?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Correct short preamble support.
[dragonfly.git] / sys / netproto / 802_11 / wlan / ieee80211_input.c
blobb294a7d9ebc965d6428d02b83f2ad3fd62bcb421
1 /*
2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
16 *
17 * Alternatively, this software may be distributed under the terms of the
18 * GNU General Public License ("GPL") version 2 as published by the Free
19 * Software Foundation.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 *
32 * $FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.62.2.14 2006/09/02 15:16:12 sam Exp $
33 * $DragonFly: src/sys/netproto/802_11/wlan/ieee80211_input.c,v 1.8 2006/11/25 13:11:30 sephe Exp $
34 */
35
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/mbuf.h>
39 #include <sys/malloc.h>
40 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 #include <sys/serialize.h>
43
44 #include <sys/socket.h>
45
46 #include <net/if.h>
47 #include <net/if_arp.h>
48 #include <net/ifq_var.h>
49 #include <net/if_media.h>
50 #include <net/ethernet.h>
51 #include <net/if_llc.h>
52 #include <net/vlan/if_vlan_var.h>
53
54 #include <netproto/802_11/ieee80211_var.h>
55
56 #include <net/bpf.h>
57
58 #ifdef IEEE80211_DEBUG
59 #include <machine/stdarg.h>
60
61 /*
62 * Decide if a received management frame should be
63 * printed when debugging is enabled. This filters some
64 * of the less interesting frames that come frequently
65 * (e.g. beacons).
66 */
67 static __inline int
68 doprint(struct ieee80211com *ic, int subtype)
69 {
70 switch (subtype) {
71 case IEEE80211_FC0_SUBTYPE_BEACON:
72 return (ic->ic_flags & IEEE80211_F_SCAN);
73 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
74 return (ic->ic_opmode == IEEE80211_M_IBSS);
75 }
76 return 1;
77 }
78
79 /*
80 * Emit a debug message about discarding a frame or information
81 * element. One format is for extracting the mac address from
82 * the frame header; the other is for when a header is not
83 * available or otherwise appropriate.
84 */
85 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do { \
86 if ((_ic)->ic_debug & (_m)) \
87 ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\
88 } while (0)
89 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do { \
90 if ((_ic)->ic_debug & (_m)) \
91 ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\
92 } while (0)
93 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do { \
94 if ((_ic)->ic_debug & (_m)) \
95 ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\
96 } while (0)
97
98 static const uint8_t *ieee80211_getbssid(struct ieee80211com *,
99 const struct ieee80211_frame *);
100 static void ieee80211_discard_frame(struct ieee80211com *,
101 const struct ieee80211_frame *, const char *type, const char *fmt, ...);
102 static void ieee80211_discard_ie(struct ieee80211com *,
103 const struct ieee80211_frame *, const char *type, const char *fmt, ...);
104 static void ieee80211_discard_mac(struct ieee80211com *,
105 const uint8_t mac[IEEE80211_ADDR_LEN], const char *type,
106 const char *fmt, ...);
107 #else
108 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...)
109 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...)
110 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...)
111 #endif /* IEEE80211_DEBUG */
112
113 static struct mbuf *ieee80211_defrag(struct ieee80211com *,
114 struct ieee80211_node *, struct mbuf *, int);
115 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int);
116 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *,
117 const uint8_t *mac, int subtype, int arg);
118 static void ieee80211_deliver_data(struct ieee80211com *,
119 struct ieee80211_node *, struct mbuf *);
120 static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable);
121 static void ieee80211_recv_pspoll(struct ieee80211com *,
122 struct ieee80211_node *, struct mbuf *);
123
124 /*
125 * Process a received frame. The node associated with the sender
126 * should be supplied. If nothing was found in the node table then
127 * the caller is assumed to supply a reference to ic_bss instead.
128 * The RSSI and a timestamp are also supplied. The RSSI data is used
129 * during AP scanning to select a AP to associate with; it can have
130 * any units so long as values have consistent units and higher values
131 * mean ``better signal''. The receive timestamp is currently not used
132 * by the 802.11 layer.
133 */
134 int
135 ieee80211_input(struct ieee80211com *ic, struct mbuf *m,
136 struct ieee80211_node *ni, int rssi, uint32_t rstamp)
137 {
138 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0)
139 #define HAS_SEQ(type) ((type & 0x4) == 0)
140 struct ifnet *ifp = ic->ic_ifp;
141 struct ieee80211_frame *wh;
142 struct ieee80211_key *key;
143 struct ether_header *eh;
144 int hdrspace;
145 uint8_t dir, type, subtype;
146 uint8_t *bssid;
147 uint16_t rxseq;
148
149 ASSERT_SERIALIZED(ifp->if_serializer);
150
151 KASSERT(ni != NULL, ("null node"));
152 ni->ni_inact = ni->ni_inact_reload;
153
154 type = -1; /* undefined */
155 /*
156 * In monitor mode, send everything directly to bpf.
157 * XXX may want to include the CRC
158 */
159 if (ic->ic_opmode == IEEE80211_M_MONITOR)
160 goto out;
161
162 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
163 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
164 ni->ni_macaddr, NULL,
165 "too short (1): len %u", m->m_pkthdr.len);
166 ic->ic_stats.is_rx_tooshort++;
167 goto out;
168 }
169 /*
170 * Bit of a cheat here, we use a pointer for a 3-address
171 * frame format but don't reference fields past outside
172 * ieee80211_frame_min w/o first validating the data is
173 * present.
174 */
175 wh = mtod(m, struct ieee80211_frame *);
176
177 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
178 IEEE80211_FC0_VERSION_0) {
179 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
180 ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
181 ic->ic_stats.is_rx_badversion++;
182 goto err;
183 }
184
185 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
186 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
187 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
188 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
189 switch (ic->ic_opmode) {
190 case IEEE80211_M_STA:
191 bssid = wh->i_addr2;
192 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
193 /* not interested in */
194 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
195 bssid, NULL, "%s", "not to bss");
196 ic->ic_stats.is_rx_wrongbss++;
197 goto out;
198 }
199 break;
200 case IEEE80211_M_IBSS:
201 case IEEE80211_M_AHDEMO:
202 case IEEE80211_M_HOSTAP:
203 if (dir != IEEE80211_FC1_DIR_NODS)
204 bssid = wh->i_addr1;
205 else if (type == IEEE80211_FC0_TYPE_CTL)
206 bssid = wh->i_addr1;
207 else {
208 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
209 IEEE80211_DISCARD_MAC(ic,
210 IEEE80211_MSG_ANY, ni->ni_macaddr,
211 NULL, "too short (2): len %u",
212 m->m_pkthdr.len);
213 ic->ic_stats.is_rx_tooshort++;
214 goto out;
215 }
216 bssid = wh->i_addr3;
217 }
218 if (type != IEEE80211_FC0_TYPE_DATA)
219 break;
220 /*
221 * Data frame, validate the bssid.
222 */
223 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) &&
224 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
225 /* not interested in */
226 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
227 bssid, NULL, "%s", "not to bss");
228 ic->ic_stats.is_rx_wrongbss++;
229 goto out;
230 }
231 /*
232 * For adhoc mode we cons up a node when it doesn't
233 * exist. This should probably done after an ACL check.
234 */
235 if (ni == ic->ic_bss &&
236 ic->ic_opmode != IEEE80211_M_HOSTAP &&
237 !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
238 /*
239 * Fake up a node for this newly
240 * discovered member of the IBSS.
241 */
242 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
243 wh->i_addr2);
244 if (ni == NULL) {
245 /* NB: stat kept for alloc failure */
246 goto err;
247 }
248 }
249 break;
250 default:
251 goto out;
252 }
253 ni->ni_rssi = rssi;
254 ni->ni_rstamp = rstamp;
255 if (HAS_SEQ(type)) {
256 uint8_t tid;
257 if (IEEE80211_QOS_HAS_SEQ(wh)) {
258 tid = ((struct ieee80211_qosframe *)wh)->
259 i_qos[0] & IEEE80211_QOS_TID;
260 if (TID_TO_WME_AC(tid) >= WME_AC_VI)
261 ic->ic_wme.wme_hipri_traffic++;
262 tid++;
263 } else
264 tid = 0;
265 rxseq = le16toh(*(uint16_t *)wh->i_seq);
266 if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
267 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
268 /* duplicate, discard */
269 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
270 bssid, "duplicate",
271 "seqno <%u,%u> fragno <%u,%u> tid %u",
272 rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
273 ni->ni_rxseqs[tid] >>
274 IEEE80211_SEQ_SEQ_SHIFT,
275 rxseq & IEEE80211_SEQ_FRAG_MASK,
276 ni->ni_rxseqs[tid] &
277 IEEE80211_SEQ_FRAG_MASK,
278 tid);
279 ic->ic_stats.is_rx_dup++;
280 IEEE80211_NODE_STAT(ni, rx_dup);
281 goto out;
282 }
283 ni->ni_rxseqs[tid] = rxseq;
284 }
285 }
286
287 switch (type) {
288 case IEEE80211_FC0_TYPE_DATA:
289 hdrspace = ieee80211_hdrspace(ic, wh);
290 if (m->m_len < hdrspace &&
291 (m = m_pullup(m, hdrspace)) == NULL) {
292 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
293 ni->ni_macaddr, NULL,
294 "data too short: expecting %u", hdrspace);
295 ic->ic_stats.is_rx_tooshort++;
296 goto out; /* XXX */
297 }
298 switch (ic->ic_opmode) {
299 case IEEE80211_M_STA:
300 if (dir != IEEE80211_FC1_DIR_FROMDS) {
301 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
302 wh, "data", "%s", "unknown dir 0x%x", dir);
303 ic->ic_stats.is_rx_wrongdir++;
304 goto out;
305 }
306 if ((ifp->if_flags & IFF_SIMPLEX) &&
307 IEEE80211_IS_MULTICAST(wh->i_addr1) &&
308 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) {
309 /*
310 * In IEEE802.11 network, multicast packet
311 * sent from me is broadcasted from AP.
312 * It should be silently discarded for
313 * SIMPLEX interface.
314 */
315 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
316 wh, NULL, "%s", "multicast echo");
317 ic->ic_stats.is_rx_mcastecho++;
318 goto out;
319 }
320 break;
321 case IEEE80211_M_IBSS:
322 case IEEE80211_M_AHDEMO:
323 if (dir != IEEE80211_FC1_DIR_NODS) {
324 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
325 wh, "data", "%s", "unknown dir 0x%x", dir);
326 ic->ic_stats.is_rx_wrongdir++;
327 goto out;
328 }
329 /* XXX no power-save support */
330 break;
331 case IEEE80211_M_HOSTAP:
332 if (dir != IEEE80211_FC1_DIR_TODS) {
333 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
334 wh, "data", "%s", "unknown dir 0x%x", dir);
335 ic->ic_stats.is_rx_wrongdir++;
336 goto out;
337 }
338 /* check if source STA is associated */
339 if (ni == ic->ic_bss) {
340 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
341 wh, "data", "%s", "unknown src");
342 ieee80211_send_error(ic, ni, wh->i_addr2,
343 IEEE80211_FC0_SUBTYPE_DEAUTH,
344 IEEE80211_REASON_NOT_AUTHED);
345 ic->ic_stats.is_rx_notassoc++;
346 goto err;
347 }
348 if (ni->ni_associd == 0) {
349 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
350 wh, "data", "%s", "unassoc src");
351 IEEE80211_SEND_MGMT(ic, ni,
352 IEEE80211_FC0_SUBTYPE_DISASSOC,
353 IEEE80211_REASON_NOT_ASSOCED);
354 ic->ic_stats.is_rx_notassoc++;
355 goto err;
356 }
357
358 /*
359 * Check for power save state change.
360 */
361 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
362 (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
363 ieee80211_node_pwrsave(ni,
364 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
365 break;
366 default:
367 /* XXX here to keep compiler happy */
368 goto out;
369 }
370
371 /*
372 * Handle privacy requirements. Note that we
373 * must not be preempted from here until after
374 * we (potentially) call ieee80211_crypto_demic;
375 * otherwise we may violate assumptions in the
376 * crypto cipher modules used to do delayed update
377 * of replay sequence numbers.
378 */
379 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
380 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
381 /*
382 * Discard encrypted frames when privacy is off.
383 */
384 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
385 wh, "WEP", "%s", "PRIVACY off");
386 ic->ic_stats.is_rx_noprivacy++;
387 IEEE80211_NODE_STAT(ni, rx_noprivacy);
388 goto out;
389 }
390 key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
391 if (key == NULL) {
392 /* NB: stats+msgs handled in crypto_decap */
393 IEEE80211_NODE_STAT(ni, rx_wepfail);
394 goto out;
395 }
396 wh = mtod(m, struct ieee80211_frame *);
397 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
398 } else {
399 key = NULL;
400 }
401
402 /*
403 * Next up, any fragmentation.
404 */
405 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
406 m = ieee80211_defrag(ic, ni, m, hdrspace);
407 if (m == NULL) {
408 /* Fragment dropped or frame not complete yet */
409 goto out;
410 }
411 }
412 wh = NULL; /* no longer valid, catch any uses */
413
414 /*
415 * Next strip any MSDU crypto bits.
416 */
417 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) {
418 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
419 ni->ni_macaddr, "data", "%s", "demic error");
420 ic->ic_stats.is_rx_demicfail++;
421 IEEE80211_NODE_STAT(ni, rx_demicfail);
422 goto out;
423 }
424
425 /* copy to listener after decrypt */
426 if (ic->ic_rawbpf)
427 bpf_mtap(ic->ic_rawbpf, m);
428
429 /*
430 * Finally, strip the 802.11 header.
431 */
432 m = ieee80211_decap(ic, m, hdrspace);
433 if (m == NULL) {
434 /* don't count Null data frames as errors */
435 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA)
436 goto out;
437 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
438 ni->ni_macaddr, "data", "%s", "decap error");
439 ic->ic_stats.is_rx_decap++;
440 IEEE80211_NODE_STAT(ni, rx_decap);
441 goto err;
442 }
443 eh = mtod(m, struct ether_header *);
444 if (!ieee80211_node_is_authorized(ni)) {
445 /*
446 * Deny any non-PAE frames received prior to
447 * authorization. For open/shared-key
448 * authentication the port is mark authorized
449 * after authentication completes. For 802.1x
450 * the port is not marked authorized by the
451 * authenticator until the handshake has completed.
452 */
453 if (eh->ether_type != htons(ETHERTYPE_PAE)) {
454 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
455 eh->ether_shost, "data",
456 "unauthorized port: ether type 0x%x len %u",
457 eh->ether_type, m->m_pkthdr.len);
458 ic->ic_stats.is_rx_unauth++;
459 IEEE80211_NODE_STAT(ni, rx_unauth);
460 goto err;
461 }
462 } else {
463 /*
464 * When denying unencrypted frames, discard
465 * any non-PAE frames received without encryption.
466 */
467 if ((ic->ic_flags & IEEE80211_F_DROPUNENC) &&
468 key == NULL &&
469 eh->ether_type != htons(ETHERTYPE_PAE)) {
470 /*
471 * Drop unencrypted frames.
472 */
473 ic->ic_stats.is_rx_unencrypted++;
474 IEEE80211_NODE_STAT(ni, rx_unencrypted);
475 goto out;
476 }
477 }
478 ieee80211_deliver_data(ic, ni, m);
479 return IEEE80211_FC0_TYPE_DATA;
480
481 case IEEE80211_FC0_TYPE_MGT:
482 ic->ic_stats.is_rx_mgmt++;
483 IEEE80211_NODE_STAT(ni, rx_mgmt);
484 if (dir != IEEE80211_FC1_DIR_NODS) {
485 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
486 wh, "data", "%s", "unknown dir 0x%x", dir);
487 ic->ic_stats.is_rx_wrongdir++;
488 goto err;
489 }
490 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
491 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
492 ni->ni_macaddr, "mgt", "too short: len %u",
493 m->m_pkthdr.len);
494 ic->ic_stats.is_rx_tooshort++;
495 goto out;
496 }
497 #ifdef IEEE80211_DEBUG
498 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) ||
499 ieee80211_msg_dumppkts(ic)) {
500 if_printf(ic->ic_ifp, "received %s from %6D rssi %d\n",
501 ieee80211_mgt_subtype_name[subtype >>
502 IEEE80211_FC0_SUBTYPE_SHIFT],
503 wh->i_addr2, ":", rssi);
504 }
505 #endif
506 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
507 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
508 /*
509 * Only shared key auth frames with a challenge
510 * should be encrypted, discard all others.
511 */
512 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
513 wh, ieee80211_mgt_subtype_name[subtype >>
514 IEEE80211_FC0_SUBTYPE_SHIFT],
515 "%s", "WEP set but not permitted");
516 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */
517 goto out;
518 }
519 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
520 /*
521 * Discard encrypted frames when privacy is off.
522 */
523 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
524 wh, "mgt", "%s", "WEP set but PRIVACY off");
525 ic->ic_stats.is_rx_noprivacy++;
526 goto out;
527 }
528 hdrspace = ieee80211_hdrspace(ic, wh);
529 key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
530 if (key == NULL) {
531 /* NB: stats+msgs handled in crypto_decap */
532 goto out;
533 }
534 wh = mtod(m, struct ieee80211_frame *);
535 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
536 }
537 if (ic->ic_rawbpf)
538 bpf_mtap(ic->ic_rawbpf, m);
539 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
540 m_freem(m);
541 return type;
542
543 case IEEE80211_FC0_TYPE_CTL:
544 IEEE80211_NODE_STAT(ni, rx_ctrl);
545 ic->ic_stats.is_rx_ctl++;
546 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
547 switch (subtype) {
548 case IEEE80211_FC0_SUBTYPE_PS_POLL:
549 ieee80211_recv_pspoll(ic, ni, m);
550 break;
551 }
552 }
553 goto out;
554 default:
555 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
556 wh, NULL, "bad frame type 0x%x", type);
557 /* should not come here */
558 break;
559 }
560 err:
561 ifp->if_ierrors++;
562 out:
563 if (m != NULL) {
564 if (ic->ic_rawbpf)
565 bpf_mtap(ic->ic_rawbpf, m);
566 m_freem(m);
567 }
568 return type;
569 #undef SEQ_LEQ
570 }
571
572 /*
573 * This function reassemble fragments.
574 */
575 static struct mbuf *
576 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni,
577 struct mbuf *m, int hdrspace)
578 {
579 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
580 struct ieee80211_frame *lwh;
581 uint16_t rxseq;
582 uint8_t fragno;
583 uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
584 struct mbuf *mfrag;
585
586 KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
587
588 rxseq = le16toh(*(uint16_t *)wh->i_seq);
589 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
590
591 /* Quick way out, if there's nothing to defragment */
592 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
593 return m;
594
595 /*
596 * Remove frag to insure it doesn't get reaped by timer.
597 */
598 if (ni->ni_table == NULL) {
599 /*
600 * Should never happen. If the node is orphaned (not in
601 * the table) then input packets should not reach here.
602 * Otherwise, a concurrent request that yanks the table
603 * should be blocked by other interlocking and/or by first
604 * shutting the driver down. Regardless, be defensive
605 * here and just bail
606 */
607 /* XXX need msg+stat */
608 m_freem(m);
609 return NULL;
610 }
611 mfrag = ni->ni_rxfrag[0];
612 ni->ni_rxfrag[0] = NULL;
613
614 /*
615 * Validate new fragment is in order and
616 * related to the previous ones.
617 */
618 if (mfrag != NULL) {
619 uint16_t last_rxseq;
620
621 lwh = mtod(mfrag, struct ieee80211_frame *);
622 last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
623 /* NB: check seq # and frag together */
624 if (rxseq != last_rxseq+1 ||
625 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
626 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
627 /*
628 * Unrelated fragment or no space for it,
629 * clear current fragments.
630 */
631 m_freem(mfrag);
632 mfrag = NULL;
633 }
634 }
635
636 if (mfrag == NULL) {
637 if (fragno != 0) { /* !first fragment, discard */
638 ic->ic_stats.is_rx_defrag++;
639 IEEE80211_NODE_STAT(ni, rx_defrag);
640 m_freem(m);
641 return NULL;
642 }
643 mfrag = m;
644 } else { /* concatenate */
645 m_adj(m, hdrspace); /* strip header */
646 m_cat(mfrag, m);
647 /* NB: m_cat doesn't update the packet header */
648 mfrag->m_pkthdr.len += m->m_pkthdr.len;
649 /* track last seqnum and fragno */
650 lwh = mtod(mfrag, struct ieee80211_frame *);
651 *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
652 }
653 if (more_frag) { /* more to come, save */
654 ni->ni_rxfragstamp = ticks;
655 ni->ni_rxfrag[0] = mfrag;
656 mfrag = NULL;
657 }
658 return mfrag;
659 }
660
661 static void
662 ieee80211_deliver_data(struct ieee80211com *ic,
663 struct ieee80211_node *ni, struct mbuf *m)
664 {
665 struct ether_header *eh = mtod(m, struct ether_header *);
666 struct ifnet *ifp = ic->ic_ifp;
667
668 /*
669 * Do accounting.
670 */
671 ifp->if_ipackets++;
672 IEEE80211_NODE_STAT(ni, rx_data);
673 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
674 if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
675 m->m_flags |= M_MCAST; /* XXX M_BCAST? */
676 IEEE80211_NODE_STAT(ni, rx_mcast);
677 } else {
678 IEEE80211_NODE_STAT(ni, rx_ucast);
679 }
680
681 /* perform as a bridge within the AP */
682 if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
683 (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) {
684 struct mbuf *m1 = NULL;
685
686 if (m->m_flags & M_MCAST) {
687 m1 = m_dup(m, MB_DONTWAIT);
688 if (m1 == NULL)
689 ifp->if_oerrors++;
690 else
691 m1->m_flags |= M_MCAST;
692 } else {
693 /*
694 * Check if the destination is known; if so
695 * and the port is authorized dispatch directly.
696 */
697 struct ieee80211_node *sta =
698 ieee80211_find_node(&ic->ic_sta, eh->ether_dhost);
699 if (sta != NULL) {
700 if (ieee80211_node_is_authorized(sta)) {
701 /*
702 * Beware of sending to ourself; this
703 * needs to happen via the normal
704 * input path.
705 */
706 if (sta != ic->ic_bss) {
707 m1 = m;
708 m = NULL;
709 }
710 } else {
711 ic->ic_stats.is_rx_unauth++;
712 IEEE80211_NODE_STAT(sta, rx_unauth);
713 }
714 ieee80211_free_node(sta);
715 }
716 }
717 if (m1 != NULL) {
718 /* XXX bypasses ALTQ */
719 ifq_handoff(ifp, m1, NULL);
720 }
721 }
722 if (m != NULL) {
723 #ifdef FREEBSD_VLAN
724 if (ni->ni_vlan != 0) {
725 /* attach vlan tag */
726 VLAN_INPUT_TAG_NEW(ifp, m, ni->ni_vlan);
727 if (m == NULL)
728 goto out; /* XXX goto err? */
729 }
730 #endif
731 ifp->if_input(ifp, m);
732 }
733 return;
734
735 #ifdef FREEBSD_VLAN
736 out:
737 if (m != NULL) {
738 if (ic->ic_rawbpf)
739 bpf_mtap(ic->ic_rawbpf, m);
740 m_freem(m);
741 }
742 #endif
743 }
744
745 static struct mbuf *
746 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen)
747 {
748 struct ieee80211_qosframe_addr4 wh; /* Max size address frames */
749 struct ether_header *eh;
750 struct llc *llc;
751
752 if (m->m_len < hdrlen + sizeof(*llc) &&
753 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
754 /* XXX stat, msg */
755 return NULL;
756 }
757 memcpy(&wh, mtod(m, caddr_t), hdrlen);
758 llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
759 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
760 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
761 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
762 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
763 llc = NULL;
764 } else {
765 m_adj(m, hdrlen - sizeof(*eh));
766 }
767 eh = mtod(m, struct ether_header *);
768 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
769 case IEEE80211_FC1_DIR_NODS:
770 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
771 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
772 break;
773 case IEEE80211_FC1_DIR_TODS:
774 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
775 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
776 break;
777 case IEEE80211_FC1_DIR_FROMDS:
778 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
779 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
780 break;
781 case IEEE80211_FC1_DIR_DSTODS:
782 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
783 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
784 break;
785 }
786 #ifdef ALIGNED_POINTER
787 if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
788 struct mbuf *n, *n0, **np;
789 caddr_t newdata;
790 int off, pktlen;
791
792 n0 = NULL;
793 np = &n0;
794 off = 0;
795 pktlen = m->m_pkthdr.len;
796 while (pktlen > off) {
797 if (n0 == NULL) {
798 MGETHDR(n, M_DONTWAIT, MT_DATA);
799 if (n == NULL) {
800 m_freem(m);
801 return NULL;
802 }
803 M_MOVE_PKTHDR(n, m);
804 n->m_len = MHLEN;
805 } else {
806 MGET(n, M_DONTWAIT, MT_DATA);
807 if (n == NULL) {
808 m_freem(m);
809 m_freem(n0);
810 return NULL;
811 }
812 n->m_len = MLEN;
813 }
814 if (pktlen - off >= MINCLSIZE) {
815 MCLGET(n, M_DONTWAIT);
816 if (n->m_flags & M_EXT)
817 n->m_len = n->m_ext.ext_size;
818 }
819 if (n0 == NULL) {
820 newdata =
821 (caddr_t)ALIGN(n->m_data + sizeof(*eh)) -
822 sizeof(*eh);
823 n->m_len -= newdata - n->m_data;
824 n->m_data = newdata;
825 }
826 if (n->m_len > pktlen - off)
827 n->m_len = pktlen - off;
828 m_copydata(m, off, n->m_len, mtod(n, caddr_t));
829 off += n->m_len;
830 *np = n;
831 np = &n->m_next;
832 }
833 m_freem(m);
834 m = n0;
835 }
836 #endif /* ALIGNED_POINTER */
837 if (llc != NULL) {
838 eh = mtod(m, struct ether_header *);
839 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
840 }
841 return m;
842 }
843
844 /*
845 * Install received rate set information in the node's state block.
846 */
847 int
848 ieee80211_setup_rates(struct ieee80211_node *ni,
849 const uint8_t *rates, const uint8_t *xrates, int flags)
850 {
851 struct ieee80211com *ic = ni->ni_ic;
852 struct ieee80211_rateset *rs = &ni->ni_rates;
853
854 memset(rs, 0, sizeof(*rs));
855 rs->rs_nrates = rates[1];
856 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
857 if (xrates != NULL) {
858 uint8_t nxrates;
859 /*
860 * Tack on 11g extended supported rate element.
861 */
862 nxrates = xrates[1];
863 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
864 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
865 IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE,
866 "[%6D] extended rate set too large;"
867 " only using %u of %u rates\n",
868 ni->ni_macaddr, ":", nxrates, xrates[1]);
869 ic->ic_stats.is_rx_rstoobig++;
870 }
871 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
872 rs->rs_nrates += nxrates;
873 }
874 return ieee80211_fix_rate(ni, flags);
875 }
876
877 static void
878 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh,
879 struct ieee80211_node *ni, int rssi, uint32_t rstamp, uint16_t seq,
880 uint16_t status)
881 {
882
883 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
884 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
885 ni->ni_macaddr, "open auth",
886 "bad sta auth mode %u", ni->ni_authmode);
887 ic->ic_stats.is_rx_bad_auth++; /* XXX */
888 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
889 /* XXX hack to workaround calling convention */
890 ieee80211_send_error(ic, ni, wh->i_addr2,
891 IEEE80211_FC0_SUBTYPE_AUTH,
892 (seq + 1) | (IEEE80211_STATUS_ALG<<16));
893 }
894 return;
895 }
896 switch (ic->ic_opmode) {
897 case IEEE80211_M_IBSS:
898 case IEEE80211_M_AHDEMO:
899 case IEEE80211_M_MONITOR:
900 /* should not come here */
901 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
902 ni->ni_macaddr, "open auth",
903 "bad operating mode %u", ic->ic_opmode);
904 break;
905
906 case IEEE80211_M_HOSTAP:
907 if (ic->ic_state != IEEE80211_S_RUN ||
908 seq != IEEE80211_AUTH_OPEN_REQUEST) {
909 ic->ic_stats.is_rx_bad_auth++;
910 return;
911 }
912 /* always accept open authentication requests */
913 if (ni == ic->ic_bss) {
914 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
915 if (ni == NULL)
916 return;
917 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
918 (void) ieee80211_ref_node(ni);
919 /*
920 * Mark the node as referenced to reflect that it's
921 * reference count has been bumped to insure it remains
922 * after the transaction completes.
923 */
924 ni->ni_flags |= IEEE80211_NODE_AREF;
925
926 IEEE80211_SEND_MGMT(ic, ni,
927 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
928 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
929 "[%6D] station authenticated (open)\n",
930 ni->ni_macaddr, ":");
931 /*
932 * When 802.1x is not in use mark the port
933 * authorized at this point so traffic can flow.
934 */
935 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
936 ieee80211_node_authorize(ni);
937 break;
938
939 case IEEE80211_M_STA:
940 if (ic->ic_state != IEEE80211_S_AUTH ||
941 seq != IEEE80211_AUTH_OPEN_RESPONSE) {
942 ic->ic_stats.is_rx_bad_auth++;
943 return;
944 }
945 if (status != 0) {
946 IEEE80211_DPRINTF(ic,
947 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
948 "[%6D] open auth failed (reason %d)\n",
949 ni->ni_macaddr, ":", status);
950 /* XXX can this happen? */
951 if (ni != ic->ic_bss)
952 ni->ni_fails++;
953 ic->ic_stats.is_rx_auth_fail++;
954 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
955 } else
956 ieee80211_new_state(ic, IEEE80211_S_ASSOC,
957 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
958 break;
959 }
960 }
961
962 /*
963 * Send a management frame error response to the specified
964 * station. If ni is associated with the station then use
965 * it; otherwise allocate a temporary node suitable for
966 * transmitting the frame and then free the reference so
967 * it will go away as soon as the frame has been transmitted.
968 */
969 static void
970 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni,
971 const uint8_t *mac, int subtype, int arg)
972 {
973 int istmp;
974
975 if (ni == ic->ic_bss) {
976 ni = ieee80211_tmp_node(ic, mac);
977 if (ni == NULL) {
978 /* XXX msg */
979 return;
980 }
981 istmp = 1;
982 } else
983 istmp = 0;
984 IEEE80211_SEND_MGMT(ic, ni, subtype, arg);
985 if (istmp)
986 ieee80211_free_node(ni);
987 }
988
989 static int
990 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni)
991 {
992 if (ni->ni_challenge == NULL)
993 MALLOC(ni->ni_challenge, uint32_t*, IEEE80211_CHALLENGE_LEN,
994 M_DEVBUF, M_NOWAIT);
995 if (ni->ni_challenge == NULL) {
996 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
997 "[%6D] shared key challenge alloc failed\n",
998 ni->ni_macaddr, ":");
999 /* XXX statistic */
1000 }
1001 return (ni->ni_challenge != NULL);
1002 }
1003
1004 /* XXX TODO: add statistics */
1005 static void
1006 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh,
1007 uint8_t *frm, uint8_t *efrm, struct ieee80211_node *ni, int rssi,
1008 uint32_t rstamp, uint16_t seq, uint16_t status)
1009 {
1010 uint8_t *challenge;
1011 int allocbs, estatus;
1012
1013 /*
1014 * NB: this can happen as we allow pre-shared key
1015 * authentication to be enabled w/o wep being turned
1016 * on so that configuration of these can be done
1017 * in any order. It may be better to enforce the
1018 * ordering in which case this check would just be
1019 * for sanity/consistency.
1020 */
1021 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
1022 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1023 ni->ni_macaddr, "shared key auth",
1024 "%s", " PRIVACY is disabled");
1025 estatus = IEEE80211_STATUS_ALG;
1026 goto bad;
1027 }
1028 /*
1029 * Pre-shared key authentication is evil; accept
1030 * it only if explicitly configured (it is supported
1031 * mainly for compatibility with clients like OS X).
1032 */
1033 if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1034 ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1035 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1036 ni->ni_macaddr, "shared key auth",
1037 "bad sta auth mode %u", ni->ni_authmode);
1038 ic->ic_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1039 estatus = IEEE80211_STATUS_ALG;
1040 goto bad;
1041 }
1042
1043 challenge = NULL;
1044 if (frm + 1 < efrm) {
1045 if ((frm[1] + 2) > (efrm - frm)) {
1046 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1047 ni->ni_macaddr, "shared key auth",
1048 "ie %d/%d too long",
1049 frm[0], (frm[1] + 2) - (efrm - frm));
1050 ic->ic_stats.is_rx_bad_auth++;
1051 estatus = IEEE80211_STATUS_CHALLENGE;
1052 goto bad;
1053 }
1054 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1055 challenge = frm;
1056 frm += frm[1] + 2;
1057 }
1058 switch (seq) {
1059 case IEEE80211_AUTH_SHARED_CHALLENGE:
1060 case IEEE80211_AUTH_SHARED_RESPONSE:
1061 if (challenge == NULL) {
1062 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1063 ni->ni_macaddr, "shared key auth",
1064 "%s", "no challenge");
1065 ic->ic_stats.is_rx_bad_auth++;
1066 estatus = IEEE80211_STATUS_CHALLENGE;
1067 goto bad;
1068 }
1069 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1070 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1071 ni->ni_macaddr, "shared key auth",
1072 "bad challenge len %d", challenge[1]);
1073 ic->ic_stats.is_rx_bad_auth++;
1074 estatus = IEEE80211_STATUS_CHALLENGE;
1075 goto bad;
1076 }
1077 default:
1078 break;
1079 }
1080 switch (ic->ic_opmode) {
1081 case IEEE80211_M_MONITOR:
1082 case IEEE80211_M_AHDEMO:
1083 case IEEE80211_M_IBSS:
1084 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1085 ni->ni_macaddr, "shared key auth",
1086 "bad operating mode %u", ic->ic_opmode);
1087 return;
1088 case IEEE80211_M_HOSTAP:
1089 if (ic->ic_state != IEEE80211_S_RUN) {
1090 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1091 ni->ni_macaddr, "shared key auth",
1092 "bad state %u", ic->ic_state);
1093 estatus = IEEE80211_STATUS_ALG; /* XXX */
1094 goto bad;
1095 }
1096 switch (seq) {
1097 case IEEE80211_AUTH_SHARED_REQUEST:
1098 if (ni == ic->ic_bss) {
1099 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
1100 if (ni == NULL) {
1101 /* NB: no way to return an error */
1102 return;
1103 }
1104 allocbs = 1;
1105 } else {
1106 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1107 (void) ieee80211_ref_node(ni);
1108 allocbs = 0;
1109 }
1110 /*
1111 * Mark the node as referenced to reflect that it's
1112 * reference count has been bumped to insure it remains
1113 * after the transaction completes.
1114 */
1115 ni->ni_flags |= IEEE80211_NODE_AREF;
1116 ni->ni_rssi = rssi;
1117 ni->ni_rstamp = rstamp;
1118 if (!alloc_challenge(ic, ni)) {
1119 /* NB: don't return error so they rexmit */
1120 return;
1121 }
1122 get_random_bytes(ni->ni_challenge,
1123 IEEE80211_CHALLENGE_LEN);
1124 IEEE80211_DPRINTF(ic,
1125 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1126 "[%6D] shared key %sauth request\n",
1127 ni->ni_macaddr, ":",
1128 allocbs ? "" : "re");
1129 break;
1130 case IEEE80211_AUTH_SHARED_RESPONSE:
1131 if (ni == ic->ic_bss) {
1132 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1133 ni->ni_macaddr, "shared key response",
1134 "%s", "unknown station");
1135 /* NB: don't send a response */
1136 return;
1137 }
1138 if (ni->ni_challenge == NULL) {
1139 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1140 ni->ni_macaddr, "shared key response",
1141 "%s", "no challenge recorded");
1142 ic->ic_stats.is_rx_bad_auth++;
1143 estatus = IEEE80211_STATUS_CHALLENGE;
1144 goto bad;
1145 }
1146 if (memcmp(ni->ni_challenge, &challenge[2],
1147 challenge[1]) != 0) {
1148 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1149 ni->ni_macaddr, "shared key response",
1150 "%s", "challenge mismatch");
1151 ic->ic_stats.is_rx_auth_fail++;
1152 estatus = IEEE80211_STATUS_CHALLENGE;
1153 goto bad;
1154 }
1155 IEEE80211_DPRINTF(ic,
1156 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1157 "[%6D] station authenticated (shared key)\n",
1158 ni->ni_macaddr, ":");
1159 ieee80211_node_authorize(ni);
1160 break;
1161 default:
1162 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1163 ni->ni_macaddr, "shared key auth",
1164 "bad seq %d", seq);
1165 ic->ic_stats.is_rx_bad_auth++;
1166 estatus = IEEE80211_STATUS_SEQUENCE;
1167 goto bad;
1168 }
1169 IEEE80211_SEND_MGMT(ic, ni,
1170 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1171 break;
1172
1173 case IEEE80211_M_STA:
1174 if (ic->ic_state != IEEE80211_S_AUTH)
1175 return;
1176 switch (seq) {
1177 case IEEE80211_AUTH_SHARED_PASS:
1178 if (ni->ni_challenge != NULL) {
1179 FREE(ni->ni_challenge, M_DEVBUF);
1180 ni->ni_challenge = NULL;
1181 }
1182 if (status != 0) {
1183 IEEE80211_DPRINTF(ic,
1184 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1185 "[%6D] shared key auth failed (reason %d)\n",
1186 ieee80211_getbssid(ic, wh), ":", status);
1187 /* XXX can this happen? */
1188 if (ni != ic->ic_bss)
1189 ni->ni_fails++;
1190 ic->ic_stats.is_rx_auth_fail++;
1191 return;
1192 }
1193 ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1194 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1195 break;
1196 case IEEE80211_AUTH_SHARED_CHALLENGE:
1197 if (!alloc_challenge(ic, ni))
1198 return;
1199 /* XXX could optimize by passing recvd challenge */
1200 memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1201 IEEE80211_SEND_MGMT(ic, ni,
1202 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1203 break;
1204 default:
1205 IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH,
1206 wh, "shared key auth", "bad seq %d", seq);
1207 ic->ic_stats.is_rx_bad_auth++;
1208 return;
1209 }
1210 break;
1211 }
1212 return;
1213 bad:
1214 /*
1215 * Send an error response; but only when operating as an AP.
1216 */
1217 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1218 /* XXX hack to workaround calling convention */
1219 ieee80211_send_error(ic, ni, wh->i_addr2,
1220 IEEE80211_FC0_SUBTYPE_AUTH,
1221 (seq + 1) | (estatus<<16));
1222 } else if (ic->ic_opmode == IEEE80211_M_STA) {
1223 /*
1224 * Kick the state machine. This short-circuits
1225 * using the mgt frame timeout to trigger the
1226 * state transition.
1227 */
1228 if (ic->ic_state == IEEE80211_S_AUTH)
1229 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1230 }
1231 }
1232
1233 /* Verify the existence and length of __elem or get out. */
1234 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \
1235 if ((__elem) == NULL) { \
1236 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \
1237 wh, ieee80211_mgt_subtype_name[subtype >> \
1238 IEEE80211_FC0_SUBTYPE_SHIFT], \
1239 "%s", "no " #__elem ); \
1240 ic->ic_stats.is_rx_elem_missing++; \
1241 return; \
1242 } \
1243 if ((__elem)[1] > (__maxlen)) { \
1244 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \
1245 wh, ieee80211_mgt_subtype_name[subtype >> \
1246 IEEE80211_FC0_SUBTYPE_SHIFT], \
1247 "bad " #__elem " len %d", (__elem)[1]); \
1248 ic->ic_stats.is_rx_elem_toobig++; \
1249 return; \
1250 } \
1251 } while (0)
1252
1253 #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \
1254 if ((_len) < (_minlen)) { \
1255 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \
1256 wh, ieee80211_mgt_subtype_name[subtype >> \
1257 IEEE80211_FC0_SUBTYPE_SHIFT], \
1258 "%s", "ie too short"); \
1259 ic->ic_stats.is_rx_elem_toosmall++; \
1260 return; \
1261 } \
1262 } while (0)
1263
1264 #ifdef IEEE80211_DEBUG
1265 static void
1266 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag,
1267 uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
1268 {
1269 printf("[%6D] discard %s frame, ssid mismatch: ", mac, ":", tag);
1270 ieee80211_print_essid(ssid + 2, ssid[1]);
1271 printf("\n");
1272 }
1273
1274 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \
1275 if ((_ssid)[1] != 0 && \
1276 ((_ssid)[1] != (_ni)->ni_esslen || \
1277 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \
1278 if (ieee80211_msg_input(ic)) \
1279 ieee80211_ssid_mismatch(ic, \
1280 ieee80211_mgt_subtype_name[subtype >> \
1281 IEEE80211_FC0_SUBTYPE_SHIFT], \
1282 wh->i_addr2, _ssid); \
1283 ic->ic_stats.is_rx_ssidmismatch++; \
1284 return; \
1285 } \
1286 } while (0)
1287 #else /* !IEEE80211_DEBUG */
1288 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \
1289 if ((_ssid)[1] != 0 && \
1290 ((_ssid)[1] != (_ni)->ni_esslen || \
1291 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \
1292 ic->ic_stats.is_rx_ssidmismatch++; \
1293 return; \
1294 } \
1295 } while (0)
1296 #endif /* !IEEE80211_DEBUG */
1297
1298 /* unalligned little endian access */
1299 #define LE_READ_2(p) \
1300 ((uint16_t) \
1301 ((((const uint8_t *)(p))[0] ) | \
1302 (((const uint8_t *)(p))[1] << 8)))
1303 #define LE_READ_4(p) \
1304 ((uint32_t) \
1305 ((((const uint8_t *)(p))[0] ) | \
1306 (((const uint8_t *)(p))[1] << 8) | \
1307 (((const uint8_t *)(p))[2] << 16) | \
1308 (((const uint8_t *)(p))[3] << 24)))
1309
1310 static int __inline
1311 iswpaoui(const uint8_t *frm)
1312 {
1313 return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
1314 }
1315
1316 static int __inline
1317 iswmeoui(const uint8_t *frm)
1318 {
1319 return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI);
1320 }
1321
1322 static int __inline
1323 iswmeparam(const uint8_t *frm)
1324 {
1325 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1326 frm[6] == WME_PARAM_OUI_SUBTYPE;
1327 }
1328
1329 static int __inline
1330 iswmeinfo(const uint8_t *frm)
1331 {
1332 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1333 frm[6] == WME_INFO_OUI_SUBTYPE;
1334 }
1335
1336 static int __inline
1337 isatherosoui(const uint8_t *frm)
1338 {
1339 return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
1340 }
1341
1342 /*
1343 * Convert a WPA cipher selector OUI to an internal
1344 * cipher algorithm. Where appropriate we also
1345 * record any key length.
1346 */
1347 static int
1348 wpa_cipher(uint8_t *sel, uint8_t *keylen)
1349 {
1350 #define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1351 uint32_t w = LE_READ_4(sel);
1352
1353 switch (w) {
1354 case WPA_SEL(WPA_CSE_NULL):
1355 return IEEE80211_CIPHER_NONE;
1356 case WPA_SEL(WPA_CSE_WEP40):
1357 if (keylen)
1358 *keylen = 40 / NBBY;
1359 return IEEE80211_CIPHER_WEP;
1360 case WPA_SEL(WPA_CSE_WEP104):
1361 if (keylen)
1362 *keylen = 104 / NBBY;
1363 return IEEE80211_CIPHER_WEP;
1364 case WPA_SEL(WPA_CSE_TKIP):
1365 return IEEE80211_CIPHER_TKIP;
1366 case WPA_SEL(WPA_CSE_CCMP):
1367 return IEEE80211_CIPHER_AES_CCM;
1368 }
1369 return 32; /* NB: so 1<< is discarded */
1370 #undef WPA_SEL
1371 }
1372
1373 /*
1374 * Convert a WPA key management/authentication algorithm
1375 * to an internal code.
1376 */
1377 static int
1378 wpa_keymgmt(uint8_t *sel)
1379 {
1380 #define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1381 uint32_t w = LE_READ_4(sel);
1382
1383 switch (w) {
1384 case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1385 return WPA_ASE_8021X_UNSPEC;
1386 case WPA_SEL(WPA_ASE_8021X_PSK):
1387 return WPA_ASE_8021X_PSK;
1388 case WPA_SEL(WPA_ASE_NONE):
1389 return WPA_ASE_NONE;
1390 }
1391 return 0; /* NB: so is discarded */
1392 #undef WPA_SEL
1393 }
1394
1395 /*
1396 * Parse a WPA information element to collect parameters
1397 * and validate the parameters against what has been
1398 * configured for the system.
1399 */
1400 static int
1401 ieee80211_parse_wpa(struct ieee80211com *ic, uint8_t *frm,
1402 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1403 {
1404 uint8_t len = frm[1];
1405 uint32_t w;
1406 int n;
1407
1408 /*
1409 * Check the length once for fixed parts: OUI, type,
1410 * version, mcast cipher, and 2 selector counts.
1411 * Other, variable-length data, must be checked separately.
1412 */
1413 if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) {
1414 IEEE80211_DISCARD_IE(ic,
1415 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1416 wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags);
1417 return IEEE80211_REASON_IE_INVALID;
1418 }
1419 if (len < 14) {
1420 IEEE80211_DISCARD_IE(ic,
1421 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1422 wh, "WPA", "too short, len %u", len);
1423 return IEEE80211_REASON_IE_INVALID;
1424 }
1425 frm += 6, len -= 4; /* NB: len is payload only */
1426 /* NB: iswapoui already validated the OUI and type */
1427 w = LE_READ_2(frm);
1428 if (w != WPA_VERSION) {
1429 IEEE80211_DISCARD_IE(ic,
1430 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1431 wh, "WPA", "bad version %u", w);
1432 return IEEE80211_REASON_IE_INVALID;
1433 }
1434 frm += 2, len -= 2;
1435
1436 /* multicast/group cipher */
1437 w = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1438 if (w != rsn->rsn_mcastcipher) {
1439 IEEE80211_DISCARD_IE(ic,
1440 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1441 wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
1442 w, rsn->rsn_mcastcipher);
1443 return IEEE80211_REASON_IE_INVALID;
1444 }
1445 frm += 4, len -= 4;
1446
1447 /* unicast ciphers */
1448 n = LE_READ_2(frm);
1449 frm += 2, len -= 2;
1450 if (len < n*4+2) {
1451 IEEE80211_DISCARD_IE(ic,
1452 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1453 wh, "WPA", "ucast cipher data too short; len %u, n %u",
1454 len, n);
1455 return IEEE80211_REASON_IE_INVALID;
1456 }
1457 w = 0;
1458 for (; n > 0; n--) {
1459 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1460 frm += 4, len -= 4;
1461 }
1462 w &= rsn->rsn_ucastcipherset;
1463 if (w == 0) {
1464 IEEE80211_DISCARD_IE(ic,
1465 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1466 wh, "WPA", "%s", "ucast cipher set empty");
1467 return IEEE80211_REASON_IE_INVALID;
1468 }
1469 if (w & (1<<IEEE80211_CIPHER_TKIP))
1470 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1471 else
1472 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1473
1474 /* key management algorithms */
1475 n = LE_READ_2(frm);
1476 frm += 2, len -= 2;
1477 if (len < n*4) {
1478 IEEE80211_DISCARD_IE(ic,
1479 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1480 wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1481 len, n);
1482 return IEEE80211_REASON_IE_INVALID;
1483 }
1484 w = 0;
1485 for (; n > 0; n--) {
1486 w |= wpa_keymgmt(frm);
1487 frm += 4, len -= 4;
1488 }
1489 w &= rsn->rsn_keymgmtset;
1490 if (w == 0) {
1491 IEEE80211_DISCARD_IE(ic,
1492 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1493 wh, "WPA", "%s", "no acceptable key mgmt alg");
1494 return IEEE80211_REASON_IE_INVALID;
1495 }
1496 if (w & WPA_ASE_8021X_UNSPEC)
1497 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1498 else
1499 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1500
1501 if (len > 2) /* optional capabilities */
1502 rsn->rsn_caps = LE_READ_2(frm);
1503
1504 return 0;
1505 }
1506
1507 /*
1508 * Convert an RSN cipher selector OUI to an internal
1509 * cipher algorithm. Where appropriate we also
1510 * record any key length.
1511 */
1512 static int
1513 rsn_cipher(uint8_t *sel, uint8_t *keylen)
1514 {
1515 #define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1516 uint32_t w = LE_READ_4(sel);
1517
1518 switch (w) {
1519 case RSN_SEL(RSN_CSE_NULL):
1520 return IEEE80211_CIPHER_NONE;
1521 case RSN_SEL(RSN_CSE_WEP40):
1522 if (keylen)
1523 *keylen = 40 / NBBY;
1524 return IEEE80211_CIPHER_WEP;
1525 case RSN_SEL(RSN_CSE_WEP104):
1526 if (keylen)
1527 *keylen = 104 / NBBY;
1528 return IEEE80211_CIPHER_WEP;
1529 case RSN_SEL(RSN_CSE_TKIP):
1530 return IEEE80211_CIPHER_TKIP;
1531 case RSN_SEL(RSN_CSE_CCMP):
1532 return IEEE80211_CIPHER_AES_CCM;
1533 case RSN_SEL(RSN_CSE_WRAP):
1534 return IEEE80211_CIPHER_AES_OCB;
1535 }
1536 return 32; /* NB: so 1<< is discarded */
1537 #undef WPA_SEL
1538 }
1539
1540 /*
1541 * Convert an RSN key management/authentication algorithm
1542 * to an internal code.
1543 */
1544 static int
1545 rsn_keymgmt(uint8_t *sel)
1546 {
1547 #define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1548 uint32_t w = LE_READ_4(sel);
1549
1550 switch (w) {
1551 case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1552 return RSN_ASE_8021X_UNSPEC;
1553 case RSN_SEL(RSN_ASE_8021X_PSK):
1554 return RSN_ASE_8021X_PSK;
1555 case RSN_SEL(RSN_ASE_NONE):
1556 return RSN_ASE_NONE;
1557 }
1558 return 0; /* NB: so is discarded */
1559 #undef RSN_SEL
1560 }
1561
1562 /*
1563 * Parse a WPA/RSN information element to collect parameters
1564 * and validate the parameters against what has been
1565 * configured for the system.
1566 */
1567 static int
1568 ieee80211_parse_rsn(struct ieee80211com *ic, uint8_t *frm,
1569 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1570 {
1571 uint8_t len = frm[1];
1572 uint32_t w;
1573 int n;
1574
1575 /*
1576 * Check the length once for fixed parts:
1577 * version, mcast cipher, and 2 selector counts.
1578 * Other, variable-length data, must be checked separately.
1579 */
1580 if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) {
1581 IEEE80211_DISCARD_IE(ic,
1582 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1583 wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags);
1584 return IEEE80211_REASON_IE_INVALID;
1585 }
1586 if (len < 10) {
1587 IEEE80211_DISCARD_IE(ic,
1588 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1589 wh, "RSN", "too short, len %u", len);
1590 return IEEE80211_REASON_IE_INVALID;
1591 }
1592 frm += 2;
1593 w = LE_READ_2(frm);
1594 if (w != RSN_VERSION) {
1595 IEEE80211_DISCARD_IE(ic,
1596 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1597 wh, "RSN", "bad version %u", w);
1598 return IEEE80211_REASON_IE_INVALID;
1599 }
1600 frm += 2, len -= 2;
1601
1602 /* multicast/group cipher */
1603 w = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1604 if (w != rsn->rsn_mcastcipher) {
1605 IEEE80211_DISCARD_IE(ic,
1606 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1607 wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
1608 w, rsn->rsn_mcastcipher);
1609 return IEEE80211_REASON_IE_INVALID;
1610 }
1611 frm += 4, len -= 4;
1612
1613 /* unicast ciphers */
1614 n = LE_READ_2(frm);
1615 frm += 2, len -= 2;
1616 if (len < n*4+2) {
1617 IEEE80211_DISCARD_IE(ic,
1618 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1619 wh, "RSN", "ucast cipher data too short; len %u, n %u",
1620 len, n);
1621 return IEEE80211_REASON_IE_INVALID;
1622 }
1623 w = 0;
1624 for (; n > 0; n--) {
1625 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1626 frm += 4, len -= 4;
1627 }
1628 w &= rsn->rsn_ucastcipherset;
1629 if (w == 0) {
1630 IEEE80211_DISCARD_IE(ic,
1631 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1632 wh, "RSN", "%s", "ucast cipher set empty");
1633 return IEEE80211_REASON_IE_INVALID;
1634 }
1635 if (w & (1<<IEEE80211_CIPHER_TKIP))
1636 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1637 else
1638 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1639
1640 /* key management algorithms */
1641 n = LE_READ_2(frm);
1642 frm += 2, len -= 2;
1643 if (len < n*4) {
1644 IEEE80211_DISCARD_IE(ic,
1645 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1646 wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1647 len, n);
1648 return IEEE80211_REASON_IE_INVALID;
1649 }
1650 w = 0;
1651 for (; n > 0; n--) {
1652 w |= rsn_keymgmt(frm);
1653 frm += 4, len -= 4;
1654 }
1655 w &= rsn->rsn_keymgmtset;
1656 if (w == 0) {
1657 IEEE80211_DISCARD_IE(ic,
1658 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1659 wh, "RSN", "%s", "no acceptable key mgmt alg");
1660 return IEEE80211_REASON_IE_INVALID;
1661 }
1662 if (w & RSN_ASE_8021X_UNSPEC)
1663 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1664 else
1665 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1666
1667 /* optional RSN capabilities */
1668 if (len > 2)
1669 rsn->rsn_caps = LE_READ_2(frm);
1670 /* XXXPMKID */
1671
1672 return 0;
1673 }
1674
1675 static int
1676 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm,
1677 const struct ieee80211_frame *wh)
1678 {
1679 #define MS(_v, _f) (((_v) & _f) >> _f##_S)
1680 struct ieee80211_wme_state *wme = &ic->ic_wme;
1681 u_int len = frm[1], qosinfo;
1682 int i;
1683
1684 if (len < sizeof(struct ieee80211_wme_param)-2) {
1685 IEEE80211_DISCARD_IE(ic,
1686 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1687 wh, "WME", "too short, len %u", len);
1688 return -1;
1689 }
1690 qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1691 qosinfo &= WME_QOSINFO_COUNT;
1692 /* XXX do proper check for wraparound */
1693 if (qosinfo == wme->wme_wmeChanParams.cap_info)
1694 return 0;
1695 frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1696 for (i = 0; i < WME_NUM_AC; i++) {
1697 struct wmeParams *wmep =
1698 &wme->wme_wmeChanParams.cap_wmeParams[i];
1699 /* NB: ACI not used */
1700 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1701 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1702 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1703 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1704 wmep->wmep_txopLimit = LE_READ_2(frm+2);
1705 frm += 4;
1706 }
1707 wme->wme_wmeChanParams.cap_info = qosinfo;
1708 return 1;
1709 #undef MS
1710 }
1711
1712 void
1713 ieee80211_saveie(uint8_t **iep, const uint8_t *ie)
1714 {
1715 u_int ielen = ie[1]+2;
1716 /*
1717 * Record information element for later use.
1718 */
1719 if (*iep == NULL || (*iep)[1] != ie[1]) {
1720 if (*iep != NULL)
1721 FREE(*iep, M_DEVBUF);
1722 MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT);
1723 }
1724 if (*iep != NULL)
1725 memcpy(*iep, ie, ielen);
1726 /* XXX note failure */
1727 }
1728
1729 /* XXX find a better place for definition */
1730 struct l2_update_frame {
1731 struct ether_header eh;
1732 uint8_t dsap;
1733 uint8_t ssap;
1734 uint8_t control;
1735 uint8_t xid[3];
1736 } __packed;
1737
1738 /*
1739 * Deliver a TGf L2UF frame on behalf of a station.
1740 * This primes any bridge when the station is roaming
1741 * between ap's on the same wired network.
1742 */
1743 static void
1744 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1745 {
1746 struct ieee80211com *ic = ni->ni_ic;
1747 struct ifnet *ifp = ic->ic_ifp;
1748 struct mbuf *m;
1749 struct l2_update_frame *l2uf;
1750 struct ether_header *eh;
1751
1752 m = m_gethdr(M_NOWAIT, MT_DATA);
1753 if (m == NULL) {
1754 IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1755 "%s", "no mbuf for l2uf frame");
1756 ic->ic_stats.is_rx_nobuf++; /* XXX not right */
1757 return;
1758 }
1759 l2uf = mtod(m, struct l2_update_frame *);
1760 eh = &l2uf->eh;
1761 /* dst: Broadcast address */
1762 IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1763 /* src: associated STA */
1764 IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1765 eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1766
1767 l2uf->dsap = 0;
1768 l2uf->ssap = 0;
1769 l2uf->control = 0xf5;
1770 l2uf->xid[0] = 0x81;
1771 l2uf->xid[1] = 0x80;
1772 l2uf->xid[2] = 0x00;
1773
1774 m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1775 m->m_pkthdr.rcvif = ifp;
1776 ieee80211_deliver_data(ic, ni, m);
1777 }
1778
1779 void
1780 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
1781 struct ieee80211_node *ni,
1782 int subtype, int rssi, uint32_t rstamp)
1783 {
1784 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1785 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1786 struct ieee80211_frame *wh;
1787 uint8_t *frm, *efrm;
1788 uint8_t *ssid, *rates, *xrates, *wpa, *wme;
1789 int reassoc, resp, allocbs;
1790 uint8_t rate;
1791
1792 wh = mtod(m0, struct ieee80211_frame *);
1793 frm = (uint8_t *)&wh[1];
1794 efrm = mtod(m0, uint8_t *) + m0->m_len;
1795 switch (subtype) {
1796 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1797 case IEEE80211_FC0_SUBTYPE_BEACON: {
1798 struct ieee80211_scanparams scan;
1799
1800 /*
1801 * We process beacon/probe response frames:
1802 * o when scanning, or
1803 * o station mode when associated (to collect state
1804 * updates such as 802.11g slot time), or
1805 * o adhoc mode (to discover neighbors)
1806 * Frames otherwise received are discarded.
1807 */
1808 if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
1809 (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) ||
1810 ic->ic_opmode == IEEE80211_M_IBSS)) {
1811 ic->ic_stats.is_rx_mgtdiscard++;
1812 return;
1813 }
1814 /*
1815 * beacon/probe response frame format
1816 * [8] time stamp
1817 * [2] beacon interval
1818 * [2] capability information
1819 * [tlv] ssid
1820 * [tlv] supported rates
1821 * [tlv] country information
1822 * [tlv] parameter set (FH/DS)
1823 * [tlv] erp information
1824 * [tlv] extended supported rates
1825 * [tlv] WME
1826 * [tlv] WPA or RSN
1827 */
1828 IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
1829 memset(&scan, 0, sizeof(scan));
1830 scan.tstamp = frm; frm += 8;
1831 scan.bintval = le16toh(*(uint16_t *)frm); frm += 2;
1832 scan.capinfo = le16toh(*(uint16_t *)frm); frm += 2;
1833 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1834 scan.chan = scan.bchan;
1835
1836 while (efrm - frm > 1) {
1837 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
1838 switch (*frm) {
1839 case IEEE80211_ELEMID_SSID:
1840 scan.ssid = frm;
1841 break;
1842 case IEEE80211_ELEMID_RATES:
1843 scan.rates = frm;
1844 break;
1845 case IEEE80211_ELEMID_COUNTRY:
1846 scan.country = frm;
1847 break;
1848 case IEEE80211_ELEMID_FHPARMS:
1849 if (ic->ic_phytype == IEEE80211_T_FH) {
1850 scan.fhdwell = LE_READ_2(&frm[2]);
1851 scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
1852 scan.fhindex = frm[6];
1853 }
1854 break;
1855 case IEEE80211_ELEMID_DSPARMS:
1856 /*
1857 * XXX hack this since depending on phytype
1858 * is problematic for multi-mode devices.
1859 */
1860 if (ic->ic_phytype != IEEE80211_T_FH)
1861 scan.chan = frm[2];
1862 break;
1863 case IEEE80211_ELEMID_TIM:
1864 /* XXX ATIM? */
1865 scan.tim = frm;
1866 scan.timoff = frm - mtod(m0, uint8_t *);
1867 break;
1868 case IEEE80211_ELEMID_IBSSPARMS:
1869 break;
1870 case IEEE80211_ELEMID_XRATES:
1871 scan.xrates = frm;
1872 break;
1873 case IEEE80211_ELEMID_ERP:
1874 if (frm[1] != 1) {
1875 IEEE80211_DISCARD_IE(ic,
1876 IEEE80211_MSG_ELEMID, wh, "ERP",
1877 "bad len %u", frm[1]);
1878 ic->ic_stats.is_rx_elem_toobig++;
1879 break;
1880 }
1881 scan.erp = frm[2];
1882 break;
1883 case IEEE80211_ELEMID_RSN:
1884 scan.wpa = frm;
1885 break;
1886 case IEEE80211_ELEMID_VENDOR:
1887 if (iswpaoui(frm))
1888 scan.wpa = frm;
1889 else if (iswmeparam(frm) || iswmeinfo(frm))
1890 scan.wme = frm;
1891 /* XXX Atheros OUI support */
1892 break;
1893 default:
1894 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID,
1895 wh, "unhandled",
1896 "id %u, len %u", *frm, frm[1]);
1897 ic->ic_stats.is_rx_elem_unknown++;
1898 break;
1899 }
1900 frm += frm[1] + 2;
1901 }
1902 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
1903 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
1904 if (
1905 #if IEEE80211_CHAN_MAX < 255
1906 scan.chan > IEEE80211_CHAN_MAX ||
1907 #endif
1908 isclr(ic->ic_chan_active, scan.chan)) {
1909 IEEE80211_DISCARD(ic,
1910 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1911 wh, ieee80211_mgt_subtype_name[subtype >>
1912 IEEE80211_FC0_SUBTYPE_SHIFT],
1913 "invalid channel %u", scan.chan);
1914 ic->ic_stats.is_rx_badchan++;
1915 return;
1916 }
1917 if (scan.chan != scan.bchan &&
1918 ic->ic_phytype != IEEE80211_T_FH) {
1919 /*
1920 * Frame was received on a channel different from the
1921 * one indicated in the DS params element id;
1922 * silently discard it.
1923 *
1924 * NB: this can happen due to signal leakage.
1925 * But we should take it for FH phy because
1926 * the rssi value should be correct even for
1927 * different hop pattern in FH.
1928 */
1929 IEEE80211_DISCARD(ic,
1930 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1931 wh, ieee80211_mgt_subtype_name[subtype >>
1932 IEEE80211_FC0_SUBTYPE_SHIFT],
1933 "for off-channel %u", scan.chan);
1934 ic->ic_stats.is_rx_chanmismatch++;
1935 return;
1936 }
1937 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
1938 scan.bintval <= IEEE80211_BINTVAL_MAX)) {
1939 IEEE80211_DISCARD(ic,
1940 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1941 wh, ieee80211_mgt_subtype_name[subtype >>
1942 IEEE80211_FC0_SUBTYPE_SHIFT],
1943 "bogus beacon interval", scan.bintval);
1944 ic->ic_stats.is_rx_badbintval++;
1945 return;
1946 }
1947
1948 /*
1949 * Count frame now that we know it's to be processed.
1950 */
1951 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1952 ic->ic_stats.is_rx_beacon++; /* XXX remove */
1953 IEEE80211_NODE_STAT(ni, rx_beacons);
1954 } else
1955 IEEE80211_NODE_STAT(ni, rx_proberesp);
1956
1957 /*
1958 * When operating in station mode, check for state updates.
1959 * Be careful to ignore beacons received while doing a
1960 * background scan. We consider only 11g/WMM stuff right now.
1961 */
1962 if (ic->ic_opmode == IEEE80211_M_STA &&
1963 ni->ni_associd != 0 &&
1964 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1965 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1966 /* record tsf of last beacon */
1967 memcpy(ni->ni_tstamp.data, scan.tstamp,
1968 sizeof(ni->ni_tstamp));
1969 /* count beacon frame for s/w bmiss handling */
1970 ic->ic_swbmiss_count++;
1971 ic->ic_bmiss_count = 0;
1972 if (ni->ni_erp != scan.erp) {
1973 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1974 "[%6D] erp change: was 0x%x, now 0x%x\n",
1975 wh->i_addr2, ":", ni->ni_erp, scan.erp);
1976 if (ic->ic_curmode == IEEE80211_MODE_11G &&
1977 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1978 ic->ic_flags |= IEEE80211_F_USEPROT;
1979 else
1980 ic->ic_flags &= ~IEEE80211_F_USEPROT;
1981 ni->ni_erp = scan.erp;
1982 /* XXX statistic */
1983 }
1984 if (ni->ni_capinfo != scan.capinfo) {
1985 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1986 "[%6D] capabilities change: before 0x%x,"
1987 " now 0x%x\n",
1988 wh->i_addr2, ":",
1989 ni->ni_capinfo, scan.capinfo);
1990
1991 if ((ni->ni_capinfo ^ scan.capinfo) &
1992 IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1993 ieee80211_set_shortslottime(ic,
1994 ic->ic_curmode == IEEE80211_MODE_11A ||
1995 (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1996 }
1997 ni->ni_capinfo = scan.capinfo;
1998 /* XXX statistic */
1999 }
2000
2001 /* NOTE: after ni_capinfo and ni_erp updates */
2002 ieee80211_set_shortpreamble(ic, ni);
2003
2004 if (scan.wme != NULL &&
2005 (ni->ni_flags & IEEE80211_NODE_QOS) &&
2006 ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0)
2007 ieee80211_wme_updateparams(ic);
2008 if (scan.tim != NULL) {
2009 struct ieee80211_tim_ie *ie =
2010 (struct ieee80211_tim_ie *) scan.tim;
2011
2012 ni->ni_dtim_count = ie->tim_count;
2013 ni->ni_dtim_period = ie->tim_period;
2014 }
2015 if (ic->ic_flags & IEEE80211_F_SCAN)
2016 ieee80211_add_scan(ic, &scan, wh,
2017 subtype, rssi, rstamp);
2018 return;
2019 }
2020 /*
2021 * If scanning, just pass information to the scan module.
2022 */
2023 if (ic->ic_flags & IEEE80211_F_SCAN) {
2024 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
2025 /*
2026 * Actively scanning a channel marked passive;
2027 * send a probe request now that we know there
2028 * is 802.11 traffic present.
2029 *
2030 * XXX check if the beacon we recv'd gives
2031 * us what we need and suppress the probe req
2032 */
2033 ieee80211_probe_curchan(ic, 1);
2034 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
2035 }
2036 ieee80211_add_scan(ic, &scan, wh,
2037 subtype, rssi, rstamp);
2038 return;
2039 }
2040 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
2041 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2042 /*
2043 * Create a new entry in the neighbor table.
2044 */
2045 ni = ieee80211_add_neighbor(ic, wh, &scan);
2046 } else if (ni->ni_capinfo == 0) {
2047 /*
2048 * Update faked node created on transmit.
2049 * Note this also updates the tsf.
2050 */
2051 ieee80211_init_neighbor(ni, wh, &scan);
2052 } else {
2053 /*
2054 * Record tsf for potential resync.
2055 */
2056 memcpy(ni->ni_tstamp.data, scan.tstamp,
2057 sizeof(ni->ni_tstamp));
2058 }
2059 if (ni != NULL) {
2060 ni->ni_rssi = rssi;
2061 ni->ni_rstamp = rstamp;
2062 }
2063 }
2064 break;
2065 }
2066
2067 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2068 if (ic->ic_opmode == IEEE80211_M_STA ||
2069 ic->ic_state != IEEE80211_S_RUN) {
2070 ic->ic_stats.is_rx_mgtdiscard++;
2071 return;
2072 }
2073 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2074 /* frame must be directed */
2075 ic->ic_stats.is_rx_mgtdiscard++; /* XXX stat */
2076 return;
2077 }
2078
2079 /*
2080 * prreq frame format
2081 * [tlv] ssid
2082 * [tlv] supported rates
2083 * [tlv] extended supported rates
2084 */
2085 ssid = rates = xrates = NULL;
2086 while (efrm - frm > 1) {
2087 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2088 switch (*frm) {
2089 case IEEE80211_ELEMID_SSID:
2090 ssid = frm;
2091 break;
2092 case IEEE80211_ELEMID_RATES:
2093 rates = frm;
2094 break;
2095 case IEEE80211_ELEMID_XRATES:
2096 xrates = frm;
2097 break;
2098 }
2099 frm += frm[1] + 2;
2100 }
2101 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2102 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2103 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2104 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
2105 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
2106 wh, ieee80211_mgt_subtype_name[subtype >>
2107 IEEE80211_FC0_SUBTYPE_SHIFT],
2108 "%s", "no ssid with ssid suppression enabled");
2109 ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/
2110 return;
2111 }
2112
2113 allocbs = 0;
2114 if (ni == ic->ic_bss) {
2115 if (ic->ic_opmode != IEEE80211_M_IBSS) {
2116 ni = ieee80211_tmp_node(ic, wh->i_addr2);
2117 allocbs = 1;
2118 } else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2119 /*
2120 * XXX Cannot tell if the sender is operating
2121 * in ibss mode. But we need a new node to
2122 * send the response so blindly add them to the
2123 * neighbor table.
2124 */
2125 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
2126 wh->i_addr2);
2127 }
2128 if (ni == NULL)
2129 return;
2130 }
2131 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2132 "[%6D] recv probe req\n", wh->i_addr2, ":");
2133 ni->ni_rssi = rssi;
2134 ni->ni_rstamp = rstamp;
2135 rate = ieee80211_setup_rates(ni, rates, xrates,
2136 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE
2137 | IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2138 if (rate & IEEE80211_RATE_BASIC) {
2139 IEEE80211_DISCARD(ic, IEEE80211_MSG_XRATE,
2140 wh, ieee80211_mgt_subtype_name[subtype >>
2141 IEEE80211_FC0_SUBTYPE_SHIFT],
2142 "%s", "recv'd rate set invalid");
2143 } else {
2144 IEEE80211_SEND_MGMT(ic, ni,
2145 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
2146 }
2147 if (allocbs) {
2148 /*
2149 * Temporary node created just to send a
2150 * response, reclaim immediately.
2151 */
2152 ieee80211_free_node(ni);
2153 }
2154 break;
2155
2156 case IEEE80211_FC0_SUBTYPE_AUTH: {
2157 uint16_t algo, seq, status;
2158 /*
2159 * auth frame format
2160 * [2] algorithm
2161 * [2] sequence
2162 * [2] status
2163 * [tlv*] challenge
2164 */
2165 IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
2166 algo = le16toh(*(uint16_t *)frm);
2167 seq = le16toh(*(uint16_t *)(frm + 2));
2168 status = le16toh(*(uint16_t *)(frm + 4));
2169 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2170 "[%6D] recv auth frame with algorithm %d seq %d\n",
2171 wh->i_addr2, ":", algo, seq);
2172 /*
2173 * Consult the ACL policy module if setup.
2174 */
2175 if (ic->ic_acl != NULL &&
2176 !ic->ic_acl->iac_check(ic, wh->i_addr2)) {
2177 IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL,
2178 wh, "auth", "%s", "disallowed by ACL");
2179 ic->ic_stats.is_rx_acl++;
2180 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2181 IEEE80211_SEND_MGMT(ic, ni,
2182 IEEE80211_FC0_SUBTYPE_AUTH,
2183 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
2184 }
2185 return;
2186 }
2187 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
2188 IEEE80211_DISCARD(ic,
2189 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
2190 wh, "auth", "%s", "TKIP countermeasures enabled");
2191 ic->ic_stats.is_rx_auth_countermeasures++;
2192 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2193 IEEE80211_SEND_MGMT(ic, ni,
2194 IEEE80211_FC0_SUBTYPE_AUTH,
2195 IEEE80211_REASON_MIC_FAILURE);
2196 }
2197 return;
2198 }
2199 if (algo == IEEE80211_AUTH_ALG_SHARED)
2200 ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi,
2201 rstamp, seq, status);
2202 else if (algo == IEEE80211_AUTH_ALG_OPEN)
2203 ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq,
2204 status);
2205 else {
2206 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2207 wh, "auth", "unsupported alg %d", algo);
2208 ic->ic_stats.is_rx_auth_unsupported++;
2209 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2210 /* XXX not right */
2211 IEEE80211_SEND_MGMT(ic, ni,
2212 IEEE80211_FC0_SUBTYPE_AUTH,
2213 (seq+1) | (IEEE80211_STATUS_ALG<<16));
2214 }
2215 return;
2216 }
2217 break;
2218 }
2219
2220 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2221 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
2222 uint16_t capinfo, lintval;
2223 struct ieee80211_rsnparms rsn;
2224 uint8_t reason;
2225
2226 if (ic->ic_opmode != IEEE80211_M_HOSTAP ||
2227 ic->ic_state != IEEE80211_S_RUN) {
2228 ic->ic_stats.is_rx_mgtdiscard++;
2229 return;
2230 }
2231
2232 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
2233 reassoc = 1;
2234 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
2235 } else {
2236 reassoc = 0;
2237 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
2238 }
2239 /*
2240 * asreq frame format
2241 * [2] capability information
2242 * [2] listen interval
2243 * [6*] current AP address (reassoc only)
2244 * [tlv] ssid
2245 * [tlv] supported rates
2246 * [tlv] extended supported rates
2247 * [tlv] WPA or RSN
2248 */
2249 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4));
2250 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) {
2251 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2252 wh, ieee80211_mgt_subtype_name[subtype >>
2253 IEEE80211_FC0_SUBTYPE_SHIFT],
2254 "%s", "wrong bssid");
2255 ic->ic_stats.is_rx_assoc_bss++;
2256 return;
2257 }
2258 capinfo = le16toh(*(uint16_t *)frm); frm += 2;
2259 lintval = le16toh(*(uint16_t *)frm); frm += 2;
2260 if (reassoc)
2261 frm += 6; /* ignore current AP info */
2262 ssid = rates = xrates = wpa = wme = NULL;
2263 while (efrm - frm > 1) {
2264 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2265 switch (*frm) {
2266 case IEEE80211_ELEMID_SSID:
2267 ssid = frm;
2268 break;
2269 case IEEE80211_ELEMID_RATES:
2270 rates = frm;
2271 break;
2272 case IEEE80211_ELEMID_XRATES:
2273 xrates = frm;
2274 break;
2275 /* XXX verify only one of RSN and WPA ie's? */
2276 case IEEE80211_ELEMID_RSN:
2277 wpa = frm;
2278 break;
2279 case IEEE80211_ELEMID_VENDOR:
2280 if (iswpaoui(frm))
2281 wpa = frm;
2282 else if (iswmeinfo(frm))
2283 wme = frm;
2284 /* XXX Atheros OUI support */
2285 break;
2286 }
2287 frm += frm[1] + 2;
2288 }
2289 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2290 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2291 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2292
2293 if (ni == ic->ic_bss) {
2294 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2295 "[%6D] deny %s request, sta not authenticated\n",
2296 wh->i_addr2, ":", reassoc ? "reassoc" : "assoc");
2297 ieee80211_send_error(ic, ni, wh->i_addr2,
2298 IEEE80211_FC0_SUBTYPE_DEAUTH,
2299 IEEE80211_REASON_ASSOC_NOT_AUTHED);
2300 ic->ic_stats.is_rx_assoc_notauth++;
2301 return;
2302 }
2303 /* assert right associstion security credentials */
2304 if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) {
2305 IEEE80211_DPRINTF(ic,
2306 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2307 "[%6D] no WPA/RSN IE in association request\n",
2308 wh->i_addr2, ":");
2309 IEEE80211_SEND_MGMT(ic, ni,
2310 IEEE80211_FC0_SUBTYPE_DEAUTH,
2311 IEEE80211_REASON_RSN_REQUIRED);
2312 ieee80211_node_leave(ic, ni);
2313 /* XXX distinguish WPA/RSN? */
2314 ic->ic_stats.is_rx_assoc_badwpaie++;
2315 return;
2316 }
2317 if (wpa != NULL) {
2318 /*
2319 * Parse WPA information element. Note that
2320 * we initialize the param block from the node
2321 * state so that information in the IE overrides
2322 * our defaults. The resulting parameters are
2323 * installed below after the association is assured.
2324 */
2325 rsn = ni->ni_rsn;
2326 if (wpa[0] != IEEE80211_ELEMID_RSN)
2327 reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh);
2328 else
2329 reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh);
2330 if (reason != 0) {
2331 IEEE80211_SEND_MGMT(ic, ni,
2332 IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
2333 ieee80211_node_leave(ic, ni);
2334 /* XXX distinguish WPA/RSN? */
2335 ic->ic_stats.is_rx_assoc_badwpaie++;
2336 return;
2337 }
2338 IEEE80211_DPRINTF(ic,
2339 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2340 "[%6D] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n",
2341 wh->i_addr2, ":",
2342 wpa[0] != IEEE80211_ELEMID_RSN ? "WPA" : "RSN",
2343 rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen,
2344 rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen,
2345 rsn.rsn_keymgmt, rsn.rsn_caps);
2346 }
2347 /* discard challenge after association */
2348 if (ni->ni_challenge != NULL) {
2349 FREE(ni->ni_challenge, M_DEVBUF);
2350 ni->ni_challenge = NULL;
2351 }
2352 /* NB: 802.11 spec says to ignore station's privacy bit */
2353 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2354 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2355 "[%6D] deny %s request, capability mismatch 0x%x\n",
2356 wh->i_addr2, ":",
2357 reassoc ? "reassoc" : "assoc", capinfo);
2358 IEEE80211_SEND_MGMT(ic, ni, resp,
2359 IEEE80211_STATUS_CAPINFO);
2360 ieee80211_node_leave(ic, ni);
2361 ic->ic_stats.is_rx_assoc_capmismatch++;
2362 return;
2363 }
2364 rate = ieee80211_setup_rates(ni, rates, xrates,
2365 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2366 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2367 /*
2368 * If constrained to 11g-only stations reject an
2369 * 11b-only station. We cheat a bit here by looking
2370 * at the max negotiated xmit rate and assuming anyone
2371 * with a best rate <24Mb/s is an 11b station.
2372 */
2373 if ((rate & IEEE80211_RATE_BASIC) ||
2374 ((ic->ic_flags & IEEE80211_F_PUREG) && rate < 48)) {
2375 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2376 "[%6D] deny %s request, rate set mismatch\n",
2377 wh->i_addr2, ":",
2378 reassoc ? "reassoc" : "assoc");
2379 IEEE80211_SEND_MGMT(ic, ni, resp,
2380 IEEE80211_STATUS_BASIC_RATE);
2381 ieee80211_node_leave(ic, ni);
2382 ic->ic_stats.is_rx_assoc_norate++;
2383 return;
2384 }
2385 ni->ni_rssi = rssi;
2386 ni->ni_rstamp = rstamp;
2387 ni->ni_intval = lintval;
2388 ni->ni_capinfo = capinfo;
2389 ni->ni_chan = ic->ic_bss->ni_chan;
2390 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell;
2391 ni->ni_fhindex = ic->ic_bss->ni_fhindex;
2392 if (wpa != NULL) {
2393 /*
2394 * Record WPA/RSN parameters for station, mark
2395 * node as using WPA and record information element
2396 * for applications that require it.
2397 */
2398 ni->ni_rsn = rsn;
2399 ieee80211_saveie(&ni->ni_wpa_ie, wpa);
2400 } else if (ni->ni_wpa_ie != NULL) {
2401 /*
2402 * Flush any state from a previous association.
2403 */
2404 FREE(ni->ni_wpa_ie, M_DEVBUF);
2405 ni->ni_wpa_ie = NULL;
2406 }
2407 if (wme != NULL) {
2408 /*
2409 * Record WME parameters for station, mark node
2410 * as capable of QoS and record information
2411 * element for applications that require it.
2412 */
2413 ieee80211_saveie(&ni->ni_wme_ie, wme);
2414 ni->ni_flags |= IEEE80211_NODE_QOS;
2415 } else if (ni->ni_wme_ie != NULL) {
2416 /*
2417 * Flush any state from a previous association.
2418 */
2419 FREE(ni->ni_wme_ie, M_DEVBUF);
2420 ni->ni_wme_ie = NULL;
2421 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2422 }
2423 ieee80211_deliver_l2uf(ni);
2424 ieee80211_node_join(ic, ni, resp);
2425 break;
2426 }
2427
2428 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2429 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
2430 uint16_t capinfo, associd;
2431 uint16_t status;
2432
2433 if (ic->ic_opmode != IEEE80211_M_STA ||
2434 ic->ic_state != IEEE80211_S_ASSOC) {
2435 ic->ic_stats.is_rx_mgtdiscard++;
2436 return;
2437 }
2438
2439 /*
2440 * asresp frame format
2441 * [2] capability information
2442 * [2] status
2443 * [2] association ID
2444 * [tlv] supported rates
2445 * [tlv] extended supported rates
2446 * [tlv] WME
2447 */
2448 IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
2449 ni = ic->ic_bss;
2450 capinfo = le16toh(*(uint16_t *)frm);
2451 frm += 2;
2452 status = le16toh(*(uint16_t *)frm);
2453 frm += 2;
2454 if (status != 0) {
2455 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2456 "[%6D] %sassoc failed (reason %d)\n",
2457 wh->i_addr2, ":",
2458 ISREASSOC(subtype) ? "re" : "", status);
2459 if (ni != ic->ic_bss) /* XXX never true? */
2460 ni->ni_fails++;
2461 ic->ic_stats.is_rx_auth_fail++; /* XXX */
2462 return;
2463 }
2464 associd = le16toh(*(uint16_t *)frm);
2465 frm += 2;
2466
2467 rates = xrates = wpa = wme = NULL;
2468 while (efrm - frm > 1) {
2469 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2470 switch (*frm) {
2471 case IEEE80211_ELEMID_RATES:
2472 rates = frm;
2473 break;
2474 case IEEE80211_ELEMID_XRATES:
2475 xrates = frm;
2476 break;
2477 case IEEE80211_ELEMID_VENDOR:
2478 if (iswmeoui(frm))
2479 wme = frm;
2480 /* XXX Atheros OUI support */
2481 break;
2482 }
2483 frm += frm[1] + 2;
2484 }
2485
2486 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2487 rate = ieee80211_setup_rates(ni, rates, xrates,
2488 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2489 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2490 if (rate & IEEE80211_RATE_BASIC) {
2491 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2492 "[%6D] %sassoc failed (rate set mismatch)\n",
2493 wh->i_addr2, ":",
2494 ISREASSOC(subtype) ? "re" : "");
2495 if (ni != ic->ic_bss) /* XXX never true? */
2496 ni->ni_fails++;
2497 ic->ic_stats.is_rx_assoc_norate++;
2498 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
2499 return;
2500 }
2501
2502 ni->ni_capinfo = capinfo;
2503 ni->ni_associd = associd;
2504 if (wme != NULL &&
2505 ieee80211_parse_wmeparams(ic, wme, wh) >= 0) {
2506 ni->ni_flags |= IEEE80211_NODE_QOS;
2507 ieee80211_wme_updateparams(ic);
2508 } else
2509 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2510 /*
2511 * Configure state now that we are associated.
2512 *
2513 * XXX may need different/additional driver callbacks?
2514 */
2515 ieee80211_set_shortpreamble(ic, ni);
2516 ieee80211_set_shortslottime(ic,
2517 ic->ic_curmode == IEEE80211_MODE_11A ||
2518 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2519 /*
2520 * Honor ERP protection.
2521 *
2522 * NB: ni_erp should zero for non-11g operation.
2523 * XXX check ic_curmode anyway?
2524 */
2525 if (ic->ic_curmode == IEEE80211_MODE_11G &&
2526 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2527 ic->ic_flags |= IEEE80211_F_USEPROT;
2528 else
2529 ic->ic_flags &= ~IEEE80211_F_USEPROT;
2530 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2531 "[%6D] %sassoc success: %s preamble, %s slot time%s%s\n",
2532 wh->i_addr2, ":",
2533 ISREASSOC(subtype) ? "re" : "",
2534 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
2535 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
2536 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
2537 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : ""
2538 );
2539 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
2540 break;
2541 }
2542
2543 case IEEE80211_FC0_SUBTYPE_DEAUTH: {
2544 uint16_t reason;
2545
2546 if (ic->ic_state == IEEE80211_S_SCAN) {
2547 ic->ic_stats.is_rx_mgtdiscard++;
2548 return;
2549 }
2550 /*
2551 * deauth frame format
2552 * [2] reason
2553 */
2554 IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
2555 reason = le16toh(*(uint16_t *)frm);
2556 ic->ic_stats.is_rx_deauth++;
2557 IEEE80211_NODE_STAT(ni, rx_deauth);
2558
2559 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2560 "[%6D] recv deauthenticate (reason %d)\n",
2561 ni->ni_macaddr, ":", reason);
2562 switch (ic->ic_opmode) {
2563 case IEEE80211_M_STA:
2564 ieee80211_new_state(ic, IEEE80211_S_AUTH,
2565 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2566 break;
2567 case IEEE80211_M_HOSTAP:
2568 if (ni != ic->ic_bss)
2569 ieee80211_node_leave(ic, ni);
2570 break;
2571 default:
2572 ic->ic_stats.is_rx_mgtdiscard++;
2573 break;
2574 }
2575 break;
2576 }
2577
2578 case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2579 uint16_t reason;
2580
2581 if (ic->ic_state != IEEE80211_S_RUN &&
2582 ic->ic_state != IEEE80211_S_ASSOC &&
2583 ic->ic_state != IEEE80211_S_AUTH) {
2584 ic->ic_stats.is_rx_mgtdiscard++;
2585 return;
2586 }
2587 /*
2588 * disassoc frame format
2589 * [2] reason
2590 */
2591 IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
2592 reason = le16toh(*(uint16_t *)frm);
2593 ic->ic_stats.is_rx_disassoc++;
2594 IEEE80211_NODE_STAT(ni, rx_disassoc);
2595
2596 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2597 "[%6D] recv disassociate (reason %d)\n",
2598 ni->ni_macaddr, ":", reason);
2599 switch (ic->ic_opmode) {
2600 case IEEE80211_M_STA:
2601 ieee80211_new_state(ic, IEEE80211_S_ASSOC,
2602 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2603 break;
2604 case IEEE80211_M_HOSTAP:
2605 if (ni != ic->ic_bss)
2606 ieee80211_node_leave(ic, ni);
2607 break;
2608 default:
2609 ic->ic_stats.is_rx_mgtdiscard++;
2610 break;
2611 }
2612 break;
2613 }
2614 default:
2615 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2616 wh, "mgt", "subtype 0x%x not handled", subtype);
2617 ic->ic_stats.is_rx_badsubtype++;
2618 break;
2619 }
2620 #undef ISREASSOC
2621 #undef ISPROBE
2622 }
2623 #undef IEEE80211_VERIFY_LENGTH
2624 #undef IEEE80211_VERIFY_ELEMENT
2625
2626 /*
2627 * Handle station power-save state change.
2628 */
2629 static void
2630 ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable)
2631 {
2632 struct ieee80211com *ic = ni->ni_ic;
2633 struct mbuf *m;
2634
2635 ASSERT_SERIALIZED(ic->ic_ifp->if_serializer);
2636
2637 if (enable) {
2638 if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0)
2639 ic->ic_ps_sta++;
2640 ni->ni_flags |= IEEE80211_NODE_PWR_MGT;
2641 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2642 "[%6D] power save mode on, %u sta's in ps mode\n",
2643 ni->ni_macaddr, ":", ic->ic_ps_sta);
2644 return;
2645 }
2646
2647 if (ni->ni_flags & IEEE80211_NODE_PWR_MGT)
2648 ic->ic_ps_sta--;
2649 ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT;
2650 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2651 "[%6D] power save mode off, %u sta's in ps mode\n",
2652 ni->ni_macaddr, ":", ic->ic_ps_sta);
2653 /* XXX if no stations in ps mode, flush mc frames */
2654
2655 /*
2656 * Flush queued unicast frames.
2657 */
2658 if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) {
2659 if (ic->ic_set_tim != NULL)
2660 ic->ic_set_tim(ni, 0); /* just in case */
2661 return;
2662 }
2663 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2664 "[%6D] flush ps queue, %u packets queued\n",
2665 ni->ni_macaddr, ":", IEEE80211_NODE_SAVEQ_QLEN(ni));
2666 for (;;) {
2667 int qlen;
2668
2669 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
2670 if (m == NULL)
2671 break;
2672 /*
2673 * If this is the last packet, turn off the TIM bit.
2674 * If there are more packets, set the more packets bit
2675 * in the mbuf so ieee80211_encap will mark the 802.11
2676 * head to indicate more data frames will follow.
2677 */
2678 if (qlen != 0)
2679 m->m_flags |= M_MORE_DATA;
2680 /* XXX need different driver interface */
2681 /* XXX bypasses q max */
2682 /* XXX bypasses ALTQ */
2683 ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL);
2684 }
2685 if (ic->ic_set_tim != NULL)
2686 ic->ic_set_tim(ni, 0);
2687 }
2688
2689 /*
2690 * Process a received ps-poll frame.
2691 */
2692 static void
2693 ieee80211_recv_pspoll(struct ieee80211com *ic,
2694 struct ieee80211_node *ni, struct mbuf *m0)
2695 {
2696 struct ieee80211_frame_min *wh;
2697 struct mbuf *m;
2698 uint16_t aid;
2699 int qlen;
2700
2701 ASSERT_SERIALIZED(ic->ic_ifp->if_serializer);
2702
2703 wh = mtod(m0, struct ieee80211_frame_min *);
2704 if (ni->ni_associd == 0) {
2705 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2706 (struct ieee80211_frame *) wh, "ps-poll",
2707 "%s", "unassociated station");
2708 ic->ic_stats.is_ps_unassoc++;
2709 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2710 IEEE80211_REASON_NOT_ASSOCED);
2711 return;
2712 }
2713
2714 aid = le16toh(*(uint16_t *)wh->i_dur);
2715 if (aid != ni->ni_associd) {
2716 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2717 (struct ieee80211_frame *) wh, "ps-poll",
2718 "aid mismatch: sta aid 0x%x poll aid 0x%x",
2719 ni->ni_associd, aid);
2720 ic->ic_stats.is_ps_badaid++;
2721 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2722 IEEE80211_REASON_NOT_ASSOCED);
2723 return;
2724 }
2725
2726 /* Okay, take the first queued packet and put it out... */
2727 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
2728 if (m == NULL) {
2729 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2730 "[%6D] recv ps-poll, but queue empty\n",
2731 wh->i_addr2, ":");
2732 ieee80211_send_nulldata(ieee80211_ref_node(ni));
2733 ic->ic_stats.is_ps_qempty++; /* XXX node stat */
2734 if (ic->ic_set_tim != NULL)
2735 ic->ic_set_tim(ni, 0); /* just in case */
2736 return;
2737 }
2738 /*
2739 * If there are more packets, set the more packets bit
2740 * in the packet dispatched to the station; otherwise
2741 * turn off the TIM bit.
2742 */
2743 if (qlen != 0) {
2744 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2745 "[%6D] recv ps-poll, send packet, %u still queued\n",
2746 ni->ni_macaddr, ":", qlen);
2747 m->m_flags |= M_MORE_DATA;
2748 } else {
2749 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2750 "[%6D] recv ps-poll, send packet, queue empty\n",
2751 ni->ni_macaddr, ":");
2752 if (ic->ic_set_tim != NULL)
2753 ic->ic_set_tim(ni, 0);
2754 }
2755 m->m_flags |= M_PWR_SAV; /* bypass PS handling */
2756 ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL); /* XXX bypasses ALTQ */
2757 }
2758
2759 #ifdef IEEE80211_DEBUG
2760 /*
2761 * Debugging support.
2762 */
2763
2764 /*
2765 * Return the bssid of a frame.
2766 */
2767 static const uint8_t *
2768 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh)
2769 {
2770 if (ic->ic_opmode == IEEE80211_M_STA)
2771 return wh->i_addr2;
2772 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
2773 return wh->i_addr1;
2774 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
2775 return wh->i_addr1;
2776 return wh->i_addr3;
2777 }
2778
2779 void
2780 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...)
2781 {
2782 char buf[128]; /* XXX */
2783 __va_list ap;
2784
2785 __va_start(ap, fmt);
2786 vsnprintf(buf, sizeof(buf), fmt, ap);
2787 __va_end(ap);
2788
2789 if_printf(ic->ic_ifp, "%s", buf); /* NB: no \n */
2790 }
2791
2792 void
2793 ieee80211_note_frame(struct ieee80211com *ic,
2794 const struct ieee80211_frame *wh,
2795 const char *fmt, ...)
2796 {
2797 char buf[128]; /* XXX */
2798 __va_list ap;
2799
2800 __va_start(ap, fmt);
2801 vsnprintf(buf, sizeof(buf), fmt, ap);
2802 __va_end(ap);
2803 if_printf(ic->ic_ifp, "[%6D] %s\n",
2804 ieee80211_getbssid(ic, wh), ":", buf);
2805 }
2806
2807 void
2808 ieee80211_note_mac(struct ieee80211com *ic,
2809 const uint8_t mac[IEEE80211_ADDR_LEN],
2810 const char *fmt, ...)
2811 {
2812 char buf[128]; /* XXX */
2813 __va_list ap;
2814
2815 __va_start(ap, fmt);
2816 vsnprintf(buf, sizeof(buf), fmt, ap);
2817 __va_end(ap);
2818 if_printf(ic->ic_ifp, "[%6D] %s\n", mac, ":", buf);
2819 }
2820
2821 static void
2822 ieee80211_discard_frame(struct ieee80211com *ic,
2823 const struct ieee80211_frame *wh,
2824 const char *type, const char *fmt, ...)
2825 {
2826 __va_list ap;
2827
2828 printf("[%s:%6D] discard ", ic->ic_ifp->if_xname,
2829 ieee80211_getbssid(ic, wh), ":");
2830 if (type != NULL)
2831 printf("%s frame, ", type);
2832 else
2833 printf("frame, ");
2834 __va_start(ap, fmt);
2835 vprintf(fmt, ap);
2836 __va_end(ap);
2837 printf("\n");
2838 }
2839
2840 static void
2841 ieee80211_discard_ie(struct ieee80211com *ic,
2842 const struct ieee80211_frame *wh,
2843 const char *type, const char *fmt, ...)
2844 {
2845 __va_list ap;
2846
2847 printf("[%s:%6D] discard ", ic->ic_ifp->if_xname,
2848 ieee80211_getbssid(ic, wh), ":");
2849 if (type != NULL)
2850 printf("%s information element, ", type);
2851 else
2852 printf("information element, ");
2853 __va_start(ap, fmt);
2854 vprintf(fmt, ap);
2855 __va_end(ap);
2856 printf("\n");
2857 }
2858
2859 static void
2860 ieee80211_discard_mac(struct ieee80211com *ic,
2861 const uint8_t mac[IEEE80211_ADDR_LEN],
2862 const char *type, const char *fmt, ...)
2863 {
2864 __va_list ap;
2865
2866 printf("[%s:%6D] discard ", ic->ic_ifp->if_xname, mac, ":");
2867 if (type != NULL)
2868 printf("%s frame, ", type);
2869 else
2870 printf("frame, ");
2871 __va_start(ap, fmt);
2872 vprintf(fmt, ap);
2873 __va_end(ap);
2874 printf("\n");
2875 }
2876 #endif /* IEEE80211_DEBUG */
DragonFly BSD