18dbcf02cSchristosTo do: 28dbcf02cSchristos- add support for WPA with ap_scan=0 (update selected cipher etc. based on 38dbcf02cSchristos AssocInfo; make sure these match with configuration) 48dbcf02cSchristos- consider closing smart card / PCSC connection when EAP-SIM/EAP-AKA 58dbcf02cSchristos authentication has been completed (cache scard data based on serial#(?) 68dbcf02cSchristos and try to optimize next connection if the same card is present for next 78dbcf02cSchristos auth) 88dbcf02cSchristos- if driver/hw is not WPA2 capable, must remove WPA_PROTO_RSN flag from 98dbcf02cSchristos ssid->proto fields to avoid detecting downgrade attacks when the driver 108dbcf02cSchristos is not reporting RSN IE, but msg 3/4 has one 118dbcf02cSchristos- Cisco AP and non-zero keyidx for unicast -> map to broadcast 128dbcf02cSchristos (actually, this already works with driver_ndis; so maybe just change 138dbcf02cSchristos driver_*.c to do the mapping for drivers that cannot handle non-zero keyidx 148dbcf02cSchristos for unicast); worked also with Host AP driver and madwifi 158dbcf02cSchristos- IEEE 802.1X and key update with driver_ndis?? wpa_supplicant did not seem 168dbcf02cSchristos to see unencrypted EAPOL-Key frames at all.. 178dbcf02cSchristos- EAP-PAX with PAX_SEC 188dbcf02cSchristos- EAP (RFC 3748) 198dbcf02cSchristos * OTP Extended Responses (Sect. 5.5) 208dbcf02cSchristos- test what happens if authenticator sends EAP-Success before real EAP 218dbcf02cSchristos authentication ("canned" Success); this should be ignored based on 228dbcf02cSchristos RFC 3748 Sect. 4.2 238dbcf02cSchristos- test compilation with gcc -W options (more warnings?) 248dbcf02cSchristos (Done once; number of unused function arguments still present) 25*9a53cbbeSchristos- ctrl_iface: get/remove blob 268dbcf02cSchristos- use doc/docbook/*.sgml and docbook2{txt,html,pdf} to replace README and 278dbcf02cSchristos web pages including the same information.. i.e., have this information only 288dbcf02cSchristos in one page; how to build a PDF file with all the SGML included? 298dbcf02cSchristos- EAP-POTP/RSA SecurID profile (RFC 4793) 308dbcf02cSchristos- document wpa_gui build and consider adding it to 'make install' 318dbcf02cSchristos- consider merging hostapd and wpa_supplicant PMKSA cache implementations 328dbcf02cSchristos- consider redesigning pending EAP requests (identity/password/otp from 338dbcf02cSchristos ctrl_iface) by moving the retrying of the previous request into EAP 348dbcf02cSchristos state machine so that EAPOL state machine is not needed for this 358dbcf02cSchristos- rfc4284.txt (network selection for eap) 368dbcf02cSchristos- www pages about configuring wpa_supplicant: 378dbcf02cSchristos * global options (ap_scan, ctrl_interfaces) based on OS/driver 388dbcf02cSchristos * network block 398dbcf02cSchristos * key_mgmt selection 408dbcf02cSchristos * WPA parameters 418dbcf02cSchristos * EAP options (one page for each method) 428dbcf02cSchristos * "configuration wizard" (step 1: select OS, step 2: select driver, ...) to 438dbcf02cSchristos generate example configuration 448dbcf02cSchristos- error path in rsn_preauth_init: should probably deinit l2_packet handlers 458dbcf02cSchristos if something fails; does something else need deinit? 468dbcf02cSchristos- consider moving SIM card functionality (IMSI fetching) away from eap.c; 478dbcf02cSchristos this should likely happen before EAP is initialized for authentication; 488dbcf02cSchristos now IMSI is read only after receiving EAP-Identity/Request, but since it is 498dbcf02cSchristos really needed for all cases, reading IMSI and generating Identity string 508dbcf02cSchristos could very well be done before EAP has been started 518dbcf02cSchristos- try to work around race in receiving association event and first EAPOL 528dbcf02cSchristos message 538dbcf02cSchristos- try to work around race in configuring PTK and sending msg 4/4 (some NDIS 548dbcf02cSchristos drivers with ndiswrapper end up not being able to complete 4-way handshake 558dbcf02cSchristos in some cases; extra delay before setting the key seems to help) 568dbcf02cSchristos- make sure that TLS session cache is not shared between EAP types or if it 578dbcf02cSchristos is, that the cache entries are bound to only one EAP type; e.g., cache entry 588dbcf02cSchristos created with EAP-TLS must not be allowed to do fast re-auth with EAP-TTLS 59*9a53cbbeSchristos- consider moving eap_peer_tls_build_ack() call into 60*9a53cbbeSchristos eap_peer_tls_process_helper() 618dbcf02cSchristos (it seems to be called always if helper returns 1) 628dbcf02cSchristos * could need to modify eap_{ttls,peap,fast}_decrypt to do same 638dbcf02cSchristos- add support for fetching full user cert chain from Windows certificate 648dbcf02cSchristos stores even when there are intermediate CA certs that are not in the 658dbcf02cSchristos configured ca_cert store (e.g., ROOT) (they could be, e.g., in CA store) 668dbcf02cSchristos- clean up common.[ch] 678dbcf02cSchristos- change TLS/crypto library interface to use a structure of function 688dbcf02cSchristos pointers and helper inline functions (like driver_ops) instead of 698dbcf02cSchristos requiring every TLS wrapper to implement all functions 708dbcf02cSchristos- add support for encrypted configuration fields (e.g., password, psk, 718dbcf02cSchristos passphrase, pin) 728dbcf02cSchristos- wpa_gui: add support for setting and showing priority 738dbcf02cSchristos- cleanup TLS/PEAP/TTLS/FAST fragmentation: both the handshake and Appl. Data 748dbcf02cSchristos phases should be able to use the same functions for this; 758dbcf02cSchristos the last step in processing sent should be this code and rest of the code 768dbcf02cSchristos should not need to care about fragmentation at all 778dbcf02cSchristos- test EAP-FAST peer with OpenSSL and verify that fallback to full handshake 788dbcf02cSchristos (ServerHello followed by something else than ChangeCipherSpec) 79