Changeset 130

Timestamp:

03/21/07 14:29:41 (22 months ago)

Author:

jwright

Message:

Added more test cases to l2ping, build in autoconf now

Location:

trunk

Files:

• Makefile.in (modified) (2 diffs)
• l2ping80211.c (modified) (5 diffs)
• l2ping80211.h (added)

trunk/Makefile.in

@@ -42 +42 @@
 TXTUNOUT  = tuntx
 
+L2PINGOBJ = l2ping80211.o
+L2PINGOUT = l2ping80211
+
 all:    $(DEPEND) $(LIBOUT) 
 
@@ -53 +56 @@
 $(TXTUNOUT):    $(TXTUNOBJ)
         $(CC) $(LDFLAGS) -o $(TXTUNOUT) $(TXTUNOBJ) $(LIBS) -lorcon -lpcap
+
+$(L2PINGOUT):   $(L2PINGOBJ)
+        $(CC) $(LDFLAGS) -o $(L2PINGOUT) $(L2PINGOBJ) $(LIBS) -lorcon -lpcap
 
 install:        $(LIBOUT)

trunk/l2ping80211.c

@@ -22 +22 @@
 #include <string.h>
 #include <stdio.h>
-#include <sys/socket.h>
-#include <linux/wireless.h>
-
+#include <ctype.h>
 #include <stdint.h>
-
+#include <time.h>
+#include <pcap.h>
+#include <signal.h>
 #include <tx80211.h>
-#include <lorcon_packasm.h>
 #include <lorcon_forge.h>
+
+#include "l2ping80211.h"
+#include "ieee80211.h"
+
+/* Globals */
+struct tx80211 tx;
+pcap_t *p = NULL;
+unsigned char *packet;
+struct pcap_pkthdr *h;
+char pcaperrbuf[PCAP_ERRBUF_SIZE];
+int offset; /* Offset to the beginning of the 802.11 header */
+int exitval=1;
+
+void sigexit()
+{
+        tx80211_close(&tx);
+        if (p != NULL) {
+                pcap_close(p);
+        }
+        exit(exitval);
+}
+
 
 void usage() {
@@ -38 +59 @@
 
         printf("l2ping80211\n"
-                   "Usage : l2ping80211 [options] -i interface -c channel -d driver \n"
-                   "        -S sourcemac -B bssidmac -D destmac\n"
-                   "  -n number        Number of packets to send\n");
+                   "Usage : l2ping80211 [options] -i interface -d driver "
+                   "-T targetmac -C testcase\n"
+                   "  [-S sourcemac -B bssidmac -D destmac -t usectimer"
+                   " -n count -c channel -V]\n");
+        printf("\nSupported test cases:\n");
+
+        i=0;
+        while(testcases[i].testname != NULL) {
+                printf("\t%d\t%s\n", testcases[i].testnum, 
+                                testcases[i].testname);
+                i++;
+        }
 
         if (cardlist == NULL) {
@@ -55 +85 @@
 }
 
+/* Converts a string to uppercase */
+void to_upper (char *s) 
+{
+        char *p, offset;
+        offset = 'A' - 'a';
+        for(p=s;*p != '\0';p++) {
+                if(islower(*p)) {
+                        *p += offset;
+                }
+        }
+}
+
+
+/* Determine radiotap data length (including header) and return offset for the
+beginning of the 802.11 header */
+int radiotap_offset(pcap_t *p, struct pcap_pkthdr *h)
+{
+        uint8_t dot11packetbuf[2312];
+        struct tx80211_radiotap_header *rtaphdr;
+        int rtaphdrlen=0;
+
+        /* Grab a packet to examine radiotap header */
+        if (pcap_next_ex(p, &h, (const u_char **)&dot11packetbuf) > -1) {
+
+                rtaphdr = (struct tx80211_radiotap_header *)dot11packetbuf;
+                rtaphdrlen = tx80211_le16(rtaphdr->it_len); /* rtap is LE */
+
+                /* Sanity check on header length */
+                if (rtaphdrlen > (h->len - 10)) {
+                        return -2; /* Bad radiotap data */
+                }
+
+                return rtaphdrlen;
+        }
+
+        return -1;
+}
+
+void lamont_hdump(unsigned char *bp, unsigned int length) {
+
+  /* stolen from tcpdump, then kludged extensively */
+
+  static const char asciify[] = "................................ !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~.................................................................................................................................";
+
+  const unsigned short *sp;
+  const unsigned char *ap;
+  unsigned int i, j;
+  int nshorts, nshorts2;
+  int padding;
+
+  printf("\n\t");
+  padding = 0;
+  sp = (unsigned short *)bp;
+  ap = (unsigned char *)bp;
+  nshorts = (unsigned int) length / sizeof(unsigned short);
+  nshorts2 = (unsigned int) length / sizeof(unsigned short);
+  i = 0;
+  j = 0;
+  while(1) {
+    while (--nshorts >= 0) {
+      printf(" %04x", tx80211_ntoh16(*sp));
+      sp++;
+      if ((++i % 8) == 0)
+        break;
+    }
+    if (nshorts < 0) {
+      if ((length & 1) && (((i-1) % 8) != 0)) {
+        printf(" %02x  ", *(unsigned char *)sp);
+        padding++;
+      }
+      nshorts = (8 - (nshorts2 - nshorts));
+      while(--nshorts >= 0) {
+        printf("     ");
+      }
+      if (!padding) printf("     ");
+    }
+    printf("  ");
+
+    while (--nshorts2 >= 0) {
+      printf("%c%c", asciify[*ap], asciify[*(ap+1)]);
+      ap += 2;
+      if ((++j % 8) == 0) {
+        printf("\n\t");
+        break;
+      }
+    }
+    if (nshorts2 < 0) {
+      if ((length & 1) && (((j-1) % 8) != 0)) {
+        printf("%c", asciify[*ap]);
+      }
+      break;
+    }
+  }
+  if ((length & 1) && (((i-1) % 8) == 0)) {
+    printf(" %02x", *(unsigned char *)sp);
+    printf("                                       %c", asciify[*ap]);
+  }
+  printf("\n");
+}
+
+/* Converts a MAC address string to a u8 array, returns -1 on error */
+int string2mac (char *string, uint8_t *mac_buf) 
+{
+    char *ptr, *next;
+    unsigned long val;
+    int i;
+
+    to_upper(string);
+
+    ptr = next = string;
+    for(i=0;i < 6;i++) {
+        if((val = strtoul(next, &ptr, 16)) > 255) {
+            return(-1);
+        }
+        mac_buf[i] = (unsigned char)val;
+        if((next == ptr) && (i != 6 - 1)) {
+            return(-1);
+        }
+        next = ptr + 1;
+    }
+
+    return(0);
+}
+
+char *printmac(unsigned char *mac)
+{
+        static char macstring[18];
+
+        memset(&macstring, 0, sizeof(macstring));
+        (void)snprintf(macstring, sizeof(macstring),
+                       "%02x:%02x:%02x:%02x:%02x:%02x",
+                       mac[0], mac[1], mac[2], mac[3], mac[4], mac[5]);
+        return (macstring);
+}
+
+/* Look for frames matching the specified attributes, returning the delta 
+ * time. */
+int watchfor(int type, int subtype, uint8_t *addr1,
+                uint8_t *addr2, uint8_t *addr3, int flags, int timeout) {
+
+        struct ieee80211_hdr *dot11hdr;
+
+        struct timeval starttime, now;
+        gettimeofday(&starttime, NULL);
+        unsigned int elapsed;
+        unsigned int finishtime = ((starttime.tv_sec * 1000000) + starttime.tv_usec + timeout);
+
+
+        gettimeofday(&now, NULL);
+        while ((unsigned int)((now.tv_sec * 1000000) + now.tv_usec) < finishtime) {
+                if (pcap_next_ex(p, &h, (const u_char **)&packet) != 1) {
+                        return -1;
+                }
+                gettimeofday(&now, NULL);
+
+                dot11hdr = (struct ieee80211_hdr *)packet;
+
+                if (dot11hdr->u1.fc.type != type) continue;
+                if (dot11hdr->u1.fc.subtype != subtype) continue;
+                if ((dot11hdr->u1.fchdr & tx80211_hton16(0x00ff)) != flags)
+                        continue;
+                if (addr1 != NULL && (memcmp(addr1, dot11hdr->addr1, 6) != 0)) 
+                        continue;
+                if (addr2 != NULL && (memcmp(addr2, dot11hdr->addr2, 6) != 0)) 
+                        continue;
+                if (addr3 != NULL && (memcmp(addr3, dot11hdr->addr3, 6) != 0)) 
+                        continue;
+
+                elapsed = ((unsigned int)((now.tv_sec * 1000000) + (now.tv_usec)) - (unsigned int)((starttime.tv_sec * 1000000) + (starttime.tv_usec)));
+                return elapsed;
+        }
+
+        return 0;
+}
+
+/* Send a NULL data frame to the target with a false BSSID, watch for the
+ * DEAUTH that follows.
+ */
+void l2ping_test_datainvalidbssiddeauth(tx80211_t *in_tx, int npacks, 
+                uint8_t *targetmac, uint32_t usectimeout)
+{
+        int i, duration;
+        struct lcpa_metapack *metapack;
+        tx80211_packet_t txpack;
+        uint8_t sourcemac[6];
+        uint8_t bssidmac[6];
+
+        metapack = lcpa_init();
+        tx80211_initpacket(&txpack);
+
+        srand(time(NULL));
+        lcpf_randmac(sourcemac, 1);
+        lcpf_randmac(bssidmac, 1);
+
+        lcpf_80211headers(metapack, 
+                        WLAN_FC_TYPE_DATA,
+                        WLAN_FC_SUBTYPE_DATANULL,
+                        0x02, /* fcflags, FromDS */
+                        0x00, /* duration */
+                        targetmac,
+                        bssidmac,
+                        sourcemac,
+                        NULL, /* addr4 */
+                        0, /* Fragment number */
+                        0); /* Sequence number */
+
+        lcpa_freeze(metapack, &txpack);
+        lcpa_free(metapack);
+
+        for(i=0; i < npacks; i++) {
+                if (tx80211_txpacket(in_tx, &txpack) < 0) {
+                        fprintf(stderr, "Unable to inject packet: %s\n",
+                                        tx80211_geterrstr(in_tx));
+                        return;
+                }
+                duration = watchfor(WLAN_FC_TYPE_MGMT, WLAN_FC_SUBTYPE_DEAUTH,
+                                bssidmac, targetmac, NULL, 0, usectimeout);
+                if (duration > 0) {
+                        print_response(targetmac, i+1, h->len, duration);
+                } else {
+                        print_noresponse(targetmac, i+1, usectimeout);
+                }
+
+                sleep(1);
+                                        
+        }
+
+        return;
+}
+
+/* Send a NULL data frame to the target with a false BSSID, watch for the
+ * ACK that follows.
+ */
+void l2ping_test_datainvalidbssid(tx80211_t *in_tx, int npacks, 
+                uint8_t *targetmac, uint32_t usectimeout)
+{
+        int i, duration;
+        struct lcpa_metapack *metapack;
+        tx80211_packet_t txpack;
+        uint8_t sourcemac[6];
+        uint8_t bssidmac[6];
+
+        metapack = lcpa_init();
+        tx80211_initpacket(&txpack);
+
+        srand(time(NULL));
+        lcpf_randmac(sourcemac, 1);
+        lcpf_randmac(bssidmac, 1);
+
+        lcpf_80211headers(metapack, 
+                        WLAN_FC_TYPE_DATA,
+                        WLAN_FC_SUBTYPE_DATANULL,
+                        0x02, /* fcflags, FromDS */
+                        0x00, /* duration */
+                        targetmac,
+                        bssidmac,
+                        sourcemac,
+                        NULL, /* addr4 */
+                        0, /* Fragment number */
+                        0); /* Sequence number */
+
+        lcpa_freeze(metapack, &txpack);
+        lcpa_free(metapack);
+
+        for(i=0; i < npacks; i++) {
+                if (tx80211_txpacket(in_tx, &txpack) < 0) {
+                        fprintf(stderr, "Unable to inject packet: %s\n",
+                                        tx80211_geterrstr(in_tx));
+                        return;
+                }
+                duration = watchfor(WLAN_FC_TYPE_CTRL, WLAN_FC_SUBTYPE_ACK,
+                                bssidmac, NULL, NULL, 0, usectimeout);
+                if (duration > 0) {
+                        print_response(targetmac, i+1, h->len, duration);
+                } else {
+                        print_noresponse(targetmac, i+1, usectimeout);
+                }
+
+                sleep(1);
+                                        
+        }
+
+        return;
+}
+
+/* 
+ * Send a NULL data frame to the AP target with a valid BSSID, valid source
+ * and a destination multicast address.  Watch for the multicast data
+ * frame response with FromDS set that follows.
+ */
+void l2ping_test_nulldatamcast(tx80211_t *in_tx, int npacks, 
+                uint8_t *bssid, uint8_t *source, uint32_t usectimeout)
+{
+        int i, duration;
+        struct lcpa_metapack *metapack;
+        tx80211_packet_t txpack;
+        uint8_t mcastdest[6];
+
+        metapack = lcpa_init();
+        tx80211_initpacket(&txpack);
+
+        srand(time(NULL));
+        lcpf_randmac(mcastdest, 1);
+        mcastdest[0] = 0xff; /* multicast bit set */
+
+        lcpf_80211headers(metapack, 
+                        WLAN_FC_TYPE_DATA,
+                        WLAN_FC_SUBTYPE_DATANULL,
+                        0x01, /* fcflags, ToDS */
+                        0x00, /* duration */
+                        bssid, /* target */
+                        source,
+                        mcastdest,
+                        NULL, /* addr4 */
+                        0, /* Fragment number */
+                        0); /* Sequence number */
+
+        lcpa_freeze(metapack, &txpack);
+        lcpa_free(metapack);
+
+        for(i=0; i < npacks; i++) {
+                if (tx80211_txpacket(in_tx, &txpack) < 0) {
+                        fprintf(stderr, "Unable to inject packet: %s\n",
+                                        tx80211_geterrstr(in_tx));
+                        return;
+                }
+                duration = watchfor(WLAN_FC_TYPE_DATA, WLAN_FC_SUBTYPE_DATANULL,
+                                mcastdest, bssid, source, 0, usectimeout);
+                if (duration > 0) {
+                        print_response(bssid, i+1, h->len, duration);
+                } else {
+                        print_noresponse(bssid, i+1, usectimeout);
+                }
+
+                sleep(1);
+                                        
+        }
+
+        return;
+}
+
+/* 
+ * Send a NULL data frame to the target with a valid BSSID, watch for the
+ * ACK that follows.
+ */
+void l2ping_test_datavalidbssid(tx80211_t *in_tx, int npacks, 
+                uint8_t *targetmac, uint8_t *bssid, uint32_t usectimeout)
+{
+        int i, duration;
+        struct lcpa_metapack *metapack;
+        tx80211_packet_t txpack;
+        uint8_t sourcemac[6];
+
+        metapack = lcpa_init();
+        tx80211_initpacket(&txpack);
+
+        srand(time(NULL));
+        lcpf_randmac(sourcemac, 1);
+
+        lcpf_80211headers(metapack, 
+                        WLAN_FC_TYPE_DATA,
+                        WLAN_FC_SUBTYPE_DATANULL,
+                        0x02, /* fcflags, FromDS */
+                        0x00, /* duration */
+                        targetmac,
+                        bssid,
+                        sourcemac,
+                        NULL, /* addr4 */
+                        0, /* Fragment number */
+                        0); /* Sequence number */
+
+        lcpa_freeze(metapack, &txpack);
+        lcpa_free(metapack);
+
+        for(i=0; i < npacks; i++) {
+                if (tx80211_txpacket(in_tx, &txpack) < 0) {
+                        fprintf(stderr, "Unable to inject packet: %s\n",
+                                        tx80211_geterrstr(in_tx));
+                        return;
+                }
+                duration = watchfor(WLAN_FC_TYPE_CTRL, WLAN_FC_SUBTYPE_ACK,
+                                bssid, NULL, NULL, 0, usectimeout);
+                if (duration > 0) {
+                        print_response(targetmac, i+1, h->len, duration);
+                } else {
+                        print_noresponse(targetmac, i+1, usectimeout);
+                }
+
+                sleep(1);
+                                        
+        }
+
+        return;
+}
+
+/* Send an RTS frame to the target station, watch for CTS response */
+void l2ping_test_rtscts(tx80211_t *in_tx, int npacks, uint8_t *targetmac,
+                uint32_t usectimeout)
+{
+        int i, duration;
+        struct lcpa_metapack *metapack;
+        tx80211_packet_t txpack;
+        uint8_t transmittermac[6];
+
+        metapack = lcpa_init();
+        tx80211_initpacket(&txpack);
+
+        srand(time(NULL));
+        lcpf_randmac(transmittermac, 1);
+
+        lcpf_rts(metapack, 
+                        targetmac,
+                        transmittermac,
+                        0x00, /* fcflags */
+                        0x00); /* duration */
+
+        lcpa_freeze(metapack, &txpack);
+        lcpa_free(metapack);
+
+        //lamont_hdump(txpack.packet, txpack.plen);
+
+        for(i=0; i < npacks; i++) {
+                if (tx80211_txpacket(in_tx, &txpack) < 0) {
+                        fprintf(stderr, "Unable to inject packet: %s\n",
+                                        tx80211_geterrstr(in_tx));
+                        return;
+                }
+                duration = watchfor(WLAN_FC_TYPE_CTRL, WLAN_FC_SUBTYPE_CTS,
+                                transmittermac, NULL, NULL, 0, usectimeout);
+                if (duration > 0) {
+                        print_response(targetmac, i+1, h->len, duration);
+                } else {
+                        print_noresponse(targetmac, i+1, usectimeout);
+                }
+                sleep(1);
+                                        
+        }
+
+        return;
+}
+
+/* 
+ * Send a NULL data frame to the AP target with a valid BSSID, invalid source
+ * and a destination broadcast address.  Watch for the deauth
+ * frame response from the AP.
+ */
+void l2ping_test_nulldatainvalidsrc(tx80211_t *in_tx, int npacks, 
+                uint8_t *targetmac, uint32_t usectimeout)
+{
+        int i, duration;
+        struct lcpa_metapack *metapack;
+        tx80211_packet_t txpack;
+        uint8_t invalidsource[6];
+        uint8_t broadcastdest[] = "\xff\xff\xff\xff\xff\xff";
+
+        metapack = lcpa_init();
+        tx80211_initpacket(&txpack);
+
+        srand(time(NULL));
+        lcpf_randmac(invalidsource, 1);
+
+        lcpf_80211headers(metapack, 
+                        WLAN_FC_TYPE_DATA,
+                        WLAN_FC_SUBTYPE_DATANULL,
+                        0x01, /* fcflags, ToDS */
+                        0x00, /* duration */
+                        targetmac, /* target/BSSID */
+                        invalidsource,
+                        broadcastdest,
+                        NULL, /* addr4 */
+                        0, /* Fragment number */
+                        0); /* Sequence number */
+
+        lcpa_freeze(metapack, &txpack);
+        lcpa_free(metapack);
+
+        //lamont_hdump(txpack.packet, txpack.plen);
+
+        for(i=0; i < npacks; i++) {
+                if (tx80211_txpacket(in_tx, &txpack) < 0) {
+                        fprintf(stderr, "Unable to inject packet: %s\n",
+                                        tx80211_geterrstr(in_tx));
+                        return;
+                }
+                duration = watchfor(WLAN_FC_TYPE_MGMT, WLAN_FC_SUBTYPE_DEAUTH,
+                                invalidsource, targetmac, targetmac, 0,
+                                usectimeout);
+                if (duration > 0) {
+                        print_response(targetmac, i+1, h->len, duration);
+                } else {
+                        print_noresponse(targetmac, i+1, usectimeout);
+                }
+
+                sleep(1);
+                                        
+        }
+
+        return;
+}
+void print_noresponse(uint8_t *mac, int num, int timeout)
+{
+        printf("No response from %s : num=%d time=%d usec\n",
+                        printmac(mac), num, timeout);
+}
+void print_response(uint8_t *mac, int num, int len, int time)
+{
+        /* Set exitval to 0 since we got a response */
+        exitval = 0;
+        printf("%d bytes from %s : num=%d time=%d usec\n",
+                        len, printmac(mac), num, time);
+}
+
+void print_test_detail() {
+        int i=0;
+        while(testcases[i].testdesc != NULL) {
+                printf("Test Case:\t%d\n", testcases[i].testnum);
+                printf("Test Name:\t%s\n", testcases[i].testname);
+                printf("Test Desc:\t%s\n", testcases[i].testdesc);
+                printf("Test Reqs:\t");
+                if (testcases[i].asmac) printf("source (-S) ");
+                if (testcases[i].admac) printf("dest (-D) ");
+                if (testcases[i].abmac) printf("BSSID (-B) ");
+                if (!(testcases[i].abmac || testcases[i].admac,
+                                testcases[i].asmac)) {
+                        printf("None.");
+                }
+                printf("\n\n");
+                i++;
+        }
+}
+
+
 int main(int argc, char *argv[]) {
-        short unsigned int ismac[6], idmac[6], ibmac[6];
-        uint8_t smac[6], dmac[6], bmac[6];
-        int asmac = 0, admac = 0, abmac = 0;
+        uint8_t smac[6], dmac[6], bmac[6], tmac[6];
+        int asmac = 0, admac = 0, abmac = 0, atmac = 0, atestcase = 0, i;
+        int optmissing = 0, pcaptype=0;
 
         char *interface = NULL;
         int channel = 0;
 
-        int npacks = 0;
-
-        struct tx80211 tx;
-        struct tx80211_packet txpack;
+        /* Default number of packets to send, override with -n */
+        int npacks = 4;
+
+        struct testcase *testc = NULL;
         int txdrv = INJ_NODRIVER;
-
-        int c = 0, ret = 0;
-
-        struct lcpa_metapack *metapack;
-
-        while ((c = getopt(argc, argv, "i:c:d:S:B:D:n:h")) != EOF) {
+        uint32_t usectimeout=10000; /* Default 10000 usec */
+
+        int c = 0;
+
+
+        while ((c = getopt(argc, argv, "i:t:c:d:S:B:D:n:h?C:T:V")) != EOF) {
                 switch (c) {
-                        case 'i':
-                                interface = strdup(optarg);
-                                break;
-                        case 'c':
-                                if (sscanf(optarg, "%d", &channel) != 1) {
-                                        fprintf(stderr, "%s: Illegal channel, expected number\n",
+                        case 'V':
+                                print_test_detail();
+                                return 0;
+                                break;
+                        case 'C':
+                                if (sscanf(optarg, "%d", &atestcase) != 1) {
+                                        fprintf(stderr, "%s: Illegal test case,"
+                                                        " expected number\n",
                                                         argv[0]);
                                         usage();
@@ -86 +650 @@
                                 }
                                 break;
-                        case 'd':
-                                txdrv = tx80211_resolvecard(optarg);
-                                break;
-                        case 'S':
-                                if (sscanf(optarg, "%02hx:%02hx:%02hx:%02hx:%02hx:%02hx",
-                                                   &ismac[0], &ismac[1], &ismac[2], 
-                                                   &ismac[3], &ismac[4], &ismac[5]) != 6) {
-                                        if (sscanf(optarg, "%02hx%02hx%02hx%02hx%02hx%02hx",
-                                                           &ismac[0], &ismac[1], &ismac[2], 
-                                                           &ismac[3], &ismac[4], &ismac[5]) != 6) {
-                                                fprintf(stderr, "%s: Illegal sourcemac, expected "
-                                                                "aa:bb:cc:dd:ee:ff or aabbccddeeff\n", argv[0]);
-                                                usage();
-                                                return -1;
-                                        }
-                                }
-                                asmac = 1;
-                                break;
-                        case 'D':
-                                if (sscanf(optarg, "%02hx:%02hx:%02hx:%02hx:%02hx:%02hx",
-                                                   &idmac[0], &idmac[1], &idmac[2], 
-                                                   &idmac[3], &idmac[4], &idmac[5]) != 6) {
-                                        if (sscanf(optarg, "%02hx%02hx%02hx%02hx%02hx%02hx",
-                                                           &idmac[0], &idmac[1], &idmac[2],