The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_input.c

Version: -  FREEBSD  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-2  -  FREEBSD-11-1  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-4  -  FREEBSD-10-3  -  FREEBSD-10-2  -  FREEBSD-10-1  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-3  -  FREEBSD-9-2  -  FREEBSD-9-1  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-4  -  FREEBSD-8-3  -  FREEBSD-8-2  -  FREEBSD-8-1  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-4  -  FREEBSD-7-3  -  FREEBSD-7-2  -  FREEBSD-7-1  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-4  -  FREEBSD-6-3  -  FREEBSD-6-2  -  FREEBSD-6-1  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-5  -  FREEBSD-5-4  -  FREEBSD-5-3  -  FREEBSD-5-2  -  FREEBSD-5-1  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  linux-2.6  -  linux-2.4.22  -  MK83  -  MK84  -  PLAN9  -  DFBSD  -  NETBSD  -  NETBSD5  -  NETBSD4  -  NETBSD3  -  NETBSD20  -  OPENBSD  -  xnu-517  -  xnu-792  -  xnu-792.6.70  -  xnu-1228  -  xnu-1456.1.26  -  xnu-1699.24.8  -  xnu-2050.18.24  -  OPENSOLARIS  -  minix-3-1-1 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2001 Atsushi Onoe
    3  * Copyright (c) 2002-2007 Sam Leffler, Errno Consulting
    4  * All rights reserved.
    5  *
    6  * Redistribution and use in source and binary forms, with or without
    7  * modification, are permitted provided that the following conditions
    8  * are met:
    9  * 1. Redistributions of source code must retain the above copyright
   10  *    notice, this list of conditions and the following disclaimer.
   11  * 2. Redistributions in binary form must reproduce the above copyright
   12  *    notice, this list of conditions and the following disclaimer in the
   13  *    documentation and/or other materials provided with the distribution.
   14  *
   15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   25  */
   26 
   27 #include <sys/cdefs.h>
   28 __FBSDID("$FreeBSD$");
   29 
   30 #include <sys/param.h>
   31 #include <sys/systm.h>
   32 #include <sys/mbuf.h>   
   33 #include <sys/malloc.h>
   34 #include <sys/endian.h>
   35 #include <sys/kernel.h>
   36  
   37 #include <sys/socket.h>
   38 
   39 #include <net/if.h>
   40 #include <net/if_media.h>
   41 #include <net/ethernet.h>
   42 #include <net/if_llc.h>
   43 #include <net/if_vlan_var.h>
   44 
   45 #include <net80211/ieee80211_var.h>
   46 #include <net80211/ieee80211_input.h>
   47 
   48 #include <net/bpf.h>
   49 
   50 #ifdef IEEE80211_DEBUG
   51 #include <machine/stdarg.h>
   52 
   53 /*
   54  * Decide if a received management frame should be
   55  * printed when debugging is enabled.  This filters some
   56  * of the less interesting frames that come frequently
   57  * (e.g. beacons).
   58  */
   59 static __inline int
   60 doprint(struct ieee80211com *ic, int subtype)
   61 {
   62         switch (subtype) {
   63         case IEEE80211_FC0_SUBTYPE_BEACON:
   64                 return (ic->ic_flags & IEEE80211_F_SCAN);
   65         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
   66                 return (ic->ic_opmode == IEEE80211_M_IBSS);
   67         }
   68         return 1;
   69 }
   70 
   71 static const uint8_t *ieee80211_getbssid(struct ieee80211com *,
   72         const struct ieee80211_frame *);
   73 #endif /* IEEE80211_DEBUG */
   74 
   75 static struct mbuf *ieee80211_defrag(struct ieee80211com *,
   76         struct ieee80211_node *, struct mbuf *, int);
   77 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int);
   78 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *,
   79                 const uint8_t *mac, int subtype, int arg);
   80 static struct mbuf *ieee80211_decap_fastframe(struct ieee80211com *,
   81         struct ieee80211_node *, struct mbuf *);
   82 static void ieee80211_recv_pspoll(struct ieee80211com *,
   83         struct ieee80211_node *, struct mbuf *);
   84 
   85 /*
   86  * Process a received frame.  The node associated with the sender
   87  * should be supplied.  If nothing was found in the node table then
   88  * the caller is assumed to supply a reference to ic_bss instead.
   89  * The RSSI and a timestamp are also supplied.  The RSSI data is used
   90  * during AP scanning to select a AP to associate with; it can have
   91  * any units so long as values have consistent units and higher values
   92  * mean ``better signal''.  The receive timestamp is currently not used
   93  * by the 802.11 layer.
   94  */
   95 int
   96 ieee80211_input(struct ieee80211com *ic, struct mbuf *m,
   97         struct ieee80211_node *ni, int rssi, int noise, uint32_t rstamp)
   98 {
   99 #define SEQ_LEQ(a,b)    ((int)((a)-(b)) <= 0)
  100 #define HAS_SEQ(type)   ((type & 0x4) == 0)
  101         struct ifnet *ifp = ic->ic_ifp;
  102         struct ieee80211_frame *wh;
  103         struct ieee80211_key *key;
  104         struct ether_header *eh;
  105         int hdrspace, need_tap;
  106         uint8_t dir, type, subtype, qos;
  107         uint8_t *bssid;
  108         uint16_t rxseq;
  109 
  110         if (m->m_flags & M_AMPDU) {
  111                 /*
  112                  * Fastpath for A-MPDU reorder q resubmission.  Frames
  113                  * w/ M_AMPDU marked have already passed through here
  114                  * but were received out of order and been held on the
  115                  * reorder queue.  When resubmitted they are marked
  116                  * with the M_AMPDU flag and we can bypass most of the
  117                  * normal processing.
  118                  */
  119                 wh = mtod(m, struct ieee80211_frame *);
  120                 type = IEEE80211_FC0_TYPE_DATA;
  121                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  122                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
  123                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
  124                 need_tap = 0;
  125                 goto resubmit_ampdu;
  126         }
  127 
  128         KASSERT(ni != NULL, ("null node"));
  129         ni->ni_inact = ni->ni_inact_reload;
  130 
  131         need_tap = 1;                   /* mbuf need to be tapped. */
  132         type = -1;                      /* undefined */
  133         /*
  134          * In monitor mode, send everything directly to bpf.
  135          * XXX may want to include the CRC
  136          */
  137         if (ic->ic_opmode == IEEE80211_M_MONITOR)
  138                 goto out;
  139 
  140         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
  141                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  142                     ni->ni_macaddr, NULL,
  143                     "too short (1): len %u", m->m_pkthdr.len);
  144                 ic->ic_stats.is_rx_tooshort++;
  145                 goto out;
  146         }
  147         /*
  148          * Bit of a cheat here, we use a pointer for a 3-address
  149          * frame format but don't reference fields past outside
  150          * ieee80211_frame_min w/o first validating the data is
  151          * present.
  152          */
  153         wh = mtod(m, struct ieee80211_frame *);
  154 
  155         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
  156             IEEE80211_FC0_VERSION_0) {
  157                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  158                     ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
  159                 ic->ic_stats.is_rx_badversion++;
  160                 goto err;
  161         }
  162 
  163         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  164         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
  165         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
  166         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
  167                 switch (ic->ic_opmode) {
  168                 case IEEE80211_M_STA:
  169                         bssid = wh->i_addr2;
  170                         if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
  171                                 /* not interested in */
  172                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
  173                                     bssid, NULL, "%s", "not to bss");
  174                                 ic->ic_stats.is_rx_wrongbss++;
  175                                 goto out;
  176                         }
  177                         break;
  178                 case IEEE80211_M_IBSS:
  179                 case IEEE80211_M_AHDEMO:
  180                 case IEEE80211_M_HOSTAP:
  181                         if (dir != IEEE80211_FC1_DIR_NODS)
  182                                 bssid = wh->i_addr1;
  183                         else if (type == IEEE80211_FC0_TYPE_CTL)
  184                                 bssid = wh->i_addr1;
  185                         else {
  186                                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  187                                         IEEE80211_DISCARD_MAC(ic,
  188                                             IEEE80211_MSG_ANY, ni->ni_macaddr,
  189                                             NULL, "too short (2): len %u",
  190                                             m->m_pkthdr.len);
  191                                         ic->ic_stats.is_rx_tooshort++;
  192                                         goto out;
  193                                 }
  194                                 bssid = wh->i_addr3;
  195                         }
  196                         if (type != IEEE80211_FC0_TYPE_DATA)
  197                                 break;
  198                         /*
  199                          * Data frame, validate the bssid.
  200                          */
  201                         if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) &&
  202                             !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
  203                                 /* not interested in */
  204                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
  205                                     bssid, NULL, "%s", "not to bss");
  206                                 ic->ic_stats.is_rx_wrongbss++;
  207                                 goto out;
  208                         }
  209                         /*
  210                          * For adhoc mode we cons up a node when it doesn't
  211                          * exist. This should probably done after an ACL check.
  212                          */
  213                         if (ni == ic->ic_bss &&
  214                             ic->ic_opmode != IEEE80211_M_HOSTAP &&
  215                             !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
  216                                 /*
  217                                  * Fake up a node for this newly
  218                                  * discovered member of the IBSS.
  219                                  */
  220                                 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
  221                                                     wh->i_addr2);
  222                                 if (ni == NULL) {
  223                                         /* NB: stat kept for alloc failure */
  224                                         goto err;
  225                                 }
  226                         }
  227                         break;
  228                 default:
  229                         goto out;
  230                 }
  231                 ni->ni_rssi = rssi;
  232                 ni->ni_noise = noise;
  233                 ni->ni_rstamp = rstamp;
  234                 if (HAS_SEQ(type)) {
  235                         uint8_t tid;
  236                         if (IEEE80211_QOS_HAS_SEQ(wh)) {
  237                                 tid = ((struct ieee80211_qosframe *)wh)->
  238                                         i_qos[0] & IEEE80211_QOS_TID;
  239                                 if (TID_TO_WME_AC(tid) >= WME_AC_VI)
  240                                         ic->ic_wme.wme_hipri_traffic++;
  241                                 tid++;
  242                         } else
  243                                 tid = IEEE80211_NONQOS_TID;
  244                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
  245                         if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
  246                             (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
  247                             SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
  248                                 /* duplicate, discard */
  249                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
  250                                     bssid, "duplicate",
  251                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
  252                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
  253                                     ni->ni_rxseqs[tid] >>
  254                                         IEEE80211_SEQ_SEQ_SHIFT,
  255                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
  256                                     ni->ni_rxseqs[tid] &
  257                                         IEEE80211_SEQ_FRAG_MASK,
  258                                     tid);
  259                                 ic->ic_stats.is_rx_dup++;
  260                                 IEEE80211_NODE_STAT(ni, rx_dup);
  261                                 goto out;
  262                         }
  263                         ni->ni_rxseqs[tid] = rxseq;
  264                 }
  265         }
  266 
  267         switch (type) {
  268         case IEEE80211_FC0_TYPE_DATA:
  269                 hdrspace = ieee80211_hdrspace(ic, wh);
  270                 if (m->m_len < hdrspace &&
  271                     (m = m_pullup(m, hdrspace)) == NULL) {
  272                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  273                             ni->ni_macaddr, NULL,
  274                             "data too short: expecting %u", hdrspace);
  275                         ic->ic_stats.is_rx_tooshort++;
  276                         goto out;               /* XXX */
  277                 }
  278                 switch (ic->ic_opmode) {
  279                 case IEEE80211_M_STA:
  280                         if (dir != IEEE80211_FC1_DIR_FROMDS) {
  281                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  282                                     wh, "data", "unknown dir 0x%x", dir);
  283                                 ic->ic_stats.is_rx_wrongdir++;
  284                                 goto out;
  285                         }
  286                         if ((ifp->if_flags & IFF_SIMPLEX) &&
  287                             IEEE80211_IS_MULTICAST(wh->i_addr1) &&
  288                             IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) {
  289                                 /*
  290                                  * In IEEE802.11 network, multicast packet
  291                                  * sent from me is broadcasted from AP.
  292                                  * It should be silently discarded for
  293                                  * SIMPLEX interface.
  294                                  */
  295                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  296                                     wh, NULL, "%s", "multicast echo");
  297                                 ic->ic_stats.is_rx_mcastecho++;
  298                                 goto out;
  299                         }
  300                         break;
  301                 case IEEE80211_M_IBSS:
  302                 case IEEE80211_M_AHDEMO:
  303                         if (dir != IEEE80211_FC1_DIR_NODS) {
  304                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  305                                     wh, "data", "unknown dir 0x%x", dir);
  306                                 ic->ic_stats.is_rx_wrongdir++;
  307                                 goto out;
  308                         }
  309                         /* XXX no power-save support */
  310                         break;
  311                 case IEEE80211_M_HOSTAP:
  312                         if (dir != IEEE80211_FC1_DIR_TODS) {
  313                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  314                                     wh, "data", "unknown dir 0x%x", dir);
  315                                 ic->ic_stats.is_rx_wrongdir++;
  316                                 goto out;
  317                         }
  318                         /* check if source STA is associated */
  319                         if (ni == ic->ic_bss) {
  320                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  321                                     wh, "data", "%s", "unknown src");
  322                                 ieee80211_send_error(ic, ni, wh->i_addr2,
  323                                     IEEE80211_FC0_SUBTYPE_DEAUTH,
  324                                     IEEE80211_REASON_NOT_AUTHED);
  325                                 ic->ic_stats.is_rx_notassoc++;
  326                                 goto err;
  327                         }
  328                         if (ni->ni_associd == 0) {
  329                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  330                                     wh, "data", "%s", "unassoc src");
  331                                 IEEE80211_SEND_MGMT(ic, ni,
  332                                     IEEE80211_FC0_SUBTYPE_DISASSOC,
  333                                     IEEE80211_REASON_NOT_ASSOCED);
  334                                 ic->ic_stats.is_rx_notassoc++;
  335                                 goto err;
  336                         }
  337 
  338                         /*
  339                          * Check for power save state change.
  340                          * XXX out-of-order A-MPDU frames?
  341                          */
  342                         if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
  343                             (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
  344                                 ieee80211_node_pwrsave(ni,
  345                                         wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
  346                         break;
  347                 default:
  348                         /* XXX here to keep compiler happy */
  349                         goto out;
  350                 }
  351 
  352                 /*
  353                  * Handle A-MPDU re-ordering.  The station must be
  354                  * associated and negotiated HT.  The frame must be
  355                  * a QoS frame (not QoS null data) and not previously
  356                  * processed for A-MPDU re-ordering.  If the frame is
  357                  * to be processed directly then ieee80211_ampdu_reorder
  358                  * will return 0; otherwise it has consumed the mbuf
  359                  * and we should do nothing more with it.
  360                  */
  361                 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
  362                     subtype == IEEE80211_FC0_SUBTYPE_QOS &&
  363                     ieee80211_ampdu_reorder(ni, m) != 0) {
  364                         m = NULL;
  365                         goto out;
  366                 }
  367         resubmit_ampdu:
  368 
  369                 /*
  370                  * Handle privacy requirements.  Note that we
  371                  * must not be preempted from here until after
  372                  * we (potentially) call ieee80211_crypto_demic;
  373                  * otherwise we may violate assumptions in the
  374                  * crypto cipher modules used to do delayed update
  375                  * of replay sequence numbers.
  376                  */
  377                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
  378                         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
  379                                 /*
  380                                  * Discard encrypted frames when privacy is off.
  381                                  */
  382                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  383                                     wh, "WEP", "%s", "PRIVACY off");
  384                                 ic->ic_stats.is_rx_noprivacy++;
  385                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
  386                                 goto out;
  387                         }
  388                         key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
  389                         if (key == NULL) {
  390                                 /* NB: stats+msgs handled in crypto_decap */
  391                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
  392                                 goto out;
  393                         }
  394                         wh = mtod(m, struct ieee80211_frame *);
  395                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
  396                 } else {
  397                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
  398                         key = NULL;
  399                 }
  400 
  401                 /*
  402                  * Save QoS bits for use below--before we strip the header.
  403                  */
  404                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
  405                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
  406                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
  407                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
  408                 } else
  409                         qos = 0;
  410 
  411                 /*
  412                  * Next up, any fragmentation.
  413                  */
  414                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  415                         m = ieee80211_defrag(ic, ni, m, hdrspace);
  416                         if (m == NULL) {
  417                                 /* Fragment dropped or frame not complete yet */
  418                                 goto out;
  419                         }
  420                 }
  421                 wh = NULL;              /* no longer valid, catch any uses */
  422 
  423                 /*
  424                  * Next strip any MSDU crypto bits.
  425                  */
  426                 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) {
  427                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
  428                             ni->ni_macaddr, "data", "%s", "demic error");
  429                         ic->ic_stats.is_rx_demicfail++;
  430                         IEEE80211_NODE_STAT(ni, rx_demicfail);
  431                         goto out;
  432                 }
  433 
  434                 /* copy to listener after decrypt */
  435                 if (bpf_peers_present(ic->ic_rawbpf))
  436                         bpf_mtap(ic->ic_rawbpf, m);
  437                 need_tap = 0;
  438 
  439                 /*
  440                  * Finally, strip the 802.11 header.
  441                  */
  442                 m = ieee80211_decap(ic, m, hdrspace);
  443                 if (m == NULL) {
  444                         /* don't count Null data frames as errors */
  445                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
  446                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
  447                                 goto out;
  448                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
  449                             ni->ni_macaddr, "data", "%s", "decap error");
  450                         ic->ic_stats.is_rx_decap++;
  451                         IEEE80211_NODE_STAT(ni, rx_decap);
  452                         goto err;
  453                 }
  454                 eh = mtod(m, struct ether_header *);
  455                 if (!ieee80211_node_is_authorized(ni)) {
  456                         /*
  457                          * Deny any non-PAE frames received prior to
  458                          * authorization.  For open/shared-key
  459                          * authentication the port is mark authorized
  460                          * after authentication completes.  For 802.1x
  461                          * the port is not marked authorized by the
  462                          * authenticator until the handshake has completed.
  463                          */
  464                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
  465                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
  466                                     eh->ether_shost, "data",
  467                                     "unauthorized port: ether type 0x%x len %u",
  468                                     eh->ether_type, m->m_pkthdr.len);
  469                                 ic->ic_stats.is_rx_unauth++;
  470                                 IEEE80211_NODE_STAT(ni, rx_unauth);
  471                                 goto err;
  472                         }
  473                 } else {
  474                         /*
  475                          * When denying unencrypted frames, discard
  476                          * any non-PAE frames received without encryption.
  477                          */
  478                         if ((ic->ic_flags & IEEE80211_F_DROPUNENC) &&
  479                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
  480                             eh->ether_type != htons(ETHERTYPE_PAE)) {
  481                                 /*
  482                                  * Drop unencrypted frames.
  483                                  */
  484                                 ic->ic_stats.is_rx_unencrypted++;
  485                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
  486                                 goto out;
  487                         }
  488                 }
  489                 /* XXX require HT? */
  490                 if (qos & IEEE80211_QOS_AMSDU) {
  491                         m = ieee80211_decap_amsdu(ni, m);
  492                         if (m == NULL)
  493                                 return IEEE80211_FC0_TYPE_DATA;
  494                 } else if ((ni->ni_ath_flags & IEEE80211_NODE_FF) &&
  495 #define FF_LLC_SIZE     (sizeof(struct ether_header) + sizeof(struct llc))
  496                     m->m_pkthdr.len >= 3*FF_LLC_SIZE) {
  497                         struct llc *llc;
  498 
  499                         /*
  500                          * Check for fast-frame tunnel encapsulation.
  501                          */
  502                         if (m->m_len < FF_LLC_SIZE &&
  503                             (m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
  504                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  505                                     ni->ni_macaddr, "fast-frame",
  506                                     "%s", "m_pullup(llc) failed");
  507                                 ic->ic_stats.is_rx_tooshort++;
  508                                 return IEEE80211_FC0_TYPE_DATA;
  509                         }
  510                         llc = (struct llc *)(mtod(m, uint8_t *) + 
  511                                 sizeof(struct ether_header));
  512                         if (llc->llc_snap.ether_type == htons(ATH_FF_ETH_TYPE)) {
  513                                 m_adj(m, FF_LLC_SIZE);
  514                                 m = ieee80211_decap_fastframe(ic, ni, m);
  515                                 if (m == NULL)
  516                                         return IEEE80211_FC0_TYPE_DATA;
  517                         }
  518                 }
  519 #undef FF_LLC_SIZE
  520                 ieee80211_deliver_data(ic, ni, m);
  521                 return IEEE80211_FC0_TYPE_DATA;
  522 
  523         case IEEE80211_FC0_TYPE_MGT:
  524                 ic->ic_stats.is_rx_mgmt++;
  525                 IEEE80211_NODE_STAT(ni, rx_mgmt);
  526                 if (dir != IEEE80211_FC1_DIR_NODS) {
  527                         IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  528                             wh, "data", "unknown dir 0x%x", dir);
  529                         ic->ic_stats.is_rx_wrongdir++;
  530                         goto err;
  531                 }
  532                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  533                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  534                             ni->ni_macaddr, "mgt", "too short: len %u",
  535                             m->m_pkthdr.len);
  536                         ic->ic_stats.is_rx_tooshort++;
  537                         goto out;
  538                 }
  539 #ifdef IEEE80211_DEBUG
  540                 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) ||
  541                     ieee80211_msg_dumppkts(ic)) {
  542                         if_printf(ic->ic_ifp, "received %s from %s rssi %d\n",
  543                             ieee80211_mgt_subtype_name[subtype >>
  544                                 IEEE80211_FC0_SUBTYPE_SHIFT],
  545                             ether_sprintf(wh->i_addr2), rssi);
  546                 }
  547 #endif
  548                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
  549                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
  550                                 /*
  551                                  * Only shared key auth frames with a challenge
  552                                  * should be encrypted, discard all others.
  553                                  */
  554                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  555                                     wh, ieee80211_mgt_subtype_name[subtype >>
  556                                         IEEE80211_FC0_SUBTYPE_SHIFT],
  557                                     "%s", "WEP set but not permitted");
  558                                 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */
  559                                 goto out;
  560                         }
  561                         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
  562                                 /*
  563                                  * Discard encrypted frames when privacy is off.
  564                                  */
  565                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
  566                                     wh, "mgt", "%s", "WEP set but PRIVACY off");
  567                                 ic->ic_stats.is_rx_noprivacy++;
  568                                 goto out;
  569                         }
  570                         hdrspace = ieee80211_hdrspace(ic, wh);
  571                         key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
  572                         if (key == NULL) {
  573                                 /* NB: stats+msgs handled in crypto_decap */
  574                                 goto out;
  575                         }
  576                         wh = mtod(m, struct ieee80211_frame *);
  577                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
  578                 }
  579                 if (bpf_peers_present(ic->ic_rawbpf))
  580                         bpf_mtap(ic->ic_rawbpf, m);
  581                 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, noise, rstamp);
  582                 m_freem(m);
  583                 return IEEE80211_FC0_TYPE_MGT;
  584 
  585         case IEEE80211_FC0_TYPE_CTL:
  586                 ic->ic_stats.is_rx_ctl++;
  587                 IEEE80211_NODE_STAT(ni, rx_ctrl);
  588                 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
  589                         switch (subtype) {
  590                         case IEEE80211_FC0_SUBTYPE_PS_POLL:
  591                                 ieee80211_recv_pspoll(ic, ni, m);
  592                                 break;
  593                         case IEEE80211_FC0_SUBTYPE_BAR:
  594                                 ieee80211_recv_bar(ni, m);
  595                                 break;
  596                         }
  597                 }
  598                 goto out;
  599         default:
  600                 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
  601                     wh, NULL, "bad frame type 0x%x", type);
  602                 /* should not come here */
  603                 break;
  604         }
  605 err:
  606         ifp->if_ierrors++;
  607 out:
  608         if (m != NULL) {
  609                 if (bpf_peers_present(ic->ic_rawbpf) && need_tap)
  610                         bpf_mtap(ic->ic_rawbpf, m);
  611                 m_freem(m);
  612         }
  613         return type;
  614 #undef SEQ_LEQ
  615 }
  616 
  617 /*
  618  * This function reassemble fragments.
  619  */
  620 static struct mbuf *
  621 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni,
  622         struct mbuf *m, int hdrspace)
  623 {
  624         struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
  625         struct ieee80211_frame *lwh;
  626         uint16_t rxseq;
  627         uint8_t fragno;
  628         uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
  629         struct mbuf *mfrag;
  630 
  631         KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
  632 
  633         rxseq = le16toh(*(uint16_t *)wh->i_seq);
  634         fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
  635 
  636         /* Quick way out, if there's nothing to defragment */
  637         if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
  638                 return m;
  639 
  640         /*
  641          * Remove frag to insure it doesn't get reaped by timer.
  642          */
  643         if (ni->ni_table == NULL) {
  644                 /*
  645                  * Should never happen.  If the node is orphaned (not in
  646                  * the table) then input packets should not reach here.
  647                  * Otherwise, a concurrent request that yanks the table
  648                  * should be blocked by other interlocking and/or by first
  649                  * shutting the driver down.  Regardless, be defensive
  650                  * here and just bail
  651                  */
  652                 /* XXX need msg+stat */
  653                 m_freem(m);
  654                 return NULL;
  655         }
  656         IEEE80211_NODE_LOCK(ni->ni_table);
  657         mfrag = ni->ni_rxfrag[0];
  658         ni->ni_rxfrag[0] = NULL;
  659         IEEE80211_NODE_UNLOCK(ni->ni_table);
  660 
  661         /*
  662          * Validate new fragment is in order and
  663          * related to the previous ones.
  664          */
  665         if (mfrag != NULL) {
  666                 uint16_t last_rxseq;
  667 
  668                 lwh = mtod(mfrag, struct ieee80211_frame *);
  669                 last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
  670                 /* NB: check seq # and frag together */
  671                 if (rxseq != last_rxseq+1 ||
  672                     !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
  673                     !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
  674                         /*
  675                          * Unrelated fragment or no space for it,
  676                          * clear current fragments.
  677                          */
  678                         m_freem(mfrag);
  679                         mfrag = NULL;
  680                 }
  681         }
  682 
  683         if (mfrag == NULL) {
  684                 if (fragno != 0) {              /* !first fragment, discard */
  685                         ic->ic_stats.is_rx_defrag++;
  686                         IEEE80211_NODE_STAT(ni, rx_defrag);
  687                         m_freem(m);
  688                         return NULL;
  689                 }
  690                 mfrag = m;
  691         } else {                                /* concatenate */
  692                 m_adj(m, hdrspace);             /* strip header */
  693                 m_cat(mfrag, m);
  694                 /* NB: m_cat doesn't update the packet header */
  695                 mfrag->m_pkthdr.len += m->m_pkthdr.len;
  696                 /* track last seqnum and fragno */
  697                 lwh = mtod(mfrag, struct ieee80211_frame *);
  698                 *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
  699         }
  700         if (more_frag) {                        /* more to come, save */
  701                 ni->ni_rxfragstamp = ticks;
  702                 ni->ni_rxfrag[0] = mfrag;
  703                 mfrag = NULL;
  704         }
  705         return mfrag;
  706 }
  707 
  708 void
  709 ieee80211_deliver_data(struct ieee80211com *ic,
  710         struct ieee80211_node *ni, struct mbuf *m)
  711 {
  712         struct ether_header *eh = mtod(m, struct ether_header *);
  713         struct ifnet *ifp = ic->ic_ifp;
  714 
  715         /*
  716          * Do accounting.
  717          */
  718         ifp->if_ipackets++;
  719         IEEE80211_NODE_STAT(ni, rx_data);
  720         IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
  721         if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
  722                 m->m_flags |= M_MCAST;          /* XXX M_BCAST? */
  723                 IEEE80211_NODE_STAT(ni, rx_mcast);
  724         } else
  725                 IEEE80211_NODE_STAT(ni, rx_ucast);
  726 
  727         /* clear driver/net80211 flags before passing up */
  728         m->m_flags &= ~M_80211_RX;
  729 
  730         /* perform as a bridge within the AP */
  731         if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
  732             (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) {
  733                 struct mbuf *m1 = NULL;
  734 
  735                 if (m->m_flags & M_MCAST) {
  736                         m1 = m_dup(m, M_DONTWAIT);
  737                         if (m1 == NULL)
  738                                 ifp->if_oerrors++;
  739                         else
  740                                 m1->m_flags |= M_MCAST;
  741                 } else {
  742                         /*
  743                          * Check if the destination is known; if so
  744                          * and the port is authorized dispatch directly.
  745                          */
  746                         struct ieee80211_node *sta =
  747                             ieee80211_find_node(&ic->ic_sta, eh->ether_dhost);
  748                         if (sta != NULL) {
  749                                 if (ieee80211_node_is_authorized(sta)) {
  750                                         /*
  751                                          * Beware of sending to ourself; this
  752                                          * needs to happen via the normal
  753                                          * input path.
  754                                          */
  755                                         if (sta != ic->ic_bss) {
  756                                                 m1 = m;
  757                                                 m = NULL;
  758                                         }
  759                                 } else {
  760                                         ic->ic_stats.is_rx_unauth++;
  761                                         IEEE80211_NODE_STAT(sta, rx_unauth);
  762                                 }
  763                                 ieee80211_free_node(sta);
  764                         }
  765                 }
  766                 if (m1 != NULL) {
  767                         int error;
  768 
  769                         /* XXX does not work well with WME */
  770                         IFQ_HANDOFF(ifp, m1, error);
  771                 }
  772         }
  773         if (m != NULL) {
  774                 m->m_pkthdr.rcvif = ifp;
  775                 if (ni->ni_vlan != 0) {
  776                         /* attach vlan tag */
  777                         m->m_pkthdr.ether_vtag = ni->ni_vlan;
  778                         m->m_flags |= M_VLANTAG;
  779                 }
  780                 (*ifp->if_input)(ifp, m);
  781         }
  782 }
  783 
  784 static struct mbuf *
  785 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen)
  786 {
  787         struct ieee80211_qosframe_addr4 wh;     /* Max size address frames */
  788         struct ether_header *eh;
  789         struct llc *llc;
  790 
  791         if (m->m_len < hdrlen + sizeof(*llc) &&
  792             (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
  793                 /* XXX stat, msg */
  794                 return NULL;
  795         }
  796         memcpy(&wh, mtod(m, caddr_t), hdrlen);
  797         llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
  798         if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
  799             llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
  800             llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
  801                 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
  802                 llc = NULL;
  803         } else {
  804                 m_adj(m, hdrlen - sizeof(*eh));
  805         }
  806         eh = mtod(m, struct ether_header *);
  807         switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
  808         case IEEE80211_FC1_DIR_NODS:
  809                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
  810                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
  811                 break;
  812         case IEEE80211_FC1_DIR_TODS:
  813                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
  814                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
  815                 break;
  816         case IEEE80211_FC1_DIR_FROMDS:
  817                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
  818                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
  819                 break;
  820         case IEEE80211_FC1_DIR_DSTODS:
  821                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
  822                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
  823                 break;
  824         }
  825 #ifdef ALIGNED_POINTER
  826         if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
  827                 struct mbuf *n, *n0, **np;
  828                 caddr_t newdata;
  829                 int off, pktlen;
  830 
  831                 n0 = NULL;
  832                 np = &n0;
  833                 off = 0;
  834                 pktlen = m->m_pkthdr.len;
  835                 while (pktlen > off) {
  836                         if (n0 == NULL) {
  837                                 MGETHDR(n, M_DONTWAIT, MT_DATA);
  838                                 if (n == NULL) {
  839                                         m_freem(m);
  840                                         return NULL;
  841                                 }
  842                                 M_MOVE_PKTHDR(n, m);
  843                                 n->m_len = MHLEN;
  844                         } else {
  845                                 MGET(n, M_DONTWAIT, MT_DATA);
  846                                 if (n == NULL) {
  847                                         m_freem(m);
  848                                         m_freem(n0);
  849                                         return NULL;
  850                                 }
  851                                 n->m_len = MLEN;
  852                         }
  853                         if (pktlen - off >= MINCLSIZE) {
  854                                 MCLGET(n, M_DONTWAIT);
  855                                 if (n->m_flags & M_EXT)
  856                                         n->m_len = n->m_ext.ext_size;
  857                         }
  858                         if (n0 == NULL) {
  859                                 newdata =
  860                                     (caddr_t)ALIGN(n->m_data + sizeof(*eh)) -
  861                                     sizeof(*eh);
  862                                 n->m_len -= newdata - n->m_data;
  863                                 n->m_data = newdata;
  864                         }
  865                         if (n->m_len > pktlen - off)
  866                                 n->m_len = pktlen - off;
  867                         m_copydata(m, off, n->m_len, mtod(n, caddr_t));
  868                         off += n->m_len;
  869                         *np = n;
  870                         np = &n->m_next;
  871                 }
  872                 m_freem(m);
  873                 m = n0;
  874         }
  875 #endif /* ALIGNED_POINTER */
  876         if (llc != NULL) {
  877                 eh = mtod(m, struct ether_header *);
  878                 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
  879         }
  880         return m;
  881 }
  882 
  883 /*
  884  * Decap a frame encapsulated in a fast-frame/A-MSDU.
  885  */
  886 struct mbuf *
  887 ieee80211_decap1(struct mbuf *m, int *framelen)
  888 {
  889 #define FF_LLC_SIZE     (sizeof(struct ether_header) + sizeof(struct llc))
  890         struct ether_header *eh;
  891         struct llc *llc;
  892 
  893         /*
  894          * The frame has an 802.3 header followed by an 802.2
  895          * LLC header.  The encapsulated frame length is in the
  896          * first header type field; save that and overwrite it 
  897          * with the true type field found in the second.  Then
  898          * copy the 802.3 header up to where it belongs and
  899          * adjust the mbuf contents to remove the void.
  900          */
  901         if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
  902                 return NULL;
  903         eh = mtod(m, struct ether_header *);    /* 802.3 header is first */
  904         llc = (struct llc *)&eh[1];             /* 802.2 header follows */
  905         *framelen = ntohs(eh->ether_type)       /* encap'd frame size */
  906                   + sizeof(struct ether_header) - sizeof(struct llc);
  907         eh->ether_type = llc->llc_un.type_snap.ether_type;
  908         ovbcopy(eh, mtod(m, uint8_t *) + sizeof(struct llc),
  909                 sizeof(struct ether_header));
  910         m_adj(m, sizeof(struct llc));
  911         return m;
  912 #undef FF_LLC_SIZE
  913 }
  914 
  915 /*
  916  * Decap the encapsulated frame pair and dispatch the first
  917  * for delivery.  The second frame is returned for delivery
  918  * via the normal path.
  919  */
  920 static struct mbuf *
  921 ieee80211_decap_fastframe(struct ieee80211com *ic,
  922         struct ieee80211_node *ni, struct mbuf *m)
  923 {
  924 #define MS(x,f) (((x) & f) >> f##_S)
  925         uint32_t ath;
  926         struct mbuf *n;
  927         int framelen;
  928 
  929         m_copydata(m, 0, sizeof(uint32_t), (caddr_t) &ath);
  930         if (MS(ath, ATH_FF_PROTO) != ATH_FF_PROTO_L2TUNNEL) {
  931                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  932                     ni->ni_macaddr, "fast-frame",
  933                     "unsupport tunnel protocol, header 0x%x", ath);
  934                 ic->ic_stats.is_ff_badhdr++;
  935                 m_freem(m);
  936                 return NULL;
  937         }
  938         /* NB: skip header and alignment padding */
  939         m_adj(m, roundup(sizeof(uint32_t) - 2, 4) + 2);
  940 
  941         ic->ic_stats.is_ff_decap++;
  942 
  943         /*
  944          * Decap the first frame, bust it apart from the
  945          * second and deliver; then decap the second frame
  946          * and return it to the caller for normal delivery.
  947          */
  948         m = ieee80211_decap1(m, &framelen);
  949         if (m == NULL) {
  950                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  951                     ni->ni_macaddr, "fast-frame", "%s", "first decap failed");
  952                 ic->ic_stats.is_ff_tooshort++;
  953                 return NULL;
  954         }
  955         n = m_split(m, framelen, M_NOWAIT);
  956         if (n == NULL) {
  957                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  958                     ni->ni_macaddr, "fast-frame",
  959                     "%s", "unable to split encapsulated frames");
  960                 ic->ic_stats.is_ff_split++;
  961                 m_freem(m);                     /* NB: must reclaim */
  962                 return NULL;
  963         }
  964         ieee80211_deliver_data(ic, ni, m);      /* 1st of pair */
  965 
  966         /*
  967          * Decap second frame.
  968          */
  969         m_adj(n, roundup2(framelen, 4) - framelen);     /* padding */
  970         n = ieee80211_decap1(n, &framelen);
  971         if (n == NULL) {
  972                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
  973                     ni->ni_macaddr, "fast-frame", "%s", "second decap failed");
  974                 ic->ic_stats.is_ff_tooshort++;
  975         }
  976         /* XXX verify framelen against mbuf contents */
  977         return n;                               /* 2nd delivered by caller */
  978 #undef MS
  979 }
  980 
  981 /*
  982  * Install received rate set information in the node's state block.
  983  */
  984 int
  985 ieee80211_setup_rates(struct ieee80211_node *ni,
  986         const uint8_t *rates, const uint8_t *xrates, int flags)
  987 {
  988         struct ieee80211com *ic = ni->ni_ic;
  989         struct ieee80211_rateset *rs = &ni->ni_rates;
  990 
  991         memset(rs, 0, sizeof(*rs));
  992         rs->rs_nrates = rates[1];
  993         memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
  994         if (xrates != NULL) {
  995                 uint8_t nxrates;
  996                 /*
  997                  * Tack on 11g extended supported rate element.
  998                  */
  999                 nxrates = xrates[1];
 1000                 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
 1001                         nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
 1002                         IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE,
 1003                              "[%s] extended rate set too large;"
 1004                              " only using %u of %u rates\n",
 1005                              ether_sprintf(ni->ni_macaddr), nxrates, xrates[1]);
 1006                         ic->ic_stats.is_rx_rstoobig++;
 1007                 }
 1008                 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
 1009                 rs->rs_nrates += nxrates;
 1010         }
 1011         return ieee80211_fix_rate(ni, rs, flags);
 1012 }
 1013 
 1014 static void
 1015 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh,
 1016     struct ieee80211_node *ni, int rssi, int noise, uint32_t rstamp,
 1017     uint16_t seq, uint16_t status)
 1018 {
 1019 
 1020         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
 1021                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1022                     ni->ni_macaddr, "open auth",
 1023                     "bad sta auth mode %u", ni->ni_authmode);
 1024                 ic->ic_stats.is_rx_bad_auth++;  /* XXX */
 1025                 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 1026                         /*
 1027                          * Clear any challenge text that may be there if
 1028                          * a previous shared key auth failed and then an
 1029                          * open auth is attempted.
 1030                          */
 1031                         if (ni->ni_challenge != NULL) {
 1032                                 FREE(ni->ni_challenge, M_80211_NODE);
 1033                                 ni->ni_challenge = NULL;
 1034                         }
 1035                         /* XXX hack to workaround calling convention */
 1036                         ieee80211_send_error(ic, ni, wh->i_addr2, 
 1037                             IEEE80211_FC0_SUBTYPE_AUTH,
 1038                             (seq + 1) | (IEEE80211_STATUS_ALG<<16));
 1039                 }
 1040                 return;
 1041         }
 1042         switch (ic->ic_opmode) {
 1043         case IEEE80211_M_IBSS:
 1044         case IEEE80211_M_AHDEMO:
 1045         case IEEE80211_M_MONITOR:
 1046         case IEEE80211_M_WDS:
 1047                 /* should not come here */
 1048                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1049                     ni->ni_macaddr, "open auth",
 1050                     "bad operating mode %u", ic->ic_opmode);
 1051                 break;
 1052 
 1053         case IEEE80211_M_HOSTAP:
 1054                 if (ic->ic_state != IEEE80211_S_RUN ||
 1055                     seq != IEEE80211_AUTH_OPEN_REQUEST) {
 1056                         ic->ic_stats.is_rx_bad_auth++;
 1057                         return;
 1058                 }
 1059                 /* always accept open authentication requests */
 1060                 if (ni == ic->ic_bss) {
 1061                         ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
 1062                         if (ni == NULL)
 1063                                 return;
 1064                 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
 1065                         (void) ieee80211_ref_node(ni);
 1066                 /*
 1067                  * Mark the node as referenced to reflect that it's
 1068                  * reference count has been bumped to insure it remains
 1069                  * after the transaction completes.
 1070                  */
 1071                 ni->ni_flags |= IEEE80211_NODE_AREF;
 1072 
 1073                 IEEE80211_SEND_MGMT(ic, ni,
 1074                         IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
 1075                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
 1076                     "[%s] station authenticated (open)\n",
 1077                     ether_sprintf(ni->ni_macaddr));
 1078                 /*
 1079                  * When 802.1x is not in use mark the port
 1080                  * authorized at this point so traffic can flow.
 1081                  */
 1082                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 1083                         ieee80211_node_authorize(ni);
 1084                 break;
 1085 
 1086         case IEEE80211_M_STA:
 1087                 if (ic->ic_state != IEEE80211_S_AUTH ||
 1088                     seq != IEEE80211_AUTH_OPEN_RESPONSE) {
 1089                         ic->ic_stats.is_rx_bad_auth++;
 1090                         return;
 1091                 }
 1092                 if (status != 0) {
 1093                         IEEE80211_DPRINTF(ic,
 1094                             IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
 1095                             "[%s] open auth failed (reason %d)\n",
 1096                             ether_sprintf(ni->ni_macaddr), status);
 1097                         /* XXX can this happen? */
 1098                         if (ni != ic->ic_bss)
 1099                                 ni->ni_fails++;
 1100                         ic->ic_stats.is_rx_auth_fail++;
 1101                         ieee80211_new_state(ic, IEEE80211_S_SCAN,
 1102                             IEEE80211_SCAN_FAIL_STATUS);
 1103                 } else
 1104                         ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
 1105                 break;
 1106         }
 1107 }
 1108 
 1109 /*
 1110  * Send a management frame error response to the specified
 1111  * station.  If ni is associated with the station then use
 1112  * it; otherwise allocate a temporary node suitable for
 1113  * transmitting the frame and then free the reference so
 1114  * it will go away as soon as the frame has been transmitted.
 1115  */
 1116 static void
 1117 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni,
 1118         const uint8_t *mac, int subtype, int arg)
 1119 {
 1120         int istmp;
 1121 
 1122         if (ni == ic->ic_bss) {
 1123                 ni = ieee80211_tmp_node(ic, mac);
 1124                 if (ni == NULL) {
 1125                         /* XXX msg */
 1126                         return;
 1127                 }
 1128                 istmp = 1;
 1129         } else
 1130                 istmp = 0;
 1131         IEEE80211_SEND_MGMT(ic, ni, subtype, arg);
 1132         if (istmp)
 1133                 ieee80211_free_node(ni);
 1134 }
 1135 
 1136 static int
 1137 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni)
 1138 {
 1139         if (ni->ni_challenge == NULL)
 1140                 MALLOC(ni->ni_challenge, uint32_t*, IEEE80211_CHALLENGE_LEN,
 1141                     M_80211_NODE, M_NOWAIT);
 1142         if (ni->ni_challenge == NULL) {
 1143                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
 1144                     "[%s] shared key challenge alloc failed\n",
 1145                     ether_sprintf(ni->ni_macaddr));
 1146                 /* XXX statistic */
 1147         }
 1148         return (ni->ni_challenge != NULL);
 1149 }
 1150 
 1151 /* XXX TODO: add statistics */
 1152 static void
 1153 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh,
 1154     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *ni,
 1155     int rssi, int noise, uint32_t rstamp, uint16_t seq, uint16_t status)
 1156 {
 1157         uint8_t *challenge;
 1158         int allocbs, estatus;
 1159 
 1160         /*
 1161          * NB: this can happen as we allow pre-shared key
 1162          * authentication to be enabled w/o wep being turned
 1163          * on so that configuration of these can be done
 1164          * in any order.  It may be better to enforce the
 1165          * ordering in which case this check would just be
 1166          * for sanity/consistency.
 1167          */
 1168         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
 1169                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1170                     ni->ni_macaddr, "shared key auth",
 1171                     "%s", " PRIVACY is disabled");
 1172                 estatus = IEEE80211_STATUS_ALG;
 1173                 goto bad;
 1174         }
 1175         /*
 1176          * Pre-shared key authentication is evil; accept
 1177          * it only if explicitly configured (it is supported
 1178          * mainly for compatibility with clients like OS X).
 1179          */
 1180         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
 1181             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
 1182                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1183                     ni->ni_macaddr, "shared key auth",
 1184                     "bad sta auth mode %u", ni->ni_authmode);
 1185                 ic->ic_stats.is_rx_bad_auth++;  /* XXX maybe a unique error? */
 1186                 estatus = IEEE80211_STATUS_ALG;
 1187                 goto bad;
 1188         }
 1189 
 1190         challenge = NULL;
 1191         if (frm + 1 < efrm) {
 1192                 if ((frm[1] + 2) > (efrm - frm)) {
 1193                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1194                             ni->ni_macaddr, "shared key auth",
 1195                             "ie %d/%d too long",
 1196                             frm[0], (frm[1] + 2) - (efrm - frm));
 1197                         ic->ic_stats.is_rx_bad_auth++;
 1198                         estatus = IEEE80211_STATUS_CHALLENGE;
 1199                         goto bad;
 1200                 }
 1201                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
 1202                         challenge = frm;
 1203                 frm += frm[1] + 2;
 1204         }
 1205         switch (seq) {
 1206         case IEEE80211_AUTH_SHARED_CHALLENGE:
 1207         case IEEE80211_AUTH_SHARED_RESPONSE:
 1208                 if (challenge == NULL) {
 1209                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1210                             ni->ni_macaddr, "shared key auth",
 1211                             "%s", "no challenge");
 1212                         ic->ic_stats.is_rx_bad_auth++;
 1213                         estatus = IEEE80211_STATUS_CHALLENGE;
 1214                         goto bad;
 1215                 }
 1216                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
 1217                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1218                             ni->ni_macaddr, "shared key auth",
 1219                             "bad challenge len %d", challenge[1]);
 1220                         ic->ic_stats.is_rx_bad_auth++;
 1221                         estatus = IEEE80211_STATUS_CHALLENGE;
 1222                         goto bad;
 1223                 }
 1224         default:
 1225                 break;
 1226         }
 1227         switch (ic->ic_opmode) {
 1228         case IEEE80211_M_MONITOR:
 1229         case IEEE80211_M_AHDEMO:
 1230         case IEEE80211_M_IBSS:
 1231         case IEEE80211_M_WDS:
 1232                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1233                     ni->ni_macaddr, "shared key auth",
 1234                     "bad operating mode %u", ic->ic_opmode);
 1235                 return;
 1236         case IEEE80211_M_HOSTAP:
 1237                 if (ic->ic_state != IEEE80211_S_RUN) {
 1238                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1239                             ni->ni_macaddr, "shared key auth",
 1240                             "bad state %u", ic->ic_state);
 1241                         estatus = IEEE80211_STATUS_ALG; /* XXX */
 1242                         goto bad;
 1243                 }
 1244                 switch (seq) {
 1245                 case IEEE80211_AUTH_SHARED_REQUEST:
 1246                         if (ni == ic->ic_bss) {
 1247                                 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
 1248                                 if (ni == NULL) {
 1249                                         /* NB: no way to return an error */
 1250                                         return;
 1251                                 }
 1252                                 allocbs = 1;
 1253                         } else {
 1254                                 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
 1255                                         (void) ieee80211_ref_node(ni);
 1256                                 allocbs = 0;
 1257                         }
 1258                         /*
 1259                          * Mark the node as referenced to reflect that it's
 1260                          * reference count has been bumped to insure it remains
 1261                          * after the transaction completes.
 1262                          */
 1263                         ni->ni_flags |= IEEE80211_NODE_AREF;
 1264                         ni->ni_rssi = rssi;
 1265                         ni->ni_noise = noise;
 1266                         ni->ni_rstamp = rstamp;
 1267                         if (!alloc_challenge(ic, ni)) {
 1268                                 /* NB: don't return error so they rexmit */
 1269                                 return;
 1270                         }
 1271                         get_random_bytes(ni->ni_challenge,
 1272                                 IEEE80211_CHALLENGE_LEN);
 1273                         IEEE80211_DPRINTF(ic,
 1274                                 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
 1275                                 "[%s] shared key %sauth request\n",
 1276                                 ether_sprintf(ni->ni_macaddr),
 1277                                 allocbs ? "" : "re");
 1278                         break;
 1279                 case IEEE80211_AUTH_SHARED_RESPONSE:
 1280                         if (ni == ic->ic_bss) {
 1281                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1282                                     ni->ni_macaddr, "shared key response",
 1283                                     "%s", "unknown station");
 1284                                 /* NB: don't send a response */
 1285                                 return;
 1286                         }
 1287                         if (ni->ni_challenge == NULL) {
 1288                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1289                                     ni->ni_macaddr, "shared key response",
 1290                                     "%s", "no challenge recorded");
 1291                                 ic->ic_stats.is_rx_bad_auth++;
 1292                                 estatus = IEEE80211_STATUS_CHALLENGE;
 1293                                 goto bad;
 1294                         }
 1295                         if (memcmp(ni->ni_challenge, &challenge[2],
 1296                                    challenge[1]) != 0) {
 1297                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1298                                     ni->ni_macaddr, "shared key response",
 1299                                     "%s", "challenge mismatch");
 1300                                 ic->ic_stats.is_rx_auth_fail++;
 1301                                 estatus = IEEE80211_STATUS_CHALLENGE;
 1302                                 goto bad;
 1303                         }
 1304                         IEEE80211_DPRINTF(ic,
 1305                             IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
 1306                             "[%s] station authenticated (shared key)\n",
 1307                             ether_sprintf(ni->ni_macaddr));
 1308                         ieee80211_node_authorize(ni);
 1309                         break;
 1310                 default:
 1311                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
 1312                             ni->ni_macaddr, "shared key auth",
 1313                             "bad seq %d", seq);
 1314                         ic->ic_stats.is_rx_bad_auth++;
 1315                         estatus = IEEE80211_STATUS_SEQUENCE;
 1316                         goto bad;
 1317                 }
 1318                 IEEE80211_SEND_MGMT(ic, ni,
 1319                         IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
 1320                 break;
 1321 
 1322         case IEEE80211_M_STA:
 1323                 if (ic->ic_state != IEEE80211_S_AUTH)
 1324                         return;
 1325                 switch (seq) {
 1326                 case IEEE80211_AUTH_SHARED_PASS:
 1327                         if (ni->ni_challenge != NULL) {
 1328                                 FREE(ni->ni_challenge, M_80211_NODE);
 1329                                 ni->ni_challenge = NULL;
 1330                         }
 1331                         if (status != 0) {
 1332                                 IEEE80211_DPRINTF(ic,
 1333                                     IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
 1334                                     "[%s] shared key auth failed (reason %d)\n",
 1335                                     ether_sprintf(ieee80211_getbssid(ic, wh)),
 1336                                     status);
 1337                                 /* XXX can this happen? */
 1338                                 if (ni != ic->ic_bss)
 1339                                         ni->ni_fails++;
 1340                                 ic->ic_stats.is_rx_auth_fail++;
 1341                                 return;
 1342                         }
 1343                         ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
 1344                         break;
 1345                 case IEEE80211_AUTH_SHARED_CHALLENGE:
 1346                         if (!alloc_challenge(ic, ni))
 1347                                 return;
 1348                         /* XXX could optimize by passing recvd challenge */
 1349                         memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
 1350                         IEEE80211_SEND_MGMT(ic, ni,
 1351                                 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
 1352                         break;
 1353                 default:
 1354                         IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH,
 1355                             wh, "shared key auth", "bad seq %d", seq);
 1356                         ic->ic_stats.is_rx_bad_auth++;
 1357                         return;
 1358                 }
 1359                 break;
 1360         }
 1361         return;
 1362 bad:
 1363         /*
 1364          * Send an error response; but only when operating as an AP.
 1365          */
 1366         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 1367                 /* XXX hack to workaround calling convention */
 1368                 ieee80211_send_error(ic, ni, wh->i_addr2,
 1369                     IEEE80211_FC0_SUBTYPE_AUTH,
 1370                     (seq + 1) | (estatus<<16));
 1371         } else if (ic->ic_opmode == IEEE80211_M_STA) {
 1372                 /*
 1373                  * Kick the state machine.  This short-circuits
 1374                  * using the mgt frame timeout to trigger the
 1375                  * state transition.
 1376                  */
 1377                 if (ic->ic_state == IEEE80211_S_AUTH)
 1378                         ieee80211_new_state(ic, IEEE80211_S_SCAN,
 1379                             IEEE80211_SCAN_FAIL_STATUS);
 1380         }
 1381 }
 1382 
 1383 /*
 1384  * Convert a WPA cipher selector OUI to an internal
 1385  * cipher algorithm.  Where appropriate we also
 1386  * record any key length.
 1387  */
 1388 static int
 1389 wpa_cipher(uint8_t *sel, uint8_t *keylen)
 1390 {
 1391 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
 1392         uint32_t w = LE_READ_4(sel);
 1393 
 1394         switch (w) {
 1395         case WPA_SEL(WPA_CSE_NULL):
 1396                 return IEEE80211_CIPHER_NONE;
 1397         case WPA_SEL(WPA_CSE_WEP40):
 1398                 if (keylen)
 1399                         *keylen = 40 / NBBY;
 1400                 return IEEE80211_CIPHER_WEP;
 1401         case WPA_SEL(WPA_CSE_WEP104):
 1402                 if (keylen)
 1403                         *keylen = 104 / NBBY;
 1404                 return IEEE80211_CIPHER_WEP;
 1405         case WPA_SEL(WPA_CSE_TKIP):
 1406                 return IEEE80211_CIPHER_TKIP;
 1407         case WPA_SEL(WPA_CSE_CCMP):
 1408                 return IEEE80211_CIPHER_AES_CCM;
 1409         }
 1410         return 32;              /* NB: so 1<< is discarded */
 1411 #undef WPA_SEL
 1412 }
 1413 
 1414 /*
 1415  * Convert a WPA key management/authentication algorithm
 1416  * to an internal code.
 1417  */
 1418 static int
 1419 wpa_keymgmt(uint8_t *sel)
 1420 {
 1421 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
 1422         uint32_t w = LE_READ_4(sel);
 1423 
 1424         switch (w) {
 1425         case WPA_SEL(WPA_ASE_8021X_UNSPEC):
 1426                 return WPA_ASE_8021X_UNSPEC;
 1427         case WPA_SEL(WPA_ASE_8021X_PSK):
 1428                 return WPA_ASE_8021X_PSK;
 1429         case WPA_SEL(WPA_ASE_NONE):
 1430                 return WPA_ASE_NONE;
 1431         }
 1432         return 0;               /* NB: so is discarded */
 1433 #undef WPA_SEL
 1434 }
 1435 
 1436 /*
 1437  * Parse a WPA information element to collect parameters
 1438  * and validate the parameters against what has been
 1439  * configured for the system.
 1440  */
 1441 static int
 1442 ieee80211_parse_wpa(struct ieee80211com *ic, uint8_t *frm,
 1443         struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
 1444 {
 1445         uint8_t len = frm[1];
 1446         uint32_t w;
 1447         int n;
 1448 
 1449         /*
 1450          * Check the length once for fixed parts: OUI, type,
 1451          * version, mcast cipher, and 2 selector counts.
 1452          * Other, variable-length data, must be checked separately.
 1453          */
 1454         if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) {
 1455                 IEEE80211_DISCARD_IE(ic,
 1456                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1457                     wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags);
 1458                 return IEEE80211_REASON_IE_INVALID;
 1459         }
 1460         if (len < 14) {
 1461                 IEEE80211_DISCARD_IE(ic,
 1462                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1463                     wh, "WPA", "too short, len %u", len);
 1464                 return IEEE80211_REASON_IE_INVALID;
 1465         }
 1466         frm += 6, len -= 4;             /* NB: len is payload only */
 1467         /* NB: iswapoui already validated the OUI and type */
 1468         w = LE_READ_2(frm);
 1469         if (w != WPA_VERSION) {
 1470                 IEEE80211_DISCARD_IE(ic,
 1471                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1472                     wh, "WPA", "bad version %u", w);
 1473                 return IEEE80211_REASON_IE_INVALID;
 1474         }
 1475         frm += 2, len -= 2;
 1476 
 1477         /* multicast/group cipher */
 1478         w = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
 1479         if (w != rsn->rsn_mcastcipher) {
 1480                 IEEE80211_DISCARD_IE(ic,
 1481                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1482                     wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
 1483                     w, rsn->rsn_mcastcipher);
 1484                 return IEEE80211_REASON_IE_INVALID;
 1485         }
 1486         frm += 4, len -= 4;
 1487 
 1488         /* unicast ciphers */
 1489         n = LE_READ_2(frm);
 1490         frm += 2, len -= 2;
 1491         if (len < n*4+2) {
 1492                 IEEE80211_DISCARD_IE(ic,
 1493                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1494                     wh, "WPA", "ucast cipher data too short; len %u, n %u",
 1495                     len, n);
 1496                 return IEEE80211_REASON_IE_INVALID;
 1497         }
 1498         w = 0;
 1499         for (; n > 0; n--) {
 1500                 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
 1501                 frm += 4, len -= 4;
 1502         }
 1503         w &= rsn->rsn_ucastcipherset;
 1504         if (w == 0) {
 1505                 IEEE80211_DISCARD_IE(ic,
 1506                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1507                     wh, "WPA", "%s", "ucast cipher set empty");
 1508                 return IEEE80211_REASON_IE_INVALID;
 1509         }
 1510         if (w & (1<<IEEE80211_CIPHER_TKIP))
 1511                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
 1512         else
 1513                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
 1514 
 1515         /* key management algorithms */
 1516         n = LE_READ_2(frm);
 1517         frm += 2, len -= 2;
 1518         if (len < n*4) {
 1519                 IEEE80211_DISCARD_IE(ic,
 1520                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1521                     wh, "WPA", "key mgmt alg data too short; len %u, n %u",
 1522                     len, n);
 1523                 return IEEE80211_REASON_IE_INVALID;
 1524         }
 1525         w = 0;
 1526         for (; n > 0; n--) {
 1527                 w |= wpa_keymgmt(frm);
 1528                 frm += 4, len -= 4;
 1529         }
 1530         w &= rsn->rsn_keymgmtset;
 1531         if (w == 0) {
 1532                 IEEE80211_DISCARD_IE(ic,
 1533                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1534                     wh, "WPA", "%s", "no acceptable key mgmt alg");
 1535                 return IEEE80211_REASON_IE_INVALID;
 1536         }
 1537         if (w & WPA_ASE_8021X_UNSPEC)
 1538                 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
 1539         else
 1540                 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
 1541 
 1542         if (len > 2)            /* optional capabilities */
 1543                 rsn->rsn_caps = LE_READ_2(frm);
 1544 
 1545         return 0;
 1546 }
 1547 
 1548 /*
 1549  * Convert an RSN cipher selector OUI to an internal
 1550  * cipher algorithm.  Where appropriate we also
 1551  * record any key length.
 1552  */
 1553 static int
 1554 rsn_cipher(uint8_t *sel, uint8_t *keylen)
 1555 {
 1556 #define RSN_SEL(x)      (((x)<<24)|RSN_OUI)
 1557         uint32_t w = LE_READ_4(sel);
 1558 
 1559         switch (w) {
 1560         case RSN_SEL(RSN_CSE_NULL):
 1561                 return IEEE80211_CIPHER_NONE;
 1562         case RSN_SEL(RSN_CSE_WEP40):
 1563                 if (keylen)
 1564                         *keylen = 40 / NBBY;
 1565                 return IEEE80211_CIPHER_WEP;
 1566         case RSN_SEL(RSN_CSE_WEP104):
 1567                 if (keylen)
 1568                         *keylen = 104 / NBBY;
 1569                 return IEEE80211_CIPHER_WEP;
 1570         case RSN_SEL(RSN_CSE_TKIP):
 1571                 return IEEE80211_CIPHER_TKIP;
 1572         case RSN_SEL(RSN_CSE_CCMP):
 1573                 return IEEE80211_CIPHER_AES_CCM;
 1574         case RSN_SEL(RSN_CSE_WRAP):
 1575                 return IEEE80211_CIPHER_AES_OCB;
 1576         }
 1577         return 32;              /* NB: so 1<< is discarded */
 1578 #undef WPA_SEL
 1579 }
 1580 
 1581 /*
 1582  * Convert an RSN key management/authentication algorithm
 1583  * to an internal code.
 1584  */
 1585 static int
 1586 rsn_keymgmt(uint8_t *sel)
 1587 {
 1588 #define RSN_SEL(x)      (((x)<<24)|RSN_OUI)
 1589         uint32_t w = LE_READ_4(sel);
 1590 
 1591         switch (w) {
 1592         case RSN_SEL(RSN_ASE_8021X_UNSPEC):
 1593                 return RSN_ASE_8021X_UNSPEC;
 1594         case RSN_SEL(RSN_ASE_8021X_PSK):
 1595                 return RSN_ASE_8021X_PSK;
 1596         case RSN_SEL(RSN_ASE_NONE):
 1597                 return RSN_ASE_NONE;
 1598         }
 1599         return 0;               /* NB: so is discarded */
 1600 #undef RSN_SEL
 1601 }
 1602 
 1603 /*
 1604  * Parse a WPA/RSN information element to collect parameters
 1605  * and validate the parameters against what has been
 1606  * configured for the system.
 1607  */
 1608 static int
 1609 ieee80211_parse_rsn(struct ieee80211com *ic, uint8_t *frm,
 1610         struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
 1611 {
 1612         uint8_t len = frm[1];
 1613         uint32_t w;
 1614         int n;
 1615 
 1616         /*
 1617          * Check the length once for fixed parts: 
 1618          * version, mcast cipher, and 2 selector counts.
 1619          * Other, variable-length data, must be checked separately.
 1620          */
 1621         if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) {
 1622                 IEEE80211_DISCARD_IE(ic,
 1623                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1624                     wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags);
 1625                 return IEEE80211_REASON_IE_INVALID;
 1626         }
 1627         if (len < 10) {
 1628                 IEEE80211_DISCARD_IE(ic,
 1629                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1630                     wh, "RSN", "too short, len %u", len);
 1631                 return IEEE80211_REASON_IE_INVALID;
 1632         }
 1633         frm += 2;
 1634         w = LE_READ_2(frm);
 1635         if (w != RSN_VERSION) {
 1636                 IEEE80211_DISCARD_IE(ic,
 1637                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1638                     wh, "RSN", "bad version %u", w);
 1639                 return IEEE80211_REASON_IE_INVALID;
 1640         }
 1641         frm += 2, len -= 2;
 1642 
 1643         /* multicast/group cipher */
 1644         w = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
 1645         if (w != rsn->rsn_mcastcipher) {
 1646                 IEEE80211_DISCARD_IE(ic,
 1647                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1648                     wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
 1649                     w, rsn->rsn_mcastcipher);
 1650                 return IEEE80211_REASON_IE_INVALID;
 1651         }
 1652         frm += 4, len -= 4;
 1653 
 1654         /* unicast ciphers */
 1655         n = LE_READ_2(frm);
 1656         frm += 2, len -= 2;
 1657         if (len < n*4+2) {
 1658                 IEEE80211_DISCARD_IE(ic,
 1659                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1660                     wh, "RSN", "ucast cipher data too short; len %u, n %u",
 1661                     len, n);
 1662                 return IEEE80211_REASON_IE_INVALID;
 1663         }
 1664         w = 0;
 1665         for (; n > 0; n--) {
 1666                 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
 1667                 frm += 4, len -= 4;
 1668         }
 1669         w &= rsn->rsn_ucastcipherset;
 1670         if (w == 0) {
 1671                 IEEE80211_DISCARD_IE(ic,
 1672                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1673                     wh, "RSN", "%s", "ucast cipher set empty");
 1674                 return IEEE80211_REASON_IE_INVALID;
 1675         }
 1676         if (w & (1<<IEEE80211_CIPHER_TKIP))
 1677                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
 1678         else
 1679                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
 1680 
 1681         /* key management algorithms */
 1682         n = LE_READ_2(frm);
 1683         frm += 2, len -= 2;
 1684         if (len < n*4) {
 1685                 IEEE80211_DISCARD_IE(ic, 
 1686                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1687                     wh, "RSN", "key mgmt alg data too short; len %u, n %u",
 1688                     len, n);
 1689                 return IEEE80211_REASON_IE_INVALID;
 1690         }
 1691         w = 0;
 1692         for (; n > 0; n--) {
 1693                 w |= rsn_keymgmt(frm);
 1694                 frm += 4, len -= 4;
 1695         }
 1696         w &= rsn->rsn_keymgmtset;
 1697         if (w == 0) {
 1698                 IEEE80211_DISCARD_IE(ic,
 1699                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
 1700                     wh, "RSN", "%s", "no acceptable key mgmt alg");
 1701                 return IEEE80211_REASON_IE_INVALID;
 1702         }
 1703         if (w & RSN_ASE_8021X_UNSPEC)
 1704                 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
 1705         else
 1706                 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
 1707 
 1708         /* optional RSN capabilities */
 1709         if (len > 2)
 1710                 rsn->rsn_caps = LE_READ_2(frm);
 1711         /* XXXPMKID */
 1712 
 1713         return 0;
 1714 }
 1715 
 1716 static int
 1717 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm,
 1718         const struct ieee80211_frame *wh)
 1719 {
 1720 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
 1721         struct ieee80211_wme_state *wme = &ic->ic_wme;
 1722         u_int len = frm[1], qosinfo;
 1723         int i;
 1724 
 1725         if (len < sizeof(struct ieee80211_wme_param)-2) {
 1726                 IEEE80211_DISCARD_IE(ic,
 1727                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
 1728                     wh, "WME", "too short, len %u", len);
 1729                 return -1;
 1730         }
 1731         qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
 1732         qosinfo &= WME_QOSINFO_COUNT;
 1733         /* XXX do proper check for wraparound */
 1734         if (qosinfo == wme->wme_wmeChanParams.cap_info)
 1735                 return 0;
 1736         frm += __offsetof(struct ieee80211_wme_param, params_acParams);
 1737         for (i = 0; i < WME_NUM_AC; i++) {
 1738                 struct wmeParams *wmep =
 1739                         &wme->wme_wmeChanParams.cap_wmeParams[i];
 1740                 /* NB: ACI not used */
 1741                 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
 1742                 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
 1743                 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
 1744                 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
 1745                 wmep->wmep_txopLimit = LE_READ_2(frm+2);
 1746                 frm += 4;
 1747         }
 1748         wme->wme_wmeChanParams.cap_info = qosinfo;
 1749         return 1;
 1750 #undef MS
 1751 }
 1752 
 1753 static int
 1754 ieee80211_parse_athparams(struct ieee80211_node *ni, uint8_t *frm,
 1755         const struct ieee80211_frame *wh)
 1756 {
 1757         struct ieee80211com *ic = ni->ni_ic;
 1758         const struct ieee80211_ath_ie *ath;
 1759         u_int len = frm[1];
 1760         int capschanged;
 1761         uint16_t defkeyix;
 1762 
 1763         if (len < sizeof(struct ieee80211_ath_ie)-2) {
 1764                 IEEE80211_DISCARD_IE(ic,
 1765                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_SUPERG,
 1766                     wh, "Atheros", "too short, len %u", len);
 1767                 return -1;
 1768         }
 1769         ath = (const struct ieee80211_ath_ie *)frm;
 1770         capschanged = (ni->ni_ath_flags != ath->ath_capability);
 1771         defkeyix = LE_READ_2(ath->ath_defkeyix);
 1772         if (capschanged || defkeyix != ni->ni_ath_defkeyix) {
 1773                 ni->ni_ath_flags = ath->ath_capability;
 1774                 ni->ni_ath_defkeyix = defkeyix;
 1775                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SUPERG,
 1776                     "[%s] ath ie change: new caps 0x%x defkeyix 0x%x\n",
 1777                     ether_sprintf(ni->ni_macaddr),
 1778                     ni->ni_ath_flags, ni->ni_ath_defkeyix);
 1779         }
 1780         if (IEEE80211_ATH_CAP(ic, ni, ATHEROS_CAP_TURBO_PRIME)) {
 1781                 uint16_t curflags, newflags;
 1782 
 1783                 /*
 1784                  * Check for turbo mode switch.  Calculate flags
 1785                  * for the new mode and effect the switch.
 1786                  */
 1787                 newflags = curflags = ic->ic_bsschan->ic_flags;
 1788                 /* NB: BOOST is not in ic_flags, so get it from the ie */
 1789                 if (ath->ath_capability & ATHEROS_CAP_BOOST) 
 1790                         newflags |= IEEE80211_CHAN_TURBO;
 1791                 else
 1792                         newflags &= ~IEEE80211_CHAN_TURBO;
 1793                 if (newflags != curflags)
 1794                         ieee80211_dturbo_switch(ic, newflags);
 1795         }
 1796         return capschanged;
 1797 }
 1798 
 1799 void
 1800 ieee80211_parse_ath(struct ieee80211_node *ni, uint8_t *ie)
 1801 {
 1802         const struct ieee80211_ath_ie *ath =
 1803                 (const struct ieee80211_ath_ie *) ie;
 1804 
 1805         ni->ni_ath_flags = ath->ath_capability;
 1806         ni->ni_ath_defkeyix = LE_READ_2(&ath->ath_defkeyix);
 1807 }
 1808 
 1809 /* XXX find a better place for definition */
 1810 struct l2_update_frame {
 1811         struct ether_header eh;
 1812         uint8_t dsap;
 1813         uint8_t ssap;
 1814         uint8_t control;
 1815         uint8_t xid[3];
 1816 }  __packed;
 1817 
 1818 /*
 1819  * Deliver a TGf L2UF frame on behalf of a station.
 1820  * This primes any bridge when the station is roaming
 1821  * between ap's on the same wired network.
 1822  */
 1823 static void
 1824 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
 1825 {
 1826         struct ieee80211com *ic = ni->ni_ic;
 1827         struct ifnet *ifp = ic->ic_ifp;
 1828         struct mbuf *m;
 1829         struct l2_update_frame *l2uf;
 1830         struct ether_header *eh;
 1831         
 1832         m = m_gethdr(M_NOWAIT, MT_DATA);
 1833         if (m == NULL) {
 1834                 IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
 1835                     "%s", "no mbuf for l2uf frame");
 1836                 ic->ic_stats.is_rx_nobuf++;     /* XXX not right */
 1837                 return;
 1838         }
 1839         l2uf = mtod(m, struct l2_update_frame *);
 1840         eh = &l2uf->eh;
 1841         /* dst: Broadcast address */
 1842         IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
 1843         /* src: associated STA */
 1844         IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
 1845         eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
 1846         
 1847         l2uf->dsap = 0;
 1848         l2uf->ssap = 0;
 1849         l2uf->control = 0xf5;
 1850         l2uf->xid[0] = 0x81;
 1851         l2uf->xid[1] = 0x80;
 1852         l2uf->xid[2] = 0x00;
 1853         
 1854         m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
 1855         ieee80211_deliver_data(ic, ni, m);
 1856 }
 1857 
 1858 static __inline int
 1859 contbgscan(struct ieee80211com *ic)
 1860 {
 1861         return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
 1862             time_after(ticks, ic->ic_lastdata + ic->ic_bgscanidle));
 1863 }
 1864 
 1865 static __inline int
 1866 startbgscan(struct ieee80211com *ic)
 1867 {
 1868         return ((ic->ic_flags & IEEE80211_F_BGSCAN) &&
 1869             !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
 1870             time_after(ticks, ic->ic_lastscan + ic->ic_bgscanintvl) &&
 1871             time_after(ticks, ic->ic_lastdata + ic->ic_bgscanidle));
 1872 }
 1873 
 1874 static void
 1875 ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
 1876         int reassoc, int resp, const char *tag, int rate)
 1877 {
 1878         struct ieee80211com *ic = ni->ni_ic;
 1879 
 1880         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
 1881             "[%s] deny %s request, %s rate set mismatch, rate 0x%x\n",
 1882             ether_sprintf(wh->i_addr2),
 1883             reassoc ? "reassoc" : "assoc", tag, rate);
 1884         IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_BASIC_RATE);
 1885         ieee80211_node_leave(ic, ni);
 1886         ic->ic_stats.is_rx_assoc_norate++;
 1887 }
 1888 
 1889 static void
 1890 capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
 1891         int reassoc, int resp, const char *tag, int capinfo)
 1892 {
 1893         struct ieee80211com *ic = ni->ni_ic;
 1894 
 1895         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
 1896             "[%s] deny %s request, %s mismatch 0x%x\n",
 1897             ether_sprintf(wh->i_addr2),
 1898             reassoc ? "reassoc" : "assoc", tag, capinfo);
 1899         IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_CAPINFO);
 1900         ieee80211_node_leave(ic, ni);
 1901         ic->ic_stats.is_rx_assoc_capmismatch++;
 1902 }
 1903 
 1904 static void
 1905 htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
 1906         int reassoc, int resp)
 1907 {
 1908         struct ieee80211com *ic = ni->ni_ic;
 1909 
 1910         IEEE80211_NOTE_MAC(ic, IEEE80211_MSG_ANY, wh->i_addr2,
 1911             "deny %s request, %s missing HT ie", reassoc ? "reassoc" : "assoc");
 1912         /* XXX no better code */
 1913         IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_OTHER);
 1914         ieee80211_node_leave(ic, ni);
 1915 }
 1916 
 1917 void
 1918 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
 1919         struct ieee80211_node *ni,
 1920         int subtype, int rssi, int noise, uint32_t rstamp)
 1921 {
 1922 #define ISPROBE(_st)    ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
 1923 #define ISREASSOC(_st)  ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
 1924         struct ieee80211_frame *wh;
 1925         uint8_t *frm, *efrm, *sfrm;
 1926         uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap, *htinfo;
 1927         int reassoc, resp, allocbs;
 1928         uint8_t rate;
 1929 
 1930         wh = mtod(m0, struct ieee80211_frame *);
 1931         frm = (uint8_t *)&wh[1];
 1932         efrm = mtod(m0, uint8_t *) + m0->m_len;
 1933         switch (subtype) {
 1934         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
 1935         case IEEE80211_FC0_SUBTYPE_BEACON: {
 1936                 struct ieee80211_scanparams scan;
 1937 
 1938                 /*
 1939                  * We process beacon/probe response frames:
 1940                  *    o when scanning, or
 1941                  *    o station mode when associated (to collect state
 1942                  *      updates such as 802.11g slot time), or
 1943                  *    o adhoc mode (to discover neighbors)
 1944                  * Frames otherwise received are discarded.
 1945                  */ 
 1946                 if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
 1947                       (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) ||
 1948                        ic->ic_opmode == IEEE80211_M_IBSS)) {
 1949                         ic->ic_stats.is_rx_mgtdiscard++;
 1950                         return;
 1951                 }
 1952                 /*
 1953                  * beacon/probe response frame format
 1954                  *      [8] time stamp
 1955                  *      [2] beacon interval
 1956                  *      [2] capability information
 1957                  *      [tlv] ssid
 1958                  *      [tlv] supported rates
 1959                  *      [tlv] country information
 1960                  *      [tlv] parameter set (FH/DS)
 1961                  *      [tlv] erp information
 1962                  *      [tlv] extended supported rates
 1963                  *      [tlv] WME
 1964                  *      [tlv] WPA or RSN
 1965                  *      [tlv] HT capabilities
 1966                  *      [tlv] HT information
 1967                  *      [tlv] Atheros capabilities
 1968                  */
 1969                 IEEE80211_VERIFY_LENGTH(efrm - frm, 12, return);
 1970                 memset(&scan, 0, sizeof(scan));
 1971                 scan.tstamp  = frm;                             frm += 8;
 1972                 scan.bintval = le16toh(*(uint16_t *)frm);       frm += 2;
 1973                 scan.capinfo = le16toh(*(uint16_t *)frm);       frm += 2;
 1974                 scan.bchan = IEEE80211_CHAN2IEEE(ic->ic_curchan);
 1975                 scan.curchan = ic->ic_curchan;
 1976                 scan.ies = frm;
 1977                 scan.ies_len = efrm - frm;
 1978 
 1979                 while (efrm - frm > 1) {
 1980                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 1981                         switch (*frm) {
 1982                         case IEEE80211_ELEMID_SSID:
 1983                                 scan.ssid = frm;
 1984                                 break;
 1985                         case IEEE80211_ELEMID_RATES:
 1986                                 scan.rates = frm;
 1987                                 break;
 1988                         case IEEE80211_ELEMID_COUNTRY:
 1989                                 scan.country = frm;
 1990                                 break;
 1991                         case IEEE80211_ELEMID_FHPARMS:
 1992                                 if (ic->ic_phytype == IEEE80211_T_FH) {
 1993                                         scan.fhdwell = LE_READ_2(&frm[2]);
 1994                                         scan.bchan = IEEE80211_FH_CHAN(frm[4], frm[5]);
 1995                                         scan.fhindex = frm[6];
 1996                                 }
 1997                                 break;
 1998                         case IEEE80211_ELEMID_DSPARMS:
 1999                                 /*
 2000                                  * XXX hack this since depending on phytype
 2001                                  * is problematic for multi-mode devices.
 2002                                  */
 2003                                 if (ic->ic_phytype != IEEE80211_T_FH)
 2004                                         scan.bchan = frm[2];
 2005                                 break;
 2006                         case IEEE80211_ELEMID_TIM:
 2007                                 /* XXX ATIM? */
 2008                                 scan.tim = frm;
 2009                                 scan.timoff = frm - mtod(m0, uint8_t *);
 2010                                 break;
 2011                         case IEEE80211_ELEMID_IBSSPARMS:
 2012                                 break;
 2013                         case IEEE80211_ELEMID_XRATES:
 2014                                 scan.xrates = frm;
 2015                                 break;
 2016                         case IEEE80211_ELEMID_ERP:
 2017                                 if (frm[1] != 1) {
 2018                                         IEEE80211_DISCARD_IE(ic,
 2019                                             IEEE80211_MSG_ELEMID, wh, "ERP",
 2020                                             "bad len %u", frm[1]);
 2021                                         ic->ic_stats.is_rx_elem_toobig++;
 2022                                         break;
 2023                                 }
 2024                                 scan.erp = frm[2];
 2025                                 break;
 2026                         case IEEE80211_ELEMID_HTCAP:
 2027                                 scan.htcap = frm;
 2028                                 break;
 2029                         case IEEE80211_ELEMID_RSN:
 2030                                 scan.rsn = frm;
 2031                                 break;
 2032                         case IEEE80211_ELEMID_HTINFO:
 2033                                 scan.htinfo = frm;
 2034                                 break;
 2035                         case IEEE80211_ELEMID_VENDOR:
 2036                                 if (iswpaoui(frm))
 2037                                         scan.wpa = frm;
 2038                                 else if (iswmeparam(frm) || iswmeinfo(frm))
 2039                                         scan.wme = frm;
 2040                                 else if (isatherosoui(frm))
 2041                                         scan.ath = frm;
 2042                                 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
 2043                                         /*
 2044                                          * Accept pre-draft HT ie's if the
 2045                                          * standard ones have not been seen.
 2046                                          */
 2047                                         if (ishtcapoui(frm)) {
 2048                                                 if (scan.htcap == NULL)
 2049                                                         scan.htcap = frm;
 2050                                         } else if (ishtinfooui(frm)) {
 2051                                                 if (scan.htinfo == NULL)
 2052                                                         scan.htcap = frm;
 2053                                         }
 2054                                 }
 2055                                 break;
 2056                         default:
 2057                                 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID,
 2058                                     wh, "unhandled",
 2059                                     "id %u, len %u", *frm, frm[1]);
 2060                                 ic->ic_stats.is_rx_elem_unknown++;
 2061                                 break;
 2062                         }
 2063                         frm += frm[1] + 2;
 2064                 }
 2065                 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
 2066                 if (scan.xrates != NULL)
 2067                         IEEE80211_VERIFY_ELEMENT(scan.xrates,
 2068                                 IEEE80211_RATE_MAXSIZE - scan.rates[1]);
 2069                 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
 2070 #if IEEE80211_CHAN_MAX < 255
 2071                 if (scan.chan > IEEE80211_CHAN_MAX) {
 2072                         IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,
 2073                             wh, ieee80211_mgt_subtype_name[subtype >>
 2074                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 2075                             "invalid channel %u", scan.chan);
 2076                         ic->ic_stats.is_rx_badchan++;
 2077                         return;
 2078                 }
 2079 #endif
 2080                 if (IEEE80211_CHAN2IEEE(scan.curchan) != scan.bchan &&
 2081                     ic->ic_phytype != IEEE80211_T_FH) {
 2082                         /*
 2083                          * Frame was received on a channel different from the
 2084                          * one indicated in the DS params element id;
 2085                          * silently discard it.
 2086                          *
 2087                          * NB: this can happen due to signal leakage.
 2088                          *     But we should take it for FH phy because
 2089                          *     the rssi value should be correct even for
 2090                          *     different hop pattern in FH.
 2091                          */
 2092                         IEEE80211_DISCARD(ic,
 2093                             IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
 2094                             wh, ieee80211_mgt_subtype_name[subtype >>
 2095                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 2096                             "for off-channel %u",
 2097                             IEEE80211_CHAN2IEEE(scan.curchan));
 2098                         ic->ic_stats.is_rx_chanmismatch++;
 2099                         return;
 2100                 }
 2101                 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
 2102                       scan.bintval <= IEEE80211_BINTVAL_MAX)) {
 2103                         IEEE80211_DISCARD(ic,
 2104                             IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
 2105                             wh, ieee80211_mgt_subtype_name[subtype >>
 2106                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 2107                             "bogus beacon interval", scan.bintval);
 2108                         ic->ic_stats.is_rx_badbintval++;
 2109                         return;
 2110                 }
 2111                 /*
 2112                  * Process HT ie's.  This is complicated by our
 2113                  * accepting both the standard ie's and the pre-draft
 2114                  * vendor OUI ie's that some vendors still use/require.
 2115                  */
 2116                 if (scan.htcap != NULL) {
 2117                         IEEE80211_VERIFY_LENGTH(scan.htcap[1],
 2118                              scan.htcap[0] == IEEE80211_ELEMID_VENDOR ?
 2119                                  4 + sizeof(struct ieee80211_ie_htcap)-2 :
 2120                                  sizeof(struct ieee80211_ie_htcap)-2,
 2121                              scan.htcap = NULL);
 2122                 }
 2123                 if (scan.htinfo != NULL) {
 2124                         IEEE80211_VERIFY_LENGTH(scan.htinfo[1],
 2125                              scan.htinfo[0] == IEEE80211_ELEMID_VENDOR ?
 2126                                  4 + sizeof(struct ieee80211_ie_htinfo)-2 :
 2127                                  sizeof(struct ieee80211_ie_htinfo)-2,
 2128                              scan.htinfo = NULL);
 2129                 }
 2130 
 2131                 /*
 2132                  * Count frame now that we know it's to be processed.
 2133                  */
 2134                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
 2135                         ic->ic_stats.is_rx_beacon++;            /* XXX remove */
 2136                         IEEE80211_NODE_STAT(ni, rx_beacons);
 2137                 } else
 2138                         IEEE80211_NODE_STAT(ni, rx_proberesp);
 2139 
 2140                 /*
 2141                  * When operating in station mode, check for state updates.
 2142                  * Be careful to ignore beacons received while doing a
 2143                  * background scan.  We consider only 11g/WMM stuff right now.
 2144                  */
 2145                 if (ic->ic_opmode == IEEE80211_M_STA &&
 2146                     ni->ni_associd != 0 &&
 2147                     ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
 2148                      IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
 2149                         /* record tsf of last beacon */
 2150                         memcpy(ni->ni_tstamp.data, scan.tstamp,
 2151                                 sizeof(ni->ni_tstamp));
 2152                         /* count beacon frame for s/w bmiss handling */
 2153                         ic->ic_swbmiss_count++;
 2154                         ic->ic_bmiss_count = 0;
 2155                         if (ni->ni_erp != scan.erp) {
 2156                                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
 2157                                     "[%s] erp change: was 0x%x, now 0x%x\n",
 2158                                     ether_sprintf(wh->i_addr2),
 2159                                     ni->ni_erp, scan.erp);
 2160                                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
 2161                                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
 2162                                         ic->ic_flags |= IEEE80211_F_USEPROT;
 2163                                 else
 2164                                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
 2165                                 ni->ni_erp = scan.erp;
 2166                                 /* XXX statistic */
 2167                         }
 2168                         if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
 2169                                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
 2170                                     "[%s] capabilities change: before 0x%x,"
 2171                                      " now 0x%x\n",
 2172                                      ether_sprintf(wh->i_addr2),
 2173                                      ni->ni_capinfo, scan.capinfo);
 2174                                 /*
 2175                                  * NB: we assume short preamble doesn't
 2176                                  *     change dynamically
 2177                                  */
 2178                                 ieee80211_set_shortslottime(ic,
 2179                                         IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
 2180                                         (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
 2181                                 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
 2182                                                | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
 2183                                 /* XXX statistic */
 2184                         }
 2185                         if (scan.wme != NULL &&
 2186                             (ni->ni_flags & IEEE80211_NODE_QOS) &&
 2187                             ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0)
 2188                                 ieee80211_wme_updateparams(ic);
 2189                         if (scan.ath != NULL)
 2190                                 ieee80211_parse_athparams(ni, scan.ath, wh);
 2191                         if (scan.htcap != NULL)
 2192                                 ieee80211_parse_htcap(ni, scan.htcap);
 2193                         if (scan.htinfo != NULL) {
 2194                                 ieee80211_parse_htinfo(ni, scan.htinfo);
 2195                                 if (ni->ni_chan != ic->ic_bsschan) {
 2196                                         /*
 2197                                          * Channel has been adjusted based on
 2198                                          * negotiated HT parameters; force the
 2199                                          * channel state to follow.
 2200                                          */
 2201                                         ieee80211_setbsschan(ic, ni->ni_chan);
 2202                                 }
 2203                         }
 2204                         if (scan.tim != NULL) {
 2205                                 struct ieee80211_tim_ie *tim =
 2206                                     (struct ieee80211_tim_ie *) scan.tim;
 2207 #if 0
 2208                                 int aid = IEEE80211_AID(ni->ni_associd);
 2209                                 int ix = aid / NBBY;
 2210                                 int min = tim->tim_bitctl &~ 1;
 2211                                 int max = tim->tim_len + min - 4;
 2212                                 if ((tim->tim_bitctl&1) ||
 2213                                     (min <= ix && ix <= max &&
 2214                                      isset(tim->tim_bitmap - min, aid))) {
 2215                                         /* 
 2216                                          * XXX Do not let bg scan kick off
 2217                                          * we are expecting data.
 2218                                          */
 2219                                         ic->ic_lastdata = ticks;
 2220                                         ieee80211_sta_pwrsave(ic, 0);
 2221                                 }
 2222 #endif
 2223                                 ni->ni_dtim_count = tim->tim_count;
 2224                                 ni->ni_dtim_period = tim->tim_period;
 2225                         }
 2226                         /*
 2227                          * If scanning, pass the info to the scan module.
 2228                          * Otherwise, check if it's the right time to do
 2229                          * a background scan.  Background scanning must
 2230                          * be enabled and we must not be operating in the
 2231                          * turbo phase of dynamic turbo mode.  Then,
 2232                          * it's been a while since the last background
 2233                          * scan and if no data frames have come through
 2234                          * recently, kick off a scan.  Note that this
 2235                          * is the mechanism by which a background scan
 2236                          * is started _and_ continued each time we
 2237                          * return on-channel to receive a beacon from
 2238                          * our ap.
 2239                          */
 2240                         if (ic->ic_flags & IEEE80211_F_SCAN) {
 2241                                 ieee80211_add_scan(ic, &scan, wh,
 2242                                         subtype, rssi, noise, rstamp);
 2243                         } else if (contbgscan(ic)) {
 2244                                 ieee80211_bg_scan(ic);
 2245                         } else if (startbgscan(ic)) {
 2246 #if 0
 2247                                 /* wakeup if we are sleeing */
 2248                                 ieee80211_set_pwrsave(ic, 0);
 2249 #endif
 2250                                 ieee80211_bg_scan(ic);
 2251                         }
 2252                         return;
 2253                 }
 2254                 /*
 2255                  * If scanning, just pass information to the scan module.
 2256                  */
 2257                 if (ic->ic_flags & IEEE80211_F_SCAN) {
 2258                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
 2259                                 /*
 2260                                  * Actively scanning a channel marked passive;
 2261                                  * send a probe request now that we know there
 2262                                  * is 802.11 traffic present.
 2263                                  *
 2264                                  * XXX check if the beacon we recv'd gives
 2265                                  * us what we need and suppress the probe req
 2266                                  */
 2267                                 ieee80211_probe_curchan(ic, 1);
 2268                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 2269                         }
 2270                         ieee80211_add_scan(ic, &scan, wh,
 2271                                 subtype, rssi, noise, rstamp);
 2272                         return;
 2273                 }
 2274                 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
 2275                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
 2276                                 /*
 2277                                  * Create a new entry in the neighbor table.
 2278                                  */
 2279                                 ni = ieee80211_add_neighbor(ic, wh, &scan);
 2280                         } else if (ni->ni_capinfo == 0) {
 2281                                 /*
 2282                                  * Update faked node created on transmit.
 2283                                  * Note this also updates the tsf.
 2284                                  */
 2285                                 ieee80211_init_neighbor(ni, wh, &scan);
 2286                         } else {
 2287                                 /*
 2288                                  * Record tsf for potential resync.
 2289                                  */
 2290                                 memcpy(ni->ni_tstamp.data, scan.tstamp,
 2291                                         sizeof(ni->ni_tstamp));
 2292                         }
 2293                         if (ni != NULL) {
 2294                                 ni->ni_rssi = rssi;
 2295                                 ni->ni_noise = noise;
 2296                                 ni->ni_rstamp = rstamp;
 2297                         }
 2298                 }
 2299                 break;
 2300         }
 2301 
 2302         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 2303                 if (ic->ic_opmode == IEEE80211_M_STA ||
 2304                     ic->ic_state != IEEE80211_S_RUN) {
 2305                         ic->ic_stats.is_rx_mgtdiscard++;
 2306                         return;
 2307                 }
 2308                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
 2309                         /* frame must be directed */
 2310                         ic->ic_stats.is_rx_mgtdiscard++;        /* XXX stat */
 2311                         return;
 2312                 }
 2313 
 2314                 /*
 2315                  * prreq frame format
 2316                  *      [tlv] ssid
 2317                  *      [tlv] supported rates
 2318                  *      [tlv] extended supported rates
 2319                  */
 2320                 ssid = rates = xrates = NULL;
 2321                 while (efrm - frm > 1) {
 2322                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 2323                         switch (*frm) {
 2324                         case IEEE80211_ELEMID_SSID:
 2325                                 ssid = frm;
 2326                                 break;
 2327                         case IEEE80211_ELEMID_RATES:
 2328                                 rates = frm;
 2329                                 break;
 2330                         case IEEE80211_ELEMID_XRATES:
 2331                                 xrates = frm;
 2332                                 break;
 2333                         }
 2334                         frm += frm[1] + 2;
 2335                 }
 2336                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
 2337                 if (xrates != NULL)
 2338                         IEEE80211_VERIFY_ELEMENT(xrates,
 2339                                 IEEE80211_RATE_MAXSIZE - rates[1]);
 2340                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
 2341                 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
 2342                 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
 2343                         IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 2344                             wh, ieee80211_mgt_subtype_name[subtype >>
 2345                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 2346                             "%s", "no ssid with ssid suppression enabled");
 2347                         ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/
 2348                         return;
 2349                 }
 2350 
 2351                 allocbs = 0;
 2352                 if (ni == ic->ic_bss) {
 2353                         if (ic->ic_opmode != IEEE80211_M_IBSS) {
 2354                                 ni = ieee80211_tmp_node(ic, wh->i_addr2);
 2355                                 allocbs = 1;
 2356                         } else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
 2357                                 /*
 2358                                  * XXX Cannot tell if the sender is operating
 2359                                  * in ibss mode.  But we need a new node to
 2360                                  * send the response so blindly add them to the
 2361                                  * neighbor table.
 2362                                  */
 2363                                 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
 2364                                         wh->i_addr2);
 2365                         }
 2366                         if (ni == NULL)
 2367                                 return;
 2368                 }
 2369                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
 2370                     "[%s] recv probe req\n", ether_sprintf(wh->i_addr2));
 2371                 ni->ni_rssi = rssi;
 2372                 ni->ni_rstamp = rstamp;
 2373                 rate = ieee80211_setup_rates(ni, rates, xrates,
 2374                           IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE
 2375                         | IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
 2376                 if (rate & IEEE80211_RATE_BASIC) {
 2377                         IEEE80211_DISCARD(ic, IEEE80211_MSG_XRATE,
 2378                             wh, ieee80211_mgt_subtype_name[subtype >>
 2379                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 2380                             "%s", "recv'd rate set invalid");
 2381                 } else {
 2382                         IEEE80211_SEND_MGMT(ic, ni,
 2383                                 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
 2384                 }
 2385                 if (allocbs) {
 2386                         /*
 2387                          * Temporary node created just to send a
 2388                          * response, reclaim immediately.
 2389                          */
 2390                         ieee80211_free_node(ni);
 2391                 }
 2392                 break;
 2393 
 2394         case IEEE80211_FC0_SUBTYPE_AUTH: {
 2395                 uint16_t algo, seq, status;
 2396                 /*
 2397                  * auth frame format
 2398                  *      [2] algorithm
 2399                  *      [2] sequence
 2400                  *      [2] status
 2401                  *      [tlv*] challenge
 2402                  */
 2403                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
 2404                 algo   = le16toh(*(uint16_t *)frm);
 2405                 seq    = le16toh(*(uint16_t *)(frm + 2));
 2406                 status = le16toh(*(uint16_t *)(frm + 4));
 2407                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
 2408                     "[%s] recv auth frame with algorithm %d seq %d\n",
 2409                     ether_sprintf(wh->i_addr2), algo, seq);
 2410                 /*
 2411                  * Consult the ACL policy module if setup.
 2412                  */
 2413                 if (ic->ic_acl != NULL &&
 2414                     !ic->ic_acl->iac_check(ic, wh->i_addr2)) {
 2415                         IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL,
 2416                             wh, "auth", "%s", "disallowed by ACL");
 2417                         ic->ic_stats.is_rx_acl++;
 2418                         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 2419                                 IEEE80211_SEND_MGMT(ic, ni,
 2420                                     IEEE80211_FC0_SUBTYPE_AUTH,
 2421                                     (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
 2422                         }
 2423                         return;
 2424                 }
 2425                 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
 2426                         IEEE80211_DISCARD(ic,
 2427                             IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
 2428                             wh, "auth", "%s", "TKIP countermeasures enabled");
 2429                         ic->ic_stats.is_rx_auth_countermeasures++;
 2430                         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 2431                                 IEEE80211_SEND_MGMT(ic, ni,
 2432                                         IEEE80211_FC0_SUBTYPE_AUTH,
 2433                                         IEEE80211_REASON_MIC_FAILURE);
 2434                         }
 2435                         return;
 2436                 }
 2437                 if (algo == IEEE80211_AUTH_ALG_SHARED)
 2438                         ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi,
 2439                             noise, rstamp, seq, status);
 2440                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
 2441                         ieee80211_auth_open(ic, wh, ni, rssi, noise, rstamp,
 2442                             seq, status);
 2443                 else {
 2444                         IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
 2445                             wh, "auth", "unsupported alg %d", algo);
 2446                         ic->ic_stats.is_rx_auth_unsupported++;
 2447                         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 2448                                 /* XXX not right */
 2449                                 IEEE80211_SEND_MGMT(ic, ni,
 2450                                         IEEE80211_FC0_SUBTYPE_AUTH,
 2451                                         (seq+1) | (IEEE80211_STATUS_ALG<<16));
 2452                         }
 2453                         return;
 2454                 } 
 2455                 break;
 2456         }
 2457 
 2458         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
 2459         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
 2460                 uint16_t capinfo, lintval;
 2461                 struct ieee80211_rsnparms rsnparms;
 2462                 uint8_t reason;
 2463                 int badwparsn;
 2464 
 2465                 if (ic->ic_opmode != IEEE80211_M_HOSTAP ||
 2466                     ic->ic_state != IEEE80211_S_RUN) {
 2467                         ic->ic_stats.is_rx_mgtdiscard++;
 2468                         return;
 2469                 }
 2470 
 2471                 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
 2472                         reassoc = 1;
 2473                         resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
 2474                 } else {
 2475                         reassoc = 0;
 2476                         resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
 2477                 }
 2478                 /*
 2479                  * asreq frame format
 2480                  *      [2] capability information
 2481                  *      [2] listen interval
 2482                  *      [6*] current AP address (reassoc only)
 2483                  *      [tlv] ssid
 2484                  *      [tlv] supported rates
 2485                  *      [tlv] extended supported rates
 2486                  *      [tlv] WPA or RSN
 2487                  *      [tlv] HT capabilities
 2488                  *      [tlv] Atheros capabilities
 2489                  */
 2490                 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
 2491                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) {
 2492                         IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
 2493                             wh, ieee80211_mgt_subtype_name[subtype >>
 2494                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 2495                             "%s", "wrong bssid");
 2496                         ic->ic_stats.is_rx_assoc_bss++;
 2497                         return;
 2498                 }
 2499                 capinfo = le16toh(*(uint16_t *)frm);    frm += 2;
 2500                 lintval = le16toh(*(uint16_t *)frm);    frm += 2;
 2501                 if (reassoc)
 2502                         frm += 6;       /* ignore current AP info */
 2503                 ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL;
 2504                 sfrm = frm;
 2505                 while (efrm - frm > 1) {
 2506                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 2507                         switch (*frm) {
 2508                         case IEEE80211_ELEMID_SSID:
 2509                                 ssid = frm;
 2510                                 break;
 2511                         case IEEE80211_ELEMID_RATES:
 2512                                 rates = frm;
 2513                                 break;
 2514                         case IEEE80211_ELEMID_XRATES:
 2515                                 xrates = frm;
 2516                                 break;
 2517                         /* XXX verify only one of RSN and WPA ie's? */
 2518                         case IEEE80211_ELEMID_RSN:
 2519                                 rsn = frm;
 2520                                 break;
 2521                         case IEEE80211_ELEMID_HTCAP:
 2522                                 htcap = frm;
 2523                                 break;
 2524                         case IEEE80211_ELEMID_VENDOR:
 2525                                 if (iswpaoui(frm))
 2526                                         wpa = frm;
 2527                                 else if (iswmeinfo(frm))
 2528                                         wme = frm;
 2529                                 else if (isatherosoui(frm))
 2530                                         ath = frm;
 2531                                 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
 2532                                         if (ishtcapoui(frm) && htcap == NULL)
 2533                                                 htcap = frm;
 2534                                 }
 2535                                 break;
 2536                         }
 2537                         frm += frm[1] + 2;
 2538                 }
 2539                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
 2540                 if (xrates != NULL)
 2541                         IEEE80211_VERIFY_ELEMENT(xrates,
 2542                                 IEEE80211_RATE_MAXSIZE - rates[1]);
 2543                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
 2544                 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
 2545                 if (htcap != NULL) {
 2546                         IEEE80211_VERIFY_LENGTH(htcap[1],
 2547                              htcap[0] == IEEE80211_ELEMID_VENDOR ?
 2548                                  4 + sizeof(struct ieee80211_ie_htcap)-2 :
 2549                                  sizeof(struct ieee80211_ie_htcap)-2,
 2550                              return);           /* XXX just NULL out? */
 2551                 }
 2552 
 2553                 if (ni == ic->ic_bss) {
 2554                         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
 2555                             "[%s] deny %s request, sta not authenticated\n",
 2556                             ether_sprintf(wh->i_addr2),
 2557                             reassoc ? "reassoc" : "assoc");
 2558                         ieee80211_send_error(ic, ni, wh->i_addr2,
 2559                             IEEE80211_FC0_SUBTYPE_DEAUTH,
 2560                             IEEE80211_REASON_ASSOC_NOT_AUTHED);
 2561                         ic->ic_stats.is_rx_assoc_notauth++;
 2562                         return;
 2563                 }
 2564                 /* assert right association security credentials */
 2565                 badwparsn = 0;
 2566                 switch (ic->ic_flags & IEEE80211_F_WPA) {
 2567                 case IEEE80211_F_WPA1:
 2568                         if (wpa == NULL)
 2569                                 badwparsn = 1;
 2570                         break;
 2571                 case IEEE80211_F_WPA2:
 2572                         if (rsn == NULL)
 2573                                 badwparsn = 1;
 2574                         break;
 2575                 case IEEE80211_F_WPA1|IEEE80211_F_WPA2:
 2576                         if (wpa == NULL && rsn == NULL)
 2577                                 badwparsn = 1;
 2578                         break;
 2579                 }
 2580                 if (badwparsn) {
 2581                         IEEE80211_DPRINTF(ic,
 2582                             IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
 2583                             "[%s] no WPA/RSN IE in association request\n",
 2584                             ether_sprintf(wh->i_addr2));
 2585                         IEEE80211_SEND_MGMT(ic, ni,
 2586                             IEEE80211_FC0_SUBTYPE_DEAUTH,
 2587                             IEEE80211_REASON_IE_INVALID);
 2588                         ieee80211_node_leave(ic, ni);
 2589                         ic->ic_stats.is_rx_assoc_badwpaie++;
 2590                         return;
 2591                 }
 2592                 if (wpa != NULL || rsn != NULL) {
 2593                         /*
 2594                          * Parse WPA/RSN information element.  Note that
 2595                          * we initialize the param block from the node
 2596                          * state so that information in the IE overrides
 2597                          * our defaults.  The resulting parameters are
 2598                          * installed below after the association is assured.
 2599                          */
 2600                         rsnparms = ni->ni_rsn;
 2601                         if (wpa != NULL)
 2602                                 reason = ieee80211_parse_wpa(ic, wpa, &rsnparms, wh);
 2603                         else
 2604                                 reason = ieee80211_parse_rsn(ic, rsn, &rsnparms, wh);
 2605                         if (reason != 0) {
 2606                                 IEEE80211_SEND_MGMT(ic, ni,
 2607                                     IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
 2608                                 ieee80211_node_leave(ic, ni);
 2609                                 /* XXX distinguish WPA/RSN? */
 2610                                 ic->ic_stats.is_rx_assoc_badwpaie++;
 2611                                 return;
 2612                         }
 2613                         IEEE80211_DPRINTF(ic,
 2614                             IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
 2615                             "[%s] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n",
 2616                             ether_sprintf(wh->i_addr2),
 2617                             wpa != NULL ? "WPA" : "RSN",
 2618                             rsnparms.rsn_mcastcipher, rsnparms.rsn_mcastkeylen,
 2619                             rsnparms.rsn_ucastcipher, rsnparms.rsn_ucastkeylen,
 2620                             rsnparms.rsn_keymgmt, rsnparms.rsn_caps);
 2621                 }
 2622                 /* discard challenge after association */
 2623                 if (ni->ni_challenge != NULL) {
 2624                         FREE(ni->ni_challenge, M_80211_NODE);
 2625                         ni->ni_challenge = NULL;
 2626                 }
 2627                 /* NB: 802.11 spec says to ignore station's privacy bit */
 2628                 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
 2629                         capinfomismatch(ni, wh, reassoc, resp,
 2630                             "capability", capinfo);
 2631                         return;
 2632                 }
 2633                 /*
 2634                  * Disallow re-associate w/ invalid slot time setting.
 2635                  */
 2636                 if (ni->ni_associd != 0 &&
 2637                     IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
 2638                     ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
 2639                         capinfomismatch(ni, wh, reassoc, resp,
 2640                             "slot time", capinfo);
 2641                         return;
 2642                 }
 2643                 rate = ieee80211_setup_rates(ni, rates, xrates,
 2644                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
 2645                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
 2646                 if (rate & IEEE80211_RATE_BASIC) {
 2647                         ratesetmismatch(ni, wh, reassoc, resp, "basic", rate);
 2648                         return;
 2649                 }
 2650                 /*
 2651                  * If constrained to 11g-only stations reject an
 2652                  * 11b-only station.  We cheat a bit here by looking
 2653                  * at the max negotiated xmit rate and assuming anyone
 2654                  * with a best rate <24Mb/s is an 11b station.
 2655                  */
 2656                 if ((ic->ic_flags & IEEE80211_F_PUREG) && rate < 48) {
 2657                         ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);
 2658                         return;
 2659                 }
 2660                 /* XXX enforce PUREN */
 2661                 /* 802.11n-specific rateset handling */
 2662                 if (IEEE80211_IS_CHAN_HT(ic->ic_curchan) && htcap != NULL) {
 2663                         rate = ieee80211_setup_htrates(ni, htcap,
 2664                                 IEEE80211_F_DOFRATE | IEEE80211_F_DONEGO |
 2665                                 IEEE80211_F_DOBRS);
 2666                         if (rate & IEEE80211_RATE_BASIC) {
 2667                                 /* XXX 11n-specific stat */
 2668                                 ratesetmismatch(ni, wh, reassoc, resp,
 2669                                     "HT", rate);
 2670                                 return;
 2671                         }
 2672                         ieee80211_ht_node_init(ni, htcap);
 2673                 } else if (ni->ni_flags & IEEE80211_NODE_HT)
 2674                         ieee80211_ht_node_cleanup(ni);
 2675                 /*
 2676                  * Allow AMPDU operation only with unencrypted traffic
 2677                  * or AES-CCM; the 11n spec only specifies these ciphers
 2678                  * so permitting any others is undefined and can lead
 2679                  * to interoperability problems.
 2680                  *
 2681                  * NB: We check for AES by looking at the GTK cipher
 2682                  *     since the WPA/11i specs say the PTK cipher has
 2683                  *     to be "as good or better".
 2684                  */
 2685                 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
 2686                     (((ic->ic_flags & IEEE80211_F_WPA) &&
 2687                       rsnparms.rsn_mcastcipher != IEEE80211_CIPHER_AES_CCM) ||
 2688                      (ic->ic_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) {
 2689                         IEEE80211_NOTE(ic,
 2690                             IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
 2691                             "disallow HT use because WEP or TKIP requested, "
 2692                             "capinfo 0x%x mcastcipher %d", capinfo,
 2693                             rsnparms.rsn_mcastcipher);
 2694                         ieee80211_ht_node_cleanup(ni);
 2695                         ic->ic_stats.is_ht_assoc_downgrade++;
 2696                 }
 2697                 /*
 2698                  * If constrained to 11n-only stations reject legacy stations.
 2699                  */
 2700                 if ((ic->ic_flags_ext & IEEE80211_FEXT_PUREN) &&
 2701                     (ni->ni_flags & IEEE80211_NODE_HT) == 0) {
 2702                         htcapmismatch(ni, wh, reassoc, resp);
 2703                         ic->ic_stats.is_ht_assoc_nohtcap++;
 2704                         return;
 2705                 }
 2706                 ni->ni_rssi = rssi;
 2707                 ni->ni_noise = noise;
 2708                 ni->ni_rstamp = rstamp;
 2709                 ni->ni_intval = lintval;
 2710                 ni->ni_capinfo = capinfo;
 2711                 ni->ni_chan = ic->ic_bsschan;
 2712                 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell;
 2713                 ni->ni_fhindex = ic->ic_bss->ni_fhindex;
 2714                 /*
 2715                  * Store the IEs.
 2716                  * XXX maybe better to just expand
 2717                  */
 2718                 if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {
 2719 #define setie(_ie, _off)        ieee80211_ies_setie(ni->ni_ies, _ie, _off)
 2720                         if (wpa != NULL) {
 2721                                 setie(wpa_ie, wpa - sfrm);
 2722                                 ni->ni_rsn = rsnparms;
 2723                         }
 2724                         if (rsn != NULL) {
 2725                                 setie(rsn_ie, rsn - sfrm);
 2726                                 ni->ni_rsn = rsnparms;
 2727                         }
 2728                         if (htcap != NULL)
 2729                                 setie(htcap_ie, htcap - sfrm);
 2730                         if (wme != NULL) {
 2731                                 setie(wme_ie, wme - sfrm);
 2732                                 /*
 2733                                  * Mark node as capable of QoS.
 2734                                  */
 2735                                 ni->ni_flags |= IEEE80211_NODE_QOS;
 2736                         } else
 2737                                 ni->ni_flags &= ~IEEE80211_NODE_QOS;
 2738                         if (ath != NULL) {
 2739                                 setie(ath_ie, ath - sfrm);
 2740                                 /* 
 2741                                  * Parse ATH station parameters.
 2742                                  */
 2743                                 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
 2744                         } else
 2745                                 ni->ni_ath_flags = 0;
 2746 #undef setie
 2747                 } else {
 2748                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
 2749                         ni->ni_ath_flags = 0;
 2750                 }
 2751                 ieee80211_node_join(ic, ni, resp);
 2752                 ieee80211_deliver_l2uf(ni);
 2753                 break;
 2754         }
 2755 
 2756         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
 2757         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
 2758                 uint16_t capinfo, associd;
 2759                 uint16_t status;
 2760 
 2761                 if (ic->ic_opmode != IEEE80211_M_STA ||
 2762                     ic->ic_state != IEEE80211_S_ASSOC) {
 2763                         ic->ic_stats.is_rx_mgtdiscard++;
 2764                         return;
 2765                 }
 2766 
 2767                 /*
 2768                  * asresp frame format
 2769                  *      [2] capability information
 2770                  *      [2] status
 2771                  *      [2] association ID
 2772                  *      [tlv] supported rates
 2773                  *      [tlv] extended supported rates
 2774                  *      [tlv] WME
 2775                  *      [tlv] HT capabilities
 2776                  *      [tlv] HT info
 2777                  */
 2778                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
 2779                 ni = ic->ic_bss;
 2780                 capinfo = le16toh(*(uint16_t *)frm);
 2781                 frm += 2;
 2782                 status = le16toh(*(uint16_t *)frm);
 2783                 frm += 2;
 2784                 if (status != 0) {
 2785                         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
 2786                             "[%s] %sassoc failed (reason %d)\n",
 2787                             ether_sprintf(wh->i_addr2),
 2788                             ISREASSOC(subtype) ?  "re" : "", status);
 2789                         if (ni != ic->ic_bss)   /* XXX never true? */
 2790                                 ni->ni_fails++;
 2791                         ic->ic_stats.is_rx_auth_fail++; /* XXX */
 2792                         return;
 2793                 }
 2794                 associd = le16toh(*(uint16_t *)frm);
 2795                 frm += 2;
 2796 
 2797                 rates = xrates = wme = htcap = htinfo = NULL;
 2798                 while (efrm - frm > 1) {
 2799                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 2800                         switch (*frm) {
 2801                         case IEEE80211_ELEMID_RATES:
 2802                                 rates = frm;
 2803                                 break;
 2804                         case IEEE80211_ELEMID_XRATES:
 2805                                 xrates = frm;
 2806                                 break;
 2807                         case IEEE80211_ELEMID_HTCAP:
 2808                                 htcap = frm;
 2809                                 break;
 2810                         case IEEE80211_ELEMID_HTINFO:
 2811                                 htinfo = frm;
 2812                                 break;
 2813                         case IEEE80211_ELEMID_VENDOR:
 2814                                 if (iswmeoui(frm))
 2815                                         wme = frm;
 2816                                 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
 2817                                         /*
 2818                                          * Accept pre-draft HT ie's if the
 2819                                          * standard ones have not been seen.
 2820                                          */
 2821                                         if (ishtcapoui(frm)) {
 2822                                                 if (htcap == NULL)
 2823                                                         htcap = frm;
 2824                                         } else if (ishtinfooui(frm)) {
 2825                                                 if (htinfo == NULL)
 2826                                                         htcap = frm;
 2827                                         }
 2828                                 }
 2829                                 /* XXX Atheros OUI support */
 2830                                 break;
 2831                         }
 2832                         frm += frm[1] + 2;
 2833                 }
 2834 
 2835                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
 2836                 if (xrates != NULL)
 2837                         IEEE80211_VERIFY_ELEMENT(xrates,
 2838                                 IEEE80211_RATE_MAXSIZE - rates[1]);
 2839                 rate = ieee80211_setup_rates(ni, rates, xrates,
 2840                                 IEEE80211_F_JOIN |
 2841                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
 2842                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
 2843                 if (rate & IEEE80211_RATE_BASIC) {
 2844                         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
 2845                             "[%s] %sassoc failed (rate set mismatch)\n",
 2846                             ether_sprintf(wh->i_addr2),
 2847                             ISREASSOC(subtype) ?  "re" : "");
 2848                         if (ni != ic->ic_bss)   /* XXX never true? */
 2849                                 ni->ni_fails++;
 2850                         ic->ic_stats.is_rx_assoc_norate++;
 2851                         ieee80211_new_state(ic, IEEE80211_S_SCAN,
 2852                             IEEE80211_SCAN_FAIL_STATUS);
 2853                         return;
 2854                 }
 2855 
 2856                 ni->ni_capinfo = capinfo;
 2857                 ni->ni_associd = associd;
 2858                 if (wme != NULL &&
 2859                     ieee80211_parse_wmeparams(ic, wme, wh) >= 0) {
 2860                         ni->ni_flags |= IEEE80211_NODE_QOS;
 2861                         ieee80211_wme_updateparams(ic);
 2862                 } else
 2863                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
 2864                 /*
 2865                  * Setup HT state according to the negotiation.
 2866                  */
 2867                 if ((ic->ic_htcaps & IEEE80211_HTC_HT) &&
 2868                     htcap != NULL && htinfo != NULL) {
 2869                         ieee80211_ht_node_init(ni, htcap);
 2870                         ieee80211_parse_htinfo(ni, htinfo);
 2871                         ieee80211_setup_htrates(ni,
 2872                             htcap, IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
 2873                         ieee80211_setup_basic_htrates(ni, htinfo);
 2874                         if (ni->ni_chan != ic->ic_bsschan) {
 2875                                 /*
 2876                                  * Channel has been adjusted based on
 2877                                  * negotiated HT parameters; force the
 2878                                  * channel state to follow.
 2879                                  */
 2880                                 ieee80211_setbsschan(ic, ni->ni_chan);
 2881                         }
 2882                 }
 2883                 /*
 2884                  * Configure state now that we are associated.
 2885                  *
 2886                  * XXX may need different/additional driver callbacks?
 2887                  */
 2888                 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
 2889                     (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
 2890                         ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
 2891                         ic->ic_flags &= ~IEEE80211_F_USEBARKER;
 2892                 } else {
 2893                         ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
 2894                         ic->ic_flags |= IEEE80211_F_USEBARKER;
 2895                 }
 2896                 ieee80211_set_shortslottime(ic,
 2897                         IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
 2898                         (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
 2899                 /*
 2900                  * Honor ERP protection.
 2901                  *
 2902                  * NB: ni_erp should zero for non-11g operation.
 2903                  */
 2904                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
 2905                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
 2906                         ic->ic_flags |= IEEE80211_F_USEPROT;
 2907                 else
 2908                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
 2909                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
 2910                     "[%s] %sassoc success: %s preamble, %s slot time%s%s%s%s\n",
 2911                     ether_sprintf(wh->i_addr2),
 2912                     ISREASSOC(subtype) ? "re" : "",
 2913                     ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
 2914                     ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
 2915                     ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
 2916                     ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
 2917                     ni->ni_flags & IEEE80211_NODE_HT ?
 2918                         (ni->ni_chw == 20 ? ", HT20" : ", HT40") : "",
 2919                     ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
 2920                     IEEE80211_ATH_CAP(ic, ni, IEEE80211_NODE_FF) ?
 2921                         ", fast-frames" : "",
 2922                     IEEE80211_ATH_CAP(ic, ni, IEEE80211_NODE_TURBOP) ?
 2923                         ", turbo" : ""
 2924                 );
 2925                 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
 2926                 break;
 2927         }
 2928 
 2929         case IEEE80211_FC0_SUBTYPE_DEAUTH: {
 2930                 uint16_t reason;
 2931 
 2932                 if (ic->ic_state == IEEE80211_S_SCAN) {
 2933                         ic->ic_stats.is_rx_mgtdiscard++;
 2934                         return;
 2935                 }
 2936                 /*
 2937                  * deauth frame format
 2938                  *      [2] reason
 2939                  */
 2940                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
 2941                 reason = le16toh(*(uint16_t *)frm);
 2942                 ic->ic_stats.is_rx_deauth++;
 2943                 IEEE80211_NODE_STAT(ni, rx_deauth);
 2944 
 2945                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) {
 2946                         /* NB: can happen when in promiscuous mode */
 2947                         ic->ic_stats.is_rx_mgtdiscard++;
 2948                         break;
 2949                 }
 2950                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
 2951                     "[%s] recv deauthenticate (reason %d)\n",
 2952                     ether_sprintf(ni->ni_macaddr), reason);
 2953                 switch (ic->ic_opmode) {
 2954                 case IEEE80211_M_STA:
 2955                         ieee80211_new_state(ic, IEEE80211_S_AUTH,
 2956                             (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
 2957                         break;
 2958                 case IEEE80211_M_HOSTAP:
 2959                         if (ni != ic->ic_bss)
 2960                                 ieee80211_node_leave(ic, ni);
 2961                         break;
 2962                 default:
 2963                         ic->ic_stats.is_rx_mgtdiscard++;
 2964                         break;
 2965                 }
 2966                 break;
 2967         }
 2968 
 2969         case IEEE80211_FC0_SUBTYPE_DISASSOC: {
 2970                 uint16_t reason;
 2971 
 2972                 if (ic->ic_state != IEEE80211_S_RUN &&
 2973                     ic->ic_state != IEEE80211_S_ASSOC &&
 2974                     ic->ic_state != IEEE80211_S_AUTH) {
 2975                         ic->ic_stats.is_rx_mgtdiscard++;
 2976                         return;
 2977                 }
 2978                 /*
 2979                  * disassoc frame format
 2980                  *      [2] reason
 2981                  */
 2982                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
 2983                 reason = le16toh(*(uint16_t *)frm);
 2984                 ic->ic_stats.is_rx_disassoc++;
 2985                 IEEE80211_NODE_STAT(ni, rx_disassoc);
 2986 
 2987                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) {
 2988                         /* NB: can happen when in promiscuous mode */
 2989                         ic->ic_stats.is_rx_mgtdiscard++;
 2990                         break;
 2991                 }
 2992                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
 2993                     "[%s] recv disassociate (reason %d)\n",
 2994                     ether_sprintf(ni->ni_macaddr), reason);
 2995                 switch (ic->ic_opmode) {
 2996                 case IEEE80211_M_STA:
 2997                         ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
 2998                         break;
 2999                 case IEEE80211_M_HOSTAP:
 3000                         if (ni != ic->ic_bss)
 3001                                 ieee80211_node_leave(ic, ni);
 3002                         break;
 3003                 default:
 3004                         ic->ic_stats.is_rx_mgtdiscard++;
 3005                         break;
 3006                 }
 3007                 break;
 3008         }
 3009 
 3010         case IEEE80211_FC0_SUBTYPE_ACTION: {
 3011                 const struct ieee80211_action *ia;
 3012 
 3013                 if (ic->ic_state != IEEE80211_S_RUN &&
 3014                     ic->ic_state != IEEE80211_S_ASSOC &&
 3015                     ic->ic_state != IEEE80211_S_AUTH) {
 3016                         ic->ic_stats.is_rx_mgtdiscard++;
 3017                         return;
 3018                 }
 3019                 /*
 3020                  * action frame format:
 3021                  *      [1] category
 3022                  *      [1] action
 3023                  *      [tlv] parameters
 3024                  */
 3025                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 3026                         sizeof(struct ieee80211_action), return);
 3027                 ia = (const struct ieee80211_action *) frm;
 3028 
 3029                 ic->ic_stats.is_rx_action++;
 3030                 IEEE80211_NODE_STAT(ni, rx_action);
 3031 
 3032                 /* verify frame payloads but defer processing */
 3033                 /* XXX maybe push this to method */
 3034                 switch (ia->ia_category) {
 3035                 case IEEE80211_ACTION_CAT_BA:
 3036                         switch (ia->ia_action) {
 3037                         case IEEE80211_ACTION_BA_ADDBA_REQUEST:
 3038                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 3039                                     sizeof(struct ieee80211_action_ba_addbarequest),
 3040                                     return);
 3041                                 break;
 3042                         case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
 3043                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 3044                                     sizeof(struct ieee80211_action_ba_addbaresponse),
 3045                                     return);
 3046                                 break;
 3047                         case IEEE80211_ACTION_BA_DELBA:
 3048                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 3049                                     sizeof(struct ieee80211_action_ba_delba),
 3050                                     return);
 3051                                 break;
 3052                         }
 3053                         break;
 3054                 case IEEE80211_ACTION_CAT_HT:
 3055                         switch (ia->ia_action) {
 3056                         case IEEE80211_ACTION_HT_TXCHWIDTH:
 3057                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 3058                                     sizeof(struct ieee80211_action_ht_txchwidth),
 3059                                     return);
 3060                                 break;
 3061                         }
 3062                         break;
 3063                 }
 3064                 ic->ic_recv_action(ni, frm, efrm);
 3065                 break;
 3066         }
 3067 
 3068         default:
 3069                 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
 3070                      wh, "mgt", "subtype 0x%x not handled", subtype);
 3071                 ic->ic_stats.is_rx_badsubtype++;
 3072                 break;
 3073         }
 3074 #undef ISREASSOC
 3075 #undef ISPROBE
 3076 }
 3077 #undef IEEE80211_VERIFY_LENGTH
 3078 #undef IEEE80211_VERIFY_ELEMENT
 3079 
 3080 /*
 3081  * Process a received ps-poll frame.
 3082  */
 3083 static void
 3084 ieee80211_recv_pspoll(struct ieee80211com *ic,
 3085         struct ieee80211_node *ni, struct mbuf *m0)
 3086 {
 3087         struct ieee80211_frame_min *wh;
 3088         struct mbuf *m;
 3089         uint16_t aid;
 3090         int qlen;
 3091 
 3092         wh = mtod(m0, struct ieee80211_frame_min *);
 3093         if (ni->ni_associd == 0) {
 3094                 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
 3095                     (struct ieee80211_frame *) wh, "ps-poll",
 3096                     "%s", "unassociated station");
 3097                 ic->ic_stats.is_ps_unassoc++;
 3098                 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
 3099                         IEEE80211_REASON_NOT_ASSOCED);
 3100                 return;
 3101         }
 3102 
 3103         aid = le16toh(*(uint16_t *)wh->i_dur);
 3104         if (aid != ni->ni_associd) {
 3105                 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
 3106                     (struct ieee80211_frame *) wh, "ps-poll",
 3107                     "aid mismatch: sta aid 0x%x poll aid 0x%x",
 3108                     ni->ni_associd, aid);
 3109                 ic->ic_stats.is_ps_badaid++;
 3110                 /*
 3111                  * NB: We used to deauth the station but it turns out
 3112                  * the Blackberry Curve 8230 (and perhaps other devices) 
 3113                  * sometimes send the wrong AID when WME is negotiated.
 3114                  * Being more lenient here seems ok as we already check
 3115                  * the station is associated and we only return frames
 3116                  * queued for the station (i.e. we don't use the AID).
 3117                  */
 3118                 return;
 3119         }
 3120 
 3121         /* Okay, take the first queued packet and put it out... */
 3122         IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
 3123         if (m == NULL) {
 3124                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
 3125                     "[%s] recv ps-poll, but queue empty\n",
 3126                     ether_sprintf(wh->i_addr2));
 3127                 ieee80211_send_nulldata(ieee80211_ref_node(ni));
 3128                 ic->ic_stats.is_ps_qempty++;    /* XXX node stat */
 3129                 if (ic->ic_set_tim != NULL)
 3130                         ic->ic_set_tim(ni, 0);  /* just in case */
 3131                 return;
 3132         }
 3133         /* 
 3134          * If there are more packets, set the more packets bit
 3135          * in the packet dispatched to the station; otherwise
 3136          * turn off the TIM bit.
 3137          */
 3138         if (qlen != 0) {
 3139                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
 3140                     "[%s] recv ps-poll, send packet, %u still queued\n",
 3141                     ether_sprintf(ni->ni_macaddr), qlen);
 3142                 m->m_flags |= M_MORE_DATA;
 3143         } else {
 3144                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
 3145                     "[%s] recv ps-poll, send packet, queue empty\n",
 3146                     ether_sprintf(ni->ni_macaddr));
 3147                 if (ic->ic_set_tim != NULL)
 3148                         ic->ic_set_tim(ni, 0);
 3149         }
 3150         m->m_flags |= M_PWR_SAV;                /* bypass PS handling */
 3151         IF_ENQUEUE(&ic->ic_ifp->if_snd, m);
 3152 }
 3153 
 3154 #ifdef IEEE80211_DEBUG
 3155 /*
 3156  * Debugging support.
 3157  */
 3158 void
 3159 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag,
 3160         uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
 3161 {
 3162         printf("[%s] discard %s frame, ssid mismatch: ",
 3163                 ether_sprintf(mac), tag);
 3164         ieee80211_print_essid(ssid + 2, ssid[1]);
 3165         printf("\n");
 3166 }
 3167 
 3168 /*
 3169  * Return the bssid of a frame.
 3170  */
 3171 static const uint8_t *
 3172 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh)
 3173 {
 3174         if (ic->ic_opmode == IEEE80211_M_STA)
 3175                 return wh->i_addr2;
 3176         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
 3177                 return wh->i_addr1;
 3178         if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
 3179                 return wh->i_addr1;
 3180         return wh->i_addr3;
 3181 }
 3182 
 3183 void
 3184 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...)
 3185 {
 3186         char buf[128];          /* XXX */
 3187         va_list ap;
 3188 
 3189         va_start(ap, fmt);
 3190         vsnprintf(buf, sizeof(buf), fmt, ap);
 3191         va_end(ap);
 3192 
 3193         if_printf(ic->ic_ifp, "%s", buf);       /* NB: no \n */
 3194 }
 3195 
 3196 void
 3197 ieee80211_note_frame(struct ieee80211com *ic,
 3198         const struct ieee80211_frame *wh,
 3199         const char *fmt, ...)
 3200 {
 3201         char buf[128];          /* XXX */
 3202         va_list ap;
 3203 
 3204         va_start(ap, fmt);
 3205         vsnprintf(buf, sizeof(buf), fmt, ap);
 3206         va_end(ap);
 3207         if_printf(ic->ic_ifp, "[%s] %s\n",
 3208                 ether_sprintf(ieee80211_getbssid(ic, wh)), buf);
 3209 }
 3210 
 3211 void
 3212 ieee80211_note_mac(struct ieee80211com *ic,
 3213         const uint8_t mac[IEEE80211_ADDR_LEN],
 3214         const char *fmt, ...)
 3215 {
 3216         char buf[128];          /* XXX */
 3217         va_list ap;
 3218 
 3219         va_start(ap, fmt);
 3220         vsnprintf(buf, sizeof(buf), fmt, ap);
 3221         va_end(ap);
 3222         if_printf(ic->ic_ifp, "[%s] %s\n", ether_sprintf(mac), buf);
 3223 }
 3224 
 3225 void
 3226 ieee80211_discard_frame(struct ieee80211com *ic,
 3227         const struct ieee80211_frame *wh,
 3228         const char *type, const char *fmt, ...)
 3229 {
 3230         va_list ap;
 3231 
 3232         printf("[%s:%s] discard ", ic->ic_ifp->if_xname,
 3233                 ether_sprintf(ieee80211_getbssid(ic, wh)));
 3234         if (type != NULL)
 3235                 printf("%s frame, ", type);
 3236         else
 3237                 printf("frame, ");
 3238         va_start(ap, fmt);
 3239         vprintf(fmt, ap);
 3240         va_end(ap);
 3241         printf("\n");
 3242 }
 3243 
 3244 void
 3245 ieee80211_discard_ie(struct ieee80211com *ic,
 3246         const struct ieee80211_frame *wh,
 3247         const char *type, const char *fmt, ...)
 3248 {
 3249         va_list ap;
 3250 
 3251         printf("[%s:%s] discard ", ic->ic_ifp->if_xname,
 3252                 ether_sprintf(ieee80211_getbssid(ic, wh)));
 3253         if (type != NULL)
 3254                 printf("%s information element, ", type);
 3255         else
 3256                 printf("information element, ");
 3257         va_start(ap, fmt);
 3258         vprintf(fmt, ap);
 3259         va_end(ap);
 3260         printf("\n");
 3261 }
 3262 
 3263 void
 3264 ieee80211_discard_mac(struct ieee80211com *ic,
 3265         const uint8_t mac[IEEE80211_ADDR_LEN],
 3266         const char *type, const char *fmt, ...)
 3267 {
 3268         va_list ap;
 3269 
 3270         printf("[%s:%s] discard ", ic->ic_ifp->if_xname, ether_sprintf(mac));
 3271         if (type != NULL)
 3272                 printf("%s frame, ", type);
 3273         else
 3274                 printf("frame, ");
 3275         va_start(ap, fmt);
 3276         vprintf(fmt, ap);
 3277         va_end(ap);
 3278         printf("\n");
 3279 }
 3280 #endif /* IEEE80211_DEBUG */

Cache object: eace7fc0c1c902b9fdfc79f9772ae44f


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.