xref: /dflybsd-src/sys/netproto/802_11/wlan/ieee80211_input.c (revision 744c01d0dc2aa1481a40e5b0988d15691602f5c9)
1 /*
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.62.2.14 2006/09/02 15:16:12 sam Exp $
33  * $DragonFly: src/sys/netproto/802_11/wlan/ieee80211_input.c,v 1.14 2007/01/01 08:51:45 sephe Exp $
34  */
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/mbuf.h>
39 #include <sys/malloc.h>
40 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 #include <sys/serialize.h>
43 
44 #include <sys/socket.h>
45 
46 #include <net/if.h>
47 #include <net/if_arp.h>
48 #include <net/ifq_var.h>
49 #include <net/if_media.h>
50 #include <net/ethernet.h>
51 #include <net/if_llc.h>
52 #include <net/vlan/if_vlan_var.h>
53 
54 #include <netproto/802_11/ieee80211_var.h>
55 
56 #include <net/bpf.h>
57 
58 #ifdef IEEE80211_DEBUG
59 #include <machine/stdarg.h>
60 
61 /*
62  * Decide if a received management frame should be
63  * printed when debugging is enabled.  This filters some
64  * of the less interesting frames that come frequently
65  * (e.g. beacons).
66  */
67 static __inline int
68 doprint(struct ieee80211com *ic, int subtype)
69 {
70 	switch (subtype) {
71 	case IEEE80211_FC0_SUBTYPE_BEACON:
72 		return (ic->ic_flags & IEEE80211_F_SCAN);
73 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
74 		return (ic->ic_opmode == IEEE80211_M_IBSS);
75 	}
76 	return 1;
77 }
78 
79 /*
80  * Emit a debug message about discarding a frame or information
81  * element.  One format is for extracting the mac address from
82  * the frame header; the other is for when a header is not
83  * available or otherwise appropriate.
84  */
85 #define	IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do {		\
86 	if ((_ic)->ic_debug & (_m))					\
87 		ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\
88 } while (0)
89 #define	IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do {	\
90 	if ((_ic)->ic_debug & (_m))					\
91 		ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\
92 } while (0)
93 #define	IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do {	\
94 	if ((_ic)->ic_debug & (_m))					\
95 		ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\
96 } while (0)
97 
98 static const uint8_t *ieee80211_getbssid(struct ieee80211com *,
99 	const struct ieee80211_frame *);
100 static void ieee80211_discard_frame(struct ieee80211com *,
101 	const struct ieee80211_frame *, const char *type, const char *fmt, ...);
102 static void ieee80211_discard_ie(struct ieee80211com *,
103 	const struct ieee80211_frame *, const char *type, const char *fmt, ...);
104 static void ieee80211_discard_mac(struct ieee80211com *,
105 	const uint8_t mac[IEEE80211_ADDR_LEN], const char *type,
106 	const char *fmt, ...);
107 #else
108 #define	IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...)
109 #define	IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...)
110 #define	IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...)
111 #endif /* IEEE80211_DEBUG */
112 
113 static struct mbuf *ieee80211_defrag(struct ieee80211com *,
114 	struct ieee80211_node *, struct mbuf *, int);
115 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int);
116 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *,
117 		const uint8_t *mac, int subtype, int arg);
118 static void ieee80211_deliver_data(struct ieee80211com *,
119 	struct ieee80211_node *, struct mbuf *);
120 static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable);
121 static void ieee80211_recv_pspoll(struct ieee80211com *,
122 	struct ieee80211_node *, struct mbuf *);
123 
124 /*
125  * Process a received frame.  The node associated with the sender
126  * should be supplied.  If nothing was found in the node table then
127  * the caller is assumed to supply a reference to ic_bss instead.
128  * The RSSI and a timestamp are also supplied.  The RSSI data is used
129  * during AP scanning to select a AP to associate with; it can have
130  * any units so long as values have consistent units and higher values
131  * mean ``better signal''.  The receive timestamp is currently not used
132  * by the 802.11 layer.
133  */
134 int
135 ieee80211_input(struct ieee80211com *ic, struct mbuf *m,
136 	struct ieee80211_node *ni, int rssi, uint32_t rstamp)
137 {
138 #define	SEQ_LEQ(a,b)	((int)((a)-(b)) <= 0)
139 #define	HAS_SEQ(type)	((type & 0x4) == 0)
140 	struct ifnet *ifp = ic->ic_ifp;
141 	struct ieee80211_frame *wh;
142 	struct ieee80211_key *key;
143 	struct ether_header *eh;
144 	int hdrspace;
145 	uint8_t dir, type, subtype;
146 	uint8_t *bssid;
147 	uint16_t rxseq;
148 
149 	ASSERT_SERIALIZED(ifp->if_serializer);
150 
151 	KASSERT(ni != NULL, ("null node"));
152 	ni->ni_inact = ni->ni_inact_reload;
153 
154 	type = -1;			/* undefined */
155 	/*
156 	 * In monitor mode, send everything directly to bpf.
157 	 * XXX may want to include the CRC
158 	 */
159 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
160 		goto out;
161 
162 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
163 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
164 		    ni->ni_macaddr, NULL,
165 		    "too short (1): len %u", m->m_pkthdr.len);
166 		ic->ic_stats.is_rx_tooshort++;
167 		goto out;
168 	}
169 	/*
170 	 * Bit of a cheat here, we use a pointer for a 3-address
171 	 * frame format but don't reference fields past outside
172 	 * ieee80211_frame_min w/o first validating the data is
173 	 * present.
174 	 */
175 	wh = mtod(m, struct ieee80211_frame *);
176 
177 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
178 	    IEEE80211_FC0_VERSION_0) {
179 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
180 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
181 		ic->ic_stats.is_rx_badversion++;
182 		goto err;
183 	}
184 
185 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
186 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
187 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
188 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
189 		switch (ic->ic_opmode) {
190 		case IEEE80211_M_STA:
191 			bssid = wh->i_addr2;
192 			if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
193 				/* not interested in */
194 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
195 				    bssid, NULL, "%s", "not to bss");
196 				ic->ic_stats.is_rx_wrongbss++;
197 				goto out;
198 			}
199 			break;
200 		case IEEE80211_M_IBSS:
201 		case IEEE80211_M_AHDEMO:
202 		case IEEE80211_M_HOSTAP:
203 			if (dir != IEEE80211_FC1_DIR_NODS)
204 				bssid = wh->i_addr1;
205 			else if (type == IEEE80211_FC0_TYPE_CTL)
206 				bssid = wh->i_addr1;
207 			else {
208 				if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
209 					IEEE80211_DISCARD_MAC(ic,
210 					    IEEE80211_MSG_ANY, ni->ni_macaddr,
211 					    NULL, "too short (2): len %u",
212 					    m->m_pkthdr.len);
213 					ic->ic_stats.is_rx_tooshort++;
214 					goto out;
215 				}
216 				bssid = wh->i_addr3;
217 			}
218 			if (type != IEEE80211_FC0_TYPE_DATA)
219 				break;
220 			/*
221 			 * Data frame, validate the bssid.
222 			 */
223 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) &&
224 			    !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
225 				/* not interested in */
226 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
227 				    bssid, NULL, "%s", "not to bss");
228 				ic->ic_stats.is_rx_wrongbss++;
229 				goto out;
230 			}
231 			/*
232 			 * For adhoc mode we cons up a node when it doesn't
233 			 * exist. This should probably done after an ACL check.
234 			 */
235 			if (ni == ic->ic_bss &&
236 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
237 			    !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
238 				/*
239 				 * Fake up a node for this newly
240 				 * discovered member of the IBSS.
241 				 */
242 				ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
243 						    wh->i_addr2);
244 				if (ni == NULL) {
245 					/* NB: stat kept for alloc failure */
246 					goto err;
247 				}
248 			}
249 			break;
250 		default:
251 			goto out;
252 		}
253 		ni->ni_rssi = rssi;
254 		ni->ni_rstamp = rstamp;
255 		if (HAS_SEQ(type)) {
256 			uint8_t tid;
257 			if (IEEE80211_QOS_HAS_SEQ(wh)) {
258 				tid = ((struct ieee80211_qosframe *)wh)->
259 					i_qos[0] & IEEE80211_QOS_TID;
260 				if (TID_TO_WME_AC(tid) >= WME_AC_VI)
261 					ic->ic_wme.wme_hipri_traffic++;
262 				tid++;
263 			} else
264 				tid = 0;
265 			rxseq = le16toh(*(uint16_t *)wh->i_seq);
266 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
267 			    SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
268 				/* duplicate, discard */
269 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
270 				    bssid, "duplicate",
271 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
272 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
273 				    ni->ni_rxseqs[tid] >>
274 					IEEE80211_SEQ_SEQ_SHIFT,
275 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
276 				    ni->ni_rxseqs[tid] &
277 					IEEE80211_SEQ_FRAG_MASK,
278 				    tid);
279 				ic->ic_stats.is_rx_dup++;
280 				IEEE80211_NODE_STAT(ni, rx_dup);
281 				goto out;
282 			}
283 			ni->ni_rxseqs[tid] = rxseq;
284 		}
285 	}
286 
287 	switch (type) {
288 	case IEEE80211_FC0_TYPE_DATA:
289 		hdrspace = ieee80211_hdrspace(ic, wh);
290 		if (m->m_len < hdrspace &&
291 		    (m = m_pullup(m, hdrspace)) == NULL) {
292 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
293 			    ni->ni_macaddr, NULL,
294 			    "data too short: expecting %u", hdrspace);
295 			ic->ic_stats.is_rx_tooshort++;
296 			goto out;		/* XXX */
297 		}
298 		switch (ic->ic_opmode) {
299 		case IEEE80211_M_STA:
300 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
301 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
302 				    wh, "data", "%s", "unknown dir 0x%x", dir);
303 				ic->ic_stats.is_rx_wrongdir++;
304 				goto out;
305 			}
306 			if ((ifp->if_flags & IFF_SIMPLEX) &&
307 			    IEEE80211_IS_MULTICAST(wh->i_addr1) &&
308 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) {
309 				/*
310 				 * In IEEE802.11 network, multicast packet
311 				 * sent from me is broadcasted from AP.
312 				 * It should be silently discarded for
313 				 * SIMPLEX interface.
314 				 */
315 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
316 				    wh, NULL, "%s", "multicast echo");
317 				ic->ic_stats.is_rx_mcastecho++;
318 				goto out;
319 			}
320 			break;
321 		case IEEE80211_M_IBSS:
322 		case IEEE80211_M_AHDEMO:
323 			if (dir != IEEE80211_FC1_DIR_NODS) {
324 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
325 				    wh, "data", "%s", "unknown dir 0x%x", dir);
326 				ic->ic_stats.is_rx_wrongdir++;
327 				goto out;
328 			}
329 			/* XXX no power-save support */
330 			break;
331 		case IEEE80211_M_HOSTAP:
332 			if (dir != IEEE80211_FC1_DIR_TODS) {
333 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
334 				    wh, "data", "%s", "unknown dir 0x%x", dir);
335 				ic->ic_stats.is_rx_wrongdir++;
336 				goto out;
337 			}
338 			/* check if source STA is associated */
339 			if (ni == ic->ic_bss) {
340 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
341 				    wh, "data", "%s", "unknown src");
342 				ieee80211_send_error(ic, ni, wh->i_addr2,
343 				    IEEE80211_FC0_SUBTYPE_DEAUTH,
344 				    IEEE80211_REASON_NOT_AUTHED);
345 				ic->ic_stats.is_rx_notassoc++;
346 				goto err;
347 			}
348 			if (ni->ni_associd == 0) {
349 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
350 				    wh, "data", "%s", "unassoc src");
351 				IEEE80211_SEND_MGMT(ic, ni,
352 				    IEEE80211_FC0_SUBTYPE_DISASSOC,
353 				    IEEE80211_REASON_NOT_ASSOCED);
354 				ic->ic_stats.is_rx_notassoc++;
355 				goto err;
356 			}
357 
358 			/*
359 			 * Check for power save state change.
360 			 */
361 			if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
362 			    (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
363 				ieee80211_node_pwrsave(ni,
364 					wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
365 			break;
366 		default:
367 			/* XXX here to keep compiler happy */
368 			goto out;
369 		}
370 
371 		/*
372 		 * Handle privacy requirements.  Note that we
373 		 * must not be preempted from here until after
374 		 * we (potentially) call ieee80211_crypto_demic;
375 		 * otherwise we may violate assumptions in the
376 		 * crypto cipher modules used to do delayed update
377 		 * of replay sequence numbers.
378 		 */
379 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
380 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
381 				/*
382 				 * Discard encrypted frames when privacy is off.
383 				 */
384 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
385 				    wh, "WEP", "%s", "PRIVACY off");
386 				ic->ic_stats.is_rx_noprivacy++;
387 				IEEE80211_NODE_STAT(ni, rx_noprivacy);
388 				goto out;
389 			}
390 			key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
391 			if (key == NULL) {
392 				/* NB: stats+msgs handled in crypto_decap */
393 				IEEE80211_NODE_STAT(ni, rx_wepfail);
394 				goto out;
395 			}
396 			wh = mtod(m, struct ieee80211_frame *);
397 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
398 		} else {
399 			key = NULL;
400 		}
401 
402 		/*
403 		 * Next up, any fragmentation.
404 		 */
405 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
406 			m = ieee80211_defrag(ic, ni, m, hdrspace);
407 			if (m == NULL) {
408 				/* Fragment dropped or frame not complete yet */
409 				goto out;
410 			}
411 		}
412 		wh = NULL;		/* no longer valid, catch any uses */
413 
414 		/*
415 		 * Next strip any MSDU crypto bits.
416 		 */
417 		if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) {
418 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
419 			    ni->ni_macaddr, "data", "%s", "demic error");
420 			ic->ic_stats.is_rx_demicfail++;
421 			IEEE80211_NODE_STAT(ni, rx_demicfail);
422 			goto out;
423 		}
424 
425 		/* copy to listener after decrypt */
426 		if (ic->ic_rawbpf)
427 			bpf_mtap(ic->ic_rawbpf, m);
428 
429 		/*
430 		 * Finally, strip the 802.11 header.
431 		 */
432 		m = ieee80211_decap(ic, m, hdrspace);
433 		if (m == NULL) {
434 			/* don't count Null data frames as errors */
435 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA)
436 				goto out;
437 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
438 			    ni->ni_macaddr, "data", "%s", "decap error");
439 			ic->ic_stats.is_rx_decap++;
440 			IEEE80211_NODE_STAT(ni, rx_decap);
441 			goto err;
442 		}
443 		eh = mtod(m, struct ether_header *);
444 		if (!ieee80211_node_is_authorized(ni)) {
445 			/*
446 			 * Deny any non-PAE frames received prior to
447 			 * authorization.  For open/shared-key
448 			 * authentication the port is mark authorized
449 			 * after authentication completes.  For 802.1x
450 			 * the port is not marked authorized by the
451 			 * authenticator until the handshake has completed.
452 			 */
453 			if (eh->ether_type != htons(ETHERTYPE_PAE)) {
454 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
455 				    eh->ether_shost, "data",
456 				    "unauthorized port: ether type 0x%x len %u",
457 				    eh->ether_type, m->m_pkthdr.len);
458 				ic->ic_stats.is_rx_unauth++;
459 				IEEE80211_NODE_STAT(ni, rx_unauth);
460 				goto err;
461 			}
462 		} else {
463 			/*
464 			 * When denying unencrypted frames, discard
465 			 * any non-PAE frames received without encryption.
466 			 */
467 			if ((ic->ic_flags & IEEE80211_F_DROPUNENC) &&
468 			    key == NULL &&
469 			    eh->ether_type != htons(ETHERTYPE_PAE)) {
470 				/*
471 				 * Drop unencrypted frames.
472 				 */
473 				ic->ic_stats.is_rx_unencrypted++;
474 				IEEE80211_NODE_STAT(ni, rx_unencrypted);
475 				goto out;
476 			}
477 		}
478 		ieee80211_deliver_data(ic, ni, m);
479 		return IEEE80211_FC0_TYPE_DATA;
480 
481 	case IEEE80211_FC0_TYPE_MGT:
482 		ic->ic_stats.is_rx_mgmt++;
483 		IEEE80211_NODE_STAT(ni, rx_mgmt);
484 		if (dir != IEEE80211_FC1_DIR_NODS) {
485 			IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
486 			    wh, "data", "%s", "unknown dir 0x%x", dir);
487 			ic->ic_stats.is_rx_wrongdir++;
488 			goto err;
489 		}
490 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
491 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
492 			    ni->ni_macaddr, "mgt", "too short: len %u",
493 			    m->m_pkthdr.len);
494 			ic->ic_stats.is_rx_tooshort++;
495 			goto out;
496 		}
497 #ifdef IEEE80211_DEBUG
498 		if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) ||
499 		    ieee80211_msg_dumppkts(ic)) {
500 			if_printf(ic->ic_ifp, "received %s from %6D rssi %d\n",
501 			    ieee80211_mgt_subtype_name[subtype >>
502 				IEEE80211_FC0_SUBTYPE_SHIFT],
503 			    wh->i_addr2, ":", rssi);
504 		}
505 #endif
506 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
507 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
508 				/*
509 				 * Only shared key auth frames with a challenge
510 				 * should be encrypted, discard all others.
511 				 */
512 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
513 				    wh, ieee80211_mgt_subtype_name[subtype >>
514 					IEEE80211_FC0_SUBTYPE_SHIFT],
515 				    "%s", "WEP set but not permitted");
516 				ic->ic_stats.is_rx_mgtdiscard++; /* XXX */
517 				goto out;
518 			}
519 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
520 				/*
521 				 * Discard encrypted frames when privacy is off.
522 				 */
523 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
524 				    wh, "mgt", "%s", "WEP set but PRIVACY off");
525 				ic->ic_stats.is_rx_noprivacy++;
526 				goto out;
527 			}
528 			hdrspace = ieee80211_hdrspace(ic, wh);
529 			key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
530 			if (key == NULL) {
531 				/* NB: stats+msgs handled in crypto_decap */
532 				goto out;
533 			}
534 			wh = mtod(m, struct ieee80211_frame *);
535 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
536 		}
537 		if (ic->ic_rawbpf)
538 			bpf_mtap(ic->ic_rawbpf, m);
539 		(*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
540 		m_freem(m);
541 		return type;
542 
543 	case IEEE80211_FC0_TYPE_CTL:
544 		IEEE80211_NODE_STAT(ni, rx_ctrl);
545 		ic->ic_stats.is_rx_ctl++;
546 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
547 			switch (subtype) {
548 			case IEEE80211_FC0_SUBTYPE_PS_POLL:
549 				ieee80211_recv_pspoll(ic, ni, m);
550 				break;
551 			}
552 		}
553 		goto out;
554 	default:
555 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
556 		    wh, NULL, "bad frame type 0x%x", type);
557 		/* should not come here */
558 		break;
559 	}
560 err:
561 	ifp->if_ierrors++;
562 out:
563 	if (m != NULL) {
564 		if (ic->ic_rawbpf)
565 			bpf_mtap(ic->ic_rawbpf, m);
566 		m_freem(m);
567 	}
568 	return type;
569 #undef SEQ_LEQ
570 }
571 
572 /*
573  * This function reassemble fragments.
574  */
575 static struct mbuf *
576 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni,
577 	struct mbuf *m, int hdrspace)
578 {
579 	struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
580 	struct ieee80211_frame *lwh;
581 	uint16_t rxseq;
582 	uint8_t fragno;
583 	uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
584 	struct mbuf *mfrag;
585 
586 	KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
587 
588 	rxseq = le16toh(*(uint16_t *)wh->i_seq);
589 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
590 
591 	/* Quick way out, if there's nothing to defragment */
592 	if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
593 		return m;
594 
595 	/*
596 	 * Remove frag to insure it doesn't get reaped by timer.
597 	 */
598 	if (ni->ni_table == NULL) {
599 		/*
600 		 * Should never happen.  If the node is orphaned (not in
601 		 * the table) then input packets should not reach here.
602 		 * Otherwise, a concurrent request that yanks the table
603 		 * should be blocked by other interlocking and/or by first
604 		 * shutting the driver down.  Regardless, be defensive
605 		 * here and just bail
606 		 */
607 		/* XXX need msg+stat */
608 		m_freem(m);
609 		return NULL;
610 	}
611 	mfrag = ni->ni_rxfrag[0];
612 	ni->ni_rxfrag[0] = NULL;
613 
614 	/*
615 	 * Validate new fragment is in order and
616 	 * related to the previous ones.
617 	 */
618 	if (mfrag != NULL) {
619 		uint16_t last_rxseq;
620 
621 		lwh = mtod(mfrag, struct ieee80211_frame *);
622 		last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
623 		/* NB: check seq # and frag together */
624 		if (rxseq != last_rxseq+1 ||
625 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
626 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
627 			/*
628 			 * Unrelated fragment or no space for it,
629 			 * clear current fragments.
630 			 */
631 			m_freem(mfrag);
632 			mfrag = NULL;
633 		}
634 	}
635 
636  	if (mfrag == NULL) {
637 		if (fragno != 0) {		/* !first fragment, discard */
638 			ic->ic_stats.is_rx_defrag++;
639 			IEEE80211_NODE_STAT(ni, rx_defrag);
640 			m_freem(m);
641 			return NULL;
642 		}
643 		mfrag = m;
644 	} else {				/* concatenate */
645 		m_adj(m, hdrspace);		/* strip header */
646 		m_cat(mfrag, m);
647 		/* NB: m_cat doesn't update the packet header */
648 		mfrag->m_pkthdr.len += m->m_pkthdr.len;
649 		/* track last seqnum and fragno */
650 		lwh = mtod(mfrag, struct ieee80211_frame *);
651 		*(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
652 	}
653 	if (more_frag) {			/* more to come, save */
654 		ni->ni_rxfragstamp = ticks;
655 		ni->ni_rxfrag[0] = mfrag;
656 		mfrag = NULL;
657 	}
658 	return mfrag;
659 }
660 
661 static void
662 ieee80211_deliver_data(struct ieee80211com *ic,
663 	struct ieee80211_node *ni, struct mbuf *m)
664 {
665 	struct ether_header *eh = mtod(m, struct ether_header *);
666 	struct ifnet *ifp = ic->ic_ifp;
667 
668 	/*
669 	 * Do accounting.
670 	 */
671 	ifp->if_ipackets++;
672 	IEEE80211_NODE_STAT(ni, rx_data);
673 	IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
674 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
675 		m->m_flags |= M_MCAST;	/* XXX M_BCAST? */
676 		IEEE80211_NODE_STAT(ni, rx_mcast);
677 	} else {
678 		IEEE80211_NODE_STAT(ni, rx_ucast);
679 	}
680 
681 	/* perform as a bridge within the AP */
682 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
683 	    (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) {
684 		struct mbuf *m1 = NULL;
685 
686 		if (m->m_flags & M_MCAST) {
687 			m1 = m_dup(m, MB_DONTWAIT);
688 			if (m1 == NULL)
689 				ifp->if_oerrors++;
690 			else
691 				m1->m_flags |= M_MCAST;
692 		} else {
693 			/*
694 			 * Check if the destination is known; if so
695 			 * and the port is authorized dispatch directly.
696 			 */
697 			struct ieee80211_node *sta =
698 			    ieee80211_find_node(&ic->ic_sta, eh->ether_dhost);
699 			if (sta != NULL) {
700 				if (ieee80211_node_is_authorized(sta)) {
701 					/*
702 					 * Beware of sending to ourself; this
703 					 * needs to happen via the normal
704 					 * input path.
705 					 */
706 					if (sta != ic->ic_bss) {
707 						m1 = m;
708 						m = NULL;
709 					}
710 				} else {
711 					ic->ic_stats.is_rx_unauth++;
712 					IEEE80211_NODE_STAT(sta, rx_unauth);
713 				}
714 				ieee80211_free_node(sta);
715 			}
716 		}
717 		if (m1 != NULL) {
718 			/* XXX bypasses ALTQ */
719 			ifq_handoff(ifp, m1, NULL);
720 		}
721 	}
722 	if (m != NULL) {
723 #ifdef FREEBSD_VLAN
724 		if (ni->ni_vlan != 0) {
725 			/* attach vlan tag */
726 			VLAN_INPUT_TAG_NEW(ifp, m, ni->ni_vlan);
727 			if (m == NULL)
728 				goto out;	/* XXX goto err? */
729 		}
730 #endif
731 		ifp->if_input(ifp, m);
732 	}
733 	return;
734 
735 #ifdef FREEBSD_VLAN
736   out:
737 	if (m != NULL) {
738 		if (ic->ic_rawbpf)
739 			bpf_mtap(ic->ic_rawbpf, m);
740 		m_freem(m);
741 	}
742 #endif
743 }
744 
745 static struct mbuf *
746 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen)
747 {
748 	struct ieee80211_qosframe_addr4 wh;	/* Max size address frames */
749 	struct ether_header *eh;
750 	struct llc *llc;
751 
752 	if (m->m_len < hdrlen + sizeof(*llc) &&
753 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
754 		/* XXX stat, msg */
755 		return NULL;
756 	}
757 	memcpy(&wh, mtod(m, caddr_t), hdrlen);
758 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
759 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
760 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
761 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
762 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
763 		llc = NULL;
764 	} else {
765 		m_adj(m, hdrlen - sizeof(*eh));
766 	}
767 	eh = mtod(m, struct ether_header *);
768 	switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
769 	case IEEE80211_FC1_DIR_NODS:
770 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
771 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
772 		break;
773 	case IEEE80211_FC1_DIR_TODS:
774 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
775 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
776 		break;
777 	case IEEE80211_FC1_DIR_FROMDS:
778 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
779 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
780 		break;
781 	case IEEE80211_FC1_DIR_DSTODS:
782 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
783 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
784 		break;
785 	}
786 #ifdef ALIGNED_POINTER
787 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
788 		struct mbuf *n, *n0, **np;
789 		caddr_t newdata;
790 		int off, pktlen;
791 
792 		n0 = NULL;
793 		np = &n0;
794 		off = 0;
795 		pktlen = m->m_pkthdr.len;
796 		while (pktlen > off) {
797 			if (n0 == NULL) {
798 				MGETHDR(n, M_DONTWAIT, MT_DATA);
799 				if (n == NULL) {
800 					m_freem(m);
801 					return NULL;
802 				}
803 				M_MOVE_PKTHDR(n, m);
804 				n->m_len = MHLEN;
805 			} else {
806 				MGET(n, M_DONTWAIT, MT_DATA);
807 				if (n == NULL) {
808 					m_freem(m);
809 					m_freem(n0);
810 					return NULL;
811 				}
812 				n->m_len = MLEN;
813 			}
814 			if (pktlen - off >= MINCLSIZE) {
815 				MCLGET(n, M_DONTWAIT);
816 				if (n->m_flags & M_EXT)
817 					n->m_len = n->m_ext.ext_size;
818 			}
819 			if (n0 == NULL) {
820 				newdata =
821 				    (caddr_t)ALIGN(n->m_data + sizeof(*eh)) -
822 				    sizeof(*eh);
823 				n->m_len -= newdata - n->m_data;
824 				n->m_data = newdata;
825 			}
826 			if (n->m_len > pktlen - off)
827 				n->m_len = pktlen - off;
828 			m_copydata(m, off, n->m_len, mtod(n, caddr_t));
829 			off += n->m_len;
830 			*np = n;
831 			np = &n->m_next;
832 		}
833 		m_freem(m);
834 		m = n0;
835 	}
836 #endif /* ALIGNED_POINTER */
837 	if (llc != NULL) {
838 		eh = mtod(m, struct ether_header *);
839 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
840 	}
841 	return m;
842 }
843 
844 /*
845  * Install received rate set information in the node's state block.
846  */
847 int
848 ieee80211_setup_rates(struct ieee80211_node *ni,
849 	const uint8_t *rates, const uint8_t *xrates, int flags, int join)
850 {
851 	struct ieee80211com *ic = ni->ni_ic;
852 	struct ieee80211_rateset *rs = &ni->ni_rates;
853 
854 	memset(rs, 0, sizeof(*rs));
855 	rs->rs_nrates = rates[1];
856 	memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
857 	if (xrates != NULL) {
858 		uint8_t nxrates;
859 		/*
860 		 * Tack on 11g extended supported rate element.
861 		 */
862 		nxrates = xrates[1];
863 		if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
864 			nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
865 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE,
866 			     "[%6D] extended rate set too large;"
867 			     " only using %u of %u rates\n",
868 			     ni->ni_macaddr, ":", nxrates, xrates[1]);
869 			ic->ic_stats.is_rx_rstoobig++;
870 		}
871 		memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
872 		rs->rs_nrates += nxrates;
873 	}
874 	return ieee80211_fix_rate(ni, flags, join);
875 }
876 
877 static void
878 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh,
879     struct ieee80211_node *ni, int rssi, uint32_t rstamp, uint16_t seq,
880     uint16_t status)
881 {
882 
883 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
884 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
885 		    ni->ni_macaddr, "open auth",
886 		    "bad sta auth mode %u", ni->ni_authmode);
887 		ic->ic_stats.is_rx_bad_auth++;	/* XXX */
888 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
889 			/* XXX hack to workaround calling convention */
890 			ieee80211_send_error(ic, ni, wh->i_addr2,
891 			    IEEE80211_FC0_SUBTYPE_AUTH,
892 			    (seq + 1) | (IEEE80211_STATUS_ALG<<16));
893 		}
894 		return;
895 	}
896 	switch (ic->ic_opmode) {
897 	case IEEE80211_M_IBSS:
898 	case IEEE80211_M_AHDEMO:
899 	case IEEE80211_M_MONITOR:
900 		/* should not come here */
901 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
902 		    ni->ni_macaddr, "open auth",
903 		    "bad operating mode %u", ic->ic_opmode);
904 		break;
905 
906 	case IEEE80211_M_HOSTAP:
907 		if (ic->ic_state != IEEE80211_S_RUN ||
908 		    seq != IEEE80211_AUTH_OPEN_REQUEST) {
909 			ic->ic_stats.is_rx_bad_auth++;
910 			return;
911 		}
912 		/* always accept open authentication requests */
913 		if (ni == ic->ic_bss) {
914 			ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
915 			if (ni == NULL)
916 				return;
917 		} else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
918 			(void) ieee80211_ref_node(ni);
919 		/*
920 		 * Mark the node as referenced to reflect that it's
921 		 * reference count has been bumped to insure it remains
922 		 * after the transaction completes.
923 		 */
924 		ni->ni_flags |= IEEE80211_NODE_AREF;
925 
926 		IEEE80211_SEND_MGMT(ic, ni,
927 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
928 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
929 		    "[%6D] station authenticated (open)\n",
930 		    ni->ni_macaddr, ":");
931 		/*
932 		 * When 802.1x is not in use mark the port
933 		 * authorized at this point so traffic can flow.
934 		 */
935 		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
936 			ieee80211_node_authorize(ni);
937 		break;
938 
939 	case IEEE80211_M_STA:
940 		if (ic->ic_state != IEEE80211_S_AUTH ||
941 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
942 			ic->ic_stats.is_rx_bad_auth++;
943 			return;
944 		}
945 		if (status != 0) {
946 			IEEE80211_DPRINTF(ic,
947 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
948 			    "[%6D] open auth failed (reason %d)\n",
949 			    ni->ni_macaddr, ":", status);
950 			/* XXX can this happen? */
951 			if (ni != ic->ic_bss)
952 				ni->ni_fails++;
953 			ic->ic_stats.is_rx_auth_fail++;
954 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
955 		} else
956 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
957 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
958 		break;
959 	}
960 }
961 
962 /*
963  * Send a management frame error response to the specified
964  * station.  If ni is associated with the station then use
965  * it; otherwise allocate a temporary node suitable for
966  * transmitting the frame and then free the reference so
967  * it will go away as soon as the frame has been transmitted.
968  */
969 static void
970 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni,
971 	const uint8_t *mac, int subtype, int arg)
972 {
973 	int istmp;
974 
975 	if (ni == ic->ic_bss) {
976 		ni = ieee80211_tmp_node(ic, mac);
977 		if (ni == NULL) {
978 			/* XXX msg */
979 			return;
980 		}
981 		istmp = 1;
982 	} else
983 		istmp = 0;
984 	IEEE80211_SEND_MGMT(ic, ni, subtype, arg);
985 	if (istmp)
986 		ieee80211_free_node(ni);
987 }
988 
989 static int
990 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni)
991 {
992 	if (ni->ni_challenge == NULL)
993 		MALLOC(ni->ni_challenge, uint32_t*, IEEE80211_CHALLENGE_LEN,
994 		    M_DEVBUF, M_NOWAIT);
995 	if (ni->ni_challenge == NULL) {
996 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
997 		    "[%6D] shared key challenge alloc failed\n",
998 		    ni->ni_macaddr, ":");
999 		/* XXX statistic */
1000 	}
1001 	return (ni->ni_challenge != NULL);
1002 }
1003 
1004 /* XXX TODO: add statistics */
1005 static void
1006 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh,
1007     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *ni, int rssi,
1008     uint32_t rstamp, uint16_t seq, uint16_t status)
1009 {
1010 	uint8_t *challenge;
1011 	int allocbs, estatus;
1012 
1013 	/*
1014 	 * NB: this can happen as we allow pre-shared key
1015 	 * authentication to be enabled w/o wep being turned
1016 	 * on so that configuration of these can be done
1017 	 * in any order.  It may be better to enforce the
1018 	 * ordering in which case this check would just be
1019 	 * for sanity/consistency.
1020 	 */
1021 	if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
1022 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1023 		    ni->ni_macaddr, "shared key auth",
1024 		    "%s", " PRIVACY is disabled");
1025 		estatus = IEEE80211_STATUS_ALG;
1026 		goto bad;
1027 	}
1028 	/*
1029 	 * Pre-shared key authentication is evil; accept
1030 	 * it only if explicitly configured (it is supported
1031 	 * mainly for compatibility with clients like OS X).
1032 	 */
1033 	if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1034 	    ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1035 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1036 		    ni->ni_macaddr, "shared key auth",
1037 		    "bad sta auth mode %u", ni->ni_authmode);
1038 		ic->ic_stats.is_rx_bad_auth++;	/* XXX maybe a unique error? */
1039 		estatus = IEEE80211_STATUS_ALG;
1040 		goto bad;
1041 	}
1042 
1043 	challenge = NULL;
1044 	if (frm + 1 < efrm) {
1045 		if ((frm[1] + 2) > (efrm - frm)) {
1046 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1047 			    ni->ni_macaddr, "shared key auth",
1048 			    "ie %d/%d too long",
1049 			    frm[0], (frm[1] + 2) - (efrm - frm));
1050 			ic->ic_stats.is_rx_bad_auth++;
1051 			estatus = IEEE80211_STATUS_CHALLENGE;
1052 			goto bad;
1053 		}
1054 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
1055 			challenge = frm;
1056 		frm += frm[1] + 2;
1057 	}
1058 	switch (seq) {
1059 	case IEEE80211_AUTH_SHARED_CHALLENGE:
1060 	case IEEE80211_AUTH_SHARED_RESPONSE:
1061 		if (challenge == NULL) {
1062 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1063 			    ni->ni_macaddr, "shared key auth",
1064 			    "%s", "no challenge");
1065 			ic->ic_stats.is_rx_bad_auth++;
1066 			estatus = IEEE80211_STATUS_CHALLENGE;
1067 			goto bad;
1068 		}
1069 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1070 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1071 			    ni->ni_macaddr, "shared key auth",
1072 			    "bad challenge len %d", challenge[1]);
1073 			ic->ic_stats.is_rx_bad_auth++;
1074 			estatus = IEEE80211_STATUS_CHALLENGE;
1075 			goto bad;
1076 		}
1077 	default:
1078 		break;
1079 	}
1080 	switch (ic->ic_opmode) {
1081 	case IEEE80211_M_MONITOR:
1082 	case IEEE80211_M_AHDEMO:
1083 	case IEEE80211_M_IBSS:
1084 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1085 		    ni->ni_macaddr, "shared key auth",
1086 		    "bad operating mode %u", ic->ic_opmode);
1087 		return;
1088 	case IEEE80211_M_HOSTAP:
1089 		if (ic->ic_state != IEEE80211_S_RUN) {
1090 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1091 			    ni->ni_macaddr, "shared key auth",
1092 			    "bad state %u", ic->ic_state);
1093 			estatus = IEEE80211_STATUS_ALG;	/* XXX */
1094 			goto bad;
1095 		}
1096 		switch (seq) {
1097 		case IEEE80211_AUTH_SHARED_REQUEST:
1098 			if (ni == ic->ic_bss) {
1099 				ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
1100 				if (ni == NULL) {
1101 					/* NB: no way to return an error */
1102 					return;
1103 				}
1104 				allocbs = 1;
1105 			} else {
1106 				if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1107 					(void) ieee80211_ref_node(ni);
1108 				allocbs = 0;
1109 			}
1110 			/*
1111 			 * Mark the node as referenced to reflect that it's
1112 			 * reference count has been bumped to insure it remains
1113 			 * after the transaction completes.
1114 			 */
1115 			ni->ni_flags |= IEEE80211_NODE_AREF;
1116 			ni->ni_rssi = rssi;
1117 			ni->ni_rstamp = rstamp;
1118 			if (!alloc_challenge(ic, ni)) {
1119 				/* NB: don't return error so they rexmit */
1120 				return;
1121 			}
1122 			get_random_bytes(ni->ni_challenge,
1123 				IEEE80211_CHALLENGE_LEN);
1124 			IEEE80211_DPRINTF(ic,
1125 				IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1126 				"[%6D] shared key %sauth request\n",
1127 				ni->ni_macaddr, ":",
1128 				allocbs ? "" : "re");
1129 			break;
1130 		case IEEE80211_AUTH_SHARED_RESPONSE:
1131 			if (ni == ic->ic_bss) {
1132 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1133 				    ni->ni_macaddr, "shared key response",
1134 				    "%s", "unknown station");
1135 				/* NB: don't send a response */
1136 				return;
1137 			}
1138 			if (ni->ni_challenge == NULL) {
1139 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1140 				    ni->ni_macaddr, "shared key response",
1141 				    "%s", "no challenge recorded");
1142 				ic->ic_stats.is_rx_bad_auth++;
1143 				estatus = IEEE80211_STATUS_CHALLENGE;
1144 				goto bad;
1145 			}
1146 			if (memcmp(ni->ni_challenge, &challenge[2],
1147 			           challenge[1]) != 0) {
1148 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1149 				    ni->ni_macaddr, "shared key response",
1150 				    "%s", "challenge mismatch");
1151 				ic->ic_stats.is_rx_auth_fail++;
1152 				estatus = IEEE80211_STATUS_CHALLENGE;
1153 				goto bad;
1154 			}
1155 			IEEE80211_DPRINTF(ic,
1156 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1157 			    "[%6D] station authenticated (shared key)\n",
1158 			    ni->ni_macaddr, ":");
1159 			ieee80211_node_authorize(ni);
1160 			break;
1161 		default:
1162 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1163 			    ni->ni_macaddr, "shared key auth",
1164 			    "bad seq %d", seq);
1165 			ic->ic_stats.is_rx_bad_auth++;
1166 			estatus = IEEE80211_STATUS_SEQUENCE;
1167 			goto bad;
1168 		}
1169 		IEEE80211_SEND_MGMT(ic, ni,
1170 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1171 		break;
1172 
1173 	case IEEE80211_M_STA:
1174 		if (ic->ic_state != IEEE80211_S_AUTH)
1175 			return;
1176 		switch (seq) {
1177 		case IEEE80211_AUTH_SHARED_PASS:
1178 			if (ni->ni_challenge != NULL) {
1179 				FREE(ni->ni_challenge, M_DEVBUF);
1180 				ni->ni_challenge = NULL;
1181 			}
1182 			if (status != 0) {
1183 				IEEE80211_DPRINTF(ic,
1184 				    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1185 				    "[%6D] shared key auth failed (reason %d)\n",
1186 				    ieee80211_getbssid(ic, wh), ":", status);
1187 				/* XXX can this happen? */
1188 				if (ni != ic->ic_bss)
1189 					ni->ni_fails++;
1190 				ic->ic_stats.is_rx_auth_fail++;
1191 				return;
1192 			}
1193 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1194 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1195 			break;
1196 		case IEEE80211_AUTH_SHARED_CHALLENGE:
1197 			if (!alloc_challenge(ic, ni))
1198 				return;
1199 			/* XXX could optimize by passing recvd challenge */
1200 			memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1201 			IEEE80211_SEND_MGMT(ic, ni,
1202 				IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1203 			break;
1204 		default:
1205 			IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH,
1206 			    wh, "shared key auth", "bad seq %d", seq);
1207 			ic->ic_stats.is_rx_bad_auth++;
1208 			return;
1209 		}
1210 		break;
1211 	}
1212 	return;
1213 bad:
1214 	/*
1215 	 * Send an error response; but only when operating as an AP.
1216 	 */
1217 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1218 		/* XXX hack to workaround calling convention */
1219 		ieee80211_send_error(ic, ni, wh->i_addr2,
1220 		    IEEE80211_FC0_SUBTYPE_AUTH,
1221 		    (seq + 1) | (estatus<<16));
1222 	} else if (ic->ic_opmode == IEEE80211_M_STA) {
1223 		/*
1224 		 * Kick the state machine.  This short-circuits
1225 		 * using the mgt frame timeout to trigger the
1226 		 * state transition.
1227 		 */
1228 		if (ic->ic_state == IEEE80211_S_AUTH)
1229 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1230 	}
1231 }
1232 
1233 /* Verify the existence and length of __elem or get out. */
1234 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do {			\
1235 	if ((__elem) == NULL) {						\
1236 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1237 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1238 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1239 		    "%s", "no " #__elem );				\
1240 		ic->ic_stats.is_rx_elem_missing++;			\
1241 		return;							\
1242 	}								\
1243 	if ((__elem)[1] > (__maxlen)) {					\
1244 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1245 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1246 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1247 		    "bad " #__elem " len %d", (__elem)[1]);		\
1248 		ic->ic_stats.is_rx_elem_toobig++;			\
1249 		return;							\
1250 	}								\
1251 } while (0)
1252 
1253 #define	IEEE80211_VERIFY_LENGTH(_len, _minlen) do {			\
1254 	if ((_len) < (_minlen)) {					\
1255 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1256 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1257 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1258 		    "%s", "ie too short");				\
1259 		ic->ic_stats.is_rx_elem_toosmall++;			\
1260 		return;							\
1261 	}								\
1262 } while (0)
1263 
1264 #ifdef IEEE80211_DEBUG
1265 static void
1266 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag,
1267 	uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
1268 {
1269 	kprintf("[%6D] discard %s frame, ssid mismatch: ", mac, ":", tag);
1270 	ieee80211_print_essid(ssid + 2, ssid[1]);
1271 	kprintf("\n");
1272 }
1273 
1274 #define	IEEE80211_VERIFY_SSID(_ni, _ssid) do {				\
1275 	if ((_ssid)[1] != 0 &&						\
1276 	    ((_ssid)[1] != (_ni)->ni_esslen ||				\
1277 	    memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {	\
1278 		if (ieee80211_msg_input(ic))				\
1279 			ieee80211_ssid_mismatch(ic, 			\
1280 			    ieee80211_mgt_subtype_name[subtype >>	\
1281 				IEEE80211_FC0_SUBTYPE_SHIFT],		\
1282 				wh->i_addr2, _ssid);			\
1283 		ic->ic_stats.is_rx_ssidmismatch++;			\
1284 		return;							\
1285 	}								\
1286 } while (0)
1287 #else /* !IEEE80211_DEBUG */
1288 #define	IEEE80211_VERIFY_SSID(_ni, _ssid) do {				\
1289 	if ((_ssid)[1] != 0 &&						\
1290 	    ((_ssid)[1] != (_ni)->ni_esslen ||				\
1291 	    memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {	\
1292 		ic->ic_stats.is_rx_ssidmismatch++;			\
1293 		return;							\
1294 	}								\
1295 } while (0)
1296 #endif /* !IEEE80211_DEBUG */
1297 
1298 /* unalligned little endian access */
1299 #define LE_READ_2(p)					\
1300 	((uint16_t)					\
1301 	 ((((const uint8_t *)(p))[0]      ) |		\
1302 	  (((const uint8_t *)(p))[1] <<  8)))
1303 #define LE_READ_4(p)					\
1304 	((uint32_t)					\
1305 	 ((((const uint8_t *)(p))[0]      ) |		\
1306 	  (((const uint8_t *)(p))[1] <<  8) |		\
1307 	  (((const uint8_t *)(p))[2] << 16) |		\
1308 	  (((const uint8_t *)(p))[3] << 24)))
1309 
1310 static int __inline
1311 iswpaoui(const uint8_t *frm)
1312 {
1313 	return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
1314 }
1315 
1316 static int __inline
1317 iswmeoui(const uint8_t *frm)
1318 {
1319 	return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI);
1320 }
1321 
1322 static int __inline
1323 iswmeparam(const uint8_t *frm)
1324 {
1325 	return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1326 		frm[6] == WME_PARAM_OUI_SUBTYPE;
1327 }
1328 
1329 static int __inline
1330 iswmeinfo(const uint8_t *frm)
1331 {
1332 	return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1333 		frm[6] == WME_INFO_OUI_SUBTYPE;
1334 }
1335 
1336 static int __inline
1337 isatherosoui(const uint8_t *frm)
1338 {
1339 	return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
1340 }
1341 
1342 /*
1343  * Convert a WPA cipher selector OUI to an internal
1344  * cipher algorithm.  Where appropriate we also
1345  * record any key length.
1346  */
1347 static int
1348 wpa_cipher(uint8_t *sel, uint8_t *keylen)
1349 {
1350 #define	WPA_SEL(x)	(((x)<<24)|WPA_OUI)
1351 	uint32_t w = LE_READ_4(sel);
1352 
1353 	switch (w) {
1354 	case WPA_SEL(WPA_CSE_NULL):
1355 		return IEEE80211_CIPHER_NONE;
1356 	case WPA_SEL(WPA_CSE_WEP40):
1357 		if (keylen)
1358 			*keylen = 40 / NBBY;
1359 		return IEEE80211_CIPHER_WEP;
1360 	case WPA_SEL(WPA_CSE_WEP104):
1361 		if (keylen)
1362 			*keylen = 104 / NBBY;
1363 		return IEEE80211_CIPHER_WEP;
1364 	case WPA_SEL(WPA_CSE_TKIP):
1365 		return IEEE80211_CIPHER_TKIP;
1366 	case WPA_SEL(WPA_CSE_CCMP):
1367 		return IEEE80211_CIPHER_AES_CCM;
1368 	}
1369 	return 32;		/* NB: so 1<< is discarded */
1370 #undef WPA_SEL
1371 }
1372 
1373 /*
1374  * Convert a WPA key management/authentication algorithm
1375  * to an internal code.
1376  */
1377 static int
1378 wpa_keymgmt(uint8_t *sel)
1379 {
1380 #define	WPA_SEL(x)	(((x)<<24)|WPA_OUI)
1381 	uint32_t w = LE_READ_4(sel);
1382 
1383 	switch (w) {
1384 	case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1385 		return WPA_ASE_8021X_UNSPEC;
1386 	case WPA_SEL(WPA_ASE_8021X_PSK):
1387 		return WPA_ASE_8021X_PSK;
1388 	case WPA_SEL(WPA_ASE_NONE):
1389 		return WPA_ASE_NONE;
1390 	}
1391 	return 0;		/* NB: so is discarded */
1392 #undef WPA_SEL
1393 }
1394 
1395 /*
1396  * Parse a WPA information element to collect parameters
1397  * and validate the parameters against what has been
1398  * configured for the system.
1399  */
1400 static int
1401 ieee80211_parse_wpa(struct ieee80211com *ic, uint8_t *frm,
1402 	struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1403 {
1404 	uint8_t len = frm[1];
1405 	uint32_t w;
1406 	int n;
1407 
1408 	/*
1409 	 * Check the length once for fixed parts: OUI, type,
1410 	 * version, mcast cipher, and 2 selector counts.
1411 	 * Other, variable-length data, must be checked separately.
1412 	 */
1413 	if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) {
1414 		IEEE80211_DISCARD_IE(ic,
1415 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1416 		    wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags);
1417 		return IEEE80211_REASON_IE_INVALID;
1418 	}
1419 	if (len < 14) {
1420 		IEEE80211_DISCARD_IE(ic,
1421 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1422 		    wh, "WPA", "too short, len %u", len);
1423 		return IEEE80211_REASON_IE_INVALID;
1424 	}
1425 	frm += 6, len -= 4;		/* NB: len is payload only */
1426 	/* NB: iswapoui already validated the OUI and type */
1427 	w = LE_READ_2(frm);
1428 	if (w != WPA_VERSION) {
1429 		IEEE80211_DISCARD_IE(ic,
1430 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1431 		    wh, "WPA", "bad version %u", w);
1432 		return IEEE80211_REASON_IE_INVALID;
1433 	}
1434 	frm += 2, len -= 2;
1435 
1436 	/* multicast/group cipher */
1437 	w = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1438 	if (w != rsn->rsn_mcastcipher) {
1439 		IEEE80211_DISCARD_IE(ic,
1440 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1441 		    wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
1442 		    w, rsn->rsn_mcastcipher);
1443 		return IEEE80211_REASON_IE_INVALID;
1444 	}
1445 	frm += 4, len -= 4;
1446 
1447 	/* unicast ciphers */
1448 	n = LE_READ_2(frm);
1449 	frm += 2, len -= 2;
1450 	if (len < n*4+2) {
1451 		IEEE80211_DISCARD_IE(ic,
1452 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1453 		    wh, "WPA", "ucast cipher data too short; len %u, n %u",
1454 		    len, n);
1455 		return IEEE80211_REASON_IE_INVALID;
1456 	}
1457 	w = 0;
1458 	for (; n > 0; n--) {
1459 		w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1460 		frm += 4, len -= 4;
1461 	}
1462 	w &= rsn->rsn_ucastcipherset;
1463 	if (w == 0) {
1464 		IEEE80211_DISCARD_IE(ic,
1465 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1466 		    wh, "WPA", "%s", "ucast cipher set empty");
1467 		return IEEE80211_REASON_IE_INVALID;
1468 	}
1469 	if (w & (1<<IEEE80211_CIPHER_TKIP))
1470 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1471 	else
1472 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1473 
1474 	/* key management algorithms */
1475 	n = LE_READ_2(frm);
1476 	frm += 2, len -= 2;
1477 	if (len < n*4) {
1478 		IEEE80211_DISCARD_IE(ic,
1479 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1480 		    wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1481 		    len, n);
1482 		return IEEE80211_REASON_IE_INVALID;
1483 	}
1484 	w = 0;
1485 	for (; n > 0; n--) {
1486 		w |= wpa_keymgmt(frm);
1487 		frm += 4, len -= 4;
1488 	}
1489 	w &= rsn->rsn_keymgmtset;
1490 	if (w == 0) {
1491 		IEEE80211_DISCARD_IE(ic,
1492 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1493 		    wh, "WPA", "%s", "no acceptable key mgmt alg");
1494 		return IEEE80211_REASON_IE_INVALID;
1495 	}
1496 	if (w & WPA_ASE_8021X_UNSPEC)
1497 		rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1498 	else
1499 		rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1500 
1501 	if (len > 2)		/* optional capabilities */
1502 		rsn->rsn_caps = LE_READ_2(frm);
1503 
1504 	return 0;
1505 }
1506 
1507 /*
1508  * Convert an RSN cipher selector OUI to an internal
1509  * cipher algorithm.  Where appropriate we also
1510  * record any key length.
1511  */
1512 static int
1513 rsn_cipher(uint8_t *sel, uint8_t *keylen)
1514 {
1515 #define	RSN_SEL(x)	(((x)<<24)|RSN_OUI)
1516 	uint32_t w = LE_READ_4(sel);
1517 
1518 	switch (w) {
1519 	case RSN_SEL(RSN_CSE_NULL):
1520 		return IEEE80211_CIPHER_NONE;
1521 	case RSN_SEL(RSN_CSE_WEP40):
1522 		if (keylen)
1523 			*keylen = 40 / NBBY;
1524 		return IEEE80211_CIPHER_WEP;
1525 	case RSN_SEL(RSN_CSE_WEP104):
1526 		if (keylen)
1527 			*keylen = 104 / NBBY;
1528 		return IEEE80211_CIPHER_WEP;
1529 	case RSN_SEL(RSN_CSE_TKIP):
1530 		return IEEE80211_CIPHER_TKIP;
1531 	case RSN_SEL(RSN_CSE_CCMP):
1532 		return IEEE80211_CIPHER_AES_CCM;
1533 	case RSN_SEL(RSN_CSE_WRAP):
1534 		return IEEE80211_CIPHER_AES_OCB;
1535 	}
1536 	return 32;		/* NB: so 1<< is discarded */
1537 #undef WPA_SEL
1538 }
1539 
1540 /*
1541  * Convert an RSN key management/authentication algorithm
1542  * to an internal code.
1543  */
1544 static int
1545 rsn_keymgmt(uint8_t *sel)
1546 {
1547 #define	RSN_SEL(x)	(((x)<<24)|RSN_OUI)
1548 	uint32_t w = LE_READ_4(sel);
1549 
1550 	switch (w) {
1551 	case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1552 		return RSN_ASE_8021X_UNSPEC;
1553 	case RSN_SEL(RSN_ASE_8021X_PSK):
1554 		return RSN_ASE_8021X_PSK;
1555 	case RSN_SEL(RSN_ASE_NONE):
1556 		return RSN_ASE_NONE;
1557 	}
1558 	return 0;		/* NB: so is discarded */
1559 #undef RSN_SEL
1560 }
1561 
1562 /*
1563  * Parse a WPA/RSN information element to collect parameters
1564  * and validate the parameters against what has been
1565  * configured for the system.
1566  */
1567 static int
1568 ieee80211_parse_rsn(struct ieee80211com *ic, uint8_t *frm,
1569 	struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1570 {
1571 	uint8_t len = frm[1];
1572 	uint32_t w;
1573 	int n;
1574 
1575 	/*
1576 	 * Check the length once for fixed parts:
1577 	 * version, mcast cipher, and 2 selector counts.
1578 	 * Other, variable-length data, must be checked separately.
1579 	 */
1580 	if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) {
1581 		IEEE80211_DISCARD_IE(ic,
1582 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1583 		    wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags);
1584 		return IEEE80211_REASON_IE_INVALID;
1585 	}
1586 	if (len < 10) {
1587 		IEEE80211_DISCARD_IE(ic,
1588 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1589 		    wh, "RSN", "too short, len %u", len);
1590 		return IEEE80211_REASON_IE_INVALID;
1591 	}
1592 	frm += 2;
1593 	w = LE_READ_2(frm);
1594 	if (w != RSN_VERSION) {
1595 		IEEE80211_DISCARD_IE(ic,
1596 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1597 		    wh, "RSN", "bad version %u", w);
1598 		return IEEE80211_REASON_IE_INVALID;
1599 	}
1600 	frm += 2, len -= 2;
1601 
1602 	/* multicast/group cipher */
1603 	w = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1604 	if (w != rsn->rsn_mcastcipher) {
1605 		IEEE80211_DISCARD_IE(ic,
1606 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1607 		    wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
1608 		    w, rsn->rsn_mcastcipher);
1609 		return IEEE80211_REASON_IE_INVALID;
1610 	}
1611 	frm += 4, len -= 4;
1612 
1613 	/* unicast ciphers */
1614 	n = LE_READ_2(frm);
1615 	frm += 2, len -= 2;
1616 	if (len < n*4+2) {
1617 		IEEE80211_DISCARD_IE(ic,
1618 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1619 		    wh, "RSN", "ucast cipher data too short; len %u, n %u",
1620 		    len, n);
1621 		return IEEE80211_REASON_IE_INVALID;
1622 	}
1623 	w = 0;
1624 	for (; n > 0; n--) {
1625 		w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1626 		frm += 4, len -= 4;
1627 	}
1628 	w &= rsn->rsn_ucastcipherset;
1629 	if (w == 0) {
1630 		IEEE80211_DISCARD_IE(ic,
1631 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1632 		    wh, "RSN", "%s", "ucast cipher set empty");
1633 		return IEEE80211_REASON_IE_INVALID;
1634 	}
1635 	if (w & (1<<IEEE80211_CIPHER_TKIP))
1636 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1637 	else
1638 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1639 
1640 	/* key management algorithms */
1641 	n = LE_READ_2(frm);
1642 	frm += 2, len -= 2;
1643 	if (len < n*4) {
1644 		IEEE80211_DISCARD_IE(ic,
1645 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1646 		    wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1647 		    len, n);
1648 		return IEEE80211_REASON_IE_INVALID;
1649 	}
1650 	w = 0;
1651 	for (; n > 0; n--) {
1652 		w |= rsn_keymgmt(frm);
1653 		frm += 4, len -= 4;
1654 	}
1655 	w &= rsn->rsn_keymgmtset;
1656 	if (w == 0) {
1657 		IEEE80211_DISCARD_IE(ic,
1658 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1659 		    wh, "RSN", "%s", "no acceptable key mgmt alg");
1660 		return IEEE80211_REASON_IE_INVALID;
1661 	}
1662 	if (w & RSN_ASE_8021X_UNSPEC)
1663 		rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1664 	else
1665 		rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1666 
1667 	/* optional RSN capabilities */
1668 	if (len > 2)
1669 		rsn->rsn_caps = LE_READ_2(frm);
1670 	/* XXXPMKID */
1671 
1672 	return 0;
1673 }
1674 
1675 static int
1676 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm,
1677 	const struct ieee80211_frame *wh)
1678 {
1679 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1680 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1681 	u_int len = frm[1], qosinfo;
1682 	int i;
1683 
1684 	if (len < sizeof(struct ieee80211_wme_param)-2) {
1685 		IEEE80211_DISCARD_IE(ic,
1686 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1687 		    wh, "WME", "too short, len %u", len);
1688 		return -1;
1689 	}
1690 	qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1691 	qosinfo &= WME_QOSINFO_COUNT;
1692 	/* XXX do proper check for wraparound */
1693 	if (qosinfo == wme->wme_wmeChanParams.cap_info)
1694 		return 0;
1695 	frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1696 	for (i = 0; i < WME_NUM_AC; i++) {
1697 		struct wmeParams *wmep =
1698 			&wme->wme_wmeChanParams.cap_wmeParams[i];
1699 		/* NB: ACI not used */
1700 		wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1701 		wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1702 		wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1703 		wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1704 		wmep->wmep_txopLimit = LE_READ_2(frm+2);
1705 		frm += 4;
1706 	}
1707 	wme->wme_wmeChanParams.cap_info = qosinfo;
1708 	return 1;
1709 #undef MS
1710 }
1711 
1712 void
1713 ieee80211_saveie(uint8_t **iep, const uint8_t *ie)
1714 {
1715 	u_int ielen = ie[1]+2;
1716 	/*
1717 	 * Record information element for later use.
1718 	 */
1719 	if (*iep == NULL || (*iep)[1] != ie[1]) {
1720 		if (*iep != NULL)
1721 			FREE(*iep, M_DEVBUF);
1722 		MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT);
1723 	}
1724 	if (*iep != NULL)
1725 		memcpy(*iep, ie, ielen);
1726 	/* XXX note failure */
1727 }
1728 
1729 /* XXX find a better place for definition */
1730 struct l2_update_frame {
1731 	struct ether_header eh;
1732 	uint8_t dsap;
1733 	uint8_t ssap;
1734 	uint8_t control;
1735 	uint8_t xid[3];
1736 } __packed;
1737 
1738 /*
1739  * Deliver a TGf L2UF frame on behalf of a station.
1740  * This primes any bridge when the station is roaming
1741  * between ap's on the same wired network.
1742  */
1743 static void
1744 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1745 {
1746 	struct ieee80211com *ic = ni->ni_ic;
1747 	struct ifnet *ifp = ic->ic_ifp;
1748 	struct mbuf *m;
1749 	struct l2_update_frame *l2uf;
1750 	struct ether_header *eh;
1751 
1752 	m = m_gethdr(MB_DONTWAIT, MT_DATA);
1753 	if (m == NULL) {
1754 		IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1755 		    "%s", "no mbuf for l2uf frame");
1756 		ic->ic_stats.is_rx_nobuf++;	/* XXX not right */
1757 		return;
1758 	}
1759 	l2uf = mtod(m, struct l2_update_frame *);
1760 	eh = &l2uf->eh;
1761 	/* dst: Broadcast address */
1762 	IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1763 	/* src: associated STA */
1764 	IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1765 	eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1766 
1767 	l2uf->dsap = 0;
1768 	l2uf->ssap = 0;
1769 	l2uf->control = 0xf5;
1770 	l2uf->xid[0] = 0x81;
1771 	l2uf->xid[1] = 0x80;
1772 	l2uf->xid[2] = 0x00;
1773 
1774 	m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1775 	m->m_pkthdr.rcvif = ifp;
1776 	ieee80211_deliver_data(ic, ni, m);
1777 }
1778 
1779 void
1780 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
1781 	struct ieee80211_node *ni,
1782 	int subtype, int rssi, uint32_t rstamp)
1783 {
1784 #define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1785 #define	ISREASSOC(_st)	((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1786 	struct ieee80211_frame *wh;
1787 	uint8_t *frm, *efrm;
1788 	uint8_t *ssid, *rates, *xrates, *wpa, *wme;
1789 	int reassoc, resp;
1790 	uint8_t rate;
1791 
1792 	wh = mtod(m0, struct ieee80211_frame *);
1793 	frm = (uint8_t *)&wh[1];
1794 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1795 	switch (subtype) {
1796 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1797 	case IEEE80211_FC0_SUBTYPE_BEACON: {
1798 		struct ieee80211_scanparams scan;
1799 
1800 		/*
1801 		 * We process beacon/probe response frames:
1802 		 *    o when scanning, or
1803 		 *    o station mode when associated (to collect state
1804 		 *      updates such as 802.11g slot time), or
1805 		 *    o adhoc mode (to discover neighbors)
1806 		 * Frames otherwise received are discarded.
1807 		 */
1808 		if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
1809 		      (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) ||
1810 		       ic->ic_opmode == IEEE80211_M_IBSS)) {
1811 			ic->ic_stats.is_rx_mgtdiscard++;
1812 			return;
1813 		}
1814 		/*
1815 		 * beacon/probe response frame format
1816 		 *	[8] time stamp
1817 		 *	[2] beacon interval
1818 		 *	[2] capability information
1819 		 *	[tlv] ssid
1820 		 *	[tlv] supported rates
1821 		 *	[tlv] country information
1822 		 *	[tlv] parameter set (FH/DS)
1823 		 *	[tlv] erp information
1824 		 *	[tlv] extended supported rates
1825 		 *	[tlv] WME
1826 		 *	[tlv] WPA or RSN
1827 		 */
1828 		IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
1829 		memset(&scan, 0, sizeof(scan));
1830 		scan.tstamp  = frm;				frm += 8;
1831 		scan.bintval = le16toh(*(uint16_t *)frm);	frm += 2;
1832 		scan.capinfo = le16toh(*(uint16_t *)frm);	frm += 2;
1833 		scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1834 		scan.chan = scan.bchan;
1835 
1836 		while (efrm - frm > 1) {
1837 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
1838 			switch (*frm) {
1839 			case IEEE80211_ELEMID_SSID:
1840 				scan.ssid = frm;
1841 				break;
1842 			case IEEE80211_ELEMID_RATES:
1843 				scan.rates = frm;
1844 				break;
1845 			case IEEE80211_ELEMID_COUNTRY:
1846 				scan.country = frm;
1847 				break;
1848 			case IEEE80211_ELEMID_FHPARMS:
1849 				if (ic->ic_phytype == IEEE80211_T_FH) {
1850 					scan.fhdwell = LE_READ_2(&frm[2]);
1851 					scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
1852 					scan.fhindex = frm[6];
1853 				}
1854 				break;
1855 			case IEEE80211_ELEMID_DSPARMS:
1856 				/*
1857 				 * XXX hack this since depending on phytype
1858 				 * is problematic for multi-mode devices.
1859 				 */
1860 				if (ic->ic_phytype != IEEE80211_T_FH)
1861 					scan.chan = frm[2];
1862 				break;
1863 			case IEEE80211_ELEMID_TIM:
1864 				/* XXX ATIM? */
1865 				scan.tim = frm;
1866 				scan.timoff = frm - mtod(m0, uint8_t *);
1867 				break;
1868 			case IEEE80211_ELEMID_IBSSPARMS:
1869 				break;
1870 			case IEEE80211_ELEMID_XRATES:
1871 				scan.xrates = frm;
1872 				break;
1873 			case IEEE80211_ELEMID_ERP:
1874 				if (frm[1] != 1) {
1875 					IEEE80211_DISCARD_IE(ic,
1876 					    IEEE80211_MSG_ELEMID, wh, "ERP",
1877 					    "bad len %u", frm[1]);
1878 					ic->ic_stats.is_rx_elem_toobig++;
1879 					break;
1880 				}
1881 				scan.erp = frm[2];
1882 				break;
1883 			case IEEE80211_ELEMID_RSN:
1884 				scan.wpa = frm;
1885 				break;
1886 			case IEEE80211_ELEMID_VENDOR:
1887 				if (iswpaoui(frm))
1888 					scan.wpa = frm;
1889 				else if (iswmeparam(frm) || iswmeinfo(frm))
1890 					scan.wme = frm;
1891 				/* XXX Atheros OUI support */
1892 				break;
1893 			default:
1894 				IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID,
1895 				    wh, "unhandled",
1896 				    "id %u, len %u", *frm, frm[1]);
1897 				ic->ic_stats.is_rx_elem_unknown++;
1898 				break;
1899 			}
1900 			frm += frm[1] + 2;
1901 		}
1902 		IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
1903 		IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
1904 		if (
1905 #if IEEE80211_CHAN_MAX < 255
1906 		    scan.chan > IEEE80211_CHAN_MAX ||
1907 #endif
1908 		    isclr(ic->ic_chan_active, scan.chan)) {
1909 			IEEE80211_DISCARD(ic,
1910 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1911 			    wh, ieee80211_mgt_subtype_name[subtype >>
1912 				IEEE80211_FC0_SUBTYPE_SHIFT],
1913 			    "invalid channel %u", scan.chan);
1914 			ic->ic_stats.is_rx_badchan++;
1915 			return;
1916 		}
1917 		if (scan.chan != scan.bchan &&
1918 		    ic->ic_phytype != IEEE80211_T_FH) {
1919 			/*
1920 			 * Frame was received on a channel different from the
1921 			 * one indicated in the DS params element id;
1922 			 * silently discard it.
1923 			 *
1924 			 * NB: this can happen due to signal leakage.
1925 			 *     But we should take it for FH phy because
1926 			 *     the rssi value should be correct even for
1927 			 *     different hop pattern in FH.
1928 			 */
1929 			IEEE80211_DISCARD(ic,
1930 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1931 			    wh, ieee80211_mgt_subtype_name[subtype >>
1932 				IEEE80211_FC0_SUBTYPE_SHIFT],
1933 			    "for off-channel %u", scan.chan);
1934 			ic->ic_stats.is_rx_chanmismatch++;
1935 			return;
1936 		}
1937 		if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
1938 		      scan.bintval <= IEEE80211_BINTVAL_MAX)) {
1939 			IEEE80211_DISCARD(ic,
1940 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1941 			    wh, ieee80211_mgt_subtype_name[subtype >>
1942 				IEEE80211_FC0_SUBTYPE_SHIFT],
1943 			    "bogus beacon interval", scan.bintval);
1944 			ic->ic_stats.is_rx_badbintval++;
1945 			return;
1946 		}
1947 
1948 		/*
1949 		 * Count frame now that we know it's to be processed.
1950 		 */
1951 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1952 			ic->ic_stats.is_rx_beacon++;		/* XXX remove */
1953 			IEEE80211_NODE_STAT(ni, rx_beacons);
1954 		} else
1955 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1956 
1957 		/*
1958 		 * When operating in station mode, check for state updates.
1959 		 * Be careful to ignore beacons received while doing a
1960 		 * background scan.  We consider only 11g/WMM stuff right now.
1961 		 */
1962 		if (ic->ic_opmode == IEEE80211_M_STA &&
1963 		    ni->ni_associd != 0 &&
1964 		    ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1965 		     IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1966 			int update_shpreamble = 0;
1967 
1968 			/* record tsf of last beacon */
1969 			memcpy(ni->ni_tstamp.data, scan.tstamp,
1970 				sizeof(ni->ni_tstamp));
1971 			/* count beacon frame for s/w bmiss handling */
1972 			ic->ic_swbmiss_count++;
1973 			ic->ic_bmiss_count = 0;
1974 			if (ni->ni_erp != scan.erp) {
1975 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1976 				    "[%6D] erp change: was 0x%x, now 0x%x\n",
1977 				    wh->i_addr2, ":", ni->ni_erp, scan.erp);
1978 				if (ic->ic_curmode == IEEE80211_MODE_11G &&
1979 				    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1980 					ic->ic_flags |= IEEE80211_F_USEPROT;
1981 				else
1982 					ic->ic_flags &= ~IEEE80211_F_USEPROT;
1983 
1984 				if ((ni->ni_erp ^ scan.erp) & IEEE80211_ERP_LONG_PREAMBLE)
1985 					update_shpreamble = 1;
1986 
1987 				ni->ni_erp = scan.erp;
1988 				/* XXX statistic */
1989 			}
1990 			if (ni->ni_capinfo != scan.capinfo) {
1991 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1992 				    "[%6D] capabilities change: before 0x%x,"
1993 				    " now 0x%x\n",
1994 				    wh->i_addr2, ":",
1995 				    ni->ni_capinfo, scan.capinfo);
1996 
1997 				if ((ni->ni_capinfo ^ scan.capinfo) &
1998 				    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1999 					ieee80211_set_shortslottime(ic,
2000 					    ic->ic_curmode == IEEE80211_MODE_11A ||
2001 					    (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2002 				}
2003 
2004 				if ((ni->ni_capinfo ^ scan.capinfo) &
2005 				    IEEE80211_CAPINFO_SHORT_PREAMBLE)
2006 					update_shpreamble = 1;
2007 
2008 				ni->ni_capinfo = scan.capinfo;
2009 				/* XXX statistic */
2010 			}
2011 
2012 			if (update_shpreamble)
2013 				ieee80211_update_shpreamble(ic, ni);
2014 
2015 			if (scan.wme != NULL &&
2016 			    (ni->ni_flags & IEEE80211_NODE_QOS) &&
2017 			    ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0)
2018 				ieee80211_wme_updateparams(ic);
2019 			if (scan.tim != NULL) {
2020 				struct ieee80211_tim_ie *ie =
2021 				    (struct ieee80211_tim_ie *) scan.tim;
2022 
2023 				ni->ni_dtim_count = ie->tim_count;
2024 				ni->ni_dtim_period = ie->tim_period;
2025 			}
2026 			if (ic->ic_flags & IEEE80211_F_SCAN)
2027 				ieee80211_add_scan(ic, &scan, wh,
2028 					subtype, rssi, rstamp);
2029 			return;
2030 		}
2031 		/*
2032 		 * If scanning, just pass information to the scan module.
2033 		 */
2034 		if (ic->ic_flags & IEEE80211_F_SCAN) {
2035 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
2036 				/*
2037 				 * Actively scanning a channel marked passive;
2038 				 * send a probe request now that we know there
2039 				 * is 802.11 traffic present.
2040 				 *
2041 				 * XXX check if the beacon we recv'd gives
2042 				 * us what we need and suppress the probe req
2043 				 */
2044 				ieee80211_probe_curchan(ic, 1);
2045 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
2046 			}
2047 			ieee80211_add_scan(ic, &scan, wh,
2048 				subtype, rssi, rstamp);
2049 			return;
2050 		}
2051 		if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
2052 			if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2053 				/*
2054 				 * Create a new entry in the neighbor table.
2055 				 */
2056 				ni = ieee80211_add_neighbor(ic, wh, &scan);
2057 			} else if (ni->ni_capinfo == 0) {
2058 				/*
2059 				 * Update faked node created on transmit.
2060 				 * Note this also updates the tsf.
2061 				 */
2062 				ieee80211_init_neighbor(ni, wh, &scan);
2063 			} else {
2064 				/*
2065 				 * Record tsf for potential resync.
2066 				 */
2067 				memcpy(ni->ni_tstamp.data, scan.tstamp,
2068 					sizeof(ni->ni_tstamp));
2069 			}
2070 			if (ni != NULL) {
2071 				ni->ni_rssi = rssi;
2072 				ni->ni_rstamp = rstamp;
2073 			}
2074 		}
2075 		break;
2076 	}
2077 
2078 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ: {
2079 		int is_tmpnode;
2080 
2081 		if (ic->ic_opmode == IEEE80211_M_STA ||
2082 		    ic->ic_state != IEEE80211_S_RUN) {
2083 			ic->ic_stats.is_rx_mgtdiscard++;
2084 			return;
2085 		}
2086 		if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2087 			/* frame must be directed */
2088 			ic->ic_stats.is_rx_mgtdiscard++;	/* XXX stat */
2089 			return;
2090 		}
2091 
2092 		/*
2093 		 * prreq frame format
2094 		 *	[tlv] ssid
2095 		 *	[tlv] supported rates
2096 		 *	[tlv] extended supported rates
2097 		 */
2098 		ssid = rates = xrates = NULL;
2099 		while (efrm - frm > 1) {
2100 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2101 			switch (*frm) {
2102 			case IEEE80211_ELEMID_SSID:
2103 				ssid = frm;
2104 				break;
2105 			case IEEE80211_ELEMID_RATES:
2106 				rates = frm;
2107 				break;
2108 			case IEEE80211_ELEMID_XRATES:
2109 				xrates = frm;
2110 				break;
2111 			}
2112 			frm += frm[1] + 2;
2113 		}
2114 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2115 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2116 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2117 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
2118 			IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
2119 			    wh, ieee80211_mgt_subtype_name[subtype >>
2120 				IEEE80211_FC0_SUBTYPE_SHIFT],
2121 			    "%s", "no ssid with ssid suppression enabled");
2122 			ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/
2123 			return;
2124 		}
2125 
2126 		is_tmpnode = 0;
2127 		if (ni == ic->ic_bss) {
2128 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
2129 				ni = ieee80211_tmp_node(ic, wh->i_addr2);
2130 				is_tmpnode = 1;
2131 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2132 				/*
2133 				 * XXX Cannot tell if the sender is operating
2134 				 * in ibss mode.  But we need a new node to
2135 				 * send the response so blindly add them to the
2136 				 * neighbor table.
2137 				 */
2138 				ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
2139 					wh->i_addr2);
2140 			}
2141 			if (ni == NULL)
2142 				return;
2143 		}
2144 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2145 		    "[%6D] recv probe req\n", wh->i_addr2, ":");
2146 		ni->ni_rssi = rssi;
2147 		ni->ni_rstamp = rstamp;
2148 
2149 		/*
2150 		 * Since temporary node's rate set will not be used,
2151 		 * there is no need to do rate negotiation for it.
2152 		 */
2153 		if (!is_tmpnode) {
2154 			ieee80211_setup_rates(ni, rates, xrates,
2155 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2156 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 0);
2157 		}
2158 
2159 		IEEE80211_SEND_MGMT(ic, ni,
2160 			IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
2161 		if (is_tmpnode) {
2162 			/*
2163 			 * Temporary node created just to send a
2164 			 * response, reclaim immediately.
2165 			 */
2166 			ieee80211_free_node(ni);
2167 		}
2168 		break;
2169 	}
2170 
2171 	case IEEE80211_FC0_SUBTYPE_AUTH: {
2172 		uint16_t algo, seq, status;
2173 		/*
2174 		 * auth frame format
2175 		 *	[2] algorithm
2176 		 *	[2] sequence
2177 		 *	[2] status
2178 		 *	[tlv*] challenge
2179 		 */
2180 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
2181 		algo   = le16toh(*(uint16_t *)frm);
2182 		seq    = le16toh(*(uint16_t *)(frm + 2));
2183 		status = le16toh(*(uint16_t *)(frm + 4));
2184 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2185 		    "[%6D] recv auth frame with algorithm %d seq %d\n",
2186 		    wh->i_addr2, ":", algo, seq);
2187 		/*
2188 		 * Consult the ACL policy module if setup.
2189 		 */
2190 		if (ic->ic_acl != NULL &&
2191 		    !ic->ic_acl->iac_check(ic, wh->i_addr2)) {
2192 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL,
2193 			    wh, "auth", "%s", "disallowed by ACL");
2194 			ic->ic_stats.is_rx_acl++;
2195 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2196 				IEEE80211_SEND_MGMT(ic, ni,
2197 				    IEEE80211_FC0_SUBTYPE_AUTH,
2198 				    (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
2199 			}
2200 			return;
2201 		}
2202 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
2203 			IEEE80211_DISCARD(ic,
2204 			    IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
2205 			    wh, "auth", "%s", "TKIP countermeasures enabled");
2206 			ic->ic_stats.is_rx_auth_countermeasures++;
2207 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2208 				IEEE80211_SEND_MGMT(ic, ni,
2209 					IEEE80211_FC0_SUBTYPE_AUTH,
2210 					IEEE80211_REASON_MIC_FAILURE);
2211 			}
2212 			return;
2213 		}
2214 		if (algo == IEEE80211_AUTH_ALG_SHARED)
2215 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi,
2216 			    rstamp, seq, status);
2217 		else if (algo == IEEE80211_AUTH_ALG_OPEN)
2218 			ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq,
2219 			    status);
2220 		else {
2221 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2222 			    wh, "auth", "unsupported alg %d", algo);
2223 			ic->ic_stats.is_rx_auth_unsupported++;
2224 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2225 				/* XXX not right */
2226 				IEEE80211_SEND_MGMT(ic, ni,
2227 					IEEE80211_FC0_SUBTYPE_AUTH,
2228 					(seq+1) | (IEEE80211_STATUS_ALG<<16));
2229 			}
2230 			return;
2231 		}
2232 		break;
2233 	}
2234 
2235 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2236 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
2237 		uint16_t capinfo, lintval;
2238 		struct ieee80211_rsnparms rsn;
2239 		uint8_t reason;
2240 
2241 		if (ic->ic_opmode != IEEE80211_M_HOSTAP ||
2242 		    ic->ic_state != IEEE80211_S_RUN) {
2243 			ic->ic_stats.is_rx_mgtdiscard++;
2244 			return;
2245 		}
2246 
2247 		if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
2248 			reassoc = 1;
2249 			resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
2250 		} else {
2251 			reassoc = 0;
2252 			resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
2253 		}
2254 		/*
2255 		 * asreq frame format
2256 		 *	[2] capability information
2257 		 *	[2] listen interval
2258 		 *	[6*] current AP address (reassoc only)
2259 		 *	[tlv] ssid
2260 		 *	[tlv] supported rates
2261 		 *	[tlv] extended supported rates
2262 		 *	[tlv] WPA or RSN
2263 		 */
2264 		IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4));
2265 		if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) {
2266 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2267 			    wh, ieee80211_mgt_subtype_name[subtype >>
2268 				IEEE80211_FC0_SUBTYPE_SHIFT],
2269 			    "%s", "wrong bssid");
2270 			ic->ic_stats.is_rx_assoc_bss++;
2271 			return;
2272 		}
2273 		capinfo = le16toh(*(uint16_t *)frm);	frm += 2;
2274 		lintval = le16toh(*(uint16_t *)frm);	frm += 2;
2275 		if (reassoc)
2276 			frm += 6;	/* ignore current AP info */
2277 		ssid = rates = xrates = wpa = wme = NULL;
2278 		while (efrm - frm > 1) {
2279 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2280 			switch (*frm) {
2281 			case IEEE80211_ELEMID_SSID:
2282 				ssid = frm;
2283 				break;
2284 			case IEEE80211_ELEMID_RATES:
2285 				rates = frm;
2286 				break;
2287 			case IEEE80211_ELEMID_XRATES:
2288 				xrates = frm;
2289 				break;
2290 			/* XXX verify only one of RSN and WPA ie's? */
2291 			case IEEE80211_ELEMID_RSN:
2292 				wpa = frm;
2293 				break;
2294 			case IEEE80211_ELEMID_VENDOR:
2295 				if (iswpaoui(frm))
2296 					wpa = frm;
2297 				else if (iswmeinfo(frm))
2298 					wme = frm;
2299 				/* XXX Atheros OUI support */
2300 				break;
2301 			}
2302 			frm += frm[1] + 2;
2303 		}
2304 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2305 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2306 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2307 
2308 		if (ni == ic->ic_bss) {
2309 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2310 			    "[%6D] deny %s request, sta not authenticated\n",
2311 			    wh->i_addr2, ":", reassoc ? "reassoc" : "assoc");
2312 			ieee80211_send_error(ic, ni, wh->i_addr2,
2313 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
2314 			    IEEE80211_REASON_ASSOC_NOT_AUTHED);
2315 			ic->ic_stats.is_rx_assoc_notauth++;
2316 			return;
2317 		}
2318 		/* assert right associstion security credentials */
2319 		if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) {
2320 			IEEE80211_DPRINTF(ic,
2321 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2322 			    "[%6D] no WPA/RSN IE in association request\n",
2323 			    wh->i_addr2, ":");
2324 			IEEE80211_SEND_MGMT(ic, ni,
2325 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
2326 			    IEEE80211_REASON_RSN_REQUIRED);
2327 			ieee80211_node_leave(ic, ni);
2328 			/* XXX distinguish WPA/RSN? */
2329 			ic->ic_stats.is_rx_assoc_badwpaie++;
2330 			return;
2331 		}
2332 		if (wpa != NULL) {
2333 			/*
2334 			 * Parse WPA information element.  Note that
2335 			 * we initialize the param block from the node
2336 			 * state so that information in the IE overrides
2337 			 * our defaults.  The resulting parameters are
2338 			 * installed below after the association is assured.
2339 			 */
2340 			rsn = ni->ni_rsn;
2341 			if (wpa[0] != IEEE80211_ELEMID_RSN)
2342 				reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh);
2343 			else
2344 				reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh);
2345 			if (reason != 0) {
2346 				IEEE80211_SEND_MGMT(ic, ni,
2347 				    IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
2348 				ieee80211_node_leave(ic, ni);
2349 				/* XXX distinguish WPA/RSN? */
2350 				ic->ic_stats.is_rx_assoc_badwpaie++;
2351 				return;
2352 			}
2353 			IEEE80211_DPRINTF(ic,
2354 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2355 			    "[%6D] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n",
2356 			    wh->i_addr2, ":",
2357 			    wpa[0] != IEEE80211_ELEMID_RSN ?  "WPA" : "RSN",
2358 			    rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen,
2359 			    rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen,
2360 			    rsn.rsn_keymgmt, rsn.rsn_caps);
2361 		}
2362 		/* discard challenge after association */
2363 		if (ni->ni_challenge != NULL) {
2364 			FREE(ni->ni_challenge, M_DEVBUF);
2365 			ni->ni_challenge = NULL;
2366 		}
2367 		/* NB: 802.11 spec says to ignore station's privacy bit */
2368 		if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2369 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2370 			    "[%6D] deny %s request, capability mismatch 0x%x\n",
2371 			    wh->i_addr2, ":",
2372 			    reassoc ? "reassoc" : "assoc", capinfo);
2373 			IEEE80211_SEND_MGMT(ic, ni, resp,
2374 				IEEE80211_STATUS_CAPINFO);
2375 			ieee80211_node_leave(ic, ni);
2376 			ic->ic_stats.is_rx_assoc_capmismatch++;
2377 			return;
2378 		}
2379 		rate = ieee80211_setup_rates(ni, rates, xrates,
2380 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2381 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 0);
2382 		if (rate & IEEE80211_RATE_BASIC) {
2383 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2384 			    "[%6D] deny %s request, rate set mismatch\n",
2385 			    wh->i_addr2, ":",
2386 			    reassoc ? "reassoc" : "assoc");
2387 			IEEE80211_SEND_MGMT(ic, ni, resp,
2388 				IEEE80211_STATUS_BASIC_RATE);
2389 			ieee80211_node_leave(ic, ni);
2390 			ic->ic_stats.is_rx_assoc_norate++;
2391 			return;
2392 		}
2393 		ni->ni_rssi = rssi;
2394 		ni->ni_rstamp = rstamp;
2395 		ni->ni_intval = lintval;
2396 		ni->ni_capinfo = capinfo;
2397 		ni->ni_chan = ic->ic_bss->ni_chan;
2398 		ni->ni_fhdwell = ic->ic_bss->ni_fhdwell;
2399 		ni->ni_fhindex = ic->ic_bss->ni_fhindex;
2400 		if (wpa != NULL) {
2401 			/*
2402 			 * Record WPA/RSN parameters for station, mark
2403 			 * node as using WPA and record information element
2404 			 * for applications that require it.
2405 			 */
2406 			ni->ni_rsn = rsn;
2407 			ieee80211_saveie(&ni->ni_wpa_ie, wpa);
2408 		} else if (ni->ni_wpa_ie != NULL) {
2409 			/*
2410 			 * Flush any state from a previous association.
2411 			 */
2412 			FREE(ni->ni_wpa_ie, M_DEVBUF);
2413 			ni->ni_wpa_ie = NULL;
2414 		}
2415 		if (wme != NULL) {
2416 			/*
2417 			 * Record WME parameters for station, mark node
2418 			 * as capable of QoS and record information
2419 			 * element for applications that require it.
2420 			 */
2421 			ieee80211_saveie(&ni->ni_wme_ie, wme);
2422 			ni->ni_flags |= IEEE80211_NODE_QOS;
2423 		} else if (ni->ni_wme_ie != NULL) {
2424 			/*
2425 			 * Flush any state from a previous association.
2426 			 */
2427 			FREE(ni->ni_wme_ie, M_DEVBUF);
2428 			ni->ni_wme_ie = NULL;
2429 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
2430 		}
2431 		ieee80211_deliver_l2uf(ni);
2432 		ieee80211_node_join(ic, ni, resp);
2433 		break;
2434 	}
2435 
2436 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2437 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
2438 		uint16_t capinfo, associd;
2439 		uint16_t status;
2440 
2441 		if (ic->ic_opmode != IEEE80211_M_STA ||
2442 		    ic->ic_state != IEEE80211_S_ASSOC) {
2443 			ic->ic_stats.is_rx_mgtdiscard++;
2444 			return;
2445 		}
2446 
2447 		/*
2448 		 * asresp frame format
2449 		 *	[2] capability information
2450 		 *	[2] status
2451 		 *	[2] association ID
2452 		 *	[tlv] supported rates
2453 		 *	[tlv] extended supported rates
2454 		 *	[tlv] WME
2455 		 */
2456 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
2457 		ni = ic->ic_bss;
2458 		capinfo = le16toh(*(uint16_t *)frm);
2459 		frm += 2;
2460 		status = le16toh(*(uint16_t *)frm);
2461 		frm += 2;
2462 		if (status != 0) {
2463 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2464 			    "[%6D] %sassoc failed (reason %d)\n",
2465 			    wh->i_addr2, ":",
2466 			    ISREASSOC(subtype) ?  "re" : "", status);
2467 			if (ni != ic->ic_bss)	/* XXX never true? */
2468 				ni->ni_fails++;
2469 			ic->ic_stats.is_rx_auth_fail++;	/* XXX */
2470 			return;
2471 		}
2472 		associd = le16toh(*(uint16_t *)frm);
2473 		frm += 2;
2474 
2475 		rates = xrates = wpa = wme = NULL;
2476 		while (efrm - frm > 1) {
2477 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2478 			switch (*frm) {
2479 			case IEEE80211_ELEMID_RATES:
2480 				rates = frm;
2481 				break;
2482 			case IEEE80211_ELEMID_XRATES:
2483 				xrates = frm;
2484 				break;
2485 			case IEEE80211_ELEMID_VENDOR:
2486 				if (iswmeoui(frm))
2487 					wme = frm;
2488 				/* XXX Atheros OUI support */
2489 				break;
2490 			}
2491 			frm += frm[1] + 2;
2492 		}
2493 
2494 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2495 		rate = ieee80211_setup_rates(ni, rates, xrates,
2496 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2497 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 1);
2498 		if (rate & IEEE80211_RATE_BASIC) {
2499 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2500 			    "[%6D] %sassoc failed (rate set mismatch)\n",
2501 			    wh->i_addr2, ":",
2502 			    ISREASSOC(subtype) ?  "re" : "");
2503 			if (ni != ic->ic_bss)	/* XXX never true? */
2504 				ni->ni_fails++;
2505 			ic->ic_stats.is_rx_assoc_norate++;
2506 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
2507 			return;
2508 		}
2509 
2510 		ni->ni_capinfo = capinfo;
2511 		ni->ni_associd = associd;
2512 		if (wme != NULL &&
2513 		    ieee80211_parse_wmeparams(ic, wme, wh) >= 0) {
2514 			ni->ni_flags |= IEEE80211_NODE_QOS;
2515 			ieee80211_wme_updateparams(ic);
2516 		} else
2517 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
2518 		/*
2519 		 * Configure state now that we are associated.
2520 		 *
2521 		 * XXX may need different/additional driver callbacks?
2522 		 */
2523 		ieee80211_update_shpreamble(ic, ni);
2524 		ieee80211_set_shortslottime(ic,
2525 			ic->ic_curmode == IEEE80211_MODE_11A ||
2526 			(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2527 		/*
2528 		 * Honor ERP protection.
2529 		 *
2530 		 * NB: ni_erp should zero for non-11g operation.
2531 		 * XXX check ic_curmode anyway?
2532 		 */
2533 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
2534 		    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2535 			ic->ic_flags |= IEEE80211_F_USEPROT;
2536 		else
2537 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
2538 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2539 		    "[%6D] %sassoc success: %s preamble, %s slot time%s%s\n",
2540 		    wh->i_addr2, ":",
2541 		    ISREASSOC(subtype) ? "re" : "",
2542 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
2543 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
2544 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
2545 		    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : ""
2546 		);
2547 		IEEE80211_PRINT_NODERATES(ic, ni, IEEE80211_MSG_ASSOC);
2548 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
2549 		break;
2550 	}
2551 
2552 	case IEEE80211_FC0_SUBTYPE_DEAUTH: {
2553 		uint16_t reason;
2554 
2555 		if (ic->ic_state == IEEE80211_S_SCAN) {
2556 			ic->ic_stats.is_rx_mgtdiscard++;
2557 			return;
2558 		}
2559 		/*
2560 		 * deauth frame format
2561 		 *	[2] reason
2562 		 */
2563 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
2564 		reason = le16toh(*(uint16_t *)frm);
2565 		ic->ic_stats.is_rx_deauth++;
2566 		IEEE80211_NODE_STAT(ni, rx_deauth);
2567 
2568 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2569 		    "[%6D] recv deauthenticate (reason %d)\n",
2570 		    ni->ni_macaddr, ":", reason);
2571 		switch (ic->ic_opmode) {
2572 		case IEEE80211_M_STA:
2573 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
2574 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2575 			break;
2576 		case IEEE80211_M_HOSTAP:
2577 			if (ni != ic->ic_bss)
2578 				ieee80211_node_leave(ic, ni);
2579 			break;
2580 		default:
2581 			ic->ic_stats.is_rx_mgtdiscard++;
2582 			break;
2583 		}
2584 		break;
2585 	}
2586 
2587 	case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2588 		uint16_t reason;
2589 
2590 		if (ic->ic_state != IEEE80211_S_RUN &&
2591 		    ic->ic_state != IEEE80211_S_ASSOC &&
2592 		    ic->ic_state != IEEE80211_S_AUTH) {
2593 			ic->ic_stats.is_rx_mgtdiscard++;
2594 			return;
2595 		}
2596 		/*
2597 		 * disassoc frame format
2598 		 *	[2] reason
2599 		 */
2600 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
2601 		reason = le16toh(*(uint16_t *)frm);
2602 		ic->ic_stats.is_rx_disassoc++;
2603 		IEEE80211_NODE_STAT(ni, rx_disassoc);
2604 
2605 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2606 		    "[%6D] recv disassociate (reason %d)\n",
2607 		    ni->ni_macaddr, ":", reason);
2608 		switch (ic->ic_opmode) {
2609 		case IEEE80211_M_STA:
2610 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
2611 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2612 			break;
2613 		case IEEE80211_M_HOSTAP:
2614 			if (ni != ic->ic_bss)
2615 				ieee80211_node_leave(ic, ni);
2616 			break;
2617 		default:
2618 			ic->ic_stats.is_rx_mgtdiscard++;
2619 			break;
2620 		}
2621 		break;
2622 	}
2623 	default:
2624 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2625 		     wh, "mgt", "subtype 0x%x not handled", subtype);
2626 		ic->ic_stats.is_rx_badsubtype++;
2627 		break;
2628 	}
2629 #undef ISREASSOC
2630 #undef ISPROBE
2631 }
2632 #undef IEEE80211_VERIFY_LENGTH
2633 #undef IEEE80211_VERIFY_ELEMENT
2634 
2635 /*
2636  * Handle station power-save state change.
2637  */
2638 static void
2639 ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable)
2640 {
2641 	struct ieee80211com *ic = ni->ni_ic;
2642 	struct mbuf *m;
2643 
2644 	ASSERT_SERIALIZED(ic->ic_ifp->if_serializer);
2645 
2646 	if (enable) {
2647 		if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0)
2648 			ic->ic_ps_sta++;
2649 		ni->ni_flags |= IEEE80211_NODE_PWR_MGT;
2650 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2651 		    "[%6D] power save mode on, %u sta's in ps mode\n",
2652 		    ni->ni_macaddr, ":", ic->ic_ps_sta);
2653 		return;
2654 	}
2655 
2656 	if (ni->ni_flags & IEEE80211_NODE_PWR_MGT)
2657 		ic->ic_ps_sta--;
2658 	ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT;
2659 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2660 	    "[%6D] power save mode off, %u sta's in ps mode\n",
2661 	    ni->ni_macaddr, ":", ic->ic_ps_sta);
2662 	/* XXX if no stations in ps mode, flush mc frames */
2663 
2664 	/*
2665 	 * Flush queued unicast frames.
2666 	 */
2667 	if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) {
2668 		if (ic->ic_set_tim != NULL)
2669 			ic->ic_set_tim(ni, 0);		/* just in case */
2670 		return;
2671 	}
2672 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2673 	    "[%6D] flush ps queue, %u packets queued\n",
2674 	    ni->ni_macaddr, ":", IEEE80211_NODE_SAVEQ_QLEN(ni));
2675 	for (;;) {
2676 		int qlen;
2677 
2678 		IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
2679 		if (m == NULL)
2680 			break;
2681 		/*
2682 		 * If this is the last packet, turn off the TIM bit.
2683 		 * If there are more packets, set the more packets bit
2684 		 * in the mbuf so ieee80211_encap will mark the 802.11
2685 		 * head to indicate more data frames will follow.
2686 		 */
2687 		if (qlen != 0)
2688 			m->m_flags |= M_MORE_DATA;
2689 		/* XXX need different driver interface */
2690 		/* XXX bypasses q max */
2691 		/* XXX bypasses ALTQ */
2692 		ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL);
2693 	}
2694 	if (ic->ic_set_tim != NULL)
2695 		ic->ic_set_tim(ni, 0);
2696 }
2697 
2698 /*
2699  * Process a received ps-poll frame.
2700  */
2701 static void
2702 ieee80211_recv_pspoll(struct ieee80211com *ic,
2703 	struct ieee80211_node *ni, struct mbuf *m0)
2704 {
2705 	struct ieee80211_frame_min *wh;
2706 	struct mbuf *m;
2707 	uint16_t aid;
2708 	int qlen;
2709 
2710 	ASSERT_SERIALIZED(ic->ic_ifp->if_serializer);
2711 
2712 	wh = mtod(m0, struct ieee80211_frame_min *);
2713 	if (ni->ni_associd == 0) {
2714 		IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2715 		    (struct ieee80211_frame *) wh, "ps-poll",
2716 		    "%s", "unassociated station");
2717 		ic->ic_stats.is_ps_unassoc++;
2718 		IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2719 			IEEE80211_REASON_NOT_ASSOCED);
2720 		return;
2721 	}
2722 
2723 	aid = le16toh(*(uint16_t *)wh->i_dur);
2724 	if (aid != ni->ni_associd) {
2725 		IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2726 		    (struct ieee80211_frame *) wh, "ps-poll",
2727 		    "aid mismatch: sta aid 0x%x poll aid 0x%x",
2728 		    ni->ni_associd, aid);
2729 		ic->ic_stats.is_ps_badaid++;
2730 		IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2731 			IEEE80211_REASON_NOT_ASSOCED);
2732 		return;
2733 	}
2734 
2735 	/* Okay, take the first queued packet and put it out... */
2736 	IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
2737 	if (m == NULL) {
2738 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2739 		    "[%6D] recv ps-poll, but queue empty\n",
2740 		    wh->i_addr2, ":");
2741 		ieee80211_send_nulldata(ieee80211_ref_node(ni));
2742 		ic->ic_stats.is_ps_qempty++;	/* XXX node stat */
2743 		if (ic->ic_set_tim != NULL)
2744 			ic->ic_set_tim(ni, 0);	/* just in case */
2745 		return;
2746 	}
2747 	/*
2748 	 * If there are more packets, set the more packets bit
2749 	 * in the packet dispatched to the station; otherwise
2750 	 * turn off the TIM bit.
2751 	 */
2752 	if (qlen != 0) {
2753 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2754 		    "[%6D] recv ps-poll, send packet, %u still queued\n",
2755 		    ni->ni_macaddr, ":", qlen);
2756 		m->m_flags |= M_MORE_DATA;
2757 	} else {
2758 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2759 		    "[%6D] recv ps-poll, send packet, queue empty\n",
2760 		    ni->ni_macaddr, ":");
2761 		if (ic->ic_set_tim != NULL)
2762 			ic->ic_set_tim(ni, 0);
2763 	}
2764 	m->m_flags |= M_PWR_SAV;			/* bypass PS handling */
2765 	ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL);	/* XXX bypasses ALTQ */
2766 }
2767 
2768 #ifdef IEEE80211_DEBUG
2769 /*
2770  * Debugging support.
2771  */
2772 
2773 /*
2774  * Return the bssid of a frame.
2775  */
2776 static const uint8_t *
2777 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh)
2778 {
2779 	if (ic->ic_opmode == IEEE80211_M_STA)
2780 		return wh->i_addr2;
2781 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
2782 		return wh->i_addr1;
2783 	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
2784 		return wh->i_addr1;
2785 	return wh->i_addr3;
2786 }
2787 
2788 void
2789 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...)
2790 {
2791 	char buf[128];		/* XXX */
2792 	__va_list ap;
2793 
2794 	__va_start(ap, fmt);
2795 	kvsnprintf(buf, sizeof(buf), fmt, ap);
2796 	__va_end(ap);
2797 
2798 	if_printf(ic->ic_ifp, "%s", buf);	/* NB: no \n */
2799 }
2800 
2801 void
2802 ieee80211_note_frame(struct ieee80211com *ic,
2803 	const struct ieee80211_frame *wh,
2804 	const char *fmt, ...)
2805 {
2806 	char buf[128];		/* XXX */
2807 	__va_list ap;
2808 
2809 	__va_start(ap, fmt);
2810 	kvsnprintf(buf, sizeof(buf), fmt, ap);
2811 	__va_end(ap);
2812 	if_printf(ic->ic_ifp, "[%6D] %s\n",
2813 		ieee80211_getbssid(ic, wh), ":", buf);
2814 }
2815 
2816 void
2817 ieee80211_note_mac(struct ieee80211com *ic,
2818 	const uint8_t mac[IEEE80211_ADDR_LEN],
2819 	const char *fmt, ...)
2820 {
2821 	char buf[128];		/* XXX */
2822 	__va_list ap;
2823 
2824 	__va_start(ap, fmt);
2825 	kvsnprintf(buf, sizeof(buf), fmt, ap);
2826 	__va_end(ap);
2827 	if_printf(ic->ic_ifp, "[%6D] %s\n", mac, ":", buf);
2828 }
2829 
2830 static void
2831 ieee80211_discard_frame(struct ieee80211com *ic,
2832 	const struct ieee80211_frame *wh,
2833 	const char *type, const char *fmt, ...)
2834 {
2835 	__va_list ap;
2836 
2837 	kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname,
2838 		ieee80211_getbssid(ic, wh), ":");
2839 	if (type != NULL)
2840 		kprintf("%s frame, ", type);
2841 	else
2842 		kprintf("frame, ");
2843 	__va_start(ap, fmt);
2844 	kvprintf(fmt, ap);
2845 	__va_end(ap);
2846 	kprintf("\n");
2847 }
2848 
2849 static void
2850 ieee80211_discard_ie(struct ieee80211com *ic,
2851 	const struct ieee80211_frame *wh,
2852 	const char *type, const char *fmt, ...)
2853 {
2854 	__va_list ap;
2855 
2856 	kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname,
2857 		ieee80211_getbssid(ic, wh), ":");
2858 	if (type != NULL)
2859 		kprintf("%s information element, ", type);
2860 	else
2861 		kprintf("information element, ");
2862 	__va_start(ap, fmt);
2863 	kvprintf(fmt, ap);
2864 	__va_end(ap);
2865 	kprintf("\n");
2866 }
2867 
2868 static void
2869 ieee80211_discard_mac(struct ieee80211com *ic,
2870 	const uint8_t mac[IEEE80211_ADDR_LEN],
2871 	const char *type, const char *fmt, ...)
2872 {
2873 	__va_list ap;
2874 
2875 	kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname, mac, ":");
2876 	if (type != NULL)
2877 		kprintf("%s frame, ", type);
2878 	else
2879 		kprintf("frame, ");
2880 	__va_start(ap, fmt);
2881 	kvprintf(fmt, ap);
2882 	__va_end(ap);
2883 	kprintf("\n");
2884 }
2885 #endif /* IEEE80211_DEBUG */
2886