Kismet

Recent Commits

• Mike Kershaw / Dragorn(04 Oct 26)

  Merge branch 'RFDeck-fix/packetchain-handler-lifetime'

• RFDeck(04 Oct 26)

  packetchain: keep removed handlers alive until no packet thread runs them remove_handler() deleted the pc_link in the *_chain_new copy while the live chain still pointed to it, so packet threads iterating the live chain called the callback through freed memory. The packet threads also swapped the shared chain vectors under packetchain_mutex and then iterated them without it, so with more than one packet thread a swap could free the storage another thread was iterating. Stopping a log under packet load crashed in packet_queue_processor(). Replace the live/_new vector pairs with immutable snapshots of all chains, held by shared_ptr. Registering or removing a handler copies the current snapshot, changes the copy and publishes it. Links are stored by value. A packet thread keeps the snapshot it runs and only fetches a new one when the atomic generation counter changed, so the hot path no longer locks packetchain_mutex per packet; it releases the snapshot before blocking on an empty queue. process_packet() holds a snapshot while running the postcap chain. remove_handler() then waits until no other thread still holds a replaced snapshot, so the caller can destroy what the handler uses once it returns. Snapshots held by the calling thread (a handler removing itself, e.g. the kismetdb error path) and by other threads waiting in remove_handler() are not waited for. The wait gives up after 5 seconds with an error instead of hanging if a handler is blocked on a lock the caller holds. The pcapppi and wiglecsv logs and the channel tracker removed their handler while holding the lock their handler takes; remove the handler before taking it. Fixes #648.

• Mike Kershaw / Dragorn(04 Oct 26)

  Merge branch 'RFDeck-fix/flipper-alert-shared'

• RFDeck(04 Oct 26)

  phy: share the FLIPPERZERO alert between the Bluetooth and BTLE phys Both kis_bluetooth_phy and kis_btle_phy register the FLIPPERZERO alert. The Bluetooth phy loads first, so the BTLE phy's registration failed ("Tried to re-register duplicate alert FLIPPERZERO" at every start) and left alert_flipper_ref at -1. raise_alert() silently ignores an unknown reference, so a Flipper Zero seen by the BTLE phy (raw BTLE captures) never raised the alert. Look the alert up first and only register it if no phy has yet.

• Mike Kershaw / Dragorn(04 Oct 26)

  Merge branch 'RFDeck-fix/poi-list'

• RFDeck(04 Oct 26)

  kismetdb: return the logged POIs from /poi/list_poi list_poi_endp_handler() always returned an empty vector, so POIs created with /poi/create_poi.cmd could never be read back over the API; they are only stored as POI snapshots in the kismetdb log. Read the POI snapshots of the current log, oldest first, and return them as kismet.poi records with timestamp, location and note. The query runs on the log's own connection, so POIs still in the open transaction are included. With the log closed the list stays empty.

• Mike Kershaw / Dragorn(03 Oct 26)

  Merge branch 'RFDeck-fix/probe-request-last-bssid'

• RFDeck(03 Oct 26)

  dot11: don't let probe traffic overwrite a client's last_bssid The management path set the source device's last_bssid on every management frame, and to an empty MAC when there was no BSSID device. bssid_dev is null for an empty or group BSSID, which is what a probe request carries, so every background scan of an associated client reset its last_bssid to 00:00:00:00:00:00 until the client sent a data frame to the AP again (downlink frames don't restore it). The destination path set last_bssid from every management frame with a BSSID, including probe responses. While a client scans, every AP in range answers, so last_bssid ended up pointing at whichever BSS answered last, one the client never joined and that isn't in its client_map (process_client() already skips probe responses for that reason). Leave last_bssid unchanged for management frames without a usable BSSID and for probe responses. last_bssid now always names a BSS that is also in the device's client_map.

• Mike Kershaw / Dragorn(02 Oct 26)

  Merge branch 'RFDeck-fix/kismetdb-close-race'

• RFDeck(02 Oct 26)

  httpd: honor API token expiration Tokens created with an expiration (/auth/apikey/generate with a duration, or create_auth() with a non-zero expiry) never expired: - the kis_net_beast_auth constructor ignored the expires argument and always stored 0 (never expires), so the token was saved to session.db without an expiration and kept working forever, also across restarts; - is_valid() was inverted and treated an expired token as valid; - check_auth_token() did not check the expiration at all. Store the expiration, fix the comparison in is_valid(), and reject expired tokens (including JWT tokens with an expires claim) in check_auth_token(). store_auth() and load_auth() already drop tokens that are no longer valid.

• Mike Kershaw / Dragorn(02 Oct 26)

  Merge branch 'RFDeck-fix/auth-token-expiry'

• RFDeck(02 Oct 26)

  kismetdb: wait for in-flight writers before closing the log close_log() ran without a lock (the old ds_mutex guard was disabled when the log moved to sqlite's own serialisation), so a packet thread that had already passed the db_enabled check could prepare or step a statement on a database that close_log() had just closed. The periodic transaction and timeout timers used db without any guard as well. Add a lifetime read/write lock: every user of db (log_packet, log_device, log_data, log_datasource, log_alert, log_snapshot, handle_message, the packet drop endpoint and the timers) holds it shared while it uses db and re-checks db_enabled after taking it, so writers still run in parallel. close_log() sets db_enabled = false first, so new writers bail out and the close can't be starved, then takes the lock exclusively, which waits only for the writers in flight; their packets still land in the old file. A db == nullptr check makes a second close (the destructor) harmless. The writers' error paths call close_log() while holding the shared lock; in that case close_log() only marks the close as pending and the writer's guard runs it after releasing the lock. Refs #644

• RFDeck(02 Oct 26)

  httpd: honor API token expiration Tokens created with an expiration (/auth/apikey/generate with a duration, or create_auth() with a non-zero expiry) never expired: - the kis_net_beast_auth constructor ignored the expires argument and always stored 0 (never expires), so the token was saved to session.db without an expiration and kept working forever, also across restarts; - is_valid() was inverted and treated an expired token as valid; - check_auth_token() did not check the expiration at all. Store the expiration, fix the comparison in is_valid(), and reject expired tokens (including JWT tokens with an expires claim) in check_auth_token(). store_auth() and load_auth() already drop tokens that are no longer valid.

• Mike Kershaw / Dragorn(02 Oct 26)

  Merge branch 'RFDeck-fix/device-tag-modtime'

• RFDeck(02 Oct 26)

  devicetracker: add modified-since device endpoints The last-time endpoints return devices by last_time, the time of the last packet, so state changes on a device that is not transmitting (a new tag or user name) never show up for clients polling them. Add /devices/modified-since/:timestamp/devices and /devices/views/:id/modified-since/:timestamp/devices, which work like the last-time endpoints (same regex filter, negative timestamps relative to now) but compare mod_time, which is updated on any change to the device. The last-time endpoints are unchanged. Refs #638

• RFDeck(02 Oct 26)

  linux_wifi: find the wiphy name when it does not start with 'phy' mac80211_find_parent() looked for a directory entry starting with 'phy' under /sys/class/net/<if>/phy80211/device/ieee80211 and returned NULL when the wiphy had been renamed (iw phy ... set name, udev, or mac80211_hwsim radios created with a name). mac80211_get_chanlist() then called strlen() on NULL and the capture helper crashed with SIGSEGV; creating a monitor vif on such a device also failed. Read the wiphy name from /sys/class/net/<if>/phy80211/name first and keep the directory scan as a fallback for older kernels. Also handle a NULL result in mac80211_get_chanlist().

• RFDeck(02 Oct 26)

  trackedlocation: fix samples_1m aggregation The block that cascades samples_10k into samples_1m was copied from the tier below and only partly adapted: it stored the latitude as longitude and the mean timestamp as frequency, and divided the vector sums by the size of samples_100 (harmless, atan2 is scale invariant). Also skip setting the aggregated signal when none of the samples had a signal; signal / num_signal was 0.0 / 0.0, and converting NaN to the int32 signal field is undefined.

• RFDeck(02 Oct 26)

  datasourcetracker: don't close the last source for an unknown UUID close_datasource() assigned every element to kds while searching and never reset it when nothing matched, so for an unknown UUID it closed the last datasource in the list and returned true. Only close on a match.

• RFDeck(02 Oct 26)

  devicetracker: add a route to delete a device tag There was no way to remove a device tag; setting an empty value keeps the tag, which is valid as a content-less flag. Add remove_device_tag() and POST /devices/by-key/:key/delete_tag.cmd (json: tagname), which removes the tag from the device and from the device_tags table and updates mod_time. An unknown tag returns an error.

• Mike Kershaw / Dragorn(02 Oct 26)

  Merge branch 'RFDeck-feat/devices-modified-since'

• RFDeck(02 Oct 26)

  linux_wifi: find the wiphy name when it does not start with 'phy' mac80211_find_parent() looked for a directory entry starting with 'phy' under /sys/class/net/<if>/phy80211/device/ieee80211 and returned NULL when the wiphy had been renamed (iw phy ... set name, udev, or mac80211_hwsim radios created with a name). mac80211_get_chanlist() then called strlen() on NULL and the capture helper crashed with SIGSEGV; creating a monitor vif on such a device also failed. Read the wiphy name from /sys/class/net/<if>/phy80211/name first and keep the directory scan as a fallback for older kernels. Also handle a NULL result in mac80211_get_chanlist().

• Mike Kershaw / Dragorn(02 Oct 26)

  Merge branch 'RFDeck-fix/wifi-phy-name-lookup'

• RFDeck(02 Oct 26)

  devicetracker: add modified-since device endpoints The last-time endpoints return devices by last_time, the time of the last packet, so state changes on a device that is not transmitting (a new tag or user name) never show up for clients polling them. Add /devices/modified-since/:timestamp/devices and /devices/views/:id/modified-since/:timestamp/devices, which work like the last-time endpoints (same regex filter, negative timestamps relative to now) but compare mod_time, which is updated on any change to the device. The last-time endpoints are unchanged. Refs #638

• RFDeck(02 Oct 26)

  linux_wifi: find the wiphy name when it does not start with 'phy' mac80211_find_parent() looked for a directory entry starting with 'phy' under /sys/class/net/<if>/phy80211/device/ieee80211 and returned NULL when the wiphy had been renamed (iw phy ... set name, udev, or mac80211_hwsim radios created with a name). mac80211_get_chanlist() then called strlen() on NULL and the capture helper crashed with SIGSEGV; creating a monitor vif on such a device also failed. Read the wiphy name from /sys/class/net/<if>/phy80211/name first and keep the directory scan as a fallback for older kernels. Also handle a NULL result in mac80211_get_chanlist().

• Mike Kershaw / Dragorn(02 Oct 26)

  Merge branch 'RFDeck-fix/location-history-1m-aggregation'

• RFDeck(02 Oct 26)

  datasourcetracker: don't close the last source for an unknown UUID close_datasource() assigned every element to kds while searching and never reset it when nothing matched, so for an unknown UUID it closed the last datasource in the list and returned true. Only close on a match.

• RFDeck(02 Oct 26)

  devicetracker: add a route to delete a device tag There was no way to remove a device tag; setting an empty value keeps the tag, which is valid as a content-less flag. Add remove_device_tag() and POST /devices/by-key/:key/delete_tag.cmd (json: tagname), which removes the tag from the device and from the device_tags table and updates mod_time. An unknown tag returns an error.

• Mike Kershaw / Dragorn(02 Oct 26)

  Merge branch 'RFDeck-fix/close-datasource-unknown-uuid'

• RFDeck(02 Oct 26)

  devicetracker: add a route to delete a device tag There was no way to remove a device tag; setting an empty value keeps the tag, which is valid as a content-less flag. Add remove_device_tag() and POST /devices/by-key/:key/delete_tag.cmd (json: tagname), which removes the tag from the device and from the device_tags table and updates mod_time. An unknown tag returns an error.

• Mike Kershaw / Dragorn(02 Oct 26)

  Merge branch 'RFDeck-feat/device-tag-delete'