1 /*-
2 * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24 */
25
26 #include <sys/cdefs.h>
27 #ifdef __FreeBSD__
28 __FBSDID("$FreeBSD: releng/8.0/sys/net80211/ieee80211_sta.c 195377 2009-07-05 17:59:19Z sam $");
29 #endif
30
31 /*
32 * IEEE 802.11 Station mode support.
33 */
34 #include "opt_inet.h"
35 #include "opt_wlan.h"
36
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/mbuf.h>
40 #include <sys/malloc.h>
41 #include <sys/kernel.h>
42
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
47 #include <sys/proc.h>
48 #include <sys/sysctl.h>
49
50 #include <net/if.h>
51 #include <net/if_media.h>
52 #include <net/if_llc.h>
53 #include <net/ethernet.h>
54
55 #include <net/bpf.h>
56
57 #include <net80211/ieee80211_var.h>
58 #include <net80211/ieee80211_sta.h>
59 #include <net80211/ieee80211_input.h>
60 #ifdef IEEE80211_SUPPORT_SUPERG
61 #include <net80211/ieee80211_superg.h>
62 #endif
63
64 #define IEEE80211_RATE2MBS(r) (((r) & IEEE80211_RATE_VAL) / 2)
65
66 static void sta_vattach(struct ieee80211vap *);
67 static void sta_beacon_miss(struct ieee80211vap *);
68 static int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
69 static int sta_input(struct ieee80211_node *, struct mbuf *, int, int);
70 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
71 int subtype, int rssi, int nf);
72 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
73
74 void
75 ieee80211_sta_attach(struct ieee80211com *ic)
76 {
77 ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
78 }
79
80 void
81 ieee80211_sta_detach(struct ieee80211com *ic)
82 {
83 }
84
85 static void
86 sta_vdetach(struct ieee80211vap *vap)
87 {
88 }
89
90 static void
91 sta_vattach(struct ieee80211vap *vap)
92 {
93 vap->iv_newstate = sta_newstate;
94 vap->iv_input = sta_input;
95 vap->iv_recv_mgmt = sta_recv_mgmt;
96 vap->iv_recv_ctl = sta_recv_ctl;
97 vap->iv_opdetach = sta_vdetach;
98 vap->iv_bmiss = sta_beacon_miss;
99 }
100
101 /*
102 * Handle a beacon miss event. The common code filters out
103 * spurious events that can happen when scanning and/or before
104 * reaching RUN state.
105 */
106 static void
107 sta_beacon_miss(struct ieee80211vap *vap)
108 {
109 struct ieee80211com *ic = vap->iv_ic;
110
111 KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
112 KASSERT(vap->iv_state >= IEEE80211_S_RUN,
113 ("wrong state %s", ieee80211_state_name[vap->iv_state]));
114
115 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
116 "beacon miss, mode %s state %s\n",
117 ieee80211_opmode_name[vap->iv_opmode],
118 ieee80211_state_name[vap->iv_state]);
119
120 if (vap->iv_state == IEEE80211_S_CSA) {
121 /*
122 * A Channel Switch is pending; assume we missed the
123 * beacon that would've completed the process and just
124 * force the switch. If we made a mistake we'll not
125 * find the AP on the new channel and fall back to a
126 * normal scan.
127 */
128 ieee80211_csa_completeswitch(ic);
129 return;
130 }
131 if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
132 /*
133 * Send a directed probe req before falling back to a
134 * scan; if we receive a response ic_bmiss_count will
135 * be reset. Some cards mistakenly report beacon miss
136 * so this avoids the expensive scan if the ap is
137 * still there.
138 */
139 ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
140 vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
141 vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
142 return;
143 }
144 vap->iv_bmiss_count = 0;
145 vap->iv_stats.is_beacon_miss++;
146 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
147 #ifdef IEEE80211_SUPPORT_SUPERG
148 struct ieee80211com *ic = vap->iv_ic;
149
150 /*
151 * If we receive a beacon miss interrupt when using
152 * dynamic turbo, attempt to switch modes before
153 * reassociating.
154 */
155 if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
156 ieee80211_dturbo_switch(vap,
157 ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
158 #endif
159 /*
160 * Try to reassociate before scanning for a new ap.
161 */
162 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
163 } else {
164 /*
165 * Somebody else is controlling state changes (e.g.
166 * a user-mode app) don't do anything that would
167 * confuse them; just drop into scan mode so they'll
168 * notified of the state change and given control.
169 */
170 ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
171 }
172 }
173
174 /*
175 * Handle deauth with reason. We retry only for
176 * the cases where we might succeed. Otherwise
177 * we downgrade the ap and scan.
178 */
179 static void
180 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
181 {
182 switch (reason) {
183 case IEEE80211_STATUS_SUCCESS: /* NB: MLME assoc */
184 case IEEE80211_STATUS_TIMEOUT:
185 case IEEE80211_REASON_ASSOC_EXPIRE:
186 case IEEE80211_REASON_NOT_AUTHED:
187 case IEEE80211_REASON_NOT_ASSOCED:
188 case IEEE80211_REASON_ASSOC_LEAVE:
189 case IEEE80211_REASON_ASSOC_NOT_AUTHED:
190 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
191 break;
192 default:
193 ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
194 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
195 ieee80211_check_scan_current(vap);
196 break;
197 }
198 }
199
200 /*
201 * IEEE80211_M_STA vap state machine handler.
202 * This routine handles the main states in the 802.11 protocol.
203 */
204 static int
205 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
206 {
207 struct ieee80211com *ic = vap->iv_ic;
208 struct ieee80211_node *ni;
209 enum ieee80211_state ostate;
210
211 IEEE80211_LOCK_ASSERT(ic);
212
213 ostate = vap->iv_state;
214 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
215 __func__, ieee80211_state_name[ostate],
216 ieee80211_state_name[nstate], arg);
217 vap->iv_state = nstate; /* state transition */
218 callout_stop(&vap->iv_mgtsend); /* XXX callout_drain */
219 if (ostate != IEEE80211_S_SCAN)
220 ieee80211_cancel_scan(vap); /* background scan */
221 ni = vap->iv_bss; /* NB: no reference held */
222 if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
223 callout_stop(&vap->iv_swbmiss);
224 switch (nstate) {
225 case IEEE80211_S_INIT:
226 switch (ostate) {
227 case IEEE80211_S_SLEEP:
228 /* XXX wakeup */
229 case IEEE80211_S_RUN:
230 IEEE80211_SEND_MGMT(ni,
231 IEEE80211_FC0_SUBTYPE_DISASSOC,
232 IEEE80211_REASON_ASSOC_LEAVE);
233 ieee80211_sta_leave(ni);
234 break;
235 case IEEE80211_S_ASSOC:
236 IEEE80211_SEND_MGMT(ni,
237 IEEE80211_FC0_SUBTYPE_DEAUTH,
238 IEEE80211_REASON_AUTH_LEAVE);
239 break;
240 case IEEE80211_S_SCAN:
241 ieee80211_cancel_scan(vap);
242 break;
243 default:
244 goto invalid;
245 }
246 if (ostate != IEEE80211_S_INIT) {
247 /* NB: optimize INIT -> INIT case */
248 ieee80211_reset_bss(vap);
249 }
250 if (vap->iv_auth->ia_detach != NULL)
251 vap->iv_auth->ia_detach(vap);
252 break;
253 case IEEE80211_S_SCAN:
254 switch (ostate) {
255 case IEEE80211_S_INIT:
256 /*
257 * Initiate a scan. We can come here as a result
258 * of an IEEE80211_IOC_SCAN_REQ too in which case
259 * the vap will be marked with IEEE80211_FEXT_SCANREQ
260 * and the scan request parameters will be present
261 * in iv_scanreq. Otherwise we do the default.
262 */
263 if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
264 ieee80211_check_scan(vap,
265 vap->iv_scanreq_flags,
266 vap->iv_scanreq_duration,
267 vap->iv_scanreq_mindwell,
268 vap->iv_scanreq_maxdwell,
269 vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
270 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
271 } else
272 ieee80211_check_scan_current(vap);
273 break;
274 case IEEE80211_S_SCAN:
275 case IEEE80211_S_AUTH:
276 case IEEE80211_S_ASSOC:
277 /*
278 * These can happen either because of a timeout
279 * on an assoc/auth response or because of a
280 * change in state that requires a reset. For
281 * the former we're called with a non-zero arg
282 * that is the cause for the failure; pass this
283 * to the scan code so it can update state.
284 * Otherwise trigger a new scan unless we're in
285 * manual roaming mode in which case an application
286 * must issue an explicit scan request.
287 */
288 if (arg != 0)
289 ieee80211_scan_assoc_fail(vap,
290 vap->iv_bss->ni_macaddr, arg);
291 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
292 ieee80211_check_scan_current(vap);
293 break;
294 case IEEE80211_S_RUN: /* beacon miss */
295 /*
296 * Beacon miss. Notify user space and if not
297 * under control of a user application (roaming
298 * manual) kick off a scan to re-connect.
299 */
300 ieee80211_sta_leave(ni);
301 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
302 ieee80211_check_scan_current(vap);
303 break;
304 default:
305 goto invalid;
306 }
307 break;
308 case IEEE80211_S_AUTH:
309 switch (ostate) {
310 case IEEE80211_S_INIT:
311 case IEEE80211_S_SCAN:
312 IEEE80211_SEND_MGMT(ni,
313 IEEE80211_FC0_SUBTYPE_AUTH, 1);
314 break;
315 case IEEE80211_S_AUTH:
316 case IEEE80211_S_ASSOC:
317 switch (arg & 0xff) {
318 case IEEE80211_FC0_SUBTYPE_AUTH:
319 /* ??? */
320 IEEE80211_SEND_MGMT(ni,
321 IEEE80211_FC0_SUBTYPE_AUTH, 2);
322 break;
323 case IEEE80211_FC0_SUBTYPE_DEAUTH:
324 sta_authretry(vap, ni, arg>>8);
325 break;
326 }
327 break;
328 case IEEE80211_S_RUN:
329 switch (arg & 0xff) {
330 case IEEE80211_FC0_SUBTYPE_AUTH:
331 IEEE80211_SEND_MGMT(ni,
332 IEEE80211_FC0_SUBTYPE_AUTH, 2);
333 vap->iv_state = ostate; /* stay RUN */
334 break;
335 case IEEE80211_FC0_SUBTYPE_DEAUTH:
336 ieee80211_sta_leave(ni);
337 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
338 /* try to reauth */
339 IEEE80211_SEND_MGMT(ni,
340 IEEE80211_FC0_SUBTYPE_AUTH, 1);
341 }
342 break;
343 }
344 break;
345 default:
346 goto invalid;
347 }
348 break;
349 case IEEE80211_S_ASSOC:
350 switch (ostate) {
351 case IEEE80211_S_AUTH:
352 case IEEE80211_S_ASSOC:
353 IEEE80211_SEND_MGMT(ni,
354 IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
355 break;
356 case IEEE80211_S_SLEEP: /* cannot happen */
357 case IEEE80211_S_RUN:
358 ieee80211_sta_leave(ni);
359 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
360 IEEE80211_SEND_MGMT(ni, arg ?
361 IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
362 IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
363 }
364 break;
365 default:
366 goto invalid;
367 }
368 break;
369 case IEEE80211_S_RUN:
370 if (vap->iv_flags & IEEE80211_F_WPA) {
371 /* XXX validate prerequisites */
372 }
373 switch (ostate) {
374 case IEEE80211_S_RUN:
375 case IEEE80211_S_CSA:
376 break;
377 case IEEE80211_S_AUTH: /* when join is done in fw */
378 case IEEE80211_S_ASSOC:
379 #ifdef IEEE80211_DEBUG
380 if (ieee80211_msg_debug(vap)) {
381 ieee80211_note(vap, "%s with %s ssid ",
382 (vap->iv_opmode == IEEE80211_M_STA ?
383 "associated" : "synchronized"),
384 ether_sprintf(ni->ni_bssid));
385 ieee80211_print_essid(vap->iv_bss->ni_essid,
386 ni->ni_esslen);
387 /* XXX MCS/HT */
388 printf(" channel %d start %uMb\n",
389 ieee80211_chan2ieee(ic, ic->ic_curchan),
390 IEEE80211_RATE2MBS(ni->ni_txrate));
391 }
392 #endif
393 ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
394 ieee80211_notify_node_join(ni,
395 arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
396 break;
397 case IEEE80211_S_SLEEP:
398 ieee80211_sta_pwrsave(vap, 0);
399 break;
400 default:
401 goto invalid;
402 }
403 ieee80211_sync_curchan(ic);
404 if (ostate != IEEE80211_S_RUN &&
405 (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)) {
406 /*
407 * Start s/w beacon miss timer for devices w/o
408 * hardware support. We fudge a bit here since
409 * we're doing this in software.
410 */
411 vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
412 2 * vap->iv_bmissthreshold * ni->ni_intval);
413 vap->iv_swbmiss_count = 0;
414 callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
415 ieee80211_swbmiss, vap);
416 }
417 /*
418 * When 802.1x is not in use mark the port authorized
419 * at this point so traffic can flow.
420 */
421 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
422 ieee80211_node_authorize(ni);
423 /*
424 * Fake association when joining an existing bss.
425 */
426 if (ic->ic_newassoc != NULL)
427 ic->ic_newassoc(vap->iv_bss, ostate != IEEE80211_S_RUN);
428 break;
429 case IEEE80211_S_CSA:
430 if (ostate != IEEE80211_S_RUN)
431 goto invalid;
432 break;
433 case IEEE80211_S_SLEEP:
434 ieee80211_sta_pwrsave(vap, 0);
435 break;
436 default:
437 invalid:
438 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
439 "%s: unexpected state transition %s -> %s\n", __func__,
440 ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
441 break;
442 }
443 return 0;
444 }
445
446 /*
447 * Return non-zero if the frame is an echo of a multicast
448 * frame sent by ourself. The dir is known to be DSTODS.
449 */
450 static __inline int
451 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
452 {
453 #define QWH4(wh) ((const struct ieee80211_qosframe_addr4 *)wh)
454 #define WH4(wh) ((const struct ieee80211_frame_addr4 *)wh)
455 const uint8_t *sa;
456
457 KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
458
459 if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
460 return 0;
461 sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
462 return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
463 #undef WH4
464 #undef QWH4
465 }
466
467 /*
468 * Return non-zero if the frame is an echo of a multicast
469 * frame sent by ourself. The dir is known to be FROMDS.
470 */
471 static __inline int
472 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
473 {
474 KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
475
476 if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
477 return 0;
478 return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
479 }
480
481 /*
482 * Decide if a received management frame should be
483 * printed when debugging is enabled. This filters some
484 * of the less interesting frames that come frequently
485 * (e.g. beacons).
486 */
487 static __inline int
488 doprint(struct ieee80211vap *vap, int subtype)
489 {
490 switch (subtype) {
491 case IEEE80211_FC0_SUBTYPE_BEACON:
492 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
493 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
494 return 0;
495 }
496 return 1;
497 }
498
499 /*
500 * Process a received frame. The node associated with the sender
501 * should be supplied. If nothing was found in the node table then
502 * the caller is assumed to supply a reference to iv_bss instead.
503 * The RSSI and a timestamp are also supplied. The RSSI data is used
504 * during AP scanning to select a AP to associate with; it can have
505 * any units so long as values have consistent units and higher values
506 * mean ``better signal''. The receive timestamp is currently not used
507 * by the 802.11 layer.
508 */
509 static int
510 sta_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
511 {
512 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0)
513 #define HAS_SEQ(type) ((type & 0x4) == 0)
514 struct ieee80211vap *vap = ni->ni_vap;
515 struct ieee80211com *ic = ni->ni_ic;
516 struct ifnet *ifp = vap->iv_ifp;
517 struct ieee80211_frame *wh;
518 struct ieee80211_key *key;
519 struct ether_header *eh;
520 int hdrspace, need_tap;
521 uint8_t dir, type, subtype, qos;
522 uint8_t *bssid;
523 uint16_t rxseq;
524
525 if (m->m_flags & M_AMPDU_MPDU) {
526 /*
527 * Fastpath for A-MPDU reorder q resubmission. Frames
528 * w/ M_AMPDU_MPDU marked have already passed through
529 * here but were received out of order and been held on
530 * the reorder queue. When resubmitted they are marked
531 * with the M_AMPDU_MPDU flag and we can bypass most of
532 * the normal processing.
533 */
534 wh = mtod(m, struct ieee80211_frame *);
535 type = IEEE80211_FC0_TYPE_DATA;
536 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
537 subtype = IEEE80211_FC0_SUBTYPE_QOS;
538 hdrspace = ieee80211_hdrspace(ic, wh); /* XXX optimize? */
539 goto resubmit_ampdu;
540 }
541
542 KASSERT(ni != NULL, ("null node"));
543 ni->ni_inact = ni->ni_inact_reload;
544
545 need_tap = 1; /* mbuf need to be tapped. */
546 type = -1; /* undefined */
547
548 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
549 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
550 ni->ni_macaddr, NULL,
551 "too short (1): len %u", m->m_pkthdr.len);
552 vap->iv_stats.is_rx_tooshort++;
553 goto out;
554 }
555 /*
556 * Bit of a cheat here, we use a pointer for a 3-address
557 * frame format but don't reference fields past outside
558 * ieee80211_frame_min w/o first validating the data is
559 * present.
560 */
561 wh = mtod(m, struct ieee80211_frame *);
562
563 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
564 IEEE80211_FC0_VERSION_0) {
565 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
566 ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
567 wh->i_fc[0], wh->i_fc[1]);
568 vap->iv_stats.is_rx_badversion++;
569 goto err;
570 }
571
572 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
573 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
574 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
575 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
576 bssid = wh->i_addr2;
577 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
578 /* not interested in */
579 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
580 bssid, NULL, "%s", "not to bss");
581 vap->iv_stats.is_rx_wrongbss++;
582 goto out;
583 }
584 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
585 ni->ni_noise = nf;
586 if (HAS_SEQ(type)) {
587 uint8_t tid = ieee80211_gettid(wh);
588 if (IEEE80211_QOS_HAS_SEQ(wh) &&
589 TID_TO_WME_AC(tid) >= WME_AC_VI)
590 ic->ic_wme.wme_hipri_traffic++;
591 rxseq = le16toh(*(uint16_t *)wh->i_seq);
592 if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
593 (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
594 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
595 /* duplicate, discard */
596 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
597 bssid, "duplicate",
598 "seqno <%u,%u> fragno <%u,%u> tid %u",
599 rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
600 ni->ni_rxseqs[tid] >>
601 IEEE80211_SEQ_SEQ_SHIFT,
602 rxseq & IEEE80211_SEQ_FRAG_MASK,
603 ni->ni_rxseqs[tid] &
604 IEEE80211_SEQ_FRAG_MASK,
605 tid);
606 vap->iv_stats.is_rx_dup++;
607 IEEE80211_NODE_STAT(ni, rx_dup);
608 goto out;
609 }
610 ni->ni_rxseqs[tid] = rxseq;
611 }
612 }
613
614 switch (type) {
615 case IEEE80211_FC0_TYPE_DATA:
616 hdrspace = ieee80211_hdrspace(ic, wh);
617 if (m->m_len < hdrspace &&
618 (m = m_pullup(m, hdrspace)) == NULL) {
619 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
620 ni->ni_macaddr, NULL,
621 "data too short: expecting %u", hdrspace);
622 vap->iv_stats.is_rx_tooshort++;
623 goto out; /* XXX */
624 }
625 /*
626 * Handle A-MPDU re-ordering. If the frame is to be
627 * processed directly then ieee80211_ampdu_reorder
628 * will return 0; otherwise it has consumed the mbuf
629 * and we should do nothing more with it.
630 */
631 if ((m->m_flags & M_AMPDU) &&
632 (dir == IEEE80211_FC1_DIR_FROMDS ||
633 dir == IEEE80211_FC1_DIR_DSTODS) &&
634 ieee80211_ampdu_reorder(ni, m) != 0) {
635 m = NULL;
636 goto out;
637 }
638 resubmit_ampdu:
639 if (dir == IEEE80211_FC1_DIR_FROMDS) {
640 if ((ifp->if_flags & IFF_SIMPLEX) &&
641 isfromds_mcastecho(vap, wh)) {
642 /*
643 * In IEEE802.11 network, multicast
644 * packets sent from "me" are broadcast
645 * from the AP; silently discard for
646 * SIMPLEX interface.
647 */
648 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
649 wh, "data", "%s", "multicast echo");
650 vap->iv_stats.is_rx_mcastecho++;
651 goto out;
652 }
653 if ((vap->iv_flags & IEEE80211_F_DWDS) &&
654 IEEE80211_IS_MULTICAST(wh->i_addr1)) {
655 /*
656 * DWDS sta's must drop 3-address mcast frames
657 * as they will be sent separately as a 4-addr
658 * frame. Accepting the 3-addr frame will
659 * confuse the bridge into thinking the sending
660 * sta is located at the end of WDS link.
661 */
662 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
663 "3-address data", "%s", "DWDS enabled");
664 vap->iv_stats.is_rx_mcastecho++;
665 goto out;
666 }
667 } else if (dir == IEEE80211_FC1_DIR_DSTODS) {
668 if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
669 IEEE80211_DISCARD(vap,
670 IEEE80211_MSG_INPUT, wh, "4-address data",
671 "%s", "DWDS not enabled");
672 vap->iv_stats.is_rx_wrongdir++;
673 goto out;
674 }
675 if ((ifp->if_flags & IFF_SIMPLEX) &&
676 isdstods_mcastecho(vap, wh)) {
677 /*
678 * In IEEE802.11 network, multicast
679 * packets sent from "me" are broadcast
680 * from the AP; silently discard for
681 * SIMPLEX interface.
682 */
683 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
684 "4-address data", "%s", "multicast echo");
685 vap->iv_stats.is_rx_mcastecho++;
686 goto out;
687 }
688 } else {
689 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
690 "data", "incorrect dir 0x%x", dir);
691 vap->iv_stats.is_rx_wrongdir++;
692 goto out;
693 }
694
695 /*
696 * Handle privacy requirements. Note that we
697 * must not be preempted from here until after
698 * we (potentially) call ieee80211_crypto_demic;
699 * otherwise we may violate assumptions in the
700 * crypto cipher modules used to do delayed update
701 * of replay sequence numbers.
702 */
703 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
704 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
705 /*
706 * Discard encrypted frames when privacy is off.
707 */
708 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
709 wh, "WEP", "%s", "PRIVACY off");
710 vap->iv_stats.is_rx_noprivacy++;
711 IEEE80211_NODE_STAT(ni, rx_noprivacy);
712 goto out;
713 }
714 key = ieee80211_crypto_decap(ni, m, hdrspace);
715 if (key == NULL) {
716 /* NB: stats+msgs handled in crypto_decap */
717 IEEE80211_NODE_STAT(ni, rx_wepfail);
718 goto out;
719 }
720 wh = mtod(m, struct ieee80211_frame *);
721 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
722 } else {
723 /* XXX M_WEP and IEEE80211_F_PRIVACY */
724 key = NULL;
725 }
726
727 /*
728 * Save QoS bits for use below--before we strip the header.
729 */
730 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
731 qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
732 ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
733 ((struct ieee80211_qosframe *)wh)->i_qos[0];
734 } else
735 qos = 0;
736
737 /*
738 * Next up, any fragmentation.
739 */
740 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
741 m = ieee80211_defrag(ni, m, hdrspace);
742 if (m == NULL) {
743 /* Fragment dropped or frame not complete yet */
744 goto out;
745 }
746 }
747 wh = NULL; /* no longer valid, catch any uses */
748
749 /*
750 * Next strip any MSDU crypto bits.
751 */
752 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
753 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
754 ni->ni_macaddr, "data", "%s", "demic error");
755 vap->iv_stats.is_rx_demicfail++;
756 IEEE80211_NODE_STAT(ni, rx_demicfail);
757 goto out;
758 }
759
760 /* copy to listener after decrypt */
761 if (ieee80211_radiotap_active_vap(vap))
762 ieee80211_radiotap_tx(vap, m);
763 need_tap = 0;
764
765 /*
766 * Finally, strip the 802.11 header.
767 */
768 m = ieee80211_decap(vap, m, hdrspace);
769 if (m == NULL) {
770 /* XXX mask bit to check for both */
771 /* don't count Null data frames as errors */
772 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
773 subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
774 goto out;
775 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
776 ni->ni_macaddr, "data", "%s", "decap error");
777 vap->iv_stats.is_rx_decap++;
778 IEEE80211_NODE_STAT(ni, rx_decap);
779 goto err;
780 }
781 eh = mtod(m, struct ether_header *);
782 if (!ieee80211_node_is_authorized(ni)) {
783 /*
784 * Deny any non-PAE frames received prior to
785 * authorization. For open/shared-key
786 * authentication the port is mark authorized
787 * after authentication completes. For 802.1x
788 * the port is not marked authorized by the
789 * authenticator until the handshake has completed.
790 */
791 if (eh->ether_type != htons(ETHERTYPE_PAE)) {
792 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
793 eh->ether_shost, "data",
794 "unauthorized port: ether type 0x%x len %u",
795 eh->ether_type, m->m_pkthdr.len);
796 vap->iv_stats.is_rx_unauth++;
797 IEEE80211_NODE_STAT(ni, rx_unauth);
798 goto err;
799 }
800 } else {
801 /*
802 * When denying unencrypted frames, discard
803 * any non-PAE frames received without encryption.
804 */
805 if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
806 (key == NULL && (m->m_flags & M_WEP) == 0) &&
807 eh->ether_type != htons(ETHERTYPE_PAE)) {
808 /*
809 * Drop unencrypted frames.
810 */
811 vap->iv_stats.is_rx_unencrypted++;
812 IEEE80211_NODE_STAT(ni, rx_unencrypted);
813 goto out;
814 }
815 }
816 /* XXX require HT? */
817 if (qos & IEEE80211_QOS_AMSDU) {
818 m = ieee80211_decap_amsdu(ni, m);
819 if (m == NULL)
820 return IEEE80211_FC0_TYPE_DATA;
821 } else {
822 #ifdef IEEE80211_SUPPORT_SUPERG
823 m = ieee80211_decap_fastframe(vap, ni, m);
824 if (m == NULL)
825 return IEEE80211_FC0_TYPE_DATA;
826 #endif
827 }
828 ieee80211_deliver_data(vap, ni, m);
829 return IEEE80211_FC0_TYPE_DATA;
830
831 case IEEE80211_FC0_TYPE_MGT:
832 vap->iv_stats.is_rx_mgmt++;
833 IEEE80211_NODE_STAT(ni, rx_mgmt);
834 if (dir != IEEE80211_FC1_DIR_NODS) {
835 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
836 wh, "data", "incorrect dir 0x%x", dir);
837 vap->iv_stats.is_rx_wrongdir++;
838 goto err;
839 }
840 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
841 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
842 ni->ni_macaddr, "mgt", "too short: len %u",
843 m->m_pkthdr.len);
844 vap->iv_stats.is_rx_tooshort++;
845 goto out;
846 }
847 #ifdef IEEE80211_DEBUG
848 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
849 ieee80211_msg_dumppkts(vap)) {
850 if_printf(ifp, "received %s from %s rssi %d\n",
851 ieee80211_mgt_subtype_name[subtype >>
852 IEEE80211_FC0_SUBTYPE_SHIFT],
853 ether_sprintf(wh->i_addr2), rssi);
854 }
855 #endif
856 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
857 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
858 /*
859 * Only shared key auth frames with a challenge
860 * should be encrypted, discard all others.
861 */
862 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
863 wh, ieee80211_mgt_subtype_name[subtype >>
864 IEEE80211_FC0_SUBTYPE_SHIFT],
865 "%s", "WEP set but not permitted");
866 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
867 goto out;
868 }
869 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
870 /*
871 * Discard encrypted frames when privacy is off.
872 */
873 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
874 wh, "mgt", "%s", "WEP set but PRIVACY off");
875 vap->iv_stats.is_rx_noprivacy++;
876 goto out;
877 }
878 hdrspace = ieee80211_hdrspace(ic, wh);
879 key = ieee80211_crypto_decap(ni, m, hdrspace);
880 if (key == NULL) {
881 /* NB: stats+msgs handled in crypto_decap */
882 goto out;
883 }
884 wh = mtod(m, struct ieee80211_frame *);
885 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
886 }
887 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
888 goto out;
889
890 case IEEE80211_FC0_TYPE_CTL:
891 vap->iv_stats.is_rx_ctl++;
892 IEEE80211_NODE_STAT(ni, rx_ctrl);
893 vap->iv_recv_ctl(ni, m, subtype);
894 goto out;
895
896 default:
897 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
898 wh, NULL, "bad frame type 0x%x", type);
899 /* should not come here */
900 break;
901 }
902 err:
903 ifp->if_ierrors++;
904 out:
905 if (m != NULL) {
906 if (need_tap && ieee80211_radiotap_active_vap(vap))
907 ieee80211_radiotap_rx(vap, m);
908 m_freem(m);
909 }
910 return type;
911 #undef SEQ_LEQ
912 }
913
914 static void
915 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
916 int rssi, int nf, uint16_t seq, uint16_t status)
917 {
918 struct ieee80211vap *vap = ni->ni_vap;
919
920 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
921 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
922 ni->ni_macaddr, "open auth",
923 "bad sta auth mode %u", ni->ni_authmode);
924 vap->iv_stats.is_rx_bad_auth++; /* XXX */
925 return;
926 }
927 if (vap->iv_state != IEEE80211_S_AUTH ||
928 seq != IEEE80211_AUTH_OPEN_RESPONSE) {
929 vap->iv_stats.is_rx_bad_auth++;
930 return;
931 }
932 if (status != 0) {
933 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
934 ni, "open auth failed (reason %d)", status);
935 vap->iv_stats.is_rx_auth_fail++;
936 vap->iv_stats.is_rx_authfail_code = status;
937 ieee80211_new_state(vap, IEEE80211_S_SCAN,
938 IEEE80211_SCAN_FAIL_STATUS);
939 } else
940 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
941 }
942
943 static void
944 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
945 uint8_t *frm, uint8_t *efrm, int rssi, int nf,
946 uint16_t seq, uint16_t status)
947 {
948 struct ieee80211vap *vap = ni->ni_vap;
949 uint8_t *challenge;
950 int estatus;
951
952 /*
953 * NB: this can happen as we allow pre-shared key
954 * authentication to be enabled w/o wep being turned
955 * on so that configuration of these can be done
956 * in any order. It may be better to enforce the
957 * ordering in which case this check would just be
958 * for sanity/consistency.
959 */
960 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
961 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
962 ni->ni_macaddr, "shared key auth",
963 "%s", " PRIVACY is disabled");
964 estatus = IEEE80211_STATUS_ALG;
965 goto bad;
966 }
967 /*
968 * Pre-shared key authentication is evil; accept
969 * it only if explicitly configured (it is supported
970 * mainly for compatibility with clients like OS X).
971 */
972 if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
973 ni->ni_authmode != IEEE80211_AUTH_SHARED) {
974 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
975 ni->ni_macaddr, "shared key auth",
976 "bad sta auth mode %u", ni->ni_authmode);
977 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
978 estatus = IEEE80211_STATUS_ALG;
979 goto bad;
980 }
981
982 challenge = NULL;
983 if (frm + 1 < efrm) {
984 if ((frm[1] + 2) > (efrm - frm)) {
985 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
986 ni->ni_macaddr, "shared key auth",
987 "ie %d/%d too long",
988 frm[0], (frm[1] + 2) - (efrm - frm));
989 vap->iv_stats.is_rx_bad_auth++;
990 estatus = IEEE80211_STATUS_CHALLENGE;
991 goto bad;
992 }
993 if (*frm == IEEE80211_ELEMID_CHALLENGE)
994 challenge = frm;
995 frm += frm[1] + 2;
996 }
997 switch (seq) {
998 case IEEE80211_AUTH_SHARED_CHALLENGE:
999 case IEEE80211_AUTH_SHARED_RESPONSE:
1000 if (challenge == NULL) {
1001 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1002 ni->ni_macaddr, "shared key auth",
1003 "%s", "no challenge");
1004 vap->iv_stats.is_rx_bad_auth++;
1005 estatus = IEEE80211_STATUS_CHALLENGE;
1006 goto bad;
1007 }
1008 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1009 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1010 ni->ni_macaddr, "shared key auth",
1011 "bad challenge len %d", challenge[1]);
1012 vap->iv_stats.is_rx_bad_auth++;
1013 estatus = IEEE80211_STATUS_CHALLENGE;
1014 goto bad;
1015 }
1016 default:
1017 break;
1018 }
1019 if (vap->iv_state != IEEE80211_S_AUTH)
1020 return;
1021 switch (seq) {
1022 case IEEE80211_AUTH_SHARED_PASS:
1023 if (ni->ni_challenge != NULL) {
1024 free(ni->ni_challenge, M_80211_NODE);
1025 ni->ni_challenge = NULL;
1026 }
1027 if (status != 0) {
1028 IEEE80211_NOTE_FRAME(vap,
1029 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
1030 "shared key auth failed (reason %d)", status);
1031 vap->iv_stats.is_rx_auth_fail++;
1032 vap->iv_stats.is_rx_authfail_code = status;
1033 return;
1034 }
1035 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1036 break;
1037 case IEEE80211_AUTH_SHARED_CHALLENGE:
1038 if (!ieee80211_alloc_challenge(ni))
1039 return;
1040 /* XXX could optimize by passing recvd challenge */
1041 memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1042 IEEE80211_SEND_MGMT(ni,
1043 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1044 break;
1045 default:
1046 IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1047 wh, "shared key auth", "bad seq %d", seq);
1048 vap->iv_stats.is_rx_bad_auth++;
1049 return;
1050 }
1051 return;
1052 bad:
1053 /*
1054 * Kick the state machine. This short-circuits
1055 * using the mgt frame timeout to trigger the
1056 * state transition.
1057 */
1058 if (vap->iv_state == IEEE80211_S_AUTH)
1059 ieee80211_new_state(vap, IEEE80211_S_SCAN,
1060 IEEE80211_SCAN_FAIL_STATUS);
1061 }
1062
1063 static int
1064 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
1065 const struct ieee80211_frame *wh)
1066 {
1067 #define MS(_v, _f) (((_v) & _f) >> _f##_S)
1068 struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
1069 u_int len = frm[1], qosinfo;
1070 int i;
1071
1072 if (len < sizeof(struct ieee80211_wme_param)-2) {
1073 IEEE80211_DISCARD_IE(vap,
1074 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1075 wh, "WME", "too short, len %u", len);
1076 return -1;
1077 }
1078 qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1079 qosinfo &= WME_QOSINFO_COUNT;
1080 /* XXX do proper check for wraparound */
1081 if (qosinfo == wme->wme_wmeChanParams.cap_info)
1082 return 0;
1083 frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1084 for (i = 0; i < WME_NUM_AC; i++) {
1085 struct wmeParams *wmep =
1086 &wme->wme_wmeChanParams.cap_wmeParams[i];
1087 /* NB: ACI not used */
1088 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1089 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1090 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1091 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1092 wmep->wmep_txopLimit = LE_READ_2(frm+2);
1093 frm += 4;
1094 }
1095 wme->wme_wmeChanParams.cap_info = qosinfo;
1096 return 1;
1097 #undef MS
1098 }
1099
1100 /*
1101 * Process 11h Channel Switch Announcement (CSA) ie. If this
1102 * is the first CSA then initiate the switch. Otherwise we
1103 * track state and trigger completion and/or cancel of the switch.
1104 * XXX should be public for IBSS use
1105 */
1106 static void
1107 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
1108 const struct ieee80211_frame *wh)
1109 {
1110 struct ieee80211com *ic = vap->iv_ic;
1111 const struct ieee80211_csa_ie *csa =
1112 (const struct ieee80211_csa_ie *) frm;
1113
1114 KASSERT(vap->iv_state >= IEEE80211_S_RUN,
1115 ("state %s", ieee80211_state_name[vap->iv_state]));
1116
1117 if (csa->csa_mode > 1) {
1118 IEEE80211_DISCARD_IE(vap,
1119 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1120 wh, "CSA", "invalid mode %u", csa->csa_mode);
1121 return;
1122 }
1123 IEEE80211_LOCK(ic);
1124 if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
1125 /*
1126 * Convert the channel number to a channel reference. We
1127 * try first to preserve turbo attribute of the current
1128 * channel then fallback. Note this will not work if the
1129 * CSA specifies a channel that requires a band switch (e.g.
1130 * 11a => 11g). This is intentional as 11h is defined only
1131 * for 5GHz/11a and because the switch does not involve a
1132 * reassociation, protocol state (capabilities, negotated
1133 * rates, etc) may/will be wrong.
1134 */
1135 struct ieee80211_channel *c =
1136 ieee80211_find_channel_byieee(ic, csa->csa_newchan,
1137 (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
1138 if (c == NULL) {
1139 c = ieee80211_find_channel_byieee(ic,
1140 csa->csa_newchan,
1141 (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
1142 if (c == NULL) {
1143 IEEE80211_DISCARD_IE(vap,
1144 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1145 wh, "CSA", "invalid channel %u",
1146 csa->csa_newchan);
1147 goto done;
1148 }
1149 }
1150 #if IEEE80211_CSA_COUNT_MIN > 0
1151 if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
1152 /*
1153 * Require at least IEEE80211_CSA_COUNT_MIN count to
1154 * reduce the risk of being redirected by a fabricated
1155 * CSA. If a valid CSA is dropped we'll still get a
1156 * beacon miss when the AP leaves the channel so we'll
1157 * eventually follow to the new channel.
1158 *
1159 * NOTE: this violates the 11h spec that states that
1160 * count may be any value and if 0 then a switch
1161 * should happen asap.
1162 */
1163 IEEE80211_DISCARD_IE(vap,
1164 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1165 wh, "CSA", "count %u too small, must be >= %u",
1166 csa->csa_count, IEEE80211_CSA_COUNT_MIN);
1167 goto done;
1168 }
1169 #endif
1170 ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
1171 } else {
1172 /*
1173 * Validate this ie against the initial CSA. We require
1174 * mode and channel not change and the count must be
1175 * monotonically decreasing. This may be pointless and
1176 * canceling the switch as a result may be too paranoid but
1177 * in the worst case if we drop out of CSA because of this
1178 * and the AP does move then we'll just end up taking a
1179 * beacon miss and scan to find the AP.
1180 *
1181 * XXX may want <= on count as we also process ProbeResp
1182 * frames and those may come in w/ the same count as the
1183 * previous beacon; but doing so leaves us open to a stuck
1184 * count until we add a dead-man timer
1185 */
1186 if (!(csa->csa_count < ic->ic_csa_count &&
1187 csa->csa_mode == ic->ic_csa_mode &&
1188 csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
1189 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
1190 "CSA ie mismatch, initial ie <%d,%d,%d>, "
1191 "this ie <%d,%d,%d>", ic->ic_csa_mode,
1192 ic->ic_csa_newchan, ic->ic_csa_count,
1193 csa->csa_mode, csa->csa_newchan, csa->csa_count);
1194 ieee80211_csa_cancelswitch(ic);
1195 } else {
1196 if (csa->csa_count <= 1)
1197 ieee80211_csa_completeswitch(ic);
1198 else
1199 ic->ic_csa_count = csa->csa_count;
1200 }
1201 }
1202 done:
1203 IEEE80211_UNLOCK(ic);
1204 }
1205
1206 /*
1207 * Return non-zero if a background scan may be continued:
1208 * o bg scan is active
1209 * o no channel switch is pending
1210 * o there has not been any traffic recently
1211 *
1212 * Note we do not check if there is an administrative enable;
1213 * this is only done to start the scan. We assume that any
1214 * change in state will be accompanied by a request to cancel
1215 * active scans which will otherwise cause this test to fail.
1216 */
1217 static __inline int
1218 contbgscan(struct ieee80211vap *vap)
1219 {
1220 struct ieee80211com *ic = vap->iv_ic;
1221
1222 return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1223 (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1224 vap->iv_state == IEEE80211_S_RUN && /* XXX? */
1225 time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1226 }
1227
1228 /*
1229 * Return non-zero if a backgrond scan may be started:
1230 * o bg scanning is administratively enabled
1231 * o no channel switch is pending
1232 * o we are not boosted on a dynamic turbo channel
1233 * o there has not been a scan recently
1234 * o there has not been any traffic recently
1235 */
1236 static __inline int
1237 startbgscan(struct ieee80211vap *vap)
1238 {
1239 struct ieee80211com *ic = vap->iv_ic;
1240
1241 return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
1242 (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1243 #ifdef IEEE80211_SUPPORT_SUPERG
1244 !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1245 #endif
1246 time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
1247 time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1248 }
1249
1250 static void
1251 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1252 int subtype, int rssi, int nf)
1253 {
1254 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1255 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1256 struct ieee80211vap *vap = ni->ni_vap;
1257 struct ieee80211com *ic = ni->ni_ic;
1258 struct ieee80211_frame *wh;
1259 uint8_t *frm, *efrm;
1260 uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
1261 uint8_t rate;
1262
1263 wh = mtod(m0, struct ieee80211_frame *);
1264 frm = (uint8_t *)&wh[1];
1265 efrm = mtod(m0, uint8_t *) + m0->m_len;
1266 switch (subtype) {
1267 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1268 case IEEE80211_FC0_SUBTYPE_BEACON: {
1269 struct ieee80211_scanparams scan;
1270 /*
1271 * We process beacon/probe response frames:
1272 * o when scanning, or
1273 * o station mode when associated (to collect state
1274 * updates such as 802.11g slot time)
1275 * Frames otherwise received are discarded.
1276 */
1277 if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
1278 vap->iv_stats.is_rx_mgtdiscard++;
1279 return;
1280 }
1281 /* XXX probe response in sta mode when !scanning? */
1282 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
1283 return;
1284 /*
1285 * Count frame now that we know it's to be processed.
1286 */
1287 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1288 vap->iv_stats.is_rx_beacon++; /* XXX remove */
1289 IEEE80211_NODE_STAT(ni, rx_beacons);
1290 } else
1291 IEEE80211_NODE_STAT(ni, rx_proberesp);
1292 /*
1293 * When operating in station mode, check for state updates.
1294 * Be careful to ignore beacons received while doing a
1295 * background scan. We consider only 11g/WMM stuff right now.
1296 */
1297 if (ni->ni_associd != 0 &&
1298 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1299 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1300 /* record tsf of last beacon */
1301 memcpy(ni->ni_tstamp.data, scan.tstamp,
1302 sizeof(ni->ni_tstamp));
1303 /* count beacon frame for s/w bmiss handling */
1304 vap->iv_swbmiss_count++;
1305 vap->iv_bmiss_count = 0;
1306 if (ni->ni_erp != scan.erp) {
1307 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1308 wh->i_addr2,
1309 "erp change: was 0x%x, now 0x%x",
1310 ni->ni_erp, scan.erp);
1311 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1312 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1313 ic->ic_flags |= IEEE80211_F_USEPROT;
1314 else
1315 ic->ic_flags &= ~IEEE80211_F_USEPROT;
1316 ni->ni_erp = scan.erp;
1317 /* XXX statistic */
1318 /* XXX driver notification */
1319 }
1320 if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1321 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1322 wh->i_addr2,
1323 "capabilities change: was 0x%x, now 0x%x",
1324 ni->ni_capinfo, scan.capinfo);
1325 /*
1326 * NB: we assume short preamble doesn't
1327 * change dynamically
1328 */
1329 ieee80211_set_shortslottime(ic,
1330 IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
1331 (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1332 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
1333 | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
1334 /* XXX statistic */
1335 }
1336 if (scan.wme != NULL &&
1337 (ni->ni_flags & IEEE80211_NODE_QOS) &&
1338 ieee80211_parse_wmeparams(vap, scan.wme, wh) > 0)
1339 ieee80211_wme_updateparams(vap);
1340 #ifdef IEEE80211_SUPPORT_SUPERG
1341 if (scan.ath != NULL)
1342 ieee80211_parse_athparams(ni, scan.ath, wh);
1343 #endif
1344 if (scan.htcap != NULL && scan.htinfo != NULL &&
1345 (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1346 ieee80211_ht_updateparams(ni,
1347 scan.htcap, scan.htinfo);
1348 /* XXX state changes? */
1349 }
1350 if (scan.tim != NULL) {
1351 struct ieee80211_tim_ie *tim =
1352 (struct ieee80211_tim_ie *) scan.tim;
1353 #if 0
1354 int aid = IEEE80211_AID(ni->ni_associd);
1355 int ix = aid / NBBY;
1356 int min = tim->tim_bitctl &~ 1;
1357 int max = tim->tim_len + min - 4;
1358 if ((tim->tim_bitctl&1) ||
1359 (min <= ix && ix <= max &&
1360 isset(tim->tim_bitmap - min, aid))) {
1361 /*
1362 * XXX Do not let bg scan kick off
1363 * we are expecting data.
1364 */
1365 ic->ic_lastdata = ticks;
1366 ieee80211_sta_pwrsave(vap, 0);
1367 }
1368 #endif
1369 ni->ni_dtim_count = tim->tim_count;
1370 ni->ni_dtim_period = tim->tim_period;
1371 }
1372 if (scan.csa != NULL &&
1373 (vap->iv_flags & IEEE80211_F_DOTH))
1374 ieee80211_parse_csaparams(vap, scan.csa, wh);
1375 else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
1376 /*
1377 * No CSA ie or 11h disabled, but a channel
1378 * switch is pending; drop out so we aren't
1379 * stuck in CSA state. If the AP really is
1380 * moving we'll get a beacon miss and scan.
1381 */
1382 IEEE80211_LOCK(ic);
1383 ieee80211_csa_cancelswitch(ic);
1384 IEEE80211_UNLOCK(ic);
1385 }
1386 /*
1387 * If scanning, pass the info to the scan module.
1388 * Otherwise, check if it's the right time to do
1389 * a background scan. Background scanning must
1390 * be enabled and we must not be operating in the
1391 * turbo phase of dynamic turbo mode. Then,
1392 * it's been a while since the last background
1393 * scan and if no data frames have come through
1394 * recently, kick off a scan. Note that this
1395 * is the mechanism by which a background scan
1396 * is started _and_ continued each time we
1397 * return on-channel to receive a beacon from
1398 * our ap.
1399 */
1400 if (ic->ic_flags & IEEE80211_F_SCAN) {
1401 ieee80211_add_scan(vap, &scan, wh,
1402 subtype, rssi, nf);
1403 } else if (contbgscan(vap)) {
1404 ieee80211_bg_scan(vap, 0);
1405 } else if (startbgscan(vap)) {
1406 vap->iv_stats.is_scan_bg++;
1407 #if 0
1408 /* wakeup if we are sleeing */
1409 ieee80211_set_pwrsave(vap, 0);
1410 #endif
1411 ieee80211_bg_scan(vap, 0);
1412 }
1413 return;
1414 }
1415 /*
1416 * If scanning, just pass information to the scan module.
1417 */
1418 if (ic->ic_flags & IEEE80211_F_SCAN) {
1419 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1420 /*
1421 * Actively scanning a channel marked passive;
1422 * send a probe request now that we know there
1423 * is 802.11 traffic present.
1424 *
1425 * XXX check if the beacon we recv'd gives
1426 * us what we need and suppress the probe req
1427 */
1428 ieee80211_probe_curchan(vap, 1);
1429 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1430 }
1431 ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1432 return;
1433 }
1434 break;
1435 }
1436
1437 case IEEE80211_FC0_SUBTYPE_AUTH: {
1438 uint16_t algo, seq, status;
1439 /*
1440 * auth frame format
1441 * [2] algorithm
1442 * [2] sequence
1443 * [2] status
1444 * [tlv*] challenge
1445 */
1446 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1447 algo = le16toh(*(uint16_t *)frm);
1448 seq = le16toh(*(uint16_t *)(frm + 2));
1449 status = le16toh(*(uint16_t *)(frm + 4));
1450 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1451 "recv auth frame with algorithm %d seq %d", algo, seq);
1452
1453 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1454 IEEE80211_DISCARD(vap,
1455 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1456 wh, "auth", "%s", "TKIP countermeasures enabled");
1457 vap->iv_stats.is_rx_auth_countermeasures++;
1458 if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1459 ieee80211_send_error(ni, wh->i_addr2,
1460 IEEE80211_FC0_SUBTYPE_AUTH,
1461 IEEE80211_REASON_MIC_FAILURE);
1462 }
1463 return;
1464 }
1465 if (algo == IEEE80211_AUTH_ALG_SHARED)
1466 sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1467 seq, status);
1468 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1469 sta_auth_open(ni, wh, rssi, nf, seq, status);
1470 else {
1471 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1472 wh, "auth", "unsupported alg %d", algo);
1473 vap->iv_stats.is_rx_auth_unsupported++;
1474 return;
1475 }
1476 break;
1477 }
1478
1479 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1480 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
1481 uint16_t capinfo, associd;
1482 uint16_t status;
1483
1484 if (vap->iv_state != IEEE80211_S_ASSOC) {
1485 vap->iv_stats.is_rx_mgtdiscard++;
1486 return;
1487 }
1488
1489 /*
1490 * asresp frame format
1491 * [2] capability information
1492 * [2] status
1493 * [2] association ID
1494 * [tlv] supported rates
1495 * [tlv] extended supported rates
1496 * [tlv] WME
1497 * [tlv] HT capabilities
1498 * [tlv] HT info
1499 */
1500 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1501 ni = vap->iv_bss;
1502 capinfo = le16toh(*(uint16_t *)frm);
1503 frm += 2;
1504 status = le16toh(*(uint16_t *)frm);
1505 frm += 2;
1506 if (status != 0) {
1507 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1508 wh->i_addr2, "%sassoc failed (reason %d)",
1509 ISREASSOC(subtype) ? "re" : "", status);
1510 vap->iv_stats.is_rx_auth_fail++; /* XXX */
1511 return;
1512 }
1513 associd = le16toh(*(uint16_t *)frm);
1514 frm += 2;
1515
1516 rates = xrates = wme = htcap = htinfo = NULL;
1517 while (efrm - frm > 1) {
1518 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1519 switch (*frm) {
1520 case IEEE80211_ELEMID_RATES:
1521 rates = frm;
1522 break;
1523 case IEEE80211_ELEMID_XRATES:
1524 xrates = frm;
1525 break;
1526 case IEEE80211_ELEMID_HTCAP:
1527 htcap = frm;
1528 break;
1529 case IEEE80211_ELEMID_HTINFO:
1530 htinfo = frm;
1531 break;
1532 case IEEE80211_ELEMID_VENDOR:
1533 if (iswmeoui(frm))
1534 wme = frm;
1535 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
1536 /*
1537 * Accept pre-draft HT ie's if the
1538 * standard ones have not been seen.
1539 */
1540 if (ishtcapoui(frm)) {
1541 if (htcap == NULL)
1542 htcap = frm;
1543 } else if (ishtinfooui(frm)) {
1544 if (htinfo == NULL)
1545 htcap = frm;
1546 }
1547 }
1548 /* XXX Atheros OUI support */
1549 break;
1550 }
1551 frm += frm[1] + 2;
1552 }
1553
1554 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1555 if (xrates != NULL)
1556 IEEE80211_VERIFY_ELEMENT(xrates,
1557 IEEE80211_RATE_MAXSIZE - rates[1], return);
1558 rate = ieee80211_setup_rates(ni, rates, xrates,
1559 IEEE80211_F_JOIN |
1560 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1561 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1562 if (rate & IEEE80211_RATE_BASIC) {
1563 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1564 wh->i_addr2,
1565 "%sassoc failed (rate set mismatch)",
1566 ISREASSOC(subtype) ? "re" : "");
1567 vap->iv_stats.is_rx_assoc_norate++;
1568 ieee80211_new_state(vap, IEEE80211_S_SCAN,
1569 IEEE80211_SCAN_FAIL_STATUS);
1570 return;
1571 }
1572
1573 ni->ni_capinfo = capinfo;
1574 ni->ni_associd = associd;
1575 if (ni->ni_jointime == 0)
1576 ni->ni_jointime = time_uptime;
1577 if (wme != NULL &&
1578 ieee80211_parse_wmeparams(vap, wme, wh) >= 0) {
1579 ni->ni_flags |= IEEE80211_NODE_QOS;
1580 ieee80211_wme_updateparams(vap);
1581 } else
1582 ni->ni_flags &= ~IEEE80211_NODE_QOS;
1583 /*
1584 * Setup HT state according to the negotiation.
1585 *
1586 * NB: shouldn't need to check if HT use is enabled but some
1587 * ap's send back HT ie's even when we don't indicate we
1588 * are HT capable in our AssocReq.
1589 */
1590 if (htcap != NULL && htinfo != NULL &&
1591 (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1592 ieee80211_ht_node_init(ni);
1593 ieee80211_ht_updateparams(ni, htcap, htinfo);
1594 ieee80211_setup_htrates(ni, htcap,
1595 IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
1596 ieee80211_setup_basic_htrates(ni, htinfo);
1597 ieee80211_node_setuptxparms(ni);
1598 } else {
1599 #ifdef IEEE80211_SUPPORT_SUPERG
1600 if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_ATH))
1601 ieee80211_ff_node_init(ni);
1602 #endif
1603 }
1604 /*
1605 * Configure state now that we are associated.
1606 *
1607 * XXX may need different/additional driver callbacks?
1608 */
1609 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1610 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1611 ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1612 ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1613 } else {
1614 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1615 ic->ic_flags |= IEEE80211_F_USEBARKER;
1616 }
1617 ieee80211_set_shortslottime(ic,
1618 IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1619 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1620 /*
1621 * Honor ERP protection.
1622 *
1623 * NB: ni_erp should zero for non-11g operation.
1624 */
1625 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1626 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1627 ic->ic_flags |= IEEE80211_F_USEPROT;
1628 else
1629 ic->ic_flags &= ~IEEE80211_F_USEPROT;
1630 IEEE80211_NOTE_MAC(vap,
1631 IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
1632 "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s",
1633 ISREASSOC(subtype) ? "re" : "",
1634 IEEE80211_NODE_AID(ni),
1635 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1636 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1637 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1638 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
1639 ni->ni_flags & IEEE80211_NODE_HT ?
1640 (ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
1641 ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
1642 ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
1643 ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
1644 ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
1645 IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
1646 ", fast-frames" : "",
1647 IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
1648 ", turbo" : ""
1649 );
1650 ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
1651 break;
1652 }
1653
1654 case IEEE80211_FC0_SUBTYPE_DEAUTH: {
1655 uint16_t reason;
1656
1657 if (vap->iv_state == IEEE80211_S_SCAN) {
1658 vap->iv_stats.is_rx_mgtdiscard++;
1659 return;
1660 }
1661 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1662 /* NB: can happen when in promiscuous mode */
1663 vap->iv_stats.is_rx_mgtdiscard++;
1664 break;
1665 }
1666
1667 /*
1668 * deauth frame format
1669 * [2] reason
1670 */
1671 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1672 reason = le16toh(*(uint16_t *)frm);
1673
1674 vap->iv_stats.is_rx_deauth++;
1675 vap->iv_stats.is_rx_deauth_code = reason;
1676 IEEE80211_NODE_STAT(ni, rx_deauth);
1677
1678 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1679 "recv deauthenticate (reason %d)", reason);
1680 ieee80211_new_state(vap, IEEE80211_S_AUTH,
1681 (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
1682 break;
1683 }
1684
1685 case IEEE80211_FC0_SUBTYPE_DISASSOC: {
1686 uint16_t reason;
1687
1688 if (vap->iv_state != IEEE80211_S_RUN &&
1689 vap->iv_state != IEEE80211_S_ASSOC &&
1690 vap->iv_state != IEEE80211_S_AUTH) {
1691 vap->iv_stats.is_rx_mgtdiscard++;
1692 return;
1693 }
1694 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1695 /* NB: can happen when in promiscuous mode */
1696 vap->iv_stats.is_rx_mgtdiscard++;
1697 break;
1698 }
1699
1700 /*
1701 * disassoc frame format
1702 * [2] reason
1703 */
1704 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1705 reason = le16toh(*(uint16_t *)frm);
1706
1707 vap->iv_stats.is_rx_disassoc++;
1708 vap->iv_stats.is_rx_disassoc_code = reason;
1709 IEEE80211_NODE_STAT(ni, rx_disassoc);
1710
1711 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1712 "recv disassociate (reason %d)", reason);
1713 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1714 break;
1715 }
1716
1717 case IEEE80211_FC0_SUBTYPE_ACTION:
1718 if (vap->iv_state == IEEE80211_S_RUN) {
1719 if (ieee80211_parse_action(ni, m0) == 0)
1720 ic->ic_recv_action(ni, wh, frm, efrm);
1721 } else
1722 vap->iv_stats.is_rx_mgtdiscard++;
1723 break;
1724
1725 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1726 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1727 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1728 vap->iv_stats.is_rx_mgtdiscard++;
1729 return;
1730 default:
1731 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1732 wh, "mgt", "subtype 0x%x not handled", subtype);
1733 vap->iv_stats.is_rx_badsubtype++;
1734 break;
1735 }
1736 #undef ISREASSOC
1737 #undef ISPROBE
1738 }
1739
1740 static void
1741 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m0, int subtype)
1742 {
1743 }
Cache object: 4bd3832b838edd83fbeb21bcb869ec5d
|