wlantest/rx_mgmt.c

   1 /*
   2  * Received Management frame processing
   3  * Copyright (c) 2010-2015, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "common/defs.h"
  13 #include "common/ieee802_11_defs.h"
  14 #include "common/ieee802_11_common.h"
  15 #include "crypto/aes_wrap.h"
  16 #include "wlantest.h"
  17
  18
  19 static const char * mgmt_stype(u16 stype)
  20 {
  21         switch (stype) {
  22         case WLAN_FC_STYPE_ASSOC_REQ:
  23                 return "ASSOC-REQ";
  24         case WLAN_FC_STYPE_ASSOC_RESP:
  25                 return "ASSOC-RESP";
  26         case WLAN_FC_STYPE_REASSOC_REQ:
  27                 return "REASSOC-REQ";
  28         case WLAN_FC_STYPE_REASSOC_RESP:
  29                 return "REASSOC-RESP";
  30         case WLAN_FC_STYPE_PROBE_REQ:
  31                 return "PROBE-REQ";
  32         case WLAN_FC_STYPE_PROBE_RESP:
  33                 return "PROBE-RESP";
  34         case WLAN_FC_STYPE_BEACON:
  35                 return "BEACON";
  36         case WLAN_FC_STYPE_ATIM:
  37                 return "ATIM";
  38         case WLAN_FC_STYPE_DISASSOC:
  39                 return "DISASSOC";
  40         case WLAN_FC_STYPE_AUTH:
  41                 return "AUTH";
  42         case WLAN_FC_STYPE_DEAUTH:
  43                 return "DEAUTH";
  44         case WLAN_FC_STYPE_ACTION:
  45                 return "ACTION";
  46         }
  47         return "??";
  48 }
  49
  50
  51 static void rx_mgmt_beacon(struct wlantest *wt, const u8 *data, size_t len)
  52 {
  53         const struct ieee80211_mgmt *mgmt;
  54         struct wlantest_bss *bss;
  55         struct ieee802_11_elems elems;
  56         size_t offset;
  57
  58         mgmt = (const struct ieee80211_mgmt *) data;
  59         offset = mgmt->u.beacon.variable - data;
  60         if (len < offset)
  61                 return;
  62         bss = bss_get(wt, mgmt->bssid);
  63         if (bss == NULL)
  64                 return;
  65         if (bss->proberesp_seen)
  66                 return; /* do not override with Beacon data */
  67         bss->capab_info = le_to_host16(mgmt->u.beacon.capab_info);
  68         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - offset,
  69                                    &elems, 0) == ParseFailed) {
  70                 if (bss->parse_error_reported)
  71                         return;
  72                 add_note(wt, MSG_INFO, "Invalid IEs in a Beacon frame from "
  73                          MACSTR, MAC2STR(mgmt->sa));
  74                 bss->parse_error_reported = 1;
  75                 return;
  76         }
  77
  78         bss_update(wt, bss, &elems);
  79 }
  80
  81
  82 static void rx_mgmt_probe_resp(struct wlantest *wt, const u8 *data, size_t len)
  83 {
  84         const struct ieee80211_mgmt *mgmt;
  85         struct wlantest_bss *bss;
  86         struct ieee802_11_elems elems;
  87         size_t offset;
  88
  89         mgmt = (const struct ieee80211_mgmt *) data;
  90         offset = mgmt->u.probe_resp.variable - data;
  91         if (len < offset)
  92                 return;
  93         bss = bss_get(wt, mgmt->bssid);
  94         if (bss == NULL)
  95                 return;
  96
  97         bss->counters[WLANTEST_BSS_COUNTER_PROBE_RESPONSE]++;
  98         bss->capab_info = le_to_host16(mgmt->u.probe_resp.capab_info);
  99         if (ieee802_11_parse_elems(mgmt->u.probe_resp.variable, len - offset,
 100                                    &elems, 0) == ParseFailed) {
 101                 if (bss->parse_error_reported)
 102                         return;
 103                 add_note(wt, MSG_INFO, "Invalid IEs in a Probe Response frame "
 104                          "from " MACSTR, MAC2STR(mgmt->sa));
 105                 bss->parse_error_reported = 1;
 106                 return;
 107         }
 108
 109         bss_update(wt, bss, &elems);
 110 }
 111
 112
 113 static void rx_mgmt_auth(struct wlantest *wt, const u8 *data, size_t len)
 114 {
 115         const struct ieee80211_mgmt *mgmt;
 116         struct wlantest_bss *bss;
 117         struct wlantest_sta *sta;
 118         u16 alg, trans, status;
 119
 120         mgmt = (const struct ieee80211_mgmt *) data;
 121         bss = bss_get(wt, mgmt->bssid);
 122         if (bss == NULL)
 123                 return;
 124         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
 125                 sta = sta_get(bss, mgmt->da);
 126         else
 127                 sta = sta_get(bss, mgmt->sa);
 128         if (sta == NULL)
 129                 return;
 130
 131         if (len < 24 + 6) {
 132                 add_note(wt, MSG_INFO, "Too short Authentication frame from "
 133                          MACSTR, MAC2STR(mgmt->sa));
 134                 return;
 135         }
 136
 137         alg = le_to_host16(mgmt->u.auth.auth_alg);
 138         trans = le_to_host16(mgmt->u.auth.auth_transaction);
 139         status = le_to_host16(mgmt->u.auth.status_code);
 140
 141         wpa_printf(MSG_DEBUG, "AUTH " MACSTR " -> " MACSTR
 142                    " (alg=%u trans=%u status=%u)",
 143                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da), alg, trans, status);
 144
 145         if (alg == 0 && trans == 2 && status == 0) {
 146                 if (sta->state == STATE1) {
 147                         add_note(wt, MSG_DEBUG, "STA " MACSTR
 148                                  " moved to State 2 with " MACSTR,
 149                                  MAC2STR(sta->addr), MAC2STR(bss->bssid));
 150                         sta->state = STATE2;
 151                 }
 152         }
 153
 154         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
 155                 sta->counters[WLANTEST_STA_COUNTER_AUTH_RX]++;
 156         else
 157                 sta->counters[WLANTEST_STA_COUNTER_AUTH_TX]++;
 158 }
 159
 160
 161 static void deauth_all_stas(struct wlantest *wt, struct wlantest_bss *bss)
 162 {
 163         struct wlantest_sta *sta;
 164         dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
 165                 if (sta->state == STATE1)
 166                         continue;
 167                 add_note(wt, MSG_DEBUG, "STA " MACSTR
 168                          " moved to State 1 with " MACSTR,
 169                          MAC2STR(sta->addr), MAC2STR(bss->bssid));
 170                 sta->state = STATE1;
 171         }
 172 }
 173
 174
 175 static void tdls_link_down(struct wlantest *wt, struct wlantest_bss *bss,
 176                            struct wlantest_sta *sta)
 177 {
 178         struct wlantest_tdls *tdls;
 179         dl_list_for_each(tdls, &bss->tdls, struct wlantest_tdls, list) {
 180                 if ((tdls->init == sta || tdls->resp == sta) && tdls->link_up)
 181                 {
 182                         add_note(wt, MSG_DEBUG, "TDLS: Set link down based on "
 183                                  "STA deauth/disassoc");
 184                         tdls->link_up = 0;
 185                 }
 186         }
 187 }
 188
 189
 190 static void rx_mgmt_deauth(struct wlantest *wt, const u8 *data, size_t len,
 191                            int valid)
 192 {
 193         const struct ieee80211_mgmt *mgmt;
 194         struct wlantest_bss *bss;
 195         struct wlantest_sta *sta;
 196         u16 fc, reason;
 197
 198         mgmt = (const struct ieee80211_mgmt *) data;
 199         bss = bss_get(wt, mgmt->bssid);
 200         if (bss == NULL)
 201                 return;
 202         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
 203                 sta = sta_get(bss, mgmt->da);
 204         else
 205                 sta = sta_get(bss, mgmt->sa);
 206
 207         if (len < 24 + 2) {
 208                 add_note(wt, MSG_INFO, "Too short Deauthentication frame from "
 209                          MACSTR, MAC2STR(mgmt->sa));
 210                 return;
 211         }
 212
 213         reason = le_to_host16(mgmt->u.deauth.reason_code);
 214         wpa_printf(MSG_DEBUG, "DEAUTH " MACSTR " -> " MACSTR
 215                    " (reason=%u) (valid=%d)",
 216                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
 217                    reason, valid);
 218         wpa_hexdump(MSG_MSGDUMP, "DEAUTH payload", data + 24, len - 24);
 219
 220         if (sta == NULL) {
 221                 if (valid && mgmt->da[0] == 0xff)
 222                         deauth_all_stas(wt, bss);
 223                 return;
 224         }
 225
 226         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
 227                 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_RX :
 228                               WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX]++;
 229                 if (sta->pwrmgt && !sta->pspoll)
 230                         sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_ASLEEP]++;
 231                 else
 232                         sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_AWAKE]++;
 233
 234                 fc = le_to_host16(mgmt->frame_control);
 235                 if (!(fc & WLAN_FC_ISWEP) && reason == 6)
 236                         sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_RC6]++;
 237                 else if (!(fc & WLAN_FC_ISWEP) && reason == 7)
 238                         sta->counters[WLANTEST_STA_COUNTER_DEAUTH_RX_RC7]++;
 239         } else
 240                 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DEAUTH_TX :
 241                               WLANTEST_STA_COUNTER_INVALID_DEAUTH_TX]++;
 242
 243         if (!valid) {
 244                 add_note(wt, MSG_INFO, "Do not change STA " MACSTR " State "
 245                          "since Disassociation frame was not protected "
 246                          "correctly", MAC2STR(sta->addr));
 247                 return;
 248         }
 249
 250         if (sta->state != STATE1) {
 251                 add_note(wt, MSG_DEBUG, "STA " MACSTR
 252                          " moved to State 1 with " MACSTR,
 253                          MAC2STR(sta->addr), MAC2STR(bss->bssid));
 254                 sta->state = STATE1;
 255         }
 256         tdls_link_down(wt, bss, sta);
 257 }
 258
 259
 260 static void rx_mgmt_assoc_req(struct wlantest *wt, const u8 *data, size_t len)
 261 {
 262         const struct ieee80211_mgmt *mgmt;
 263         struct wlantest_bss *bss;
 264         struct wlantest_sta *sta;
 265         struct ieee802_11_elems elems;
 266
 267         mgmt = (const struct ieee80211_mgmt *) data;
 268         bss = bss_get(wt, mgmt->bssid);
 269         if (bss == NULL)
 270                 return;
 271         sta = sta_get(bss, mgmt->sa);
 272         if (sta == NULL)
 273                 return;
 274
 275         if (len < 24 + 4) {
 276                 add_note(wt, MSG_INFO, "Too short Association Request frame "
 277                          "from " MACSTR, MAC2STR(mgmt->sa));
 278                 return;
 279         }
 280
 281         wpa_printf(MSG_DEBUG, "ASSOCREQ " MACSTR " -> " MACSTR
 282                    " (capab=0x%x listen_int=%u)",
 283                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
 284                    le_to_host16(mgmt->u.assoc_req.capab_info),
 285                    le_to_host16(mgmt->u.assoc_req.listen_interval));
 286
 287         sta->counters[WLANTEST_STA_COUNTER_ASSOCREQ_TX]++;
 288
 289         if (ieee802_11_parse_elems(mgmt->u.assoc_req.variable,
 290                                    len - (mgmt->u.assoc_req.variable - data),
 291                                    &elems, 0) == ParseFailed) {
 292                 add_note(wt, MSG_INFO, "Invalid IEs in Association Request "
 293                          "frame from " MACSTR, MAC2STR(mgmt->sa));
 294                 return;
 295         }
 296
 297         sta->assocreq_capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
 298         sta->assocreq_listen_int =
 299                 le_to_host16(mgmt->u.assoc_req.listen_interval);
 300         os_free(sta->assocreq_ies);
 301         sta->assocreq_ies_len = len - (mgmt->u.assoc_req.variable - data);
 302         sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
 303         if (sta->assocreq_ies)
 304                 os_memcpy(sta->assocreq_ies, mgmt->u.assoc_req.variable,
 305                           sta->assocreq_ies_len);
 306
 307         sta_update_assoc(sta, &elems);
 308 }
 309
 310
 311 static void rx_mgmt_assoc_resp(struct wlantest *wt, const u8 *data, size_t len)
 312 {
 313         const struct ieee80211_mgmt *mgmt;
 314         struct wlantest_bss *bss;
 315         struct wlantest_sta *sta;
 316         u16 capab, status, aid;
 317         const u8 *ies;
 318         size_t ies_len;
 319         struct wpa_ft_ies parse;
 320
 321         mgmt = (const struct ieee80211_mgmt *) data;
 322         bss = bss_get(wt, mgmt->bssid);
 323         if (bss == NULL)
 324                 return;
 325         sta = sta_get(bss, mgmt->da);
 326         if (sta == NULL)
 327                 return;
 328
 329         if (len < 24 + 6) {
 330                 add_note(wt, MSG_INFO, "Too short Association Response frame "
 331                          "from " MACSTR, MAC2STR(mgmt->sa));
 332                 return;
 333         }
 334
 335         ies = mgmt->u.assoc_resp.variable;
 336         ies_len = len - (mgmt->u.assoc_resp.variable - data);
 337
 338         capab = le_to_host16(mgmt->u.assoc_resp.capab_info);
 339         status = le_to_host16(mgmt->u.assoc_resp.status_code);
 340         aid = le_to_host16(mgmt->u.assoc_resp.aid);
 341
 342         wpa_printf(MSG_DEBUG, "ASSOCRESP " MACSTR " -> " MACSTR
 343                    " (capab=0x%x status=%u aid=%u)",
 344                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
 345                    aid & 0x3fff);
 346
 347         if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
 348                 struct ieee802_11_elems elems;
 349                 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
 350                     ParseFailed) {
 351                         add_note(wt, MSG_INFO, "Failed to parse IEs in "
 352                                  "AssocResp from " MACSTR,
 353                                  MAC2STR(mgmt->sa));
 354                 } else if (elems.timeout_int == NULL ||
 355                            elems.timeout_int[0] !=
 356                            WLAN_TIMEOUT_ASSOC_COMEBACK) {
 357                         add_note(wt, MSG_INFO, "No valid Timeout Interval IE "
 358                                  "with Assoc Comeback time in AssocResp "
 359                                  "(status=30) from " MACSTR,
 360                                  MAC2STR(mgmt->sa));
 361                 } else {
 362                         sta->counters[
 363                                 WLANTEST_STA_COUNTER_ASSOCRESP_COMEBACK]++;
 364                 }
 365         }
 366
 367         if (status)
 368                 return;
 369
 370         if ((aid & 0xc000) != 0xc000) {
 371                 add_note(wt, MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
 372                          "in Association Response from " MACSTR,
 373                          MAC2STR(mgmt->sa));
 374         }
 375         sta->aid = aid & 0xc000;
 376
 377         if (sta->state < STATE2) {
 378                 add_note(wt, MSG_DEBUG,
 379                          "STA " MACSTR " was not in State 2 when "
 380                          "getting associated", MAC2STR(sta->addr));
 381         }
 382
 383         if (sta->state < STATE3) {
 384                 add_note(wt, MSG_DEBUG, "STA " MACSTR
 385                          " moved to State 3 with " MACSTR,
 386                          MAC2STR(sta->addr), MAC2STR(bss->bssid));
 387                 sta->state = STATE3;
 388         }
 389
 390         if (wpa_ft_parse_ies(ies, ies_len, &parse) == 0) {
 391                 if (parse.r0kh_id) {
 392                         os_memcpy(bss->r0kh_id, parse.r0kh_id,
 393                                   parse.r0kh_id_len);
 394                         bss->r0kh_id_len = parse.r0kh_id_len;
 395                 }
 396                 if (parse.r1kh_id)
 397                         os_memcpy(bss->r1kh_id, parse.r1kh_id, FT_R1KH_ID_LEN);
 398         }
 399 }
 400
 401
 402 static void rx_mgmt_reassoc_req(struct wlantest *wt, const u8 *data,
 403                                 size_t len)
 404 {
 405         const struct ieee80211_mgmt *mgmt;
 406         struct wlantest_bss *bss;
 407         struct wlantest_sta *sta;
 408         struct ieee802_11_elems elems;
 409
 410         mgmt = (const struct ieee80211_mgmt *) data;
 411         bss = bss_get(wt, mgmt->bssid);
 412         if (bss == NULL)
 413                 return;
 414         sta = sta_get(bss, mgmt->sa);
 415         if (sta == NULL)
 416                 return;
 417
 418         if (len < 24 + 4 + ETH_ALEN) {
 419                 add_note(wt, MSG_INFO, "Too short Reassociation Request frame "
 420                          "from " MACSTR, MAC2STR(mgmt->sa));
 421                 return;
 422         }
 423
 424         wpa_printf(MSG_DEBUG, "REASSOCREQ " MACSTR " -> " MACSTR
 425                    " (capab=0x%x listen_int=%u current_ap=" MACSTR ")",
 426                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
 427                    le_to_host16(mgmt->u.reassoc_req.capab_info),
 428                    le_to_host16(mgmt->u.reassoc_req.listen_interval),
 429                    MAC2STR(mgmt->u.reassoc_req.current_ap));
 430
 431         sta->counters[WLANTEST_STA_COUNTER_REASSOCREQ_TX]++;
 432
 433         if (ieee802_11_parse_elems(mgmt->u.reassoc_req.variable,
 434                                    len - (mgmt->u.reassoc_req.variable - data),
 435                                    &elems, 0) == ParseFailed) {
 436                 add_note(wt, MSG_INFO, "Invalid IEs in Reassociation Request "
 437                          "frame from " MACSTR, MAC2STR(mgmt->sa));
 438                 return;
 439         }
 440
 441         sta->assocreq_capab_info =
 442                 le_to_host16(mgmt->u.reassoc_req.capab_info);
 443         sta->assocreq_listen_int =
 444                 le_to_host16(mgmt->u.reassoc_req.listen_interval);
 445         os_free(sta->assocreq_ies);
 446         sta->assocreq_ies_len = len - (mgmt->u.reassoc_req.variable - data);
 447         sta->assocreq_ies = os_malloc(sta->assocreq_ies_len);
 448         if (sta->assocreq_ies)
 449                 os_memcpy(sta->assocreq_ies, mgmt->u.reassoc_req.variable,
 450                           sta->assocreq_ies_len);
 451
 452         sta_update_assoc(sta, &elems);
 453 }
 454
 455
 456 static void rx_mgmt_reassoc_resp(struct wlantest *wt, const u8 *data,
 457                                  size_t len)
 458 {
 459         const struct ieee80211_mgmt *mgmt;
 460         struct wlantest_bss *bss;
 461         struct wlantest_sta *sta;
 462         u16 capab, status, aid;
 463
 464         mgmt = (const struct ieee80211_mgmt *) data;
 465         bss = bss_get(wt, mgmt->bssid);
 466         if (bss == NULL)
 467                 return;
 468         sta = sta_get(bss, mgmt->da);
 469         if (sta == NULL)
 470                 return;
 471
 472         if (len < 24 + 6) {
 473                 add_note(wt, MSG_INFO, "Too short Reassociation Response frame "
 474                          "from " MACSTR, MAC2STR(mgmt->sa));
 475                 return;
 476         }
 477
 478         capab = le_to_host16(mgmt->u.reassoc_resp.capab_info);
 479         status = le_to_host16(mgmt->u.reassoc_resp.status_code);
 480         aid = le_to_host16(mgmt->u.reassoc_resp.aid);
 481
 482         wpa_printf(MSG_DEBUG, "REASSOCRESP " MACSTR " -> " MACSTR
 483                    " (capab=0x%x status=%u aid=%u)",
 484                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da), capab, status,
 485                    aid & 0x3fff);
 486
 487         if (status == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
 488                 struct ieee802_11_elems elems;
 489                 const u8 *ies = mgmt->u.reassoc_resp.variable;
 490                 size_t ies_len = len - (mgmt->u.reassoc_resp.variable - data);
 491                 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
 492                     ParseFailed) {
 493                         add_note(wt, MSG_INFO, "Failed to parse IEs in "
 494                                  "ReassocResp from " MACSTR,
 495                                  MAC2STR(mgmt->sa));
 496                 } else if (elems.timeout_int == NULL ||
 497                            elems.timeout_int[0] !=
 498                            WLAN_TIMEOUT_ASSOC_COMEBACK) {
 499                         add_note(wt, MSG_INFO, "No valid Timeout Interval IE "
 500                                  "with Assoc Comeback time in ReassocResp "
 501                                  "(status=30) from " MACSTR,
 502                                  MAC2STR(mgmt->sa));
 503                 } else {
 504                         sta->counters[
 505                                 WLANTEST_STA_COUNTER_REASSOCRESP_COMEBACK]++;
 506                 }
 507         }
 508
 509         if (status)
 510                 return;
 511
 512         if ((aid & 0xc000) != 0xc000) {
 513                 add_note(wt, MSG_DEBUG, "Two MSBs of the AID were not set to 1 "
 514                          "in Reassociation Response from " MACSTR,
 515                          MAC2STR(mgmt->sa));
 516         }
 517         sta->aid = aid & 0xc000;
 518
 519         if (sta->state < STATE2) {
 520                 add_note(wt, MSG_DEBUG,
 521                          "STA " MACSTR " was not in State 2 when "
 522                          "getting associated", MAC2STR(sta->addr));
 523         }
 524
 525         if (sta->state < STATE3) {
 526                 add_note(wt, MSG_DEBUG, "STA " MACSTR
 527                          " moved to State 3 with " MACSTR,
 528                          MAC2STR(sta->addr), MAC2STR(bss->bssid));
 529                 sta->state = STATE3;
 530         }
 531 }
 532
 533
 534 static void disassoc_all_stas(struct wlantest *wt, struct wlantest_bss *bss)
 535 {
 536         struct wlantest_sta *sta;
 537         dl_list_for_each(sta, &bss->sta, struct wlantest_sta, list) {
 538                 if (sta->state <= STATE2)
 539                         continue;
 540                 add_note(wt, MSG_DEBUG, "STA " MACSTR
 541                          " moved to State 2 with " MACSTR,
 542                          MAC2STR(sta->addr), MAC2STR(bss->bssid));
 543                 sta->state = STATE2;
 544         }
 545 }
 546
 547
 548 static void rx_mgmt_disassoc(struct wlantest *wt, const u8 *data, size_t len,
 549                              int valid)
 550 {
 551         const struct ieee80211_mgmt *mgmt;
 552         struct wlantest_bss *bss;
 553         struct wlantest_sta *sta;
 554         u16 fc, reason;
 555
 556         mgmt = (const struct ieee80211_mgmt *) data;
 557         bss = bss_get(wt, mgmt->bssid);
 558         if (bss == NULL)
 559                 return;
 560         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
 561                 sta = sta_get(bss, mgmt->da);
 562         else
 563                 sta = sta_get(bss, mgmt->sa);
 564
 565         if (len < 24 + 2) {
 566                 add_note(wt, MSG_INFO, "Too short Disassociation frame from "
 567                          MACSTR, MAC2STR(mgmt->sa));
 568                 return;
 569         }
 570
 571         reason = le_to_host16(mgmt->u.disassoc.reason_code);
 572         wpa_printf(MSG_DEBUG, "DISASSOC " MACSTR " -> " MACSTR
 573                    " (reason=%u) (valid=%d)",
 574                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
 575                    reason, valid);
 576         wpa_hexdump(MSG_MSGDUMP, "DISASSOC payload", data + 24, len - 24);
 577
 578         if (sta == NULL) {
 579                 if (valid && mgmt->da[0] == 0xff)
 580                         disassoc_all_stas(wt, bss);
 581                 return;
 582         }
 583
 584         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
 585                 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_RX :
 586                               WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX]++;
 587                 if (sta->pwrmgt && !sta->pspoll)
 588                         sta->counters[
 589                                 WLANTEST_STA_COUNTER_DISASSOC_RX_ASLEEP]++;
 590                 else
 591                         sta->counters[
 592                                 WLANTEST_STA_COUNTER_DISASSOC_RX_AWAKE]++;
 593
 594                 fc = le_to_host16(mgmt->frame_control);
 595                 if (!(fc & WLAN_FC_ISWEP) && reason == 6)
 596                         sta->counters[WLANTEST_STA_COUNTER_DISASSOC_RX_RC6]++;
 597                 else if (!(fc & WLAN_FC_ISWEP) && reason == 7)
 598                         sta->counters[WLANTEST_STA_COUNTER_DISASSOC_RX_RC7]++;
 599         } else
 600                 sta->counters[valid ? WLANTEST_STA_COUNTER_VALID_DISASSOC_TX :
 601                               WLANTEST_STA_COUNTER_INVALID_DISASSOC_TX]++;
 602
 603         if (!valid) {
 604                 add_note(wt, MSG_INFO, "Do not change STA " MACSTR " State "
 605                          "since Disassociation frame was not protected "
 606                          "correctly", MAC2STR(sta->addr));
 607                 return;
 608         }
 609
 610         if (sta->state < STATE2) {
 611                 add_note(wt, MSG_DEBUG,
 612                          "STA " MACSTR " was not in State 2 or 3 "
 613                          "when getting disassociated", MAC2STR(sta->addr));
 614         }
 615
 616         if (sta->state > STATE2) {
 617                 add_note(wt, MSG_DEBUG, "STA " MACSTR
 618                          " moved to State 2 with " MACSTR,
 619                          MAC2STR(sta->addr), MAC2STR(bss->bssid));
 620                 sta->state = STATE2;
 621         }
 622         tdls_link_down(wt, bss, sta);
 623 }
 624
 625
 626 static void rx_mgmt_action_sa_query_req(struct wlantest *wt,
 627                                         struct wlantest_sta *sta,
 628                                         const struct ieee80211_mgmt *mgmt,
 629                                         size_t len, int valid)
 630 {
 631         const u8 *rx_id;
 632         u8 *id;
 633
 634         rx_id = (const u8 *) mgmt->u.action.u.sa_query_req.trans_id;
 635         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
 636                 id = sta->ap_sa_query_tr;
 637         else
 638                 id = sta->sta_sa_query_tr;
 639         add_note(wt, MSG_INFO, "SA Query Request " MACSTR " -> " MACSTR
 640                  " (trans_id=%02x%02x)%s",
 641                  MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
 642                  valid ? "" : " (invalid protection)");
 643         os_memcpy(id, mgmt->u.action.u.sa_query_req.trans_id, 2);
 644         if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
 645                 sta->counters[valid ?
 646                               WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_TX :
 647                               WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_TX]++;
 648         else
 649                 sta->counters[valid ?
 650                               WLANTEST_STA_COUNTER_VALID_SAQUERYREQ_RX :
 651                               WLANTEST_STA_COUNTER_INVALID_SAQUERYREQ_RX]++;
 652 }
 653
 654
 655 static void rx_mgmt_action_sa_query_resp(struct wlantest *wt,
 656                                          struct wlantest_sta *sta,
 657                                          const struct ieee80211_mgmt *mgmt,
 658                                          size_t len, int valid)
 659 {
 660         const u8 *rx_id;
 661         u8 *id;
 662         int match;
 663
 664         rx_id = (const u8 *) mgmt->u.action.u.sa_query_resp.trans_id;
 665         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
 666                 id = sta->sta_sa_query_tr;
 667         else
 668                 id = sta->ap_sa_query_tr;
 669         match = os_memcmp(rx_id, id, 2) == 0;
 670         add_note(wt, MSG_INFO, "SA Query Response " MACSTR " -> " MACSTR
 671                  " (trans_id=%02x%02x; %s)%s",
 672                  MAC2STR(mgmt->sa), MAC2STR(mgmt->da), rx_id[0], rx_id[1],
 673                  match ? "match" : "mismatch",
 674                  valid ? "" : " (invalid protection)");
 675         if (os_memcmp(mgmt->sa, sta->addr, ETH_ALEN) == 0)
 676                 sta->counters[(valid && match) ?
 677                               WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_TX :
 678                               WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_TX]++;
 679         else
 680                 sta->counters[(valid && match) ?
 681                               WLANTEST_STA_COUNTER_VALID_SAQUERYRESP_RX :
 682                               WLANTEST_STA_COUNTER_INVALID_SAQUERYRESP_RX]++;
 683 }
 684
 685
 686 static void rx_mgmt_action_sa_query(struct wlantest *wt,
 687                                     struct wlantest_sta *sta,
 688                                     const struct ieee80211_mgmt *mgmt,
 689                                     size_t len, int valid)
 690 {
 691         if (len < 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
 692                 add_note(wt, MSG_INFO, "Too short SA Query frame from " MACSTR,
 693                          MAC2STR(mgmt->sa));
 694                 return;
 695         }
 696
 697         if (len > 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN) {
 698                 size_t elen = len - (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN);
 699                 add_note(wt, MSG_INFO, "Unexpected %u octets of extra data at "
 700                          "the end of SA Query frame from " MACSTR,
 701                          (unsigned) elen, MAC2STR(mgmt->sa));
 702                 wpa_hexdump(MSG_INFO, "SA Query extra data",
 703                             ((const u8 *) mgmt) + len - elen, elen);
 704         }
 705
 706         switch (mgmt->u.action.u.sa_query_req.action) {
 707         case WLAN_SA_QUERY_REQUEST:
 708                 rx_mgmt_action_sa_query_req(wt, sta, mgmt, len, valid);
 709                 break;
 710         case WLAN_SA_QUERY_RESPONSE:
 711                 rx_mgmt_action_sa_query_resp(wt, sta, mgmt, len, valid);
 712                 break;
 713         default:
 714                 add_note(wt, MSG_INFO, "Unexpected SA Query action value %u "
 715                          "from " MACSTR,
 716                          mgmt->u.action.u.sa_query_req.action,
 717                          MAC2STR(mgmt->sa));
 718         }
 719 }
 720
 721
 722 static void rx_mgmt_action(struct wlantest *wt, const u8 *data, size_t len,
 723                            int valid)
 724 {
 725         const struct ieee80211_mgmt *mgmt;
 726         struct wlantest_bss *bss;
 727         struct wlantest_sta *sta;
 728
 729         mgmt = (const struct ieee80211_mgmt *) data;
 730         if (mgmt->da[0] & 0x01) {
 731                 add_note(wt, MSG_DEBUG, "Group addressed Action frame: DA="
 732                          MACSTR " SA=" MACSTR " BSSID=" MACSTR
 733                          " category=%u",
 734                          MAC2STR(mgmt->da), MAC2STR(mgmt->sa),
 735                          MAC2STR(mgmt->bssid), mgmt->u.action.category);
 736                 return; /* Ignore group addressed Action frames for now */
 737         }
 738         bss = bss_get(wt, mgmt->bssid);
 739         if (bss == NULL)
 740                 return;
 741         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
 742                 sta = sta_get(bss, mgmt->da);
 743         else
 744                 sta = sta_get(bss, mgmt->sa);
 745         if (sta == NULL)
 746                 return;
 747
 748         if (len < 24 + 1) {
 749                 add_note(wt, MSG_INFO, "Too short Action frame from " MACSTR,
 750                          MAC2STR(mgmt->sa));
 751                 return;
 752         }
 753
 754         wpa_printf(MSG_DEBUG, "ACTION " MACSTR " -> " MACSTR
 755                    " (category=%u) (valid=%d)",
 756                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
 757                    mgmt->u.action.category, valid);
 758         wpa_hexdump(MSG_MSGDUMP, "ACTION payload", data + 24, len - 24);
 759
 760         if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
 761             sta->state < STATE3) {
 762                 add_note(wt, MSG_INFO, "Action frame sent when STA is not in "
 763                          "State 3 (SA=" MACSTR " DATA=" MACSTR ")",
 764                          MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
 765         }
 766
 767         switch (mgmt->u.action.category) {
 768         case WLAN_ACTION_SA_QUERY:
 769                 rx_mgmt_action_sa_query(wt, sta, mgmt, len, valid);
 770                 break;
 771         }
 772 }
 773
 774
 775 static int check_mmie_mic(unsigned int mgmt_group_cipher,
 776                           const u8 *igtk, size_t igtk_len,
 777                           const u8 *data, size_t len)
 778 {
 779         u8 *buf;
 780         u8 mic[16];
 781         u16 fc;
 782         const struct ieee80211_hdr *hdr;
 783         int ret, mic_len;
 784
 785         if (!mgmt_group_cipher || igtk_len < 16)
 786                 return -1;
 787         mic_len = mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC ? 8 : 16;
 788
 789         if (len < 24 || len - 24 < mic_len)
 790                 return -1;
 791
 792         buf = os_malloc(len + 20 - 24);
 793         if (buf == NULL)
 794                 return -1;
 795
 796         /* BIP AAD: FC(masked) A1 A2 A3 */
 797         hdr = (const struct ieee80211_hdr *) data;
 798         fc = le_to_host16(hdr->frame_control);
 799         fc &= ~(WLAN_FC_RETRY | WLAN_FC_PWRMGT | WLAN_FC_MOREDATA);
 800         WPA_PUT_LE16(buf, fc);
 801         os_memcpy(buf + 2, hdr->addr1, 3 * ETH_ALEN);
 802
 803         /* Frame body with MMIE MIC masked to zero */
 804         os_memcpy(buf + 20, data + 24, len - 24 - mic_len);
 805         os_memset(buf + 20 + len - 24 - mic_len, 0, mic_len);
 806
 807         wpa_hexdump(MSG_MSGDUMP, "BIP: AAD|Body(masked)", buf, len + 20 - 24);
 808         /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
 809         if (mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC) {
 810                 ret = omac1_aes_128(igtk, buf, len + 20 - 24, mic);
 811         } else if (mgmt_group_cipher == WPA_CIPHER_BIP_CMAC_256) {
 812                 ret = omac1_aes_256(igtk, buf, len + 20 - 24, mic);
 813         } else if (mgmt_group_cipher == WPA_CIPHER_BIP_GMAC_128 ||
 814                  mgmt_group_cipher == WPA_CIPHER_BIP_GMAC_256) {
 815                 u8 nonce[12], *npos;
 816                 const u8 *ipn;
 817
 818                 ipn = data + len - mic_len - 6;
 819
 820                 /* Nonce: A2 | IPN */
 821                 os_memcpy(nonce, hdr->addr2, ETH_ALEN);
 822                 npos = nonce + ETH_ALEN;
 823                 *npos++ = ipn[5];
 824                 *npos++ = ipn[4];
 825                 *npos++ = ipn[3];
 826                 *npos++ = ipn[2];
 827                 *npos++ = ipn[1];
 828                 *npos++ = ipn[0];
 829
 830                 ret = aes_gmac(igtk, igtk_len, nonce, sizeof(nonce),
 831                                buf, len + 20 - 24, mic);
 832         } else {
 833                 ret = -1;
 834         }
 835         if (ret < 0) {
 836                 os_free(buf);
 837                 return -1;
 838         }
 839
 840         os_free(buf);
 841
 842         if (os_memcmp(data + len - mic_len, mic, mic_len) != 0)
 843                 return -1;
 844
 845         return 0;
 846 }
 847
 848
 849 static int check_bip(struct wlantest *wt, const u8 *data, size_t len)
 850 {
 851         const struct ieee80211_mgmt *mgmt;
 852         u16 fc, stype;
 853         const u8 *mmie;
 854         u16 keyid;
 855         struct wlantest_bss *bss;
 856         size_t mic_len;
 857
 858         mgmt = (const struct ieee80211_mgmt *) data;
 859         fc = le_to_host16(mgmt->frame_control);
 860         stype = WLAN_FC_GET_STYPE(fc);
 861
 862         if (stype == WLAN_FC_STYPE_ACTION) {
 863                 if (len < 24 + 1)
 864                         return 0;
 865                 if (mgmt->u.action.category == WLAN_ACTION_PUBLIC)
 866                         return 0; /* Not a robust management frame */
 867         }
 868
 869         bss = bss_get(wt, mgmt->bssid);
 870         if (bss == NULL)
 871                 return 0; /* No key known yet */
 872
 873         mic_len = bss->mgmt_group_cipher == WPA_CIPHER_AES_128_CMAC ? 8 : 16;
 874
 875         if (len < 24 + 10 + mic_len ||
 876             data[len - (10 + mic_len)] != WLAN_EID_MMIE ||
 877             data[len - (10 + mic_len - 1)] != 8 + mic_len) {
 878                 /* No MMIE */
 879                 if (bss->rsn_capab & WPA_CAPABILITY_MFPC) {
 880                         add_note(wt, MSG_INFO, "Robust group-addressed "
 881                                  "management frame sent without BIP by "
 882                                  MACSTR, MAC2STR(mgmt->sa));
 883                         bss->counters[WLANTEST_BSS_COUNTER_MISSING_BIP_MMIE]++;
 884                         return -1;
 885                 }
 886                 return 0;
 887         }
 888
 889         mmie = data + len - (8 + mic_len);
 890         keyid = WPA_GET_LE16(mmie);
 891         if (keyid & 0xf000) {
 892                 add_note(wt, MSG_INFO, "MMIE KeyID reserved bits not zero "
 893                          "(%04x) from " MACSTR, keyid, MAC2STR(mgmt->sa));
 894                 keyid &= 0x0fff;
 895         }
 896         if (keyid < 4 || keyid > 5) {
 897                 add_note(wt, MSG_INFO, "Unexpected MMIE KeyID %u from " MACSTR,
 898                          keyid, MAC2STR(mgmt->sa));
 899                 bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
 900                 return 0;
 901         }
 902         wpa_printf(MSG_DEBUG, "MMIE KeyID %u", keyid);
 903         wpa_hexdump(MSG_MSGDUMP, "MMIE IPN", mmie + 2, 6);
 904         wpa_hexdump(MSG_MSGDUMP, "MMIE MIC", mmie + 8, mic_len);
 905
 906         if (!bss->igtk_len[keyid]) {
 907                 add_note(wt, MSG_DEBUG, "No IGTK known to validate BIP frame");
 908                 return 0;
 909         }
 910
 911         if (os_memcmp(mmie + 2, bss->ipn[keyid], 6) <= 0) {
 912                 add_note(wt, MSG_INFO, "BIP replay detected: SA=" MACSTR,
 913                          MAC2STR(mgmt->sa));
 914                 wpa_hexdump(MSG_INFO, "RX IPN", mmie + 2, 6);
 915                 wpa_hexdump(MSG_INFO, "Last RX IPN", bss->ipn[keyid], 6);
 916         }
 917
 918         if (check_mmie_mic(bss->mgmt_group_cipher, bss->igtk[keyid],
 919                            bss->igtk_len[keyid], data, len) < 0) {
 920                 add_note(wt, MSG_INFO, "Invalid MMIE MIC in a frame from "
 921                          MACSTR, MAC2STR(mgmt->sa));
 922                 bss->counters[WLANTEST_BSS_COUNTER_INVALID_BIP_MMIE]++;
 923                 return -1;
 924         }
 925
 926         add_note(wt, MSG_DEBUG, "Valid MMIE MIC");
 927         os_memcpy(bss->ipn[keyid], mmie + 2, 6);
 928         bss->counters[WLANTEST_BSS_COUNTER_VALID_BIP_MMIE]++;
 929
 930         if (stype == WLAN_FC_STYPE_DEAUTH)
 931                 bss->counters[WLANTEST_BSS_COUNTER_BIP_DEAUTH]++;
 932         else if (stype == WLAN_FC_STYPE_DISASSOC)
 933                 bss->counters[WLANTEST_BSS_COUNTER_BIP_DISASSOC]++;
 934
 935         return 0;
 936 }
 937
 938
 939 static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
 940                               size_t *dlen)
 941 {
 942         struct wlantest_bss *bss;
 943         struct wlantest_sta *sta;
 944         const struct ieee80211_hdr *hdr;
 945         int keyid;
 946         u8 *decrypted, *frame = NULL;
 947         u8 pn[6], *rsc;
 948
 949         hdr = (const struct ieee80211_hdr *) data;
 950         bss = bss_get(wt, hdr->addr3);
 951         if (bss == NULL)
 952                 return NULL;
 953         if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
 954                 sta = sta_get(bss, hdr->addr2);
 955         else
 956                 sta = sta_get(bss, hdr->addr1);
 957         if (sta == NULL || !sta->ptk_set) {
 958                 add_note(wt, MSG_MSGDUMP, "No PTK known to decrypt the frame");
 959                 return NULL;
 960         }
 961
 962         if (len < 24 + 4)
 963                 return NULL;
 964
 965         if (!(data[24 + 3] & 0x20)) {
 966                 add_note(wt, MSG_INFO, "Expected CCMP frame from " MACSTR
 967                          " did not have ExtIV bit set to 1",
 968                          MAC2STR(hdr->addr2));
 969                 return NULL;
 970         }
 971
 972         if (data[24 + 2] != 0 || (data[24 + 3] & 0x1f) != 0) {
 973                 add_note(wt, MSG_INFO, "CCMP mgmt frame from " MACSTR " used "
 974                          "non-zero reserved bit", MAC2STR(hdr->addr2));
 975         }
 976
 977         keyid = data[24 + 3] >> 6;
 978         if (keyid != 0) {
 979                 add_note(wt, MSG_INFO, "Unexpected non-zero KeyID %d in "
 980                          "individually addressed Management frame from "
 981                          MACSTR, keyid, MAC2STR(hdr->addr2));
 982         }
 983
 984         if (os_memcmp(hdr->addr1, hdr->addr3, ETH_ALEN) == 0)
 985                 rsc = sta->rsc_tods[16];
 986         else
 987                 rsc = sta->rsc_fromds[16];
 988
 989         ccmp_get_pn(pn, data + 24);
 990         if (os_memcmp(pn, rsc, 6) <= 0) {
 991                 u16 seq_ctrl = le_to_host16(hdr->seq_ctrl);
 992                 add_note(wt, MSG_INFO, "CCMP/TKIP replay detected: A1=" MACSTR
 993                          " A2=" MACSTR " A3=" MACSTR " seq=%u frag=%u%s",
 994                          MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
 995                          MAC2STR(hdr->addr3),
 996                          WLAN_GET_SEQ_SEQ(seq_ctrl),
 997                          WLAN_GET_SEQ_FRAG(seq_ctrl),
 998                          (le_to_host16(hdr->frame_control) & WLAN_FC_RETRY) ?
 999                          " Retry" : "");
1000                 wpa_hexdump(MSG_INFO, "RX PN", pn, 6);
1001                 wpa_hexdump(MSG_INFO, "RSC", rsc, 6);
1002         }
1003
1004         decrypted = ccmp_decrypt(sta->ptk.tk, hdr, data + 24, len - 24, dlen);
1005         if (decrypted) {
1006                 os_memcpy(rsc, pn, 6);
1007                 frame = os_malloc(24 + *dlen);
1008                 if (frame) {
1009                         os_memcpy(frame, data, 24);
1010                         os_memcpy(frame + 24, decrypted, *dlen);
1011                         *dlen += 24;
1012                 }
1013         }
1014
1015         os_free(decrypted);
1016
1017         return frame;
1018 }
1019
1020
1021 static int check_mgmt_ccmp(struct wlantest *wt, const u8 *data, size_t len)
1022 {
1023         const struct ieee80211_mgmt *mgmt;
1024         u16 fc;
1025         struct wlantest_bss *bss;
1026         struct wlantest_sta *sta;
1027
1028         mgmt = (const struct ieee80211_mgmt *) data;
1029         fc = le_to_host16(mgmt->frame_control);
1030
1031         if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
1032                 if (len > 24 &&
1033                     mgmt->u.action.category == WLAN_ACTION_PUBLIC)
1034                         return 0; /* Not a robust management frame */
1035         }
1036
1037         bss = bss_get(wt, mgmt->bssid);
1038         if (bss == NULL)
1039                 return 0;
1040         if (os_memcmp(mgmt->da, mgmt->bssid, ETH_ALEN) == 0)
1041                 sta = sta_get(bss, mgmt->sa);
1042         else
1043                 sta = sta_get(bss, mgmt->da);
1044         if (sta == NULL)
1045                 return 0;
1046
1047         if ((sta->rsn_capab & WPA_CAPABILITY_MFPC) &&
1048             (sta->state == STATE3 ||
1049              WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION)) {
1050                 add_note(wt, MSG_INFO, "Robust individually-addressed "
1051                          "management frame sent without CCMP by "
1052                          MACSTR, MAC2STR(mgmt->sa));
1053                 return -1;
1054         }
1055
1056         return 0;
1057 }
1058
1059
1060 void rx_mgmt(struct wlantest *wt, const u8 *data, size_t len)
1061 {
1062         const struct ieee80211_hdr *hdr;
1063         u16 fc, stype;
1064         int valid = 1;
1065         u8 *decrypted = NULL;
1066         size_t dlen;
1067
1068         if (len < 24)
1069                 return;
1070
1071         hdr = (const struct ieee80211_hdr *) data;
1072         fc = le_to_host16(hdr->frame_control);
1073         wt->rx_mgmt++;
1074         stype = WLAN_FC_GET_STYPE(fc);
1075
1076         if ((hdr->addr1[0] & 0x01) &&
1077             (stype == WLAN_FC_STYPE_DEAUTH ||
1078              stype == WLAN_FC_STYPE_DISASSOC ||
1079              stype == WLAN_FC_STYPE_ACTION)) {
1080                 if (check_bip(wt, data, len) < 0)
1081                         valid = 0;
1082         }
1083
1084         wpa_printf((stype == WLAN_FC_STYPE_BEACON ||
1085                     stype == WLAN_FC_STYPE_PROBE_RESP ||
1086                     stype == WLAN_FC_STYPE_PROBE_REQ) ?
1087                    MSG_EXCESSIVE : MSG_MSGDUMP,
1088                    "MGMT %s%s%s DA=" MACSTR " SA=" MACSTR " BSSID=" MACSTR,
1089                    mgmt_stype(stype),
1090                    fc & WLAN_FC_PWRMGT ? " PwrMgt" : "",
1091                    fc & WLAN_FC_ISWEP ? " Prot" : "",
1092                    MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
1093                    MAC2STR(hdr->addr3));
1094
1095         if ((fc & WLAN_FC_ISWEP) &&
1096             !(hdr->addr1[0] & 0x01) &&
1097             (stype == WLAN_FC_STYPE_DEAUTH ||
1098              stype == WLAN_FC_STYPE_DISASSOC ||
1099              stype == WLAN_FC_STYPE_ACTION)) {
1100                 decrypted = mgmt_ccmp_decrypt(wt, data, len, &dlen);
1101                 if (decrypted) {
1102                         write_pcap_decrypted(wt, decrypted, dlen, NULL, 0);
1103                         data = decrypted;
1104                         len = dlen;
1105                 } else
1106                         valid = 0;
1107         }
1108
1109         if (!(fc & WLAN_FC_ISWEP) &&
1110             !(hdr->addr1[0] & 0x01) &&
1111             (stype == WLAN_FC_STYPE_DEAUTH ||
1112              stype == WLAN_FC_STYPE_DISASSOC ||
1113              stype == WLAN_FC_STYPE_ACTION)) {
1114                 if (check_mgmt_ccmp(wt, data, len) < 0)
1115                         valid = 0;
1116         }
1117
1118         switch (stype) {
1119         case WLAN_FC_STYPE_BEACON:
1120                 rx_mgmt_beacon(wt, data, len);
1121                 break;
1122         case WLAN_FC_STYPE_PROBE_RESP:
1123                 rx_mgmt_probe_resp(wt, data, len);
1124                 break;
1125         case WLAN_FC_STYPE_AUTH:
1126                 rx_mgmt_auth(wt, data, len);
1127                 break;
1128         case WLAN_FC_STYPE_DEAUTH:
1129                 rx_mgmt_deauth(wt, data, len, valid);
1130                 break;
1131         case WLAN_FC_STYPE_ASSOC_REQ:
1132                 rx_mgmt_assoc_req(wt, data, len);
1133                 break;
1134         case WLAN_FC_STYPE_ASSOC_RESP:
1135                 rx_mgmt_assoc_resp(wt, data, len);
1136                 break;
1137         case WLAN_FC_STYPE_REASSOC_REQ:
1138                 rx_mgmt_reassoc_req(wt, data, len);
1139                 break;
1140         case WLAN_FC_STYPE_REASSOC_RESP:
1141                 rx_mgmt_reassoc_resp(wt, data, len);
1142                 break;
1143         case WLAN_FC_STYPE_DISASSOC:
1144                 rx_mgmt_disassoc(wt, data, len, valid);
1145                 break;
1146         case WLAN_FC_STYPE_ACTION:
1147                 rx_mgmt_action(wt, data, len, valid);
1148                 break;
1149         }
1150
1151         os_free(decrypted);
1152
1153         wt->last_mgmt_valid = valid;
1154 }
1155
1156
1157 static void rx_mgmt_deauth_ack(struct wlantest *wt,
1158                                const struct ieee80211_hdr *hdr)
1159 {
1160         const struct ieee80211_mgmt *mgmt;
1161         struct wlantest_bss *bss;
1162         struct wlantest_sta *sta;
1163
1164         mgmt = (const struct ieee80211_mgmt *) hdr;
1165         bss = bss_get(wt, mgmt->bssid);
1166         if (bss == NULL)
1167                 return;
1168         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
1169                 sta = sta_get(bss, mgmt->da);
1170         else
1171                 sta = sta_get(bss, mgmt->sa);
1172         if (sta == NULL)
1173                 return;
1174
1175         add_note(wt, MSG_DEBUG, "DEAUTH from " MACSTR " acknowledged by "
1176                  MACSTR, MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1177         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
1178                 int c;
1179                 c = wt->last_mgmt_valid ?
1180                         WLANTEST_STA_COUNTER_VALID_DEAUTH_RX_ACK :
1181                         WLANTEST_STA_COUNTER_INVALID_DEAUTH_RX_ACK;
1182                 sta->counters[c]++;
1183         }
1184 }
1185
1186
1187 static void rx_mgmt_disassoc_ack(struct wlantest *wt,
1188                                  const struct ieee80211_hdr *hdr)
1189 {
1190         const struct ieee80211_mgmt *mgmt;
1191         struct wlantest_bss *bss;
1192         struct wlantest_sta *sta;
1193
1194         mgmt = (const struct ieee80211_mgmt *) hdr;
1195         bss = bss_get(wt, mgmt->bssid);
1196         if (bss == NULL)
1197                 return;
1198         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0)
1199                 sta = sta_get(bss, mgmt->da);
1200         else
1201                 sta = sta_get(bss, mgmt->sa);
1202         if (sta == NULL)
1203                 return;
1204
1205         add_note(wt, MSG_DEBUG, "DISASSOC from " MACSTR " acknowledged by "
1206                  MACSTR, MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1207         if (os_memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN) == 0) {
1208                 int c;
1209                 c = wt->last_mgmt_valid ?
1210                         WLANTEST_STA_COUNTER_VALID_DISASSOC_RX_ACK :
1211                         WLANTEST_STA_COUNTER_INVALID_DISASSOC_RX_ACK;
1212                 sta->counters[c]++;
1213         }
1214 }
1215
1216
1217 void rx_mgmt_ack(struct wlantest *wt, const struct ieee80211_hdr *hdr)
1218 {
1219         u16 fc, stype;
1220         fc = le_to_host16(hdr->frame_control);
1221         stype = WLAN_FC_GET_STYPE(fc);
1222
1223         wpa_printf(MSG_MSGDUMP, "MGMT ACK: stype=%u a1=" MACSTR " a2=" MACSTR
1224                    " a3=" MACSTR,
1225                    stype, MAC2STR(hdr->addr1), MAC2STR(hdr->addr2),
1226                    MAC2STR(hdr->addr3));
1227
1228         switch (stype) {
1229         case WLAN_FC_STYPE_DEAUTH:
1230                 rx_mgmt_deauth_ack(wt, hdr);
1231                 break;
1232         case WLAN_FC_STYPE_DISASSOC:
1233                 rx_mgmt_disassoc_ack(wt, hdr);
1234                 break;
1235         }
1236 }