1 /*-
2 * SPDX-License-Identifier: BSD-4-Clause
3 *
4 * Copyright (c) 2005
5 * Bill Paul <wpaul@windriver.com>. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. All advertising materials mentioning features or use of this software
16 * must display the following acknowledgement:
17 * This product includes software developed by Bill Paul.
18 * 4. Neither the name of the author nor the names of any co-contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY Bill Paul AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL Bill Paul OR THE VOICES IN HIS HEAD
26 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32 * THE POSSIBILITY OF SUCH DAMAGE.
33 */
34
35 #include <sys/cdefs.h>
36 /*
37 * This file implements a small portion of the Winpcap API for the
38 * Windows NDIS interface in wpa_supplicant. It provides just enough
39 * routines to fool wpa_supplicant into thinking it's really running
40 * in a Windows environment.
41 */
42
43 #include <sys/types.h>
44 #include <sys/param.h>
45 #include <sys/socket.h>
46 #include <sys/ioctl.h>
47 #include <sys/errno.h>
48 #include <sys/sysctl.h>
49 #include <sys/fcntl.h>
50 #include <net/if.h>
51 #include <net/if_dl.h>
52
53 #include <netinet/in.h>
54 #include <arpa/inet.h>
55 #include <netdb.h>
56 #include <net/route.h>
57
58 #include <net80211/ieee80211_ioctl.h>
59
60 #include <stdio.h>
61 #include <string.h>
62 #include <stdlib.h>
63 #include <unistd.h>
64 #include <pcap.h>
65
66 #include "Packet32.h"
67
68 #define OID_802_11_ADD_KEY 0x0d01011D
69
70 typedef ULONGLONG NDIS_802_11_KEY_RSC;
71 typedef UCHAR NDIS_802_11_MAC_ADDRESS[6];
72
73 typedef struct NDIS_802_11_KEY {
74 ULONG Length;
75 ULONG KeyIndex;
76 ULONG KeyLength;
77 NDIS_802_11_MAC_ADDRESS BSSID;
78 NDIS_802_11_KEY_RSC KeyRSC;
79 UCHAR KeyMaterial[1];
80 } NDIS_802_11_KEY;
81
82 typedef struct NDIS_802_11_KEY_COMPAT {
83 ULONG Length;
84 ULONG KeyIndex;
85 ULONG KeyLength;
86 NDIS_802_11_MAC_ADDRESS BSSID;
87 UCHAR Pad[6]; /* Make struct layout match Windows. */
88 NDIS_802_11_KEY_RSC KeyRSC;
89 #ifdef notdef
90 UCHAR KeyMaterial[1];
91 #endif
92 } NDIS_802_11_KEY_COMPAT;
93
94 #define TRUE 1
95 #define FALSE 0
96
97 struct adapter {
98 int socket;
99 char name[IFNAMSIZ];
100 int prev_roaming;
101 };
102
103 PCHAR
PacketGetVersion(void)104 PacketGetVersion(void)
105 {
106 return("FreeBSD WinPcap compatibility shim v1.0");
107 }
108
109 void *
PacketOpenAdapter(CHAR * iface)110 PacketOpenAdapter(CHAR *iface)
111 {
112 struct adapter *a;
113 int s;
114 int ifflags;
115 struct ifreq ifr;
116 struct ieee80211req ireq;
117
118 s = socket(PF_INET, SOCK_DGRAM, 0);
119
120 if (s == -1)
121 return(NULL);
122
123 a = malloc(sizeof(struct adapter));
124 if (a == NULL)
125 return(NULL);
126
127 a->socket = s;
128 if (strncmp(iface, "\\Device\\NPF_", 12) == 0)
129 iface += 12;
130 else if (strncmp(iface, "\\DEVICE\\", 8) == 0)
131 iface += 8;
132 snprintf(a->name, IFNAMSIZ, "%s", iface);
133
134 /* Turn off net80211 roaming */
135 bzero((char *)&ireq, sizeof(ireq));
136 strncpy(ireq.i_name, iface, sizeof (ifr.ifr_name));
137 ireq.i_type = IEEE80211_IOC_ROAMING;
138 if (ioctl(a->socket, SIOCG80211, &ireq) == 0) {
139 a->prev_roaming = ireq.i_val;
140 ireq.i_val = IEEE80211_ROAMING_MANUAL;
141 if (ioctl(a->socket, SIOCS80211, &ireq) < 0)
142 fprintf(stderr,
143 "Could not set IEEE80211_ROAMING_MANUAL\n");
144 }
145
146 bzero((char *)&ifr, sizeof(ifr));
147 strncpy(ifr.ifr_name, iface, sizeof (ifr.ifr_name));
148 if (ioctl(a->socket, SIOCGIFFLAGS, (caddr_t)&ifr) < 0) {
149 free(a);
150 close(s);
151 return(NULL);
152 }
153 ifr.ifr_flags |= IFF_UP;
154 if (ioctl(a->socket, SIOCSIFFLAGS, (caddr_t)&ifr) < 0) {
155 free(a);
156 close(s);
157 return(NULL);
158 }
159
160 return(a);
161 }
162
163 int
PacketRequest(void * iface,BOOLEAN set,PACKET_OID_DATA * oid)164 PacketRequest(void *iface, BOOLEAN set, PACKET_OID_DATA *oid)
165 {
166 struct adapter *a;
167 uint32_t retval;
168 struct ifreq ifr;
169 NDIS_802_11_KEY *old;
170 NDIS_802_11_KEY_COMPAT *new;
171 PACKET_OID_DATA *o = NULL;
172
173 if (iface == NULL)
174 return(-1);
175
176 a = iface;
177 bzero((char *)&ifr, sizeof(ifr));
178
179 /*
180 * This hack is necessary to work around a difference
181 * betwee the GNU C and Microsoft C compilers. The NDIS_802_11_KEY
182 * structure has a uint64_t in it, right after an array of
183 * chars. The Microsoft compiler inserts padding right before
184 * the 64-bit value to align it on a 64-bit boundary, but
185 * GCC only aligns it on a 32-bit boundary. Trying to pass
186 * the GCC-formatted structure to an NDIS binary driver
187 * fails because some of the fields appear to be at the
188 * wrong offsets.
189 *
190 * To get around this, if we detect someone is trying to do
191 * a set operation on OID_802_11_ADD_KEY, we shuffle the data
192 * into a properly padded structure and pass that into the
193 * driver instead. This allows the driver_ndis.c code supplied
194 * with wpa_supplicant to work unmodified.
195 */
196
197 if (set == TRUE && oid->Oid == OID_802_11_ADD_KEY) {
198 old = (NDIS_802_11_KEY *)&oid->Data;
199 o = malloc(sizeof(PACKET_OID_DATA) +
200 sizeof(NDIS_802_11_KEY_COMPAT) + old->KeyLength);
201 if (o == NULL)
202 return(0);
203 bzero((char *)o, sizeof(PACKET_OID_DATA) +
204 sizeof(NDIS_802_11_KEY_COMPAT) + old->KeyLength);
205 o->Oid = oid->Oid;
206 o->Length = sizeof(NDIS_802_11_KEY_COMPAT) + old->KeyLength;
207 new = (NDIS_802_11_KEY_COMPAT *)&o->Data;
208 new->KeyRSC = old->KeyRSC;
209 new->Length = o->Length;
210 new->KeyIndex = old->KeyIndex;
211 new->KeyLength = old->KeyLength;
212 bcopy(old->BSSID, new->BSSID, sizeof(NDIS_802_11_MAC_ADDRESS));
213 bcopy(old->KeyMaterial, (char *)new +
214 sizeof(NDIS_802_11_KEY_COMPAT), new->KeyLength);
215 ifr.ifr_data = (caddr_t)o;
216 } else
217 ifr.ifr_data = (caddr_t)oid;
218
219 strlcpy(ifr.ifr_name, a->name, sizeof(ifr.ifr_name));
220
221 if (set == TRUE)
222 retval = ioctl(a->socket, SIOCSDRVSPEC, &ifr);
223 else
224 retval = ioctl(a->socket, SIOCGDRVSPEC, &ifr);
225
226 if (o != NULL)
227 free(o);
228
229 if (retval)
230 return(0);
231
232 return(1);
233 }
234
235 int
PacketGetAdapterNames(CHAR * namelist,ULONG * len)236 PacketGetAdapterNames(CHAR *namelist, ULONG *len)
237 {
238 int mib[6];
239 size_t needed;
240 struct if_msghdr *ifm;
241 struct sockaddr_dl *sdl;
242 char *buf, *lim, *next;
243 char *plist;
244 int spc;
245 int i, ifcnt = 0;
246
247 plist = namelist;
248 spc = 0;
249
250 bzero(plist, *len);
251
252 needed = 0;
253 mib[0] = CTL_NET;
254 mib[1] = PF_ROUTE;
255 mib[2] = 0; /* protocol */
256 mib[3] = 0; /* wildcard address family */
257 mib[4] = NET_RT_IFLIST;
258 mib[5] = 0; /* no flags */
259
260 if (sysctl (mib, 6, NULL, &needed, NULL, 0) < 0)
261 return(FALSE);
262
263 buf = malloc (needed);
264 if (buf == NULL)
265 return(FALSE);
266
267 if (sysctl (mib, 6, buf, &needed, NULL, 0) < 0) {
268 free(buf);
269 return(FALSE);
270 }
271
272 lim = buf + needed;
273
274 /* Generate interface name list. */
275
276 next = buf;
277 while (next < lim) {
278 ifm = (struct if_msghdr *)next;
279 if (ifm->ifm_type == RTM_IFINFO) {
280 sdl = (struct sockaddr_dl *)(ifm + 1);
281 if (strnstr(sdl->sdl_data, "wlan", sdl->sdl_nlen)) {
282 if ((spc + sdl->sdl_nlen) > *len) {
283 free(buf);
284 return(FALSE);
285 }
286 strncpy(plist, sdl->sdl_data, sdl->sdl_nlen);
287 plist += (sdl->sdl_nlen + 1);
288 spc += (sdl->sdl_nlen + 1);
289 ifcnt++;
290 }
291 }
292 next += ifm->ifm_msglen;
293 }
294
295
296 /* Insert an extra "" as a spacer */
297
298 plist++;
299 spc++;
300
301 /*
302 * Now generate the interface description list. There
303 * must be a unique description for each interface, and
304 * they have to match what the ndis_events program will
305 * feed in later. To keep this simple, we just repeat
306 * the interface list over again.
307 */
308
309 next = buf;
310 while (next < lim) {
311 ifm = (struct if_msghdr *)next;
312 if (ifm->ifm_type == RTM_IFINFO) {
313 sdl = (struct sockaddr_dl *)(ifm + 1);
314 if (strnstr(sdl->sdl_data, "wlan", sdl->sdl_nlen)) {
315 if ((spc + sdl->sdl_nlen) > *len) {
316 free(buf);
317 return(FALSE);
318 }
319 strncpy(plist, sdl->sdl_data, sdl->sdl_nlen);
320 plist += (sdl->sdl_nlen + 1);
321 spc += (sdl->sdl_nlen + 1);
322 ifcnt++;
323 }
324 }
325 next += ifm->ifm_msglen;
326 }
327
328 free (buf);
329
330 *len = spc + 1;
331
332 return(TRUE);
333 }
334
335 void
PacketCloseAdapter(void * iface)336 PacketCloseAdapter(void *iface)
337 {
338 struct adapter *a;
339 struct ifreq ifr;
340 struct ieee80211req ireq;
341
342 if (iface == NULL)
343 return;
344
345 a = iface;
346
347 /* Reset net80211 roaming */
348 bzero((char *)&ireq, sizeof(ireq));
349 strncpy(ireq.i_name, a->name, sizeof (ifr.ifr_name));
350 ireq.i_type = IEEE80211_IOC_ROAMING;
351 ireq.i_val = a->prev_roaming;
352 ioctl(a->socket, SIOCS80211, &ireq);
353
354 bzero((char *)&ifr, sizeof(ifr));
355 strncpy(ifr.ifr_name, a->name, sizeof (ifr.ifr_name));
356 ioctl(a->socket, SIOCGIFFLAGS, (caddr_t)&ifr);
357 ifr.ifr_flags &= ~IFF_UP;
358 ioctl(a->socket, SIOCSIFFLAGS, (caddr_t)&ifr);
359 close(a->socket);
360 free(a);
361
362 return;
363 }
364
365 #if __FreeBSD_version < 600000
366
367 /*
368 * The version of libpcap in FreeBSD 5.2.1 doesn't have these routines.
369 * Call me insane if you will, but I still run 5.2.1 on my laptop, and
370 * I'd like to use WPA there.
371 */
372
373 int
pcap_get_selectable_fd(pcap_t * p)374 pcap_get_selectable_fd(pcap_t *p)
375 {
376 return(pcap_fileno(p));
377 }
378
379 /*
380 * The old version of libpcap opens its BPF descriptor in read-only
381 * mode. We need to temporarily create a new one we can write to.
382 */
383
384 int
pcap_inject(pcap_t * p,const void * buf,size_t len)385 pcap_inject(pcap_t *p, const void *buf, size_t len)
386 {
387 int fd;
388 int res, n = 0;
389 char device[sizeof "/dev/bpf0000000000"];
390 struct ifreq ifr;
391
392 /*
393 * Go through all the minors and find one that isn't in use.
394 */
395 do {
396 (void)snprintf(device, sizeof(device), "/dev/bpf%d", n++);
397 fd = open(device, O_RDWR);
398 } while (fd < 0 && errno == EBUSY);
399
400 if (fd == -1)
401 return(-1);
402
403 bzero((char *)&ifr, sizeof(ifr));
404 ioctl(pcap_fileno(p), BIOCGETIF, (caddr_t)&ifr);
405 ioctl(fd, BIOCSETIF, (caddr_t)&ifr);
406
407 res = write(fd, buf, len);
408
409 close(fd);
410
411 return(res);
412 }
413 #endif
414