fix: do not save dummy/invalid half handshakes

This commit is contained in:
Simone Margaritelli 2019-10-26 10:16:40 +02:00
commit 4069887cf6

View file

@ -99,9 +99,14 @@ func (mod *WiFiModule) discoverHandshakes(radiotap *layers.RadioTap, dot11 *laye
} }
} }
// if we had unsaved packets and either the handshake is half, complete validPMKID := rawPMKID != nil
// or it contains the PMKID, generate a new event. validHalfHandshake := !staIsUs && station.Handshake.Half()
if doSave && (rawPMKID != nil || station.Handshake.Half() || station.Handshake.Complete()) { validFullHandshake := station.Handshake.Complete()
// if we have unsaved packets AND
// if we captured a PMKID OR
// if we captured am half handshake which is not ours OR
// if we captured a full handshake
if doSave && (validPMKID || validHalfHandshake || validFullHandshake) {
mod.Session.Events.Add("wifi.client.handshake", HandshakeEvent{ mod.Session.Events.Add("wifi.client.handshake", HandshakeEvent{
File: shakesFileName, File: shakesFileName,
NewPackets: numUnsaved, NewPackets: numUnsaved,