The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/net80211/ieee80211_sta.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*-
    2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
    3  * All rights reserved.
    4  *
    5  * Redistribution and use in source and binary forms, with or without
    6  * modification, are permitted provided that the following conditions
    7  * are met:
    8  * 1. Redistributions of source code must retain the above copyright
    9  *    notice, this list of conditions and the following disclaimer.
   10  * 2. Redistributions in binary form must reproduce the above copyright
   11  *    notice, this list of conditions and the following disclaimer in the
   12  *    documentation and/or other materials provided with the distribution.
   13  *
   14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
   15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
   16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
   17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
   18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
   19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
   20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
   21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
   22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
   23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   24  */
   25 
   26 #include <sys/cdefs.h>
   27 #ifdef __FreeBSD__
   28 __FBSDID("$FreeBSD: releng/10.4/sys/net80211/ieee80211_sta.c 262007 2014-02-17 01:36:53Z kevlo $");
   29 #endif
   30 
   31 /*
   32  * IEEE 802.11 Station mode support.
   33  */
   34 #include "opt_inet.h"
   35 #include "opt_wlan.h"
   36 
   37 #include <sys/param.h>
   38 #include <sys/systm.h> 
   39 #include <sys/mbuf.h>   
   40 #include <sys/malloc.h>
   41 #include <sys/kernel.h>
   42 
   43 #include <sys/socket.h>
   44 #include <sys/sockio.h>
   45 #include <sys/endian.h>
   46 #include <sys/errno.h>
   47 #include <sys/proc.h>
   48 #include <sys/sysctl.h>
   49 
   50 #include <net/if.h>
   51 #include <net/if_media.h>
   52 #include <net/if_llc.h>
   53 #include <net/if_dl.h>
   54 #include <net/if_var.h>
   55 #include <net/ethernet.h>
   56 
   57 #include <net/bpf.h>
   58 
   59 #include <net80211/ieee80211_var.h>
   60 #include <net80211/ieee80211_sta.h>
   61 #include <net80211/ieee80211_input.h>
   62 #ifdef IEEE80211_SUPPORT_SUPERG
   63 #include <net80211/ieee80211_superg.h>
   64 #endif
   65 #include <net80211/ieee80211_ratectl.h>
   66 #include <net80211/ieee80211_sta.h>
   67 
   68 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
   69 
   70 static  void sta_vattach(struct ieee80211vap *);
   71 static  void sta_beacon_miss(struct ieee80211vap *);
   72 static  int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
   73 static  int sta_input(struct ieee80211_node *, struct mbuf *, int, int);
   74 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
   75             int subtype, int rssi, int nf);
   76 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
   77 
   78 void
   79 ieee80211_sta_attach(struct ieee80211com *ic)
   80 {
   81         ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
   82 }
   83 
   84 void
   85 ieee80211_sta_detach(struct ieee80211com *ic)
   86 {
   87 }
   88 
   89 static void
   90 sta_vdetach(struct ieee80211vap *vap)
   91 {
   92 }
   93 
   94 static void
   95 sta_vattach(struct ieee80211vap *vap)
   96 {
   97         vap->iv_newstate = sta_newstate;
   98         vap->iv_input = sta_input;
   99         vap->iv_recv_mgmt = sta_recv_mgmt;
  100         vap->iv_recv_ctl = sta_recv_ctl;
  101         vap->iv_opdetach = sta_vdetach;
  102         vap->iv_bmiss = sta_beacon_miss;
  103 }
  104 
  105 /*
  106  * Handle a beacon miss event.  The common code filters out
  107  * spurious events that can happen when scanning and/or before
  108  * reaching RUN state.
  109  */
  110 static void
  111 sta_beacon_miss(struct ieee80211vap *vap)
  112 {
  113         struct ieee80211com *ic = vap->iv_ic;
  114 
  115         IEEE80211_LOCK_ASSERT(ic);
  116 
  117         KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
  118         KASSERT(vap->iv_state >= IEEE80211_S_RUN,
  119             ("wrong state %s", ieee80211_state_name[vap->iv_state]));
  120 
  121         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
  122             "beacon miss, mode %s state %s\n",
  123             ieee80211_opmode_name[vap->iv_opmode],
  124             ieee80211_state_name[vap->iv_state]);
  125 
  126         if (vap->iv_state == IEEE80211_S_CSA) {
  127                 /*
  128                  * A Channel Switch is pending; assume we missed the
  129                  * beacon that would've completed the process and just
  130                  * force the switch.  If we made a mistake we'll not
  131                  * find the AP on the new channel and fall back to a
  132                  * normal scan.
  133                  */
  134                 ieee80211_csa_completeswitch(ic);
  135                 return;
  136         }
  137         if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
  138                 /*
  139                  * Send a directed probe req before falling back to a
  140                  * scan; if we receive a response ic_bmiss_count will
  141                  * be reset.  Some cards mistakenly report beacon miss
  142                  * so this avoids the expensive scan if the ap is
  143                  * still there.
  144                  */
  145                 ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
  146                         vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
  147                         vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
  148                 return;
  149         }
  150 
  151         callout_stop(&vap->iv_swbmiss);
  152         vap->iv_bmiss_count = 0;
  153         vap->iv_stats.is_beacon_miss++;
  154         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
  155 #ifdef IEEE80211_SUPPORT_SUPERG
  156                 struct ieee80211com *ic = vap->iv_ic;
  157 
  158                 /*
  159                  * If we receive a beacon miss interrupt when using
  160                  * dynamic turbo, attempt to switch modes before
  161                  * reassociating.
  162                  */
  163                 if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
  164                         ieee80211_dturbo_switch(vap,
  165                             ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
  166 #endif
  167                 /*
  168                  * Try to reassociate before scanning for a new ap.
  169                  */
  170                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
  171         } else {
  172                 /*
  173                  * Somebody else is controlling state changes (e.g.
  174                  * a user-mode app) don't do anything that would
  175                  * confuse them; just drop into scan mode so they'll
  176                  * notified of the state change and given control.
  177                  */
  178                 ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
  179         }
  180 }
  181 
  182 /*
  183  * Handle deauth with reason.  We retry only for
  184  * the cases where we might succeed.  Otherwise
  185  * we downgrade the ap and scan.
  186  */
  187 static void
  188 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
  189 {
  190         switch (reason) {
  191         case IEEE80211_STATUS_SUCCESS:          /* NB: MLME assoc */
  192         case IEEE80211_STATUS_TIMEOUT:
  193         case IEEE80211_REASON_ASSOC_EXPIRE:
  194         case IEEE80211_REASON_NOT_AUTHED:
  195         case IEEE80211_REASON_NOT_ASSOCED:
  196         case IEEE80211_REASON_ASSOC_LEAVE:
  197         case IEEE80211_REASON_ASSOC_NOT_AUTHED:
  198                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
  199                 break;
  200         default:
  201                 ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
  202                 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  203                         ieee80211_check_scan_current(vap);
  204                 break;
  205         }
  206 }
  207 
  208 /*
  209  * IEEE80211_M_STA vap state machine handler.
  210  * This routine handles the main states in the 802.11 protocol.
  211  */
  212 static int
  213 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
  214 {
  215         struct ieee80211com *ic = vap->iv_ic;
  216         struct ieee80211_node *ni;
  217         enum ieee80211_state ostate;
  218 
  219         IEEE80211_LOCK_ASSERT(ic);
  220 
  221         ostate = vap->iv_state;
  222         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
  223             __func__, ieee80211_state_name[ostate],
  224             ieee80211_state_name[nstate], arg);
  225         vap->iv_state = nstate;                 /* state transition */
  226         callout_stop(&vap->iv_mgtsend);         /* XXX callout_drain */
  227         if (ostate != IEEE80211_S_SCAN)
  228                 ieee80211_cancel_scan(vap);     /* background scan */
  229         ni = vap->iv_bss;                       /* NB: no reference held */
  230         if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
  231                 callout_stop(&vap->iv_swbmiss);
  232         switch (nstate) {
  233         case IEEE80211_S_INIT:
  234                 switch (ostate) {
  235                 case IEEE80211_S_SLEEP:
  236                         /* XXX wakeup */
  237                 case IEEE80211_S_RUN:
  238                         IEEE80211_SEND_MGMT(ni,
  239                             IEEE80211_FC0_SUBTYPE_DISASSOC,
  240                             IEEE80211_REASON_ASSOC_LEAVE);
  241                         ieee80211_sta_leave(ni);
  242                         break;
  243                 case IEEE80211_S_ASSOC:
  244                         IEEE80211_SEND_MGMT(ni,
  245                             IEEE80211_FC0_SUBTYPE_DEAUTH,
  246                             IEEE80211_REASON_AUTH_LEAVE);
  247                         break;
  248                 case IEEE80211_S_SCAN:
  249                         ieee80211_cancel_scan(vap);
  250                         break;
  251                 default:
  252                         goto invalid;
  253                 }
  254                 if (ostate != IEEE80211_S_INIT) {
  255                         /* NB: optimize INIT -> INIT case */
  256                         ieee80211_reset_bss(vap);
  257                 }
  258                 if (vap->iv_auth->ia_detach != NULL)
  259                         vap->iv_auth->ia_detach(vap);
  260                 break;
  261         case IEEE80211_S_SCAN:
  262                 switch (ostate) {
  263                 case IEEE80211_S_INIT:
  264                         /*
  265                          * Initiate a scan.  We can come here as a result
  266                          * of an IEEE80211_IOC_SCAN_REQ too in which case
  267                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
  268                          * and the scan request parameters will be present
  269                          * in iv_scanreq.  Otherwise we do the default.
  270                          */
  271                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
  272                                 ieee80211_check_scan(vap,
  273                                     vap->iv_scanreq_flags,
  274                                     vap->iv_scanreq_duration,
  275                                     vap->iv_scanreq_mindwell,
  276                                     vap->iv_scanreq_maxdwell,
  277                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
  278                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
  279                         } else
  280                                 ieee80211_check_scan_current(vap);
  281                         break;
  282                 case IEEE80211_S_SCAN:
  283                 case IEEE80211_S_AUTH:
  284                 case IEEE80211_S_ASSOC:
  285                         /*
  286                          * These can happen either because of a timeout
  287                          * on an assoc/auth response or because of a
  288                          * change in state that requires a reset.  For
  289                          * the former we're called with a non-zero arg
  290                          * that is the cause for the failure; pass this
  291                          * to the scan code so it can update state.
  292                          * Otherwise trigger a new scan unless we're in
  293                          * manual roaming mode in which case an application
  294                          * must issue an explicit scan request.
  295                          */
  296                         if (arg != 0)
  297                                 ieee80211_scan_assoc_fail(vap,
  298                                         vap->iv_bss->ni_macaddr, arg);
  299                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  300                                 ieee80211_check_scan_current(vap);
  301                         break;
  302                 case IEEE80211_S_RUN:           /* beacon miss */
  303                         /*
  304                          * Beacon miss.  Notify user space and if not
  305                          * under control of a user application (roaming
  306                          * manual) kick off a scan to re-connect.
  307                          */
  308                         ieee80211_sta_leave(ni);
  309                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
  310                                 ieee80211_check_scan_current(vap);
  311                         break;
  312                 default:
  313                         goto invalid;
  314                 }
  315                 break;
  316         case IEEE80211_S_AUTH:
  317                 switch (ostate) {
  318                 case IEEE80211_S_INIT:
  319                 case IEEE80211_S_SCAN:
  320                         IEEE80211_SEND_MGMT(ni,
  321                             IEEE80211_FC0_SUBTYPE_AUTH, 1);
  322                         break;
  323                 case IEEE80211_S_AUTH:
  324                 case IEEE80211_S_ASSOC:
  325                         switch (arg & 0xff) {
  326                         case IEEE80211_FC0_SUBTYPE_AUTH:
  327                                 /* ??? */
  328                                 IEEE80211_SEND_MGMT(ni,
  329                                     IEEE80211_FC0_SUBTYPE_AUTH, 2);
  330                                 break;
  331                         case IEEE80211_FC0_SUBTYPE_DEAUTH:
  332                                 sta_authretry(vap, ni, arg>>8);
  333                                 break;
  334                         }
  335                         break;
  336                 case IEEE80211_S_RUN:
  337                         switch (arg & 0xff) {
  338                         case IEEE80211_FC0_SUBTYPE_AUTH:
  339                                 IEEE80211_SEND_MGMT(ni,
  340                                     IEEE80211_FC0_SUBTYPE_AUTH, 2);
  341                                 vap->iv_state = ostate; /* stay RUN */
  342                                 break;
  343                         case IEEE80211_FC0_SUBTYPE_DEAUTH:
  344                                 ieee80211_sta_leave(ni);
  345                                 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
  346                                         /* try to reauth */
  347                                         IEEE80211_SEND_MGMT(ni,
  348                                             IEEE80211_FC0_SUBTYPE_AUTH, 1);
  349                                 }
  350                                 break;
  351                         }
  352                         break;
  353                 default:
  354                         goto invalid;
  355                 }
  356                 break;
  357         case IEEE80211_S_ASSOC:
  358                 switch (ostate) {
  359                 case IEEE80211_S_AUTH:
  360                 case IEEE80211_S_ASSOC:
  361                         IEEE80211_SEND_MGMT(ni,
  362                             IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
  363                         break;
  364                 case IEEE80211_S_SLEEP:         /* cannot happen */
  365                 case IEEE80211_S_RUN:
  366                         ieee80211_sta_leave(ni);
  367                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
  368                                 IEEE80211_SEND_MGMT(ni, arg ?
  369                                     IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
  370                                     IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
  371                         }
  372                         break;
  373                 default:
  374                         goto invalid;
  375                 }
  376                 break;
  377         case IEEE80211_S_RUN:
  378                 if (vap->iv_flags & IEEE80211_F_WPA) {
  379                         /* XXX validate prerequisites */
  380                 }
  381                 switch (ostate) {
  382                 case IEEE80211_S_RUN:
  383                 case IEEE80211_S_CSA:
  384                         break;
  385                 case IEEE80211_S_AUTH:          /* when join is done in fw */
  386                 case IEEE80211_S_ASSOC:
  387 #ifdef IEEE80211_DEBUG
  388                         if (ieee80211_msg_debug(vap)) {
  389                                 ieee80211_note(vap, "%s with %s ssid ",
  390                                     (vap->iv_opmode == IEEE80211_M_STA ?
  391                                     "associated" : "synchronized"),
  392                                     ether_sprintf(ni->ni_bssid));
  393                                 ieee80211_print_essid(vap->iv_bss->ni_essid,
  394                                     ni->ni_esslen);
  395                                 /* XXX MCS/HT */
  396                                 printf(" channel %d start %uMb\n",
  397                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
  398                                     IEEE80211_RATE2MBS(ni->ni_txrate));
  399                         }
  400 #endif
  401                         ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
  402                         ieee80211_notify_node_join(ni, 
  403                             arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
  404                         break;
  405                 case IEEE80211_S_SLEEP:
  406                         vap->iv_sta_ps(vap, 0);
  407                         break;
  408                 default:
  409                         goto invalid;
  410                 }
  411                 ieee80211_sync_curchan(ic);
  412                 if (ostate != IEEE80211_S_RUN &&
  413                     (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)) {
  414                         /*
  415                          * Start s/w beacon miss timer for devices w/o
  416                          * hardware support.  We fudge a bit here since
  417                          * we're doing this in software.
  418                          */
  419                         vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
  420                                 2 * vap->iv_bmissthreshold * ni->ni_intval);
  421                         vap->iv_swbmiss_count = 0;
  422                         callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
  423                                 ieee80211_swbmiss, vap);
  424                 }
  425                 /*
  426                  * When 802.1x is not in use mark the port authorized
  427                  * at this point so traffic can flow.
  428                  */
  429                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
  430                         ieee80211_node_authorize(ni);
  431                 /*
  432                  * Fake association when joining an existing bss.
  433                  */
  434                 if (ic->ic_newassoc != NULL)
  435                         ic->ic_newassoc(vap->iv_bss, ostate != IEEE80211_S_RUN);
  436                 break;
  437         case IEEE80211_S_CSA:
  438                 if (ostate != IEEE80211_S_RUN)
  439                         goto invalid;
  440                 break;
  441         case IEEE80211_S_SLEEP:
  442                 vap->iv_sta_ps(vap, 1);
  443                 break;
  444         default:
  445         invalid:
  446                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
  447                     "%s: unexpected state transition %s -> %s\n", __func__,
  448                     ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
  449                 break;
  450         }
  451         return 0;
  452 }
  453 
  454 /*
  455  * Return non-zero if the frame is an echo of a multicast
  456  * frame sent by ourself.  The dir is known to be DSTODS.
  457  */
  458 static __inline int
  459 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
  460 {
  461 #define QWH4(wh)        ((const struct ieee80211_qosframe_addr4 *)wh)
  462 #define WH4(wh)         ((const struct ieee80211_frame_addr4 *)wh)
  463         const uint8_t *sa;
  464 
  465         KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
  466 
  467         if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
  468                 return 0;
  469         sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
  470         return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
  471 #undef WH4
  472 #undef QWH4
  473 }
  474 
  475 /*
  476  * Return non-zero if the frame is an echo of a multicast
  477  * frame sent by ourself.  The dir is known to be FROMDS.
  478  */
  479 static __inline int
  480 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
  481 {
  482         KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
  483 
  484         if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
  485                 return 0;
  486         return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
  487 }
  488 
  489 /*
  490  * Decide if a received management frame should be
  491  * printed when debugging is enabled.  This filters some
  492  * of the less interesting frames that come frequently
  493  * (e.g. beacons).
  494  */
  495 static __inline int
  496 doprint(struct ieee80211vap *vap, int subtype)
  497 {
  498         switch (subtype) {
  499         case IEEE80211_FC0_SUBTYPE_BEACON:
  500                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
  501         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  502                 return 0;
  503         }
  504         return 1;
  505 }
  506 
  507 /*
  508  * Process a received frame.  The node associated with the sender
  509  * should be supplied.  If nothing was found in the node table then
  510  * the caller is assumed to supply a reference to iv_bss instead.
  511  * The RSSI and a timestamp are also supplied.  The RSSI data is used
  512  * during AP scanning to select a AP to associate with; it can have
  513  * any units so long as values have consistent units and higher values
  514  * mean ``better signal''.  The receive timestamp is currently not used
  515  * by the 802.11 layer.
  516  */
  517 static int
  518 sta_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
  519 {
  520 #define HAS_SEQ(type)   ((type & 0x4) == 0)
  521         struct ieee80211vap *vap = ni->ni_vap;
  522         struct ieee80211com *ic = ni->ni_ic;
  523         struct ifnet *ifp = vap->iv_ifp;
  524         struct ieee80211_frame *wh;
  525         struct ieee80211_key *key;
  526         struct ether_header *eh;
  527         int hdrspace, need_tap = 1;     /* mbuf need to be tapped. */
  528         uint8_t dir, type, subtype, qos;
  529         uint8_t *bssid;
  530         uint16_t rxseq;
  531 
  532         if (m->m_flags & M_AMPDU_MPDU) {
  533                 /*
  534                  * Fastpath for A-MPDU reorder q resubmission.  Frames
  535                  * w/ M_AMPDU_MPDU marked have already passed through
  536                  * here but were received out of order and been held on
  537                  * the reorder queue.  When resubmitted they are marked
  538                  * with the M_AMPDU_MPDU flag and we can bypass most of
  539                  * the normal processing.
  540                  */
  541                 wh = mtod(m, struct ieee80211_frame *);
  542                 type = IEEE80211_FC0_TYPE_DATA;
  543                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  544                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
  545                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
  546                 goto resubmit_ampdu;
  547         }
  548 
  549         KASSERT(ni != NULL, ("null node"));
  550         ni->ni_inact = ni->ni_inact_reload;
  551 
  552         type = -1;                      /* undefined */
  553 
  554         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
  555                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  556                     ni->ni_macaddr, NULL,
  557                     "too short (1): len %u", m->m_pkthdr.len);
  558                 vap->iv_stats.is_rx_tooshort++;
  559                 goto out;
  560         }
  561         /*
  562          * Bit of a cheat here, we use a pointer for a 3-address
  563          * frame format but don't reference fields past outside
  564          * ieee80211_frame_min w/o first validating the data is
  565          * present.
  566          */
  567         wh = mtod(m, struct ieee80211_frame *);
  568 
  569         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
  570             IEEE80211_FC0_VERSION_0) {
  571                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  572                     ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
  573                     wh->i_fc[0], wh->i_fc[1]);
  574                 vap->iv_stats.is_rx_badversion++;
  575                 goto err;
  576         }
  577 
  578         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
  579         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
  580         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
  581         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
  582                 bssid = wh->i_addr2;
  583                 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
  584                         /* not interested in */
  585                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  586                             bssid, NULL, "%s", "not to bss");
  587                         vap->iv_stats.is_rx_wrongbss++;
  588                         goto out;
  589                 }
  590 
  591                 /*
  592                  * Some devices may be in a promiscuous mode
  593                  * where they receive frames for multiple station
  594                  * addresses.
  595                  *
  596                  * If we receive a data frame that isn't
  597                  * destined to our VAP MAC, drop it.
  598                  *
  599                  * XXX TODO: This is only enforced when not scanning;
  600                  * XXX it assumes a software-driven scan will put the NIC
  601                  * XXX into a "no data frames" mode before setting this
  602                  * XXX flag. Otherwise it may be possible that we'll still
  603                  * XXX process data frames whilst scanning.
  604                  */
  605                 if ((! IEEE80211_IS_MULTICAST(wh->i_addr1))
  606                     && (! IEEE80211_ADDR_EQ(wh->i_addr1, IF_LLADDR(ifp)))) {
  607                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  608                             bssid, NULL, "not to cur sta: lladdr=%6D, addr1=%6D",
  609                             IF_LLADDR(ifp), ":", wh->i_addr1, ":");
  610                         vap->iv_stats.is_rx_wrongbss++;
  611                         goto out;
  612                 }
  613 
  614                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
  615                 ni->ni_noise = nf;
  616                 if (HAS_SEQ(type) && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  617                         uint8_t tid = ieee80211_gettid(wh);
  618                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
  619                             TID_TO_WME_AC(tid) >= WME_AC_VI)
  620                                 ic->ic_wme.wme_hipri_traffic++;
  621                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
  622                         if (! ieee80211_check_rxseq(ni, wh)) {
  623                                 /* duplicate, discard */
  624                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  625                                     bssid, "duplicate",
  626                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
  627                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
  628                                     ni->ni_rxseqs[tid] >>
  629                                         IEEE80211_SEQ_SEQ_SHIFT,
  630                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
  631                                     ni->ni_rxseqs[tid] &
  632                                         IEEE80211_SEQ_FRAG_MASK,
  633                                     tid);
  634                                 vap->iv_stats.is_rx_dup++;
  635                                 IEEE80211_NODE_STAT(ni, rx_dup);
  636                                 goto out;
  637                         }
  638                         ni->ni_rxseqs[tid] = rxseq;
  639                 }
  640         }
  641 
  642         switch (type) {
  643         case IEEE80211_FC0_TYPE_DATA:
  644                 hdrspace = ieee80211_hdrspace(ic, wh);
  645                 if (m->m_len < hdrspace &&
  646                     (m = m_pullup(m, hdrspace)) == NULL) {
  647                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  648                             ni->ni_macaddr, NULL,
  649                             "data too short: expecting %u", hdrspace);
  650                         vap->iv_stats.is_rx_tooshort++;
  651                         goto out;               /* XXX */
  652                 }
  653                 /*
  654                  * Handle A-MPDU re-ordering.  If the frame is to be
  655                  * processed directly then ieee80211_ampdu_reorder
  656                  * will return 0; otherwise it has consumed the mbuf
  657                  * and we should do nothing more with it.
  658                  */
  659                 if ((m->m_flags & M_AMPDU) &&
  660                     (dir == IEEE80211_FC1_DIR_FROMDS ||
  661                      dir == IEEE80211_FC1_DIR_DSTODS) &&
  662                     ieee80211_ampdu_reorder(ni, m) != 0) {
  663                         m = NULL;
  664                         goto out;
  665                 }
  666         resubmit_ampdu:
  667                 if (dir == IEEE80211_FC1_DIR_FROMDS) {
  668                         if ((ifp->if_flags & IFF_SIMPLEX) &&
  669                             isfromds_mcastecho(vap, wh)) {
  670                                 /*
  671                                  * In IEEE802.11 network, multicast
  672                                  * packets sent from "me" are broadcast
  673                                  * from the AP; silently discard for
  674                                  * SIMPLEX interface.
  675                                  */
  676                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  677                                     wh, "data", "%s", "multicast echo");
  678                                 vap->iv_stats.is_rx_mcastecho++;
  679                                 goto out;
  680                         }
  681                         if ((vap->iv_flags & IEEE80211_F_DWDS) &&
  682                             IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  683                                 /*
  684                                  * DWDS sta's must drop 3-address mcast frames
  685                                  * as they will be sent separately as a 4-addr
  686                                  * frame.  Accepting the 3-addr frame will
  687                                  * confuse the bridge into thinking the sending
  688                                  * sta is located at the end of WDS link.
  689                                  */
  690                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
  691                                     "3-address data", "%s", "DWDS enabled");
  692                                 vap->iv_stats.is_rx_mcastecho++;
  693                                 goto out;
  694                         }
  695                 } else if (dir == IEEE80211_FC1_DIR_DSTODS) {
  696                         if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
  697                                 IEEE80211_DISCARD(vap,
  698                                     IEEE80211_MSG_INPUT, wh, "4-address data",
  699                                     "%s", "DWDS not enabled");
  700                                 vap->iv_stats.is_rx_wrongdir++;
  701                                 goto out;
  702                         }
  703                         if ((ifp->if_flags & IFF_SIMPLEX) &&
  704                             isdstods_mcastecho(vap, wh)) {
  705                                 /*
  706                                  * In IEEE802.11 network, multicast
  707                                  * packets sent from "me" are broadcast
  708                                  * from the AP; silently discard for
  709                                  * SIMPLEX interface.
  710                                  */
  711                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
  712                                     "4-address data", "%s", "multicast echo");
  713                                 vap->iv_stats.is_rx_mcastecho++;
  714                                 goto out;
  715                         }
  716                 } else {
  717                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
  718                             "data", "incorrect dir 0x%x", dir);
  719                         vap->iv_stats.is_rx_wrongdir++;
  720                         goto out;
  721                 }
  722 
  723                 /*
  724                  * Handle privacy requirements.  Note that we
  725                  * must not be preempted from here until after
  726                  * we (potentially) call ieee80211_crypto_demic;
  727                  * otherwise we may violate assumptions in the
  728                  * crypto cipher modules used to do delayed update
  729                  * of replay sequence numbers.
  730                  */
  731                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
  732                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
  733                                 /*
  734                                  * Discard encrypted frames when privacy is off.
  735                                  */
  736                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  737                                     wh, "WEP", "%s", "PRIVACY off");
  738                                 vap->iv_stats.is_rx_noprivacy++;
  739                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
  740                                 goto out;
  741                         }
  742                         key = ieee80211_crypto_decap(ni, m, hdrspace);
  743                         if (key == NULL) {
  744                                 /* NB: stats+msgs handled in crypto_decap */
  745                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
  746                                 goto out;
  747                         }
  748                         wh = mtod(m, struct ieee80211_frame *);
  749                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
  750                 } else {
  751                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
  752                         key = NULL;
  753                 }
  754 
  755                 /*
  756                  * Save QoS bits for use below--before we strip the header.
  757                  */
  758                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
  759                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
  760                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
  761                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
  762                 } else
  763                         qos = 0;
  764 
  765                 /*
  766                  * Next up, any fragmentation.
  767                  */
  768                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
  769                         m = ieee80211_defrag(ni, m, hdrspace);
  770                         if (m == NULL) {
  771                                 /* Fragment dropped or frame not complete yet */
  772                                 goto out;
  773                         }
  774                 }
  775                 wh = NULL;              /* no longer valid, catch any uses */
  776 
  777                 /*
  778                  * Next strip any MSDU crypto bits.
  779                  */
  780                 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
  781                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  782                             ni->ni_macaddr, "data", "%s", "demic error");
  783                         vap->iv_stats.is_rx_demicfail++;
  784                         IEEE80211_NODE_STAT(ni, rx_demicfail);
  785                         goto out;
  786                 }
  787 
  788                 /* copy to listener after decrypt */
  789                 if (ieee80211_radiotap_active_vap(vap))
  790                         ieee80211_radiotap_rx(vap, m);
  791                 need_tap = 0;
  792 
  793                 /*
  794                  * Finally, strip the 802.11 header.
  795                  */
  796                 m = ieee80211_decap(vap, m, hdrspace);
  797                 if (m == NULL) {
  798                         /* XXX mask bit to check for both */
  799                         /* don't count Null data frames as errors */
  800                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
  801                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
  802                                 goto out;
  803                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  804                             ni->ni_macaddr, "data", "%s", "decap error");
  805                         vap->iv_stats.is_rx_decap++;
  806                         IEEE80211_NODE_STAT(ni, rx_decap);
  807                         goto err;
  808                 }
  809                 eh = mtod(m, struct ether_header *);
  810                 if (!ieee80211_node_is_authorized(ni)) {
  811                         /*
  812                          * Deny any non-PAE frames received prior to
  813                          * authorization.  For open/shared-key
  814                          * authentication the port is mark authorized
  815                          * after authentication completes.  For 802.1x
  816                          * the port is not marked authorized by the
  817                          * authenticator until the handshake has completed.
  818                          */
  819                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
  820                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
  821                                     eh->ether_shost, "data",
  822                                     "unauthorized port: ether type 0x%x len %u",
  823                                     eh->ether_type, m->m_pkthdr.len);
  824                                 vap->iv_stats.is_rx_unauth++;
  825                                 IEEE80211_NODE_STAT(ni, rx_unauth);
  826                                 goto err;
  827                         }
  828                 } else {
  829                         /*
  830                          * When denying unencrypted frames, discard
  831                          * any non-PAE frames received without encryption.
  832                          */
  833                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
  834                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
  835                             eh->ether_type != htons(ETHERTYPE_PAE)) {
  836                                 /*
  837                                  * Drop unencrypted frames.
  838                                  */
  839                                 vap->iv_stats.is_rx_unencrypted++;
  840                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
  841                                 goto out;
  842                         }
  843                 }
  844                 /* XXX require HT? */
  845                 if (qos & IEEE80211_QOS_AMSDU) {
  846                         m = ieee80211_decap_amsdu(ni, m);
  847                         if (m == NULL)
  848                                 return IEEE80211_FC0_TYPE_DATA;
  849                 } else {
  850 #ifdef IEEE80211_SUPPORT_SUPERG
  851                         m = ieee80211_decap_fastframe(vap, ni, m);
  852                         if (m == NULL)
  853                                 return IEEE80211_FC0_TYPE_DATA;
  854 #endif
  855                 }
  856                 ieee80211_deliver_data(vap, ni, m);
  857                 return IEEE80211_FC0_TYPE_DATA;
  858 
  859         case IEEE80211_FC0_TYPE_MGT:
  860                 vap->iv_stats.is_rx_mgmt++;
  861                 IEEE80211_NODE_STAT(ni, rx_mgmt);
  862                 if (dir != IEEE80211_FC1_DIR_NODS) {
  863                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  864                             wh, "data", "incorrect dir 0x%x", dir);
  865                         vap->iv_stats.is_rx_wrongdir++;
  866                         goto err;
  867                 }
  868                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
  869                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
  870                             ni->ni_macaddr, "mgt", "too short: len %u",
  871                             m->m_pkthdr.len);
  872                         vap->iv_stats.is_rx_tooshort++;
  873                         goto out;
  874                 }
  875 #ifdef IEEE80211_DEBUG
  876                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
  877                     ieee80211_msg_dumppkts(vap)) {
  878                         if_printf(ifp, "received %s from %s rssi %d\n",
  879                             ieee80211_mgt_subtype_name[subtype >>
  880                                 IEEE80211_FC0_SUBTYPE_SHIFT],
  881                             ether_sprintf(wh->i_addr2), rssi);
  882                 }
  883 #endif
  884                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
  885                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
  886                                 /*
  887                                  * Only shared key auth frames with a challenge
  888                                  * should be encrypted, discard all others.
  889                                  */
  890                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  891                                     wh, ieee80211_mgt_subtype_name[subtype >>
  892                                         IEEE80211_FC0_SUBTYPE_SHIFT],
  893                                     "%s", "WEP set but not permitted");
  894                                 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
  895                                 goto out;
  896                         }
  897                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
  898                                 /*
  899                                  * Discard encrypted frames when privacy is off.
  900                                  */
  901                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
  902                                     wh, "mgt", "%s", "WEP set but PRIVACY off");
  903                                 vap->iv_stats.is_rx_noprivacy++;
  904                                 goto out;
  905                         }
  906                         hdrspace = ieee80211_hdrspace(ic, wh);
  907                         key = ieee80211_crypto_decap(ni, m, hdrspace);
  908                         if (key == NULL) {
  909                                 /* NB: stats+msgs handled in crypto_decap */
  910                                 goto out;
  911                         }
  912                         wh = mtod(m, struct ieee80211_frame *);
  913                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
  914                 }
  915                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
  916                 goto out;
  917 
  918         case IEEE80211_FC0_TYPE_CTL:
  919                 vap->iv_stats.is_rx_ctl++;
  920                 IEEE80211_NODE_STAT(ni, rx_ctrl);
  921                 vap->iv_recv_ctl(ni, m, subtype);
  922                 goto out;
  923 
  924         default:
  925                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
  926                     wh, NULL, "bad frame type 0x%x", type);
  927                 /* should not come here */
  928                 break;
  929         }
  930 err:
  931         ifp->if_ierrors++;
  932 out:
  933         if (m != NULL) {
  934                 if (need_tap && ieee80211_radiotap_active_vap(vap))
  935                         ieee80211_radiotap_rx(vap, m);
  936                 m_freem(m);
  937         }
  938         return type;
  939 }
  940 
  941 static void
  942 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
  943     int rssi, int nf, uint16_t seq, uint16_t status)
  944 {
  945         struct ieee80211vap *vap = ni->ni_vap;
  946 
  947         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
  948                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
  949                     ni->ni_macaddr, "open auth",
  950                     "bad sta auth mode %u", ni->ni_authmode);
  951                 vap->iv_stats.is_rx_bad_auth++; /* XXX */
  952                 return;
  953         }
  954         if (vap->iv_state != IEEE80211_S_AUTH ||
  955             seq != IEEE80211_AUTH_OPEN_RESPONSE) {
  956                 vap->iv_stats.is_rx_bad_auth++;
  957                 return;
  958         }
  959         if (status != 0) {
  960                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
  961                     ni, "open auth failed (reason %d)", status);
  962                 vap->iv_stats.is_rx_auth_fail++;
  963                 vap->iv_stats.is_rx_authfail_code = status;
  964                 ieee80211_new_state(vap, IEEE80211_S_SCAN,
  965                     IEEE80211_SCAN_FAIL_STATUS);
  966         } else
  967                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
  968 }
  969 
  970 static void
  971 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
  972     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
  973     uint16_t seq, uint16_t status)
  974 {
  975         struct ieee80211vap *vap = ni->ni_vap;
  976         uint8_t *challenge;
  977         int estatus;
  978 
  979         /*
  980          * NB: this can happen as we allow pre-shared key
  981          * authentication to be enabled w/o wep being turned
  982          * on so that configuration of these can be done
  983          * in any order.  It may be better to enforce the
  984          * ordering in which case this check would just be
  985          * for sanity/consistency.
  986          */
  987         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
  988                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
  989                     ni->ni_macaddr, "shared key auth",
  990                     "%s", " PRIVACY is disabled");
  991                 estatus = IEEE80211_STATUS_ALG;
  992                 goto bad;
  993         }
  994         /*
  995          * Pre-shared key authentication is evil; accept
  996          * it only if explicitly configured (it is supported
  997          * mainly for compatibility with clients like OS X).
  998          */
  999         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
 1000             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
 1001                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1002                     ni->ni_macaddr, "shared key auth",
 1003                     "bad sta auth mode %u", ni->ni_authmode);
 1004                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
 1005                 estatus = IEEE80211_STATUS_ALG;
 1006                 goto bad;
 1007         }
 1008 
 1009         challenge = NULL;
 1010         if (frm + 1 < efrm) {
 1011                 if ((frm[1] + 2) > (efrm - frm)) {
 1012                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1013                             ni->ni_macaddr, "shared key auth",
 1014                             "ie %d/%d too long",
 1015                             frm[0], (frm[1] + 2) - (efrm - frm));
 1016                         vap->iv_stats.is_rx_bad_auth++;
 1017                         estatus = IEEE80211_STATUS_CHALLENGE;
 1018                         goto bad;
 1019                 }
 1020                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
 1021                         challenge = frm;
 1022                 frm += frm[1] + 2;
 1023         }
 1024         switch (seq) {
 1025         case IEEE80211_AUTH_SHARED_CHALLENGE:
 1026         case IEEE80211_AUTH_SHARED_RESPONSE:
 1027                 if (challenge == NULL) {
 1028                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1029                             ni->ni_macaddr, "shared key auth",
 1030                             "%s", "no challenge");
 1031                         vap->iv_stats.is_rx_bad_auth++;
 1032                         estatus = IEEE80211_STATUS_CHALLENGE;
 1033                         goto bad;
 1034                 }
 1035                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
 1036                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 1037                             ni->ni_macaddr, "shared key auth",
 1038                             "bad challenge len %d", challenge[1]);
 1039                         vap->iv_stats.is_rx_bad_auth++;
 1040                         estatus = IEEE80211_STATUS_CHALLENGE;
 1041                         goto bad;
 1042                 }
 1043         default:
 1044                 break;
 1045         }
 1046         if (vap->iv_state != IEEE80211_S_AUTH)
 1047                 return;
 1048         switch (seq) {
 1049         case IEEE80211_AUTH_SHARED_PASS:
 1050                 if (ni->ni_challenge != NULL) {
 1051                         free(ni->ni_challenge, M_80211_NODE);
 1052                         ni->ni_challenge = NULL;
 1053                 }
 1054                 if (status != 0) {
 1055                         IEEE80211_NOTE_FRAME(vap,
 1056                             IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
 1057                             "shared key auth failed (reason %d)", status);
 1058                         vap->iv_stats.is_rx_auth_fail++;
 1059                         vap->iv_stats.is_rx_authfail_code = status;
 1060                         return;
 1061                 }
 1062                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
 1063                 break;
 1064         case IEEE80211_AUTH_SHARED_CHALLENGE:
 1065                 if (!ieee80211_alloc_challenge(ni))
 1066                         return;
 1067                 /* XXX could optimize by passing recvd challenge */
 1068                 memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
 1069                 IEEE80211_SEND_MGMT(ni,
 1070                         IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
 1071                 break;
 1072         default:
 1073                 IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
 1074                     wh, "shared key auth", "bad seq %d", seq);
 1075                 vap->iv_stats.is_rx_bad_auth++;
 1076                 return;
 1077         }
 1078         return;
 1079 bad:
 1080         /*
 1081          * Kick the state machine.  This short-circuits
 1082          * using the mgt frame timeout to trigger the
 1083          * state transition.
 1084          */
 1085         if (vap->iv_state == IEEE80211_S_AUTH)
 1086                 ieee80211_new_state(vap, IEEE80211_S_SCAN,
 1087                     IEEE80211_SCAN_FAIL_STATUS);
 1088 }
 1089 
 1090 int
 1091 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
 1092         const struct ieee80211_frame *wh)
 1093 {
 1094 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
 1095         struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
 1096         u_int len = frm[1], qosinfo;
 1097         int i;
 1098 
 1099         if (len < sizeof(struct ieee80211_wme_param)-2) {
 1100                 IEEE80211_DISCARD_IE(vap,
 1101                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
 1102                     wh, "WME", "too short, len %u", len);
 1103                 return -1;
 1104         }
 1105         qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
 1106         qosinfo &= WME_QOSINFO_COUNT;
 1107         /* XXX do proper check for wraparound */
 1108         if (qosinfo == wme->wme_wmeChanParams.cap_info)
 1109                 return 0;
 1110         frm += __offsetof(struct ieee80211_wme_param, params_acParams);
 1111         for (i = 0; i < WME_NUM_AC; i++) {
 1112                 struct wmeParams *wmep =
 1113                         &wme->wme_wmeChanParams.cap_wmeParams[i];
 1114                 /* NB: ACI not used */
 1115                 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
 1116                 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
 1117                 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
 1118                 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
 1119                 wmep->wmep_txopLimit = LE_READ_2(frm+2);
 1120                 frm += 4;
 1121         }
 1122         wme->wme_wmeChanParams.cap_info = qosinfo;
 1123         return 1;
 1124 #undef MS
 1125 }
 1126 
 1127 /*
 1128  * Process 11h Channel Switch Announcement (CSA) ie.  If this
 1129  * is the first CSA then initiate the switch.  Otherwise we
 1130  * track state and trigger completion and/or cancel of the switch.
 1131  * XXX should be public for IBSS use
 1132  */
 1133 static void
 1134 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
 1135         const struct ieee80211_frame *wh)
 1136 {
 1137         struct ieee80211com *ic = vap->iv_ic;
 1138         const struct ieee80211_csa_ie *csa =
 1139             (const struct ieee80211_csa_ie *) frm;
 1140 
 1141         KASSERT(vap->iv_state >= IEEE80211_S_RUN,
 1142             ("state %s", ieee80211_state_name[vap->iv_state]));
 1143 
 1144         if (csa->csa_mode > 1) {
 1145                 IEEE80211_DISCARD_IE(vap,
 1146                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
 1147                     wh, "CSA", "invalid mode %u", csa->csa_mode);
 1148                 return;
 1149         }
 1150         IEEE80211_LOCK(ic);
 1151         if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
 1152                 /*
 1153                  * Convert the channel number to a channel reference.  We
 1154                  * try first to preserve turbo attribute of the current
 1155                  * channel then fallback.  Note this will not work if the
 1156                  * CSA specifies a channel that requires a band switch (e.g.
 1157                  * 11a => 11g).  This is intentional as 11h is defined only
 1158                  * for 5GHz/11a and because the switch does not involve a
 1159                  * reassociation, protocol state (capabilities, negotated
 1160                  * rates, etc) may/will be wrong.
 1161                  */
 1162                 struct ieee80211_channel *c =
 1163                     ieee80211_find_channel_byieee(ic, csa->csa_newchan,
 1164                         (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
 1165                 if (c == NULL) {
 1166                         c = ieee80211_find_channel_byieee(ic,
 1167                             csa->csa_newchan,
 1168                             (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
 1169                         if (c == NULL) {
 1170                                 IEEE80211_DISCARD_IE(vap,
 1171                                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
 1172                                     wh, "CSA", "invalid channel %u",
 1173                                     csa->csa_newchan);
 1174                                 goto done;
 1175                         }
 1176                 }
 1177 #if IEEE80211_CSA_COUNT_MIN > 0
 1178                 if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
 1179                         /*
 1180                          * Require at least IEEE80211_CSA_COUNT_MIN count to
 1181                          * reduce the risk of being redirected by a fabricated
 1182                          * CSA.  If a valid CSA is dropped we'll still get a
 1183                          * beacon miss when the AP leaves the channel so we'll
 1184                          * eventually follow to the new channel.
 1185                          *
 1186                          * NOTE: this violates the 11h spec that states that
 1187                          * count may be any value and if 0 then a switch
 1188                          * should happen asap.
 1189                          */
 1190                         IEEE80211_DISCARD_IE(vap,
 1191                             IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
 1192                             wh, "CSA", "count %u too small, must be >= %u",
 1193                             csa->csa_count, IEEE80211_CSA_COUNT_MIN);
 1194                         goto done;
 1195                 }
 1196 #endif
 1197                 ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
 1198         } else {
 1199                 /*
 1200                  * Validate this ie against the initial CSA.  We require
 1201                  * mode and channel not change and the count must be
 1202                  * monotonically decreasing.  This may be pointless and
 1203                  * canceling the switch as a result may be too paranoid but
 1204                  * in the worst case if we drop out of CSA because of this
 1205                  * and the AP does move then we'll just end up taking a
 1206                  * beacon miss and scan to find the AP.
 1207                  *
 1208                  * XXX may want <= on count as we also process ProbeResp
 1209                  * frames and those may come in w/ the same count as the
 1210                  * previous beacon; but doing so leaves us open to a stuck
 1211                  * count until we add a dead-man timer
 1212                  */
 1213                 if (!(csa->csa_count < ic->ic_csa_count &&
 1214                       csa->csa_mode == ic->ic_csa_mode &&
 1215                       csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
 1216                         IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
 1217                             "CSA ie mismatch, initial ie <%d,%d,%d>, "
 1218                             "this ie <%d,%d,%d>", ic->ic_csa_mode,
 1219                             ic->ic_csa_newchan, ic->ic_csa_count,
 1220                             csa->csa_mode, csa->csa_newchan, csa->csa_count);
 1221                         ieee80211_csa_cancelswitch(ic);
 1222                 } else {
 1223                         if (csa->csa_count <= 1)
 1224                                 ieee80211_csa_completeswitch(ic);
 1225                         else
 1226                                 ic->ic_csa_count = csa->csa_count;
 1227                 }
 1228         }
 1229 done:
 1230         IEEE80211_UNLOCK(ic);
 1231 }
 1232 
 1233 /*
 1234  * Return non-zero if a background scan may be continued:
 1235  * o bg scan is active
 1236  * o no channel switch is pending
 1237  * o there has not been any traffic recently
 1238  *
 1239  * Note we do not check if there is an administrative enable;
 1240  * this is only done to start the scan.  We assume that any
 1241  * change in state will be accompanied by a request to cancel
 1242  * active scans which will otherwise cause this test to fail.
 1243  */
 1244 static __inline int
 1245 contbgscan(struct ieee80211vap *vap)
 1246 {
 1247         struct ieee80211com *ic = vap->iv_ic;
 1248 
 1249         return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
 1250             (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
 1251             vap->iv_state == IEEE80211_S_RUN &&         /* XXX? */
 1252             time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
 1253 }
 1254 
 1255 /*
 1256  * Return non-zero if a backgrond scan may be started:
 1257  * o bg scanning is administratively enabled
 1258  * o no channel switch is pending
 1259  * o we are not boosted on a dynamic turbo channel
 1260  * o there has not been a scan recently
 1261  * o there has not been any traffic recently
 1262  */
 1263 static __inline int
 1264 startbgscan(struct ieee80211vap *vap)
 1265 {
 1266         struct ieee80211com *ic = vap->iv_ic;
 1267 
 1268         return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
 1269             (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
 1270 #ifdef IEEE80211_SUPPORT_SUPERG
 1271             !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
 1272 #endif
 1273             time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
 1274             time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
 1275 }
 1276 
 1277 static void
 1278 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
 1279         int subtype, int rssi, int nf)
 1280 {
 1281 #define ISPROBE(_st)    ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
 1282 #define ISREASSOC(_st)  ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
 1283         struct ieee80211vap *vap = ni->ni_vap;
 1284         struct ieee80211com *ic = ni->ni_ic;
 1285         struct ieee80211_frame *wh;
 1286         uint8_t *frm, *efrm;
 1287         uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
 1288         uint8_t rate;
 1289         int ht_state_change = 0;
 1290 
 1291         wh = mtod(m0, struct ieee80211_frame *);
 1292         frm = (uint8_t *)&wh[1];
 1293         efrm = mtod(m0, uint8_t *) + m0->m_len;
 1294         switch (subtype) {
 1295         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
 1296         case IEEE80211_FC0_SUBTYPE_BEACON: {
 1297                 struct ieee80211_scanparams scan;
 1298                 /*
 1299                  * We process beacon/probe response frames:
 1300                  *    o when scanning, or
 1301                  *    o station mode when associated (to collect state
 1302                  *      updates such as 802.11g slot time)
 1303                  * Frames otherwise received are discarded.
 1304                  */ 
 1305                 if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
 1306                         vap->iv_stats.is_rx_mgtdiscard++;
 1307                         return;
 1308                 }
 1309                 /* XXX probe response in sta mode when !scanning? */
 1310                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0) {
 1311                         if (! (ic->ic_flags & IEEE80211_F_SCAN))
 1312                                 vap->iv_stats.is_beacon_bad++;
 1313                         return;
 1314                 }
 1315                 /*
 1316                  * Count frame now that we know it's to be processed.
 1317                  */
 1318                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
 1319                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
 1320                         IEEE80211_NODE_STAT(ni, rx_beacons);
 1321                 } else
 1322                         IEEE80211_NODE_STAT(ni, rx_proberesp);
 1323                 /*
 1324                  * When operating in station mode, check for state updates.
 1325                  * Be careful to ignore beacons received while doing a
 1326                  * background scan.  We consider only 11g/WMM stuff right now.
 1327                  */
 1328                 if (ni->ni_associd != 0 &&
 1329                     ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
 1330                      IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
 1331                         /* record tsf of last beacon */
 1332                         memcpy(ni->ni_tstamp.data, scan.tstamp,
 1333                                 sizeof(ni->ni_tstamp));
 1334                         /* count beacon frame for s/w bmiss handling */
 1335                         vap->iv_swbmiss_count++;
 1336                         vap->iv_bmiss_count = 0;
 1337                         if (ni->ni_erp != scan.erp) {
 1338                                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
 1339                                     wh->i_addr2,
 1340                                     "erp change: was 0x%x, now 0x%x",
 1341                                     ni->ni_erp, scan.erp);
 1342                                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
 1343                                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
 1344                                         ic->ic_flags |= IEEE80211_F_USEPROT;
 1345                                 else
 1346                                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
 1347                                 ni->ni_erp = scan.erp;
 1348                                 /* XXX statistic */
 1349                                 /* XXX driver notification */
 1350                         }
 1351                         if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
 1352                                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
 1353                                     wh->i_addr2,
 1354                                     "capabilities change: was 0x%x, now 0x%x",
 1355                                     ni->ni_capinfo, scan.capinfo);
 1356                                 /*
 1357                                  * NB: we assume short preamble doesn't
 1358                                  *     change dynamically
 1359                                  */
 1360                                 ieee80211_set_shortslottime(ic,
 1361                                         IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
 1362                                         (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
 1363                                 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
 1364                                                | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
 1365                                 /* XXX statistic */
 1366                         }
 1367                         if (scan.wme != NULL &&
 1368                             (ni->ni_flags & IEEE80211_NODE_QOS) &&
 1369                             ieee80211_parse_wmeparams(vap, scan.wme, wh) > 0)
 1370                                 ieee80211_wme_updateparams(vap);
 1371 #ifdef IEEE80211_SUPPORT_SUPERG
 1372                         if (scan.ath != NULL)
 1373                                 ieee80211_parse_athparams(ni, scan.ath, wh);
 1374 #endif
 1375                         if (scan.htcap != NULL && scan.htinfo != NULL &&
 1376                             (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
 1377                                 /* XXX state changes? */
 1378                                 if (ieee80211_ht_updateparams(ni,
 1379                                     scan.htcap, scan.htinfo))
 1380                                         ht_state_change = 1;
 1381                         }
 1382                         if (scan.quiet)
 1383                                 ic->ic_set_quiet(ni, scan.quiet);
 1384                         if (scan.tim != NULL) {
 1385                                 struct ieee80211_tim_ie *tim =
 1386                                     (struct ieee80211_tim_ie *) scan.tim;
 1387 #if 0
 1388                                 int aid = IEEE80211_AID(ni->ni_associd);
 1389                                 int ix = aid / NBBY;
 1390                                 int min = tim->tim_bitctl &~ 1;
 1391                                 int max = tim->tim_len + min - 4;
 1392                                 if ((tim->tim_bitctl&1) ||
 1393                                     (min <= ix && ix <= max &&
 1394                                      isset(tim->tim_bitmap - min, aid))) {
 1395                                         /* 
 1396                                          * XXX Do not let bg scan kick off
 1397                                          * we are expecting data.
 1398                                          */
 1399                                         ic->ic_lastdata = ticks;
 1400                                         vap->iv_sta_ps(vap, 0);
 1401                                 }
 1402 #endif
 1403                                 ni->ni_dtim_count = tim->tim_count;
 1404                                 ni->ni_dtim_period = tim->tim_period;
 1405                         }
 1406                         if (scan.csa != NULL &&
 1407                             (vap->iv_flags & IEEE80211_F_DOTH))
 1408                                 ieee80211_parse_csaparams(vap, scan.csa, wh);
 1409                         else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
 1410                                 /*
 1411                                  * No CSA ie or 11h disabled, but a channel
 1412                                  * switch is pending; drop out so we aren't
 1413                                  * stuck in CSA state.  If the AP really is
 1414                                  * moving we'll get a beacon miss and scan.
 1415                                  */
 1416                                 IEEE80211_LOCK(ic);
 1417                                 ieee80211_csa_cancelswitch(ic);
 1418                                 IEEE80211_UNLOCK(ic);
 1419                         }
 1420                         /*
 1421                          * If scanning, pass the info to the scan module.
 1422                          * Otherwise, check if it's the right time to do
 1423                          * a background scan.  Background scanning must
 1424                          * be enabled and we must not be operating in the
 1425                          * turbo phase of dynamic turbo mode.  Then,
 1426                          * it's been a while since the last background
 1427                          * scan and if no data frames have come through
 1428                          * recently, kick off a scan.  Note that this
 1429                          * is the mechanism by which a background scan
 1430                          * is started _and_ continued each time we
 1431                          * return on-channel to receive a beacon from
 1432                          * our ap.
 1433                          */
 1434                         if (ic->ic_flags & IEEE80211_F_SCAN) {
 1435                                 ieee80211_add_scan(vap, &scan, wh,
 1436                                         subtype, rssi, nf);
 1437                         } else if (contbgscan(vap)) {
 1438                                 ieee80211_bg_scan(vap, 0);
 1439                         } else if (startbgscan(vap)) {
 1440                                 vap->iv_stats.is_scan_bg++;
 1441 #if 0
 1442                                 /* wakeup if we are sleeing */
 1443                                 ieee80211_set_pwrsave(vap, 0);
 1444 #endif
 1445                                 ieee80211_bg_scan(vap, 0);
 1446                         }
 1447 
 1448                         /*
 1449                          * If we've had a channel width change (eg HT20<->HT40)
 1450                          * then schedule a delayed driver notification.
 1451                          */
 1452                         if (ht_state_change)
 1453                                 ieee80211_update_chw(ic);
 1454                         return;
 1455                 }
 1456                 /*
 1457                  * If scanning, just pass information to the scan module.
 1458                  */
 1459                 if (ic->ic_flags & IEEE80211_F_SCAN) {
 1460                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
 1461                                 /*
 1462                                  * Actively scanning a channel marked passive;
 1463                                  * send a probe request now that we know there
 1464                                  * is 802.11 traffic present.
 1465                                  *
 1466                                  * XXX check if the beacon we recv'd gives
 1467                                  * us what we need and suppress the probe req
 1468                                  */
 1469                                 ieee80211_probe_curchan(vap, 1);
 1470                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 1471                         }
 1472                         ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
 1473                         return;
 1474                 }
 1475                 break;
 1476         }
 1477 
 1478         case IEEE80211_FC0_SUBTYPE_AUTH: {
 1479                 uint16_t algo, seq, status;
 1480                 /*
 1481                  * auth frame format
 1482                  *      [2] algorithm
 1483                  *      [2] sequence
 1484                  *      [2] status
 1485                  *      [tlv*] challenge
 1486                  */
 1487                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
 1488                 algo   = le16toh(*(uint16_t *)frm);
 1489                 seq    = le16toh(*(uint16_t *)(frm + 2));
 1490                 status = le16toh(*(uint16_t *)(frm + 4));
 1491                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
 1492                     "recv auth frame with algorithm %d seq %d", algo, seq);
 1493 
 1494                 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
 1495                         IEEE80211_DISCARD(vap,
 1496                             IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
 1497                             wh, "auth", "%s", "TKIP countermeasures enabled");
 1498                         vap->iv_stats.is_rx_auth_countermeasures++;
 1499                         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
 1500                                 ieee80211_send_error(ni, wh->i_addr2,
 1501                                         IEEE80211_FC0_SUBTYPE_AUTH,
 1502                                         IEEE80211_REASON_MIC_FAILURE);
 1503                         }
 1504                         return;
 1505                 }
 1506                 if (algo == IEEE80211_AUTH_ALG_SHARED)
 1507                         sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
 1508                             seq, status);
 1509                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
 1510                         sta_auth_open(ni, wh, rssi, nf, seq, status);
 1511                 else {
 1512                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 1513                             wh, "auth", "unsupported alg %d", algo);
 1514                         vap->iv_stats.is_rx_auth_unsupported++;
 1515                         return;
 1516                 } 
 1517                 break;
 1518         }
 1519 
 1520         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
 1521         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
 1522                 uint16_t capinfo, associd;
 1523                 uint16_t status;
 1524 
 1525                 if (vap->iv_state != IEEE80211_S_ASSOC) {
 1526                         vap->iv_stats.is_rx_mgtdiscard++;
 1527                         return;
 1528                 }
 1529 
 1530                 /*
 1531                  * asresp frame format
 1532                  *      [2] capability information
 1533                  *      [2] status
 1534                  *      [2] association ID
 1535                  *      [tlv] supported rates
 1536                  *      [tlv] extended supported rates
 1537                  *      [tlv] WME
 1538                  *      [tlv] HT capabilities
 1539                  *      [tlv] HT info
 1540                  */
 1541                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
 1542                 ni = vap->iv_bss;
 1543                 capinfo = le16toh(*(uint16_t *)frm);
 1544                 frm += 2;
 1545                 status = le16toh(*(uint16_t *)frm);
 1546                 frm += 2;
 1547                 if (status != 0) {
 1548                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
 1549                             wh->i_addr2, "%sassoc failed (reason %d)",
 1550                             ISREASSOC(subtype) ?  "re" : "", status);
 1551                         vap->iv_stats.is_rx_auth_fail++;        /* XXX */
 1552                         return;
 1553                 }
 1554                 associd = le16toh(*(uint16_t *)frm);
 1555                 frm += 2;
 1556 
 1557                 rates = xrates = wme = htcap = htinfo = NULL;
 1558                 while (efrm - frm > 1) {
 1559                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 1560                         switch (*frm) {
 1561                         case IEEE80211_ELEMID_RATES:
 1562                                 rates = frm;
 1563                                 break;
 1564                         case IEEE80211_ELEMID_XRATES:
 1565                                 xrates = frm;
 1566                                 break;
 1567                         case IEEE80211_ELEMID_HTCAP:
 1568                                 htcap = frm;
 1569                                 break;
 1570                         case IEEE80211_ELEMID_HTINFO:
 1571                                 htinfo = frm;
 1572                                 break;
 1573                         case IEEE80211_ELEMID_VENDOR:
 1574                                 if (iswmeoui(frm))
 1575                                         wme = frm;
 1576                                 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
 1577                                         /*
 1578                                          * Accept pre-draft HT ie's if the
 1579                                          * standard ones have not been seen.
 1580                                          */
 1581                                         if (ishtcapoui(frm)) {
 1582                                                 if (htcap == NULL)
 1583                                                         htcap = frm;
 1584                                         } else if (ishtinfooui(frm)) {
 1585                                                 if (htinfo == NULL)
 1586                                                         htinfo = frm;
 1587                                         }
 1588                                 }
 1589                                 /* XXX Atheros OUI support */
 1590                                 break;
 1591                         }
 1592                         frm += frm[1] + 2;
 1593                 }
 1594 
 1595                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
 1596                 if (xrates != NULL)
 1597                         IEEE80211_VERIFY_ELEMENT(xrates,
 1598                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
 1599                 rate = ieee80211_setup_rates(ni, rates, xrates,
 1600                                 IEEE80211_F_JOIN |
 1601                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
 1602                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
 1603                 if (rate & IEEE80211_RATE_BASIC) {
 1604                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
 1605                             wh->i_addr2,
 1606                             "%sassoc failed (rate set mismatch)",
 1607                             ISREASSOC(subtype) ?  "re" : "");
 1608                         vap->iv_stats.is_rx_assoc_norate++;
 1609                         ieee80211_new_state(vap, IEEE80211_S_SCAN,
 1610                             IEEE80211_SCAN_FAIL_STATUS);
 1611                         return;
 1612                 }
 1613 
 1614                 ni->ni_capinfo = capinfo;
 1615                 ni->ni_associd = associd;
 1616                 if (ni->ni_jointime == 0)
 1617                         ni->ni_jointime = time_uptime;
 1618                 if (wme != NULL &&
 1619                     ieee80211_parse_wmeparams(vap, wme, wh) >= 0) {
 1620                         ni->ni_flags |= IEEE80211_NODE_QOS;
 1621                         ieee80211_wme_updateparams(vap);
 1622                 } else
 1623                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
 1624                 /*
 1625                  * Setup HT state according to the negotiation.
 1626                  *
 1627                  * NB: shouldn't need to check if HT use is enabled but some
 1628                  *     ap's send back HT ie's even when we don't indicate we
 1629                  *     are HT capable in our AssocReq.
 1630                  */
 1631                 if (htcap != NULL && htinfo != NULL &&
 1632                     (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
 1633                         ieee80211_ht_node_init(ni);
 1634                         ieee80211_ht_updateparams(ni, htcap, htinfo);
 1635                         ieee80211_setup_htrates(ni, htcap,
 1636                              IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
 1637                         ieee80211_setup_basic_htrates(ni, htinfo);
 1638                         ieee80211_node_setuptxparms(ni);
 1639                         ieee80211_ratectl_node_init(ni);
 1640                 } else {
 1641 #ifdef IEEE80211_SUPPORT_SUPERG
 1642                         if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_ATH))
 1643                                 ieee80211_ff_node_init(ni);
 1644 #endif
 1645                 }
 1646                 /*
 1647                  * Configure state now that we are associated.
 1648                  *
 1649                  * XXX may need different/additional driver callbacks?
 1650                  */
 1651                 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
 1652                     (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
 1653                         ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
 1654                         ic->ic_flags &= ~IEEE80211_F_USEBARKER;
 1655                 } else {
 1656                         ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
 1657                         ic->ic_flags |= IEEE80211_F_USEBARKER;
 1658                 }
 1659                 ieee80211_set_shortslottime(ic,
 1660                         IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
 1661                         (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
 1662                 /*
 1663                  * Honor ERP protection.
 1664                  *
 1665                  * NB: ni_erp should zero for non-11g operation.
 1666                  */
 1667                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
 1668                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
 1669                         ic->ic_flags |= IEEE80211_F_USEPROT;
 1670                 else
 1671                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
 1672                 IEEE80211_NOTE_MAC(vap,
 1673                     IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
 1674                     "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s",
 1675                     ISREASSOC(subtype) ? "re" : "",
 1676                     IEEE80211_NODE_AID(ni),
 1677                     ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
 1678                     ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
 1679                     ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
 1680                     ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
 1681                     ni->ni_flags & IEEE80211_NODE_HT ?
 1682                         (ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
 1683                     ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
 1684                     ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
 1685                         ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
 1686                     ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
 1687                     IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
 1688                         ", fast-frames" : "",
 1689                     IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
 1690                         ", turbo" : ""
 1691                 );
 1692                 ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
 1693                 break;
 1694         }
 1695 
 1696         case IEEE80211_FC0_SUBTYPE_DEAUTH: {
 1697                 uint16_t reason;
 1698 
 1699                 if (vap->iv_state == IEEE80211_S_SCAN) {
 1700                         vap->iv_stats.is_rx_mgtdiscard++;
 1701                         return;
 1702                 }
 1703                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
 1704                         /* NB: can happen when in promiscuous mode */
 1705                         vap->iv_stats.is_rx_mgtdiscard++;
 1706                         break;
 1707                 }
 1708 
 1709                 /*
 1710                  * deauth frame format
 1711                  *      [2] reason
 1712                  */
 1713                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
 1714                 reason = le16toh(*(uint16_t *)frm);
 1715 
 1716                 vap->iv_stats.is_rx_deauth++;
 1717                 vap->iv_stats.is_rx_deauth_code = reason;
 1718                 IEEE80211_NODE_STAT(ni, rx_deauth);
 1719 
 1720                 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
 1721                     "recv deauthenticate (reason %d)", reason);
 1722                 ieee80211_new_state(vap, IEEE80211_S_AUTH,
 1723                     (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
 1724                 break;
 1725         }
 1726 
 1727         case IEEE80211_FC0_SUBTYPE_DISASSOC: {
 1728                 uint16_t reason;
 1729 
 1730                 if (vap->iv_state != IEEE80211_S_RUN &&
 1731                     vap->iv_state != IEEE80211_S_ASSOC &&
 1732                     vap->iv_state != IEEE80211_S_AUTH) {
 1733                         vap->iv_stats.is_rx_mgtdiscard++;
 1734                         return;
 1735                 }
 1736                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
 1737                         /* NB: can happen when in promiscuous mode */
 1738                         vap->iv_stats.is_rx_mgtdiscard++;
 1739                         break;
 1740                 }
 1741 
 1742                 /*
 1743                  * disassoc frame format
 1744                  *      [2] reason
 1745                  */
 1746                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
 1747                 reason = le16toh(*(uint16_t *)frm);
 1748 
 1749                 vap->iv_stats.is_rx_disassoc++;
 1750                 vap->iv_stats.is_rx_disassoc_code = reason;
 1751                 IEEE80211_NODE_STAT(ni, rx_disassoc);
 1752 
 1753                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
 1754                     "recv disassociate (reason %d)", reason);
 1755                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
 1756                 break;
 1757         }
 1758 
 1759         case IEEE80211_FC0_SUBTYPE_ACTION:
 1760         case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
 1761                 if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
 1762                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1763                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1764                             wh, NULL, "%s", "not for us");
 1765                         vap->iv_stats.is_rx_mgtdiscard++;
 1766                 } else if (vap->iv_state != IEEE80211_S_RUN) {
 1767                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1768                             wh, NULL, "wrong state %s",
 1769                             ieee80211_state_name[vap->iv_state]);
 1770                         vap->iv_stats.is_rx_mgtdiscard++;
 1771                 } else {
 1772                         if (ieee80211_parse_action(ni, m0) == 0)
 1773                                 (void)ic->ic_recv_action(ni, wh, frm, efrm);
 1774                 }
 1775                 break;
 1776 
 1777         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
 1778         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
 1779         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 1780         case IEEE80211_FC0_SUBTYPE_ATIM:
 1781                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 1782                     wh, NULL, "%s", "not handled");
 1783                 vap->iv_stats.is_rx_mgtdiscard++;
 1784                 break;
 1785 
 1786         default:
 1787                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 1788                     wh, "mgt", "subtype 0x%x not handled", subtype);
 1789                 vap->iv_stats.is_rx_badsubtype++;
 1790                 break;
 1791         }
 1792 #undef ISREASSOC
 1793 #undef ISPROBE
 1794 }
 1795 
 1796 static void
 1797 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
 1798 {
 1799         switch (subtype) {
 1800         case IEEE80211_FC0_SUBTYPE_BAR:
 1801                 ieee80211_recv_bar(ni, m);
 1802                 break;
 1803         }
 1804 }

Cache object: 84eee3dc1c9c48bb0d3c746d63dba61c


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.