1 /*
2  * Driver interaction with Linux nl80211/cfg80211 - AP monitor interface
3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
7  * Copyright (c) 2009-2010, Atheros Communications
8  *
9  * This software may be distributed under the terms of the BSD license.
10  * See README for more details.
11  */
12 
13 #include "includes.h"
14 #include <netpacket/packet.h>
15 #include <linux/filter.h>
16 
17 #include "utils/common.h"
18 #include "utils/eloop.h"
19 #include "common/ieee802_11_defs.h"
20 #include "common/ieee802_11_common.h"
21 #include "linux_ioctl.h"
22 #include "radiotap_iter.h"
23 #include "driver_nl80211.h"
24 
25 
handle_tx_callback(void * ctx,u8 * buf,size_t len,int ok)26 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
27 {
28 	struct ieee80211_hdr *hdr;
29 	u16 fc;
30 	union wpa_event_data event;
31 
32 	hdr = (struct ieee80211_hdr *) buf;
33 	fc = le_to_host16(hdr->frame_control);
34 
35 	os_memset(&event, 0, sizeof(event));
36 	event.tx_status.type = WLAN_FC_GET_TYPE(fc);
37 	event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
38 	event.tx_status.dst = hdr->addr1;
39 	event.tx_status.data = buf;
40 	event.tx_status.data_len = len;
41 	event.tx_status.ack = ok;
42 	wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
43 }
44 
45 
from_unknown_sta(struct wpa_driver_nl80211_data * drv,u8 * buf,size_t len)46 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
47 			     u8 *buf, size_t len)
48 {
49 	struct ieee80211_hdr *hdr = (void *)buf;
50 	u16 fc;
51 	union wpa_event_data event;
52 
53 	if (len < sizeof(*hdr))
54 		return;
55 
56 	fc = le_to_host16(hdr->frame_control);
57 
58 	os_memset(&event, 0, sizeof(event));
59 	event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len);
60 	event.rx_from_unknown.addr = hdr->addr2;
61 	event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) ==
62 		(WLAN_FC_FROMDS | WLAN_FC_TODS);
63 	wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
64 }
65 
66 
handle_frame(struct wpa_driver_nl80211_data * drv,u8 * buf,size_t len,int datarate,int ssi_signal)67 static void handle_frame(struct wpa_driver_nl80211_data *drv,
68 			 u8 *buf, size_t len, int datarate, int ssi_signal)
69 {
70 	struct ieee80211_hdr *hdr;
71 	u16 fc;
72 	union wpa_event_data event;
73 
74 	if (!drv->use_monitor)
75 		return;
76 
77 	hdr = (struct ieee80211_hdr *) buf;
78 	fc = le_to_host16(hdr->frame_control);
79 
80 	switch (WLAN_FC_GET_TYPE(fc)) {
81 	case WLAN_FC_TYPE_MGMT:
82 		os_memset(&event, 0, sizeof(event));
83 		event.rx_mgmt.frame = buf;
84 		event.rx_mgmt.frame_len = len;
85 		event.rx_mgmt.datarate = datarate;
86 		event.rx_mgmt.ssi_signal = ssi_signal;
87 		wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
88 		break;
89 	case WLAN_FC_TYPE_CTRL:
90 		/* can only get here with PS-Poll frames */
91 		wpa_printf(MSG_DEBUG, "CTRL");
92 		from_unknown_sta(drv, buf, len);
93 		break;
94 	case WLAN_FC_TYPE_DATA:
95 		from_unknown_sta(drv, buf, len);
96 		break;
97 	}
98 }
99 
100 
handle_monitor_read(int sock,void * eloop_ctx,void * sock_ctx)101 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
102 {
103 	struct wpa_driver_nl80211_data *drv = eloop_ctx;
104 	int len;
105 	unsigned char buf[3000];
106 	struct ieee80211_radiotap_iterator iter;
107 	int ret;
108 	int datarate = 0, ssi_signal = 0;
109 	int injected = 0, failed = 0, rxflags = 0;
110 
111 	len = recv(sock, buf, sizeof(buf), 0);
112 	if (len < 0) {
113 		wpa_printf(MSG_ERROR, "nl80211: Monitor socket recv failed: %s",
114 			   strerror(errno));
115 		return;
116 	}
117 
118 	if (ieee80211_radiotap_iterator_init(&iter, (void *) buf, len, NULL)) {
119 		wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame");
120 		return;
121 	}
122 
123 	while (1) {
124 		ret = ieee80211_radiotap_iterator_next(&iter);
125 		if (ret == -ENOENT)
126 			break;
127 		if (ret) {
128 			wpa_printf(MSG_INFO, "nl80211: received invalid radiotap frame (%d)",
129 				   ret);
130 			return;
131 		}
132 		switch (iter.this_arg_index) {
133 		case IEEE80211_RADIOTAP_FLAGS:
134 			if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
135 				len -= 4;
136 			break;
137 		case IEEE80211_RADIOTAP_RX_FLAGS:
138 			rxflags = 1;
139 			break;
140 		case IEEE80211_RADIOTAP_TX_FLAGS:
141 			injected = 1;
142 			failed = le_to_host16((*(le16 *) iter.this_arg)) &
143 					IEEE80211_RADIOTAP_F_TX_FAIL;
144 			break;
145 		case IEEE80211_RADIOTAP_DATA_RETRIES:
146 			break;
147 		case IEEE80211_RADIOTAP_CHANNEL:
148 			/* TODO: convert from freq/flags to channel number */
149 			break;
150 		case IEEE80211_RADIOTAP_RATE:
151 			datarate = *iter.this_arg * 5;
152 			break;
153 		case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
154 			ssi_signal = (s8) *iter.this_arg;
155 			break;
156 		}
157 	}
158 
159 	if (rxflags && injected)
160 		return;
161 
162 	if (!injected)
163 		handle_frame(drv, buf + iter._max_length,
164 			     len - iter._max_length, datarate, ssi_signal);
165 	else
166 		handle_tx_callback(drv->ctx, buf + iter._max_length,
167 				   len - iter._max_length, !failed);
168 }
169 
170 
171 /*
172  * we post-process the filter code later and rewrite
173  * this to the offset to the last instruction
174  */
175 #define PASS	0xFF
176 #define FAIL	0xFE
177 
178 static struct sock_filter msock_filter_insns[] = {
179 	/*
180 	 * do a little-endian load of the radiotap length field
181 	 */
182 	/* load lower byte into A */
183 	BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
184 	/* put it into X (== index register) */
185 	BPF_STMT(BPF_MISC| BPF_TAX, 0),
186 	/* load upper byte into A */
187 	BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
188 	/* left-shift it by 8 */
189 	BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
190 	/* or with X */
191 	BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
192 	/* put result into X */
193 	BPF_STMT(BPF_MISC| BPF_TAX, 0),
194 
195 	/*
196 	 * Allow management frames through, this also gives us those
197 	 * management frames that we sent ourselves with status
198 	 */
199 	/* load the lower byte of the IEEE 802.11 frame control field */
200 	BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
201 	/* mask off frame type and version */
202 	BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
203 	/* accept frame if it's both 0, fall through otherwise */
204 	BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
205 
206 	/*
207 	 * TODO: add a bit to radiotap RX flags that indicates
208 	 * that the sending station is not associated, then
209 	 * add a filter here that filters on our DA and that flag
210 	 * to allow us to deauth frames to that bad station.
211 	 *
212 	 * For now allow all To DS data frames through.
213 	 */
214 	/* load the IEEE 802.11 frame control field */
215 	BPF_STMT(BPF_LD  | BPF_H | BPF_IND, 0),
216 	/* mask off frame type, version and DS status */
217 	BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
218 	/* accept frame if version 0, type 2 and To DS, fall through otherwise
219 	 */
220 	BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
221 
222 #if 0
223 	/*
224 	 * drop non-data frames
225 	 */
226 	/* load the lower byte of the frame control field */
227 	BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
228 	/* mask off QoS bit */
229 	BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
230 	/* drop non-data frames */
231 	BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
232 #endif
233 	/* load the upper byte of the frame control field */
234 	BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 1),
235 	/* mask off toDS/fromDS */
236 	BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
237 	/* accept WDS frames */
238 	BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, PASS, 0),
239 
240 	/*
241 	 * add header length to index
242 	 */
243 	/* load the lower byte of the frame control field */
244 	BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
245 	/* mask off QoS bit */
246 	BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
247 	/* right shift it by 6 to give 0 or 2 */
248 	BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
249 	/* add data frame header length */
250 	BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
251 	/* add index, was start of 802.11 header */
252 	BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
253 	/* move to index, now start of LL header */
254 	BPF_STMT(BPF_MISC | BPF_TAX, 0),
255 
256 	/*
257 	 * Accept empty data frames, we use those for
258 	 * polling activity.
259 	 */
260 	BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
261 	BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
262 
263 	/*
264 	 * Accept EAPOL frames
265 	 */
266 	BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
267 	BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
268 	BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
269 	BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
270 
271 	/* keep these last two statements or change the code below */
272 	/* return 0 == "DROP" */
273 	BPF_STMT(BPF_RET | BPF_K, 0),
274 	/* return ~0 == "keep all" */
275 	BPF_STMT(BPF_RET | BPF_K, ~0),
276 };
277 
278 static struct sock_fprog msock_filter = {
279 	.len = ARRAY_SIZE(msock_filter_insns),
280 	.filter = msock_filter_insns,
281 };
282 
283 
add_monitor_filter(int s)284 static int add_monitor_filter(int s)
285 {
286 	int idx;
287 
288 	/* rewrite all PASS/FAIL jump offsets */
289 	for (idx = 0; idx < msock_filter.len; idx++) {
290 		struct sock_filter *insn = &msock_filter_insns[idx];
291 
292 		if (BPF_CLASS(insn->code) == BPF_JMP) {
293 			if (insn->code == (BPF_JMP|BPF_JA)) {
294 				if (insn->k == PASS)
295 					insn->k = msock_filter.len - idx - 2;
296 				else if (insn->k == FAIL)
297 					insn->k = msock_filter.len - idx - 3;
298 			}
299 
300 			if (insn->jt == PASS)
301 				insn->jt = msock_filter.len - idx - 2;
302 			else if (insn->jt == FAIL)
303 				insn->jt = msock_filter.len - idx - 3;
304 
305 			if (insn->jf == PASS)
306 				insn->jf = msock_filter.len - idx - 2;
307 			else if (insn->jf == FAIL)
308 				insn->jf = msock_filter.len - idx - 3;
309 		}
310 	}
311 
312 	if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
313 		       &msock_filter, sizeof(msock_filter))) {
314 		wpa_printf(MSG_ERROR, "nl80211: setsockopt(SO_ATTACH_FILTER) failed: %s",
315 			   strerror(errno));
316 		return -1;
317 	}
318 
319 	return 0;
320 }
321 
322 
nl80211_remove_monitor_interface(struct wpa_driver_nl80211_data * drv)323 void nl80211_remove_monitor_interface(struct wpa_driver_nl80211_data *drv)
324 {
325 	if (drv->monitor_refcount > 0)
326 		drv->monitor_refcount--;
327 	wpa_printf(MSG_DEBUG, "nl80211: Remove monitor interface: refcount=%d",
328 		   drv->monitor_refcount);
329 	if (drv->monitor_refcount > 0)
330 		return;
331 
332 	if (drv->monitor_ifidx >= 0) {
333 		nl80211_remove_iface(drv, drv->monitor_ifidx);
334 		drv->monitor_ifidx = -1;
335 	}
336 	if (drv->monitor_sock >= 0) {
337 		eloop_unregister_read_sock(drv->monitor_sock);
338 		close(drv->monitor_sock);
339 		drv->monitor_sock = -1;
340 	}
341 }
342 
343 
nl80211_create_monitor_interface(struct wpa_driver_nl80211_data * drv)344 int nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
345 {
346 	char buf[IFNAMSIZ];
347 	struct sockaddr_ll ll;
348 	int optval;
349 	socklen_t optlen;
350 
351 	if (drv->monitor_ifidx >= 0) {
352 		drv->monitor_refcount++;
353 		wpa_printf(MSG_DEBUG, "nl80211: Re-use existing monitor interface: refcount=%d",
354 			   drv->monitor_refcount);
355 		return 0;
356 	}
357 
358 	if (os_strncmp(drv->first_bss->ifname, "p2p-", 4) == 0) {
359 		/*
360 		 * P2P interface name is of the format p2p-%s-%d. For monitor
361 		 * interface name corresponding to P2P GO, replace "p2p-" with
362 		 * "mon-" to retain the same interface name length and to
363 		 * indicate that it is a monitor interface.
364 		 */
365 		snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss->ifname + 4);
366 	} else {
367 		int ret;
368 
369 		/* Non-P2P interface with AP functionality. */
370 		ret = os_snprintf(buf, IFNAMSIZ, "mon.%s",
371 				  drv->first_bss->ifname);
372 		if (ret >= (int) sizeof(buf))
373 			wpa_printf(MSG_DEBUG,
374 				   "nl80211: Monitor interface name has been truncated to %s",
375 				   buf);
376 		else if (ret < 0)
377 			return ret;
378 	}
379 
380 	buf[IFNAMSIZ - 1] = '\0';
381 
382 	drv->monitor_ifidx =
383 		nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
384 				     0, NULL, NULL, 0);
385 
386 	if (drv->monitor_ifidx == -EOPNOTSUPP) {
387 		/*
388 		 * This is backward compatibility for a few versions of
389 		 * the kernel only that didn't advertise the right
390 		 * attributes for the only driver that then supported
391 		 * AP mode w/o monitor -- ath6kl.
392 		 */
393 		wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
394 			   "monitor interface type - try to run without it");
395 		drv->device_ap_sme = 1;
396 	}
397 
398 	if (drv->monitor_ifidx < 0)
399 		return -1;
400 
401 	if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1))
402 		goto error;
403 
404 	memset(&ll, 0, sizeof(ll));
405 	ll.sll_family = AF_PACKET;
406 	ll.sll_ifindex = drv->monitor_ifidx;
407 	drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
408 	if (drv->monitor_sock < 0) {
409 		wpa_printf(MSG_ERROR, "nl80211: socket[PF_PACKET,SOCK_RAW] failed: %s",
410 			   strerror(errno));
411 		goto error;
412 	}
413 
414 	if (add_monitor_filter(drv->monitor_sock)) {
415 		wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
416 			   "interface; do filtering in user space");
417 		/* This works, but will cost in performance. */
418 	}
419 
420 	if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
421 		wpa_printf(MSG_ERROR, "nl80211: monitor socket bind failed: %s",
422 			   strerror(errno));
423 		goto error;
424 	}
425 
426 	optlen = sizeof(optval);
427 	optval = 20;
428 	if (setsockopt
429 	    (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
430 		wpa_printf(MSG_ERROR, "nl80211: Failed to set socket priority: %s",
431 			   strerror(errno));
432 		goto error;
433 	}
434 
435 	if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
436 				     drv, NULL)) {
437 		wpa_printf(MSG_INFO, "nl80211: Could not register monitor read socket");
438 		goto error;
439 	}
440 
441 	drv->monitor_refcount++;
442 	return 0;
443  error:
444 	nl80211_remove_monitor_interface(drv);
445 	return -1;
446 }
447 
448 
nl80211_send_monitor(struct wpa_driver_nl80211_data * drv,const void * data,size_t len,int encrypt,int noack)449 int nl80211_send_monitor(struct wpa_driver_nl80211_data *drv,
450 			 const void *data, size_t len,
451 			 int encrypt, int noack)
452 {
453 	__u8 rtap_hdr[] = {
454 		0x00, 0x00, /* radiotap version */
455 		0x0e, 0x00, /* radiotap length */
456 		0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
457 		IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
458 		0x00,       /* padding */
459 		0x00, 0x00, /* RX and TX flags to indicate that */
460 		0x00, 0x00, /* this is the injected frame directly */
461 	};
462 	struct iovec iov[2] = {
463 		{
464 			.iov_base = &rtap_hdr,
465 			.iov_len = sizeof(rtap_hdr),
466 		},
467 		{
468 			.iov_base = (void *) data,
469 			.iov_len = len,
470 		}
471 	};
472 	struct msghdr msg = {
473 		.msg_name = NULL,
474 		.msg_namelen = 0,
475 		.msg_iov = iov,
476 		.msg_iovlen = 2,
477 		.msg_control = NULL,
478 		.msg_controllen = 0,
479 		.msg_flags = 0,
480 	};
481 	int res;
482 	u16 txflags = 0;
483 
484 	if (encrypt)
485 		rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
486 
487 	if (drv->monitor_sock < 0) {
488 		wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
489 			   "for %s", __func__);
490 		return -1;
491 	}
492 
493 	if (noack)
494 		txflags |= IEEE80211_RADIOTAP_F_TX_NOACK;
495 	WPA_PUT_LE16(&rtap_hdr[12], txflags);
496 
497 	res = sendmsg(drv->monitor_sock, &msg, 0);
498 	if (res < 0) {
499 		wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
500 		return -1;
501 	}
502 	return 0;
503 }
504