1 /*-
2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
16 *
17 * Alternatively, this software may be distributed under the terms of the
18 * GNU General Public License ("GPL") version 2 as published by the Free
19 * Software Foundation.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD: releng/5.2/sys/net80211/ieee80211_output.c 121180 2003-10-17 23:15:30Z sam $");
35
36 #include "opt_inet.h"
37
38 #include <sys/param.h>
39 #include <sys/systm.h>
40 #include <sys/mbuf.h>
41 #include <sys/malloc.h>
42 #include <sys/kernel.h>
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
47 #include <sys/bus.h>
48 #include <sys/proc.h>
49 #include <sys/sysctl.h>
50
51 #include <machine/atomic.h>
52
53 #include <net/if.h>
54 #include <net/if_dl.h>
55 #include <net/if_media.h>
56 #include <net/if_arp.h>
57 #include <net/ethernet.h>
58 #include <net/if_llc.h>
59
60 #include <net80211/ieee80211_var.h>
61
62 #include <net/bpf.h>
63
64 #ifdef INET
65 #include <netinet/in.h>
66 #include <netinet/if_ether.h>
67 #endif
68
69 /*
70 * Send a management frame to the specified node. The node pointer
71 * must have a reference as the pointer will be passed to the driver
72 * and potentially held for a long time. If the frame is successfully
73 * dispatched to the driver, then it is responsible for freeing the
74 * reference (and potentially free'ing up any associated storage).
75 */
76 static int
77 ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni,
78 struct mbuf *m, int type)
79 {
80 struct ieee80211com *ic = (void *)ifp;
81 struct ieee80211_frame *wh;
82
83 KASSERT(ni != NULL, ("null node"));
84 ni->ni_inact = 0;
85
86 /*
87 * Yech, hack alert! We want to pass the node down to the
88 * driver's start routine. If we don't do so then the start
89 * routine must immediately look it up again and that can
90 * cause a lock order reversal if, for example, this frame
91 * is being sent because the station is being timedout and
92 * the frame being sent is a DEAUTH message. We could stick
93 * this in an m_tag and tack that on to the mbuf. However
94 * that's rather expensive to do for every frame so instead
95 * we stuff it in the rcvif field since outbound frames do
96 * not (presently) use this.
97 */
98 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
99 if (m == NULL)
100 return ENOMEM;
101 KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null"));
102 m->m_pkthdr.rcvif = (void *)ni;
103
104 wh = mtod(m, struct ieee80211_frame *);
105 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
106 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
107 *(u_int16_t *)wh->i_dur = 0;
108 *(u_int16_t *)wh->i_seq =
109 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
110 ni->ni_txseq++;
111 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
112 IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
113 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
114
115 if (ifp->if_flags & IFF_DEBUG) {
116 /* avoid to print too many frames */
117 if (ic->ic_opmode == IEEE80211_M_IBSS ||
118 #ifdef IEEE80211_DEBUG
119 ieee80211_debug > 1 ||
120 #endif
121 (type & IEEE80211_FC0_SUBTYPE_MASK) !=
122 IEEE80211_FC0_SUBTYPE_PROBE_RESP)
123 if_printf(ifp, "sending %s to %s on channel %u\n",
124 ieee80211_mgt_subtype_name[
125 (type & IEEE80211_FC0_SUBTYPE_MASK)
126 >> IEEE80211_FC0_SUBTYPE_SHIFT],
127 ether_sprintf(ni->ni_macaddr),
128 ieee80211_chan2ieee(ic, ni->ni_chan));
129 }
130
131 IF_ENQUEUE(&ic->ic_mgtq, m);
132 ifp->if_timer = 1;
133 (*ifp->if_start)(ifp);
134 return 0;
135 }
136
137 /*
138 * Encapsulate an outbound data frame. The mbuf chain is updated and
139 * a reference to the destination node is returned. If an error is
140 * encountered NULL is returned and the node reference will also be NULL.
141 *
142 * NB: The caller is responsible for free'ing a returned node reference.
143 * The convention is ic_bss is not reference counted; the caller must
144 * maintain that.
145 */
146 struct mbuf *
147 ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni)
148 {
149 struct ieee80211com *ic = (void *)ifp;
150 struct ether_header eh;
151 struct ieee80211_frame *wh;
152 struct ieee80211_node *ni = NULL;
153 struct llc *llc;
154
155 if (m->m_len < sizeof(struct ether_header)) {
156 m = m_pullup(m, sizeof(struct ether_header));
157 if (m == NULL) {
158 ic->ic_stats.is_tx_nombuf++;
159 goto bad;
160 }
161 }
162 memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
163
164 if (ic->ic_opmode != IEEE80211_M_STA) {
165 ni = ieee80211_find_node(ic, eh.ether_dhost);
166 if (ni == NULL) {
167 /*
168 * When not in station mode the destination
169 * address should always be in the node table
170 * if the device sends management frames to us;
171 * unless this is a multicast/broadcast frame.
172 * For devices that don't send management frames
173 * to the host we have to cheat; use the bss
174 * node instead; the card will/should clobber
175 * the bssid address as necessary.
176 *
177 * XXX this handles AHDEMO because all devices
178 * that support it don't send mgmt frames;
179 * but it might be better to test explicitly
180 */
181 if (!IEEE80211_IS_MULTICAST(eh.ether_dhost) &&
182 (ic->ic_caps & IEEE80211_C_RCVMGT)) {
183 IEEE80211_DPRINTF(("%s: no node for dst %s, "
184 "discard frame\n", __func__,
185 ether_sprintf(eh.ether_dhost)));
186 ic->ic_stats.is_tx_nonode++;
187 goto bad;
188 }
189 ni = ic->ic_bss;
190 }
191 } else
192 ni = ic->ic_bss;
193 ni->ni_inact = 0;
194
195 m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
196 llc = mtod(m, struct llc *);
197 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
198 llc->llc_control = LLC_UI;
199 llc->llc_snap.org_code[0] = 0;
200 llc->llc_snap.org_code[1] = 0;
201 llc->llc_snap.org_code[2] = 0;
202 llc->llc_snap.ether_type = eh.ether_type;
203 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
204 if (m == NULL) {
205 ic->ic_stats.is_tx_nombuf++;
206 goto bad;
207 }
208 wh = mtod(m, struct ieee80211_frame *);
209 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
210 *(u_int16_t *)wh->i_dur = 0;
211 *(u_int16_t *)wh->i_seq =
212 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
213 ni->ni_txseq++;
214 switch (ic->ic_opmode) {
215 case IEEE80211_M_STA:
216 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
217 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
218 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
219 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
220 break;
221 case IEEE80211_M_IBSS:
222 case IEEE80211_M_AHDEMO:
223 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
224 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
225 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
226 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
227 break;
228 case IEEE80211_M_HOSTAP:
229 wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
230 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
231 IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
232 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
233 break;
234 case IEEE80211_M_MONITOR:
235 goto bad;
236 }
237 *pni = ni;
238 return m;
239 bad:
240 if (m != NULL)
241 m_freem(m);
242 if (ni && ni != ic->ic_bss)
243 ieee80211_free_node(ic, ni);
244 *pni = NULL;
245 return NULL;
246 }
247
248 /*
249 * Add a supported rates element id to a frame.
250 */
251 u_int8_t *
252 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs)
253 {
254 int nrates;
255
256 *frm++ = IEEE80211_ELEMID_RATES;
257 nrates = rs->rs_nrates;
258 if (nrates > IEEE80211_RATE_SIZE)
259 nrates = IEEE80211_RATE_SIZE;
260 *frm++ = nrates;
261 memcpy(frm, rs->rs_rates, nrates);
262 return frm + nrates;
263 }
264
265 /*
266 * Add an extended supported rates element id to a frame.
267 */
268 u_int8_t *
269 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs)
270 {
271 /*
272 * Add an extended supported rates element if operating in 11g mode.
273 */
274 if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
275 int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
276 *frm++ = IEEE80211_ELEMID_XRATES;
277 *frm++ = nrates;
278 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
279 frm += nrates;
280 }
281 return frm;
282 }
283
284 /*
285 * Add an ssid elemet to a frame.
286 */
287 static u_int8_t *
288 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len)
289 {
290 *frm++ = IEEE80211_ELEMID_SSID;
291 *frm++ = len;
292 memcpy(frm, ssid, len);
293 return frm + len;
294 }
295
296 static struct mbuf *
297 ieee80211_getmbuf(int flags, int type, u_int pktlen)
298 {
299 struct mbuf *m;
300
301 KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
302 if (pktlen <= MHLEN)
303 MGETHDR(m, flags, type);
304 else
305 m = m_getcl(flags, type, M_PKTHDR);
306 return m;
307 }
308
309 /*
310 * Send a management frame. The node is for the destination (or ic_bss
311 * when in station mode). Nodes other than ic_bss have their reference
312 * count bumped to reflect our use for an indeterminant time.
313 */
314 int
315 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
316 int type, int arg)
317 {
318 #define senderr(_x, _v) do { ic->ic_stats._v++; ret = _x; goto bad; } while (0)
319 struct ifnet *ifp = &ic->ic_if;
320 struct mbuf *m;
321 u_int8_t *frm;
322 enum ieee80211_phymode mode;
323 u_int16_t capinfo;
324 int ret, timer;
325
326 KASSERT(ni != NULL, ("null node"));
327
328 /*
329 * Hold a reference on the node so it doesn't go away until after
330 * the xmit is complete all the way in the driver. On error we
331 * will remove our reference.
332 */
333 if (ni != ic->ic_bss)
334 ieee80211_ref_node(ni);
335 timer = 0;
336 switch (type) {
337 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
338 /*
339 * prreq frame format
340 * [tlv] ssid
341 * [tlv] supported rates
342 * [tlv] extended supported rates
343 */
344 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
345 2 + ic->ic_des_esslen
346 + 2 + IEEE80211_RATE_SIZE
347 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
348 if (m == NULL)
349 senderr(ENOMEM, is_tx_nombuf);
350 m->m_data += sizeof(struct ieee80211_frame);
351 frm = mtod(m, u_int8_t *);
352 frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen);
353 mode = ieee80211_chan2mode(ic, ni->ni_chan);
354 frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]);
355 frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]);
356 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
357
358 timer = IEEE80211_TRANS_WAIT;
359 break;
360
361 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
362 /*
363 * probe response frame format
364 * [8] time stamp
365 * [2] beacon interval
366 * [2] cabability information
367 * [tlv] ssid
368 * [tlv] supported rates
369 * [tlv] parameter set (FH/DS)
370 * [tlv] parameter set (IBSS)
371 * [tlv] extended supported rates
372 */
373 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
374 8 + 2 + 2 + 2
375 + 2 + ni->ni_esslen
376 + 2 + IEEE80211_RATE_SIZE
377 + (ic->ic_phytype == IEEE80211_T_FH ? 7 : 3)
378 + 6
379 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
380 if (m == NULL)
381 senderr(ENOMEM, is_tx_nombuf);
382 m->m_data += sizeof(struct ieee80211_frame);
383 frm = mtod(m, u_int8_t *);
384
385 memset(frm, 0, 8); /* timestamp should be filled later */
386 frm += 8;
387 *(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval);
388 frm += 2;
389 if (ic->ic_opmode == IEEE80211_M_IBSS)
390 capinfo = IEEE80211_CAPINFO_IBSS;
391 else
392 capinfo = IEEE80211_CAPINFO_ESS;
393 if (ic->ic_flags & IEEE80211_F_WEPON)
394 capinfo |= IEEE80211_CAPINFO_PRIVACY;
395 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
396 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
397 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
398 *(u_int16_t *)frm = htole16(capinfo);
399 frm += 2;
400
401 frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
402 ic->ic_bss->ni_esslen);
403 frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates);
404
405 if (ic->ic_phytype == IEEE80211_T_FH) {
406 *frm++ = IEEE80211_ELEMID_FHPARMS;
407 *frm++ = 5;
408 *frm++ = ni->ni_fhdwell & 0x00ff;
409 *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff;
410 *frm++ = IEEE80211_FH_CHANSET(
411 ieee80211_chan2ieee(ic, ni->ni_chan));
412 *frm++ = IEEE80211_FH_CHANPAT(
413 ieee80211_chan2ieee(ic, ni->ni_chan));
414 *frm++ = ni->ni_fhindex;
415 } else {
416 *frm++ = IEEE80211_ELEMID_DSPARMS;
417 *frm++ = 1;
418 *frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
419 }
420
421 if (ic->ic_opmode == IEEE80211_M_IBSS) {
422 *frm++ = IEEE80211_ELEMID_IBSSPARMS;
423 *frm++ = 2;
424 *frm++ = 0; *frm++ = 0; /* TODO: ATIM window */
425 } else { /* IEEE80211_M_HOSTAP */
426 /* TODO: TIM */
427 *frm++ = IEEE80211_ELEMID_TIM;
428 *frm++ = 4; /* length */
429 *frm++ = 0; /* DTIM count */
430 *frm++ = 1; /* DTIM period */
431 *frm++ = 0; /* bitmap control */
432 *frm++ = 0; /* Partial Virtual Bitmap (variable length) */
433 }
434 frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates);
435 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
436 break;
437
438 case IEEE80211_FC0_SUBTYPE_AUTH:
439 MGETHDR(m, M_DONTWAIT, MT_DATA);
440 if (m == NULL)
441 senderr(ENOMEM, is_tx_nombuf);
442 MH_ALIGN(m, 2 * 3);
443 m->m_pkthdr.len = m->m_len = 6;
444 frm = mtod(m, u_int8_t *);
445 /* TODO: shared key auth */
446 ((u_int16_t *)frm)[0] = htole16(IEEE80211_AUTH_ALG_OPEN);
447 ((u_int16_t *)frm)[1] = htole16(arg); /* sequence number */
448 ((u_int16_t *)frm)[2] = 0; /* status */
449 if (ic->ic_opmode == IEEE80211_M_STA)
450 timer = IEEE80211_TRANS_WAIT;
451 break;
452
453 case IEEE80211_FC0_SUBTYPE_DEAUTH:
454 if (ifp->if_flags & IFF_DEBUG)
455 if_printf(ifp, "station %s deauthenticate (reason %d)\n",
456 ether_sprintf(ni->ni_macaddr), arg);
457 MGETHDR(m, M_DONTWAIT, MT_DATA);
458 if (m == NULL)
459 senderr(ENOMEM, is_tx_nombuf);
460 MH_ALIGN(m, 2);
461 m->m_pkthdr.len = m->m_len = 2;
462 *mtod(m, u_int16_t *) = htole16(arg); /* reason */
463 break;
464
465 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
466 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
467 /*
468 * asreq frame format
469 * [2] capability information
470 * [2] listen interval
471 * [6*] current AP address (reassoc only)
472 * [tlv] ssid
473 * [tlv] supported rates
474 * [tlv] extended supported rates
475 */
476 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
477 sizeof(capinfo)
478 + sizeof(u_int16_t)
479 + IEEE80211_ADDR_LEN
480 + 2 + ni->ni_esslen
481 + 2 + IEEE80211_RATE_SIZE
482 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
483 if (m == NULL)
484 senderr(ENOMEM, is_tx_nombuf);
485 m->m_data += sizeof(struct ieee80211_frame);
486 frm = mtod(m, u_int8_t *);
487
488 capinfo = 0;
489 if (ic->ic_opmode == IEEE80211_M_IBSS)
490 capinfo |= IEEE80211_CAPINFO_IBSS;
491 else /* IEEE80211_M_STA */
492 capinfo |= IEEE80211_CAPINFO_ESS;
493 if (ic->ic_flags & IEEE80211_F_WEPON)
494 capinfo |= IEEE80211_CAPINFO_PRIVACY;
495 /*
496 * NB: Some 11a AP's reject the request when
497 * short premable is set.
498 */
499 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
500 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
501 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
502 if (ic->ic_flags & IEEE80211_F_SHSLOT)
503 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
504 *(u_int16_t *)frm = htole16(capinfo);
505 frm += 2;
506
507 *(u_int16_t *)frm = htole16(ic->ic_lintval);
508 frm += 2;
509
510 if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
511 IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
512 frm += IEEE80211_ADDR_LEN;
513 }
514
515 frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
516 frm = ieee80211_add_rates(frm, &ni->ni_rates);
517 frm = ieee80211_add_xrates(frm, &ni->ni_rates);
518 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
519
520 timer = IEEE80211_TRANS_WAIT;
521 break;
522
523 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
524 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
525 /*
526 * asreq frame format
527 * [2] capability information
528 * [2] status
529 * [2] association ID
530 * [tlv] supported rates
531 * [tlv] extended supported rates
532 */
533 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
534 sizeof(capinfo)
535 + sizeof(u_int16_t)
536 + sizeof(u_int16_t)
537 + 2 + IEEE80211_RATE_SIZE
538 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
539 if (m == NULL)
540 senderr(ENOMEM, is_tx_nombuf);
541 m->m_data += sizeof(struct ieee80211_frame);
542 frm = mtod(m, u_int8_t *);
543
544 capinfo = IEEE80211_CAPINFO_ESS;
545 if (ic->ic_flags & IEEE80211_F_WEPON)
546 capinfo |= IEEE80211_CAPINFO_PRIVACY;
547 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
548 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
549 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
550 *(u_int16_t *)frm = htole16(capinfo);
551 frm += 2;
552
553 *(u_int16_t *)frm = htole16(arg); /* status */
554 frm += 2;
555
556 if (arg == IEEE80211_STATUS_SUCCESS)
557 *(u_int16_t *)frm = htole16(ni->ni_associd);
558 frm += 2;
559
560 frm = ieee80211_add_rates(frm, &ni->ni_rates);
561 frm = ieee80211_add_xrates(frm, &ni->ni_rates);
562 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
563 break;
564
565 case IEEE80211_FC0_SUBTYPE_DISASSOC:
566 if (ifp->if_flags & IFF_DEBUG)
567 if_printf(ifp, "station %s disassociate (reason %d)\n",
568 ether_sprintf(ni->ni_macaddr), arg);
569 MGETHDR(m, M_DONTWAIT, MT_DATA);
570 if (m == NULL)
571 senderr(ENOMEM, is_tx_nombuf);
572 MH_ALIGN(m, 2);
573 m->m_pkthdr.len = m->m_len = 2;
574 *mtod(m, u_int16_t *) = htole16(arg); /* reason */
575 break;
576
577 default:
578 IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n",
579 __func__, type));
580 senderr(EINVAL, is_tx_unknownmgt);
581 /* NOTREACHED */
582 }
583
584 ret = ieee80211_mgmt_output(ifp, ni, m, type);
585 if (ret == 0) {
586 if (timer)
587 ic->ic_mgt_timer = timer;
588 } else {
589 bad:
590 if (ni != ic->ic_bss) /* remove ref we added */
591 ieee80211_free_node(ic, ni);
592 }
593 return ret;
594 #undef senderr
595 }
Cache object: a02607bc062258469032ee990d340438
|