Changeset 99

Show
Ignore:
Timestamp:
02/22/07 16:37:48 (23 months ago)
Author:
dragorn
Message:

started forge rewrite (untested)

Location:
trunk
Files:
2 modified

Legend:

Unmodified
Added
Removed

  • trunk/lorcon_forge.c

    r33 r99  
    2626#include <stdio.h> 
    2727 
    28 #include "packetforge.h" 
    29 #include "ieee80211.h" 
    3028#include "endian_magic.h" 
     29 
     30#include "lorcon_forge.h" 
    3131 
    3232uint8_t *ouilist[] = { 
    … …  
    5757}; 
    5858 
    59 void lcpf_createrandmac(uint8_t *addr) { 
    60     int listlen = 0; 
     59void lcpf_randmac(uint8_t *addr, int valid) { 
     60    static int listlen = 0; 
    6161 
    62     while (ouilist[listlen] != NULL) { 
    63         listlen++; 
    64     }; 
     62        if (listlen == 0) { 
     63                while (ouilist[listlen] != NULL) { 
     64                        listlen++; 
     65                }; 
     66        } 
    6567 
    66     memcpy(addr, ouilist[rand() % listlen], 3); 
     68        if (valid) { 
     69                memcpy(addr, ouilist[rand() % listlen], 3); 
     70        } else { 
     71                addr[0] = rand() % 255; 
     72                addr[1] = rand() % 255; 
     73                addr[2] = rand() % 255; 
     74        } 
     75 
    6776    addr[3] = rand() % 255; 
    6877    addr[4] = rand() % 255; 
    … …  
    7079} 
    7180 
    72 lcpf_packet *lcpf_packet_init(int in_carriermax, uint8_t in_type, uint8_t in_subtype,  
    73                               uint8_t *in_addr0, uint8_t *in_addr1, uint8_t *in_addr2) { 
    74     lcpf_packet *pak; 
     81void lcpf_80211headers(metapacket *pack, unsigned int type, unsigned int subtype, 
     82                                           unsigned int fcflags, unsigned int duration, 
     83                                           uint8_t *mac1, uint8_t *mac2, uint8_t *mac3, 
     84                                           uint8_t *mac4, unsigned int fragment,  
     85                                           unsigned int sequence) { 
    7586 
    76     pak = (lcpf_packet *) malloc(sizeof(lcpf_packet)); 
    77     pak->raw_buf = (uint8_t *) malloc(in_carriermax); 
    78     pak->maxlen = in_carriermax; 
    79     pak->len = IEEE80211_HDRLEN; 
    80     pak->ieee_header = &(pak->raw_buf[0]); 
    81     pak->append_ptr = &(pak->raw_buf[len]); 
    82     pak->nr_tagparms = 0; 
     87        /* Re-use a single buffer and use the copy ops, saves a malloc 
     88         * thrash */ 
     89        uint8_t chunk[2]; 
     90        uint16_t *sixptr; 
    8391 
    84     memset(pak->ieee_header, 0, sizeof(ieee80211_hdr)); 
     92        chunk[0] = ((type << 2) | (subtype << 4)); 
     93        chunk[1] = (uint8_t) fcflags; 
     94        pack = pack_append_copy(pack, "80211FC", 2, chunk); 
    8595 
    86     pak->ieee_header = host_to_le16((in_type << 2) | (in_subtype << 4)); 
     96        sixptr = (uint16_t *) chunk; 
     97        *sixptr = htons((uint16_t) duration); 
     98        pack = pack_append_copy(pack, "80211DUR", 2, chunk); 
    8799 
    88     memcpy(pak->ieee_header->addr1, in_addr1, 6); 
    89     memcpy(pak->ieee_header->addr2, in_addr2, 6); 
    90     memcpy(pak->ieee_header->addr3, in_addr3, 6); 
     100        if (mac1 != NULL) 
     101                pack = pack_append_copy(pack, "80211MAC1", 6, mac1); 
     102        if (mac2 != NULL) 
     103                pack = pack_append_copy(pack, "80211MAC2", 6, mac2); 
     104        if (mac3 != NULL) 
     105                pack = pack_append_copy(pack, "80211MAC3", 6, mac3); 
     106        if (mac4 != NULL) 
     107                pack = pack_append_copy(pack, "80211MAC4", 6, mac4); 
    91108 
    92     return pak; 
     109        *sixptr = ((sequence << 4) | fragment); 
     110        pack = pack_append_copy(pack, "80211FRAGSEQ", 2, chunk); 
    93111} 
    94112 
    95 void lcpf_packet_destroy(lcpf_packet *mod_packet) { 
    96     free(mod_packet->raw_buf); 
    97     free(mod_packet); 
    98 } 
     113void lcpf_beacon(metapacket *pack, uint8_t *src, uint8_t *bssid, int framecontrol, 
     114                                 int duration, int fragment, int sequence,  
     115                                 uint64_t timestamp, int beacon, int capabilities) { 
     116        uint8_t chunk[8]; 
     117        uint16_t *sixptr = (uint16_t *) chunk; 
     118        uint64_t *ch64 = (uint64_t *) chunk; 
    99119 
    100 int lcpf_packet_addtagparm(int in_parm, int in_len, uint8_t *in_data,  
    101                            lcpf_packet *mod_packet) { 
    102     if (mod_packet-> 
     120        memcpy(chunk, "\xFF\xFF\xFF\xFF\xFF\xFF", 6); 
     121        lcpf_80211headers(pack, 0, 8, framecontrol, duration, 
     122                                          chunk, src, bssid, NULL, 
     123                                          fragment, sequence); 
     124 
     125        *ch64 = timestamp; 
     126        pack = pack_append_copy(pack, "BEACONBSSTIME", 8, chunk); 
     127 
     128        *sixptr = beacon; 
     129        pack = pack_append_copy(pack, "BEACONINT", 2, chunk); 
     130 
     131        *sixptr = capabilities; 
     132        pack = pack_append_copy(pack, "BEACONCAP", 2, chunk); 
    103133 
    104134} 
    105135 
    106 int PacketForgeDeauth(uint8_t *in_bssid, uint8_t *in_source,  
    107                       uint8_t *in_dest, uint8_t **ret_frame) { 
    108     struct ieee80211_mgmt txheader; 
    109     int len; 
    110      
    111     memset(&txheader, 0, sizeof(txheader)); 
    112  
    113     txheader.frame_control = host_to_le16(WLAN_FC_TYPE_MGMT << 2) |  
    114         (WLAN_FC_SUBTYPE_DEAUTH << 4); 
    115  
    116     // Fill in the addresses 
    117     memcpy(txheader.bssid, in_bssid, 6); 
    118      
    119     if (in_source != NULL) 
    120         memcpy(txheader.sa, in_source, 6); 
    121     else 
    122         memcpy(txheader.sa, in_bssid, 6); 
    123  
    124     if (in_dest != NULL) 
    125         memcpy(txheader.da, in_dest, 6); 
    126     else 
    127         memset(txheader.da, 0xFF, 6); 
    128  
    129     // Fill in the reason 
    130     txheader.u.deauth.reason_code = host_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID); 
    131  
    132     // Alloc and copy it into the return buffer 
    133     len = (IEEE80211_HDRLEN + sizeof(txheader.u.deauth)); 
    134  
    135     *ret_frame = new uint8_t[len]; 
    136     memcpy(*ret_frame, &txheader, len); 
    137  
    138     return len; 
    139 } 
    140  
    141 int PacketForgeDisassoc(uint8_t *in_bssid, uint8_t *in_source, 
    142                         uint8_t *in_dest, uint8_t **ret_frame) { 
    143     struct ieee80211_mgmt txheader; 
    144     int len; 
    145  
    146     memset(&txheader, 0, sizeof(txheader)); 
    147  
    148     txheader.frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) | 
    149         (WLAN_FC_SUBTYPE_DISASSOC << 4)); 
    150  
    151     // Fill in the addresses 
    152     memcpy(txheader.bssid, in_bssid, 6); 
    153      
    154     if (in_source != NULL) 
    155         memcpy(txheader.sa, in_source, 6); 
    156     else 
    157         memcpy(txheader.sa, in_bssid, 6); 
    158  
    159     if (in_dest != NULL) 
    160         memcpy(txheader.da, in_dest, 6); 
    161     else 
    162         memset(txheader.da, 0xFF, 6); 
    163  
    164     txheader.u.disassoc.reason_code = host_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID); 
    165  
    166     len = (IEEE80211_HDRLEN + sizeof(txheader.u.disassoc)); 
    167     *ret_frame = new uint8_t[len]; 
    168     memcpy(*ret_frame, &txheader, len); 
    169  
    170     return len; 
    171 } 
    172  
    173 int PacketForgeAssocReq(uint8_t *in_bssid, uint8_t *in_source, const char *in_ssid, 
    174                         int in_wep, uint8_t **ret_frame) { 
    175     // Highly influenced by some old airjack code and void11 
    176     struct ieee80211_mgmt txheader; 
    177     int len; 
    178     uint8_t *variable; 
    179     int vlen; 
    180  
    181     memset(&txheader, 0, sizeof(txheader)); 
    182  
    183     // Variable = 1b tag 1b len Xb ssid 1b tag 1b size 4b supprates 
    184     vlen = 8 + strlen(in_ssid); 
    185     variable = new uint8_t[vlen]; 
    186  
    187     txheader.frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) | 
    188         (WLAN_FC_SUBTYPE_ASSOCREQ << 4)); 
    189  
    190     // Fill in random if we weren't given a source to assoc from 
    191     if (in_source == NULL)  
    192         PacketForgeCreateRandmac(txheader.sa); 
    193     else 
    194         memcpy(txheader.sa, in_source, 6); 
    195  
    196     memcpy(txheader.da, in_bssid, 6); 
    197     memcpy(txheader.bssid, in_bssid, 6); 
    198  
    199     // Set the capability fields 
    200     txheader.u.assoc_req.capab_info = host_to_le16(WLAN_CAPABILITY_ESS); 
    201     if (in_wep) 
    202         txheader.u.assoc_req.capab_info |= host_to_le16(WLAN_CAPABILITY_PRIVACY); 
    203  
    204     txheader.u.assoc_req.listen_interval = host_to_le16(1); 
    205  
    206     int voff = 0; 
    207     variable[voff++] = WLAN_TAGPARM_SSID; 
    208     variable[voff++] = strlen(in_ssid); 
    209     memcpy(&(variable[voff]), in_ssid, strlen(in_ssid)); 
    210     voff += strlen(in_ssid); 
    211     variable[voff++] = WLAN_TAGPARM_SUPPRATES; 
    212     variable[voff++] = 4; 
    213         variable[voff++] = 0x82; // 1mbit 
    214     variable[voff++] = 0x84; // 2mbit 
    215     variable[voff++] = 0x0b; // 5.5 
    216     variable[voff++] = 0x16; // 11 
    217  
    218     // Play some games copying the variable after the standard frame 
    219     len = (IEEE80211_HDRLEN + sizeof(txheader.u.assoc_req)); 
    220     *ret_frame = new uint8_t[len + vlen]; 
    221     memcpy(*ret_frame, &txheader, len); 
    222     memcpy((*ret_frame) + len, variable, vlen); 
    223     len += vlen; 
    224  
    225     delete[] variable; 
    226     return len; 
    227 } 
    228  
    229 int PacketForgeAuth(uint8_t *in_source, uint8_t *in_dest, uint8_t **ret_frame) { 
    230     // Highly influenced by some old airjack code and void11 
    231     struct ieee80211_mgmt txheader; 
    232     int len; 
    233  
    234     memset(&txheader, 0, sizeof(txheader)); 
    235      
    236     txheader.frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) | 
    237         (WLAN_FC_SUBTYPE_AUTH << 4)); 
    238  
    239     // Fill in random if we weren't given a source to assoc from 
    240     if (in_source == NULL)  
    241         PacketForgeCreateRandmac(txheader.sa); 
    242     else 
    243         memcpy(txheader.sa, in_source, 6); 
    244  
    245     memcpy(txheader.da, in_dest, 6); 
    246     memcpy(txheader.bssid, in_dest, 6); 
    247  
    248     txheader.u.auth.auth_alg = host_to_le16(0); 
    249     txheader.u.auth.auth_transaction = host_to_le16(1); 
    250     txheader.u.auth.status_code = host_to_le16(0); 
    251  
    252     len = (IEEE80211_HDRLEN + sizeof(txheader.u.auth)); 
    253     *ret_frame = new uint8_t[len]; 
    254     memcpy(*ret_frame, &txheader, len); 
    255      
    256     return len; 
    257 } 
    258  
    259 int PacketForgeProbeReq(uint8_t *in_source, const char *in_ssid, uint8_t **ret_frame) { 
    260     // Highly influenced by some old airjack code and void11 
    261     struct ieee80211_mgmt txheader; 
    262     int len; 
    263     uint8_t *variable; 
    264     int vlen; 
    265  
    266     memset(&txheader, 0, sizeof(txheader)); 
    267  
    268     // Variable = 1b tag 1b len Xb ssid 1b tag 1b size 4b supprates 
    269     vlen = 8 + strlen(in_ssid); 
    270     variable = new uint8_t[vlen]; 
    271  
    272     txheader.frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) | 
    273         (WLAN_FC_SUBTYPE_PROBEREQ << 4)); 
    274  
    275     // Fill in random if we weren't given a source to probe from 
    276     if (in_source == NULL)  
    277         PacketForgeCreateRandmac(txheader.sa); 
    278     else 
    279         memcpy(txheader.sa, in_source, 6); 
    280  
    281     memset(txheader.da, 0xFF, 6); 
    282     memset(txheader.bssid, 0xFF, 6); 
    283  
    284     int voff = 0; 
    285     variable[voff++] = WLAN_TAGPARM_SSID; 
    286     variable[voff++] = strlen(in_ssid); 
    287     memcpy(&(variable[voff]), in_ssid, strlen(in_ssid)); 
    288     voff += strlen(in_ssid); 
    289     variable[voff++] = WLAN_TAGPARM_SUPPRATES; 
    290     variable[voff++] = 4; 
    291         variable[voff++] = 0x82; // 1mbit 
    292     variable[voff++] = 0x84; // 2mbit 
    293     variable[voff++] = 0x0b; // 5.5 
    294     variable[voff++] = 0x16; // 11 
    295  
    296     // Play some games copying the variable after the standard frame 
    297     len = (IEEE80211_HDRLEN + sizeof(txheader.u.probe_req)); 
    298     *ret_frame = new uint8_t[len + vlen]; 
    299     memcpy(*ret_frame, &txheader, len); 
    300     memcpy((*ret_frame) + len, variable, vlen); 
    301     len += vlen; 
    302  
    303     delete[] variable; 
    304     return len; 
    305 } 
    306  

  • trunk/lorcon_forge.h

    r68 r99  
    3333#include "ieee_80211.h" 
    3434 
    35 // Tagged parameter in a frame 
    36 typedef struct lcpf_tagparm { 
    37         uint8_t tag_num; 
    38         uint8_t tag_len; 
    39         uint8_t tag_data[0]; 
    40 } __attribute__ ((packed)); 
     35#include "packet_assembly.h" 
    4136 
    42 #define lcpf_genstate_init          0 
    43 #define lcpf_genstate_ 
     37/* 
     38 * Lorcon Packet Forge 
     39 * 
     40 * Relatively simplistic mechanism for building 802.11 frames using the lorcon 
     41 * packet assembly utilities. 
     42 * 
     43 * Utility functions are included for most of the 802.11 packet types, as well 
     44 * as functions for adding to dynamically sized types. 
     45 * 
     46 * All lorcon packet forge functions use the lcpf_ namespace 
     47 */ 
    4448 
    45 typedef struct lcpf_packet { 
    46         // Generation state (can't add tagparms after raw payload, for example) 
    47         uint8_t gen_state; 
    48         // Raw packet buffer 
    49         uint8_t *raw_buf; 
    50         // Current length and maximum possible length 
    51         unsigned int len; 
    52         unsigned int max_len; 
    53         // Pointer to where to append data 
    54         uint8_t *append_ptr; 
     49/* Create a random MAC address, optionally seeded with a valid wireless OUI 
     50 * 
     51 * addr must be allocated by the caller 
     52 */ 
     53void lcpf_randmac(uint8_t *addr, int valid); 
    5554 
    56         ieee802_hdr *ieee_header; 
    57         uint8_t *data_payload; 
     55/* Generate the common 802.11 headers.  Lower-level function which will generally 
     56 * be wrapped in packet-specific functions 
     57 * 
     58 * pack is expected to be an initialized, empty metapack. 
     59 * 
     60 * mac1 through mac4 are expected to contain NULL or a MAC address for that 
     61 * slot.  The interpretation of the MAC address in each slot will vary per 
     62 * 802.11 type, the caller is expected to provide the MACs in appropriate order. 
     63 * 
     64 */ 
     65void lcpf_80211headers(metapacket *pack, unsigned int type, unsigned int subtype, 
     66                                           unsigned int fcflags, unsigned int duration, 
     67                                           uint8_t *mac1, uint8_t *mac2, uint8_t *mac3, 
     68                                           uint8_t *mac4, unsigned int fragment,  
     69                                           unsigned int sequence); 
    5870 
    59         struct { 
    60                 uint8_t nr_tagparms; 
    61                 lcpf_tagparm *tagparms; 
    62         } tagged_parameters; 
    63  
    64         struct ieee80211_mgmt *mgmt_header; 
    65 }; 
    66  
    67 // Forge a random mac within a reasonable OUI 
    68 void lcpf_createrandmac(uint8_t * addr); 
    69  
    70 // Initialize a raw frame with the provided info 
    71 lcpf_packet *lcpf_packet_init(int in_carriermax, uint8_t in_type, 
    72                               uint8_t in_subtype, uint8_t * in_addr0, 
    73                               uint8_t * in_addr1, uint8_t * in_addr2); 
    74  
    75 // Add a tagged parameter to a packet 
    76 int lcpf_packet_addtagparm(int in_parm, int in_len, uint8_t * in_data, 
    77                            lcpf_packet * mod_packet); 
    78  
    79 // Add a data payload 
    80 int lcpf_packet_addpayload(int in_len, uint8_t * in_data, 
    81                            lcpf_packet * mod_packet); 
     71/* Generate a beacon frame header with no IE tags (see lcpf_appendie) 
     72 * 
     73 * pack is expected to be an initialized, empty metapack 
     74 * 
     75 */ 
     76void lcpf_beacon(metapacket *pack, uint8_t *src, uint8_t *bssid, int framecontrol, 
     77                                 int duration, int fragment, int sequence,  
     78                                 uint64_t timestamp, int beacon, int capabilities); 
    8279 
    8380#endif