2011-06-06 11:12:48

by Roberto Riggio

[permalink] [raw]
Subject: [PATCH] Frame injection

This patch is a combination of Matteo's patch and another submitted
several months ago on the list. It is tested for what concerns 11g rates.
However I did not manage to inject frames at 11n rates (tested only with
an atheros sr71a card)

Signed-off-by: Roberto Riggio <[email protected]>

--

diff -urN compat-wireless-2011-05-13.old//include/net/mac80211.h
compat-wireless-2011-05-13//include/net/mac80211.h
--- compat-wireless-2011-05-13.old//include/net/mac80211.h 2011-05-16
19:20:13.000000000 +0100
+++ compat-wireless-2011-05-13//include/net/mac80211.h 2011-05-30
12:52:25.260002000 +0100
@@ -344,6 +344,7 @@
* @IEEE80211_TX_INTFL_TKIP_MIC_FAILURE: Marks this packet to be used
for TKIP
* testing. It will be sent out with incorrect Michael MIC key to allow
* TKIP countermeasures to be tested.
+ * @IEEE80211_TX_CTL_RC_BYPASS: Don't use rate control on the frame.
*
* Note: If you have to add new flags to the enumeration, then don't
* forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
@@ -374,6 +375,7 @@
IEEE80211_TX_CTL_STBC = BIT(23) | BIT(24),
IEEE80211_TX_CTL_TX_OFFCHAN = BIT(25),
IEEE80211_TX_INTFL_TKIP_MIC_FAILURE = BIT(26),
+ IEEE80211_TX_CTL_RC_BYPASS = BIT(27),
};

#define IEEE80211_TX_CTL_STBC_SHIFT 23
diff -urN compat-wireless-2011-05-13.old//net/mac80211/tx.c
compat-wireless-2011-05-13//net/mac80211/tx.c
--- compat-wireless-2011-05-13.old//net/mac80211/tx.c 2011-05-16
19:20:13.000000000 +0100
+++ compat-wireless-2011-05-13//net/mac80211/tx.c 2011-05-30
14:00:36.936002002 +0100
@@ -1040,11 +1040,14 @@
struct ieee80211_radiotap_iterator iterator;
struct ieee80211_radiotap_header *rthdr =
(struct ieee80211_radiotap_header *) skb->data;
+ struct ieee80211_supported_band *sband;
bool hw_frag;
struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
NULL);

+ sband = tx->local->hw.wiphy->bands[tx->channel->band];
+
info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
tx->flags &= ~IEEE80211_TX_FRAGMENTED;

@@ -1092,6 +1095,55 @@
tx->flags |= IEEE80211_TX_FRAGMENTED;
break;

+ case IEEE80211_RADIOTAP_RATE: {
+ int i, idx = -1;
+ int rate = *iterator.this_arg * 5;
+
+ for (i = 0; i < sband->n_bitrates; i++)
+ if (sband->bitrates[i].bitrate == rate) {
+ idx = i;
+ break;
+ }
+
+ /* Rate not available - rejecting */
+ if (idx < 0)
+ return false;
+
+ info->flags |= IEEE80211_TX_CTL_RC_BYPASS;
+ info->control.rates[0].idx = idx;
+ info->control.rates[0].count = 1;
+ for (i = 1; i < IEEE80211_TX_MAX_RATES; i++)
+ info->control.rates[i].idx = -1;
+ break;
+ }
+
+ case IEEE80211_RADIOTAP_DATA_RETRIES:
+ /*
+ * Only allow setting the number of retries in
+ * conjunction with the rates, when the rate control
+ * is bypassed.
+ */
+ if (info->flags & IEEE80211_TX_CTL_RC_BYPASS)
+ info->control.rates[0].count =
+ *iterator.this_arg;
+ break;
+
+ case IEEE80211_RADIOTAP_MCS: {
+ u8 flags = iterator.this_arg[1];
+ u8 mcs = iterator.this_arg[2];
+ info->flags |= IEEE80211_TX_CTL_RC_BYPASS;
+ info->control.rates[0].idx = mcs;
+ info->control.rates[0].flags |=
+ IEEE80211_TX_RC_MCS;
+ if (flags & IEEE80211_RADIOTAP_MCS_BW_40)
+ info->control.rates[0].flags |=
+ IEEE80211_TX_RC_40_MHZ_WIDTH;
+ if (flags & IEEE80211_RADIOTAP_MCS_SGI)
+ info->control.rates[0].flags |=
+ IEEE80211_TX_RC_SHORT_GI;
+ break;
+ }
+
/*
* Please update the file
* Documentation/networking/mac80211-injection.txt
@@ -1398,8 +1450,9 @@
CALL_TXH(ieee80211_tx_h_ps_buf);
CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
CALL_TXH(ieee80211_tx_h_select_key);
- if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
- CALL_TXH(ieee80211_tx_h_rate_ctrl);
+ if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) &&
+ !(info->flags & IEEE80211_TX_CTL_RC_BYPASS))
+ CALL_TXH(ieee80211_tx_h_rate_ctrl);

if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION))
goto txh_done;
diff -urN compat-wireless-2011-05-13.old//net/wireless/radiotap.c
compat-wireless-2011-05-13//net/wireless/radiotap.c
--- compat-wireless-2011-05-13.old//net/wireless/radiotap.c
2011-05-16 19:20:10.000000000 +0100
+++ compat-wireless-2011-05-13//net/wireless/radiotap.c 2011-05-30
12:51:56.348002001 +0100
@@ -40,6 +40,7 @@
[IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
[IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
[IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
+ [IEEE80211_RADIOTAP_MCS] = { .align = 1, .size = 3, },
/*
* add more here as they are defined in radiotap.h
*/


2011-07-07 17:33:51

by Johannes Berg

[permalink] [raw]
Subject: Re: [PATCH] Frame injection

On Thu, 2011-07-07 at 13:02 -0400, John W. Linville wrote:
> I never saw any comments on this one...

I ignored it because it was just a lot of things thrown into one and
then with a useless changelog tacked on ....

johannes


2011-07-07 17:16:55

by John W. Linville

[permalink] [raw]
Subject: Re: [PATCH] Frame injection

I never saw any comments on this one...

On Mon, Jun 06, 2011 at 01:12:46PM +0200, Roberto Riggio wrote:
> This patch is a combination of Matteo's patch and another submitted
> several months ago on the list. It is tested for what concerns 11g rates.
> However I did not manage to inject frames at 11n rates (tested only with
> an atheros sr71a card)
>
> Signed-off-by: Roberto Riggio <[email protected]>
>
> --
>
> diff -urN compat-wireless-2011-05-13.old//include/net/mac80211.h
> compat-wireless-2011-05-13//include/net/mac80211.h
> --- compat-wireless-2011-05-13.old//include/net/mac80211.h
> 2011-05-16 19:20:13.000000000 +0100
> +++ compat-wireless-2011-05-13//include/net/mac80211.h 2011-05-30
> 12:52:25.260002000 +0100
> @@ -344,6 +344,7 @@
> * @IEEE80211_TX_INTFL_TKIP_MIC_FAILURE: Marks this packet to be
> used for TKIP
> * testing. It will be sent out with incorrect Michael MIC key to allow
> * TKIP countermeasures to be tested.
> + * @IEEE80211_TX_CTL_RC_BYPASS: Don't use rate control on the frame.
> *
> * Note: If you have to add new flags to the enumeration, then don't
> * forget to update %IEEE80211_TX_TEMPORARY_FLAGS when necessary.
> @@ -374,6 +375,7 @@
> IEEE80211_TX_CTL_STBC = BIT(23) | BIT(24),
> IEEE80211_TX_CTL_TX_OFFCHAN = BIT(25),
> IEEE80211_TX_INTFL_TKIP_MIC_FAILURE = BIT(26),
> + IEEE80211_TX_CTL_RC_BYPASS = BIT(27),
> };
>
> #define IEEE80211_TX_CTL_STBC_SHIFT 23
> diff -urN compat-wireless-2011-05-13.old//net/mac80211/tx.c
> compat-wireless-2011-05-13//net/mac80211/tx.c
> --- compat-wireless-2011-05-13.old//net/mac80211/tx.c 2011-05-16
> 19:20:13.000000000 +0100
> +++ compat-wireless-2011-05-13//net/mac80211/tx.c 2011-05-30
> 14:00:36.936002002 +0100
> @@ -1040,11 +1040,14 @@
> struct ieee80211_radiotap_iterator iterator;
> struct ieee80211_radiotap_header *rthdr =
> (struct ieee80211_radiotap_header *) skb->data;
> + struct ieee80211_supported_band *sband;
> bool hw_frag;
> struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
> int ret = ieee80211_radiotap_iterator_init(&iterator, rthdr, skb->len,
> NULL);
>
> + sband = tx->local->hw.wiphy->bands[tx->channel->band];
> +
> info->flags |= IEEE80211_TX_INTFL_DONT_ENCRYPT;
> tx->flags &= ~IEEE80211_TX_FRAGMENTED;
>
> @@ -1092,6 +1095,55 @@
> tx->flags |= IEEE80211_TX_FRAGMENTED;
> break;
>
> + case IEEE80211_RADIOTAP_RATE: {
> + int i, idx = -1;
> + int rate = *iterator.this_arg * 5;
> +
> + for (i = 0; i < sband->n_bitrates; i++)
> + if (sband->bitrates[i].bitrate == rate) {
> + idx = i;
> + break;
> + }
> +
> + /* Rate not available - rejecting */
> + if (idx < 0)
> + return false;
> +
> + info->flags |= IEEE80211_TX_CTL_RC_BYPASS;
> + info->control.rates[0].idx = idx;
> + info->control.rates[0].count = 1;
> + for (i = 1; i < IEEE80211_TX_MAX_RATES; i++)
> + info->control.rates[i].idx = -1;
> + break;
> + }
> +
> + case IEEE80211_RADIOTAP_DATA_RETRIES:
> + /*
> + * Only allow setting the number of retries in
> + * conjunction with the rates, when the rate control
> + * is bypassed.
> + */
> + if (info->flags & IEEE80211_TX_CTL_RC_BYPASS)
> + info->control.rates[0].count =
> + *iterator.this_arg;
> + break;
> +
> + case IEEE80211_RADIOTAP_MCS: {
> + u8 flags = iterator.this_arg[1];
> + u8 mcs = iterator.this_arg[2];
> + info->flags |= IEEE80211_TX_CTL_RC_BYPASS;
> + info->control.rates[0].idx = mcs;
> + info->control.rates[0].flags |=
> + IEEE80211_TX_RC_MCS;
> + if (flags & IEEE80211_RADIOTAP_MCS_BW_40)
> + info->control.rates[0].flags |=
> + IEEE80211_TX_RC_40_MHZ_WIDTH;
> + if (flags & IEEE80211_RADIOTAP_MCS_SGI)
> + info->control.rates[0].flags |=
> + IEEE80211_TX_RC_SHORT_GI;
> + break;
> + }
> +
> /*
> * Please update the file
> * Documentation/networking/mac80211-injection.txt
> @@ -1398,8 +1450,9 @@
> CALL_TXH(ieee80211_tx_h_ps_buf);
> CALL_TXH(ieee80211_tx_h_check_control_port_protocol);
> CALL_TXH(ieee80211_tx_h_select_key);
> - if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL))
> - CALL_TXH(ieee80211_tx_h_rate_ctrl);
> + if (!(tx->local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) &&
> + !(info->flags & IEEE80211_TX_CTL_RC_BYPASS))
> + CALL_TXH(ieee80211_tx_h_rate_ctrl);
>
> if (unlikely(info->flags & IEEE80211_TX_INTFL_RETRANSMISSION))
> goto txh_done;
> diff -urN compat-wireless-2011-05-13.old//net/wireless/radiotap.c
> compat-wireless-2011-05-13//net/wireless/radiotap.c
> --- compat-wireless-2011-05-13.old//net/wireless/radiotap.c
> 2011-05-16 19:20:10.000000000 +0100
> +++ compat-wireless-2011-05-13//net/wireless/radiotap.c
> 2011-05-30 12:51:56.348002001 +0100
> @@ -40,6 +40,7 @@
> [IEEE80211_RADIOTAP_TX_FLAGS] = { .align = 2, .size = 2, },
> [IEEE80211_RADIOTAP_RTS_RETRIES] = { .align = 1, .size = 1, },
> [IEEE80211_RADIOTAP_DATA_RETRIES] = { .align = 1, .size = 1, },
> + [IEEE80211_RADIOTAP_MCS] = { .align = 1, .size = 3, },
> /*
> * add more here as they are defined in radiotap.h
> */
> --
> To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
> the body of a message to [email protected]
> More majordomo info at http://vger.kernel.org/majordomo-info.html
>

--
John W. Linville Someday the world will need a hero, and you
[email protected] might be all we have. Be ready.