2 * Received Management frame processing
3 * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
15 #include "utils/includes.h"
17 #include "utils/common.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "crypto/aes_wrap.h"
24 static const char * mgmt_stype(u16 stype)
27 case WLAN_FC_STYPE_ASSOC_REQ:
29 case WLAN_FC_STYPE_ASSOC_RESP:
31 case WLAN_FC_STYPE_REASSOC_REQ:
33 case WLAN_FC_STYPE_REASSOC_RESP:
34 return "REASSOC-RESP";
35 case WLAN_FC_STYPE_PROBE_REQ:
37 case WLAN_FC_STYPE_PROBE_RESP:
39 case WLAN_FC_STYPE_BEACON:
41 case WLAN_FC_STYPE_ATIM:
43 case WLAN_FC_STYPE_DISASSOC:
45 case WLAN_FC_STYPE_AUTH:
47 case WLAN_FC_STYPE_DEAUTH:
49 case WLAN_FC_STYPE_ACTION:
56 static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
58 const struct ieee80211_mgmt *mgmt;
59 struct wlantest_bss *bss;
60 struct ieee802_11_elems elems;
62 mgmt = (const struct ieee80211_mgmt *) data;
63 bss = bss_get(wt, mgmt->bssid);
66 if (bss->proberesp_seen)
67 return; /* do not override with Beacon data */
68 bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
69 if (ieee802_11_parse_elems(mgmt->u.beacon.variable,
70 len - (mgmt->u.beacon.variable - data),
71 &elems, 0) == ParseFailed) {
72 if (bss->parse_error_reported)
74 wpa_printf(MSG_INFO, "Invalid IEs in a Beacon frame from "
75 MACSTR, MAC2STR(mgmt->sa));
76 bss->parse_error_reported = 1;
80 bss_update(wt, bss, &elems);
84 static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
86 const struct ieee80211_mgmt *mgmt;
87 struct wlantest_bss *bss;
88 struct ieee802_11_elems elems;
90 mgmt = (const struct ieee80211_mgmt *) data;
91 bss = bss_get(wt, mgmt->bssid);
95 bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
96 if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
97 len - (mgmt->u.probe_resp.variable - data),
98 &elems, 0) == ParseFailed) {
99 if (bss->parse_error_reported)
101 wpa_printf(MSG_INFO, "Invalid IEs in a Probe Response frame "
102 "from " MACSTR, MAC2STR(mgmt->sa));
103 bss->parse_error_reported = 1;
107 bss_update(wt, bss, &elems);
111 static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
113 const struct ieee80211_mgmt *mgmt;
114 struct wlantest_bss *bss;
115 struct wlantest_sta *sta;
116 u16 alg, trans, status;
118 mgmt = (const struct ieee80211_mgmt *) data;
119 bss = bss_get(wt, mgmt->bssid);
122 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
123 sta = sta_get(bss, mgmt->da);
125 sta = sta_get(bss, mgmt->sa);
130 wpa_printf(MSG_INFO, "Too short Authentication frame from "
131 MACSTR, MAC2STR(mgmt->sa));
135 alg = le_to_host16(mgmt->u.auth.auth_alg);
136 trans = le_to_host16(mgmt->u.auth.auth_transaction);
137 status = le_to_host16(mgmt->u.auth.status_code);
139 wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
140 " (alg=%u trans=%u status=%u)",
141 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
143 if (alg == 0 && trans == 2 && status == 0) {
144 if (sta->state == STATE1) {
145 wpa_printf(MSG_DEBUG, "STA " MACSTR
146 " moved to State 2 with " MACSTR,
147 MAC2STR(sta->addr), MAC2STR(bss->bssid));
154 static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
157 const struct ieee80211_mgmt *mgmt;
158 struct wlantest_bss *bss;
159 struct wlantest_sta *sta;
161 mgmt = (const struct ieee80211_mgmt *) data;
162 bss = bss_get(wt, mgmt->bssid);
165 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
166 sta = sta_get(bss, mgmt->da);
168 sta = sta_get(bss, mgmt->sa);
173 wpa_printf(MSG_INFO, "Too short Deauthentication frame from "
174 MACSTR, MAC2STR(mgmt->sa));
178 wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
180 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
181 le_to_host16(mgmt->u.deauth.reason_code));
182 wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
185 wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
186 "since Disassociation frame was not protected "
187 "correctly", MAC2STR(sta->addr));
191 if (sta->state != STATE1) {
192 wpa_printf(MSG_DEBUG, "STA " MACSTR
193 " moved to State 1 with " MACSTR,
194 MAC2STR(sta->addr), MAC2STR(bss->bssid));
200 static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
202 const struct ieee80211_mgmt *mgmt;
203 struct wlantest_bss *bss;
204 struct wlantest_sta *sta;
205 struct ieee802_11_elems elems;
207 mgmt = (const struct ieee80211_mgmt *) data;
208 bss = bss_get(wt, mgmt->bssid);
211 sta = sta_get(bss, mgmt->sa);
216 wpa_printf(MSG_INFO, "Too short Association Request frame "
217 "from " MACSTR, MAC2STR(mgmt->sa));
221 wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
222 " (capab=0x%x listen_int=%u)",
223 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
224 le_to_host16(mgmt->u.assoc_req.capab_info),
225 le_to_host16(mgmt->u.assoc_req.listen_interval));
227 if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
228 len - (mgmt->u.assoc_req.variable - data),
229 &elems, 0) == ParseFailed) {
230 wpa_printf(MSG_INFO, "Invalid IEs in Association Request "
231 "frame from " MACSTR, MAC2STR(mgmt->sa));
235 sta_update_assoc(sta, &elems);
239 static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
241 const struct ieee80211_mgmt *mgmt;
242 struct wlantest_bss *bss;
243 struct wlantest_sta *sta;
244 u16 capab, status, aid;
246 mgmt = (const struct ieee80211_mgmt *) data;
247 bss = bss_get(wt, mgmt->bssid);
250 sta = sta_get(bss, mgmt->da);
255 wpa_printf(MSG_INFO, "Too short Association Response frame "
256 "from " MACSTR, MAC2STR(mgmt->sa));
260 capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
261 status = le_to_host16(mgmt->u.assoc_resp.status_code);
262 aid = le_to_host16(mgmt->u.assoc_resp.aid);
264 wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
265 " (capab=0x%x status=%u aid=%u)",
266 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
272 if ((aid & 0xc000) != 0xc000) {
273 wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
274 "in Association Response from " MACSTR,
277 sta->aid = aid & 0xc000;
279 if (sta->state < STATE2) {
280 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
281 "getting associated", MAC2STR(sta->addr));
284 if (sta->state < STATE3) {
285 wpa_printf(MSG_DEBUG, "STA " MACSTR
286 " moved to State 3 with " MACSTR,
287 MAC2STR(sta->addr), MAC2STR(bss->bssid));
293 static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
296 const struct ieee80211_mgmt *mgmt;
297 struct wlantest_bss *bss;
298 struct wlantest_sta *sta;
299 struct ieee802_11_elems elems;
301 mgmt = (const struct ieee80211_mgmt *) data;
302 bss = bss_get(wt, mgmt->bssid);
305 sta = sta_get(bss, mgmt->sa);
309 if (len < 24 + 4 + ETH_ALEN) {
310 wpa_printf(MSG_INFO, "Too short Reassociation Request frame "
311 "from " MACSTR, MAC2STR(mgmt->sa));
315 wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
316 " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
317 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
318 le_to_host16(mgmt->u.reassoc_req.capab_info),
319 le_to_host16(mgmt->u.reassoc_req.listen_interval),
320 MAC2STR(mgmt->u.reassoc_req.current_ap));
322 if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
323 len - (mgmt->u.reassoc_req.variable - data),
324 &elems, 0) == ParseFailed) {
325 wpa_printf(MSG_INFO, "Invalid IEs in Reassociation Request "
326 "frame from " MACSTR, MAC2STR(mgmt->sa));
330 sta_update_assoc(sta, &elems);
334 static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
337 const struct ieee80211_mgmt *mgmt;
338 struct wlantest_bss *bss;
339 struct wlantest_sta *sta;
340 u16 capab, status, aid;
342 mgmt = (const struct ieee80211_mgmt *) data;
343 bss = bss_get(wt, mgmt->bssid);
346 sta = sta_get(bss, mgmt->da);
351 wpa_printf(MSG_INFO, "Too short Reassociation Response frame "
352 "from " MACSTR, MAC2STR(mgmt->sa));
356 capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
357 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
358 aid = le_to_host16(mgmt->u.reassoc_resp.aid);
360 wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
361 " (capab=0x%x status=%u aid=%u)",
362 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
368 if ((aid & 0xc000) != 0xc000) {
369 wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
370 "in Reassociation Response from " MACSTR,
373 sta->aid = aid & 0xc000;
375 if (sta->state < STATE2) {
376 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
377 "getting associated", MAC2STR(sta->addr));
380 if (sta->state < STATE3) {
381 wpa_printf(MSG_DEBUG, "STA " MACSTR
382 " moved to State 3 with " MACSTR,
383 MAC2STR(sta->addr), MAC2STR(bss->bssid));
389 static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
392 const struct ieee80211_mgmt *mgmt;
393 struct wlantest_bss *bss;
394 struct wlantest_sta *sta;
396 mgmt = (const struct ieee80211_mgmt *) data;
397 bss = bss_get(wt, mgmt->bssid);
400 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
401 sta = sta_get(bss, mgmt->da);
403 sta = sta_get(bss, mgmt->sa);
408 wpa_printf(MSG_INFO, "Too short Disassociation frame from "
409 MACSTR, MAC2STR(mgmt->sa));
413 wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
415 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
416 le_to_host16(mgmt->u.disassoc.reason_code));
417 wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
420 wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
421 "since Disassociation frame was not protected "
422 "correctly", MAC2STR(sta->addr));
426 if (sta->state < STATE2) {
427 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 or 3 "
428 "when getting disassociated", MAC2STR(sta->addr));
431 if (sta->state > STATE2) {
432 wpa_printf(MSG_DEBUG, "STA " MACSTR
433 " moved to State 2 with " MACSTR,
434 MAC2STR(sta->addr), MAC2STR(bss->bssid));
440 static void rx_mgmt_action_sa_query(struct wlantest *wt,
441 struct wlantest_sta *sta,
442 const struct ieee80211_mgmt *mgmt,
443 size_t len, int valid)
448 if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
449 wpa_printf(MSG_INFO, "Too short SA Query frame from " MACSTR,
454 if (len > 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
455 size_t elen = len - (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN);
456 wpa_printf(MSG_INFO, "Unexpected %u octets of extra data at "
457 "the end of SA Query frame from " MACSTR,
458 (unsigned) elen, MAC2STR(mgmt->sa));
459 wpa_hexdump(MSG_INFO, "SA Query extra data",
460 ((const u8 *) mgmt) + len - elen, elen);
463 switch (mgmt->u.action.u.sa_query_req.action) {
464 case WLAN_SA_QUERY_REQUEST:
465 rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
466 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
467 id = sta->ap_sa_query_tr;
469 id = sta->sta_sa_query_tr;
470 wpa_printf(MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
471 " (trans_id=%02x%02x)%s",
472 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
474 valid ? "" : " (invalid protection)");
475 os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
477 case WLAN_SA_QUERY_RESPONSE:
478 rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
479 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
480 id = sta->sta_sa_query_tr;
482 id = sta->ap_sa_query_tr;
483 wpa_printf(MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
484 " (trans_id=%02x%02x; %s)%s",
485 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
487 os_memcmp(rx_id, id, 2) == 0 ?
488 "match" : "mismatch",
489 valid ? "" : " (invalid protection)");
492 wpa_printf(MSG_INFO, "Unexpected SA Query action value %u "
494 mgmt->u.action.u.sa_query_req.action,
500 static void rx_mgmt_action(struct wlantest *wt, const u8 *data, size_t len,
503 const struct ieee80211_mgmt *mgmt;
504 struct wlantest_bss *bss;
505 struct wlantest_sta *sta;
507 mgmt = (const struct ieee80211_mgmt *) data;
508 if (mgmt->da[0] & 0x01)
509 return; /* Ignore group addressed Action frames for now */
510 bss = bss_get(wt, mgmt->bssid);
513 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
514 sta = sta_get(bss, mgmt->da);
516 sta = sta_get(bss, mgmt->sa);
521 wpa_printf(MSG_INFO, "Too short Action frame from "
522 MACSTR, MAC2STR(mgmt->sa));
526 wpa_printf(MSG_DEBUG, "ACTION " MACSTR " -> " MACSTR
527 " (category=%u) (valid=%d)",
528 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
529 mgmt->u.action.category, valid);
530 wpa_hexdump(MSG_MSGDUMP, "ACTION payload", data + 24, len - 24);
532 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
533 sta->state < STATE3) {
534 wpa_printf(MSG_INFO, "Action frame sent when STA is not in "
535 "State 3 (SA=" MACSTR " DATA=" MACSTR ")",
536 MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
539 switch (mgmt->u.action.category) {
540 case WLAN_ACTION_SA_QUERY:
541 rx_mgmt_action_sa_query(wt, sta, mgmt, len, valid);
547 static int check_mmie_mic(const u8 *igtk, const u8 *data, size_t len)
552 const struct ieee80211_hdr *hdr;
554 buf = os_malloc(len + 20 - 24);
558 /* BIP AAD: FC(masked) A1 A2 A3 */
559 hdr = (const struct ieee80211_hdr *) data;
560 fc = le_to_host16(hdr->frame_control);
561 fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
562 WPA_PUT_LE16(buf, fc);
563 os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
565 /* Frame body with MMIE MIC masked to zero */
566 os_memcpy(buf + 20, data + 24, len - 24 - 8);
567 os_memset(buf + 20 + len - 24 - 8, 0, 8);
569 wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
570 /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
571 if (omac1_aes_128(igtk, buf, len + 20 - 24, mic) < 0) {
578 if (os_memcmp(data + len - 8, mic, 8) != 0)
585 static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
587 const struct ieee80211_mgmt *mgmt;
591 struct wlantest_bss *bss;
593 mgmt = (const struct ieee80211_mgmt *) data;
594 fc = le_to_host16(mgmt->frame_control);
595 stype = WLAN_FC_GET_STYPE(fc);
597 if (stype == WLAN_FC_STYPE_ACTION) {
600 if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
601 return 0; /* Not a robust management frame */
604 bss = bss_get(wt, mgmt->bssid);
606 return 0; /* No key known yet */
608 if (len < 24 + 18 || data[len - 18] != WLAN_EID_MMIE ||
609 data[len - 17] != 16) {
611 if (bss->rsn_capab & WPA_CAPABILITY_MFPC) {
612 wpa_printf(MSG_INFO, "Robust group-addressed "
613 "management frame sent without BIP by "
614 MACSTR, MAC2STR(mgmt->sa));
620 mmie = data + len - 16;
621 keyid = WPA_GET_LE16(mmie);
622 if (keyid < 4 || keyid > 5) {
623 wpa_printf(MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
624 keyid, MAC2STR(mgmt->sa));
627 wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
628 wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
629 wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, 8);
631 if (!bss->igtk_set[keyid]) {
632 wpa_printf(MSG_DEBUG, "No IGTK known to validate BIP frame");
636 if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
637 wpa_printf(MSG_INFO, "BIP replay detected: SA=" MACSTR,
639 wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
640 wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
643 if (check_mmie_mic(bss->igtk[keyid], data, len) < 0) {
644 wpa_printf(MSG_INFO, "Invalid MMIE MIC in a frame from "
645 MACSTR, MAC2STR(mgmt->sa));
649 wpa_printf(MSG_DEBUG, "Valid MMIE MIC");
650 os_memcpy(bss->ipn[keyid], mmie + 2, 6);
656 static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
659 struct wlantest_bss *bss;
660 struct wlantest_sta *sta;
661 const struct ieee80211_hdr *hdr;
663 u8 *decrypted, *frame;
666 hdr = (const struct ieee80211_hdr *) data;
667 bss = bss_get(wt, hdr->addr3);
670 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
671 sta = sta_get(bss, hdr->addr2);
673 sta = sta_get(bss, hdr->addr1);
674 if (sta == NULL || !sta->ptk_set) {
675 wpa_printf(MSG_MSGDUMP, "No PTK known to decrypt the frame");
679 keyid = data[3] >> 6;
681 wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
682 "individually addressed Management frame from "
683 MACSTR, keyid, MAC2STR(hdr->addr2));
686 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
687 rsc = sta->rsc_tods[16];
689 rsc = sta->rsc_fromds[16];
691 ccmp_get_pn(pn, data + 24);
692 if (os_memcmp(pn, rsc, 6) <= 0) {
693 wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: SA=" MACSTR,
694 MAC2STR(hdr->addr2));
695 wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
696 wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
699 decrypted = ccmp_decrypt(sta->ptk.tk1, hdr, data + 24, len - 24, dlen);
701 os_memcpy(rsc, pn, 6);
703 frame = os_malloc(24 + *dlen);
705 os_memcpy(frame, data, 24);
706 os_memcpy(frame + 24, decrypted, *dlen);
716 static int check_mgmt_ccmp(struct wlantest *wt, const u8 *data, size_t len)
718 const struct ieee80211_mgmt *mgmt;
720 struct wlantest_bss *bss;
721 struct wlantest_sta *sta;
723 mgmt = (const struct ieee80211_mgmt *) data;
724 fc = le_to_host16(mgmt->frame_control);
726 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
728 mgmt->u.action.category == WLAN_ACTION_PUBLIC)
729 return 0; /* Not a robust management frame */
732 bss = bss_get(wt, mgmt->bssid);
735 if (os_memcmp(mgmt->da, mgmt->bssid, ETH_ALEN) == 0)
736 sta = sta_get(bss, mgmt->sa);
738 sta = sta_get(bss, mgmt->da);
742 if (sta->rsn_capab & WPA_CAPABILITY_MFPC) {
743 wpa_printf(MSG_INFO, "Robust individually-addressed "
744 "management frame sent without CCMP by "
745 MACSTR, MAC2STR(mgmt->sa));
753 void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
755 const struct ieee80211_hdr *hdr;
758 u8 *decrypted = NULL;
764 hdr = (const struct ieee80211_hdr *) data;
765 fc = le_to_host16(hdr->frame_control);
767 stype = WLAN_FC_GET_STYPE(fc);
769 if ((hdr->addr1[0] & 0x01) &&
770 (stype == WLAN_FC_STYPE_DEAUTH ||
771 stype == WLAN_FC_STYPE_DISASSOC ||
772 stype == WLAN_FC_STYPE_ACTION)) {
773 if (check_bip(wt, data, len) < 0)
777 wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
778 stype == WLAN_FC_STYPE_PROBE_RESP ||
779 stype == WLAN_FC_STYPE_PROBE_REQ) ?
780 MSG_EXCESSIVE : MSG_MSGDUMP,
781 "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
783 fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
784 fc & WLAN_FC_ISWEP ? " Prot" : "",
785 MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
786 MAC2STR(hdr->addr3));
788 if ((fc & WLAN_FC_ISWEP) &&
789 !(hdr->addr1[0] & 0x01) &&
790 (stype == WLAN_FC_STYPE_DEAUTH ||
791 stype == WLAN_FC_STYPE_DISASSOC ||
792 stype == WLAN_FC_STYPE_ACTION)) {
793 decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
795 write_pcap_decrypted(wt, decrypted, dlen, NULL, 0);
802 if (!(fc & WLAN_FC_ISWEP) &&
803 !(hdr->addr1[0] & 0x01) &&
804 (stype == WLAN_FC_STYPE_DEAUTH ||
805 stype == WLAN_FC_STYPE_DISASSOC ||
806 stype == WLAN_FC_STYPE_ACTION)) {
807 if (check_mgmt_ccmp(wt, data, len) < 0)
812 case WLAN_FC_STYPE_BEACON:
813 rx_mgmt_beacon(wt, data, len);
815 case WLAN_FC_STYPE_PROBE_RESP:
816 rx_mgmt_probe_resp(wt, data, len);
818 case WLAN_FC_STYPE_AUTH:
819 rx_mgmt_auth(wt, data, len);
821 case WLAN_FC_STYPE_DEAUTH:
822 rx_mgmt_deauth(wt, data, len, valid);
824 case WLAN_FC_STYPE_ASSOC_REQ:
825 rx_mgmt_assoc_req(wt, data, len);
827 case WLAN_FC_STYPE_ASSOC_RESP:
828 rx_mgmt_assoc_resp(wt, data, len);
830 case WLAN_FC_STYPE_REASSOC_REQ:
831 rx_mgmt_reassoc_req(wt, data, len);
833 case WLAN_FC_STYPE_REASSOC_RESP:
834 rx_mgmt_reassoc_resp(wt, data, len);
836 case WLAN_FC_STYPE_DISASSOC:
837 rx_mgmt_disassoc(wt, data, len, valid);
839 case WLAN_FC_STYPE_ACTION:
840 rx_mgmt_action(wt, data, len, valid);