Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

RaspiPass AP fails to change MACs/SSIDs #32

Open
joshbgosh10592 opened this issue Mar 20, 2018 · 35 comments
Open

RaspiPass AP fails to change MACs/SSIDs #32

joshbgosh10592 opened this issue Mar 20, 2018 · 35 comments

Comments

@joshbgosh10592
Copy link

joshbgosh10592 commented Mar 20, 2018 •
edited
Loading

Hi! Once I reboot the Pi, the AP isn't automatically started, which may be by design, which is fine. I click start AP under Admin tasks. Most of the time, it succeeds. If it doesn't for whatever reason, I just reboot the Pi using the admin tab, and it works. Until the first change. Then my 3DSs cannot connect for a while, and I'll keep connection testing to the attwifi network, and it'll fail (Error code 003-1099, "No AP in range") most of the time and randomly connect again.

I'm also not putting the fact that I'm in an apartment complex with a lot of wireless networks broadcasting... If that is the cause, how often does a 3DS attempt to reach out with a StreetPass relay?

I'm mostly concerned if this part is what's causing the failure:

1521580108.497843: Failed to create interface mon.wlan0: -95 (Operation not supported)
1521580108.507942: wlan0: interface state UNINITIALIZED->COUNTRY_UPDATE
1521580108.508492: wlan0: Could not connect to kernel driver

Here's the most recent log, after I let it change MACs the first time:

Probability manually set at 100
Wed Mar 21 08:08:27 AEDT 2018
Starting RaspiPass...
Running random check with 100% chance...
Random check passed - bringing up AP.
Closing any existing hostapd processes...
Using SSID attwifi and MAC address 4E:53:50:4F:4F:40
Changing MAC address...
Bringing up access point...
hostapd output may follow below.
1521580108.496494: Configuration file: /var/raspipass/hostapd.conf
1521580108.497843: Failed to create interface mon.wlan0: -95 (Operation not supported)
1521580108.507942: wlan0: interface state UNINITIALIZED->COUNTRY_UPDATE
1521580108.508492: wlan0: Could not connect to kernel driver
1521580108.510575: Using interface wlan0 with hwaddr 4e:53:50:4f:4f:40 and ssid "attwifi"
1521580108.717949: wlan0: interface state COUNTRY_UPDATE->ENABLED
1521580108.717968: wlan0: AP-ENABLED
1521580123.617713: 1521580123.617723: wlan0: STA GALAXY3DS IEEE 802.11: associated
1521580123.618325: wlan0: AP-STA-CONNECTED CLIENT3DS1
1521580123.618359: 1521580123.618363: wlan0: STA GALAXY3DS RADIUS: starting accounting session 5AB1784C-00000000
1521580135.462584: 1521580135.462593: wlan0: STA PIKA3DSIEEE 802.11: associated
1521580135.462880: wlan0: AP-STA-CONNECTED PIKA3DS
1521580135.462913: 1521580135.462918: wlan0: STA 7c:bb:8a:f7:fc:5e RADIUS: starting accounting session 5AB1784C-00000001
1521580151.397053: 1521580151.397064: wlan0: STA PIKA3DS IEEE 802.11: disassociated
1521580151.397166: wlan0: AP-STA-DISCONNECTED PIKA3DS
1521580173.167753: 1521580173.167763: wlan0: STA BLACK3DS IEEE 802.11: associated
1521580173.168069: wlan0: AP-STA-CONNECTED BLACK3DS
1521580173.168101: 1521580173.168105: wlan0: STA BLACK3DS RADIUS: starting accounting session 5AB1784C-00000002
1521580178.068094: 1521580178.068105: wlan0: STA PIKA3DS IEEE 802.11: associated
1521580178.068399: wlan0: AP-STA-CONNECTED PIKA3DS
1521580178.068432: 1521580178.068437: wlan0: STA PIKA3DS RADIUS: starting accounting session 5AB1784C-00000003
1521580184.026636: 1521580184.026648: wlan0: STA PIKA3DS IEEE 802.11: disassociated
1521580184.026750: wlan0: AP-STA-DISCONNECTED PIKA3DS
1521580200.099481: 1521580200.099491: wlan0: STA PIKA3DS IEEE 802.11: associated
1521580200.099794: wlan0: AP-STA-CONNECTED PIKA3DS
1521580200.099826: 1521580200.099830: wlan0: STA PIKA3DS RADIUS: starting accounting session 5AB1784C-00000004
1521580238.868265: 1521580238.868275: wlan0: STA BLACK3DS IEEE 802.11: disassociated
1521580238.868379: wlan0: AP-STA-DISCONNECTED BLACK3DS
1521580325.706423: 1521580325.706434: wlan0: STA GALAXY3DS IEEE 802.11: disassociated
1521580325.706537: wlan0: AP-STA-DISCONNECTED GALAXY3DS
1521580380.545839: wlan0: AP-STA-DISCONNECTED PIKA3DS
@fatmagic
Copy link

fatmagic commented Mar 21, 2018 •
edited
Loading

Getting the same thing here with a new RPi3 and 7.4 image. From my 2 days of testing, I found out that the Nintendo Relay IPs have changed. Pinchie only allows traffic through the RaspiPass that are directed to the Nintendo Relay points (which is a smart move in regards to security, considering it's an open WiFi connection). His IPTables are setup to only allow traffic for those IPs. The Relay IPs have changed since Pinchie's last update, so the current IPTables are not relevant any longer.

To test this, I disabled the firewall on the RaspiPass, and instantly I got streetpasses.

So now, I have to filter my 3DS traffic on my normal WiFi and find out what IPs it's trying to connect to, and then submit those changes to Pinchie. Or we'll just have to add it in manually (or I can try to figure out how to fork this Project and do it myself, new territory for me!).

Will keep you posted on this.

@joshbgosh10592
Copy link
Author

I was kind of thinking that once I kept reading about it. I'm wondering if we could just MAC filter what devices connect (only allow 3DS MACs, manually added, and maybe only allow traffic to 52.x.x.x and 192.195.x.x (unless they changed that drastically...)
Unless... Can IPTables be set to only allow certain domains? That would be the easiest way, I could think, and future-proof it.

I'm trying to think of how I could assist... I have an enterprise grade switch which I can see what type of traffic is being sent, and a DD-WRT installed on a Netgear router spoofing NSPOOF connected to said switch, but I'm not sure if I can make it sniff only IP addresses entering/leaving that specific port. I could port mirror and have all traffic sent to that device to another port which I could have Wireshark running on, but I don't have another computer laying around.

@fatmagic
Copy link

Hey Josh -

Well shoot, if you could narrow down the traffic that the 3DS is pulling down while it's asleep, that would be most useful. We could then manually update the IPTables and get it working again properly, without having to drop the firewall. Here is a comment where Pinchie originally sifted his traffic for exactly this - not sure it will be helpful, but you can at least see where he was getting his info from to fix this issue a year ago.

And in regards to MAC filtering, Pinchie tried it, but it didn't work on the RPi3 (see this comment). I would imagine it's possible, but I personally don't know how to implement it.

If you can't pull it off, I can probably sift for the traffic via my corporate firewall (which I fully control). I'll just dig through the log files and see what the 3DS is hitting. Let me know if you have any success.

@joshbgosh10592
Copy link
Author

If I had my Pi-Hole install working properly, it would be a lot easier... However, looking at the live log file (which gets insane on my network), I found this:
npdl.cdn.nintendowifi.net - 104.88.7.160
nasc.nintendowifi.net 69.25.139.139
nppl.c.app.nintendowifi.net - 52.39.19.157 and 34.208.213.200
conntest.nintendowifi.net - 69.25.139.140
l-npns.app.nintendo.net - 35.167.248.201 and 54.68.136.190

Now, most of these I found are CNAMEs, so they just point to something else, but the IPs I gave are from Pi-Hole, or a DNS lookup (via PING).
I'm not exactly sure what they use for this, but could probably just reference his post you mentioned about him sifting his traffic, and just modify the IPs of them.

@fatmagic
Copy link

fatmagic commented Mar 22, 2018 •
edited
Loading

Josh - I heard from Pinchie, he mentioned we can try this to track it down:

If you're proficient enough, there's a commented line in iptables preventing dropped LAN packets being logged. With that enabled and iptables re-run it should start logging the addresses it was denied to. You have to filter through a lot of garbage traffic, but with 100% probability set on the device you can get the addresses by time.

So with a bit of log watching on the RPi3, we can probably find all the addresses as well.

I also want to try the addresses you provided.

Will continue playing.

@fatmagic
Copy link

@joshbgosh10592 Been tinkering around with this more today. Getting further along. Hopefully will have this beat in a day or two.

@joshbgosh10592
Copy link
Author

joshbgosh10592 commented Mar 24, 2018 •
edited
Loading

@fatmagic Awesome! I've been too busy with work to really try anything, but may be able to on Monday, if anything is still needed.

Unless @Pinchie has the list of hostnames that were resolving to the list of IPs he provided here. If he does, it would be even easier.

@ztc0611
Copy link

ztc0611 commented Mar 24, 2018 •
edited
Loading

@fatmagic how did you disable the firewall? I wouldn't mind doing this, because I just want streetpasses.
You're a legend for coming back and fixing this!

@joshbgosh10592
Copy link
Author

joshbgosh10592 commented Mar 24, 2018 •
edited
Loading

Hey @fatmagic Take a look at this.
I think, to honor @Pinchie 's wishes by making it "set it and forget it", there could be a cronjob created to run a script (or multiple scripts, because there are multiple hostnames) to change the entry in iptables.

So, then we're only stuck trying to figure out what hostnames are being used by the 3DS. The rest, we could modify/create the cronjob to run and modify it from there.

@Pinchie
Copy link
Owner

Pinchie commented Mar 24, 2018 •
edited
Loading

@the-mudkip You can disable the firewall with:

sudo iptables --flush

Note that the iptables rules are also present in the firewall.rules file in /raspi_secure - that file is automatically re-loaded on reboot (technically when the network interface comes back up from a down/off state)

With regards to the firewall files in the /raspi_secure directory:

  • /raspi_secure/iptables.sh is the script I use to dump all the rules into iptables when I'm working on them (I personally hate reading the firewall.rules layout...). Running sudo iptables --flush follwed by sudo /raspi_secure/iptables.sh sets the rules as written in the script.
  • /raspi_secure/firewall.rules is generated from an active iptables configuration by running: sudo iptables-save > /raspi_secure/firewall.rules

Unfortunately I've never had a list of hostnames - as @joshbgosh10592 points out, that would make iptables fixing a lot easier by grepping/piping nslookup output. Unfortunately the IPs only reverse-lookup'd to their very generic hosting provider server name, rather than a useful DNS entry. :(

I've advised @fatmagic that by uncommenting the last line in iptables.sh and re-implementing the iptables rules (ie flush and reload) the dropped packets will be logged to dmesg. Unfortunately that means digging out the info you need from a huge pile of rejected multicast packets, but you can at least use dmesg -T to get human-readable times. Also make sure you clear your dmesg regularly if you do this - it logs a lot.

To everyone, so sorry I hadn't replied. I had messages from fatmagic on Reddit but I had no idea you were all on here trying to fix this. You'd think I'd be subscribed to my own damn code's forum. My apologies. I appreciate you keeping this ticking along. :)

@joshbgosh10592
Copy link
Author

@Pinchie No worries! This has gotten my creative/coding side alive and I'm enjoying it!
Based off your IP addresses, I can assume at least some hostnames used are above. However, once I get my new install of Pi-Hole running, I can tell you everything my 3DS is querying, clearly, so a script could be created to dynamically update IPTables' list every so often (maybe every hour or so).
I should have this up and running probably Monday.

If that's something you like to do/have done? It would make it truly set/forget it.

@Pinchie
Copy link
Owner

Pinchie commented Mar 25, 2018

That's something that would be fantastic, thank you so much. 😄

@fatmagic
Copy link

Sorry for going quiet here - was busy this weekend. Thanks for dropping in @Pinchie :-D
@joshbgosh10592 - Very curious how your work goes on a dynamically updating IPTables list!
I had to teardown my Homepass relay temporarily, so I can't do any testing until Tues/Wednesday. Will check back in tomorrow!

@joshbgosh10592
Copy link
Author

joshbgosh10592 commented Mar 27, 2018 •
edited
Loading

Ok, so my original Pi-Hole install somehow managed to start working (after the host OS crashed and needed rebooted. I don't know, it's giving me a headache...) Anywho, I have the hostnames my 3DS reached out to. I'm not sure if all 5 of them are needed for streetpass, but here they are.

Edit: Conntest.nintendowifi.net and service.spr.app.nintendo.net are required. conntest, if blocked, doesn't even try to do anything else (kind of expected, but wanted to validate anyway), and when I had service.spr.app.nintendo.net blocked, no streetpass came through.

l-npns.app.nintendo.net
nppl.c.app.nintendowifi.net
npdl.cnd.nintendowifi.net (this didn't come through every time my 3DS was asleep. May not be required)
service.spr.app.nintendo.net (Required)
conntest.nintendowifi.net (Required)

Now, to make the script, I don't know how to make the script loop, but we could just take the example script I liked to and make 5 copies of it, or if someone knows how to input multiple hostnames, it would be even better. Another problem is that the 3DSs are reaching out to a CDN, which frequently provide more than one IP address (usually two). Not sure if the 3DS needs access to both or just one.

I'm also not sure where RaspiPass is saving its log file, to put that into the script.

@fatmagic
Copy link

fatmagic commented Mar 27, 2018 via email •
edited
Loading

@joshbgosh10592
Copy link
Author

You could ping them, but it would only return one IP address. I'm not sure if the 3DS would try both IPs DNS handed it and retry until it succeeded, or if it just gives up.

I've been so busy this week, I'll need to visit it hopefully Saturday to pull all the DNS responses to the 3DS.

Unfortunately, IPTables requires IP addresses and can't do FQDNs (to my knowledge). I really wish it would receive the request, make a DNS query, cache the responses, then add them to the table. But I guess that could open it up for DNS poisoning...

@joshbgosh10592
Copy link
Author

joshbgosh10592 commented Apr 1, 2018 •
edited
Loading

Sorry for going radio silence there for a while...
Here's the output of dnsmasq, listing all (current) IPs for the hostnames provided. I THINK these are correct. There was a lot going on involving nintendo on my network for this.
bold is what I referenced in earlier, italics is new stuff I found that probably isn't required.
(I also did the formatting because I wanted it to look cool.....)

accounts.nintendo.com is 52.86.186.6 AND 52.205.220.59
conntest.nintendowifi.net is 69.25.139.140
nasc.nintendowifi.net is 69.25.139.139
nppl.c.app.nintendowifi.net is 34.214.189.108 AND 52.35.47.127
npvk.app.nintendo.net 35.167.6.187 and 35.166.81.83. Not sure what that does, but this was the first time I've seen these.)
npdl.cdn.nintendowifi.net is 23.73.158.30
l-npns.app.nintendo.net is 54.68.136.190 AND 34.208.66.50
service.spr.app.nintendo.net is 54.218.98.74

@Pinchie
Copy link
Owner

Pinchie commented Apr 2, 2018 •
edited
Loading

One option to look at would be to amend the iptables.sh file to run the lookups. If you look at running something like
dig +short accounts.nintendo.com a
then you'll get both addresses.

Wondering if it wouldn't be best to look at reading that into an array and parsing through it.

We could, for example, put something like this at the top of iptables.sh:

digaround() {
        digarray=(`dig +short $1 a`)
        for i in "${digarray[@]}"
        do
                echo Adding whitelist entry for $i \($1\)
                iptables -A INPUT -s $i -j ACCEPT
                iptables -A OUTPUT -s $i -j ACCEPT
                iptables -A FORWARD -s $i -j ACCEPT
        done
}

That will pull the IPs returned by dig +short (hostname) a into an array, and add iptables rules for each value in the array. That will mean multiple IPs per host won't be an issue.

Essentially -- given we have the right list of hostnames -- the whole bank of streetpass relay whitelist entries in iptables.sh can be replaced with lines of
digaround (hostname)
for each domain.

Then it's just a matter adding iptables --flush to the top of iptables.sh, and setting a root cronjob to run it regularly to re-lookup IPs on the fly.

@joshbgosh10592
Copy link
Author

I didn't even know that command existed haha. That makes things a lot easier.
Would that cache the DNS queries for some point of time, or would it work to resolve them when the 3DS made a request? I'm not sure how long the 3DS's tolerance is for latency.
The cronjob could just run probably every night/few hours or so, and maybe upon reboot?

@Pinchie
Copy link
Owner

Pinchie commented Apr 3, 2018

So I got my Pi3 and 3DS back.. got the Pi booted and installed dnsutils to get the dig command while I clear out my streetpass queue.

Looking at the copy I have here, I've got the timezone changing and faster web UI to push out in the next version too. Looks like I left a lot of unmerged work on the 'working' tree 🤦‍♂️

Once I'm clear I'll do digaround() as detailed above and see if I get any hits

Hopefully the whitelist entries should just work with

# Streetpass relay whitelist
digaround accounts.nintendo.com
digaround conntest.nintendowifi.net
digaround nasc.nintendowifi.net
digaround nppl.c.app.nintendowifi.net
digaround npvk.app.nintendo.net
digaround npdl.cdn.nintendowifi.net
digaround l-npns.app.nintendo.net
digaround service.spr.app.nintendo.net

@Pinchie
Copy link
Owner

Pinchie commented Apr 4, 2018

Running ~24 hours with the firewall off, and no streetpass hits. I'm suspecting there's an issue with StreetPass on my 3DS since the battery was stone-dead when I got it back, but I'm trying to avoid a full system format.

@fatmagic
Copy link

fatmagic commented Apr 4, 2018 via email

@joshbgosh10592
Copy link
Author

I also had that issue, wouldn't receive any StreetPass visits even after clearing out my line and plaza.
I had to turn StreetPass off of everything from within mii plaza, delete the "extra data" for plaza from 3DS settings, and open it again.
I had to wait a little for the puzzles to appear again (update, probably), and I lost progress for everything that was additionally purchased (mii force, wrangler, etc.) but didn't need to reset from factory.
However, I'm not getting any passes from my other solution (spoofed MAC using DD-WRT) at the moment... Not sure if I need to reset again (stupid bug...) or if Nintendo did something. I'm sure if they did do something, it would be a lot louder, though.

@fatmagic
Copy link

fatmagic commented Apr 4, 2018 via email

@Pinchie
Copy link
Owner

Pinchie commented Apr 5, 2018

All my StreetPass games have been cleared of hits.. I keep getting the same SpotPass notification coming in though, which is a good indicator of an issue with the 3DS software. ☹️

Still googling around for a non-destructive solution :(

@joshbgosh10592
Copy link
Author

joshbgosh10592 commented Apr 5, 2018 •
edited
Loading

I'm having the same problem... I even did my semi-destructive solution that worked before, and I still haven't received a HomePass hit... I'm testing if I can actually StreetPass with another 3DS now, which I REALLY hope works, as I'm going to a convention this weekend and if I can't StreetPass, I'm going to be StreetPissed.
Edit: Real StreetPass works for me, just not HomePass stuff, again...

@fatmagic
Copy link

fatmagic commented Apr 5, 2018 via email

@joshbgosh10592
Copy link
Author

joshbgosh10592 commented Apr 6, 2018 •
edited
Loading

I'm glad it's working for you at least. I dumped my firewall and still received no HomePass hits, no matter which MAC I'm using for the AP.
Seems like for some reason my 3DS no longer likes HomePass for some reason.
I may be going to GameStop tomorrow to get the Pikachu 2DS and I'll do a transfer to it, reset the 3DS, and transfer back in a week.

@fatmagic
Copy link

fatmagic commented Apr 7, 2018

Looks like we might be dead in the water here.

My old Spillpass that has been rock solid since HomePass got started years ago - is not giving out any streetpasses.

The last Nintendo Zone is now in NYC - site was quietly updated with the following - http://en-americas-support.nintendo.com/app/answers/detail/a_id/277/~/where-are-nintendo-zones-located%3F

I think Homepass may be over. My last thought is to try the MAC address for that last Nintendo Zone in NYC and see if they are still storing the Streetpass Data for that MAC.

@joshbgosh10592
Copy link
Author

Darnit. Looks like Nintendo killed the Homepass relay system... Check out Homepass.info..

"As of the beginning of April 2018, Nintendo has discontinued the Streetpass Relay system - which has effectively killed HomePass in its' current state. If any further developments are made to the HomePass system (e.g. some sort of Homebrew version), then this sheet will be updated to reflect those changes. But for now it is a sad farewell to one of the best updates Nintendo released for the 3DS. It's been a fun 5 years - so long and thanks for all the passes!"

@fatmagic
Copy link

fatmagic commented May 1, 2018 via email •
edited
Loading

@zigford
Copy link

zigford commented May 3, 2018

Could tools like RaspiPass and @fatmagic spreadsheet be used to create our own relays? Between me and my kids we have 5 3ds in our house. If we could share our Pi mac addresses, can they be used to share streetpasses without Nintendo's involvement?

@fatmagic
Copy link

fatmagic commented May 3, 2018 via email

@joshbgosh10592
Copy link
Author

@fatmagic I didn't know you were that involved in that! That's pretty awesome!
I'm wondering if we could just spoof that remaining Nintendo Zone? Any idea what the AP name is? I saw it was just basically a question mark.

@Pinchie
Copy link
Owner

Pinchie commented May 4, 2018

I saw someone in that thread has access to a still-active point.

There's still a very slim option if we can emulate the data sent to/from the Nintendo services, but that does seem pretty slim. We'd be able to set hosts table entries to send the packets to/from a server of our designing instead of Nintendo's, but there are so many things in the way of getting that working. :(

What we really need is an insider from Nintendo.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@Pinchie @zigford @joshbgosh10592 @fatmagic @ztc0611