ESP8266 Developer Zone

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2022-02-01T05:54:45+08:00

...but it appears to go away if I patch cnx_csa_fn() to do nothing:

40217830 :
40217830:f00d ret.n

actually it works better than patching ieee80211_add_csa() since it doesn't react to CSA's while scanning instead of not sending CSA's (I guess).

What is cnx_csa_fn() supposed to do anyway?

Statistics: Posted by st0ff3r — Tue Feb 01, 2022 5:54 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2022-01-31T05:27:57+08:00

[update]
thought it was fixed in latest commit (1391d154092f9e0e7702086ab9af1558584cc694) , but unfortunately I still get it:

switch to channel 12
scandone
-> wifi_scan_done_cb(3fff68d8, 1)

and then wireless connection is disconnected

Statistics: Posted by st0ff3r — Mon Jan 31, 2022 5:27 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2022-01-23T11:48:54+08:00

Looks like it was fixed in latest update https://github.com/espressif/ESP8266_NO ... issues/354

thanx a lot

Statistics: Posted by st0ff3r — Sun Jan 23, 2022 11:48 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-11-30T08:38:37+08:00

Looking closer to libnet80211.a it looks like its based on FreeBSD net80211 https://github.com/freebsd/freebsd-src/ ... s/net80211

So in a desparate try to force the esp to _not_ sending out CSA while scanning, I patched the function ieee80211_add_csa() in ieee80211_output.o like this:

40214748 :
40214748: f00d ret.n

so it completely skips the adding of CSA.

It worked!
I am not seeing "switch to channel X" anymore if there are no ESP's with unpatched ieee80211_add_csa close.

But a better solution would be if it would not _react_ to CSA's sent from other ESP's acting as an access points, when the client is not connected to that specific access point.

Any chances you could look into it? As it is now, the ESP's connection to an access point can be disconnected by anybody sending "evil" beacon packages.

Statistics: Posted by st0ff3r — Tue Nov 30, 2021 8:38 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-11-28T09:04:18+08:00

Hi, sorry i havent have time to write back, but sadly the csa attack bug still there, even in the latest git master. Could I do anything to help debugging it?

Here is a simple program:

Code:

static os_timer_t wifi_scan_timer;
static void wifi_scan_timer_func(void *arg);

ICACHE_FLASH_ATTR
void wifi_scan_done_cb(void *arg, STATUS status) {
   struct bss_info *info;
   
   if ((arg != NULL) && (status == OK)) {
      info = (struct bss_info *)arg;
      
      while (info != NULL) {
         os_printf("channel: %d, ssid: %s, bssid %02x:%02x:%02x:%02x:%02x:%02x, rssi: %d, freq_offset: %d, freqcal_val: %d\n\r", info->channel, 
            info->ssid,
            info->bssid[0], 
            info->bssid[1], 
            info->bssid[2], 
            info->bssid[3], 
            info->bssid[4], 
            info->bssid[5],
            info->rssi,
            info->freq_offset,
            info->freqcal_val
         );
         info = info->next.stqe_next;
      }
   }
}

static void ICACHE_FLASH_ATTR wifi_scan_timer_func(void *arg) {
   wifi_station_scan(NULL, wifi_scan_done_cb);
}

ICACHE_FLASH_ATTR void system_init_done(void) {
   struct station_config stationConf;

   wifi_set_opmode_current(STATIONAP_MODE);
   memset(&stationConf, 0, sizeof(struct station_config));
   wifi_station_get_config(&stationConf);
   
   os_memcpy(&stationConf.ssid, "Loppen Public", 32); 
   os_memcpy(&stationConf.password, "", 64);
   
   wifi_station_set_config_current(&stationConf);
   wifi_station_connect();

   os_timer_disarm(&wifi_scan_timer);
   os_timer_setfn(&wifi_scan_timer, (os_timer_func_t *)wifi_scan_timer_func, NULL);
   os_timer_arm(&wifi_scan_timer, 5000, 1);
}

ICACHE_FLASH_ATTR void user_init(void) {
   system_update_cpu_freq(160);
   uart_init(BIT_RATE_115200, BIT_RATE_115200);

   wifi_set_opmode_current(NULL_MODE);
   wifi_station_disconnect();

   system_init_done_cb(&system_init_done);
}

and this is the output, while it runs simultaniously with another one also scanning. So as my earlier debugging shows (https://github.com/espressif/ESP8266_NONOS_SDK/issues/312) the code honour 802.11 beacons containing CSA when scanning, even if its sent from another ap than its connected to:

mode : sta(ec:fa:bc:21:27:94) + softAP(ee:fa:bc:21:27:94)
add if0
add if1
dhcp server start:(ip:192.168.4.1,mask:255.255.255.0,gw:192.168.4.1)
bcn 100
scandone
state: 0 -> 2 (b0)
state: 2 -> 3 (0)
state: 3 -> 5 (10)
add 0
aid 1

connected with Loppen Public, channel 1
dhcp client start...
cnt
ip:10.0.1.177,mask:255.255.255.0,gw:10.0.1.1
switch to channel 6
scandone
switch to channel 6
scandone
switch to channel 6
scandone
switch to channel 6
scandone
scandone
switch to channel 6
scandone
switch to channel 6
scandone
[...]

Statistics: Posted by st0ff3r — Sun Nov 28, 2021 9:04 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-04-29T18:08:12+08:00

its not the same ssid/bssi thats what is strange - totally unrelated ssid

Statistics: Posted by st0ff3r — Thu Apr 29, 2021 6:08 pm

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-04-23T10:46:37+08:00

May I ask if the SSID & BSSID of beacon sent from beacon_spammer be the same as the SSID & BSSID of the router which ESP8266 connected to？

Statistics: Posted by Her Mary — Fri Apr 23, 2021 10:46 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-03-29T23:55:10+08:00

Hereby attached tcpdump wifi capture file and serial debugging output of the following scenario:
1. esp 8266 connected to ssid "Loppen Public" on channel 1
2. "beacon_spammer" sending out CSA's on channel 2
3. tcpdump running on same host as "beacon_spammer" on channel 2

Thanx a lot for your help to debug

beacon_spammer_experiment.zip

Statistics: Posted by st0ff3r — Mon Mar 29, 2021 11:55 pm

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-03-26T21:59:40+08:00

Sure, I'll do that

Statistics: Posted by st0ff3r — Fri Mar 26, 2021 9:59 pm

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-03-26T16:13:40+08:00

Hi st0ff3r,

Could you have a try with the new test lib?

libnet80211-test2.a.zip

If possible, could you provide captured Wi-Fi packets for analyzing?

Thanks.

Statistics: Posted by ESP_Faye — Fri Mar 26, 2021 4:13 pm

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-03-13T07:16:50+08:00

Same result, but no debugging message besides "switch to channel 2" after calling wifi_station_scan(). Should I try to change wifi_station_set_reconnect_policy(1) to wifi_station_set_reconnect_policy(0) as well?

serial_log.txt.zip

Statistics: Posted by st0ff3r — Sat Mar 13, 2021 7:16 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-03-12T15:44:04+08:00

Could you test with this libnet80211.a?

libnet80211.a.zip

And provide the entire logs for debugging?

Statistics: Posted by ESP_Faye — Fri Mar 12, 2021 3:44 pm

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-03-04T21:18:42+08:00

Still the same with wifi_station_set_reconnect_policy(0):

-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -65
@@ set csa state to CSA start 2
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff37b8, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done

Statistics: Posted by st0ff3r — Thu Mar 04, 2021 9:18 pm

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-03-04T10:04:00+08:00

Could you have a try that change `wifi_station_set_reconnect_policy(1);` to `wifi_station_set_reconnect_policy(0);`, to see if the issue persists?
https://github.com/nabovarme/MeterLogge ... in.c#L1188

Statistics: Posted by ESP_Faye — Thu Mar 04, 2021 10:04 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-02-28T08:09:56+08:00

just tried it, the log gives the following when scanning and then looses internet connectivity and wifi_station_scan-callback handler returns either 1 or 4 (showed in the log as the second parameter to "-> wifi_scan_done_cb(...)"

"-> wifi_scan_timer_func()" is starting the scan by calling wifi_station_scan()

MQTT: received MQTT_MSG_TYPE_PUBCOMP for id: 6
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 17
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 17
TCP: data received 102 bytes
topic_len: 34, data_len: 64
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 17
-> wifi_scan_timer_func()
RSSI: -61
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff7500, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -61
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff7500, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff7500, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff7500, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff7500, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 18

MQTT: Send keepalive packet to mqtt-host:1883!
MQTT: Sending, type: 12, id: 0000
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 17
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff7a10, 4)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
scandone
-> wifi_scan_timer_func()
RSSI: -64
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -64
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 4)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
scandone
-> wifi_scan_timer_func()
RSSI: -64
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 4)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
scandone
MQTT: queuing publish, length: 196, queue size(0/12288)
?5é-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 17
MQTT: Sending, type: 3, id: 0007
MQTT: espconn_send() returned an error, re-queueing
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 4)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
scandone
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -63
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> wifi_scan_timer_func()
RSSI: -62
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff4338, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 18

MQTT: Send keepalive packet to mqtt-host:1883!
MQTT: Sending, type: 12, id: 0000
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 7
TCP: Disconnected callback
mqtt_disconnected_cb
TCP: Free memory
TCP: Connect to domain mqtt-host:1883
dns_gethostbyname() returned ERR_OK
-> mqtt_dns_found()
DNS: found ip 193.89.248.25
TCP: connecting...
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 10
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 10
-> wifi_scan_timer_func()
RSSI: -62
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff75c0, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
mqtt_timeout_cb
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 9
TCP: Free memory
TCP: Connect to domain mqtt-host:1883
dns_gethostbyname() returned ERR_OK
-> mqtt_dns_found()
DNS: found ip 193.89.248.25
TCP: connecting...
TCP: Reconnect to: mqtt-host:1883
TCP: Reconnect to mqtt-host:1883
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 8
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 8
-> wifi_scan_timer_func()
RSSI: -62
@@ set csa state to CSA start 2
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff43b8, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
mqtt_timeout_cb
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 9
TCP: Free memory
TCP: Connect to domain mqtt-host:1883
dns_gethostbyname() returned ERR_OK
-> mqtt_dns_found()
DNS: found ip 193.89.248.25
TCP: connecting...
TCP: Reconnect to: mqtt-host:1883
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 10
-> wifi_scan_timer_func()
RSSI: -62
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
@@ add csa 1
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff75c0, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
mqtt_timeout_cb
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 9
TCP: Free memory
TCP: Connect to domain mqtt-host:1883
dns_gethostbyname() returned ERR_OK
-> mqtt_dns_found()
DNS: found ip 193.89.248.25
TCP: connecting...
TCP: Reconnect to: mqtt-host:1883
TCP: Reconnect to mqtt-host:1883
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 8
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 8
-> wifi_scan_timer_func()
RSSI: -66
@@ set csa state to CSA start 2
@@ add csa 3
@@ add csa 1
switch to channel 2
scandone
-> wifi_scan_done_cb(3fff43b8, 1)
-> wifi_start_scan(WIFI_SCAN_INTERVAL)
@@ set csa state to CSA done
mqtt_timeout_cb
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 9
TCP: Free memory
TCP: Connect to domain mqtt-host:1883
dns_gethostbyname() returned ERR_OK
-> mqtt_dns_found()
DNS: found ip 193.89.248.25
TCP: connecting...
TCP: Reconnect to: mqtt-host:1883
-> MQTT_Task()
event sig: 0, par: 1073685192, conn state: 10

Statistics: Posted by st0ff3r — Sun Feb 28, 2021 8:09 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-02-28T05:50:01+08:00

Thank you. I will try it asap

Statistics: Posted by st0ff3r — Sun Feb 28, 2021 5:50 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-02-18T14:24:15+08:00

Hi st0ff3r,

Sorry that we cannot reproduce the issue you reported.
As the picture showed, the captured beacon after scanning does not contain CSA.

Maybe you can try to debug this issue with the attached libnet80211.a, we added some logs into it.
If you can reproduce the issue with this debug lib, could you provide the logs for analyzing?

Thanks.

libnet80211.a.zip

Statistics: Posted by ESP_Faye — Thu Feb 18, 2021 2:24 pm

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-02-03T00:39:12+08:00

Have not tried

Statistics: Posted by st0ff3r — Wed Feb 03, 2021 12:39 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-01-15T16:10:20+08:00

Does ESP8266 RTOS also have the same issue?

Statistics: Posted by Her Mary — Fri Jan 15, 2021 4:10 pm

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2021-01-05T09:07:03+08:00

Cool, thanks a lot

Statistics: Posted by st0ff3r — Tue Jan 05, 2021 9:07 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2020-12-29T11:10:25+08:00

Hi,

So sorry that we missed this topic before. We have arranged an engineer to check with this issue. But due to the isolation caused by COVID-19, it may need some time to check and debug this issue. I will feedback to you as soon as there is any update. Sorry again for the inconvenience.

Thanks.

Statistics: Posted by ESP_Faye — Tue Dec 29, 2020 11:10 am

Re: Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2020-12-28T07:41:36+08:00

Espressif, anyone having time to check it?

Statistics: Posted by st0ff3r — Mon Dec 28, 2020 7:41 am

Wrongly reacting to and sending 802.11 beacons with Channel Switch Announcement

2020-06-04T07:42:37+08:00

ESP's appear to honour 802.11 beacons containing CSA even if they are not connected to the AP sending the beacon.

Here is a simple command that sends out beacons containing CSA's
https://github.com/nabovarme/beacon_spammer

I am using an esp8266 with non-os sdk latest from master git.

The app is here: https://github.com/nabovarme/MeterLogger it is running as an AP and periodically scanning for wireless networks.

This is a severe error in the 802.11 implementation. Both the sending of CSA's and reacting on them while scanning should not happen I guess.

Statistics: Posted by st0ff3r — Thu Jun 04, 2020 7:42 am