Demo: Linux Goes Apple Picking: Cross-Platform Ad hoc Communication with Apple Wireless Direct Link

TL;DR

This paper reverse engineers Apple's proprietary AWDL protocol, implements a Linux-based prototype, and demonstrates cross-platform ad hoc communication with Apple devices using IPv6 and custom synchronization mechanisms.

Contribution

We provide the first open-source Linux implementation of AWDL, enabling cross-platform ad hoc communication with Apple devices.

Findings

Linux prototype successfully synchronizes with AWDL clusters.

Enables direct IPv6 communication between Linux and Apple devices.

Demonstrates data exchange via ICMPv6 and TCP over AWDL.

Abstract

Apple Wireless Direct Link (AWDL) is a proprietary and undocumented wireless ad hoc protocol that Apple introduced around 2014 and which is the base for applications such as AirDrop and AirPlay. We have reverse engineered the protocol and explain its frame format and operation in our MobiCom '18 paper "One Billion Apples' Secret Sauce: Recipe of the Apple Wireless Direct Link Ad hoc Protocol." AWDL builds on the IEEE 802.11 standard and implements election, synchronization, and channel hopping mechanisms on top of it. Furthermore, AWDL features an IPv6-based data path which enables direct communication. To validate our own work, we implement a working prototype of AWDL on Linux-based systems. Our implementation is written in C, runs in userspace, and makes use of Linux's Netlink API for interactions with the system's networking stack and the pcap library for frame injection and reception. In our demonstrator, we show how our Linux system synchronizes to an existing AWDL cluster or takes over the master role itself. Furthermore, it can receive data frames from and send them to a MacBook or iPhone via AWDL. We demonstrate the data exchange via ICMPv6 echo request and replies as well as sending and receiving data over a TCP connection.

Figures

Full text

To validate our own work, we implement a working prototype of AWDL on Linux-based systems. Our implementation is written in C, runs in userspace, and makes use of Linux’s Netlink API for interactions with the system’s networking stack and the pcap library for frame injection and reception. In our demonstrator, we show how our Linux system synchronizes to an existing AWDL cluster or takes over the master role itself. Furthermore, it can receive data frames from and send them to a MacBook or iPhone via AWDL. We demonstrate the data exchange via ICMPv6 echo request and replies as well as sending and receiving data over a TCP connection.

AWDL, IEEE 802.11, Apple, macOS, iOS, Linux, Netlink

††journalyear: 2018††copyright: rightsretained††conference: The 24th Annual International Conference on Mobile Computing and Networking; October 29–November 2, 2018; New Delhi, India††booktitle: The 24th Annual International Conference on Mobile Computing and Networking (MobiCom ’18), October 29–November 2, 2018, New Delhi, India††price: 15.00††doi: 10.1145/3241539.3267716††isbn: 978-1-4503-5903-0/18/10††ccs: Networks Ad hoc networks††ccs: Networks Link-layer protocols

1. Introduction and Background

New types of proximity-based services such as contactless payment (e. g., NFC), location-aware advertisements (e. g., Bluetooth LE), user-aware security measures (e. g., Apple Auto Unlock), peer-to-peer file transfers (e. g. Apple AirDrop), and media streaming (e. g., Apple AirPlay) have re-ignited the interest in wireless ad hoc communications. One key enabling technologies for such services is AWDL which provides Wi-Fi speed data transfers between neighboring devices but is—unfortunately—only available in Apple devices. In our MobiCom’18 paper (Stute et al., 2018), we investigated the workings of this protocol, released an open source Wireshark dissector (Kreitschmann and Stute, 2018), and conducted a performance evaluation with Apple’s implementations. In this paper, we draw on these findings and present a working prototype of AWDL as a Linux userspace daemon which can take part in the AWDL election and synchronization process, can be discovered by others, and receives and transmits data frames from and to other AWDL devices. Our implementation integrates itself in the Linux networking stack by providing a virtual network interface such that existing IPv6-capable programs can use AWDL without modification. Our setup consists of a Linux-based machine and macOS/iOS devices, and we can show that arbitrary programs (e. g., ping and netcat) successfully run over our AWDL implementation. Our work proves that cross-platform ad hoc communication is feasible and we provide a base for future cross-platform ad hoc applications.

2. Implementation

We implement our prototype in plain C for performance reasons and to facilitate porting the code to other platforms.

2.1. Overview

We depict the architecture and integration of our AWDL daemon in Fig. 1. At its core, the daemon uses an event loop (libuv111http://libuv.org) that

(1) listens on the Wi-Fi interface for new IEEE 802.11 frames using libpcap,222https://github.com/the-tcpdump-group/libpcap

(2) listens on a virtual Ethernet interface for new traffic from the host system, and

(3) periodically schedules the transmission of AWDL action frames that carry information used for peer discovery, synchronization, and election procedures.

When a new Wi-Fi frame is available on the monitoring interface, we check whether the frame is an AWDL action or data frame. Other frames such as regular IEEE 802.11 frames are dropped by a BPF filter that only forwards frames with the AWDL-specific BSSID 00:25:00:ff:94:73. If we receive an action frame, we derive (Hinden and Deering, 2006) a link-local IPv6 address from the source Ethernet address and add both to the system’s neighbor table. Based on the included Type-Length-Value (TLV) fields, we run the election and synchronization mechanisms as described in (Stute et al., 2018). If we receive a data frame, we strip the AWDL data header, replace it with a regular Ethernet header, and forward the frame to the virtual awdl0 interface. We do the inverse for Ethernet frames that we receive from awdl0 and add the AWDL sequence number from an internal counter. In addition, the daemon periodically emits AWDL action frames that it builds from its internal synchronization and election state. We document the complete frame format in our Wireshark dissector (Kreitschmann and Stute, 2018).

2.2. Portability and Future Work

Since our prototype is written in C, it should be possible to port the code to different operating systems. However, we have the following dependencies that each target platform needs to provide:

(1) a Wi-Fi card supporting active monitor mode with frame injection to be able to receive and send IEEE 802.11 frames,

(2) a means to change the Wi-Fi channel such as nl80211,

(3) access to the system’s IPv6 neighbor table, and

(4) a facility to create virtual network interfaces such as TUN/TAP.

In principle, this should allow implementations on Android smartphones where monitor mode and frame injection can be enabled using the Nexmon framework (Schulz et al., 2017). Our prototype currently lacks a channel switching mechanism that would be required to follow nodes to a different channel. However, since AWDL devices usually meet on one social channel (6, 44, or 149), our prototype still works by continually listening on a fixed channel.

2.3. Enabling AWDL in macOS and iOS Third-party Applications

On Linux, every program using sockets can use our awdl0 interface. On macOS, programs must set an XNU-specific SO_RECV_ANYIF333https://opensource.apple.com/source/xnu/xnu-4570.41.2/bsd/sys/socket.h socket option.444The socket option is the “default packet filter” that we discuss in (Stute et al., 2018). Using this option, any software on macOS using sockets can support AWDL, thus, enabling cross-platform applications with minor modifications to the code. As an alternative, programs on macOS and iOS can use the higher-level NetService API (Apple Inc., 2018) which activates mDNS/DNS-SD and establishes TCP connections via the awdl0 interface. We provide an example application implementing a TCP–AWDL proxy (Stute, 2018). For cross-platform communication, the Linux system must support mDNS/DNS-SD, e. g., via avahi.555https://www.avahi.org

3. Demonstrator

We briefly summarize our demonstrator devices, the activities that the attendee can see, and list our requirements for our on-location setup. We show our setup in Fig. 2.

3.1. Devices

Our AWDL implementation runs on an APU board (PC Engines, 2018) with a Qualcomm Atheros AR928X Wi-Fi card which implements the IEEE 802.11n standard and uses the ath9k driver which provides frame injection in monitor mode. We use various Apple devices such as iPhone and MacBook to demonstrate cross-platform communication.

3.2. Activities by Attendee

We can offer to show different aspects of our cross-platform communication depending on the attendees’ demands.

• •

We can show the neighbor tables in both Apple and Linux implementations which contains the AWDL peers if they emit action frames.

• •

We can conduct a Wireshark live capture of AWDL frames and dissect their content. We can then also analyze these capture files w.r.t. election behavior and synchronization accuracy similar to (Stute et al., 2018).

• •

We can send and receive ICMPv6 echo requests and replies by using ping.

• •

We can establish a TCP connection between two AWDL nodes and send messages by using netcat.

• •

We invite attendees to do all of the above with their own macOS or iOS devices as well.

We depict some of the above in Fig. 3 and might offer more activities subject to the results of our ongoing research.

3.3. Requirements at Location

For our demonstrator, we require

(1) a table,

(2) three power outlets with Europlugs next to the table, and

(3) about one hour for the setup.

Acknowledgements.

This work is funded by the LOEWE initiative (Hesse, Germany) within the NICER project and by the German Federal Ministry of Education and Research (BMBF) and the State of Hesse within CRISP-DA.