802.11: fix header length when HT Control header is present

print-802_11.c

@@ -2108,10 +2108,16 @@ extract_header_length(netdissect_options *ndo,
 
 	switch (FC_TYPE(fc)) {
 	case T_MGMT:
-		return MGMT_HDRLEN;
+		len = MGMT_HDRLEN;
+		// HT Control field presence determined by +HTC bit
+		// (9.2.4.6 of IEEE 802.11-2020)
+		if (FC_ORDER(fc))
+			len += IEEE802_11_HT_CONTROL_LEN;
+		return len;
 	case T_CTRL:
 		switch (FC_SUBTYPE(fc)) {
 		case CTRL_CONTROL_WRAPPER:
+			// HT Control field included in length
 			return CTRL_CONTROL_WRAPPER_HDRLEN;
 		case CTRL_BAR:
 			return CTRL_BAR_HDRLEN;
@@ -2135,8 +2141,13 @@ extract_header_length(netdissect_options *ndo,
 		}
 	case T_DATA:
 		len = (FC_TO_DS(fc) && FC_FROM_DS(fc)) ? 30 : 24;
-		if (DATA_FRAME_IS_QOS(FC_SUBTYPE(fc)))
+		if (DATA_FRAME_IS_QOS(FC_SUBTYPE(fc))) {
 			len += 2;
+			// HT Control field presence determined by +HTC bit
+			// (9.2.4.6 of IEEE 802.11-2020)
+			if (FC_ORDER(fc))
+				len += IEEE802_11_HT_CONTROL_LEN;
+		}
 		return len;
 	default:
 		ND_PRINT("unknown 802.11 frame type (%u)", FC_TYPE(fc));
@@ -2168,7 +2179,7 @@ ieee_802_11_hdr_print(netdissect_options *ndo,
 		if (FC_RETRY(fc))
 			ND_PRINT("Retry ");
 		if (FC_ORDER(fc))
-			ND_PRINT("Strictly Ordered ");
+			ND_PRINT("+HTC ");
 		if (FC_PROTECTED(fc))
 			ND_PRINT("Protected ");
 		if (FC_TYPE(fc) != T_CTRL || FC_SUBTYPE(fc) != CTRL_PS_POLL)

tests/TESTLIST

@@ -336,6 +336,7 @@ scps_invalid	scps_invalid.pcap	scps_invalid.out
 802.11_exthdr	ieee802.11_exthdr.pcap	ieee802.11_exthdr.out	-v
 802.11_rx-stbc	ieee802.11_rx-stbc.pcap	ieee802.11_rx-stbc.out
 802.11_meshid	ieee802.11_meshid.pcap	ieee802.11_meshid.out
+802.11_htc 	ieee802.11_htc.pcap 	ieee802.11_htc.out 	-ve
 
 # OpenFlow tests
 of10_p3295-vv	of10_p3295.pcap		of10_p3295-vv.out	-vv

tests/ieee802.11_htc.out

@@ -0,0 +1,14 @@
+    1  2025-09-30 12:22:28.668829 967750278us tsft wep 5180 MHz 11a -45dBm signal -107dBm noise antenna 0 [bit 23] +HTC 48us CF +QoS BSSID:36:80:94:c0:22:8b SA:b0:be:83:5b:4b:40 DA:ff:ff:ff:ff:ff:ff LLC, dsap SNAP (0xaa) Individual, ssap SNAP (0xaa) Command, ctrl 0x03: oui Ethernet (0x000000), ethertype IPv4 (0x0800), length 328: (tos 0x0, ttl 255, id 23296, offset 0, flags [none], proto UDP (17), length 328)
+    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from b0:be:83:5b:4b:40, length 300, xid 0xf6afdddd, Flags [none]
+	  Client-Ethernet-Address b0:be:83:5b:4b:40
+	  Vendor-rfc1048 Extensions
+	    Magic Cookie 0x63825363
+	    DHCP-Message (53), length 1: Discover
+	    Parameter-Request (55), length 12: 
+	      Subnet-Mask (1), Classless-Static-Route (121), Default-Gateway (3), Domain-Name-Server (6)
+	      Domain-Name (15), IPv6-Only-Preferred (108), URL (114), Unknown (119)
+	      Unknown (252), LDAP (95), Netbios-Name-Server (44), Netbios-Node (46)
+	    MSZ (57), length 2: 1500
+	    Client-ID (61), length 7: ether b0:be:83:5b:4b:40
+	    Lease-Time (51), length 4: 7776000
+	    Hostname (12), length 15: "SebastiestMBP13"