2 * wpa_supplicant - P2P fuzzer
3 * Copyright (c) 2015, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #include "utils/includes.h"
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
17 static void debug_print(void *ctx, int level, const char *msg)
19 wpa_printf(level, "P2P: %s", msg);
23 static void find_stopped(void *ctx)
28 static int start_listen(void *ctx, unsigned int freq,
29 unsigned int duration,
30 const struct wpabuf *probe_resp_ie)
36 static void stop_listen(void *ctx)
41 static void dev_found(void *ctx, const u8 *addr,
42 const struct p2p_peer_info *info,
48 static void dev_lost(void *ctx, const u8 *dev_addr)
53 static int send_action(void *ctx, unsigned int freq, const u8 *dst,
54 const u8 *src, const u8 *bssid, const u8 *buf,
55 size_t len, unsigned int wait_time)
61 static void send_action_done(void *ctx)
66 static void go_neg_req_rx(void *ctx, const u8 *src, u16 dev_passwd_id)
71 static struct p2p_data * init_p2p(void)
73 struct p2p_config p2p;
75 os_memset(&p2p, 0, sizeof(p2p));
77 p2p.passphrase_len = 8;
78 p2p.channels.reg_classes = 1;
79 p2p.channels.reg_class[0].reg_class = 81;
80 p2p.channels.reg_class[0].channel[0] = 1;
81 p2p.channels.reg_class[0].channel[1] = 2;
82 p2p.channels.reg_class[0].channels = 2;
83 p2p.debug_print = debug_print;
84 p2p.find_stopped = find_stopped;
85 p2p.start_listen = start_listen;
86 p2p.stop_listen = stop_listen;
87 p2p.dev_found = dev_found;
88 p2p.dev_lost = dev_lost;
89 p2p.send_action = send_action;
90 p2p.send_action_done = send_action_done;
91 p2p.go_neg_req_rx = go_neg_req_rx;
93 return p2p_init(&p2p);
103 static void test_send_proberesp(void *eloop_data, void *user_ctx)
105 struct arg_ctx *ctx = eloop_data;
108 struct os_reltime rx_time;
110 wpa_printf(MSG_INFO, "p2p-fuzzer: Send proberesp '%s'", ctx->fname);
112 data = os_readfile(ctx->fname, &len);
114 wpa_printf(MSG_ERROR, "Could not read '%s'", ctx->fname);
118 wpa_hexdump(MSG_MSGDUMP, "fuzzer - IEs", data, len);
120 os_memset(&rx_time, 0, sizeof(rx_time));
121 p2p_scan_res_handler(ctx->p2p, (u8 *) "\x02\x00\x00\x00\x01\x00", 2412,
122 &rx_time, 0, (u8 *) data, len);
123 p2p_scan_res_handled(ctx->p2p);
130 static void test_send_action(void *eloop_data, void *user_ctx)
132 struct arg_ctx *ctx = eloop_data;
135 struct os_reltime rx_time;
136 struct ieee80211_mgmt *mgmt;
138 wpa_printf(MSG_INFO, "p2p-fuzzer: Send action '%s'", ctx->fname);
140 data = os_readfile(ctx->fname, &len);
142 wpa_printf(MSG_ERROR, "Could not read '%s'", ctx->fname);
145 if (len < IEEE80211_HDRLEN + 1)
148 wpa_hexdump(MSG_MSGDUMP, "fuzzer - action", data, len);
150 mgmt = (struct ieee80211_mgmt *) data;
151 os_memset(&rx_time, 0, sizeof(rx_time));
152 p2p_rx_action(ctx->p2p, mgmt->da, mgmt->sa, mgmt->bssid,
153 mgmt->u.action.category,
154 (u8 *) data + IEEE80211_HDRLEN + 1,
155 len - IEEE80211_HDRLEN - 1, 2412);
163 int main(int argc, char *argv[])
165 struct p2p_data *p2p;
168 /* TODO: probreq and wpas_p2p_probe_req_rx() */
171 printf("usage: %s <proberesp|action> <file>\n", argv[0]);
175 if (os_program_init())
179 wpa_debug_show_keys = 1;
182 wpa_printf(MSG_ERROR, "Failed to initialize event loop");
188 wpa_printf(MSG_ERROR, "P2P init failed");
195 if (os_strcmp(argv[1], "proberesp") == 0) {
196 eloop_register_timeout(0, 0, test_send_proberesp, &ctx, NULL);
197 } else if (os_strcmp(argv[1], "action") == 0) {
198 eloop_register_timeout(0, 0, test_send_action, &ctx, NULL);
200 wpa_printf(MSG_ERROR, "Unsupported test type '%s'", argv[1]);
204 wpa_printf(MSG_DEBUG, "Starting eloop");
206 wpa_printf(MSG_DEBUG, "eloop done");