wlantest/inject.c

   1 /*
   2  * wlantest frame injection
   3  * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "common/defs.h"
  13 #include "common/ieee802_11_defs.h"
  14 #include "crypto/aes_wrap.h"
  15 #include "wlantest.h"
  16
  17
  18 static int inject_frame(int s, const void *data, size_t len)
  19 {
  20 #define IEEE80211_RADIOTAP_F_FRAG       0x08
  21         unsigned char rtap_hdr[] = {
  22                 0x00, 0x00, /* radiotap version */
  23                 0x0e, 0x00, /* radiotap length */
  24                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
  25                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
  26                 0x00,       /* padding */
  27                 0x00, 0x00, /* RX and TX flags to indicate that */
  28                 0x00, 0x00, /* this is the injected frame directly */
  29         };
  30         struct iovec iov[2] = {
  31                 {
  32                         .iov_base = &rtap_hdr,
  33                         .iov_len = sizeof(rtap_hdr),
  34                 },
  35                 {
  36                         .iov_base = (void *) data,
  37                         .iov_len = len,
  38                 }
  39         };
  40         struct msghdr msg = {
  41                 .msg_name = NULL,
  42                 .msg_namelen = 0,
  43                 .msg_iov = iov,
  44                 .msg_iovlen = 2,
  45                 .msg_control = NULL,
  46                 .msg_controllen = 0,
  47                 .msg_flags = 0,
  48         };
  49         int ret;
  50
  51         ret = sendmsg(s, &msg, 0);
  52         if (ret < 0)
  53                 perror("sendmsg");
  54         return ret;
  55 }
  56
  57
  58 static int is_robust_mgmt(u8 *frame, size_t len)
  59 {
  60         struct ieee80211_mgmt *mgmt;
  61         u16 fc, stype;
  62         if (len < 24)
  63                 return 0;
  64         mgmt = (struct ieee80211_mgmt *) frame;
  65         fc = le_to_host16(mgmt->frame_control);
  66         if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT)
  67                 return 0;
  68         stype = WLAN_FC_GET_STYPE(fc);
  69         if (stype == WLAN_FC_STYPE_DEAUTH || stype == WLAN_FC_STYPE_DISASSOC)
  70                 return 1;
  71         if (stype == WLAN_FC_STYPE_ACTION) {
  72                 if (len < 25)
  73                         return 0;
  74                 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC)
  75                         return 1;
  76         }
  77         return 0;
  78 }
  79
  80
  81 static int wlantest_inject_bip(struct wlantest *wt, struct wlantest_bss *bss,
  82                                u8 *frame, size_t len, int incorrect_key)
  83 {
  84         u8 *prot;
  85         u8 dummy[16];
  86         int ret;
  87         size_t plen;
  88
  89         if (!bss->igtk_set[bss->igtk_idx])
  90                 return -1;
  91
  92         os_memset(dummy, 0x11, sizeof(dummy));
  93         inc_byte_array(bss->ipn[bss->igtk_idx], 6);
  94
  95         prot = bip_protect(incorrect_key ? dummy : bss->igtk[bss->igtk_idx],
  96                            frame, len, bss->ipn[bss->igtk_idx],
  97                            bss->igtk_idx, &plen);
  98         if (prot == NULL)
  99                 return -1;
 100
 101
 102         ret = inject_frame(wt->monitor_sock, prot, plen);
 103         os_free(prot);
 104
 105         return (ret < 0) ? -1 : 0;
 106 }
 107
 108
 109 static int wlantest_inject_prot_bc(struct wlantest *wt,
 110                                    struct wlantest_bss *bss,
 111                                    u8 *frame, size_t len, int incorrect_key)
 112 {
 113         u8 *crypt;
 114         size_t crypt_len;
 115         int ret;
 116         u8 dummy[64];
 117         u8 *pn;
 118         struct ieee80211_hdr *hdr;
 119         u16 fc;
 120         int hdrlen;
 121
 122         hdr = (struct ieee80211_hdr *) frame;
 123         hdrlen = 24;
 124         fc = le_to_host16(hdr->frame_control);
 125
 126         if (!bss->gtk_len[bss->gtk_idx])
 127                 return -1;
 128
 129         if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
 130             (WLAN_FC_TODS | WLAN_FC_FROMDS))
 131                 hdrlen += ETH_ALEN;
 132         pn = bss->rsc[bss->gtk_idx];
 133         inc_byte_array(pn, 6);
 134
 135         os_memset(dummy, 0x11, sizeof(dummy));
 136         if (bss->group_cipher == WPA_CIPHER_TKIP)
 137                 crypt = tkip_encrypt(incorrect_key ? dummy :
 138                                      bss->gtk[bss->gtk_idx],
 139                                      frame, len, hdrlen, NULL, pn,
 140                                      bss->gtk_idx, &crypt_len);
 141         else
 142                 crypt = ccmp_encrypt(incorrect_key ? dummy :
 143                                      bss->gtk[bss->gtk_idx],
 144                                      frame, len, hdrlen, NULL, pn,
 145                                      bss->gtk_idx, &crypt_len);
 146
 147         if (crypt == NULL)
 148                 return -1;
 149
 150         ret = inject_frame(wt->monitor_sock, crypt, crypt_len);
 151         os_free(crypt);
 152
 153         return (ret < 0) ? -1 : 0;
 154 }
 155
 156
 157 static int wlantest_inject_prot(struct wlantest *wt, struct wlantest_bss *bss,
 158                                 struct wlantest_sta *sta, u8 *frame,
 159                                 size_t len, int incorrect_key)
 160 {
 161         u8 *crypt;
 162         size_t crypt_len;
 163         int ret;
 164         u8 dummy[64];
 165         u8 *pn;
 166         struct ieee80211_hdr *hdr;
 167         u16 fc;
 168         int tid = 0;
 169         u8 *qos = NULL;
 170         int hdrlen;
 171         struct wlantest_tdls *tdls = NULL;
 172         const u8 *tk = NULL;
 173
 174         hdr = (struct ieee80211_hdr *) frame;
 175         hdrlen = 24;
 176         fc = le_to_host16(hdr->frame_control);
 177
 178         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
 179             (fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) == 0) {
 180                 struct wlantest_sta *sta2;
 181                 bss = bss_get(wt, hdr->addr3);
 182                 if (bss == NULL) {
 183                         wpa_printf(MSG_DEBUG, "No BSS found for TDLS "
 184                                    "injection");
 185                         return -1;
 186                 }
 187                 sta = sta_find(bss, hdr->addr2);
 188                 sta2 = sta_find(bss, hdr->addr1);
 189                 if (sta == NULL || sta2 == NULL) {
 190                         wpa_printf(MSG_DEBUG, "No stations found for TDLS "
 191                                    "injection");
 192                         return -1;
 193                 }
 194                 dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list)
 195                 {
 196                         if ((tdls->init == sta && tdls->resp == sta2) ||
 197                             (tdls->init == sta2 && tdls->resp == sta)) {
 198                                 if (!tdls->link_up)
 199                                         wpa_printf(MSG_DEBUG, "TDLS: Link not "
 200                                                    "up, but injecting Data "
 201                                                    "frame on direct link");
 202                                 tk = tdls->tpk.tk;
 203                                 break;
 204                         }
 205                 }
 206         }
 207
 208         if (tk == NULL && sta == NULL) {
 209                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
 210                         return wlantest_inject_bip(wt, bss, frame, len,
 211                                                    incorrect_key);
 212                 return wlantest_inject_prot_bc(wt, bss, frame, len,
 213                                                incorrect_key);
 214         }
 215
 216         if (tk == NULL && !sta->ptk_set) {
 217                 wpa_printf(MSG_DEBUG, "No key known for injection");
 218                 return -1;
 219         }
 220
 221         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
 222                 tid = 16;
 223         else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
 224                 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
 225                     (WLAN_FC_TODS | WLAN_FC_FROMDS))
 226                         hdrlen += ETH_ALEN;
 227                 if (WLAN_FC_GET_STYPE(fc) & 0x08) {
 228                         qos = frame + hdrlen;
 229                         hdrlen += 2;
 230                         tid = qos[0] & 0x0f;
 231                 }
 232         }
 233         if (tk) {
 234                 if (os_memcmp(hdr->addr2, tdls->init->addr, ETH_ALEN) == 0)
 235                         pn = tdls->rsc_init[tid];
 236                 else
 237                         pn = tdls->rsc_resp[tid];
 238         } else if (os_memcmp(hdr->addr2, bss->bssid, ETH_ALEN) == 0)
 239                 pn = sta->rsc_fromds[tid];
 240         else
 241                 pn = sta->rsc_tods[tid];
 242         inc_byte_array(pn, 6);
 243
 244         os_memset(dummy, 0x11, sizeof(dummy));
 245         if (tk)
 246                 crypt = ccmp_encrypt(incorrect_key ? dummy : tk,
 247                                      frame, len, hdrlen, qos, pn, 0,
 248                                      &crypt_len);
 249         else if (sta->pairwise_cipher == WPA_CIPHER_TKIP)
 250                 crypt = tkip_encrypt(incorrect_key ? dummy : sta->ptk.tk1,
 251                                      frame, len, hdrlen, qos, pn, 0,
 252                                      &crypt_len);
 253         else
 254                 crypt = ccmp_encrypt(incorrect_key ? dummy : sta->ptk.tk1,
 255                                      frame, len, hdrlen, qos, pn, 0,
 256                                      &crypt_len);
 257
 258         if (crypt == NULL) {
 259                 wpa_printf(MSG_DEBUG, "Frame encryption failed");
 260                 return -1;
 261         }
 262
 263         wpa_hexdump(MSG_DEBUG, "Inject frame (encrypted)", crypt, crypt_len);
 264         ret = inject_frame(wt->monitor_sock, crypt, crypt_len);
 265         os_free(crypt);
 266         wpa_printf(MSG_DEBUG, "inject_frame for protected frame: %d", ret);
 267
 268         return (ret < 0) ? -1 : 0;
 269 }
 270
 271
 272 int wlantest_inject(struct wlantest *wt, struct wlantest_bss *bss,
 273                     struct wlantest_sta *sta, u8 *frame, size_t len,
 274                     enum wlantest_inject_protection prot)
 275 {
 276         int ret;
 277         struct ieee80211_hdr *hdr;
 278         u16 fc;
 279         int protectable, protect = 0;
 280
 281         wpa_hexdump(MSG_DEBUG, "Inject frame", frame, len);
 282         if (wt->monitor_sock < 0) {
 283                 wpa_printf(MSG_INFO, "Cannot inject frames when monitor "
 284                            "interface is not in use");
 285                 return -1;
 286         }
 287
 288         if (prot != WLANTEST_INJECT_UNPROTECTED && bss == NULL) {
 289                 wpa_printf(MSG_INFO, "No BSS information to inject "
 290                            "protected frames");
 291                 return -1;
 292         }
 293
 294         hdr = (struct ieee80211_hdr *) frame;
 295         fc = le_to_host16(hdr->frame_control);
 296         protectable = WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA ||
 297                 is_robust_mgmt(frame, len);
 298
 299         if ((prot == WLANTEST_INJECT_PROTECTED ||
 300              prot == WLANTEST_INJECT_INCORRECT_KEY) && bss) {
 301                 if (!sta &&
 302                     ((WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
 303                       !bss->igtk_set[bss->igtk_idx]) ||
 304                      (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
 305                       !bss->gtk_len[bss->gtk_idx]))) {
 306                         wpa_printf(MSG_INFO, "No GTK/IGTK known for "
 307                                    MACSTR " to protect the injected "
 308                                    "frame", MAC2STR(bss->bssid));
 309                         return -1;
 310                 }
 311                 if (sta && !sta->ptk_set) {
 312                         wpa_printf(MSG_INFO, "No PTK known for the STA " MACSTR
 313                                    " to encrypt the injected frame",
 314                                    MAC2STR(sta->addr));
 315                         return -1;
 316                 }
 317                 protect = 1;
 318         } else if (protectable && prot != WLANTEST_INJECT_UNPROTECTED && bss) {
 319                 if (sta && sta->ptk_set)
 320                         protect = 1;
 321                 else if (!sta) {
 322                         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
 323                             bss->gtk_len[bss->gtk_idx])
 324                                 protect = 1;
 325                         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
 326                             bss->igtk_set[bss->igtk_idx])
 327                                 protect = 1;
 328                 }
 329         }
 330
 331         if (protect && bss)
 332                 return wlantest_inject_prot(
 333                         wt, bss, sta, frame, len,
 334                         prot == WLANTEST_INJECT_INCORRECT_KEY);
 335
 336         ret = inject_frame(wt->monitor_sock, frame, len);
 337         wpa_printf(MSG_DEBUG, "inject_frame for unprotected frame: %d", ret);
 338         return (ret < 0) ? -1 : 0;
 339 }