Loading Documentation/networking/mac80211-injection.txt 0 → 100644 +59 −0 Original line number Diff line number Diff line How to use packet injection with mac80211 ========================================= mac80211 now allows arbitrary packets to be injected down any Monitor Mode interface from userland. The packet you inject needs to be composed in the following format: [ radiotap header ] [ ieee80211 header ] [ payload ] The radiotap format is discussed in ./Documentation/networking/radiotap-headers.txt. Despite 13 radiotap argument types are currently defined, most only make sense to appear on received packets. Currently three kinds of argument are used by the injection code, although it knows to skip any other arguments that are present (facilitating replay of captured radiotap headers directly): - IEEE80211_RADIOTAP_RATE - u8 arg in 500kbps units (0x02 --> 1Mbps) - IEEE80211_RADIOTAP_ANTENNA - u8 arg, 0x00 = ant1, 0x01 = ant2 - IEEE80211_RADIOTAP_DBM_TX_POWER - u8 arg, dBm Here is an example valid radiotap header defining these three parameters 0x00, 0x00, // <-- radiotap version 0x0b, 0x00, // <- radiotap header length 0x04, 0x0c, 0x00, 0x00, // <-- bitmap 0x6c, // <-- rate 0x0c, //<-- tx power 0x01 //<-- antenna The ieee80211 header follows immediately afterwards, looking for example like this: 0x08, 0x01, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x10, 0x86 Then lastly there is the payload. After composing the packet contents, it is sent by send()-ing it to a logical mac80211 interface that is in Monitor mode. Libpcap can also be used, (which is easier than doing the work to bind the socket to the right interface), along the following lines: ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf); ... r = pcap_inject(ppcap, u8aSendBuffer, nLength); You can also find sources for a complete inject test applet here: http://penumbra.warmcat.com/_twk/tiki-index.php?page=packetspammer Andy Green <andy@warmcat.com> Documentation/networking/radiotap-headers.txt 0 → 100644 +152 −0 Original line number Diff line number Diff line How to use radiotap headers =========================== Pointer to the radiotap include file ------------------------------------ Radiotap headers are variable-length and extensible, you can get most of the information you need to know on them from: ./include/net/ieee80211_radiotap.h This document gives an overview and warns on some corner cases. Structure of the header ----------------------- There is a fixed portion at the start which contains a u32 bitmap that defines if the possible argument associated with that bit is present or not. So if b0 of the it_present member of ieee80211_radiotap_header is set, it means that the header for argument index 0 (IEEE80211_RADIOTAP_TSFT) is present in the argument area. < 8-byte ieee80211_radiotap_header > [ <possible argument bitmap extensions ... > ] [ <argument> ... ] At the moment there are only 13 possible argument indexes defined, but in case we run out of space in the u32 it_present member, it is defined that b31 set indicates that there is another u32 bitmap following (shown as "possible argument bitmap extensions..." above), and the start of the arguments is moved forward 4 bytes each time. Note also that the it_len member __le16 is set to the total number of bytes covered by the ieee80211_radiotap_header and any arguments following. Requirements for arguments -------------------------- After the fixed part of the header, the arguments follow for each argument index whose matching bit is set in the it_present member of ieee80211_radiotap_header. - the arguments are all stored little-endian! - the argument payload for a given argument index has a fixed size. So IEEE80211_RADIOTAP_TSFT being present always indicates an 8-byte argument is present. See the comments in ./include/net/ieee80211_radiotap.h for a nice breakdown of all the argument sizes - the arguments must be aligned to a boundary of the argument size using padding. So a u16 argument must start on the next u16 boundary if it isn't already on one, a u32 must start on the next u32 boundary and so on. - "alignment" is relative to the start of the ieee80211_radiotap_header, ie, the first byte of the radiotap header. The absolute alignment of that first byte isn't defined. So even if the whole radiotap header is starting at, eg, address 0x00000003, still the first byte of the radiotap header is treated as 0 for alignment purposes. - the above point that there may be no absolute alignment for multibyte entities in the fixed radiotap header or the argument region means that you have to take special evasive action when trying to access these multibyte entities. Some arches like Blackfin cannot deal with an attempt to dereference, eg, a u16 pointer that is pointing to an odd address. Instead you have to use a kernel API get_unaligned() to dereference the pointer, which will do it bytewise on the arches that require that. - The arguments for a given argument index can be a compound of multiple types together. For example IEEE80211_RADIOTAP_CHANNEL has an argument payload consisting of two u16s of total length 4. When this happens, the padding rule is applied dealing with a u16, NOT dealing with a 4-byte single entity. Example valid radiotap header ----------------------------- 0x00, 0x00, // <-- radiotap version + pad byte 0x0b, 0x00, // <- radiotap header length 0x04, 0x0c, 0x00, 0x00, // <-- bitmap 0x6c, // <-- rate (in 500kHz units) 0x0c, //<-- tx power 0x01 //<-- antenna Using the Radiotap Parser ------------------------- If you are having to parse a radiotap struct, you can radically simplify the job by using the radiotap parser that lives in net/wireless/radiotap.c and has its prototypes available in include/net/cfg80211.h. You use it like this: #include <net/cfg80211.h> /* buf points to the start of the radiotap header part */ int MyFunction(u8 * buf, int buflen) { int pkt_rate_100kHz = 0, antenna = 0, pwr = 0; struct ieee80211_radiotap_iterator iterator; int ret = ieee80211_radiotap_iterator_init(&iterator, buf, buflen); while (!ret) { ret = ieee80211_radiotap_iterator_next(&iterator); if (ret) continue; /* see if this argument is something we can use */ switch (iterator.this_arg_index) { /* * You must take care when dereferencing iterator.this_arg * for multibyte types... the pointer is not aligned. Use * get_unaligned((type *)iterator.this_arg) to dereference * iterator.this_arg for type "type" safely on all arches. */ case IEEE80211_RADIOTAP_RATE: /* radiotap "rate" u8 is in * 500kbps units, eg, 0x02=1Mbps */ pkt_rate_100kHz = (*iterator.this_arg) * 5; break; case IEEE80211_RADIOTAP_ANTENNA: /* radiotap uses 0 for 1st ant */ antenna = *iterator.this_arg); break; case IEEE80211_RADIOTAP_DBM_TX_POWER: pwr = *iterator.this_arg; break; default: break; } } /* while more rt headers */ if (ret != -ENOENT) return TXRX_DROP; /* discard the radiotap header part */ buf += iterator.max_length; buflen -= iterator.max_length; ... } Andy Green <andy@warmcat.com> include/linux/ieee80211.h +11 −0 Original line number Diff line number Diff line Loading @@ -227,6 +227,17 @@ struct ieee80211_cts { #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10) #define WLAN_CAPABILITY_DSSS_OFDM (1<<13) /* 802.11g ERP information element */ #define WLAN_ERP_NON_ERP_PRESENT (1<<0) #define WLAN_ERP_USE_PROTECTION (1<<1) #define WLAN_ERP_BARKER_PREAMBLE (1<<2) /* WLAN_ERP_BARKER_PREAMBLE values */ enum { WLAN_ERP_PREAMBLE_SHORT = 0, WLAN_ERP_PREAMBLE_LONG = 1, }; /* Status codes */ enum ieee80211_statuscode { WLAN_STATUS_SUCCESS = 0, Loading include/net/cfg80211.h +38 −0 Original line number Diff line number Diff line Loading @@ -11,6 +11,44 @@ * Copyright 2006 Johannes Berg <johannes@sipsolutions.net> */ /* Radiotap header iteration * implemented in net/wireless/radiotap.c * docs in Documentation/networking/radiotap-headers.txt */ /** * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args * @rtheader: pointer to the radiotap header we are walking through * @max_length: length of radiotap header in cpu byte ordering * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg * @this_arg: pointer to current radiotap arg * @arg_index: internal next argument index * @arg: internal next argument pointer * @next_bitmap: internal pointer to next present u32 * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present */ struct ieee80211_radiotap_iterator { struct ieee80211_radiotap_header *rtheader; int max_length; int this_arg_index; u8 *this_arg; int arg_index; u8 *arg; __le32 *next_bitmap; u32 bitmap_shifter; }; extern int ieee80211_radiotap_iterator_init( struct ieee80211_radiotap_iterator *iterator, struct ieee80211_radiotap_header *radiotap_header, int max_length); extern int ieee80211_radiotap_iterator_next( struct ieee80211_radiotap_iterator *iterator); /* from net/wireless.h */ struct wiphy; Loading include/net/mac80211.h +12 −10 Original line number Diff line number Diff line Loading @@ -347,9 +347,16 @@ enum ieee80211_if_types { * @mac_addr: pointer to MAC address of the interface. This pointer is valid * until the interface is removed (i.e. it cannot be used after * remove_interface() callback was called for this interface). * This pointer will be %NULL for monitor interfaces, be careful. * * This structure is used in add_interface() and remove_interface() * callbacks of &struct ieee80211_hw. * * When you allow multiple interfaces to be added to your PHY, take care * that the hardware can actually handle multiple MAC addresses. However, * also take care that when there's no interface left with mac_addr != %NULL * you remove the MAC address from the device to avoid acknowledging packets * in pure monitor mode. */ struct ieee80211_if_init_conf { int if_id; Loading Loading @@ -574,10 +581,11 @@ struct ieee80211_ops { * to returning zero. By returning non-zero addition of the interface * is inhibited. Unless monitor_during_oper is set, it is guaranteed * that monitor interfaces and normal interfaces are mutually * exclusive. The open() handler is called after add_interface() * if this is the first device added. At least one of the open() * open() and add_interface() callbacks has to be assigned. If * add_interface() is NULL, one STA interface is permitted only. */ * exclusive. If assigned, the open() handler is called after * add_interface() if this is the first device added. The * add_interface() callback has to be assigned because it is the only * way to obtain the requested MAC address for any interface. */ int (*add_interface)(struct ieee80211_hw *hw, struct ieee80211_if_init_conf *conf); Loading Loading @@ -921,12 +929,6 @@ struct sk_buff * ieee80211_get_buffered_bc(struct ieee80211_hw *hw, int if_id, struct ieee80211_tx_control *control); /* Low level drivers that have their own MLME and MAC indicate * the aid for an associating station with this call */ int ieee80211_set_aid_for_sta(struct ieee80211_hw *hw, u8 *peer_address, u16 aid); /* Given an sk_buff with a raw 802.11 header at the data pointer this function * returns the 802.11 header length in bytes (not including encryption * headers). If the data in the sk_buff is too short to contain a valid 802.11 Loading Loading
Documentation/networking/mac80211-injection.txt 0 → 100644 +59 −0 Original line number Diff line number Diff line How to use packet injection with mac80211 ========================================= mac80211 now allows arbitrary packets to be injected down any Monitor Mode interface from userland. The packet you inject needs to be composed in the following format: [ radiotap header ] [ ieee80211 header ] [ payload ] The radiotap format is discussed in ./Documentation/networking/radiotap-headers.txt. Despite 13 radiotap argument types are currently defined, most only make sense to appear on received packets. Currently three kinds of argument are used by the injection code, although it knows to skip any other arguments that are present (facilitating replay of captured radiotap headers directly): - IEEE80211_RADIOTAP_RATE - u8 arg in 500kbps units (0x02 --> 1Mbps) - IEEE80211_RADIOTAP_ANTENNA - u8 arg, 0x00 = ant1, 0x01 = ant2 - IEEE80211_RADIOTAP_DBM_TX_POWER - u8 arg, dBm Here is an example valid radiotap header defining these three parameters 0x00, 0x00, // <-- radiotap version 0x0b, 0x00, // <- radiotap header length 0x04, 0x0c, 0x00, 0x00, // <-- bitmap 0x6c, // <-- rate 0x0c, //<-- tx power 0x01 //<-- antenna The ieee80211 header follows immediately afterwards, looking for example like this: 0x08, 0x01, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x13, 0x22, 0x33, 0x44, 0x55, 0x66, 0x10, 0x86 Then lastly there is the payload. After composing the packet contents, it is sent by send()-ing it to a logical mac80211 interface that is in Monitor mode. Libpcap can also be used, (which is easier than doing the work to bind the socket to the right interface), along the following lines: ppcap = pcap_open_live(szInterfaceName, 800, 1, 20, szErrbuf); ... r = pcap_inject(ppcap, u8aSendBuffer, nLength); You can also find sources for a complete inject test applet here: http://penumbra.warmcat.com/_twk/tiki-index.php?page=packetspammer Andy Green <andy@warmcat.com>
Documentation/networking/radiotap-headers.txt 0 → 100644 +152 −0 Original line number Diff line number Diff line How to use radiotap headers =========================== Pointer to the radiotap include file ------------------------------------ Radiotap headers are variable-length and extensible, you can get most of the information you need to know on them from: ./include/net/ieee80211_radiotap.h This document gives an overview and warns on some corner cases. Structure of the header ----------------------- There is a fixed portion at the start which contains a u32 bitmap that defines if the possible argument associated with that bit is present or not. So if b0 of the it_present member of ieee80211_radiotap_header is set, it means that the header for argument index 0 (IEEE80211_RADIOTAP_TSFT) is present in the argument area. < 8-byte ieee80211_radiotap_header > [ <possible argument bitmap extensions ... > ] [ <argument> ... ] At the moment there are only 13 possible argument indexes defined, but in case we run out of space in the u32 it_present member, it is defined that b31 set indicates that there is another u32 bitmap following (shown as "possible argument bitmap extensions..." above), and the start of the arguments is moved forward 4 bytes each time. Note also that the it_len member __le16 is set to the total number of bytes covered by the ieee80211_radiotap_header and any arguments following. Requirements for arguments -------------------------- After the fixed part of the header, the arguments follow for each argument index whose matching bit is set in the it_present member of ieee80211_radiotap_header. - the arguments are all stored little-endian! - the argument payload for a given argument index has a fixed size. So IEEE80211_RADIOTAP_TSFT being present always indicates an 8-byte argument is present. See the comments in ./include/net/ieee80211_radiotap.h for a nice breakdown of all the argument sizes - the arguments must be aligned to a boundary of the argument size using padding. So a u16 argument must start on the next u16 boundary if it isn't already on one, a u32 must start on the next u32 boundary and so on. - "alignment" is relative to the start of the ieee80211_radiotap_header, ie, the first byte of the radiotap header. The absolute alignment of that first byte isn't defined. So even if the whole radiotap header is starting at, eg, address 0x00000003, still the first byte of the radiotap header is treated as 0 for alignment purposes. - the above point that there may be no absolute alignment for multibyte entities in the fixed radiotap header or the argument region means that you have to take special evasive action when trying to access these multibyte entities. Some arches like Blackfin cannot deal with an attempt to dereference, eg, a u16 pointer that is pointing to an odd address. Instead you have to use a kernel API get_unaligned() to dereference the pointer, which will do it bytewise on the arches that require that. - The arguments for a given argument index can be a compound of multiple types together. For example IEEE80211_RADIOTAP_CHANNEL has an argument payload consisting of two u16s of total length 4. When this happens, the padding rule is applied dealing with a u16, NOT dealing with a 4-byte single entity. Example valid radiotap header ----------------------------- 0x00, 0x00, // <-- radiotap version + pad byte 0x0b, 0x00, // <- radiotap header length 0x04, 0x0c, 0x00, 0x00, // <-- bitmap 0x6c, // <-- rate (in 500kHz units) 0x0c, //<-- tx power 0x01 //<-- antenna Using the Radiotap Parser ------------------------- If you are having to parse a radiotap struct, you can radically simplify the job by using the radiotap parser that lives in net/wireless/radiotap.c and has its prototypes available in include/net/cfg80211.h. You use it like this: #include <net/cfg80211.h> /* buf points to the start of the radiotap header part */ int MyFunction(u8 * buf, int buflen) { int pkt_rate_100kHz = 0, antenna = 0, pwr = 0; struct ieee80211_radiotap_iterator iterator; int ret = ieee80211_radiotap_iterator_init(&iterator, buf, buflen); while (!ret) { ret = ieee80211_radiotap_iterator_next(&iterator); if (ret) continue; /* see if this argument is something we can use */ switch (iterator.this_arg_index) { /* * You must take care when dereferencing iterator.this_arg * for multibyte types... the pointer is not aligned. Use * get_unaligned((type *)iterator.this_arg) to dereference * iterator.this_arg for type "type" safely on all arches. */ case IEEE80211_RADIOTAP_RATE: /* radiotap "rate" u8 is in * 500kbps units, eg, 0x02=1Mbps */ pkt_rate_100kHz = (*iterator.this_arg) * 5; break; case IEEE80211_RADIOTAP_ANTENNA: /* radiotap uses 0 for 1st ant */ antenna = *iterator.this_arg); break; case IEEE80211_RADIOTAP_DBM_TX_POWER: pwr = *iterator.this_arg; break; default: break; } } /* while more rt headers */ if (ret != -ENOENT) return TXRX_DROP; /* discard the radiotap header part */ buf += iterator.max_length; buflen -= iterator.max_length; ... } Andy Green <andy@warmcat.com>
include/linux/ieee80211.h +11 −0 Original line number Diff line number Diff line Loading @@ -227,6 +227,17 @@ struct ieee80211_cts { #define WLAN_CAPABILITY_SHORT_SLOT_TIME (1<<10) #define WLAN_CAPABILITY_DSSS_OFDM (1<<13) /* 802.11g ERP information element */ #define WLAN_ERP_NON_ERP_PRESENT (1<<0) #define WLAN_ERP_USE_PROTECTION (1<<1) #define WLAN_ERP_BARKER_PREAMBLE (1<<2) /* WLAN_ERP_BARKER_PREAMBLE values */ enum { WLAN_ERP_PREAMBLE_SHORT = 0, WLAN_ERP_PREAMBLE_LONG = 1, }; /* Status codes */ enum ieee80211_statuscode { WLAN_STATUS_SUCCESS = 0, Loading
include/net/cfg80211.h +38 −0 Original line number Diff line number Diff line Loading @@ -11,6 +11,44 @@ * Copyright 2006 Johannes Berg <johannes@sipsolutions.net> */ /* Radiotap header iteration * implemented in net/wireless/radiotap.c * docs in Documentation/networking/radiotap-headers.txt */ /** * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args * @rtheader: pointer to the radiotap header we are walking through * @max_length: length of radiotap header in cpu byte ordering * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg * @this_arg: pointer to current radiotap arg * @arg_index: internal next argument index * @arg: internal next argument pointer * @next_bitmap: internal pointer to next present u32 * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present */ struct ieee80211_radiotap_iterator { struct ieee80211_radiotap_header *rtheader; int max_length; int this_arg_index; u8 *this_arg; int arg_index; u8 *arg; __le32 *next_bitmap; u32 bitmap_shifter; }; extern int ieee80211_radiotap_iterator_init( struct ieee80211_radiotap_iterator *iterator, struct ieee80211_radiotap_header *radiotap_header, int max_length); extern int ieee80211_radiotap_iterator_next( struct ieee80211_radiotap_iterator *iterator); /* from net/wireless.h */ struct wiphy; Loading
include/net/mac80211.h +12 −10 Original line number Diff line number Diff line Loading @@ -347,9 +347,16 @@ enum ieee80211_if_types { * @mac_addr: pointer to MAC address of the interface. This pointer is valid * until the interface is removed (i.e. it cannot be used after * remove_interface() callback was called for this interface). * This pointer will be %NULL for monitor interfaces, be careful. * * This structure is used in add_interface() and remove_interface() * callbacks of &struct ieee80211_hw. * * When you allow multiple interfaces to be added to your PHY, take care * that the hardware can actually handle multiple MAC addresses. However, * also take care that when there's no interface left with mac_addr != %NULL * you remove the MAC address from the device to avoid acknowledging packets * in pure monitor mode. */ struct ieee80211_if_init_conf { int if_id; Loading Loading @@ -574,10 +581,11 @@ struct ieee80211_ops { * to returning zero. By returning non-zero addition of the interface * is inhibited. Unless monitor_during_oper is set, it is guaranteed * that monitor interfaces and normal interfaces are mutually * exclusive. The open() handler is called after add_interface() * if this is the first device added. At least one of the open() * open() and add_interface() callbacks has to be assigned. If * add_interface() is NULL, one STA interface is permitted only. */ * exclusive. If assigned, the open() handler is called after * add_interface() if this is the first device added. The * add_interface() callback has to be assigned because it is the only * way to obtain the requested MAC address for any interface. */ int (*add_interface)(struct ieee80211_hw *hw, struct ieee80211_if_init_conf *conf); Loading Loading @@ -921,12 +929,6 @@ struct sk_buff * ieee80211_get_buffered_bc(struct ieee80211_hw *hw, int if_id, struct ieee80211_tx_control *control); /* Low level drivers that have their own MLME and MAC indicate * the aid for an associating station with this call */ int ieee80211_set_aid_for_sta(struct ieee80211_hw *hw, u8 *peer_address, u16 aid); /* Given an sk_buff with a raw 802.11 header at the data pointer this function * returns the 802.11 header length in bytes (not including encryption * headers). If the data in the sk_buff is too short to contain a valid 802.11 Loading
