2 * Received Management frame processing
3 * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
15 #include "utils/includes.h"
17 #include "utils/common.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "crypto/aes_wrap.h"
24 static const char * mgmt_stype(u16 stype)
27 case WLAN_FC_STYPE_ASSOC_REQ:
29 case WLAN_FC_STYPE_ASSOC_RESP:
31 case WLAN_FC_STYPE_REASSOC_REQ:
33 case WLAN_FC_STYPE_REASSOC_RESP:
34 return "REASSOC-RESP";
35 case WLAN_FC_STYPE_PROBE_REQ:
37 case WLAN_FC_STYPE_PROBE_RESP:
39 case WLAN_FC_STYPE_BEACON:
41 case WLAN_FC_STYPE_ATIM:
43 case WLAN_FC_STYPE_DISASSOC:
45 case WLAN_FC_STYPE_AUTH:
47 case WLAN_FC_STYPE_DEAUTH:
49 case WLAN_FC_STYPE_ACTION:
56 static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
58 const struct ieee80211_mgmt *mgmt;
59 struct wlantest_bss *bss;
60 struct ieee802_11_elems elems;
62 mgmt = (const struct ieee80211_mgmt *) data;
63 bss = bss_get(wt, mgmt->bssid);
66 if (bss->proberesp_seen)
67 return; /* do not override with Beacon data */
68 bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
69 if (ieee802_11_parse_elems(mgmt->u.beacon.variable,
70 len - (mgmt->u.beacon.variable - data),
71 &elems, 0) == ParseFailed) {
72 if (bss->parse_error_reported)
74 wpa_printf(MSG_INFO, "Invalid IEs in a Beacon frame from "
75 MACSTR, MAC2STR(mgmt->sa));
76 bss->parse_error_reported = 1;
80 bss_update(wt, bss, &elems);
84 static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
86 const struct ieee80211_mgmt *mgmt;
87 struct wlantest_bss *bss;
88 struct ieee802_11_elems elems;
90 mgmt = (const struct ieee80211_mgmt *) data;
91 bss = bss_get(wt, mgmt->bssid);
95 bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
96 if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
97 len - (mgmt->u.probe_resp.variable - data),
98 &elems, 0) == ParseFailed) {
99 if (bss->parse_error_reported)
101 wpa_printf(MSG_INFO, "Invalid IEs in a Probe Response frame "
102 "from " MACSTR, MAC2STR(mgmt->sa));
103 bss->parse_error_reported = 1;
107 bss_update(wt, bss, &elems);
111 static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
113 const struct ieee80211_mgmt *mgmt;
114 struct wlantest_bss *bss;
115 struct wlantest_sta *sta;
116 u16 alg, trans, status;
118 mgmt = (const struct ieee80211_mgmt *) data;
119 bss = bss_get(wt, mgmt->bssid);
122 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
123 sta = sta_get(bss, mgmt->da);
125 sta = sta_get(bss, mgmt->sa);
130 wpa_printf(MSG_INFO, "Too short Authentication frame from "
131 MACSTR, MAC2STR(mgmt->sa));
135 alg = le_to_host16(mgmt->u.auth.auth_alg);
136 trans = le_to_host16(mgmt->u.auth.auth_transaction);
137 status = le_to_host16(mgmt->u.auth.status_code);
139 wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
140 " (alg=%u trans=%u status=%u)",
141 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
143 if (alg == 0 && trans == 2 && status == 0) {
144 if (sta->state == STATE1) {
145 wpa_printf(MSG_DEBUG, "STA " MACSTR
146 " moved to State 2 with " MACSTR,
147 MAC2STR(sta->addr), MAC2STR(bss->bssid));
154 static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
157 const struct ieee80211_mgmt *mgmt;
158 struct wlantest_bss *bss;
159 struct wlantest_sta *sta;
161 mgmt = (const struct ieee80211_mgmt *) data;
162 bss = bss_get(wt, mgmt->bssid);
165 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
166 sta = sta_get(bss, mgmt->da);
168 sta = sta_get(bss, mgmt->sa);
173 wpa_printf(MSG_INFO, "Too short Deauthentication frame from "
174 MACSTR, MAC2STR(mgmt->sa));
178 wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
180 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
181 le_to_host16(mgmt->u.deauth.reason_code));
182 wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
185 wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
186 "since Disassociation frame was not protected "
187 "correctly", MAC2STR(sta->addr));
191 if (sta->state != STATE1) {
192 wpa_printf(MSG_DEBUG, "STA " MACSTR
193 " moved to State 1 with " MACSTR,
194 MAC2STR(sta->addr), MAC2STR(bss->bssid));
200 static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
202 const struct ieee80211_mgmt *mgmt;
203 struct wlantest_bss *bss;
204 struct wlantest_sta *sta;
205 struct ieee802_11_elems elems;
207 mgmt = (const struct ieee80211_mgmt *) data;
208 bss = bss_get(wt, mgmt->bssid);
211 sta = sta_get(bss, mgmt->sa);
216 wpa_printf(MSG_INFO, "Too short Association Request frame "
217 "from " MACSTR, MAC2STR(mgmt->sa));
221 wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
222 " (capab=0x%x listen_int=%u)",
223 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
224 le_to_host16(mgmt->u.assoc_req.capab_info),
225 le_to_host16(mgmt->u.assoc_req.listen_interval));
227 if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
228 len - (mgmt->u.assoc_req.variable - data),
229 &elems, 0) == ParseFailed) {
230 wpa_printf(MSG_INFO, "Invalid IEs in Association Request "
231 "frame from " MACSTR, MAC2STR(mgmt->sa));
235 sta_update_assoc(sta, &elems);
239 static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
241 const struct ieee80211_mgmt *mgmt;
242 struct wlantest_bss *bss;
243 struct wlantest_sta *sta;
244 u16 capab, status, aid;
246 mgmt = (const struct ieee80211_mgmt *) data;
247 bss = bss_get(wt, mgmt->bssid);
250 sta = sta_get(bss, mgmt->da);
255 wpa_printf(MSG_INFO, "Too short Association Response frame "
256 "from " MACSTR, MAC2STR(mgmt->sa));
260 capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
261 status = le_to_host16(mgmt->u.assoc_resp.status_code);
262 aid = le_to_host16(mgmt->u.assoc_resp.aid);
264 wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
265 " (capab=0x%x status=%u aid=%u)",
266 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
272 if ((aid & 0xc000) != 0xc000) {
273 wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
274 "in Association Response from " MACSTR,
277 sta->aid = aid & 0xc000;
279 if (sta->state < STATE2) {
280 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
281 "getting associated", MAC2STR(sta->addr));
284 if (sta->state < STATE3) {
285 wpa_printf(MSG_DEBUG, "STA " MACSTR
286 " moved to State 3 with " MACSTR,
287 MAC2STR(sta->addr), MAC2STR(bss->bssid));
293 static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
296 const struct ieee80211_mgmt *mgmt;
297 struct wlantest_bss *bss;
298 struct wlantest_sta *sta;
299 struct ieee802_11_elems elems;
301 mgmt = (const struct ieee80211_mgmt *) data;
302 bss = bss_get(wt, mgmt->bssid);
305 sta = sta_get(bss, mgmt->sa);
309 if (len < 24 + 4 + ETH_ALEN) {
310 wpa_printf(MSG_INFO, "Too short Reassociation Request frame "
311 "from " MACSTR, MAC2STR(mgmt->sa));
315 wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
316 " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
317 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
318 le_to_host16(mgmt->u.reassoc_req.capab_info),
319 le_to_host16(mgmt->u.reassoc_req.listen_interval),
320 MAC2STR(mgmt->u.reassoc_req.current_ap));
322 if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
323 len - (mgmt->u.reassoc_req.variable - data),
324 &elems, 0) == ParseFailed) {
325 wpa_printf(MSG_INFO, "Invalid IEs in Reassociation Request "
326 "frame from " MACSTR, MAC2STR(mgmt->sa));
330 sta_update_assoc(sta, &elems);
334 static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
337 const struct ieee80211_mgmt *mgmt;
338 struct wlantest_bss *bss;
339 struct wlantest_sta *sta;
340 u16 capab, status, aid;
342 mgmt = (const struct ieee80211_mgmt *) data;
343 bss = bss_get(wt, mgmt->bssid);
346 sta = sta_get(bss, mgmt->da);
351 wpa_printf(MSG_INFO, "Too short Reassociation Response frame "
352 "from " MACSTR, MAC2STR(mgmt->sa));
356 capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
357 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
358 aid = le_to_host16(mgmt->u.reassoc_resp.aid);
360 wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
361 " (capab=0x%x status=%u aid=%u)",
362 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
368 if ((aid & 0xc000) != 0xc000) {
369 wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
370 "in Reassociation Response from " MACSTR,
373 sta->aid = aid & 0xc000;
375 if (sta->state < STATE2) {
376 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
377 "getting associated", MAC2STR(sta->addr));
380 if (sta->state < STATE3) {
381 wpa_printf(MSG_DEBUG, "STA " MACSTR
382 " moved to State 3 with " MACSTR,
383 MAC2STR(sta->addr), MAC2STR(bss->bssid));
389 static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
392 const struct ieee80211_mgmt *mgmt;
393 struct wlantest_bss *bss;
394 struct wlantest_sta *sta;
396 mgmt = (const struct ieee80211_mgmt *) data;
397 bss = bss_get(wt, mgmt->bssid);
400 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
401 sta = sta_get(bss, mgmt->da);
403 sta = sta_get(bss, mgmt->sa);
408 wpa_printf(MSG_INFO, "Too short Disassociation frame from "
409 MACSTR, MAC2STR(mgmt->sa));
413 wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
415 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
416 le_to_host16(mgmt->u.disassoc.reason_code));
417 wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
420 wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
421 "since Disassociation frame was not protected "
422 "correctly", MAC2STR(sta->addr));
426 if (sta->state < STATE2) {
427 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 or 3 "
428 "when getting disassociated", MAC2STR(sta->addr));
431 if (sta->state > STATE2) {
432 wpa_printf(MSG_DEBUG, "STA " MACSTR
433 " moved to State 2 with " MACSTR,
434 MAC2STR(sta->addr), MAC2STR(bss->bssid));
440 static int check_mmie_mic(const u8 *igtk, const u8 *data, size_t len)
445 const struct ieee80211_hdr *hdr;
447 buf = os_malloc(len + 20 - 24);
451 /* BIP AAD: FC(masked) A1 A2 A3 */
452 hdr = (const struct ieee80211_hdr *) data;
453 fc = le_to_host16(hdr->frame_control);
454 fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
455 WPA_PUT_LE16(buf, fc);
456 os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
458 /* Frame body with MMIE MIC masked to zero */
459 os_memcpy(buf + 20, data + 24, len - 24 - 8);
460 os_memset(buf + 20 + len - 24 - 8, 0, 8);
462 wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
463 /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
464 if (omac1_aes_128(igtk, buf, len + 20 - 24, mic) < 0) {
471 if (os_memcmp(data + len - 8, mic, 8) != 0)
478 static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
480 const struct ieee80211_mgmt *mgmt;
484 struct wlantest_bss *bss;
486 mgmt = (const struct ieee80211_mgmt *) data;
487 fc = le_to_host16(mgmt->frame_control);
488 stype = WLAN_FC_GET_STYPE(fc);
490 if (stype == WLAN_FC_STYPE_ACTION) {
493 if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
494 return 0; /* Not a robust management frame */
497 bss = bss_get(wt, mgmt->bssid);
499 return 0; /* No key known yet */
501 if (len < 24 + 18 || data[len - 18] != WLAN_EID_MMIE ||
502 data[len - 17] != 16) {
504 /* TODO: use MFPC flag in RSN IE instead of IGTK flags */
505 if (bss->igtk_set[4] || bss->igtk_set[5]) {
506 wpa_printf(MSG_INFO, "Robust group-addressed "
507 "management frame sent without BIP by "
508 MACSTR, MAC2STR(mgmt->sa));
514 mmie = data + len - 16;
515 keyid = WPA_GET_LE16(mmie);
516 if (keyid < 4 || keyid > 5) {
517 wpa_printf(MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
518 keyid, MAC2STR(mgmt->sa));
521 wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
522 wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
523 wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, 8);
525 if (!bss->igtk_set[keyid]) {
526 wpa_printf(MSG_DEBUG, "No IGTK known to validate BIP frame");
530 if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
531 wpa_printf(MSG_INFO, "BIP replay detected: SA=" MACSTR,
533 wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
534 wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
537 if (check_mmie_mic(bss->igtk[keyid], data, len) < 0) {
538 wpa_printf(MSG_INFO, "Invalid MMIE MIC in a frame from "
539 MACSTR, MAC2STR(mgmt->sa));
543 wpa_printf(MSG_DEBUG, "Valid MMIE MIC");
544 os_memcpy(bss->ipn[keyid], mmie + 2, 6);
550 static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
553 struct wlantest_bss *bss;
554 struct wlantest_sta *sta;
555 const struct ieee80211_hdr *hdr;
557 u8 *decrypted, *frame;
560 hdr = (const struct ieee80211_hdr *) data;
561 bss = bss_get(wt, hdr->addr3);
564 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
565 sta = sta_get(bss, hdr->addr2);
567 sta = sta_get(bss, hdr->addr1);
568 if (sta == NULL || !sta->ptk_set) {
569 wpa_printf(MSG_MSGDUMP, "No PTK known to decrypt the frame");
573 keyid = data[3] >> 6;
575 wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
576 "individually addressed Management frame from "
577 MACSTR, keyid, MAC2STR(hdr->addr2));
580 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
581 rsc = sta->rsc_tods[16];
583 rsc = sta->rsc_fromds[16];
585 ccmp_get_pn(pn, data);
586 if (os_memcmp(pn, rsc, 6) <= 0) {
587 wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: SA=" MACSTR,
588 MAC2STR(hdr->addr2));
589 wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
590 wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
593 decrypted = ccmp_decrypt(sta->ptk.tk1, hdr, data + 24, len - 24, dlen);
595 os_memcpy(rsc, pn, 6);
597 frame = os_malloc(24 + *dlen);
599 os_memcpy(frame, data, 24);
600 os_memcpy(frame + 24, decrypted, *dlen);
610 void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
612 const struct ieee80211_hdr *hdr;
615 u8 *decrypted = NULL;
621 hdr = (const struct ieee80211_hdr *) data;
622 fc = le_to_host16(hdr->frame_control);
624 stype = WLAN_FC_GET_STYPE(fc);
626 if ((hdr->addr1[0] & 0x01) &&
627 (stype == WLAN_FC_STYPE_DEAUTH ||
628 stype == WLAN_FC_STYPE_DISASSOC ||
629 stype == WLAN_FC_STYPE_ACTION))
630 check_bip(wt, data, len);
632 wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
633 stype == WLAN_FC_STYPE_PROBE_RESP ||
634 stype == WLAN_FC_STYPE_PROBE_REQ) ?
635 MSG_EXCESSIVE : MSG_MSGDUMP,
636 "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
638 fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
639 fc & WLAN_FC_ISWEP ? " Prot" : "",
640 MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
641 MAC2STR(hdr->addr3));
643 if ((fc & WLAN_FC_ISWEP) &&
644 !(hdr->addr1[0] & 0x01) &&
645 (stype == WLAN_FC_STYPE_DEAUTH ||
646 stype == WLAN_FC_STYPE_DISASSOC ||
647 stype == WLAN_FC_STYPE_ACTION)) {
648 decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
658 case WLAN_FC_STYPE_BEACON:
659 rx_mgmt_beacon(wt, data, len);
661 case WLAN_FC_STYPE_PROBE_RESP:
662 rx_mgmt_probe_resp(wt, data, len);
664 case WLAN_FC_STYPE_AUTH:
665 rx_mgmt_auth(wt, data, len);
667 case WLAN_FC_STYPE_DEAUTH:
668 rx_mgmt_deauth(wt, data, len, valid);
670 case WLAN_FC_STYPE_ASSOC_REQ:
671 rx_mgmt_assoc_req(wt, data, len);
673 case WLAN_FC_STYPE_ASSOC_RESP:
674 rx_mgmt_assoc_resp(wt, data, len);
676 case WLAN_FC_STYPE_REASSOC_REQ:
677 rx_mgmt_reassoc_req(wt, data, len);
679 case WLAN_FC_STYPE_REASSOC_RESP:
680 rx_mgmt_reassoc_resp(wt, data, len);
682 case WLAN_FC_STYPE_DISASSOC:
683 rx_mgmt_disassoc(wt, data, len, valid);