1 /*-
2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002-2007 Sam Leffler, Errno Consulting
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD: releng/7.4/sys/net80211/ieee80211_input.c 215617 2010-11-21 10:56:04Z bschmidt $");
29
30 #include <sys/param.h>
31 #include <sys/systm.h>
32 #include <sys/mbuf.h>
33 #include <sys/malloc.h>
34 #include <sys/endian.h>
35 #include <sys/kernel.h>
36
37 #include <sys/socket.h>
38
39 #include <net/if.h>
40 #include <net/if_media.h>
41 #include <net/ethernet.h>
42 #include <net/if_llc.h>
43 #include <net/if_vlan_var.h>
44
45 #include <net80211/ieee80211_var.h>
46 #include <net80211/ieee80211_input.h>
47
48 #include <net/bpf.h>
49
50 #ifdef IEEE80211_DEBUG
51 #include <machine/stdarg.h>
52
53 /*
54 * Decide if a received management frame should be
55 * printed when debugging is enabled. This filters some
56 * of the less interesting frames that come frequently
57 * (e.g. beacons).
58 */
59 static __inline int
60 doprint(struct ieee80211com *ic, int subtype)
61 {
62 switch (subtype) {
63 case IEEE80211_FC0_SUBTYPE_BEACON:
64 return (ic->ic_flags & IEEE80211_F_SCAN);
65 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
66 return (ic->ic_opmode == IEEE80211_M_IBSS);
67 }
68 return 1;
69 }
70
71 static const uint8_t *ieee80211_getbssid(struct ieee80211com *,
72 const struct ieee80211_frame *);
73 #endif /* IEEE80211_DEBUG */
74
75 static struct mbuf *ieee80211_defrag(struct ieee80211com *,
76 struct ieee80211_node *, struct mbuf *, int);
77 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int);
78 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *,
79 const uint8_t *mac, int subtype, int arg);
80 static struct mbuf *ieee80211_decap_fastframe(struct ieee80211com *,
81 struct ieee80211_node *, struct mbuf *);
82 static void ieee80211_recv_pspoll(struct ieee80211com *,
83 struct ieee80211_node *, struct mbuf *);
84
85 /*
86 * Process a received frame. The node associated with the sender
87 * should be supplied. If nothing was found in the node table then
88 * the caller is assumed to supply a reference to ic_bss instead.
89 * The RSSI and a timestamp are also supplied. The RSSI data is used
90 * during AP scanning to select a AP to associate with; it can have
91 * any units so long as values have consistent units and higher values
92 * mean ``better signal''. The receive timestamp is currently not used
93 * by the 802.11 layer.
94 */
95 int
96 ieee80211_input(struct ieee80211com *ic, struct mbuf *m,
97 struct ieee80211_node *ni, int rssi, int noise, uint32_t rstamp)
98 {
99 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0)
100 #define HAS_SEQ(type) ((type & 0x4) == 0)
101 struct ifnet *ifp = ic->ic_ifp;
102 struct ieee80211_frame *wh;
103 struct ieee80211_key *key;
104 struct ether_header *eh;
105 int hdrspace, need_tap;
106 uint8_t dir, type, subtype, qos;
107 uint8_t *bssid;
108 uint16_t rxseq;
109
110 if (m->m_flags & M_AMPDU) {
111 /*
112 * Fastpath for A-MPDU reorder q resubmission. Frames
113 * w/ M_AMPDU marked have already passed through here
114 * but were received out of order and been held on the
115 * reorder queue. When resubmitted they are marked
116 * with the M_AMPDU flag and we can bypass most of the
117 * normal processing.
118 */
119 wh = mtod(m, struct ieee80211_frame *);
120 type = IEEE80211_FC0_TYPE_DATA;
121 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
122 subtype = IEEE80211_FC0_SUBTYPE_QOS;
123 hdrspace = ieee80211_hdrspace(ic, wh); /* XXX optimize? */
124 need_tap = 0;
125 goto resubmit_ampdu;
126 }
127
128 KASSERT(ni != NULL, ("null node"));
129 ni->ni_inact = ni->ni_inact_reload;
130
131 need_tap = 1; /* mbuf need to be tapped. */
132 type = -1; /* undefined */
133 /*
134 * In monitor mode, send everything directly to bpf.
135 * XXX may want to include the CRC
136 */
137 if (ic->ic_opmode == IEEE80211_M_MONITOR)
138 goto out;
139
140 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
141 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
142 ni->ni_macaddr, NULL,
143 "too short (1): len %u", m->m_pkthdr.len);
144 ic->ic_stats.is_rx_tooshort++;
145 goto out;
146 }
147 /*
148 * Bit of a cheat here, we use a pointer for a 3-address
149 * frame format but don't reference fields past outside
150 * ieee80211_frame_min w/o first validating the data is
151 * present.
152 */
153 wh = mtod(m, struct ieee80211_frame *);
154
155 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
156 IEEE80211_FC0_VERSION_0) {
157 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
158 ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
159 ic->ic_stats.is_rx_badversion++;
160 goto err;
161 }
162
163 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
164 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
165 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
166 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
167 switch (ic->ic_opmode) {
168 case IEEE80211_M_STA:
169 bssid = wh->i_addr2;
170 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
171 /* not interested in */
172 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
173 bssid, NULL, "%s", "not to bss");
174 ic->ic_stats.is_rx_wrongbss++;
175 goto out;
176 }
177 break;
178 case IEEE80211_M_IBSS:
179 case IEEE80211_M_AHDEMO:
180 case IEEE80211_M_HOSTAP:
181 if (dir != IEEE80211_FC1_DIR_NODS)
182 bssid = wh->i_addr1;
183 else if (type == IEEE80211_FC0_TYPE_CTL)
184 bssid = wh->i_addr1;
185 else {
186 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
187 IEEE80211_DISCARD_MAC(ic,
188 IEEE80211_MSG_ANY, ni->ni_macaddr,
189 NULL, "too short (2): len %u",
190 m->m_pkthdr.len);
191 ic->ic_stats.is_rx_tooshort++;
192 goto out;
193 }
194 bssid = wh->i_addr3;
195 }
196 if (type != IEEE80211_FC0_TYPE_DATA)
197 break;
198 /*
199 * Data frame, validate the bssid.
200 */
201 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) &&
202 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
203 /* not interested in */
204 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
205 bssid, NULL, "%s", "not to bss");
206 ic->ic_stats.is_rx_wrongbss++;
207 goto out;
208 }
209 /*
210 * For adhoc mode we cons up a node when it doesn't
211 * exist. This should probably done after an ACL check.
212 */
213 if (ni == ic->ic_bss &&
214 ic->ic_opmode != IEEE80211_M_HOSTAP &&
215 !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
216 /*
217 * Fake up a node for this newly
218 * discovered member of the IBSS.
219 */
220 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
221 wh->i_addr2);
222 if (ni == NULL) {
223 /* NB: stat kept for alloc failure */
224 goto err;
225 }
226 }
227 break;
228 default:
229 goto out;
230 }
231 ni->ni_rssi = rssi;
232 ni->ni_noise = noise;
233 ni->ni_rstamp = rstamp;
234 if (HAS_SEQ(type)) {
235 uint8_t tid;
236 if (IEEE80211_QOS_HAS_SEQ(wh)) {
237 tid = ((struct ieee80211_qosframe *)wh)->
238 i_qos[0] & IEEE80211_QOS_TID;
239 if (TID_TO_WME_AC(tid) >= WME_AC_VI)
240 ic->ic_wme.wme_hipri_traffic++;
241 tid++;
242 } else
243 tid = IEEE80211_NONQOS_TID;
244 rxseq = le16toh(*(uint16_t *)wh->i_seq);
245 if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
246 (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
247 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
248 /* duplicate, discard */
249 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
250 bssid, "duplicate",
251 "seqno <%u,%u> fragno <%u,%u> tid %u",
252 rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
253 ni->ni_rxseqs[tid] >>
254 IEEE80211_SEQ_SEQ_SHIFT,
255 rxseq & IEEE80211_SEQ_FRAG_MASK,
256 ni->ni_rxseqs[tid] &
257 IEEE80211_SEQ_FRAG_MASK,
258 tid);
259 ic->ic_stats.is_rx_dup++;
260 IEEE80211_NODE_STAT(ni, rx_dup);
261 goto out;
262 }
263 ni->ni_rxseqs[tid] = rxseq;
264 }
265 }
266
267 switch (type) {
268 case IEEE80211_FC0_TYPE_DATA:
269 hdrspace = ieee80211_hdrspace(ic, wh);
270 if (m->m_len < hdrspace &&
271 (m = m_pullup(m, hdrspace)) == NULL) {
272 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
273 ni->ni_macaddr, NULL,
274 "data too short: expecting %u", hdrspace);
275 ic->ic_stats.is_rx_tooshort++;
276 goto out; /* XXX */
277 }
278 switch (ic->ic_opmode) {
279 case IEEE80211_M_STA:
280 if (dir != IEEE80211_FC1_DIR_FROMDS) {
281 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
282 wh, "data", "unknown dir 0x%x", dir);
283 ic->ic_stats.is_rx_wrongdir++;
284 goto out;
285 }
286 if ((ifp->if_flags & IFF_SIMPLEX) &&
287 IEEE80211_IS_MULTICAST(wh->i_addr1) &&
288 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) {
289 /*
290 * In IEEE802.11 network, multicast packet
291 * sent from me is broadcasted from AP.
292 * It should be silently discarded for
293 * SIMPLEX interface.
294 */
295 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
296 wh, NULL, "%s", "multicast echo");
297 ic->ic_stats.is_rx_mcastecho++;
298 goto out;
299 }
300 break;
301 case IEEE80211_M_IBSS:
302 case IEEE80211_M_AHDEMO:
303 if (dir != IEEE80211_FC1_DIR_NODS) {
304 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
305 wh, "data", "unknown dir 0x%x", dir);
306 ic->ic_stats.is_rx_wrongdir++;
307 goto out;
308 }
309 /* XXX no power-save support */
310 break;
311 case IEEE80211_M_HOSTAP:
312 if (dir != IEEE80211_FC1_DIR_TODS) {
313 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
314 wh, "data", "unknown dir 0x%x", dir);
315 ic->ic_stats.is_rx_wrongdir++;
316 goto out;
317 }
318 /* check if source STA is associated */
319 if (ni == ic->ic_bss) {
320 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
321 wh, "data", "%s", "unknown src");
322 ieee80211_send_error(ic, ni, wh->i_addr2,
323 IEEE80211_FC0_SUBTYPE_DEAUTH,
324 IEEE80211_REASON_NOT_AUTHED);
325 ic->ic_stats.is_rx_notassoc++;
326 goto err;
327 }
328 if (ni->ni_associd == 0) {
329 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
330 wh, "data", "%s", "unassoc src");
331 IEEE80211_SEND_MGMT(ic, ni,
332 IEEE80211_FC0_SUBTYPE_DISASSOC,
333 IEEE80211_REASON_NOT_ASSOCED);
334 ic->ic_stats.is_rx_notassoc++;
335 goto err;
336 }
337
338 /*
339 * Check for power save state change.
340 * XXX out-of-order A-MPDU frames?
341 */
342 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
343 (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
344 ieee80211_node_pwrsave(ni,
345 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
346 break;
347 default:
348 /* XXX here to keep compiler happy */
349 goto out;
350 }
351
352 /*
353 * Handle A-MPDU re-ordering. The station must be
354 * associated and negotiated HT. The frame must be
355 * a QoS frame (not QoS null data) and not previously
356 * processed for A-MPDU re-ordering. If the frame is
357 * to be processed directly then ieee80211_ampdu_reorder
358 * will return 0; otherwise it has consumed the mbuf
359 * and we should do nothing more with it.
360 */
361 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
362 subtype == IEEE80211_FC0_SUBTYPE_QOS &&
363 ieee80211_ampdu_reorder(ni, m) != 0) {
364 m = NULL;
365 goto out;
366 }
367 resubmit_ampdu:
368
369 /*
370 * Handle privacy requirements. Note that we
371 * must not be preempted from here until after
372 * we (potentially) call ieee80211_crypto_demic;
373 * otherwise we may violate assumptions in the
374 * crypto cipher modules used to do delayed update
375 * of replay sequence numbers.
376 */
377 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
378 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
379 /*
380 * Discard encrypted frames when privacy is off.
381 */
382 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
383 wh, "WEP", "%s", "PRIVACY off");
384 ic->ic_stats.is_rx_noprivacy++;
385 IEEE80211_NODE_STAT(ni, rx_noprivacy);
386 goto out;
387 }
388 key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
389 if (key == NULL) {
390 /* NB: stats+msgs handled in crypto_decap */
391 IEEE80211_NODE_STAT(ni, rx_wepfail);
392 goto out;
393 }
394 wh = mtod(m, struct ieee80211_frame *);
395 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
396 } else {
397 /* XXX M_WEP and IEEE80211_F_PRIVACY */
398 key = NULL;
399 }
400
401 /*
402 * Save QoS bits for use below--before we strip the header.
403 */
404 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
405 qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
406 ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
407 ((struct ieee80211_qosframe *)wh)->i_qos[0];
408 } else
409 qos = 0;
410
411 /*
412 * Next up, any fragmentation.
413 */
414 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
415 m = ieee80211_defrag(ic, ni, m, hdrspace);
416 if (m == NULL) {
417 /* Fragment dropped or frame not complete yet */
418 goto out;
419 }
420 }
421 wh = NULL; /* no longer valid, catch any uses */
422
423 /*
424 * Next strip any MSDU crypto bits.
425 */
426 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) {
427 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
428 ni->ni_macaddr, "data", "%s", "demic error");
429 ic->ic_stats.is_rx_demicfail++;
430 IEEE80211_NODE_STAT(ni, rx_demicfail);
431 goto out;
432 }
433
434 /* copy to listener after decrypt */
435 if (bpf_peers_present(ic->ic_rawbpf))
436 bpf_mtap(ic->ic_rawbpf, m);
437 need_tap = 0;
438
439 /*
440 * Finally, strip the 802.11 header.
441 */
442 m = ieee80211_decap(ic, m, hdrspace);
443 if (m == NULL) {
444 /* don't count Null data frames as errors */
445 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
446 subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
447 goto out;
448 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
449 ni->ni_macaddr, "data", "%s", "decap error");
450 ic->ic_stats.is_rx_decap++;
451 IEEE80211_NODE_STAT(ni, rx_decap);
452 goto err;
453 }
454 eh = mtod(m, struct ether_header *);
455 if (!ieee80211_node_is_authorized(ni)) {
456 /*
457 * Deny any non-PAE frames received prior to
458 * authorization. For open/shared-key
459 * authentication the port is mark authorized
460 * after authentication completes. For 802.1x
461 * the port is not marked authorized by the
462 * authenticator until the handshake has completed.
463 */
464 if (eh->ether_type != htons(ETHERTYPE_PAE)) {
465 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
466 eh->ether_shost, "data",
467 "unauthorized port: ether type 0x%x len %u",
468 eh->ether_type, m->m_pkthdr.len);
469 ic->ic_stats.is_rx_unauth++;
470 IEEE80211_NODE_STAT(ni, rx_unauth);
471 goto err;
472 }
473 } else {
474 /*
475 * When denying unencrypted frames, discard
476 * any non-PAE frames received without encryption.
477 */
478 if ((ic->ic_flags & IEEE80211_F_DROPUNENC) &&
479 (key == NULL && (m->m_flags & M_WEP) == 0) &&
480 eh->ether_type != htons(ETHERTYPE_PAE)) {
481 /*
482 * Drop unencrypted frames.
483 */
484 ic->ic_stats.is_rx_unencrypted++;
485 IEEE80211_NODE_STAT(ni, rx_unencrypted);
486 goto out;
487 }
488 }
489 /* XXX require HT? */
490 if (qos & IEEE80211_QOS_AMSDU) {
491 m = ieee80211_decap_amsdu(ni, m);
492 if (m == NULL)
493 return IEEE80211_FC0_TYPE_DATA;
494 } else if ((ni->ni_ath_flags & IEEE80211_NODE_FF) &&
495 #define FF_LLC_SIZE (sizeof(struct ether_header) + sizeof(struct llc))
496 m->m_pkthdr.len >= 3*FF_LLC_SIZE) {
497 struct llc *llc;
498
499 /*
500 * Check for fast-frame tunnel encapsulation.
501 */
502 if (m->m_len < FF_LLC_SIZE &&
503 (m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
504 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
505 ni->ni_macaddr, "fast-frame",
506 "%s", "m_pullup(llc) failed");
507 ic->ic_stats.is_rx_tooshort++;
508 return IEEE80211_FC0_TYPE_DATA;
509 }
510 llc = (struct llc *)(mtod(m, uint8_t *) +
511 sizeof(struct ether_header));
512 if (llc->llc_snap.ether_type == htons(ATH_FF_ETH_TYPE)) {
513 m_adj(m, FF_LLC_SIZE);
514 m = ieee80211_decap_fastframe(ic, ni, m);
515 if (m == NULL)
516 return IEEE80211_FC0_TYPE_DATA;
517 }
518 }
519 #undef FF_LLC_SIZE
520 ieee80211_deliver_data(ic, ni, m);
521 return IEEE80211_FC0_TYPE_DATA;
522
523 case IEEE80211_FC0_TYPE_MGT:
524 ic->ic_stats.is_rx_mgmt++;
525 IEEE80211_NODE_STAT(ni, rx_mgmt);
526 if (dir != IEEE80211_FC1_DIR_NODS) {
527 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
528 wh, "data", "unknown dir 0x%x", dir);
529 ic->ic_stats.is_rx_wrongdir++;
530 goto err;
531 }
532 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
533 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
534 ni->ni_macaddr, "mgt", "too short: len %u",
535 m->m_pkthdr.len);
536 ic->ic_stats.is_rx_tooshort++;
537 goto out;
538 }
539 #ifdef IEEE80211_DEBUG
540 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) ||
541 ieee80211_msg_dumppkts(ic)) {
542 if_printf(ic->ic_ifp, "received %s from %s rssi %d\n",
543 ieee80211_mgt_subtype_name[subtype >>
544 IEEE80211_FC0_SUBTYPE_SHIFT],
545 ether_sprintf(wh->i_addr2), rssi);
546 }
547 #endif
548 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
549 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
550 /*
551 * Only shared key auth frames with a challenge
552 * should be encrypted, discard all others.
553 */
554 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
555 wh, ieee80211_mgt_subtype_name[subtype >>
556 IEEE80211_FC0_SUBTYPE_SHIFT],
557 "%s", "WEP set but not permitted");
558 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */
559 goto out;
560 }
561 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
562 /*
563 * Discard encrypted frames when privacy is off.
564 */
565 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
566 wh, "mgt", "%s", "WEP set but PRIVACY off");
567 ic->ic_stats.is_rx_noprivacy++;
568 goto out;
569 }
570 hdrspace = ieee80211_hdrspace(ic, wh);
571 key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
572 if (key == NULL) {
573 /* NB: stats+msgs handled in crypto_decap */
574 goto out;
575 }
576 wh = mtod(m, struct ieee80211_frame *);
577 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
578 }
579 if (bpf_peers_present(ic->ic_rawbpf))
580 bpf_mtap(ic->ic_rawbpf, m);
581 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, noise, rstamp);
582 m_freem(m);
583 return IEEE80211_FC0_TYPE_MGT;
584
585 case IEEE80211_FC0_TYPE_CTL:
586 ic->ic_stats.is_rx_ctl++;
587 IEEE80211_NODE_STAT(ni, rx_ctrl);
588 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
589 switch (subtype) {
590 case IEEE80211_FC0_SUBTYPE_PS_POLL:
591 ieee80211_recv_pspoll(ic, ni, m);
592 break;
593 case IEEE80211_FC0_SUBTYPE_BAR:
594 ieee80211_recv_bar(ni, m);
595 break;
596 }
597 }
598 goto out;
599 default:
600 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
601 wh, NULL, "bad frame type 0x%x", type);
602 /* should not come here */
603 break;
604 }
605 err:
606 ifp->if_ierrors++;
607 out:
608 if (m != NULL) {
609 if (bpf_peers_present(ic->ic_rawbpf) && need_tap)
610 bpf_mtap(ic->ic_rawbpf, m);
611 m_freem(m);
612 }
613 return type;
614 #undef SEQ_LEQ
615 }
616
617 /*
618 * This function reassemble fragments.
619 */
620 static struct mbuf *
621 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni,
622 struct mbuf *m, int hdrspace)
623 {
624 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
625 struct ieee80211_frame *lwh;
626 uint16_t rxseq;
627 uint8_t fragno;
628 uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
629 struct mbuf *mfrag;
630
631 KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
632
633 rxseq = le16toh(*(uint16_t *)wh->i_seq);
634 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
635
636 /* Quick way out, if there's nothing to defragment */
637 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
638 return m;
639
640 /*
641 * Remove frag to insure it doesn't get reaped by timer.
642 */
643 if (ni->ni_table == NULL) {
644 /*
645 * Should never happen. If the node is orphaned (not in
646 * the table) then input packets should not reach here.
647 * Otherwise, a concurrent request that yanks the table
648 * should be blocked by other interlocking and/or by first
649 * shutting the driver down. Regardless, be defensive
650 * here and just bail
651 */
652 /* XXX need msg+stat */
653 m_freem(m);
654 return NULL;
655 }
656 IEEE80211_NODE_LOCK(ni->ni_table);
657 mfrag = ni->ni_rxfrag[0];
658 ni->ni_rxfrag[0] = NULL;
659 IEEE80211_NODE_UNLOCK(ni->ni_table);
660
661 /*
662 * Validate new fragment is in order and
663 * related to the previous ones.
664 */
665 if (mfrag != NULL) {
666 uint16_t last_rxseq;
667
668 lwh = mtod(mfrag, struct ieee80211_frame *);
669 last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
670 /* NB: check seq # and frag together */
671 if (rxseq != last_rxseq+1 ||
672 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
673 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
674 /*
675 * Unrelated fragment or no space for it,
676 * clear current fragments.
677 */
678 m_freem(mfrag);
679 mfrag = NULL;
680 }
681 }
682
683 if (mfrag == NULL) {
684 if (fragno != 0) { /* !first fragment, discard */
685 ic->ic_stats.is_rx_defrag++;
686 IEEE80211_NODE_STAT(ni, rx_defrag);
687 m_freem(m);
688 return NULL;
689 }
690 mfrag = m;
691 } else { /* concatenate */
692 m_adj(m, hdrspace); /* strip header */
693 m_cat(mfrag, m);
694 /* NB: m_cat doesn't update the packet header */
695 mfrag->m_pkthdr.len += m->m_pkthdr.len;
696 /* track last seqnum and fragno */
697 lwh = mtod(mfrag, struct ieee80211_frame *);
698 *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
699 }
700 if (more_frag) { /* more to come, save */
701 ni->ni_rxfragstamp = ticks;
702 ni->ni_rxfrag[0] = mfrag;
703 mfrag = NULL;
704 }
705 return mfrag;
706 }
707
708 void
709 ieee80211_deliver_data(struct ieee80211com *ic,
710 struct ieee80211_node *ni, struct mbuf *m)
711 {
712 struct ether_header *eh = mtod(m, struct ether_header *);
713 struct ifnet *ifp = ic->ic_ifp;
714
715 /*
716 * Do accounting.
717 */
718 ifp->if_ipackets++;
719 IEEE80211_NODE_STAT(ni, rx_data);
720 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
721 if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
722 m->m_flags |= M_MCAST; /* XXX M_BCAST? */
723 IEEE80211_NODE_STAT(ni, rx_mcast);
724 } else
725 IEEE80211_NODE_STAT(ni, rx_ucast);
726
727 /* clear driver/net80211 flags before passing up */
728 m->m_flags &= ~M_80211_RX;
729
730 /* perform as a bridge within the AP */
731 if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
732 (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) {
733 struct mbuf *m1 = NULL;
734
735 if (m->m_flags & M_MCAST) {
736 m1 = m_dup(m, M_DONTWAIT);
737 if (m1 == NULL)
738 ifp->if_oerrors++;
739 else
740 m1->m_flags |= M_MCAST;
741 } else {
742 /*
743 * Check if the destination is known; if so
744 * and the port is authorized dispatch directly.
745 */
746 struct ieee80211_node *sta =
747 ieee80211_find_node(&ic->ic_sta, eh->ether_dhost);
748 if (sta != NULL) {
749 if (ieee80211_node_is_authorized(sta)) {
750 /*
751 * Beware of sending to ourself; this
752 * needs to happen via the normal
753 * input path.
754 */
755 if (sta != ic->ic_bss) {
756 m1 = m;
757 m = NULL;
758 }
759 } else {
760 ic->ic_stats.is_rx_unauth++;
761 IEEE80211_NODE_STAT(sta, rx_unauth);
762 }
763 ieee80211_free_node(sta);
764 }
765 }
766 if (m1 != NULL) {
767 int error;
768
769 /* XXX does not work well with WME */
770 IFQ_HANDOFF(ifp, m1, error);
771 }
772 }
773 if (m != NULL) {
774 m->m_pkthdr.rcvif = ifp;
775 if (ni->ni_vlan != 0) {
776 /* attach vlan tag */
777 m->m_pkthdr.ether_vtag = ni->ni_vlan;
778 m->m_flags |= M_VLANTAG;
779 }
780 (*ifp->if_input)(ifp, m);
781 }
782 }
783
784 static struct mbuf *
785 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen)
786 {
787 struct ieee80211_qosframe_addr4 wh; /* Max size address frames */
788 struct ether_header *eh;
789 struct llc *llc;
790
791 if (m->m_len < hdrlen + sizeof(*llc) &&
792 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
793 /* XXX stat, msg */
794 return NULL;
795 }
796 memcpy(&wh, mtod(m, caddr_t), hdrlen);
797 llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
798 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
799 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
800 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
801 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
802 llc = NULL;
803 } else {
804 m_adj(m, hdrlen - sizeof(*eh));
805 }
806 eh = mtod(m, struct ether_header *);
807 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
808 case IEEE80211_FC1_DIR_NODS:
809 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
810 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
811 break;
812 case IEEE80211_FC1_DIR_TODS:
813 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
814 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
815 break;
816 case IEEE80211_FC1_DIR_FROMDS:
817 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
818 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
819 break;
820 case IEEE80211_FC1_DIR_DSTODS:
821 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
822 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
823 break;
824 }
825 #ifdef ALIGNED_POINTER
826 if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
827 struct mbuf *n, *n0, **np;
828 caddr_t newdata;
829 int off, pktlen;
830
831 n0 = NULL;
832 np = &n0;
833 off = 0;
834 pktlen = m->m_pkthdr.len;
835 while (pktlen > off) {
836 if (n0 == NULL) {
837 MGETHDR(n, M_DONTWAIT, MT_DATA);
838 if (n == NULL) {
839 m_freem(m);
840 return NULL;
841 }
842 M_MOVE_PKTHDR(n, m);
843 n->m_len = MHLEN;
844 } else {
845 MGET(n, M_DONTWAIT, MT_DATA);
846 if (n == NULL) {
847 m_freem(m);
848 m_freem(n0);
849 return NULL;
850 }
851 n->m_len = MLEN;
852 }
853 if (pktlen - off >= MINCLSIZE) {
854 MCLGET(n, M_DONTWAIT);
855 if (n->m_flags & M_EXT)
856 n->m_len = n->m_ext.ext_size;
857 }
858 if (n0 == NULL) {
859 newdata =
860 (caddr_t)ALIGN(n->m_data + sizeof(*eh)) -
861 sizeof(*eh);
862 n->m_len -= newdata - n->m_data;
863 n->m_data = newdata;
864 }
865 if (n->m_len > pktlen - off)
866 n->m_len = pktlen - off;
867 m_copydata(m, off, n->m_len, mtod(n, caddr_t));
868 off += n->m_len;
869 *np = n;
870 np = &n->m_next;
871 }
872 m_freem(m);
873 m = n0;
874 }
875 #endif /* ALIGNED_POINTER */
876 if (llc != NULL) {
877 eh = mtod(m, struct ether_header *);
878 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
879 }
880 return m;
881 }
882
883 /*
884 * Decap a frame encapsulated in a fast-frame/A-MSDU.
885 */
886 struct mbuf *
887 ieee80211_decap1(struct mbuf *m, int *framelen)
888 {
889 #define FF_LLC_SIZE (sizeof(struct ether_header) + sizeof(struct llc))
890 struct ether_header *eh;
891 struct llc *llc;
892
893 /*
894 * The frame has an 802.3 header followed by an 802.2
895 * LLC header. The encapsulated frame length is in the
896 * first header type field; save that and overwrite it
897 * with the true type field found in the second. Then
898 * copy the 802.3 header up to where it belongs and
899 * adjust the mbuf contents to remove the void.
900 */
901 if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
902 return NULL;
903 eh = mtod(m, struct ether_header *); /* 802.3 header is first */
904 llc = (struct llc *)&eh[1]; /* 802.2 header follows */
905 *framelen = ntohs(eh->ether_type) /* encap'd frame size */
906 + sizeof(struct ether_header) - sizeof(struct llc);
907 eh->ether_type = llc->llc_un.type_snap.ether_type;
908 ovbcopy(eh, mtod(m, uint8_t *) + sizeof(struct llc),
909 sizeof(struct ether_header));
910 m_adj(m, sizeof(struct llc));
911 return m;
912 #undef FF_LLC_SIZE
913 }
914
915 /*
916 * Decap the encapsulated frame pair and dispatch the first
917 * for delivery. The second frame is returned for delivery
918 * via the normal path.
919 */
920 static struct mbuf *
921 ieee80211_decap_fastframe(struct ieee80211com *ic,
922 struct ieee80211_node *ni, struct mbuf *m)
923 {
924 #define MS(x,f) (((x) & f) >> f##_S)
925 uint32_t ath;
926 struct mbuf *n;
927 int framelen;
928
929 m_copydata(m, 0, sizeof(uint32_t), (caddr_t) &ath);
930 if (MS(ath, ATH_FF_PROTO) != ATH_FF_PROTO_L2TUNNEL) {
931 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
932 ni->ni_macaddr, "fast-frame",
933 "unsupport tunnel protocol, header 0x%x", ath);
934 ic->ic_stats.is_ff_badhdr++;
935 m_freem(m);
936 return NULL;
937 }
938 /* NB: skip header and alignment padding */
939 m_adj(m, roundup(sizeof(uint32_t) - 2, 4) + 2);
940
941 ic->ic_stats.is_ff_decap++;
942
943 /*
944 * Decap the first frame, bust it apart from the
945 * second and deliver; then decap the second frame
946 * and return it to the caller for normal delivery.
947 */
948 m = ieee80211_decap1(m, &framelen);
949 if (m == NULL) {
950 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
951 ni->ni_macaddr, "fast-frame", "%s", "first decap failed");
952 ic->ic_stats.is_ff_tooshort++;
953 return NULL;
954 }
955 n = m_split(m, framelen, M_NOWAIT);
956 if (n == NULL) {
957 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
958 ni->ni_macaddr, "fast-frame",
959 "%s", "unable to split encapsulated frames");
960 ic->ic_stats.is_ff_split++;
961 m_freem(m); /* NB: must reclaim */
962 return NULL;
963 }
964 ieee80211_deliver_data(ic, ni, m); /* 1st of pair */
965
966 /*
967 * Decap second frame.
968 */
969 m_adj(n, roundup2(framelen, 4) - framelen); /* padding */
970 n = ieee80211_decap1(n, &framelen);
971 if (n == NULL) {
972 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
973 ni->ni_macaddr, "fast-frame", "%s", "second decap failed");
974 ic->ic_stats.is_ff_tooshort++;
975 }
976 /* XXX verify framelen against mbuf contents */
977 return n; /* 2nd delivered by caller */
978 #undef MS
979 }
980
981 /*
982 * Install received rate set information in the node's state block.
983 */
984 int
985 ieee80211_setup_rates(struct ieee80211_node *ni,
986 const uint8_t *rates, const uint8_t *xrates, int flags)
987 {
988 struct ieee80211com *ic = ni->ni_ic;
989 struct ieee80211_rateset *rs = &ni->ni_rates;
990
991 memset(rs, 0, sizeof(*rs));
992 rs->rs_nrates = rates[1];
993 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
994 if (xrates != NULL) {
995 uint8_t nxrates;
996 /*
997 * Tack on 11g extended supported rate element.
998 */
999 nxrates = xrates[1];
1000 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
1001 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
1002 IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE,
1003 "[%s] extended rate set too large;"
1004 " only using %u of %u rates\n",
1005 ether_sprintf(ni->ni_macaddr), nxrates, xrates[1]);
1006 ic->ic_stats.is_rx_rstoobig++;
1007 }
1008 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
1009 rs->rs_nrates += nxrates;
1010 }
1011 return ieee80211_fix_rate(ni, rs, flags);
1012 }
1013
1014 static void
1015 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh,
1016 struct ieee80211_node *ni, int rssi, int noise, uint32_t rstamp,
1017 uint16_t seq, uint16_t status)
1018 {
1019
1020 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
1021 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1022 ni->ni_macaddr, "open auth",
1023 "bad sta auth mode %u", ni->ni_authmode);
1024 ic->ic_stats.is_rx_bad_auth++; /* XXX */
1025 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1026 /*
1027 * Clear any challenge text that may be there if
1028 * a previous shared key auth failed and then an
1029 * open auth is attempted.
1030 */
1031 if (ni->ni_challenge != NULL) {
1032 FREE(ni->ni_challenge, M_80211_NODE);
1033 ni->ni_challenge = NULL;
1034 }
1035 /* XXX hack to workaround calling convention */
1036 ieee80211_send_error(ic, ni, wh->i_addr2,
1037 IEEE80211_FC0_SUBTYPE_AUTH,
1038 (seq + 1) | (IEEE80211_STATUS_ALG<<16));
1039 }
1040 return;
1041 }
1042 switch (ic->ic_opmode) {
1043 case IEEE80211_M_IBSS:
1044 case IEEE80211_M_AHDEMO:
1045 case IEEE80211_M_MONITOR:
1046 case IEEE80211_M_WDS:
1047 /* should not come here */
1048 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1049 ni->ni_macaddr, "open auth",
1050 "bad operating mode %u", ic->ic_opmode);
1051 break;
1052
1053 case IEEE80211_M_HOSTAP:
1054 if (ic->ic_state != IEEE80211_S_RUN ||
1055 seq != IEEE80211_AUTH_OPEN_REQUEST) {
1056 ic->ic_stats.is_rx_bad_auth++;
1057 return;
1058 }
1059 /* always accept open authentication requests */
1060 if (ni == ic->ic_bss) {
1061 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
1062 if (ni == NULL)
1063 return;
1064 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1065 (void) ieee80211_ref_node(ni);
1066 /*
1067 * Mark the node as referenced to reflect that it's
1068 * reference count has been bumped to insure it remains
1069 * after the transaction completes.
1070 */
1071 ni->ni_flags |= IEEE80211_NODE_AREF;
1072
1073 IEEE80211_SEND_MGMT(ic, ni,
1074 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1075 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1076 "[%s] station authenticated (open)\n",
1077 ether_sprintf(ni->ni_macaddr));
1078 /*
1079 * When 802.1x is not in use mark the port
1080 * authorized at this point so traffic can flow.
1081 */
1082 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
1083 ieee80211_node_authorize(ni);
1084 break;
1085
1086 case IEEE80211_M_STA:
1087 if (ic->ic_state != IEEE80211_S_AUTH ||
1088 seq != IEEE80211_AUTH_OPEN_RESPONSE) {
1089 ic->ic_stats.is_rx_bad_auth++;
1090 return;
1091 }
1092 if (status != 0) {
1093 IEEE80211_DPRINTF(ic,
1094 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1095 "[%s] open auth failed (reason %d)\n",
1096 ether_sprintf(ni->ni_macaddr), status);
1097 /* XXX can this happen? */
1098 if (ni != ic->ic_bss)
1099 ni->ni_fails++;
1100 ic->ic_stats.is_rx_auth_fail++;
1101 ieee80211_new_state(ic, IEEE80211_S_SCAN,
1102 IEEE80211_SCAN_FAIL_STATUS);
1103 } else
1104 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
1105 break;
1106 }
1107 }
1108
1109 /*
1110 * Send a management frame error response to the specified
1111 * station. If ni is associated with the station then use
1112 * it; otherwise allocate a temporary node suitable for
1113 * transmitting the frame and then free the reference so
1114 * it will go away as soon as the frame has been transmitted.
1115 */
1116 static void
1117 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni,
1118 const uint8_t *mac, int subtype, int arg)
1119 {
1120 int istmp;
1121
1122 if (ni == ic->ic_bss) {
1123 ni = ieee80211_tmp_node(ic, mac);
1124 if (ni == NULL) {
1125 /* XXX msg */
1126 return;
1127 }
1128 istmp = 1;
1129 } else
1130 istmp = 0;
1131 IEEE80211_SEND_MGMT(ic, ni, subtype, arg);
1132 if (istmp)
1133 ieee80211_free_node(ni);
1134 }
1135
1136 static int
1137 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni)
1138 {
1139 if (ni->ni_challenge == NULL)
1140 MALLOC(ni->ni_challenge, uint32_t*, IEEE80211_CHALLENGE_LEN,
1141 M_80211_NODE, M_NOWAIT);
1142 if (ni->ni_challenge == NULL) {
1143 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1144 "[%s] shared key challenge alloc failed\n",
1145 ether_sprintf(ni->ni_macaddr));
1146 /* XXX statistic */
1147 }
1148 return (ni->ni_challenge != NULL);
1149 }
1150
1151 /* XXX TODO: add statistics */
1152 static void
1153 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh,
1154 uint8_t *frm, uint8_t *efrm, struct ieee80211_node *ni,
1155 int rssi, int noise, uint32_t rstamp, uint16_t seq, uint16_t status)
1156 {
1157 uint8_t *challenge;
1158 int allocbs, estatus;
1159
1160 /*
1161 * NB: this can happen as we allow pre-shared key
1162 * authentication to be enabled w/o wep being turned
1163 * on so that configuration of these can be done
1164 * in any order. It may be better to enforce the
1165 * ordering in which case this check would just be
1166 * for sanity/consistency.
1167 */
1168 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
1169 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1170 ni->ni_macaddr, "shared key auth",
1171 "%s", " PRIVACY is disabled");
1172 estatus = IEEE80211_STATUS_ALG;
1173 goto bad;
1174 }
1175 /*
1176 * Pre-shared key authentication is evil; accept
1177 * it only if explicitly configured (it is supported
1178 * mainly for compatibility with clients like OS X).
1179 */
1180 if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1181 ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1182 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1183 ni->ni_macaddr, "shared key auth",
1184 "bad sta auth mode %u", ni->ni_authmode);
1185 ic->ic_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1186 estatus = IEEE80211_STATUS_ALG;
1187 goto bad;
1188 }
1189
1190 challenge = NULL;
1191 if (frm + 1 < efrm) {
1192 if ((frm[1] + 2) > (efrm - frm)) {
1193 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1194 ni->ni_macaddr, "shared key auth",
1195 "ie %d/%d too long",
1196 frm[0], (frm[1] + 2) - (efrm - frm));
1197 ic->ic_stats.is_rx_bad_auth++;
1198 estatus = IEEE80211_STATUS_CHALLENGE;
1199 goto bad;
1200 }
1201 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1202 challenge = frm;
1203 frm += frm[1] + 2;
1204 }
1205 switch (seq) {
1206 case IEEE80211_AUTH_SHARED_CHALLENGE:
1207 case IEEE80211_AUTH_SHARED_RESPONSE:
1208 if (challenge == NULL) {
1209 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1210 ni->ni_macaddr, "shared key auth",
1211 "%s", "no challenge");
1212 ic->ic_stats.is_rx_bad_auth++;
1213 estatus = IEEE80211_STATUS_CHALLENGE;
1214 goto bad;
1215 }
1216 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1217 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1218 ni->ni_macaddr, "shared key auth",
1219 "bad challenge len %d", challenge[1]);
1220 ic->ic_stats.is_rx_bad_auth++;
1221 estatus = IEEE80211_STATUS_CHALLENGE;
1222 goto bad;
1223 }
1224 default:
1225 break;
1226 }
1227 switch (ic->ic_opmode) {
1228 case IEEE80211_M_MONITOR:
1229 case IEEE80211_M_AHDEMO:
1230 case IEEE80211_M_IBSS:
1231 case IEEE80211_M_WDS:
1232 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1233 ni->ni_macaddr, "shared key auth",
1234 "bad operating mode %u", ic->ic_opmode);
1235 return;
1236 case IEEE80211_M_HOSTAP:
1237 if (ic->ic_state != IEEE80211_S_RUN) {
1238 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1239 ni->ni_macaddr, "shared key auth",
1240 "bad state %u", ic->ic_state);
1241 estatus = IEEE80211_STATUS_ALG; /* XXX */
1242 goto bad;
1243 }
1244 switch (seq) {
1245 case IEEE80211_AUTH_SHARED_REQUEST:
1246 if (ni == ic->ic_bss) {
1247 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
1248 if (ni == NULL) {
1249 /* NB: no way to return an error */
1250 return;
1251 }
1252 allocbs = 1;
1253 } else {
1254 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1255 (void) ieee80211_ref_node(ni);
1256 allocbs = 0;
1257 }
1258 /*
1259 * Mark the node as referenced to reflect that it's
1260 * reference count has been bumped to insure it remains
1261 * after the transaction completes.
1262 */
1263 ni->ni_flags |= IEEE80211_NODE_AREF;
1264 ni->ni_rssi = rssi;
1265 ni->ni_noise = noise;
1266 ni->ni_rstamp = rstamp;
1267 if (!alloc_challenge(ic, ni)) {
1268 /* NB: don't return error so they rexmit */
1269 return;
1270 }
1271 get_random_bytes(ni->ni_challenge,
1272 IEEE80211_CHALLENGE_LEN);
1273 IEEE80211_DPRINTF(ic,
1274 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1275 "[%s] shared key %sauth request\n",
1276 ether_sprintf(ni->ni_macaddr),
1277 allocbs ? "" : "re");
1278 break;
1279 case IEEE80211_AUTH_SHARED_RESPONSE:
1280 if (ni == ic->ic_bss) {
1281 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1282 ni->ni_macaddr, "shared key response",
1283 "%s", "unknown station");
1284 /* NB: don't send a response */
1285 return;
1286 }
1287 if (ni->ni_challenge == NULL) {
1288 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1289 ni->ni_macaddr, "shared key response",
1290 "%s", "no challenge recorded");
1291 ic->ic_stats.is_rx_bad_auth++;
1292 estatus = IEEE80211_STATUS_CHALLENGE;
1293 goto bad;
1294 }
1295 if (memcmp(ni->ni_challenge, &challenge[2],
1296 challenge[1]) != 0) {
1297 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1298 ni->ni_macaddr, "shared key response",
1299 "%s", "challenge mismatch");
1300 ic->ic_stats.is_rx_auth_fail++;
1301 estatus = IEEE80211_STATUS_CHALLENGE;
1302 goto bad;
1303 }
1304 IEEE80211_DPRINTF(ic,
1305 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1306 "[%s] station authenticated (shared key)\n",
1307 ether_sprintf(ni->ni_macaddr));
1308 ieee80211_node_authorize(ni);
1309 break;
1310 default:
1311 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1312 ni->ni_macaddr, "shared key auth",
1313 "bad seq %d", seq);
1314 ic->ic_stats.is_rx_bad_auth++;
1315 estatus = IEEE80211_STATUS_SEQUENCE;
1316 goto bad;
1317 }
1318 IEEE80211_SEND_MGMT(ic, ni,
1319 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1320 break;
1321
1322 case IEEE80211_M_STA:
1323 if (ic->ic_state != IEEE80211_S_AUTH)
1324 return;
1325 switch (seq) {
1326 case IEEE80211_AUTH_SHARED_PASS:
1327 if (ni->ni_challenge != NULL) {
1328 FREE(ni->ni_challenge, M_80211_NODE);
1329 ni->ni_challenge = NULL;
1330 }
1331 if (status != 0) {
1332 IEEE80211_DPRINTF(ic,
1333 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1334 "[%s] shared key auth failed (reason %d)\n",
1335 ether_sprintf(ieee80211_getbssid(ic, wh)),
1336 status);
1337 /* XXX can this happen? */
1338 if (ni != ic->ic_bss)
1339 ni->ni_fails++;
1340 ic->ic_stats.is_rx_auth_fail++;
1341 return;
1342 }
1343 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
1344 break;
1345 case IEEE80211_AUTH_SHARED_CHALLENGE:
1346 if (!alloc_challenge(ic, ni))
1347 return;
1348 /* XXX could optimize by passing recvd challenge */
1349 memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1350 IEEE80211_SEND_MGMT(ic, ni,
1351 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1352 break;
1353 default:
1354 IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH,
1355 wh, "shared key auth", "bad seq %d", seq);
1356 ic->ic_stats.is_rx_bad_auth++;
1357 return;
1358 }
1359 break;
1360 }
1361 return;
1362 bad:
1363 /*
1364 * Send an error response; but only when operating as an AP.
1365 */
1366 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1367 /* XXX hack to workaround calling convention */
1368 ieee80211_send_error(ic, ni, wh->i_addr2,
1369 IEEE80211_FC0_SUBTYPE_AUTH,
1370 (seq + 1) | (estatus<<16));
1371 } else if (ic->ic_opmode == IEEE80211_M_STA) {
1372 /*
1373 * Kick the state machine. This short-circuits
1374 * using the mgt frame timeout to trigger the
1375 * state transition.
1376 */
1377 if (ic->ic_state == IEEE80211_S_AUTH)
1378 ieee80211_new_state(ic, IEEE80211_S_SCAN,
1379 IEEE80211_SCAN_FAIL_STATUS);
1380 }
1381 }
1382
1383 /*
1384 * Convert a WPA cipher selector OUI to an internal
1385 * cipher algorithm. Where appropriate we also
1386 * record any key length.
1387 */
1388 static int
1389 wpa_cipher(uint8_t *sel, uint8_t *keylen)
1390 {
1391 #define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1392 uint32_t w = LE_READ_4(sel);
1393
1394 switch (w) {
1395 case WPA_SEL(WPA_CSE_NULL):
1396 return IEEE80211_CIPHER_NONE;
1397 case WPA_SEL(WPA_CSE_WEP40):
1398 if (keylen)
1399 *keylen = 40 / NBBY;
1400 return IEEE80211_CIPHER_WEP;
1401 case WPA_SEL(WPA_CSE_WEP104):
1402 if (keylen)
1403 *keylen = 104 / NBBY;
1404 return IEEE80211_CIPHER_WEP;
1405 case WPA_SEL(WPA_CSE_TKIP):
1406 return IEEE80211_CIPHER_TKIP;
1407 case WPA_SEL(WPA_CSE_CCMP):
1408 return IEEE80211_CIPHER_AES_CCM;
1409 }
1410 return 32; /* NB: so 1<< is discarded */
1411 #undef WPA_SEL
1412 }
1413
1414 /*
1415 * Convert a WPA key management/authentication algorithm
1416 * to an internal code.
1417 */
1418 static int
1419 wpa_keymgmt(uint8_t *sel)
1420 {
1421 #define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1422 uint32_t w = LE_READ_4(sel);
1423
1424 switch (w) {
1425 case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1426 return WPA_ASE_8021X_UNSPEC;
1427 case WPA_SEL(WPA_ASE_8021X_PSK):
1428 return WPA_ASE_8021X_PSK;
1429 case WPA_SEL(WPA_ASE_NONE):
1430 return WPA_ASE_NONE;
1431 }
1432 return 0; /* NB: so is discarded */
1433 #undef WPA_SEL
1434 }
1435
1436 /*
1437 * Parse a WPA information element to collect parameters
1438 * and validate the parameters against what has been
1439 * configured for the system.
1440 */
1441 static int
1442 ieee80211_parse_wpa(struct ieee80211com *ic, uint8_t *frm,
1443 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1444 {
1445 uint8_t len = frm[1];
1446 uint32_t w;
1447 int n;
1448
1449 /*
1450 * Check the length once for fixed parts: OUI, type,
1451 * version, mcast cipher, and 2 selector counts.
1452 * Other, variable-length data, must be checked separately.
1453 */
1454 if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) {
1455 IEEE80211_DISCARD_IE(ic,
1456 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1457 wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags);
1458 return IEEE80211_REASON_IE_INVALID;
1459 }
1460 if (len < 14) {
1461 IEEE80211_DISCARD_IE(ic,
1462 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1463 wh, "WPA", "too short, len %u", len);
1464 return IEEE80211_REASON_IE_INVALID;
1465 }
1466 frm += 6, len -= 4; /* NB: len is payload only */
1467 /* NB: iswpaoui already validated the OUI and type */
1468 w = LE_READ_2(frm);
1469 if (w != WPA_VERSION) {
1470 IEEE80211_DISCARD_IE(ic,
1471 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1472 wh, "WPA", "bad version %u", w);
1473 return IEEE80211_REASON_IE_INVALID;
1474 }
1475 frm += 2, len -= 2;
1476
1477 /* multicast/group cipher */
1478 w = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1479 if (w != rsn->rsn_mcastcipher) {
1480 IEEE80211_DISCARD_IE(ic,
1481 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1482 wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
1483 w, rsn->rsn_mcastcipher);
1484 return IEEE80211_REASON_IE_INVALID;
1485 }
1486 frm += 4, len -= 4;
1487
1488 /* unicast ciphers */
1489 n = LE_READ_2(frm);
1490 frm += 2, len -= 2;
1491 if (len < n*4+2) {
1492 IEEE80211_DISCARD_IE(ic,
1493 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1494 wh, "WPA", "ucast cipher data too short; len %u, n %u",
1495 len, n);
1496 return IEEE80211_REASON_IE_INVALID;
1497 }
1498 w = 0;
1499 for (; n > 0; n--) {
1500 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1501 frm += 4, len -= 4;
1502 }
1503 w &= rsn->rsn_ucastcipherset;
1504 if (w == 0) {
1505 IEEE80211_DISCARD_IE(ic,
1506 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1507 wh, "WPA", "%s", "ucast cipher set empty");
1508 return IEEE80211_REASON_IE_INVALID;
1509 }
1510 if (w & (1<<IEEE80211_CIPHER_TKIP))
1511 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1512 else
1513 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1514
1515 /* key management algorithms */
1516 n = LE_READ_2(frm);
1517 frm += 2, len -= 2;
1518 if (len < n*4) {
1519 IEEE80211_DISCARD_IE(ic,
1520 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1521 wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1522 len, n);
1523 return IEEE80211_REASON_IE_INVALID;
1524 }
1525 w = 0;
1526 for (; n > 0; n--) {
1527 w |= wpa_keymgmt(frm);
1528 frm += 4, len -= 4;
1529 }
1530 w &= rsn->rsn_keymgmtset;
1531 if (w == 0) {
1532 IEEE80211_DISCARD_IE(ic,
1533 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1534 wh, "WPA", "%s", "no acceptable key mgmt alg");
1535 return IEEE80211_REASON_IE_INVALID;
1536 }
1537 if (w & WPA_ASE_8021X_UNSPEC)
1538 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1539 else
1540 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1541
1542 if (len > 2) /* optional capabilities */
1543 rsn->rsn_caps = LE_READ_2(frm);
1544
1545 return 0;
1546 }
1547
1548 /*
1549 * Convert an RSN cipher selector OUI to an internal
1550 * cipher algorithm. Where appropriate we also
1551 * record any key length.
1552 */
1553 static int
1554 rsn_cipher(uint8_t *sel, uint8_t *keylen)
1555 {
1556 #define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1557 uint32_t w = LE_READ_4(sel);
1558
1559 switch (w) {
1560 case RSN_SEL(RSN_CSE_NULL):
1561 return IEEE80211_CIPHER_NONE;
1562 case RSN_SEL(RSN_CSE_WEP40):
1563 if (keylen)
1564 *keylen = 40 / NBBY;
1565 return IEEE80211_CIPHER_WEP;
1566 case RSN_SEL(RSN_CSE_WEP104):
1567 if (keylen)
1568 *keylen = 104 / NBBY;
1569 return IEEE80211_CIPHER_WEP;
1570 case RSN_SEL(RSN_CSE_TKIP):
1571 return IEEE80211_CIPHER_TKIP;
1572 case RSN_SEL(RSN_CSE_CCMP):
1573 return IEEE80211_CIPHER_AES_CCM;
1574 case RSN_SEL(RSN_CSE_WRAP):
1575 return IEEE80211_CIPHER_AES_OCB;
1576 }
1577 return 32; /* NB: so 1<< is discarded */
1578 #undef WPA_SEL
1579 }
1580
1581 /*
1582 * Convert an RSN key management/authentication algorithm
1583 * to an internal code.
1584 */
1585 static int
1586 rsn_keymgmt(uint8_t *sel)
1587 {
1588 #define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1589 uint32_t w = LE_READ_4(sel);
1590
1591 switch (w) {
1592 case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1593 return RSN_ASE_8021X_UNSPEC;
1594 case RSN_SEL(RSN_ASE_8021X_PSK):
1595 return RSN_ASE_8021X_PSK;
1596 case RSN_SEL(RSN_ASE_NONE):
1597 return RSN_ASE_NONE;
1598 }
1599 return 0; /* NB: so is discarded */
1600 #undef RSN_SEL
1601 }
1602
1603 /*
1604 * Parse a WPA/RSN information element to collect parameters
1605 * and validate the parameters against what has been
1606 * configured for the system.
1607 */
1608 static int
1609 ieee80211_parse_rsn(struct ieee80211com *ic, uint8_t *frm,
1610 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1611 {
1612 uint8_t len = frm[1];
1613 uint32_t w;
1614 int n;
1615
1616 /*
1617 * Check the length once for fixed parts:
1618 * version, mcast cipher, and 2 selector counts.
1619 * Other, variable-length data, must be checked separately.
1620 */
1621 if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) {
1622 IEEE80211_DISCARD_IE(ic,
1623 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1624 wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags);
1625 return IEEE80211_REASON_IE_INVALID;
1626 }
1627 if (len < 10) {
1628 IEEE80211_DISCARD_IE(ic,
1629 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1630 wh, "RSN", "too short, len %u", len);
1631 return IEEE80211_REASON_IE_INVALID;
1632 }
1633 frm += 2;
1634 w = LE_READ_2(frm);
1635 if (w != RSN_VERSION) {
1636 IEEE80211_DISCARD_IE(ic,
1637 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1638 wh, "RSN", "bad version %u", w);
1639 return IEEE80211_REASON_IE_INVALID;
1640 }
1641 frm += 2, len -= 2;
1642
1643 /* multicast/group cipher */
1644 w = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1645 if (w != rsn->rsn_mcastcipher) {
1646 IEEE80211_DISCARD_IE(ic,
1647 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1648 wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
1649 w, rsn->rsn_mcastcipher);
1650 return IEEE80211_REASON_IE_INVALID;
1651 }
1652 frm += 4, len -= 4;
1653
1654 /* unicast ciphers */
1655 n = LE_READ_2(frm);
1656 frm += 2, len -= 2;
1657 if (len < n*4+2) {
1658 IEEE80211_DISCARD_IE(ic,
1659 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1660 wh, "RSN", "ucast cipher data too short; len %u, n %u",
1661 len, n);
1662 return IEEE80211_REASON_IE_INVALID;
1663 }
1664 w = 0;
1665 for (; n > 0; n--) {
1666 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1667 frm += 4, len -= 4;
1668 }
1669 w &= rsn->rsn_ucastcipherset;
1670 if (w == 0) {
1671 IEEE80211_DISCARD_IE(ic,
1672 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1673 wh, "RSN", "%s", "ucast cipher set empty");
1674 return IEEE80211_REASON_IE_INVALID;
1675 }
1676 if (w & (1<<IEEE80211_CIPHER_TKIP))
1677 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1678 else
1679 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1680
1681 /* key management algorithms */
1682 n = LE_READ_2(frm);
1683 frm += 2, len -= 2;
1684 if (len < n*4) {
1685 IEEE80211_DISCARD_IE(ic,
1686 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1687 wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1688 len, n);
1689 return IEEE80211_REASON_IE_INVALID;
1690 }
1691 w = 0;
1692 for (; n > 0; n--) {
1693 w |= rsn_keymgmt(frm);
1694 frm += 4, len -= 4;
1695 }
1696 w &= rsn->rsn_keymgmtset;
1697 if (w == 0) {
1698 IEEE80211_DISCARD_IE(ic,
1699 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1700 wh, "RSN", "%s", "no acceptable key mgmt alg");
1701 return IEEE80211_REASON_IE_INVALID;
1702 }
1703 if (w & RSN_ASE_8021X_UNSPEC)
1704 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1705 else
1706 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1707
1708 /* optional RSN capabilities */
1709 if (len > 2)
1710 rsn->rsn_caps = LE_READ_2(frm);
1711 /* XXXPMKID */
1712
1713 return 0;
1714 }
1715
1716 static int
1717 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm,
1718 const struct ieee80211_frame *wh)
1719 {
1720 #define MS(_v, _f) (((_v) & _f) >> _f##_S)
1721 struct ieee80211_wme_state *wme = &ic->ic_wme;
1722 u_int len = frm[1], qosinfo;
1723 int i;
1724
1725 if (len < sizeof(struct ieee80211_wme_param)-2) {
1726 IEEE80211_DISCARD_IE(ic,
1727 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1728 wh, "WME", "too short, len %u", len);
1729 return -1;
1730 }
1731 qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1732 qosinfo &= WME_QOSINFO_COUNT;
1733 /* XXX do proper check for wraparound */
1734 if (qosinfo == wme->wme_wmeChanParams.cap_info)
1735 return 0;
1736 frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1737 for (i = 0; i < WME_NUM_AC; i++) {
1738 struct wmeParams *wmep =
1739 &wme->wme_wmeChanParams.cap_wmeParams[i];
1740 /* NB: ACI not used */
1741 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1742 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1743 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1744 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1745 wmep->wmep_txopLimit = LE_READ_2(frm+2);
1746 frm += 4;
1747 }
1748 wme->wme_wmeChanParams.cap_info = qosinfo;
1749 return 1;
1750 #undef MS
1751 }
1752
1753 static int
1754 ieee80211_parse_athparams(struct ieee80211_node *ni, uint8_t *frm,
1755 const struct ieee80211_frame *wh)
1756 {
1757 struct ieee80211com *ic = ni->ni_ic;
1758 const struct ieee80211_ath_ie *ath;
1759 u_int len = frm[1];
1760 int capschanged;
1761 uint16_t defkeyix;
1762
1763 if (len < sizeof(struct ieee80211_ath_ie)-2) {
1764 IEEE80211_DISCARD_IE(ic,
1765 IEEE80211_MSG_ELEMID | IEEE80211_MSG_SUPERG,
1766 wh, "Atheros", "too short, len %u", len);
1767 return -1;
1768 }
1769 ath = (const struct ieee80211_ath_ie *)frm;
1770 capschanged = (ni->ni_ath_flags != ath->ath_capability);
1771 defkeyix = LE_READ_2(ath->ath_defkeyix);
1772 if (capschanged || defkeyix != ni->ni_ath_defkeyix) {
1773 ni->ni_ath_flags = ath->ath_capability;
1774 ni->ni_ath_defkeyix = defkeyix;
1775 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SUPERG,
1776 "[%s] ath ie change: new caps 0x%x defkeyix 0x%x\n",
1777 ether_sprintf(ni->ni_macaddr),
1778 ni->ni_ath_flags, ni->ni_ath_defkeyix);
1779 }
1780 if (IEEE80211_ATH_CAP(ic, ni, ATHEROS_CAP_TURBO_PRIME)) {
1781 uint16_t curflags, newflags;
1782
1783 /*
1784 * Check for turbo mode switch. Calculate flags
1785 * for the new mode and effect the switch.
1786 */
1787 newflags = curflags = ic->ic_bsschan->ic_flags;
1788 /* NB: BOOST is not in ic_flags, so get it from the ie */
1789 if (ath->ath_capability & ATHEROS_CAP_BOOST)
1790 newflags |= IEEE80211_CHAN_TURBO;
1791 else
1792 newflags &= ~IEEE80211_CHAN_TURBO;
1793 if (newflags != curflags)
1794 ieee80211_dturbo_switch(ic, newflags);
1795 }
1796 return capschanged;
1797 }
1798
1799 void
1800 ieee80211_parse_ath(struct ieee80211_node *ni, uint8_t *ie)
1801 {
1802 const struct ieee80211_ath_ie *ath =
1803 (const struct ieee80211_ath_ie *) ie;
1804
1805 ni->ni_ath_flags = ath->ath_capability;
1806 ni->ni_ath_defkeyix = LE_READ_2(&ath->ath_defkeyix);
1807 }
1808
1809 /* XXX find a better place for definition */
1810 struct l2_update_frame {
1811 struct ether_header eh;
1812 uint8_t dsap;
1813 uint8_t ssap;
1814 uint8_t control;
1815 uint8_t xid[3];
1816 } __packed;
1817
1818 /*
1819 * Deliver a TGf L2UF frame on behalf of a station.
1820 * This primes any bridge when the station is roaming
1821 * between ap's on the same wired network.
1822 */
1823 static void
1824 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1825 {
1826 struct ieee80211com *ic = ni->ni_ic;
1827 struct ifnet *ifp = ic->ic_ifp;
1828 struct mbuf *m;
1829 struct l2_update_frame *l2uf;
1830 struct ether_header *eh;
1831
1832 m = m_gethdr(M_NOWAIT, MT_DATA);
1833 if (m == NULL) {
1834 IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1835 "%s", "no mbuf for l2uf frame");
1836 ic->ic_stats.is_rx_nobuf++; /* XXX not right */
1837 return;
1838 }
1839 l2uf = mtod(m, struct l2_update_frame *);
1840 eh = &l2uf->eh;
1841 /* dst: Broadcast address */
1842 IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1843 /* src: associated STA */
1844 IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1845 eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1846
1847 l2uf->dsap = 0;
1848 l2uf->ssap = 0;
1849 l2uf->control = 0xf5;
1850 l2uf->xid[0] = 0x81;
1851 l2uf->xid[1] = 0x80;
1852 l2uf->xid[2] = 0x00;
1853
1854 m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1855 ieee80211_deliver_data(ic, ni, m);
1856 }
1857
1858 static __inline int
1859 contbgscan(struct ieee80211com *ic)
1860 {
1861 return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1862 time_after(ticks, ic->ic_lastdata + ic->ic_bgscanidle));
1863 }
1864
1865 static __inline int
1866 startbgscan(struct ieee80211com *ic)
1867 {
1868 return ((ic->ic_flags & IEEE80211_F_BGSCAN) &&
1869 !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1870 time_after(ticks, ic->ic_lastscan + ic->ic_bgscanintvl) &&
1871 time_after(ticks, ic->ic_lastdata + ic->ic_bgscanidle));
1872 }
1873
1874 static void
1875 ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1876 int reassoc, int resp, const char *tag, int rate)
1877 {
1878 struct ieee80211com *ic = ni->ni_ic;
1879
1880 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1881 "[%s] deny %s request, %s rate set mismatch, rate 0x%x\n",
1882 ether_sprintf(wh->i_addr2),
1883 reassoc ? "reassoc" : "assoc", tag, rate);
1884 IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_BASIC_RATE);
1885 ieee80211_node_leave(ic, ni);
1886 ic->ic_stats.is_rx_assoc_norate++;
1887 }
1888
1889 static void
1890 capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1891 int reassoc, int resp, const char *tag, int capinfo)
1892 {
1893 struct ieee80211com *ic = ni->ni_ic;
1894
1895 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1896 "[%s] deny %s request, %s mismatch 0x%x\n",
1897 ether_sprintf(wh->i_addr2),
1898 reassoc ? "reassoc" : "assoc", tag, capinfo);
1899 IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_CAPINFO);
1900 ieee80211_node_leave(ic, ni);
1901 ic->ic_stats.is_rx_assoc_capmismatch++;
1902 }
1903
1904 static void
1905 htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1906 int reassoc, int resp)
1907 {
1908 struct ieee80211com *ic = ni->ni_ic;
1909
1910 IEEE80211_NOTE_MAC(ic, IEEE80211_MSG_ANY, wh->i_addr2,
1911 "deny %s request, %s missing HT ie", reassoc ? "reassoc" : "assoc");
1912 /* XXX no better code */
1913 IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_OTHER);
1914 ieee80211_node_leave(ic, ni);
1915 }
1916
1917 void
1918 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
1919 struct ieee80211_node *ni,
1920 int subtype, int rssi, int noise, uint32_t rstamp)
1921 {
1922 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1923 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1924 struct ieee80211_frame *wh;
1925 uint8_t *frm, *efrm, *sfrm;
1926 uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap, *htinfo;
1927 int reassoc, resp, allocbs;
1928 uint8_t rate;
1929
1930 wh = mtod(m0, struct ieee80211_frame *);
1931 frm = (uint8_t *)&wh[1];
1932 efrm = mtod(m0, uint8_t *) + m0->m_len;
1933 switch (subtype) {
1934 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1935 case IEEE80211_FC0_SUBTYPE_BEACON: {
1936 struct ieee80211_scanparams scan;
1937
1938 /*
1939 * We process beacon/probe response frames:
1940 * o when scanning, or
1941 * o station mode when associated (to collect state
1942 * updates such as 802.11g slot time), or
1943 * o adhoc mode (to discover neighbors)
1944 * Frames otherwise received are discarded.
1945 */
1946 if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
1947 (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) ||
1948 ic->ic_opmode == IEEE80211_M_IBSS)) {
1949 ic->ic_stats.is_rx_mgtdiscard++;
1950 return;
1951 }
1952 /*
1953 * beacon/probe response frame format
1954 * [8] time stamp
1955 * [2] beacon interval
1956 * [2] capability information
1957 * [tlv] ssid
1958 * [tlv] supported rates
1959 * [tlv] country information
1960 * [tlv] parameter set (FH/DS)
1961 * [tlv] erp information
1962 * [tlv] extended supported rates
1963 * [tlv] WME
1964 * [tlv] WPA or RSN
1965 * [tlv] HT capabilities
1966 * [tlv] HT information
1967 * [tlv] Atheros capabilities
1968 */
1969 IEEE80211_VERIFY_LENGTH(efrm - frm, 12, return);
1970 memset(&scan, 0, sizeof(scan));
1971 scan.tstamp = frm; frm += 8;
1972 scan.bintval = le16toh(*(uint16_t *)frm); frm += 2;
1973 scan.capinfo = le16toh(*(uint16_t *)frm); frm += 2;
1974 scan.bchan = IEEE80211_CHAN2IEEE(ic->ic_curchan);
1975 scan.curchan = ic->ic_curchan;
1976 scan.ies = frm;
1977 scan.ies_len = efrm - frm;
1978
1979 while (efrm - frm > 1) {
1980 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1981 switch (*frm) {
1982 case IEEE80211_ELEMID_SSID:
1983 scan.ssid = frm;
1984 break;
1985 case IEEE80211_ELEMID_RATES:
1986 scan.rates = frm;
1987 break;
1988 case IEEE80211_ELEMID_COUNTRY:
1989 scan.country = frm;
1990 break;
1991 case IEEE80211_ELEMID_FHPARMS:
1992 if (ic->ic_phytype == IEEE80211_T_FH) {
1993 scan.fhdwell = LE_READ_2(&frm[2]);
1994 scan.bchan = IEEE80211_FH_CHAN(frm[4], frm[5]);
1995 scan.fhindex = frm[6];
1996 }
1997 break;
1998 case IEEE80211_ELEMID_DSPARMS:
1999 /*
2000 * XXX hack this since depending on phytype
2001 * is problematic for multi-mode devices.
2002 */
2003 if (ic->ic_phytype != IEEE80211_T_FH)
2004 scan.bchan = frm[2];
2005 break;
2006 case IEEE80211_ELEMID_TIM:
2007 /* XXX ATIM? */
2008 scan.tim = frm;
2009 scan.timoff = frm - mtod(m0, uint8_t *);
2010 break;
2011 case IEEE80211_ELEMID_IBSSPARMS:
2012 break;
2013 case IEEE80211_ELEMID_XRATES:
2014 scan.xrates = frm;
2015 break;
2016 case IEEE80211_ELEMID_ERP:
2017 if (frm[1] != 1) {
2018 IEEE80211_DISCARD_IE(ic,
2019 IEEE80211_MSG_ELEMID, wh, "ERP",
2020 "bad len %u", frm[1]);
2021 ic->ic_stats.is_rx_elem_toobig++;
2022 break;
2023 }
2024 scan.erp = frm[2];
2025 break;
2026 case IEEE80211_ELEMID_HTCAP:
2027 scan.htcap = frm;
2028 break;
2029 case IEEE80211_ELEMID_RSN:
2030 scan.rsn = frm;
2031 break;
2032 case IEEE80211_ELEMID_HTINFO:
2033 scan.htinfo = frm;
2034 break;
2035 case IEEE80211_ELEMID_VENDOR:
2036 if (iswpaoui(frm))
2037 scan.wpa = frm;
2038 else if (iswmeparam(frm) || iswmeinfo(frm))
2039 scan.wme = frm;
2040 else if (isatherosoui(frm))
2041 scan.ath = frm;
2042 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
2043 /*
2044 * Accept pre-draft HT ie's if the
2045 * standard ones have not been seen.
2046 */
2047 if (ishtcapoui(frm)) {
2048 if (scan.htcap == NULL)
2049 scan.htcap = frm;
2050 } else if (ishtinfooui(frm)) {
2051 if (scan.htinfo == NULL)
2052 scan.htcap = frm;
2053 }
2054 }
2055 break;
2056 default:
2057 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID,
2058 wh, "unhandled",
2059 "id %u, len %u", *frm, frm[1]);
2060 ic->ic_stats.is_rx_elem_unknown++;
2061 break;
2062 }
2063 frm += frm[1] + 2;
2064 }
2065 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
2066 if (scan.xrates != NULL)
2067 IEEE80211_VERIFY_ELEMENT(scan.xrates,
2068 IEEE80211_RATE_MAXSIZE - scan.rates[1]);
2069 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
2070 #if IEEE80211_CHAN_MAX < 255
2071 if (scan.chan > IEEE80211_CHAN_MAX) {
2072 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,
2073 wh, ieee80211_mgt_subtype_name[subtype >>
2074 IEEE80211_FC0_SUBTYPE_SHIFT],
2075 "invalid channel %u", scan.chan);
2076 ic->ic_stats.is_rx_badchan++;
2077 return;
2078 }
2079 #endif
2080 if (IEEE80211_CHAN2IEEE(scan.curchan) != scan.bchan &&
2081 ic->ic_phytype != IEEE80211_T_FH) {
2082 /*
2083 * Frame was received on a channel different from the
2084 * one indicated in the DS params element id;
2085 * silently discard it.
2086 *
2087 * NB: this can happen due to signal leakage.
2088 * But we should take it for FH phy because
2089 * the rssi value should be correct even for
2090 * different hop pattern in FH.
2091 */
2092 IEEE80211_DISCARD(ic,
2093 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
2094 wh, ieee80211_mgt_subtype_name[subtype >>
2095 IEEE80211_FC0_SUBTYPE_SHIFT],
2096 "for off-channel %u",
2097 IEEE80211_CHAN2IEEE(scan.curchan));
2098 ic->ic_stats.is_rx_chanmismatch++;
2099 return;
2100 }
2101 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
2102 scan.bintval <= IEEE80211_BINTVAL_MAX)) {
2103 IEEE80211_DISCARD(ic,
2104 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
2105 wh, ieee80211_mgt_subtype_name[subtype >>
2106 IEEE80211_FC0_SUBTYPE_SHIFT],
2107 "bogus beacon interval", scan.bintval);
2108 ic->ic_stats.is_rx_badbintval++;
2109 return;
2110 }
2111 /*
2112 * Process HT ie's. This is complicated by our
2113 * accepting both the standard ie's and the pre-draft
2114 * vendor OUI ie's that some vendors still use/require.
2115 */
2116 if (scan.htcap != NULL) {
2117 IEEE80211_VERIFY_LENGTH(scan.htcap[1],
2118 scan.htcap[0] == IEEE80211_ELEMID_VENDOR ?
2119 4 + sizeof(struct ieee80211_ie_htcap)-2 :
2120 sizeof(struct ieee80211_ie_htcap)-2,
2121 scan.htcap = NULL);
2122 }
2123 if (scan.htinfo != NULL) {
2124 IEEE80211_VERIFY_LENGTH(scan.htinfo[1],
2125 scan.htinfo[0] == IEEE80211_ELEMID_VENDOR ?
2126 4 + sizeof(struct ieee80211_ie_htinfo)-2 :
2127 sizeof(struct ieee80211_ie_htinfo)-2,
2128 scan.htinfo = NULL);
2129 }
2130
2131 /*
2132 * Count frame now that we know it's to be processed.
2133 */
2134 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
2135 ic->ic_stats.is_rx_beacon++; /* XXX remove */
2136 IEEE80211_NODE_STAT(ni, rx_beacons);
2137 } else
2138 IEEE80211_NODE_STAT(ni, rx_proberesp);
2139
2140 /*
2141 * When operating in station mode, check for state updates.
2142 * Be careful to ignore beacons received while doing a
2143 * background scan. We consider only 11g/WMM stuff right now.
2144 */
2145 if (ic->ic_opmode == IEEE80211_M_STA &&
2146 ni->ni_associd != 0 &&
2147 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
2148 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
2149 /* record tsf of last beacon */
2150 memcpy(ni->ni_tstamp.data, scan.tstamp,
2151 sizeof(ni->ni_tstamp));
2152 /* count beacon frame for s/w bmiss handling */
2153 ic->ic_swbmiss_count++;
2154 ic->ic_bmiss_count = 0;
2155 if (ni->ni_erp != scan.erp) {
2156 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2157 "[%s] erp change: was 0x%x, now 0x%x\n",
2158 ether_sprintf(wh->i_addr2),
2159 ni->ni_erp, scan.erp);
2160 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
2161 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2162 ic->ic_flags |= IEEE80211_F_USEPROT;
2163 else
2164 ic->ic_flags &= ~IEEE80211_F_USEPROT;
2165 ni->ni_erp = scan.erp;
2166 /* XXX statistic */
2167 }
2168 if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
2169 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2170 "[%s] capabilities change: before 0x%x,"
2171 " now 0x%x\n",
2172 ether_sprintf(wh->i_addr2),
2173 ni->ni_capinfo, scan.capinfo);
2174 /*
2175 * NB: we assume short preamble doesn't
2176 * change dynamically
2177 */
2178 ieee80211_set_shortslottime(ic,
2179 IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
2180 (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2181 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
2182 | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
2183 /* XXX statistic */
2184 }
2185 if (scan.wme != NULL &&
2186 (ni->ni_flags & IEEE80211_NODE_QOS) &&
2187 ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0)
2188 ieee80211_wme_updateparams(ic);
2189 if (scan.ath != NULL)
2190 ieee80211_parse_athparams(ni, scan.ath, wh);
2191 if (scan.htcap != NULL)
2192 ieee80211_parse_htcap(ni, scan.htcap);
2193 if (scan.htinfo != NULL) {
2194 ieee80211_parse_htinfo(ni, scan.htinfo);
2195 if (ni->ni_chan != ic->ic_bsschan) {
2196 /*
2197 * Channel has been adjusted based on
2198 * negotiated HT parameters; force the
2199 * channel state to follow.
2200 */
2201 ieee80211_setbsschan(ic, ni->ni_chan);
2202 }
2203 }
2204 if (scan.tim != NULL) {
2205 struct ieee80211_tim_ie *tim =
2206 (struct ieee80211_tim_ie *) scan.tim;
2207 #if 0
2208 int aid = IEEE80211_AID(ni->ni_associd);
2209 int ix = aid / NBBY;
2210 int min = tim->tim_bitctl &~ 1;
2211 int max = tim->tim_len + min - 4;
2212 if ((tim->tim_bitctl&1) ||
2213 (min <= ix && ix <= max &&
2214 isset(tim->tim_bitmap - min, aid))) {
2215 /*
2216 * XXX Do not let bg scan kick off
2217 * we are expecting data.
2218 */
2219 ic->ic_lastdata = ticks;
2220 ieee80211_sta_pwrsave(ic, 0);
2221 }
2222 #endif
2223 ni->ni_dtim_count = tim->tim_count;
2224 ni->ni_dtim_period = tim->tim_period;
2225 }
2226 /*
2227 * If scanning, pass the info to the scan module.
2228 * Otherwise, check if it's the right time to do
2229 * a background scan. Background scanning must
2230 * be enabled and we must not be operating in the
2231 * turbo phase of dynamic turbo mode. Then,
2232 * it's been a while since the last background
2233 * scan and if no data frames have come through
2234 * recently, kick off a scan. Note that this
2235 * is the mechanism by which a background scan
2236 * is started _and_ continued each time we
2237 * return on-channel to receive a beacon from
2238 * our ap.
2239 */
2240 if (ic->ic_flags & IEEE80211_F_SCAN) {
2241 ieee80211_add_scan(ic, &scan, wh,
2242 subtype, rssi, noise, rstamp);
2243 } else if (contbgscan(ic)) {
2244 ieee80211_bg_scan(ic);
2245 } else if (startbgscan(ic)) {
2246 #if 0
2247 /* wakeup if we are sleeing */
2248 ieee80211_set_pwrsave(ic, 0);
2249 #endif
2250 ieee80211_bg_scan(ic);
2251 }
2252 return;
2253 }
2254 /*
2255 * If scanning, just pass information to the scan module.
2256 */
2257 if (ic->ic_flags & IEEE80211_F_SCAN) {
2258 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
2259 /*
2260 * Actively scanning a channel marked passive;
2261 * send a probe request now that we know there
2262 * is 802.11 traffic present.
2263 *
2264 * XXX check if the beacon we recv'd gives
2265 * us what we need and suppress the probe req
2266 */
2267 ieee80211_probe_curchan(ic, 1);
2268 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
2269 }
2270 ieee80211_add_scan(ic, &scan, wh,
2271 subtype, rssi, noise, rstamp);
2272 return;
2273 }
2274 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
2275 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2276 /*
2277 * Create a new entry in the neighbor table.
2278 */
2279 ni = ieee80211_add_neighbor(ic, wh, &scan);
2280 } else if (ni->ni_capinfo == 0) {
2281 /*
2282 * Update faked node created on transmit.
2283 * Note this also updates the tsf.
2284 */
2285 ieee80211_init_neighbor(ni, wh, &scan);
2286 } else {
2287 /*
2288 * Record tsf for potential resync.
2289 */
2290 memcpy(ni->ni_tstamp.data, scan.tstamp,
2291 sizeof(ni->ni_tstamp));
2292 }
2293 if (ni != NULL) {
2294 ni->ni_rssi = rssi;
2295 ni->ni_noise = noise;
2296 ni->ni_rstamp = rstamp;
2297 }
2298 }
2299 break;
2300 }
2301
2302 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2303 if (ic->ic_opmode == IEEE80211_M_STA ||
2304 ic->ic_state != IEEE80211_S_RUN) {
2305 ic->ic_stats.is_rx_mgtdiscard++;
2306 return;
2307 }
2308 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2309 /* frame must be directed */
2310 ic->ic_stats.is_rx_mgtdiscard++; /* XXX stat */
2311 return;
2312 }
2313
2314 /*
2315 * prreq frame format
2316 * [tlv] ssid
2317 * [tlv] supported rates
2318 * [tlv] extended supported rates
2319 */
2320 ssid = rates = xrates = NULL;
2321 while (efrm - frm > 1) {
2322 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2323 switch (*frm) {
2324 case IEEE80211_ELEMID_SSID:
2325 ssid = frm;
2326 break;
2327 case IEEE80211_ELEMID_RATES:
2328 rates = frm;
2329 break;
2330 case IEEE80211_ELEMID_XRATES:
2331 xrates = frm;
2332 break;
2333 }
2334 frm += frm[1] + 2;
2335 }
2336 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2337 if (xrates != NULL)
2338 IEEE80211_VERIFY_ELEMENT(xrates,
2339 IEEE80211_RATE_MAXSIZE - rates[1]);
2340 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2341 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2342 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
2343 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
2344 wh, ieee80211_mgt_subtype_name[subtype >>
2345 IEEE80211_FC0_SUBTYPE_SHIFT],
2346 "%s", "no ssid with ssid suppression enabled");
2347 ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/
2348 return;
2349 }
2350
2351 allocbs = 0;
2352 if (ni == ic->ic_bss) {
2353 if (ic->ic_opmode != IEEE80211_M_IBSS) {
2354 ni = ieee80211_tmp_node(ic, wh->i_addr2);
2355 allocbs = 1;
2356 } else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2357 /*
2358 * XXX Cannot tell if the sender is operating
2359 * in ibss mode. But we need a new node to
2360 * send the response so blindly add them to the
2361 * neighbor table.
2362 */
2363 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
2364 wh->i_addr2);
2365 }
2366 if (ni == NULL)
2367 return;
2368 }
2369 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2370 "[%s] recv probe req\n", ether_sprintf(wh->i_addr2));
2371 ni->ni_rssi = rssi;
2372 ni->ni_rstamp = rstamp;
2373 rate = ieee80211_setup_rates(ni, rates, xrates,
2374 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE
2375 | IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2376 if (rate & IEEE80211_RATE_BASIC) {
2377 IEEE80211_DISCARD(ic, IEEE80211_MSG_XRATE,
2378 wh, ieee80211_mgt_subtype_name[subtype >>
2379 IEEE80211_FC0_SUBTYPE_SHIFT],
2380 "%s", "recv'd rate set invalid");
2381 } else {
2382 IEEE80211_SEND_MGMT(ic, ni,
2383 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
2384 }
2385 if (allocbs) {
2386 /*
2387 * Temporary node created just to send a
2388 * response, reclaim immediately.
2389 */
2390 ieee80211_free_node(ni);
2391 }
2392 break;
2393
2394 case IEEE80211_FC0_SUBTYPE_AUTH: {
2395 uint16_t algo, seq, status;
2396 /*
2397 * auth frame format
2398 * [2] algorithm
2399 * [2] sequence
2400 * [2] status
2401 * [tlv*] challenge
2402 */
2403 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
2404 algo = le16toh(*(uint16_t *)frm);
2405 seq = le16toh(*(uint16_t *)(frm + 2));
2406 status = le16toh(*(uint16_t *)(frm + 4));
2407 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2408 "[%s] recv auth frame with algorithm %d seq %d\n",
2409 ether_sprintf(wh->i_addr2), algo, seq);
2410 /*
2411 * Consult the ACL policy module if setup.
2412 */
2413 if (ic->ic_acl != NULL &&
2414 !ic->ic_acl->iac_check(ic, wh->i_addr2)) {
2415 IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL,
2416 wh, "auth", "%s", "disallowed by ACL");
2417 ic->ic_stats.is_rx_acl++;
2418 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2419 IEEE80211_SEND_MGMT(ic, ni,
2420 IEEE80211_FC0_SUBTYPE_AUTH,
2421 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
2422 }
2423 return;
2424 }
2425 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
2426 IEEE80211_DISCARD(ic,
2427 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
2428 wh, "auth", "%s", "TKIP countermeasures enabled");
2429 ic->ic_stats.is_rx_auth_countermeasures++;
2430 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2431 IEEE80211_SEND_MGMT(ic, ni,
2432 IEEE80211_FC0_SUBTYPE_AUTH,
2433 IEEE80211_REASON_MIC_FAILURE);
2434 }
2435 return;
2436 }
2437 if (algo == IEEE80211_AUTH_ALG_SHARED)
2438 ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi,
2439 noise, rstamp, seq, status);
2440 else if (algo == IEEE80211_AUTH_ALG_OPEN)
2441 ieee80211_auth_open(ic, wh, ni, rssi, noise, rstamp,
2442 seq, status);
2443 else {
2444 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2445 wh, "auth", "unsupported alg %d", algo);
2446 ic->ic_stats.is_rx_auth_unsupported++;
2447 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2448 /* XXX not right */
2449 IEEE80211_SEND_MGMT(ic, ni,
2450 IEEE80211_FC0_SUBTYPE_AUTH,
2451 (seq+1) | (IEEE80211_STATUS_ALG<<16));
2452 }
2453 return;
2454 }
2455 break;
2456 }
2457
2458 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2459 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
2460 uint16_t capinfo, lintval;
2461 struct ieee80211_rsnparms rsnparms;
2462 uint8_t reason;
2463 int badwparsn;
2464
2465 if (ic->ic_opmode != IEEE80211_M_HOSTAP ||
2466 ic->ic_state != IEEE80211_S_RUN) {
2467 ic->ic_stats.is_rx_mgtdiscard++;
2468 return;
2469 }
2470
2471 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
2472 reassoc = 1;
2473 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
2474 } else {
2475 reassoc = 0;
2476 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
2477 }
2478 /*
2479 * asreq frame format
2480 * [2] capability information
2481 * [2] listen interval
2482 * [6*] current AP address (reassoc only)
2483 * [tlv] ssid
2484 * [tlv] supported rates
2485 * [tlv] extended supported rates
2486 * [tlv] WPA or RSN
2487 * [tlv] HT capabilities
2488 * [tlv] Atheros capabilities
2489 */
2490 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
2491 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) {
2492 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2493 wh, ieee80211_mgt_subtype_name[subtype >>
2494 IEEE80211_FC0_SUBTYPE_SHIFT],
2495 "%s", "wrong bssid");
2496 ic->ic_stats.is_rx_assoc_bss++;
2497 return;
2498 }
2499 capinfo = le16toh(*(uint16_t *)frm); frm += 2;
2500 lintval = le16toh(*(uint16_t *)frm); frm += 2;
2501 if (reassoc)
2502 frm += 6; /* ignore current AP info */
2503 ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL;
2504 sfrm = frm;
2505 while (efrm - frm > 1) {
2506 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2507 switch (*frm) {
2508 case IEEE80211_ELEMID_SSID:
2509 ssid = frm;
2510 break;
2511 case IEEE80211_ELEMID_RATES:
2512 rates = frm;
2513 break;
2514 case IEEE80211_ELEMID_XRATES:
2515 xrates = frm;
2516 break;
2517 /* XXX verify only one of RSN and WPA ie's? */
2518 case IEEE80211_ELEMID_RSN:
2519 rsn = frm;
2520 break;
2521 case IEEE80211_ELEMID_HTCAP:
2522 htcap = frm;
2523 break;
2524 case IEEE80211_ELEMID_VENDOR:
2525 if (iswpaoui(frm))
2526 wpa = frm;
2527 else if (iswmeinfo(frm))
2528 wme = frm;
2529 else if (isatherosoui(frm))
2530 ath = frm;
2531 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
2532 if (ishtcapoui(frm) && htcap == NULL)
2533 htcap = frm;
2534 }
2535 break;
2536 }
2537 frm += frm[1] + 2;
2538 }
2539 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2540 if (xrates != NULL)
2541 IEEE80211_VERIFY_ELEMENT(xrates,
2542 IEEE80211_RATE_MAXSIZE - rates[1]);
2543 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2544 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2545 if (htcap != NULL) {
2546 IEEE80211_VERIFY_LENGTH(htcap[1],
2547 htcap[0] == IEEE80211_ELEMID_VENDOR ?
2548 4 + sizeof(struct ieee80211_ie_htcap)-2 :
2549 sizeof(struct ieee80211_ie_htcap)-2,
2550 return); /* XXX just NULL out? */
2551 }
2552
2553 if (ni == ic->ic_bss) {
2554 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2555 "[%s] deny %s request, sta not authenticated\n",
2556 ether_sprintf(wh->i_addr2),
2557 reassoc ? "reassoc" : "assoc");
2558 ieee80211_send_error(ic, ni, wh->i_addr2,
2559 IEEE80211_FC0_SUBTYPE_DEAUTH,
2560 IEEE80211_REASON_ASSOC_NOT_AUTHED);
2561 ic->ic_stats.is_rx_assoc_notauth++;
2562 return;
2563 }
2564 /* assert right association security credentials */
2565 badwparsn = 0;
2566 switch (ic->ic_flags & IEEE80211_F_WPA) {
2567 case IEEE80211_F_WPA1:
2568 if (wpa == NULL)
2569 badwparsn = 1;
2570 break;
2571 case IEEE80211_F_WPA2:
2572 if (rsn == NULL)
2573 badwparsn = 1;
2574 break;
2575 case IEEE80211_F_WPA1|IEEE80211_F_WPA2:
2576 if (wpa == NULL && rsn == NULL)
2577 badwparsn = 1;
2578 break;
2579 }
2580 if (badwparsn) {
2581 IEEE80211_DPRINTF(ic,
2582 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2583 "[%s] no WPA/RSN IE in association request\n",
2584 ether_sprintf(wh->i_addr2));
2585 IEEE80211_SEND_MGMT(ic, ni,
2586 IEEE80211_FC0_SUBTYPE_DEAUTH,
2587 IEEE80211_REASON_IE_INVALID);
2588 ieee80211_node_leave(ic, ni);
2589 ic->ic_stats.is_rx_assoc_badwpaie++;
2590 return;
2591 }
2592 if (wpa != NULL || rsn != NULL) {
2593 /*
2594 * Parse WPA/RSN information element. Note that
2595 * we initialize the param block from the node
2596 * state so that information in the IE overrides
2597 * our defaults. The resulting parameters are
2598 * installed below after the association is assured.
2599 */
2600 rsnparms = ni->ni_rsn;
2601 if (wpa != NULL)
2602 reason = ieee80211_parse_wpa(ic, wpa, &rsnparms, wh);
2603 else
2604 reason = ieee80211_parse_rsn(ic, rsn, &rsnparms, wh);
2605 if (reason != 0) {
2606 IEEE80211_SEND_MGMT(ic, ni,
2607 IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
2608 ieee80211_node_leave(ic, ni);
2609 /* XXX distinguish WPA/RSN? */
2610 ic->ic_stats.is_rx_assoc_badwpaie++;
2611 return;
2612 }
2613 IEEE80211_DPRINTF(ic,
2614 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2615 "[%s] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n",
2616 ether_sprintf(wh->i_addr2),
2617 wpa != NULL ? "WPA" : "RSN",
2618 rsnparms.rsn_mcastcipher, rsnparms.rsn_mcastkeylen,
2619 rsnparms.rsn_ucastcipher, rsnparms.rsn_ucastkeylen,
2620 rsnparms.rsn_keymgmt, rsnparms.rsn_caps);
2621 }
2622 /* discard challenge after association */
2623 if (ni->ni_challenge != NULL) {
2624 FREE(ni->ni_challenge, M_80211_NODE);
2625 ni->ni_challenge = NULL;
2626 }
2627 /* NB: 802.11 spec says to ignore station's privacy bit */
2628 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2629 capinfomismatch(ni, wh, reassoc, resp,
2630 "capability", capinfo);
2631 return;
2632 }
2633 /*
2634 * Disallow re-associate w/ invalid slot time setting.
2635 */
2636 if (ni->ni_associd != 0 &&
2637 IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
2638 ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
2639 capinfomismatch(ni, wh, reassoc, resp,
2640 "slot time", capinfo);
2641 return;
2642 }
2643 rate = ieee80211_setup_rates(ni, rates, xrates,
2644 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2645 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2646 if (rate & IEEE80211_RATE_BASIC) {
2647 ratesetmismatch(ni, wh, reassoc, resp, "basic", rate);
2648 return;
2649 }
2650 /*
2651 * If constrained to 11g-only stations reject an
2652 * 11b-only station. We cheat a bit here by looking
2653 * at the max negotiated xmit rate and assuming anyone
2654 * with a best rate <24Mb/s is an 11b station.
2655 */
2656 if ((ic->ic_flags & IEEE80211_F_PUREG) && rate < 48) {
2657 ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);
2658 return;
2659 }
2660 /* XXX enforce PUREN */
2661 /* 802.11n-specific rateset handling */
2662 if (IEEE80211_IS_CHAN_HT(ic->ic_curchan) && htcap != NULL) {
2663 rate = ieee80211_setup_htrates(ni, htcap,
2664 IEEE80211_F_DOFRATE | IEEE80211_F_DONEGO |
2665 IEEE80211_F_DOBRS);
2666 if (rate & IEEE80211_RATE_BASIC) {
2667 /* XXX 11n-specific stat */
2668 ratesetmismatch(ni, wh, reassoc, resp,
2669 "HT", rate);
2670 return;
2671 }
2672 ieee80211_ht_node_init(ni, htcap);
2673 } else if (ni->ni_flags & IEEE80211_NODE_HT)
2674 ieee80211_ht_node_cleanup(ni);
2675 /*
2676 * Allow AMPDU operation only with unencrypted traffic
2677 * or AES-CCM; the 11n spec only specifies these ciphers
2678 * so permitting any others is undefined and can lead
2679 * to interoperability problems.
2680 *
2681 * NB: We check for AES by looking at the GTK cipher
2682 * since the WPA/11i specs say the PTK cipher has
2683 * to be "as good or better".
2684 */
2685 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
2686 (((ic->ic_flags & IEEE80211_F_WPA) &&
2687 rsnparms.rsn_mcastcipher != IEEE80211_CIPHER_AES_CCM) ||
2688 (ic->ic_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) {
2689 IEEE80211_NOTE(ic,
2690 IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
2691 "disallow HT use because WEP or TKIP requested, "
2692 "capinfo 0x%x mcastcipher %d", capinfo,
2693 rsnparms.rsn_mcastcipher);
2694 ieee80211_ht_node_cleanup(ni);
2695 ic->ic_stats.is_ht_assoc_downgrade++;
2696 }
2697 /*
2698 * If constrained to 11n-only stations reject legacy stations.
2699 */
2700 if ((ic->ic_flags_ext & IEEE80211_FEXT_PUREN) &&
2701 (ni->ni_flags & IEEE80211_NODE_HT) == 0) {
2702 htcapmismatch(ni, wh, reassoc, resp);
2703 ic->ic_stats.is_ht_assoc_nohtcap++;
2704 return;
2705 }
2706 ni->ni_rssi = rssi;
2707 ni->ni_noise = noise;
2708 ni->ni_rstamp = rstamp;
2709 ni->ni_intval = lintval;
2710 ni->ni_capinfo = capinfo;
2711 ni->ni_chan = ic->ic_bsschan;
2712 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell;
2713 ni->ni_fhindex = ic->ic_bss->ni_fhindex;
2714 /*
2715 * Store the IEs.
2716 * XXX maybe better to just expand
2717 */
2718 if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {
2719 #define setie(_ie, _off) ieee80211_ies_setie(ni->ni_ies, _ie, _off)
2720 if (wpa != NULL) {
2721 setie(wpa_ie, wpa - sfrm);
2722 ni->ni_rsn = rsnparms;
2723 }
2724 if (rsn != NULL) {
2725 setie(rsn_ie, rsn - sfrm);
2726 ni->ni_rsn = rsnparms;
2727 }
2728 if (htcap != NULL)
2729 setie(htcap_ie, htcap - sfrm);
2730 if (wme != NULL) {
2731 setie(wme_ie, wme - sfrm);
2732 /*
2733 * Mark node as capable of QoS.
2734 */
2735 ni->ni_flags |= IEEE80211_NODE_QOS;
2736 } else
2737 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2738 if (ath != NULL) {
2739 setie(ath_ie, ath - sfrm);
2740 /*
2741 * Parse ATH station parameters.
2742 */
2743 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
2744 } else
2745 ni->ni_ath_flags = 0;
2746 #undef setie
2747 } else {
2748 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2749 ni->ni_ath_flags = 0;
2750 }
2751 ieee80211_node_join(ic, ni, resp);
2752 ieee80211_deliver_l2uf(ni);
2753 break;
2754 }
2755
2756 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2757 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
2758 uint16_t capinfo, associd;
2759 uint16_t status;
2760
2761 if (ic->ic_opmode != IEEE80211_M_STA ||
2762 ic->ic_state != IEEE80211_S_ASSOC) {
2763 ic->ic_stats.is_rx_mgtdiscard++;
2764 return;
2765 }
2766
2767 /*
2768 * asresp frame format
2769 * [2] capability information
2770 * [2] status
2771 * [2] association ID
2772 * [tlv] supported rates
2773 * [tlv] extended supported rates
2774 * [tlv] WME
2775 * [tlv] HT capabilities
2776 * [tlv] HT info
2777 */
2778 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
2779 ni = ic->ic_bss;
2780 capinfo = le16toh(*(uint16_t *)frm);
2781 frm += 2;
2782 status = le16toh(*(uint16_t *)frm);
2783 frm += 2;
2784 if (status != 0) {
2785 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2786 "[%s] %sassoc failed (reason %d)\n",
2787 ether_sprintf(wh->i_addr2),
2788 ISREASSOC(subtype) ? "re" : "", status);
2789 if (ni != ic->ic_bss) /* XXX never true? */
2790 ni->ni_fails++;
2791 ic->ic_stats.is_rx_auth_fail++; /* XXX */
2792 return;
2793 }
2794 associd = le16toh(*(uint16_t *)frm);
2795 frm += 2;
2796
2797 rates = xrates = wme = htcap = htinfo = NULL;
2798 while (efrm - frm > 1) {
2799 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2800 switch (*frm) {
2801 case IEEE80211_ELEMID_RATES:
2802 rates = frm;
2803 break;
2804 case IEEE80211_ELEMID_XRATES:
2805 xrates = frm;
2806 break;
2807 case IEEE80211_ELEMID_HTCAP:
2808 htcap = frm;
2809 break;
2810 case IEEE80211_ELEMID_HTINFO:
2811 htinfo = frm;
2812 break;
2813 case IEEE80211_ELEMID_VENDOR:
2814 if (iswmeoui(frm))
2815 wme = frm;
2816 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
2817 /*
2818 * Accept pre-draft HT ie's if the
2819 * standard ones have not been seen.
2820 */
2821 if (ishtcapoui(frm)) {
2822 if (htcap == NULL)
2823 htcap = frm;
2824 } else if (ishtinfooui(frm)) {
2825 if (htinfo == NULL)
2826 htcap = frm;
2827 }
2828 }
2829 /* XXX Atheros OUI support */
2830 break;
2831 }
2832 frm += frm[1] + 2;
2833 }
2834
2835 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2836 if (xrates != NULL)
2837 IEEE80211_VERIFY_ELEMENT(xrates,
2838 IEEE80211_RATE_MAXSIZE - rates[1]);
2839 rate = ieee80211_setup_rates(ni, rates, xrates,
2840 IEEE80211_F_JOIN |
2841 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2842 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2843 if (rate & IEEE80211_RATE_BASIC) {
2844 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2845 "[%s] %sassoc failed (rate set mismatch)\n",
2846 ether_sprintf(wh->i_addr2),
2847 ISREASSOC(subtype) ? "re" : "");
2848 if (ni != ic->ic_bss) /* XXX never true? */
2849 ni->ni_fails++;
2850 ic->ic_stats.is_rx_assoc_norate++;
2851 ieee80211_new_state(ic, IEEE80211_S_SCAN,
2852 IEEE80211_SCAN_FAIL_STATUS);
2853 return;
2854 }
2855
2856 ni->ni_capinfo = capinfo;
2857 ni->ni_associd = associd;
2858 if (wme != NULL &&
2859 ieee80211_parse_wmeparams(ic, wme, wh) >= 0) {
2860 ni->ni_flags |= IEEE80211_NODE_QOS;
2861 ieee80211_wme_updateparams(ic);
2862 } else
2863 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2864 /*
2865 * Setup HT state according to the negotiation.
2866 */
2867 if ((ic->ic_htcaps & IEEE80211_HTC_HT) &&
2868 htcap != NULL && htinfo != NULL) {
2869 ieee80211_ht_node_init(ni, htcap);
2870 ieee80211_parse_htinfo(ni, htinfo);
2871 ieee80211_setup_htrates(ni,
2872 htcap, IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
2873 ieee80211_setup_basic_htrates(ni, htinfo);
2874 if (ni->ni_chan != ic->ic_bsschan) {
2875 /*
2876 * Channel has been adjusted based on
2877 * negotiated HT parameters; force the
2878 * channel state to follow.
2879 */
2880 ieee80211_setbsschan(ic, ni->ni_chan);
2881 }
2882 }
2883 /*
2884 * Configure state now that we are associated.
2885 *
2886 * XXX may need different/additional driver callbacks?
2887 */
2888 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
2889 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
2890 ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
2891 ic->ic_flags &= ~IEEE80211_F_USEBARKER;
2892 } else {
2893 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
2894 ic->ic_flags |= IEEE80211_F_USEBARKER;
2895 }
2896 ieee80211_set_shortslottime(ic,
2897 IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
2898 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2899 /*
2900 * Honor ERP protection.
2901 *
2902 * NB: ni_erp should zero for non-11g operation.
2903 */
2904 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
2905 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2906 ic->ic_flags |= IEEE80211_F_USEPROT;
2907 else
2908 ic->ic_flags &= ~IEEE80211_F_USEPROT;
2909 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2910 "[%s] %sassoc success: %s preamble, %s slot time%s%s%s%s\n",
2911 ether_sprintf(wh->i_addr2),
2912 ISREASSOC(subtype) ? "re" : "",
2913 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
2914 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
2915 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
2916 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
2917 ni->ni_flags & IEEE80211_NODE_HT ?
2918 (ni->ni_chw == 20 ? ", HT20" : ", HT40") : "",
2919 ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
2920 IEEE80211_ATH_CAP(ic, ni, IEEE80211_NODE_FF) ?
2921 ", fast-frames" : "",
2922 IEEE80211_ATH_CAP(ic, ni, IEEE80211_NODE_TURBOP) ?
2923 ", turbo" : ""
2924 );
2925 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
2926 break;
2927 }
2928
2929 case IEEE80211_FC0_SUBTYPE_DEAUTH: {
2930 uint16_t reason;
2931
2932 if (ic->ic_state == IEEE80211_S_SCAN) {
2933 ic->ic_stats.is_rx_mgtdiscard++;
2934 return;
2935 }
2936 /*
2937 * deauth frame format
2938 * [2] reason
2939 */
2940 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2941 reason = le16toh(*(uint16_t *)frm);
2942 ic->ic_stats.is_rx_deauth++;
2943 IEEE80211_NODE_STAT(ni, rx_deauth);
2944
2945 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) {
2946 /* NB: can happen when in promiscuous mode */
2947 ic->ic_stats.is_rx_mgtdiscard++;
2948 break;
2949 }
2950 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2951 "[%s] recv deauthenticate (reason %d)\n",
2952 ether_sprintf(ni->ni_macaddr), reason);
2953 switch (ic->ic_opmode) {
2954 case IEEE80211_M_STA:
2955 ieee80211_new_state(ic, IEEE80211_S_AUTH,
2956 (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
2957 break;
2958 case IEEE80211_M_HOSTAP:
2959 if (ni != ic->ic_bss)
2960 ieee80211_node_leave(ic, ni);
2961 break;
2962 default:
2963 ic->ic_stats.is_rx_mgtdiscard++;
2964 break;
2965 }
2966 break;
2967 }
2968
2969 case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2970 uint16_t reason;
2971
2972 if (ic->ic_state != IEEE80211_S_RUN &&
2973 ic->ic_state != IEEE80211_S_ASSOC &&
2974 ic->ic_state != IEEE80211_S_AUTH) {
2975 ic->ic_stats.is_rx_mgtdiscard++;
2976 return;
2977 }
2978 /*
2979 * disassoc frame format
2980 * [2] reason
2981 */
2982 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2983 reason = le16toh(*(uint16_t *)frm);
2984 ic->ic_stats.is_rx_disassoc++;
2985 IEEE80211_NODE_STAT(ni, rx_disassoc);
2986
2987 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) {
2988 /* NB: can happen when in promiscuous mode */
2989 ic->ic_stats.is_rx_mgtdiscard++;
2990 break;
2991 }
2992 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2993 "[%s] recv disassociate (reason %d)\n",
2994 ether_sprintf(ni->ni_macaddr), reason);
2995 switch (ic->ic_opmode) {
2996 case IEEE80211_M_STA:
2997 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
2998 break;
2999 case IEEE80211_M_HOSTAP:
3000 if (ni != ic->ic_bss)
3001 ieee80211_node_leave(ic, ni);
3002 break;
3003 default:
3004 ic->ic_stats.is_rx_mgtdiscard++;
3005 break;
3006 }
3007 break;
3008 }
3009
3010 case IEEE80211_FC0_SUBTYPE_ACTION: {
3011 const struct ieee80211_action *ia;
3012
3013 if (ic->ic_state != IEEE80211_S_RUN &&
3014 ic->ic_state != IEEE80211_S_ASSOC &&
3015 ic->ic_state != IEEE80211_S_AUTH) {
3016 ic->ic_stats.is_rx_mgtdiscard++;
3017 return;
3018 }
3019 /*
3020 * action frame format:
3021 * [1] category
3022 * [1] action
3023 * [tlv] parameters
3024 */
3025 IEEE80211_VERIFY_LENGTH(efrm - frm,
3026 sizeof(struct ieee80211_action), return);
3027 ia = (const struct ieee80211_action *) frm;
3028
3029 ic->ic_stats.is_rx_action++;
3030 IEEE80211_NODE_STAT(ni, rx_action);
3031
3032 /* verify frame payloads but defer processing */
3033 /* XXX maybe push this to method */
3034 switch (ia->ia_category) {
3035 case IEEE80211_ACTION_CAT_BA:
3036 switch (ia->ia_action) {
3037 case IEEE80211_ACTION_BA_ADDBA_REQUEST:
3038 IEEE80211_VERIFY_LENGTH(efrm - frm,
3039 sizeof(struct ieee80211_action_ba_addbarequest),
3040 return);
3041 break;
3042 case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
3043 IEEE80211_VERIFY_LENGTH(efrm - frm,
3044 sizeof(struct ieee80211_action_ba_addbaresponse),
3045 return);
3046 break;
3047 case IEEE80211_ACTION_BA_DELBA:
3048 IEEE80211_VERIFY_LENGTH(efrm - frm,
3049 sizeof(struct ieee80211_action_ba_delba),
3050 return);
3051 break;
3052 }
3053 break;
3054 case IEEE80211_ACTION_CAT_HT:
3055 switch (ia->ia_action) {
3056 case IEEE80211_ACTION_HT_TXCHWIDTH:
3057 IEEE80211_VERIFY_LENGTH(efrm - frm,
3058 sizeof(struct ieee80211_action_ht_txchwidth),
3059 return);
3060 break;
3061 }
3062 break;
3063 }
3064 ic->ic_recv_action(ni, frm, efrm);
3065 break;
3066 }
3067
3068 default:
3069 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
3070 wh, "mgt", "subtype 0x%x not handled", subtype);
3071 ic->ic_stats.is_rx_badsubtype++;
3072 break;
3073 }
3074 #undef ISREASSOC
3075 #undef ISPROBE
3076 }
3077 #undef IEEE80211_VERIFY_LENGTH
3078 #undef IEEE80211_VERIFY_ELEMENT
3079
3080 /*
3081 * Process a received ps-poll frame.
3082 */
3083 static void
3084 ieee80211_recv_pspoll(struct ieee80211com *ic,
3085 struct ieee80211_node *ni, struct mbuf *m0)
3086 {
3087 struct ieee80211_frame_min *wh;
3088 struct mbuf *m;
3089 uint16_t aid;
3090 int qlen;
3091
3092 wh = mtod(m0, struct ieee80211_frame_min *);
3093 if (ni->ni_associd == 0) {
3094 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
3095 (struct ieee80211_frame *) wh, "ps-poll",
3096 "%s", "unassociated station");
3097 ic->ic_stats.is_ps_unassoc++;
3098 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
3099 IEEE80211_REASON_NOT_ASSOCED);
3100 return;
3101 }
3102
3103 aid = le16toh(*(uint16_t *)wh->i_dur);
3104 if (aid != ni->ni_associd) {
3105 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
3106 (struct ieee80211_frame *) wh, "ps-poll",
3107 "aid mismatch: sta aid 0x%x poll aid 0x%x",
3108 ni->ni_associd, aid);
3109 ic->ic_stats.is_ps_badaid++;
3110 /*
3111 * NB: We used to deauth the station but it turns out
3112 * the Blackberry Curve 8230 (and perhaps other devices)
3113 * sometimes send the wrong AID when WME is negotiated.
3114 * Being more lenient here seems ok as we already check
3115 * the station is associated and we only return frames
3116 * queued for the station (i.e. we don't use the AID).
3117 */
3118 return;
3119 }
3120
3121 /* Okay, take the first queued packet and put it out... */
3122 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
3123 if (m == NULL) {
3124 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
3125 "[%s] recv ps-poll, but queue empty\n",
3126 ether_sprintf(wh->i_addr2));
3127 ieee80211_send_nulldata(ieee80211_ref_node(ni));
3128 ic->ic_stats.is_ps_qempty++; /* XXX node stat */
3129 if (ic->ic_set_tim != NULL)
3130 ic->ic_set_tim(ni, 0); /* just in case */
3131 return;
3132 }
3133 /*
3134 * If there are more packets, set the more packets bit
3135 * in the packet dispatched to the station; otherwise
3136 * turn off the TIM bit.
3137 */
3138 if (qlen != 0) {
3139 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
3140 "[%s] recv ps-poll, send packet, %u still queued\n",
3141 ether_sprintf(ni->ni_macaddr), qlen);
3142 m->m_flags |= M_MORE_DATA;
3143 } else {
3144 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
3145 "[%s] recv ps-poll, send packet, queue empty\n",
3146 ether_sprintf(ni->ni_macaddr));
3147 if (ic->ic_set_tim != NULL)
3148 ic->ic_set_tim(ni, 0);
3149 }
3150 m->m_flags |= M_PWR_SAV; /* bypass PS handling */
3151 IF_ENQUEUE(&ic->ic_ifp->if_snd, m);
3152 }
3153
3154 #ifdef IEEE80211_DEBUG
3155 /*
3156 * Debugging support.
3157 */
3158 void
3159 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag,
3160 uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
3161 {
3162 printf("[%s] discard %s frame, ssid mismatch: ",
3163 ether_sprintf(mac), tag);
3164 ieee80211_print_essid(ssid + 2, ssid[1]);
3165 printf("\n");
3166 }
3167
3168 /*
3169 * Return the bssid of a frame.
3170 */
3171 static const uint8_t *
3172 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh)
3173 {
3174 if (ic->ic_opmode == IEEE80211_M_STA)
3175 return wh->i_addr2;
3176 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
3177 return wh->i_addr1;
3178 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
3179 return wh->i_addr1;
3180 return wh->i_addr3;
3181 }
3182
3183 void
3184 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...)
3185 {
3186 char buf[128]; /* XXX */
3187 va_list ap;
3188
3189 va_start(ap, fmt);
3190 vsnprintf(buf, sizeof(buf), fmt, ap);
3191 va_end(ap);
3192
3193 if_printf(ic->ic_ifp, "%s", buf); /* NB: no \n */
3194 }
3195
3196 void
3197 ieee80211_note_frame(struct ieee80211com *ic,
3198 const struct ieee80211_frame *wh,
3199 const char *fmt, ...)
3200 {
3201 char buf[128]; /* XXX */
3202 va_list ap;
3203
3204 va_start(ap, fmt);
3205 vsnprintf(buf, sizeof(buf), fmt, ap);
3206 va_end(ap);
3207 if_printf(ic->ic_ifp, "[%s] %s\n",
3208 ether_sprintf(ieee80211_getbssid(ic, wh)), buf);
3209 }
3210
3211 void
3212 ieee80211_note_mac(struct ieee80211com *ic,
3213 const uint8_t mac[IEEE80211_ADDR_LEN],
3214 const char *fmt, ...)
3215 {
3216 char buf[128]; /* XXX */
3217 va_list ap;
3218
3219 va_start(ap, fmt);
3220 vsnprintf(buf, sizeof(buf), fmt, ap);
3221 va_end(ap);
3222 if_printf(ic->ic_ifp, "[%s] %s\n", ether_sprintf(mac), buf);
3223 }
3224
3225 void
3226 ieee80211_discard_frame(struct ieee80211com *ic,
3227 const struct ieee80211_frame *wh,
3228 const char *type, const char *fmt, ...)
3229 {
3230 va_list ap;
3231
3232 printf("[%s:%s] discard ", ic->ic_ifp->if_xname,
3233 ether_sprintf(ieee80211_getbssid(ic, wh)));
3234 if (type != NULL)
3235 printf("%s frame, ", type);
3236 else
3237 printf("frame, ");
3238 va_start(ap, fmt);
3239 vprintf(fmt, ap);
3240 va_end(ap);
3241 printf("\n");
3242 }
3243
3244 void
3245 ieee80211_discard_ie(struct ieee80211com *ic,
3246 const struct ieee80211_frame *wh,
3247 const char *type, const char *fmt, ...)
3248 {
3249 va_list ap;
3250
3251 printf("[%s:%s] discard ", ic->ic_ifp->if_xname,
3252 ether_sprintf(ieee80211_getbssid(ic, wh)));
3253 if (type != NULL)
3254 printf("%s information element, ", type);
3255 else
3256 printf("information element, ");
3257 va_start(ap, fmt);
3258 vprintf(fmt, ap);
3259 va_end(ap);
3260 printf("\n");
3261 }
3262
3263 void
3264 ieee80211_discard_mac(struct ieee80211com *ic,
3265 const uint8_t mac[IEEE80211_ADDR_LEN],
3266 const char *type, const char *fmt, ...)
3267 {
3268 va_list ap;
3269
3270 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, ether_sprintf(mac));
3271 if (type != NULL)
3272 printf("%s frame, ", type);
3273 else
3274 printf("frame, ");
3275 va_start(ap, fmt);
3276 vprintf(fmt, ap);
3277 va_end(ap);
3278 printf("\n");
3279 }
3280 #endif /* IEEE80211_DEBUG */
Cache object: 0546009e289f746137febe14db3f24cd
|