1 /*-
2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29
30 #include "opt_wlan.h"
31
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/mbuf.h>
35 #include <sys/malloc.h>
36 #include <sys/endian.h>
37 #include <sys/kernel.h>
38
39 #include <sys/socket.h>
40
41 #include <net/ethernet.h>
42 #include <net/if.h>
43 #include <net/if_llc.h>
44 #include <net/if_media.h>
45 #include <net/if_vlan_var.h>
46
47 #include <net80211/ieee80211_var.h>
48 #include <net80211/ieee80211_input.h>
49 #ifdef IEEE80211_SUPPORT_MESH
50 #include <net80211/ieee80211_mesh.h>
51 #endif
52
53 #include <net/bpf.h>
54
55 #ifdef INET
56 #include <netinet/in.h>
57 #include <net/ethernet.h>
58 #endif
59
60 int
61 ieee80211_input_all(struct ieee80211com *ic, struct mbuf *m, int rssi, int nf)
62 {
63 struct ieee80211vap *vap;
64 int type = -1;
65
66 m->m_flags |= M_BCAST; /* NB: mark for bpf tap'ing */
67
68 /* XXX locking */
69 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
70 struct ieee80211_node *ni;
71 struct mbuf *mcopy;
72
73 /* NB: could check for IFF_UP but this is cheaper */
74 if (vap->iv_state == IEEE80211_S_INIT)
75 continue;
76 /*
77 * WDS vap's only receive directed traffic from the
78 * station at the ``far end''. That traffic should
79 * be passed through the AP vap the station is associated
80 * to--so don't spam them with mcast frames.
81 */
82 if (vap->iv_opmode == IEEE80211_M_WDS)
83 continue;
84 if (TAILQ_NEXT(vap, iv_next) != NULL) {
85 /*
86 * Packet contents are changed by ieee80211_decap
87 * so do a deep copy of the packet.
88 */
89 mcopy = m_dup(m, M_DONTWAIT);
90 if (mcopy == NULL) {
91 /* XXX stat+msg */
92 continue;
93 }
94 } else {
95 mcopy = m;
96 m = NULL;
97 }
98 ni = ieee80211_ref_node(vap->iv_bss);
99 type = ieee80211_input(ni, mcopy, rssi, nf);
100 ieee80211_free_node(ni);
101 }
102 if (m != NULL) /* no vaps, reclaim mbuf */
103 m_freem(m);
104 return type;
105 }
106
107 /*
108 * This function reassembles fragments.
109 *
110 * XXX should handle 3 concurrent reassemblies per-spec.
111 */
112 struct mbuf *
113 ieee80211_defrag(struct ieee80211_node *ni, struct mbuf *m, int hdrspace)
114 {
115 struct ieee80211vap *vap = ni->ni_vap;
116 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
117 struct ieee80211_frame *lwh;
118 uint16_t rxseq;
119 uint8_t fragno;
120 uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
121 struct mbuf *mfrag;
122
123 KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
124
125 rxseq = le16toh(*(uint16_t *)wh->i_seq);
126 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
127
128 /* Quick way out, if there's nothing to defragment */
129 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
130 return m;
131
132 /*
133 * Remove frag to insure it doesn't get reaped by timer.
134 */
135 if (ni->ni_table == NULL) {
136 /*
137 * Should never happen. If the node is orphaned (not in
138 * the table) then input packets should not reach here.
139 * Otherwise, a concurrent request that yanks the table
140 * should be blocked by other interlocking and/or by first
141 * shutting the driver down. Regardless, be defensive
142 * here and just bail
143 */
144 /* XXX need msg+stat */
145 m_freem(m);
146 return NULL;
147 }
148 IEEE80211_NODE_LOCK(ni->ni_table);
149 mfrag = ni->ni_rxfrag[0];
150 ni->ni_rxfrag[0] = NULL;
151 IEEE80211_NODE_UNLOCK(ni->ni_table);
152
153 /*
154 * Validate new fragment is in order and
155 * related to the previous ones.
156 */
157 if (mfrag != NULL) {
158 uint16_t last_rxseq;
159
160 lwh = mtod(mfrag, struct ieee80211_frame *);
161 last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
162 /* NB: check seq # and frag together */
163 if (rxseq != last_rxseq+1 ||
164 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
165 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
166 /*
167 * Unrelated fragment or no space for it,
168 * clear current fragments.
169 */
170 m_freem(mfrag);
171 mfrag = NULL;
172 }
173 }
174
175 if (mfrag == NULL) {
176 if (fragno != 0) { /* !first fragment, discard */
177 vap->iv_stats.is_rx_defrag++;
178 IEEE80211_NODE_STAT(ni, rx_defrag);
179 m_freem(m);
180 return NULL;
181 }
182 mfrag = m;
183 } else { /* concatenate */
184 m_adj(m, hdrspace); /* strip header */
185 m_cat(mfrag, m);
186 /* NB: m_cat doesn't update the packet header */
187 mfrag->m_pkthdr.len += m->m_pkthdr.len;
188 /* track last seqnum and fragno */
189 lwh = mtod(mfrag, struct ieee80211_frame *);
190 *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
191 }
192 if (more_frag) { /* more to come, save */
193 ni->ni_rxfragstamp = ticks;
194 ni->ni_rxfrag[0] = mfrag;
195 mfrag = NULL;
196 }
197 return mfrag;
198 }
199
200 void
201 ieee80211_deliver_data(struct ieee80211vap *vap,
202 struct ieee80211_node *ni, struct mbuf *m)
203 {
204 struct ether_header *eh = mtod(m, struct ether_header *);
205 struct ifnet *ifp = vap->iv_ifp;
206
207 /* clear driver/net80211 flags before passing up */
208 m->m_flags &= ~(M_80211_RX | M_MCAST | M_BCAST);
209
210 /* NB: see hostap_deliver_data, this path doesn't handle hostap */
211 KASSERT(vap->iv_opmode != IEEE80211_M_HOSTAP, ("gack, hostap"));
212 /*
213 * Do accounting.
214 */
215 ifp->if_ipackets++;
216 IEEE80211_NODE_STAT(ni, rx_data);
217 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
218 if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
219 m->m_flags |= M_MCAST; /* XXX M_BCAST? */
220 IEEE80211_NODE_STAT(ni, rx_mcast);
221 } else
222 IEEE80211_NODE_STAT(ni, rx_ucast);
223 m->m_pkthdr.rcvif = ifp;
224
225 if (ni->ni_vlan != 0) {
226 /* attach vlan tag */
227 m->m_pkthdr.ether_vtag = ni->ni_vlan;
228 m->m_flags |= M_VLANTAG;
229 }
230 ifp->if_input(ifp, m);
231 }
232
233 struct mbuf *
234 ieee80211_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen)
235 {
236 struct ieee80211_qosframe_addr4 wh;
237 struct ether_header *eh;
238 struct llc *llc;
239
240 KASSERT(hdrlen <= sizeof(wh),
241 ("hdrlen %d > max %zd", hdrlen, sizeof(wh)));
242
243 if (m->m_len < hdrlen + sizeof(*llc) &&
244 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
245 vap->iv_stats.is_rx_tooshort++;
246 /* XXX msg */
247 return NULL;
248 }
249 memcpy(&wh, mtod(m, caddr_t), hdrlen);
250 llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
251 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
252 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
253 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
254 /* NB: preserve AppleTalk frames that have a native SNAP hdr */
255 !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
256 llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
257 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
258 llc = NULL;
259 } else {
260 m_adj(m, hdrlen - sizeof(*eh));
261 }
262 eh = mtod(m, struct ether_header *);
263 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
264 case IEEE80211_FC1_DIR_NODS:
265 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
266 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
267 break;
268 case IEEE80211_FC1_DIR_TODS:
269 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
270 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
271 break;
272 case IEEE80211_FC1_DIR_FROMDS:
273 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
274 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
275 break;
276 case IEEE80211_FC1_DIR_DSTODS:
277 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
278 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
279 break;
280 }
281 #ifdef ALIGNED_POINTER
282 if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
283 m = ieee80211_realign(vap, m, sizeof(*eh));
284 if (m == NULL)
285 return NULL;
286 }
287 #endif /* ALIGNED_POINTER */
288 if (llc != NULL) {
289 eh = mtod(m, struct ether_header *);
290 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
291 }
292 return m;
293 }
294
295 /*
296 * Decap a frame encapsulated in a fast-frame/A-MSDU.
297 */
298 struct mbuf *
299 ieee80211_decap1(struct mbuf *m, int *framelen)
300 {
301 #define FF_LLC_SIZE (sizeof(struct ether_header) + sizeof(struct llc))
302 struct ether_header *eh;
303 struct llc *llc;
304
305 /*
306 * The frame has an 802.3 header followed by an 802.2
307 * LLC header. The encapsulated frame length is in the
308 * first header type field; save that and overwrite it
309 * with the true type field found in the second. Then
310 * copy the 802.3 header up to where it belongs and
311 * adjust the mbuf contents to remove the void.
312 */
313 if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
314 return NULL;
315 eh = mtod(m, struct ether_header *); /* 802.3 header is first */
316 llc = (struct llc *)&eh[1]; /* 802.2 header follows */
317 *framelen = ntohs(eh->ether_type) /* encap'd frame size */
318 + sizeof(struct ether_header) - sizeof(struct llc);
319 eh->ether_type = llc->llc_un.type_snap.ether_type;
320 ovbcopy(eh, mtod(m, uint8_t *) + sizeof(struct llc),
321 sizeof(struct ether_header));
322 m_adj(m, sizeof(struct llc));
323 return m;
324 #undef FF_LLC_SIZE
325 }
326
327 /*
328 * Install received rate set information in the node's state block.
329 */
330 int
331 ieee80211_setup_rates(struct ieee80211_node *ni,
332 const uint8_t *rates, const uint8_t *xrates, int flags)
333 {
334 struct ieee80211vap *vap = ni->ni_vap;
335 struct ieee80211_rateset *rs = &ni->ni_rates;
336
337 memset(rs, 0, sizeof(*rs));
338 rs->rs_nrates = rates[1];
339 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
340 if (xrates != NULL) {
341 uint8_t nxrates;
342 /*
343 * Tack on 11g extended supported rate element.
344 */
345 nxrates = xrates[1];
346 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
347 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
348 IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE, ni,
349 "extended rate set too large; only using "
350 "%u of %u rates", nxrates, xrates[1]);
351 vap->iv_stats.is_rx_rstoobig++;
352 }
353 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
354 rs->rs_nrates += nxrates;
355 }
356 return ieee80211_fix_rate(ni, rs, flags);
357 }
358
359 /*
360 * Send a management frame error response to the specified
361 * station. If ni is associated with the station then use
362 * it; otherwise allocate a temporary node suitable for
363 * transmitting the frame and then free the reference so
364 * it will go away as soon as the frame has been transmitted.
365 */
366 void
367 ieee80211_send_error(struct ieee80211_node *ni,
368 const uint8_t mac[IEEE80211_ADDR_LEN], int subtype, int arg)
369 {
370 struct ieee80211vap *vap = ni->ni_vap;
371 int istmp;
372
373 if (ni == vap->iv_bss) {
374 if (vap->iv_state != IEEE80211_S_RUN) {
375 /*
376 * XXX hack until we get rid of this routine.
377 * We can be called prior to the vap reaching
378 * run state under certain conditions in which
379 * case iv_bss->ni_chan will not be setup.
380 * Check for this explicitly and and just ignore
381 * the request.
382 */
383 return;
384 }
385 ni = ieee80211_tmp_node(vap, mac);
386 if (ni == NULL) {
387 /* XXX msg */
388 return;
389 }
390 istmp = 1;
391 } else
392 istmp = 0;
393 IEEE80211_SEND_MGMT(ni, subtype, arg);
394 if (istmp)
395 ieee80211_free_node(ni);
396 }
397
398 int
399 ieee80211_alloc_challenge(struct ieee80211_node *ni)
400 {
401 if (ni->ni_challenge == NULL)
402 ni->ni_challenge = (uint32_t *) malloc(IEEE80211_CHALLENGE_LEN,
403 M_80211_NODE, M_NOWAIT);
404 if (ni->ni_challenge == NULL) {
405 IEEE80211_NOTE(ni->ni_vap,
406 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
407 "%s", "shared key challenge alloc failed");
408 /* XXX statistic */
409 }
410 return (ni->ni_challenge != NULL);
411 }
412
413 /*
414 * Parse a Beacon or ProbeResponse frame and return the
415 * useful information in an ieee80211_scanparams structure.
416 * Status is set to 0 if no problems were found; otherwise
417 * a bitmask of IEEE80211_BPARSE_* items is returned that
418 * describes the problems detected.
419 */
420 int
421 ieee80211_parse_beacon(struct ieee80211_node *ni, struct mbuf *m,
422 struct ieee80211_scanparams *scan)
423 {
424 struct ieee80211vap *vap = ni->ni_vap;
425 struct ieee80211com *ic = ni->ni_ic;
426 struct ieee80211_frame *wh;
427 uint8_t *frm, *efrm;
428
429 wh = mtod(m, struct ieee80211_frame *);
430 frm = (uint8_t *)&wh[1];
431 efrm = mtod(m, uint8_t *) + m->m_len;
432 scan->status = 0;
433 /*
434 * beacon/probe response frame format
435 * [8] time stamp
436 * [2] beacon interval
437 * [2] capability information
438 * [tlv] ssid
439 * [tlv] supported rates
440 * [tlv] country information
441 * [tlv] channel switch announcement (CSA)
442 * [tlv] parameter set (FH/DS)
443 * [tlv] erp information
444 * [tlv] extended supported rates
445 * [tlv] WME
446 * [tlv] WPA or RSN
447 * [tlv] HT capabilities
448 * [tlv] HT information
449 * [tlv] Atheros capabilities
450 * [tlv] Mesh ID
451 * [tlv] Mesh Configuration
452 */
453 IEEE80211_VERIFY_LENGTH(efrm - frm, 12,
454 return (scan->status = IEEE80211_BPARSE_BADIELEN));
455 memset(scan, 0, sizeof(*scan));
456 scan->tstamp = frm; frm += 8;
457 scan->bintval = le16toh(*(uint16_t *)frm); frm += 2;
458 scan->capinfo = le16toh(*(uint16_t *)frm); frm += 2;
459 scan->bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
460 scan->chan = scan->bchan;
461 scan->ies = frm;
462 scan->ies_len = efrm - frm;
463
464 while (efrm - frm > 1) {
465 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2,
466 return (scan->status = IEEE80211_BPARSE_BADIELEN));
467 switch (*frm) {
468 case IEEE80211_ELEMID_SSID:
469 scan->ssid = frm;
470 break;
471 case IEEE80211_ELEMID_RATES:
472 scan->rates = frm;
473 break;
474 case IEEE80211_ELEMID_COUNTRY:
475 scan->country = frm;
476 break;
477 case IEEE80211_ELEMID_CSA:
478 scan->csa = frm;
479 break;
480 case IEEE80211_ELEMID_FHPARMS:
481 if (ic->ic_phytype == IEEE80211_T_FH) {
482 scan->fhdwell = LE_READ_2(&frm[2]);
483 scan->chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
484 scan->fhindex = frm[6];
485 }
486 break;
487 case IEEE80211_ELEMID_DSPARMS:
488 /*
489 * XXX hack this since depending on phytype
490 * is problematic for multi-mode devices.
491 */
492 if (ic->ic_phytype != IEEE80211_T_FH)
493 scan->chan = frm[2];
494 break;
495 case IEEE80211_ELEMID_TIM:
496 /* XXX ATIM? */
497 scan->tim = frm;
498 scan->timoff = frm - mtod(m, uint8_t *);
499 break;
500 case IEEE80211_ELEMID_IBSSPARMS:
501 case IEEE80211_ELEMID_CFPARMS:
502 case IEEE80211_ELEMID_PWRCNSTR:
503 /* NB: avoid debugging complaints */
504 break;
505 case IEEE80211_ELEMID_XRATES:
506 scan->xrates = frm;
507 break;
508 case IEEE80211_ELEMID_ERP:
509 if (frm[1] != 1) {
510 IEEE80211_DISCARD_IE(vap,
511 IEEE80211_MSG_ELEMID, wh, "ERP",
512 "bad len %u", frm[1]);
513 vap->iv_stats.is_rx_elem_toobig++;
514 break;
515 }
516 scan->erp = frm[2] | 0x100;
517 break;
518 case IEEE80211_ELEMID_HTCAP:
519 scan->htcap = frm;
520 break;
521 case IEEE80211_ELEMID_RSN:
522 scan->rsn = frm;
523 break;
524 case IEEE80211_ELEMID_HTINFO:
525 scan->htinfo = frm;
526 break;
527 #ifdef IEEE80211_SUPPORT_MESH
528 case IEEE80211_ELEMID_MESHID:
529 scan->meshid = frm;
530 break;
531 case IEEE80211_ELEMID_MESHCONF:
532 scan->meshconf = frm;
533 break;
534 #endif
535 case IEEE80211_ELEMID_VENDOR:
536 if (iswpaoui(frm))
537 scan->wpa = frm;
538 else if (iswmeparam(frm) || iswmeinfo(frm))
539 scan->wme = frm;
540 #ifdef IEEE80211_SUPPORT_SUPERG
541 else if (isatherosoui(frm))
542 scan->ath = frm;
543 #endif
544 #ifdef IEEE80211_SUPPORT_TDMA
545 else if (istdmaoui(frm))
546 scan->tdma = frm;
547 #endif
548 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
549 /*
550 * Accept pre-draft HT ie's if the
551 * standard ones have not been seen.
552 */
553 if (ishtcapoui(frm)) {
554 if (scan->htcap == NULL)
555 scan->htcap = frm;
556 } else if (ishtinfooui(frm)) {
557 if (scan->htinfo == NULL)
558 scan->htcap = frm;
559 }
560 }
561 break;
562 default:
563 IEEE80211_DISCARD_IE(vap, IEEE80211_MSG_ELEMID,
564 wh, "unhandled",
565 "id %u, len %u", *frm, frm[1]);
566 vap->iv_stats.is_rx_elem_unknown++;
567 break;
568 }
569 frm += frm[1] + 2;
570 }
571 IEEE80211_VERIFY_ELEMENT(scan->rates, IEEE80211_RATE_MAXSIZE,
572 scan->status |= IEEE80211_BPARSE_RATES_INVALID);
573 if (scan->rates != NULL && scan->xrates != NULL) {
574 /*
575 * NB: don't process XRATES if RATES is missing. This
576 * avoids a potential null ptr deref and should be ok
577 * as the return code will already note RATES is missing
578 * (so callers shouldn't otherwise process the frame).
579 */
580 IEEE80211_VERIFY_ELEMENT(scan->xrates,
581 IEEE80211_RATE_MAXSIZE - scan->rates[1],
582 scan->status |= IEEE80211_BPARSE_XRATES_INVALID);
583 }
584 IEEE80211_VERIFY_ELEMENT(scan->ssid, IEEE80211_NWID_LEN,
585 scan->status |= IEEE80211_BPARSE_SSID_INVALID);
586 if (scan->chan != scan->bchan && ic->ic_phytype != IEEE80211_T_FH) {
587 /*
588 * Frame was received on a channel different from the
589 * one indicated in the DS params element id;
590 * silently discard it.
591 *
592 * NB: this can happen due to signal leakage.
593 * But we should take it for FH phy because
594 * the rssi value should be correct even for
595 * different hop pattern in FH.
596 */
597 IEEE80211_DISCARD(vap,
598 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
599 wh, NULL, "for off-channel %u", scan->chan);
600 vap->iv_stats.is_rx_chanmismatch++;
601 scan->status |= IEEE80211_BPARSE_OFFCHAN;
602 }
603 if (!(IEEE80211_BINTVAL_MIN <= scan->bintval &&
604 scan->bintval <= IEEE80211_BINTVAL_MAX)) {
605 IEEE80211_DISCARD(vap,
606 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
607 wh, NULL, "bogus beacon interval", scan->bintval);
608 vap->iv_stats.is_rx_badbintval++;
609 scan->status |= IEEE80211_BPARSE_BINTVAL_INVALID;
610 }
611 if (scan->country != NULL) {
612 /*
613 * Validate we have at least enough data to extract
614 * the country code. Not sure if we should return an
615 * error instead of discarding the IE; consider this
616 * being lenient as we don't depend on the data for
617 * correct operation.
618 */
619 IEEE80211_VERIFY_LENGTH(scan->country[1], 3 * sizeof(uint8_t),
620 scan->country = NULL);
621 }
622 if (scan->csa != NULL) {
623 /*
624 * Validate Channel Switch Announcement; this must
625 * be the correct length or we toss the frame.
626 */
627 IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t),
628 scan->status |= IEEE80211_BPARSE_CSA_INVALID);
629 }
630 /*
631 * Process HT ie's. This is complicated by our
632 * accepting both the standard ie's and the pre-draft
633 * vendor OUI ie's that some vendors still use/require.
634 */
635 if (scan->htcap != NULL) {
636 IEEE80211_VERIFY_LENGTH(scan->htcap[1],
637 scan->htcap[0] == IEEE80211_ELEMID_VENDOR ?
638 4 + sizeof(struct ieee80211_ie_htcap)-2 :
639 sizeof(struct ieee80211_ie_htcap)-2,
640 scan->htcap = NULL);
641 }
642 if (scan->htinfo != NULL) {
643 IEEE80211_VERIFY_LENGTH(scan->htinfo[1],
644 scan->htinfo[0] == IEEE80211_ELEMID_VENDOR ?
645 4 + sizeof(struct ieee80211_ie_htinfo)-2 :
646 sizeof(struct ieee80211_ie_htinfo)-2,
647 scan->htinfo = NULL);
648 }
649 return scan->status;
650 }
651
652 /*
653 * Parse an Action frame. Return 0 on success, non-zero on failure.
654 */
655 int
656 ieee80211_parse_action(struct ieee80211_node *ni, struct mbuf *m)
657 {
658 struct ieee80211vap *vap = ni->ni_vap;
659 const struct ieee80211_action *ia;
660 struct ieee80211_frame *wh;
661 uint8_t *frm, *efrm;
662
663 /*
664 * action frame format:
665 * [1] category
666 * [1] action
667 * [tlv] parameters
668 */
669 wh = mtod(m, struct ieee80211_frame *);
670 frm = (u_int8_t *)&wh[1];
671 efrm = mtod(m, u_int8_t *) + m->m_len;
672 IEEE80211_VERIFY_LENGTH(efrm - frm,
673 sizeof(struct ieee80211_action), return EINVAL);
674 ia = (const struct ieee80211_action *) frm;
675
676 vap->iv_stats.is_rx_action++;
677 IEEE80211_NODE_STAT(ni, rx_action);
678
679 /* verify frame payloads but defer processing */
680 /* XXX maybe push this to method */
681 switch (ia->ia_category) {
682 case IEEE80211_ACTION_CAT_BA:
683 switch (ia->ia_action) {
684 case IEEE80211_ACTION_BA_ADDBA_REQUEST:
685 IEEE80211_VERIFY_LENGTH(efrm - frm,
686 sizeof(struct ieee80211_action_ba_addbarequest),
687 return EINVAL);
688 break;
689 case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
690 IEEE80211_VERIFY_LENGTH(efrm - frm,
691 sizeof(struct ieee80211_action_ba_addbaresponse),
692 return EINVAL);
693 break;
694 case IEEE80211_ACTION_BA_DELBA:
695 IEEE80211_VERIFY_LENGTH(efrm - frm,
696 sizeof(struct ieee80211_action_ba_delba),
697 return EINVAL);
698 break;
699 }
700 break;
701 case IEEE80211_ACTION_CAT_HT:
702 switch (ia->ia_action) {
703 case IEEE80211_ACTION_HT_TXCHWIDTH:
704 IEEE80211_VERIFY_LENGTH(efrm - frm,
705 sizeof(struct ieee80211_action_ht_txchwidth),
706 return EINVAL);
707 break;
708 case IEEE80211_ACTION_HT_MIMOPWRSAVE:
709 IEEE80211_VERIFY_LENGTH(efrm - frm,
710 sizeof(struct ieee80211_action_ht_mimopowersave),
711 return EINVAL);
712 break;
713 }
714 break;
715 }
716 return 0;
717 }
718
719 #ifdef IEEE80211_DEBUG
720 /*
721 * Debugging support.
722 */
723 void
724 ieee80211_ssid_mismatch(struct ieee80211vap *vap, const char *tag,
725 uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
726 {
727 printf("[%s] discard %s frame, ssid mismatch: ",
728 ether_sprintf(mac), tag);
729 ieee80211_print_essid(ssid + 2, ssid[1]);
730 printf("\n");
731 }
732
733 /*
734 * Return the bssid of a frame.
735 */
736 static const uint8_t *
737 ieee80211_getbssid(const struct ieee80211vap *vap,
738 const struct ieee80211_frame *wh)
739 {
740 if (vap->iv_opmode == IEEE80211_M_STA)
741 return wh->i_addr2;
742 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
743 return wh->i_addr1;
744 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
745 return wh->i_addr1;
746 return wh->i_addr3;
747 }
748
749 #include <machine/stdarg.h>
750
751 void
752 ieee80211_note(const struct ieee80211vap *vap, const char *fmt, ...)
753 {
754 char buf[128]; /* XXX */
755 va_list ap;
756
757 va_start(ap, fmt);
758 vsnprintf(buf, sizeof(buf), fmt, ap);
759 va_end(ap);
760
761 if_printf(vap->iv_ifp, "%s", buf); /* NB: no \n */
762 }
763
764 void
765 ieee80211_note_frame(const struct ieee80211vap *vap,
766 const struct ieee80211_frame *wh,
767 const char *fmt, ...)
768 {
769 char buf[128]; /* XXX */
770 va_list ap;
771
772 va_start(ap, fmt);
773 vsnprintf(buf, sizeof(buf), fmt, ap);
774 va_end(ap);
775 if_printf(vap->iv_ifp, "[%s] %s\n",
776 ether_sprintf(ieee80211_getbssid(vap, wh)), buf);
777 }
778
779 void
780 ieee80211_note_mac(const struct ieee80211vap *vap,
781 const uint8_t mac[IEEE80211_ADDR_LEN],
782 const char *fmt, ...)
783 {
784 char buf[128]; /* XXX */
785 va_list ap;
786
787 va_start(ap, fmt);
788 vsnprintf(buf, sizeof(buf), fmt, ap);
789 va_end(ap);
790 if_printf(vap->iv_ifp, "[%s] %s\n", ether_sprintf(mac), buf);
791 }
792
793 void
794 ieee80211_discard_frame(const struct ieee80211vap *vap,
795 const struct ieee80211_frame *wh,
796 const char *type, const char *fmt, ...)
797 {
798 va_list ap;
799
800 if_printf(vap->iv_ifp, "[%s] discard ",
801 ether_sprintf(ieee80211_getbssid(vap, wh)));
802 if (type == NULL) {
803 printf("%s frame, ", ieee80211_mgt_subtype_name[
804 (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) >>
805 IEEE80211_FC0_SUBTYPE_SHIFT]);
806 } else
807 printf("%s frame, ", type);
808 va_start(ap, fmt);
809 vprintf(fmt, ap);
810 va_end(ap);
811 printf("\n");
812 }
813
814 void
815 ieee80211_discard_ie(const struct ieee80211vap *vap,
816 const struct ieee80211_frame *wh,
817 const char *type, const char *fmt, ...)
818 {
819 va_list ap;
820
821 if_printf(vap->iv_ifp, "[%s] discard ",
822 ether_sprintf(ieee80211_getbssid(vap, wh)));
823 if (type != NULL)
824 printf("%s information element, ", type);
825 else
826 printf("information element, ");
827 va_start(ap, fmt);
828 vprintf(fmt, ap);
829 va_end(ap);
830 printf("\n");
831 }
832
833 void
834 ieee80211_discard_mac(const struct ieee80211vap *vap,
835 const uint8_t mac[IEEE80211_ADDR_LEN],
836 const char *type, const char *fmt, ...)
837 {
838 va_list ap;
839
840 if_printf(vap->iv_ifp, "[%s] discard ", ether_sprintf(mac));
841 if (type != NULL)
842 printf("%s frame, ", type);
843 else
844 printf("frame, ");
845 va_start(ap, fmt);
846 vprintf(fmt, ap);
847 va_end(ap);
848 printf("\n");
849 }
850 #endif /* IEEE80211_DEBUG */
Cache object: 2d0606a2826acea6927676a06572df64
|