2009-10-16 02:10:13

by Gabriele Gristina

[permalink] [raw]
Subject: [PATCH] mac80211: fixed injection in monitor mode

I have a problem with mac80211 injection:
if i setup interface in monitor mode with iwconfig and i try to send a
custum 802.11 frame i see twice the packet in monitor interface.
The first packet is right, the second is different only in the radiotap
header: rtap len is fixed to 13 bytes...
If i setup interface with airmon-ng the packet is sended once but the
radiotap header is fixed to 13 bytes.

Patch for 2.6.31.4

--- net/mac80211/main.c.orig 2009-10-16 00:50:00.000000000 +0200
+++ net/mac80211/main.c 2009-10-15 23:06:03.000000000 +0200
@@ -607,6 +607,9 @@
skb->protocol = htons(ETH_P_802_2);
memset(skb->cb, 0, sizeof(skb->cb));

+ if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
+ goto out_no_echo;
+
rcu_read_lock();
list_for_each_entry_rcu(sdata, &local->interfaces, list) {
if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
@@ -630,7 +633,8 @@
skb = NULL;
}
rcu_read_unlock();
- dev_kfree_skb(skb);
+out_no_echo:
+ if (skb) dev_kfree_skb(skb);
}
EXPORT_SYMBOL(ieee80211_tx_status);




2009-10-16 14:16:51

by John W. Linville

[permalink] [raw]
Subject: Re: [PATCH] mac80211: fixed injection in monitor mode

On Fri, Oct 16, 2009 at 04:09:21AM +0200, Gabriele Gristina wrote:
> I have a problem with mac80211 injection:
> if i setup interface in monitor mode with iwconfig and i try to send a
> custum 802.11 frame i see twice the packet in monitor interface.
> The first packet is right, the second is different only in the radiotap
> header: rtap len is fixed to 13 bytes...
> If i setup interface with airmon-ng the packet is sended once but the
> radiotap header is fixed to 13 bytes.
>
> Patch for 2.6.31.4
>
> --- net/mac80211/main.c.orig 2009-10-16 00:50:00.000000000 +0200
> +++ net/mac80211/main.c 2009-10-15 23:06:03.000000000 +0200
> @@ -607,6 +607,9 @@
> skb->protocol = htons(ETH_P_802_2);
> memset(skb->cb, 0, sizeof(skb->cb));
>
> + if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
> + goto out_no_echo;
> +
> rcu_read_lock();
> list_for_each_entry_rcu(sdata, &local->interfaces, list) {
> if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
> @@ -630,7 +633,8 @@
> skb = NULL;
> }
> rcu_read_unlock();
> - dev_kfree_skb(skb);
> +out_no_echo:
> + if (skb) dev_kfree_skb(skb);
> }
> EXPORT_SYMBOL(ieee80211_tx_status);
>

Thanks for the patch! But I need a Signed-off-by line...

http://linux.yyz.us/patch-format.html

--
John W. Linville Someday the world will need a hero, and you
[email protected] might be all we have. Be ready.

2009-10-16 17:19:23

by Sid Hayn

[permalink] [raw]
Subject: Re: [PATCH] mac80211: fixed injection in monitor mode

Johannes Berg wrote:
> On Fri, 2009-10-16 at 04:09 +0200, Gabriele Gristina wrote:
>
>> I have a problem with mac80211 injection:
>> if i setup interface in monitor mode with iwconfig and i try to send a
>> custum 802.11 frame i see twice the packet in monitor interface.
>> The first packet is right, the second is different only in the radiotap
>> header: rtap len is fixed to 13 bytes...
>> If i setup interface with airmon-ng the packet is sended once but the
>> radiotap header is fixed to 13 bytes.
>>
>
> This is correct. The patch is wrong.
>
>
I'm very stupid, could you please elaborate how seeing every single
packets twice with different headers is "correct"?

Thanks,
Rick
> johannes
>


2009-10-16 17:14:02

by Gabriele Gristina

[permalink] [raw]
Subject: Re: [PATCH] mac80211: fixed injection in monitor mode

why is wrong?
there's another way to inject once packet?

2009/10/16, Johannes Berg <[email protected]>:
> On Fri, 2009-10-16 at 04:09 +0200, Gabriele Gristina wrote:
>> I have a problem with mac80211 injection:
>> if i setup interface in monitor mode with iwconfig and i try to send a
>> custum 802.11 frame i see twice the packet in monitor interface.
>> The first packet is right, the second is different only in the radiotap
>> header: rtap len is fixed to 13 bytes...
>> If i setup interface with airmon-ng the packet is sended once but the
>> radiotap header is fixed to 13 bytes.
>
> This is correct. The patch is wrong.
>
> johannes
>

2009-10-16 14:47:06

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH] mac80211: fixed injection in monitor mode

On Fri, 2009-10-16 at 04:09 +0200, Gabriele Gristina wrote:
> I have a problem with mac80211 injection:
> if i setup interface in monitor mode with iwconfig and i try to send a
> custum 802.11 frame i see twice the packet in monitor interface.
> The first packet is right, the second is different only in the radiotap
> header: rtap len is fixed to 13 bytes...
> If i setup interface with airmon-ng the packet is sended once but the
> radiotap header is fixed to 13 bytes.

This is correct. The patch is wrong.

johannes


Attachments:
signature.asc (801.00 B)
This is a digitally signed message part

2009-10-17 00:27:00

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH] mac80211: fixed injection in monitor mode

On Fri, 2009-10-16 at 13:19 -0400, Richard Farina wrote:
> Johannes Berg wrote:
> > On Fri, 2009-10-16 at 04:09 +0200, Gabriele Gristina wrote:
> >
> >> I have a problem with mac80211 injection:
> >> if i setup interface in monitor mode with iwconfig and i try to send a
> >> custum 802.11 frame i see twice the packet in monitor interface.
> >> The first packet is right, the second is different only in the radiotap
> >> header: rtap len is fixed to 13 bytes...
> >> If i setup interface with airmon-ng the packet is sended once but the
> >> radiotap header is fixed to 13 bytes.
> >>
> >
> > This is correct. The patch is wrong.
> >
> >
> I'm very stupid, could you please elaborate how seeing every single
> packets twice with different headers is "correct"?

Look at the patch. I'ts the injection itself + tx status.

johannes


Attachments:
signature.asc (801.00 B)
This is a digitally signed message part