The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_adhoc.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2007-2009 Sam Leffler, Errno Consulting
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   24  */
   25 
   26 #include <sys/cdefs.h>
   27 #ifdef __FreeBSD__
   28 __FBSDID("$FreeBSD$");
   29 #endif
   30 
   31 /*
   32  * IEEE 802.11 IBSS mode support.
   33  */
   34 #include "opt_inet.h"
   35 #include "opt_wlan.h"
   36 
   37 #include <sys/param.h>
   38 #include <sys/systm.h> 
   39 #include <sys/mbuf.h>   
   40 #include <sys/malloc.h>
   41 #include <sys/kernel.h>
   42 
   43 #include <sys/socket.h>
   44 #include <sys/sockio.h>
   45 #include <sys/endian.h>
   46 #include <sys/errno.h>
   47 #include <sys/proc.h>
   48 #include <sys/sysctl.h>
   49 
   50 #include <net/if.h>
   51 #include <net/if_media.h>
   52 #include <net/if_llc.h>
   53 #include <net/ethernet.h>
   54 
   55 #include <net/bpf.h>
   56 
   57 #include <net80211/ieee80211_var.h>
   58 #include <net80211/ieee80211_adhoc.h>
   59 #include <net80211/ieee80211_input.h>
   60 #ifdef IEEE80211_SUPPORT_SUPERG
   61 #include <net80211/ieee80211_superg.h>
   62 #endif
   63 #ifdef IEEE80211_SUPPORT_TDMA
   64 #include <net80211/ieee80211_tdma.h>
   65 #endif
   66 
   67 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
   68 
   69 static  void adhoc_vattach(struct ieee80211vap *);
   70 static  int adhoc_newstate(struct ieee80211vap *, enum ieee80211_state, int);
   71 static int adhoc_input(struct ieee80211_node *, struct mbuf *, int, int);
   72 static void adhoc_recv_mgmt(struct ieee80211_node *, struct mbuf *,
   73         int subtype, int, int);
   74 static void ahdemo_recv_mgmt(struct ieee80211_node *, struct mbuf *,
   75         int subtype, int, int);
   76 static void adhoc_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
   77 
   78 void
   79 ieee80211_adhoc_attach(struct ieee80211com *ic)
   80 {
   81         ic->ic_vattach[IEEE80211_M_IBSS] = adhoc_vattach;
   82         ic->ic_vattach[IEEE80211_M_AHDEMO] = adhoc_vattach;
   83 }
   84 
   85 void
   86 ieee80211_adhoc_detach(struct ieee80211com *ic)
   87 {
   88 }
   89 
   90 static void
   91 adhoc_vdetach(struct ieee80211vap *vap)
   92 {
   93 }
   94 
   95 static void
   96 adhoc_vattach(struct ieee80211vap *vap)
   97 {
   98         vap->iv_newstate = adhoc_newstate;
   99         vap->iv_input = adhoc_input;
  100         if (vap->iv_opmode == IEEE80211_M_IBSS)
  101                 vap->iv_recv_mgmt = adhoc_recv_mgmt;
  102         else
  103                 vap->iv_recv_mgmt = ahdemo_recv_mgmt;
  104         vap->iv_recv_ctl = adhoc_recv_ctl;
  105         vap->iv_opdetach = adhoc_vdetach;
  106 #ifdef IEEE80211_SUPPORT_TDMA
  107         /*
  108          * Throw control to tdma support.  Note we do this
  109          * after setting up our callbacks so it can piggyback
  110          * on top of us.
  111          */
  112         if (vap->iv_caps & IEEE80211_C_TDMA)
  113                 ieee80211_tdma_vattach(vap);
  114 #endif
  115 }
  116 
  117 static void
  118 sta_leave(void *arg, struct ieee80211_node *ni)
  119 {
  120         struct ieee80211vap *vap = arg;
  121 
  122         if (ni->ni_vap == vap && ni != vap->iv_bss)
  123                 ieee80211_node_leave(ni);
  124 }
  125 
  126 /*
  127  * IEEE80211_M_IBSS+IEEE80211_M_AHDEMO vap state machine handler.
  128  */
  129 static int
  130 adhoc_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
  131 {
  132         struct ieee80211com *ic = vap->iv_ic;
  133         struct ieee80211_node *ni;
  134         enum ieee80211_state ostate;
  135 
  136         IEEE80211_LOCK_ASSERT(vap->iv_ic);
  137 
  138         ostate = vap->iv_state;
  139         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
  140             __func__, ieee80211_state_name[ostate],
  141             ieee80211_state_name[nstate], arg);
  142         vap->iv_state = nstate;                 /* state transition */
  143         if (ostate != IEEE80211_S_SCAN)
  144                 ieee80211_cancel_scan(vap);     /* background scan */
  145         ni = vap->iv_bss;                       /* NB: no reference held */
  146         switch (nstate) {
  147         case IEEE80211_S_INIT:
  148                 switch (ostate) {
  149                 case IEEE80211_S_SCAN:
  150                         ieee80211_cancel_scan(vap);
  151                         break;
  152                 default:
  153                         break;
  154                 }
  155                 if (ostate != IEEE80211_S_INIT) {
  156                         /* NB: optimize INIT -> INIT case */
  157                         ieee80211_reset_bss(vap);
  158                 }
  159                 break;
  160         case IEEE80211_S_SCAN:
  161                 switch (ostate) {
  162                 case IEEE80211_S_RUN:           /* beacon miss */
  163                         /* purge station table; entries are stale */
  164                         ieee80211_iterate_nodes(&ic->ic_sta, sta_leave, vap);
  165                         /* fall thru... */
  166                 case IEEE80211_S_INIT:
  167                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
  168                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
  169                                 /*
  170                                  * Already have a channel; bypass the
  171                                  * scan and startup immediately.
  172                                  */
  173                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
  174                                 break;
  175                         }
  176                         /*
  177                          * Initiate a scan.  We can come here as a result
  178                          * of an IEEE80211_IOC_SCAN_REQ too in which case
  179                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
  180                          * and the scan request parameters will be present
  181                          * in iv_scanreq.  Otherwise we do the default.
  182                          */
  183                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
  184                                 ieee80211_check_scan(vap,
  185                                     vap->iv_scanreq_flags,
  186                                     vap->iv_scanreq_duration,
  187                                     vap->iv_scanreq_mindwell,
  188                                     vap->iv_scanreq_maxdwell,
  189                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
  190                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
  191                         } else
  192                                 ieee80211_check_scan_current(vap);
  193                         break;
  194                 case IEEE80211_S_SCAN:
  195                         /*
  196                          * This can happen because of a change in state
  197                          * that requires a reset.  Trigger a new scan
  198                          * unless we're in manual roaming mode in which
  199                          * case an application must issue an explicit request.
  200                          */
  201                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  202                                 ieee80211_check_scan_current(vap);
  203                         break;
  204                 default:
  205                         goto invalid;
  206                 }
  207                 break;
  208         case IEEE80211_S_RUN:
  209                 if (vap->iv_flags & IEEE80211_F_WPA) {
  210                         /* XXX validate prerequisites */
  211                 }
  212                 switch (ostate) {
  213                 case IEEE80211_S_SCAN:
  214 #ifdef IEEE80211_DEBUG
  215                         if (ieee80211_msg_debug(vap)) {
  216                                 ieee80211_note(vap,
  217                                     "synchronized with %s ssid ",
  218                                     ether_sprintf(ni->ni_bssid));
  219                                 ieee80211_print_essid(vap->iv_bss->ni_essid,
  220                                     ni->ni_esslen);
  221                                 /* XXX MCS/HT */
  222                                 printf(" channel %d start %uMb\n",
  223                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
  224                                     IEEE80211_RATE2MBS(ni->ni_txrate));
  225                         }
  226 #endif
  227                         break;
  228                 default:
  229                         goto invalid;
  230                 }
  231                 /*
  232                  * When 802.1x is not in use mark the port authorized
  233                  * at this point so traffic can flow.
  234                  */
  235                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
  236                         ieee80211_node_authorize(ni);
  237                 /*
  238                  * Fake association when joining an existing bss.
  239                  */
  240                 if (!IEEE80211_ADDR_EQ(ni->ni_macaddr, vap->iv_myaddr) &&
  241                     ic->ic_newassoc != NULL)
  242                         ic->ic_newassoc(ni, ostate != IEEE80211_S_RUN);
  243                 break;
  244         case IEEE80211_S_SLEEP:
  245                 ieee80211_sta_pwrsave(vap, 0);
  246                 break;
  247         default:
  248         invalid:
  249                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
  250                     "%s: unexpected state transition %s -> %s\n", __func__,
  251                     ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
  252                 break;
  253         }
  254         return 0;
  255 }
  256 
  257 /*
  258  * Decide if a received management frame should be
  259  * printed when debugging is enabled.  This filters some
  260  * of the less interesting frames that come frequently
  261  * (e.g. beacons).
  262  */
  263 static __inline int
  264 doprint(struct ieee80211vap *vap, int subtype)
  265 {
  266         switch (subtype) {
  267         case IEEE80211_FC0_SUBTYPE_BEACON:
  268                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
  269         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  270                 return 1;
  271         }
  272         return 1;
  273 }
  274 
  275 /*
  276  * Process a received frame.  The node associated with the sender
  277  * should be supplied.  If nothing was found in the node table then
  278  * the caller is assumed to supply a reference to iv_bss instead.
  279  * The RSSI and a timestamp are also supplied.  The RSSI data is used
  280  * during AP scanning to select a AP to associate with; it can have
  281  * any units so long as values have consistent units and higher values
  282  * mean ``better signal''.  The receive timestamp is currently not used
  283  * by the 802.11 layer.
  284  */
  285 static int
  286 adhoc_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
  287 {
  288 #define HAS_SEQ(type)   ((type & 0x4) == 0)
  289         struct ieee80211vap *vap = ni->ni_vap;
  290         struct ieee80211com *ic = ni->ni_ic;
  291         struct ifnet *ifp = vap->iv_ifp;
  292         struct ieee80211_frame *wh;
  293         struct ieee80211_key *key;
  294         struct ether_header *eh;
  295         int hdrspace, need_tap = 1;     /* mbuf need to be tapped. */   
  296         uint8_t dir, type, subtype, qos;
  297         uint8_t *bssid;
  298         uint16_t rxseq;
  299 
  300         if (m->m_flags & M_AMPDU_MPDU) {
  301                 /*
  302                  * Fastpath for A-MPDU reorder q resubmission.  Frames
  303                  * w/ M_AMPDU_MPDU marked have already passed through
  304                  * here but were received out of order and been held on
  305                  * the reorder queue.  When resubmitted they are marked
  306                  * with the M_AMPDU_MPDU flag and we can bypass most of
  307                  * the normal processing.
  308                  */
  309                 wh = mtod(m, struct ieee80211_frame *);
  310                 type = IEEE80211_FC0_TYPE_DATA;
  311                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  312                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
  313                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
  314                 goto resubmit_ampdu;
  315         }
  316 
  317         KASSERT(ni != NULL, ("null node"));
  318         ni->ni_inact = ni->ni_inact_reload;
  319 
  320         type = -1;                      /* undefined */
  321 
  322         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
  323                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  324                     ni->ni_macaddr, NULL,
  325                     "too short (1): len %u", m->m_pkthdr.len);
  326                 vap->iv_stats.is_rx_tooshort++;
  327                 goto out;
  328         }
  329         /*
  330          * Bit of a cheat here, we use a pointer for a 3-address
  331          * frame format but don't reference fields past outside
  332          * ieee80211_frame_min w/o first validating the data is
  333          * present.
  334          */
  335         wh = mtod(m, struct ieee80211_frame *);
  336 
  337         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
  338             IEEE80211_FC0_VERSION_0) {
  339                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  340                     ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
  341                     wh->i_fc[0], wh->i_fc[1]);
  342                 vap->iv_stats.is_rx_badversion++;
  343                 goto err;
  344         }
  345 
  346         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  347         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
  348         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
  349         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
  350                 if (dir != IEEE80211_FC1_DIR_NODS)
  351                         bssid = wh->i_addr1;
  352                 else if (type == IEEE80211_FC0_TYPE_CTL)
  353                         bssid = wh->i_addr1;
  354                 else {
  355                         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  356                                 IEEE80211_DISCARD_MAC(vap,
  357                                     IEEE80211_MSG_ANY, ni->ni_macaddr,
  358                                     NULL, "too short (2): len %u",
  359                                     m->m_pkthdr.len);
  360                                 vap->iv_stats.is_rx_tooshort++;
  361                                 goto out;
  362                         }
  363                         bssid = wh->i_addr3;
  364                 }
  365                 /*
  366                  * Validate the bssid.
  367                  */
  368                 if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
  369                     !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
  370                         /* not interested in */
  371                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  372                             bssid, NULL, "%s", "not to bss");
  373                         vap->iv_stats.is_rx_wrongbss++;
  374                         goto out;
  375                 }
  376                 /*
  377                  * Data frame, cons up a node when it doesn't
  378                  * exist. This should probably done after an ACL check.
  379                  */
  380                 if (type == IEEE80211_FC0_TYPE_DATA &&
  381                     ni == vap->iv_bss &&
  382                     !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
  383                         /*
  384                          * Beware of frames that come in too early; we
  385                          * can receive broadcast frames and creating sta
  386                          * entries will blow up because there is no bss
  387                          * channel yet.
  388                          */
  389                         if (vap->iv_state != IEEE80211_S_RUN) {
  390                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  391                                     wh, "data", "not in RUN state (%s)",
  392                                     ieee80211_state_name[vap->iv_state]);
  393                                 vap->iv_stats.is_rx_badstate++;
  394                                 goto err;
  395                         }
  396                         /*
  397                          * Fake up a node for this newly
  398                          * discovered member of the IBSS.
  399                          */
  400                         ni = ieee80211_fakeup_adhoc_node(vap, wh->i_addr2);
  401                         if (ni == NULL) {
  402                                 /* NB: stat kept for alloc failure */
  403                                 goto err;
  404                         }
  405                 }
  406                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
  407                 ni->ni_noise = nf;
  408                 if (HAS_SEQ(type)) {
  409                         uint8_t tid = ieee80211_gettid(wh);
  410                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
  411                             TID_TO_WME_AC(tid) >= WME_AC_VI)
  412                                 ic->ic_wme.wme_hipri_traffic++;
  413                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
  414                         if (! ieee80211_check_rxseq(ni, wh)) {
  415                                 /* duplicate, discard */
  416                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  417                                     bssid, "duplicate",
  418                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
  419                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
  420                                     ni->ni_rxseqs[tid] >>
  421                                         IEEE80211_SEQ_SEQ_SHIFT,
  422                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
  423                                     ni->ni_rxseqs[tid] &
  424                                         IEEE80211_SEQ_FRAG_MASK,
  425                                     tid);
  426                                 vap->iv_stats.is_rx_dup++;
  427                                 IEEE80211_NODE_STAT(ni, rx_dup);
  428                                 goto out;
  429                         }
  430                         ni->ni_rxseqs[tid] = rxseq;
  431                 }
  432         }
  433 
  434         switch (type) {
  435         case IEEE80211_FC0_TYPE_DATA:
  436                 hdrspace = ieee80211_hdrspace(ic, wh);
  437                 if (m->m_len < hdrspace &&
  438                     (m = m_pullup(m, hdrspace)) == NULL) {
  439                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  440                             ni->ni_macaddr, NULL,
  441                             "data too short: expecting %u", hdrspace);
  442                         vap->iv_stats.is_rx_tooshort++;
  443                         goto out;               /* XXX */
  444                 }
  445                 if (dir != IEEE80211_FC1_DIR_NODS) {
  446                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  447                             wh, "data", "incorrect dir 0x%x", dir);
  448                         vap->iv_stats.is_rx_wrongdir++;
  449                         goto out;
  450                 }
  451                 /* XXX no power-save support */
  452 
  453                 /*
  454                  * Handle A-MPDU re-ordering.  If the frame is to be
  455                  * processed directly then ieee80211_ampdu_reorder
  456                  * will return 0; otherwise it has consumed the mbuf
  457                  * and we should do nothing more with it.
  458                  */
  459                 if ((m->m_flags & M_AMPDU) &&
  460                     ieee80211_ampdu_reorder(ni, m) != 0) {
  461                         m = NULL;
  462                         goto out;
  463                 }
  464         resubmit_ampdu:
  465 
  466                 /*
  467                  * Handle privacy requirements.  Note that we
  468                  * must not be preempted from here until after
  469                  * we (potentially) call ieee80211_crypto_demic;
  470                  * otherwise we may violate assumptions in the
  471                  * crypto cipher modules used to do delayed update
  472                  * of replay sequence numbers.
  473                  */
  474                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
  475                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
  476                                 /*
  477                                  * Discard encrypted frames when privacy is off.
  478                                  */
  479                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  480                                     wh, "WEP", "%s", "PRIVACY off");
  481                                 vap->iv_stats.is_rx_noprivacy++;
  482                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
  483                                 goto out;
  484                         }
  485                         key = ieee80211_crypto_decap(ni, m, hdrspace);
  486                         if (key == NULL) {
  487                                 /* NB: stats+msgs handled in crypto_decap */
  488                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
  489                                 goto out;
  490                         }
  491                         wh = mtod(m, struct ieee80211_frame *);
  492                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
  493                 } else {
  494                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
  495                         key = NULL;
  496                 }
  497 
  498                 /*
  499                  * Save QoS bits for use below--before we strip the header.
  500                  */
  501                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
  502                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
  503                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
  504                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
  505                 } else
  506                         qos = 0;
  507 
  508                 /*
  509                  * Next up, any fragmentation.
  510                  */
  511                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  512                         m = ieee80211_defrag(ni, m, hdrspace);
  513                         if (m == NULL) {
  514                                 /* Fragment dropped or frame not complete yet */
  515                                 goto out;
  516                         }
  517                 }
  518                 wh = NULL;              /* no longer valid, catch any uses */
  519 
  520                 /*
  521                  * Next strip any MSDU crypto bits.
  522                  */
  523                 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
  524                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  525                             ni->ni_macaddr, "data", "%s", "demic error");
  526                         vap->iv_stats.is_rx_demicfail++;
  527                         IEEE80211_NODE_STAT(ni, rx_demicfail);
  528                         goto out;
  529                 }
  530 
  531                 /* copy to listener after decrypt */
  532                 if (ieee80211_radiotap_active_vap(vap))
  533                         ieee80211_radiotap_rx(vap, m);
  534                 need_tap = 0;
  535 
  536                 /*
  537                  * Finally, strip the 802.11 header.
  538                  */
  539                 m = ieee80211_decap(vap, m, hdrspace);
  540                 if (m == NULL) {
  541                         /* XXX mask bit to check for both */
  542                         /* don't count Null data frames as errors */
  543                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
  544                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
  545                                 goto out;
  546                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  547                             ni->ni_macaddr, "data", "%s", "decap error");
  548                         vap->iv_stats.is_rx_decap++;
  549                         IEEE80211_NODE_STAT(ni, rx_decap);
  550                         goto err;
  551                 }
  552                 eh = mtod(m, struct ether_header *);
  553                 if (!ieee80211_node_is_authorized(ni)) {
  554                         /*
  555                          * Deny any non-PAE frames received prior to
  556                          * authorization.  For open/shared-key
  557                          * authentication the port is mark authorized
  558                          * after authentication completes.  For 802.1x
  559                          * the port is not marked authorized by the
  560                          * authenticator until the handshake has completed.
  561                          */
  562                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
  563                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  564                                     eh->ether_shost, "data",
  565                                     "unauthorized port: ether type 0x%x len %u",
  566                                     eh->ether_type, m->m_pkthdr.len);
  567                                 vap->iv_stats.is_rx_unauth++;
  568                                 IEEE80211_NODE_STAT(ni, rx_unauth);
  569                                 goto err;
  570                         }
  571                 } else {
  572                         /*
  573                          * When denying unencrypted frames, discard
  574                          * any non-PAE frames received without encryption.
  575                          */
  576                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
  577                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
  578                             eh->ether_type != htons(ETHERTYPE_PAE)) {
  579                                 /*
  580                                  * Drop unencrypted frames.
  581                                  */
  582                                 vap->iv_stats.is_rx_unencrypted++;
  583                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
  584                                 goto out;
  585                         }
  586                 }
  587                 /* XXX require HT? */
  588                 if (qos & IEEE80211_QOS_AMSDU) {
  589                         m = ieee80211_decap_amsdu(ni, m);
  590                         if (m == NULL)
  591                                 return IEEE80211_FC0_TYPE_DATA;
  592                 } else {
  593 #ifdef IEEE80211_SUPPORT_SUPERG
  594                         m = ieee80211_decap_fastframe(vap, ni, m);
  595                         if (m == NULL)
  596                                 return IEEE80211_FC0_TYPE_DATA;
  597 #endif
  598                 }
  599                 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
  600                         ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
  601                 else
  602                         ieee80211_deliver_data(vap, ni, m);
  603                 return IEEE80211_FC0_TYPE_DATA;
  604 
  605         case IEEE80211_FC0_TYPE_MGT:
  606                 vap->iv_stats.is_rx_mgmt++;
  607                 IEEE80211_NODE_STAT(ni, rx_mgmt);
  608                 if (dir != IEEE80211_FC1_DIR_NODS) {
  609                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  610                             wh, "data", "incorrect dir 0x%x", dir);
  611                         vap->iv_stats.is_rx_wrongdir++;
  612                         goto err;
  613                 }
  614                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  615                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  616                             ni->ni_macaddr, "mgt", "too short: len %u",
  617                             m->m_pkthdr.len);
  618                         vap->iv_stats.is_rx_tooshort++;
  619                         goto out;
  620                 }
  621 #ifdef IEEE80211_DEBUG
  622                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
  623                     ieee80211_msg_dumppkts(vap)) {
  624                         if_printf(ifp, "received %s from %s rssi %d\n",
  625                             ieee80211_mgt_subtype_name[subtype >>
  626                                 IEEE80211_FC0_SUBTYPE_SHIFT],
  627                             ether_sprintf(wh->i_addr2), rssi);
  628                 }
  629 #endif
  630                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
  631                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  632                             wh, NULL, "%s", "WEP set but not permitted");
  633                         vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
  634                         goto out;
  635                 }
  636                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
  637                 goto out;
  638 
  639         case IEEE80211_FC0_TYPE_CTL:
  640                 vap->iv_stats.is_rx_ctl++;
  641                 IEEE80211_NODE_STAT(ni, rx_ctrl);
  642                 vap->iv_recv_ctl(ni, m, subtype);
  643                 goto out;
  644 
  645         default:
  646                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  647                     wh, "bad", "frame type 0x%x", type);
  648                 /* should not come here */
  649                 break;
  650         }
  651 err:
  652         ifp->if_ierrors++;
  653 out:
  654         if (m != NULL) {
  655                 if (need_tap && ieee80211_radiotap_active_vap(vap))
  656                         ieee80211_radiotap_rx(vap, m);
  657                 m_freem(m);
  658         }
  659         return type;
  660 }
  661 
  662 static int
  663 is11bclient(const uint8_t *rates, const uint8_t *xrates)
  664 {
  665         static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
  666         int i;
  667 
  668         /* NB: the 11b clients we care about will not have xrates */
  669         if (xrates != NULL || rates == NULL)
  670                 return 0;
  671         for (i = 0; i < rates[1]; i++) {
  672                 int r = rates[2+i] & IEEE80211_RATE_VAL;
  673                 if (r > 2*11 || ((1<<r) & brates) == 0)
  674                         return 0;
  675         }
  676         return 1;
  677 }
  678 
  679 static void
  680 adhoc_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
  681         int subtype, int rssi, int nf)
  682 {
  683         struct ieee80211vap *vap = ni->ni_vap;
  684         struct ieee80211com *ic = ni->ni_ic;
  685         struct ieee80211_frame *wh;
  686         uint8_t *frm, *efrm, *sfrm;
  687         uint8_t *ssid, *rates, *xrates;
  688 
  689         wh = mtod(m0, struct ieee80211_frame *);
  690         frm = (uint8_t *)&wh[1];
  691         efrm = mtod(m0, uint8_t *) + m0->m_len;
  692         switch (subtype) {
  693         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
  694         case IEEE80211_FC0_SUBTYPE_BEACON: {
  695                 struct ieee80211_scanparams scan;
  696                 /*
  697                  * We process beacon/probe response
  698                  * frames to discover neighbors.
  699                  */ 
  700                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
  701                         return;
  702                 /*
  703                  * Count frame now that we know it's to be processed.
  704                  */
  705                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
  706                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
  707                         IEEE80211_NODE_STAT(ni, rx_beacons);
  708                 } else
  709                         IEEE80211_NODE_STAT(ni, rx_proberesp);
  710                 /*
  711                  * If scanning, just pass information to the scan module.
  712                  */
  713                 if (ic->ic_flags & IEEE80211_F_SCAN) {
  714                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
  715                                 /*
  716                                  * Actively scanning a channel marked passive;
  717                                  * send a probe request now that we know there
  718                                  * is 802.11 traffic present.
  719                                  *
  720                                  * XXX check if the beacon we recv'd gives
  721                                  * us what we need and suppress the probe req
  722                                  */
  723                                 ieee80211_probe_curchan(vap, 1);
  724                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
  725                         }
  726                         ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
  727                         return;
  728                 }
  729                 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
  730                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
  731                                 /*
  732                                  * Create a new entry in the neighbor table.
  733                                  */
  734                                 ni = ieee80211_add_neighbor(vap, wh, &scan);
  735                         } else if (ni->ni_capinfo == 0) {
  736                                 /*
  737                                  * Update faked node created on transmit.
  738                                  * Note this also updates the tsf.
  739                                  */
  740                                 ieee80211_init_neighbor(ni, wh, &scan);
  741                         } else {
  742                                 /*
  743                                  * Record tsf for potential resync.
  744                                  */
  745                                 memcpy(ni->ni_tstamp.data, scan.tstamp,
  746                                         sizeof(ni->ni_tstamp));
  747                         }
  748                         if (ni != NULL) {
  749                                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
  750                                 ni->ni_noise = nf;
  751                         }
  752                 }
  753                 break;
  754         }
  755 
  756         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  757                 if (vap->iv_state != IEEE80211_S_RUN) {
  758                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  759                             wh, NULL, "wrong state %s",
  760                             ieee80211_state_name[vap->iv_state]);
  761                         vap->iv_stats.is_rx_mgtdiscard++;
  762                         return;
  763                 }
  764                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
  765                         /* frame must be directed */
  766                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  767                             wh, NULL, "%s", "not unicast");
  768                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
  769                         return;
  770                 }
  771 
  772                 /*
  773                  * prreq frame format
  774                  *      [tlv] ssid
  775                  *      [tlv] supported rates
  776                  *      [tlv] extended supported rates
  777                  */
  778                 ssid = rates = xrates = NULL;
  779                 sfrm = frm;
  780                 while (efrm - frm > 1) {
  781                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
  782                         switch (*frm) {
  783                         case IEEE80211_ELEMID_SSID:
  784                                 ssid = frm;
  785                                 break;
  786                         case IEEE80211_ELEMID_RATES:
  787                                 rates = frm;
  788                                 break;
  789                         case IEEE80211_ELEMID_XRATES:
  790                                 xrates = frm;
  791                                 break;
  792                         }
  793                         frm += frm[1] + 2;
  794                 }
  795                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
  796                 if (xrates != NULL)
  797                         IEEE80211_VERIFY_ELEMENT(xrates,
  798                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
  799                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
  800                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
  801                 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
  802                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  803                             wh, NULL,
  804                             "%s", "no ssid with ssid suppression enabled");
  805                         vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
  806                         return;
  807                 }
  808 
  809                 /* XXX find a better class or define it's own */
  810                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
  811                     "%s", "recv probe req");
  812                 /*
  813                  * Some legacy 11b clients cannot hack a complete
  814                  * probe response frame.  When the request includes
  815                  * only a bare-bones rate set, communicate this to
  816                  * the transmit side.
  817                  */
  818                 ieee80211_send_proberesp(vap, wh->i_addr2,
  819                     is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
  820                 break;
  821 
  822         case IEEE80211_FC0_SUBTYPE_ACTION:
  823         case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
  824                 if (ni == vap->iv_bss) {
  825                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  826                             wh, NULL, "%s", "unknown node");
  827                         vap->iv_stats.is_rx_mgtdiscard++;
  828                 } else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
  829                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  830                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  831                             wh, NULL, "%s", "not for us");
  832                         vap->iv_stats.is_rx_mgtdiscard++;
  833                 } else if (vap->iv_state != IEEE80211_S_RUN) {
  834                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  835                             wh, NULL, "wrong state %s",
  836                             ieee80211_state_name[vap->iv_state]);
  837                         vap->iv_stats.is_rx_mgtdiscard++;
  838                 } else {
  839                         if (ieee80211_parse_action(ni, m0) == 0)
  840                                 (void)ic->ic_recv_action(ni, wh, frm, efrm);
  841                 }
  842                 break;
  843 
  844         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
  845         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
  846         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
  847         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
  848         case IEEE80211_FC0_SUBTYPE_ATIM:
  849         case IEEE80211_FC0_SUBTYPE_DISASSOC:
  850         case IEEE80211_FC0_SUBTYPE_AUTH:
  851         case IEEE80211_FC0_SUBTYPE_DEAUTH:
  852                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  853                     wh, NULL, "%s", "not handled");
  854                 vap->iv_stats.is_rx_mgtdiscard++;
  855                 break;
  856 
  857         default:
  858                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  859                     wh, "mgt", "subtype 0x%x not handled", subtype);
  860                 vap->iv_stats.is_rx_badsubtype++;
  861                 break;
  862         }
  863 }
  864 #undef IEEE80211_VERIFY_LENGTH
  865 #undef IEEE80211_VERIFY_ELEMENT
  866 
  867 static void
  868 ahdemo_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
  869         int subtype, int rssi, int nf)
  870 {
  871         struct ieee80211vap *vap = ni->ni_vap;
  872         struct ieee80211com *ic = ni->ni_ic;
  873         struct ieee80211_frame *wh;
  874 
  875         /*
  876          * Process management frames when scanning; useful for doing
  877          * a site-survey.
  878          */
  879         if (ic->ic_flags & IEEE80211_F_SCAN)
  880                 adhoc_recv_mgmt(ni, m0, subtype, rssi, nf);
  881         else {
  882                 wh = mtod(m0, struct ieee80211_frame *);
  883                 switch (subtype) {
  884                 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
  885                 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
  886                 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
  887                 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
  888                 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  889                 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
  890                 case IEEE80211_FC0_SUBTYPE_BEACON:
  891                 case IEEE80211_FC0_SUBTYPE_ATIM:
  892                 case IEEE80211_FC0_SUBTYPE_DISASSOC:
  893                 case IEEE80211_FC0_SUBTYPE_AUTH:
  894                 case IEEE80211_FC0_SUBTYPE_DEAUTH:
  895                 case IEEE80211_FC0_SUBTYPE_ACTION:
  896                 case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
  897                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  898                              wh, NULL, "%s", "not handled");
  899                         vap->iv_stats.is_rx_mgtdiscard++;
  900                         break;
  901                 default:
  902                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  903                              wh, "mgt", "subtype 0x%x not handled", subtype);
  904                         vap->iv_stats.is_rx_badsubtype++;
  905                         break;
  906                 }
  907         }
  908 }
  909 
  910 static void
  911 adhoc_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
  912 {
  913 
  914         switch (subtype) {
  915         case IEEE80211_FC0_SUBTYPE_BAR:
  916                 ieee80211_recv_bar(ni, m);
  917                 break;
  918         }
  919 }

Cache object: 058ce978046018a7cf239d3971573d6b


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.