net/reaver/patches/0001-wpscrack-big-endian-fixes.patch

   1 From 4e7af9f022996cb0a03b30f6af265b757807dfa2 Mon Sep 17 00:00:00 2001
   2 From: Paul Fertser <fercerpav@gmail.com>
   3 Date: Wed, 27 Jun 2012 17:44:55 +0400
   4 Subject: [PATCH 1/3] wpscrack: big-endian fixes
   5
   6 This should fix access to the radiotap, 802.11, LLC/SNAP and WFA
   7 headers' fields. Run-time tested on an ar71xx BE system.
   8
   9 Signed-off-by: Paul Fertser <fercerpav@gmail.com>
  10 ---
  11  src/80211.c    |   65 +++++++++++++++++++------------
  12  src/builder.c  |   23 +++++------
  13  src/defs.h     |  116 +++++++++++++++++++++++++++++++++++++++-----------------
  14  src/exchange.c |   23 ++++++-----
  15  src/wpsmon.c   |   13 ++++--
  16  5 files changed, 151 insertions(+), 89 deletions(-)
  17
  18 diff --git a/src/80211.c b/src/80211.c
  19 index c2aff59..19f1e92 100644
  20 --- a/src/80211.c
  21 +++ b/src/80211.c
  22 @@ -90,17 +90,19 @@ void read_ap_beacon()
  23                  if(header.len >= MIN_BEACON_SIZE)
  24                  {
  25                          rt_header = (struct radio_tap_header *) radio_header(packet, header.len);
  26 -                        frame_header = (struct dot11_frame_header *) (packet + rt_header->len);
  27 -
  28 +                       size_t rt_header_len = __le16_to_cpu(rt_header->len);
  29 +                       frame_header = (struct dot11_frame_header *) (packet + rt_header_len);
  30 +
  31                         if(is_target(frame_header))
  32                         {
  33 -                                if(frame_header->fc.type == MANAGEMENT_FRAME && frame_header->fc.sub_type == SUBTYPE_BEACON)
  34 +                                if((frame_header->fc & __cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
  35 +                                  __cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON))
  36                                  {
  37 -                                               beacon = (struct beacon_management_frame *) (packet + rt_header->len + sizeof(struct dot11_frame_header));
  38 +                                               beacon = (struct beacon_management_frame *) (packet + rt_header_len + sizeof(struct dot11_frame_header));
  39                                                 set_ap_capability(beacon->capability);
  40
  41                                         /* Obtain the SSID and channel number from the beacon packet */
  42 -                                       tag_offset = rt_header->len + sizeof(struct dot11_frame_header) + sizeof(struct beacon_management_frame);
  43 +                                       tag_offset = rt_header_len + sizeof(struct dot11_frame_header) + sizeof(struct beacon_management_frame);
  44                                         channel = parse_beacon_tags(packet, header.len);
  45
  46                                         /* If no channel was manually specified, switch to the AP's current channel */
  47 @@ -135,29 +137,31 @@ int8_t signal_strength(const u_char *packet, size_t len)
  48         {
  49                 header = (struct radio_tap_header *) packet;
  50
  51 -               if((header->flags & SSI_FLAG) == SSI_FLAG)
  52 +               uint32_t flags = __le32_to_cpu(header->flags);
  53 +
  54 +               if((flags & SSI_FLAG) == SSI_FLAG)
  55                 {
  56 -                       if((header->flags & TSFT_FLAG) == TSFT_FLAG)
  57 +                       if((flags & TSFT_FLAG) == TSFT_FLAG)
  58                         {
  59                                 offset += TSFT_SIZE;
  60                         }
  61
  62 -                       if((header->flags & FLAGS_FLAG) == FLAGS_FLAG)
  63 +                       if((flags & FLAGS_FLAG) == FLAGS_FLAG)
  64                         {
  65                                 offset += FLAGS_SIZE;
  66                         }
  67
  68 -                       if((header->flags & RATE_FLAG) == RATE_FLAG)
  69 +                       if((flags & RATE_FLAG) == RATE_FLAG)
  70                         {
  71                                 offset += RATE_SIZE;
  72                         }
  73
  74 -                       if((header->flags & CHANNEL_FLAG) == CHANNEL_FLAG)
  75 +                       if((flags & CHANNEL_FLAG) == CHANNEL_FLAG)
  76                         {
  77                                 offset += CHANNEL_SIZE;
  78                         }
  79
  80 -                       if((header->flags & FHSS_FLAG) == FHSS_FLAG)
  81 +                       if((flags & FHSS_FLAG) == FHSS_FLAG)
  82                         {
  83                                 offset += FHSS_FLAG;
  84                         }
  85 @@ -196,11 +200,13 @@ int is_wps_locked()
  86                 if(header.len >= MIN_BEACON_SIZE)
  87                 {
  88                         rt_header = (struct radio_tap_header *) radio_header(packet, header.len);
  89 -                       frame_header = (struct dot11_frame_header *) (packet + rt_header->len);
  90 +                       size_t rt_header_len = __le16_to_cpu(rt_header->len);
  91 +                       frame_header = (struct dot11_frame_header *) (packet + rt_header_len);
  92
  93                         if(memcmp(frame_header->addr3, get_bssid(), MAC_ADDR_LEN) == 0)
  94                         {
  95 -                               if(frame_header->fc.type == MANAGEMENT_FRAME && frame_header->fc.sub_type == SUBTYPE_BEACON)
  96 +                                if((frame_header->fc & __cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
  97 +                                  __cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_BEACON))
  98                                 {
  99                                         if(parse_wps_parameters(packet, header.len, &wps))
 100                                         {
 101 @@ -411,24 +417,30 @@ int associate_recv_loop()
 102                  if(header.len >= MIN_AUTH_SIZE)
 103                  {
 104                         rt_header = (struct radio_tap_header *) radio_header(packet, header.len);
 105 -                        dot11_frame = (struct dot11_frame_header *) (packet + rt_header->len);
 106 +                       size_t rt_header_len = __le16_to_cpu(rt_header->len);
 107 +                       dot11_frame = (struct dot11_frame_header *) (packet + rt_header_len);
 108
 109                          if((memcmp(dot11_frame->addr3, get_bssid(), MAC_ADDR_LEN) == 0) &&
 110                             (memcmp(dot11_frame->addr1, get_mac(), MAC_ADDR_LEN) == 0))
 111                          {
 112 -                               if(dot11_frame->fc.type == MANAGEMENT_FRAME)
 113 +                                if((dot11_frame->fc & __cpu_to_le16(IEEE80211_FCTL_FTYPE)) ==
 114 +                                  __cpu_to_le16(IEEE80211_FTYPE_MGMT))
 115                                 {
 116 -                                       auth_frame = (struct authentication_management_frame *) (packet + sizeof(struct dot11_frame_header) + rt_header->len);
 117 -                                       assoc_frame = (struct association_response_management_frame *) (packet + sizeof(struct dot11_frame_header) + rt_header->len);
 118 +                                       auth_frame = (struct authentication_management_frame *) (packet + sizeof(struct dot11_frame_header) + rt_header_len);
 119 +                                       assoc_frame = (struct association_response_management_frame *) (packet + sizeof(struct dot11_frame_header) + rt_header_len);
 120
 121                                         /* Did we get an authentication packet with a successful status? */
 122 -                                       if((dot11_frame->fc.sub_type == SUBTYPE_AUTHENTICATION) && (auth_frame->status == AUTHENTICATION_SUCCESS))
 123 +                                       if((dot11_frame->fc & __cpu_to_le16(IEEE80211_FCTL_STYPE)) ==
 124 +                                          __cpu_to_le16(IEEE80211_STYPE_AUTH)
 125 +                                          && (auth_frame->status == __cpu_to_le16(AUTHENTICATION_SUCCESS)))
 126                                                 {
 127                                                         ret_val = AUTH_OK;
 128                                                         break;
 129                                                 }
 130                                         /* Did we get an association packet with a successful status? */
 131 -                                               else if((dot11_frame->fc.sub_type == SUBTYPE_ASSOCIATION) && (assoc_frame->status == ASSOCIATION_SUCCESS))
 132 +                                               else if((dot11_frame->fc & __cpu_to_le16(IEEE80211_FCTL_STYPE)) ==
 133 +                                               __cpu_to_le16(IEEE80211_STYPE_ASSOC_RESP)
 134 +                                               && (assoc_frame->status == __cpu_to_le16(ASSOCIATION_SUCCESS)))
 135                                         {
 136                                                 ret_val = ASSOCIATE_OK;
 137                                                 break;
 138 @@ -455,13 +467,14 @@ enum encryption_type supported_encryption(const u_char *packet, size_t len)
 139         if(len > MIN_BEACON_SIZE)
 140         {
 141                 rt_header = (struct radio_tap_header *) radio_header(packet, len);
 142 -               beacon = (struct beacon_management_frame *) (packet + rt_header->len + sizeof(struct dot11_frame_header));
 143 -               offset = tag_offset = rt_header->len + sizeof(struct dot11_frame_header) + sizeof(struct beacon_management_frame);
 144 +               size_t rt_header_len = __le16_to_cpu(rt_header->len);
 145 +               beacon = (struct beacon_management_frame *) (packet + rt_header_len + sizeof(struct dot11_frame_header));
 146 +               offset = tag_offset = rt_header_len + sizeof(struct dot11_frame_header) + sizeof(struct beacon_management_frame);
 147
 148                 tag_len = len - tag_offset;
 149                 tag_data = (const u_char *) (packet + tag_offset);
 150
 151 -               if((beacon->capability & CAPABILITY_WEP) == CAPABILITY_WEP)
 152 +               if((__le16_to_cpu(beacon->capability) & CAPABILITY_WEP) == CAPABILITY_WEP)
 153                 {
 154                         enc = WEP;
 155
 156 @@ -509,7 +522,7 @@ int parse_beacon_tags(const u_char *packet, size_t len)
 157         struct radio_tap_header *rt_header = NULL;
 158
 159         rt_header = (struct radio_tap_header *) radio_header(packet, len);
 160 -       tag_offset = rt_header->len + sizeof(struct dot11_frame_header) + sizeof(struct beacon_management_frame);
 161 +       tag_offset = __le16_to_cpu(rt_header->len) + sizeof(struct dot11_frame_header) + sizeof(struct beacon_management_frame);
 162
 163         if(tag_offset < len)
 164         {
 165 @@ -548,7 +561,7 @@ int parse_beacon_tags(const u_char *packet, size_t len)
 166                 {
 167                         if(ie_len  == 1)
 168                         {
 169 -                               memcpy((int *) &channel, channel_data, ie_len);
 170 +                               channel = *(uint8_t*)channel_data;
 171                         }
 172                         free(channel_data);
 173                 }
 174 @@ -603,13 +616,13 @@ int check_fcs(const u_char *packet, size_t len)
 175         if(len > 4)
 176         {
 177                 /* Get the packet's reported FCS (last 4 bytes of the packet) */
 178 -               memcpy((uint32_t *) &fcs, (packet + (len-4)), 4);
 179 +               fcs = __le32_to_cpu(*(uint32_t*)(packet + (len-4)));
 180
 181                 /* FCS is not calculated over the radio tap header */
 182                 if(has_rt_header())
 183                 {
 184                         rt_header = (struct radio_tap_header *) packet;
 185 -                       offset += rt_header->len;
 186 +                       offset += __le16_to_cpu(rt_header->len);
 187                 }
 188
 189                 if(len > offset)
 190 diff --git a/src/builder.c b/src/builder.c
 191 index 37f2de7..6bf89e7 100644
 192 --- a/src/builder.c
 193 +++ b/src/builder.c
 194 @@ -44,9 +44,8 @@ const void *build_radio_tap_header(size_t *len)
 195                 memset((void *) buf, 0, sizeof(struct radio_tap_header));
 196                 rt_header = (struct radio_tap_header *) buf;
 197
 198 -               rt_header->len = sizeof(struct radio_tap_header);
 199 -
 200 -               *len = rt_header->len;
 201 +               *len = sizeof(struct radio_tap_header);
 202 +               rt_header->len = __cpu_to_le16(*len);
 203         }
 204
 205         return buf;
 206 @@ -67,9 +66,9 @@ const void *build_dot11_frame_header(uint16_t fc, size_t *len)
 207
 208                 frag_seq += SEQ_MASK;
 209
 210 -               header->duration = DEFAULT_DURATION;
 211 -               memcpy((void *) &header->fc, (void *) &fc, sizeof(struct frame_control));
 212 -               header->frag_seq = frag_seq;
 213 +               header->duration = __cpu_to_le16(DEFAULT_DURATION);
 214 +               header->fc = __cpu_to_le16(fc);
 215 +               header->frag_seq = __cpu_to_le16(frag_seq);
 216
 217                 memcpy((void *) header->addr1, get_bssid(), MAC_ADDR_LEN);
 218                 memcpy((void *) header->addr2, get_mac(), MAC_ADDR_LEN);
 219 @@ -91,8 +90,8 @@ const void *build_authentication_management_frame(size_t *len)
 220                 memset((void *) buf, 0, *len);
 221                 frame = (struct authentication_management_frame *) buf;
 222
 223 -               frame->algorithm = OPEN_SYSTEM;
 224 -               frame->sequence = 1;
 225 +               frame->algorithm = __cpu_to_le16(OPEN_SYSTEM);
 226 +               frame->sequence = __cpu_to_le16(1);
 227                 frame->status = 0;
 228         }
 229
 230 @@ -111,8 +110,8 @@ const void *build_association_management_frame(size_t *len)
 231                 memset((void *) buf, 0, *len);
 232                 frame = (struct association_request_management_frame *) buf;
 233
 234 -               frame->capability = get_ap_capability();
 235 -               frame->listen_interval = LISTEN_INTERVAL;
 236 +               frame->capability = __cpu_to_le16(get_ap_capability());
 237 +               frame->listen_interval = __cpu_to_le16(LISTEN_INTERVAL);
 238         }
 239
 240         return buf;
 241 @@ -133,7 +132,7 @@ const void *build_llc_header(size_t *len)
 242                 header->dsap = LLC_SNAP;
 243                 header->ssap = LLC_SNAP;
 244                 header->control_field = UNNUMBERED_FRAME;
 245 -               header->type = DOT1X_AUTHENTICATION;
 246 +               header->type = __cpu_to_be16(DOT1X_AUTHENTICATION);
 247
 248         }
 249
 250 @@ -279,7 +278,7 @@ const void *build_wfa_header(uint8_t op_code, size_t *len)
 251                 header = (struct wfa_expanded_header *) buf;
 252
 253                 memcpy(header->id, WFA_VENDOR_ID, sizeof(header->id));
 254 -               header->type = SIMPLE_CONFIG;
 255 +               header->type = __cpu_to_be32(SIMPLE_CONFIG);
 256                 header->opcode = op_code;
 257         }
 258
 259 diff --git a/src/defs.h b/src/defs.h
 260 index b2f45ea..0c628e7 100644
 261 --- a/src/defs.h
 262 +++ b/src/defs.h
 263 @@ -41,6 +41,7 @@
 264  #include <string.h>
 265  #include <time.h>
 266  #include <pcap.h>
 267 +#include <asm/byteorder.h>
 268
 269  #include "wps.h"
 270
 271 @@ -65,10 +66,10 @@
 272  #define MANAGEMENT_FRAME       0x00
 273  #define SUBTYPE_BEACON         0x08
 274
 275 -#define DOT1X_AUTHENTICATION   0x8E88
 276 +#define DOT1X_AUTHENTICATION   0x888E
 277  #define DOT1X_EAP_PACKET       0x00
 278
 279 -#define SIMPLE_CONFIG          0x01000000
 280 +#define SIMPLE_CONFIG          0x00000001
 281
 282  #define P1_SIZE                        10000
 283  #define P2_SIZE                        1000
 284 @@ -282,66 +283,111 @@ enum wfa_elements
 285         WEP_TRANSMIT_KEY = 0x10064
 286  };
 287
 288 +#define IEEE80211_FCTL_VERS            0x0003
 289 +#define IEEE80211_FCTL_FTYPE           0x000c
 290 +#define IEEE80211_FCTL_STYPE           0x00f0
 291 +#define IEEE80211_FCTL_TODS            0x0100
 292 +#define IEEE80211_FCTL_FROMDS          0x0200
 293 +#define IEEE80211_FCTL_MOREFRAGS       0x0400
 294 +#define IEEE80211_FCTL_RETRY           0x0800
 295 +#define IEEE80211_FCTL_PM              0x1000
 296 +#define IEEE80211_FCTL_MOREDATA                0x2000
 297 +#define IEEE80211_FCTL_PROTECTED       0x4000
 298 +#define IEEE80211_FCTL_ORDER           0x8000
 299 +
 300 +#define IEEE80211_SCTL_FRAG            0x000F
 301 +#define IEEE80211_SCTL_SEQ             0xFFF0
 302 +
 303 +#define IEEE80211_FTYPE_MGMT           0x0000
 304 +#define IEEE80211_FTYPE_CTL            0x0004
 305 +#define IEEE80211_FTYPE_DATA           0x0008
 306 +
 307 +/* management */
 308 +#define IEEE80211_STYPE_ASSOC_REQ      0x0000
 309 +#define IEEE80211_STYPE_ASSOC_RESP     0x0010
 310 +#define IEEE80211_STYPE_REASSOC_REQ    0x0020
 311 +#define IEEE80211_STYPE_REASSOC_RESP   0x0030
 312 +#define IEEE80211_STYPE_PROBE_REQ      0x0040
 313 +#define IEEE80211_STYPE_PROBE_RESP     0x0050
 314 +#define IEEE80211_STYPE_BEACON         0x0080
 315 +#define IEEE80211_STYPE_ATIM           0x0090
 316 +#define IEEE80211_STYPE_DISASSOC       0x00A0
 317 +#define IEEE80211_STYPE_AUTH           0x00B0
 318 +#define IEEE80211_STYPE_DEAUTH         0x00C0
 319 +#define IEEE80211_STYPE_ACTION         0x00D0
 320 +
 321 +/* control */
 322 +#define IEEE80211_STYPE_BACK_REQ       0x0080
 323 +#define IEEE80211_STYPE_BACK           0x0090
 324 +#define IEEE80211_STYPE_PSPOLL         0x00A0
 325 +#define IEEE80211_STYPE_RTS            0x00B0
 326 +#define IEEE80211_STYPE_CTS            0x00C0
 327 +#define IEEE80211_STYPE_ACK            0x00D0
 328 +#define IEEE80211_STYPE_CFEND          0x00E0
 329 +#define IEEE80211_STYPE_CFENDACK       0x00F0
 330 +
 331 +/* data */
 332 +#define IEEE80211_STYPE_DATA                   0x0000
 333 +#define IEEE80211_STYPE_DATA_CFACK             0x0010
 334 +#define IEEE80211_STYPE_DATA_CFPOLL            0x0020
 335 +#define IEEE80211_STYPE_DATA_CFACKPOLL         0x0030
 336 +#define IEEE80211_STYPE_NULLFUNC               0x0040
 337 +#define IEEE80211_STYPE_CFACK                  0x0050
 338 +#define IEEE80211_STYPE_CFPOLL                 0x0060
 339 +#define IEEE80211_STYPE_CFACKPOLL              0x0070
 340 +#define IEEE80211_STYPE_QOS_DATA               0x0080
 341 +#define IEEE80211_STYPE_QOS_DATA_CFACK         0x0090
 342 +#define IEEE80211_STYPE_QOS_DATA_CFPOLL                0x00A0
 343 +#define IEEE80211_STYPE_QOS_DATA_CFACKPOLL     0x00B0
 344 +#define IEEE80211_STYPE_QOS_NULLFUNC           0x00C0
 345 +#define IEEE80211_STYPE_QOS_CFACK              0x00D0
 346 +#define IEEE80211_STYPE_QOS_CFPOLL             0x00E0
 347 +#define IEEE80211_STYPE_QOS_CFACKPOLL          0x00F0
 348 +
 349  #pragma pack(1)
 350  struct radio_tap_header
 351  {
 352         uint8_t revision;
 353         uint8_t pad;
 354 -       uint16_t len;
 355 -       uint32_t flags;
 356 -};
 357 -
 358 -struct frame_control
 359 -{
 360 -        unsigned version : 2;
 361 -        unsigned type : 2;
 362 -        unsigned sub_type : 4;
 363 -
 364 -        unsigned to_ds : 1;
 365 -        unsigned from_ds : 1;
 366 -        unsigned more_frag : 1;
 367 -        unsigned retry : 1;
 368 -        unsigned pwr_mgt : 1;
 369 -        unsigned more_data : 1;
 370 -        unsigned protected_frame : 1;
 371 -        unsigned order : 1;
 372 +       __le16 len;
 373 +       __le32 flags;
 374  };
 375
 376  struct dot11_frame_header
 377  {
 378 -       struct frame_control fc;
 379 -        uint16_t duration;
 380 +       __le16 fc;
 381 +       __le16 duration;
 382         unsigned char addr1[MAC_ADDR_LEN];
 383         unsigned char addr2[MAC_ADDR_LEN];
 384         unsigned char addr3[MAC_ADDR_LEN];
 385 -       uint16_t frag_seq;
 386 +       __le16 frag_seq;
 387  };
 388
 389  struct authentication_management_frame
 390  {
 391 -       uint16_t algorithm;
 392 -       uint16_t sequence;
 393 -       uint16_t status;
 394 +       __le16 algorithm;
 395 +       __le16 sequence;
 396 +       __le16 status;
 397  };
 398
 399  struct association_request_management_frame
 400  {
 401 -       uint16_t capability;
 402 -       uint16_t listen_interval;
 403 +       __le16 capability;
 404 +       __le16 listen_interval;
 405  };
 406
 407  struct association_response_management_frame
 408  {
 409 -       uint16_t capability;
 410 -       uint16_t status;
 411 -       uint16_t id;
 412 +       __le16 capability;
 413 +       __le16 status;
 414 +       __le16 id;
 415  };
 416
 417  struct beacon_management_frame
 418  {
 419         unsigned char timestamp[TIMESTAMP_LEN];
 420 -       uint16_t beacon_interval;
 421 -       uint16_t capability;
 422 +       __le16 beacon_interval;
 423 +       __le16 capability;
 424  };
 425
 426  struct llc_header
 427 @@ -350,7 +396,7 @@ struct llc_header
 428         uint8_t ssap;
 429         uint8_t control_field;
 430         unsigned char org_code[3];
 431 -       uint16_t type;
 432 +       __be16 type;
 433  };
 434
 435  struct dot1X_header
 436 @@ -371,7 +417,7 @@ struct eap_header
 437  struct wfa_expanded_header
 438  {
 439         unsigned char id[3];
 440 -       uint32_t type;
 441 +       __be32 type;
 442         uint8_t opcode;
 443         uint8_t flags;
 444  };
 445 diff --git a/src/exchange.c b/src/exchange.c
 446 index 23c87e9..4f9a82b 100644
 447 --- a/src/exchange.c
 448 +++ b/src/exchange.c
 449 @@ -306,26 +306,27 @@ enum wps_type process_packet(const u_char *packet, struct pcap_pkthdr *header)
 450
 451         /* Cast the radio tap and 802.11 frame headers and parse out the Frame Control field */
 452         rt_header = (struct radio_tap_header *) packet;
 453 -       frame_header = (struct dot11_frame_header *) (packet+rt_header->len);
 454 +       size_t rt_header_len = __le16_to_cpu(rt_header->len);
 455 +       frame_header = (struct dot11_frame_header *) (packet+rt_header_len);
 456
 457         /* Does the BSSID/source address match our target BSSID? */
 458         if(memcmp(frame_header->addr3, get_bssid(), MAC_ADDR_LEN) == 0)
 459         {
 460                 /* Is this a data packet sent to our MAC address? */
 461 -               if(frame_header->fc.type == DATA_FRAME &&
 462 -                       frame_header->fc.sub_type == SUBTYPE_DATA &&
 463 -                       (memcmp(frame_header->addr1, get_mac(), MAC_ADDR_LEN) == 0))
 464 +               if (((frame_header->fc & __cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) ==
 465 +                    __cpu_to_le16(IEEE80211_FTYPE_DATA | IEEE80211_STYPE_DATA)) &&
 466 +                   (memcmp(frame_header->addr1, get_mac(), MAC_ADDR_LEN) == 0))
 467                 {
 468                         llc = (struct llc_header *) (packet +
 469 -                                                       rt_header->len +
 470 +                                                       rt_header_len +
 471                                                         sizeof(struct dot11_frame_header)
 472                         );
 473
 474                         /* All packets in our exchanges will be 802.1x */
 475 -                       if(llc->type == DOT1X_AUTHENTICATION)
 476 +                       if(llc->type == __cpu_to_be16(DOT1X_AUTHENTICATION))
 477                         {
 478                                 dot1x = (struct dot1X_header *) (packet +
 479 -                                                               rt_header->len +
 480 +                                                               rt_header_len +
 481                                                                 sizeof(struct dot11_frame_header) +
 482                                                                 sizeof(struct llc_header)
 483                                 );
 484 @@ -334,7 +335,7 @@ enum wps_type process_packet(const u_char *packet, struct pcap_pkthdr *header)
 485                                 if(dot1x->type == DOT1X_EAP_PACKET && (header->len >= EAP_PACKET_SIZE))
 486                                 {
 487                                         eap = (struct eap_header *) (packet +
 488 -                                                                       rt_header->len +
 489 +                                                                       rt_header_len +
 490                                                                         sizeof(struct dot11_frame_header) +
 491                                                                         sizeof(struct llc_header) +
 492                                                                         sizeof(struct dot1X_header)
 493 @@ -366,7 +367,7 @@ enum wps_type process_packet(const u_char *packet, struct pcap_pkthdr *header)
 494                                                 else if((eap->type == EAP_EXPANDED) && (header->len > WFA_PACKET_SIZE))
 495                                                 {
 496                                                         wfa = (struct wfa_expanded_header *) (packet +
 497 -                                                                                       rt_header->len +
 498 +                                                                                       rt_header_len +
 499                                                                                         sizeof(struct dot11_frame_header) +
 500                                                                                         sizeof(struct llc_header) +
 501                                                                                         sizeof(struct dot1X_header) +
 502 @@ -374,14 +375,14 @@ enum wps_type process_packet(const u_char *packet, struct pcap_pkthdr *header)
 503                                                         );
 504
 505                                                         /* Verify that this is a WPS message */
 506 -                                                       if(wfa->type == SIMPLE_CONFIG)
 507 +                                                       if(wfa->type == __cpu_to_be32(SIMPLE_CONFIG))
 508                                                         {
 509                                                                 wps_msg_len =   (size_t) ntohs(eap->len) -
 510                                                                                 sizeof(struct eap_header) -
 511                                                                                 sizeof(struct wfa_expanded_header);
 512
 513                                                                 wps_msg = (const void *) (packet +
 514 -                                                                                       rt_header->len +
 515 +                                                                                       rt_header_len +
 516                                                                                                 sizeof(struct dot11_frame_header) +
 517                                                                                                 sizeof(struct llc_header) +
 518                                                                                                 sizeof(struct dot1X_header) +
 519 diff --git a/src/wpsmon.c b/src/wpsmon.c
 520 index d976924..22a394f 100644
 521 --- a/src/wpsmon.c
 522 +++ b/src/wpsmon.c
 523 @@ -295,7 +295,8 @@ void parse_wps_settings(const u_char *packet, struct pcap_pkthdr *header, char *
 524          }
 525
 526         rt_header = (struct radio_tap_header *) radio_header(packet, header->len);
 527 -       frame_header = (struct dot11_frame_header *) (packet + rt_header->len);
 528 +       size_t rt_header_len = __le16_to_cpu(rt_header->len);
 529 +       frame_header = (struct dot11_frame_header *) (packet + rt_header_len);
 530
 531         /* If a specific BSSID was specified, only parse packets from that BSSID */
 532         if(!is_target(frame_header))
 533 @@ -323,15 +324,17 @@ void parse_wps_settings(const u_char *packet, struct pcap_pkthdr *header, char *
 534                                 channel_changed = 1;
 535                         }
 536
 537 -                       if(frame_header->fc.sub_type == PROBE_RESPONSE ||
 538 -                                   frame_header->fc.sub_type == SUBTYPE_BEACON)
 539 +                       unsigned fsub_type = frame_header->fc & __cpu_to_le16(IEEE80211_FCTL_STYPE);
 540 +
 541 +                       if(fsub_type == __cpu_to_le16(IEEE80211_STYPE_PROBE_RESP) ||
 542 +                          fsub_type == __cpu_to_le16(IEEE80211_STYPE_BEACON))
 543                         {
 544                                 wps_parsed = parse_wps_parameters(packet, header->len, wps);
 545                         }
 546
 547                         if(!is_done(bssid) && (get_channel() == channel || source == PCAP_FILE))
 548                         {
 549 -                               if(frame_header->fc.sub_type == SUBTYPE_BEACON &&
 550 +                               if(fsub_type == __cpu_to_le16(IEEE80211_STYPE_BEACON) &&
 551                                    mode == SCAN &&
 552                                    !passive &&
 553                                    should_probe(bssid))
 554 @@ -369,7 +372,7 @@ void parse_wps_settings(const u_char *packet, struct pcap_pkthdr *header, char *
 555                                  * If there was no WPS information, then the AP does not support WPS and we should ignore it from here on.
 556                                  * If this was a probe response, then we've gotten all WPS info we can get from this AP and should ignore it from here on.
 557                                  */
 558 -                               if(!wps_parsed || frame_header->fc.sub_type == PROBE_RESPONSE)
 559 +                               if(!wps_parsed || fsub_type == __cpu_to_le16(IEEE80211_STYPE_PROBE_RESP))
 560                                 {
 561                                         mark_ap_complete(bssid);
 562                                 }
 563 --
 564 1.7.7
 565