1 /* $OpenBSD: ieee80211_proto.c,v 1.107 2021/12/05 11:33:45 stsp Exp $ */ 2 /* $NetBSD: ieee80211_proto.c,v 1.8 2004/04/30 23:58:20 dyoung Exp $ */ 3 4 /*- 5 * Copyright (c) 2001 Atsushi Onoe 6 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting 7 * Copyright (c) 2008, 2009 Damien Bergamini 8 * All rights reserved. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 3. The name of the author may not be used to endorse or promote products 19 * derived from this software without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 /* 34 * IEEE 802.11 protocol support. 35 */ 36 37 #include <sys/param.h> 38 #include <sys/systm.h> 39 #include <sys/mbuf.h> 40 #include <sys/kernel.h> 41 #include <sys/socket.h> 42 #include <sys/sockio.h> 43 #include <sys/endian.h> 44 #include <sys/errno.h> 45 #include <sys/sysctl.h> 46 47 #include <net/if.h> 48 #include <net/if_dl.h> 49 #include <net/if_media.h> 50 #include <net/if_llc.h> 51 #include <net/route.h> 52 53 #include <netinet/in.h> 54 #include <netinet/if_ether.h> 55 56 #include <net80211/ieee80211_var.h> 57 #include <net80211/ieee80211_priv.h> 58 59 const char * const ieee80211_mgt_subtype_name[] = { 60 "assoc_req", "assoc_resp", "reassoc_req", "reassoc_resp", 61 "probe_req", "probe_resp", "reserved#6", "reserved#7", 62 "beacon", "atim", "disassoc", "auth", 63 "deauth", "action", "action_noack", "reserved#15" 64 }; 65 const char * const ieee80211_state_name[IEEE80211_S_MAX] = { 66 "INIT", /* IEEE80211_S_INIT */ 67 "SCAN", /* IEEE80211_S_SCAN */ 68 "AUTH", /* IEEE80211_S_AUTH */ 69 "ASSOC", /* IEEE80211_S_ASSOC */ 70 "RUN" /* IEEE80211_S_RUN */ 71 }; 72 const char * const ieee80211_phymode_name[] = { 73 "auto", /* IEEE80211_MODE_AUTO */ 74 "11a", /* IEEE80211_MODE_11A */ 75 "11b", /* IEEE80211_MODE_11B */ 76 "11g", /* IEEE80211_MODE_11G */ 77 "11n", /* IEEE80211_MODE_11N */ 78 }; 79 80 void ieee80211_set_beacon_miss_threshold(struct ieee80211com *); 81 int ieee80211_newstate(struct ieee80211com *, enum ieee80211_state, int); 82 83 void 84 ieee80211_proto_attach(struct ifnet *ifp) 85 { 86 struct ieee80211com *ic = (void *)ifp; 87 88 mq_init(&ic->ic_mgtq, IFQ_MAXLEN, IPL_NET); 89 mq_init(&ic->ic_pwrsaveq, IFQ_MAXLEN, IPL_NET); 90 91 ifp->if_hdrlen = sizeof(struct ieee80211_frame); 92 93 ic->ic_rtsthreshold = IEEE80211_RTS_MAX; 94 ic->ic_fragthreshold = 2346; /* XXX not used yet */ 95 ic->ic_fixed_rate = -1; /* no fixed rate */ 96 ic->ic_fixed_mcs = -1; /* no fixed mcs */ 97 ic->ic_protmode = IEEE80211_PROT_CTSONLY; 98 99 /* protocol state change handler */ 100 ic->ic_newstate = ieee80211_newstate; 101 102 /* initialize management frame handlers */ 103 ic->ic_recv_mgmt = ieee80211_recv_mgmt; 104 ic->ic_send_mgmt = ieee80211_send_mgmt; 105 } 106 107 void 108 ieee80211_proto_detach(struct ifnet *ifp) 109 { 110 struct ieee80211com *ic = (void *)ifp; 111 112 mq_purge(&ic->ic_mgtq); 113 mq_purge(&ic->ic_pwrsaveq); 114 } 115 116 void 117 ieee80211_print_essid(const u_int8_t *essid, int len) 118 { 119 int i; 120 const u_int8_t *p; 121 122 if (len > IEEE80211_NWID_LEN) 123 len = IEEE80211_NWID_LEN; 124 /* determine printable or not */ 125 for (i = 0, p = essid; i < len; i++, p++) { 126 if (*p < ' ' || *p > 0x7e) 127 break; 128 } 129 if (i == len) { 130 printf("\""); 131 for (i = 0, p = essid; i < len; i++, p++) 132 printf("%c", *p); 133 printf("\""); 134 } else { 135 printf("0x"); 136 for (i = 0, p = essid; i < len; i++, p++) 137 printf("%02x", *p); 138 } 139 } 140 141 #ifdef IEEE80211_DEBUG 142 void 143 ieee80211_dump_pkt(const u_int8_t *buf, int len, int rate, int rssi) 144 { 145 struct ieee80211_frame *wh; 146 int i; 147 148 wh = (struct ieee80211_frame *)buf; 149 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) { 150 case IEEE80211_FC1_DIR_NODS: 151 printf("NODS %s", ether_sprintf(wh->i_addr2)); 152 printf("->%s", ether_sprintf(wh->i_addr1)); 153 printf("(%s)", ether_sprintf(wh->i_addr3)); 154 break; 155 case IEEE80211_FC1_DIR_TODS: 156 printf("TODS %s", ether_sprintf(wh->i_addr2)); 157 printf("->%s", ether_sprintf(wh->i_addr3)); 158 printf("(%s)", ether_sprintf(wh->i_addr1)); 159 break; 160 case IEEE80211_FC1_DIR_FROMDS: 161 printf("FRDS %s", ether_sprintf(wh->i_addr3)); 162 printf("->%s", ether_sprintf(wh->i_addr1)); 163 printf("(%s)", ether_sprintf(wh->i_addr2)); 164 break; 165 case IEEE80211_FC1_DIR_DSTODS: 166 printf("DSDS %s", ether_sprintf((u_int8_t *)&wh[1])); 167 printf("->%s", ether_sprintf(wh->i_addr3)); 168 printf("(%s", ether_sprintf(wh->i_addr2)); 169 printf("->%s)", ether_sprintf(wh->i_addr1)); 170 break; 171 } 172 switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) { 173 case IEEE80211_FC0_TYPE_DATA: 174 printf(" data"); 175 break; 176 case IEEE80211_FC0_TYPE_MGT: 177 printf(" %s", ieee80211_mgt_subtype_name[ 178 (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) 179 >> IEEE80211_FC0_SUBTYPE_SHIFT]); 180 break; 181 default: 182 printf(" type#%d", wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK); 183 break; 184 } 185 if (wh->i_fc[1] & IEEE80211_FC1_WEP) 186 printf(" WEP"); 187 if (rate >= 0) 188 printf(" %d%sM", rate / 2, (rate & 1) ? ".5" : ""); 189 if (rssi >= 0) 190 printf(" +%d", rssi); 191 printf("\n"); 192 if (len > 0) { 193 for (i = 0; i < len; i++) { 194 if ((i & 1) == 0) 195 printf(" "); 196 printf("%02x", buf[i]); 197 } 198 printf("\n"); 199 } 200 } 201 #endif 202 203 int 204 ieee80211_fix_rate(struct ieee80211com *ic, struct ieee80211_node *ni, 205 int flags) 206 { 207 #define RV(v) ((v) & IEEE80211_RATE_VAL) 208 int i, j, ignore, error; 209 int okrate, badrate, fixedrate; 210 const struct ieee80211_rateset *srs; 211 struct ieee80211_rateset *nrs; 212 u_int8_t r; 213 214 /* 215 * If the fixed rate check was requested but no fixed rate has been 216 * defined then just remove the check. 217 */ 218 if ((flags & IEEE80211_F_DOFRATE) && ic->ic_fixed_rate == -1) 219 flags &= ~IEEE80211_F_DOFRATE; 220 221 error = 0; 222 okrate = badrate = fixedrate = 0; 223 srs = &ic->ic_sup_rates[ieee80211_chan2mode(ic, ni->ni_chan)]; 224 nrs = &ni->ni_rates; 225 for (i = 0; i < nrs->rs_nrates; ) { 226 ignore = 0; 227 if (flags & IEEE80211_F_DOSORT) { 228 /* 229 * Sort rates. 230 */ 231 for (j = i + 1; j < nrs->rs_nrates; j++) { 232 if (RV(nrs->rs_rates[i]) > 233 RV(nrs->rs_rates[j])) { 234 r = nrs->rs_rates[i]; 235 nrs->rs_rates[i] = nrs->rs_rates[j]; 236 nrs->rs_rates[j] = r; 237 } 238 } 239 } 240 r = nrs->rs_rates[i] & IEEE80211_RATE_VAL; 241 badrate = r; 242 if (flags & IEEE80211_F_DOFRATE) { 243 /* 244 * Check fixed rate is included. 245 */ 246 if (r == RV(srs->rs_rates[ic->ic_fixed_rate])) 247 fixedrate = r; 248 } 249 if (flags & IEEE80211_F_DONEGO) { 250 /* 251 * Check against supported rates. 252 */ 253 for (j = 0; j < srs->rs_nrates; j++) { 254 if (r == RV(srs->rs_rates[j])) { 255 /* 256 * Overwrite with the supported rate 257 * value so any basic rate bit is set. 258 * This insures that response we send 259 * to stations have the necessary basic 260 * rate bit set. 261 */ 262 nrs->rs_rates[i] = srs->rs_rates[j]; 263 break; 264 } 265 } 266 if (j == srs->rs_nrates) { 267 /* 268 * A rate in the node's rate set is not 269 * supported. If this is a basic rate and we 270 * are operating as an AP then this is an error. 271 * Otherwise we just discard/ignore the rate. 272 * Note that this is important for 11b stations 273 * when they want to associate with an 11g AP. 274 */ 275 #ifndef IEEE80211_STA_ONLY 276 if (ic->ic_opmode == IEEE80211_M_HOSTAP && 277 (nrs->rs_rates[i] & IEEE80211_RATE_BASIC)) 278 error++; 279 #endif 280 ignore++; 281 } 282 } 283 if (flags & IEEE80211_F_DODEL) { 284 /* 285 * Delete unacceptable rates. 286 */ 287 if (ignore) { 288 nrs->rs_nrates--; 289 for (j = i; j < nrs->rs_nrates; j++) 290 nrs->rs_rates[j] = nrs->rs_rates[j + 1]; 291 nrs->rs_rates[j] = 0; 292 continue; 293 } 294 } 295 if (!ignore) 296 okrate = nrs->rs_rates[i]; 297 i++; 298 } 299 if (okrate == 0 || error != 0 || 300 ((flags & IEEE80211_F_DOFRATE) && fixedrate == 0)) 301 return badrate | IEEE80211_RATE_BASIC; 302 else 303 return RV(okrate); 304 #undef RV 305 } 306 307 /* 308 * Reset 11g-related state. 309 */ 310 void 311 ieee80211_reset_erp(struct ieee80211com *ic) 312 { 313 ic->ic_flags &= ~IEEE80211_F_USEPROT; 314 315 ieee80211_set_shortslottime(ic, 316 ic->ic_curmode == IEEE80211_MODE_11A || 317 (ic->ic_curmode == IEEE80211_MODE_11N && 318 IEEE80211_IS_CHAN_5GHZ(ic->ic_ibss_chan)) 319 #ifndef IEEE80211_STA_ONLY 320 || 321 ((ic->ic_curmode == IEEE80211_MODE_11G || 322 (ic->ic_curmode == IEEE80211_MODE_11N && 323 IEEE80211_IS_CHAN_2GHZ(ic->ic_ibss_chan))) && 324 ic->ic_opmode == IEEE80211_M_HOSTAP && 325 (ic->ic_caps & IEEE80211_C_SHSLOT)) 326 #endif 327 ); 328 329 if (ic->ic_curmode == IEEE80211_MODE_11A || 330 (ic->ic_curmode == IEEE80211_MODE_11N && 331 IEEE80211_IS_CHAN_5GHZ(ic->ic_ibss_chan)) || 332 (ic->ic_caps & IEEE80211_C_SHPREAMBLE)) 333 ic->ic_flags |= IEEE80211_F_SHPREAMBLE; 334 else 335 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE; 336 } 337 338 /* 339 * Set the short slot time state and notify the driver. 340 */ 341 void 342 ieee80211_set_shortslottime(struct ieee80211com *ic, int on) 343 { 344 if (on) 345 ic->ic_flags |= IEEE80211_F_SHSLOT; 346 else 347 ic->ic_flags &= ~IEEE80211_F_SHSLOT; 348 349 /* notify the driver */ 350 if (ic->ic_updateslot != NULL) 351 ic->ic_updateslot(ic); 352 } 353 354 /* 355 * This function is called by the 802.1X PACP machine (via an ioctl) when 356 * the transmit key machine (4-Way Handshake for 802.11) should run. 357 */ 358 int 359 ieee80211_keyrun(struct ieee80211com *ic, u_int8_t *macaddr) 360 { 361 struct ieee80211_node *ni = ic->ic_bss; 362 #ifndef IEEE80211_STA_ONLY 363 struct ieee80211_pmk *pmk; 364 #endif 365 366 /* STA must be associated or AP must be ready */ 367 if (ic->ic_state != IEEE80211_S_RUN || 368 !(ic->ic_flags & IEEE80211_F_RSNON)) 369 return ENETDOWN; 370 371 ni->ni_rsn_supp_state = RSNA_SUPP_PTKSTART; 372 #ifndef IEEE80211_STA_ONLY 373 if (ic->ic_opmode == IEEE80211_M_STA) 374 #endif 375 return 0; /* supplicant only, do nothing */ 376 377 #ifndef IEEE80211_STA_ONLY 378 /* find the STA with which we must start the key exchange */ 379 if ((ni = ieee80211_find_node(ic, macaddr)) == NULL) { 380 DPRINTF(("no node found for %s\n", ether_sprintf(macaddr))); 381 return EINVAL; 382 } 383 /* check that the STA is in the correct state */ 384 if (ni->ni_state != IEEE80211_STA_ASSOC || 385 ni->ni_rsn_state != RSNA_AUTHENTICATION_2) { 386 DPRINTF(("unexpected in state %d\n", ni->ni_rsn_state)); 387 return EINVAL; 388 } 389 ni->ni_rsn_state = RSNA_INITPMK; 390 391 /* make sure a PMK is available for this STA, otherwise deauth it */ 392 if ((pmk = ieee80211_pmksa_find(ic, ni, NULL)) == NULL) { 393 DPRINTF(("no PMK available for %s\n", ether_sprintf(macaddr))); 394 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 395 IEEE80211_REASON_AUTH_LEAVE); 396 ieee80211_node_leave(ic, ni); 397 return EINVAL; 398 } 399 memcpy(ni->ni_pmk, pmk->pmk_key, IEEE80211_PMK_LEN); 400 memcpy(ni->ni_pmkid, pmk->pmk_pmkid, IEEE80211_PMKID_LEN); 401 ni->ni_flags |= IEEE80211_NODE_PMK; 402 403 /* initiate key exchange (4-Way Handshake) with STA */ 404 return ieee80211_send_4way_msg1(ic, ni); 405 #endif /* IEEE80211_STA_ONLY */ 406 } 407 408 #ifndef IEEE80211_STA_ONLY 409 /* 410 * Initiate a group key handshake with a node. 411 */ 412 static void 413 ieee80211_node_gtk_rekey(void *arg, struct ieee80211_node *ni) 414 { 415 struct ieee80211com *ic = arg; 416 417 if (ni->ni_state != IEEE80211_STA_ASSOC || 418 ni->ni_rsn_gstate != RSNA_IDLE) 419 return; 420 421 /* initiate a group key handshake with STA */ 422 ni->ni_flags |= IEEE80211_NODE_REKEY; 423 if (ieee80211_send_group_msg1(ic, ni) != 0) 424 ni->ni_flags &= ~IEEE80211_NODE_REKEY; 425 } 426 427 /* 428 * This function is called in HostAP mode when the group key needs to be 429 * changed. 430 */ 431 void 432 ieee80211_setkeys(struct ieee80211com *ic) 433 { 434 struct ieee80211_key *k; 435 u_int8_t kid; 436 int rekeysta = 0; 437 438 /* Swap(GM, GN) */ 439 kid = (ic->ic_def_txkey == 1) ? 2 : 1; 440 k = &ic->ic_nw_keys[kid]; 441 memset(k, 0, sizeof(*k)); 442 k->k_id = kid; 443 k->k_cipher = ic->ic_bss->ni_rsngroupcipher; 444 k->k_flags = IEEE80211_KEY_GROUP | IEEE80211_KEY_TX; 445 k->k_len = ieee80211_cipher_keylen(k->k_cipher); 446 arc4random_buf(k->k_key, k->k_len); 447 448 if (ic->ic_caps & IEEE80211_C_MFP) { 449 /* Swap(GM_igtk, GN_igtk) */ 450 kid = (ic->ic_igtk_kid == 4) ? 5 : 4; 451 k = &ic->ic_nw_keys[kid]; 452 memset(k, 0, sizeof(*k)); 453 k->k_id = kid; 454 k->k_cipher = ic->ic_bss->ni_rsngroupmgmtcipher; 455 k->k_flags = IEEE80211_KEY_IGTK | IEEE80211_KEY_TX; 456 k->k_len = 16; 457 arc4random_buf(k->k_key, k->k_len); 458 } 459 460 ieee80211_iterate_nodes(ic, ieee80211_node_gtk_rekey, ic); 461 ieee80211_iterate_nodes(ic, ieee80211_count_rekeysta, &rekeysta); 462 if (rekeysta == 0) 463 ieee80211_setkeysdone(ic); 464 } 465 466 /* 467 * The group key handshake has been completed with all associated stations. 468 */ 469 void 470 ieee80211_setkeysdone(struct ieee80211com *ic) 471 { 472 u_int8_t kid; 473 474 /* install GTK */ 475 kid = (ic->ic_def_txkey == 1) ? 2 : 1; 476 switch ((*ic->ic_set_key)(ic, ic->ic_bss, &ic->ic_nw_keys[kid])) { 477 case 0: 478 case EBUSY: 479 ic->ic_def_txkey = kid; 480 break; 481 default: 482 break; 483 } 484 485 if (ic->ic_caps & IEEE80211_C_MFP) { 486 /* install IGTK */ 487 kid = (ic->ic_igtk_kid == 4) ? 5 : 4; 488 switch ((*ic->ic_set_key)(ic, ic->ic_bss, &ic->ic_nw_keys[kid])) { 489 case 0: 490 case EBUSY: 491 ic->ic_igtk_kid = kid; 492 break; 493 default: 494 break; 495 } 496 } 497 } 498 499 /* 500 * Group key lifetime has expired, update it. 501 */ 502 void 503 ieee80211_gtk_rekey_timeout(void *arg) 504 { 505 struct ieee80211com *ic = arg; 506 int s; 507 508 s = splnet(); 509 ieee80211_setkeys(ic); 510 splx(s); 511 512 /* re-schedule a GTK rekeying after 3600s */ 513 timeout_add_sec(&ic->ic_rsn_timeout, 3600); 514 } 515 516 void 517 ieee80211_sa_query_timeout(void *arg) 518 { 519 struct ieee80211_node *ni = arg; 520 struct ieee80211com *ic = ni->ni_ic; 521 int s; 522 523 s = splnet(); 524 if (++ni->ni_sa_query_count >= 3) { 525 ni->ni_flags &= ~IEEE80211_NODE_SA_QUERY; 526 ni->ni_flags |= IEEE80211_NODE_SA_QUERY_FAILED; 527 } else /* retry SA Query Request */ 528 ieee80211_sa_query_request(ic, ni); 529 splx(s); 530 } 531 532 /* 533 * Request that a SA Query Request frame be sent to a specified peer STA 534 * to which the STA is associated. 535 */ 536 void 537 ieee80211_sa_query_request(struct ieee80211com *ic, struct ieee80211_node *ni) 538 { 539 /* MLME-SAQuery.request */ 540 541 if (!(ni->ni_flags & IEEE80211_NODE_SA_QUERY)) { 542 ni->ni_flags |= IEEE80211_NODE_SA_QUERY; 543 ni->ni_flags &= ~IEEE80211_NODE_SA_QUERY_FAILED; 544 ni->ni_sa_query_count = 0; 545 } 546 /* generate new Transaction Identifier */ 547 ni->ni_sa_query_trid++; 548 549 /* send SA Query Request */ 550 IEEE80211_SEND_ACTION(ic, ni, IEEE80211_CATEG_SA_QUERY, 551 IEEE80211_ACTION_SA_QUERY_REQ, 0); 552 timeout_add_msec(&ni->ni_sa_query_to, 10); 553 } 554 #endif /* IEEE80211_STA_ONLY */ 555 556 void 557 ieee80211_ht_negotiate(struct ieee80211com *ic, struct ieee80211_node *ni) 558 { 559 int i; 560 561 ni->ni_flags &= ~(IEEE80211_NODE_HT | IEEE80211_NODE_HT_SGI20 | 562 IEEE80211_NODE_HT_SGI40); 563 564 /* Check if we support HT. */ 565 if ((ic->ic_modecaps & (1 << IEEE80211_MODE_11N)) == 0) 566 return; 567 568 /* Check if HT support has been explicitly disabled. */ 569 if ((ic->ic_flags & IEEE80211_F_HTON) == 0) 570 return; 571 572 /* 573 * Check if the peer supports HT. 574 * Require at least one of the mandatory MCS. 575 * MCS 0-7 are mandatory but some APs have particular MCS disabled. 576 */ 577 if (!ieee80211_node_supports_ht(ni)) { 578 ic->ic_stats.is_ht_nego_no_mandatory_mcs++; 579 return; 580 } 581 582 if (ic->ic_opmode == IEEE80211_M_STA) { 583 /* We must support the AP's basic MCS set. */ 584 for (i = 0; i < IEEE80211_HT_NUM_MCS; i++) { 585 if (isset(ni->ni_basic_mcs, i) && 586 !isset(ic->ic_sup_mcs, i)) { 587 ic->ic_stats.is_ht_nego_no_basic_mcs++; 588 return; 589 } 590 } 591 } 592 593 /* 594 * Don't allow group cipher (includes WEP) or TKIP 595 * for pairwise encryption (see 802.11-2012 11.1.6). 596 */ 597 if (ic->ic_flags & IEEE80211_F_WEPON) { 598 ic->ic_stats.is_ht_nego_bad_crypto++; 599 return; 600 } 601 if ((ic->ic_flags & IEEE80211_F_RSNON) && 602 (ni->ni_rsnciphers & IEEE80211_CIPHER_USEGROUP || 603 ni->ni_rsnciphers & IEEE80211_CIPHER_TKIP)) { 604 ic->ic_stats.is_ht_nego_bad_crypto++; 605 return; 606 } 607 608 ni->ni_flags |= IEEE80211_NODE_HT; 609 610 if (ieee80211_node_supports_ht_sgi20(ni) && 611 (ic->ic_htcaps & IEEE80211_HTCAP_SGI20)) 612 ni->ni_flags |= IEEE80211_NODE_HT_SGI20; 613 if (ieee80211_node_supports_ht_sgi40(ni) && 614 (ic->ic_htcaps & IEEE80211_HTCAP_SGI40)) 615 ni->ni_flags |= IEEE80211_NODE_HT_SGI40; 616 } 617 618 void 619 ieee80211_tx_ba_timeout(void *arg) 620 { 621 struct ieee80211_tx_ba *ba = arg; 622 struct ieee80211_node *ni = ba->ba_ni; 623 struct ieee80211com *ic = ni->ni_ic; 624 u_int8_t tid; 625 int s; 626 627 s = splnet(); 628 tid = ((caddr_t)ba - (caddr_t)ni->ni_tx_ba) / sizeof(*ba); 629 if (ba->ba_state == IEEE80211_BA_REQUESTED) { 630 /* MLME-ADDBA.confirm(TIMEOUT) */ 631 ba->ba_state = IEEE80211_BA_INIT; 632 if (ni->ni_addba_req_intval[tid] < 633 IEEE80211_ADDBA_REQ_INTVAL_MAX) 634 ni->ni_addba_req_intval[tid]++; 635 /* 636 * In case the peer believes there is an existing 637 * block ack agreement with us, try to delete it. 638 */ 639 IEEE80211_SEND_ACTION(ic, ni, IEEE80211_CATEG_BA, 640 IEEE80211_ACTION_DELBA, 641 IEEE80211_REASON_SETUP_REQUIRED << 16 | 1 << 8 | tid); 642 } else if (ba->ba_state == IEEE80211_BA_AGREED) { 643 /* Block Ack inactivity timeout */ 644 ic->ic_stats.is_ht_tx_ba_timeout++; 645 ieee80211_delba_request(ic, ni, IEEE80211_REASON_TIMEOUT, 646 1, tid); 647 } 648 splx(s); 649 } 650 651 void 652 ieee80211_rx_ba_timeout(void *arg) 653 { 654 struct ieee80211_rx_ba *ba = arg; 655 struct ieee80211_node *ni = ba->ba_ni; 656 struct ieee80211com *ic = ni->ni_ic; 657 u_int8_t tid; 658 int s; 659 660 ic->ic_stats.is_ht_rx_ba_timeout++; 661 662 s = splnet(); 663 664 /* Block Ack inactivity timeout */ 665 tid = ((caddr_t)ba - (caddr_t)ni->ni_rx_ba) / sizeof(*ba); 666 ieee80211_delba_request(ic, ni, IEEE80211_REASON_TIMEOUT, 0, tid); 667 668 splx(s); 669 } 670 671 /* 672 * Request initiation of Block Ack with the specified peer. 673 */ 674 int 675 ieee80211_addba_request(struct ieee80211com *ic, struct ieee80211_node *ni, 676 u_int16_t ssn, u_int8_t tid) 677 { 678 struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid]; 679 680 if (ba->ba_state != IEEE80211_BA_INIT) 681 return EBUSY; 682 683 /* MLME-ADDBA.request */ 684 685 /* setup Block Ack */ 686 ba->ba_ni = ni; 687 ba->ba_state = IEEE80211_BA_REQUESTED; 688 ba->ba_token = ic->ic_dialog_token++; 689 ba->ba_timeout_val = 0; 690 timeout_set(&ba->ba_to, ieee80211_tx_ba_timeout, ba); 691 ba->ba_winsize = IEEE80211_BA_MAX_WINSZ; 692 ba->ba_winstart = ssn; 693 ba->ba_winend = (ba->ba_winstart + ba->ba_winsize - 1) & 0xfff; 694 ba->ba_params = 695 (ba->ba_winsize << IEEE80211_ADDBA_BUFSZ_SHIFT) | 696 (tid << IEEE80211_ADDBA_TID_SHIFT); 697 ba->ba_params |= IEEE80211_ADDBA_AMSDU; 698 if ((ic->ic_htcaps & IEEE80211_HTCAP_DELAYEDBA) == 0) 699 /* immediate BA */ 700 ba->ba_params |= IEEE80211_ADDBA_BA_POLICY; 701 702 if ((ic->ic_caps & IEEE80211_C_ADDBA_OFFLOAD) && 703 ic->ic_ampdu_tx_start != NULL) { 704 int err = ic->ic_ampdu_tx_start(ic, ni, tid); 705 if (err && err != EBUSY) { 706 /* driver failed to setup, rollback */ 707 ieee80211_addba_resp_refuse(ic, ni, tid, 708 IEEE80211_STATUS_UNSPECIFIED); 709 } else if (err == 0) 710 ieee80211_addba_resp_accept(ic, ni, tid); 711 return err; /* The device will send an ADDBA frame. */ 712 } 713 714 timeout_add_sec(&ba->ba_to, 1); /* dot11ADDBAResponseTimeout */ 715 IEEE80211_SEND_ACTION(ic, ni, IEEE80211_CATEG_BA, 716 IEEE80211_ACTION_ADDBA_REQ, tid); 717 return 0; 718 } 719 720 /* 721 * Request the deletion of Block Ack with a peer and notify driver. 722 */ 723 void 724 ieee80211_delba_request(struct ieee80211com *ic, struct ieee80211_node *ni, 725 u_int16_t reason, u_int8_t dir, u_int8_t tid) 726 { 727 /* MLME-DELBA.request */ 728 729 if (reason) { 730 /* transmit a DELBA frame */ 731 IEEE80211_SEND_ACTION(ic, ni, IEEE80211_CATEG_BA, 732 IEEE80211_ACTION_DELBA, reason << 16 | dir << 8 | tid); 733 } 734 if (dir) { 735 /* MLME-DELBA.confirm(Originator) */ 736 if (ic->ic_ampdu_tx_stop != NULL) 737 ic->ic_ampdu_tx_stop(ic, ni, tid); 738 ieee80211_node_tx_ba_clear(ni, tid); 739 } else { 740 /* MLME-DELBA.confirm(Recipient) */ 741 struct ieee80211_rx_ba *ba = &ni->ni_rx_ba[tid]; 742 int i; 743 744 if (ic->ic_ampdu_rx_stop != NULL) 745 ic->ic_ampdu_rx_stop(ic, ni, tid); 746 747 ba->ba_state = IEEE80211_BA_INIT; 748 /* stop Block Ack inactivity timer */ 749 timeout_del(&ba->ba_to); 750 timeout_del(&ba->ba_gap_to); 751 752 if (ba->ba_buf != NULL) { 753 /* free all MSDUs stored in reordering buffer */ 754 for (i = 0; i < IEEE80211_BA_MAX_WINSZ; i++) 755 m_freem(ba->ba_buf[i].m); 756 /* free reordering buffer */ 757 free(ba->ba_buf, M_DEVBUF, 758 IEEE80211_BA_MAX_WINSZ * sizeof(*ba->ba_buf)); 759 ba->ba_buf = NULL; 760 } 761 } 762 } 763 764 #ifndef IEEE80211_STA_ONLY 765 void 766 ieee80211_auth_open_confirm(struct ieee80211com *ic, 767 struct ieee80211_node *ni, uint16_t seq) 768 { 769 struct ifnet *ifp = &ic->ic_if; 770 771 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 772 if (ifp->if_flags & IFF_DEBUG) 773 printf("%s: station %s %s authenticated (open)\n", 774 ifp->if_xname, 775 ether_sprintf((u_int8_t *)ni->ni_macaddr), 776 ni->ni_state != IEEE80211_STA_CACHE ? 777 "newly" : "already"); 778 ieee80211_node_newstate(ni, IEEE80211_STA_AUTH); 779 } 780 #endif 781 782 void 783 ieee80211_try_another_bss(struct ieee80211com *ic) 784 { 785 struct ieee80211_node *curbs, *selbs; 786 struct ifnet *ifp = &ic->ic_if; 787 788 /* Don't select our current AP again. */ 789 curbs = ieee80211_find_node(ic, ic->ic_bss->ni_macaddr); 790 if (curbs) { 791 curbs->ni_fails++; 792 ieee80211_node_newstate(curbs, IEEE80211_STA_CACHE); 793 } 794 795 /* Try a different AP from the same ESS if available. */ 796 if (ic->ic_caps & IEEE80211_C_SCANALLBAND) { 797 /* 798 * Make sure we will consider APs on all bands during 799 * access point selection in ieee80211_node_choose_bss(). 800 * During multi-band scans, our previous AP may be trying 801 * to steer us onto another band by denying authentication. 802 */ 803 ieee80211_setmode(ic, IEEE80211_MODE_AUTO); 804 } 805 selbs = ieee80211_node_choose_bss(ic, 0, NULL); 806 if (selbs == NULL) 807 return; 808 809 /* Should not happen but seriously, don't try the same AP again. */ 810 if (memcmp(selbs->ni_macaddr, ic->ic_bss->ni_macaddr, 811 IEEE80211_NWID_LEN) == 0) 812 return; 813 814 if (ifp->if_flags & IFF_DEBUG) 815 printf("%s: trying AP %s on channel %d instead\n", 816 ifp->if_xname, ether_sprintf(selbs->ni_macaddr), 817 ieee80211_chan2ieee(ic, selbs->ni_chan)); 818 819 /* Triggers an AUTH->AUTH transition, avoiding another SCAN. */ 820 ieee80211_node_join_bss(ic, selbs); 821 } 822 823 void 824 ieee80211_auth_open(struct ieee80211com *ic, const struct ieee80211_frame *wh, 825 struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, u_int16_t seq, 826 u_int16_t status) 827 { 828 struct ifnet *ifp = &ic->ic_if; 829 switch (ic->ic_opmode) { 830 #ifndef IEEE80211_STA_ONLY 831 case IEEE80211_M_IBSS: 832 if (ic->ic_state != IEEE80211_S_RUN || 833 seq != IEEE80211_AUTH_OPEN_REQUEST) { 834 DPRINTF(("discard auth from %s; state %u, seq %u\n", 835 ether_sprintf((u_int8_t *)wh->i_addr2), 836 ic->ic_state, seq)); 837 ic->ic_stats.is_rx_bad_auth++; 838 return; 839 } 840 ieee80211_new_state(ic, IEEE80211_S_AUTH, 841 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 842 843 /* In IBSS mode no (re)association frames are sent. */ 844 if (ic->ic_flags & IEEE80211_F_RSNON) 845 ni->ni_rsn_supp_state = RSNA_SUPP_PTKSTART; 846 break; 847 848 case IEEE80211_M_AHDEMO: 849 /* should not come here */ 850 break; 851 852 case IEEE80211_M_HOSTAP: 853 if (ic->ic_state != IEEE80211_S_RUN || 854 seq != IEEE80211_AUTH_OPEN_REQUEST) { 855 DPRINTF(("discard auth from %s; state %u, seq %u\n", 856 ether_sprintf((u_int8_t *)wh->i_addr2), 857 ic->ic_state, seq)); 858 ic->ic_stats.is_rx_bad_auth++; 859 return; 860 } 861 if (ni == ic->ic_bss) { 862 ni = ieee80211_find_node(ic, wh->i_addr2); 863 if (ni == NULL) 864 ni = ieee80211_alloc_node(ic, wh->i_addr2); 865 if (ni == NULL) { 866 return; 867 } 868 IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid); 869 ni->ni_rssi = rxi->rxi_rssi; 870 ni->ni_rstamp = rxi->rxi_tstamp; 871 ni->ni_chan = ic->ic_bss->ni_chan; 872 } 873 874 /* 875 * Drivers may want to set up state before confirming. 876 * In which case this returns EBUSY and the driver will 877 * later call ieee80211_auth_open_confirm() by itself. 878 */ 879 if (ic->ic_newauth && ic->ic_newauth(ic, ni, 880 ni->ni_state != IEEE80211_STA_CACHE, seq) != 0) 881 break; 882 ieee80211_auth_open_confirm(ic, ni, seq); 883 break; 884 #endif /* IEEE80211_STA_ONLY */ 885 886 case IEEE80211_M_STA: 887 if (ic->ic_state != IEEE80211_S_AUTH || 888 seq != IEEE80211_AUTH_OPEN_RESPONSE) { 889 ic->ic_stats.is_rx_bad_auth++; 890 DPRINTF(("discard auth from %s; state %u, seq %u\n", 891 ether_sprintf((u_int8_t *)wh->i_addr2), 892 ic->ic_state, seq)); 893 return; 894 } 895 if (ic->ic_flags & IEEE80211_F_RSNON) { 896 /* XXX not here! */ 897 ic->ic_bss->ni_flags &= ~IEEE80211_NODE_TXRXPROT; 898 ic->ic_bss->ni_port_valid = 0; 899 ic->ic_bss->ni_replaycnt_ok = 0; 900 (*ic->ic_delete_key)(ic, ic->ic_bss, 901 &ic->ic_bss->ni_pairwise_key); 902 } 903 if (status != 0) { 904 if (ifp->if_flags & IFF_DEBUG) 905 printf("%s: open authentication failed " 906 "(status %d) for %s\n", ifp->if_xname, 907 status, 908 ether_sprintf((u_int8_t *)wh->i_addr3)); 909 if (ni != ic->ic_bss) 910 ni->ni_fails++; 911 else 912 ieee80211_try_another_bss(ic); 913 ic->ic_stats.is_rx_auth_fail++; 914 return; 915 } 916 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 917 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 918 break; 919 default: 920 break; 921 } 922 } 923 924 void 925 ieee80211_set_beacon_miss_threshold(struct ieee80211com *ic) 926 { 927 struct ifnet *ifp = &ic->ic_if; 928 929 /* 930 * Scale the missed beacon counter threshold to the AP's actual 931 * beacon interval. 932 */ 933 int btimeout = MIN(IEEE80211_BEACON_MISS_THRES * ic->ic_bss->ni_intval, 934 IEEE80211_BEACON_MISS_THRES * (IEEE80211_DUR_TU / 10)); 935 /* Ensure that at least one beacon may be missed. */ 936 btimeout = MAX(btimeout, 2 * ic->ic_bss->ni_intval); 937 if (ic->ic_bss->ni_intval > 0) /* don't crash if interval is bogus */ 938 ic->ic_bmissthres = btimeout / ic->ic_bss->ni_intval; 939 940 if (ifp->if_flags & IFF_DEBUG) 941 printf("%s: missed beacon threshold set to %d beacons, " 942 "beacon interval is %u TU\n", ifp->if_xname, 943 ic->ic_bmissthres, ic->ic_bss->ni_intval); 944 } 945 946 /* Tell our peer, and the driver, to stop A-MPDU Tx for all TIDs. */ 947 void 948 ieee80211_stop_ampdu_tx(struct ieee80211com *ic, struct ieee80211_node *ni, 949 int mgt) 950 { 951 int tid; 952 953 for (tid = 0; tid < nitems(ni->ni_tx_ba); tid++) { 954 struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid]; 955 if (ba->ba_state != IEEE80211_BA_AGREED) 956 continue; 957 958 if (ic->ic_caps & IEEE80211_C_ADDBA_OFFLOAD) { 959 if (ic->ic_ampdu_tx_stop != NULL) 960 ic->ic_ampdu_tx_stop(ic, ni, tid); 961 continue; /* Don't change ba->ba_state! */ 962 } 963 964 ieee80211_delba_request(ic, ni, 965 mgt == -1 ? 0 : IEEE80211_REASON_AUTH_LEAVE, 1, tid); 966 } 967 } 968 969 void 970 ieee80211_check_wpa_supplicant_failure(struct ieee80211com *ic, 971 struct ieee80211_node *ni) 972 { 973 struct ieee80211_node *ni2; 974 975 if (ic->ic_opmode != IEEE80211_M_STA 976 #ifndef IEEE80211_STA_ONLY 977 && ic->ic_opmode != IEEE80211_M_IBSS 978 #endif 979 ) 980 return; 981 982 if (ni->ni_rsn_supp_state != RSNA_SUPP_PTKNEGOTIATING) 983 return; 984 985 ni->ni_assoc_fail |= IEEE80211_NODE_ASSOCFAIL_WPA_KEY; 986 987 if (ni != ic->ic_bss) 988 return; 989 990 /* Also update the copy of our AP's node in the node cache. */ 991 ni2 = ieee80211_find_node(ic, ic->ic_bss->ni_macaddr); 992 if (ni2) 993 ni2->ni_assoc_fail |= ic->ic_bss->ni_assoc_fail; 994 } 995 996 int 997 ieee80211_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, 998 int mgt) 999 { 1000 struct ifnet *ifp = &ic->ic_if; 1001 struct ieee80211_node *ni; 1002 enum ieee80211_state ostate; 1003 u_int rate; 1004 #ifndef IEEE80211_STA_ONLY 1005 int s; 1006 #endif 1007 1008 ostate = ic->ic_state; 1009 if (ifp->if_flags & IFF_DEBUG) 1010 printf("%s: %s -> %s\n", ifp->if_xname, 1011 ieee80211_state_name[ostate], ieee80211_state_name[nstate]); 1012 ic->ic_state = nstate; /* state transition */ 1013 ni = ic->ic_bss; /* NB: no reference held */ 1014 ieee80211_set_link_state(ic, LINK_STATE_DOWN); 1015 ic->ic_xflags &= ~IEEE80211_F_TX_MGMT_ONLY; 1016 switch (nstate) { 1017 case IEEE80211_S_INIT: 1018 /* 1019 * If mgt = -1, driver is already partway down, so do 1020 * not send management frames. 1021 */ 1022 switch (ostate) { 1023 case IEEE80211_S_INIT: 1024 break; 1025 case IEEE80211_S_RUN: 1026 if (mgt == -1) 1027 goto justcleanup; 1028 ieee80211_stop_ampdu_tx(ic, ni, mgt); 1029 ieee80211_ba_del(ni); 1030 switch (ic->ic_opmode) { 1031 case IEEE80211_M_STA: 1032 IEEE80211_SEND_MGMT(ic, ni, 1033 IEEE80211_FC0_SUBTYPE_DISASSOC, 1034 IEEE80211_REASON_ASSOC_LEAVE); 1035 break; 1036 #ifndef IEEE80211_STA_ONLY 1037 case IEEE80211_M_HOSTAP: 1038 s = splnet(); 1039 RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree) { 1040 if (ni->ni_state != IEEE80211_STA_ASSOC) 1041 continue; 1042 IEEE80211_SEND_MGMT(ic, ni, 1043 IEEE80211_FC0_SUBTYPE_DISASSOC, 1044 IEEE80211_REASON_ASSOC_LEAVE); 1045 } 1046 splx(s); 1047 break; 1048 #endif 1049 default: 1050 break; 1051 } 1052 /* FALLTHROUGH */ 1053 case IEEE80211_S_ASSOC: 1054 if (mgt == -1) 1055 goto justcleanup; 1056 switch (ic->ic_opmode) { 1057 case IEEE80211_M_STA: 1058 IEEE80211_SEND_MGMT(ic, ni, 1059 IEEE80211_FC0_SUBTYPE_DEAUTH, 1060 IEEE80211_REASON_AUTH_LEAVE); 1061 break; 1062 #ifndef IEEE80211_STA_ONLY 1063 case IEEE80211_M_HOSTAP: 1064 s = splnet(); 1065 RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree) { 1066 IEEE80211_SEND_MGMT(ic, ni, 1067 IEEE80211_FC0_SUBTYPE_DEAUTH, 1068 IEEE80211_REASON_AUTH_LEAVE); 1069 } 1070 splx(s); 1071 break; 1072 #endif 1073 default: 1074 break; 1075 } 1076 /* FALLTHROUGH */ 1077 case IEEE80211_S_AUTH: 1078 case IEEE80211_S_SCAN: 1079 justcleanup: 1080 #ifndef IEEE80211_STA_ONLY 1081 if (ic->ic_opmode == IEEE80211_M_HOSTAP) 1082 timeout_del(&ic->ic_rsn_timeout); 1083 #endif 1084 ieee80211_ba_del(ni); 1085 timeout_del(&ic->ic_bgscan_timeout); 1086 ic->ic_bgscan_fail = 0; 1087 ic->ic_mgt_timer = 0; 1088 mq_purge(&ic->ic_mgtq); 1089 mq_purge(&ic->ic_pwrsaveq); 1090 ieee80211_free_allnodes(ic, 1); 1091 break; 1092 } 1093 ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; 1094 ni->ni_assoc_fail = 0; 1095 if (ic->ic_flags & IEEE80211_F_RSNON) 1096 ieee80211_crypto_clear_groupkeys(ic); 1097 break; 1098 case IEEE80211_S_SCAN: 1099 ic->ic_flags &= ~IEEE80211_F_SIBSS; 1100 /* initialize bss for probe request */ 1101 IEEE80211_ADDR_COPY(ni->ni_macaddr, etherbroadcastaddr); 1102 IEEE80211_ADDR_COPY(ni->ni_bssid, etherbroadcastaddr); 1103 ni->ni_rates = ic->ic_sup_rates[ 1104 ieee80211_chan2mode(ic, ni->ni_chan)]; 1105 ni->ni_associd = 0; 1106 ni->ni_rstamp = 0; 1107 ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; 1108 if (ic->ic_flags & IEEE80211_F_RSNON) 1109 ieee80211_crypto_clear_groupkeys(ic); 1110 switch (ostate) { 1111 case IEEE80211_S_INIT: 1112 #ifndef IEEE80211_STA_ONLY 1113 if (ic->ic_opmode == IEEE80211_M_HOSTAP && 1114 ic->ic_des_chan != IEEE80211_CHAN_ANYC) { 1115 /* 1116 * AP operation and we already have a channel; 1117 * bypass the scan and startup immediately. 1118 */ 1119 ieee80211_create_ibss(ic, ic->ic_des_chan); 1120 } else 1121 #endif 1122 ieee80211_begin_scan(ifp); 1123 break; 1124 case IEEE80211_S_SCAN: 1125 /* scan next */ 1126 if (ic->ic_flags & IEEE80211_F_ASCAN) { 1127 IEEE80211_SEND_MGMT(ic, ni, 1128 IEEE80211_FC0_SUBTYPE_PROBE_REQ, 0); 1129 } 1130 break; 1131 case IEEE80211_S_RUN: 1132 /* beacon miss */ 1133 if (ifp->if_flags & IFF_DEBUG) { 1134 /* XXX bssid clobbered above */ 1135 printf("%s: no recent beacons from %s;" 1136 " rescanning\n", ifp->if_xname, 1137 ether_sprintf(ic->ic_bss->ni_bssid)); 1138 } 1139 timeout_del(&ic->ic_bgscan_timeout); 1140 ic->ic_bgscan_fail = 0; 1141 ieee80211_stop_ampdu_tx(ic, ni, mgt); 1142 ieee80211_free_allnodes(ic, 1); 1143 /* FALLTHROUGH */ 1144 case IEEE80211_S_AUTH: 1145 case IEEE80211_S_ASSOC: 1146 /* timeout restart scan */ 1147 ni = ieee80211_find_node(ic, ic->ic_bss->ni_macaddr); 1148 if (ni != NULL) 1149 ni->ni_fails++; 1150 ieee80211_begin_scan(ifp); 1151 break; 1152 } 1153 break; 1154 case IEEE80211_S_AUTH: 1155 if (ostate == IEEE80211_S_RUN) 1156 ieee80211_check_wpa_supplicant_failure(ic, ni); 1157 ni->ni_rsn_supp_state = RSNA_SUPP_INITIALIZE; 1158 if (ic->ic_flags & IEEE80211_F_RSNON) 1159 ieee80211_crypto_clear_groupkeys(ic); 1160 switch (ostate) { 1161 case IEEE80211_S_INIT: 1162 if (ifp->if_flags & IFF_DEBUG) 1163 printf("%s: invalid transition %s -> %s\n", 1164 ifp->if_xname, ieee80211_state_name[ostate], 1165 ieee80211_state_name[nstate]); 1166 break; 1167 case IEEE80211_S_SCAN: 1168 IEEE80211_SEND_MGMT(ic, ni, 1169 IEEE80211_FC0_SUBTYPE_AUTH, 1); 1170 break; 1171 case IEEE80211_S_AUTH: 1172 case IEEE80211_S_ASSOC: 1173 switch (mgt) { 1174 case IEEE80211_FC0_SUBTYPE_AUTH: 1175 if (ic->ic_opmode == IEEE80211_M_STA) { 1176 IEEE80211_SEND_MGMT(ic, ni, 1177 IEEE80211_FC0_SUBTYPE_AUTH, 1178 IEEE80211_AUTH_OPEN_REQUEST); 1179 } 1180 break; 1181 case IEEE80211_FC0_SUBTYPE_DEAUTH: 1182 /* ignore and retry scan on timeout */ 1183 break; 1184 } 1185 break; 1186 case IEEE80211_S_RUN: 1187 timeout_del(&ic->ic_bgscan_timeout); 1188 ic->ic_bgscan_fail = 0; 1189 ieee80211_stop_ampdu_tx(ic, ni, mgt); 1190 ieee80211_ba_del(ni); 1191 switch (mgt) { 1192 case IEEE80211_FC0_SUBTYPE_AUTH: 1193 IEEE80211_SEND_MGMT(ic, ni, 1194 IEEE80211_FC0_SUBTYPE_AUTH, 2); 1195 ic->ic_state = ostate; /* stay RUN */ 1196 break; 1197 case IEEE80211_FC0_SUBTYPE_DEAUTH: 1198 /* try to reauth */ 1199 IEEE80211_SEND_MGMT(ic, ni, 1200 IEEE80211_FC0_SUBTYPE_AUTH, 1); 1201 break; 1202 } 1203 break; 1204 } 1205 break; 1206 case IEEE80211_S_ASSOC: 1207 switch (ostate) { 1208 case IEEE80211_S_INIT: 1209 case IEEE80211_S_SCAN: 1210 case IEEE80211_S_ASSOC: 1211 if (ifp->if_flags & IFF_DEBUG) 1212 printf("%s: invalid transition %s -> %s\n", 1213 ifp->if_xname, ieee80211_state_name[ostate], 1214 ieee80211_state_name[nstate]); 1215 break; 1216 case IEEE80211_S_AUTH: 1217 IEEE80211_SEND_MGMT(ic, ni, 1218 IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0); 1219 break; 1220 case IEEE80211_S_RUN: 1221 ieee80211_stop_ampdu_tx(ic, ni, mgt); 1222 ieee80211_ba_del(ni); 1223 IEEE80211_SEND_MGMT(ic, ni, 1224 IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 1); 1225 break; 1226 } 1227 break; 1228 case IEEE80211_S_RUN: 1229 switch (ostate) { 1230 case IEEE80211_S_INIT: 1231 if (ic->ic_opmode == IEEE80211_M_MONITOR) 1232 break; 1233 case IEEE80211_S_AUTH: 1234 case IEEE80211_S_RUN: 1235 if (ifp->if_flags & IFF_DEBUG) 1236 printf("%s: invalid transition %s -> %s\n", 1237 ifp->if_xname, ieee80211_state_name[ostate], 1238 ieee80211_state_name[nstate]); 1239 break; 1240 case IEEE80211_S_SCAN: /* adhoc/hostap mode */ 1241 case IEEE80211_S_ASSOC: /* infra mode */ 1242 if (ni->ni_txrate >= ni->ni_rates.rs_nrates) 1243 panic("%s: bogus xmit rate %u setup", 1244 __func__, ni->ni_txrate); 1245 if (ifp->if_flags & IFF_DEBUG) { 1246 printf("%s: %s with %s ssid ", 1247 ifp->if_xname, 1248 ic->ic_opmode == IEEE80211_M_STA ? 1249 "associated" : "synchronized", 1250 ether_sprintf(ni->ni_bssid)); 1251 ieee80211_print_essid(ic->ic_bss->ni_essid, 1252 ni->ni_esslen); 1253 rate = ni->ni_rates.rs_rates[ni->ni_txrate] & 1254 IEEE80211_RATE_VAL; 1255 printf(" channel %d", 1256 ieee80211_chan2ieee(ic, ni->ni_chan)); 1257 if (ni->ni_flags & IEEE80211_NODE_HT) 1258 printf(" start MCS %u", ni->ni_txmcs); 1259 else 1260 printf(" start %u%sMb", 1261 rate / 2, (rate & 1) ? ".5" : ""); 1262 printf(" %s preamble %s slot time%s%s\n", 1263 (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ? 1264 "short" : "long", 1265 (ic->ic_flags & IEEE80211_F_SHSLOT) ? 1266 "short" : "long", 1267 (ic->ic_flags & IEEE80211_F_USEPROT) ? 1268 " protection enabled" : "", 1269 (ni->ni_flags & IEEE80211_NODE_HT) ? 1270 " HT enabled" : ""); 1271 } 1272 if (!(ic->ic_flags & IEEE80211_F_RSNON)) { 1273 /* 1274 * NB: When RSN is enabled, we defer setting 1275 * the link up until the port is valid. 1276 */ 1277 ieee80211_set_link_state(ic, LINK_STATE_UP); 1278 ni->ni_assoc_fail = 0; 1279 } 1280 ic->ic_mgt_timer = 0; 1281 ieee80211_set_beacon_miss_threshold(ic); 1282 if_start(ifp); 1283 break; 1284 } 1285 break; 1286 } 1287 return 0; 1288 } 1289 1290 void 1291 ieee80211_rtm_80211info_task(void *arg) 1292 { 1293 struct ieee80211com *ic = arg; 1294 struct ifnet *ifp = &ic->ic_if; 1295 struct if_ieee80211_data ifie; 1296 int s = splnet(); 1297 1298 if (LINK_STATE_IS_UP(ifp->if_link_state)) { 1299 memset(&ifie, 0, sizeof(ifie)); 1300 ifie.ifie_nwid_len = ic->ic_bss->ni_esslen; 1301 memcpy(ifie.ifie_nwid, ic->ic_bss->ni_essid, 1302 sizeof(ifie.ifie_nwid)); 1303 memcpy(ifie.ifie_addr, ic->ic_bss->ni_bssid, 1304 sizeof(ifie.ifie_addr)); 1305 ifie.ifie_channel = ieee80211_chan2ieee(ic, 1306 ic->ic_bss->ni_chan); 1307 ifie.ifie_flags = ic->ic_flags; 1308 ifie.ifie_xflags = ic->ic_xflags; 1309 rtm_80211info(&ic->ic_if, &ifie); 1310 } 1311 1312 splx(s); 1313 } 1314 1315 void 1316 ieee80211_set_link_state(struct ieee80211com *ic, int nstate) 1317 { 1318 struct ifnet *ifp = &ic->ic_if; 1319 1320 switch (ic->ic_opmode) { 1321 #ifndef IEEE80211_STA_ONLY 1322 case IEEE80211_M_IBSS: 1323 case IEEE80211_M_HOSTAP: 1324 nstate = LINK_STATE_UNKNOWN; 1325 break; 1326 #endif 1327 case IEEE80211_M_MONITOR: 1328 nstate = LINK_STATE_DOWN; 1329 break; 1330 default: 1331 break; 1332 } 1333 if (nstate != ifp->if_link_state) { 1334 ifp->if_link_state = nstate; 1335 if (LINK_STATE_IS_UP(nstate)) 1336 task_add(systq, &ic->ic_rtm_80211info_task); 1337 if_link_state_change(ifp); 1338 } 1339 } 1340