Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2024-11-25 00:38:24 -05:00
Code Issues Projects Releases Wiki Activity

Renamed Ping procedure into SA Query procedure per 802.11w/D7.0

Browse Source 
This commit changes just the name and Action category per D7.0. The
retransmit/timeout processing in the AP is not yet updated with the
changes in D7.0.
This commit is contained in:
Jouni Malinen 2008-12-26 11:46:21 +02:00
parent 9a9876bf9c
commit 93b76319f1
6 changed files with 109 additions and 105 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
hostapd/ap.h
View File

@ -1,6 +1,6 @@
/*
* hostapd / Station table data structures
* Copyright (c) 2002-2004, Jouni Malinen <j@w1.fi>
* Copyright (c) 2002-2008, Jouni Malinen <j@w1.fi>
* Copyright (c) 2007-2008, Intel Corporation
*
* This program is free software; you can redistribute it and/or modify
@ -100,11 +100,12 @@ struct sta_info {
#endif /* CONFIG_IEEE80211N */
#ifdef CONFIG_IEEE80211W
int ping_count; /* number of pending ping requests;
* 0 = no ping in progress */
int ping_timed_out;
u8 *ping_trans_id; /* buffer of WLAN_PING_TRANS_ID_LEN * ping_count
* octets of pending ping transaction identifiers */
int sa_query_count; /* number of pending SA Query requests;
* 0 = no SA Query in progress */
int sa_query_timed_out;
u8 *sa_query_trans_id; /* buffer of WLAN_SA_QUERY_TR_ID_LEN *
* sa_query_count octets of pending SA Query
* transaction identifiers */
#endif /* CONFIG_IEEE80211W */
struct wpabuf *wps_ie; /* WPS IE from (Re)Association Request */

61
hostapd/ieee802_11.c
View File

@ -302,7 +302,7 @@ static u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
*pos++ = WLAN_EID_ASSOC_COMEBACK_TIME;
*pos++ = 4;
timeout = (hapd->conf->assoc_ping_attempts - sta->ping_count + 1) *
timeout = (hapd->conf->assoc_ping_attempts - sta->sa_query_count + 1) *
hapd->conf->assoc_ping_timeout;
WPA_PUT_LE32(pos, timeout);
pos += 4;
@ -893,16 +893,16 @@ static void handle_assoc(struct hostapd_data *hapd,
if (resp != WLAN_STATUS_SUCCESS)
goto fail;
#ifdef CONFIG_IEEE80211W
if ((sta->flags & WLAN_STA_MFP) && !sta->ping_timed_out) {
if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out) {
/*
* STA has already been associated with MFP and ping
* timeout has not been reached. Reject the
* association attempt temporarily and start ping, if
* one is not pending.
* STA has already been associated with MFP and SA
* Query timeout has not been reached. Reject the
* association attempt temporarily and start SA Query,
* if one is not pending.
*/
if (sta->ping_count == 0)
ap_sta_start_ping(hapd, sta);
if (sta->sa_query_count == 0)
ap_sta_start_sa_query(hapd, sta);
resp = WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
goto fail;
@ -1225,51 +1225,54 @@ static void handle_beacon(struct hostapd_data *hapd,
#ifdef CONFIG_IEEE80211W
static void hostapd_ping_action(struct hostapd_data *hapd,
struct ieee80211_mgmt *mgmt, size_t len)
static void hostapd_sa_query_action(struct hostapd_data *hapd,
struct ieee80211_mgmt *mgmt, size_t len)
{
struct sta_info *sta;
u8 *end;
int i;
end = mgmt->u.action.u.ping_resp.trans_id + WLAN_PING_TRANS_ID_LEN;
end = mgmt->u.action.u.sa_query_resp.trans_id +
WLAN_SA_QUERY_TR_ID_LEN;
if (((u8 *) mgmt) + len < end) {
wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short Ping Action "
wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
"frame (len=%lu)", (unsigned long) len);
return;
}
if (mgmt->u.action.u.ping_resp.action != WLAN_PING_RESPONSE) {
wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected Ping Action %d",
mgmt->u.action.u.ping_resp.action);
if (mgmt->u.action.u.sa_query_resp.action != WLAN_SA_QUERY_RESPONSE) {
wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
"Action %d", mgmt->u.action.u.sa_query_resp.action);
return;
}
/* MLME-PING.confirm */
/* MLME-SAQuery.confirm */
sta = ap_get_sta(hapd, mgmt->sa);
if (sta == NULL || sta->ping_trans_id == NULL) {
if (sta == NULL || sta->sa_query_trans_id == NULL) {
wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
"pending ping request found");
"pending SA Query request found");
return;
}
for (i = 0; i < sta->ping_count; i++) {
if (os_memcmp(sta->ping_trans_id + i * WLAN_PING_TRANS_ID_LEN,
mgmt->u.action.u.ping_resp.trans_id,
WLAN_PING_TRANS_ID_LEN) == 0)
for (i = 0; i < sta->sa_query_count; i++) {
if (os_memcmp(sta->sa_query_trans_id +
i * WLAN_SA_QUERY_TR_ID_LEN,
mgmt->u.action.u.sa_query_resp.trans_id,
WLAN_SA_QUERY_TR_ID_LEN) == 0)
break;
}
if (i >= sta->ping_count) {
wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching ping "
if (i >= sta->sa_query_count) {
wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
"transaction identifier found");
return;
}
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG, "Reply to pending ping received");
ap_sta_stop_ping(hapd, sta);
HOSTAPD_LEVEL_DEBUG,
"Reply to pending SA Query received");
ap_sta_stop_sa_query(hapd, sta);
}
#endif /* CONFIG_IEEE80211W */
@ -1310,8 +1313,8 @@ static void handle_action(struct hostapd_data *hapd,
hostapd_wme_action(hapd, mgmt, len);
return;
#ifdef CONFIG_IEEE80211W
case WLAN_ACTION_PING:
hostapd_ping_action(hapd, mgmt, len);
case WLAN_ACTION_SA_QUERY:
hostapd_sa_query_action(hapd, mgmt, len);
return;
#endif /* CONFIG_IEEE80211W */
}
@ -1529,7 +1532,7 @@ static void handle_assoc_cb(struct hostapd_data *hapd,
#endif /* CONFIG_IEEE80211N */
#ifdef CONFIG_IEEE80211W
sta->ping_timed_out = 0;
sta->sa_query_timed_out = 0;
#endif /* CONFIG_IEEE80211W */
if (hostapd_sta_add(hapd->conf->iface, hapd, sta->addr, sta->aid,

70
hostapd/sta_info.c
View File

@ -35,7 +35,7 @@ static int ap_sta_in_other_bss(struct hostapd_data *hapd,
struct sta_info *sta, u32 flags);
static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx);
#ifdef CONFIG_IEEE80211W
static void ap_ping_timer(void *eloop_ctx, void *timeout_ctx);
static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx);
#endif /* CONFIG_IEEE80211W */
int ap_for_each_sta(struct hostapd_data *hapd,
@ -189,8 +189,8 @@ void ap_free_sta(struct hostapd_data *hapd, struct sta_info *sta)
os_free(sta->challenge);
#ifdef CONFIG_IEEE80211W
os_free(sta->ping_trans_id);
eloop_cancel_timeout(ap_ping_timer, hapd, sta);
os_free(sta->sa_query_trans_id);
eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);
#endif /* CONFIG_IEEE80211W */
wpabuf_free(sta->wps_ie);
@ -613,9 +613,9 @@ int ap_sta_bind_vlan(struct hostapd_data *hapd, struct sta_info *sta,
#ifdef CONFIG_IEEE80211W
/* MLME-PING.request */
static void ieee802_11_send_ping_req(struct hostapd_data *hapd, const u8 *addr,
const u8 *trans_id)
/* MLME-SAQuery.request */
static void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
const u8 *addr, const u8 *trans_id)
{
struct ieee80211_mgmt mgmt;
u8 *end;
@ -626,70 +626,70 @@ static void ieee802_11_send_ping_req(struct hostapd_data *hapd, const u8 *addr,
os_memcpy(mgmt.da, addr, ETH_ALEN);
os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
mgmt.u.action.category = WLAN_ACTION_PING;
mgmt.u.action.u.ping_req.action = WLAN_PING_REQUEST;
os_memcpy(mgmt.u.action.u.ping_req.trans_id, trans_id,
WLAN_PING_TRANS_ID_LEN);
end = mgmt.u.action.u.ping_req.trans_id + WLAN_PING_TRANS_ID_LEN;
mgmt.u.action.category = WLAN_ACTION_SA_QUERY;
mgmt.u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
os_memcpy(mgmt.u.action.u.sa_query_req.trans_id, trans_id,
WLAN_SA_QUERY_TR_ID_LEN);
end = mgmt.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
if (hostapd_send_mgmt_frame(hapd, &mgmt, IEEE80211_HDRLEN +
end - (u8 *) &mgmt, 0) < 0)
perror("ieee802_11_send_ping_req: send");
perror("ieee802_11_send_sa_query_req: send");
}
static void ap_ping_timer(void *eloop_ctx, void *timeout_ctx)
static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
{
struct hostapd_data *hapd = eloop_ctx;
struct sta_info *sta = timeout_ctx;
unsigned int timeout, sec, usec;
u8 *trans_id, *nbuf;
if (sta->ping_count >= hapd->conf->assoc_ping_attempts) {
if (sta->sa_query_count >= hapd->conf->assoc_ping_attempts) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"association ping timed out");
sta->ping_timed_out = 1;
os_free(sta->ping_trans_id);
sta->ping_trans_id = NULL;
sta->ping_count = 0;
"association SA Query timed out");
sta->sa_query_timed_out = 1;
os_free(sta->sa_query_trans_id);
sta->sa_query_trans_id = NULL;
sta->sa_query_count = 0;
return;
}
nbuf = os_realloc(sta->ping_trans_id,
(sta->ping_count + 1) * WLAN_PING_TRANS_ID_LEN);
nbuf = os_realloc(sta->sa_query_trans_id,
(sta->sa_query_count + 1) * WLAN_SA_QUERY_TR_ID_LEN);
if (nbuf == NULL)
return;
trans_id = nbuf + sta->ping_count * WLAN_PING_TRANS_ID_LEN;
sta->ping_trans_id = nbuf;
sta->ping_count++;
trans_id = nbuf + sta->sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
sta->sa_query_trans_id = nbuf;
sta->sa_query_count++;
os_get_random(trans_id, WLAN_PING_TRANS_ID_LEN);
os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN);
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_DEBUG,
"association ping attempt %d", sta->ping_count);
"association SA Query attempt %d", sta->sa_query_count);
ieee802_11_send_ping_req(hapd, sta->addr, trans_id);
ieee802_11_send_sa_query_req(hapd, sta->addr, trans_id);
timeout = hapd->conf->assoc_ping_timeout;
sec = ((timeout / 1000) * 1024) / 1000;
usec = (timeout % 1000) * 1024;
eloop_register_timeout(sec, usec, ap_ping_timer, hapd, sta);
eloop_register_timeout(sec, usec, ap_sa_query_timer, hapd, sta);
}
void ap_sta_start_ping(struct hostapd_data *hapd, struct sta_info *sta)
void ap_sta_start_sa_query(struct hostapd_data *hapd, struct sta_info *sta)
{
ap_ping_timer(hapd, sta);
ap_sa_query_timer(hapd, sta);
}
void ap_sta_stop_ping(struct hostapd_data *hapd, struct sta_info *sta)
void ap_sta_stop_sa_query(struct hostapd_data *hapd, struct sta_info *sta)
{
eloop_cancel_timeout(ap_ping_timer, hapd, sta);
os_free(sta->ping_trans_id);
sta->ping_trans_id = NULL;
sta->ping_count = 0;
eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);
os_free(sta->sa_query_trans_id);
sta->sa_query_trans_id = NULL;
sta->sa_query_count = 0;
}
#endif /* CONFIG_IEEE80211W */

6
hostapd/sta_info.h
View File

@ -1,6 +1,6 @@
/*
* hostapd / Station table
* Copyright (c) 2002-2004, Jouni Malinen <j@w1.fi>
* Copyright (c) 2002-2008, Jouni Malinen <j@w1.fi>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
@ -36,7 +36,7 @@ void ap_sta_deauthenticate(struct hostapd_data *hapd, struct sta_info *sta,
u16 reason);
int ap_sta_bind_vlan(struct hostapd_data *hapd, struct sta_info *sta,
int old_vlanid);
void ap_sta_start_ping(struct hostapd_data *hapd, struct sta_info *sta);
void ap_sta_stop_ping(struct hostapd_data *hapd, struct sta_info *sta);
void ap_sta_start_sa_query(struct hostapd_data *hapd, struct sta_info *sta);
void ap_sta_stop_sa_query(struct hostapd_data *hapd, struct sta_info *sta);
#endif /* STA_INFO_H */

18
src/common/ieee802_11_defs.h
View File

@ -214,14 +214,14 @@
#define WLAN_ACTION_BLOCK_ACK 3
#define WLAN_ACTION_RADIO_MEASUREMENT 5
#define WLAN_ACTION_FT 6
#define WLAN_ACTION_PING 8
#define WLAN_ACTION_SA_QUERY 7
#define WLAN_ACTION_WMM 17
/* Ping Action frame (IEEE 802.11w/D6.0, 7.4.9) */
#define WLAN_PING_REQUEST 0
#define WLAN_PING_RESPONSE 1
/* SA Query Action frame (IEEE 802.11w/D7.0, 7.4.9) */
#define WLAN_SA_QUERY_REQUEST 0
#define WLAN_SA_QUERY_RESPONSE 1
#define WLAN_PING_TRANS_ID_LEN 16
#define WLAN_SA_QUERY_TR_ID_LEN 16
#ifdef _MSC_VER
@ -321,12 +321,12 @@ struct ieee80211_mgmt {
} STRUCT_PACKED ft_action_resp;
struct {
u8 action;
u8 trans_id[WLAN_PING_TRANS_ID_LEN];
} STRUCT_PACKED ping_req;
u8 trans_id[WLAN_SA_QUERY_TR_ID_LEN];
} STRUCT_PACKED sa_query_req;
struct {
u8 action; /* */
u8 trans_id[WLAN_PING_TRANS_ID_LEN];
} STRUCT_PACKED ping_resp;
u8 trans_id[WLAN_SA_QUERY_TR_ID_LEN];
} STRUCT_PACKED sa_query_resp;
} u;
} STRUCT_PACKED action;
} u;

46
wpa_supplicant/mlme.c
View File

@ -1738,9 +1738,9 @@ static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
#ifdef CONFIG_IEEE80211W
/* MLME-PING.response */
static int ieee80211_sta_send_ping_resp(struct wpa_supplicant *wpa_s,
const u8 *addr, const u8 *trans_id)
/* MLME-SAQuery.response */
static int ieee80211_sta_send_sa_query_resp(struct wpa_supplicant *wpa_s,
const u8 *addr, const u8 *trans_id)
{
struct ieee80211_mgmt *mgmt;
int res;
@ -1749,7 +1749,7 @@ static int ieee80211_sta_send_ping_resp(struct wpa_supplicant *wpa_s,
mgmt = os_zalloc(sizeof(*mgmt));
if (mgmt == NULL) {
wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
"ping action frame");
"SA Query action frame");
return -1;
}
@ -1759,11 +1759,11 @@ static int ieee80211_sta_send_ping_resp(struct wpa_supplicant *wpa_s,
os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
WLAN_FC_STYPE_ACTION);
mgmt->u.action.category = WLAN_ACTION_PING;
mgmt->u.action.u.ping_resp.action = WLAN_PING_RESPONSE;
os_memcpy(mgmt->u.action.u.ping_resp.trans_id, trans_id,
WLAN_PING_TRANS_ID_LEN);
len += 1 + sizeof(mgmt->u.action.u.ping_resp);
mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
mgmt->u.action.u.sa_query_resp.action = WLAN_SA_QUERY_RESPONSE;
os_memcpy(mgmt->u.action.u.sa_query_resp.trans_id, trans_id,
WLAN_SA_QUERY_TR_ID_LEN);
len += 1 + sizeof(mgmt->u.action.u.sa_query_resp);
res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
os_free(mgmt);
@ -1772,36 +1772,36 @@ static int ieee80211_sta_send_ping_resp(struct wpa_supplicant *wpa_s,
}
static void ieee80211_rx_mgmt_ping_action(
static void ieee80211_rx_mgmt_sa_query_action(
struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
struct ieee80211_rx_status *rx_status)
{
if (len < 24 + 1 + sizeof(mgmt->u.action.u.ping_req)) {
wpa_printf(MSG_DEBUG, "MLME: Too short Ping Action frame");
if (len < 24 + 1 + sizeof(mgmt->u.action.u.sa_query_req)) {
wpa_printf(MSG_DEBUG, "MLME: Too short SA Query Action frame");
return;
}
if (mgmt->u.action.u.ping_req.action != WLAN_PING_REQUEST) {
wpa_printf(MSG_DEBUG, "MLME: Unexpected Ping Action %d",
mgmt->u.action.u.ping_req.action);
if (mgmt->u.action.u.sa_query_req.action != WLAN_SA_QUERY_REQUEST) {
wpa_printf(MSG_DEBUG, "MLME: Unexpected SA Query Action %d",
mgmt->u.action.u.sa_query_req.action);
return;
}
if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
wpa_printf(MSG_DEBUG, "MLME: Ignore ping from unknown source "
MACSTR, MAC2STR(mgmt->sa));
wpa_printf(MSG_DEBUG, "MLME: Ignore SA Query from unknown "
"source " MACSTR, MAC2STR(mgmt->sa));
return;
}
if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
wpa_printf(MSG_DEBUG, "MLME: Ignore ping request during "
wpa_printf(MSG_DEBUG, "MLME: Ignore SA query request during "
"association process");
return;
}
wpa_printf(MSG_DEBUG, "MLME: Replying to ping request");
ieee80211_sta_send_ping_resp(wpa_s, mgmt->sa,
mgmt->u.action.u.ping_req.trans_id);
wpa_printf(MSG_DEBUG, "MLME: Replying to SA Query request");
ieee80211_sta_send_sa_query_resp(wpa_s, mgmt->sa, mgmt->u.action.u.
sa_query_req.trans_id);
}
#endif /* CONFIG_IEEE80211W */
@ -1824,8 +1824,8 @@ static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
break;
#endif /* CONFIG_IEEE80211R */
#ifdef CONFIG_IEEE80211W
case WLAN_ACTION_PING:
ieee80211_rx_mgmt_ping_action(wpa_s, mgmt, len, rx_status);
case WLAN_ACTION_SA_QUERY:
ieee80211_rx_mgmt_sa_query_action(wpa_s, mgmt, len, rx_status);
break;
#endif /* CONFIG_IEEE80211W */
default: