The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_adhoc.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2007-2009 Sam Leffler, Errno Consulting
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   24  */
   25 
   26 #include <sys/cdefs.h>
   27 #ifdef __FreeBSD__
   28 __FBSDID("$FreeBSD: releng/8.3/sys/net80211/ieee80211_adhoc.c 215621 2010-11-21 11:03:22Z bschmidt $");
   29 #endif
   30 
   31 /*
   32  * IEEE 802.11 IBSS mode support.
   33  */
   34 #include "opt_inet.h"
   35 #include "opt_wlan.h"
   36 
   37 #include <sys/param.h>
   38 #include <sys/systm.h> 
   39 #include <sys/mbuf.h>   
   40 #include <sys/malloc.h>
   41 #include <sys/kernel.h>
   42 
   43 #include <sys/socket.h>
   44 #include <sys/sockio.h>
   45 #include <sys/endian.h>
   46 #include <sys/errno.h>
   47 #include <sys/proc.h>
   48 #include <sys/sysctl.h>
   49 
   50 #include <net/if.h>
   51 #include <net/if_media.h>
   52 #include <net/if_llc.h>
   53 #include <net/ethernet.h>
   54 
   55 #include <net/bpf.h>
   56 
   57 #include <net80211/ieee80211_var.h>
   58 #include <net80211/ieee80211_adhoc.h>
   59 #include <net80211/ieee80211_input.h>
   60 #ifdef IEEE80211_SUPPORT_SUPERG
   61 #include <net80211/ieee80211_superg.h>
   62 #endif
   63 #ifdef IEEE80211_SUPPORT_TDMA
   64 #include <net80211/ieee80211_tdma.h>
   65 #endif
   66 
   67 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
   68 
   69 static  void adhoc_vattach(struct ieee80211vap *);
   70 static  int adhoc_newstate(struct ieee80211vap *, enum ieee80211_state, int);
   71 static int adhoc_input(struct ieee80211_node *, struct mbuf *, int, int);
   72 static void adhoc_recv_mgmt(struct ieee80211_node *, struct mbuf *,
   73         int subtype, int, int);
   74 static void ahdemo_recv_mgmt(struct ieee80211_node *, struct mbuf *,
   75         int subtype, int, int);
   76 static void adhoc_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
   77 
   78 void
   79 ieee80211_adhoc_attach(struct ieee80211com *ic)
   80 {
   81         ic->ic_vattach[IEEE80211_M_IBSS] = adhoc_vattach;
   82         ic->ic_vattach[IEEE80211_M_AHDEMO] = adhoc_vattach;
   83 }
   84 
   85 void
   86 ieee80211_adhoc_detach(struct ieee80211com *ic)
   87 {
   88 }
   89 
   90 static void
   91 adhoc_vdetach(struct ieee80211vap *vap)
   92 {
   93 }
   94 
   95 static void
   96 adhoc_vattach(struct ieee80211vap *vap)
   97 {
   98         vap->iv_newstate = adhoc_newstate;
   99         vap->iv_input = adhoc_input;
  100         if (vap->iv_opmode == IEEE80211_M_IBSS)
  101                 vap->iv_recv_mgmt = adhoc_recv_mgmt;
  102         else
  103                 vap->iv_recv_mgmt = ahdemo_recv_mgmt;
  104         vap->iv_recv_ctl = adhoc_recv_ctl;
  105         vap->iv_opdetach = adhoc_vdetach;
  106 #ifdef IEEE80211_SUPPORT_TDMA
  107         /*
  108          * Throw control to tdma support.  Note we do this
  109          * after setting up our callbacks so it can piggyback
  110          * on top of us.
  111          */
  112         if (vap->iv_caps & IEEE80211_C_TDMA)
  113                 ieee80211_tdma_vattach(vap);
  114 #endif
  115 }
  116 
  117 static void
  118 sta_leave(void *arg, struct ieee80211_node *ni)
  119 {
  120         struct ieee80211vap *vap = arg;
  121 
  122         if (ni->ni_vap == vap && ni != vap->iv_bss)
  123                 ieee80211_node_leave(ni);
  124 }
  125 
  126 /*
  127  * IEEE80211_M_IBSS+IEEE80211_M_AHDEMO vap state machine handler.
  128  */
  129 static int
  130 adhoc_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
  131 {
  132         struct ieee80211com *ic = vap->iv_ic;
  133         struct ieee80211_node *ni;
  134         enum ieee80211_state ostate;
  135 
  136         IEEE80211_LOCK_ASSERT(vap->iv_ic);
  137 
  138         ostate = vap->iv_state;
  139         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
  140             __func__, ieee80211_state_name[ostate],
  141             ieee80211_state_name[nstate], arg);
  142         vap->iv_state = nstate;                 /* state transition */
  143         if (ostate != IEEE80211_S_SCAN)
  144                 ieee80211_cancel_scan(vap);     /* background scan */
  145         ni = vap->iv_bss;                       /* NB: no reference held */
  146         switch (nstate) {
  147         case IEEE80211_S_INIT:
  148                 switch (ostate) {
  149                 case IEEE80211_S_SCAN:
  150                         ieee80211_cancel_scan(vap);
  151                         break;
  152                 default:
  153                         break;
  154                 }
  155                 if (ostate != IEEE80211_S_INIT) {
  156                         /* NB: optimize INIT -> INIT case */
  157                         ieee80211_reset_bss(vap);
  158                 }
  159                 break;
  160         case IEEE80211_S_SCAN:
  161                 switch (ostate) {
  162                 case IEEE80211_S_RUN:           /* beacon miss */
  163                         /* purge station table; entries are stale */
  164                         ieee80211_iterate_nodes(&ic->ic_sta, sta_leave, vap);
  165                         /* fall thru... */
  166                 case IEEE80211_S_INIT:
  167                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
  168                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
  169                                 /*
  170                                  * Already have a channel; bypass the
  171                                  * scan and startup immediately.
  172                                  */
  173                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
  174                                 break;
  175                         }
  176                         /*
  177                          * Initiate a scan.  We can come here as a result
  178                          * of an IEEE80211_IOC_SCAN_REQ too in which case
  179                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
  180                          * and the scan request parameters will be present
  181                          * in iv_scanreq.  Otherwise we do the default.
  182                          */
  183                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
  184                                 ieee80211_check_scan(vap,
  185                                     vap->iv_scanreq_flags,
  186                                     vap->iv_scanreq_duration,
  187                                     vap->iv_scanreq_mindwell,
  188                                     vap->iv_scanreq_maxdwell,
  189                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
  190                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
  191                         } else
  192                                 ieee80211_check_scan_current(vap);
  193                         break;
  194                 case IEEE80211_S_SCAN:
  195                         /*
  196                          * This can happen because of a change in state
  197                          * that requires a reset.  Trigger a new scan
  198                          * unless we're in manual roaming mode in which
  199                          * case an application must issue an explicit request.
  200                          */
  201                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  202                                 ieee80211_check_scan_current(vap);
  203                         break;
  204                 default:
  205                         goto invalid;
  206                 }
  207                 break;
  208         case IEEE80211_S_RUN:
  209                 if (vap->iv_flags & IEEE80211_F_WPA) {
  210                         /* XXX validate prerequisites */
  211                 }
  212                 switch (ostate) {
  213                 case IEEE80211_S_SCAN:
  214 #ifdef IEEE80211_DEBUG
  215                         if (ieee80211_msg_debug(vap)) {
  216                                 ieee80211_note(vap,
  217                                     "synchronized with %s ssid ",
  218                                     ether_sprintf(ni->ni_bssid));
  219                                 ieee80211_print_essid(vap->iv_bss->ni_essid,
  220                                     ni->ni_esslen);
  221                                 /* XXX MCS/HT */
  222                                 printf(" channel %d start %uMb\n",
  223                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
  224                                     IEEE80211_RATE2MBS(ni->ni_txrate));
  225                         }
  226 #endif
  227                         break;
  228                 default:
  229                         goto invalid;
  230                 }
  231                 /*
  232                  * When 802.1x is not in use mark the port authorized
  233                  * at this point so traffic can flow.
  234                  */
  235                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
  236                         ieee80211_node_authorize(ni);
  237                 /*
  238                  * Fake association when joining an existing bss.
  239                  */
  240                 if (!IEEE80211_ADDR_EQ(ni->ni_macaddr, vap->iv_myaddr) &&
  241                     ic->ic_newassoc != NULL)
  242                         ic->ic_newassoc(ni, ostate != IEEE80211_S_RUN);
  243                 break;
  244         case IEEE80211_S_SLEEP:
  245                 ieee80211_sta_pwrsave(vap, 0);
  246                 break;
  247         default:
  248         invalid:
  249                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
  250                     "%s: unexpected state transition %s -> %s\n", __func__,
  251                     ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
  252                 break;
  253         }
  254         return 0;
  255 }
  256 
  257 /*
  258  * Decide if a received management frame should be
  259  * printed when debugging is enabled.  This filters some
  260  * of the less interesting frames that come frequently
  261  * (e.g. beacons).
  262  */
  263 static __inline int
  264 doprint(struct ieee80211vap *vap, int subtype)
  265 {
  266         switch (subtype) {
  267         case IEEE80211_FC0_SUBTYPE_BEACON:
  268                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
  269         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  270                 return 1;
  271         }
  272         return 1;
  273 }
  274 
  275 /*
  276  * Process a received frame.  The node associated with the sender
  277  * should be supplied.  If nothing was found in the node table then
  278  * the caller is assumed to supply a reference to iv_bss instead.
  279  * The RSSI and a timestamp are also supplied.  The RSSI data is used
  280  * during AP scanning to select a AP to associate with; it can have
  281  * any units so long as values have consistent units and higher values
  282  * mean ``better signal''.  The receive timestamp is currently not used
  283  * by the 802.11 layer.
  284  */
  285 static int
  286 adhoc_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
  287 {
  288 #define SEQ_LEQ(a,b)    ((int)((a)-(b)) <= 0)
  289 #define HAS_SEQ(type)   ((type & 0x4) == 0)
  290         struct ieee80211vap *vap = ni->ni_vap;
  291         struct ieee80211com *ic = ni->ni_ic;
  292         struct ifnet *ifp = vap->iv_ifp;
  293         struct ieee80211_frame *wh;
  294         struct ieee80211_key *key;
  295         struct ether_header *eh;
  296         int hdrspace, need_tap = 1;     /* mbuf need to be tapped. */   
  297         uint8_t dir, type, subtype, qos;
  298         uint8_t *bssid;
  299         uint16_t rxseq;
  300 
  301         if (m->m_flags & M_AMPDU_MPDU) {
  302                 /*
  303                  * Fastpath for A-MPDU reorder q resubmission.  Frames
  304                  * w/ M_AMPDU_MPDU marked have already passed through
  305                  * here but were received out of order and been held on
  306                  * the reorder queue.  When resubmitted they are marked
  307                  * with the M_AMPDU_MPDU flag and we can bypass most of
  308                  * the normal processing.
  309                  */
  310                 wh = mtod(m, struct ieee80211_frame *);
  311                 type = IEEE80211_FC0_TYPE_DATA;
  312                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  313                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
  314                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
  315                 goto resubmit_ampdu;
  316         }
  317 
  318         KASSERT(ni != NULL, ("null node"));
  319         ni->ni_inact = ni->ni_inact_reload;
  320 
  321         type = -1;                      /* undefined */
  322 
  323         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
  324                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  325                     ni->ni_macaddr, NULL,
  326                     "too short (1): len %u", m->m_pkthdr.len);
  327                 vap->iv_stats.is_rx_tooshort++;
  328                 goto out;
  329         }
  330         /*
  331          * Bit of a cheat here, we use a pointer for a 3-address
  332          * frame format but don't reference fields past outside
  333          * ieee80211_frame_min w/o first validating the data is
  334          * present.
  335          */
  336         wh = mtod(m, struct ieee80211_frame *);
  337 
  338         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
  339             IEEE80211_FC0_VERSION_0) {
  340                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  341                     ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
  342                     wh->i_fc[0], wh->i_fc[1]);
  343                 vap->iv_stats.is_rx_badversion++;
  344                 goto err;
  345         }
  346 
  347         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  348         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
  349         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
  350         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
  351                 if (dir != IEEE80211_FC1_DIR_NODS)
  352                         bssid = wh->i_addr1;
  353                 else if (type == IEEE80211_FC0_TYPE_CTL)
  354                         bssid = wh->i_addr1;
  355                 else {
  356                         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  357                                 IEEE80211_DISCARD_MAC(vap,
  358                                     IEEE80211_MSG_ANY, ni->ni_macaddr,
  359                                     NULL, "too short (2): len %u",
  360                                     m->m_pkthdr.len);
  361                                 vap->iv_stats.is_rx_tooshort++;
  362                                 goto out;
  363                         }
  364                         bssid = wh->i_addr3;
  365                 }
  366                 /*
  367                  * Validate the bssid.
  368                  */
  369                 if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
  370                     !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
  371                         /* not interested in */
  372                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  373                             bssid, NULL, "%s", "not to bss");
  374                         vap->iv_stats.is_rx_wrongbss++;
  375                         goto out;
  376                 }
  377                 /*
  378                  * Data frame, cons up a node when it doesn't
  379                  * exist. This should probably done after an ACL check.
  380                  */
  381                 if (type == IEEE80211_FC0_TYPE_DATA &&
  382                     ni == vap->iv_bss &&
  383                     !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
  384                         /*
  385                          * Beware of frames that come in too early; we
  386                          * can receive broadcast frames and creating sta
  387                          * entries will blow up because there is no bss
  388                          * channel yet.
  389                          */
  390                         if (vap->iv_state != IEEE80211_S_RUN) {
  391                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  392                                     wh, "data", "not in RUN state (%s)",
  393                                     ieee80211_state_name[vap->iv_state]);
  394                                 vap->iv_stats.is_rx_badstate++;
  395                                 goto err;
  396                         }
  397                         /*
  398                          * Fake up a node for this newly
  399                          * discovered member of the IBSS.
  400                          */
  401                         ni = ieee80211_fakeup_adhoc_node(vap, wh->i_addr2);
  402                         if (ni == NULL) {
  403                                 /* NB: stat kept for alloc failure */
  404                                 goto err;
  405                         }
  406                 }
  407                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
  408                 ni->ni_noise = nf;
  409                 if (HAS_SEQ(type)) {
  410                         uint8_t tid = ieee80211_gettid(wh);
  411                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
  412                             TID_TO_WME_AC(tid) >= WME_AC_VI)
  413                                 ic->ic_wme.wme_hipri_traffic++;
  414                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
  415                         if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
  416                             (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
  417                             SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
  418                                 /* duplicate, discard */
  419                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  420                                     bssid, "duplicate",
  421                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
  422                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
  423                                     ni->ni_rxseqs[tid] >>
  424                                         IEEE80211_SEQ_SEQ_SHIFT,
  425                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
  426                                     ni->ni_rxseqs[tid] &
  427                                         IEEE80211_SEQ_FRAG_MASK,
  428                                     tid);
  429                                 vap->iv_stats.is_rx_dup++;
  430                                 IEEE80211_NODE_STAT(ni, rx_dup);
  431                                 goto out;
  432                         }
  433                         ni->ni_rxseqs[tid] = rxseq;
  434                 }
  435         }
  436 
  437         switch (type) {
  438         case IEEE80211_FC0_TYPE_DATA:
  439                 hdrspace = ieee80211_hdrspace(ic, wh);
  440                 if (m->m_len < hdrspace &&
  441                     (m = m_pullup(m, hdrspace)) == NULL) {
  442                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  443                             ni->ni_macaddr, NULL,
  444                             "data too short: expecting %u", hdrspace);
  445                         vap->iv_stats.is_rx_tooshort++;
  446                         goto out;               /* XXX */
  447                 }
  448                 if (dir != IEEE80211_FC1_DIR_NODS) {
  449                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  450                             wh, "data", "incorrect dir 0x%x", dir);
  451                         vap->iv_stats.is_rx_wrongdir++;
  452                         goto out;
  453                 }
  454                 /* XXX no power-save support */
  455 
  456                 /*
  457                  * Handle A-MPDU re-ordering.  If the frame is to be
  458                  * processed directly then ieee80211_ampdu_reorder
  459                  * will return 0; otherwise it has consumed the mbuf
  460                  * and we should do nothing more with it.
  461                  */
  462                 if ((m->m_flags & M_AMPDU) &&
  463                     ieee80211_ampdu_reorder(ni, m) != 0) {
  464                         m = NULL;
  465                         goto out;
  466                 }
  467         resubmit_ampdu:
  468 
  469                 /*
  470                  * Handle privacy requirements.  Note that we
  471                  * must not be preempted from here until after
  472                  * we (potentially) call ieee80211_crypto_demic;
  473                  * otherwise we may violate assumptions in the
  474                  * crypto cipher modules used to do delayed update
  475                  * of replay sequence numbers.
  476                  */
  477                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
  478                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
  479                                 /*
  480                                  * Discard encrypted frames when privacy is off.
  481                                  */
  482                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  483                                     wh, "WEP", "%s", "PRIVACY off");
  484                                 vap->iv_stats.is_rx_noprivacy++;
  485                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
  486                                 goto out;
  487                         }
  488                         key = ieee80211_crypto_decap(ni, m, hdrspace);
  489                         if (key == NULL) {
  490                                 /* NB: stats+msgs handled in crypto_decap */
  491                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
  492                                 goto out;
  493                         }
  494                         wh = mtod(m, struct ieee80211_frame *);
  495                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
  496                 } else {
  497                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
  498                         key = NULL;
  499                 }
  500 
  501                 /*
  502                  * Save QoS bits for use below--before we strip the header.
  503                  */
  504                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
  505                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
  506                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
  507                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
  508                 } else
  509                         qos = 0;
  510 
  511                 /*
  512                  * Next up, any fragmentation.
  513                  */
  514                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  515                         m = ieee80211_defrag(ni, m, hdrspace);
  516                         if (m == NULL) {
  517                                 /* Fragment dropped or frame not complete yet */
  518                                 goto out;
  519                         }
  520                 }
  521                 wh = NULL;              /* no longer valid, catch any uses */
  522 
  523                 /*
  524                  * Next strip any MSDU crypto bits.
  525                  */
  526                 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
  527                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  528                             ni->ni_macaddr, "data", "%s", "demic error");
  529                         vap->iv_stats.is_rx_demicfail++;
  530                         IEEE80211_NODE_STAT(ni, rx_demicfail);
  531                         goto out;
  532                 }
  533 
  534                 /* copy to listener after decrypt */
  535                 if (ieee80211_radiotap_active_vap(vap))
  536                         ieee80211_radiotap_rx(vap, m);
  537                 need_tap = 0;
  538 
  539                 /*
  540                  * Finally, strip the 802.11 header.
  541                  */
  542                 m = ieee80211_decap(vap, m, hdrspace);
  543                 if (m == NULL) {
  544                         /* XXX mask bit to check for both */
  545                         /* don't count Null data frames as errors */
  546                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
  547                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
  548                                 goto out;
  549                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  550                             ni->ni_macaddr, "data", "%s", "decap error");
  551                         vap->iv_stats.is_rx_decap++;
  552                         IEEE80211_NODE_STAT(ni, rx_decap);
  553                         goto err;
  554                 }
  555                 eh = mtod(m, struct ether_header *);
  556                 if (!ieee80211_node_is_authorized(ni)) {
  557                         /*
  558                          * Deny any non-PAE frames received prior to
  559                          * authorization.  For open/shared-key
  560                          * authentication the port is mark authorized
  561                          * after authentication completes.  For 802.1x
  562                          * the port is not marked authorized by the
  563                          * authenticator until the handshake has completed.
  564                          */
  565                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
  566                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  567                                     eh->ether_shost, "data",
  568                                     "unauthorized port: ether type 0x%x len %u",
  569                                     eh->ether_type, m->m_pkthdr.len);
  570                                 vap->iv_stats.is_rx_unauth++;
  571                                 IEEE80211_NODE_STAT(ni, rx_unauth);
  572                                 goto err;
  573                         }
  574                 } else {
  575                         /*
  576                          * When denying unencrypted frames, discard
  577                          * any non-PAE frames received without encryption.
  578                          */
  579                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
  580                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
  581                             eh->ether_type != htons(ETHERTYPE_PAE)) {
  582                                 /*
  583                                  * Drop unencrypted frames.
  584                                  */
  585                                 vap->iv_stats.is_rx_unencrypted++;
  586                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
  587                                 goto out;
  588                         }
  589                 }
  590                 /* XXX require HT? */
  591                 if (qos & IEEE80211_QOS_AMSDU) {
  592                         m = ieee80211_decap_amsdu(ni, m);
  593                         if (m == NULL)
  594                                 return IEEE80211_FC0_TYPE_DATA;
  595                 } else {
  596 #ifdef IEEE80211_SUPPORT_SUPERG
  597                         m = ieee80211_decap_fastframe(vap, ni, m);
  598                         if (m == NULL)
  599                                 return IEEE80211_FC0_TYPE_DATA;
  600 #endif
  601                 }
  602                 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
  603                         ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
  604                 else
  605                         ieee80211_deliver_data(vap, ni, m);
  606                 return IEEE80211_FC0_TYPE_DATA;
  607 
  608         case IEEE80211_FC0_TYPE_MGT:
  609                 vap->iv_stats.is_rx_mgmt++;
  610                 IEEE80211_NODE_STAT(ni, rx_mgmt);
  611                 if (dir != IEEE80211_FC1_DIR_NODS) {
  612                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  613                             wh, "data", "incorrect dir 0x%x", dir);
  614                         vap->iv_stats.is_rx_wrongdir++;
  615                         goto err;
  616                 }
  617                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  618                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  619                             ni->ni_macaddr, "mgt", "too short: len %u",
  620                             m->m_pkthdr.len);
  621                         vap->iv_stats.is_rx_tooshort++;
  622                         goto out;
  623                 }
  624 #ifdef IEEE80211_DEBUG
  625                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
  626                     ieee80211_msg_dumppkts(vap)) {
  627                         if_printf(ifp, "received %s from %s rssi %d\n",
  628                             ieee80211_mgt_subtype_name[subtype >>
  629                                 IEEE80211_FC0_SUBTYPE_SHIFT],
  630                             ether_sprintf(wh->i_addr2), rssi);
  631                 }
  632 #endif
  633                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
  634                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  635                             wh, NULL, "%s", "WEP set but not permitted");
  636                         vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
  637                         goto out;
  638                 }
  639                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
  640                 goto out;
  641 
  642         case IEEE80211_FC0_TYPE_CTL:
  643                 vap->iv_stats.is_rx_ctl++;
  644                 IEEE80211_NODE_STAT(ni, rx_ctrl);
  645                 vap->iv_recv_ctl(ni, m, subtype);
  646                 goto out;
  647 
  648         default:
  649                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  650                     wh, "bad", "frame type 0x%x", type);
  651                 /* should not come here */
  652                 break;
  653         }
  654 err:
  655         ifp->if_ierrors++;
  656 out:
  657         if (m != NULL) {
  658                 if (need_tap && ieee80211_radiotap_active_vap(vap))
  659                         ieee80211_radiotap_rx(vap, m);
  660                 m_freem(m);
  661         }
  662         return type;
  663 #undef SEQ_LEQ
  664 }
  665 
  666 static int
  667 is11bclient(const uint8_t *rates, const uint8_t *xrates)
  668 {
  669         static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
  670         int i;
  671 
  672         /* NB: the 11b clients we care about will not have xrates */
  673         if (xrates != NULL || rates == NULL)
  674                 return 0;
  675         for (i = 0; i < rates[1]; i++) {
  676                 int r = rates[2+i] & IEEE80211_RATE_VAL;
  677                 if (r > 2*11 || ((1<<r) & brates) == 0)
  678                         return 0;
  679         }
  680         return 1;
  681 }
  682 
  683 static void
  684 adhoc_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
  685         int subtype, int rssi, int nf)
  686 {
  687         struct ieee80211vap *vap = ni->ni_vap;
  688         struct ieee80211com *ic = ni->ni_ic;
  689         struct ieee80211_frame *wh;
  690         uint8_t *frm, *efrm, *sfrm;
  691         uint8_t *ssid, *rates, *xrates;
  692 
  693         wh = mtod(m0, struct ieee80211_frame *);
  694         frm = (uint8_t *)&wh[1];
  695         efrm = mtod(m0, uint8_t *) + m0->m_len;
  696         switch (subtype) {
  697         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
  698         case IEEE80211_FC0_SUBTYPE_BEACON: {
  699                 struct ieee80211_scanparams scan;
  700                 /*
  701                  * We process beacon/probe response
  702                  * frames to discover neighbors.
  703                  */ 
  704                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
  705                         return;
  706                 /*
  707                  * Count frame now that we know it's to be processed.
  708                  */
  709                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
  710                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
  711                         IEEE80211_NODE_STAT(ni, rx_beacons);
  712                 } else
  713                         IEEE80211_NODE_STAT(ni, rx_proberesp);
  714                 /*
  715                  * If scanning, just pass information to the scan module.
  716                  */
  717                 if (ic->ic_flags & IEEE80211_F_SCAN) {
  718                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
  719                                 /*
  720                                  * Actively scanning a channel marked passive;
  721                                  * send a probe request now that we know there
  722                                  * is 802.11 traffic present.
  723                                  *
  724                                  * XXX check if the beacon we recv'd gives
  725                                  * us what we need and suppress the probe req
  726                                  */
  727                                 ieee80211_probe_curchan(vap, 1);
  728                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
  729                         }
  730                         ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
  731                         return;
  732                 }
  733                 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
  734                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
  735                                 /*
  736                                  * Create a new entry in the neighbor table.
  737                                  */
  738                                 ni = ieee80211_add_neighbor(vap, wh, &scan);
  739                         } else if (ni->ni_capinfo == 0) {
  740                                 /*
  741                                  * Update faked node created on transmit.
  742                                  * Note this also updates the tsf.
  743                                  */
  744                                 ieee80211_init_neighbor(ni, wh, &scan);
  745                         } else {
  746                                 /*
  747                                  * Record tsf for potential resync.
  748                                  */
  749                                 memcpy(ni->ni_tstamp.data, scan.tstamp,
  750                                         sizeof(ni->ni_tstamp));
  751                         }
  752                         if (ni != NULL) {
  753                                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
  754                                 ni->ni_noise = nf;
  755                         }
  756                 }
  757                 break;
  758         }
  759 
  760         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  761                 if (vap->iv_state != IEEE80211_S_RUN) {
  762                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  763                             wh, NULL, "wrong state %s",
  764                             ieee80211_state_name[vap->iv_state]);
  765                         vap->iv_stats.is_rx_mgtdiscard++;
  766                         return;
  767                 }
  768                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
  769                         /* frame must be directed */
  770                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  771                             wh, NULL, "%s", "not unicast");
  772                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
  773                         return;
  774                 }
  775 
  776                 /*
  777                  * prreq frame format
  778                  *      [tlv] ssid
  779                  *      [tlv] supported rates
  780                  *      [tlv] extended supported rates
  781                  */
  782                 ssid = rates = xrates = NULL;
  783                 sfrm = frm;
  784                 while (efrm - frm > 1) {
  785                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
  786                         switch (*frm) {
  787                         case IEEE80211_ELEMID_SSID:
  788                                 ssid = frm;
  789                                 break;
  790                         case IEEE80211_ELEMID_RATES:
  791                                 rates = frm;
  792                                 break;
  793                         case IEEE80211_ELEMID_XRATES:
  794                                 xrates = frm;
  795                                 break;
  796                         }
  797                         frm += frm[1] + 2;
  798                 }
  799                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
  800                 if (xrates != NULL)
  801                         IEEE80211_VERIFY_ELEMENT(xrates,
  802                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
  803                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
  804                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
  805                 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
  806                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  807                             wh, NULL,
  808                             "%s", "no ssid with ssid suppression enabled");
  809                         vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
  810                         return;
  811                 }
  812 
  813                 /* XXX find a better class or define it's own */
  814                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
  815                     "%s", "recv probe req");
  816                 /*
  817                  * Some legacy 11b clients cannot hack a complete
  818                  * probe response frame.  When the request includes
  819                  * only a bare-bones rate set, communicate this to
  820                  * the transmit side.
  821                  */
  822                 ieee80211_send_proberesp(vap, wh->i_addr2,
  823                     is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
  824                 break;
  825 
  826         case IEEE80211_FC0_SUBTYPE_ACTION: {
  827                 const struct ieee80211_action *ia;
  828 
  829                 if (vap->iv_state != IEEE80211_S_RUN) {
  830                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  831                             wh, NULL, "wrong state %s",
  832                             ieee80211_state_name[vap->iv_state]);
  833                         vap->iv_stats.is_rx_mgtdiscard++;
  834                         return;
  835                 }
  836                 /*
  837                  * action frame format:
  838                  *      [1] category
  839                  *      [1] action
  840                  *      [tlv] parameters
  841                  */
  842                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  843                         sizeof(struct ieee80211_action), return);
  844                 ia = (const struct ieee80211_action *) frm;
  845 
  846                 vap->iv_stats.is_rx_action++;
  847                 IEEE80211_NODE_STAT(ni, rx_action);
  848 
  849                 /* verify frame payloads but defer processing */
  850                 /* XXX maybe push this to method */
  851                 switch (ia->ia_category) {
  852                 case IEEE80211_ACTION_CAT_BA:
  853                         switch (ia->ia_action) {
  854                         case IEEE80211_ACTION_BA_ADDBA_REQUEST:
  855                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  856                                     sizeof(struct ieee80211_action_ba_addbarequest),
  857                                     return);
  858                                 break;
  859                         case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
  860                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  861                                     sizeof(struct ieee80211_action_ba_addbaresponse),
  862                                     return);
  863                                 break;
  864                         case IEEE80211_ACTION_BA_DELBA:
  865                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  866                                     sizeof(struct ieee80211_action_ba_delba),
  867                                     return);
  868                                 break;
  869                         }
  870                         break;
  871                 case IEEE80211_ACTION_CAT_HT:
  872                         switch (ia->ia_action) {
  873                         case IEEE80211_ACTION_HT_TXCHWIDTH:
  874                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
  875                                     sizeof(struct ieee80211_action_ht_txchwidth),
  876                                     return);
  877                                 break;
  878                         }
  879                         break;
  880                 }
  881                 ic->ic_recv_action(ni, wh, frm, efrm);
  882                 break;
  883         }
  884 
  885         case IEEE80211_FC0_SUBTYPE_AUTH:
  886         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
  887         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
  888         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
  889         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
  890         case IEEE80211_FC0_SUBTYPE_DEAUTH:
  891         case IEEE80211_FC0_SUBTYPE_DISASSOC:
  892                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  893                      wh, NULL, "%s", "not handled");
  894                 vap->iv_stats.is_rx_mgtdiscard++;
  895                 return;
  896 
  897         default:
  898                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  899                      wh, "mgt", "subtype 0x%x not handled", subtype);
  900                 vap->iv_stats.is_rx_badsubtype++;
  901                 break;
  902         }
  903 }
  904 #undef IEEE80211_VERIFY_LENGTH
  905 #undef IEEE80211_VERIFY_ELEMENT
  906 
  907 static void
  908 ahdemo_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
  909         int subtype, int rssi, int nf)
  910 {
  911         struct ieee80211vap *vap = ni->ni_vap;
  912         struct ieee80211com *ic = ni->ni_ic;
  913 
  914         /*
  915          * Process management frames when scanning; useful for doing
  916          * a site-survey.
  917          */
  918         if (ic->ic_flags & IEEE80211_F_SCAN)
  919                 adhoc_recv_mgmt(ni, m0, subtype, rssi, nf);
  920         else
  921                 vap->iv_stats.is_rx_mgtdiscard++;
  922 }
  923 
  924 static void
  925 adhoc_recv_ctl(struct ieee80211_node *ni, struct mbuf *m0, int subtype)
  926 {
  927 }

Cache object: aecbbfde5485a1354f1bc7c22b7255c2


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.