From 20062114cdd1ae8a456642175430aaf6831352be Mon Sep 17 00:00:00 2001
From: Jouni Malinen <j@w1.fi>
Date: Sat, 13 Nov 2010 12:54:07 +0200
Subject: [PATCH] wlantest: Verify that TKIP/CCMP frames set ExtIV=1

---
 wlantest/rx_data.c | 16 ++++++++++++++++
 wlantest/rx_mgmt.c | 12 +++++++++++-
 2 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/wlantest/rx_data.c b/wlantest/rx_data.c
index ab0ab0f3f..24de59f00 100644
--- a/wlantest/rx_data.c
+++ b/wlantest/rx_data.c
@@ -971,6 +971,14 @@ static void rx_data_bss_prot_group(struct wlantest *wt,
 		return;
 	}
 
+	if (bss->group_cipher & (WPA_CIPHER_TKIP | WPA_CIPHER_CCMP) &&
+	    !(data[3] & 0x20)) {
+		    wpa_printf(MSG_INFO, "Expected TKIP/CCMP frame from "
+			       MACSTR " did not have ExtIV bit set to 1",
+			       MAC2STR(bss->bssid));
+		    return;
+	}
+
 	keyid = data[3] >> 6;
 	if (bss->gtk_len[keyid] == 0) {
 		wpa_printf(MSG_MSGDUMP, "No GTK known to decrypt the frame "
@@ -1046,6 +1054,14 @@ static void rx_data_bss_prot(struct wlantest *wt,
 		return;
 	}
 
+	if (sta->pairwise_cipher & (WPA_CIPHER_TKIP | WPA_CIPHER_CCMP) &&
+	    !(data[3] & 0x20)) {
+		    wpa_printf(MSG_INFO, "Expected TKIP/CCMP frame from "
+			       MACSTR " did not have ExtIV bit set to 1",
+			       MAC2STR(src));
+		    return;
+	}
+
 	keyid = data[3] >> 6;
 	if (keyid != 0) {
 		wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
diff --git a/wlantest/rx_mgmt.c b/wlantest/rx_mgmt.c
index 53a6396c8..d58c68574 100644
--- a/wlantest/rx_mgmt.c
+++ b/wlantest/rx_mgmt.c
@@ -676,7 +676,17 @@ static u8 * mgmt_ccmp_decrypt(struct wlantest *wt, const u8 *data, size_t len,
 		return NULL;
 	}
 
-	keyid = data[3] >> 6;
+	if (len < 24 + 4)
+		return NULL;
+
+	if (!(data[24 + 3] & 0x20)) {
+		wpa_printf(MSG_INFO, "Expected CCMP frame from " MACSTR
+			   " did not have ExtIV bit set to 1",
+			   MAC2STR(hdr->addr2));
+		return NULL;
+	}
+
+	keyid = data[24 + 3] >> 6;
 	if (keyid != 0) {
 		wpa_printf(MSG_INFO, "Unexpected non-zero KeyID %d in "
 			   "individually addressed Management frame from "