[PATCH] mac80211: fixed injection in monitor mode

[PATCH] mac80211: fixed injection in monitor mode

[Gabriele Gristina]

I have a problem with mac80211 injection:
if i setup interface in monitor mode with iwconfig and i try to send a
custum 802.11 frame i see twice the packet in monitor interface.
The first packet is right, the second is different only in the radiotap
header: rtap len is fixed to 13 bytes...
If i setup interface with airmon-ng the packet is sended once but the
radiotap header is fixed to 13 bytes.

Patch for 2.6.31.4

--- net/mac80211/main.c.orig    2009-10-16 00:50:00.000000000 +0200
+++ net/mac80211/main.c    2009-10-15 23:06:03.000000000 +0200
@@ -607,6 +607,9 @@
     skb->protocol = htons(ETH_P_802_2);
     memset(skb->cb, 0, sizeof(skb->cb));
 
+    if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
+        goto out_no_echo;
+
     rcu_read_lock();
     list_for_each_entry_rcu(sdata, &local->interfaces, list) {
         if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
@@ -630,7 +633,8 @@
         skb = NULL;
     }
     rcu_read_unlock();
-    dev_kfree_skb(skb);
+out_no_echo:
+    if (skb) dev_kfree_skb(skb);
 }
 EXPORT_SYMBOL(ieee80211_tx_status);

Re: [PATCH] mac80211: fixed injection in monitor mode

[John W. Linville]

On Fri, Oct 16, 2009 at 04:09:21AM +0200, Gabriele Gristina wrote:
> I have a problem with mac80211 injection:
> if i setup interface in monitor mode with iwconfig and i try to send a
> custum 802.11 frame i see twice the packet in monitor interface.
> The first packet is right, the second is different only in the radiotap
> header: rtap len is fixed to 13 bytes...
> If i setup interface with airmon-ng the packet is sended once but the
> radiotap header is fixed to 13 bytes.
> 
> Patch for 2.6.31.4
> 
> --- net/mac80211/main.c.orig    2009-10-16 00:50:00.000000000 +0200
> +++ net/mac80211/main.c    2009-10-15 23:06:03.000000000 +0200
> @@ -607,6 +607,9 @@
>      skb->protocol = htons(ETH_P_802_2);
>      memset(skb->cb, 0, sizeof(skb->cb));
>  
> +    if (!(info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS))
> +        goto out_no_echo;
> +
>      rcu_read_lock();
>      list_for_each_entry_rcu(sdata, &local->interfaces, list) {
>          if (sdata->vif.type == NL80211_IFTYPE_MONITOR) {
> @@ -630,7 +633,8 @@
>          skb = NULL;
>      }
>      rcu_read_unlock();
> -    dev_kfree_skb(skb);
> +out_no_echo:
> +    if (skb) dev_kfree_skb(skb);
>  }
>  EXPORT_SYMBOL(ieee80211_tx_status);
> 

Thanks for the patch!  But I need a Signed-off-by line...

	http://linux.yyz.us/patch-format.html

-- 
John W. Linville		Someday the world will need a hero, and you
linville@tuxdriver.com			might be all we have.  Be ready.

Re: [PATCH] mac80211: fixed injection in monitor mode

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 533 bytes --]

On Fri, 2009-10-16 at 04:09 +0200, Gabriele Gristina wrote:
> I have a problem with mac80211 injection:
> if i setup interface in monitor mode with iwconfig and i try to send a
> custum 802.11 frame i see twice the packet in monitor interface.
> The first packet is right, the second is different only in the radiotap
> header: rtap len is fixed to 13 bytes...
> If i setup interface with airmon-ng the packet is sended once but the
> radiotap header is fixed to 13 bytes.

This is correct. The patch is wrong.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]

Re: [PATCH] mac80211: fixed injection in monitor mode

[MatriX]

why is wrong?
there's another way to inject once packet?

2009/10/16, Johannes Berg <johannes@sipsolutions.net>:
> On Fri, 2009-10-16 at 04:09 +0200, Gabriele Gristina wrote:
>> I have a problem with mac80211 injection:
>> if i setup interface in monitor mode with iwconfig and i try to send a
>> custum 802.11 frame i see twice the packet in monitor interface.
>> The first packet is right, the second is different only in the radiotap
>> header: rtap len is fixed to 13 bytes...
>> If i setup interface with airmon-ng the packet is sended once but the
>> radiotap header is fixed to 13 bytes.
>
> This is correct. The patch is wrong.
>
> johannes
>

Re: [PATCH] mac80211: fixed injection in monitor mode

[Richard Farina]

Johannes Berg wrote:
> On Fri, 2009-10-16 at 04:09 +0200, Gabriele Gristina wrote:
>   
>> I have a problem with mac80211 injection:
>> if i setup interface in monitor mode with iwconfig and i try to send a
>> custum 802.11 frame i see twice the packet in monitor interface.
>> The first packet is right, the second is different only in the radiotap
>> header: rtap len is fixed to 13 bytes...
>> If i setup interface with airmon-ng the packet is sended once but the
>> radiotap header is fixed to 13 bytes.
>>     
>
> This is correct. The patch is wrong.
>
>   
I'm very stupid, could you please elaborate how seeing every single 
packets twice with different headers is "correct"?

Thanks,
Rick
> johannes
>   

Re: [PATCH] mac80211: fixed injection in monitor mode

[Johannes Berg]

[-- Attachment #1: Type: text/plain, Size: 866 bytes --]

On Fri, 2009-10-16 at 13:19 -0400, Richard Farina wrote:
> Johannes Berg wrote:
> > On Fri, 2009-10-16 at 04:09 +0200, Gabriele Gristina wrote:
> >   
> >> I have a problem with mac80211 injection:
> >> if i setup interface in monitor mode with iwconfig and i try to send a
> >> custum 802.11 frame i see twice the packet in monitor interface.
> >> The first packet is right, the second is different only in the radiotap
> >> header: rtap len is fixed to 13 bytes...
> >> If i setup interface with airmon-ng the packet is sended once but the
> >> radiotap header is fixed to 13 bytes.
> >>     
> >
> > This is correct. The patch is wrong.
> >
> >   
> I'm very stupid, could you please elaborate how seeing every single 
> packets twice with different headers is "correct"?

Look at the patch. I'ts the injection itself + tx status.

johannes

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 801 bytes --]