From d7718bc6f6d342f2808edfaef54f2a5fa5b7e132 Mon Sep 17 00:00:00 2001 From: Mathy Vanhoef Date: Sat, 16 Jan 2021 14:39:21 +0400 Subject: [PATCH] fragattack: use set_amsdu and is_amsdu functions --- research/fraginternals.py | 3 +-- research/libwifi | 2 +- research/tests_attacks.py | 2 +- research/tests_common.py | 6 +++--- 4 files changed, 6 insertions(+), 7 deletions(-) diff --git a/research/fraginternals.py b/research/fraginternals.py index 6d15d9d78..a9cc02a07 100644 --- a/research/fraginternals.py +++ b/research/fraginternals.py @@ -59,8 +59,7 @@ def freebsd_encap_eapolmsdu(p, src, dst, payload): p.addr1 = "ff:ff:ff:ff:ff:ff" # Encapsulate EAPOL in malformed EAPOL/A-MSDU fragment - p.A_MSDU_Present = 1 - + set_amsdu(p) p = p/freebsd_create_eapolmsdu(src, dst, payload) return p diff --git a/research/libwifi b/research/libwifi index efd0f0f57..424954db9 160000 --- a/research/libwifi +++ b/research/libwifi @@ -1 +1 @@ -Subproject commit efd0f0f571f286768d057d81731ca63bdb3eb75c +Subproject commit 424954db968be2ba47450db525b31bc2f60a7a2e diff --git a/research/tests_attacks.py b/research/tests_attacks.py index 29e645a28..dfdbad459 100644 --- a/research/tests_attacks.py +++ b/research/tests_attacks.py @@ -42,7 +42,7 @@ class AmsduInject(Test): p = header/LLC()/SNAP()/IP(dst="192.168.1.2", src="3.5.1.1")/TCP()/Raw(b"A" * 748) p = p/create_msdu_subframe(src, dst, request, last=True) - p[Dot11QoS].A_MSDU_Present = 1 + set_amsdu(p[Dot11QoS]) # Schedule transmission of frame self.actions[0].frame = p diff --git a/research/tests_common.py b/research/tests_common.py index ac5b7ba5d..8eea8cda8 100644 --- a/research/tests_common.py +++ b/research/tests_common.py @@ -58,12 +58,12 @@ class PingTest(Test): if self.as_msdu == 1: # Set the A-MSDU frame type flag in the QoS header - header.A_MSDU_Present = 1 + set_amsdu(header) # Encapsulate the request in an A-MSDU payload request = create_msdu_subframe(station.mac, station.get_peermac(), request) elif self.as_msdu == 2: # Set A-MSDU flag but include a normal payload (fake A-MSDU) - header.A_MSDU_Present = 1 + set_amsdu(header) # Generate all the individual (fragmented) frames num_frags = len(self.get_actions(Action.Inject)) @@ -237,7 +237,7 @@ class EapolAmsduTest(Test): # Generate the single frame header, request, check_fn = generate_request(station, self.ptype, dport=self.dport) # Set the A-MSDU frame type flag in the QoS header - header.A_MSDU_Present = 1 + set_amsdu(header) # We can automatically detect the result if the last fragment was sent after a connected event. # Note we might get a reply during a rekey handshake, and this will be handled properly.