Bugzilla – Bug 1080
Management frame from foreign AP can crash ns-3
Last modified: 2011-03-28 10:23:25 EDT
This bug was reported by Sergio Martínez Tornell http://mailman.isi.edu/pipermail/ns-developers/2011-March/008771.html I think I have found a bug in ApWifiMac. When an AP receive a Mgt packet from another AP, lets say a Beacon frame, it doesn't know how to handle it and drops this error: NS_FATAL_ERROR ("Don't know how to handle frame (type=" << hdr->GetType ()); //Type is five in case of MGT_BEACON I have fixed it by this patch: --- a/src/devices/wifi/ap-wifi-mac.cc Wed Jan 05 21:00:01 2011 -0800 +++ b/src/devices/wifi/ap-wifi-mac.cc Thu Mar 24 20:29:46 2011 +0100 @@ -530,6 +530,13 @@ return; } } + else if( from != GetAddress() && hdr->GetAddr1 () != GetAddress () ) + { + // this is an Mgt packet from another AP not for us + // we can ignore it. + NotifyRxDrop (packet); + return; + } }
Created attachment 1050 [details] non minimal testcase I kept the non wifi related code because I think this bug has a strong random component. The error appears around second 13.
I found this bug in Ns-3.10 (In reply to comment #0) > This bug was reported by Sergio Martínez Tornell > > http://mailman.isi.edu/pipermail/ns-developers/2011-March/008771.html > > I think I have found a bug in ApWifiMac. > > When an AP receive a Mgt packet from another AP, lets say a Beacon > frame, it doesn't know how to handle it and drops this error: > > NS_FATAL_ERROR ("Don't know how to handle frame (type=" << > hdr->GetType ()); //Type is five in case of MGT_BEACON > > I have fixed it by this patch: > > --- a/src/devices/wifi/ap-wifi-mac.cc Wed Jan 05 21:00:01 2011 -0800 > +++ b/src/devices/wifi/ap-wifi-mac.cc Thu Mar 24 20:29:46 2011 +0100 > @@ -530,6 +530,13 @@ > return; > } > } > + else if( from != GetAddress() && hdr->GetAddr1 () != GetAddress () ) > + { > + // this is an Mgt packet from another AP not for us > + // we can ignore it. > + NotifyRxDrop (packet); > + return; > + } > }
(In reply to comment #1) > Created attachment 1050 [details] > non minimal testcase > > I kept the non wifi related code because I think this bug has a strong random > component. The error appears around second 13. Thanks. I downloaded the ns-3.10 tarball, put your test case in scratch and ran it. Unfortunately, I cannot currently reproduce your bug. Which simulation seed and run have you been using? Which operating system are you using (32 bit or 64 bit)? R
(In reply to comment #3) > (In reply to comment #1) > > Created attachment 1050 [details] > > non minimal testcase > > > > I kept the non wifi related code because I think this bug has a strong random > > component. The error appears around second 13. > > Thanks. I downloaded the ns-3.10 tarball, put your test case in scratch and ran > it. Unfortunately, I cannot currently reproduce your bug. > > Which simulation seed and run have you been using? Which operating system are > you using (32 bit or 64 bit)? > > R I'm using a 64 bits OS. I will try to generate a minimal script along this week. This bug should appear every time an AP receive a beacon frame from another AP. The destination Address is Broadcast, so it match the condition to be forwarded to upper layers by lowest mac levels, then, since an AP cannot manage packets coming from another AP (WDS is not implemented as far as I know), it should be discarded by ApWifiMac.
Sergio, thanks for this bug report. I think this is a duplicate of bug 1069. I suggest to continue the discussion there. *** This bug has been marked as a duplicate of bug 1069 ***