ieee80211_output.c revision 132712
156893Sfenner/*- 256893Sfenner * Copyright (c) 2001 Atsushi Onoe 356893Sfenner * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting 456893Sfenner * All rights reserved. 556893Sfenner * 656893Sfenner * Redistribution and use in source and binary forms, with or without 756893Sfenner * modification, are permitted provided that the following conditions 856893Sfenner * are met: 956893Sfenner * 1. Redistributions of source code must retain the above copyright 1056893Sfenner * notice, this list of conditions and the following disclaimer. 1156893Sfenner * 2. Redistributions in binary form must reproduce the above copyright 1256893Sfenner * notice, this list of conditions and the following disclaimer in the 1356893Sfenner * documentation and/or other materials provided with the distribution. 1456893Sfenner * 3. The name of the author may not be used to endorse or promote products 1556893Sfenner * derived from this software without specific prior written permission. 1656893Sfenner * 1756893Sfenner * Alternatively, this software may be distributed under the terms of the 1856893Sfenner * GNU General Public License ("GPL") version 2 as published by the Free 1956893Sfenner * Software Foundation. 2056893Sfenner * 2156893Sfenner * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 2256893Sfenner * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 2356893Sfenner * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 2456893Sfenner * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 2556893Sfenner * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 2656893Sfenner * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 2756893Sfenner * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 2856893Sfenner * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 2956893Sfenner * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 3056893Sfenner * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 3156893Sfenner */ 3256893Sfenner 3356893Sfenner#include <sys/cdefs.h> 3456893Sfenner__FBSDID("$FreeBSD: head/sys/net80211/ieee80211_output.c 132712 2004-07-27 23:20:45Z rwatson $"); 3556893Sfenner 3656893Sfenner#include "opt_inet.h" 3756893Sfenner 3856893Sfenner#include <sys/param.h> 3956893Sfenner#include <sys/systm.h> 4056893Sfenner#include <sys/mbuf.h> 4156893Sfenner#include <sys/malloc.h> 4256893Sfenner#include <sys/kernel.h> 4356893Sfenner#include <sys/socket.h> 44127668Sbms#include <sys/sockio.h> 45190207Srpaulo#include <sys/endian.h> 4656893Sfenner#include <sys/errno.h> 47127668Sbms#include <sys/bus.h> 4856893Sfenner#include <sys/proc.h> 4956893Sfenner#include <sys/sysctl.h> 5056893Sfenner 5156893Sfenner#include <machine/atomic.h> 52127668Sbms 5356893Sfenner#include <net/if.h> 5456893Sfenner#include <net/if_dl.h> 5556893Sfenner#include <net/if_media.h> 5656893Sfenner#include <net/if_arp.h> 5756893Sfenner#include <net/ethernet.h> 58127668Sbms#include <net/if_llc.h> 5956893Sfenner 60162017Ssam#include <net80211/ieee80211_var.h> 6156893Sfenner 62162017Ssam#include <net/bpf.h> 63162017Ssam 64162017Ssam#ifdef INET 65162017Ssam#include <netinet/in.h> 66162017Ssam#include <netinet/if_ether.h> 67162017Ssam#endif 68162017Ssam 69162017Ssam/* 70162017Ssam * Send a management frame to the specified node. The node pointer 71162017Ssam * must have a reference as the pointer will be passed to the driver 72162017Ssam * and potentially held for a long time. If the frame is successfully 73162017Ssam * dispatched to the driver, then it is responsible for freeing the 74162017Ssam * reference (and potentially free'ing up any associated storage). 75162017Ssam */ 76162017Ssamstatic int 77162017Ssamieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni, 78162017Ssam struct mbuf *m, int type) 79162017Ssam{ 8056893Sfenner struct ieee80211com *ic = (void *)ifp; 8156893Sfenner struct ieee80211_frame *wh; 8256893Sfenner 8356893Sfenner KASSERT(ni != NULL, ("null node")); 84127668Sbms ni->ni_inact = 0; 8556893Sfenner 8656893Sfenner /* 8756893Sfenner * Yech, hack alert! We want to pass the node down to the 8856893Sfenner * driver's start routine. If we don't do so then the start 8956893Sfenner * routine must immediately look it up again and that can 9056893Sfenner * cause a lock order reversal if, for example, this frame 9156893Sfenner * is being sent because the station is being timedout and 92162017Ssam * the frame being sent is a DEAUTH message. We could stick 93162017Ssam * this in an m_tag and tack that on to the mbuf. However 94162017Ssam * that's rather expensive to do for every frame so instead 95162017Ssam * we stuff it in the rcvif field since outbound frames do 96162017Ssam * not (presently) use this. 97162017Ssam */ 98162017Ssam M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT); 99127668Sbms if (m == NULL) 100162017Ssam return ENOMEM; 101162017Ssam KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null")); 102162017Ssam m->m_pkthdr.rcvif = (void *)ni; 103127668Sbms 104127668Sbms wh = mtod(m, struct ieee80211_frame *); 105127668Sbms wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type; 10656893Sfenner wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 10756893Sfenner *(u_int16_t *)wh->i_dur = 0; 10856893Sfenner *(u_int16_t *)wh->i_seq = 109162017Ssam htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT); 110162017Ssam ni->ni_txseq++; 111162017Ssam IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr); 112162017Ssam IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr); 11356893Sfenner IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid); 11456893Sfenner 11556893Sfenner if (ifp->if_flags & IFF_DEBUG) { 11656893Sfenner /* avoid to print too many frames */ 117162017Ssam if (ic->ic_opmode == IEEE80211_M_IBSS || 118162017Ssam#ifdef IEEE80211_DEBUG 119162017Ssam ieee80211_debug > 1 || 12056893Sfenner#endif 12156893Sfenner (type & IEEE80211_FC0_SUBTYPE_MASK) != 12256893Sfenner IEEE80211_FC0_SUBTYPE_PROBE_RESP) 12356893Sfenner if_printf(ifp, "sending %s to %s on channel %u\n", 124162017Ssam ieee80211_mgt_subtype_name[ 125162017Ssam (type & IEEE80211_FC0_SUBTYPE_MASK) 12656893Sfenner >> IEEE80211_FC0_SUBTYPE_SHIFT], 127162017Ssam ether_sprintf(ni->ni_macaddr), 12856893Sfenner ieee80211_chan2ieee(ic, ni->ni_chan)); 129127668Sbms } 13056893Sfenner 13156893Sfenner IF_ENQUEUE(&ic->ic_mgtq, m); 13256893Sfenner ifp->if_timer = 1; 13356893Sfenner if_start(ifp); 134146773Ssam return 0; 13556893Sfenner} 13656893Sfenner 13756893Sfenner/* 13856893Sfenner * Encapsulate an outbound data frame. The mbuf chain is updated and 13956893Sfenner * a reference to the destination node is returned. If an error is 14056893Sfenner * encountered NULL is returned and the node reference will also be NULL. 14156893Sfenner * 14256893Sfenner * NB: The caller is responsible for free'ing a returned node reference. 14356893Sfenner * The convention is ic_bss is not reference counted; the caller must 144127668Sbms * maintain that. 14556893Sfenner */ 14656893Sfennerstruct mbuf * 14756893Sfennerieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni) 14856893Sfenner{ 14956893Sfenner struct ieee80211com *ic = (void *)ifp; 15056893Sfenner struct ether_header eh; 15156893Sfenner struct ieee80211_frame *wh; 152127668Sbms struct ieee80211_node *ni = NULL; 15356893Sfenner struct llc *llc; 15456893Sfenner 15556893Sfenner if (m->m_len < sizeof(struct ether_header)) { 15656893Sfenner m = m_pullup(m, sizeof(struct ether_header)); 15756893Sfenner if (m == NULL) { 15856893Sfenner ic->ic_stats.is_tx_nombuf++; 15956893Sfenner goto bad; 16056893Sfenner } 161146773Ssam } 16256893Sfenner memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header)); 163127668Sbms 16456893Sfenner ni = ieee80211_find_txnode(ic, eh.ether_dhost); 16556893Sfenner if (ni == NULL) { 16656893Sfenner IEEE80211_DPRINTF(("%s: no node for dst %s, discard frame\n", 16756893Sfenner __func__, ether_sprintf(eh.ether_dhost))); 16856893Sfenner ic->ic_stats.is_tx_nonode++; 16956893Sfenner goto bad; 170162017Ssam } 17156893Sfenner ni->ni_inact = 0; 172162017Ssam 173162017Ssam m_adj(m, sizeof(struct ether_header) - sizeof(struct llc)); 17456893Sfenner llc = mtod(m, struct llc *); 17556893Sfenner llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP; 17656893Sfenner llc->llc_control = LLC_UI; 177162017Ssam llc->llc_snap.org_code[0] = 0; 17856893Sfenner llc->llc_snap.org_code[1] = 0; 179162017Ssam llc->llc_snap.org_code[2] = 0; 180162017Ssam llc->llc_snap.ether_type = eh.ether_type; 18156893Sfenner M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT); 18256893Sfenner if (m == NULL) { 18356893Sfenner ic->ic_stats.is_tx_nombuf++; 184 goto bad; 185 } 186 wh = mtod(m, struct ieee80211_frame *); 187 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA; 188 *(u_int16_t *)wh->i_dur = 0; 189 *(u_int16_t *)wh->i_seq = 190 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT); 191 ni->ni_txseq++; 192 switch (ic->ic_opmode) { 193 case IEEE80211_M_STA: 194 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS; 195 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid); 196 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost); 197 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost); 198 break; 199 case IEEE80211_M_IBSS: 200 case IEEE80211_M_AHDEMO: 201 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 202 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost); 203 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost); 204 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid); 205 break; 206 case IEEE80211_M_HOSTAP: 207 wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS; 208 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost); 209 IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid); 210 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost); 211 break; 212 case IEEE80211_M_MONITOR: 213 goto bad; 214 } 215 *pni = ni; 216 return m; 217bad: 218 if (m != NULL) 219 m_freem(m); 220 if (ni && ni != ic->ic_bss) 221 ieee80211_free_node(ic, ni); 222 *pni = NULL; 223 return NULL; 224} 225 226/* 227 * Add a supported rates element id to a frame. 228 */ 229u_int8_t * 230ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs) 231{ 232 int nrates; 233 234 *frm++ = IEEE80211_ELEMID_RATES; 235 nrates = rs->rs_nrates; 236 if (nrates > IEEE80211_RATE_SIZE) 237 nrates = IEEE80211_RATE_SIZE; 238 *frm++ = nrates; 239 memcpy(frm, rs->rs_rates, nrates); 240 return frm + nrates; 241} 242 243/* 244 * Add an extended supported rates element id to a frame. 245 */ 246u_int8_t * 247ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs) 248{ 249 /* 250 * Add an extended supported rates element if operating in 11g mode. 251 */ 252 if (rs->rs_nrates > IEEE80211_RATE_SIZE) { 253 int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE; 254 *frm++ = IEEE80211_ELEMID_XRATES; 255 *frm++ = nrates; 256 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates); 257 frm += nrates; 258 } 259 return frm; 260} 261 262/* 263 * Add an ssid elemet to a frame. 264 */ 265static u_int8_t * 266ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len) 267{ 268 *frm++ = IEEE80211_ELEMID_SSID; 269 *frm++ = len; 270 memcpy(frm, ssid, len); 271 return frm + len; 272} 273 274static struct mbuf * 275ieee80211_getmbuf(int flags, int type, u_int pktlen) 276{ 277 struct mbuf *m; 278 279 KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen)); 280 if (pktlen <= MHLEN) 281 MGETHDR(m, flags, type); 282 else 283 m = m_getcl(flags, type, M_PKTHDR); 284 return m; 285} 286 287/* 288 * Send a management frame. The node is for the destination (or ic_bss 289 * when in station mode). Nodes other than ic_bss have their reference 290 * count bumped to reflect our use for an indeterminant time. 291 */ 292int 293ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni, 294 int type, int arg) 295{ 296#define senderr(_x, _v) do { ic->ic_stats._v++; ret = _x; goto bad; } while (0) 297 struct ifnet *ifp = &ic->ic_if; 298 struct mbuf *m; 299 u_int8_t *frm; 300 enum ieee80211_phymode mode; 301 u_int16_t capinfo; 302 int ret, timer; 303 304 KASSERT(ni != NULL, ("null node")); 305 306 /* 307 * Hold a reference on the node so it doesn't go away until after 308 * the xmit is complete all the way in the driver. On error we 309 * will remove our reference. 310 */ 311 if (ni != ic->ic_bss) 312 ieee80211_ref_node(ni); 313 timer = 0; 314 switch (type) { 315 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 316 /* 317 * prreq frame format 318 * [tlv] ssid 319 * [tlv] supported rates 320 * [tlv] extended supported rates 321 */ 322 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 323 2 + ic->ic_des_esslen 324 + 2 + IEEE80211_RATE_SIZE 325 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 326 if (m == NULL) 327 senderr(ENOMEM, is_tx_nombuf); 328 m->m_data += sizeof(struct ieee80211_frame); 329 frm = mtod(m, u_int8_t *); 330 frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen); 331 mode = ieee80211_chan2mode(ic, ni->ni_chan); 332 frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]); 333 frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]); 334 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 335 336 timer = IEEE80211_TRANS_WAIT; 337 break; 338 339 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 340 /* 341 * probe response frame format 342 * [8] time stamp 343 * [2] beacon interval 344 * [2] cabability information 345 * [tlv] ssid 346 * [tlv] supported rates 347 * [tlv] parameter set (FH/DS) 348 * [tlv] parameter set (IBSS) 349 * [tlv] extended supported rates 350 */ 351 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 352 8 + 2 + 2 + 2 353 + 2 + ni->ni_esslen 354 + 2 + IEEE80211_RATE_SIZE 355 + (ic->ic_phytype == IEEE80211_T_FH ? 7 : 3) 356 + 6 357 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 358 if (m == NULL) 359 senderr(ENOMEM, is_tx_nombuf); 360 m->m_data += sizeof(struct ieee80211_frame); 361 frm = mtod(m, u_int8_t *); 362 363 memset(frm, 0, 8); /* timestamp should be filled later */ 364 frm += 8; 365 *(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval); 366 frm += 2; 367 if (ic->ic_opmode == IEEE80211_M_IBSS) 368 capinfo = IEEE80211_CAPINFO_IBSS; 369 else 370 capinfo = IEEE80211_CAPINFO_ESS; 371 if (ic->ic_flags & IEEE80211_F_WEPON) 372 capinfo |= IEEE80211_CAPINFO_PRIVACY; 373 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 374 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 375 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 376 *(u_int16_t *)frm = htole16(capinfo); 377 frm += 2; 378 379 frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid, 380 ic->ic_bss->ni_esslen); 381 frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates); 382 383 if (ic->ic_phytype == IEEE80211_T_FH) { 384 *frm++ = IEEE80211_ELEMID_FHPARMS; 385 *frm++ = 5; 386 *frm++ = ni->ni_fhdwell & 0x00ff; 387 *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff; 388 *frm++ = IEEE80211_FH_CHANSET( 389 ieee80211_chan2ieee(ic, ni->ni_chan)); 390 *frm++ = IEEE80211_FH_CHANPAT( 391 ieee80211_chan2ieee(ic, ni->ni_chan)); 392 *frm++ = ni->ni_fhindex; 393 } else { 394 *frm++ = IEEE80211_ELEMID_DSPARMS; 395 *frm++ = 1; 396 *frm++ = ieee80211_chan2ieee(ic, ni->ni_chan); 397 } 398 399 if (ic->ic_opmode == IEEE80211_M_IBSS) { 400 *frm++ = IEEE80211_ELEMID_IBSSPARMS; 401 *frm++ = 2; 402 *frm++ = 0; *frm++ = 0; /* TODO: ATIM window */ 403 } else { /* IEEE80211_M_HOSTAP */ 404 /* TODO: TIM */ 405 *frm++ = IEEE80211_ELEMID_TIM; 406 *frm++ = 4; /* length */ 407 *frm++ = 0; /* DTIM count */ 408 *frm++ = 1; /* DTIM period */ 409 *frm++ = 0; /* bitmap control */ 410 *frm++ = 0; /* Partial Virtual Bitmap (variable length) */ 411 } 412 frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates); 413 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 414 break; 415 416 case IEEE80211_FC0_SUBTYPE_AUTH: 417 MGETHDR(m, M_DONTWAIT, MT_DATA); 418 if (m == NULL) 419 senderr(ENOMEM, is_tx_nombuf); 420 MH_ALIGN(m, 2 * 3); 421 m->m_pkthdr.len = m->m_len = 6; 422 frm = mtod(m, u_int8_t *); 423 /* TODO: shared key auth */ 424 ((u_int16_t *)frm)[0] = htole16(IEEE80211_AUTH_ALG_OPEN); 425 ((u_int16_t *)frm)[1] = htole16(arg); /* sequence number */ 426 ((u_int16_t *)frm)[2] = 0; /* status */ 427 if (ic->ic_opmode == IEEE80211_M_STA) 428 timer = IEEE80211_TRANS_WAIT; 429 break; 430 431 case IEEE80211_FC0_SUBTYPE_DEAUTH: 432 if (ifp->if_flags & IFF_DEBUG) 433 if_printf(ifp, "station %s deauthenticate (reason %d)\n", 434 ether_sprintf(ni->ni_macaddr), arg); 435 MGETHDR(m, M_DONTWAIT, MT_DATA); 436 if (m == NULL) 437 senderr(ENOMEM, is_tx_nombuf); 438 MH_ALIGN(m, 2); 439 m->m_pkthdr.len = m->m_len = 2; 440 *mtod(m, u_int16_t *) = htole16(arg); /* reason */ 441 break; 442 443 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 444 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: 445 /* 446 * asreq frame format 447 * [2] capability information 448 * [2] listen interval 449 * [6*] current AP address (reassoc only) 450 * [tlv] ssid 451 * [tlv] supported rates 452 * [tlv] extended supported rates 453 */ 454 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 455 sizeof(capinfo) 456 + sizeof(u_int16_t) 457 + IEEE80211_ADDR_LEN 458 + 2 + ni->ni_esslen 459 + 2 + IEEE80211_RATE_SIZE 460 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 461 if (m == NULL) 462 senderr(ENOMEM, is_tx_nombuf); 463 m->m_data += sizeof(struct ieee80211_frame); 464 frm = mtod(m, u_int8_t *); 465 466 capinfo = 0; 467 if (ic->ic_opmode == IEEE80211_M_IBSS) 468 capinfo |= IEEE80211_CAPINFO_IBSS; 469 else /* IEEE80211_M_STA */ 470 capinfo |= IEEE80211_CAPINFO_ESS; 471 if (ic->ic_flags & IEEE80211_F_WEPON) 472 capinfo |= IEEE80211_CAPINFO_PRIVACY; 473 /* 474 * NB: Some 11a AP's reject the request when 475 * short premable is set. 476 */ 477 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 478 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 479 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 480 if (ic->ic_flags & IEEE80211_F_SHSLOT) 481 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME; 482 *(u_int16_t *)frm = htole16(capinfo); 483 frm += 2; 484 485 *(u_int16_t *)frm = htole16(ic->ic_lintval); 486 frm += 2; 487 488 if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 489 IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid); 490 frm += IEEE80211_ADDR_LEN; 491 } 492 493 frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen); 494 frm = ieee80211_add_rates(frm, &ni->ni_rates); 495 frm = ieee80211_add_xrates(frm, &ni->ni_rates); 496 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 497 498 timer = IEEE80211_TRANS_WAIT; 499 break; 500 501 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 502 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: 503 /* 504 * asreq frame format 505 * [2] capability information 506 * [2] status 507 * [2] association ID 508 * [tlv] supported rates 509 * [tlv] extended supported rates 510 */ 511 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 512 sizeof(capinfo) 513 + sizeof(u_int16_t) 514 + sizeof(u_int16_t) 515 + 2 + IEEE80211_RATE_SIZE 516 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 517 if (m == NULL) 518 senderr(ENOMEM, is_tx_nombuf); 519 m->m_data += sizeof(struct ieee80211_frame); 520 frm = mtod(m, u_int8_t *); 521 522 capinfo = IEEE80211_CAPINFO_ESS; 523 if (ic->ic_flags & IEEE80211_F_WEPON) 524 capinfo |= IEEE80211_CAPINFO_PRIVACY; 525 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 526 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 527 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 528 *(u_int16_t *)frm = htole16(capinfo); 529 frm += 2; 530 531 *(u_int16_t *)frm = htole16(arg); /* status */ 532 frm += 2; 533 534 if (arg == IEEE80211_STATUS_SUCCESS) 535 *(u_int16_t *)frm = htole16(ni->ni_associd); 536 frm += 2; 537 538 frm = ieee80211_add_rates(frm, &ni->ni_rates); 539 frm = ieee80211_add_xrates(frm, &ni->ni_rates); 540 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 541 break; 542 543 case IEEE80211_FC0_SUBTYPE_DISASSOC: 544 if (ifp->if_flags & IFF_DEBUG) 545 if_printf(ifp, "station %s disassociate (reason %d)\n", 546 ether_sprintf(ni->ni_macaddr), arg); 547 MGETHDR(m, M_DONTWAIT, MT_DATA); 548 if (m == NULL) 549 senderr(ENOMEM, is_tx_nombuf); 550 MH_ALIGN(m, 2); 551 m->m_pkthdr.len = m->m_len = 2; 552 *mtod(m, u_int16_t *) = htole16(arg); /* reason */ 553 break; 554 555 default: 556 IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n", 557 __func__, type)); 558 senderr(EINVAL, is_tx_unknownmgt); 559 /* NOTREACHED */ 560 } 561 562 ret = ieee80211_mgmt_output(ifp, ni, m, type); 563 if (ret == 0) { 564 if (timer) 565 ic->ic_mgt_timer = timer; 566 } else { 567bad: 568 if (ni != ic->ic_bss) /* remove ref we added */ 569 ieee80211_free_node(ic, ni); 570 } 571 return ret; 572#undef senderr 573} 574