xref: /netbsd-src/sys/net80211/ieee80211_ioctl.c (revision f3cfa6f6ce31685c6c4a758bc430e69eb99f50a4)
1 /*	$NetBSD: ieee80211_ioctl.c,v 1.66 2019/05/17 04:08:54 msaitoh Exp $	*/
2 /*-
3  * Copyright (c) 2001 Atsushi Onoe
4  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. The name of the author may not be used to endorse or promote products
16  *    derived from this software without specific prior written permission.
17  *
18  * Alternatively, this software may be distributed under the terms of the
19  * GNU General Public License ("GPL") version 2 as published by the Free
20  * Software Foundation.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32  */
33 
34 #include <sys/cdefs.h>
35 #ifdef __FreeBSD__
36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_ioctl.c,v 1.35 2005/08/30 14:27:47 avatar Exp $");
37 #endif
38 #ifdef __NetBSD__
39 __KERNEL_RCSID(0, "$NetBSD: ieee80211_ioctl.c,v 1.66 2019/05/17 04:08:54 msaitoh Exp $");
40 #endif
41 
42 /*
43  * IEEE 802.11 ioctl support (FreeBSD-specific)
44  */
45 
46 #ifdef _KERNEL_OPT
47 #include "opt_inet.h"
48 #include "opt_compat_netbsd.h"
49 #endif
50 
51 #include <sys/endian.h>
52 #include <sys/param.h>
53 #include <sys/kernel.h>
54 #include <sys/socket.h>
55 #include <sys/sockio.h>
56 #include <sys/systm.h>
57 #include <sys/proc.h>
58 #include <sys/kauth.h>
59 #include <sys/module.h>
60 #include <sys/compat_stub.h>
61 
62 #include <net/if.h>
63 #include <net/if_arp.h>
64 #include <net/if_media.h>
65 #include <net/if_ether.h>
66 
67 #ifdef INET
68 #include <netinet/in.h>
69 #include <netinet/if_inarp.h>
70 #endif
71 
72 #include <net80211/ieee80211_var.h>
73 #include <net80211/ieee80211_ioctl.h>
74 
75 #include <dev/ic/wi_ieee.h>
76 
77 #include <compat/sys/sockio.h>
78 
79 #ifdef __FreeBSD__
80 #define	IS_UP(_ic) \
81 	(((_ic)->ic_ifp->if_flags & IFF_UP) &&			\
82 	    ((_ic)->ic_ifp->if_drv_flags & IFF_DRV_RUNNING))
83 #endif
84 #ifdef __NetBSD__
85 #define	IS_UP(_ic) \
86 	(((_ic)->ic_ifp->if_flags & IFF_UP) &&			\
87 	    ((_ic)->ic_ifp->if_flags & IFF_RUNNING))
88 #endif
89 #define	IS_UP_AUTO(_ic) \
90 	(IS_UP(_ic) && (_ic)->ic_roaming == IEEE80211_ROAMING_AUTO)
91 
92 /*
93  * XXX
94  * Wireless LAN specific configuration interface, which is compatible
95  * with wicontrol(8).
96  */
97 
98 struct wi_read_ap_args {
99 	int	i;		/* result count */
100 	struct wi_apinfo *ap;	/* current entry in result buffer */
101 	void *	max;		/* result buffer bound */
102 };
103 
104 static void
105 wi_read_ap_result(void *arg, struct ieee80211_node *ni)
106 {
107 	struct ieee80211com *ic = ni->ni_ic;
108 	struct wi_read_ap_args *sa = arg;
109 	struct wi_apinfo *ap = sa->ap;
110 	struct ieee80211_rateset *rs;
111 	int j;
112 
113 	if ((void *)(ap + 1) > sa->max)
114 		return;
115 	memset(ap, 0, sizeof(struct wi_apinfo));
116 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
117 		IEEE80211_ADDR_COPY(ap->bssid, ni->ni_macaddr);
118 		ap->namelen = ic->ic_des_esslen;
119 		if (ic->ic_des_esslen)
120 			memcpy(ap->name, ic->ic_des_essid,
121 			    ic->ic_des_esslen);
122 	} else {
123 		IEEE80211_ADDR_COPY(ap->bssid, ni->ni_bssid);
124 		ap->namelen = ni->ni_esslen;
125 		if (ni->ni_esslen)
126 			memcpy(ap->name, ni->ni_essid,
127 			    ni->ni_esslen);
128 	}
129 	ap->channel = ieee80211_chan2ieee(ic, ni->ni_chan);
130 	ap->signal = ic->ic_node_getrssi(ni);
131 	ap->capinfo = ni->ni_capinfo;
132 	ap->interval = ni->ni_intval;
133 	rs = &ni->ni_rates;
134 	for (j = 0; j < rs->rs_nrates; j++) {
135 		if (rs->rs_rates[j] & IEEE80211_RATE_BASIC) {
136 			ap->rate = (rs->rs_rates[j] &
137 			    IEEE80211_RATE_VAL) * 5; /* XXX */
138 		}
139 	}
140 	sa->i++;
141 	sa->ap++;
142 }
143 
144 struct wi_read_prism2_args {
145 	int	i;		/* result count */
146 	struct wi_scan_res *res;/* current entry in result buffer */
147 	void *	max;		/* result buffer bound */
148 };
149 
150 #if 0
151 static void
152 wi_read_prism2_result(void *arg, struct ieee80211_node *ni)
153 {
154 	struct ieee80211com *ic = ni->ni_ic;
155 	struct wi_read_prism2_args *sa = arg;
156 	struct wi_scan_res *res = sa->res;
157 
158 	if ((void *)(res + 1) > sa->max)
159 		return;
160 	res->wi_chan = ieee80211_chan2ieee(ic, ni->ni_chan);
161 	res->wi_noise = 0;
162 	res->wi_signal = ic->ic_node_getrssi(ni);
163 	IEEE80211_ADDR_COPY(res->wi_bssid, ni->ni_bssid);
164 	res->wi_interval = ni->ni_intval;
165 	res->wi_capinfo = ni->ni_capinfo;
166 	res->wi_ssid_len = ni->ni_esslen;
167 	memcpy(res->wi_ssid, ni->ni_essid, IEEE80211_NWID_LEN);
168 	/* NB: assumes wi_srates holds <= ni->ni_rates */
169 	memcpy(res->wi_srates, ni->ni_rates.rs_rates,
170 		sizeof(res->wi_srates));
171 	if (ni->ni_rates.rs_nrates < 10)
172 		res->wi_srates[ni->ni_rates.rs_nrates] = 0;
173 	res->wi_rate = ni->ni_rates.rs_rates[ni->ni_txrate];
174 	res->wi_rsvd = 0;
175 
176 	sa->i++;
177 	sa->res++;
178 }
179 
180 struct wi_read_sigcache_args {
181 	int	i;		/* result count */
182 	struct wi_sigcache *wsc;/* current entry in result buffer */
183 	void *	max;		/* result buffer bound */
184 };
185 
186 static void
187 wi_read_sigcache(void *arg, struct ieee80211_node *ni)
188 {
189 	struct ieee80211com *ic = ni->ni_ic;
190 	struct wi_read_sigcache_args *sa = arg;
191 	struct wi_sigcache *wsc = sa->wsc;
192 
193 	if ((void *)(wsc + 1) > sa->max)
194 		return;
195 	memset(wsc, 0, sizeof(struct wi_sigcache));
196 	IEEE80211_ADDR_COPY(wsc->macsrc, ni->ni_macaddr);
197 	wsc->signal = ic->ic_node_getrssi(ni);
198 
199 	sa->wsc++;
200 	sa->i++;
201 }
202 #endif
203 
204 int
205 ieee80211_cfgget(struct ieee80211com *ic, u_long cmd, void *data)
206 {
207 	struct ifnet *ifp = ic->ic_ifp;
208 	int i, j, error;
209 	struct ifreq *ifr = (struct ifreq *)data;
210 	struct wi_req *wreq;
211 	struct wi_ltv_keys *keys;
212 
213 	wreq = malloc(sizeof(*wreq), M_TEMP, M_WAITOK);
214 	error = copyin(ifr->ifr_data, wreq, sizeof(*wreq));
215 	if (error)
216 		goto out;
217 	wreq->wi_len = 0;
218 	switch (wreq->wi_type) {
219 	case WI_RID_SERIALNO:
220 	case WI_RID_STA_IDENTITY:
221 		/* nothing appropriate */
222 		break;
223 	case WI_RID_NODENAME:
224 		strlcpy((char *)&wreq->wi_val[1], hostname,
225 		    sizeof(wreq->wi_val) - sizeof(wreq->wi_val[0]));
226 		wreq->wi_val[0] = htole16(strlen(hostname));
227 		wreq->wi_len = (1 + strlen(hostname) + 1) / 2;
228 		break;
229 	case WI_RID_CURRENT_SSID:
230 		if (ic->ic_state != IEEE80211_S_RUN) {
231 			wreq->wi_val[0] = 0;
232 			wreq->wi_len = 1;
233 			break;
234 		}
235 		wreq->wi_val[0] = htole16(ic->ic_bss->ni_esslen);
236 		memcpy(&wreq->wi_val[1], ic->ic_bss->ni_essid,
237 		    ic->ic_bss->ni_esslen);
238 		wreq->wi_len = (1 + ic->ic_bss->ni_esslen + 1) / 2;
239 		break;
240 	case WI_RID_OWN_SSID:
241 	case WI_RID_DESIRED_SSID:
242 		wreq->wi_val[0] = htole16(ic->ic_des_esslen);
243 		memcpy(&wreq->wi_val[1], ic->ic_des_essid, ic->ic_des_esslen);
244 		wreq->wi_len = (1 + ic->ic_des_esslen + 1) / 2;
245 		break;
246 	case WI_RID_CURRENT_BSSID:
247 		if (ic->ic_state == IEEE80211_S_RUN)
248 			IEEE80211_ADDR_COPY(wreq->wi_val, ic->ic_bss->ni_bssid);
249 		else
250 			memset(wreq->wi_val, 0, IEEE80211_ADDR_LEN);
251 		wreq->wi_len = IEEE80211_ADDR_LEN / 2;
252 		break;
253 	case WI_RID_CHANNEL_LIST:
254 		memset(wreq->wi_val, 0, sizeof(wreq->wi_val));
255 		/*
256 		 * Since channel 0 is not available for DS, channel 1
257 		 * is assigned to LSB on WaveLAN.
258 		 */
259 		if (ic->ic_phytype == IEEE80211_T_DS)
260 			i = 1;
261 		else
262 			i = 0;
263 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++)
264 			if (isset(ic->ic_chan_active, i)) {
265 				setbit((u_int8_t *)wreq->wi_val, j);
266 				wreq->wi_len = j / 16 + 1;
267 			}
268 		break;
269 	case WI_RID_OWN_CHNL:
270 		wreq->wi_val[0] = htole16(
271 			ieee80211_chan2ieee(ic, ic->ic_ibss_chan));
272 		wreq->wi_len = 1;
273 		break;
274 	case WI_RID_CURRENT_CHAN:
275 		wreq->wi_val[0] = htole16(
276 			ieee80211_chan2ieee(ic, ic->ic_curchan));
277 		wreq->wi_len = 1;
278 		break;
279 	case WI_RID_COMMS_QUALITY:
280 		wreq->wi_val[0] = 0;				/* quality */
281 		wreq->wi_val[1] = htole16(ic->ic_node_getrssi(ic->ic_bss));
282 		wreq->wi_val[2] = 0;				/* noise */
283 		wreq->wi_len = 3;
284 		break;
285 	case WI_RID_PROMISC:
286 		wreq->wi_val[0] = htole16((ifp->if_flags & IFF_PROMISC) ? 1 : 0);
287 		wreq->wi_len = 1;
288 		break;
289 	case WI_RID_PORTTYPE:
290 		wreq->wi_val[0] = htole16(ic->ic_opmode);
291 		wreq->wi_len = 1;
292 		break;
293 	case WI_RID_MAC_NODE:
294 		IEEE80211_ADDR_COPY(wreq->wi_val, ic->ic_myaddr);
295 		wreq->wi_len = IEEE80211_ADDR_LEN / 2;
296 		break;
297 	case WI_RID_TX_RATE:
298 		if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
299 			wreq->wi_val[0] = 0;	/* auto */
300 		else
301 			wreq->wi_val[0] = htole16(
302 			    (ic->ic_sup_rates[ic->ic_curmode].rs_rates[ic->ic_fixed_rate] &
303 			    IEEE80211_RATE_VAL) / 2);
304 		wreq->wi_len = 1;
305 		break;
306 	case WI_RID_CUR_TX_RATE:
307 		wreq->wi_val[0] = htole16(
308 		    (ic->ic_bss->ni_rates.rs_rates[ic->ic_bss->ni_txrate] &
309 		    IEEE80211_RATE_VAL) / 2);
310 		wreq->wi_len = 1;
311 		break;
312 	case WI_RID_FRAG_THRESH:
313 		wreq->wi_val[0] = htole16(ic->ic_fragthreshold);
314 		wreq->wi_len = 1;
315 		break;
316 	case WI_RID_RTS_THRESH:
317 		wreq->wi_val[0] = htole16(ic->ic_rtsthreshold);
318 		wreq->wi_len = 1;
319 		break;
320 	case WI_RID_CREATE_IBSS:
321 		wreq->wi_val[0] =
322 		    htole16((ic->ic_flags & IEEE80211_F_IBSSON) ? 1 : 0);
323 		wreq->wi_len = 1;
324 		break;
325 	case WI_RID_MICROWAVE_OVEN:
326 		wreq->wi_val[0] = 0;	/* no ... not supported */
327 		wreq->wi_len = 1;
328 		break;
329 	case WI_RID_ROAMING_MODE:
330 		wreq->wi_val[0] = htole16(ic->ic_roaming);	/* XXX map */
331 		wreq->wi_len = 1;
332 		break;
333 	case WI_RID_SYSTEM_SCALE:
334 		wreq->wi_val[0] = htole16(1);	/* low density ... not supp */
335 		wreq->wi_len = 1;
336 		break;
337 	case WI_RID_PM_ENABLED:
338 		wreq->wi_val[0] =
339 		    htole16((ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0);
340 		wreq->wi_len = 1;
341 		break;
342 	case WI_RID_MAX_SLEEP:
343 		wreq->wi_val[0] = htole16(ic->ic_lintval);
344 		wreq->wi_len = 1;
345 		break;
346 	case WI_RID_CUR_BEACON_INT:
347 		wreq->wi_val[0] = htole16(ic->ic_bss->ni_intval);
348 		wreq->wi_len = 1;
349 		break;
350 	case WI_RID_WEP_AVAIL:
351 		wreq->wi_val[0] = htole16(1);	/* always available */
352 		wreq->wi_len = 1;
353 		break;
354 	case WI_RID_CNFAUTHMODE:
355 		wreq->wi_val[0] = htole16(1);	/* TODO: open system only */
356 		wreq->wi_len = 1;
357 		break;
358 	case WI_RID_ENCRYPTION:
359 		wreq->wi_val[0] =
360 		    htole16((ic->ic_flags & IEEE80211_F_PRIVACY) ? 1 : 0);
361 		wreq->wi_len = 1;
362 		break;
363 	case WI_RID_TX_CRYPT_KEY:
364 		wreq->wi_val[0] = htole16(ic->ic_def_txkey);
365 		wreq->wi_len = 1;
366 		break;
367 	case WI_RID_DEFLT_CRYPT_KEYS:
368 		keys = (struct wi_ltv_keys *)wreq;
369 		/* do not show keys to non-root user */
370 		error = kauth_authorize_network(curlwp->l_cred,
371 		    KAUTH_NETWORK_INTERFACE,
372 		    KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp,
373 		    NULL, NULL);
374 		if (error) {
375 			memset(keys, 0, sizeof(*keys));
376 			error = 0;
377 			break;
378 		}
379 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
380 			keys->wi_keys[i].wi_keylen =
381 			    htole16(ic->ic_nw_keys[i].wk_keylen);
382 			memcpy(keys->wi_keys[i].wi_keydat,
383 			    ic->ic_nw_keys[i].wk_key,
384 			    ic->ic_nw_keys[i].wk_keylen);
385 		}
386 		wreq->wi_len = sizeof(*keys) / 2;
387 		break;
388 	case WI_RID_MAX_DATALEN:
389 		wreq->wi_val[0] = htole16(ic->ic_fragthreshold);
390 		wreq->wi_len = 1;
391 		break;
392 	case WI_RID_DBM_ADJUST:
393 		/* not supported, we just pass rssi value from driver. */
394 		break;
395 	case WI_RID_IFACE_STATS:
396 		/* XXX: should be implemented in lower drivers */
397 		break;
398 	case WI_RID_READ_APS:
399 		/*
400 		 * Don't return results until active scan completes.
401 		 */
402 		if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
403 			struct wi_read_ap_args args;
404 
405 			args.i = 0;
406 			args.ap = (void *)((char *)wreq->wi_val + sizeof(i));
407 			args.max = (void *)(wreq + 1);
408 			ieee80211_iterate_nodes(&ic->ic_scan,
409 				wi_read_ap_result, &args);
410 			memcpy(wreq->wi_val, &args.i, sizeof(args.i));
411 			wreq->wi_len = (sizeof(int) +
412 				sizeof(struct wi_apinfo) * args.i) / 2;
413 		} else
414 			error = EINPROGRESS;
415 		break;
416 #if 0
417 	case WI_RID_SCAN_RES:			/* compatibility interface */
418 		if ((ic->ic_flags & (IEEE80211_F_SCAN|IEEE80211_F_ASCAN)) == 0) {
419 			struct wi_read_prism2_args args;
420 			struct wi_scan_p2_hdr *p2;
421 
422 			/* NB: use Prism2 format so we can include rate info */
423 			p2 = (struct wi_scan_p2_hdr *)wreq->wi_val;
424 			args.i = 0;
425 			args.res = (void *)&p2[1];
426 			args.max = (void *)(wreq + 1);
427 			ieee80211_iterate_nodes(&ic->ic_scan,
428 				wi_read_prism2_result, &args);
429 			p2->wi_rsvd = 0;
430 			p2->wi_reason = args.i;
431 			wreq->wi_len = (sizeof(*p2) +
432 				sizeof(struct wi_scan_res) * args.i) / 2;
433 		} else
434 			error = EINPROGRESS;
435 		break;
436 	case WI_RID_READ_CACHE: {
437 		struct wi_read_sigcache_args args;
438 		args.i = 0;
439 		args.wsc = (struct wi_sigcache *) wreq->wi_val;
440 		args.max = (void *)(wreq + 1);
441 		ieee80211_iterate_nodes(&ic->ic_scan, wi_read_sigcache, &args);
442 		wreq->wi_len = sizeof(struct wi_sigcache) * args.i / 2;
443 		break;
444 	}
445 #endif
446 	default:
447 		error = EINVAL;
448 		break;
449 	}
450 	if (error == 0) {
451 		wreq->wi_len++;
452 		error = copyout(wreq, ifr->ifr_data, sizeof(*wreq));
453 	}
454 out:
455 	free(wreq, M_TEMP);
456 	return error;
457 }
458 
459 static int
460 findrate(struct ieee80211com *ic, enum ieee80211_phymode mode, int rate)
461 {
462 #define	IEEERATE(_ic,_m,_i) \
463 	((_ic)->ic_sup_rates[_m].rs_rates[_i] & IEEE80211_RATE_VAL)
464 	int i, nrates = ic->ic_sup_rates[mode].rs_nrates;
465 	for (i = 0; i < nrates; i++)
466 		if (IEEERATE(ic, mode, i) == rate)
467 			return i;
468 	return -1;
469 #undef IEEERATE
470 }
471 
472 /*
473  * Prepare to do a user-initiated scan for AP's.  If no
474  * current/default channel is setup or the current channel
475  * is invalid then pick the first available channel from
476  * the active list as the place to start the scan.
477  */
478 static int
479 ieee80211_setupscan(struct ieee80211com *ic, const u_int8_t chanlist[])
480 {
481 
482 	/*
483 	 * XXX don't permit a scan to be started unless we
484 	 * know the device is ready.  For the moment this means
485 	 * the device is marked up as this is the required to
486 	 * initialize the hardware.  It would be better to permit
487 	 * scanning prior to being up but that'll require some
488 	 * changes to the infrastructure.
489 	 */
490 	if (!IS_UP(ic))
491 		return EINVAL;
492 	memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
493 	/*
494 	 * We force the state to INIT before calling ieee80211_new_state
495 	 * to get ieee80211_begin_scan called.  We really want to scan w/o
496 	 * altering the current state but that's not possible right now.
497 	 */
498 	/* XXX handle proberequest case */
499 	ic->ic_state = IEEE80211_S_INIT;	/* XXX bypass state machine */
500 	return 0;
501 }
502 
503 int
504 ieee80211_cfgset(struct ieee80211com *ic, u_long cmd, void *data)
505 {
506 	struct ifnet *ifp = ic->ic_ifp;
507 	int i, j, len, error, rate;
508 	struct ifreq *ifr = (struct ifreq *)data;
509 	struct wi_ltv_keys *keys;
510 	struct wi_req *wreq;
511 	u_int8_t chanlist[IEEE80211_CHAN_BYTES];
512 
513 	wreq = malloc(sizeof(*wreq), M_TEMP, M_WAITOK);
514 	error = copyin(ifr->ifr_data, wreq, sizeof(*wreq));
515 	if (error)
516 		goto out;
517 	len = wreq->wi_len ? (wreq->wi_len - 1) * 2 : 0;
518 	switch (wreq->wi_type) {
519 	case WI_RID_SERIALNO:
520 	case WI_RID_NODENAME:
521 	case WI_RID_CURRENT_SSID:
522 		error = EPERM;
523 		goto out;
524 	case WI_RID_OWN_SSID:
525 	case WI_RID_DESIRED_SSID:
526 		if (le16toh(wreq->wi_val[0]) * 2 > len ||
527 		    le16toh(wreq->wi_val[0]) > IEEE80211_NWID_LEN) {
528 			error = ENOSPC;
529 			break;
530 		}
531 		memset(ic->ic_des_essid, 0, sizeof(ic->ic_des_essid));
532 		ic->ic_des_esslen = le16toh(wreq->wi_val[0]) * 2;
533 		memcpy(ic->ic_des_essid, &wreq->wi_val[1], ic->ic_des_esslen);
534 		error = ENETRESET;
535 		break;
536 	case WI_RID_CURRENT_BSSID:
537 		error = EPERM;
538 		goto out;
539 	case WI_RID_OWN_CHNL:
540 		if (len != 2)
541 			goto invalid;
542 		i = le16toh(wreq->wi_val[0]);
543 		if (i < 0 ||
544 		    i > IEEE80211_CHAN_MAX ||
545 		    isclr(ic->ic_chan_active, i))
546 			goto invalid;
547 		ic->ic_ibss_chan = &ic->ic_channels[i];
548 		if (ic->ic_opmode == IEEE80211_M_MONITOR)
549 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
550 		else
551 			error = ENETRESET;
552 		break;
553 	case WI_RID_CURRENT_CHAN:
554 	case WI_RID_COMMS_QUALITY:
555 		error = EPERM;
556 		goto out;
557 	case WI_RID_PROMISC:
558 		if (len != 2)
559 			goto invalid;
560 		if (ifp->if_flags & IFF_PROMISC) {
561 			if (wreq->wi_val[0] == 0) {
562 				ifp->if_flags &= ~IFF_PROMISC;
563 				error = ENETRESET;
564 			}
565 		} else {
566 			if (wreq->wi_val[0] != 0) {
567 				ifp->if_flags |= IFF_PROMISC;
568 				error = ENETRESET;
569 			}
570 		}
571 		break;
572 	case WI_RID_PORTTYPE:
573 		if (len != 2)
574 			goto invalid;
575 		switch (le16toh(wreq->wi_val[0])) {
576 		case IEEE80211_M_STA:
577 			break;
578 		case IEEE80211_M_IBSS:
579 			if (!(ic->ic_caps & IEEE80211_C_IBSS))
580 				goto invalid;
581 			break;
582 		case IEEE80211_M_AHDEMO:
583 			if (ic->ic_phytype != IEEE80211_T_DS ||
584 			    !(ic->ic_caps & IEEE80211_C_AHDEMO))
585 				goto invalid;
586 			break;
587 		case IEEE80211_M_HOSTAP:
588 			if (!(ic->ic_caps & IEEE80211_C_HOSTAP))
589 				goto invalid;
590 			break;
591 		default:
592 			goto invalid;
593 		}
594 		if (le16toh(wreq->wi_val[0]) != ic->ic_opmode) {
595 			ic->ic_opmode = le16toh(wreq->wi_val[0]);
596 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
597 		}
598 		break;
599 #if 0
600 	case WI_RID_MAC_NODE:
601 		if (len != IEEE80211_ADDR_LEN)
602 			goto invalid;
603 		IEEE80211_ADDR_COPY(LLADDR(ifp->if_sadl), wreq->wi_val);
604 		/* if_init will copy lladdr into ic_myaddr */
605 		error = ENETRESET;
606 		break;
607 #endif
608 	case WI_RID_TX_RATE:
609 		if (len != 2)
610 			goto invalid;
611 		if (wreq->wi_val[0] == 0) {
612 			/* auto */
613 			ic->ic_fixed_rate = IEEE80211_FIXED_RATE_NONE;
614 			break;
615 		}
616 		rate = 2 * le16toh(wreq->wi_val[0]);
617 		if (ic->ic_curmode == IEEE80211_MODE_AUTO) {
618 			/*
619 			 * In autoselect mode search for the rate.  We take
620 			 * the first instance which may not be right, but we
621 			 * are limited by the interface.  Note that we also
622 			 * lock the mode to insure the rate is meaningful
623 			 * when it is used.
624 			 */
625 			for (j = IEEE80211_MODE_11A;
626 			     j < IEEE80211_MODE_MAX; j++) {
627 				if ((ic->ic_modecaps & (1<<j)) == 0)
628 					continue;
629 				i = findrate(ic, j, rate);
630 				if (i != -1) {
631 					/* lock mode too */
632 					ic->ic_curmode = j;
633 					goto setrate;
634 				}
635 			}
636 		} else {
637 			i = findrate(ic, ic->ic_curmode, rate);
638 			if (i != -1)
639 				goto setrate;
640 		}
641 		goto invalid;
642 	setrate:
643 		ic->ic_fixed_rate = i;
644 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
645 		break;
646 	case WI_RID_CUR_TX_RATE:
647 		error = EPERM;
648 		goto out;
649 	case WI_RID_FRAG_THRESH:
650 		if (len != 2)
651 			goto invalid;
652 		ic->ic_fragthreshold = le16toh(wreq->wi_val[0]);
653 		error = ENETRESET;
654 		break;
655 	case WI_RID_RTS_THRESH:
656 		if (len != 2)
657 			goto invalid;
658 		ic->ic_rtsthreshold = le16toh(wreq->wi_val[0]);
659 		error = ENETRESET;
660 		break;
661 	case WI_RID_CREATE_IBSS:
662 		if (len != 2)
663 			goto invalid;
664 		if (wreq->wi_val[0] != 0) {
665 			if ((ic->ic_caps & IEEE80211_C_IBSS) == 0)
666 				goto invalid;
667 			if ((ic->ic_flags & IEEE80211_F_IBSSON) == 0) {
668 				ic->ic_flags |= IEEE80211_F_IBSSON;
669 				if (ic->ic_opmode == IEEE80211_M_IBSS &&
670 				    ic->ic_state == IEEE80211_S_SCAN)
671 					error = IS_UP_AUTO(ic) ? ENETRESET : 0;
672 			}
673 		} else {
674 			if (ic->ic_flags & IEEE80211_F_IBSSON) {
675 				ic->ic_flags &= ~IEEE80211_F_IBSSON;
676 				if (ic->ic_flags & IEEE80211_F_SIBSS) {
677 					ic->ic_flags &= ~IEEE80211_F_SIBSS;
678 					error = IS_UP_AUTO(ic) ? ENETRESET : 0;
679 				}
680 			}
681 		}
682 		break;
683 	case WI_RID_MICROWAVE_OVEN:
684 		if (len != 2)
685 			goto invalid;
686 		if (wreq->wi_val[0] != 0)
687 			goto invalid;		/* not supported */
688 		break;
689 	case WI_RID_ROAMING_MODE:
690 		if (len != 2)
691 			goto invalid;
692 		i = le16toh(wreq->wi_val[0]);
693 		if (i > IEEE80211_ROAMING_MANUAL)
694 			goto invalid;		/* not supported */
695 		ic->ic_roaming = i;
696 		break;
697 	case WI_RID_SYSTEM_SCALE:
698 		if (len != 2)
699 			goto invalid;
700 		if (le16toh(wreq->wi_val[0]) != 1)
701 			goto invalid;		/* not supported */
702 		break;
703 	case WI_RID_PM_ENABLED:
704 		if (len != 2)
705 			goto invalid;
706 		if (wreq->wi_val[0] != 0) {
707 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
708 				goto invalid;
709 			if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
710 				ic->ic_flags |= IEEE80211_F_PMGTON;
711 				error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
712 			}
713 		} else {
714 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
715 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
716 				error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
717 			}
718 		}
719 		break;
720 	case WI_RID_MAX_SLEEP:
721 		if (len != 2)
722 			goto invalid;
723 		ic->ic_lintval = le16toh(wreq->wi_val[0]);
724 		if (ic->ic_flags & IEEE80211_F_PMGTON)
725 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
726 		break;
727 	case WI_RID_CUR_BEACON_INT:
728 	case WI_RID_WEP_AVAIL:
729 		error = EPERM;
730 		goto out;
731 	case WI_RID_CNFAUTHMODE:
732 		if (len != 2)
733 			goto invalid;
734 		i = le16toh(wreq->wi_val[0]);
735 		if (i > IEEE80211_AUTH_WPA)
736 			goto invalid;
737 		ic->ic_bss->ni_authmode = i;		/* XXX ENETRESET? */
738 		error = ENETRESET;
739 		break;
740 	case WI_RID_ENCRYPTION:
741 		if (len != 2)
742 			goto invalid;
743 		if (wreq->wi_val[0] != 0) {
744 			if ((ic->ic_caps & IEEE80211_C_WEP) == 0)
745 				goto invalid;
746 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
747 				ic->ic_flags |= IEEE80211_F_PRIVACY;
748 				error = ENETRESET;
749 			}
750 		} else {
751 			if (ic->ic_flags & IEEE80211_F_PRIVACY) {
752 				ic->ic_flags &= ~IEEE80211_F_PRIVACY;
753 				error = ENETRESET;
754 			}
755 		}
756 		break;
757 	case WI_RID_TX_CRYPT_KEY:
758 		if (len != 2)
759 			goto invalid;
760 		i = le16toh(wreq->wi_val[0]);
761 		if (i >= IEEE80211_WEP_NKID)
762 			goto invalid;
763 		ic->ic_def_txkey = i;
764 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
765 		break;
766 	case WI_RID_DEFLT_CRYPT_KEYS:
767 		if (len != sizeof(struct wi_ltv_keys))
768 			goto invalid;
769 		keys = (struct wi_ltv_keys *)wreq;
770 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
771 			len = le16toh(keys->wi_keys[i].wi_keylen);
772 			if (len != 0 && len < IEEE80211_WEP_KEYLEN)
773 				goto invalid;
774 			if (len > IEEE80211_KEYBUF_SIZE)
775 				goto invalid;
776 		}
777 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
778 			struct ieee80211_key *k = &ic->ic_nw_keys[i];
779 
780 			len = le16toh(keys->wi_keys[i].wi_keylen);
781 			k->wk_keylen = len;
782 			k->wk_flags = IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV;
783 			memset(k->wk_key, 0, sizeof(k->wk_key));
784 			memcpy(k->wk_key, keys->wi_keys[i].wi_keydat, len);
785 #if 0
786 			k->wk_type = IEEE80211_CIPHER_WEP;
787 #endif
788 		}
789 		error = ENETRESET;
790 		break;
791 	case WI_RID_MAX_DATALEN:
792 		if (len != 2)
793 			goto invalid;
794 		len = le16toh(wreq->wi_val[0]);
795 		if (len < 350 /* ? */ || len > IEEE80211_MAX_LEN)
796 			goto invalid;
797 		ic->ic_fragthreshold = len;
798 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
799 		break;
800 	case WI_RID_IFACE_STATS:
801 		error = EPERM;
802 		break;
803 	case WI_RID_SCAN_REQ:			/* XXX wicontrol */
804 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
805 			break;
806 		error = ieee80211_setupscan(ic, ic->ic_chan_avail);
807 		if (error == 0)
808 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
809 		break;
810 	case WI_RID_SCAN_APS:
811 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)
812 			break;
813 		len--;			/* XXX: tx rate? */
814 		/* FALLTHRU */
815 	case WI_RID_CHANNEL_LIST:
816 		memset(chanlist, 0, sizeof(chanlist));
817 		/*
818 		 * Since channel 0 is not available for DS, channel 1
819 		 * is assigned to LSB on WaveLAN.
820 		 */
821 		if (ic->ic_phytype == IEEE80211_T_DS)
822 			i = 1;
823 		else
824 			i = 0;
825 		for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
826 			if ((j / 8) >= len)
827 				break;
828 			if (isclr((u_int8_t *)wreq->wi_val, j))
829 				continue;
830 			if (isclr(ic->ic_chan_active, i)) {
831 				if (wreq->wi_type != WI_RID_CHANNEL_LIST)
832 					continue;
833 				if (isclr(ic->ic_chan_avail, i)) {
834 					error = EPERM;
835 					goto out;
836 				}
837 			}
838 			setbit(chanlist, i);
839 		}
840 		error = ieee80211_setupscan(ic, chanlist);
841 		if (wreq->wi_type == WI_RID_CHANNEL_LIST) {
842 			/* NB: ignore error from ieee80211_setupscan */
843 			error = ENETRESET;
844 		} else if (error == 0)
845 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
846 		break;
847 	default:
848 		goto invalid;
849 	}
850 	if (error == ENETRESET && !IS_UP_AUTO(ic))
851 		error = 0;
852 out:
853 	free(wreq, M_TEMP);
854 	return error;
855 invalid:
856 	free(wreq, M_TEMP);
857 	return EINVAL;
858 }
859 
860 static int
861 cap2cipher(int flag)
862 {
863 	switch (flag) {
864 	case IEEE80211_C_WEP:		return IEEE80211_CIPHER_WEP;
865 	case IEEE80211_C_AES:		return IEEE80211_CIPHER_AES_OCB;
866 	case IEEE80211_C_AES_CCM:	return IEEE80211_CIPHER_AES_CCM;
867 	case IEEE80211_C_CKIP:		return IEEE80211_CIPHER_CKIP;
868 	case IEEE80211_C_TKIP:		return IEEE80211_CIPHER_TKIP;
869 	}
870 	return -1;
871 }
872 
873 static int
874 ieee80211_ioctl_getkey(struct ieee80211com *ic, struct ieee80211req *ireq)
875 {
876 	struct ieee80211_node *ni;
877 	struct ieee80211req_key ik;
878 	struct ieee80211_key *wk;
879 	const struct ieee80211_cipher *cip;
880 	u_int kid;
881 	int error;
882 
883 	if (ireq->i_len != sizeof(ik))
884 		return EINVAL;
885 	error = copyin(ireq->i_data, &ik, sizeof(ik));
886 	if (error)
887 		return error;
888 	kid = ik.ik_keyix;
889 	if (kid == IEEE80211_KEYIX_NONE) {
890 		ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
891 		if (ni == NULL)
892 			return EINVAL;		/* XXX */
893 		wk = &ni->ni_ucastkey;
894 	} else {
895 		if (kid >= IEEE80211_WEP_NKID)
896 			return EINVAL;
897 		wk = &ic->ic_nw_keys[kid];
898 		IEEE80211_ADDR_COPY(&ik.ik_macaddr, ic->ic_bss->ni_macaddr);
899 		ni = NULL;
900 	}
901 	cip = wk->wk_cipher;
902 	ik.ik_type = cip->ic_cipher;
903 	ik.ik_keylen = wk->wk_keylen;
904 	ik.ik_flags = wk->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV);
905 	if (wk->wk_keyix == ic->ic_def_txkey)
906 		ik.ik_flags |= IEEE80211_KEY_DEFAULT;
907 	if (kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_INTERFACE,
908 	    KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ic->ic_ifp, NULL, NULL) == 0) {
909 		/* NB: only root can read key data */
910 		ik.ik_keyrsc = wk->wk_keyrsc;
911 		ik.ik_keytsc = wk->wk_keytsc;
912 		memcpy(ik.ik_keydata, wk->wk_key, wk->wk_keylen);
913 		if (cip->ic_cipher == IEEE80211_CIPHER_TKIP) {
914 			memcpy(ik.ik_keydata+wk->wk_keylen,
915 				wk->wk_key + IEEE80211_KEYBUF_SIZE,
916 				IEEE80211_MICBUF_SIZE);
917 			ik.ik_keylen += IEEE80211_MICBUF_SIZE;
918 		}
919 	} else {
920 		ik.ik_keyrsc = 0;
921 		ik.ik_keytsc = 0;
922 		memset(ik.ik_keydata, 0, sizeof(ik.ik_keydata));
923 	}
924 	if (ni != NULL)
925 		ieee80211_free_node(ni);
926 	return copyout(&ik, ireq->i_data, sizeof(ik));
927 }
928 
929 static int
930 ieee80211_ioctl_getchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
931 {
932 	size_t len = ireq->i_len;
933 
934 	if (len > sizeof(ic->ic_chan_active))
935 		len = sizeof(ic->ic_chan_active);
936 	return copyout(&ic->ic_chan_active, ireq->i_data, len);
937 }
938 
939 static int
940 ieee80211_ioctl_getchaninfo(struct ieee80211com *ic, struct ieee80211req *ireq)
941 {
942 	struct ieee80211req_chaninfo *chans;
943 	uint32_t i, space;
944 	int error;
945 
946 	/*
947 	 * Since channel 0 is not available for DS, channel 1
948 	 * is assigned to LSB on WaveLAN.
949 	 */
950 	if (ic->ic_phytype == IEEE80211_T_DS)
951 		i = 1;
952 	else
953 		i = 0;
954 
955 	chans = malloc(sizeof(*chans), M_TEMP, M_WAITOK|M_ZERO);
956 
957 	for (; i <= IEEE80211_CHAN_MAX; i++)
958 		if (isset(ic->ic_chan_avail, i)) {
959 			struct ieee80211_channel *c = &ic->ic_channels[i];
960 			chans->ic_chans[chans->ic_nchans].ic_freq = c->ic_freq;
961 			chans->ic_chans[chans->ic_nchans].ic_flags = c->ic_flags;
962 			chans->ic_nchans++;
963 		}
964 	space = offsetof(struct ieee80211req_chaninfo,
965 	    ic_chans[chans->ic_nchans]);
966 	if (space > ireq->i_len)
967 		space = ireq->i_len;
968 	error = copyout(chans, ireq->i_data, space);
969 	free(chans, M_TEMP);
970 	return error;
971 }
972 
973 static int
974 ieee80211_ioctl_getwpaie(struct ieee80211com *ic, struct ieee80211req *ireq)
975 {
976 	struct ieee80211_node *ni;
977 	struct ieee80211req_wpaie wpaie;
978 	int error;
979 
980 	if (ireq->i_len < IEEE80211_ADDR_LEN)
981 		return EINVAL;
982 	error = copyin(ireq->i_data, wpaie.wpa_macaddr, IEEE80211_ADDR_LEN);
983 	if (error != 0)
984 		return error;
985 	ni = ieee80211_find_node(&ic->ic_sta, wpaie.wpa_macaddr);
986 	if (ni == NULL)
987 		return EINVAL;		/* XXX */
988 	memset(wpaie.wpa_ie, 0, sizeof(wpaie.wpa_ie));
989 	if (ni->ni_wpa_ie != NULL) {
990 		int ielen = ni->ni_wpa_ie[1] + 2;
991 		if (ielen > sizeof(wpaie.wpa_ie))
992 			ielen = sizeof(wpaie.wpa_ie);
993 		memcpy(wpaie.wpa_ie, ni->ni_wpa_ie, ielen);
994 	}
995 	ieee80211_free_node(ni);
996 	if (ireq->i_len > sizeof(wpaie))
997 		ireq->i_len = sizeof(wpaie);
998 	return copyout(&wpaie, ireq->i_data, ireq->i_len);
999 }
1000 
1001 static int
1002 ieee80211_ioctl_getstastats(struct ieee80211com *ic, struct ieee80211req *ireq)
1003 {
1004 	struct ieee80211_node *ni;
1005 	u_int8_t macaddr[IEEE80211_ADDR_LEN];
1006 	const size_t off = offsetof(struct ieee80211req_sta_stats, is_stats);
1007 	int error;
1008 
1009 	if (ireq->i_len < off)
1010 		return EINVAL;
1011 	error = copyin(ireq->i_data, macaddr, IEEE80211_ADDR_LEN);
1012 	if (error != 0)
1013 		return error;
1014 	ni = ieee80211_find_node(&ic->ic_sta, macaddr);
1015 	if (ni == NULL)
1016 		return EINVAL;		/* XXX */
1017 	if (ireq->i_len > sizeof(struct ieee80211req_sta_stats))
1018 		ireq->i_len = sizeof(struct ieee80211req_sta_stats);
1019 	/* NB: copy out only the statistics */
1020 	error = copyout(&ni->ni_stats, (u_int8_t *) ireq->i_data + off,
1021 			ireq->i_len - off);
1022 	ieee80211_free_node(ni);
1023 	return error;
1024 }
1025 
1026 static void
1027 get_scan_result(struct ieee80211req_scan_result *sr,
1028 	const struct ieee80211_node *ni)
1029 {
1030 	struct ieee80211com *ic = ni->ni_ic;
1031 	u_int ielen = 0;
1032 
1033 	memset(sr, 0, sizeof(*sr));
1034 	sr->isr_ssid_len = ni->ni_esslen;
1035 	if (ni->ni_wpa_ie != NULL)
1036 		ielen += 2+ni->ni_wpa_ie[1];
1037 	if (ni->ni_wme_ie != NULL)
1038 		ielen += 2+ni->ni_wme_ie[1];
1039 
1040 	/*
1041 	 * The value sr->isr_ie_len is defined as a uint8_t, so we
1042 	 * need to be careful to avoid an integer overflow.  If the
1043 	 * value would overflow, we will set isr_ie_len to zero, and
1044 	 * ieee80211_ioctl_getscanresults (below) will avoid copying
1045 	 * the (overflowing) data.
1046 	 */
1047 	if (ielen > 255)
1048 		ielen = 0;
1049 	sr->isr_ie_len = ielen;
1050 	sr->isr_len = sizeof(*sr) + sr->isr_ssid_len + sr->isr_ie_len;
1051 	sr->isr_len = roundup(sr->isr_len, sizeof(u_int32_t));
1052 	if (ni->ni_chan != IEEE80211_CHAN_ANYC) {
1053 		sr->isr_freq = ni->ni_chan->ic_freq;
1054 		sr->isr_flags = ni->ni_chan->ic_flags;
1055 	}
1056 	sr->isr_rssi = ic->ic_node_getrssi(ni);
1057 	sr->isr_intval = ni->ni_intval;
1058 	sr->isr_capinfo = ni->ni_capinfo;
1059 	sr->isr_erp = ni->ni_erp;
1060 	IEEE80211_ADDR_COPY(sr->isr_bssid, ni->ni_bssid);
1061 	sr->isr_nrates = ni->ni_rates.rs_nrates;
1062 	if (sr->isr_nrates > 15)
1063 		sr->isr_nrates = 15;
1064 	memcpy(sr->isr_rates, ni->ni_rates.rs_rates, sr->isr_nrates);
1065 }
1066 
1067 static int
1068 ieee80211_ioctl_getscanresults(struct ieee80211com *ic, struct ieee80211req *ireq)
1069 {
1070 	union {
1071 		struct ieee80211req_scan_result res;
1072 		char data[sizeof(struct ieee80211req_scan_result) + IEEE80211_NWID_LEN + 256 * 2];
1073 	} u;
1074 	struct ieee80211req_scan_result *sr = &u.res;
1075 	struct ieee80211_node_table *nt;
1076 	struct ieee80211_node *ni;
1077 	int error;
1078 	uint32_t space;
1079 	u_int8_t *p, *cp;
1080 
1081 	p = ireq->i_data;
1082 	space = ireq->i_len;
1083 	error = 0;
1084 	/* XXX locking */
1085 	nt =  &ic->ic_scan;
1086 	TAILQ_FOREACH(ni, &nt->nt_node, ni_list) {
1087 		/* NB: skip pre-scan node state */
1088 		if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1089 			continue;
1090 		get_scan_result(sr, ni);
1091 		if (sr->isr_len > sizeof(u))
1092 			continue;		/* XXX */
1093 		if (space < sr->isr_len)
1094 			break;
1095 		cp = (u_int8_t *)(sr+1);
1096 		memcpy(cp, ni->ni_essid, ni->ni_esslen);
1097 		cp += ni->ni_esslen;
1098 		if (sr->isr_ie_len > 0 && ni->ni_wpa_ie != NULL) {
1099 			memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1100 			cp += 2+ni->ni_wpa_ie[1];
1101 		}
1102 		if (sr->isr_ie_len > 0 && ni->ni_wme_ie != NULL) {
1103 			memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1104 			cp += 2+ni->ni_wme_ie[1];
1105 		}
1106 		error = copyout(sr, p, sr->isr_len);
1107 		if (error)
1108 			break;
1109 		p += sr->isr_len;
1110 		space -= sr->isr_len;
1111 	}
1112 	ireq->i_len -= space;
1113 	return error;
1114 }
1115 
1116 struct stainforeq {
1117 	struct ieee80211com *ic;
1118 	struct ieee80211req_sta_info *si;
1119 	size_t	space;
1120 };
1121 
1122 static size_t
1123 sta_space(const struct ieee80211_node *ni, size_t *ielen)
1124 {
1125 	*ielen = 0;
1126 	if (ni->ni_wpa_ie != NULL)
1127 		*ielen += 2+ni->ni_wpa_ie[1];
1128 	if (ni->ni_wme_ie != NULL)
1129 		*ielen += 2+ni->ni_wme_ie[1];
1130 	return roundup(sizeof(struct ieee80211req_sta_info) + *ielen,
1131 		      sizeof(u_int32_t));
1132 }
1133 
1134 static void
1135 get_sta_space(void *arg, struct ieee80211_node *ni)
1136 {
1137 	struct stainforeq *req = arg;
1138 	struct ieee80211com *ic = ni->ni_ic;
1139 	size_t ielen;
1140 
1141 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1142 	    ni->ni_associd == 0)	/* only associated stations */
1143 		return;
1144 	req->space += sta_space(ni, &ielen);
1145 }
1146 
1147 static void
1148 get_sta_info(void *arg, struct ieee80211_node *ni)
1149 {
1150 	struct stainforeq *req = arg;
1151 	struct ieee80211com *ic = ni->ni_ic;
1152 	struct ieee80211req_sta_info *si;
1153 	size_t ielen, len;
1154 	u_int8_t *cp;
1155 
1156 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
1157 	    ni->ni_associd == 0)	/* only associated stations */
1158 		return;
1159 	if (ni->ni_chan == IEEE80211_CHAN_ANYC)	/* XXX bogus entry */
1160 		return;
1161 	len = sta_space(ni, &ielen);
1162 	if (len > req->space)
1163 		return;
1164 	si = req->si;
1165 	si->isi_len = len;
1166 	si->isi_ie_len = ielen;
1167 	si->isi_freq = ni->ni_chan->ic_freq;
1168 	si->isi_flags = ni->ni_chan->ic_flags;
1169 	si->isi_state = ni->ni_flags;
1170 	si->isi_authmode = ni->ni_authmode;
1171 	si->isi_rssi = ic->ic_node_getrssi(ni);
1172 	si->isi_capinfo = ni->ni_capinfo;
1173 	si->isi_erp = ni->ni_erp;
1174 	IEEE80211_ADDR_COPY(si->isi_macaddr, ni->ni_macaddr);
1175 	si->isi_nrates = ni->ni_rates.rs_nrates;
1176 	if (si->isi_nrates > 15)
1177 		si->isi_nrates = 15;
1178 	memcpy(si->isi_rates, ni->ni_rates.rs_rates, si->isi_nrates);
1179 	si->isi_txrate = ni->ni_txrate;
1180 	si->isi_associd = ni->ni_associd;
1181 	si->isi_txpower = ni->ni_txpower;
1182 	si->isi_vlan = ni->ni_vlan;
1183 	if (ni->ni_flags & IEEE80211_NODE_QOS) {
1184 		memcpy(si->isi_txseqs, ni->ni_txseqs, sizeof(ni->ni_txseqs));
1185 		memcpy(si->isi_rxseqs, ni->ni_rxseqs, sizeof(ni->ni_rxseqs));
1186 	} else {
1187 		si->isi_txseqs[0] = ni->ni_txseqs[0];
1188 		si->isi_rxseqs[0] = ni->ni_rxseqs[0];
1189 	}
1190 	/* NB: leave all cases in case we relax ni_associd == 0 check */
1191 	if (ieee80211_node_is_authorized(ni))
1192 		si->isi_inact = ic->ic_inact_run;
1193 	else if (ni->ni_associd != 0)
1194 		si->isi_inact = ic->ic_inact_auth;
1195 	else
1196 		si->isi_inact = ic->ic_inact_init;
1197 	si->isi_inact = (si->isi_inact - ni->ni_inact) * IEEE80211_INACT_WAIT;
1198 
1199 	cp = (u_int8_t *)(si+1);
1200 	if (ni->ni_wpa_ie != NULL) {
1201 		memcpy(cp, ni->ni_wpa_ie, 2+ni->ni_wpa_ie[1]);
1202 		cp += 2+ni->ni_wpa_ie[1];
1203 	}
1204 	if (ni->ni_wme_ie != NULL) {
1205 		memcpy(cp, ni->ni_wme_ie, 2+ni->ni_wme_ie[1]);
1206 		cp += 2+ni->ni_wme_ie[1];
1207 	}
1208 
1209 	req->si = (struct ieee80211req_sta_info *)(((u_int8_t *)si) + len);
1210 	req->space -= len;
1211 }
1212 
1213 static int
1214 ieee80211_ioctl_getstainfo(struct ieee80211com *ic, struct ieee80211req *ireq)
1215 {
1216 	struct stainforeq req;
1217 	int error;
1218 
1219 	if (ireq->i_len < sizeof(struct stainforeq))
1220 		return EFAULT;
1221 
1222 	error = 0;
1223 	req.space = 0;
1224 	ieee80211_iterate_nodes(&ic->ic_sta, get_sta_space, &req);
1225 	if (req.space > ireq->i_len)
1226 		req.space = ireq->i_len;
1227 	if (req.space > 0) {
1228 		size_t space;
1229 		void *p;
1230 
1231 		space = req.space;
1232 		/* XXX M_WAITOK after driver lock released */
1233 		p = malloc(space, M_TEMP, M_NOWAIT);
1234 		if (p == NULL)
1235 			return ENOMEM;
1236 		req.si = p;
1237 		ieee80211_iterate_nodes(&ic->ic_sta, get_sta_info, &req);
1238 		ireq->i_len = space - req.space;
1239 		error = copyout(p, ireq->i_data, ireq->i_len);
1240 		free(p, M_TEMP);
1241 	} else
1242 		ireq->i_len = 0;
1243 
1244 	return error;
1245 }
1246 
1247 static int
1248 ieee80211_ioctl_getstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1249 {
1250 	struct ieee80211_node *ni;
1251 	struct ieee80211req_sta_txpow txpow;
1252 	int error;
1253 
1254 	if (ireq->i_len != sizeof(txpow))
1255 		return EINVAL;
1256 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1257 	if (error != 0)
1258 		return error;
1259 	ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1260 	if (ni == NULL)
1261 		return EINVAL;		/* XXX */
1262 	txpow.it_txpow = ni->ni_txpower;
1263 	error = copyout(&txpow, ireq->i_data, sizeof(txpow));
1264 	ieee80211_free_node(ni);
1265 	return error;
1266 }
1267 
1268 static int
1269 ieee80211_ioctl_getwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1270 {
1271 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1272 	struct wmeParams *wmep;
1273 	int ac;
1274 
1275 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1276 		return EINVAL;
1277 
1278 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1279 	if (ac >= WME_NUM_AC)
1280 		ac = WME_AC_BE;
1281 	if (ireq->i_len & IEEE80211_WMEPARAM_BSS)
1282 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1283 	else
1284 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1285 	switch (ireq->i_type) {
1286 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1287 		ireq->i_val = wmep->wmep_logcwmin;
1288 		break;
1289 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1290 		ireq->i_val = wmep->wmep_logcwmax;
1291 		break;
1292 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1293 		ireq->i_val = wmep->wmep_aifsn;
1294 		break;
1295 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1296 		ireq->i_val = wmep->wmep_txopLimit;
1297 		break;
1298 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1299 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1300 		ireq->i_val = wmep->wmep_acm;
1301 		break;
1302 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
1303 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1304 		ireq->i_val = !wmep->wmep_noackPolicy;
1305 		break;
1306 	}
1307 	return 0;
1308 }
1309 
1310 static int
1311 ieee80211_ioctl_getmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1312 {
1313 	const struct ieee80211_aclator *acl = ic->ic_acl;
1314 
1315 	return (acl == NULL ? EINVAL : acl->iac_getioctl(ic, ireq));
1316 }
1317 
1318 #if defined(COMPAT_FREEBSD_NET80211)
1319 static int
1320 ieee80211_ioctl_get80211_fbsd(struct ieee80211com *ic, u_long cmd,
1321     struct ieee80211req *ireq)
1322 {
1323 	u_int kid, len;
1324 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
1325 	char tmpssid[IEEE80211_NWID_LEN];
1326 	struct ifnet *ifp = ic->ic_ifp;
1327 
1328 	int error = 0;
1329 
1330 	switch (ireq->i_type) {
1331 	case IEEE80211_IOC_SSID:
1332 		switch (ic->ic_state) {
1333 		case IEEE80211_S_INIT:
1334 		case IEEE80211_S_SCAN:
1335 			ireq->i_len = ic->ic_des_esslen;
1336 			memcpy(tmpssid, ic->ic_des_essid, ireq->i_len);
1337 			break;
1338 		default:
1339 			ireq->i_len = ic->ic_bss->ni_esslen;
1340 			memcpy(tmpssid, ic->ic_bss->ni_essid,
1341 				ireq->i_len);
1342 			break;
1343 		}
1344 		error = copyout(tmpssid, ireq->i_data, ireq->i_len);
1345 		break;
1346 	case IEEE80211_IOC_NUMSSIDS:
1347 		ireq->i_val = 1;
1348 		break;
1349 	case IEEE80211_IOC_WEP:
1350 		if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0)
1351 			ireq->i_val = IEEE80211_WEP_OFF;
1352 		else if (ic->ic_flags & IEEE80211_F_DROPUNENC)
1353 			ireq->i_val = IEEE80211_WEP_ON;
1354 		else
1355 			ireq->i_val = IEEE80211_WEP_MIXED;
1356 		break;
1357 	case IEEE80211_IOC_WEPKEY:
1358 		kid = (u_int) ireq->i_val;
1359 		if (kid >= IEEE80211_WEP_NKID)
1360 			return EINVAL;
1361 		len = (u_int) ic->ic_nw_keys[kid].wk_keylen;
1362 		/* NB: only root can read WEP keys */
1363 		if (kauth_authorize_network(curlwp->l_cred,
1364 		    KAUTH_NETWORK_INTERFACE,
1365 		    KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp, NULL,
1366 		    NULL) == 0) {
1367 			memcpy(tmpkey, ic->ic_nw_keys[kid].wk_key, len);
1368 		} else {
1369 			memset(tmpkey, 0, len);
1370 		}
1371 		ireq->i_len = len;
1372 		error = copyout(tmpkey, ireq->i_data, len);
1373 		break;
1374 	case IEEE80211_IOC_NUMWEPKEYS:
1375 		ireq->i_val = IEEE80211_WEP_NKID;
1376 		break;
1377 	case IEEE80211_IOC_WEPTXKEY:
1378 		ireq->i_val = ic->ic_def_txkey;
1379 		break;
1380 	case IEEE80211_IOC_CHANNEL:
1381 		ireq->i_val = ieee80211_chan2ieee(ic, ic->ic_curchan);
1382 		break;
1383 	case IEEE80211_IOC_POWERSAVE:
1384 		if (ic->ic_flags & IEEE80211_F_PMGTON)
1385 			ireq->i_val = IEEE80211_POWERSAVE_ON;
1386 		else
1387 			ireq->i_val = IEEE80211_POWERSAVE_OFF;
1388 		break;
1389 	case IEEE80211_IOC_POWERSAVESLEEP:
1390 		ireq->i_val = ic->ic_lintval;
1391 		break;
1392 	case IEEE80211_IOC_BSSID:
1393 		if (ireq->i_len != IEEE80211_ADDR_LEN)
1394 			return EINVAL;
1395 		error = copyout(ic->ic_state == IEEE80211_S_RUN ?
1396 					ic->ic_bss->ni_bssid :
1397 					ic->ic_des_bssid,
1398 				ireq->i_data, ireq->i_len);
1399 		break;
1400 	default:
1401 		error = EINVAL;
1402 		break;
1403 	}
1404 	return error;
1405 }
1406 #endif /* COMPAT_FREEBSD_NET80211 */
1407 
1408 /*
1409  * When building the kernel with -O2 on the i386 architecture, gcc
1410  * seems to want to inline this function into ieee80211_ioctl()
1411  * (which is the only routine that calls it). When this happens,
1412  * ieee80211_ioctl() ends up consuming an additional 2K of stack
1413  * space. (Exactly why it needs so much is unclear.) The problem
1414  * is that it's possible for ieee80211_ioctl() to invoke other
1415  * routines (including driver init functions) which could then find
1416  * themselves perilously close to exhausting the stack.
1417  *
1418  * To avoid this, we deliberately prevent gcc from inlining this
1419  * routine. Another way to avoid this is to use less agressive
1420  * optimization when compiling this file (i.e. -O instead of -O2)
1421  * but special-casing the compilation of this one module in the
1422  * build system would be awkward.
1423  */
1424 #ifdef __GNUC__
1425 __attribute__ ((__noinline__))
1426 #endif
1427 static int
1428 ieee80211_ioctl_get80211(struct ieee80211com *ic, u_long cmd,
1429     struct ieee80211req *ireq)
1430 {
1431 	const struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
1432 	int error = 0;
1433 	u_int m;
1434 
1435 	switch (ireq->i_type) {
1436 	case IEEE80211_IOC_AUTHMODE:
1437 		if (ic->ic_flags & IEEE80211_F_WPA)
1438 			ireq->i_val = IEEE80211_AUTH_WPA;
1439 		else
1440 			ireq->i_val = ic->ic_bss->ni_authmode;
1441 		break;
1442 	case IEEE80211_IOC_RTSTHRESHOLD:
1443 		ireq->i_val = ic->ic_rtsthreshold;
1444 		break;
1445 	case IEEE80211_IOC_PROTMODE:
1446 		ireq->i_val = ic->ic_protmode;
1447 		break;
1448 	case IEEE80211_IOC_TXPOWER:
1449 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
1450 			return EINVAL;
1451 		ireq->i_val = ic->ic_txpowlimit;
1452 		break;
1453 	case IEEE80211_IOC_MCASTCIPHER:
1454 		ireq->i_val = rsn->rsn_mcastcipher;
1455 		break;
1456 	case IEEE80211_IOC_MCASTKEYLEN:
1457 		ireq->i_val = rsn->rsn_mcastkeylen;
1458 		break;
1459 	case IEEE80211_IOC_UCASTCIPHERS:
1460 		ireq->i_val = 0;
1461 		for (m = 0x1; m != 0; m <<= 1)
1462 			if (rsn->rsn_ucastcipherset & m)
1463 				ireq->i_val |= 1<<cap2cipher(m);
1464 		break;
1465 	case IEEE80211_IOC_UCASTCIPHER:
1466 		ireq->i_val = rsn->rsn_ucastcipher;
1467 		break;
1468 	case IEEE80211_IOC_UCASTKEYLEN:
1469 		ireq->i_val = rsn->rsn_ucastkeylen;
1470 		break;
1471 	case IEEE80211_IOC_KEYMGTALGS:
1472 		ireq->i_val = rsn->rsn_keymgmtset;
1473 		break;
1474 	case IEEE80211_IOC_RSNCAPS:
1475 		ireq->i_val = rsn->rsn_caps;
1476 		break;
1477 	case IEEE80211_IOC_WPA:
1478 		switch (ic->ic_flags & IEEE80211_F_WPA) {
1479 		case IEEE80211_F_WPA1:
1480 			ireq->i_val = 1;
1481 			break;
1482 		case IEEE80211_F_WPA2:
1483 			ireq->i_val = 2;
1484 			break;
1485 		case IEEE80211_F_WPA1 | IEEE80211_F_WPA2:
1486 			ireq->i_val = 3;
1487 			break;
1488 		default:
1489 			ireq->i_val = 0;
1490 			break;
1491 		}
1492 		break;
1493 	case IEEE80211_IOC_CHANLIST:
1494 		error = ieee80211_ioctl_getchanlist(ic, ireq);
1495 		break;
1496 	case IEEE80211_IOC_ROAMING:
1497 		ireq->i_val = ic->ic_roaming;
1498 		break;
1499 	case IEEE80211_IOC_PRIVACY:
1500 		ireq->i_val = (ic->ic_flags & IEEE80211_F_PRIVACY) != 0;
1501 		break;
1502 	case IEEE80211_IOC_DROPUNENCRYPTED:
1503 		ireq->i_val = (ic->ic_flags & IEEE80211_F_DROPUNENC) != 0;
1504 		break;
1505 	case IEEE80211_IOC_COUNTERMEASURES:
1506 		ireq->i_val = (ic->ic_flags & IEEE80211_F_COUNTERM) != 0;
1507 		break;
1508 	case IEEE80211_IOC_DRIVER_CAPS:
1509 		ireq->i_val = ic->ic_caps>>16;
1510 		ireq->i_len = ic->ic_caps&0xffff;
1511 		break;
1512 	case IEEE80211_IOC_WME:
1513 		ireq->i_val = (ic->ic_flags & IEEE80211_F_WME) != 0;
1514 		break;
1515 	case IEEE80211_IOC_HIDESSID:
1516 		ireq->i_val = (ic->ic_flags & IEEE80211_F_HIDESSID) != 0;
1517 		break;
1518 	case IEEE80211_IOC_APBRIDGE:
1519 		ireq->i_val = (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0;
1520 		break;
1521 	case IEEE80211_IOC_OPTIE:
1522 		if (ic->ic_opt_ie == NULL)
1523 			return EINVAL;
1524 		/* NB: truncate, caller can check length */
1525 		if (ireq->i_len > ic->ic_opt_ie_len)
1526 			ireq->i_len = ic->ic_opt_ie_len;
1527 		error = copyout(ic->ic_opt_ie, ireq->i_data, ireq->i_len);
1528 		break;
1529 	case IEEE80211_IOC_WPAKEY:
1530 		error = ieee80211_ioctl_getkey(ic, ireq);
1531 		break;
1532 	case IEEE80211_IOC_CHANINFO:
1533 		error = ieee80211_ioctl_getchaninfo(ic, ireq);
1534 		break;
1535 	case IEEE80211_IOC_WPAIE:
1536 		error = ieee80211_ioctl_getwpaie(ic, ireq);
1537 		break;
1538 	case IEEE80211_IOC_SCAN_RESULTS:
1539 		error = ieee80211_ioctl_getscanresults(ic, ireq);
1540 		break;
1541 	case IEEE80211_IOC_STA_STATS:
1542 		error = ieee80211_ioctl_getstastats(ic, ireq);
1543 		break;
1544 	case IEEE80211_IOC_TXPOWMAX:
1545 		ireq->i_val = ic->ic_bss->ni_txpower;
1546 		break;
1547 	case IEEE80211_IOC_STA_TXPOW:
1548 		error = ieee80211_ioctl_getstatxpow(ic, ireq);
1549 		break;
1550 	case IEEE80211_IOC_STA_INFO:
1551 		error = ieee80211_ioctl_getstainfo(ic, ireq);
1552 		break;
1553 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1554 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1555 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1556 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
1557 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
1558 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
1559 		error = ieee80211_ioctl_getwmeparam(ic, ireq);
1560 		break;
1561 	case IEEE80211_IOC_DTIM_PERIOD:
1562 		ireq->i_val = ic->ic_dtim_period;
1563 		break;
1564 	case IEEE80211_IOC_BEACON_INTERVAL:
1565 		/* NB: get from ic_bss for station mode */
1566 		ireq->i_val = ic->ic_bss->ni_intval;
1567 		break;
1568 	case IEEE80211_IOC_PUREG:
1569 		ireq->i_val = (ic->ic_flags & IEEE80211_F_PUREG) != 0;
1570 		break;
1571 	case IEEE80211_IOC_MCAST_RATE:
1572 		ireq->i_val = ic->ic_mcast_rate;
1573 		break;
1574 	case IEEE80211_IOC_FRAGTHRESHOLD:
1575 		ireq->i_val = ic->ic_fragthreshold;
1576 		break;
1577 	case IEEE80211_IOC_MACCMD:
1578 		error = ieee80211_ioctl_getmaccmd(ic, ireq);
1579 		break;
1580 	default:
1581 #if defined(COMPAT_FREEBSD_NET80211)
1582 		error = ieee80211_ioctl_get80211_fbsd(ic, cmd, ireq);
1583 #else
1584 		error = EINVAL;
1585 #endif /* COMPAT_FREEBSD_NET80211 */
1586 		break;
1587 	}
1588 	return error;
1589 }
1590 
1591 static int
1592 ieee80211_ioctl_setoptie(struct ieee80211com *ic, struct ieee80211req *ireq)
1593 {
1594 	int error;
1595 	void *ie;
1596 
1597 	/*
1598 	 * NB: Doing this for ap operation could be useful (e.g. for
1599 	 *     WPA and/or WME) except that it typically is worthless
1600 	 *     without being able to intervene when processing
1601 	 *     association response frames--so disallow it for now.
1602 	 */
1603 	if (ic->ic_opmode != IEEE80211_M_STA)
1604 		return EINVAL;
1605 	if (ireq->i_len > IEEE80211_MAX_OPT_IE)
1606 		return EINVAL;
1607 	/* NB: data.length is validated by the wireless extensions code */
1608 	ie = malloc(ireq->i_len, M_DEVBUF, M_WAITOK);
1609 	if (ie == NULL)
1610 		return ENOMEM;
1611 	error = copyin(ireq->i_data, ie, ireq->i_len);
1612 	/* XXX sanity check data? */
1613 	if (ic->ic_opt_ie != NULL)
1614 		free(ic->ic_opt_ie, M_DEVBUF);
1615 	ic->ic_opt_ie = ie;
1616 	ic->ic_opt_ie_len = ireq->i_len;
1617 	return error;
1618 }
1619 
1620 static int
1621 ieee80211_ioctl_setkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1622 {
1623 	struct ieee80211req_key ik;
1624 	struct ieee80211_node *ni;
1625 	struct ieee80211_key *wk;
1626 	u_int16_t kid;
1627 	int error;
1628 
1629 	if (ireq->i_len != sizeof(ik))
1630 		return EINVAL;
1631 	error = copyin(ireq->i_data, &ik, sizeof(ik));
1632 	if (error)
1633 		return error;
1634 	/* NB: cipher support is verified by ieee80211_crypt_newkey */
1635 	/* NB: this also checks ik->ik_keylen > sizeof(wk->wk_key) */
1636 	if (ik.ik_keylen > sizeof(ik.ik_keydata))
1637 		return E2BIG;
1638 	kid = ik.ik_keyix;
1639 	if (kid == IEEE80211_KEYIX_NONE) {
1640 		/* XXX unicast keys currently must be tx/rx */
1641 		if (ik.ik_flags != (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))
1642 			return EINVAL;
1643 		if (ic->ic_opmode == IEEE80211_M_STA) {
1644 			ni = ieee80211_ref_node(ic->ic_bss);
1645 			if (!IEEE80211_ADDR_EQ(ik.ik_macaddr, ni->ni_bssid)) {
1646 				ieee80211_free_node(ni);
1647 				return EADDRNOTAVAIL;
1648 			}
1649 		} else {
1650 			ni = ieee80211_find_node(&ic->ic_sta, ik.ik_macaddr);
1651 			if (ni == NULL)
1652 				return ENOENT;
1653 		}
1654 		wk = &ni->ni_ucastkey;
1655 	} else {
1656 		if (kid >= IEEE80211_WEP_NKID)
1657 			return EINVAL;
1658 		wk = &ic->ic_nw_keys[kid];
1659 		ni = NULL;
1660 	}
1661 	error = 0;
1662 	ieee80211_key_update_begin(ic);
1663 	if (ieee80211_crypto_newkey(ic, ik.ik_type, ik.ik_flags, wk)) {
1664 		wk->wk_keylen = ik.ik_keylen;
1665 		/* NB: MIC presence is implied by cipher type */
1666 		if (wk->wk_keylen > IEEE80211_KEYBUF_SIZE)
1667 			wk->wk_keylen = IEEE80211_KEYBUF_SIZE;
1668 		wk->wk_keyrsc = ik.ik_keyrsc;
1669 		wk->wk_keytsc = 0;			/* new key, reset */
1670 		memset(wk->wk_key, 0, sizeof(wk->wk_key));
1671 		memcpy(wk->wk_key, ik.ik_keydata, ik.ik_keylen);
1672 		if (!ieee80211_crypto_setkey(ic, wk,
1673 		    ni != NULL ? ni->ni_macaddr : ik.ik_macaddr))
1674 			error = EIO;
1675 		else if ((ik.ik_flags & IEEE80211_KEY_DEFAULT))
1676 			ic->ic_def_txkey = kid;
1677 	} else
1678 		error = ENXIO;
1679 	ieee80211_key_update_end(ic);
1680 	if (ni != NULL)
1681 		ieee80211_free_node(ni);
1682 	return error;
1683 }
1684 
1685 static int
1686 ieee80211_ioctl_delkey(struct ieee80211com *ic, struct ieee80211req *ireq)
1687 {
1688 	struct ieee80211req_del_key dk;
1689 	int kid, error;
1690 
1691 	if (ireq->i_len != sizeof(dk))
1692 		return EINVAL;
1693 	error = copyin(ireq->i_data, &dk, sizeof(dk));
1694 	if (error)
1695 		return error;
1696 	kid = dk.idk_keyix;
1697 	/* XXX u_int8_t -> u_int16_t */
1698 	if (dk.idk_keyix == (u_int8_t) IEEE80211_KEYIX_NONE) {
1699 		struct ieee80211_node *ni;
1700 
1701 		if (ic->ic_opmode == IEEE80211_M_STA) {
1702 			ni = ieee80211_ref_node(ic->ic_bss);
1703 			if (!IEEE80211_ADDR_EQ(dk.idk_macaddr, ni->ni_bssid)) {
1704 				ieee80211_free_node(ni);
1705 				return EADDRNOTAVAIL;
1706 			}
1707 		} else {
1708 			ni = ieee80211_find_node(&ic->ic_sta, dk.idk_macaddr);
1709 			if (ni == NULL)
1710 				return ENOENT;
1711 		}
1712 		/* XXX error return */
1713 		ieee80211_node_delucastkey(ni);
1714 		ieee80211_free_node(ni);
1715 	} else {
1716 		if (kid >= IEEE80211_WEP_NKID)
1717 			return EINVAL;
1718 		/* XXX error return */
1719 		ieee80211_crypto_delkey(ic, &ic->ic_nw_keys[kid]);
1720 	}
1721 	return 0;
1722 }
1723 
1724 #ifndef IEEE80211_NO_HOSTAP
1725 static void
1726 domlme(void *arg, struct ieee80211_node *ni)
1727 {
1728 	struct ieee80211com *ic = ni->ni_ic;
1729 	struct ieee80211req_mlme *mlme = arg;
1730 
1731 	if (ni->ni_associd != 0) {
1732 		IEEE80211_SEND_MGMT(ic, ni,
1733 			mlme->im_op == IEEE80211_MLME_DEAUTH ?
1734 				IEEE80211_FC0_SUBTYPE_DEAUTH :
1735 				IEEE80211_FC0_SUBTYPE_DISASSOC,
1736 			mlme->im_reason);
1737 	}
1738 	ieee80211_node_leave(ic, ni);
1739 }
1740 #endif /* !IEEE80211_NO_HOSTAP */
1741 
1742 static int
1743 ieee80211_ioctl_setmlme(struct ieee80211com *ic, struct ieee80211req *ireq)
1744 {
1745 	struct ieee80211req_mlme mlme;
1746 	struct ieee80211_node *ni;
1747 	int error;
1748 
1749 	if (ireq->i_len != sizeof(mlme))
1750 		return EINVAL;
1751 	error = copyin(ireq->i_data, &mlme, sizeof(mlme));
1752 	if (error)
1753 		return error;
1754 	switch (mlme.im_op) {
1755 	case IEEE80211_MLME_ASSOC:
1756 		if (ic->ic_opmode != IEEE80211_M_STA)
1757 			return EINVAL;
1758 		/* XXX must be in S_SCAN state? */
1759 
1760 		if (mlme.im_ssid_len != 0) {
1761 			/*
1762 			 * Desired ssid specified; must match both bssid and
1763 			 * ssid to distinguish ap advertising multiple ssid's.
1764 			 */
1765 			ni = ieee80211_find_node_with_ssid(&ic->ic_scan,
1766 				mlme.im_macaddr,
1767 				mlme.im_ssid_len, mlme.im_ssid);
1768 		} else {
1769 			/*
1770 			 * Normal case; just match bssid.
1771 			 */
1772 			ni = ieee80211_find_node(&ic->ic_scan, mlme.im_macaddr);
1773 		}
1774 		if (ni == NULL)
1775 			return EINVAL;
1776 		if (!ieee80211_sta_join(ic, ni)) {
1777 			ieee80211_free_node(ni);
1778 			return EINVAL;
1779 		}
1780 		break;
1781 	case IEEE80211_MLME_DISASSOC:
1782 	case IEEE80211_MLME_DEAUTH:
1783 		switch (ic->ic_opmode) {
1784 		case IEEE80211_M_STA:
1785 			/* XXX not quite right */
1786 			ieee80211_new_state(ic, IEEE80211_S_INIT,
1787 				mlme.im_reason);
1788 			break;
1789 		case IEEE80211_M_HOSTAP:
1790 #ifndef IEEE80211_NO_HOSTAP
1791 			/* NB: the broadcast address means do 'em all */
1792 			if (!IEEE80211_ADDR_EQ(mlme.im_macaddr, ic->ic_ifp->if_broadcastaddr)) {
1793 				if ((ni = ieee80211_find_node(&ic->ic_sta,
1794 						mlme.im_macaddr)) == NULL)
1795 					return EINVAL;
1796 				domlme(&mlme, ni);
1797 				ieee80211_free_node(ni);
1798 			} else {
1799 				ieee80211_iterate_nodes(&ic->ic_sta,
1800 						domlme, &mlme);
1801 			}
1802 #endif /* !IEEE80211_NO_HOSTAP */
1803 			break;
1804 		default:
1805 			return EINVAL;
1806 		}
1807 		break;
1808 	case IEEE80211_MLME_AUTHORIZE:
1809 	case IEEE80211_MLME_UNAUTHORIZE:
1810 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1811 			return EINVAL;
1812 		ni = ieee80211_find_node(&ic->ic_sta, mlme.im_macaddr);
1813 		if (ni == NULL)
1814 			return EINVAL;
1815 		if (mlme.im_op == IEEE80211_MLME_AUTHORIZE)
1816 			ieee80211_node_authorize(ni);
1817 		else
1818 			ieee80211_node_unauthorize(ni);
1819 		ieee80211_free_node(ni);
1820 		break;
1821 	default:
1822 		return EINVAL;
1823 	}
1824 	return 0;
1825 }
1826 
1827 static int
1828 ieee80211_ioctl_macmac(struct ieee80211com *ic, struct ieee80211req *ireq)
1829 {
1830 	u_int8_t mac[IEEE80211_ADDR_LEN];
1831 	const struct ieee80211_aclator *acl = ic->ic_acl;
1832 	int error;
1833 
1834 	if (ireq->i_len != sizeof(mac))
1835 		return EINVAL;
1836 	error = copyin(ireq->i_data, mac, ireq->i_len);
1837 	if (error)
1838 		return error;
1839 	if (acl == NULL) {
1840 		acl = ieee80211_aclator_get("mac");
1841 		if (acl == NULL || !acl->iac_attach(ic))
1842 			return EINVAL;
1843 		ic->ic_acl = acl;
1844 	}
1845 	if (ireq->i_type == IEEE80211_IOC_ADDMAC)
1846 		acl->iac_add(ic, mac);
1847 	else
1848 		acl->iac_remove(ic, mac);
1849 	return 0;
1850 }
1851 
1852 static int
1853 ieee80211_ioctl_setmaccmd(struct ieee80211com *ic, struct ieee80211req *ireq)
1854 {
1855 	const struct ieee80211_aclator *acl = ic->ic_acl;
1856 
1857 	switch (ireq->i_val) {
1858 	case IEEE80211_MACCMD_POLICY_OPEN:
1859 	case IEEE80211_MACCMD_POLICY_ALLOW:
1860 	case IEEE80211_MACCMD_POLICY_DENY:
1861 		if (acl == NULL) {
1862 			acl = ieee80211_aclator_get("mac");
1863 			if (acl == NULL || !acl->iac_attach(ic))
1864 				return EINVAL;
1865 			ic->ic_acl = acl;
1866 		}
1867 		acl->iac_setpolicy(ic, ireq->i_val);
1868 		break;
1869 	case IEEE80211_MACCMD_FLUSH:
1870 		if (acl != NULL)
1871 			acl->iac_flush(ic);
1872 		/* NB: silently ignore when not in use */
1873 		break;
1874 	case IEEE80211_MACCMD_DETACH:
1875 		if (acl != NULL) {
1876 			ic->ic_acl = NULL;
1877 			acl->iac_detach(ic);
1878 		}
1879 		break;
1880 	default:
1881 		if (acl == NULL)
1882 			return EINVAL;
1883 		else
1884 			return acl->iac_setioctl(ic, ireq);
1885 	}
1886 	return 0;
1887 }
1888 
1889 static int
1890 ieee80211_ioctl_setchanlist(struct ieee80211com *ic, struct ieee80211req *ireq)
1891 {
1892 	struct ieee80211req_chanlist list;
1893 	u_int8_t chanlist[IEEE80211_CHAN_BYTES];
1894 	int i, j, error;
1895 
1896 	if (ireq->i_len != sizeof(list))
1897 		return EINVAL;
1898 	error = copyin(ireq->i_data, &list, sizeof(list));
1899 	if (error)
1900 		return error;
1901 	memset(chanlist, 0, sizeof(chanlist));
1902 	/*
1903 	 * Since channel 0 is not available for DS, channel 1
1904 	 * is assigned to LSB on WaveLAN.
1905 	 */
1906 	if (ic->ic_phytype == IEEE80211_T_DS)
1907 		i = 1;
1908 	else
1909 		i = 0;
1910 	for (j = 0; i <= IEEE80211_CHAN_MAX; i++, j++) {
1911 		/*
1912 		 * NB: silently discard unavailable channels so users
1913 		 *     can specify 1-255 to get all available channels.
1914 		 */
1915 		if (isset(list.ic_channels, j) && isset(ic->ic_chan_avail, i))
1916 			setbit(chanlist, i);
1917 	}
1918 	if (ic->ic_ibss_chan == NULL ||
1919 	    isclr(chanlist, ieee80211_chan2ieee(ic, ic->ic_ibss_chan))) {
1920 		for (i = 0; i <= IEEE80211_CHAN_MAX; i++)
1921 			if (isset(chanlist, i)) {
1922 				ic->ic_ibss_chan = &ic->ic_channels[i];
1923 				goto found;
1924 			}
1925 		return EINVAL;			/* no active channels */
1926 found:
1927 		;
1928 	}
1929 	memcpy(ic->ic_chan_active, chanlist, sizeof(ic->ic_chan_active));
1930 	return IS_UP_AUTO(ic) ? ENETRESET : 0;
1931 }
1932 
1933 static int
1934 ieee80211_ioctl_setstatxpow(struct ieee80211com *ic, struct ieee80211req *ireq)
1935 {
1936 	struct ieee80211_node *ni;
1937 	struct ieee80211req_sta_txpow txpow;
1938 	int error;
1939 
1940 	if (ireq->i_len != sizeof(txpow))
1941 		return EINVAL;
1942 	error = copyin(ireq->i_data, &txpow, sizeof(txpow));
1943 	if (error != 0)
1944 		return error;
1945 	ni = ieee80211_find_node(&ic->ic_sta, txpow.it_macaddr);
1946 	if (ni == NULL)
1947 		return EINVAL;		/* XXX */
1948 	ni->ni_txpower = txpow.it_txpow;
1949 	ieee80211_free_node(ni);
1950 	return error;
1951 }
1952 
1953 static int
1954 ieee80211_ioctl_setwmeparam(struct ieee80211com *ic, struct ieee80211req *ireq)
1955 {
1956 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1957 	struct wmeParams *wmep, *chanp;
1958 	int isbss, ac;
1959 
1960 	if ((ic->ic_caps & IEEE80211_C_WME) == 0)
1961 		return EINVAL;
1962 
1963 	isbss = (ireq->i_len & IEEE80211_WMEPARAM_BSS);
1964 	ac = (ireq->i_len & IEEE80211_WMEPARAM_VAL);
1965 	if (ac >= WME_NUM_AC)
1966 		ac = WME_AC_BE;
1967 	if (isbss) {
1968 		chanp = &wme->wme_bssChanParams.cap_wmeParams[ac];
1969 		wmep = &wme->wme_wmeBssChanParams.cap_wmeParams[ac];
1970 	} else {
1971 		chanp = &wme->wme_chanParams.cap_wmeParams[ac];
1972 		wmep = &wme->wme_wmeChanParams.cap_wmeParams[ac];
1973 	}
1974 	switch (ireq->i_type) {
1975 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
1976 		if (isbss) {
1977 			wmep->wmep_logcwmin = ireq->i_val;
1978 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1979 				chanp->wmep_logcwmin = ireq->i_val;
1980 		} else {
1981 			wmep->wmep_logcwmin = chanp->wmep_logcwmin =
1982 				ireq->i_val;
1983 		}
1984 		break;
1985 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
1986 		if (isbss) {
1987 			wmep->wmep_logcwmax = ireq->i_val;
1988 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1989 				chanp->wmep_logcwmax = ireq->i_val;
1990 		} else {
1991 			wmep->wmep_logcwmax = chanp->wmep_logcwmax =
1992 				ireq->i_val;
1993 		}
1994 		break;
1995 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
1996 		if (isbss) {
1997 			wmep->wmep_aifsn = ireq->i_val;
1998 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
1999 				chanp->wmep_aifsn = ireq->i_val;
2000 		} else {
2001 			wmep->wmep_aifsn = chanp->wmep_aifsn = ireq->i_val;
2002 		}
2003 		break;
2004 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
2005 		if (isbss) {
2006 			wmep->wmep_txopLimit = ireq->i_val;
2007 			if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
2008 				chanp->wmep_txopLimit = ireq->i_val;
2009 		} else {
2010 			wmep->wmep_txopLimit = chanp->wmep_txopLimit =
2011 				ireq->i_val;
2012 		}
2013 		break;
2014 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
2015 		wmep->wmep_acm = ireq->i_val;
2016 		if ((wme->wme_flags & WME_F_AGGRMODE) == 0)
2017 			chanp->wmep_acm = ireq->i_val;
2018 		break;
2019 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (!bss only)*/
2020 		wmep->wmep_noackPolicy = chanp->wmep_noackPolicy =
2021 			(ireq->i_val) == 0;
2022 		break;
2023 	}
2024 	ieee80211_wme_updateparams(ic);
2025 	return 0;
2026 }
2027 
2028 static int
2029 cipher2cap(int cipher)
2030 {
2031 	switch (cipher) {
2032 	case IEEE80211_CIPHER_WEP:	return IEEE80211_C_WEP;
2033 	case IEEE80211_CIPHER_AES_OCB:	return IEEE80211_C_AES;
2034 	case IEEE80211_CIPHER_AES_CCM:	return IEEE80211_C_AES_CCM;
2035 	case IEEE80211_CIPHER_CKIP:	return IEEE80211_C_CKIP;
2036 	case IEEE80211_CIPHER_TKIP:	return IEEE80211_C_TKIP;
2037 	}
2038 	return 0;
2039 }
2040 
2041 static int
2042 ieee80211_ioctl_set80211(struct ieee80211com *ic, u_long cmd,
2043     struct ieee80211req *ireq)
2044 {
2045 #if defined(__FreeBSD__) || defined(COMPAT_FREEBSD_NET80211)
2046 	static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
2047 	u_int8_t tmpkey[IEEE80211_KEYBUF_SIZE];
2048 	char tmpssid[IEEE80211_NWID_LEN];
2049 	u_int8_t tmpbssid[IEEE80211_ADDR_LEN];
2050 	struct ieee80211_key *k;
2051 	u_int kid;
2052 #endif /* __FreeBSD__ || COMPAT_FREEBSD_NET80211 */
2053 	struct ieee80211_rsnparms *rsn = &ic->ic_bss->ni_rsn;
2054 	int error;
2055 	const struct ieee80211_authenticator *auth;
2056 	int j, caps;
2057 
2058 	error = 0;
2059 	switch (ireq->i_type) {
2060 #if defined(__FreeBSD__) || defined(COMPAT_FREEBSD_NET80211)
2061 	case IEEE80211_IOC_SSID:
2062 		if (ireq->i_val != 0 ||
2063 		    ireq->i_len > IEEE80211_NWID_LEN)
2064 			return EINVAL;
2065 		error = copyin(ireq->i_data, tmpssid, ireq->i_len);
2066 		if (error)
2067 			break;
2068 		memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
2069 		ic->ic_des_esslen = ireq->i_len;
2070 		memcpy(ic->ic_des_essid, tmpssid, ireq->i_len);
2071 		error = ENETRESET;
2072 		break;
2073 #endif /* __FreeBSD__ || COMPAT_FREEBSD_NET80211 */
2074 	case IEEE80211_IOC_WEP:
2075 		switch (ireq->i_val) {
2076 		case IEEE80211_WEP_OFF:
2077 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2078 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2079 			break;
2080 		case IEEE80211_WEP_ON:
2081 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2082 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
2083 			break;
2084 		case IEEE80211_WEP_MIXED:
2085 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2086 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2087 			break;
2088 		}
2089 		error = ENETRESET;
2090 		break;
2091 #if defined(__FreeBSD__) || defined(COMPAT_FREEBSD_NET80211)
2092 	case IEEE80211_IOC_WEPKEY:
2093 		kid = (u_int) ireq->i_val;
2094 		if (kid >= IEEE80211_WEP_NKID)
2095 			return EINVAL;
2096 		k = &ic->ic_nw_keys[kid];
2097 		if (ireq->i_len == 0) {
2098 			/* zero-len =>'s delete any existing key */
2099 			(void) ieee80211_crypto_delkey(ic, k);
2100 			break;
2101 		}
2102 		if (ireq->i_len > sizeof(tmpkey))
2103 			return EINVAL;
2104 		memset(tmpkey, 0, sizeof(tmpkey));
2105 		error = copyin(ireq->i_data, tmpkey, ireq->i_len);
2106 		if (error)
2107 			break;
2108 		ieee80211_key_update_begin(ic);
2109 		k->wk_keyix = kid;	/* NB: force fixed key id */
2110 		if (ieee80211_crypto_newkey(ic, IEEE80211_CIPHER_WEP,
2111 		    IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
2112 			k->wk_keylen = ireq->i_len;
2113 			memcpy(k->wk_key, tmpkey, sizeof(tmpkey));
2114 			if  (!ieee80211_crypto_setkey(ic, k, ic->ic_myaddr))
2115 				error = EINVAL;
2116 		} else
2117 			error = EINVAL;
2118 		ieee80211_key_update_end(ic);
2119 		if (!error)			/* NB: for compatibility */
2120 			error = ENETRESET;
2121 		break;
2122 	case IEEE80211_IOC_WEPTXKEY:
2123 		kid = (u_int) ireq->i_val;
2124 		if (kid >= IEEE80211_WEP_NKID &&
2125 		    (u_int16_t) kid != IEEE80211_KEYIX_NONE)
2126 			return EINVAL;
2127 		ic->ic_def_txkey = kid;
2128 		error = ENETRESET;	/* push to hardware */
2129 		break;
2130 #endif /* __FreeBSD__ || COMPAT_FREEBSD_NET80211 */
2131 	case IEEE80211_IOC_AUTHMODE:
2132 		switch (ireq->i_val) {
2133 		case IEEE80211_AUTH_WPA:
2134 		case IEEE80211_AUTH_8021X:	/* 802.1x */
2135 		case IEEE80211_AUTH_OPEN:	/* open */
2136 		case IEEE80211_AUTH_SHARED:	/* shared-key */
2137 		case IEEE80211_AUTH_AUTO:	/* auto */
2138 			auth = ieee80211_authenticator_get(ireq->i_val);
2139 			if (auth == NULL)
2140 				return EINVAL;
2141 			break;
2142 		default:
2143 			return EINVAL;
2144 		}
2145 		switch (ireq->i_val) {
2146 		case IEEE80211_AUTH_WPA:	/* WPA w/ 802.1x */
2147 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2148 			ireq->i_val = IEEE80211_AUTH_8021X;
2149 			break;
2150 		case IEEE80211_AUTH_OPEN:	/* open */
2151 			ic->ic_flags &= ~(IEEE80211_F_WPA|IEEE80211_F_PRIVACY);
2152 			break;
2153 		case IEEE80211_AUTH_SHARED:	/* shared-key */
2154 		case IEEE80211_AUTH_8021X:	/* 802.1x */
2155 			ic->ic_flags &= ~IEEE80211_F_WPA;
2156 			/* both require a key so mark the PRIVACY capability */
2157 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2158 			break;
2159 		case IEEE80211_AUTH_AUTO:	/* auto */
2160 			ic->ic_flags &= ~IEEE80211_F_WPA;
2161 			/* XXX PRIVACY handling? */
2162 			/* XXX what's the right way to do this? */
2163 			break;
2164 		}
2165 		/* NB: authenticator attach/detach happens on state change */
2166 		ic->ic_bss->ni_authmode = ireq->i_val;
2167 		/* XXX mixed/mode/usage? */
2168 		ic->ic_auth = auth;
2169 		error = ENETRESET;
2170 		break;
2171 #if defined(__FreeBSD__) || defined(COMPAT_FREEBSD_NET80211)
2172 	case IEEE80211_IOC_CHANNEL:
2173 		/* XXX 0xffff overflows 16-bit signed */
2174 		if (ireq->i_val == 0 ||
2175 		    ireq->i_val == (int16_t) IEEE80211_CHAN_ANY)
2176 			ic->ic_des_chan = IEEE80211_CHAN_ANYC;
2177 		else if ((u_int) ireq->i_val > IEEE80211_CHAN_MAX ||
2178 		    isclr(ic->ic_chan_active, ireq->i_val)) {
2179 			return EINVAL;
2180 		} else
2181 			ic->ic_ibss_chan = ic->ic_des_chan =
2182 				&ic->ic_channels[ireq->i_val];
2183 		switch (ic->ic_state) {
2184 		case IEEE80211_S_INIT:
2185 		case IEEE80211_S_SCAN:
2186 			error = ENETRESET;
2187 			break;
2188 		default:
2189 			/*
2190 			 * If the desired channel has changed (to something
2191 			 * other than any) and we're not already scanning,
2192 			 * then kick the state machine.
2193 			 */
2194 			if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
2195 			    ic->ic_bss->ni_chan != ic->ic_des_chan &&
2196 			    (ic->ic_flags & IEEE80211_F_SCAN) == 0)
2197 				error = ENETRESET;
2198 			break;
2199 		}
2200 		if (error == ENETRESET &&
2201 			ic->ic_opmode == IEEE80211_M_MONITOR) {
2202 			if (IS_UP(ic)) {
2203 				/*
2204 				 * Monitor mode can switch directly.
2205 				 */
2206 				if (ic->ic_des_chan != IEEE80211_CHAN_ANYC)
2207 					ic->ic_curchan = ic->ic_des_chan;
2208 				error = ic->ic_reset(ic->ic_ifp);
2209 			} else
2210 				error = 0;
2211 		}
2212 		break;
2213 	case IEEE80211_IOC_POWERSAVE:
2214 		switch (ireq->i_val) {
2215 		case IEEE80211_POWERSAVE_OFF:
2216 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
2217 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
2218 				error = ENETRESET;
2219 			}
2220 			break;
2221 		case IEEE80211_POWERSAVE_ON:
2222 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
2223 				error = EINVAL;
2224 			else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
2225 				ic->ic_flags |= IEEE80211_F_PMGTON;
2226 				error = ENETRESET;
2227 			}
2228 			break;
2229 		default:
2230 			error = EINVAL;
2231 			break;
2232 		}
2233 		break;
2234 	case IEEE80211_IOC_POWERSAVESLEEP:
2235 		if (ireq->i_val < 0)
2236 			return EINVAL;
2237 		ic->ic_lintval = ireq->i_val;
2238 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2239 		break;
2240 #endif /* __FreeBSD__ || COMPAT_FREEBSD_NET80211 */
2241 	case IEEE80211_IOC_RTSTHRESHOLD:
2242 		if (!(IEEE80211_RTS_MIN <= ireq->i_val &&
2243 		      ireq->i_val <= IEEE80211_RTS_MAX))
2244 			return EINVAL;
2245 		ic->ic_rtsthreshold = ireq->i_val;
2246 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2247 		break;
2248 	case IEEE80211_IOC_PROTMODE:
2249 		if (ireq->i_val > IEEE80211_PROT_RTSCTS)
2250 			return EINVAL;
2251 		ic->ic_protmode = ireq->i_val;
2252 		/* NB: if not operating in 11g this can wait */
2253 		if (ic->ic_curmode == IEEE80211_MODE_11G)
2254 			error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2255 		break;
2256 	case IEEE80211_IOC_TXPOWER:
2257 		if ((ic->ic_caps & IEEE80211_C_TXPMGT) == 0)
2258 			return EINVAL;
2259 		if (!(IEEE80211_TXPOWER_MIN < ireq->i_val &&
2260 		      ireq->i_val < IEEE80211_TXPOWER_MAX))
2261 			return EINVAL;
2262 		ic->ic_txpowlimit = ireq->i_val;
2263 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2264 		break;
2265 	case IEEE80211_IOC_ROAMING:
2266 		if (!(IEEE80211_ROAMING_DEVICE <= ireq->i_val &&
2267 		    ireq->i_val <= IEEE80211_ROAMING_MANUAL))
2268 			return EINVAL;
2269 		ic->ic_roaming = ireq->i_val;
2270 		/* XXXX reset? */
2271 		break;
2272 	case IEEE80211_IOC_PRIVACY:
2273 		if (ireq->i_val) {
2274 			/* XXX check for key state? */
2275 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2276 		} else
2277 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2278 		break;
2279 	case IEEE80211_IOC_DROPUNENCRYPTED:
2280 		if (ireq->i_val)
2281 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
2282 		else
2283 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2284 		break;
2285 	case IEEE80211_IOC_WPAKEY:
2286 		error = ieee80211_ioctl_setkey(ic, ireq);
2287 		break;
2288 	case IEEE80211_IOC_DELKEY:
2289 		error = ieee80211_ioctl_delkey(ic, ireq);
2290 		break;
2291 	case IEEE80211_IOC_MLME:
2292 		error = ieee80211_ioctl_setmlme(ic, ireq);
2293 		break;
2294 	case IEEE80211_IOC_OPTIE:
2295 		error = ieee80211_ioctl_setoptie(ic, ireq);
2296 		break;
2297 	case IEEE80211_IOC_COUNTERMEASURES:
2298 		if (ireq->i_val) {
2299 			if ((ic->ic_flags & IEEE80211_F_WPA) == 0)
2300 				return EINVAL;
2301 			ic->ic_flags |= IEEE80211_F_COUNTERM;
2302 		} else
2303 			ic->ic_flags &= ~IEEE80211_F_COUNTERM;
2304 		break;
2305 	case IEEE80211_IOC_WPA:
2306 		if (ireq->i_val > 3)
2307 			return EINVAL;
2308 		/* XXX verify ciphers available */
2309 		ic->ic_flags &= ~IEEE80211_F_WPA;
2310 		switch (ireq->i_val) {
2311 		case 1:
2312 			ic->ic_flags |= IEEE80211_F_WPA1;
2313 			break;
2314 		case 2:
2315 			ic->ic_flags |= IEEE80211_F_WPA2;
2316 			break;
2317 		case 3:
2318 			ic->ic_flags |= IEEE80211_F_WPA1 | IEEE80211_F_WPA2;
2319 			break;
2320 		}
2321 		error = ENETRESET;		/* XXX? */
2322 		break;
2323 	case IEEE80211_IOC_WME:
2324 		if (ireq->i_val) {
2325 			if ((ic->ic_caps & IEEE80211_C_WME) == 0)
2326 				return EINVAL;
2327 			ic->ic_flags |= IEEE80211_F_WME;
2328 		} else
2329 			ic->ic_flags &= ~IEEE80211_F_WME;
2330 		error = ENETRESET;		/* XXX maybe not for station? */
2331 		break;
2332 	case IEEE80211_IOC_HIDESSID:
2333 		if (ireq->i_val)
2334 			ic->ic_flags |= IEEE80211_F_HIDESSID;
2335 		else
2336 			ic->ic_flags &= ~IEEE80211_F_HIDESSID;
2337 		error = ENETRESET;
2338 		break;
2339 	case IEEE80211_IOC_APBRIDGE:
2340 		if (ireq->i_val == 0)
2341 			ic->ic_flags |= IEEE80211_F_NOBRIDGE;
2342 		else
2343 			ic->ic_flags &= ~IEEE80211_F_NOBRIDGE;
2344 		break;
2345 	case IEEE80211_IOC_MCASTCIPHER:
2346 		if ((ic->ic_caps & cipher2cap(ireq->i_val)) == 0 &&
2347 		    !ieee80211_crypto_available(ireq->i_val))
2348 			return EINVAL;
2349 		rsn->rsn_mcastcipher = ireq->i_val;
2350 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2351 		break;
2352 	case IEEE80211_IOC_MCASTKEYLEN:
2353 		if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2354 			return EINVAL;
2355 		/* XXX no way to verify driver capability */
2356 		rsn->rsn_mcastkeylen = ireq->i_val;
2357 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2358 		break;
2359 	case IEEE80211_IOC_UCASTCIPHERS:
2360 		/*
2361 		 * Convert user-specified cipher set to the set
2362 		 * we can support (via hardware or software).
2363 		 * NB: this logic intentionally ignores unknown and
2364 		 * unsupported ciphers so folks can specify 0xff or
2365 		 * similar and get all available ciphers.
2366 		 */
2367 		caps = 0;
2368 		for (j = 1; j < 32; j++)	/* NB: skip WEP */
2369 			if ((ireq->i_val & (1<<j)) &&
2370 			    ((ic->ic_caps & cipher2cap(j)) ||
2371 			     ieee80211_crypto_available(j)))
2372 				caps |= 1<<j;
2373 		if (caps == 0)			/* nothing available */
2374 			return EINVAL;
2375 		/* XXX verify ciphers ok for unicast use? */
2376 		/* XXX disallow if running as it'll have no effect */
2377 		rsn->rsn_ucastcipherset = caps;
2378 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2379 		break;
2380 	case IEEE80211_IOC_UCASTCIPHER:
2381 		if ((rsn->rsn_ucastcipherset & cipher2cap(ireq->i_val)) == 0)
2382 			return EINVAL;
2383 		rsn->rsn_ucastcipher = ireq->i_val;
2384 		break;
2385 	case IEEE80211_IOC_UCASTKEYLEN:
2386 		if (!(0 < ireq->i_val && ireq->i_val < IEEE80211_KEYBUF_SIZE))
2387 			return EINVAL;
2388 		/* XXX no way to verify driver capability */
2389 		rsn->rsn_ucastkeylen = ireq->i_val;
2390 		break;
2391 	case IEEE80211_IOC_DRIVER_CAPS:
2392 		/* NB: for testing */
2393 		ic->ic_caps = (((u_int16_t) ireq->i_val) << 16) |
2394 			       ((u_int16_t) ireq->i_len);
2395 		break;
2396 	case IEEE80211_IOC_KEYMGTALGS:
2397 		/* XXX check */
2398 		rsn->rsn_keymgmtset = ireq->i_val;
2399 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2400 		break;
2401 	case IEEE80211_IOC_RSNCAPS:
2402 		/* XXX check */
2403 		rsn->rsn_caps = ireq->i_val;
2404 		error = (ic->ic_flags & IEEE80211_F_WPA) ? ENETRESET : 0;
2405 		break;
2406 #if defined(__FreeBSD__) || defined(COMPAT_FREEBSD_NET80211)
2407 	case IEEE80211_IOC_BSSID:
2408 		/* NB: should only be set when in STA mode */
2409 		if (ic->ic_opmode != IEEE80211_M_STA)
2410 			return EINVAL;
2411 		if (ireq->i_len != sizeof(tmpbssid))
2412 			return EINVAL;
2413 		error = copyin(ireq->i_data, tmpbssid, ireq->i_len);
2414 		if (error)
2415 			break;
2416 		IEEE80211_ADDR_COPY(ic->ic_des_bssid, tmpbssid);
2417 		if (IEEE80211_ADDR_EQ(ic->ic_des_bssid, zerobssid))
2418 			ic->ic_flags &= ~IEEE80211_F_DESBSSID;
2419 		else
2420 			ic->ic_flags |= IEEE80211_F_DESBSSID;
2421 		error = ENETRESET;
2422 		break;
2423 #endif /* __FreeBSD__ || COMPAT_FREEBSD_NET80211 */
2424 	case IEEE80211_IOC_CHANLIST:
2425 		error = ieee80211_ioctl_setchanlist(ic, ireq);
2426 		break;
2427 	case IEEE80211_IOC_SCAN_REQ:
2428 		if (ic->ic_opmode == IEEE80211_M_HOSTAP)	/* XXX ignore */
2429 			break;
2430 		error = ieee80211_setupscan(ic, ic->ic_chan_avail);
2431 		if (error == 0)		/* XXX background scan */
2432 			error = ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2433 		break;
2434 	case IEEE80211_IOC_ADDMAC:
2435 	case IEEE80211_IOC_DELMAC:
2436 		error = ieee80211_ioctl_macmac(ic, ireq);
2437 		break;
2438 	case IEEE80211_IOC_MACCMD:
2439 		error = ieee80211_ioctl_setmaccmd(ic, ireq);
2440 		break;
2441 	case IEEE80211_IOC_STA_TXPOW:
2442 		error = ieee80211_ioctl_setstatxpow(ic, ireq);
2443 		break;
2444 	case IEEE80211_IOC_WME_CWMIN:		/* WME: CWmin */
2445 	case IEEE80211_IOC_WME_CWMAX:		/* WME: CWmax */
2446 	case IEEE80211_IOC_WME_AIFS:		/* WME: AIFS */
2447 	case IEEE80211_IOC_WME_TXOPLIMIT:	/* WME: txops limit */
2448 	case IEEE80211_IOC_WME_ACM:		/* WME: ACM (bss only) */
2449 	case IEEE80211_IOC_WME_ACKPOLICY:	/* WME: ACK policy (bss only) */
2450 		error = ieee80211_ioctl_setwmeparam(ic, ireq);
2451 		break;
2452 	case IEEE80211_IOC_DTIM_PERIOD:
2453 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2454 		    ic->ic_opmode != IEEE80211_M_IBSS)
2455 			return EINVAL;
2456 		if (IEEE80211_DTIM_MIN <= ireq->i_val &&
2457 		    ireq->i_val <= IEEE80211_DTIM_MAX) {
2458 			ic->ic_dtim_period = ireq->i_val;
2459 			error = ENETRESET;		/* requires restart */
2460 		} else
2461 			error = EINVAL;
2462 		break;
2463 	case IEEE80211_IOC_BEACON_INTERVAL:
2464 		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2465 		    ic->ic_opmode != IEEE80211_M_IBSS)
2466 			return EINVAL;
2467 		if (IEEE80211_BINTVAL_MIN <= ireq->i_val &&
2468 		    ireq->i_val <= IEEE80211_BINTVAL_MAX) {
2469 			ic->ic_bintval = ireq->i_val;
2470 			error = ENETRESET;		/* requires restart */
2471 		} else
2472 			error = EINVAL;
2473 		break;
2474 	case IEEE80211_IOC_PUREG:
2475 		if (ireq->i_val)
2476 			ic->ic_flags |= IEEE80211_F_PUREG;
2477 		else
2478 			ic->ic_flags &= ~IEEE80211_F_PUREG;
2479 		/* NB: reset only if we're operating on an 11g channel */
2480 		if (ic->ic_curmode == IEEE80211_MODE_11G)
2481 			error = ENETRESET;
2482 		break;
2483 	case IEEE80211_IOC_MCAST_RATE:
2484 		ic->ic_mcast_rate = ireq->i_val & IEEE80211_RATE_VAL;
2485 		break;
2486 	case IEEE80211_IOC_FRAGTHRESHOLD:
2487 		if ((ic->ic_caps & IEEE80211_C_TXFRAG) == 0 &&
2488 		    ireq->i_val != IEEE80211_FRAG_MAX)
2489 			return EINVAL;
2490 		if (!(IEEE80211_FRAG_MIN <= ireq->i_val &&
2491 		      ireq->i_val <= IEEE80211_FRAG_MAX))
2492 			return EINVAL;
2493 		ic->ic_fragthreshold = ireq->i_val;
2494 		error = IS_UP(ic) ? ic->ic_reset(ic->ic_ifp) : 0;
2495 		break;
2496 	default:
2497 		error = EINVAL;
2498 		break;
2499 	}
2500 	if (error == ENETRESET && !IS_UP_AUTO(ic))
2501 		error = 0;
2502 	return error;
2503 }
2504 
2505 #ifdef __FreeBSD__
2506 int
2507 ieee80211_ioctl(struct ieee80211com *ic, u_long cmd, void *data)
2508 {
2509 	struct ifnet *ifp = ic->ic_ifp;
2510 	int error = 0;
2511 	struct ifreq *ifr;
2512 	struct ifaddr *ifa;			/* XXX */
2513 
2514 	switch (cmd) {
2515 	case SIOCSIFMEDIA:
2516 	case SIOCGIFMEDIA:
2517 		error = ifmedia_ioctl(ifp, (struct ifreq *) data,
2518 				&ic->ic_media, cmd);
2519 		break;
2520 	case SIOCG80211:
2521 		error = ieee80211_ioctl_get80211(ic, cmd,
2522 				(struct ieee80211req *) data);
2523 		break;
2524 	case SIOCS80211:
2525 		error = suser(curthread);
2526 		if (error == 0)
2527 			error = ieee80211_ioctl_set80211(ic, cmd,
2528 					(struct ieee80211req *) data);
2529 		break;
2530 	case SIOCGIFGENERIC:
2531 		error = ieee80211_cfgget(ic, cmd, data);
2532 		break;
2533 	case SIOCSIFGENERIC:
2534 		error = suser(curthread);
2535 		if (error)
2536 			break;
2537 		error = ieee80211_cfgset(ic, cmd, data);
2538 		break;
2539 	case SIOCG80211STATS:
2540 		ifr = (struct ifreq *)data;
2541 		copyout(&ic->ic_stats, ifr->ifr_data, sizeof (ic->ic_stats));
2542 		break;
2543 	case SIOCSIFMTU:
2544 		ifr = (struct ifreq *)data;
2545 		if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
2546 		    ifr->ifr_mtu <= IEEE80211_MTU_MAX))
2547 			error = EINVAL;
2548 		else
2549 			ifp->if_mtu = ifr->ifr_mtu;
2550 		break;
2551 	default:
2552 		error = ether_ioctl(ifp, cmd, data);
2553 		break;
2554 	}
2555 	return error;
2556 }
2557 #endif /* __FreeBSD__ */
2558 
2559 #ifdef __NetBSD__
2560 
2561 int
2562 ieee80211_ioctl(struct ieee80211com *ic, u_long cmd, void *data)
2563 {
2564 	struct ifnet *ifp = ic->ic_ifp;
2565 	struct ifreq *ifr = (struct ifreq *)data;
2566 	int i, error = 0, kid, klen, s;
2567 	struct ieee80211_key *k;
2568 	struct ieee80211_nwid nwid;
2569 	struct ieee80211_nwkey *nwkey;
2570 	struct ieee80211_power *power;
2571 	struct ieee80211_bssid *bssid;
2572 	struct ieee80211chanreq *chanreq;
2573 	struct ieee80211_channel *chan;
2574 	uint32_t oflags;
2575 	static const u_int8_t zerobssid[IEEE80211_ADDR_LEN];
2576 	u_int8_t tmpkey[IEEE80211_WEP_NKID][IEEE80211_KEYBUF_SIZE];
2577 
2578 	switch (cmd) {
2579 	case SIOCSIFMEDIA:
2580 	case SIOCGIFMEDIA:
2581 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2582 		break;
2583 	case SIOCG80211:
2584 		error = ieee80211_ioctl_get80211(ic, cmd,
2585 				(struct ieee80211req *) data);
2586 		break;
2587 	case SIOCS80211:
2588 		if ((error = kauth_authorize_network(curlwp->l_cred,
2589 		    KAUTH_NETWORK_INTERFACE,
2590 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
2591 		    NULL)) != 0)
2592 			break;
2593 		error = ieee80211_ioctl_set80211(ic, cmd,
2594 				(struct ieee80211req *) data);
2595 		break;
2596 	case SIOCS80211NWID:
2597 		if ((error = copyin(ifr->ifr_data, &nwid, sizeof(nwid))) != 0)
2598 			break;
2599 		if (nwid.i_len > IEEE80211_NWID_LEN) {
2600 			error = EINVAL;
2601 			break;
2602 		}
2603 		memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
2604 		ic->ic_des_esslen = nwid.i_len;
2605 		memcpy(ic->ic_des_essid, nwid.i_nwid, nwid.i_len);
2606 		error = ENETRESET;
2607 		break;
2608 	case SIOCG80211NWID:
2609 		memset(&nwid, 0, sizeof(nwid));
2610 		switch (ic->ic_state) {
2611 		case IEEE80211_S_INIT:
2612 		case IEEE80211_S_SCAN:
2613 			nwid.i_len = ic->ic_des_esslen;
2614 			memcpy(nwid.i_nwid, ic->ic_des_essid, nwid.i_len);
2615 			break;
2616 		default:
2617 			nwid.i_len = ic->ic_bss->ni_esslen;
2618 			memcpy(nwid.i_nwid, ic->ic_bss->ni_essid, nwid.i_len);
2619 			break;
2620 		}
2621 		error = copyout(&nwid, ifr->ifr_data, sizeof(nwid));
2622 		break;
2623 	case SIOCS80211NWKEY:
2624 		nwkey = (struct ieee80211_nwkey *)data;
2625 		/* transmit key index out of range? */
2626 		kid = nwkey->i_defkid - 1;
2627 		if (kid < 0 || kid >= IEEE80211_WEP_NKID) {
2628 			error = EINVAL;
2629 			break;
2630 		}
2631 		/* no such transmit key is set? */
2632 		if (nwkey->i_key[kid].i_keylen == 0 ||
2633 		    (nwkey->i_key[kid].i_keylen == -1 &&
2634 		     ic->ic_nw_keys[kid].wk_keylen == 0)) {
2635 			if (nwkey->i_wepon != IEEE80211_NWKEY_OPEN) {
2636 				error = EINVAL;
2637 				break;
2638 			}
2639 		}
2640 		/* check key lengths */
2641 		for (kid = 0; kid < IEEE80211_WEP_NKID; kid++) {
2642 			klen = nwkey->i_key[kid].i_keylen;
2643 			if ((klen > 0 &&
2644 			    klen < IEEE80211_WEP_KEYLEN) ||
2645 			    klen > sizeof(ic->ic_nw_keys[kid].wk_key)) {
2646 				error = EINVAL;
2647 				break;
2648 			}
2649 		}
2650 
2651 		if (error)
2652 			break;
2653 
2654 		/* copy in keys */
2655 		(void)memset(tmpkey, 0, sizeof(tmpkey));
2656 		for (kid = 0; kid < IEEE80211_WEP_NKID; kid++) {
2657 			klen = nwkey->i_key[kid].i_keylen;
2658 			if (klen <= 0)
2659 				continue;
2660 			if ((error = copyin(nwkey->i_key[kid].i_keydat,
2661 			    tmpkey[kid], klen)) != 0)
2662 				break;
2663 		}
2664 
2665 		if (error)
2666 			break;
2667 
2668 		/* set keys */
2669 		ieee80211_key_update_begin(ic);
2670 		for (kid = 0; kid < IEEE80211_WEP_NKID; kid++) {
2671 			klen = nwkey->i_key[kid].i_keylen;
2672 			if (klen <= 0)
2673 				continue;
2674 			k = &ic->ic_nw_keys[kid];
2675 			k->wk_keyix = kid;
2676 			if (!ieee80211_crypto_newkey(ic, IEEE80211_CIPHER_WEP,
2677 			    IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV, k)) {
2678 				error = EINVAL;
2679 				continue;
2680 			}
2681 			k->wk_keylen = nwkey->i_key[kid].i_keylen;
2682 			(void)memcpy(k->wk_key, tmpkey[kid],
2683 			    sizeof(tmpkey[kid]));
2684 			if (!ieee80211_crypto_setkey(ic, k, ic->ic_myaddr))
2685 				error = EINVAL;
2686 		}
2687 		ieee80211_key_update_end(ic);
2688 
2689 		if (error)
2690 			break;
2691 
2692 		/* delete keys */
2693 		for (kid = 0; kid < IEEE80211_WEP_NKID; kid++) {
2694 			klen = nwkey->i_key[kid].i_keylen;
2695 			k = &ic->ic_nw_keys[kid];
2696 			if (klen <= 0)
2697 				(void)ieee80211_crypto_delkey(ic, k);
2698 		}
2699 
2700 		/* set transmit key */
2701 		kid = nwkey->i_defkid - 1;
2702 		if (ic->ic_def_txkey != kid) {
2703 			ic->ic_def_txkey = kid;
2704 			error = ENETRESET;
2705 		}
2706 		oflags = ic->ic_flags;
2707 		if (nwkey->i_wepon == IEEE80211_NWKEY_OPEN) {
2708 			ic->ic_flags &= ~IEEE80211_F_PRIVACY;
2709 			ic->ic_flags &= ~IEEE80211_F_DROPUNENC;
2710 		} else {
2711 			ic->ic_flags |= IEEE80211_F_PRIVACY;
2712 			ic->ic_flags |= IEEE80211_F_DROPUNENC;
2713 		}
2714 		if (oflags != ic->ic_flags)
2715 			error = ENETRESET;
2716 		break;
2717 	case SIOCG80211NWKEY:
2718 		nwkey = (struct ieee80211_nwkey *)data;
2719 		if (ic->ic_flags & IEEE80211_F_PRIVACY)
2720 			nwkey->i_wepon = IEEE80211_NWKEY_WEP;
2721 		else
2722 			nwkey->i_wepon = IEEE80211_NWKEY_OPEN;
2723 		nwkey->i_defkid = ic->ic_def_txkey + 1;
2724 		for (i = 0; i < IEEE80211_WEP_NKID; i++) {
2725 			if (nwkey->i_key[i].i_keydat == NULL)
2726 				continue;
2727 			/* do not show any keys to non-root user */
2728 			if ((error = kauth_authorize_network(curlwp->l_cred,
2729 			    KAUTH_NETWORK_INTERFACE,
2730 			    KAUTH_REQ_NETWORK_INTERFACE_GETPRIV, ifp,
2731 			    (void *)cmd, NULL)) != 0)
2732 				break;
2733 			nwkey->i_key[i].i_keylen = ic->ic_nw_keys[i].wk_keylen;
2734 			if ((error = copyout(ic->ic_nw_keys[i].wk_key,
2735 			    nwkey->i_key[i].i_keydat,
2736 			    ic->ic_nw_keys[i].wk_keylen)) != 0)
2737 				break;
2738 		}
2739 		break;
2740 	case SIOCS80211POWER:
2741 		power = (struct ieee80211_power *)data;
2742 		ic->ic_lintval = power->i_maxsleep;
2743 		if (power->i_enabled != 0) {
2744 			if ((ic->ic_caps & IEEE80211_C_PMGT) == 0)
2745 				error = EINVAL;
2746 			else if ((ic->ic_flags & IEEE80211_F_PMGTON) == 0) {
2747 				ic->ic_flags |= IEEE80211_F_PMGTON;
2748 				error = ENETRESET;
2749 			}
2750 		} else {
2751 			if (ic->ic_flags & IEEE80211_F_PMGTON) {
2752 				ic->ic_flags &= ~IEEE80211_F_PMGTON;
2753 				error = ENETRESET;
2754 			}
2755 		}
2756 		break;
2757 	case SIOCG80211POWER:
2758 		power = (struct ieee80211_power *)data;
2759 		power->i_enabled = (ic->ic_flags & IEEE80211_F_PMGTON) ? 1 : 0;
2760 		power->i_maxsleep = ic->ic_lintval;
2761 		break;
2762 	case SIOCS80211BSSID:
2763 		bssid = (struct ieee80211_bssid *)data;
2764 		IEEE80211_ADDR_COPY(ic->ic_des_bssid, bssid->i_bssid);
2765 		if (IEEE80211_ADDR_EQ(ic->ic_des_bssid, zerobssid))
2766 			ic->ic_flags &= ~IEEE80211_F_DESBSSID;
2767 		else
2768 			ic->ic_flags |= IEEE80211_F_DESBSSID;
2769 		error = ENETRESET;
2770 		break;
2771 	case SIOCG80211BSSID:
2772 		bssid = (struct ieee80211_bssid *)data;
2773 		switch (ic->ic_state) {
2774 		case IEEE80211_S_INIT:
2775 		case IEEE80211_S_SCAN:
2776 			if (ic->ic_opmode == IEEE80211_M_HOSTAP)
2777 				IEEE80211_ADDR_COPY(bssid->i_bssid,
2778 				    ic->ic_myaddr);
2779 			else if (ic->ic_flags & IEEE80211_F_DESBSSID)
2780 				IEEE80211_ADDR_COPY(bssid->i_bssid,
2781 				    ic->ic_des_bssid);
2782 			else
2783 				memset(bssid->i_bssid, 0, IEEE80211_ADDR_LEN);
2784 			break;
2785 		default:
2786 			IEEE80211_ADDR_COPY(bssid->i_bssid,
2787 			    ic->ic_bss->ni_bssid);
2788 			break;
2789 		}
2790 		break;
2791 	case SIOCS80211CHANNEL:
2792 		chanreq = (struct ieee80211chanreq *)data;
2793 		if (chanreq->i_channel == IEEE80211_CHAN_ANY)
2794 			ic->ic_des_chan = IEEE80211_CHAN_ANYC;
2795 		else if (chanreq->i_channel > IEEE80211_CHAN_MAX ||
2796 		    isclr(ic->ic_chan_active, chanreq->i_channel)) {
2797 			error = EINVAL;
2798 			break;
2799 		} else
2800 			ic->ic_ibss_chan = ic->ic_des_chan =
2801 			    &ic->ic_channels[chanreq->i_channel];
2802 		switch (ic->ic_state) {
2803 		case IEEE80211_S_INIT:
2804 		case IEEE80211_S_SCAN:
2805 			error = ENETRESET;
2806 			break;
2807 		default:
2808 			if (ic->ic_opmode == IEEE80211_M_STA) {
2809 				if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
2810 				    ic->ic_bss->ni_chan != ic->ic_des_chan)
2811 					error = ENETRESET;
2812 			} else if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2813 				ic->ic_curchan = ic->ic_ibss_chan;
2814 				error = ENETRESET;
2815 			} else {
2816 				if (ic->ic_bss->ni_chan != ic->ic_ibss_chan)
2817 					error = ENETRESET;
2818 			}
2819 			break;
2820 		}
2821 		break;
2822 	case SIOCG80211CHANNEL:
2823 		chanreq = (struct ieee80211chanreq *)data;
2824 		switch (ic->ic_state) {
2825 		case IEEE80211_S_INIT:
2826 		case IEEE80211_S_SCAN:
2827 			if (ic->ic_opmode == IEEE80211_M_STA)
2828 				chan = ic->ic_des_chan;
2829 			else
2830 				chan = ic->ic_ibss_chan;
2831 			break;
2832 		default:
2833 			chan = ic->ic_curchan;
2834 			break;
2835 		}
2836 		chanreq->i_channel = ieee80211_chan2ieee(ic, chan);
2837 		break;
2838 	case SIOCGIFGENERIC:
2839 		error = ieee80211_cfgget(ic, cmd, data);
2840 		break;
2841 	case SIOCSIFGENERIC:
2842 		error = kauth_authorize_network(curlwp->l_cred,
2843 		    KAUTH_NETWORK_INTERFACE,
2844 		    KAUTH_REQ_NETWORK_INTERFACE_SETPRIV, ifp, (void *)cmd,
2845 		    NULL);
2846 		if (error)
2847 			break;
2848 		error = ieee80211_cfgset(ic, cmd, data);
2849 		break;
2850 	case OSIOCG80211STATS:
2851 	case OSIOCG80211ZSTATS:
2852 		(void)module_autoload("compat_20", MODULE_CLASS_EXEC);
2853 		MODULE_HOOK_CALL(ieee80211_ioctl_20_hook, (ic, cmd, data),
2854 		    enosys(), error);
2855 		break;
2856 	case SIOCG80211ZSTATS:
2857 	case SIOCG80211STATS:
2858 		ifr = (struct ifreq *)data;
2859 		s = splnet();
2860 		error = copyout(&ic->ic_stats, ifr->ifr_buf,
2861 		    MIN(sizeof(ic->ic_stats), ifr->ifr_buflen));
2862 		if (error == 0 && cmd == SIOCG80211ZSTATS)
2863 			(void)memset(&ic->ic_stats, 0, sizeof(ic->ic_stats));
2864 		splx(s);
2865 		break;
2866 	case SIOCSIFMTU:
2867 		ifr = (struct ifreq *)data;
2868 		if (!(IEEE80211_MTU_MIN <= ifr->ifr_mtu &&
2869 		    ifr->ifr_mtu <= IEEE80211_MTU_MAX))
2870 			error = EINVAL;
2871 		else if ((error = ifioctl_common(ifp, cmd, data)) == ENETRESET)
2872 			error = 0;
2873 		break;
2874 	default:
2875 		error = ether_ioctl(ifp, cmd, data);
2876 		break;
2877 	}
2878 	return error;
2879 }
2880 #endif /* __NetBSD__ */
2881