2 * Received Management frame processing
3 * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
15 #include "utils/includes.h"
17 #include "utils/common.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "crypto/aes_wrap.h"
24 static const char * mgmt_stype(u16 stype)
27 case WLAN_FC_STYPE_ASSOC_REQ:
29 case WLAN_FC_STYPE_ASSOC_RESP:
31 case WLAN_FC_STYPE_REASSOC_REQ:
33 case WLAN_FC_STYPE_REASSOC_RESP:
34 return "REASSOC-RESP";
35 case WLAN_FC_STYPE_PROBE_REQ:
37 case WLAN_FC_STYPE_PROBE_RESP:
39 case WLAN_FC_STYPE_BEACON:
41 case WLAN_FC_STYPE_ATIM:
43 case WLAN_FC_STYPE_DISASSOC:
45 case WLAN_FC_STYPE_AUTH:
47 case WLAN_FC_STYPE_DEAUTH:
49 case WLAN_FC_STYPE_ACTION:
56 static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
58 const struct ieee80211_mgmt *mgmt;
59 struct wlantest_bss *bss;
60 struct ieee802_11_elems elems;
62 mgmt = (const struct ieee80211_mgmt *) data;
63 bss = bss_get(wt, mgmt->bssid);
66 if (bss->proberesp_seen)
67 return; /* do not override with Beacon data */
68 bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
69 if (ieee802_11_parse_elems(mgmt->u.beacon.variable,
70 len - (mgmt->u.beacon.variable - data),
71 &elems, 0) == ParseFailed) {
72 if (bss->parse_error_reported)
74 wpa_printf(MSG_INFO, "Invalid IEs in a Beacon frame from "
75 MACSTR, MAC2STR(mgmt->sa));
76 bss->parse_error_reported = 1;
80 bss_update(wt, bss, &elems);
84 static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
86 const struct ieee80211_mgmt *mgmt;
87 struct wlantest_bss *bss;
88 struct ieee802_11_elems elems;
90 mgmt = (const struct ieee80211_mgmt *) data;
91 bss = bss_get(wt, mgmt->bssid);
95 bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
96 if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
97 len - (mgmt->u.probe_resp.variable - data),
98 &elems, 0) == ParseFailed) {
99 if (bss->parse_error_reported)
101 wpa_printf(MSG_INFO, "Invalid IEs in a Probe Response frame "
102 "from " MACSTR, MAC2STR(mgmt->sa));
103 bss->parse_error_reported = 1;
107 bss_update(wt, bss, &elems);
111 static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
113 const struct ieee80211_mgmt *mgmt;
114 struct wlantest_bss *bss;
115 struct wlantest_sta *sta;
116 u16 alg, trans, status;
118 mgmt = (const struct ieee80211_mgmt *) data;
119 bss = bss_get(wt, mgmt->bssid);
122 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
123 sta = sta_get(bss, mgmt->da);
125 sta = sta_get(bss, mgmt->sa);
130 wpa_printf(MSG_INFO, "Too short Authentication frame from "
131 MACSTR, MAC2STR(mgmt->sa));
135 alg = le_to_host16(mgmt->u.auth.auth_alg);
136 trans = le_to_host16(mgmt->u.auth.auth_transaction);
137 status = le_to_host16(mgmt->u.auth.status_code);
139 wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
140 " (alg=%u trans=%u status=%u)",
141 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
143 if (alg == 0 && trans == 2 && status == 0) {
144 if (sta->state == STATE1) {
145 wpa_printf(MSG_DEBUG, "STA " MACSTR
146 " moved to State 2 with " MACSTR,
147 MAC2STR(sta->addr), MAC2STR(bss->bssid));
152 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
153 sta->counters[WLANTEST_STA_COUNTER_AUTH_RX]++;
155 sta->counters[WLANTEST_STA_COUNTER_AUTH_TX]++;
159 static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
162 const struct ieee80211_mgmt *mgmt;
163 struct wlantest_bss *bss;
164 struct wlantest_sta *sta;
166 mgmt = (const struct ieee80211_mgmt *) data;
167 bss = bss_get(wt, mgmt->bssid);
170 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
171 sta = sta_get(bss, mgmt->da);
173 sta = sta_get(bss, mgmt->sa);
178 wpa_printf(MSG_INFO, "Too short Deauthentication frame from "
179 MACSTR, MAC2STR(mgmt->sa));
183 wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
185 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
186 le_to_host16(mgmt->u.deauth.reason_code));
187 wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
189 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
190 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_RX :
191 WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX]++;
193 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_TX :
194 WLANTEST_STA_COUNTER_INVALID_DEAUTH_TX]++;
197 wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
198 "since Disassociation frame was not protected "
199 "correctly", MAC2STR(sta->addr));
203 if (sta->state != STATE1) {
204 wpa_printf(MSG_DEBUG, "STA " MACSTR
205 " moved to State 1 with " MACSTR,
206 MAC2STR(sta->addr), MAC2STR(bss->bssid));
212 static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
214 const struct ieee80211_mgmt *mgmt;
215 struct wlantest_bss *bss;
216 struct wlantest_sta *sta;
217 struct ieee802_11_elems elems;
219 mgmt = (const struct ieee80211_mgmt *) data;
220 bss = bss_get(wt, mgmt->bssid);
223 sta = sta_get(bss, mgmt->sa);
228 wpa_printf(MSG_INFO, "Too short Association Request frame "
229 "from " MACSTR, MAC2STR(mgmt->sa));
233 wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
234 " (capab=0x%x listen_int=%u)",
235 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
236 le_to_host16(mgmt->u.assoc_req.capab_info),
237 le_to_host16(mgmt->u.assoc_req.listen_interval));
239 sta->counters[WLANTEST_STA_COUNTER_ASSOCREQ_TX]++;
241 if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
242 len - (mgmt->u.assoc_req.variable - data),
243 &elems, 0) == ParseFailed) {
244 wpa_printf(MSG_INFO, "Invalid IEs in Association Request "
245 "frame from " MACSTR, MAC2STR(mgmt->sa));
249 sta->assocreq_capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
250 sta->assocreq_listen_int =
251 le_to_host16(mgmt->u.assoc_req.listen_interval);
252 os_free(sta->assocreq_ies);
253 sta->assocreq_ies_len = len - (mgmt->u.assoc_req.variable - data);
254 sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
255 if (sta->assocreq_ies)
256 os_memcpy(sta->assocreq_ies, mgmt->u.assoc_req.variable,
257 sta->assocreq_ies_len);
259 sta_update_assoc(sta, &elems);
263 static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
265 const struct ieee80211_mgmt *mgmt;
266 struct wlantest_bss *bss;
267 struct wlantest_sta *sta;
268 u16 capab, status, aid;
270 mgmt = (const struct ieee80211_mgmt *) data;
271 bss = bss_get(wt, mgmt->bssid);
274 sta = sta_get(bss, mgmt->da);
279 wpa_printf(MSG_INFO, "Too short Association Response frame "
280 "from " MACSTR, MAC2STR(mgmt->sa));
284 capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
285 status = le_to_host16(mgmt->u.assoc_resp.status_code);
286 aid = le_to_host16(mgmt->u.assoc_resp.aid);
288 wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
289 " (capab=0x%x status=%u aid=%u)",
290 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
293 if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
294 struct ieee802_11_elems elems;
295 const u8 *ies = mgmt->u.assoc_resp.variable;
296 size_t ies_len = len - (mgmt->u.assoc_resp.variable - data);
297 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
299 wpa_printf(MSG_INFO, "Failed to parse IEs in "
300 "AssocResp from " MACSTR,
302 } else if (elems.timeout_int == 0 ||
303 elems.timeout_int_len != 5) {
304 wpa_printf(MSG_INFO, "No valid Timeout Interval IE in "
305 "AssocResp (status=30) from " MACSTR,
309 WLANTEST_STA_COUNTER_ASSOCRESP_COMEBACK]++;
316 if ((aid & 0xc000) != 0xc000) {
317 wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
318 "in Association Response from " MACSTR,
321 sta->aid = aid & 0xc000;
323 if (sta->state < STATE2) {
324 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
325 "getting associated", MAC2STR(sta->addr));
328 if (sta->state < STATE3) {
329 wpa_printf(MSG_DEBUG, "STA " MACSTR
330 " moved to State 3 with " MACSTR,
331 MAC2STR(sta->addr), MAC2STR(bss->bssid));
337 static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
340 const struct ieee80211_mgmt *mgmt;
341 struct wlantest_bss *bss;
342 struct wlantest_sta *sta;
343 struct ieee802_11_elems elems;
345 mgmt = (const struct ieee80211_mgmt *) data;
346 bss = bss_get(wt, mgmt->bssid);
349 sta = sta_get(bss, mgmt->sa);
353 if (len < 24 + 4 + ETH_ALEN) {
354 wpa_printf(MSG_INFO, "Too short Reassociation Request frame "
355 "from " MACSTR, MAC2STR(mgmt->sa));
359 wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
360 " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
361 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
362 le_to_host16(mgmt->u.reassoc_req.capab_info),
363 le_to_host16(mgmt->u.reassoc_req.listen_interval),
364 MAC2STR(mgmt->u.reassoc_req.current_ap));
366 sta->counters[WLANTEST_STA_COUNTER_REASSOCREQ_TX]++;
368 if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
369 len - (mgmt->u.reassoc_req.variable - data),
370 &elems, 0) == ParseFailed) {
371 wpa_printf(MSG_INFO, "Invalid IEs in Reassociation Request "
372 "frame from " MACSTR, MAC2STR(mgmt->sa));
376 sta->assocreq_capab_info =
377 le_to_host16(mgmt->u.reassoc_req.capab_info);
378 sta->assocreq_listen_int =
379 le_to_host16(mgmt->u.reassoc_req.listen_interval);
380 os_free(sta->assocreq_ies);
381 sta->assocreq_ies_len = len - (mgmt->u.reassoc_req.variable - data);
382 sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
383 if (sta->assocreq_ies)
384 os_memcpy(sta->assocreq_ies, mgmt->u.reassoc_req.variable,
385 sta->assocreq_ies_len);
387 sta_update_assoc(sta, &elems);
391 static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
394 const struct ieee80211_mgmt *mgmt;
395 struct wlantest_bss *bss;
396 struct wlantest_sta *sta;
397 u16 capab, status, aid;
399 mgmt = (const struct ieee80211_mgmt *) data;
400 bss = bss_get(wt, mgmt->bssid);
403 sta = sta_get(bss, mgmt->da);
408 wpa_printf(MSG_INFO, "Too short Reassociation Response frame "
409 "from " MACSTR, MAC2STR(mgmt->sa));
413 capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
414 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
415 aid = le_to_host16(mgmt->u.reassoc_resp.aid);
417 wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
418 " (capab=0x%x status=%u aid=%u)",
419 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
422 if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
423 struct ieee802_11_elems elems;
424 const u8 *ies = mgmt->u.reassoc_resp.variable;
425 size_t ies_len = len - (mgmt->u.reassoc_resp.variable - data);
426 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
428 wpa_printf(MSG_INFO, "Failed to parse IEs in "
429 "ReassocResp from " MACSTR,
431 } else if (elems.timeout_int == 0 ||
432 elems.timeout_int_len != 5) {
433 wpa_printf(MSG_INFO, "No valid Timeout Interval IE in "
434 "ReassocResp (status=30) from " MACSTR,
438 WLANTEST_STA_COUNTER_REASSOCRESP_COMEBACK]++;
445 if ((aid & 0xc000) != 0xc000) {
446 wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
447 "in Reassociation Response from " MACSTR,
450 sta->aid = aid & 0xc000;
452 if (sta->state < STATE2) {
453 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
454 "getting associated", MAC2STR(sta->addr));
457 if (sta->state < STATE3) {
458 wpa_printf(MSG_DEBUG, "STA " MACSTR
459 " moved to State 3 with " MACSTR,
460 MAC2STR(sta->addr), MAC2STR(bss->bssid));
466 static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
469 const struct ieee80211_mgmt *mgmt;
470 struct wlantest_bss *bss;
471 struct wlantest_sta *sta;
473 mgmt = (const struct ieee80211_mgmt *) data;
474 bss = bss_get(wt, mgmt->bssid);
477 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
478 sta = sta_get(bss, mgmt->da);
480 sta = sta_get(bss, mgmt->sa);
485 wpa_printf(MSG_INFO, "Too short Disassociation frame from "
486 MACSTR, MAC2STR(mgmt->sa));
490 wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
492 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
493 le_to_host16(mgmt->u.disassoc.reason_code));
494 wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
496 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
497 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_RX :
498 WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX]++;
500 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_TX :
501 WLANTEST_STA_COUNTER_INVALID_DISASSOC_TX]++;
504 wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
505 "since Disassociation frame was not protected "
506 "correctly", MAC2STR(sta->addr));
510 if (sta->state < STATE2) {
511 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 or 3 "
512 "when getting disassociated", MAC2STR(sta->addr));
515 if (sta->state > STATE2) {
516 wpa_printf(MSG_DEBUG, "STA " MACSTR
517 " moved to State 2 with " MACSTR,
518 MAC2STR(sta->addr), MAC2STR(bss->bssid));
524 static void rx_mgmt_action_sa_query_req(struct wlantest *wt,
525 struct wlantest_sta *sta,
526 const struct ieee80211_mgmt *mgmt,
527 size_t len, int valid)
532 rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
533 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
534 id = sta->ap_sa_query_tr;
536 id = sta->sta_sa_query_tr;
537 wpa_printf(MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
538 " (trans_id=%02x%02x)%s",
539 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
540 valid ? "" : " (invalid protection)");
541 os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
542 if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
543 sta->counters[valid ?
544 WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_TX :
545 WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_TX]++;
547 sta->counters[valid ?
548 WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_RX :
549 WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_RX]++;
553 static void rx_mgmt_action_sa_query_resp(struct wlantest *wt,
554 struct wlantest_sta *sta,
555 const struct ieee80211_mgmt *mgmt,
556 size_t len, int valid)
562 rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
563 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
564 id = sta->sta_sa_query_tr;
566 id = sta->ap_sa_query_tr;
567 match = os_memcmp(rx_id, id, 2) == 0;
568 wpa_printf(MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
569 " (trans_id=%02x%02x; %s)%s",
570 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
571 match ? "match" : "mismatch",
572 valid ? "" : " (invalid protection)");
573 if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
574 sta->counters[(valid && match) ?
575 WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_TX :
576 WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_TX]++;
578 sta->counters[(valid && match) ?
579 WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_RX :
580 WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_RX]++;
584 static void rx_mgmt_action_sa_query(struct wlantest *wt,
585 struct wlantest_sta *sta,
586 const struct ieee80211_mgmt *mgmt,
587 size_t len, int valid)
589 if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
590 wpa_printf(MSG_INFO, "Too short SA Query frame from " MACSTR,
595 if (len > 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
596 size_t elen = len - (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN);
597 wpa_printf(MSG_INFO, "Unexpected %u octets of extra data at "
598 "the end of SA Query frame from " MACSTR,
599 (unsigned) elen, MAC2STR(mgmt->sa));
600 wpa_hexdump(MSG_INFO, "SA Query extra data",
601 ((const u8 *) mgmt) + len - elen, elen);
604 switch (mgmt->u.action.u.sa_query_req.action) {
605 case WLAN_SA_QUERY_REQUEST:
606 rx_mgmt_action_sa_query_req(wt, sta, mgmt, len, valid);
608 case WLAN_SA_QUERY_RESPONSE:
609 rx_mgmt_action_sa_query_resp(wt, sta, mgmt, len, valid);
612 wpa_printf(MSG_INFO, "Unexpected SA Query action value %u "
614 mgmt->u.action.u.sa_query_req.action,
620 static void rx_mgmt_action(struct wlantest *wt, const u8 *data, size_t len,
623 const struct ieee80211_mgmt *mgmt;
624 struct wlantest_bss *bss;
625 struct wlantest_sta *sta;
627 mgmt = (const struct ieee80211_mgmt *) data;
628 if (mgmt->da[0] & 0x01) {
629 wpa_printf(MSG_DEBUG, "Group addressed Action frame: DA="
630 MACSTR " SA=" MACSTR " BSSID=" MACSTR
632 MAC2STR(mgmt->da), MAC2STR(mgmt->sa),
633 MAC2STR(mgmt->bssid), mgmt->u.action.category);
634 return; /* Ignore group addressed Action frames for now */
636 bss = bss_get(wt, mgmt->bssid);
639 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
640 sta = sta_get(bss, mgmt->da);
642 sta = sta_get(bss, mgmt->sa);
647 wpa_printf(MSG_INFO, "Too short Action frame from "
648 MACSTR, MAC2STR(mgmt->sa));
652 wpa_printf(MSG_DEBUG, "ACTION " MACSTR " -> " MACSTR
653 " (category=%u) (valid=%d)",
654 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
655 mgmt->u.action.category, valid);
656 wpa_hexdump(MSG_MSGDUMP, "ACTION payload", data + 24, len - 24);
658 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
659 sta->state < STATE3) {
660 wpa_printf(MSG_INFO, "Action frame sent when STA is not in "
661 "State 3 (SA=" MACSTR " DATA=" MACSTR ")",
662 MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
665 switch (mgmt->u.action.category) {
666 case WLAN_ACTION_SA_QUERY:
667 rx_mgmt_action_sa_query(wt, sta, mgmt, len, valid);
673 static int check_mmie_mic(const u8 *igtk, const u8 *data, size_t len)
678 const struct ieee80211_hdr *hdr;
680 buf = os_malloc(len + 20 - 24);
684 /* BIP AAD: FC(masked) A1 A2 A3 */
685 hdr = (const struct ieee80211_hdr *) data;
686 fc = le_to_host16(hdr->frame_control);
687 fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
688 WPA_PUT_LE16(buf, fc);
689 os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
691 /* Frame body with MMIE MIC masked to zero */
692 os_memcpy(buf + 20, data + 24, len - 24 - 8);
693 os_memset(buf + 20 + len - 24 - 8, 0, 8);
695 wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
696 /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
697 if (omac1_aes_128(igtk, buf, len + 20 - 24, mic) < 0) {
704 if (os_memcmp(data + len - 8, mic, 8) != 0)
711 static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
713 const struct ieee80211_mgmt *mgmt;
717 struct wlantest_bss *bss;
719 mgmt = (const struct ieee80211_mgmt *) data;
720 fc = le_to_host16(mgmt->frame_control);
721 stype = WLAN_FC_GET_STYPE(fc);
723 if (stype == WLAN_FC_STYPE_ACTION) {
726 if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
727 return 0; /* Not a robust management frame */
730 bss = bss_get(wt, mgmt->bssid);
732 return 0; /* No key known yet */
734 if (len < 24 + 18 || data[len - 18] != WLAN_EID_MMIE ||
735 data[len - 17] != 16) {
737 if (bss->rsn_capab & WPA_CAPABILITY_MFPC) {
738 wpa_printf(MSG_INFO, "Robust group-addressed "
739 "management frame sent without BIP by "
740 MACSTR, MAC2STR(mgmt->sa));
741 bss->counters[WLANTEST_BSS_COUNTER_MISSING_BIP_MMIE]++;
747 mmie = data + len - 16;
748 keyid = WPA_GET_LE16(mmie);
749 if (keyid & 0xf000) {
750 wpa_printf(MSG_INFO, "MMIE KeyID reserved bits not zero "
751 "(%04x) from " MACSTR, keyid, MAC2STR(mgmt->sa));
754 if (keyid < 4 || keyid > 5) {
755 wpa_printf(MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
756 keyid, MAC2STR(mgmt->sa));
757 bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
760 wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
761 wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
762 wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, 8);
764 if (!bss->igtk_set[keyid]) {
765 wpa_printf(MSG_DEBUG, "No IGTK known to validate BIP frame");
769 if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
770 wpa_printf(MSG_INFO, "BIP replay detected: SA=" MACSTR,
772 wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
773 wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
776 if (check_mmie_mic(bss->igtk[keyid], data, len) < 0) {
777 wpa_printf(MSG_INFO, "Invalid MMIE MIC in a frame from "
778 MACSTR, MAC2STR(mgmt->sa));
779 bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
783 wpa_printf(MSG_DEBUG, "Valid MMIE MIC");
784 os_memcpy(bss->ipn[keyid], mmie + 2, 6);
785 bss->counters[WLANTEST_BSS_COUNTER_VALID_BIP_MMIE]++;
787 if (stype == WLAN_FC_STYPE_DEAUTH)
788 bss->counters[WLANTEST_BSS_COUNTER_BIP_DEAUTH]++;
789 else if (stype == WLAN_FC_STYPE_DISASSOC)
790 bss->counters[WLANTEST_BSS_COUNTER_BIP_DISASSOC]++;
796 static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
799 struct wlantest_bss *bss;
800 struct wlantest_sta *sta;
801 const struct ieee80211_hdr *hdr;
803 u8 *decrypted, *frame = NULL;
806 hdr = (const struct ieee80211_hdr *) data;
807 bss = bss_get(wt, hdr->addr3);
810 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
811 sta = sta_get(bss, hdr->addr2);
813 sta = sta_get(bss, hdr->addr1);
814 if (sta == NULL || !sta->ptk_set) {
815 wpa_printf(MSG_MSGDUMP, "No PTK known to decrypt the frame");
822 if (!(data[24 + 3] & 0x20)) {
823 wpa_printf(MSG_INFO, "Expected CCMP frame from " MACSTR
824 " did not have ExtIV bit set to 1",
825 MAC2STR(hdr->addr2));
829 if (data[24 + 2] != 0 || (data[24 + 3] & 0x1f) != 0) {
830 wpa_printf(MSG_INFO, "CCMP mgmt frame from " MACSTR " used "
831 "non-zero reserved bit", MAC2STR(hdr->addr2));
834 keyid = data[24 + 3] >> 6;
836 wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
837 "individually addressed Management frame from "
838 MACSTR, keyid, MAC2STR(hdr->addr2));
841 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
842 rsc = sta->rsc_tods[16];
844 rsc = sta->rsc_fromds[16];
846 ccmp_get_pn(pn, data + 24);
847 if (os_memcmp(pn, rsc, 6) <= 0) {
848 wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: SA=" MACSTR,
849 MAC2STR(hdr->addr2));
850 wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
851 wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
854 decrypted = ccmp_decrypt(sta->ptk.tk1, hdr, data + 24, len - 24, dlen);
856 os_memcpy(rsc, pn, 6);
857 frame = os_malloc(24 + *dlen);
859 os_memcpy(frame, data, 24);
860 os_memcpy(frame + 24, decrypted, *dlen);
871 static int check_mgmt_ccmp(struct wlantest *wt, const u8 *data, size_t len)
873 const struct ieee80211_mgmt *mgmt;
875 struct wlantest_bss *bss;
876 struct wlantest_sta *sta;
878 mgmt = (const struct ieee80211_mgmt *) data;
879 fc = le_to_host16(mgmt->frame_control);
881 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
883 mgmt->u.action.category == WLAN_ACTION_PUBLIC)
884 return 0; /* Not a robust management frame */
887 bss = bss_get(wt, mgmt->bssid);
890 if (os_memcmp(mgmt->da, mgmt->bssid, ETH_ALEN) == 0)
891 sta = sta_get(bss, mgmt->sa);
893 sta = sta_get(bss, mgmt->da);
897 if ((sta->rsn_capab & WPA_CAPABILITY_MFPC) &&
898 (sta->state == STATE3 ||
899 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION)) {
900 wpa_printf(MSG_INFO, "Robust individually-addressed "
901 "management frame sent without CCMP by "
902 MACSTR, MAC2STR(mgmt->sa));
910 void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
912 const struct ieee80211_hdr *hdr;
915 u8 *decrypted = NULL;
921 hdr = (const struct ieee80211_hdr *) data;
922 fc = le_to_host16(hdr->frame_control);
924 stype = WLAN_FC_GET_STYPE(fc);
926 if ((hdr->addr1[0] & 0x01) &&
927 (stype == WLAN_FC_STYPE_DEAUTH ||
928 stype == WLAN_FC_STYPE_DISASSOC ||
929 stype == WLAN_FC_STYPE_ACTION)) {
930 if (check_bip(wt, data, len) < 0)
934 wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
935 stype == WLAN_FC_STYPE_PROBE_RESP ||
936 stype == WLAN_FC_STYPE_PROBE_REQ) ?
937 MSG_EXCESSIVE : MSG_MSGDUMP,
938 "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
940 fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
941 fc & WLAN_FC_ISWEP ? " Prot" : "",
942 MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
943 MAC2STR(hdr->addr3));
945 if ((fc & WLAN_FC_ISWEP) &&
946 !(hdr->addr1[0] & 0x01) &&
947 (stype == WLAN_FC_STYPE_DEAUTH ||
948 stype == WLAN_FC_STYPE_DISASSOC ||
949 stype == WLAN_FC_STYPE_ACTION)) {
950 decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
952 write_pcap_decrypted(wt, decrypted, dlen, NULL, 0);
959 if (!(fc & WLAN_FC_ISWEP) &&
960 !(hdr->addr1[0] & 0x01) &&
961 (stype == WLAN_FC_STYPE_DEAUTH ||
962 stype == WLAN_FC_STYPE_DISASSOC ||
963 stype == WLAN_FC_STYPE_ACTION)) {
964 if (check_mgmt_ccmp(wt, data, len) < 0)
969 case WLAN_FC_STYPE_BEACON:
970 rx_mgmt_beacon(wt, data, len);
972 case WLAN_FC_STYPE_PROBE_RESP:
973 rx_mgmt_probe_resp(wt, data, len);
975 case WLAN_FC_STYPE_AUTH:
976 rx_mgmt_auth(wt, data, len);
978 case WLAN_FC_STYPE_DEAUTH:
979 rx_mgmt_deauth(wt, data, len, valid);
981 case WLAN_FC_STYPE_ASSOC_REQ:
982 rx_mgmt_assoc_req(wt, data, len);
984 case WLAN_FC_STYPE_ASSOC_RESP:
985 rx_mgmt_assoc_resp(wt, data, len);
987 case WLAN_FC_STYPE_REASSOC_REQ:
988 rx_mgmt_reassoc_req(wt, data, len);
990 case WLAN_FC_STYPE_REASSOC_RESP:
991 rx_mgmt_reassoc_resp(wt, data, len);
993 case WLAN_FC_STYPE_DISASSOC:
994 rx_mgmt_disassoc(wt, data, len, valid);
996 case WLAN_FC_STYPE_ACTION:
997 rx_mgmt_action(wt, data, len, valid);