1 /* 2 * Copyright (c) 2001 Atsushi Onoe 3 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * Alternatively, this software may be distributed under the terms of the 18 * GNU General Public License ("GPL") version 2 as published by the Free 19 * Software Foundation. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 * 32 * $FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.62.2.14 2006/09/02 15:16:12 sam Exp $ 33 * $DragonFly: src/sys/netproto/802_11/wlan/ieee80211_input.c,v 1.14 2007/01/01 08:51:45 sephe Exp $ 34 */ 35 36 #include <sys/param.h> 37 #include <sys/systm.h> 38 #include <sys/mbuf.h> 39 #include <sys/malloc.h> 40 #include <sys/endian.h> 41 #include <sys/kernel.h> 42 #include <sys/serialize.h> 43 44 #include <sys/socket.h> 45 46 #include <net/if.h> 47 #include <net/if_arp.h> 48 #include <net/ifq_var.h> 49 #include <net/if_media.h> 50 #include <net/ethernet.h> 51 #include <net/if_llc.h> 52 #include <net/vlan/if_vlan_var.h> 53 54 #include <netproto/802_11/ieee80211_var.h> 55 56 #include <net/bpf.h> 57 58 #ifdef IEEE80211_DEBUG 59 #include <machine/stdarg.h> 60 61 /* 62 * Decide if a received management frame should be 63 * printed when debugging is enabled. This filters some 64 * of the less interesting frames that come frequently 65 * (e.g. beacons). 66 */ 67 static __inline int 68 doprint(struct ieee80211com *ic, int subtype) 69 { 70 switch (subtype) { 71 case IEEE80211_FC0_SUBTYPE_BEACON: 72 return (ic->ic_flags & IEEE80211_F_SCAN); 73 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 74 return (ic->ic_opmode == IEEE80211_M_IBSS); 75 } 76 return 1; 77 } 78 79 /* 80 * Emit a debug message about discarding a frame or information 81 * element. One format is for extracting the mac address from 82 * the frame header; the other is for when a header is not 83 * available or otherwise appropriate. 84 */ 85 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do { \ 86 if ((_ic)->ic_debug & (_m)) \ 87 ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\ 88 } while (0) 89 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do { \ 90 if ((_ic)->ic_debug & (_m)) \ 91 ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\ 92 } while (0) 93 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do { \ 94 if ((_ic)->ic_debug & (_m)) \ 95 ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\ 96 } while (0) 97 98 static const uint8_t *ieee80211_getbssid(struct ieee80211com *, 99 const struct ieee80211_frame *); 100 static void ieee80211_discard_frame(struct ieee80211com *, 101 const struct ieee80211_frame *, const char *type, const char *fmt, ...); 102 static void ieee80211_discard_ie(struct ieee80211com *, 103 const struct ieee80211_frame *, const char *type, const char *fmt, ...); 104 static void ieee80211_discard_mac(struct ieee80211com *, 105 const uint8_t mac[IEEE80211_ADDR_LEN], const char *type, 106 const char *fmt, ...); 107 #else 108 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) 109 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) 110 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) 111 #endif /* IEEE80211_DEBUG */ 112 113 static struct mbuf *ieee80211_defrag(struct ieee80211com *, 114 struct ieee80211_node *, struct mbuf *, int); 115 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int); 116 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *, 117 const uint8_t *mac, int subtype, int arg); 118 static void ieee80211_deliver_data(struct ieee80211com *, 119 struct ieee80211_node *, struct mbuf *); 120 static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable); 121 static void ieee80211_recv_pspoll(struct ieee80211com *, 122 struct ieee80211_node *, struct mbuf *); 123 124 /* 125 * Process a received frame. The node associated with the sender 126 * should be supplied. If nothing was found in the node table then 127 * the caller is assumed to supply a reference to ic_bss instead. 128 * The RSSI and a timestamp are also supplied. The RSSI data is used 129 * during AP scanning to select a AP to associate with; it can have 130 * any units so long as values have consistent units and higher values 131 * mean ``better signal''. The receive timestamp is currently not used 132 * by the 802.11 layer. 133 */ 134 int 135 ieee80211_input(struct ieee80211com *ic, struct mbuf *m, 136 struct ieee80211_node *ni, int rssi, uint32_t rstamp) 137 { 138 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0) 139 #define HAS_SEQ(type) ((type & 0x4) == 0) 140 struct ifnet *ifp = ic->ic_ifp; 141 struct ieee80211_frame *wh; 142 struct ieee80211_key *key; 143 struct ether_header *eh; 144 int hdrspace; 145 uint8_t dir, type, subtype; 146 uint8_t *bssid; 147 uint16_t rxseq; 148 149 ASSERT_SERIALIZED(ifp->if_serializer); 150 151 KASSERT(ni != NULL, ("null node")); 152 ni->ni_inact = ni->ni_inact_reload; 153 154 type = -1; /* undefined */ 155 /* 156 * In monitor mode, send everything directly to bpf. 157 * XXX may want to include the CRC 158 */ 159 if (ic->ic_opmode == IEEE80211_M_MONITOR) 160 goto out; 161 162 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) { 163 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 164 ni->ni_macaddr, NULL, 165 "too short (1): len %u", m->m_pkthdr.len); 166 ic->ic_stats.is_rx_tooshort++; 167 goto out; 168 } 169 /* 170 * Bit of a cheat here, we use a pointer for a 3-address 171 * frame format but don't reference fields past outside 172 * ieee80211_frame_min w/o first validating the data is 173 * present. 174 */ 175 wh = mtod(m, struct ieee80211_frame *); 176 177 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) != 178 IEEE80211_FC0_VERSION_0) { 179 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 180 ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]); 181 ic->ic_stats.is_rx_badversion++; 182 goto err; 183 } 184 185 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 186 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 187 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 188 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) { 189 switch (ic->ic_opmode) { 190 case IEEE80211_M_STA: 191 bssid = wh->i_addr2; 192 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) { 193 /* not interested in */ 194 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 195 bssid, NULL, "%s", "not to bss"); 196 ic->ic_stats.is_rx_wrongbss++; 197 goto out; 198 } 199 break; 200 case IEEE80211_M_IBSS: 201 case IEEE80211_M_AHDEMO: 202 case IEEE80211_M_HOSTAP: 203 if (dir != IEEE80211_FC1_DIR_NODS) 204 bssid = wh->i_addr1; 205 else if (type == IEEE80211_FC0_TYPE_CTL) 206 bssid = wh->i_addr1; 207 else { 208 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 209 IEEE80211_DISCARD_MAC(ic, 210 IEEE80211_MSG_ANY, ni->ni_macaddr, 211 NULL, "too short (2): len %u", 212 m->m_pkthdr.len); 213 ic->ic_stats.is_rx_tooshort++; 214 goto out; 215 } 216 bssid = wh->i_addr3; 217 } 218 if (type != IEEE80211_FC0_TYPE_DATA) 219 break; 220 /* 221 * Data frame, validate the bssid. 222 */ 223 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) && 224 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) { 225 /* not interested in */ 226 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 227 bssid, NULL, "%s", "not to bss"); 228 ic->ic_stats.is_rx_wrongbss++; 229 goto out; 230 } 231 /* 232 * For adhoc mode we cons up a node when it doesn't 233 * exist. This should probably done after an ACL check. 234 */ 235 if (ni == ic->ic_bss && 236 ic->ic_opmode != IEEE80211_M_HOSTAP && 237 !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 238 /* 239 * Fake up a node for this newly 240 * discovered member of the IBSS. 241 */ 242 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 243 wh->i_addr2); 244 if (ni == NULL) { 245 /* NB: stat kept for alloc failure */ 246 goto err; 247 } 248 } 249 break; 250 default: 251 goto out; 252 } 253 ni->ni_rssi = rssi; 254 ni->ni_rstamp = rstamp; 255 if (HAS_SEQ(type)) { 256 uint8_t tid; 257 if (IEEE80211_QOS_HAS_SEQ(wh)) { 258 tid = ((struct ieee80211_qosframe *)wh)-> 259 i_qos[0] & IEEE80211_QOS_TID; 260 if (TID_TO_WME_AC(tid) >= WME_AC_VI) 261 ic->ic_wme.wme_hipri_traffic++; 262 tid++; 263 } else 264 tid = 0; 265 rxseq = le16toh(*(uint16_t *)wh->i_seq); 266 if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) && 267 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) { 268 /* duplicate, discard */ 269 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 270 bssid, "duplicate", 271 "seqno <%u,%u> fragno <%u,%u> tid %u", 272 rxseq >> IEEE80211_SEQ_SEQ_SHIFT, 273 ni->ni_rxseqs[tid] >> 274 IEEE80211_SEQ_SEQ_SHIFT, 275 rxseq & IEEE80211_SEQ_FRAG_MASK, 276 ni->ni_rxseqs[tid] & 277 IEEE80211_SEQ_FRAG_MASK, 278 tid); 279 ic->ic_stats.is_rx_dup++; 280 IEEE80211_NODE_STAT(ni, rx_dup); 281 goto out; 282 } 283 ni->ni_rxseqs[tid] = rxseq; 284 } 285 } 286 287 switch (type) { 288 case IEEE80211_FC0_TYPE_DATA: 289 hdrspace = ieee80211_hdrspace(ic, wh); 290 if (m->m_len < hdrspace && 291 (m = m_pullup(m, hdrspace)) == NULL) { 292 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 293 ni->ni_macaddr, NULL, 294 "data too short: expecting %u", hdrspace); 295 ic->ic_stats.is_rx_tooshort++; 296 goto out; /* XXX */ 297 } 298 switch (ic->ic_opmode) { 299 case IEEE80211_M_STA: 300 if (dir != IEEE80211_FC1_DIR_FROMDS) { 301 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 302 wh, "data", "%s", "unknown dir 0x%x", dir); 303 ic->ic_stats.is_rx_wrongdir++; 304 goto out; 305 } 306 if ((ifp->if_flags & IFF_SIMPLEX) && 307 IEEE80211_IS_MULTICAST(wh->i_addr1) && 308 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) { 309 /* 310 * In IEEE802.11 network, multicast packet 311 * sent from me is broadcasted from AP. 312 * It should be silently discarded for 313 * SIMPLEX interface. 314 */ 315 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 316 wh, NULL, "%s", "multicast echo"); 317 ic->ic_stats.is_rx_mcastecho++; 318 goto out; 319 } 320 break; 321 case IEEE80211_M_IBSS: 322 case IEEE80211_M_AHDEMO: 323 if (dir != IEEE80211_FC1_DIR_NODS) { 324 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 325 wh, "data", "%s", "unknown dir 0x%x", dir); 326 ic->ic_stats.is_rx_wrongdir++; 327 goto out; 328 } 329 /* XXX no power-save support */ 330 break; 331 case IEEE80211_M_HOSTAP: 332 if (dir != IEEE80211_FC1_DIR_TODS) { 333 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 334 wh, "data", "%s", "unknown dir 0x%x", dir); 335 ic->ic_stats.is_rx_wrongdir++; 336 goto out; 337 } 338 /* check if source STA is associated */ 339 if (ni == ic->ic_bss) { 340 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 341 wh, "data", "%s", "unknown src"); 342 ieee80211_send_error(ic, ni, wh->i_addr2, 343 IEEE80211_FC0_SUBTYPE_DEAUTH, 344 IEEE80211_REASON_NOT_AUTHED); 345 ic->ic_stats.is_rx_notassoc++; 346 goto err; 347 } 348 if (ni->ni_associd == 0) { 349 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 350 wh, "data", "%s", "unassoc src"); 351 IEEE80211_SEND_MGMT(ic, ni, 352 IEEE80211_FC0_SUBTYPE_DISASSOC, 353 IEEE80211_REASON_NOT_ASSOCED); 354 ic->ic_stats.is_rx_notassoc++; 355 goto err; 356 } 357 358 /* 359 * Check for power save state change. 360 */ 361 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^ 362 (ni->ni_flags & IEEE80211_NODE_PWR_MGT))) 363 ieee80211_node_pwrsave(ni, 364 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT); 365 break; 366 default: 367 /* XXX here to keep compiler happy */ 368 goto out; 369 } 370 371 /* 372 * Handle privacy requirements. Note that we 373 * must not be preempted from here until after 374 * we (potentially) call ieee80211_crypto_demic; 375 * otherwise we may violate assumptions in the 376 * crypto cipher modules used to do delayed update 377 * of replay sequence numbers. 378 */ 379 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 380 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 381 /* 382 * Discard encrypted frames when privacy is off. 383 */ 384 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 385 wh, "WEP", "%s", "PRIVACY off"); 386 ic->ic_stats.is_rx_noprivacy++; 387 IEEE80211_NODE_STAT(ni, rx_noprivacy); 388 goto out; 389 } 390 key = ieee80211_crypto_decap(ic, ni, m, hdrspace); 391 if (key == NULL) { 392 /* NB: stats+msgs handled in crypto_decap */ 393 IEEE80211_NODE_STAT(ni, rx_wepfail); 394 goto out; 395 } 396 wh = mtod(m, struct ieee80211_frame *); 397 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 398 } else { 399 key = NULL; 400 } 401 402 /* 403 * Next up, any fragmentation. 404 */ 405 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 406 m = ieee80211_defrag(ic, ni, m, hdrspace); 407 if (m == NULL) { 408 /* Fragment dropped or frame not complete yet */ 409 goto out; 410 } 411 } 412 wh = NULL; /* no longer valid, catch any uses */ 413 414 /* 415 * Next strip any MSDU crypto bits. 416 */ 417 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) { 418 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 419 ni->ni_macaddr, "data", "%s", "demic error"); 420 ic->ic_stats.is_rx_demicfail++; 421 IEEE80211_NODE_STAT(ni, rx_demicfail); 422 goto out; 423 } 424 425 /* copy to listener after decrypt */ 426 if (ic->ic_rawbpf) 427 bpf_mtap(ic->ic_rawbpf, m); 428 429 /* 430 * Finally, strip the 802.11 header. 431 */ 432 m = ieee80211_decap(ic, m, hdrspace); 433 if (m == NULL) { 434 /* don't count Null data frames as errors */ 435 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA) 436 goto out; 437 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 438 ni->ni_macaddr, "data", "%s", "decap error"); 439 ic->ic_stats.is_rx_decap++; 440 IEEE80211_NODE_STAT(ni, rx_decap); 441 goto err; 442 } 443 eh = mtod(m, struct ether_header *); 444 if (!ieee80211_node_is_authorized(ni)) { 445 /* 446 * Deny any non-PAE frames received prior to 447 * authorization. For open/shared-key 448 * authentication the port is mark authorized 449 * after authentication completes. For 802.1x 450 * the port is not marked authorized by the 451 * authenticator until the handshake has completed. 452 */ 453 if (eh->ether_type != htons(ETHERTYPE_PAE)) { 454 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 455 eh->ether_shost, "data", 456 "unauthorized port: ether type 0x%x len %u", 457 eh->ether_type, m->m_pkthdr.len); 458 ic->ic_stats.is_rx_unauth++; 459 IEEE80211_NODE_STAT(ni, rx_unauth); 460 goto err; 461 } 462 } else { 463 /* 464 * When denying unencrypted frames, discard 465 * any non-PAE frames received without encryption. 466 */ 467 if ((ic->ic_flags & IEEE80211_F_DROPUNENC) && 468 key == NULL && 469 eh->ether_type != htons(ETHERTYPE_PAE)) { 470 /* 471 * Drop unencrypted frames. 472 */ 473 ic->ic_stats.is_rx_unencrypted++; 474 IEEE80211_NODE_STAT(ni, rx_unencrypted); 475 goto out; 476 } 477 } 478 ieee80211_deliver_data(ic, ni, m); 479 return IEEE80211_FC0_TYPE_DATA; 480 481 case IEEE80211_FC0_TYPE_MGT: 482 ic->ic_stats.is_rx_mgmt++; 483 IEEE80211_NODE_STAT(ni, rx_mgmt); 484 if (dir != IEEE80211_FC1_DIR_NODS) { 485 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 486 wh, "data", "%s", "unknown dir 0x%x", dir); 487 ic->ic_stats.is_rx_wrongdir++; 488 goto err; 489 } 490 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 491 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 492 ni->ni_macaddr, "mgt", "too short: len %u", 493 m->m_pkthdr.len); 494 ic->ic_stats.is_rx_tooshort++; 495 goto out; 496 } 497 #ifdef IEEE80211_DEBUG 498 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) || 499 ieee80211_msg_dumppkts(ic)) { 500 if_printf(ic->ic_ifp, "received %s from %6D rssi %d\n", 501 ieee80211_mgt_subtype_name[subtype >> 502 IEEE80211_FC0_SUBTYPE_SHIFT], 503 wh->i_addr2, ":", rssi); 504 } 505 #endif 506 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 507 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) { 508 /* 509 * Only shared key auth frames with a challenge 510 * should be encrypted, discard all others. 511 */ 512 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 513 wh, ieee80211_mgt_subtype_name[subtype >> 514 IEEE80211_FC0_SUBTYPE_SHIFT], 515 "%s", "WEP set but not permitted"); 516 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */ 517 goto out; 518 } 519 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 520 /* 521 * Discard encrypted frames when privacy is off. 522 */ 523 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 524 wh, "mgt", "%s", "WEP set but PRIVACY off"); 525 ic->ic_stats.is_rx_noprivacy++; 526 goto out; 527 } 528 hdrspace = ieee80211_hdrspace(ic, wh); 529 key = ieee80211_crypto_decap(ic, ni, m, hdrspace); 530 if (key == NULL) { 531 /* NB: stats+msgs handled in crypto_decap */ 532 goto out; 533 } 534 wh = mtod(m, struct ieee80211_frame *); 535 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 536 } 537 if (ic->ic_rawbpf) 538 bpf_mtap(ic->ic_rawbpf, m); 539 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp); 540 m_freem(m); 541 return type; 542 543 case IEEE80211_FC0_TYPE_CTL: 544 IEEE80211_NODE_STAT(ni, rx_ctrl); 545 ic->ic_stats.is_rx_ctl++; 546 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 547 switch (subtype) { 548 case IEEE80211_FC0_SUBTYPE_PS_POLL: 549 ieee80211_recv_pspoll(ic, ni, m); 550 break; 551 } 552 } 553 goto out; 554 default: 555 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 556 wh, NULL, "bad frame type 0x%x", type); 557 /* should not come here */ 558 break; 559 } 560 err: 561 ifp->if_ierrors++; 562 out: 563 if (m != NULL) { 564 if (ic->ic_rawbpf) 565 bpf_mtap(ic->ic_rawbpf, m); 566 m_freem(m); 567 } 568 return type; 569 #undef SEQ_LEQ 570 } 571 572 /* 573 * This function reassemble fragments. 574 */ 575 static struct mbuf * 576 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni, 577 struct mbuf *m, int hdrspace) 578 { 579 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 580 struct ieee80211_frame *lwh; 581 uint16_t rxseq; 582 uint8_t fragno; 583 uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG; 584 struct mbuf *mfrag; 585 586 KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?")); 587 588 rxseq = le16toh(*(uint16_t *)wh->i_seq); 589 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK; 590 591 /* Quick way out, if there's nothing to defragment */ 592 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL) 593 return m; 594 595 /* 596 * Remove frag to insure it doesn't get reaped by timer. 597 */ 598 if (ni->ni_table == NULL) { 599 /* 600 * Should never happen. If the node is orphaned (not in 601 * the table) then input packets should not reach here. 602 * Otherwise, a concurrent request that yanks the table 603 * should be blocked by other interlocking and/or by first 604 * shutting the driver down. Regardless, be defensive 605 * here and just bail 606 */ 607 /* XXX need msg+stat */ 608 m_freem(m); 609 return NULL; 610 } 611 mfrag = ni->ni_rxfrag[0]; 612 ni->ni_rxfrag[0] = NULL; 613 614 /* 615 * Validate new fragment is in order and 616 * related to the previous ones. 617 */ 618 if (mfrag != NULL) { 619 uint16_t last_rxseq; 620 621 lwh = mtod(mfrag, struct ieee80211_frame *); 622 last_rxseq = le16toh(*(uint16_t *)lwh->i_seq); 623 /* NB: check seq # and frag together */ 624 if (rxseq != last_rxseq+1 || 625 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) || 626 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { 627 /* 628 * Unrelated fragment or no space for it, 629 * clear current fragments. 630 */ 631 m_freem(mfrag); 632 mfrag = NULL; 633 } 634 } 635 636 if (mfrag == NULL) { 637 if (fragno != 0) { /* !first fragment, discard */ 638 ic->ic_stats.is_rx_defrag++; 639 IEEE80211_NODE_STAT(ni, rx_defrag); 640 m_freem(m); 641 return NULL; 642 } 643 mfrag = m; 644 } else { /* concatenate */ 645 m_adj(m, hdrspace); /* strip header */ 646 m_cat(mfrag, m); 647 /* NB: m_cat doesn't update the packet header */ 648 mfrag->m_pkthdr.len += m->m_pkthdr.len; 649 /* track last seqnum and fragno */ 650 lwh = mtod(mfrag, struct ieee80211_frame *); 651 *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq; 652 } 653 if (more_frag) { /* more to come, save */ 654 ni->ni_rxfragstamp = ticks; 655 ni->ni_rxfrag[0] = mfrag; 656 mfrag = NULL; 657 } 658 return mfrag; 659 } 660 661 static void 662 ieee80211_deliver_data(struct ieee80211com *ic, 663 struct ieee80211_node *ni, struct mbuf *m) 664 { 665 struct ether_header *eh = mtod(m, struct ether_header *); 666 struct ifnet *ifp = ic->ic_ifp; 667 668 /* 669 * Do accounting. 670 */ 671 ifp->if_ipackets++; 672 IEEE80211_NODE_STAT(ni, rx_data); 673 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len); 674 if (ETHER_IS_MULTICAST(eh->ether_dhost)) { 675 m->m_flags |= M_MCAST; /* XXX M_BCAST? */ 676 IEEE80211_NODE_STAT(ni, rx_mcast); 677 } else { 678 IEEE80211_NODE_STAT(ni, rx_ucast); 679 } 680 681 /* perform as a bridge within the AP */ 682 if (ic->ic_opmode == IEEE80211_M_HOSTAP && 683 (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) { 684 struct mbuf *m1 = NULL; 685 686 if (m->m_flags & M_MCAST) { 687 m1 = m_dup(m, MB_DONTWAIT); 688 if (m1 == NULL) 689 ifp->if_oerrors++; 690 else 691 m1->m_flags |= M_MCAST; 692 } else { 693 /* 694 * Check if the destination is known; if so 695 * and the port is authorized dispatch directly. 696 */ 697 struct ieee80211_node *sta = 698 ieee80211_find_node(&ic->ic_sta, eh->ether_dhost); 699 if (sta != NULL) { 700 if (ieee80211_node_is_authorized(sta)) { 701 /* 702 * Beware of sending to ourself; this 703 * needs to happen via the normal 704 * input path. 705 */ 706 if (sta != ic->ic_bss) { 707 m1 = m; 708 m = NULL; 709 } 710 } else { 711 ic->ic_stats.is_rx_unauth++; 712 IEEE80211_NODE_STAT(sta, rx_unauth); 713 } 714 ieee80211_free_node(sta); 715 } 716 } 717 if (m1 != NULL) { 718 /* XXX bypasses ALTQ */ 719 ifq_handoff(ifp, m1, NULL); 720 } 721 } 722 if (m != NULL) { 723 #ifdef FREEBSD_VLAN 724 if (ni->ni_vlan != 0) { 725 /* attach vlan tag */ 726 VLAN_INPUT_TAG_NEW(ifp, m, ni->ni_vlan); 727 if (m == NULL) 728 goto out; /* XXX goto err? */ 729 } 730 #endif 731 ifp->if_input(ifp, m); 732 } 733 return; 734 735 #ifdef FREEBSD_VLAN 736 out: 737 if (m != NULL) { 738 if (ic->ic_rawbpf) 739 bpf_mtap(ic->ic_rawbpf, m); 740 m_freem(m); 741 } 742 #endif 743 } 744 745 static struct mbuf * 746 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen) 747 { 748 struct ieee80211_qosframe_addr4 wh; /* Max size address frames */ 749 struct ether_header *eh; 750 struct llc *llc; 751 752 if (m->m_len < hdrlen + sizeof(*llc) && 753 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) { 754 /* XXX stat, msg */ 755 return NULL; 756 } 757 memcpy(&wh, mtod(m, caddr_t), hdrlen); 758 llc = (struct llc *)(mtod(m, caddr_t) + hdrlen); 759 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP && 760 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 && 761 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) { 762 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh)); 763 llc = NULL; 764 } else { 765 m_adj(m, hdrlen - sizeof(*eh)); 766 } 767 eh = mtod(m, struct ether_header *); 768 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) { 769 case IEEE80211_FC1_DIR_NODS: 770 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 771 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 772 break; 773 case IEEE80211_FC1_DIR_TODS: 774 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 775 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 776 break; 777 case IEEE80211_FC1_DIR_FROMDS: 778 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 779 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3); 780 break; 781 case IEEE80211_FC1_DIR_DSTODS: 782 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 783 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4); 784 break; 785 } 786 #ifdef ALIGNED_POINTER 787 if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) { 788 struct mbuf *n, *n0, **np; 789 caddr_t newdata; 790 int off, pktlen; 791 792 n0 = NULL; 793 np = &n0; 794 off = 0; 795 pktlen = m->m_pkthdr.len; 796 while (pktlen > off) { 797 if (n0 == NULL) { 798 MGETHDR(n, M_DONTWAIT, MT_DATA); 799 if (n == NULL) { 800 m_freem(m); 801 return NULL; 802 } 803 M_MOVE_PKTHDR(n, m); 804 n->m_len = MHLEN; 805 } else { 806 MGET(n, M_DONTWAIT, MT_DATA); 807 if (n == NULL) { 808 m_freem(m); 809 m_freem(n0); 810 return NULL; 811 } 812 n->m_len = MLEN; 813 } 814 if (pktlen - off >= MINCLSIZE) { 815 MCLGET(n, M_DONTWAIT); 816 if (n->m_flags & M_EXT) 817 n->m_len = n->m_ext.ext_size; 818 } 819 if (n0 == NULL) { 820 newdata = 821 (caddr_t)ALIGN(n->m_data + sizeof(*eh)) - 822 sizeof(*eh); 823 n->m_len -= newdata - n->m_data; 824 n->m_data = newdata; 825 } 826 if (n->m_len > pktlen - off) 827 n->m_len = pktlen - off; 828 m_copydata(m, off, n->m_len, mtod(n, caddr_t)); 829 off += n->m_len; 830 *np = n; 831 np = &n->m_next; 832 } 833 m_freem(m); 834 m = n0; 835 } 836 #endif /* ALIGNED_POINTER */ 837 if (llc != NULL) { 838 eh = mtod(m, struct ether_header *); 839 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh)); 840 } 841 return m; 842 } 843 844 /* 845 * Install received rate set information in the node's state block. 846 */ 847 int 848 ieee80211_setup_rates(struct ieee80211_node *ni, 849 const uint8_t *rates, const uint8_t *xrates, int flags, int join) 850 { 851 struct ieee80211com *ic = ni->ni_ic; 852 struct ieee80211_rateset *rs = &ni->ni_rates; 853 854 memset(rs, 0, sizeof(*rs)); 855 rs->rs_nrates = rates[1]; 856 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates); 857 if (xrates != NULL) { 858 uint8_t nxrates; 859 /* 860 * Tack on 11g extended supported rate element. 861 */ 862 nxrates = xrates[1]; 863 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) { 864 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates; 865 IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE, 866 "[%6D] extended rate set too large;" 867 " only using %u of %u rates\n", 868 ni->ni_macaddr, ":", nxrates, xrates[1]); 869 ic->ic_stats.is_rx_rstoobig++; 870 } 871 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates); 872 rs->rs_nrates += nxrates; 873 } 874 return ieee80211_fix_rate(ni, flags, join); 875 } 876 877 static void 878 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh, 879 struct ieee80211_node *ni, int rssi, uint32_t rstamp, uint16_t seq, 880 uint16_t status) 881 { 882 883 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) { 884 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 885 ni->ni_macaddr, "open auth", 886 "bad sta auth mode %u", ni->ni_authmode); 887 ic->ic_stats.is_rx_bad_auth++; /* XXX */ 888 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 889 /* XXX hack to workaround calling convention */ 890 ieee80211_send_error(ic, ni, wh->i_addr2, 891 IEEE80211_FC0_SUBTYPE_AUTH, 892 (seq + 1) | (IEEE80211_STATUS_ALG<<16)); 893 } 894 return; 895 } 896 switch (ic->ic_opmode) { 897 case IEEE80211_M_IBSS: 898 case IEEE80211_M_AHDEMO: 899 case IEEE80211_M_MONITOR: 900 /* should not come here */ 901 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 902 ni->ni_macaddr, "open auth", 903 "bad operating mode %u", ic->ic_opmode); 904 break; 905 906 case IEEE80211_M_HOSTAP: 907 if (ic->ic_state != IEEE80211_S_RUN || 908 seq != IEEE80211_AUTH_OPEN_REQUEST) { 909 ic->ic_stats.is_rx_bad_auth++; 910 return; 911 } 912 /* always accept open authentication requests */ 913 if (ni == ic->ic_bss) { 914 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 915 if (ni == NULL) 916 return; 917 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 918 (void) ieee80211_ref_node(ni); 919 /* 920 * Mark the node as referenced to reflect that it's 921 * reference count has been bumped to insure it remains 922 * after the transaction completes. 923 */ 924 ni->ni_flags |= IEEE80211_NODE_AREF; 925 926 IEEE80211_SEND_MGMT(ic, ni, 927 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 928 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 929 "[%6D] station authenticated (open)\n", 930 ni->ni_macaddr, ":"); 931 /* 932 * When 802.1x is not in use mark the port 933 * authorized at this point so traffic can flow. 934 */ 935 if (ni->ni_authmode != IEEE80211_AUTH_8021X) 936 ieee80211_node_authorize(ni); 937 break; 938 939 case IEEE80211_M_STA: 940 if (ic->ic_state != IEEE80211_S_AUTH || 941 seq != IEEE80211_AUTH_OPEN_RESPONSE) { 942 ic->ic_stats.is_rx_bad_auth++; 943 return; 944 } 945 if (status != 0) { 946 IEEE80211_DPRINTF(ic, 947 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 948 "[%6D] open auth failed (reason %d)\n", 949 ni->ni_macaddr, ":", status); 950 /* XXX can this happen? */ 951 if (ni != ic->ic_bss) 952 ni->ni_fails++; 953 ic->ic_stats.is_rx_auth_fail++; 954 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 955 } else 956 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 957 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 958 break; 959 } 960 } 961 962 /* 963 * Send a management frame error response to the specified 964 * station. If ni is associated with the station then use 965 * it; otherwise allocate a temporary node suitable for 966 * transmitting the frame and then free the reference so 967 * it will go away as soon as the frame has been transmitted. 968 */ 969 static void 970 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni, 971 const uint8_t *mac, int subtype, int arg) 972 { 973 int istmp; 974 975 if (ni == ic->ic_bss) { 976 ni = ieee80211_tmp_node(ic, mac); 977 if (ni == NULL) { 978 /* XXX msg */ 979 return; 980 } 981 istmp = 1; 982 } else 983 istmp = 0; 984 IEEE80211_SEND_MGMT(ic, ni, subtype, arg); 985 if (istmp) 986 ieee80211_free_node(ni); 987 } 988 989 static int 990 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni) 991 { 992 if (ni->ni_challenge == NULL) 993 MALLOC(ni->ni_challenge, uint32_t*, IEEE80211_CHALLENGE_LEN, 994 M_DEVBUF, M_NOWAIT); 995 if (ni->ni_challenge == NULL) { 996 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 997 "[%6D] shared key challenge alloc failed\n", 998 ni->ni_macaddr, ":"); 999 /* XXX statistic */ 1000 } 1001 return (ni->ni_challenge != NULL); 1002 } 1003 1004 /* XXX TODO: add statistics */ 1005 static void 1006 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh, 1007 uint8_t *frm, uint8_t *efrm, struct ieee80211_node *ni, int rssi, 1008 uint32_t rstamp, uint16_t seq, uint16_t status) 1009 { 1010 uint8_t *challenge; 1011 int allocbs, estatus; 1012 1013 /* 1014 * NB: this can happen as we allow pre-shared key 1015 * authentication to be enabled w/o wep being turned 1016 * on so that configuration of these can be done 1017 * in any order. It may be better to enforce the 1018 * ordering in which case this check would just be 1019 * for sanity/consistency. 1020 */ 1021 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 1022 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1023 ni->ni_macaddr, "shared key auth", 1024 "%s", " PRIVACY is disabled"); 1025 estatus = IEEE80211_STATUS_ALG; 1026 goto bad; 1027 } 1028 /* 1029 * Pre-shared key authentication is evil; accept 1030 * it only if explicitly configured (it is supported 1031 * mainly for compatibility with clients like OS X). 1032 */ 1033 if (ni->ni_authmode != IEEE80211_AUTH_AUTO && 1034 ni->ni_authmode != IEEE80211_AUTH_SHARED) { 1035 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1036 ni->ni_macaddr, "shared key auth", 1037 "bad sta auth mode %u", ni->ni_authmode); 1038 ic->ic_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */ 1039 estatus = IEEE80211_STATUS_ALG; 1040 goto bad; 1041 } 1042 1043 challenge = NULL; 1044 if (frm + 1 < efrm) { 1045 if ((frm[1] + 2) > (efrm - frm)) { 1046 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1047 ni->ni_macaddr, "shared key auth", 1048 "ie %d/%d too long", 1049 frm[0], (frm[1] + 2) - (efrm - frm)); 1050 ic->ic_stats.is_rx_bad_auth++; 1051 estatus = IEEE80211_STATUS_CHALLENGE; 1052 goto bad; 1053 } 1054 if (*frm == IEEE80211_ELEMID_CHALLENGE) 1055 challenge = frm; 1056 frm += frm[1] + 2; 1057 } 1058 switch (seq) { 1059 case IEEE80211_AUTH_SHARED_CHALLENGE: 1060 case IEEE80211_AUTH_SHARED_RESPONSE: 1061 if (challenge == NULL) { 1062 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1063 ni->ni_macaddr, "shared key auth", 1064 "%s", "no challenge"); 1065 ic->ic_stats.is_rx_bad_auth++; 1066 estatus = IEEE80211_STATUS_CHALLENGE; 1067 goto bad; 1068 } 1069 if (challenge[1] != IEEE80211_CHALLENGE_LEN) { 1070 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1071 ni->ni_macaddr, "shared key auth", 1072 "bad challenge len %d", challenge[1]); 1073 ic->ic_stats.is_rx_bad_auth++; 1074 estatus = IEEE80211_STATUS_CHALLENGE; 1075 goto bad; 1076 } 1077 default: 1078 break; 1079 } 1080 switch (ic->ic_opmode) { 1081 case IEEE80211_M_MONITOR: 1082 case IEEE80211_M_AHDEMO: 1083 case IEEE80211_M_IBSS: 1084 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1085 ni->ni_macaddr, "shared key auth", 1086 "bad operating mode %u", ic->ic_opmode); 1087 return; 1088 case IEEE80211_M_HOSTAP: 1089 if (ic->ic_state != IEEE80211_S_RUN) { 1090 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1091 ni->ni_macaddr, "shared key auth", 1092 "bad state %u", ic->ic_state); 1093 estatus = IEEE80211_STATUS_ALG; /* XXX */ 1094 goto bad; 1095 } 1096 switch (seq) { 1097 case IEEE80211_AUTH_SHARED_REQUEST: 1098 if (ni == ic->ic_bss) { 1099 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 1100 if (ni == NULL) { 1101 /* NB: no way to return an error */ 1102 return; 1103 } 1104 allocbs = 1; 1105 } else { 1106 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 1107 (void) ieee80211_ref_node(ni); 1108 allocbs = 0; 1109 } 1110 /* 1111 * Mark the node as referenced to reflect that it's 1112 * reference count has been bumped to insure it remains 1113 * after the transaction completes. 1114 */ 1115 ni->ni_flags |= IEEE80211_NODE_AREF; 1116 ni->ni_rssi = rssi; 1117 ni->ni_rstamp = rstamp; 1118 if (!alloc_challenge(ic, ni)) { 1119 /* NB: don't return error so they rexmit */ 1120 return; 1121 } 1122 get_random_bytes(ni->ni_challenge, 1123 IEEE80211_CHALLENGE_LEN); 1124 IEEE80211_DPRINTF(ic, 1125 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1126 "[%6D] shared key %sauth request\n", 1127 ni->ni_macaddr, ":", 1128 allocbs ? "" : "re"); 1129 break; 1130 case IEEE80211_AUTH_SHARED_RESPONSE: 1131 if (ni == ic->ic_bss) { 1132 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1133 ni->ni_macaddr, "shared key response", 1134 "%s", "unknown station"); 1135 /* NB: don't send a response */ 1136 return; 1137 } 1138 if (ni->ni_challenge == NULL) { 1139 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1140 ni->ni_macaddr, "shared key response", 1141 "%s", "no challenge recorded"); 1142 ic->ic_stats.is_rx_bad_auth++; 1143 estatus = IEEE80211_STATUS_CHALLENGE; 1144 goto bad; 1145 } 1146 if (memcmp(ni->ni_challenge, &challenge[2], 1147 challenge[1]) != 0) { 1148 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1149 ni->ni_macaddr, "shared key response", 1150 "%s", "challenge mismatch"); 1151 ic->ic_stats.is_rx_auth_fail++; 1152 estatus = IEEE80211_STATUS_CHALLENGE; 1153 goto bad; 1154 } 1155 IEEE80211_DPRINTF(ic, 1156 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1157 "[%6D] station authenticated (shared key)\n", 1158 ni->ni_macaddr, ":"); 1159 ieee80211_node_authorize(ni); 1160 break; 1161 default: 1162 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1163 ni->ni_macaddr, "shared key auth", 1164 "bad seq %d", seq); 1165 ic->ic_stats.is_rx_bad_auth++; 1166 estatus = IEEE80211_STATUS_SEQUENCE; 1167 goto bad; 1168 } 1169 IEEE80211_SEND_MGMT(ic, ni, 1170 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1171 break; 1172 1173 case IEEE80211_M_STA: 1174 if (ic->ic_state != IEEE80211_S_AUTH) 1175 return; 1176 switch (seq) { 1177 case IEEE80211_AUTH_SHARED_PASS: 1178 if (ni->ni_challenge != NULL) { 1179 FREE(ni->ni_challenge, M_DEVBUF); 1180 ni->ni_challenge = NULL; 1181 } 1182 if (status != 0) { 1183 IEEE80211_DPRINTF(ic, 1184 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1185 "[%6D] shared key auth failed (reason %d)\n", 1186 ieee80211_getbssid(ic, wh), ":", status); 1187 /* XXX can this happen? */ 1188 if (ni != ic->ic_bss) 1189 ni->ni_fails++; 1190 ic->ic_stats.is_rx_auth_fail++; 1191 return; 1192 } 1193 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 1194 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 1195 break; 1196 case IEEE80211_AUTH_SHARED_CHALLENGE: 1197 if (!alloc_challenge(ic, ni)) 1198 return; 1199 /* XXX could optimize by passing recvd challenge */ 1200 memcpy(ni->ni_challenge, &challenge[2], challenge[1]); 1201 IEEE80211_SEND_MGMT(ic, ni, 1202 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1203 break; 1204 default: 1205 IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH, 1206 wh, "shared key auth", "bad seq %d", seq); 1207 ic->ic_stats.is_rx_bad_auth++; 1208 return; 1209 } 1210 break; 1211 } 1212 return; 1213 bad: 1214 /* 1215 * Send an error response; but only when operating as an AP. 1216 */ 1217 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 1218 /* XXX hack to workaround calling convention */ 1219 ieee80211_send_error(ic, ni, wh->i_addr2, 1220 IEEE80211_FC0_SUBTYPE_AUTH, 1221 (seq + 1) | (estatus<<16)); 1222 } else if (ic->ic_opmode == IEEE80211_M_STA) { 1223 /* 1224 * Kick the state machine. This short-circuits 1225 * using the mgt frame timeout to trigger the 1226 * state transition. 1227 */ 1228 if (ic->ic_state == IEEE80211_S_AUTH) 1229 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 1230 } 1231 } 1232 1233 /* Verify the existence and length of __elem or get out. */ 1234 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \ 1235 if ((__elem) == NULL) { \ 1236 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1237 wh, ieee80211_mgt_subtype_name[subtype >> \ 1238 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1239 "%s", "no " #__elem ); \ 1240 ic->ic_stats.is_rx_elem_missing++; \ 1241 return; \ 1242 } \ 1243 if ((__elem)[1] > (__maxlen)) { \ 1244 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1245 wh, ieee80211_mgt_subtype_name[subtype >> \ 1246 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1247 "bad " #__elem " len %d", (__elem)[1]); \ 1248 ic->ic_stats.is_rx_elem_toobig++; \ 1249 return; \ 1250 } \ 1251 } while (0) 1252 1253 #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \ 1254 if ((_len) < (_minlen)) { \ 1255 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1256 wh, ieee80211_mgt_subtype_name[subtype >> \ 1257 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1258 "%s", "ie too short"); \ 1259 ic->ic_stats.is_rx_elem_toosmall++; \ 1260 return; \ 1261 } \ 1262 } while (0) 1263 1264 #ifdef IEEE80211_DEBUG 1265 static void 1266 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag, 1267 uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid) 1268 { 1269 kprintf("[%6D] discard %s frame, ssid mismatch: ", mac, ":", tag); 1270 ieee80211_print_essid(ssid + 2, ssid[1]); 1271 kprintf("\n"); 1272 } 1273 1274 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1275 if ((_ssid)[1] != 0 && \ 1276 ((_ssid)[1] != (_ni)->ni_esslen || \ 1277 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1278 if (ieee80211_msg_input(ic)) \ 1279 ieee80211_ssid_mismatch(ic, \ 1280 ieee80211_mgt_subtype_name[subtype >> \ 1281 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1282 wh->i_addr2, _ssid); \ 1283 ic->ic_stats.is_rx_ssidmismatch++; \ 1284 return; \ 1285 } \ 1286 } while (0) 1287 #else /* !IEEE80211_DEBUG */ 1288 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1289 if ((_ssid)[1] != 0 && \ 1290 ((_ssid)[1] != (_ni)->ni_esslen || \ 1291 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1292 ic->ic_stats.is_rx_ssidmismatch++; \ 1293 return; \ 1294 } \ 1295 } while (0) 1296 #endif /* !IEEE80211_DEBUG */ 1297 1298 /* unalligned little endian access */ 1299 #define LE_READ_2(p) \ 1300 ((uint16_t) \ 1301 ((((const uint8_t *)(p))[0] ) | \ 1302 (((const uint8_t *)(p))[1] << 8))) 1303 #define LE_READ_4(p) \ 1304 ((uint32_t) \ 1305 ((((const uint8_t *)(p))[0] ) | \ 1306 (((const uint8_t *)(p))[1] << 8) | \ 1307 (((const uint8_t *)(p))[2] << 16) | \ 1308 (((const uint8_t *)(p))[3] << 24))) 1309 1310 static int __inline 1311 iswpaoui(const uint8_t *frm) 1312 { 1313 return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI); 1314 } 1315 1316 static int __inline 1317 iswmeoui(const uint8_t *frm) 1318 { 1319 return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI); 1320 } 1321 1322 static int __inline 1323 iswmeparam(const uint8_t *frm) 1324 { 1325 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1326 frm[6] == WME_PARAM_OUI_SUBTYPE; 1327 } 1328 1329 static int __inline 1330 iswmeinfo(const uint8_t *frm) 1331 { 1332 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1333 frm[6] == WME_INFO_OUI_SUBTYPE; 1334 } 1335 1336 static int __inline 1337 isatherosoui(const uint8_t *frm) 1338 { 1339 return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI); 1340 } 1341 1342 /* 1343 * Convert a WPA cipher selector OUI to an internal 1344 * cipher algorithm. Where appropriate we also 1345 * record any key length. 1346 */ 1347 static int 1348 wpa_cipher(uint8_t *sel, uint8_t *keylen) 1349 { 1350 #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1351 uint32_t w = LE_READ_4(sel); 1352 1353 switch (w) { 1354 case WPA_SEL(WPA_CSE_NULL): 1355 return IEEE80211_CIPHER_NONE; 1356 case WPA_SEL(WPA_CSE_WEP40): 1357 if (keylen) 1358 *keylen = 40 / NBBY; 1359 return IEEE80211_CIPHER_WEP; 1360 case WPA_SEL(WPA_CSE_WEP104): 1361 if (keylen) 1362 *keylen = 104 / NBBY; 1363 return IEEE80211_CIPHER_WEP; 1364 case WPA_SEL(WPA_CSE_TKIP): 1365 return IEEE80211_CIPHER_TKIP; 1366 case WPA_SEL(WPA_CSE_CCMP): 1367 return IEEE80211_CIPHER_AES_CCM; 1368 } 1369 return 32; /* NB: so 1<< is discarded */ 1370 #undef WPA_SEL 1371 } 1372 1373 /* 1374 * Convert a WPA key management/authentication algorithm 1375 * to an internal code. 1376 */ 1377 static int 1378 wpa_keymgmt(uint8_t *sel) 1379 { 1380 #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1381 uint32_t w = LE_READ_4(sel); 1382 1383 switch (w) { 1384 case WPA_SEL(WPA_ASE_8021X_UNSPEC): 1385 return WPA_ASE_8021X_UNSPEC; 1386 case WPA_SEL(WPA_ASE_8021X_PSK): 1387 return WPA_ASE_8021X_PSK; 1388 case WPA_SEL(WPA_ASE_NONE): 1389 return WPA_ASE_NONE; 1390 } 1391 return 0; /* NB: so is discarded */ 1392 #undef WPA_SEL 1393 } 1394 1395 /* 1396 * Parse a WPA information element to collect parameters 1397 * and validate the parameters against what has been 1398 * configured for the system. 1399 */ 1400 static int 1401 ieee80211_parse_wpa(struct ieee80211com *ic, uint8_t *frm, 1402 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1403 { 1404 uint8_t len = frm[1]; 1405 uint32_t w; 1406 int n; 1407 1408 /* 1409 * Check the length once for fixed parts: OUI, type, 1410 * version, mcast cipher, and 2 selector counts. 1411 * Other, variable-length data, must be checked separately. 1412 */ 1413 if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) { 1414 IEEE80211_DISCARD_IE(ic, 1415 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1416 wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags); 1417 return IEEE80211_REASON_IE_INVALID; 1418 } 1419 if (len < 14) { 1420 IEEE80211_DISCARD_IE(ic, 1421 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1422 wh, "WPA", "too short, len %u", len); 1423 return IEEE80211_REASON_IE_INVALID; 1424 } 1425 frm += 6, len -= 4; /* NB: len is payload only */ 1426 /* NB: iswapoui already validated the OUI and type */ 1427 w = LE_READ_2(frm); 1428 if (w != WPA_VERSION) { 1429 IEEE80211_DISCARD_IE(ic, 1430 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1431 wh, "WPA", "bad version %u", w); 1432 return IEEE80211_REASON_IE_INVALID; 1433 } 1434 frm += 2, len -= 2; 1435 1436 /* multicast/group cipher */ 1437 w = wpa_cipher(frm, &rsn->rsn_mcastkeylen); 1438 if (w != rsn->rsn_mcastcipher) { 1439 IEEE80211_DISCARD_IE(ic, 1440 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1441 wh, "WPA", "mcast cipher mismatch; got %u, expected %u", 1442 w, rsn->rsn_mcastcipher); 1443 return IEEE80211_REASON_IE_INVALID; 1444 } 1445 frm += 4, len -= 4; 1446 1447 /* unicast ciphers */ 1448 n = LE_READ_2(frm); 1449 frm += 2, len -= 2; 1450 if (len < n*4+2) { 1451 IEEE80211_DISCARD_IE(ic, 1452 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1453 wh, "WPA", "ucast cipher data too short; len %u, n %u", 1454 len, n); 1455 return IEEE80211_REASON_IE_INVALID; 1456 } 1457 w = 0; 1458 for (; n > 0; n--) { 1459 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen); 1460 frm += 4, len -= 4; 1461 } 1462 w &= rsn->rsn_ucastcipherset; 1463 if (w == 0) { 1464 IEEE80211_DISCARD_IE(ic, 1465 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1466 wh, "WPA", "%s", "ucast cipher set empty"); 1467 return IEEE80211_REASON_IE_INVALID; 1468 } 1469 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1470 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1471 else 1472 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1473 1474 /* key management algorithms */ 1475 n = LE_READ_2(frm); 1476 frm += 2, len -= 2; 1477 if (len < n*4) { 1478 IEEE80211_DISCARD_IE(ic, 1479 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1480 wh, "WPA", "key mgmt alg data too short; len %u, n %u", 1481 len, n); 1482 return IEEE80211_REASON_IE_INVALID; 1483 } 1484 w = 0; 1485 for (; n > 0; n--) { 1486 w |= wpa_keymgmt(frm); 1487 frm += 4, len -= 4; 1488 } 1489 w &= rsn->rsn_keymgmtset; 1490 if (w == 0) { 1491 IEEE80211_DISCARD_IE(ic, 1492 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1493 wh, "WPA", "%s", "no acceptable key mgmt alg"); 1494 return IEEE80211_REASON_IE_INVALID; 1495 } 1496 if (w & WPA_ASE_8021X_UNSPEC) 1497 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC; 1498 else 1499 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK; 1500 1501 if (len > 2) /* optional capabilities */ 1502 rsn->rsn_caps = LE_READ_2(frm); 1503 1504 return 0; 1505 } 1506 1507 /* 1508 * Convert an RSN cipher selector OUI to an internal 1509 * cipher algorithm. Where appropriate we also 1510 * record any key length. 1511 */ 1512 static int 1513 rsn_cipher(uint8_t *sel, uint8_t *keylen) 1514 { 1515 #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1516 uint32_t w = LE_READ_4(sel); 1517 1518 switch (w) { 1519 case RSN_SEL(RSN_CSE_NULL): 1520 return IEEE80211_CIPHER_NONE; 1521 case RSN_SEL(RSN_CSE_WEP40): 1522 if (keylen) 1523 *keylen = 40 / NBBY; 1524 return IEEE80211_CIPHER_WEP; 1525 case RSN_SEL(RSN_CSE_WEP104): 1526 if (keylen) 1527 *keylen = 104 / NBBY; 1528 return IEEE80211_CIPHER_WEP; 1529 case RSN_SEL(RSN_CSE_TKIP): 1530 return IEEE80211_CIPHER_TKIP; 1531 case RSN_SEL(RSN_CSE_CCMP): 1532 return IEEE80211_CIPHER_AES_CCM; 1533 case RSN_SEL(RSN_CSE_WRAP): 1534 return IEEE80211_CIPHER_AES_OCB; 1535 } 1536 return 32; /* NB: so 1<< is discarded */ 1537 #undef WPA_SEL 1538 } 1539 1540 /* 1541 * Convert an RSN key management/authentication algorithm 1542 * to an internal code. 1543 */ 1544 static int 1545 rsn_keymgmt(uint8_t *sel) 1546 { 1547 #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1548 uint32_t w = LE_READ_4(sel); 1549 1550 switch (w) { 1551 case RSN_SEL(RSN_ASE_8021X_UNSPEC): 1552 return RSN_ASE_8021X_UNSPEC; 1553 case RSN_SEL(RSN_ASE_8021X_PSK): 1554 return RSN_ASE_8021X_PSK; 1555 case RSN_SEL(RSN_ASE_NONE): 1556 return RSN_ASE_NONE; 1557 } 1558 return 0; /* NB: so is discarded */ 1559 #undef RSN_SEL 1560 } 1561 1562 /* 1563 * Parse a WPA/RSN information element to collect parameters 1564 * and validate the parameters against what has been 1565 * configured for the system. 1566 */ 1567 static int 1568 ieee80211_parse_rsn(struct ieee80211com *ic, uint8_t *frm, 1569 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1570 { 1571 uint8_t len = frm[1]; 1572 uint32_t w; 1573 int n; 1574 1575 /* 1576 * Check the length once for fixed parts: 1577 * version, mcast cipher, and 2 selector counts. 1578 * Other, variable-length data, must be checked separately. 1579 */ 1580 if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) { 1581 IEEE80211_DISCARD_IE(ic, 1582 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1583 wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags); 1584 return IEEE80211_REASON_IE_INVALID; 1585 } 1586 if (len < 10) { 1587 IEEE80211_DISCARD_IE(ic, 1588 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1589 wh, "RSN", "too short, len %u", len); 1590 return IEEE80211_REASON_IE_INVALID; 1591 } 1592 frm += 2; 1593 w = LE_READ_2(frm); 1594 if (w != RSN_VERSION) { 1595 IEEE80211_DISCARD_IE(ic, 1596 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1597 wh, "RSN", "bad version %u", w); 1598 return IEEE80211_REASON_IE_INVALID; 1599 } 1600 frm += 2, len -= 2; 1601 1602 /* multicast/group cipher */ 1603 w = rsn_cipher(frm, &rsn->rsn_mcastkeylen); 1604 if (w != rsn->rsn_mcastcipher) { 1605 IEEE80211_DISCARD_IE(ic, 1606 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1607 wh, "RSN", "mcast cipher mismatch; got %u, expected %u", 1608 w, rsn->rsn_mcastcipher); 1609 return IEEE80211_REASON_IE_INVALID; 1610 } 1611 frm += 4, len -= 4; 1612 1613 /* unicast ciphers */ 1614 n = LE_READ_2(frm); 1615 frm += 2, len -= 2; 1616 if (len < n*4+2) { 1617 IEEE80211_DISCARD_IE(ic, 1618 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1619 wh, "RSN", "ucast cipher data too short; len %u, n %u", 1620 len, n); 1621 return IEEE80211_REASON_IE_INVALID; 1622 } 1623 w = 0; 1624 for (; n > 0; n--) { 1625 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen); 1626 frm += 4, len -= 4; 1627 } 1628 w &= rsn->rsn_ucastcipherset; 1629 if (w == 0) { 1630 IEEE80211_DISCARD_IE(ic, 1631 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1632 wh, "RSN", "%s", "ucast cipher set empty"); 1633 return IEEE80211_REASON_IE_INVALID; 1634 } 1635 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1636 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1637 else 1638 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1639 1640 /* key management algorithms */ 1641 n = LE_READ_2(frm); 1642 frm += 2, len -= 2; 1643 if (len < n*4) { 1644 IEEE80211_DISCARD_IE(ic, 1645 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1646 wh, "RSN", "key mgmt alg data too short; len %u, n %u", 1647 len, n); 1648 return IEEE80211_REASON_IE_INVALID; 1649 } 1650 w = 0; 1651 for (; n > 0; n--) { 1652 w |= rsn_keymgmt(frm); 1653 frm += 4, len -= 4; 1654 } 1655 w &= rsn->rsn_keymgmtset; 1656 if (w == 0) { 1657 IEEE80211_DISCARD_IE(ic, 1658 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1659 wh, "RSN", "%s", "no acceptable key mgmt alg"); 1660 return IEEE80211_REASON_IE_INVALID; 1661 } 1662 if (w & RSN_ASE_8021X_UNSPEC) 1663 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC; 1664 else 1665 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK; 1666 1667 /* optional RSN capabilities */ 1668 if (len > 2) 1669 rsn->rsn_caps = LE_READ_2(frm); 1670 /* XXXPMKID */ 1671 1672 return 0; 1673 } 1674 1675 static int 1676 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm, 1677 const struct ieee80211_frame *wh) 1678 { 1679 #define MS(_v, _f) (((_v) & _f) >> _f##_S) 1680 struct ieee80211_wme_state *wme = &ic->ic_wme; 1681 u_int len = frm[1], qosinfo; 1682 int i; 1683 1684 if (len < sizeof(struct ieee80211_wme_param)-2) { 1685 IEEE80211_DISCARD_IE(ic, 1686 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME, 1687 wh, "WME", "too short, len %u", len); 1688 return -1; 1689 } 1690 qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)]; 1691 qosinfo &= WME_QOSINFO_COUNT; 1692 /* XXX do proper check for wraparound */ 1693 if (qosinfo == wme->wme_wmeChanParams.cap_info) 1694 return 0; 1695 frm += __offsetof(struct ieee80211_wme_param, params_acParams); 1696 for (i = 0; i < WME_NUM_AC; i++) { 1697 struct wmeParams *wmep = 1698 &wme->wme_wmeChanParams.cap_wmeParams[i]; 1699 /* NB: ACI not used */ 1700 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM); 1701 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN); 1702 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN); 1703 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX); 1704 wmep->wmep_txopLimit = LE_READ_2(frm+2); 1705 frm += 4; 1706 } 1707 wme->wme_wmeChanParams.cap_info = qosinfo; 1708 return 1; 1709 #undef MS 1710 } 1711 1712 void 1713 ieee80211_saveie(uint8_t **iep, const uint8_t *ie) 1714 { 1715 u_int ielen = ie[1]+2; 1716 /* 1717 * Record information element for later use. 1718 */ 1719 if (*iep == NULL || (*iep)[1] != ie[1]) { 1720 if (*iep != NULL) 1721 FREE(*iep, M_DEVBUF); 1722 MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT); 1723 } 1724 if (*iep != NULL) 1725 memcpy(*iep, ie, ielen); 1726 /* XXX note failure */ 1727 } 1728 1729 /* XXX find a better place for definition */ 1730 struct l2_update_frame { 1731 struct ether_header eh; 1732 uint8_t dsap; 1733 uint8_t ssap; 1734 uint8_t control; 1735 uint8_t xid[3]; 1736 } __packed; 1737 1738 /* 1739 * Deliver a TGf L2UF frame on behalf of a station. 1740 * This primes any bridge when the station is roaming 1741 * between ap's on the same wired network. 1742 */ 1743 static void 1744 ieee80211_deliver_l2uf(struct ieee80211_node *ni) 1745 { 1746 struct ieee80211com *ic = ni->ni_ic; 1747 struct ifnet *ifp = ic->ic_ifp; 1748 struct mbuf *m; 1749 struct l2_update_frame *l2uf; 1750 struct ether_header *eh; 1751 1752 m = m_gethdr(MB_DONTWAIT, MT_DATA); 1753 if (m == NULL) { 1754 IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni, 1755 "%s", "no mbuf for l2uf frame"); 1756 ic->ic_stats.is_rx_nobuf++; /* XXX not right */ 1757 return; 1758 } 1759 l2uf = mtod(m, struct l2_update_frame *); 1760 eh = &l2uf->eh; 1761 /* dst: Broadcast address */ 1762 IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr); 1763 /* src: associated STA */ 1764 IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr); 1765 eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh)); 1766 1767 l2uf->dsap = 0; 1768 l2uf->ssap = 0; 1769 l2uf->control = 0xf5; 1770 l2uf->xid[0] = 0x81; 1771 l2uf->xid[1] = 0x80; 1772 l2uf->xid[2] = 0x00; 1773 1774 m->m_pkthdr.len = m->m_len = sizeof(*l2uf); 1775 m->m_pkthdr.rcvif = ifp; 1776 ieee80211_deliver_data(ic, ni, m); 1777 } 1778 1779 void 1780 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, 1781 struct ieee80211_node *ni, 1782 int subtype, int rssi, uint32_t rstamp) 1783 { 1784 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP) 1785 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP) 1786 struct ieee80211_frame *wh; 1787 uint8_t *frm, *efrm; 1788 uint8_t *ssid, *rates, *xrates, *wpa, *wme; 1789 int reassoc, resp; 1790 uint8_t rate; 1791 1792 wh = mtod(m0, struct ieee80211_frame *); 1793 frm = (uint8_t *)&wh[1]; 1794 efrm = mtod(m0, uint8_t *) + m0->m_len; 1795 switch (subtype) { 1796 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 1797 case IEEE80211_FC0_SUBTYPE_BEACON: { 1798 struct ieee80211_scanparams scan; 1799 1800 /* 1801 * We process beacon/probe response frames: 1802 * o when scanning, or 1803 * o station mode when associated (to collect state 1804 * updates such as 802.11g slot time), or 1805 * o adhoc mode (to discover neighbors) 1806 * Frames otherwise received are discarded. 1807 */ 1808 if (!((ic->ic_flags & IEEE80211_F_SCAN) || 1809 (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) || 1810 ic->ic_opmode == IEEE80211_M_IBSS)) { 1811 ic->ic_stats.is_rx_mgtdiscard++; 1812 return; 1813 } 1814 /* 1815 * beacon/probe response frame format 1816 * [8] time stamp 1817 * [2] beacon interval 1818 * [2] capability information 1819 * [tlv] ssid 1820 * [tlv] supported rates 1821 * [tlv] country information 1822 * [tlv] parameter set (FH/DS) 1823 * [tlv] erp information 1824 * [tlv] extended supported rates 1825 * [tlv] WME 1826 * [tlv] WPA or RSN 1827 */ 1828 IEEE80211_VERIFY_LENGTH(efrm - frm, 12); 1829 memset(&scan, 0, sizeof(scan)); 1830 scan.tstamp = frm; frm += 8; 1831 scan.bintval = le16toh(*(uint16_t *)frm); frm += 2; 1832 scan.capinfo = le16toh(*(uint16_t *)frm); frm += 2; 1833 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan); 1834 scan.chan = scan.bchan; 1835 1836 while (efrm - frm > 1) { 1837 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 1838 switch (*frm) { 1839 case IEEE80211_ELEMID_SSID: 1840 scan.ssid = frm; 1841 break; 1842 case IEEE80211_ELEMID_RATES: 1843 scan.rates = frm; 1844 break; 1845 case IEEE80211_ELEMID_COUNTRY: 1846 scan.country = frm; 1847 break; 1848 case IEEE80211_ELEMID_FHPARMS: 1849 if (ic->ic_phytype == IEEE80211_T_FH) { 1850 scan.fhdwell = LE_READ_2(&frm[2]); 1851 scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]); 1852 scan.fhindex = frm[6]; 1853 } 1854 break; 1855 case IEEE80211_ELEMID_DSPARMS: 1856 /* 1857 * XXX hack this since depending on phytype 1858 * is problematic for multi-mode devices. 1859 */ 1860 if (ic->ic_phytype != IEEE80211_T_FH) 1861 scan.chan = frm[2]; 1862 break; 1863 case IEEE80211_ELEMID_TIM: 1864 /* XXX ATIM? */ 1865 scan.tim = frm; 1866 scan.timoff = frm - mtod(m0, uint8_t *); 1867 break; 1868 case IEEE80211_ELEMID_IBSSPARMS: 1869 break; 1870 case IEEE80211_ELEMID_XRATES: 1871 scan.xrates = frm; 1872 break; 1873 case IEEE80211_ELEMID_ERP: 1874 if (frm[1] != 1) { 1875 IEEE80211_DISCARD_IE(ic, 1876 IEEE80211_MSG_ELEMID, wh, "ERP", 1877 "bad len %u", frm[1]); 1878 ic->ic_stats.is_rx_elem_toobig++; 1879 break; 1880 } 1881 scan.erp = frm[2]; 1882 break; 1883 case IEEE80211_ELEMID_RSN: 1884 scan.wpa = frm; 1885 break; 1886 case IEEE80211_ELEMID_VENDOR: 1887 if (iswpaoui(frm)) 1888 scan.wpa = frm; 1889 else if (iswmeparam(frm) || iswmeinfo(frm)) 1890 scan.wme = frm; 1891 /* XXX Atheros OUI support */ 1892 break; 1893 default: 1894 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID, 1895 wh, "unhandled", 1896 "id %u, len %u", *frm, frm[1]); 1897 ic->ic_stats.is_rx_elem_unknown++; 1898 break; 1899 } 1900 frm += frm[1] + 2; 1901 } 1902 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE); 1903 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN); 1904 if ( 1905 #if IEEE80211_CHAN_MAX < 255 1906 scan.chan > IEEE80211_CHAN_MAX || 1907 #endif 1908 isclr(ic->ic_chan_active, scan.chan)) { 1909 IEEE80211_DISCARD(ic, 1910 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1911 wh, ieee80211_mgt_subtype_name[subtype >> 1912 IEEE80211_FC0_SUBTYPE_SHIFT], 1913 "invalid channel %u", scan.chan); 1914 ic->ic_stats.is_rx_badchan++; 1915 return; 1916 } 1917 if (scan.chan != scan.bchan && 1918 ic->ic_phytype != IEEE80211_T_FH) { 1919 /* 1920 * Frame was received on a channel different from the 1921 * one indicated in the DS params element id; 1922 * silently discard it. 1923 * 1924 * NB: this can happen due to signal leakage. 1925 * But we should take it for FH phy because 1926 * the rssi value should be correct even for 1927 * different hop pattern in FH. 1928 */ 1929 IEEE80211_DISCARD(ic, 1930 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1931 wh, ieee80211_mgt_subtype_name[subtype >> 1932 IEEE80211_FC0_SUBTYPE_SHIFT], 1933 "for off-channel %u", scan.chan); 1934 ic->ic_stats.is_rx_chanmismatch++; 1935 return; 1936 } 1937 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 1938 scan.bintval <= IEEE80211_BINTVAL_MAX)) { 1939 IEEE80211_DISCARD(ic, 1940 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1941 wh, ieee80211_mgt_subtype_name[subtype >> 1942 IEEE80211_FC0_SUBTYPE_SHIFT], 1943 "bogus beacon interval", scan.bintval); 1944 ic->ic_stats.is_rx_badbintval++; 1945 return; 1946 } 1947 1948 /* 1949 * Count frame now that we know it's to be processed. 1950 */ 1951 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) { 1952 ic->ic_stats.is_rx_beacon++; /* XXX remove */ 1953 IEEE80211_NODE_STAT(ni, rx_beacons); 1954 } else 1955 IEEE80211_NODE_STAT(ni, rx_proberesp); 1956 1957 /* 1958 * When operating in station mode, check for state updates. 1959 * Be careful to ignore beacons received while doing a 1960 * background scan. We consider only 11g/WMM stuff right now. 1961 */ 1962 if (ic->ic_opmode == IEEE80211_M_STA && 1963 ni->ni_associd != 0 && 1964 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 || 1965 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) { 1966 int update_shpreamble = 0; 1967 1968 /* record tsf of last beacon */ 1969 memcpy(ni->ni_tstamp.data, scan.tstamp, 1970 sizeof(ni->ni_tstamp)); 1971 /* count beacon frame for s/w bmiss handling */ 1972 ic->ic_swbmiss_count++; 1973 ic->ic_bmiss_count = 0; 1974 if (ni->ni_erp != scan.erp) { 1975 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 1976 "[%6D] erp change: was 0x%x, now 0x%x\n", 1977 wh->i_addr2, ":", ni->ni_erp, scan.erp); 1978 if (ic->ic_curmode == IEEE80211_MODE_11G && 1979 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 1980 ic->ic_flags |= IEEE80211_F_USEPROT; 1981 else 1982 ic->ic_flags &= ~IEEE80211_F_USEPROT; 1983 1984 if ((ni->ni_erp ^ scan.erp) & IEEE80211_ERP_LONG_PREAMBLE) 1985 update_shpreamble = 1; 1986 1987 ni->ni_erp = scan.erp; 1988 /* XXX statistic */ 1989 } 1990 if (ni->ni_capinfo != scan.capinfo) { 1991 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 1992 "[%6D] capabilities change: before 0x%x," 1993 " now 0x%x\n", 1994 wh->i_addr2, ":", 1995 ni->ni_capinfo, scan.capinfo); 1996 1997 if ((ni->ni_capinfo ^ scan.capinfo) & 1998 IEEE80211_CAPINFO_SHORT_SLOTTIME) { 1999 ieee80211_set_shortslottime(ic, 2000 ic->ic_curmode == IEEE80211_MODE_11A || 2001 (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2002 } 2003 2004 if ((ni->ni_capinfo ^ scan.capinfo) & 2005 IEEE80211_CAPINFO_SHORT_PREAMBLE) 2006 update_shpreamble = 1; 2007 2008 ni->ni_capinfo = scan.capinfo; 2009 /* XXX statistic */ 2010 } 2011 2012 if (update_shpreamble) 2013 ieee80211_update_shpreamble(ic, ni); 2014 2015 if (scan.wme != NULL && 2016 (ni->ni_flags & IEEE80211_NODE_QOS) && 2017 ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0) 2018 ieee80211_wme_updateparams(ic); 2019 if (scan.tim != NULL) { 2020 struct ieee80211_tim_ie *ie = 2021 (struct ieee80211_tim_ie *) scan.tim; 2022 2023 ni->ni_dtim_count = ie->tim_count; 2024 ni->ni_dtim_period = ie->tim_period; 2025 } 2026 if (ic->ic_flags & IEEE80211_F_SCAN) 2027 ieee80211_add_scan(ic, &scan, wh, 2028 subtype, rssi, rstamp); 2029 return; 2030 } 2031 /* 2032 * If scanning, just pass information to the scan module. 2033 */ 2034 if (ic->ic_flags & IEEE80211_F_SCAN) { 2035 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) { 2036 /* 2037 * Actively scanning a channel marked passive; 2038 * send a probe request now that we know there 2039 * is 802.11 traffic present. 2040 * 2041 * XXX check if the beacon we recv'd gives 2042 * us what we need and suppress the probe req 2043 */ 2044 ieee80211_probe_curchan(ic, 1); 2045 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN; 2046 } 2047 ieee80211_add_scan(ic, &scan, wh, 2048 subtype, rssi, rstamp); 2049 return; 2050 } 2051 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) { 2052 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 2053 /* 2054 * Create a new entry in the neighbor table. 2055 */ 2056 ni = ieee80211_add_neighbor(ic, wh, &scan); 2057 } else if (ni->ni_capinfo == 0) { 2058 /* 2059 * Update faked node created on transmit. 2060 * Note this also updates the tsf. 2061 */ 2062 ieee80211_init_neighbor(ni, wh, &scan); 2063 } else { 2064 /* 2065 * Record tsf for potential resync. 2066 */ 2067 memcpy(ni->ni_tstamp.data, scan.tstamp, 2068 sizeof(ni->ni_tstamp)); 2069 } 2070 if (ni != NULL) { 2071 ni->ni_rssi = rssi; 2072 ni->ni_rstamp = rstamp; 2073 } 2074 } 2075 break; 2076 } 2077 2078 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: { 2079 int is_tmpnode; 2080 2081 if (ic->ic_opmode == IEEE80211_M_STA || 2082 ic->ic_state != IEEE80211_S_RUN) { 2083 ic->ic_stats.is_rx_mgtdiscard++; 2084 return; 2085 } 2086 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) { 2087 /* frame must be directed */ 2088 ic->ic_stats.is_rx_mgtdiscard++; /* XXX stat */ 2089 return; 2090 } 2091 2092 /* 2093 * prreq frame format 2094 * [tlv] ssid 2095 * [tlv] supported rates 2096 * [tlv] extended supported rates 2097 */ 2098 ssid = rates = xrates = NULL; 2099 while (efrm - frm > 1) { 2100 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2101 switch (*frm) { 2102 case IEEE80211_ELEMID_SSID: 2103 ssid = frm; 2104 break; 2105 case IEEE80211_ELEMID_RATES: 2106 rates = frm; 2107 break; 2108 case IEEE80211_ELEMID_XRATES: 2109 xrates = frm; 2110 break; 2111 } 2112 frm += frm[1] + 2; 2113 } 2114 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2115 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2116 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2117 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) { 2118 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 2119 wh, ieee80211_mgt_subtype_name[subtype >> 2120 IEEE80211_FC0_SUBTYPE_SHIFT], 2121 "%s", "no ssid with ssid suppression enabled"); 2122 ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/ 2123 return; 2124 } 2125 2126 is_tmpnode = 0; 2127 if (ni == ic->ic_bss) { 2128 if (ic->ic_opmode != IEEE80211_M_IBSS) { 2129 ni = ieee80211_tmp_node(ic, wh->i_addr2); 2130 is_tmpnode = 1; 2131 } else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 2132 /* 2133 * XXX Cannot tell if the sender is operating 2134 * in ibss mode. But we need a new node to 2135 * send the response so blindly add them to the 2136 * neighbor table. 2137 */ 2138 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 2139 wh->i_addr2); 2140 } 2141 if (ni == NULL) 2142 return; 2143 } 2144 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2145 "[%6D] recv probe req\n", wh->i_addr2, ":"); 2146 ni->ni_rssi = rssi; 2147 ni->ni_rstamp = rstamp; 2148 2149 /* 2150 * Since temporary node's rate set will not be used, 2151 * there is no need to do rate negotiation for it. 2152 */ 2153 if (!is_tmpnode) { 2154 ieee80211_setup_rates(ni, rates, xrates, 2155 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2156 IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 0); 2157 } 2158 2159 IEEE80211_SEND_MGMT(ic, ni, 2160 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0); 2161 if (is_tmpnode) { 2162 /* 2163 * Temporary node created just to send a 2164 * response, reclaim immediately. 2165 */ 2166 ieee80211_free_node(ni); 2167 } 2168 break; 2169 } 2170 2171 case IEEE80211_FC0_SUBTYPE_AUTH: { 2172 uint16_t algo, seq, status; 2173 /* 2174 * auth frame format 2175 * [2] algorithm 2176 * [2] sequence 2177 * [2] status 2178 * [tlv*] challenge 2179 */ 2180 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2181 algo = le16toh(*(uint16_t *)frm); 2182 seq = le16toh(*(uint16_t *)(frm + 2)); 2183 status = le16toh(*(uint16_t *)(frm + 4)); 2184 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2185 "[%6D] recv auth frame with algorithm %d seq %d\n", 2186 wh->i_addr2, ":", algo, seq); 2187 /* 2188 * Consult the ACL policy module if setup. 2189 */ 2190 if (ic->ic_acl != NULL && 2191 !ic->ic_acl->iac_check(ic, wh->i_addr2)) { 2192 IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL, 2193 wh, "auth", "%s", "disallowed by ACL"); 2194 ic->ic_stats.is_rx_acl++; 2195 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2196 IEEE80211_SEND_MGMT(ic, ni, 2197 IEEE80211_FC0_SUBTYPE_AUTH, 2198 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16)); 2199 } 2200 return; 2201 } 2202 if (ic->ic_flags & IEEE80211_F_COUNTERM) { 2203 IEEE80211_DISCARD(ic, 2204 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO, 2205 wh, "auth", "%s", "TKIP countermeasures enabled"); 2206 ic->ic_stats.is_rx_auth_countermeasures++; 2207 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2208 IEEE80211_SEND_MGMT(ic, ni, 2209 IEEE80211_FC0_SUBTYPE_AUTH, 2210 IEEE80211_REASON_MIC_FAILURE); 2211 } 2212 return; 2213 } 2214 if (algo == IEEE80211_AUTH_ALG_SHARED) 2215 ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi, 2216 rstamp, seq, status); 2217 else if (algo == IEEE80211_AUTH_ALG_OPEN) 2218 ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq, 2219 status); 2220 else { 2221 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2222 wh, "auth", "unsupported alg %d", algo); 2223 ic->ic_stats.is_rx_auth_unsupported++; 2224 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2225 /* XXX not right */ 2226 IEEE80211_SEND_MGMT(ic, ni, 2227 IEEE80211_FC0_SUBTYPE_AUTH, 2228 (seq+1) | (IEEE80211_STATUS_ALG<<16)); 2229 } 2230 return; 2231 } 2232 break; 2233 } 2234 2235 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 2236 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: { 2237 uint16_t capinfo, lintval; 2238 struct ieee80211_rsnparms rsn; 2239 uint8_t reason; 2240 2241 if (ic->ic_opmode != IEEE80211_M_HOSTAP || 2242 ic->ic_state != IEEE80211_S_RUN) { 2243 ic->ic_stats.is_rx_mgtdiscard++; 2244 return; 2245 } 2246 2247 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 2248 reassoc = 1; 2249 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP; 2250 } else { 2251 reassoc = 0; 2252 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP; 2253 } 2254 /* 2255 * asreq frame format 2256 * [2] capability information 2257 * [2] listen interval 2258 * [6*] current AP address (reassoc only) 2259 * [tlv] ssid 2260 * [tlv] supported rates 2261 * [tlv] extended supported rates 2262 * [tlv] WPA or RSN 2263 */ 2264 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4)); 2265 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) { 2266 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2267 wh, ieee80211_mgt_subtype_name[subtype >> 2268 IEEE80211_FC0_SUBTYPE_SHIFT], 2269 "%s", "wrong bssid"); 2270 ic->ic_stats.is_rx_assoc_bss++; 2271 return; 2272 } 2273 capinfo = le16toh(*(uint16_t *)frm); frm += 2; 2274 lintval = le16toh(*(uint16_t *)frm); frm += 2; 2275 if (reassoc) 2276 frm += 6; /* ignore current AP info */ 2277 ssid = rates = xrates = wpa = wme = NULL; 2278 while (efrm - frm > 1) { 2279 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2280 switch (*frm) { 2281 case IEEE80211_ELEMID_SSID: 2282 ssid = frm; 2283 break; 2284 case IEEE80211_ELEMID_RATES: 2285 rates = frm; 2286 break; 2287 case IEEE80211_ELEMID_XRATES: 2288 xrates = frm; 2289 break; 2290 /* XXX verify only one of RSN and WPA ie's? */ 2291 case IEEE80211_ELEMID_RSN: 2292 wpa = frm; 2293 break; 2294 case IEEE80211_ELEMID_VENDOR: 2295 if (iswpaoui(frm)) 2296 wpa = frm; 2297 else if (iswmeinfo(frm)) 2298 wme = frm; 2299 /* XXX Atheros OUI support */ 2300 break; 2301 } 2302 frm += frm[1] + 2; 2303 } 2304 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2305 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2306 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2307 2308 if (ni == ic->ic_bss) { 2309 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2310 "[%6D] deny %s request, sta not authenticated\n", 2311 wh->i_addr2, ":", reassoc ? "reassoc" : "assoc"); 2312 ieee80211_send_error(ic, ni, wh->i_addr2, 2313 IEEE80211_FC0_SUBTYPE_DEAUTH, 2314 IEEE80211_REASON_ASSOC_NOT_AUTHED); 2315 ic->ic_stats.is_rx_assoc_notauth++; 2316 return; 2317 } 2318 /* assert right associstion security credentials */ 2319 if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) { 2320 IEEE80211_DPRINTF(ic, 2321 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2322 "[%6D] no WPA/RSN IE in association request\n", 2323 wh->i_addr2, ":"); 2324 IEEE80211_SEND_MGMT(ic, ni, 2325 IEEE80211_FC0_SUBTYPE_DEAUTH, 2326 IEEE80211_REASON_RSN_REQUIRED); 2327 ieee80211_node_leave(ic, ni); 2328 /* XXX distinguish WPA/RSN? */ 2329 ic->ic_stats.is_rx_assoc_badwpaie++; 2330 return; 2331 } 2332 if (wpa != NULL) { 2333 /* 2334 * Parse WPA information element. Note that 2335 * we initialize the param block from the node 2336 * state so that information in the IE overrides 2337 * our defaults. The resulting parameters are 2338 * installed below after the association is assured. 2339 */ 2340 rsn = ni->ni_rsn; 2341 if (wpa[0] != IEEE80211_ELEMID_RSN) 2342 reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh); 2343 else 2344 reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh); 2345 if (reason != 0) { 2346 IEEE80211_SEND_MGMT(ic, ni, 2347 IEEE80211_FC0_SUBTYPE_DEAUTH, reason); 2348 ieee80211_node_leave(ic, ni); 2349 /* XXX distinguish WPA/RSN? */ 2350 ic->ic_stats.is_rx_assoc_badwpaie++; 2351 return; 2352 } 2353 IEEE80211_DPRINTF(ic, 2354 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2355 "[%6D] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n", 2356 wh->i_addr2, ":", 2357 wpa[0] != IEEE80211_ELEMID_RSN ? "WPA" : "RSN", 2358 rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen, 2359 rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen, 2360 rsn.rsn_keymgmt, rsn.rsn_caps); 2361 } 2362 /* discard challenge after association */ 2363 if (ni->ni_challenge != NULL) { 2364 FREE(ni->ni_challenge, M_DEVBUF); 2365 ni->ni_challenge = NULL; 2366 } 2367 /* NB: 802.11 spec says to ignore station's privacy bit */ 2368 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) { 2369 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2370 "[%6D] deny %s request, capability mismatch 0x%x\n", 2371 wh->i_addr2, ":", 2372 reassoc ? "reassoc" : "assoc", capinfo); 2373 IEEE80211_SEND_MGMT(ic, ni, resp, 2374 IEEE80211_STATUS_CAPINFO); 2375 ieee80211_node_leave(ic, ni); 2376 ic->ic_stats.is_rx_assoc_capmismatch++; 2377 return; 2378 } 2379 rate = ieee80211_setup_rates(ni, rates, xrates, 2380 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2381 IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 0); 2382 if (rate & IEEE80211_RATE_BASIC) { 2383 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2384 "[%6D] deny %s request, rate set mismatch\n", 2385 wh->i_addr2, ":", 2386 reassoc ? "reassoc" : "assoc"); 2387 IEEE80211_SEND_MGMT(ic, ni, resp, 2388 IEEE80211_STATUS_BASIC_RATE); 2389 ieee80211_node_leave(ic, ni); 2390 ic->ic_stats.is_rx_assoc_norate++; 2391 return; 2392 } 2393 ni->ni_rssi = rssi; 2394 ni->ni_rstamp = rstamp; 2395 ni->ni_intval = lintval; 2396 ni->ni_capinfo = capinfo; 2397 ni->ni_chan = ic->ic_bss->ni_chan; 2398 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell; 2399 ni->ni_fhindex = ic->ic_bss->ni_fhindex; 2400 if (wpa != NULL) { 2401 /* 2402 * Record WPA/RSN parameters for station, mark 2403 * node as using WPA and record information element 2404 * for applications that require it. 2405 */ 2406 ni->ni_rsn = rsn; 2407 ieee80211_saveie(&ni->ni_wpa_ie, wpa); 2408 } else if (ni->ni_wpa_ie != NULL) { 2409 /* 2410 * Flush any state from a previous association. 2411 */ 2412 FREE(ni->ni_wpa_ie, M_DEVBUF); 2413 ni->ni_wpa_ie = NULL; 2414 } 2415 if (wme != NULL) { 2416 /* 2417 * Record WME parameters for station, mark node 2418 * as capable of QoS and record information 2419 * element for applications that require it. 2420 */ 2421 ieee80211_saveie(&ni->ni_wme_ie, wme); 2422 ni->ni_flags |= IEEE80211_NODE_QOS; 2423 } else if (ni->ni_wme_ie != NULL) { 2424 /* 2425 * Flush any state from a previous association. 2426 */ 2427 FREE(ni->ni_wme_ie, M_DEVBUF); 2428 ni->ni_wme_ie = NULL; 2429 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2430 } 2431 ieee80211_deliver_l2uf(ni); 2432 ieee80211_node_join(ic, ni, resp); 2433 break; 2434 } 2435 2436 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 2437 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: { 2438 uint16_t capinfo, associd; 2439 uint16_t status; 2440 2441 if (ic->ic_opmode != IEEE80211_M_STA || 2442 ic->ic_state != IEEE80211_S_ASSOC) { 2443 ic->ic_stats.is_rx_mgtdiscard++; 2444 return; 2445 } 2446 2447 /* 2448 * asresp frame format 2449 * [2] capability information 2450 * [2] status 2451 * [2] association ID 2452 * [tlv] supported rates 2453 * [tlv] extended supported rates 2454 * [tlv] WME 2455 */ 2456 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2457 ni = ic->ic_bss; 2458 capinfo = le16toh(*(uint16_t *)frm); 2459 frm += 2; 2460 status = le16toh(*(uint16_t *)frm); 2461 frm += 2; 2462 if (status != 0) { 2463 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2464 "[%6D] %sassoc failed (reason %d)\n", 2465 wh->i_addr2, ":", 2466 ISREASSOC(subtype) ? "re" : "", status); 2467 if (ni != ic->ic_bss) /* XXX never true? */ 2468 ni->ni_fails++; 2469 ic->ic_stats.is_rx_auth_fail++; /* XXX */ 2470 return; 2471 } 2472 associd = le16toh(*(uint16_t *)frm); 2473 frm += 2; 2474 2475 rates = xrates = wpa = wme = NULL; 2476 while (efrm - frm > 1) { 2477 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2478 switch (*frm) { 2479 case IEEE80211_ELEMID_RATES: 2480 rates = frm; 2481 break; 2482 case IEEE80211_ELEMID_XRATES: 2483 xrates = frm; 2484 break; 2485 case IEEE80211_ELEMID_VENDOR: 2486 if (iswmeoui(frm)) 2487 wme = frm; 2488 /* XXX Atheros OUI support */ 2489 break; 2490 } 2491 frm += frm[1] + 2; 2492 } 2493 2494 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2495 rate = ieee80211_setup_rates(ni, rates, xrates, 2496 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2497 IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 1); 2498 if (rate & IEEE80211_RATE_BASIC) { 2499 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2500 "[%6D] %sassoc failed (rate set mismatch)\n", 2501 wh->i_addr2, ":", 2502 ISREASSOC(subtype) ? "re" : ""); 2503 if (ni != ic->ic_bss) /* XXX never true? */ 2504 ni->ni_fails++; 2505 ic->ic_stats.is_rx_assoc_norate++; 2506 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 2507 return; 2508 } 2509 2510 ni->ni_capinfo = capinfo; 2511 ni->ni_associd = associd; 2512 if (wme != NULL && 2513 ieee80211_parse_wmeparams(ic, wme, wh) >= 0) { 2514 ni->ni_flags |= IEEE80211_NODE_QOS; 2515 ieee80211_wme_updateparams(ic); 2516 } else 2517 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2518 /* 2519 * Configure state now that we are associated. 2520 * 2521 * XXX may need different/additional driver callbacks? 2522 */ 2523 ieee80211_update_shpreamble(ic, ni); 2524 ieee80211_set_shortslottime(ic, 2525 ic->ic_curmode == IEEE80211_MODE_11A || 2526 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2527 /* 2528 * Honor ERP protection. 2529 * 2530 * NB: ni_erp should zero for non-11g operation. 2531 * XXX check ic_curmode anyway? 2532 */ 2533 if (ic->ic_curmode == IEEE80211_MODE_11G && 2534 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 2535 ic->ic_flags |= IEEE80211_F_USEPROT; 2536 else 2537 ic->ic_flags &= ~IEEE80211_F_USEPROT; 2538 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2539 "[%6D] %sassoc success: %s preamble, %s slot time%s%s\n", 2540 wh->i_addr2, ":", 2541 ISREASSOC(subtype) ? "re" : "", 2542 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long", 2543 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long", 2544 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "", 2545 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "" 2546 ); 2547 IEEE80211_PRINT_NODERATES(ic, ni, IEEE80211_MSG_ASSOC); 2548 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype); 2549 break; 2550 } 2551 2552 case IEEE80211_FC0_SUBTYPE_DEAUTH: { 2553 uint16_t reason; 2554 2555 if (ic->ic_state == IEEE80211_S_SCAN) { 2556 ic->ic_stats.is_rx_mgtdiscard++; 2557 return; 2558 } 2559 /* 2560 * deauth frame format 2561 * [2] reason 2562 */ 2563 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2564 reason = le16toh(*(uint16_t *)frm); 2565 ic->ic_stats.is_rx_deauth++; 2566 IEEE80211_NODE_STAT(ni, rx_deauth); 2567 2568 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2569 "[%6D] recv deauthenticate (reason %d)\n", 2570 ni->ni_macaddr, ":", reason); 2571 switch (ic->ic_opmode) { 2572 case IEEE80211_M_STA: 2573 ieee80211_new_state(ic, IEEE80211_S_AUTH, 2574 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2575 break; 2576 case IEEE80211_M_HOSTAP: 2577 if (ni != ic->ic_bss) 2578 ieee80211_node_leave(ic, ni); 2579 break; 2580 default: 2581 ic->ic_stats.is_rx_mgtdiscard++; 2582 break; 2583 } 2584 break; 2585 } 2586 2587 case IEEE80211_FC0_SUBTYPE_DISASSOC: { 2588 uint16_t reason; 2589 2590 if (ic->ic_state != IEEE80211_S_RUN && 2591 ic->ic_state != IEEE80211_S_ASSOC && 2592 ic->ic_state != IEEE80211_S_AUTH) { 2593 ic->ic_stats.is_rx_mgtdiscard++; 2594 return; 2595 } 2596 /* 2597 * disassoc frame format 2598 * [2] reason 2599 */ 2600 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2601 reason = le16toh(*(uint16_t *)frm); 2602 ic->ic_stats.is_rx_disassoc++; 2603 IEEE80211_NODE_STAT(ni, rx_disassoc); 2604 2605 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2606 "[%6D] recv disassociate (reason %d)\n", 2607 ni->ni_macaddr, ":", reason); 2608 switch (ic->ic_opmode) { 2609 case IEEE80211_M_STA: 2610 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 2611 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2612 break; 2613 case IEEE80211_M_HOSTAP: 2614 if (ni != ic->ic_bss) 2615 ieee80211_node_leave(ic, ni); 2616 break; 2617 default: 2618 ic->ic_stats.is_rx_mgtdiscard++; 2619 break; 2620 } 2621 break; 2622 } 2623 default: 2624 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2625 wh, "mgt", "subtype 0x%x not handled", subtype); 2626 ic->ic_stats.is_rx_badsubtype++; 2627 break; 2628 } 2629 #undef ISREASSOC 2630 #undef ISPROBE 2631 } 2632 #undef IEEE80211_VERIFY_LENGTH 2633 #undef IEEE80211_VERIFY_ELEMENT 2634 2635 /* 2636 * Handle station power-save state change. 2637 */ 2638 static void 2639 ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable) 2640 { 2641 struct ieee80211com *ic = ni->ni_ic; 2642 struct mbuf *m; 2643 2644 ASSERT_SERIALIZED(ic->ic_ifp->if_serializer); 2645 2646 if (enable) { 2647 if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) 2648 ic->ic_ps_sta++; 2649 ni->ni_flags |= IEEE80211_NODE_PWR_MGT; 2650 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2651 "[%6D] power save mode on, %u sta's in ps mode\n", 2652 ni->ni_macaddr, ":", ic->ic_ps_sta); 2653 return; 2654 } 2655 2656 if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) 2657 ic->ic_ps_sta--; 2658 ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT; 2659 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2660 "[%6D] power save mode off, %u sta's in ps mode\n", 2661 ni->ni_macaddr, ":", ic->ic_ps_sta); 2662 /* XXX if no stations in ps mode, flush mc frames */ 2663 2664 /* 2665 * Flush queued unicast frames. 2666 */ 2667 if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) { 2668 if (ic->ic_set_tim != NULL) 2669 ic->ic_set_tim(ni, 0); /* just in case */ 2670 return; 2671 } 2672 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2673 "[%6D] flush ps queue, %u packets queued\n", 2674 ni->ni_macaddr, ":", IEEE80211_NODE_SAVEQ_QLEN(ni)); 2675 for (;;) { 2676 int qlen; 2677 2678 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2679 if (m == NULL) 2680 break; 2681 /* 2682 * If this is the last packet, turn off the TIM bit. 2683 * If there are more packets, set the more packets bit 2684 * in the mbuf so ieee80211_encap will mark the 802.11 2685 * head to indicate more data frames will follow. 2686 */ 2687 if (qlen != 0) 2688 m->m_flags |= M_MORE_DATA; 2689 /* XXX need different driver interface */ 2690 /* XXX bypasses q max */ 2691 /* XXX bypasses ALTQ */ 2692 ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL); 2693 } 2694 if (ic->ic_set_tim != NULL) 2695 ic->ic_set_tim(ni, 0); 2696 } 2697 2698 /* 2699 * Process a received ps-poll frame. 2700 */ 2701 static void 2702 ieee80211_recv_pspoll(struct ieee80211com *ic, 2703 struct ieee80211_node *ni, struct mbuf *m0) 2704 { 2705 struct ieee80211_frame_min *wh; 2706 struct mbuf *m; 2707 uint16_t aid; 2708 int qlen; 2709 2710 ASSERT_SERIALIZED(ic->ic_ifp->if_serializer); 2711 2712 wh = mtod(m0, struct ieee80211_frame_min *); 2713 if (ni->ni_associd == 0) { 2714 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2715 (struct ieee80211_frame *) wh, "ps-poll", 2716 "%s", "unassociated station"); 2717 ic->ic_stats.is_ps_unassoc++; 2718 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2719 IEEE80211_REASON_NOT_ASSOCED); 2720 return; 2721 } 2722 2723 aid = le16toh(*(uint16_t *)wh->i_dur); 2724 if (aid != ni->ni_associd) { 2725 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2726 (struct ieee80211_frame *) wh, "ps-poll", 2727 "aid mismatch: sta aid 0x%x poll aid 0x%x", 2728 ni->ni_associd, aid); 2729 ic->ic_stats.is_ps_badaid++; 2730 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2731 IEEE80211_REASON_NOT_ASSOCED); 2732 return; 2733 } 2734 2735 /* Okay, take the first queued packet and put it out... */ 2736 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2737 if (m == NULL) { 2738 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2739 "[%6D] recv ps-poll, but queue empty\n", 2740 wh->i_addr2, ":"); 2741 ieee80211_send_nulldata(ieee80211_ref_node(ni)); 2742 ic->ic_stats.is_ps_qempty++; /* XXX node stat */ 2743 if (ic->ic_set_tim != NULL) 2744 ic->ic_set_tim(ni, 0); /* just in case */ 2745 return; 2746 } 2747 /* 2748 * If there are more packets, set the more packets bit 2749 * in the packet dispatched to the station; otherwise 2750 * turn off the TIM bit. 2751 */ 2752 if (qlen != 0) { 2753 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2754 "[%6D] recv ps-poll, send packet, %u still queued\n", 2755 ni->ni_macaddr, ":", qlen); 2756 m->m_flags |= M_MORE_DATA; 2757 } else { 2758 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2759 "[%6D] recv ps-poll, send packet, queue empty\n", 2760 ni->ni_macaddr, ":"); 2761 if (ic->ic_set_tim != NULL) 2762 ic->ic_set_tim(ni, 0); 2763 } 2764 m->m_flags |= M_PWR_SAV; /* bypass PS handling */ 2765 ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL); /* XXX bypasses ALTQ */ 2766 } 2767 2768 #ifdef IEEE80211_DEBUG 2769 /* 2770 * Debugging support. 2771 */ 2772 2773 /* 2774 * Return the bssid of a frame. 2775 */ 2776 static const uint8_t * 2777 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh) 2778 { 2779 if (ic->ic_opmode == IEEE80211_M_STA) 2780 return wh->i_addr2; 2781 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS) 2782 return wh->i_addr1; 2783 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL) 2784 return wh->i_addr1; 2785 return wh->i_addr3; 2786 } 2787 2788 void 2789 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...) 2790 { 2791 char buf[128]; /* XXX */ 2792 __va_list ap; 2793 2794 __va_start(ap, fmt); 2795 kvsnprintf(buf, sizeof(buf), fmt, ap); 2796 __va_end(ap); 2797 2798 if_printf(ic->ic_ifp, "%s", buf); /* NB: no \n */ 2799 } 2800 2801 void 2802 ieee80211_note_frame(struct ieee80211com *ic, 2803 const struct ieee80211_frame *wh, 2804 const char *fmt, ...) 2805 { 2806 char buf[128]; /* XXX */ 2807 __va_list ap; 2808 2809 __va_start(ap, fmt); 2810 kvsnprintf(buf, sizeof(buf), fmt, ap); 2811 __va_end(ap); 2812 if_printf(ic->ic_ifp, "[%6D] %s\n", 2813 ieee80211_getbssid(ic, wh), ":", buf); 2814 } 2815 2816 void 2817 ieee80211_note_mac(struct ieee80211com *ic, 2818 const uint8_t mac[IEEE80211_ADDR_LEN], 2819 const char *fmt, ...) 2820 { 2821 char buf[128]; /* XXX */ 2822 __va_list ap; 2823 2824 __va_start(ap, fmt); 2825 kvsnprintf(buf, sizeof(buf), fmt, ap); 2826 __va_end(ap); 2827 if_printf(ic->ic_ifp, "[%6D] %s\n", mac, ":", buf); 2828 } 2829 2830 static void 2831 ieee80211_discard_frame(struct ieee80211com *ic, 2832 const struct ieee80211_frame *wh, 2833 const char *type, const char *fmt, ...) 2834 { 2835 __va_list ap; 2836 2837 kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname, 2838 ieee80211_getbssid(ic, wh), ":"); 2839 if (type != NULL) 2840 kprintf("%s frame, ", type); 2841 else 2842 kprintf("frame, "); 2843 __va_start(ap, fmt); 2844 kvprintf(fmt, ap); 2845 __va_end(ap); 2846 kprintf("\n"); 2847 } 2848 2849 static void 2850 ieee80211_discard_ie(struct ieee80211com *ic, 2851 const struct ieee80211_frame *wh, 2852 const char *type, const char *fmt, ...) 2853 { 2854 __va_list ap; 2855 2856 kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname, 2857 ieee80211_getbssid(ic, wh), ":"); 2858 if (type != NULL) 2859 kprintf("%s information element, ", type); 2860 else 2861 kprintf("information element, "); 2862 __va_start(ap, fmt); 2863 kvprintf(fmt, ap); 2864 __va_end(ap); 2865 kprintf("\n"); 2866 } 2867 2868 static void 2869 ieee80211_discard_mac(struct ieee80211com *ic, 2870 const uint8_t mac[IEEE80211_ADDR_LEN], 2871 const char *type, const char *fmt, ...) 2872 { 2873 __va_list ap; 2874 2875 kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname, mac, ":"); 2876 if (type != NULL) 2877 kprintf("%s frame, ", type); 2878 else 2879 kprintf("frame, "); 2880 __va_start(ap, fmt); 2881 kvprintf(fmt, ap); 2882 __va_end(ap); 2883 kprintf("\n"); 2884 } 2885 #endif /* IEEE80211_DEBUG */ 2886