ieee80211_output.c revision 121180
1/*- 2 * Copyright (c) 2001 Atsushi Onoe 3 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * Alternatively, this software may be distributed under the terms of the 18 * GNU General Public License ("GPL") version 2 as published by the Free 19 * Software Foundation. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33#include <sys/cdefs.h> 34__FBSDID("$FreeBSD: head/sys/net80211/ieee80211_output.c 121180 2003-10-17 23:15:30Z sam $"); 35 36#include "opt_inet.h" 37 38#include <sys/param.h> 39#include <sys/systm.h> 40#include <sys/mbuf.h> 41#include <sys/malloc.h> 42#include <sys/kernel.h> 43#include <sys/socket.h> 44#include <sys/sockio.h> 45#include <sys/endian.h> 46#include <sys/errno.h> 47#include <sys/bus.h> 48#include <sys/proc.h> 49#include <sys/sysctl.h> 50 51#include <machine/atomic.h> 52 53#include <net/if.h> 54#include <net/if_dl.h> 55#include <net/if_media.h> 56#include <net/if_arp.h> 57#include <net/ethernet.h> 58#include <net/if_llc.h> 59 60#include <net80211/ieee80211_var.h> 61 62#include <net/bpf.h> 63 64#ifdef INET 65#include <netinet/in.h> 66#include <netinet/if_ether.h> 67#endif 68 69/* 70 * Send a management frame to the specified node. The node pointer 71 * must have a reference as the pointer will be passed to the driver 72 * and potentially held for a long time. If the frame is successfully 73 * dispatched to the driver, then it is responsible for freeing the 74 * reference (and potentially free'ing up any associated storage). 75 */ 76static int 77ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni, 78 struct mbuf *m, int type) 79{ 80 struct ieee80211com *ic = (void *)ifp; 81 struct ieee80211_frame *wh; 82 83 KASSERT(ni != NULL, ("null node")); 84 ni->ni_inact = 0; 85 86 /* 87 * Yech, hack alert! We want to pass the node down to the 88 * driver's start routine. If we don't do so then the start 89 * routine must immediately look it up again and that can 90 * cause a lock order reversal if, for example, this frame 91 * is being sent because the station is being timedout and 92 * the frame being sent is a DEAUTH message. We could stick 93 * this in an m_tag and tack that on to the mbuf. However 94 * that's rather expensive to do for every frame so instead 95 * we stuff it in the rcvif field since outbound frames do 96 * not (presently) use this. 97 */ 98 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT); 99 if (m == NULL) 100 return ENOMEM; 101 KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null")); 102 m->m_pkthdr.rcvif = (void *)ni; 103 104 wh = mtod(m, struct ieee80211_frame *); 105 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type; 106 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 107 *(u_int16_t *)wh->i_dur = 0; 108 *(u_int16_t *)wh->i_seq = 109 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT); 110 ni->ni_txseq++; 111 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr); 112 IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr); 113 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid); 114 115 if (ifp->if_flags & IFF_DEBUG) { 116 /* avoid to print too many frames */ 117 if (ic->ic_opmode == IEEE80211_M_IBSS || 118#ifdef IEEE80211_DEBUG 119 ieee80211_debug > 1 || 120#endif 121 (type & IEEE80211_FC0_SUBTYPE_MASK) != 122 IEEE80211_FC0_SUBTYPE_PROBE_RESP) 123 if_printf(ifp, "sending %s to %s on channel %u\n", 124 ieee80211_mgt_subtype_name[ 125 (type & IEEE80211_FC0_SUBTYPE_MASK) 126 >> IEEE80211_FC0_SUBTYPE_SHIFT], 127 ether_sprintf(ni->ni_macaddr), 128 ieee80211_chan2ieee(ic, ni->ni_chan)); 129 } 130 131 IF_ENQUEUE(&ic->ic_mgtq, m); 132 ifp->if_timer = 1; 133 (*ifp->if_start)(ifp); 134 return 0; 135} 136 137/* 138 * Encapsulate an outbound data frame. The mbuf chain is updated and 139 * a reference to the destination node is returned. If an error is 140 * encountered NULL is returned and the node reference will also be NULL. 141 * 142 * NB: The caller is responsible for free'ing a returned node reference. 143 * The convention is ic_bss is not reference counted; the caller must 144 * maintain that. 145 */ 146struct mbuf * 147ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni) 148{ 149 struct ieee80211com *ic = (void *)ifp; 150 struct ether_header eh; 151 struct ieee80211_frame *wh; 152 struct ieee80211_node *ni = NULL; 153 struct llc *llc; 154 155 if (m->m_len < sizeof(struct ether_header)) { 156 m = m_pullup(m, sizeof(struct ether_header)); 157 if (m == NULL) { 158 ic->ic_stats.is_tx_nombuf++; 159 goto bad; 160 } 161 } 162 memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header)); 163 164 if (ic->ic_opmode != IEEE80211_M_STA) { 165 ni = ieee80211_find_node(ic, eh.ether_dhost); 166 if (ni == NULL) { 167 /* 168 * When not in station mode the destination 169 * address should always be in the node table 170 * if the device sends management frames to us; 171 * unless this is a multicast/broadcast frame. 172 * For devices that don't send management frames 173 * to the host we have to cheat; use the bss 174 * node instead; the card will/should clobber 175 * the bssid address as necessary. 176 * 177 * XXX this handles AHDEMO because all devices 178 * that support it don't send mgmt frames; 179 * but it might be better to test explicitly 180 */ 181 if (!IEEE80211_IS_MULTICAST(eh.ether_dhost) && 182 (ic->ic_caps & IEEE80211_C_RCVMGT)) { 183 IEEE80211_DPRINTF(("%s: no node for dst %s, " 184 "discard frame\n", __func__, 185 ether_sprintf(eh.ether_dhost))); 186 ic->ic_stats.is_tx_nonode++; 187 goto bad; 188 } 189 ni = ic->ic_bss; 190 } 191 } else 192 ni = ic->ic_bss; 193 ni->ni_inact = 0; 194 195 m_adj(m, sizeof(struct ether_header) - sizeof(struct llc)); 196 llc = mtod(m, struct llc *); 197 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP; 198 llc->llc_control = LLC_UI; 199 llc->llc_snap.org_code[0] = 0; 200 llc->llc_snap.org_code[1] = 0; 201 llc->llc_snap.org_code[2] = 0; 202 llc->llc_snap.ether_type = eh.ether_type; 203 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT); 204 if (m == NULL) { 205 ic->ic_stats.is_tx_nombuf++; 206 goto bad; 207 } 208 wh = mtod(m, struct ieee80211_frame *); 209 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA; 210 *(u_int16_t *)wh->i_dur = 0; 211 *(u_int16_t *)wh->i_seq = 212 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT); 213 ni->ni_txseq++; 214 switch (ic->ic_opmode) { 215 case IEEE80211_M_STA: 216 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS; 217 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid); 218 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost); 219 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost); 220 break; 221 case IEEE80211_M_IBSS: 222 case IEEE80211_M_AHDEMO: 223 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 224 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost); 225 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost); 226 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid); 227 break; 228 case IEEE80211_M_HOSTAP: 229 wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS; 230 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost); 231 IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid); 232 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost); 233 break; 234 case IEEE80211_M_MONITOR: 235 goto bad; 236 } 237 *pni = ni; 238 return m; 239bad: 240 if (m != NULL) 241 m_freem(m); 242 if (ni && ni != ic->ic_bss) 243 ieee80211_free_node(ic, ni); 244 *pni = NULL; 245 return NULL; 246} 247 248/* 249 * Add a supported rates element id to a frame. 250 */ 251u_int8_t * 252ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs) 253{ 254 int nrates; 255 256 *frm++ = IEEE80211_ELEMID_RATES; 257 nrates = rs->rs_nrates; 258 if (nrates > IEEE80211_RATE_SIZE) 259 nrates = IEEE80211_RATE_SIZE; 260 *frm++ = nrates; 261 memcpy(frm, rs->rs_rates, nrates); 262 return frm + nrates; 263} 264 265/* 266 * Add an extended supported rates element id to a frame. 267 */ 268u_int8_t * 269ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs) 270{ 271 /* 272 * Add an extended supported rates element if operating in 11g mode. 273 */ 274 if (rs->rs_nrates > IEEE80211_RATE_SIZE) { 275 int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE; 276 *frm++ = IEEE80211_ELEMID_XRATES; 277 *frm++ = nrates; 278 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates); 279 frm += nrates; 280 } 281 return frm; 282} 283 284/* 285 * Add an ssid elemet to a frame. 286 */ 287static u_int8_t * 288ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len) 289{ 290 *frm++ = IEEE80211_ELEMID_SSID; 291 *frm++ = len; 292 memcpy(frm, ssid, len); 293 return frm + len; 294} 295 296static struct mbuf * 297ieee80211_getmbuf(int flags, int type, u_int pktlen) 298{ 299 struct mbuf *m; 300 301 KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen)); 302 if (pktlen <= MHLEN) 303 MGETHDR(m, flags, type); 304 else 305 m = m_getcl(flags, type, M_PKTHDR); 306 return m; 307} 308 309/* 310 * Send a management frame. The node is for the destination (or ic_bss 311 * when in station mode). Nodes other than ic_bss have their reference 312 * count bumped to reflect our use for an indeterminant time. 313 */ 314int 315ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni, 316 int type, int arg) 317{ 318#define senderr(_x, _v) do { ic->ic_stats._v++; ret = _x; goto bad; } while (0) 319 struct ifnet *ifp = &ic->ic_if; 320 struct mbuf *m; 321 u_int8_t *frm; 322 enum ieee80211_phymode mode; 323 u_int16_t capinfo; 324 int ret, timer; 325 326 KASSERT(ni != NULL, ("null node")); 327 328 /* 329 * Hold a reference on the node so it doesn't go away until after 330 * the xmit is complete all the way in the driver. On error we 331 * will remove our reference. 332 */ 333 if (ni != ic->ic_bss) 334 ieee80211_ref_node(ni); 335 timer = 0; 336 switch (type) { 337 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 338 /* 339 * prreq frame format 340 * [tlv] ssid 341 * [tlv] supported rates 342 * [tlv] extended supported rates 343 */ 344 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 345 2 + ic->ic_des_esslen 346 + 2 + IEEE80211_RATE_SIZE 347 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 348 if (m == NULL) 349 senderr(ENOMEM, is_tx_nombuf); 350 m->m_data += sizeof(struct ieee80211_frame); 351 frm = mtod(m, u_int8_t *); 352 frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen); 353 mode = ieee80211_chan2mode(ic, ni->ni_chan); 354 frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]); 355 frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]); 356 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 357 358 timer = IEEE80211_TRANS_WAIT; 359 break; 360 361 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 362 /* 363 * probe response frame format 364 * [8] time stamp 365 * [2] beacon interval 366 * [2] cabability information 367 * [tlv] ssid 368 * [tlv] supported rates 369 * [tlv] parameter set (FH/DS) 370 * [tlv] parameter set (IBSS) 371 * [tlv] extended supported rates 372 */ 373 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 374 8 + 2 + 2 + 2 375 + 2 + ni->ni_esslen 376 + 2 + IEEE80211_RATE_SIZE 377 + (ic->ic_phytype == IEEE80211_T_FH ? 7 : 3) 378 + 6 379 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 380 if (m == NULL) 381 senderr(ENOMEM, is_tx_nombuf); 382 m->m_data += sizeof(struct ieee80211_frame); 383 frm = mtod(m, u_int8_t *); 384 385 memset(frm, 0, 8); /* timestamp should be filled later */ 386 frm += 8; 387 *(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval); 388 frm += 2; 389 if (ic->ic_opmode == IEEE80211_M_IBSS) 390 capinfo = IEEE80211_CAPINFO_IBSS; 391 else 392 capinfo = IEEE80211_CAPINFO_ESS; 393 if (ic->ic_flags & IEEE80211_F_WEPON) 394 capinfo |= IEEE80211_CAPINFO_PRIVACY; 395 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 396 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 397 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 398 *(u_int16_t *)frm = htole16(capinfo); 399 frm += 2; 400 401 frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid, 402 ic->ic_bss->ni_esslen); 403 frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates); 404 405 if (ic->ic_phytype == IEEE80211_T_FH) { 406 *frm++ = IEEE80211_ELEMID_FHPARMS; 407 *frm++ = 5; 408 *frm++ = ni->ni_fhdwell & 0x00ff; 409 *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff; 410 *frm++ = IEEE80211_FH_CHANSET( 411 ieee80211_chan2ieee(ic, ni->ni_chan)); 412 *frm++ = IEEE80211_FH_CHANPAT( 413 ieee80211_chan2ieee(ic, ni->ni_chan)); 414 *frm++ = ni->ni_fhindex; 415 } else { 416 *frm++ = IEEE80211_ELEMID_DSPARMS; 417 *frm++ = 1; 418 *frm++ = ieee80211_chan2ieee(ic, ni->ni_chan); 419 } 420 421 if (ic->ic_opmode == IEEE80211_M_IBSS) { 422 *frm++ = IEEE80211_ELEMID_IBSSPARMS; 423 *frm++ = 2; 424 *frm++ = 0; *frm++ = 0; /* TODO: ATIM window */ 425 } else { /* IEEE80211_M_HOSTAP */ 426 /* TODO: TIM */ 427 *frm++ = IEEE80211_ELEMID_TIM; 428 *frm++ = 4; /* length */ 429 *frm++ = 0; /* DTIM count */ 430 *frm++ = 1; /* DTIM period */ 431 *frm++ = 0; /* bitmap control */ 432 *frm++ = 0; /* Partial Virtual Bitmap (variable length) */ 433 } 434 frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates); 435 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 436 break; 437 438 case IEEE80211_FC0_SUBTYPE_AUTH: 439 MGETHDR(m, M_DONTWAIT, MT_DATA); 440 if (m == NULL) 441 senderr(ENOMEM, is_tx_nombuf); 442 MH_ALIGN(m, 2 * 3); 443 m->m_pkthdr.len = m->m_len = 6; 444 frm = mtod(m, u_int8_t *); 445 /* TODO: shared key auth */ 446 ((u_int16_t *)frm)[0] = htole16(IEEE80211_AUTH_ALG_OPEN); 447 ((u_int16_t *)frm)[1] = htole16(arg); /* sequence number */ 448 ((u_int16_t *)frm)[2] = 0; /* status */ 449 if (ic->ic_opmode == IEEE80211_M_STA) 450 timer = IEEE80211_TRANS_WAIT; 451 break; 452 453 case IEEE80211_FC0_SUBTYPE_DEAUTH: 454 if (ifp->if_flags & IFF_DEBUG) 455 if_printf(ifp, "station %s deauthenticate (reason %d)\n", 456 ether_sprintf(ni->ni_macaddr), arg); 457 MGETHDR(m, M_DONTWAIT, MT_DATA); 458 if (m == NULL) 459 senderr(ENOMEM, is_tx_nombuf); 460 MH_ALIGN(m, 2); 461 m->m_pkthdr.len = m->m_len = 2; 462 *mtod(m, u_int16_t *) = htole16(arg); /* reason */ 463 break; 464 465 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 466 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: 467 /* 468 * asreq frame format 469 * [2] capability information 470 * [2] listen interval 471 * [6*] current AP address (reassoc only) 472 * [tlv] ssid 473 * [tlv] supported rates 474 * [tlv] extended supported rates 475 */ 476 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 477 sizeof(capinfo) 478 + sizeof(u_int16_t) 479 + IEEE80211_ADDR_LEN 480 + 2 + ni->ni_esslen 481 + 2 + IEEE80211_RATE_SIZE 482 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 483 if (m == NULL) 484 senderr(ENOMEM, is_tx_nombuf); 485 m->m_data += sizeof(struct ieee80211_frame); 486 frm = mtod(m, u_int8_t *); 487 488 capinfo = 0; 489 if (ic->ic_opmode == IEEE80211_M_IBSS) 490 capinfo |= IEEE80211_CAPINFO_IBSS; 491 else /* IEEE80211_M_STA */ 492 capinfo |= IEEE80211_CAPINFO_ESS; 493 if (ic->ic_flags & IEEE80211_F_WEPON) 494 capinfo |= IEEE80211_CAPINFO_PRIVACY; 495 /* 496 * NB: Some 11a AP's reject the request when 497 * short premable is set. 498 */ 499 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 500 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 501 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 502 if (ic->ic_flags & IEEE80211_F_SHSLOT) 503 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME; 504 *(u_int16_t *)frm = htole16(capinfo); 505 frm += 2; 506 507 *(u_int16_t *)frm = htole16(ic->ic_lintval); 508 frm += 2; 509 510 if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 511 IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid); 512 frm += IEEE80211_ADDR_LEN; 513 } 514 515 frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen); 516 frm = ieee80211_add_rates(frm, &ni->ni_rates); 517 frm = ieee80211_add_xrates(frm, &ni->ni_rates); 518 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 519 520 timer = IEEE80211_TRANS_WAIT; 521 break; 522 523 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 524 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: 525 /* 526 * asreq frame format 527 * [2] capability information 528 * [2] status 529 * [2] association ID 530 * [tlv] supported rates 531 * [tlv] extended supported rates 532 */ 533 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 534 sizeof(capinfo) 535 + sizeof(u_int16_t) 536 + sizeof(u_int16_t) 537 + 2 + IEEE80211_RATE_SIZE 538 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 539 if (m == NULL) 540 senderr(ENOMEM, is_tx_nombuf); 541 m->m_data += sizeof(struct ieee80211_frame); 542 frm = mtod(m, u_int8_t *); 543 544 capinfo = IEEE80211_CAPINFO_ESS; 545 if (ic->ic_flags & IEEE80211_F_WEPON) 546 capinfo |= IEEE80211_CAPINFO_PRIVACY; 547 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 548 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 549 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 550 *(u_int16_t *)frm = htole16(capinfo); 551 frm += 2; 552 553 *(u_int16_t *)frm = htole16(arg); /* status */ 554 frm += 2; 555 556 if (arg == IEEE80211_STATUS_SUCCESS) 557 *(u_int16_t *)frm = htole16(ni->ni_associd); 558 frm += 2; 559 560 frm = ieee80211_add_rates(frm, &ni->ni_rates); 561 frm = ieee80211_add_xrates(frm, &ni->ni_rates); 562 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 563 break; 564 565 case IEEE80211_FC0_SUBTYPE_DISASSOC: 566 if (ifp->if_flags & IFF_DEBUG) 567 if_printf(ifp, "station %s disassociate (reason %d)\n", 568 ether_sprintf(ni->ni_macaddr), arg); 569 MGETHDR(m, M_DONTWAIT, MT_DATA); 570 if (m == NULL) 571 senderr(ENOMEM, is_tx_nombuf); 572 MH_ALIGN(m, 2); 573 m->m_pkthdr.len = m->m_len = 2; 574 *mtod(m, u_int16_t *) = htole16(arg); /* reason */ 575 break; 576 577 default: 578 IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n", 579 __func__, type)); 580 senderr(EINVAL, is_tx_unknownmgt); 581 /* NOTREACHED */ 582 } 583 584 ret = ieee80211_mgmt_output(ifp, ni, m, type); 585 if (ret == 0) { 586 if (timer) 587 ic->ic_mgt_timer = timer; 588 } else { 589bad: 590 if (ni != ic->ic_bss) /* remove ref we added */ 591 ieee80211_free_node(ic, ni); 592 } 593 return ret; 594#undef senderr 595} 596