From a9eae7efe30b4f2616602b6d2f6198dfd3407074 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 8 Sep 2012 16:32:35 +0300 Subject: [PATCH] wlantest: Move BIP function into a separate function and file Signed-hostap: Jouni Malinen --- wlantest/Makefile | 1 + wlantest/bip.c | 67 +++++++++++++++++++++++++++++++++++++++++++++ wlantest/inject.c | 49 +++++---------------------------- wlantest/wlantest.h | 3 ++ 4 files changed, 78 insertions(+), 42 deletions(-) create mode 100644 wlantest/bip.c diff --git a/wlantest/Makefile b/wlantest/Makefile index 272a09800..a79c7efbb 100644 --- a/wlantest/Makefile +++ b/wlantest/Makefile @@ -67,6 +67,7 @@ OBJS += tkip.o OBJS += ctrl.o OBJS += inject.o OBJS += wep.o +OBJS += bip.o LIBS += -lpcap diff --git a/wlantest/bip.c b/wlantest/bip.c new file mode 100644 index 000000000..a239d49d6 --- /dev/null +++ b/wlantest/bip.c @@ -0,0 +1,67 @@ +/* + * BIP + * Copyright (c) 2010-2012, Jouni Malinen + * + * This software may be distributed under the terms of the BSD license. + * See README for more details. + */ + +#include "utils/includes.h" + +#include "utils/common.h" +#include "common/ieee802_11_defs.h" +#include "crypto/aes_wrap.h" +#include "wlantest.h" + + +u8 * bip_protect(const u8 *igtk, u8 *frame, size_t len, u8 *ipn, int keyid, + size_t *prot_len) +{ + u8 *prot, *pos, *buf; + u8 mic[16]; + u16 fc; + struct ieee80211_hdr *hdr; + size_t plen; + + plen = len + 18; + prot = os_malloc(plen); + if (prot == NULL) + return NULL; + os_memcpy(prot, frame, len); + pos = prot + len; + *pos++ = WLAN_EID_MMIE; + *pos++ = 16; + WPA_PUT_LE16(pos, keyid); + pos += 2; + os_memcpy(pos, ipn, 6); + pos += 6; + os_memset(pos, 0, 8); /* MIC */ + + buf = os_malloc(plen + 20 - 24); + if (buf == NULL) { + os_free(prot); + return NULL; + } + + /* BIP AAD: FC(masked) A1 A2 A3 */ + hdr = (struct ieee80211_hdr *) frame; + fc = le_to_host16(hdr->frame_control); + fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA); + WPA_PUT_LE16(buf, fc); + os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN); + os_memcpy(buf + 20, prot + 24, plen - 24); + wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, plen + 20 - 24); + /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */ + if (omac1_aes_128(igtk, buf, plen + 20 - 24, mic) < 0) { + os_free(prot); + os_free(buf); + return NULL; + } + os_free(buf); + + os_memcpy(pos, mic, 8); + wpa_hexdump(MSG_DEBUG, "BIP MMIE MIC", pos, 8); + + *prot_len = plen; + return prot; +} diff --git a/wlantest/inject.c b/wlantest/inject.c index b57f23f57..ab8d11315 100644 --- a/wlantest/inject.c +++ b/wlantest/inject.c @@ -81,58 +81,23 @@ static int is_robust_mgmt(u8 *frame, size_t len) static int wlantest_inject_bip(struct wlantest *wt, struct wlantest_bss *bss, u8 *frame, size_t len, int incorrect_key) { - u8 *prot, *pos, *buf; - u8 mic[16]; + u8 *prot; u8 dummy[16]; int ret; - u16 fc; - struct ieee80211_hdr *hdr; size_t plen; if (!bss->igtk_set[bss->igtk_idx]) return -1; - plen = len + 18; - prot = os_malloc(plen); + os_memset(dummy, 0x11, sizeof(dummy)); + inc_byte_array(bss->ipn[bss->igtk_idx], 6); + + prot = bip_protect(incorrect_key ? dummy : bss->igtk[bss->igtk_idx], + frame, len, bss->ipn[bss->igtk_idx], + bss->igtk_idx, &plen); if (prot == NULL) return -1; - os_memcpy(prot, frame, len); - pos = prot + len; - *pos++ = WLAN_EID_MMIE; - *pos++ = 16; - WPA_PUT_LE16(pos, bss->igtk_idx); - pos += 2; - inc_byte_array(bss->ipn[bss->igtk_idx], 6); - os_memcpy(pos, bss->ipn[bss->igtk_idx], 6); - pos += 6; - os_memset(pos, 0, 8); /* MIC */ - buf = os_malloc(plen + 20 - 24); - if (buf == NULL) { - os_free(prot); - return -1; - } - - /* BIP AAD: FC(masked) A1 A2 A3 */ - hdr = (struct ieee80211_hdr *) frame; - fc = le_to_host16(hdr->frame_control); - fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA); - WPA_PUT_LE16(buf, fc); - os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN); - os_memcpy(buf + 20, prot + 24, plen - 24); - wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, plen + 20 - 24); - /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */ - os_memset(dummy, 0x11, sizeof(dummy)); - if (omac1_aes_128(incorrect_key ? dummy : bss->igtk[bss->igtk_idx], - buf, plen + 20 - 24, mic) < 0) { - os_free(prot); - os_free(buf); - return -1; - } - os_free(buf); - - os_memcpy(pos, mic, 8); - wpa_hexdump(MSG_DEBUG, "BIP MMIE MIC", pos, 8); ret = inject_frame(wt->monitor_sock, prot, plen); os_free(prot); diff --git a/wlantest/wlantest.h b/wlantest/wlantest.h index de8bc65e1..ad5849bae 100644 --- a/wlantest/wlantest.h +++ b/wlantest/wlantest.h @@ -237,6 +237,9 @@ void tkip_get_pn(u8 *pn, const u8 *data); u8 * wep_decrypt(struct wlantest *wt, const struct ieee80211_hdr *hdr, const u8 *data, size_t data_len, size_t *decrypted_len); +u8 * bip_protect(const u8 *igtk, u8 *frame, size_t len, u8 *ipn, int keyid, + size_t *prot_len); + int ctrl_init(struct wlantest *wt); void ctrl_deinit(struct wlantest *wt);