?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Remove empty DragonFly CVS IDs.
[dragonfly.git] / sys / netproto / 802_11 / wlan / ieee80211_hostap.c
blob5da64a1ed5f2bcb777f53edf27db9665dc0711b2
1 /*-
2 * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 *
25 * $FreeBSD: head/sys/net80211/ieee80211_hostap.c 203422 2010-02-03 10:07:43Z rpaulo $
26 */
27
28 /*
29 * IEEE 802.11 HOSTAP mode support.
30 */
31 #include "opt_inet.h"
32 #include "opt_wlan.h"
33
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/mbuf.h>
37 #include <sys/malloc.h>
38 #include <sys/kernel.h>
39
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <sys/endian.h>
43 #include <sys/errno.h>
44 #include <sys/proc.h>
45 #include <sys/sysctl.h>
46
47 #include <net/if.h>
48 #include <net/if_media.h>
49 #include <net/if_llc.h>
50 #include <net/ethernet.h>
51 #include <net/route.h>
52
53 #include <net/bpf.h>
54
55 #include <netproto/802_11/ieee80211_var.h>
56 #include <netproto/802_11/ieee80211_hostap.h>
57 #include <netproto/802_11/ieee80211_input.h>
58 #ifdef IEEE80211_SUPPORT_SUPERG
59 #include <netproto/802_11/ieee80211_superg.h>
60 #endif
61 #include <netproto/802_11/ieee80211_wds.h>
62
63 #define IEEE80211_RATE2MBS(r) (((r) & IEEE80211_RATE_VAL) / 2)
64
65 static void hostap_vattach(struct ieee80211vap *);
66 static int hostap_newstate(struct ieee80211vap *, enum ieee80211_state, int);
67 static int hostap_input(struct ieee80211_node *ni, struct mbuf *m,
68 int rssi, int nf);
69 static void hostap_deliver_data(struct ieee80211vap *,
70 struct ieee80211_node *, struct mbuf *);
71 static void hostap_recv_mgmt(struct ieee80211_node *, struct mbuf *,
72 int subtype, int rssi, int nf);
73 static void hostap_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
74 static void hostap_recv_pspoll(struct ieee80211_node *, struct mbuf *);
75
76 void
77 ieee80211_hostap_attach(struct ieee80211com *ic)
78 {
79 ic->ic_vattach[IEEE80211_M_HOSTAP] = hostap_vattach;
80 }
81
82 void
83 ieee80211_hostap_detach(struct ieee80211com *ic)
84 {
85 }
86
87 static void
88 hostap_vdetach(struct ieee80211vap *vap)
89 {
90 }
91
92 static void
93 hostap_vattach(struct ieee80211vap *vap)
94 {
95 vap->iv_newstate = hostap_newstate;
96 vap->iv_input = hostap_input;
97 vap->iv_recv_mgmt = hostap_recv_mgmt;
98 vap->iv_recv_ctl = hostap_recv_ctl;
99 vap->iv_opdetach = hostap_vdetach;
100 vap->iv_deliver_data = hostap_deliver_data;
101 }
102
103 static void
104 sta_disassoc(void *arg, struct ieee80211_node *ni)
105 {
106 struct ieee80211vap *vap = arg;
107
108 if (ni->ni_vap == vap && ni->ni_associd != 0) {
109 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DISASSOC,
110 IEEE80211_REASON_ASSOC_LEAVE);
111 ieee80211_node_leave(ni);
112 }
113 }
114
115 static void
116 sta_csa(void *arg, struct ieee80211_node *ni)
117 {
118 struct ieee80211vap *vap = arg;
119
120 if (ni->ni_vap == vap && ni->ni_associd != 0)
121 if (ni->ni_inact > vap->iv_inact_init) {
122 ni->ni_inact = vap->iv_inact_init;
123 IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,
124 "%s: inact %u", __func__, ni->ni_inact);
125 }
126 }
127
128 static void
129 sta_drop(void *arg, struct ieee80211_node *ni)
130 {
131 struct ieee80211vap *vap = arg;
132
133 if (ni->ni_vap == vap && ni->ni_associd != 0)
134 ieee80211_node_leave(ni);
135 }
136
137 /*
138 * Does a channel change require associated stations to re-associate
139 * so protocol state is correct. This is used when doing CSA across
140 * bands or similar (e.g. HT -> legacy).
141 */
142 static int
143 isbandchange(struct ieee80211com *ic)
144 {
145 return ((ic->ic_bsschan->ic_flags ^ ic->ic_csa_newchan->ic_flags) &
146 (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_HALF |
147 IEEE80211_CHAN_QUARTER | IEEE80211_CHAN_HT)) != 0;
148 }
149
150 /*
151 * IEEE80211_M_HOSTAP vap state machine handler.
152 */
153 static int
154 hostap_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
155 {
156 struct ieee80211com *ic = vap->iv_ic;
157 enum ieee80211_state ostate;
158
159 ostate = vap->iv_state;
160 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
161 __func__, ieee80211_state_name[ostate],
162 ieee80211_state_name[nstate], arg);
163 vap->iv_state = nstate; /* state transition */
164 if (ostate != IEEE80211_S_SCAN)
165 ieee80211_cancel_scan(vap); /* background scan */
166 switch (nstate) {
167 case IEEE80211_S_INIT:
168 switch (ostate) {
169 case IEEE80211_S_SCAN:
170 ieee80211_cancel_scan(vap);
171 break;
172 case IEEE80211_S_CAC:
173 ieee80211_dfs_cac_stop(vap);
174 break;
175 case IEEE80211_S_RUN:
176 ieee80211_iterate_nodes(&ic->ic_sta, sta_disassoc, vap);
177 break;
178 default:
179 break;
180 }
181 if (ostate != IEEE80211_S_INIT) {
182 /* NB: optimize INIT -> INIT case */
183 ieee80211_reset_bss(vap);
184 }
185 if (vap->iv_auth->ia_detach != NULL)
186 vap->iv_auth->ia_detach(vap);
187 break;
188 case IEEE80211_S_SCAN:
189 switch (ostate) {
190 case IEEE80211_S_CSA:
191 case IEEE80211_S_RUN:
192 ieee80211_iterate_nodes(&ic->ic_sta, sta_disassoc, vap);
193 /*
194 * Clear overlapping BSS state; the beacon frame
195 * will be reconstructed on transition to the RUN
196 * state and the timeout routines check if the flag
197 * is set before doing anything so this is sufficient.
198 */
199 ic->ic_flags_ext &= ~IEEE80211_FEXT_NONERP_PR;
200 ic->ic_flags_ht &= ~IEEE80211_FHT_NONHT_PR;
201 /* fall thru... */
202 case IEEE80211_S_CAC:
203 /*
204 * NB: We may get here because of a manual channel
205 * change in which case we need to stop CAC
206 * XXX no need to stop if ostate RUN but it's ok
207 */
208 ieee80211_dfs_cac_stop(vap);
209 /* fall thru... */
210 case IEEE80211_S_INIT:
211 if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
212 !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
213 /*
214 * Already have a channel; bypass the
215 * scan and startup immediately.
216 * ieee80211_create_ibss will call back to
217 * move us to RUN state.
218 */
219 ieee80211_create_ibss(vap, vap->iv_des_chan);
220 break;
221 }
222 /*
223 * Initiate a scan. We can come here as a result
224 * of an IEEE80211_IOC_SCAN_REQ too in which case
225 * the vap will be marked with IEEE80211_FEXT_SCANREQ
226 * and the scan request parameters will be present
227 * in iv_scanreq. Otherwise we do the default.
228 */
229 if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
230 ieee80211_check_scan(vap,
231 vap->iv_scanreq_flags,
232 vap->iv_scanreq_duration,
233 vap->iv_scanreq_mindwell,
234 vap->iv_scanreq_maxdwell,
235 vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
236 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
237 } else
238 ieee80211_check_scan_current(vap);
239 break;
240 case IEEE80211_S_SCAN:
241 /*
242 * A state change requires a reset; scan.
243 */
244 ieee80211_check_scan_current(vap);
245 break;
246 default:
247 break;
248 }
249 break;
250 case IEEE80211_S_CAC:
251 /*
252 * Start CAC on a DFS channel. We come here when starting
253 * a bss on a DFS channel (see ieee80211_create_ibss).
254 */
255 ieee80211_dfs_cac_start(vap);
256 break;
257 case IEEE80211_S_RUN:
258 if (vap->iv_flags & IEEE80211_F_WPA) {
259 /* XXX validate prerequisites */
260 }
261 switch (ostate) {
262 case IEEE80211_S_INIT:
263 /*
264 * Already have a channel; bypass the
265 * scan and startup immediately.
266 * Note that ieee80211_create_ibss will call
267 * back to do a RUN->RUN state change.
268 */
269 ieee80211_create_ibss(vap,
270 ieee80211_ht_adjust_channel(ic,
271 ic->ic_curchan, vap->iv_flags_ht));
272 /* NB: iv_bss is changed on return */
273 break;
274 case IEEE80211_S_CAC:
275 /*
276 * NB: This is the normal state change when CAC
277 * expires and no radar was detected; no need to
278 * clear the CAC timer as it's already expired.
279 */
280 /* fall thru... */
281 case IEEE80211_S_CSA:
282 /*
283 * Shorten inactivity timer of associated stations
284 * to weed out sta's that don't follow a CSA.
285 */
286 ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
287 /*
288 * Update bss node channel to reflect where
289 * we landed after CSA.
290 */
291 ieee80211_node_set_chan(vap->iv_bss,
292 ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
293 ieee80211_htchanflags(vap->iv_bss->ni_chan)));
294 /* XXX bypass debug msgs */
295 break;
296 case IEEE80211_S_SCAN:
297 case IEEE80211_S_RUN:
298 #ifdef IEEE80211_DEBUG
299 if (ieee80211_msg_debug(vap)) {
300 struct ieee80211_node *ni = vap->iv_bss;
301 ieee80211_note(vap,
302 "synchronized with %6D ssid ",
303 ni->ni_bssid, ":");
304 ieee80211_print_essid(ni->ni_essid,
305 ni->ni_esslen);
306 /* XXX MCS/HT */
307 kprintf(" channel %d start %uMb\n",
308 ieee80211_chan2ieee(ic, ic->ic_curchan),
309 IEEE80211_RATE2MBS(ni->ni_txrate));
310 }
311 #endif
312 break;
313 default:
314 break;
315 }
316 /*
317 * Start/stop the authenticator. We delay until here
318 * to allow configuration to happen out of order.
319 */
320 if (vap->iv_auth->ia_attach != NULL) {
321 /* XXX check failure */
322 vap->iv_auth->ia_attach(vap);
323 } else if (vap->iv_auth->ia_detach != NULL) {
324 vap->iv_auth->ia_detach(vap);
325 }
326 ieee80211_node_authorize(vap->iv_bss);
327 break;
328 case IEEE80211_S_CSA:
329 if (ostate == IEEE80211_S_RUN && isbandchange(ic)) {
330 /*
331 * On a ``band change'' silently drop associated
332 * stations as they must re-associate before they
333 * can pass traffic (as otherwise protocol state
334 * such as capabilities and the negotiated rate
335 * set may/will be wrong).
336 */
337 ieee80211_iterate_nodes(&ic->ic_sta, sta_drop, vap);
338 }
339 break;
340 default:
341 break;
342 }
343 return 0;
344 }
345
346 static void
347 hostap_deliver_data(struct ieee80211vap *vap,
348 struct ieee80211_node *ni, struct mbuf *m)
349 {
350 struct ether_header *eh = mtod(m, struct ether_header *);
351 struct ifnet *ifp = vap->iv_ifp;
352
353 /* clear driver/net80211 flags before passing up */
354 m->m_flags &= ~(M_80211_RX | M_MCAST | M_BCAST);
355
356 KASSERT(vap->iv_opmode == IEEE80211_M_HOSTAP,
357 ("gack, opmode %d", vap->iv_opmode));
358 /*
359 * Do accounting.
360 */
361 ifp->if_ipackets++;
362 IEEE80211_NODE_STAT(ni, rx_data);
363 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
364 if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
365 m->m_flags |= M_MCAST; /* XXX M_BCAST? */
366 IEEE80211_NODE_STAT(ni, rx_mcast);
367 } else
368 IEEE80211_NODE_STAT(ni, rx_ucast);
369
370 /* perform as a bridge within the AP */
371 if ((vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0) {
372 struct mbuf *mcopy = NULL;
373
374 if (m->m_flags & M_MCAST) {
375 mcopy = m_dup(m, MB_DONTWAIT);
376 if (mcopy == NULL)
377 ifp->if_oerrors++;
378 else
379 mcopy->m_flags |= M_MCAST;
380 } else {
381 /*
382 * Check if the destination is associated with the
383 * same vap and authorized to receive traffic.
384 * Beware of traffic destined for the vap itself;
385 * sending it will not work; just let it be delivered
386 * normally.
387 */
388 struct ieee80211_node *sta = ieee80211_find_vap_node(
389 &vap->iv_ic->ic_sta, vap, eh->ether_dhost);
390 if (sta != NULL) {
391 if (ieee80211_node_is_authorized(sta)) {
392 /*
393 * Beware of sending to ourself; this
394 * needs to happen via the normal
395 * input path.
396 */
397 if (sta != vap->iv_bss) {
398 mcopy = m;
399 m = NULL;
400 }
401 } else {
402 vap->iv_stats.is_rx_unauth++;
403 IEEE80211_NODE_STAT(sta, rx_unauth);
404 }
405 ieee80211_free_node(sta);
406 }
407 }
408 if (mcopy != NULL) {
409 int len, err;
410 len = mcopy->m_pkthdr.len;
411 err = ieee80211_handoff(ifp, mcopy);
412 if (err) {
413 /* NB: IFQ_HANDOFF reclaims mcopy */
414 } else {
415 ifp->if_opackets++;
416 }
417 }
418 }
419 if (m != NULL) {
420 /*
421 * Mark frame as coming from vap's interface.
422 */
423 m->m_pkthdr.rcvif = ifp;
424 if (m->m_flags & M_MCAST) {
425 /*
426 * Spam DWDS vap's w/ multicast traffic.
427 */
428 /* XXX only if dwds in use? */
429 ieee80211_dwds_mcast(vap, m);
430 }
431 if (ni->ni_vlan != 0) {
432 /* attach vlan tag */
433 m->m_pkthdr.ether_vlantag = ni->ni_vlan;
434 m->m_flags |= M_VLANTAG;
435 }
436 ifp->if_input(ifp, m);
437 }
438 }
439
440 /*
441 * Decide if a received management frame should be
442 * printed when debugging is enabled. This filters some
443 * of the less interesting frames that come frequently
444 * (e.g. beacons).
445 */
446 static __inline int
447 doprint(struct ieee80211vap *vap, int subtype)
448 {
449 switch (subtype) {
450 case IEEE80211_FC0_SUBTYPE_BEACON:
451 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
452 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
453 return 0;
454 }
455 return 1;
456 }
457
458 /*
459 * Process a received frame. The node associated with the sender
460 * should be supplied. If nothing was found in the node table then
461 * the caller is assumed to supply a reference to iv_bss instead.
462 * The RSSI and a timestamp are also supplied. The RSSI data is used
463 * during AP scanning to select a AP to associate with; it can have
464 * any units so long as values have consistent units and higher values
465 * mean ``better signal''. The receive timestamp is currently not used
466 * by the 802.11 layer.
467 */
468 static int
469 hostap_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
470 {
471 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0)
472 #define HAS_SEQ(type) ((type & 0x4) == 0)
473 struct ieee80211vap *vap = ni->ni_vap;
474 struct ieee80211com *ic = ni->ni_ic;
475 struct ifnet *ifp = vap->iv_ifp;
476 struct ieee80211_frame *wh;
477 struct ieee80211_key *key;
478 struct ether_header *eh;
479 int hdrspace, need_tap = 1; /* mbuf need to be tapped. */
480 uint8_t dir, type, subtype, qos;
481 uint8_t *bssid;
482 uint16_t rxseq;
483
484 if (m->m_flags & M_AMPDU_MPDU) {
485 /*
486 * Fastpath for A-MPDU reorder q resubmission. Frames
487 * w/ M_AMPDU_MPDU marked have already passed through
488 * here but were received out of order and been held on
489 * the reorder queue. When resubmitted they are marked
490 * with the M_AMPDU_MPDU flag and we can bypass most of
491 * the normal processing.
492 */
493 wh = mtod(m, struct ieee80211_frame *);
494 type = IEEE80211_FC0_TYPE_DATA;
495 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
496 subtype = IEEE80211_FC0_SUBTYPE_QOS;
497 hdrspace = ieee80211_hdrspace(ic, wh); /* XXX optimize? */
498 goto resubmit_ampdu;
499 }
500
501 KASSERT(ni != NULL, ("null node"));
502 ni->ni_inact = ni->ni_inact_reload;
503
504 type = -1; /* undefined */
505
506 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
507 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
508 ni->ni_macaddr, NULL,
509 "too short (1): len %u", m->m_pkthdr.len);
510 vap->iv_stats.is_rx_tooshort++;
511 goto out;
512 }
513 /*
514 * Bit of a cheat here, we use a pointer for a 3-address
515 * frame format but don't reference fields past outside
516 * ieee80211_frame_min w/o first validating the data is
517 * present.
518 */
519 wh = mtod(m, struct ieee80211_frame *);
520
521 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
522 IEEE80211_FC0_VERSION_0) {
523 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
524 ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
525 wh->i_fc[0], wh->i_fc[1]);
526 vap->iv_stats.is_rx_badversion++;
527 goto err;
528 }
529
530 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
531 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
532 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
533 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
534 if (dir != IEEE80211_FC1_DIR_NODS)
535 bssid = wh->i_addr1;
536 else if (type == IEEE80211_FC0_TYPE_CTL)
537 bssid = wh->i_addr1;
538 else {
539 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
540 IEEE80211_DISCARD_MAC(vap,
541 IEEE80211_MSG_ANY, ni->ni_macaddr,
542 NULL, "too short (2): len %u",
543 m->m_pkthdr.len);
544 vap->iv_stats.is_rx_tooshort++;
545 goto out;
546 }
547 bssid = wh->i_addr3;
548 }
549 /*
550 * Validate the bssid.
551 */
552 if (!(type == IEEE80211_FC0_TYPE_MGT &&
553 subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
554 !IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
555 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
556 /* not interested in */
557 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
558 bssid, NULL, "%s", "not to bss");
559 vap->iv_stats.is_rx_wrongbss++;
560 goto out;
561 }
562
563 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
564 ni->ni_noise = nf;
565 if (HAS_SEQ(type)) {
566 uint8_t tid = ieee80211_gettid(wh);
567 if (IEEE80211_QOS_HAS_SEQ(wh) &&
568 TID_TO_WME_AC(tid) >= WME_AC_VI)
569 ic->ic_wme.wme_hipri_traffic++;
570 rxseq = le16toh(*(uint16_t *)wh->i_seq);
571 if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
572 (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
573 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
574 /* duplicate, discard */
575 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
576 bssid, "duplicate",
577 "seqno <%u,%u> fragno <%u,%u> tid %u",
578 rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
579 ni->ni_rxseqs[tid] >>
580 IEEE80211_SEQ_SEQ_SHIFT,
581 rxseq & IEEE80211_SEQ_FRAG_MASK,
582 ni->ni_rxseqs[tid] &
583 IEEE80211_SEQ_FRAG_MASK,
584 tid);
585 vap->iv_stats.is_rx_dup++;
586 IEEE80211_NODE_STAT(ni, rx_dup);
587 goto out;
588 }
589 ni->ni_rxseqs[tid] = rxseq;
590 }
591 }
592
593 switch (type) {
594 case IEEE80211_FC0_TYPE_DATA:
595 hdrspace = ieee80211_hdrspace(ic, wh);
596 if (m->m_len < hdrspace &&
597 (m = m_pullup(m, hdrspace)) == NULL) {
598 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
599 ni->ni_macaddr, NULL,
600 "data too short: expecting %u", hdrspace);
601 vap->iv_stats.is_rx_tooshort++;
602 goto out; /* XXX */
603 }
604 if (!(dir == IEEE80211_FC1_DIR_TODS ||
605 (dir == IEEE80211_FC1_DIR_DSTODS &&
606 (vap->iv_flags & IEEE80211_F_DWDS)))) {
607 if (dir != IEEE80211_FC1_DIR_DSTODS) {
608 IEEE80211_DISCARD(vap,
609 IEEE80211_MSG_INPUT, wh, "data",
610 "incorrect dir 0x%x", dir);
611 } else {
612 IEEE80211_DISCARD(vap,
613 IEEE80211_MSG_INPUT |
614 IEEE80211_MSG_WDS, wh,
615 "4-address data",
616 "%s", "DWDS not enabled");
617 }
618 vap->iv_stats.is_rx_wrongdir++;
619 goto out;
620 }
621 /* check if source STA is associated */
622 if (ni == vap->iv_bss) {
623 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
624 wh, "data", "%s", "unknown src");
625 ieee80211_send_error(ni, wh->i_addr2,
626 IEEE80211_FC0_SUBTYPE_DEAUTH,
627 IEEE80211_REASON_NOT_AUTHED);
628 vap->iv_stats.is_rx_notassoc++;
629 goto err;
630 }
631 if (ni->ni_associd == 0) {
632 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
633 wh, "data", "%s", "unassoc src");
634 IEEE80211_SEND_MGMT(ni,
635 IEEE80211_FC0_SUBTYPE_DISASSOC,
636 IEEE80211_REASON_NOT_ASSOCED);
637 vap->iv_stats.is_rx_notassoc++;
638 goto err;
639 }
640
641 /*
642 * Check for power save state change.
643 * XXX out-of-order A-MPDU frames?
644 */
645 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
646 (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
647 ieee80211_node_pwrsave(ni,
648 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
649 /*
650 * For 4-address packets handle WDS discovery
651 * notifications. Once a WDS link is setup frames
652 * are just delivered to the WDS vap (see below).
653 */
654 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap == NULL) {
655 if (!ieee80211_node_is_authorized(ni)) {
656 IEEE80211_DISCARD(vap,
657 IEEE80211_MSG_INPUT |
658 IEEE80211_MSG_WDS, wh,
659 "4-address data",
660 "%s", "unauthorized port");
661 vap->iv_stats.is_rx_unauth++;
662 IEEE80211_NODE_STAT(ni, rx_unauth);
663 goto err;
664 }
665 ieee80211_dwds_discover(ni, m);
666 return type;
667 }
668
669 /*
670 * Handle A-MPDU re-ordering. If the frame is to be
671 * processed directly then ieee80211_ampdu_reorder
672 * will return 0; otherwise it has consumed the mbuf
673 * and we should do nothing more with it.
674 */
675 if ((m->m_flags & M_AMPDU) &&
676 ieee80211_ampdu_reorder(ni, m) != 0) {
677 m = NULL;
678 goto out;
679 }
680 resubmit_ampdu:
681
682 /*
683 * Handle privacy requirements. Note that we
684 * must not be preempted from here until after
685 * we (potentially) call ieee80211_crypto_demic;
686 * otherwise we may violate assumptions in the
687 * crypto cipher modules used to do delayed update
688 * of replay sequence numbers.
689 */
690 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
691 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
692 /*
693 * Discard encrypted frames when privacy is off.
694 */
695 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
696 wh, "WEP", "%s", "PRIVACY off");
697 vap->iv_stats.is_rx_noprivacy++;
698 IEEE80211_NODE_STAT(ni, rx_noprivacy);
699 goto out;
700 }
701 key = ieee80211_crypto_decap(ni, m, hdrspace);
702 if (key == NULL) {
703 /* NB: stats+msgs handled in crypto_decap */
704 IEEE80211_NODE_STAT(ni, rx_wepfail);
705 goto out;
706 }
707 wh = mtod(m, struct ieee80211_frame *);
708 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
709 } else {
710 /* XXX M_WEP and IEEE80211_F_PRIVACY */
711 key = NULL;
712 }
713
714 /*
715 * Save QoS bits for use below--before we strip the header.
716 */
717 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
718 qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
719 ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
720 ((struct ieee80211_qosframe *)wh)->i_qos[0];
721 } else
722 qos = 0;
723
724 /*
725 * Next up, any fragmentation.
726 */
727 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
728 m = ieee80211_defrag(ni, m, hdrspace);
729 if (m == NULL) {
730 /* Fragment dropped or frame not complete yet */
731 goto out;
732 }
733 }
734 wh = NULL; /* no longer valid, catch any uses */
735
736 /*
737 * Next strip any MSDU crypto bits.
738 */
739 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
740 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
741 ni->ni_macaddr, "data", "%s", "demic error");
742 vap->iv_stats.is_rx_demicfail++;
743 IEEE80211_NODE_STAT(ni, rx_demicfail);
744 goto out;
745 }
746 /* copy to listener after decrypt */
747 if (ieee80211_radiotap_active_vap(vap))
748 ieee80211_radiotap_rx(vap, m);
749 need_tap = 0;
750 /*
751 * Finally, strip the 802.11 header.
752 */
753 m = ieee80211_decap(vap, m, hdrspace);
754 if (m == NULL) {
755 /* XXX mask bit to check for both */
756 /* don't count Null data frames as errors */
757 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
758 subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
759 goto out;
760 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
761 ni->ni_macaddr, "data", "%s", "decap error");
762 vap->iv_stats.is_rx_decap++;
763 IEEE80211_NODE_STAT(ni, rx_decap);
764 goto err;
765 }
766 eh = mtod(m, struct ether_header *);
767 if (!ieee80211_node_is_authorized(ni)) {
768 /*
769 * Deny any non-PAE frames received prior to
770 * authorization. For open/shared-key
771 * authentication the port is mark authorized
772 * after authentication completes. For 802.1x
773 * the port is not marked authorized by the
774 * authenticator until the handshake has completed.
775 */
776 if (eh->ether_type != htons(ETHERTYPE_PAE)) {
777 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
778 eh->ether_shost, "data",
779 "unauthorized port: ether type 0x%x len %u",
780 eh->ether_type, m->m_pkthdr.len);
781 vap->iv_stats.is_rx_unauth++;
782 IEEE80211_NODE_STAT(ni, rx_unauth);
783 goto err;
784 }
785 } else {
786 /*
787 * When denying unencrypted frames, discard
788 * any non-PAE frames received without encryption.
789 */
790 if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
791 (key == NULL && (m->m_flags & M_WEP) == 0) &&
792 eh->ether_type != htons(ETHERTYPE_PAE)) {
793 /*
794 * Drop unencrypted frames.
795 */
796 vap->iv_stats.is_rx_unencrypted++;
797 IEEE80211_NODE_STAT(ni, rx_unencrypted);
798 goto out;
799 }
800 }
801 /* XXX require HT? */
802 if (qos & IEEE80211_QOS_AMSDU) {
803 m = ieee80211_decap_amsdu(ni, m);
804 if (m == NULL)
805 return IEEE80211_FC0_TYPE_DATA;
806 } else {
807 #ifdef IEEE80211_SUPPORT_SUPERG
808 m = ieee80211_decap_fastframe(vap, ni, m);
809 if (m == NULL)
810 return IEEE80211_FC0_TYPE_DATA;
811 #endif
812 }
813 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
814 ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
815 else
816 hostap_deliver_data(vap, ni, m);
817 return IEEE80211_FC0_TYPE_DATA;
818
819 case IEEE80211_FC0_TYPE_MGT:
820 vap->iv_stats.is_rx_mgmt++;
821 IEEE80211_NODE_STAT(ni, rx_mgmt);
822 if (dir != IEEE80211_FC1_DIR_NODS) {
823 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
824 wh, "mgt", "incorrect dir 0x%x", dir);
825 vap->iv_stats.is_rx_wrongdir++;
826 goto err;
827 }
828 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
829 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
830 ni->ni_macaddr, "mgt", "too short: len %u",
831 m->m_pkthdr.len);
832 vap->iv_stats.is_rx_tooshort++;
833 goto out;
834 }
835 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
836 /* ensure return frames are unicast */
837 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
838 wh, NULL, "source is multicast: %6D",
839 wh->i_addr2, ":");
840 vap->iv_stats.is_rx_mgtdiscard++; /* XXX stat */
841 goto out;
842 }
843 #ifdef IEEE80211_DEBUG
844 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
845 ieee80211_msg_dumppkts(vap)) {
846 if_printf(ifp, "received %s from %6D rssi %d\n",
847 ieee80211_mgt_subtype_name[subtype >>
848 IEEE80211_FC0_SUBTYPE_SHIFT],
849 wh->i_addr2, ":", rssi);
850 }
851 #endif
852 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
853 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
854 /*
855 * Only shared key auth frames with a challenge
856 * should be encrypted, discard all others.
857 */
858 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
859 wh, NULL,
860 "%s", "WEP set but not permitted");
861 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
862 goto out;
863 }
864 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
865 /*
866 * Discard encrypted frames when privacy is off.
867 */
868 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
869 wh, NULL, "%s", "WEP set but PRIVACY off");
870 vap->iv_stats.is_rx_noprivacy++;
871 goto out;
872 }
873 hdrspace = ieee80211_hdrspace(ic, wh);
874 key = ieee80211_crypto_decap(ni, m, hdrspace);
875 if (key == NULL) {
876 /* NB: stats+msgs handled in crypto_decap */
877 goto out;
878 }
879 wh = mtod(m, struct ieee80211_frame *);
880 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
881 }
882 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
883 goto out;
884
885 case IEEE80211_FC0_TYPE_CTL:
886 vap->iv_stats.is_rx_ctl++;
887 IEEE80211_NODE_STAT(ni, rx_ctrl);
888 vap->iv_recv_ctl(ni, m, subtype);
889 goto out;
890 default:
891 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
892 wh, "bad", "frame type 0x%x", type);
893 /* should not come here */
894 break;
895 }
896 err:
897 ifp->if_ierrors++;
898 out:
899 if (m != NULL) {
900 if (need_tap && ieee80211_radiotap_active_vap(vap))
901 ieee80211_radiotap_rx(vap, m);
902 m_freem(m);
903 }
904 return type;
905 #undef SEQ_LEQ
906 }
907
908 static void
909 hostap_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
910 int rssi, int nf, uint16_t seq, uint16_t status)
911 {
912 struct ieee80211vap *vap = ni->ni_vap;
913
914 KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
915
916 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
917 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
918 ni->ni_macaddr, "open auth",
919 "bad sta auth mode %u", ni->ni_authmode);
920 vap->iv_stats.is_rx_bad_auth++; /* XXX */
921 /*
922 * Clear any challenge text that may be there if
923 * a previous shared key auth failed and then an
924 * open auth is attempted.
925 */
926 if (ni->ni_challenge != NULL) {
927 kfree(ni->ni_challenge, M_80211_NODE);
928 ni->ni_challenge = NULL;
929 }
930 /* XXX hack to workaround calling convention */
931 ieee80211_send_error(ni, wh->i_addr2,
932 IEEE80211_FC0_SUBTYPE_AUTH,
933 (seq + 1) | (IEEE80211_STATUS_ALG<<16));
934 return;
935 }
936 if (seq != IEEE80211_AUTH_OPEN_REQUEST) {
937 vap->iv_stats.is_rx_bad_auth++;
938 return;
939 }
940 /* always accept open authentication requests */
941 if (ni == vap->iv_bss) {
942 ni = ieee80211_dup_bss(vap, wh->i_addr2);
943 if (ni == NULL)
944 return;
945 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
946 (void) ieee80211_ref_node(ni);
947 /*
948 * Mark the node as referenced to reflect that it's
949 * reference count has been bumped to insure it remains
950 * after the transaction completes.
951 */
952 ni->ni_flags |= IEEE80211_NODE_AREF;
953 /*
954 * Mark the node as requiring a valid association id
955 * before outbound traffic is permitted.
956 */
957 ni->ni_flags |= IEEE80211_NODE_ASSOCID;
958
959 if (vap->iv_acl != NULL &&
960 vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
961 /*
962 * When the ACL policy is set to RADIUS we defer the
963 * authorization to a user agent. Dispatch an event,
964 * a subsequent MLME call will decide the fate of the
965 * station. If the user agent is not present then the
966 * node will be reclaimed due to inactivity.
967 */
968 IEEE80211_NOTE_MAC(vap,
969 IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL, ni->ni_macaddr,
970 "%s", "station authentication defered (radius acl)");
971 ieee80211_notify_node_auth(ni);
972 } else {
973 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
974 IEEE80211_NOTE_MAC(vap,
975 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni->ni_macaddr,
976 "%s", "station authenticated (open)");
977 /*
978 * When 802.1x is not in use mark the port
979 * authorized at this point so traffic can flow.
980 */
981 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
982 ieee80211_node_authorize(ni);
983 }
984 }
985
986 static void
987 hostap_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
988 uint8_t *frm, uint8_t *efrm, int rssi, int nf,
989 uint16_t seq, uint16_t status)
990 {
991 struct ieee80211vap *vap = ni->ni_vap;
992 uint8_t *challenge;
993 int allocbs, estatus;
994
995 KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
996
997 /*
998 * NB: this can happen as we allow pre-shared key
999 * authentication to be enabled w/o wep being turned
1000 * on so that configuration of these can be done
1001 * in any order. It may be better to enforce the
1002 * ordering in which case this check would just be
1003 * for sanity/consistency.
1004 */
1005 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
1006 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1007 ni->ni_macaddr, "shared key auth",
1008 "%s", " PRIVACY is disabled");
1009 estatus = IEEE80211_STATUS_ALG;
1010 goto bad;
1011 }
1012 /*
1013 * Pre-shared key authentication is evil; accept
1014 * it only if explicitly configured (it is supported
1015 * mainly for compatibility with clients like Mac OS X).
1016 */
1017 if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1018 ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1019 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1020 ni->ni_macaddr, "shared key auth",
1021 "bad sta auth mode %u", ni->ni_authmode);
1022 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1023 estatus = IEEE80211_STATUS_ALG;
1024 goto bad;
1025 }
1026
1027 challenge = NULL;
1028 if (frm + 1 < efrm) {
1029 if ((frm[1] + 2) > (efrm - frm)) {
1030 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1031 ni->ni_macaddr, "shared key auth",
1032 "ie %d/%d too long",
1033 frm[0], (int)((frm[1] + 2) - (efrm - frm)));
1034 vap->iv_stats.is_rx_bad_auth++;
1035 estatus = IEEE80211_STATUS_CHALLENGE;
1036 goto bad;
1037 }
1038 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1039 challenge = frm;
1040 frm += frm[1] + 2;
1041 }
1042 switch (seq) {
1043 case IEEE80211_AUTH_SHARED_CHALLENGE:
1044 case IEEE80211_AUTH_SHARED_RESPONSE:
1045 if (challenge == NULL) {
1046 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1047 ni->ni_macaddr, "shared key auth",
1048 "%s", "no challenge");
1049 vap->iv_stats.is_rx_bad_auth++;
1050 estatus = IEEE80211_STATUS_CHALLENGE;
1051 goto bad;
1052 }
1053 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1054 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1055 ni->ni_macaddr, "shared key auth",
1056 "bad challenge len %d", challenge[1]);
1057 vap->iv_stats.is_rx_bad_auth++;
1058 estatus = IEEE80211_STATUS_CHALLENGE;
1059 goto bad;
1060 }
1061 default:
1062 break;
1063 }
1064 switch (seq) {
1065 case IEEE80211_AUTH_SHARED_REQUEST:
1066 if (ni == vap->iv_bss) {
1067 ni = ieee80211_dup_bss(vap, wh->i_addr2);
1068 if (ni == NULL) {
1069 /* NB: no way to return an error */
1070 return;
1071 }
1072 allocbs = 1;
1073 } else {
1074 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1075 (void) ieee80211_ref_node(ni);
1076 allocbs = 0;
1077 }
1078 /*
1079 * Mark the node as referenced to reflect that it's
1080 * reference count has been bumped to insure it remains
1081 * after the transaction completes.
1082 */
1083 ni->ni_flags |= IEEE80211_NODE_AREF;
1084 /*
1085 * Mark the node as requiring a valid associatio id
1086 * before outbound traffic is permitted.
1087 */
1088 ni->ni_flags |= IEEE80211_NODE_ASSOCID;
1089 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1090 ni->ni_noise = nf;
1091 if (!ieee80211_alloc_challenge(ni)) {
1092 /* NB: don't return error so they rexmit */
1093 return;
1094 }
1095 get_random_bytes(ni->ni_challenge,
1096 IEEE80211_CHALLENGE_LEN);
1097 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1098 ni, "shared key %sauth request", allocbs ? "" : "re");
1099 /*
1100 * When the ACL policy is set to RADIUS we defer the
1101 * authorization to a user agent. Dispatch an event,
1102 * a subsequent MLME call will decide the fate of the
1103 * station. If the user agent is not present then the
1104 * node will be reclaimed due to inactivity.
1105 */
1106 if (vap->iv_acl != NULL &&
1107 vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
1108 IEEE80211_NOTE_MAC(vap,
1109 IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL,
1110 ni->ni_macaddr,
1111 "%s", "station authentication defered (radius acl)");
1112 ieee80211_notify_node_auth(ni);
1113 return;
1114 }
1115 break;
1116 case IEEE80211_AUTH_SHARED_RESPONSE:
1117 if (ni == vap->iv_bss) {
1118 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1119 ni->ni_macaddr, "shared key response",
1120 "%s", "unknown station");
1121 /* NB: don't send a response */
1122 return;
1123 }
1124 if (ni->ni_challenge == NULL) {
1125 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1126 ni->ni_macaddr, "shared key response",
1127 "%s", "no challenge recorded");
1128 vap->iv_stats.is_rx_bad_auth++;
1129 estatus = IEEE80211_STATUS_CHALLENGE;
1130 goto bad;
1131 }
1132 if (memcmp(ni->ni_challenge, &challenge[2],
1133 challenge[1]) != 0) {
1134 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1135 ni->ni_macaddr, "shared key response",
1136 "%s", "challenge mismatch");
1137 vap->iv_stats.is_rx_auth_fail++;
1138 estatus = IEEE80211_STATUS_CHALLENGE;
1139 goto bad;
1140 }
1141 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1142 ni, "%s", "station authenticated (shared key)");
1143 ieee80211_node_authorize(ni);
1144 break;
1145 default:
1146 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1147 ni->ni_macaddr, "shared key auth",
1148 "bad seq %d", seq);
1149 vap->iv_stats.is_rx_bad_auth++;
1150 estatus = IEEE80211_STATUS_SEQUENCE;
1151 goto bad;
1152 }
1153 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1154 return;
1155 bad:
1156 /*
1157 * Send an error response; but only when operating as an AP.
1158 */
1159 /* XXX hack to workaround calling convention */
1160 ieee80211_send_error(ni, wh->i_addr2,
1161 IEEE80211_FC0_SUBTYPE_AUTH,
1162 (seq + 1) | (estatus<<16));
1163 }
1164
1165 /*
1166 * Convert a WPA cipher selector OUI to an internal
1167 * cipher algorithm. Where appropriate we also
1168 * record any key length.
1169 */
1170 static int
1171 wpa_cipher(const uint8_t *sel, uint8_t *keylen)
1172 {
1173 #define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1174 uint32_t w = LE_READ_4(sel);
1175
1176 switch (w) {
1177 case WPA_SEL(WPA_CSE_NULL):
1178 return IEEE80211_CIPHER_NONE;
1179 case WPA_SEL(WPA_CSE_WEP40):
1180 if (keylen)
1181 *keylen = 40 / NBBY;
1182 return IEEE80211_CIPHER_WEP;
1183 case WPA_SEL(WPA_CSE_WEP104):
1184 if (keylen)
1185 *keylen = 104 / NBBY;
1186 return IEEE80211_CIPHER_WEP;
1187 case WPA_SEL(WPA_CSE_TKIP):
1188 return IEEE80211_CIPHER_TKIP;
1189 case WPA_SEL(WPA_CSE_CCMP):
1190 return IEEE80211_CIPHER_AES_CCM;
1191 }
1192 return 32; /* NB: so 1<< is discarded */
1193 #undef WPA_SEL
1194 }
1195
1196 /*
1197 * Convert a WPA key management/authentication algorithm
1198 * to an internal code.
1199 */
1200 static int
1201 wpa_keymgmt(const uint8_t *sel)
1202 {
1203 #define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1204 uint32_t w = LE_READ_4(sel);
1205
1206 switch (w) {
1207 case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1208 return WPA_ASE_8021X_UNSPEC;
1209 case WPA_SEL(WPA_ASE_8021X_PSK):
1210 return WPA_ASE_8021X_PSK;
1211 case WPA_SEL(WPA_ASE_NONE):
1212 return WPA_ASE_NONE;
1213 }
1214 return 0; /* NB: so is discarded */
1215 #undef WPA_SEL
1216 }
1217
1218 /*
1219 * Parse a WPA information element to collect parameters.
1220 * Note that we do not validate security parameters; that
1221 * is handled by the authenticator; the parsing done here
1222 * is just for internal use in making operational decisions.
1223 */
1224 static int
1225 ieee80211_parse_wpa(struct ieee80211vap *vap, const uint8_t *frm,
1226 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1227 {
1228 uint8_t len = frm[1];
1229 uint32_t w;
1230 int n;
1231
1232 /*
1233 * Check the length once for fixed parts: OUI, type,
1234 * version, mcast cipher, and 2 selector counts.
1235 * Other, variable-length data, must be checked separately.
1236 */
1237 if ((vap->iv_flags & IEEE80211_F_WPA1) == 0) {
1238 IEEE80211_DISCARD_IE(vap,
1239 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1240 wh, "WPA", "not WPA, flags 0x%x", vap->iv_flags);
1241 return IEEE80211_REASON_IE_INVALID;
1242 }
1243 if (len < 14) {
1244 IEEE80211_DISCARD_IE(vap,
1245 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1246 wh, "WPA", "too short, len %u", len);
1247 return IEEE80211_REASON_IE_INVALID;
1248 }
1249 frm += 6, len -= 4; /* NB: len is payload only */
1250 /* NB: iswpaoui already validated the OUI and type */
1251 w = LE_READ_2(frm);
1252 if (w != WPA_VERSION) {
1253 IEEE80211_DISCARD_IE(vap,
1254 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1255 wh, "WPA", "bad version %u", w);
1256 return IEEE80211_REASON_IE_INVALID;
1257 }
1258 frm += 2, len -= 2;
1259
1260 memset(rsn, 0, sizeof(*rsn));
1261
1262 /* multicast/group cipher */
1263 rsn->rsn_mcastcipher = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1264 frm += 4, len -= 4;
1265
1266 /* unicast ciphers */
1267 n = LE_READ_2(frm);
1268 frm += 2, len -= 2;
1269 if (len < n*4+2) {
1270 IEEE80211_DISCARD_IE(vap,
1271 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1272 wh, "WPA", "ucast cipher data too short; len %u, n %u",
1273 len, n);
1274 return IEEE80211_REASON_IE_INVALID;
1275 }
1276 w = 0;
1277 for (; n > 0; n--) {
1278 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1279 frm += 4, len -= 4;
1280 }
1281 if (w & (1<<IEEE80211_CIPHER_TKIP))
1282 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1283 else
1284 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1285
1286 /* key management algorithms */
1287 n = LE_READ_2(frm);
1288 frm += 2, len -= 2;
1289 if (len < n*4) {
1290 IEEE80211_DISCARD_IE(vap,
1291 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1292 wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1293 len, n);
1294 return IEEE80211_REASON_IE_INVALID;
1295 }
1296 w = 0;
1297 for (; n > 0; n--) {
1298 w |= wpa_keymgmt(frm);
1299 frm += 4, len -= 4;
1300 }
1301 if (w & WPA_ASE_8021X_UNSPEC)
1302 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1303 else
1304 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1305
1306 if (len > 2) /* optional capabilities */
1307 rsn->rsn_caps = LE_READ_2(frm);
1308
1309 return 0;
1310 }
1311
1312 /*
1313 * Convert an RSN cipher selector OUI to an internal
1314 * cipher algorithm. Where appropriate we also
1315 * record any key length.
1316 */
1317 static int
1318 rsn_cipher(const uint8_t *sel, uint8_t *keylen)
1319 {
1320 #define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1321 uint32_t w = LE_READ_4(sel);
1322
1323 switch (w) {
1324 case RSN_SEL(RSN_CSE_NULL):
1325 return IEEE80211_CIPHER_NONE;
1326 case RSN_SEL(RSN_CSE_WEP40):
1327 if (keylen)
1328 *keylen = 40 / NBBY;
1329 return IEEE80211_CIPHER_WEP;
1330 case RSN_SEL(RSN_CSE_WEP104):
1331 if (keylen)
1332 *keylen = 104 / NBBY;
1333 return IEEE80211_CIPHER_WEP;
1334 case RSN_SEL(RSN_CSE_TKIP):
1335 return IEEE80211_CIPHER_TKIP;
1336 case RSN_SEL(RSN_CSE_CCMP):
1337 return IEEE80211_CIPHER_AES_CCM;
1338 case RSN_SEL(RSN_CSE_WRAP):
1339 return IEEE80211_CIPHER_AES_OCB;
1340 }
1341 return 32; /* NB: so 1<< is discarded */
1342 #undef WPA_SEL
1343 }
1344
1345 /*
1346 * Convert an RSN key management/authentication algorithm
1347 * to an internal code.
1348 */
1349 static int
1350 rsn_keymgmt(const uint8_t *sel)
1351 {
1352 #define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1353 uint32_t w = LE_READ_4(sel);
1354
1355 switch (w) {
1356 case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1357 return RSN_ASE_8021X_UNSPEC;
1358 case RSN_SEL(RSN_ASE_8021X_PSK):
1359 return RSN_ASE_8021X_PSK;
1360 case RSN_SEL(RSN_ASE_NONE):
1361 return RSN_ASE_NONE;
1362 }
1363 return 0; /* NB: so is discarded */
1364 #undef RSN_SEL
1365 }
1366
1367 /*
1368 * Parse a WPA/RSN information element to collect parameters
1369 * and validate the parameters against what has been
1370 * configured for the system.
1371 */
1372 static int
1373 ieee80211_parse_rsn(struct ieee80211vap *vap, const uint8_t *frm,
1374 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1375 {
1376 uint8_t len = frm[1];
1377 uint32_t w;
1378 int n;
1379
1380 /*
1381 * Check the length once for fixed parts:
1382 * version, mcast cipher, and 2 selector counts.
1383 * Other, variable-length data, must be checked separately.
1384 */
1385 if ((vap->iv_flags & IEEE80211_F_WPA2) == 0) {
1386 IEEE80211_DISCARD_IE(vap,
1387 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1388 wh, "WPA", "not RSN, flags 0x%x", vap->iv_flags);
1389 return IEEE80211_REASON_IE_INVALID;
1390 }
1391 if (len < 10) {
1392 IEEE80211_DISCARD_IE(vap,
1393 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1394 wh, "RSN", "too short, len %u", len);
1395 return IEEE80211_REASON_IE_INVALID;
1396 }
1397 frm += 2;
1398 w = LE_READ_2(frm);
1399 if (w != RSN_VERSION) {
1400 IEEE80211_DISCARD_IE(vap,
1401 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1402 wh, "RSN", "bad version %u", w);
1403 return IEEE80211_REASON_IE_INVALID;
1404 }
1405 frm += 2, len -= 2;
1406
1407 memset(rsn, 0, sizeof(*rsn));
1408
1409 /* multicast/group cipher */
1410 rsn->rsn_mcastcipher = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1411 frm += 4, len -= 4;
1412
1413 /* unicast ciphers */
1414 n = LE_READ_2(frm);
1415 frm += 2, len -= 2;
1416 if (len < n*4+2) {
1417 IEEE80211_DISCARD_IE(vap,
1418 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1419 wh, "RSN", "ucast cipher data too short; len %u, n %u",
1420 len, n);
1421 return IEEE80211_REASON_IE_INVALID;
1422 }
1423 w = 0;
1424 for (; n > 0; n--) {
1425 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1426 frm += 4, len -= 4;
1427 }
1428 if (w & (1<<IEEE80211_CIPHER_TKIP))
1429 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1430 else
1431 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1432
1433 /* key management algorithms */
1434 n = LE_READ_2(frm);
1435 frm += 2, len -= 2;
1436 if (len < n*4) {
1437 IEEE80211_DISCARD_IE(vap,
1438 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1439 wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1440 len, n);
1441 return IEEE80211_REASON_IE_INVALID;
1442 }
1443 w = 0;
1444 for (; n > 0; n--) {
1445 w |= rsn_keymgmt(frm);
1446 frm += 4, len -= 4;
1447 }
1448 if (w & RSN_ASE_8021X_UNSPEC)
1449 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1450 else
1451 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1452
1453 /* optional RSN capabilities */
1454 if (len > 2)
1455 rsn->rsn_caps = LE_READ_2(frm);
1456 /* XXXPMKID */
1457
1458 return 0;
1459 }
1460
1461 /*
1462 * WPA/802.11i assocation request processing.
1463 */
1464 static int
1465 wpa_assocreq(struct ieee80211_node *ni, struct ieee80211_rsnparms *rsnparms,
1466 const struct ieee80211_frame *wh, const uint8_t *wpa,
1467 const uint8_t *rsn, uint16_t capinfo)
1468 {
1469 struct ieee80211vap *vap = ni->ni_vap;
1470 uint8_t reason;
1471 int badwparsn;
1472
1473 ni->ni_flags &= ~(IEEE80211_NODE_WPS|IEEE80211_NODE_TSN);
1474 if (wpa == NULL && rsn == NULL) {
1475 if (vap->iv_flags_ext & IEEE80211_FEXT_WPS) {
1476 /*
1477 * W-Fi Protected Setup (WPS) permits
1478 * clients to associate and pass EAPOL frames
1479 * to establish initial credentials.
1480 */
1481 ni->ni_flags |= IEEE80211_NODE_WPS;
1482 return 1;
1483 }
1484 if ((vap->iv_flags_ext & IEEE80211_FEXT_TSN) &&
1485 (capinfo & IEEE80211_CAPINFO_PRIVACY)) {
1486 /*
1487 * Transitional Security Network. Permits clients
1488 * to associate and use WEP while WPA is configured.
1489 */
1490 ni->ni_flags |= IEEE80211_NODE_TSN;
1491 return 1;
1492 }
1493 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1494 wh, NULL, "%s", "no WPA/RSN IE in association request");
1495 vap->iv_stats.is_rx_assoc_badwpaie++;
1496 reason = IEEE80211_REASON_IE_INVALID;
1497 goto bad;
1498 }
1499 /* assert right association security credentials */
1500 badwparsn = 0; /* NB: to silence compiler */
1501 switch (vap->iv_flags & IEEE80211_F_WPA) {
1502 case IEEE80211_F_WPA1:
1503 badwparsn = (wpa == NULL);
1504 break;
1505 case IEEE80211_F_WPA2:
1506 badwparsn = (rsn == NULL);
1507 break;
1508 case IEEE80211_F_WPA1|IEEE80211_F_WPA2:
1509 badwparsn = (wpa == NULL && rsn == NULL);
1510 break;
1511 }
1512 if (badwparsn) {
1513 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1514 wh, NULL,
1515 "%s", "missing WPA/RSN IE in association request");
1516 vap->iv_stats.is_rx_assoc_badwpaie++;
1517 reason = IEEE80211_REASON_IE_INVALID;
1518 goto bad;
1519 }
1520 /*
1521 * Parse WPA/RSN information element.
1522 */
1523 if (wpa != NULL)
1524 reason = ieee80211_parse_wpa(vap, wpa, rsnparms, wh);
1525 else
1526 reason = ieee80211_parse_rsn(vap, rsn, rsnparms, wh);
1527 if (reason != 0) {
1528 /* XXX distinguish WPA/RSN? */
1529 vap->iv_stats.is_rx_assoc_badwpaie++;
1530 goto bad;
1531 }
1532 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, ni,
1533 "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x",
1534 wpa != NULL ? "WPA" : "RSN",
1535 rsnparms->rsn_mcastcipher, rsnparms->rsn_mcastkeylen,
1536 rsnparms->rsn_ucastcipher, rsnparms->rsn_ucastkeylen,
1537 rsnparms->rsn_keymgmt, rsnparms->rsn_caps);
1538
1539 return 1;
1540 bad:
1541 ieee80211_node_deauth(ni, reason);
1542 return 0;
1543 }
1544
1545 /* XXX find a better place for definition */
1546 struct l2_update_frame {
1547 struct ether_header eh;
1548 uint8_t dsap;
1549 uint8_t ssap;
1550 uint8_t control;
1551 uint8_t xid[3];
1552 } __packed;
1553
1554 /*
1555 * Deliver a TGf L2UF frame on behalf of a station.
1556 * This primes any bridge when the station is roaming
1557 * between ap's on the same wired network.
1558 */
1559 static void
1560 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1561 {
1562 struct ieee80211vap *vap = ni->ni_vap;
1563 struct ifnet *ifp = vap->iv_ifp;
1564 struct mbuf *m;
1565 struct l2_update_frame *l2uf;
1566 struct ether_header *eh;
1567
1568 m = m_gethdr(MB_DONTWAIT, MT_DATA);
1569 if (m == NULL) {
1570 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1571 "%s", "no mbuf for l2uf frame");
1572 vap->iv_stats.is_rx_nobuf++; /* XXX not right */
1573 return;
1574 }
1575 l2uf = mtod(m, struct l2_update_frame *);
1576 eh = &l2uf->eh;
1577 /* dst: Broadcast address */
1578 IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1579 /* src: associated STA */
1580 IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1581 eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1582
1583 l2uf->dsap = 0;
1584 l2uf->ssap = 0;
1585 l2uf->control = 0xf5;
1586 l2uf->xid[0] = 0x81;
1587 l2uf->xid[1] = 0x80;
1588 l2uf->xid[2] = 0x00;
1589
1590 m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1591 hostap_deliver_data(vap, ni, m);
1592 }
1593
1594 static void
1595 ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1596 int reassoc, int resp, const char *tag, int rate)
1597 {
1598 IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1599 "deny %s request, %s rate set mismatch, rate/MCS %d",
1600 reassoc ? "reassoc" : "assoc", tag, rate & IEEE80211_RATE_VAL);
1601 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_BASIC_RATE);
1602 ieee80211_node_leave(ni);
1603 }
1604
1605 static void
1606 capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1607 int reassoc, int resp, const char *tag, int capinfo)
1608 {
1609 struct ieee80211vap *vap = ni->ni_vap;
1610
1611 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1612 "deny %s request, %s mismatch 0x%x",
1613 reassoc ? "reassoc" : "assoc", tag, capinfo);
1614 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_CAPINFO);
1615 ieee80211_node_leave(ni);
1616 vap->iv_stats.is_rx_assoc_capmismatch++;
1617 }
1618
1619 static void
1620 htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1621 int reassoc, int resp)
1622 {
1623 IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1624 "deny %s request, missing HT ie", reassoc ? "reassoc" : "assoc");
1625 /* XXX no better code */
1626 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_MISSING_HT_CAPS);
1627 ieee80211_node_leave(ni);
1628 }
1629
1630 static void
1631 authalgreject(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1632 int algo, int seq, int status)
1633 {
1634 struct ieee80211vap *vap = ni->ni_vap;
1635
1636 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1637 wh, NULL, "unsupported alg %d", algo);
1638 vap->iv_stats.is_rx_auth_unsupported++;
1639 ieee80211_send_error(ni, wh->i_addr2, IEEE80211_FC0_SUBTYPE_AUTH,
1640 seq | (status << 16));
1641 }
1642
1643 static __inline int
1644 ishtmixed(const uint8_t *ie)
1645 {
1646 const struct ieee80211_ie_htinfo *ht =
1647 (const struct ieee80211_ie_htinfo *) ie;
1648 return (ht->hi_byte2 & IEEE80211_HTINFO_OPMODE) ==
1649 IEEE80211_HTINFO_OPMODE_MIXED;
1650 }
1651
1652 static int
1653 is11bclient(const uint8_t *rates, const uint8_t *xrates)
1654 {
1655 static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
1656 int i;
1657
1658 /* NB: the 11b clients we care about will not have xrates */
1659 if (xrates != NULL || rates == NULL)
1660 return 0;
1661 for (i = 0; i < rates[1]; i++) {
1662 int r = rates[2+i] & IEEE80211_RATE_VAL;
1663 if (r > 2*11 || ((1<<r) & brates) == 0)
1664 return 0;
1665 }
1666 return 1;
1667 }
1668
1669 static void
1670 hostap_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1671 int subtype, int rssi, int nf)
1672 {
1673 struct ieee80211vap *vap = ni->ni_vap;
1674 struct ieee80211com *ic = ni->ni_ic;
1675 struct ieee80211_frame *wh;
1676 uint8_t *frm, *efrm, *sfrm;
1677 uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap;
1678 int reassoc, resp;
1679 uint8_t rate;
1680
1681 wh = mtod(m0, struct ieee80211_frame *);
1682 frm = (uint8_t *)&wh[1];
1683 efrm = mtod(m0, uint8_t *) + m0->m_len;
1684 switch (subtype) {
1685 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1686 case IEEE80211_FC0_SUBTYPE_BEACON: {
1687 struct ieee80211_scanparams scan;
1688 /*
1689 * We process beacon/probe response frames when scanning;
1690 * otherwise we check beacon frames for overlapping non-ERP
1691 * BSS in 11g and/or overlapping legacy BSS when in HT.
1692 */
1693 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 &&
1694 subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1695 vap->iv_stats.is_rx_mgtdiscard++;
1696 return;
1697 }
1698 /* NB: accept off-channel frames */
1699 if (ieee80211_parse_beacon(ni, m0, &scan) &~ IEEE80211_BPARSE_OFFCHAN)
1700 return;
1701 /*
1702 * Count frame now that we know it's to be processed.
1703 */
1704 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1705 vap->iv_stats.is_rx_beacon++; /* XXX remove */
1706 IEEE80211_NODE_STAT(ni, rx_beacons);
1707 } else
1708 IEEE80211_NODE_STAT(ni, rx_proberesp);
1709 /*
1710 * If scanning, just pass information to the scan module.
1711 */
1712 if (ic->ic_flags & IEEE80211_F_SCAN) {
1713 if (scan.status == 0 && /* NB: on channel */
1714 (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN)) {
1715 /*
1716 * Actively scanning a channel marked passive;
1717 * send a probe request now that we know there
1718 * is 802.11 traffic present.
1719 *
1720 * XXX check if the beacon we recv'd gives
1721 * us what we need and suppress the probe req
1722 */
1723 ieee80211_probe_curchan(vap, 1);
1724 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1725 }
1726 ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1727 return;
1728 }
1729 /*
1730 * Check beacon for overlapping bss w/ non ERP stations.
1731 * If we detect one and protection is configured but not
1732 * enabled, enable it and start a timer that'll bring us
1733 * out if we stop seeing the bss.
1734 */
1735 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1736 scan.status == 0 && /* NB: on-channel */
1737 ((scan.erp & 0x100) == 0 || /* NB: no ERP, 11b sta*/
1738 (scan.erp & IEEE80211_ERP_NON_ERP_PRESENT))) {
1739 ic->ic_lastnonerp = ticks;
1740 ic->ic_flags_ext |= IEEE80211_FEXT_NONERP_PR;
1741 if (ic->ic_protmode != IEEE80211_PROT_NONE &&
1742 (ic->ic_flags & IEEE80211_F_USEPROT) == 0) {
1743 IEEE80211_NOTE_FRAME(vap,
1744 IEEE80211_MSG_ASSOC, wh,
1745 "non-ERP present on channel %d "
1746 "(saw erp 0x%x from channel %d), "
1747 "enable use of protection",
1748 ic->ic_curchan->ic_ieee,
1749 scan.erp, scan.chan);
1750 ic->ic_flags |= IEEE80211_F_USEPROT;
1751 ieee80211_notify_erp(ic);
1752 }
1753 }
1754 /*
1755 * Check beacon for non-HT station on HT channel
1756 * and update HT BSS occupancy as appropriate.
1757 */
1758 if (IEEE80211_IS_CHAN_HT(ic->ic_curchan)) {
1759 if (scan.status & IEEE80211_BPARSE_OFFCHAN) {
1760 /*
1761 * Off control channel; only check frames
1762 * that come in the extension channel when
1763 * operating w/ HT40.
1764 */
1765 if (!IEEE80211_IS_CHAN_HT40(ic->ic_curchan))
1766 break;
1767 if (scan.chan != ic->ic_curchan->ic_extieee)
1768 break;
1769 }
1770 if (scan.htinfo == NULL) {
1771 ieee80211_htprot_update(ic,
1772 IEEE80211_HTINFO_OPMODE_PROTOPT |
1773 IEEE80211_HTINFO_NONHT_PRESENT);
1774 } else if (ishtmixed(scan.htinfo)) {
1775 /* XXX? take NONHT_PRESENT from beacon? */
1776 ieee80211_htprot_update(ic,
1777 IEEE80211_HTINFO_OPMODE_MIXED |
1778 IEEE80211_HTINFO_NONHT_PRESENT);
1779 }
1780 }
1781 break;
1782 }
1783
1784 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1785 if (vap->iv_state != IEEE80211_S_RUN) {
1786 vap->iv_stats.is_rx_mgtdiscard++;
1787 return;
1788 }
1789 /*
1790 * prreq frame format
1791 * [tlv] ssid
1792 * [tlv] supported rates
1793 * [tlv] extended supported rates
1794 */
1795 ssid = rates = xrates = NULL;
1796 sfrm = frm;
1797 while (efrm - frm > 1) {
1798 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1799 switch (*frm) {
1800 case IEEE80211_ELEMID_SSID:
1801 ssid = frm;
1802 break;
1803 case IEEE80211_ELEMID_RATES:
1804 rates = frm;
1805 break;
1806 case IEEE80211_ELEMID_XRATES:
1807 xrates = frm;
1808 break;
1809 }
1810 frm += frm[1] + 2;
1811 }
1812 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1813 if (xrates != NULL)
1814 IEEE80211_VERIFY_ELEMENT(xrates,
1815 IEEE80211_RATE_MAXSIZE - rates[1], return);
1816 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
1817 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
1818 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
1819 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1820 wh, NULL,
1821 "%s", "no ssid with ssid suppression enabled");
1822 vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
1823 return;
1824 }
1825
1826 /* XXX find a better class or define it's own */
1827 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
1828 "%s", "recv probe req");
1829 /*
1830 * Some legacy 11b clients cannot hack a complete
1831 * probe response frame. When the request includes
1832 * only a bare-bones rate set, communicate this to
1833 * the transmit side.
1834 */
1835 ieee80211_send_proberesp(vap, wh->i_addr2,
1836 is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
1837 break;
1838
1839 case IEEE80211_FC0_SUBTYPE_AUTH: {
1840 uint16_t algo, seq, status;
1841
1842 if (vap->iv_state != IEEE80211_S_RUN) {
1843 vap->iv_stats.is_rx_mgtdiscard++;
1844 return;
1845 }
1846 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1847 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1848 wh, NULL, "%s", "wrong bssid");
1849 vap->iv_stats.is_rx_wrongbss++; /*XXX unique stat?*/
1850 return;
1851 }
1852 /*
1853 * auth frame format
1854 * [2] algorithm
1855 * [2] sequence
1856 * [2] status
1857 * [tlv*] challenge
1858 */
1859 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1860 algo = le16toh(*(uint16_t *)frm);
1861 seq = le16toh(*(uint16_t *)(frm + 2));
1862 status = le16toh(*(uint16_t *)(frm + 4));
1863 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1864 "recv auth frame with algorithm %d seq %d", algo, seq);
1865 /*
1866 * Consult the ACL policy module if setup.
1867 */
1868 if (vap->iv_acl != NULL &&
1869 !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
1870 IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1871 wh, NULL, "%s", "disallowed by ACL");
1872 vap->iv_stats.is_rx_acl++;
1873 ieee80211_send_error(ni, wh->i_addr2,
1874 IEEE80211_FC0_SUBTYPE_AUTH,
1875 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
1876 return;
1877 }
1878 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1879 IEEE80211_DISCARD(vap,
1880 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1881 wh, NULL, "%s", "TKIP countermeasures enabled");
1882 vap->iv_stats.is_rx_auth_countermeasures++;
1883 ieee80211_send_error(ni, wh->i_addr2,
1884 IEEE80211_FC0_SUBTYPE_AUTH,
1885 IEEE80211_REASON_MIC_FAILURE);
1886 return;
1887 }
1888 if (algo == IEEE80211_AUTH_ALG_SHARED)
1889 hostap_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1890 seq, status);
1891 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1892 hostap_auth_open(ni, wh, rssi, nf, seq, status);
1893 else if (algo == IEEE80211_AUTH_ALG_LEAP) {
1894 authalgreject(ni, wh, algo,
1895 seq+1, IEEE80211_STATUS_ALG);
1896 return;
1897 } else {
1898 /*
1899 * We assume that an unknown algorithm is the result
1900 * of a decryption failure on a shared key auth frame;
1901 * return a status code appropriate for that instead
1902 * of IEEE80211_STATUS_ALG.
1903 *
1904 * NB: a seq# of 4 is intentional; the decrypted
1905 * frame likely has a bogus seq value.
1906 */
1907 authalgreject(ni, wh, algo,
1908 4, IEEE80211_STATUS_CHALLENGE);
1909 return;
1910 }
1911 break;
1912 }
1913
1914 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1915 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
1916 uint16_t capinfo, lintval;
1917 struct ieee80211_rsnparms rsnparms;
1918
1919 if (vap->iv_state != IEEE80211_S_RUN) {
1920 vap->iv_stats.is_rx_mgtdiscard++;
1921 return;
1922 }
1923 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1924 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1925 wh, NULL, "%s", "wrong bssid");
1926 vap->iv_stats.is_rx_assoc_bss++;
1927 return;
1928 }
1929 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
1930 reassoc = 1;
1931 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
1932 } else {
1933 reassoc = 0;
1934 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
1935 }
1936 if (ni == vap->iv_bss) {
1937 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1938 "deny %s request, sta not authenticated",
1939 reassoc ? "reassoc" : "assoc");
1940 ieee80211_send_error(ni, wh->i_addr2,
1941 IEEE80211_FC0_SUBTYPE_DEAUTH,
1942 IEEE80211_REASON_ASSOC_NOT_AUTHED);
1943 vap->iv_stats.is_rx_assoc_notauth++;
1944 return;
1945 }
1946
1947 /*
1948 * asreq frame format
1949 * [2] capability information
1950 * [2] listen interval
1951 * [6*] current AP address (reassoc only)
1952 * [tlv] ssid
1953 * [tlv] supported rates
1954 * [tlv] extended supported rates
1955 * [tlv] WPA or RSN
1956 * [tlv] HT capabilities
1957 * [tlv] Atheros capabilities
1958 */
1959 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
1960 capinfo = le16toh(*(uint16_t *)frm); frm += 2;
1961 lintval = le16toh(*(uint16_t *)frm); frm += 2;
1962 if (reassoc)
1963 frm += 6; /* ignore current AP info */
1964 ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL;
1965 sfrm = frm;
1966 while (efrm - frm > 1) {
1967 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1968 switch (*frm) {
1969 case IEEE80211_ELEMID_SSID:
1970 ssid = frm;
1971 break;
1972 case IEEE80211_ELEMID_RATES:
1973 rates = frm;
1974 break;
1975 case IEEE80211_ELEMID_XRATES:
1976 xrates = frm;
1977 break;
1978 case IEEE80211_ELEMID_RSN:
1979 rsn = frm;
1980 break;
1981 case IEEE80211_ELEMID_HTCAP:
1982 htcap = frm;
1983 break;
1984 case IEEE80211_ELEMID_VENDOR:
1985 if (iswpaoui(frm))
1986 wpa = frm;
1987 else if (iswmeinfo(frm))
1988 wme = frm;
1989 #ifdef IEEE80211_SUPPORT_SUPERG
1990 else if (isatherosoui(frm))
1991 ath = frm;
1992 #endif
1993 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
1994 if (ishtcapoui(frm) && htcap == NULL)
1995 htcap = frm;
1996 }
1997 break;
1998 }
1999 frm += frm[1] + 2;
2000 }
2001 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2002 if (xrates != NULL)
2003 IEEE80211_VERIFY_ELEMENT(xrates,
2004 IEEE80211_RATE_MAXSIZE - rates[1], return);
2005 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2006 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
2007 if (htcap != NULL) {
2008 IEEE80211_VERIFY_LENGTH(htcap[1],
2009 htcap[0] == IEEE80211_ELEMID_VENDOR ?
2010 4 + sizeof(struct ieee80211_ie_htcap)-2 :
2011 sizeof(struct ieee80211_ie_htcap)-2,
2012 return); /* XXX just NULL out? */
2013 }
2014
2015 if ((vap->iv_flags & IEEE80211_F_WPA) &&
2016 !wpa_assocreq(ni, &rsnparms, wh, wpa, rsn, capinfo))
2017 return;
2018 /* discard challenge after association */
2019 if (ni->ni_challenge != NULL) {
2020 kfree(ni->ni_challenge, M_80211_NODE);
2021 ni->ni_challenge = NULL;
2022 }
2023 /* NB: 802.11 spec says to ignore station's privacy bit */
2024 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2025 capinfomismatch(ni, wh, reassoc, resp,
2026 "capability", capinfo);
2027 return;
2028 }
2029 /*
2030 * Disallow re-associate w/ invalid slot time setting.
2031 */
2032 if (ni->ni_associd != 0 &&
2033 IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
2034 ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
2035 capinfomismatch(ni, wh, reassoc, resp,
2036 "slot time", capinfo);
2037 return;
2038 }
2039 rate = ieee80211_setup_rates(ni, rates, xrates,
2040 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2041 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2042 if (rate & IEEE80211_RATE_BASIC) {
2043 ratesetmismatch(ni, wh, reassoc, resp, "legacy", rate);
2044 vap->iv_stats.is_rx_assoc_norate++;
2045 return;
2046 }
2047 /*
2048 * If constrained to 11g-only stations reject an
2049 * 11b-only station. We cheat a bit here by looking
2050 * at the max negotiated xmit rate and assuming anyone
2051 * with a best rate <24Mb/s is an 11b station.
2052 */
2053 if ((vap->iv_flags & IEEE80211_F_PUREG) && rate < 48) {
2054 ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);
2055 vap->iv_stats.is_rx_assoc_norate++;
2056 return;
2057 }
2058 /*
2059 * Do HT rate set handling and setup HT node state.
2060 */
2061 ni->ni_chan = vap->iv_bss->ni_chan;
2062 if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && htcap != NULL) {
2063 rate = ieee80211_setup_htrates(ni, htcap,
2064 IEEE80211_F_DOFMCS | IEEE80211_F_DONEGO |
2065 IEEE80211_F_DOBRS);
2066 if (rate & IEEE80211_RATE_BASIC) {
2067 ratesetmismatch(ni, wh, reassoc, resp,
2068 "HT", rate);
2069 vap->iv_stats.is_ht_assoc_norate++;
2070 return;
2071 }
2072 ieee80211_ht_node_init(ni);
2073 ieee80211_ht_updatehtcap(ni, htcap);
2074 } else if (ni->ni_flags & IEEE80211_NODE_HT)
2075 ieee80211_ht_node_cleanup(ni);
2076 #ifdef IEEE80211_SUPPORT_SUPERG
2077 else if (ni->ni_ath_flags & IEEE80211_NODE_ATH)
2078 ieee80211_ff_node_cleanup(ni);
2079 #endif
2080 /*
2081 * Allow AMPDU operation only with unencrypted traffic
2082 * or AES-CCM; the 11n spec only specifies these ciphers
2083 * so permitting any others is undefined and can lead
2084 * to interoperability problems.
2085 */
2086 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
2087 (((vap->iv_flags & IEEE80211_F_WPA) &&
2088 rsnparms.rsn_ucastcipher != IEEE80211_CIPHER_AES_CCM) ||
2089 (vap->iv_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) {
2090 IEEE80211_NOTE(vap,
2091 IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
2092 "disallow HT use because WEP or TKIP requested, "
2093 "capinfo 0x%x ucastcipher %d", capinfo,
2094 rsnparms.rsn_ucastcipher);
2095 ieee80211_ht_node_cleanup(ni);
2096 vap->iv_stats.is_ht_assoc_downgrade++;
2097 }
2098 /*
2099 * If constrained to 11n-only stations reject legacy stations.
2100 */
2101 if ((vap->iv_flags_ht & IEEE80211_FHT_PUREN) &&
2102 (ni->ni_flags & IEEE80211_NODE_HT) == 0) {
2103 htcapmismatch(ni, wh, reassoc, resp);
2104 vap->iv_stats.is_ht_assoc_nohtcap++;
2105 return;
2106 }
2107 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
2108 ni->ni_noise = nf;
2109 ni->ni_intval = lintval;
2110 ni->ni_capinfo = capinfo;
2111 ni->ni_fhdwell = vap->iv_bss->ni_fhdwell;
2112 ni->ni_fhindex = vap->iv_bss->ni_fhindex;
2113 /*
2114 * Store the IEs.
2115 * XXX maybe better to just expand
2116 */
2117 if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {
2118 #define setie(_ie, _off) ieee80211_ies_setie(ni->ni_ies, _ie, _off)
2119 if (wpa != NULL)
2120 setie(wpa_ie, wpa - sfrm);
2121 if (rsn != NULL)
2122 setie(rsn_ie, rsn - sfrm);
2123 if (htcap != NULL)
2124 setie(htcap_ie, htcap - sfrm);
2125 if (wme != NULL) {
2126 setie(wme_ie, wme - sfrm);
2127 /*
2128 * Mark node as capable of QoS.
2129 */
2130 ni->ni_flags |= IEEE80211_NODE_QOS;
2131 } else
2132 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2133 #ifdef IEEE80211_SUPPORT_SUPERG
2134 if (ath != NULL) {
2135 setie(ath_ie, ath - sfrm);
2136 /*
2137 * Parse ATH station parameters.
2138 */
2139 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
2140 } else
2141 #endif
2142 ni->ni_ath_flags = 0;
2143 #undef setie
2144 } else {
2145 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2146 ni->ni_ath_flags = 0;
2147 }
2148 ieee80211_node_join(ni, resp);
2149 ieee80211_deliver_l2uf(ni);
2150 break;
2151 }
2152
2153 case IEEE80211_FC0_SUBTYPE_DEAUTH:
2154 case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2155 uint16_t reason;
2156
2157 if (vap->iv_state != IEEE80211_S_RUN ||
2158 /* NB: can happen when in promiscuous mode */
2159 !IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
2160 vap->iv_stats.is_rx_mgtdiscard++;
2161 break;
2162 }
2163 /*
2164 * deauth/disassoc frame format
2165 * [2] reason
2166 */
2167 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2168 reason = le16toh(*(uint16_t *)frm);
2169 if (subtype == IEEE80211_FC0_SUBTYPE_DEAUTH) {
2170 vap->iv_stats.is_rx_deauth++;
2171 IEEE80211_NODE_STAT(ni, rx_deauth);
2172 } else {
2173 vap->iv_stats.is_rx_disassoc++;
2174 IEEE80211_NODE_STAT(ni, rx_disassoc);
2175 }
2176 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
2177 "recv %s (reason %d)", ieee80211_mgt_subtype_name[subtype >>
2178 IEEE80211_FC0_SUBTYPE_SHIFT], reason);
2179 if (ni != vap->iv_bss)
2180 ieee80211_node_leave(ni);
2181 break;
2182 }
2183
2184 case IEEE80211_FC0_SUBTYPE_ACTION:
2185 if (vap->iv_state == IEEE80211_S_RUN) {
2186 if (ieee80211_parse_action(ni, m0) == 0)
2187 ic->ic_recv_action(ni, wh, frm, efrm);
2188 } else
2189 vap->iv_stats.is_rx_mgtdiscard++;
2190 break;
2191
2192 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2193 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2194 default:
2195 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2196 wh, "mgt", "subtype 0x%x not handled", subtype);
2197 vap->iv_stats.is_rx_badsubtype++;
2198 break;
2199 }
2200 }
2201
2202 static void
2203 hostap_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2204 {
2205 switch (subtype) {
2206 case IEEE80211_FC0_SUBTYPE_PS_POLL:
2207 hostap_recv_pspoll(ni, m);
2208 break;
2209 case IEEE80211_FC0_SUBTYPE_BAR:
2210 ieee80211_recv_bar(ni, m);
2211 break;
2212 }
2213 }
2214
2215 /*
2216 * Process a received ps-poll frame.
2217 */
2218 static void
2219 hostap_recv_pspoll(struct ieee80211_node *ni, struct mbuf *m0)
2220 {
2221 struct ieee80211vap *vap = ni->ni_vap;
2222 struct ieee80211_frame_min *wh;
2223 struct ifnet *ifp;
2224 struct mbuf *m;
2225 uint16_t aid;
2226 int qlen;
2227
2228 wh = mtod(m0, struct ieee80211_frame_min *);
2229 if (ni->ni_associd == 0) {
2230 IEEE80211_DISCARD(vap,
2231 IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2232 (struct ieee80211_frame *) wh, NULL,
2233 "%s", "unassociated station");
2234 vap->iv_stats.is_ps_unassoc++;
2235 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2236 IEEE80211_REASON_NOT_ASSOCED);
2237 return;
2238 }
2239
2240 aid = le16toh(*(uint16_t *)wh->i_dur);
2241 if (aid != ni->ni_associd) {
2242 IEEE80211_DISCARD(vap,
2243 IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2244 (struct ieee80211_frame *) wh, NULL,
2245 "aid mismatch: sta aid 0x%x poll aid 0x%x",
2246 ni->ni_associd, aid);
2247 vap->iv_stats.is_ps_badaid++;
2248 /*
2249 * NB: We used to deauth the station but it turns out
2250 * the Blackberry Curve 8230 (and perhaps other devices)
2251 * sometimes send the wrong AID when WME is negotiated.
2252 * Being more lenient here seems ok as we already check
2253 * the station is associated and we only return frames
2254 * queued for the station (i.e. we don't use the AID).
2255 */
2256 return;
2257 }
2258
2259 /* Okay, take the first queued packet and put it out... */
2260 m = ieee80211_node_psq_dequeue(ni, &qlen);
2261 if (m == NULL) {
2262 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_POWER, wh->i_addr2,
2263 "%s", "recv ps-poll, but queue empty");
2264 ieee80211_send_nulldata(ieee80211_ref_node(ni));
2265 vap->iv_stats.is_ps_qempty++; /* XXX node stat */
2266 if (vap->iv_set_tim != NULL)
2267 vap->iv_set_tim(ni, 0); /* just in case */
2268 return;
2269 }
2270 /*
2271 * If there are more packets, set the more packets bit
2272 * in the packet dispatched to the station; otherwise
2273 * turn off the TIM bit.
2274 */
2275 if (qlen != 0) {
2276 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2277 "recv ps-poll, send packet, %u still queued", qlen);
2278 m->m_flags |= M_MORE_DATA;
2279 } else {
2280 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2281 "%s", "recv ps-poll, send packet, queue empty");
2282 if (vap->iv_set_tim != NULL)
2283 vap->iv_set_tim(ni, 0);
2284 }
2285 m->m_flags |= M_PWR_SAV; /* bypass PS handling */
2286
2287 if (m->m_flags & M_ENCAP)
2288 ifp = vap->iv_ic->ic_ifp;
2289 else
2290 ifp = vap->iv_ifp;
2291 IF_ENQUEUE(&ifp->if_snd, m);
2292 ifp->if_start(ifp);
2293 }
DragonFly BSD