public void Test_Constructor_EncryptedDataFrame()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_encrypted_data_frame.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
Packet p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data);
DataDataFrame frame = (DataDataFrame)p.PayloadPacket;
Assert.AreEqual(0, frame.FrameControl.ProtocolVersion);
Assert.AreEqual(FrameControlField.FrameSubTypes.Data, frame.FrameControl.SubType);
Assert.IsFalse(frame.FrameControl.ToDS);
Assert.IsTrue(frame.FrameControl.FromDS);
Assert.IsFalse(frame.FrameControl.MoreFragments);
Assert.IsFalse(frame.FrameControl.Retry);
Assert.IsFalse(frame.FrameControl.PowerManagement);
Assert.IsFalse(frame.FrameControl.MoreData);
Assert.IsTrue(frame.FrameControl.Protected);
Assert.IsFalse(frame.FrameControl.Order);
Assert.AreEqual(0, frame.Duration.Field); //this need expanding on in the future
Assert.AreEqual("33330000000C", frame.DestinationAddress.ToString().ToUpper());
Assert.AreEqual("00173FB72C29", frame.SourceAddress.ToString().ToUpper());
Assert.AreEqual("0024B2F8D706", frame.BssId.ToString().ToUpper());
Assert.AreEqual(0, frame.SequenceControl.FragmentNumber);
Assert.AreEqual(1561, frame.SequenceControl.SequenceNumber);
Assert.AreEqual(0xC77B6323, frame.FrameCheckSequence);
Assert.AreEqual(24, frame.FrameSize);
Assert.AreEqual(218, frame.PayloadData.Length);
}
public void Test_Bytes_ParsedPacketWithFcsNotIncluded()
{
var dev = new CaptureFileReaderDevice("../../CaptureFiles/80211_unencrypted_data_frame.pcap");
dev.Open();
var rawCapture = dev.GetNextPacket();
dev.Close();
//For this test we are just going to ignore the radio packet that precedes the data frame
Packet p = Packet.ParsePacket(rawCapture.LinkLayerType, rawCapture.Data);
DataDataFrame frame = (DataDataFrame)p.PayloadPacket;
frame.AppendFcs = false;
var frameBytes = frame.Bytes;
var expectedLength = frame.FrameSize + frame.PayloadData.Length;
Assert.AreEqual(expectedLength, frameBytes.Length);
Assert.AreEqual(EndianBitConverter.Big.ToUInt32(frame.PayloadData, frame.PayloadData.Length - 4),
EndianBitConverter.Big.ToUInt32(frameBytes, frameBytes.Length - 4));
}
public void Test_Bytes_ConstructedPacketWithFcsIncluded()
{
//We will use a DataDataFrame for this test but the
//type isn't really important.
var dataFrame = new DataDataFrame();
dataFrame.FrameControl.FromDS = true;
dataFrame.BssId = PhysicalAddress.Parse("AABBCCDDEEFF");
dataFrame.SourceAddress = PhysicalAddress.Parse("AABBCCDDEEFF");
dataFrame.DestinationAddress = PhysicalAddress.Parse("112233445566");
dataFrame.PayloadData = new Byte[] { 0x1, 0x2, 0x3, 0x4 };
//Force it to recalculate the FCS and include it when serialised
dataFrame.UpdateFrameCheckSequence();
dataFrame.AppendFcs = true;
Assert.IsTrue(dataFrame.FCSValid);
var expectedLength = dataFrame.FrameSize + dataFrame.PayloadData.Length + 4;
Byte[] frameBytes = dataFrame.Bytes;
Assert.AreEqual(expectedLength, frameBytes.Length);
Assert.AreEqual(dataFrame.FrameCheckSequence.ToString("X"),
EndianBitConverter.Big.ToUInt32(frameBytes, frameBytes.Length - 4).ToString("X"));
Assert.AreEqual(dataFrame.FrameCheckSequence,
EndianBitConverter.Big.ToUInt32(frameBytes, frameBytes.Length - 4));
}
public void Test_ConstructorWithCorruptBuffer()
{
//buffer is way too short for frame. We are just checking it doesn't throw
byte[] corruptBuffer = new byte[] { 0x01 };
DataDataFrame frame = new DataDataFrame(new ByteArraySegment(corruptBuffer));
Assert.IsFalse(frame.FCSValid);
}
public void Test_Constructor_UnecryptedDataFrameFromValues()
{
DataDataFrame frame = new DataDataFrame();
frame.FrameControl.ToDS = false;
frame.FrameControl.FromDS = true;
frame.FrameControl.MoreFragments = true;
frame.SequenceControl.SequenceNumber = 0x89;
frame.SequenceControl.FragmentNumber = 0x1;
frame.Duration.Field = 0x1234;
frame.DestinationAddress = PhysicalAddress.Parse("111111111111");
frame.SourceAddress = PhysicalAddress.Parse("222222222222");
frame.BssId = PhysicalAddress.Parse("333333333333");
frame.PayloadData = new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 };
frame.UpdateFrameCheckSequence();
UInt32 fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var bas = new ByteArraySegment(bytes);
//create a new frame that should be identical to the original
DataDataFrame recreatedFrame = MacFrame.ParsePacket(bas) as DataDataFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual(FrameControlField.FrameSubTypes.Data, recreatedFrame.FrameControl.SubType);
Assert.IsFalse(recreatedFrame.FrameControl.ToDS);
Assert.IsTrue(recreatedFrame.FrameControl.FromDS);
Assert.IsTrue(recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual(0x89, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual(0x1, recreatedFrame.SequenceControl.FragmentNumber);
Assert.AreEqual("111111111111", recreatedFrame.DestinationAddress.ToString().ToUpper());
Assert.AreEqual("222222222222", recreatedFrame.SourceAddress.ToString().ToUpper());
Assert.AreEqual("333333333333", recreatedFrame.BssId.ToString().ToUpper());
CollectionAssert.AreEqual(new byte[] { 0x01, 0x02, 0x03, 0x04, 0x05 }, recreatedFrame.PayloadData);
Assert.AreEqual(fcs, recreatedFrame.FrameCheckSequence);
}
public void Test_Bytes_ConstructedPacketWithFcsNotIncluded()
{
//We will use a DataDataFrame for this test but the
//type isn't really important.
var dataFrame = new DataDataFrame();
dataFrame.FrameControl.FromDS = true;
dataFrame.BssId = PhysicalAddress.Parse("AABBCCDDEEFF");
dataFrame.SourceAddress = PhysicalAddress.Parse("AABBCCDDEEFF");
dataFrame.DestinationAddress = PhysicalAddress.Parse("112233445566");
dataFrame.PayloadData = new Byte[] { 0x01, 0x02, 0x03, 0x04 };
//Force it to recalculate the FCS but don't include it when serialised
dataFrame.UpdateFrameCheckSequence();
dataFrame.AppendFcs = false;
var expectedLength = dataFrame.FrameSize + dataFrame.PayloadData.Length;
var frameBytes = dataFrame.Bytes;
Assert.AreEqual(expectedLength, frameBytes.Length);
//Check that we get last four bytes of data at the end rather than the FCS
Assert.AreEqual(0x01020304, EndianBitConverter.Big.ToUInt32(frameBytes, frameBytes.Length - 4));
}
public void Test_ConstructorWithCorruptBuffer ()
{
//buffer is way too short for frame. We are just checking it doesn't throw
byte[] corruptBuffer = new byte[]{0x01};
DataDataFrame frame = new DataDataFrame(new ByteArraySegment(corruptBuffer));
Assert.IsFalse(frame.FCSValid);
}
public void Test_Constructor_UnecryptedDataFrameFromValues ()
{
DataDataFrame frame = new DataDataFrame ();
frame.FrameControl.ToDS = false;
frame.FrameControl.FromDS = true;
frame.FrameControl.MoreFragments = true;
frame.SequenceControl.SequenceNumber = 0x89;
frame.SequenceControl.FragmentNumber = 0x1;
frame.Duration.Field = 0x1234;
frame.DestinationAddress = PhysicalAddress.Parse ("111111111111");
frame.SourceAddress = PhysicalAddress.Parse ("222222222222");
frame.BssId = PhysicalAddress.Parse ("333333333333");
frame.PayloadData = new byte[]{0x01, 0x02, 0x03, 0x04, 0x05};
frame.UpdateFrameCheckSequence ();
UInt32 fcs = frame.FrameCheckSequence;
//serialize the frame into a byte buffer
var bytes = frame.Bytes;
var bas = new ByteArraySegment (bytes);
//create a new frame that should be identical to the original
DataDataFrame recreatedFrame = MacFrame.ParsePacket (bas) as DataDataFrame;
recreatedFrame.UpdateFrameCheckSequence();
Assert.AreEqual (FrameControlField.FrameSubTypes.Data, recreatedFrame.FrameControl.SubType);
Assert.IsFalse (recreatedFrame.FrameControl.ToDS);
Assert.IsTrue (recreatedFrame.FrameControl.FromDS);
Assert.IsTrue (recreatedFrame.FrameControl.MoreFragments);
Assert.AreEqual (0x89, recreatedFrame.SequenceControl.SequenceNumber);
Assert.AreEqual (0x1, recreatedFrame.SequenceControl.FragmentNumber);
Assert.AreEqual ("111111111111", recreatedFrame.DestinationAddress.ToString ().ToUpper ());
Assert.AreEqual ("222222222222", recreatedFrame.SourceAddress.ToString ().ToUpper ());
Assert.AreEqual ("333333333333", recreatedFrame.BssId.ToString ().ToUpper ());
CollectionAssert.AreEqual (new byte[]{0x01, 0x02, 0x03, 0x04, 0x05}, recreatedFrame.PayloadData);
Assert.AreEqual (fcs, recreatedFrame.FrameCheckSequence);
}
/// <summary>
/// Parses the <see cref="Kavprot.Packets.Utils.ByteArraySegment"/> into a MacFrame.
/// </summary>
/// <returns>
/// The parsed MacFrame or null if it could not be parsed.
/// </returns>
/// <param name='bas'>
/// The bytes of the packet. bas.Offset should point to the first byte in the mac frame.
/// </param>
/// <remarks>If the provided bytes contain the FCS then call <see cref="MacFrame.ParsePacketWithFcs"/> instead. The presence of the
/// FCS is usually determined by configuration of the device used to capture the packets.</remarks>
public static MacFrame ParsePacket(ByteArraySegment bas)
{
if (bas.Length < MacFields.FrameControlLength)
{
//there isn't enough data to even try and work out what type of packet it is
return(null);
}
//this is a bit ugly as we will end up parsing the framecontrol field twice, once here and once
//inside the packet constructor. Could create the framecontrol and pass it to the packet but I think that is equally ugly
FrameControlField frameControl = new FrameControlField(
EndianBitConverter.Big.ToUInt16(bas.Bytes, bas.Offset));
MacFrame macFrame = null;
switch (frameControl.SubType)
{
case FrameControlField.FrameSubTypes.ManagementAssociationRequest:
{
macFrame = new AssociationRequestFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementAssociationResponse:
{
macFrame = new AssociationResponseFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementReassociationRequest:
{
macFrame = new ReassociationRequestFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementReassociationResponse:
{
macFrame = new AssociationResponseFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementProbeRequest:
{
macFrame = new ProbeRequestFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementProbeResponse:
{
macFrame = new ProbeResponseFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementReserved0:
break; //TODO
case FrameControlField.FrameSubTypes.ManagementReserved1:
break; //TODO
case FrameControlField.FrameSubTypes.ManagementBeacon:
{
macFrame = new BeaconFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementATIM:
break; //TODO
case FrameControlField.FrameSubTypes.ManagementDisassociation:
{
macFrame = new DisassociationFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementAuthentication:
{
macFrame = new AuthenticationFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementDeauthentication:
{
macFrame = new DeauthenticationFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementAction:
{
macFrame = new ActionFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ManagementReserved3:
break; //TODO
case FrameControlField.FrameSubTypes.ControlBlockAcknowledgmentRequest:
{
macFrame = new BlockAcknowledgmentRequestFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlBlockAcknowledgment:
{
macFrame = new BlockAcknowledgmentFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlPSPoll:
break; //TODO
case FrameControlField.FrameSubTypes.ControlRTS:
{
macFrame = new RtsFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlCTS:
{
macFrame = new CtsFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlACK:
{
macFrame = new AckFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlCFEnd:
{
macFrame = new ContentionFreeEndFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.ControlCFEndCFACK:
break; //TODO
case FrameControlField.FrameSubTypes.Data:
case FrameControlField.FrameSubTypes.DataCFACK:
case FrameControlField.FrameSubTypes.DataCFPoll:
case FrameControlField.FrameSubTypes.DataCFAckCFPoll:
{
macFrame = new DataDataFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.DataNullFunctionNoData:
case FrameControlField.FrameSubTypes.DataCFAckNoData:
case FrameControlField.FrameSubTypes.DataCFPollNoData:
case FrameControlField.FrameSubTypes.DataCFAckCFPollNoData:
{
macFrame = new NullDataFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.QosData:
case FrameControlField.FrameSubTypes.QosDataAndCFAck:
case FrameControlField.FrameSubTypes.QosDataAndCFPoll:
case FrameControlField.FrameSubTypes.QosDataAndCFAckAndCFPoll:
{
macFrame = new QosDataFrame(bas);
break;
}
case FrameControlField.FrameSubTypes.QosNullData:
case FrameControlField.FrameSubTypes.QosCFAck:
case FrameControlField.FrameSubTypes.QosCFPoll:
case FrameControlField.FrameSubTypes.QosCFAckAndCFPoll:
{
macFrame = new QosNullDataFrame(bas);
break;
}
default:
//this is an unsupported (and unknown) packet type
break;
}
return(macFrame);
}
public void Test_Bytes_ConstructedPacketWithFcsNotIncluded()
{
//We will use a DataDataFrame for this test but the
//type isn't really important.
var dataFrame = new DataDataFrame();
dataFrame.FrameControl.FromDS = true;
dataFrame.BssId = PhysicalAddress.Parse("AABBCCDDEEFF");
dataFrame.SourceAddress = PhysicalAddress.Parse("AABBCCDDEEFF");
dataFrame.DestinationAddress = PhysicalAddress.Parse("112233445566");
dataFrame.PayloadData = new byte[]{0x01, 0x02, 0x03, 0x04};
//Force it to recalculate the FCS but don't include it when serialised
dataFrame.UpdateFrameCheckSequence();
dataFrame.AppendFcs = false;
var expectedLength = dataFrame.FrameSize + dataFrame.PayloadData.Length;
var frameBytes = dataFrame.Bytes;
Assert.AreEqual(expectedLength, frameBytes.Length);
//Check that we get last four bytes of data at the end rather than the FCS
Assert.AreEqual(0x01020304, EndianBitConverter.Big.ToUInt32(frameBytes, frameBytes.Length - 4));
}
public void Test_Bytes_ConstructedPacketWithFcsIncluded()
{
//We will use a DataDataFrame for this test but the
//type isn't really important.
var dataFrame = new DataDataFrame();
dataFrame.FrameControl.FromDS = true;
dataFrame.BssId = PhysicalAddress.Parse("AABBCCDDEEFF");
dataFrame.SourceAddress = PhysicalAddress.Parse("AABBCCDDEEFF");
dataFrame.DestinationAddress = PhysicalAddress.Parse("112233445566");
dataFrame.PayloadData = new byte[]{0x1, 0x2, 0x3, 0x4};
//Force it to recalculate the FCS and include it when serialised
dataFrame.UpdateFrameCheckSequence();
dataFrame.AppendFcs = true;
Assert.IsTrue(dataFrame.FCSValid);
var expectedLength = dataFrame.FrameSize + dataFrame.PayloadData.Length + 4;
byte[] frameBytes = dataFrame.Bytes;
Assert.AreEqual(expectedLength, frameBytes.Length);
Assert.AreEqual(dataFrame.FrameCheckSequence.ToString("X"),
EndianBitConverter.Big.ToUInt32(frameBytes, frameBytes.Length - 4).ToString("X"));
Assert.AreEqual(dataFrame.FrameCheckSequence,
EndianBitConverter.Big.ToUInt32(frameBytes, frameBytes.Length - 4));
}
