivers::Net::Wifi;
using Bytes = std::vector<uint8_t>;
namespace Timekeeping {
uint64_t g_ms = 1000;
uint64_t GetMilliseconds() { return g_ms; }
void BusyWaitMs(uint64_t ms) { g_ms += ms; }
void BusyWaitUs(uint64_t us) { g_ms += (us + 999) / 1000; }
}
static int g_fails = 0;
static void check(bool cond, const char* what) {
printf(" %s %s\n", cond ? "PASS" : "FAIL", what);
if (!cond) g_fails++;
}
static uint16_t be16(const uint8_t* p) { return (uint16_t)(p[0] << 8 | p[1]); }
static uint16_t le16(const uint8_t* p) { return (uint16_t)(p[0] | p[1] << 8); }
static uint32_t le32(const uint8_t* p) { uint32_t v; memcpy(&v, p, 4); return v; }
static void putle16(Bytes& b, uint16_t v) { b.push_back((uint8_t)v); b.push_back((uint8_t)(v >> 8)); }
static void putle32(Bytes& b, uint32_t v) { for (int i = 0; i < 4; i++) b.push_back((uint8_t)(v >> (8 * i))); }
static void putbe16(Bytes& b, uint16_t v) { b.push_back((uint8_t)(v >> 8)); b.push_back((uint8_t)v); }
static void putbe32(Bytes& b, uint32_t v) { for (int i = 3; i >= 0; i--) b.push_back((uint8_t)(v >> (8 * i))); }
static void append(Bytes& b, const uint8_t* p, size_t n) { b.insert(b.end(), p, p + n); }
static const uint8_t PLACEHOLDER_MAC[6] = { 0xb8, 0x27, 0xeb, 0x74, 0xf2, 0x6c };
static const uint8_t BOARD_MAC[6] = { 0xdc, 0xa6, 0x32, 0x01, 0x02, 0xff };
static const uint8_t WLAN_MAC[6] = { 0xdc, 0xa6, 0x32, 0x01, 0x03, 0x00 }; // board + 1, with carry
static const uint8_t AP_OPEN[6] = { 0x00, 0x11, 0x22, 0x33, 0x44, 0x01 };
static const uint8_t AP_WPA[6] = { 0x00, 0x11, 0x22, 0x33, 0x44, 0x02 };
// =============================================================================
// Simulated firmware
// =============================================================================
struct Ioctl {
uint32_t Cmd;
bool Set;
std::string Name; // iovar name, for GET_VAR/SET_VAR
Bytes Data; // what follows the name (or the whole payload)
uint64_t Order;
};
struct Fw {
std::deque<Bytes> ToHost; // complete SDPCM frames
Bytes Cur;
size_t CurOff = 0;
uint8_t HostSeq = 0; // next sequence number expected
uint8_t Window = 8;
bool SeqError = false;
bool Mute = false; // stop answering ioctls
std::vector<Ioctl> Ioctls;
std::vector<std::pair<Bytes, uint64_t>> DataTx; // Ethernet frames, order
uint64_t Order = 0;
bool AutoJoin = true;
void (*OnEapol)(const Bytes& body) = nullptr;
};
static Fw fw;
static void QueueFrame(uint8_t channel, const Bytes& payload) {
Bytes f(12, 0);
uint16_t len = (uint16_t)(12 + payload.size());
f[0] = (uint8_t)len; f[1] = (uint8_t)(len >> 8);
f[2] = (uint8_t)~len; f[3] = (uint8_t)(~len >> 8);
f[4] = 0;
f[5] = channel;
f[7] = 12;
f[9] = (uint8_t)(fw.HostSeq + fw.Window); // credit
append(f, payload.data(), payload.size());
fw.ToHost.push_back(f);
}
static Bytes Bdc(const Bytes& eth) {
Bytes b = { 0x20, 0, 0, 0 };
append(b, eth.data(), eth.size());
return b;
}
static void QueueEvent(uint32_t type, uint32_t status, uint32_t reason, uint16_t flags,
const uint8_t* addr, const Bytes& data = {}) {
Bytes e;
append(e, WLAN_MAC, 6);
append(e, AP_WPA, 6);
putbe16(e, 0x886C);
putbe16(e, 0x8001);
putbe16(e, (uint16_t)(48 + data.size()));
e.push_back(1);
e.push_back(0x00); e.push_back(0x10); e.push_back(0x18);
putbe16(e, 1);
putbe16(e, 2); // version
putbe16(e, flags);
putbe32(e, type);
putbe32(e, status);
putbe32(e, reason);
putbe32(e, 0); // auth type
putbe32(e, (uint32_t)data.size());
Bytes a(6, 0);
if (addr) memcpy(a.data(), addr, 6);
append(e, a.data(), 6);
Bytes ifname(16, 0);
memcpy(ifname.data(), "wlan0", 5);
append(e, ifname.data(), 16);
e.push_back(0); // ifidx
e.push_back(0); // bsscfgidx
append(e, data.data(), data.size());
QueueFrame(1, Bdc(e));
}
static void QueueEthernet(const uint8_t* src, uint16_t type, const Bytes& body) {
Bytes e;
append(e, WLAN_MAC, 6);
append(e, src, 6);
putbe16(e, type);
append(e, body.data(), body.size());
QueueFrame(2, Bdc(e));
}
// One brcmf_bss_info_le, laid out as Linux's struct.
static Bytes BssInfo(const uint8_t* bssid, const char* ssid, uint16_t chanspec, uint8_t ctl,
int16_t rssi, uint16_t caps, const Bytes& ies) {
Bytes b(128, 0);
memcpy(&b[0], "\x6d\x00\x00\x00", 4); // version 109
uint32_t len = (uint32_t)(128 + ies.size());
memcpy(&b[4], &len, 4);
memcpy(&b[8], bssid, 6);
uint16_t bcn = 100;
memcpy(&b[14], &bcn, 2);
memcpy(&b[16], &caps, 2);
b[18] = (uint8_t)strlen(ssid);
memcpy(&b[19], ssid, strlen(ssid));
memcpy(&b[72], &chanspec, 2);
b[76] = 3;
memcpy(&b[78], &rssi, 2);
b[88] = ctl;
uint16_t ieOff = 128;
memcpy(&b[116], &ieOff, 2);
uint32_t ieLen = (uint32_t)ies.size();
memcpy(&b[120], &ieLen, 4);
append(b, ies.data(), ies.size());
return b;
}
static const Bytes RSN_CCMP = {
0x01, 0x00, 0x00, 0x0f, 0xac, 0x04, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x04,
0x01, 0x00, 0x00, 0x0f, 0xac, 0x02, 0x00, 0x00,
};
static const Bytes RSN_GCMP = {
0x01, 0x00, 0x00, 0x0f, 0xac, 0x08, 0x01, 0x00, 0x00, 0x0f, 0xac, 0x08,
0x01, 0x00, 0x00, 0x0f, 0xac, 0x02, 0x00, 0x00,
};
static Bytes Ies(const char* ssid, uint8_t channel, const Bytes* rsn) {
Bytes ie;
ie.push_back(0); ie.push_back((uint8_t)strlen(ssid));
append(ie, (const uint8_t*)ssid, strlen(ssid));
ie.push_back(1); ie.push_back(4); ie.push_back(0x82); ie.push_back(0x84); ie.push_back(0x0b); ie.push_back(0x16);
ie.push_back(3); ie.push_back(1); ie.push_back(channel);
if (rsn) {
ie.push_back(48); ie.push_back((uint8_t)rsn->size());
append(ie, rsn->data(), rsn->size());
}
return ie;
}
static void QueueEscan(uint16_t syncId) {
Bytes bss1 = BssInfo(AP_OPEN, "OpenNet", 0x1006, 6, -48, 0x0401, Ies("OpenNet", 6, nullptr));
Bytes bss2 = BssInfo(AP_WPA, "SecureNet", 0xd024, 36, -61, 0x0411, Ies("SecureNet", 36, &RSN_CCMP));
for (const Bytes* bss : { &bss1, &bss2 }) {
Bytes r;
putle32(r, (uint32_t)(12 + bss->size()));
putle32(r, 1);
putle16(r, syncId);
putle16(r, 1);
append(r, bss->data(), bss->size());
QueueEvent(69, 8, 0, 0, nullptr, r); // PARTIAL
}
QueueEvent(69, 0, 0, 0, nullptr); // done
}
static void FwControl(const uint8_t* p, size_t len) {
uint32_t cmd = le32(p), dlen = le32(p + 4), flags = le32(p + 8);
bool set = flags & 2;
const uint8_t* data = p + 16;
size_t avail = len - 16;
if (dlen > avail) dlen = (uint32_t)avail;
Ioctl io{cmd, set, "", {}, fw.Order++};
if (cmd == 262 || cmd == 263) {
size_t n = strnlen((const char*)data, dlen);
io.Name.assign((const char*)data, n);
if (n + 1 < dlen) io.Data.assign(data + n + 1, data + dlen);
} else {
io.Data.assign(data, data + dlen);
}
fw.Ioctls.push_back(io);
if (fw.Mute) return;
int32_t status = 0;
Bytes resp(dlen, 0);
if (cmd == 262) {
if (io.Name == "cur_etheraddr") memcpy(resp.data(), PLACEHOLDER_MAC, 6);
else if (io.Name == "ver") {
const char* v = "wl0: Aug 29 2023 01:51:02 version 7.45.265 (28bca26 CY) FWID 01-b677b91b\n";
memcpy(resp.data(), v, strlen(v) < dlen ? strlen(v) : dlen);
} else if (io.Name == "clmload_status") {
} else status = -23; // BCME_UNSUPPORTED
} else if (cmd == 263) {
if (io.Name == "escan") {
QueueEscan(le16(io.Data.data() + 6));
} else if (io.Name == "join" && fw.AutoJoin) {
QueueEvent(0, 0, 0, 0, io.Data.data() + 56);
QueueEvent(16, 0, 0, 1, io.Data.data() + 56);
} else if (io.Name == "bus:rxglom" || io.Name == "mfp" || io.Name == "sup_wpa") {
status = -23;
}
} else if (cmd == 217) { // valid channels
uint32_t list[3] = { 2, 1, 36 };
memcpy(resp.data(), list, sizeof(list) < dlen ? sizeof(list) : dlen);
}
Bytes r;
putle32(r, cmd);
putle32(r, dlen);
putle32(r, (flags & 0xFFFF0002u) | (status < 0 ? 1 : 0));
putle32(r, (uint32_t)status);
append(r, resp.data(), resp.size());
QueueFrame(0, r);
}
static void FwReceive(const uint8_t* f, size_t busLen) {
uint16_t len = le16(f), check = le16(f + 2);
if ((uint16_t)(len ^ check) != 0xFFFF || len > busLen) { fw.SeqError = true; return; }
if (f[4] != fw.HostSeq) fw.SeqError = true;
fw.HostSeq = (uint8_t)(f[4] + 1);
uint8_t ch = f[5] & 0x0F, off = f[7];
const uint8_t* p = f + off;
size_t plen = len - off;
if (ch == 0) {
FwControl(p, plen);
} else if (ch == 2) {
if (plen < 4 || (p[0] >> 4) != 2 || p[3] != 0) { fw.SeqError = true; return; }
Bytes eth(p + 4, p + plen);
fw.DataTx.push_back({eth, fw.Order++});
if (eth.size() >= 14 && be16(&eth[12]) == 0x888E && fw.OnEapol)
fw.OnEapol(Bytes(eth.begin() + 14, eth.end()));
}
}
// =============================================================================
// What the driver links against instead of the hardware
// =============================================================================
namespace Drivers::Net::Wifi {
BrcmfDevice g_brcmf;
bool BrcmfBpRead32(uint32_t addr, uint32_t& value) {
value = 0;
if (addr == g_brcmf.SdioCoreBase + 0x20 && (!fw.ToHost.empty() || !fw.Cur.empty()))
value = 0x40; // I_HMB_FRAME_IND
return true;
}
bool BrcmfBpWrite32(uint32_t, uint32_t) { return true; }
bool BrcmfBpReadMem(uint32_t, uint8_t*, uint32_t) { return true; }
bool BrcmfBpWriteMem(uint32_t, const uint8_t*, uint32_t) { return true; }
bool BrcmfBpSelectWindow(uint32_t) { return true; }
bool BrcmfF1Read8(uint32_t, uint8_t& v) { v = 0; return true; }
bool BrcmfF1Write8(uint32_t, uint8_t) { return true; }
bool BrcmfChipBringUp() {
g_brcmf.FwName = "43456";
g_brcmf.SdioCoreBase = 0x18002000;
g_brcmf.HostIntMask = 0x200000F0;
return true;
}
void BrcmfChipPowerOff() {}
void BrcmfDumpConsole() {}
uint8_t* BrcmfLoadFile(const char* ext, uint32_t& size, bool) {
if (strcmp(ext, "clm_blob") != 0) return nullptr;
size = 3000;
uint8_t* p = (uint8_t*)malloc(size);
for (uint32_t i = 0; i < size; i++) p[i] = (uint8_t)i;
return p;
}
struct Seen { Bytes Bssid; Bytes Ies; uint16_t Beacon, Caps; uint8_t Channel; int8_t Rssi; };
static std::vector<Seen> g_seen;
static std::vector<Bytes> g_delivered;
void WifiRxBssInfo(const uint8_t* bssid, uint16_t beaconInterval, uint16_t capability,
const uint8_t* ies, uint32_t iesLen, uint8_t channel, int8_t rssiDbm) {
g_seen.push_back({Bytes(bssid, bssid + 6), Bytes(ies, ies + iesLen), beaconInterval,
capability, channel, rssiDbm});
}
void WifiRxEthernet(const uint8_t* frame, uint32_t len) {
g_delivered.push_back(Bytes(frame, frame + len));
}
// Routed by Wifi.cpp in the kernel.
bool WpaTxEapol(const uint8_t* body, uint32_t len) { return BrcmfWpaTxEapol(body, len); }
bool WpaInstallPtk(const uint8_t* tk, uint32_t tkLen, uint8_t cipher) {
return BrcmfWpaInstallPtk(tk, tkLen, cipher);
}
bool WpaInstallGtk(const uint8_t* gtk, uint32_t gtkLen, uint8_t keyIdx,
uint8_t cipher, const uint8_t* rsc) {
return BrcmfWpaInstallGtk(gtk, gtkLen, keyIdx, cipher, rsc);
}
}
namespace Drivers::Net::Wifi::Sdio {
bool HostInit(uint64_t, uint32_t) { return true; }
bool CardInit() { return true; }
bool Read8(uint32_t, uint32_t, uint8_t& v) { v = 0; return true; }
bool Write8(uint32_t, uint32_t, uint8_t) { return true; }
bool EnableFunction(uint32_t, bool, uint64_t) { return true; }
bool EnableCardInterrupts(uint8_t) { return true; }
void Abort(uint32_t) {}
bool CardInterruptPending() { return !fw.ToHost.empty(); }
bool IsInitialized() { return true; }
bool ReadBlock(uint32_t fn, uint32_t, bool, uint8_t* buffer, uint32_t len) {
if (fn != FN2 || (len & 3)) return false;
Timekeeping::g_ms++;
if (fw.Cur.empty()) {
if (fw.ToHost.empty()) { memset(buffer, 0, len); return true; }
fw.Cur = fw.ToHost.front();
fw.ToHost.pop_front();
fw.CurOff = 0;
}
for (uint32_t i = 0; i < len; i++, fw.CurOff++)
buffer[i] = fw.CurOff < fw.Cur.size() ? fw.Cur[fw.CurOff] : 0;
if (fw.CurOff >= ((fw.Cur.size() + 3) & ~(size_t)3)) fw.Cur.clear();
return true;
}
bool WriteBlock(uint32_t fn, uint32_t, bool, const uint8_t* buffer, uint32_t len) {
if (fn != FN2 || (len & 3)) return false;
if (len > FN2_BLOCK && len % FN2_BLOCK) fw.SeqError = true; // padded to whole blocks
Timekeeping::g_ms++;
FwReceive(buffer, len);
return true;
}
}
namespace Drivers::Platform::RpiFirmware {
bool GetBoardMacAddress(uint8_t mac[6]) { memcpy(mac, BOARD_MAC, 6); return true; }
bool SetGpioOutput(uint32_t, bool) { return true; }
}
// =============================================================================
// An independent WPA2-PSK authenticator
// =============================================================================
namespace Ap {
using namespace Kt::Crypto;
static const char* SSID = "SecureNet";
static const char* PASS = "supersecret123";
static uint8_t pmk[32], ptk[48], anonce[32], snonce[32], gtk[16];
static uint64_t replay = 0;
static Bytes lastMsg2, lastMsg4, staRsn;
static bool msg2MicOk = false, msg4MicOk = false;
static void Prf(const uint8_t* key, const char* label, const Bytes& data, uint8_t* out, size_t n) {
uint8_t counter = 0;
size_t done = 0;
while (done < n) {
Bytes m((const uint8_t*)label, (const uint8_t*)label + strlen(label) + 1);
append(m, data.data(), data.size());
m.push_back(counter++);
uint8_t h[20];
HmacSha1(key, 32, m.data(), m.size(), h);
size_t take = n - done < 20 ? n - done : 20;
memcpy(out + done, h, take);
done += take;
}
}
static Bytes KeyFrame(uint16_t info, const Bytes& keyData, bool mic) {
Bytes k(99, 0);
k[0] = 2; k[1] = 3;
uint16_t bodyLen = (uint16_t)(95 + keyData.size());
k[2] = (uint8_t)(bodyLen >> 8); k[3] = (uint8_t)bodyLen;
k[4] = 2;
k[5] = (uint8_t)(info >> 8); k[6] = (uint8_t)info;
k[8] = 16;
for (int i = 0; i < 8; i++) k[9 + i] = (uint8_t)(replay >> (56 - 8 * i));
memcpy(&k[17], anonce, 32);
k[97] = (uint8_t)(keyData.size() >> 8); k[98] = (uint8_t)keyData.size();
append(k, keyData.data(), keyData.size());
if (mic) {
uint8_t h[20];
HmacSha1(ptk, 16, k.data(), k.size(), h);
memcpy(&k[81], h, 16);
}
return k;
}
static bool MicOk(Bytes frame) {
if (frame.size() < 99) return false;
uint8_t mic[16];
memcpy(mic, &frame[81], 16);
memset(&frame[81], 0, 16);
uint8_t h[20];
HmacSha1(ptk, 16, frame.data(), frame.size(), h);
return memcmp(h, mic, 16) == 0;
}
static void Start(const char* pass) {
Pbkdf2Sha1(pass, strlen(pass), (const uint8_t*)SSID, strlen(SSID), 4096, pmk, 32);
for (int i = 0; i < 32; i++) anonce[i] = (uint8_t)(0xA0 + i);
for (int i = 0; i < 16; i++) gtk[i] = (uint8_t)(0x30 + i);
replay = 1;
lastMsg2.clear(); lastMsg4.clear(); staRsn.clear();
msg2MicOk = msg4MicOk = false;
QueueEthernet(AP_WPA, 0x888E, KeyFrame(0x008A, {}, false)); // msg 1
}
static void OnEapol(const Bytes& f) {
if (f.size() < 99 || f[1] != 3) return;
uint16_t info = be16(&f[5]);
if (!(info & 0x0100)) return;
if (lastMsg2.empty()) {
lastMsg2 = f;
memcpy(snonce, &f[17], 32);
Bytes data;
const uint8_t* a = memcmp(AP_WPA, WLAN_MAC, 6) < 0 ? AP_WPA : WLAN_MAC;
const uint8_t* b = a == AP_WPA ? WLAN_MAC : AP_WPA;
append(data, a, 6); append(data, b, 6);
const uint8_t* n1 = memcmp(anonce, snonce, 32) < 0 ? anonce : snonce;
const uint8_t* n2 = n1 == anonce ? snonce : anonce;
append(data, n1, 32); append(data, n2, 32);
Prf(pmk, "Pairwise key expansion", data, ptk, 48);
msg2MicOk = MicOk(f);
uint16_t kdl = be16(&f[97]);
staRsn.assign(f.begin() + 99, f.begin() + 99 + kdl);
if (!msg2MicOk) {
// Wrong passphrase: the AP gives up and deauthenticates.
QueueEvent(6, 0, 15, 0, AP_WPA);
return;
}
// Message 3: our RSN IE and the GTK KDE, key-wrapped under the KEK.
Bytes plain = { 0x30, (uint8_t)RSN_CCMP.size() };
append(plain, RSN_CCMP.data(), RSN_CCMP.size());
Bytes kde = { 0xdd, 22, 0x00, 0x0f, 0xac, 0x01, 0x01, 0x00 };
append(kde, gtk, 16);
append(plain, kde.data(), kde.size());
plain.push_back(0xdd);
while (plain.size() % 8) plain.push_back(0);
Bytes wrapped(plain.size() + 8);
AesKeyWrap(ptk + 16, 16, plain.data(), plain.size(), wrapped.data());
replay = 2;
QueueEthernet(AP_WPA, 0x888E, KeyFrame(0x13CA, wrapped, true));
} else if (lastMsg4.empty()) {
lastMsg4 = f;
msg4MicOk = MicOk(f);
}
}
}
// =============================================================================
// Cases
// =============================================================================
static void Pump(int rounds = 20) {
for (int i = 0; i < rounds; i++) {
BrcmfService();
Timekeeping::g_ms += 5;
}
}
static const Ioctl* LastSet(const char* name) {
for (auto it = fw.Ioctls.rbegin(); it != fw.Ioctls.rend(); ++it)
if (it->Set && it->Name == name) return &*it;
return nullptr;
}
static uint32_t SetInt(const char* name) {
const Ioctl* io = LastSet(name);
return io && io->Data.size() >= 4 ? le32(io->Data.data()) : 0xDEADBEEF;
}
static const Ioctl* LastCmd(uint32_t cmd) {
for (auto it = fw.Ioctls.rbegin(); it != fw.Ioctls.rend(); ++it)
if (it->Cmd == cmd) return &*it;
return nullptr;
}
static constexpr int CONN_IDLE = 0, CONN_ASSOCIATING = 4, CONN_HANDSHAKING = 6,
CONN_CONNECTED = 7, CONN_FAILED = 8;
static void CaseInit() {
printf("== bring-up and preinit ==\n");
check(BrcmfProbe(0xFE300000), "the Arasan controller is claimed");
check(BrcmfCompleteInit(), "preinit completes against the firmware");
check(!fw.SeqError, "every frame carries the next sequence number and a valid header");
check(BrcmfGetState() == BrcmfState::Running, "the radio is running");
check(memcmp(g_brcmf.Mac, WLAN_MAC, 6) == 0, "the NVRAM placeholder MAC becomes the board address + 1");
const Ioctl* mac = LastSet("cur_etheraddr");
check(mac && mac->Data.size() == 6 && memcmp(mac->Data.data(), WLAN_MAC, 6) == 0,
"and is programmed into the firmware");
check(strcmp(g_brcmf.FwVersion, "7.45.265") == 0, "the firmware version is read from \"ver\"");
std::vector<const Ioctl*> clm;
for (auto& io : fw.Ioctls) if (io.Set && io.Name == "clmload") clm.push_back(&io);
check(clm.size() == 3, "a 3000-byte CLM blob goes down in three chunks");
if (clm.size() == 3) {
check(le16(clm[0]->Data.data()) == 0x1002 && le16(clm[1]->Data.data()) == 0x1000 &&
le16(clm[2]->Data.data()) == 0x1004, "flagged begin / middle / end, handler version 1");
check(le16(clm[0]->Data.data() + 2) == 2, "of type CLM");
check(le32(clm[0]->Data.data() + 4) == 1400 && le32(clm[2]->Data.data() + 4) == 200,
"with 1400-byte chunks and the remainder last");
check(clm[1]->Data[12] == (uint8_t)1400 && clm[2]->Data[12 + 199] == (uint8_t)2999,
"carrying the blob's bytes in order");
}
const Ioctl* ev = LastSet("event_msgs");
bool evOk = ev && ev->Data.size() == 16;
if (evOk) {
for (uint32_t e : { 0u, 5u, 6u, 12u, 16u, 69u })
evOk = evOk && (ev->Data[e / 8] & (1u << (e % 8)));
}
check(evOk, "events for join, link, deauth/disassoc and escan are enabled");
check(SetInt("roam_off") == 1, "firmware roaming is off");
const Ioctl* up = LastCmd(2);
check(up && up->Set, "WLC_UP is sent");
const Ioctl* pm = LastCmd(86);
check(pm && le32(pm->Data.data()) == 0, "power save is off");
check(g_brcmf.ChannelCount == 2 && g_brcmf.Band24 && g_brcmf.Band5,
"the valid channel list gives the channel count and bands");
uint32_t v = 0;
check(!BrcmfIovarGetInt("no_such_iovar", v, true), "an iovar the firmware rejects reports failure");
check(BrcmfGetState() == BrcmfState::Running, "without counting against the firmware's health");
}
static void CaseScan() {
printf("== escan ==\n");
check(BrcmfStartScan(), "a scan starts");
const Ioctl* es = LastSet("escan");
check(es && es->Data.size() == 72, "escan carries the 72-byte v1 parameter block");
if (es && es->Data.size() == 72) {
const uint8_t* p = es->Data.data();
check(le32(p) == 1 && le16(p + 4) == 1, "version 1, action start");
bool bcast = true;
for (int i = 0; i < 6; i++) bcast = bcast && p[44 + i] == 0xFF;
check(bcast && p[50] == 2 && p[51] == 0, "broadcast BSSID, any BSS type, active");
check(le32(p + 52) == 0xFFFFFFFF && le32(p + 68) == 0, "default dwells, every channel");
}
Pump();
check(!BrcmfScanActive(), "the completion event ends the scan");
check(g_seen.size() == 2, "both BSSs reach the scan table");
if (g_seen.size() == 2) {
check(memcmp(g_seen[0].Bssid.data(), AP_OPEN, 6) == 0 && g_seen[0].Channel == 6 &&
g_seen[0].Rssi == -48 && g_seen[0].Beacon == 100, "BSSID, channel, RSSI, beacon interval");
check(g_seen[1].Channel == 36 && (g_seen[1].Caps & 0x10), "the 5 GHz network, privacy set");
check(g_seen[1].Ies.size() == Ies("SecureNet", 36, &RSN_CCMP).size() && g_seen[1].Ies[0] == 0,
"with its information elements intact");
}
}
static void CaseOpenJoin() {
printf("== open network ==\n");
check(BrcmfConnectStart(AP_OPEN, 6, "OpenNet", nullptr, nullptr, 0), "the join is accepted");
check(SetInt("wpa_auth") == 0 && SetInt("wsec") == 0 && SetInt("auth") == 0,
"no WPA, no encryption, open system authentication");
const Ioctl* j = LastSet("join");
check(j && j->Data.size() == 72, "join carries brcmf_ext_join_params_le");
if (j && j->Data.size() == 72) {
const uint8_t* p = j->Data.data();
check(le32(p) == 7 && memcmp(p + 4, "OpenNet", 7) == 0, "the SSID");
check(memcmp(p + 56, AP_OPEN, 6) == 0 && le32(p + 64) == 1 && le16(p + 68) == 0x1006,
"the BSSID and the chanspec escan reported");
}
check(BrcmfConnectState() == CONN_ASSOCIATING, "associating until the firmware says otherwise");
Pump();
check(BrcmfConnectState() == CONN_CONNECTED && BrcmfLinkUp(), "E_SET_SSID + E_LINK bring the link up");
Bytes eth;
append(eth, AP_OPEN, 6); append(eth, WLAN_MAC, 6); putbe16(eth, 0x0800);
for (int i = 0; i < 100; i++) eth.push_back((uint8_t)i);
size_t before = fw.DataTx.size();
check(BrcmfSendEthernet(eth.data(), (uint32_t)eth.size()), "an Ethernet frame is accepted");
Pump(2);
check(fw.DataTx.size() == before + 1 && fw.DataTx.back().first == eth,
"and reaches the firmware unchanged behind a BDC header");
Bytes big = eth;
big.resize(1514, 0x5a);
check(BrcmfSendEthernet(big.data(), (uint32_t)big.size()), "a full-size frame is accepted");
Pump(2);
check(fw.DataTx.back().first == big && !fw.SeqError, "and goes out padded to whole blocks");
g_delivered.clear();
QueueEthernet(AP_OPEN, 0x0800, Bytes(60, 0x11));
Pump(2);
check(g_delivered.size() == 1 && g_delivered[0].size() == 74 && be16(&g_delivered[0][12]) == 0x0800,
"a received data frame is delivered to the stack");
QueueEvent(6, 0, 3, 0, AP_OPEN); // DEAUTH_IND
Pump();
check(BrcmfConnectState() == CONN_IDLE && !BrcmfLinkUp(), "a deauthentication takes the link down");
check(!BrcmfSendEthernet(eth.data(), (uint32_t)eth.size()), "and nothing is sent while it is down");
}
static const Ioctl* FindKey(uint32_t index) {
for (auto it = fw.Ioctls.rbegin(); it != fw.Ioctls.rend(); ++it)
if (it->Set && it->Name == "wsec_key" && it->Data.size() == 164 && le32(it->Data.data()) == index)
return &*it;
return nullptr;
}
static void CaseWpaJoin() {
printf("== WPA2-PSK ==\n");
fw.OnEapol = Ap::OnEapol;
size_t ioctlsBefore = fw.Ioctls.size();
check(BrcmfConnectStart(AP_WPA, 36, "SecureNet", Ap::PASS, RSN_CCMP.data(), (uint8_t)RSN_CCMP.size()),
"the join is accepted");
check(SetInt("wpa_auth") == 0x80 && SetInt("wsec") == 4 && SetInt("auth") == 0,
"WPA2-PSK, AES, open system authentication");
const Ioctl* ie = LastSet("wpaie");
Bytes want = { 0x30, (uint8_t)RSN_CCMP.size() };
append(want, RSN_CCMP.data(), RSN_CCMP.size());
check(ie && ie->Data == want, "the supplicant's RSN element goes into the association request");
const Ioctl* j = LastSet("join");
check(j && le16(j->Data.data() + 68) == 0xd024, "the 5 GHz chanspec from the scan");
Pump();
check(BrcmfConnectState() == CONN_HANDSHAKING && !BrcmfLinkUp(),
"association waits for the handshake before the link is usable");
Ap::Start(Ap::PASS);
Pump(40);
check(!Ap::lastMsg2.empty() && Ap::msg2MicOk, "message 2 carries a MIC the AP verifies");
check(Ap::staRsn == want, "and the same RSN element");
check(!Ap::lastMsg4.empty() && Ap::msg4MicOk, "message 4 follows message 3, MIC verified");
check(BrcmfConnectState() == CONN_CONNECTED && BrcmfLinkUp(), "the link is up once keyed");
const Ioctl* ptk = FindKey(0);
const Ioctl* gtk = FindKey(1);
check(ptk && memcmp(ptk->Data.data() + 8, Ap::ptk + 32, 16) == 0 && le32(ptk->Data.data() + 4) == 16,
"the pairwise key is the TK the AP derived");
if (ptk) {
const uint8_t* k = ptk->Data.data();
check(le32(k + 112) == 4 && le32(k + 116) == 0 && memcmp(k + 156, AP_WPA, 6) == 0,
"AES-CCM, bound to the AP's address");
}
check(gtk && memcmp(gtk->Data.data() + 8, Ap::gtk, 16) == 0, "the group key is the AP's GTK");
if (gtk) {
const uint8_t* k = gtk->Data.data();
bool noEa = true;
for (int i = 0; i < 6; i++) noEa = noEa && k[156 + i] == 0;
check(le32(k + 116) == 2 && noEa && le32(k + 132) == 1, "primary, broadcast, receive IV set");
}
uint64_t msg4Order = 0;
for (auto& d : fw.DataTx)
if (d.first.size() > 14 && be16(&d.first[12]) == 0x888E) msg4Order = d.second;
check(ptk && msg4Order != 0 && msg4Order < ptk->Order,
"message 4 reaches the radio before the pairwise key is installed");
(void)ioctlsBefore;
QueueEvent(16, 0, 0, 0, AP_WPA); // link down
Pump();
check(BrcmfConnectState() == CONN_IDLE, "losing the link returns to idle");
}
static void CaseWrongPassphrase() {
printf("== wrong passphrase ==\n");
check(BrcmfConnectStart(AP_WPA, 36, "SecureNet", "not-the-password", RSN_CCMP.data(),
(uint8_t)RSN_CCMP.size()), "the join is accepted");
Pump();
Ap::Start(Ap::PASS);
Pump(40);
check(!Ap::lastMsg2.empty() && !Ap::msg2MicOk, "the AP rejects message 2's MIC");
check(BrcmfConnectState() == CONN_FAILED, "the deauthentication fails the join");
check(BrcmfJoinFailedOnAuth(), "and it is reported as an authentication failure");
BrcmfConnectAbort();
const Ioctl* d = LastCmd(52);
check(d && d->Set && memcmp(d->Data.data() + 4, AP_WPA, 6) == 0, "abort disassociates from the AP");
check(BrcmfConnectState() == CONN_IDLE, "and leaves the connection idle");
}
static void CaseRefusals() {
printf("== refusals ==\n");
check(!BrcmfConnectStart(AP_WPA, 36, "SecureNet", Ap::PASS, RSN_GCMP.data(), (uint8_t)RSN_GCMP.size()),
"a GCMP network is refused before anything is sent");
check(BrcmfConnectRefusedForSecurity(), "as a security refusal");
check(!BrcmfConnectStart(AP_WPA, 36, "SecureNet", nullptr, RSN_CCMP.data(), (uint8_t)RSN_CCMP.size()),
"an encrypted network without a passphrase is refused");
}
static void CaseJoinTimeout() {
printf("== join timeout ==\n");
fw.AutoJoin = false;
check(BrcmfConnectStart(AP_OPEN, 6, "OpenNet", nullptr, nullptr, 0), "the join is accepted");
Timekeeping::g_ms += 13000;
Pump(2);
check(BrcmfConnectState() == CONN_FAILED, "no answer from the firmware fails the join in bounded time");
BrcmfConnectAbort();
check(BrcmfConnectStart(AP_OPEN, 6, "OpenNet", nullptr, nullptr, 0), "another join is accepted");
QueueEvent(0, 3, 0, 0, AP_OPEN); // SET_SSID: no networks
Pump();
check(BrcmfConnectState() == CONN_FAILED, "an E_SET_SSID failure fails it at once");
BrcmfConnectAbort();
fw.AutoJoin = true;
}
static void CaseDeadFirmware() {
printf("== firmware stops answering ==\n");
fw.Mute = true;
uint32_t v = 0;
for (int i = 0; i < 3; i++) BrcmfIovarGetInt("ver", v, true);
check(BrcmfGetState() == BrcmfState::Error, "three unanswered commands mark the radio failed");
check(!BrcmfStartScan(), "and nothing more is attempted");
fw.Mute = false;
}
int main() {
CaseInit();
CaseScan();
CaseOpenJoin();
CaseWpaJoin();
CaseWrongPassphrase();
CaseRefusals();
CaseJoinTimeout();
CaseDeadFirmware();
if (g_fails) {
printf("\n%d Broadcom case(s) FAILED\n", g_fails);
return 1;
}
printf("\nAll Broadcom protocol and connection cases passed.\n");
return 0;
}
Reference in new issue View Git Blame Copy Permalink