sta->state = STATE2;
}
}
+
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
+ sta->counters[WLANTEST_STA_COUNTER_AUTH_RX]++;
+ else
+ sta->counters[WLANTEST_STA_COUNTER_AUTH_TX]++;
+}
+
+
+static void deauth_all_stas(struct wlantest_bss *bss)
+{
+ struct wlantest_sta *sta;
+ dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
+ if (sta->state == STATE1)
+ continue;
+ wpa_printf(MSG_DEBUG, "STA " MACSTR
+ " moved to State 1 with " MACSTR,
+ MAC2STR(sta->addr), MAC2STR(bss->bssid));
+ sta->state = STATE1;
+ }
+}
+
+
+static void tdls_link_down(struct wlantest_bss *bss, struct wlantest_sta *sta)
+{
+ struct wlantest_tdls *tdls;
+ dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list) {
+ if ((tdls->init == sta || tdls->resp == sta) && tdls->link_up)
+ {
+ wpa_printf(MSG_DEBUG, "TDLS: Set link down based on "
+ "STA deauth/disassoc");
+ tdls->link_up = 0;
+ }
+ }
}
const struct ieee80211_mgmt *mgmt;
struct wlantest_bss *bss;
struct wlantest_sta *sta;
+ u16 fc, reason;
mgmt = (const struct ieee80211_mgmt *) data;
bss = bss_get(wt, mgmt->bssid);
sta = sta_get(bss, mgmt->da);
else
sta = sta_get(bss, mgmt->sa);
- if (sta == NULL)
- return;
if (len < 24 + 2) {
wpa_printf(MSG_INFO, "Too short Deauthentication frame from "
return;
}
+ reason = le_to_host16(mgmt->u.deauth.reason_code);
wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
- " (reason=%u)",
+ " (reason=%u) (valid=%d)",
MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
- le_to_host16(mgmt->u.deauth.reason_code));
+ reason, valid);
wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
+ if (sta == NULL) {
+ if (valid && mgmt->da[0] == 0xff)
+ deauth_all_stas(bss);
+ return;
+ }
+
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
+ sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_RX :
+ WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX]++;
+ if (sta->pwrmgt && !sta->pspoll)
+ sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_ASLEEP]++;
+ else
+ sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_AWAKE]++;
+
+ fc = le_to_host16(mgmt->frame_control);
+ if (!(fc & WLAN_FC_ISWEP) && reason == 6)
+ sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_RC6]++;
+ else if (!(fc & WLAN_FC_ISWEP) && reason == 7)
+ sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_RC7]++;
+ } else
+ sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_TX :
+ WLANTEST_STA_COUNTER_INVALID_DEAUTH_TX]++;
+
if (!valid) {
wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
"since Disassociation frame was not protected "
MAC2STR(sta->addr), MAC2STR(bss->bssid));
sta->state = STATE1;
}
+ tdls_link_down(bss, sta);
}
le_to_host16(mgmt->u.assoc_req.capab_info),
le_to_host16(mgmt->u.assoc_req.listen_interval));
+ sta->counters[WLANTEST_STA_COUNTER_ASSOCREQ_TX]++;
+
if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
len - (mgmt->u.assoc_req.variable - data),
&elems, 0) == ParseFailed) {
return;
}
+ sta->assocreq_capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
+ sta->assocreq_listen_int =
+ le_to_host16(mgmt->u.assoc_req.listen_interval);
+ os_free(sta->assocreq_ies);
+ sta->assocreq_ies_len = len - (mgmt->u.assoc_req.variable - data);
+ sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
+ if (sta->assocreq_ies)
+ os_memcpy(sta->assocreq_ies, mgmt->u.assoc_req.variable,
+ sta->assocreq_ies_len);
+
sta_update_assoc(sta, &elems);
}
MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
aid & 0x3fff);
+ if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
+ struct ieee802_11_elems elems;
+ const u8 *ies = mgmt->u.assoc_resp.variable;
+ size_t ies_len = len - (mgmt->u.assoc_resp.variable - data);
+ if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
+ ParseFailed) {
+ wpa_printf(MSG_INFO, "Failed to parse IEs in "
+ "AssocResp from " MACSTR,
+ MAC2STR(mgmt->sa));
+ } else if (elems.timeout_int == NULL ||
+ elems.timeout_int_len != 5 ||
+ elems.timeout_int[0] !=
+ WLAN_TIMEOUT_ASSOC_COMEBACK) {
+ wpa_printf(MSG_INFO, "No valid Timeout Interval IE "
+ "with Assoc Comeback time in AssocResp "
+ "(status=30) from " MACSTR,
+ MAC2STR(mgmt->sa));
+ } else {
+ sta->counters[
+ WLANTEST_STA_COUNTER_ASSOCRESP_COMEBACK]++;
+ }
+ }
+
if (status)
return;
le_to_host16(mgmt->u.reassoc_req.listen_interval),
MAC2STR(mgmt->u.reassoc_req.current_ap));
+ sta->counters[WLANTEST_STA_COUNTER_REASSOCREQ_TX]++;
+
if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
len - (mgmt->u.reassoc_req.variable - data),
&elems, 0) == ParseFailed) {
return;
}
+ sta->assocreq_capab_info =
+ le_to_host16(mgmt->u.reassoc_req.capab_info);
+ sta->assocreq_listen_int =
+ le_to_host16(mgmt->u.reassoc_req.listen_interval);
+ os_free(sta->assocreq_ies);
+ sta->assocreq_ies_len = len - (mgmt->u.reassoc_req.variable - data);
+ sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
+ if (sta->assocreq_ies)
+ os_memcpy(sta->assocreq_ies, mgmt->u.reassoc_req.variable,
+ sta->assocreq_ies_len);
+
sta_update_assoc(sta, &elems);
}
MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
aid & 0x3fff);
+ if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
+ struct ieee802_11_elems elems;
+ const u8 *ies = mgmt->u.reassoc_resp.variable;
+ size_t ies_len = len - (mgmt->u.reassoc_resp.variable - data);
+ if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
+ ParseFailed) {
+ wpa_printf(MSG_INFO, "Failed to parse IEs in "
+ "ReassocResp from " MACSTR,
+ MAC2STR(mgmt->sa));
+ } else if (elems.timeout_int == NULL ||
+ elems.timeout_int_len != 5 ||
+ elems.timeout_int[0] !=
+ WLAN_TIMEOUT_ASSOC_COMEBACK) {
+ wpa_printf(MSG_INFO, "No valid Timeout Interval IE "
+ "with Assoc Comeback time in ReassocResp "
+ "(status=30) from " MACSTR,
+ MAC2STR(mgmt->sa));
+ } else {
+ sta->counters[
+ WLANTEST_STA_COUNTER_REASSOCRESP_COMEBACK]++;
+ }
+ }
+
if (status)
return;
}
+static void disassoc_all_stas(struct wlantest_bss *bss)
+{
+ struct wlantest_sta *sta;
+ dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
+ if (sta->state <= STATE2)
+ continue;
+ wpa_printf(MSG_DEBUG, "STA " MACSTR
+ " moved to State 2 with " MACSTR,
+ MAC2STR(sta->addr), MAC2STR(bss->bssid));
+ sta->state = STATE2;
+ }
+}
+
+
static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
int valid)
{
const struct ieee80211_mgmt *mgmt;
struct wlantest_bss *bss;
struct wlantest_sta *sta;
+ u16 fc, reason;
mgmt = (const struct ieee80211_mgmt *) data;
bss = bss_get(wt, mgmt->bssid);
sta = sta_get(bss, mgmt->da);
else
sta = sta_get(bss, mgmt->sa);
- if (sta == NULL)
- return;
if (len < 24 + 2) {
wpa_printf(MSG_INFO, "Too short Disassociation frame from "
return;
}
+ reason = le_to_host16(mgmt->u.disassoc.reason_code);
wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
- " (reason=%u)",
+ " (reason=%u) (valid=%d)",
MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
- le_to_host16(mgmt->u.disassoc.reason_code));
+ reason, valid);
wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
+ if (sta == NULL) {
+ if (valid && mgmt->da[0] == 0xff)
+ disassoc_all_stas(bss);
+ return;
+ }
+
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
+ sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_RX :
+ WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX]++;
+ if (sta->pwrmgt && !sta->pspoll)
+ sta->counters[
+ WLANTEST_STA_COUNTER_DISASSOC_RX_ASLEEP]++;
+ else
+ sta->counters[
+ WLANTEST_STA_COUNTER_DISASSOC_RX_AWAKE]++;
+
+ fc = le_to_host16(mgmt->frame_control);
+ if (!(fc & WLAN_FC_ISWEP) && reason == 6)
+ sta->counters[WLANTEST_STA_COUNTER_DISASSOC_RX_RC6]++;
+ else if (!(fc & WLAN_FC_ISWEP) && reason == 7)
+ sta->counters[WLANTEST_STA_COUNTER_DISASSOC_RX_RC7]++;
+ } else
+ sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_TX :
+ WLANTEST_STA_COUNTER_INVALID_DISASSOC_TX]++;
+
if (!valid) {
wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
"since Disassociation frame was not protected "
MAC2STR(sta->addr), MAC2STR(bss->bssid));
sta->state = STATE2;
}
+ tdls_link_down(bss, sta);
+}
+
+
+static void rx_mgmt_action_sa_query_req(struct wlantest *wt,
+ struct wlantest_sta *sta,
+ const struct ieee80211_mgmt *mgmt,
+ size_t len, int valid)
+{
+ const u8 *rx_id;
+ u8 *id;
+
+ rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
+ id = sta->ap_sa_query_tr;
+ else
+ id = sta->sta_sa_query_tr;
+ wpa_printf(MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
+ " (trans_id=%02x%02x)%s",
+ MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
+ valid ? "" : " (invalid protection)");
+ os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
+ if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
+ sta->counters[valid ?
+ WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_TX :
+ WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_TX]++;
+ else
+ sta->counters[valid ?
+ WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_RX :
+ WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_RX]++;
+}
+
+
+static void rx_mgmt_action_sa_query_resp(struct wlantest *wt,
+ struct wlantest_sta *sta,
+ const struct ieee80211_mgmt *mgmt,
+ size_t len, int valid)
+{
+ const u8 *rx_id;
+ u8 *id;
+ int match;
+
+ rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
+ id = sta->sta_sa_query_tr;
+ else
+ id = sta->ap_sa_query_tr;
+ match = os_memcmp(rx_id, id, 2) == 0;
+ wpa_printf(MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
+ " (trans_id=%02x%02x; %s)%s",
+ MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
+ match ? "match" : "mismatch",
+ valid ? "" : " (invalid protection)");
+ if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
+ sta->counters[(valid && match) ?
+ WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_TX :
+ WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_TX]++;
+ else
+ sta->counters[(valid && match) ?
+ WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_RX :
+ WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_RX]++;
}
const struct ieee80211_mgmt *mgmt,
size_t len, int valid)
{
- const u8 *rx_id;
- u8 *id;
-
if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
wpa_printf(MSG_INFO, "Too short SA Query frame from " MACSTR,
MAC2STR(mgmt->sa));
switch (mgmt->u.action.u.sa_query_req.action) {
case WLAN_SA_QUERY_REQUEST:
- rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
- if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
- id = sta->ap_sa_query_tr;
- else
- id = sta->sta_sa_query_tr;
- wpa_printf(MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
- " (trans_id=%02x%02x)%s",
- MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
- rx_id[0], rx_id[1],
- valid ? "" : " (invalid protection)");
- os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
+ rx_mgmt_action_sa_query_req(wt, sta, mgmt, len, valid);
break;
case WLAN_SA_QUERY_RESPONSE:
- rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
- if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
- id = sta->sta_sa_query_tr;
- else
- id = sta->ap_sa_query_tr;
- wpa_printf(MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
- " (trans_id=%02x%02x; %s)%s",
- MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
- rx_id[0], rx_id[1],
- os_memcmp(rx_id, id, 2) == 0 ?
- "match" : "mismatch",
- valid ? "" : " (invalid protection)");
+ rx_mgmt_action_sa_query_resp(wt, sta, mgmt, len, valid);
break;
default:
wpa_printf(MSG_INFO, "Unexpected SA Query action value %u "
struct wlantest_sta *sta;
mgmt = (const struct ieee80211_mgmt *) data;
- if (mgmt->da[0] & 0x01)
+ if (mgmt->da[0] & 0x01) {
+ wpa_printf(MSG_DEBUG, "Group addressed Action frame: DA="
+ MACSTR " SA=" MACSTR " BSSID=" MACSTR
+ " category=%u",
+ MAC2STR(mgmt->da), MAC2STR(mgmt->sa),
+ MAC2STR(mgmt->bssid), mgmt->u.action.category);
return; /* Ignore group addressed Action frames for now */
+ }
bss = bss_get(wt, mgmt->bssid);
if (bss == NULL)
return;
wpa_printf(MSG_INFO, "Robust group-addressed "
"management frame sent without BIP by "
MACSTR, MAC2STR(mgmt->sa));
+ bss->counters[WLANTEST_BSS_COUNTER_MISSING_BIP_MMIE]++;
return -1;
}
return 0;
if (keyid < 4 || keyid > 5) {
wpa_printf(MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
keyid, MAC2STR(mgmt->sa));
+ bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
return 0;
}
wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
if (check_mmie_mic(bss->igtk[keyid], data, len) < 0) {
wpa_printf(MSG_INFO, "Invalid MMIE MIC in a frame from "
MACSTR, MAC2STR(mgmt->sa));
+ bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
return -1;
}
wpa_printf(MSG_DEBUG, "Valid MMIE MIC");
os_memcpy(bss->ipn[keyid], mmie + 2, 6);
+ bss->counters[WLANTEST_BSS_COUNTER_VALID_BIP_MMIE]++;
+
+ if (stype == WLAN_FC_STYPE_DEAUTH)
+ bss->counters[WLANTEST_BSS_COUNTER_BIP_DEAUTH]++;
+ else if (stype == WLAN_FC_STYPE_DISASSOC)
+ bss->counters[WLANTEST_BSS_COUNTER_BIP_DISASSOC]++;
return 0;
}
ccmp_get_pn(pn, data + 24);
if (os_memcmp(pn, rsc, 6) <= 0) {
- wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: SA=" MACSTR,
- MAC2STR(hdr->addr2));
+ u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
+ wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: A1=" MACSTR
+ " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u",
+ MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
+ MAC2STR(hdr->addr3),
+ WLAN_GET_SEQ_SEQ(seq_ctrl),
+ WLAN_GET_SEQ_FRAG(seq_ctrl));
wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
}
if (sta == NULL)
return 0;
- if (sta->rsn_capab & WPA_CAPABILITY_MFPC) {
+ if ((sta->rsn_capab & WPA_CAPABILITY_MFPC) &&
+ (sta->state == STATE3 ||
+ WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION)) {
wpa_printf(MSG_INFO, "Robust individually-addressed "
"management frame sent without CCMP by "
MACSTR, MAC2STR(mgmt->sa));
}
os_free(decrypted);
+
+ wt->last_mgmt_valid = valid;
+}
+
+
+static void rx_mgmt_deauth_ack(struct wlantest *wt,
+ const struct ieee80211_hdr *hdr)
+{
+ const struct ieee80211_mgmt *mgmt;
+ struct wlantest_bss *bss;
+ struct wlantest_sta *sta;
+
+ mgmt = (const struct ieee80211_mgmt *) hdr;
+ bss = bss_get(wt, mgmt->bssid);
+ if (bss == NULL)
+ return;
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
+ sta = sta_get(bss, mgmt->da);
+ else
+ sta = sta_get(bss, mgmt->sa);
+ if (sta == NULL)
+ return;
+
+ wpa_printf(MSG_DEBUG, "DEAUTH from " MACSTR " acknowledged by " MACSTR,
+ MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
+ int c;
+ c = wt->last_mgmt_valid ?
+ WLANTEST_STA_COUNTER_VALID_DEAUTH_RX_ACK :
+ WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX_ACK;
+ sta->counters[c]++;
+ }
+}
+
+
+static void rx_mgmt_disassoc_ack(struct wlantest *wt,
+ const struct ieee80211_hdr *hdr)
+{
+ const struct ieee80211_mgmt *mgmt;
+ struct wlantest_bss *bss;
+ struct wlantest_sta *sta;
+
+ mgmt = (const struct ieee80211_mgmt *) hdr;
+ bss = bss_get(wt, mgmt->bssid);
+ if (bss == NULL)
+ return;
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
+ sta = sta_get(bss, mgmt->da);
+ else
+ sta = sta_get(bss, mgmt->sa);
+ if (sta == NULL)
+ return;
+
+ wpa_printf(MSG_DEBUG, "DISASSOC from " MACSTR " acknowledged by "
+ MACSTR, MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
+ if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
+ int c;
+ c = wt->last_mgmt_valid ?
+ WLANTEST_STA_COUNTER_VALID_DISASSOC_RX_ACK :
+ WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX_ACK;
+ sta->counters[c]++;
+ }
+}
+
+
+void rx_mgmt_ack(struct wlantest *wt, const struct ieee80211_hdr *hdr)
+{
+ u16 fc, stype;
+ fc = le_to_host16(hdr->frame_control);
+ stype = WLAN_FC_GET_STYPE(fc);
+
+ wpa_printf(MSG_MSGDUMP, "MGMT ACK: stype=%u a1=" MACSTR " a2=" MACSTR
+ " a3=" MACSTR,
+ stype, MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
+ MAC2STR(hdr->addr3));
+
+ switch (stype) {
+ case WLAN_FC_STYPE_DEAUTH:
+ rx_mgmt_deauth_ack(wt, hdr);
+ break;
+ case WLAN_FC_STYPE_DISASSOC:
+ rx_mgmt_disassoc_ack(wt, hdr);
+ break;
+ }
}
projects / mech_eap.git / blobdiff