rx_mgmt.c 31 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798991001011021031041051061071081091101111121131141151161171181191201211221231241251261271281291301311321331341351361371381391401411421431441451461471481491501511521531541551561571581591601611621631641651661671681691701711721731741751761771781791801811821831841851861871881891901911921931941951961971981992002012022032042052062072082092102112122132142152162172182192202212222232242252262272282292302312322332342352362372382392402412422432442452462472482492502512522532542552562572582592602612622632642652662672682692702712722732742752762772782792802812822832842852862872882892902912922932942952962972982993003013023033043053063073083093103113123133143153163173183193203213223233243253263273283293303313323333343353363373383393403413423433443453463473483493503513523533543553563573583593603613623633643653663673683693703713723733743753763773783793803813823833843853863873883893903913923933943953963973983994004014024034044054064074084094104114124134144154164174184194204214224234244254264274284294304314324334344354364374384394404414424434444454464474484494504514524534544554564574584594604614624634644654664674684694704714724734744754764774784794804814824834844854864874884894904914924934944954964974984995005015025035045055065075085095105115125135145155165175185195205215225235245255265275285295305315325335345355365375385395405415425435445455465475485495505515525535545555565575585595605615625635645655665675685695705715725735745755765775785795805815825835845855865875885895905915925935945955965975985996006016026036046056066076086096106116126136146156166176186196206216226236246256266276286296306316326336346356366376386396406416426436446456466476486496506516526536546556566576586596606616626636646656666676686696706716726736746756766776786796806816826836846856866876886896906916926936946956966976986997007017027037047057067077087097107117127137147157167177187197207217227237247257267277287297307317327337347357367377387397407417427437447457467477487497507517527537547557567577587597607617627637647657667677687697707717727737747757767777787797807817827837847857867877887897907917927937947957967977987998008018028038048058068078088098108118128138148158168178188198208218228238248258268278288298308318328338348358368378388398408418428438448458468478488498508518528538548558568578588598608618628638648658668678688698708718728738748758768778788798808818828838848858868878888898908918928938948958968978988999009019029039049059069079089099109119129139149159169179189199209219229239249259269279289299309319329339349359369379389399409419429439449459469479489499509519529539549559569579589599609619629639649659669679689699709719729739749759769779789799809819829839849859869879889899909919929939949959969979989991000100110021003100410051006100710081009101010111012101310141015101610171018101910201021102210231024102510261027102810291030103110321033103410351036103710381039104010411042104310441045104610471048104910501051105210531054105510561057105810591060106110621063106410651066106710681069107010711072107310741075107610771078107910801081108210831084108510861087108810891090109110921093109410951096109710981099110011011102110311041105110611071108110911101111111211131114111511161117111811191120112111221123112411251126112711281129113011311132113311341135113611371138113911401141114211431144114511461147114811491150115111521153115411551156115711581159
  1. /*
  2. * Received Management frame processing
  3. * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
  4. *
  5. * This program is free software; you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License version 2 as
  7. * published by the Free Software Foundation.
  8. *
  9. * Alternatively, this software may be distributed under the terms of BSD
  10. * license.
  11. *
  12. * See README and COPYING for more details.
  13. */
  14. #include "utils/includes.h"
  15. #include "utils/common.h"
  16. #include "common/ieee802_11_defs.h"
  17. #include "common/ieee802_11_common.h"
  18. #include "crypto/aes_wrap.h"
  19. #include "wlantest.h"
  20. static const char * mgmt_stype(u16 stype)
  21. {
  22. switch (stype) {
  23. case WLAN_FC_STYPE_ASSOC_REQ:
  24. return "ASSOC-REQ";
  25. case WLAN_FC_STYPE_ASSOC_RESP:
  26. return "ASSOC-RESP";
  27. case WLAN_FC_STYPE_REASSOC_REQ:
  28. return "REASSOC-REQ";
  29. case WLAN_FC_STYPE_REASSOC_RESP:
  30. return "REASSOC-RESP";
  31. case WLAN_FC_STYPE_PROBE_REQ:
  32. return "PROBE-REQ";
  33. case WLAN_FC_STYPE_PROBE_RESP:
  34. return "PROBE-RESP";
  35. case WLAN_FC_STYPE_BEACON:
  36. return "BEACON";
  37. case WLAN_FC_STYPE_ATIM:
  38. return "ATIM";
  39. case WLAN_FC_STYPE_DISASSOC:
  40. return "DISASSOC";
  41. case WLAN_FC_STYPE_AUTH:
  42. return "AUTH";
  43. case WLAN_FC_STYPE_DEAUTH:
  44. return "DEAUTH";
  45. case WLAN_FC_STYPE_ACTION:
  46. return "ACTION";
  47. }
  48. return "??";
  49. }
  50. static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
  51. {
  52. const struct ieee80211_mgmt *mgmt;
  53. struct wlantest_bss *bss;
  54. struct ieee802_11_elems elems;
  55. mgmt = (const struct ieee80211_mgmt *) data;
  56. bss = bss_get(wt, mgmt->bssid);
  57. if (bss == NULL)
  58. return;
  59. if (bss->proberesp_seen)
  60. return; /* do not override with Beacon data */
  61. bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
  62. if (ieee802_11_parse_elems(mgmt->u.beacon.variable,
  63. len - (mgmt->u.beacon.variable - data),
  64. &elems, 0) == ParseFailed) {
  65. if (bss->parse_error_reported)
  66. return;
  67. wpa_printf(MSG_INFO, "Invalid IEs in a Beacon frame from "
  68. MACSTR, MAC2STR(mgmt->sa));
  69. bss->parse_error_reported = 1;
  70. return;
  71. }
  72. bss_update(wt, bss, &elems);
  73. }
  74. static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
  75. {
  76. const struct ieee80211_mgmt *mgmt;
  77. struct wlantest_bss *bss;
  78. struct ieee802_11_elems elems;
  79. mgmt = (const struct ieee80211_mgmt *) data;
  80. bss = bss_get(wt, mgmt->bssid);
  81. if (bss == NULL)
  82. return;
  83. bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
  84. if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
  85. len - (mgmt->u.probe_resp.variable - data),
  86. &elems, 0) == ParseFailed) {
  87. if (bss->parse_error_reported)
  88. return;
  89. wpa_printf(MSG_INFO, "Invalid IEs in a Probe Response frame "
  90. "from " MACSTR, MAC2STR(mgmt->sa));
  91. bss->parse_error_reported = 1;
  92. return;
  93. }
  94. bss_update(wt, bss, &elems);
  95. }
  96. static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
  97. {
  98. const struct ieee80211_mgmt *mgmt;
  99. struct wlantest_bss *bss;
  100. struct wlantest_sta *sta;
  101. u16 alg, trans, status;
  102. mgmt = (const struct ieee80211_mgmt *) data;
  103. bss = bss_get(wt, mgmt->bssid);
  104. if (bss == NULL)
  105. return;
  106. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  107. sta = sta_get(bss, mgmt->da);
  108. else
  109. sta = sta_get(bss, mgmt->sa);
  110. if (sta == NULL)
  111. return;
  112. if (len < 24 + 6) {
  113. wpa_printf(MSG_INFO, "Too short Authentication frame from "
  114. MACSTR, MAC2STR(mgmt->sa));
  115. return;
  116. }
  117. alg = le_to_host16(mgmt->u.auth.auth_alg);
  118. trans = le_to_host16(mgmt->u.auth.auth_transaction);
  119. status = le_to_host16(mgmt->u.auth.status_code);
  120. wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
  121. " (alg=%u trans=%u status=%u)",
  122. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
  123. if (alg == 0 && trans == 2 && status == 0) {
  124. if (sta->state == STATE1) {
  125. wpa_printf(MSG_DEBUG, "STA " MACSTR
  126. " moved to State 2 with " MACSTR,
  127. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  128. sta->state = STATE2;
  129. }
  130. }
  131. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  132. sta->counters[WLANTEST_STA_COUNTER_AUTH_RX]++;
  133. else
  134. sta->counters[WLANTEST_STA_COUNTER_AUTH_TX]++;
  135. }
  136. static void deauth_all_stas(struct wlantest_bss *bss)
  137. {
  138. struct wlantest_sta *sta;
  139. dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
  140. if (sta->state == STATE1)
  141. continue;
  142. wpa_printf(MSG_DEBUG, "STA " MACSTR
  143. " moved to State 1 with " MACSTR,
  144. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  145. sta->state = STATE1;
  146. }
  147. }
  148. static void tdls_link_down(struct wlantest_bss *bss, struct wlantest_sta *sta)
  149. {
  150. struct wlantest_tdls *tdls;
  151. dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list) {
  152. if ((tdls->init == sta || tdls->resp == sta) && tdls->link_up)
  153. {
  154. wpa_printf(MSG_DEBUG, "TDLS: Set link down based on "
  155. "STA deauth/disassoc");
  156. tdls->link_up = 0;
  157. }
  158. }
  159. }
  160. static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
  161. int valid)
  162. {
  163. const struct ieee80211_mgmt *mgmt;
  164. struct wlantest_bss *bss;
  165. struct wlantest_sta *sta;
  166. mgmt = (const struct ieee80211_mgmt *) data;
  167. bss = bss_get(wt, mgmt->bssid);
  168. if (bss == NULL)
  169. return;
  170. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  171. sta = sta_get(bss, mgmt->da);
  172. else
  173. sta = sta_get(bss, mgmt->sa);
  174. if (len < 24 + 2) {
  175. wpa_printf(MSG_INFO, "Too short Deauthentication frame from "
  176. MACSTR, MAC2STR(mgmt->sa));
  177. return;
  178. }
  179. wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
  180. " (reason=%u) (valid=%d)",
  181. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  182. le_to_host16(mgmt->u.deauth.reason_code), valid);
  183. wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
  184. if (sta == NULL) {
  185. if (valid && mgmt->da[0] == 0xff)
  186. deauth_all_stas(bss);
  187. return;
  188. }
  189. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  190. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_RX :
  191. WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX]++;
  192. if (sta->pwrmgt && !sta->pspoll)
  193. sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_ASLEEP]++;
  194. else
  195. sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_AWAKE]++;
  196. } else
  197. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_TX :
  198. WLANTEST_STA_COUNTER_INVALID_DEAUTH_TX]++;
  199. if (!valid) {
  200. wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
  201. "since Disassociation frame was not protected "
  202. "correctly", MAC2STR(sta->addr));
  203. return;
  204. }
  205. if (sta->state != STATE1) {
  206. wpa_printf(MSG_DEBUG, "STA " MACSTR
  207. " moved to State 1 with " MACSTR,
  208. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  209. sta->state = STATE1;
  210. }
  211. tdls_link_down(bss, sta);
  212. }
  213. static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
  214. {
  215. const struct ieee80211_mgmt *mgmt;
  216. struct wlantest_bss *bss;
  217. struct wlantest_sta *sta;
  218. struct ieee802_11_elems elems;
  219. mgmt = (const struct ieee80211_mgmt *) data;
  220. bss = bss_get(wt, mgmt->bssid);
  221. if (bss == NULL)
  222. return;
  223. sta = sta_get(bss, mgmt->sa);
  224. if (sta == NULL)
  225. return;
  226. if (len < 24 + 4) {
  227. wpa_printf(MSG_INFO, "Too short Association Request frame "
  228. "from " MACSTR, MAC2STR(mgmt->sa));
  229. return;
  230. }
  231. wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
  232. " (capab=0x%x listen_int=%u)",
  233. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  234. le_to_host16(mgmt->u.assoc_req.capab_info),
  235. le_to_host16(mgmt->u.assoc_req.listen_interval));
  236. sta->counters[WLANTEST_STA_COUNTER_ASSOCREQ_TX]++;
  237. if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
  238. len - (mgmt->u.assoc_req.variable - data),
  239. &elems, 0) == ParseFailed) {
  240. wpa_printf(MSG_INFO, "Invalid IEs in Association Request "
  241. "frame from " MACSTR, MAC2STR(mgmt->sa));
  242. return;
  243. }
  244. sta->assocreq_capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
  245. sta->assocreq_listen_int =
  246. le_to_host16(mgmt->u.assoc_req.listen_interval);
  247. os_free(sta->assocreq_ies);
  248. sta->assocreq_ies_len = len - (mgmt->u.assoc_req.variable - data);
  249. sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
  250. if (sta->assocreq_ies)
  251. os_memcpy(sta->assocreq_ies, mgmt->u.assoc_req.variable,
  252. sta->assocreq_ies_len);
  253. sta_update_assoc(sta, &elems);
  254. }
  255. static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
  256. {
  257. const struct ieee80211_mgmt *mgmt;
  258. struct wlantest_bss *bss;
  259. struct wlantest_sta *sta;
  260. u16 capab, status, aid;
  261. mgmt = (const struct ieee80211_mgmt *) data;
  262. bss = bss_get(wt, mgmt->bssid);
  263. if (bss == NULL)
  264. return;
  265. sta = sta_get(bss, mgmt->da);
  266. if (sta == NULL)
  267. return;
  268. if (len < 24 + 6) {
  269. wpa_printf(MSG_INFO, "Too short Association Response frame "
  270. "from " MACSTR, MAC2STR(mgmt->sa));
  271. return;
  272. }
  273. capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
  274. status = le_to_host16(mgmt->u.assoc_resp.status_code);
  275. aid = le_to_host16(mgmt->u.assoc_resp.aid);
  276. wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
  277. " (capab=0x%x status=%u aid=%u)",
  278. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
  279. aid & 0x3fff);
  280. if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
  281. struct ieee802_11_elems elems;
  282. const u8 *ies = mgmt->u.assoc_resp.variable;
  283. size_t ies_len = len - (mgmt->u.assoc_resp.variable - data);
  284. if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
  285. ParseFailed) {
  286. wpa_printf(MSG_INFO, "Failed to parse IEs in "
  287. "AssocResp from " MACSTR,
  288. MAC2STR(mgmt->sa));
  289. } else if (elems.timeout_int == NULL ||
  290. elems.timeout_int_len != 5 ||
  291. elems.timeout_int[0] !=
  292. WLAN_TIMEOUT_ASSOC_COMEBACK) {
  293. wpa_printf(MSG_INFO, "No valid Timeout Interval IE "
  294. "with Assoc Comeback time in AssocResp "
  295. "(status=30) from " MACSTR,
  296. MAC2STR(mgmt->sa));
  297. } else {
  298. sta->counters[
  299. WLANTEST_STA_COUNTER_ASSOCRESP_COMEBACK]++;
  300. }
  301. }
  302. if (status)
  303. return;
  304. if ((aid & 0xc000) != 0xc000) {
  305. wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
  306. "in Association Response from " MACSTR,
  307. MAC2STR(mgmt->sa));
  308. }
  309. sta->aid = aid & 0xc000;
  310. if (sta->state < STATE2) {
  311. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
  312. "getting associated", MAC2STR(sta->addr));
  313. }
  314. if (sta->state < STATE3) {
  315. wpa_printf(MSG_DEBUG, "STA " MACSTR
  316. " moved to State 3 with " MACSTR,
  317. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  318. sta->state = STATE3;
  319. }
  320. }
  321. static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
  322. size_t len)
  323. {
  324. const struct ieee80211_mgmt *mgmt;
  325. struct wlantest_bss *bss;
  326. struct wlantest_sta *sta;
  327. struct ieee802_11_elems elems;
  328. mgmt = (const struct ieee80211_mgmt *) data;
  329. bss = bss_get(wt, mgmt->bssid);
  330. if (bss == NULL)
  331. return;
  332. sta = sta_get(bss, mgmt->sa);
  333. if (sta == NULL)
  334. return;
  335. if (len < 24 + 4 + ETH_ALEN) {
  336. wpa_printf(MSG_INFO, "Too short Reassociation Request frame "
  337. "from " MACSTR, MAC2STR(mgmt->sa));
  338. return;
  339. }
  340. wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
  341. " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
  342. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  343. le_to_host16(mgmt->u.reassoc_req.capab_info),
  344. le_to_host16(mgmt->u.reassoc_req.listen_interval),
  345. MAC2STR(mgmt->u.reassoc_req.current_ap));
  346. sta->counters[WLANTEST_STA_COUNTER_REASSOCREQ_TX]++;
  347. if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
  348. len - (mgmt->u.reassoc_req.variable - data),
  349. &elems, 0) == ParseFailed) {
  350. wpa_printf(MSG_INFO, "Invalid IEs in Reassociation Request "
  351. "frame from " MACSTR, MAC2STR(mgmt->sa));
  352. return;
  353. }
  354. sta->assocreq_capab_info =
  355. le_to_host16(mgmt->u.reassoc_req.capab_info);
  356. sta->assocreq_listen_int =
  357. le_to_host16(mgmt->u.reassoc_req.listen_interval);
  358. os_free(sta->assocreq_ies);
  359. sta->assocreq_ies_len = len - (mgmt->u.reassoc_req.variable - data);
  360. sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
  361. if (sta->assocreq_ies)
  362. os_memcpy(sta->assocreq_ies, mgmt->u.reassoc_req.variable,
  363. sta->assocreq_ies_len);
  364. sta_update_assoc(sta, &elems);
  365. }
  366. static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
  367. size_t len)
  368. {
  369. const struct ieee80211_mgmt *mgmt;
  370. struct wlantest_bss *bss;
  371. struct wlantest_sta *sta;
  372. u16 capab, status, aid;
  373. mgmt = (const struct ieee80211_mgmt *) data;
  374. bss = bss_get(wt, mgmt->bssid);
  375. if (bss == NULL)
  376. return;
  377. sta = sta_get(bss, mgmt->da);
  378. if (sta == NULL)
  379. return;
  380. if (len < 24 + 6) {
  381. wpa_printf(MSG_INFO, "Too short Reassociation Response frame "
  382. "from " MACSTR, MAC2STR(mgmt->sa));
  383. return;
  384. }
  385. capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
  386. status = le_to_host16(mgmt->u.reassoc_resp.status_code);
  387. aid = le_to_host16(mgmt->u.reassoc_resp.aid);
  388. wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
  389. " (capab=0x%x status=%u aid=%u)",
  390. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
  391. aid & 0x3fff);
  392. if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
  393. struct ieee802_11_elems elems;
  394. const u8 *ies = mgmt->u.reassoc_resp.variable;
  395. size_t ies_len = len - (mgmt->u.reassoc_resp.variable - data);
  396. if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
  397. ParseFailed) {
  398. wpa_printf(MSG_INFO, "Failed to parse IEs in "
  399. "ReassocResp from " MACSTR,
  400. MAC2STR(mgmt->sa));
  401. } else if (elems.timeout_int == NULL ||
  402. elems.timeout_int_len != 5 ||
  403. elems.timeout_int[0] !=
  404. WLAN_TIMEOUT_ASSOC_COMEBACK) {
  405. wpa_printf(MSG_INFO, "No valid Timeout Interval IE "
  406. "with Assoc Comeback time in ReassocResp "
  407. "(status=30) from " MACSTR,
  408. MAC2STR(mgmt->sa));
  409. } else {
  410. sta->counters[
  411. WLANTEST_STA_COUNTER_REASSOCRESP_COMEBACK]++;
  412. }
  413. }
  414. if (status)
  415. return;
  416. if ((aid & 0xc000) != 0xc000) {
  417. wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
  418. "in Reassociation Response from " MACSTR,
  419. MAC2STR(mgmt->sa));
  420. }
  421. sta->aid = aid & 0xc000;
  422. if (sta->state < STATE2) {
  423. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
  424. "getting associated", MAC2STR(sta->addr));
  425. }
  426. if (sta->state < STATE3) {
  427. wpa_printf(MSG_DEBUG, "STA " MACSTR
  428. " moved to State 3 with " MACSTR,
  429. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  430. sta->state = STATE3;
  431. }
  432. }
  433. static void disassoc_all_stas(struct wlantest_bss *bss)
  434. {
  435. struct wlantest_sta *sta;
  436. dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
  437. if (sta->state <= STATE2)
  438. continue;
  439. wpa_printf(MSG_DEBUG, "STA " MACSTR
  440. " moved to State 2 with " MACSTR,
  441. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  442. sta->state = STATE2;
  443. }
  444. }
  445. static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
  446. int valid)
  447. {
  448. const struct ieee80211_mgmt *mgmt;
  449. struct wlantest_bss *bss;
  450. struct wlantest_sta *sta;
  451. mgmt = (const struct ieee80211_mgmt *) data;
  452. bss = bss_get(wt, mgmt->bssid);
  453. if (bss == NULL)
  454. return;
  455. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  456. sta = sta_get(bss, mgmt->da);
  457. else
  458. sta = sta_get(bss, mgmt->sa);
  459. if (len < 24 + 2) {
  460. wpa_printf(MSG_INFO, "Too short Disassociation frame from "
  461. MACSTR, MAC2STR(mgmt->sa));
  462. return;
  463. }
  464. wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
  465. " (reason=%u) (valid=%d)",
  466. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  467. le_to_host16(mgmt->u.disassoc.reason_code), valid);
  468. wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
  469. if (sta == NULL) {
  470. if (valid && mgmt->da[0] == 0xff)
  471. disassoc_all_stas(bss);
  472. return;
  473. }
  474. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  475. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_RX :
  476. WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX]++;
  477. if (sta->pwrmgt && !sta->pspoll)
  478. sta->counters[
  479. WLANTEST_STA_COUNTER_DISASSOC_RX_ASLEEP]++;
  480. else
  481. sta->counters[
  482. WLANTEST_STA_COUNTER_DISASSOC_RX_AWAKE]++;
  483. } else
  484. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_TX :
  485. WLANTEST_STA_COUNTER_INVALID_DISASSOC_TX]++;
  486. if (!valid) {
  487. wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
  488. "since Disassociation frame was not protected "
  489. "correctly", MAC2STR(sta->addr));
  490. return;
  491. }
  492. if (sta->state < STATE2) {
  493. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 or 3 "
  494. "when getting disassociated", MAC2STR(sta->addr));
  495. }
  496. if (sta->state > STATE2) {
  497. wpa_printf(MSG_DEBUG, "STA " MACSTR
  498. " moved to State 2 with " MACSTR,
  499. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  500. sta->state = STATE2;
  501. }
  502. tdls_link_down(bss, sta);
  503. }
  504. static void rx_mgmt_action_sa_query_req(struct wlantest *wt,
  505. struct wlantest_sta *sta,
  506. const struct ieee80211_mgmt *mgmt,
  507. size_t len, int valid)
  508. {
  509. const u8 *rx_id;
  510. u8 *id;
  511. rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
  512. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  513. id = sta->ap_sa_query_tr;
  514. else
  515. id = sta->sta_sa_query_tr;
  516. wpa_printf(MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
  517. " (trans_id=%02x%02x)%s",
  518. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
  519. valid ? "" : " (invalid protection)");
  520. os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
  521. if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
  522. sta->counters[valid ?
  523. WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_TX :
  524. WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_TX]++;
  525. else
  526. sta->counters[valid ?
  527. WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_RX :
  528. WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_RX]++;
  529. }
  530. static void rx_mgmt_action_sa_query_resp(struct wlantest *wt,
  531. struct wlantest_sta *sta,
  532. const struct ieee80211_mgmt *mgmt,
  533. size_t len, int valid)
  534. {
  535. const u8 *rx_id;
  536. u8 *id;
  537. int match;
  538. rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
  539. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  540. id = sta->sta_sa_query_tr;
  541. else
  542. id = sta->ap_sa_query_tr;
  543. match = os_memcmp(rx_id, id, 2) == 0;
  544. wpa_printf(MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
  545. " (trans_id=%02x%02x; %s)%s",
  546. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
  547. match ? "match" : "mismatch",
  548. valid ? "" : " (invalid protection)");
  549. if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
  550. sta->counters[(valid && match) ?
  551. WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_TX :
  552. WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_TX]++;
  553. else
  554. sta->counters[(valid && match) ?
  555. WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_RX :
  556. WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_RX]++;
  557. }
  558. static void rx_mgmt_action_sa_query(struct wlantest *wt,
  559. struct wlantest_sta *sta,
  560. const struct ieee80211_mgmt *mgmt,
  561. size_t len, int valid)
  562. {
  563. if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
  564. wpa_printf(MSG_INFO, "Too short SA Query frame from " MACSTR,
  565. MAC2STR(mgmt->sa));
  566. return;
  567. }
  568. if (len > 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
  569. size_t elen = len - (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN);
  570. wpa_printf(MSG_INFO, "Unexpected %u octets of extra data at "
  571. "the end of SA Query frame from " MACSTR,
  572. (unsigned) elen, MAC2STR(mgmt->sa));
  573. wpa_hexdump(MSG_INFO, "SA Query extra data",
  574. ((const u8 *) mgmt) + len - elen, elen);
  575. }
  576. switch (mgmt->u.action.u.sa_query_req.action) {
  577. case WLAN_SA_QUERY_REQUEST:
  578. rx_mgmt_action_sa_query_req(wt, sta, mgmt, len, valid);
  579. break;
  580. case WLAN_SA_QUERY_RESPONSE:
  581. rx_mgmt_action_sa_query_resp(wt, sta, mgmt, len, valid);
  582. break;
  583. default:
  584. wpa_printf(MSG_INFO, "Unexpected SA Query action value %u "
  585. "from " MACSTR,
  586. mgmt->u.action.u.sa_query_req.action,
  587. MAC2STR(mgmt->sa));
  588. }
  589. }
  590. static void rx_mgmt_action(struct wlantest *wt, const u8 *data, size_t len,
  591. int valid)
  592. {
  593. const struct ieee80211_mgmt *mgmt;
  594. struct wlantest_bss *bss;
  595. struct wlantest_sta *sta;
  596. mgmt = (const struct ieee80211_mgmt *) data;
  597. if (mgmt->da[0] & 0x01) {
  598. wpa_printf(MSG_DEBUG, "Group addressed Action frame: DA="
  599. MACSTR " SA=" MACSTR " BSSID=" MACSTR
  600. " category=%u",
  601. MAC2STR(mgmt->da), MAC2STR(mgmt->sa),
  602. MAC2STR(mgmt->bssid), mgmt->u.action.category);
  603. return; /* Ignore group addressed Action frames for now */
  604. }
  605. bss = bss_get(wt, mgmt->bssid);
  606. if (bss == NULL)
  607. return;
  608. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  609. sta = sta_get(bss, mgmt->da);
  610. else
  611. sta = sta_get(bss, mgmt->sa);
  612. if (sta == NULL)
  613. return;
  614. if (len < 24 + 1) {
  615. wpa_printf(MSG_INFO, "Too short Action frame from "
  616. MACSTR, MAC2STR(mgmt->sa));
  617. return;
  618. }
  619. wpa_printf(MSG_DEBUG, "ACTION " MACSTR " -> " MACSTR
  620. " (category=%u) (valid=%d)",
  621. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  622. mgmt->u.action.category, valid);
  623. wpa_hexdump(MSG_MSGDUMP, "ACTION payload", data + 24, len - 24);
  624. if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
  625. sta->state < STATE3) {
  626. wpa_printf(MSG_INFO, "Action frame sent when STA is not in "
  627. "State 3 (SA=" MACSTR " DATA=" MACSTR ")",
  628. MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  629. }
  630. switch (mgmt->u.action.category) {
  631. case WLAN_ACTION_SA_QUERY:
  632. rx_mgmt_action_sa_query(wt, sta, mgmt, len, valid);
  633. break;
  634. }
  635. }
  636. static int check_mmie_mic(const u8 *igtk, const u8 *data, size_t len)
  637. {
  638. u8 *buf;
  639. u8 mic[16];
  640. u16 fc;
  641. const struct ieee80211_hdr *hdr;
  642. buf = os_malloc(len + 20 - 24);
  643. if (buf == NULL)
  644. return -1;
  645. /* BIP AAD: FC(masked) A1 A2 A3 */
  646. hdr = (const struct ieee80211_hdr *) data;
  647. fc = le_to_host16(hdr->frame_control);
  648. fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
  649. WPA_PUT_LE16(buf, fc);
  650. os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
  651. /* Frame body with MMIE MIC masked to zero */
  652. os_memcpy(buf + 20, data + 24, len - 24 - 8);
  653. os_memset(buf + 20 + len - 24 - 8, 0, 8);
  654. wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
  655. /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
  656. if (omac1_aes_128(igtk, buf, len + 20 - 24, mic) < 0) {
  657. os_free(buf);
  658. return -1;
  659. }
  660. os_free(buf);
  661. if (os_memcmp(data + len - 8, mic, 8) != 0)
  662. return -1;
  663. return 0;
  664. }
  665. static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
  666. {
  667. const struct ieee80211_mgmt *mgmt;
  668. u16 fc, stype;
  669. const u8 *mmie;
  670. u16 keyid;
  671. struct wlantest_bss *bss;
  672. mgmt = (const struct ieee80211_mgmt *) data;
  673. fc = le_to_host16(mgmt->frame_control);
  674. stype = WLAN_FC_GET_STYPE(fc);
  675. if (stype == WLAN_FC_STYPE_ACTION) {
  676. if (len < 24 + 1)
  677. return 0;
  678. if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
  679. return 0; /* Not a robust management frame */
  680. }
  681. bss = bss_get(wt, mgmt->bssid);
  682. if (bss == NULL)
  683. return 0; /* No key known yet */
  684. if (len < 24 + 18 || data[len - 18] != WLAN_EID_MMIE ||
  685. data[len - 17] != 16) {
  686. /* No MMIE */
  687. if (bss->rsn_capab & WPA_CAPABILITY_MFPC) {
  688. wpa_printf(MSG_INFO, "Robust group-addressed "
  689. "management frame sent without BIP by "
  690. MACSTR, MAC2STR(mgmt->sa));
  691. bss->counters[WLANTEST_BSS_COUNTER_MISSING_BIP_MMIE]++;
  692. return -1;
  693. }
  694. return 0;
  695. }
  696. mmie = data + len - 16;
  697. keyid = WPA_GET_LE16(mmie);
  698. if (keyid & 0xf000) {
  699. wpa_printf(MSG_INFO, "MMIE KeyID reserved bits not zero "
  700. "(%04x) from " MACSTR, keyid, MAC2STR(mgmt->sa));
  701. keyid &= 0x0fff;
  702. }
  703. if (keyid < 4 || keyid > 5) {
  704. wpa_printf(MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
  705. keyid, MAC2STR(mgmt->sa));
  706. bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
  707. return 0;
  708. }
  709. wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
  710. wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
  711. wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, 8);
  712. if (!bss->igtk_set[keyid]) {
  713. wpa_printf(MSG_DEBUG, "No IGTK known to validate BIP frame");
  714. return 0;
  715. }
  716. if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
  717. wpa_printf(MSG_INFO, "BIP replay detected: SA=" MACSTR,
  718. MAC2STR(mgmt->sa));
  719. wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
  720. wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
  721. }
  722. if (check_mmie_mic(bss->igtk[keyid], data, len) < 0) {
  723. wpa_printf(MSG_INFO, "Invalid MMIE MIC in a frame from "
  724. MACSTR, MAC2STR(mgmt->sa));
  725. bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
  726. return -1;
  727. }
  728. wpa_printf(MSG_DEBUG, "Valid MMIE MIC");
  729. os_memcpy(bss->ipn[keyid], mmie + 2, 6);
  730. bss->counters[WLANTEST_BSS_COUNTER_VALID_BIP_MMIE]++;
  731. if (stype == WLAN_FC_STYPE_DEAUTH)
  732. bss->counters[WLANTEST_BSS_COUNTER_BIP_DEAUTH]++;
  733. else if (stype == WLAN_FC_STYPE_DISASSOC)
  734. bss->counters[WLANTEST_BSS_COUNTER_BIP_DISASSOC]++;
  735. return 0;
  736. }
  737. static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
  738. size_t *dlen)
  739. {
  740. struct wlantest_bss *bss;
  741. struct wlantest_sta *sta;
  742. const struct ieee80211_hdr *hdr;
  743. int keyid;
  744. u8 *decrypted, *frame = NULL;
  745. u8 pn[6], *rsc;
  746. hdr = (const struct ieee80211_hdr *) data;
  747. bss = bss_get(wt, hdr->addr3);
  748. if (bss == NULL)
  749. return NULL;
  750. if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
  751. sta = sta_get(bss, hdr->addr2);
  752. else
  753. sta = sta_get(bss, hdr->addr1);
  754. if (sta == NULL || !sta->ptk_set) {
  755. wpa_printf(MSG_MSGDUMP, "No PTK known to decrypt the frame");
  756. return NULL;
  757. }
  758. if (len < 24 + 4)
  759. return NULL;
  760. if (!(data[24 + 3] & 0x20)) {
  761. wpa_printf(MSG_INFO, "Expected CCMP frame from " MACSTR
  762. " did not have ExtIV bit set to 1",
  763. MAC2STR(hdr->addr2));
  764. return NULL;
  765. }
  766. if (data[24 + 2] != 0 || (data[24 + 3] & 0x1f) != 0) {
  767. wpa_printf(MSG_INFO, "CCMP mgmt frame from " MACSTR " used "
  768. "non-zero reserved bit", MAC2STR(hdr->addr2));
  769. }
  770. keyid = data[24 + 3] >> 6;
  771. if (keyid != 0) {
  772. wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
  773. "individually addressed Management frame from "
  774. MACSTR, keyid, MAC2STR(hdr->addr2));
  775. }
  776. if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
  777. rsc = sta->rsc_tods[16];
  778. else
  779. rsc = sta->rsc_fromds[16];
  780. ccmp_get_pn(pn, data + 24);
  781. if (os_memcmp(pn, rsc, 6) <= 0) {
  782. u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
  783. wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: A1=" MACSTR
  784. " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u",
  785. MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  786. MAC2STR(hdr->addr3),
  787. WLAN_GET_SEQ_SEQ(seq_ctrl),
  788. WLAN_GET_SEQ_FRAG(seq_ctrl));
  789. wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
  790. wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
  791. }
  792. decrypted = ccmp_decrypt(sta->ptk.tk1, hdr, data + 24, len - 24, dlen);
  793. if (decrypted) {
  794. os_memcpy(rsc, pn, 6);
  795. frame = os_malloc(24 + *dlen);
  796. if (frame) {
  797. os_memcpy(frame, data, 24);
  798. os_memcpy(frame + 24, decrypted, *dlen);
  799. *dlen += 24;
  800. }
  801. }
  802. os_free(decrypted);
  803. return frame;
  804. }
  805. static int check_mgmt_ccmp(struct wlantest *wt, const u8 *data, size_t len)
  806. {
  807. const struct ieee80211_mgmt *mgmt;
  808. u16 fc;
  809. struct wlantest_bss *bss;
  810. struct wlantest_sta *sta;
  811. mgmt = (const struct ieee80211_mgmt *) data;
  812. fc = le_to_host16(mgmt->frame_control);
  813. if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
  814. if (len > 24 &&
  815. mgmt->u.action.category == WLAN_ACTION_PUBLIC)
  816. return 0; /* Not a robust management frame */
  817. }
  818. bss = bss_get(wt, mgmt->bssid);
  819. if (bss == NULL)
  820. return 0;
  821. if (os_memcmp(mgmt->da, mgmt->bssid, ETH_ALEN) == 0)
  822. sta = sta_get(bss, mgmt->sa);
  823. else
  824. sta = sta_get(bss, mgmt->da);
  825. if (sta == NULL)
  826. return 0;
  827. if ((sta->rsn_capab & WPA_CAPABILITY_MFPC) &&
  828. (sta->state == STATE3 ||
  829. WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION)) {
  830. wpa_printf(MSG_INFO, "Robust individually-addressed "
  831. "management frame sent without CCMP by "
  832. MACSTR, MAC2STR(mgmt->sa));
  833. return -1;
  834. }
  835. return 0;
  836. }
  837. void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
  838. {
  839. const struct ieee80211_hdr *hdr;
  840. u16 fc, stype;
  841. int valid = 1;
  842. u8 *decrypted = NULL;
  843. size_t dlen;
  844. if (len < 24)
  845. return;
  846. hdr = (const struct ieee80211_hdr *) data;
  847. fc = le_to_host16(hdr->frame_control);
  848. wt->rx_mgmt++;
  849. stype = WLAN_FC_GET_STYPE(fc);
  850. if ((hdr->addr1[0] & 0x01) &&
  851. (stype == WLAN_FC_STYPE_DEAUTH ||
  852. stype == WLAN_FC_STYPE_DISASSOC ||
  853. stype == WLAN_FC_STYPE_ACTION)) {
  854. if (check_bip(wt, data, len) < 0)
  855. valid = 0;
  856. }
  857. wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
  858. stype == WLAN_FC_STYPE_PROBE_RESP ||
  859. stype == WLAN_FC_STYPE_PROBE_REQ) ?
  860. MSG_EXCESSIVE : MSG_MSGDUMP,
  861. "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
  862. mgmt_stype(stype),
  863. fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
  864. fc & WLAN_FC_ISWEP ? " Prot" : "",
  865. MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  866. MAC2STR(hdr->addr3));
  867. if ((fc & WLAN_FC_ISWEP) &&
  868. !(hdr->addr1[0] & 0x01) &&
  869. (stype == WLAN_FC_STYPE_DEAUTH ||
  870. stype == WLAN_FC_STYPE_DISASSOC ||
  871. stype == WLAN_FC_STYPE_ACTION)) {
  872. decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
  873. if (decrypted) {
  874. write_pcap_decrypted(wt, decrypted, dlen, NULL, 0);
  875. data = decrypted;
  876. len = dlen;
  877. } else
  878. valid = 0;
  879. }
  880. if (!(fc & WLAN_FC_ISWEP) &&
  881. !(hdr->addr1[0] & 0x01) &&
  882. (stype == WLAN_FC_STYPE_DEAUTH ||
  883. stype == WLAN_FC_STYPE_DISASSOC ||
  884. stype == WLAN_FC_STYPE_ACTION)) {
  885. if (check_mgmt_ccmp(wt, data, len) < 0)
  886. valid = 0;
  887. }
  888. switch (stype) {
  889. case WLAN_FC_STYPE_BEACON:
  890. rx_mgmt_beacon(wt, data, len);
  891. break;
  892. case WLAN_FC_STYPE_PROBE_RESP:
  893. rx_mgmt_probe_resp(wt, data, len);
  894. break;
  895. case WLAN_FC_STYPE_AUTH:
  896. rx_mgmt_auth(wt, data, len);
  897. break;
  898. case WLAN_FC_STYPE_DEAUTH:
  899. rx_mgmt_deauth(wt, data, len, valid);
  900. break;
  901. case WLAN_FC_STYPE_ASSOC_REQ:
  902. rx_mgmt_assoc_req(wt, data, len);
  903. break;
  904. case WLAN_FC_STYPE_ASSOC_RESP:
  905. rx_mgmt_assoc_resp(wt, data, len);
  906. break;
  907. case WLAN_FC_STYPE_REASSOC_REQ:
  908. rx_mgmt_reassoc_req(wt, data, len);
  909. break;
  910. case WLAN_FC_STYPE_REASSOC_RESP:
  911. rx_mgmt_reassoc_resp(wt, data, len);
  912. break;
  913. case WLAN_FC_STYPE_DISASSOC:
  914. rx_mgmt_disassoc(wt, data, len, valid);
  915. break;
  916. case WLAN_FC_STYPE_ACTION:
  917. rx_mgmt_action(wt, data, len, valid);
  918. break;
  919. }
  920. os_free(decrypted);
  921. wt->last_mgmt_valid = valid;
  922. }
  923. static void rx_mgmt_deauth_ack(struct wlantest *wt,
  924. const struct ieee80211_hdr *hdr)
  925. {
  926. const struct ieee80211_mgmt *mgmt;
  927. struct wlantest_bss *bss;
  928. struct wlantest_sta *sta;
  929. mgmt = (const struct ieee80211_mgmt *) hdr;
  930. bss = bss_get(wt, mgmt->bssid);
  931. if (bss == NULL)
  932. return;
  933. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  934. sta = sta_get(bss, mgmt->da);
  935. else
  936. sta = sta_get(bss, mgmt->sa);
  937. if (sta == NULL)
  938. return;
  939. wpa_printf(MSG_DEBUG, "DEAUTH from " MACSTR " acknowledged by " MACSTR,
  940. MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  941. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  942. int c;
  943. c = wt->last_mgmt_valid ?
  944. WLANTEST_STA_COUNTER_VALID_DEAUTH_RX_ACK :
  945. WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX_ACK;
  946. sta->counters[c]++;
  947. }
  948. }
  949. static void rx_mgmt_disassoc_ack(struct wlantest *wt,
  950. const struct ieee80211_hdr *hdr)
  951. {
  952. const struct ieee80211_mgmt *mgmt;
  953. struct wlantest_bss *bss;
  954. struct wlantest_sta *sta;
  955. mgmt = (const struct ieee80211_mgmt *) hdr;
  956. bss = bss_get(wt, mgmt->bssid);
  957. if (bss == NULL)
  958. return;
  959. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  960. sta = sta_get(bss, mgmt->da);
  961. else
  962. sta = sta_get(bss, mgmt->sa);
  963. if (sta == NULL)
  964. return;
  965. wpa_printf(MSG_DEBUG, "DISASSOC from " MACSTR " acknowledged by "
  966. MACSTR, MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  967. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  968. int c;
  969. c = wt->last_mgmt_valid ?
  970. WLANTEST_STA_COUNTER_VALID_DISASSOC_RX_ACK :
  971. WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX_ACK;
  972. sta->counters[c]++;
  973. }
  974. }
  975. void rx_mgmt_ack(struct wlantest *wt, const struct ieee80211_hdr *hdr)
  976. {
  977. u16 fc, stype;
  978. fc = le_to_host16(hdr->frame_control);
  979. stype = WLAN_FC_GET_STYPE(fc);
  980. wpa_printf(MSG_MSGDUMP, "MGMT ACK: stype=%u a1=" MACSTR " a2=" MACSTR
  981. " a3=" MACSTR,
  982. stype, MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  983. MAC2STR(hdr->addr3));
  984. switch (stype) {
  985. case WLAN_FC_STYPE_DEAUTH:
  986. rx_mgmt_deauth_ack(wt, hdr);
  987. break;
  988. case WLAN_FC_STYPE_DISASSOC:
  989. rx_mgmt_disassoc_ack(wt, hdr);
  990. break;
  991. }
  992. }