1 /*-
2 * SPDX-License-Identifier: BSD-4-Clause
3 *
4 * Copyright (c) 2005
5 * Bill Paul <[email protected]>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. All advertising materials mentioning features or use of this software
16 * must display the following acknowledgement:
17 * This product includes software developed by Bill Paul.
18 * 4. Neither the name of the author nor the names of any co-contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
26 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32 * THE POSSIBILITY OF SUCH DAMAGE.
33 */
34
35 #include <sys/cdefs.h>
36 __FBSDID("$FreeBSD$");
37
38 /*
39 * This file implements a small portion of the Winpcap API for the
40 * Windows NDIS interface in wpa_supplicant. It provides just enough
41 * routines to fool wpa_supplicant into thinking it's really running
42 * in a Windows environment.
43 */
44
45 #include <sys/types.h>
46 #include <sys/param.h>
47 #include <sys/socket.h>
48 #include <sys/ioctl.h>
49 #include <sys/errno.h>
50 #include <sys/sysctl.h>
51 #include <sys/fcntl.h>
52 #include <net/if.h>
53 #include <net/if_dl.h>
54
55 #include <netinet/in.h>
56 #include <arpa/inet.h>
57 #include <netdb.h>
58 #include <net/route.h>
59
60 #include <net80211/ieee80211_ioctl.h>
61
62 #include <stdio.h>
63 #include <string.h>
64 #include <stdlib.h>
65 #include <unistd.h>
66 #include <pcap.h>
67
68 #include "Packet32.h"
69
70 #define OID_802_11_ADD_KEY 0x0d01011D
71
72 typedef ULONGLONG NDIS_802_11_KEY_RSC;
73 typedef UCHAR NDIS_802_11_MAC_ADDRESS[6];
74
75 typedef struct NDIS_802_11_KEY {
76 ULONG Length;
77 ULONG KeyIndex;
78 ULONG KeyLength;
79 NDIS_802_11_MAC_ADDRESS BSSID;
80 NDIS_802_11_KEY_RSC KeyRSC;
81 UCHAR KeyMaterial[1];
82 } NDIS_802_11_KEY;
83
84 typedef struct NDIS_802_11_KEY_COMPAT {
85 ULONG Length;
86 ULONG KeyIndex;
87 ULONG KeyLength;
88 NDIS_802_11_MAC_ADDRESS BSSID;
89 UCHAR Pad[6]; /* Make struct layout match Windows. */
90 NDIS_802_11_KEY_RSC KeyRSC;
91 #ifdef notdef
92 UCHAR KeyMaterial[1];
93 #endif
94 } NDIS_802_11_KEY_COMPAT;
95
96 #define TRUE 1
97 #define FALSE 0
98
99 struct adapter {
100 int socket;
101 char name[IFNAMSIZ];
102 int prev_roaming;
103 };
104
105 PCHAR
PacketGetVersion(void)106 PacketGetVersion(void)
107 {
108 return("FreeBSD WinPcap compatibility shim v1.0");
109 }
110
111 void *
PacketOpenAdapter(CHAR * iface)112 PacketOpenAdapter(CHAR *iface)
113 {
114 struct adapter *a;
115 int s;
116 int ifflags;
117 struct ifreq ifr;
118 struct ieee80211req ireq;
119
120 s = socket(PF_INET, SOCK_DGRAM, 0);
121
122 if (s == -1)
123 return(NULL);
124
125 a = malloc(sizeof(struct adapter));
126 if (a == NULL)
127 return(NULL);
128
129 a->socket = s;
130 if (strncmp(iface, "\\Device\\NPF_", 12) == 0)
131 iface += 12;
132 else if (strncmp(iface, "\\DEVICE\\", 8) == 0)
133 iface += 8;
134 snprintf(a->name, IFNAMSIZ, "%s", iface);
135
136 /* Turn off net80211 roaming */
137 bzero((char *)&ireq, sizeof(ireq));
138 strncpy(ireq.i_name, iface, sizeof (ifr.ifr_name));
139 ireq.i_type = IEEE80211_IOC_ROAMING;
140 if (ioctl(a->socket, SIOCG80211, &ireq) == 0) {
141 a->prev_roaming = ireq.i_val;
142 ireq.i_val = IEEE80211_ROAMING_MANUAL;
143 if (ioctl(a->socket, SIOCS80211, &ireq) < 0)
144 fprintf(stderr,
145 "Could not set IEEE80211_ROAMING_MANUAL\n");
146 }
147
148 bzero((char *)&ifr, sizeof(ifr));
149 strncpy(ifr.ifr_name, iface, sizeof (ifr.ifr_name));
150 if (ioctl(a->socket, SIOCGIFFLAGS, (caddr_t)&ifr) < 0) {
151 free(a);
152 close(s);
153 return(NULL);
154 }
155 ifr.ifr_flags |= IFF_UP;
156 if (ioctl(a->socket, SIOCSIFFLAGS, (caddr_t)&ifr) < 0) {
157 free(a);
158 close(s);
159 return(NULL);
160 }
161
162 return(a);
163 }
164
165 int
PacketRequest(void * iface,BOOLEAN set,PACKET_OID_DATA * oid)166 PacketRequest(void *iface, BOOLEAN set, PACKET_OID_DATA *oid)
167 {
168 struct adapter *a;
169 uint32_t retval;
170 struct ifreq ifr;
171 NDIS_802_11_KEY *old;
172 NDIS_802_11_KEY_COMPAT *new;
173 PACKET_OID_DATA *o = NULL;
174
175 if (iface == NULL)
176 return(-1);
177
178 a = iface;
179 bzero((char *)&ifr, sizeof(ifr));
180
181 /*
182 * This hack is necessary to work around a difference
183 * betwee the GNU C and Microsoft C compilers. The NDIS_802_11_KEY
184 * structure has a uint64_t in it, right after an array of
185 * chars. The Microsoft compiler inserts padding right before
186 * the 64-bit value to align it on a 64-bit boundary, but
187 * GCC only aligns it on a 32-bit boundary. Trying to pass
188 * the GCC-formatted structure to an NDIS binary driver
189 * fails because some of the fields appear to be at the
190 * wrong offsets.
191 *
192 * To get around this, if we detect someone is trying to do
193 * a set operation on OID_802_11_ADD_KEY, we shuffle the data
194 * into a properly padded structure and pass that into the
195 * driver instead. This allows the driver_ndis.c code supplied
196 * with wpa_supplicant to work unmodified.
197 */
198
199 if (set == TRUE && oid->Oid == OID_802_11_ADD_KEY) {
200 old = (NDIS_802_11_KEY *)&oid->Data;
201 o = malloc(sizeof(PACKET_OID_DATA) +
202 sizeof(NDIS_802_11_KEY_COMPAT) + old->KeyLength);
203 if (o == NULL)
204 return(0);
205 bzero((char *)o, sizeof(PACKET_OID_DATA) +
206 sizeof(NDIS_802_11_KEY_COMPAT) + old->KeyLength);
207 o->Oid = oid->Oid;
208 o->Length = sizeof(NDIS_802_11_KEY_COMPAT) + old->KeyLength;
209 new = (NDIS_802_11_KEY_COMPAT *)&o->Data;
210 new->KeyRSC = old->KeyRSC;
211 new->Length = o->Length;
212 new->KeyIndex = old->KeyIndex;
213 new->KeyLength = old->KeyLength;
214 bcopy(old->BSSID, new->BSSID, sizeof(NDIS_802_11_MAC_ADDRESS));
215 bcopy(old->KeyMaterial, (char *)new +
216 sizeof(NDIS_802_11_KEY_COMPAT), new->KeyLength);
217 ifr.ifr_data = (caddr_t)o;
218 } else
219 ifr.ifr_data = (caddr_t)oid;
220
221 strlcpy(ifr.ifr_name, a->name, sizeof(ifr.ifr_name));
222
223 if (set == TRUE)
224 retval = ioctl(a->socket, SIOCSDRVSPEC, &ifr);
225 else
226 retval = ioctl(a->socket, SIOCGDRVSPEC, &ifr);
227
228 if (o != NULL)
229 free(o);
230
231 if (retval)
232 return(0);
233
234 return(1);
235 }
236
237 int
PacketGetAdapterNames(CHAR * namelist,ULONG * len)238 PacketGetAdapterNames(CHAR *namelist, ULONG *len)
239 {
240 int mib[6];
241 size_t needed;
242 struct if_msghdr *ifm;
243 struct sockaddr_dl *sdl;
244 char *buf, *lim, *next;
245 char *plist;
246 int spc;
247 int i, ifcnt = 0;
248
249 plist = namelist;
250 spc = 0;
251
252 bzero(plist, *len);
253
254 needed = 0;
255 mib[0] = CTL_NET;
256 mib[1] = PF_ROUTE;
257 mib[2] = 0; /* protocol */
258 mib[3] = 0; /* wildcard address family */
259 mib[4] = NET_RT_IFLIST;
260 mib[5] = 0; /* no flags */
261
262 if (sysctl (mib, 6, NULL, &needed, NULL, 0) < 0)
263 return(FALSE);
264
265 buf = malloc (needed);
266 if (buf == NULL)
267 return(FALSE);
268
269 if (sysctl (mib, 6, buf, &needed, NULL, 0) < 0) {
270 free(buf);
271 return(FALSE);
272 }
273
274 lim = buf + needed;
275
276 /* Generate interface name list. */
277
278 next = buf;
279 while (next < lim) {
280 ifm = (struct if_msghdr *)next;
281 if (ifm->ifm_type == RTM_IFINFO) {
282 sdl = (struct sockaddr_dl *)(ifm + 1);
283 if (strnstr(sdl->sdl_data, "wlan", sdl->sdl_nlen)) {
284 if ((spc + sdl->sdl_nlen) > *len) {
285 free(buf);
286 return(FALSE);
287 }
288 strncpy(plist, sdl->sdl_data, sdl->sdl_nlen);
289 plist += (sdl->sdl_nlen + 1);
290 spc += (sdl->sdl_nlen + 1);
291 ifcnt++;
292 }
293 }
294 next += ifm->ifm_msglen;
295 }
296
297
298 /* Insert an extra "" as a spacer */
299
300 plist++;
301 spc++;
302
303 /*
304 * Now generate the interface description list. There
305 * must be a unique description for each interface, and
306 * they have to match what the ndis_events program will
307 * feed in later. To keep this simple, we just repeat
308 * the interface list over again.
309 */
310
311 next = buf;
312 while (next < lim) {
313 ifm = (struct if_msghdr *)next;
314 if (ifm->ifm_type == RTM_IFINFO) {
315 sdl = (struct sockaddr_dl *)(ifm + 1);
316 if (strnstr(sdl->sdl_data, "wlan", sdl->sdl_nlen)) {
317 if ((spc + sdl->sdl_nlen) > *len) {
318 free(buf);
319 return(FALSE);
320 }
321 strncpy(plist, sdl->sdl_data, sdl->sdl_nlen);
322 plist += (sdl->sdl_nlen + 1);
323 spc += (sdl->sdl_nlen + 1);
324 ifcnt++;
325 }
326 }
327 next += ifm->ifm_msglen;
328 }
329
330 free (buf);
331
332 *len = spc + 1;
333
334 return(TRUE);
335 }
336
337 void
PacketCloseAdapter(void * iface)338 PacketCloseAdapter(void *iface)
339 {
340 struct adapter *a;
341 struct ifreq ifr;
342 struct ieee80211req ireq;
343
344 if (iface == NULL)
345 return;
346
347 a = iface;
348
349 /* Reset net80211 roaming */
350 bzero((char *)&ireq, sizeof(ireq));
351 strncpy(ireq.i_name, a->name, sizeof (ifr.ifr_name));
352 ireq.i_type = IEEE80211_IOC_ROAMING;
353 ireq.i_val = a->prev_roaming;
354 ioctl(a->socket, SIOCS80211, &ireq);
355
356 bzero((char *)&ifr, sizeof(ifr));
357 strncpy(ifr.ifr_name, a->name, sizeof (ifr.ifr_name));
358 ioctl(a->socket, SIOCGIFFLAGS, (caddr_t)&ifr);
359 ifr.ifr_flags &= ~IFF_UP;
360 ioctl(a->socket, SIOCSIFFLAGS, (caddr_t)&ifr);
361 close(a->socket);
362 free(a);
363
364 return;
365 }
366
367 #if __FreeBSD_version < 600000
368
369 /*
370 * The version of libpcap in FreeBSD 5.2.1 doesn't have these routines.
371 * Call me insane if you will, but I still run 5.2.1 on my laptop, and
372 * I'd like to use WPA there.
373 */
374
375 int
pcap_get_selectable_fd(pcap_t * p)376 pcap_get_selectable_fd(pcap_t *p)
377 {
378 return(pcap_fileno(p));
379 }
380
381 /*
382 * The old version of libpcap opens its BPF descriptor in read-only
383 * mode. We need to temporarily create a new one we can write to.
384 */
385
386 int
pcap_inject(pcap_t * p,const void * buf,size_t len)387 pcap_inject(pcap_t *p, const void *buf, size_t len)
388 {
389 int fd;
390 int res, n = 0;
391 char device[sizeof "/dev/bpf0000000000"];
392 struct ifreq ifr;
393
394 /*
395 * Go through all the minors and find one that isn't in use.
396 */
397 do {
398 (void)snprintf(device, sizeof(device), "/dev/bpf%d", n++);
399 fd = open(device, O_RDWR);
400 } while (fd < 0 && errno == EBUSY);
401
402 if (fd == -1)
403 return(-1);
404
405 bzero((char *)&ifr, sizeof(ifr));
406 ioctl(pcap_fileno(p), BIOCGETIF, (caddr_t)&ifr);
407 ioctl(fd, BIOCSETIF, (caddr_t)&ifr);
408
409 res = write(fd, buf, len);
410
411 close(fd);
412
413 return(res);
414 }
415 #endif
416