Tom Jones

Fortnightly Transport Call Meeting Notes

ComprehensiveDebugging

Email: <thj AT SPAMFREE freebsd DOT org>

Hacking Notes

Loader

building:

make buildenv
make -C stand

pcie pass through

The old method for having ppt pick up devices is with loader.conf like:

Instead we can use devctl which will take a device name or a path. If we detach we need to use a fuller device path. I.e.:

sudo devctl detach xhci0
sudo devctl set driver pci0:0:20:0 ppt

Wireless

Some handy wireshark expressions:

probe

    request and response
        (wlan.sa == e4:5e:37:dc:12:6b  or wlan.ra == e4:5e:37:dc:12:6b ) and (wlan.fc.type_subtype == 0x0004 or wlan.fc.type_subtype == 0x0005)
assoc
    request and response
        (wlan.sa == e4:5e:37:dc:12:6b  or wlan.ra == e4:5e:37:dc:12:6b ) and (wlan.fc.type_subtype == 0x0004 or wlan.fc.type_subtype == 0x0005)

The in operator makes it easier to compare with a list.

wlan.fc.type_subtype in {0x0000, 0x0001, 0x0004, 0x0005}

        (wlan.sa == e4:5e:37:dc:12:6b  or wlan.ra == e4:5e:37:dc:12:6b )

Decrypting wpa with tshark

sudo tcpdump -i wlan1 -y IEEE802_11_RADIO
sudo tshark -i wlan1 -I -V  -o wlan.enable_decryption:TRUE -o "uat:80211_keys:\"wpa-pwd\",\"{ieee80211}:{fw-enc}\""
sudo tshark -i wlan1 -I -V  -o wlan.enable_decryption:TRUE -o 'uat:80211_keys:"wpa-pwd","{ieee80211}:{fw-enc}"' -Y 'wlan.sa == e4:5e:37:dc:12:6b  or wlan.ra == e4:5e:37:dc:12:6b'

Streaming from the air interface on an OpenWRT router

on the openwrt side we need:

        root@OpenWrt:~# tcpdump -i phy0-mon0 --immediate-mode -U -w - | nc -l -p 19000

We can filter for the gl.inet router with:

        root@OpenWrt:~# tcpdump -i phy0-mon0 --immediate-mode -U ether host 94:83:c4:98:ab:f2 or ether host e4:5e:37:dc:12:6b -w - | nc -l -p 19000
or for a specific pair of hosts:
        tcpdump -i phy0-mon0 --immediate-mode -U ether host 94:83:c4:98:ab:f2 or ether host e4:5e:37:dc:12:6b or type ctl subtype ack -w - | nc -l -p 19000

as a script:

        staeth="ether 94:83:c4:98:ab:f2"
        apeth="ether host e4:5e:37:dc:12:6b"
        ack="type ctl subtype ack"
        beacon="subtype beacon"

        tcpdump -i phy0-mon0 --immediate-mode -U -w - \
                "($staeth or $apeth or $ack) and (not $beacon)" | nc -l -p 19000

Wireshark can now connect to my remote host (192.168.4.34 as an example):

        $ wireshark -k -i TCP@192.168.4.164:19000

Getting OpenWRT to advertise 160MHz channels

root@OpenWrt:~# cat /etc/config/wireless 

config wifi-device 'radio0'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi'
        option band '2g'
        option channel '6'
        option htmode 'HE20'
        option num_global_macaddr '7'
        option disabled '0'
        option country 'GB'
        option log_level '2'

config wifi-iface 'default_radio0'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'a2-enc'
        option encryption 'psk2'
        option key 'ieee80211'

config wifi-device 'radio1'
        option type 'mac80211'
        option path 'platform/soc/18000000.wifi+1'
        option band '5g'
        option channel '36'
        option htmode 'VHT160'
#       option htmode 'HE80'
        option num_global_macaddr '7'
        option disabled '0'
        option country 'GB'
        option background_radar '0'
        option log_level '1'

config wifi-iface 'default_radio1'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'a5-enc'
        option encryption 'psk2'
        option key 'ieee80211'

Building stuff

build with gcc

make CROSS_TOOLCHAIN=amd64-gcc14 buildkernel

Bugs

Free bugs, fixes and usability things for anyone that needs one

nextboot

$ nextboot -k kernel.m6
error: 1
nextboot: zfsbootcfg returned 1: No error: 0
$ sudo nextboot -k kernel.m6

Should be permission denied

python3 cannot send on divert sockets

# kldload ipdivert
# sudo ipfw add 200 divert 42 tcp from any to 192.168.1.1 2600 (divert doesn't work on localhost)

#create a raw socket

import sys
import socket

ruleport = ("0.0.0.0", 42)

sock = socket.socket(socket.PF_DIVERT, socket.SOCK_RAW, 0)
sock.bind(ruleport)


while True:
    print("reading from socket")

    buf = sock.recv(65565)      # should be recvfrom
    sockto.sendto(buf, port)    # should be sendto


    print("got a packet {} bytes".format(len(buf)))

This throws an exception for the method not being supported by the protocol family

ifconfig should parse all arguments before performing opeations

$ sudo ifconfig wlan create wlandev rtwn0 wlanmmode monitor
Password:
ifconfig: wlanmmode: bad value
wlan1

This shouldn't have created wlan1, which has now been created in the wrong mode (the default station)

Installer

pkgbase

Small things


CategoryHomepage

TomJones (last edited 2025-10-07T09:39:45+0000 by TomJones)