Diffstat (limited to 'noncore/net/wellenreiter/daemon/source/sniffer.c') (more/less context) (ignore whitespace changes)
-rw-r--r-- | noncore/net/wellenreiter/daemon/source/sniffer.c | 437 |
1 files changed, 437 insertions, 0 deletions
diff --git a/noncore/net/wellenreiter/daemon/source/sniffer.c b/noncore/net/wellenreiter/daemon/source/sniffer.c new file mode 100644 index 0000000..6f40503 --- a/dev/null +++ b/noncore/net/wellenreiter/daemon/source/sniffer.c | |||
@@ -0,0 +1,437 @@ | |||
1 | /* Its just a simple rfmon mode sniffer | ||
2 | i hope my C is at last a bit better then in my | ||
3 | early days :-). | ||
4 | This works only with cisco wireless cards with an rfmon | ||
5 | able driver and not with wifi stuff. | ||
6 | Btw. did i mention that i hate C? | ||
7 | |||
8 | To compile use: | ||
9 | gcc wlan-sniffer.c -o wlan-sniffer -lpcap | ||
10 | |||
11 | use it like this: | ||
12 | wlan-sniffer interface | ||
13 | |||
14 | */ | ||
15 | #include "sniffer.h" | ||
16 | |||
17 | int main(int argc, char **argv) | ||
18 | { | ||
19 | int ret; /* return code */ | ||
20 | ret = card_into_monitormode (SNIFFER_DEVICE, CARD_TYPE_NG); | ||
21 | if (ret == -1) | ||
22 | { | ||
23 | exit(-1); | ||
24 | } | ||
25 | start_sniffing (SNIFFER_DEVICE); | ||
26 | |||
27 | return 0; | ||
28 | } | ||
29 | |||
30 | int card_into_monitormode (char * device, int cardtype) | ||
31 | { | ||
32 | int ret = -1; | ||
33 | int datalink; /* used for getting the pcap datalink type */ | ||
34 | char CiscoRFMON[35] = "/proc/driver/aironet/"; | ||
35 | FILE *CISCO_CONFIG_FILE; | ||
36 | char errbuf[PCAP_ERRBUF_SIZE]; | ||
37 | pcap_t *handle; | ||
38 | |||
39 | /* Checks if we have a device to sniff on */ | ||
40 | if(device == NULL) | ||
41 | { | ||
42 | printf ("Fatal error i did not have any interfaces to sniff on\n"); | ||
43 | exit(1); | ||
44 | } | ||
45 | |||
46 | /* Setting the prmiscous and up flag to the interface */ | ||
47 | if (card_set_promisc_up (device) == 0) | ||
48 | { | ||
49 | printf ("Interface flags correctly set using ifconfig\n"); | ||
50 | } | ||
51 | |||
52 | /* Check the cardtype and executes the commands to go into monitor mode */ | ||
53 | if (cardtype == CARD_TYPE_CISCO) /* I got a cisco card */ | ||
54 | { | ||
55 | /* bring the sniffer into rfmon mode */ | ||
56 | snprintf(CiscoRFMON, sizeof(CiscoRFMON),DEFAULT_PATH, device); | ||
57 | CISCO_CONFIG_FILE = fopen(CiscoRFMON,"w"); | ||
58 | fputs ("Mode: r",CISCO_CONFIG_FILE); | ||
59 | fputs ("Mode: y",CISCO_CONFIG_FILE); | ||
60 | fputs ("XmitPower: 1",CISCO_CONFIG_FILE); | ||
61 | fclose(CISCO_CONFIG_FILE); | ||
62 | } | ||
63 | else if (cardtype == CARD_TYPE_NG) | ||
64 | { | ||
65 | char wlanngcmd[62]; | ||
66 | snprintf(wlanngcmd, sizeof(wlanngcmd),"%s %s lnxreq_wlansniff channel=1 enable=true",WLANCTL_PATH,device); | ||
67 | if (ret = (system (wlanngcmd)) != 0) | ||
68 | { | ||
69 | printf ("\n Fatal error could not set %s in raw mode, check cardtype\n",device); | ||
70 | exit(1); | ||
71 | } | ||
72 | } | ||
73 | else if (cardtype == CARD_TYPE_HOSTAP) | ||
74 | { | ||
75 | printf ("Got a host-ap card, nothing is implemented now\n"); | ||
76 | } | ||
77 | |||
78 | |||
79 | /* Check the interface if it is in the correct raw mode */ | ||
80 | handle = pcap_open_live(device, BUFSIZ, 1, 0, errbuf); | ||
81 | |||
82 | /* getting the datalink type */ | ||
83 | datalink = pcap_datalink(handle); | ||
84 | |||
85 | if (datalink == DLT_IEEE802_11) /* Rawmode is IEEE802_11 */ | ||
86 | { | ||
87 | printf ("Your successfully listen on %s in 802.11 raw mode\n",device); | ||
88 | pcap_close(handle); | ||
89 | return (0); | ||
90 | |||
91 | } | ||
92 | else | ||
93 | { | ||
94 | printf ("Fatal error, cannot continue, your interface %s does not work in the correct 802.11 raw mode, check you driver please\n",device); | ||
95 | pcap_close(handle); | ||
96 | exit(1); | ||
97 | } | ||
98 | } | ||
99 | |||
100 | int card_set_promisc_up (char * device) | ||
101 | { | ||
102 | int ret; | ||
103 | char ifconfigcmd[32]; | ||
104 | snprintf(ifconfigcmd,sizeof(ifconfigcmd),SBIN_PATH, device); | ||
105 | ret = system (ifconfigcmd); | ||
106 | if (ret > 0) | ||
107 | { | ||
108 | printf ("\nFatal error, could not execute %s please check your card,binary location and permission\n",ifconfigcmd); | ||
109 | exit(1); | ||
110 | } | ||
111 | return(0); | ||
112 | } | ||
113 | |||
114 | int start_sniffing (char * device) | ||
115 | { | ||
116 | int ret; /* return code */ | ||
117 | pcap_t *handletopcap; | ||
118 | char errbuf[PCAP_ERRBUF_SIZE]; | ||
119 | struct pcap_pkthdr header; /* The header that pcap gives us */ | ||
120 | const u_char *packet; /* The actual packet */ | ||
121 | |||
122 | /* opening the pcap for sniffing */ | ||
123 | handletopcap = pcap_open_live(device, BUFSIZ, 1, 1000, errbuf); | ||
124 | |||
125 | /* Next few lines a taken out of kismet */ | ||
126 | #ifdef HAVE_PCAP_NONBLOCK | ||
127 | pcap_setnonblock(handletopcap, 1, errstr); | ||
128 | #endif | ||
129 | |||
130 | /*start scanning */ | ||
131 | pcap_loop(handletopcap,-1,process_packets,NULL); | ||
132 | |||
133 | printf("\nDone processing packets... wheew!\n"); | ||
134 | return 0; | ||
135 | } | ||
136 | |||
137 | void process_packets(u_char *useless,const struct pcap_pkthdr* pkthdr,const u_char* packet) | ||
138 | { | ||
139 | u_int caplen = pkthdr->caplen; | ||
140 | u_int length = pkthdr->len; | ||
141 | u_int16_t fc; | ||
142 | u_int HEADER_LENGTH; | ||
143 | u_short extracted_ethertype; | ||
144 | int snapend; | ||
145 | int ret; | ||
146 | /* pinfo holds all interresting information for us */ | ||
147 | struct packetinfo pinfo; | ||
148 | struct packetinfo *pinfoptr; | ||
149 | pinfoptr=&pinfo; | ||
150 | |||
151 | pinfoptr->isvalid = 0; | ||
152 | pinfoptr->pktlen = pkthdr->len; | ||
153 | if (caplen < IEEE802_11_FC_LEN) | ||
154 | { | ||
155 | /* This is a garbage packet, because is does not long enough | ||
156 | to hold a 802.11b header */ | ||
157 | pinfoptr->isvalid = 0; | ||
158 | return; | ||
159 | } | ||
160 | |||
161 | /* Gets the framecontrol bits (2bytes long) */ | ||
162 | fc = EXTRACT_LE_16BITS(packet); | ||
163 | |||
164 | HEADER_LENGTH = GetHeaderLength(fc); | ||
165 | |||
166 | if (caplen < HEADER_LENGTH) | ||
167 | { | ||
168 | /* This is a garbage packet, because it is not long enough | ||
169 | to hold a correct header of its type */ | ||
170 | pinfoptr->isvalid = 0; | ||
171 | return; | ||
172 | } | ||
173 | |||
174 | /* Decode 802.11b header out of the packet */ | ||
175 | if (decode_80211b_hdr(packet,pinfoptr) == 0) | ||
176 | { | ||
177 | /* Justification of the ofset to further process the packet */ | ||
178 | length -= HEADER_LENGTH; | ||
179 | caplen -= HEADER_LENGTH; | ||
180 | packet += HEADER_LENGTH; | ||
181 | } | ||
182 | else | ||
183 | { /* Something is wrong,could not be a correct packet */ | ||
184 | return; | ||
185 | } | ||
186 | |||
187 | switch (FC_TYPE(fc)) | ||
188 | { | ||
189 | /* Is it a managemnet frame? */ | ||
190 | case T_MGMT: | ||
191 | switch (FC_SUBTYPE(fc)) | ||
192 | { /* Is it a beacon frame? */ | ||
193 | case ST_BEACON: | ||
194 | if (handle_beacon(fc, packet,pinfoptr) ==0) | ||
195 | { | ||
196 | if (!strcmp(pinfoptr->desthwaddr,"ff:ff:ff:ff:ff:ff") == 0) | ||
197 | { | ||
198 | /* Every beacon must have the broadcast as destination | ||
199 | so it must be a shitti packet */ | ||
200 | pinfoptr->isvalid = 0; | ||
201 | return; | ||
202 | } | ||
203 | if (pinfoptr->cap_ESS == pinfoptr->cap_IBSS) | ||
204 | { | ||
205 | /* Only one of both are possible, so must be | ||
206 | a noise packet, if this comes up */ | ||
207 | pinfoptr->isvalid = 0; | ||
208 | return; | ||
209 | } | ||
210 | if (pinfoptr->channel < 1 || pinfoptr->channel > 14) | ||
211 | { | ||
212 | /* Only channels between 1 and 14 are possible | ||
213 | others must be noise packets */ | ||
214 | pinfoptr->isvalid = 0; | ||
215 | return; | ||
216 | } | ||
217 | |||
218 | /* Decoding successfull of beacon frame */ | ||
219 | if (pinfoptr->cap_ESS == 1 &&pinfoptr->cap_IBSS ==0) | ||
220 | { | ||
221 | printf ("\nHave found an accesspoint:"); | ||
222 | } | ||
223 | else if(pinfoptr->cap_ESS == 0 && pinfoptr->cap_IBSS == 1) | ||
224 | { | ||
225 | printf ("\nHave found an AD-HOC station:"); | ||
226 | |||
227 | } | ||
228 | if (strcmp (pinfoptr->ssid,NONBROADCASTING) ==0) | ||
229 | { | ||
230 | printf ("\n\tOn a non-broadcasting network"); | ||
231 | } | ||
232 | else | ||
233 | { | ||
234 | printf ("\n\tOn network : %s",pinfoptr->ssid); | ||
235 | } | ||
236 | printf ("\n\tLen SSID : %d",pinfoptr->ssid_len); | ||
237 | printf ("\n\tOn Channel : %d",pinfoptr->channel); | ||
238 | printf ("\n\tEncryption : %s", pinfoptr->cap_WEP ? "ON" : "OFF"); | ||
239 | printf ("\n\tMacaddress : %s",pinfoptr->sndhwaddr); | ||
240 | printf ("\n\tBssid : %s",pinfoptr->bssid); | ||
241 | printf ("\n\tDest : %s\n",pinfoptr->desthwaddr); | ||
242 | } | ||
243 | break; | ||
244 | default: | ||
245 | printf("Unknown IEEE802.11 frame subtype (%d)",FC_SUBTYPE(fc)); | ||
246 | break; | ||
247 | } /* End of switch over different mgt frame types */ | ||
248 | |||
249 | break; | ||
250 | case T_CTRL: | ||
251 | //decode_control_frames(fc, packet); | ||
252 | printf ("Its a control frame"); | ||
253 | break; | ||
254 | case T_DATA: | ||
255 | //decode_data_frames(fc, packet); | ||
256 | printf ("Its a date frame"); | ||
257 | break; | ||
258 | default: | ||
259 | printf("Unknown IEEE802.11 frame type (%d)",FC_TYPE(fc)); | ||
260 | break; | ||
261 | } | ||
262 | } | ||
263 | |||
264 | |||
265 | /* This decodes the 802.11b frame header out of the 802.11b packet | ||
266 | all the infos is placed into the packetinfo structure */ | ||
267 | int decode_80211b_hdr(const u_char *p,struct packetinfo *ppinfo) | ||
268 | { | ||
269 | char * ret; | ||
270 | char testme[16]; | ||
271 | const struct mgmt_header_t *mgthdr = (const struct mgmt_header_t *) p; | ||
272 | ppinfo->fcsubtype = FC_SUBTYPE(mgthdr->fc); | ||
273 | |||
274 | /* Get the sender, bssid and dest mac address */ | ||
275 | etheraddr_string(mgthdr->bssid,ppinfo->bssid); | ||
276 | etheraddr_string(mgthdr->da,ppinfo->desthwaddr); | ||
277 | etheraddr_string(mgthdr->sa,ppinfo->sndhwaddr); | ||
278 | ppinfo->fc_wep = FC_WEP(mgthdr->fc); | ||
279 | return(0); | ||
280 | } | ||
281 | |||
282 | |||
283 | void etheraddr_string(register const u_char *ep,char * text) | ||
284 | { | ||
285 | static char hex[] = "0123456789abcdef"; | ||
286 | register u_int i, j; | ||
287 | register char *cp; | ||
288 | char buf[sizeof("00:00:00:00:00:00")]; | ||
289 | cp = buf; | ||
290 | if ((j = *ep >> 4) != 0) | ||
291 | *cp++ = hex[j]; | ||
292 | *cp++ = hex[*ep++ & 0xf]; | ||
293 | for (i = 5; (int)--i >= 0;) { | ||
294 | *cp++ = ':'; | ||
295 | if ((j = *ep >> 4) != 0) | ||
296 | *cp++ = hex[j]; | ||
297 | *cp++ = hex[*ep++ & 0xf]; | ||
298 | } | ||
299 | *cp = '\0'; | ||
300 | strcpy(text,buf); | ||
301 | return; | ||
302 | } | ||
303 | |||
304 | int handle_beacon(u_int16_t fc, const u_char *p,struct packetinfo *ppinfo) | ||
305 | { | ||
306 | struct mgmt_body_t pbody; | ||
307 | int offset = 0; | ||
308 | |||
309 | /* Get the static informations out of the packet */ | ||
310 | memset(&pbody, 0, sizeof(pbody)); | ||
311 | memcpy(&pbody.timestamp, p, 8); | ||
312 | offset += 8; | ||
313 | pbody.beacon_interval = EXTRACT_LE_16BITS(p+offset); | ||
314 | offset += 2; | ||
315 | pbody.capability_info = EXTRACT_LE_16BITS(p+offset); | ||
316 | offset += 2; | ||
317 | |||
318 | /* Gets the different flags out of the capabilities */ | ||
319 | ppinfo->cap_ESS = CAPABILITY_ESS(pbody.capability_info); | ||
320 | ppinfo->cap_IBSS = CAPABILITY_IBSS(pbody.capability_info); | ||
321 | ppinfo->cap_WEP = CAPABILITY_PRIVACY(pbody.capability_info); | ||
322 | |||
323 | /* Gets the tagged elements out of the packets */ | ||
324 | while (offset + 1 < ppinfo->pktlen) | ||
325 | { | ||
326 | switch (*(p + offset)) | ||
327 | { | ||
328 | case E_SSID: | ||
329 | memcpy(&(pbody.ssid),p+offset,2); offset += 2; | ||
330 | if (pbody.ssid.length > 0) | ||
331 | { | ||
332 | memcpy(&(pbody.ssid.ssid),p+offset,pbody.ssid.length); offset += pbody.ssid.length; | ||
333 | pbody.ssid.ssid[pbody.ssid.length]='\0'; | ||
334 | if (strcmp(pbody.ssid.ssid,"")==0) | ||
335 | { | ||
336 | ppinfo->ssid = NONBROADCASTING; | ||
337 | } | ||
338 | else | ||
339 | { | ||
340 | ppinfo->ssid = pbody.ssid.ssid; | ||
341 | } | ||
342 | ppinfo->ssid_len = pbody.ssid.length; | ||
343 | } | ||
344 | break; | ||
345 | case E_CHALLENGE: | ||
346 | memcpy(&(pbody.challenge),p+offset,2); offset += 2; | ||
347 | if (pbody.challenge.length > 0) | ||
348 | { | ||
349 | memcpy(&(pbody.challenge.text),p+offset,pbody.challenge.length); offset += pbody.challenge.length; | ||
350 | pbody.challenge.text[pbody.challenge.length]='\0'; | ||
351 | } | ||
352 | break; | ||
353 | case E_RATES: | ||
354 | memcpy(&(pbody.rates),p+offset,2); offset += 2; | ||
355 | if (pbody.rates.length > 0) { | ||
356 | memcpy(&(pbody.rates.rate),p+offset,pbody.rates.length); offset += pbody.rates.length; | ||
357 | } | ||
358 | break; | ||
359 | case E_DS: | ||
360 | memcpy(&(pbody.ds),p+offset,3); offset +=3; | ||
361 | ppinfo->channel = pbody.ds.channel; | ||
362 | break; | ||
363 | case E_CF: | ||
364 | memcpy(&(pbody.cf),p+offset,8); offset +=8; | ||
365 | break; | ||
366 | case E_TIM: | ||
367 | memcpy(&(pbody.tim),p+offset,2); offset +=2; | ||
368 | memcpy(&(pbody.tim.count),p+offset,3); offset +=3; | ||
369 | if ((pbody.tim.length -3) > 0) | ||
370 | { | ||
371 | memcpy((pbody.tim.bitmap),p+(pbody.tim.length -3),(pbody.tim.length -3)); | ||
372 | offset += pbody.tim.length -3; | ||
373 | } | ||
374 | break; | ||
375 | default: | ||
376 | #if 0 | ||
377 | printf("(1) unhandled element_id (%d) ", *(p+offset) ); | ||
378 | #endif | ||
379 | offset+= *(p+offset+1) + 2; | ||
380 | break; | ||
381 | } /* end of switch*/ | ||
382 | } /* end of for loop */ | ||
383 | return(0); | ||
384 | |||
385 | |||
386 | |||
387 | |||
388 | } /* End of handle_beacon */ | ||
389 | |||
390 | |||
391 | static int GetHeaderLength(u_int16_t fc) | ||
392 | { | ||
393 | int iLength=0; | ||
394 | |||
395 | switch (FC_TYPE(fc)) { | ||
396 | case T_MGMT: | ||
397 | iLength = MGMT_HEADER_LEN; | ||
398 | break; | ||
399 | case T_CTRL: | ||
400 | switch (FC_SUBTYPE(fc)) { | ||
401 | case CTRL_PS_POLL: | ||
402 | iLength = CTRL_PS_POLL_LEN; | ||
403 | break; | ||
404 | case CTRL_RTS: | ||
405 | iLength = CTRL_RTS_LEN; | ||
406 | break; | ||
407 | case CTRL_CTS: | ||
408 | iLength = CTRL_CTS_LEN; | ||
409 | break; | ||
410 | case CTRL_ACK: | ||
411 | iLength = CTRL_ACK_LEN; | ||
412 | break; | ||
413 | case CTRL_CF_END: | ||
414 | iLength = CTRL_END_LEN; | ||
415 | break; | ||
416 | case CTRL_END_ACK: | ||
417 | iLength = CTRL_END_ACK_LEN; | ||
418 | break; | ||
419 | default: | ||
420 | iLength = 0; | ||
421 | break; | ||
422 | } | ||
423 | break; | ||
424 | case T_DATA: | ||
425 | if (FC_TO_DS(fc) && FC_FROM_DS(fc)) | ||
426 | iLength = 30; | ||
427 | else | ||
428 | iLength = 24; | ||
429 | break; | ||
430 | default: | ||
431 | printf("unknown IEEE802.11 frame type (%d)", | ||
432 | FC_TYPE(fc)); | ||
433 | break; | ||
434 | } | ||
435 | |||
436 | return iLength; | ||
437 | } | ||