nl80211: Use monitor interface for sending no-encrypt test frames

Since NL80211_CMD_FRAME does not allow encryption to be disabled for the
frame, add a monitor interface temporarily for cases where this type of
no-encrypt frames are to be sent. The temporary monitor interface is
removed immediately after sending the frame.

This is testing functionality (only in CONFIG_TESTING_OPTIONS=y builds)
that is used for PMF testing where the AP can use this to inject an
unprotected Robust Management frame (mainly, Deauthentication or
Disassociation frame) even in cases where PMF has been negotiated for
the association.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 967a24225974dd21c2285b80f1851805f4c3bb7b..e4bc44ffba22aab219b8f339a5dacc12c4da96b1 100644 (file)
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -3747,6 +3747,19 @@ static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
            WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_ACTION)
                use_cookie = 0;
 send_frame_cmd:
+#ifdef CONFIG_TESTING_OPTIONS
+       if (no_encrypt && !encrypt && !drv->use_monitor) {
+               wpa_printf(MSG_DEBUG,
+                          "nl80211: Request to send an unencrypted frame - use a monitor interface for this");
+               if (nl80211_create_monitor_interface(drv) < 0)
+                       return -1;
+               res = nl80211_send_monitor(drv, data, data_len, encrypt,
+                                          noack);
+               nl80211_remove_monitor_interface(drv);
+               return res;
+       }
+#endif /* CONFIG_TESTING_OPTIONS */
+
        wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame_cmd");
        res = nl80211_send_frame_cmd(bss, freq, wait_time, data, data_len,
                                     use_cookie, no_cck, noack, offchanok,

diff --git a/src/drivers/driver_nl80211_monitor.c b/src/drivers/driver_nl80211_monitor.c
index f25cd792464a0805fcb9202c6b5112f9a4cfb595..7ff55f149a618ee45428616765ff2183cb0ea5ad 100644 (file)
--- a/src/drivers/driver_nl80211_monitor.c
+++ b/src/drivers/driver_nl80211_monitor.c
@@ -71,6 +71,9 @@ static void handle_frame(struct wpa_driver_nl80211_data *drv,
        u16 fc;
        union wpa_event_data event;
 
+       if (!drv->use_monitor)
+               return;
+
        hdr = (struct ieee80211_hdr *) buf;
        fc = le_to_host16(hdr->frame_control);