2 * Copyright (c) 2007-2009 Sam Leffler, Errno Consulting
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
32 * IEEE 802.11 IBSS mode support.
37 #include <sys/param.h>
38 #include <sys/systm.h>
40 #include <sys/malloc.h>
41 #include <sys/kernel.h>
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
48 #include <sys/sysctl.h>
51 #include <net/if_var.h>
52 #include <net/if_media.h>
53 #include <net/if_llc.h>
54 #include <net/ethernet.h>
58 #include <netproto/802_11/ieee80211_var.h>
59 #include <netproto/802_11/ieee80211_adhoc.h>
60 #include <netproto/802_11/ieee80211_input.h>
61 #ifdef IEEE80211_SUPPORT_SUPERG
62 #include <netproto/802_11/ieee80211_superg.h>
64 #ifdef IEEE80211_SUPPORT_TDMA
65 #include <netproto/802_11/ieee80211_tdma.h>
67 #include <netproto/802_11/ieee80211_sta.h>
69 #define IEEE80211_RATE2MBS(r) (((r) & IEEE80211_RATE_VAL) / 2)
71 static void adhoc_vattach(struct ieee80211vap
*);
72 static int adhoc_newstate(struct ieee80211vap
*, enum ieee80211_state
, int);
73 static int adhoc_input(struct ieee80211_node
*, struct mbuf
*,
74 const struct ieee80211_rx_stats
*, int, int);
75 static void adhoc_recv_mgmt(struct ieee80211_node
*, struct mbuf
*,
76 int subtype
, const struct ieee80211_rx_stats
*, int, int);
77 static void ahdemo_recv_mgmt(struct ieee80211_node
*, struct mbuf
*,
78 int subtype
, const struct ieee80211_rx_stats
*rxs
, int, int);
79 static void adhoc_recv_ctl(struct ieee80211_node
*, struct mbuf
*, int subtype
);
82 ieee80211_adhoc_attach(struct ieee80211com
*ic
)
84 ic
->ic_vattach
[IEEE80211_M_IBSS
] = adhoc_vattach
;
85 ic
->ic_vattach
[IEEE80211_M_AHDEMO
] = adhoc_vattach
;
89 ieee80211_adhoc_detach(struct ieee80211com
*ic
)
94 adhoc_vdetach(struct ieee80211vap
*vap
)
99 adhoc_vattach(struct ieee80211vap
*vap
)
101 vap
->iv_newstate
= adhoc_newstate
;
102 vap
->iv_input
= adhoc_input
;
103 if (vap
->iv_opmode
== IEEE80211_M_IBSS
)
104 vap
->iv_recv_mgmt
= adhoc_recv_mgmt
;
106 vap
->iv_recv_mgmt
= ahdemo_recv_mgmt
;
107 vap
->iv_recv_ctl
= adhoc_recv_ctl
;
108 vap
->iv_opdetach
= adhoc_vdetach
;
109 #ifdef IEEE80211_SUPPORT_TDMA
111 * Throw control to tdma support. Note we do this
112 * after setting up our callbacks so it can piggyback
115 if (vap
->iv_caps
& IEEE80211_C_TDMA
)
116 ieee80211_tdma_vattach(vap
);
121 sta_leave(void *arg
, struct ieee80211_node
*ni
)
123 struct ieee80211vap
*vap
= arg
;
125 if (ni
->ni_vap
== vap
&& ni
!= vap
->iv_bss
)
126 ieee80211_node_leave(ni
);
130 * IEEE80211_M_IBSS+IEEE80211_M_AHDEMO vap state machine handler.
133 adhoc_newstate(struct ieee80211vap
*vap
, enum ieee80211_state nstate
, int arg
)
135 struct ieee80211com
*ic
= vap
->iv_ic
;
136 struct ieee80211_node
*ni
;
137 enum ieee80211_state ostate
;
139 IEEE80211_LOCK_ASSERT(vap
->iv_ic
);
141 ostate
= vap
->iv_state
;
142 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_STATE
, "%s: %s -> %s (%d)\n",
143 __func__
, ieee80211_state_name
[ostate
],
144 ieee80211_state_name
[nstate
], arg
);
145 vap
->iv_state
= nstate
; /* state transition */
146 if (ostate
!= IEEE80211_S_SCAN
)
147 ieee80211_cancel_scan(vap
); /* background scan */
148 ni
= vap
->iv_bss
; /* NB: no reference held */
150 case IEEE80211_S_INIT
:
152 case IEEE80211_S_SCAN
:
153 ieee80211_cancel_scan(vap
);
158 if (ostate
!= IEEE80211_S_INIT
) {
159 /* NB: optimize INIT -> INIT case */
160 ieee80211_reset_bss(vap
);
163 case IEEE80211_S_SCAN
:
165 case IEEE80211_S_RUN
: /* beacon miss */
166 /* purge station table; entries are stale */
167 ieee80211_iterate_nodes(&ic
->ic_sta
, sta_leave
, vap
);
169 case IEEE80211_S_INIT
:
170 if (vap
->iv_des_chan
!= IEEE80211_CHAN_ANYC
&&
171 !IEEE80211_IS_CHAN_RADAR(vap
->iv_des_chan
)) {
173 * Already have a channel; bypass the
174 * scan and startup immediately.
176 ieee80211_create_ibss(vap
,
177 ieee80211_ht_adjust_channel(ic
,
178 vap
->iv_des_chan
, vap
->iv_flags_ht
));
182 * Initiate a scan. We can come here as a result
183 * of an IEEE80211_IOC_SCAN_REQ too in which case
184 * the vap will be marked with IEEE80211_FEXT_SCANREQ
185 * and the scan request parameters will be present
186 * in iv_scanreq. Otherwise we do the default.
188 if (vap
->iv_flags_ext
& IEEE80211_FEXT_SCANREQ
) {
189 ieee80211_check_scan(vap
,
190 vap
->iv_scanreq_flags
,
191 vap
->iv_scanreq_duration
,
192 vap
->iv_scanreq_mindwell
,
193 vap
->iv_scanreq_maxdwell
,
194 vap
->iv_scanreq_nssid
, vap
->iv_scanreq_ssid
);
195 vap
->iv_flags_ext
&= ~IEEE80211_FEXT_SCANREQ
;
197 ieee80211_check_scan_current(vap
);
199 case IEEE80211_S_SCAN
:
201 * This can happen because of a change in state
202 * that requires a reset. Trigger a new scan
203 * unless we're in manual roaming mode in which
204 * case an application must issue an explicit request.
206 if (vap
->iv_roaming
== IEEE80211_ROAMING_AUTO
)
207 ieee80211_check_scan_current(vap
);
213 case IEEE80211_S_RUN
:
214 if (vap
->iv_flags
& IEEE80211_F_WPA
) {
215 /* XXX validate prerequisites */
218 case IEEE80211_S_SCAN
:
219 #ifdef IEEE80211_DEBUG
220 if (ieee80211_msg_debug(vap
)) {
222 "synchronized with %s ssid ",
223 ether_sprintf(ni
->ni_bssid
));
224 ieee80211_print_essid(vap
->iv_bss
->ni_essid
,
227 kprintf(" channel %d start %uMb\n",
228 ieee80211_chan2ieee(ic
, ic
->ic_curchan
),
229 IEEE80211_RATE2MBS(ni
->ni_txrate
));
233 case IEEE80211_S_RUN
: /* IBSS merge */
239 * When 802.1x is not in use mark the port authorized
240 * at this point so traffic can flow.
242 if (ni
->ni_authmode
!= IEEE80211_AUTH_8021X
)
243 ieee80211_node_authorize(ni
);
245 * Fake association when joining an existing bss.
247 if (!IEEE80211_ADDR_EQ(ni
->ni_macaddr
, vap
->iv_myaddr
) &&
248 ic
->ic_newassoc
!= NULL
)
249 ic
->ic_newassoc(ni
, ostate
!= IEEE80211_S_RUN
);
251 case IEEE80211_S_SLEEP
:
252 vap
->iv_sta_ps(vap
, 0);
256 IEEE80211_DPRINTF(vap
, IEEE80211_MSG_STATE
,
257 "%s: unexpected state transition %s -> %s\n", __func__
,
258 ieee80211_state_name
[ostate
], ieee80211_state_name
[nstate
]);
265 * Decide if a received management frame should be
266 * printed when debugging is enabled. This filters some
267 * of the less interesting frames that come frequently
271 doprint(struct ieee80211vap
*vap
, int subtype
)
274 case IEEE80211_FC0_SUBTYPE_BEACON
:
275 return (vap
->iv_ic
->ic_flags
& IEEE80211_F_SCAN
);
276 case IEEE80211_FC0_SUBTYPE_PROBE_REQ
:
283 * Process a received frame. The node associated with the sender
284 * should be supplied. If nothing was found in the node table then
285 * the caller is assumed to supply a reference to iv_bss instead.
286 * The RSSI and a timestamp are also supplied. The RSSI data is used
287 * during AP scanning to select a AP to associate with; it can have
288 * any units so long as values have consistent units and higher values
289 * mean ``better signal''. The receive timestamp is currently not used
290 * by the 802.11 layer.
293 adhoc_input(struct ieee80211_node
*ni
, struct mbuf
*m
,
294 const struct ieee80211_rx_stats
*rxs
, int rssi
, int nf
)
296 struct ieee80211vap
*vap
= ni
->ni_vap
;
297 struct ieee80211com
*ic
= ni
->ni_ic
;
298 struct ifnet
*ifp
= vap
->iv_ifp
;
299 struct ieee80211_frame
*wh
;
300 struct ieee80211_key
*key
;
301 struct ether_header
*eh
;
302 int hdrspace
, need_tap
= 1; /* mbuf need to be tapped. */
303 uint8_t dir
, type
, subtype
, qos
;
306 if (m
->m_flags
& M_AMPDU_MPDU
) {
308 * Fastpath for A-MPDU reorder q resubmission. Frames
309 * w/ M_AMPDU_MPDU marked have already passed through
310 * here but were received out of order and been held on
311 * the reorder queue. When resubmitted they are marked
312 * with the M_AMPDU_MPDU flag and we can bypass most of
313 * the normal processing.
315 wh
= mtod(m
, struct ieee80211_frame
*);
316 type
= IEEE80211_FC0_TYPE_DATA
;
317 dir
= wh
->i_fc
[1] & IEEE80211_FC1_DIR_MASK
;
318 subtype
= IEEE80211_FC0_SUBTYPE_QOS
;
319 hdrspace
= ieee80211_hdrspace(ic
, wh
); /* XXX optimize? */
323 KASSERT(ni
!= NULL
, ("null node"));
324 ni
->ni_inact
= ni
->ni_inact_reload
;
326 type
= -1; /* undefined */
328 if (m
->m_pkthdr
.len
< sizeof(struct ieee80211_frame_min
)) {
329 IEEE80211_DISCARD_MAC(vap
, IEEE80211_MSG_ANY
,
330 ni
->ni_macaddr
, NULL
,
331 "too short (1): len %u", m
->m_pkthdr
.len
);
332 vap
->iv_stats
.is_rx_tooshort
++;
336 * Bit of a cheat here, we use a pointer for a 3-address
337 * frame format but don't reference fields past outside
338 * ieee80211_frame_min w/o first validating the data is
341 wh
= mtod(m
, struct ieee80211_frame
*);
343 if ((wh
->i_fc
[0] & IEEE80211_FC0_VERSION_MASK
) !=
344 IEEE80211_FC0_VERSION_0
) {
345 IEEE80211_DISCARD_MAC(vap
, IEEE80211_MSG_ANY
,
346 ni
->ni_macaddr
, NULL
, "wrong version, fc %02x:%02x",
347 wh
->i_fc
[0], wh
->i_fc
[1]);
348 vap
->iv_stats
.is_rx_badversion
++;
352 dir
= wh
->i_fc
[1] & IEEE80211_FC1_DIR_MASK
;
353 type
= wh
->i_fc
[0] & IEEE80211_FC0_TYPE_MASK
;
354 subtype
= wh
->i_fc
[0] & IEEE80211_FC0_SUBTYPE_MASK
;
355 if ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0) {
356 if (dir
!= IEEE80211_FC1_DIR_NODS
)
358 else if (type
== IEEE80211_FC0_TYPE_CTL
)
361 if (m
->m_pkthdr
.len
< sizeof(struct ieee80211_frame
)) {
362 IEEE80211_DISCARD_MAC(vap
,
363 IEEE80211_MSG_ANY
, ni
->ni_macaddr
,
364 NULL
, "too short (2): len %u",
366 vap
->iv_stats
.is_rx_tooshort
++;
372 * Validate the bssid.
374 if (!IEEE80211_ADDR_EQ(bssid
, vap
->iv_bss
->ni_bssid
) &&
375 !IEEE80211_ADDR_EQ(bssid
, ifp
->if_broadcastaddr
)) {
376 /* not interested in */
377 IEEE80211_DISCARD_MAC(vap
, IEEE80211_MSG_INPUT
,
378 bssid
, NULL
, "%s", "not to bss");
379 vap
->iv_stats
.is_rx_wrongbss
++;
383 * Data frame, cons up a node when it doesn't
384 * exist. This should probably done after an ACL check.
386 if (type
== IEEE80211_FC0_TYPE_DATA
&&
388 !IEEE80211_ADDR_EQ(wh
->i_addr2
, ni
->ni_macaddr
)) {
390 * Beware of frames that come in too early; we
391 * can receive broadcast frames and creating sta
392 * entries will blow up because there is no bss
395 if (vap
->iv_state
!= IEEE80211_S_RUN
) {
396 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
397 wh
, "data", "not in RUN state (%s)",
398 ieee80211_state_name
[vap
->iv_state
]);
399 vap
->iv_stats
.is_rx_badstate
++;
403 * Fake up a node for this newly
404 * discovered member of the IBSS.
406 ni
= ieee80211_fakeup_adhoc_node(vap
, wh
->i_addr2
);
408 /* NB: stat kept for alloc failure */
412 IEEE80211_RSSI_LPF(ni
->ni_avgrssi
, rssi
);
414 if (IEEE80211_HAS_SEQ(type
, subtype
) &&
415 IEEE80211_ADDR_EQ(wh
->i_addr2
, ni
->ni_macaddr
)) {
416 uint8_t tid
= ieee80211_gettid(wh
);
417 if (IEEE80211_QOS_HAS_SEQ(wh
) &&
418 TID_TO_WME_AC(tid
) >= WME_AC_VI
)
419 ic
->ic_wme
.wme_hipri_traffic
++;
420 if (! ieee80211_check_rxseq(ni
, wh
, bssid
))
426 case IEEE80211_FC0_TYPE_DATA
:
427 hdrspace
= ieee80211_hdrspace(ic
, wh
);
428 if (m
->m_len
< hdrspace
&&
429 (m
= m_pullup(m
, hdrspace
)) == NULL
) {
430 IEEE80211_DISCARD_MAC(vap
, IEEE80211_MSG_ANY
,
431 ni
->ni_macaddr
, NULL
,
432 "data too short: expecting %u", hdrspace
);
433 vap
->iv_stats
.is_rx_tooshort
++;
436 if (dir
!= IEEE80211_FC1_DIR_NODS
) {
437 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
438 wh
, "data", "incorrect dir 0x%x", dir
);
439 vap
->iv_stats
.is_rx_wrongdir
++;
442 /* XXX no power-save support */
445 * Handle A-MPDU re-ordering. If the frame is to be
446 * processed directly then ieee80211_ampdu_reorder
447 * will return 0; otherwise it has consumed the mbuf
448 * and we should do nothing more with it.
450 if ((m
->m_flags
& M_AMPDU
) &&
451 ieee80211_ampdu_reorder(ni
, m
) != 0) {
458 * Handle privacy requirements. Note that we
459 * must not be preempted from here until after
460 * we (potentially) call ieee80211_crypto_demic;
461 * otherwise we may violate assumptions in the
462 * crypto cipher modules used to do delayed update
463 * of replay sequence numbers.
465 if (wh
->i_fc
[1] & IEEE80211_FC1_PROTECTED
) {
466 if ((vap
->iv_flags
& IEEE80211_F_PRIVACY
) == 0) {
468 * Discard encrypted frames when privacy is off.
470 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
471 wh
, "WEP", "%s", "PRIVACY off");
472 vap
->iv_stats
.is_rx_noprivacy
++;
473 IEEE80211_NODE_STAT(ni
, rx_noprivacy
);
476 key
= ieee80211_crypto_decap(ni
, m
, hdrspace
);
478 /* NB: stats+msgs handled in crypto_decap */
479 IEEE80211_NODE_STAT(ni
, rx_wepfail
);
482 wh
= mtod(m
, struct ieee80211_frame
*);
483 wh
->i_fc
[1] &= ~IEEE80211_FC1_PROTECTED
;
485 /* XXX M_WEP and IEEE80211_F_PRIVACY */
490 * Save QoS bits for use below--before we strip the header.
492 if (subtype
== IEEE80211_FC0_SUBTYPE_QOS
) {
493 qos
= (dir
== IEEE80211_FC1_DIR_DSTODS
) ?
494 ((struct ieee80211_qosframe_addr4
*)wh
)->i_qos
[0] :
495 ((struct ieee80211_qosframe
*)wh
)->i_qos
[0];
500 * Next up, any fragmentation.
502 if (!IEEE80211_IS_MULTICAST(wh
->i_addr1
)) {
503 m
= ieee80211_defrag(ni
, m
, hdrspace
);
505 /* Fragment dropped or frame not complete yet */
509 wh
= NULL
; /* no longer valid, catch any uses */
512 * Next strip any MSDU crypto bits.
514 if (key
!= NULL
&& !ieee80211_crypto_demic(vap
, key
, m
, 0)) {
515 IEEE80211_DISCARD_MAC(vap
, IEEE80211_MSG_INPUT
,
516 ni
->ni_macaddr
, "data", "%s", "demic error");
517 vap
->iv_stats
.is_rx_demicfail
++;
518 IEEE80211_NODE_STAT(ni
, rx_demicfail
);
522 /* copy to listener after decrypt */
523 if (ieee80211_radiotap_active_vap(vap
))
524 ieee80211_radiotap_rx(vap
, m
);
528 * Finally, strip the 802.11 header.
530 m
= ieee80211_decap(vap
, m
, hdrspace
);
532 /* XXX mask bit to check for both */
533 /* don't count Null data frames as errors */
534 if (subtype
== IEEE80211_FC0_SUBTYPE_NODATA
||
535 subtype
== IEEE80211_FC0_SUBTYPE_QOS_NULL
)
537 IEEE80211_DISCARD_MAC(vap
, IEEE80211_MSG_INPUT
,
538 ni
->ni_macaddr
, "data", "%s", "decap error");
539 vap
->iv_stats
.is_rx_decap
++;
540 IEEE80211_NODE_STAT(ni
, rx_decap
);
543 eh
= mtod(m
, struct ether_header
*);
544 if (!ieee80211_node_is_authorized(ni
)) {
546 * Deny any non-PAE frames received prior to
547 * authorization. For open/shared-key
548 * authentication the port is mark authorized
549 * after authentication completes. For 802.1x
550 * the port is not marked authorized by the
551 * authenticator until the handshake has completed.
553 if (eh
->ether_type
!= htons(ETHERTYPE_PAE
)) {
554 IEEE80211_DISCARD_MAC(vap
, IEEE80211_MSG_INPUT
,
555 eh
->ether_shost
, "data",
556 "unauthorized port: ether type 0x%x len %u",
557 eh
->ether_type
, m
->m_pkthdr
.len
);
558 vap
->iv_stats
.is_rx_unauth
++;
559 IEEE80211_NODE_STAT(ni
, rx_unauth
);
564 * When denying unencrypted frames, discard
565 * any non-PAE frames received without encryption.
567 if ((vap
->iv_flags
& IEEE80211_F_DROPUNENC
) &&
568 (key
== NULL
&& (m
->m_flags
& M_WEP
) == 0) &&
569 eh
->ether_type
!= htons(ETHERTYPE_PAE
)) {
571 * Drop unencrypted frames.
573 vap
->iv_stats
.is_rx_unencrypted
++;
574 IEEE80211_NODE_STAT(ni
, rx_unencrypted
);
578 /* XXX require HT? */
579 if (qos
& IEEE80211_QOS_AMSDU
) {
580 m
= ieee80211_decap_amsdu(ni
, m
);
582 return IEEE80211_FC0_TYPE_DATA
;
584 #ifdef IEEE80211_SUPPORT_SUPERG
585 m
= ieee80211_decap_fastframe(vap
, ni
, m
);
587 return IEEE80211_FC0_TYPE_DATA
;
590 if (dir
== IEEE80211_FC1_DIR_DSTODS
&& ni
->ni_wdsvap
!= NULL
)
591 ieee80211_deliver_data(ni
->ni_wdsvap
, ni
, m
);
593 ieee80211_deliver_data(vap
, ni
, m
);
594 return IEEE80211_FC0_TYPE_DATA
;
596 case IEEE80211_FC0_TYPE_MGT
:
597 vap
->iv_stats
.is_rx_mgmt
++;
598 IEEE80211_NODE_STAT(ni
, rx_mgmt
);
599 if (dir
!= IEEE80211_FC1_DIR_NODS
) {
600 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
601 wh
, "data", "incorrect dir 0x%x", dir
);
602 vap
->iv_stats
.is_rx_wrongdir
++;
605 if (m
->m_pkthdr
.len
< sizeof(struct ieee80211_frame
)) {
606 IEEE80211_DISCARD_MAC(vap
, IEEE80211_MSG_ANY
,
607 ni
->ni_macaddr
, "mgt", "too short: len %u",
609 vap
->iv_stats
.is_rx_tooshort
++;
612 #ifdef IEEE80211_DEBUG
613 if ((ieee80211_msg_debug(vap
) && doprint(vap
, subtype
)) ||
614 ieee80211_msg_dumppkts(vap
)) {
615 if_printf(ifp
, "received %s from %s rssi %d\n",
616 ieee80211_mgt_subtype_name(subtype
),
617 ether_sprintf(wh
->i_addr2
), rssi
);
620 if (wh
->i_fc
[1] & IEEE80211_FC1_PROTECTED
) {
621 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
622 wh
, NULL
, "%s", "WEP set but not permitted");
623 vap
->iv_stats
.is_rx_mgtdiscard
++; /* XXX */
626 vap
->iv_recv_mgmt(ni
, m
, subtype
, rxs
, rssi
, nf
);
629 case IEEE80211_FC0_TYPE_CTL
:
630 vap
->iv_stats
.is_rx_ctl
++;
631 IEEE80211_NODE_STAT(ni
, rx_ctrl
);
632 vap
->iv_recv_ctl(ni
, m
, subtype
);
636 IEEE80211_DISCARD(vap
, IEEE80211_MSG_ANY
,
637 wh
, "bad", "frame type 0x%x", type
);
638 /* should not come here */
642 if_inc_counter(ifp
, IFCOUNTER_IERRORS
, 1);
645 if (need_tap
&& ieee80211_radiotap_active_vap(vap
))
646 ieee80211_radiotap_rx(vap
, m
);
653 is11bclient(const uint8_t *rates
, const uint8_t *xrates
)
655 static const uint32_t brates
= (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
658 /* NB: the 11b clients we care about will not have xrates */
659 if (xrates
!= NULL
|| rates
== NULL
)
661 for (i
= 0; i
< rates
[1]; i
++) {
662 int r
= rates
[2+i
] & IEEE80211_RATE_VAL
;
663 if (r
> 2*11 || ((1<<r
) & brates
) == 0)
670 adhoc_recv_mgmt(struct ieee80211_node
*ni
, struct mbuf
*m0
,
671 int subtype
, const struct ieee80211_rx_stats
*rxs
, int rssi
, int nf
)
673 struct ieee80211vap
*vap
= ni
->ni_vap
;
674 struct ieee80211com
*ic
= ni
->ni_ic
;
675 struct ieee80211_channel
*rxchan
= ic
->ic_curchan
;
676 struct ieee80211_frame
*wh
;
677 uint8_t *frm
, *efrm
, *sfrm
;
678 uint8_t *ssid
, *rates
, *xrates
;
680 int ht_state_change
= 0;
683 wh
= mtod(m0
, struct ieee80211_frame
*);
684 frm
= (uint8_t *)&wh
[1];
685 efrm
= mtod(m0
, uint8_t *) + m0
->m_len
;
687 case IEEE80211_FC0_SUBTYPE_PROBE_RESP
:
688 case IEEE80211_FC0_SUBTYPE_BEACON
: {
689 struct ieee80211_scanparams scan
;
690 struct ieee80211_channel
*c
;
692 * We process beacon/probe response
693 * frames to discover neighbors.
696 c
= ieee80211_lookup_channel_rxstatus(vap
, rxs
);
700 if (ieee80211_parse_beacon(ni
, m0
, rxchan
, &scan
) != 0)
703 * Count frame now that we know it's to be processed.
705 if (subtype
== IEEE80211_FC0_SUBTYPE_BEACON
) {
706 vap
->iv_stats
.is_rx_beacon
++; /* XXX remove */
707 IEEE80211_NODE_STAT(ni
, rx_beacons
);
709 IEEE80211_NODE_STAT(ni
, rx_proberesp
);
711 * If scanning, just pass information to the scan module.
713 if (ic
->ic_flags
& IEEE80211_F_SCAN
) {
714 if (ic
->ic_flags_ext
& IEEE80211_FEXT_PROBECHAN
) {
716 * Actively scanning a channel marked passive;
717 * send a probe request now that we know there
718 * is 802.11 traffic present.
720 * XXX check if the beacon we recv'd gives
721 * us what we need and suppress the probe req
723 ieee80211_probe_curchan(vap
, 1);
724 ic
->ic_flags_ext
&= ~IEEE80211_FEXT_PROBECHAN
;
726 ieee80211_add_scan(vap
, rxchan
, &scan
, wh
,
730 if (scan
.capinfo
& IEEE80211_CAPINFO_IBSS
) {
731 if (!IEEE80211_ADDR_EQ(wh
->i_addr2
, ni
->ni_macaddr
)) {
733 * Create a new entry in the neighbor table.
735 ni
= ieee80211_add_neighbor(vap
, wh
, &scan
);
736 } else if (ni
->ni_capinfo
== 0) {
738 * Update faked node created on transmit.
739 * Note this also updates the tsf.
741 ieee80211_init_neighbor(ni
, wh
, &scan
);
744 * Record tsf for potential resync.
746 memcpy(ni
->ni_tstamp
.data
, scan
.tstamp
,
747 sizeof(ni
->ni_tstamp
));
750 * This isn't enabled yet - otherwise it would
751 * update the HT parameters and channel width
752 * from any node, which could lead to lots of
753 * strange behaviour if the 11n nodes aren't
754 * exactly configured to match.
757 if (scan
.htcap
!= NULL
&& scan
.htinfo
!= NULL
&&
758 (vap
->iv_flags_ht
& IEEE80211_FHT_HT
)) {
759 if (ieee80211_ht_updateparams(ni
,
760 scan
.htcap
, scan
.htinfo
))
765 IEEE80211_RSSI_LPF(ni
->ni_avgrssi
, rssi
);
769 * Same here - the channel width change should
770 * be applied to the specific peer node, not
771 * to the ic. Ie, the interface configuration
772 * should stay in its current channel width;
773 * but it should change the rate control and
774 * any queued frames for the given node only.
776 * Since there's no (current) way to inform
777 * the driver that a channel width change has
778 * occurred for a single node, just stub this
783 ieee80211_update_chw(ic
);
789 case IEEE80211_FC0_SUBTYPE_PROBE_REQ
:
790 if (vap
->iv_state
!= IEEE80211_S_RUN
) {
791 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
792 wh
, NULL
, "wrong state %s",
793 ieee80211_state_name
[vap
->iv_state
]);
794 vap
->iv_stats
.is_rx_mgtdiscard
++;
797 if (IEEE80211_IS_MULTICAST(wh
->i_addr2
)) {
798 /* frame must be directed */
799 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
800 wh
, NULL
, "%s", "not unicast");
801 vap
->iv_stats
.is_rx_mgtdiscard
++; /* XXX stat */
808 * [tlv] supported rates
809 * [tlv] extended supported rates
811 ssid
= rates
= xrates
= NULL
;
813 while (efrm
- frm
> 1) {
814 IEEE80211_VERIFY_LENGTH(efrm
- frm
, frm
[1] + 2, return);
816 case IEEE80211_ELEMID_SSID
:
819 case IEEE80211_ELEMID_RATES
:
822 case IEEE80211_ELEMID_XRATES
:
828 IEEE80211_VERIFY_ELEMENT(rates
, IEEE80211_RATE_MAXSIZE
, return);
830 IEEE80211_VERIFY_ELEMENT(xrates
,
831 IEEE80211_RATE_MAXSIZE
- rates
[1], return);
832 IEEE80211_VERIFY_ELEMENT(ssid
, IEEE80211_NWID_LEN
, return);
833 IEEE80211_VERIFY_SSID(vap
->iv_bss
, ssid
, return);
834 if ((vap
->iv_flags
& IEEE80211_F_HIDESSID
) && ssid
[1] == 0) {
835 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
837 "%s", "no ssid with ssid suppression enabled");
838 vap
->iv_stats
.is_rx_ssidmismatch
++; /*XXX*/
842 /* XXX find a better class or define it's own */
843 IEEE80211_NOTE_MAC(vap
, IEEE80211_MSG_INPUT
, wh
->i_addr2
,
844 "%s", "recv probe req");
846 * Some legacy 11b clients cannot hack a complete
847 * probe response frame. When the request includes
848 * only a bare-bones rate set, communicate this to
851 ieee80211_send_proberesp(vap
, wh
->i_addr2
,
852 is11bclient(rates
, xrates
) ? IEEE80211_SEND_LEGACY_11B
: 0);
855 case IEEE80211_FC0_SUBTYPE_ACTION
:
856 case IEEE80211_FC0_SUBTYPE_ACTION_NOACK
:
857 if ((ni
== vap
->iv_bss
) &&
858 !IEEE80211_ADDR_EQ(wh
->i_addr2
, ni
->ni_macaddr
)) {
859 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
860 wh
, NULL
, "%s", "unknown node");
861 vap
->iv_stats
.is_rx_mgtdiscard
++;
862 } else if (!IEEE80211_ADDR_EQ(vap
->iv_myaddr
, wh
->i_addr1
) &&
863 !IEEE80211_IS_MULTICAST(wh
->i_addr1
)) {
864 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
865 wh
, NULL
, "%s", "not for us");
866 vap
->iv_stats
.is_rx_mgtdiscard
++;
867 } else if (vap
->iv_state
!= IEEE80211_S_RUN
) {
868 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
869 wh
, NULL
, "wrong state %s",
870 ieee80211_state_name
[vap
->iv_state
]);
871 vap
->iv_stats
.is_rx_mgtdiscard
++;
873 if (ieee80211_parse_action(ni
, m0
) == 0)
874 (void)ic
->ic_recv_action(ni
, wh
, frm
, efrm
);
878 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ
:
879 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP
:
880 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ
:
881 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP
:
882 case IEEE80211_FC0_SUBTYPE_TIMING_ADV
:
883 case IEEE80211_FC0_SUBTYPE_ATIM
:
884 case IEEE80211_FC0_SUBTYPE_DISASSOC
:
885 case IEEE80211_FC0_SUBTYPE_AUTH
:
886 case IEEE80211_FC0_SUBTYPE_DEAUTH
:
887 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
888 wh
, NULL
, "%s", "not handled");
889 vap
->iv_stats
.is_rx_mgtdiscard
++;
893 IEEE80211_DISCARD(vap
, IEEE80211_MSG_ANY
,
894 wh
, "mgt", "subtype 0x%x not handled", subtype
);
895 vap
->iv_stats
.is_rx_badsubtype
++;
899 #undef IEEE80211_VERIFY_LENGTH
900 #undef IEEE80211_VERIFY_ELEMENT
903 ahdemo_recv_mgmt(struct ieee80211_node
*ni
, struct mbuf
*m0
,
904 int subtype
, const struct ieee80211_rx_stats
*rxs
, int rssi
, int nf
)
906 struct ieee80211vap
*vap
= ni
->ni_vap
;
907 struct ieee80211com
*ic
= ni
->ni_ic
;
908 struct ieee80211_frame
*wh
;
911 * Process management frames when scanning; useful for doing
914 if (ic
->ic_flags
& IEEE80211_F_SCAN
)
915 adhoc_recv_mgmt(ni
, m0
, subtype
, rxs
, rssi
, nf
);
917 wh
= mtod(m0
, struct ieee80211_frame
*);
919 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ
:
920 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP
:
921 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ
:
922 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP
:
923 case IEEE80211_FC0_SUBTYPE_PROBE_REQ
:
924 case IEEE80211_FC0_SUBTYPE_PROBE_RESP
:
925 case IEEE80211_FC0_SUBTYPE_TIMING_ADV
:
926 case IEEE80211_FC0_SUBTYPE_BEACON
:
927 case IEEE80211_FC0_SUBTYPE_ATIM
:
928 case IEEE80211_FC0_SUBTYPE_DISASSOC
:
929 case IEEE80211_FC0_SUBTYPE_AUTH
:
930 case IEEE80211_FC0_SUBTYPE_DEAUTH
:
931 case IEEE80211_FC0_SUBTYPE_ACTION
:
932 case IEEE80211_FC0_SUBTYPE_ACTION_NOACK
:
933 IEEE80211_DISCARD(vap
, IEEE80211_MSG_INPUT
,
934 wh
, NULL
, "%s", "not handled");
935 vap
->iv_stats
.is_rx_mgtdiscard
++;
938 IEEE80211_DISCARD(vap
, IEEE80211_MSG_ANY
,
939 wh
, "mgt", "subtype 0x%x not handled", subtype
);
940 vap
->iv_stats
.is_rx_badsubtype
++;
947 adhoc_recv_ctl(struct ieee80211_node
*ni
, struct mbuf
*m
, int subtype
)
951 case IEEE80211_FC0_SUBTYPE_BAR
:
952 ieee80211_recv_bar(ni
, m
);