2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
17 * Alternatively, this software may be distributed under the terms of the
18 * GNU General Public License ("GPL") version 2 as published by the Free
19 * Software Foundation.
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 * $FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.62.2.14 2006/09/02 15:16:12 sam Exp $
33 * $DragonFly: src/sys/netproto/802_11/wlan/ieee80211_input.c,v 1.8 2006/11/25 13:11:30 sephe Exp $
36 #include <sys/param.h>
37 #include <sys/systm.h>
39 #include <sys/malloc.h>
40 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 #include <sys/serialize.h>
44 #include <sys/socket.h>
47 #include <net/if_arp.h>
48 #include <net/ifq_var.h>
49 #include <net/if_media.h>
50 #include <net/ethernet.h>
51 #include <net/if_llc.h>
52 #include <net/vlan/if_vlan_var.h>
54 #include <netproto/802_11/ieee80211_var.h>
58 #ifdef IEEE80211_DEBUG
59 #include <machine/stdarg.h>
62 * Decide if a received management frame should be
63 * printed when debugging is enabled. This filters some
64 * of the less interesting frames that come frequently
68 doprint(struct ieee80211com
*ic
, int subtype
)
71 case IEEE80211_FC0_SUBTYPE_BEACON
:
72 return (ic
->ic_flags
& IEEE80211_F_SCAN
);
73 case IEEE80211_FC0_SUBTYPE_PROBE_REQ
:
74 return (ic
->ic_opmode
== IEEE80211_M_IBSS
);
80 * Emit a debug message about discarding a frame or information
81 * element. One format is for extracting the mac address from
82 * the frame header; the other is for when a header is not
83 * available or otherwise appropriate.
85 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do { \
86 if ((_ic)->ic_debug & (_m)) \
87 ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\
89 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do { \
90 if ((_ic)->ic_debug & (_m)) \
91 ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\
93 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do { \
94 if ((_ic)->ic_debug & (_m)) \
95 ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\
98 static const uint8_t *ieee80211_getbssid(struct ieee80211com
*,
99 const struct ieee80211_frame
*);
100 static void ieee80211_discard_frame(struct ieee80211com
*,
101 const struct ieee80211_frame
*, const char *type
, const char *fmt
, ...);
102 static void ieee80211_discard_ie(struct ieee80211com
*,
103 const struct ieee80211_frame
*, const char *type
, const char *fmt
, ...);
104 static void ieee80211_discard_mac(struct ieee80211com
*,
105 const uint8_t mac
[IEEE80211_ADDR_LEN
], const char *type
,
106 const char *fmt
, ...);
108 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...)
109 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...)
110 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...)
111 #endif /* IEEE80211_DEBUG */
113 static struct mbuf
*ieee80211_defrag(struct ieee80211com
*,
114 struct ieee80211_node
*, struct mbuf
*, int);
115 static struct mbuf
*ieee80211_decap(struct ieee80211com
*, struct mbuf
*, int);
116 static void ieee80211_send_error(struct ieee80211com
*, struct ieee80211_node
*,
117 const uint8_t *mac
, int subtype
, int arg
);
118 static void ieee80211_deliver_data(struct ieee80211com
*,
119 struct ieee80211_node
*, struct mbuf
*);
120 static void ieee80211_node_pwrsave(struct ieee80211_node
*, int enable
);
121 static void ieee80211_recv_pspoll(struct ieee80211com
*,
122 struct ieee80211_node
*, struct mbuf
*);
125 * Process a received frame. The node associated with the sender
126 * should be supplied. If nothing was found in the node table then
127 * the caller is assumed to supply a reference to ic_bss instead.
128 * The RSSI and a timestamp are also supplied. The RSSI data is used
129 * during AP scanning to select a AP to associate with; it can have
130 * any units so long as values have consistent units and higher values
131 * mean ``better signal''. The receive timestamp is currently not used
132 * by the 802.11 layer.
135 ieee80211_input(struct ieee80211com
*ic
, struct mbuf
*m
,
136 struct ieee80211_node
*ni
, int rssi
, uint32_t rstamp
)
138 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0)
139 #define HAS_SEQ(type) ((type & 0x4) == 0)
140 struct ifnet
*ifp
= ic
->ic_ifp
;
141 struct ieee80211_frame
*wh
;
142 struct ieee80211_key
*key
;
143 struct ether_header
*eh
;
145 uint8_t dir
, type
, subtype
;
149 ASSERT_SERIALIZED(ifp
->if_serializer
);
151 KASSERT(ni
!= NULL
, ("null node"));
152 ni
->ni_inact
= ni
->ni_inact_reload
;
154 type
= -1; /* undefined */
156 * In monitor mode, send everything directly to bpf.
157 * XXX may want to include the CRC
159 if (ic
->ic_opmode
== IEEE80211_M_MONITOR
)
162 if (m
->m_pkthdr
.len
< sizeof(struct ieee80211_frame_min
)) {
163 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_ANY
,
164 ni
->ni_macaddr
, NULL
,
165 "too short (1): len %u", m
->m_pkthdr
.len
);
166 ic
->ic_stats
.is_rx_tooshort
++;
170 * Bit of a cheat here, we use a pointer for a 3-address
171 * frame format but don't reference fields past outside
172 * ieee80211_frame_min w/o first validating the data is
175 wh
= mtod(m
, struct ieee80211_frame
*);
177 if ((wh
->i_fc
[0] & IEEE80211_FC0_VERSION_MASK
) !=
178 IEEE80211_FC0_VERSION_0
) {
179 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_ANY
,
180 ni
->ni_macaddr
, NULL
, "wrong version %x", wh
->i_fc
[0]);
181 ic
->ic_stats
.is_rx_badversion
++;
185 dir
= wh
->i_fc
[1] & IEEE80211_FC1_DIR_MASK
;
186 type
= wh
->i_fc
[0] & IEEE80211_FC0_TYPE_MASK
;
187 subtype
= wh
->i_fc
[0] & IEEE80211_FC0_SUBTYPE_MASK
;
188 if ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0) {
189 switch (ic
->ic_opmode
) {
190 case IEEE80211_M_STA
:
192 if (!IEEE80211_ADDR_EQ(bssid
, ni
->ni_bssid
)) {
193 /* not interested in */
194 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_INPUT
,
195 bssid
, NULL
, "%s", "not to bss");
196 ic
->ic_stats
.is_rx_wrongbss
++;
200 case IEEE80211_M_IBSS
:
201 case IEEE80211_M_AHDEMO
:
202 case IEEE80211_M_HOSTAP
:
203 if (dir
!= IEEE80211_FC1_DIR_NODS
)
205 else if (type
== IEEE80211_FC0_TYPE_CTL
)
208 if (m
->m_pkthdr
.len
< sizeof(struct ieee80211_frame
)) {
209 IEEE80211_DISCARD_MAC(ic
,
210 IEEE80211_MSG_ANY
, ni
->ni_macaddr
,
211 NULL
, "too short (2): len %u",
213 ic
->ic_stats
.is_rx_tooshort
++;
218 if (type
!= IEEE80211_FC0_TYPE_DATA
)
221 * Data frame, validate the bssid.
223 if (!IEEE80211_ADDR_EQ(bssid
, ic
->ic_bss
->ni_bssid
) &&
224 !IEEE80211_ADDR_EQ(bssid
, ifp
->if_broadcastaddr
)) {
225 /* not interested in */
226 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_INPUT
,
227 bssid
, NULL
, "%s", "not to bss");
228 ic
->ic_stats
.is_rx_wrongbss
++;
232 * For adhoc mode we cons up a node when it doesn't
233 * exist. This should probably done after an ACL check.
235 if (ni
== ic
->ic_bss
&&
236 ic
->ic_opmode
!= IEEE80211_M_HOSTAP
&&
237 !IEEE80211_ADDR_EQ(wh
->i_addr2
, ni
->ni_macaddr
)) {
239 * Fake up a node for this newly
240 * discovered member of the IBSS.
242 ni
= ieee80211_fakeup_adhoc_node(&ic
->ic_sta
,
245 /* NB: stat kept for alloc failure */
254 ni
->ni_rstamp
= rstamp
;
257 if (IEEE80211_QOS_HAS_SEQ(wh
)) {
258 tid
= ((struct ieee80211_qosframe
*)wh
)->
259 i_qos
[0] & IEEE80211_QOS_TID
;
260 if (TID_TO_WME_AC(tid
) >= WME_AC_VI
)
261 ic
->ic_wme
.wme_hipri_traffic
++;
265 rxseq
= le16toh(*(uint16_t *)wh
->i_seq
);
266 if ((wh
->i_fc
[1] & IEEE80211_FC1_RETRY
) &&
267 SEQ_LEQ(rxseq
, ni
->ni_rxseqs
[tid
])) {
268 /* duplicate, discard */
269 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_INPUT
,
271 "seqno <%u,%u> fragno <%u,%u> tid %u",
272 rxseq
>> IEEE80211_SEQ_SEQ_SHIFT
,
273 ni
->ni_rxseqs
[tid
] >>
274 IEEE80211_SEQ_SEQ_SHIFT
,
275 rxseq
& IEEE80211_SEQ_FRAG_MASK
,
277 IEEE80211_SEQ_FRAG_MASK
,
279 ic
->ic_stats
.is_rx_dup
++;
280 IEEE80211_NODE_STAT(ni
, rx_dup
);
283 ni
->ni_rxseqs
[tid
] = rxseq
;
288 case IEEE80211_FC0_TYPE_DATA
:
289 hdrspace
= ieee80211_hdrspace(ic
, wh
);
290 if (m
->m_len
< hdrspace
&&
291 (m
= m_pullup(m
, hdrspace
)) == NULL
) {
292 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_ANY
,
293 ni
->ni_macaddr
, NULL
,
294 "data too short: expecting %u", hdrspace
);
295 ic
->ic_stats
.is_rx_tooshort
++;
298 switch (ic
->ic_opmode
) {
299 case IEEE80211_M_STA
:
300 if (dir
!= IEEE80211_FC1_DIR_FROMDS
) {
301 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
302 wh
, "data", "%s", "unknown dir 0x%x", dir
);
303 ic
->ic_stats
.is_rx_wrongdir
++;
306 if ((ifp
->if_flags
& IFF_SIMPLEX
) &&
307 IEEE80211_IS_MULTICAST(wh
->i_addr1
) &&
308 IEEE80211_ADDR_EQ(wh
->i_addr3
, ic
->ic_myaddr
)) {
310 * In IEEE802.11 network, multicast packet
311 * sent from me is broadcasted from AP.
312 * It should be silently discarded for
315 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
316 wh
, NULL
, "%s", "multicast echo");
317 ic
->ic_stats
.is_rx_mcastecho
++;
321 case IEEE80211_M_IBSS
:
322 case IEEE80211_M_AHDEMO
:
323 if (dir
!= IEEE80211_FC1_DIR_NODS
) {
324 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
325 wh
, "data", "%s", "unknown dir 0x%x", dir
);
326 ic
->ic_stats
.is_rx_wrongdir
++;
329 /* XXX no power-save support */
331 case IEEE80211_M_HOSTAP
:
332 if (dir
!= IEEE80211_FC1_DIR_TODS
) {
333 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
334 wh
, "data", "%s", "unknown dir 0x%x", dir
);
335 ic
->ic_stats
.is_rx_wrongdir
++;
338 /* check if source STA is associated */
339 if (ni
== ic
->ic_bss
) {
340 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
341 wh
, "data", "%s", "unknown src");
342 ieee80211_send_error(ic
, ni
, wh
->i_addr2
,
343 IEEE80211_FC0_SUBTYPE_DEAUTH
,
344 IEEE80211_REASON_NOT_AUTHED
);
345 ic
->ic_stats
.is_rx_notassoc
++;
348 if (ni
->ni_associd
== 0) {
349 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
350 wh
, "data", "%s", "unassoc src");
351 IEEE80211_SEND_MGMT(ic
, ni
,
352 IEEE80211_FC0_SUBTYPE_DISASSOC
,
353 IEEE80211_REASON_NOT_ASSOCED
);
354 ic
->ic_stats
.is_rx_notassoc
++;
359 * Check for power save state change.
361 if (((wh
->i_fc
[1] & IEEE80211_FC1_PWR_MGT
) ^
362 (ni
->ni_flags
& IEEE80211_NODE_PWR_MGT
)))
363 ieee80211_node_pwrsave(ni
,
364 wh
->i_fc
[1] & IEEE80211_FC1_PWR_MGT
);
367 /* XXX here to keep compiler happy */
372 * Handle privacy requirements. Note that we
373 * must not be preempted from here until after
374 * we (potentially) call ieee80211_crypto_demic;
375 * otherwise we may violate assumptions in the
376 * crypto cipher modules used to do delayed update
377 * of replay sequence numbers.
379 if (wh
->i_fc
[1] & IEEE80211_FC1_WEP
) {
380 if ((ic
->ic_flags
& IEEE80211_F_PRIVACY
) == 0) {
382 * Discard encrypted frames when privacy is off.
384 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
385 wh
, "WEP", "%s", "PRIVACY off");
386 ic
->ic_stats
.is_rx_noprivacy
++;
387 IEEE80211_NODE_STAT(ni
, rx_noprivacy
);
390 key
= ieee80211_crypto_decap(ic
, ni
, m
, hdrspace
);
392 /* NB: stats+msgs handled in crypto_decap */
393 IEEE80211_NODE_STAT(ni
, rx_wepfail
);
396 wh
= mtod(m
, struct ieee80211_frame
*);
397 wh
->i_fc
[1] &= ~IEEE80211_FC1_WEP
;
403 * Next up, any fragmentation.
405 if (!IEEE80211_IS_MULTICAST(wh
->i_addr1
)) {
406 m
= ieee80211_defrag(ic
, ni
, m
, hdrspace
);
408 /* Fragment dropped or frame not complete yet */
412 wh
= NULL
; /* no longer valid, catch any uses */
415 * Next strip any MSDU crypto bits.
417 if (key
!= NULL
&& !ieee80211_crypto_demic(ic
, key
, m
, 0)) {
418 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_INPUT
,
419 ni
->ni_macaddr
, "data", "%s", "demic error");
420 ic
->ic_stats
.is_rx_demicfail
++;
421 IEEE80211_NODE_STAT(ni
, rx_demicfail
);
425 /* copy to listener after decrypt */
427 bpf_mtap(ic
->ic_rawbpf
, m
);
430 * Finally, strip the 802.11 header.
432 m
= ieee80211_decap(ic
, m
, hdrspace
);
434 /* don't count Null data frames as errors */
435 if (subtype
== IEEE80211_FC0_SUBTYPE_NODATA
)
437 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_INPUT
,
438 ni
->ni_macaddr
, "data", "%s", "decap error");
439 ic
->ic_stats
.is_rx_decap
++;
440 IEEE80211_NODE_STAT(ni
, rx_decap
);
443 eh
= mtod(m
, struct ether_header
*);
444 if (!ieee80211_node_is_authorized(ni
)) {
446 * Deny any non-PAE frames received prior to
447 * authorization. For open/shared-key
448 * authentication the port is mark authorized
449 * after authentication completes. For 802.1x
450 * the port is not marked authorized by the
451 * authenticator until the handshake has completed.
453 if (eh
->ether_type
!= htons(ETHERTYPE_PAE
)) {
454 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_INPUT
,
455 eh
->ether_shost
, "data",
456 "unauthorized port: ether type 0x%x len %u",
457 eh
->ether_type
, m
->m_pkthdr
.len
);
458 ic
->ic_stats
.is_rx_unauth
++;
459 IEEE80211_NODE_STAT(ni
, rx_unauth
);
464 * When denying unencrypted frames, discard
465 * any non-PAE frames received without encryption.
467 if ((ic
->ic_flags
& IEEE80211_F_DROPUNENC
) &&
469 eh
->ether_type
!= htons(ETHERTYPE_PAE
)) {
471 * Drop unencrypted frames.
473 ic
->ic_stats
.is_rx_unencrypted
++;
474 IEEE80211_NODE_STAT(ni
, rx_unencrypted
);
478 ieee80211_deliver_data(ic
, ni
, m
);
479 return IEEE80211_FC0_TYPE_DATA
;
481 case IEEE80211_FC0_TYPE_MGT
:
482 ic
->ic_stats
.is_rx_mgmt
++;
483 IEEE80211_NODE_STAT(ni
, rx_mgmt
);
484 if (dir
!= IEEE80211_FC1_DIR_NODS
) {
485 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
486 wh
, "data", "%s", "unknown dir 0x%x", dir
);
487 ic
->ic_stats
.is_rx_wrongdir
++;
490 if (m
->m_pkthdr
.len
< sizeof(struct ieee80211_frame
)) {
491 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_ANY
,
492 ni
->ni_macaddr
, "mgt", "too short: len %u",
494 ic
->ic_stats
.is_rx_tooshort
++;
497 #ifdef IEEE80211_DEBUG
498 if ((ieee80211_msg_debug(ic
) && doprint(ic
, subtype
)) ||
499 ieee80211_msg_dumppkts(ic
)) {
500 if_printf(ic
->ic_ifp
, "received %s from %6D rssi %d\n",
501 ieee80211_mgt_subtype_name
[subtype
>>
502 IEEE80211_FC0_SUBTYPE_SHIFT
],
503 wh
->i_addr2
, ":", rssi
);
506 if (wh
->i_fc
[1] & IEEE80211_FC1_WEP
) {
507 if (subtype
!= IEEE80211_FC0_SUBTYPE_AUTH
) {
509 * Only shared key auth frames with a challenge
510 * should be encrypted, discard all others.
512 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
513 wh
, ieee80211_mgt_subtype_name
[subtype
>>
514 IEEE80211_FC0_SUBTYPE_SHIFT
],
515 "%s", "WEP set but not permitted");
516 ic
->ic_stats
.is_rx_mgtdiscard
++; /* XXX */
519 if ((ic
->ic_flags
& IEEE80211_F_PRIVACY
) == 0) {
521 * Discard encrypted frames when privacy is off.
523 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
524 wh
, "mgt", "%s", "WEP set but PRIVACY off");
525 ic
->ic_stats
.is_rx_noprivacy
++;
528 hdrspace
= ieee80211_hdrspace(ic
, wh
);
529 key
= ieee80211_crypto_decap(ic
, ni
, m
, hdrspace
);
531 /* NB: stats+msgs handled in crypto_decap */
534 wh
= mtod(m
, struct ieee80211_frame
*);
535 wh
->i_fc
[1] &= ~IEEE80211_FC1_WEP
;
538 bpf_mtap(ic
->ic_rawbpf
, m
);
539 (*ic
->ic_recv_mgmt
)(ic
, m
, ni
, subtype
, rssi
, rstamp
);
543 case IEEE80211_FC0_TYPE_CTL
:
544 IEEE80211_NODE_STAT(ni
, rx_ctrl
);
545 ic
->ic_stats
.is_rx_ctl
++;
546 if (ic
->ic_opmode
== IEEE80211_M_HOSTAP
) {
548 case IEEE80211_FC0_SUBTYPE_PS_POLL
:
549 ieee80211_recv_pspoll(ic
, ni
, m
);
555 IEEE80211_DISCARD(ic
, IEEE80211_MSG_ANY
,
556 wh
, NULL
, "bad frame type 0x%x", type
);
557 /* should not come here */
565 bpf_mtap(ic
->ic_rawbpf
, m
);
573 * This function reassemble fragments.
576 ieee80211_defrag(struct ieee80211com
*ic
, struct ieee80211_node
*ni
,
577 struct mbuf
*m
, int hdrspace
)
579 struct ieee80211_frame
*wh
= mtod(m
, struct ieee80211_frame
*);
580 struct ieee80211_frame
*lwh
;
583 uint8_t more_frag
= wh
->i_fc
[1] & IEEE80211_FC1_MORE_FRAG
;
586 KASSERT(!IEEE80211_IS_MULTICAST(wh
->i_addr1
), ("multicast fragm?"));
588 rxseq
= le16toh(*(uint16_t *)wh
->i_seq
);
589 fragno
= rxseq
& IEEE80211_SEQ_FRAG_MASK
;
591 /* Quick way out, if there's nothing to defragment */
592 if (!more_frag
&& fragno
== 0 && ni
->ni_rxfrag
[0] == NULL
)
596 * Remove frag to insure it doesn't get reaped by timer.
598 if (ni
->ni_table
== NULL
) {
600 * Should never happen. If the node is orphaned (not in
601 * the table) then input packets should not reach here.
602 * Otherwise, a concurrent request that yanks the table
603 * should be blocked by other interlocking and/or by first
604 * shutting the driver down. Regardless, be defensive
607 /* XXX need msg+stat */
611 mfrag
= ni
->ni_rxfrag
[0];
612 ni
->ni_rxfrag
[0] = NULL
;
615 * Validate new fragment is in order and
616 * related to the previous ones.
621 lwh
= mtod(mfrag
, struct ieee80211_frame
*);
622 last_rxseq
= le16toh(*(uint16_t *)lwh
->i_seq
);
623 /* NB: check seq # and frag together */
624 if (rxseq
!= last_rxseq
+1 ||
625 !IEEE80211_ADDR_EQ(wh
->i_addr1
, lwh
->i_addr1
) ||
626 !IEEE80211_ADDR_EQ(wh
->i_addr2
, lwh
->i_addr2
)) {
628 * Unrelated fragment or no space for it,
629 * clear current fragments.
637 if (fragno
!= 0) { /* !first fragment, discard */
638 ic
->ic_stats
.is_rx_defrag
++;
639 IEEE80211_NODE_STAT(ni
, rx_defrag
);
644 } else { /* concatenate */
645 m_adj(m
, hdrspace
); /* strip header */
647 /* NB: m_cat doesn't update the packet header */
648 mfrag
->m_pkthdr
.len
+= m
->m_pkthdr
.len
;
649 /* track last seqnum and fragno */
650 lwh
= mtod(mfrag
, struct ieee80211_frame
*);
651 *(uint16_t *) lwh
->i_seq
= *(uint16_t *) wh
->i_seq
;
653 if (more_frag
) { /* more to come, save */
654 ni
->ni_rxfragstamp
= ticks
;
655 ni
->ni_rxfrag
[0] = mfrag
;
662 ieee80211_deliver_data(struct ieee80211com
*ic
,
663 struct ieee80211_node
*ni
, struct mbuf
*m
)
665 struct ether_header
*eh
= mtod(m
, struct ether_header
*);
666 struct ifnet
*ifp
= ic
->ic_ifp
;
672 IEEE80211_NODE_STAT(ni
, rx_data
);
673 IEEE80211_NODE_STAT_ADD(ni
, rx_bytes
, m
->m_pkthdr
.len
);
674 if (ETHER_IS_MULTICAST(eh
->ether_dhost
)) {
675 m
->m_flags
|= M_MCAST
; /* XXX M_BCAST? */
676 IEEE80211_NODE_STAT(ni
, rx_mcast
);
678 IEEE80211_NODE_STAT(ni
, rx_ucast
);
681 /* perform as a bridge within the AP */
682 if (ic
->ic_opmode
== IEEE80211_M_HOSTAP
&&
683 (ic
->ic_flags
& IEEE80211_F_NOBRIDGE
) == 0) {
684 struct mbuf
*m1
= NULL
;
686 if (m
->m_flags
& M_MCAST
) {
687 m1
= m_dup(m
, MB_DONTWAIT
);
691 m1
->m_flags
|= M_MCAST
;
694 * Check if the destination is known; if so
695 * and the port is authorized dispatch directly.
697 struct ieee80211_node
*sta
=
698 ieee80211_find_node(&ic
->ic_sta
, eh
->ether_dhost
);
700 if (ieee80211_node_is_authorized(sta
)) {
702 * Beware of sending to ourself; this
703 * needs to happen via the normal
706 if (sta
!= ic
->ic_bss
) {
711 ic
->ic_stats
.is_rx_unauth
++;
712 IEEE80211_NODE_STAT(sta
, rx_unauth
);
714 ieee80211_free_node(sta
);
718 /* XXX bypasses ALTQ */
719 ifq_handoff(ifp
, m1
, NULL
);
724 if (ni
->ni_vlan
!= 0) {
725 /* attach vlan tag */
726 VLAN_INPUT_TAG_NEW(ifp
, m
, ni
->ni_vlan
);
728 goto out
; /* XXX goto err? */
731 ifp
->if_input(ifp
, m
);
739 bpf_mtap(ic
->ic_rawbpf
, m
);
746 ieee80211_decap(struct ieee80211com
*ic
, struct mbuf
*m
, int hdrlen
)
748 struct ieee80211_qosframe_addr4 wh
; /* Max size address frames */
749 struct ether_header
*eh
;
752 if (m
->m_len
< hdrlen
+ sizeof(*llc
) &&
753 (m
= m_pullup(m
, hdrlen
+ sizeof(*llc
))) == NULL
) {
757 memcpy(&wh
, mtod(m
, caddr_t
), hdrlen
);
758 llc
= (struct llc
*)(mtod(m
, caddr_t
) + hdrlen
);
759 if (llc
->llc_dsap
== LLC_SNAP_LSAP
&& llc
->llc_ssap
== LLC_SNAP_LSAP
&&
760 llc
->llc_control
== LLC_UI
&& llc
->llc_snap
.org_code
[0] == 0 &&
761 llc
->llc_snap
.org_code
[1] == 0 && llc
->llc_snap
.org_code
[2] == 0) {
762 m_adj(m
, hdrlen
+ sizeof(struct llc
) - sizeof(*eh
));
765 m_adj(m
, hdrlen
- sizeof(*eh
));
767 eh
= mtod(m
, struct ether_header
*);
768 switch (wh
.i_fc
[1] & IEEE80211_FC1_DIR_MASK
) {
769 case IEEE80211_FC1_DIR_NODS
:
770 IEEE80211_ADDR_COPY(eh
->ether_dhost
, wh
.i_addr1
);
771 IEEE80211_ADDR_COPY(eh
->ether_shost
, wh
.i_addr2
);
773 case IEEE80211_FC1_DIR_TODS
:
774 IEEE80211_ADDR_COPY(eh
->ether_dhost
, wh
.i_addr3
);
775 IEEE80211_ADDR_COPY(eh
->ether_shost
, wh
.i_addr2
);
777 case IEEE80211_FC1_DIR_FROMDS
:
778 IEEE80211_ADDR_COPY(eh
->ether_dhost
, wh
.i_addr1
);
779 IEEE80211_ADDR_COPY(eh
->ether_shost
, wh
.i_addr3
);
781 case IEEE80211_FC1_DIR_DSTODS
:
782 IEEE80211_ADDR_COPY(eh
->ether_dhost
, wh
.i_addr3
);
783 IEEE80211_ADDR_COPY(eh
->ether_shost
, wh
.i_addr4
);
786 #ifdef ALIGNED_POINTER
787 if (!ALIGNED_POINTER(mtod(m
, caddr_t
) + sizeof(*eh
), uint32_t)) {
788 struct mbuf
*n
, *n0
, **np
;
795 pktlen
= m
->m_pkthdr
.len
;
796 while (pktlen
> off
) {
798 MGETHDR(n
, M_DONTWAIT
, MT_DATA
);
806 MGET(n
, M_DONTWAIT
, MT_DATA
);
814 if (pktlen
- off
>= MINCLSIZE
) {
815 MCLGET(n
, M_DONTWAIT
);
816 if (n
->m_flags
& M_EXT
)
817 n
->m_len
= n
->m_ext
.ext_size
;
821 (caddr_t
)ALIGN(n
->m_data
+ sizeof(*eh
)) -
823 n
->m_len
-= newdata
- n
->m_data
;
826 if (n
->m_len
> pktlen
- off
)
827 n
->m_len
= pktlen
- off
;
828 m_copydata(m
, off
, n
->m_len
, mtod(n
, caddr_t
));
836 #endif /* ALIGNED_POINTER */
838 eh
= mtod(m
, struct ether_header
*);
839 eh
->ether_type
= htons(m
->m_pkthdr
.len
- sizeof(*eh
));
845 * Install received rate set information in the node's state block.
848 ieee80211_setup_rates(struct ieee80211_node
*ni
,
849 const uint8_t *rates
, const uint8_t *xrates
, int flags
)
851 struct ieee80211com
*ic
= ni
->ni_ic
;
852 struct ieee80211_rateset
*rs
= &ni
->ni_rates
;
854 memset(rs
, 0, sizeof(*rs
));
855 rs
->rs_nrates
= rates
[1];
856 memcpy(rs
->rs_rates
, rates
+ 2, rs
->rs_nrates
);
857 if (xrates
!= NULL
) {
860 * Tack on 11g extended supported rate element.
863 if (rs
->rs_nrates
+ nxrates
> IEEE80211_RATE_MAXSIZE
) {
864 nxrates
= IEEE80211_RATE_MAXSIZE
- rs
->rs_nrates
;
865 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_XRATE
,
866 "[%6D] extended rate set too large;"
867 " only using %u of %u rates\n",
868 ni
->ni_macaddr
, ":", nxrates
, xrates
[1]);
869 ic
->ic_stats
.is_rx_rstoobig
++;
871 memcpy(rs
->rs_rates
+ rs
->rs_nrates
, xrates
+2, nxrates
);
872 rs
->rs_nrates
+= nxrates
;
874 return ieee80211_fix_rate(ni
, flags
);
878 ieee80211_auth_open(struct ieee80211com
*ic
, struct ieee80211_frame
*wh
,
879 struct ieee80211_node
*ni
, int rssi
, uint32_t rstamp
, uint16_t seq
,
883 if (ni
->ni_authmode
== IEEE80211_AUTH_SHARED
) {
884 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
885 ni
->ni_macaddr
, "open auth",
886 "bad sta auth mode %u", ni
->ni_authmode
);
887 ic
->ic_stats
.is_rx_bad_auth
++; /* XXX */
888 if (ic
->ic_opmode
== IEEE80211_M_HOSTAP
) {
889 /* XXX hack to workaround calling convention */
890 ieee80211_send_error(ic
, ni
, wh
->i_addr2
,
891 IEEE80211_FC0_SUBTYPE_AUTH
,
892 (seq
+ 1) | (IEEE80211_STATUS_ALG
<<16));
896 switch (ic
->ic_opmode
) {
897 case IEEE80211_M_IBSS
:
898 case IEEE80211_M_AHDEMO
:
899 case IEEE80211_M_MONITOR
:
900 /* should not come here */
901 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
902 ni
->ni_macaddr
, "open auth",
903 "bad operating mode %u", ic
->ic_opmode
);
906 case IEEE80211_M_HOSTAP
:
907 if (ic
->ic_state
!= IEEE80211_S_RUN
||
908 seq
!= IEEE80211_AUTH_OPEN_REQUEST
) {
909 ic
->ic_stats
.is_rx_bad_auth
++;
912 /* always accept open authentication requests */
913 if (ni
== ic
->ic_bss
) {
914 ni
= ieee80211_dup_bss(&ic
->ic_sta
, wh
->i_addr2
);
917 } else if ((ni
->ni_flags
& IEEE80211_NODE_AREF
) == 0)
918 (void) ieee80211_ref_node(ni
);
920 * Mark the node as referenced to reflect that it's
921 * reference count has been bumped to insure it remains
922 * after the transaction completes.
924 ni
->ni_flags
|= IEEE80211_NODE_AREF
;
926 IEEE80211_SEND_MGMT(ic
, ni
,
927 IEEE80211_FC0_SUBTYPE_AUTH
, seq
+ 1);
928 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_DEBUG
| IEEE80211_MSG_AUTH
,
929 "[%6D] station authenticated (open)\n",
930 ni
->ni_macaddr
, ":");
932 * When 802.1x is not in use mark the port
933 * authorized at this point so traffic can flow.
935 if (ni
->ni_authmode
!= IEEE80211_AUTH_8021X
)
936 ieee80211_node_authorize(ni
);
939 case IEEE80211_M_STA
:
940 if (ic
->ic_state
!= IEEE80211_S_AUTH
||
941 seq
!= IEEE80211_AUTH_OPEN_RESPONSE
) {
942 ic
->ic_stats
.is_rx_bad_auth
++;
946 IEEE80211_DPRINTF(ic
,
947 IEEE80211_MSG_DEBUG
| IEEE80211_MSG_AUTH
,
948 "[%6D] open auth failed (reason %d)\n",
949 ni
->ni_macaddr
, ":", status
);
950 /* XXX can this happen? */
951 if (ni
!= ic
->ic_bss
)
953 ic
->ic_stats
.is_rx_auth_fail
++;
954 ieee80211_new_state(ic
, IEEE80211_S_SCAN
, 0);
956 ieee80211_new_state(ic
, IEEE80211_S_ASSOC
,
957 wh
->i_fc
[0] & IEEE80211_FC0_SUBTYPE_MASK
);
963 * Send a management frame error response to the specified
964 * station. If ni is associated with the station then use
965 * it; otherwise allocate a temporary node suitable for
966 * transmitting the frame and then free the reference so
967 * it will go away as soon as the frame has been transmitted.
970 ieee80211_send_error(struct ieee80211com
*ic
, struct ieee80211_node
*ni
,
971 const uint8_t *mac
, int subtype
, int arg
)
975 if (ni
== ic
->ic_bss
) {
976 ni
= ieee80211_tmp_node(ic
, mac
);
984 IEEE80211_SEND_MGMT(ic
, ni
, subtype
, arg
);
986 ieee80211_free_node(ni
);
990 alloc_challenge(struct ieee80211com
*ic
, struct ieee80211_node
*ni
)
992 if (ni
->ni_challenge
== NULL
)
993 MALLOC(ni
->ni_challenge
, uint32_t*, IEEE80211_CHALLENGE_LEN
,
995 if (ni
->ni_challenge
== NULL
) {
996 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_DEBUG
| IEEE80211_MSG_AUTH
,
997 "[%6D] shared key challenge alloc failed\n",
998 ni
->ni_macaddr
, ":");
1001 return (ni
->ni_challenge
!= NULL
);
1004 /* XXX TODO: add statistics */
1006 ieee80211_auth_shared(struct ieee80211com
*ic
, struct ieee80211_frame
*wh
,
1007 uint8_t *frm
, uint8_t *efrm
, struct ieee80211_node
*ni
, int rssi
,
1008 uint32_t rstamp
, uint16_t seq
, uint16_t status
)
1011 int allocbs
, estatus
;
1014 * NB: this can happen as we allow pre-shared key
1015 * authentication to be enabled w/o wep being turned
1016 * on so that configuration of these can be done
1017 * in any order. It may be better to enforce the
1018 * ordering in which case this check would just be
1019 * for sanity/consistency.
1021 if ((ic
->ic_flags
& IEEE80211_F_PRIVACY
) == 0) {
1022 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1023 ni
->ni_macaddr
, "shared key auth",
1024 "%s", " PRIVACY is disabled");
1025 estatus
= IEEE80211_STATUS_ALG
;
1029 * Pre-shared key authentication is evil; accept
1030 * it only if explicitly configured (it is supported
1031 * mainly for compatibility with clients like OS X).
1033 if (ni
->ni_authmode
!= IEEE80211_AUTH_AUTO
&&
1034 ni
->ni_authmode
!= IEEE80211_AUTH_SHARED
) {
1035 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1036 ni
->ni_macaddr
, "shared key auth",
1037 "bad sta auth mode %u", ni
->ni_authmode
);
1038 ic
->ic_stats
.is_rx_bad_auth
++; /* XXX maybe a unique error? */
1039 estatus
= IEEE80211_STATUS_ALG
;
1044 if (frm
+ 1 < efrm
) {
1045 if ((frm
[1] + 2) > (efrm
- frm
)) {
1046 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1047 ni
->ni_macaddr
, "shared key auth",
1048 "ie %d/%d too long",
1049 frm
[0], (frm
[1] + 2) - (efrm
- frm
));
1050 ic
->ic_stats
.is_rx_bad_auth
++;
1051 estatus
= IEEE80211_STATUS_CHALLENGE
;
1054 if (*frm
== IEEE80211_ELEMID_CHALLENGE
)
1059 case IEEE80211_AUTH_SHARED_CHALLENGE
:
1060 case IEEE80211_AUTH_SHARED_RESPONSE
:
1061 if (challenge
== NULL
) {
1062 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1063 ni
->ni_macaddr
, "shared key auth",
1064 "%s", "no challenge");
1065 ic
->ic_stats
.is_rx_bad_auth
++;
1066 estatus
= IEEE80211_STATUS_CHALLENGE
;
1069 if (challenge
[1] != IEEE80211_CHALLENGE_LEN
) {
1070 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1071 ni
->ni_macaddr
, "shared key auth",
1072 "bad challenge len %d", challenge
[1]);
1073 ic
->ic_stats
.is_rx_bad_auth
++;
1074 estatus
= IEEE80211_STATUS_CHALLENGE
;
1080 switch (ic
->ic_opmode
) {
1081 case IEEE80211_M_MONITOR
:
1082 case IEEE80211_M_AHDEMO
:
1083 case IEEE80211_M_IBSS
:
1084 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1085 ni
->ni_macaddr
, "shared key auth",
1086 "bad operating mode %u", ic
->ic_opmode
);
1088 case IEEE80211_M_HOSTAP
:
1089 if (ic
->ic_state
!= IEEE80211_S_RUN
) {
1090 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1091 ni
->ni_macaddr
, "shared key auth",
1092 "bad state %u", ic
->ic_state
);
1093 estatus
= IEEE80211_STATUS_ALG
; /* XXX */
1097 case IEEE80211_AUTH_SHARED_REQUEST
:
1098 if (ni
== ic
->ic_bss
) {
1099 ni
= ieee80211_dup_bss(&ic
->ic_sta
, wh
->i_addr2
);
1101 /* NB: no way to return an error */
1106 if ((ni
->ni_flags
& IEEE80211_NODE_AREF
) == 0)
1107 (void) ieee80211_ref_node(ni
);
1111 * Mark the node as referenced to reflect that it's
1112 * reference count has been bumped to insure it remains
1113 * after the transaction completes.
1115 ni
->ni_flags
|= IEEE80211_NODE_AREF
;
1117 ni
->ni_rstamp
= rstamp
;
1118 if (!alloc_challenge(ic
, ni
)) {
1119 /* NB: don't return error so they rexmit */
1122 get_random_bytes(ni
->ni_challenge
,
1123 IEEE80211_CHALLENGE_LEN
);
1124 IEEE80211_DPRINTF(ic
,
1125 IEEE80211_MSG_DEBUG
| IEEE80211_MSG_AUTH
,
1126 "[%6D] shared key %sauth request\n",
1127 ni
->ni_macaddr
, ":",
1128 allocbs
? "" : "re");
1130 case IEEE80211_AUTH_SHARED_RESPONSE
:
1131 if (ni
== ic
->ic_bss
) {
1132 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1133 ni
->ni_macaddr
, "shared key response",
1134 "%s", "unknown station");
1135 /* NB: don't send a response */
1138 if (ni
->ni_challenge
== NULL
) {
1139 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1140 ni
->ni_macaddr
, "shared key response",
1141 "%s", "no challenge recorded");
1142 ic
->ic_stats
.is_rx_bad_auth
++;
1143 estatus
= IEEE80211_STATUS_CHALLENGE
;
1146 if (memcmp(ni
->ni_challenge
, &challenge
[2],
1147 challenge
[1]) != 0) {
1148 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1149 ni
->ni_macaddr
, "shared key response",
1150 "%s", "challenge mismatch");
1151 ic
->ic_stats
.is_rx_auth_fail
++;
1152 estatus
= IEEE80211_STATUS_CHALLENGE
;
1155 IEEE80211_DPRINTF(ic
,
1156 IEEE80211_MSG_DEBUG
| IEEE80211_MSG_AUTH
,
1157 "[%6D] station authenticated (shared key)\n",
1158 ni
->ni_macaddr
, ":");
1159 ieee80211_node_authorize(ni
);
1162 IEEE80211_DISCARD_MAC(ic
, IEEE80211_MSG_AUTH
,
1163 ni
->ni_macaddr
, "shared key auth",
1165 ic
->ic_stats
.is_rx_bad_auth
++;
1166 estatus
= IEEE80211_STATUS_SEQUENCE
;
1169 IEEE80211_SEND_MGMT(ic
, ni
,
1170 IEEE80211_FC0_SUBTYPE_AUTH
, seq
+ 1);
1173 case IEEE80211_M_STA
:
1174 if (ic
->ic_state
!= IEEE80211_S_AUTH
)
1177 case IEEE80211_AUTH_SHARED_PASS
:
1178 if (ni
->ni_challenge
!= NULL
) {
1179 FREE(ni
->ni_challenge
, M_DEVBUF
);
1180 ni
->ni_challenge
= NULL
;
1183 IEEE80211_DPRINTF(ic
,
1184 IEEE80211_MSG_DEBUG
| IEEE80211_MSG_AUTH
,
1185 "[%6D] shared key auth failed (reason %d)\n",
1186 ieee80211_getbssid(ic
, wh
), ":", status
);
1187 /* XXX can this happen? */
1188 if (ni
!= ic
->ic_bss
)
1190 ic
->ic_stats
.is_rx_auth_fail
++;
1193 ieee80211_new_state(ic
, IEEE80211_S_ASSOC
,
1194 wh
->i_fc
[0] & IEEE80211_FC0_SUBTYPE_MASK
);
1196 case IEEE80211_AUTH_SHARED_CHALLENGE
:
1197 if (!alloc_challenge(ic
, ni
))
1199 /* XXX could optimize by passing recvd challenge */
1200 memcpy(ni
->ni_challenge
, &challenge
[2], challenge
[1]);
1201 IEEE80211_SEND_MGMT(ic
, ni
,
1202 IEEE80211_FC0_SUBTYPE_AUTH
, seq
+ 1);
1205 IEEE80211_DISCARD(ic
, IEEE80211_MSG_AUTH
,
1206 wh
, "shared key auth", "bad seq %d", seq
);
1207 ic
->ic_stats
.is_rx_bad_auth
++;
1215 * Send an error response; but only when operating as an AP.
1217 if (ic
->ic_opmode
== IEEE80211_M_HOSTAP
) {
1218 /* XXX hack to workaround calling convention */
1219 ieee80211_send_error(ic
, ni
, wh
->i_addr2
,
1220 IEEE80211_FC0_SUBTYPE_AUTH
,
1221 (seq
+ 1) | (estatus
<<16));
1222 } else if (ic
->ic_opmode
== IEEE80211_M_STA
) {
1224 * Kick the state machine. This short-circuits
1225 * using the mgt frame timeout to trigger the
1228 if (ic
->ic_state
== IEEE80211_S_AUTH
)
1229 ieee80211_new_state(ic
, IEEE80211_S_SCAN
, 0);
1233 /* Verify the existence and length of __elem or get out. */
1234 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \
1235 if ((__elem) == NULL) { \
1236 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \
1237 wh, ieee80211_mgt_subtype_name[subtype >> \
1238 IEEE80211_FC0_SUBTYPE_SHIFT], \
1239 "%s", "no " #__elem ); \
1240 ic->ic_stats.is_rx_elem_missing++; \
1243 if ((__elem)[1] > (__maxlen)) { \
1244 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \
1245 wh, ieee80211_mgt_subtype_name[subtype >> \
1246 IEEE80211_FC0_SUBTYPE_SHIFT], \
1247 "bad " #__elem " len %d", (__elem)[1]); \
1248 ic->ic_stats.is_rx_elem_toobig++; \
1253 #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \
1254 if ((_len) < (_minlen)) { \
1255 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \
1256 wh, ieee80211_mgt_subtype_name[subtype >> \
1257 IEEE80211_FC0_SUBTYPE_SHIFT], \
1258 "%s", "ie too short"); \
1259 ic->ic_stats.is_rx_elem_toosmall++; \
1264 #ifdef IEEE80211_DEBUG
1266 ieee80211_ssid_mismatch(struct ieee80211com
*ic
, const char *tag
,
1267 uint8_t mac
[IEEE80211_ADDR_LEN
], uint8_t *ssid
)
1269 printf("[%6D] discard %s frame, ssid mismatch: ", mac
, ":", tag
);
1270 ieee80211_print_essid(ssid
+ 2, ssid
[1]);
1274 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \
1275 if ((_ssid)[1] != 0 && \
1276 ((_ssid)[1] != (_ni)->ni_esslen || \
1277 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \
1278 if (ieee80211_msg_input(ic)) \
1279 ieee80211_ssid_mismatch(ic, \
1280 ieee80211_mgt_subtype_name[subtype >> \
1281 IEEE80211_FC0_SUBTYPE_SHIFT], \
1282 wh->i_addr2, _ssid); \
1283 ic->ic_stats.is_rx_ssidmismatch++; \
1287 #else /* !IEEE80211_DEBUG */
1288 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \
1289 if ((_ssid)[1] != 0 && \
1290 ((_ssid)[1] != (_ni)->ni_esslen || \
1291 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \
1292 ic->ic_stats.is_rx_ssidmismatch++; \
1296 #endif /* !IEEE80211_DEBUG */
1298 /* unalligned little endian access */
1299 #define LE_READ_2(p) \
1301 ((((const uint8_t *)(p))[0] ) | \
1302 (((const uint8_t *)(p))[1] << 8)))
1303 #define LE_READ_4(p) \
1305 ((((const uint8_t *)(p))[0] ) | \
1306 (((const uint8_t *)(p))[1] << 8) | \
1307 (((const uint8_t *)(p))[2] << 16) | \
1308 (((const uint8_t *)(p))[3] << 24)))
1311 iswpaoui(const uint8_t *frm
)
1313 return frm
[1] > 3 && LE_READ_4(frm
+2) == ((WPA_OUI_TYPE
<<24)|WPA_OUI
);
1317 iswmeoui(const uint8_t *frm
)
1319 return frm
[1] > 3 && LE_READ_4(frm
+2) == ((WME_OUI_TYPE
<<24)|WME_OUI
);
1323 iswmeparam(const uint8_t *frm
)
1325 return frm
[1] > 5 && LE_READ_4(frm
+2) == ((WME_OUI_TYPE
<<24)|WME_OUI
) &&
1326 frm
[6] == WME_PARAM_OUI_SUBTYPE
;
1330 iswmeinfo(const uint8_t *frm
)
1332 return frm
[1] > 5 && LE_READ_4(frm
+2) == ((WME_OUI_TYPE
<<24)|WME_OUI
) &&
1333 frm
[6] == WME_INFO_OUI_SUBTYPE
;
1337 isatherosoui(const uint8_t *frm
)
1339 return frm
[1] > 3 && LE_READ_4(frm
+2) == ((ATH_OUI_TYPE
<<24)|ATH_OUI
);
1343 * Convert a WPA cipher selector OUI to an internal
1344 * cipher algorithm. Where appropriate we also
1345 * record any key length.
1348 wpa_cipher(uint8_t *sel
, uint8_t *keylen
)
1350 #define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1351 uint32_t w
= LE_READ_4(sel
);
1354 case WPA_SEL(WPA_CSE_NULL
):
1355 return IEEE80211_CIPHER_NONE
;
1356 case WPA_SEL(WPA_CSE_WEP40
):
1358 *keylen
= 40 / NBBY
;
1359 return IEEE80211_CIPHER_WEP
;
1360 case WPA_SEL(WPA_CSE_WEP104
):
1362 *keylen
= 104 / NBBY
;
1363 return IEEE80211_CIPHER_WEP
;
1364 case WPA_SEL(WPA_CSE_TKIP
):
1365 return IEEE80211_CIPHER_TKIP
;
1366 case WPA_SEL(WPA_CSE_CCMP
):
1367 return IEEE80211_CIPHER_AES_CCM
;
1369 return 32; /* NB: so 1<< is discarded */
1374 * Convert a WPA key management/authentication algorithm
1375 * to an internal code.
1378 wpa_keymgmt(uint8_t *sel
)
1380 #define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1381 uint32_t w
= LE_READ_4(sel
);
1384 case WPA_SEL(WPA_ASE_8021X_UNSPEC
):
1385 return WPA_ASE_8021X_UNSPEC
;
1386 case WPA_SEL(WPA_ASE_8021X_PSK
):
1387 return WPA_ASE_8021X_PSK
;
1388 case WPA_SEL(WPA_ASE_NONE
):
1389 return WPA_ASE_NONE
;
1391 return 0; /* NB: so is discarded */
1396 * Parse a WPA information element to collect parameters
1397 * and validate the parameters against what has been
1398 * configured for the system.
1401 ieee80211_parse_wpa(struct ieee80211com
*ic
, uint8_t *frm
,
1402 struct ieee80211_rsnparms
*rsn
, const struct ieee80211_frame
*wh
)
1404 uint8_t len
= frm
[1];
1409 * Check the length once for fixed parts: OUI, type,
1410 * version, mcast cipher, and 2 selector counts.
1411 * Other, variable-length data, must be checked separately.
1413 if ((ic
->ic_flags
& IEEE80211_F_WPA1
) == 0) {
1414 IEEE80211_DISCARD_IE(ic
,
1415 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1416 wh
, "WPA", "not WPA, flags 0x%x", ic
->ic_flags
);
1417 return IEEE80211_REASON_IE_INVALID
;
1420 IEEE80211_DISCARD_IE(ic
,
1421 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1422 wh
, "WPA", "too short, len %u", len
);
1423 return IEEE80211_REASON_IE_INVALID
;
1425 frm
+= 6, len
-= 4; /* NB: len is payload only */
1426 /* NB: iswapoui already validated the OUI and type */
1428 if (w
!= WPA_VERSION
) {
1429 IEEE80211_DISCARD_IE(ic
,
1430 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1431 wh
, "WPA", "bad version %u", w
);
1432 return IEEE80211_REASON_IE_INVALID
;
1436 /* multicast/group cipher */
1437 w
= wpa_cipher(frm
, &rsn
->rsn_mcastkeylen
);
1438 if (w
!= rsn
->rsn_mcastcipher
) {
1439 IEEE80211_DISCARD_IE(ic
,
1440 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1441 wh
, "WPA", "mcast cipher mismatch; got %u, expected %u",
1442 w
, rsn
->rsn_mcastcipher
);
1443 return IEEE80211_REASON_IE_INVALID
;
1447 /* unicast ciphers */
1451 IEEE80211_DISCARD_IE(ic
,
1452 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1453 wh
, "WPA", "ucast cipher data too short; len %u, n %u",
1455 return IEEE80211_REASON_IE_INVALID
;
1458 for (; n
> 0; n
--) {
1459 w
|= 1<<wpa_cipher(frm
, &rsn
->rsn_ucastkeylen
);
1462 w
&= rsn
->rsn_ucastcipherset
;
1464 IEEE80211_DISCARD_IE(ic
,
1465 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1466 wh
, "WPA", "%s", "ucast cipher set empty");
1467 return IEEE80211_REASON_IE_INVALID
;
1469 if (w
& (1<<IEEE80211_CIPHER_TKIP
))
1470 rsn
->rsn_ucastcipher
= IEEE80211_CIPHER_TKIP
;
1472 rsn
->rsn_ucastcipher
= IEEE80211_CIPHER_AES_CCM
;
1474 /* key management algorithms */
1478 IEEE80211_DISCARD_IE(ic
,
1479 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1480 wh
, "WPA", "key mgmt alg data too short; len %u, n %u",
1482 return IEEE80211_REASON_IE_INVALID
;
1485 for (; n
> 0; n
--) {
1486 w
|= wpa_keymgmt(frm
);
1489 w
&= rsn
->rsn_keymgmtset
;
1491 IEEE80211_DISCARD_IE(ic
,
1492 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1493 wh
, "WPA", "%s", "no acceptable key mgmt alg");
1494 return IEEE80211_REASON_IE_INVALID
;
1496 if (w
& WPA_ASE_8021X_UNSPEC
)
1497 rsn
->rsn_keymgmt
= WPA_ASE_8021X_UNSPEC
;
1499 rsn
->rsn_keymgmt
= WPA_ASE_8021X_PSK
;
1501 if (len
> 2) /* optional capabilities */
1502 rsn
->rsn_caps
= LE_READ_2(frm
);
1508 * Convert an RSN cipher selector OUI to an internal
1509 * cipher algorithm. Where appropriate we also
1510 * record any key length.
1513 rsn_cipher(uint8_t *sel
, uint8_t *keylen
)
1515 #define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1516 uint32_t w
= LE_READ_4(sel
);
1519 case RSN_SEL(RSN_CSE_NULL
):
1520 return IEEE80211_CIPHER_NONE
;
1521 case RSN_SEL(RSN_CSE_WEP40
):
1523 *keylen
= 40 / NBBY
;
1524 return IEEE80211_CIPHER_WEP
;
1525 case RSN_SEL(RSN_CSE_WEP104
):
1527 *keylen
= 104 / NBBY
;
1528 return IEEE80211_CIPHER_WEP
;
1529 case RSN_SEL(RSN_CSE_TKIP
):
1530 return IEEE80211_CIPHER_TKIP
;
1531 case RSN_SEL(RSN_CSE_CCMP
):
1532 return IEEE80211_CIPHER_AES_CCM
;
1533 case RSN_SEL(RSN_CSE_WRAP
):
1534 return IEEE80211_CIPHER_AES_OCB
;
1536 return 32; /* NB: so 1<< is discarded */
1541 * Convert an RSN key management/authentication algorithm
1542 * to an internal code.
1545 rsn_keymgmt(uint8_t *sel
)
1547 #define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1548 uint32_t w
= LE_READ_4(sel
);
1551 case RSN_SEL(RSN_ASE_8021X_UNSPEC
):
1552 return RSN_ASE_8021X_UNSPEC
;
1553 case RSN_SEL(RSN_ASE_8021X_PSK
):
1554 return RSN_ASE_8021X_PSK
;
1555 case RSN_SEL(RSN_ASE_NONE
):
1556 return RSN_ASE_NONE
;
1558 return 0; /* NB: so is discarded */
1563 * Parse a WPA/RSN information element to collect parameters
1564 * and validate the parameters against what has been
1565 * configured for the system.
1568 ieee80211_parse_rsn(struct ieee80211com
*ic
, uint8_t *frm
,
1569 struct ieee80211_rsnparms
*rsn
, const struct ieee80211_frame
*wh
)
1571 uint8_t len
= frm
[1];
1576 * Check the length once for fixed parts:
1577 * version, mcast cipher, and 2 selector counts.
1578 * Other, variable-length data, must be checked separately.
1580 if ((ic
->ic_flags
& IEEE80211_F_WPA2
) == 0) {
1581 IEEE80211_DISCARD_IE(ic
,
1582 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1583 wh
, "WPA", "not RSN, flags 0x%x", ic
->ic_flags
);
1584 return IEEE80211_REASON_IE_INVALID
;
1587 IEEE80211_DISCARD_IE(ic
,
1588 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1589 wh
, "RSN", "too short, len %u", len
);
1590 return IEEE80211_REASON_IE_INVALID
;
1594 if (w
!= RSN_VERSION
) {
1595 IEEE80211_DISCARD_IE(ic
,
1596 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1597 wh
, "RSN", "bad version %u", w
);
1598 return IEEE80211_REASON_IE_INVALID
;
1602 /* multicast/group cipher */
1603 w
= rsn_cipher(frm
, &rsn
->rsn_mcastkeylen
);
1604 if (w
!= rsn
->rsn_mcastcipher
) {
1605 IEEE80211_DISCARD_IE(ic
,
1606 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1607 wh
, "RSN", "mcast cipher mismatch; got %u, expected %u",
1608 w
, rsn
->rsn_mcastcipher
);
1609 return IEEE80211_REASON_IE_INVALID
;
1613 /* unicast ciphers */
1617 IEEE80211_DISCARD_IE(ic
,
1618 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1619 wh
, "RSN", "ucast cipher data too short; len %u, n %u",
1621 return IEEE80211_REASON_IE_INVALID
;
1624 for (; n
> 0; n
--) {
1625 w
|= 1<<rsn_cipher(frm
, &rsn
->rsn_ucastkeylen
);
1628 w
&= rsn
->rsn_ucastcipherset
;
1630 IEEE80211_DISCARD_IE(ic
,
1631 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1632 wh
, "RSN", "%s", "ucast cipher set empty");
1633 return IEEE80211_REASON_IE_INVALID
;
1635 if (w
& (1<<IEEE80211_CIPHER_TKIP
))
1636 rsn
->rsn_ucastcipher
= IEEE80211_CIPHER_TKIP
;
1638 rsn
->rsn_ucastcipher
= IEEE80211_CIPHER_AES_CCM
;
1640 /* key management algorithms */
1644 IEEE80211_DISCARD_IE(ic
,
1645 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1646 wh
, "RSN", "key mgmt alg data too short; len %u, n %u",
1648 return IEEE80211_REASON_IE_INVALID
;
1651 for (; n
> 0; n
--) {
1652 w
|= rsn_keymgmt(frm
);
1655 w
&= rsn
->rsn_keymgmtset
;
1657 IEEE80211_DISCARD_IE(ic
,
1658 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WPA
,
1659 wh
, "RSN", "%s", "no acceptable key mgmt alg");
1660 return IEEE80211_REASON_IE_INVALID
;
1662 if (w
& RSN_ASE_8021X_UNSPEC
)
1663 rsn
->rsn_keymgmt
= RSN_ASE_8021X_UNSPEC
;
1665 rsn
->rsn_keymgmt
= RSN_ASE_8021X_PSK
;
1667 /* optional RSN capabilities */
1669 rsn
->rsn_caps
= LE_READ_2(frm
);
1676 ieee80211_parse_wmeparams(struct ieee80211com
*ic
, uint8_t *frm
,
1677 const struct ieee80211_frame
*wh
)
1679 #define MS(_v, _f) (((_v) & _f) >> _f##_S)
1680 struct ieee80211_wme_state
*wme
= &ic
->ic_wme
;
1681 u_int len
= frm
[1], qosinfo
;
1684 if (len
< sizeof(struct ieee80211_wme_param
)-2) {
1685 IEEE80211_DISCARD_IE(ic
,
1686 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_WME
,
1687 wh
, "WME", "too short, len %u", len
);
1690 qosinfo
= frm
[__offsetof(struct ieee80211_wme_param
, param_qosInfo
)];
1691 qosinfo
&= WME_QOSINFO_COUNT
;
1692 /* XXX do proper check for wraparound */
1693 if (qosinfo
== wme
->wme_wmeChanParams
.cap_info
)
1695 frm
+= __offsetof(struct ieee80211_wme_param
, params_acParams
);
1696 for (i
= 0; i
< WME_NUM_AC
; i
++) {
1697 struct wmeParams
*wmep
=
1698 &wme
->wme_wmeChanParams
.cap_wmeParams
[i
];
1699 /* NB: ACI not used */
1700 wmep
->wmep_acm
= MS(frm
[0], WME_PARAM_ACM
);
1701 wmep
->wmep_aifsn
= MS(frm
[0], WME_PARAM_AIFSN
);
1702 wmep
->wmep_logcwmin
= MS(frm
[1], WME_PARAM_LOGCWMIN
);
1703 wmep
->wmep_logcwmax
= MS(frm
[1], WME_PARAM_LOGCWMAX
);
1704 wmep
->wmep_txopLimit
= LE_READ_2(frm
+2);
1707 wme
->wme_wmeChanParams
.cap_info
= qosinfo
;
1713 ieee80211_saveie(uint8_t **iep
, const uint8_t *ie
)
1715 u_int ielen
= ie
[1]+2;
1717 * Record information element for later use.
1719 if (*iep
== NULL
|| (*iep
)[1] != ie
[1]) {
1721 FREE(*iep
, M_DEVBUF
);
1722 MALLOC(*iep
, void*, ielen
, M_DEVBUF
, M_NOWAIT
);
1725 memcpy(*iep
, ie
, ielen
);
1726 /* XXX note failure */
1729 /* XXX find a better place for definition */
1730 struct l2_update_frame
{
1731 struct ether_header eh
;
1739 * Deliver a TGf L2UF frame on behalf of a station.
1740 * This primes any bridge when the station is roaming
1741 * between ap's on the same wired network.
1744 ieee80211_deliver_l2uf(struct ieee80211_node
*ni
)
1746 struct ieee80211com
*ic
= ni
->ni_ic
;
1747 struct ifnet
*ifp
= ic
->ic_ifp
;
1749 struct l2_update_frame
*l2uf
;
1750 struct ether_header
*eh
;
1752 m
= m_gethdr(M_NOWAIT
, MT_DATA
);
1754 IEEE80211_NOTE(ic
, IEEE80211_MSG_ASSOC
, ni
,
1755 "%s", "no mbuf for l2uf frame");
1756 ic
->ic_stats
.is_rx_nobuf
++; /* XXX not right */
1759 l2uf
= mtod(m
, struct l2_update_frame
*);
1761 /* dst: Broadcast address */
1762 IEEE80211_ADDR_COPY(eh
->ether_dhost
, ifp
->if_broadcastaddr
);
1763 /* src: associated STA */
1764 IEEE80211_ADDR_COPY(eh
->ether_shost
, ni
->ni_macaddr
);
1765 eh
->ether_type
= htons(sizeof(*l2uf
) - sizeof(*eh
));
1769 l2uf
->control
= 0xf5;
1770 l2uf
->xid
[0] = 0x81;
1771 l2uf
->xid
[1] = 0x80;
1772 l2uf
->xid
[2] = 0x00;
1774 m
->m_pkthdr
.len
= m
->m_len
= sizeof(*l2uf
);
1775 m
->m_pkthdr
.rcvif
= ifp
;
1776 ieee80211_deliver_data(ic
, ni
, m
);
1780 ieee80211_recv_mgmt(struct ieee80211com
*ic
, struct mbuf
*m0
,
1781 struct ieee80211_node
*ni
,
1782 int subtype
, int rssi
, uint32_t rstamp
)
1784 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1785 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1786 struct ieee80211_frame
*wh
;
1787 uint8_t *frm
, *efrm
;
1788 uint8_t *ssid
, *rates
, *xrates
, *wpa
, *wme
;
1789 int reassoc
, resp
, allocbs
;
1792 wh
= mtod(m0
, struct ieee80211_frame
*);
1793 frm
= (uint8_t *)&wh
[1];
1794 efrm
= mtod(m0
, uint8_t *) + m0
->m_len
;
1796 case IEEE80211_FC0_SUBTYPE_PROBE_RESP
:
1797 case IEEE80211_FC0_SUBTYPE_BEACON
: {
1798 struct ieee80211_scanparams scan
;
1801 * We process beacon/probe response frames:
1802 * o when scanning, or
1803 * o station mode when associated (to collect state
1804 * updates such as 802.11g slot time), or
1805 * o adhoc mode (to discover neighbors)
1806 * Frames otherwise received are discarded.
1808 if (!((ic
->ic_flags
& IEEE80211_F_SCAN
) ||
1809 (ic
->ic_opmode
== IEEE80211_M_STA
&& ni
->ni_associd
) ||
1810 ic
->ic_opmode
== IEEE80211_M_IBSS
)) {
1811 ic
->ic_stats
.is_rx_mgtdiscard
++;
1815 * beacon/probe response frame format
1817 * [2] beacon interval
1818 * [2] capability information
1820 * [tlv] supported rates
1821 * [tlv] country information
1822 * [tlv] parameter set (FH/DS)
1823 * [tlv] erp information
1824 * [tlv] extended supported rates
1828 IEEE80211_VERIFY_LENGTH(efrm
- frm
, 12);
1829 memset(&scan
, 0, sizeof(scan
));
1830 scan
.tstamp
= frm
; frm
+= 8;
1831 scan
.bintval
= le16toh(*(uint16_t *)frm
); frm
+= 2;
1832 scan
.capinfo
= le16toh(*(uint16_t *)frm
); frm
+= 2;
1833 scan
.bchan
= ieee80211_chan2ieee(ic
, ic
->ic_curchan
);
1834 scan
.chan
= scan
.bchan
;
1836 while (efrm
- frm
> 1) {
1837 IEEE80211_VERIFY_LENGTH(efrm
- frm
, frm
[1] + 2);
1839 case IEEE80211_ELEMID_SSID
:
1842 case IEEE80211_ELEMID_RATES
:
1845 case IEEE80211_ELEMID_COUNTRY
:
1848 case IEEE80211_ELEMID_FHPARMS
:
1849 if (ic
->ic_phytype
== IEEE80211_T_FH
) {
1850 scan
.fhdwell
= LE_READ_2(&frm
[2]);
1851 scan
.chan
= IEEE80211_FH_CHAN(frm
[4], frm
[5]);
1852 scan
.fhindex
= frm
[6];
1855 case IEEE80211_ELEMID_DSPARMS
:
1857 * XXX hack this since depending on phytype
1858 * is problematic for multi-mode devices.
1860 if (ic
->ic_phytype
!= IEEE80211_T_FH
)
1863 case IEEE80211_ELEMID_TIM
:
1866 scan
.timoff
= frm
- mtod(m0
, uint8_t *);
1868 case IEEE80211_ELEMID_IBSSPARMS
:
1870 case IEEE80211_ELEMID_XRATES
:
1873 case IEEE80211_ELEMID_ERP
:
1875 IEEE80211_DISCARD_IE(ic
,
1876 IEEE80211_MSG_ELEMID
, wh
, "ERP",
1877 "bad len %u", frm
[1]);
1878 ic
->ic_stats
.is_rx_elem_toobig
++;
1883 case IEEE80211_ELEMID_RSN
:
1886 case IEEE80211_ELEMID_VENDOR
:
1889 else if (iswmeparam(frm
) || iswmeinfo(frm
))
1891 /* XXX Atheros OUI support */
1894 IEEE80211_DISCARD_IE(ic
, IEEE80211_MSG_ELEMID
,
1896 "id %u, len %u", *frm
, frm
[1]);
1897 ic
->ic_stats
.is_rx_elem_unknown
++;
1902 IEEE80211_VERIFY_ELEMENT(scan
.rates
, IEEE80211_RATE_MAXSIZE
);
1903 IEEE80211_VERIFY_ELEMENT(scan
.ssid
, IEEE80211_NWID_LEN
);
1905 #if IEEE80211_CHAN_MAX < 255
1906 scan
.chan
> IEEE80211_CHAN_MAX
||
1908 isclr(ic
->ic_chan_active
, scan
.chan
)) {
1909 IEEE80211_DISCARD(ic
,
1910 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_INPUT
,
1911 wh
, ieee80211_mgt_subtype_name
[subtype
>>
1912 IEEE80211_FC0_SUBTYPE_SHIFT
],
1913 "invalid channel %u", scan
.chan
);
1914 ic
->ic_stats
.is_rx_badchan
++;
1917 if (scan
.chan
!= scan
.bchan
&&
1918 ic
->ic_phytype
!= IEEE80211_T_FH
) {
1920 * Frame was received on a channel different from the
1921 * one indicated in the DS params element id;
1922 * silently discard it.
1924 * NB: this can happen due to signal leakage.
1925 * But we should take it for FH phy because
1926 * the rssi value should be correct even for
1927 * different hop pattern in FH.
1929 IEEE80211_DISCARD(ic
,
1930 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_INPUT
,
1931 wh
, ieee80211_mgt_subtype_name
[subtype
>>
1932 IEEE80211_FC0_SUBTYPE_SHIFT
],
1933 "for off-channel %u", scan
.chan
);
1934 ic
->ic_stats
.is_rx_chanmismatch
++;
1937 if (!(IEEE80211_BINTVAL_MIN
<= scan
.bintval
&&
1938 scan
.bintval
<= IEEE80211_BINTVAL_MAX
)) {
1939 IEEE80211_DISCARD(ic
,
1940 IEEE80211_MSG_ELEMID
| IEEE80211_MSG_INPUT
,
1941 wh
, ieee80211_mgt_subtype_name
[subtype
>>
1942 IEEE80211_FC0_SUBTYPE_SHIFT
],
1943 "bogus beacon interval", scan
.bintval
);
1944 ic
->ic_stats
.is_rx_badbintval
++;
1949 * Count frame now that we know it's to be processed.
1951 if (subtype
== IEEE80211_FC0_SUBTYPE_BEACON
) {
1952 ic
->ic_stats
.is_rx_beacon
++; /* XXX remove */
1953 IEEE80211_NODE_STAT(ni
, rx_beacons
);
1955 IEEE80211_NODE_STAT(ni
, rx_proberesp
);
1958 * When operating in station mode, check for state updates.
1959 * Be careful to ignore beacons received while doing a
1960 * background scan. We consider only 11g/WMM stuff right now.
1962 if (ic
->ic_opmode
== IEEE80211_M_STA
&&
1963 ni
->ni_associd
!= 0 &&
1964 ((ic
->ic_flags
& IEEE80211_F_SCAN
) == 0 ||
1965 IEEE80211_ADDR_EQ(wh
->i_addr2
, ni
->ni_bssid
))) {
1966 /* record tsf of last beacon */
1967 memcpy(ni
->ni_tstamp
.data
, scan
.tstamp
,
1968 sizeof(ni
->ni_tstamp
));
1969 /* count beacon frame for s/w bmiss handling */
1970 ic
->ic_swbmiss_count
++;
1971 ic
->ic_bmiss_count
= 0;
1972 if (ni
->ni_erp
!= scan
.erp
) {
1973 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ASSOC
,
1974 "[%6D] erp change: was 0x%x, now 0x%x\n",
1975 wh
->i_addr2
, ":", ni
->ni_erp
, scan
.erp
);
1976 if (ic
->ic_curmode
== IEEE80211_MODE_11G
&&
1977 (ni
->ni_erp
& IEEE80211_ERP_USE_PROTECTION
))
1978 ic
->ic_flags
|= IEEE80211_F_USEPROT
;
1980 ic
->ic_flags
&= ~IEEE80211_F_USEPROT
;
1981 ni
->ni_erp
= scan
.erp
;
1984 if (ni
->ni_capinfo
!= scan
.capinfo
) {
1985 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ASSOC
,
1986 "[%6D] capabilities change: before 0x%x,"
1989 ni
->ni_capinfo
, scan
.capinfo
);
1991 if ((ni
->ni_capinfo
^ scan
.capinfo
) &
1992 IEEE80211_CAPINFO_SHORT_SLOTTIME
) {
1993 ieee80211_set_shortslottime(ic
,
1994 ic
->ic_curmode
== IEEE80211_MODE_11A
||
1995 (scan
.capinfo
& IEEE80211_CAPINFO_SHORT_SLOTTIME
));
1997 ni
->ni_capinfo
= scan
.capinfo
;
2001 /* NOTE: after ni_capinfo and ni_erp updates */
2002 ieee80211_set_shortpreamble(ic
, ni
);
2004 if (scan
.wme
!= NULL
&&
2005 (ni
->ni_flags
& IEEE80211_NODE_QOS
) &&
2006 ieee80211_parse_wmeparams(ic
, scan
.wme
, wh
) > 0)
2007 ieee80211_wme_updateparams(ic
);
2008 if (scan
.tim
!= NULL
) {
2009 struct ieee80211_tim_ie
*ie
=
2010 (struct ieee80211_tim_ie
*) scan
.tim
;
2012 ni
->ni_dtim_count
= ie
->tim_count
;
2013 ni
->ni_dtim_period
= ie
->tim_period
;
2015 if (ic
->ic_flags
& IEEE80211_F_SCAN
)
2016 ieee80211_add_scan(ic
, &scan
, wh
,
2017 subtype
, rssi
, rstamp
);
2021 * If scanning, just pass information to the scan module.
2023 if (ic
->ic_flags
& IEEE80211_F_SCAN
) {
2024 if (ic
->ic_flags_ext
& IEEE80211_FEXT_PROBECHAN
) {
2026 * Actively scanning a channel marked passive;
2027 * send a probe request now that we know there
2028 * is 802.11 traffic present.
2030 * XXX check if the beacon we recv'd gives
2031 * us what we need and suppress the probe req
2033 ieee80211_probe_curchan(ic
, 1);
2034 ic
->ic_flags_ext
&= ~IEEE80211_FEXT_PROBECHAN
;
2036 ieee80211_add_scan(ic
, &scan
, wh
,
2037 subtype
, rssi
, rstamp
);
2040 if (scan
.capinfo
& IEEE80211_CAPINFO_IBSS
) {
2041 if (!IEEE80211_ADDR_EQ(wh
->i_addr2
, ni
->ni_macaddr
)) {
2043 * Create a new entry in the neighbor table.
2045 ni
= ieee80211_add_neighbor(ic
, wh
, &scan
);
2046 } else if (ni
->ni_capinfo
== 0) {
2048 * Update faked node created on transmit.
2049 * Note this also updates the tsf.
2051 ieee80211_init_neighbor(ni
, wh
, &scan
);
2054 * Record tsf for potential resync.
2056 memcpy(ni
->ni_tstamp
.data
, scan
.tstamp
,
2057 sizeof(ni
->ni_tstamp
));
2061 ni
->ni_rstamp
= rstamp
;
2067 case IEEE80211_FC0_SUBTYPE_PROBE_REQ
:
2068 if (ic
->ic_opmode
== IEEE80211_M_STA
||
2069 ic
->ic_state
!= IEEE80211_S_RUN
) {
2070 ic
->ic_stats
.is_rx_mgtdiscard
++;
2073 if (IEEE80211_IS_MULTICAST(wh
->i_addr2
)) {
2074 /* frame must be directed */
2075 ic
->ic_stats
.is_rx_mgtdiscard
++; /* XXX stat */
2080 * prreq frame format
2082 * [tlv] supported rates
2083 * [tlv] extended supported rates
2085 ssid
= rates
= xrates
= NULL
;
2086 while (efrm
- frm
> 1) {
2087 IEEE80211_VERIFY_LENGTH(efrm
- frm
, frm
[1] + 2);
2089 case IEEE80211_ELEMID_SSID
:
2092 case IEEE80211_ELEMID_RATES
:
2095 case IEEE80211_ELEMID_XRATES
:
2101 IEEE80211_VERIFY_ELEMENT(rates
, IEEE80211_RATE_MAXSIZE
);
2102 IEEE80211_VERIFY_ELEMENT(ssid
, IEEE80211_NWID_LEN
);
2103 IEEE80211_VERIFY_SSID(ic
->ic_bss
, ssid
);
2104 if ((ic
->ic_flags
& IEEE80211_F_HIDESSID
) && ssid
[1] == 0) {
2105 IEEE80211_DISCARD(ic
, IEEE80211_MSG_INPUT
,
2106 wh
, ieee80211_mgt_subtype_name
[subtype
>>
2107 IEEE80211_FC0_SUBTYPE_SHIFT
],
2108 "%s", "no ssid with ssid suppression enabled");
2109 ic
->ic_stats
.is_rx_ssidmismatch
++; /*XXX*/
2114 if (ni
== ic
->ic_bss
) {
2115 if (ic
->ic_opmode
!= IEEE80211_M_IBSS
) {
2116 ni
= ieee80211_tmp_node(ic
, wh
->i_addr2
);
2118 } else if (!IEEE80211_ADDR_EQ(wh
->i_addr2
, ni
->ni_macaddr
)) {
2120 * XXX Cannot tell if the sender is operating
2121 * in ibss mode. But we need a new node to
2122 * send the response so blindly add them to the
2125 ni
= ieee80211_fakeup_adhoc_node(&ic
->ic_sta
,
2131 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ASSOC
,
2132 "[%6D] recv probe req\n", wh
->i_addr2
, ":");
2134 ni
->ni_rstamp
= rstamp
;
2135 rate
= ieee80211_setup_rates(ni
, rates
, xrates
,
2136 IEEE80211_F_DOSORT
| IEEE80211_F_DOFRATE
2137 | IEEE80211_F_DONEGO
| IEEE80211_F_DODEL
);
2138 if (rate
& IEEE80211_RATE_BASIC
) {
2139 IEEE80211_DISCARD(ic
, IEEE80211_MSG_XRATE
,
2140 wh
, ieee80211_mgt_subtype_name
[subtype
>>
2141 IEEE80211_FC0_SUBTYPE_SHIFT
],
2142 "%s", "recv'd rate set invalid");
2144 IEEE80211_SEND_MGMT(ic
, ni
,
2145 IEEE80211_FC0_SUBTYPE_PROBE_RESP
, 0);
2149 * Temporary node created just to send a
2150 * response, reclaim immediately.
2152 ieee80211_free_node(ni
);
2156 case IEEE80211_FC0_SUBTYPE_AUTH
: {
2157 uint16_t algo
, seq
, status
;
2165 IEEE80211_VERIFY_LENGTH(efrm
- frm
, 6);
2166 algo
= le16toh(*(uint16_t *)frm
);
2167 seq
= le16toh(*(uint16_t *)(frm
+ 2));
2168 status
= le16toh(*(uint16_t *)(frm
+ 4));
2169 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_AUTH
,
2170 "[%6D] recv auth frame with algorithm %d seq %d\n",
2171 wh
->i_addr2
, ":", algo
, seq
);
2173 * Consult the ACL policy module if setup.
2175 if (ic
->ic_acl
!= NULL
&&
2176 !ic
->ic_acl
->iac_check(ic
, wh
->i_addr2
)) {
2177 IEEE80211_DISCARD(ic
, IEEE80211_MSG_ACL
,
2178 wh
, "auth", "%s", "disallowed by ACL");
2179 ic
->ic_stats
.is_rx_acl
++;
2180 if (ic
->ic_opmode
== IEEE80211_M_HOSTAP
) {
2181 IEEE80211_SEND_MGMT(ic
, ni
,
2182 IEEE80211_FC0_SUBTYPE_AUTH
,
2183 (seq
+1) | (IEEE80211_STATUS_UNSPECIFIED
<<16));
2187 if (ic
->ic_flags
& IEEE80211_F_COUNTERM
) {
2188 IEEE80211_DISCARD(ic
,
2189 IEEE80211_MSG_AUTH
| IEEE80211_MSG_CRYPTO
,
2190 wh
, "auth", "%s", "TKIP countermeasures enabled");
2191 ic
->ic_stats
.is_rx_auth_countermeasures
++;
2192 if (ic
->ic_opmode
== IEEE80211_M_HOSTAP
) {
2193 IEEE80211_SEND_MGMT(ic
, ni
,
2194 IEEE80211_FC0_SUBTYPE_AUTH
,
2195 IEEE80211_REASON_MIC_FAILURE
);
2199 if (algo
== IEEE80211_AUTH_ALG_SHARED
)
2200 ieee80211_auth_shared(ic
, wh
, frm
+ 6, efrm
, ni
, rssi
,
2201 rstamp
, seq
, status
);
2202 else if (algo
== IEEE80211_AUTH_ALG_OPEN
)
2203 ieee80211_auth_open(ic
, wh
, ni
, rssi
, rstamp
, seq
,
2206 IEEE80211_DISCARD(ic
, IEEE80211_MSG_ANY
,
2207 wh
, "auth", "unsupported alg %d", algo
);
2208 ic
->ic_stats
.is_rx_auth_unsupported
++;
2209 if (ic
->ic_opmode
== IEEE80211_M_HOSTAP
) {
2211 IEEE80211_SEND_MGMT(ic
, ni
,
2212 IEEE80211_FC0_SUBTYPE_AUTH
,
2213 (seq
+1) | (IEEE80211_STATUS_ALG
<<16));
2220 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ
:
2221 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ
: {
2222 uint16_t capinfo
, lintval
;
2223 struct ieee80211_rsnparms rsn
;
2226 if (ic
->ic_opmode
!= IEEE80211_M_HOSTAP
||
2227 ic
->ic_state
!= IEEE80211_S_RUN
) {
2228 ic
->ic_stats
.is_rx_mgtdiscard
++;
2232 if (subtype
== IEEE80211_FC0_SUBTYPE_REASSOC_REQ
) {
2234 resp
= IEEE80211_FC0_SUBTYPE_REASSOC_RESP
;
2237 resp
= IEEE80211_FC0_SUBTYPE_ASSOC_RESP
;
2240 * asreq frame format
2241 * [2] capability information
2242 * [2] listen interval
2243 * [6*] current AP address (reassoc only)
2245 * [tlv] supported rates
2246 * [tlv] extended supported rates
2249 IEEE80211_VERIFY_LENGTH(efrm
- frm
, (reassoc
? 10 : 4));
2250 if (!IEEE80211_ADDR_EQ(wh
->i_addr3
, ic
->ic_bss
->ni_bssid
)) {
2251 IEEE80211_DISCARD(ic
, IEEE80211_MSG_ANY
,
2252 wh
, ieee80211_mgt_subtype_name
[subtype
>>
2253 IEEE80211_FC0_SUBTYPE_SHIFT
],
2254 "%s", "wrong bssid");
2255 ic
->ic_stats
.is_rx_assoc_bss
++;
2258 capinfo
= le16toh(*(uint16_t *)frm
); frm
+= 2;
2259 lintval
= le16toh(*(uint16_t *)frm
); frm
+= 2;
2261 frm
+= 6; /* ignore current AP info */
2262 ssid
= rates
= xrates
= wpa
= wme
= NULL
;
2263 while (efrm
- frm
> 1) {
2264 IEEE80211_VERIFY_LENGTH(efrm
- frm
, frm
[1] + 2);
2266 case IEEE80211_ELEMID_SSID
:
2269 case IEEE80211_ELEMID_RATES
:
2272 case IEEE80211_ELEMID_XRATES
:
2275 /* XXX verify only one of RSN and WPA ie's? */
2276 case IEEE80211_ELEMID_RSN
:
2279 case IEEE80211_ELEMID_VENDOR
:
2282 else if (iswmeinfo(frm
))
2284 /* XXX Atheros OUI support */
2289 IEEE80211_VERIFY_ELEMENT(rates
, IEEE80211_RATE_MAXSIZE
);
2290 IEEE80211_VERIFY_ELEMENT(ssid
, IEEE80211_NWID_LEN
);
2291 IEEE80211_VERIFY_SSID(ic
->ic_bss
, ssid
);
2293 if (ni
== ic
->ic_bss
) {
2294 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ANY
,
2295 "[%6D] deny %s request, sta not authenticated\n",
2296 wh
->i_addr2
, ":", reassoc
? "reassoc" : "assoc");
2297 ieee80211_send_error(ic
, ni
, wh
->i_addr2
,
2298 IEEE80211_FC0_SUBTYPE_DEAUTH
,
2299 IEEE80211_REASON_ASSOC_NOT_AUTHED
);
2300 ic
->ic_stats
.is_rx_assoc_notauth
++;
2303 /* assert right associstion security credentials */
2304 if (wpa
== NULL
&& (ic
->ic_flags
& IEEE80211_F_WPA
)) {
2305 IEEE80211_DPRINTF(ic
,
2306 IEEE80211_MSG_ASSOC
| IEEE80211_MSG_WPA
,
2307 "[%6D] no WPA/RSN IE in association request\n",
2309 IEEE80211_SEND_MGMT(ic
, ni
,
2310 IEEE80211_FC0_SUBTYPE_DEAUTH
,
2311 IEEE80211_REASON_RSN_REQUIRED
);
2312 ieee80211_node_leave(ic
, ni
);
2313 /* XXX distinguish WPA/RSN? */
2314 ic
->ic_stats
.is_rx_assoc_badwpaie
++;
2319 * Parse WPA information element. Note that
2320 * we initialize the param block from the node
2321 * state so that information in the IE overrides
2322 * our defaults. The resulting parameters are
2323 * installed below after the association is assured.
2326 if (wpa
[0] != IEEE80211_ELEMID_RSN
)
2327 reason
= ieee80211_parse_wpa(ic
, wpa
, &rsn
, wh
);
2329 reason
= ieee80211_parse_rsn(ic
, wpa
, &rsn
, wh
);
2331 IEEE80211_SEND_MGMT(ic
, ni
,
2332 IEEE80211_FC0_SUBTYPE_DEAUTH
, reason
);
2333 ieee80211_node_leave(ic
, ni
);
2334 /* XXX distinguish WPA/RSN? */
2335 ic
->ic_stats
.is_rx_assoc_badwpaie
++;
2338 IEEE80211_DPRINTF(ic
,
2339 IEEE80211_MSG_ASSOC
| IEEE80211_MSG_WPA
,
2340 "[%6D] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n",
2342 wpa
[0] != IEEE80211_ELEMID_RSN
? "WPA" : "RSN",
2343 rsn
.rsn_mcastcipher
, rsn
.rsn_mcastkeylen
,
2344 rsn
.rsn_ucastcipher
, rsn
.rsn_ucastkeylen
,
2345 rsn
.rsn_keymgmt
, rsn
.rsn_caps
);
2347 /* discard challenge after association */
2348 if (ni
->ni_challenge
!= NULL
) {
2349 FREE(ni
->ni_challenge
, M_DEVBUF
);
2350 ni
->ni_challenge
= NULL
;
2352 /* NB: 802.11 spec says to ignore station's privacy bit */
2353 if ((capinfo
& IEEE80211_CAPINFO_ESS
) == 0) {
2354 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ANY
,
2355 "[%6D] deny %s request, capability mismatch 0x%x\n",
2357 reassoc
? "reassoc" : "assoc", capinfo
);
2358 IEEE80211_SEND_MGMT(ic
, ni
, resp
,
2359 IEEE80211_STATUS_CAPINFO
);
2360 ieee80211_node_leave(ic
, ni
);
2361 ic
->ic_stats
.is_rx_assoc_capmismatch
++;
2364 rate
= ieee80211_setup_rates(ni
, rates
, xrates
,
2365 IEEE80211_F_DOSORT
| IEEE80211_F_DOFRATE
|
2366 IEEE80211_F_DONEGO
| IEEE80211_F_DODEL
);
2368 * If constrained to 11g-only stations reject an
2369 * 11b-only station. We cheat a bit here by looking
2370 * at the max negotiated xmit rate and assuming anyone
2371 * with a best rate <24Mb/s is an 11b station.
2373 if ((rate
& IEEE80211_RATE_BASIC
) ||
2374 ((ic
->ic_flags
& IEEE80211_F_PUREG
) && rate
< 48)) {
2375 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ANY
,
2376 "[%6D] deny %s request, rate set mismatch\n",
2378 reassoc
? "reassoc" : "assoc");
2379 IEEE80211_SEND_MGMT(ic
, ni
, resp
,
2380 IEEE80211_STATUS_BASIC_RATE
);
2381 ieee80211_node_leave(ic
, ni
);
2382 ic
->ic_stats
.is_rx_assoc_norate
++;
2386 ni
->ni_rstamp
= rstamp
;
2387 ni
->ni_intval
= lintval
;
2388 ni
->ni_capinfo
= capinfo
;
2389 ni
->ni_chan
= ic
->ic_bss
->ni_chan
;
2390 ni
->ni_fhdwell
= ic
->ic_bss
->ni_fhdwell
;
2391 ni
->ni_fhindex
= ic
->ic_bss
->ni_fhindex
;
2394 * Record WPA/RSN parameters for station, mark
2395 * node as using WPA and record information element
2396 * for applications that require it.
2399 ieee80211_saveie(&ni
->ni_wpa_ie
, wpa
);
2400 } else if (ni
->ni_wpa_ie
!= NULL
) {
2402 * Flush any state from a previous association.
2404 FREE(ni
->ni_wpa_ie
, M_DEVBUF
);
2405 ni
->ni_wpa_ie
= NULL
;
2409 * Record WME parameters for station, mark node
2410 * as capable of QoS and record information
2411 * element for applications that require it.
2413 ieee80211_saveie(&ni
->ni_wme_ie
, wme
);
2414 ni
->ni_flags
|= IEEE80211_NODE_QOS
;
2415 } else if (ni
->ni_wme_ie
!= NULL
) {
2417 * Flush any state from a previous association.
2419 FREE(ni
->ni_wme_ie
, M_DEVBUF
);
2420 ni
->ni_wme_ie
= NULL
;
2421 ni
->ni_flags
&= ~IEEE80211_NODE_QOS
;
2423 ieee80211_deliver_l2uf(ni
);
2424 ieee80211_node_join(ic
, ni
, resp
);
2428 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP
:
2429 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP
: {
2430 uint16_t capinfo
, associd
;
2433 if (ic
->ic_opmode
!= IEEE80211_M_STA
||
2434 ic
->ic_state
!= IEEE80211_S_ASSOC
) {
2435 ic
->ic_stats
.is_rx_mgtdiscard
++;
2440 * asresp frame format
2441 * [2] capability information
2443 * [2] association ID
2444 * [tlv] supported rates
2445 * [tlv] extended supported rates
2448 IEEE80211_VERIFY_LENGTH(efrm
- frm
, 6);
2450 capinfo
= le16toh(*(uint16_t *)frm
);
2452 status
= le16toh(*(uint16_t *)frm
);
2455 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ASSOC
,
2456 "[%6D] %sassoc failed (reason %d)\n",
2458 ISREASSOC(subtype
) ? "re" : "", status
);
2459 if (ni
!= ic
->ic_bss
) /* XXX never true? */
2461 ic
->ic_stats
.is_rx_auth_fail
++; /* XXX */
2464 associd
= le16toh(*(uint16_t *)frm
);
2467 rates
= xrates
= wpa
= wme
= NULL
;
2468 while (efrm
- frm
> 1) {
2469 IEEE80211_VERIFY_LENGTH(efrm
- frm
, frm
[1] + 2);
2471 case IEEE80211_ELEMID_RATES
:
2474 case IEEE80211_ELEMID_XRATES
:
2477 case IEEE80211_ELEMID_VENDOR
:
2480 /* XXX Atheros OUI support */
2486 IEEE80211_VERIFY_ELEMENT(rates
, IEEE80211_RATE_MAXSIZE
);
2487 rate
= ieee80211_setup_rates(ni
, rates
, xrates
,
2488 IEEE80211_F_DOSORT
| IEEE80211_F_DOFRATE
|
2489 IEEE80211_F_DONEGO
| IEEE80211_F_DODEL
);
2490 if (rate
& IEEE80211_RATE_BASIC
) {
2491 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ASSOC
,
2492 "[%6D] %sassoc failed (rate set mismatch)\n",
2494 ISREASSOC(subtype
) ? "re" : "");
2495 if (ni
!= ic
->ic_bss
) /* XXX never true? */
2497 ic
->ic_stats
.is_rx_assoc_norate
++;
2498 ieee80211_new_state(ic
, IEEE80211_S_SCAN
, 0);
2502 ni
->ni_capinfo
= capinfo
;
2503 ni
->ni_associd
= associd
;
2505 ieee80211_parse_wmeparams(ic
, wme
, wh
) >= 0) {
2506 ni
->ni_flags
|= IEEE80211_NODE_QOS
;
2507 ieee80211_wme_updateparams(ic
);
2509 ni
->ni_flags
&= ~IEEE80211_NODE_QOS
;
2511 * Configure state now that we are associated.
2513 * XXX may need different/additional driver callbacks?
2515 ieee80211_set_shortpreamble(ic
, ni
);
2516 ieee80211_set_shortslottime(ic
,
2517 ic
->ic_curmode
== IEEE80211_MODE_11A
||
2518 (ni
->ni_capinfo
& IEEE80211_CAPINFO_SHORT_SLOTTIME
));
2520 * Honor ERP protection.
2522 * NB: ni_erp should zero for non-11g operation.
2523 * XXX check ic_curmode anyway?
2525 if (ic
->ic_curmode
== IEEE80211_MODE_11G
&&
2526 (ni
->ni_erp
& IEEE80211_ERP_USE_PROTECTION
))
2527 ic
->ic_flags
|= IEEE80211_F_USEPROT
;
2529 ic
->ic_flags
&= ~IEEE80211_F_USEPROT
;
2530 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ASSOC
,
2531 "[%6D] %sassoc success: %s preamble, %s slot time%s%s\n",
2533 ISREASSOC(subtype
) ? "re" : "",
2534 ic
->ic_flags
&IEEE80211_F_SHPREAMBLE
? "short" : "long",
2535 ic
->ic_flags
&IEEE80211_F_SHSLOT
? "short" : "long",
2536 ic
->ic_flags
&IEEE80211_F_USEPROT
? ", protection" : "",
2537 ni
->ni_flags
& IEEE80211_NODE_QOS
? ", QoS" : ""
2539 ieee80211_new_state(ic
, IEEE80211_S_RUN
, subtype
);
2543 case IEEE80211_FC0_SUBTYPE_DEAUTH
: {
2546 if (ic
->ic_state
== IEEE80211_S_SCAN
) {
2547 ic
->ic_stats
.is_rx_mgtdiscard
++;
2551 * deauth frame format
2554 IEEE80211_VERIFY_LENGTH(efrm
- frm
, 2);
2555 reason
= le16toh(*(uint16_t *)frm
);
2556 ic
->ic_stats
.is_rx_deauth
++;
2557 IEEE80211_NODE_STAT(ni
, rx_deauth
);
2559 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_AUTH
,
2560 "[%6D] recv deauthenticate (reason %d)\n",
2561 ni
->ni_macaddr
, ":", reason
);
2562 switch (ic
->ic_opmode
) {
2563 case IEEE80211_M_STA
:
2564 ieee80211_new_state(ic
, IEEE80211_S_AUTH
,
2565 wh
->i_fc
[0] & IEEE80211_FC0_SUBTYPE_MASK
);
2567 case IEEE80211_M_HOSTAP
:
2568 if (ni
!= ic
->ic_bss
)
2569 ieee80211_node_leave(ic
, ni
);
2572 ic
->ic_stats
.is_rx_mgtdiscard
++;
2578 case IEEE80211_FC0_SUBTYPE_DISASSOC
: {
2581 if (ic
->ic_state
!= IEEE80211_S_RUN
&&
2582 ic
->ic_state
!= IEEE80211_S_ASSOC
&&
2583 ic
->ic_state
!= IEEE80211_S_AUTH
) {
2584 ic
->ic_stats
.is_rx_mgtdiscard
++;
2588 * disassoc frame format
2591 IEEE80211_VERIFY_LENGTH(efrm
- frm
, 2);
2592 reason
= le16toh(*(uint16_t *)frm
);
2593 ic
->ic_stats
.is_rx_disassoc
++;
2594 IEEE80211_NODE_STAT(ni
, rx_disassoc
);
2596 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_ASSOC
,
2597 "[%6D] recv disassociate (reason %d)\n",
2598 ni
->ni_macaddr
, ":", reason
);
2599 switch (ic
->ic_opmode
) {
2600 case IEEE80211_M_STA
:
2601 ieee80211_new_state(ic
, IEEE80211_S_ASSOC
,
2602 wh
->i_fc
[0] & IEEE80211_FC0_SUBTYPE_MASK
);
2604 case IEEE80211_M_HOSTAP
:
2605 if (ni
!= ic
->ic_bss
)
2606 ieee80211_node_leave(ic
, ni
);
2609 ic
->ic_stats
.is_rx_mgtdiscard
++;
2615 IEEE80211_DISCARD(ic
, IEEE80211_MSG_ANY
,
2616 wh
, "mgt", "subtype 0x%x not handled", subtype
);
2617 ic
->ic_stats
.is_rx_badsubtype
++;
2623 #undef IEEE80211_VERIFY_LENGTH
2624 #undef IEEE80211_VERIFY_ELEMENT
2627 * Handle station power-save state change.
2630 ieee80211_node_pwrsave(struct ieee80211_node
*ni
, int enable
)
2632 struct ieee80211com
*ic
= ni
->ni_ic
;
2635 ASSERT_SERIALIZED(ic
->ic_ifp
->if_serializer
);
2638 if ((ni
->ni_flags
& IEEE80211_NODE_PWR_MGT
) == 0)
2640 ni
->ni_flags
|= IEEE80211_NODE_PWR_MGT
;
2641 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_POWER
,
2642 "[%6D] power save mode on, %u sta's in ps mode\n",
2643 ni
->ni_macaddr
, ":", ic
->ic_ps_sta
);
2647 if (ni
->ni_flags
& IEEE80211_NODE_PWR_MGT
)
2649 ni
->ni_flags
&= ~IEEE80211_NODE_PWR_MGT
;
2650 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_POWER
,
2651 "[%6D] power save mode off, %u sta's in ps mode\n",
2652 ni
->ni_macaddr
, ":", ic
->ic_ps_sta
);
2653 /* XXX if no stations in ps mode, flush mc frames */
2656 * Flush queued unicast frames.
2658 if (IEEE80211_NODE_SAVEQ_QLEN(ni
) == 0) {
2659 if (ic
->ic_set_tim
!= NULL
)
2660 ic
->ic_set_tim(ni
, 0); /* just in case */
2663 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_POWER
,
2664 "[%6D] flush ps queue, %u packets queued\n",
2665 ni
->ni_macaddr
, ":", IEEE80211_NODE_SAVEQ_QLEN(ni
));
2669 IEEE80211_NODE_SAVEQ_DEQUEUE(ni
, m
, qlen
);
2673 * If this is the last packet, turn off the TIM bit.
2674 * If there are more packets, set the more packets bit
2675 * in the mbuf so ieee80211_encap will mark the 802.11
2676 * head to indicate more data frames will follow.
2679 m
->m_flags
|= M_MORE_DATA
;
2680 /* XXX need different driver interface */
2681 /* XXX bypasses q max */
2682 /* XXX bypasses ALTQ */
2683 ifq_enqueue(&ic
->ic_ifp
->if_snd
, m
, NULL
);
2685 if (ic
->ic_set_tim
!= NULL
)
2686 ic
->ic_set_tim(ni
, 0);
2690 * Process a received ps-poll frame.
2693 ieee80211_recv_pspoll(struct ieee80211com
*ic
,
2694 struct ieee80211_node
*ni
, struct mbuf
*m0
)
2696 struct ieee80211_frame_min
*wh
;
2701 ASSERT_SERIALIZED(ic
->ic_ifp
->if_serializer
);
2703 wh
= mtod(m0
, struct ieee80211_frame_min
*);
2704 if (ni
->ni_associd
== 0) {
2705 IEEE80211_DISCARD(ic
, IEEE80211_MSG_POWER
| IEEE80211_MSG_DEBUG
,
2706 (struct ieee80211_frame
*) wh
, "ps-poll",
2707 "%s", "unassociated station");
2708 ic
->ic_stats
.is_ps_unassoc
++;
2709 IEEE80211_SEND_MGMT(ic
, ni
, IEEE80211_FC0_SUBTYPE_DEAUTH
,
2710 IEEE80211_REASON_NOT_ASSOCED
);
2714 aid
= le16toh(*(uint16_t *)wh
->i_dur
);
2715 if (aid
!= ni
->ni_associd
) {
2716 IEEE80211_DISCARD(ic
, IEEE80211_MSG_POWER
| IEEE80211_MSG_DEBUG
,
2717 (struct ieee80211_frame
*) wh
, "ps-poll",
2718 "aid mismatch: sta aid 0x%x poll aid 0x%x",
2719 ni
->ni_associd
, aid
);
2720 ic
->ic_stats
.is_ps_badaid
++;
2721 IEEE80211_SEND_MGMT(ic
, ni
, IEEE80211_FC0_SUBTYPE_DEAUTH
,
2722 IEEE80211_REASON_NOT_ASSOCED
);
2726 /* Okay, take the first queued packet and put it out... */
2727 IEEE80211_NODE_SAVEQ_DEQUEUE(ni
, m
, qlen
);
2729 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_POWER
,
2730 "[%6D] recv ps-poll, but queue empty\n",
2732 ieee80211_send_nulldata(ieee80211_ref_node(ni
));
2733 ic
->ic_stats
.is_ps_qempty
++; /* XXX node stat */
2734 if (ic
->ic_set_tim
!= NULL
)
2735 ic
->ic_set_tim(ni
, 0); /* just in case */
2739 * If there are more packets, set the more packets bit
2740 * in the packet dispatched to the station; otherwise
2741 * turn off the TIM bit.
2744 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_POWER
,
2745 "[%6D] recv ps-poll, send packet, %u still queued\n",
2746 ni
->ni_macaddr
, ":", qlen
);
2747 m
->m_flags
|= M_MORE_DATA
;
2749 IEEE80211_DPRINTF(ic
, IEEE80211_MSG_POWER
,
2750 "[%6D] recv ps-poll, send packet, queue empty\n",
2751 ni
->ni_macaddr
, ":");
2752 if (ic
->ic_set_tim
!= NULL
)
2753 ic
->ic_set_tim(ni
, 0);
2755 m
->m_flags
|= M_PWR_SAV
; /* bypass PS handling */
2756 ifq_enqueue(&ic
->ic_ifp
->if_snd
, m
, NULL
); /* XXX bypasses ALTQ */
2759 #ifdef IEEE80211_DEBUG
2761 * Debugging support.
2765 * Return the bssid of a frame.
2767 static const uint8_t *
2768 ieee80211_getbssid(struct ieee80211com
*ic
, const struct ieee80211_frame
*wh
)
2770 if (ic
->ic_opmode
== IEEE80211_M_STA
)
2772 if ((wh
->i_fc
[1] & IEEE80211_FC1_DIR_MASK
) != IEEE80211_FC1_DIR_NODS
)
2774 if ((wh
->i_fc
[0] & IEEE80211_FC0_SUBTYPE_MASK
) == IEEE80211_FC0_SUBTYPE_PS_POLL
)
2780 ieee80211_note(struct ieee80211com
*ic
, const char *fmt
, ...)
2782 char buf
[128]; /* XXX */
2785 __va_start(ap
, fmt
);
2786 vsnprintf(buf
, sizeof(buf
), fmt
, ap
);
2789 if_printf(ic
->ic_ifp
, "%s", buf
); /* NB: no \n */
2793 ieee80211_note_frame(struct ieee80211com
*ic
,
2794 const struct ieee80211_frame
*wh
,
2795 const char *fmt
, ...)
2797 char buf
[128]; /* XXX */
2800 __va_start(ap
, fmt
);
2801 vsnprintf(buf
, sizeof(buf
), fmt
, ap
);
2803 if_printf(ic
->ic_ifp
, "[%6D] %s\n",
2804 ieee80211_getbssid(ic
, wh
), ":", buf
);
2808 ieee80211_note_mac(struct ieee80211com
*ic
,
2809 const uint8_t mac
[IEEE80211_ADDR_LEN
],
2810 const char *fmt
, ...)
2812 char buf
[128]; /* XXX */
2815 __va_start(ap
, fmt
);
2816 vsnprintf(buf
, sizeof(buf
), fmt
, ap
);
2818 if_printf(ic
->ic_ifp
, "[%6D] %s\n", mac
, ":", buf
);
2822 ieee80211_discard_frame(struct ieee80211com
*ic
,
2823 const struct ieee80211_frame
*wh
,
2824 const char *type
, const char *fmt
, ...)
2828 printf("[%s:%6D] discard ", ic
->ic_ifp
->if_xname
,
2829 ieee80211_getbssid(ic
, wh
), ":");
2831 printf("%s frame, ", type
);
2834 __va_start(ap
, fmt
);
2841 ieee80211_discard_ie(struct ieee80211com
*ic
,
2842 const struct ieee80211_frame
*wh
,
2843 const char *type
, const char *fmt
, ...)
2847 printf("[%s:%6D] discard ", ic
->ic_ifp
->if_xname
,
2848 ieee80211_getbssid(ic
, wh
), ":");
2850 printf("%s information element, ", type
);
2852 printf("information element, ");
2853 __va_start(ap
, fmt
);
2860 ieee80211_discard_mac(struct ieee80211com
*ic
,
2861 const uint8_t mac
[IEEE80211_ADDR_LEN
],
2862 const char *type
, const char *fmt
, ...)
2866 printf("[%s:%6D] discard ", ic
->ic_ifp
->if_xname
, mac
, ":");
2868 printf("%s frame, ", type
);
2871 __va_start(ap
, fmt
);
2876 #endif /* IEEE80211_DEBUG */