aboutsummaryrefslogtreecommitdiffstats
path: root/wlantest/wep.c
diff options
context:
space:
mode:
authorJouni Malinen <jouni.malinen@atheros.com>2011-01-14 15:43:17 (GMT)
committerJouni Malinen <j@w1.fi>2011-01-14 15:43:17 (GMT)
commit2e479416d1bfa584eddf7d335cf969ea6fe1f89c (patch)
tree0ef076cbd4031ef46afe8e0eeff30062aaa19be7 /wlantest/wep.c
parent3558c41ee71ff0e34aca47412b33019630c8e922 (diff)
downloadhostap-2e479416d1bfa584eddf7d335cf969ea6fe1f89c.zip
hostap-2e479416d1bfa584eddf7d335cf969ea6fe1f89c.tar.gz
hostap-2e479416d1bfa584eddf7d335cf969ea6fe1f89c.tar.bz2
wlantest: Add support for decrypting WEP frames
Diffstat (limited to 'wlantest/wep.c')
-rw-r--r--wlantest/wep.c109
1 files changed, 109 insertions, 0 deletions
diff --git a/wlantest/wep.c b/wlantest/wep.c
new file mode 100644
index 0000000..13ff218
--- /dev/null
+++ b/wlantest/wep.c
@@ -0,0 +1,109 @@
+/*
+ * Wired Equivalent Privacy (WEP)
+ * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * Alternatively, this software may be distributed under the terms of BSD
+ * license.
+ *
+ * See README and COPYING for more details.
+ */
+
+#include "utils/includes.h"
+
+#include "utils/common.h"
+#include "common/ieee802_11_defs.h"
+#include "wlantest.h"
+
+
+void wep_crypt(u8 *key, u8 *buf, size_t plen)
+{
+ u32 i, j, k;
+ u8 S[256];
+#define S_SWAP(a,b) do { u8 t = S[a]; S[a] = S[b]; S[b] = t; } while(0)
+ u8 *pos;
+
+ /* Setup RC4 state */
+ for (i = 0; i < 256; i++)
+ S[i] = i;
+ j = 0;
+ for (i = 0; i < 256; i++) {
+ j = (j + S[i] + key[i & 0x0f]) & 0xff;
+ S_SWAP(i, j);
+ }
+
+ /* Apply RC4 to data */
+ pos = buf;
+ i = j = 0;
+ for (k = 0; k < plen; k++) {
+ i = (i + 1) & 0xff;
+ j = (j + S[i]) & 0xff;
+ S_SWAP(i, j);
+ *pos ^= S[(S[i] + S[j]) & 0xff];
+ pos++;
+ }
+}
+
+
+static int try_wep(const u8 *key, size_t key_len, const u8 *data,
+ size_t data_len, u8 *plain)
+{
+ u32 icv, rx_icv;
+ u8 k[16];
+ int i, j;
+
+ for (i = 0, j = 0; i < sizeof(k); i++) {
+ k[i] = key[j];
+ j++;
+ if (j >= key_len)
+ j = 0;
+ }
+
+ os_memcpy(plain, data, data_len);
+ wep_crypt(k, plain, data_len);
+ icv = crc32(plain, data_len - 4);
+ rx_icv = WPA_GET_LE32(plain + data_len - 4);
+ if (icv != rx_icv)
+ return -1;
+
+ return 0;
+}
+
+
+u8 * wep_decrypt(struct wlantest *wt, const struct ieee80211_hdr *hdr,
+ const u8 *data, size_t data_len, size_t *decrypted_len)
+{
+ u8 *plain;
+ struct wlantest_wep *w;
+ int found = 0;
+ u8 key[16];
+
+ if (dl_list_empty(&wt->wep))
+ return NULL;
+
+ if (data_len < 4 + 4)
+ return NULL;
+ plain = os_malloc(data_len - 4);
+ if (plain == NULL)
+ return NULL;
+
+ dl_list_for_each(w, &wt->wep, struct wlantest_wep, list) {
+ os_memcpy(key, data, 3);
+ os_memcpy(key + 3, w->key, w->key_len);
+ if (try_wep(key, 3 + w->key_len, data + 4, data_len - 4, plain)
+ == 0) {
+ found = 1;
+ break;
+ }
+ }
+ if (!found) {
+ os_free(plain);
+ return NULL;
+ }
+
+ *decrypted_len = data_len - 4 - 4;
+ return plain;
+}