1 /*-
2  * Copyright (c) 2009 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Rui Paulo under sponsorship from the
6  * FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 #include <sys/cdefs.h>
30 #ifdef __FreeBSD__
31 __FBSDID("$FreeBSD$");
32 #endif
33 
34 /*
35  * IEEE 802.11s Mesh Point (MBSS) support.
36  *
37  * Based on March 2009, D3.0 802.11s draft spec.
38  */
39 #include "opt_inet.h"
40 #include "opt_wlan.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/mbuf.h>
45 #include <sys/malloc.h>
46 #include <sys/kernel.h>
47 
48 #include <sys/socket.h>
49 #include <sys/sockio.h>
50 #include <sys/endian.h>
51 #include <sys/errno.h>
52 #include <sys/proc.h>
53 #include <sys/sysctl.h>
54 
55 #include <net/bpf.h>
56 #include <net/if.h>
57 #include <net/if_var.h>
58 #include <net/if_media.h>
59 #include <net/if_llc.h>
60 #include <net/ethernet.h>
61 
62 #include <netproto/802_11/ieee80211_var.h>
63 #include <netproto/802_11/ieee80211_action.h>
64 #ifdef IEEE80211_SUPPORT_SUPERG
65 #include <netproto/802_11/ieee80211_superg.h>
66 #endif
67 #include <netproto/802_11/ieee80211_input.h>
68 #include <netproto/802_11/ieee80211_mesh.h>
69 
70 static void	mesh_rt_flush_invalid(struct ieee80211vap *);
71 static int	mesh_select_proto_path(struct ieee80211vap *, const char *);
72 static int	mesh_select_proto_metric(struct ieee80211vap *, const char *);
73 static void	mesh_vattach(struct ieee80211vap *);
74 static int	mesh_newstate(struct ieee80211vap *, enum ieee80211_state, int);
75 static void	mesh_rt_cleanup_cb(void *);
76 static void	mesh_gatemode_setup(struct ieee80211vap *);
77 static void	mesh_gatemode_cb(void *);
78 static void	mesh_linkchange(struct ieee80211_node *,
79 		    enum ieee80211_mesh_mlstate);
80 static void	mesh_checkid(void *, struct ieee80211_node *);
81 static uint32_t	mesh_generateid(struct ieee80211vap *);
82 static int	mesh_checkpseq(struct ieee80211vap *,
83 		    const uint8_t [IEEE80211_ADDR_LEN], uint32_t);
84 static void	mesh_transmit_to_gate(struct ieee80211vap *, struct mbuf *,
85 		    struct ieee80211_mesh_route *);
86 static void	mesh_forward(struct ieee80211vap *, struct mbuf *,
87 		    const struct ieee80211_meshcntl *);
88 static int	mesh_input(struct ieee80211_node *, struct mbuf *,
89 		    const struct ieee80211_rx_stats *rxs, int, int);
90 static void	mesh_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
91 		    const struct ieee80211_rx_stats *rxs, int, int);
92 static void	mesh_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
93 static void	mesh_peer_timeout_setup(struct ieee80211_node *);
94 static void	mesh_peer_timeout_backoff(struct ieee80211_node *);
95 static void	mesh_peer_timeout_cb(void *);
96 static __inline void
97 		mesh_peer_timeout_stop(struct ieee80211_node *);
98 static int	mesh_verify_meshid(struct ieee80211vap *, const uint8_t *);
99 static int	mesh_verify_meshconf(struct ieee80211vap *, const uint8_t *);
100 static int	mesh_verify_meshpeer(struct ieee80211vap *, uint8_t,
101     		    const uint8_t *);
102 uint32_t	mesh_airtime_calc(struct ieee80211_node *);
103 
104 /*
105  * Timeout values come from the specification and are in milliseconds.
106  */
107 static SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD, 0,
108     "IEEE 802.11s parameters");
109 static int	ieee80211_mesh_gateint = -1;
110 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, gateint, CTLTYPE_INT | CTLFLAG_RW,
111     &ieee80211_mesh_gateint, 0, ieee80211_sysctl_msecs_ticks, "I",
112     "mesh gate interval (ms)");
113 static int ieee80211_mesh_retrytimeout = -1;
114 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout, CTLTYPE_INT | CTLFLAG_RW,
115     &ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
116     "Retry timeout (msec)");
117 static int ieee80211_mesh_holdingtimeout = -1;
118 
119 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout, CTLTYPE_INT | CTLFLAG_RW,
120     &ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
121     "Holding state timeout (msec)");
122 static int ieee80211_mesh_confirmtimeout = -1;
123 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout, CTLTYPE_INT | CTLFLAG_RW,
124     &ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
125     "Confirm state timeout (msec)");
126 static int ieee80211_mesh_backofftimeout = -1;
127 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, backofftimeout, CTLTYPE_INT | CTLFLAG_RW,
128     &ieee80211_mesh_backofftimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
129     "Backoff timeout (msec). This is to throutles peering forever when "
130     "not receiving answer or is rejected by a neighbor");
131 static int ieee80211_mesh_maxretries = 2;
132 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxretries, CTLFLAG_RW,
133     &ieee80211_mesh_maxretries, 0,
134     "Maximum retries during peer link establishment");
135 static int ieee80211_mesh_maxholding = 2;
136 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxholding, CTLFLAG_RW,
137     &ieee80211_mesh_maxholding, 0,
138     "Maximum times we are allowed to transition to HOLDING state before "
139     "backinoff during peer link establishment");
140 
141 static const uint8_t broadcastaddr[IEEE80211_ADDR_LEN] =
142 	{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
143 
144 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_open;
145 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_confirm;
146 static	ieee80211_recv_action_func mesh_recv_action_meshpeering_close;
147 static	ieee80211_recv_action_func mesh_recv_action_meshlmetric;
148 static	ieee80211_recv_action_func mesh_recv_action_meshgate;
149 
150 static	ieee80211_send_action_func mesh_send_action_meshpeering_open;
151 static	ieee80211_send_action_func mesh_send_action_meshpeering_confirm;
152 static	ieee80211_send_action_func mesh_send_action_meshpeering_close;
153 static	ieee80211_send_action_func mesh_send_action_meshlmetric;
154 static	ieee80211_send_action_func mesh_send_action_meshgate;
155 
156 static const struct ieee80211_mesh_proto_metric mesh_metric_airtime = {
157 	.mpm_descr	= "AIRTIME",
158 	.mpm_ie		= IEEE80211_MESHCONF_METRIC_AIRTIME,
159 	.mpm_metric	= mesh_airtime_calc,
160 };
161 
162 static struct ieee80211_mesh_proto_path		mesh_proto_paths[4];
163 static struct ieee80211_mesh_proto_metric	mesh_proto_metrics[4];
164 
165 MALLOC_DEFINE(M_80211_MESH_PREQ, "80211preq", "802.11 MESH Path Request frame");
166 MALLOC_DEFINE(M_80211_MESH_PREP, "80211prep", "802.11 MESH Path Reply frame");
167 MALLOC_DEFINE(M_80211_MESH_PERR, "80211perr", "802.11 MESH Path Error frame");
168 
169 /* The longer one of the lifetime should be stored as new lifetime */
170 #define MESH_ROUTE_LIFETIME_MAX(a, b)	(a > b ? a : b)
171 
172 MALLOC_DEFINE(M_80211_MESH_RT, "80211mesh_rt", "802.11s routing table");
173 MALLOC_DEFINE(M_80211_MESH_GT_RT, "80211mesh_gt", "802.11s known gates table");
174 
175 /*
176  * Helper functions to manipulate the Mesh routing table.
177  */
178 
179 static struct ieee80211_mesh_route *
mesh_rt_find_locked(struct ieee80211_mesh_state * ms,const uint8_t dest[IEEE80211_ADDR_LEN])180 mesh_rt_find_locked(struct ieee80211_mesh_state *ms,
181     const uint8_t dest[IEEE80211_ADDR_LEN])
182 {
183 	struct ieee80211_mesh_route *rt;
184 
185 	MESH_RT_LOCK_ASSERT(ms);
186 
187 	TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
188 		if (IEEE80211_ADDR_EQ(dest, rt->rt_dest))
189 			return rt;
190 	}
191 	return NULL;
192 }
193 
194 static struct ieee80211_mesh_route *
mesh_rt_add_locked(struct ieee80211vap * vap,const uint8_t dest[IEEE80211_ADDR_LEN])195 mesh_rt_add_locked(struct ieee80211vap *vap,
196     const uint8_t dest[IEEE80211_ADDR_LEN])
197 {
198 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
199 	struct ieee80211_mesh_route *rt;
200 
201 	KASSERT(!IEEE80211_ADDR_EQ(broadcastaddr, dest),
202 	    ("%s: adding broadcast to the routing table", __func__));
203 
204 	MESH_RT_LOCK_ASSERT(ms);
205 
206 #if defined(__DragonFly__)
207 	rt = kmalloc(ALIGN(sizeof(struct ieee80211_mesh_route)) +
208 	    ms->ms_ppath->mpp_privlen, M_80211_MESH_RT, M_INTWAIT | M_ZERO);
209 #else
210 	rt = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_route)) +
211 	    ms->ms_ppath->mpp_privlen, M_80211_MESH_RT,
212 	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
213 #endif
214 	if (rt != NULL) {
215 		rt->rt_vap = vap;
216 		IEEE80211_ADDR_COPY(rt->rt_dest, dest);
217 		rt->rt_priv = (void *)ALIGN(&rt[1]);
218 		MESH_RT_ENTRY_LOCK_INIT(rt, "MBSS_RT");
219 #if defined(__DragonFly__)
220 		callout_init_mp(&rt->rt_discovery);
221 #else
222 		callout_init(&rt->rt_discovery, 1);
223 #endif
224 		rt->rt_updtime = ticks;	/* create time */
225 		TAILQ_INSERT_TAIL(&ms->ms_routes, rt, rt_next);
226 	}
227 	return rt;
228 }
229 
230 struct ieee80211_mesh_route *
ieee80211_mesh_rt_find(struct ieee80211vap * vap,const uint8_t dest[IEEE80211_ADDR_LEN])231 ieee80211_mesh_rt_find(struct ieee80211vap *vap,
232     const uint8_t dest[IEEE80211_ADDR_LEN])
233 {
234 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
235 	struct ieee80211_mesh_route *rt;
236 
237 	MESH_RT_LOCK(ms);
238 	rt = mesh_rt_find_locked(ms, dest);
239 	MESH_RT_UNLOCK(ms);
240 	return rt;
241 }
242 
243 struct ieee80211_mesh_route *
ieee80211_mesh_rt_add(struct ieee80211vap * vap,const uint8_t dest[IEEE80211_ADDR_LEN])244 ieee80211_mesh_rt_add(struct ieee80211vap *vap,
245     const uint8_t dest[IEEE80211_ADDR_LEN])
246 {
247 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
248 	struct ieee80211_mesh_route *rt;
249 
250 	KASSERT(ieee80211_mesh_rt_find(vap, dest) == NULL,
251 	    ("%s: duplicate entry in the routing table", __func__));
252 	KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
253 	    ("%s: adding self to the routing table", __func__));
254 
255 	MESH_RT_LOCK(ms);
256 	rt = mesh_rt_add_locked(vap, dest);
257 	MESH_RT_UNLOCK(ms);
258 	return rt;
259 }
260 
261 /*
262  * Update the route lifetime and returns the updated lifetime.
263  * If new_lifetime is zero and route is timedout it will be invalidated.
264  * new_lifetime is in msec
265  */
266 int
ieee80211_mesh_rt_update(struct ieee80211_mesh_route * rt,int new_lifetime)267 ieee80211_mesh_rt_update(struct ieee80211_mesh_route *rt, int new_lifetime)
268 {
269 	int timesince, now;
270 	uint32_t lifetime = 0;
271 
272 	KASSERT(rt != NULL, ("route is NULL"));
273 
274 	now = ticks;
275 	MESH_RT_ENTRY_LOCK(rt);
276 
277 	/* dont clobber a proxy entry gated by us */
278 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY && rt->rt_nhops == 0) {
279 		MESH_RT_ENTRY_UNLOCK(rt);
280 		return rt->rt_lifetime;
281 	}
282 
283 	timesince = ticks_to_msecs(now - rt->rt_updtime);
284 	rt->rt_updtime = now;
285 	if (timesince >= rt->rt_lifetime) {
286 		if (new_lifetime != 0) {
287 			rt->rt_lifetime = new_lifetime;
288 		}
289 		else {
290 			rt->rt_flags &= ~IEEE80211_MESHRT_FLAGS_VALID;
291 			rt->rt_lifetime = 0;
292 		}
293 	} else {
294 		/* update what is left of lifetime */
295 		rt->rt_lifetime = rt->rt_lifetime - timesince;
296 		rt->rt_lifetime  = MESH_ROUTE_LIFETIME_MAX(
297 			new_lifetime, rt->rt_lifetime);
298 	}
299 	lifetime = rt->rt_lifetime;
300 	MESH_RT_ENTRY_UNLOCK(rt);
301 
302 	return lifetime;
303 }
304 
305 /*
306  * Add a proxy route (as needed) for the specified destination.
307  */
308 void
ieee80211_mesh_proxy_check(struct ieee80211vap * vap,const uint8_t dest[IEEE80211_ADDR_LEN])309 ieee80211_mesh_proxy_check(struct ieee80211vap *vap,
310     const uint8_t dest[IEEE80211_ADDR_LEN])
311 {
312 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
313 	struct ieee80211_mesh_route *rt;
314 
315 	MESH_RT_LOCK(ms);
316 	rt = mesh_rt_find_locked(ms, dest);
317 	if (rt == NULL) {
318 		rt = mesh_rt_add_locked(vap, dest);
319 		if (rt == NULL) {
320 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
321 			    "%s", "unable to add proxy entry");
322 			vap->iv_stats.is_mesh_rtaddfailed++;
323 		} else {
324 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
325 			    "%s", "add proxy entry");
326 			IEEE80211_ADDR_COPY(rt->rt_mesh_gate, vap->iv_myaddr);
327 			IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
328 			rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
329 				     |  IEEE80211_MESHRT_FLAGS_PROXY;
330 		}
331 	} else if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
332 		KASSERT(rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY,
333 		    ("no proxy flag for poxy entry"));
334 		struct ieee80211com *ic = vap->iv_ic;
335 		/*
336 		 * Fix existing entry created by received frames from
337 		 * stations that have some memory of dest.  We also
338 		 * flush any frames held on the staging queue; delivering
339 		 * them is too much trouble right now.
340 		 */
341 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
342 		    "%s", "fix proxy entry");
343 		IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
344 		rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
345 			     |  IEEE80211_MESHRT_FLAGS_PROXY;
346 		/* XXX belongs in hwmp */
347 		ieee80211_ageq_drain_node(&ic->ic_stageq,
348 		   (void *)(uintptr_t) ieee80211_mac_hash(ic, dest));
349 		/* XXX stat? */
350 	}
351 	MESH_RT_UNLOCK(ms);
352 }
353 
354 static __inline void
mesh_rt_del(struct ieee80211_mesh_state * ms,struct ieee80211_mesh_route * rt)355 mesh_rt_del(struct ieee80211_mesh_state *ms, struct ieee80211_mesh_route *rt)
356 {
357 	TAILQ_REMOVE(&ms->ms_routes, rt, rt_next);
358 	/*
359 	 * Grab the lock before destroying it, to be sure no one else
360 	 * is holding the route.
361 	 */
362 	MESH_RT_ENTRY_LOCK(rt);
363 	callout_drain(&rt->rt_discovery);
364 	MESH_RT_ENTRY_LOCK_DESTROY(rt);
365 	IEEE80211_FREE(rt, M_80211_MESH_RT);
366 }
367 
368 void
ieee80211_mesh_rt_del(struct ieee80211vap * vap,const uint8_t dest[IEEE80211_ADDR_LEN])369 ieee80211_mesh_rt_del(struct ieee80211vap *vap,
370     const uint8_t dest[IEEE80211_ADDR_LEN])
371 {
372 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
373 	struct ieee80211_mesh_route *rt, *next;
374 
375 	MESH_RT_LOCK(ms);
376 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
377 		if (IEEE80211_ADDR_EQ(rt->rt_dest, dest)) {
378 			if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
379 				ms->ms_ppath->mpp_senderror(vap, dest, rt,
380 				    IEEE80211_REASON_MESH_PERR_NO_PROXY);
381 			} else {
382 				ms->ms_ppath->mpp_senderror(vap, dest, rt,
383 				    IEEE80211_REASON_MESH_PERR_DEST_UNREACH);
384 			}
385 			mesh_rt_del(ms, rt);
386 			MESH_RT_UNLOCK(ms);
387 			return;
388 		}
389 	}
390 	MESH_RT_UNLOCK(ms);
391 }
392 
393 void
ieee80211_mesh_rt_flush(struct ieee80211vap * vap)394 ieee80211_mesh_rt_flush(struct ieee80211vap *vap)
395 {
396 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
397 	struct ieee80211_mesh_route *rt, *next;
398 
399 	if (ms == NULL)
400 		return;
401 	MESH_RT_LOCK(ms);
402 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next)
403 		mesh_rt_del(ms, rt);
404 	MESH_RT_UNLOCK(ms);
405 }
406 
407 void
ieee80211_mesh_rt_flush_peer(struct ieee80211vap * vap,const uint8_t peer[IEEE80211_ADDR_LEN])408 ieee80211_mesh_rt_flush_peer(struct ieee80211vap *vap,
409     const uint8_t peer[IEEE80211_ADDR_LEN])
410 {
411 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
412 	struct ieee80211_mesh_route *rt, *next;
413 
414 	MESH_RT_LOCK(ms);
415 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
416 		if (IEEE80211_ADDR_EQ(rt->rt_nexthop, peer))
417 			mesh_rt_del(ms, rt);
418 	}
419 	MESH_RT_UNLOCK(ms);
420 }
421 
422 /*
423  * Flush expired routing entries, i.e. those in invalid state for
424  * some time.
425  */
426 static void
mesh_rt_flush_invalid(struct ieee80211vap * vap)427 mesh_rt_flush_invalid(struct ieee80211vap *vap)
428 {
429 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
430 	struct ieee80211_mesh_route *rt, *next;
431 
432 	if (ms == NULL)
433 		return;
434 	MESH_RT_LOCK(ms);
435 	TAILQ_FOREACH_SAFE(rt, &ms->ms_routes, rt_next, next) {
436 		/* Discover paths will be deleted by their own callout */
437 		if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_DISCOVER)
438 			continue;
439 		ieee80211_mesh_rt_update(rt, 0);
440 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0)
441 			mesh_rt_del(ms, rt);
442 	}
443 	MESH_RT_UNLOCK(ms);
444 }
445 
446 int
ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path * mpp)447 ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path *mpp)
448 {
449 	int i, firstempty = -1;
450 
451 	for (i = 0; i < nitems(mesh_proto_paths); i++) {
452 		if (strncmp(mpp->mpp_descr, mesh_proto_paths[i].mpp_descr,
453 		    IEEE80211_MESH_PROTO_DSZ) == 0)
454 			return EEXIST;
455 		if (!mesh_proto_paths[i].mpp_active && firstempty == -1)
456 			firstempty = i;
457 	}
458 	if (firstempty < 0)
459 		return ENOSPC;
460 	memcpy(&mesh_proto_paths[firstempty], mpp, sizeof(*mpp));
461 	mesh_proto_paths[firstempty].mpp_active = 1;
462 	return 0;
463 }
464 
465 int
ieee80211_mesh_register_proto_metric(const struct ieee80211_mesh_proto_metric * mpm)466 ieee80211_mesh_register_proto_metric(const struct
467     ieee80211_mesh_proto_metric *mpm)
468 {
469 	int i, firstempty = -1;
470 
471 	for (i = 0; i < nitems(mesh_proto_metrics); i++) {
472 		if (strncmp(mpm->mpm_descr, mesh_proto_metrics[i].mpm_descr,
473 		    IEEE80211_MESH_PROTO_DSZ) == 0)
474 			return EEXIST;
475 		if (!mesh_proto_metrics[i].mpm_active && firstempty == -1)
476 			firstempty = i;
477 	}
478 	if (firstempty < 0)
479 		return ENOSPC;
480 	memcpy(&mesh_proto_metrics[firstempty], mpm, sizeof(*mpm));
481 	mesh_proto_metrics[firstempty].mpm_active = 1;
482 	return 0;
483 }
484 
485 static int
mesh_select_proto_path(struct ieee80211vap * vap,const char * name)486 mesh_select_proto_path(struct ieee80211vap *vap, const char *name)
487 {
488 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
489 	int i;
490 
491 	for (i = 0; i < nitems(mesh_proto_paths); i++) {
492 		if (strcasecmp(mesh_proto_paths[i].mpp_descr, name) == 0) {
493 			ms->ms_ppath = &mesh_proto_paths[i];
494 			return 0;
495 		}
496 	}
497 	return ENOENT;
498 }
499 
500 static int
mesh_select_proto_metric(struct ieee80211vap * vap,const char * name)501 mesh_select_proto_metric(struct ieee80211vap *vap, const char *name)
502 {
503 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
504 	int i;
505 
506 	for (i = 0; i < nitems(mesh_proto_metrics); i++) {
507 		if (strcasecmp(mesh_proto_metrics[i].mpm_descr, name) == 0) {
508 			ms->ms_pmetric = &mesh_proto_metrics[i];
509 			return 0;
510 		}
511 	}
512 	return ENOENT;
513 }
514 
515 static void
mesh_gatemode_setup(struct ieee80211vap * vap)516 mesh_gatemode_setup(struct ieee80211vap *vap)
517 {
518 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
519 
520 	/*
521 	 * NB: When a mesh gate is running as a ROOT it shall
522 	 * not send out periodic GANNs but instead mark the
523 	 * mesh gate flag for the corresponding proactive PREQ
524 	 * and RANN frames.
525 	 */
526 	if (ms->ms_flags & IEEE80211_MESHFLAGS_ROOT ||
527 	    (ms->ms_flags & IEEE80211_MESHFLAGS_GATE) == 0) {
528 		callout_drain(&ms->ms_gatetimer);
529 		return ;
530 	}
531 	callout_reset(&ms->ms_gatetimer, ieee80211_mesh_gateint,
532 	    mesh_gatemode_cb, vap);
533 }
534 
535 static void
mesh_gatemode_cb(void * arg)536 mesh_gatemode_cb(void *arg)
537 {
538 	struct ieee80211vap *vap = (struct ieee80211vap *)arg;
539 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
540 	struct ieee80211_meshgann_ie gann;
541 
542 	gann.gann_flags = 0; /* Reserved */
543 	gann.gann_hopcount = 0;
544 	gann.gann_ttl = ms->ms_ttl;
545 	IEEE80211_ADDR_COPY(gann.gann_addr, vap->iv_myaddr);
546 	gann.gann_seq = ms->ms_gateseq++;
547 	gann.gann_interval = ieee80211_mesh_gateint;
548 
549 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH, vap->iv_bss,
550 	    "send broadcast GANN (seq %u)", gann.gann_seq);
551 
552 	ieee80211_send_action(vap->iv_bss, IEEE80211_ACTION_CAT_MESH,
553 	    IEEE80211_ACTION_MESH_GANN, &gann);
554 	mesh_gatemode_setup(vap);
555 }
556 
557 static void
ieee80211_mesh_init(void)558 ieee80211_mesh_init(void)
559 {
560 
561 	memset(mesh_proto_paths, 0, sizeof(mesh_proto_paths));
562 	memset(mesh_proto_metrics, 0, sizeof(mesh_proto_metrics));
563 
564 	/*
565 	 * Setup mesh parameters that depends on the clock frequency.
566 	 */
567 	ieee80211_mesh_gateint = msecs_to_ticks(10000);
568 	ieee80211_mesh_retrytimeout = msecs_to_ticks(40);
569 	ieee80211_mesh_holdingtimeout = msecs_to_ticks(40);
570 	ieee80211_mesh_confirmtimeout = msecs_to_ticks(40);
571 	ieee80211_mesh_backofftimeout = msecs_to_ticks(5000);
572 
573 	/*
574 	 * Register action frame handlers.
575 	 */
576 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
577 	    IEEE80211_ACTION_MESHPEERING_OPEN,
578 	    mesh_recv_action_meshpeering_open);
579 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
580 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
581 	    mesh_recv_action_meshpeering_confirm);
582 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
583 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
584 	    mesh_recv_action_meshpeering_close);
585 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
586 	    IEEE80211_ACTION_MESH_LMETRIC, mesh_recv_action_meshlmetric);
587 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
588 	    IEEE80211_ACTION_MESH_GANN, mesh_recv_action_meshgate);
589 
590 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
591 	    IEEE80211_ACTION_MESHPEERING_OPEN,
592 	    mesh_send_action_meshpeering_open);
593 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
594 	    IEEE80211_ACTION_MESHPEERING_CONFIRM,
595 	    mesh_send_action_meshpeering_confirm);
596 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_SELF_PROT,
597 	    IEEE80211_ACTION_MESHPEERING_CLOSE,
598 	    mesh_send_action_meshpeering_close);
599 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESH,
600 	    IEEE80211_ACTION_MESH_LMETRIC,
601 	    mesh_send_action_meshlmetric);
602 	ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESH,
603 	    IEEE80211_ACTION_MESH_GANN,
604 	    mesh_send_action_meshgate);
605 
606 	/*
607 	 * Register Airtime Link Metric.
608 	 */
609 	ieee80211_mesh_register_proto_metric(&mesh_metric_airtime);
610 
611 }
612 SYSINIT(wlan_mesh, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_mesh_init, NULL);
613 
614 void
ieee80211_mesh_attach(struct ieee80211com * ic)615 ieee80211_mesh_attach(struct ieee80211com *ic)
616 {
617 	ic->ic_vattach[IEEE80211_M_MBSS] = mesh_vattach;
618 }
619 
620 void
ieee80211_mesh_detach(struct ieee80211com * ic)621 ieee80211_mesh_detach(struct ieee80211com *ic)
622 {
623 }
624 
625 static void
mesh_vdetach_peers(void * arg,struct ieee80211_node * ni)626 mesh_vdetach_peers(void *arg, struct ieee80211_node *ni)
627 {
628 	struct ieee80211com *ic = ni->ni_ic;
629 	uint16_t args[3];
630 
631 	if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED) {
632 		args[0] = ni->ni_mlpid;
633 		args[1] = ni->ni_mllid;
634 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
635 		ieee80211_send_action(ni,
636 		    IEEE80211_ACTION_CAT_SELF_PROT,
637 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
638 		    args);
639 	}
640 	callout_drain(&ni->ni_mltimer);
641 	/* XXX belongs in hwmp */
642 	ieee80211_ageq_drain_node(&ic->ic_stageq,
643 	   (void *)(uintptr_t) ieee80211_mac_hash(ic, ni->ni_macaddr));
644 }
645 
646 static void
mesh_vdetach(struct ieee80211vap * vap)647 mesh_vdetach(struct ieee80211vap *vap)
648 {
649 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
650 
651 	callout_drain(&ms->ms_cleantimer);
652 	ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_vdetach_peers,
653 	    NULL);
654 	ieee80211_mesh_rt_flush(vap);
655 	MESH_RT_LOCK_DESTROY(ms);
656 	ms->ms_ppath->mpp_vdetach(vap);
657 	IEEE80211_FREE(vap->iv_mesh, M_80211_VAP);
658 	vap->iv_mesh = NULL;
659 }
660 
661 static void
mesh_vattach(struct ieee80211vap * vap)662 mesh_vattach(struct ieee80211vap *vap)
663 {
664 	struct ieee80211_mesh_state *ms;
665 	vap->iv_newstate = mesh_newstate;
666 	vap->iv_input = mesh_input;
667 	vap->iv_opdetach = mesh_vdetach;
668 	vap->iv_recv_mgmt = mesh_recv_mgmt;
669 	vap->iv_recv_ctl = mesh_recv_ctl;
670 #if defined(__DragonFly__)
671 	ms = kmalloc(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
672 	    M_INTWAIT | M_ZERO);
673 #else
674 	ms = IEEE80211_MALLOC(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
675 	    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
676 #endif
677 	if (ms == NULL) {
678 		kprintf("%s: couldn't alloc MBSS state\n", __func__);
679 		return;
680 	}
681 	vap->iv_mesh = ms;
682 	ms->ms_seq = 0;
683 	ms->ms_flags = (IEEE80211_MESHFLAGS_AP | IEEE80211_MESHFLAGS_FWD);
684 	ms->ms_ttl = IEEE80211_MESH_DEFAULT_TTL;
685 	TAILQ_INIT(&ms->ms_known_gates);
686 	TAILQ_INIT(&ms->ms_routes);
687 	MESH_RT_LOCK_INIT(ms, "MBSS");
688 #if defined(__DragonFly__)
689 	callout_init_mp(&ms->ms_cleantimer);
690 	callout_init_mp(&ms->ms_gatetimer);
691 #else
692 	callout_init(&ms->ms_cleantimer, 1);
693 	callout_init(&ms->ms_gatetimer, 1);
694 #endif
695 	ms->ms_gateseq = 0;
696 	mesh_select_proto_metric(vap, "AIRTIME");
697 	KASSERT(ms->ms_pmetric, ("ms_pmetric == NULL"));
698 	mesh_select_proto_path(vap, "HWMP");
699 	KASSERT(ms->ms_ppath, ("ms_ppath == NULL"));
700 	ms->ms_ppath->mpp_vattach(vap);
701 }
702 
703 /*
704  * IEEE80211_M_MBSS vap state machine handler.
705  */
706 static int
mesh_newstate(struct ieee80211vap * vap,enum ieee80211_state nstate,int arg)707 mesh_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
708 {
709 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
710 	struct ieee80211com *ic = vap->iv_ic;
711 	struct ieee80211_node *ni;
712 	enum ieee80211_state ostate;
713 
714 	IEEE80211_LOCK_ASSERT(ic);
715 
716 	ostate = vap->iv_state;
717 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
718 	    __func__, ieee80211_state_name[ostate],
719 	    ieee80211_state_name[nstate], arg);
720 	vap->iv_state = nstate;		/* state transition */
721 	if (ostate != IEEE80211_S_SCAN)
722 		ieee80211_cancel_scan(vap);	/* background scan */
723 	ni = vap->iv_bss;			/* NB: no reference held */
724 	if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN) {
725 		callout_drain(&ms->ms_cleantimer);
726 		callout_drain(&ms->ms_gatetimer);
727 	}
728 	switch (nstate) {
729 	case IEEE80211_S_INIT:
730 		switch (ostate) {
731 		case IEEE80211_S_SCAN:
732 			ieee80211_cancel_scan(vap);
733 			break;
734 		case IEEE80211_S_CAC:
735 			ieee80211_dfs_cac_stop(vap);
736 			break;
737 		case IEEE80211_S_RUN:
738 			ieee80211_iterate_nodes(&ic->ic_sta,
739 			    mesh_vdetach_peers, NULL);
740 			break;
741 		default:
742 			break;
743 		}
744 		if (ostate != IEEE80211_S_INIT) {
745 			/* NB: optimize INIT -> INIT case */
746 			ieee80211_reset_bss(vap);
747 			ieee80211_mesh_rt_flush(vap);
748 		}
749 		break;
750 	case IEEE80211_S_SCAN:
751 		switch (ostate) {
752 		case IEEE80211_S_INIT:
753 			if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
754 			    !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan) &&
755 			    ms->ms_idlen != 0) {
756 				/*
757 				 * Already have a channel and a mesh ID; bypass
758 				 * the scan and startup immediately.
759 				 */
760 				ieee80211_create_ibss(vap, vap->iv_des_chan);
761 				break;
762 			}
763 			/*
764 			 * Initiate a scan.  We can come here as a result
765 			 * of an IEEE80211_IOC_SCAN_REQ too in which case
766 			 * the vap will be marked with IEEE80211_FEXT_SCANREQ
767 			 * and the scan request parameters will be present
768 			 * in iv_scanreq.  Otherwise we do the default.
769 			*/
770 			if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
771 				ieee80211_check_scan(vap,
772 				    vap->iv_scanreq_flags,
773 				    vap->iv_scanreq_duration,
774 				    vap->iv_scanreq_mindwell,
775 				    vap->iv_scanreq_maxdwell,
776 				    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
777 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
778 			} else
779 				ieee80211_check_scan_current(vap);
780 			break;
781 		default:
782 			break;
783 		}
784 		break;
785 	case IEEE80211_S_CAC:
786 		/*
787 		 * Start CAC on a DFS channel.  We come here when starting
788 		 * a bss on a DFS channel (see ieee80211_create_ibss).
789 		 */
790 		ieee80211_dfs_cac_start(vap);
791 		break;
792 	case IEEE80211_S_RUN:
793 		switch (ostate) {
794 		case IEEE80211_S_INIT:
795 			/*
796 			 * Already have a channel; bypass the
797 			 * scan and startup immediately.
798 			 * Note that ieee80211_create_ibss will call
799 			 * back to do a RUN->RUN state change.
800 			 */
801 			ieee80211_create_ibss(vap,
802 			    ieee80211_ht_adjust_channel(ic,
803 				ic->ic_curchan, vap->iv_flags_ht));
804 			/* NB: iv_bss is changed on return */
805 			break;
806 		case IEEE80211_S_CAC:
807 			/*
808 			 * NB: This is the normal state change when CAC
809 			 * expires and no radar was detected; no need to
810 			 * clear the CAC timer as it's already expired.
811 			 */
812 			/* fall thru... */
813 		case IEEE80211_S_CSA:
814 #if 0
815 			/*
816 			 * Shorten inactivity timer of associated stations
817 			 * to weed out sta's that don't follow a CSA.
818 			 */
819 			ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
820 #endif
821 			/*
822 			 * Update bss node channel to reflect where
823 			 * we landed after CSA.
824 			 */
825 			ieee80211_node_set_chan(vap->iv_bss,
826 			    ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
827 				ieee80211_htchanflags(vap->iv_bss->ni_chan)));
828 			/* XXX bypass debug msgs */
829 			break;
830 		case IEEE80211_S_SCAN:
831 		case IEEE80211_S_RUN:
832 #ifdef IEEE80211_DEBUG
833 			if (ieee80211_msg_debug(vap)) {
834 				struct ieee80211_node *ni = vap->iv_bss;
835 				ieee80211_note(vap,
836 				    "synchronized with %s meshid ",
837 				    ether_sprintf(ni->ni_meshid));
838 				ieee80211_print_essid(ni->ni_meshid,
839 				    ni->ni_meshidlen);
840 				/* XXX MCS/HT */
841 				kprintf(" channel %d\n",
842 				    ieee80211_chan2ieee(ic, ic->ic_curchan));
843 			}
844 #endif
845 			break;
846 		default:
847 			break;
848 		}
849 		ieee80211_node_authorize(vap->iv_bss);
850 		callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
851                     mesh_rt_cleanup_cb, vap);
852 		mesh_gatemode_setup(vap);
853 		break;
854 	default:
855 		break;
856 	}
857 	/* NB: ostate not nstate */
858 	ms->ms_ppath->mpp_newstate(vap, ostate, arg);
859 	return 0;
860 }
861 
862 static void
mesh_rt_cleanup_cb(void * arg)863 mesh_rt_cleanup_cb(void *arg)
864 {
865 	struct ieee80211vap *vap = arg;
866 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
867 
868 	mesh_rt_flush_invalid(vap);
869 	callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
870 	    mesh_rt_cleanup_cb, vap);
871 }
872 
873 /*
874  * Mark a mesh STA as gate and return a pointer to it.
875  * If this is first time, we create a new gate route.
876  * Always update the path route to this mesh gate.
877  */
878 struct ieee80211_mesh_gate_route *
ieee80211_mesh_mark_gate(struct ieee80211vap * vap,const uint8_t * addr,struct ieee80211_mesh_route * rt)879 ieee80211_mesh_mark_gate(struct ieee80211vap *vap, const uint8_t *addr,
880     struct ieee80211_mesh_route *rt)
881 {
882 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
883 	struct ieee80211_mesh_gate_route *gr = NULL, *next;
884 	int found = 0;
885 
886 	MESH_RT_LOCK(ms);
887 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, next) {
888 		if (IEEE80211_ADDR_EQ(gr->gr_addr, addr)) {
889 			found = 1;
890 			break;
891 		}
892 	}
893 
894 	if (!found) {
895 		/* New mesh gate add it to known table. */
896 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, addr,
897 		    "%s", "stored new gate information from pro-PREQ.");
898 #if defined(__DragonFly__)
899 		gr = kmalloc(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
900 		    M_80211_MESH_GT_RT, M_INTWAIT | M_ZERO);
901 #else
902 		gr = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
903 		    M_80211_MESH_GT_RT,
904 		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
905 #endif
906 		IEEE80211_ADDR_COPY(gr->gr_addr, addr);
907 		TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
908 	}
909 	gr->gr_route = rt;
910 	/* TODO: link from path route to gate route */
911 	MESH_RT_UNLOCK(ms);
912 
913 	return gr;
914 }
915 
916 
917 /*
918  * Helper function to note the Mesh Peer Link FSM change.
919  */
920 static void
mesh_linkchange(struct ieee80211_node * ni,enum ieee80211_mesh_mlstate state)921 mesh_linkchange(struct ieee80211_node *ni, enum ieee80211_mesh_mlstate state)
922 {
923 	struct ieee80211vap *vap = ni->ni_vap;
924 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
925 #ifdef IEEE80211_DEBUG
926 	static const char *meshlinkstates[] = {
927 		[IEEE80211_NODE_MESH_IDLE]		= "IDLE",
928 		[IEEE80211_NODE_MESH_OPENSNT]		= "OPEN SENT",
929 		[IEEE80211_NODE_MESH_OPENRCV]		= "OPEN RECEIVED",
930 		[IEEE80211_NODE_MESH_CONFIRMRCV]	= "CONFIRM RECEIVED",
931 		[IEEE80211_NODE_MESH_ESTABLISHED]	= "ESTABLISHED",
932 		[IEEE80211_NODE_MESH_HOLDING]		= "HOLDING"
933 	};
934 #endif
935 	IEEE80211_NOTE(vap, IEEE80211_MSG_MESH,
936 	    ni, "peer link: %s -> %s",
937 	    meshlinkstates[ni->ni_mlstate], meshlinkstates[state]);
938 
939 	/* track neighbor count */
940 	if (state == IEEE80211_NODE_MESH_ESTABLISHED &&
941 	    ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
942 		KASSERT(ms->ms_neighbors < 65535, ("neighbor count overflow"));
943 		ms->ms_neighbors++;
944 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
945 	} else if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED &&
946 	    state != IEEE80211_NODE_MESH_ESTABLISHED) {
947 		KASSERT(ms->ms_neighbors > 0, ("neighbor count 0"));
948 		ms->ms_neighbors--;
949 		ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
950 	}
951 	ni->ni_mlstate = state;
952 	switch (state) {
953 	case IEEE80211_NODE_MESH_HOLDING:
954 		ms->ms_ppath->mpp_peerdown(ni);
955 		break;
956 	case IEEE80211_NODE_MESH_ESTABLISHED:
957 		ieee80211_mesh_discover(vap, ni->ni_macaddr, NULL);
958 		break;
959 	default:
960 		break;
961 	}
962 }
963 
964 /*
965  * Helper function to generate a unique local ID required for mesh
966  * peer establishment.
967  */
968 static void
mesh_checkid(void * arg,struct ieee80211_node * ni)969 mesh_checkid(void *arg, struct ieee80211_node *ni)
970 {
971 	uint16_t *r = arg;
972 
973 	if (*r == ni->ni_mllid)
974 		*(uint16_t *)arg = 0;
975 }
976 
977 static uint32_t
mesh_generateid(struct ieee80211vap * vap)978 mesh_generateid(struct ieee80211vap *vap)
979 {
980 	int maxiter = 4;
981 	uint16_t r;
982 
983 	do {
984 		get_random_bytes(&r, 2);
985 		ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_checkid, &r);
986 		maxiter--;
987 	} while (r == 0 && maxiter > 0);
988 	return r;
989 }
990 
991 /*
992  * Verifies if we already received this packet by checking its
993  * sequence number.
994  * Returns 0 if the frame is to be accepted, 1 otherwise.
995  */
996 static int
mesh_checkpseq(struct ieee80211vap * vap,const uint8_t source[IEEE80211_ADDR_LEN],uint32_t seq)997 mesh_checkpseq(struct ieee80211vap *vap,
998     const uint8_t source[IEEE80211_ADDR_LEN], uint32_t seq)
999 {
1000 	struct ieee80211_mesh_route *rt;
1001 
1002 	rt = ieee80211_mesh_rt_find(vap, source);
1003 	if (rt == NULL) {
1004 		rt = ieee80211_mesh_rt_add(vap, source);
1005 		if (rt == NULL) {
1006 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
1007 			    "%s", "add mcast route failed");
1008 			vap->iv_stats.is_mesh_rtaddfailed++;
1009 			return 1;
1010 		}
1011 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
1012 		    "add mcast route, mesh seqno %d", seq);
1013 		rt->rt_lastmseq = seq;
1014 		return 0;
1015 	}
1016 	if (IEEE80211_MESH_SEQ_GEQ(rt->rt_lastmseq, seq)) {
1017 		return 1;
1018 	} else {
1019 		rt->rt_lastmseq = seq;
1020 		return 0;
1021 	}
1022 }
1023 
1024 /*
1025  * Iterate the routing table and locate the next hop.
1026  */
1027 struct ieee80211_node *
ieee80211_mesh_find_txnode(struct ieee80211vap * vap,const uint8_t dest[IEEE80211_ADDR_LEN])1028 ieee80211_mesh_find_txnode(struct ieee80211vap *vap,
1029     const uint8_t dest[IEEE80211_ADDR_LEN])
1030 {
1031 	struct ieee80211_mesh_route *rt;
1032 
1033 	rt = ieee80211_mesh_rt_find(vap, dest);
1034 	if (rt == NULL)
1035 		return NULL;
1036 	if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
1037 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
1038 		    "%s: !valid, flags 0x%x", __func__, rt->rt_flags);
1039 		/* XXX stat */
1040 		return NULL;
1041 	}
1042 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
1043 		rt = ieee80211_mesh_rt_find(vap, rt->rt_mesh_gate);
1044 		if (rt == NULL) return NULL;
1045 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
1046 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
1047 			    "%s: meshgate !valid, flags 0x%x", __func__,
1048 			    rt->rt_flags);
1049 			/* XXX stat */
1050 			return NULL;
1051 		}
1052 	}
1053 	return ieee80211_find_txnode(vap, rt->rt_nexthop);
1054 }
1055 
1056 static void
mesh_transmit_to_gate(struct ieee80211vap * vap,struct mbuf * m,struct ieee80211_mesh_route * rt_gate)1057 mesh_transmit_to_gate(struct ieee80211vap *vap, struct mbuf *m,
1058     struct ieee80211_mesh_route *rt_gate)
1059 {
1060 	struct ifnet *ifp = vap->iv_ifp;
1061 	struct ieee80211_node *ni;
1062 
1063 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1064 
1065 	ni = ieee80211_mesh_find_txnode(vap, rt_gate->rt_dest);
1066 	if (ni == NULL) {
1067 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1068 		m_freem(m);
1069 		return;
1070 	}
1071 
1072 	/*
1073 	 * Send through the VAP packet transmit path.
1074 	 * This consumes the node ref grabbed above and
1075 	 * the mbuf, regardless of whether there's a problem
1076 	 * or not.
1077 	 */
1078 	(void) ieee80211_vap_pkt_send_dest(vap, m, ni);
1079 }
1080 
1081 /*
1082  * Forward the queued frames to known valid mesh gates.
1083  * Assume destination to be outside the MBSS (i.e. proxy entry),
1084  * If no valid mesh gates are known silently discard queued frames.
1085  * After transmitting frames to all known valid mesh gates, this route
1086  * will be marked invalid, and a new path discovery will happen in the hopes
1087  * that (at least) one of the mesh gates have a new proxy entry for us to use.
1088  */
1089 void
ieee80211_mesh_forward_to_gates(struct ieee80211vap * vap,struct ieee80211_mesh_route * rt_dest)1090 ieee80211_mesh_forward_to_gates(struct ieee80211vap *vap,
1091     struct ieee80211_mesh_route *rt_dest)
1092 {
1093 	struct ieee80211com *ic = vap->iv_ic;
1094 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1095 	struct ieee80211_mesh_route *rt_gate;
1096 	struct ieee80211_mesh_gate_route *gr = NULL, *gr_next;
1097 	struct mbuf *m, *mcopy, *next;
1098 
1099 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1100 
1101 	KASSERT( rt_dest->rt_flags == IEEE80211_MESHRT_FLAGS_DISCOVER,
1102 	    ("Route is not marked with IEEE80211_MESHRT_FLAGS_DISCOVER"));
1103 
1104 	/* XXX: send to more than one valid mash gate */
1105 	MESH_RT_LOCK(ms);
1106 
1107 	m = ieee80211_ageq_remove(&ic->ic_stageq,
1108 	    (struct ieee80211_node *)(uintptr_t)
1109 	    ieee80211_mac_hash(ic, rt_dest->rt_dest));
1110 
1111 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, gr_next) {
1112 		rt_gate = gr->gr_route;
1113 		if (rt_gate == NULL) {
1114 #if defined(__DragonFly__)
1115 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1116 				rt_dest->rt_dest,
1117 				"mesh gate with no path %s",
1118 				ether_sprintf(gr->gr_addr));
1119 #else
1120 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1121 				"mesh gate with no path %6D",
1122 				gr->gr_addr, ":");
1123 #endif
1124 			continue;
1125 		}
1126 		if ((rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0)
1127 			continue;
1128 		KASSERT(rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_GATE,
1129 		    ("route not marked as a mesh gate"));
1130 		KASSERT((rt_gate->rt_flags &
1131 			IEEE80211_MESHRT_FLAGS_PROXY) == 0,
1132 			("found mesh gate that is also marked porxy"));
1133 		/*
1134 		 * convert route to a proxy route gated by the current
1135 		 * mesh gate, this is needed so encap can built data
1136 		 * frame with correct address.
1137 		 */
1138 		rt_dest->rt_flags = IEEE80211_MESHRT_FLAGS_PROXY |
1139 			IEEE80211_MESHRT_FLAGS_VALID;
1140 		rt_dest->rt_ext_seq = 1; /* random value */
1141 		IEEE80211_ADDR_COPY(rt_dest->rt_mesh_gate, rt_gate->rt_dest);
1142 		IEEE80211_ADDR_COPY(rt_dest->rt_nexthop, rt_gate->rt_nexthop);
1143 		rt_dest->rt_metric = rt_gate->rt_metric;
1144 		rt_dest->rt_nhops = rt_gate->rt_nhops;
1145 		ieee80211_mesh_rt_update(rt_dest, ms->ms_ppath->mpp_inact);
1146 		MESH_RT_UNLOCK(ms);
1147 		/* XXX: lock?? */
1148 		mcopy = m_dup(m, M_NOWAIT);
1149 		for (; mcopy != NULL; mcopy = next) {
1150 			next = mcopy->m_nextpkt;
1151 			mcopy->m_nextpkt = NULL;
1152 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP,
1153 			    rt_dest->rt_dest,
1154 			    "flush queued frame %p len %d", mcopy,
1155 			    mcopy->m_pkthdr.len);
1156 			mesh_transmit_to_gate(vap, mcopy, rt_gate);
1157 		}
1158 		MESH_RT_LOCK(ms);
1159 	}
1160 	rt_dest->rt_flags = 0; /* Mark invalid */
1161 	m_freem(m);
1162 	MESH_RT_UNLOCK(ms);
1163 }
1164 
1165 /*
1166  * Forward the specified frame.
1167  * Decrement the TTL and set TA to our MAC address.
1168  */
1169 static void
mesh_forward(struct ieee80211vap * vap,struct mbuf * m,const struct ieee80211_meshcntl * mc)1170 mesh_forward(struct ieee80211vap *vap, struct mbuf *m,
1171     const struct ieee80211_meshcntl *mc)
1172 {
1173 	struct ieee80211com *ic = vap->iv_ic;
1174 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1175 	struct ifnet *ifp = vap->iv_ifp;
1176 	const struct ieee80211_frame *wh =
1177 	    mtod(m, const struct ieee80211_frame *);
1178 	struct mbuf *mcopy;
1179 	struct ieee80211_meshcntl *mccopy;
1180 	struct ieee80211_frame *whcopy;
1181 	struct ieee80211_node *ni;
1182 	int err;
1183 
1184 	/* This is called from the RX path - don't hold this lock */
1185 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1186 
1187 	/*
1188 	 * mesh ttl of 1 means we are the last one receiving it,
1189 	 * according to amendment we decrement and then check if
1190 	 * 0, if so we dont forward.
1191 	 */
1192 	if (mc->mc_ttl < 1) {
1193 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1194 		    "%s", "frame not fwd'd, ttl 1");
1195 		vap->iv_stats.is_mesh_fwd_ttl++;
1196 		return;
1197 	}
1198 	if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
1199 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1200 		    "%s", "frame not fwd'd, fwding disabled");
1201 		vap->iv_stats.is_mesh_fwd_disabled++;
1202 		return;
1203 	}
1204 	mcopy = m_dup(m, M_NOWAIT);
1205 	if (mcopy == NULL) {
1206 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1207 		    "%s", "frame not fwd'd, cannot dup");
1208 		vap->iv_stats.is_mesh_fwd_nobuf++;
1209 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1210 		return;
1211 	}
1212 	mcopy = m_pullup(mcopy, ieee80211_hdrspace(ic, wh) +
1213 	    sizeof(struct ieee80211_meshcntl));
1214 	if (mcopy == NULL) {
1215 		IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1216 		    "%s", "frame not fwd'd, too short");
1217 		vap->iv_stats.is_mesh_fwd_tooshort++;
1218 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1219 		m_freem(mcopy);
1220 		return;
1221 	}
1222 	whcopy = mtod(mcopy, struct ieee80211_frame *);
1223 	mccopy = (struct ieee80211_meshcntl *)
1224 	    (mtod(mcopy, uint8_t *) + ieee80211_hdrspace(ic, wh));
1225 	/* XXX clear other bits? */
1226 	whcopy->i_fc[1] &= ~IEEE80211_FC1_RETRY;
1227 	IEEE80211_ADDR_COPY(whcopy->i_addr2, vap->iv_myaddr);
1228 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1229 		ni = ieee80211_ref_node(vap->iv_bss);
1230 		mcopy->m_flags |= M_MCAST;
1231 	} else {
1232 		ni = ieee80211_mesh_find_txnode(vap, whcopy->i_addr3);
1233 		if (ni == NULL) {
1234 			/*
1235 			 * [Optional] any of the following three actions:
1236 			 * o silently discard
1237 			 * o trigger a path discovery
1238 			 * o inform TA that meshDA is unknown.
1239 			 */
1240 			IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
1241 			    "%s", "frame not fwd'd, no path");
1242 			ms->ms_ppath->mpp_senderror(vap, whcopy->i_addr3, NULL,
1243 			    IEEE80211_REASON_MESH_PERR_NO_FI);
1244 			vap->iv_stats.is_mesh_fwd_nopath++;
1245 			m_freem(mcopy);
1246 			return;
1247 		}
1248 		IEEE80211_ADDR_COPY(whcopy->i_addr1, ni->ni_macaddr);
1249 	}
1250 	KASSERT(mccopy->mc_ttl > 0, ("%s called with wrong ttl", __func__));
1251 	mccopy->mc_ttl--;
1252 
1253 	/* XXX calculate priority so drivers can find the tx queue */
1254 	M_WME_SETAC(mcopy, WME_AC_BE);
1255 
1256 	/* XXX do we know m_nextpkt is NULL? */
1257 	mcopy->m_pkthdr.rcvif = (void *) ni;
1258 
1259 	/*
1260 	 * XXX this bypasses all of the VAP TX handling; it passes frames
1261 	 * directly to the parent interface.
1262 	 *
1263 	 * Because of this, there's no TX lock being held as there's no
1264 	 * encaps state being used.
1265 	 *
1266 	 * Doing a direct parent transmit may not be the correct thing
1267 	 * to do here; we'll have to re-think this soon.
1268 	 */
1269 	IEEE80211_TX_LOCK(ic);
1270 	err = ieee80211_parent_xmitpkt(ic, mcopy);
1271 	IEEE80211_TX_UNLOCK(ic);
1272 	if (!err)
1273 		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1274 }
1275 
1276 static struct mbuf *
mesh_decap(struct ieee80211vap * vap,struct mbuf * m,int hdrlen,int meshdrlen)1277 mesh_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen, int meshdrlen)
1278 {
1279 #define	WHDIR(wh)	((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK)
1280 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1281 	uint8_t b[sizeof(struct ieee80211_qosframe_addr4) +
1282 		  sizeof(struct ieee80211_meshcntl_ae10)];
1283 	const struct ieee80211_qosframe_addr4 *wh;
1284 	const struct ieee80211_meshcntl_ae10 *mc;
1285 	struct ether_header *eh;
1286 	struct llc *llc;
1287 	int ae;
1288 
1289 	if (m->m_len < hdrlen + sizeof(*llc) &&
1290 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
1291 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
1292 		    "discard data frame: %s", "m_pullup failed");
1293 		vap->iv_stats.is_rx_tooshort++;
1294 		return NULL;
1295 	}
1296 	memcpy(b, mtod(m, caddr_t), hdrlen);
1297 	wh = (const struct ieee80211_qosframe_addr4 *)&b[0];
1298 	mc = (const struct ieee80211_meshcntl_ae10 *)&b[hdrlen - meshdrlen];
1299 	KASSERT(WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS ||
1300 		WHDIR(wh) == IEEE80211_FC1_DIR_DSTODS,
1301 	    ("bogus dir, fc 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1302 
1303 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
1304 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
1305 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
1306 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
1307 	    /* NB: preserve AppleTalk frames that have a native SNAP hdr */
1308 	    !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
1309 	      llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
1310 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
1311 		llc = NULL;
1312 	} else {
1313 		m_adj(m, hdrlen - sizeof(*eh));
1314 	}
1315 	eh = mtod(m, struct ether_header *);
1316 	ae = mc->mc_flags & IEEE80211_MESH_AE_MASK;
1317 	if (WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS) {
1318 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr1);
1319 		if (ae == IEEE80211_MESH_AE_00) {
1320 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr3);
1321 		} else if (ae == IEEE80211_MESH_AE_01) {
1322 			IEEE80211_ADDR_COPY(eh->ether_shost,
1323 			    MC01(mc)->mc_addr4);
1324 		} else {
1325 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1326 			    (const struct ieee80211_frame *)wh, NULL,
1327 			    "bad AE %d", ae);
1328 			vap->iv_stats.is_mesh_badae++;
1329 			m_freem(m);
1330 			return NULL;
1331 		}
1332 	} else {
1333 		if (ae == IEEE80211_MESH_AE_00) {
1334 			IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr3);
1335 			IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr4);
1336 		} else if (ae == IEEE80211_MESH_AE_10) {
1337 			IEEE80211_ADDR_COPY(eh->ether_dhost, mc->mc_addr5);
1338 			IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr6);
1339 		} else {
1340 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1341 			    (const struct ieee80211_frame *)wh, NULL,
1342 			    "bad AE %d", ae);
1343 			vap->iv_stats.is_mesh_badae++;
1344 			m_freem(m);
1345 			return NULL;
1346 		}
1347 	}
1348 #ifndef __NO_STRICT_ALIGNMENT
1349 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
1350 		m = ieee80211_realign(vap, m, sizeof(*eh));
1351 		if (m == NULL)
1352 			return NULL;
1353 	}
1354 #endif /* !__NO_STRICT_ALIGNMENT */
1355 	if (llc != NULL) {
1356 		eh = mtod(m, struct ether_header *);
1357 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
1358 	}
1359 	return m;
1360 #undef	WDIR
1361 #undef	MC01
1362 }
1363 
1364 /*
1365  * Return non-zero if the unicast mesh data frame should be processed
1366  * locally.  Frames that are not proxy'd have our address, otherwise
1367  * we need to consult the routing table to look for a proxy entry.
1368  */
1369 static __inline int
mesh_isucastforme(struct ieee80211vap * vap,const struct ieee80211_frame * wh,const struct ieee80211_meshcntl * mc)1370 mesh_isucastforme(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
1371     const struct ieee80211_meshcntl *mc)
1372 {
1373 	int ae = mc->mc_flags & 3;
1374 
1375 	KASSERT((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS,
1376 	    ("bad dir 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1377 	KASSERT(ae == IEEE80211_MESH_AE_00 || ae == IEEE80211_MESH_AE_10,
1378 	    ("bad AE %d", ae));
1379 	if (ae == IEEE80211_MESH_AE_10) {	/* ucast w/ proxy */
1380 		const struct ieee80211_meshcntl_ae10 *mc10 =
1381 		    (const struct ieee80211_meshcntl_ae10 *) mc;
1382 		struct ieee80211_mesh_route *rt =
1383 		    ieee80211_mesh_rt_find(vap, mc10->mc_addr5);
1384 		/* check for proxy route to ourself */
1385 		return (rt != NULL &&
1386 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY));
1387 	} else					/* ucast w/o proxy */
1388 		return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
1389 }
1390 
1391 /*
1392  * Verifies transmitter, updates lifetime, precursor list and forwards data.
1393  * > 0 means we have forwarded data and no need to process locally
1394  * == 0 means we want to process locally (and we may have forwarded data
1395  * < 0 means there was an error and data should be discarded
1396  */
1397 static int
mesh_recv_indiv_data_to_fwrd(struct ieee80211vap * vap,struct mbuf * m,struct ieee80211_frame * wh,const struct ieee80211_meshcntl * mc)1398 mesh_recv_indiv_data_to_fwrd(struct ieee80211vap *vap, struct mbuf *m,
1399     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1400 {
1401 	struct ieee80211_qosframe_addr4 *qwh;
1402 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1403 	struct ieee80211_mesh_route *rt_meshda, *rt_meshsa;
1404 
1405 	/* This is called from the RX path - don't hold this lock */
1406 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1407 
1408 	qwh = (struct ieee80211_qosframe_addr4 *)wh;
1409 
1410 	/*
1411 	 * TODO:
1412 	 * o verify addr2 is  a legitimate transmitter
1413 	 * o lifetime of precursor of addr3 (addr2) is max(init, curr)
1414 	 * o lifetime of precursor of addr4 (nexthop) is max(init, curr)
1415 	 */
1416 
1417 	/* set lifetime of addr3 (meshDA) to initial value */
1418 	rt_meshda = ieee80211_mesh_rt_find(vap, qwh->i_addr3);
1419 	if (rt_meshda == NULL) {
1420 #if defined(__DragonFly__)
1421 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, qwh->i_addr2,
1422 		    "no route to meshDA(%s)", ether_sprintf(qwh->i_addr3));
1423 #else
1424 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, qwh->i_addr2,
1425 		    "no route to meshDA(%6D)", qwh->i_addr3, ":");
1426 #endif
1427 		/*
1428 		 * [Optional] any of the following three actions:
1429 		 * o silently discard 				[X]
1430 		 * o trigger a path discovery			[ ]
1431 		 * o inform TA that meshDA is unknown.		[ ]
1432 		 */
1433 		/* XXX: stats */
1434 		return (-1);
1435 	}
1436 
1437 	ieee80211_mesh_rt_update(rt_meshda, ticks_to_msecs(
1438 	    ms->ms_ppath->mpp_inact));
1439 
1440 	/* set lifetime of addr4 (meshSA) to initial value */
1441 	rt_meshsa = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
1442 	KASSERT(rt_meshsa != NULL, ("no route"));
1443 	ieee80211_mesh_rt_update(rt_meshsa, ticks_to_msecs(
1444 	    ms->ms_ppath->mpp_inact));
1445 
1446 	mesh_forward(vap, m, mc);
1447 	return (1); /* dont process locally */
1448 }
1449 
1450 /*
1451  * Verifies transmitter, updates lifetime, precursor list and process data
1452  * locally, if data is proxy with AE = 10 it could mean data should go
1453  * on another mesh path or data should be forwarded to the DS.
1454  *
1455  * > 0 means we have forwarded data and no need to process locally
1456  * == 0 means we want to process locally (and we may have forwarded data
1457  * < 0 means there was an error and data should be discarded
1458  */
1459 static int
mesh_recv_indiv_data_to_me(struct ieee80211vap * vap,struct mbuf * m,struct ieee80211_frame * wh,const struct ieee80211_meshcntl * mc)1460 mesh_recv_indiv_data_to_me(struct ieee80211vap *vap, struct mbuf *m,
1461     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1462 {
1463 	struct ieee80211_qosframe_addr4 *qwh;
1464 	const struct ieee80211_meshcntl_ae10 *mc10;
1465 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1466 	struct ieee80211_mesh_route *rt;
1467 	int ae;
1468 
1469 	/* This is called from the RX path - don't hold this lock */
1470 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1471 
1472 	qwh = (struct ieee80211_qosframe_addr4 *)wh;
1473 	mc10 = (const struct ieee80211_meshcntl_ae10 *)mc;
1474 
1475 	/*
1476 	 * TODO:
1477 	 * o verify addr2 is  a legitimate transmitter
1478 	 * o lifetime of precursor entry is max(init, curr)
1479 	 */
1480 
1481 	/* set lifetime of addr4 (meshSA) to initial value */
1482 	rt = ieee80211_mesh_rt_find(vap, qwh->i_addr4);
1483 	KASSERT(rt != NULL, ("no route"));
1484 	ieee80211_mesh_rt_update(rt, ticks_to_msecs(ms->ms_ppath->mpp_inact));
1485 	rt = NULL;
1486 
1487 	ae = mc10->mc_flags & IEEE80211_MESH_AE_MASK;
1488 	KASSERT(ae == IEEE80211_MESH_AE_00 ||
1489 	    ae == IEEE80211_MESH_AE_10, ("bad AE %d", ae));
1490 	if (ae == IEEE80211_MESH_AE_10) {
1491 		if (IEEE80211_ADDR_EQ(mc10->mc_addr5, qwh->i_addr3)) {
1492 			return (0); /* process locally */
1493 		}
1494 
1495 		rt =  ieee80211_mesh_rt_find(vap, mc10->mc_addr5);
1496 		if (rt != NULL &&
1497 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) &&
1498 		    (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) == 0) {
1499 			/*
1500 			 * Forward on another mesh-path, according to
1501 			 * amendment as specified in 9.32.4.1
1502 			 */
1503 			IEEE80211_ADDR_COPY(qwh->i_addr3, mc10->mc_addr5);
1504 			mesh_forward(vap, m,
1505 			    (const struct ieee80211_meshcntl *)mc10);
1506 			return (1); /* dont process locally */
1507 		}
1508 		/*
1509 		 * All other cases: forward of MSDUs from the MBSS to DS indiv.
1510 		 * addressed according to 13.11.3.2.
1511 		 */
1512 #if defined(__DragonFly__)
1513 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_OUTPUT, qwh->i_addr2,
1514 		    "forward frame to DS, SA(%s) DA(%s)",
1515 		    ether_sprintf(mc10->mc_addr6),
1516 		    ether_sprintf(mc10->mc_addr5));
1517 #else
1518 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_OUTPUT, qwh->i_addr2,
1519 		    "forward frame to DS, SA(%6D) DA(%6D)",
1520 		    mc10->mc_addr6, ":", mc10->mc_addr5, ":");
1521 #endif
1522 	}
1523 	return (0); /* process locally */
1524 }
1525 
1526 /*
1527  * Try to forward the group addressed data on to other mesh STAs, and
1528  * also to the DS.
1529  *
1530  * > 0 means we have forwarded data and no need to process locally
1531  * == 0 means we want to process locally (and we may have forwarded data
1532  * < 0 means there was an error and data should be discarded
1533  */
1534 static int
mesh_recv_group_data(struct ieee80211vap * vap,struct mbuf * m,struct ieee80211_frame * wh,const struct ieee80211_meshcntl * mc)1535 mesh_recv_group_data(struct ieee80211vap *vap, struct mbuf *m,
1536     struct ieee80211_frame *wh, const struct ieee80211_meshcntl *mc)
1537 {
1538 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1539 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1540 
1541 	/* This is called from the RX path - don't hold this lock */
1542 	IEEE80211_TX_UNLOCK_ASSERT(vap->iv_ic);
1543 
1544 	mesh_forward(vap, m, mc);
1545 
1546 	if(mc->mc_ttl > 0) {
1547 		if (mc->mc_flags & IEEE80211_MESH_AE_01) {
1548 			/*
1549 			 * Forward of MSDUs from the MBSS to DS group addressed
1550 			 * (according to 13.11.3.2)
1551 			 * This happens by delivering the packet, and a bridge
1552 			 * will sent it on another port member.
1553 			 */
1554 			if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE &&
1555 			    ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
1556 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH,
1557 				    MC01(mc)->mc_addr4, "%s",
1558 				    "forward from MBSS to the DS");
1559 		}
1560 	}
1561 	return (0); /* process locally */
1562 #undef	MC01
1563 }
1564 
1565 static int
mesh_input(struct ieee80211_node * ni,struct mbuf * m,const struct ieee80211_rx_stats * rxs,int rssi,int nf)1566 mesh_input(struct ieee80211_node *ni, struct mbuf *m,
1567     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1568 {
1569 #define	HAS_SEQ(type)	((type & 0x4) == 0)
1570 #define	MC01(mc)	((const struct ieee80211_meshcntl_ae01 *)mc)
1571 #define	MC10(mc)	((const struct ieee80211_meshcntl_ae10 *)mc)
1572 	struct ieee80211vap *vap = ni->ni_vap;
1573 	struct ieee80211com *ic = ni->ni_ic;
1574 	struct ifnet *ifp = vap->iv_ifp;
1575 	struct ieee80211_frame *wh;
1576 	const struct ieee80211_meshcntl *mc;
1577 	int hdrspace, meshdrlen, need_tap, error;
1578 	uint8_t dir, type, subtype, ae;
1579 	uint32_t seq;
1580 	const uint8_t *addr;
1581 	uint8_t qos[2];
1582 
1583 	KASSERT(ni != NULL, ("null node"));
1584 	ni->ni_inact = ni->ni_inact_reload;
1585 
1586 	need_tap = 1;			/* mbuf need to be tapped. */
1587 	type = -1;			/* undefined */
1588 
1589 	/* This is called from the RX path - don't hold this lock */
1590 	IEEE80211_TX_UNLOCK_ASSERT(ic);
1591 
1592 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
1593 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1594 		    ni->ni_macaddr, NULL,
1595 		    "too short (1): len %u", m->m_pkthdr.len);
1596 		vap->iv_stats.is_rx_tooshort++;
1597 		goto out;
1598 	}
1599 	/*
1600 	 * Bit of a cheat here, we use a pointer for a 3-address
1601 	 * frame format but don't reference fields past outside
1602 	 * ieee80211_frame_min w/o first validating the data is
1603 	 * present.
1604 	*/
1605 	wh = mtod(m, struct ieee80211_frame *);
1606 
1607 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1608 	    IEEE80211_FC0_VERSION_0) {
1609 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1610 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
1611 		vap->iv_stats.is_rx_badversion++;
1612 		goto err;
1613 	}
1614 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1615 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1616 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1617 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1618 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1619 		ni->ni_noise = nf;
1620 		if (HAS_SEQ(type)) {
1621 			uint8_t tid = ieee80211_gettid(wh);
1622 
1623 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
1624 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
1625 				ic->ic_wme.wme_hipri_traffic++;
1626 			if (! ieee80211_check_rxseq(ni, wh, wh->i_addr1))
1627 				goto out;
1628 		}
1629 	}
1630 #ifdef IEEE80211_DEBUG
1631 	/*
1632 	 * It's easier, but too expensive, to simulate different mesh
1633 	 * topologies by consulting the ACL policy very early, so do this
1634 	 * only under DEBUG.
1635 	 *
1636 	 * NB: this check is also done upon peering link initiation.
1637 	 */
1638 	if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1639 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1640 		    wh, NULL, "%s", "disallowed by ACL");
1641 		vap->iv_stats.is_rx_acl++;
1642 		goto out;
1643 	}
1644 #endif
1645 	switch (type) {
1646 	case IEEE80211_FC0_TYPE_DATA:
1647 		if (ni == vap->iv_bss)
1648 			goto out;
1649 		if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
1650 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1651 			    ni->ni_macaddr, NULL,
1652 			    "peer link not yet established (%d)",
1653 			    ni->ni_mlstate);
1654 			vap->iv_stats.is_mesh_nolink++;
1655 			goto out;
1656 		}
1657 		if (dir != IEEE80211_FC1_DIR_FROMDS &&
1658 		    dir != IEEE80211_FC1_DIR_DSTODS) {
1659 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1660 			    wh, "data", "incorrect dir 0x%x", dir);
1661 			vap->iv_stats.is_rx_wrongdir++;
1662 			goto err;
1663 		}
1664 
1665 		/* All Mesh data frames are QoS subtype */
1666 		if (!HAS_SEQ(type)) {
1667 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1668 			    wh, "data", "incorrect subtype 0x%x", subtype);
1669 			vap->iv_stats.is_rx_badsubtype++;
1670 			goto err;
1671 		}
1672 
1673 		/*
1674 		 * Next up, any fragmentation.
1675 		 * XXX: we defrag before we even try to forward,
1676 		 * Mesh Control field is not present in sub-sequent
1677 		 * fragmented frames. This is in contrast to Draft 4.0.
1678 		 */
1679 		hdrspace = ieee80211_hdrspace(ic, wh);
1680 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1681 			m = ieee80211_defrag(ni, m, hdrspace);
1682 			if (m == NULL) {
1683 				/* Fragment dropped or frame not complete yet */
1684 				goto out;
1685 			}
1686 		}
1687 		wh = mtod(m, struct ieee80211_frame *); /* NB: after defrag */
1688 
1689 		/*
1690 		 * Now we have a complete Mesh Data frame.
1691 		 */
1692 
1693 		/*
1694 		 * Only fromDStoDS data frames use 4 address qos frames
1695 		 * as specified in amendment. Otherwise addr4 is located
1696 		 * in the Mesh Control field and a 3 address qos frame
1697 		 * is used.
1698 		 */
1699 		if (IEEE80211_IS_DSTODS(wh))
1700 			*(uint16_t *)qos = *(uint16_t *)
1701 			    ((struct ieee80211_qosframe_addr4 *)wh)->i_qos;
1702 		else
1703 			*(uint16_t *)qos = *(uint16_t *)
1704 			    ((struct ieee80211_qosframe *)wh)->i_qos;
1705 
1706 		/*
1707 		 * NB: The mesh STA sets the Mesh Control Present
1708 		 * subfield to 1 in the Mesh Data frame containing
1709 		 * an unfragmented MSDU, an A-MSDU, or the first
1710 		 * fragment of an MSDU.
1711 		 * After defrag it should always be present.
1712 		 */
1713 		if (!(qos[1] & IEEE80211_QOS_MC)) {
1714 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1715 			    ni->ni_macaddr, NULL,
1716 			    "%s", "Mesh control field not present");
1717 			vap->iv_stats.is_rx_elem_missing++; /* XXX: kinda */
1718 			goto err;
1719 		}
1720 
1721 		/* pull up enough to get to the mesh control */
1722 		if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
1723 		    (m = m_pullup(m, hdrspace +
1724 		        sizeof(struct ieee80211_meshcntl))) == NULL) {
1725 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1726 			    ni->ni_macaddr, NULL,
1727 			    "data too short: expecting %u", hdrspace);
1728 			vap->iv_stats.is_rx_tooshort++;
1729 			goto out;		/* XXX */
1730 		}
1731 		/*
1732 		 * Now calculate the full extent of the headers. Note
1733 		 * mesh_decap will pull up anything we didn't get
1734 		 * above when it strips the 802.11 headers.
1735 		 */
1736 		mc = (const struct ieee80211_meshcntl *)
1737 		    (mtod(m, const uint8_t *) + hdrspace);
1738 		ae = mc->mc_flags & IEEE80211_MESH_AE_MASK;
1739 		meshdrlen = sizeof(struct ieee80211_meshcntl) +
1740 		    ae * IEEE80211_ADDR_LEN;
1741 		hdrspace += meshdrlen;
1742 
1743 		/* pull complete hdrspace = ieee80211_hdrspace + meshcontrol */
1744 		if ((meshdrlen > sizeof(struct ieee80211_meshcntl)) &&
1745 		    (m->m_len < hdrspace) &&
1746 		    ((m = m_pullup(m, hdrspace)) == NULL)) {
1747 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1748 			    ni->ni_macaddr, NULL,
1749 			    "data too short: expecting %u", hdrspace);
1750 			vap->iv_stats.is_rx_tooshort++;
1751 			goto out;		/* XXX */
1752 		}
1753 		/* XXX: are we sure there is no reallocating after m_pullup? */
1754 
1755 		seq = le32dec(mc->mc_seq);
1756 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1757 			addr = wh->i_addr3;
1758 		else if (ae == IEEE80211_MESH_AE_01)
1759 			addr = MC01(mc)->mc_addr4;
1760 		else
1761 			addr = ((struct ieee80211_qosframe_addr4 *)wh)->i_addr4;
1762 		if (IEEE80211_ADDR_EQ(vap->iv_myaddr, addr)) {
1763 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1764 			    addr, "data", "%s", "not to me");
1765 			vap->iv_stats.is_rx_wrongbss++;	/* XXX kinda */
1766 			goto out;
1767 		}
1768 		if (mesh_checkpseq(vap, addr, seq) != 0) {
1769 			vap->iv_stats.is_rx_dup++;
1770 			goto out;
1771 		}
1772 
1773 		/* This code "routes" the frame to the right control path */
1774 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1775 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr3))
1776 				error =
1777 				    mesh_recv_indiv_data_to_me(vap, m, wh, mc);
1778 			else if (IEEE80211_IS_MULTICAST(wh->i_addr3))
1779 				error = mesh_recv_group_data(vap, m, wh, mc);
1780 			else
1781 				error = mesh_recv_indiv_data_to_fwrd(vap, m,
1782 				    wh, mc);
1783 		} else
1784 			error = mesh_recv_group_data(vap, m, wh, mc);
1785 		if (error < 0)
1786 			goto err;
1787 		else if (error > 0)
1788 			goto out;
1789 
1790 		if (ieee80211_radiotap_active_vap(vap))
1791 			ieee80211_radiotap_rx(vap, m);
1792 		need_tap = 0;
1793 
1794 		/*
1795 		 * Finally, strip the 802.11 header.
1796 		 */
1797 		m = mesh_decap(vap, m, hdrspace, meshdrlen);
1798 		if (m == NULL) {
1799 			/* XXX mask bit to check for both */
1800 			/* don't count Null data frames as errors */
1801 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
1802 			    subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
1803 				goto out;
1804 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1805 			    ni->ni_macaddr, "data", "%s", "decap error");
1806 			vap->iv_stats.is_rx_decap++;
1807 			IEEE80211_NODE_STAT(ni, rx_decap);
1808 			goto err;
1809 		}
1810 		if (qos[0] & IEEE80211_QOS_AMSDU) {
1811 			m = ieee80211_decap_amsdu(ni, m);
1812 			if (m == NULL)
1813 				return IEEE80211_FC0_TYPE_DATA;
1814 		}
1815 		ieee80211_deliver_data(vap, ni, m);
1816 		return type;
1817 	case IEEE80211_FC0_TYPE_MGT:
1818 		vap->iv_stats.is_rx_mgmt++;
1819 		IEEE80211_NODE_STAT(ni, rx_mgmt);
1820 		if (dir != IEEE80211_FC1_DIR_NODS) {
1821 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1822 			    wh, "mgt", "incorrect dir 0x%x", dir);
1823 			vap->iv_stats.is_rx_wrongdir++;
1824 			goto err;
1825 		}
1826 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
1827 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1828 			    ni->ni_macaddr, "mgt", "too short: len %u",
1829 			    m->m_pkthdr.len);
1830 			vap->iv_stats.is_rx_tooshort++;
1831 			goto out;
1832 		}
1833 #ifdef IEEE80211_DEBUG
1834 		if ((ieee80211_msg_debug(vap) &&
1835 		    (vap->iv_ic->ic_flags & IEEE80211_F_SCAN)) ||
1836 		    ieee80211_msg_dumppkts(vap)) {
1837 			if_printf(ifp, "received %s from %s rssi %d\n",
1838 			    ieee80211_mgt_subtype_name(subtype),
1839 			    ether_sprintf(wh->i_addr2), rssi);
1840 		}
1841 #endif
1842 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1843 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1844 			    wh, NULL, "%s", "WEP set but not permitted");
1845 			vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
1846 			goto out;
1847 		}
1848 		vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
1849 		goto out;
1850 	case IEEE80211_FC0_TYPE_CTL:
1851 		vap->iv_stats.is_rx_ctl++;
1852 		IEEE80211_NODE_STAT(ni, rx_ctrl);
1853 		goto out;
1854 	default:
1855 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1856 		    wh, "bad", "frame type 0x%x", type);
1857 		/* should not come here */
1858 		break;
1859 	}
1860 err:
1861 	if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1862 out:
1863 	if (m != NULL) {
1864 		if (need_tap && ieee80211_radiotap_active_vap(vap))
1865 			ieee80211_radiotap_rx(vap, m);
1866 		m_freem(m);
1867 	}
1868 	return type;
1869 #undef	HAS_SEQ
1870 #undef	MC01
1871 #undef	MC10
1872 }
1873 
1874 static void
mesh_recv_mgmt(struct ieee80211_node * ni,struct mbuf * m0,int subtype,const struct ieee80211_rx_stats * rxs,int rssi,int nf)1875 mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
1876     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1877 {
1878 	struct ieee80211vap *vap = ni->ni_vap;
1879 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1880 	struct ieee80211com *ic = ni->ni_ic;
1881 	struct ieee80211_channel *rxchan = ic->ic_curchan;
1882 	struct ieee80211_frame *wh;
1883 	struct ieee80211_mesh_route *rt;
1884 	uint8_t *frm, *efrm;
1885 
1886 	wh = mtod(m0, struct ieee80211_frame *);
1887 	frm = (uint8_t *)&wh[1];
1888 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1889 	switch (subtype) {
1890 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1891 	case IEEE80211_FC0_SUBTYPE_BEACON:
1892 	{
1893 		struct ieee80211_scanparams scan;
1894 		struct ieee80211_channel *c;
1895 		/*
1896 		 * We process beacon/probe response
1897 		 * frames to discover neighbors.
1898 		 */
1899 		if (rxs != NULL) {
1900 			c = ieee80211_lookup_channel_rxstatus(vap, rxs);
1901 			if (c != NULL)
1902 				rxchan = c;
1903 		}
1904 		if (ieee80211_parse_beacon(ni, m0, rxchan, &scan) != 0)
1905 			return;
1906 		/*
1907 		 * Count frame now that we know it's to be processed.
1908 		 */
1909 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1910 			vap->iv_stats.is_rx_beacon++;	/* XXX remove */
1911 			IEEE80211_NODE_STAT(ni, rx_beacons);
1912 		} else
1913 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1914 		/*
1915 		 * If scanning, just pass information to the scan module.
1916 		 */
1917 		if (ic->ic_flags & IEEE80211_F_SCAN) {
1918 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1919 				/*
1920 				 * Actively scanning a channel marked passive;
1921 				 * send a probe request now that we know there
1922 				 * is 802.11 traffic present.
1923 				 *
1924 				 * XXX check if the beacon we recv'd gives
1925 				 * us what we need and suppress the probe req
1926 				 */
1927 				ieee80211_probe_curchan(vap, 1);
1928 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1929 			}
1930 			ieee80211_add_scan(vap, rxchan, &scan, wh,
1931 			    subtype, rssi, nf);
1932 			return;
1933 		}
1934 
1935 		/* The rest of this code assumes we are running */
1936 		if (vap->iv_state != IEEE80211_S_RUN)
1937 			return;
1938 		/*
1939 		 * Ignore non-mesh STAs.
1940 		 */
1941 		if ((scan.capinfo &
1942 		     (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) ||
1943 		    scan.meshid == NULL || scan.meshconf == NULL) {
1944 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1945 			    wh, "beacon", "%s", "not a mesh sta");
1946 			vap->iv_stats.is_mesh_wrongmesh++;
1947 			return;
1948 		}
1949 		/*
1950 		 * Ignore STAs for other mesh networks.
1951 		 */
1952 		if (memcmp(scan.meshid+2, ms->ms_id, ms->ms_idlen) != 0 ||
1953 		    mesh_verify_meshconf(vap, scan.meshconf)) {
1954 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1955 			    wh, "beacon", "%s", "not for our mesh");
1956 			vap->iv_stats.is_mesh_wrongmesh++;
1957 			return;
1958 		}
1959 		/*
1960 		 * Peer only based on the current ACL policy.
1961 		 */
1962 		if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1963 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1964 			    wh, NULL, "%s", "disallowed by ACL");
1965 			vap->iv_stats.is_rx_acl++;
1966 			return;
1967 		}
1968 		/*
1969 		 * Do neighbor discovery.
1970 		 */
1971 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
1972 			/*
1973 			 * Create a new entry in the neighbor table.
1974 			 */
1975 			ni = ieee80211_add_neighbor(vap, wh, &scan);
1976 		}
1977 		/*
1978 		 * Automatically peer with discovered nodes if possible.
1979 		 */
1980 		if (ni != vap->iv_bss &&
1981 		    (ms->ms_flags & IEEE80211_MESHFLAGS_AP)) {
1982 			switch (ni->ni_mlstate) {
1983 			case IEEE80211_NODE_MESH_IDLE:
1984 			{
1985 				uint16_t args[1];
1986 
1987 				/* Wait for backoff callout to reset counter */
1988 				if (ni->ni_mlhcnt >= ieee80211_mesh_maxholding)
1989 					return;
1990 
1991 				ni->ni_mlpid = mesh_generateid(vap);
1992 				if (ni->ni_mlpid == 0)
1993 					return;
1994 				mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENSNT);
1995 				args[0] = ni->ni_mlpid;
1996 				ieee80211_send_action(ni,
1997 				IEEE80211_ACTION_CAT_SELF_PROT,
1998 				IEEE80211_ACTION_MESHPEERING_OPEN, args);
1999 				ni->ni_mlrcnt = 0;
2000 				mesh_peer_timeout_setup(ni);
2001 				break;
2002 			}
2003 			case IEEE80211_NODE_MESH_ESTABLISHED:
2004 			{
2005 				/*
2006 				 * Valid beacon from a peer mesh STA
2007 				 * bump TA lifetime
2008 				 */
2009 				rt = ieee80211_mesh_rt_find(vap, wh->i_addr2);
2010 				if(rt != NULL) {
2011 					ieee80211_mesh_rt_update(rt,
2012 					    ticks_to_msecs(
2013 					    ms->ms_ppath->mpp_inact));
2014 				}
2015 				break;
2016 			}
2017 			default:
2018 				break; /* ignore */
2019 			}
2020 		}
2021 		break;
2022 	}
2023 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2024 	{
2025 		uint8_t *ssid, *meshid, *rates, *xrates;
2026 		uint8_t *sfrm;
2027 
2028 		if (vap->iv_state != IEEE80211_S_RUN) {
2029 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2030 			    wh, NULL, "wrong state %s",
2031 			    ieee80211_state_name[vap->iv_state]);
2032 			vap->iv_stats.is_rx_mgtdiscard++;
2033 			return;
2034 		}
2035 		if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2036 			/* frame must be directed */
2037 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2038 			    wh, NULL, "%s", "not unicast");
2039 			vap->iv_stats.is_rx_mgtdiscard++;	/* XXX stat */
2040 			return;
2041 		}
2042 		/*
2043 		 * prreq frame format
2044 		 *      [tlv] ssid
2045 		 *      [tlv] supported rates
2046 		 *      [tlv] extended supported rates
2047 		 *	[tlv] mesh id
2048 		 */
2049 		ssid = meshid = rates = xrates = NULL;
2050 		sfrm = frm;
2051 		while (efrm - frm > 1) {
2052 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2053 			switch (*frm) {
2054 			case IEEE80211_ELEMID_SSID:
2055 				ssid = frm;
2056 				break;
2057 			case IEEE80211_ELEMID_RATES:
2058 				rates = frm;
2059 				break;
2060 			case IEEE80211_ELEMID_XRATES:
2061 				xrates = frm;
2062 				break;
2063 			case IEEE80211_ELEMID_MESHID:
2064 				meshid = frm;
2065 				break;
2066 			}
2067 			frm += frm[1] + 2;
2068 		}
2069 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2070 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2071 		if (xrates != NULL)
2072 			IEEE80211_VERIFY_ELEMENT(xrates,
2073 			    IEEE80211_RATE_MAXSIZE - rates[1], return);
2074 		if (meshid != NULL) {
2075 			IEEE80211_VERIFY_ELEMENT(meshid,
2076 			    IEEE80211_MESHID_LEN, return);
2077 			/* NB: meshid, not ssid */
2078 			IEEE80211_VERIFY_SSID(vap->iv_bss, meshid, return);
2079 		}
2080 
2081 		/* XXX find a better class or define it's own */
2082 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
2083 		    "%s", "recv probe req");
2084 		/*
2085 		 * Some legacy 11b clients cannot hack a complete
2086 		 * probe response frame.  When the request includes
2087 		 * only a bare-bones rate set, communicate this to
2088 		 * the transmit side.
2089 		 */
2090 		ieee80211_send_proberesp(vap, wh->i_addr2, 0);
2091 		break;
2092 	}
2093 
2094 	case IEEE80211_FC0_SUBTYPE_ACTION:
2095 	case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2096 		if (ni == vap->iv_bss) {
2097 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2098 			    wh, NULL, "%s", "unknown node");
2099 			vap->iv_stats.is_rx_mgtdiscard++;
2100 		} else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2101 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2102 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2103 			    wh, NULL, "%s", "not for us");
2104 			vap->iv_stats.is_rx_mgtdiscard++;
2105 		} else if (vap->iv_state != IEEE80211_S_RUN) {
2106 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2107 			    wh, NULL, "wrong state %s",
2108 			    ieee80211_state_name[vap->iv_state]);
2109 			vap->iv_stats.is_rx_mgtdiscard++;
2110 		} else {
2111 			if (ieee80211_parse_action(ni, m0) == 0)
2112 				(void)ic->ic_recv_action(ni, wh, frm, efrm);
2113 		}
2114 		break;
2115 
2116 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2117 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2118 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2119 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2120 	case IEEE80211_FC0_SUBTYPE_TIMING_ADV:
2121 	case IEEE80211_FC0_SUBTYPE_ATIM:
2122 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
2123 	case IEEE80211_FC0_SUBTYPE_AUTH:
2124 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
2125 		IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2126 		    wh, NULL, "%s", "not handled");
2127 		vap->iv_stats.is_rx_mgtdiscard++;
2128 		break;
2129 
2130 	default:
2131 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2132 		    wh, "mgt", "subtype 0x%x not handled", subtype);
2133 		vap->iv_stats.is_rx_badsubtype++;
2134 		break;
2135 	}
2136 }
2137 
2138 static void
mesh_recv_ctl(struct ieee80211_node * ni,struct mbuf * m,int subtype)2139 mesh_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2140 {
2141 
2142 	switch (subtype) {
2143 	case IEEE80211_FC0_SUBTYPE_BAR:
2144 		ieee80211_recv_bar(ni, m);
2145 		break;
2146 	}
2147 }
2148 
2149 /*
2150  * Parse meshpeering action ie's for MPM frames
2151  */
2152 static const struct ieee80211_meshpeer_ie *
mesh_parse_meshpeering_action(struct ieee80211_node * ni,const struct ieee80211_frame * wh,const uint8_t * frm,const uint8_t * efrm,struct ieee80211_meshpeer_ie * mp,uint8_t subtype)2153 mesh_parse_meshpeering_action(struct ieee80211_node *ni,
2154 	const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
2155 	const uint8_t *frm, const uint8_t *efrm,
2156 	struct ieee80211_meshpeer_ie *mp, uint8_t subtype)
2157 {
2158 	struct ieee80211vap *vap = ni->ni_vap;
2159 	const struct ieee80211_meshpeer_ie *mpie;
2160 	uint16_t args[3];
2161 	const uint8_t *meshid, *meshconf, *meshpeer;
2162 	uint8_t sendclose = 0; /* 1 = MPM frame rejected, close will be sent */
2163 
2164 	meshid = meshconf = meshpeer = NULL;
2165 	while (efrm - frm > 1) {
2166 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return NULL);
2167 		switch (*frm) {
2168 		case IEEE80211_ELEMID_MESHID:
2169 			meshid = frm;
2170 			break;
2171 		case IEEE80211_ELEMID_MESHCONF:
2172 			meshconf = frm;
2173 			break;
2174 		case IEEE80211_ELEMID_MESHPEER:
2175 			meshpeer = frm;
2176 			mpie = (const struct ieee80211_meshpeer_ie *) frm;
2177 			memset(mp, 0, sizeof(*mp));
2178 			mp->peer_len = mpie->peer_len;
2179 			mp->peer_proto = le16dec(&mpie->peer_proto);
2180 			mp->peer_llinkid = le16dec(&mpie->peer_llinkid);
2181 			switch (subtype) {
2182 			case IEEE80211_ACTION_MESHPEERING_CONFIRM:
2183 				mp->peer_linkid =
2184 				    le16dec(&mpie->peer_linkid);
2185 				break;
2186 			case IEEE80211_ACTION_MESHPEERING_CLOSE:
2187 				/* NB: peer link ID is optional */
2188 				if (mpie->peer_len ==
2189 				    (IEEE80211_MPM_BASE_SZ + 2)) {
2190 					mp->peer_linkid = 0;
2191 					mp->peer_rcode =
2192 					    le16dec(&mpie->peer_linkid);
2193 				} else {
2194 					mp->peer_linkid =
2195 					    le16dec(&mpie->peer_linkid);
2196 					mp->peer_rcode =
2197 					    le16dec(&mpie->peer_rcode);
2198 				}
2199 				break;
2200 			}
2201 			break;
2202 		}
2203 		frm += frm[1] + 2;
2204 	}
2205 
2206 	/*
2207 	 * Verify the contents of the frame.
2208 	 * If it fails validation, close the peer link.
2209 	 */
2210 	if (mesh_verify_meshpeer(vap, subtype, (const uint8_t *)mp)) {
2211 		sendclose = 1;
2212 		IEEE80211_DISCARD(vap,
2213 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2214 		    wh, NULL, "%s", "MPM validation failed");
2215 	}
2216 
2217 	/* If meshid is not the same reject any frames type. */
2218 	if (sendclose == 0 && mesh_verify_meshid(vap, meshid)) {
2219 		sendclose = 1;
2220 		IEEE80211_DISCARD(vap,
2221 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2222 		    wh, NULL, "%s", "not for our mesh");
2223 		if (subtype == IEEE80211_ACTION_MESHPEERING_CLOSE) {
2224 			/*
2225 			 * Standard not clear about this, if we dont ignore
2226 			 * there will be an endless loop between nodes sending
2227 			 * CLOSE frames between each other with wrong meshid.
2228 			 * Discard and timers will bring FSM to IDLE state.
2229 			 */
2230 			return NULL;
2231 		}
2232 	}
2233 
2234 	/*
2235 	 * Close frames are accepted if meshid is the same.
2236 	 * Verify the other two types.
2237 	 */
2238 	if (sendclose == 0 && subtype != IEEE80211_ACTION_MESHPEERING_CLOSE &&
2239 	    mesh_verify_meshconf(vap, meshconf)) {
2240 		sendclose = 1;
2241 		IEEE80211_DISCARD(vap,
2242 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2243 		    wh, NULL, "%s", "configuration missmatch");
2244 	}
2245 
2246 	if (sendclose) {
2247 		vap->iv_stats.is_rx_mgtdiscard++;
2248 		switch (ni->ni_mlstate) {
2249 		case IEEE80211_NODE_MESH_IDLE:
2250 		case IEEE80211_NODE_MESH_ESTABLISHED:
2251 		case IEEE80211_NODE_MESH_HOLDING:
2252 			/* ignore */
2253 			break;
2254 		case IEEE80211_NODE_MESH_OPENSNT:
2255 		case IEEE80211_NODE_MESH_OPENRCV:
2256 		case IEEE80211_NODE_MESH_CONFIRMRCV:
2257 			args[0] = ni->ni_mlpid;
2258 			args[1] = ni->ni_mllid;
2259 			/* Reason codes for rejection */
2260 			switch (subtype) {
2261 			case IEEE80211_ACTION_MESHPEERING_OPEN:
2262 				args[2] = IEEE80211_REASON_MESH_CPVIOLATION;
2263 				break;
2264 			case IEEE80211_ACTION_MESHPEERING_CONFIRM:
2265 				args[2] = IEEE80211_REASON_MESH_INCONS_PARAMS;
2266 				break;
2267 			}
2268 			ieee80211_send_action(ni,
2269 			    IEEE80211_ACTION_CAT_SELF_PROT,
2270 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2271 			    args);
2272 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2273 			mesh_peer_timeout_setup(ni);
2274 			break;
2275 		}
2276 		return NULL;
2277 	}
2278 
2279 	return (const struct ieee80211_meshpeer_ie *) mp;
2280 }
2281 
2282 static int
mesh_recv_action_meshpeering_open(struct ieee80211_node * ni,const struct ieee80211_frame * wh,const uint8_t * frm,const uint8_t * efrm)2283 mesh_recv_action_meshpeering_open(struct ieee80211_node *ni,
2284 	const struct ieee80211_frame *wh,
2285 	const uint8_t *frm, const uint8_t *efrm)
2286 {
2287 	struct ieee80211vap *vap = ni->ni_vap;
2288 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2289 	struct ieee80211_meshpeer_ie ie;
2290 	const struct ieee80211_meshpeer_ie *meshpeer;
2291 	uint16_t args[3];
2292 
2293 	/* +2+2 for action + code + capabilites */
2294 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2, efrm, &ie,
2295 	    IEEE80211_ACTION_MESHPEERING_OPEN);
2296 	if (meshpeer == NULL) {
2297 		return 0;
2298 	}
2299 
2300 	/* XXX move up */
2301 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2302 	    "recv PEER OPEN, lid 0x%x", meshpeer->peer_llinkid);
2303 
2304 	switch (ni->ni_mlstate) {
2305 	case IEEE80211_NODE_MESH_IDLE:
2306 		/* Reject open request if reached our maximum neighbor count */
2307 		if (ms->ms_neighbors >= IEEE80211_MESH_MAX_NEIGHBORS) {
2308 			args[0] = meshpeer->peer_llinkid;
2309 			args[1] = 0;
2310 			args[2] = IEEE80211_REASON_MESH_MAX_PEERS;
2311 			ieee80211_send_action(ni,
2312 			    IEEE80211_ACTION_CAT_SELF_PROT,
2313 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2314 			    args);
2315 			/* stay in IDLE state */
2316 			return (0);
2317 		}
2318 		/* Open frame accepted */
2319 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
2320 		ni->ni_mllid = meshpeer->peer_llinkid;
2321 		ni->ni_mlpid = mesh_generateid(vap);
2322 		if (ni->ni_mlpid == 0)
2323 			return 0;		/* XXX */
2324 		args[0] = ni->ni_mlpid;
2325 		/* Announce we're open too... */
2326 		ieee80211_send_action(ni,
2327 		    IEEE80211_ACTION_CAT_SELF_PROT,
2328 		    IEEE80211_ACTION_MESHPEERING_OPEN, args);
2329 		/* ...and confirm the link. */
2330 		args[0] = ni->ni_mlpid;
2331 		args[1] = ni->ni_mllid;
2332 		ieee80211_send_action(ni,
2333 		    IEEE80211_ACTION_CAT_SELF_PROT,
2334 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2335 		    args);
2336 		mesh_peer_timeout_setup(ni);
2337 		break;
2338 	case IEEE80211_NODE_MESH_OPENRCV:
2339 		/* Wrong Link ID */
2340 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2341 			args[0] = ni->ni_mllid;
2342 			args[1] = ni->ni_mlpid;
2343 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2344 			ieee80211_send_action(ni,
2345 			    IEEE80211_ACTION_CAT_SELF_PROT,
2346 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2347 			    args);
2348 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2349 			mesh_peer_timeout_setup(ni);
2350 			break;
2351 		}
2352 		/* Duplicate open, confirm again. */
2353 		args[0] = ni->ni_mlpid;
2354 		args[1] = ni->ni_mllid;
2355 		ieee80211_send_action(ni,
2356 		    IEEE80211_ACTION_CAT_SELF_PROT,
2357 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2358 		    args);
2359 		break;
2360 	case IEEE80211_NODE_MESH_OPENSNT:
2361 		ni->ni_mllid = meshpeer->peer_llinkid;
2362 		mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
2363 		args[0] = ni->ni_mlpid;
2364 		args[1] = ni->ni_mllid;
2365 		ieee80211_send_action(ni,
2366 		    IEEE80211_ACTION_CAT_SELF_PROT,
2367 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2368 		    args);
2369 		/* NB: don't setup/clear any timeout */
2370 		break;
2371 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2372 		if (ni->ni_mlpid != meshpeer->peer_linkid ||
2373 		    ni->ni_mllid != meshpeer->peer_llinkid) {
2374 			args[0] = ni->ni_mlpid;
2375 			args[1] = ni->ni_mllid;
2376 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2377 			ieee80211_send_action(ni,
2378 			    IEEE80211_ACTION_CAT_SELF_PROT,
2379 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2380 			    args);
2381 			mesh_linkchange(ni,
2382 			    IEEE80211_NODE_MESH_HOLDING);
2383 			mesh_peer_timeout_setup(ni);
2384 			break;
2385 		}
2386 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
2387 		ni->ni_mllid = meshpeer->peer_llinkid;
2388 		args[0] = ni->ni_mlpid;
2389 		args[1] = ni->ni_mllid;
2390 		ieee80211_send_action(ni,
2391 		    IEEE80211_ACTION_CAT_SELF_PROT,
2392 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2393 		    args);
2394 		mesh_peer_timeout_stop(ni);
2395 		break;
2396 	case IEEE80211_NODE_MESH_ESTABLISHED:
2397 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2398 			args[0] = ni->ni_mllid;
2399 			args[1] = ni->ni_mlpid;
2400 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2401 			ieee80211_send_action(ni,
2402 			    IEEE80211_ACTION_CAT_SELF_PROT,
2403 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2404 			    args);
2405 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2406 			mesh_peer_timeout_setup(ni);
2407 			break;
2408 		}
2409 		args[0] = ni->ni_mlpid;
2410 		args[1] = ni->ni_mllid;
2411 		ieee80211_send_action(ni,
2412 		    IEEE80211_ACTION_CAT_SELF_PROT,
2413 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2414 		    args);
2415 		break;
2416 	case IEEE80211_NODE_MESH_HOLDING:
2417 		args[0] = ni->ni_mlpid;
2418 		args[1] = meshpeer->peer_llinkid;
2419 		/* Standard not clear about what the reaason code should be */
2420 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2421 		ieee80211_send_action(ni,
2422 		    IEEE80211_ACTION_CAT_SELF_PROT,
2423 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2424 		    args);
2425 		break;
2426 	}
2427 	return 0;
2428 }
2429 
2430 static int
mesh_recv_action_meshpeering_confirm(struct ieee80211_node * ni,const struct ieee80211_frame * wh,const uint8_t * frm,const uint8_t * efrm)2431 mesh_recv_action_meshpeering_confirm(struct ieee80211_node *ni,
2432 	const struct ieee80211_frame *wh,
2433 	const uint8_t *frm, const uint8_t *efrm)
2434 {
2435 	struct ieee80211vap *vap = ni->ni_vap;
2436 	struct ieee80211_meshpeer_ie ie;
2437 	const struct ieee80211_meshpeer_ie *meshpeer;
2438 	uint16_t args[3];
2439 
2440 	/* +2+2+2+2 for action + code + capabilites + status code + AID */
2441 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2+2+2, efrm, &ie,
2442 	    IEEE80211_ACTION_MESHPEERING_CONFIRM);
2443 	if (meshpeer == NULL) {
2444 		return 0;
2445 	}
2446 
2447 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2448 	    "recv PEER CONFIRM, local id 0x%x, peer id 0x%x",
2449 	    meshpeer->peer_llinkid, meshpeer->peer_linkid);
2450 
2451 	switch (ni->ni_mlstate) {
2452 	case IEEE80211_NODE_MESH_OPENRCV:
2453 		mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
2454 		mesh_peer_timeout_stop(ni);
2455 		break;
2456 	case IEEE80211_NODE_MESH_OPENSNT:
2457 		mesh_linkchange(ni, IEEE80211_NODE_MESH_CONFIRMRCV);
2458 		mesh_peer_timeout_setup(ni);
2459 		break;
2460 	case IEEE80211_NODE_MESH_HOLDING:
2461 		args[0] = ni->ni_mlpid;
2462 		args[1] = meshpeer->peer_llinkid;
2463 		/* Standard not clear about what the reaason code should be */
2464 		args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2465 		ieee80211_send_action(ni,
2466 		    IEEE80211_ACTION_CAT_SELF_PROT,
2467 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2468 		    args);
2469 		break;
2470 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2471 		if (ni->ni_mllid != meshpeer->peer_llinkid) {
2472 			args[0] = ni->ni_mlpid;
2473 			args[1] = ni->ni_mllid;
2474 			args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
2475 			ieee80211_send_action(ni,
2476 			    IEEE80211_ACTION_CAT_SELF_PROT,
2477 			    IEEE80211_ACTION_MESHPEERING_CLOSE,
2478 			    args);
2479 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2480 			mesh_peer_timeout_setup(ni);
2481 		}
2482 		break;
2483 	default:
2484 		IEEE80211_DISCARD(vap,
2485 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2486 		    wh, NULL, "received confirm in invalid state %d",
2487 		    ni->ni_mlstate);
2488 		vap->iv_stats.is_rx_mgtdiscard++;
2489 		break;
2490 	}
2491 	return 0;
2492 }
2493 
2494 static int
mesh_recv_action_meshpeering_close(struct ieee80211_node * ni,const struct ieee80211_frame * wh,const uint8_t * frm,const uint8_t * efrm)2495 mesh_recv_action_meshpeering_close(struct ieee80211_node *ni,
2496 	const struct ieee80211_frame *wh,
2497 	const uint8_t *frm, const uint8_t *efrm)
2498 {
2499 	struct ieee80211_meshpeer_ie ie;
2500 	const struct ieee80211_meshpeer_ie *meshpeer;
2501 	uint16_t args[3];
2502 
2503 	/* +2 for action + code */
2504 	meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2, efrm, &ie,
2505 	    IEEE80211_ACTION_MESHPEERING_CLOSE);
2506 	if (meshpeer == NULL) {
2507 		return 0;
2508 	}
2509 
2510 	/*
2511 	 * XXX: check reason code, for example we could receive
2512 	 * IEEE80211_REASON_MESH_MAX_PEERS then we should not attempt
2513 	 * to peer again.
2514 	 */
2515 
2516 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2517 	    ni, "%s", "recv PEER CLOSE");
2518 
2519 	switch (ni->ni_mlstate) {
2520 	case IEEE80211_NODE_MESH_IDLE:
2521 		/* ignore */
2522 		break;
2523 	case IEEE80211_NODE_MESH_OPENRCV:
2524 	case IEEE80211_NODE_MESH_OPENSNT:
2525 	case IEEE80211_NODE_MESH_CONFIRMRCV:
2526 	case IEEE80211_NODE_MESH_ESTABLISHED:
2527 		args[0] = ni->ni_mlpid;
2528 		args[1] = ni->ni_mllid;
2529 		args[2] = IEEE80211_REASON_MESH_CLOSE_RCVD;
2530 		ieee80211_send_action(ni,
2531 		    IEEE80211_ACTION_CAT_SELF_PROT,
2532 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2533 		    args);
2534 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2535 		mesh_peer_timeout_setup(ni);
2536 		break;
2537 	case IEEE80211_NODE_MESH_HOLDING:
2538 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
2539 		mesh_peer_timeout_stop(ni);
2540 		break;
2541 	}
2542 	return 0;
2543 }
2544 
2545 /*
2546  * Link Metric handling.
2547  */
2548 static int
mesh_recv_action_meshlmetric(struct ieee80211_node * ni,const struct ieee80211_frame * wh,const uint8_t * frm,const uint8_t * efrm)2549 mesh_recv_action_meshlmetric(struct ieee80211_node *ni,
2550 	const struct ieee80211_frame *wh,
2551 	const uint8_t *frm, const uint8_t *efrm)
2552 {
2553 	const struct ieee80211_meshlmetric_ie *ie =
2554 	    (const struct ieee80211_meshlmetric_ie *)
2555 	    (frm+2); /* action + code */
2556 	struct ieee80211_meshlmetric_ie lm_rep;
2557 
2558 	if (ie->lm_flags & IEEE80211_MESH_LMETRIC_FLAGS_REQ) {
2559 		lm_rep.lm_flags = 0;
2560 		lm_rep.lm_metric = mesh_airtime_calc(ni);
2561 		ieee80211_send_action(ni,
2562 		    IEEE80211_ACTION_CAT_MESH,
2563 		    IEEE80211_ACTION_MESH_LMETRIC,
2564 		    &lm_rep);
2565 	}
2566 	/* XXX: else do nothing for now */
2567 	return 0;
2568 }
2569 
2570 /*
2571  * Parse meshgate action ie's for GANN frames.
2572  * Returns -1 if parsing fails, otherwise 0.
2573  */
2574 static int
mesh_parse_meshgate_action(struct ieee80211_node * ni,const struct ieee80211_frame * wh,struct ieee80211_meshgann_ie * ie,const uint8_t * frm,const uint8_t * efrm)2575 mesh_parse_meshgate_action(struct ieee80211_node *ni,
2576     const struct ieee80211_frame *wh,	/* XXX for VERIFY_LENGTH */
2577     struct ieee80211_meshgann_ie *ie, const uint8_t *frm, const uint8_t *efrm)
2578 {
2579 	struct ieee80211vap *vap = ni->ni_vap;
2580 	const struct ieee80211_meshgann_ie *gannie;
2581 
2582 	while (efrm - frm > 1) {
2583 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return -1);
2584 		switch (*frm) {
2585 		case IEEE80211_ELEMID_MESHGANN:
2586 			gannie = (const struct ieee80211_meshgann_ie *) frm;
2587 			memset(ie, 0, sizeof(*ie));
2588 			ie->gann_ie = gannie->gann_ie;
2589 			ie->gann_len = gannie->gann_len;
2590 			ie->gann_flags = gannie->gann_flags;
2591 			ie->gann_hopcount = gannie->gann_hopcount;
2592 			ie->gann_ttl = gannie->gann_ttl;
2593 			IEEE80211_ADDR_COPY(ie->gann_addr, gannie->gann_addr);
2594 			ie->gann_seq = le32dec(&gannie->gann_seq);
2595 			ie->gann_interval = le16dec(&gannie->gann_interval);
2596 			break;
2597 		}
2598 		frm += frm[1] + 2;
2599 	}
2600 
2601 	return 0;
2602 }
2603 
2604 /*
2605  * Mesh Gate Announcement handling.
2606  */
2607 static int
mesh_recv_action_meshgate(struct ieee80211_node * ni,const struct ieee80211_frame * wh,const uint8_t * frm,const uint8_t * efrm)2608 mesh_recv_action_meshgate(struct ieee80211_node *ni,
2609 	const struct ieee80211_frame *wh,
2610 	const uint8_t *frm, const uint8_t *efrm)
2611 {
2612 	struct ieee80211vap *vap = ni->ni_vap;
2613 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2614 	struct ieee80211_mesh_gate_route *gr, *next;
2615 	struct ieee80211_mesh_route *rt_gate;
2616 	struct ieee80211_meshgann_ie pgann;
2617 	struct ieee80211_meshgann_ie ie;
2618 	int found = 0;
2619 
2620 	/* +2 for action + code */
2621 	if (mesh_parse_meshgate_action(ni, wh, &ie, frm+2, efrm) != 0) {
2622 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
2623 		    ni->ni_macaddr, NULL, "%s",
2624 		    "GANN parsing failed");
2625 		vap->iv_stats.is_rx_mgtdiscard++;
2626 		return (0);
2627 	}
2628 
2629 	if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ie.gann_addr))
2630 		return 0;
2631 
2632 #if defined(__DragonFly__)
2633 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ni->ni_macaddr,
2634 	    "received GANN, meshgate: %s (seq %u)",
2635 	    ether_sprintf(ie.gann_addr),
2636 	    ie.gann_seq);
2637 #else
2638 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ni->ni_macaddr,
2639 	    "received GANN, meshgate: %6D (seq %u)", ie.gann_addr, ":",
2640 	    ie.gann_seq);
2641 #endif
2642 
2643 	if (ms == NULL)
2644 		return (0);
2645 	MESH_RT_LOCK(ms);
2646 	TAILQ_FOREACH_SAFE(gr, &ms->ms_known_gates, gr_next, next) {
2647 		if (!IEEE80211_ADDR_EQ(gr->gr_addr, ie.gann_addr))
2648 			continue;
2649 		if (ie.gann_seq <= gr->gr_lastseq) {
2650 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
2651 			    ni->ni_macaddr, NULL,
2652 			    "GANN old seqno %u <= %u",
2653 			    ie.gann_seq, gr->gr_lastseq);
2654 			MESH_RT_UNLOCK(ms);
2655 			return (0);
2656 		}
2657 		/* corresponding mesh gate found & GANN accepted */
2658 		found = 1;
2659 		break;
2660 
2661 	}
2662 	if (found == 0) {
2663 		/* this GANN is from a new mesh Gate add it to known table. */
2664 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ie.gann_addr,
2665 		    "stored new GANN information, seq %u.", ie.gann_seq);
2666 #if defined(__DragonFly__)
2667 		gr = kmalloc(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
2668 		    M_80211_MESH_GT_RT, M_INTWAIT | M_ZERO);
2669 #else
2670 		gr = IEEE80211_MALLOC(ALIGN(sizeof(struct ieee80211_mesh_gate_route)),
2671 		    M_80211_MESH_GT_RT,
2672 		    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
2673 #endif
2674 		IEEE80211_ADDR_COPY(gr->gr_addr, ie.gann_addr);
2675 		TAILQ_INSERT_TAIL(&ms->ms_known_gates, gr, gr_next);
2676 	}
2677 	gr->gr_lastseq = ie.gann_seq;
2678 
2679 	/* check if we have a path to this gate */
2680 	rt_gate = mesh_rt_find_locked(ms, gr->gr_addr);
2681 	if (rt_gate != NULL &&
2682 	    rt_gate->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) {
2683 		gr->gr_route = rt_gate;
2684 		rt_gate->rt_flags |= IEEE80211_MESHRT_FLAGS_GATE;
2685 	}
2686 
2687 	MESH_RT_UNLOCK(ms);
2688 
2689 	/* popagate only if decremented ttl >= 1 && forwarding is enabled */
2690 	if ((ie.gann_ttl - 1) < 1 && !(ms->ms_flags & IEEE80211_MESHFLAGS_FWD))
2691 		return 0;
2692 	pgann.gann_flags = ie.gann_flags; /* Reserved */
2693 	pgann.gann_hopcount = ie.gann_hopcount + 1;
2694 	pgann.gann_ttl = ie.gann_ttl - 1;
2695 	IEEE80211_ADDR_COPY(pgann.gann_addr, ie.gann_addr);
2696 	pgann.gann_seq = ie.gann_seq;
2697 	pgann.gann_interval = ie.gann_interval;
2698 
2699 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, ie.gann_addr,
2700 	    "%s", "propagate GANN");
2701 
2702 	ieee80211_send_action(vap->iv_bss, IEEE80211_ACTION_CAT_MESH,
2703 	    IEEE80211_ACTION_MESH_GANN, &pgann);
2704 
2705 	return 0;
2706 }
2707 
2708 static int
mesh_send_action(struct ieee80211_node * ni,const uint8_t sa[IEEE80211_ADDR_LEN],const uint8_t da[IEEE80211_ADDR_LEN],struct mbuf * m)2709 mesh_send_action(struct ieee80211_node *ni,
2710     const uint8_t sa[IEEE80211_ADDR_LEN],
2711     const uint8_t da[IEEE80211_ADDR_LEN],
2712     struct mbuf *m)
2713 {
2714 	struct ieee80211vap *vap = ni->ni_vap;
2715 	struct ieee80211com *ic = ni->ni_ic;
2716 	struct ieee80211_bpf_params params;
2717 	struct ieee80211_frame *wh;
2718 	int ret;
2719 
2720 	KASSERT(ni != NULL, ("null node"));
2721 
2722 	if (vap->iv_state == IEEE80211_S_CAC) {
2723 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
2724 		    "block %s frame in CAC state", "Mesh action");
2725 		vap->iv_stats.is_tx_badstate++;
2726 		ieee80211_free_node(ni);
2727 		m_freem(m);
2728 		return EIO;		/* XXX */
2729 	}
2730 
2731 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_NOWAIT);
2732 	if (m == NULL) {
2733 		ieee80211_free_node(ni);
2734 		return ENOMEM;
2735 	}
2736 
2737 	IEEE80211_TX_LOCK(ic);
2738 	wh = mtod(m, struct ieee80211_frame *);
2739 	ieee80211_send_setup(ni, m,
2740 	     IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ACTION,
2741 	     IEEE80211_NONQOS_TID, sa, da, sa);
2742 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
2743 
2744 	memset(&params, 0, sizeof(params));
2745 	params.ibp_pri = WME_AC_VO;
2746 	params.ibp_rate0 = ni->ni_txparms->mgmtrate;
2747 	if (IEEE80211_IS_MULTICAST(da))
2748 		params.ibp_try0 = 1;
2749 	else
2750 		params.ibp_try0 = ni->ni_txparms->maxretry;
2751 	params.ibp_power = ni->ni_txpower;
2752 
2753 	IEEE80211_NODE_STAT(ni, tx_mgmt);
2754 
2755 	ret = ieee80211_raw_output(vap, ni, m, &params);
2756 	IEEE80211_TX_UNLOCK(ic);
2757 	return (ret);
2758 }
2759 
2760 #define	ADDSHORT(frm, v) do {			\
2761 	frm[0] = (v) & 0xff;			\
2762 	frm[1] = (v) >> 8;			\
2763 	frm += 2;				\
2764 } while (0)
2765 #define	ADDWORD(frm, v) do {			\
2766 	frm[0] = (v) & 0xff;			\
2767 	frm[1] = ((v) >> 8) & 0xff;		\
2768 	frm[2] = ((v) >> 16) & 0xff;		\
2769 	frm[3] = ((v) >> 24) & 0xff;		\
2770 	frm += 4;				\
2771 } while (0)
2772 
2773 static int
mesh_send_action_meshpeering_open(struct ieee80211_node * ni,int category,int action,void * args0)2774 mesh_send_action_meshpeering_open(struct ieee80211_node *ni,
2775 	int category, int action, void *args0)
2776 {
2777 	struct ieee80211vap *vap = ni->ni_vap;
2778 	struct ieee80211com *ic = ni->ni_ic;
2779 	uint16_t *args = args0;
2780 	const struct ieee80211_rateset *rs;
2781 	struct mbuf *m;
2782 	uint8_t *frm;
2783 
2784 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2785 	    "send PEER OPEN action: localid 0x%x", args[0]);
2786 
2787 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2788 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2789 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2790 	ieee80211_ref_node(ni);
2791 
2792 	m = ieee80211_getmgtframe(&frm,
2793 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2794 	    sizeof(uint16_t)	/* action+category */
2795 	    + sizeof(uint16_t)	/* capabilites */
2796 	    + 2 + IEEE80211_RATE_SIZE
2797 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2798 	    + 2 + IEEE80211_MESHID_LEN
2799 	    + sizeof(struct ieee80211_meshconf_ie)
2800 	    + sizeof(struct ieee80211_meshpeer_ie)
2801 	);
2802 	if (m != NULL) {
2803 		/*
2804 		 * mesh peer open action frame format:
2805 		 *   [1] category
2806 		 *   [1] action
2807 		 *   [2] capabilities
2808 		 *   [tlv] rates
2809 		 *   [tlv] xrates
2810 		 *   [tlv] mesh id
2811 		 *   [tlv] mesh conf
2812 		 *   [tlv] mesh peer link mgmt
2813 		 */
2814 		*frm++ = category;
2815 		*frm++ = action;
2816 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2817 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2818 		frm = ieee80211_add_rates(frm, rs);
2819 		frm = ieee80211_add_xrates(frm, rs);
2820 		frm = ieee80211_add_meshid(frm, vap);
2821 		frm = ieee80211_add_meshconf(frm, vap);
2822 		frm = ieee80211_add_meshpeer(frm, IEEE80211_ACTION_MESHPEERING_OPEN,
2823 		    args[0], 0, 0);
2824 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2825 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2826 	} else {
2827 		vap->iv_stats.is_tx_nobuf++;
2828 		ieee80211_free_node(ni);
2829 		return ENOMEM;
2830 	}
2831 }
2832 
2833 static int
mesh_send_action_meshpeering_confirm(struct ieee80211_node * ni,int category,int action,void * args0)2834 mesh_send_action_meshpeering_confirm(struct ieee80211_node *ni,
2835 	int category, int action, void *args0)
2836 {
2837 	struct ieee80211vap *vap = ni->ni_vap;
2838 	struct ieee80211com *ic = ni->ni_ic;
2839 	uint16_t *args = args0;
2840 	const struct ieee80211_rateset *rs;
2841 	struct mbuf *m;
2842 	uint8_t *frm;
2843 
2844 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2845 	    "send PEER CONFIRM action: localid 0x%x, peerid 0x%x",
2846 	    args[0], args[1]);
2847 
2848 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2849 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2850 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2851 	ieee80211_ref_node(ni);
2852 
2853 	m = ieee80211_getmgtframe(&frm,
2854 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2855 	    sizeof(uint16_t)	/* action+category */
2856 	    + sizeof(uint16_t)	/* capabilites */
2857 	    + sizeof(uint16_t)	/* status code */
2858 	    + sizeof(uint16_t)	/* AID */
2859 	    + 2 + IEEE80211_RATE_SIZE
2860 	    + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
2861 	    + 2 + IEEE80211_MESHID_LEN
2862 	    + sizeof(struct ieee80211_meshconf_ie)
2863 	    + sizeof(struct ieee80211_meshpeer_ie)
2864 	);
2865 	if (m != NULL) {
2866 		/*
2867 		 * mesh peer confirm action frame format:
2868 		 *   [1] category
2869 		 *   [1] action
2870 		 *   [2] capabilities
2871 		 *   [2] status code
2872 		 *   [2] association id (peer ID)
2873 		 *   [tlv] rates
2874 		 *   [tlv] xrates
2875 		 *   [tlv] mesh id
2876 		 *   [tlv] mesh conf
2877 		 *   [tlv] mesh peer link mgmt
2878 		 */
2879 		*frm++ = category;
2880 		*frm++ = action;
2881 		ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
2882 		ADDSHORT(frm, 0);		/* status code */
2883 		ADDSHORT(frm, args[1]);		/* AID */
2884 		rs = ieee80211_get_suprates(ic, ic->ic_curchan);
2885 		frm = ieee80211_add_rates(frm, rs);
2886 		frm = ieee80211_add_xrates(frm, rs);
2887 		frm = ieee80211_add_meshid(frm, vap);
2888 		frm = ieee80211_add_meshconf(frm, vap);
2889 		frm = ieee80211_add_meshpeer(frm,
2890 		    IEEE80211_ACTION_MESHPEERING_CONFIRM,
2891 		    args[0], args[1], 0);
2892 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2893 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2894 	} else {
2895 		vap->iv_stats.is_tx_nobuf++;
2896 		ieee80211_free_node(ni);
2897 		return ENOMEM;
2898 	}
2899 }
2900 
2901 static int
mesh_send_action_meshpeering_close(struct ieee80211_node * ni,int category,int action,void * args0)2902 mesh_send_action_meshpeering_close(struct ieee80211_node *ni,
2903 	int category, int action, void *args0)
2904 {
2905 	struct ieee80211vap *vap = ni->ni_vap;
2906 	struct ieee80211com *ic = ni->ni_ic;
2907 	uint16_t *args = args0;
2908 	struct mbuf *m;
2909 	uint8_t *frm;
2910 
2911 	IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2912 	    "send PEER CLOSE action: localid 0x%x, peerid 0x%x reason %d (%s)",
2913 	    args[0], args[1], args[2], ieee80211_reason_to_string(args[2]));
2914 
2915 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2916 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2917 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2918 	ieee80211_ref_node(ni);
2919 
2920 	m = ieee80211_getmgtframe(&frm,
2921 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2922 	    sizeof(uint16_t)	/* action+category */
2923 	    + sizeof(uint16_t)	/* reason code */
2924 	    + 2 + IEEE80211_MESHID_LEN
2925 	    + sizeof(struct ieee80211_meshpeer_ie)
2926 	);
2927 	if (m != NULL) {
2928 		/*
2929 		 * mesh peer close action frame format:
2930 		 *   [1] category
2931 		 *   [1] action
2932 		 *   [tlv] mesh id
2933 		 *   [tlv] mesh peer link mgmt
2934 		 */
2935 		*frm++ = category;
2936 		*frm++ = action;
2937 		frm = ieee80211_add_meshid(frm, vap);
2938 		frm = ieee80211_add_meshpeer(frm,
2939 		    IEEE80211_ACTION_MESHPEERING_CLOSE,
2940 		    args[0], args[1], args[2]);
2941 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2942 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2943 	} else {
2944 		vap->iv_stats.is_tx_nobuf++;
2945 		ieee80211_free_node(ni);
2946 		return ENOMEM;
2947 	}
2948 }
2949 
2950 static int
mesh_send_action_meshlmetric(struct ieee80211_node * ni,int category,int action,void * arg0)2951 mesh_send_action_meshlmetric(struct ieee80211_node *ni,
2952 	int category, int action, void *arg0)
2953 {
2954 	struct ieee80211vap *vap = ni->ni_vap;
2955 	struct ieee80211com *ic = ni->ni_ic;
2956 	struct ieee80211_meshlmetric_ie *ie = arg0;
2957 	struct mbuf *m;
2958 	uint8_t *frm;
2959 
2960 	if (ie->lm_flags & IEEE80211_MESH_LMETRIC_FLAGS_REQ) {
2961 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2962 		    ni, "%s", "send LINK METRIC REQUEST action");
2963 	} else {
2964 		IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
2965 		    ni, "send LINK METRIC REPLY action: metric 0x%x",
2966 		    ie->lm_metric);
2967 	}
2968 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2969 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
2970 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
2971 	ieee80211_ref_node(ni);
2972 
2973 	m = ieee80211_getmgtframe(&frm,
2974 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
2975 	    sizeof(uint16_t) +	/* action+category */
2976 	    sizeof(struct ieee80211_meshlmetric_ie)
2977 	);
2978 	if (m != NULL) {
2979 		/*
2980 		 * mesh link metric
2981 		 *   [1] category
2982 		 *   [1] action
2983 		 *   [tlv] mesh link metric
2984 		 */
2985 		*frm++ = category;
2986 		*frm++ = action;
2987 		frm = ieee80211_add_meshlmetric(frm,
2988 		    ie->lm_flags, ie->lm_metric);
2989 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2990 		return mesh_send_action(ni, vap->iv_myaddr, ni->ni_macaddr, m);
2991 	} else {
2992 		vap->iv_stats.is_tx_nobuf++;
2993 		ieee80211_free_node(ni);
2994 		return ENOMEM;
2995 	}
2996 }
2997 
2998 static int
mesh_send_action_meshgate(struct ieee80211_node * ni,int category,int action,void * arg0)2999 mesh_send_action_meshgate(struct ieee80211_node *ni,
3000 	int category, int action, void *arg0)
3001 {
3002 	struct ieee80211vap *vap = ni->ni_vap;
3003 	struct ieee80211com *ic = ni->ni_ic;
3004 	struct ieee80211_meshgann_ie *ie = arg0;
3005 	struct mbuf *m;
3006 	uint8_t *frm;
3007 
3008 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
3009 	    "ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n", __func__, __LINE__,
3010 	    ni, ether_sprintf(ni->ni_macaddr), ieee80211_node_refcnt(ni)+1);
3011 	ieee80211_ref_node(ni);
3012 
3013 	m = ieee80211_getmgtframe(&frm,
3014 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
3015 	    sizeof(uint16_t) +	/* action+category */
3016 	    IEEE80211_MESHGANN_BASE_SZ
3017 	);
3018 	if (m != NULL) {
3019 		/*
3020 		 * mesh link metric
3021 		 *   [1] category
3022 		 *   [1] action
3023 		 *   [tlv] mesh gate annoucement
3024 		 */
3025 		*frm++ = category;
3026 		*frm++ = action;
3027 		frm = ieee80211_add_meshgate(frm, ie);
3028 		m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
3029 		return mesh_send_action(ni, vap->iv_myaddr, broadcastaddr, m);
3030 	} else {
3031 		vap->iv_stats.is_tx_nobuf++;
3032 		ieee80211_free_node(ni);
3033 		return ENOMEM;
3034 	}
3035 }
3036 
3037 static void
mesh_peer_timeout_setup(struct ieee80211_node * ni)3038 mesh_peer_timeout_setup(struct ieee80211_node *ni)
3039 {
3040 	switch (ni->ni_mlstate) {
3041 	case IEEE80211_NODE_MESH_HOLDING:
3042 		ni->ni_mltval = ieee80211_mesh_holdingtimeout;
3043 		break;
3044 	case IEEE80211_NODE_MESH_CONFIRMRCV:
3045 		ni->ni_mltval = ieee80211_mesh_confirmtimeout;
3046 		break;
3047 	case IEEE80211_NODE_MESH_IDLE:
3048 		ni->ni_mltval = 0;
3049 		break;
3050 	default:
3051 		ni->ni_mltval = ieee80211_mesh_retrytimeout;
3052 		break;
3053 	}
3054 	if (ni->ni_mltval)
3055 		callout_reset(&ni->ni_mltimer, ni->ni_mltval,
3056 		    mesh_peer_timeout_cb, ni);
3057 }
3058 
3059 /*
3060  * Same as above but backoffs timer statisically 50%.
3061  */
3062 static void
mesh_peer_timeout_backoff(struct ieee80211_node * ni)3063 mesh_peer_timeout_backoff(struct ieee80211_node *ni)
3064 {
3065 	uint32_t r;
3066 
3067 	r = arc4random();
3068 	ni->ni_mltval += r % ni->ni_mltval;
3069 	callout_reset(&ni->ni_mltimer, ni->ni_mltval, mesh_peer_timeout_cb,
3070 	    ni);
3071 }
3072 
3073 static __inline void
mesh_peer_timeout_stop(struct ieee80211_node * ni)3074 mesh_peer_timeout_stop(struct ieee80211_node *ni)
3075 {
3076 	callout_drain(&ni->ni_mltimer);
3077 }
3078 
3079 static void
mesh_peer_backoff_cb(void * arg)3080 mesh_peer_backoff_cb(void *arg)
3081 {
3082 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
3083 
3084 	/* After backoff timeout, try to peer automatically again. */
3085 	ni->ni_mlhcnt = 0;
3086 }
3087 
3088 /*
3089  * Mesh Peer Link Management FSM timeout handling.
3090  */
3091 static void
mesh_peer_timeout_cb(void * arg)3092 mesh_peer_timeout_cb(void *arg)
3093 {
3094 	struct ieee80211_node *ni = (struct ieee80211_node *)arg;
3095 	uint16_t args[3];
3096 
3097 	IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_MESH,
3098 	    ni, "mesh link timeout, state %d, retry counter %d",
3099 	    ni->ni_mlstate, ni->ni_mlrcnt);
3100 
3101 	switch (ni->ni_mlstate) {
3102 	case IEEE80211_NODE_MESH_IDLE:
3103 	case IEEE80211_NODE_MESH_ESTABLISHED:
3104 		break;
3105 	case IEEE80211_NODE_MESH_OPENSNT:
3106 	case IEEE80211_NODE_MESH_OPENRCV:
3107 		if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
3108 			args[0] = ni->ni_mlpid;
3109 			args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
3110 			ieee80211_send_action(ni,
3111 			    IEEE80211_ACTION_CAT_SELF_PROT,
3112 			    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
3113 			ni->ni_mlrcnt = 0;
3114 			mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
3115 			mesh_peer_timeout_setup(ni);
3116 		} else {
3117 			args[0] = ni->ni_mlpid;
3118 			ieee80211_send_action(ni,
3119 			    IEEE80211_ACTION_CAT_SELF_PROT,
3120 			    IEEE80211_ACTION_MESHPEERING_OPEN, args);
3121 			ni->ni_mlrcnt++;
3122 			mesh_peer_timeout_backoff(ni);
3123 		}
3124 		break;
3125 	case IEEE80211_NODE_MESH_CONFIRMRCV:
3126 		args[0] = ni->ni_mlpid;
3127 		args[2] = IEEE80211_REASON_MESH_CONFIRM_TIMEOUT;
3128 		ieee80211_send_action(ni,
3129 		    IEEE80211_ACTION_CAT_SELF_PROT,
3130 		    IEEE80211_ACTION_MESHPEERING_CLOSE, args);
3131 		mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
3132 		mesh_peer_timeout_setup(ni);
3133 		break;
3134 	case IEEE80211_NODE_MESH_HOLDING:
3135 		ni->ni_mlhcnt++;
3136 		if (ni->ni_mlhcnt >= ieee80211_mesh_maxholding)
3137 			callout_reset(&ni->ni_mlhtimer,
3138 			    ieee80211_mesh_backofftimeout,
3139 			    mesh_peer_backoff_cb, ni);
3140 		mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
3141 		break;
3142 	}
3143 }
3144 
3145 static int
mesh_verify_meshid(struct ieee80211vap * vap,const uint8_t * ie)3146 mesh_verify_meshid(struct ieee80211vap *vap, const uint8_t *ie)
3147 {
3148 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3149 
3150 	if (ie == NULL || ie[1] != ms->ms_idlen)
3151 		return 1;
3152 	return memcmp(ms->ms_id, ie + 2, ms->ms_idlen);
3153 }
3154 
3155 /*
3156  * Check if we are using the same algorithms for this mesh.
3157  */
3158 static int
mesh_verify_meshconf(struct ieee80211vap * vap,const uint8_t * ie)3159 mesh_verify_meshconf(struct ieee80211vap *vap, const uint8_t *ie)
3160 {
3161 	const struct ieee80211_meshconf_ie *meshconf =
3162 	    (const struct ieee80211_meshconf_ie *) ie;
3163 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
3164 
3165 	if (meshconf == NULL)
3166 		return 1;
3167 	if (meshconf->conf_pselid != ms->ms_ppath->mpp_ie) {
3168 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3169 		    "unknown path selection algorithm: 0x%x\n",
3170 		    meshconf->conf_pselid);
3171 		return 1;
3172 	}
3173 	if (meshconf->conf_pmetid != ms->ms_pmetric->mpm_ie) {
3174 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3175 		    "unknown path metric algorithm: 0x%x\n",
3176 		    meshconf->conf_pmetid);
3177 		return 1;
3178 	}
3179 	if (meshconf->conf_ccid != 0) {
3180 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3181 		    "unknown congestion control algorithm: 0x%x\n",
3182 		    meshconf->conf_ccid);
3183 		return 1;
3184 	}
3185 	if (meshconf->conf_syncid != IEEE80211_MESHCONF_SYNC_NEIGHOFF) {
3186 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3187 		    "unknown sync algorithm: 0x%x\n",
3188 		    meshconf->conf_syncid);
3189 		return 1;
3190 	}
3191 	if (meshconf->conf_authid != 0) {
3192 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3193 		    "unknown auth auth algorithm: 0x%x\n",
3194 		    meshconf->conf_pselid);
3195 		return 1;
3196 	}
3197 	/* Not accepting peers */
3198 	if (!(meshconf->conf_cap & IEEE80211_MESHCONF_CAP_AP)) {
3199 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
3200 		    "not accepting peers: 0x%x\n", meshconf->conf_cap);
3201 		return 1;
3202 	}
3203 	return 0;
3204 }
3205 
3206 static int
mesh_verify_meshpeer(struct ieee80211vap * vap,uint8_t subtype,const uint8_t * ie)3207 mesh_verify_meshpeer(struct ieee80211vap *vap, uint8_t subtype,
3208     const uint8_t *ie)
3209 {
3210 	const struct ieee80211_meshpeer_ie *meshpeer =
3211 	    (const struct ieee80211_meshpeer_ie *) ie;
3212 
3213 	if (meshpeer == NULL ||
3214 	    meshpeer->peer_len < IEEE80211_MPM_BASE_SZ ||
3215 	    meshpeer->peer_len > IEEE80211_MPM_MAX_SZ)
3216 		return 1;
3217 	if (meshpeer->peer_proto != IEEE80211_MPPID_MPM) {
3218 		IEEE80211_DPRINTF(vap,
3219 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
3220 		    "Only MPM protocol is supported (proto: 0x%02X)",
3221 		    meshpeer->peer_proto);
3222 		return 1;
3223 	}
3224 	switch (subtype) {
3225 	case IEEE80211_ACTION_MESHPEERING_OPEN:
3226 		if (meshpeer->peer_len != IEEE80211_MPM_BASE_SZ)
3227 			return 1;
3228 		break;
3229 	case IEEE80211_ACTION_MESHPEERING_CONFIRM:
3230 		if (meshpeer->peer_len != IEEE80211_MPM_BASE_SZ + 2)
3231 			return 1;
3232 		break;
3233 	case IEEE80211_ACTION_MESHPEERING_CLOSE:
3234 		if (meshpeer->peer_len < IEEE80211_MPM_BASE_SZ + 2)
3235 			return 1;
3236 		if (meshpeer->peer_len == (IEEE80211_MPM_BASE_SZ + 2) &&
3237 		    meshpeer->peer_linkid != 0)
3238 			return 1;
3239 		if (meshpeer->peer_rcode == 0)
3240 			return 1;
3241 		break;
3242 	}
3243 	return 0;
3244 }
3245 
3246 /*
3247  * Add a Mesh ID IE to a frame.
3248  */
3249 uint8_t *
ieee80211_add_meshid(uint8_t * frm,struct ieee80211vap * vap)3250 ieee80211_add_meshid(uint8_t *frm, struct ieee80211vap *vap)
3251 {
3252 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3253 
3254 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a mbss vap"));
3255 
3256 	*frm++ = IEEE80211_ELEMID_MESHID;
3257 	*frm++ = ms->ms_idlen;
3258 	memcpy(frm, ms->ms_id, ms->ms_idlen);
3259 	return frm + ms->ms_idlen;
3260 }
3261 
3262 /*
3263  * Add a Mesh Configuration IE to a frame.
3264  * For now just use HWMP routing, Airtime link metric, Null Congestion
3265  * Signaling, Null Sync Protocol and Null Authentication.
3266  */
3267 uint8_t *
ieee80211_add_meshconf(uint8_t * frm,struct ieee80211vap * vap)3268 ieee80211_add_meshconf(uint8_t *frm, struct ieee80211vap *vap)
3269 {
3270 	const struct ieee80211_mesh_state *ms = vap->iv_mesh;
3271 	uint16_t caps;
3272 
3273 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
3274 
3275 	*frm++ = IEEE80211_ELEMID_MESHCONF;
3276 	*frm++ = IEEE80211_MESH_CONF_SZ;
3277 	*frm++ = ms->ms_ppath->mpp_ie;		/* path selection */
3278 	*frm++ = ms->ms_pmetric->mpm_ie;	/* link metric */
3279 	*frm++ = IEEE80211_MESHCONF_CC_DISABLED;
3280 	*frm++ = IEEE80211_MESHCONF_SYNC_NEIGHOFF;
3281 	*frm++ = IEEE80211_MESHCONF_AUTH_DISABLED;
3282 	/* NB: set the number of neighbors before the rest */
3283 	*frm = (ms->ms_neighbors > IEEE80211_MESH_MAX_NEIGHBORS ?
3284 	    IEEE80211_MESH_MAX_NEIGHBORS : ms->ms_neighbors) << 1;
3285 	if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE)
3286 		*frm |= IEEE80211_MESHCONF_FORM_GATE;
3287 	frm += 1;
3288 	caps = 0;
3289 	if (ms->ms_flags & IEEE80211_MESHFLAGS_AP)
3290 		caps |= IEEE80211_MESHCONF_CAP_AP;
3291 	if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
3292 		caps |= IEEE80211_MESHCONF_CAP_FWRD;
3293 	*frm++ = caps;
3294 	return frm;
3295 }
3296 
3297 /*
3298  * Add a Mesh Peer Management IE to a frame.
3299  */
3300 uint8_t *
ieee80211_add_meshpeer(uint8_t * frm,uint8_t subtype,uint16_t localid,uint16_t peerid,uint16_t reason)3301 ieee80211_add_meshpeer(uint8_t *frm, uint8_t subtype, uint16_t localid,
3302     uint16_t peerid, uint16_t reason)
3303 {
3304 
3305 	KASSERT(localid != 0, ("localid == 0"));
3306 
3307 	*frm++ = IEEE80211_ELEMID_MESHPEER;
3308 	switch (subtype) {
3309 	case IEEE80211_ACTION_MESHPEERING_OPEN:
3310 		*frm++ = IEEE80211_MPM_BASE_SZ;		/* length */
3311 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3312 		ADDSHORT(frm, localid);			/* local ID */
3313 		break;
3314 	case IEEE80211_ACTION_MESHPEERING_CONFIRM:
3315 		KASSERT(peerid != 0, ("sending peer confirm without peer id"));
3316 		*frm++ = IEEE80211_MPM_BASE_SZ + 2;	/* length */
3317 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3318 		ADDSHORT(frm, localid);			/* local ID */
3319 		ADDSHORT(frm, peerid);			/* peer ID */
3320 		break;
3321 	case IEEE80211_ACTION_MESHPEERING_CLOSE:
3322 		if (peerid)
3323 			*frm++ = IEEE80211_MPM_MAX_SZ;	/* length */
3324 		else
3325 			*frm++ = IEEE80211_MPM_BASE_SZ + 2; /* length */
3326 		ADDSHORT(frm, IEEE80211_MPPID_MPM);	/* proto */
3327 		ADDSHORT(frm, localid);	/* local ID */
3328 		if (peerid)
3329 			ADDSHORT(frm, peerid);	/* peer ID */
3330 		ADDSHORT(frm, reason);
3331 		break;
3332 	}
3333 	return frm;
3334 }
3335 
3336 /*
3337  * Compute an Airtime Link Metric for the link with this node.
3338  *
3339  * Based on Draft 3.0 spec (11B.10, p.149).
3340  */
3341 /*
3342  * Max 802.11s overhead.
3343  */
3344 #define IEEE80211_MESH_MAXOVERHEAD \
3345 	(sizeof(struct ieee80211_qosframe_addr4) \
3346 	 + sizeof(struct ieee80211_meshcntl_ae10) \
3347 	+ sizeof(struct llc) \
3348 	+ IEEE80211_ADDR_LEN \
3349 	+ IEEE80211_WEP_IVLEN \
3350 	+ IEEE80211_WEP_KIDLEN \
3351 	+ IEEE80211_WEP_CRCLEN \
3352 	+ IEEE80211_WEP_MICLEN \
3353 	+ IEEE80211_CRC_LEN)
3354 uint32_t
mesh_airtime_calc(struct ieee80211_node * ni)3355 mesh_airtime_calc(struct ieee80211_node *ni)
3356 {
3357 #define M_BITS 8
3358 #define S_FACTOR (2 * M_BITS)
3359 	struct ieee80211com *ic = ni->ni_ic;
3360 	struct ifnet *ifp = ni->ni_vap->iv_ifp;
3361 	static const int nbits = 8192 << M_BITS;
3362 	uint32_t overhead, rate, errrate;
3363 	uint64_t res;
3364 
3365 	/* Time to transmit a frame */
3366 	rate = ni->ni_txrate;
3367 	overhead = ieee80211_compute_duration(ic->ic_rt,
3368 	    ifp->if_mtu + IEEE80211_MESH_MAXOVERHEAD, rate, 0) << M_BITS;
3369 	/* Error rate in percentage */
3370 	/* XXX assuming small failures are ok */
3371 #if defined(__DragonFly__)
3372 	u_long	icount;
3373 	u_long	ocount;
3374 	IFNET_STAT_GET(ifp, ierrors, icount);
3375 	IFNET_STAT_GET(ifp, oerrors, ocount);
3376 	errrate = (((ocount + icount) / 100) << M_BITS)
3377 	    / 100;
3378 #else
3379 	errrate = (((ifp->if_get_counter(ifp, IFCOUNTER_OERRORS) +
3380 	    ifp->if_get_counter(ifp, IFCOUNTER_IERRORS)) / 100) << M_BITS)
3381 	    / 100;
3382 #endif
3383 	res = (overhead + (nbits / rate)) *
3384 	    ((1 << S_FACTOR) / ((1 << M_BITS) - errrate));
3385 
3386 	return (uint32_t)(res >> S_FACTOR);
3387 #undef M_BITS
3388 #undef S_FACTOR
3389 }
3390 
3391 /*
3392  * Add a Mesh Link Metric report IE to a frame.
3393  */
3394 uint8_t *
ieee80211_add_meshlmetric(uint8_t * frm,uint8_t flags,uint32_t metric)3395 ieee80211_add_meshlmetric(uint8_t *frm, uint8_t flags, uint32_t metric)
3396 {
3397 	*frm++ = IEEE80211_ELEMID_MESHLINK;
3398 	*frm++ = 5;
3399 	*frm++ = flags;
3400 	ADDWORD(frm, metric);
3401 	return frm;
3402 }
3403 
3404 /*
3405  * Add a Mesh Gate Announcement IE to a frame.
3406  */
3407 uint8_t *
ieee80211_add_meshgate(uint8_t * frm,struct ieee80211_meshgann_ie * ie)3408 ieee80211_add_meshgate(uint8_t *frm, struct ieee80211_meshgann_ie *ie)
3409 {
3410 	*frm++ = IEEE80211_ELEMID_MESHGANN; /* ie */
3411 	*frm++ = IEEE80211_MESHGANN_BASE_SZ; /* len */
3412 	*frm++ = ie->gann_flags;
3413 	*frm++ = ie->gann_hopcount;
3414 	*frm++ = ie->gann_ttl;
3415 	IEEE80211_ADDR_COPY(frm, ie->gann_addr);
3416 	frm += 6;
3417 	ADDWORD(frm, ie->gann_seq);
3418 	ADDSHORT(frm, ie->gann_interval);
3419 	return frm;
3420 }
3421 #undef ADDSHORT
3422 #undef ADDWORD
3423 
3424 /*
3425  * Initialize any mesh-specific node state.
3426  */
3427 void
ieee80211_mesh_node_init(struct ieee80211vap * vap,struct ieee80211_node * ni)3428 ieee80211_mesh_node_init(struct ieee80211vap *vap, struct ieee80211_node *ni)
3429 {
3430 	ni->ni_flags |= IEEE80211_NODE_QOS;
3431 #if defined(__DragonFly__)
3432 	callout_init_mp(&ni->ni_mltimer);
3433 	callout_init_mp(&ni->ni_mlhtimer);
3434 #else
3435 	callout_init(&ni->ni_mltimer, 1);
3436 	callout_init(&ni->ni_mlhtimer, 1);
3437 #endif
3438 }
3439 
3440 /*
3441  * Cleanup any mesh-specific node state.
3442  */
3443 void
ieee80211_mesh_node_cleanup(struct ieee80211_node * ni)3444 ieee80211_mesh_node_cleanup(struct ieee80211_node *ni)
3445 {
3446 	struct ieee80211vap *vap = ni->ni_vap;
3447 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3448 
3449 	callout_drain(&ni->ni_mltimer);
3450 	callout_drain(&ni->ni_mlhtimer);
3451 	/* NB: short-circuit callbacks after mesh_vdetach */
3452 	if (vap->iv_mesh != NULL)
3453 		ms->ms_ppath->mpp_peerdown(ni);
3454 }
3455 
3456 void
ieee80211_parse_meshid(struct ieee80211_node * ni,const uint8_t * ie)3457 ieee80211_parse_meshid(struct ieee80211_node *ni, const uint8_t *ie)
3458 {
3459 	ni->ni_meshidlen = ie[1];
3460 	memcpy(ni->ni_meshid, ie + 2, ie[1]);
3461 }
3462 
3463 /*
3464  * Setup mesh-specific node state on neighbor discovery.
3465  */
3466 void
ieee80211_mesh_init_neighbor(struct ieee80211_node * ni,const struct ieee80211_frame * wh,const struct ieee80211_scanparams * sp)3467 ieee80211_mesh_init_neighbor(struct ieee80211_node *ni,
3468 	const struct ieee80211_frame *wh,
3469 	const struct ieee80211_scanparams *sp)
3470 {
3471 	ieee80211_parse_meshid(ni, sp->meshid);
3472 }
3473 
3474 void
ieee80211_mesh_update_beacon(struct ieee80211vap * vap,struct ieee80211_beacon_offsets * bo)3475 ieee80211_mesh_update_beacon(struct ieee80211vap *vap,
3476 	struct ieee80211_beacon_offsets *bo)
3477 {
3478 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
3479 
3480 	if (isset(bo->bo_flags, IEEE80211_BEACON_MESHCONF)) {
3481 		(void)ieee80211_add_meshconf(bo->bo_meshconf, vap);
3482 		clrbit(bo->bo_flags, IEEE80211_BEACON_MESHCONF);
3483 	}
3484 }
3485 
3486 static int
mesh_ioctl_get80211(struct ieee80211vap * vap,struct ieee80211req * ireq)3487 mesh_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
3488 {
3489 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3490 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
3491 	struct ieee80211_mesh_route *rt;
3492 	struct ieee80211req_mesh_route *imr;
3493 	size_t len, off;
3494 	uint8_t *p;
3495 	int error;
3496 
3497 	if (vap->iv_opmode != IEEE80211_M_MBSS)
3498 		return ENOSYS;
3499 
3500 	error = 0;
3501 	switch (ireq->i_type) {
3502 	case IEEE80211_IOC_MESH_ID:
3503 		ireq->i_len = ms->ms_idlen;
3504 		memcpy(tmpmeshid, ms->ms_id, ireq->i_len);
3505 		error = copyout(tmpmeshid, ireq->i_data, ireq->i_len);
3506 		break;
3507 	case IEEE80211_IOC_MESH_AP:
3508 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_AP) != 0;
3509 		break;
3510 	case IEEE80211_IOC_MESH_FWRD:
3511 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) != 0;
3512 		break;
3513 	case IEEE80211_IOC_MESH_GATE:
3514 		ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_GATE) != 0;
3515 		break;
3516 	case IEEE80211_IOC_MESH_TTL:
3517 		ireq->i_val = ms->ms_ttl;
3518 		break;
3519 	case IEEE80211_IOC_MESH_RTCMD:
3520 		switch (ireq->i_val) {
3521 		case IEEE80211_MESH_RTCMD_LIST:
3522 			len = 0;
3523 			MESH_RT_LOCK(ms);
3524 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
3525 				len += sizeof(*imr);
3526 			}
3527 			MESH_RT_UNLOCK(ms);
3528 			if (len > ireq->i_len || ireq->i_len < sizeof(*imr)) {
3529 				ireq->i_len = len;
3530 				return ENOMEM;
3531 			}
3532 			ireq->i_len = len;
3533 			/* XXX M_WAIT? */
3534 #if defined(__DragonFly__)
3535 			p = kmalloc(len, M_TEMP, M_INTWAIT | M_ZERO);
3536 #else
3537 			p = IEEE80211_MALLOC(len, M_TEMP,
3538 				IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
3539 #endif
3540 			if (p == NULL)
3541 				return ENOMEM;
3542 			off = 0;
3543 			MESH_RT_LOCK(ms);
3544 			TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
3545 				if (off >= len)
3546 					break;
3547 				imr = (struct ieee80211req_mesh_route *)
3548 				    (p + off);
3549 				IEEE80211_ADDR_COPY(imr->imr_dest,
3550 				    rt->rt_dest);
3551 				IEEE80211_ADDR_COPY(imr->imr_nexthop,
3552 				    rt->rt_nexthop);
3553 				imr->imr_metric = rt->rt_metric;
3554 				imr->imr_nhops = rt->rt_nhops;
3555 				imr->imr_lifetime =
3556 				    ieee80211_mesh_rt_update(rt, 0);
3557 				imr->imr_lastmseq = rt->rt_lastmseq;
3558 				imr->imr_flags = rt->rt_flags; /* last */
3559 				off += sizeof(*imr);
3560 			}
3561 			MESH_RT_UNLOCK(ms);
3562 			error = copyout(p, (uint8_t *)ireq->i_data,
3563 			    ireq->i_len);
3564 			IEEE80211_FREE(p, M_TEMP);
3565 			break;
3566 		case IEEE80211_MESH_RTCMD_FLUSH:
3567 		case IEEE80211_MESH_RTCMD_ADD:
3568 		case IEEE80211_MESH_RTCMD_DELETE:
3569 			return EINVAL;
3570 		default:
3571 			return ENOSYS;
3572 		}
3573 		break;
3574 	case IEEE80211_IOC_MESH_PR_METRIC:
3575 		len = strlen(ms->ms_pmetric->mpm_descr);
3576 		if (ireq->i_len < len)
3577 			return EINVAL;
3578 		ireq->i_len = len;
3579 		error = copyout(ms->ms_pmetric->mpm_descr,
3580 		    (uint8_t *)ireq->i_data, len);
3581 		break;
3582 	case IEEE80211_IOC_MESH_PR_PATH:
3583 		len = strlen(ms->ms_ppath->mpp_descr);
3584 		if (ireq->i_len < len)
3585 			return EINVAL;
3586 		ireq->i_len = len;
3587 		error = copyout(ms->ms_ppath->mpp_descr,
3588 		    (uint8_t *)ireq->i_data, len);
3589 		break;
3590 	default:
3591 		return ENOSYS;
3592 	}
3593 
3594 	return error;
3595 }
3596 IEEE80211_IOCTL_GET(mesh, mesh_ioctl_get80211);
3597 
3598 static int
mesh_ioctl_set80211(struct ieee80211vap * vap,struct ieee80211req * ireq)3599 mesh_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
3600 {
3601 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
3602 	uint8_t tmpmeshid[IEEE80211_NWID_LEN];
3603 	uint8_t tmpaddr[IEEE80211_ADDR_LEN];
3604 	char tmpproto[IEEE80211_MESH_PROTO_DSZ];
3605 	int error;
3606 
3607 	if (vap->iv_opmode != IEEE80211_M_MBSS)
3608 		return ENOSYS;
3609 
3610 	error = 0;
3611 	switch (ireq->i_type) {
3612 	case IEEE80211_IOC_MESH_ID:
3613 		if (ireq->i_val != 0 || ireq->i_len > IEEE80211_MESHID_LEN)
3614 			return EINVAL;
3615 		error = copyin(ireq->i_data, tmpmeshid, ireq->i_len);
3616 		if (error != 0)
3617 			break;
3618 		memset(ms->ms_id, 0, IEEE80211_NWID_LEN);
3619 		ms->ms_idlen = ireq->i_len;
3620 		memcpy(ms->ms_id, tmpmeshid, ireq->i_len);
3621 		error = ENETRESET;
3622 		break;
3623 	case IEEE80211_IOC_MESH_AP:
3624 		if (ireq->i_val)
3625 			ms->ms_flags |= IEEE80211_MESHFLAGS_AP;
3626 		else
3627 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_AP;
3628 		error = ENETRESET;
3629 		break;
3630 	case IEEE80211_IOC_MESH_FWRD:
3631 		if (ireq->i_val)
3632 			ms->ms_flags |= IEEE80211_MESHFLAGS_FWD;
3633 		else
3634 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_FWD;
3635 		mesh_gatemode_setup(vap);
3636 		break;
3637 	case IEEE80211_IOC_MESH_GATE:
3638 		if (ireq->i_val)
3639 			ms->ms_flags |= IEEE80211_MESHFLAGS_GATE;
3640 		else
3641 			ms->ms_flags &= ~IEEE80211_MESHFLAGS_GATE;
3642 		break;
3643 	case IEEE80211_IOC_MESH_TTL:
3644 		ms->ms_ttl = (uint8_t) ireq->i_val;
3645 		break;
3646 	case IEEE80211_IOC_MESH_RTCMD:
3647 		switch (ireq->i_val) {
3648 		case IEEE80211_MESH_RTCMD_LIST:
3649 			return EINVAL;
3650 		case IEEE80211_MESH_RTCMD_FLUSH:
3651 			ieee80211_mesh_rt_flush(vap);
3652 			break;
3653 		case IEEE80211_MESH_RTCMD_ADD:
3654 			if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||
3655 			    IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))
3656 				return EINVAL;
3657 			error = copyin(ireq->i_data, &tmpaddr,
3658 			    IEEE80211_ADDR_LEN);
3659 			if (error == 0)
3660 				ieee80211_mesh_discover(vap, tmpaddr, NULL);
3661 			break;
3662 		case IEEE80211_MESH_RTCMD_DELETE:
3663 			ieee80211_mesh_rt_del(vap, ireq->i_data);
3664 			break;
3665 		default:
3666 			return ENOSYS;
3667 		}
3668 		break;
3669 	case IEEE80211_IOC_MESH_PR_METRIC:
3670 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
3671 		if (error == 0) {
3672 			error = mesh_select_proto_metric(vap, tmpproto);
3673 			if (error == 0)
3674 				error = ENETRESET;
3675 		}
3676 		break;
3677 	case IEEE80211_IOC_MESH_PR_PATH:
3678 		error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
3679 		if (error == 0) {
3680 			error = mesh_select_proto_path(vap, tmpproto);
3681 			if (error == 0)
3682 				error = ENETRESET;
3683 		}
3684 		break;
3685 	default:
3686 		return ENOSYS;
3687 	}
3688 	return error;
3689 }
3690 IEEE80211_IOCTL_SET(mesh, mesh_ioctl_set80211);
3691