1 /* 2 * Driver interaction with Linux nl80211/cfg80211 - AP monitor interface 3 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi> 4 * Copyright (c) 2003-2004, Instant802 Networks, Inc. 5 * Copyright (c) 2005-2006, Devicescape Software, Inc. 6 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net> 7 * Copyright (c) 2009-2010, Atheros Communications 8 * 9 * This software may be distributed under the terms of the BSD license. 10 * See README for more details. 11 */ 12 13 #include "includes.h" 14 #include <netpacket/packet.h> 15 #include <linux/filter.h> 16 17 #include "utils/common.h" 18 #include "utils/eloop.h" 19 #include "common/ieee802_11_defs.h" 20 #include "common/ieee802_11_common.h" 21 #include "linux_ioctl.h" 22 #include "radiotap_iter.h" 23 #include "driver_nl80211.h" 24 25 26 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok) 27 { 28 struct ieee80211_hdr *hdr; 29 u16 fc; 30 union wpa_event_data event; 31 32 hdr = (struct ieee80211_hdr *) buf; 33 fc = le_to_host16(hdr->frame_control); 34 35 os_memset(&event, 0, sizeof(event)); 36 event.tx_status.type = WLAN_FC_GET_TYPE(fc); 37 event.tx_status.stype = WLAN_FC_GET_STYPE(fc); 38 event.tx_status.dst = hdr->addr1; 39 event.tx_status.data = buf; 40 event.tx_status.data_len = len; 41 event.tx_status.ack = ok; 42 wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event); 43 } 44 45 46 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv, 47 u8 *buf, size_t len) 48 { 49 struct ieee80211_hdr *hdr = (void *)buf; 50 u16 fc; 51 union wpa_event_data event; 52 53 if (len < sizeof(*hdr)) 54 return; 55 56 fc = le_to_host16(hdr->frame_control); 57 58 os_memset(&event, 0, sizeof(event)); 59 event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len); 60 event.rx_from_unknown.addr = hdr->addr2; 61 event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) == 62 (WLAN_FC_FROMDS | WLAN_FC_TODS); 63 wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event); 64 } 65 66 67 static void handle_frame(struct wpa_driver_nl80211_data *drv, 68 u8 *buf, size_t len, int datarate, int ssi_signal) 69 { 70 struct ieee80211_hdr *hdr; 71 u16 fc; 72 union wpa_event_data event; 73 74 if (!drv->use_monitor) 75 return; 76 77 hdr = (struct ieee80211_hdr *) buf; 78 fc = le_to_host16(hdr->frame_control); 79 80 switch (WLAN_FC_GET_TYPE(fc)) { 81 case WLAN_FC_TYPE_MGMT: 82 os_memset(&event, 0, sizeof(event)); 83 event.rx_mgmt.frame = buf; 84 event.rx_mgmt.frame_len = len; 85 event.rx_mgmt.datarate = datarate; 86 event.rx_mgmt.ssi_signal = ssi_signal; 87 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event); 88 break; 89 case WLAN_FC_TYPE_CTRL: 90 /* can only get here with PS-Poll frames */ 91 wpa_printf(MSG_DEBUG, "CTRL"); 92 from_unknown_sta(drv, buf, len); 93 break; 94 case WLAN_FC_TYPE_DATA: 95 from_unknown_sta(drv, buf, len); 96 break; 97 } 98 } 99 100 101 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx) 102 { 103 struct wpa_driver_nl80211_data *drv = eloop_ctx; 104 int len; 105 unsigned char buf[3000]; 106 struct ieee80211_radiotap_iterator iter; 107 int ret; 108 int datarate = 0, ssi_signal = 0; 109 int injected = 0, failed = 0, rxflags = 0; 110 111 len = recv(sock, buf, sizeof(buf), 0); 112 if (len < 0) { 113 wpa_printf(MSG_ERROR, "nl80211: Monitor socket recv failed: %s", 114 strerror(errno)); 115 return; 116 } 117 118 if (ieee80211_radiotap_iterator_init(&iter, (void *) buf, len, NULL)) { 119 wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame"); 120 return; 121 } 122 123 while (1) { 124 ret = ieee80211_radiotap_iterator_next(&iter); 125 if (ret == -ENOENT) 126 break; 127 if (ret) { 128 wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame (%d)", 129 ret); 130 return; 131 } 132 switch (iter.this_arg_index) { 133 case IEEE80211_RADIOTAP_FLAGS: 134 if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS) 135 len -= 4; 136 break; 137 case IEEE80211_RADIOTAP_RX_FLAGS: 138 rxflags = 1; 139 break; 140 case IEEE80211_RADIOTAP_TX_FLAGS: 141 injected = 1; 142 failed = le_to_host16((*(le16 *) iter.this_arg)) & 143 IEEE80211_RADIOTAP_F_TX_FAIL; 144 break; 145 case IEEE80211_RADIOTAP_DATA_RETRIES: 146 break; 147 case IEEE80211_RADIOTAP_CHANNEL: 148 /* TODO: convert from freq/flags to channel number */ 149 break; 150 case IEEE80211_RADIOTAP_RATE: 151 datarate = *iter.this_arg * 5; 152 break; 153 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL: 154 ssi_signal = (s8) *iter.this_arg; 155 break; 156 } 157 } 158 159 if (rxflags && injected) 160 return; 161 162 if (!injected) 163 handle_frame(drv, buf + iter._max_length, 164 len - iter._max_length, datarate, ssi_signal); 165 else 166 handle_tx_callback(drv->ctx, buf + iter._max_length, 167 len - iter._max_length, !failed); 168 } 169 170 171 /* 172 * we post-process the filter code later and rewrite 173 * this to the offset to the last instruction 174 */ 175 #define PASS 0xFF 176 #define FAIL 0xFE 177 178 static struct sock_filter msock_filter_insns[] = { 179 /* 180 * do a little-endian load of the radiotap length field 181 */ 182 /* load lower byte into A */ 183 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 2), 184 /* put it into X (== index register) */ 185 BPF_STMT(BPF_MISC| BPF_TAX, 0), 186 /* load upper byte into A */ 187 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 3), 188 /* left-shift it by 8 */ 189 BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8), 190 /* or with X */ 191 BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0), 192 /* put result into X */ 193 BPF_STMT(BPF_MISC| BPF_TAX, 0), 194 195 /* 196 * Allow management frames through, this also gives us those 197 * management frames that we sent ourselves with status 198 */ 199 /* load the lower byte of the IEEE 802.11 frame control field */ 200 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), 201 /* mask off frame type and version */ 202 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF), 203 /* accept frame if it's both 0, fall through otherwise */ 204 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0), 205 206 /* 207 * TODO: add a bit to radiotap RX flags that indicates 208 * that the sending station is not associated, then 209 * add a filter here that filters on our DA and that flag 210 * to allow us to deauth frames to that bad station. 211 * 212 * For now allow all To DS data frames through. 213 */ 214 /* load the IEEE 802.11 frame control field */ 215 BPF_STMT(BPF_LD | BPF_H | BPF_IND, 0), 216 /* mask off frame type, version and DS status */ 217 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03), 218 /* accept frame if version 0, type 2 and To DS, fall through otherwise 219 */ 220 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0), 221 222 #if 0 223 /* 224 * drop non-data frames 225 */ 226 /* load the lower byte of the frame control field */ 227 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), 228 /* mask off QoS bit */ 229 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0c), 230 /* drop non-data frames */ 231 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 8, 0, FAIL), 232 #endif 233 /* load the upper byte of the frame control field */ 234 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 1), 235 /* mask off toDS/fromDS */ 236 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x03), 237 /* accept WDS frames */ 238 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 3, PASS, 0), 239 240 /* 241 * add header length to index 242 */ 243 /* load the lower byte of the frame control field */ 244 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), 245 /* mask off QoS bit */ 246 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x80), 247 /* right shift it by 6 to give 0 or 2 */ 248 BPF_STMT(BPF_ALU | BPF_RSH | BPF_K, 6), 249 /* add data frame header length */ 250 BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 24), 251 /* add index, was start of 802.11 header */ 252 BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0), 253 /* move to index, now start of LL header */ 254 BPF_STMT(BPF_MISC | BPF_TAX, 0), 255 256 /* 257 * Accept empty data frames, we use those for 258 * polling activity. 259 */ 260 BPF_STMT(BPF_LD | BPF_W | BPF_LEN, 0), 261 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0), 262 263 /* 264 * Accept EAPOL frames 265 */ 266 BPF_STMT(BPF_LD | BPF_W | BPF_IND, 0), 267 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL), 268 BPF_STMT(BPF_LD | BPF_W | BPF_IND, 4), 269 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL), 270 271 /* keep these last two statements or change the code below */ 272 /* return 0 == "DROP" */ 273 BPF_STMT(BPF_RET | BPF_K, 0), 274 /* return ~0 == "keep all" */ 275 BPF_STMT(BPF_RET | BPF_K, ~0), 276 }; 277 278 static struct sock_fprog msock_filter = { 279 .len = ARRAY_SIZE(msock_filter_insns), 280 .filter = msock_filter_insns, 281 }; 282 283 284 static int add_monitor_filter(int s) 285 { 286 int idx; 287 288 /* rewrite all PASS/FAIL jump offsets */ 289 for (idx = 0; idx < msock_filter.len; idx++) { 290 struct sock_filter *insn = &msock_filter_insns[idx]; 291 292 if (BPF_CLASS(insn->code) == BPF_JMP) { 293 if (insn->code == (BPF_JMP|BPF_JA)) { 294 if (insn->k == PASS) 295 insn->k = msock_filter.len - idx - 2; 296 else if (insn->k == FAIL) 297 insn->k = msock_filter.len - idx - 3; 298 } 299 300 if (insn->jt == PASS) 301 insn->jt = msock_filter.len - idx - 2; 302 else if (insn->jt == FAIL) 303 insn->jt = msock_filter.len - idx - 3; 304 305 if (insn->jf == PASS) 306 insn->jf = msock_filter.len - idx - 2; 307 else if (insn->jf == FAIL) 308 insn->jf = msock_filter.len - idx - 3; 309 } 310 } 311 312 if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, 313 &msock_filter, sizeof(msock_filter))) { 314 wpa_printf(MSG_ERROR, "nl80211: setsockopt(SO_ATTACH_FILTER) failed: %s", 315 strerror(errno)); 316 return -1; 317 } 318 319 return 0; 320 } 321 322 323 void nl80211_remove_monitor_interface(struct wpa_driver_nl80211_data *drv) 324 { 325 if (drv->monitor_refcount > 0) 326 drv->monitor_refcount--; 327 wpa_printf(MSG_DEBUG, "nl80211: Remove monitor interface: refcount=%d", 328 drv->monitor_refcount); 329 if (drv->monitor_refcount > 0) 330 return; 331 332 if (drv->monitor_ifidx >= 0) { 333 nl80211_remove_iface(drv, drv->monitor_ifidx); 334 drv->monitor_ifidx = -1; 335 } 336 if (drv->monitor_sock >= 0) { 337 eloop_unregister_read_sock(drv->monitor_sock); 338 close(drv->monitor_sock); 339 drv->monitor_sock = -1; 340 } 341 } 342 343 344 int nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv) 345 { 346 char buf[IFNAMSIZ]; 347 struct sockaddr_ll ll; 348 int optval; 349 socklen_t optlen; 350 351 if (drv->monitor_ifidx >= 0) { 352 drv->monitor_refcount++; 353 wpa_printf(MSG_DEBUG, "nl80211: Re-use existing monitor interface: refcount=%d", 354 drv->monitor_refcount); 355 return 0; 356 } 357 358 if (os_strncmp(drv->first_bss->ifname, "p2p-", 4) == 0) { 359 /* 360 * P2P interface name is of the format p2p-%s-%d. For monitor 361 * interface name corresponding to P2P GO, replace "p2p-" with 362 * "mon-" to retain the same interface name length and to 363 * indicate that it is a monitor interface. 364 */ 365 snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss->ifname + 4); 366 } else { 367 int ret; 368 369 /* Non-P2P interface with AP functionality. */ 370 ret = os_snprintf(buf, IFNAMSIZ, "mon.%s", 371 drv->first_bss->ifname); 372 if (ret >= (int) sizeof(buf)) 373 wpa_printf(MSG_DEBUG, 374 "nl80211: Monitor interface name has been truncated to %s", 375 buf); 376 else if (ret < 0) 377 return ret; 378 } 379 380 buf[IFNAMSIZ - 1] = '\0'; 381 382 drv->monitor_ifidx = 383 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL, 384 0, NULL, NULL, 0); 385 386 if (drv->monitor_ifidx == -EOPNOTSUPP) { 387 /* 388 * This is backward compatibility for a few versions of 389 * the kernel only that didn't advertise the right 390 * attributes for the only driver that then supported 391 * AP mode w/o monitor -- ath6kl. 392 */ 393 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support " 394 "monitor interface type - try to run without it"); 395 drv->device_ap_sme = 1; 396 } 397 398 if (drv->monitor_ifidx < 0) 399 return -1; 400 401 if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1)) 402 goto error; 403 404 memset(&ll, 0, sizeof(ll)); 405 ll.sll_family = AF_PACKET; 406 ll.sll_ifindex = drv->monitor_ifidx; 407 drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); 408 if (drv->monitor_sock < 0) { 409 wpa_printf(MSG_ERROR, "nl80211: socket[PF_PACKET,SOCK_RAW] failed: %s", 410 strerror(errno)); 411 goto error; 412 } 413 414 if (add_monitor_filter(drv->monitor_sock)) { 415 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor " 416 "interface; do filtering in user space"); 417 /* This works, but will cost in performance. */ 418 } 419 420 if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) { 421 wpa_printf(MSG_ERROR, "nl80211: monitor socket bind failed: %s", 422 strerror(errno)); 423 goto error; 424 } 425 426 optlen = sizeof(optval); 427 optval = 20; 428 if (setsockopt 429 (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) { 430 wpa_printf(MSG_ERROR, "nl80211: Failed to set socket priority: %s", 431 strerror(errno)); 432 goto error; 433 } 434 435 if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read, 436 drv, NULL)) { 437 wpa_printf(MSG_INFO, "nl80211: Could not register monitor read socket"); 438 goto error; 439 } 440 441 drv->monitor_refcount++; 442 return 0; 443 error: 444 nl80211_remove_monitor_interface(drv); 445 return -1; 446 } 447 448 449 int nl80211_send_monitor(struct wpa_driver_nl80211_data *drv, 450 const void *data, size_t len, 451 int encrypt, int noack) 452 { 453 __u8 rtap_hdr[] = { 454 0x00, 0x00, /* radiotap version */ 455 0x0e, 0x00, /* radiotap length */ 456 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */ 457 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */ 458 0x00, /* padding */ 459 0x00, 0x00, /* RX and TX flags to indicate that */ 460 0x00, 0x00, /* this is the injected frame directly */ 461 }; 462 struct iovec iov[2] = { 463 { 464 .iov_base = &rtap_hdr, 465 .iov_len = sizeof(rtap_hdr), 466 }, 467 { 468 .iov_base = (void *) data, 469 .iov_len = len, 470 } 471 }; 472 struct msghdr msg = { 473 .msg_name = NULL, 474 .msg_namelen = 0, 475 .msg_iov = iov, 476 .msg_iovlen = 2, 477 .msg_control = NULL, 478 .msg_controllen = 0, 479 .msg_flags = 0, 480 }; 481 int res; 482 u16 txflags = 0; 483 484 if (encrypt) 485 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP; 486 487 if (drv->monitor_sock < 0) { 488 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available " 489 "for %s", __func__); 490 return -1; 491 } 492 493 if (noack) 494 txflags |= IEEE80211_RADIOTAP_F_TX_NOACK; 495 WPA_PUT_LE16(&rtap_hdr[12], txflags); 496 497 res = sendmsg(drv->monitor_sock, &msg, 0); 498 if (res < 0) { 499 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno)); 500 return -1; 501 } 502 return 0; 503 } 504