1 /* $NetBSD: ieee80211_node.c,v 1.59 2006/11/16 01:33:41 christos Exp $ */
2 /*-
3 * Copyright (c) 2001 Atsushi Onoe
4 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. The name of the author may not be used to endorse or promote products
16 * derived from this software without specific prior written permission.
17 *
18 * Alternatively, this software may be distributed under the terms of the
19 * GNU General Public License ("GPL") version 2 as published by the Free
20 * Software Foundation.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 */
33
34 #include <sys/cdefs.h>
35 #ifdef __FreeBSD__
36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_node.c,v 1.65 2005/08/13 17:50:21 sam Exp $");
37 #endif
38 #ifdef __NetBSD__
39 __KERNEL_RCSID(0, "$NetBSD: ieee80211_node.c,v 1.59 2006/11/16 01:33:41 christos Exp $");
40 #endif
41
42 #include "opt_inet.h"
43
44 #include <sys/param.h>
45 #include <sys/systm.h>
46 #include <sys/mbuf.h>
47 #include <sys/malloc.h>
48 #include <sys/kernel.h>
49
50 #include <sys/socket.h>
51 #include <sys/sockio.h>
52 #include <sys/endian.h>
53 #include <sys/errno.h>
54 #include <sys/proc.h>
55 #include <sys/sysctl.h>
56
57 #include <net/if.h>
58 #include <net/if_media.h>
59 #include <net/if_arp.h>
60 #include <net/if_ether.h>
61 #include <net/if_llc.h>
62
63 #include <net80211/ieee80211_netbsd.h>
64 #include <net80211/ieee80211_var.h>
65
66 #include <net/bpf.h>
67
68 #ifdef INET
69 #include <netinet/in.h>
70 #include <net/if_ether.h>
71 #endif
72
73 /*
74 * Association id's are managed with a bit vector.
75 */
76 #define IEEE80211_AID_SET(b, w) \
77 ((w)[IEEE80211_AID(b) / 32] |= (1 << (IEEE80211_AID(b) % 32)))
78 #define IEEE80211_AID_CLR(b, w) \
79 ((w)[IEEE80211_AID(b) / 32] &= ~(1 << (IEEE80211_AID(b) % 32)))
80 #define IEEE80211_AID_ISSET(b, w) \
81 ((w)[IEEE80211_AID(b) / 32] & (1 << (IEEE80211_AID(b) % 32)))
82
83 static struct ieee80211_node *node_alloc(struct ieee80211_node_table *);
84 static void node_cleanup(struct ieee80211_node *);
85 static void node_free(struct ieee80211_node *);
86 static u_int8_t node_getrssi(const struct ieee80211_node *);
87
88 static void ieee80211_setup_node(struct ieee80211_node_table *,
89 struct ieee80211_node *, const u_int8_t *);
90 static void _ieee80211_free_node(struct ieee80211_node *);
91 static void ieee80211_free_allnodes(struct ieee80211_node_table *);
92
93 static void ieee80211_timeout_scan_candidates(struct ieee80211_node_table *);
94 static void ieee80211_timeout_stations(struct ieee80211_node_table *);
95
96 static void ieee80211_set_tim(struct ieee80211_node *, int set);
97
98 static void ieee80211_node_table_init(struct ieee80211com *ic,
99 struct ieee80211_node_table *nt, const char *name,
100 int inact, int keyixmax,
101 void (*timeout)(struct ieee80211_node_table *));
102 static void ieee80211_node_table_cleanup(struct ieee80211_node_table *nt);
103
104 MALLOC_DEFINE(M_80211_NODE, "80211node", "802.11 node state");
105
106 void
107 ieee80211_node_attach(struct ieee80211com *ic)
108 {
109
110 ic->ic_node_alloc = node_alloc;
111 ic->ic_node_free = node_free;
112 ic->ic_node_cleanup = node_cleanup;
113 ic->ic_node_getrssi = node_getrssi;
114
115 /* default station inactivity timer setings */
116 ic->ic_inact_init = IEEE80211_INACT_INIT;
117 ic->ic_inact_auth = IEEE80211_INACT_AUTH;
118 ic->ic_inact_run = IEEE80211_INACT_RUN;
119 ic->ic_inact_probe = IEEE80211_INACT_PROBE;
120
121 /* NB: driver should override */
122 ic->ic_max_aid = IEEE80211_AID_DEF;
123 ic->ic_set_tim = ieee80211_set_tim;
124 }
125
126 void
127 ieee80211_node_lateattach(struct ieee80211com *ic)
128 {
129 struct ieee80211_rsnparms *rsn;
130
131 if (ic->ic_max_aid > IEEE80211_AID_MAX)
132 ic->ic_max_aid = IEEE80211_AID_MAX;
133 ic->ic_aid_bitmap = malloc(howmany(ic->ic_max_aid, 32) *
134 sizeof(u_int32_t), M_DEVBUF, M_NOWAIT | M_ZERO);
135 if (ic->ic_aid_bitmap == NULL) {
136 /* XXX no way to recover */
137 printf("%s: no memory for AID bitmap!\n", __func__);
138 ic->ic_max_aid = 0;
139 }
140
141 /* XXX defer until using hostap/ibss mode */
142 ic->ic_tim_len = howmany(ic->ic_max_aid, 8) * sizeof(u_int8_t);
143 ic->ic_tim_bitmap = malloc(ic->ic_tim_len, M_DEVBUF, M_NOWAIT | M_ZERO);
144 if (ic->ic_tim_bitmap == NULL) {
145 /* XXX no way to recover */
146 printf("%s: no memory for TIM bitmap!\n", __func__);
147 }
148
149 ieee80211_node_table_init(ic, &ic->ic_sta, "station",
150 IEEE80211_INACT_INIT, ic->ic_crypto.cs_max_keyix,
151 ieee80211_timeout_stations);
152 ieee80211_node_table_init(ic, &ic->ic_scan, "scan",
153 IEEE80211_INACT_SCAN, 0,
154 ieee80211_timeout_scan_candidates);
155
156 ieee80211_reset_bss(ic);
157 /*
158 * Setup "global settings" in the bss node so that
159 * each new station automatically inherits them.
160 */
161 rsn = &ic->ic_bss->ni_rsn;
162 /* WEP, TKIP, and AES-CCM are always supported */
163 rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_WEP;
164 rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_TKIP;
165 rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_AES_CCM;
166 if (ic->ic_caps & IEEE80211_C_AES)
167 rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_AES_OCB;
168 if (ic->ic_caps & IEEE80211_C_CKIP)
169 rsn->rsn_ucastcipherset |= 1<<IEEE80211_CIPHER_CKIP;
170 /*
171 * Default unicast cipher to WEP for 802.1x use. If
172 * WPA is enabled the management code will set these
173 * values to reflect.
174 */
175 rsn->rsn_ucastcipher = IEEE80211_CIPHER_WEP;
176 rsn->rsn_ucastkeylen = 104 / NBBY;
177 /*
178 * WPA says the multicast cipher is the lowest unicast
179 * cipher supported. But we skip WEP which would
180 * otherwise be used based on this criteria.
181 */
182 rsn->rsn_mcastcipher = IEEE80211_CIPHER_TKIP;
183 rsn->rsn_mcastkeylen = 128 / NBBY;
184
185 /*
186 * We support both WPA-PSK and 802.1x; the one used
187 * is determined by the authentication mode and the
188 * setting of the PSK state.
189 */
190 rsn->rsn_keymgmtset = WPA_ASE_8021X_UNSPEC | WPA_ASE_8021X_PSK;
191 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
192
193 ic->ic_auth = ieee80211_authenticator_get(ic->ic_bss->ni_authmode);
194 }
195
196 void
197 ieee80211_node_detach(struct ieee80211com *ic)
198 {
199
200 if (ic->ic_bss != NULL) {
201 ieee80211_free_node(ic->ic_bss);
202 ic->ic_bss = NULL;
203 }
204 ieee80211_node_table_cleanup(&ic->ic_scan);
205 ieee80211_node_table_cleanup(&ic->ic_sta);
206 if (ic->ic_aid_bitmap != NULL) {
207 FREE(ic->ic_aid_bitmap, M_DEVBUF);
208 ic->ic_aid_bitmap = NULL;
209 }
210 if (ic->ic_tim_bitmap != NULL) {
211 FREE(ic->ic_tim_bitmap, M_DEVBUF);
212 ic->ic_tim_bitmap = NULL;
213 }
214 }
215
216 /*
217 * Port authorize/unauthorize interfaces for use by an authenticator.
218 */
219
220 void
221 ieee80211_node_authorize(struct ieee80211_node *ni)
222 {
223 struct ieee80211com *ic = ni->ni_ic;
224
225 ni->ni_flags |= IEEE80211_NODE_AUTH;
226 ni->ni_inact_reload = ic->ic_inact_run;
227 }
228
229 void
230 ieee80211_node_unauthorize(struct ieee80211_node *ni)
231 {
232 ni->ni_flags &= ~IEEE80211_NODE_AUTH;
233 }
234
235 /*
236 * Set/change the channel. The rate set is also updated as
237 * to insure a consistent view by drivers.
238 */
239 static void
240 ieee80211_set_chan(struct ieee80211com *ic,
241 struct ieee80211_node *ni, struct ieee80211_channel *chan)
242 {
243 if (chan == IEEE80211_CHAN_ANYC) /* XXX while scanning */
244 chan = ic->ic_curchan;
245 ni->ni_chan = chan;
246 ni->ni_rates = ic->ic_sup_rates[ieee80211_chan2mode(ic, chan)];
247 }
248
249 /*
250 * AP scanning support.
251 */
252
253 #ifdef IEEE80211_DEBUG
254 static void
255 dump_chanlist(const u_char chans[])
256 {
257 const char *sep;
258 int i;
259
260 sep = " ";
261 for (i = 0; i < IEEE80211_CHAN_MAX; i++)
262 if (isset(chans, i)) {
263 printf("%s%u", sep, i);
264 sep = ", ";
265 }
266 }
267 #endif /* IEEE80211_DEBUG */
268
269 /*
270 * Initialize the channel set to scan based on the
271 * of available channels and the current PHY mode.
272 */
273 static void
274 ieee80211_reset_scan(struct ieee80211com *ic)
275 {
276
277 /* XXX ic_des_chan should be handled with ic_chan_active */
278 if (ic->ic_des_chan != IEEE80211_CHAN_ANYC) {
279 memset(ic->ic_chan_scan, 0, sizeof(ic->ic_chan_scan));
280 setbit(ic->ic_chan_scan,
281 ieee80211_chan2ieee(ic, ic->ic_des_chan));
282 } else
283 memcpy(ic->ic_chan_scan, ic->ic_chan_active,
284 sizeof(ic->ic_chan_active));
285 #ifdef IEEE80211_DEBUG
286 if (ieee80211_msg_scan(ic)) {
287 printf("%s: scan set:", __func__);
288 dump_chanlist(ic->ic_chan_scan);
289 printf(" start chan %u\n",
290 ieee80211_chan2ieee(ic, ic->ic_curchan));
291 }
292 #endif /* IEEE80211_DEBUG */
293 }
294
295 /*
296 * Begin an active scan.
297 */
298 void
299 ieee80211_begin_scan(struct ieee80211com *ic, int reset)
300 {
301
302 ic->ic_scan.nt_scangen++;
303 /*
304 * In all but hostap mode scanning starts off in
305 * an active mode before switching to passive.
306 */
307 if (ic->ic_opmode != IEEE80211_M_HOSTAP) {
308 ic->ic_flags |= IEEE80211_F_ASCAN;
309 ic->ic_stats.is_scan_active++;
310 } else
311 ic->ic_stats.is_scan_passive++;
312 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
313 "begin %s scan in %s mode, scangen %u\n",
314 (ic->ic_flags & IEEE80211_F_ASCAN) ? "active" : "passive",
315 ieee80211_phymode_name[ic->ic_curmode], ic->ic_scan.nt_scangen);
316 /*
317 * Clear scan state and flush any previously seen AP's.
318 */
319 ieee80211_reset_scan(ic);
320 if (reset)
321 ieee80211_free_allnodes(&ic->ic_scan);
322
323 ic->ic_flags |= IEEE80211_F_SCAN;
324
325 /* Scan the next channel. */
326 ieee80211_next_scan(ic);
327 }
328
329 /*
330 * Switch to the next channel marked for scanning.
331 */
332 int
333 ieee80211_next_scan(struct ieee80211com *ic)
334 {
335 struct ieee80211_channel *chan;
336
337 /*
338 * Insure any previous mgt frame timeouts don't fire.
339 * This assumes the driver does the right thing in
340 * flushing anything queued in the driver and below.
341 */
342 ic->ic_mgt_timer = 0;
343 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
344
345 chan = ic->ic_curchan;
346 do {
347 if (++chan > &ic->ic_channels[IEEE80211_CHAN_MAX])
348 chan = &ic->ic_channels[0];
349 if (isset(ic->ic_chan_scan, ieee80211_chan2ieee(ic, chan))) {
350 clrbit(ic->ic_chan_scan, ieee80211_chan2ieee(ic, chan));
351 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
352 "%s: chan %d->%d\n", __func__,
353 ieee80211_chan2ieee(ic, ic->ic_curchan),
354 ieee80211_chan2ieee(ic, chan));
355 ic->ic_curchan = chan;
356 /*
357 * XXX drivers should do this as needed,
358 * XXX for now maintain compatibility
359 */
360 ic->ic_bss->ni_rates =
361 ic->ic_sup_rates[ieee80211_chan2mode(ic, chan)];
362 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
363 return 1;
364 }
365 } while (chan != ic->ic_curchan);
366 ieee80211_end_scan(ic);
367 return 0;
368 }
369
370 /*
371 * Probe the curent channel, if allowed, while scanning.
372 * If the channel is not marked passive-only then send
373 * a probe request immediately. Otherwise mark state and
374 * listen for beacons on the channel; if we receive something
375 * then we'll transmit a probe request.
376 */
377 void
378 ieee80211_probe_curchan(struct ieee80211com *ic, int force)
379 {
380 struct ifnet *ifp = ic->ic_ifp;
381
382 if ((ic->ic_curchan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0 || force) {
383 /*
384 * XXX send both broadcast+directed probe request
385 */
386 ieee80211_send_probereq(ic->ic_bss,
387 ic->ic_myaddr, ifp->if_broadcastaddr,
388 ifp->if_broadcastaddr,
389 ic->ic_des_essid, ic->ic_des_esslen,
390 ic->ic_opt_ie, ic->ic_opt_ie_len);
391 } else
392 ic->ic_flags_ext |= IEEE80211_FEXT_PROBECHAN;
393 }
394
395 static __inline void
396 copy_bss(struct ieee80211_node *nbss, const struct ieee80211_node *obss)
397 {
398 /* propagate useful state */
399 nbss->ni_authmode = obss->ni_authmode;
400 nbss->ni_txpower = obss->ni_txpower;
401 nbss->ni_vlan = obss->ni_vlan;
402 nbss->ni_rsn = obss->ni_rsn;
403 /* XXX statistics? */
404 }
405
406 void
407 ieee80211_create_ibss(struct ieee80211com* ic, struct ieee80211_channel *chan)
408 {
409 struct ieee80211_node_table *nt;
410 struct ieee80211_node *ni;
411
412 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
413 "%s: creating ibss\n", __func__);
414
415 /*
416 * Create the station/neighbor table. Note that for adhoc
417 * mode we make the initial inactivity timer longer since
418 * we create nodes only through discovery and they typically
419 * are long-lived associations.
420 */
421 nt = &ic->ic_sta;
422 IEEE80211_NODE_LOCK(nt);
423 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
424 nt->nt_name = "station";
425 nt->nt_inact_init = ic->ic_inact_init;
426 } else {
427 nt->nt_name = "neighbor";
428 nt->nt_inact_init = ic->ic_inact_run;
429 }
430 IEEE80211_NODE_UNLOCK(nt);
431
432 ni = ieee80211_alloc_node(&ic->ic_sta, ic->ic_myaddr);
433 if (ni == NULL) {
434 /* XXX recovery? */
435 return;
436 }
437 IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_myaddr);
438 ni->ni_esslen = ic->ic_des_esslen;
439 memcpy(ni->ni_essid, ic->ic_des_essid, ni->ni_esslen);
440 copy_bss(ni, ic->ic_bss);
441 ni->ni_intval = ic->ic_bintval;
442 if (ic->ic_flags & IEEE80211_F_PRIVACY)
443 ni->ni_capinfo |= IEEE80211_CAPINFO_PRIVACY;
444 if (ic->ic_phytype == IEEE80211_T_FH) {
445 ni->ni_fhdwell = 200; /* XXX */
446 ni->ni_fhindex = 1;
447 }
448 if (ic->ic_opmode == IEEE80211_M_IBSS) {
449 ic->ic_flags |= IEEE80211_F_SIBSS;
450 ni->ni_capinfo |= IEEE80211_CAPINFO_IBSS; /* XXX */
451 if (ic->ic_flags & IEEE80211_F_DESBSSID)
452 IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_des_bssid);
453 else
454 ni->ni_bssid[0] |= 0x02; /* local bit for IBSS */
455 }
456 /*
457 * Fix the channel and related attributes.
458 */
459 ieee80211_set_chan(ic, ni, chan);
460 ic->ic_curchan = chan;
461 ic->ic_curmode = ieee80211_chan2mode(ic, chan);
462 /*
463 * Do mode-specific rate setup.
464 */
465 if (ic->ic_curmode == IEEE80211_MODE_11G) {
466 /*
467 * Use a mixed 11b/11g rate set.
468 */
469 ieee80211_set11gbasicrates(&ni->ni_rates, IEEE80211_MODE_11G);
470 } else if (ic->ic_curmode == IEEE80211_MODE_11B) {
471 /*
472 * Force pure 11b rate set.
473 */
474 ieee80211_set11gbasicrates(&ni->ni_rates, IEEE80211_MODE_11B);
475 }
476
477 (void) ieee80211_sta_join(ic, ieee80211_ref_node(ni));
478 }
479
480 void
481 ieee80211_reset_bss(struct ieee80211com *ic)
482 {
483 struct ieee80211_node *ni, *obss;
484
485 ieee80211_node_table_reset(&ic->ic_scan);
486 ieee80211_node_table_reset(&ic->ic_sta);
487
488 ni = ieee80211_alloc_node(&ic->ic_scan, ic->ic_myaddr);
489 IASSERT(ni != NULL, ("unable to setup inital BSS node"));
490 obss = ic->ic_bss;
491 ic->ic_bss = ieee80211_ref_node(ni);
492 if (obss != NULL) {
493 copy_bss(ni, obss);
494 ni->ni_intval = ic->ic_bintval;
495 ieee80211_free_node(obss);
496 }
497 }
498
499 /* XXX tunable */
500 #define STA_FAILS_MAX 2 /* assoc failures before ignored */
501
502 static int
503 ieee80211_match_bss(struct ieee80211com *ic, struct ieee80211_node *ni)
504 {
505 u_int8_t rate;
506 int fail;
507
508 fail = 0;
509 if (isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan)))
510 fail |= 0x01;
511 if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
512 ni->ni_chan != ic->ic_des_chan)
513 fail |= 0x01;
514 if (ic->ic_opmode == IEEE80211_M_IBSS) {
515 if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
516 fail |= 0x02;
517 } else {
518 if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0)
519 fail |= 0x02;
520 }
521 if (ic->ic_flags & IEEE80211_F_PRIVACY) {
522 if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
523 fail |= 0x04;
524 } else {
525 /* XXX does this mean privacy is supported or required? */
526 if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
527 fail |= 0x04;
528 }
529 rate = ieee80211_fix_rate(ni, IEEE80211_F_DONEGO | IEEE80211_F_DOFRATE);
530 if (rate & IEEE80211_RATE_BASIC)
531 fail |= 0x08;
532 if (ic->ic_des_esslen != 0 &&
533 (ni->ni_esslen != ic->ic_des_esslen ||
534 memcmp(ni->ni_essid, ic->ic_des_essid, ic->ic_des_esslen) != 0))
535 fail |= 0x10;
536 if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
537 !IEEE80211_ADDR_EQ(ic->ic_des_bssid, ni->ni_bssid))
538 fail |= 0x20;
539 if (ni->ni_fails >= STA_FAILS_MAX)
540 fail |= 0x40;
541 #ifdef IEEE80211_DEBUG
542 if (ieee80211_msg_scan(ic)) {
543 printf(" %c %s",
544 fail & 0x40 ? '=' : fail & 0x80 ? '^' : fail ? '-' : '+',
545 ether_sprintf(ni->ni_macaddr));
546 printf(" %s%c", ether_sprintf(ni->ni_bssid),
547 fail & 0x20 ? '!' : ' ');
548 printf(" %3d%c", ieee80211_chan2ieee(ic, ni->ni_chan),
549 fail & 0x01 ? '!' : ' ');
550 printf(" %+4d", ni->ni_rssi);
551 printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2,
552 fail & 0x08 ? '!' : ' ');
553 printf(" %4s%c",
554 (ni->ni_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
555 (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
556 "????",
557 fail & 0x02 ? '!' : ' ');
558 printf(" %3s%c ",
559 (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) ?
560 "wep" : "no",
561 fail & 0x04 ? '!' : ' ');
562 ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
563 printf("%s\n", fail & 0x10 ? "!" : "");
564 }
565 #endif
566 return fail;
567 }
568
569 static __inline u_int8_t
570 maxrate(const struct ieee80211_node *ni)
571 {
572 const struct ieee80211_rateset *rs = &ni->ni_rates;
573 /* NB: assumes rate set is sorted (happens on frame receive) */
574 return rs->rs_rates[rs->rs_nrates-1] & IEEE80211_RATE_VAL;
575 }
576
577 /*
578 * Compare the capabilities of two nodes and decide which is
579 * more desirable (return >0 if a is considered better). Note
580 * that we assume compatibility/usability has already been checked
581 * so we don't need to (e.g. validate whether privacy is supported).
582 * Used to select the best scan candidate for association in a BSS.
583 */
584 static int
585 ieee80211_node_compare(struct ieee80211com *ic,
586 const struct ieee80211_node *a,
587 const struct ieee80211_node *b)
588 {
589 u_int8_t maxa, maxb;
590 u_int8_t rssia, rssib;
591 int weight;
592
593 /* privacy support preferred */
594 if ((a->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) &&
595 (b->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
596 return 1;
597 if ((a->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0 &&
598 (b->ni_capinfo & IEEE80211_CAPINFO_PRIVACY))
599 return -1;
600
601 /* compare count of previous failures */
602 weight = b->ni_fails - a->ni_fails;
603 if (abs(weight) > 1)
604 return weight;
605
606 rssia = ic->ic_node_getrssi(a);
607 rssib = ic->ic_node_getrssi(b);
608 if (abs(rssib - rssia) < 5) {
609 /* best/max rate preferred if signal level close enough XXX */
610 maxa = maxrate(a);
611 maxb = maxrate(b);
612 if (maxa != maxb)
613 return maxa - maxb;
614 /* XXX use freq for channel preference */
615 /* for now just prefer 5 GHz band to all other bands */
616 if (IEEE80211_IS_CHAN_5GHZ(a->ni_chan) &&
617 !IEEE80211_IS_CHAN_5GHZ(b->ni_chan))
618 return 1;
619 if (!IEEE80211_IS_CHAN_5GHZ(a->ni_chan) &&
620 IEEE80211_IS_CHAN_5GHZ(b->ni_chan))
621 return -1;
622 }
623 /* all things being equal, use signal level */
624 return rssia - rssib;
625 }
626
627 /*
628 * Mark an ongoing scan stopped.
629 */
630 void
631 ieee80211_cancel_scan(struct ieee80211com *ic)
632 {
633
634 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN, "%s: end %s scan\n",
635 __func__,
636 (ic->ic_flags & IEEE80211_F_ASCAN) ? "active" : "passive");
637
638 ic->ic_flags &= ~(IEEE80211_F_SCAN | IEEE80211_F_ASCAN);
639 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
640 }
641
642 /*
643 * Complete a scan of potential channels.
644 */
645 void
646 ieee80211_end_scan(struct ieee80211com *ic)
647 {
648 struct ieee80211_node_table *nt = &ic->ic_scan;
649 struct ieee80211_node *ni, *selbs;
650
651 ieee80211_cancel_scan(ic);
652 ieee80211_notify_scan_done(ic);
653
654 #ifndef IEEE80211_NO_HOSTAP
655 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
656 u_int8_t maxrssi[IEEE80211_CHAN_MAX]; /* XXX off stack? */
657 int i, bestchan;
658 u_int8_t rssi;
659
660 /*
661 * The passive scan to look for existing AP's completed,
662 * select a channel to camp on. Identify the channels
663 * that already have one or more AP's and try to locate
664 * an unoccupied one. If that fails, pick a channel that
665 * looks to be quietest.
666 */
667 memset(maxrssi, 0, sizeof(maxrssi));
668 IEEE80211_NODE_LOCK(nt);
669 TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
670 rssi = ic->ic_node_getrssi(ni);
671 i = ieee80211_chan2ieee(ic, ni->ni_chan);
672 if (rssi > maxrssi[i])
673 maxrssi[i] = rssi;
674 }
675 IEEE80211_NODE_UNLOCK(nt);
676 /* XXX select channel more intelligently */
677 bestchan = -1;
678 for (i = 0; i < IEEE80211_CHAN_MAX; i++)
679 if (isset(ic->ic_chan_active, i)) {
680 /*
681 * If the channel is unoccupied the max rssi
682 * should be zero; just take it. Otherwise
683 * track the channel with the lowest rssi and
684 * use that when all channels appear occupied.
685 */
686 if (maxrssi[i] == 0) {
687 bestchan = i;
688 break;
689 }
690 if (bestchan == -1 ||
691 maxrssi[i] < maxrssi[bestchan])
692 bestchan = i;
693 }
694 if (bestchan != -1) {
695 ieee80211_create_ibss(ic, &ic->ic_channels[bestchan]);
696 return;
697 }
698 /* no suitable channel, should not happen */
699 }
700 #endif /* !IEEE80211_NO_HOSTAP */
701
702 /*
703 * When manually sequencing the state machine; scan just once
704 * regardless of whether we have a candidate or not. The
705 * controlling application is expected to setup state and
706 * initiate an association.
707 */
708 if (ic->ic_roaming == IEEE80211_ROAMING_MANUAL)
709 return;
710 /*
711 * Automatic sequencing; look for a candidate and
712 * if found join the network.
713 */
714 /* NB: unlocked read should be ok */
715 if (TAILQ_FIRST(&nt->nt_node) == NULL) {
716 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN,
717 "%s: no scan candidate\n", __func__);
718 notfound:
719 if (ic->ic_opmode == IEEE80211_M_IBSS &&
720 (ic->ic_flags & IEEE80211_F_IBSSON) &&
721 ic->ic_des_esslen != 0) {
722 ieee80211_create_ibss(ic, ic->ic_ibss_chan);
723 return;
724 }
725 /*
726 * Decrement the failure counts so entries will be
727 * reconsidered the next time around. We really want
728 * to do this only for sta's where we've previously
729 * had some success.
730 */
731 IEEE80211_NODE_LOCK(nt);
732 TAILQ_FOREACH(ni, &nt->nt_node, ni_list)
733 if (ni->ni_fails)
734 ni->ni_fails--;
735 IEEE80211_NODE_UNLOCK(nt);
736 /*
737 * Reset the list of channels to scan and start again.
738 */
739 ieee80211_reset_scan(ic);
740 ic->ic_flags |= IEEE80211_F_SCAN;
741 ieee80211_next_scan(ic);
742 return;
743 }
744 selbs = NULL;
745 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SCAN, "\t%s\n",
746 "macaddr bssid chan rssi rate flag wep essid");
747 IEEE80211_NODE_LOCK(nt);
748 TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
749 if (ieee80211_match_bss(ic, ni) == 0) {
750 if (selbs == NULL)
751 selbs = ni;
752 else if (ieee80211_node_compare(ic, ni, selbs) > 0)
753 selbs = ni;
754 }
755 }
756 if (selbs != NULL) /* NB: grab ref while dropping lock */
757 (void) ieee80211_ref_node(selbs);
758 IEEE80211_NODE_UNLOCK(nt);
759 if (selbs == NULL)
760 goto notfound;
761 if (!ieee80211_sta_join(ic, selbs)) {
762 ieee80211_free_node(selbs);
763 goto notfound;
764 }
765 }
766
767 /*
768 * Handle 802.11 ad hoc network merge. The
769 * convention, set by the Wireless Ethernet Compatibility Alliance
770 * (WECA), is that an 802.11 station will change its BSSID to match
771 * the "oldest" 802.11 ad hoc network, on the same channel, that
772 * has the station's desired SSID. The "oldest" 802.11 network
773 * sends beacons with the greatest TSF timestamp.
774 *
775 * The caller is assumed to validate TSF's before attempting a merge.
776 *
777 * Return !0 if the BSSID changed, 0 otherwise.
778 */
779 int
780 ieee80211_ibss_merge(struct ieee80211_node *ni)
781 {
782 struct ieee80211com *ic = ni->ni_ic;
783
784 if (ni == ic->ic_bss ||
785 IEEE80211_ADDR_EQ(ni->ni_bssid, ic->ic_bss->ni_bssid)) {
786 /* unchanged, nothing to do */
787 return 0;
788 }
789 if (ieee80211_match_bss(ic, ni) != 0) { /* capabilities mismatch */
790 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
791 "%s: merge failed, capabilities mismatch\n", __func__);
792 ic->ic_stats.is_ibss_capmismatch++;
793 return 0;
794 }
795 if (!ieee80211_sta_join(ic, ieee80211_ref_node(ni)))
796 return 0;
797 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
798 "%s: new bssid %s: %s preamble, %s slot time%s\n", __func__,
799 ether_sprintf(ni->ni_bssid),
800 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
801 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
802 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : ""
803 );
804 ic->ic_flags &= ~IEEE80211_F_SIBSS;
805 return 1;
806 }
807
808 /*
809 * Join the specified IBSS/BSS network. The node is assumed to
810 * be passed in with a held reference.
811 */
812 int
813 ieee80211_sta_join(struct ieee80211com *ic, struct ieee80211_node *selbs)
814 {
815 struct ieee80211_node *obss;
816
817 if (ic->ic_opmode == IEEE80211_M_IBSS) {
818 struct ieee80211_node_table *nt;
819 /*
820 * Delete unusable rates; we've already checked
821 * that the negotiated rate set is acceptable.
822 */
823 ieee80211_fix_rate(selbs, IEEE80211_F_DODEL);
824 /*
825 * Fillin the neighbor table; it will already
826 * exist if we are simply switching mastership.
827 * XXX ic_sta always setup so this is unnecessary?
828 */
829 nt = &ic->ic_sta;
830 IEEE80211_NODE_LOCK(nt);
831 nt->nt_name = "neighbor";
832 nt->nt_inact_init = ic->ic_inact_run;
833 IEEE80211_NODE_UNLOCK(nt);
834 }
835
836 /*
837 * Committed to selbs, setup state.
838 */
839 obss = ic->ic_bss;
840 ic->ic_bss = selbs; /* NB: caller assumed to bump refcnt */
841 if (obss != NULL) {
842 copy_bss(selbs, obss);
843 ieee80211_free_node(obss);
844 }
845 /*
846 * Set the erp state (mostly the slot time) to deal with
847 * the auto-select case; this should be redundant if the
848 * mode is locked.
849 */
850 ic->ic_curmode = ieee80211_chan2mode(ic, selbs->ni_chan);
851 ic->ic_curchan = selbs->ni_chan;
852 ieee80211_reset_erp(ic);
853 ieee80211_wme_initparams(ic);
854
855 if (ic->ic_opmode == IEEE80211_M_STA)
856 ieee80211_new_state(ic, IEEE80211_S_AUTH, -1);
857 else
858 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
859 return 1;
860 }
861
862 /*
863 * Leave the specified IBSS/BSS network. The node is assumed to
864 * be passed in with a held reference.
865 */
866 void
867 ieee80211_sta_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
868 {
869 ic->ic_node_cleanup(ni);
870 ieee80211_notify_node_leave(ic, ni);
871 }
872
873 int
874 ieee80211_get_rate(const struct ieee80211_node * const ni)
875 {
876 #define RATE(_ix) (ni->ni_rates.rs_rates[(_ix)] & IEEE80211_RATE_VAL)
877 int ix, rate;
878 struct ieee80211com *ic = ni->ni_ic;
879 const struct ieee80211_rateset *rs;
880
881 IASSERT(ni != NULL, ("ni != NULL"));
882 IASSERT(ieee80211_node_refcnt(ni) > 0,
883 ("refcnt(ni) == %d", ieee80211_node_refcnt(ni)));
884 IASSERT(ic != NULL, ("ic != NULL"));
885 if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
886 rs = &ic->ic_sup_rates[ic->ic_curmode];
887 rate = rs->rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
888 for (ix = ni->ni_rates.rs_nrates - 1;
889 ix >= 0 && RATE(ix) != rate; ix--)
890 ;
891 if (ix < 0) {
892 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG,
893 "%s: fixed rate %d (%d.%d Mb/s) not in rate set",
894 __func__, ic->ic_fixed_rate, (rate * 5) / 10,
895 (rate * 5) % 10);
896 goto no_rate;
897 }
898 } else if (ic->ic_state == IEEE80211_S_RUN)
899 rate = ni->ni_rates.rs_rates[ni->ni_txrate];
900 else {
901 no_rate:
902 rs = &ni->ni_rates;
903 /* Choose node's lowest basic rate, or else its lowest rate. */
904 for (ix = 0; ix < rs->rs_nrates; ix++) {
905 if (rs->rs_rates[ix] & IEEE80211_RATE_BASIC)
906 return rs->rs_rates[ix] & IEEE80211_RATE_VAL;
907 }
908 return ni->ni_rates.rs_rates[0] & IEEE80211_RATE_VAL;
909 }
910 return rate & IEEE80211_RATE_VAL;
911 }
912
913 static struct ieee80211_node *
914 node_alloc(struct ieee80211_node_table *nt)
915 {
916 struct ieee80211_node *ni;
917
918 MALLOC(ni, struct ieee80211_node *, sizeof(struct ieee80211_node),
919 M_80211_NODE, M_NOWAIT | M_ZERO);
920 return ni;
921 }
922
923 /*
924 * Reclaim any resources in a node and reset any critical
925 * state. Typically nodes are free'd immediately after,
926 * but in some cases the storage may be reused so we need
927 * to insure consistent state (should probably fix that).
928 */
929 static void
930 node_cleanup(struct ieee80211_node *ni)
931 {
932 #define N(a) (sizeof(a)/sizeof(a[0]))
933 struct ieee80211com *ic = ni->ni_ic;
934 int i, qlen;
935
936 /* NB: preserve ni_table */
937 if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) {
938 ic->ic_ps_sta--;
939 ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT;
940 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
941 "[%s] power save mode off, %u sta's in ps mode\n",
942 ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta);
943 }
944 /*
945 * Clear AREF flag that marks the authorization refcnt bump
946 * has happened. This is probably not needed as the node
947 * should always be removed from the table so not found but
948 * do it just in case.
949 */
950 ni->ni_flags &= ~IEEE80211_NODE_AREF;
951
952 /*
953 * Drain power save queue and, if needed, clear TIM.
954 */
955 IEEE80211_NODE_SAVEQ_DRAIN(ni, qlen);
956 if (qlen != 0 && ic->ic_set_tim != NULL)
957 ic->ic_set_tim(ni, 0);
958
959 ni->ni_associd = 0;
960 if (ni->ni_challenge != NULL) {
961 FREE(ni->ni_challenge, M_DEVBUF);
962 ni->ni_challenge = NULL;
963 }
964 /*
965 * Preserve SSID, WPA, and WME ie's so the bss node is
966 * reusable during a re-auth/re-assoc state transition.
967 * If we remove these data they will not be recreated
968 * because they come from a probe-response or beacon frame
969 * which cannot be expected prior to the association-response.
970 * This should not be an issue when operating in other modes
971 * as stations leaving always go through a full state transition
972 * which will rebuild this state.
973 *
974 * XXX does this leave us open to inheriting old state?
975 */
976 for (i = 0; i < N(ni->ni_rxfrag); i++)
977 if (ni->ni_rxfrag[i] != NULL) {
978 m_freem(ni->ni_rxfrag[i]);
979 ni->ni_rxfrag[i] = NULL;
980 }
981 /*
982 * Must be careful here to remove any key map entry w/o a LOR.
983 */
984 ieee80211_node_delucastkey(ni);
985 #undef N
986 }
987
988 static void
989 node_free(struct ieee80211_node *ni)
990 {
991 struct ieee80211com *ic = ni->ni_ic;
992
993 ic->ic_node_cleanup(ni);
994 if (ni->ni_wpa_ie != NULL)
995 FREE(ni->ni_wpa_ie, M_DEVBUF);
996 if (ni->ni_wme_ie != NULL)
997 FREE(ni->ni_wme_ie, M_DEVBUF);
998 IEEE80211_NODE_SAVEQ_DESTROY(ni);
999 FREE(ni, M_80211_NODE);
1000 }
1001
1002 static u_int8_t
1003 node_getrssi(const struct ieee80211_node *ni)
1004 {
1005 return ni->ni_rssi;
1006 }
1007
1008 static void
1009 ieee80211_setup_node(struct ieee80211_node_table *nt,
1010 struct ieee80211_node *ni, const u_int8_t *macaddr)
1011 {
1012 struct ieee80211com *ic = nt->nt_ic;
1013 int hash;
1014
1015 IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1016 "%s %p<%s> in %s table\n", __func__, ni,
1017 ether_sprintf(macaddr), nt->nt_name);
1018
1019 IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
1020 hash = IEEE80211_NODE_HASH(macaddr);
1021 ieee80211_node_initref(ni); /* mark referenced */
1022 ni->ni_chan = IEEE80211_CHAN_ANYC;
1023 ni->ni_authmode = IEEE80211_AUTH_OPEN;
1024 ni->ni_txpower = ic->ic_txpowlimit; /* max power */
1025 ieee80211_crypto_resetkey(ic, &ni->ni_ucastkey, IEEE80211_KEYIX_NONE);
1026 ni->ni_inact_reload = nt->nt_inact_init;
1027 ni->ni_inact = ni->ni_inact_reload;
1028 IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
1029
1030 IEEE80211_NODE_LOCK(nt);
1031 TAILQ_INSERT_TAIL(&nt->nt_node, ni, ni_list);
1032 LIST_INSERT_HEAD(&nt->nt_hash[hash], ni, ni_hash);
1033 ni->ni_table = nt;
1034 ni->ni_ic = ic;
1035 IEEE80211_NODE_UNLOCK(nt);
1036 }
1037
1038 struct ieee80211_node *
1039 ieee80211_alloc_node(struct ieee80211_node_table *nt, const u_int8_t *macaddr)
1040 {
1041 struct ieee80211com *ic = nt->nt_ic;
1042 struct ieee80211_node *ni;
1043
1044 ni = ic->ic_node_alloc(nt);
1045 if (ni != NULL)
1046 ieee80211_setup_node(nt, ni, macaddr);
1047 else
1048 ic->ic_stats.is_rx_nodealloc++;
1049 return ni;
1050 }
1051
1052 /*
1053 * Craft a temporary node suitable for sending a management frame
1054 * to the specified station. We craft only as much state as we
1055 * need to do the work since the node will be immediately reclaimed
1056 * once the send completes.
1057 */
1058 struct ieee80211_node *
1059 ieee80211_tmp_node(struct ieee80211com *ic, const u_int8_t *macaddr)
1060 {
1061 struct ieee80211_node *ni;
1062
1063 ni = ic->ic_node_alloc(&ic->ic_sta);
1064 if (ni != NULL) {
1065 IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1066 "%s %p<%s>\n", __func__, ni, ether_sprintf(macaddr));
1067
1068 IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
1069 IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
1070 ieee80211_node_initref(ni); /* mark referenced */
1071 ni->ni_txpower = ic->ic_bss->ni_txpower;
1072 /* NB: required by ieee80211_fix_rate */
1073 ieee80211_set_chan(ic, ni, ic->ic_bss->ni_chan);
1074 ieee80211_crypto_resetkey(ic, &ni->ni_ucastkey,
1075 IEEE80211_KEYIX_NONE);
1076 /* XXX optimize away */
1077 IEEE80211_NODE_SAVEQ_INIT(ni, "unknown");
1078
1079 ni->ni_table = NULL; /* NB: pedantic */
1080 ni->ni_ic = ic;
1081 } else {
1082 /* XXX msg */
1083 ic->ic_stats.is_rx_nodealloc++;
1084 }
1085 return ni;
1086 }
1087
1088 struct ieee80211_node *
1089 ieee80211_dup_bss(struct ieee80211_node_table *nt, const u_int8_t *macaddr)
1090 {
1091 struct ieee80211com *ic = nt->nt_ic;
1092 struct ieee80211_node *ni;
1093
1094 ni = ic->ic_node_alloc(nt);
1095 if (ni != NULL) {
1096 ieee80211_setup_node(nt, ni, macaddr);
1097 /*
1098 * Inherit from ic_bss.
1099 */
1100 ni->ni_authmode = ic->ic_bss->ni_authmode;
1101 ni->ni_txpower = ic->ic_bss->ni_txpower;
1102 ni->ni_vlan = ic->ic_bss->ni_vlan; /* XXX?? */
1103 IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
1104 ieee80211_set_chan(ic, ni, ic->ic_bss->ni_chan);
1105 ni->ni_rsn = ic->ic_bss->ni_rsn;
1106 } else
1107 ic->ic_stats.is_rx_nodealloc++;
1108 return ni;
1109 }
1110
1111 static struct ieee80211_node *
1112 #ifdef IEEE80211_DEBUG_REFCNT
1113 _ieee80211_find_node_debug(struct ieee80211_node_table *nt,
1114 const u_int8_t *macaddr, const char *func, int line)
1115 #else
1116 _ieee80211_find_node(struct ieee80211_node_table *nt,
1117 const u_int8_t *macaddr)
1118 #endif
1119 {
1120 struct ieee80211_node *ni;
1121 int hash;
1122
1123 IEEE80211_NODE_LOCK_ASSERT(nt);
1124
1125 hash = IEEE80211_NODE_HASH(macaddr);
1126 LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
1127 if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr)) {
1128 ieee80211_ref_node(ni); /* mark referenced */
1129 #ifdef IEEE80211_DEBUG_REFCNT
1130 IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
1131 "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
1132 func, line,
1133 ni, ether_sprintf(ni->ni_macaddr),
1134 ieee80211_node_refcnt(ni));
1135 #endif
1136 return ni;
1137 }
1138 }
1139 return NULL;
1140 }
1141 #ifdef IEEE80211_DEBUG_REFCNT
1142 #define _ieee80211_find_node(nt, mac) \
1143 _ieee80211_find_node_debug(nt, mac, func, line)
1144 #endif
1145
1146 struct ieee80211_node *
1147 #ifdef IEEE80211_DEBUG_REFCNT
1148 ieee80211_find_node_debug(struct ieee80211_node_table *nt,
1149 const u_int8_t *macaddr, const char *func, int line)
1150 #else
1151 ieee80211_find_node(struct ieee80211_node_table *nt, const u_int8_t *macaddr)
1152 #endif
1153 {
1154 struct ieee80211_node *ni;
1155
1156 IEEE80211_NODE_LOCK(nt);
1157 ni = _ieee80211_find_node(nt, macaddr);
1158 IEEE80211_NODE_UNLOCK(nt);
1159 return ni;
1160 }
1161
1162 /*
1163 * Fake up a node; this handles node discovery in adhoc mode.
1164 * Note that for the driver's benefit we we treat this like
1165 * an association so the driver has an opportunity to setup
1166 * it's private state.
1167 */
1168 struct ieee80211_node *
1169 ieee80211_fakeup_adhoc_node(struct ieee80211_node_table *nt,
1170 const u_int8_t macaddr[IEEE80211_ADDR_LEN])
1171 {
1172 struct ieee80211com *ic = nt->nt_ic;
1173 struct ieee80211_node *ni;
1174
1175 ni = ieee80211_dup_bss(nt, macaddr);
1176 if (ni != NULL) {
1177 /* XXX no rate negotiation; just dup */
1178 ni->ni_rates = ic->ic_bss->ni_rates;
1179 if (ic->ic_newassoc != NULL)
1180 ic->ic_newassoc(ni, 1);
1181 /* XXX not right for 802.1x/WPA */
1182 ieee80211_node_authorize(ni);
1183 }
1184 return ni;
1185 }
1186
1187 #ifdef IEEE80211_DEBUG
1188 static void
1189 dump_probe_beacon(u_int8_t subtype, int isnew,
1190 const u_int8_t mac[IEEE80211_ADDR_LEN],
1191 const struct ieee80211_scanparams *sp)
1192 {
1193
1194 printf("[%s] %s%s on chan %u (bss chan %u) ",
1195 ether_sprintf(mac), isnew ? "new " : "",
1196 ieee80211_mgt_subtype_name[subtype >> IEEE80211_FC0_SUBTYPE_SHIFT],
1197 sp->chan, sp->bchan);
1198 ieee80211_print_essid(sp->ssid + 2, sp->ssid[1]);
1199 printf("\n");
1200
1201 if (isnew) {
1202 printf("[%s] caps 0x%x bintval %u erp 0x%x",
1203 ether_sprintf(mac), sp->capinfo, sp->bintval, sp->erp);
1204 if (sp->country != NULL) {
1205 #ifdef __FreeBSD__
1206 printf(" country info %*D",
1207 sp->country[1], sp->country+2, " ");
1208 #else
1209 int i;
1210 printf(" country info");
1211 for (i = 0; i < sp->country[1]; i++)
1212 printf(" %02x", sp->country[i+2]);
1213 #endif
1214 }
1215 printf("\n");
1216 }
1217 }
1218 #endif /* IEEE80211_DEBUG */
1219
1220 static void
1221 saveie(u_int8_t **iep, const u_int8_t *ie)
1222 {
1223
1224 if (ie == NULL)
1225 *iep = NULL;
1226 else
1227 ieee80211_saveie(iep, ie);
1228 }
1229
1230 /*
1231 * Process a beacon or probe response frame.
1232 */
1233 void
1234 ieee80211_add_scan(struct ieee80211com *ic,
1235 const struct ieee80211_scanparams *sp,
1236 const struct ieee80211_frame *wh,
1237 int subtype, int rssi, int rstamp)
1238 {
1239 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1240 struct ieee80211_node_table *nt = &ic->ic_scan;
1241 struct ieee80211_node *ni;
1242 int newnode = 0;
1243
1244 ni = ieee80211_find_node(nt, wh->i_addr2);
1245 if (ni == NULL) {
1246 /*
1247 * Create a new entry.
1248 */
1249 ni = ic->ic_node_alloc(nt);
1250 if (ni == NULL) {
1251 ic->ic_stats.is_rx_nodealloc++;
1252 return;
1253 }
1254 ieee80211_setup_node(nt, ni, wh->i_addr2);
1255 /*
1256 * XXX inherit from ic_bss.
1257 */
1258 ni->ni_authmode = ic->ic_bss->ni_authmode;
1259 ni->ni_txpower = ic->ic_bss->ni_txpower;
1260 ni->ni_vlan = ic->ic_bss->ni_vlan; /* XXX?? */
1261 ieee80211_set_chan(ic, ni, ic->ic_curchan);
1262 ni->ni_rsn = ic->ic_bss->ni_rsn;
1263 newnode = 1;
1264 }
1265 #ifdef IEEE80211_DEBUG
1266 if (ieee80211_msg_scan(ic) && (ic->ic_flags & IEEE80211_F_SCAN))
1267 dump_probe_beacon(subtype, newnode, wh->i_addr2, sp);
1268 #endif
1269 /* XXX ap beaconing multiple ssid w/ same bssid */
1270 if (sp->ssid[1] != 0 &&
1271 (ISPROBE(subtype) || ni->ni_esslen == 0)) {
1272 ni->ni_esslen = sp->ssid[1];
1273 memset(ni->ni_essid, 0, sizeof(ni->ni_essid));
1274 memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]);
1275 }
1276 ni->ni_scangen = ic->ic_scan.nt_scangen;
1277 IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
1278 ni->ni_rssi = rssi;
1279 ni->ni_rstamp = rstamp;
1280 memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
1281 ni->ni_intval = sp->bintval;
1282 ni->ni_capinfo = sp->capinfo;
1283 ni->ni_chan = &ic->ic_channels[sp->chan];
1284 ni->ni_fhdwell = sp->fhdwell;
1285 ni->ni_fhindex = sp->fhindex;
1286 ni->ni_erp = sp->erp;
1287 if (sp->tim != NULL) {
1288 struct ieee80211_tim_ie *ie =
1289 (struct ieee80211_tim_ie *) sp->tim;
1290
1291 ni->ni_dtim_count = ie->tim_count;
1292 ni->ni_dtim_period = ie->tim_period;
1293 }
1294 /*
1295 * Record the byte offset from the mac header to
1296 * the start of the TIM information element for
1297 * use by hardware and/or to speedup software
1298 * processing of beacon frames.
1299 */
1300 ni->ni_timoff = sp->timoff;
1301 /*
1302 * Record optional information elements that might be
1303 * used by applications or drivers.
1304 */
1305 saveie(&ni->ni_wme_ie, sp->wme);
1306 saveie(&ni->ni_wpa_ie, sp->wpa);
1307
1308 /* NB: must be after ni_chan is setup */
1309 ieee80211_setup_rates(ni, sp->rates, sp->xrates, IEEE80211_F_DOSORT);
1310
1311 if (!newnode)
1312 ieee80211_free_node(ni);
1313 #undef ISPROBE
1314 }
1315
1316 void
1317 ieee80211_init_neighbor(struct ieee80211com *ic, struct ieee80211_node *ni,
1318 const struct ieee80211_frame *wh, const struct ieee80211_scanparams *sp,
1319 int isnew)
1320 {
1321 ni->ni_esslen = sp->ssid[1];
1322 memcpy(ni->ni_essid, sp->ssid + 2, sp->ssid[1]);
1323 IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
1324 memcpy(ni->ni_tstamp.data, sp->tstamp, sizeof(ni->ni_tstamp));
1325 ni->ni_intval = sp->bintval;
1326 ni->ni_capinfo = sp->capinfo;
1327 ni->ni_chan = ic->ic_bss->ni_chan;
1328 ni->ni_fhdwell = sp->fhdwell;
1329 ni->ni_fhindex = sp->fhindex;
1330 ni->ni_erp = sp->erp;
1331 ni->ni_timoff = sp->timoff;
1332 if (sp->wme != NULL)
1333 ieee80211_saveie(&ni->ni_wme_ie, sp->wme);
1334 if (sp->wpa != NULL)
1335 ieee80211_saveie(&ni->ni_wpa_ie, sp->wpa);
1336
1337 /* NB: must be after ni_chan is setup */
1338 ieee80211_setup_rates(ni, sp->rates, sp->xrates,
1339 IEEE80211_F_DODEL | IEEE80211_F_DONEGO | IEEE80211_F_DOSORT);
1340
1341 if (ic->ic_newassoc != NULL)
1342 ic->ic_newassoc(ni, isnew);
1343 }
1344
1345 /*
1346 * Do node discovery in adhoc mode on receipt of a beacon
1347 * or probe response frame. Note that for the driver's
1348 * benefit we we treat this like an association so the
1349 * driver has an opportunity to setup it's private state.
1350 */
1351 struct ieee80211_node *
1352 ieee80211_add_neighbor(struct ieee80211com *ic,
1353 const struct ieee80211_frame *wh,
1354 const struct ieee80211_scanparams *sp)
1355 {
1356 struct ieee80211_node *ni;
1357
1358 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);/* XXX alloc_node? */
1359 if (ni != NULL) {
1360 ieee80211_init_neighbor(ic, ni, wh, sp, 1);
1361 /* XXX not right for 802.1x/WPA */
1362 ieee80211_node_authorize(ni);
1363 }
1364 return ni;
1365 }
1366
1367 #define IS_CTL(wh) \
1368 ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL)
1369 #define IS_PSPOLL(wh) \
1370 ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
1371 /*
1372 * Locate the node for sender, track state, and then pass the
1373 * (referenced) node up to the 802.11 layer for its use. We
1374 * are required to pass some node so we fall back to ic_bss
1375 * when this frame is from an unknown sender. The 802.11 layer
1376 * knows this means the sender wasn't in the node table and
1377 * acts accordingly.
1378 */
1379 struct ieee80211_node *
1380 #ifdef IEEE80211_DEBUG_REFCNT
1381 ieee80211_find_rxnode_debug(struct ieee80211com *ic,
1382 const struct ieee80211_frame_min *wh, const char *func, int line)
1383 #else
1384 ieee80211_find_rxnode(struct ieee80211com *ic,
1385 const struct ieee80211_frame_min *wh)
1386 #endif
1387 {
1388 struct ieee80211_node_table *nt;
1389 struct ieee80211_node *ni;
1390
1391 /* XXX may want scanned nodes in the neighbor table for adhoc */
1392 if (ic->ic_opmode == IEEE80211_M_STA ||
1393 ic->ic_opmode == IEEE80211_M_MONITOR ||
1394 (ic->ic_flags & IEEE80211_F_SCAN))
1395 nt = &ic->ic_scan;
1396 else
1397 nt = &ic->ic_sta;
1398 /* XXX check ic_bss first in station mode */
1399 /* XXX 4-address frames? */
1400 IEEE80211_NODE_LOCK(nt);
1401 if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
1402 ni = _ieee80211_find_node(nt, wh->i_addr1);
1403 else
1404 ni = _ieee80211_find_node(nt, wh->i_addr2);
1405 if (ni == NULL)
1406 ni = ieee80211_ref_node(ic->ic_bss);
1407 IEEE80211_NODE_UNLOCK(nt);
1408
1409 return ni;
1410 }
1411
1412 /*
1413 * Like ieee80211_find_rxnode but use the supplied h/w
1414 * key index as a hint to locate the node in the key
1415 * mapping table. If an entry is present at the key
1416 * index we return it; otherwise do a normal lookup and
1417 * update the mapping table if the station has a unicast
1418 * key assigned to it.
1419 */
1420 struct ieee80211_node *
1421 #ifdef IEEE80211_DEBUG_REFCNT
1422 ieee80211_find_rxnode_withkey_debug(struct ieee80211com *ic,
1423 const struct ieee80211_frame_min *wh, ieee80211_keyix keyix,
1424 const char *func, int line)
1425 #else
1426 ieee80211_find_rxnode_withkey(struct ieee80211com *ic,
1427 const struct ieee80211_frame_min *wh, ieee80211_keyix keyix)
1428 #endif
1429 {
1430 struct ieee80211_node_table *nt;
1431 struct ieee80211_node *ni;
1432
1433 if (ic->ic_opmode == IEEE80211_M_STA ||
1434 ic->ic_opmode == IEEE80211_M_MONITOR ||
1435 (ic->ic_flags & IEEE80211_F_SCAN))
1436 nt = &ic->ic_scan;
1437 else
1438 nt = &ic->ic_sta;
1439 IEEE80211_NODE_LOCK(nt);
1440 if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax)
1441 ni = nt->nt_keyixmap[keyix];
1442 else
1443 ni = NULL;
1444 if (ni == NULL) {
1445 if (IS_CTL(wh) && !IS_PSPOLL(wh) /*&& !IS_RTS(ah)*/)
1446 ni = _ieee80211_find_node(nt, wh->i_addr1);
1447 else
1448 ni = _ieee80211_find_node(nt, wh->i_addr2);
1449 if (ni == NULL)
1450 ni = ieee80211_ref_node(ic->ic_bss);
1451 if (nt->nt_keyixmap != NULL) {
1452 /*
1453 * If the station has a unicast key cache slot
1454 * assigned update the key->node mapping table.
1455 */
1456 keyix = ni->ni_ucastkey.wk_rxkeyix;
1457 /* XXX can keyixmap[keyix] != NULL? */
1458 if (keyix < nt->nt_keyixmax &&
1459 nt->nt_keyixmap[keyix] == NULL) {
1460 IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1461 "%s: add key map entry %p<%s> refcnt %d\n",
1462 __func__, ni, ether_sprintf(ni->ni_macaddr),
1463 ieee80211_node_refcnt(ni)+1);
1464 nt->nt_keyixmap[keyix] = ieee80211_ref_node(ni);
1465 }
1466 }
1467 } else {
1468 ieee80211_ref_node(ni);
1469 }
1470 IEEE80211_NODE_UNLOCK(nt);
1471
1472 return ni;
1473 }
1474 #undef IS_PSPOLL
1475 #undef IS_CTL
1476
1477 /*
1478 * Return a reference to the appropriate node for sending
1479 * a data frame. This handles node discovery in adhoc networks.
1480 */
1481 struct ieee80211_node *
1482 #ifdef IEEE80211_DEBUG_REFCNT
1483 ieee80211_find_txnode_debug(struct ieee80211com *ic, const u_int8_t *macaddr,
1484 const char *func, int line)
1485 #else
1486 ieee80211_find_txnode(struct ieee80211com *ic, const u_int8_t *macaddr)
1487 #endif
1488 {
1489 struct ieee80211_node_table *nt = &ic->ic_sta;
1490 struct ieee80211_node *ni;
1491
1492 /*
1493 * The destination address should be in the node table
1494 * unless this is a multicast/broadcast frame. We can
1495 * also optimize station mode operation, all frames go
1496 * to the bss node.
1497 */
1498 /* XXX can't hold lock across dup_bss 'cuz of recursive locking */
1499 IEEE80211_NODE_LOCK(nt);
1500 if (ic->ic_opmode == IEEE80211_M_STA || IEEE80211_IS_MULTICAST(macaddr))
1501 ni = ieee80211_ref_node(ic->ic_bss);
1502 else
1503 ni = _ieee80211_find_node(nt, macaddr);
1504 IEEE80211_NODE_UNLOCK(nt);
1505
1506 if (ni == NULL) {
1507 if (ic->ic_opmode == IEEE80211_M_IBSS ||
1508 ic->ic_opmode == IEEE80211_M_AHDEMO) {
1509 /*
1510 * In adhoc mode cons up a node for the destination.
1511 * Note that we need an additional reference for the
1512 * caller to be consistent with _ieee80211_find_node.
1513 */
1514 ni = ieee80211_fakeup_adhoc_node(nt, macaddr);
1515 if (ni != NULL)
1516 (void) ieee80211_ref_node(ni);
1517 } else {
1518 IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT,
1519 "[%s] no node, discard frame (%s)\n",
1520 ether_sprintf(macaddr), __func__);
1521 ic->ic_stats.is_tx_nonode++;
1522 }
1523 }
1524 return ni;
1525 }
1526
1527 /*
1528 * Like find but search based on the channel too.
1529 */
1530 struct ieee80211_node *
1531 #ifdef IEEE80211_DEBUG_REFCNT
1532 ieee80211_find_node_with_channel_debug(struct ieee80211_node_table *nt,
1533 const u_int8_t *macaddr, struct ieee80211_channel *chan,
1534 const char *func, int line)
1535 #else
1536 ieee80211_find_node_with_channel(struct ieee80211_node_table *nt,
1537 const u_int8_t *macaddr, struct ieee80211_channel *chan)
1538 #endif
1539 {
1540 struct ieee80211_node *ni;
1541 int hash;
1542
1543 hash = IEEE80211_NODE_HASH(macaddr);
1544 IEEE80211_NODE_LOCK(nt);
1545 LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
1546 if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) &&
1547 ni->ni_chan == chan) {
1548 ieee80211_ref_node(ni); /* mark referenced */
1549 IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
1550 #ifdef IEEE80211_DEBUG_REFCNT
1551 "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
1552 func, line,
1553 #else
1554 "%s %p<%s> refcnt %d\n", __func__,
1555 #endif
1556 ni, ether_sprintf(ni->ni_macaddr),
1557 ieee80211_node_refcnt(ni));
1558 break;
1559 }
1560 }
1561 IEEE80211_NODE_UNLOCK(nt);
1562 return ni;
1563 }
1564
1565 struct ieee80211_node *
1566 ieee80211_refine_node_for_beacon(struct ieee80211com *ic,
1567 struct ieee80211_node *ni0, struct ieee80211_channel *chan,
1568 const u_int8_t *ssid)
1569 {
1570 struct ieee80211_node_table *nt = ni0->ni_table;
1571 struct ieee80211_node *best, *ni;
1572 int best_score = 0, score;
1573
1574 if (nt == NULL)
1575 return ni0;
1576
1577 best = ni0;
1578 if (ssid[1] == 0 || best->ni_esslen == 0)
1579 best_score = 1;
1580 else if (ssid[1] == best->ni_esslen &&
1581 memcmp(ssid + 2, best->ni_essid, ssid[1]) == 0)
1582 best_score = 2;
1583 else
1584 best_score = 0;
1585
1586 IEEE80211_NODE_LOCK(nt);
1587 for (ni = LIST_NEXT(ni0, ni_hash); ni != NULL;
1588 ni = LIST_NEXT(ni, ni_hash)) {
1589 if (!IEEE80211_ADDR_EQ(ni->ni_macaddr, best->ni_macaddr) ||
1590 ni->ni_ic != best->ni_ic || ni->ni_chan != chan)
1591 continue;
1592
1593 if (ssid[1] == 0 || ni->ni_esslen == 0)
1594 score = 1;
1595 else if (ssid[1] == ni->ni_esslen &&
1596 memcmp(ssid + 2, ni->ni_essid, ssid[1]) == 0)
1597 score = 2;
1598 else
1599 continue;
1600
1601 if (score > best_score) {
1602 best = ni;
1603 best_score = score;
1604 }
1605 }
1606 IEEE80211_NODE_UNLOCK(nt);
1607 return best;
1608 }
1609
1610 /*
1611 * Like find but search based on the ssid too.
1612 */
1613 struct ieee80211_node *
1614 #ifdef IEEE80211_DEBUG_REFCNT
1615 ieee80211_find_node_with_ssid_debug(struct ieee80211_node_table *nt,
1616 const u_int8_t *macaddr, u_int ssidlen, const u_int8_t *ssid,
1617 const char *func, int line)
1618 #else
1619 ieee80211_find_node_with_ssid(struct ieee80211_node_table *nt,
1620 const u_int8_t *macaddr, u_int ssidlen, const u_int8_t *ssid)
1621 #endif
1622 {
1623 #define MATCH_SSID(ni, ssid, ssidlen) \
1624 (ni->ni_esslen == ssidlen && memcmp(ni->ni_essid, ssid, ssidlen) == 0)
1625 static const u_int8_t zeromac[IEEE80211_ADDR_LEN];
1626 struct ieee80211com *ic = nt->nt_ic;
1627 struct ieee80211_node *ni;
1628 int hash;
1629
1630 IEEE80211_NODE_LOCK(nt);
1631 /*
1632 * A mac address that is all zero means match only the ssid;
1633 * otherwise we must match both.
1634 */
1635 if (IEEE80211_ADDR_EQ(macaddr, zeromac)) {
1636 TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1637 if (MATCH_SSID(ni, ssid, ssidlen))
1638 break;
1639 }
1640 } else {
1641 hash = IEEE80211_NODE_HASH(macaddr);
1642 LIST_FOREACH(ni, &nt->nt_hash[hash], ni_hash) {
1643 if (IEEE80211_ADDR_EQ(ni->ni_macaddr, macaddr) &&
1644 MATCH_SSID(ni, ssid, ssidlen))
1645 break;
1646 }
1647 }
1648 if (ni != NULL) {
1649 ieee80211_ref_node(ni); /* mark referenced */
1650 IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1651 #ifdef IEEE80211_DEBUG_REFCNT
1652 "%s (%s:%u) %p<%s> refcnt %d\n", __func__,
1653 func, line,
1654 #else
1655 "%s %p<%s> refcnt %d\n", __func__,
1656 #endif
1657 ni, ether_sprintf(ni->ni_macaddr),
1658 ieee80211_node_refcnt(ni));
1659 }
1660 IEEE80211_NODE_UNLOCK(nt);
1661 return ni;
1662 #undef MATCH_SSID
1663 }
1664
1665 static void
1666 _ieee80211_free_node(struct ieee80211_node *ni)
1667 {
1668 struct ieee80211com *ic = ni->ni_ic;
1669 struct ieee80211_node_table *nt = ni->ni_table;
1670
1671 IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1672 "%s %p<%s> in %s table\n", __func__, ni,
1673 ether_sprintf(ni->ni_macaddr),
1674 nt != NULL ? nt->nt_name : "<gone>");
1675
1676 IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
1677 if (nt != NULL) {
1678 TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
1679 LIST_REMOVE(ni, ni_hash);
1680 }
1681 ic->ic_node_free(ni);
1682 }
1683
1684 void
1685 #ifdef IEEE80211_DEBUG_REFCNT
1686 ieee80211_free_node_debug(struct ieee80211_node *ni, const char *func, int line)
1687 #else
1688 ieee80211_free_node(struct ieee80211_node *ni)
1689 #endif
1690 {
1691 struct ieee80211_node_table *nt = ni->ni_table;
1692
1693 #ifdef IEEE80211_DEBUG_REFCNT
1694 IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1695 "%s (%s:%u) %p<%s> refcnt %d\n", __func__, func, line, ni,
1696 ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)-1);
1697 #endif
1698 if (nt != NULL) {
1699 IEEE80211_NODE_LOCK(nt);
1700 if (ieee80211_node_dectestref(ni)) {
1701 /*
1702 * Last reference, reclaim state.
1703 */
1704 _ieee80211_free_node(ni);
1705 } else if (ieee80211_node_refcnt(ni) == 1 &&
1706 nt->nt_keyixmap != NULL) {
1707 ieee80211_keyix keyix;
1708 /*
1709 * Check for a last reference in the key mapping table.
1710 */
1711 keyix = ni->ni_ucastkey.wk_rxkeyix;
1712 if (keyix < nt->nt_keyixmax &&
1713 nt->nt_keyixmap[keyix] == ni) {
1714 IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1715 "%s: %p<%s> clear key map entry", __func__,
1716 ni, ether_sprintf(ni->ni_macaddr));
1717 nt->nt_keyixmap[keyix] = NULL;
1718 ieee80211_node_decref(ni); /* XXX needed? */
1719 _ieee80211_free_node(ni);
1720 }
1721 }
1722 IEEE80211_NODE_UNLOCK(nt);
1723 } else {
1724 if (ieee80211_node_dectestref(ni))
1725 _ieee80211_free_node(ni);
1726 }
1727 }
1728
1729 /*
1730 * Reclaim a unicast key and clear any key cache state.
1731 */
1732 int
1733 ieee80211_node_delucastkey(struct ieee80211_node *ni)
1734 {
1735 struct ieee80211com *ic = ni->ni_ic;
1736 struct ieee80211_node_table *nt = &ic->ic_sta;
1737 struct ieee80211_node *nikey;
1738 ieee80211_keyix keyix;
1739 int isowned, status;
1740
1741 /*
1742 * NB: We must beware of LOR here; deleting the key
1743 * can cause the crypto layer to block traffic updates
1744 * which can generate a LOR against the node table lock;
1745 * grab it here and stash the key index for our use below.
1746 *
1747 * Must also beware of recursion on the node table lock.
1748 * When called from node_cleanup we may already have
1749 * the node table lock held. Unfortunately there's no
1750 * way to separate out this path so we must do this
1751 * conditionally.
1752 */
1753 isowned = IEEE80211_NODE_IS_LOCKED(nt);
1754 if (!isowned)
1755 IEEE80211_NODE_LOCK(nt);
1756 keyix = ni->ni_ucastkey.wk_rxkeyix;
1757 status = ieee80211_crypto_delkey(ic, &ni->ni_ucastkey);
1758 if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax) {
1759 nikey = nt->nt_keyixmap[keyix];
1760 nt->nt_keyixmap[keyix] = NULL;;
1761 } else
1762 nikey = NULL;
1763 if (!isowned)
1764 IEEE80211_NODE_UNLOCK(&ic->ic_sta);
1765
1766 if (nikey != NULL) {
1767 IASSERT(nikey == ni,
1768 ("key map out of sync, ni %p nikey %p", ni, nikey));
1769 IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1770 "%s: delete key map entry %p<%s> refcnt %d\n",
1771 __func__, ni, ether_sprintf(ni->ni_macaddr),
1772 ieee80211_node_refcnt(ni)-1);
1773 ieee80211_free_node(ni);
1774 }
1775 return status;
1776 }
1777
1778 /*
1779 * Reclaim a node. If this is the last reference count then
1780 * do the normal free work. Otherwise remove it from the node
1781 * table and mark it gone by clearing the back-reference.
1782 */
1783 static void
1784 node_reclaim(struct ieee80211_node_table *nt, struct ieee80211_node *ni)
1785 {
1786 ieee80211_keyix keyix;
1787
1788 IEEE80211_NODE_LOCK_ASSERT(nt);
1789
1790 IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1791 "%s: remove %p<%s> from %s table, refcnt %d\n",
1792 __func__, ni, ether_sprintf(ni->ni_macaddr),
1793 nt->nt_name, ieee80211_node_refcnt(ni)-1);
1794 /*
1795 * Clear any entry in the unicast key mapping table.
1796 * We need to do it here so rx lookups don't find it
1797 * in the mapping table even if it's not in the hash
1798 * table. We cannot depend on the mapping table entry
1799 * being cleared because the node may not be free'd.
1800 */
1801 keyix = ni->ni_ucastkey.wk_rxkeyix;
1802 if (nt->nt_keyixmap != NULL && keyix < nt->nt_keyixmax &&
1803 nt->nt_keyixmap[keyix] == ni) {
1804 IEEE80211_DPRINTF(ni->ni_ic, IEEE80211_MSG_NODE,
1805 "%s: %p<%s> clear key map entry\n",
1806 __func__, ni, ether_sprintf(ni->ni_macaddr));
1807 nt->nt_keyixmap[keyix] = NULL;
1808 ieee80211_node_decref(ni); /* NB: don't need free */
1809 }
1810 if (!ieee80211_node_dectestref(ni)) {
1811 /*
1812 * Other references are present, just remove the
1813 * node from the table so it cannot be found. When
1814 * the references are dropped storage will be
1815 * reclaimed.
1816 */
1817 TAILQ_REMOVE(&nt->nt_node, ni, ni_list);
1818 LIST_REMOVE(ni, ni_hash);
1819 ni->ni_table = NULL; /* clear reference */
1820 } else
1821 _ieee80211_free_node(ni);
1822 }
1823
1824 static void
1825 ieee80211_free_allnodes_locked(struct ieee80211_node_table *nt)
1826 {
1827 struct ieee80211com *ic = nt->nt_ic;
1828 struct ieee80211_node *ni;
1829
1830 IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1831 "%s: free all nodes in %s table\n", __func__, nt->nt_name);
1832
1833 while ((ni = TAILQ_FIRST(&nt->nt_node)) != NULL) {
1834 if (ni->ni_associd != 0) {
1835 if (ic->ic_auth->ia_node_leave != NULL)
1836 ic->ic_auth->ia_node_leave(ic, ni);
1837 IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
1838 }
1839 node_reclaim(nt, ni);
1840 }
1841 ieee80211_reset_erp(ic);
1842 }
1843
1844 static void
1845 ieee80211_free_allnodes(struct ieee80211_node_table *nt)
1846 {
1847
1848 IEEE80211_NODE_LOCK(nt);
1849 ieee80211_free_allnodes_locked(nt);
1850 IEEE80211_NODE_UNLOCK(nt);
1851 }
1852
1853 /*
1854 * Timeout entries in the scan cache.
1855 */
1856 static void
1857 ieee80211_timeout_scan_candidates(struct ieee80211_node_table *nt)
1858 {
1859 struct ieee80211com *ic = nt->nt_ic;
1860 struct ieee80211_node *ni, *tni;
1861
1862 IEEE80211_NODE_LOCK(nt);
1863 ni = ic->ic_bss;
1864 /* XXX belongs elsewhere */
1865 if (ni->ni_rxfrag[0] != NULL && ticks > ni->ni_rxfragstamp + hz) {
1866 m_freem(ni->ni_rxfrag[0]);
1867 ni->ni_rxfrag[0] = NULL;
1868 }
1869 TAILQ_FOREACH_SAFE(ni, &nt->nt_node, ni_list, tni) {
1870 if (ni->ni_inact && --ni->ni_inact == 0) {
1871 IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1872 "[%s] scan candidate purged from cache "
1873 "(refcnt %u)\n", ether_sprintf(ni->ni_macaddr),
1874 ieee80211_node_refcnt(ni));
1875 node_reclaim(nt, ni);
1876 }
1877 }
1878 IEEE80211_NODE_UNLOCK(nt);
1879
1880 nt->nt_inact_timer = IEEE80211_INACT_WAIT;
1881 }
1882
1883 /*
1884 * Timeout inactive stations and do related housekeeping.
1885 * Note that we cannot hold the node lock while sending a
1886 * frame as this would lead to a LOR. Instead we use a
1887 * generation number to mark nodes that we've scanned and
1888 * drop the lock and restart a scan if we have to time out
1889 * a node. Since we are single-threaded by virtue of
1890 * controlling the inactivity timer we can be sure this will
1891 * process each node only once.
1892 */
1893 static void
1894 ieee80211_timeout_stations(struct ieee80211_node_table *nt)
1895 {
1896 struct ieee80211com *ic = nt->nt_ic;
1897 struct ieee80211_node *ni;
1898 u_int gen;
1899 int isadhoc;
1900
1901 isadhoc = (ic->ic_opmode == IEEE80211_M_IBSS ||
1902 ic->ic_opmode == IEEE80211_M_AHDEMO);
1903 IEEE80211_SCAN_LOCK(nt);
1904 gen = ++nt->nt_scangen;
1905 IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
1906 "%s: %s scangen %u\n", __func__, nt->nt_name, gen);
1907 restart:
1908 IEEE80211_NODE_LOCK(nt);
1909 TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1910 if (ni->ni_scangen == gen) /* previously handled */
1911 continue;
1912 ni->ni_scangen = gen;
1913 /*
1914 * Ignore entries for which have yet to receive an
1915 * authentication frame. These are transient and
1916 * will be reclaimed when the last reference to them
1917 * goes away (when frame xmits complete).
1918 */
1919 if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1920 (ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1921 continue;
1922 /*
1923 * Free fragment if not needed anymore
1924 * (last fragment older than 1s).
1925 * XXX doesn't belong here
1926 */
1927 if (ni->ni_rxfrag[0] != NULL &&
1928 ticks > ni->ni_rxfragstamp + hz) {
1929 m_freem(ni->ni_rxfrag[0]);
1930 ni->ni_rxfrag[0] = NULL;
1931 }
1932 /*
1933 * Special case ourself; we may be idle for extended periods
1934 * of time and regardless reclaiming our state is wrong.
1935 */
1936 if (ni == ic->ic_bss)
1937 continue;
1938 ni->ni_inact--;
1939 if (ni->ni_associd != 0 || isadhoc) {
1940 /*
1941 * Age frames on the power save queue. The
1942 * aging interval is 4 times the listen
1943 * interval specified by the station. This
1944 * number is factored into the age calculations
1945 * when the frame is placed on the queue. We
1946 * store ages as time differences we can check
1947 * and/or adjust only the head of the list.
1948 */
1949 if (IEEE80211_NODE_SAVEQ_QLEN(ni) != 0) {
1950 struct mbuf *m;
1951 int discard = 0;
1952
1953 IEEE80211_NODE_SAVEQ_LOCK(ni);
1954 while (IF_POLL(&ni->ni_savedq, m) != NULL &&
1955 M_AGE_GET(m) < IEEE80211_INACT_WAIT) {
1956 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, "[%s] discard frame, age %u\n", ether_sprintf(ni->ni_macaddr), M_AGE_GET(m));/*XXX*/
1957 _IEEE80211_NODE_SAVEQ_DEQUEUE_HEAD(ni, m);
1958 m_freem(m);
1959 discard++;
1960 }
1961 if (m != NULL)
1962 M_AGE_SUB(m, IEEE80211_INACT_WAIT);
1963 IEEE80211_NODE_SAVEQ_UNLOCK(ni);
1964
1965 if (discard != 0) {
1966 IEEE80211_DPRINTF(ic,
1967 IEEE80211_MSG_POWER,
1968 "[%s] discard %u frames for age\n",
1969 ether_sprintf(ni->ni_macaddr),
1970 discard);
1971 IEEE80211_NODE_STAT_ADD(ni,
1972 ps_discard, discard);
1973 if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0)
1974 ic->ic_set_tim(ni, 0);
1975 }
1976 }
1977 /*
1978 * Probe the station before time it out. We
1979 * send a null data frame which may not be
1980 * universally supported by drivers (need it
1981 * for ps-poll support so it should be...).
1982 */
1983 if (0 < ni->ni_inact &&
1984 ni->ni_inact <= ic->ic_inact_probe) {
1985 IEEE80211_NOTE(ic,
1986 IEEE80211_MSG_INACT | IEEE80211_MSG_NODE,
1987 ni, "%s",
1988 "probe station due to inactivity");
1989 /*
1990 * Grab a reference before unlocking the table
1991 * so the node cannot be reclaimed before we
1992 * send the frame. ieee80211_send_nulldata
1993 * understands we've done this and reclaims the
1994 * ref for us as needed.
1995 */
1996 ieee80211_ref_node(ni);
1997 IEEE80211_NODE_UNLOCK(nt);
1998 ieee80211_send_nulldata(ni);
1999 /* XXX stat? */
2000 goto restart;
2001 }
2002 }
2003 if (ni->ni_inact <= 0) {
2004 IEEE80211_NOTE(ic,
2005 IEEE80211_MSG_INACT | IEEE80211_MSG_NODE, ni,
2006 "station timed out due to inactivity "
2007 "(refcnt %u)", ieee80211_node_refcnt(ni));
2008 /*
2009 * Send a deauthenticate frame and drop the station.
2010 * This is somewhat complicated due to reference counts
2011 * and locking. At this point a station will typically
2012 * have a reference count of 1. ieee80211_node_leave
2013 * will do a "free" of the node which will drop the
2014 * reference count. But in the meantime a reference
2015 * will be held by the deauth frame. The actual reclaim
2016 * of the node will happen either after the tx is
2017 * completed or by ieee80211_node_leave.
2018 *
2019 * Separately we must drop the node lock before sending
2020 * in case the driver takes a lock, as this will result
2021 * in LOR between the node lock and the driver lock.
2022 */
2023 IEEE80211_NODE_UNLOCK(nt);
2024 if (ni->ni_associd != 0) {
2025 IEEE80211_SEND_MGMT(ic, ni,
2026 IEEE80211_FC0_SUBTYPE_DEAUTH,
2027 IEEE80211_REASON_AUTH_EXPIRE);
2028 }
2029 ieee80211_node_leave(ic, ni);
2030 ic->ic_stats.is_node_timeout++;
2031 goto restart;
2032 }
2033 }
2034 IEEE80211_NODE_UNLOCK(nt);
2035
2036 IEEE80211_SCAN_UNLOCK(nt);
2037
2038 nt->nt_inact_timer = IEEE80211_INACT_WAIT;
2039 }
2040
2041 void
2042 ieee80211_iterate_nodes(struct ieee80211_node_table *nt, ieee80211_iter_func *f, void *arg)
2043 {
2044 struct ieee80211_node *ni;
2045 u_int gen;
2046
2047 IEEE80211_SCAN_LOCK(nt);
2048 gen = ++nt->nt_scangen;
2049 restart:
2050 IEEE80211_NODE_LOCK(nt);
2051 TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
2052 if (ni->ni_scangen != gen) {
2053 ni->ni_scangen = gen;
2054 (void) ieee80211_ref_node(ni);
2055 IEEE80211_NODE_UNLOCK(nt);
2056 (*f)(arg, ni);
2057 ieee80211_free_node(ni);
2058 goto restart;
2059 }
2060 }
2061 IEEE80211_NODE_UNLOCK(nt);
2062
2063 IEEE80211_SCAN_UNLOCK(nt);
2064 }
2065
2066 void
2067 ieee80211_dump_node(struct ieee80211_node_table *nt,
2068 struct ieee80211_node *ni)
2069 {
2070 printf("0x%p: mac %s refcnt %d\n", ni,
2071 ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni));
2072 printf("\tscangen %u authmode %u flags 0x%x\n",
2073 ni->ni_scangen, ni->ni_authmode, ni->ni_flags);
2074 printf("\tassocid 0x%x txpower %u vlan %u\n",
2075 ni->ni_associd, ni->ni_txpower, ni->ni_vlan);
2076 printf("\ttxseq %u rxseq %u fragno %u rxfragstamp %u\n",
2077 ni->ni_txseqs[0],
2078 ni->ni_rxseqs[0] >> IEEE80211_SEQ_SEQ_SHIFT,
2079 ni->ni_rxseqs[0] & IEEE80211_SEQ_FRAG_MASK,
2080 ni->ni_rxfragstamp);
2081 printf("\trstamp %u rssi %u intval %u capinfo 0x%x\n",
2082 ni->ni_rstamp, ni->ni_rssi, ni->ni_intval, ni->ni_capinfo);
2083 printf("\tbssid %s essid \"%.*s\" channel %u:0x%x\n",
2084 ether_sprintf(ni->ni_bssid),
2085 ni->ni_esslen, ni->ni_essid,
2086 ni->ni_chan->ic_freq, ni->ni_chan->ic_flags);
2087 printf("\tfails %u inact %u txrate %u\n",
2088 ni->ni_fails, ni->ni_inact, ni->ni_txrate);
2089 }
2090
2091 void
2092 ieee80211_dump_nodes(struct ieee80211_node_table *nt)
2093 {
2094 ieee80211_iterate_nodes(nt,
2095 (ieee80211_iter_func *) ieee80211_dump_node, nt);
2096 }
2097
2098 /*
2099 * Handle a station joining an 11g network.
2100 */
2101 static void
2102 ieee80211_node_join_11g(struct ieee80211com *ic, struct ieee80211_node *ni)
2103 {
2104
2105 /*
2106 * Station isn't capable of short slot time. Bump
2107 * the count of long slot time stations and disable
2108 * use of short slot time. Note that the actual switch
2109 * over to long slot time use may not occur until the
2110 * next beacon transmission (per sec. 7.3.1.4 of 11g).
2111 */
2112 if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) {
2113 ic->ic_longslotsta++;
2114 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2115 "[%s] station needs long slot time, count %d\n",
2116 ether_sprintf(ni->ni_macaddr), ic->ic_longslotsta);
2117 /* XXX vap's w/ conflicting needs won't work */
2118 ieee80211_set_shortslottime(ic, 0);
2119 }
2120 /*
2121 * If the new station is not an ERP station
2122 * then bump the counter and enable protection
2123 * if configured.
2124 */
2125 if (!ieee80211_iserp_rateset(ic, &ni->ni_rates)) {
2126 ic->ic_nonerpsta++;
2127 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2128 "[%s] station is !ERP, %d non-ERP stations associated\n",
2129 ether_sprintf(ni->ni_macaddr), ic->ic_nonerpsta);
2130 /*
2131 * If protection is configured, enable it.
2132 */
2133 if (ic->ic_protmode != IEEE80211_PROT_NONE) {
2134 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2135 "%s: enable use of protection\n", __func__);
2136 ic->ic_flags |= IEEE80211_F_USEPROT;
2137 }
2138 /*
2139 * If station does not support short preamble
2140 * then we must enable use of Barker preamble.
2141 */
2142 if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) == 0) {
2143 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2144 "[%s] station needs long preamble\n",
2145 ether_sprintf(ni->ni_macaddr));
2146 ic->ic_flags |= IEEE80211_F_USEBARKER;
2147 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
2148 }
2149 } else
2150 ni->ni_flags |= IEEE80211_NODE_ERP;
2151 }
2152
2153 void
2154 ieee80211_node_join(struct ieee80211com *ic, struct ieee80211_node *ni, int resp)
2155 {
2156 int newassoc;
2157
2158 if (ni->ni_associd == 0) {
2159 u_int16_t aid;
2160
2161 /*
2162 * It would be good to search the bitmap
2163 * more efficiently, but this will do for now.
2164 */
2165 for (aid = 1; aid < ic->ic_max_aid; aid++) {
2166 if (!IEEE80211_AID_ISSET(aid,
2167 ic->ic_aid_bitmap))
2168 break;
2169 }
2170 if (aid >= ic->ic_max_aid) {
2171 IEEE80211_SEND_MGMT(ic, ni, resp,
2172 IEEE80211_REASON_ASSOC_TOOMANY);
2173 ieee80211_node_leave(ic, ni);
2174 return;
2175 }
2176 ni->ni_associd = aid | 0xc000;
2177 IEEE80211_AID_SET(ni->ni_associd, ic->ic_aid_bitmap);
2178 ic->ic_sta_assoc++;
2179 newassoc = 1;
2180 if (ic->ic_curmode == IEEE80211_MODE_11G)
2181 ieee80211_node_join_11g(ic, ni);
2182 } else
2183 newassoc = 0;
2184
2185 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG,
2186 "[%s] station %sassociated at aid %d: %s preamble, %s slot time%s%s\n",
2187 ether_sprintf(ni->ni_macaddr), newassoc ? "" : "re",
2188 IEEE80211_NODE_AID(ni),
2189 ic->ic_flags & IEEE80211_F_SHPREAMBLE ? "short" : "long",
2190 ic->ic_flags & IEEE80211_F_SHSLOT ? "short" : "long",
2191 ic->ic_flags & IEEE80211_F_USEPROT ? ", protection" : "",
2192 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : ""
2193 );
2194
2195 /* give driver a chance to setup state like ni_txrate */
2196 if (ic->ic_newassoc != NULL)
2197 ic->ic_newassoc(ni, newassoc);
2198 ni->ni_inact_reload = ic->ic_inact_auth;
2199 ni->ni_inact = ni->ni_inact_reload;
2200 IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_SUCCESS);
2201 /* tell the authenticator about new station */
2202 if (ic->ic_auth->ia_node_join != NULL)
2203 ic->ic_auth->ia_node_join(ic, ni);
2204 ieee80211_notify_node_join(ic, ni, newassoc);
2205 }
2206
2207 /*
2208 * Handle a station leaving an 11g network.
2209 */
2210 static void
2211 ieee80211_node_leave_11g(struct ieee80211com *ic, struct ieee80211_node *ni)
2212 {
2213
2214 IASSERT(ic->ic_curmode == IEEE80211_MODE_11G,
2215 ("not in 11g, bss %u:0x%x, curmode %u", ni->ni_chan->ic_freq,
2216 ni->ni_chan->ic_flags, ic->ic_curmode));
2217
2218 /*
2219 * If a long slot station do the slot time bookkeeping.
2220 */
2221 if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) == 0) {
2222 IASSERT(ic->ic_longslotsta > 0,
2223 ("bogus long slot station count %d", ic->ic_longslotsta));
2224 ic->ic_longslotsta--;
2225 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2226 "[%s] long slot time station leaves, count now %d\n",
2227 ether_sprintf(ni->ni_macaddr), ic->ic_longslotsta);
2228 if (ic->ic_longslotsta == 0) {
2229 /*
2230 * Re-enable use of short slot time if supported
2231 * and not operating in IBSS mode (per spec).
2232 */
2233 if ((ic->ic_caps & IEEE80211_C_SHSLOT) &&
2234 ic->ic_opmode != IEEE80211_M_IBSS) {
2235 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2236 "%s: re-enable use of short slot time\n",
2237 __func__);
2238 ieee80211_set_shortslottime(ic, 1);
2239 }
2240 }
2241 }
2242 /*
2243 * If a non-ERP station do the protection-related bookkeeping.
2244 */
2245 if ((ni->ni_flags & IEEE80211_NODE_ERP) == 0) {
2246 IASSERT(ic->ic_nonerpsta > 0,
2247 ("bogus non-ERP station count %d", ic->ic_nonerpsta));
2248 ic->ic_nonerpsta--;
2249 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2250 "[%s] non-ERP station leaves, count now %d\n",
2251 ether_sprintf(ni->ni_macaddr), ic->ic_nonerpsta);
2252 if (ic->ic_nonerpsta == 0) {
2253 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2254 "%s: disable use of protection\n", __func__);
2255 ic->ic_flags &= ~IEEE80211_F_USEPROT;
2256 /* XXX verify mode? */
2257 if (ic->ic_caps & IEEE80211_C_SHPREAMBLE) {
2258 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2259 "%s: re-enable use of short preamble\n",
2260 __func__);
2261 ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
2262 ic->ic_flags &= ~IEEE80211_F_USEBARKER;
2263 }
2264 }
2265 }
2266 }
2267
2268 /*
2269 * Handle bookkeeping for station deauthentication/disassociation
2270 * when operating as an ap.
2271 */
2272 void
2273 ieee80211_node_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
2274 {
2275 struct ieee80211_node_table *nt = ni->ni_table;
2276
2277 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG,
2278 "[%s] station with aid %d leaves\n",
2279 ether_sprintf(ni->ni_macaddr), IEEE80211_NODE_AID(ni));
2280
2281 IASSERT(ic->ic_opmode == IEEE80211_M_HOSTAP ||
2282 ic->ic_opmode == IEEE80211_M_IBSS ||
2283 ic->ic_opmode == IEEE80211_M_AHDEMO,
2284 ("unexpected operating mode %u", ic->ic_opmode));
2285 /*
2286 * If node wasn't previously associated all
2287 * we need to do is reclaim the reference.
2288 */
2289 /* XXX ibss mode bypasses 11g and notification */
2290 if (ni->ni_associd == 0)
2291 goto done;
2292 /*
2293 * Tell the authenticator the station is leaving.
2294 * Note that we must do this before yanking the
2295 * association id as the authenticator uses the
2296 * associd to locate it's state block.
2297 */
2298 if (ic->ic_auth->ia_node_leave != NULL)
2299 ic->ic_auth->ia_node_leave(ic, ni);
2300 IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
2301 ni->ni_associd = 0;
2302 ic->ic_sta_assoc--;
2303
2304 if (ic->ic_curmode == IEEE80211_MODE_11G)
2305 ieee80211_node_leave_11g(ic, ni);
2306 /*
2307 * Cleanup station state. In particular clear various
2308 * state that might otherwise be reused if the node
2309 * is reused before the reference count goes to zero
2310 * (and memory is reclaimed).
2311 */
2312 ieee80211_sta_leave(ic, ni);
2313 done:
2314 /*
2315 * Remove the node from any table it's recorded in and
2316 * drop the caller's reference. Removal from the table
2317 * is important to insure the node is not reprocessed
2318 * for inactivity.
2319 */
2320 if (nt != NULL) {
2321 IEEE80211_NODE_LOCK(nt);
2322 node_reclaim(nt, ni);
2323 IEEE80211_NODE_UNLOCK(nt);
2324 } else
2325 ieee80211_free_node(ni);
2326 }
2327
2328 u_int8_t
2329 ieee80211_getrssi(struct ieee80211com *ic)
2330 {
2331 #define NZ(x) ((x) == 0 ? 1 : (x))
2332 struct ieee80211_node_table *nt = &ic->ic_sta;
2333 u_int32_t rssi_samples, rssi_total;
2334 struct ieee80211_node *ni;
2335
2336 rssi_total = 0;
2337 rssi_samples = 0;
2338 switch (ic->ic_opmode) {
2339 case IEEE80211_M_IBSS: /* average of all ibss neighbors */
2340 /* XXX locking */
2341 TAILQ_FOREACH(ni, &nt->nt_node, ni_list)
2342 if (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) {
2343 rssi_samples++;
2344 rssi_total += ic->ic_node_getrssi(ni);
2345 }
2346 break;
2347 case IEEE80211_M_AHDEMO: /* average of all neighbors */
2348 /* XXX locking */
2349 TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
2350 rssi_samples++;
2351 rssi_total += ic->ic_node_getrssi(ni);
2352 }
2353 break;
2354 case IEEE80211_M_HOSTAP: /* average of all associated stations */
2355 #ifndef IEEE80211_NO_HOSTAP
2356 /* XXX locking */
2357 TAILQ_FOREACH(ni, &nt->nt_node, ni_list)
2358 if (IEEE80211_AID(ni->ni_associd) != 0) {
2359 rssi_samples++;
2360 rssi_total += ic->ic_node_getrssi(ni);
2361 }
2362 #endif /* !IEEE80211_NO_HOSTAP */
2363 break;
2364 case IEEE80211_M_MONITOR: /* XXX */
2365 case IEEE80211_M_STA: /* use stats from associated ap */
2366 default:
2367 if (ic->ic_bss != NULL)
2368 rssi_total = ic->ic_node_getrssi(ic->ic_bss);
2369 rssi_samples = 1;
2370 break;
2371 }
2372 return rssi_total / NZ(rssi_samples);
2373 #undef NZ
2374 }
2375
2376 /*
2377 * Indicate whether there are frames queued for a station in power-save mode.
2378 */
2379 static void
2380 ieee80211_set_tim(struct ieee80211_node *ni, int set)
2381 {
2382 struct ieee80211com *ic = ni->ni_ic;
2383 u_int16_t aid;
2384
2385 IASSERT(ic->ic_opmode == IEEE80211_M_HOSTAP ||
2386 ic->ic_opmode == IEEE80211_M_IBSS,
2387 ("operating mode %u", ic->ic_opmode));
2388
2389 aid = IEEE80211_AID(ni->ni_associd);
2390 IASSERT(aid < ic->ic_max_aid,
2391 ("bogus aid %u, max %u", aid, ic->ic_max_aid));
2392
2393 IEEE80211_BEACON_LOCK(ic);
2394 if (set != (isset(ic->ic_tim_bitmap, aid) != 0)) {
2395 if (set) {
2396 setbit(ic->ic_tim_bitmap, aid);
2397 ic->ic_ps_pending++;
2398 } else {
2399 clrbit(ic->ic_tim_bitmap, aid);
2400 ic->ic_ps_pending--;
2401 }
2402 ic->ic_flags |= IEEE80211_F_TIMUPDATE;
2403 }
2404 IEEE80211_BEACON_UNLOCK(ic);
2405 }
2406
2407 /*
2408 * Node table support.
2409 */
2410
2411 static void
2412 ieee80211_node_table_init(struct ieee80211com *ic,
2413 struct ieee80211_node_table *nt,
2414 const char *name, int inact, int keyixmax,
2415 void (*timeout)(struct ieee80211_node_table *))
2416 {
2417
2418 IEEE80211_DPRINTF(ic, IEEE80211_MSG_NODE,
2419 "%s %s table, inact %u\n", __func__, name, inact);
2420
2421 nt->nt_ic = ic;
2422 /* XXX need unit */
2423 IEEE80211_NODE_LOCK_INIT(nt, ic->ic_ifp->if_xname);
2424 IEEE80211_SCAN_LOCK_INIT(nt, ic->ic_ifp->if_xname);
2425 TAILQ_INIT(&nt->nt_node);
2426 nt->nt_name = name;
2427 nt->nt_scangen = 1;
2428 nt->nt_inact_init = inact;
2429 nt->nt_timeout = timeout;
2430 nt->nt_keyixmax = keyixmax;
2431 if (nt->nt_keyixmax > 0) {
2432 nt->nt_keyixmap = malloc(keyixmax *
2433 sizeof(struct ieee80211_node *), M_80211_NODE,
2434 M_NOWAIT | M_ZERO);
2435 if (nt->nt_keyixmap == NULL)
2436 if_printf(ic->ic_ifp,
2437 "Cannot allocate key index map with %u entries\n",
2438 keyixmax);
2439 } else
2440 nt->nt_keyixmap = NULL;
2441 }
2442
2443 void
2444 ieee80211_node_table_reset(struct ieee80211_node_table *nt)
2445 {
2446
2447 IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
2448 "%s %s table\n", __func__, nt->nt_name);
2449
2450 IEEE80211_NODE_LOCK(nt);
2451 nt->nt_inact_timer = 0;
2452 ieee80211_free_allnodes_locked(nt);
2453 IEEE80211_NODE_UNLOCK(nt);
2454 }
2455
2456 static void
2457 ieee80211_node_table_cleanup(struct ieee80211_node_table *nt)
2458 {
2459
2460 IEEE80211_DPRINTF(nt->nt_ic, IEEE80211_MSG_NODE,
2461 "%s %s table\n", __func__, nt->nt_name);
2462
2463 IEEE80211_NODE_LOCK(nt);
2464 ieee80211_free_allnodes_locked(nt);
2465 if (nt->nt_keyixmap != NULL) {
2466 /* XXX verify all entries are NULL */
2467 int i;
2468 for (i = 0; i < nt->nt_keyixmax; i++)
2469 if (nt->nt_keyixmap[i] != NULL)
2470 printf("%s: %s[%u] still active\n", __func__,
2471 nt->nt_name, i);
2472 FREE(nt->nt_keyixmap, M_80211_NODE);
2473 nt->nt_keyixmap = NULL;
2474 }
2475 IEEE80211_SCAN_LOCK_DESTROY(nt);
2476 IEEE80211_NODE_LOCK_DESTROY(nt);
2477 }
Cache object: 4c8c9c34f51357833a6618926af3b7d4
|