ieee80211_input.c revision 167442
1/*- 2 * Copyright (c) 2001 Atsushi Onoe 3 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * Alternatively, this software may be distributed under the terms of the 18 * GNU General Public License ("GPL") version 2 as published by the Free 19 * Software Foundation. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33#include <sys/cdefs.h> 34__FBSDID("$FreeBSD: head/sys/net80211/ieee80211_input.c 167442 2007-03-11 07:22:21Z sam $"); 35 36#include <sys/param.h> 37#include <sys/systm.h> 38#include <sys/mbuf.h> 39#include <sys/malloc.h> 40#include <sys/endian.h> 41#include <sys/kernel.h> 42 43#include <sys/socket.h> 44 45#include <net/if.h> 46#include <net/if_media.h> 47#include <net/ethernet.h> 48#include <net/if_llc.h> 49#include <net/if_vlan_var.h> 50 51#include <net80211/ieee80211_var.h> 52 53#include <net/bpf.h> 54 55#ifdef IEEE80211_DEBUG 56#include <machine/stdarg.h> 57 58/* 59 * Decide if a received management frame should be 60 * printed when debugging is enabled. This filters some 61 * of the less interesting frames that come frequently 62 * (e.g. beacons). 63 */ 64static __inline int 65doprint(struct ieee80211com *ic, int subtype) 66{ 67 switch (subtype) { 68 case IEEE80211_FC0_SUBTYPE_BEACON: 69 return (ic->ic_flags & IEEE80211_F_SCAN); 70 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 71 return (ic->ic_opmode == IEEE80211_M_IBSS); 72 } 73 return 1; 74} 75 76static const u_int8_t *ieee80211_getbssid(struct ieee80211com *, 77 const struct ieee80211_frame *); 78#endif /* IEEE80211_DEBUG */ 79 80static struct mbuf *ieee80211_defrag(struct ieee80211com *, 81 struct ieee80211_node *, struct mbuf *, int); 82static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int); 83static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *, 84 const u_int8_t *mac, int subtype, int arg); 85static void ieee80211_deliver_data(struct ieee80211com *, 86 struct ieee80211_node *, struct mbuf *); 87static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable); 88static void ieee80211_recv_pspoll(struct ieee80211com *, 89 struct ieee80211_node *, struct mbuf *); 90 91/* 92 * Process a received frame. The node associated with the sender 93 * should be supplied. If nothing was found in the node table then 94 * the caller is assumed to supply a reference to ic_bss instead. 95 * The RSSI and a timestamp are also supplied. The RSSI data is used 96 * during AP scanning to select a AP to associate with; it can have 97 * any units so long as values have consistent units and higher values 98 * mean ``better signal''. The receive timestamp is currently not used 99 * by the 802.11 layer. 100 */ 101int 102ieee80211_input(struct ieee80211com *ic, struct mbuf *m, 103 struct ieee80211_node *ni, int rssi, u_int32_t rstamp) 104{ 105#define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0) 106#define HAS_SEQ(type) ((type & 0x4) == 0) 107 struct ifnet *ifp = ic->ic_ifp; 108 struct ieee80211_frame *wh; 109 struct ieee80211_key *key; 110 struct ether_header *eh; 111 int hdrspace; 112 u_int8_t dir, type, subtype; 113 u_int8_t *bssid; 114 u_int16_t rxseq; 115 116 KASSERT(ni != NULL, ("null node")); 117 ni->ni_inact = ni->ni_inact_reload; 118 119 /* trim CRC here so WEP can find its own CRC at the end of packet. */ 120 if (m->m_flags & M_HASFCS) { 121 m_adj(m, -IEEE80211_CRC_LEN); 122 m->m_flags &= ~M_HASFCS; 123 } 124 type = -1; /* undefined */ 125 /* 126 * In monitor mode, send everything directly to bpf. 127 * XXX may want to include the CRC 128 */ 129 if (ic->ic_opmode == IEEE80211_M_MONITOR) 130 goto out; 131 132 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) { 133 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 134 ni->ni_macaddr, NULL, 135 "too short (1): len %u", m->m_pkthdr.len); 136 ic->ic_stats.is_rx_tooshort++; 137 goto out; 138 } 139 /* 140 * Bit of a cheat here, we use a pointer for a 3-address 141 * frame format but don't reference fields past outside 142 * ieee80211_frame_min w/o first validating the data is 143 * present. 144 */ 145 wh = mtod(m, struct ieee80211_frame *); 146 147 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) != 148 IEEE80211_FC0_VERSION_0) { 149 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 150 ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]); 151 ic->ic_stats.is_rx_badversion++; 152 goto err; 153 } 154 155 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 156 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 157 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 158 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) { 159 switch (ic->ic_opmode) { 160 case IEEE80211_M_STA: 161 bssid = wh->i_addr2; 162 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) { 163 /* not interested in */ 164 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 165 bssid, NULL, "%s", "not to bss"); 166 ic->ic_stats.is_rx_wrongbss++; 167 goto out; 168 } 169 break; 170 case IEEE80211_M_IBSS: 171 case IEEE80211_M_AHDEMO: 172 case IEEE80211_M_HOSTAP: 173 if (dir != IEEE80211_FC1_DIR_NODS) 174 bssid = wh->i_addr1; 175 else if (type == IEEE80211_FC0_TYPE_CTL) 176 bssid = wh->i_addr1; 177 else { 178 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 179 IEEE80211_DISCARD_MAC(ic, 180 IEEE80211_MSG_ANY, ni->ni_macaddr, 181 NULL, "too short (2): len %u", 182 m->m_pkthdr.len); 183 ic->ic_stats.is_rx_tooshort++; 184 goto out; 185 } 186 bssid = wh->i_addr3; 187 } 188 if (type != IEEE80211_FC0_TYPE_DATA) 189 break; 190 /* 191 * Data frame, validate the bssid. 192 */ 193 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) && 194 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) { 195 /* not interested in */ 196 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 197 bssid, NULL, "%s", "not to bss"); 198 ic->ic_stats.is_rx_wrongbss++; 199 goto out; 200 } 201 /* 202 * For adhoc mode we cons up a node when it doesn't 203 * exist. This should probably done after an ACL check. 204 */ 205 if (ni == ic->ic_bss && 206 ic->ic_opmode != IEEE80211_M_HOSTAP && 207 !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 208 /* 209 * Fake up a node for this newly 210 * discovered member of the IBSS. 211 */ 212 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 213 wh->i_addr2); 214 if (ni == NULL) { 215 /* NB: stat kept for alloc failure */ 216 goto err; 217 } 218 } 219 break; 220 default: 221 goto out; 222 } 223 ni->ni_rssi = rssi; 224 ni->ni_rstamp = rstamp; 225 if (HAS_SEQ(type)) { 226 u_int8_t tid; 227 if (IEEE80211_QOS_HAS_SEQ(wh)) { 228 tid = ((struct ieee80211_qosframe *)wh)-> 229 i_qos[0] & IEEE80211_QOS_TID; 230 if (TID_TO_WME_AC(tid) >= WME_AC_VI) 231 ic->ic_wme.wme_hipri_traffic++; 232 tid++; 233 } else 234 tid = IEEE80211_NONQOS_TID; 235 rxseq = le16toh(*(u_int16_t *)wh->i_seq); 236 if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) && 237 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) { 238 /* duplicate, discard */ 239 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 240 bssid, "duplicate", 241 "seqno <%u,%u> fragno <%u,%u> tid %u", 242 rxseq >> IEEE80211_SEQ_SEQ_SHIFT, 243 ni->ni_rxseqs[tid] >> 244 IEEE80211_SEQ_SEQ_SHIFT, 245 rxseq & IEEE80211_SEQ_FRAG_MASK, 246 ni->ni_rxseqs[tid] & 247 IEEE80211_SEQ_FRAG_MASK, 248 tid); 249 ic->ic_stats.is_rx_dup++; 250 IEEE80211_NODE_STAT(ni, rx_dup); 251 goto out; 252 } 253 ni->ni_rxseqs[tid] = rxseq; 254 } 255 } 256 257 switch (type) { 258 case IEEE80211_FC0_TYPE_DATA: 259 hdrspace = ieee80211_hdrspace(ic, wh); 260 if (m->m_len < hdrspace && 261 (m = m_pullup(m, hdrspace)) == NULL) { 262 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 263 ni->ni_macaddr, NULL, 264 "data too short: expecting %u", hdrspace); 265 ic->ic_stats.is_rx_tooshort++; 266 goto out; /* XXX */ 267 } 268 switch (ic->ic_opmode) { 269 case IEEE80211_M_STA: 270 if (dir != IEEE80211_FC1_DIR_FROMDS) { 271 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 272 wh, "data", "%s", "unknown dir 0x%x", dir); 273 ic->ic_stats.is_rx_wrongdir++; 274 goto out; 275 } 276 if ((ifp->if_flags & IFF_SIMPLEX) && 277 IEEE80211_IS_MULTICAST(wh->i_addr1) && 278 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) { 279 /* 280 * In IEEE802.11 network, multicast packet 281 * sent from me is broadcasted from AP. 282 * It should be silently discarded for 283 * SIMPLEX interface. 284 */ 285 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 286 wh, NULL, "%s", "multicast echo"); 287 ic->ic_stats.is_rx_mcastecho++; 288 goto out; 289 } 290 break; 291 case IEEE80211_M_IBSS: 292 case IEEE80211_M_AHDEMO: 293 if (dir != IEEE80211_FC1_DIR_NODS) { 294 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 295 wh, "data", "%s", "unknown dir 0x%x", dir); 296 ic->ic_stats.is_rx_wrongdir++; 297 goto out; 298 } 299 /* XXX no power-save support */ 300 break; 301 case IEEE80211_M_HOSTAP: 302 if (dir != IEEE80211_FC1_DIR_TODS) { 303 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 304 wh, "data", "%s", "unknown dir 0x%x", dir); 305 ic->ic_stats.is_rx_wrongdir++; 306 goto out; 307 } 308 /* check if source STA is associated */ 309 if (ni == ic->ic_bss) { 310 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 311 wh, "data", "%s", "unknown src"); 312 ieee80211_send_error(ic, ni, wh->i_addr2, 313 IEEE80211_FC0_SUBTYPE_DEAUTH, 314 IEEE80211_REASON_NOT_AUTHED); 315 ic->ic_stats.is_rx_notassoc++; 316 goto err; 317 } 318 if (ni->ni_associd == 0) { 319 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 320 wh, "data", "%s", "unassoc src"); 321 IEEE80211_SEND_MGMT(ic, ni, 322 IEEE80211_FC0_SUBTYPE_DISASSOC, 323 IEEE80211_REASON_NOT_ASSOCED); 324 ic->ic_stats.is_rx_notassoc++; 325 goto err; 326 } 327 328 /* 329 * Check for power save state change. 330 */ 331 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^ 332 (ni->ni_flags & IEEE80211_NODE_PWR_MGT))) 333 ieee80211_node_pwrsave(ni, 334 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT); 335 break; 336 default: 337 /* XXX here to keep compiler happy */ 338 goto out; 339 } 340 341 /* 342 * Handle privacy requirements. Note that we 343 * must not be preempted from here until after 344 * we (potentially) call ieee80211_crypto_demic; 345 * otherwise we may violate assumptions in the 346 * crypto cipher modules used to do delayed update 347 * of replay sequence numbers. 348 */ 349 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 350 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 351 /* 352 * Discard encrypted frames when privacy is off. 353 */ 354 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 355 wh, "WEP", "%s", "PRIVACY off"); 356 ic->ic_stats.is_rx_noprivacy++; 357 IEEE80211_NODE_STAT(ni, rx_noprivacy); 358 goto out; 359 } 360 key = ieee80211_crypto_decap(ic, ni, m, hdrspace); 361 if (key == NULL) { 362 /* NB: stats+msgs handled in crypto_decap */ 363 IEEE80211_NODE_STAT(ni, rx_wepfail); 364 goto out; 365 } 366 wh = mtod(m, struct ieee80211_frame *); 367 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 368 } else { 369 key = NULL; 370 } 371 372 /* 373 * Next up, any fragmentation. 374 */ 375 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 376 m = ieee80211_defrag(ic, ni, m, hdrspace); 377 if (m == NULL) { 378 /* Fragment dropped or frame not complete yet */ 379 goto out; 380 } 381 } 382 wh = NULL; /* no longer valid, catch any uses */ 383 384 /* 385 * Next strip any MSDU crypto bits. 386 */ 387 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) { 388 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 389 ni->ni_macaddr, "data", "%s", "demic error"); 390 ic->ic_stats.is_rx_demicfail++; 391 IEEE80211_NODE_STAT(ni, rx_demicfail); 392 goto out; 393 } 394 395 /* copy to listener after decrypt */ 396 if (bpf_peers_present(ic->ic_rawbpf)) 397 bpf_mtap(ic->ic_rawbpf, m); 398 399 /* 400 * Finally, strip the 802.11 header. 401 */ 402 m = ieee80211_decap(ic, m, hdrspace); 403 if (m == NULL) { 404 /* don't count Null data frames as errors */ 405 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA) 406 goto out; 407 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 408 ni->ni_macaddr, "data", "%s", "decap error"); 409 ic->ic_stats.is_rx_decap++; 410 IEEE80211_NODE_STAT(ni, rx_decap); 411 goto err; 412 } 413 eh = mtod(m, struct ether_header *); 414 if (!ieee80211_node_is_authorized(ni)) { 415 /* 416 * Deny any non-PAE frames received prior to 417 * authorization. For open/shared-key 418 * authentication the port is mark authorized 419 * after authentication completes. For 802.1x 420 * the port is not marked authorized by the 421 * authenticator until the handshake has completed. 422 */ 423 if (eh->ether_type != htons(ETHERTYPE_PAE)) { 424 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 425 eh->ether_shost, "data", 426 "unauthorized port: ether type 0x%x len %u", 427 eh->ether_type, m->m_pkthdr.len); 428 ic->ic_stats.is_rx_unauth++; 429 IEEE80211_NODE_STAT(ni, rx_unauth); 430 goto err; 431 } 432 } else { 433 /* 434 * When denying unencrypted frames, discard 435 * any non-PAE frames received without encryption. 436 */ 437 if ((ic->ic_flags & IEEE80211_F_DROPUNENC) && 438 key == NULL && 439 eh->ether_type != htons(ETHERTYPE_PAE)) { 440 /* 441 * Drop unencrypted frames. 442 */ 443 ic->ic_stats.is_rx_unencrypted++; 444 IEEE80211_NODE_STAT(ni, rx_unencrypted); 445 goto out; 446 } 447 } 448 ieee80211_deliver_data(ic, ni, m); 449 return IEEE80211_FC0_TYPE_DATA; 450 451 case IEEE80211_FC0_TYPE_MGT: 452 ic->ic_stats.is_rx_mgmt++; 453 IEEE80211_NODE_STAT(ni, rx_mgmt); 454 if (dir != IEEE80211_FC1_DIR_NODS) { 455 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 456 wh, "data", "%s", "unknown dir 0x%x", dir); 457 ic->ic_stats.is_rx_wrongdir++; 458 goto err; 459 } 460 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 461 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 462 ni->ni_macaddr, "mgt", "too short: len %u", 463 m->m_pkthdr.len); 464 ic->ic_stats.is_rx_tooshort++; 465 goto out; 466 } 467#ifdef IEEE80211_DEBUG 468 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) || 469 ieee80211_msg_dumppkts(ic)) { 470 if_printf(ic->ic_ifp, "received %s from %s rssi %d\n", 471 ieee80211_mgt_subtype_name[subtype >> 472 IEEE80211_FC0_SUBTYPE_SHIFT], 473 ether_sprintf(wh->i_addr2), rssi); 474 } 475#endif 476 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 477 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) { 478 /* 479 * Only shared key auth frames with a challenge 480 * should be encrypted, discard all others. 481 */ 482 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 483 wh, ieee80211_mgt_subtype_name[subtype >> 484 IEEE80211_FC0_SUBTYPE_SHIFT], 485 "%s", "WEP set but not permitted"); 486 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */ 487 goto out; 488 } 489 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 490 /* 491 * Discard encrypted frames when privacy is off. 492 */ 493 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 494 wh, "mgt", "%s", "WEP set but PRIVACY off"); 495 ic->ic_stats.is_rx_noprivacy++; 496 goto out; 497 } 498 hdrspace = ieee80211_hdrspace(ic, wh); 499 key = ieee80211_crypto_decap(ic, ni, m, hdrspace); 500 if (key == NULL) { 501 /* NB: stats+msgs handled in crypto_decap */ 502 goto out; 503 } 504 wh = mtod(m, struct ieee80211_frame *); 505 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 506 } 507 if (bpf_peers_present(ic->ic_rawbpf)) 508 bpf_mtap(ic->ic_rawbpf, m); 509 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp); 510 m_freem(m); 511 return type; 512 513 case IEEE80211_FC0_TYPE_CTL: 514 ic->ic_stats.is_rx_ctl++; 515 IEEE80211_NODE_STAT(ni, rx_ctrl); 516 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 517 switch (subtype) { 518 case IEEE80211_FC0_SUBTYPE_PS_POLL: 519 ieee80211_recv_pspoll(ic, ni, m); 520 break; 521 } 522 } 523 goto out; 524 default: 525 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 526 wh, NULL, "bad frame type 0x%x", type); 527 /* should not come here */ 528 break; 529 } 530err: 531 ifp->if_ierrors++; 532out: 533 if (m != NULL) { 534 if (bpf_peers_present(ic->ic_rawbpf)) 535 bpf_mtap(ic->ic_rawbpf, m); 536 m_freem(m); 537 } 538 return type; 539#undef SEQ_LEQ 540} 541 542/* 543 * This function reassemble fragments. 544 */ 545static struct mbuf * 546ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni, 547 struct mbuf *m, int hdrspace) 548{ 549 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 550 struct ieee80211_frame *lwh; 551 u_int16_t rxseq; 552 u_int8_t fragno; 553 u_int8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG; 554 struct mbuf *mfrag; 555 556 KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?")); 557 558 rxseq = le16toh(*(u_int16_t *)wh->i_seq); 559 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK; 560 561 /* Quick way out, if there's nothing to defragment */ 562 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL) 563 return m; 564 565 /* 566 * Remove frag to insure it doesn't get reaped by timer. 567 */ 568 if (ni->ni_table == NULL) { 569 /* 570 * Should never happen. If the node is orphaned (not in 571 * the table) then input packets should not reach here. 572 * Otherwise, a concurrent request that yanks the table 573 * should be blocked by other interlocking and/or by first 574 * shutting the driver down. Regardless, be defensive 575 * here and just bail 576 */ 577 /* XXX need msg+stat */ 578 m_freem(m); 579 return NULL; 580 } 581 IEEE80211_NODE_LOCK(ni->ni_table); 582 mfrag = ni->ni_rxfrag[0]; 583 ni->ni_rxfrag[0] = NULL; 584 IEEE80211_NODE_UNLOCK(ni->ni_table); 585 586 /* 587 * Validate new fragment is in order and 588 * related to the previous ones. 589 */ 590 if (mfrag != NULL) { 591 u_int16_t last_rxseq; 592 593 lwh = mtod(mfrag, struct ieee80211_frame *); 594 last_rxseq = le16toh(*(u_int16_t *)lwh->i_seq); 595 /* NB: check seq # and frag together */ 596 if (rxseq != last_rxseq+1 || 597 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) || 598 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { 599 /* 600 * Unrelated fragment or no space for it, 601 * clear current fragments. 602 */ 603 m_freem(mfrag); 604 mfrag = NULL; 605 } 606 } 607 608 if (mfrag == NULL) { 609 if (fragno != 0) { /* !first fragment, discard */ 610 ic->ic_stats.is_rx_defrag++; 611 IEEE80211_NODE_STAT(ni, rx_defrag); 612 m_freem(m); 613 return NULL; 614 } 615 mfrag = m; 616 } else { /* concatenate */ 617 m_adj(m, hdrspace); /* strip header */ 618 m_cat(mfrag, m); 619 /* NB: m_cat doesn't update the packet header */ 620 mfrag->m_pkthdr.len += m->m_pkthdr.len; 621 /* track last seqnum and fragno */ 622 lwh = mtod(mfrag, struct ieee80211_frame *); 623 *(u_int16_t *) lwh->i_seq = *(u_int16_t *) wh->i_seq; 624 } 625 if (more_frag) { /* more to come, save */ 626 ni->ni_rxfragstamp = ticks; 627 ni->ni_rxfrag[0] = mfrag; 628 mfrag = NULL; 629 } 630 return mfrag; 631} 632 633static void 634ieee80211_deliver_data(struct ieee80211com *ic, 635 struct ieee80211_node *ni, struct mbuf *m) 636{ 637 struct ether_header *eh = mtod(m, struct ether_header *); 638 struct ifnet *ifp = ic->ic_ifp; 639 640 /* 641 * Do accounting. 642 */ 643 ifp->if_ipackets++; 644 IEEE80211_NODE_STAT(ni, rx_data); 645 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len); 646 if (ETHER_IS_MULTICAST(eh->ether_dhost)) { 647 m->m_flags |= M_MCAST; /* XXX M_BCAST? */ 648 IEEE80211_NODE_STAT(ni, rx_mcast); 649 } else 650 IEEE80211_NODE_STAT(ni, rx_ucast); 651 652 /* perform as a bridge within the AP */ 653 if (ic->ic_opmode == IEEE80211_M_HOSTAP && 654 (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) { 655 struct mbuf *m1 = NULL; 656 657 if (m->m_flags & M_MCAST) { 658 m1 = m_dup(m, M_DONTWAIT); 659 if (m1 == NULL) 660 ifp->if_oerrors++; 661 else 662 m1->m_flags |= M_MCAST; 663 } else { 664 /* 665 * Check if the destination is known; if so 666 * and the port is authorized dispatch directly. 667 */ 668 struct ieee80211_node *sta = 669 ieee80211_find_node(&ic->ic_sta, eh->ether_dhost); 670 if (sta != NULL) { 671 if (ieee80211_node_is_authorized(sta)) { 672 /* 673 * Beware of sending to ourself; this 674 * needs to happen via the normal 675 * input path. 676 */ 677 if (sta != ic->ic_bss) { 678 m1 = m; 679 m = NULL; 680 } 681 } else { 682 ic->ic_stats.is_rx_unauth++; 683 IEEE80211_NODE_STAT(sta, rx_unauth); 684 } 685 ieee80211_free_node(sta); 686 } 687 } 688 if (m1 != NULL) 689 IF_HANDOFF(&ifp->if_snd, m1, ifp); 690 } 691 if (m != NULL) { 692 m->m_pkthdr.rcvif = ifp; 693 if (ni->ni_vlan != 0) { 694 /* attach vlan tag */ 695 m->m_pkthdr.ether_vtag = ni->ni_vlan; 696 m->m_flags |= M_VLANTAG; 697 } 698 (*ifp->if_input)(ifp, m); 699 } 700} 701 702static struct mbuf * 703ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen) 704{ 705 struct ieee80211_qosframe_addr4 wh; /* Max size address frames */ 706 struct ether_header *eh; 707 struct llc *llc; 708 709 if (m->m_len < hdrlen + sizeof(*llc) && 710 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) { 711 /* XXX stat, msg */ 712 return NULL; 713 } 714 memcpy(&wh, mtod(m, caddr_t), hdrlen); 715 llc = (struct llc *)(mtod(m, caddr_t) + hdrlen); 716 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP && 717 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 && 718 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) { 719 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh)); 720 llc = NULL; 721 } else { 722 m_adj(m, hdrlen - sizeof(*eh)); 723 } 724 eh = mtod(m, struct ether_header *); 725 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) { 726 case IEEE80211_FC1_DIR_NODS: 727 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 728 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 729 break; 730 case IEEE80211_FC1_DIR_TODS: 731 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 732 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 733 break; 734 case IEEE80211_FC1_DIR_FROMDS: 735 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 736 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3); 737 break; 738 case IEEE80211_FC1_DIR_DSTODS: 739 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 740 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4); 741 break; 742 } 743#ifdef ALIGNED_POINTER 744 if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), u_int32_t)) { 745 struct mbuf *n, *n0, **np; 746 caddr_t newdata; 747 int off, pktlen; 748 749 n0 = NULL; 750 np = &n0; 751 off = 0; 752 pktlen = m->m_pkthdr.len; 753 while (pktlen > off) { 754 if (n0 == NULL) { 755 MGETHDR(n, M_DONTWAIT, MT_DATA); 756 if (n == NULL) { 757 m_freem(m); 758 return NULL; 759 } 760 M_MOVE_PKTHDR(n, m); 761 n->m_len = MHLEN; 762 } else { 763 MGET(n, M_DONTWAIT, MT_DATA); 764 if (n == NULL) { 765 m_freem(m); 766 m_freem(n0); 767 return NULL; 768 } 769 n->m_len = MLEN; 770 } 771 if (pktlen - off >= MINCLSIZE) { 772 MCLGET(n, M_DONTWAIT); 773 if (n->m_flags & M_EXT) 774 n->m_len = n->m_ext.ext_size; 775 } 776 if (n0 == NULL) { 777 newdata = 778 (caddr_t)ALIGN(n->m_data + sizeof(*eh)) - 779 sizeof(*eh); 780 n->m_len -= newdata - n->m_data; 781 n->m_data = newdata; 782 } 783 if (n->m_len > pktlen - off) 784 n->m_len = pktlen - off; 785 m_copydata(m, off, n->m_len, mtod(n, caddr_t)); 786 off += n->m_len; 787 *np = n; 788 np = &n->m_next; 789 } 790 m_freem(m); 791 m = n0; 792 } 793#endif /* ALIGNED_POINTER */ 794 if (llc != NULL) { 795 eh = mtod(m, struct ether_header *); 796 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh)); 797 } 798 return m; 799} 800 801/* 802 * Install received rate set information in the node's state block. 803 */ 804int 805ieee80211_setup_rates(struct ieee80211_node *ni, 806 const u_int8_t *rates, const u_int8_t *xrates, int flags) 807{ 808 struct ieee80211com *ic = ni->ni_ic; 809 struct ieee80211_rateset *rs = &ni->ni_rates; 810 811 memset(rs, 0, sizeof(*rs)); 812 rs->rs_nrates = rates[1]; 813 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates); 814 if (xrates != NULL) { 815 u_int8_t nxrates; 816 /* 817 * Tack on 11g extended supported rate element. 818 */ 819 nxrates = xrates[1]; 820 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) { 821 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates; 822 IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE, 823 "[%s] extended rate set too large;" 824 " only using %u of %u rates\n", 825 ether_sprintf(ni->ni_macaddr), nxrates, xrates[1]); 826 ic->ic_stats.is_rx_rstoobig++; 827 } 828 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates); 829 rs->rs_nrates += nxrates; 830 } 831 return ieee80211_fix_rate(ni, rs, flags); 832} 833 834static void 835ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh, 836 struct ieee80211_node *ni, int rssi, u_int32_t rstamp, u_int16_t seq, 837 u_int16_t status) 838{ 839 840 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) { 841 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 842 ni->ni_macaddr, "open auth", 843 "bad sta auth mode %u", ni->ni_authmode); 844 ic->ic_stats.is_rx_bad_auth++; /* XXX */ 845 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 846 /* 847 * Clear any challenge text that may be there if 848 * a previous shared key auth failed and then an 849 * open auth is attempted. 850 */ 851 if (ni->ni_challenge != NULL) { 852 FREE(ni->ni_challenge, M_DEVBUF); 853 ni->ni_challenge = NULL; 854 } 855 /* XXX hack to workaround calling convention */ 856 ieee80211_send_error(ic, ni, wh->i_addr2, 857 IEEE80211_FC0_SUBTYPE_AUTH, 858 (seq + 1) | (IEEE80211_STATUS_ALG<<16)); 859 } 860 return; 861 } 862 switch (ic->ic_opmode) { 863 case IEEE80211_M_IBSS: 864 case IEEE80211_M_AHDEMO: 865 case IEEE80211_M_MONITOR: 866 /* should not come here */ 867 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 868 ni->ni_macaddr, "open auth", 869 "bad operating mode %u", ic->ic_opmode); 870 break; 871 872 case IEEE80211_M_HOSTAP: 873 if (ic->ic_state != IEEE80211_S_RUN || 874 seq != IEEE80211_AUTH_OPEN_REQUEST) { 875 ic->ic_stats.is_rx_bad_auth++; 876 return; 877 } 878 /* always accept open authentication requests */ 879 if (ni == ic->ic_bss) { 880 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 881 if (ni == NULL) 882 return; 883 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 884 (void) ieee80211_ref_node(ni); 885 /* 886 * Mark the node as referenced to reflect that it's 887 * reference count has been bumped to insure it remains 888 * after the transaction completes. 889 */ 890 ni->ni_flags |= IEEE80211_NODE_AREF; 891 892 IEEE80211_SEND_MGMT(ic, ni, 893 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 894 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 895 "[%s] station authenticated (open)\n", 896 ether_sprintf(ni->ni_macaddr)); 897 /* 898 * When 802.1x is not in use mark the port 899 * authorized at this point so traffic can flow. 900 */ 901 if (ni->ni_authmode != IEEE80211_AUTH_8021X) 902 ieee80211_node_authorize(ni); 903 break; 904 905 case IEEE80211_M_STA: 906 if (ic->ic_state != IEEE80211_S_AUTH || 907 seq != IEEE80211_AUTH_OPEN_RESPONSE) { 908 ic->ic_stats.is_rx_bad_auth++; 909 return; 910 } 911 if (status != 0) { 912 IEEE80211_DPRINTF(ic, 913 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 914 "[%s] open auth failed (reason %d)\n", 915 ether_sprintf(ni->ni_macaddr), status); 916 /* XXX can this happen? */ 917 if (ni != ic->ic_bss) 918 ni->ni_fails++; 919 ic->ic_stats.is_rx_auth_fail++; 920 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 921 } else 922 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 923 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 924 break; 925 } 926} 927 928/* 929 * Send a management frame error response to the specified 930 * station. If ni is associated with the station then use 931 * it; otherwise allocate a temporary node suitable for 932 * transmitting the frame and then free the reference so 933 * it will go away as soon as the frame has been transmitted. 934 */ 935static void 936ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni, 937 const u_int8_t *mac, int subtype, int arg) 938{ 939 int istmp; 940 941 if (ni == ic->ic_bss) { 942 ni = ieee80211_tmp_node(ic, mac); 943 if (ni == NULL) { 944 /* XXX msg */ 945 return; 946 } 947 istmp = 1; 948 } else 949 istmp = 0; 950 IEEE80211_SEND_MGMT(ic, ni, subtype, arg); 951 if (istmp) 952 ieee80211_free_node(ni); 953} 954 955static int 956alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni) 957{ 958 if (ni->ni_challenge == NULL) 959 MALLOC(ni->ni_challenge, u_int32_t*, IEEE80211_CHALLENGE_LEN, 960 M_DEVBUF, M_NOWAIT); 961 if (ni->ni_challenge == NULL) { 962 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 963 "[%s] shared key challenge alloc failed\n", 964 ether_sprintf(ni->ni_macaddr)); 965 /* XXX statistic */ 966 } 967 return (ni->ni_challenge != NULL); 968} 969 970/* XXX TODO: add statistics */ 971static void 972ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh, 973 u_int8_t *frm, u_int8_t *efrm, struct ieee80211_node *ni, int rssi, 974 u_int32_t rstamp, u_int16_t seq, u_int16_t status) 975{ 976 u_int8_t *challenge; 977 int allocbs, estatus; 978 979 /* 980 * NB: this can happen as we allow pre-shared key 981 * authentication to be enabled w/o wep being turned 982 * on so that configuration of these can be done 983 * in any order. It may be better to enforce the 984 * ordering in which case this check would just be 985 * for sanity/consistency. 986 */ 987 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 988 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 989 ni->ni_macaddr, "shared key auth", 990 "%s", " PRIVACY is disabled"); 991 estatus = IEEE80211_STATUS_ALG; 992 goto bad; 993 } 994 /* 995 * Pre-shared key authentication is evil; accept 996 * it only if explicitly configured (it is supported 997 * mainly for compatibility with clients like OS X). 998 */ 999 if (ni->ni_authmode != IEEE80211_AUTH_AUTO && 1000 ni->ni_authmode != IEEE80211_AUTH_SHARED) { 1001 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1002 ni->ni_macaddr, "shared key auth", 1003 "bad sta auth mode %u", ni->ni_authmode); 1004 ic->ic_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */ 1005 estatus = IEEE80211_STATUS_ALG; 1006 goto bad; 1007 } 1008 1009 challenge = NULL; 1010 if (frm + 1 < efrm) { 1011 if ((frm[1] + 2) > (efrm - frm)) { 1012 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1013 ni->ni_macaddr, "shared key auth", 1014 "ie %d/%d too long", 1015 frm[0], (frm[1] + 2) - (efrm - frm)); 1016 ic->ic_stats.is_rx_bad_auth++; 1017 estatus = IEEE80211_STATUS_CHALLENGE; 1018 goto bad; 1019 } 1020 if (*frm == IEEE80211_ELEMID_CHALLENGE) 1021 challenge = frm; 1022 frm += frm[1] + 2; 1023 } 1024 switch (seq) { 1025 case IEEE80211_AUTH_SHARED_CHALLENGE: 1026 case IEEE80211_AUTH_SHARED_RESPONSE: 1027 if (challenge == NULL) { 1028 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1029 ni->ni_macaddr, "shared key auth", 1030 "%s", "no challenge"); 1031 ic->ic_stats.is_rx_bad_auth++; 1032 estatus = IEEE80211_STATUS_CHALLENGE; 1033 goto bad; 1034 } 1035 if (challenge[1] != IEEE80211_CHALLENGE_LEN) { 1036 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1037 ni->ni_macaddr, "shared key auth", 1038 "bad challenge len %d", challenge[1]); 1039 ic->ic_stats.is_rx_bad_auth++; 1040 estatus = IEEE80211_STATUS_CHALLENGE; 1041 goto bad; 1042 } 1043 default: 1044 break; 1045 } 1046 switch (ic->ic_opmode) { 1047 case IEEE80211_M_MONITOR: 1048 case IEEE80211_M_AHDEMO: 1049 case IEEE80211_M_IBSS: 1050 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1051 ni->ni_macaddr, "shared key auth", 1052 "bad operating mode %u", ic->ic_opmode); 1053 return; 1054 case IEEE80211_M_HOSTAP: 1055 if (ic->ic_state != IEEE80211_S_RUN) { 1056 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1057 ni->ni_macaddr, "shared key auth", 1058 "bad state %u", ic->ic_state); 1059 estatus = IEEE80211_STATUS_ALG; /* XXX */ 1060 goto bad; 1061 } 1062 switch (seq) { 1063 case IEEE80211_AUTH_SHARED_REQUEST: 1064 if (ni == ic->ic_bss) { 1065 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 1066 if (ni == NULL) { 1067 /* NB: no way to return an error */ 1068 return; 1069 } 1070 allocbs = 1; 1071 } else { 1072 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 1073 (void) ieee80211_ref_node(ni); 1074 allocbs = 0; 1075 } 1076 /* 1077 * Mark the node as referenced to reflect that it's 1078 * reference count has been bumped to insure it remains 1079 * after the transaction completes. 1080 */ 1081 ni->ni_flags |= IEEE80211_NODE_AREF; 1082 ni->ni_rssi = rssi; 1083 ni->ni_rstamp = rstamp; 1084 if (!alloc_challenge(ic, ni)) { 1085 /* NB: don't return error so they rexmit */ 1086 return; 1087 } 1088 get_random_bytes(ni->ni_challenge, 1089 IEEE80211_CHALLENGE_LEN); 1090 IEEE80211_DPRINTF(ic, 1091 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1092 "[%s] shared key %sauth request\n", 1093 ether_sprintf(ni->ni_macaddr), 1094 allocbs ? "" : "re"); 1095 break; 1096 case IEEE80211_AUTH_SHARED_RESPONSE: 1097 if (ni == ic->ic_bss) { 1098 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1099 ni->ni_macaddr, "shared key response", 1100 "%s", "unknown station"); 1101 /* NB: don't send a response */ 1102 return; 1103 } 1104 if (ni->ni_challenge == NULL) { 1105 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1106 ni->ni_macaddr, "shared key response", 1107 "%s", "no challenge recorded"); 1108 ic->ic_stats.is_rx_bad_auth++; 1109 estatus = IEEE80211_STATUS_CHALLENGE; 1110 goto bad; 1111 } 1112 if (memcmp(ni->ni_challenge, &challenge[2], 1113 challenge[1]) != 0) { 1114 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1115 ni->ni_macaddr, "shared key response", 1116 "%s", "challenge mismatch"); 1117 ic->ic_stats.is_rx_auth_fail++; 1118 estatus = IEEE80211_STATUS_CHALLENGE; 1119 goto bad; 1120 } 1121 IEEE80211_DPRINTF(ic, 1122 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1123 "[%s] station authenticated (shared key)\n", 1124 ether_sprintf(ni->ni_macaddr)); 1125 ieee80211_node_authorize(ni); 1126 break; 1127 default: 1128 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1129 ni->ni_macaddr, "shared key auth", 1130 "bad seq %d", seq); 1131 ic->ic_stats.is_rx_bad_auth++; 1132 estatus = IEEE80211_STATUS_SEQUENCE; 1133 goto bad; 1134 } 1135 IEEE80211_SEND_MGMT(ic, ni, 1136 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1137 break; 1138 1139 case IEEE80211_M_STA: 1140 if (ic->ic_state != IEEE80211_S_AUTH) 1141 return; 1142 switch (seq) { 1143 case IEEE80211_AUTH_SHARED_PASS: 1144 if (ni->ni_challenge != NULL) { 1145 FREE(ni->ni_challenge, M_DEVBUF); 1146 ni->ni_challenge = NULL; 1147 } 1148 if (status != 0) { 1149 IEEE80211_DPRINTF(ic, 1150 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1151 "[%s] shared key auth failed (reason %d)\n", 1152 ether_sprintf(ieee80211_getbssid(ic, wh)), 1153 status); 1154 /* XXX can this happen? */ 1155 if (ni != ic->ic_bss) 1156 ni->ni_fails++; 1157 ic->ic_stats.is_rx_auth_fail++; 1158 return; 1159 } 1160 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 1161 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 1162 break; 1163 case IEEE80211_AUTH_SHARED_CHALLENGE: 1164 if (!alloc_challenge(ic, ni)) 1165 return; 1166 /* XXX could optimize by passing recvd challenge */ 1167 memcpy(ni->ni_challenge, &challenge[2], challenge[1]); 1168 IEEE80211_SEND_MGMT(ic, ni, 1169 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1170 break; 1171 default: 1172 IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH, 1173 wh, "shared key auth", "bad seq %d", seq); 1174 ic->ic_stats.is_rx_bad_auth++; 1175 return; 1176 } 1177 break; 1178 } 1179 return; 1180bad: 1181 /* 1182 * Send an error response; but only when operating as an AP. 1183 */ 1184 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 1185 /* XXX hack to workaround calling convention */ 1186 ieee80211_send_error(ic, ni, wh->i_addr2, 1187 IEEE80211_FC0_SUBTYPE_AUTH, 1188 (seq + 1) | (estatus<<16)); 1189 } else if (ic->ic_opmode == IEEE80211_M_STA) { 1190 /* 1191 * Kick the state machine. This short-circuits 1192 * using the mgt frame timeout to trigger the 1193 * state transition. 1194 */ 1195 if (ic->ic_state == IEEE80211_S_AUTH) 1196 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 1197 } 1198} 1199 1200/* Verify the existence and length of __elem or get out. */ 1201#define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \ 1202 if ((__elem) == NULL) { \ 1203 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1204 wh, ieee80211_mgt_subtype_name[subtype >> \ 1205 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1206 "%s", "no " #__elem ); \ 1207 ic->ic_stats.is_rx_elem_missing++; \ 1208 return; \ 1209 } \ 1210 if ((__elem)[1] > (__maxlen)) { \ 1211 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1212 wh, ieee80211_mgt_subtype_name[subtype >> \ 1213 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1214 "bad " #__elem " len %d", (__elem)[1]); \ 1215 ic->ic_stats.is_rx_elem_toobig++; \ 1216 return; \ 1217 } \ 1218} while (0) 1219 1220#define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \ 1221 if ((_len) < (_minlen)) { \ 1222 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1223 wh, ieee80211_mgt_subtype_name[subtype >> \ 1224 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1225 "ie too short, got %d, expected %d", \ 1226 (_len), (_minlen)); \ 1227 ic->ic_stats.is_rx_elem_toosmall++; \ 1228 return; \ 1229 } \ 1230} while (0) 1231 1232#ifdef IEEE80211_DEBUG 1233static void 1234ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag, 1235 u_int8_t mac[IEEE80211_ADDR_LEN], u_int8_t *ssid) 1236{ 1237 printf("[%s] discard %s frame, ssid mismatch: ", 1238 ether_sprintf(mac), tag); 1239 ieee80211_print_essid(ssid + 2, ssid[1]); 1240 printf("\n"); 1241} 1242 1243#define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1244 if ((_ssid)[1] != 0 && \ 1245 ((_ssid)[1] != (_ni)->ni_esslen || \ 1246 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1247 if (ieee80211_msg_input(ic)) \ 1248 ieee80211_ssid_mismatch(ic, \ 1249 ieee80211_mgt_subtype_name[subtype >> \ 1250 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1251 wh->i_addr2, _ssid); \ 1252 ic->ic_stats.is_rx_ssidmismatch++; \ 1253 return; \ 1254 } \ 1255} while (0) 1256#else /* !IEEE80211_DEBUG */ 1257#define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1258 if ((_ssid)[1] != 0 && \ 1259 ((_ssid)[1] != (_ni)->ni_esslen || \ 1260 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1261 ic->ic_stats.is_rx_ssidmismatch++; \ 1262 return; \ 1263 } \ 1264} while (0) 1265#endif /* !IEEE80211_DEBUG */ 1266 1267/* unalligned little endian access */ 1268#define LE_READ_2(p) \ 1269 ((u_int16_t) \ 1270 ((((const u_int8_t *)(p))[0] ) | \ 1271 (((const u_int8_t *)(p))[1] << 8))) 1272#define LE_READ_4(p) \ 1273 ((u_int32_t) \ 1274 ((((const u_int8_t *)(p))[0] ) | \ 1275 (((const u_int8_t *)(p))[1] << 8) | \ 1276 (((const u_int8_t *)(p))[2] << 16) | \ 1277 (((const u_int8_t *)(p))[3] << 24))) 1278 1279static __inline int 1280iswpaoui(const u_int8_t *frm) 1281{ 1282 return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI); 1283} 1284 1285static __inline int 1286iswmeoui(const u_int8_t *frm) 1287{ 1288 return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI); 1289} 1290 1291static __inline int 1292iswmeparam(const u_int8_t *frm) 1293{ 1294 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1295 frm[6] == WME_PARAM_OUI_SUBTYPE; 1296} 1297 1298static __inline int 1299iswmeinfo(const u_int8_t *frm) 1300{ 1301 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1302 frm[6] == WME_INFO_OUI_SUBTYPE; 1303} 1304 1305static __inline int 1306isatherosoui(const u_int8_t *frm) 1307{ 1308 return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI); 1309} 1310 1311/* 1312 * Convert a WPA cipher selector OUI to an internal 1313 * cipher algorithm. Where appropriate we also 1314 * record any key length. 1315 */ 1316static int 1317wpa_cipher(u_int8_t *sel, u_int8_t *keylen) 1318{ 1319#define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1320 u_int32_t w = LE_READ_4(sel); 1321 1322 switch (w) { 1323 case WPA_SEL(WPA_CSE_NULL): 1324 return IEEE80211_CIPHER_NONE; 1325 case WPA_SEL(WPA_CSE_WEP40): 1326 if (keylen) 1327 *keylen = 40 / NBBY; 1328 return IEEE80211_CIPHER_WEP; 1329 case WPA_SEL(WPA_CSE_WEP104): 1330 if (keylen) 1331 *keylen = 104 / NBBY; 1332 return IEEE80211_CIPHER_WEP; 1333 case WPA_SEL(WPA_CSE_TKIP): 1334 return IEEE80211_CIPHER_TKIP; 1335 case WPA_SEL(WPA_CSE_CCMP): 1336 return IEEE80211_CIPHER_AES_CCM; 1337 } 1338 return 32; /* NB: so 1<< is discarded */ 1339#undef WPA_SEL 1340} 1341 1342/* 1343 * Convert a WPA key management/authentication algorithm 1344 * to an internal code. 1345 */ 1346static int 1347wpa_keymgmt(u_int8_t *sel) 1348{ 1349#define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1350 u_int32_t w = LE_READ_4(sel); 1351 1352 switch (w) { 1353 case WPA_SEL(WPA_ASE_8021X_UNSPEC): 1354 return WPA_ASE_8021X_UNSPEC; 1355 case WPA_SEL(WPA_ASE_8021X_PSK): 1356 return WPA_ASE_8021X_PSK; 1357 case WPA_SEL(WPA_ASE_NONE): 1358 return WPA_ASE_NONE; 1359 } 1360 return 0; /* NB: so is discarded */ 1361#undef WPA_SEL 1362} 1363 1364/* 1365 * Parse a WPA information element to collect parameters 1366 * and validate the parameters against what has been 1367 * configured for the system. 1368 */ 1369static int 1370ieee80211_parse_wpa(struct ieee80211com *ic, u_int8_t *frm, 1371 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1372{ 1373 u_int8_t len = frm[1]; 1374 u_int32_t w; 1375 int n; 1376 1377 /* 1378 * Check the length once for fixed parts: OUI, type, 1379 * version, mcast cipher, and 2 selector counts. 1380 * Other, variable-length data, must be checked separately. 1381 */ 1382 if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) { 1383 IEEE80211_DISCARD_IE(ic, 1384 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1385 wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags); 1386 return IEEE80211_REASON_IE_INVALID; 1387 } 1388 if (len < 14) { 1389 IEEE80211_DISCARD_IE(ic, 1390 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1391 wh, "WPA", "too short, len %u", len); 1392 return IEEE80211_REASON_IE_INVALID; 1393 } 1394 frm += 6, len -= 4; /* NB: len is payload only */ 1395 /* NB: iswapoui already validated the OUI and type */ 1396 w = LE_READ_2(frm); 1397 if (w != WPA_VERSION) { 1398 IEEE80211_DISCARD_IE(ic, 1399 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1400 wh, "WPA", "bad version %u", w); 1401 return IEEE80211_REASON_IE_INVALID; 1402 } 1403 frm += 2, len -= 2; 1404 1405 /* multicast/group cipher */ 1406 w = wpa_cipher(frm, &rsn->rsn_mcastkeylen); 1407 if (w != rsn->rsn_mcastcipher) { 1408 IEEE80211_DISCARD_IE(ic, 1409 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1410 wh, "WPA", "mcast cipher mismatch; got %u, expected %u", 1411 w, rsn->rsn_mcastcipher); 1412 return IEEE80211_REASON_IE_INVALID; 1413 } 1414 frm += 4, len -= 4; 1415 1416 /* unicast ciphers */ 1417 n = LE_READ_2(frm); 1418 frm += 2, len -= 2; 1419 if (len < n*4+2) { 1420 IEEE80211_DISCARD_IE(ic, 1421 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1422 wh, "WPA", "ucast cipher data too short; len %u, n %u", 1423 len, n); 1424 return IEEE80211_REASON_IE_INVALID; 1425 } 1426 w = 0; 1427 for (; n > 0; n--) { 1428 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen); 1429 frm += 4, len -= 4; 1430 } 1431 w &= rsn->rsn_ucastcipherset; 1432 if (w == 0) { 1433 IEEE80211_DISCARD_IE(ic, 1434 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1435 wh, "WPA", "%s", "ucast cipher set empty"); 1436 return IEEE80211_REASON_IE_INVALID; 1437 } 1438 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1439 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1440 else 1441 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1442 1443 /* key management algorithms */ 1444 n = LE_READ_2(frm); 1445 frm += 2, len -= 2; 1446 if (len < n*4) { 1447 IEEE80211_DISCARD_IE(ic, 1448 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1449 wh, "WPA", "key mgmt alg data too short; len %u, n %u", 1450 len, n); 1451 return IEEE80211_REASON_IE_INVALID; 1452 } 1453 w = 0; 1454 for (; n > 0; n--) { 1455 w |= wpa_keymgmt(frm); 1456 frm += 4, len -= 4; 1457 } 1458 w &= rsn->rsn_keymgmtset; 1459 if (w == 0) { 1460 IEEE80211_DISCARD_IE(ic, 1461 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1462 wh, "WPA", "%s", "no acceptable key mgmt alg"); 1463 return IEEE80211_REASON_IE_INVALID; 1464 } 1465 if (w & WPA_ASE_8021X_UNSPEC) 1466 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC; 1467 else 1468 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK; 1469 1470 if (len > 2) /* optional capabilities */ 1471 rsn->rsn_caps = LE_READ_2(frm); 1472 1473 return 0; 1474} 1475 1476/* 1477 * Convert an RSN cipher selector OUI to an internal 1478 * cipher algorithm. Where appropriate we also 1479 * record any key length. 1480 */ 1481static int 1482rsn_cipher(u_int8_t *sel, u_int8_t *keylen) 1483{ 1484#define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1485 u_int32_t w = LE_READ_4(sel); 1486 1487 switch (w) { 1488 case RSN_SEL(RSN_CSE_NULL): 1489 return IEEE80211_CIPHER_NONE; 1490 case RSN_SEL(RSN_CSE_WEP40): 1491 if (keylen) 1492 *keylen = 40 / NBBY; 1493 return IEEE80211_CIPHER_WEP; 1494 case RSN_SEL(RSN_CSE_WEP104): 1495 if (keylen) 1496 *keylen = 104 / NBBY; 1497 return IEEE80211_CIPHER_WEP; 1498 case RSN_SEL(RSN_CSE_TKIP): 1499 return IEEE80211_CIPHER_TKIP; 1500 case RSN_SEL(RSN_CSE_CCMP): 1501 return IEEE80211_CIPHER_AES_CCM; 1502 case RSN_SEL(RSN_CSE_WRAP): 1503 return IEEE80211_CIPHER_AES_OCB; 1504 } 1505 return 32; /* NB: so 1<< is discarded */ 1506#undef WPA_SEL 1507} 1508 1509/* 1510 * Convert an RSN key management/authentication algorithm 1511 * to an internal code. 1512 */ 1513static int 1514rsn_keymgmt(u_int8_t *sel) 1515{ 1516#define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1517 u_int32_t w = LE_READ_4(sel); 1518 1519 switch (w) { 1520 case RSN_SEL(RSN_ASE_8021X_UNSPEC): 1521 return RSN_ASE_8021X_UNSPEC; 1522 case RSN_SEL(RSN_ASE_8021X_PSK): 1523 return RSN_ASE_8021X_PSK; 1524 case RSN_SEL(RSN_ASE_NONE): 1525 return RSN_ASE_NONE; 1526 } 1527 return 0; /* NB: so is discarded */ 1528#undef RSN_SEL 1529} 1530 1531/* 1532 * Parse a WPA/RSN information element to collect parameters 1533 * and validate the parameters against what has been 1534 * configured for the system. 1535 */ 1536static int 1537ieee80211_parse_rsn(struct ieee80211com *ic, u_int8_t *frm, 1538 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1539{ 1540 u_int8_t len = frm[1]; 1541 u_int32_t w; 1542 int n; 1543 1544 /* 1545 * Check the length once for fixed parts: 1546 * version, mcast cipher, and 2 selector counts. 1547 * Other, variable-length data, must be checked separately. 1548 */ 1549 if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) { 1550 IEEE80211_DISCARD_IE(ic, 1551 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1552 wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags); 1553 return IEEE80211_REASON_IE_INVALID; 1554 } 1555 if (len < 10) { 1556 IEEE80211_DISCARD_IE(ic, 1557 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1558 wh, "RSN", "too short, len %u", len); 1559 return IEEE80211_REASON_IE_INVALID; 1560 } 1561 frm += 2; 1562 w = LE_READ_2(frm); 1563 if (w != RSN_VERSION) { 1564 IEEE80211_DISCARD_IE(ic, 1565 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1566 wh, "RSN", "bad version %u", w); 1567 return IEEE80211_REASON_IE_INVALID; 1568 } 1569 frm += 2, len -= 2; 1570 1571 /* multicast/group cipher */ 1572 w = rsn_cipher(frm, &rsn->rsn_mcastkeylen); 1573 if (w != rsn->rsn_mcastcipher) { 1574 IEEE80211_DISCARD_IE(ic, 1575 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1576 wh, "RSN", "mcast cipher mismatch; got %u, expected %u", 1577 w, rsn->rsn_mcastcipher); 1578 return IEEE80211_REASON_IE_INVALID; 1579 } 1580 frm += 4, len -= 4; 1581 1582 /* unicast ciphers */ 1583 n = LE_READ_2(frm); 1584 frm += 2, len -= 2; 1585 if (len < n*4+2) { 1586 IEEE80211_DISCARD_IE(ic, 1587 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1588 wh, "RSN", "ucast cipher data too short; len %u, n %u", 1589 len, n); 1590 return IEEE80211_REASON_IE_INVALID; 1591 } 1592 w = 0; 1593 for (; n > 0; n--) { 1594 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen); 1595 frm += 4, len -= 4; 1596 } 1597 w &= rsn->rsn_ucastcipherset; 1598 if (w == 0) { 1599 IEEE80211_DISCARD_IE(ic, 1600 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1601 wh, "RSN", "%s", "ucast cipher set empty"); 1602 return IEEE80211_REASON_IE_INVALID; 1603 } 1604 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1605 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1606 else 1607 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1608 1609 /* key management algorithms */ 1610 n = LE_READ_2(frm); 1611 frm += 2, len -= 2; 1612 if (len < n*4) { 1613 IEEE80211_DISCARD_IE(ic, 1614 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1615 wh, "RSN", "key mgmt alg data too short; len %u, n %u", 1616 len, n); 1617 return IEEE80211_REASON_IE_INVALID; 1618 } 1619 w = 0; 1620 for (; n > 0; n--) { 1621 w |= rsn_keymgmt(frm); 1622 frm += 4, len -= 4; 1623 } 1624 w &= rsn->rsn_keymgmtset; 1625 if (w == 0) { 1626 IEEE80211_DISCARD_IE(ic, 1627 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1628 wh, "RSN", "%s", "no acceptable key mgmt alg"); 1629 return IEEE80211_REASON_IE_INVALID; 1630 } 1631 if (w & RSN_ASE_8021X_UNSPEC) 1632 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC; 1633 else 1634 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK; 1635 1636 /* optional RSN capabilities */ 1637 if (len > 2) 1638 rsn->rsn_caps = LE_READ_2(frm); 1639 /* XXXPMKID */ 1640 1641 return 0; 1642} 1643 1644static int 1645ieee80211_parse_wmeparams(struct ieee80211com *ic, u_int8_t *frm, 1646 const struct ieee80211_frame *wh) 1647{ 1648#define MS(_v, _f) (((_v) & _f) >> _f##_S) 1649 struct ieee80211_wme_state *wme = &ic->ic_wme; 1650 u_int len = frm[1], qosinfo; 1651 int i; 1652 1653 if (len < sizeof(struct ieee80211_wme_param)-2) { 1654 IEEE80211_DISCARD_IE(ic, 1655 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME, 1656 wh, "WME", "too short, len %u", len); 1657 return -1; 1658 } 1659 qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)]; 1660 qosinfo &= WME_QOSINFO_COUNT; 1661 /* XXX do proper check for wraparound */ 1662 if (qosinfo == wme->wme_wmeChanParams.cap_info) 1663 return 0; 1664 frm += __offsetof(struct ieee80211_wme_param, params_acParams); 1665 for (i = 0; i < WME_NUM_AC; i++) { 1666 struct wmeParams *wmep = 1667 &wme->wme_wmeChanParams.cap_wmeParams[i]; 1668 /* NB: ACI not used */ 1669 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM); 1670 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN); 1671 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN); 1672 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX); 1673 wmep->wmep_txopLimit = LE_READ_2(frm+2); 1674 frm += 4; 1675 } 1676 wme->wme_wmeChanParams.cap_info = qosinfo; 1677 return 1; 1678#undef MS 1679} 1680 1681void 1682ieee80211_saveie(u_int8_t **iep, const u_int8_t *ie) 1683{ 1684 u_int ielen = ie[1]+2; 1685 /* 1686 * Record information element for later use. 1687 */ 1688 if (*iep == NULL || (*iep)[1] != ie[1]) { 1689 if (*iep != NULL) 1690 FREE(*iep, M_DEVBUF); 1691 MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT); 1692 } 1693 if (*iep != NULL) 1694 memcpy(*iep, ie, ielen); 1695 /* XXX note failure */ 1696} 1697 1698/* XXX find a better place for definition */ 1699struct l2_update_frame { 1700 struct ether_header eh; 1701 u_int8_t dsap; 1702 u_int8_t ssap; 1703 u_int8_t control; 1704 u_int8_t xid[3]; 1705} __packed; 1706 1707/* 1708 * Deliver a TGf L2UF frame on behalf of a station. 1709 * This primes any bridge when the station is roaming 1710 * between ap's on the same wired network. 1711 */ 1712static void 1713ieee80211_deliver_l2uf(struct ieee80211_node *ni) 1714{ 1715 struct ieee80211com *ic = ni->ni_ic; 1716 struct ifnet *ifp = ic->ic_ifp; 1717 struct mbuf *m; 1718 struct l2_update_frame *l2uf; 1719 struct ether_header *eh; 1720 1721 m = m_gethdr(M_NOWAIT, MT_DATA); 1722 if (m == NULL) { 1723 IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni, 1724 "%s", "no mbuf for l2uf frame"); 1725 ic->ic_stats.is_rx_nobuf++; /* XXX not right */ 1726 return; 1727 } 1728 l2uf = mtod(m, struct l2_update_frame *); 1729 eh = &l2uf->eh; 1730 /* dst: Broadcast address */ 1731 IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr); 1732 /* src: associated STA */ 1733 IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr); 1734 eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh)); 1735 1736 l2uf->dsap = 0; 1737 l2uf->ssap = 0; 1738 l2uf->control = 0xf5; 1739 l2uf->xid[0] = 0x81; 1740 l2uf->xid[1] = 0x80; 1741 l2uf->xid[2] = 0x00; 1742 1743 m->m_pkthdr.len = m->m_len = sizeof(*l2uf); 1744 ieee80211_deliver_data(ic, ni, m); 1745} 1746 1747static void 1748ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh, 1749 int reassoc, int resp, const char *tag, int rate) 1750{ 1751 struct ieee80211com *ic = ni->ni_ic; 1752 1753 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 1754 "[%s] deny %s request, %srate set mismatch, rate 0x%x\n", 1755 ether_sprintf(wh->i_addr2), 1756 reassoc ? "reassoc" : "assoc", tag, rate); 1757 IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_BASIC_RATE); 1758 ieee80211_node_leave(ic, ni); 1759 ic->ic_stats.is_rx_assoc_norate++; 1760} 1761 1762static void 1763capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh, 1764 int reassoc, int resp, const char *tag, int capinfo) 1765{ 1766 struct ieee80211com *ic = ni->ni_ic; 1767 1768 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 1769 "[%s] deny %s request, %s mismatch 0x%x\n", 1770 ether_sprintf(wh->i_addr2), 1771 reassoc ? "reassoc" : "assoc", tag, capinfo); 1772 IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_CAPINFO); 1773 ieee80211_node_leave(ic, ni); 1774 ic->ic_stats.is_rx_assoc_capmismatch++; 1775} 1776 1777void 1778ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, 1779 struct ieee80211_node *ni, 1780 int subtype, int rssi, u_int32_t rstamp) 1781{ 1782#define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP) 1783#define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP) 1784 struct ieee80211_frame *wh; 1785 u_int8_t *frm, *efrm; 1786 u_int8_t *ssid, *rates, *xrates, *wpa, *wme; 1787 int reassoc, resp, allocbs; 1788 u_int8_t rate; 1789 1790 wh = mtod(m0, struct ieee80211_frame *); 1791 frm = (u_int8_t *)&wh[1]; 1792 efrm = mtod(m0, u_int8_t *) + m0->m_len; 1793 switch (subtype) { 1794 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 1795 case IEEE80211_FC0_SUBTYPE_BEACON: { 1796 struct ieee80211_scanparams scan; 1797 1798 /* 1799 * We process beacon/probe response frames: 1800 * o when scanning, or 1801 * o station mode when associated (to collect state 1802 * updates such as 802.11g slot time), or 1803 * o adhoc mode (to discover neighbors) 1804 * Frames otherwise received are discarded. 1805 */ 1806 if (!((ic->ic_flags & IEEE80211_F_SCAN) || 1807 (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) || 1808 ic->ic_opmode == IEEE80211_M_IBSS)) { 1809 ic->ic_stats.is_rx_mgtdiscard++; 1810 return; 1811 } 1812 /* 1813 * beacon/probe response frame format 1814 * [8] time stamp 1815 * [2] beacon interval 1816 * [2] capability information 1817 * [tlv] ssid 1818 * [tlv] supported rates 1819 * [tlv] country information 1820 * [tlv] parameter set (FH/DS) 1821 * [tlv] erp information 1822 * [tlv] extended supported rates 1823 * [tlv] WME 1824 * [tlv] WPA or RSN 1825 */ 1826 IEEE80211_VERIFY_LENGTH(efrm - frm, 12); 1827 memset(&scan, 0, sizeof(scan)); 1828 scan.tstamp = frm; frm += 8; 1829 scan.bintval = le16toh(*(u_int16_t *)frm); frm += 2; 1830 scan.capinfo = le16toh(*(u_int16_t *)frm); frm += 2; 1831 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan); 1832 scan.chan = scan.bchan; 1833 1834 while (efrm - frm > 1) { 1835 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 1836 switch (*frm) { 1837 case IEEE80211_ELEMID_SSID: 1838 scan.ssid = frm; 1839 break; 1840 case IEEE80211_ELEMID_RATES: 1841 scan.rates = frm; 1842 break; 1843 case IEEE80211_ELEMID_COUNTRY: 1844 scan.country = frm; 1845 break; 1846 case IEEE80211_ELEMID_FHPARMS: 1847 if (ic->ic_phytype == IEEE80211_T_FH) { 1848 scan.fhdwell = LE_READ_2(&frm[2]); 1849 scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]); 1850 scan.fhindex = frm[6]; 1851 } 1852 break; 1853 case IEEE80211_ELEMID_DSPARMS: 1854 /* 1855 * XXX hack this since depending on phytype 1856 * is problematic for multi-mode devices. 1857 */ 1858 if (ic->ic_phytype != IEEE80211_T_FH) 1859 scan.chan = frm[2]; 1860 break; 1861 case IEEE80211_ELEMID_TIM: 1862 /* XXX ATIM? */ 1863 scan.tim = frm; 1864 scan.timoff = frm - mtod(m0, u_int8_t *); 1865 break; 1866 case IEEE80211_ELEMID_IBSSPARMS: 1867 break; 1868 case IEEE80211_ELEMID_XRATES: 1869 scan.xrates = frm; 1870 break; 1871 case IEEE80211_ELEMID_ERP: 1872 if (frm[1] != 1) { 1873 IEEE80211_DISCARD_IE(ic, 1874 IEEE80211_MSG_ELEMID, wh, "ERP", 1875 "bad len %u", frm[1]); 1876 ic->ic_stats.is_rx_elem_toobig++; 1877 break; 1878 } 1879 scan.erp = frm[2]; 1880 break; 1881 case IEEE80211_ELEMID_RSN: 1882 scan.wpa = frm; 1883 break; 1884 case IEEE80211_ELEMID_VENDOR: 1885 if (iswpaoui(frm)) 1886 scan.wpa = frm; 1887 else if (iswmeparam(frm) || iswmeinfo(frm)) 1888 scan.wme = frm; 1889 /* XXX Atheros OUI support */ 1890 break; 1891 default: 1892 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID, 1893 wh, "unhandled", 1894 "id %u, len %u", *frm, frm[1]); 1895 ic->ic_stats.is_rx_elem_unknown++; 1896 break; 1897 } 1898 frm += frm[1] + 2; 1899 } 1900 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE); 1901 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN); 1902 if ( 1903#if IEEE80211_CHAN_MAX < 255 1904 scan.chan > IEEE80211_CHAN_MAX || 1905#endif 1906 isclr(ic->ic_chan_active, scan.chan)) { 1907 IEEE80211_DISCARD(ic, 1908 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1909 wh, ieee80211_mgt_subtype_name[subtype >> 1910 IEEE80211_FC0_SUBTYPE_SHIFT], 1911 "invalid channel %u", scan.chan); 1912 ic->ic_stats.is_rx_badchan++; 1913 return; 1914 } 1915 if (scan.chan != scan.bchan && 1916 ic->ic_phytype != IEEE80211_T_FH) { 1917 /* 1918 * Frame was received on a channel different from the 1919 * one indicated in the DS params element id; 1920 * silently discard it. 1921 * 1922 * NB: this can happen due to signal leakage. 1923 * But we should take it for FH phy because 1924 * the rssi value should be correct even for 1925 * different hop pattern in FH. 1926 */ 1927 IEEE80211_DISCARD(ic, 1928 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1929 wh, ieee80211_mgt_subtype_name[subtype >> 1930 IEEE80211_FC0_SUBTYPE_SHIFT], 1931 "for off-channel %u", scan.chan); 1932 ic->ic_stats.is_rx_chanmismatch++; 1933 return; 1934 } 1935 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 1936 scan.bintval <= IEEE80211_BINTVAL_MAX)) { 1937 IEEE80211_DISCARD(ic, 1938 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1939 wh, ieee80211_mgt_subtype_name[subtype >> 1940 IEEE80211_FC0_SUBTYPE_SHIFT], 1941 "bogus beacon interval", scan.bintval); 1942 ic->ic_stats.is_rx_badbintval++; 1943 return; 1944 } 1945 1946 /* 1947 * Count frame now that we know it's to be processed. 1948 */ 1949 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) { 1950 ic->ic_stats.is_rx_beacon++; /* XXX remove */ 1951 IEEE80211_NODE_STAT(ni, rx_beacons); 1952 } else 1953 IEEE80211_NODE_STAT(ni, rx_proberesp); 1954 1955 /* 1956 * When operating in station mode, check for state updates. 1957 * Be careful to ignore beacons received while doing a 1958 * background scan. We consider only 11g/WMM stuff right now. 1959 */ 1960 if (ic->ic_opmode == IEEE80211_M_STA && 1961 ni->ni_associd != 0 && 1962 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 || 1963 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) { 1964 /* record tsf of last beacon */ 1965 memcpy(ni->ni_tstamp.data, scan.tstamp, 1966 sizeof(ni->ni_tstamp)); 1967 /* count beacon frame for s/w bmiss handling */ 1968 ic->ic_swbmiss_count++; 1969 ic->ic_bmiss_count = 0; 1970 if (ni->ni_erp != scan.erp) { 1971 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 1972 "[%s] erp change: was 0x%x, now 0x%x\n", 1973 ether_sprintf(wh->i_addr2), 1974 ni->ni_erp, scan.erp); 1975 if (ic->ic_curmode == IEEE80211_MODE_11G && 1976 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 1977 ic->ic_flags |= IEEE80211_F_USEPROT; 1978 else 1979 ic->ic_flags &= ~IEEE80211_F_USEPROT; 1980 ni->ni_erp = scan.erp; 1981 /* XXX statistic */ 1982 } 1983 if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) { 1984 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 1985 "[%s] capabilities change: before 0x%x," 1986 " now 0x%x\n", 1987 ether_sprintf(wh->i_addr2), 1988 ni->ni_capinfo, scan.capinfo); 1989 /* 1990 * NB: we assume short preamble doesn't 1991 * change dynamically 1992 */ 1993 ieee80211_set_shortslottime(ic, 1994 ic->ic_curmode == IEEE80211_MODE_11A || 1995 (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 1996 ni->ni_capinfo = scan.capinfo; 1997 /* XXX statistic */ 1998 } 1999 if (scan.wme != NULL && 2000 (ni->ni_flags & IEEE80211_NODE_QOS) && 2001 ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0) 2002 ieee80211_wme_updateparams(ic); 2003 if (scan.tim != NULL) { 2004 struct ieee80211_tim_ie *ie = 2005 (struct ieee80211_tim_ie *) scan.tim; 2006 2007 ni->ni_dtim_count = ie->tim_count; 2008 ni->ni_dtim_period = ie->tim_period; 2009 } 2010 if (ic->ic_flags & IEEE80211_F_SCAN) 2011 ieee80211_add_scan(ic, &scan, wh, 2012 subtype, rssi, rstamp); 2013 return; 2014 } 2015 /* 2016 * If scanning, just pass information to the scan module. 2017 */ 2018 if (ic->ic_flags & IEEE80211_F_SCAN) { 2019 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) { 2020 /* 2021 * Actively scanning a channel marked passive; 2022 * send a probe request now that we know there 2023 * is 802.11 traffic present. 2024 * 2025 * XXX check if the beacon we recv'd gives 2026 * us what we need and suppress the probe req 2027 */ 2028 ieee80211_probe_curchan(ic, 1); 2029 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN; 2030 } 2031 ieee80211_add_scan(ic, &scan, wh, 2032 subtype, rssi, rstamp); 2033 return; 2034 } 2035 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) { 2036 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 2037 /* 2038 * Create a new entry in the neighbor table. 2039 */ 2040 ni = ieee80211_add_neighbor(ic, wh, &scan); 2041 } else if (ni->ni_capinfo == 0) { 2042 /* 2043 * Update faked node created on transmit. 2044 * Note this also updates the tsf. 2045 */ 2046 ieee80211_init_neighbor(ni, wh, &scan); 2047 } else { 2048 /* 2049 * Record tsf for potential resync. 2050 */ 2051 memcpy(ni->ni_tstamp.data, scan.tstamp, 2052 sizeof(ni->ni_tstamp)); 2053 } 2054 if (ni != NULL) { 2055 ni->ni_rssi = rssi; 2056 ni->ni_rstamp = rstamp; 2057 } 2058 } 2059 break; 2060 } 2061 2062 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 2063 if (ic->ic_opmode == IEEE80211_M_STA || 2064 ic->ic_state != IEEE80211_S_RUN) { 2065 ic->ic_stats.is_rx_mgtdiscard++; 2066 return; 2067 } 2068 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) { 2069 /* frame must be directed */ 2070 ic->ic_stats.is_rx_mgtdiscard++; /* XXX stat */ 2071 return; 2072 } 2073 2074 /* 2075 * prreq frame format 2076 * [tlv] ssid 2077 * [tlv] supported rates 2078 * [tlv] extended supported rates 2079 */ 2080 ssid = rates = xrates = NULL; 2081 while (efrm - frm > 1) { 2082 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2083 switch (*frm) { 2084 case IEEE80211_ELEMID_SSID: 2085 ssid = frm; 2086 break; 2087 case IEEE80211_ELEMID_RATES: 2088 rates = frm; 2089 break; 2090 case IEEE80211_ELEMID_XRATES: 2091 xrates = frm; 2092 break; 2093 } 2094 frm += frm[1] + 2; 2095 } 2096 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2097 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2098 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2099 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) { 2100 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 2101 wh, ieee80211_mgt_subtype_name[subtype >> 2102 IEEE80211_FC0_SUBTYPE_SHIFT], 2103 "%s", "no ssid with ssid suppression enabled"); 2104 ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/ 2105 return; 2106 } 2107 2108 allocbs = 0; 2109 if (ni == ic->ic_bss) { 2110 if (ic->ic_opmode != IEEE80211_M_IBSS) { 2111 ni = ieee80211_tmp_node(ic, wh->i_addr2); 2112 allocbs = 1; 2113 } else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 2114 /* 2115 * XXX Cannot tell if the sender is operating 2116 * in ibss mode. But we need a new node to 2117 * send the response so blindly add them to the 2118 * neighbor table. 2119 */ 2120 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 2121 wh->i_addr2); 2122 } 2123 if (ni == NULL) 2124 return; 2125 } 2126 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2127 "[%s] recv probe req\n", ether_sprintf(wh->i_addr2)); 2128 ni->ni_rssi = rssi; 2129 ni->ni_rstamp = rstamp; 2130 rate = ieee80211_setup_rates(ni, rates, xrates, 2131 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE 2132 | IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 2133 if (rate & IEEE80211_RATE_BASIC) { 2134 IEEE80211_DISCARD(ic, IEEE80211_MSG_XRATE, 2135 wh, ieee80211_mgt_subtype_name[subtype >> 2136 IEEE80211_FC0_SUBTYPE_SHIFT], 2137 "%s", "recv'd rate set invalid"); 2138 } else { 2139 IEEE80211_SEND_MGMT(ic, ni, 2140 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0); 2141 } 2142 if (allocbs) { 2143 /* 2144 * Temporary node created just to send a 2145 * response, reclaim immediately. 2146 */ 2147 ieee80211_free_node(ni); 2148 } 2149 break; 2150 2151 case IEEE80211_FC0_SUBTYPE_AUTH: { 2152 u_int16_t algo, seq, status; 2153 /* 2154 * auth frame format 2155 * [2] algorithm 2156 * [2] sequence 2157 * [2] status 2158 * [tlv*] challenge 2159 */ 2160 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2161 algo = le16toh(*(u_int16_t *)frm); 2162 seq = le16toh(*(u_int16_t *)(frm + 2)); 2163 status = le16toh(*(u_int16_t *)(frm + 4)); 2164 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2165 "[%s] recv auth frame with algorithm %d seq %d\n", 2166 ether_sprintf(wh->i_addr2), algo, seq); 2167 /* 2168 * Consult the ACL policy module if setup. 2169 */ 2170 if (ic->ic_acl != NULL && 2171 !ic->ic_acl->iac_check(ic, wh->i_addr2)) { 2172 IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL, 2173 wh, "auth", "%s", "disallowed by ACL"); 2174 ic->ic_stats.is_rx_acl++; 2175 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2176 IEEE80211_SEND_MGMT(ic, ni, 2177 IEEE80211_FC0_SUBTYPE_AUTH, 2178 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16)); 2179 } 2180 return; 2181 } 2182 if (ic->ic_flags & IEEE80211_F_COUNTERM) { 2183 IEEE80211_DISCARD(ic, 2184 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO, 2185 wh, "auth", "%s", "TKIP countermeasures enabled"); 2186 ic->ic_stats.is_rx_auth_countermeasures++; 2187 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2188 IEEE80211_SEND_MGMT(ic, ni, 2189 IEEE80211_FC0_SUBTYPE_AUTH, 2190 IEEE80211_REASON_MIC_FAILURE); 2191 } 2192 return; 2193 } 2194 if (algo == IEEE80211_AUTH_ALG_SHARED) 2195 ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi, 2196 rstamp, seq, status); 2197 else if (algo == IEEE80211_AUTH_ALG_OPEN) 2198 ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq, 2199 status); 2200 else { 2201 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2202 wh, "auth", "unsupported alg %d", algo); 2203 ic->ic_stats.is_rx_auth_unsupported++; 2204 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2205 /* XXX not right */ 2206 IEEE80211_SEND_MGMT(ic, ni, 2207 IEEE80211_FC0_SUBTYPE_AUTH, 2208 (seq+1) | (IEEE80211_STATUS_ALG<<16)); 2209 } 2210 return; 2211 } 2212 break; 2213 } 2214 2215 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 2216 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: { 2217 u_int16_t capinfo, lintval; 2218 struct ieee80211_rsnparms rsn; 2219 u_int8_t reason; 2220 2221 if (ic->ic_opmode != IEEE80211_M_HOSTAP || 2222 ic->ic_state != IEEE80211_S_RUN) { 2223 ic->ic_stats.is_rx_mgtdiscard++; 2224 return; 2225 } 2226 2227 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 2228 reassoc = 1; 2229 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP; 2230 } else { 2231 reassoc = 0; 2232 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP; 2233 } 2234 /* 2235 * asreq frame format 2236 * [2] capability information 2237 * [2] listen interval 2238 * [6*] current AP address (reassoc only) 2239 * [tlv] ssid 2240 * [tlv] supported rates 2241 * [tlv] extended supported rates 2242 * [tlv] WPA or RSN 2243 */ 2244 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4)); 2245 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) { 2246 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2247 wh, ieee80211_mgt_subtype_name[subtype >> 2248 IEEE80211_FC0_SUBTYPE_SHIFT], 2249 "%s", "wrong bssid"); 2250 ic->ic_stats.is_rx_assoc_bss++; 2251 return; 2252 } 2253 capinfo = le16toh(*(u_int16_t *)frm); frm += 2; 2254 lintval = le16toh(*(u_int16_t *)frm); frm += 2; 2255 if (reassoc) 2256 frm += 6; /* ignore current AP info */ 2257 ssid = rates = xrates = wpa = wme = NULL; 2258 while (efrm - frm > 1) { 2259 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2260 switch (*frm) { 2261 case IEEE80211_ELEMID_SSID: 2262 ssid = frm; 2263 break; 2264 case IEEE80211_ELEMID_RATES: 2265 rates = frm; 2266 break; 2267 case IEEE80211_ELEMID_XRATES: 2268 xrates = frm; 2269 break; 2270 /* XXX verify only one of RSN and WPA ie's? */ 2271 case IEEE80211_ELEMID_RSN: 2272 wpa = frm; 2273 break; 2274 case IEEE80211_ELEMID_VENDOR: 2275 if (iswpaoui(frm)) 2276 wpa = frm; 2277 else if (iswmeinfo(frm)) 2278 wme = frm; 2279 /* XXX Atheros OUI support */ 2280 break; 2281 } 2282 frm += frm[1] + 2; 2283 } 2284 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2285 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2286 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2287 2288 if (ni == ic->ic_bss) { 2289 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2290 "[%s] deny %s request, sta not authenticated\n", 2291 ether_sprintf(wh->i_addr2), 2292 reassoc ? "reassoc" : "assoc"); 2293 ieee80211_send_error(ic, ni, wh->i_addr2, 2294 IEEE80211_FC0_SUBTYPE_DEAUTH, 2295 IEEE80211_REASON_ASSOC_NOT_AUTHED); 2296 ic->ic_stats.is_rx_assoc_notauth++; 2297 return; 2298 } 2299 /* assert right associstion security credentials */ 2300 if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) { 2301 IEEE80211_DPRINTF(ic, 2302 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2303 "[%s] no WPA/RSN IE in association request\n", 2304 ether_sprintf(wh->i_addr2)); 2305 IEEE80211_SEND_MGMT(ic, ni, 2306 IEEE80211_FC0_SUBTYPE_DEAUTH, 2307 IEEE80211_REASON_RSN_REQUIRED); 2308 ieee80211_node_leave(ic, ni); 2309 /* XXX distinguish WPA/RSN? */ 2310 ic->ic_stats.is_rx_assoc_badwpaie++; 2311 return; 2312 } 2313 if (wpa != NULL) { 2314 /* 2315 * Parse WPA information element. Note that 2316 * we initialize the param block from the node 2317 * state so that information in the IE overrides 2318 * our defaults. The resulting parameters are 2319 * installed below after the association is assured. 2320 */ 2321 rsn = ni->ni_rsn; 2322 if (wpa[0] != IEEE80211_ELEMID_RSN) 2323 reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh); 2324 else 2325 reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh); 2326 if (reason != 0) { 2327 IEEE80211_SEND_MGMT(ic, ni, 2328 IEEE80211_FC0_SUBTYPE_DEAUTH, reason); 2329 ieee80211_node_leave(ic, ni); 2330 /* XXX distinguish WPA/RSN? */ 2331 ic->ic_stats.is_rx_assoc_badwpaie++; 2332 return; 2333 } 2334 IEEE80211_DPRINTF(ic, 2335 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2336 "[%s] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n", 2337 ether_sprintf(wh->i_addr2), 2338 wpa[0] != IEEE80211_ELEMID_RSN ? "WPA" : "RSN", 2339 rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen, 2340 rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen, 2341 rsn.rsn_keymgmt, rsn.rsn_caps); 2342 } 2343 /* discard challenge after association */ 2344 if (ni->ni_challenge != NULL) { 2345 FREE(ni->ni_challenge, M_DEVBUF); 2346 ni->ni_challenge = NULL; 2347 } 2348 /* NB: 802.11 spec says to ignore station's privacy bit */ 2349 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) { 2350 capinfomismatch(ni, wh, reassoc, resp, 2351 "capability", capinfo); 2352 return; 2353 } 2354 /* 2355 * Disallow re-associate w/ invalid slot time setting. 2356 */ 2357 if (ni->ni_associd != 0 && 2358 ic->ic_curmode == IEEE80211_MODE_11G && 2359 ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) { 2360 capinfomismatch(ni, wh, reassoc, resp, 2361 "slot time", capinfo); 2362 return; 2363 } 2364 rate = ieee80211_setup_rates(ni, rates, xrates, 2365 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2366 IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 2367 if (rate & IEEE80211_RATE_BASIC) { 2368 ratesetmismatch(ni, wh, reassoc, resp, "basic", rate); 2369 return; 2370 } 2371 /* 2372 * If constrained to 11g-only stations reject an 2373 * 11b-only station. We cheat a bit here by looking 2374 * at the max negotiated xmit rate and assuming anyone 2375 * with a best rate <24Mb/s is an 11b station. 2376 */ 2377 if ((ic->ic_flags & IEEE80211_F_PUREG) && rate < 48) { 2378 ratesetmismatch(ni, wh, reassoc, resp, "11g", rate); 2379 return; 2380 } 2381 ni->ni_rssi = rssi; 2382 ni->ni_rstamp = rstamp; 2383 ni->ni_intval = lintval; 2384 ni->ni_capinfo = capinfo; 2385 ni->ni_chan = ic->ic_bss->ni_chan; 2386 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell; 2387 ni->ni_fhindex = ic->ic_bss->ni_fhindex; 2388 if (wpa != NULL) { 2389 /* 2390 * Record WPA/RSN parameters for station, mark 2391 * node as using WPA and record information element 2392 * for applications that require it. 2393 */ 2394 ni->ni_rsn = rsn; 2395 ieee80211_saveie(&ni->ni_wpa_ie, wpa); 2396 } else if (ni->ni_wpa_ie != NULL) { 2397 /* 2398 * Flush any state from a previous association. 2399 */ 2400 FREE(ni->ni_wpa_ie, M_DEVBUF); 2401 ni->ni_wpa_ie = NULL; 2402 } 2403 if (wme != NULL) { 2404 /* 2405 * Record WME parameters for station, mark node 2406 * as capable of QoS and record information 2407 * element for applications that require it. 2408 */ 2409 ieee80211_saveie(&ni->ni_wme_ie, wme); 2410 ni->ni_flags |= IEEE80211_NODE_QOS; 2411 } else if (ni->ni_wme_ie != NULL) { 2412 /* 2413 * Flush any state from a previous association. 2414 */ 2415 FREE(ni->ni_wme_ie, M_DEVBUF); 2416 ni->ni_wme_ie = NULL; 2417 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2418 } 2419 ieee80211_deliver_l2uf(ni); 2420 ieee80211_node_join(ic, ni, resp); 2421 break; 2422 } 2423 2424 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 2425 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: { 2426 u_int16_t capinfo, associd; 2427 u_int16_t status; 2428 2429 if (ic->ic_opmode != IEEE80211_M_STA || 2430 ic->ic_state != IEEE80211_S_ASSOC) { 2431 ic->ic_stats.is_rx_mgtdiscard++; 2432 return; 2433 } 2434 2435 /* 2436 * asresp frame format 2437 * [2] capability information 2438 * [2] status 2439 * [2] association ID 2440 * [tlv] supported rates 2441 * [tlv] extended supported rates 2442 * [tlv] WME 2443 */ 2444 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2445 ni = ic->ic_bss; 2446 capinfo = le16toh(*(u_int16_t *)frm); 2447 frm += 2; 2448 status = le16toh(*(u_int16_t *)frm); 2449 frm += 2; 2450 if (status != 0) { 2451 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2452 "[%s] %sassoc failed (reason %d)\n", 2453 ether_sprintf(wh->i_addr2), 2454 ISREASSOC(subtype) ? "re" : "", status); 2455 if (ni != ic->ic_bss) /* XXX never true? */ 2456 ni->ni_fails++; 2457 ic->ic_stats.is_rx_auth_fail++; /* XXX */ 2458 return; 2459 } 2460 associd = le16toh(*(u_int16_t *)frm); 2461 frm += 2; 2462 2463 rates = xrates = wpa = wme = NULL; 2464 while (efrm - frm > 1) { 2465 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2466 switch (*frm) { 2467 case IEEE80211_ELEMID_RATES: 2468 rates = frm; 2469 break; 2470 case IEEE80211_ELEMID_XRATES: 2471 xrates = frm; 2472 break; 2473 case IEEE80211_ELEMID_VENDOR: 2474 if (iswmeoui(frm)) 2475 wme = frm; 2476 /* XXX Atheros OUI support */ 2477 break; 2478 } 2479 frm += frm[1] + 2; 2480 } 2481 2482 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2483 rate = ieee80211_setup_rates(ni, rates, xrates, 2484 IEEE80211_F_JOIN | 2485 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2486 IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 2487 if (rate & IEEE80211_RATE_BASIC) { 2488 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2489 "[%s] %sassoc failed (rate set mismatch)\n", 2490 ether_sprintf(wh->i_addr2), 2491 ISREASSOC(subtype) ? "re" : ""); 2492 if (ni != ic->ic_bss) /* XXX never true? */ 2493 ni->ni_fails++; 2494 ic->ic_stats.is_rx_assoc_norate++; 2495 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 2496 return; 2497 } 2498 2499 ni->ni_capinfo = capinfo; 2500 ni->ni_associd = associd; 2501 if (wme != NULL && 2502 ieee80211_parse_wmeparams(ic, wme, wh) >= 0) { 2503 ni->ni_flags |= IEEE80211_NODE_QOS; 2504 ieee80211_wme_updateparams(ic); 2505 } else 2506 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2507 /* 2508 * Configure state now that we are associated. 2509 * 2510 * XXX may need different/additional driver callbacks? 2511 */ 2512 if (ic->ic_curmode == IEEE80211_MODE_11A || 2513 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) { 2514 ic->ic_flags |= IEEE80211_F_SHPREAMBLE; 2515 ic->ic_flags &= ~IEEE80211_F_USEBARKER; 2516 } else { 2517 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE; 2518 ic->ic_flags |= IEEE80211_F_USEBARKER; 2519 } 2520 ieee80211_set_shortslottime(ic, 2521 ic->ic_curmode == IEEE80211_MODE_11A || 2522 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2523 /* 2524 * Honor ERP protection. 2525 * 2526 * NB: ni_erp should zero for non-11g operation. 2527 * XXX check ic_curmode anyway? 2528 */ 2529 if (ic->ic_curmode == IEEE80211_MODE_11G && 2530 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 2531 ic->ic_flags |= IEEE80211_F_USEPROT; 2532 else 2533 ic->ic_flags &= ~IEEE80211_F_USEPROT; 2534 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2535 "[%s] %sassoc success: %s preamble, %s slot time%s%s\n", 2536 ether_sprintf(wh->i_addr2), 2537 ISREASSOC(subtype) ? "re" : "", 2538 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long", 2539 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long", 2540 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "", 2541 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "" 2542 ); 2543 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype); 2544 break; 2545 } 2546 2547 case IEEE80211_FC0_SUBTYPE_DEAUTH: { 2548 u_int16_t reason; 2549 2550 if (ic->ic_state == IEEE80211_S_SCAN) { 2551 ic->ic_stats.is_rx_mgtdiscard++; 2552 return; 2553 } 2554 /* 2555 * deauth frame format 2556 * [2] reason 2557 */ 2558 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2559 reason = le16toh(*(u_int16_t *)frm); 2560 ic->ic_stats.is_rx_deauth++; 2561 IEEE80211_NODE_STAT(ni, rx_deauth); 2562 2563 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) { 2564 /* NB: can happen when in promiscuous mode */ 2565 ic->ic_stats.is_rx_mgtdiscard++; 2566 break; 2567 } 2568 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2569 "[%s] recv deauthenticate (reason %d)\n", 2570 ether_sprintf(ni->ni_macaddr), reason); 2571 switch (ic->ic_opmode) { 2572 case IEEE80211_M_STA: 2573 ieee80211_new_state(ic, IEEE80211_S_AUTH, 2574 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2575 break; 2576 case IEEE80211_M_HOSTAP: 2577 if (ni != ic->ic_bss) 2578 ieee80211_node_leave(ic, ni); 2579 break; 2580 default: 2581 ic->ic_stats.is_rx_mgtdiscard++; 2582 break; 2583 } 2584 break; 2585 } 2586 2587 case IEEE80211_FC0_SUBTYPE_DISASSOC: { 2588 u_int16_t reason; 2589 2590 if (ic->ic_state != IEEE80211_S_RUN && 2591 ic->ic_state != IEEE80211_S_ASSOC && 2592 ic->ic_state != IEEE80211_S_AUTH) { 2593 ic->ic_stats.is_rx_mgtdiscard++; 2594 return; 2595 } 2596 /* 2597 * disassoc frame format 2598 * [2] reason 2599 */ 2600 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2601 reason = le16toh(*(u_int16_t *)frm); 2602 ic->ic_stats.is_rx_disassoc++; 2603 IEEE80211_NODE_STAT(ni, rx_disassoc); 2604 2605 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) { 2606 /* NB: can happen when in promiscuous mode */ 2607 ic->ic_stats.is_rx_mgtdiscard++; 2608 break; 2609 } 2610 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2611 "[%s] recv disassociate (reason %d)\n", 2612 ether_sprintf(ni->ni_macaddr), reason); 2613 switch (ic->ic_opmode) { 2614 case IEEE80211_M_STA: 2615 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 2616 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2617 break; 2618 case IEEE80211_M_HOSTAP: 2619 if (ni != ic->ic_bss) 2620 ieee80211_node_leave(ic, ni); 2621 break; 2622 default: 2623 ic->ic_stats.is_rx_mgtdiscard++; 2624 break; 2625 } 2626 break; 2627 } 2628 default: 2629 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2630 wh, "mgt", "subtype 0x%x not handled", subtype); 2631 ic->ic_stats.is_rx_badsubtype++; 2632 break; 2633 } 2634#undef ISREASSOC 2635#undef ISPROBE 2636} 2637#undef IEEE80211_VERIFY_LENGTH 2638#undef IEEE80211_VERIFY_ELEMENT 2639 2640/* 2641 * Handle station power-save state change. 2642 */ 2643static void 2644ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable) 2645{ 2646 struct ieee80211com *ic = ni->ni_ic; 2647 struct mbuf *m, *mhead, *mtail; 2648 int mcount; 2649 2650 if (enable) { 2651 if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) 2652 ic->ic_ps_sta++; 2653 ni->ni_flags |= IEEE80211_NODE_PWR_MGT; 2654 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2655 "[%s] power save mode on, %u sta's in ps mode\n", 2656 ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta); 2657 return; 2658 } 2659 2660 if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) 2661 ic->ic_ps_sta--; 2662 ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT; 2663 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2664 "[%s] power save mode off, %u sta's in ps mode\n", 2665 ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta); 2666 /* XXX if no stations in ps mode, flush mc frames */ 2667 2668 /* 2669 * Flush queued unicast frames. 2670 */ 2671 if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) { 2672 if (ic->ic_set_tim != NULL) 2673 ic->ic_set_tim(ni, 0); /* just in case */ 2674 return; 2675 } 2676 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2677 "[%s] flush ps queue, %u packets queued\n", 2678 ether_sprintf(ni->ni_macaddr), IEEE80211_NODE_SAVEQ_QLEN(ni)); 2679 /* 2680 * Unload the frames from the ps q but don't send them 2681 * to the driver yet. We do this in two stages to minimize 2682 * locking but also because there's no easy way to preserve 2683 * ordering given the existing ifnet access mechanisms. 2684 * XXX could be optimized 2685 */ 2686 IEEE80211_NODE_SAVEQ_LOCK(ni); 2687 mcount = IEEE80211_NODE_SAVEQ_QLEN(ni); 2688 mhead = mtail = NULL; 2689 for (;;) { 2690 _IEEE80211_NODE_SAVEQ_DEQUEUE_HEAD(ni, m); 2691 if (m == NULL) 2692 break; 2693 if (mhead == NULL) { 2694 mhead = m; 2695 m->m_nextpkt = NULL; 2696 } else 2697 mtail->m_nextpkt = m; 2698 mtail = m; 2699 } 2700 IEEE80211_NODE_SAVEQ_UNLOCK(ni); 2701 if (mhead != NULL) { 2702 /* XXX need different driver interface */ 2703 /* XXX bypasses q max */ 2704 IF_PREPEND_LIST(&ic->ic_ifp->if_snd, mhead, mtail, mcount); 2705 } 2706 if (ic->ic_set_tim != NULL) 2707 ic->ic_set_tim(ni, 0); 2708} 2709 2710/* 2711 * Process a received ps-poll frame. 2712 */ 2713static void 2714ieee80211_recv_pspoll(struct ieee80211com *ic, 2715 struct ieee80211_node *ni, struct mbuf *m0) 2716{ 2717 struct ieee80211_frame_min *wh; 2718 struct mbuf *m; 2719 u_int16_t aid; 2720 int qlen; 2721 2722 wh = mtod(m0, struct ieee80211_frame_min *); 2723 if (ni->ni_associd == 0) { 2724 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2725 (struct ieee80211_frame *) wh, "ps-poll", 2726 "%s", "unassociated station"); 2727 ic->ic_stats.is_ps_unassoc++; 2728 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2729 IEEE80211_REASON_NOT_ASSOCED); 2730 return; 2731 } 2732 2733 aid = le16toh(*(u_int16_t *)wh->i_dur); 2734 if (aid != ni->ni_associd) { 2735 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2736 (struct ieee80211_frame *) wh, "ps-poll", 2737 "aid mismatch: sta aid 0x%x poll aid 0x%x", 2738 ni->ni_associd, aid); 2739 ic->ic_stats.is_ps_badaid++; 2740 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2741 IEEE80211_REASON_NOT_ASSOCED); 2742 return; 2743 } 2744 2745 /* Okay, take the first queued packet and put it out... */ 2746 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2747 if (m == NULL) { 2748 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2749 "[%s] recv ps-poll, but queue empty\n", 2750 ether_sprintf(wh->i_addr2)); 2751 ieee80211_send_nulldata(ieee80211_ref_node(ni)); 2752 ic->ic_stats.is_ps_qempty++; /* XXX node stat */ 2753 if (ic->ic_set_tim != NULL) 2754 ic->ic_set_tim(ni, 0); /* just in case */ 2755 return; 2756 } 2757 /* 2758 * If there are more packets, set the more packets bit 2759 * in the packet dispatched to the station; otherwise 2760 * turn off the TIM bit. 2761 */ 2762 if (qlen != 0) { 2763 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2764 "[%s] recv ps-poll, send packet, %u still queued\n", 2765 ether_sprintf(ni->ni_macaddr), qlen); 2766 m->m_flags |= M_MORE_DATA; 2767 } else { 2768 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2769 "[%s] recv ps-poll, send packet, queue empty\n", 2770 ether_sprintf(ni->ni_macaddr)); 2771 if (ic->ic_set_tim != NULL) 2772 ic->ic_set_tim(ni, 0); 2773 } 2774 m->m_flags |= M_PWR_SAV; /* bypass PS handling */ 2775 IF_ENQUEUE(&ic->ic_ifp->if_snd, m); 2776} 2777 2778#ifdef IEEE80211_DEBUG 2779/* 2780 * Debugging support. 2781 */ 2782 2783/* 2784 * Return the bssid of a frame. 2785 */ 2786static const u_int8_t * 2787ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh) 2788{ 2789 if (ic->ic_opmode == IEEE80211_M_STA) 2790 return wh->i_addr2; 2791 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS) 2792 return wh->i_addr1; 2793 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL) 2794 return wh->i_addr1; 2795 return wh->i_addr3; 2796} 2797 2798void 2799ieee80211_note(struct ieee80211com *ic, const char *fmt, ...) 2800{ 2801 char buf[128]; /* XXX */ 2802 va_list ap; 2803 2804 va_start(ap, fmt); 2805 vsnprintf(buf, sizeof(buf), fmt, ap); 2806 va_end(ap); 2807 2808 if_printf(ic->ic_ifp, "%s", buf); /* NB: no \n */ 2809} 2810 2811void 2812ieee80211_note_frame(struct ieee80211com *ic, 2813 const struct ieee80211_frame *wh, 2814 const char *fmt, ...) 2815{ 2816 char buf[128]; /* XXX */ 2817 va_list ap; 2818 2819 va_start(ap, fmt); 2820 vsnprintf(buf, sizeof(buf), fmt, ap); 2821 va_end(ap); 2822 if_printf(ic->ic_ifp, "[%s] %s\n", 2823 ether_sprintf(ieee80211_getbssid(ic, wh)), buf); 2824} 2825 2826void 2827ieee80211_note_mac(struct ieee80211com *ic, 2828 const u_int8_t mac[IEEE80211_ADDR_LEN], 2829 const char *fmt, ...) 2830{ 2831 char buf[128]; /* XXX */ 2832 va_list ap; 2833 2834 va_start(ap, fmt); 2835 vsnprintf(buf, sizeof(buf), fmt, ap); 2836 va_end(ap); 2837 if_printf(ic->ic_ifp, "[%s] %s\n", ether_sprintf(mac), buf); 2838} 2839 2840void 2841ieee80211_discard_frame(struct ieee80211com *ic, 2842 const struct ieee80211_frame *wh, 2843 const char *type, const char *fmt, ...) 2844{ 2845 va_list ap; 2846 2847 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, 2848 ether_sprintf(ieee80211_getbssid(ic, wh))); 2849 if (type != NULL) 2850 printf("%s frame, ", type); 2851 else 2852 printf("frame, "); 2853 va_start(ap, fmt); 2854 vprintf(fmt, ap); 2855 va_end(ap); 2856 printf("\n"); 2857} 2858 2859void 2860ieee80211_discard_ie(struct ieee80211com *ic, 2861 const struct ieee80211_frame *wh, 2862 const char *type, const char *fmt, ...) 2863{ 2864 va_list ap; 2865 2866 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, 2867 ether_sprintf(ieee80211_getbssid(ic, wh))); 2868 if (type != NULL) 2869 printf("%s information element, ", type); 2870 else 2871 printf("information element, "); 2872 va_start(ap, fmt); 2873 vprintf(fmt, ap); 2874 va_end(ap); 2875 printf("\n"); 2876} 2877 2878void 2879ieee80211_discard_mac(struct ieee80211com *ic, 2880 const u_int8_t mac[IEEE80211_ADDR_LEN], 2881 const char *type, const char *fmt, ...) 2882{ 2883 va_list ap; 2884 2885 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, ether_sprintf(mac)); 2886 if (type != NULL) 2887 printf("%s frame, ", type); 2888 else 2889 printf("frame, "); 2890 va_start(ap, fmt); 2891 vprintf(fmt, ap); 2892 va_end(ap); 2893 printf("\n"); 2894} 2895#endif /* IEEE80211_DEBUG */ 2896