w00t/ap/ap.c

92 void fill_basic(struct ieee80211_frame *wh, struct params *p)
96         wh->i_dur[0] = 0x69;
97         wh->i_dur[1] = 0x00;
99         memcpy(wh->i_addr2, p->mac, 6);
101         seq = (short*)wh->i_seq;
119 int fill_beacon(struct params *p, struct ieee80211_frame *wh)
124 	ptr = (char*) (wh+1);
150 	return ptr - ((char*) wh);
156 	struct ieee80211_frame *wh;
160 	wh = (struct ieee80211_frame*) buf;
163 	fill_basic(wh, p);
164 	memset(wh->i_addr1, 0xff, 6);
165 	memcpy(wh->i_addr3, p->mac, 6);
167 	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT;
168 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_BEACON;
170 	len = fill_beacon(p, wh);
173 	ptr = (char*)wh + len;
180 	send_frame(p, wh, len);
190 	struct ieee80211_frame *wh;
193 	wh = (struct ieee80211_frame*) buf;
196 	fill_basic(wh, p);
197 	memcpy(wh->i_addr1, mac, 6);
198 	memcpy(wh->i_addr3, p->mac, 6);
200 	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT;
201 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_PROBE_RESP;
203 	len = fill_beacon(p, wh);
206 	send_frame(p, wh, len);
209 void read_preq(struct params *p, struct ieee80211_frame *wh, int len)
215 	ptr = (unsigned char*) (wh+1);
228 	mac2str(macs, wh->i_addr2);
232 		send_pres(p, wh->i_addr2);
238 	struct ieee80211_frame *wh;
242 	wh = (struct ieee80211_frame*) buf;
245 	fill_basic(wh, p);
246 	memcpy(wh->i_addr1, mac, 6);
247 	memcpy(wh->i_addr3, p->mac, 6);
249 	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT;
250 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_AUTH;
252 	ptr = (unsigned short*) (wh+1);
257 	len = ((char*)ptr) - ((char*) wh);
259 	send_frame(p, wh, len);
262 void read_auth(struct params *p, struct ieee80211_frame *wh, int len)
267 	if (memcmp(wh->i_addr1, p->mac, 6) != 0)
270 	ptr = (unsigned short*) (wh+1);
277 		mac2str(mac, wh->i_addr2);
279 		send_auth(p, wh->i_addr2);
288 	struct ieee80211_frame *wh;
292 	wh = (struct ieee80211_frame*) buf;
295 	fill_basic(wh, p);
296 	memcpy(wh->i_addr1, mac, 6);
297 	memcpy(wh->i_addr3, p->mac, 6);
299 	wh->i_fc[0] |= IEEE80211_FC0_TYPE_MGT;
300 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
302 	ptr = (char*) (wh+1);
316 	len = ptr - ((char*) wh);
318 	send_frame(p, wh, len);
321 void read_assoc(struct params *p, struct ieee80211_frame *wh, int len)
327 	if (memcmp(wh->i_addr1, p->mac, 6) != 0)
330 	ptr = (unsigned char*) (wh+1);
345 	mac2str(macs, wh->i_addr2);
349 		send_assoc(p, wh->i_addr2);
352 void read_mgt(struct params *p, struct ieee80211_frame *wh, int len)
354 	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
356 		read_preq(p, wh, len);
363 		read_auth(p, wh, len);
367 		read_assoc(p, wh, len);
375 		printf("wtf %d\n", (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) >>
385 	struct ieee80211_frame *wh;
388 	wh = (struct ieee80211_frame*) buf;
389 	wh->i_fc[0] |= IEEE80211_FC0_TYPE_CTL;
390 	wh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_CTS;
391 	wh->i_dur[0] = 0x69;
392 	wh->i_dur[0] = 0x00;
393 	memcpy(wh->i_addr1, mac, 6);
395 	send_frame(p, wh, 10);
398 void read_rts(struct params *p, struct ieee80211_frame *wh, int len)
400 	if (memcmp(wh->i_addr1, p->mac, 6) != 0)
403 	send_cts(p, wh->i_addr2);
406 void read_ack(struct params *p, struct ieee80211_frame *wh, int len)
408 	if (memcmp(wh->i_addr1, p->mac, 6) == 0)
412 void read_ctl(struct params *p, struct ieee80211_frame *wh, int len)
414 	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
416 		read_rts(p, wh, len);
420 		read_ack(p, wh, len);
427 		printf("wtf %d\n", (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) >>
437 int broadcast(struct ieee80211_frame *wh)
441 	if (memcmp(wh->i_addr1, "\xff\xff\xff\xff\xff\xff", 6) == 0)
447 void enque(struct params *p, struct ieee80211_frame *wh, int len)
449 	if (broadcast(wh))
454 	memcpy(p->packet, wh, len);
458 	wh = (struct ieee80211_frame*) p->packet;
459 	wh->i_fc[1] |= IEEE80211_FC1_RETRY;
465 void relay_data(struct params *p, struct ieee80211_frame *wh, int len)
472 	memcpy(fc, wh->i_fc, 2);
473 	memcpy(seq, wh->i_seq, 2);
476 	wh->i_fc[1] &= ~(IEEE80211_FC1_DIR_TODS | IEEE80211_FC1_RETRY);
477 	wh->i_fc[1] |= IEEE80211_FC1_DIR_FROMDS;
478 	memcpy(wh->i_addr1, wh->i_addr3, sizeof(wh->i_addr1));
479 	memcpy(wh->i_addr3, wh->i_addr2, sizeof(wh->i_addr3));
480 	memcpy(wh->i_addr2, p->mac, sizeof(wh->i_addr2));
481         ps = (unsigned short*)wh->i_seq;
484 	send_frame(p, wh, len);
485 	enque(p, wh, len);
488 	memcpy(wh->i_fc, fc, sizeof(fc));
489 	memcpy(wh->i_addr2, wh->i_addr3, sizeof(wh->i_addr2));
490 	memcpy(wh->i_addr3, wh->i_addr1, sizeof(wh->i_addr2));
491 	memcpy(wh->i_addr1, p->mac, sizeof(wh->i_addr1));
492 	memcpy(wh->i_seq, seq, sizeof(seq));
495 void read_real_data(struct params *p, struct ieee80211_frame *wh, int len)
499 	char *ptr = (char*) (wh+1);
502 	if (memcmp(wh->i_addr1, p->mac, 6) != 0)
506 	if (memcmp(wh->i_addr3, p->mac, 6) != 0)
507 		relay_data(p, wh, len);
509 	memcpy(dst, wh->i_addr3, 6);
512 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
518 		if (wep_decrypt(wh, len, p->wep_key, p->wep_len) == -1){
530 	memcpy(ptr, wh->i_addr2, 6);
534 	len -= sizeof(*wh);
548 void read_data(struct params *p, struct ieee80211_frame *wh, int len)
550 	switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
552 		read_real_data(p, wh, len);
559 		printf("wtf %d\n", (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) >>
595 int duplicate(struct params *p, struct ieee80211_frame *wh, int rc)
600 	if (!frame_type(wh, IEEE80211_FC0_TYPE_DATA,
604 	s = seqno(wh);
606 	c = client_find(p, wh->i_addr2);
613 		memcpy(c->mac, wh->i_addr2, 6);
619 	if (wh->i_fc[1] & IEEE80211_FC1_RETRY) {
642 void ack(struct params *p, struct ieee80211_frame *wh)
644 	if (memcmp(wh->i_addr1, p->mac, 6) != 0)
647 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
650 	send_ack(p->tx, wh->i_addr2);
657 	struct ieee80211_frame *wh;
663 	wh = get_wifi(buf, &rc);
664 	if (!wh)
668 	if (memcmp(wh->i_addr2, p->mac, 6) == 0) {
670 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
676 	ack(p, wh);
679 	if (duplicate(p, wh, rc)) {
686 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
688 		read_mgt(p, wh, rc);
692 		read_ctl(p, wh, rc);
696 		read_data(p, wh, rc);
713 	struct ieee80211_frame *wh;
731 	wh = (struct ieee80211_frame*) buf;
734 	fill_basic(wh, p);
735 	memcpy(wh->i_addr3, src, sizeof(wh->i_addr3));
736 	memcpy(wh->i_addr1, dst, sizeof(wh->i_addr1));
737 	wh->i_fc[0] |= IEEE80211_FC0_TYPE_DATA;
738 	wh->i_fc[1] |= IEEE80211_FC1_DIR_FROMDS;
740 		wh->i_fc[1] |= IEEE80211_FC1_PROTECTED;
743 	ptr = (char*) (wh+1);
758 		ptr = (char*) (wh+1);
763 		wep_encrypt(wh, rd, p->wep_key, p->wep_len);
767 	send_frame(p, wh, rd);