2 * Received Management frame processing
3 * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
15 #include "utils/includes.h"
17 #include "utils/common.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "crypto/aes_wrap.h"
24 static const char * mgmt_stype(u16 stype)
27 case WLAN_FC_STYPE_ASSOC_REQ:
29 case WLAN_FC_STYPE_ASSOC_RESP:
31 case WLAN_FC_STYPE_REASSOC_REQ:
33 case WLAN_FC_STYPE_REASSOC_RESP:
34 return "REASSOC-RESP";
35 case WLAN_FC_STYPE_PROBE_REQ:
37 case WLAN_FC_STYPE_PROBE_RESP:
39 case WLAN_FC_STYPE_BEACON:
41 case WLAN_FC_STYPE_ATIM:
43 case WLAN_FC_STYPE_DISASSOC:
45 case WLAN_FC_STYPE_AUTH:
47 case WLAN_FC_STYPE_DEAUTH:
49 case WLAN_FC_STYPE_ACTION:
56 static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
58 const struct ieee80211_mgmt *mgmt;
59 struct wlantest_bss *bss;
60 struct ieee802_11_elems elems;
62 mgmt = (const struct ieee80211_mgmt *) data;
63 bss = bss_get(wt, mgmt->bssid);
66 if (bss->proberesp_seen)
67 return; /* do not override with Beacon data */
68 bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
69 if (ieee802_11_parse_elems(mgmt->u.beacon.variable,
70 len - (mgmt->u.beacon.variable - data),
71 &elems, 0) == ParseFailed) {
72 if (bss->parse_error_reported)
74 wpa_printf(MSG_INFO, "Invalid IEs in a Beacon frame from "
75 MACSTR, MAC2STR(mgmt->sa));
76 bss->parse_error_reported = 1;
80 bss_update(wt, bss, &elems);
84 static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
86 const struct ieee80211_mgmt *mgmt;
87 struct wlantest_bss *bss;
88 struct ieee802_11_elems elems;
90 mgmt = (const struct ieee80211_mgmt *) data;
91 bss = bss_get(wt, mgmt->bssid);
95 bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
96 if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
97 len - (mgmt->u.probe_resp.variable - data),
98 &elems, 0) == ParseFailed) {
99 if (bss->parse_error_reported)
101 wpa_printf(MSG_INFO, "Invalid IEs in a Probe Response frame "
102 "from " MACSTR, MAC2STR(mgmt->sa));
103 bss->parse_error_reported = 1;
107 bss_update(wt, bss, &elems);
111 static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
113 const struct ieee80211_mgmt *mgmt;
114 struct wlantest_bss *bss;
115 struct wlantest_sta *sta;
116 u16 alg, trans, status;
118 mgmt = (const struct ieee80211_mgmt *) data;
119 bss = bss_get(wt, mgmt->bssid);
122 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
123 sta = sta_get(bss, mgmt->da);
125 sta = sta_get(bss, mgmt->sa);
130 wpa_printf(MSG_INFO, "Too short Authentication frame from "
131 MACSTR, MAC2STR(mgmt->sa));
135 alg = le_to_host16(mgmt->u.auth.auth_alg);
136 trans = le_to_host16(mgmt->u.auth.auth_transaction);
137 status = le_to_host16(mgmt->u.auth.status_code);
139 wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
140 " (alg=%u trans=%u status=%u)",
141 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
143 if (alg == 0 && trans == 2 && status == 0) {
144 if (sta->state == STATE1) {
145 wpa_printf(MSG_DEBUG, "STA " MACSTR
146 " moved to State 2 with " MACSTR,
147 MAC2STR(sta->addr), MAC2STR(bss->bssid));
154 static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
157 const struct ieee80211_mgmt *mgmt;
158 struct wlantest_bss *bss;
159 struct wlantest_sta *sta;
161 mgmt = (const struct ieee80211_mgmt *) data;
162 bss = bss_get(wt, mgmt->bssid);
165 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
166 sta = sta_get(bss, mgmt->da);
168 sta = sta_get(bss, mgmt->sa);
173 wpa_printf(MSG_INFO, "Too short Deauthentication frame from "
174 MACSTR, MAC2STR(mgmt->sa));
178 wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
180 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
181 le_to_host16(mgmt->u.deauth.reason_code));
182 wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
185 wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
186 "since Disassociation frame was not protected "
187 "correctly", MAC2STR(sta->addr));
191 if (sta->state != STATE1) {
192 wpa_printf(MSG_DEBUG, "STA " MACSTR
193 " moved to State 1 with " MACSTR,
194 MAC2STR(sta->addr), MAC2STR(bss->bssid));
200 static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
202 const struct ieee80211_mgmt *mgmt;
203 struct wlantest_bss *bss;
204 struct wlantest_sta *sta;
205 struct ieee802_11_elems elems;
207 mgmt = (const struct ieee80211_mgmt *) data;
208 bss = bss_get(wt, mgmt->bssid);
211 sta = sta_get(bss, mgmt->sa);
216 wpa_printf(MSG_INFO, "Too short Association Request frame "
217 "from " MACSTR, MAC2STR(mgmt->sa));
221 wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
222 " (capab=0x%x listen_int=%u)",
223 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
224 le_to_host16(mgmt->u.assoc_req.capab_info),
225 le_to_host16(mgmt->u.assoc_req.listen_interval));
227 if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
228 len - (mgmt->u.assoc_req.variable - data),
229 &elems, 0) == ParseFailed) {
230 wpa_printf(MSG_INFO, "Invalid IEs in Association Request "
231 "frame from " MACSTR, MAC2STR(mgmt->sa));
235 sta_update_assoc(sta, &elems);
239 static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
241 const struct ieee80211_mgmt *mgmt;
242 struct wlantest_bss *bss;
243 struct wlantest_sta *sta;
244 u16 capab, status, aid;
246 mgmt = (const struct ieee80211_mgmt *) data;
247 bss = bss_get(wt, mgmt->bssid);
250 sta = sta_get(bss, mgmt->da);
255 wpa_printf(MSG_INFO, "Too short Association Response frame "
256 "from " MACSTR, MAC2STR(mgmt->sa));
260 capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
261 status = le_to_host16(mgmt->u.assoc_resp.status_code);
262 aid = le_to_host16(mgmt->u.assoc_resp.aid);
264 wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
265 " (capab=0x%x status=%u aid=%u)",
266 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
272 if ((aid & 0xc000) != 0xc000) {
273 wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
274 "in Association Response from " MACSTR,
277 sta->aid = aid & 0xc000;
279 if (sta->state < STATE2) {
280 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
281 "getting associated", MAC2STR(sta->addr));
284 if (sta->state < STATE3) {
285 wpa_printf(MSG_DEBUG, "STA " MACSTR
286 " moved to State 3 with " MACSTR,
287 MAC2STR(sta->addr), MAC2STR(bss->bssid));
293 static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
296 const struct ieee80211_mgmt *mgmt;
297 struct wlantest_bss *bss;
298 struct wlantest_sta *sta;
299 struct ieee802_11_elems elems;
301 mgmt = (const struct ieee80211_mgmt *) data;
302 bss = bss_get(wt, mgmt->bssid);
305 sta = sta_get(bss, mgmt->sa);
309 if (len < 24 + 4 + ETH_ALEN) {
310 wpa_printf(MSG_INFO, "Too short Reassociation Request frame "
311 "from " MACSTR, MAC2STR(mgmt->sa));
315 wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
316 " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
317 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
318 le_to_host16(mgmt->u.reassoc_req.capab_info),
319 le_to_host16(mgmt->u.reassoc_req.listen_interval),
320 MAC2STR(mgmt->u.reassoc_req.current_ap));
322 if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
323 len - (mgmt->u.reassoc_req.variable - data),
324 &elems, 0) == ParseFailed) {
325 wpa_printf(MSG_INFO, "Invalid IEs in Reassociation Request "
326 "frame from " MACSTR, MAC2STR(mgmt->sa));
330 sta_update_assoc(sta, &elems);
334 static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
337 const struct ieee80211_mgmt *mgmt;
338 struct wlantest_bss *bss;
339 struct wlantest_sta *sta;
340 u16 capab, status, aid;
342 mgmt = (const struct ieee80211_mgmt *) data;
343 bss = bss_get(wt, mgmt->bssid);
346 sta = sta_get(bss, mgmt->da);
351 wpa_printf(MSG_INFO, "Too short Reassociation Response frame "
352 "from " MACSTR, MAC2STR(mgmt->sa));
356 capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
357 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
358 aid = le_to_host16(mgmt->u.reassoc_resp.aid);
360 wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
361 " (capab=0x%x status=%u aid=%u)",
362 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
368 if ((aid & 0xc000) != 0xc000) {
369 wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
370 "in Reassociation Response from " MACSTR,
373 sta->aid = aid & 0xc000;
375 if (sta->state < STATE2) {
376 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
377 "getting associated", MAC2STR(sta->addr));
380 if (sta->state < STATE3) {
381 wpa_printf(MSG_DEBUG, "STA " MACSTR
382 " moved to State 3 with " MACSTR,
383 MAC2STR(sta->addr), MAC2STR(bss->bssid));
389 static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
392 const struct ieee80211_mgmt *mgmt;
393 struct wlantest_bss *bss;
394 struct wlantest_sta *sta;
396 mgmt = (const struct ieee80211_mgmt *) data;
397 bss = bss_get(wt, mgmt->bssid);
400 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
401 sta = sta_get(bss, mgmt->da);
403 sta = sta_get(bss, mgmt->sa);
408 wpa_printf(MSG_INFO, "Too short Disassociation frame from "
409 MACSTR, MAC2STR(mgmt->sa));
413 wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
415 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
416 le_to_host16(mgmt->u.disassoc.reason_code));
417 wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
420 wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
421 "since Disassociation frame was not protected "
422 "correctly", MAC2STR(sta->addr));
426 if (sta->state < STATE2) {
427 wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 or 3 "
428 "when getting disassociated", MAC2STR(sta->addr));
431 if (sta->state > STATE2) {
432 wpa_printf(MSG_DEBUG, "STA " MACSTR
433 " moved to State 2 with " MACSTR,
434 MAC2STR(sta->addr), MAC2STR(bss->bssid));
440 static void rx_mgmt_action_sa_query(struct wlantest *wt,
441 struct wlantest_sta *sta,
442 const struct ieee80211_mgmt *mgmt,
448 if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
449 wpa_printf(MSG_INFO, "Too short SA Query frame from " MACSTR,
454 if (len > 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
455 size_t elen = len - (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN);
456 wpa_printf(MSG_INFO, "Unexpected %u octets of extra data at "
457 "the end of SA Query frame from " MACSTR,
458 (unsigned) elen, MAC2STR(mgmt->sa));
459 wpa_hexdump(MSG_INFO, "SA Query extra data",
460 ((const u8 *) mgmt) + len - elen, elen);
463 switch (mgmt->u.action.u.sa_query_req.action) {
464 case WLAN_SA_QUERY_REQUEST:
465 rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
466 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
467 id = sta->ap_sa_query_tr;
469 id = sta->sta_sa_query_tr;
470 wpa_printf(MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
471 " (trans_id=%02x%02x)",
472 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
474 os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
476 case WLAN_SA_QUERY_RESPONSE:
477 rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
478 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
479 id = sta->sta_sa_query_tr;
481 id = sta->ap_sa_query_tr;
482 wpa_printf(MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
483 " (trans_id=%02x%02x; %s)",
484 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
486 os_memcmp(rx_id, id, 2) == 0 ?
487 "match" : "mismatch");
490 wpa_printf(MSG_INFO, "Unexpected SA Query action value %u "
492 mgmt->u.action.u.sa_query_req.action,
498 static void rx_mgmt_action(struct wlantest *wt, const u8 *data, size_t len)
500 const struct ieee80211_mgmt *mgmt;
501 struct wlantest_bss *bss;
502 struct wlantest_sta *sta;
504 mgmt = (const struct ieee80211_mgmt *) data;
505 if (mgmt->da[0] & 0x01)
506 return; /* Ignore group addressed Action frames for now */
507 bss = bss_get(wt, mgmt->bssid);
510 if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
511 sta = sta_get(bss, mgmt->da);
513 sta = sta_get(bss, mgmt->sa);
518 wpa_printf(MSG_INFO, "Too short Action frame from "
519 MACSTR, MAC2STR(mgmt->sa));
523 wpa_printf(MSG_DEBUG, "ACTION " MACSTR " -> " MACSTR
525 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
526 mgmt->u.action.category);
527 wpa_hexdump(MSG_MSGDUMP, "ACTION payload", data + 24, len - 24);
529 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
530 sta->state < STATE3) {
531 wpa_printf(MSG_INFO, "Action frame sent when STA is not in "
532 "State 3 (SA=" MACSTR " DATA=" MACSTR ")",
533 MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
536 switch (mgmt->u.action.category) {
537 case WLAN_ACTION_SA_QUERY:
538 rx_mgmt_action_sa_query(wt, sta, mgmt, len);
544 static int check_mmie_mic(const u8 *igtk, const u8 *data, size_t len)
549 const struct ieee80211_hdr *hdr;
551 buf = os_malloc(len + 20 - 24);
555 /* BIP AAD: FC(masked) A1 A2 A3 */
556 hdr = (const struct ieee80211_hdr *) data;
557 fc = le_to_host16(hdr->frame_control);
558 fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
559 WPA_PUT_LE16(buf, fc);
560 os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
562 /* Frame body with MMIE MIC masked to zero */
563 os_memcpy(buf + 20, data + 24, len - 24 - 8);
564 os_memset(buf + 20 + len - 24 - 8, 0, 8);
566 wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
567 /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
568 if (omac1_aes_128(igtk, buf, len + 20 - 24, mic) < 0) {
575 if (os_memcmp(data + len - 8, mic, 8) != 0)
582 static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
584 const struct ieee80211_mgmt *mgmt;
588 struct wlantest_bss *bss;
590 mgmt = (const struct ieee80211_mgmt *) data;
591 fc = le_to_host16(mgmt->frame_control);
592 stype = WLAN_FC_GET_STYPE(fc);
594 if (stype == WLAN_FC_STYPE_ACTION) {
597 if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
598 return 0; /* Not a robust management frame */
601 bss = bss_get(wt, mgmt->bssid);
603 return 0; /* No key known yet */
605 if (len < 24 + 18 || data[len - 18] != WLAN_EID_MMIE ||
606 data[len - 17] != 16) {
608 /* TODO: use MFPC flag in RSN IE instead of IGTK flags */
609 if (bss->igtk_set[4] || bss->igtk_set[5]) {
610 wpa_printf(MSG_INFO, "Robust group-addressed "
611 "management frame sent without BIP by "
612 MACSTR, MAC2STR(mgmt->sa));
618 mmie = data + len - 16;
619 keyid = WPA_GET_LE16(mmie);
620 if (keyid < 4 || keyid > 5) {
621 wpa_printf(MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
622 keyid, MAC2STR(mgmt->sa));
625 wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
626 wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
627 wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, 8);
629 if (!bss->igtk_set[keyid]) {
630 wpa_printf(MSG_DEBUG, "No IGTK known to validate BIP frame");
634 if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
635 wpa_printf(MSG_INFO, "BIP replay detected: SA=" MACSTR,
637 wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
638 wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
641 if (check_mmie_mic(bss->igtk[keyid], data, len) < 0) {
642 wpa_printf(MSG_INFO, "Invalid MMIE MIC in a frame from "
643 MACSTR, MAC2STR(mgmt->sa));
647 wpa_printf(MSG_DEBUG, "Valid MMIE MIC");
648 os_memcpy(bss->ipn[keyid], mmie + 2, 6);
654 static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
657 struct wlantest_bss *bss;
658 struct wlantest_sta *sta;
659 const struct ieee80211_hdr *hdr;
661 u8 *decrypted, *frame;
664 hdr = (const struct ieee80211_hdr *) data;
665 bss = bss_get(wt, hdr->addr3);
668 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
669 sta = sta_get(bss, hdr->addr2);
671 sta = sta_get(bss, hdr->addr1);
672 if (sta == NULL || !sta->ptk_set) {
673 wpa_printf(MSG_MSGDUMP, "No PTK known to decrypt the frame");
677 keyid = data[3] >> 6;
679 wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
680 "individually addressed Management frame from "
681 MACSTR, keyid, MAC2STR(hdr->addr2));
684 if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
685 rsc = sta->rsc_tods[16];
687 rsc = sta->rsc_fromds[16];
689 ccmp_get_pn(pn, data);
690 if (os_memcmp(pn, rsc, 6) <= 0) {
691 wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: SA=" MACSTR,
692 MAC2STR(hdr->addr2));
693 wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
694 wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
697 decrypted = ccmp_decrypt(sta->ptk.tk1, hdr, data + 24, len - 24, dlen);
699 os_memcpy(rsc, pn, 6);
701 frame = os_malloc(24 + *dlen);
703 os_memcpy(frame, data, 24);
704 os_memcpy(frame + 24, decrypted, *dlen);
714 void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
716 const struct ieee80211_hdr *hdr;
719 u8 *decrypted = NULL;
725 hdr = (const struct ieee80211_hdr *) data;
726 fc = le_to_host16(hdr->frame_control);
728 stype = WLAN_FC_GET_STYPE(fc);
730 if ((hdr->addr1[0] & 0x01) &&
731 (stype == WLAN_FC_STYPE_DEAUTH ||
732 stype == WLAN_FC_STYPE_DISASSOC ||
733 stype == WLAN_FC_STYPE_ACTION))
734 check_bip(wt, data, len);
736 wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
737 stype == WLAN_FC_STYPE_PROBE_RESP ||
738 stype == WLAN_FC_STYPE_PROBE_REQ) ?
739 MSG_EXCESSIVE : MSG_MSGDUMP,
740 "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
742 fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
743 fc & WLAN_FC_ISWEP ? " Prot" : "",
744 MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
745 MAC2STR(hdr->addr3));
747 if ((fc & WLAN_FC_ISWEP) &&
748 !(hdr->addr1[0] & 0x01) &&
749 (stype == WLAN_FC_STYPE_DEAUTH ||
750 stype == WLAN_FC_STYPE_DISASSOC ||
751 stype == WLAN_FC_STYPE_ACTION)) {
752 decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
760 /* TODO: verify that robust management frames are protected if MFP was
764 case WLAN_FC_STYPE_BEACON:
765 rx_mgmt_beacon(wt, data, len);
767 case WLAN_FC_STYPE_PROBE_RESP:
768 rx_mgmt_probe_resp(wt, data, len);
770 case WLAN_FC_STYPE_AUTH:
771 rx_mgmt_auth(wt, data, len);
773 case WLAN_FC_STYPE_DEAUTH:
774 rx_mgmt_deauth(wt, data, len, valid);
776 case WLAN_FC_STYPE_ASSOC_REQ:
777 rx_mgmt_assoc_req(wt, data, len);
779 case WLAN_FC_STYPE_ASSOC_RESP:
780 rx_mgmt_assoc_resp(wt, data, len);
782 case WLAN_FC_STYPE_REASSOC_REQ:
783 rx_mgmt_reassoc_req(wt, data, len);
785 case WLAN_FC_STYPE_REASSOC_RESP:
786 rx_mgmt_reassoc_resp(wt, data, len);
788 case WLAN_FC_STYPE_DISASSOC:
789 rx_mgmt_disassoc(wt, data, len, valid);
791 case WLAN_FC_STYPE_ACTION:
793 rx_mgmt_action(wt, data, len);