Skip to content

Add 802.11 Radio Measurement action support#5039

Open
middleendian wants to merge 1 commit into
secdev:masterfrom
middleendian:dot11_radio_measurement
Open

Add 802.11 Radio Measurement action support#5039
middleendian wants to merge 1 commit into
secdev:masterfrom
middleendian:dot11_radio_measurement

Conversation

@middleendian

Copy link
Copy Markdown
Contributor

Dot11 Radio Measurement Action

Scope:

  • Adds Dot11RadioMeasurement for Action category 5.
  • Adds Radio Measurement Request and Report action bodies for actions 0
    and 1.
  • Specializes Beacon measurement request/report fields for Measurement Type
    5.
  • Leaves unsupported measurement types as raw
    measurement_request_data / measurement_report_data.
  • Adds focused dissection and raw round-trip tests for Beacon request,
    Beacon report, and unsupported measurement request fallback.

Spec references used in code comments:

  • IEEE Std 802.11-2020, 9.6.6.1: Radio Measurement Action field values.
  • IEEE Std 802.11-2020, 9.6.6.2: Radio Measurement Request frame.
  • IEEE Std 802.11-2020, 9.6.6.3: Radio Measurement Report frame.
  • IEEE Std 802.11-2020, 9.4.2.20: Measurement Request element.
  • IEEE Std 802.11-2020, 9.4.2.20.7: Beacon request.
  • IEEE Std 802.11-2020, 9.4.2.21: Measurement Report element.
  • IEEE Std 802.11-2020, 9.4.2.21.7: Beacon report.

Intentional partial support:

  • Only Beacon measurement type 5 is specialized in this PR.
  • Other measurement types are retained as raw bytes instead of being parsed
    with the wrong field layout.
  • The frame bodies parse one Measurement Request/Report element.

Test command used:

test/run_tests -t test/scapy/layers/dot11.uts -F

Result:

PASSED=68 FAILED=0

AI-Assisted: yes (Codex)

@codecov

codecov Bot commented Jul 7, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.22%. Comparing base (2498fbb) to head (94e7777).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5039      +/-   ##
==========================================
- Coverage   80.22%   80.22%   -0.01%     
==========================================
  Files         387      387              
  Lines       96450    96473      +23     
==========================================
+ Hits        77381    77395      +14     
- Misses      19069    19078       +9     
Files with missing lines Coverage Δ
scapy/layers/dot11.py 92.17% <100.00%> (+0.27%) ⬆️

... and 8 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds initial 802.11 Radio Measurement (Action category 5) dissection support to Scapy, focusing on Radio Measurement Request/Report actions and specializing Beacon measurement (type 5) while preserving raw bytes for unsupported measurement types.

Changes:

  • Introduces Dot11RadioMeasurement action layer plus Request/Report body layers, with Beacon request/report specializations.
  • Adds layer bindings for Action category 0x05 and actions 0 (request) / 1 (report).
  • Extends dot11.uts with dissection + raw round-trip tests for Beacon request/report and unsupported request fallback.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File Description
scapy/layers/dot11.py Adds Radio Measurement action/request/report packets, Beacon specializations, and layer bindings.
test/scapy/layers/dot11.uts Adds regression tests covering Beacon request/report dissection and raw fallback behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread scapy/layers/dot11.py
Comment on lines +2081 to +2082
def extract_padding(self, s):
return "", s
Comment thread scapy/layers/dot11.py
Comment on lines +2153 to +2154
def extract_padding(self, s):
return "", s
Comment thread scapy/layers/dot11.py
Comment on lines +2188 to +2200
ConditionalField(
StrLenField(
"measurement_report_data",
b"",
length_from=lambda p: max(p.len - 3, 0)
),
lambda p: (
p.measurement_report_type != 5 and
p.late == 0 and
p.incapable == 0 and
p.refused == 0
)
),
Comment thread scapy/layers/dot11.py
Comment on lines +2072 to +2079
fields_desc = [
ByteField("operating_class", 0),
ByteField("channel_number", 0),
LEShortField("randomization_interval", 0),
LEShortField("measurement_duration", 0),
ByteField("measurement_mode", 0),
MACField("BSSID", ETHER_ANY),
]
Comment on lines +795 to +810
= Dot11RadioMeasurementRequest - unsupported measurement type

data = b"\x05\x00\x01\x00\x00\x26\x05\x02\x00\x07\xaa\xbb"
pkt = Dot11Action(data)
assert Dot11RadioMeasurementRequest in pkt

req = pkt[Dot11RadioMeasurementRequest]
assert req.token == 1
assert req.repetitions == 0
assert req.ID == 38
assert req.len == 5
assert req.measurement_token == 2
assert req.measurement_request_type == 7
assert req.measurement_request_data == b"\xaa\xbb"
assert raw(pkt) == data

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants