2 * Received Management frame processing
3 * Copyright (c) 2010-2015, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #include "utils/includes.h"
11 #include "utils/common.h"
12 #include "common/defs.h"
13 #include "common/ieee802_11_defs.h"
14 #include "common/ieee802_11_common.h"
15 #include "crypto/aes_wrap.h"
19 static const char * mgmt_stype(u16 stype)
22 case WLAN_FC_STYPE_ASSOC_REQ:
24 case WLAN_FC_STYPE_ASSOC_RESP:
26 case WLAN_FC_STYPE_REASSOC_REQ:
28 case WLAN_FC_STYPE_REASSOC_RESP:
29 return "REASSOC-RESP";
30 case WLAN_FC_STYPE_PROBE_REQ:
32 case WLAN_FC_STYPE_PROBE_RESP:
34 case WLAN_FC_STYPE_BEACON:
36 case WLAN_FC_STYPE_ATIM:
38 case WLAN_FC_STYPE_DISASSOC:
40 case WLAN_FC_STYPE_AUTH:
42 case WLAN_FC_STYPE_DEAUTH:
44 case WLAN_FC_STYPE_ACTION:
51 static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
53 const struct ieee80211_mgmt *mgmt;
54 struct wlantest_bss *bss;
55 struct ieee802_11_elems elems;
58 mgmt = (const struct ieee80211_mgmt *) data;
59 offset = mgmt->u.beacon.variable - data;
62 bss = bss_get(wt, mgmt->bssid);
65 if (bss->proberesp_seen)
66 return; /* do not override with Beacon data */
67 bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
68 if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - offset,
69 &elems, 0) == ParseFailed) {
70 if (bss->parse_error_reported)
72 add_note(wt, MSG_INFO, "Invalid IEs in a Beacon frame from "
73 MACSTR, MAC2STR(mgmt->sa));
74 bss->parse_error_reported = 1;
78 bss_update(wt, bss, &elems);
82 static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
84 const struct ieee80211_mgmt *mgmt;
85 struct wlantest_bss *bss;
86 struct ieee802_11_elems elems;
89 mgmt = (const struct ieee80211_mgmt *) data;
90 offset = mgmt->u.probe_resp.variable - data;
93 bss = bss_get(wt, mgmt->bssid);
97 bss->counters[WLANTEST_BSS_COUNTER_PROBE_RESPONSE]++;
98 bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
99 if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - offset,
100 &elems, 0) == ParseFailed) {
101 if (bss->parse_error_reported)
103 add_note(wt, MSG_INFO, "Invalid IEs in a Probe Response frame "
104 "from " MACSTR, MAC2STR(mgmt->sa));
105 bss->parse_error_reported = 1;
109 bss_update(wt, bss, &elems);
113 static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
115 const struct ieee80211_mgmt *mgmt;
116 struct wlantest_bss *bss;
117 struct wlantest_sta *sta;
118 u16 alg, trans, status;
120 mgmt = (const struct ieee80211_mgmt *) data;
121 bss = bss_get(wt, mgmt->bssid);
124 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
125 sta = sta_get(bss, mgmt->da);
127 sta = sta_get(bss, mgmt->sa);
132 add_note(wt, MSG_INFO, "Too short Authentication frame from "
133 MACSTR, MAC2STR(mgmt->sa));
137 alg = le_to_host16(mgmt->u.auth.auth_alg);
138 trans = le_to_host16(mgmt->u.auth.auth_transaction);
139 status = le_to_host16(mgmt->u.auth.status_code);
141 wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
142 " (alg=%u trans=%u status=%u)",
143 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
145 if (alg == 0 && trans == 2 && status == 0) {
146 if (sta->state == STATE1) {
147 add_note(wt, MSG_DEBUG, "STA " MACSTR
148 " moved to State 2 with " MACSTR,
149 MAC2STR(sta->addr), MAC2STR(bss->bssid));
154 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
155 sta->counters[WLANTEST_STA_COUNTER_AUTH_RX]++;
157 sta->counters[WLANTEST_STA_COUNTER_AUTH_TX]++;
161 static void deauth_all_stas(struct wlantest *wt, struct wlantest_bss *bss)
163 struct wlantest_sta *sta;
164 dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
165 if (sta->state == STATE1)
167 add_note(wt, MSG_DEBUG, "STA " MACSTR
168 " moved to State 1 with " MACSTR,
169 MAC2STR(sta->addr), MAC2STR(bss->bssid));
175 static void tdls_link_down(struct wlantest *wt, struct wlantest_bss *bss,
176 struct wlantest_sta *sta)
178 struct wlantest_tdls *tdls;
179 dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list) {
180 if ((tdls->init == sta || tdls->resp == sta) && tdls->link_up)
182 add_note(wt, MSG_DEBUG, "TDLS: Set link down based on "
183 "STA deauth/disassoc");
190 static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
193 const struct ieee80211_mgmt *mgmt;
194 struct wlantest_bss *bss;
195 struct wlantest_sta *sta;
198 mgmt = (const struct ieee80211_mgmt *) data;
199 bss = bss_get(wt, mgmt->bssid);
202 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
203 sta = sta_get(bss, mgmt->da);
205 sta = sta_get(bss, mgmt->sa);
208 add_note(wt, MSG_INFO, "Too short Deauthentication frame from "
209 MACSTR, MAC2STR(mgmt->sa));
213 reason = le_to_host16(mgmt->u.deauth.reason_code);
214 wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
215 " (reason=%u) (valid=%d)",
216 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
218 wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
221 if (valid && mgmt->da[0] == 0xff)
222 deauth_all_stas(wt, bss);
226 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
227 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_RX :
228 WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX]++;
229 if (sta->pwrmgt && !sta->pspoll)
230 sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_ASLEEP]++;
232 sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_AWAKE]++;
234 fc = le_to_host16(mgmt->frame_control);
235 if (!(fc & WLAN_FC_ISWEP) && reason == 6)
236 sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_RC6]++;
237 else if (!(fc & WLAN_FC_ISWEP) && reason == 7)
238 sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_RC7]++;
240 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_TX :
241 WLANTEST_STA_COUNTER_INVALID_DEAUTH_TX]++;
244 add_note(wt, MSG_INFO, "Do not change STA " MACSTR " State "
245 "since Disassociation frame was not protected "
246 "correctly", MAC2STR(sta->addr));
250 if (sta->state != STATE1) {
251 add_note(wt, MSG_DEBUG, "STA " MACSTR
252 " moved to State 1 with " MACSTR,
253 MAC2STR(sta->addr), MAC2STR(bss->bssid));
256 tdls_link_down(wt, bss, sta);
260 static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
262 const struct ieee80211_mgmt *mgmt;
263 struct wlantest_bss *bss;
264 struct wlantest_sta *sta;
265 struct ieee802_11_elems elems;
267 mgmt = (const struct ieee80211_mgmt *) data;
268 bss = bss_get(wt, mgmt->bssid);
271 sta = sta_get(bss, mgmt->sa);
276 add_note(wt, MSG_INFO, "Too short Association Request frame "
277 "from " MACSTR, MAC2STR(mgmt->sa));
281 wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
282 " (capab=0x%x listen_int=%u)",
283 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
284 le_to_host16(mgmt->u.assoc_req.capab_info),
285 le_to_host16(mgmt->u.assoc_req.listen_interval));
287 sta->counters[WLANTEST_STA_COUNTER_ASSOCREQ_TX]++;
289 if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
290 len - (mgmt->u.assoc_req.variable - data),
291 &elems, 0) == ParseFailed) {
292 add_note(wt, MSG_INFO, "Invalid IEs in Association Request "
293 "frame from " MACSTR, MAC2STR(mgmt->sa));
297 sta->assocreq_capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
298 sta->assocreq_listen_int =
299 le_to_host16(mgmt->u.assoc_req.listen_interval);
300 os_free(sta->assocreq_ies);
301 sta->assocreq_ies_len = len - (mgmt->u.assoc_req.variable - data);
302 sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
303 if (sta->assocreq_ies)
304 os_memcpy(sta->assocreq_ies, mgmt->u.assoc_req.variable,
305 sta->assocreq_ies_len);
307 sta_update_assoc(sta, &elems);
311 static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
313 const struct ieee80211_mgmt *mgmt;
314 struct wlantest_bss *bss;
315 struct wlantest_sta *sta;
316 u16 capab, status, aid;
318 mgmt = (const struct ieee80211_mgmt *) data;
319 bss = bss_get(wt, mgmt->bssid);
322 sta = sta_get(bss, mgmt->da);
327 add_note(wt, MSG_INFO, "Too short Association Response frame "
328 "from " MACSTR, MAC2STR(mgmt->sa));
332 capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
333 status = le_to_host16(mgmt->u.assoc_resp.status_code);
334 aid = le_to_host16(mgmt->u.assoc_resp.aid);
336 wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
337 " (capab=0x%x status=%u aid=%u)",
338 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
341 if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
342 struct ieee802_11_elems elems;
343 const u8 *ies = mgmt->u.assoc_resp.variable;
344 size_t ies_len = len - (mgmt->u.assoc_resp.variable - data);
345 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
347 add_note(wt, MSG_INFO, "Failed to parse IEs in "
348 "AssocResp from " MACSTR,
350 } else if (elems.timeout_int == NULL ||
351 elems.timeout_int[0] !=
352 WLAN_TIMEOUT_ASSOC_COMEBACK) {
353 add_note(wt, MSG_INFO, "No valid Timeout Interval IE "
354 "with Assoc Comeback time in AssocResp "
355 "(status=30) from " MACSTR,
359 WLANTEST_STA_COUNTER_ASSOCRESP_COMEBACK]++;
366 if ((aid & 0xc000) != 0xc000) {
367 add_note(wt, MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
368 "in Association Response from " MACSTR,
371 sta->aid = aid & 0xc000;
373 if (sta->state < STATE2) {
374 add_note(wt, MSG_DEBUG,
375 "STA " MACSTR " was not in State 2 when "
376 "getting associated", MAC2STR(sta->addr));
379 if (sta->state < STATE3) {
380 add_note(wt, MSG_DEBUG, "STA " MACSTR
381 " moved to State 3 with " MACSTR,
382 MAC2STR(sta->addr), MAC2STR(bss->bssid));
388 static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
391 const struct ieee80211_mgmt *mgmt;
392 struct wlantest_bss *bss;
393 struct wlantest_sta *sta;
394 struct ieee802_11_elems elems;
396 mgmt = (const struct ieee80211_mgmt *) data;
397 bss = bss_get(wt, mgmt->bssid);
400 sta = sta_get(bss, mgmt->sa);
404 if (len < 24 + 4 + ETH_ALEN) {
405 add_note(wt, MSG_INFO, "Too short Reassociation Request frame "
406 "from " MACSTR, MAC2STR(mgmt->sa));
410 wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
411 " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
412 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
413 le_to_host16(mgmt->u.reassoc_req.capab_info),
414 le_to_host16(mgmt->u.reassoc_req.listen_interval),
415 MAC2STR(mgmt->u.reassoc_req.current_ap));
417 sta->counters[WLANTEST_STA_COUNTER_REASSOCREQ_TX]++;
419 if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
420 len - (mgmt->u.reassoc_req.variable - data),
421 &elems, 0) == ParseFailed) {
422 add_note(wt, MSG_INFO, "Invalid IEs in Reassociation Request "
423 "frame from " MACSTR, MAC2STR(mgmt->sa));
427 sta->assocreq_capab_info =
428 le_to_host16(mgmt->u.reassoc_req.capab_info);
429 sta->assocreq_listen_int =
430 le_to_host16(mgmt->u.reassoc_req.listen_interval);
431 os_free(sta->assocreq_ies);
432 sta->assocreq_ies_len = len - (mgmt->u.reassoc_req.variable - data);
433 sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
434 if (sta->assocreq_ies)
435 os_memcpy(sta->assocreq_ies, mgmt->u.reassoc_req.variable,
436 sta->assocreq_ies_len);
438 sta_update_assoc(sta, &elems);
442 static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
445 const struct ieee80211_mgmt *mgmt;
446 struct wlantest_bss *bss;
447 struct wlantest_sta *sta;
448 u16 capab, status, aid;
450 mgmt = (const struct ieee80211_mgmt *) data;
451 bss = bss_get(wt, mgmt->bssid);
454 sta = sta_get(bss, mgmt->da);
459 add_note(wt, MSG_INFO, "Too short Reassociation Response frame "
460 "from " MACSTR, MAC2STR(mgmt->sa));
464 capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
465 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
466 aid = le_to_host16(mgmt->u.reassoc_resp.aid);
468 wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
469 " (capab=0x%x status=%u aid=%u)",
470 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
473 if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
474 struct ieee802_11_elems elems;
475 const u8 *ies = mgmt->u.reassoc_resp.variable;
476 size_t ies_len = len - (mgmt->u.reassoc_resp.variable - data);
477 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
479 add_note(wt, MSG_INFO, "Failed to parse IEs in "
480 "ReassocResp from " MACSTR,
482 } else if (elems.timeout_int == NULL ||
483 elems.timeout_int[0] !=
484 WLAN_TIMEOUT_ASSOC_COMEBACK) {
485 add_note(wt, MSG_INFO, "No valid Timeout Interval IE "
486 "with Assoc Comeback time in ReassocResp "
487 "(status=30) from " MACSTR,
491 WLANTEST_STA_COUNTER_REASSOCRESP_COMEBACK]++;
498 if ((aid & 0xc000) != 0xc000) {
499 add_note(wt, MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
500 "in Reassociation Response from " MACSTR,
503 sta->aid = aid & 0xc000;
505 if (sta->state < STATE2) {
506 add_note(wt, MSG_DEBUG,
507 "STA " MACSTR " was not in State 2 when "
508 "getting associated", MAC2STR(sta->addr));
511 if (sta->state < STATE3) {
512 add_note(wt, MSG_DEBUG, "STA " MACSTR
513 " moved to State 3 with " MACSTR,
514 MAC2STR(sta->addr), MAC2STR(bss->bssid));
520 static void disassoc_all_stas(struct wlantest *wt, struct wlantest_bss *bss)
522 struct wlantest_sta *sta;
523 dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
524 if (sta->state <= STATE2)
526 add_note(wt, MSG_DEBUG, "STA " MACSTR
527 " moved to State 2 with " MACSTR,
528 MAC2STR(sta->addr), MAC2STR(bss->bssid));
534 static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
537 const struct ieee80211_mgmt *mgmt;
538 struct wlantest_bss *bss;
539 struct wlantest_sta *sta;
542 mgmt = (const struct ieee80211_mgmt *) data;
543 bss = bss_get(wt, mgmt->bssid);
546 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
547 sta = sta_get(bss, mgmt->da);
549 sta = sta_get(bss, mgmt->sa);
552 add_note(wt, MSG_INFO, "Too short Disassociation frame from "
553 MACSTR, MAC2STR(mgmt->sa));
557 reason = le_to_host16(mgmt->u.disassoc.reason_code);
558 wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
559 " (reason=%u) (valid=%d)",
560 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
562 wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
565 if (valid && mgmt->da[0] == 0xff)
566 disassoc_all_stas(wt, bss);
570 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
571 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_RX :
572 WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX]++;
573 if (sta->pwrmgt && !sta->pspoll)
575 WLANTEST_STA_COUNTER_DISASSOC_RX_ASLEEP]++;
578 WLANTEST_STA_COUNTER_DISASSOC_RX_AWAKE]++;
580 fc = le_to_host16(mgmt->frame_control);
581 if (!(fc & WLAN_FC_ISWEP) && reason == 6)
582 sta->counters[WLANTEST_STA_COUNTER_DISASSOC_RX_RC6]++;
583 else if (!(fc & WLAN_FC_ISWEP) && reason == 7)
584 sta->counters[WLANTEST_STA_COUNTER_DISASSOC_RX_RC7]++;
586 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_TX :
587 WLANTEST_STA_COUNTER_INVALID_DISASSOC_TX]++;
590 add_note(wt, MSG_INFO, "Do not change STA " MACSTR " State "
591 "since Disassociation frame was not protected "
592 "correctly", MAC2STR(sta->addr));
596 if (sta->state < STATE2) {
597 add_note(wt, MSG_DEBUG,
598 "STA " MACSTR " was not in State 2 or 3 "
599 "when getting disassociated", MAC2STR(sta->addr));
602 if (sta->state > STATE2) {
603 add_note(wt, MSG_DEBUG, "STA " MACSTR
604 " moved to State 2 with " MACSTR,
605 MAC2STR(sta->addr), MAC2STR(bss->bssid));
608 tdls_link_down(wt, bss, sta);
612 static void rx_mgmt_action_sa_query_req(struct wlantest *wt,
613 struct wlantest_sta *sta,
614 const struct ieee80211_mgmt *mgmt,
615 size_t len, int valid)
620 rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
621 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
622 id = sta->ap_sa_query_tr;
624 id = sta->sta_sa_query_tr;
625 add_note(wt, MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
626 " (trans_id=%02x%02x)%s",
627 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
628 valid ? "" : " (invalid protection)");
629 os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
630 if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
631 sta->counters[valid ?
632 WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_TX :
633 WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_TX]++;
635 sta->counters[valid ?
636 WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_RX :
637 WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_RX]++;
641 static void rx_mgmt_action_sa_query_resp(struct wlantest *wt,
642 struct wlantest_sta *sta,
643 const struct ieee80211_mgmt *mgmt,
644 size_t len, int valid)
650 rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
651 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
652 id = sta->sta_sa_query_tr;
654 id = sta->ap_sa_query_tr;
655 match = os_memcmp(rx_id, id, 2) == 0;
656 add_note(wt, MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
657 " (trans_id=%02x%02x; %s)%s",
658 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
659 match ? "match" : "mismatch",
660 valid ? "" : " (invalid protection)");
661 if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
662 sta->counters[(valid && match) ?
663 WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_TX :
664 WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_TX]++;
666 sta->counters[(valid && match) ?
667 WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_RX :
668 WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_RX]++;
672 static void rx_mgmt_action_sa_query(struct wlantest *wt,
673 struct wlantest_sta *sta,
674 const struct ieee80211_mgmt *mgmt,
675 size_t len, int valid)
677 if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
678 add_note(wt, MSG_INFO, "Too short SA Query frame from " MACSTR,
683 if (len > 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
684 size_t elen = len - (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN);
685 add_note(wt, MSG_INFO, "Unexpected %u octets of extra data at "
686 "the end of SA Query frame from " MACSTR,
687 (unsigned) elen, MAC2STR(mgmt->sa));
688 wpa_hexdump(MSG_INFO, "SA Query extra data",
689 ((const u8 *) mgmt) + len - elen, elen);
692 switch (mgmt->u.action.u.sa_query_req.action) {
693 case WLAN_SA_QUERY_REQUEST:
694 rx_mgmt_action_sa_query_req(wt, sta, mgmt, len, valid);
696 case WLAN_SA_QUERY_RESPONSE:
697 rx_mgmt_action_sa_query_resp(wt, sta, mgmt, len, valid);
700 add_note(wt, MSG_INFO, "Unexpected SA Query action value %u "
702 mgmt->u.action.u.sa_query_req.action,
708 static void rx_mgmt_action(struct wlantest *wt, const u8 *data, size_t len,
711 const struct ieee80211_mgmt *mgmt;
712 struct wlantest_bss *bss;
713 struct wlantest_sta *sta;
715 mgmt = (const struct ieee80211_mgmt *) data;
716 if (mgmt->da[0] & 0x01) {
717 add_note(wt, MSG_DEBUG, "Group addressed Action frame: DA="
718 MACSTR " SA=" MACSTR " BSSID=" MACSTR
720 MAC2STR(mgmt->da), MAC2STR(mgmt->sa),
721 MAC2STR(mgmt->bssid), mgmt->u.action.category);
722 return; /* Ignore group addressed Action frames for now */
724 bss = bss_get(wt, mgmt->bssid);
727 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
728 sta = sta_get(bss, mgmt->da);
730 sta = sta_get(bss, mgmt->sa);
735 add_note(wt, MSG_INFO, "Too short Action frame from " MACSTR,
740 wpa_printf(MSG_DEBUG, "ACTION " MACSTR " -> " MACSTR
741 " (category=%u) (valid=%d)",
742 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
743 mgmt->u.action.category, valid);
744 wpa_hexdump(MSG_MSGDUMP, "ACTION payload", data + 24, len - 24);
746 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
747 sta->state < STATE3) {
748 add_note(wt, MSG_INFO, "Action frame sent when STA is not in "
749 "State 3 (SA=" MACSTR " DATA=" MACSTR ")",
750 MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
753 switch (mgmt->u.action.category) {
754 case WLAN_ACTION_SA_QUERY:
755 rx_mgmt_action_sa_query(wt, sta, mgmt, len, valid);
761 static int check_mmie_mic(unsigned int mgmt_group_cipher,
762 const u8 *igtk, size_t igtk_len,
763 const u8 *data, size_t len)
768 const struct ieee80211_hdr *hdr;
771 if (!mgmt_group_cipher || igtk_len < 16)
773 mic_len = mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC ? 8 : 16;
775 if (len < 24 || len - 24 < mic_len)
778 buf = os_malloc(len + 20 - 24);
782 /* BIP AAD: FC(masked) A1 A2 A3 */
783 hdr = (const struct ieee80211_hdr *) data;
784 fc = le_to_host16(hdr->frame_control);
785 fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
786 WPA_PUT_LE16(buf, fc);
787 os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
789 /* Frame body with MMIE MIC masked to zero */
790 os_memcpy(buf + 20, data + 24, len - 24 - mic_len);
791 os_memset(buf + 20 + len - 24 - mic_len, 0, mic_len);
793 wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
794 /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
795 if (mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
796 ret = omac1_aes_128(igtk, buf, len + 20 - 24, mic);
797 } else if (mgmt_group_cipher == WPA_CIPHER_BIP_CMAC_256) {
798 ret = omac1_aes_256(igtk, buf, len + 20 - 24, mic);
799 } else if (mgmt_group_cipher == WPA_CIPHER_BIP_GMAC_128 ||
800 mgmt_group_cipher == WPA_CIPHER_BIP_GMAC_256) {
804 ipn = data + len - mic_len - 6;
806 /* Nonce: A2 | IPN */
807 os_memcpy(nonce, hdr->addr2, ETH_ALEN);
808 npos = nonce + ETH_ALEN;
816 ret = aes_gmac(igtk, igtk_len, nonce, sizeof(nonce),
817 buf, len + 20 - 24, mic);
828 if (os_memcmp(data + len - mic_len, mic, mic_len) != 0)
835 static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
837 const struct ieee80211_mgmt *mgmt;
841 struct wlantest_bss *bss;
844 mgmt = (const struct ieee80211_mgmt *) data;
845 fc = le_to_host16(mgmt->frame_control);
846 stype = WLAN_FC_GET_STYPE(fc);
848 if (stype == WLAN_FC_STYPE_ACTION) {
851 if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
852 return 0; /* Not a robust management frame */
855 bss = bss_get(wt, mgmt->bssid);
857 return 0; /* No key known yet */
859 mic_len = bss->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC ? 8 : 16;
861 if (len < 24 + 10 + mic_len ||
862 data[len - (10 + mic_len)] != WLAN_EID_MMIE ||
863 data[len - (10 + mic_len - 1)] != 8 + mic_len) {
865 if (bss->rsn_capab & WPA_CAPABILITY_MFPC) {
866 add_note(wt, MSG_INFO, "Robust group-addressed "
867 "management frame sent without BIP by "
868 MACSTR, MAC2STR(mgmt->sa));
869 bss->counters[WLANTEST_BSS_COUNTER_MISSING_BIP_MMIE]++;
875 mmie = data + len - (8 + mic_len);
876 keyid = WPA_GET_LE16(mmie);
877 if (keyid & 0xf000) {
878 add_note(wt, MSG_INFO, "MMIE KeyID reserved bits not zero "
879 "(%04x) from " MACSTR, keyid, MAC2STR(mgmt->sa));
882 if (keyid < 4 || keyid > 5) {
883 add_note(wt, MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
884 keyid, MAC2STR(mgmt->sa));
885 bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
888 wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
889 wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
890 wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, mic_len);
892 if (!bss->igtk_len[keyid]) {
893 add_note(wt, MSG_DEBUG, "No IGTK known to validate BIP frame");
897 if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
898 add_note(wt, MSG_INFO, "BIP replay detected: SA=" MACSTR,
900 wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
901 wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
904 if (check_mmie_mic(bss->mgmt_group_cipher, bss->igtk[keyid],
905 bss->igtk_len[keyid], data, len) < 0) {
906 add_note(wt, MSG_INFO, "Invalid MMIE MIC in a frame from "
907 MACSTR, MAC2STR(mgmt->sa));
908 bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
912 add_note(wt, MSG_DEBUG, "Valid MMIE MIC");
913 os_memcpy(bss->ipn[keyid], mmie + 2, 6);
914 bss->counters[WLANTEST_BSS_COUNTER_VALID_BIP_MMIE]++;
916 if (stype == WLAN_FC_STYPE_DEAUTH)
917 bss->counters[WLANTEST_BSS_COUNTER_BIP_DEAUTH]++;
918 else if (stype == WLAN_FC_STYPE_DISASSOC)
919 bss->counters[WLANTEST_BSS_COUNTER_BIP_DISASSOC]++;
925 static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
928 struct wlantest_bss *bss;
929 struct wlantest_sta *sta;
930 const struct ieee80211_hdr *hdr;
932 u8 *decrypted, *frame = NULL;
935 hdr = (const struct ieee80211_hdr *) data;
936 bss = bss_get(wt, hdr->addr3);
939 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
940 sta = sta_get(bss, hdr->addr2);
942 sta = sta_get(bss, hdr->addr1);
943 if (sta == NULL || !sta->ptk_set) {
944 add_note(wt, MSG_MSGDUMP, "No PTK known to decrypt the frame");
951 if (!(data[24 + 3] & 0x20)) {
952 add_note(wt, MSG_INFO, "Expected CCMP frame from " MACSTR
953 " did not have ExtIV bit set to 1",
954 MAC2STR(hdr->addr2));
958 if (data[24 + 2] != 0 || (data[24 + 3] & 0x1f) != 0) {
959 add_note(wt, MSG_INFO, "CCMP mgmt frame from " MACSTR " used "
960 "non-zero reserved bit", MAC2STR(hdr->addr2));
963 keyid = data[24 + 3] >> 6;
965 add_note(wt, MSG_INFO, "Unexpected non-zero KeyID %d in "
966 "individually addressed Management frame from "
967 MACSTR, keyid, MAC2STR(hdr->addr2));
970 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
971 rsc = sta->rsc_tods[16];
973 rsc = sta->rsc_fromds[16];
975 ccmp_get_pn(pn, data + 24);
976 if (os_memcmp(pn, rsc, 6) <= 0) {
977 u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
978 add_note(wt, MSG_INFO, "CCMP/TKIP replay detected: A1=" MACSTR
979 " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u%s",
980 MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
982 WLAN_GET_SEQ_SEQ(seq_ctrl),
983 WLAN_GET_SEQ_FRAG(seq_ctrl),
984 (le_to_host16(hdr->frame_control) & WLAN_FC_RETRY) ?
986 wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
987 wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
990 decrypted = ccmp_decrypt(sta->ptk.tk, hdr, data + 24, len - 24, dlen);
992 os_memcpy(rsc, pn, 6);
993 frame = os_malloc(24 + *dlen);
995 os_memcpy(frame, data, 24);
996 os_memcpy(frame + 24, decrypted, *dlen);
1007 static int check_mgmt_ccmp(struct wlantest *wt, const u8 *data, size_t len)
1009 const struct ieee80211_mgmt *mgmt;
1011 struct wlantest_bss *bss;
1012 struct wlantest_sta *sta;
1014 mgmt = (const struct ieee80211_mgmt *) data;
1015 fc = le_to_host16(mgmt->frame_control);
1017 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
1019 mgmt->u.action.category == WLAN_ACTION_PUBLIC)
1020 return 0; /* Not a robust management frame */
1023 bss = bss_get(wt, mgmt->bssid);
1026 if (os_memcmp(mgmt->da, mgmt->bssid, ETH_ALEN) == 0)
1027 sta = sta_get(bss, mgmt->sa);
1029 sta = sta_get(bss, mgmt->da);
1033 if ((sta->rsn_capab & WPA_CAPABILITY_MFPC) &&
1034 (sta->state == STATE3 ||
1035 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION)) {
1036 add_note(wt, MSG_INFO, "Robust individually-addressed "
1037 "management frame sent without CCMP by "
1038 MACSTR, MAC2STR(mgmt->sa));
1046 void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
1048 const struct ieee80211_hdr *hdr;
1051 u8 *decrypted = NULL;
1057 hdr = (const struct ieee80211_hdr *) data;
1058 fc = le_to_host16(hdr->frame_control);
1060 stype = WLAN_FC_GET_STYPE(fc);
1062 if ((hdr->addr1[0] & 0x01) &&
1063 (stype == WLAN_FC_STYPE_DEAUTH ||
1064 stype == WLAN_FC_STYPE_DISASSOC ||
1065 stype == WLAN_FC_STYPE_ACTION)) {
1066 if (check_bip(wt, data, len) < 0)
1070 wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
1071 stype == WLAN_FC_STYPE_PROBE_RESP ||
1072 stype == WLAN_FC_STYPE_PROBE_REQ) ?
1073 MSG_EXCESSIVE : MSG_MSGDUMP,
1074 "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
1076 fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
1077 fc & WLAN_FC_ISWEP ? " Prot" : "",
1078 MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
1079 MAC2STR(hdr->addr3));
1081 if ((fc & WLAN_FC_ISWEP) &&
1082 !(hdr->addr1[0] & 0x01) &&
1083 (stype == WLAN_FC_STYPE_DEAUTH ||
1084 stype == WLAN_FC_STYPE_DISASSOC ||
1085 stype == WLAN_FC_STYPE_ACTION)) {
1086 decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
1088 write_pcap_decrypted(wt, decrypted, dlen, NULL, 0);
1095 if (!(fc & WLAN_FC_ISWEP) &&
1096 !(hdr->addr1[0] & 0x01) &&
1097 (stype == WLAN_FC_STYPE_DEAUTH ||
1098 stype == WLAN_FC_STYPE_DISASSOC ||
1099 stype == WLAN_FC_STYPE_ACTION)) {
1100 if (check_mgmt_ccmp(wt, data, len) < 0)
1105 case WLAN_FC_STYPE_BEACON:
1106 rx_mgmt_beacon(wt, data, len);
1108 case WLAN_FC_STYPE_PROBE_RESP:
1109 rx_mgmt_probe_resp(wt, data, len);
1111 case WLAN_FC_STYPE_AUTH:
1112 rx_mgmt_auth(wt, data, len);
1114 case WLAN_FC_STYPE_DEAUTH:
1115 rx_mgmt_deauth(wt, data, len, valid);
1117 case WLAN_FC_STYPE_ASSOC_REQ:
1118 rx_mgmt_assoc_req(wt, data, len);
1120 case WLAN_FC_STYPE_ASSOC_RESP:
1121 rx_mgmt_assoc_resp(wt, data, len);
1123 case WLAN_FC_STYPE_REASSOC_REQ:
1124 rx_mgmt_reassoc_req(wt, data, len);
1126 case WLAN_FC_STYPE_REASSOC_RESP:
1127 rx_mgmt_reassoc_resp(wt, data, len);
1129 case WLAN_FC_STYPE_DISASSOC:
1130 rx_mgmt_disassoc(wt, data, len, valid);
1132 case WLAN_FC_STYPE_ACTION:
1133 rx_mgmt_action(wt, data, len, valid);
1139 wt->last_mgmt_valid = valid;
1143 static void rx_mgmt_deauth_ack(struct wlantest *wt,
1144 const struct ieee80211_hdr *hdr)
1146 const struct ieee80211_mgmt *mgmt;
1147 struct wlantest_bss *bss;
1148 struct wlantest_sta *sta;
1150 mgmt = (const struct ieee80211_mgmt *) hdr;
1151 bss = bss_get(wt, mgmt->bssid);
1154 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
1155 sta = sta_get(bss, mgmt->da);
1157 sta = sta_get(bss, mgmt->sa);
1161 add_note(wt, MSG_DEBUG, "DEAUTH from " MACSTR " acknowledged by "
1162 MACSTR, MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1163 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
1165 c = wt->last_mgmt_valid ?
1166 WLANTEST_STA_COUNTER_VALID_DEAUTH_RX_ACK :
1167 WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX_ACK;
1173 static void rx_mgmt_disassoc_ack(struct wlantest *wt,
1174 const struct ieee80211_hdr *hdr)
1176 const struct ieee80211_mgmt *mgmt;
1177 struct wlantest_bss *bss;
1178 struct wlantest_sta *sta;
1180 mgmt = (const struct ieee80211_mgmt *) hdr;
1181 bss = bss_get(wt, mgmt->bssid);
1184 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
1185 sta = sta_get(bss, mgmt->da);
1187 sta = sta_get(bss, mgmt->sa);
1191 add_note(wt, MSG_DEBUG, "DISASSOC from " MACSTR " acknowledged by "
1192 MACSTR, MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1193 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
1195 c = wt->last_mgmt_valid ?
1196 WLANTEST_STA_COUNTER_VALID_DISASSOC_RX_ACK :
1197 WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX_ACK;
1203 void rx_mgmt_ack(struct wlantest *wt, const struct ieee80211_hdr *hdr)
1206 fc = le_to_host16(hdr->frame_control);
1207 stype = WLAN_FC_GET_STYPE(fc);
1209 wpa_printf(MSG_MSGDUMP, "MGMT ACK: stype=%u a1=" MACSTR " a2=" MACSTR
1211 stype, MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
1212 MAC2STR(hdr->addr3));
1215 case WLAN_FC_STYPE_DEAUTH:
1216 rx_mgmt_deauth_ack(wt, hdr);
1218 case WLAN_FC_STYPE_DISASSOC:
1219 rx_mgmt_disassoc_ack(wt, hdr);