The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_adhoc.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2007-2009 Sam Leffler, Errno Consulting
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   24  */
   25 
   26 #include <sys/cdefs.h>
   27 #ifdef __FreeBSD__
   28 __FBSDID("$FreeBSD: releng/8.1/sys/net80211/ieee80211_adhoc.c 199583 2009-11-20 15:27:52Z jhb $");
   29 #endif
   30 
   31 /*
   32  * IEEE 802.11 IBSS mode support.
   33  */
   34 #include "opt_inet.h"
   35 #include "opt_wlan.h"
   36 
   37 #include <sys/param.h>
   38 #include <sys/systm.h> 
   39 #include <sys/mbuf.h>   
   40 #include <sys/malloc.h>
   41 #include <sys/kernel.h>
   42 
   43 #include <sys/socket.h>
   44 #include <sys/sockio.h>
   45 #include <sys/endian.h>
   46 #include <sys/errno.h>
   47 #include <sys/proc.h>
   48 #include <sys/sysctl.h>
   49 
   50 #include <net/if.h>
   51 #include <net/if_media.h>
   52 #include <net/if_llc.h>
   53 #include <net/ethernet.h>
   54 
   55 #include <net/bpf.h>
   56 
   57 #include <net80211/ieee80211_var.h>
   58 #include <net80211/ieee80211_adhoc.h>
   59 #include <net80211/ieee80211_input.h>
   60 #ifdef IEEE80211_SUPPORT_SUPERG
   61 #include <net80211/ieee80211_superg.h>
   62 #endif
   63 #ifdef IEEE80211_SUPPORT_TDMA
   64 #include <net80211/ieee80211_tdma.h>
   65 #endif
   66 
   67 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
   68 
   69 static  void adhoc_vattach(struct ieee80211vap *);
   70 static  int adhoc_newstate(struct ieee80211vap *, enum ieee80211_state, int);
   71 static int adhoc_input(struct ieee80211_node *, struct mbuf *, int, int);
   72 static void adhoc_recv_mgmt(struct ieee80211_node *, struct mbuf *,
   73         int subtype, int, int);
   74 static void ahdemo_recv_mgmt(struct ieee80211_node *, struct mbuf *,
   75         int subtype, int, int);
   76 static void adhoc_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
   77 
   78 void
   79 ieee80211_adhoc_attach(struct ieee80211com *ic)
   80 {
   81         ic->ic_vattach[IEEE80211_M_IBSS] = adhoc_vattach;
   82         ic->ic_vattach[IEEE80211_M_AHDEMO] = adhoc_vattach;
   83 }
   84 
   85 void
   86 ieee80211_adhoc_detach(struct ieee80211com *ic)
   87 {
   88 }
   89 
   90 static void
   91 adhoc_vdetach(struct ieee80211vap *vap)
   92 {
   93 }
   94 
   95 static void
   96 adhoc_vattach(struct ieee80211vap *vap)
   97 {
   98         vap->iv_newstate = adhoc_newstate;
   99         vap->iv_input = adhoc_input;
  100         if (vap->iv_opmode == IEEE80211_M_IBSS)
  101                 vap->iv_recv_mgmt = adhoc_recv_mgmt;
  102         else
  103                 vap->iv_recv_mgmt = ahdemo_recv_mgmt;
  104         vap->iv_recv_ctl = adhoc_recv_ctl;
  105         vap->iv_opdetach = adhoc_vdetach;
  106 #ifdef IEEE80211_SUPPORT_TDMA
  107         /*
  108          * Throw control to tdma support.  Note we do this
  109          * after setting up our callbacks so it can piggyback
  110          * on top of us.
  111          */
  112         if (vap->iv_caps & IEEE80211_C_TDMA)
  113                 ieee80211_tdma_vattach(vap);
  114 #endif
  115 }
  116 
  117 static void
  118 sta_leave(void *arg, struct ieee80211_node *ni)
  119 {
  120         struct ieee80211vap *vap = arg;
  121 
  122         if (ni->ni_vap == vap && ni != vap->iv_bss)
  123                 ieee80211_node_leave(ni);
  124 }
  125 
  126 /*
  127  * IEEE80211_M_IBSS+IEEE80211_M_AHDEMO vap state machine handler.
  128  */
  129 static int
  130 adhoc_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
  131 {
  132         struct ieee80211com *ic = vap->iv_ic;
  133         struct ieee80211_node *ni;
  134         enum ieee80211_state ostate;
  135 
  136         IEEE80211_LOCK_ASSERT(vap->iv_ic);
  137 
  138         ostate = vap->iv_state;
  139         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
  140             __func__, ieee80211_state_name[ostate],
  141             ieee80211_state_name[nstate], arg);
  142         vap->iv_state = nstate;                 /* state transition */
  143         if (ostate != IEEE80211_S_SCAN)
  144                 ieee80211_cancel_scan(vap);     /* background scan */
  145         ni = vap->iv_bss;                       /* NB: no reference held */
  146         switch (nstate) {
  147         case IEEE80211_S_INIT:
  148                 switch (ostate) {
  149                 case IEEE80211_S_SCAN:
  150                         ieee80211_cancel_scan(vap);
  151                         break;
  152                 default:
  153                         break;
  154                 }
  155                 if (ostate != IEEE80211_S_INIT) {
  156                         /* NB: optimize INIT -> INIT case */
  157                         ieee80211_reset_bss(vap);
  158                 }
  159                 break;
  160         case IEEE80211_S_SCAN:
  161                 switch (ostate) {
  162                 case IEEE80211_S_RUN:           /* beacon miss */
  163                         /* purge station table; entries are stale */
  164                         ieee80211_iterate_nodes(&ic->ic_sta, sta_leave, vap);
  165                         /* fall thru... */
  166                 case IEEE80211_S_INIT:
  167                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
  168                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
  169                                 /*
  170                                  * Already have a channel; bypass the
  171                                  * scan and startup immediately.
  172                                  */
  173                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
  174                                 break;
  175                         }
  176                         /*
  177                          * Initiate a scan.  We can come here as a result
  178                          * of an IEEE80211_IOC_SCAN_REQ too in which case
  179                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
  180                          * and the scan request parameters will be present
  181                          * in iv_scanreq.  Otherwise we do the default.
  182                          */
  183                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
  184                                 ieee80211_check_scan(vap,
  185                                     vap->iv_scanreq_flags,
  186                                     vap->iv_scanreq_duration,
  187                                     vap->iv_scanreq_mindwell,
  188                                     vap->iv_scanreq_maxdwell,
  189                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
  190                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
  191                         } else
  192                                 ieee80211_check_scan_current(vap);
  193                         break;
  194                 case IEEE80211_S_SCAN:
  195                         /*
  196                          * This can happen because of a change in state
  197                          * that requires a reset.  Trigger a new scan
  198                          * unless we're in manual roaming mode in which
  199                          * case an application must issue an explicit request.
  200                          */
  201                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  202                                 ieee80211_check_scan_current(vap);
  203                         break;
  204                 default:
  205                         goto invalid;
  206                 }
  207                 break;
  208         case IEEE80211_S_RUN:
  209                 if (vap->iv_flags & IEEE80211_F_WPA) {
  210                         /* XXX validate prerequisites */
  211                 }
  212                 switch (ostate) {
  213                 case IEEE80211_S_SCAN:
  214 #ifdef IEEE80211_DEBUG
  215                         if (ieee80211_msg_debug(vap)) {
  216                                 ieee80211_note(vap,
  217                                     "synchronized with %s ssid ",
  218                                     ether_sprintf(ni->ni_bssid));
  219                                 ieee80211_print_essid(vap->iv_bss->ni_essid,
  220                                     ni->ni_esslen);
  221                                 /* XXX MCS/HT */
  222                                 printf(" channel %d start %uMb\n",
  223                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
  224                                     IEEE80211_RATE2MBS(ni->ni_txrate));
  225                         }
  226 #endif
  227                         break;
  228                 default:
  229                         goto invalid;
  230                 }
  231                 /*
  232                  * When 802.1x is not in use mark the port authorized
  233                  * at this point so traffic can flow.
  234                  */
  235                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
  236                         ieee80211_node_authorize(ni);
  237                 /*
  238                  * Fake association when joining an existing bss.
  239                  */
  240                 if (!IEEE80211_ADDR_EQ(ni->ni_macaddr, vap->iv_myaddr) &&
  241                     ic->ic_newassoc != NULL)
  242                         ic->ic_newassoc(ni, ostate != IEEE80211_S_RUN);
  243                 break;
  244         case IEEE80211_S_SLEEP:
  245                 ieee80211_sta_pwrsave(vap, 0);
  246                 break;
  247         default:
  248         invalid:
  249                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
  250                     "%s: unexpected state transition %s -> %s\n", __func__,
  251                     ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
  252                 break;
  253         }
  254         return 0;
  255 }
  256 
  257 /*
  258  * Decide if a received management frame should be
  259  * printed when debugging is enabled.  This filters some
  260  * of the less interesting frames that come frequently
  261  * (e.g. beacons).
  262  */
  263 static __inline int
  264 doprint(struct ieee80211vap *vap, int subtype)
  265 {
  266         switch (subtype) {
  267         case IEEE80211_FC0_SUBTYPE_BEACON:
  268                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
  269         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  270                 return 1;
  271         }
  272         return 1;
  273 }
  274 
  275 /*
  276  * Process a received frame.  The node associated with the sender
  277  * should be supplied.  If nothing was found in the node table then
  278  * the caller is assumed to supply a reference to iv_bss instead.
  279  * The RSSI and a timestamp are also supplied.  The RSSI data is used
  280  * during AP scanning to select a AP to associate with; it can have
  281  * any units so long as values have consistent units and higher values
  282  * mean ``better signal''.  The receive timestamp is currently not used
  283  * by the 802.11 layer.
  284  */
  285 static int
  286 adhoc_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
  287 {
  288 #define SEQ_LEQ(a,b)    ((int)((a)-(b)) <= 0)
  289 #define HAS_SEQ(type)   ((type & 0x4) == 0)
  290         struct ieee80211vap *vap = ni->ni_vap;
  291         struct ieee80211com *ic = ni->ni_ic;
  292         struct ifnet *ifp = vap->iv_ifp;
  293         struct ieee80211_frame *wh;
  294         struct ieee80211_key *key;
  295         struct ether_header *eh;
  296         int hdrspace, need_tap;
  297         uint8_t dir, type, subtype, qos;
  298         uint8_t *bssid;
  299         uint16_t rxseq;
  300 
  301         if (m->m_flags & M_AMPDU_MPDU) {
  302                 /*
  303                  * Fastpath for A-MPDU reorder q resubmission.  Frames
  304                  * w/ M_AMPDU_MPDU marked have already passed through
  305                  * here but were received out of order and been held on
  306                  * the reorder queue.  When resubmitted they are marked
  307                  * with the M_AMPDU_MPDU flag and we can bypass most of
  308                  * the normal processing.
  309                  */
  310                 wh = mtod(m, struct ieee80211_frame *);
  311                 type = IEEE80211_FC0_TYPE_DATA;
  312                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  313                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
  314                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
  315                 goto resubmit_ampdu;
  316         }
  317 
  318         KASSERT(ni != NULL, ("null node"));
  319         ni->ni_inact = ni->ni_inact_reload;
  320 
  321         need_tap = 1;                   /* mbuf need to be tapped. */
  322         type = -1;                      /* undefined */
  323 
  324         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
  325                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  326                     ni->ni_macaddr, NULL,
  327                     "too short (1): len %u", m->m_pkthdr.len);
  328                 vap->iv_stats.is_rx_tooshort++;
  329                 goto out;
  330         }
  331         /*
  332          * Bit of a cheat here, we use a pointer for a 3-address
  333          * frame format but don't reference fields past outside
  334          * ieee80211_frame_min w/o first validating the data is
  335          * present.
  336          */
  337         wh = mtod(m, struct ieee80211_frame *);
  338 
  339         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
  340             IEEE80211_FC0_VERSION_0) {
  341                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  342                     ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
  343                     wh->i_fc[0], wh->i_fc[1]);
  344                 vap->iv_stats.is_rx_badversion++;
  345                 goto err;
  346         }
  347 
  348         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  349         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
  350         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
  351         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
  352                 if (dir != IEEE80211_FC1_DIR_NODS)
  353                         bssid = wh->i_addr1;
  354                 else if (type == IEEE80211_FC0_TYPE_CTL)
  355                         bssid = wh->i_addr1;
  356                 else {
  357                         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  358                                 IEEE80211_DISCARD_MAC(vap,
  359                                     IEEE80211_MSG_ANY, ni->ni_macaddr,
  360                                     NULL, "too short (2): len %u",
  361                                     m->m_pkthdr.len);
  362                                 vap->iv_stats.is_rx_tooshort++;
  363                                 goto out;
  364                         }
  365                         bssid = wh->i_addr3;
  366                 }
  367                 /*
  368                  * Validate the bssid.
  369                  */
  370                 if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
  371                     !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
  372                         /* not interested in */
  373                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  374                             bssid, NULL, "%s", "not to bss");
  375                         vap->iv_stats.is_rx_wrongbss++;
  376                         goto out;
  377                 }
  378                 /*
  379                  * Data frame, cons up a node when it doesn't
  380                  * exist. This should probably done after an ACL check.
  381                  */
  382                 if (type == IEEE80211_FC0_TYPE_DATA &&
  383                     ni == vap->iv_bss &&
  384                     !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
  385                         /*
  386                          * Beware of frames that come in too early; we
  387                          * can receive broadcast frames and creating sta
  388                          * entries will blow up because there is no bss
  389                          * channel yet.
  390                          */
  391                         if (vap->iv_state != IEEE80211_S_RUN) {
  392                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  393                                     wh, "data", "not in RUN state (%s)",
  394                                     ieee80211_state_name[vap->iv_state]);
  395                                 vap->iv_stats.is_rx_badstate++;
  396                                 goto err;
  397                         }
  398                         /*
  399                          * Fake up a node for this newly
  400                          * discovered member of the IBSS.
  401                          */
  402                         ni = ieee80211_fakeup_adhoc_node(vap, wh->i_addr2);
  403                         if (ni == NULL) {
  404                                 /* NB: stat kept for alloc failure */
  405                                 goto err;
  406                         }
  407                 }
  408                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
  409                 ni->ni_noise = nf;
  410                 if (HAS_SEQ(type)) {
  411                         uint8_t tid = ieee80211_gettid(wh);
  412                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
  413                             TID_TO_WME_AC(tid) >= WME_AC_VI)
  414                                 ic->ic_wme.wme_hipri_traffic++;
  415                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
  416                         if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
  417                             (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
  418                             SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
  419                                 /* duplicate, discard */
  420                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  421                                     bssid, "duplicate",
  422                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
  423                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
  424                                     ni->ni_rxseqs[tid] >>
  425                                         IEEE80211_SEQ_SEQ_SHIFT,
  426                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
  427                                     ni->ni_rxseqs[tid] &
  428                                         IEEE80211_SEQ_FRAG_MASK,
  429                                     tid);
  430                                 vap->iv_stats.is_rx_dup++;
  431                                 IEEE80211_NODE_STAT(ni, rx_dup);
  432                                 goto out;
  433                         }
  434                         ni->ni_rxseqs[tid] = rxseq;
  435                 }
  436         }
  437 
  438         switch (type) {
  439         case IEEE80211_FC0_TYPE_DATA:
  440                 hdrspace = ieee80211_hdrspace(ic, wh);
  441                 if (m->m_len < hdrspace &&
  442                     (m = m_pullup(m, hdrspace)) == NULL) {
  443                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  444                             ni->ni_macaddr, NULL,
  445                             "data too short: expecting %u", hdrspace);
  446                         vap->iv_stats.is_rx_tooshort++;
  447                         goto out;               /* XXX */
  448                 }
  449                 if (dir != IEEE80211_FC1_DIR_NODS) {
  450                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  451                             wh, "data", "incorrect dir 0x%x", dir);
  452                         vap->iv_stats.is_rx_wrongdir++;
  453                         goto out;
  454                 }
  455                 /* XXX no power-save support */
  456 
  457                 /*
  458                  * Handle A-MPDU re-ordering.  If the frame is to be
  459                  * processed directly then ieee80211_ampdu_reorder
  460                  * will return 0; otherwise it has consumed the mbuf
  461                  * and we should do nothing more with it.
  462                  */
  463                 if ((m->m_flags & M_AMPDU) &&
  464                     ieee80211_ampdu_reorder(ni, m) != 0) {
  465                         m = NULL;
  466                         goto out;
  467                 }
  468         resubmit_ampdu:
  469 
  470                 /*
  471                  * Handle privacy requirements.  Note that we
  472                  * must not be preempted from here until after
  473                  * we (potentially) call ieee80211_crypto_demic;
  474                  * otherwise we may violate assumptions in the
  475                  * crypto cipher modules used to do delayed update
  476                  * of replay sequence numbers.
  477                  */
  478                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
  479                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
  480                                 /*
  481                                  * Discard encrypted frames when privacy is off.
  482                                  */
  483                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  484                                     wh, "WEP", "%s", "PRIVACY off");
  485                                 vap->iv_stats.is_rx_noprivacy++;
  486                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
  487                                 goto out;
  488                         }
  489                         key = ieee80211_crypto_decap(ni, m, hdrspace);
  490                         if (key == NULL) {
  491                                 /* NB: stats+msgs handled in crypto_decap */
  492                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
  493                                 goto out;
  494                         }
  495                         wh = mtod(m, struct ieee80211_frame *);
  496                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
  497                 } else {
  498                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
  499                         key = NULL;
  500                 }
  501 
  502                 /*
  503                  * Save QoS bits for use below--before we strip the header.
  504                  */
  505                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
  506                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
  507                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
  508                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
  509                 } else
  510                         qos = 0;
  511 
  512                 /*
  513                  * Next up, any fragmentation.
  514                  */
  515                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  516                         m = ieee80211_defrag(ni, m, hdrspace);
  517                         if (m == NULL) {
  518                                 /* Fragment dropped or frame not complete yet */
  519                                 goto out;
  520                         }
  521                 }
  522                 wh = NULL;              /* no longer valid, catch any uses */
  523 
  524                 /*
  525                  * Next strip any MSDU crypto bits.
  526                  */
  527                 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
  528                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  529                             ni->ni_macaddr, "data", "%s", "demic error");
  530                         vap->iv_stats.is_rx_demicfail++;
  531                         IEEE80211_NODE_STAT(ni, rx_demicfail);
  532                         goto out;
  533                 }
  534 
  535                 /* copy to listener after decrypt */
  536                 if (ieee80211_radiotap_active_vap(vap))
  537                         ieee80211_radiotap_rx(vap, m);
  538                 need_tap = 0;
  539 
  540                 /*
  541                  * Finally, strip the 802.11 header.
  542                  */
  543                 m = ieee80211_decap(vap, m, hdrspace);
  544                 if (m == NULL) {
  545                         /* XXX mask bit to check for both */
  546                         /* don't count Null data frames as errors */
  547                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
  548                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
  549                                 goto out;
  550                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  551                             ni->ni_macaddr, "data", "%s", "decap error");
  552                         vap->iv_stats.is_rx_decap++;
  553                         IEEE80211_NODE_STAT(ni, rx_decap);
  554                         goto err;
  555                 }
  556                 eh = mtod(m, struct ether_header *);
  557                 if (!ieee80211_node_is_authorized(ni)) {
  558                         /*
  559                          * Deny any non-PAE frames received prior to
  560                          * authorization.  For open/shared-key
  561                          * authentication the port is mark authorized
  562                          * after authentication completes.  For 802.1x
  563                          * the port is not marked authorized by the
  564                          * authenticator until the handshake has completed.
  565                          */
  566                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
  567                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  568                                     eh->ether_shost, "data",
  569                                     "unauthorized port: ether type 0x%x len %u",
  570                                     eh->ether_type, m->m_pkthdr.len);
  571                                 vap->iv_stats.is_rx_unauth++;
  572                                 IEEE80211_NODE_STAT(ni, rx_unauth);
  573                                 goto err;
  574                         }
  575                 } else {
  576                         /*
  577                          * When denying unencrypted frames, discard
  578                          * any non-PAE frames received without encryption.
  579                          */
  580                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
  581                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
  582                             eh->ether_type != htons(ETHERTYPE_PAE)) {
  583                                 /*
  584                                  * Drop unencrypted frames.
  585                                  */
  586                                 vap->iv_stats.is_rx_unencrypted++;
  587                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
  588                                 goto out;
  589                         }
  590                 }
  591                 /* XXX require HT? */
  592                 if (qos & IEEE80211_QOS_AMSDU) {
  593                         m = ieee80211_decap_amsdu(ni, m);
  594                         if (m == NULL)
  595                                 return IEEE80211_FC0_TYPE_DATA;
  596                 } else {
  597 #ifdef IEEE80211_SUPPORT_SUPERG
  598                         m = ieee80211_decap_fastframe(vap, ni, m);
  599                         if (m == NULL)
  600                                 return IEEE80211_FC0_TYPE_DATA;
  601 #endif
  602                 }
  603                 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
  604                         ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
  605                 else
  606                         ieee80211_deliver_data(vap, ni, m);
  607                 return IEEE80211_FC0_TYPE_DATA;
  608 
  609         case IEEE80211_FC0_TYPE_MGT:
  610                 vap->iv_stats.is_rx_mgmt++;
  611                 IEEE80211_NODE_STAT(ni, rx_mgmt);
  612                 if (dir != IEEE80211_FC1_DIR_NODS) {
  613                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  614                             wh, "data", "incorrect dir 0x%x", dir);
  615                         vap->iv_stats.is_rx_wrongdir++;
  616                         goto err;
  617                 }
  618                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  619                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  620                             ni->ni_macaddr, "mgt", "too short: len %u",
  621                             m->m_pkthdr.len);
  622                         vap->iv_stats.is_rx_tooshort++;
  623                         goto out;
  624                 }
  625 #ifdef IEEE80211_DEBUG
  626                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
  627                     ieee80211_msg_dumppkts(vap)) {
  628                         if_printf(ifp, "received %s from %s rssi %d\n",
  629                             ieee80211_mgt_subtype_name[subtype >>
  630                                 IEEE80211_FC0_SUBTYPE_SHIFT],
  631                             ether_sprintf(wh->i_addr2), rssi);
  632                 }
  633 #endif
  634                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
  635                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  636                             wh, NULL, "%s", "WEP set but not permitted");
  637                         vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
  638                         goto out;
  639                 }
  640                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
  641                 goto out;
  642 
  643         case IEEE80211_FC0_TYPE_CTL:
  644                 vap->iv_stats.is_rx_ctl++;
  645                 IEEE80211_NODE_STAT(ni, rx_ctrl);
  646                 vap->iv_recv_ctl(ni, m, subtype);
  647                 goto out;
  648 
  649         default:
  650                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  651                     wh, "bad", "frame type 0x%x", type);
  652                 /* should not come here */
  653                 break;
  654         }
  655 err:
  656         ifp->if_ierrors++;
  657 out:
  658         if (m != NULL) {
  659                 if (need_tap && ieee80211_radiotap_active_vap(vap))
  660                         ieee80211_radiotap_rx(vap, m);
  661                 m_freem(m);
  662         }
  663         return type;
  664 #undef SEQ_LEQ
  665 }
  666 
  667 static int
  668 is11bclient(const uint8_t *rates, const uint8_t *xrates)
  669 {
  670         static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
  671         int i;
  672 
  673         /* NB: the 11b clients we care about will not have xrates */
  674         if (xrates != NULL || rates == NULL)
  675                 return 0;
  676         for (i = 0; i < rates[1]; i++) {
  677                 int r = rates[2+i] & IEEE80211_RATE_VAL;
  678                 if (r > 2*11 || ((1<<r) & brates) == 0)
  679                         return 0;
  680         }
  681         return 1;
  682 }
  683 
  684 static void
  685 adhoc_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
  686         int subtype, int rssi, int nf)
  687 {
  688         struct ieee80211vap *vap = ni->ni_vap;
  689         struct ieee80211com *ic = ni->ni_ic;
  690         struct ieee80211_frame *wh;
  691         uint8_t *frm, *efrm, *sfrm;
  692         uint8_t *ssid, *rates, *xrates;
  693 
  694         wh = mtod(m0, struct ieee80211_frame *);
  695         frm = (uint8_t *)&wh[1];
  696         efrm = mtod(m0, uint8_t *) + m0->m_len;
  697         switch (subtype) {
  698         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
  699         case IEEE80211_FC0_SUBTYPE_BEACON: {
  700                 struct ieee80211_scanparams scan;
  701                 /*
  702                  * We process beacon/probe response
  703                  * frames to discover neighbors.
  704                  */ 
  705                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
  706                         return;
  707                 /*
  708                  * Count frame now that we know it's to be processed.
  709                  */
  710                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
  711                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
  712                         IEEE80211_NODE_STAT(ni, rx_beacons);
  713                 } else
  714                         IEEE80211_NODE_STAT(ni, rx_proberesp);
  715                 /*
  716                  * If scanning, just pass information to the scan module.
  717                  */
  718                 if (ic->ic_flags & IEEE80211_F_SCAN) {
  719                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
  720                                 /*
  721                                  * Actively scanning a channel marked passive;
  722                                  * send a probe request now that we know there
  723                                  * is 802.11 traffic present.
  724                                  *
  725                                  * XXX check if the beacon we recv'd gives
  726                                  * us what we need and suppress the probe req
  727                                  */
  728                                 ieee80211_probe_curchan(vap, 1);
  729                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
  730                         }
  731                         ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
  732                         return;
  733                 }
  734                 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
  735                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
  736                                 /*
  737                                  * Create a new entry in the neighbor table.
  738                                  */
  739                                 ni = ieee80211_add_neighbor(vap, wh, &scan);
  740                         } else if (ni->ni_capinfo == 0) {
  741                                 /*
  742                                  * Update faked node created on transmit.
  743                                  * Note this also updates the tsf.
  744                                  */
  745                                 ieee80211_init_neighbor(ni, wh, &scan);
  746                         } else {
  747                                 /*
  748                                  * Record tsf for potential resync.
  749                                  */
  750                                 memcpy(ni->ni_tstamp.data, scan.tstamp,
  751                                         sizeof(ni->ni_tstamp));
  752                         }
  753                         if (ni != NULL) {
  754                                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
  755                                 ni->ni_noise = nf;
  756                         }
  757                 }
  758                 break;
  759         }
  760 
  761         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  762                 if (vap->iv_state != IEEE80211_S_RUN) {
  763                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  764                             wh, NULL, "wrong state %s",
  765                             ieee80211_state_name[vap->iv_state]);
  766                         vap->iv_stats.is_rx_mgtdiscard++;
  767                         return;
  768                 }
  769                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
  770                         /* frame must be directed */
  771                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  772                             wh, NULL, "%s", "not unicast");
  773                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
  774                         return;
  775                 }
  776 
  777                 /*
  778                  * prreq frame format
  779                  *      [tlv] ssid
  780                  *      [tlv] supported rates
  781                  *      [tlv] extended supported rates
  782                  */
  783                 ssid = rates = xrates = NULL;
  784                 sfrm = frm;
  785                 while (efrm - frm > 1) {
  786                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
  787                         switch (*frm) {
  788                         case IEEE80211_ELEMID_SSID:
  789                                 ssid = frm;
  790                                 break;
  791                         case IEEE80211_ELEMID_RATES:
  792                                 rates = frm;
  793                                 break;
  794                         case IEEE80211_ELEMID_XRATES:
  795                                 xrates = frm;
  796                                 break;
  797                         }
  798                         frm += frm[1] + 2;
  799                 }
  800                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
  801                 if (xrates != NULL)
  802                         IEEE80211_VERIFY_ELEMENT(xrates,
  803                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
  804                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
  805                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
  806                 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
  807                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  808                             wh, NULL,
  809                             "%s", "no ssid with ssid suppression enabled");
  810                         vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
  811                         return;
  812                 }
  813 
  814                 /* XXX find a better class or define it's own */
  815                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
  816                     "%s", "recv probe req");
  817                 /*
  818                  * Some legacy 11b clients cannot hack a complete
  819                  * probe response frame.  When the request includes
  820                  * only a bare-bones rate set, communicate this to
  821                  * the transmit side.
  822                  */
  823                 ieee80211_send_proberesp(vap, wh->i_addr2,
  824                     is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
  825                 break;
  826 
  827         case IEEE80211_FC0_SUBTYPE_ACTION: {
  828                 const struct ieee80211_action *ia;
  829 
  830                 if (vap->iv_state != IEEE80211_S_RUN) {
  831                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  832                             wh, NULL, "wrong state %s",
  833                             ieee80211_state_name[vap->iv_state]);
  834                         vap->iv_stats.is_rx_mgtdiscard++;
  835                         return;
  836                 }
  837                 /*
  838                  * action frame format:
  839                  *      [1] category
  840                  *      [1] action
  841                  *      [tlv] parameters
  842                  */
  843                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  844                         sizeof(struct ieee80211_action), return);
  845                 ia = (const struct ieee80211_action *) frm;
  846 
  847                 vap->iv_stats.is_rx_action++;
  848                 IEEE80211_NODE_STAT(ni, rx_action);
  849 
  850                 /* verify frame payloads but defer processing */
  851                 /* XXX maybe push this to method */
  852                 switch (ia->ia_category) {
  853                 case IEEE80211_ACTION_CAT_BA:
  854                         switch (ia->ia_action) {
  855                         case IEEE80211_ACTION_BA_ADDBA_REQUEST:
  856                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  857                                     sizeof(struct ieee80211_action_ba_addbarequest),
  858                                     return);
  859                                 break;
  860                         case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
  861                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  862                                     sizeof(struct ieee80211_action_ba_addbaresponse),
  863                                     return);
  864                                 break;
  865                         case IEEE80211_ACTION_BA_DELBA:
  866                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  867                                     sizeof(struct ieee80211_action_ba_delba),
  868                                     return);
  869                                 break;
  870                         }
  871                         break;
  872                 case IEEE80211_ACTION_CAT_HT:
  873                         switch (ia->ia_action) {
  874                         case IEEE80211_ACTION_HT_TXCHWIDTH:
  875                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  876                                     sizeof(struct ieee80211_action_ht_txchwidth),
  877                                     return);
  878                                 break;
  879                         }
  880                         break;
  881                 }
  882                 ic->ic_recv_action(ni, wh, frm, efrm);
  883                 break;
  884         }
  885 
  886         case IEEE80211_FC0_SUBTYPE_AUTH:
  887         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
  888         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
  889         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
  890         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
  891         case IEEE80211_FC0_SUBTYPE_DEAUTH:
  892         case IEEE80211_FC0_SUBTYPE_DISASSOC:
  893                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  894                      wh, NULL, "%s", "not handled");
  895                 vap->iv_stats.is_rx_mgtdiscard++;
  896                 return;
  897 
  898         default:
  899                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  900                      wh, "mgt", "subtype 0x%x not handled", subtype);
  901                 vap->iv_stats.is_rx_badsubtype++;
  902                 break;
  903         }
  904 }
  905 #undef IEEE80211_VERIFY_LENGTH
  906 #undef IEEE80211_VERIFY_ELEMENT
  907 
  908 static void
  909 ahdemo_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
  910         int subtype, int rssi, int nf)
  911 {
  912         struct ieee80211vap *vap = ni->ni_vap;
  913         struct ieee80211com *ic = ni->ni_ic;
  914 
  915         /*
  916          * Process management frames when scanning; useful for doing
  917          * a site-survey.
  918          */
  919         if (ic->ic_flags & IEEE80211_F_SCAN)
  920                 adhoc_recv_mgmt(ni, m0, subtype, rssi, nf);
  921         else
  922                 vap->iv_stats.is_rx_mgtdiscard++;
  923 }
  924 
  925 static void
  926 adhoc_recv_ctl(struct ieee80211_node *ni, struct mbuf *m0, int subtype)
  927 {
  928 }

Cache object: 1a8be799648edbb9baca77b5bba6f016


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.