airjack.c

Go to the documentation of this file.

/* Linux Prism II Stumbler - Utility Scan for 802_11 networks under Linux
 * 
 * File : $Name$
 * Project : WifiScanner (c) 2002 Hervé Schauer Consultants
 * Usage : This utility is written for use with IEEE 802.11 adapters based
 * on Intersil's PRISM II chipset (PCMCIA).
 * 
 * Some part of this code is taken from essid_ack.c from aitrjack26
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License
 * as published by the Free Software Foundation; either version 2
 * of the License, or (at your option) any later version.
 * 
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 * 
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 *
 * $Id: airjack.c 174 2007-07-25 13:20:29Z poggij $
 */

#include <include.h>
#include <src/airjack.h>
#include <src/wlan-ng.h>
#include <src/functions.h>
#include <src/crt_io.h>

#ifdef HAVE_LINUX_WIRELESS
#include <net/if.h>
#endif
#include <sys/socket.h>

#include <features.h>           /* for the glibc version number */
#include <netinet/in.h>
#if __GLIBC__ >= 2 && __GLIBC_MINOR >= 1
#include <netpacket/packet.h>
#include <net/ethernet.h>       /* the L2 protocols */
#else
#include <asm/types.h>
#include <linux/if_packet.h>
#include <linux/if_ether.h>     /* The L2 protocols */
#endif

static char *ID = "$Id: airjack.c 174 2007-07-25 13:20:29Z poggij $";

// All extern value you want
//extern unsigned int DebugLevel;
//extern UINT8 SingleChannel;
//extern UINT8 TypeOfCard;
extern ConfigStruct config;
extern UINT16 NumberOfDetectedClient;
extern ClientInfo_t *ClientInfo;
extern ScanResult_t Res;

//--- STATIC
static CaptureArg ca;
static char errbuf[PCAP_ERRBUF_SIZE];
static int sockfd;              /* listen and send socket */
static struct ifreq req;
static struct aj_config aj_conf;

static const UINT8 BroadcastMAC[WLAN_ADDR_LEN] =
    { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };

//-------------
int selectChannelAIRJACK(char *devname, int channel)
{
#define STR_MAX 80
  int result = 0;
#if 0
  char str[STR_MAX];
  snprintf(str, STR_MAX, "set_channel -c %d -i %s 2>/dev/null",
           channel, devname);
  debug(3, "%s\n", str);
  result += system(str);
#else
  req.ifr_data = (char *) &aj_conf;

  /* populate the structure */
  if (ioctl(sockfd, SIOCAJGMODE, &req) < 0) {
    return (-4);
  }

  aj_conf.channel = channel;
  aj_conf.monitor = 1;

  if (ioctl(sockfd, SIOCAJSMODE, &req) < 0) {
    return (-4);
  }
#endif
  return result;
}

int shutCardAIRJACK(char *devname)
{
  return IfconfigSetFlags(devname, IFF_UP);
}

int openCardAIRJACK(char *devname)
{
  int result = 0;
  struct sockaddr_ll addr;

  // Turn on monitor mode
  result += IfconfigSetFlags(devname, IFF_UP + IFF_PROMISC);

  /* open the link layer socket */
  if ((sockfd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL))) < 0) {
    return (-1);
  }

  /* get the interface index */
  memset(&req, 0, sizeof(struct ifreq));
  memset(&aj_conf, 0, sizeof(struct aj_config));
  strncpy(req.ifr_name, devname, IFNAMSIZ);

  if (ioctl(sockfd, SIOCGIFINDEX, &req) < 0) {
    return (-2);
  }

  /* bind the socket to the interface */
  memset(&addr, 0, sizeof(struct sockaddr_ll));
  addr.sll_ifindex = req.ifr_ifindex;
  addr.sll_protocol = htons(ETH_P_ALL);
  addr.sll_family = AF_PACKET;
  if (bind(sockfd, (struct sockaddr *) &addr, sizeof(struct sockaddr_ll)) <
      0) {
    return (-3);
  }


  return result;
}


// Get packet from card
int getPacketAIRJACK(p80211_caphdr_t * wlan_header, UINT8 * buf, int maxlen)
{
  struct pcap_pkthdr pktHdr;
  u_char *ret;
  fd_set rs;

  FD_ZERO(&rs);
  FD_SET(0, &rs);

  ret = (u_char *) pcap_next(ca.pcap, &pktHdr);
  // If no problem and packet is enought big (with data)
  if ((ret) && (pktHdr.len >= 1)) {
    if (memcpy_buff(buf, ret, pktHdr.len) == NULL)
      return 0;
    // Fill Header
    // TODO : find this information in any maner ?!
    wlan_header->version = 0;    // It's a reduced capture frame format
    wlan_header->length = 0;     // Not used for now
    wlan_header->mactime = 0;
    wlan_header->hosttime = 0;
    wlan_header->phytype = 0;    // Not used for now
    wlan_header->channel = 0;
    wlan_header->datarate = 0;   // datarate is in units of 100kbps.
    wlan_header->antenna = 0;    // Not used for now
    wlan_header->priority = 0;   // Not used for now
    wlan_header->ssi_type = 0;   // Not used for now
    wlan_header->ssi_signal = 0;
    wlan_header->ssi_noise = 0;
    wlan_header->preamble = 0;   // Not used for now
    wlan_header->encoding = 0;   // Not used for now

    return pktHdr.len;
  } else {
    return (0);                 // Noting to read
  }
}

int openPacketAIRJACK(char *devname)
{
  int DataLink;

  ca.pcap = pcap_open_live(devname, 3000, 1, 0, errbuf);
  if (ca.pcap) {
    pcap_setnonblock(ca.pcap, 1, errbuf);
    DataLink = pcap_datalink(ca.pcap);
    switch (DataLink) {
    case DLT_PRISM_HEADER:
      debug(2,
            "pcap_datalink(ca.pcap) = %d = DLT_PRISM_HEADER\n", DataLink);
      ca.offset = 0x90;
      break;
    case DLT_IEEE802_11:
      debug(2, "pcap_datalink(ca.pcap) = %d = DLT_IEEE802_11\n", DataLink);
      ca.offset = 0;
      break;
    case DLT_AIRONET_HEADER:
      debug(2,
            "pcap_datalink(ca.pcap) = %d = DLT_AIRONET_HEADER:\n",
            DataLink);
      ca.offset = 0;
      break;
    default:                   //COOKED
      debug(2, "pcap_datalink(ca.pcap) = %d = COOKED:\n", DataLink);
      ca.offset = 160;
    }
    return 1;
  }
  return -1;
}

void closePacketAIRJACK(void)
{
  pcap_close(ca.pcap);
}

void sendDeauth(UINT8 dest[WLAN_ADDR_LEN], UINT8 bssid[WLAN_ADDR_LEN],
                UINT8 channel)
{
  struct {
    struct a3_80211 hdr;
    unsigned short int reason;
  } __attribute__ ((packed)) frame;
  UINT8 OldChannel = 0;

  /* setup the frame */
  memset(&frame, 0, sizeof(frame));
  memcpy(frame.hdr.mh_mac1, dest, sizeof(frame.hdr.mh_mac1));
  memcpy(frame.hdr.mh_mac2, bssid, sizeof(frame.hdr.mh_mac2));
  memcpy(frame.hdr.mh_mac3, bssid, sizeof(frame.hdr.mh_mac3));

  frame.hdr.mh_type = FC_TYPE_MGT;
  frame.hdr.mh_subtype = MGT_DEAUTH;
  frame.hdr.mh_from_ds = 1;
  frame.reason = 2;             /* previous authentication is no longer valid */

  if (channel != 0) {           // Backup channel and change to the channel of the AP
    OldChannel = Res.SChannel;
    selectChannelAIRJACK(config.devname, channel);
  }

  if (write(sockfd, &frame, sizeof(frame)) < 0) {
    warning("AIRJACK error : write\n");
  }

  debug(2, "Send De-auth -- BSSID: %02X:%02X:%02X:%02X:%02X:%02X --"
        " DEST: %02X:%02X:%02X:%02X:%02X:%02X -- Channel: %d\n",
        bssid[0], bssid[1], bssid[2], bssid[3], bssid[4], bssid[5],
        dest[0], dest[1], dest[2], dest[3], dest[4], dest[5], channel);

  if (channel != 0) {           // restore channel
    Res.SChannel = OldChannel;
    selectChannelAIRJACK(config.devname, OldChannel);
  }
}

---