416 if (err) {
417 /* NB: IFQ_HANDOFF reclaims mcopy */
418 } else {
419 ifp->if_opackets++;
420 }
421 }
422 }
423 if (m != NULL) {
424 /*
425 * Mark frame as coming from vap's interface.
426 */
427 m->m_pkthdr.rcvif = ifp;
428 if (m->m_flags & M_MCAST) {
429 /*
430 * Spam DWDS vap's w/ multicast traffic.
431 */
432 /* XXX only if dwds in use? */
433 ieee80211_dwds_mcast(vap, m);
434 }
435 if (ni->ni_vlan != 0) {
436 /* attach vlan tag */
437 m->m_pkthdr.ether_vtag = ni->ni_vlan;
438 m->m_flags |= M_VLANTAG;
439 }
440 ifp->if_input(ifp, m);
441 }
442}
443
444/*
445 * Decide if a received management frame should be
446 * printed when debugging is enabled. This filters some
447 * of the less interesting frames that come frequently
448 * (e.g. beacons).
449 */
450static __inline int
451doprint(struct ieee80211vap *vap, int subtype)
452{
453 switch (subtype) {
454 case IEEE80211_FC0_SUBTYPE_BEACON:
455 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
456 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
457 return 0;
458 }
459 return 1;
460}
461
462/*
463 * Process a received frame. The node associated with the sender
464 * should be supplied. If nothing was found in the node table then
465 * the caller is assumed to supply a reference to iv_bss instead.
466 * The RSSI and a timestamp are also supplied. The RSSI data is used
467 * during AP scanning to select a AP to associate with; it can have
468 * any units so long as values have consistent units and higher values
469 * mean ``better signal''. The receive timestamp is currently not used
470 * by the 802.11 layer.
471 */
472static int
473hostap_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
474{
475#define HAS_SEQ(type) ((type & 0x4) == 0)
476 struct ieee80211vap *vap = ni->ni_vap;
477 struct ieee80211com *ic = ni->ni_ic;
478 struct ifnet *ifp = vap->iv_ifp;
479 struct ieee80211_frame *wh;
480 struct ieee80211_key *key;
481 struct ether_header *eh;
482 int hdrspace, need_tap = 1; /* mbuf need to be tapped. */
483 uint8_t dir, type, subtype, qos;
484 uint8_t *bssid;
485 uint16_t rxseq;
486
487 if (m->m_flags & M_AMPDU_MPDU) {
488 /*
489 * Fastpath for A-MPDU reorder q resubmission. Frames
490 * w/ M_AMPDU_MPDU marked have already passed through
491 * here but were received out of order and been held on
492 * the reorder queue. When resubmitted they are marked
493 * with the M_AMPDU_MPDU flag and we can bypass most of
494 * the normal processing.
495 */
496 wh = mtod(m, struct ieee80211_frame *);
497 type = IEEE80211_FC0_TYPE_DATA;
498 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
499 subtype = IEEE80211_FC0_SUBTYPE_QOS;
500 hdrspace = ieee80211_hdrspace(ic, wh); /* XXX optimize? */
501 goto resubmit_ampdu;
502 }
503
504 KASSERT(ni != NULL, ("null node"));
505 ni->ni_inact = ni->ni_inact_reload;
506
507 type = -1; /* undefined */
508
509 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
510 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
511 ni->ni_macaddr, NULL,
512 "too short (1): len %u", m->m_pkthdr.len);
513 vap->iv_stats.is_rx_tooshort++;
514 goto out;
515 }
516 /*
517 * Bit of a cheat here, we use a pointer for a 3-address
518 * frame format but don't reference fields past outside
519 * ieee80211_frame_min w/o first validating the data is
520 * present.
521 */
522 wh = mtod(m, struct ieee80211_frame *);
523
524 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
525 IEEE80211_FC0_VERSION_0) {
526 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
527 ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
528 wh->i_fc[0], wh->i_fc[1]);
529 vap->iv_stats.is_rx_badversion++;
530 goto err;
531 }
532
533 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
534 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
535 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
536 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
537 if (dir != IEEE80211_FC1_DIR_NODS)
538 bssid = wh->i_addr1;
539 else if (type == IEEE80211_FC0_TYPE_CTL)
540 bssid = wh->i_addr1;
541 else {
542 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
543 IEEE80211_DISCARD_MAC(vap,
544 IEEE80211_MSG_ANY, ni->ni_macaddr,
545 NULL, "too short (2): len %u",
546 m->m_pkthdr.len);
547 vap->iv_stats.is_rx_tooshort++;
548 goto out;
549 }
550 bssid = wh->i_addr3;
551 }
552 /*
553 * Validate the bssid.
554 */
555 if (!(type == IEEE80211_FC0_TYPE_MGT &&
556 subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
557 !IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
558 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
559 /* not interested in */
560 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
561 bssid, NULL, "%s", "not to bss");
562 vap->iv_stats.is_rx_wrongbss++;
563 goto out;
564 }
565
566 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
567 ni->ni_noise = nf;
568 if (HAS_SEQ(type)) {
569 uint8_t tid = ieee80211_gettid(wh);
570 if (IEEE80211_QOS_HAS_SEQ(wh) &&
571 TID_TO_WME_AC(tid) >= WME_AC_VI)
572 ic->ic_wme.wme_hipri_traffic++;
573 rxseq = le16toh(*(uint16_t *)wh->i_seq);
574 if (! ieee80211_check_rxseq(ni, wh)) {
575 /* duplicate, discard */
576 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
577 bssid, "duplicate",
578 "seqno <%u,%u> fragno <%u,%u> tid %u",
579 rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
580 ni->ni_rxseqs[tid] >>
581 IEEE80211_SEQ_SEQ_SHIFT,
582 rxseq & IEEE80211_SEQ_FRAG_MASK,
583 ni->ni_rxseqs[tid] &
584 IEEE80211_SEQ_FRAG_MASK,
585 tid);
586 vap->iv_stats.is_rx_dup++;
587 IEEE80211_NODE_STAT(ni, rx_dup);
588 goto out;
589 }
590 ni->ni_rxseqs[tid] = rxseq;
591 }
592 }
593
594 switch (type) {
595 case IEEE80211_FC0_TYPE_DATA:
596 hdrspace = ieee80211_hdrspace(ic, wh);
597 if (m->m_len < hdrspace &&
598 (m = m_pullup(m, hdrspace)) == NULL) {
599 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
600 ni->ni_macaddr, NULL,
601 "data too short: expecting %u", hdrspace);
602 vap->iv_stats.is_rx_tooshort++;
603 goto out; /* XXX */
604 }
605 if (!(dir == IEEE80211_FC1_DIR_TODS ||
606 (dir == IEEE80211_FC1_DIR_DSTODS &&
607 (vap->iv_flags & IEEE80211_F_DWDS)))) {
608 if (dir != IEEE80211_FC1_DIR_DSTODS) {
609 IEEE80211_DISCARD(vap,
610 IEEE80211_MSG_INPUT, wh, "data",
611 "incorrect dir 0x%x", dir);
612 } else {
613 IEEE80211_DISCARD(vap,
614 IEEE80211_MSG_INPUT |
615 IEEE80211_MSG_WDS, wh,
616 "4-address data",
617 "%s", "DWDS not enabled");
618 }
619 vap->iv_stats.is_rx_wrongdir++;
620 goto out;
621 }
622 /* check if source STA is associated */
623 if (ni == vap->iv_bss) {
624 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
625 wh, "data", "%s", "unknown src");
626 ieee80211_send_error(ni, wh->i_addr2,
627 IEEE80211_FC0_SUBTYPE_DEAUTH,
628 IEEE80211_REASON_NOT_AUTHED);
629 vap->iv_stats.is_rx_notassoc++;
630 goto err;
631 }
632 if (ni->ni_associd == 0) {
633 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
634 wh, "data", "%s", "unassoc src");
635 IEEE80211_SEND_MGMT(ni,
636 IEEE80211_FC0_SUBTYPE_DISASSOC,
637 IEEE80211_REASON_NOT_ASSOCED);
638 vap->iv_stats.is_rx_notassoc++;
639 goto err;
640 }
641
642 /*
643 * Check for power save state change.
644 * XXX out-of-order A-MPDU frames?
645 */
646 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
647 (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
648 vap->iv_node_ps(ni,
649 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
650 /*
651 * For 4-address packets handle WDS discovery
652 * notifications. Once a WDS link is setup frames
653 * are just delivered to the WDS vap (see below).
654 */
655 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap == NULL) {
656 if (!ieee80211_node_is_authorized(ni)) {
657 IEEE80211_DISCARD(vap,
658 IEEE80211_MSG_INPUT |
659 IEEE80211_MSG_WDS, wh,
660 "4-address data",
661 "%s", "unauthorized port");
662 vap->iv_stats.is_rx_unauth++;
663 IEEE80211_NODE_STAT(ni, rx_unauth);
664 goto err;
665 }
666 ieee80211_dwds_discover(ni, m);
667 return type;
668 }
669
670 /*
671 * Handle A-MPDU re-ordering. If the frame is to be
672 * processed directly then ieee80211_ampdu_reorder
673 * will return 0; otherwise it has consumed the mbuf
674 * and we should do nothing more with it.
675 */
676 if ((m->m_flags & M_AMPDU) &&
677 ieee80211_ampdu_reorder(ni, m) != 0) {
678 m = NULL;
679 goto out;
680 }
681 resubmit_ampdu:
682
683 /*
684 * Handle privacy requirements. Note that we
685 * must not be preempted from here until after
686 * we (potentially) call ieee80211_crypto_demic;
687 * otherwise we may violate assumptions in the
688 * crypto cipher modules used to do delayed update
689 * of replay sequence numbers.
690 */
691 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
692 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
693 /*
694 * Discard encrypted frames when privacy is off.
695 */
696 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
697 wh, "WEP", "%s", "PRIVACY off");
698 vap->iv_stats.is_rx_noprivacy++;
699 IEEE80211_NODE_STAT(ni, rx_noprivacy);
700 goto out;
701 }
702 key = ieee80211_crypto_decap(ni, m, hdrspace);
703 if (key == NULL) {
704 /* NB: stats+msgs handled in crypto_decap */
705 IEEE80211_NODE_STAT(ni, rx_wepfail);
706 goto out;
707 }
708 wh = mtod(m, struct ieee80211_frame *);
709 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
710 } else {
711 /* XXX M_WEP and IEEE80211_F_PRIVACY */
712 key = NULL;
713 }
714
715 /*
716 * Save QoS bits for use below--before we strip the header.
717 */
718 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
719 qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
720 ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
721 ((struct ieee80211_qosframe *)wh)->i_qos[0];
722 } else
723 qos = 0;
724
725 /*
726 * Next up, any fragmentation.
727 */
728 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
729 m = ieee80211_defrag(ni, m, hdrspace);
730 if (m == NULL) {
731 /* Fragment dropped or frame not complete yet */
732 goto out;
733 }
734 }
735 wh = NULL; /* no longer valid, catch any uses */
736
737 /*
738 * Next strip any MSDU crypto bits.
739 */
740 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
741 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
742 ni->ni_macaddr, "data", "%s", "demic error");
743 vap->iv_stats.is_rx_demicfail++;
744 IEEE80211_NODE_STAT(ni, rx_demicfail);
745 goto out;
746 }
747 /* copy to listener after decrypt */
748 if (ieee80211_radiotap_active_vap(vap))
749 ieee80211_radiotap_rx(vap, m);
750 need_tap = 0;
751 /*
752 * Finally, strip the 802.11 header.
753 */
754 m = ieee80211_decap(vap, m, hdrspace);
755 if (m == NULL) {
756 /* XXX mask bit to check for both */
757 /* don't count Null data frames as errors */
758 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
759 subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
760 goto out;
761 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
762 ni->ni_macaddr, "data", "%s", "decap error");
763 vap->iv_stats.is_rx_decap++;
764 IEEE80211_NODE_STAT(ni, rx_decap);
765 goto err;
766 }
767 eh = mtod(m, struct ether_header *);
768 if (!ieee80211_node_is_authorized(ni)) {
769 /*
770 * Deny any non-PAE frames received prior to
771 * authorization. For open/shared-key
772 * authentication the port is mark authorized
773 * after authentication completes. For 802.1x
774 * the port is not marked authorized by the
775 * authenticator until the handshake has completed.
776 */
777 if (eh->ether_type != htons(ETHERTYPE_PAE)) {
778 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
779 eh->ether_shost, "data",
780 "unauthorized port: ether type 0x%x len %u",
781 eh->ether_type, m->m_pkthdr.len);
782 vap->iv_stats.is_rx_unauth++;
783 IEEE80211_NODE_STAT(ni, rx_unauth);
784 goto err;
785 }
786 } else {
787 /*
788 * When denying unencrypted frames, discard
789 * any non-PAE frames received without encryption.
790 */
791 if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
792 (key == NULL && (m->m_flags & M_WEP) == 0) &&
793 eh->ether_type != htons(ETHERTYPE_PAE)) {
794 /*
795 * Drop unencrypted frames.
796 */
797 vap->iv_stats.is_rx_unencrypted++;
798 IEEE80211_NODE_STAT(ni, rx_unencrypted);
799 goto out;
800 }
801 }
802 /* XXX require HT? */
803 if (qos & IEEE80211_QOS_AMSDU) {
804 m = ieee80211_decap_amsdu(ni, m);
805 if (m == NULL)
806 return IEEE80211_FC0_TYPE_DATA;
807 } else {
808#ifdef IEEE80211_SUPPORT_SUPERG
809 m = ieee80211_decap_fastframe(vap, ni, m);
810 if (m == NULL)
811 return IEEE80211_FC0_TYPE_DATA;
812#endif
813 }
814 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
815 ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
816 else
817 hostap_deliver_data(vap, ni, m);
818 return IEEE80211_FC0_TYPE_DATA;
819
820 case IEEE80211_FC0_TYPE_MGT:
821 vap->iv_stats.is_rx_mgmt++;
822 IEEE80211_NODE_STAT(ni, rx_mgmt);
823 if (dir != IEEE80211_FC1_DIR_NODS) {
824 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
825 wh, "mgt", "incorrect dir 0x%x", dir);
826 vap->iv_stats.is_rx_wrongdir++;
827 goto err;
828 }
829 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
830 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
831 ni->ni_macaddr, "mgt", "too short: len %u",
832 m->m_pkthdr.len);
833 vap->iv_stats.is_rx_tooshort++;
834 goto out;
835 }
836 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
837 /* ensure return frames are unicast */
838 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
839 wh, NULL, "source is multicast: %s",
840 ether_sprintf(wh->i_addr2));
841 vap->iv_stats.is_rx_mgtdiscard++; /* XXX stat */
842 goto out;
843 }
844#ifdef IEEE80211_DEBUG
845 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
846 ieee80211_msg_dumppkts(vap)) {
847 if_printf(ifp, "received %s from %s rssi %d\n",
848 ieee80211_mgt_subtype_name[subtype >>
849 IEEE80211_FC0_SUBTYPE_SHIFT],
850 ether_sprintf(wh->i_addr2), rssi);
851 }
852#endif
853 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
854 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
855 /*
856 * Only shared key auth frames with a challenge
857 * should be encrypted, discard all others.
858 */
859 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
860 wh, NULL,
861 "%s", "WEP set but not permitted");
862 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
863 goto out;
864 }
865 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
866 /*
867 * Discard encrypted frames when privacy is off.
868 */
869 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
870 wh, NULL, "%s", "WEP set but PRIVACY off");
871 vap->iv_stats.is_rx_noprivacy++;
872 goto out;
873 }
874 hdrspace = ieee80211_hdrspace(ic, wh);
875 key = ieee80211_crypto_decap(ni, m, hdrspace);
876 if (key == NULL) {
877 /* NB: stats+msgs handled in crypto_decap */
878 goto out;
879 }
880 wh = mtod(m, struct ieee80211_frame *);
881 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
882 }
883 /*
884 * Pass the packet to radiotap before calling iv_recv_mgmt().
885 * Otherwise iv_recv_mgmt() might pass another packet to
886 * radiotap, resulting in out of order packet captures.
887 */
888 if (ieee80211_radiotap_active_vap(vap))
889 ieee80211_radiotap_rx(vap, m);
890 need_tap = 0;
891 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
892 goto out;
893
894 case IEEE80211_FC0_TYPE_CTL:
895 vap->iv_stats.is_rx_ctl++;
896 IEEE80211_NODE_STAT(ni, rx_ctrl);
897 vap->iv_recv_ctl(ni, m, subtype);
898 goto out;
899 default:
900 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
901 wh, "bad", "frame type 0x%x", type);
902 /* should not come here */
903 break;
904 }
905err:
906 ifp->if_ierrors++;
907out:
908 if (m != NULL) {
909 if (need_tap && ieee80211_radiotap_active_vap(vap))
910 ieee80211_radiotap_rx(vap, m);
911 m_freem(m);
912 }
913 return type;
914}
915
916static void
917hostap_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
918 int rssi, int nf, uint16_t seq, uint16_t status)
919{
920 struct ieee80211vap *vap = ni->ni_vap;
921
922 KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
923
924 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
925 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
926 ni->ni_macaddr, "open auth",
927 "bad sta auth mode %u", ni->ni_authmode);
928 vap->iv_stats.is_rx_bad_auth++; /* XXX */
929 /*
930 * Clear any challenge text that may be there if
931 * a previous shared key auth failed and then an
932 * open auth is attempted.
933 */
934 if (ni->ni_challenge != NULL) {
935 free(ni->ni_challenge, M_80211_NODE);
936 ni->ni_challenge = NULL;
937 }
938 /* XXX hack to workaround calling convention */
939 ieee80211_send_error(ni, wh->i_addr2,
940 IEEE80211_FC0_SUBTYPE_AUTH,
941 (seq + 1) | (IEEE80211_STATUS_ALG<<16));
942 return;
943 }
944 if (seq != IEEE80211_AUTH_OPEN_REQUEST) {
945 vap->iv_stats.is_rx_bad_auth++;
946 return;
947 }
948 /* always accept open authentication requests */
949 if (ni == vap->iv_bss) {
950 ni = ieee80211_dup_bss(vap, wh->i_addr2);
951 if (ni == NULL)
952 return;
953 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
954 (void) ieee80211_ref_node(ni);
955 /*
956 * Mark the node as referenced to reflect that it's
957 * reference count has been bumped to insure it remains
958 * after the transaction completes.
959 */
960 ni->ni_flags |= IEEE80211_NODE_AREF;
961 /*
962 * Mark the node as requiring a valid association id
963 * before outbound traffic is permitted.
964 */
965 ni->ni_flags |= IEEE80211_NODE_ASSOCID;
966
967 if (vap->iv_acl != NULL &&
968 vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
969 /*
970 * When the ACL policy is set to RADIUS we defer the
971 * authorization to a user agent. Dispatch an event,
972 * a subsequent MLME call will decide the fate of the
973 * station. If the user agent is not present then the
974 * node will be reclaimed due to inactivity.
975 */
976 IEEE80211_NOTE_MAC(vap,
977 IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL, ni->ni_macaddr,
978 "%s", "station authentication defered (radius acl)");
979 ieee80211_notify_node_auth(ni);
980 } else {
981 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
982 IEEE80211_NOTE_MAC(vap,
983 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni->ni_macaddr,
984 "%s", "station authenticated (open)");
985 /*
986 * When 802.1x is not in use mark the port
987 * authorized at this point so traffic can flow.
988 */
989 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
990 ieee80211_node_authorize(ni);
991 }
992}
993
994static void
995hostap_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
996 uint8_t *frm, uint8_t *efrm, int rssi, int nf,
997 uint16_t seq, uint16_t status)
998{
999 struct ieee80211vap *vap = ni->ni_vap;
1000 uint8_t *challenge;
1001 int allocbs, estatus;
1002
1003 KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
1004
1005 /*
1006 * NB: this can happen as we allow pre-shared key
1007 * authentication to be enabled w/o wep being turned
1008 * on so that configuration of these can be done
1009 * in any order. It may be better to enforce the
1010 * ordering in which case this check would just be
1011 * for sanity/consistency.
1012 */
1013 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
1014 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1015 ni->ni_macaddr, "shared key auth",
1016 "%s", " PRIVACY is disabled");
1017 estatus = IEEE80211_STATUS_ALG;
1018 goto bad;
1019 }
1020 /*
1021 * Pre-shared key authentication is evil; accept
1022 * it only if explicitly configured (it is supported
1023 * mainly for compatibility with clients like Mac OS X).
1024 */
1025 if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1026 ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1027 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1028 ni->ni_macaddr, "shared key auth",
1029 "bad sta auth mode %u", ni->ni_authmode);
1030 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1031 estatus = IEEE80211_STATUS_ALG;
1032 goto bad;
1033 }
1034
1035 challenge = NULL;
1036 if (frm + 1 < efrm) {
1037 if ((frm[1] + 2) > (efrm - frm)) {
1038 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1039 ni->ni_macaddr, "shared key auth",
1040 "ie %d/%d too long",
1041 frm[0], (frm[1] + 2) - (efrm - frm));
1042 vap->iv_stats.is_rx_bad_auth++;
1043 estatus = IEEE80211_STATUS_CHALLENGE;
1044 goto bad;
1045 }
1046 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1047 challenge = frm;
1048 frm += frm[1] + 2;
1049 }
1050 switch (seq) {
1051 case IEEE80211_AUTH_SHARED_CHALLENGE:
1052 case IEEE80211_AUTH_SHARED_RESPONSE:
1053 if (challenge == NULL) {
1054 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1055 ni->ni_macaddr, "shared key auth",
1056 "%s", "no challenge");
1057 vap->iv_stats.is_rx_bad_auth++;
1058 estatus = IEEE80211_STATUS_CHALLENGE;
1059 goto bad;
1060 }
1061 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1062 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1063 ni->ni_macaddr, "shared key auth",
1064 "bad challenge len %d", challenge[1]);
1065 vap->iv_stats.is_rx_bad_auth++;
1066 estatus = IEEE80211_STATUS_CHALLENGE;
1067 goto bad;
1068 }
1069 default:
1070 break;
1071 }
1072 switch (seq) {
1073 case IEEE80211_AUTH_SHARED_REQUEST:
1074 if (ni == vap->iv_bss) {
1075 ni = ieee80211_dup_bss(vap, wh->i_addr2);
1076 if (ni == NULL) {
1077 /* NB: no way to return an error */
1078 return;
1079 }
1080 allocbs = 1;
1081 } else {
1082 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1083 (void) ieee80211_ref_node(ni);
1084 allocbs = 0;
1085 }
1086 /*
1087 * Mark the node as referenced to reflect that it's
1088 * reference count has been bumped to insure it remains
1089 * after the transaction completes.
1090 */
1091 ni->ni_flags |= IEEE80211_NODE_AREF;
1092 /*
1093 * Mark the node as requiring a valid associatio id
1094 * before outbound traffic is permitted.
1095 */
1096 ni->ni_flags |= IEEE80211_NODE_ASSOCID;
1097 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1098 ni->ni_noise = nf;
1099 if (!ieee80211_alloc_challenge(ni)) {
1100 /* NB: don't return error so they rexmit */
1101 return;
1102 }
1103 get_random_bytes(ni->ni_challenge,
1104 IEEE80211_CHALLENGE_LEN);
1105 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1106 ni, "shared key %sauth request", allocbs ? "" : "re");
1107 /*
1108 * When the ACL policy is set to RADIUS we defer the
1109 * authorization to a user agent. Dispatch an event,
1110 * a subsequent MLME call will decide the fate of the
1111 * station. If the user agent is not present then the
1112 * node will be reclaimed due to inactivity.
1113 */
1114 if (vap->iv_acl != NULL &&
1115 vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
1116 IEEE80211_NOTE_MAC(vap,
1117 IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL,
1118 ni->ni_macaddr,
1119 "%s", "station authentication defered (radius acl)");
1120 ieee80211_notify_node_auth(ni);
1121 return;
1122 }
1123 break;
1124 case IEEE80211_AUTH_SHARED_RESPONSE:
1125 if (ni == vap->iv_bss) {
1126 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1127 ni->ni_macaddr, "shared key response",
1128 "%s", "unknown station");
1129 /* NB: don't send a response */
1130 return;
1131 }
1132 if (ni->ni_challenge == NULL) {
1133 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1134 ni->ni_macaddr, "shared key response",
1135 "%s", "no challenge recorded");
1136 vap->iv_stats.is_rx_bad_auth++;
1137 estatus = IEEE80211_STATUS_CHALLENGE;
1138 goto bad;
1139 }
1140 if (memcmp(ni->ni_challenge, &challenge[2],
1141 challenge[1]) != 0) {
1142 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1143 ni->ni_macaddr, "shared key response",
1144 "%s", "challenge mismatch");
1145 vap->iv_stats.is_rx_auth_fail++;
1146 estatus = IEEE80211_STATUS_CHALLENGE;
1147 goto bad;
1148 }
1149 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1150 ni, "%s", "station authenticated (shared key)");
1151 ieee80211_node_authorize(ni);
1152 break;
1153 default:
1154 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1155 ni->ni_macaddr, "shared key auth",
1156 "bad seq %d", seq);
1157 vap->iv_stats.is_rx_bad_auth++;
1158 estatus = IEEE80211_STATUS_SEQUENCE;
1159 goto bad;
1160 }
1161 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1162 return;
1163bad:
1164 /*
1165 * Send an error response; but only when operating as an AP.
1166 */
1167 /* XXX hack to workaround calling convention */
1168 ieee80211_send_error(ni, wh->i_addr2,
1169 IEEE80211_FC0_SUBTYPE_AUTH,
1170 (seq + 1) | (estatus<<16));
1171}
1172
1173/*
1174 * Convert a WPA cipher selector OUI to an internal
1175 * cipher algorithm. Where appropriate we also
1176 * record any key length.
1177 */
1178static int
1179wpa_cipher(const uint8_t *sel, uint8_t *keylen)
1180{
1181#define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1182 uint32_t w = LE_READ_4(sel);
1183
1184 switch (w) {
1185 case WPA_SEL(WPA_CSE_NULL):
1186 return IEEE80211_CIPHER_NONE;
1187 case WPA_SEL(WPA_CSE_WEP40):
1188 if (keylen)
1189 *keylen = 40 / NBBY;
1190 return IEEE80211_CIPHER_WEP;
1191 case WPA_SEL(WPA_CSE_WEP104):
1192 if (keylen)
1193 *keylen = 104 / NBBY;
1194 return IEEE80211_CIPHER_WEP;
1195 case WPA_SEL(WPA_CSE_TKIP):
1196 return IEEE80211_CIPHER_TKIP;
1197 case WPA_SEL(WPA_CSE_CCMP):
1198 return IEEE80211_CIPHER_AES_CCM;
1199 }
1200 return 32; /* NB: so 1<< is discarded */
1201#undef WPA_SEL
1202}
1203
1204/*
1205 * Convert a WPA key management/authentication algorithm
1206 * to an internal code.
1207 */
1208static int
1209wpa_keymgmt(const uint8_t *sel)
1210{
1211#define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1212 uint32_t w = LE_READ_4(sel);
1213
1214 switch (w) {
1215 case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1216 return WPA_ASE_8021X_UNSPEC;
1217 case WPA_SEL(WPA_ASE_8021X_PSK):
1218 return WPA_ASE_8021X_PSK;
1219 case WPA_SEL(WPA_ASE_NONE):
1220 return WPA_ASE_NONE;
1221 }
1222 return 0; /* NB: so is discarded */
1223#undef WPA_SEL
1224}
1225
1226/*
1227 * Parse a WPA information element to collect parameters.
1228 * Note that we do not validate security parameters; that
1229 * is handled by the authenticator; the parsing done here
1230 * is just for internal use in making operational decisions.
1231 */
1232static int
1233ieee80211_parse_wpa(struct ieee80211vap *vap, const uint8_t *frm,
1234 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1235{
1236 uint8_t len = frm[1];
1237 uint32_t w;
1238 int n;
1239
1240 /*
1241 * Check the length once for fixed parts: OUI, type,
1242 * version, mcast cipher, and 2 selector counts.
1243 * Other, variable-length data, must be checked separately.
1244 */
1245 if ((vap->iv_flags & IEEE80211_F_WPA1) == 0) {
1246 IEEE80211_DISCARD_IE(vap,
1247 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1248 wh, "WPA", "not WPA, flags 0x%x", vap->iv_flags);
1249 return IEEE80211_REASON_IE_INVALID;
1250 }
1251 if (len < 14) {
1252 IEEE80211_DISCARD_IE(vap,
1253 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1254 wh, "WPA", "too short, len %u", len);
1255 return IEEE80211_REASON_IE_INVALID;
1256 }
1257 frm += 6, len -= 4; /* NB: len is payload only */
1258 /* NB: iswpaoui already validated the OUI and type */
1259 w = LE_READ_2(frm);
1260 if (w != WPA_VERSION) {
1261 IEEE80211_DISCARD_IE(vap,
1262 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1263 wh, "WPA", "bad version %u", w);
1264 return IEEE80211_REASON_IE_INVALID;
1265 }
1266 frm += 2, len -= 2;
1267
1268 memset(rsn, 0, sizeof(*rsn));
1269
1270 /* multicast/group cipher */
1271 rsn->rsn_mcastcipher = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1272 frm += 4, len -= 4;
1273
1274 /* unicast ciphers */
1275 n = LE_READ_2(frm);
1276 frm += 2, len -= 2;
1277 if (len < n*4+2) {
1278 IEEE80211_DISCARD_IE(vap,
1279 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1280 wh, "WPA", "ucast cipher data too short; len %u, n %u",
1281 len, n);
1282 return IEEE80211_REASON_IE_INVALID;
1283 }
1284 w = 0;
1285 for (; n > 0; n--) {
1286 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1287 frm += 4, len -= 4;
1288 }
1289 if (w & (1<<IEEE80211_CIPHER_TKIP))
1290 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1291 else
1292 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1293
1294 /* key management algorithms */
1295 n = LE_READ_2(frm);
1296 frm += 2, len -= 2;
1297 if (len < n*4) {
1298 IEEE80211_DISCARD_IE(vap,
1299 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1300 wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1301 len, n);
1302 return IEEE80211_REASON_IE_INVALID;
1303 }
1304 w = 0;
1305 for (; n > 0; n--) {
1306 w |= wpa_keymgmt(frm);
1307 frm += 4, len -= 4;
1308 }
1309 if (w & WPA_ASE_8021X_UNSPEC)
1310 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1311 else
1312 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1313
1314 if (len > 2) /* optional capabilities */
1315 rsn->rsn_caps = LE_READ_2(frm);
1316
1317 return 0;
1318}
1319
1320/*
1321 * Convert an RSN cipher selector OUI to an internal
1322 * cipher algorithm. Where appropriate we also
1323 * record any key length.
1324 */
1325static int
1326rsn_cipher(const uint8_t *sel, uint8_t *keylen)
1327{
1328#define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1329 uint32_t w = LE_READ_4(sel);
1330
1331 switch (w) {
1332 case RSN_SEL(RSN_CSE_NULL):
1333 return IEEE80211_CIPHER_NONE;
1334 case RSN_SEL(RSN_CSE_WEP40):
1335 if (keylen)
1336 *keylen = 40 / NBBY;
1337 return IEEE80211_CIPHER_WEP;
1338 case RSN_SEL(RSN_CSE_WEP104):
1339 if (keylen)
1340 *keylen = 104 / NBBY;
1341 return IEEE80211_CIPHER_WEP;
1342 case RSN_SEL(RSN_CSE_TKIP):
1343 return IEEE80211_CIPHER_TKIP;
1344 case RSN_SEL(RSN_CSE_CCMP):
1345 return IEEE80211_CIPHER_AES_CCM;
1346 case RSN_SEL(RSN_CSE_WRAP):
1347 return IEEE80211_CIPHER_AES_OCB;
1348 }
1349 return 32; /* NB: so 1<< is discarded */
1350#undef WPA_SEL
1351}
1352
1353/*
1354 * Convert an RSN key management/authentication algorithm
1355 * to an internal code.
1356 */
1357static int
1358rsn_keymgmt(const uint8_t *sel)
1359{
1360#define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1361 uint32_t w = LE_READ_4(sel);
1362
1363 switch (w) {
1364 case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1365 return RSN_ASE_8021X_UNSPEC;
1366 case RSN_SEL(RSN_ASE_8021X_PSK):
1367 return RSN_ASE_8021X_PSK;
1368 case RSN_SEL(RSN_ASE_NONE):
1369 return RSN_ASE_NONE;
1370 }
1371 return 0; /* NB: so is discarded */
1372#undef RSN_SEL
1373}
1374
1375/*
1376 * Parse a WPA/RSN information element to collect parameters
1377 * and validate the parameters against what has been
1378 * configured for the system.
1379 */
1380static int
1381ieee80211_parse_rsn(struct ieee80211vap *vap, const uint8_t *frm,
1382 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1383{
1384 uint8_t len = frm[1];
1385 uint32_t w;
1386 int n;
1387
1388 /*
1389 * Check the length once for fixed parts:
1390 * version, mcast cipher, and 2 selector counts.
1391 * Other, variable-length data, must be checked separately.
1392 */
1393 if ((vap->iv_flags & IEEE80211_F_WPA2) == 0) {
1394 IEEE80211_DISCARD_IE(vap,
1395 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1396 wh, "WPA", "not RSN, flags 0x%x", vap->iv_flags);
1397 return IEEE80211_REASON_IE_INVALID;
1398 }
1399 if (len < 10) {
1400 IEEE80211_DISCARD_IE(vap,
1401 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1402 wh, "RSN", "too short, len %u", len);
1403 return IEEE80211_REASON_IE_INVALID;
1404 }
1405 frm += 2;
1406 w = LE_READ_2(frm);
1407 if (w != RSN_VERSION) {
1408 IEEE80211_DISCARD_IE(vap,
1409 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1410 wh, "RSN", "bad version %u", w);
1411 return IEEE80211_REASON_IE_INVALID;
1412 }
1413 frm += 2, len -= 2;
1414
1415 memset(rsn, 0, sizeof(*rsn));
1416
1417 /* multicast/group cipher */
1418 rsn->rsn_mcastcipher = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1419 frm += 4, len -= 4;
1420
1421 /* unicast ciphers */
1422 n = LE_READ_2(frm);
1423 frm += 2, len -= 2;
1424 if (len < n*4+2) {
1425 IEEE80211_DISCARD_IE(vap,
1426 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1427 wh, "RSN", "ucast cipher data too short; len %u, n %u",
1428 len, n);
1429 return IEEE80211_REASON_IE_INVALID;
1430 }
1431 w = 0;
1432 for (; n > 0; n--) {
1433 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1434 frm += 4, len -= 4;
1435 }
1436 if (w & (1<<IEEE80211_CIPHER_TKIP))
1437 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1438 else
1439 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1440
1441 /* key management algorithms */
1442 n = LE_READ_2(frm);
1443 frm += 2, len -= 2;
1444 if (len < n*4) {
1445 IEEE80211_DISCARD_IE(vap,
1446 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1447 wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1448 len, n);
1449 return IEEE80211_REASON_IE_INVALID;
1450 }
1451 w = 0;
1452 for (; n > 0; n--) {
1453 w |= rsn_keymgmt(frm);
1454 frm += 4, len -= 4;
1455 }
1456 if (w & RSN_ASE_8021X_UNSPEC)
1457 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1458 else
1459 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1460
1461 /* optional RSN capabilities */
1462 if (len > 2)
1463 rsn->rsn_caps = LE_READ_2(frm);
1464 /* XXXPMKID */
1465
1466 return 0;
1467}
1468
1469/*
1470 * WPA/802.11i assocation request processing.
1471 */
1472static int
1473wpa_assocreq(struct ieee80211_node *ni, struct ieee80211_rsnparms *rsnparms,
1474 const struct ieee80211_frame *wh, const uint8_t *wpa,
1475 const uint8_t *rsn, uint16_t capinfo)
1476{
1477 struct ieee80211vap *vap = ni->ni_vap;
1478 uint8_t reason;
1479 int badwparsn;
1480
1481 ni->ni_flags &= ~(IEEE80211_NODE_WPS|IEEE80211_NODE_TSN);
1482 if (wpa == NULL && rsn == NULL) {
1483 if (vap->iv_flags_ext & IEEE80211_FEXT_WPS) {
1484 /*
1485 * W-Fi Protected Setup (WPS) permits
1486 * clients to associate and pass EAPOL frames
1487 * to establish initial credentials.
1488 */
1489 ni->ni_flags |= IEEE80211_NODE_WPS;
1490 return 1;
1491 }
1492 if ((vap->iv_flags_ext & IEEE80211_FEXT_TSN) &&
1493 (capinfo & IEEE80211_CAPINFO_PRIVACY)) {
1494 /*
1495 * Transitional Security Network. Permits clients
1496 * to associate and use WEP while WPA is configured.
1497 */
1498 ni->ni_flags |= IEEE80211_NODE_TSN;
1499 return 1;
1500 }
1501 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1502 wh, NULL, "%s", "no WPA/RSN IE in association request");
1503 vap->iv_stats.is_rx_assoc_badwpaie++;
1504 reason = IEEE80211_REASON_IE_INVALID;
1505 goto bad;
1506 }
1507 /* assert right association security credentials */
1508 badwparsn = 0; /* NB: to silence compiler */
1509 switch (vap->iv_flags & IEEE80211_F_WPA) {
1510 case IEEE80211_F_WPA1:
1511 badwparsn = (wpa == NULL);
1512 break;
1513 case IEEE80211_F_WPA2:
1514 badwparsn = (rsn == NULL);
1515 break;
1516 case IEEE80211_F_WPA1|IEEE80211_F_WPA2:
1517 badwparsn = (wpa == NULL && rsn == NULL);
1518 break;
1519 }
1520 if (badwparsn) {
1521 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1522 wh, NULL,
1523 "%s", "missing WPA/RSN IE in association request");
1524 vap->iv_stats.is_rx_assoc_badwpaie++;
1525 reason = IEEE80211_REASON_IE_INVALID;
1526 goto bad;
1527 }
1528 /*
1529 * Parse WPA/RSN information element.
1530 */
1531 if (wpa != NULL)
1532 reason = ieee80211_parse_wpa(vap, wpa, rsnparms, wh);
1533 else
1534 reason = ieee80211_parse_rsn(vap, rsn, rsnparms, wh);
1535 if (reason != 0) {
1536 /* XXX distinguish WPA/RSN? */
1537 vap->iv_stats.is_rx_assoc_badwpaie++;
1538 goto bad;
1539 }
1540 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, ni,
1541 "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x",
1542 wpa != NULL ? "WPA" : "RSN",
1543 rsnparms->rsn_mcastcipher, rsnparms->rsn_mcastkeylen,
1544 rsnparms->rsn_ucastcipher, rsnparms->rsn_ucastkeylen,
1545 rsnparms->rsn_keymgmt, rsnparms->rsn_caps);
1546
1547 return 1;
1548bad:
1549 ieee80211_node_deauth(ni, reason);
1550 return 0;
1551}
1552
1553/* XXX find a better place for definition */
1554struct l2_update_frame {
1555 struct ether_header eh;
1556 uint8_t dsap;
1557 uint8_t ssap;
1558 uint8_t control;
1559 uint8_t xid[3];
1560} __packed;
1561
1562/*
1563 * Deliver a TGf L2UF frame on behalf of a station.
1564 * This primes any bridge when the station is roaming
1565 * between ap's on the same wired network.
1566 */
1567static void
1568ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1569{
1570 struct ieee80211vap *vap = ni->ni_vap;
1571 struct ifnet *ifp = vap->iv_ifp;
1572 struct mbuf *m;
1573 struct l2_update_frame *l2uf;
1574 struct ether_header *eh;
1575
1576 m = m_gethdr(M_NOWAIT, MT_DATA);
1577 if (m == NULL) {
1578 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1579 "%s", "no mbuf for l2uf frame");
1580 vap->iv_stats.is_rx_nobuf++; /* XXX not right */
1581 return;
1582 }
1583 l2uf = mtod(m, struct l2_update_frame *);
1584 eh = &l2uf->eh;
1585 /* dst: Broadcast address */
1586 IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1587 /* src: associated STA */
1588 IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1589 eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1590
1591 l2uf->dsap = 0;
1592 l2uf->ssap = 0;
1593 l2uf->control = 0xf5;
1594 l2uf->xid[0] = 0x81;
1595 l2uf->xid[1] = 0x80;
1596 l2uf->xid[2] = 0x00;
1597
1598 m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1599 hostap_deliver_data(vap, ni, m);
1600}
1601
1602static void
1603ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1604 int reassoc, int resp, const char *tag, int rate)
1605{
1606 IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1607 "deny %s request, %s rate set mismatch, rate/MCS %d",
1608 reassoc ? "reassoc" : "assoc", tag, rate & IEEE80211_RATE_VAL);
1609 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_BASIC_RATE);
1610 ieee80211_node_leave(ni);
1611}
1612
1613static void
1614capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1615 int reassoc, int resp, const char *tag, int capinfo)
1616{
1617 struct ieee80211vap *vap = ni->ni_vap;
1618
1619 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1620 "deny %s request, %s mismatch 0x%x",
1621 reassoc ? "reassoc" : "assoc", tag, capinfo);
1622 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_CAPINFO);
1623 ieee80211_node_leave(ni);
1624 vap->iv_stats.is_rx_assoc_capmismatch++;
1625}
1626
1627static void
1628htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1629 int reassoc, int resp)
1630{
1631 IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1632 "deny %s request, %s missing HT ie", reassoc ? "reassoc" : "assoc");
1633 /* XXX no better code */
1634 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_MISSING_HT_CAPS);
1635 ieee80211_node_leave(ni);
1636}
1637
1638static void
1639authalgreject(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1640 int algo, int seq, int status)
1641{
1642 struct ieee80211vap *vap = ni->ni_vap;
1643
1644 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1645 wh, NULL, "unsupported alg %d", algo);
1646 vap->iv_stats.is_rx_auth_unsupported++;
1647 ieee80211_send_error(ni, wh->i_addr2, IEEE80211_FC0_SUBTYPE_AUTH,
1648 seq | (status << 16));
1649}
1650
1651static __inline int
1652ishtmixed(const uint8_t *ie)
1653{
1654 const struct ieee80211_ie_htinfo *ht =
1655 (const struct ieee80211_ie_htinfo *) ie;
1656 return (ht->hi_byte2 & IEEE80211_HTINFO_OPMODE) ==
1657 IEEE80211_HTINFO_OPMODE_MIXED;
1658}
1659
1660static int
1661is11bclient(const uint8_t *rates, const uint8_t *xrates)
1662{
1663 static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
1664 int i;
1665
1666 /* NB: the 11b clients we care about will not have xrates */
1667 if (xrates != NULL || rates == NULL)
1668 return 0;
1669 for (i = 0; i < rates[1]; i++) {
1670 int r = rates[2+i] & IEEE80211_RATE_VAL;
1671 if (r > 2*11 || ((1<<r) & brates) == 0)
1672 return 0;
1673 }
1674 return 1;
1675}
1676
1677static void
1678hostap_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1679 int subtype, int rssi, int nf)
1680{
1681 struct ieee80211vap *vap = ni->ni_vap;
1682 struct ieee80211com *ic = ni->ni_ic;
1683 struct ieee80211_frame *wh;
1684 uint8_t *frm, *efrm, *sfrm;
1685 uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap;
1686 int reassoc, resp;
1687 uint8_t rate;
1688
1689 wh = mtod(m0, struct ieee80211_frame *);
1690 frm = (uint8_t *)&wh[1];
1691 efrm = mtod(m0, uint8_t *) + m0->m_len;
1692 switch (subtype) {
1693 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1694 case IEEE80211_FC0_SUBTYPE_BEACON: {
1695 struct ieee80211_scanparams scan;
1696 /*
1697 * We process beacon/probe response frames when scanning;
1698 * otherwise we check beacon frames for overlapping non-ERP
1699 * BSS in 11g and/or overlapping legacy BSS when in HT.
1700 */
1701 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 &&
1702 subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1703 vap->iv_stats.is_rx_mgtdiscard++;
1704 return;
1705 }
1706 /* NB: accept off-channel frames */
1707 if (ieee80211_parse_beacon(ni, m0, &scan) &~ IEEE80211_BPARSE_OFFCHAN)
1708 return;
1709 /*
1710 * Count frame now that we know it's to be processed.
1711 */
1712 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1713 vap->iv_stats.is_rx_beacon++; /* XXX remove */
1714 IEEE80211_NODE_STAT(ni, rx_beacons);
1715 } else
1716 IEEE80211_NODE_STAT(ni, rx_proberesp);
1717 /*
1718 * If scanning, just pass information to the scan module.
1719 */
1720 if (ic->ic_flags & IEEE80211_F_SCAN) {
1721 if (scan.status == 0 && /* NB: on channel */
1722 (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN)) {
1723 /*
1724 * Actively scanning a channel marked passive;
1725 * send a probe request now that we know there
1726 * is 802.11 traffic present.
1727 *
1728 * XXX check if the beacon we recv'd gives
1729 * us what we need and suppress the probe req
1730 */
1731 ieee80211_probe_curchan(vap, 1);
1732 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1733 }
1734 ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1735 return;
1736 }
1737 /*
1738 * Check beacon for overlapping bss w/ non ERP stations.
1739 * If we detect one and protection is configured but not
1740 * enabled, enable it and start a timer that'll bring us
1741 * out if we stop seeing the bss.
1742 */
1743 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1744 scan.status == 0 && /* NB: on-channel */
1745 ((scan.erp & 0x100) == 0 || /* NB: no ERP, 11b sta*/
1746 (scan.erp & IEEE80211_ERP_NON_ERP_PRESENT))) {
1747 ic->ic_lastnonerp = ticks;
1748 ic->ic_flags_ext |= IEEE80211_FEXT_NONERP_PR;
1749 if (ic->ic_protmode != IEEE80211_PROT_NONE &&
1750 (ic->ic_flags & IEEE80211_F_USEPROT) == 0) {
1751 IEEE80211_NOTE_FRAME(vap,
1752 IEEE80211_MSG_ASSOC, wh,
1753 "non-ERP present on channel %d "
1754 "(saw erp 0x%x from channel %d), "
1755 "enable use of protection",
1756 ic->ic_curchan->ic_ieee,
1757 scan.erp, scan.chan);
1758 ic->ic_flags |= IEEE80211_F_USEPROT;
1759 ieee80211_notify_erp(ic);
1760 }
1761 }
1762 /*
1763 * Check beacon for non-HT station on HT channel
1764 * and update HT BSS occupancy as appropriate.
1765 */
1766 if (IEEE80211_IS_CHAN_HT(ic->ic_curchan)) {
1767 if (scan.status & IEEE80211_BPARSE_OFFCHAN) {
1768 /*
1769 * Off control channel; only check frames
1770 * that come in the extension channel when
1771 * operating w/ HT40.
1772 */
1773 if (!IEEE80211_IS_CHAN_HT40(ic->ic_curchan))
1774 break;
1775 if (scan.chan != ic->ic_curchan->ic_extieee)
1776 break;
1777 }
1778 if (scan.htinfo == NULL) {
1779 ieee80211_htprot_update(ic,
1780 IEEE80211_HTINFO_OPMODE_PROTOPT |
1781 IEEE80211_HTINFO_NONHT_PRESENT);
1782 } else if (ishtmixed(scan.htinfo)) {
1783 /* XXX? take NONHT_PRESENT from beacon? */
1784 ieee80211_htprot_update(ic,
1785 IEEE80211_HTINFO_OPMODE_MIXED |
1786 IEEE80211_HTINFO_NONHT_PRESENT);
1787 }
1788 }
1789 break;
1790 }
1791
1792 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1793 if (vap->iv_state != IEEE80211_S_RUN) {
1794 vap->iv_stats.is_rx_mgtdiscard++;
1795 return;
1796 }
1797 /*
1798 * Consult the ACL policy module if setup.
1799 */
1800 if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1801 IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1802 wh, NULL, "%s", "disallowed by ACL");
1803 vap->iv_stats.is_rx_acl++;
1804 return;
1805 }
1806 /*
1807 * prreq frame format
1808 * [tlv] ssid
1809 * [tlv] supported rates
1810 * [tlv] extended supported rates
1811 */
1812 ssid = rates = xrates = NULL;
1813 sfrm = frm;
1814 while (efrm - frm > 1) {
1815 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1816 switch (*frm) {
1817 case IEEE80211_ELEMID_SSID:
1818 ssid = frm;
1819 break;
1820 case IEEE80211_ELEMID_RATES:
1821 rates = frm;
1822 break;
1823 case IEEE80211_ELEMID_XRATES:
1824 xrates = frm;
1825 break;
1826 }
1827 frm += frm[1] + 2;
1828 }
1829 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1830 if (xrates != NULL)
1831 IEEE80211_VERIFY_ELEMENT(xrates,
1832 IEEE80211_RATE_MAXSIZE - rates[1], return);
1833 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
1834 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
1835 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
1836 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1837 wh, NULL,
1838 "%s", "no ssid with ssid suppression enabled");
1839 vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
1840 return;
1841 }
1842
1843 /* XXX find a better class or define it's own */
1844 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
1845 "%s", "recv probe req");
1846 /*
1847 * Some legacy 11b clients cannot hack a complete
1848 * probe response frame. When the request includes
1849 * only a bare-bones rate set, communicate this to
1850 * the transmit side.
1851 */
1852 ieee80211_send_proberesp(vap, wh->i_addr2,
1853 is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
1854 break;
1855
1856 case IEEE80211_FC0_SUBTYPE_AUTH: {
1857 uint16_t algo, seq, status;
1858
1859 if (vap->iv_state != IEEE80211_S_RUN) {
1860 vap->iv_stats.is_rx_mgtdiscard++;
1861 return;
1862 }
1863 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1864 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1865 wh, NULL, "%s", "wrong bssid");
1866 vap->iv_stats.is_rx_wrongbss++; /*XXX unique stat?*/
1867 return;
1868 }
1869 /*
1870 * auth frame format
1871 * [2] algorithm
1872 * [2] sequence
1873 * [2] status
1874 * [tlv*] challenge
1875 */
1876 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1877 algo = le16toh(*(uint16_t *)frm);
1878 seq = le16toh(*(uint16_t *)(frm + 2));
1879 status = le16toh(*(uint16_t *)(frm + 4));
1880 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1881 "recv auth frame with algorithm %d seq %d", algo, seq);
1882 /*
1883 * Consult the ACL policy module if setup.
1884 */
1885 if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1886 IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1887 wh, NULL, "%s", "disallowed by ACL");
1888 vap->iv_stats.is_rx_acl++;
1889 ieee80211_send_error(ni, wh->i_addr2,
1890 IEEE80211_FC0_SUBTYPE_AUTH,
1891 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
1892 return;
1893 }
1894 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1895 IEEE80211_DISCARD(vap,
1896 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1897 wh, NULL, "%s", "TKIP countermeasures enabled");
1898 vap->iv_stats.is_rx_auth_countermeasures++;
1899 ieee80211_send_error(ni, wh->i_addr2,
1900 IEEE80211_FC0_SUBTYPE_AUTH,
1901 IEEE80211_REASON_MIC_FAILURE);
1902 return;
1903 }
1904 if (algo == IEEE80211_AUTH_ALG_SHARED)
1905 hostap_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1906 seq, status);
1907 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1908 hostap_auth_open(ni, wh, rssi, nf, seq, status);
1909 else if (algo == IEEE80211_AUTH_ALG_LEAP) {
1910 authalgreject(ni, wh, algo,
1911 seq+1, IEEE80211_STATUS_ALG);
1912 return;
1913 } else {
1914 /*
1915 * We assume that an unknown algorithm is the result
1916 * of a decryption failure on a shared key auth frame;
1917 * return a status code appropriate for that instead
1918 * of IEEE80211_STATUS_ALG.
1919 *
1920 * NB: a seq# of 4 is intentional; the decrypted
1921 * frame likely has a bogus seq value.
1922 */
1923 authalgreject(ni, wh, algo,
1924 4, IEEE80211_STATUS_CHALLENGE);
1925 return;
1926 }
1927 break;
1928 }
1929
1930 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1931 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
1932 uint16_t capinfo, lintval;
1933 struct ieee80211_rsnparms rsnparms;
1934
1935 if (vap->iv_state != IEEE80211_S_RUN) {
1936 vap->iv_stats.is_rx_mgtdiscard++;
1937 return;
1938 }
1939 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1940 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1941 wh, NULL, "%s", "wrong bssid");
1942 vap->iv_stats.is_rx_assoc_bss++;
1943 return;
1944 }
1945 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
1946 reassoc = 1;
1947 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
1948 } else {
1949 reassoc = 0;
1950 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
1951 }
1952 if (ni == vap->iv_bss) {
1953 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1954 "deny %s request, sta not authenticated",
1955 reassoc ? "reassoc" : "assoc");
1956 ieee80211_send_error(ni, wh->i_addr2,
1957 IEEE80211_FC0_SUBTYPE_DEAUTH,
1958 IEEE80211_REASON_ASSOC_NOT_AUTHED);
1959 vap->iv_stats.is_rx_assoc_notauth++;
1960 return;
1961 }
1962
1963 /*
1964 * asreq frame format
1965 * [2] capability information
1966 * [2] listen interval
1967 * [6*] current AP address (reassoc only)
1968 * [tlv] ssid
1969 * [tlv] supported rates
1970 * [tlv] extended supported rates
1971 * [tlv] WPA or RSN
1972 * [tlv] HT capabilities
1973 * [tlv] Atheros capabilities
1974 */
1975 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
1976 capinfo = le16toh(*(uint16_t *)frm); frm += 2;
1977 lintval = le16toh(*(uint16_t *)frm); frm += 2;
1978 if (reassoc)
1979 frm += 6; /* ignore current AP info */
1980 ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL;
1981 sfrm = frm;
1982 while (efrm - frm > 1) {
1983 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1984 switch (*frm) {
1985 case IEEE80211_ELEMID_SSID:
1986 ssid = frm;
1987 break;
1988 case IEEE80211_ELEMID_RATES:
1989 rates = frm;
1990 break;
1991 case IEEE80211_ELEMID_XRATES:
1992 xrates = frm;
1993 break;
1994 case IEEE80211_ELEMID_RSN:
1995 rsn = frm;
1996 break;
1997 case IEEE80211_ELEMID_HTCAP:
1998 htcap = frm;
1999 break;
2000 case IEEE80211_ELEMID_VENDOR:
2001 if (iswpaoui(frm))
2002 wpa = frm;
2003 else if (iswmeinfo(frm))
2004 wme = frm;
2005#ifdef IEEE80211_SUPPORT_SUPERG
2006 else if (isatherosoui(frm))
2007 ath = frm;
2008#endif
2009 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
2010 if (ishtcapoui(frm) && htcap == NULL)
2011 htcap = frm;
2012 }
2013 break;
2014 }
2015 frm += frm[1] + 2;
2016 }
2017 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2018 if (xrates != NULL)
2019 IEEE80211_VERIFY_ELEMENT(xrates,
2020 IEEE80211_RATE_MAXSIZE - rates[1], return);
2021 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2022 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
2023 if (htcap != NULL) {
2024 IEEE80211_VERIFY_LENGTH(htcap[1],
2025 htcap[0] == IEEE80211_ELEMID_VENDOR ?
2026 4 + sizeof(struct ieee80211_ie_htcap)-2 :
2027 sizeof(struct ieee80211_ie_htcap)-2,
2028 return); /* XXX just NULL out? */
2029 }
2030
2031 if ((vap->iv_flags & IEEE80211_F_WPA) &&
2032 !wpa_assocreq(ni, &rsnparms, wh, wpa, rsn, capinfo))
2033 return;
2034 /* discard challenge after association */
2035 if (ni->ni_challenge != NULL) {
2036 free(ni->ni_challenge, M_80211_NODE);
2037 ni->ni_challenge = NULL;
2038 }
2039 /* NB: 802.11 spec says to ignore station's privacy bit */
2040 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2041 capinfomismatch(ni, wh, reassoc, resp,
2042 "capability", capinfo);
2043 return;
2044 }
2045 /*
2046 * Disallow re-associate w/ invalid slot time setting.
2047 */
2048 if (ni->ni_associd != 0 &&
2049 IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
2050 ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
2051 capinfomismatch(ni, wh, reassoc, resp,
2052 "slot time", capinfo);
2053 return;
2054 }
2055 rate = ieee80211_setup_rates(ni, rates, xrates,
2056 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2057 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2058 if (rate & IEEE80211_RATE_BASIC) {
2059 ratesetmismatch(ni, wh, reassoc, resp, "legacy", rate);
2060 vap->iv_stats.is_rx_assoc_norate++;
2061 return;
2062 }
2063 /*
2064 * If constrained to 11g-only stations reject an
2065 * 11b-only station. We cheat a bit here by looking
2066 * at the max negotiated xmit rate and assuming anyone
2067 * with a best rate <24Mb/s is an 11b station.
2068 */
2069 if ((vap->iv_flags & IEEE80211_F_PUREG) && rate < 48) {
2070 ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);
2071 vap->iv_stats.is_rx_assoc_norate++;
2072 return;
2073 }
2074 /*
2075 * Do HT rate set handling and setup HT node state.
2076 */
2077 ni->ni_chan = vap->iv_bss->ni_chan;
2078 if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && htcap != NULL) {
2079 rate = ieee80211_setup_htrates(ni, htcap,
2080 IEEE80211_F_DOFMCS | IEEE80211_F_DONEGO |
2081 IEEE80211_F_DOBRS);
2082 if (rate & IEEE80211_RATE_BASIC) {
2083 ratesetmismatch(ni, wh, reassoc, resp,
2084 "HT", rate);
2085 vap->iv_stats.is_ht_assoc_norate++;
2086 return;
2087 }
2088 ieee80211_ht_node_init(ni);
2089 ieee80211_ht_updatehtcap(ni, htcap);
2090 } else if (ni->ni_flags & IEEE80211_NODE_HT)
2091 ieee80211_ht_node_cleanup(ni);
2092#ifdef IEEE80211_SUPPORT_SUPERG
2093 else if (ni->ni_ath_flags & IEEE80211_NODE_ATH)
2094 ieee80211_ff_node_cleanup(ni);
2095#endif
2096 /*
2097 * Allow AMPDU operation only with unencrypted traffic
2098 * or AES-CCM; the 11n spec only specifies these ciphers
2099 * so permitting any others is undefined and can lead
2100 * to interoperability problems.
2101 */
2102 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
2103 (((vap->iv_flags & IEEE80211_F_WPA) &&
2104 rsnparms.rsn_ucastcipher != IEEE80211_CIPHER_AES_CCM) ||
2105 (vap->iv_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) {
2106 IEEE80211_NOTE(vap,
2107 IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
2108 "disallow HT use because WEP or TKIP requested, "
2109 "capinfo 0x%x ucastcipher %d", capinfo,
2110 rsnparms.rsn_ucastcipher);
2111 ieee80211_ht_node_cleanup(ni);
2112 vap->iv_stats.is_ht_assoc_downgrade++;
2113 }
2114 /*
2115 * If constrained to 11n-only stations reject legacy stations.
2116 */
2117 if ((vap->iv_flags_ht & IEEE80211_FHT_PUREN) &&
2118 (ni->ni_flags & IEEE80211_NODE_HT) == 0) {
2119 htcapmismatch(ni, wh, reassoc, resp);
2120 vap->iv_stats.is_ht_assoc_nohtcap++;
2121 return;
2122 }
2123 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
2124 ni->ni_noise = nf;
2125 ni->ni_intval = lintval;
2126 ni->ni_capinfo = capinfo;
2127 ni->ni_fhdwell = vap->iv_bss->ni_fhdwell;
2128 ni->ni_fhindex = vap->iv_bss->ni_fhindex;
2129 /*
2130 * Store the IEs.
2131 * XXX maybe better to just expand
2132 */
2133 if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {
2134#define setie(_ie, _off) ieee80211_ies_setie(ni->ni_ies, _ie, _off)
2135 if (wpa != NULL)
2136 setie(wpa_ie, wpa - sfrm);
2137 if (rsn != NULL)
2138 setie(rsn_ie, rsn - sfrm);
2139 if (htcap != NULL)
2140 setie(htcap_ie, htcap - sfrm);
2141 if (wme != NULL) {
2142 setie(wme_ie, wme - sfrm);
2143 /*
2144 * Mark node as capable of QoS.
2145 */
2146 ni->ni_flags |= IEEE80211_NODE_QOS;
2147 } else
2148 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2149#ifdef IEEE80211_SUPPORT_SUPERG
2150 if (ath != NULL) {
2151 setie(ath_ie, ath - sfrm);
2152 /*
2153 * Parse ATH station parameters.
2154 */
2155 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
2156 } else
2157#endif
2158 ni->ni_ath_flags = 0;
2159#undef setie
2160 } else {
2161 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2162 ni->ni_ath_flags = 0;
2163 }
2164 ieee80211_node_join(ni, resp);
2165 ieee80211_deliver_l2uf(ni);
2166 break;
2167 }
2168
2169 case IEEE80211_FC0_SUBTYPE_DEAUTH:
2170 case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2171 uint16_t reason;
2172
2173 if (vap->iv_state != IEEE80211_S_RUN ||
2174 /* NB: can happen when in promiscuous mode */
2175 !IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
2176 vap->iv_stats.is_rx_mgtdiscard++;
2177 break;
2178 }
2179 /*
2180 * deauth/disassoc frame format
2181 * [2] reason
2182 */
2183 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2184 reason = le16toh(*(uint16_t *)frm);
2185 if (subtype == IEEE80211_FC0_SUBTYPE_DEAUTH) {
2186 vap->iv_stats.is_rx_deauth++;
2187 IEEE80211_NODE_STAT(ni, rx_deauth);
2188 } else {
2189 vap->iv_stats.is_rx_disassoc++;
2190 IEEE80211_NODE_STAT(ni, rx_disassoc);
2191 }
2192 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
2193 "recv %s (reason %d)", ieee80211_mgt_subtype_name[subtype >>
2194 IEEE80211_FC0_SUBTYPE_SHIFT], reason);
2195 if (ni != vap->iv_bss)
2196 ieee80211_node_leave(ni);
2197 break;
2198 }
2199
2200 case IEEE80211_FC0_SUBTYPE_ACTION:
2201 case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2202 if (ni == vap->iv_bss) {
2203 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2204 wh, NULL, "%s", "unknown node");
2205 vap->iv_stats.is_rx_mgtdiscard++;
2206 } else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2207 !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2208 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2209 wh, NULL, "%s", "not for us");
2210 vap->iv_stats.is_rx_mgtdiscard++;
2211 } else if (vap->iv_state != IEEE80211_S_RUN) {
2212 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2213 wh, NULL, "wrong state %s",
2214 ieee80211_state_name[vap->iv_state]);
2215 vap->iv_stats.is_rx_mgtdiscard++;
2216 } else {
2217 if (ieee80211_parse_action(ni, m0) == 0)
2218 (void)ic->ic_recv_action(ni, wh, frm, efrm);
2219 }
2220 break;
2221
2222 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2223 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2224 case IEEE80211_FC0_SUBTYPE_ATIM:
2225 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2226 wh, NULL, "%s", "not handled");
2227 vap->iv_stats.is_rx_mgtdiscard++;
2228 break;
2229
2230 default:
2231 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2232 wh, "mgt", "subtype 0x%x not handled", subtype);
2233 vap->iv_stats.is_rx_badsubtype++;
2234 break;
2235 }
2236}
2237
2238static void
2239hostap_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2240{
2241 switch (subtype) {
2242 case IEEE80211_FC0_SUBTYPE_PS_POLL:
2243 ni->ni_vap->iv_recv_pspoll(ni, m);
2244 break;
2245 case IEEE80211_FC0_SUBTYPE_BAR:
2246 ieee80211_recv_bar(ni, m);
2247 break;
2248 }
2249}
2250
2251/*
2252 * Process a received ps-poll frame.
2253 */
2254void
2255ieee80211_recv_pspoll(struct ieee80211_node *ni, struct mbuf *m0)
2256{
2257 struct ieee80211vap *vap = ni->ni_vap;
2258 struct ieee80211com *ic = vap->iv_ic;
2259 struct ieee80211_frame_min *wh;
2260 struct mbuf *m;
2261 uint16_t aid;
2262 int qlen;
2263
2264 wh = mtod(m0, struct ieee80211_frame_min *);
2265 if (ni->ni_associd == 0) {
2266 IEEE80211_DISCARD(vap,
2267 IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2268 (struct ieee80211_frame *) wh, NULL,
2269 "%s", "unassociated station");
2270 vap->iv_stats.is_ps_unassoc++;
2271 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2272 IEEE80211_REASON_NOT_ASSOCED);
2273 return;
2274 }
2275
2276 aid = le16toh(*(uint16_t *)wh->i_dur);
2277 if (aid != ni->ni_associd) {
2278 IEEE80211_DISCARD(vap,
2279 IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2280 (struct ieee80211_frame *) wh, NULL,
2281 "aid mismatch: sta aid 0x%x poll aid 0x%x",
2282 ni->ni_associd, aid);
2283 vap->iv_stats.is_ps_badaid++;
2284 /*
2285 * NB: We used to deauth the station but it turns out
2286 * the Blackberry Curve 8230 (and perhaps other devices)
2287 * sometimes send the wrong AID when WME is negotiated.
2288 * Being more lenient here seems ok as we already check
2289 * the station is associated and we only return frames
2290 * queued for the station (i.e. we don't use the AID).
2291 */
2292 return;
2293 }
2294
2295 /* Okay, take the first queued packet and put it out... */
2296 m = ieee80211_node_psq_dequeue(ni, &qlen);
2297 if (m == NULL) {
2298 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_POWER, wh->i_addr2,
2299 "%s", "recv ps-poll, but queue empty");
2300 ieee80211_send_nulldata(ieee80211_ref_node(ni));
2301 vap->iv_stats.is_ps_qempty++; /* XXX node stat */
2302 if (vap->iv_set_tim != NULL)
2303 vap->iv_set_tim(ni, 0); /* just in case */
2304 return;
2305 }
2306 /*
2307 * If there are more packets, set the more packets bit
2308 * in the packet dispatched to the station; otherwise
2309 * turn off the TIM bit.
2310 */
2311 if (qlen != 0) {
2312 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2313 "recv ps-poll, send packet, %u still queued", qlen);
2314 m->m_flags |= M_MORE_DATA;
2315 } else {
2316 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2317 "%s", "recv ps-poll, send packet, queue empty");
2318 if (vap->iv_set_tim != NULL)
2319 vap->iv_set_tim(ni, 0);
2320 }
2321 m->m_flags |= M_PWR_SAV; /* bypass PS handling */
2322
2323 /*
2324 * Do the right thing; if it's an encap'ed frame then
| 416 if (err) {
417 /* NB: IFQ_HANDOFF reclaims mcopy */
418 } else {
419 ifp->if_opackets++;
420 }
421 }
422 }
423 if (m != NULL) {
424 /*
425 * Mark frame as coming from vap's interface.
426 */
427 m->m_pkthdr.rcvif = ifp;
428 if (m->m_flags & M_MCAST) {
429 /*
430 * Spam DWDS vap's w/ multicast traffic.
431 */
432 /* XXX only if dwds in use? */
433 ieee80211_dwds_mcast(vap, m);
434 }
435 if (ni->ni_vlan != 0) {
436 /* attach vlan tag */
437 m->m_pkthdr.ether_vtag = ni->ni_vlan;
438 m->m_flags |= M_VLANTAG;
439 }
440 ifp->if_input(ifp, m);
441 }
442}
443
444/*
445 * Decide if a received management frame should be
446 * printed when debugging is enabled. This filters some
447 * of the less interesting frames that come frequently
448 * (e.g. beacons).
449 */
450static __inline int
451doprint(struct ieee80211vap *vap, int subtype)
452{
453 switch (subtype) {
454 case IEEE80211_FC0_SUBTYPE_BEACON:
455 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
456 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
457 return 0;
458 }
459 return 1;
460}
461
462/*
463 * Process a received frame. The node associated with the sender
464 * should be supplied. If nothing was found in the node table then
465 * the caller is assumed to supply a reference to iv_bss instead.
466 * The RSSI and a timestamp are also supplied. The RSSI data is used
467 * during AP scanning to select a AP to associate with; it can have
468 * any units so long as values have consistent units and higher values
469 * mean ``better signal''. The receive timestamp is currently not used
470 * by the 802.11 layer.
471 */
472static int
473hostap_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
474{
475#define HAS_SEQ(type) ((type & 0x4) == 0)
476 struct ieee80211vap *vap = ni->ni_vap;
477 struct ieee80211com *ic = ni->ni_ic;
478 struct ifnet *ifp = vap->iv_ifp;
479 struct ieee80211_frame *wh;
480 struct ieee80211_key *key;
481 struct ether_header *eh;
482 int hdrspace, need_tap = 1; /* mbuf need to be tapped. */
483 uint8_t dir, type, subtype, qos;
484 uint8_t *bssid;
485 uint16_t rxseq;
486
487 if (m->m_flags & M_AMPDU_MPDU) {
488 /*
489 * Fastpath for A-MPDU reorder q resubmission. Frames
490 * w/ M_AMPDU_MPDU marked have already passed through
491 * here but were received out of order and been held on
492 * the reorder queue. When resubmitted they are marked
493 * with the M_AMPDU_MPDU flag and we can bypass most of
494 * the normal processing.
495 */
496 wh = mtod(m, struct ieee80211_frame *);
497 type = IEEE80211_FC0_TYPE_DATA;
498 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
499 subtype = IEEE80211_FC0_SUBTYPE_QOS;
500 hdrspace = ieee80211_hdrspace(ic, wh); /* XXX optimize? */
501 goto resubmit_ampdu;
502 }
503
504 KASSERT(ni != NULL, ("null node"));
505 ni->ni_inact = ni->ni_inact_reload;
506
507 type = -1; /* undefined */
508
509 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
510 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
511 ni->ni_macaddr, NULL,
512 "too short (1): len %u", m->m_pkthdr.len);
513 vap->iv_stats.is_rx_tooshort++;
514 goto out;
515 }
516 /*
517 * Bit of a cheat here, we use a pointer for a 3-address
518 * frame format but don't reference fields past outside
519 * ieee80211_frame_min w/o first validating the data is
520 * present.
521 */
522 wh = mtod(m, struct ieee80211_frame *);
523
524 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
525 IEEE80211_FC0_VERSION_0) {
526 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
527 ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
528 wh->i_fc[0], wh->i_fc[1]);
529 vap->iv_stats.is_rx_badversion++;
530 goto err;
531 }
532
533 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
534 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
535 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
536 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
537 if (dir != IEEE80211_FC1_DIR_NODS)
538 bssid = wh->i_addr1;
539 else if (type == IEEE80211_FC0_TYPE_CTL)
540 bssid = wh->i_addr1;
541 else {
542 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
543 IEEE80211_DISCARD_MAC(vap,
544 IEEE80211_MSG_ANY, ni->ni_macaddr,
545 NULL, "too short (2): len %u",
546 m->m_pkthdr.len);
547 vap->iv_stats.is_rx_tooshort++;
548 goto out;
549 }
550 bssid = wh->i_addr3;
551 }
552 /*
553 * Validate the bssid.
554 */
555 if (!(type == IEEE80211_FC0_TYPE_MGT &&
556 subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
557 !IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
558 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
559 /* not interested in */
560 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
561 bssid, NULL, "%s", "not to bss");
562 vap->iv_stats.is_rx_wrongbss++;
563 goto out;
564 }
565
566 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
567 ni->ni_noise = nf;
568 if (HAS_SEQ(type)) {
569 uint8_t tid = ieee80211_gettid(wh);
570 if (IEEE80211_QOS_HAS_SEQ(wh) &&
571 TID_TO_WME_AC(tid) >= WME_AC_VI)
572 ic->ic_wme.wme_hipri_traffic++;
573 rxseq = le16toh(*(uint16_t *)wh->i_seq);
574 if (! ieee80211_check_rxseq(ni, wh)) {
575 /* duplicate, discard */
576 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
577 bssid, "duplicate",
578 "seqno <%u,%u> fragno <%u,%u> tid %u",
579 rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
580 ni->ni_rxseqs[tid] >>
581 IEEE80211_SEQ_SEQ_SHIFT,
582 rxseq & IEEE80211_SEQ_FRAG_MASK,
583 ni->ni_rxseqs[tid] &
584 IEEE80211_SEQ_FRAG_MASK,
585 tid);
586 vap->iv_stats.is_rx_dup++;
587 IEEE80211_NODE_STAT(ni, rx_dup);
588 goto out;
589 }
590 ni->ni_rxseqs[tid] = rxseq;
591 }
592 }
593
594 switch (type) {
595 case IEEE80211_FC0_TYPE_DATA:
596 hdrspace = ieee80211_hdrspace(ic, wh);
597 if (m->m_len < hdrspace &&
598 (m = m_pullup(m, hdrspace)) == NULL) {
599 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
600 ni->ni_macaddr, NULL,
601 "data too short: expecting %u", hdrspace);
602 vap->iv_stats.is_rx_tooshort++;
603 goto out; /* XXX */
604 }
605 if (!(dir == IEEE80211_FC1_DIR_TODS ||
606 (dir == IEEE80211_FC1_DIR_DSTODS &&
607 (vap->iv_flags & IEEE80211_F_DWDS)))) {
608 if (dir != IEEE80211_FC1_DIR_DSTODS) {
609 IEEE80211_DISCARD(vap,
610 IEEE80211_MSG_INPUT, wh, "data",
611 "incorrect dir 0x%x", dir);
612 } else {
613 IEEE80211_DISCARD(vap,
614 IEEE80211_MSG_INPUT |
615 IEEE80211_MSG_WDS, wh,
616 "4-address data",
617 "%s", "DWDS not enabled");
618 }
619 vap->iv_stats.is_rx_wrongdir++;
620 goto out;
621 }
622 /* check if source STA is associated */
623 if (ni == vap->iv_bss) {
624 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
625 wh, "data", "%s", "unknown src");
626 ieee80211_send_error(ni, wh->i_addr2,
627 IEEE80211_FC0_SUBTYPE_DEAUTH,
628 IEEE80211_REASON_NOT_AUTHED);
629 vap->iv_stats.is_rx_notassoc++;
630 goto err;
631 }
632 if (ni->ni_associd == 0) {
633 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
634 wh, "data", "%s", "unassoc src");
635 IEEE80211_SEND_MGMT(ni,
636 IEEE80211_FC0_SUBTYPE_DISASSOC,
637 IEEE80211_REASON_NOT_ASSOCED);
638 vap->iv_stats.is_rx_notassoc++;
639 goto err;
640 }
641
642 /*
643 * Check for power save state change.
644 * XXX out-of-order A-MPDU frames?
645 */
646 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
647 (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
648 vap->iv_node_ps(ni,
649 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
650 /*
651 * For 4-address packets handle WDS discovery
652 * notifications. Once a WDS link is setup frames
653 * are just delivered to the WDS vap (see below).
654 */
655 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap == NULL) {
656 if (!ieee80211_node_is_authorized(ni)) {
657 IEEE80211_DISCARD(vap,
658 IEEE80211_MSG_INPUT |
659 IEEE80211_MSG_WDS, wh,
660 "4-address data",
661 "%s", "unauthorized port");
662 vap->iv_stats.is_rx_unauth++;
663 IEEE80211_NODE_STAT(ni, rx_unauth);
664 goto err;
665 }
666 ieee80211_dwds_discover(ni, m);
667 return type;
668 }
669
670 /*
671 * Handle A-MPDU re-ordering. If the frame is to be
672 * processed directly then ieee80211_ampdu_reorder
673 * will return 0; otherwise it has consumed the mbuf
674 * and we should do nothing more with it.
675 */
676 if ((m->m_flags & M_AMPDU) &&
677 ieee80211_ampdu_reorder(ni, m) != 0) {
678 m = NULL;
679 goto out;
680 }
681 resubmit_ampdu:
682
683 /*
684 * Handle privacy requirements. Note that we
685 * must not be preempted from here until after
686 * we (potentially) call ieee80211_crypto_demic;
687 * otherwise we may violate assumptions in the
688 * crypto cipher modules used to do delayed update
689 * of replay sequence numbers.
690 */
691 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
692 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
693 /*
694 * Discard encrypted frames when privacy is off.
695 */
696 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
697 wh, "WEP", "%s", "PRIVACY off");
698 vap->iv_stats.is_rx_noprivacy++;
699 IEEE80211_NODE_STAT(ni, rx_noprivacy);
700 goto out;
701 }
702 key = ieee80211_crypto_decap(ni, m, hdrspace);
703 if (key == NULL) {
704 /* NB: stats+msgs handled in crypto_decap */
705 IEEE80211_NODE_STAT(ni, rx_wepfail);
706 goto out;
707 }
708 wh = mtod(m, struct ieee80211_frame *);
709 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
710 } else {
711 /* XXX M_WEP and IEEE80211_F_PRIVACY */
712 key = NULL;
713 }
714
715 /*
716 * Save QoS bits for use below--before we strip the header.
717 */
718 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
719 qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
720 ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
721 ((struct ieee80211_qosframe *)wh)->i_qos[0];
722 } else
723 qos = 0;
724
725 /*
726 * Next up, any fragmentation.
727 */
728 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
729 m = ieee80211_defrag(ni, m, hdrspace);
730 if (m == NULL) {
731 /* Fragment dropped or frame not complete yet */
732 goto out;
733 }
734 }
735 wh = NULL; /* no longer valid, catch any uses */
736
737 /*
738 * Next strip any MSDU crypto bits.
739 */
740 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
741 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
742 ni->ni_macaddr, "data", "%s", "demic error");
743 vap->iv_stats.is_rx_demicfail++;
744 IEEE80211_NODE_STAT(ni, rx_demicfail);
745 goto out;
746 }
747 /* copy to listener after decrypt */
748 if (ieee80211_radiotap_active_vap(vap))
749 ieee80211_radiotap_rx(vap, m);
750 need_tap = 0;
751 /*
752 * Finally, strip the 802.11 header.
753 */
754 m = ieee80211_decap(vap, m, hdrspace);
755 if (m == NULL) {
756 /* XXX mask bit to check for both */
757 /* don't count Null data frames as errors */
758 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
759 subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
760 goto out;
761 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
762 ni->ni_macaddr, "data", "%s", "decap error");
763 vap->iv_stats.is_rx_decap++;
764 IEEE80211_NODE_STAT(ni, rx_decap);
765 goto err;
766 }
767 eh = mtod(m, struct ether_header *);
768 if (!ieee80211_node_is_authorized(ni)) {
769 /*
770 * Deny any non-PAE frames received prior to
771 * authorization. For open/shared-key
772 * authentication the port is mark authorized
773 * after authentication completes. For 802.1x
774 * the port is not marked authorized by the
775 * authenticator until the handshake has completed.
776 */
777 if (eh->ether_type != htons(ETHERTYPE_PAE)) {
778 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
779 eh->ether_shost, "data",
780 "unauthorized port: ether type 0x%x len %u",
781 eh->ether_type, m->m_pkthdr.len);
782 vap->iv_stats.is_rx_unauth++;
783 IEEE80211_NODE_STAT(ni, rx_unauth);
784 goto err;
785 }
786 } else {
787 /*
788 * When denying unencrypted frames, discard
789 * any non-PAE frames received without encryption.
790 */
791 if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
792 (key == NULL && (m->m_flags & M_WEP) == 0) &&
793 eh->ether_type != htons(ETHERTYPE_PAE)) {
794 /*
795 * Drop unencrypted frames.
796 */
797 vap->iv_stats.is_rx_unencrypted++;
798 IEEE80211_NODE_STAT(ni, rx_unencrypted);
799 goto out;
800 }
801 }
802 /* XXX require HT? */
803 if (qos & IEEE80211_QOS_AMSDU) {
804 m = ieee80211_decap_amsdu(ni, m);
805 if (m == NULL)
806 return IEEE80211_FC0_TYPE_DATA;
807 } else {
808#ifdef IEEE80211_SUPPORT_SUPERG
809 m = ieee80211_decap_fastframe(vap, ni, m);
810 if (m == NULL)
811 return IEEE80211_FC0_TYPE_DATA;
812#endif
813 }
814 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
815 ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
816 else
817 hostap_deliver_data(vap, ni, m);
818 return IEEE80211_FC0_TYPE_DATA;
819
820 case IEEE80211_FC0_TYPE_MGT:
821 vap->iv_stats.is_rx_mgmt++;
822 IEEE80211_NODE_STAT(ni, rx_mgmt);
823 if (dir != IEEE80211_FC1_DIR_NODS) {
824 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
825 wh, "mgt", "incorrect dir 0x%x", dir);
826 vap->iv_stats.is_rx_wrongdir++;
827 goto err;
828 }
829 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
830 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
831 ni->ni_macaddr, "mgt", "too short: len %u",
832 m->m_pkthdr.len);
833 vap->iv_stats.is_rx_tooshort++;
834 goto out;
835 }
836 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
837 /* ensure return frames are unicast */
838 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
839 wh, NULL, "source is multicast: %s",
840 ether_sprintf(wh->i_addr2));
841 vap->iv_stats.is_rx_mgtdiscard++; /* XXX stat */
842 goto out;
843 }
844#ifdef IEEE80211_DEBUG
845 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
846 ieee80211_msg_dumppkts(vap)) {
847 if_printf(ifp, "received %s from %s rssi %d\n",
848 ieee80211_mgt_subtype_name[subtype >>
849 IEEE80211_FC0_SUBTYPE_SHIFT],
850 ether_sprintf(wh->i_addr2), rssi);
851 }
852#endif
853 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
854 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
855 /*
856 * Only shared key auth frames with a challenge
857 * should be encrypted, discard all others.
858 */
859 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
860 wh, NULL,
861 "%s", "WEP set but not permitted");
862 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
863 goto out;
864 }
865 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
866 /*
867 * Discard encrypted frames when privacy is off.
868 */
869 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
870 wh, NULL, "%s", "WEP set but PRIVACY off");
871 vap->iv_stats.is_rx_noprivacy++;
872 goto out;
873 }
874 hdrspace = ieee80211_hdrspace(ic, wh);
875 key = ieee80211_crypto_decap(ni, m, hdrspace);
876 if (key == NULL) {
877 /* NB: stats+msgs handled in crypto_decap */
878 goto out;
879 }
880 wh = mtod(m, struct ieee80211_frame *);
881 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
882 }
883 /*
884 * Pass the packet to radiotap before calling iv_recv_mgmt().
885 * Otherwise iv_recv_mgmt() might pass another packet to
886 * radiotap, resulting in out of order packet captures.
887 */
888 if (ieee80211_radiotap_active_vap(vap))
889 ieee80211_radiotap_rx(vap, m);
890 need_tap = 0;
891 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
892 goto out;
893
894 case IEEE80211_FC0_TYPE_CTL:
895 vap->iv_stats.is_rx_ctl++;
896 IEEE80211_NODE_STAT(ni, rx_ctrl);
897 vap->iv_recv_ctl(ni, m, subtype);
898 goto out;
899 default:
900 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
901 wh, "bad", "frame type 0x%x", type);
902 /* should not come here */
903 break;
904 }
905err:
906 ifp->if_ierrors++;
907out:
908 if (m != NULL) {
909 if (need_tap && ieee80211_radiotap_active_vap(vap))
910 ieee80211_radiotap_rx(vap, m);
911 m_freem(m);
912 }
913 return type;
914}
915
916static void
917hostap_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
918 int rssi, int nf, uint16_t seq, uint16_t status)
919{
920 struct ieee80211vap *vap = ni->ni_vap;
921
922 KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
923
924 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
925 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
926 ni->ni_macaddr, "open auth",
927 "bad sta auth mode %u", ni->ni_authmode);
928 vap->iv_stats.is_rx_bad_auth++; /* XXX */
929 /*
930 * Clear any challenge text that may be there if
931 * a previous shared key auth failed and then an
932 * open auth is attempted.
933 */
934 if (ni->ni_challenge != NULL) {
935 free(ni->ni_challenge, M_80211_NODE);
936 ni->ni_challenge = NULL;
937 }
938 /* XXX hack to workaround calling convention */
939 ieee80211_send_error(ni, wh->i_addr2,
940 IEEE80211_FC0_SUBTYPE_AUTH,
941 (seq + 1) | (IEEE80211_STATUS_ALG<<16));
942 return;
943 }
944 if (seq != IEEE80211_AUTH_OPEN_REQUEST) {
945 vap->iv_stats.is_rx_bad_auth++;
946 return;
947 }
948 /* always accept open authentication requests */
949 if (ni == vap->iv_bss) {
950 ni = ieee80211_dup_bss(vap, wh->i_addr2);
951 if (ni == NULL)
952 return;
953 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
954 (void) ieee80211_ref_node(ni);
955 /*
956 * Mark the node as referenced to reflect that it's
957 * reference count has been bumped to insure it remains
958 * after the transaction completes.
959 */
960 ni->ni_flags |= IEEE80211_NODE_AREF;
961 /*
962 * Mark the node as requiring a valid association id
963 * before outbound traffic is permitted.
964 */
965 ni->ni_flags |= IEEE80211_NODE_ASSOCID;
966
967 if (vap->iv_acl != NULL &&
968 vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
969 /*
970 * When the ACL policy is set to RADIUS we defer the
971 * authorization to a user agent. Dispatch an event,
972 * a subsequent MLME call will decide the fate of the
973 * station. If the user agent is not present then the
974 * node will be reclaimed due to inactivity.
975 */
976 IEEE80211_NOTE_MAC(vap,
977 IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL, ni->ni_macaddr,
978 "%s", "station authentication defered (radius acl)");
979 ieee80211_notify_node_auth(ni);
980 } else {
981 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
982 IEEE80211_NOTE_MAC(vap,
983 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni->ni_macaddr,
984 "%s", "station authenticated (open)");
985 /*
986 * When 802.1x is not in use mark the port
987 * authorized at this point so traffic can flow.
988 */
989 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
990 ieee80211_node_authorize(ni);
991 }
992}
993
994static void
995hostap_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
996 uint8_t *frm, uint8_t *efrm, int rssi, int nf,
997 uint16_t seq, uint16_t status)
998{
999 struct ieee80211vap *vap = ni->ni_vap;
1000 uint8_t *challenge;
1001 int allocbs, estatus;
1002
1003 KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
1004
1005 /*
1006 * NB: this can happen as we allow pre-shared key
1007 * authentication to be enabled w/o wep being turned
1008 * on so that configuration of these can be done
1009 * in any order. It may be better to enforce the
1010 * ordering in which case this check would just be
1011 * for sanity/consistency.
1012 */
1013 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
1014 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1015 ni->ni_macaddr, "shared key auth",
1016 "%s", " PRIVACY is disabled");
1017 estatus = IEEE80211_STATUS_ALG;
1018 goto bad;
1019 }
1020 /*
1021 * Pre-shared key authentication is evil; accept
1022 * it only if explicitly configured (it is supported
1023 * mainly for compatibility with clients like Mac OS X).
1024 */
1025 if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1026 ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1027 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1028 ni->ni_macaddr, "shared key auth",
1029 "bad sta auth mode %u", ni->ni_authmode);
1030 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1031 estatus = IEEE80211_STATUS_ALG;
1032 goto bad;
1033 }
1034
1035 challenge = NULL;
1036 if (frm + 1 < efrm) {
1037 if ((frm[1] + 2) > (efrm - frm)) {
1038 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1039 ni->ni_macaddr, "shared key auth",
1040 "ie %d/%d too long",
1041 frm[0], (frm[1] + 2) - (efrm - frm));
1042 vap->iv_stats.is_rx_bad_auth++;
1043 estatus = IEEE80211_STATUS_CHALLENGE;
1044 goto bad;
1045 }
1046 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1047 challenge = frm;
1048 frm += frm[1] + 2;
1049 }
1050 switch (seq) {
1051 case IEEE80211_AUTH_SHARED_CHALLENGE:
1052 case IEEE80211_AUTH_SHARED_RESPONSE:
1053 if (challenge == NULL) {
1054 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1055 ni->ni_macaddr, "shared key auth",
1056 "%s", "no challenge");
1057 vap->iv_stats.is_rx_bad_auth++;
1058 estatus = IEEE80211_STATUS_CHALLENGE;
1059 goto bad;
1060 }
1061 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1062 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1063 ni->ni_macaddr, "shared key auth",
1064 "bad challenge len %d", challenge[1]);
1065 vap->iv_stats.is_rx_bad_auth++;
1066 estatus = IEEE80211_STATUS_CHALLENGE;
1067 goto bad;
1068 }
1069 default:
1070 break;
1071 }
1072 switch (seq) {
1073 case IEEE80211_AUTH_SHARED_REQUEST:
1074 if (ni == vap->iv_bss) {
1075 ni = ieee80211_dup_bss(vap, wh->i_addr2);
1076 if (ni == NULL) {
1077 /* NB: no way to return an error */
1078 return;
1079 }
1080 allocbs = 1;
1081 } else {
1082 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1083 (void) ieee80211_ref_node(ni);
1084 allocbs = 0;
1085 }
1086 /*
1087 * Mark the node as referenced to reflect that it's
1088 * reference count has been bumped to insure it remains
1089 * after the transaction completes.
1090 */
1091 ni->ni_flags |= IEEE80211_NODE_AREF;
1092 /*
1093 * Mark the node as requiring a valid associatio id
1094 * before outbound traffic is permitted.
1095 */
1096 ni->ni_flags |= IEEE80211_NODE_ASSOCID;
1097 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1098 ni->ni_noise = nf;
1099 if (!ieee80211_alloc_challenge(ni)) {
1100 /* NB: don't return error so they rexmit */
1101 return;
1102 }
1103 get_random_bytes(ni->ni_challenge,
1104 IEEE80211_CHALLENGE_LEN);
1105 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1106 ni, "shared key %sauth request", allocbs ? "" : "re");
1107 /*
1108 * When the ACL policy is set to RADIUS we defer the
1109 * authorization to a user agent. Dispatch an event,
1110 * a subsequent MLME call will decide the fate of the
1111 * station. If the user agent is not present then the
1112 * node will be reclaimed due to inactivity.
1113 */
1114 if (vap->iv_acl != NULL &&
1115 vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
1116 IEEE80211_NOTE_MAC(vap,
1117 IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL,
1118 ni->ni_macaddr,
1119 "%s", "station authentication defered (radius acl)");
1120 ieee80211_notify_node_auth(ni);
1121 return;
1122 }
1123 break;
1124 case IEEE80211_AUTH_SHARED_RESPONSE:
1125 if (ni == vap->iv_bss) {
1126 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1127 ni->ni_macaddr, "shared key response",
1128 "%s", "unknown station");
1129 /* NB: don't send a response */
1130 return;
1131 }
1132 if (ni->ni_challenge == NULL) {
1133 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1134 ni->ni_macaddr, "shared key response",
1135 "%s", "no challenge recorded");
1136 vap->iv_stats.is_rx_bad_auth++;
1137 estatus = IEEE80211_STATUS_CHALLENGE;
1138 goto bad;
1139 }
1140 if (memcmp(ni->ni_challenge, &challenge[2],
1141 challenge[1]) != 0) {
1142 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1143 ni->ni_macaddr, "shared key response",
1144 "%s", "challenge mismatch");
1145 vap->iv_stats.is_rx_auth_fail++;
1146 estatus = IEEE80211_STATUS_CHALLENGE;
1147 goto bad;
1148 }
1149 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1150 ni, "%s", "station authenticated (shared key)");
1151 ieee80211_node_authorize(ni);
1152 break;
1153 default:
1154 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1155 ni->ni_macaddr, "shared key auth",
1156 "bad seq %d", seq);
1157 vap->iv_stats.is_rx_bad_auth++;
1158 estatus = IEEE80211_STATUS_SEQUENCE;
1159 goto bad;
1160 }
1161 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1162 return;
1163bad:
1164 /*
1165 * Send an error response; but only when operating as an AP.
1166 */
1167 /* XXX hack to workaround calling convention */
1168 ieee80211_send_error(ni, wh->i_addr2,
1169 IEEE80211_FC0_SUBTYPE_AUTH,
1170 (seq + 1) | (estatus<<16));
1171}
1172
1173/*
1174 * Convert a WPA cipher selector OUI to an internal
1175 * cipher algorithm. Where appropriate we also
1176 * record any key length.
1177 */
1178static int
1179wpa_cipher(const uint8_t *sel, uint8_t *keylen)
1180{
1181#define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1182 uint32_t w = LE_READ_4(sel);
1183
1184 switch (w) {
1185 case WPA_SEL(WPA_CSE_NULL):
1186 return IEEE80211_CIPHER_NONE;
1187 case WPA_SEL(WPA_CSE_WEP40):
1188 if (keylen)
1189 *keylen = 40 / NBBY;
1190 return IEEE80211_CIPHER_WEP;
1191 case WPA_SEL(WPA_CSE_WEP104):
1192 if (keylen)
1193 *keylen = 104 / NBBY;
1194 return IEEE80211_CIPHER_WEP;
1195 case WPA_SEL(WPA_CSE_TKIP):
1196 return IEEE80211_CIPHER_TKIP;
1197 case WPA_SEL(WPA_CSE_CCMP):
1198 return IEEE80211_CIPHER_AES_CCM;
1199 }
1200 return 32; /* NB: so 1<< is discarded */
1201#undef WPA_SEL
1202}
1203
1204/*
1205 * Convert a WPA key management/authentication algorithm
1206 * to an internal code.
1207 */
1208static int
1209wpa_keymgmt(const uint8_t *sel)
1210{
1211#define WPA_SEL(x) (((x)<<24)|WPA_OUI)
1212 uint32_t w = LE_READ_4(sel);
1213
1214 switch (w) {
1215 case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1216 return WPA_ASE_8021X_UNSPEC;
1217 case WPA_SEL(WPA_ASE_8021X_PSK):
1218 return WPA_ASE_8021X_PSK;
1219 case WPA_SEL(WPA_ASE_NONE):
1220 return WPA_ASE_NONE;
1221 }
1222 return 0; /* NB: so is discarded */
1223#undef WPA_SEL
1224}
1225
1226/*
1227 * Parse a WPA information element to collect parameters.
1228 * Note that we do not validate security parameters; that
1229 * is handled by the authenticator; the parsing done here
1230 * is just for internal use in making operational decisions.
1231 */
1232static int
1233ieee80211_parse_wpa(struct ieee80211vap *vap, const uint8_t *frm,
1234 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1235{
1236 uint8_t len = frm[1];
1237 uint32_t w;
1238 int n;
1239
1240 /*
1241 * Check the length once for fixed parts: OUI, type,
1242 * version, mcast cipher, and 2 selector counts.
1243 * Other, variable-length data, must be checked separately.
1244 */
1245 if ((vap->iv_flags & IEEE80211_F_WPA1) == 0) {
1246 IEEE80211_DISCARD_IE(vap,
1247 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1248 wh, "WPA", "not WPA, flags 0x%x", vap->iv_flags);
1249 return IEEE80211_REASON_IE_INVALID;
1250 }
1251 if (len < 14) {
1252 IEEE80211_DISCARD_IE(vap,
1253 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1254 wh, "WPA", "too short, len %u", len);
1255 return IEEE80211_REASON_IE_INVALID;
1256 }
1257 frm += 6, len -= 4; /* NB: len is payload only */
1258 /* NB: iswpaoui already validated the OUI and type */
1259 w = LE_READ_2(frm);
1260 if (w != WPA_VERSION) {
1261 IEEE80211_DISCARD_IE(vap,
1262 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1263 wh, "WPA", "bad version %u", w);
1264 return IEEE80211_REASON_IE_INVALID;
1265 }
1266 frm += 2, len -= 2;
1267
1268 memset(rsn, 0, sizeof(*rsn));
1269
1270 /* multicast/group cipher */
1271 rsn->rsn_mcastcipher = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1272 frm += 4, len -= 4;
1273
1274 /* unicast ciphers */
1275 n = LE_READ_2(frm);
1276 frm += 2, len -= 2;
1277 if (len < n*4+2) {
1278 IEEE80211_DISCARD_IE(vap,
1279 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1280 wh, "WPA", "ucast cipher data too short; len %u, n %u",
1281 len, n);
1282 return IEEE80211_REASON_IE_INVALID;
1283 }
1284 w = 0;
1285 for (; n > 0; n--) {
1286 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1287 frm += 4, len -= 4;
1288 }
1289 if (w & (1<<IEEE80211_CIPHER_TKIP))
1290 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1291 else
1292 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1293
1294 /* key management algorithms */
1295 n = LE_READ_2(frm);
1296 frm += 2, len -= 2;
1297 if (len < n*4) {
1298 IEEE80211_DISCARD_IE(vap,
1299 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1300 wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1301 len, n);
1302 return IEEE80211_REASON_IE_INVALID;
1303 }
1304 w = 0;
1305 for (; n > 0; n--) {
1306 w |= wpa_keymgmt(frm);
1307 frm += 4, len -= 4;
1308 }
1309 if (w & WPA_ASE_8021X_UNSPEC)
1310 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1311 else
1312 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1313
1314 if (len > 2) /* optional capabilities */
1315 rsn->rsn_caps = LE_READ_2(frm);
1316
1317 return 0;
1318}
1319
1320/*
1321 * Convert an RSN cipher selector OUI to an internal
1322 * cipher algorithm. Where appropriate we also
1323 * record any key length.
1324 */
1325static int
1326rsn_cipher(const uint8_t *sel, uint8_t *keylen)
1327{
1328#define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1329 uint32_t w = LE_READ_4(sel);
1330
1331 switch (w) {
1332 case RSN_SEL(RSN_CSE_NULL):
1333 return IEEE80211_CIPHER_NONE;
1334 case RSN_SEL(RSN_CSE_WEP40):
1335 if (keylen)
1336 *keylen = 40 / NBBY;
1337 return IEEE80211_CIPHER_WEP;
1338 case RSN_SEL(RSN_CSE_WEP104):
1339 if (keylen)
1340 *keylen = 104 / NBBY;
1341 return IEEE80211_CIPHER_WEP;
1342 case RSN_SEL(RSN_CSE_TKIP):
1343 return IEEE80211_CIPHER_TKIP;
1344 case RSN_SEL(RSN_CSE_CCMP):
1345 return IEEE80211_CIPHER_AES_CCM;
1346 case RSN_SEL(RSN_CSE_WRAP):
1347 return IEEE80211_CIPHER_AES_OCB;
1348 }
1349 return 32; /* NB: so 1<< is discarded */
1350#undef WPA_SEL
1351}
1352
1353/*
1354 * Convert an RSN key management/authentication algorithm
1355 * to an internal code.
1356 */
1357static int
1358rsn_keymgmt(const uint8_t *sel)
1359{
1360#define RSN_SEL(x) (((x)<<24)|RSN_OUI)
1361 uint32_t w = LE_READ_4(sel);
1362
1363 switch (w) {
1364 case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1365 return RSN_ASE_8021X_UNSPEC;
1366 case RSN_SEL(RSN_ASE_8021X_PSK):
1367 return RSN_ASE_8021X_PSK;
1368 case RSN_SEL(RSN_ASE_NONE):
1369 return RSN_ASE_NONE;
1370 }
1371 return 0; /* NB: so is discarded */
1372#undef RSN_SEL
1373}
1374
1375/*
1376 * Parse a WPA/RSN information element to collect parameters
1377 * and validate the parameters against what has been
1378 * configured for the system.
1379 */
1380static int
1381ieee80211_parse_rsn(struct ieee80211vap *vap, const uint8_t *frm,
1382 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1383{
1384 uint8_t len = frm[1];
1385 uint32_t w;
1386 int n;
1387
1388 /*
1389 * Check the length once for fixed parts:
1390 * version, mcast cipher, and 2 selector counts.
1391 * Other, variable-length data, must be checked separately.
1392 */
1393 if ((vap->iv_flags & IEEE80211_F_WPA2) == 0) {
1394 IEEE80211_DISCARD_IE(vap,
1395 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1396 wh, "WPA", "not RSN, flags 0x%x", vap->iv_flags);
1397 return IEEE80211_REASON_IE_INVALID;
1398 }
1399 if (len < 10) {
1400 IEEE80211_DISCARD_IE(vap,
1401 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1402 wh, "RSN", "too short, len %u", len);
1403 return IEEE80211_REASON_IE_INVALID;
1404 }
1405 frm += 2;
1406 w = LE_READ_2(frm);
1407 if (w != RSN_VERSION) {
1408 IEEE80211_DISCARD_IE(vap,
1409 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1410 wh, "RSN", "bad version %u", w);
1411 return IEEE80211_REASON_IE_INVALID;
1412 }
1413 frm += 2, len -= 2;
1414
1415 memset(rsn, 0, sizeof(*rsn));
1416
1417 /* multicast/group cipher */
1418 rsn->rsn_mcastcipher = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1419 frm += 4, len -= 4;
1420
1421 /* unicast ciphers */
1422 n = LE_READ_2(frm);
1423 frm += 2, len -= 2;
1424 if (len < n*4+2) {
1425 IEEE80211_DISCARD_IE(vap,
1426 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1427 wh, "RSN", "ucast cipher data too short; len %u, n %u",
1428 len, n);
1429 return IEEE80211_REASON_IE_INVALID;
1430 }
1431 w = 0;
1432 for (; n > 0; n--) {
1433 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1434 frm += 4, len -= 4;
1435 }
1436 if (w & (1<<IEEE80211_CIPHER_TKIP))
1437 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1438 else
1439 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1440
1441 /* key management algorithms */
1442 n = LE_READ_2(frm);
1443 frm += 2, len -= 2;
1444 if (len < n*4) {
1445 IEEE80211_DISCARD_IE(vap,
1446 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1447 wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1448 len, n);
1449 return IEEE80211_REASON_IE_INVALID;
1450 }
1451 w = 0;
1452 for (; n > 0; n--) {
1453 w |= rsn_keymgmt(frm);
1454 frm += 4, len -= 4;
1455 }
1456 if (w & RSN_ASE_8021X_UNSPEC)
1457 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1458 else
1459 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1460
1461 /* optional RSN capabilities */
1462 if (len > 2)
1463 rsn->rsn_caps = LE_READ_2(frm);
1464 /* XXXPMKID */
1465
1466 return 0;
1467}
1468
1469/*
1470 * WPA/802.11i assocation request processing.
1471 */
1472static int
1473wpa_assocreq(struct ieee80211_node *ni, struct ieee80211_rsnparms *rsnparms,
1474 const struct ieee80211_frame *wh, const uint8_t *wpa,
1475 const uint8_t *rsn, uint16_t capinfo)
1476{
1477 struct ieee80211vap *vap = ni->ni_vap;
1478 uint8_t reason;
1479 int badwparsn;
1480
1481 ni->ni_flags &= ~(IEEE80211_NODE_WPS|IEEE80211_NODE_TSN);
1482 if (wpa == NULL && rsn == NULL) {
1483 if (vap->iv_flags_ext & IEEE80211_FEXT_WPS) {
1484 /*
1485 * W-Fi Protected Setup (WPS) permits
1486 * clients to associate and pass EAPOL frames
1487 * to establish initial credentials.
1488 */
1489 ni->ni_flags |= IEEE80211_NODE_WPS;
1490 return 1;
1491 }
1492 if ((vap->iv_flags_ext & IEEE80211_FEXT_TSN) &&
1493 (capinfo & IEEE80211_CAPINFO_PRIVACY)) {
1494 /*
1495 * Transitional Security Network. Permits clients
1496 * to associate and use WEP while WPA is configured.
1497 */
1498 ni->ni_flags |= IEEE80211_NODE_TSN;
1499 return 1;
1500 }
1501 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1502 wh, NULL, "%s", "no WPA/RSN IE in association request");
1503 vap->iv_stats.is_rx_assoc_badwpaie++;
1504 reason = IEEE80211_REASON_IE_INVALID;
1505 goto bad;
1506 }
1507 /* assert right association security credentials */
1508 badwparsn = 0; /* NB: to silence compiler */
1509 switch (vap->iv_flags & IEEE80211_F_WPA) {
1510 case IEEE80211_F_WPA1:
1511 badwparsn = (wpa == NULL);
1512 break;
1513 case IEEE80211_F_WPA2:
1514 badwparsn = (rsn == NULL);
1515 break;
1516 case IEEE80211_F_WPA1|IEEE80211_F_WPA2:
1517 badwparsn = (wpa == NULL && rsn == NULL);
1518 break;
1519 }
1520 if (badwparsn) {
1521 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1522 wh, NULL,
1523 "%s", "missing WPA/RSN IE in association request");
1524 vap->iv_stats.is_rx_assoc_badwpaie++;
1525 reason = IEEE80211_REASON_IE_INVALID;
1526 goto bad;
1527 }
1528 /*
1529 * Parse WPA/RSN information element.
1530 */
1531 if (wpa != NULL)
1532 reason = ieee80211_parse_wpa(vap, wpa, rsnparms, wh);
1533 else
1534 reason = ieee80211_parse_rsn(vap, rsn, rsnparms, wh);
1535 if (reason != 0) {
1536 /* XXX distinguish WPA/RSN? */
1537 vap->iv_stats.is_rx_assoc_badwpaie++;
1538 goto bad;
1539 }
1540 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, ni,
1541 "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x",
1542 wpa != NULL ? "WPA" : "RSN",
1543 rsnparms->rsn_mcastcipher, rsnparms->rsn_mcastkeylen,
1544 rsnparms->rsn_ucastcipher, rsnparms->rsn_ucastkeylen,
1545 rsnparms->rsn_keymgmt, rsnparms->rsn_caps);
1546
1547 return 1;
1548bad:
1549 ieee80211_node_deauth(ni, reason);
1550 return 0;
1551}
1552
1553/* XXX find a better place for definition */
1554struct l2_update_frame {
1555 struct ether_header eh;
1556 uint8_t dsap;
1557 uint8_t ssap;
1558 uint8_t control;
1559 uint8_t xid[3];
1560} __packed;
1561
1562/*
1563 * Deliver a TGf L2UF frame on behalf of a station.
1564 * This primes any bridge when the station is roaming
1565 * between ap's on the same wired network.
1566 */
1567static void
1568ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1569{
1570 struct ieee80211vap *vap = ni->ni_vap;
1571 struct ifnet *ifp = vap->iv_ifp;
1572 struct mbuf *m;
1573 struct l2_update_frame *l2uf;
1574 struct ether_header *eh;
1575
1576 m = m_gethdr(M_NOWAIT, MT_DATA);
1577 if (m == NULL) {
1578 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1579 "%s", "no mbuf for l2uf frame");
1580 vap->iv_stats.is_rx_nobuf++; /* XXX not right */
1581 return;
1582 }
1583 l2uf = mtod(m, struct l2_update_frame *);
1584 eh = &l2uf->eh;
1585 /* dst: Broadcast address */
1586 IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1587 /* src: associated STA */
1588 IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1589 eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1590
1591 l2uf->dsap = 0;
1592 l2uf->ssap = 0;
1593 l2uf->control = 0xf5;
1594 l2uf->xid[0] = 0x81;
1595 l2uf->xid[1] = 0x80;
1596 l2uf->xid[2] = 0x00;
1597
1598 m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1599 hostap_deliver_data(vap, ni, m);
1600}
1601
1602static void
1603ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1604 int reassoc, int resp, const char *tag, int rate)
1605{
1606 IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1607 "deny %s request, %s rate set mismatch, rate/MCS %d",
1608 reassoc ? "reassoc" : "assoc", tag, rate & IEEE80211_RATE_VAL);
1609 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_BASIC_RATE);
1610 ieee80211_node_leave(ni);
1611}
1612
1613static void
1614capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1615 int reassoc, int resp, const char *tag, int capinfo)
1616{
1617 struct ieee80211vap *vap = ni->ni_vap;
1618
1619 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1620 "deny %s request, %s mismatch 0x%x",
1621 reassoc ? "reassoc" : "assoc", tag, capinfo);
1622 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_CAPINFO);
1623 ieee80211_node_leave(ni);
1624 vap->iv_stats.is_rx_assoc_capmismatch++;
1625}
1626
1627static void
1628htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1629 int reassoc, int resp)
1630{
1631 IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1632 "deny %s request, %s missing HT ie", reassoc ? "reassoc" : "assoc");
1633 /* XXX no better code */
1634 IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_MISSING_HT_CAPS);
1635 ieee80211_node_leave(ni);
1636}
1637
1638static void
1639authalgreject(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1640 int algo, int seq, int status)
1641{
1642 struct ieee80211vap *vap = ni->ni_vap;
1643
1644 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1645 wh, NULL, "unsupported alg %d", algo);
1646 vap->iv_stats.is_rx_auth_unsupported++;
1647 ieee80211_send_error(ni, wh->i_addr2, IEEE80211_FC0_SUBTYPE_AUTH,
1648 seq | (status << 16));
1649}
1650
1651static __inline int
1652ishtmixed(const uint8_t *ie)
1653{
1654 const struct ieee80211_ie_htinfo *ht =
1655 (const struct ieee80211_ie_htinfo *) ie;
1656 return (ht->hi_byte2 & IEEE80211_HTINFO_OPMODE) ==
1657 IEEE80211_HTINFO_OPMODE_MIXED;
1658}
1659
1660static int
1661is11bclient(const uint8_t *rates, const uint8_t *xrates)
1662{
1663 static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
1664 int i;
1665
1666 /* NB: the 11b clients we care about will not have xrates */
1667 if (xrates != NULL || rates == NULL)
1668 return 0;
1669 for (i = 0; i < rates[1]; i++) {
1670 int r = rates[2+i] & IEEE80211_RATE_VAL;
1671 if (r > 2*11 || ((1<<r) & brates) == 0)
1672 return 0;
1673 }
1674 return 1;
1675}
1676
1677static void
1678hostap_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1679 int subtype, int rssi, int nf)
1680{
1681 struct ieee80211vap *vap = ni->ni_vap;
1682 struct ieee80211com *ic = ni->ni_ic;
1683 struct ieee80211_frame *wh;
1684 uint8_t *frm, *efrm, *sfrm;
1685 uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap;
1686 int reassoc, resp;
1687 uint8_t rate;
1688
1689 wh = mtod(m0, struct ieee80211_frame *);
1690 frm = (uint8_t *)&wh[1];
1691 efrm = mtod(m0, uint8_t *) + m0->m_len;
1692 switch (subtype) {
1693 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1694 case IEEE80211_FC0_SUBTYPE_BEACON: {
1695 struct ieee80211_scanparams scan;
1696 /*
1697 * We process beacon/probe response frames when scanning;
1698 * otherwise we check beacon frames for overlapping non-ERP
1699 * BSS in 11g and/or overlapping legacy BSS when in HT.
1700 */
1701 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 &&
1702 subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1703 vap->iv_stats.is_rx_mgtdiscard++;
1704 return;
1705 }
1706 /* NB: accept off-channel frames */
1707 if (ieee80211_parse_beacon(ni, m0, &scan) &~ IEEE80211_BPARSE_OFFCHAN)
1708 return;
1709 /*
1710 * Count frame now that we know it's to be processed.
1711 */
1712 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1713 vap->iv_stats.is_rx_beacon++; /* XXX remove */
1714 IEEE80211_NODE_STAT(ni, rx_beacons);
1715 } else
1716 IEEE80211_NODE_STAT(ni, rx_proberesp);
1717 /*
1718 * If scanning, just pass information to the scan module.
1719 */
1720 if (ic->ic_flags & IEEE80211_F_SCAN) {
1721 if (scan.status == 0 && /* NB: on channel */
1722 (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN)) {
1723 /*
1724 * Actively scanning a channel marked passive;
1725 * send a probe request now that we know there
1726 * is 802.11 traffic present.
1727 *
1728 * XXX check if the beacon we recv'd gives
1729 * us what we need and suppress the probe req
1730 */
1731 ieee80211_probe_curchan(vap, 1);
1732 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1733 }
1734 ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1735 return;
1736 }
1737 /*
1738 * Check beacon for overlapping bss w/ non ERP stations.
1739 * If we detect one and protection is configured but not
1740 * enabled, enable it and start a timer that'll bring us
1741 * out if we stop seeing the bss.
1742 */
1743 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1744 scan.status == 0 && /* NB: on-channel */
1745 ((scan.erp & 0x100) == 0 || /* NB: no ERP, 11b sta*/
1746 (scan.erp & IEEE80211_ERP_NON_ERP_PRESENT))) {
1747 ic->ic_lastnonerp = ticks;
1748 ic->ic_flags_ext |= IEEE80211_FEXT_NONERP_PR;
1749 if (ic->ic_protmode != IEEE80211_PROT_NONE &&
1750 (ic->ic_flags & IEEE80211_F_USEPROT) == 0) {
1751 IEEE80211_NOTE_FRAME(vap,
1752 IEEE80211_MSG_ASSOC, wh,
1753 "non-ERP present on channel %d "
1754 "(saw erp 0x%x from channel %d), "
1755 "enable use of protection",
1756 ic->ic_curchan->ic_ieee,
1757 scan.erp, scan.chan);
1758 ic->ic_flags |= IEEE80211_F_USEPROT;
1759 ieee80211_notify_erp(ic);
1760 }
1761 }
1762 /*
1763 * Check beacon for non-HT station on HT channel
1764 * and update HT BSS occupancy as appropriate.
1765 */
1766 if (IEEE80211_IS_CHAN_HT(ic->ic_curchan)) {
1767 if (scan.status & IEEE80211_BPARSE_OFFCHAN) {
1768 /*
1769 * Off control channel; only check frames
1770 * that come in the extension channel when
1771 * operating w/ HT40.
1772 */
1773 if (!IEEE80211_IS_CHAN_HT40(ic->ic_curchan))
1774 break;
1775 if (scan.chan != ic->ic_curchan->ic_extieee)
1776 break;
1777 }
1778 if (scan.htinfo == NULL) {
1779 ieee80211_htprot_update(ic,
1780 IEEE80211_HTINFO_OPMODE_PROTOPT |
1781 IEEE80211_HTINFO_NONHT_PRESENT);
1782 } else if (ishtmixed(scan.htinfo)) {
1783 /* XXX? take NONHT_PRESENT from beacon? */
1784 ieee80211_htprot_update(ic,
1785 IEEE80211_HTINFO_OPMODE_MIXED |
1786 IEEE80211_HTINFO_NONHT_PRESENT);
1787 }
1788 }
1789 break;
1790 }
1791
1792 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1793 if (vap->iv_state != IEEE80211_S_RUN) {
1794 vap->iv_stats.is_rx_mgtdiscard++;
1795 return;
1796 }
1797 /*
1798 * Consult the ACL policy module if setup.
1799 */
1800 if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1801 IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1802 wh, NULL, "%s", "disallowed by ACL");
1803 vap->iv_stats.is_rx_acl++;
1804 return;
1805 }
1806 /*
1807 * prreq frame format
1808 * [tlv] ssid
1809 * [tlv] supported rates
1810 * [tlv] extended supported rates
1811 */
1812 ssid = rates = xrates = NULL;
1813 sfrm = frm;
1814 while (efrm - frm > 1) {
1815 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1816 switch (*frm) {
1817 case IEEE80211_ELEMID_SSID:
1818 ssid = frm;
1819 break;
1820 case IEEE80211_ELEMID_RATES:
1821 rates = frm;
1822 break;
1823 case IEEE80211_ELEMID_XRATES:
1824 xrates = frm;
1825 break;
1826 }
1827 frm += frm[1] + 2;
1828 }
1829 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1830 if (xrates != NULL)
1831 IEEE80211_VERIFY_ELEMENT(xrates,
1832 IEEE80211_RATE_MAXSIZE - rates[1], return);
1833 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
1834 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
1835 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
1836 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1837 wh, NULL,
1838 "%s", "no ssid with ssid suppression enabled");
1839 vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
1840 return;
1841 }
1842
1843 /* XXX find a better class or define it's own */
1844 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
1845 "%s", "recv probe req");
1846 /*
1847 * Some legacy 11b clients cannot hack a complete
1848 * probe response frame. When the request includes
1849 * only a bare-bones rate set, communicate this to
1850 * the transmit side.
1851 */
1852 ieee80211_send_proberesp(vap, wh->i_addr2,
1853 is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
1854 break;
1855
1856 case IEEE80211_FC0_SUBTYPE_AUTH: {
1857 uint16_t algo, seq, status;
1858
1859 if (vap->iv_state != IEEE80211_S_RUN) {
1860 vap->iv_stats.is_rx_mgtdiscard++;
1861 return;
1862 }
1863 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1864 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1865 wh, NULL, "%s", "wrong bssid");
1866 vap->iv_stats.is_rx_wrongbss++; /*XXX unique stat?*/
1867 return;
1868 }
1869 /*
1870 * auth frame format
1871 * [2] algorithm
1872 * [2] sequence
1873 * [2] status
1874 * [tlv*] challenge
1875 */
1876 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1877 algo = le16toh(*(uint16_t *)frm);
1878 seq = le16toh(*(uint16_t *)(frm + 2));
1879 status = le16toh(*(uint16_t *)(frm + 4));
1880 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1881 "recv auth frame with algorithm %d seq %d", algo, seq);
1882 /*
1883 * Consult the ACL policy module if setup.
1884 */
1885 if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1886 IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1887 wh, NULL, "%s", "disallowed by ACL");
1888 vap->iv_stats.is_rx_acl++;
1889 ieee80211_send_error(ni, wh->i_addr2,
1890 IEEE80211_FC0_SUBTYPE_AUTH,
1891 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
1892 return;
1893 }
1894 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1895 IEEE80211_DISCARD(vap,
1896 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1897 wh, NULL, "%s", "TKIP countermeasures enabled");
1898 vap->iv_stats.is_rx_auth_countermeasures++;
1899 ieee80211_send_error(ni, wh->i_addr2,
1900 IEEE80211_FC0_SUBTYPE_AUTH,
1901 IEEE80211_REASON_MIC_FAILURE);
1902 return;
1903 }
1904 if (algo == IEEE80211_AUTH_ALG_SHARED)
1905 hostap_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1906 seq, status);
1907 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1908 hostap_auth_open(ni, wh, rssi, nf, seq, status);
1909 else if (algo == IEEE80211_AUTH_ALG_LEAP) {
1910 authalgreject(ni, wh, algo,
1911 seq+1, IEEE80211_STATUS_ALG);
1912 return;
1913 } else {
1914 /*
1915 * We assume that an unknown algorithm is the result
1916 * of a decryption failure on a shared key auth frame;
1917 * return a status code appropriate for that instead
1918 * of IEEE80211_STATUS_ALG.
1919 *
1920 * NB: a seq# of 4 is intentional; the decrypted
1921 * frame likely has a bogus seq value.
1922 */
1923 authalgreject(ni, wh, algo,
1924 4, IEEE80211_STATUS_CHALLENGE);
1925 return;
1926 }
1927 break;
1928 }
1929
1930 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1931 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
1932 uint16_t capinfo, lintval;
1933 struct ieee80211_rsnparms rsnparms;
1934
1935 if (vap->iv_state != IEEE80211_S_RUN) {
1936 vap->iv_stats.is_rx_mgtdiscard++;
1937 return;
1938 }
1939 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1940 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1941 wh, NULL, "%s", "wrong bssid");
1942 vap->iv_stats.is_rx_assoc_bss++;
1943 return;
1944 }
1945 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
1946 reassoc = 1;
1947 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
1948 } else {
1949 reassoc = 0;
1950 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
1951 }
1952 if (ni == vap->iv_bss) {
1953 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1954 "deny %s request, sta not authenticated",
1955 reassoc ? "reassoc" : "assoc");
1956 ieee80211_send_error(ni, wh->i_addr2,
1957 IEEE80211_FC0_SUBTYPE_DEAUTH,
1958 IEEE80211_REASON_ASSOC_NOT_AUTHED);
1959 vap->iv_stats.is_rx_assoc_notauth++;
1960 return;
1961 }
1962
1963 /*
1964 * asreq frame format
1965 * [2] capability information
1966 * [2] listen interval
1967 * [6*] current AP address (reassoc only)
1968 * [tlv] ssid
1969 * [tlv] supported rates
1970 * [tlv] extended supported rates
1971 * [tlv] WPA or RSN
1972 * [tlv] HT capabilities
1973 * [tlv] Atheros capabilities
1974 */
1975 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
1976 capinfo = le16toh(*(uint16_t *)frm); frm += 2;
1977 lintval = le16toh(*(uint16_t *)frm); frm += 2;
1978 if (reassoc)
1979 frm += 6; /* ignore current AP info */
1980 ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL;
1981 sfrm = frm;
1982 while (efrm - frm > 1) {
1983 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1984 switch (*frm) {
1985 case IEEE80211_ELEMID_SSID:
1986 ssid = frm;
1987 break;
1988 case IEEE80211_ELEMID_RATES:
1989 rates = frm;
1990 break;
1991 case IEEE80211_ELEMID_XRATES:
1992 xrates = frm;
1993 break;
1994 case IEEE80211_ELEMID_RSN:
1995 rsn = frm;
1996 break;
1997 case IEEE80211_ELEMID_HTCAP:
1998 htcap = frm;
1999 break;
2000 case IEEE80211_ELEMID_VENDOR:
2001 if (iswpaoui(frm))
2002 wpa = frm;
2003 else if (iswmeinfo(frm))
2004 wme = frm;
2005#ifdef IEEE80211_SUPPORT_SUPERG
2006 else if (isatherosoui(frm))
2007 ath = frm;
2008#endif
2009 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
2010 if (ishtcapoui(frm) && htcap == NULL)
2011 htcap = frm;
2012 }
2013 break;
2014 }
2015 frm += frm[1] + 2;
2016 }
2017 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2018 if (xrates != NULL)
2019 IEEE80211_VERIFY_ELEMENT(xrates,
2020 IEEE80211_RATE_MAXSIZE - rates[1], return);
2021 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2022 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
2023 if (htcap != NULL) {
2024 IEEE80211_VERIFY_LENGTH(htcap[1],
2025 htcap[0] == IEEE80211_ELEMID_VENDOR ?
2026 4 + sizeof(struct ieee80211_ie_htcap)-2 :
2027 sizeof(struct ieee80211_ie_htcap)-2,
2028 return); /* XXX just NULL out? */
2029 }
2030
2031 if ((vap->iv_flags & IEEE80211_F_WPA) &&
2032 !wpa_assocreq(ni, &rsnparms, wh, wpa, rsn, capinfo))
2033 return;
2034 /* discard challenge after association */
2035 if (ni->ni_challenge != NULL) {
2036 free(ni->ni_challenge, M_80211_NODE);
2037 ni->ni_challenge = NULL;
2038 }
2039 /* NB: 802.11 spec says to ignore station's privacy bit */
2040 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2041 capinfomismatch(ni, wh, reassoc, resp,
2042 "capability", capinfo);
2043 return;
2044 }
2045 /*
2046 * Disallow re-associate w/ invalid slot time setting.
2047 */
2048 if (ni->ni_associd != 0 &&
2049 IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
2050 ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
2051 capinfomismatch(ni, wh, reassoc, resp,
2052 "slot time", capinfo);
2053 return;
2054 }
2055 rate = ieee80211_setup_rates(ni, rates, xrates,
2056 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2057 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2058 if (rate & IEEE80211_RATE_BASIC) {
2059 ratesetmismatch(ni, wh, reassoc, resp, "legacy", rate);
2060 vap->iv_stats.is_rx_assoc_norate++;
2061 return;
2062 }
2063 /*
2064 * If constrained to 11g-only stations reject an
2065 * 11b-only station. We cheat a bit here by looking
2066 * at the max negotiated xmit rate and assuming anyone
2067 * with a best rate <24Mb/s is an 11b station.
2068 */
2069 if ((vap->iv_flags & IEEE80211_F_PUREG) && rate < 48) {
2070 ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);
2071 vap->iv_stats.is_rx_assoc_norate++;
2072 return;
2073 }
2074 /*
2075 * Do HT rate set handling and setup HT node state.
2076 */
2077 ni->ni_chan = vap->iv_bss->ni_chan;
2078 if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && htcap != NULL) {
2079 rate = ieee80211_setup_htrates(ni, htcap,
2080 IEEE80211_F_DOFMCS | IEEE80211_F_DONEGO |
2081 IEEE80211_F_DOBRS);
2082 if (rate & IEEE80211_RATE_BASIC) {
2083 ratesetmismatch(ni, wh, reassoc, resp,
2084 "HT", rate);
2085 vap->iv_stats.is_ht_assoc_norate++;
2086 return;
2087 }
2088 ieee80211_ht_node_init(ni);
2089 ieee80211_ht_updatehtcap(ni, htcap);
2090 } else if (ni->ni_flags & IEEE80211_NODE_HT)
2091 ieee80211_ht_node_cleanup(ni);
2092#ifdef IEEE80211_SUPPORT_SUPERG
2093 else if (ni->ni_ath_flags & IEEE80211_NODE_ATH)
2094 ieee80211_ff_node_cleanup(ni);
2095#endif
2096 /*
2097 * Allow AMPDU operation only with unencrypted traffic
2098 * or AES-CCM; the 11n spec only specifies these ciphers
2099 * so permitting any others is undefined and can lead
2100 * to interoperability problems.
2101 */
2102 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
2103 (((vap->iv_flags & IEEE80211_F_WPA) &&
2104 rsnparms.rsn_ucastcipher != IEEE80211_CIPHER_AES_CCM) ||
2105 (vap->iv_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) {
2106 IEEE80211_NOTE(vap,
2107 IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
2108 "disallow HT use because WEP or TKIP requested, "
2109 "capinfo 0x%x ucastcipher %d", capinfo,
2110 rsnparms.rsn_ucastcipher);
2111 ieee80211_ht_node_cleanup(ni);
2112 vap->iv_stats.is_ht_assoc_downgrade++;
2113 }
2114 /*
2115 * If constrained to 11n-only stations reject legacy stations.
2116 */
2117 if ((vap->iv_flags_ht & IEEE80211_FHT_PUREN) &&
2118 (ni->ni_flags & IEEE80211_NODE_HT) == 0) {
2119 htcapmismatch(ni, wh, reassoc, resp);
2120 vap->iv_stats.is_ht_assoc_nohtcap++;
2121 return;
2122 }
2123 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
2124 ni->ni_noise = nf;
2125 ni->ni_intval = lintval;
2126 ni->ni_capinfo = capinfo;
2127 ni->ni_fhdwell = vap->iv_bss->ni_fhdwell;
2128 ni->ni_fhindex = vap->iv_bss->ni_fhindex;
2129 /*
2130 * Store the IEs.
2131 * XXX maybe better to just expand
2132 */
2133 if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {
2134#define setie(_ie, _off) ieee80211_ies_setie(ni->ni_ies, _ie, _off)
2135 if (wpa != NULL)
2136 setie(wpa_ie, wpa - sfrm);
2137 if (rsn != NULL)
2138 setie(rsn_ie, rsn - sfrm);
2139 if (htcap != NULL)
2140 setie(htcap_ie, htcap - sfrm);
2141 if (wme != NULL) {
2142 setie(wme_ie, wme - sfrm);
2143 /*
2144 * Mark node as capable of QoS.
2145 */
2146 ni->ni_flags |= IEEE80211_NODE_QOS;
2147 } else
2148 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2149#ifdef IEEE80211_SUPPORT_SUPERG
2150 if (ath != NULL) {
2151 setie(ath_ie, ath - sfrm);
2152 /*
2153 * Parse ATH station parameters.
2154 */
2155 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
2156 } else
2157#endif
2158 ni->ni_ath_flags = 0;
2159#undef setie
2160 } else {
2161 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2162 ni->ni_ath_flags = 0;
2163 }
2164 ieee80211_node_join(ni, resp);
2165 ieee80211_deliver_l2uf(ni);
2166 break;
2167 }
2168
2169 case IEEE80211_FC0_SUBTYPE_DEAUTH:
2170 case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2171 uint16_t reason;
2172
2173 if (vap->iv_state != IEEE80211_S_RUN ||
2174 /* NB: can happen when in promiscuous mode */
2175 !IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
2176 vap->iv_stats.is_rx_mgtdiscard++;
2177 break;
2178 }
2179 /*
2180 * deauth/disassoc frame format
2181 * [2] reason
2182 */
2183 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2184 reason = le16toh(*(uint16_t *)frm);
2185 if (subtype == IEEE80211_FC0_SUBTYPE_DEAUTH) {
2186 vap->iv_stats.is_rx_deauth++;
2187 IEEE80211_NODE_STAT(ni, rx_deauth);
2188 } else {
2189 vap->iv_stats.is_rx_disassoc++;
2190 IEEE80211_NODE_STAT(ni, rx_disassoc);
2191 }
2192 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
2193 "recv %s (reason %d)", ieee80211_mgt_subtype_name[subtype >>
2194 IEEE80211_FC0_SUBTYPE_SHIFT], reason);
2195 if (ni != vap->iv_bss)
2196 ieee80211_node_leave(ni);
2197 break;
2198 }
2199
2200 case IEEE80211_FC0_SUBTYPE_ACTION:
2201 case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2202 if (ni == vap->iv_bss) {
2203 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2204 wh, NULL, "%s", "unknown node");
2205 vap->iv_stats.is_rx_mgtdiscard++;
2206 } else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2207 !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2208 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2209 wh, NULL, "%s", "not for us");
2210 vap->iv_stats.is_rx_mgtdiscard++;
2211 } else if (vap->iv_state != IEEE80211_S_RUN) {
2212 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2213 wh, NULL, "wrong state %s",
2214 ieee80211_state_name[vap->iv_state]);
2215 vap->iv_stats.is_rx_mgtdiscard++;
2216 } else {
2217 if (ieee80211_parse_action(ni, m0) == 0)
2218 (void)ic->ic_recv_action(ni, wh, frm, efrm);
2219 }
2220 break;
2221
2222 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2223 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2224 case IEEE80211_FC0_SUBTYPE_ATIM:
2225 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2226 wh, NULL, "%s", "not handled");
2227 vap->iv_stats.is_rx_mgtdiscard++;
2228 break;
2229
2230 default:
2231 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2232 wh, "mgt", "subtype 0x%x not handled", subtype);
2233 vap->iv_stats.is_rx_badsubtype++;
2234 break;
2235 }
2236}
2237
2238static void
2239hostap_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2240{
2241 switch (subtype) {
2242 case IEEE80211_FC0_SUBTYPE_PS_POLL:
2243 ni->ni_vap->iv_recv_pspoll(ni, m);
2244 break;
2245 case IEEE80211_FC0_SUBTYPE_BAR:
2246 ieee80211_recv_bar(ni, m);
2247 break;
2248 }
2249}
2250
2251/*
2252 * Process a received ps-poll frame.
2253 */
2254void
2255ieee80211_recv_pspoll(struct ieee80211_node *ni, struct mbuf *m0)
2256{
2257 struct ieee80211vap *vap = ni->ni_vap;
2258 struct ieee80211com *ic = vap->iv_ic;
2259 struct ieee80211_frame_min *wh;
2260 struct mbuf *m;
2261 uint16_t aid;
2262 int qlen;
2263
2264 wh = mtod(m0, struct ieee80211_frame_min *);
2265 if (ni->ni_associd == 0) {
2266 IEEE80211_DISCARD(vap,
2267 IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2268 (struct ieee80211_frame *) wh, NULL,
2269 "%s", "unassociated station");
2270 vap->iv_stats.is_ps_unassoc++;
2271 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2272 IEEE80211_REASON_NOT_ASSOCED);
2273 return;
2274 }
2275
2276 aid = le16toh(*(uint16_t *)wh->i_dur);
2277 if (aid != ni->ni_associd) {
2278 IEEE80211_DISCARD(vap,
2279 IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2280 (struct ieee80211_frame *) wh, NULL,
2281 "aid mismatch: sta aid 0x%x poll aid 0x%x",
2282 ni->ni_associd, aid);
2283 vap->iv_stats.is_ps_badaid++;
2284 /*
2285 * NB: We used to deauth the station but it turns out
2286 * the Blackberry Curve 8230 (and perhaps other devices)
2287 * sometimes send the wrong AID when WME is negotiated.
2288 * Being more lenient here seems ok as we already check
2289 * the station is associated and we only return frames
2290 * queued for the station (i.e. we don't use the AID).
2291 */
2292 return;
2293 }
2294
2295 /* Okay, take the first queued packet and put it out... */
2296 m = ieee80211_node_psq_dequeue(ni, &qlen);
2297 if (m == NULL) {
2298 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_POWER, wh->i_addr2,
2299 "%s", "recv ps-poll, but queue empty");
2300 ieee80211_send_nulldata(ieee80211_ref_node(ni));
2301 vap->iv_stats.is_ps_qempty++; /* XXX node stat */
2302 if (vap->iv_set_tim != NULL)
2303 vap->iv_set_tim(ni, 0); /* just in case */
2304 return;
2305 }
2306 /*
2307 * If there are more packets, set the more packets bit
2308 * in the packet dispatched to the station; otherwise
2309 * turn off the TIM bit.
2310 */
2311 if (qlen != 0) {
2312 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2313 "recv ps-poll, send packet, %u still queued", qlen);
2314 m->m_flags |= M_MORE_DATA;
2315 } else {
2316 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2317 "%s", "recv ps-poll, send packet, queue empty");
2318 if (vap->iv_set_tim != NULL)
2319 vap->iv_set_tim(ni, 0);
2320 }
2321 m->m_flags |= M_PWR_SAV; /* bypass PS handling */
2322
2323 /*
2324 * Do the right thing; if it's an encap'ed frame then
|