ieee80211: populate management BSSID and Capability Information - #1199
Open
mgonzalezlopezudc wants to merge 2 commits into
Open
mgonzalezlopezudc wants to merge 2 commits into
mgonzalezlopezudc wants to merge 2 commits into
Conversation
This was referenced Sep 15, 2026
mgonzalezlopezudc
force-pushed
the
fix/ieee80211-audit-management-frames
branch
2 times, most recently
from
September 16, 2026 09:18
1658874 to
05570e9
Compare
mgonzalezlopezudc
marked this pull request as ready for review
September 16, 2026 10:23
STA management frames built before association omitted Address3. Carry the procedure-selected BSSID in a typed request tag and honor it at MAC header construction, preserving the AP fallback and keeping receiver address distinct from BSSID. A real STA scan/authentication/association test checks management Address3 at the MAC boundary, including wildcard probes. All 30 infrastructure scenarios listed below change their ~tND fingerprints because STA management Address3 now contains the target or wildcard BSSID, with the corresponding computed FCS. Their tplx and ~tNl values are unchanged. Verified run 0 at the existing CSV time limits: showcases/visualizer/canvas/ieee80211 VisualizingHandover showcases/visualizer/canvas/networkpathactivity ChangingPaths showcases/visualizer/canvas/styling Annotation showcases/wireless/handover General examples/ipv6/mipv6 Handover tutorials/configurator Step8B examples/wireless/qos MacQosWithoutAggregation showcases/visualizer/canvas/packetdrop QueueOverflow showcases/visualizer/canvas/ieee80211 SignalLevels showcases/wireless/qos NonQos examples/dhcp WirelessDHCP examples/ipv6/mipv6 RouteOptimizationTwoCNs examples/wireless/handover General tutorials/configurator Step9 examples/wireless/qos MacQosWithRtsCts showcases/visualizer/canvas/ieee80211 OneNetwork showcases/visualizer/canvas/interfacetable AdvancedFeatures showcases/wireless/multiradio General showcases/wireless/qos Qos examples/dhcp Wireless2DHCP examples/ipv6/mipv6roaming Roaming examples/wireless/wiredandwirelesshostswithap General examples/wireless/qos MacQosWithBlockAck examples/wireless/qos MacNonQos showcases/visualizer/canvas/ieee80211 MultipleNetworks showcases/visualizer/canvas/physicallinkactivity Filtering examples/ipv6/pmipv6 General tutorials/configurator Step8A tutorials/configurator Step12 examples/wireless/qos MacQos Change: src.ieee80211.management | behavior.change.fix | test fingerprint | wifi-audit
Infrastructure Beacon and Probe Response builders left the modeled Capability field zero. Advertise ESS and the configured QoS capability. Association builders populate QoS while leaving their reserved ESS/IBSS bits clear, as required by the frame-role-specific capability rules. The focused module test checks generated Beacon and Probe Response objects and their serialized capability bytes for QoS-enabled and legacy APs. The association module test enters all four request/response generators with authenticated peers and checks typed fields and serialized capability bytes for both QoS settings, keeping reserved ESS/IBSS bits clear. Generic serializer defaults and raw-field round trips are preserved. All 30 infrastructure scenarios listed below change their ~tND fingerprints again because generated management frames now carry ESS and modeled QoS capability bits, with the corresponding computed FCS. Their tplx and ~tNl values are unchanged. These values reproduce the reported CI results. Verified run 0 at the existing CSV time limits: showcases/visualizer/canvas/ieee80211 VisualizingHandover showcases/visualizer/canvas/networkpathactivity ChangingPaths showcases/visualizer/canvas/styling Annotation showcases/wireless/handover General examples/ipv6/mipv6 Handover tutorials/configurator Step8B examples/wireless/qos MacQosWithoutAggregation showcases/visualizer/canvas/packetdrop QueueOverflow showcases/visualizer/canvas/ieee80211 SignalLevels showcases/wireless/qos NonQos examples/dhcp WirelessDHCP examples/ipv6/mipv6 RouteOptimizationTwoCNs examples/wireless/handover General tutorials/configurator Step9 examples/wireless/qos MacQosWithRtsCts showcases/visualizer/canvas/ieee80211 OneNetwork showcases/visualizer/canvas/interfacetable AdvancedFeatures showcases/wireless/multiradio General showcases/wireless/qos Qos examples/dhcp Wireless2DHCP examples/ipv6/mipv6roaming Roaming examples/wireless/wiredandwirelesshostswithap General examples/wireless/qos MacQosWithBlockAck examples/wireless/qos MacNonQos showcases/visualizer/canvas/ieee80211 MultipleNetworks showcases/visualizer/canvas/physicallinkactivity Filtering examples/ipv6/pmipv6 General tutorials/configurator Step8A tutorials/configurator Step12 examples/wireless/qos MacQos Change: src.ieee80211.management | behavior.change.fix | test fingerprint | wifi-audit
mgonzalezlopezudc
force-pushed
the
fix/ieee80211-audit-management-frames
branch
from
September 16, 2026 20:43
05570e9 to
a036c31
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
STA-originated management frames omitted Address3/BSSID, and generated infrastructure Beacons and Probe Responses advertised zero Capability Information. Carry the procedure’s BSSID through an explicit request tag and populate ESS and modeled QoS capability bits according to frame role.
Scope
STA management, MAC encapsulation, AP management, a WLAN BSSID request tag and capability constants. Read the BSSID commit first, then the Capability Information commit.
Standards references: IEEE 802.11-2024 §§9.3.3.1 and 9.4.1.4.
Dependencies and merge order
No prerequisite within this audit series. Merge this PR before the Action No Ack, Open System authentication and scan-completion PRs; they currently carry its BSSID prerequisite.
Validation
Pinned test base:
7287f347aaca36e557c708d6930a6f5a450b2833.Verified revised commits:
5d5286c372: target BSSID in STA management headers, including 30 intermediate fingerprint updates.05570e9c3e: generated management capabilities, including 30 final fingerprint updates.Both revised commits built in debug mode and passed all 30 affected fingerprint cases with
tplx,~tNl, and~tND, using run 0 and the existing CSV time limits. The base passed all 30 original expectations. All 30 final~tNDvalues reproduce the reported CI results exactly;tplxand~tNlremain unchanged at both commits. Additional individualopp_replchecks passed all three ingredients for OneNetwork at both revised commits.Fingerprint command, from
tests/fingerprintafter sourcingsetenv -q:Each explicit CSV contains only the 30 configurations listed below, with the corresponding commit's tracked expectations.
Focused module checks, from the repository root:
The BSSID test passed at the first source revision. A fresh debug build and all three focused module tests passed on the exact combined head
05570e9c3e4ca1cd717b807bb3545d75c9d1b16e. All 30 fingerprint cases also passed on this head. The follow-up adds only test coverage; production code and fingerprint baselines are unchanged.The new association capability test enters all four production association/reassociation request and response generators with seeded authenticated peers. It checks object fields and serialized bytes for QoS enabled and disabled, including clear ESS/IBSS bits. Removing each of the four capability assignments independently makes this test fail at the expected assertion. This is generator coverage, not a complete over-the-air reassociation handshake.
A matched OneNetwork/run 0 packet capture over the first second isolates the byte changes: the BSSID commit changes Address3 and FCS, and the capability commit changes Capability Information and FCS. All 25 captured frames retain matching times, subtypes and lengths across revisions. The first BSSID change is a Probe Request at 0.263510953s, from an all-zero to broadcast BSSID. The first capability change is a Beacon at 0.084206354s, from
0x0000to0x0001(ESS).Commit-message, classification and whitespace checks pass. Validation used debug builds with assertions enabled (
-O0 -Wall -g0); no release-build result is claimed.Fingerprint baselines
Each of these 30 configurations changes at both commits: the intermediate BSSID values belong to the first commit, and the final capability values belong to the second. Only
~tNDentries change, intests/fingerprint/examples.csv(13),showcases.csv(13), andtutorials.csv(4).examples/dhcpWirelessDHCP,Wireless2DHCPexamples/ipv6/mipv6Handover,RouteOptimizationTwoCNsexamples/ipv6/mipv6roamingRoamingexamples/ipv6/pmipv6Generalexamples/wireless/handoverGeneralexamples/wireless/qosMacQosWithoutAggregation,MacQosWithRtsCts,MacQosWithBlockAck,MacNonQos,MacQosexamples/wireless/wiredandwirelesshostswithapGeneralshowcases/visualizer/canvas/ieee80211VisualizingHandover,SignalLevels,OneNetwork,MultipleNetworksshowcases/visualizer/canvas/interfacetableAdvancedFeaturesshowcases/visualizer/canvas/networkpathactivityChangingPathsshowcases/visualizer/canvas/packetdropQueueOverflowshowcases/visualizer/canvas/physicallinkactivityFilteringshowcases/visualizer/canvas/stylingAnnotationshowcases/wireless/handoverGeneralshowcases/wireless/multiradioGeneralshowcases/wireless/qosNonQos,Qostutorials/configuratorStep8B,Step9,Step8A,Step12Limits and review status
ESS/IBSS remain reserved in association frames. Tests cover Beacon, Probe Response, and all four association/reassociation request and response generators. Complete reassociation handshakes and independent receiver/BSSID combinations remain outside this coverage.
Draft pending final independent review and reconciliation with current upstream. Live PR overlap has not been reverified against the pinned test base.