rx_mgmt.c 31 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153
  1. /*
  2. * Received Management frame processing
  3. * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
  4. *
  5. * This program is free software; you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License version 2 as
  7. * published by the Free Software Foundation.
  8. *
  9. * Alternatively, this software may be distributed under the terms of BSD
  10. * license.
  11. *
  12. * See README and COPYING for more details.
  13. */
  14. #include "utils/includes.h"
  15. #include "utils/common.h"
  16. #include "common/ieee802_11_defs.h"
  17. #include "common/ieee802_11_common.h"
  18. #include "crypto/aes_wrap.h"
  19. #include "wlantest.h"
  20. static const char * mgmt_stype(u16 stype)
  21. {
  22. switch (stype) {
  23. case WLAN_FC_STYPE_ASSOC_REQ:
  24. return "ASSOC-REQ";
  25. case WLAN_FC_STYPE_ASSOC_RESP:
  26. return "ASSOC-RESP";
  27. case WLAN_FC_STYPE_REASSOC_REQ:
  28. return "REASSOC-REQ";
  29. case WLAN_FC_STYPE_REASSOC_RESP:
  30. return "REASSOC-RESP";
  31. case WLAN_FC_STYPE_PROBE_REQ:
  32. return "PROBE-REQ";
  33. case WLAN_FC_STYPE_PROBE_RESP:
  34. return "PROBE-RESP";
  35. case WLAN_FC_STYPE_BEACON:
  36. return "BEACON";
  37. case WLAN_FC_STYPE_ATIM:
  38. return "ATIM";
  39. case WLAN_FC_STYPE_DISASSOC:
  40. return "DISASSOC";
  41. case WLAN_FC_STYPE_AUTH:
  42. return "AUTH";
  43. case WLAN_FC_STYPE_DEAUTH:
  44. return "DEAUTH";
  45. case WLAN_FC_STYPE_ACTION:
  46. return "ACTION";
  47. }
  48. return "??";
  49. }
  50. static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
  51. {
  52. const struct ieee80211_mgmt *mgmt;
  53. struct wlantest_bss *bss;
  54. struct ieee802_11_elems elems;
  55. mgmt = (const struct ieee80211_mgmt *) data;
  56. bss = bss_get(wt, mgmt->bssid);
  57. if (bss == NULL)
  58. return;
  59. if (bss->proberesp_seen)
  60. return; /* do not override with Beacon data */
  61. bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
  62. if (ieee802_11_parse_elems(mgmt->u.beacon.variable,
  63. len - (mgmt->u.beacon.variable - data),
  64. &elems, 0) == ParseFailed) {
  65. if (bss->parse_error_reported)
  66. return;
  67. wpa_printf(MSG_INFO, "Invalid IEs in a Beacon frame from "
  68. MACSTR, MAC2STR(mgmt->sa));
  69. bss->parse_error_reported = 1;
  70. return;
  71. }
  72. bss_update(wt, bss, &elems);
  73. }
  74. static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
  75. {
  76. const struct ieee80211_mgmt *mgmt;
  77. struct wlantest_bss *bss;
  78. struct ieee802_11_elems elems;
  79. mgmt = (const struct ieee80211_mgmt *) data;
  80. bss = bss_get(wt, mgmt->bssid);
  81. if (bss == NULL)
  82. return;
  83. bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
  84. if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
  85. len - (mgmt->u.probe_resp.variable - data),
  86. &elems, 0) == ParseFailed) {
  87. if (bss->parse_error_reported)
  88. return;
  89. wpa_printf(MSG_INFO, "Invalid IEs in a Probe Response frame "
  90. "from " MACSTR, MAC2STR(mgmt->sa));
  91. bss->parse_error_reported = 1;
  92. return;
  93. }
  94. bss_update(wt, bss, &elems);
  95. }
  96. static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
  97. {
  98. const struct ieee80211_mgmt *mgmt;
  99. struct wlantest_bss *bss;
  100. struct wlantest_sta *sta;
  101. u16 alg, trans, status;
  102. mgmt = (const struct ieee80211_mgmt *) data;
  103. bss = bss_get(wt, mgmt->bssid);
  104. if (bss == NULL)
  105. return;
  106. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  107. sta = sta_get(bss, mgmt->da);
  108. else
  109. sta = sta_get(bss, mgmt->sa);
  110. if (sta == NULL)
  111. return;
  112. if (len < 24 + 6) {
  113. wpa_printf(MSG_INFO, "Too short Authentication frame from "
  114. MACSTR, MAC2STR(mgmt->sa));
  115. return;
  116. }
  117. alg = le_to_host16(mgmt->u.auth.auth_alg);
  118. trans = le_to_host16(mgmt->u.auth.auth_transaction);
  119. status = le_to_host16(mgmt->u.auth.status_code);
  120. wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
  121. " (alg=%u trans=%u status=%u)",
  122. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
  123. if (alg == 0 && trans == 2 && status == 0) {
  124. if (sta->state == STATE1) {
  125. wpa_printf(MSG_DEBUG, "STA " MACSTR
  126. " moved to State 2 with " MACSTR,
  127. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  128. sta->state = STATE2;
  129. }
  130. }
  131. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  132. sta->counters[WLANTEST_STA_COUNTER_AUTH_RX]++;
  133. else
  134. sta->counters[WLANTEST_STA_COUNTER_AUTH_TX]++;
  135. }
  136. static void deauth_all_stas(struct wlantest_bss *bss)
  137. {
  138. struct wlantest_sta *sta;
  139. dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
  140. if (sta->state == STATE1)
  141. continue;
  142. wpa_printf(MSG_DEBUG, "STA " MACSTR
  143. " moved to State 1 with " MACSTR,
  144. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  145. sta->state = STATE1;
  146. }
  147. }
  148. static void tdls_link_down(struct wlantest_bss *bss, struct wlantest_sta *sta)
  149. {
  150. struct wlantest_tdls *tdls;
  151. dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list) {
  152. if ((tdls->init == sta || tdls->resp == sta) && tdls->link_up)
  153. {
  154. wpa_printf(MSG_DEBUG, "TDLS: Set link down based on "
  155. "STA deauth/disassoc");
  156. tdls->link_up = 0;
  157. }
  158. }
  159. }
  160. static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
  161. int valid)
  162. {
  163. const struct ieee80211_mgmt *mgmt;
  164. struct wlantest_bss *bss;
  165. struct wlantest_sta *sta;
  166. mgmt = (const struct ieee80211_mgmt *) data;
  167. bss = bss_get(wt, mgmt->bssid);
  168. if (bss == NULL)
  169. return;
  170. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  171. sta = sta_get(bss, mgmt->da);
  172. else
  173. sta = sta_get(bss, mgmt->sa);
  174. if (len < 24 + 2) {
  175. wpa_printf(MSG_INFO, "Too short Deauthentication frame from "
  176. MACSTR, MAC2STR(mgmt->sa));
  177. return;
  178. }
  179. wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
  180. " (reason=%u) (valid=%d)",
  181. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  182. le_to_host16(mgmt->u.deauth.reason_code), valid);
  183. wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
  184. if (sta == NULL) {
  185. if (valid && mgmt->da[0] == 0xff)
  186. deauth_all_stas(bss);
  187. return;
  188. }
  189. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  190. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_RX :
  191. WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX]++;
  192. if (sta->pwrmgt && !sta->pspoll)
  193. sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_ASLEEP]++;
  194. else
  195. sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_AWAKE]++;
  196. } else
  197. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_TX :
  198. WLANTEST_STA_COUNTER_INVALID_DEAUTH_TX]++;
  199. if (!valid) {
  200. wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
  201. "since Disassociation frame was not protected "
  202. "correctly", MAC2STR(sta->addr));
  203. return;
  204. }
  205. if (sta->state != STATE1) {
  206. wpa_printf(MSG_DEBUG, "STA " MACSTR
  207. " moved to State 1 with " MACSTR,
  208. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  209. sta->state = STATE1;
  210. }
  211. tdls_link_down(bss, sta);
  212. }
  213. static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
  214. {
  215. const struct ieee80211_mgmt *mgmt;
  216. struct wlantest_bss *bss;
  217. struct wlantest_sta *sta;
  218. struct ieee802_11_elems elems;
  219. mgmt = (const struct ieee80211_mgmt *) data;
  220. bss = bss_get(wt, mgmt->bssid);
  221. if (bss == NULL)
  222. return;
  223. sta = sta_get(bss, mgmt->sa);
  224. if (sta == NULL)
  225. return;
  226. if (len < 24 + 4) {
  227. wpa_printf(MSG_INFO, "Too short Association Request frame "
  228. "from " MACSTR, MAC2STR(mgmt->sa));
  229. return;
  230. }
  231. wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
  232. " (capab=0x%x listen_int=%u)",
  233. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  234. le_to_host16(mgmt->u.assoc_req.capab_info),
  235. le_to_host16(mgmt->u.assoc_req.listen_interval));
  236. sta->counters[WLANTEST_STA_COUNTER_ASSOCREQ_TX]++;
  237. if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
  238. len - (mgmt->u.assoc_req.variable - data),
  239. &elems, 0) == ParseFailed) {
  240. wpa_printf(MSG_INFO, "Invalid IEs in Association Request "
  241. "frame from " MACSTR, MAC2STR(mgmt->sa));
  242. return;
  243. }
  244. sta->assocreq_capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
  245. sta->assocreq_listen_int =
  246. le_to_host16(mgmt->u.assoc_req.listen_interval);
  247. os_free(sta->assocreq_ies);
  248. sta->assocreq_ies_len = len - (mgmt->u.assoc_req.variable - data);
  249. sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
  250. if (sta->assocreq_ies)
  251. os_memcpy(sta->assocreq_ies, mgmt->u.assoc_req.variable,
  252. sta->assocreq_ies_len);
  253. sta_update_assoc(sta, &elems);
  254. }
  255. static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
  256. {
  257. const struct ieee80211_mgmt *mgmt;
  258. struct wlantest_bss *bss;
  259. struct wlantest_sta *sta;
  260. u16 capab, status, aid;
  261. mgmt = (const struct ieee80211_mgmt *) data;
  262. bss = bss_get(wt, mgmt->bssid);
  263. if (bss == NULL)
  264. return;
  265. sta = sta_get(bss, mgmt->da);
  266. if (sta == NULL)
  267. return;
  268. if (len < 24 + 6) {
  269. wpa_printf(MSG_INFO, "Too short Association Response frame "
  270. "from " MACSTR, MAC2STR(mgmt->sa));
  271. return;
  272. }
  273. capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
  274. status = le_to_host16(mgmt->u.assoc_resp.status_code);
  275. aid = le_to_host16(mgmt->u.assoc_resp.aid);
  276. wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
  277. " (capab=0x%x status=%u aid=%u)",
  278. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
  279. aid & 0x3fff);
  280. if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
  281. struct ieee802_11_elems elems;
  282. const u8 *ies = mgmt->u.assoc_resp.variable;
  283. size_t ies_len = len - (mgmt->u.assoc_resp.variable - data);
  284. if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
  285. ParseFailed) {
  286. wpa_printf(MSG_INFO, "Failed to parse IEs in "
  287. "AssocResp from " MACSTR,
  288. MAC2STR(mgmt->sa));
  289. } else if (elems.timeout_int == 0 ||
  290. elems.timeout_int_len != 5) {
  291. wpa_printf(MSG_INFO, "No valid Timeout Interval IE in "
  292. "AssocResp (status=30) from " MACSTR,
  293. MAC2STR(mgmt->sa));
  294. } else {
  295. sta->counters[
  296. WLANTEST_STA_COUNTER_ASSOCRESP_COMEBACK]++;
  297. }
  298. }
  299. if (status)
  300. return;
  301. if ((aid & 0xc000) != 0xc000) {
  302. wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
  303. "in Association Response from " MACSTR,
  304. MAC2STR(mgmt->sa));
  305. }
  306. sta->aid = aid & 0xc000;
  307. if (sta->state < STATE2) {
  308. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
  309. "getting associated", MAC2STR(sta->addr));
  310. }
  311. if (sta->state < STATE3) {
  312. wpa_printf(MSG_DEBUG, "STA " MACSTR
  313. " moved to State 3 with " MACSTR,
  314. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  315. sta->state = STATE3;
  316. }
  317. }
  318. static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
  319. size_t len)
  320. {
  321. const struct ieee80211_mgmt *mgmt;
  322. struct wlantest_bss *bss;
  323. struct wlantest_sta *sta;
  324. struct ieee802_11_elems elems;
  325. mgmt = (const struct ieee80211_mgmt *) data;
  326. bss = bss_get(wt, mgmt->bssid);
  327. if (bss == NULL)
  328. return;
  329. sta = sta_get(bss, mgmt->sa);
  330. if (sta == NULL)
  331. return;
  332. if (len < 24 + 4 + ETH_ALEN) {
  333. wpa_printf(MSG_INFO, "Too short Reassociation Request frame "
  334. "from " MACSTR, MAC2STR(mgmt->sa));
  335. return;
  336. }
  337. wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
  338. " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
  339. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  340. le_to_host16(mgmt->u.reassoc_req.capab_info),
  341. le_to_host16(mgmt->u.reassoc_req.listen_interval),
  342. MAC2STR(mgmt->u.reassoc_req.current_ap));
  343. sta->counters[WLANTEST_STA_COUNTER_REASSOCREQ_TX]++;
  344. if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
  345. len - (mgmt->u.reassoc_req.variable - data),
  346. &elems, 0) == ParseFailed) {
  347. wpa_printf(MSG_INFO, "Invalid IEs in Reassociation Request "
  348. "frame from " MACSTR, MAC2STR(mgmt->sa));
  349. return;
  350. }
  351. sta->assocreq_capab_info =
  352. le_to_host16(mgmt->u.reassoc_req.capab_info);
  353. sta->assocreq_listen_int =
  354. le_to_host16(mgmt->u.reassoc_req.listen_interval);
  355. os_free(sta->assocreq_ies);
  356. sta->assocreq_ies_len = len - (mgmt->u.reassoc_req.variable - data);
  357. sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
  358. if (sta->assocreq_ies)
  359. os_memcpy(sta->assocreq_ies, mgmt->u.reassoc_req.variable,
  360. sta->assocreq_ies_len);
  361. sta_update_assoc(sta, &elems);
  362. }
  363. static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
  364. size_t len)
  365. {
  366. const struct ieee80211_mgmt *mgmt;
  367. struct wlantest_bss *bss;
  368. struct wlantest_sta *sta;
  369. u16 capab, status, aid;
  370. mgmt = (const struct ieee80211_mgmt *) data;
  371. bss = bss_get(wt, mgmt->bssid);
  372. if (bss == NULL)
  373. return;
  374. sta = sta_get(bss, mgmt->da);
  375. if (sta == NULL)
  376. return;
  377. if (len < 24 + 6) {
  378. wpa_printf(MSG_INFO, "Too short Reassociation Response frame "
  379. "from " MACSTR, MAC2STR(mgmt->sa));
  380. return;
  381. }
  382. capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
  383. status = le_to_host16(mgmt->u.reassoc_resp.status_code);
  384. aid = le_to_host16(mgmt->u.reassoc_resp.aid);
  385. wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
  386. " (capab=0x%x status=%u aid=%u)",
  387. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
  388. aid & 0x3fff);
  389. if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
  390. struct ieee802_11_elems elems;
  391. const u8 *ies = mgmt->u.reassoc_resp.variable;
  392. size_t ies_len = len - (mgmt->u.reassoc_resp.variable - data);
  393. if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
  394. ParseFailed) {
  395. wpa_printf(MSG_INFO, "Failed to parse IEs in "
  396. "ReassocResp from " MACSTR,
  397. MAC2STR(mgmt->sa));
  398. } else if (elems.timeout_int == 0 ||
  399. elems.timeout_int_len != 5) {
  400. wpa_printf(MSG_INFO, "No valid Timeout Interval IE in "
  401. "ReassocResp (status=30) from " MACSTR,
  402. MAC2STR(mgmt->sa));
  403. } else {
  404. sta->counters[
  405. WLANTEST_STA_COUNTER_REASSOCRESP_COMEBACK]++;
  406. }
  407. }
  408. if (status)
  409. return;
  410. if ((aid & 0xc000) != 0xc000) {
  411. wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
  412. "in Reassociation Response from " MACSTR,
  413. MAC2STR(mgmt->sa));
  414. }
  415. sta->aid = aid & 0xc000;
  416. if (sta->state < STATE2) {
  417. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
  418. "getting associated", MAC2STR(sta->addr));
  419. }
  420. if (sta->state < STATE3) {
  421. wpa_printf(MSG_DEBUG, "STA " MACSTR
  422. " moved to State 3 with " MACSTR,
  423. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  424. sta->state = STATE3;
  425. }
  426. }
  427. static void disassoc_all_stas(struct wlantest_bss *bss)
  428. {
  429. struct wlantest_sta *sta;
  430. dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
  431. if (sta->state <= STATE2)
  432. continue;
  433. wpa_printf(MSG_DEBUG, "STA " MACSTR
  434. " moved to State 2 with " MACSTR,
  435. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  436. sta->state = STATE2;
  437. }
  438. }
  439. static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
  440. int valid)
  441. {
  442. const struct ieee80211_mgmt *mgmt;
  443. struct wlantest_bss *bss;
  444. struct wlantest_sta *sta;
  445. mgmt = (const struct ieee80211_mgmt *) data;
  446. bss = bss_get(wt, mgmt->bssid);
  447. if (bss == NULL)
  448. return;
  449. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  450. sta = sta_get(bss, mgmt->da);
  451. else
  452. sta = sta_get(bss, mgmt->sa);
  453. if (len < 24 + 2) {
  454. wpa_printf(MSG_INFO, "Too short Disassociation frame from "
  455. MACSTR, MAC2STR(mgmt->sa));
  456. return;
  457. }
  458. wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
  459. " (reason=%u) (valid=%d)",
  460. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  461. le_to_host16(mgmt->u.disassoc.reason_code), valid);
  462. wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
  463. if (sta == NULL) {
  464. if (valid && mgmt->da[0] == 0xff)
  465. disassoc_all_stas(bss);
  466. return;
  467. }
  468. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  469. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_RX :
  470. WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX]++;
  471. if (sta->pwrmgt && !sta->pspoll)
  472. sta->counters[
  473. WLANTEST_STA_COUNTER_DISASSOC_RX_ASLEEP]++;
  474. else
  475. sta->counters[
  476. WLANTEST_STA_COUNTER_DISASSOC_RX_AWAKE]++;
  477. } else
  478. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_TX :
  479. WLANTEST_STA_COUNTER_INVALID_DISASSOC_TX]++;
  480. if (!valid) {
  481. wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
  482. "since Disassociation frame was not protected "
  483. "correctly", MAC2STR(sta->addr));
  484. return;
  485. }
  486. if (sta->state < STATE2) {
  487. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 or 3 "
  488. "when getting disassociated", MAC2STR(sta->addr));
  489. }
  490. if (sta->state > STATE2) {
  491. wpa_printf(MSG_DEBUG, "STA " MACSTR
  492. " moved to State 2 with " MACSTR,
  493. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  494. sta->state = STATE2;
  495. }
  496. tdls_link_down(bss, sta);
  497. }
  498. static void rx_mgmt_action_sa_query_req(struct wlantest *wt,
  499. struct wlantest_sta *sta,
  500. const struct ieee80211_mgmt *mgmt,
  501. size_t len, int valid)
  502. {
  503. const u8 *rx_id;
  504. u8 *id;
  505. rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
  506. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  507. id = sta->ap_sa_query_tr;
  508. else
  509. id = sta->sta_sa_query_tr;
  510. wpa_printf(MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
  511. " (trans_id=%02x%02x)%s",
  512. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
  513. valid ? "" : " (invalid protection)");
  514. os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
  515. if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
  516. sta->counters[valid ?
  517. WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_TX :
  518. WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_TX]++;
  519. else
  520. sta->counters[valid ?
  521. WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_RX :
  522. WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_RX]++;
  523. }
  524. static void rx_mgmt_action_sa_query_resp(struct wlantest *wt,
  525. struct wlantest_sta *sta,
  526. const struct ieee80211_mgmt *mgmt,
  527. size_t len, int valid)
  528. {
  529. const u8 *rx_id;
  530. u8 *id;
  531. int match;
  532. rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
  533. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  534. id = sta->sta_sa_query_tr;
  535. else
  536. id = sta->ap_sa_query_tr;
  537. match = os_memcmp(rx_id, id, 2) == 0;
  538. wpa_printf(MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
  539. " (trans_id=%02x%02x; %s)%s",
  540. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
  541. match ? "match" : "mismatch",
  542. valid ? "" : " (invalid protection)");
  543. if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
  544. sta->counters[(valid && match) ?
  545. WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_TX :
  546. WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_TX]++;
  547. else
  548. sta->counters[(valid && match) ?
  549. WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_RX :
  550. WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_RX]++;
  551. }
  552. static void rx_mgmt_action_sa_query(struct wlantest *wt,
  553. struct wlantest_sta *sta,
  554. const struct ieee80211_mgmt *mgmt,
  555. size_t len, int valid)
  556. {
  557. if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
  558. wpa_printf(MSG_INFO, "Too short SA Query frame from " MACSTR,
  559. MAC2STR(mgmt->sa));
  560. return;
  561. }
  562. if (len > 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
  563. size_t elen = len - (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN);
  564. wpa_printf(MSG_INFO, "Unexpected %u octets of extra data at "
  565. "the end of SA Query frame from " MACSTR,
  566. (unsigned) elen, MAC2STR(mgmt->sa));
  567. wpa_hexdump(MSG_INFO, "SA Query extra data",
  568. ((const u8 *) mgmt) + len - elen, elen);
  569. }
  570. switch (mgmt->u.action.u.sa_query_req.action) {
  571. case WLAN_SA_QUERY_REQUEST:
  572. rx_mgmt_action_sa_query_req(wt, sta, mgmt, len, valid);
  573. break;
  574. case WLAN_SA_QUERY_RESPONSE:
  575. rx_mgmt_action_sa_query_resp(wt, sta, mgmt, len, valid);
  576. break;
  577. default:
  578. wpa_printf(MSG_INFO, "Unexpected SA Query action value %u "
  579. "from " MACSTR,
  580. mgmt->u.action.u.sa_query_req.action,
  581. MAC2STR(mgmt->sa));
  582. }
  583. }
  584. static void rx_mgmt_action(struct wlantest *wt, const u8 *data, size_t len,
  585. int valid)
  586. {
  587. const struct ieee80211_mgmt *mgmt;
  588. struct wlantest_bss *bss;
  589. struct wlantest_sta *sta;
  590. mgmt = (const struct ieee80211_mgmt *) data;
  591. if (mgmt->da[0] & 0x01) {
  592. wpa_printf(MSG_DEBUG, "Group addressed Action frame: DA="
  593. MACSTR " SA=" MACSTR " BSSID=" MACSTR
  594. " category=%u",
  595. MAC2STR(mgmt->da), MAC2STR(mgmt->sa),
  596. MAC2STR(mgmt->bssid), mgmt->u.action.category);
  597. return; /* Ignore group addressed Action frames for now */
  598. }
  599. bss = bss_get(wt, mgmt->bssid);
  600. if (bss == NULL)
  601. return;
  602. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  603. sta = sta_get(bss, mgmt->da);
  604. else
  605. sta = sta_get(bss, mgmt->sa);
  606. if (sta == NULL)
  607. return;
  608. if (len < 24 + 1) {
  609. wpa_printf(MSG_INFO, "Too short Action frame from "
  610. MACSTR, MAC2STR(mgmt->sa));
  611. return;
  612. }
  613. wpa_printf(MSG_DEBUG, "ACTION " MACSTR " -> " MACSTR
  614. " (category=%u) (valid=%d)",
  615. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  616. mgmt->u.action.category, valid);
  617. wpa_hexdump(MSG_MSGDUMP, "ACTION payload", data + 24, len - 24);
  618. if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
  619. sta->state < STATE3) {
  620. wpa_printf(MSG_INFO, "Action frame sent when STA is not in "
  621. "State 3 (SA=" MACSTR " DATA=" MACSTR ")",
  622. MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  623. }
  624. switch (mgmt->u.action.category) {
  625. case WLAN_ACTION_SA_QUERY:
  626. rx_mgmt_action_sa_query(wt, sta, mgmt, len, valid);
  627. break;
  628. }
  629. }
  630. static int check_mmie_mic(const u8 *igtk, const u8 *data, size_t len)
  631. {
  632. u8 *buf;
  633. u8 mic[16];
  634. u16 fc;
  635. const struct ieee80211_hdr *hdr;
  636. buf = os_malloc(len + 20 - 24);
  637. if (buf == NULL)
  638. return -1;
  639. /* BIP AAD: FC(masked) A1 A2 A3 */
  640. hdr = (const struct ieee80211_hdr *) data;
  641. fc = le_to_host16(hdr->frame_control);
  642. fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
  643. WPA_PUT_LE16(buf, fc);
  644. os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
  645. /* Frame body with MMIE MIC masked to zero */
  646. os_memcpy(buf + 20, data + 24, len - 24 - 8);
  647. os_memset(buf + 20 + len - 24 - 8, 0, 8);
  648. wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
  649. /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
  650. if (omac1_aes_128(igtk, buf, len + 20 - 24, mic) < 0) {
  651. os_free(buf);
  652. return -1;
  653. }
  654. os_free(buf);
  655. if (os_memcmp(data + len - 8, mic, 8) != 0)
  656. return -1;
  657. return 0;
  658. }
  659. static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
  660. {
  661. const struct ieee80211_mgmt *mgmt;
  662. u16 fc, stype;
  663. const u8 *mmie;
  664. u16 keyid;
  665. struct wlantest_bss *bss;
  666. mgmt = (const struct ieee80211_mgmt *) data;
  667. fc = le_to_host16(mgmt->frame_control);
  668. stype = WLAN_FC_GET_STYPE(fc);
  669. if (stype == WLAN_FC_STYPE_ACTION) {
  670. if (len < 24 + 1)
  671. return 0;
  672. if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
  673. return 0; /* Not a robust management frame */
  674. }
  675. bss = bss_get(wt, mgmt->bssid);
  676. if (bss == NULL)
  677. return 0; /* No key known yet */
  678. if (len < 24 + 18 || data[len - 18] != WLAN_EID_MMIE ||
  679. data[len - 17] != 16) {
  680. /* No MMIE */
  681. if (bss->rsn_capab & WPA_CAPABILITY_MFPC) {
  682. wpa_printf(MSG_INFO, "Robust group-addressed "
  683. "management frame sent without BIP by "
  684. MACSTR, MAC2STR(mgmt->sa));
  685. bss->counters[WLANTEST_BSS_COUNTER_MISSING_BIP_MMIE]++;
  686. return -1;
  687. }
  688. return 0;
  689. }
  690. mmie = data + len - 16;
  691. keyid = WPA_GET_LE16(mmie);
  692. if (keyid & 0xf000) {
  693. wpa_printf(MSG_INFO, "MMIE KeyID reserved bits not zero "
  694. "(%04x) from " MACSTR, keyid, MAC2STR(mgmt->sa));
  695. keyid &= 0x0fff;
  696. }
  697. if (keyid < 4 || keyid > 5) {
  698. wpa_printf(MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
  699. keyid, MAC2STR(mgmt->sa));
  700. bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
  701. return 0;
  702. }
  703. wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
  704. wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
  705. wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, 8);
  706. if (!bss->igtk_set[keyid]) {
  707. wpa_printf(MSG_DEBUG, "No IGTK known to validate BIP frame");
  708. return 0;
  709. }
  710. if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
  711. wpa_printf(MSG_INFO, "BIP replay detected: SA=" MACSTR,
  712. MAC2STR(mgmt->sa));
  713. wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
  714. wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
  715. }
  716. if (check_mmie_mic(bss->igtk[keyid], data, len) < 0) {
  717. wpa_printf(MSG_INFO, "Invalid MMIE MIC in a frame from "
  718. MACSTR, MAC2STR(mgmt->sa));
  719. bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
  720. return -1;
  721. }
  722. wpa_printf(MSG_DEBUG, "Valid MMIE MIC");
  723. os_memcpy(bss->ipn[keyid], mmie + 2, 6);
  724. bss->counters[WLANTEST_BSS_COUNTER_VALID_BIP_MMIE]++;
  725. if (stype == WLAN_FC_STYPE_DEAUTH)
  726. bss->counters[WLANTEST_BSS_COUNTER_BIP_DEAUTH]++;
  727. else if (stype == WLAN_FC_STYPE_DISASSOC)
  728. bss->counters[WLANTEST_BSS_COUNTER_BIP_DISASSOC]++;
  729. return 0;
  730. }
  731. static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
  732. size_t *dlen)
  733. {
  734. struct wlantest_bss *bss;
  735. struct wlantest_sta *sta;
  736. const struct ieee80211_hdr *hdr;
  737. int keyid;
  738. u8 *decrypted, *frame = NULL;
  739. u8 pn[6], *rsc;
  740. hdr = (const struct ieee80211_hdr *) data;
  741. bss = bss_get(wt, hdr->addr3);
  742. if (bss == NULL)
  743. return NULL;
  744. if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
  745. sta = sta_get(bss, hdr->addr2);
  746. else
  747. sta = sta_get(bss, hdr->addr1);
  748. if (sta == NULL || !sta->ptk_set) {
  749. wpa_printf(MSG_MSGDUMP, "No PTK known to decrypt the frame");
  750. return NULL;
  751. }
  752. if (len < 24 + 4)
  753. return NULL;
  754. if (!(data[24 + 3] & 0x20)) {
  755. wpa_printf(MSG_INFO, "Expected CCMP frame from " MACSTR
  756. " did not have ExtIV bit set to 1",
  757. MAC2STR(hdr->addr2));
  758. return NULL;
  759. }
  760. if (data[24 + 2] != 0 || (data[24 + 3] & 0x1f) != 0) {
  761. wpa_printf(MSG_INFO, "CCMP mgmt frame from " MACSTR " used "
  762. "non-zero reserved bit", MAC2STR(hdr->addr2));
  763. }
  764. keyid = data[24 + 3] >> 6;
  765. if (keyid != 0) {
  766. wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
  767. "individually addressed Management frame from "
  768. MACSTR, keyid, MAC2STR(hdr->addr2));
  769. }
  770. if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
  771. rsc = sta->rsc_tods[16];
  772. else
  773. rsc = sta->rsc_fromds[16];
  774. ccmp_get_pn(pn, data + 24);
  775. if (os_memcmp(pn, rsc, 6) <= 0) {
  776. u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
  777. wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: A1=" MACSTR
  778. " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u",
  779. MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  780. MAC2STR(hdr->addr3),
  781. WLAN_GET_SEQ_SEQ(seq_ctrl),
  782. WLAN_GET_SEQ_FRAG(seq_ctrl));
  783. wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
  784. wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
  785. }
  786. decrypted = ccmp_decrypt(sta->ptk.tk1, hdr, data + 24, len - 24, dlen);
  787. if (decrypted) {
  788. os_memcpy(rsc, pn, 6);
  789. frame = os_malloc(24 + *dlen);
  790. if (frame) {
  791. os_memcpy(frame, data, 24);
  792. os_memcpy(frame + 24, decrypted, *dlen);
  793. *dlen += 24;
  794. }
  795. }
  796. os_free(decrypted);
  797. return frame;
  798. }
  799. static int check_mgmt_ccmp(struct wlantest *wt, const u8 *data, size_t len)
  800. {
  801. const struct ieee80211_mgmt *mgmt;
  802. u16 fc;
  803. struct wlantest_bss *bss;
  804. struct wlantest_sta *sta;
  805. mgmt = (const struct ieee80211_mgmt *) data;
  806. fc = le_to_host16(mgmt->frame_control);
  807. if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
  808. if (len > 24 &&
  809. mgmt->u.action.category == WLAN_ACTION_PUBLIC)
  810. return 0; /* Not a robust management frame */
  811. }
  812. bss = bss_get(wt, mgmt->bssid);
  813. if (bss == NULL)
  814. return 0;
  815. if (os_memcmp(mgmt->da, mgmt->bssid, ETH_ALEN) == 0)
  816. sta = sta_get(bss, mgmt->sa);
  817. else
  818. sta = sta_get(bss, mgmt->da);
  819. if (sta == NULL)
  820. return 0;
  821. if ((sta->rsn_capab & WPA_CAPABILITY_MFPC) &&
  822. (sta->state == STATE3 ||
  823. WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION)) {
  824. wpa_printf(MSG_INFO, "Robust individually-addressed "
  825. "management frame sent without CCMP by "
  826. MACSTR, MAC2STR(mgmt->sa));
  827. return -1;
  828. }
  829. return 0;
  830. }
  831. void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
  832. {
  833. const struct ieee80211_hdr *hdr;
  834. u16 fc, stype;
  835. int valid = 1;
  836. u8 *decrypted = NULL;
  837. size_t dlen;
  838. if (len < 24)
  839. return;
  840. hdr = (const struct ieee80211_hdr *) data;
  841. fc = le_to_host16(hdr->frame_control);
  842. wt->rx_mgmt++;
  843. stype = WLAN_FC_GET_STYPE(fc);
  844. if ((hdr->addr1[0] & 0x01) &&
  845. (stype == WLAN_FC_STYPE_DEAUTH ||
  846. stype == WLAN_FC_STYPE_DISASSOC ||
  847. stype == WLAN_FC_STYPE_ACTION)) {
  848. if (check_bip(wt, data, len) < 0)
  849. valid = 0;
  850. }
  851. wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
  852. stype == WLAN_FC_STYPE_PROBE_RESP ||
  853. stype == WLAN_FC_STYPE_PROBE_REQ) ?
  854. MSG_EXCESSIVE : MSG_MSGDUMP,
  855. "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
  856. mgmt_stype(stype),
  857. fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
  858. fc & WLAN_FC_ISWEP ? " Prot" : "",
  859. MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  860. MAC2STR(hdr->addr3));
  861. if ((fc & WLAN_FC_ISWEP) &&
  862. !(hdr->addr1[0] & 0x01) &&
  863. (stype == WLAN_FC_STYPE_DEAUTH ||
  864. stype == WLAN_FC_STYPE_DISASSOC ||
  865. stype == WLAN_FC_STYPE_ACTION)) {
  866. decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
  867. if (decrypted) {
  868. write_pcap_decrypted(wt, decrypted, dlen, NULL, 0);
  869. data = decrypted;
  870. len = dlen;
  871. } else
  872. valid = 0;
  873. }
  874. if (!(fc & WLAN_FC_ISWEP) &&
  875. !(hdr->addr1[0] & 0x01) &&
  876. (stype == WLAN_FC_STYPE_DEAUTH ||
  877. stype == WLAN_FC_STYPE_DISASSOC ||
  878. stype == WLAN_FC_STYPE_ACTION)) {
  879. if (check_mgmt_ccmp(wt, data, len) < 0)
  880. valid = 0;
  881. }
  882. switch (stype) {
  883. case WLAN_FC_STYPE_BEACON:
  884. rx_mgmt_beacon(wt, data, len);
  885. break;
  886. case WLAN_FC_STYPE_PROBE_RESP:
  887. rx_mgmt_probe_resp(wt, data, len);
  888. break;
  889. case WLAN_FC_STYPE_AUTH:
  890. rx_mgmt_auth(wt, data, len);
  891. break;
  892. case WLAN_FC_STYPE_DEAUTH:
  893. rx_mgmt_deauth(wt, data, len, valid);
  894. break;
  895. case WLAN_FC_STYPE_ASSOC_REQ:
  896. rx_mgmt_assoc_req(wt, data, len);
  897. break;
  898. case WLAN_FC_STYPE_ASSOC_RESP:
  899. rx_mgmt_assoc_resp(wt, data, len);
  900. break;
  901. case WLAN_FC_STYPE_REASSOC_REQ:
  902. rx_mgmt_reassoc_req(wt, data, len);
  903. break;
  904. case WLAN_FC_STYPE_REASSOC_RESP:
  905. rx_mgmt_reassoc_resp(wt, data, len);
  906. break;
  907. case WLAN_FC_STYPE_DISASSOC:
  908. rx_mgmt_disassoc(wt, data, len, valid);
  909. break;
  910. case WLAN_FC_STYPE_ACTION:
  911. rx_mgmt_action(wt, data, len, valid);
  912. break;
  913. }
  914. os_free(decrypted);
  915. wt->last_mgmt_valid = valid;
  916. }
  917. static void rx_mgmt_deauth_ack(struct wlantest *wt,
  918. const struct ieee80211_hdr *hdr)
  919. {
  920. const struct ieee80211_mgmt *mgmt;
  921. struct wlantest_bss *bss;
  922. struct wlantest_sta *sta;
  923. mgmt = (const struct ieee80211_mgmt *) hdr;
  924. bss = bss_get(wt, mgmt->bssid);
  925. if (bss == NULL)
  926. return;
  927. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  928. sta = sta_get(bss, mgmt->da);
  929. else
  930. sta = sta_get(bss, mgmt->sa);
  931. if (sta == NULL)
  932. return;
  933. wpa_printf(MSG_DEBUG, "DEAUTH from " MACSTR " acknowledged by " MACSTR,
  934. MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  935. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  936. int c;
  937. c = wt->last_mgmt_valid ?
  938. WLANTEST_STA_COUNTER_VALID_DEAUTH_RX_ACK :
  939. WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX_ACK;
  940. sta->counters[c]++;
  941. }
  942. }
  943. static void rx_mgmt_disassoc_ack(struct wlantest *wt,
  944. const struct ieee80211_hdr *hdr)
  945. {
  946. const struct ieee80211_mgmt *mgmt;
  947. struct wlantest_bss *bss;
  948. struct wlantest_sta *sta;
  949. mgmt = (const struct ieee80211_mgmt *) hdr;
  950. bss = bss_get(wt, mgmt->bssid);
  951. if (bss == NULL)
  952. return;
  953. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  954. sta = sta_get(bss, mgmt->da);
  955. else
  956. sta = sta_get(bss, mgmt->sa);
  957. if (sta == NULL)
  958. return;
  959. wpa_printf(MSG_DEBUG, "DISASSOC from " MACSTR " acknowledged by "
  960. MACSTR, MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  961. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  962. int c;
  963. c = wt->last_mgmt_valid ?
  964. WLANTEST_STA_COUNTER_VALID_DISASSOC_RX_ACK :
  965. WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX_ACK;
  966. sta->counters[c]++;
  967. }
  968. }
  969. void rx_mgmt_ack(struct wlantest *wt, const struct ieee80211_hdr *hdr)
  970. {
  971. u16 fc, stype;
  972. fc = le_to_host16(hdr->frame_control);
  973. stype = WLAN_FC_GET_STYPE(fc);
  974. wpa_printf(MSG_MSGDUMP, "MGMT ACK: stype=%u a1=" MACSTR " a2=" MACSTR
  975. " a3=" MACSTR,
  976. stype, MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  977. MAC2STR(hdr->addr3));
  978. switch (stype) {
  979. case WLAN_FC_STYPE_DEAUTH:
  980. rx_mgmt_deauth_ack(wt, hdr);
  981. break;
  982. case WLAN_FC_STYPE_DISASSOC:
  983. rx_mgmt_disassoc_ack(wt, hdr);
  984. break;
  985. }
  986. }