Skip to content

Commit 3208039

Browse files
dragorndragorn
committed
s1g: more work on parsing s1g beacons properly
1 parent d508e07 commit 3208039

File tree

2 files changed

+21
-239
lines changed

2 files changed

+21
-239
lines changed

‎phy_80211.cc‎

Lines changed: 19 additions & 239 deletions
Original file line numberDiff line numberDiff line change
@@ -2628,8 +2628,6 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
26282628
const std::shared_ptr<kis_gps_packinfo>& pack_gpsinfo) {
26292629
std::shared_ptr<dot11_advertised_ssid> ssid;
26302630

2631-
bool channel_from_ht = false;
2632-
26332631
if (dot11info->subtype != packet_sub_s1g_beacon) {
26342632
return;
26352633
}
@@ -2642,7 +2640,7 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
26422640
if (ssid != nullptr) {
26432641
ssid->set_if_lt_last_time(in_pack->ts.tv_sec);
26442642

2645-
if (dot11info->subtype == packet_sub_beacon) {
2643+
if (dot11info->subtype == packet_sub_s1g_beacon) {
26462644
ssid->inc_beacons_sec();
26472645
}
26482646
}
@@ -2686,9 +2684,7 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
26862684
(l1info->freq_khz != basedev->get_frequency() || basedev->get_channel().empty())) {
26872685
try {
26882686
basedev->set_channel(khz_to_channel(l1info->freq_khz));
2689-
} catch (const std::runtime_error& e) {
2690-
;
2691-
}
2687+
} catch (...) { }
26922688
}
26932689

26942690
bool new_ssid = false;
@@ -2747,6 +2743,11 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
27472743
if (new_ssid) {
27482744
packet_dot11_parse_ie_list(in_pack.get(), dot11info.get());
27492745

2746+
// always set the channel if we have s1g properties
2747+
if (dot11info->s1g_operation.parsed()) {
2748+
ssid->set_channel(fmt::format("{}ah", dot11info->s1g_operation.primary_channel()));
2749+
}
2750+
27502751
ssid->set_ssid_hash(dot11info->ssid_csum);
27512752

27522753
ssid->set_crypt_set(dot11info->cryptset);
@@ -2876,7 +2877,7 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
28762877

28772878
if (dot11info->ssid_len != 0 && alertracker->potential_alert(alert_ssidcanary_ref)) {
28782879
auto ntype =
2879-
dot11info->subtype == packet_sub_beacon ? std::string("advertising") :
2880+
dot11info->subtype == packet_sub_s1g_beacon ? std::string("advertising") :
28802881
std::string("responding for");
28812882
for (const auto& i : *ssidcanary_map) {
28822883
auto si = std::static_pointer_cast<tracker_element_string>(i.second)->get();
@@ -2892,20 +2893,6 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
28922893
}
28932894
}
28942895

2895-
if (alertracker->potential_alert(alert_airjackssid_ref) &&
2896-
ssid->get_ssid() == "AirJack" ) {
2897-
2898-
std::string al = "IEEE80211 Access Point BSSID " +
2899-
basedev->get_macaddr().mac_to_string() + " broadcasting SSID "
2900-
"\"AirJack\" which implies an attempt to disrupt "
2901-
"networks.";
2902-
2903-
alertracker->raise_alert(alert_airjackssid_ref, in_pack,
2904-
dot11info->bssid_mac, dot11info->source_mac,
2905-
dot11info->dest_mac, dot11info->other_mac,
2906-
dot11info->channel, al);
2907-
}
2908-
29092896
if (ssid->get_ssid() != "") {
29102897
basedev->set_devicename(ssid->get_ssid());
29112898
} else if (ssid->has_meshid() && ssid->get_meshid().length() > 0) {
@@ -2922,7 +2909,7 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
29222909

29232910
if (sa->compare_ssid(dot11info->ssid, dot11info->source_mac)) {
29242911
std::string ntype =
2925-
dot11info->subtype == packet_sub_beacon ? std::string("advertising") :
2912+
dot11info->subtype == packet_sub_s1g_beacon ? std::string("advertising") :
29262913
std::string("responding for");
29272914

29282915
std::string al = "IEEE80211 Unauthorized device (" +
@@ -2941,10 +2928,16 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
29412928
}
29422929
}
29432930
}
2944-
} else {
2931+
} else if (ssid != nullptr) {
29452932
ssid->set_if_lt_last_time(in_pack->ts.tv_sec);
29462933
}
29472934

2935+
if (ssid == nullptr) {
2936+
// If we got here we probably had a compressed SSID and we don't deal
2937+
// with those currently, so nothing to update
2938+
return;
2939+
}
2940+
29482941
dot11dev->set_last_adv_ssid(ssid);
29492942

29502943
ssid->set_ietag_checksum(dot11info->ietag_csum);
@@ -2974,7 +2967,7 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
29742967
ssid->set_wpa_mfp_supported(false);
29752968
}
29762969

2977-
if (dot11info->subtype == packet_sub_beacon) {
2970+
if (dot11info->subtype == packet_sub_s1g_beacon) {
29782971
auto tag_hash = xx_hash_cpp{};
29792972

29802973
for (const auto& i : beacon_ie_fingerprint_list) {
@@ -2998,120 +2991,6 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
29982991

29992992
// Set the type
30002993
ssid->set_ssid_beacon(true);
3001-
3002-
// Update beacon info, if any
3003-
if (dot11info->beacon_info.length() > 0)
3004-
ssid->set_beacon_info(dot11info->beacon_info);
3005-
3006-
// Set the mobility
3007-
if (dot11info->dot11r_mobility.parsed()) {
3008-
ssid->set_dot11r_mobility(true);
3009-
ssid->set_dot11r_mobility_domain_id(dot11info->dot11r_mobility.mobility_domain());
3010-
}
3011-
3012-
// Set tx power
3013-
ssid->set_ccx_txpower(dot11info->ccx_txpower);
3014-
3015-
// Set client mfp
3016-
ssid->set_cisco_client_mfp(dot11info->cisco_client_mfp);
3017-
3018-
// Set QBSS
3019-
if (dot11info->qbss.parsed()) {
3020-
ssid->set_dot11e_qbss(true);
3021-
ssid->set_dot11e_qbss_stations(dot11info->qbss.station_count());
3022-
3023-
// Percentage is value / max (1 byte, 255)
3024-
double chperc = (double) ((double) dot11info->qbss.channel_utilization() /
3025-
(double) 255.0f) * 100.0f;
3026-
ssid->set_dot11e_qbss_channel_load(chperc);
3027-
}
3028-
3029-
// Set the HT and VHT info. If we have VHT, we assume we must have HT; I've never
3030-
// seen VHT without HT. We handle HT only later on.
3031-
if (dot11info->dot11vht.parsed() && dot11info->dot11ht.parsed()) {
3032-
channel_from_ht = true;
3033-
3034-
// Grab the primary channel from the HT data
3035-
ssid->set_channel(n_to_string<int>(dot11info->dot11ht.primary_channel()));
3036-
3037-
if (dot11info->dot11vht.channel_width() == dot11_ie_192_vht_op::ch_80) {
3038-
ssid->set_ht_mode("HT80");
3039-
ssid->set_ht_center_1(5000 + (5 * dot11info->dot11vht.center1()));
3040-
ssid->set_ht_center_2(5000 + (5 * dot11info->dot11vht.center2()));
3041-
} else if (dot11info->dot11vht.channel_width() == dot11_ie_192_vht_op::ch_160) {
3042-
ssid->set_ht_mode("HT160");
3043-
ssid->set_ht_center_1(5000 + (5 * dot11info->dot11vht.center1()));
3044-
ssid->set_ht_center_2(0);
3045-
} else if (dot11info->dot11vht.channel_width() == dot11_ie_192_vht_op::ch_80_80) {
3046-
ssid->set_ht_mode("HT80+80");
3047-
ssid->set_ht_center_1(5000 + (5 * dot11info->dot11vht.center1()));
3048-
ssid->set_ht_center_2(5000 + (5 * dot11info->dot11vht.center2()));
3049-
} else if (dot11info->dot11vht.channel_width() == dot11_ie_192_vht_op::ch_20_40) {
3050-
if (dot11info->dot11ht.ht_info_chan_offset_none()) {
3051-
ssid->set_ht_mode("HT20");
3052-
} else if (dot11info->dot11ht.ht_info_chan_offset_above()) {
3053-
ssid->set_ht_mode("HT40+");
3054-
} else if (dot11info->dot11ht.ht_info_chan_offset_below()) {
3055-
ssid->set_ht_mode("HT40-");
3056-
}
3057-
3058-
ssid->set_ht_center_1(0);
3059-
ssid->set_ht_center_2(0);
3060-
3061-
}
3062-
} else if (dot11info->dot11ht.parsed()) {
3063-
// Only HT info no VHT
3064-
if (dot11info->dot11ht.ht_info_chan_offset_none()) {
3065-
ssid->set_ht_mode("HT20");
3066-
} else if (dot11info->dot11ht.ht_info_chan_offset_above()) {
3067-
ssid->set_ht_mode("HT40+");
3068-
} else if (dot11info->dot11ht.ht_info_chan_offset_below()) {
3069-
ssid->set_ht_mode("HT40-");
3070-
}
3071-
3072-
channel_from_ht = true;
3073-
3074-
ssid->set_ht_center_1(0);
3075-
ssid->set_ht_center_2(0);
3076-
ssid->set_channel(n_to_string<int>(dot11info->dot11ht.primary_channel()));
3077-
}
3078-
3079-
// Update OWE
3080-
if (dot11info->owe_transition.parsed()) {
3081-
ssid->set_owe_bssid(dot11info->owe_transition.bssid());
3082-
ssid->set_owe_ssid_len(dot11info->owe_transition.ssid().length());
3083-
ssid->set_owe_ssid(munge_to_printable(dot11info->owe_transition.ssid()));
3084-
}
3085-
3086-
// Pull specific tags we don't pre-parse
3087-
3088-
// Update mesh capabilities
3089-
auto meshcap = dot11info->ie_tags.tags_map().find(113);
3090-
if (meshcap != dot11info->ie_tags.tags_map().end()) {
3091-
try {
3092-
auto mc = Globalreg::new_from_pool<dot11_ie_113_mesh_config>();
3093-
mc->parse(meshcap->second->tag_data());
3094-
3095-
ssid->set_mesh_forwarding(mc->mesh_forwarding());
3096-
ssid->set_mesh_peerings(mc->num_peerings());
3097-
ssid->set_mesh_gateway(mc->connected_to_gate());
3098-
} catch (...) {
3099-
;
3100-
}
3101-
}
3102-
3103-
auto tpc = dot11info->ie_tags.tags_map().find(35);
3104-
if (tpc != dot11info->ie_tags.tags_map().end()) {
3105-
try {
3106-
auto tpc_ie = Globalreg::new_from_pool<dot11_ie_35_tpc>();
3107-
tpc_ie->parse(tpc->second->tag_data());
3108-
3109-
ssid->set_adv_tx_power(tpc_ie->txpower());
3110-
} catch (...) {
3111-
;
3112-
}
3113-
3114-
}
31152994
} else if (dot11info->subtype == packet_sub_probe_resp) {
31162995
if (mac_addr((uint8_t *) "\x00\x13\x37\x00\x00\x00", 6, 24) ==
31172996
dot11info->source_mac) {
@@ -3167,10 +3046,10 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
31673046
basedev->set_crypt_string(crypt_s);
31683047
}
31693048

3170-
if (!channel_from_ht && ssid->get_channel().length() > 0 &&
3049+
if (ssid->get_channel().length() > 0 &&
31713050
ssid->get_channel() != dot11info->channel && dot11info->channel != "0") {
31723051

3173-
if (dot11info->subtype == packet_sub_beacon) {
3052+
if (dot11info->subtype == packet_sub_s1g_beacon) {
31743053
auto al =
31753054
fmt::format("IEEE80211 Access Point BSSID {} SSID \"{}\" changed advertised channel "
31763055
"from {} to {}, which may indicate spoofing or impersonation. This may also be a "
@@ -3198,105 +3077,6 @@ void kis_80211_phy::handle_ssid_s1g(const std::shared_ptr<kis_tracked_device_bas
31983077
}
31993078
}
32003079

3201-
// Only process dot11d from beacons
3202-
if (dot11info->subtype == packet_sub_beacon) {
3203-
bool dot11dmismatch = false;
3204-
3205-
if (ssid->get_dot11d_country().length() > 0 &&
3206-
ssid->get_dot11d_country() != dot11info->dot11d_country) {
3207-
dot11dmismatch = true;
3208-
}
3209-
3210-
if (process_11d_country_list && ssid->has_dot11d_vec()) {
3211-
auto dot11dvec(ssid->get_dot11d_vec());
3212-
3213-
if (dot11dvec->size() != dot11info->dot11d_vec.size()) {
3214-
dot11dmismatch = true;
3215-
} else {
3216-
for (unsigned int vc = 0;
3217-
vc < dot11dvec->size() && vc < dot11info->dot11d_vec.size(); vc++) {
3218-
auto ri = static_cast<dot11_11d_tracked_range_info *>((*(dot11dvec->begin() + vc)).get());
3219-
3220-
if (ri->get_startchan() != dot11info->dot11d_vec[vc].startchan ||
3221-
ri->get_numchan() != dot11info->dot11d_vec[vc].numchan ||
3222-
ri->get_txpower() != dot11info->dot11d_vec[vc].txpower) {
3223-
dot11dmismatch = true;
3224-
break;
3225-
}
3226-
}
3227-
}
3228-
}
3229-
3230-
if (dot11dmismatch) {
3231-
if (alertracker->potential_alert(alert_dot11d_ref)) {
3232-
3233-
std::string al = "IEEE80211 Access Point BSSID " +
3234-
basedev->get_macaddr().mac_to_string() + " SSID \"" +
3235-
ssid->get_ssid() + "\" advertised conflicting 802.11d "
3236-
"information which may indicate AP spoofing/impersonation";
3237-
3238-
alertracker->raise_alert(alert_dot11d_ref, in_pack,
3239-
dot11info->bssid_mac, dot11info->source_mac,
3240-
dot11info->dest_mac, dot11info->other_mac,
3241-
dot11info->channel, al);
3242-
3243-
}
3244-
}
3245-
3246-
ssid->set_dot11d_country(dot11info->dot11d_country);
3247-
3248-
if (process_11d_country_list) {
3249-
if (dot11info->dot11d_vec.size() > 0 && ssid->has_dot11d_vec())
3250-
ssid->set_dot11d_vec(dot11info->dot11d_vec);
3251-
else if (dot11info->dot11d_vec.size() == 0 && ssid->has_dot11d_vec())
3252-
ssid->clear_dot11d_vec();
3253-
}
3254-
}
3255-
3256-
if (ssid->has_wps_state() || dot11info->wps != DOT11_WPS_NO_WPS) {
3257-
ssid->set_wps_version(dot11info->wps_version);
3258-
ssid->set_wps_state(dot11info->wps);
3259-
ssid->set_wps_config_methods(dot11info->wps_config_methods);
3260-
if (dot11info->wps_device_name != "")
3261-
ssid->set_wps_device_name(dot11info->wps_device_name);
3262-
if (dot11info->wps_manuf != "")
3263-
ssid->set_wps_manuf(dot11info->wps_manuf);
3264-
if (dot11info->wps_model_name != "") {
3265-
ssid->set_wps_model_name(dot11info->wps_model_name);
3266-
}
3267-
if (dot11info->wps_model_number != "")
3268-
ssid->set_wps_model_number(dot11info->wps_model_number);
3269-
if (dot11info->wps_serial_number != "")
3270-
ssid->set_wps_serial_number(dot11info->wps_serial_number);
3271-
3272-
if (dot11info->wps_uuid_e != "")
3273-
ssid->set_wps_uuid_e(dot11info->wps_uuid_e);
3274-
3275-
}
3276-
3277-
if (dot11info->beacon_interval && ssid->get_beaconrate() !=
3278-
Ieee80211Interval2NSecs(dot11info->beacon_interval)) {
3279-
3280-
if (ssid->get_beaconrate() != 0 &&
3281-
alertracker->potential_alert(alert_beaconrate_ref)) {
3282-
std::string al = "IEEE80211 Access Point BSSID " +
3283-
basedev->get_macaddr().mac_to_string() + " SSID \"" +
3284-
ssid->get_ssid() + "\" changed beacon rate from " +
3285-
n_to_string<int>(ssid->get_beaconrate()) + " to " +
3286-
n_to_string<int>(Ieee80211Interval2NSecs(dot11info->beacon_interval)) +
3287-
" which may indicate AP spoofing/impersonation";
3288-
3289-
alertracker->raise_alert(alert_beaconrate_ref, in_pack,
3290-
dot11info->bssid_mac, dot11info->source_mac,
3291-
dot11info->dest_mac, dot11info->other_mac,
3292-
dot11info->channel, al);
3293-
}
3294-
3295-
ssid->set_beaconrate(Ieee80211Interval2NSecs(dot11info->beacon_interval));
3296-
}
3297-
3298-
ssid->set_maxrate(dot11info->maxrate);
3299-
33003080
// Add the location data, if any
33013081
if (pack_gpsinfo != NULL && pack_gpsinfo->fix > 1) {
33023082
auto loc = ssid->get_location();

‎phy_80211_dissectors.cc‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2525,6 +2525,8 @@ int kis_80211_phy::packet_dot11_ie_dissector(kis_packet* in_pack, dot11_packinfo
25252525
} else if (ie_tag.tag_num() == 232) {
25262526
try {
25272527
packinfo->s1g_operation.parse(ie_tag.tag_data());
2528+
2529+
packinfo->channel = fmt::format("{}ah", packinfo->s1g_operation.primary_channel());
25282530
} catch (...) {
25292531
packinfo->corrupt = 1;
25302532
return -1;

0 commit comments

Comments
 (0)