Repository navigation
Add WPA2-Enterprise (PEAP/MSCHAPv2) support - #287
Closed
dantdmdarealguy wants to merge 1 commit into
Closed
dantdmdarealguy wants to merge 1 commit into
dantdmdarealguy wants to merge 1 commit into
Conversation
Adds a userspace 802.1X supplicant so HeliPort can join WPA2-Enterprise networks with itlwm. All EAP, TLS and certificate handling is here; itlwm only relays EAPOL frames and installs the derived PMK. - EAP engine: vendored hostap eap_peer with its internal TLS client (EAPCore/, BSD, no OpenSSL), driven by a small RFC 4137 lower layer (EAPSupplicantBridge.c). PEAPv0 outer, MSCHAPv2 inner. - Server certificate trust on first use: the first connection to an SSID runs a probe-only TLS handshake that stops after the server certificate, so no credentials are sent. The user checks the subject and SHA-256 fingerprint and pins it; later connections verify the pin in hostap before phase 2. - EAPOL frames move through itlwm's RX_EAPOL / TX_EAPOL user-client calls, so no privileged helper or extra entitlements are needed and unsigned builds work. Older itlwm builds are detected and the user is told to update. - Credentials in the Keychain; Remember / auto-join work as for personal networks. Reauthentication is answered on the established association, also after a HeliPort relaunch. - Fix a stack overflow in get_platform_info() (strcat into a 32-byte field), and Join-button and credential validation in WiFiConfigWindow for enterprise networks. For testing reauthentication: notifyutil -p org.openintelwireless.HeliPort.debug.reauth Closes OpenIntelWireless#4.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Certificate-change reporting, PMK delivery failure handling, pin removal, and secure PMK erasure need correction.
Review effort: Balanced
Findings: 1
Open (3)
What changed in this PR
Adds a userspace PEAP/MSCHAPv2 supplicant that integrates with the new itlwm 802.1X transport and PMK interfaces.
Changes:
- Adds EAPOL transport, authentication lifecycle, reauthentication, and certificate pinning.
- Vendors hostap EAP, TLS, and cryptographic components.
- Adds enterprise credential UI and ClientKit ioctl support.
| File | Description |
|---|---|
ClientKit/{Api.c,Api.h,Common.h,IoctlId.h} |
Adds enterprise association, EAPOL, and PMK APIs. |
HeliPort/EAPSupplicant/* |
Implements the supplicant, transport, and certificate pins. |
HeliPort/NetworkManager.swift |
Integrates enterprise association and auto-join. |
HeliPort/Appearance/WiFiConfigWindow.swift |
Adds enterprise credential handling. |
HeliPort/Appearance/StatusMenu/* |
Manages session teardown and reattachment. |
HeliPort/Bridge.h |
Exposes the C supplicant bridge to Swift. |
HeliPort.xcodeproj/project.pbxproj |
Adds new sources to the application target. |
EAPCore/EAPSupplicantBridge.{c,h} |
Bridges Swift transport to hostap’s EAP peer. |
EAPCore/{README.md,build_config.h} |
Documents and configures the vendored core. |
EAPCore/common/* |
Provides shared protocol definitions. |
EAPCore/crypto/* |
Provides internal cryptographic primitives. |
EAPCore/eap_common/* |
Provides shared EAP and PEAP routines. |
EAPCore/eap_peer/* |
Implements PEAP/MSCHAPv2 peer authentication. |
EAPCore/tls/* |
Implements TLS and X.509 processing. |
EAPCore/utils/* |
Provides hostap utility infrastructure. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+352
to
+354
| // Don't let a derived PMK linger in this stack frame any longer than | ||
| // the syscall that consumes it needs it for. | ||
| memset(&req, 0, sizeof(req)); |
| b->cb.notify_eap_error = cb_notify_eap_error; | ||
| b->cb.set_anon_id = cb_set_anon_id; | ||
|
|
||
| b->sm = eap_peer_sm_init(b, &b->cb, b, &b->eap_conf); |
Comment on lines
+53
to
+54
| func removePin(forSSID ssid: String) { | ||
| try? keychain.remove(ssid) |
Author
|
Superseded by #288. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes: #4 · Requires: OpenIntelWireless/itlwm#1073. Older kexts don't have the new ioctls; HeliPort detects that and asks the user to update itlwm.
Summary
Adds a userspace 802.1X supplicant so HeliPort can join WPA2-Enterprise networks
with itlwm. All EAP, TLS and certificate handling happens here; the kext only
relays EAPOL frames and installs the derived PMK (see the itlwm PR, OpenIntelWireless/itlwm#1073).
How it works
eap_peerwith its internal TLS implementation(
EAPCore/, BSD license, no OpenSSL), driven by a small RFC 4137 lower layer(
EAPSupplicantBridge.c). PEAPv0 outer, MSCHAPv2 inner; other methods are NAK'd.probe-only TLS handshake that aborts right after the server certificate, so no
credentials are sent. HeliPort shows the subject and SHA-256 fingerprint; on
Trust it pins the certificate per SSID. Later connections verify the pin inside
hostap (
hash://server/sha256/…) before phase 2, so credentials only ever go tothe pinned certificate. A changed certificate is reported and the attempt fails.
user-client ioctls (
RX_EAPOL/TX_EAPOL).exchange, every 250 ms otherwise (enough to catch an AP-initiated reauth).
completely unsigned app, so the release zip is ad-hoc signed.
CredentialsManager;"Remember this network" and auto-join work as for personal networks.
the same association (periodic reauth, session timeouts), including after a
HeliPort relaunch while still connected (credentials restored from the Keychain).
Other fixes
ClientKit:get_platform_info()builtdriver_version + " " + fw_versionwithstrcpy/strcatinto a 32-byte field and could overflow the caller's stack.WiFiConfigWindow: the Join button checked the username box's own visibilityinstead of its grid row, the username box had no delegate, and enterprise
passwords were truncated to 64 / required ≥ 8 characters (WPA passphrase rules).
UI
first connect.
Prebuilt binaries
Until this is merged, an unofficial prebuilt
itlwm.kext+HeliPort.appbuilt from these PRs is on my fork's releases page: https://github.com/dantdmdarealguy/itlwm/releases. The two only work together, and only with itlwm (not AirportItlwm).Testing
TAMU_WiFi(PEAP/MSCHAPv2): first connect with certificate prompt,repeat connect with pinned certificate, Remember + auto-join at login,
reauthentication (
notifyutil -p org.openintelwireless.HeliPort.debug.reauthtriggers one for testing).
master, froma rule newer SwiftLint versions add. The CI build commands (Debug and Release,
unsigned) succeed.
Limitations / follow-ups
a pinned certificate yet (forgetting the network clears it).
exchange about 3 s later, and connectivity dropped for about 1.4 s (see the itlwm
PR).
EAPVerboseLogging(defaults) enables hostap debug logging; it includescredential-derived hexdumps, so it is off by default.