?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
[PATCH] mac80211: fix virtual interface locking
[linux-2.6.git] / net / mac80211 / rx.c
blobcb44a9db0e198543b4420135b50b594e2b01a575
1 /*
2 * Copyright 2002-2005, Instant802 Networks, Inc.
3 * Copyright 2005-2006, Devicescape Software, Inc.
4 * Copyright 2006-2007 Jiri Benc <jbenc@suse.cz>
5 * Copyright 2007 Johannes Berg <johannes@sipsolutions.net>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 */
11
12 #include <linux/kernel.h>
13 #include <linux/skbuff.h>
14 #include <linux/netdevice.h>
15 #include <linux/etherdevice.h>
16 #include <linux/rcupdate.h>
17 #include <net/mac80211.h>
18 #include <net/ieee80211_radiotap.h>
19
20 #include "ieee80211_i.h"
21 #include "ieee80211_led.h"
22 #include "ieee80211_common.h"
23 #include "wep.h"
24 #include "wpa.h"
25 #include "tkip.h"
26 #include "wme.h"
27
28 /* pre-rx handlers
29 *
30 * these don't have dev/sdata fields in the rx data
31 * The sta value should also not be used because it may
32 * be NULL even though a STA (in IBSS mode) will be added.
33 */
34
35 static ieee80211_txrx_result
36 ieee80211_rx_h_parse_qos(struct ieee80211_txrx_data *rx)
37 {
38 u8 *data = rx->skb->data;
39 int tid;
40
41 /* does the frame have a qos control field? */
42 if (WLAN_FC_IS_QOS_DATA(rx->fc)) {
43 u8 *qc = data + ieee80211_get_hdrlen(rx->fc) - QOS_CONTROL_LEN;
44 /* frame has qos control */
45 tid = qc[0] & QOS_CONTROL_TID_MASK;
46 } else {
47 if (unlikely((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)) {
48 /* Separate TID for management frames */
49 tid = NUM_RX_DATA_QUEUES - 1;
50 } else {
51 /* no qos control present */
52 tid = 0; /* 802.1d - Best Effort */
53 }
54 }
55
56 I802_DEBUG_INC(rx->local->wme_rx_queue[tid]);
57 /* only a debug counter, sta might not be assigned properly yet */
58 if (rx->sta)
59 I802_DEBUG_INC(rx->sta->wme_rx_queue[tid]);
60
61 rx->u.rx.queue = tid;
62 /* Set skb->priority to 1d tag if highest order bit of TID is not set.
63 * For now, set skb->priority to 0 for other cases. */
64 rx->skb->priority = (tid > 7) ? 0 : tid;
65
66 return TXRX_CONTINUE;
67 }
68
69 static ieee80211_txrx_result
70 ieee80211_rx_h_load_stats(struct ieee80211_txrx_data *rx)
71 {
72 struct ieee80211_local *local = rx->local;
73 struct sk_buff *skb = rx->skb;
74 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) skb->data;
75 u32 load = 0, hdrtime;
76 struct ieee80211_rate *rate;
77 struct ieee80211_hw_mode *mode = local->hw.conf.mode;
78 int i;
79
80 /* Estimate total channel use caused by this frame */
81
82 if (unlikely(mode->num_rates < 0))
83 return TXRX_CONTINUE;
84
85 rate = &mode->rates[0];
86 for (i = 0; i < mode->num_rates; i++) {
87 if (mode->rates[i].val == rx->u.rx.status->rate) {
88 rate = &mode->rates[i];
89 break;
90 }
91 }
92
93 /* 1 bit at 1 Mbit/s takes 1 usec; in channel_use values,
94 * 1 usec = 1/8 * (1080 / 10) = 13.5 */
95
96 if (mode->mode == MODE_IEEE80211A ||
97 (mode->mode == MODE_IEEE80211G &&
98 rate->flags & IEEE80211_RATE_ERP))
99 hdrtime = CHAN_UTIL_HDR_SHORT;
100 else
101 hdrtime = CHAN_UTIL_HDR_LONG;
102
103 load = hdrtime;
104 if (!is_multicast_ether_addr(hdr->addr1))
105 load += hdrtime;
106
107 load += skb->len * rate->rate_inv;
108
109 /* Divide channel_use by 8 to avoid wrapping around the counter */
110 load >>= CHAN_UTIL_SHIFT;
111 local->channel_use_raw += load;
112 rx->u.rx.load = load;
113
114 return TXRX_CONTINUE;
115 }
116
117 ieee80211_rx_handler ieee80211_rx_pre_handlers[] =
118 {
119 ieee80211_rx_h_parse_qos,
120 ieee80211_rx_h_load_stats,
121 NULL
122 };
123
124 /* rx handlers */
125
126 static ieee80211_txrx_result
127 ieee80211_rx_h_if_stats(struct ieee80211_txrx_data *rx)
128 {
129 if (rx->sta)
130 rx->sta->channel_use_raw += rx->u.rx.load;
131 rx->sdata->channel_use_raw += rx->u.rx.load;
132 return TXRX_CONTINUE;
133 }
134
135 static void
136 ieee80211_rx_monitor(struct net_device *dev, struct sk_buff *skb,
137 struct ieee80211_rx_status *status)
138 {
139 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
140 struct ieee80211_rate *rate;
141 struct ieee80211_rtap_hdr {
142 struct ieee80211_radiotap_header hdr;
143 u8 flags;
144 u8 rate;
145 __le16 chan_freq;
146 __le16 chan_flags;
147 u8 antsignal;
148 u8 padding_for_rxflags;
149 __le16 rx_flags;
150 } __attribute__ ((packed)) *rthdr;
151
152 skb->dev = dev;
153
154 if (status->flag & RX_FLAG_RADIOTAP)
155 goto out;
156
157 if (skb_headroom(skb) < sizeof(*rthdr)) {
158 I802_DEBUG_INC(local->rx_expand_skb_head);
159 if (pskb_expand_head(skb, sizeof(*rthdr), 0, GFP_ATOMIC)) {
160 dev_kfree_skb(skb);
161 return;
162 }
163 }
164
165 rthdr = (struct ieee80211_rtap_hdr *) skb_push(skb, sizeof(*rthdr));
166 memset(rthdr, 0, sizeof(*rthdr));
167 rthdr->hdr.it_len = cpu_to_le16(sizeof(*rthdr));
168 rthdr->hdr.it_present =
169 cpu_to_le32((1 << IEEE80211_RADIOTAP_FLAGS) |
170 (1 << IEEE80211_RADIOTAP_RATE) |
171 (1 << IEEE80211_RADIOTAP_CHANNEL) |
172 (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL) |
173 (1 << IEEE80211_RADIOTAP_RX_FLAGS));
174 rthdr->flags = local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS ?
175 IEEE80211_RADIOTAP_F_FCS : 0;
176
177 /* FIXME: when radiotap gets a 'bad PLCP' flag use it here */
178 rthdr->rx_flags = 0;
179 if (status->flag &
180 (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
181 rthdr->rx_flags |= cpu_to_le16(IEEE80211_RADIOTAP_F_RX_BADFCS);
182
183 rate = ieee80211_get_rate(local, status->phymode, status->rate);
184 if (rate)
185 rthdr->rate = rate->rate / 5;
186
187 rthdr->chan_freq = cpu_to_le16(status->freq);
188 rthdr->chan_flags =
189 status->phymode == MODE_IEEE80211A ?
190 cpu_to_le16(IEEE80211_CHAN_OFDM | IEEE80211_CHAN_5GHZ) :
191 cpu_to_le16(IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ);
192 rthdr->antsignal = status->ssi;
193
194 out:
195 dev->stats.rx_packets++;
196 dev->stats.rx_bytes += skb->len;
197
198 skb_set_mac_header(skb, 0);
199 skb->ip_summed = CHECKSUM_UNNECESSARY;
200 skb->pkt_type = PACKET_OTHERHOST;
201 skb->protocol = htons(ETH_P_802_2);
202 memset(skb->cb, 0, sizeof(skb->cb));
203 netif_rx(skb);
204 }
205
206 static ieee80211_txrx_result
207 ieee80211_rx_h_monitor(struct ieee80211_txrx_data *rx)
208 {
209 if (rx->sdata->type == IEEE80211_IF_TYPE_MNTR) {
210 ieee80211_rx_monitor(rx->dev, rx->skb, rx->u.rx.status);
211 return TXRX_QUEUED;
212 }
213
214 /*
215 * Drop frames with failed FCS/PLCP checksums here, they are only
216 * relevant for monitor mode, the rest of the stack should never
217 * see them.
218 */
219 if (rx->u.rx.status->flag &
220 (RX_FLAG_FAILED_FCS_CRC | RX_FLAG_FAILED_PLCP_CRC))
221 return TXRX_DROP;
222
223 if (rx->u.rx.status->flag & RX_FLAG_RADIOTAP)
224 skb_pull(rx->skb, ieee80211_get_radiotap_len(rx->skb->data));
225
226 return TXRX_CONTINUE;
227 }
228
229 static ieee80211_txrx_result
230 ieee80211_rx_h_passive_scan(struct ieee80211_txrx_data *rx)
231 {
232 struct ieee80211_local *local = rx->local;
233 struct sk_buff *skb = rx->skb;
234
235 if (unlikely(local->sta_scanning != 0)) {
236 ieee80211_sta_rx_scan(rx->dev, skb, rx->u.rx.status);
237 return TXRX_QUEUED;
238 }
239
240 if (unlikely(rx->flags & IEEE80211_TXRXD_RXIN_SCAN)) {
241 /* scanning finished during invoking of handlers */
242 I802_DEBUG_INC(local->rx_handlers_drop_passive_scan);
243 return TXRX_DROP;
244 }
245
246 return TXRX_CONTINUE;
247 }
248
249 static ieee80211_txrx_result
250 ieee80211_rx_h_check(struct ieee80211_txrx_data *rx)
251 {
252 struct ieee80211_hdr *hdr;
253 hdr = (struct ieee80211_hdr *) rx->skb->data;
254
255 /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
256 if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
257 if (unlikely(rx->fc & IEEE80211_FCTL_RETRY &&
258 rx->sta->last_seq_ctrl[rx->u.rx.queue] ==
259 hdr->seq_ctrl)) {
260 if (rx->flags & IEEE80211_TXRXD_RXRA_MATCH) {
261 rx->local->dot11FrameDuplicateCount++;
262 rx->sta->num_duplicates++;
263 }
264 return TXRX_DROP;
265 } else
266 rx->sta->last_seq_ctrl[rx->u.rx.queue] = hdr->seq_ctrl;
267 }
268
269 if ((rx->local->hw.flags & IEEE80211_HW_RX_INCLUDES_FCS) &&
270 rx->skb->len > FCS_LEN)
271 skb_trim(rx->skb, rx->skb->len - FCS_LEN);
272
273 if (unlikely(rx->skb->len < 16)) {
274 I802_DEBUG_INC(rx->local->rx_handlers_drop_short);
275 return TXRX_DROP;
276 }
277
278 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
279 rx->skb->pkt_type = PACKET_OTHERHOST;
280 else if (compare_ether_addr(rx->dev->dev_addr, hdr->addr1) == 0)
281 rx->skb->pkt_type = PACKET_HOST;
282 else if (is_multicast_ether_addr(hdr->addr1)) {
283 if (is_broadcast_ether_addr(hdr->addr1))
284 rx->skb->pkt_type = PACKET_BROADCAST;
285 else
286 rx->skb->pkt_type = PACKET_MULTICAST;
287 } else
288 rx->skb->pkt_type = PACKET_OTHERHOST;
289
290 /* Drop disallowed frame classes based on STA auth/assoc state;
291 * IEEE 802.11, Chap 5.5.
292 *
293 * 80211.o does filtering only based on association state, i.e., it
294 * drops Class 3 frames from not associated stations. hostapd sends
295 * deauth/disassoc frames when needed. In addition, hostapd is
296 * responsible for filtering on both auth and assoc states.
297 */
298 if (unlikely(((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA ||
299 ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_CTL &&
300 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_PSPOLL)) &&
301 rx->sdata->type != IEEE80211_IF_TYPE_IBSS &&
302 (!rx->sta || !(rx->sta->flags & WLAN_STA_ASSOC)))) {
303 if ((!(rx->fc & IEEE80211_FCTL_FROMDS) &&
304 !(rx->fc & IEEE80211_FCTL_TODS) &&
305 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA)
306 || !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
307 /* Drop IBSS frames and frames for other hosts
308 * silently. */
309 return TXRX_DROP;
310 }
311
312 if (!rx->local->apdev)
313 return TXRX_DROP;
314
315 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
316 ieee80211_msg_sta_not_assoc);
317 return TXRX_QUEUED;
318 }
319
320 return TXRX_CONTINUE;
321 }
322
323
324 static ieee80211_txrx_result
325 ieee80211_rx_h_load_key(struct ieee80211_txrx_data *rx)
326 {
327 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
328 int keyidx;
329 int hdrlen;
330 struct ieee80211_key *stakey = NULL;
331
332 /*
333 * Key selection 101
334 *
335 * There are three types of keys:
336 * - GTK (group keys)
337 * - PTK (pairwise keys)
338 * - STK (station-to-station pairwise keys)
339 *
340 * When selecting a key, we have to distinguish between multicast
341 * (including broadcast) and unicast frames, the latter can only
342 * use PTKs and STKs while the former always use GTKs. Unless, of
343 * course, actual WEP keys ("pre-RSNA") are used, then unicast
344 * frames can also use key indizes like GTKs. Hence, if we don't
345 * have a PTK/STK we check the key index for a WEP key.
346 *
347 * Note that in a regular BSS, multicast frames are sent by the
348 * AP only, associated stations unicast the frame to the AP first
349 * which then multicasts it on their behalf.
350 *
351 * There is also a slight problem in IBSS mode: GTKs are negotiated
352 * with each station, that is something we don't currently handle.
353 * The spec seems to expect that one negotiates the same key with
354 * every station but there's no such requirement; VLANs could be
355 * possible.
356 */
357
358 if (!(rx->fc & IEEE80211_FCTL_PROTECTED))
359 return TXRX_CONTINUE;
360
361 /*
362 * No point in finding a key if the frame is neither
363 * addressed to us nor a multicast frame.
364 */
365 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
366 return TXRX_CONTINUE;
367
368 if (rx->sta)
369 stakey = rcu_dereference(rx->sta->key);
370
371 if (!is_multicast_ether_addr(hdr->addr1) && stakey) {
372 rx->key = stakey;
373 } else {
374 /*
375 * The device doesn't give us the IV so we won't be
376 * able to look up the key. That's ok though, we
377 * don't need to decrypt the frame, we just won't
378 * be able to keep statistics accurate.
379 * Except for key threshold notifications, should
380 * we somehow allow the driver to tell us which key
381 * the hardware used if this flag is set?
382 */
383 if ((rx->u.rx.status->flag & RX_FLAG_DECRYPTED) &&
384 (rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED))
385 return TXRX_CONTINUE;
386
387 hdrlen = ieee80211_get_hdrlen(rx->fc);
388
389 if (rx->skb->len < 8 + hdrlen)
390 return TXRX_DROP; /* TODO: count this? */
391
392 /*
393 * no need to call ieee80211_wep_get_keyidx,
394 * it verifies a bunch of things we've done already
395 */
396 keyidx = rx->skb->data[hdrlen + 3] >> 6;
397
398 rx->key = rcu_dereference(rx->sdata->keys[keyidx]);
399
400 /*
401 * RSNA-protected unicast frames should always be sent with
402 * pairwise or station-to-station keys, but for WEP we allow
403 * using a key index as well.
404 */
405 if (rx->key && rx->key->conf.alg != ALG_WEP &&
406 !is_multicast_ether_addr(hdr->addr1))
407 rx->key = NULL;
408 }
409
410 if (rx->key) {
411 rx->key->tx_rx_count++;
412 /* TODO: add threshold stuff again */
413 }
414
415 return TXRX_CONTINUE;
416 }
417
418 static void ap_sta_ps_start(struct net_device *dev, struct sta_info *sta)
419 {
420 struct ieee80211_sub_if_data *sdata;
421 DECLARE_MAC_BUF(mac);
422
423 sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
424
425 if (sdata->bss)
426 atomic_inc(&sdata->bss->num_sta_ps);
427 sta->flags |= WLAN_STA_PS;
428 sta->pspoll = 0;
429 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
430 printk(KERN_DEBUG "%s: STA %s aid %d enters power save mode\n",
431 dev->name, print_mac(mac, sta->addr), sta->aid);
432 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
433 }
434
435 static int ap_sta_ps_end(struct net_device *dev, struct sta_info *sta)
436 {
437 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
438 struct sk_buff *skb;
439 int sent = 0;
440 struct ieee80211_sub_if_data *sdata;
441 struct ieee80211_tx_packet_data *pkt_data;
442 DECLARE_MAC_BUF(mac);
443
444 sdata = IEEE80211_DEV_TO_SUB_IF(sta->dev);
445 if (sdata->bss)
446 atomic_dec(&sdata->bss->num_sta_ps);
447 sta->flags &= ~(WLAN_STA_PS | WLAN_STA_TIM);
448 sta->pspoll = 0;
449 if (!skb_queue_empty(&sta->ps_tx_buf)) {
450 if (local->ops->set_tim)
451 local->ops->set_tim(local_to_hw(local), sta->aid, 0);
452 if (sdata->bss)
453 bss_tim_clear(local, sdata->bss, sta->aid);
454 }
455 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
456 printk(KERN_DEBUG "%s: STA %s aid %d exits power save mode\n",
457 dev->name, print_mac(mac, sta->addr), sta->aid);
458 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
459 /* Send all buffered frames to the station */
460 while ((skb = skb_dequeue(&sta->tx_filtered)) != NULL) {
461 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
462 sent++;
463 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
464 dev_queue_xmit(skb);
465 }
466 while ((skb = skb_dequeue(&sta->ps_tx_buf)) != NULL) {
467 pkt_data = (struct ieee80211_tx_packet_data *) skb->cb;
468 local->total_ps_buffered--;
469 sent++;
470 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
471 printk(KERN_DEBUG "%s: STA %s aid %d send PS frame "
472 "since STA not sleeping anymore\n", dev->name,
473 print_mac(mac, sta->addr), sta->aid);
474 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
475 pkt_data->flags |= IEEE80211_TXPD_REQUEUE;
476 dev_queue_xmit(skb);
477 }
478
479 return sent;
480 }
481
482 static ieee80211_txrx_result
483 ieee80211_rx_h_sta_process(struct ieee80211_txrx_data *rx)
484 {
485 struct sta_info *sta = rx->sta;
486 struct net_device *dev = rx->dev;
487 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
488
489 if (!sta)
490 return TXRX_CONTINUE;
491
492 /* Update last_rx only for IBSS packets which are for the current
493 * BSSID to avoid keeping the current IBSS network alive in cases where
494 * other STAs are using different BSSID. */
495 if (rx->sdata->type == IEEE80211_IF_TYPE_IBSS) {
496 u8 *bssid = ieee80211_get_bssid(hdr, rx->skb->len);
497 if (compare_ether_addr(bssid, rx->sdata->u.sta.bssid) == 0)
498 sta->last_rx = jiffies;
499 } else
500 if (!is_multicast_ether_addr(hdr->addr1) ||
501 rx->sdata->type == IEEE80211_IF_TYPE_STA) {
502 /* Update last_rx only for unicast frames in order to prevent
503 * the Probe Request frames (the only broadcast frames from a
504 * STA in infrastructure mode) from keeping a connection alive.
505 */
506 sta->last_rx = jiffies;
507 }
508
509 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
510 return TXRX_CONTINUE;
511
512 sta->rx_fragments++;
513 sta->rx_bytes += rx->skb->len;
514 sta->last_rssi = rx->u.rx.status->ssi;
515 sta->last_signal = rx->u.rx.status->signal;
516 sta->last_noise = rx->u.rx.status->noise;
517
518 if (!(rx->fc & IEEE80211_FCTL_MOREFRAGS)) {
519 /* Change STA power saving mode only in the end of a frame
520 * exchange sequence */
521 if ((sta->flags & WLAN_STA_PS) && !(rx->fc & IEEE80211_FCTL_PM))
522 rx->u.rx.sent_ps_buffered += ap_sta_ps_end(dev, sta);
523 else if (!(sta->flags & WLAN_STA_PS) &&
524 (rx->fc & IEEE80211_FCTL_PM))
525 ap_sta_ps_start(dev, sta);
526 }
527
528 /* Drop data::nullfunc frames silently, since they are used only to
529 * control station power saving mode. */
530 if ((rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
531 (rx->fc & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_NULLFUNC) {
532 I802_DEBUG_INC(rx->local->rx_handlers_drop_nullfunc);
533 /* Update counter and free packet here to avoid counting this
534 * as a dropped packed. */
535 sta->rx_packets++;
536 dev_kfree_skb(rx->skb);
537 return TXRX_QUEUED;
538 }
539
540 return TXRX_CONTINUE;
541 } /* ieee80211_rx_h_sta_process */
542
543 static ieee80211_txrx_result
544 ieee80211_rx_h_wep_weak_iv_detection(struct ieee80211_txrx_data *rx)
545 {
546 if (!rx->sta || !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
547 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA ||
548 !rx->key || rx->key->conf.alg != ALG_WEP ||
549 !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
550 return TXRX_CONTINUE;
551
552 /* Check for weak IVs, if hwaccel did not remove IV from the frame */
553 if (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED) ||
554 !(rx->u.rx.status->flag & RX_FLAG_DECRYPTED))
555 if (ieee80211_wep_is_weak_iv(rx->skb, rx->key))
556 rx->sta->wep_weak_iv_count++;
557
558 return TXRX_CONTINUE;
559 }
560
561 static ieee80211_txrx_result
562 ieee80211_rx_h_wep_decrypt(struct ieee80211_txrx_data *rx)
563 {
564 if ((rx->key && rx->key->conf.alg != ALG_WEP) ||
565 !(rx->fc & IEEE80211_FCTL_PROTECTED) ||
566 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
567 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
568 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)))
569 return TXRX_CONTINUE;
570
571 if (!rx->key) {
572 if (net_ratelimit())
573 printk(KERN_DEBUG "%s: RX WEP frame, but no key set\n",
574 rx->dev->name);
575 return TXRX_DROP;
576 }
577
578 if (!(rx->u.rx.status->flag & RX_FLAG_DECRYPTED)) {
579 if (ieee80211_wep_decrypt(rx->local, rx->skb, rx->key)) {
580 if (net_ratelimit())
581 printk(KERN_DEBUG "%s: RX WEP frame, decrypt "
582 "failed\n", rx->dev->name);
583 return TXRX_DROP;
584 }
585 } else if (!(rx->u.rx.status->flag & RX_FLAG_IV_STRIPPED)) {
586 ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key);
587 /* remove ICV */
588 skb_trim(rx->skb, rx->skb->len - 4);
589 }
590
591 return TXRX_CONTINUE;
592 }
593
594 static inline struct ieee80211_fragment_entry *
595 ieee80211_reassemble_add(struct ieee80211_sub_if_data *sdata,
596 unsigned int frag, unsigned int seq, int rx_queue,
597 struct sk_buff **skb)
598 {
599 struct ieee80211_fragment_entry *entry;
600 int idx;
601
602 idx = sdata->fragment_next;
603 entry = &sdata->fragments[sdata->fragment_next++];
604 if (sdata->fragment_next >= IEEE80211_FRAGMENT_MAX)
605 sdata->fragment_next = 0;
606
607 if (!skb_queue_empty(&entry->skb_list)) {
608 #ifdef CONFIG_MAC80211_DEBUG
609 struct ieee80211_hdr *hdr =
610 (struct ieee80211_hdr *) entry->skb_list.next->data;
611 DECLARE_MAC_BUF(mac);
612 DECLARE_MAC_BUF(mac2);
613 printk(KERN_DEBUG "%s: RX reassembly removed oldest "
614 "fragment entry (idx=%d age=%lu seq=%d last_frag=%d "
615 "addr1=%s addr2=%s\n",
616 sdata->dev->name, idx,
617 jiffies - entry->first_frag_time, entry->seq,
618 entry->last_frag, print_mac(mac, hdr->addr1),
619 print_mac(mac2, hdr->addr2));
620 #endif /* CONFIG_MAC80211_DEBUG */
621 __skb_queue_purge(&entry->skb_list);
622 }
623
624 __skb_queue_tail(&entry->skb_list, *skb); /* no need for locking */
625 *skb = NULL;
626 entry->first_frag_time = jiffies;
627 entry->seq = seq;
628 entry->rx_queue = rx_queue;
629 entry->last_frag = frag;
630 entry->ccmp = 0;
631 entry->extra_len = 0;
632
633 return entry;
634 }
635
636 static inline struct ieee80211_fragment_entry *
637 ieee80211_reassemble_find(struct ieee80211_sub_if_data *sdata,
638 u16 fc, unsigned int frag, unsigned int seq,
639 int rx_queue, struct ieee80211_hdr *hdr)
640 {
641 struct ieee80211_fragment_entry *entry;
642 int i, idx;
643
644 idx = sdata->fragment_next;
645 for (i = 0; i < IEEE80211_FRAGMENT_MAX; i++) {
646 struct ieee80211_hdr *f_hdr;
647 u16 f_fc;
648
649 idx--;
650 if (idx < 0)
651 idx = IEEE80211_FRAGMENT_MAX - 1;
652
653 entry = &sdata->fragments[idx];
654 if (skb_queue_empty(&entry->skb_list) || entry->seq != seq ||
655 entry->rx_queue != rx_queue ||
656 entry->last_frag + 1 != frag)
657 continue;
658
659 f_hdr = (struct ieee80211_hdr *) entry->skb_list.next->data;
660 f_fc = le16_to_cpu(f_hdr->frame_control);
661
662 if ((fc & IEEE80211_FCTL_FTYPE) != (f_fc & IEEE80211_FCTL_FTYPE) ||
663 compare_ether_addr(hdr->addr1, f_hdr->addr1) != 0 ||
664 compare_ether_addr(hdr->addr2, f_hdr->addr2) != 0)
665 continue;
666
667 if (entry->first_frag_time + 2 * HZ < jiffies) {
668 __skb_queue_purge(&entry->skb_list);
669 continue;
670 }
671 return entry;
672 }
673
674 return NULL;
675 }
676
677 static ieee80211_txrx_result
678 ieee80211_rx_h_defragment(struct ieee80211_txrx_data *rx)
679 {
680 struct ieee80211_hdr *hdr;
681 u16 sc;
682 unsigned int frag, seq;
683 struct ieee80211_fragment_entry *entry;
684 struct sk_buff *skb;
685 DECLARE_MAC_BUF(mac);
686
687 hdr = (struct ieee80211_hdr *) rx->skb->data;
688 sc = le16_to_cpu(hdr->seq_ctrl);
689 frag = sc & IEEE80211_SCTL_FRAG;
690
691 if (likely((!(rx->fc & IEEE80211_FCTL_MOREFRAGS) && frag == 0) ||
692 (rx->skb)->len < 24 ||
693 is_multicast_ether_addr(hdr->addr1))) {
694 /* not fragmented */
695 goto out;
696 }
697 I802_DEBUG_INC(rx->local->rx_handlers_fragments);
698
699 seq = (sc & IEEE80211_SCTL_SEQ) >> 4;
700
701 if (frag == 0) {
702 /* This is the first fragment of a new frame. */
703 entry = ieee80211_reassemble_add(rx->sdata, frag, seq,
704 rx->u.rx.queue, &(rx->skb));
705 if (rx->key && rx->key->conf.alg == ALG_CCMP &&
706 (rx->fc & IEEE80211_FCTL_PROTECTED)) {
707 /* Store CCMP PN so that we can verify that the next
708 * fragment has a sequential PN value. */
709 entry->ccmp = 1;
710 memcpy(entry->last_pn,
711 rx->key->u.ccmp.rx_pn[rx->u.rx.queue],
712 CCMP_PN_LEN);
713 }
714 return TXRX_QUEUED;
715 }
716
717 /* This is a fragment for a frame that should already be pending in
718 * fragment cache. Add this fragment to the end of the pending entry.
719 */
720 entry = ieee80211_reassemble_find(rx->sdata, rx->fc, frag, seq,
721 rx->u.rx.queue, hdr);
722 if (!entry) {
723 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
724 return TXRX_DROP;
725 }
726
727 /* Verify that MPDUs within one MSDU have sequential PN values.
728 * (IEEE 802.11i, 8.3.3.4.5) */
729 if (entry->ccmp) {
730 int i;
731 u8 pn[CCMP_PN_LEN], *rpn;
732 if (!rx->key || rx->key->conf.alg != ALG_CCMP)
733 return TXRX_DROP;
734 memcpy(pn, entry->last_pn, CCMP_PN_LEN);
735 for (i = CCMP_PN_LEN - 1; i >= 0; i--) {
736 pn[i]++;
737 if (pn[i])
738 break;
739 }
740 rpn = rx->key->u.ccmp.rx_pn[rx->u.rx.queue];
741 if (memcmp(pn, rpn, CCMP_PN_LEN) != 0) {
742 if (net_ratelimit())
743 printk(KERN_DEBUG "%s: defrag: CCMP PN not "
744 "sequential A2=%s"
745 " PN=%02x%02x%02x%02x%02x%02x "
746 "(expected %02x%02x%02x%02x%02x%02x)\n",
747 rx->dev->name, print_mac(mac, hdr->addr2),
748 rpn[0], rpn[1], rpn[2], rpn[3], rpn[4],
749 rpn[5], pn[0], pn[1], pn[2], pn[3],
750 pn[4], pn[5]);
751 return TXRX_DROP;
752 }
753 memcpy(entry->last_pn, pn, CCMP_PN_LEN);
754 }
755
756 skb_pull(rx->skb, ieee80211_get_hdrlen(rx->fc));
757 __skb_queue_tail(&entry->skb_list, rx->skb);
758 entry->last_frag = frag;
759 entry->extra_len += rx->skb->len;
760 if (rx->fc & IEEE80211_FCTL_MOREFRAGS) {
761 rx->skb = NULL;
762 return TXRX_QUEUED;
763 }
764
765 rx->skb = __skb_dequeue(&entry->skb_list);
766 if (skb_tailroom(rx->skb) < entry->extra_len) {
767 I802_DEBUG_INC(rx->local->rx_expand_skb_head2);
768 if (unlikely(pskb_expand_head(rx->skb, 0, entry->extra_len,
769 GFP_ATOMIC))) {
770 I802_DEBUG_INC(rx->local->rx_handlers_drop_defrag);
771 __skb_queue_purge(&entry->skb_list);
772 return TXRX_DROP;
773 }
774 }
775 while ((skb = __skb_dequeue(&entry->skb_list))) {
776 memcpy(skb_put(rx->skb, skb->len), skb->data, skb->len);
777 dev_kfree_skb(skb);
778 }
779
780 /* Complete frame has been reassembled - process it now */
781 rx->flags |= IEEE80211_TXRXD_FRAGMENTED;
782
783 out:
784 if (rx->sta)
785 rx->sta->rx_packets++;
786 if (is_multicast_ether_addr(hdr->addr1))
787 rx->local->dot11MulticastReceivedFrameCount++;
788 else
789 ieee80211_led_rx(rx->local);
790 return TXRX_CONTINUE;
791 }
792
793 static ieee80211_txrx_result
794 ieee80211_rx_h_ps_poll(struct ieee80211_txrx_data *rx)
795 {
796 struct sk_buff *skb;
797 int no_pending_pkts;
798 DECLARE_MAC_BUF(mac);
799
800 if (likely(!rx->sta ||
801 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_CTL ||
802 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_PSPOLL ||
803 !(rx->flags & IEEE80211_TXRXD_RXRA_MATCH)))
804 return TXRX_CONTINUE;
805
806 skb = skb_dequeue(&rx->sta->tx_filtered);
807 if (!skb) {
808 skb = skb_dequeue(&rx->sta->ps_tx_buf);
809 if (skb)
810 rx->local->total_ps_buffered--;
811 }
812 no_pending_pkts = skb_queue_empty(&rx->sta->tx_filtered) &&
813 skb_queue_empty(&rx->sta->ps_tx_buf);
814
815 if (skb) {
816 struct ieee80211_hdr *hdr =
817 (struct ieee80211_hdr *) skb->data;
818
819 /* tell TX path to send one frame even though the STA may
820 * still remain is PS mode after this frame exchange */
821 rx->sta->pspoll = 1;
822
823 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
824 printk(KERN_DEBUG "STA %s aid %d: PS Poll (entries after %d)\n",
825 print_mac(mac, rx->sta->addr), rx->sta->aid,
826 skb_queue_len(&rx->sta->ps_tx_buf));
827 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
828
829 /* Use MoreData flag to indicate whether there are more
830 * buffered frames for this STA */
831 if (no_pending_pkts) {
832 hdr->frame_control &= cpu_to_le16(~IEEE80211_FCTL_MOREDATA);
833 rx->sta->flags &= ~WLAN_STA_TIM;
834 } else
835 hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_MOREDATA);
836
837 dev_queue_xmit(skb);
838
839 if (no_pending_pkts) {
840 if (rx->local->ops->set_tim)
841 rx->local->ops->set_tim(local_to_hw(rx->local),
842 rx->sta->aid, 0);
843 if (rx->sdata->bss)
844 bss_tim_clear(rx->local, rx->sdata->bss, rx->sta->aid);
845 }
846 #ifdef CONFIG_MAC80211_VERBOSE_PS_DEBUG
847 } else if (!rx->u.rx.sent_ps_buffered) {
848 printk(KERN_DEBUG "%s: STA %s sent PS Poll even "
849 "though there is no buffered frames for it\n",
850 rx->dev->name, print_mac(mac, rx->sta->addr));
851 #endif /* CONFIG_MAC80211_VERBOSE_PS_DEBUG */
852
853 }
854
855 /* Free PS Poll skb here instead of returning TXRX_DROP that would
856 * count as an dropped frame. */
857 dev_kfree_skb(rx->skb);
858
859 return TXRX_QUEUED;
860 }
861
862 static ieee80211_txrx_result
863 ieee80211_rx_h_remove_qos_control(struct ieee80211_txrx_data *rx)
864 {
865 u16 fc = rx->fc;
866 u8 *data = rx->skb->data;
867 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) data;
868
869 if (!WLAN_FC_IS_QOS_DATA(fc))
870 return TXRX_CONTINUE;
871
872 /* remove the qos control field, update frame type and meta-data */
873 memmove(data + 2, data, ieee80211_get_hdrlen(fc) - 2);
874 hdr = (struct ieee80211_hdr *) skb_pull(rx->skb, 2);
875 /* change frame type to non QOS */
876 rx->fc = fc &= ~IEEE80211_STYPE_QOS_DATA;
877 hdr->frame_control = cpu_to_le16(fc);
878
879 return TXRX_CONTINUE;
880 }
881
882 static ieee80211_txrx_result
883 ieee80211_rx_h_802_1x_pae(struct ieee80211_txrx_data *rx)
884 {
885 if (rx->sdata->eapol && ieee80211_is_eapol(rx->skb) &&
886 rx->sdata->type != IEEE80211_IF_TYPE_STA &&
887 (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
888 /* Pass both encrypted and unencrypted EAPOL frames to user
889 * space for processing. */
890 if (!rx->local->apdev)
891 return TXRX_DROP;
892 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
893 ieee80211_msg_normal);
894 return TXRX_QUEUED;
895 }
896
897 if (unlikely(rx->sdata->ieee802_1x &&
898 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
899 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
900 (!rx->sta || !(rx->sta->flags & WLAN_STA_AUTHORIZED)) &&
901 !ieee80211_is_eapol(rx->skb))) {
902 #ifdef CONFIG_MAC80211_DEBUG
903 struct ieee80211_hdr *hdr =
904 (struct ieee80211_hdr *) rx->skb->data;
905 DECLARE_MAC_BUF(mac);
906 printk(KERN_DEBUG "%s: dropped frame from %s"
907 " (unauthorized port)\n", rx->dev->name,
908 print_mac(mac, hdr->addr2));
909 #endif /* CONFIG_MAC80211_DEBUG */
910 return TXRX_DROP;
911 }
912
913 return TXRX_CONTINUE;
914 }
915
916 static ieee80211_txrx_result
917 ieee80211_rx_h_drop_unencrypted(struct ieee80211_txrx_data *rx)
918 {
919 /*
920 * Pass through unencrypted frames if the hardware has
921 * decrypted them already.
922 */
923 if (rx->u.rx.status->flag & RX_FLAG_DECRYPTED)
924 return TXRX_CONTINUE;
925
926 /* Drop unencrypted frames if key is set. */
927 if (unlikely(!(rx->fc & IEEE80211_FCTL_PROTECTED) &&
928 (rx->fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_DATA &&
929 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_NULLFUNC &&
930 (rx->key || rx->sdata->drop_unencrypted) &&
931 (rx->sdata->eapol == 0 ||
932 !ieee80211_is_eapol(rx->skb)))) {
933 if (net_ratelimit())
934 printk(KERN_DEBUG "%s: RX non-WEP frame, but expected "
935 "encryption\n", rx->dev->name);
936 return TXRX_DROP;
937 }
938 return TXRX_CONTINUE;
939 }
940
941 static ieee80211_txrx_result
942 ieee80211_rx_h_data(struct ieee80211_txrx_data *rx)
943 {
944 struct net_device *dev = rx->dev;
945 struct ieee80211_local *local = rx->local;
946 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *) rx->skb->data;
947 u16 fc, hdrlen, ethertype;
948 u8 *payload;
949 u8 dst[ETH_ALEN];
950 u8 src[ETH_ALEN];
951 struct sk_buff *skb = rx->skb, *skb2;
952 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
953 DECLARE_MAC_BUF(mac);
954 DECLARE_MAC_BUF(mac2);
955 DECLARE_MAC_BUF(mac3);
956 DECLARE_MAC_BUF(mac4);
957
958 fc = rx->fc;
959 if (unlikely((fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA))
960 return TXRX_CONTINUE;
961
962 if (unlikely(!WLAN_FC_DATA_PRESENT(fc)))
963 return TXRX_DROP;
964
965 hdrlen = ieee80211_get_hdrlen(fc);
966
967 /* convert IEEE 802.11 header + possible LLC headers into Ethernet
968 * header
969 * IEEE 802.11 address fields:
970 * ToDS FromDS Addr1 Addr2 Addr3 Addr4
971 * 0 0 DA SA BSSID n/a
972 * 0 1 DA BSSID SA n/a
973 * 1 0 BSSID SA DA n/a
974 * 1 1 RA TA DA SA
975 */
976
977 switch (fc & (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS)) {
978 case IEEE80211_FCTL_TODS:
979 /* BSSID SA DA */
980 memcpy(dst, hdr->addr3, ETH_ALEN);
981 memcpy(src, hdr->addr2, ETH_ALEN);
982
983 if (unlikely(sdata->type != IEEE80211_IF_TYPE_AP &&
984 sdata->type != IEEE80211_IF_TYPE_VLAN)) {
985 if (net_ratelimit())
986 printk(KERN_DEBUG "%s: dropped ToDS frame "
987 "(BSSID=%s SA=%s DA=%s)\n",
988 dev->name,
989 print_mac(mac, hdr->addr1),
990 print_mac(mac2, hdr->addr2),
991 print_mac(mac3, hdr->addr3));
992 return TXRX_DROP;
993 }
994 break;
995 case (IEEE80211_FCTL_TODS | IEEE80211_FCTL_FROMDS):
996 /* RA TA DA SA */
997 memcpy(dst, hdr->addr3, ETH_ALEN);
998 memcpy(src, hdr->addr4, ETH_ALEN);
999
1000 if (unlikely(sdata->type != IEEE80211_IF_TYPE_WDS)) {
1001 if (net_ratelimit())
1002 printk(KERN_DEBUG "%s: dropped FromDS&ToDS "
1003 "frame (RA=%s TA=%s DA=%s SA=%s)\n",
1004 rx->dev->name,
1005 print_mac(mac, hdr->addr1),
1006 print_mac(mac2, hdr->addr2),
1007 print_mac(mac3, hdr->addr3),
1008 print_mac(mac4, hdr->addr4));
1009 return TXRX_DROP;
1010 }
1011 break;
1012 case IEEE80211_FCTL_FROMDS:
1013 /* DA BSSID SA */
1014 memcpy(dst, hdr->addr1, ETH_ALEN);
1015 memcpy(src, hdr->addr3, ETH_ALEN);
1016
1017 if (sdata->type != IEEE80211_IF_TYPE_STA ||
1018 (is_multicast_ether_addr(dst) &&
1019 !compare_ether_addr(src, dev->dev_addr)))
1020 return TXRX_DROP;
1021 break;
1022 case 0:
1023 /* DA SA BSSID */
1024 memcpy(dst, hdr->addr1, ETH_ALEN);
1025 memcpy(src, hdr->addr2, ETH_ALEN);
1026
1027 if (sdata->type != IEEE80211_IF_TYPE_IBSS) {
1028 if (net_ratelimit()) {
1029 printk(KERN_DEBUG "%s: dropped IBSS frame "
1030 "(DA=%s SA=%s BSSID=%s)\n",
1031 dev->name,
1032 print_mac(mac, hdr->addr1),
1033 print_mac(mac2, hdr->addr2),
1034 print_mac(mac3, hdr->addr3));
1035 }
1036 return TXRX_DROP;
1037 }
1038 break;
1039 }
1040
1041 payload = skb->data + hdrlen;
1042
1043 if (unlikely(skb->len - hdrlen < 8)) {
1044 if (net_ratelimit()) {
1045 printk(KERN_DEBUG "%s: RX too short data frame "
1046 "payload\n", dev->name);
1047 }
1048 return TXRX_DROP;
1049 }
1050
1051 ethertype = (payload[6] << 8) | payload[7];
1052
1053 if (likely((compare_ether_addr(payload, rfc1042_header) == 0 &&
1054 ethertype != ETH_P_AARP && ethertype != ETH_P_IPX) ||
1055 compare_ether_addr(payload, bridge_tunnel_header) == 0)) {
1056 /* remove RFC1042 or Bridge-Tunnel encapsulation and
1057 * replace EtherType */
1058 skb_pull(skb, hdrlen + 6);
1059 memcpy(skb_push(skb, ETH_ALEN), src, ETH_ALEN);
1060 memcpy(skb_push(skb, ETH_ALEN), dst, ETH_ALEN);
1061 } else {
1062 struct ethhdr *ehdr;
1063 __be16 len;
1064 skb_pull(skb, hdrlen);
1065 len = htons(skb->len);
1066 ehdr = (struct ethhdr *) skb_push(skb, sizeof(struct ethhdr));
1067 memcpy(ehdr->h_dest, dst, ETH_ALEN);
1068 memcpy(ehdr->h_source, src, ETH_ALEN);
1069 ehdr->h_proto = len;
1070 }
1071 skb->dev = dev;
1072
1073 skb2 = NULL;
1074
1075 dev->stats.rx_packets++;
1076 dev->stats.rx_bytes += skb->len;
1077
1078 if (local->bridge_packets && (sdata->type == IEEE80211_IF_TYPE_AP
1079 || sdata->type == IEEE80211_IF_TYPE_VLAN) &&
1080 (rx->flags & IEEE80211_TXRXD_RXRA_MATCH)) {
1081 if (is_multicast_ether_addr(skb->data)) {
1082 /* send multicast frames both to higher layers in
1083 * local net stack and back to the wireless media */
1084 skb2 = skb_copy(skb, GFP_ATOMIC);
1085 if (!skb2 && net_ratelimit())
1086 printk(KERN_DEBUG "%s: failed to clone "
1087 "multicast frame\n", dev->name);
1088 } else {
1089 struct sta_info *dsta;
1090 dsta = sta_info_get(local, skb->data);
1091 if (dsta && !dsta->dev) {
1092 if (net_ratelimit())
1093 printk(KERN_DEBUG "Station with null "
1094 "dev structure!\n");
1095 } else if (dsta && dsta->dev == dev) {
1096 /* Destination station is associated to this
1097 * AP, so send the frame directly to it and
1098 * do not pass the frame to local net stack.
1099 */
1100 skb2 = skb;
1101 skb = NULL;
1102 }
1103 if (dsta)
1104 sta_info_put(dsta);
1105 }
1106 }
1107
1108 if (skb) {
1109 /* deliver to local stack */
1110 skb->protocol = eth_type_trans(skb, dev);
1111 memset(skb->cb, 0, sizeof(skb->cb));
1112 netif_rx(skb);
1113 }
1114
1115 if (skb2) {
1116 /* send to wireless media */
1117 skb2->protocol = __constant_htons(ETH_P_802_3);
1118 skb_set_network_header(skb2, 0);
1119 skb_set_mac_header(skb2, 0);
1120 dev_queue_xmit(skb2);
1121 }
1122
1123 return TXRX_QUEUED;
1124 }
1125
1126 static ieee80211_txrx_result
1127 ieee80211_rx_h_mgmt(struct ieee80211_txrx_data *rx)
1128 {
1129 struct ieee80211_sub_if_data *sdata;
1130
1131 if (!(rx->flags & IEEE80211_TXRXD_RXRA_MATCH))
1132 return TXRX_DROP;
1133
1134 sdata = IEEE80211_DEV_TO_SUB_IF(rx->dev);
1135 if ((sdata->type == IEEE80211_IF_TYPE_STA ||
1136 sdata->type == IEEE80211_IF_TYPE_IBSS) &&
1137 !rx->local->user_space_mlme) {
1138 ieee80211_sta_rx_mgmt(rx->dev, rx->skb, rx->u.rx.status);
1139 } else {
1140 /* Management frames are sent to hostapd for processing */
1141 if (!rx->local->apdev)
1142 return TXRX_DROP;
1143 ieee80211_rx_mgmt(rx->local, rx->skb, rx->u.rx.status,
1144 ieee80211_msg_normal);
1145 }
1146 return TXRX_QUEUED;
1147 }
1148
1149 static inline ieee80211_txrx_result __ieee80211_invoke_rx_handlers(
1150 struct ieee80211_local *local,
1151 ieee80211_rx_handler *handlers,
1152 struct ieee80211_txrx_data *rx,
1153 struct sta_info *sta)
1154 {
1155 ieee80211_rx_handler *handler;
1156 ieee80211_txrx_result res = TXRX_DROP;
1157
1158 for (handler = handlers; *handler != NULL; handler++) {
1159 res = (*handler)(rx);
1160
1161 switch (res) {
1162 case TXRX_CONTINUE:
1163 continue;
1164 case TXRX_DROP:
1165 I802_DEBUG_INC(local->rx_handlers_drop);
1166 if (sta)
1167 sta->rx_dropped++;
1168 break;
1169 case TXRX_QUEUED:
1170 I802_DEBUG_INC(local->rx_handlers_queued);
1171 break;
1172 }
1173 break;
1174 }
1175
1176 if (res == TXRX_DROP)
1177 dev_kfree_skb(rx->skb);
1178 return res;
1179 }
1180
1181 static inline void ieee80211_invoke_rx_handlers(struct ieee80211_local *local,
1182 ieee80211_rx_handler *handlers,
1183 struct ieee80211_txrx_data *rx,
1184 struct sta_info *sta)
1185 {
1186 if (__ieee80211_invoke_rx_handlers(local, handlers, rx, sta) ==
1187 TXRX_CONTINUE)
1188 dev_kfree_skb(rx->skb);
1189 }
1190
1191 static void ieee80211_rx_michael_mic_report(struct net_device *dev,
1192 struct ieee80211_hdr *hdr,
1193 struct sta_info *sta,
1194 struct ieee80211_txrx_data *rx)
1195 {
1196 int keyidx, hdrlen;
1197 DECLARE_MAC_BUF(mac);
1198 DECLARE_MAC_BUF(mac2);
1199
1200 hdrlen = ieee80211_get_hdrlen_from_skb(rx->skb);
1201 if (rx->skb->len >= hdrlen + 4)
1202 keyidx = rx->skb->data[hdrlen + 3] >> 6;
1203 else
1204 keyidx = -1;
1205
1206 if (net_ratelimit())
1207 printk(KERN_DEBUG "%s: TKIP hwaccel reported Michael MIC "
1208 "failure from %s to %s keyidx=%d\n",
1209 dev->name, print_mac(mac, hdr->addr2),
1210 print_mac(mac2, hdr->addr1), keyidx);
1211
1212 if (!sta) {
1213 /*
1214 * Some hardware seem to generate incorrect Michael MIC
1215 * reports; ignore them to avoid triggering countermeasures.
1216 */
1217 if (net_ratelimit())
1218 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1219 "error for unknown address %s\n",
1220 dev->name, print_mac(mac, hdr->addr2));
1221 goto ignore;
1222 }
1223
1224 if (!(rx->fc & IEEE80211_FCTL_PROTECTED)) {
1225 if (net_ratelimit())
1226 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1227 "error for a frame with no PROTECTED flag (src "
1228 "%s)\n", dev->name, print_mac(mac, hdr->addr2));
1229 goto ignore;
1230 }
1231
1232 if (rx->sdata->type == IEEE80211_IF_TYPE_AP && keyidx) {
1233 /*
1234 * APs with pairwise keys should never receive Michael MIC
1235 * errors for non-zero keyidx because these are reserved for
1236 * group keys and only the AP is sending real multicast
1237 * frames in the BSS.
1238 */
1239 if (net_ratelimit())
1240 printk(KERN_DEBUG "%s: ignored Michael MIC error for "
1241 "a frame with non-zero keyidx (%d)"
1242 " (src %s)\n", dev->name, keyidx,
1243 print_mac(mac, hdr->addr2));
1244 goto ignore;
1245 }
1246
1247 if ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA &&
1248 ((rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT ||
1249 (rx->fc & IEEE80211_FCTL_STYPE) != IEEE80211_STYPE_AUTH)) {
1250 if (net_ratelimit())
1251 printk(KERN_DEBUG "%s: ignored spurious Michael MIC "
1252 "error for a frame that cannot be encrypted "
1253 "(fc=0x%04x) (src %s)\n",
1254 dev->name, rx->fc, print_mac(mac, hdr->addr2));
1255 goto ignore;
1256 }
1257
1258 mac80211_ev_michael_mic_failure(rx->dev, keyidx, hdr);
1259 ignore:
1260 dev_kfree_skb(rx->skb);
1261 rx->skb = NULL;
1262 }
1263
1264 ieee80211_rx_handler ieee80211_rx_handlers[] =
1265 {
1266 ieee80211_rx_h_if_stats,
1267 ieee80211_rx_h_monitor,
1268 ieee80211_rx_h_passive_scan,
1269 ieee80211_rx_h_check,
1270 ieee80211_rx_h_load_key,
1271 ieee80211_rx_h_sta_process,
1272 ieee80211_rx_h_ccmp_decrypt,
1273 ieee80211_rx_h_tkip_decrypt,
1274 ieee80211_rx_h_wep_weak_iv_detection,
1275 ieee80211_rx_h_wep_decrypt,
1276 ieee80211_rx_h_defragment,
1277 ieee80211_rx_h_ps_poll,
1278 ieee80211_rx_h_michael_mic_verify,
1279 /* this must be after decryption - so header is counted in MPDU mic
1280 * must be before pae and data, so QOS_DATA format frames
1281 * are not passed to user space by these functions
1282 */
1283 ieee80211_rx_h_remove_qos_control,
1284 ieee80211_rx_h_802_1x_pae,
1285 ieee80211_rx_h_drop_unencrypted,
1286 ieee80211_rx_h_data,
1287 ieee80211_rx_h_mgmt,
1288 NULL
1289 };
1290
1291 /* main receive path */
1292
1293 static int prepare_for_handlers(struct ieee80211_sub_if_data *sdata,
1294 u8 *bssid, struct ieee80211_txrx_data *rx,
1295 struct ieee80211_hdr *hdr)
1296 {
1297 int multicast = is_multicast_ether_addr(hdr->addr1);
1298
1299 switch (sdata->type) {
1300 case IEEE80211_IF_TYPE_STA:
1301 if (!bssid)
1302 return 0;
1303 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1304 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1305 return 0;
1306 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1307 } else if (!multicast &&
1308 compare_ether_addr(sdata->dev->dev_addr,
1309 hdr->addr1) != 0) {
1310 if (!(sdata->dev->flags & IFF_PROMISC))
1311 return 0;
1312 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1313 }
1314 break;
1315 case IEEE80211_IF_TYPE_IBSS:
1316 if (!bssid)
1317 return 0;
1318 if (!ieee80211_bssid_match(bssid, sdata->u.sta.bssid)) {
1319 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1320 return 0;
1321 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1322 } else if (!multicast &&
1323 compare_ether_addr(sdata->dev->dev_addr,
1324 hdr->addr1) != 0) {
1325 if (!(sdata->dev->flags & IFF_PROMISC))
1326 return 0;
1327 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1328 } else if (!rx->sta)
1329 rx->sta = ieee80211_ibss_add_sta(sdata->dev, rx->skb,
1330 bssid, hdr->addr2);
1331 break;
1332 case IEEE80211_IF_TYPE_AP:
1333 if (!bssid) {
1334 if (compare_ether_addr(sdata->dev->dev_addr,
1335 hdr->addr1))
1336 return 0;
1337 } else if (!ieee80211_bssid_match(bssid,
1338 sdata->dev->dev_addr)) {
1339 if (!(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1340 return 0;
1341 rx->flags &= ~IEEE80211_TXRXD_RXRA_MATCH;
1342 }
1343 if (sdata->dev == sdata->local->mdev &&
1344 !(rx->flags & IEEE80211_TXRXD_RXIN_SCAN))
1345 /* do not receive anything via
1346 * master device when not scanning */
1347 return 0;
1348 break;
1349 case IEEE80211_IF_TYPE_WDS:
1350 if (bssid ||
1351 (rx->fc & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_DATA)
1352 return 0;
1353 if (compare_ether_addr(sdata->u.wds.remote_addr, hdr->addr2))
1354 return 0;
1355 break;
1356 }
1357
1358 return 1;
1359 }
1360
1361 /*
1362 * This is the receive path handler. It is called by a low level driver when an
1363 * 802.11 MPDU is received from the hardware.
1364 */
1365 void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
1366 struct ieee80211_rx_status *status)
1367 {
1368 struct ieee80211_local *local = hw_to_local(hw);
1369 struct ieee80211_sub_if_data *sdata;
1370 struct sta_info *sta;
1371 struct ieee80211_hdr *hdr;
1372 struct ieee80211_txrx_data rx;
1373 u16 type;
1374 int radiotap_len = 0, prepres;
1375 struct ieee80211_sub_if_data *prev = NULL;
1376 struct sk_buff *skb_new;
1377 u8 *bssid;
1378 int bogon;
1379
1380 if (status->flag & RX_FLAG_RADIOTAP) {
1381 radiotap_len = ieee80211_get_radiotap_len(skb->data);
1382 skb_pull(skb, radiotap_len);
1383 }
1384
1385 /*
1386 * key references and virtual interfaces are protected using RCU
1387 * and this requires that we are in a read-side RCU section during
1388 * receive processing
1389 */
1390 rcu_read_lock();
1391
1392 hdr = (struct ieee80211_hdr *) skb->data;
1393 memset(&rx, 0, sizeof(rx));
1394 rx.skb = skb;
1395 rx.local = local;
1396
1397 rx.u.rx.status = status;
1398 rx.fc = skb->len >= 2 ? le16_to_cpu(hdr->frame_control) : 0;
1399 type = rx.fc & IEEE80211_FCTL_FTYPE;
1400
1401 bogon = status->flag & (RX_FLAG_FAILED_FCS_CRC |
1402 RX_FLAG_FAILED_PLCP_CRC);
1403
1404 if (!bogon && (type == IEEE80211_FTYPE_DATA ||
1405 type == IEEE80211_FTYPE_MGMT))
1406 local->dot11ReceivedFragmentCount++;
1407
1408 if (!bogon && skb->len >= 16) {
1409 sta = rx.sta = sta_info_get(local, hdr->addr2);
1410 if (sta) {
1411 rx.dev = rx.sta->dev;
1412 rx.sdata = IEEE80211_DEV_TO_SUB_IF(rx.dev);
1413 }
1414 } else
1415 sta = rx.sta = NULL;
1416
1417 if ((status->flag & RX_FLAG_MMIC_ERROR)) {
1418 ieee80211_rx_michael_mic_report(local->mdev, hdr, sta, &rx);
1419 goto end;
1420 }
1421
1422 if (unlikely(local->sta_scanning))
1423 rx.flags |= IEEE80211_TXRXD_RXIN_SCAN;
1424
1425 if (__ieee80211_invoke_rx_handlers(local, local->rx_pre_handlers, &rx,
1426 sta) != TXRX_CONTINUE)
1427 goto end;
1428 skb = rx.skb;
1429
1430 skb_push(skb, radiotap_len);
1431 if (sta && !(sta->flags & (WLAN_STA_WDS | WLAN_STA_ASSOC_AP)) &&
1432 !local->iff_promiscs && !is_multicast_ether_addr(hdr->addr1)) {
1433 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
1434 ieee80211_invoke_rx_handlers(local, local->rx_handlers, &rx,
1435 rx.sta);
1436 sta_info_put(sta);
1437 rcu_read_unlock();
1438 return;
1439 }
1440
1441 bssid = ieee80211_get_bssid(hdr, skb->len - radiotap_len);
1442
1443 list_for_each_entry_rcu(sdata, &local->interfaces, list) {
1444 rx.flags |= IEEE80211_TXRXD_RXRA_MATCH;
1445
1446 if (!netif_running(sdata->dev))
1447 continue;
1448
1449 prepres = prepare_for_handlers(sdata, bssid, &rx, hdr);
1450 /* prepare_for_handlers can change sta */
1451 sta = rx.sta;
1452
1453 if (!prepres)
1454 continue;
1455
1456 /*
1457 * frame is destined for this interface, but if it's not
1458 * also for the previous one we handle that after the
1459 * loop to avoid copying the SKB once too much
1460 */
1461
1462 if (!prev) {
1463 prev = sdata;
1464 continue;
1465 }
1466
1467 /*
1468 * frame was destined for the previous interface
1469 * so invoke RX handlers for it
1470 */
1471
1472 skb_new = skb_copy(skb, GFP_ATOMIC);
1473 if (!skb_new) {
1474 if (net_ratelimit())
1475 printk(KERN_DEBUG "%s: failed to copy "
1476 "multicast frame for %s",
1477 wiphy_name(local->hw.wiphy),
1478 prev->dev->name);
1479 continue;
1480 }
1481 rx.skb = skb_new;
1482 rx.dev = prev->dev;
1483 rx.sdata = prev;
1484 ieee80211_invoke_rx_handlers(local, local->rx_handlers,
1485 &rx, sta);
1486 prev = sdata;
1487 }
1488 if (prev) {
1489 rx.skb = skb;
1490 rx.dev = prev->dev;
1491 rx.sdata = prev;
1492 ieee80211_invoke_rx_handlers(local, local->rx_handlers,
1493 &rx, sta);
1494 } else
1495 dev_kfree_skb(skb);
1496
1497 end:
1498 rcu_read_unlock();
1499
1500 if (sta)
1501 sta_info_put(sta);
1502 }
1503 EXPORT_SYMBOL(__ieee80211_rx);
1504
1505 /* This is a version of the rx handler that can be called from hard irq
1506 * context. Post the skb on the queue and schedule the tasklet */
1507 void ieee80211_rx_irqsafe(struct ieee80211_hw *hw, struct sk_buff *skb,
1508 struct ieee80211_rx_status *status)
1509 {
1510 struct ieee80211_local *local = hw_to_local(hw);
1511
1512 BUILD_BUG_ON(sizeof(struct ieee80211_rx_status) > sizeof(skb->cb));
1513
1514 skb->dev = local->mdev;
1515 /* copy status into skb->cb for use by tasklet */
1516 memcpy(skb->cb, status, sizeof(*status));
1517 skb->pkt_type = IEEE80211_RX_MSG;
1518 skb_queue_tail(&local->skb_queue, skb);
1519 tasklet_schedule(&local->tasklet);
1520 }
1521 EXPORT_SYMBOL(ieee80211_rx_irqsafe);
Linus' kernel tree