rx_mgmt.c 32 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175
  1. /*
  2. * Received Management frame processing
  3. * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
  4. *
  5. * This program is free software; you can redistribute it and/or modify
  6. * it under the terms of the GNU General Public License version 2 as
  7. * published by the Free Software Foundation.
  8. *
  9. * Alternatively, this software may be distributed under the terms of BSD
  10. * license.
  11. *
  12. * See README and COPYING for more details.
  13. */
  14. #include "utils/includes.h"
  15. #include "utils/common.h"
  16. #include "common/ieee802_11_defs.h"
  17. #include "common/ieee802_11_common.h"
  18. #include "crypto/aes_wrap.h"
  19. #include "wlantest.h"
  20. static const char * mgmt_stype(u16 stype)
  21. {
  22. switch (stype) {
  23. case WLAN_FC_STYPE_ASSOC_REQ:
  24. return "ASSOC-REQ";
  25. case WLAN_FC_STYPE_ASSOC_RESP:
  26. return "ASSOC-RESP";
  27. case WLAN_FC_STYPE_REASSOC_REQ:
  28. return "REASSOC-REQ";
  29. case WLAN_FC_STYPE_REASSOC_RESP:
  30. return "REASSOC-RESP";
  31. case WLAN_FC_STYPE_PROBE_REQ:
  32. return "PROBE-REQ";
  33. case WLAN_FC_STYPE_PROBE_RESP:
  34. return "PROBE-RESP";
  35. case WLAN_FC_STYPE_BEACON:
  36. return "BEACON";
  37. case WLAN_FC_STYPE_ATIM:
  38. return "ATIM";
  39. case WLAN_FC_STYPE_DISASSOC:
  40. return "DISASSOC";
  41. case WLAN_FC_STYPE_AUTH:
  42. return "AUTH";
  43. case WLAN_FC_STYPE_DEAUTH:
  44. return "DEAUTH";
  45. case WLAN_FC_STYPE_ACTION:
  46. return "ACTION";
  47. }
  48. return "??";
  49. }
  50. static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
  51. {
  52. const struct ieee80211_mgmt *mgmt;
  53. struct wlantest_bss *bss;
  54. struct ieee802_11_elems elems;
  55. mgmt = (const struct ieee80211_mgmt *) data;
  56. bss = bss_get(wt, mgmt->bssid);
  57. if (bss == NULL)
  58. return;
  59. if (bss->proberesp_seen)
  60. return; /* do not override with Beacon data */
  61. bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
  62. if (ieee802_11_parse_elems(mgmt->u.beacon.variable,
  63. len - (mgmt->u.beacon.variable - data),
  64. &elems, 0) == ParseFailed) {
  65. if (bss->parse_error_reported)
  66. return;
  67. wpa_printf(MSG_INFO, "Invalid IEs in a Beacon frame from "
  68. MACSTR, MAC2STR(mgmt->sa));
  69. bss->parse_error_reported = 1;
  70. return;
  71. }
  72. bss_update(wt, bss, &elems);
  73. }
  74. static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
  75. {
  76. const struct ieee80211_mgmt *mgmt;
  77. struct wlantest_bss *bss;
  78. struct ieee802_11_elems elems;
  79. mgmt = (const struct ieee80211_mgmt *) data;
  80. bss = bss_get(wt, mgmt->bssid);
  81. if (bss == NULL)
  82. return;
  83. bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
  84. if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable,
  85. len - (mgmt->u.probe_resp.variable - data),
  86. &elems, 0) == ParseFailed) {
  87. if (bss->parse_error_reported)
  88. return;
  89. wpa_printf(MSG_INFO, "Invalid IEs in a Probe Response frame "
  90. "from " MACSTR, MAC2STR(mgmt->sa));
  91. bss->parse_error_reported = 1;
  92. return;
  93. }
  94. bss_update(wt, bss, &elems);
  95. }
  96. static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
  97. {
  98. const struct ieee80211_mgmt *mgmt;
  99. struct wlantest_bss *bss;
  100. struct wlantest_sta *sta;
  101. u16 alg, trans, status;
  102. mgmt = (const struct ieee80211_mgmt *) data;
  103. bss = bss_get(wt, mgmt->bssid);
  104. if (bss == NULL)
  105. return;
  106. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  107. sta = sta_get(bss, mgmt->da);
  108. else
  109. sta = sta_get(bss, mgmt->sa);
  110. if (sta == NULL)
  111. return;
  112. if (len < 24 + 6) {
  113. wpa_printf(MSG_INFO, "Too short Authentication frame from "
  114. MACSTR, MAC2STR(mgmt->sa));
  115. return;
  116. }
  117. alg = le_to_host16(mgmt->u.auth.auth_alg);
  118. trans = le_to_host16(mgmt->u.auth.auth_transaction);
  119. status = le_to_host16(mgmt->u.auth.status_code);
  120. wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
  121. " (alg=%u trans=%u status=%u)",
  122. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
  123. if (alg == 0 && trans == 2 && status == 0) {
  124. if (sta->state == STATE1) {
  125. wpa_printf(MSG_DEBUG, "STA " MACSTR
  126. " moved to State 2 with " MACSTR,
  127. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  128. sta->state = STATE2;
  129. }
  130. }
  131. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  132. sta->counters[WLANTEST_STA_COUNTER_AUTH_RX]++;
  133. else
  134. sta->counters[WLANTEST_STA_COUNTER_AUTH_TX]++;
  135. }
  136. static void deauth_all_stas(struct wlantest_bss *bss)
  137. {
  138. struct wlantest_sta *sta;
  139. dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
  140. if (sta->state == STATE1)
  141. continue;
  142. wpa_printf(MSG_DEBUG, "STA " MACSTR
  143. " moved to State 1 with " MACSTR,
  144. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  145. sta->state = STATE1;
  146. }
  147. }
  148. static void tdls_link_down(struct wlantest_bss *bss, struct wlantest_sta *sta)
  149. {
  150. struct wlantest_tdls *tdls;
  151. dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list) {
  152. if ((tdls->init == sta || tdls->resp == sta) && tdls->link_up)
  153. {
  154. wpa_printf(MSG_DEBUG, "TDLS: Set link down based on "
  155. "STA deauth/disassoc");
  156. tdls->link_up = 0;
  157. }
  158. }
  159. }
  160. static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
  161. int valid)
  162. {
  163. const struct ieee80211_mgmt *mgmt;
  164. struct wlantest_bss *bss;
  165. struct wlantest_sta *sta;
  166. u16 fc, reason;
  167. mgmt = (const struct ieee80211_mgmt *) data;
  168. bss = bss_get(wt, mgmt->bssid);
  169. if (bss == NULL)
  170. return;
  171. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  172. sta = sta_get(bss, mgmt->da);
  173. else
  174. sta = sta_get(bss, mgmt->sa);
  175. if (len < 24 + 2) {
  176. wpa_printf(MSG_INFO, "Too short Deauthentication frame from "
  177. MACSTR, MAC2STR(mgmt->sa));
  178. return;
  179. }
  180. reason = le_to_host16(mgmt->u.deauth.reason_code);
  181. wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
  182. " (reason=%u) (valid=%d)",
  183. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  184. reason, valid);
  185. wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
  186. if (sta == NULL) {
  187. if (valid && mgmt->da[0] == 0xff)
  188. deauth_all_stas(bss);
  189. return;
  190. }
  191. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  192. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_RX :
  193. WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX]++;
  194. if (sta->pwrmgt && !sta->pspoll)
  195. sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_ASLEEP]++;
  196. else
  197. sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_AWAKE]++;
  198. fc = le_to_host16(mgmt->frame_control);
  199. if (!(fc & WLAN_FC_ISWEP) && reason == 6)
  200. sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_RC6]++;
  201. else if (!(fc & WLAN_FC_ISWEP) && reason == 7)
  202. sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_RC7]++;
  203. } else
  204. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_TX :
  205. WLANTEST_STA_COUNTER_INVALID_DEAUTH_TX]++;
  206. if (!valid) {
  207. wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
  208. "since Disassociation frame was not protected "
  209. "correctly", MAC2STR(sta->addr));
  210. return;
  211. }
  212. if (sta->state != STATE1) {
  213. wpa_printf(MSG_DEBUG, "STA " MACSTR
  214. " moved to State 1 with " MACSTR,
  215. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  216. sta->state = STATE1;
  217. }
  218. tdls_link_down(bss, sta);
  219. }
  220. static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
  221. {
  222. const struct ieee80211_mgmt *mgmt;
  223. struct wlantest_bss *bss;
  224. struct wlantest_sta *sta;
  225. struct ieee802_11_elems elems;
  226. mgmt = (const struct ieee80211_mgmt *) data;
  227. bss = bss_get(wt, mgmt->bssid);
  228. if (bss == NULL)
  229. return;
  230. sta = sta_get(bss, mgmt->sa);
  231. if (sta == NULL)
  232. return;
  233. if (len < 24 + 4) {
  234. wpa_printf(MSG_INFO, "Too short Association Request frame "
  235. "from " MACSTR, MAC2STR(mgmt->sa));
  236. return;
  237. }
  238. wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
  239. " (capab=0x%x listen_int=%u)",
  240. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  241. le_to_host16(mgmt->u.assoc_req.capab_info),
  242. le_to_host16(mgmt->u.assoc_req.listen_interval));
  243. sta->counters[WLANTEST_STA_COUNTER_ASSOCREQ_TX]++;
  244. if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
  245. len - (mgmt->u.assoc_req.variable - data),
  246. &elems, 0) == ParseFailed) {
  247. wpa_printf(MSG_INFO, "Invalid IEs in Association Request "
  248. "frame from " MACSTR, MAC2STR(mgmt->sa));
  249. return;
  250. }
  251. sta->assocreq_capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
  252. sta->assocreq_listen_int =
  253. le_to_host16(mgmt->u.assoc_req.listen_interval);
  254. os_free(sta->assocreq_ies);
  255. sta->assocreq_ies_len = len - (mgmt->u.assoc_req.variable - data);
  256. sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
  257. if (sta->assocreq_ies)
  258. os_memcpy(sta->assocreq_ies, mgmt->u.assoc_req.variable,
  259. sta->assocreq_ies_len);
  260. sta_update_assoc(sta, &elems);
  261. }
  262. static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
  263. {
  264. const struct ieee80211_mgmt *mgmt;
  265. struct wlantest_bss *bss;
  266. struct wlantest_sta *sta;
  267. u16 capab, status, aid;
  268. mgmt = (const struct ieee80211_mgmt *) data;
  269. bss = bss_get(wt, mgmt->bssid);
  270. if (bss == NULL)
  271. return;
  272. sta = sta_get(bss, mgmt->da);
  273. if (sta == NULL)
  274. return;
  275. if (len < 24 + 6) {
  276. wpa_printf(MSG_INFO, "Too short Association Response frame "
  277. "from " MACSTR, MAC2STR(mgmt->sa));
  278. return;
  279. }
  280. capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
  281. status = le_to_host16(mgmt->u.assoc_resp.status_code);
  282. aid = le_to_host16(mgmt->u.assoc_resp.aid);
  283. wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
  284. " (capab=0x%x status=%u aid=%u)",
  285. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
  286. aid & 0x3fff);
  287. if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
  288. struct ieee802_11_elems elems;
  289. const u8 *ies = mgmt->u.assoc_resp.variable;
  290. size_t ies_len = len - (mgmt->u.assoc_resp.variable - data);
  291. if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
  292. ParseFailed) {
  293. wpa_printf(MSG_INFO, "Failed to parse IEs in "
  294. "AssocResp from " MACSTR,
  295. MAC2STR(mgmt->sa));
  296. } else if (elems.timeout_int == NULL ||
  297. elems.timeout_int_len != 5 ||
  298. elems.timeout_int[0] !=
  299. WLAN_TIMEOUT_ASSOC_COMEBACK) {
  300. wpa_printf(MSG_INFO, "No valid Timeout Interval IE "
  301. "with Assoc Comeback time in AssocResp "
  302. "(status=30) from " MACSTR,
  303. MAC2STR(mgmt->sa));
  304. } else {
  305. sta->counters[
  306. WLANTEST_STA_COUNTER_ASSOCRESP_COMEBACK]++;
  307. }
  308. }
  309. if (status)
  310. return;
  311. if ((aid & 0xc000) != 0xc000) {
  312. wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
  313. "in Association Response from " MACSTR,
  314. MAC2STR(mgmt->sa));
  315. }
  316. sta->aid = aid & 0xc000;
  317. if (sta->state < STATE2) {
  318. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
  319. "getting associated", MAC2STR(sta->addr));
  320. }
  321. if (sta->state < STATE3) {
  322. wpa_printf(MSG_DEBUG, "STA " MACSTR
  323. " moved to State 3 with " MACSTR,
  324. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  325. sta->state = STATE3;
  326. }
  327. }
  328. static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
  329. size_t len)
  330. {
  331. const struct ieee80211_mgmt *mgmt;
  332. struct wlantest_bss *bss;
  333. struct wlantest_sta *sta;
  334. struct ieee802_11_elems elems;
  335. mgmt = (const struct ieee80211_mgmt *) data;
  336. bss = bss_get(wt, mgmt->bssid);
  337. if (bss == NULL)
  338. return;
  339. sta = sta_get(bss, mgmt->sa);
  340. if (sta == NULL)
  341. return;
  342. if (len < 24 + 4 + ETH_ALEN) {
  343. wpa_printf(MSG_INFO, "Too short Reassociation Request frame "
  344. "from " MACSTR, MAC2STR(mgmt->sa));
  345. return;
  346. }
  347. wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
  348. " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
  349. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  350. le_to_host16(mgmt->u.reassoc_req.capab_info),
  351. le_to_host16(mgmt->u.reassoc_req.listen_interval),
  352. MAC2STR(mgmt->u.reassoc_req.current_ap));
  353. sta->counters[WLANTEST_STA_COUNTER_REASSOCREQ_TX]++;
  354. if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
  355. len - (mgmt->u.reassoc_req.variable - data),
  356. &elems, 0) == ParseFailed) {
  357. wpa_printf(MSG_INFO, "Invalid IEs in Reassociation Request "
  358. "frame from " MACSTR, MAC2STR(mgmt->sa));
  359. return;
  360. }
  361. sta->assocreq_capab_info =
  362. le_to_host16(mgmt->u.reassoc_req.capab_info);
  363. sta->assocreq_listen_int =
  364. le_to_host16(mgmt->u.reassoc_req.listen_interval);
  365. os_free(sta->assocreq_ies);
  366. sta->assocreq_ies_len = len - (mgmt->u.reassoc_req.variable - data);
  367. sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
  368. if (sta->assocreq_ies)
  369. os_memcpy(sta->assocreq_ies, mgmt->u.reassoc_req.variable,
  370. sta->assocreq_ies_len);
  371. sta_update_assoc(sta, &elems);
  372. }
  373. static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
  374. size_t len)
  375. {
  376. const struct ieee80211_mgmt *mgmt;
  377. struct wlantest_bss *bss;
  378. struct wlantest_sta *sta;
  379. u16 capab, status, aid;
  380. mgmt = (const struct ieee80211_mgmt *) data;
  381. bss = bss_get(wt, mgmt->bssid);
  382. if (bss == NULL)
  383. return;
  384. sta = sta_get(bss, mgmt->da);
  385. if (sta == NULL)
  386. return;
  387. if (len < 24 + 6) {
  388. wpa_printf(MSG_INFO, "Too short Reassociation Response frame "
  389. "from " MACSTR, MAC2STR(mgmt->sa));
  390. return;
  391. }
  392. capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
  393. status = le_to_host16(mgmt->u.reassoc_resp.status_code);
  394. aid = le_to_host16(mgmt->u.reassoc_resp.aid);
  395. wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
  396. " (capab=0x%x status=%u aid=%u)",
  397. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
  398. aid & 0x3fff);
  399. if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
  400. struct ieee802_11_elems elems;
  401. const u8 *ies = mgmt->u.reassoc_resp.variable;
  402. size_t ies_len = len - (mgmt->u.reassoc_resp.variable - data);
  403. if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
  404. ParseFailed) {
  405. wpa_printf(MSG_INFO, "Failed to parse IEs in "
  406. "ReassocResp from " MACSTR,
  407. MAC2STR(mgmt->sa));
  408. } else if (elems.timeout_int == NULL ||
  409. elems.timeout_int_len != 5 ||
  410. elems.timeout_int[0] !=
  411. WLAN_TIMEOUT_ASSOC_COMEBACK) {
  412. wpa_printf(MSG_INFO, "No valid Timeout Interval IE "
  413. "with Assoc Comeback time in ReassocResp "
  414. "(status=30) from " MACSTR,
  415. MAC2STR(mgmt->sa));
  416. } else {
  417. sta->counters[
  418. WLANTEST_STA_COUNTER_REASSOCRESP_COMEBACK]++;
  419. }
  420. }
  421. if (status)
  422. return;
  423. if ((aid & 0xc000) != 0xc000) {
  424. wpa_printf(MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
  425. "in Reassociation Response from " MACSTR,
  426. MAC2STR(mgmt->sa));
  427. }
  428. sta->aid = aid & 0xc000;
  429. if (sta->state < STATE2) {
  430. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 when "
  431. "getting associated", MAC2STR(sta->addr));
  432. }
  433. if (sta->state < STATE3) {
  434. wpa_printf(MSG_DEBUG, "STA " MACSTR
  435. " moved to State 3 with " MACSTR,
  436. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  437. sta->state = STATE3;
  438. }
  439. }
  440. static void disassoc_all_stas(struct wlantest_bss *bss)
  441. {
  442. struct wlantest_sta *sta;
  443. dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
  444. if (sta->state <= STATE2)
  445. continue;
  446. wpa_printf(MSG_DEBUG, "STA " MACSTR
  447. " moved to State 2 with " MACSTR,
  448. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  449. sta->state = STATE2;
  450. }
  451. }
  452. static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
  453. int valid)
  454. {
  455. const struct ieee80211_mgmt *mgmt;
  456. struct wlantest_bss *bss;
  457. struct wlantest_sta *sta;
  458. u16 fc, reason;
  459. mgmt = (const struct ieee80211_mgmt *) data;
  460. bss = bss_get(wt, mgmt->bssid);
  461. if (bss == NULL)
  462. return;
  463. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  464. sta = sta_get(bss, mgmt->da);
  465. else
  466. sta = sta_get(bss, mgmt->sa);
  467. if (len < 24 + 2) {
  468. wpa_printf(MSG_INFO, "Too short Disassociation frame from "
  469. MACSTR, MAC2STR(mgmt->sa));
  470. return;
  471. }
  472. reason = le_to_host16(mgmt->u.disassoc.reason_code);
  473. wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
  474. " (reason=%u) (valid=%d)",
  475. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  476. reason, valid);
  477. wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
  478. if (sta == NULL) {
  479. if (valid && mgmt->da[0] == 0xff)
  480. disassoc_all_stas(bss);
  481. return;
  482. }
  483. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  484. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_RX :
  485. WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX]++;
  486. if (sta->pwrmgt && !sta->pspoll)
  487. sta->counters[
  488. WLANTEST_STA_COUNTER_DISASSOC_RX_ASLEEP]++;
  489. else
  490. sta->counters[
  491. WLANTEST_STA_COUNTER_DISASSOC_RX_AWAKE]++;
  492. fc = le_to_host16(mgmt->frame_control);
  493. if (!(fc & WLAN_FC_ISWEP) && reason == 6)
  494. sta->counters[WLANTEST_STA_COUNTER_DISASSOC_RX_RC6]++;
  495. else if (!(fc & WLAN_FC_ISWEP) && reason == 7)
  496. sta->counters[WLANTEST_STA_COUNTER_DISASSOC_RX_RC7]++;
  497. } else
  498. sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_TX :
  499. WLANTEST_STA_COUNTER_INVALID_DISASSOC_TX]++;
  500. if (!valid) {
  501. wpa_printf(MSG_INFO, "Do not change STA " MACSTR " State "
  502. "since Disassociation frame was not protected "
  503. "correctly", MAC2STR(sta->addr));
  504. return;
  505. }
  506. if (sta->state < STATE2) {
  507. wpa_printf(MSG_DEBUG, "STA " MACSTR " was not in State 2 or 3 "
  508. "when getting disassociated", MAC2STR(sta->addr));
  509. }
  510. if (sta->state > STATE2) {
  511. wpa_printf(MSG_DEBUG, "STA " MACSTR
  512. " moved to State 2 with " MACSTR,
  513. MAC2STR(sta->addr), MAC2STR(bss->bssid));
  514. sta->state = STATE2;
  515. }
  516. tdls_link_down(bss, sta);
  517. }
  518. static void rx_mgmt_action_sa_query_req(struct wlantest *wt,
  519. struct wlantest_sta *sta,
  520. const struct ieee80211_mgmt *mgmt,
  521. size_t len, int valid)
  522. {
  523. const u8 *rx_id;
  524. u8 *id;
  525. rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
  526. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  527. id = sta->ap_sa_query_tr;
  528. else
  529. id = sta->sta_sa_query_tr;
  530. wpa_printf(MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
  531. " (trans_id=%02x%02x)%s",
  532. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
  533. valid ? "" : " (invalid protection)");
  534. os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
  535. if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
  536. sta->counters[valid ?
  537. WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_TX :
  538. WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_TX]++;
  539. else
  540. sta->counters[valid ?
  541. WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_RX :
  542. WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_RX]++;
  543. }
  544. static void rx_mgmt_action_sa_query_resp(struct wlantest *wt,
  545. struct wlantest_sta *sta,
  546. const struct ieee80211_mgmt *mgmt,
  547. size_t len, int valid)
  548. {
  549. const u8 *rx_id;
  550. u8 *id;
  551. int match;
  552. rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
  553. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  554. id = sta->sta_sa_query_tr;
  555. else
  556. id = sta->ap_sa_query_tr;
  557. match = os_memcmp(rx_id, id, 2) == 0;
  558. wpa_printf(MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
  559. " (trans_id=%02x%02x; %s)%s",
  560. MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
  561. match ? "match" : "mismatch",
  562. valid ? "" : " (invalid protection)");
  563. if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
  564. sta->counters[(valid && match) ?
  565. WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_TX :
  566. WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_TX]++;
  567. else
  568. sta->counters[(valid && match) ?
  569. WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_RX :
  570. WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_RX]++;
  571. }
  572. static void rx_mgmt_action_sa_query(struct wlantest *wt,
  573. struct wlantest_sta *sta,
  574. const struct ieee80211_mgmt *mgmt,
  575. size_t len, int valid)
  576. {
  577. if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
  578. wpa_printf(MSG_INFO, "Too short SA Query frame from " MACSTR,
  579. MAC2STR(mgmt->sa));
  580. return;
  581. }
  582. if (len > 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
  583. size_t elen = len - (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN);
  584. wpa_printf(MSG_INFO, "Unexpected %u octets of extra data at "
  585. "the end of SA Query frame from " MACSTR,
  586. (unsigned) elen, MAC2STR(mgmt->sa));
  587. wpa_hexdump(MSG_INFO, "SA Query extra data",
  588. ((const u8 *) mgmt) + len - elen, elen);
  589. }
  590. switch (mgmt->u.action.u.sa_query_req.action) {
  591. case WLAN_SA_QUERY_REQUEST:
  592. rx_mgmt_action_sa_query_req(wt, sta, mgmt, len, valid);
  593. break;
  594. case WLAN_SA_QUERY_RESPONSE:
  595. rx_mgmt_action_sa_query_resp(wt, sta, mgmt, len, valid);
  596. break;
  597. default:
  598. wpa_printf(MSG_INFO, "Unexpected SA Query action value %u "
  599. "from " MACSTR,
  600. mgmt->u.action.u.sa_query_req.action,
  601. MAC2STR(mgmt->sa));
  602. }
  603. }
  604. static void rx_mgmt_action(struct wlantest *wt, const u8 *data, size_t len,
  605. int valid)
  606. {
  607. const struct ieee80211_mgmt *mgmt;
  608. struct wlantest_bss *bss;
  609. struct wlantest_sta *sta;
  610. mgmt = (const struct ieee80211_mgmt *) data;
  611. if (mgmt->da[0] & 0x01) {
  612. wpa_printf(MSG_DEBUG, "Group addressed Action frame: DA="
  613. MACSTR " SA=" MACSTR " BSSID=" MACSTR
  614. " category=%u",
  615. MAC2STR(mgmt->da), MAC2STR(mgmt->sa),
  616. MAC2STR(mgmt->bssid), mgmt->u.action.category);
  617. return; /* Ignore group addressed Action frames for now */
  618. }
  619. bss = bss_get(wt, mgmt->bssid);
  620. if (bss == NULL)
  621. return;
  622. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  623. sta = sta_get(bss, mgmt->da);
  624. else
  625. sta = sta_get(bss, mgmt->sa);
  626. if (sta == NULL)
  627. return;
  628. if (len < 24 + 1) {
  629. wpa_printf(MSG_INFO, "Too short Action frame from "
  630. MACSTR, MAC2STR(mgmt->sa));
  631. return;
  632. }
  633. wpa_printf(MSG_DEBUG, "ACTION " MACSTR " -> " MACSTR
  634. " (category=%u) (valid=%d)",
  635. MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
  636. mgmt->u.action.category, valid);
  637. wpa_hexdump(MSG_MSGDUMP, "ACTION payload", data + 24, len - 24);
  638. if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
  639. sta->state < STATE3) {
  640. wpa_printf(MSG_INFO, "Action frame sent when STA is not in "
  641. "State 3 (SA=" MACSTR " DATA=" MACSTR ")",
  642. MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  643. }
  644. switch (mgmt->u.action.category) {
  645. case WLAN_ACTION_SA_QUERY:
  646. rx_mgmt_action_sa_query(wt, sta, mgmt, len, valid);
  647. break;
  648. }
  649. }
  650. static int check_mmie_mic(const u8 *igtk, const u8 *data, size_t len)
  651. {
  652. u8 *buf;
  653. u8 mic[16];
  654. u16 fc;
  655. const struct ieee80211_hdr *hdr;
  656. buf = os_malloc(len + 20 - 24);
  657. if (buf == NULL)
  658. return -1;
  659. /* BIP AAD: FC(masked) A1 A2 A3 */
  660. hdr = (const struct ieee80211_hdr *) data;
  661. fc = le_to_host16(hdr->frame_control);
  662. fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
  663. WPA_PUT_LE16(buf, fc);
  664. os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
  665. /* Frame body with MMIE MIC masked to zero */
  666. os_memcpy(buf + 20, data + 24, len - 24 - 8);
  667. os_memset(buf + 20 + len - 24 - 8, 0, 8);
  668. wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
  669. /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
  670. if (omac1_aes_128(igtk, buf, len + 20 - 24, mic) < 0) {
  671. os_free(buf);
  672. return -1;
  673. }
  674. os_free(buf);
  675. if (os_memcmp(data + len - 8, mic, 8) != 0)
  676. return -1;
  677. return 0;
  678. }
  679. static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
  680. {
  681. const struct ieee80211_mgmt *mgmt;
  682. u16 fc, stype;
  683. const u8 *mmie;
  684. u16 keyid;
  685. struct wlantest_bss *bss;
  686. mgmt = (const struct ieee80211_mgmt *) data;
  687. fc = le_to_host16(mgmt->frame_control);
  688. stype = WLAN_FC_GET_STYPE(fc);
  689. if (stype == WLAN_FC_STYPE_ACTION) {
  690. if (len < 24 + 1)
  691. return 0;
  692. if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
  693. return 0; /* Not a robust management frame */
  694. }
  695. bss = bss_get(wt, mgmt->bssid);
  696. if (bss == NULL)
  697. return 0; /* No key known yet */
  698. if (len < 24 + 18 || data[len - 18] != WLAN_EID_MMIE ||
  699. data[len - 17] != 16) {
  700. /* No MMIE */
  701. if (bss->rsn_capab & WPA_CAPABILITY_MFPC) {
  702. wpa_printf(MSG_INFO, "Robust group-addressed "
  703. "management frame sent without BIP by "
  704. MACSTR, MAC2STR(mgmt->sa));
  705. bss->counters[WLANTEST_BSS_COUNTER_MISSING_BIP_MMIE]++;
  706. return -1;
  707. }
  708. return 0;
  709. }
  710. mmie = data + len - 16;
  711. keyid = WPA_GET_LE16(mmie);
  712. if (keyid & 0xf000) {
  713. wpa_printf(MSG_INFO, "MMIE KeyID reserved bits not zero "
  714. "(%04x) from " MACSTR, keyid, MAC2STR(mgmt->sa));
  715. keyid &= 0x0fff;
  716. }
  717. if (keyid < 4 || keyid > 5) {
  718. wpa_printf(MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
  719. keyid, MAC2STR(mgmt->sa));
  720. bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
  721. return 0;
  722. }
  723. wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
  724. wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
  725. wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, 8);
  726. if (!bss->igtk_set[keyid]) {
  727. wpa_printf(MSG_DEBUG, "No IGTK known to validate BIP frame");
  728. return 0;
  729. }
  730. if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
  731. wpa_printf(MSG_INFO, "BIP replay detected: SA=" MACSTR,
  732. MAC2STR(mgmt->sa));
  733. wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
  734. wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
  735. }
  736. if (check_mmie_mic(bss->igtk[keyid], data, len) < 0) {
  737. wpa_printf(MSG_INFO, "Invalid MMIE MIC in a frame from "
  738. MACSTR, MAC2STR(mgmt->sa));
  739. bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
  740. return -1;
  741. }
  742. wpa_printf(MSG_DEBUG, "Valid MMIE MIC");
  743. os_memcpy(bss->ipn[keyid], mmie + 2, 6);
  744. bss->counters[WLANTEST_BSS_COUNTER_VALID_BIP_MMIE]++;
  745. if (stype == WLAN_FC_STYPE_DEAUTH)
  746. bss->counters[WLANTEST_BSS_COUNTER_BIP_DEAUTH]++;
  747. else if (stype == WLAN_FC_STYPE_DISASSOC)
  748. bss->counters[WLANTEST_BSS_COUNTER_BIP_DISASSOC]++;
  749. return 0;
  750. }
  751. static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
  752. size_t *dlen)
  753. {
  754. struct wlantest_bss *bss;
  755. struct wlantest_sta *sta;
  756. const struct ieee80211_hdr *hdr;
  757. int keyid;
  758. u8 *decrypted, *frame = NULL;
  759. u8 pn[6], *rsc;
  760. hdr = (const struct ieee80211_hdr *) data;
  761. bss = bss_get(wt, hdr->addr3);
  762. if (bss == NULL)
  763. return NULL;
  764. if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
  765. sta = sta_get(bss, hdr->addr2);
  766. else
  767. sta = sta_get(bss, hdr->addr1);
  768. if (sta == NULL || !sta->ptk_set) {
  769. wpa_printf(MSG_MSGDUMP, "No PTK known to decrypt the frame");
  770. return NULL;
  771. }
  772. if (len < 24 + 4)
  773. return NULL;
  774. if (!(data[24 + 3] & 0x20)) {
  775. wpa_printf(MSG_INFO, "Expected CCMP frame from " MACSTR
  776. " did not have ExtIV bit set to 1",
  777. MAC2STR(hdr->addr2));
  778. return NULL;
  779. }
  780. if (data[24 + 2] != 0 || (data[24 + 3] & 0x1f) != 0) {
  781. wpa_printf(MSG_INFO, "CCMP mgmt frame from " MACSTR " used "
  782. "non-zero reserved bit", MAC2STR(hdr->addr2));
  783. }
  784. keyid = data[24 + 3] >> 6;
  785. if (keyid != 0) {
  786. wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
  787. "individually addressed Management frame from "
  788. MACSTR, keyid, MAC2STR(hdr->addr2));
  789. }
  790. if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
  791. rsc = sta->rsc_tods[16];
  792. else
  793. rsc = sta->rsc_fromds[16];
  794. ccmp_get_pn(pn, data + 24);
  795. if (os_memcmp(pn, rsc, 6) <= 0) {
  796. u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
  797. wpa_printf(MSG_INFO, "CCMP/TKIP replay detected: A1=" MACSTR
  798. " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u",
  799. MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  800. MAC2STR(hdr->addr3),
  801. WLAN_GET_SEQ_SEQ(seq_ctrl),
  802. WLAN_GET_SEQ_FRAG(seq_ctrl));
  803. wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
  804. wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
  805. }
  806. decrypted = ccmp_decrypt(sta->ptk.tk1, hdr, data + 24, len - 24, dlen);
  807. if (decrypted) {
  808. os_memcpy(rsc, pn, 6);
  809. frame = os_malloc(24 + *dlen);
  810. if (frame) {
  811. os_memcpy(frame, data, 24);
  812. os_memcpy(frame + 24, decrypted, *dlen);
  813. *dlen += 24;
  814. }
  815. }
  816. os_free(decrypted);
  817. return frame;
  818. }
  819. static int check_mgmt_ccmp(struct wlantest *wt, const u8 *data, size_t len)
  820. {
  821. const struct ieee80211_mgmt *mgmt;
  822. u16 fc;
  823. struct wlantest_bss *bss;
  824. struct wlantest_sta *sta;
  825. mgmt = (const struct ieee80211_mgmt *) data;
  826. fc = le_to_host16(mgmt->frame_control);
  827. if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
  828. if (len > 24 &&
  829. mgmt->u.action.category == WLAN_ACTION_PUBLIC)
  830. return 0; /* Not a robust management frame */
  831. }
  832. bss = bss_get(wt, mgmt->bssid);
  833. if (bss == NULL)
  834. return 0;
  835. if (os_memcmp(mgmt->da, mgmt->bssid, ETH_ALEN) == 0)
  836. sta = sta_get(bss, mgmt->sa);
  837. else
  838. sta = sta_get(bss, mgmt->da);
  839. if (sta == NULL)
  840. return 0;
  841. if ((sta->rsn_capab & WPA_CAPABILITY_MFPC) &&
  842. (sta->state == STATE3 ||
  843. WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION)) {
  844. wpa_printf(MSG_INFO, "Robust individually-addressed "
  845. "management frame sent without CCMP by "
  846. MACSTR, MAC2STR(mgmt->sa));
  847. return -1;
  848. }
  849. return 0;
  850. }
  851. void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
  852. {
  853. const struct ieee80211_hdr *hdr;
  854. u16 fc, stype;
  855. int valid = 1;
  856. u8 *decrypted = NULL;
  857. size_t dlen;
  858. if (len < 24)
  859. return;
  860. hdr = (const struct ieee80211_hdr *) data;
  861. fc = le_to_host16(hdr->frame_control);
  862. wt->rx_mgmt++;
  863. stype = WLAN_FC_GET_STYPE(fc);
  864. if ((hdr->addr1[0] & 0x01) &&
  865. (stype == WLAN_FC_STYPE_DEAUTH ||
  866. stype == WLAN_FC_STYPE_DISASSOC ||
  867. stype == WLAN_FC_STYPE_ACTION)) {
  868. if (check_bip(wt, data, len) < 0)
  869. valid = 0;
  870. }
  871. wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
  872. stype == WLAN_FC_STYPE_PROBE_RESP ||
  873. stype == WLAN_FC_STYPE_PROBE_REQ) ?
  874. MSG_EXCESSIVE : MSG_MSGDUMP,
  875. "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
  876. mgmt_stype(stype),
  877. fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
  878. fc & WLAN_FC_ISWEP ? " Prot" : "",
  879. MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  880. MAC2STR(hdr->addr3));
  881. if ((fc & WLAN_FC_ISWEP) &&
  882. !(hdr->addr1[0] & 0x01) &&
  883. (stype == WLAN_FC_STYPE_DEAUTH ||
  884. stype == WLAN_FC_STYPE_DISASSOC ||
  885. stype == WLAN_FC_STYPE_ACTION)) {
  886. decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
  887. if (decrypted) {
  888. write_pcap_decrypted(wt, decrypted, dlen, NULL, 0);
  889. data = decrypted;
  890. len = dlen;
  891. } else
  892. valid = 0;
  893. }
  894. if (!(fc & WLAN_FC_ISWEP) &&
  895. !(hdr->addr1[0] & 0x01) &&
  896. (stype == WLAN_FC_STYPE_DEAUTH ||
  897. stype == WLAN_FC_STYPE_DISASSOC ||
  898. stype == WLAN_FC_STYPE_ACTION)) {
  899. if (check_mgmt_ccmp(wt, data, len) < 0)
  900. valid = 0;
  901. }
  902. switch (stype) {
  903. case WLAN_FC_STYPE_BEACON:
  904. rx_mgmt_beacon(wt, data, len);
  905. break;
  906. case WLAN_FC_STYPE_PROBE_RESP:
  907. rx_mgmt_probe_resp(wt, data, len);
  908. break;
  909. case WLAN_FC_STYPE_AUTH:
  910. rx_mgmt_auth(wt, data, len);
  911. break;
  912. case WLAN_FC_STYPE_DEAUTH:
  913. rx_mgmt_deauth(wt, data, len, valid);
  914. break;
  915. case WLAN_FC_STYPE_ASSOC_REQ:
  916. rx_mgmt_assoc_req(wt, data, len);
  917. break;
  918. case WLAN_FC_STYPE_ASSOC_RESP:
  919. rx_mgmt_assoc_resp(wt, data, len);
  920. break;
  921. case WLAN_FC_STYPE_REASSOC_REQ:
  922. rx_mgmt_reassoc_req(wt, data, len);
  923. break;
  924. case WLAN_FC_STYPE_REASSOC_RESP:
  925. rx_mgmt_reassoc_resp(wt, data, len);
  926. break;
  927. case WLAN_FC_STYPE_DISASSOC:
  928. rx_mgmt_disassoc(wt, data, len, valid);
  929. break;
  930. case WLAN_FC_STYPE_ACTION:
  931. rx_mgmt_action(wt, data, len, valid);
  932. break;
  933. }
  934. os_free(decrypted);
  935. wt->last_mgmt_valid = valid;
  936. }
  937. static void rx_mgmt_deauth_ack(struct wlantest *wt,
  938. const struct ieee80211_hdr *hdr)
  939. {
  940. const struct ieee80211_mgmt *mgmt;
  941. struct wlantest_bss *bss;
  942. struct wlantest_sta *sta;
  943. mgmt = (const struct ieee80211_mgmt *) hdr;
  944. bss = bss_get(wt, mgmt->bssid);
  945. if (bss == NULL)
  946. return;
  947. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  948. sta = sta_get(bss, mgmt->da);
  949. else
  950. sta = sta_get(bss, mgmt->sa);
  951. if (sta == NULL)
  952. return;
  953. wpa_printf(MSG_DEBUG, "DEAUTH from " MACSTR " acknowledged by " MACSTR,
  954. MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  955. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  956. int c;
  957. c = wt->last_mgmt_valid ?
  958. WLANTEST_STA_COUNTER_VALID_DEAUTH_RX_ACK :
  959. WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX_ACK;
  960. sta->counters[c]++;
  961. }
  962. }
  963. static void rx_mgmt_disassoc_ack(struct wlantest *wt,
  964. const struct ieee80211_hdr *hdr)
  965. {
  966. const struct ieee80211_mgmt *mgmt;
  967. struct wlantest_bss *bss;
  968. struct wlantest_sta *sta;
  969. mgmt = (const struct ieee80211_mgmt *) hdr;
  970. bss = bss_get(wt, mgmt->bssid);
  971. if (bss == NULL)
  972. return;
  973. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
  974. sta = sta_get(bss, mgmt->da);
  975. else
  976. sta = sta_get(bss, mgmt->sa);
  977. if (sta == NULL)
  978. return;
  979. wpa_printf(MSG_DEBUG, "DISASSOC from " MACSTR " acknowledged by "
  980. MACSTR, MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
  981. if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
  982. int c;
  983. c = wt->last_mgmt_valid ?
  984. WLANTEST_STA_COUNTER_VALID_DISASSOC_RX_ACK :
  985. WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX_ACK;
  986. sta->counters[c]++;
  987. }
  988. }
  989. void rx_mgmt_ack(struct wlantest *wt, const struct ieee80211_hdr *hdr)
  990. {
  991. u16 fc, stype;
  992. fc = le_to_host16(hdr->frame_control);
  993. stype = WLAN_FC_GET_STYPE(fc);
  994. wpa_printf(MSG_MSGDUMP, "MGMT ACK: stype=%u a1=" MACSTR " a2=" MACSTR
  995. " a3=" MACSTR,
  996. stype, MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
  997. MAC2STR(hdr->addr3));
  998. switch (stype) {
  999. case WLAN_FC_STYPE_DEAUTH:
  1000. rx_mgmt_deauth_ack(wt, hdr);
  1001. break;
  1002. case WLAN_FC_STYPE_DISASSOC:
  1003. rx_mgmt_disassoc_ack(wt, hdr);
  1004. break;
  1005. }
  1006. }