xref: /openbsd-src/usr.sbin/tcpdump/print-802_11.c (revision d59bb9942320b767f2a19aaa7690c8c6e30b724c)
1 /*	$OpenBSD: print-802_11.c,v 1.39 2017/03/04 17:51:20 stsp Exp $	*/
2 
3 /*
4  * Copyright (c) 2005 Reyk Floeter <reyk@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include <sys/time.h>
20 #include <sys/socket.h>
21 #include <sys/file.h>
22 #include <sys/ioctl.h>
23 
24 #include <net/if.h>
25 
26 #include <netinet/in.h>
27 #include <netinet/if_ether.h>
28 
29 #include <net80211/ieee80211.h>
30 #include <net80211/ieee80211_radiotap.h>
31 
32 #include <ctype.h>
33 #include <pcap.h>
34 #include <stdio.h>
35 #include <string.h>
36 
37 #include "addrtoname.h"
38 #include "interface.h"
39 
40 const char *ieee80211_ctl_subtype_name[] = {
41 	"reserved#0",
42 	"reserved#1",
43 	"reserved#2",
44 	"reserved#3",
45 	"reserved#4",
46 	"reserved#5",
47 	"reserved#6",
48 	"wrapper",
49 	"block ack request",
50 	"block ack",
51 	"ps poll",
52 	"rts",
53 	"cts",
54 	"ack",
55 	"cf-end",
56 	"cf-end-ack",
57 };
58 
59 const char *ieee80211_mgt_subtype_name[] = {
60 	"association request",
61 	"association response",
62 	"reassociation request",
63 	"reassociation response",
64 	"probe request",
65 	"probe response",
66 	"reserved#6",
67 	"reserved#7",
68 	"beacon",
69 	"atim",
70 	"disassociation",
71 	"authentication",
72 	"deauthentication",
73 	"action",
74 	"action noack",
75 	"reserved#15"
76 };
77 
78 const char *ieee80211_data_subtype_name[] = {
79 	"data",
80 	"data cf ack",
81 	"data cf poll",
82 	"data cf poll ack",
83 	"no-data",
84 	"no-data cf poll",
85 	"no-data cf ack",
86 	"no-data cf poll ack",
87 	"QoS data",
88 	"QoS data cf ack",
89 	"QoS data cf poll",
90 	"QoS data cf poll ack",
91 	"QoS no-data",
92 	"QoS no-data cf poll",
93 	"QoS no-data cf ack",
94 	"QoS no-data cf poll ack"
95 };
96 
97 int	 ieee80211_hdr(struct ieee80211_frame *);
98 int	 ieee80211_data(struct ieee80211_frame *, u_int);
99 void	 ieee80211_print_element(u_int8_t *, u_int);
100 void	 ieee80211_print_essid(u_int8_t *, u_int);
101 void	 ieee80211_print_country(u_int8_t *, u_int);
102 void	 ieee80211_print_htcaps(u_int8_t *, u_int);
103 void	 ieee80211_print_htop(u_int8_t *, u_int);
104 int	 ieee80211_print_beacon(struct ieee80211_frame *, u_int);
105 int	 ieee80211_print_assocreq(struct ieee80211_frame *, u_int);
106 int	 ieee80211_print_elements(uint8_t *);
107 int	 ieee80211_frame(struct ieee80211_frame *, u_int);
108 int	 ieee80211_print(struct ieee80211_frame *, u_int);
109 u_int	 ieee80211_any2ieee(u_int, u_int);
110 void	 ieee80211_reason(u_int16_t);
111 
112 #define TCARR(a)	TCHECK2(*a, sizeof(a))
113 
114 int ieee80211_encap = 0;
115 
116 int
117 ieee80211_hdr(struct ieee80211_frame *wh)
118 {
119 	struct ieee80211_frame_addr4 *w4;
120 
121 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
122 	case IEEE80211_FC1_DIR_NODS:
123 		TCARR(wh->i_addr2);
124 		printf("%s", etheraddr_string(wh->i_addr2));
125 		TCARR(wh->i_addr1);
126 		printf(" > %s", etheraddr_string(wh->i_addr1));
127 		TCARR(wh->i_addr3);
128 		printf(", bssid %s", etheraddr_string(wh->i_addr3));
129 		break;
130 	case IEEE80211_FC1_DIR_TODS:
131 		TCARR(wh->i_addr2);
132 		printf("%s", etheraddr_string(wh->i_addr2));
133 		TCARR(wh->i_addr3);
134 		printf(" > %s", etheraddr_string(wh->i_addr3));
135 		TCARR(wh->i_addr1);
136 		printf(", bssid %s, > DS", etheraddr_string(wh->i_addr1));
137 		break;
138 	case IEEE80211_FC1_DIR_FROMDS:
139 		TCARR(wh->i_addr3);
140 		printf("%s", etheraddr_string(wh->i_addr3));
141 		TCARR(wh->i_addr1);
142 		printf(" > %s", etheraddr_string(wh->i_addr1));
143 		TCARR(wh->i_addr2);
144 		printf(", bssid %s, DS >", etheraddr_string(wh->i_addr2));
145 		break;
146 	case IEEE80211_FC1_DIR_DSTODS:
147 		w4 = (struct ieee80211_frame_addr4 *) wh;
148 		TCARR(w4->i_addr4);
149 		printf("%s", etheraddr_string(w4->i_addr4));
150 		TCARR(w4->i_addr3);
151 		printf(" > %s", etheraddr_string(w4->i_addr3));
152 		TCARR(w4->i_addr2);
153 		printf(", bssid %s", etheraddr_string(w4->i_addr2));
154 		TCARR(w4->i_addr1);
155 		printf(" > %s, DS > DS", etheraddr_string(w4->i_addr1));
156 		break;
157 	}
158 	if (vflag) {
159 		u_int16_t seq;
160 		TCARR(wh->i_seq);
161 		bcopy(wh->i_seq, &seq, sizeof(u_int16_t));
162 		printf(" (seq %u): ", letoh16(seq));
163 	} else
164 		printf(": ");
165 
166 	return (0);
167 
168  trunc:
169 	/* Truncated elements in frame */
170 	return (1);
171 }
172 
173 int
174 ieee80211_data(struct ieee80211_frame *wh, u_int len)
175 {
176 	u_int8_t *t = (u_int8_t *)wh;
177 	u_int datalen;
178 	int data = !(wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_NODATA);
179 	int hasqos = ((wh->i_fc[0] &
180 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_QOS)) ==
181 	    (IEEE80211_FC0_TYPE_DATA | IEEE80211_FC0_SUBTYPE_QOS));
182 	u_char *esrc = NULL, *edst = NULL;
183 
184 	if (hasqos) {
185 		struct ieee80211_qosframe *wq;
186 
187 		wq = (struct ieee80211_qosframe *) wh;
188 		TCHECK(*wq);
189 		t += sizeof(*wq);
190 		datalen = len - sizeof(*wq);
191 	} else {
192 		TCHECK(*wh);
193 		t += sizeof(*wh);
194 		datalen = len - sizeof(*wh);
195 	}
196 
197 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
198 	case IEEE80211_FC1_DIR_TODS:
199 		esrc = wh->i_addr2;
200 		edst = wh->i_addr3;
201 		break;
202 	case IEEE80211_FC1_DIR_FROMDS:
203 		esrc = wh->i_addr3;
204 		edst = wh->i_addr1;
205 		break;
206 	case IEEE80211_FC1_DIR_NODS:
207 		esrc = wh->i_addr2;
208 		edst = wh->i_addr1;
209 		break;
210 	case IEEE80211_FC1_DIR_DSTODS:
211 		if (hasqos) {
212 			struct ieee80211_qosframe_addr4 *w4;
213 
214 			w4 = (struct ieee80211_qosframe_addr4 *) wh;
215 			TCHECK(*w4);
216 			t = (u_int8_t *) (w4 + 1);
217 			datalen = len - sizeof(*w4);
218 			esrc = w4->i_addr4;
219 			edst = w4->i_addr3;
220 		} else {
221 			struct ieee80211_frame_addr4 *w4;
222 
223 			w4 = (struct ieee80211_frame_addr4 *) wh;
224 			TCHECK(*w4);
225 			t = (u_int8_t *) (w4 + 1);
226 			datalen = len - sizeof(*w4);
227 			esrc = w4->i_addr4;
228 			edst = w4->i_addr3;
229 		}
230 		break;
231 	}
232 
233 	if (data && esrc)
234 		llc_print(t, datalen, datalen, esrc, edst);
235 	else if (eflag && esrc)
236 		printf("%s > %s",
237 		    etheraddr_string(esrc), etheraddr_string(edst));
238 
239 	return (0);
240 
241  trunc:
242 	/* Truncated elements in frame */
243 	return (1);
244 }
245 
246 /* Caller checks len */
247 void
248 ieee80211_print_element(u_int8_t *data, u_int len)
249 {
250 	u_int8_t *p;
251 	int i;
252 
253 	printf(" 0x");
254 	for (i = 0, p = data; i < len; i++, p++)
255 		printf("%02x", *p);
256 }
257 
258 /* Caller checks len */
259 void
260 ieee80211_print_essid(u_int8_t *essid, u_int len)
261 {
262 	u_int8_t *p;
263 	int i;
264 
265 	if (len > IEEE80211_NWID_LEN)
266 		len = IEEE80211_NWID_LEN;
267 
268 	/* determine printable or not */
269 	for (i = 0, p = essid; i < len; i++, p++) {
270 		if (*p < ' ' || *p > 0x7e)
271 			break;
272 	}
273 	if (i == len) {
274 		printf(" (");
275 		for (i = 0, p = essid; i < len; i++, p++)
276 			putchar(*p);
277 		putchar(')');
278 	} else
279 		ieee80211_print_element(essid, len);
280 }
281 
282 /* Caller checks len */
283 void
284 ieee80211_print_country(u_int8_t *data, u_int len)
285 {
286 	u_int8_t first_chan, nchan, maxpower;
287 
288 	if (len < 6)
289 		return;
290 
291 	/* country string */
292 	printf((isprint(data[0]) ? " '%c" : " '\\%03o"), data[0]);
293 	printf((isprint(data[1]) ? "%c" : "\\%03o"), data[1]);
294 	printf((isprint(data[2]) ? "%c'" : "\\%03o'"), data[2]);
295 
296 	len -= 3;
297 	data += 3;
298 
299 	/* channels and corresponding TX power limits */
300 	while (len >= 3) {
301 		/* no pretty-printing for nonsensical zero values,
302 		 * nor for operating extension IDs (values >= 201) */
303 		if (data[0] == 0 || data[1] == 0 ||
304 		    data[0] >= 201 || data[1] >= 201) {
305 			printf(", %d %d %d", data[0], data[1], data[2]);
306 			len -= 3;
307 			data += 3;
308 			continue;
309 		}
310 
311 		first_chan = data[0];
312 		nchan = data[1];
313 		maxpower = data[2];
314 
315 		printf(", channel%s %d", nchan == 1 ? "" : "s", first_chan);
316 		if (nchan > 1)
317 			printf("-%d", first_chan + nchan - 1);
318 		printf(" limit %ddB", maxpower);
319 
320 		len -= 3;
321 		data += 3;
322 	}
323 }
324 
325 /* Caller checks len */
326 void
327 ieee80211_print_htcaps(u_int8_t *data, u_int len)
328 {
329 	uint16_t htcaps, rxrate;
330 	int smps, rxstbc;
331 	uint8_t ampdu, txmcs;
332 	int i;
333 	uint8_t *rxmcs;
334 
335 	if (len < 2) {
336 		ieee80211_print_element(data, len);
337 		return;
338 	}
339 
340 	htcaps = (data[0]) | (data[1] << 8);
341 	printf("=<");
342 
343 	/* channel width */
344 	if (htcaps & IEEE80211_HTCAP_CBW20_40)
345 		printf("20/40MHz");
346 	else
347 		printf("20MHz");
348 
349 	/* LDPC coding */
350 	if (htcaps & IEEE80211_HTCAP_LDPC)
351 		printf(",LDPC");
352 
353 	/* spatial multiplexing power save mode */
354 	smps = (htcaps & IEEE80211_HTCAP_SMPS_MASK)
355 	    >> IEEE80211_HTCAP_SMPS_SHIFT;
356 	if (smps == 0)
357 		printf(",SMPS static");
358 	else if (smps == 1)
359 		printf(",SMPS dynamic");
360 
361 	/* 11n greenfield mode */
362 	if (htcaps & IEEE80211_HTCAP_GF)
363 		printf(",greenfield");
364 
365 	/* short guard interval */
366 	if (htcaps & IEEE80211_HTCAP_SGI20)
367 		printf(",SGI@20MHz");
368 	if (htcaps & IEEE80211_HTCAP_SGI40)
369 		printf(",SGI@40MHz");
370 
371 	/* space-time block coding */
372 	if (htcaps & IEEE80211_HTCAP_TXSTBC)
373 		printf(",TXSTBC");
374 	rxstbc = (htcaps & IEEE80211_HTCAP_RXSTBC_MASK)
375 	    >> IEEE80211_HTCAP_RXSTBC_SHIFT;
376 	if (rxstbc > 0 && rxstbc < 4)
377 		printf(",RXSTBC %d stream", rxstbc);
378 
379 	/* delayed block-ack */
380 	if (htcaps & IEEE80211_HTCAP_DELAYEDBA)
381 		printf(",delayed BA");
382 
383 	/* max A-MSDU length */
384 	if (htcaps & IEEE80211_HTCAP_AMSDU7935)
385 		printf(",A-MSDU 7935");
386 	else
387 		printf(",A-MSDU 3839");
388 
389 	/* DSSS/CCK in 40MHz mode */
390 	if (htcaps & IEEE80211_HTCAP_DSSSCCK40)
391 		printf(",DSSS/CCK@40MHz");
392 
393 	/* 40MHz intolerant */
394 	if (htcaps & IEEE80211_HTCAP_40INTOLERANT)
395 		printf(",40MHz intolerant");
396 
397 	/* L-SIG TXOP protection */
398 	if (htcaps & IEEE80211_HTCAP_LSIGTXOPPROT)
399 		printf(",L-SIG TXOP prot");
400 
401 	if (len < 3) {
402 		printf(">");
403 		return;
404 	}
405 
406 	/* A-MPDU parameters. */
407 	ampdu = data[2];
408 
409 	/* A-MPDU length exponent */
410 	if ((ampdu & IEEE80211_AMPDU_PARAM_LE) >= 0 &&
411 	    (ampdu & IEEE80211_AMPDU_PARAM_LE) <= 3)
412 		printf(",A-MPDU max %d",
413 		    (1 << (13 + (ampdu & IEEE80211_AMPDU_PARAM_LE))) - 1);
414 
415 	/* A-MPDU start spacing */
416 	if (ampdu & IEEE80211_AMPDU_PARAM_SS) {
417 		float ss;
418 
419 		switch ((ampdu & IEEE80211_AMPDU_PARAM_SS) >> 2) {
420 		case 1:
421 			ss = 0.25;
422 			break;
423 		case 2:
424 			ss = 0.5;
425 			break;
426 		case 3:
427 			ss = 1;
428 			break;
429 		case 4:
430 			ss = 2;
431 			break;
432 		case 5:
433 			ss = 4;
434 			break;
435 		case 6:
436 			ss = 8;
437 			break;
438 		case 7:
439 			ss = 16;
440 			break;
441 		default:
442 			ss = 0;
443 			break;
444 		}
445 		if (ss != 0)
446 			printf(",A-MPDU spacing %.2fus", ss);
447 	}
448 
449 	if (len < 21) {
450 		printf(">");
451 		return;
452 	}
453 
454 	/* Supported MCS set. */
455 	printf(",RxMCS 0x");
456 	rxmcs = &data[3];
457 	for (i = 0; i < 10; i++)
458 		printf("%02x", rxmcs[i]);
459 
460 	/* Max MCS Rx rate (a value of 0 means "not specified"). */
461 	rxrate = ((data[13] | (data[14]) << 8) & IEEE80211_MCS_RX_RATE_HIGH);
462 	if (rxrate)
463 		printf(",RxMaxrate %huMb/s", rxrate);
464 
465 	/* Tx MCS Set */
466 	txmcs = data[15];
467 	if (txmcs & IEEE80211_TX_MCS_SET_DEFINED) {
468 		if (txmcs & IEEE80211_TX_RX_MCS_NOT_EQUAL) {
469 			/* Number of spatial Tx streams. */
470 			printf(",%d Tx streams",
471 			     1 + ((txmcs & IEEE80211_TX_SPATIAL_STREAMS) >> 2));
472 			/* Transmit unequal modulation supported. */
473 			if (txmcs & IEEE80211_TX_UNEQUAL_MODULATION)
474 				printf(",UEQM");
475 		}
476 	}
477 
478 	printf(">");
479 }
480 
481 /* Caller checks len */
482 void
483 ieee80211_print_htop(u_int8_t *data, u_int len)
484 {
485 	u_int8_t primary_chan;
486 	u_int8_t htopinfo[5];
487 	u_int8_t basic_mcs[16];
488 	int sco, htprot, i;
489 
490 	if (len < sizeof(primary_chan) + sizeof(htopinfo) + sizeof(basic_mcs)) {
491 		ieee80211_print_element(data, len);
492 		return;
493 	}
494 
495 	htopinfo[0] = data[1];
496 
497 	printf("=<");
498 
499 	/* primary channel and secondary channel offset */
500 	primary_chan = data[0];
501 	sco = ((htopinfo[0] & IEEE80211_HTOP0_SCO_MASK)
502 	    >> IEEE80211_HTOP0_SCO_SHIFT);
503 	if (sco == 0) /* no secondary channel */
504 		printf("20MHz chan %d", primary_chan);
505 	else if (sco == 1) { /* secondary channel above */
506 		if (primary_chan >= 1 && primary_chan <= 13) /* 2GHz */
507 			printf("40MHz chan %d:%d", primary_chan,
508 			    primary_chan + 1);
509 		else if (primary_chan >= 34) /* 5GHz */
510 			printf("40MHz chan %d:%d", primary_chan,
511 			    primary_chan + 4);
512 		else
513 			printf("[invalid 40MHz chan %d+]", primary_chan);
514 	} else if (sco == 3) { /* secondary channel below */
515 		if (primary_chan >= 2 && primary_chan <= 14) /* 2GHz */
516 			printf("40MHz chan %d:%d", primary_chan,
517 			    primary_chan - 1);
518 		else if (primary_chan >= 40) /* 5GHz */
519 			printf("40MHz chan %d:%d", primary_chan,
520 			    primary_chan - 4);
521 		else
522 			printf("[invalid 40MHz chan %d-]", primary_chan);
523 	} else
524 		printf("chan %d [invalid secondary channel offset %d]",
525 		    primary_chan, sco);
526 
527 	/* STA channel width */
528 	if ((htopinfo[0] & IEEE80211_HTOP0_CHW) == 0)
529 		printf(",STA chanw 20MHz");
530 
531 	/* reduced interframe space (RIFS) permitted */
532 	if (htopinfo[0] & IEEE80211_HTOP0_RIFS)
533 		printf(",RIFS");
534 
535 	htopinfo[1] = data[2];
536 
537 	/* protection requirements for HT transmissions */
538 	htprot = ((htopinfo[1] & IEEE80211_HTOP1_PROT_MASK)
539 	    >> IEEE80211_HTOP1_PROT_SHIFT);
540 	switch (htprot) {
541 	case IEEE80211_HTPROT_NONE:
542 		printf(",htprot none");
543 		break;
544 	case IEEE80211_HTPROT_NONMEMBER:
545 		printf(",htprot non-member");
546 		break;
547 	case IEEE80211_HTPROT_20MHZ:
548 		printf(",htprot 20MHz");
549 		break;
550 	case IEEE80211_HTPROT_NONHT_MIXED:
551 		printf(",htprot non-HT-mixed");
552 		break;
553 	default:
554 		printf(",htprot %d", htprot);
555 		break;
556 	}
557 
558 	/* non-greenfield STA present */
559 	if (htopinfo[1] & IEEE80211_HTOP1_NONGF_STA)
560 		printf(",non-greenfield STA");
561 
562 	/* non-HT STA present */
563 	if (htopinfo[1] & IEEE80211_HTOP1_OBSS_NONHT_STA)
564 		printf(",non-HT STA");
565 
566 	htopinfo[3] = data[4];
567 
568 	/* dual-beacon */
569 	if (htopinfo[3] & IEEE80211_HTOP2_DUALBEACON)
570 		printf(",dualbeacon");
571 
572 	/* dual CTS protection */
573 	if (htopinfo[3] & IEEE80211_HTOP2_DUALCTSPROT)
574 		printf(",dualctsprot");
575 
576 	htopinfo[4] = data[5];
577 
578 	/* space-time block coding (STBC) beacon */
579 	if ((htopinfo[4] << 8) & IEEE80211_HTOP2_STBCBEACON)
580 		printf(",STBC beacon");
581 
582 	/* L-SIG (non-HT signal field) TX opportunity (TXOP) protection */
583 	if ((htopinfo[4] << 8) & IEEE80211_HTOP2_LSIGTXOP)
584 		printf(",lsigtxprot");
585 
586 	/* phased-coexistence operation (PCO) active */
587 	if ((htopinfo[4] << 8) & IEEE80211_HTOP2_PCOACTIVE) {
588 		/* PCO phase */
589 		if ((htopinfo[4] << 8) & IEEE80211_HTOP2_PCOPHASE40)
590 			printf(",pco40MHz");
591 		else
592 			printf(",pco20MHz");
593 	}
594 
595 	/* basic MCS set */
596 	memcpy(basic_mcs, &data[6], sizeof(basic_mcs));
597 	printf(",basic MCS set 0x");
598 	for (i = 0; i < sizeof(basic_mcs) / sizeof(basic_mcs[0]); i++)
599 			printf("%x", basic_mcs[i]);
600 
601 	printf(">");
602 }
603 
604 int
605 ieee80211_print_beacon(struct ieee80211_frame *wh, u_int len)
606 {
607 	uint64_t tstamp;
608 	uint16_t bintval, capinfo;
609 	uint8_t *frm;
610 
611 	if (len < sizeof(tstamp) + sizeof(bintval) + sizeof(capinfo))
612 		return 1; /* truncated */
613 
614 	frm = (u_int8_t *)&wh[1];
615 
616 	bcopy(frm, &tstamp, sizeof(u_int64_t));
617 	frm += 8;
618 	if (vflag > 1)
619 		printf(", timestamp %llu", letoh64(tstamp));
620 
621 	bcopy(frm, &bintval, sizeof(u_int16_t));
622 	frm += 2;
623 	if (vflag > 1)
624 		printf(", interval %u", letoh16(bintval));
625 
626 	bcopy(frm, &capinfo, sizeof(u_int16_t));
627 	frm += 2;
628 	if (vflag)
629 		printb(", caps", letoh16(capinfo), IEEE80211_CAPINFO_BITS);
630 
631 	return ieee80211_print_elements(frm);
632 }
633 
634 int
635 ieee80211_print_assocreq(struct ieee80211_frame *wh, u_int len)
636 {
637 	uint8_t subtype;
638 	uint16_t capinfo, lintval;
639 	uint8_t *frm;
640 
641 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
642 
643 	if (len < sizeof(capinfo) + sizeof(lintval) +
644 	    (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ ?
645 	    IEEE80211_ADDR_LEN : 0))
646 		return 1; /* truncated */
647 
648 	frm = (u_int8_t *)&wh[1];
649 
650 	bcopy(frm, &capinfo, sizeof(u_int16_t));
651 	frm += 2;
652 	if (vflag)
653 		printb(", caps", letoh16(capinfo), IEEE80211_CAPINFO_BITS);
654 
655 	bcopy(frm, &lintval, sizeof(u_int16_t));
656 	frm += 2;
657 	if (vflag > 1)
658 		printf(", listen interval %u", letoh16(lintval));
659 
660 	if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
661 		if (vflag)
662 			printf(", AP %s", etheraddr_string(frm));
663 		frm += IEEE80211_ADDR_LEN;
664 	}
665 
666 	return ieee80211_print_elements(frm);
667 }
668 
669 int
670 ieee80211_print_elements(uint8_t *frm)
671 {
672 	int i;
673 
674 	while (TTEST2(*frm, 2)) {
675 		u_int len = frm[1];
676 		u_int8_t *data = frm + 2;
677 
678 		if (!TTEST2(*data, len))
679 			break;
680 
681 #define ELEM_CHECK(l)	if (len != l) goto trunc
682 
683 		switch (*frm) {
684 		case IEEE80211_ELEMID_SSID:
685 			printf(", ssid");
686 			ieee80211_print_essid(data, len);
687 			break;
688 		case IEEE80211_ELEMID_RATES:
689 			printf(", rates");
690 			if (!vflag)
691 				break;
692 			for (i = len; i > 0; i--, data++)
693 				printf(" %uM%s",
694 				    (data[0] & IEEE80211_RATE_VAL) / 2,
695 				    (data[0] & IEEE80211_RATE_BASIC
696 				    ? "*" : ""));
697 			break;
698 		case IEEE80211_ELEMID_FHPARMS:
699 			ELEM_CHECK(5);
700 			printf(", fh (dwell %u, chan %u, index %u)",
701 			    (data[1] << 8) | data[0],
702 			    (data[2] - 1) * 80 + data[3],	/* FH_CHAN */
703 			    data[4]);
704 			break;
705 		case IEEE80211_ELEMID_DSPARMS:
706 			ELEM_CHECK(1);
707 			printf(", ds");
708 			if (vflag)
709 				printf(" (chan %u)", data[0]);
710 			break;
711 		case IEEE80211_ELEMID_CFPARMS:
712 			printf(", cf");
713 			if (vflag)
714 				ieee80211_print_element(data, len);
715 			break;
716 		case IEEE80211_ELEMID_TIM:
717 			printf(", tim");
718 			if (vflag)
719 				ieee80211_print_element(data, len);
720 			break;
721 		case IEEE80211_ELEMID_IBSSPARMS:
722 			printf(", ibss");
723 			if (vflag)
724 				ieee80211_print_element(data, len);
725 			break;
726 		case IEEE80211_ELEMID_COUNTRY:
727 			printf(", country");
728 			if (vflag)
729 				ieee80211_print_country(data, len);
730 			break;
731 		case IEEE80211_ELEMID_CHALLENGE:
732 			printf(", challenge");
733 			if (vflag)
734 				ieee80211_print_element(data, len);
735 			break;
736 		case IEEE80211_ELEMID_CSA:
737 			ELEM_CHECK(3);
738 			printf(", csa (chan %u count %u%s)", data[1], data[2],
739 			    (data[0] == 1) ? " noTX" : "");
740 			break;
741 		case IEEE80211_ELEMID_ERP:
742 			printf(", erp");
743 			if (vflag)
744 				ieee80211_print_element(data, len);
745 			break;
746 		case IEEE80211_ELEMID_RSN:
747 			printf(", rsn");
748 			if (vflag)
749 				ieee80211_print_element(data, len);
750 			break;
751 		case IEEE80211_ELEMID_XRATES:
752 			printf(", xrates");
753 			if (!vflag)
754 				break;
755 			for (i = len; i > 0; i--, data++)
756 				printf(" %uM",
757 				    (data[0] & IEEE80211_RATE_VAL) / 2);
758 			break;
759 		case IEEE80211_ELEMID_TPC_REPORT:
760 			printf(", tpcreport");
761 			if (vflag)
762 				ieee80211_print_element(data, len);
763 			break;
764 		case IEEE80211_ELEMID_TPC_REQUEST:
765 			printf(", tpcrequest");
766 			if (vflag)
767 				ieee80211_print_element(data, len);
768 			break;
769 		case IEEE80211_ELEMID_HTCAPS:
770 			printf(", htcaps");
771 			if (vflag)
772 				ieee80211_print_htcaps(data, len);
773 			break;
774 		case IEEE80211_ELEMID_HTOP:
775 			printf(", htop");
776 			if (vflag)
777 				ieee80211_print_htop(data, len);
778 			break;
779 		case IEEE80211_ELEMID_POWER_CONSTRAINT:
780 			ELEM_CHECK(1);
781 			printf(", power constraint %udB", data[0]);
782 			break;
783 		case IEEE80211_ELEMID_QBSS_LOAD:
784 			ELEM_CHECK(5);
785 			printf(", %u stations, %d%% utilization, "
786 			    "admission capacity %uus/s",
787 			    (data[0] | data[1] << 8),
788 			    (data[2] * 100) / 255,
789 			    (data[3] | data[4] << 8) / 32);
790 			break;
791 		case IEEE80211_ELEMID_VENDOR:
792 			printf(", vendor");
793 			if (vflag)
794 				ieee80211_print_element(data, len);
795 			break;
796 		default:
797 			printf(", %u:%u", (u_int) *frm, len);
798 			if (vflag)
799 				ieee80211_print_element(data, len);
800 			break;
801 		}
802 		frm += len + 2;
803 
804 		if (frm >= snapend)
805 			break;
806 	}
807 
808 #undef ELEM_CHECK
809 
810 	return (0);
811 
812  trunc:
813 	/* Truncated elements in frame */
814 	return (1);
815 }
816 
817 int
818 ieee80211_frame(struct ieee80211_frame *wh, u_int len)
819 {
820 	u_int8_t subtype, type, *frm;
821 
822 	TCARR(wh->i_fc);
823 
824 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
825 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
826 
827 	frm = (u_int8_t *)&wh[1];
828 
829 	if (vflag)
830 		printb(" flags", wh->i_fc[1], IEEE80211_FC1_BITS);
831 
832 	switch (type) {
833 	case IEEE80211_FC0_TYPE_DATA:
834 		printf(": %s: ", ieee80211_data_subtype_name[
835 		    subtype >> IEEE80211_FC0_SUBTYPE_SHIFT]);
836 		ieee80211_data(wh, len);
837 		break;
838 	case IEEE80211_FC0_TYPE_MGT:
839 		printf(": %s", ieee80211_mgt_subtype_name[
840 		    subtype >> IEEE80211_FC0_SUBTYPE_SHIFT]);
841 		switch (subtype) {
842 		case IEEE80211_FC0_SUBTYPE_BEACON:
843 		case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
844 			if (ieee80211_print_beacon(wh, len) != 0)
845 				goto trunc;
846 			break;
847 		case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
848 		case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
849 			if (ieee80211_print_assocreq(wh, len) != 0)
850 				goto trunc;
851 			break;
852 		case IEEE80211_FC0_SUBTYPE_AUTH:
853 			TCHECK2(*frm, 2);		/* Auth Algorithm */
854 			switch (IEEE80211_AUTH_ALGORITHM(frm)) {
855 			case IEEE80211_AUTH_ALG_OPEN:
856 				TCHECK2(*frm, 4);	/* Auth Transaction */
857 				switch (IEEE80211_AUTH_TRANSACTION(frm)) {
858 				case IEEE80211_AUTH_OPEN_REQUEST:
859 					printf(" request");
860 					break;
861 				case IEEE80211_AUTH_OPEN_RESPONSE:
862 					printf(" response");
863 					break;
864 				}
865 				break;
866 			case IEEE80211_AUTH_ALG_SHARED:
867 				TCHECK2(*frm, 4);	/* Auth Transaction */
868 				switch (IEEE80211_AUTH_TRANSACTION(frm)) {
869 				case IEEE80211_AUTH_SHARED_REQUEST:
870 					printf(" request");
871 					break;
872 				case IEEE80211_AUTH_SHARED_CHALLENGE:
873 					printf(" challenge");
874 					break;
875 				case IEEE80211_AUTH_SHARED_RESPONSE:
876 					printf(" response");
877 					break;
878 				case IEEE80211_AUTH_SHARED_PASS:
879 					printf(" pass");
880 					break;
881 				}
882 				break;
883 			case IEEE80211_AUTH_ALG_LEAP:
884 				printf(" (leap)");
885 				break;
886 			}
887 			break;
888 		case IEEE80211_FC0_SUBTYPE_DEAUTH:
889 		case IEEE80211_FC0_SUBTYPE_DISASSOC:
890 			TCHECK2(*frm, 2);		/* Reason Code */
891 			ieee80211_reason(frm[0] | (frm[1] << 8));
892 			break;
893 		}
894 		break;
895 	case IEEE80211_FC0_TYPE_CTL: {
896 		u_int8_t *t = (u_int8_t *) wh;
897 
898 		printf(": %s", ieee80211_ctl_subtype_name[
899 		    subtype >> IEEE80211_FC0_SUBTYPE_SHIFT]);
900 		if (!vflag)
901 			break;
902 
903 		/* See 802.11 2012 "8.3.1 Control frames". */
904 		t += 2; /* skip Frame Control */
905 		switch (subtype) {
906 		case IEEE80211_FC0_SUBTYPE_RTS:
907 		case IEEE80211_FC0_SUBTYPE_BAR:
908 		case IEEE80211_FC0_SUBTYPE_BA:
909 			TCHECK2(*t, 2); /* Duration */
910 			printf(", duration %dus", (t[0] | t[1] << 8));
911 			t += 2;
912 			TCHECK2(*t, 6); /* RA */
913 			printf(", ra %s", etheraddr_string(t));
914 			t += 6;
915 			TCHECK2(*t, 6); /* TA */
916 			printf(", ta %s", etheraddr_string(t));
917 			if (subtype == IEEE80211_FC0_SUBTYPE_BAR ||
918 			    subtype == IEEE80211_FC0_SUBTYPE_BA) {
919 				u_int16_t ctrl;
920 
921 				t += 6;
922 				TCHECK2(*t, 2); /* BAR/BA control */
923 				ctrl = t[0] | (t[1] << 8);
924 				if (ctrl & IEEE80211_BA_ACK_POLICY)
925 					printf(", no ack");
926 				else
927 					printf(", normal ack");
928 				if ((ctrl & IEEE80211_BA_MULTI_TID) == 0 &&
929 				    (ctrl & IEEE80211_BA_COMPRESSED) == 0)
930 					printf(", basic variant");
931 				else if ((ctrl & IEEE80211_BA_MULTI_TID) &&
932 				    (ctrl & IEEE80211_BA_COMPRESSED))
933 					printf(", multi-tid variant");
934 				else if (ctrl & IEEE80211_BA_COMPRESSED)
935 					printf(", compressed variant");
936 			}
937 			break;
938 		case IEEE80211_FC0_SUBTYPE_CTS:
939 		case IEEE80211_FC0_SUBTYPE_ACK:
940 			TCHECK2(*t, 2); /* Duration */
941 			printf(", duration %dus", (t[0] | t[1] << 8));
942 			t += 2;
943 			TCHECK2(*t, 6); /* RA */
944 			printf(", ra %s", etheraddr_string(t));
945 			break;
946 		case IEEE80211_FC0_SUBTYPE_PS_POLL:
947 			TCHECK2(*t, 2); /* AID */
948 			printf(", aid 0x%x", (t[0] | t[1] << 8));
949 			t += 2;
950 			TCHECK2(*t, 6); /* BSSID(RA) */
951 			printf(", ra %s", etheraddr_string(t));
952 			t += 6;
953 			TCHECK2(*t, 6); /* TA */
954 			printf(", ta %s", etheraddr_string(t));
955 			break;
956 		}
957 		break;
958 	}
959 	default:
960 		printf(": type#%d", type);
961 		break;
962 	}
963 
964 	return (0);
965 
966  trunc:
967 	/* Truncated 802.11 frame */
968 	return (1);
969 }
970 
971 u_int
972 ieee80211_any2ieee(u_int freq, u_int flags)
973 {
974 	if (flags & IEEE80211_CHAN_2GHZ) {
975 		if (freq == 2484)
976 			return 14;
977 		if (freq < 2484)
978 			return (freq - 2407) / 5;
979 		else
980 			return 15 + ((freq - 2512) / 20);
981 	} else if (flags & IEEE80211_CHAN_5GHZ) {
982 		return (freq - 5000) / 5;
983 	} else {
984 		/* Assume channel is already an IEEE number */
985 		return (freq);
986 	}
987 }
988 
989 int
990 ieee80211_print(struct ieee80211_frame *wh, u_int len)
991 {
992 	if (eflag)
993 		if (ieee80211_hdr(wh))
994 			return (1);
995 
996 	printf("802.11");
997 
998 	return (ieee80211_frame(wh, len));
999 }
1000 
1001 void
1002 ieee802_11_if_print(u_char *user, const struct pcap_pkthdr *h,
1003     const u_char *p)
1004 {
1005 	struct ieee80211_frame *wh = (struct ieee80211_frame*)p;
1006 
1007 	if (!ieee80211_encap)
1008 		ts_print(&h->ts);
1009 
1010 	packetp = p;
1011 	snapend = p + h->caplen;
1012 
1013 	if (ieee80211_print(wh, (u_int)h->len) != 0)
1014 		printf("[|802.11]");
1015 
1016 	if (!ieee80211_encap) {
1017 		if (xflag)
1018 			default_print(p, (u_int)h->len);
1019 		putchar('\n');
1020 	}
1021 }
1022 
1023 void
1024 ieee802_11_radio_if_print(u_char *user, const struct pcap_pkthdr *h,
1025     const u_char *p)
1026 {
1027 	struct ieee80211_radiotap_header *rh =
1028 	    (struct ieee80211_radiotap_header*)p;
1029 	struct ieee80211_frame *wh;
1030 	u_int8_t *t;
1031 	u_int32_t present;
1032 	u_int len, rh_len;
1033 	u_int16_t tmp;
1034 
1035 	if (!ieee80211_encap)
1036 		ts_print(&h->ts);
1037 
1038 	packetp = p;
1039 	snapend = p + h->caplen;
1040 
1041 	TCHECK(*rh);
1042 
1043 	len = h->len;
1044 	rh_len = letoh16(rh->it_len);
1045 	if (rh->it_version != 0) {
1046 		printf("[?radiotap + 802.11 v:%u]", rh->it_version);
1047 		goto out;
1048 	}
1049 
1050 	wh = (struct ieee80211_frame *)(p + rh_len);
1051 	if (len <= rh_len || ieee80211_print(wh, len - rh_len))
1052 		printf("[|802.11]");
1053 
1054 	t = (u_int8_t*)p + sizeof(struct ieee80211_radiotap_header);
1055 
1056 	if ((present = letoh32(rh->it_present)) == 0)
1057 		goto out;
1058 
1059 	printf(", <radiotap v%u", rh->it_version);
1060 
1061 #define RADIOTAP(_x)	\
1062 	(present & (1 << IEEE80211_RADIOTAP_##_x))
1063 
1064 	if (RADIOTAP(TSFT)) {
1065 		u_int64_t tsf;
1066 
1067 		TCHECK2(*t, 8);
1068 		bcopy(t, &tsf, sizeof(u_int64_t));
1069 		if (vflag > 1)
1070 			printf(", tsf %llu", letoh64(tsf));
1071 		t += 8;
1072 	}
1073 
1074 	if (RADIOTAP(FLAGS)) {
1075 		u_int8_t flags = *(u_int8_t*)t;
1076 		TCHECK2(*t, 1);
1077 
1078 		if (flags & IEEE80211_RADIOTAP_F_CFP)
1079 			printf(", CFP");
1080 		if (flags & IEEE80211_RADIOTAP_F_SHORTPRE)
1081 			printf(", SHORTPRE");
1082 		if (flags & IEEE80211_RADIOTAP_F_WEP)
1083 			printf(", WEP");
1084 		if (flags & IEEE80211_RADIOTAP_F_FRAG)
1085 			printf(", FRAG");
1086 		t += 1;
1087 	}
1088 
1089 	if (RADIOTAP(RATE)) {
1090 		TCHECK2(*t, 1);
1091 		if (vflag) {
1092 			uint8_t rate = *(u_int8_t*)t;
1093 			if (rate & 0x80)
1094 				printf(", MCS %u", rate & 0x7f);
1095 			else
1096 				printf(", %uMbit/s", rate / 2);
1097 		}
1098 		t += 1;
1099 	}
1100 
1101 	if (RADIOTAP(CHANNEL)) {
1102 		u_int16_t freq, flags;
1103 		TCHECK2(*t, 2);
1104 
1105 		bcopy(t, &freq, sizeof(u_int16_t));
1106 		freq = letoh16(freq);
1107 		t += 2;
1108 		TCHECK2(*t, 2);
1109 		bcopy(t, &flags, sizeof(u_int16_t));
1110 		flags = letoh16(flags);
1111 		t += 2;
1112 
1113 		printf(", chan %u", ieee80211_any2ieee(freq, flags));
1114 
1115 		if (flags & IEEE80211_CHAN_HT)
1116 			printf(", 11n");
1117 		else if (flags & IEEE80211_CHAN_DYN &&
1118 		    flags & IEEE80211_CHAN_2GHZ)
1119 			printf(", 11g");
1120 		else if (flags & IEEE80211_CHAN_CCK &&
1121 		    flags & IEEE80211_CHAN_2GHZ)
1122 			printf(", 11b");
1123 		else if (flags & IEEE80211_CHAN_OFDM &&
1124 		    flags & IEEE80211_CHAN_2GHZ)
1125 			printf(", 11G");
1126 		else if (flags & IEEE80211_CHAN_OFDM &&
1127 		    flags & IEEE80211_CHAN_5GHZ)
1128 			printf(", 11a");
1129 
1130 		if (flags & IEEE80211_CHAN_XR)
1131 			printf(", XR");
1132 	}
1133 
1134 	if (RADIOTAP(FHSS)) {
1135 		TCHECK2(*t, 2);
1136 		printf(", fhss %u/%u", *(u_int8_t*)t, *(u_int8_t*)t + 1);
1137 		t += 2;
1138 	}
1139 
1140 	if (RADIOTAP(DBM_ANTSIGNAL)) {
1141 		TCHECK(*t);
1142 		printf(", sig %ddBm", *(int8_t*)t);
1143 		t += 1;
1144 	}
1145 
1146 	if (RADIOTAP(DBM_ANTNOISE)) {
1147 		TCHECK(*t);
1148 		printf(", noise %ddBm", *(int8_t*)t);
1149 		t += 1;
1150 	}
1151 
1152 	if (RADIOTAP(LOCK_QUALITY)) {
1153 		TCHECK2(*t, 2);
1154 		if (vflag) {
1155 			bcopy(t, &tmp, sizeof(u_int16_t));
1156 			printf(", quality %u", letoh16(tmp));
1157 		}
1158 		t += 2;
1159 	}
1160 
1161 	if (RADIOTAP(TX_ATTENUATION)) {
1162 		TCHECK2(*t, 2);
1163 		if (vflag) {
1164 			bcopy(t, &tmp, sizeof(u_int16_t));
1165 			printf(", txatt %u", letoh16(tmp));
1166 		}
1167 		t += 2;
1168 	}
1169 
1170 	if (RADIOTAP(DB_TX_ATTENUATION)) {
1171 		TCHECK2(*t, 2);
1172 		if (vflag) {
1173 			bcopy(t, &tmp, sizeof(u_int16_t));
1174 			printf(", txatt %udB", letoh16(tmp));
1175 		}
1176 		t += 2;
1177 	}
1178 
1179 	if (RADIOTAP(DBM_TX_POWER)) {
1180 		TCHECK(*t);
1181 		printf(", txpower %ddBm", *(int8_t*)t);
1182 		t += 1;
1183 	}
1184 
1185 	if (RADIOTAP(ANTENNA)) {
1186 		TCHECK(*t);
1187 		if (vflag)
1188 			printf(", antenna %u", *(u_int8_t*)t);
1189 		t += 1;
1190 	}
1191 
1192 	if (RADIOTAP(DB_ANTSIGNAL)) {
1193 		TCHECK(*t);
1194 		printf(", signal %udB", *(u_int8_t*)t);
1195 		t += 1;
1196 	}
1197 
1198 	if (RADIOTAP(DB_ANTNOISE)) {
1199 		TCHECK(*t);
1200 		printf(", noise %udB", *(u_int8_t*)t);
1201 		t += 1;
1202 	}
1203 
1204 	if (RADIOTAP(FCS)) {
1205 		TCHECK2(*t, 4);
1206 		if (vflag) {
1207 			u_int32_t fcs;
1208 			bcopy(t, &fcs, sizeof(u_int32_t));
1209 			printf(", fcs %08x", letoh32(fcs));
1210 		}
1211 		t += 4;
1212 	}
1213 
1214 	if (RADIOTAP(RSSI)) {
1215 		u_int8_t rssi, max_rssi;
1216 		TCHECK(*t);
1217 		rssi = *(u_int8_t*)t;
1218 		t += 1;
1219 		TCHECK(*t);
1220 		max_rssi = *(u_int8_t*)t;
1221 		t += 1;
1222 
1223 		printf(", rssi %u/%u", rssi, max_rssi);
1224 	}
1225 
1226 #undef RADIOTAP
1227 
1228 	putchar('>');
1229 	goto out;
1230 
1231  trunc:
1232 	/* Truncated frame */
1233 	printf("[|radiotap + 802.11]");
1234 
1235  out:
1236 	if (!ieee80211_encap) {
1237 		if (xflag)
1238 			default_print(p, h->len);
1239 		putchar('\n');
1240 	}
1241 }
1242 
1243 void
1244 ieee80211_reason(u_int16_t reason)
1245 {
1246 	if (!vflag)
1247 		return;
1248 
1249 	switch (reason) {
1250 	case IEEE80211_REASON_UNSPECIFIED:
1251 		printf(", unspecified failure");
1252 		break;
1253 	case IEEE80211_REASON_AUTH_EXPIRE:
1254 		printf(", authentication expired");
1255 		break;
1256 	case IEEE80211_REASON_AUTH_LEAVE:
1257 		printf(", deauth - station left");
1258 		break;
1259 	case IEEE80211_REASON_ASSOC_EXPIRE:
1260 		printf(", association expired");
1261 		break;
1262 	case IEEE80211_REASON_ASSOC_TOOMANY:
1263 		printf(", too many associated stations");
1264 		break;
1265 	case IEEE80211_REASON_NOT_AUTHED:
1266 		printf(", not authenticated");
1267 		break;
1268 	case IEEE80211_REASON_NOT_ASSOCED:
1269 		printf(", not associated");
1270 		break;
1271 	case IEEE80211_REASON_ASSOC_LEAVE:
1272 		printf(", disassociated - station left");
1273 		break;
1274 	case IEEE80211_REASON_ASSOC_NOT_AUTHED:
1275 		printf(", association but not authenticated");
1276 		break;
1277 	case IEEE80211_REASON_RSN_REQUIRED:
1278 		printf(", rsn required");
1279 		break;
1280 	case IEEE80211_REASON_RSN_INCONSISTENT:
1281 		printf(", rsn inconsistent");
1282 		break;
1283 	case IEEE80211_REASON_IE_INVALID:
1284 		printf(", ie invalid");
1285 		break;
1286 	case IEEE80211_REASON_MIC_FAILURE:
1287 		printf(", mic failure");
1288 		break;
1289 	default:
1290 		printf(", unknown reason %u", reason);
1291 	}
1292 }
1293