MSCS: Process unsolciited MSCS Response frames

Align MSCS response handling as described in IEEE P802.11-REVme/D4.0,
11.25.3 (MSCS procedures):

AP may send unsolicited MSCS Response frame using dialog_token == 0.
Instead of dropping the frame due to dialog_token mismatch, accept
it and set the status accordingly.

Signed-off-by: Daniel Gabay <daniel.gabay@intel.com>

diff --git a/wpa_supplicant/robust_av.c b/wpa_supplicant/robust_av.c
index 993c2a47576eff076a57194322038fadcf97fd00..a3edf3bee80e691c563702afeb069b6c31df6193 100644 (file)
--- a/wpa_supplicant/robust_av.c
+++ b/wpa_supplicant/robust_av.c
@@ -740,7 +740,15 @@ void wpas_handle_robust_av_recv_action(struct wpa_supplicant *wpa_s,
 
        dialog_token = *buf++;
        len--;
-       if (dialog_token != wpa_s->robust_av.dialog_token) {
+
+       /* AP sets dialog token to 0 for unsolicited response */
+       if (!dialog_token && !wpa_s->mscs_setup_done) {
+               wpa_printf(MSG_INFO,
+                          "MSCS: Drop unsolicited received frame: inactive");
+               return;
+       }
+
+       if (dialog_token && dialog_token != wpa_s->robust_av.dialog_token) {
                wpa_printf(MSG_INFO,
                           "MSCS: Drop received frame due to dialog token mismatch: received:%u expected:%u",
                           dialog_token, wpa_s->robust_av.dialog_token);