2 * Received Management frame processing
3 * Copyright (c) 2010, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
15 #include "utils/includes.h"
17 #include "utils/common.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "crypto/aes_wrap.h"
24 static const char * mgmt_stype(u16 stype
)
27 case WLAN_FC_STYPE_ASSOC_REQ
:
29 case WLAN_FC_STYPE_ASSOC_RESP
:
31 case WLAN_FC_STYPE_REASSOC_REQ
:
33 case WLAN_FC_STYPE_REASSOC_RESP
:
34 return "REASSOC-RESP";
35 case WLAN_FC_STYPE_PROBE_REQ
:
37 case WLAN_FC_STYPE_PROBE_RESP
:
39 case WLAN_FC_STYPE_BEACON
:
41 case WLAN_FC_STYPE_ATIM
:
43 case WLAN_FC_STYPE_DISASSOC
:
45 case WLAN_FC_STYPE_AUTH
:
47 case WLAN_FC_STYPE_DEAUTH
:
49 case WLAN_FC_STYPE_ACTION
:
56 static void rx_mgmt_beacon(struct wlantest
*wt
, const u8
*data
, size_t len
)
58 const struct ieee80211_mgmt
*mgmt
;
59 struct wlantest_bss
*bss
;
60 struct ieee802_11_elems elems
;
62 mgmt
= (const struct ieee80211_mgmt
*) data
;
63 bss
= bss_get(wt
, mgmt
->bssid
);
66 if (bss
->proberesp_seen
)
67 return; /* do not override with Beacon data */
68 bss
->capab_info
= le_to_host16(mgmt
->u
.beacon
.capab_info
);
69 if (ieee802_11_parse_elems(mgmt
->u
.beacon
.variable
,
70 len
- (mgmt
->u
.beacon
.variable
- data
),
71 &elems
, 0) == ParseFailed
) {
72 if (bss
->parse_error_reported
)
74 wpa_printf(MSG_INFO
, "Invalid IEs in a Beacon frame from "
75 MACSTR
, MAC2STR(mgmt
->sa
));
76 bss
->parse_error_reported
= 1;
80 bss_update(wt
, bss
, &elems
);
84 static void rx_mgmt_probe_resp(struct wlantest
*wt
, const u8
*data
, size_t len
)
86 const struct ieee80211_mgmt
*mgmt
;
87 struct wlantest_bss
*bss
;
88 struct ieee802_11_elems elems
;
90 mgmt
= (const struct ieee80211_mgmt
*) data
;
91 bss
= bss_get(wt
, mgmt
->bssid
);
95 bss
->capab_info
= le_to_host16(mgmt
->u
.probe_resp
.capab_info
);
96 if (ieee802_11_parse_elems(mgmt
->u
.probe_resp
.variable
,
97 len
- (mgmt
->u
.probe_resp
.variable
- data
),
98 &elems
, 0) == ParseFailed
) {
99 if (bss
->parse_error_reported
)
101 wpa_printf(MSG_INFO
, "Invalid IEs in a Probe Response frame "
102 "from " MACSTR
, MAC2STR(mgmt
->sa
));
103 bss
->parse_error_reported
= 1;
107 bss_update(wt
, bss
, &elems
);
111 static void rx_mgmt_auth(struct wlantest
*wt
, const u8
*data
, size_t len
)
113 const struct ieee80211_mgmt
*mgmt
;
114 struct wlantest_bss
*bss
;
115 struct wlantest_sta
*sta
;
116 u16 alg
, trans
, status
;
118 mgmt
= (const struct ieee80211_mgmt
*) data
;
119 bss
= bss_get(wt
, mgmt
->bssid
);
122 if (os_memcmp(mgmt
->sa
, mgmt
->bssid
, ETH_ALEN
) == 0)
123 sta
= sta_get(bss
, mgmt
->da
);
125 sta
= sta_get(bss
, mgmt
->sa
);
130 wpa_printf(MSG_INFO
, "Too short Authentication frame from "
131 MACSTR
, MAC2STR(mgmt
->sa
));
135 alg
= le_to_host16(mgmt
->u
.auth
.auth_alg
);
136 trans
= le_to_host16(mgmt
->u
.auth
.auth_transaction
);
137 status
= le_to_host16(mgmt
->u
.auth
.status_code
);
139 wpa_printf(MSG_DEBUG
, "AUTH " MACSTR
" -> " MACSTR
140 " (alg=%u trans=%u status=%u)",
141 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
), alg
, trans
, status
);
143 if (alg
== 0 && trans
== 2 && status
== 0) {
144 if (sta
->state
== STATE1
) {
145 wpa_printf(MSG_DEBUG
, "STA " MACSTR
146 " moved to State 2 with " MACSTR
,
147 MAC2STR(sta
->addr
), MAC2STR(bss
->bssid
));
154 static void rx_mgmt_deauth(struct wlantest
*wt
, const u8
*data
, size_t len
,
157 const struct ieee80211_mgmt
*mgmt
;
158 struct wlantest_bss
*bss
;
159 struct wlantest_sta
*sta
;
161 mgmt
= (const struct ieee80211_mgmt
*) data
;
162 bss
= bss_get(wt
, mgmt
->bssid
);
165 if (os_memcmp(mgmt
->sa
, mgmt
->bssid
, ETH_ALEN
) == 0)
166 sta
= sta_get(bss
, mgmt
->da
);
168 sta
= sta_get(bss
, mgmt
->sa
);
173 wpa_printf(MSG_INFO
, "Too short Deauthentication frame from "
174 MACSTR
, MAC2STR(mgmt
->sa
));
178 wpa_printf(MSG_DEBUG
, "DEAUTH " MACSTR
" -> " MACSTR
180 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
),
181 le_to_host16(mgmt
->u
.deauth
.reason_code
));
182 wpa_hexdump(MSG_MSGDUMP
, "DEAUTH payload", data
+ 24, len
- 24);
185 wpa_printf(MSG_INFO
, "Do not change STA " MACSTR
" State "
186 "since Disassociation frame was not protected "
187 "correctly", MAC2STR(sta
->addr
));
191 if (sta
->state
!= STATE1
) {
192 wpa_printf(MSG_DEBUG
, "STA " MACSTR
193 " moved to State 1 with " MACSTR
,
194 MAC2STR(sta
->addr
), MAC2STR(bss
->bssid
));
200 static void rx_mgmt_assoc_req(struct wlantest
*wt
, const u8
*data
, size_t len
)
202 const struct ieee80211_mgmt
*mgmt
;
203 struct wlantest_bss
*bss
;
204 struct wlantest_sta
*sta
;
205 struct ieee802_11_elems elems
;
207 mgmt
= (const struct ieee80211_mgmt
*) data
;
208 bss
= bss_get(wt
, mgmt
->bssid
);
211 sta
= sta_get(bss
, mgmt
->sa
);
216 wpa_printf(MSG_INFO
, "Too short Association Request frame "
217 "from " MACSTR
, MAC2STR(mgmt
->sa
));
221 wpa_printf(MSG_DEBUG
, "ASSOCREQ " MACSTR
" -> " MACSTR
222 " (capab=0x%x listen_int=%u)",
223 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
),
224 le_to_host16(mgmt
->u
.assoc_req
.capab_info
),
225 le_to_host16(mgmt
->u
.assoc_req
.listen_interval
));
227 if (ieee802_11_parse_elems(mgmt
->u
.assoc_req
.variable
,
228 len
- (mgmt
->u
.assoc_req
.variable
- data
),
229 &elems
, 0) == ParseFailed
) {
230 wpa_printf(MSG_INFO
, "Invalid IEs in Association Request "
231 "frame from " MACSTR
, MAC2STR(mgmt
->sa
));
235 sta_update_assoc(sta
, &elems
);
239 static void rx_mgmt_assoc_resp(struct wlantest
*wt
, const u8
*data
, size_t len
)
241 const struct ieee80211_mgmt
*mgmt
;
242 struct wlantest_bss
*bss
;
243 struct wlantest_sta
*sta
;
244 u16 capab
, status
, aid
;
246 mgmt
= (const struct ieee80211_mgmt
*) data
;
247 bss
= bss_get(wt
, mgmt
->bssid
);
250 sta
= sta_get(bss
, mgmt
->da
);
255 wpa_printf(MSG_INFO
, "Too short Association Response frame "
256 "from " MACSTR
, MAC2STR(mgmt
->sa
));
260 capab
= le_to_host16(mgmt
->u
.assoc_resp
.capab_info
);
261 status
= le_to_host16(mgmt
->u
.assoc_resp
.status_code
);
262 aid
= le_to_host16(mgmt
->u
.assoc_resp
.aid
);
264 wpa_printf(MSG_DEBUG
, "ASSOCRESP " MACSTR
" -> " MACSTR
265 " (capab=0x%x status=%u aid=%u)",
266 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
), capab
, status
,
272 if ((aid
& 0xc000) != 0xc000) {
273 wpa_printf(MSG_DEBUG
, "Two MSBs of the AID were not set to 1 "
274 "in Association Response from " MACSTR
,
277 sta
->aid
= aid
& 0xc000;
279 if (sta
->state
< STATE2
) {
280 wpa_printf(MSG_DEBUG
, "STA " MACSTR
" was not in State 2 when "
281 "getting associated", MAC2STR(sta
->addr
));
284 if (sta
->state
< STATE3
) {
285 wpa_printf(MSG_DEBUG
, "STA " MACSTR
286 " moved to State 3 with " MACSTR
,
287 MAC2STR(sta
->addr
), MAC2STR(bss
->bssid
));
293 static void rx_mgmt_reassoc_req(struct wlantest
*wt
, const u8
*data
,
296 const struct ieee80211_mgmt
*mgmt
;
297 struct wlantest_bss
*bss
;
298 struct wlantest_sta
*sta
;
299 struct ieee802_11_elems elems
;
301 mgmt
= (const struct ieee80211_mgmt
*) data
;
302 bss
= bss_get(wt
, mgmt
->bssid
);
305 sta
= sta_get(bss
, mgmt
->sa
);
309 if (len
< 24 + 4 + ETH_ALEN
) {
310 wpa_printf(MSG_INFO
, "Too short Reassociation Request frame "
311 "from " MACSTR
, MAC2STR(mgmt
->sa
));
315 wpa_printf(MSG_DEBUG
, "REASSOCREQ " MACSTR
" -> " MACSTR
316 " (capab=0x%x listen_int=%u current_ap=" MACSTR
")",
317 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
),
318 le_to_host16(mgmt
->u
.reassoc_req
.capab_info
),
319 le_to_host16(mgmt
->u
.reassoc_req
.listen_interval
),
320 MAC2STR(mgmt
->u
.reassoc_req
.current_ap
));
322 if (ieee802_11_parse_elems(mgmt
->u
.reassoc_req
.variable
,
323 len
- (mgmt
->u
.reassoc_req
.variable
- data
),
324 &elems
, 0) == ParseFailed
) {
325 wpa_printf(MSG_INFO
, "Invalid IEs in Reassociation Request "
326 "frame from " MACSTR
, MAC2STR(mgmt
->sa
));
330 sta_update_assoc(sta
, &elems
);
334 static void rx_mgmt_reassoc_resp(struct wlantest
*wt
, const u8
*data
,
337 const struct ieee80211_mgmt
*mgmt
;
338 struct wlantest_bss
*bss
;
339 struct wlantest_sta
*sta
;
340 u16 capab
, status
, aid
;
342 mgmt
= (const struct ieee80211_mgmt
*) data
;
343 bss
= bss_get(wt
, mgmt
->bssid
);
346 sta
= sta_get(bss
, mgmt
->da
);
351 wpa_printf(MSG_INFO
, "Too short Reassociation Response frame "
352 "from " MACSTR
, MAC2STR(mgmt
->sa
));
356 capab
= le_to_host16(mgmt
->u
.reassoc_resp
.capab_info
);
357 status
= le_to_host16(mgmt
->u
.reassoc_resp
.status_code
);
358 aid
= le_to_host16(mgmt
->u
.reassoc_resp
.aid
);
360 wpa_printf(MSG_DEBUG
, "REASSOCRESP " MACSTR
" -> " MACSTR
361 " (capab=0x%x status=%u aid=%u)",
362 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
), capab
, status
,
368 if ((aid
& 0xc000) != 0xc000) {
369 wpa_printf(MSG_DEBUG
, "Two MSBs of the AID were not set to 1 "
370 "in Reassociation Response from " MACSTR
,
373 sta
->aid
= aid
& 0xc000;
375 if (sta
->state
< STATE2
) {
376 wpa_printf(MSG_DEBUG
, "STA " MACSTR
" was not in State 2 when "
377 "getting associated", MAC2STR(sta
->addr
));
380 if (sta
->state
< STATE3
) {
381 wpa_printf(MSG_DEBUG
, "STA " MACSTR
382 " moved to State 3 with " MACSTR
,
383 MAC2STR(sta
->addr
), MAC2STR(bss
->bssid
));
389 static void rx_mgmt_disassoc(struct wlantest
*wt
, const u8
*data
, size_t len
,
392 const struct ieee80211_mgmt
*mgmt
;
393 struct wlantest_bss
*bss
;
394 struct wlantest_sta
*sta
;
396 mgmt
= (const struct ieee80211_mgmt
*) data
;
397 bss
= bss_get(wt
, mgmt
->bssid
);
400 if (os_memcmp(mgmt
->sa
, mgmt
->bssid
, ETH_ALEN
) == 0)
401 sta
= sta_get(bss
, mgmt
->da
);
403 sta
= sta_get(bss
, mgmt
->sa
);
408 wpa_printf(MSG_INFO
, "Too short Disassociation frame from "
409 MACSTR
, MAC2STR(mgmt
->sa
));
413 wpa_printf(MSG_DEBUG
, "DISASSOC " MACSTR
" -> " MACSTR
415 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
),
416 le_to_host16(mgmt
->u
.disassoc
.reason_code
));
417 wpa_hexdump(MSG_MSGDUMP
, "DISASSOC payload", data
+ 24, len
- 24);
420 wpa_printf(MSG_INFO
, "Do not change STA " MACSTR
" State "
421 "since Disassociation frame was not protected "
422 "correctly", MAC2STR(sta
->addr
));
426 if (sta
->state
< STATE2
) {
427 wpa_printf(MSG_DEBUG
, "STA " MACSTR
" was not in State 2 or 3 "
428 "when getting disassociated", MAC2STR(sta
->addr
));
431 if (sta
->state
> STATE2
) {
432 wpa_printf(MSG_DEBUG
, "STA " MACSTR
433 " moved to State 2 with " MACSTR
,
434 MAC2STR(sta
->addr
), MAC2STR(bss
->bssid
));
440 static void rx_mgmt_action_sa_query(struct wlantest
*wt
,
441 struct wlantest_sta
*sta
,
442 const struct ieee80211_mgmt
*mgmt
,
448 if (len
< 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN
) {
449 wpa_printf(MSG_INFO
, "Too short SA Query frame from " MACSTR
,
454 if (len
> 24 + 2 + WLAN_SA_QUERY_TR_ID_LEN
) {
455 size_t elen
= len
- (24 + 2 + WLAN_SA_QUERY_TR_ID_LEN
);
456 wpa_printf(MSG_INFO
, "Unexpected %u octets of extra data at "
457 "the end of SA Query frame from " MACSTR
,
458 (unsigned) elen
, MAC2STR(mgmt
->sa
));
459 wpa_hexdump(MSG_INFO
, "SA Query extra data",
460 ((const u8
*) mgmt
) + len
- elen
, elen
);
463 switch (mgmt
->u
.action
.u
.sa_query_req
.action
) {
464 case WLAN_SA_QUERY_REQUEST
:
465 rx_id
= (const u8
*) mgmt
->u
.action
.u
.sa_query_req
.trans_id
;
466 if (os_memcmp(mgmt
->sa
, mgmt
->bssid
, ETH_ALEN
) == 0)
467 id
= sta
->ap_sa_query_tr
;
469 id
= sta
->sta_sa_query_tr
;
470 wpa_printf(MSG_INFO
, "SA Query Request " MACSTR
" -> " MACSTR
471 " (trans_id=%02x%02x)",
472 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
),
474 os_memcpy(id
, mgmt
->u
.action
.u
.sa_query_req
.trans_id
, 2);
476 case WLAN_SA_QUERY_RESPONSE
:
477 rx_id
= (const u8
*) mgmt
->u
.action
.u
.sa_query_resp
.trans_id
;
478 if (os_memcmp(mgmt
->sa
, mgmt
->bssid
, ETH_ALEN
) == 0)
479 id
= sta
->sta_sa_query_tr
;
481 id
= sta
->ap_sa_query_tr
;
482 wpa_printf(MSG_INFO
, "SA Query Response " MACSTR
" -> " MACSTR
483 " (trans_id=%02x%02x; %s)",
484 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
),
486 os_memcmp(rx_id
, id
, 2) == 0 ?
487 "match" : "mismatch");
490 wpa_printf(MSG_INFO
, "Unexpected SA Query action value %u "
492 mgmt
->u
.action
.u
.sa_query_req
.action
,
498 static void rx_mgmt_action(struct wlantest
*wt
, const u8
*data
, size_t len
)
500 const struct ieee80211_mgmt
*mgmt
;
501 struct wlantest_bss
*bss
;
502 struct wlantest_sta
*sta
;
504 mgmt
= (const struct ieee80211_mgmt
*) data
;
505 if (mgmt
->da
[0] & 0x01)
506 return; /* Ignore group addressed Action frames for now */
507 bss
= bss_get(wt
, mgmt
->bssid
);
510 if (os_memcmp(mgmt
->sa
, mgmt
->bssid
, ETH_ALEN
) == 0)
511 sta
= sta_get(bss
, mgmt
->da
);
513 sta
= sta_get(bss
, mgmt
->sa
);
518 wpa_printf(MSG_INFO
, "Too short Action frame from "
519 MACSTR
, MAC2STR(mgmt
->sa
));
523 wpa_printf(MSG_DEBUG
, "ACTION " MACSTR
" -> " MACSTR
525 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
),
526 mgmt
->u
.action
.category
);
527 wpa_hexdump(MSG_MSGDUMP
, "ACTION payload", data
+ 24, len
- 24);
529 if (mgmt
->u
.action
.category
!= WLAN_ACTION_PUBLIC
&&
530 sta
->state
< STATE3
) {
531 wpa_printf(MSG_INFO
, "Action frame sent when STA is not in "
532 "State 3 (SA=" MACSTR
" DATA=" MACSTR
")",
533 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
));
536 switch (mgmt
->u
.action
.category
) {
537 case WLAN_ACTION_SA_QUERY
:
538 rx_mgmt_action_sa_query(wt
, sta
, mgmt
, len
);
544 static int check_mmie_mic(const u8
*igtk
, const u8
*data
, size_t len
)
549 const struct ieee80211_hdr
*hdr
;
551 buf
= os_malloc(len
+ 20 - 24);
555 /* BIP AAD: FC(masked) A1 A2 A3 */
556 hdr
= (const struct ieee80211_hdr
*) data
;
557 fc
= le_to_host16(hdr
->frame_control
);
558 fc
&= ~(WLAN_FC_RETRY
| WLAN_FC_PWRMGT
| WLAN_FC_MOREDATA
);
559 WPA_PUT_LE16(buf
, fc
);
560 os_memcpy(buf
+ 2, hdr
->addr1
, 3 * ETH_ALEN
);
562 /* Frame body with MMIE MIC masked to zero */
563 os_memcpy(buf
+ 20, data
+ 24, len
- 24 - 8);
564 os_memset(buf
+ 20 + len
- 24 - 8, 0, 8);
566 wpa_hexdump(MSG_MSGDUMP
, "BIP: AAD|Body(masked)", buf
, len
+ 20 - 24);
567 /* MIC = L(AES-128-CMAC(AAD || Frame Body(masked)), 0, 64) */
568 if (omac1_aes_128(igtk
, buf
, len
+ 20 - 24, mic
) < 0) {
575 if (os_memcmp(data
+ len
- 8, mic
, 8) != 0)
582 static int check_bip(struct wlantest
*wt
, const u8
*data
, size_t len
)
584 const struct ieee80211_mgmt
*mgmt
;
588 struct wlantest_bss
*bss
;
590 mgmt
= (const struct ieee80211_mgmt
*) data
;
591 fc
= le_to_host16(mgmt
->frame_control
);
592 stype
= WLAN_FC_GET_STYPE(fc
);
594 if (stype
== WLAN_FC_STYPE_ACTION
) {
597 if (mgmt
->u
.action
.category
== WLAN_ACTION_PUBLIC
)
598 return 0; /* Not a robust management frame */
601 bss
= bss_get(wt
, mgmt
->bssid
);
603 return 0; /* No key known yet */
605 if (len
< 24 + 18 || data
[len
- 18] != WLAN_EID_MMIE
||
606 data
[len
- 17] != 16) {
608 /* TODO: use MFPC flag in RSN IE instead of IGTK flags */
609 if (bss
->igtk_set
[4] || bss
->igtk_set
[5]) {
610 wpa_printf(MSG_INFO
, "Robust group-addressed "
611 "management frame sent without BIP by "
612 MACSTR
, MAC2STR(mgmt
->sa
));
618 mmie
= data
+ len
- 16;
619 keyid
= WPA_GET_LE16(mmie
);
620 if (keyid
< 4 || keyid
> 5) {
621 wpa_printf(MSG_INFO
, "Unexpected MMIE KeyID %u from " MACSTR
,
622 keyid
, MAC2STR(mgmt
->sa
));
625 wpa_printf(MSG_DEBUG
, "MMIE KeyID %u", keyid
);
626 wpa_hexdump(MSG_MSGDUMP
, "MMIE IPN", mmie
+ 2, 6);
627 wpa_hexdump(MSG_MSGDUMP
, "MMIE MIC", mmie
+ 8, 8);
629 if (!bss
->igtk_set
[keyid
]) {
630 wpa_printf(MSG_DEBUG
, "No IGTK known to validate BIP frame");
634 if (os_memcmp(mmie
+ 2, bss
->ipn
[keyid
], 6) <= 0) {
635 wpa_printf(MSG_INFO
, "BIP replay detected: SA=" MACSTR
,
637 wpa_hexdump(MSG_INFO
, "RX IPN", mmie
+ 2, 6);
638 wpa_hexdump(MSG_INFO
, "Last RX IPN", bss
->ipn
[keyid
], 6);
641 if (check_mmie_mic(bss
->igtk
[keyid
], data
, len
) < 0) {
642 wpa_printf(MSG_INFO
, "Invalid MMIE MIC in a frame from "
643 MACSTR
, MAC2STR(mgmt
->sa
));
647 wpa_printf(MSG_DEBUG
, "Valid MMIE MIC");
648 os_memcpy(bss
->ipn
[keyid
], mmie
+ 2, 6);
654 static u8
* mgmt_ccmp_decrypt(struct wlantest
*wt
, const u8
*data
, size_t len
,
657 struct wlantest_bss
*bss
;
658 struct wlantest_sta
*sta
;
659 const struct ieee80211_hdr
*hdr
;
661 u8
*decrypted
, *frame
;
664 hdr
= (const struct ieee80211_hdr
*) data
;
665 bss
= bss_get(wt
, hdr
->addr3
);
668 if (os_memcmp(hdr
->addr1
, hdr
->addr3
, ETH_ALEN
) == 0)
669 sta
= sta_get(bss
, hdr
->addr2
);
671 sta
= sta_get(bss
, hdr
->addr1
);
672 if (sta
== NULL
|| !sta
->ptk_set
) {
673 wpa_printf(MSG_MSGDUMP
, "No PTK known to decrypt the frame");
677 keyid
= data
[3] >> 6;
679 wpa_printf(MSG_INFO
, "Unexpected non-zero KeyID %d in "
680 "individually addressed Management frame from "
681 MACSTR
, keyid
, MAC2STR(hdr
->addr2
));
684 if (os_memcmp(hdr
->addr1
, hdr
->addr3
, ETH_ALEN
) == 0)
685 rsc
= sta
->rsc_tods
[16];
687 rsc
= sta
->rsc_fromds
[16];
689 ccmp_get_pn(pn
, data
+ 24);
690 if (os_memcmp(pn
, rsc
, 6) <= 0) {
691 wpa_printf(MSG_INFO
, "CCMP/TKIP replay detected: SA=" MACSTR
,
692 MAC2STR(hdr
->addr2
));
693 wpa_hexdump(MSG_INFO
, "RX PN", pn
, 6);
694 wpa_hexdump(MSG_INFO
, "RSC", rsc
, 6);
697 decrypted
= ccmp_decrypt(sta
->ptk
.tk1
, hdr
, data
+ 24, len
- 24, dlen
);
699 os_memcpy(rsc
, pn
, 6);
701 frame
= os_malloc(24 + *dlen
);
703 os_memcpy(frame
, data
, 24);
704 os_memcpy(frame
+ 24, decrypted
, *dlen
);
714 void rx_mgmt(struct wlantest
*wt
, const u8
*data
, size_t len
)
716 const struct ieee80211_hdr
*hdr
;
719 u8
*decrypted
= NULL
;
725 hdr
= (const struct ieee80211_hdr
*) data
;
726 fc
= le_to_host16(hdr
->frame_control
);
728 stype
= WLAN_FC_GET_STYPE(fc
);
730 if ((hdr
->addr1
[0] & 0x01) &&
731 (stype
== WLAN_FC_STYPE_DEAUTH
||
732 stype
== WLAN_FC_STYPE_DISASSOC
||
733 stype
== WLAN_FC_STYPE_ACTION
))
734 check_bip(wt
, data
, len
);
736 wpa_printf((stype
== WLAN_FC_STYPE_BEACON
||
737 stype
== WLAN_FC_STYPE_PROBE_RESP
||
738 stype
== WLAN_FC_STYPE_PROBE_REQ
) ?
739 MSG_EXCESSIVE
: MSG_MSGDUMP
,
740 "MGMT %s%s%s DA=" MACSTR
" SA=" MACSTR
" BSSID=" MACSTR
,
742 fc
& WLAN_FC_PWRMGT
? " PwrMgt" : "",
743 fc
& WLAN_FC_ISWEP
? " Prot" : "",
744 MAC2STR(hdr
->addr1
), MAC2STR(hdr
->addr2
),
745 MAC2STR(hdr
->addr3
));
747 if ((fc
& WLAN_FC_ISWEP
) &&
748 !(hdr
->addr1
[0] & 0x01) &&
749 (stype
== WLAN_FC_STYPE_DEAUTH
||
750 stype
== WLAN_FC_STYPE_DISASSOC
||
751 stype
== WLAN_FC_STYPE_ACTION
)) {
752 decrypted
= mgmt_ccmp_decrypt(wt
, data
, len
, &dlen
);
754 write_pcap_decrypted(wt
, decrypted
, dlen
, NULL
, 0);
761 /* TODO: verify that robust management frames are protected if MFP was
765 case WLAN_FC_STYPE_BEACON
:
766 rx_mgmt_beacon(wt
, data
, len
);
768 case WLAN_FC_STYPE_PROBE_RESP
:
769 rx_mgmt_probe_resp(wt
, data
, len
);
771 case WLAN_FC_STYPE_AUTH
:
772 rx_mgmt_auth(wt
, data
, len
);
774 case WLAN_FC_STYPE_DEAUTH
:
775 rx_mgmt_deauth(wt
, data
, len
, valid
);
777 case WLAN_FC_STYPE_ASSOC_REQ
:
778 rx_mgmt_assoc_req(wt
, data
, len
);
780 case WLAN_FC_STYPE_ASSOC_RESP
:
781 rx_mgmt_assoc_resp(wt
, data
, len
);
783 case WLAN_FC_STYPE_REASSOC_REQ
:
784 rx_mgmt_reassoc_req(wt
, data
, len
);
786 case WLAN_FC_STYPE_REASSOC_RESP
:
787 rx_mgmt_reassoc_resp(wt
, data
, len
);
789 case WLAN_FC_STYPE_DISASSOC
:
790 rx_mgmt_disassoc(wt
, data
, len
, valid
);
792 case WLAN_FC_STYPE_ACTION
:
794 rx_mgmt_action(wt
, data
, len
);