[thirdparty/hostap.git] / wlantest / inject.c

/*
 * wlantest frame injection
 * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
 *
 * This software may be distributed under the terms of the BSD license.
 * See README for more details.
 */

#include "utils/includes.h"

#include "utils/common.h"
#include "common/defs.h"
#include "common/ieee802_11_defs.h"
#include "crypto/aes_wrap.h"
#include "wlantest.h"


static int inject_frame(int s, const void *data, size_t len)
{
#define	IEEE80211_RADIOTAP_F_FRAG	0x08
	unsigned char rtap_hdr[] = {
		0x00, 0x00, /* radiotap version */
		0x0e, 0x00, /* radiotap length */
		0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
		IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
		0x00,       /* padding */
		0x00, 0x00, /* RX and TX flags to indicate that */
		0x00, 0x00, /* this is the injected frame directly */
	};
	struct iovec iov[2] = {
		{
			.iov_base = &rtap_hdr,
			.iov_len = sizeof(rtap_hdr),
		},
		{
			.iov_base = (void *) data,
			.iov_len = len,
		}
	};
	struct msghdr msg = {
		.msg_name = NULL,
		.msg_namelen = 0,
		.msg_iov = iov,
		.msg_iovlen = 2,
		.msg_control = NULL,
		.msg_controllen = 0,
		.msg_flags = 0,
	};
	int ret;

	ret = sendmsg(s, &msg, 0);
	if (ret < 0)
		perror("sendmsg");
	return ret;
}


static int is_robust_mgmt(u8 *frame, size_t len)
{
	struct ieee80211_mgmt *mgmt;
	u16 fc, stype;
	if (len < 24)
		return 0;
	mgmt = (struct ieee80211_mgmt *) frame;
	fc = le_to_host16(mgmt->frame_control);
	if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT)
		return 0;
	stype = WLAN_FC_GET_STYPE(fc);
	if (stype == WLAN_FC_STYPE_DEAUTH || stype == WLAN_FC_STYPE_DISASSOC)
		return 1;
	if (stype == WLAN_FC_STYPE_ACTION) {
		if (len < 25)
			return 0;
		if (mgmt->u.action.category != WLAN_ACTION_PUBLIC)
			return 1;
	}
	return 0;
}


static int wlantest_inject_bip(struct wlantest *wt, struct wlantest_bss *bss,
			       u8 *frame, size_t len, int incorrect_key)
{
	u8 *prot;
	u8 dummy[16];
	int ret;
	size_t plen;

	if (!bss->igtk_set[bss->igtk_idx])
		return -1;

	os_memset(dummy, 0x11, sizeof(dummy));
	inc_byte_array(bss->ipn[bss->igtk_idx], 6);

	prot = bip_protect(incorrect_key ? dummy : bss->igtk[bss->igtk_idx],
			   frame, len, bss->ipn[bss->igtk_idx],
			   bss->igtk_idx, &plen);
	if (prot == NULL)
		return -1;


	ret = inject_frame(wt->monitor_sock, prot, plen);
	os_free(prot);

	return (ret < 0) ? -1 : 0;
}


static int wlantest_inject_prot_bc(struct wlantest *wt,
				   struct wlantest_bss *bss,
				   u8 *frame, size_t len, int incorrect_key)
{
	u8 *crypt;
	size_t crypt_len;
	int ret;
	u8 dummy[64];
	u8 *pn;
	struct ieee80211_hdr *hdr;
	u16 fc;
	int hdrlen;

	hdr = (struct ieee80211_hdr *) frame;
	hdrlen = 24;
	fc = le_to_host16(hdr->frame_control);

	if (!bss->gtk_len[bss->gtk_idx])
		return -1;

	if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
	    (WLAN_FC_TODS | WLAN_FC_FROMDS))
		hdrlen += ETH_ALEN;
	pn = bss->rsc[bss->gtk_idx];
	inc_byte_array(pn, 6);

	os_memset(dummy, 0x11, sizeof(dummy));
	if (bss->group_cipher == WPA_CIPHER_TKIP)
		crypt = tkip_encrypt(incorrect_key ? dummy :
				     bss->gtk[bss->gtk_idx],
				     frame, len, hdrlen, NULL, pn,
				     bss->gtk_idx, &crypt_len);
	else
		crypt = ccmp_encrypt(incorrect_key ? dummy :
				     bss->gtk[bss->gtk_idx],
				     frame, len, hdrlen, NULL, pn,
				     bss->gtk_idx, &crypt_len);

	if (crypt == NULL)
		return -1;

	ret = inject_frame(wt->monitor_sock, crypt, crypt_len);
	os_free(crypt);

	return (ret < 0) ? -1 : 0;
}


static int wlantest_inject_prot(struct wlantest *wt, struct wlantest_bss *bss,
				struct wlantest_sta *sta, u8 *frame,
				size_t len, int incorrect_key)
{
	u8 *crypt;
	size_t crypt_len;
	int ret;
	u8 dummy[64];
	u8 *pn;
	struct ieee80211_hdr *hdr;
	u16 fc;
	int tid = 0;
	u8 *qos = NULL;
	int hdrlen;
	struct wlantest_tdls *tdls = NULL;
	const u8 *tk = NULL;

	hdr = (struct ieee80211_hdr *) frame;
	hdrlen = 24;
	fc = le_to_host16(hdr->frame_control);

	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
	    (fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) == 0) {
		struct wlantest_sta *sta2;
		bss = bss_get(wt, hdr->addr3);
		if (bss == NULL) {
			wpa_printf(MSG_DEBUG, "No BSS found for TDLS "
				   "injection");
			return -1;
		}
		sta = sta_find(bss, hdr->addr2);
		sta2 = sta_find(bss, hdr->addr1);
		if (sta == NULL || sta2 == NULL) {
			wpa_printf(MSG_DEBUG, "No stations found for TDLS "
				   "injection");
			return -1;
		}
		dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list)
		{
			if ((tdls->init == sta && tdls->resp == sta2) ||
			    (tdls->init == sta2 && tdls->resp == sta)) {
				if (!tdls->link_up)
					wpa_printf(MSG_DEBUG, "TDLS: Link not "
						   "up, but injecting Data "
						   "frame on direct link");
				tk = tdls->tpk.tk;
				break;
			}
		}
	}

	if (tk == NULL && sta == NULL) {
		if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
			return wlantest_inject_bip(wt, bss, frame, len,
						   incorrect_key);
		return wlantest_inject_prot_bc(wt, bss, frame, len,
					       incorrect_key);
	}

	if (tk == NULL && !sta->ptk_set) {
		wpa_printf(MSG_DEBUG, "No key known for injection");
		return -1;
	}

	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
		tid = 16;
	else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
		if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
		    (WLAN_FC_TODS | WLAN_FC_FROMDS))
			hdrlen += ETH_ALEN;
		if (WLAN_FC_GET_STYPE(fc) & 0x08) {
			qos = frame + hdrlen;
			hdrlen += 2;
			tid = qos[0] & 0x0f;
		}
	}
	if (tk) {
		if (os_memcmp(hdr->addr2, tdls->init->addr, ETH_ALEN) == 0)
			pn = tdls->rsc_init[tid];
		else
			pn = tdls->rsc_resp[tid];
	} else if (os_memcmp(hdr->addr2, bss->bssid, ETH_ALEN) == 0)
		pn = sta->rsc_fromds[tid];
	else
		pn = sta->rsc_tods[tid];
	inc_byte_array(pn, 6);

	os_memset(dummy, 0x11, sizeof(dummy));
	if (tk) 
		crypt = ccmp_encrypt(incorrect_key ? dummy : tk,
				     frame, len, hdrlen, qos, pn, 0,
				     &crypt_len);
	else if (sta->pairwise_cipher == WPA_CIPHER_TKIP)
		crypt = tkip_encrypt(incorrect_key ? dummy : sta->ptk.tk1,
				     frame, len, hdrlen, qos, pn, 0,
				     &crypt_len);
	else
		crypt = ccmp_encrypt(incorrect_key ? dummy : sta->ptk.tk1,
				     frame, len, hdrlen, qos, pn, 0,
				     &crypt_len);

	if (crypt == NULL) {
		wpa_printf(MSG_DEBUG, "Frame encryption failed");
		return -1;
	}

	wpa_hexdump(MSG_DEBUG, "Inject frame (encrypted)", crypt, crypt_len);
	ret = inject_frame(wt->monitor_sock, crypt, crypt_len);
	os_free(crypt);
	wpa_printf(MSG_DEBUG, "inject_frame for protected frame: %d", ret);

	return (ret < 0) ? -1 : 0;
}


int wlantest_inject(struct wlantest *wt, struct wlantest_bss *bss,
		    struct wlantest_sta *sta, u8 *frame, size_t len,
		    enum wlantest_inject_protection prot)
{
	int ret;
	struct ieee80211_hdr *hdr;
	u16 fc;
	int protectable, protect = 0;

	wpa_hexdump(MSG_DEBUG, "Inject frame", frame, len);
	if (wt->monitor_sock < 0) {
		wpa_printf(MSG_INFO, "Cannot inject frames when monitor "
			   "interface is not in use");
		return -1;
	}

	if (prot != WLANTEST_INJECT_UNPROTECTED &&
	    (bss == NULL || sta == NULL)) {
		wpa_printf(MSG_INFO, "No BSS/STA information to inject "
			   "protected frames");
		return -1;
	}

	hdr = (struct ieee80211_hdr *) frame;
	fc = le_to_host16(hdr->frame_control);
	protectable = WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA ||
		is_robust_mgmt(frame, len);

	if ((prot == WLANTEST_INJECT_PROTECTED ||
	     prot == WLANTEST_INJECT_INCORRECT_KEY) && bss) {
		if (!sta &&
		    ((WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
		      !bss->igtk_set[bss->igtk_idx]) ||
		     (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
		      !bss->gtk_len[bss->gtk_idx]))) {
			wpa_printf(MSG_INFO, "No GTK/IGTK known for "
				   MACSTR " to protect the injected "
				   "frame", MAC2STR(bss->bssid));
			return -1;
		}
		if (sta && !sta->ptk_set) {
			wpa_printf(MSG_INFO, "No PTK known for the STA " MACSTR
				   " to encrypt the injected frame",
				   MAC2STR(sta->addr));
			return -1;
		}
		protect = 1;
	} else if (protectable && prot != WLANTEST_INJECT_UNPROTECTED && bss) {
		if (sta && sta->ptk_set)
			protect = 1;
		else if (!sta) {
			if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
			    bss->gtk_len[bss->gtk_idx])
				protect = 1;
			if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
			    bss->igtk_set[bss->igtk_idx])
				protect = 1;
		}
	}

	if (protect && bss)
		return wlantest_inject_prot(
			wt, bss, sta, frame, len,
			prot == WLANTEST_INJECT_INCORRECT_KEY);

	ret = inject_frame(wt->monitor_sock, frame, len);
	wpa_printf(MSG_DEBUG, "inject_frame for unprotected frame: %d", ret);
	return (ret < 0) ? -1 : 0;
}
Commit	Line	Data
7d23e971 JM	1	/*
	2	* wlantest frame injection
	3	* Copyright (c) 2010, Jouni Malinen <j@w1.fi>
	4	*
0f3d578e JM	5	* This software may be distributed under the terms of the BSD license.
0f3d578e JM	6	* See README for more details.
7d23e971 JM	7	*/
	8
	9	#include "utils/includes.h"
	10
	11	#include "utils/common.h"
571ab37b JM	12	#include "common/defs.h"
571ab37b JM	13	#include "common/ieee802_11_defs.h"
2e4c3469	14	#include "crypto/aes_wrap.h"
7d23e971 JM	15	#include "wlantest.h"
	16
	17
	18	static int inject_frame(int s, const void *data, size_t len)
	19	{
	20	#define IEEE80211_RADIOTAP_F_FRAG 0x08
	21	unsigned char rtap_hdr[] = {
	22	0x00, 0x00, /* radiotap version */
	23	0x0e, 0x00, /* radiotap length */
	24	0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
	25	IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
	26	0x00, /* padding */
	27	0x00, 0x00, /* RX and TX flags to indicate that */
	28	0x00, 0x00, /* this is the injected frame directly */
	29	};
	30	struct iovec iov[2] = {
	31	{
	32	.iov_base = &rtap_hdr,
	33	.iov_len = sizeof(rtap_hdr),
	34	},
	35	{
	36	.iov_base = (void *) data,
	37	.iov_len = len,
	38	}
	39	};
	40	struct msghdr msg = {
	41	.msg_name = NULL,
	42	.msg_namelen = 0,
	43	.msg_iov = iov,
	44	.msg_iovlen = 2,
	45	.msg_control = NULL,
	46	.msg_controllen = 0,
	47	.msg_flags = 0,
	48	};
	49	int ret;
	50
	51	ret = sendmsg(s, &msg, 0);
	52	if (ret < 0)
	53	perror("sendmsg");
	54	return ret;
	55	}
	56
	57
571ab37b JM	58	static int is_robust_mgmt(u8 *frame, size_t len)
	59	{
	60	struct ieee80211_mgmt *mgmt;
	61	u16 fc, stype;
	62	if (len < 24)
	63	return 0;
	64	mgmt = (struct ieee80211_mgmt *) frame;
	65	fc = le_to_host16(mgmt->frame_control);
	66	if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT)
	67	return 0;
	68	stype = WLAN_FC_GET_STYPE(fc);
	69	if (stype == WLAN_FC_STYPE_DEAUTH \|\| stype == WLAN_FC_STYPE_DISASSOC)
	70	return 1;
	71	if (stype == WLAN_FC_STYPE_ACTION) {
	72	if (len < 25)
	73	return 0;
	74	if (mgmt->u.action.category != WLAN_ACTION_PUBLIC)
	75	return 1;
	76	}
	77	return 0;
	78	}
	79
	80
2e4c3469 JM	81	static int wlantest_inject_bip(struct wlantest wt, struct wlantest_bss bss,
	82	u8 *frame, size_t len, int incorrect_key)
	83	{
a9eae7ef	84	u8 *prot;
2e4c3469 JM	85	u8 dummy[16];
2e4c3469 JM	86	int ret;
2e4c3469 JM	87	size_t plen;
	88
	89	if (!bss->igtk_set[bss->igtk_idx])
	90	return -1;
	91
a9eae7ef	92	os_memset(dummy, 0x11, sizeof(dummy));
2e4c3469	93	inc_byte_array(bss->ipn[bss->igtk_idx], 6);
2e4c3469	94
a9eae7ef JM	95	prot = bip_protect(incorrect_key ? dummy : bss->igtk[bss->igtk_idx],
	96	frame, len, bss->ipn[bss->igtk_idx],
	97	bss->igtk_idx, &plen);
	98	if (prot == NULL)
2e4c3469	99	return -1;
2e4c3469	100
2e4c3469 JM	101
	102	ret = inject_frame(wt->monitor_sock, prot, plen);
	103	os_free(prot);
	104
	105	return (ret < 0) ? -1 : 0;
	106	}
	107
	108
	109	static int wlantest_inject_prot_bc(struct wlantest *wt,
	110	struct wlantest_bss *bss,
	111	u8 *frame, size_t len, int incorrect_key)
	112	{
	113	u8 *crypt;
	114	size_t crypt_len;
	115	int ret;
	116	u8 dummy[64];
	117	u8 *pn;
	118	struct ieee80211_hdr *hdr;
	119	u16 fc;
	120	int hdrlen;
	121
	122	hdr = (struct ieee80211_hdr *) frame;
	123	hdrlen = 24;
	124	fc = le_to_host16(hdr->frame_control);
	125
	126	if (!bss->gtk_len[bss->gtk_idx])
	127	return -1;
	128
	129	if ((fc & (WLAN_FC_TODS \| WLAN_FC_FROMDS)) ==
	130	(WLAN_FC_TODS \| WLAN_FC_FROMDS))
	131	hdrlen += ETH_ALEN;
	132	pn = bss->rsc[bss->gtk_idx];
	133	inc_byte_array(pn, 6);
	134
	135	os_memset(dummy, 0x11, sizeof(dummy));
	136	if (bss->group_cipher == WPA_CIPHER_TKIP)
	137	crypt = tkip_encrypt(incorrect_key ? dummy :
	138	bss->gtk[bss->gtk_idx],
	139	frame, len, hdrlen, NULL, pn,
	140	bss->gtk_idx, &crypt_len);
	141	else
	142	crypt = ccmp_encrypt(incorrect_key ? dummy :
	143	bss->gtk[bss->gtk_idx],
	144	frame, len, hdrlen, NULL, pn,
	145	bss->gtk_idx, &crypt_len);
	146
	147	if (crypt == NULL)
	148	return -1;
	149
	150	ret = inject_frame(wt->monitor_sock, crypt, crypt_len);
	151	os_free(crypt);
	152
	153	return (ret < 0) ? -1 : 0;
	154	}
	155
	156
571ab37b JM	157	static int wlantest_inject_prot(struct wlantest wt, struct wlantest_bss bss,
	158	struct wlantest_sta sta, u8 frame,
	159	size_t len, int incorrect_key)
	160	{
	161	u8 *crypt;
	162	size_t crypt_len;
	163	int ret;
	164	u8 dummy[64];
	165	u8 *pn;
	166	struct ieee80211_hdr *hdr;
	167	u16 fc;
	168	int tid = 0;
	169	u8 *qos = NULL;
	170	int hdrlen;
b3a6d9d4 JM	171	struct wlantest_tdls *tdls = NULL;
b3a6d9d4 JM	172	const u8 *tk = NULL;
571ab37b	173
2e4c3469 JM	174	hdr = (struct ieee80211_hdr *) frame;
	175	hdrlen = 24;
	176	fc = le_to_host16(hdr->frame_control);
	177
880a97dc JM	178	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
880a97dc JM	179	(fc & (WLAN_FC_TODS \| WLAN_FC_FROMDS)) == 0) {
b3a6d9d4 JM	180	struct wlantest_sta *sta2;
b3a6d9d4 JM	181	bss = bss_get(wt, hdr->addr3);
a8401116 JM	182	if (bss == NULL) {
	183	wpa_printf(MSG_DEBUG, "No BSS found for TDLS "
	184	"injection");
b3a6d9d4	185	return -1;
a8401116	186	}
b3a6d9d4 JM	187	sta = sta_find(bss, hdr->addr2);
b3a6d9d4 JM	188	sta2 = sta_find(bss, hdr->addr1);
a8401116 JM	189	if (sta == NULL \|\| sta2 == NULL) {
	190	wpa_printf(MSG_DEBUG, "No stations found for TDLS "
	191	"injection");
b3a6d9d4	192	return -1;
a8401116	193	}
b3a6d9d4 JM	194	dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list)
	195	{
	196	if ((tdls->init == sta && tdls->resp == sta2) \|\|
	197	(tdls->init == sta2 && tdls->resp == sta)) {
	198	if (!tdls->link_up)
	199	wpa_printf(MSG_DEBUG, "TDLS: Link not "
	200	"up, but injecting Data "
	201	"frame on direct link");
	202	tk = tdls->tpk.tk;
	203	break;
	204	}
	205	}
	206	}
	207
	208	if (tk == NULL && sta == NULL) {
2e4c3469 JM	209	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
	210	return wlantest_inject_bip(wt, bss, frame, len,
	211	incorrect_key);
	212	return wlantest_inject_prot_bc(wt, bss, frame, len,
	213	incorrect_key);
	214	}
571ab37b	215
a8401116 JM	216	if (tk == NULL && !sta->ptk_set) {
a8401116 JM	217	wpa_printf(MSG_DEBUG, "No key known for injection");
571ab37b	218	return -1;
a8401116	219	}
571ab37b	220
571ab37b JM	221	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
	222	tid = 16;
	223	else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
	224	if ((fc & (WLAN_FC_TODS \| WLAN_FC_FROMDS)) ==
	225	(WLAN_FC_TODS \| WLAN_FC_FROMDS))
	226	hdrlen += ETH_ALEN;
	227	if (WLAN_FC_GET_STYPE(fc) & 0x08) {
	228	qos = frame + hdrlen;
	229	hdrlen += 2;
	230	tid = qos[0] & 0x0f;
	231	}
	232	}
b3a6d9d4 JM	233	if (tk) {
	234	if (os_memcmp(hdr->addr2, tdls->init->addr, ETH_ALEN) == 0)
	235	pn = tdls->rsc_init[tid];
	236	else
	237	pn = tdls->rsc_resp[tid];
	238	} else if (os_memcmp(hdr->addr2, bss->bssid, ETH_ALEN) == 0)
571ab37b JM	239	pn = sta->rsc_fromds[tid];
	240	else
	241	pn = sta->rsc_tods[tid];
	242	inc_byte_array(pn, 6);
	243
	244	os_memset(dummy, 0x11, sizeof(dummy));
b3a6d9d4 JM	245	if (tk)
	246	crypt = ccmp_encrypt(incorrect_key ? dummy : tk,
	247	frame, len, hdrlen, qos, pn, 0,
	248	&crypt_len);
	249	else if (sta->pairwise_cipher == WPA_CIPHER_TKIP)
571ab37b JM	250	crypt = tkip_encrypt(incorrect_key ? dummy : sta->ptk.tk1,
	251	frame, len, hdrlen, qos, pn, 0,
	252	&crypt_len);
	253	else
	254	crypt = ccmp_encrypt(incorrect_key ? dummy : sta->ptk.tk1,
	255	frame, len, hdrlen, qos, pn, 0,
	256	&crypt_len);
	257
a8401116 JM	258	if (crypt == NULL) {
a8401116 JM	259	wpa_printf(MSG_DEBUG, "Frame encryption failed");
571ab37b	260	return -1;
a8401116	261	}
571ab37b	262
902621e2	263	wpa_hexdump(MSG_DEBUG, "Inject frame (encrypted)", crypt, crypt_len);
571ab37b JM	264	ret = inject_frame(wt->monitor_sock, crypt, crypt_len);
571ab37b JM	265	os_free(crypt);
a8401116	266	wpa_printf(MSG_DEBUG, "inject_frame for protected frame: %d", ret);
571ab37b JM	267
	268	return (ret < 0) ? -1 : 0;
	269	}
	270
	271
7d23e971 JM	272	int wlantest_inject(struct wlantest wt, struct wlantest_bss bss,
	273	struct wlantest_sta sta, u8 frame, size_t len,
	274	enum wlantest_inject_protection prot)
	275	{
	276	int ret;
571ab37b JM	277	struct ieee80211_hdr *hdr;
	278	u16 fc;
	279	int protectable, protect = 0;
7d23e971 JM	280
	281	wpa_hexdump(MSG_DEBUG, "Inject frame", frame, len);
	282	if (wt->monitor_sock < 0) {
	283	wpa_printf(MSG_INFO, "Cannot inject frames when monitor "
	284	"interface is not in use");
	285	return -1;
	286	}
	287
02b915f6 JM	288	if (prot != WLANTEST_INJECT_UNPROTECTED &&
	289	(bss == NULL \|\| sta == NULL)) {
	290	wpa_printf(MSG_INFO, "No BSS/STA information to inject "
	291	"protected frames");
	292	return -1;
	293	}
	294
571ab37b JM	295	hdr = (struct ieee80211_hdr *) frame;
	296	fc = le_to_host16(hdr->frame_control);
	297	protectable = WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA \|\|
	298	is_robust_mgmt(frame, len);
	299
02b915f6 JM	300	if ((prot == WLANTEST_INJECT_PROTECTED \|\|
02b915f6 JM	301	prot == WLANTEST_INJECT_INCORRECT_KEY) && bss) {
2e4c3469 JM	302	if (!sta &&
	303	((WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
	304	!bss->igtk_set[bss->igtk_idx]) \|\|
	305	(WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
	306	!bss->gtk_len[bss->gtk_idx]))) {
	307	wpa_printf(MSG_INFO, "No GTK/IGTK known for "
	308	MACSTR " to protect the injected "
	309	"frame", MAC2STR(bss->bssid));
571ab37b JM	310	return -1;
	311	}
	312	if (sta && !sta->ptk_set) {
	313	wpa_printf(MSG_INFO, "No PTK known for the STA " MACSTR
	314	" to encrypt the injected frame",
	315	MAC2STR(sta->addr));
	316	return -1;
	317	}
	318	protect = 1;
02b915f6	319	} else if (protectable && prot != WLANTEST_INJECT_UNPROTECTED && bss) {
571ab37b JM	320	if (sta && sta->ptk_set)
	321	protect = 1;
	322	else if (!sta) {
	323	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA &&
2e4c3469	324	bss->gtk_len[bss->gtk_idx])
571ab37b JM	325	protect = 1;
571ab37b JM	326	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
2e4c3469	327	bss->igtk_set[bss->igtk_idx])
571ab37b JM	328	protect = 1;
	329	}
	330	}
	331
02b915f6	332	if (protect && bss)
571ab37b JM	333	return wlantest_inject_prot(
	334	wt, bss, sta, frame, len,
	335	prot == WLANTEST_INJECT_INCORRECT_KEY);
7d23e971 JM	336
7d23e971 JM	337	ret = inject_frame(wt->monitor_sock, frame, len);
a8401116	338	wpa_printf(MSG_DEBUG, "inject_frame for unprotected frame: %d", ret);
7d23e971 JM	339	return (ret < 0) ? -1 : 0;
7d23e971 JM	340	}