2 * wlantest frame injection
3 * Copyright (c) 2010-2015, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #include "utils/includes.h"
11 #include "utils/common.h"
12 #include "common/defs.h"
13 #include "common/ieee802_11_defs.h"
14 #include "crypto/aes_wrap.h"
18 static int inject_frame(int s, const void *data, size_t len)
20 #define IEEE80211_RADIOTAP_F_FRAG 0x08
21 unsigned char rtap_hdr[] = {
22 0x00, 0x00, /* radiotap version */
23 0x0e, 0x00, /* radiotap length */
24 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
25 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
27 0x00, 0x00, /* RX and TX flags to indicate that */
28 0x00, 0x00, /* this is the injected frame directly */
30 struct iovec iov[2] = {
32 .iov_base = &rtap_hdr,
33 .iov_len = sizeof(rtap_hdr),
36 .iov_base = (void *) data,
51 ret = sendmsg(s, &msg, 0);
53 wpa_printf(MSG_ERROR, "sendmsg: %s", strerror(errno));
58 static int is_robust_mgmt(u8 *frame, size_t len)
60 struct ieee80211_mgmt *mgmt;
64 mgmt = (struct ieee80211_mgmt *) frame;
65 fc = le_to_host16(mgmt->frame_control);
66 if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT)
68 stype = WLAN_FC_GET_STYPE(fc);
69 if (stype == WLAN_FC_STYPE_DEAUTH || stype == WLAN_FC_STYPE_DISASSOC)
71 if (stype == WLAN_FC_STYPE_ACTION) {
74 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC)
81 static int wlantest_inject_bip(struct wlantest *wt, struct wlantest_bss *bss,
82 u8 *frame, size_t len, int incorrect_key)
89 if (!bss->igtk_len[bss->igtk_idx])
92 os_memset(dummy, 0x11, sizeof(dummy));
93 inc_byte_array(bss->ipn[bss->igtk_idx], 6);
95 prot = bip_protect(incorrect_key ? dummy : bss->igtk[bss->igtk_idx],
96 bss->igtk_len[bss->igtk_idx],
97 frame, len, bss->ipn[bss->igtk_idx],
98 bss->igtk_idx, &plen);
103 ret = inject_frame(wt->monitor_sock, prot, plen);
106 return (ret < 0) ? -1 : 0;
110 static int wlantest_inject_prot_bc(struct wlantest *wt,
111 struct wlantest_bss *bss,
112 u8 *frame, size_t len, int incorrect_key)
119 struct ieee80211_hdr *hdr;
123 hdr = (struct ieee80211_hdr *) frame;
125 fc = le_to_host16(hdr->frame_control);
127 if (!bss->gtk_len[bss->gtk_idx])
130 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
131 (WLAN_FC_TODS | WLAN_FC_FROMDS))
133 pn = bss->rsc[bss->gtk_idx];
134 inc_byte_array(pn, 6);
136 os_memset(dummy, 0x11, sizeof(dummy));
137 if (bss->group_cipher == WPA_CIPHER_TKIP)
138 crypt = tkip_encrypt(incorrect_key ? dummy :
139 bss->gtk[bss->gtk_idx],
140 frame, len, hdrlen, NULL, pn,
141 bss->gtk_idx, &crypt_len);
143 crypt = ccmp_encrypt(incorrect_key ? dummy :
144 bss->gtk[bss->gtk_idx],
145 frame, len, hdrlen, NULL, pn,
146 bss->gtk_idx, &crypt_len);
151 ret = inject_frame(wt->monitor_sock, crypt, crypt_len);
154 return (ret < 0) ? -1 : 0;
158 static int wlantest_inject_prot(struct wlantest *wt, struct wlantest_bss *bss,
159 struct wlantest_sta *sta, u8 *frame,
160 size_t len, int incorrect_key)
167 struct ieee80211_hdr *hdr;
172 struct wlantest_tdls *tdls = NULL;
175 hdr = (struct ieee80211_hdr *) frame;
177 fc = le_to_host16(hdr->frame_control);
179 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
180 (fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) == 0) {
181 struct wlantest_sta *sta2;
182 bss = bss_get(wt, hdr->addr3);
184 wpa_printf(MSG_DEBUG, "No BSS found for TDLS "
188 sta = sta_find(bss, hdr->addr2);
189 sta2 = sta_find(bss, hdr->addr1);
190 if (sta == NULL || sta2 == NULL) {
191 wpa_printf(MSG_DEBUG, "No stations found for TDLS "
195 dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list)
197 if ((tdls->init == sta && tdls->resp == sta2) ||
198 (tdls->init == sta2 && tdls->resp == sta)) {
200 wpa_printf(MSG_DEBUG, "TDLS: Link not "
201 "up, but injecting Data "
202 "frame on direct link");
209 if (tk == NULL && sta == NULL) {
210 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
211 return wlantest_inject_bip(wt, bss, frame, len,
213 return wlantest_inject_prot_bc(wt, bss, frame, len,
217 if (tk == NULL && !sta->ptk_set) {
218 wpa_printf(MSG_DEBUG, "No key known for injection");
222 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
224 else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
225 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
226 (WLAN_FC_TODS | WLAN_FC_FROMDS))
228 if (WLAN_FC_GET_STYPE(fc) & 0x08) {
229 qos = frame + hdrlen;
235 if (os_memcmp(hdr->addr2, tdls->init->addr, ETH_ALEN) == 0)
236 pn = tdls->rsc_init[tid];
238 pn = tdls->rsc_resp[tid];
239 } else if (os_memcmp(hdr->addr2, bss->bssid, ETH_ALEN) == 0)
240 pn = sta->rsc_fromds[tid];
242 pn = sta->rsc_tods[tid];
243 inc_byte_array(pn, 6);
245 os_memset(dummy, 0x11, sizeof(dummy));
247 crypt = ccmp_encrypt(incorrect_key ? dummy : tk,
248 frame, len, hdrlen, qos, pn, 0,
250 else if (sta->pairwise_cipher == WPA_CIPHER_TKIP)
251 crypt = tkip_encrypt(incorrect_key ? dummy : sta->ptk.tk,
252 frame, len, hdrlen, qos, pn, 0,
255 crypt = ccmp_encrypt(incorrect_key ? dummy : sta->ptk.tk,
256 frame, len, hdrlen, qos, pn, 0,
260 wpa_printf(MSG_DEBUG, "Frame encryption failed");
264 wpa_hexdump(MSG_DEBUG, "Inject frame (encrypted)", crypt, crypt_len);
265 ret = inject_frame(wt->monitor_sock, crypt, crypt_len);
267 wpa_printf(MSG_DEBUG, "inject_frame for protected frame: %d", ret);
269 return (ret < 0) ? -1 : 0;
273 int wlantest_inject(struct wlantest *wt, struct wlantest_bss *bss,
274 struct wlantest_sta *sta, u8 *frame, size_t len,
275 enum wlantest_inject_protection prot)
278 struct ieee80211_hdr *hdr;
280 int protectable, protect = 0;
282 wpa_hexdump(MSG_DEBUG, "Inject frame", frame, len);
283 if (wt->monitor_sock < 0) {
284 wpa_printf(MSG_INFO, "Cannot inject frames when monitor "
285 "interface is not in use");
289 if (prot != WLANTEST_INJECT_UNPROTECTED && bss == NULL) {
290 wpa_printf(MSG_INFO, "No BSS information to inject "
295 hdr = (struct ieee80211_hdr *) frame;
296 fc = le_to_host16(hdr->frame_control);
297 protectable = WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA ||
298 is_robust_mgmt(frame, len);
300 if ((prot == WLANTEST_INJECT_PROTECTED ||
301 prot == WLANTEST_INJECT_INCORRECT_KEY) && bss) {
303 ((WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
304 !bss->igtk_len[bss->igtk_idx]) ||
305 (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
306 !bss->gtk_len[bss->gtk_idx]))) {
307 wpa_printf(MSG_INFO, "No GTK/IGTK known for "
308 MACSTR " to protect the injected "
309 "frame", MAC2STR(bss->bssid));
312 if (sta && !sta->ptk_set) {
313 wpa_printf(MSG_INFO, "No PTK known for the STA " MACSTR
314 " to encrypt the injected frame",
319 } else if (protectable && prot != WLANTEST_INJECT_UNPROTECTED && bss) {
320 if (sta && sta->ptk_set)
323 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
324 bss->gtk_len[bss->gtk_idx])
326 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
327 bss->igtk_len[bss->igtk_idx])
333 return wlantest_inject_prot(
334 wt, bss, sta, frame, len,
335 prot == WLANTEST_INJECT_INCORRECT_KEY);
337 ret = inject_frame(wt->monitor_sock, frame, len);
338 wpa_printf(MSG_DEBUG, "inject_frame for unprotected frame: %d", ret);
339 return (ret < 0) ? -1 : 0;