wm_oneshot_esp.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502
  1. #include "wm_oneshot_esp.h"
  2. #define ESP_GUIDE_DATUM 512
  3. #define ESP_DATA_OFFSET 40
  4. #define ESP_CRC_POLYNOM 0x8C
  5. #define ESP_CRC_INITIAL 0x00
  6. struct esp_data_t{
  7. u8 data;
  8. u8 used;
  9. };
  10. esp_printf_fn esp_printf = NULL;
  11. static u8 *esp_scan_bss;
  12. const u8 esp_dst_addr[3] = {0x01,0x00,0x5e};
  13. u8 esp_last_num[2] = {0,0};
  14. u16 esp_head[2][4] = {{0,0,0,0},{0,0,0,0}};
  15. u16 esp_byte[2][3] = {{0,0,0},{0,0,0}};
  16. u8 esp_state = 0;
  17. u16 esp_data_datum = 0;
  18. u8 esp_head_cnt[2] = {0,0};
  19. u8 esp_byte_cnt[2] = {0,0};
  20. u8 esp_sync_cnt = 0;
  21. u8 esp_src_mac[6] = {0};
  22. // u8 esp_crc_table[256];
  23. u8 esp_crc_value = 0;
  24. u8 esp_data_cnt = 0;
  25. u16 esp_last_seq[2] = {0,0};
  26. u16 esp_last_len = 0;
  27. u8 esp_temp_lock = 0;
  28. struct esp_data_t esp_data[120];
  29. struct esp_param_t esp_param;
  30. extern u8 gucssidData[];
  31. extern u8 gucpwdData[];
  32. const u8 esp_crc_table[] = {
  33. 0x00,0x5E,0xBC,0xE2,0x61,0x3F,0xDD,0x83,
  34. 0xC2,0x9C,0x7E,0x20,0xA3,0xFD,0x1F,0x41,
  35. 0x9D,0xC3,0x21,0x7F,0xFC,0xA2,0x40,0x1E,
  36. 0x5F,0x01,0xE3,0xBD,0x3E,0x60,0x82,0xDC,
  37. 0x23,0x7D,0x9F,0xC1,0x42,0x1C,0xFE,0xA0,
  38. 0xE1,0xBF,0x5D,0x03,0x80,0xDE,0x3C,0x62,
  39. 0xBE,0xE0,0x02,0x5C,0xDF,0x81,0x63,0x3D,
  40. 0x7C,0x22,0xC0,0x9E,0x1D,0x43,0xA1,0xFF,
  41. 0x46,0x18,0xFA,0xA4,0x27,0x79,0x9B,0xC5,
  42. 0x84,0xDA,0x38,0x66,0xE5,0xBB,0x59,0x07,
  43. 0xDB,0x85,0x67,0x39,0xBA,0xE4,0x06,0x58,
  44. 0x19,0x47,0xA5,0xFB,0x78,0x26,0xC4,0x9A,
  45. 0x65,0x3B,0xD9,0x87,0x04,0x5A,0xB8,0xE6,
  46. 0xA7,0xF9,0x1B,0x45,0xC6,0x98,0x7A,0x24,
  47. 0xF8,0xA6,0x44,0x1A,0x99,0xC7,0x25,0x7B,
  48. 0x3A,0x64,0x86,0xD8,0x5B,0x05,0xE7,0xB9,
  49. 0x8C,0xD2,0x30,0x6E,0xED,0xB3,0x51,0x0F,
  50. 0x4E,0x10,0xF2,0xAC,0x2F,0x71,0x93,0xCD,
  51. 0x11,0x4F,0xAD,0xF3,0x70,0x2E,0xCC,0x92,
  52. 0xD3,0x8D,0x6F,0x31,0xB2,0xEC,0x0E,0x50,
  53. 0xAF,0xF1,0x13,0x4D,0xCE,0x90,0x72,0x2C,
  54. 0x6D,0x33,0xD1,0x8F,0x0C,0x52,0xB0,0xEE,
  55. 0x32,0x6C,0x8E,0xD0,0x53,0x0D,0xEF,0xB1,
  56. 0xF0,0xAE,0x4C,0x12,0x91,0xCF,0x2D,0x73,
  57. 0xCA,0x94,0x76,0x28,0xAB,0xF5,0x17,0x49,
  58. 0x08,0x56,0xB4,0xEA,0x69,0x37,0xD5,0x8B,
  59. 0x57,0x09,0xEB,0xB5,0x36,0x68,0x8A,0xD4,
  60. 0x95,0xCB,0x29,0x77,0xF4,0xAA,0x48,0x16,
  61. 0xE9,0xB7,0x55,0x0B,0x88,0xD6,0x34,0x6A,
  62. 0x2B,0x75,0x97,0xC9,0x4A,0x14,0xF6,0xA8,
  63. 0x74,0x2A,0xC8,0x96,0x15,0x4B,0xA9,0xF7,
  64. 0xB6,0xE8,0x0A,0x54,0xD7,0x89,0x6B,0x35,
  65. };
  66. #if 0
  67. void esp_crc8_table_init(void)
  68. {
  69. int i;
  70. u8 bit;
  71. u8 remainder;
  72. for(i=0; i<256; i++)
  73. {
  74. remainder = i;
  75. for(bit=0; bit<8; bit++)
  76. {
  77. if((remainder&0x01) != 0)
  78. remainder = (remainder >> 1) ^ ESP_CRC_POLYNOM;
  79. else
  80. remainder >>= 1;
  81. }
  82. esp_crc_table[i] = remainder;
  83. }
  84. }
  85. #endif
  86. void esp_crc8_init(void)
  87. {
  88. esp_crc_value = ESP_CRC_INITIAL;
  89. }
  90. void esp_crc8_update(u8 data)
  91. {
  92. u8 val;
  93. val = data ^ esp_crc_value;
  94. esp_crc_value = esp_crc_table[val] ^ (esp_crc_value<<8);
  95. }
  96. u8 esp_crc8_get(void)
  97. {
  98. return esp_crc_value;
  99. }
  100. u8 esp_crc8_calc(u8 *buf, u16 len)
  101. {
  102. u16 i;
  103. esp_crc8_init();
  104. for(i=0; i<len; i++)
  105. {
  106. esp_crc8_update(buf[i]);
  107. }
  108. return esp_crc8_get();
  109. }
  110. static int esp_ssid_bssid_crc_match(u8 ssidCrc, u8 bssidCrc, u8 ssidLen, u8 *ssid, u8 *bssid)
  111. {
  112. struct tls_scan_bss_t *bss = NULL;
  113. int i = 0;
  114. bss = (struct tls_scan_bss_t *)esp_scan_bss;
  115. if(bss == NULL)
  116. {
  117. return -1;
  118. }
  119. for (i = 0; i < bss->count; i++)
  120. {
  121. if ((ssidCrc == esp_crc8_calc(bss->bss[i].ssid, bss->bss[i].ssid_len)) && (ssidLen == bss->bss[i].ssid_len)
  122. && (bssidCrc == esp_crc8_calc(bss->bss[i].bssid, 6)))
  123. {
  124. memcpy(ssid, bss->bss[i].ssid, bss->bss[i].ssid_len);
  125. memcpy(bssid, bss->bss[i].bssid, 6);
  126. return 0;
  127. }
  128. }
  129. return -1;
  130. }
  131. int tls_esp_recv(u8 *buf, u16 data_len)
  132. {
  133. struct ieee80211_hdr *hdr = (struct ieee80211_hdr*)buf;
  134. u8 *multicast = NULL;
  135. u8 *SrcMac = NULL;
  136. u8 crc, num, data;
  137. u16 i;
  138. u8 totalXor, totalLen, apPwdLen, apSsidCrc, apSsidLen, apBssidCrc;
  139. int ret;
  140. u16 frm_len;
  141. u16 guide_len;
  142. u8 tods = 0;
  143. multicast = ieee80211_get_DA(hdr);
  144. if(hdr->duration_id & 0x02) //normal mode stbc不处理
  145. {
  146. return ESP_ONESHOT_CONTINUE;
  147. }
  148. if (ieee80211_is_data_qos(hdr->frame_control))
  149. {
  150. frm_len = data_len - 2;
  151. }
  152. else
  153. {
  154. frm_len = data_len;
  155. }
  156. tods = ieee80211_has_tods(hdr->frame_control);
  157. SrcMac = ieee80211_get_SA(hdr);
  158. if(memcmp(multicast, esp_dst_addr, 3) && (0 == is_broadcast_ether_addr(multicast)))
  159. {
  160. return ESP_ONESHOT_CONTINUE;
  161. }
  162. switch(esp_state)
  163. {
  164. case 0:
  165. if(frm_len < 512)
  166. {
  167. return ESP_ONESHOT_CONTINUE;
  168. }
  169. if(is_zero_ether_addr(esp_src_mac))
  170. {
  171. memcpy(esp_src_mac, SrcMac, 6);
  172. esp_head_cnt[0] = esp_head_cnt[1] = 0;
  173. esp_sync_cnt = 0;
  174. esp_temp_lock = 0;
  175. esp_last_seq[0] = esp_last_seq[1] = 0;
  176. memset(esp_head, 0, sizeof(esp_head));
  177. }
  178. else
  179. {
  180. if(memcmp(esp_src_mac, SrcMac, 6))
  181. {
  182. memcpy(esp_src_mac, SrcMac, 6);
  183. esp_head_cnt[0] = esp_head_cnt[1] = 0;
  184. esp_sync_cnt = 0;
  185. esp_temp_lock = 0;
  186. esp_last_seq[0] = esp_last_seq[1] = 0;
  187. memset(esp_head, 0, sizeof(esp_head));
  188. }else{
  189. if(esp_printf)
  190. esp_printf("tods:%d,%d,"MACSTR"\n", tods, frm_len, MAC2STR(SrcMac));
  191. }
  192. }
  193. if (ieee80211_has_retry(hdr->frame_control) && (esp_last_seq[tods] == hdr->seq_ctrl))
  194. {
  195. return ESP_ONESHOT_CONTINUE;
  196. }
  197. esp_last_seq[tods] = hdr->seq_ctrl;
  198. esp_head[tods][esp_head_cnt[tods]] = frm_len;
  199. if(esp_head_cnt[tods] > 0)
  200. {
  201. if(((esp_head[tods][esp_head_cnt[tods]]+1) != esp_head[tods][esp_head_cnt[tods]-1])
  202. && ((esp_head[tods][esp_head_cnt[tods]]-3) != esp_head[tods][esp_head_cnt[tods]-1]))
  203. {
  204. esp_temp_lock = 0;
  205. esp_head_cnt[tods] = 0;
  206. esp_head[tods][0] = frm_len;
  207. }else{
  208. esp_temp_lock = 1;
  209. }
  210. }
  211. esp_head_cnt[tods] ++;
  212. if(esp_head_cnt[tods] >= 4)
  213. {
  214. esp_sync_cnt ++;
  215. esp_head_cnt[tods] = 0;
  216. }
  217. if(esp_sync_cnt >= 1)
  218. {
  219. guide_len = esp_head[tods][0];
  220. for(i=1; i<=3; i++)
  221. {
  222. if(guide_len > esp_head[tods][i])
  223. guide_len = esp_head[tods][i]; //取出同步头中最小值
  224. }
  225. esp_state = 1; //同步完成, 锁定源MAC和信道
  226. esp_data_datum = guide_len - ESP_GUIDE_DATUM + ESP_DATA_OFFSET; //获取到基准长度
  227. if(esp_printf)
  228. esp_printf("esp lock:%d\n", esp_data_datum);
  229. return ESP_ONESHOT_CHAN_LOCKED;
  230. }
  231. if(esp_temp_lock == 1)
  232. {
  233. return ESP_ONESHOT_CHAN_TEMP_LOCKED;
  234. }
  235. break;
  236. case 1:
  237. if((frm_len >= 512) || (frm_len < esp_data_datum))
  238. {
  239. return ESP_ONESHOT_CONTINUE;
  240. }
  241. if(memcmp(esp_src_mac, SrcMac, 6))
  242. {
  243. return ESP_ONESHOT_CONTINUE;
  244. }
  245. if (ieee80211_has_retry(hdr->frame_control) && (esp_last_seq[tods] == hdr->seq_ctrl))
  246. {
  247. return ESP_ONESHOT_CONTINUE;
  248. }
  249. esp_last_seq[tods] = hdr->seq_ctrl;
  250. if(esp_last_num[tods] != multicast[5])
  251. {
  252. memset((u8 *)&esp_byte[tods][0], 0, 3);
  253. esp_byte_cnt[tods] = 0;
  254. esp_last_num[tods] = multicast[5];
  255. }
  256. esp_byte[tods][esp_byte_cnt[tods]] = frm_len - esp_data_datum;
  257. if((esp_byte_cnt[tods]==0) && (esp_byte[tods][0]>=256))
  258. {
  259. esp_byte_cnt[tods] = 0;
  260. }
  261. else if((esp_byte_cnt[tods]==1) && (esp_byte[tods][1]<256))
  262. {
  263. esp_byte[tods][0] = frm_len - esp_data_datum;
  264. esp_byte_cnt[tods] = 1;
  265. }
  266. else if((esp_byte_cnt[tods]==2) && (esp_byte[tods][2]>=256))
  267. {
  268. esp_byte_cnt[tods] = 0;
  269. }
  270. else
  271. {
  272. esp_byte_cnt[tods] ++;
  273. }
  274. if(esp_byte_cnt[tods] >= 3)
  275. {
  276. crc = (esp_byte[tods][0]&0xF0) + ((esp_byte[tods][2]&0xF0)>>4);
  277. num = esp_byte[tods][1]&0xFF;
  278. data = ((esp_byte[tods][0]&0x0F)<<4) + (esp_byte[tods][2]&0x0F);
  279. if(esp_data[num].used == 0)
  280. {
  281. esp_crc8_init();
  282. esp_crc8_update(data);
  283. esp_crc8_update(num);
  284. if(crc == esp_crc8_get())
  285. {
  286. if(esp_printf)
  287. esp_printf("%d\n", num);
  288. esp_data[num].data = data;
  289. esp_data[num].used = 1;
  290. esp_data_cnt ++;
  291. }
  292. }
  293. esp_byte_cnt[tods] = 0;
  294. }
  295. if(esp_data[0].used)
  296. {
  297. if(esp_data_cnt >= esp_data[0].data + 6) //计算异或校验,CRC校验等
  298. {
  299. if(esp_printf)
  300. esp_printf("here1\n");
  301. totalLen = esp_data[0].data;
  302. totalXor = 0;
  303. for(i=0; i<totalLen; i++)
  304. {
  305. totalXor ^= esp_data[i].data;
  306. }
  307. if(totalXor != 0) //异或校验错误
  308. {
  309. if(esp_printf)
  310. esp_printf("totalXor err\n");
  311. memset((u8 *)&esp_data, 0, sizeof(esp_data));
  312. return ESP_ONESHOT_CONTINUE;
  313. }
  314. apPwdLen = esp_data[1].data;
  315. apSsidCrc = esp_data[2].data;
  316. apBssidCrc = esp_data[3].data;
  317. apSsidLen = totalLen - 9 - apPwdLen;
  318. esp_crc8_init();
  319. for(i=0; i<apSsidLen; i++)
  320. {
  321. esp_crc8_update(esp_data[9+apPwdLen+i].data);
  322. esp_param.ssid[i] = esp_data[9+apPwdLen+i].data;
  323. }
  324. if(apSsidCrc != esp_crc8_get())
  325. {
  326. if(esp_printf)
  327. esp_printf("apSsidCrc err\n");
  328. memset((u8 *)&esp_data, 0, sizeof(esp_data));
  329. return ESP_ONESHOT_CONTINUE;
  330. }
  331. esp_param.ssid_len = apSsidLen;
  332. esp_param.pwd_len = apPwdLen;
  333. esp_param.total_len = totalLen;
  334. for(i=0; i<apPwdLen; i++)
  335. {
  336. esp_param.pwd[i] = esp_data[9+i].data;
  337. }
  338. for(i=0; i<4; i++)
  339. {
  340. esp_param.ip[i] = esp_data[5+i].data;
  341. }
  342. esp_crc8_init();
  343. for(i=0; i<6; i++)
  344. {
  345. esp_crc8_update(esp_data[totalLen+i].data);
  346. esp_param.bssid[i] = esp_data[totalLen+i].data;
  347. }
  348. if(apBssidCrc != esp_crc8_get())
  349. {
  350. if(esp_printf)
  351. esp_printf("apBssidCrc err\n");
  352. memset(esp_param.bssid, 0, 6);
  353. }
  354. return ESP_ONESHOT_COMPLETE;
  355. }
  356. else
  357. {
  358. if(esp_data[1].used && esp_data[2].used && esp_data[3].used && esp_data[4].used)
  359. {
  360. for(i=0; i<4; i++)
  361. {
  362. if(esp_data[5+i].used)
  363. {
  364. esp_param.ip[i] = esp_data[5+i].data;
  365. }
  366. else
  367. {
  368. break;
  369. }
  370. }
  371. if(i != 4)
  372. {
  373. return ESP_ONESHOT_CONTINUE;
  374. }
  375. totalLen = esp_data[0].data;
  376. apPwdLen = esp_data[1].data;
  377. apSsidCrc = esp_data[2].data;
  378. apBssidCrc = esp_data[3].data;
  379. apSsidLen = totalLen - 9 - apPwdLen;
  380. for(i=0; i<apPwdLen; i++)
  381. {
  382. if(esp_data[9+i].used)
  383. {
  384. esp_param.pwd[i] = esp_data[9+i].data;
  385. }
  386. else
  387. {
  388. break;
  389. }
  390. }
  391. if(i == apPwdLen)
  392. {
  393. if(esp_printf)
  394. esp_printf("here2\n");
  395. ret = esp_ssid_bssid_crc_match(apSsidCrc, apBssidCrc, apSsidLen, esp_param.ssid, esp_param.bssid);
  396. if(ret == 0)
  397. {
  398. if(esp_printf)
  399. esp_printf("esp_ssid_bssid_crc_match sucess\n");
  400. totalXor = 0;
  401. for(i=0; i<totalLen-apSsidLen; i++)
  402. {
  403. totalXor ^= esp_data[i].data;
  404. }
  405. for(i=0; i<apSsidLen; i++)
  406. {
  407. totalXor ^= esp_param.ssid[i];
  408. }
  409. if(totalXor != 0) //异或校验错误
  410. {
  411. if(esp_printf)
  412. esp_printf("totalXor err\n");
  413. memset((u8 *)&esp_data, 0, sizeof(esp_data));
  414. return ESP_ONESHOT_CONTINUE;
  415. }
  416. if(esp_printf)
  417. esp_printf("esp totalXor sucess\n");
  418. esp_param.ssid_len = apSsidLen;
  419. esp_param.pwd_len = apPwdLen;
  420. esp_param.total_len = totalLen;
  421. return ESP_ONESHOT_COMPLETE;
  422. }
  423. }
  424. }
  425. }
  426. }
  427. break;
  428. }
  429. return ESP_ONESHOT_CONTINUE;
  430. }
  431. void tls_esp_init(u8 *scanBss)
  432. {
  433. // esp_crc8_table_init();
  434. memset((u8 *)&esp_data[0], 0, sizeof(esp_data));
  435. memset(esp_head, 0, sizeof(esp_head));
  436. memset(esp_byte, 0, sizeof(esp_byte));
  437. memset(esp_src_mac, 0, 6);
  438. memset(&esp_param, 0, sizeof(struct esp_param_t));
  439. memset(esp_last_num, 0, sizeof(esp_last_num));
  440. esp_temp_lock = 0;
  441. esp_state = 0;
  442. esp_data_datum = 0;
  443. memset(esp_head_cnt, 0, sizeof(esp_head_cnt));
  444. memset(esp_byte_cnt, 0, sizeof(esp_byte_cnt));
  445. esp_sync_cnt = 0;
  446. esp_crc_value = 0;
  447. esp_data_cnt = 0;
  448. memset(esp_last_seq, 0, sizeof(esp_last_seq));
  449. esp_scan_bss = scanBss;
  450. if(esp_printf)
  451. esp_printf("tls_esp_init\n");
  452. }