From bae93012cd52e872323edb0211b23d9cda4ba858 Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sun, 18 Dec 2016 12:23:02 +0200
Subject: [PATCH] tests: mac80211 and unknown Action frame rejection in STA
 mode

Signed-off-by: Jouni Malinen <j@w1.fi>
---
 tests/hwsim/test_kernel.py | 73 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 72 insertions(+), 1 deletion(-)

diff --git a/tests/hwsim/test_kernel.py b/tests/hwsim/test_kernel.py
index 793226298..f2b072300 100644
--- a/tests/hwsim/test_kernel.py
+++ b/tests/hwsim/test_kernel.py
@@ -1,4 +1,4 @@
-# Test a few kernel bugs
+# Test a few kernel bugs and functionality
 # Copyright (c) 2016, Intel Deutschland GmbH
 #
 # Author: Johannes Berg <johannes.berg@intel.com>
@@ -8,6 +8,10 @@
 
 import hostapd
 import binascii
+import os
+import struct
+from test_wnm import expect_ack
+from tshark import run_tshark
 
 def _test_kernel_bss_leak(dev, apdev, deauth):
     ssid = "test-bss-leak"
@@ -55,3 +59,70 @@ def test_kernel_bss_leak_deauth(dev, apdev):
 def test_kernel_bss_leak_timeout(dev, apdev):
     """cfg80211/mac80211 BSS leak on timeout"""
     return _test_kernel_bss_leak(dev, apdev, deauth=False)
+
+MGMT_SUBTYPE_ACTION = 13
+
+def expect_no_ack(hapd):
+    ev = hapd.wait_event(["MGMT-TX-STATUS"], timeout=5)
+    if ev is None:
+        raise Exception("Missing TX status")
+    if "ok=0" not in ev:
+        raise Exception("Action frame unexpectedly acknowledged")
+
+def test_kernel_unknown_action_frame_rejection_sta(dev, apdev, params):
+    """mac80211 and unknown Action frame rejection in STA mode"""
+    hapd = hostapd.add_ap(apdev[0], { "ssid": "unknown-action" })
+    dev[0].connect("unknown-action", key_mgmt="NONE", scan_freq="2412")
+    bssid = hapd.own_addr()
+    addr = dev[0].own_addr()
+
+    hapd.set("ext_mgmt_frame_handling", "1")
+
+    # Unicast Action frame with unknown category (response expected)
+    msg = {}
+    msg['fc'] = MGMT_SUBTYPE_ACTION << 4
+    msg['da'] = addr
+    msg['sa'] = bssid
+    msg['bssid'] = bssid
+    msg['payload'] = struct.pack("<BB", 0x70, 0)
+    hapd.mgmt_tx(msg)
+    expect_ack(hapd)
+
+    # Note: mac80211 does not allow group-addressed Action frames in unknown
+    # categories to be transmitted in AP mode, so for now, these steps are
+    # commented out.
+
+    # Multicast Action frame with unknown category (no response expected)
+    #msg['da'] = "01:ff:ff:ff:ff:ff"
+    #msg['payload'] = struct.pack("<BB", 0x71, 1)
+    #hapd.mgmt_tx(msg)
+    #expect_no_ack(hapd)
+
+    # Broadcast Action frame with unknown category (no response expected)
+    #msg['da'] = "ff:ff:ff:ff:ff:ff"
+    #msg['payload'] = struct.pack("<BB", 0x72, 2)
+    #hapd.mgmt_tx(msg)
+    #expect_no_ack(hapd)
+
+    # Unicast Action frame with error indication category (no response expected)
+    msg['da'] = addr
+    msg['payload'] = struct.pack("<BB", 0xf3, 3)
+    hapd.mgmt_tx(msg)
+    expect_ack(hapd)
+
+    # Unicast Action frame with unknown category (response expected)
+    msg['da'] = addr
+    msg['payload'] = struct.pack("<BB", 0x74, 4)
+    hapd.mgmt_tx(msg)
+    expect_ack(hapd)
+
+    out = run_tshark(os.path.join(params['logdir'], "hwsim0.pcapng"),
+                     "wlan.sa == %s && wlan.fc.type_subtype == 0x0d" % addr,
+                     display=["wlan_mgt.fixed.category_code"])
+    res = out.splitlines()
+    categ = [ int(x) for x in res ]
+
+    if 0xf2 in categ or 0xf3 in categ:
+        raise Exception("Unexpected Action frame rejection: " + str(categ))
+    if 0xf0 not in categ or 0xf4 not in categ:
+        raise Exception("Action frame rejection missing: " + str(categ))