2010-11-26 19:25:05

by Jouni Malinen

[permalink] [raw]
Subject: [PATCH] mac80211: Fix frame injection using non-AP vif

In order for frame injection to work properly for some use cases
(e.g., finding the station entry and keys for encryption), mac80211
needs to find the correct sdata entry. This works when the main vif
is in AP mode, but commit a2c1e3dad516618cb0fbfb1a62c36d0b0744573a
broke this particular use case for station main vif. While this type of
injection is quite unusual operation, it has some uses and we should fix
it. Do this by changing the monitor vif sdata selection to allow station
vif to be selected instead of limiting it to just AP vifs. We still need
to skip some iftypes to avoid selecting unsuitable vif for injection.

Signed-off-by: Jouni Malinen <[email protected]>

---
net/mac80211/tx.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)

--- wireless-testing.orig/net/mac80211/tx.c 2010-11-26 20:21:02.000000000 +0200
+++ wireless-testing/net/mac80211/tx.c 2010-11-26 20:36:22.000000000 +0200
@@ -1595,7 +1595,12 @@ static void ieee80211_xmit(struct ieee80
list) {
if (!ieee80211_sdata_running(tmp_sdata))
continue;
- if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
+ if (tmp_sdata->vif.type ==
+ NL80211_IFTYPE_MONITOR ||
+ tmp_sdata->vif.type ==
+ NL80211_IFTYPE_AP_VLAN ||
+ tmp_sdata->vif.type ==
+ NL80211_IFTYPE_WDS)
continue;
if (compare_ether_addr(tmp_sdata->vif.addr,
hdr->addr2) == 0) {

--
Jouni Malinen PGP id EFC895FA


2010-11-30 05:26:44

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH] mac80211: Fix frame injection using non-AP vif

On Mon, 2010-11-29 at 13:49 -0800, Luis R. Rodriguez wrote:
> On Fri, Nov 26, 2010 at 10:41 AM, Jouni Malinen
> <[email protected]> wrote:
> > In order for frame injection to work properly for some use cases
> > (e.g., finding the station entry and keys for encryption), mac80211
> > needs to find the correct sdata entry. This works when the main vif
> > is in AP mode, but commit a2c1e3dad516618cb0fbfb1a62c36d0b0744573a
> > broke this particular use case for station main vif. While this type of
> > injection is quite unusual operation, it has some uses and we should fix
> > it. Do this by changing the monitor vif sdata selection to allow station
> > vif to be selected instead of limiting it to just AP vifs. We still need
> > to skip some iftypes to avoid selecting unsuitable vif for injection.
> >
> > Signed-off-by: Jouni Malinen <[email protected]>
> >
> > ---
> > net/mac80211/tx.c | 7 ++++++-
> > 1 file changed, 6 insertions(+), 1 deletion(-)
> >
> > --- wireless-testing.orig/net/mac80211/tx.c 2010-11-26 20:21:02.000000000 +0200
> > +++ wireless-testing/net/mac80211/tx.c 2010-11-26 20:36:22.000000000 +0200
> > @@ -1595,7 +1595,12 @@ static void ieee80211_xmit(struct ieee80
> > list) {
> > if (!ieee80211_sdata_running(tmp_sdata))
> > continue;
> > - if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
> > + if (tmp_sdata->vif.type ==
> > + NL80211_IFTYPE_MONITOR ||
>
> Ah, for some reason I thought we were able to push frames as a monitor
> all along, no wonder packetspammer didn't work, or should it?

That'll still work -- it just won't encrypt the frames correctly where
necessary for a primary *station* interface.

johannes


2010-11-29 21:49:55

by Luis R. Rodriguez

[permalink] [raw]
Subject: Re: [PATCH] mac80211: Fix frame injection using non-AP vif

On Fri, Nov 26, 2010 at 10:41 AM, Jouni Malinen
<[email protected]> wrote:
> In order for frame injection to work properly for some use cases
> (e.g., finding the station entry and keys for encryption), mac80211
> needs to find the correct sdata entry. This works when the main vif
> is in AP mode, but commit a2c1e3dad516618cb0fbfb1a62c36d0b0744573a
> broke this particular use case for station main vif. While this type of
> injection is quite unusual operation, it has some uses and we should fix
> it. Do this by changing the monitor vif sdata selection to allow station
> vif to be selected instead of limiting it to just AP vifs. We still need
> to skip some iftypes to avoid selecting unsuitable vif for injection.
>
> Signed-off-by: Jouni Malinen <[email protected]>
>
> ---
>  net/mac80211/tx.c |    7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> --- wireless-testing.orig/net/mac80211/tx.c     2010-11-26 20:21:02.000000000 +0200
> +++ wireless-testing/net/mac80211/tx.c  2010-11-26 20:36:22.000000000 +0200
> @@ -1595,7 +1595,12 @@ static void ieee80211_xmit(struct ieee80
>                                                list) {
>                                if (!ieee80211_sdata_running(tmp_sdata))
>                                        continue;
> -                               if (tmp_sdata->vif.type != NL80211_IFTYPE_AP)
> +                               if (tmp_sdata->vif.type ==
> +                                   NL80211_IFTYPE_MONITOR ||

Ah, for some reason I thought we were able to push frames as a monitor
all along, no wonder packetspammer didn't work, or should it?

Luis