1 /*- 2 * Copyright (c) 2006, Andrea Bittau <a.bittau@cs.ucl.ac.uk> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 * 26 * $FreeBSD: src/tools/tools/net80211/wlaninject/wlaninject.c,v 1.3 2009/07/24 15:31:22 sam Exp $ 27 */ 28 #include <stdlib.h> 29 #include <stdio.h> 30 #include <errno.h> 31 #include <err.h> 32 #include <fcntl.h> 33 #include <unistd.h> 34 #include <sys/types.h> 35 #include <sys/time.h> 36 #include <sys/ioctl.h> 37 #include <sys/uio.h> 38 #include <net/bpf.h> 39 #include <sys/socket.h> 40 #include <net/if.h> 41 #include <net/if_media.h> 42 #include <string.h> 43 #include <netproto/802_11/ieee80211.h> 44 #include <netproto/802_11/ieee80211_ioctl.h> 45 #include <netproto/802_11/ieee80211_dragonfly.h> 46 #include <netproto/802_11/ieee80211_radiotap.h> 47 #include <sys/endian.h> 48 #include <assert.h> 49 50 void setup_if(char *dev, int chan) { 51 int s; 52 struct ifreq ifr; 53 unsigned int flags; 54 struct ifmediareq ifmr; 55 int *mwords; 56 struct ieee80211req ireq; 57 58 if ((s = socket(PF_INET, SOCK_DGRAM, 0)) == -1) 59 err(1, "socket()"); 60 61 /* chan */ 62 memset(&ireq, 0, sizeof(ireq)); 63 snprintf(ireq.i_name, sizeof(ireq.i_name), "%s", dev); 64 ireq.i_type = IEEE80211_IOC_CHANNEL; 65 ireq.i_val = chan; 66 if (ioctl(s, SIOCS80211, &ireq) == -1) 67 err(1, "ioctl(SIOCS80211)"); 68 69 /* UP & PROMISC */ 70 memset(&ifr, 0, sizeof(ifr)); 71 snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s", dev); 72 if (ioctl(s, SIOCGIFFLAGS, &ifr) == -1) 73 err(1, "ioctl(SIOCGIFFLAGS)"); 74 flags = (ifr.ifr_flags & 0xffff) | (ifr.ifr_flagshigh << 16); 75 flags |= IFF_UP | IFF_PPROMISC; 76 ifr.ifr_flags = flags & 0xffff; 77 ifr.ifr_flagshigh = flags >> 16; 78 if (ioctl(s, SIOCSIFFLAGS, &ifr) == -1) 79 err(1, "ioctl(SIOCSIFFLAGS)"); 80 81 close(s); 82 } 83 84 int open_bpf(char *dev) 85 { 86 char buf[64]; 87 int i; 88 int fd; 89 struct ifreq ifr; 90 unsigned int dlt = DLT_IEEE802_11_RADIO; 91 92 for (i = 0; i < 64; i++) { 93 sprintf(buf, "/dev/bpf%d", i); 94 95 fd = open(buf, O_RDWR); 96 if (fd != -1) 97 break; 98 else if (errno != EBUSY) 99 err(1, "open()"); 100 } 101 if (fd == -1) { 102 printf("Can't find bpf\n"); 103 exit(1); 104 } 105 106 memset(&ifr, 0, sizeof(ifr)); 107 snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%s", dev); 108 if (ioctl(fd, BIOCSETIF, &ifr) == -1) 109 err(1, "ioctl(BIOCSETIF)"); 110 111 if (ioctl(fd, BIOCSDLT, &dlt) == -1) 112 err(1, "ioctl(BIOCSDLT)"); 113 114 i = 1; 115 if (ioctl(fd, BIOCIMMEDIATE, &i) == -1) 116 err(1, "ioctl(BIOCIMMEDIATE)"); 117 118 return fd; 119 } 120 121 void inject(int fd, void *buf, int buflen, struct ieee80211_bpf_params *p) 122 { 123 struct iovec iov[2]; 124 int totlen; 125 int rc; 126 127 iov[0].iov_base = p; 128 iov[0].iov_len = p->ibp_len; 129 130 iov[1].iov_base = buf; 131 iov[1].iov_len = buflen; 132 totlen = iov[0].iov_len + iov[1].iov_len; 133 134 rc = writev(fd, iov, sizeof(iov)/sizeof(struct iovec)); 135 if (rc == -1) 136 err(1, "writev()"); 137 if (rc != totlen) { 138 printf("Wrote only %d/%d\n", rc, totlen); 139 exit(1); 140 } 141 } 142 143 void usage(char *progname) 144 { 145 printf("Usage: %s <opts>\n" 146 "Physical:\n" 147 "\t-i\t<iface>\n" 148 "\t-c\t<chan>\n" 149 "\t-N\tno ack\n" 150 "\t-V\t<iface> [verify via iface whether packet was mangled]\n" 151 "\t-W\tWME AC\n" 152 "\t-X\ttransmit rate (Mbps)\n" 153 "\t-P\ttransmit power (device units)\n" 154 "802.11:\n" 155 "\t-h\tthis lame message\n" 156 "\t-v\t<version>\n" 157 "\t-t\t<type>\n" 158 "\t-s\t<subtype>\n" 159 "\t-T\tto ds\n" 160 "\t-F\tfrom ds\n" 161 "\t-m\tmore frags\n" 162 "\t-r\tretry\n" 163 "\t-p\tpower\n" 164 "\t-d\tmore data\n" 165 "\t-w\twep\n" 166 "\t-o\torder\n" 167 "\t-u\t<duration>\n" 168 "\t-1\t<addr 1>\n" 169 "\t-2\t<addr 2>\n" 170 "\t-3\t<addr 3>\n" 171 "\t-n\t<seqno>\n" 172 "\t-f\t<fragno>\n" 173 "\t-4\t<addr 4>\n" 174 "\t-b\t<payload file>\n" 175 "\t-l\t<len>\n" 176 "Management:\n" 177 "\t-e\t<info element [hex digits 010203... first is type]>\n" 178 "\t-S\t<SSID>\n" 179 "\t-a\t<algo no>\n" 180 "\t-A\t<transaction>\n" 181 "\t-C\t<status code>\n" 182 "\t-R\tstandard rates\n" 183 , progname); 184 exit(1); 185 } 186 187 int str2type(const char *type) 188 { 189 #define equal(a,b) (strcasecmp(a,b) == 0) 190 if (equal(type, "mgt")) 191 return IEEE80211_FC0_TYPE_MGT >> IEEE80211_FC0_TYPE_SHIFT; 192 else if (equal(type, "ctl")) 193 return IEEE80211_FC0_TYPE_CTL >> IEEE80211_FC0_TYPE_SHIFT; 194 else if (equal(type, "data")) 195 return IEEE80211_FC0_TYPE_DATA >> IEEE80211_FC0_TYPE_SHIFT; 196 197 return atoi(type) & 3; 198 #undef equal 199 } 200 201 int str2subtype(const char *subtype) 202 { 203 #define equal(a,b) (strcasecmp(a,b) == 0) 204 if (equal(subtype, "preq") || equal(subtype, "probereq")) 205 return IEEE80211_FC0_SUBTYPE_PROBE_REQ >> 206 IEEE80211_FC0_SUBTYPE_SHIFT; 207 else if (equal(subtype, "auth")) 208 return IEEE80211_FC0_SUBTYPE_AUTH >> 209 IEEE80211_FC0_SUBTYPE_SHIFT; 210 else if (equal(subtype, "areq") || equal(subtype, "assocreq")) 211 return IEEE80211_FC0_SUBTYPE_ASSOC_REQ >> 212 IEEE80211_FC0_SUBTYPE_SHIFT; 213 else if (equal(subtype, "data")) 214 return IEEE80211_FC0_SUBTYPE_DATA >> 215 IEEE80211_FC0_SUBTYPE_SHIFT; 216 217 return atoi(subtype) & 0xf; 218 #undef equal 219 } 220 221 void str2mac(unsigned char *mac, char *str) 222 { 223 unsigned int macf[6]; 224 int i; 225 226 if (sscanf(str, "%x:%x:%x:%x:%x:%x", 227 &macf[0], &macf[1], &macf[2], 228 &macf[3], &macf[4], &macf[5]) != 6) { 229 printf("can't parse mac %s\n", str); 230 exit(1); 231 } 232 233 for (i = 0; i < 6; i++) 234 *mac++ = (unsigned char) macf[i]; 235 } 236 237 int str2wmeac(const char *ac) 238 { 239 #define equal(a,b) (strcasecmp(a,b) == 0) 240 if (equal(ac, "ac_be") || equal(ac, "be")) 241 return WME_AC_BE; 242 if (equal(ac, "ac_bk") || equal(ac, "bk")) 243 return WME_AC_BK; 244 if (equal(ac, "ac_vi") || equal(ac, "vi")) 245 return WME_AC_VI; 246 if (equal(ac, "ac_vo") || equal(ac, "vo")) 247 return WME_AC_VO; 248 errx(1, "unknown wme access class %s", ac); 249 #undef equal 250 } 251 252 int str2rate(const char *rate) 253 { 254 switch (atoi(rate)) { 255 case 54: return 54*2; 256 case 48: return 48*2; 257 case 36: return 36*2; 258 case 24: return 24*2; 259 case 18: return 18*2; 260 case 12: return 12*2; 261 case 9: return 9*2; 262 case 6: return 6*2; 263 case 11: return 11*2; 264 case 5: return 11; 265 case 2: return 2*2; 266 case 1: return 1*2; 267 } 268 errx(1, "unknown transmit rate %s", rate); 269 } 270 271 const char *rate2str(int rate) 272 { 273 static char buf[30]; 274 275 if (rate == 11) 276 return "5.5"; 277 snprintf(buf, sizeof(buf), "%u", rate/2); 278 return buf; 279 } 280 281 int load_payload(char *fname, void *buf, int len) 282 { 283 int fd; 284 int rc; 285 286 if ((fd = open(fname, O_RDONLY)) == -1) 287 err(1, "open()"); 288 289 if ((rc = read(fd, buf, len)) == -1) 290 err(1, "read()"); 291 292 close(fd); 293 printf("Read %d bytes from %s\n", rc, fname); 294 return rc; 295 } 296 297 int header_len(struct ieee80211_frame *wh) 298 { 299 int len = sizeof(*wh); 300 301 switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) { 302 case IEEE80211_FC0_TYPE_MGT: 303 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) { 304 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 305 len += 2 + 2; /* capa & listen */ 306 break; 307 308 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 309 len += 2 + 2 + 2; /* capa & status & assoc */ 310 break; 311 312 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: 313 len += 2 + 2 + 6; /* capa & listen & AP */ 314 break; 315 316 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: 317 len += 2 + 2 + 2; /* capa & status & assoc */ 318 break; 319 320 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 321 case IEEE80211_FC0_SUBTYPE_ATIM: 322 break; 323 324 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 325 case IEEE80211_FC0_SUBTYPE_BEACON: 326 len += 8 + 2 + 2; /* time & bint & capa */ 327 break; 328 329 case IEEE80211_FC0_SUBTYPE_DISASSOC: 330 len += 2; /* reason */ 331 break; 332 333 case IEEE80211_FC0_SUBTYPE_AUTH: 334 len += 2 + 2 + 2; /* algo & seq & status */ 335 break; 336 337 case IEEE80211_FC0_SUBTYPE_DEAUTH: 338 len += 2; /* reason */ 339 break; 340 341 default: 342 errx(1, "Unknown MGT subtype 0x%x", 343 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 344 } 345 break; 346 347 case IEEE80211_FC0_TYPE_CTL: 348 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) { 349 case IEEE80211_FC0_SUBTYPE_PS_POLL: 350 len = sizeof(struct ieee80211_frame_pspoll); 351 break; 352 353 case IEEE80211_FC0_SUBTYPE_RTS: 354 len = sizeof(struct ieee80211_frame_rts); 355 break; 356 357 case IEEE80211_FC0_SUBTYPE_CTS: 358 len = sizeof(struct ieee80211_frame_cts); 359 break; 360 361 case IEEE80211_FC0_SUBTYPE_ACK: 362 len = sizeof(struct ieee80211_frame_ack); 363 break; 364 365 case IEEE80211_FC0_SUBTYPE_CF_END_ACK: 366 case IEEE80211_FC0_SUBTYPE_CF_END: 367 len = sizeof(struct ieee80211_frame_cfend); 368 break; 369 370 default: 371 errx(1, "Unknown CTL subtype 0x%x", 372 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 373 } 374 break; 375 376 case IEEE80211_FC0_TYPE_DATA: 377 if (wh->i_fc[1] & IEEE80211_FC1_DIR_DSTODS) 378 len += sizeof(wh->i_addr1); 379 break; 380 381 default: 382 errx(1, "Unknown type 0x%x", 383 wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK); 384 exit(1); 385 } 386 387 return len; 388 } 389 390 int parse_ie(char *str, unsigned char *ie, int len) 391 { 392 int digits = 0; 393 char num[3]; 394 int conv = 0; 395 int ielen; 396 397 ielen = strlen(str)/2; 398 if (ielen < 1 || (strlen(str) % 2)) { 399 printf("Invalid IE %s\n", str); 400 exit(1); 401 } 402 403 num[2] = 0; 404 while (ielen) { 405 num[digits++] = *str; 406 str++; 407 if (digits == 2) { 408 unsigned int x; 409 410 sscanf(num, "%x", &x); 411 412 if (len <= 0) { 413 printf("No space for IE\n"); 414 exit(1); 415 } 416 417 *ie++ = (unsigned char) x; 418 len--; 419 ielen--; 420 421 /* first char */ 422 if (conv == 0) { 423 if (len == 0) { 424 printf("No space for IE\n"); 425 exit(1); 426 } 427 *ie++ = (unsigned char) ielen; 428 len--; 429 conv++; 430 } 431 conv++; 432 digits = 0; 433 } 434 } 435 436 return conv; 437 } 438 439 int possible_match(struct ieee80211_frame *sent, int slen, 440 struct ieee80211_frame *got, int glen) 441 { 442 if (slen != glen) 443 return 0; 444 445 if (memcmp(sent->i_addr1, got->i_addr1, 6) != 0) 446 printf("Addr1 doesn't match\n"); 447 448 if ((sent->i_fc[0] & IEEE80211_FC0_TYPE_MASK) != 449 (got->i_fc[0] & IEEE80211_FC0_TYPE_MASK)) 450 return 0; 451 452 if ((sent->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) != 453 (got->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)) 454 return 0; 455 456 /* Good enough for CTL frames I guess */ 457 if ((got->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL) 458 return 1; 459 460 if (memcmp(sent->i_addr2, got->i_addr2, 6) == 0 && 461 memcmp(sent->i_addr3, got->i_addr3, 6) == 0) 462 return 1; 463 464 return 0; 465 } 466 467 int do_verify(struct ieee80211_frame *sent, int slen, void *got, int glen) 468 { 469 #define BIT(n) (1<<(n)) 470 struct bpf_hdr *bpfh = got; 471 struct ieee80211_frame *wh; 472 struct ieee80211_radiotap_header *rth; 473 int i; 474 unsigned char *ptr, *ptr2; 475 uint32_t present; 476 uint8_t rflags; 477 478 /* get the 802.11 header */ 479 glen -= bpfh->bh_hdrlen; 480 assert(glen > 0); 481 if (bpfh->bh_caplen != glen) { 482 abort(); 483 } 484 rth = (struct ieee80211_radiotap_header*) 485 ((char*) bpfh + bpfh->bh_hdrlen); 486 glen -= rth->it_len; 487 assert(glen > 0); 488 wh = (struct ieee80211_frame*) ((char*)rth + rth->it_len); 489 490 /* check if FCS/CRC is included in packet */ 491 present = le32toh(rth->it_present); 492 if (present & BIT(IEEE80211_RADIOTAP_FLAGS)) { 493 if (present & BIT(IEEE80211_RADIOTAP_TSFT)) 494 rflags = ((const uint8_t *)rth)[8]; 495 else 496 rflags = ((const uint8_t *)rth)[0]; 497 } else 498 rflags = 0; 499 if (rflags & IEEE80211_RADIOTAP_F_FCS) 500 glen -= IEEE80211_CRC_LEN; 501 assert(glen > 0); 502 503 /* did we receive the packet we sent? */ 504 if (!possible_match(sent, slen, wh, glen)) 505 return 0; 506 507 /* check if it got mangled */ 508 if (memcmp(sent, wh, slen) == 0) { 509 printf("No mangling---got it perfect\n"); 510 return 1; 511 } 512 513 /* print differences */ 514 printf("Got mangled:\n"); 515 ptr = (unsigned char*) sent; 516 ptr2 = (unsigned char *) wh; 517 for (i = 0; i < slen; i++, ptr++, ptr2++) { 518 if (*ptr != *ptr2) 519 printf("Position: %d Was: %.2X Got: %.2X\n", 520 i, *ptr, *ptr2); 521 } 522 return -1; 523 #undef BIT 524 } 525 526 int main(int argc, char *argv[]) 527 { 528 int fd, fd2; 529 char *iface = "wlan0"; 530 char *verify = NULL; 531 int chan = 1; 532 struct { 533 struct ieee80211_frame w; 534 unsigned char buf[2048]; 535 } __packed u; 536 int len = 0; 537 int ch; 538 struct ieee80211_bpf_params params; 539 struct ieee80211_frame *wh = &u.w; 540 unsigned char *body = u.buf; 541 542 memset(&u, 0, sizeof(u)); 543 memset(¶ms, 0, sizeof(params)); 544 params.ibp_vers = IEEE80211_BPF_VERSION; 545 params.ibp_len = sizeof(struct ieee80211_bpf_params) - 6; 546 params.ibp_rate0 = 2; /* 1 MB/s XXX */ 547 params.ibp_try0 = 1; /* no retransmits */ 548 params.ibp_power = 100; /* nominal max */ 549 params.ibp_pri = WME_AC_VO; /* high priority */ 550 551 while ((ch = getopt(argc, argv, 552 "hv:t:s:TFmpdwou:1:2:3:4:b:i:c:l:n:f:e:S:a:A:C:NRV:W:X:P:")) != -1) { 553 switch (ch) { 554 case 'i': 555 iface = optarg; 556 break; 557 558 case 'c': 559 chan = atoi(optarg); 560 break; 561 562 case 'v': 563 wh->i_fc[0] |= atoi(optarg)& IEEE80211_FC0_VERSION_MASK; 564 break; 565 566 case 't': 567 wh->i_fc[0] |= str2type(optarg) << 568 IEEE80211_FC0_TYPE_SHIFT; 569 break; 570 571 case 's': 572 wh->i_fc[0] |= str2subtype(optarg) << 573 IEEE80211_FC0_SUBTYPE_SHIFT; 574 len = header_len(wh); 575 body += len; 576 break; 577 578 case 'T': 579 wh->i_fc[1] |= IEEE80211_FC1_DIR_TODS; 580 break; 581 582 case 'F': 583 wh->i_fc[1] |= IEEE80211_FC1_DIR_FROMDS; 584 break; 585 586 case 'm': 587 wh->i_fc[1] |= IEEE80211_FC1_MORE_FRAG; 588 break; 589 590 case 'r': 591 wh->i_fc[1] |= IEEE80211_FC1_RETRY; 592 break; 593 594 case 'p': 595 wh->i_fc[1] |= IEEE80211_FC1_PWR_MGT; 596 break; 597 598 case 'd': 599 wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA; 600 break; 601 602 case 'w': 603 wh->i_fc[1] |= IEEE80211_FC1_WEP; 604 break; 605 606 case 'o': 607 wh->i_fc[1] |= IEEE80211_FC1_ORDER; 608 break; 609 610 case 'u': 611 *(uint16_t*)wh->i_dur = htole16(atoi(optarg)); 612 break; 613 614 case '1': 615 str2mac(wh->i_addr1, optarg); 616 break; 617 618 case '2': 619 str2mac(wh->i_addr2, optarg); 620 break; 621 622 case '3': 623 str2mac(wh->i_addr3, optarg); 624 break; 625 626 case '4': 627 str2mac(body, optarg); 628 break; 629 630 case 'n': 631 *(uint16_t*)wh->i_seq |= htole16((atoi(optarg) & 0xfff) 632 << IEEE80211_SEQ_SEQ_SHIFT); 633 break; 634 635 case 'f': 636 wh->i_seq[0] |= atoi(optarg) & 0xf; 637 break; 638 639 case 'b': 640 len += load_payload(optarg, body, 641 u.buf + sizeof(u.buf) - body); 642 break; 643 644 case 'l': 645 len = atoi(optarg); 646 break; 647 648 case 'e': 649 do { 650 int ln; 651 652 ln = parse_ie(optarg, body, 653 u.buf + sizeof(u.buf) - body); 654 len += ln; 655 body += ln; 656 } while(0); 657 break; 658 659 case 'S': 660 do { 661 int ln; 662 int left = u.buf + sizeof(u.buf) - body; 663 664 ln = strlen(optarg) & 0xff; 665 if ((ln + 2) > left) { 666 printf("No space for SSID\n"); 667 exit(1); 668 } 669 670 *body++ = 0; 671 *body++ = ln; 672 memcpy(body, optarg, ln); 673 body += ln; 674 len += ln + 2; 675 } while(0); 676 break; 677 678 case 'R': 679 do { 680 unsigned char rates[] = "\x1\x4\x82\x84\xb\x16"; 681 int left = u.buf + sizeof(u.buf) - body; 682 683 if ((sizeof(rates) - 1) > left) { 684 printf("No space for rates\n"); 685 exit(1); 686 } 687 688 memcpy(body, rates, sizeof(rates) - 1); 689 body += sizeof(rates) - 1; 690 len += sizeof(rates) - 1; 691 } while(0); 692 break; 693 694 case 'a': 695 do { 696 uint16_t *x = (uint16_t*) (wh+1); 697 *x = htole16(atoi(optarg)); 698 } while(0); 699 break; 700 701 case 'A': 702 do { 703 uint16_t *x = (uint16_t*) (wh+1); 704 x += 1; 705 *x = htole16(atoi(optarg)); 706 } while(0); 707 break; 708 709 case 'C': 710 do { 711 uint16_t *x = (uint16_t*) (wh+1); 712 713 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) 714 == IEEE80211_FC0_SUBTYPE_AUTH) 715 x += 1; 716 x += 1; 717 *x = htole16(atoi(optarg)); 718 } while(0); 719 break; 720 721 case 'N': 722 params.ibp_flags |= IEEE80211_BPF_NOACK; 723 break; 724 725 case 'V': 726 verify = optarg; 727 break; 728 729 case 'W': 730 params.ibp_pri = str2wmeac(optarg); 731 break; 732 733 case 'X': 734 params.ibp_rate0 = str2rate(optarg); 735 break; 736 737 case 'P': 738 params.ibp_power = atoi(optarg); 739 break; 740 741 case 'h': 742 default: 743 usage(argv[0]); 744 break; 745 } 746 } 747 748 if (!len) { 749 usage(argv[0]); 750 exit(1); 751 } 752 753 printf("Using interface %s on chan %d, transmit at %s Mbp/s\n", 754 iface, chan, rate2str(params.ibp_rate0)); 755 setup_if(iface, chan); 756 fd = open_bpf(iface); 757 printf("Dose: %db\n", len); 758 759 if (verify) { 760 setup_if(verify, chan); 761 fd2 = open_bpf(verify); 762 } 763 inject(fd, wh, len, ¶ms); 764 close(fd); 765 if (verify) { 766 char buf2[4096]; 767 int rc; 768 int max = 10; 769 int timeout = 2; 770 fd_set fds; 771 struct timeval tv; 772 time_t start; 773 774 printf("Verifying via %s\n", verify); 775 start = time(NULL); 776 while (max--) { 777 FD_ZERO(&fds); 778 FD_SET(fd2, &fds); 779 780 tv.tv_usec = 0; 781 tv.tv_sec = time(NULL) - start; 782 if (tv.tv_sec >= timeout) { 783 timeout = 0; 784 break; 785 } 786 tv.tv_sec = timeout - tv.tv_sec; 787 if (select(fd2+1, &fds, NULL, NULL, &tv) == -1) 788 err(1, "select()"); 789 if (!FD_ISSET(fd2, &fds)) 790 continue; 791 792 if ((rc = read(fd2, buf2, sizeof(buf2))) == -1) 793 err(1, "read()"); 794 795 if (do_verify(wh, len, buf2, rc)) { 796 max = 666; 797 break; 798 } 799 } 800 if (max != 666 || !timeout) 801 printf("No luck\n"); 802 close(fd2); 803 } 804 805 exit(0); 806 } 807