dot11decrypt_system.h

Go to the documentation of this file.

 
#ifndef _DOT11DECRYPT_SYSTEM_H
#define _DOT11DECRYPT_SYSTEM_H
 
/************************************************************************/
/*  Constant definitions                        */
 
/*  General definitions                     */
#define DOT11DECRYPT_RET_SUCCESS                      0
#define DOT11DECRYPT_RET_UNSUCCESS                    1
 
#define DOT11DECRYPT_RET_NO_DATA                  1
#define DOT11DECRYPT_RET_WRONG_DATA_SIZE              2
#define DOT11DECRYPT_RET_REQ_DATA                 3
#define DOT11DECRYPT_RET_NO_VALID_HANDSHAKE           4
#define DOT11DECRYPT_RET_NO_DATA_ENCRYPTED            5
 
#define DOT11DECRYPT_RET_SUCCESS_HANDSHAKE       -1
 
#define DOT11DECRYPT_MAX_KEYS_NR                 64
 
/*  Decryption algorithms fields size definition (bytes)        */
#define DOT11DECRYPT_WPA_NONCE_LEN               32
#define DOT11DECRYPT_WPA_PTK_MAX_LEN             96 /* TKIP 48, AKM 18/24/25 96 */
#define DOT11DECRYPT_WPA_MICKEY_MAX_LEN          32
 
#define DOT11DECRYPT_WEP_128_KEY_LEN             16 /* 128 bits */
 
/* General 802.11 constants                     */
#define DOT11DECRYPT_MAC_LEN               6
#define DOT11DECRYPT_RADIOTAP_HEADER_LEN              24
 
#define DOT11DECRYPT_EAPOL_MAX_LEN          1024U
 
#define DOT11DECRYPT_TK_LEN                           16
 
/* Max length of capture data                       */
#define DOT11DECRYPT_MAX_CAPLEN         (12 * 1024)
 
#define DOT11DECRYPT_WEP_IVLEN  3       /* 24bit */
#define DOT11DECRYPT_WEP_KIDLEN 1       /* 1 octet */
#define DOT11DECRYPT_WEP_ICV    4
#define DOT11DECRYPT_WEP_HEADER DOT11DECRYPT_WEP_IVLEN + DOT11DECRYPT_WEP_KIDLEN
#define DOT11DECRYPT_WEP_TRAILER    DOT11DECRYPT_WEP_ICV
 
/*
 * 802.11i defines an extended IV for use with non-WEP ciphers.
 * When the EXTIV bit is set in the key id byte an additional
 * 4 bytes immediately follow the IV for TKIP.  For CCMP the
 * EXTIV bit is likewise set but the 8 bytes represent the
 * CCMP header rather than IV+extended-IV.
 */
#define DOT11DECRYPT_RSNA_EXTIV 0x20
#define DOT11DECRYPT_RSNA_EXTIVLEN  4       /* extended IV length */
#define DOT11DECRYPT_TKIP_MICLEN    8       /* trailing MIC */
 
#define DOT11DECRYPT_RSNA_HEADER    DOT11DECRYPT_WEP_HEADER + DOT11DECRYPT_RSNA_EXTIVLEN
 
#define DOT11DECRYPT_CCMP_HEADER        DOT11DECRYPT_RSNA_HEADER
#define DOT11DECRYPT_CCMP_TRAILER       8   /* IEEE 802.11-2016 12.5.3.2 CCMP MPDU format */
#define DOT11DECRYPT_CCMP_256_TRAILER   16  /* IEEE 802.11-2016 12.5.3.2 CCMP MPDU format */
 
#define DOT11DECRYPT_GCMP_HEADER        8   /* IEEE 802.11-206 12.5.5.2 GCMP MPDU format */
#define DOT11DECRYPT_GCMP_TRAILER       16
 
#define DOT11DECRYPT_TKIP_HEADER    DOT11DECRYPT_RSNA_HEADER
#define DOT11DECRYPT_TKIP_TRAILER   DOT11DECRYPT_TKIP_MICLEN + DOT11DECRYPT_WEP_ICV
 
#define DOT11DECRYPT_RSNA_MIN_TRAILER 8
 
#define DOT11DECRYPT_MAX_MLO_LINKS 3 // Is there actually any device supporting this many links?
 
/************************************************************************/
/*      File includes                                                   */
 
#include <stdint.h>
#include <stdbool.h>
 
#include "dot11decrypt_user.h"
#include "ws_symbol_export.h"
 
/************************************************************************/
/*  Macro definitions                       */
 
/************************************************************************/
/*  Type definitions                        */
 
typedef struct _DOT11DECRYPT_SEC_ASSOCIATION_ID {
    unsigned char bssid[DOT11DECRYPT_MAC_LEN];
    unsigned char sta[DOT11DECRYPT_MAC_LEN];
} DOT11DECRYPT_SEC_ASSOCIATION_ID, *PDOT11DECRYPT_SEC_ASSOCIATION_ID;
 
typedef struct _DOT11DECRYPT_SEC_ASSOCIATION {
    /* This is for reassociations. A linked list of old security
     * associations is kept.  GCS
     */
    struct _DOT11DECRYPT_SEC_ASSOCIATION* next;
 
    DOT11DECRYPT_SEC_ASSOCIATION_ID saId;
    DOT11DECRYPT_KEY_ITEM *key;
    uint8_t handshake;
    uint8_t validKey;
 
    struct {
        uint8_t key_ver;        /* Key descriptor version   */
        unsigned char nonce[DOT11DECRYPT_WPA_NONCE_LEN];
        /* used to derive PTK, ANonce stored, SNonce taken  */
        /* the 2nd packet of the 4W handshake           */
        int akm;
        int cipher;
        int tmp_group_cipher; /* Keep between HS msg 2 and 3 */
        int pmk_len;
        unsigned char ptk[DOT11DECRYPT_WPA_PTK_MAX_LEN]; /* session key used in decryption algorithm */
        int ptk_len;
 
        /* MLD info */
        uint8_t mld : 1; /* 1 if both STA and AP MLD MAC set */
        uint8_t ap_mld_mac_set : 1;
        uint8_t sta_mld_mac_set : 1;
        uint8_t ap_mld_mac[DOT11DECRYPT_MAC_LEN];
        uint8_t sta_mld_mac[DOT11DECRYPT_MAC_LEN];
        struct DOT11DECRYPT_MLO_LINK_INFO {
                uint8_t id_set : 1;
                uint8_t sta_mac_set : 1;
                uint8_t ap_mac_set : 1;
            uint8_t id : 4;
            uint8_t sta_mac[DOT11DECRYPT_MAC_LEN];
            uint8_t ap_mac[DOT11DECRYPT_MAC_LEN];
        } mlo_links[DOT11DECRYPT_MAX_MLO_LINKS];
    } wpa;
 
 
} DOT11DECRYPT_SEC_ASSOCIATION, *PDOT11DECRYPT_SEC_ASSOCIATION;
 
typedef struct _DOT11DECRYPT_CONTEXT {
    GHashTable *sa_hash;
    DOT11DECRYPT_KEY_ITEM keys[DOT11DECRYPT_MAX_KEYS_NR];
    size_t keys_nr;
    uint8_t pkt_ssid[DOT11DECRYPT_WPA_SSID_MAX_LEN];
    size_t pkt_ssid_len;
} DOT11DECRYPT_CONTEXT, *PDOT11DECRYPT_CONTEXT;
 
typedef enum _DOT11DECRYPT_HS_MSG_TYPE {
    DOT11DECRYPT_HS_MSG_TYPE_INVALID = 0,
    DOT11DECRYPT_HS_MSG_TYPE_4WHS_1,
    DOT11DECRYPT_HS_MSG_TYPE_4WHS_2,
    DOT11DECRYPT_HS_MSG_TYPE_4WHS_3,
    DOT11DECRYPT_HS_MSG_TYPE_4WHS_4,
    DOT11DECRYPT_HS_MSG_TYPE_GHS_1,
    DOT11DECRYPT_HS_MSG_TYPE_GHS_2
} DOT11DECRYPT_HS_MSG_TYPE;
 
typedef struct _DOT11DECRYPT_FTE {
    uint8_t *mic;
    uint8_t mic_len;
    uint8_t *anonce;
    uint8_t *snonce;
    uint8_t *r0kh_id;
    uint8_t r0kh_id_len;
    uint8_t *r1kh_id;
    uint8_t r1kh_id_len;
} DOT11DECRYPT_FTE, *PDOT11DECRYPT_FTE;
 
typedef struct _DOT11DECRYPT_EAPOL_PARSED {
    DOT11DECRYPT_HS_MSG_TYPE msg_type;
    uint16_t len;
    uint8_t key_type;
    uint8_t key_version;
    uint16_t key_len;
    uint8_t *key_iv;
    uint8_t *key_data;
    uint16_t key_data_len;
    uint8_t group_cipher;
    uint8_t cipher;
    uint8_t akm;
    uint8_t *nonce;
    uint8_t *mic;
    uint16_t mic_len;
    uint8_t *gtk;
    uint16_t gtk_len;
    uint8_t *mld_mac;
 
    uint8_t mlo_link_count;
    struct DOT11DECRYPT_EAPOL_PARSED_MLO_LINK {
        uint8_t id;
        uint8_t *mac;
    } mlo_link[DOT11DECRYPT_MAX_MLO_LINKS];
 
    uint8_t mlo_gtk_count;
    struct DOT11DECRYPT_EAPOL_PARSED_MLO_GTK {
        uint8_t link_id;
        uint8_t *key;
        uint8_t len;
    } mlo_gtk[DOT11DECRYPT_MAX_MLO_LINKS];
 
    /* For fast bss transition akms */
    uint8_t *mdid;
    DOT11DECRYPT_FTE fte;
} DOT11DECRYPT_EAPOL_PARSED, *PDOT11DECRYPT_EAPOL_PARSED;
 
typedef struct _DOT11DECRYPT_ASSOC_PARSED
{
    uint8_t frame_subtype;
    uint8_t group_cipher;
    uint8_t cipher;
    uint8_t akm;
    uint8_t *mdid;
    DOT11DECRYPT_FTE fte;
    uint8_t* rsne_tag;
    uint8_t* rsnxe_tag;
    uint8_t* mde_tag;
    uint8_t* fte_tag;
    uint8_t* rde_tag;
    uint8_t *gtk;
    uint16_t gtk_len;
    uint16_t gtk_subelem_key_len;
    uint8_t bssid[DOT11DECRYPT_MAC_LEN];
    uint8_t sa[DOT11DECRYPT_MAC_LEN];
    uint8_t da[DOT11DECRYPT_MAC_LEN];
} DOT11DECRYPT_ASSOC_PARSED, *PDOT11DECRYPT_ASSOC_PARSED;
 
/************************************************************************/
/*  Function prototype declarations                 */
 
#ifdef  __cplusplus
extern "C" {
#endif
 
extern int Dot11DecryptDecryptPacket(
    PDOT11DECRYPT_CONTEXT ctx,
    const uint8_t *data,
    const unsigned data_off,
    const unsigned data_len,
    unsigned char *decrypt_data,
    uint32_t *decrypt_len,
    PDOT11DECRYPT_KEY_ITEM key)
    ;
 
extern int
Dot11DecryptDecryptKeyData(PDOT11DECRYPT_CONTEXT ctx,
                           PDOT11DECRYPT_EAPOL_PARSED eapol_parsed,
                           const unsigned char bssid[DOT11DECRYPT_MAC_LEN],
                           const unsigned char sta[DOT11DECRYPT_MAC_LEN],
                           unsigned char *decrypted_data, unsigned *decrypted_len,
                           PDOT11DECRYPT_KEY_ITEM key)
    ;
 
extern int Dot11DecryptScanEapolForKeys(
    PDOT11DECRYPT_CONTEXT ctx,
    PDOT11DECRYPT_EAPOL_PARSED eapol_parsed,
    const uint8_t *eapol_raw,
    const unsigned tot_len,
    const unsigned char bssid[DOT11DECRYPT_MAC_LEN],
    const unsigned char sta[DOT11DECRYPT_MAC_LEN])
    ;
 
int
Dot11DecryptScanFtAssocForKeys(
    const PDOT11DECRYPT_CONTEXT ctx,
    const PDOT11DECRYPT_ASSOC_PARSED assoc_parsed,
    uint8_t *decrypted_gtk, size_t *decrypted_len,
    DOT11DECRYPT_KEY_ITEM* used_key);
 
extern int Dot11DecryptScanTdlsForKeys(
    PDOT11DECRYPT_CONTEXT ctx,
    const uint8_t *data,
    const unsigned tot_len)
    ;
 
int
Dot11DecryptGetKCK(const PDOT11DECRYPT_KEY_ITEM key, const uint8_t **kck);
 
int
Dot11DecryptGetKEK(const PDOT11DECRYPT_KEY_ITEM key, const uint8_t **kek);
 
int
Dot11DecryptGetTK(const PDOT11DECRYPT_KEY_ITEM key, const uint8_t **tk);
 
int
Dot11DecryptGetGTK(const PDOT11DECRYPT_KEY_ITEM key, const uint8_t **gtk);
 
extern int Dot11DecryptSetKeys(
    PDOT11DECRYPT_CONTEXT ctx,
    DOT11DECRYPT_KEY_ITEM keys[],
    const size_t keys_nr)
    ;
 
int Dot11DecryptSetLastSSID(
        PDOT11DECRYPT_CONTEXT ctx,
        char *pkt_ssid,
        size_t pkt_ssid_len)
    ;
 
WS_DLL_PUBLIC
int Dot11DecryptInitContext(
        PDOT11DECRYPT_CONTEXT ctx)
    ;
 
WS_DLL_PUBLIC
int Dot11DecryptDestroyContext(
    PDOT11DECRYPT_CONTEXT ctx)
    ;
 
#ifdef  __cplusplus
}
#endif
 
#endif /* _DOT11DECRYPT_SYSTEM_H */