WPA_Supplicant

AiC0315

I was running the wpa_supplicant bypass for ATT on Plus version 23.05.01. Yesterday I did a fresh install of 2.7.0 and loaded my config backup now I can not get the bypass to work.

Running wpa_cli status I get this error: Failed to connect to non-global ctrl_ifname: (nil) error: No such file or directory

I have these commands set in the shell command:

(Early shellcmd) /sbin/ifconfig igb0 ether "XX:XX:XX:XX:XX:XX" && /root/WPA_Supplicant/wpa_supplicant -B -Dwired -i igb0 -c /root/WPA_Supplicant/wpa_supplicant.conf -P/var/run/wpa_supplicant.pid && sleep 10 && /usr/sbin/wpa_cli logon.

(Shellcmd) wpa_cli logoff && sleep 10 && wpa_cli logon

Here is my wpa_supplicant.conf:

eapol_version=1
ap_scan=0
fast_reauth=1

network={
ca_cert="/root/WPA_Supplicant/CERTS/CA.pem"
client_cert="/root/WPA_Supplicant/CERTS/Client.pem"
eap=TLS
eapol_flags=0
identity="XX:XX:XX:XX:XX:XX"
key_mgmt=IEEE8021X
phase1="allow_canned_success=1"
private_key="/root/WPA_Supplicant/CERTS/PrivateKey.pem"
}

What am I missing?

stephenw10

You have the wpa_supplicant present at that location?

What happens if you run that shellcmd line manually?

AiC0315

@stephenw10

Ok so here is what I have now. I did a clean install of 2.7.0 on a different machine. I double checked all file names, interfaces and made sure wpa_supplicant was executable. I get no IP address on the wan.

Here is the output when I run the earlyshellcmd manually:
Successfully initialized wpa_supplicant
ioctl[SIOC{ADD/DEL}MULTI]: Address already in use
Failed to connect to non-global ctrl_ifname: (nil) error: No such file or directory

I reinstalled Plus on my normal machine and it gets an IP right after boot.

Thanks for the help

stephenw10

Ah, it could be because the required code to allow it to see VLAN 0 tagged packets is different: https://redmine.pfsense.org/issues/14457

That patch is in 2.7 but not 23.05.1. It is in 23.09 though. You could test that.

AiC0315

@stephenw10
I updated my test machine to 23.09.RC with the exact same config as 2.7.0 and 23.09.RC pulled an IP immediately.

stephenw10

Ok, that's good. That would have been far more difficult to fix!

Is there a set of instructions for how you set this up?

AiC0315

@stephenw10

All thats required is to clone the mac address of the certs on the WAN interface. Point the earlyshellcmd to where my files are. Make the wpa_supplicant in my files executable. And add the shellcmd I posted earlier. Thats basically it.
To me it seems something is different in 2.7.0 than in 23.05.01. Could it be the wpa_supplicant files located at var/run/wpa_supplicant.pid and /usr/sbin/wpa_cli? I will post my my wpa_supplicant.conf below.

eapol_version=1
ap_scan=0
fast_reauth=1
network={
ca_cert="/root/WPA/Certs/CA.pem"
client_cert="/root/WPA/Certs/Client.pem"
eap=TLS
eapol_flags=0
identity="XX:XX:XX:XX:XX:XX" # Internet (ONT) interface MAC address must match this value
key_mgmt=IEEE8021X
phase1="allow_canned_success=1"
private_key="/root/WPA/Certs/PrivateKey.pem
}

My files are located at /root/WPA. This is the working config using pfsense plus.

Thanks again for your help

AiC0315

@stephenw10
Heres a link to a dsl thread that has some info in it.

ATT Bypass

stephenw10

But you had to copy wpa_suplicant itself into /root? That isn't present by default. Where did you copy it from?

wpa_supplicant is on the system but you're running a modified version maybe?

AiC0315

@stephenw10
I got that version of wpa_supplicant from the link i posted. Sorry I posted that probably at the same time you were responding

stephenw10

Ah OK. So you're using the version from that attachment I assume.

Those posts are all from right around the time 2.7 was released. You might try just using the included wpa_supplicant version.That has those patches:
https://github.com/pfsense/FreeBSD-src/tree/RELENG_2_7_0/contrib/wpa/src/l2_packet

GPz1100

@AiC0315 There was talk on the discord channel about changes in the new openssl breaking wpa_supplicant/att 802.1x use.

I don't recall off the top of my in which versionof pf openssl was updated (2.7/23.01 or 23.05.x, or 23.09).

In any event, the fix was to allow reverting back to a less secure usage (tls1) for environment in which wpa_supplicant is executed.

I've pasted the relevant lines to pastebin from the chat.

https://pastebin.com/bxg7qda4

This is a quote of https://discord.com/channels/886329492438671420/927008236584984587/1162122299445616650 from user "D" in the #pfsense channel.

Note you still need to be using the wpa_supplicant binary with the vlan0 patch.

Note2: The whole mac cloning is a non issue. You DON'T have to clone it. But what is important is the mac in the wpa_supplicant.conf file match the mac of the wan interface. So long as the two are the same, you will have connectivity. If they don't match, 802.1x auth will take place but you'll never get a dhcp ip.

stephenw10

@GPz1100 said in WPA_Supplicant:

https://pastebin.com/bxg7qda4

Mmm, that looks like it's only for the change to OpenSSL 3, which isn't in 2.7 (yet). Or in 23.05.1.

GPz1100

@stephenw10 ^^I believe it was 23.09 that introduced the new openssl.

It's unclear why the OP was unsuccessful with 2.70, given it does include the vlan0 patched wpa_supplicant with the same wpa_supplicant.conf

@AiC0315 said in WPA_Supplicant:

Failed to connect to non-global ctrl_ifname: (nil) error: No such file or directory

This error suggests a missing conf parameter in wpa_supplicant.conf, specifically

ctrl_interface=DIR=/var/run/wpa_supplicant

This goes ABOVE the "network={" array.

AiC0315

@GPz1100

I'll add that parameter when i have time and see what happens.

Thank you both for helping me try to figure this out

AiC0315

@GPz1100
Had time to mess with this last night. using this config.

ctrl_interface=DIR=/var/run/wpa_supplicant

eapol_version=1
ap_scan=0
fast_reauth=1
network={
ca_cert="/root/WPA/Certs/CA.pem"
client_cert="/root/WPA/Certs/Client.pem"
eap=TLS..
eapol_flags=0
identity="XX:XX:XX:XX:XX:XX" # Internet (ONT) interface MAC address must match this value
key_mgmt=IEEE8021X
phase1="allow_canned_success=1"
private_key="/root/WPA/Certs/PrivateKey.pem"
}
Works perfectly on 23.05.1 but does not get an IP on 2.7.0. Im using the wpa_supplicant posted on the dslforum link.
At this point I'm about to give up. Now I just have to dercide if I want to pay for plus from here on out

stephenw10

You tried using the included wpa_supplicant? 2.7 should have the patch to accept vlan0 by default.

GPz1100

@AiC0315 Where/when are you initializing wpa_supplicant?

AiC0315

@stephenw10
Yes, I used the wpa_supplicant file posted in the dslreports post

AiC0315

@GPz1100
/sbin/ifconfig igb0 ether "XX:XX:XX:XX:XX:XX" && /root/WPA/wpa_supplicant -B -Dwired -i igb0 -c /root/WPA/wpa_supplicant.conf -P/var/run/wpa_supplicant.pid && sleep 10 && /usr/sbin/wpa_cli logon. (early shellcmd)

wpa_cli logoff && sleep 10 && wpa_cli logon (shellcmd)