From a5fd7ba7bab79996ed50a5c1d939272436446876 Mon Sep 17 00:00:00 2001
From: hackbard <hackbard>
Date: Mon, 18 Nov 2002 19:57:28 +0000
Subject: [PATCH] added snap supprt

---
 hdw-sniff.c | 72 ++++++++++++++++++++++++++++++++++++++++++-----------
 hdw-sniff.h |  8 +++++-
 2 files changed, 64 insertions(+), 16 deletions(-)

diff --git a/hdw-sniff.c b/hdw-sniff.c
index fc67686..f17c826 100644
--- a/hdw-sniff.c
+++ b/hdw-sniff.c
@@ -13,6 +13,8 @@
 #include <arpa/inet.h>
 #include <pcap.h>
 #include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
 #include <unistd.h>
 #include <sys/ioctl.h>
 
@@ -27,6 +29,9 @@
 
 #include "hdw-sniff.h" /* my functions */
 
+/* global variables */
+int file_fd=0;
+
 int main(int argc, char *argv[]) {
 
 	char pcap_error[PCAP_ERRBUF_SIZE];
@@ -35,7 +40,6 @@ int main(int argc, char *argv[]) {
 	fd_set pcap_fd_set;
 	struct timeval fd_set_tv;
 	char sys_call[30];
-	FILE *logfile;
 	struct info_struct my_info_struct;
 	
 	/* parse the arguments */
@@ -48,7 +52,7 @@ int main(int argc, char *argv[]) {
 		printf("no logfile specified, writing to stdout ...\n");
 	} 
 	else {
-		if((logfile=fopen(argv[3],"w"))!=NULL) {
+		if((file_fd=open(argv[3],O_RDWR))!=0) {
 			printf("writing to logfile %s ...\n",argv[3]);
 		}
 		else {
@@ -120,9 +124,10 @@ void pcap_process(u_char *info,const struct pcap_pkthdr *pcap_header,
 			const u_char *package) {
 	
 	/* local variables */
-	char tmp_buf[20];
+	char tmp_buf[20],crypted_snap[6];
 	struct linux_wlan_ng_prism_hdr *prism_hdr;
 	struct ieee802_11_hdr *w_hdr;
+	struct snaphdr *snap_hdr;
 	struct ethhdr *e_hdr;
 	struct iphdr *ip_hdr;
 	struct info_struct *my_info_struct;
@@ -193,7 +198,7 @@ void pcap_process(u_char *info,const struct pcap_pkthdr *pcap_header,
 		strcpy(tmp_buf,"deauthentification");
 	else strcpy(tmp_buf,"impossible situation \%) - go mail the author.");
 	}
-	else strcpy(tmp_buf,"control & monitor frame types not supported yet");
+	else strcpy(tmp_buf,"control & data frame type not supported yet");
 	/* print out frame type */
 	printf("=> %s\n",tmp_buf);
 	
@@ -204,20 +209,57 @@ void pcap_process(u_char *info,const struct pcap_pkthdr *pcap_header,
 	}
 
 	/* ieee802.3 */
+	/* we need smaller w_hdr for non distributed frames */
+	if((w_hdr->frame_ctl & (1<<8)) & (w_hdr->frame_ctl & (1<<9))) {
+		printf("=> distributed packet !!!!11\n");
+	} else w_o-=(sizeof(struct snaphdr)-sizeof(unsigned short));
+
 	/* ethernet */
 	if((strncmp(my_info_struct->dev,"eth",3)==0) | 
 		((w_hdr->frame_ctl & IEEE802_11_FTYPE_DATA)>0)) {
-	printf("ethernet: (%d bytes)\n",e_o);
-	e_hdr=(struct ethhdr *)(package+p_o+w_o);
-	/* what types ? */
-	printf("type = ");
-	printf("%x  ",ntohs(e_hdr->h_proto));
-	printf("dest_addr = ");
-	for(i=0;i<ETH_ALEN;i++)
-	printf("%x%s",*(e_hdr->h_dest+i),((i==ETH_ALEN-1)?" ":":"));
-	printf(" src_addr = ");
-	for(i=0;i<ETH_ALEN;i++)
-	printf("%x%s",*(e_hdr->h_source+i),((i==ETH_ALEN-1)?"\n":":"));
+
+	if(!(w_hdr->frame_ctl & IEEE802_11_FTYPE_DATA)) {
+		printf("ethernet: (%d bytes)\n",e_o);
+		e_hdr=(struct ethhdr *)(package+p_o+w_o);
+		/* what types ? */
+		printf("type = ");
+		printf("%x  ",ntohs(e_hdr->h_proto));
+		printf("dest_addr = ");
+		for(i=0;i<ETH_ALEN;i++)
+		printf("%x%s",*(e_hdr->h_dest+i),((i==ETH_ALEN-1)?" ":":"));
+		printf(" src_addr = ");
+		for(i=0;i<ETH_ALEN;i++) printf("%x%s",*(e_hdr->h_source+i),
+						((i==ETH_ALEN-1)?"\n":":"));
+	} 
+	else {
+		snap_hdr=(struct snaphdr *)(package+p_o+w_o);
+		if(snap_hdr->snap[0]==0xaa &
+		   snap_hdr->snap[1]==0xaa &
+		   snap_hdr->snap[2]==0x03 &
+		   snap_hdr->snap[3]==0x00 &
+		   snap_hdr->snap[4]==0x00 &
+		   snap_hdr->snap[5]==0x00) {
+			printf("- no encryption!\n");
+			if(snap_hdr->proto==ntohs(ETH_P_IP)) {
+				/* we want ip header to get parsed */
+				e_hdr->h_proto=htons(ETH_P_IP);
+				e_o=sizeof(struct snaphdr);
+			}
+		}
+		else {
+			printf("- crypted packet!\n");
+			/* print crypted snap - write into file */
+			printf("snap: (aa aa 03 00 00 00) ");
+			for(i=0;i<6;i++) {
+				printf("%x ",snap_hdr->snap[i]);
+				if(file_fd>0) write(file_fd,snap_hdr->snap+i,1);
+			}
+			printf("\n");
+			// write(file_fd,'\n',1);
+			/* dont look at ipheader */
+			e_hdr->h_proto=htons(0);
+		}
+	}
 
 		/* IP ? */
 	if(ntohs(e_hdr->h_proto)==ETH_P_IP) {
diff --git a/hdw-sniff.h b/hdw-sniff.h
index fbea5d5..6dc06b9 100644
--- a/hdw-sniff.h
+++ b/hdw-sniff.h
@@ -4,13 +4,19 @@
 void pcap_process(u_char *count,const struct pcap_pkthdr *pcap_header,
 			const u_char *package);
 
+/* snap header struct */
+struct snaphdr {
+		unsigned char snap[6];	/* the six magic snap chars */
+		unsigned short proto;	/* protocol type */
+} __attribute__ ((packed));
+
 /* info struct */
 struct info_struct {
                 int count;      /* count packages */
                 char dev[10];   /* device */
                 char mmode;     /* monitor type ... and later more */
 		int channel;	/* current freq channel */
-        };
+};
 
 /* hop_chanel function */
 int hop_channel(struct info_struct *info,int foo_fd);
-- 
2.20.1