Skip to content

ieee80211: populate management BSSID and Capability Information - #1199

Open
mgonzalezlopezudc wants to merge 2 commits into
inet-framework:masterfrom
mgonzalezlopezudc:fix/ieee80211-audit-management-frames
Open

mgonzalezlopezudc wants to merge 2 commits into
inet-framework:masterfrom
mgonzalezlopezudc:fix/ieee80211-audit-management-frames

Conversation

@mgonzalezlopezudc

@mgonzalezlopezudc mgonzalezlopezudc commented Sep 15, 2026

Copy link
Copy Markdown
Contributor

Summary

STA-originated management frames omitted Address3/BSSID, and generated infrastructure Beacons and Probe Responses advertised zero Capability Information. Carry the procedure’s BSSID through an explicit request tag and populate ESS and modeled QoS capability bits according to frame role.

Scope

STA management, MAC encapsulation, AP management, a WLAN BSSID request tag and capability constants. Read the BSSID commit first, then the Capability Information commit.

Standards references: IEEE 802.11-2024 §§9.3.3.1 and 9.4.1.4.

Dependencies and merge order

No prerequisite within this audit series. Merge this PR before the Action No Ack, Open System authentication and scan-completion PRs; they currently carry its BSSID prerequisite.

Validation

Pinned test base: 7287f347aaca36e557c708d6930a6f5a450b2833.

Verified revised commits:

  • 5d5286c372: target BSSID in STA management headers, including 30 intermediate fingerprint updates.
  • 05570e9c3e: generated management capabilities, including 30 final fingerprint updates.

Both revised commits built in debug mode and passed all 30 affected fingerprint cases with tplx, ~tNl, and ~tND, using run 0 and the existing CSV time limits. The base passed all 30 original expectations. All 30 final ~tND values reproduce the reported CI results exactly; tplx and ~tNl remain unchanged at both commits. Additional individual opp_repl checks passed all three ingredients for OneNetwork at both revised commits.

Fingerprint command, from tests/fingerprint after sourcing setenv -q:

./fingerprinttest -d -m '.' -f tplx -f '~tNl' -f '~tND' -t 4 /tmp/inet-pr1199-fingerprints/bssid-verified.csv
./fingerprinttest -d -m '.' -f tplx -f '~tNl' -f '~tND' -t 4 /tmp/inet-pr1199-fingerprints/head-verified.csv

Each explicit CSV contains only the 30 configurations listed below, with the corresponding commit's tracked expectations.

Focused module checks, from the repository root:

inet_run_module_tests -m debug -f 'Ieee80211StaMgmtBssid_1\.test'
inet_run_module_tests -m debug -f 'Ieee80211(StaMgmtBssid|MgmtCapabilities|AssociationCapabilities)_1\.test'

The BSSID test passed at the first source revision. A fresh debug build and all three focused module tests passed on the exact combined head 05570e9c3e4ca1cd717b807bb3545d75c9d1b16e. All 30 fingerprint cases also passed on this head. The follow-up adds only test coverage; production code and fingerprint baselines are unchanged.

The new association capability test enters all four production association/reassociation request and response generators with seeded authenticated peers. It checks object fields and serialized bytes for QoS enabled and disabled, including clear ESS/IBSS bits. Removing each of the four capability assignments independently makes this test fail at the expected assertion. This is generator coverage, not a complete over-the-air reassociation handshake.

A matched OneNetwork/run 0 packet capture over the first second isolates the byte changes: the BSSID commit changes Address3 and FCS, and the capability commit changes Capability Information and FCS. All 25 captured frames retain matching times, subtypes and lengths across revisions. The first BSSID change is a Probe Request at 0.263510953s, from an all-zero to broadcast BSSID. The first capability change is a Beacon at 0.084206354s, from 0x0000 to 0x0001 (ESS).

Commit-message, classification and whitespace checks pass. Validation used debug builds with assertions enabled (-O0 -Wall -g0); no release-build result is claimed.

Fingerprint baselines

Each of these 30 configurations changes at both commits: the intermediate BSSID values belong to the first commit, and the final capability values belong to the second. Only ~tND entries change, in tests/fingerprint/examples.csv (13), showcases.csv (13), and tutorials.csv (4).

Directory Configurations (run 0)
examples/dhcp WirelessDHCP, Wireless2DHCP
examples/ipv6/mipv6 Handover, RouteOptimizationTwoCNs
examples/ipv6/mipv6roaming Roaming
examples/ipv6/pmipv6 General
examples/wireless/handover General
examples/wireless/qos MacQosWithoutAggregation, MacQosWithRtsCts, MacQosWithBlockAck, MacNonQos, MacQos
examples/wireless/wiredandwirelesshostswithap General
showcases/visualizer/canvas/ieee80211 VisualizingHandover, SignalLevels, OneNetwork, MultipleNetworks
showcases/visualizer/canvas/interfacetable AdvancedFeatures
showcases/visualizer/canvas/networkpathactivity ChangingPaths
showcases/visualizer/canvas/packetdrop QueueOverflow
showcases/visualizer/canvas/physicallinkactivity Filtering
showcases/visualizer/canvas/styling Annotation
showcases/wireless/handover General
showcases/wireless/multiradio General
showcases/wireless/qos NonQos, Qos
tutorials/configurator Step8B, Step9, Step8A, Step12

Limits and review status

ESS/IBSS remain reserved in association frames. Tests cover Beacon, Probe Response, and all four association/reassociation request and response generators. Complete reassociation handshakes and independent receiver/BSSID combinations remain outside this coverage.

Draft pending final independent review and reconciliation with current upstream. Live PR overlap has not been reverified against the pinned test base.

STA management frames built before association omitted Address3. Carry the procedure-selected BSSID in a typed request tag and honor it at MAC header construction, preserving the AP fallback and keeping receiver address distinct from BSSID.

A real STA scan/authentication/association test checks management Address3 at the MAC boundary, including wildcard probes.

All 30 infrastructure scenarios listed below change their ~tND fingerprints
because STA management Address3 now contains the target or wildcard BSSID,
with the corresponding computed FCS. Their tplx and ~tNl values are unchanged.

Verified run 0 at the existing CSV time limits:
  showcases/visualizer/canvas/ieee80211 VisualizingHandover
  showcases/visualizer/canvas/networkpathactivity ChangingPaths
  showcases/visualizer/canvas/styling Annotation
  showcases/wireless/handover General
  examples/ipv6/mipv6 Handover
  tutorials/configurator Step8B
  examples/wireless/qos MacQosWithoutAggregation
  showcases/visualizer/canvas/packetdrop QueueOverflow
  showcases/visualizer/canvas/ieee80211 SignalLevels
  showcases/wireless/qos NonQos
  examples/dhcp WirelessDHCP
  examples/ipv6/mipv6 RouteOptimizationTwoCNs
  examples/wireless/handover General
  tutorials/configurator Step9
  examples/wireless/qos MacQosWithRtsCts
  showcases/visualizer/canvas/ieee80211 OneNetwork
  showcases/visualizer/canvas/interfacetable AdvancedFeatures
  showcases/wireless/multiradio General
  showcases/wireless/qos Qos
  examples/dhcp Wireless2DHCP
  examples/ipv6/mipv6roaming Roaming
  examples/wireless/wiredandwirelesshostswithap General
  examples/wireless/qos MacQosWithBlockAck
  examples/wireless/qos MacNonQos
  showcases/visualizer/canvas/ieee80211 MultipleNetworks
  showcases/visualizer/canvas/physicallinkactivity Filtering
  examples/ipv6/pmipv6 General
  tutorials/configurator Step8A
  tutorials/configurator Step12
  examples/wireless/qos MacQos

Change: src.ieee80211.management | behavior.change.fix | test fingerprint | wifi-audit
Infrastructure Beacon and Probe Response builders left the modeled Capability field zero. Advertise ESS and the configured QoS capability. Association builders populate QoS while leaving their reserved ESS/IBSS bits clear, as required by the frame-role-specific capability rules.

The focused module test checks generated Beacon and Probe Response objects and their serialized capability bytes for QoS-enabled and legacy APs. The association module test enters all four request/response generators with authenticated peers and checks typed fields and serialized capability bytes for both QoS settings, keeping reserved ESS/IBSS bits clear. Generic serializer defaults and raw-field round trips are preserved.

All 30 infrastructure scenarios listed below change their ~tND fingerprints
again because generated management frames now carry ESS and modeled QoS
capability bits, with the corresponding computed FCS. Their tplx and ~tNl
values are unchanged. These values reproduce the reported CI results.

Verified run 0 at the existing CSV time limits:
  showcases/visualizer/canvas/ieee80211 VisualizingHandover
  showcases/visualizer/canvas/networkpathactivity ChangingPaths
  showcases/visualizer/canvas/styling Annotation
  showcases/wireless/handover General
  examples/ipv6/mipv6 Handover
  tutorials/configurator Step8B
  examples/wireless/qos MacQosWithoutAggregation
  showcases/visualizer/canvas/packetdrop QueueOverflow
  showcases/visualizer/canvas/ieee80211 SignalLevels
  showcases/wireless/qos NonQos
  examples/dhcp WirelessDHCP
  examples/ipv6/mipv6 RouteOptimizationTwoCNs
  examples/wireless/handover General
  tutorials/configurator Step9
  examples/wireless/qos MacQosWithRtsCts
  showcases/visualizer/canvas/ieee80211 OneNetwork
  showcases/visualizer/canvas/interfacetable AdvancedFeatures
  showcases/wireless/multiradio General
  showcases/wireless/qos Qos
  examples/dhcp Wireless2DHCP
  examples/ipv6/mipv6roaming Roaming
  examples/wireless/wiredandwirelesshostswithap General
  examples/wireless/qos MacQosWithBlockAck
  examples/wireless/qos MacNonQos
  showcases/visualizer/canvas/ieee80211 MultipleNetworks
  showcases/visualizer/canvas/physicallinkactivity Filtering
  examples/ipv6/pmipv6 General
  tutorials/configurator Step8A
  tutorials/configurator Step12
  examples/wireless/qos MacQos

Change: src.ieee80211.management | behavior.change.fix | test fingerprint | wifi-audit
@mgonzalezlopezudc
mgonzalezlopezudc force-pushed the fix/ieee80211-audit-management-frames branch from 05570e9 to a036c31 Compare September 16, 2026 20:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant