LCOV - code coverage report
Current view: top level - src/drivers - driver_nl80211_monitor.c (source / functions) Hit Total Coverage
Test: wpa_supplicant/hostapd combined for hwsim test run 1443382998 Lines: 135 179 75.4 %
Date: 2015-09-27 Functions: 8 8 100.0 %

          Line data    Source code
       1             : /*
       2             :  * Driver interaction with Linux nl80211/cfg80211 - AP monitor interface
       3             :  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
       4             :  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
       5             :  * Copyright (c) 2005-2006, Devicescape Software, Inc.
       6             :  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
       7             :  * Copyright (c) 2009-2010, Atheros Communications
       8             :  *
       9             :  * This software may be distributed under the terms of the BSD license.
      10             :  * See README for more details.
      11             :  */
      12             : 
      13             : #include "includes.h"
      14             : #include <netpacket/packet.h>
      15             : #include <linux/filter.h>
      16             : 
      17             : #include "utils/common.h"
      18             : #include "utils/eloop.h"
      19             : #include "common/ieee802_11_defs.h"
      20             : #include "common/ieee802_11_common.h"
      21             : #include "linux_ioctl.h"
      22             : #include "radiotap_iter.h"
      23             : #include "driver_nl80211.h"
      24             : 
      25             : 
      26          93 : static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
      27             : {
      28             :         struct ieee80211_hdr *hdr;
      29             :         u16 fc;
      30             :         union wpa_event_data event;
      31             : 
      32          93 :         hdr = (struct ieee80211_hdr *) buf;
      33          93 :         fc = le_to_host16(hdr->frame_control);
      34             : 
      35          93 :         os_memset(&event, 0, sizeof(event));
      36          93 :         event.tx_status.type = WLAN_FC_GET_TYPE(fc);
      37          93 :         event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
      38          93 :         event.tx_status.dst = hdr->addr1;
      39          93 :         event.tx_status.data = buf;
      40          93 :         event.tx_status.data_len = len;
      41          93 :         event.tx_status.ack = ok;
      42          93 :         wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
      43          93 : }
      44             : 
      45             : 
      46           1 : static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
      47             :                              u8 *buf, size_t len)
      48             : {
      49           1 :         struct ieee80211_hdr *hdr = (void *)buf;
      50             :         u16 fc;
      51             :         union wpa_event_data event;
      52             : 
      53           1 :         if (len < sizeof(*hdr))
      54           1 :                 return;
      55             : 
      56           1 :         fc = le_to_host16(hdr->frame_control);
      57             : 
      58           1 :         os_memset(&event, 0, sizeof(event));
      59           1 :         event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len);
      60           1 :         event.rx_from_unknown.addr = hdr->addr2;
      61           1 :         event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) ==
      62             :                 (WLAN_FC_FROMDS | WLAN_FC_TODS);
      63           1 :         wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
      64             : }
      65             : 
      66             : 
      67          47 : static void handle_frame(struct wpa_driver_nl80211_data *drv,
      68             :                          u8 *buf, size_t len, int datarate, int ssi_signal)
      69             : {
      70             :         struct ieee80211_hdr *hdr;
      71             :         u16 fc;
      72             :         union wpa_event_data event;
      73             : 
      74          47 :         hdr = (struct ieee80211_hdr *) buf;
      75          47 :         fc = le_to_host16(hdr->frame_control);
      76             : 
      77          47 :         switch (WLAN_FC_GET_TYPE(fc)) {
      78             :         case WLAN_FC_TYPE_MGMT:
      79          46 :                 os_memset(&event, 0, sizeof(event));
      80          46 :                 event.rx_mgmt.frame = buf;
      81          46 :                 event.rx_mgmt.frame_len = len;
      82          46 :                 event.rx_mgmt.datarate = datarate;
      83          46 :                 event.rx_mgmt.ssi_signal = ssi_signal;
      84          46 :                 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
      85          46 :                 break;
      86             :         case WLAN_FC_TYPE_CTRL:
      87             :                 /* can only get here with PS-Poll frames */
      88           0 :                 wpa_printf(MSG_DEBUG, "CTRL");
      89           0 :                 from_unknown_sta(drv, buf, len);
      90           0 :                 break;
      91             :         case WLAN_FC_TYPE_DATA:
      92           1 :                 from_unknown_sta(drv, buf, len);
      93           1 :                 break;
      94             :         }
      95          47 : }
      96             : 
      97             : 
      98         140 : static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
      99             : {
     100         140 :         struct wpa_driver_nl80211_data *drv = eloop_ctx;
     101             :         int len;
     102             :         unsigned char buf[3000];
     103             :         struct ieee80211_radiotap_iterator iter;
     104             :         int ret;
     105         140 :         int datarate = 0, ssi_signal = 0;
     106         140 :         int injected = 0, failed = 0, rxflags = 0;
     107             : 
     108         140 :         len = recv(sock, buf, sizeof(buf), 0);
     109         140 :         if (len < 0) {
     110           0 :                 wpa_printf(MSG_ERROR, "nl80211: Monitor socket recv failed: %s",
     111           0 :                            strerror(errno));
     112           0 :                 return;
     113             :         }
     114             : 
     115         140 :         if (ieee80211_radiotap_iterator_init(&iter, (void *) buf, len, NULL)) {
     116           0 :                 wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame");
     117           0 :                 return;
     118             :         }
     119             : 
     120             :         while (1) {
     121         748 :                 ret = ieee80211_radiotap_iterator_next(&iter);
     122         748 :                 if (ret == -ENOENT)
     123         140 :                         break;
     124         608 :                 if (ret) {
     125           0 :                         wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame (%d)",
     126             :                                    ret);
     127           0 :                         return;
     128             :                 }
     129         608 :                 switch (iter.this_arg_index) {
     130             :                 case IEEE80211_RADIOTAP_FLAGS:
     131          47 :                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
     132           0 :                                 len -= 4;
     133          47 :                         break;
     134             :                 case IEEE80211_RADIOTAP_RX_FLAGS:
     135          47 :                         rxflags = 1;
     136          47 :                         break;
     137             :                 case IEEE80211_RADIOTAP_TX_FLAGS:
     138          93 :                         injected = 1;
     139          93 :                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
     140             :                                         IEEE80211_RADIOTAP_F_TX_FAIL;
     141          93 :                         break;
     142             :                 case IEEE80211_RADIOTAP_DATA_RETRIES:
     143          93 :                         break;
     144             :                 case IEEE80211_RADIOTAP_CHANNEL:
     145             :                         /* TODO: convert from freq/flags to channel number */
     146          47 :                         break;
     147             :                 case IEEE80211_RADIOTAP_RATE:
     148         139 :                         datarate = *iter.this_arg * 5;
     149         139 :                         break;
     150             :                 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
     151          47 :                         ssi_signal = (s8) *iter.this_arg;
     152          47 :                         break;
     153             :                 }
     154         608 :         }
     155             : 
     156         140 :         if (rxflags && injected)
     157           0 :                 return;
     158             : 
     159         140 :         if (!injected)
     160          47 :                 handle_frame(drv, buf + iter._max_length,
     161          47 :                              len - iter._max_length, datarate, ssi_signal);
     162             :         else
     163         186 :                 handle_tx_callback(drv->ctx, buf + iter._max_length,
     164          93 :                                    len - iter._max_length, !failed);
     165             : }
     166             : 
     167             : 
     168             : /*
     169             :  * we post-process the filter code later and rewrite
     170             :  * this to the offset to the last instruction
     171             :  */
     172             : #define PASS    0xFF
     173             : #define FAIL    0xFE
     174             : 
     175             : static struct sock_filter msock_filter_insns[] = {
     176             :         /*
     177             :          * do a little-endian load of the radiotap length field
     178             :          */
     179             :         /* load lower byte into A */
     180             :         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
     181             :         /* put it into X (== index register) */
     182             :         BPF_STMT(BPF_MISC| BPF_TAX, 0),
     183             :         /* load upper byte into A */
     184             :         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
     185             :         /* left-shift it by 8 */
     186             :         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
     187             :         /* or with X */
     188             :         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
     189             :         /* put result into X */
     190             :         BPF_STMT(BPF_MISC| BPF_TAX, 0),
     191             : 
     192             :         /*
     193             :          * Allow management frames through, this also gives us those
     194             :          * management frames that we sent ourselves with status
     195             :          */
     196             :         /* load the lower byte of the IEEE 802.11 frame control field */
     197             :         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
     198             :         /* mask off frame type and version */
     199             :         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
     200             :         /* accept frame if it's both 0, fall through otherwise */
     201             :         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
     202             : 
     203             :         /*
     204             :          * TODO: add a bit to radiotap RX flags that indicates
     205             :          * that the sending station is not associated, then
     206             :          * add a filter here that filters on our DA and that flag
     207             :          * to allow us to deauth frames to that bad station.
     208             :          *
     209             :          * For now allow all To DS data frames through.
     210             :          */
     211             :         /* load the IEEE 802.11 frame control field */
     212             :         BPF_STMT(BPF_LD  | BPF_H | BPF_IND, 0),
     213             :         /* mask off frame type, version and DS status */
     214             :         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
     215             :         /* accept frame if version 0, type 2 and To DS, fall through otherwise
     216             :          */
     217             :         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
     218             : 
     219             : #if 0
     220             :         /*
     221             :          * drop non-data frames
     222             :          */
     223             :         /* load the lower byte of the frame control field */
     224             :         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
     225             :         /* mask off QoS bit */
     226             :         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
     227             :         /* drop non-data frames */
     228             :         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
     229             : #endif
     230             :         /* load the upper byte of the frame control field */
     231             :         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 1),
     232             :         /* mask off toDS/fromDS */
     233             :         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
     234             :         /* accept WDS frames */
     235             :         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, PASS, 0),
     236             : 
     237             :         /*
     238             :          * add header length to index
     239             :          */
     240             :         /* load the lower byte of the frame control field */
     241             :         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
     242             :         /* mask off QoS bit */
     243             :         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
     244             :         /* right shift it by 6 to give 0 or 2 */
     245             :         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
     246             :         /* add data frame header length */
     247             :         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
     248             :         /* add index, was start of 802.11 header */
     249             :         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
     250             :         /* move to index, now start of LL header */
     251             :         BPF_STMT(BPF_MISC | BPF_TAX, 0),
     252             : 
     253             :         /*
     254             :          * Accept empty data frames, we use those for
     255             :          * polling activity.
     256             :          */
     257             :         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
     258             :         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
     259             : 
     260             :         /*
     261             :          * Accept EAPOL frames
     262             :          */
     263             :         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
     264             :         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
     265             :         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
     266             :         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
     267             : 
     268             :         /* keep these last two statements or change the code below */
     269             :         /* return 0 == "DROP" */
     270             :         BPF_STMT(BPF_RET | BPF_K, 0),
     271             :         /* return ~0 == "keep all" */
     272             :         BPF_STMT(BPF_RET | BPF_K, ~0),
     273             : };
     274             : 
     275             : static struct sock_fprog msock_filter = {
     276             :         .len = ARRAY_SIZE(msock_filter_insns),
     277             :         .filter = msock_filter_insns,
     278             : };
     279             : 
     280             : 
     281           7 : static int add_monitor_filter(int s)
     282             : {
     283             :         int idx;
     284             : 
     285             :         /* rewrite all PASS/FAIL jump offsets */
     286         210 :         for (idx = 0; idx < msock_filter.len; idx++) {
     287         203 :                 struct sock_filter *insn = &msock_filter_insns[idx];
     288             : 
     289         203 :                 if (BPF_CLASS(insn->code) == BPF_JMP) {
     290          42 :                         if (insn->code == (BPF_JMP|BPF_JA)) {
     291           0 :                                 if (insn->k == PASS)
     292           0 :                                         insn->k = msock_filter.len - idx - 2;
     293           0 :                                 else if (insn->k == FAIL)
     294           0 :                                         insn->k = msock_filter.len - idx - 3;
     295             :                         }
     296             : 
     297          42 :                         if (insn->jt == PASS)
     298          30 :                                 insn->jt = msock_filter.len - idx - 2;
     299          12 :                         else if (insn->jt == FAIL)
     300           0 :                                 insn->jt = msock_filter.len - idx - 3;
     301             : 
     302          42 :                         if (insn->jf == PASS)
     303           0 :                                 insn->jf = msock_filter.len - idx - 2;
     304          42 :                         else if (insn->jf == FAIL)
     305          12 :                                 insn->jf = msock_filter.len - idx - 3;
     306             :                 }
     307             :         }
     308             : 
     309           7 :         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
     310             :                        &msock_filter, sizeof(msock_filter))) {
     311           0 :                 wpa_printf(MSG_ERROR, "nl80211: setsockopt(SO_ATTACH_FILTER) failed: %s",
     312           0 :                            strerror(errno));
     313           0 :                 return -1;
     314             :         }
     315             : 
     316           7 :         return 0;
     317             : }
     318             : 
     319             : 
     320        2187 : void nl80211_remove_monitor_interface(struct wpa_driver_nl80211_data *drv)
     321             : {
     322        2187 :         if (drv->monitor_refcount > 0)
     323           8 :                 drv->monitor_refcount--;
     324        2187 :         wpa_printf(MSG_DEBUG, "nl80211: Remove monitor interface: refcount=%d",
     325             :                    drv->monitor_refcount);
     326        2187 :         if (drv->monitor_refcount > 0)
     327        2188 :                 return;
     328             : 
     329        2186 :         if (drv->monitor_ifidx >= 0) {
     330           7 :                 nl80211_remove_iface(drv, drv->monitor_ifidx);
     331           7 :                 drv->monitor_ifidx = -1;
     332             :         }
     333        2186 :         if (drv->monitor_sock >= 0) {
     334           7 :                 eloop_unregister_read_sock(drv->monitor_sock);
     335           7 :                 close(drv->monitor_sock);
     336           7 :                 drv->monitor_sock = -1;
     337             :         }
     338             : }
     339             : 
     340             : 
     341           8 : int nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
     342             : {
     343             :         char buf[IFNAMSIZ];
     344             :         struct sockaddr_ll ll;
     345             :         int optval;
     346             :         socklen_t optlen;
     347             : 
     348           8 :         if (drv->monitor_ifidx >= 0) {
     349           1 :                 drv->monitor_refcount++;
     350           1 :                 wpa_printf(MSG_DEBUG, "nl80211: Re-use existing monitor interface: refcount=%d",
     351             :                            drv->monitor_refcount);
     352           1 :                 return 0;
     353             :         }
     354             : 
     355           7 :         if (os_strncmp(drv->first_bss->ifname, "p2p-", 4) == 0) {
     356             :                 /*
     357             :                  * P2P interface name is of the format p2p-%s-%d. For monitor
     358             :                  * interface name corresponding to P2P GO, replace "p2p-" with
     359             :                  * "mon-" to retain the same interface name length and to
     360             :                  * indicate that it is a monitor interface.
     361             :                  */
     362           0 :                 snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss->ifname + 4);
     363             :         } else {
     364             :                 /* Non-P2P interface with AP functionality. */
     365           7 :                 snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss->ifname);
     366             :         }
     367             : 
     368           7 :         buf[IFNAMSIZ - 1] = '\0';
     369             : 
     370           7 :         drv->monitor_ifidx =
     371           7 :                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
     372             :                                      0, NULL, NULL, 0);
     373             : 
     374           7 :         if (drv->monitor_ifidx == -EOPNOTSUPP) {
     375             :                 /*
     376             :                  * This is backward compatibility for a few versions of
     377             :                  * the kernel only that didn't advertise the right
     378             :                  * attributes for the only driver that then supported
     379             :                  * AP mode w/o monitor -- ath6kl.
     380             :                  */
     381           0 :                 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
     382             :                            "monitor interface type - try to run without it");
     383           0 :                 drv->device_ap_sme = 1;
     384             :         }
     385             : 
     386           7 :         if (drv->monitor_ifidx < 0)
     387           0 :                 return -1;
     388             : 
     389           7 :         if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1))
     390           0 :                 goto error;
     391             : 
     392           7 :         memset(&ll, 0, sizeof(ll));
     393           7 :         ll.sll_family = AF_PACKET;
     394           7 :         ll.sll_ifindex = drv->monitor_ifidx;
     395           7 :         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
     396           7 :         if (drv->monitor_sock < 0) {
     397           0 :                 wpa_printf(MSG_ERROR, "nl80211: socket[PF_PACKET,SOCK_RAW] failed: %s",
     398           0 :                            strerror(errno));
     399           0 :                 goto error;
     400             :         }
     401             : 
     402           7 :         if (add_monitor_filter(drv->monitor_sock)) {
     403           0 :                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
     404             :                            "interface; do filtering in user space");
     405             :                 /* This works, but will cost in performance. */
     406             :         }
     407             : 
     408           7 :         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
     409           0 :                 wpa_printf(MSG_ERROR, "nl80211: monitor socket bind failed: %s",
     410           0 :                            strerror(errno));
     411           0 :                 goto error;
     412             :         }
     413             : 
     414           7 :         optlen = sizeof(optval);
     415           7 :         optval = 20;
     416           7 :         if (setsockopt
     417           7 :             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
     418           0 :                 wpa_printf(MSG_ERROR, "nl80211: Failed to set socket priority: %s",
     419           0 :                            strerror(errno));
     420           0 :                 goto error;
     421             :         }
     422             : 
     423           7 :         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
     424             :                                      drv, NULL)) {
     425           0 :                 wpa_printf(MSG_INFO, "nl80211: Could not register monitor read socket");
     426           0 :                 goto error;
     427             :         }
     428             : 
     429           7 :         drv->monitor_refcount++;
     430           7 :         return 0;
     431             :  error:
     432           0 :         nl80211_remove_monitor_interface(drv);
     433           0 :         return -1;
     434             : }
     435             : 
     436             : 
     437         102 : int nl80211_send_monitor(struct wpa_driver_nl80211_data *drv,
     438             :                          const void *data, size_t len,
     439             :                          int encrypt, int noack)
     440             : {
     441         102 :         __u8 rtap_hdr[] = {
     442             :                 0x00, 0x00, /* radiotap version */
     443             :                 0x0e, 0x00, /* radiotap length */
     444             :                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
     445             :                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
     446             :                 0x00,       /* padding */
     447             :                 0x00, 0x00, /* RX and TX flags to indicate that */
     448             :                 0x00, 0x00, /* this is the injected frame directly */
     449             :         };
     450         102 :         struct iovec iov[2] = {
     451             :                 {
     452             :                         .iov_base = &rtap_hdr,
     453             :                         .iov_len = sizeof(rtap_hdr),
     454             :                 },
     455             :                 {
     456             :                         .iov_base = (void *) data,
     457             :                         .iov_len = len,
     458             :                 }
     459             :         };
     460         102 :         struct msghdr msg = {
     461             :                 .msg_name = NULL,
     462             :                 .msg_namelen = 0,
     463             :                 .msg_iov = iov,
     464             :                 .msg_iovlen = 2,
     465             :                 .msg_control = NULL,
     466             :                 .msg_controllen = 0,
     467             :                 .msg_flags = 0,
     468             :         };
     469             :         int res;
     470         102 :         u16 txflags = 0;
     471             : 
     472         102 :         if (encrypt)
     473          42 :                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
     474             : 
     475         102 :         if (drv->monitor_sock < 0) {
     476           0 :                 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
     477             :                            "for %s", __func__);
     478           0 :                 return -1;
     479             :         }
     480             : 
     481         102 :         if (noack)
     482          11 :                 txflags |= IEEE80211_RADIOTAP_F_TX_NOACK;
     483         102 :         WPA_PUT_LE16(&rtap_hdr[12], txflags);
     484             : 
     485         102 :         res = sendmsg(drv->monitor_sock, &msg, 0);
     486         102 :         if (res < 0) {
     487           0 :                 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
     488           0 :                 return -1;
     489             :         }
     490         102 :         return 0;
     491             : }

Generated by: LCOV version 1.10