1 /* $OpenBSD: ieee80211_node.c,v 1.198 2023/10/22 12:01:36 stsp Exp $ */
2 /* $NetBSD: ieee80211_node.c,v 1.14 2004/05/09 09:18:47 dyoung Exp $ */
3
4 /*-
5 * Copyright (c) 2001 Atsushi Onoe
6 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
7 * Copyright (c) 2008 Damien Bergamini
8 * All rights reserved.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. The name of the author may not be used to endorse or promote products
19 * derived from this software without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31 */
32
33 #include "bridge.h"
34
35 #include <sys/param.h>
36 #include <sys/systm.h>
37 #include <sys/mbuf.h>
38 #include <sys/malloc.h>
39 #include <sys/kernel.h>
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <sys/endian.h>
43 #include <sys/errno.h>
44 #include <sys/sysctl.h>
45 #include <sys/tree.h>
46
47 #include <net/if.h>
48 #include <net/if_dl.h>
49 #include <net/if_media.h>
50
51 #include <netinet/in.h>
52 #include <netinet/if_ether.h>
53
54 #if NBRIDGE > 0
55 #include <net/if_bridge.h>
56 #endif
57
58 #include <net80211/ieee80211_var.h>
59 #include <net80211/ieee80211_priv.h>
60
61 struct ieee80211_node *ieee80211_node_alloc(struct ieee80211com *);
62 void ieee80211_node_free(struct ieee80211com *, struct ieee80211_node *);
63 void ieee80211_node_copy(struct ieee80211com *, struct ieee80211_node *,
64 const struct ieee80211_node *);
65 void ieee80211_choose_rsnparams(struct ieee80211com *);
66 u_int8_t ieee80211_node_getrssi(struct ieee80211com *,
67 const struct ieee80211_node *);
68 int ieee80211_node_checkrssi(struct ieee80211com *,
69 const struct ieee80211_node *);
70 int ieee80211_ess_is_better(struct ieee80211com *ic, struct ieee80211_node *,
71 struct ieee80211_node *);
72 void ieee80211_node_set_timeouts(struct ieee80211_node *);
73 void ieee80211_setup_node(struct ieee80211com *, struct ieee80211_node *,
74 const u_int8_t *);
75 struct ieee80211_node *ieee80211_alloc_node_helper(struct ieee80211com *);
76 void ieee80211_node_free_unref_cb(struct ieee80211_node *);
77 void ieee80211_node_tx_flushed(struct ieee80211com *, struct ieee80211_node *);
78 void ieee80211_node_switch_bss(struct ieee80211com *, struct ieee80211_node *);
79 void ieee80211_node_addba_request(struct ieee80211_node *, int);
80 void ieee80211_node_addba_request_ac_be_to(void *);
81 void ieee80211_node_addba_request_ac_bk_to(void *);
82 void ieee80211_node_addba_request_ac_vi_to(void *);
83 void ieee80211_node_addba_request_ac_vo_to(void *);
84 void ieee80211_needs_auth(struct ieee80211com *, struct ieee80211_node *);
85 #ifndef IEEE80211_STA_ONLY
86 void ieee80211_node_join_ht(struct ieee80211com *, struct ieee80211_node *);
87 void ieee80211_node_join_rsn(struct ieee80211com *, struct ieee80211_node *);
88 void ieee80211_node_join_11g(struct ieee80211com *, struct ieee80211_node *);
89 void ieee80211_node_leave_ht(struct ieee80211com *, struct ieee80211_node *);
90 void ieee80211_node_leave_vht(struct ieee80211com *, struct ieee80211_node *);
91 void ieee80211_node_leave_rsn(struct ieee80211com *, struct ieee80211_node *);
92 void ieee80211_node_leave_11g(struct ieee80211com *, struct ieee80211_node *);
93 void ieee80211_node_leave_pwrsave(struct ieee80211com *,
94 struct ieee80211_node *);
95 void ieee80211_inact_timeout(void *);
96 void ieee80211_node_cache_timeout(void *);
97 #endif
98 void ieee80211_clean_inactive_nodes(struct ieee80211com *, int);
99
100 #ifndef IEEE80211_STA_ONLY
101 void
ieee80211_inact_timeout(void * arg)102 ieee80211_inact_timeout(void *arg)
103 {
104 struct ieee80211com *ic = arg;
105 struct ieee80211_node *ni, *next_ni;
106 int s;
107
108 s = splnet();
109 for (ni = RBT_MIN(ieee80211_tree, &ic->ic_tree);
110 ni != NULL; ni = next_ni) {
111 next_ni = RBT_NEXT(ieee80211_tree, ni);
112 if (ni->ni_refcnt > 0)
113 continue;
114 if (ni->ni_inact < IEEE80211_INACT_MAX)
115 ni->ni_inact++;
116 }
117 splx(s);
118
119 timeout_add_sec(&ic->ic_inact_timeout, IEEE80211_INACT_WAIT);
120 }
121
122 void
ieee80211_node_cache_timeout(void * arg)123 ieee80211_node_cache_timeout(void *arg)
124 {
125 struct ieee80211com *ic = arg;
126
127 ieee80211_clean_nodes(ic, 1);
128 timeout_add_sec(&ic->ic_node_cache_timeout, IEEE80211_CACHE_WAIT);
129 }
130 #endif
131
132 /*
133 * For debug purposes
134 */
135 void
ieee80211_print_ess(struct ieee80211_ess * ess)136 ieee80211_print_ess(struct ieee80211_ess *ess)
137 {
138 ieee80211_print_essid(ess->essid, ess->esslen);
139 if (ess->flags & IEEE80211_F_RSNON) {
140 printf(" wpa");
141 if (ess->rsnprotos & IEEE80211_PROTO_RSN)
142 printf(",wpa2");
143 if (ess->rsnprotos & IEEE80211_PROTO_WPA)
144 printf(",wpa1");
145
146 if (ess->rsnakms & IEEE80211_AKM_8021X ||
147 ess->rsnakms & IEEE80211_AKM_SHA256_8021X)
148 printf(",802.1x");
149 printf(" ");
150
151 if (ess->rsnciphers & IEEE80211_CIPHER_USEGROUP)
152 printf(" usegroup");
153 if (ess->rsnciphers & IEEE80211_CIPHER_WEP40)
154 printf(" wep40");
155 if (ess->rsnciphers & IEEE80211_CIPHER_WEP104)
156 printf(" wep104");
157 if (ess->rsnciphers & IEEE80211_CIPHER_TKIP)
158 printf(" tkip");
159 if (ess->rsnciphers & IEEE80211_CIPHER_CCMP)
160 printf(" ccmp");
161 }
162 if (ess->flags & IEEE80211_F_WEPON) {
163 int i = ess->def_txkey;
164
165 printf(" wep,");
166 if (ess->nw_keys[i].k_cipher & IEEE80211_CIPHER_WEP40)
167 printf("wep40");
168 if (ess->nw_keys[i].k_cipher & IEEE80211_CIPHER_WEP104)
169 printf("wep104");
170 }
171 if (ess->flags == 0)
172 printf(" clear");
173 printf("\n");
174 }
175
176 void
ieee80211_print_ess_list(struct ieee80211com * ic)177 ieee80211_print_ess_list(struct ieee80211com *ic)
178 {
179 struct ifnet *ifp = &ic->ic_if;
180 struct ieee80211_ess *ess;
181
182 printf("%s: known networks\n", ifp->if_xname);
183 TAILQ_FOREACH(ess, &ic->ic_ess, ess_next) {
184 ieee80211_print_ess(ess);
185 }
186 }
187
188 struct ieee80211_ess *
ieee80211_get_ess(struct ieee80211com * ic,const char * nwid,int len)189 ieee80211_get_ess(struct ieee80211com *ic, const char *nwid, int len)
190 {
191 struct ieee80211_ess *ess;
192
193 TAILQ_FOREACH(ess, &ic->ic_ess, ess_next) {
194 if (len == ess->esslen &&
195 memcmp(ess->essid, nwid, ess->esslen) == 0)
196 return ess;
197 }
198
199 return NULL;
200 }
201
202 void
ieee80211_del_ess(struct ieee80211com * ic,char * nwid,int len,int all)203 ieee80211_del_ess(struct ieee80211com *ic, char *nwid, int len, int all)
204 {
205 struct ieee80211_ess *ess, *next;
206
207 TAILQ_FOREACH_SAFE(ess, &ic->ic_ess, ess_next, next) {
208 if (all == 1 || (ess->esslen == len &&
209 memcmp(ess->essid, nwid, len) == 0)) {
210 TAILQ_REMOVE(&ic->ic_ess, ess, ess_next);
211 explicit_bzero(ess, sizeof(*ess));
212 free(ess, M_DEVBUF, sizeof(*ess));
213 if (TAILQ_EMPTY(&ic->ic_ess))
214 ic->ic_flags &= ~IEEE80211_F_AUTO_JOIN;
215 if (all != 1)
216 return;
217 }
218 }
219 }
220
221 /* Keep in sync with ieee80211_ioctl.c:ieee80211_ioctl_setnwkeys() */
222 static int
ieee80211_ess_setnwkeys(struct ieee80211_ess * ess,const struct ieee80211_nwkey * nwkey)223 ieee80211_ess_setnwkeys(struct ieee80211_ess *ess,
224 const struct ieee80211_nwkey *nwkey)
225 {
226 struct ieee80211_key *k;
227 int error, i;
228
229 if (nwkey->i_wepon == IEEE80211_NWKEY_OPEN) {
230 if (!(ess->flags & IEEE80211_F_WEPON))
231 return 0;
232 ess->flags &= ~IEEE80211_F_WEPON;
233 return ENETRESET;
234 }
235 if (nwkey->i_defkid < 1 || nwkey->i_defkid > IEEE80211_WEP_NKID)
236 return EINVAL;
237
238 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
239 if (nwkey->i_key[i].i_keylen == 0 ||
240 nwkey->i_key[i].i_keydat == NULL)
241 continue; /* entry not set */
242 if (nwkey->i_key[i].i_keylen > IEEE80211_KEYBUF_SIZE)
243 return EINVAL;
244
245 /* map wep key to ieee80211_key */
246 k = &ess->nw_keys[i];
247 memset(k, 0, sizeof(*k));
248 if (nwkey->i_key[i].i_keylen <= 5)
249 k->k_cipher = IEEE80211_CIPHER_WEP40;
250 else
251 k->k_cipher = IEEE80211_CIPHER_WEP104;
252 k->k_len = ieee80211_cipher_keylen(k->k_cipher);
253 k->k_flags = IEEE80211_KEY_GROUP | IEEE80211_KEY_TX;
254 error = copyin(nwkey->i_key[i].i_keydat, k->k_key, k->k_len);
255 if (error != 0)
256 return error;
257 }
258 ess->def_txkey = nwkey->i_defkid - 1;
259 ess->flags |= IEEE80211_F_WEPON;
260
261 return ENETRESET;
262 }
263
264
265 /* Keep in sync with ieee80211_ioctl.c:ieee80211_ioctl_setwpaparms() */
266 static int
ieee80211_ess_setwpaparms(struct ieee80211_ess * ess,const struct ieee80211_wpaparams * wpa)267 ieee80211_ess_setwpaparms(struct ieee80211_ess *ess,
268 const struct ieee80211_wpaparams *wpa)
269 {
270 if (!wpa->i_enabled) {
271 if (!(ess->flags & IEEE80211_F_RSNON))
272 return 0;
273 ess->flags &= ~IEEE80211_F_RSNON;
274 ess->rsnprotos = 0;
275 ess->rsnakms = 0;
276 ess->rsngroupcipher = 0;
277 ess->rsnciphers = 0;
278 return ENETRESET;
279 }
280
281 ess->rsnprotos = 0;
282 if (wpa->i_protos & IEEE80211_WPA_PROTO_WPA1)
283 ess->rsnprotos |= IEEE80211_PROTO_WPA;
284 if (wpa->i_protos & IEEE80211_WPA_PROTO_WPA2)
285 ess->rsnprotos |= IEEE80211_PROTO_RSN;
286 if (ess->rsnprotos == 0) /* set to default (RSN) */
287 ess->rsnprotos = IEEE80211_PROTO_RSN;
288
289 ess->rsnakms = 0;
290 if (wpa->i_akms & IEEE80211_WPA_AKM_PSK)
291 ess->rsnakms |= IEEE80211_AKM_PSK;
292 if (wpa->i_akms & IEEE80211_WPA_AKM_SHA256_PSK)
293 ess->rsnakms |= IEEE80211_AKM_SHA256_PSK;
294 if (wpa->i_akms & IEEE80211_WPA_AKM_8021X)
295 ess->rsnakms |= IEEE80211_AKM_8021X;
296 if (wpa->i_akms & IEEE80211_WPA_AKM_SHA256_8021X)
297 ess->rsnakms |= IEEE80211_AKM_SHA256_8021X;
298 if (ess->rsnakms == 0) /* set to default (PSK) */
299 ess->rsnakms = IEEE80211_AKM_PSK;
300
301 if (wpa->i_groupcipher == IEEE80211_WPA_CIPHER_WEP40)
302 ess->rsngroupcipher = IEEE80211_CIPHER_WEP40;
303 else if (wpa->i_groupcipher == IEEE80211_WPA_CIPHER_TKIP)
304 ess->rsngroupcipher = IEEE80211_CIPHER_TKIP;
305 else if (wpa->i_groupcipher == IEEE80211_WPA_CIPHER_CCMP)
306 ess->rsngroupcipher = IEEE80211_CIPHER_CCMP;
307 else if (wpa->i_groupcipher == IEEE80211_WPA_CIPHER_WEP104)
308 ess->rsngroupcipher = IEEE80211_CIPHER_WEP104;
309 else { /* set to default */
310 if (ess->rsnprotos & IEEE80211_PROTO_WPA)
311 ess->rsngroupcipher = IEEE80211_CIPHER_TKIP;
312 else
313 ess->rsngroupcipher = IEEE80211_CIPHER_CCMP;
314 }
315
316 ess->rsnciphers = 0;
317 if (wpa->i_ciphers & IEEE80211_WPA_CIPHER_TKIP)
318 ess->rsnciphers |= IEEE80211_CIPHER_TKIP;
319 if (wpa->i_ciphers & IEEE80211_WPA_CIPHER_CCMP)
320 ess->rsnciphers |= IEEE80211_CIPHER_CCMP;
321 if (wpa->i_ciphers & IEEE80211_WPA_CIPHER_USEGROUP)
322 ess->rsnciphers = IEEE80211_CIPHER_USEGROUP;
323 if (ess->rsnciphers == 0) { /* set to default (CCMP, TKIP if WPA1) */
324 ess->rsnciphers = IEEE80211_CIPHER_CCMP;
325 if (ess->rsnprotos & IEEE80211_PROTO_WPA)
326 ess->rsnciphers |= IEEE80211_CIPHER_TKIP;
327 }
328
329 ess->flags |= IEEE80211_F_RSNON;
330
331 if (ess->rsnakms &
332 (IEEE80211_AKM_8021X|IEEE80211_WPA_AKM_SHA256_8021X))
333 ess->flags |= IEEE80211_JOIN_8021X;
334
335 return ENETRESET;
336 }
337
338 static void
ieee80211_ess_clear_wep(struct ieee80211_ess * ess)339 ieee80211_ess_clear_wep(struct ieee80211_ess *ess)
340 {
341 int i;
342
343 /* Disable WEP */
344 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
345 explicit_bzero(&ess->nw_keys[i], sizeof(ess->nw_keys[0]));
346 }
347 ess->def_txkey = 0;
348 ess->flags &= ~IEEE80211_F_WEPON;
349 }
350
351 static void
ieee80211_ess_clear_wpa(struct ieee80211_ess * ess)352 ieee80211_ess_clear_wpa(struct ieee80211_ess *ess)
353 {
354 /* Disable WPA */
355 ess->rsnprotos = ess->rsnakms = ess->rsngroupcipher =
356 ess->rsnciphers = 0;
357 explicit_bzero(ess->psk, sizeof(ess->psk));
358 ess->flags &= ~(IEEE80211_F_PSK | IEEE80211_F_RSNON);
359 }
360
361 int
ieee80211_add_ess(struct ieee80211com * ic,struct ieee80211_join * join)362 ieee80211_add_ess(struct ieee80211com *ic, struct ieee80211_join *join)
363 {
364 struct ieee80211_ess *ess;
365 int new = 0, ness = 0;
366
367 /* only valid for station (aka, client) mode */
368 if (ic->ic_opmode != IEEE80211_M_STA)
369 return (0);
370
371 TAILQ_FOREACH(ess, &ic->ic_ess, ess_next) {
372 if (ess->esslen == join->i_len &&
373 memcmp(ess->essid, join->i_nwid, ess->esslen) == 0)
374 break;
375 ness++;
376 }
377
378 if (ess == NULL) {
379 /* if not found, and wpa/wep are set, then return */
380 if ((join->i_flags & IEEE80211_JOIN_WPA) &&
381 (join->i_flags & IEEE80211_JOIN_NWKEY)) {
382 return (EINVAL);
383 }
384 if (ness > IEEE80211_CACHE_SIZE)
385 return (ERANGE);
386 new = 1;
387 ess = malloc(sizeof(*ess), M_DEVBUF, M_NOWAIT|M_ZERO);
388 if (ess == NULL)
389 return (ENOMEM);
390 memcpy(ess->essid, join->i_nwid, join->i_len);
391 ess->esslen = join->i_len;
392 }
393
394 if (join->i_flags & IEEE80211_JOIN_WPA) {
395 if (join->i_wpaparams.i_enabled) {
396 if (!(ic->ic_caps & IEEE80211_C_RSN)) {
397 free(ess, M_DEVBUF, sizeof(*ess));
398 return ENODEV;
399 }
400 ieee80211_ess_setwpaparms(ess,
401 &join->i_wpaparams);
402 if (join->i_flags & IEEE80211_JOIN_WPAPSK) {
403 ess->flags |= IEEE80211_F_PSK;
404 explicit_bzero(ess->psk, sizeof(ess->psk));
405 memcpy(ess->psk, &join->i_wpapsk.i_psk,
406 sizeof(ess->psk));
407 }
408 ieee80211_ess_clear_wep(ess);
409 } else {
410 ieee80211_ess_clear_wpa(ess);
411 }
412 } else if (join->i_flags & IEEE80211_JOIN_NWKEY) {
413 if (join->i_nwkey.i_wepon) {
414 if (!(ic->ic_caps & IEEE80211_C_WEP)) {
415 free(ess, M_DEVBUF, sizeof(*ess));
416 return ENODEV;
417 }
418 ieee80211_ess_setnwkeys(ess, &join->i_nwkey);
419 ieee80211_ess_clear_wpa(ess);
420 } else {
421 ieee80211_ess_clear_wep(ess);
422 }
423 }
424
425 if (new)
426 TAILQ_INSERT_TAIL(&ic->ic_ess, ess, ess_next);
427
428 return (0);
429 }
430
431 uint8_t
ieee80211_ess_adjust_rssi(struct ieee80211com * ic,struct ieee80211_node * ni)432 ieee80211_ess_adjust_rssi(struct ieee80211com *ic, struct ieee80211_node *ni)
433 {
434 uint8_t rssi = ni->ni_rssi;
435
436 /*
437 * Slightly punish 2 GHz RSSI values since they are usually
438 * stronger than 5 GHz RSSI values.
439 */
440 if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
441 if (ic->ic_max_rssi) {
442 uint8_t p = (5 * ic->ic_max_rssi) / 100;
443 if (rssi >= p)
444 rssi -= p; /* punish by 5% */
445 } else {
446 if (rssi >= 8)
447 rssi -= 8; /* punish by 8 dBm */
448 }
449 }
450
451 return rssi;
452 }
453
454 int
ieee80211_ess_calculate_score(struct ieee80211com * ic,struct ieee80211_node * ni)455 ieee80211_ess_calculate_score(struct ieee80211com *ic,
456 struct ieee80211_node *ni)
457 {
458 int score = 0;
459 uint8_t min_5ghz_rssi;
460
461 if (ic->ic_max_rssi)
462 min_5ghz_rssi = IEEE80211_RSSI_THRES_RATIO_5GHZ;
463 else
464 min_5ghz_rssi = (uint8_t)IEEE80211_RSSI_THRES_5GHZ;
465
466 /* not using join any */
467 if (ieee80211_get_ess(ic, ni->ni_essid, ni->ni_esslen))
468 score += 32;
469
470 /* Calculate the crypto score */
471 if (ni->ni_rsnprotos & IEEE80211_PROTO_RSN)
472 score += 16;
473 if (ni->ni_rsnprotos & IEEE80211_PROTO_WPA)
474 score += 8;
475 if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
476 score += 4;
477
478 /* 5GHz with a good signal */
479 if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) &&
480 ni->ni_rssi > min_5ghz_rssi)
481 score += 2;
482
483 /* HT/VHT available */
484 if (ieee80211_node_supports_ht(ni))
485 score++;
486 if (ieee80211_node_supports_vht(ni))
487 score++;
488
489 /* Boost this AP if it had no auth/assoc failures in the past. */
490 if (ni->ni_fails == 0)
491 score += 21;
492
493 return score;
494 }
495
496 /*
497 * Given two APs, determine the "better" one of the two.
498 * We compute a score based on the following attributes:
499 *
500 * crypto: wpa2 > wpa1 > wep > open
501 * band: 5 GHz > 2 GHz provided 5 GHz rssi is above threshold
502 * supported standard revisions: 11ac > 11n > 11a/b/g
503 * rssi: rssi1 > rssi2 as a numeric comparison with a slight
504 * disadvantage for 2 GHz APs
505 *
506 * Crypto carries most weight, followed by band, followed by rssi.
507 */
508 int
ieee80211_ess_is_better(struct ieee80211com * ic,struct ieee80211_node * nicur,struct ieee80211_node * nican)509 ieee80211_ess_is_better(struct ieee80211com *ic,
510 struct ieee80211_node *nicur, struct ieee80211_node *nican)
511 {
512 struct ifnet *ifp = &ic->ic_if;
513 int score_cur = 0, score_can = 0;
514 int cur_rssi, can_rssi;
515
516 score_cur = ieee80211_ess_calculate_score(ic, nicur);
517 score_can = ieee80211_ess_calculate_score(ic, nican);
518
519 cur_rssi = ieee80211_ess_adjust_rssi(ic, nicur);
520 can_rssi = ieee80211_ess_adjust_rssi(ic, nican);
521
522 if (can_rssi > cur_rssi)
523 score_can++;
524
525 if ((ifp->if_flags & IFF_DEBUG) && (score_can <= score_cur)) {
526 printf("%s: AP %s ", ifp->if_xname,
527 ether_sprintf(nican->ni_bssid));
528 ieee80211_print_essid(nican->ni_essid, nican->ni_esslen);
529 printf(" score %d\n", score_can);
530 }
531
532 return score_can > score_cur;
533 }
534
535 /* Determine whether a candidate AP belongs to a given ESS. */
536 int
ieee80211_match_ess(struct ieee80211_ess * ess,struct ieee80211_node * ni)537 ieee80211_match_ess(struct ieee80211_ess *ess, struct ieee80211_node *ni)
538 {
539 if (ess->esslen != 0 &&
540 (ess->esslen != ni->ni_esslen ||
541 memcmp(ess->essid, ni->ni_essid, ess->esslen) != 0)) {
542 ni->ni_assoc_fail |= IEEE80211_NODE_ASSOCFAIL_ESSID;
543 return 0;
544 }
545
546 if (ess->flags & (IEEE80211_F_PSK | IEEE80211_F_RSNON)) {
547 /* Ensure same WPA version. */
548 if ((ni->ni_rsnprotos & IEEE80211_PROTO_RSN) &&
549 (ess->rsnprotos & IEEE80211_PROTO_RSN) == 0) {
550 ni->ni_assoc_fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
551 return 0;
552 }
553 if ((ni->ni_rsnprotos & IEEE80211_PROTO_WPA) &&
554 (ess->rsnprotos & IEEE80211_PROTO_WPA) == 0) {
555 ni->ni_assoc_fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
556 return 0;
557 }
558 } else if (ess->flags & IEEE80211_F_WEPON) {
559 if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0) {
560 ni->ni_assoc_fail |= IEEE80211_NODE_ASSOCFAIL_PRIVACY;
561 return 0;
562 }
563 } else {
564 if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) != 0) {
565 ni->ni_assoc_fail |= IEEE80211_NODE_ASSOCFAIL_PRIVACY;
566 return 0;
567 }
568 }
569
570 if (ess->esslen == 0 &&
571 (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) != 0) {
572 ni->ni_assoc_fail |= IEEE80211_NODE_ASSOCFAIL_PRIVACY;
573 return 0;
574 }
575
576 return 1;
577 }
578
579 void
ieee80211_switch_ess(struct ieee80211com * ic)580 ieee80211_switch_ess(struct ieee80211com *ic)
581 {
582 struct ifnet *ifp = &ic->ic_if;
583 struct ieee80211_ess *ess, *seless = NULL;
584 struct ieee80211_node *ni, *selni = NULL;
585
586 if (!ISSET(ifp->if_flags, IFF_RUNNING))
587 return;
588
589 /* Find the best AP matching an entry on our ESS join list. */
590 RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree) {
591 if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
592 !IEEE80211_ADDR_EQ(ic->ic_des_bssid, ni->ni_bssid))
593 continue;
594
595 TAILQ_FOREACH(ess, &ic->ic_ess, ess_next) {
596 if (ieee80211_match_ess(ess, ni))
597 break;
598 }
599 if (ess == NULL)
600 continue;
601
602 /*
603 * Operate only on ic_des_essid if auto-join is disabled.
604 * We might have a password stored for this network.
605 */
606 if (!ISSET(ic->ic_flags, IEEE80211_F_AUTO_JOIN)) {
607 if (ic->ic_des_esslen == ni->ni_esslen &&
608 memcmp(ic->ic_des_essid, ni->ni_essid,
609 ni->ni_esslen) == 0) {
610 ieee80211_set_ess(ic, ess, ni);
611 return;
612 }
613 continue;
614 }
615
616 if (selni == NULL) {
617 seless = ess;
618 selni = ni;
619 continue;
620 }
621
622 if (ieee80211_ess_is_better(ic, selni, ni)) {
623 seless = ess;
624 selni = ni;
625 }
626 }
627
628 if (selni && seless && !(selni->ni_esslen == ic->ic_des_esslen &&
629 (memcmp(ic->ic_des_essid, selni->ni_essid,
630 IEEE80211_NWID_LEN) == 0))) {
631 if (ifp->if_flags & IFF_DEBUG) {
632 printf("%s: best AP %s ", ifp->if_xname,
633 ether_sprintf(selni->ni_bssid));
634 ieee80211_print_essid(selni->ni_essid,
635 selni->ni_esslen);
636 printf(" score %d\n",
637 ieee80211_ess_calculate_score(ic, selni));
638 printf("%s: switching to network ", ifp->if_xname);
639 ieee80211_print_essid(selni->ni_essid,
640 selni->ni_esslen);
641 if (seless->esslen == 0)
642 printf(" via join any");
643 printf("\n");
644
645 }
646 ieee80211_set_ess(ic, seless, selni);
647 }
648 }
649
650 void
ieee80211_set_ess(struct ieee80211com * ic,struct ieee80211_ess * ess,struct ieee80211_node * ni)651 ieee80211_set_ess(struct ieee80211com *ic, struct ieee80211_ess *ess,
652 struct ieee80211_node *ni)
653 {
654 memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
655 ic->ic_des_esslen = ni->ni_esslen;
656 memcpy(ic->ic_des_essid, ni->ni_essid, ic->ic_des_esslen);
657
658 ieee80211_disable_wep(ic);
659 ieee80211_disable_rsn(ic);
660
661 if (ess->flags & IEEE80211_F_RSNON) {
662 explicit_bzero(ic->ic_psk, sizeof(ic->ic_psk));
663 memcpy(ic->ic_psk, ess->psk, sizeof(ic->ic_psk));
664
665 ic->ic_rsnprotos = ess->rsnprotos;
666 ic->ic_rsnakms = ess->rsnakms;
667 ic->ic_rsngroupcipher = ess->rsngroupcipher;
668 ic->ic_rsnciphers = ess->rsnciphers;
669 ic->ic_flags |= IEEE80211_F_RSNON;
670 if (ess->flags & IEEE80211_F_PSK)
671 ic->ic_flags |= IEEE80211_F_PSK;
672 } else if (ess->flags & IEEE80211_F_WEPON) {
673 struct ieee80211_key *k;
674 int i;
675
676 for (i = 0; i < IEEE80211_WEP_NKID; i++) {
677 k = &ic->ic_nw_keys[i];
678 if (k->k_cipher != IEEE80211_CIPHER_NONE)
679 (*ic->ic_delete_key)(ic, NULL, k);
680 memcpy(&ic->ic_nw_keys[i], &ess->nw_keys[i],
681 sizeof(struct ieee80211_key));
682 if (k->k_cipher != IEEE80211_CIPHER_NONE)
683 (*ic->ic_set_key)(ic, NULL, k);
684 }
685 ic->ic_def_txkey = ess->def_txkey;
686 ic->ic_flags |= IEEE80211_F_WEPON;
687 }
688 }
689
690 void
ieee80211_deselect_ess(struct ieee80211com * ic)691 ieee80211_deselect_ess(struct ieee80211com *ic)
692 {
693 memset(ic->ic_des_essid, 0, IEEE80211_NWID_LEN);
694 ic->ic_des_esslen = 0;
695 ieee80211_disable_wep(ic);
696 ieee80211_disable_rsn(ic);
697 }
698
699 void
ieee80211_node_attach(struct ifnet * ifp)700 ieee80211_node_attach(struct ifnet *ifp)
701 {
702 struct ieee80211com *ic = (void *)ifp;
703 #ifndef IEEE80211_STA_ONLY
704 int size;
705 #endif
706
707 RBT_INIT(ieee80211_tree, &ic->ic_tree);
708 ic->ic_node_alloc = ieee80211_node_alloc;
709 ic->ic_node_free = ieee80211_node_free;
710 ic->ic_node_copy = ieee80211_node_copy;
711 ic->ic_node_getrssi = ieee80211_node_getrssi;
712 ic->ic_node_checkrssi = ieee80211_node_checkrssi;
713 ic->ic_scangen = 1;
714 ic->ic_max_nnodes = ieee80211_cache_size;
715
716 if (ic->ic_max_aid == 0)
717 ic->ic_max_aid = IEEE80211_AID_DEF;
718 else if (ic->ic_max_aid > IEEE80211_AID_MAX)
719 ic->ic_max_aid = IEEE80211_AID_MAX;
720 #ifndef IEEE80211_STA_ONLY
721 size = howmany(ic->ic_max_aid, 32) * sizeof(u_int32_t);
722 ic->ic_aid_bitmap = malloc(size, M_DEVBUF, M_NOWAIT | M_ZERO);
723 if (ic->ic_aid_bitmap == NULL) {
724 /* XXX no way to recover */
725 printf("%s: no memory for AID bitmap!\n", __func__);
726 ic->ic_max_aid = 0;
727 }
728 if (ic->ic_caps & (IEEE80211_C_HOSTAP | IEEE80211_C_IBSS)) {
729 ic->ic_tim_len = howmany(ic->ic_max_aid, 8);
730 ic->ic_tim_bitmap = malloc(ic->ic_tim_len, M_DEVBUF,
731 M_NOWAIT | M_ZERO);
732 if (ic->ic_tim_bitmap == NULL) {
733 printf("%s: no memory for TIM bitmap!\n", __func__);
734 ic->ic_tim_len = 0;
735 } else
736 ic->ic_set_tim = ieee80211_set_tim;
737 timeout_set(&ic->ic_rsn_timeout,
738 ieee80211_gtk_rekey_timeout, ic);
739 timeout_set(&ic->ic_inact_timeout,
740 ieee80211_inact_timeout, ic);
741 timeout_set(&ic->ic_node_cache_timeout,
742 ieee80211_node_cache_timeout, ic);
743 }
744 #endif
745 TAILQ_INIT(&ic->ic_ess);
746 }
747
748 struct ieee80211_node *
ieee80211_alloc_node_helper(struct ieee80211com * ic)749 ieee80211_alloc_node_helper(struct ieee80211com *ic)
750 {
751 struct ieee80211_node *ni;
752 if (ic->ic_nnodes >= ic->ic_max_nnodes)
753 ieee80211_clean_nodes(ic, 0);
754 if (ic->ic_nnodes >= ic->ic_max_nnodes)
755 return NULL;
756 ni = (*ic->ic_node_alloc)(ic);
757 return ni;
758 }
759
760 void
ieee80211_node_lateattach(struct ifnet * ifp)761 ieee80211_node_lateattach(struct ifnet *ifp)
762 {
763 struct ieee80211com *ic = (void *)ifp;
764 struct ieee80211_node *ni;
765
766 ni = ieee80211_alloc_node_helper(ic);
767 if (ni == NULL)
768 panic("unable to setup initial BSS node");
769 ni->ni_chan = IEEE80211_CHAN_ANYC;
770 ic->ic_bss = ieee80211_ref_node(ni);
771 ic->ic_txpower = IEEE80211_TXPOWER_MAX;
772 #ifndef IEEE80211_STA_ONLY
773 mq_init(&ni->ni_savedq, IEEE80211_PS_MAX_QUEUE, IPL_NET);
774 #endif
775 }
776
777 void
ieee80211_node_detach(struct ifnet * ifp)778 ieee80211_node_detach(struct ifnet *ifp)
779 {
780 struct ieee80211com *ic = (void *)ifp;
781
782 if (ic->ic_bss != NULL) {
783 (*ic->ic_node_free)(ic, ic->ic_bss);
784 ic->ic_bss = NULL;
785 }
786 ieee80211_del_ess(ic, NULL, 0, 1);
787 ieee80211_free_allnodes(ic, 1);
788 #ifndef IEEE80211_STA_ONLY
789 free(ic->ic_aid_bitmap, M_DEVBUF,
790 howmany(ic->ic_max_aid, 32) * sizeof(u_int32_t));
791 free(ic->ic_tim_bitmap, M_DEVBUF, ic->ic_tim_len);
792 timeout_del(&ic->ic_inact_timeout);
793 timeout_del(&ic->ic_node_cache_timeout);
794 timeout_del(&ic->ic_tkip_micfail_timeout);
795 #endif
796 timeout_del(&ic->ic_rsn_timeout);
797 }
798
799 /*
800 * AP scanning support.
801 */
802
803 /*
804 * Initialize the active channel set based on the set
805 * of available channels and the current PHY mode.
806 */
807 void
ieee80211_reset_scan(struct ifnet * ifp)808 ieee80211_reset_scan(struct ifnet *ifp)
809 {
810 struct ieee80211com *ic = (void *)ifp;
811
812 memcpy(ic->ic_chan_scan, ic->ic_chan_active,
813 sizeof(ic->ic_chan_active));
814 /* NB: hack, setup so next_scan starts with the first channel */
815 if (ic->ic_bss != NULL && ic->ic_bss->ni_chan == IEEE80211_CHAN_ANYC)
816 ic->ic_bss->ni_chan = &ic->ic_channels[IEEE80211_CHAN_MAX];
817 }
818
819 /*
820 * Increase a node's inactivity counter.
821 * This counter get reset to zero if a frame is received.
822 * This function is intended for station mode only.
823 * See ieee80211_node_cache_timeout() for hostap mode.
824 */
825 void
ieee80211_node_raise_inact(void * arg,struct ieee80211_node * ni)826 ieee80211_node_raise_inact(void *arg, struct ieee80211_node *ni)
827 {
828 if (ni->ni_refcnt == 0 && ni->ni_inact < IEEE80211_INACT_SCAN)
829 ni->ni_inact++;
830 }
831
832 /*
833 * Begin an active scan.
834 */
835 void
ieee80211_begin_scan(struct ifnet * ifp)836 ieee80211_begin_scan(struct ifnet *ifp)
837 {
838 struct ieee80211com *ic = (void *)ifp;
839
840 /*
841 * In all but hostap mode scanning starts off in
842 * an active mode before switching to passive.
843 */
844 #ifndef IEEE80211_STA_ONLY
845 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
846 #endif
847 {
848 ic->ic_flags |= IEEE80211_F_ASCAN;
849 ic->ic_stats.is_scan_active++;
850 }
851 #ifndef IEEE80211_STA_ONLY
852 else
853 ic->ic_stats.is_scan_passive++;
854 #endif
855 if (ifp->if_flags & IFF_DEBUG)
856 printf("%s: begin %s scan\n", ifp->if_xname,
857 (ic->ic_flags & IEEE80211_F_ASCAN) ?
858 "active" : "passive");
859
860
861 if (ic->ic_opmode == IEEE80211_M_STA) {
862 ieee80211_node_cleanup(ic, ic->ic_bss);
863 ieee80211_iterate_nodes(ic, ieee80211_node_raise_inact, NULL);
864 }
865
866 /*
867 * Reset the current mode. Setting the current mode will also
868 * reset scan state.
869 */
870 if (IFM_MODE(ic->ic_media.ifm_cur->ifm_media) == IFM_AUTO)
871 ic->ic_curmode = IEEE80211_MODE_AUTO;
872 ieee80211_setmode(ic, ic->ic_curmode);
873
874 ic->ic_scan_count = 0;
875
876 /* Scan the next channel. */
877 ieee80211_next_scan(ifp);
878 }
879
880 /*
881 * Switch to the next channel marked for scanning.
882 */
883 void
ieee80211_next_scan(struct ifnet * ifp)884 ieee80211_next_scan(struct ifnet *ifp)
885 {
886 struct ieee80211com *ic = (void *)ifp;
887 struct ieee80211_channel *chan;
888
889 chan = ic->ic_bss->ni_chan;
890 for (;;) {
891 if (++chan > &ic->ic_channels[IEEE80211_CHAN_MAX])
892 chan = &ic->ic_channels[0];
893 if (isset(ic->ic_chan_scan, ieee80211_chan2ieee(ic, chan))) {
894 /*
895 * Ignore channels marked passive-only
896 * during an active scan.
897 */
898 if ((ic->ic_flags & IEEE80211_F_ASCAN) == 0 ||
899 (chan->ic_flags & IEEE80211_CHAN_PASSIVE) == 0)
900 break;
901 }
902 if (chan == ic->ic_bss->ni_chan) {
903 ieee80211_end_scan(ifp);
904 return;
905 }
906 }
907 clrbit(ic->ic_chan_scan, ieee80211_chan2ieee(ic, chan));
908 DPRINTF(("chan %d->%d\n",
909 ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan),
910 ieee80211_chan2ieee(ic, chan)));
911 ic->ic_bss->ni_chan = chan;
912 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
913 }
914
915 #ifndef IEEE80211_STA_ONLY
916 void
ieee80211_create_ibss(struct ieee80211com * ic,struct ieee80211_channel * chan)917 ieee80211_create_ibss(struct ieee80211com* ic, struct ieee80211_channel *chan)
918 {
919 enum ieee80211_phymode mode;
920 struct ieee80211_node *ni;
921 struct ifnet *ifp = &ic->ic_if;
922
923 ni = ic->ic_bss;
924 if (ifp->if_flags & IFF_DEBUG)
925 printf("%s: creating ibss\n", ifp->if_xname);
926 ic->ic_flags |= IEEE80211_F_SIBSS;
927 ni->ni_chan = chan;
928 if ((ic->ic_flags & IEEE80211_F_VHTON) && IEEE80211_IS_CHAN_5GHZ(chan))
929 mode = IEEE80211_MODE_11AC;
930 else if (ic->ic_flags & IEEE80211_F_HTON)
931 mode = IEEE80211_MODE_11N;
932 else
933 mode = ieee80211_chan2mode(ic, ni->ni_chan);
934 ieee80211_setmode(ic, mode);
935 /* Pick an appropriate mode for supported legacy rates. */
936 if (ic->ic_curmode == IEEE80211_MODE_11AC) {
937 mode = IEEE80211_MODE_11A;
938 } else if (ic->ic_curmode == IEEE80211_MODE_11N) {
939 if (IEEE80211_IS_CHAN_5GHZ(chan))
940 mode = IEEE80211_MODE_11A;
941 else
942 mode = IEEE80211_MODE_11G;
943 } else {
944 mode = ic->ic_curmode;
945 }
946 ni->ni_rates = ic->ic_sup_rates[mode];
947 ni->ni_txrate = 0;
948 IEEE80211_ADDR_COPY(ni->ni_macaddr, ic->ic_myaddr);
949 IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_myaddr);
950 if (ic->ic_opmode == IEEE80211_M_IBSS) {
951 if ((ic->ic_flags & IEEE80211_F_DESBSSID) != 0)
952 IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_des_bssid);
953 else
954 ni->ni_bssid[0] |= 0x02; /* local bit for IBSS */
955 }
956 ni->ni_esslen = ic->ic_des_esslen;
957 memcpy(ni->ni_essid, ic->ic_des_essid, ni->ni_esslen);
958 ni->ni_rssi = 0;
959 ni->ni_rstamp = 0;
960 memset(ni->ni_tstamp, 0, sizeof(ni->ni_tstamp));
961 ni->ni_intval = ic->ic_lintval;
962 ni->ni_capinfo = IEEE80211_CAPINFO_IBSS;
963 if (ic->ic_flags & IEEE80211_F_WEPON)
964 ni->ni_capinfo |= IEEE80211_CAPINFO_PRIVACY;
965 if (ic->ic_flags & IEEE80211_F_HTON) {
966 const struct ieee80211_edca_ac_params *ac_qap;
967 struct ieee80211_edca_ac_params *ac;
968 int aci;
969
970 /*
971 * Configure HT protection. This will be updated later
972 * based on the number of non-HT nodes in the node cache.
973 */
974 ic->ic_protmode = IEEE80211_PROT_NONE;
975 ni->ni_htop1 = IEEE80211_HTPROT_NONE;
976 /* Disallow Greenfield mode. None of our drivers support it. */
977 ni->ni_htop1 |= IEEE80211_HTOP1_NONGF_STA;
978 if (ic->ic_updateprot)
979 ic->ic_updateprot(ic);
980
981 /* Configure QoS EDCA parameters. */
982 for (aci = 0; aci < EDCA_NUM_AC; aci++) {
983 ac = &ic->ic_edca_ac[aci];
984 ac_qap = &ieee80211_qap_edca_table[ic->ic_curmode][aci];
985 ac->ac_acm = ac_qap->ac_acm;
986 ac->ac_aifsn = ac_qap->ac_aifsn;
987 ac->ac_ecwmin = ac_qap->ac_ecwmin;
988 ac->ac_ecwmax = ac_qap->ac_ecwmax;
989 ac->ac_txoplimit = ac_qap->ac_txoplimit;
990 }
991 if (ic->ic_updateedca)
992 (*ic->ic_updateedca)(ic);
993 }
994 if (ic->ic_flags & IEEE80211_F_RSNON) {
995 struct ieee80211_key *k;
996
997 /* initialize 256-bit global key counter to a random value */
998 arc4random_buf(ic->ic_globalcnt, EAPOL_KEY_NONCE_LEN);
999
1000 ni->ni_rsnprotos = ic->ic_rsnprotos;
1001 ni->ni_rsnakms = ic->ic_rsnakms;
1002 ni->ni_rsnciphers = ic->ic_rsnciphers;
1003 ni->ni_rsngroupcipher = ic->ic_rsngroupcipher;
1004 ni->ni_rsngroupmgmtcipher = ic->ic_rsngroupmgmtcipher;
1005 ni->ni_rsncaps = 0;
1006 if (ic->ic_caps & IEEE80211_C_MFP) {
1007 ni->ni_rsncaps |= IEEE80211_RSNCAP_MFPC;
1008 if (ic->ic_flags & IEEE80211_F_MFPR)
1009 ni->ni_rsncaps |= IEEE80211_RSNCAP_MFPR;
1010 }
1011
1012 ic->ic_def_txkey = 1;
1013 ic->ic_flags &= ~IEEE80211_F_COUNTERM;
1014 k = &ic->ic_nw_keys[ic->ic_def_txkey];
1015 memset(k, 0, sizeof(*k));
1016 k->k_id = ic->ic_def_txkey;
1017 k->k_cipher = ni->ni_rsngroupcipher;
1018 k->k_flags = IEEE80211_KEY_GROUP | IEEE80211_KEY_TX;
1019 k->k_len = ieee80211_cipher_keylen(k->k_cipher);
1020 arc4random_buf(k->k_key, k->k_len);
1021 (*ic->ic_set_key)(ic, ni, k); /* XXX */
1022
1023 if (ic->ic_caps & IEEE80211_C_MFP) {
1024 ic->ic_igtk_kid = 4;
1025 k = &ic->ic_nw_keys[ic->ic_igtk_kid];
1026 memset(k, 0, sizeof(*k));
1027 k->k_id = ic->ic_igtk_kid;
1028 k->k_cipher = ni->ni_rsngroupmgmtcipher;
1029 k->k_flags = IEEE80211_KEY_IGTK | IEEE80211_KEY_TX;
1030 k->k_len = 16;
1031 arc4random_buf(k->k_key, k->k_len);
1032 (*ic->ic_set_key)(ic, ni, k); /* XXX */
1033 }
1034 /*
1035 * In HostAP mode, multicast traffic is sent using ic_bss
1036 * as the Tx node, so mark our node as valid so we can send
1037 * multicast frames using the group key we've just configured.
1038 */
1039 ni->ni_port_valid = 1;
1040 ni->ni_flags |= IEEE80211_NODE_TXPROT;
1041
1042 /* schedule a GTK/IGTK rekeying after 3600s */
1043 timeout_add_sec(&ic->ic_rsn_timeout, 3600);
1044 }
1045 timeout_add_sec(&ic->ic_inact_timeout, IEEE80211_INACT_WAIT);
1046 timeout_add_sec(&ic->ic_node_cache_timeout, IEEE80211_CACHE_WAIT);
1047 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1048 }
1049 #endif /* IEEE80211_STA_ONLY */
1050
1051 int
ieee80211_match_bss(struct ieee80211com * ic,struct ieee80211_node * ni,int bgscan)1052 ieee80211_match_bss(struct ieee80211com *ic, struct ieee80211_node *ni,
1053 int bgscan)
1054 {
1055 u_int8_t rate;
1056 int fail;
1057
1058 fail = 0;
1059 if ((ic->ic_flags & IEEE80211_F_BGSCAN) == 0 &&
1060 isclr(ic->ic_chan_active, ieee80211_chan2ieee(ic, ni->ni_chan)))
1061 fail |= IEEE80211_NODE_ASSOCFAIL_CHAN;
1062 if (ic->ic_des_chan != IEEE80211_CHAN_ANYC &&
1063 ni->ni_chan != ic->ic_des_chan)
1064 fail |= IEEE80211_NODE_ASSOCFAIL_CHAN;
1065 #ifndef IEEE80211_STA_ONLY
1066 if (ic->ic_opmode == IEEE80211_M_IBSS) {
1067 if ((ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) == 0)
1068 fail |= IEEE80211_NODE_ASSOCFAIL_IBSS;
1069 } else
1070 #endif
1071 {
1072 if ((ni->ni_capinfo & IEEE80211_CAPINFO_ESS) == 0)
1073 fail |= IEEE80211_NODE_ASSOCFAIL_IBSS;
1074 }
1075 if (ic->ic_flags & (IEEE80211_F_WEPON | IEEE80211_F_RSNON)) {
1076 if ((ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) == 0)
1077 fail |= IEEE80211_NODE_ASSOCFAIL_PRIVACY;
1078 } else {
1079 if (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY)
1080 fail |= IEEE80211_NODE_ASSOCFAIL_PRIVACY;
1081 }
1082
1083 rate = ieee80211_fix_rate(ic, ni, IEEE80211_F_DONEGO);
1084 if (rate & IEEE80211_RATE_BASIC)
1085 fail |= IEEE80211_NODE_ASSOCFAIL_BASIC_RATE;
1086 if (ic->ic_des_esslen == 0)
1087 fail |= IEEE80211_NODE_ASSOCFAIL_ESSID;
1088 if (ic->ic_des_esslen != 0 &&
1089 (ni->ni_esslen != ic->ic_des_esslen ||
1090 memcmp(ni->ni_essid, ic->ic_des_essid, ic->ic_des_esslen) != 0))
1091 fail |= IEEE80211_NODE_ASSOCFAIL_ESSID;
1092 if ((ic->ic_flags & IEEE80211_F_DESBSSID) &&
1093 !IEEE80211_ADDR_EQ(ic->ic_des_bssid, ni->ni_bssid))
1094 fail |= IEEE80211_NODE_ASSOCFAIL_BSSID;
1095
1096 if (ic->ic_flags & IEEE80211_F_RSNON) {
1097 /*
1098 * If at least one RSN IE field from the AP's RSN IE fails
1099 * to overlap with any value the STA supports, the STA shall
1100 * decline to associate with that AP.
1101 */
1102 if ((ni->ni_rsnprotos & ic->ic_rsnprotos) == 0)
1103 fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
1104 if ((ni->ni_rsnakms & ic->ic_rsnakms) == 0)
1105 fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
1106 if ((ni->ni_rsnakms & ic->ic_rsnakms &
1107 ~(IEEE80211_AKM_PSK | IEEE80211_AKM_SHA256_PSK)) == 0) {
1108 /* AP only supports PSK AKMPs */
1109 if (!(ic->ic_flags & IEEE80211_F_PSK))
1110 fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
1111 }
1112 if (ni->ni_rsngroupcipher != IEEE80211_CIPHER_WEP40 &&
1113 ni->ni_rsngroupcipher != IEEE80211_CIPHER_TKIP &&
1114 ni->ni_rsngroupcipher != IEEE80211_CIPHER_CCMP &&
1115 ni->ni_rsngroupcipher != IEEE80211_CIPHER_WEP104)
1116 fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
1117 if ((ni->ni_rsnciphers & ic->ic_rsnciphers) == 0)
1118 fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
1119
1120 /* we only support BIP as the IGTK cipher */
1121 if ((ni->ni_rsncaps & IEEE80211_RSNCAP_MFPC) &&
1122 ni->ni_rsngroupmgmtcipher != IEEE80211_CIPHER_BIP)
1123 fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
1124
1125 /* we do not support MFP but AP requires it */
1126 if (!(ic->ic_caps & IEEE80211_C_MFP) &&
1127 (ni->ni_rsncaps & IEEE80211_RSNCAP_MFPR))
1128 fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
1129
1130 /* we require MFP but AP does not support it */
1131 if ((ic->ic_caps & IEEE80211_C_MFP) &&
1132 (ic->ic_flags & IEEE80211_F_MFPR) &&
1133 !(ni->ni_rsncaps & IEEE80211_RSNCAP_MFPC))
1134 fail |= IEEE80211_NODE_ASSOCFAIL_WPA_PROTO;
1135 }
1136
1137 if (ic->ic_if.if_flags & IFF_DEBUG) {
1138 printf("%s: %c %s%c", ic->ic_if.if_xname, fail ? '-' : '+',
1139 ether_sprintf(ni->ni_bssid),
1140 fail & IEEE80211_NODE_ASSOCFAIL_BSSID ? '!' : ' ');
1141 printf(" %3d%c", ieee80211_chan2ieee(ic, ni->ni_chan),
1142 fail & IEEE80211_NODE_ASSOCFAIL_CHAN ? '!' : ' ');
1143 printf(" %+4d", ni->ni_rssi);
1144 printf(" %2dM%c", (rate & IEEE80211_RATE_VAL) / 2,
1145 fail & IEEE80211_NODE_ASSOCFAIL_BASIC_RATE ? '!' : ' ');
1146 printf(" %4s%c",
1147 (ni->ni_capinfo & IEEE80211_CAPINFO_ESS) ? "ess" :
1148 (ni->ni_capinfo & IEEE80211_CAPINFO_IBSS) ? "ibss" :
1149 "????",
1150 fail & IEEE80211_NODE_ASSOCFAIL_IBSS ? '!' : ' ');
1151 printf(" %7s%c ",
1152 (ni->ni_capinfo & IEEE80211_CAPINFO_PRIVACY) ?
1153 "privacy" : "no",
1154 fail & IEEE80211_NODE_ASSOCFAIL_PRIVACY ? '!' : ' ');
1155 printf(" %3s%c ",
1156 (ic->ic_flags & IEEE80211_F_RSNON) ?
1157 "rsn" : "no",
1158 fail & IEEE80211_NODE_ASSOCFAIL_WPA_PROTO ? '!' : ' ');
1159 ieee80211_print_essid(ni->ni_essid, ni->ni_esslen);
1160 printf("%s\n",
1161 fail & IEEE80211_NODE_ASSOCFAIL_ESSID ? "!" : "");
1162 }
1163
1164 /* We don't care about unrelated networks during background scans. */
1165 if (bgscan) {
1166 if ((fail & IEEE80211_NODE_ASSOCFAIL_ESSID) == 0)
1167 ni->ni_assoc_fail = fail;
1168 } else
1169 ni->ni_assoc_fail = fail;
1170 if ((fail & IEEE80211_NODE_ASSOCFAIL_ESSID) == 0)
1171 ic->ic_bss->ni_assoc_fail = ni->ni_assoc_fail;
1172
1173 return fail;
1174 }
1175
1176 struct ieee80211_node_switch_bss_arg {
1177 u_int8_t cur_macaddr[IEEE80211_ADDR_LEN];
1178 u_int8_t sel_macaddr[IEEE80211_ADDR_LEN];
1179 };
1180
1181 void
ieee80211_node_free_unref_cb(struct ieee80211_node * ni)1182 ieee80211_node_free_unref_cb(struct ieee80211_node *ni)
1183 {
1184 free(ni->ni_unref_arg, M_DEVBUF, ni->ni_unref_arg_size);
1185
1186 /* Guard against accidental reuse. */
1187 ni->ni_unref_cb = NULL;
1188 ni->ni_unref_arg = NULL;
1189 ni->ni_unref_arg_size = 0;
1190 }
1191
1192 /* Implements ni->ni_unref_cb(). */
1193 void
ieee80211_node_tx_stopped(struct ieee80211com * ic,struct ieee80211_node * ni)1194 ieee80211_node_tx_stopped(struct ieee80211com *ic,
1195 struct ieee80211_node *ni)
1196 {
1197 splassert(IPL_NET);
1198
1199 if ((ic->ic_flags & IEEE80211_F_BGSCAN) == 0)
1200 return;
1201
1202 /*
1203 * Install a callback which will switch us to the new AP once
1204 * the de-auth frame has been processed by hardware.
1205 * Pass on the existing ni->ni_unref_arg argument.
1206 */
1207 ic->ic_bss->ni_unref_cb = ieee80211_node_switch_bss;
1208
1209 /*
1210 * All data frames queued to hardware have been flushed and
1211 * A-MPDU Tx has been stopped. We are now going to switch APs.
1212 * Queue a de-auth frame addressed at our current AP.
1213 */
1214 if (IEEE80211_SEND_MGMT(ic, ic->ic_bss,
1215 IEEE80211_FC0_SUBTYPE_DEAUTH,
1216 IEEE80211_REASON_AUTH_LEAVE) != 0) {
1217 ic->ic_flags &= ~IEEE80211_F_BGSCAN;
1218 ieee80211_node_free_unref_cb(ni);
1219 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1220 return;
1221 }
1222
1223 /* F_BGSCAN flag gets cleared in ieee80211_node_join_bss(). */
1224 }
1225
1226 /* Implements ni->ni_unref_cb(). */
1227 void
ieee80211_node_tx_flushed(struct ieee80211com * ic,struct ieee80211_node * ni)1228 ieee80211_node_tx_flushed(struct ieee80211com *ic, struct ieee80211_node *ni)
1229 {
1230 splassert(IPL_NET);
1231
1232 if ((ic->ic_flags & IEEE80211_F_BGSCAN) == 0)
1233 return;
1234
1235 /* All data frames queued to hardware have been flushed. */
1236 if (ic->ic_caps & IEEE80211_C_TX_AMPDU) {
1237 /*
1238 * Install a callback which will switch us to the
1239 * new AP once Tx agg sessions have been stopped,
1240 * which involves sending a DELBA frame.
1241 * Pass on the existing ni->ni_unref_arg argument.
1242 */
1243 ic->ic_bss->ni_unref_cb = ieee80211_node_tx_stopped;
1244 ieee80211_stop_ampdu_tx(ic, ic->ic_bss,
1245 IEEE80211_FC0_SUBTYPE_DEAUTH);
1246 } else
1247 ieee80211_node_tx_stopped(ic, ni);
1248 }
1249
1250 /* Implements ni->ni_unref_cb(). */
1251 void
ieee80211_node_switch_bss(struct ieee80211com * ic,struct ieee80211_node * ni)1252 ieee80211_node_switch_bss(struct ieee80211com *ic, struct ieee80211_node *ni)
1253 {
1254 struct ifnet *ifp = &ic->ic_if;
1255 struct ieee80211_node_switch_bss_arg *sba = ni->ni_unref_arg;
1256 struct ieee80211_node *curbs, *selbs;
1257
1258 splassert(IPL_NET);
1259
1260 if ((ic->ic_flags & IEEE80211_F_BGSCAN) == 0)
1261 return;
1262
1263 ic->ic_xflags &= ~IEEE80211_F_TX_MGMT_ONLY;
1264
1265 selbs = ieee80211_find_node(ic, sba->sel_macaddr);
1266 if (selbs == NULL) {
1267 ieee80211_node_free_unref_cb(ni);
1268 ic->ic_flags &= ~IEEE80211_F_BGSCAN;
1269 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1270 return;
1271 }
1272
1273 curbs = ieee80211_find_node(ic, sba->cur_macaddr);
1274 if (curbs == NULL) {
1275 ieee80211_node_free_unref_cb(ni);
1276 ic->ic_flags &= ~IEEE80211_F_BGSCAN;
1277 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1278 return;
1279 }
1280
1281 if (ifp->if_flags & IFF_DEBUG) {
1282 printf("%s: roaming from %s chan %d ",
1283 ifp->if_xname, ether_sprintf(curbs->ni_macaddr),
1284 ieee80211_chan2ieee(ic, curbs->ni_chan));
1285 printf("to %s chan %d\n", ether_sprintf(selbs->ni_macaddr),
1286 ieee80211_chan2ieee(ic, selbs->ni_chan));
1287 }
1288 ieee80211_node_newstate(curbs, IEEE80211_STA_CACHE);
1289 /*
1290 * ieee80211_node_join_bss() frees arg and ic->ic_bss via
1291 * ic->ic_node_copy() in ieee80211_node_cleanup().
1292 */
1293 ieee80211_node_join_bss(ic, selbs);
1294 }
1295
1296 void
ieee80211_node_join_bss(struct ieee80211com * ic,struct ieee80211_node * selbs)1297 ieee80211_node_join_bss(struct ieee80211com *ic, struct ieee80211_node *selbs)
1298 {
1299 enum ieee80211_phymode mode;
1300 struct ieee80211_node *ni;
1301 uint32_t assoc_fail = 0;
1302
1303 /* Reinitialize media mode and channels if needed. */
1304 mode = ieee80211_chan2mode(ic, selbs->ni_chan);
1305 if (mode != ic->ic_curmode)
1306 ieee80211_setmode(ic, mode);
1307
1308 /* Keep recorded association failures for this BSS/ESS intact. */
1309 if (IEEE80211_ADDR_EQ(ic->ic_bss->ni_macaddr, selbs->ni_macaddr) ||
1310 (ic->ic_des_esslen > 0 && ic->ic_des_esslen == selbs->ni_esslen &&
1311 memcmp(ic->ic_des_essid, selbs->ni_essid, selbs->ni_esslen) == 0))
1312 assoc_fail = ic->ic_bss->ni_assoc_fail;
1313
1314 (*ic->ic_node_copy)(ic, ic->ic_bss, selbs);
1315 ni = ic->ic_bss;
1316 ni->ni_assoc_fail |= assoc_fail;
1317
1318 ic->ic_curmode = ieee80211_chan2mode(ic, ni->ni_chan);
1319
1320 /* Make sure we send valid rates in an association request. */
1321 if (ic->ic_opmode == IEEE80211_M_STA)
1322 ieee80211_fix_rate(ic, ni,
1323 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1324 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1325
1326 if (ic->ic_flags & IEEE80211_F_RSNON)
1327 ieee80211_choose_rsnparams(ic);
1328 else if (ic->ic_flags & IEEE80211_F_WEPON)
1329 ni->ni_rsncipher = IEEE80211_CIPHER_USEGROUP;
1330
1331 ieee80211_node_newstate(selbs, IEEE80211_STA_BSS);
1332 #ifndef IEEE80211_STA_ONLY
1333 if (ic->ic_opmode == IEEE80211_M_IBSS) {
1334 ieee80211_fix_rate(ic, ni, IEEE80211_F_DOFRATE |
1335 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1336 if (ni->ni_rates.rs_nrates == 0) {
1337 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1338 return;
1339 }
1340 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
1341 } else
1342 #endif
1343 {
1344 int bgscan = ((ic->ic_flags & IEEE80211_F_BGSCAN) &&
1345 ic->ic_opmode == IEEE80211_M_STA &&
1346 ic->ic_state == IEEE80211_S_RUN);
1347 int auth_next = (ic->ic_opmode == IEEE80211_M_STA &&
1348 ic->ic_state == IEEE80211_S_AUTH);
1349 int mgt = -1;
1350
1351 timeout_del(&ic->ic_bgscan_timeout);
1352 ic->ic_flags &= ~IEEE80211_F_BGSCAN;
1353
1354 /*
1355 * After a background scan, we have now switched APs.
1356 * Pretend we were just de-authed, which makes
1357 * ieee80211_new_state() try to re-auth and thus send
1358 * an AUTH frame to our newly selected AP.
1359 */
1360 if (bgscan)
1361 mgt = IEEE80211_FC0_SUBTYPE_DEAUTH;
1362 /*
1363 * If we are trying another AP after the previous one
1364 * failed (state transition AUTH->AUTH), ensure that
1365 * ieee80211_new_state() tries to send another auth frame.
1366 */
1367 else if (auth_next)
1368 mgt = IEEE80211_FC0_SUBTYPE_AUTH;
1369
1370 ieee80211_new_state(ic, IEEE80211_S_AUTH, mgt);
1371 }
1372 }
1373
1374 struct ieee80211_node *
ieee80211_node_choose_bss(struct ieee80211com * ic,int bgscan,struct ieee80211_node ** curbs)1375 ieee80211_node_choose_bss(struct ieee80211com *ic, int bgscan,
1376 struct ieee80211_node **curbs)
1377 {
1378 struct ieee80211_node *ni, *nextbs, *selbs = NULL,
1379 *selbs2 = NULL, *selbs5 = NULL;
1380 uint8_t min_5ghz_rssi;
1381
1382 ni = RBT_MIN(ieee80211_tree, &ic->ic_tree);
1383
1384 for (; ni != NULL; ni = nextbs) {
1385 nextbs = RBT_NEXT(ieee80211_tree, ni);
1386 if (ni->ni_fails) {
1387 /*
1388 * The configuration of the access points may change
1389 * during my scan. So delete the entry for the AP
1390 * and retry to associate if there is another beacon.
1391 */
1392 if (ni->ni_fails++ > 2)
1393 ieee80211_free_node(ic, ni);
1394 continue;
1395 }
1396
1397 if (curbs && ieee80211_node_cmp(ic->ic_bss, ni) == 0)
1398 *curbs = ni;
1399
1400 if (ieee80211_match_bss(ic, ni, bgscan) != 0)
1401 continue;
1402
1403 if (ic->ic_caps & IEEE80211_C_SCANALLBAND) {
1404 if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan) &&
1405 (selbs2 == NULL || ni->ni_rssi > selbs2->ni_rssi))
1406 selbs2 = ni;
1407 else if (IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) &&
1408 (selbs5 == NULL || ni->ni_rssi > selbs5->ni_rssi))
1409 selbs5 = ni;
1410 } else if (selbs == NULL || ni->ni_rssi > selbs->ni_rssi)
1411 selbs = ni;
1412 }
1413
1414 if (ic->ic_max_rssi)
1415 min_5ghz_rssi = IEEE80211_RSSI_THRES_RATIO_5GHZ;
1416 else
1417 min_5ghz_rssi = (uint8_t)IEEE80211_RSSI_THRES_5GHZ;
1418
1419 /*
1420 * Prefer a 5Ghz AP even if its RSSI is weaker than the best 2Ghz AP
1421 * (as long as it meets the minimum RSSI threshold) since the 5Ghz band
1422 * is usually less saturated.
1423 */
1424 if (selbs5 && (*ic->ic_node_checkrssi)(ic, selbs5))
1425 selbs = selbs5;
1426 else if (selbs5 && selbs2)
1427 selbs = (selbs5->ni_rssi >= selbs2->ni_rssi ? selbs5 : selbs2);
1428 else if (selbs2)
1429 selbs = selbs2;
1430 else if (selbs5)
1431 selbs = selbs5;
1432
1433 return selbs;
1434 }
1435
1436 /*
1437 * Complete a scan of potential channels.
1438 */
1439 void
ieee80211_end_scan(struct ifnet * ifp)1440 ieee80211_end_scan(struct ifnet *ifp)
1441 {
1442 struct ieee80211com *ic = (void *)ifp;
1443 struct ieee80211_node *ni, *selbs = NULL, *curbs = NULL;
1444 int bgscan = ((ic->ic_flags & IEEE80211_F_BGSCAN) &&
1445 ic->ic_opmode == IEEE80211_M_STA &&
1446 ic->ic_state == IEEE80211_S_RUN);
1447
1448 if (ifp->if_flags & IFF_DEBUG)
1449 printf("%s: end %s scan\n", ifp->if_xname,
1450 bgscan ? "background" :
1451 ((ic->ic_flags & IEEE80211_F_ASCAN) ?
1452 "active" : "passive"));
1453
1454 if (ic->ic_scan_count)
1455 ic->ic_flags &= ~IEEE80211_F_ASCAN;
1456
1457 if (ic->ic_opmode == IEEE80211_M_STA)
1458 ieee80211_clean_inactive_nodes(ic, IEEE80211_INACT_SCAN);
1459
1460 ni = RBT_MIN(ieee80211_tree, &ic->ic_tree);
1461
1462 #ifndef IEEE80211_STA_ONLY
1463 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1464 /* XXX off stack? */
1465 u_char occupied[howmany(IEEE80211_CHAN_MAX, NBBY)];
1466 int i, fail;
1467
1468 /*
1469 * The passive scan to look for existing AP's completed,
1470 * select a channel to camp on. Identify the channels
1471 * that already have one or more AP's and try to locate
1472 * an unoccupied one. If that fails, pick a random
1473 * channel from the active set.
1474 */
1475 memset(occupied, 0, sizeof(occupied));
1476 RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree)
1477 setbit(occupied, ieee80211_chan2ieee(ic, ni->ni_chan));
1478 for (i = 0; i < IEEE80211_CHAN_MAX; i++)
1479 if (isset(ic->ic_chan_active, i) && isclr(occupied, i))
1480 break;
1481 if (i == IEEE80211_CHAN_MAX) {
1482 fail = arc4random() & 3; /* random 0-3 */
1483 for (i = 0; i < IEEE80211_CHAN_MAX; i++)
1484 if (isset(ic->ic_chan_active, i) && fail-- == 0)
1485 break;
1486 }
1487 ieee80211_create_ibss(ic, &ic->ic_channels[i]);
1488 return;
1489 }
1490 #endif
1491 if (ni == NULL) {
1492 DPRINTF(("no scan candidate\n"));
1493 notfound:
1494
1495 #ifndef IEEE80211_STA_ONLY
1496 if (ic->ic_opmode == IEEE80211_M_IBSS &&
1497 (ic->ic_flags & IEEE80211_F_IBSSON) &&
1498 ic->ic_des_esslen != 0) {
1499 ieee80211_create_ibss(ic, ic->ic_ibss_chan);
1500 return;
1501 }
1502 #endif
1503 /*
1504 * Reset the list of channels to scan and scan the next mode
1505 * if nothing has been found.
1506 * If the device scans all bands in one fell swoop, return
1507 * current scan results to userspace regardless of mode.
1508 * This will loop forever until an access point is found.
1509 */
1510 ieee80211_reset_scan(ifp);
1511 if (ieee80211_next_mode(ifp) == IEEE80211_MODE_AUTO ||
1512 (ic->ic_caps & IEEE80211_C_SCANALLBAND))
1513 ic->ic_scan_count++;
1514
1515 ieee80211_next_scan(ifp);
1516 return;
1517 }
1518
1519 /* Possibly switch which ssid we are associated with */
1520 if (!bgscan && ic->ic_opmode == IEEE80211_M_STA)
1521 ieee80211_switch_ess(ic);
1522
1523 selbs = ieee80211_node_choose_bss(ic, bgscan, &curbs);
1524 if (bgscan) {
1525 struct ieee80211_node_switch_bss_arg *arg;
1526
1527 /* AP disappeared? Should not happen. */
1528 if (selbs == NULL || curbs == NULL) {
1529 ic->ic_flags &= ~IEEE80211_F_BGSCAN;
1530 goto notfound;
1531 }
1532
1533 /*
1534 * After a background scan we might end up choosing the
1535 * same AP again. Or the newly selected AP's RSSI level
1536 * might be low enough to trigger another background scan.
1537 * Do not change ic->ic_bss in these cases and make
1538 * background scans less frequent.
1539 */
1540 if (selbs == curbs || !(*ic->ic_node_checkrssi)(ic, selbs)) {
1541 if (ic->ic_bgscan_fail < IEEE80211_BGSCAN_FAIL_MAX) {
1542 if (ic->ic_bgscan_fail <= 0)
1543 ic->ic_bgscan_fail = 1;
1544 else
1545 ic->ic_bgscan_fail *= 2;
1546 }
1547 ic->ic_flags &= ~IEEE80211_F_BGSCAN;
1548
1549 /*
1550 * HT is negotiated during association so we must use
1551 * ic_bss to check HT. The nodes tree was re-populated
1552 * during background scan and therefore selbs and curbs
1553 * may not carry HT information.
1554 */
1555 ni = ic->ic_bss;
1556 if (ni->ni_flags & IEEE80211_NODE_VHT)
1557 ieee80211_setmode(ic, IEEE80211_MODE_11AC);
1558 else if (ni->ni_flags & IEEE80211_NODE_HT)
1559 ieee80211_setmode(ic, IEEE80211_MODE_11N);
1560 else
1561 ieee80211_setmode(ic,
1562 ieee80211_chan2mode(ic, ni->ni_chan));
1563 return;
1564 }
1565
1566 arg = malloc(sizeof(*arg), M_DEVBUF, M_NOWAIT | M_ZERO);
1567 if (arg == NULL) {
1568 ic->ic_flags &= ~IEEE80211_F_BGSCAN;
1569 return;
1570 }
1571
1572 ic->ic_bgscan_fail = 0;
1573
1574 /* Prevent dispatch of additional data frames to hardware. */
1575 ic->ic_xflags |= IEEE80211_F_TX_MGMT_ONLY;
1576
1577 IEEE80211_ADDR_COPY(arg->cur_macaddr, curbs->ni_macaddr);
1578 IEEE80211_ADDR_COPY(arg->sel_macaddr, selbs->ni_macaddr);
1579
1580 if (ic->ic_bgscan_done) {
1581 /*
1582 * The driver will flush its queues and allow roaming
1583 * to proceed once queues have been flushed.
1584 * On failure the driver will move back to SCAN state.
1585 */
1586 ic->ic_bgscan_done(ic, arg, sizeof(*arg));
1587 return;
1588 }
1589
1590 /*
1591 * Install a callback which will switch us to the new AP once
1592 * all dispatched frames have been processed by hardware.
1593 */
1594 ic->ic_bss->ni_unref_arg = arg;
1595 ic->ic_bss->ni_unref_arg_size = sizeof(*arg);
1596 if (ic->ic_bss->ni_refcnt > 0)
1597 ic->ic_bss->ni_unref_cb = ieee80211_node_tx_flushed;
1598 else
1599 ieee80211_node_tx_flushed(ic, ni);
1600 /* F_BGSCAN flag gets cleared in ieee80211_node_join_bss(). */
1601 return;
1602 } else if (selbs == NULL)
1603 goto notfound;
1604
1605 ieee80211_node_join_bss(ic, selbs);
1606 }
1607
1608 /*
1609 * Autoselect the best RSN parameters (protocol, AKMP, pairwise cipher...)
1610 * that are supported by both peers (STA mode only).
1611 */
1612 void
ieee80211_choose_rsnparams(struct ieee80211com * ic)1613 ieee80211_choose_rsnparams(struct ieee80211com *ic)
1614 {
1615 struct ieee80211_node *ni = ic->ic_bss;
1616 struct ieee80211_pmk *pmk;
1617
1618 /* filter out unsupported protocol versions */
1619 ni->ni_rsnprotos &= ic->ic_rsnprotos;
1620 /* prefer RSN (aka WPA2) over WPA */
1621 if (ni->ni_rsnprotos & IEEE80211_PROTO_RSN)
1622 ni->ni_rsnprotos = IEEE80211_PROTO_RSN;
1623 else
1624 ni->ni_rsnprotos = IEEE80211_PROTO_WPA;
1625
1626 /* filter out unsupported AKMPs */
1627 ni->ni_rsnakms &= ic->ic_rsnakms;
1628 /* prefer SHA-256 based AKMPs */
1629 if ((ic->ic_flags & IEEE80211_F_PSK) && (ni->ni_rsnakms &
1630 (IEEE80211_AKM_PSK | IEEE80211_AKM_SHA256_PSK))) {
1631 /* AP supports PSK AKMP and a PSK is configured */
1632 if (ni->ni_rsnakms & IEEE80211_AKM_SHA256_PSK)
1633 ni->ni_rsnakms = IEEE80211_AKM_SHA256_PSK;
1634 else
1635 ni->ni_rsnakms = IEEE80211_AKM_PSK;
1636 } else {
1637 if (ni->ni_rsnakms & IEEE80211_AKM_SHA256_8021X)
1638 ni->ni_rsnakms = IEEE80211_AKM_SHA256_8021X;
1639 else
1640 ni->ni_rsnakms = IEEE80211_AKM_8021X;
1641 /* check if we have a cached PMK for this AP */
1642 if (ni->ni_rsnprotos == IEEE80211_PROTO_RSN &&
1643 (pmk = ieee80211_pmksa_find(ic, ni, NULL)) != NULL) {
1644 memcpy(ni->ni_pmkid, pmk->pmk_pmkid,
1645 IEEE80211_PMKID_LEN);
1646 ni->ni_flags |= IEEE80211_NODE_PMKID;
1647 }
1648 }
1649
1650 /* filter out unsupported pairwise ciphers */
1651 ni->ni_rsnciphers &= ic->ic_rsnciphers;
1652 /* prefer CCMP over TKIP */
1653 if (ni->ni_rsnciphers & IEEE80211_CIPHER_CCMP)
1654 ni->ni_rsnciphers = IEEE80211_CIPHER_CCMP;
1655 else
1656 ni->ni_rsnciphers = IEEE80211_CIPHER_TKIP;
1657 ni->ni_rsncipher = ni->ni_rsnciphers;
1658
1659 /* use MFP if we both support it */
1660 if ((ic->ic_caps & IEEE80211_C_MFP) &&
1661 (ni->ni_rsncaps & IEEE80211_RSNCAP_MFPC))
1662 ni->ni_flags |= IEEE80211_NODE_MFP;
1663 }
1664
1665 int
ieee80211_get_rate(struct ieee80211com * ic)1666 ieee80211_get_rate(struct ieee80211com *ic)
1667 {
1668 u_int8_t (*rates)[IEEE80211_RATE_MAXSIZE];
1669 int rate;
1670
1671 rates = &ic->ic_bss->ni_rates.rs_rates;
1672
1673 if (ic->ic_fixed_rate != -1)
1674 rate = (*rates)[ic->ic_fixed_rate];
1675 else if (ic->ic_state == IEEE80211_S_RUN)
1676 rate = (*rates)[ic->ic_bss->ni_txrate];
1677 else
1678 rate = 0;
1679
1680 return rate & IEEE80211_RATE_VAL;
1681 }
1682
1683 struct ieee80211_node *
ieee80211_node_alloc(struct ieee80211com * ic)1684 ieee80211_node_alloc(struct ieee80211com *ic)
1685 {
1686 return malloc(sizeof(struct ieee80211_node), M_DEVBUF,
1687 M_NOWAIT | M_ZERO);
1688 }
1689
1690 void
ieee80211_node_cleanup(struct ieee80211com * ic,struct ieee80211_node * ni)1691 ieee80211_node_cleanup(struct ieee80211com *ic, struct ieee80211_node *ni)
1692 {
1693 if (ni->ni_rsnie != NULL) {
1694 free(ni->ni_rsnie, M_DEVBUF, 2 + ni->ni_rsnie[1]);
1695 ni->ni_rsnie = NULL;
1696 }
1697 ieee80211_ba_del(ni);
1698 #ifndef IEEE80211_STA_ONLY
1699 mq_purge(&ni->ni_savedq);
1700 #endif
1701 ieee80211_node_free_unref_cb(ni);
1702 }
1703
1704 void
ieee80211_node_free(struct ieee80211com * ic,struct ieee80211_node * ni)1705 ieee80211_node_free(struct ieee80211com *ic, struct ieee80211_node *ni)
1706 {
1707 ieee80211_node_cleanup(ic, ni);
1708 free(ni, M_DEVBUF, 0);
1709 }
1710
1711 void
ieee80211_node_copy(struct ieee80211com * ic,struct ieee80211_node * dst,const struct ieee80211_node * src)1712 ieee80211_node_copy(struct ieee80211com *ic,
1713 struct ieee80211_node *dst, const struct ieee80211_node *src)
1714 {
1715 ieee80211_node_cleanup(ic, dst);
1716 *dst = *src;
1717 dst->ni_rsnie = NULL;
1718 if (src->ni_rsnie != NULL)
1719 ieee80211_save_ie(src->ni_rsnie, &dst->ni_rsnie);
1720 ieee80211_node_set_timeouts(dst);
1721 #ifndef IEEE80211_STA_ONLY
1722 mq_init(&dst->ni_savedq, IEEE80211_PS_MAX_QUEUE, IPL_NET);
1723 #endif
1724 }
1725
1726 u_int8_t
ieee80211_node_getrssi(struct ieee80211com * ic,const struct ieee80211_node * ni)1727 ieee80211_node_getrssi(struct ieee80211com *ic,
1728 const struct ieee80211_node *ni)
1729 {
1730 return ni->ni_rssi;
1731 }
1732
1733 int
ieee80211_node_checkrssi(struct ieee80211com * ic,const struct ieee80211_node * ni)1734 ieee80211_node_checkrssi(struct ieee80211com *ic,
1735 const struct ieee80211_node *ni)
1736 {
1737 uint8_t thres;
1738
1739 if (ni->ni_chan == IEEE80211_CHAN_ANYC)
1740 return 0;
1741
1742 if (ic->ic_max_rssi) {
1743 thres = (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) ?
1744 IEEE80211_RSSI_THRES_RATIO_2GHZ :
1745 IEEE80211_RSSI_THRES_RATIO_5GHZ;
1746 return ((ni->ni_rssi * 100) / ic->ic_max_rssi >= thres);
1747 }
1748
1749 thres = (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) ?
1750 IEEE80211_RSSI_THRES_2GHZ :
1751 IEEE80211_RSSI_THRES_5GHZ;
1752 return (ni->ni_rssi >= (u_int8_t)thres);
1753 }
1754
1755 void
ieee80211_node_set_timeouts(struct ieee80211_node * ni)1756 ieee80211_node_set_timeouts(struct ieee80211_node *ni)
1757 {
1758 int i;
1759
1760 #ifndef IEEE80211_STA_ONLY
1761 timeout_set(&ni->ni_eapol_to, ieee80211_eapol_timeout, ni);
1762 timeout_set(&ni->ni_sa_query_to, ieee80211_sa_query_timeout, ni);
1763 #endif
1764 timeout_set(&ni->ni_addba_req_to[EDCA_AC_BE],
1765 ieee80211_node_addba_request_ac_be_to, ni);
1766 timeout_set(&ni->ni_addba_req_to[EDCA_AC_BK],
1767 ieee80211_node_addba_request_ac_bk_to, ni);
1768 timeout_set(&ni->ni_addba_req_to[EDCA_AC_VI],
1769 ieee80211_node_addba_request_ac_vi_to, ni);
1770 timeout_set(&ni->ni_addba_req_to[EDCA_AC_VO],
1771 ieee80211_node_addba_request_ac_vo_to, ni);
1772 for (i = 0; i < nitems(ni->ni_addba_req_intval); i++)
1773 ni->ni_addba_req_intval[i] = 1;
1774 }
1775
1776 void
ieee80211_setup_node(struct ieee80211com * ic,struct ieee80211_node * ni,const u_int8_t * macaddr)1777 ieee80211_setup_node(struct ieee80211com *ic,
1778 struct ieee80211_node *ni, const u_int8_t *macaddr)
1779 {
1780 int i, s;
1781
1782 DPRINTF(("%s\n", ether_sprintf((u_int8_t *)macaddr)));
1783 IEEE80211_ADDR_COPY(ni->ni_macaddr, macaddr);
1784 ieee80211_node_newstate(ni, IEEE80211_STA_CACHE);
1785
1786 ni->ni_ic = ic; /* back-pointer */
1787 /* Initialize cached last sequence numbers with invalid values. */
1788 ni->ni_rxseq = 0xffffU;
1789 for (i=0; i < IEEE80211_NUM_TID; ++i)
1790 ni->ni_qos_rxseqs[i] = 0xffffU;
1791 #ifndef IEEE80211_STA_ONLY
1792 mq_init(&ni->ni_savedq, IEEE80211_PS_MAX_QUEUE, IPL_NET);
1793 #endif
1794 ieee80211_node_set_timeouts(ni);
1795
1796 s = splnet();
1797 RBT_INSERT(ieee80211_tree, &ic->ic_tree, ni);
1798 ic->ic_nnodes++;
1799 splx(s);
1800 }
1801
1802 struct ieee80211_node *
ieee80211_alloc_node(struct ieee80211com * ic,const u_int8_t * macaddr)1803 ieee80211_alloc_node(struct ieee80211com *ic, const u_int8_t *macaddr)
1804 {
1805 struct ieee80211_node *ni = ieee80211_alloc_node_helper(ic);
1806 if (ni != NULL)
1807 ieee80211_setup_node(ic, ni, macaddr);
1808 else
1809 ic->ic_stats.is_rx_nodealloc++;
1810 return ni;
1811 }
1812
1813 struct ieee80211_node *
ieee80211_dup_bss(struct ieee80211com * ic,const u_int8_t * macaddr)1814 ieee80211_dup_bss(struct ieee80211com *ic, const u_int8_t *macaddr)
1815 {
1816 struct ieee80211_node *ni = ieee80211_alloc_node_helper(ic);
1817 if (ni != NULL) {
1818 ieee80211_setup_node(ic, ni, macaddr);
1819 /*
1820 * Inherit from ic_bss.
1821 */
1822 IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
1823 ni->ni_chan = ic->ic_bss->ni_chan;
1824 } else
1825 ic->ic_stats.is_rx_nodealloc++;
1826 return ni;
1827 }
1828
1829 struct ieee80211_node *
ieee80211_find_node(struct ieee80211com * ic,const u_int8_t * macaddr)1830 ieee80211_find_node(struct ieee80211com *ic, const u_int8_t *macaddr)
1831 {
1832 struct ieee80211_node *ni;
1833 int cmp;
1834
1835 /* similar to RBT_FIND except we compare keys, not nodes */
1836 ni = RBT_ROOT(ieee80211_tree, &ic->ic_tree);
1837 while (ni != NULL) {
1838 cmp = memcmp(macaddr, ni->ni_macaddr, IEEE80211_ADDR_LEN);
1839 if (cmp < 0)
1840 ni = RBT_LEFT(ieee80211_tree, ni);
1841 else if (cmp > 0)
1842 ni = RBT_RIGHT(ieee80211_tree, ni);
1843 else
1844 break;
1845 }
1846 return ni;
1847 }
1848
1849 /*
1850 * Return a reference to the appropriate node for sending
1851 * a data frame. This handles node discovery in adhoc networks.
1852 *
1853 * Drivers will call this, so increase the reference count before
1854 * returning the node.
1855 */
1856 struct ieee80211_node *
ieee80211_find_txnode(struct ieee80211com * ic,const u_int8_t * macaddr)1857 ieee80211_find_txnode(struct ieee80211com *ic, const u_int8_t *macaddr)
1858 {
1859 #ifndef IEEE80211_STA_ONLY
1860 struct ieee80211_node *ni;
1861 int s;
1862 #endif
1863
1864 /*
1865 * The destination address should be in the node table
1866 * unless we are operating in station mode or this is a
1867 * multicast/broadcast frame.
1868 */
1869 if (ic->ic_opmode == IEEE80211_M_STA || IEEE80211_IS_MULTICAST(macaddr))
1870 return ieee80211_ref_node(ic->ic_bss);
1871
1872 #ifndef IEEE80211_STA_ONLY
1873 s = splnet();
1874 ni = ieee80211_find_node(ic, macaddr);
1875 splx(s);
1876 if (ni == NULL) {
1877 if (ic->ic_opmode != IEEE80211_M_IBSS &&
1878 ic->ic_opmode != IEEE80211_M_AHDEMO)
1879 return NULL;
1880
1881 /*
1882 * Fake up a node; this handles node discovery in
1883 * adhoc mode. Note that for the driver's benefit
1884 * we treat this like an association so the driver
1885 * has an opportunity to setup its private state.
1886 *
1887 * XXX need better way to handle this; issue probe
1888 * request so we can deduce rate set, etc.
1889 */
1890 if ((ni = ieee80211_dup_bss(ic, macaddr)) == NULL)
1891 return NULL;
1892 /* XXX no rate negotiation; just dup */
1893 ni->ni_rates = ic->ic_bss->ni_rates;
1894 ni->ni_txrate = 0;
1895 if (ic->ic_newassoc)
1896 (*ic->ic_newassoc)(ic, ni, 1);
1897 }
1898 return ieee80211_ref_node(ni);
1899 #else
1900 return NULL; /* can't get there */
1901 #endif /* IEEE80211_STA_ONLY */
1902 }
1903
1904 /*
1905 * It is usually desirable to process a Rx packet using its sender's
1906 * node-record instead of the BSS record.
1907 *
1908 * - AP mode: keep a node-record for every authenticated/associated
1909 * station *in the BSS*. For future use, we also track neighboring
1910 * APs, since they might belong to the same ESS. APs in the same
1911 * ESS may bridge packets to each other, forming a Wireless
1912 * Distribution System (WDS).
1913 *
1914 * - IBSS mode: keep a node-record for every station *in the BSS*.
1915 * Also track neighboring stations by their beacons/probe responses.
1916 *
1917 * - monitor mode: keep a node-record for every sender, regardless
1918 * of BSS.
1919 *
1920 * - STA mode: the only available node-record is the BSS record,
1921 * ic->ic_bss.
1922 *
1923 * Of all the 802.11 Control packets, only the node-records for
1924 * RTS packets node-record can be looked up.
1925 *
1926 * Return non-zero if the packet's node-record is kept, zero
1927 * otherwise.
1928 */
1929 static __inline int
ieee80211_needs_rxnode(struct ieee80211com * ic,const struct ieee80211_frame * wh,const u_int8_t ** bssid)1930 ieee80211_needs_rxnode(struct ieee80211com *ic,
1931 const struct ieee80211_frame *wh, const u_int8_t **bssid)
1932 {
1933 int monitor, rc = 0;
1934
1935 monitor = (ic->ic_opmode == IEEE80211_M_MONITOR);
1936
1937 *bssid = NULL;
1938
1939 switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1940 case IEEE80211_FC0_TYPE_CTL:
1941 if (!monitor)
1942 break;
1943 return (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1944 IEEE80211_FC0_SUBTYPE_RTS;
1945 case IEEE80211_FC0_TYPE_MGT:
1946 *bssid = wh->i_addr3;
1947 switch (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) {
1948 case IEEE80211_FC0_SUBTYPE_BEACON:
1949 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1950 break;
1951 default:
1952 #ifndef IEEE80211_STA_ONLY
1953 if (ic->ic_opmode == IEEE80211_M_STA)
1954 break;
1955 rc = IEEE80211_ADDR_EQ(*bssid, ic->ic_bss->ni_bssid) ||
1956 IEEE80211_ADDR_EQ(*bssid, etherbroadcastaddr);
1957 #endif
1958 break;
1959 }
1960 break;
1961 case IEEE80211_FC0_TYPE_DATA:
1962 switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
1963 case IEEE80211_FC1_DIR_NODS:
1964 *bssid = wh->i_addr3;
1965 #ifndef IEEE80211_STA_ONLY
1966 if (ic->ic_opmode == IEEE80211_M_IBSS ||
1967 ic->ic_opmode == IEEE80211_M_AHDEMO)
1968 rc = IEEE80211_ADDR_EQ(*bssid,
1969 ic->ic_bss->ni_bssid);
1970 #endif
1971 break;
1972 case IEEE80211_FC1_DIR_TODS:
1973 *bssid = wh->i_addr1;
1974 #ifndef IEEE80211_STA_ONLY
1975 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
1976 rc = IEEE80211_ADDR_EQ(*bssid,
1977 ic->ic_bss->ni_bssid);
1978 #endif
1979 break;
1980 case IEEE80211_FC1_DIR_FROMDS:
1981 case IEEE80211_FC1_DIR_DSTODS:
1982 *bssid = wh->i_addr2;
1983 #ifndef IEEE80211_STA_ONLY
1984 rc = (ic->ic_opmode == IEEE80211_M_HOSTAP);
1985 #endif
1986 break;
1987 }
1988 break;
1989 }
1990 return monitor || rc;
1991 }
1992
1993 /*
1994 * Drivers call this, so increase the reference count before returning
1995 * the node.
1996 */
1997 struct ieee80211_node *
ieee80211_find_rxnode(struct ieee80211com * ic,const struct ieee80211_frame * wh)1998 ieee80211_find_rxnode(struct ieee80211com *ic,
1999 const struct ieee80211_frame *wh)
2000 {
2001 static const u_int8_t zero[] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
2002 struct ieee80211_node *ni;
2003 const u_int8_t *bssid;
2004 int s;
2005
2006 if (!ieee80211_needs_rxnode(ic, wh, &bssid))
2007 return ieee80211_ref_node(ic->ic_bss);
2008
2009 s = splnet();
2010 ni = ieee80211_find_node(ic, wh->i_addr2);
2011 splx(s);
2012
2013 if (ni != NULL)
2014 return ieee80211_ref_node(ni);
2015 #ifndef IEEE80211_STA_ONLY
2016 if (ic->ic_opmode == IEEE80211_M_HOSTAP)
2017 return ieee80211_ref_node(ic->ic_bss);
2018 #endif
2019 /* XXX see remarks in ieee80211_find_txnode */
2020 /* XXX no rate negotiation; just dup */
2021 if ((ni = ieee80211_dup_bss(ic, wh->i_addr2)) == NULL)
2022 return ieee80211_ref_node(ic->ic_bss);
2023
2024 IEEE80211_ADDR_COPY(ni->ni_bssid, (bssid != NULL) ? bssid : zero);
2025
2026 ni->ni_rates = ic->ic_bss->ni_rates;
2027 ni->ni_txrate = 0;
2028 if (ic->ic_newassoc)
2029 (*ic->ic_newassoc)(ic, ni, 1);
2030
2031 DPRINTF(("faked-up node %p for %s\n", ni,
2032 ether_sprintf((u_int8_t *)wh->i_addr2)));
2033
2034 return ieee80211_ref_node(ni);
2035 }
2036
2037 void
ieee80211_node_tx_ba_clear(struct ieee80211_node * ni,int tid)2038 ieee80211_node_tx_ba_clear(struct ieee80211_node *ni, int tid)
2039 {
2040 struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
2041
2042 if (ba->ba_state != IEEE80211_BA_INIT) {
2043 if (timeout_pending(&ba->ba_to))
2044 timeout_del(&ba->ba_to);
2045 ba->ba_state = IEEE80211_BA_INIT;
2046 }
2047 }
2048
2049 void
ieee80211_ba_del(struct ieee80211_node * ni)2050 ieee80211_ba_del(struct ieee80211_node *ni)
2051 {
2052 int tid;
2053
2054 for (tid = 0; tid < nitems(ni->ni_rx_ba); tid++) {
2055 struct ieee80211_rx_ba *ba = &ni->ni_rx_ba[tid];
2056 if (ba->ba_state != IEEE80211_BA_INIT) {
2057 if (timeout_pending(&ba->ba_to))
2058 timeout_del(&ba->ba_to);
2059 if (timeout_pending(&ba->ba_gap_to))
2060 timeout_del(&ba->ba_gap_to);
2061 ba->ba_state = IEEE80211_BA_INIT;
2062 }
2063 }
2064
2065 for (tid = 0; tid < nitems(ni->ni_tx_ba); tid++)
2066 ieee80211_node_tx_ba_clear(ni, tid);
2067
2068 timeout_del(&ni->ni_addba_req_to[EDCA_AC_BE]);
2069 timeout_del(&ni->ni_addba_req_to[EDCA_AC_BK]);
2070 timeout_del(&ni->ni_addba_req_to[EDCA_AC_VI]);
2071 timeout_del(&ni->ni_addba_req_to[EDCA_AC_VO]);
2072 }
2073
2074 void
ieee80211_free_node(struct ieee80211com * ic,struct ieee80211_node * ni)2075 ieee80211_free_node(struct ieee80211com *ic, struct ieee80211_node *ni)
2076 {
2077 if (ni == ic->ic_bss)
2078 panic("freeing bss node");
2079
2080 splassert(IPL_NET);
2081
2082 DPRINTF(("%s\n", ether_sprintf(ni->ni_macaddr)));
2083 #ifndef IEEE80211_STA_ONLY
2084 timeout_del(&ni->ni_eapol_to);
2085 timeout_del(&ni->ni_sa_query_to);
2086 IEEE80211_AID_CLR(ni->ni_associd, ic->ic_aid_bitmap);
2087 #endif
2088 ieee80211_ba_del(ni);
2089 RBT_REMOVE(ieee80211_tree, &ic->ic_tree, ni);
2090 ic->ic_nnodes--;
2091 #ifndef IEEE80211_STA_ONLY
2092 if (mq_purge(&ni->ni_savedq) > 0) {
2093 if (ic->ic_set_tim != NULL)
2094 (*ic->ic_set_tim)(ic, ni->ni_associd, 0);
2095 }
2096 #endif
2097 (*ic->ic_node_free)(ic, ni);
2098 /* TBD indicate to drivers that a new node can be allocated */
2099 }
2100
2101 void
ieee80211_release_node(struct ieee80211com * ic,struct ieee80211_node * ni)2102 ieee80211_release_node(struct ieee80211com *ic, struct ieee80211_node *ni)
2103 {
2104 int s;
2105 void (*ni_unref_cb)(struct ieee80211com *, struct ieee80211_node *);
2106
2107 DPRINTF(("%s refcnt %u\n", ether_sprintf(ni->ni_macaddr),
2108 ni->ni_refcnt));
2109 s = splnet();
2110 if (ieee80211_node_decref(ni) == 0) {
2111 if (ni->ni_unref_cb) {
2112 /* The callback may set ni->ni_unref_cb again. */
2113 ni_unref_cb = ni->ni_unref_cb;
2114 ni->ni_unref_cb = NULL;
2115 /* Freed by callback if necessary: */
2116 (*ni_unref_cb)(ic, ni);
2117 }
2118 if (ni->ni_state == IEEE80211_STA_COLLECT)
2119 ieee80211_free_node(ic, ni);
2120 }
2121 splx(s);
2122 }
2123
2124 void
ieee80211_free_allnodes(struct ieee80211com * ic,int clear_ic_bss)2125 ieee80211_free_allnodes(struct ieee80211com *ic, int clear_ic_bss)
2126 {
2127 struct ieee80211_node *ni;
2128 int s;
2129
2130 DPRINTF(("freeing all nodes\n"));
2131 s = splnet();
2132 while ((ni = RBT_MIN(ieee80211_tree, &ic->ic_tree)) != NULL)
2133 ieee80211_free_node(ic, ni);
2134 splx(s);
2135
2136 if (clear_ic_bss && ic->ic_bss != NULL)
2137 ieee80211_node_cleanup(ic, ic->ic_bss);
2138 }
2139
2140 void
ieee80211_clean_cached(struct ieee80211com * ic)2141 ieee80211_clean_cached(struct ieee80211com *ic)
2142 {
2143 struct ieee80211_node *ni, *next_ni;
2144 int s;
2145
2146 s = splnet();
2147 for (ni = RBT_MIN(ieee80211_tree, &ic->ic_tree);
2148 ni != NULL; ni = next_ni) {
2149 next_ni = RBT_NEXT(ieee80211_tree, ni);
2150 if (ni->ni_state == IEEE80211_STA_CACHE)
2151 ieee80211_free_node(ic, ni);
2152 }
2153 splx(s);
2154 }
2155 /*
2156 * Timeout inactive nodes.
2157 *
2158 * If called because of a cache timeout, which happens only in hostap and ibss
2159 * modes, clean all inactive cached or authenticated nodes but don't de-auth
2160 * any associated nodes. Also update HT protection settings.
2161 *
2162 * Else, this function is called because a new node must be allocated but the
2163 * node cache is full. In this case, return as soon as a free slot was made
2164 * available. If acting as hostap, clean cached nodes regardless of their
2165 * recent activity and also allow de-authing of authenticated nodes older
2166 * than one cache wait interval, and de-authing of inactive associated nodes.
2167 */
2168 void
ieee80211_clean_nodes(struct ieee80211com * ic,int cache_timeout)2169 ieee80211_clean_nodes(struct ieee80211com *ic, int cache_timeout)
2170 {
2171 struct ieee80211_node *ni, *next_ni;
2172 u_int gen = ic->ic_scangen++; /* NB: ok 'cuz single-threaded*/
2173 int s;
2174 #ifndef IEEE80211_STA_ONLY
2175 int nnodes = 0, nonht = 0, nonhtassoc = 0;
2176 struct ifnet *ifp = &ic->ic_if;
2177 enum ieee80211_htprot htprot = IEEE80211_HTPROT_NONE;
2178 enum ieee80211_protmode protmode = IEEE80211_PROT_NONE;
2179 #endif
2180
2181 s = splnet();
2182 for (ni = RBT_MIN(ieee80211_tree, &ic->ic_tree);
2183 ni != NULL; ni = next_ni) {
2184 next_ni = RBT_NEXT(ieee80211_tree, ni);
2185 if (!cache_timeout && ic->ic_nnodes < ic->ic_max_nnodes)
2186 break;
2187 if (ni->ni_scangen == gen) /* previously handled */
2188 continue;
2189 #ifndef IEEE80211_STA_ONLY
2190 nnodes++;
2191 if ((ic->ic_flags & IEEE80211_F_HTON) && cache_timeout) {
2192 /*
2193 * Check if node supports 802.11n.
2194 * Only require HT capabilities IE for this check.
2195 * Nodes might never reveal their supported MCS to us
2196 * unless they go through a full association sequence.
2197 * ieee80211_node_supports_ht() could misclassify them.
2198 */
2199 if ((ni->ni_flags & IEEE80211_NODE_HTCAP) == 0) {
2200 nonht++;
2201 if (ni->ni_state == IEEE80211_STA_ASSOC)
2202 nonhtassoc++;
2203 }
2204 }
2205 #endif
2206 ni->ni_scangen = gen;
2207 if (ni->ni_refcnt > 0)
2208 continue;
2209 #ifndef IEEE80211_STA_ONLY
2210 if ((ic->ic_opmode == IEEE80211_M_HOSTAP ||
2211 ic->ic_opmode == IEEE80211_M_IBSS) &&
2212 ic->ic_state == IEEE80211_S_RUN) {
2213 if (cache_timeout) {
2214 if (ni->ni_state != IEEE80211_STA_COLLECT &&
2215 (ni->ni_state == IEEE80211_STA_ASSOC ||
2216 ni->ni_inact < IEEE80211_INACT_MAX))
2217 continue;
2218 } else {
2219 if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
2220 ((ni->ni_state == IEEE80211_STA_ASSOC &&
2221 ni->ni_inact < IEEE80211_INACT_MAX) ||
2222 (ni->ni_state == IEEE80211_STA_AUTH &&
2223 ni->ni_inact == 0)))
2224 continue;
2225
2226 if (ic->ic_opmode == IEEE80211_M_IBSS &&
2227 ni->ni_state != IEEE80211_STA_COLLECT &&
2228 ni->ni_state != IEEE80211_STA_CACHE &&
2229 ni->ni_inact < IEEE80211_INACT_MAX)
2230 continue;
2231 }
2232 }
2233 if (ifp->if_flags & IFF_DEBUG)
2234 printf("%s: station %s purged from node cache\n",
2235 ifp->if_xname, ether_sprintf(ni->ni_macaddr));
2236 #endif
2237 /*
2238 * If we're hostap and the node is authenticated, send
2239 * a deauthentication frame. The node will be freed when
2240 * the driver calls ieee80211_release_node().
2241 */
2242 #ifndef IEEE80211_STA_ONLY
2243 nnodes--;
2244 if ((ic->ic_flags & IEEE80211_F_HTON) && cache_timeout) {
2245 if ((ni->ni_flags & IEEE80211_NODE_HTCAP) == 0) {
2246 nonht--;
2247 if (ni->ni_state == IEEE80211_STA_ASSOC)
2248 nonhtassoc--;
2249 }
2250 }
2251 if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
2252 ni->ni_state >= IEEE80211_STA_AUTH &&
2253 ni->ni_state != IEEE80211_STA_COLLECT) {
2254 IEEE80211_SEND_MGMT(ic, ni,
2255 IEEE80211_FC0_SUBTYPE_DEAUTH,
2256 IEEE80211_REASON_AUTH_EXPIRE);
2257 ieee80211_node_leave(ic, ni);
2258 } else
2259 #endif
2260 ieee80211_free_node(ic, ni);
2261 ic->ic_stats.is_node_timeout++;
2262 }
2263
2264 #ifndef IEEE80211_STA_ONLY
2265 if ((ic->ic_flags & IEEE80211_F_HTON) && cache_timeout) {
2266 uint16_t htop1 = ic->ic_bss->ni_htop1;
2267
2268 /* Update HT protection settings. */
2269 if (nonht) {
2270 protmode = IEEE80211_PROT_CTSONLY;
2271 if (nonhtassoc)
2272 htprot = IEEE80211_HTPROT_NONHT_MIXED;
2273 else
2274 htprot = IEEE80211_HTPROT_NONMEMBER;
2275 }
2276 if ((htop1 & IEEE80211_HTOP1_PROT_MASK) != htprot) {
2277 htop1 &= ~IEEE80211_HTOP1_PROT_MASK;
2278 htop1 |= htprot;
2279 ic->ic_bss->ni_htop1 = htop1;
2280 ic->ic_protmode = protmode;
2281 if (ic->ic_updateprot)
2282 ic->ic_updateprot(ic);
2283 }
2284 }
2285
2286 /*
2287 * During a cache timeout we iterate over all nodes.
2288 * Check for node leaks by comparing the actual number of cached
2289 * nodes with the ic_nnodes count, which is maintained while adding
2290 * and removing nodes from the cache.
2291 */
2292 if ((ifp->if_flags & IFF_DEBUG) && cache_timeout &&
2293 nnodes != ic->ic_nnodes)
2294 printf("%s: number of cached nodes is %d, expected %d,"
2295 "possible nodes leak\n", ifp->if_xname, nnodes,
2296 ic->ic_nnodes);
2297 #endif
2298 splx(s);
2299 }
2300
2301 void
ieee80211_clean_inactive_nodes(struct ieee80211com * ic,int inact_max)2302 ieee80211_clean_inactive_nodes(struct ieee80211com *ic, int inact_max)
2303 {
2304 struct ieee80211_node *ni, *next_ni;
2305 u_int gen = ic->ic_scangen++; /* NB: ok 'cuz single-threaded*/
2306 int s;
2307
2308 s = splnet();
2309 for (ni = RBT_MIN(ieee80211_tree, &ic->ic_tree);
2310 ni != NULL; ni = next_ni) {
2311 next_ni = RBT_NEXT(ieee80211_tree, ni);
2312 if (ni->ni_scangen == gen) /* previously handled */
2313 continue;
2314 ni->ni_scangen = gen;
2315 if (ni->ni_refcnt > 0 || ni->ni_inact < inact_max)
2316 continue;
2317 ieee80211_free_node(ic, ni);
2318 ic->ic_stats.is_node_timeout++;
2319 }
2320
2321 splx(s);
2322 }
2323
2324 void
ieee80211_iterate_nodes(struct ieee80211com * ic,ieee80211_iter_func * f,void * arg)2325 ieee80211_iterate_nodes(struct ieee80211com *ic, ieee80211_iter_func *f,
2326 void *arg)
2327 {
2328 struct ieee80211_node *ni;
2329 int s;
2330
2331 s = splnet();
2332 RBT_FOREACH(ni, ieee80211_tree, &ic->ic_tree)
2333 (*f)(arg, ni);
2334 splx(s);
2335 }
2336
2337
2338 /*
2339 * Install received HT caps information in the node's state block.
2340 */
2341 void
ieee80211_setup_htcaps(struct ieee80211_node * ni,const uint8_t * data,uint8_t len)2342 ieee80211_setup_htcaps(struct ieee80211_node *ni, const uint8_t *data,
2343 uint8_t len)
2344 {
2345 uint16_t rxrate;
2346
2347 if (len != 26)
2348 return;
2349
2350 ni->ni_htcaps = (data[0] | (data[1] << 8));
2351 ni->ni_ampdu_param = data[2];
2352
2353 memcpy(ni->ni_rxmcs, &data[3], sizeof(ni->ni_rxmcs));
2354 /* clear reserved bits */
2355 clrbit(ni->ni_rxmcs, 77);
2356 clrbit(ni->ni_rxmcs, 78);
2357 clrbit(ni->ni_rxmcs, 79);
2358
2359 /* Max MCS Rx rate in 1Mb/s units (0 means "not specified"). */
2360 rxrate = ((data[13] | (data[14]) << 8) & IEEE80211_MCS_RX_RATE_HIGH);
2361 if (rxrate < 1024)
2362 ni->ni_max_rxrate = rxrate;
2363
2364 ni->ni_tx_mcs_set = data[15];
2365 ni->ni_htxcaps = (data[19] | (data[20] << 8));
2366 ni->ni_txbfcaps = (data[21] | (data[22] << 8) | (data[23] << 16) |
2367 (data[24] << 24));
2368 ni->ni_aselcaps = data[25];
2369
2370 ni->ni_flags |= IEEE80211_NODE_HTCAP;
2371 }
2372
2373 #ifndef IEEE80211_STA_ONLY
2374 /*
2375 * Handle nodes switching from 11n into legacy modes.
2376 */
2377 void
ieee80211_clear_htcaps(struct ieee80211_node * ni)2378 ieee80211_clear_htcaps(struct ieee80211_node *ni)
2379 {
2380 ni->ni_htcaps = 0;
2381 ni->ni_ampdu_param = 0;
2382 memset(ni->ni_rxmcs, 0, sizeof(ni->ni_rxmcs));
2383 ni->ni_max_rxrate = 0;
2384 ni->ni_tx_mcs_set = 0;
2385 ni->ni_htxcaps = 0;
2386 ni->ni_txbfcaps = 0;
2387 ni->ni_aselcaps = 0;
2388
2389 ni->ni_flags &= ~(IEEE80211_NODE_HT | IEEE80211_NODE_HT_SGI20 |
2390 IEEE80211_NODE_HT_SGI40 | IEEE80211_NODE_HTCAP);
2391
2392 }
2393 #endif
2394
2395 int
ieee80211_40mhz_valid_secondary_above(uint8_t primary_chan)2396 ieee80211_40mhz_valid_secondary_above(uint8_t primary_chan)
2397 {
2398 static const uint8_t valid_secondary_chan[] = {
2399 5, 6, 7, 8, 9, 10, 11, 12, 13,
2400 40, 48, 56, 64, 104, 112, 120, 128, 136, 144, 153, 161
2401 };
2402 uint8_t secondary_chan;
2403 int i;
2404
2405 if ((primary_chan >= 1 && primary_chan <= 9) ||
2406 (primary_chan >= 36 && primary_chan <= 157))
2407 secondary_chan = primary_chan + 4;
2408 else
2409 return 0;
2410
2411 for (i = 0; i < nitems(valid_secondary_chan); i++) {
2412 if (secondary_chan == valid_secondary_chan[i])
2413 return 1;
2414 }
2415
2416 return 0;
2417 }
2418
2419 int
ieee80211_40mhz_valid_secondary_below(uint8_t primary_chan)2420 ieee80211_40mhz_valid_secondary_below(uint8_t primary_chan)
2421 {
2422 static const uint8_t valid_secondary_chan[] = {
2423 1, 2, 3, 4, 5, 6, 7, 8, 9,
2424 36, 44, 52, 60, 100, 108, 116, 124, 132, 140, 149, 157
2425 };
2426 int8_t secondary_chan;
2427 int i;
2428
2429 if ((primary_chan >= 5 && primary_chan <= 13) ||
2430 (primary_chan >= 40 && primary_chan <= 161))
2431 secondary_chan = primary_chan - 4;
2432 else
2433 return 0;
2434
2435 for (i = 0; i < nitems(valid_secondary_chan); i++) {
2436 if (secondary_chan == valid_secondary_chan[i])
2437 return 1;
2438 }
2439
2440 return 0;
2441 }
2442
2443 /*
2444 * Only accept 40 MHz channel configurations that conform to
2445 * regulatory operating classes as defined by the 802.11ac spec.
2446 * Passing other configurations down to firmware can result in
2447 * regulatory assertions being trigged, such as fatal firmware
2448 * error 14FD in iwm(4).
2449 *
2450 * See 802.11ac 2013, page 380, Tables E-1 to E-5.
2451 */
2452 int
ieee80211_40mhz_center_freq_valid(uint8_t primary_chan,uint8_t htop0)2453 ieee80211_40mhz_center_freq_valid(uint8_t primary_chan, uint8_t htop0)
2454 {
2455 uint8_t sco;
2456
2457 sco = ((htop0 & IEEE80211_HTOP0_SCO_MASK) >> IEEE80211_HTOP0_SCO_SHIFT);
2458 switch (sco) {
2459 case IEEE80211_HTOP0_SCO_SCN:
2460 return 1;
2461 case IEEE80211_HTOP0_SCO_SCA:
2462 return ieee80211_40mhz_valid_secondary_above(primary_chan);
2463 case IEEE80211_HTOP0_SCO_SCB:
2464 return ieee80211_40mhz_valid_secondary_below(primary_chan);
2465 }
2466
2467 return 0;
2468 }
2469
2470 /*
2471 * Install received HT op information in the node's state block.
2472 */
2473 int
ieee80211_setup_htop(struct ieee80211_node * ni,const uint8_t * data,uint8_t len,int isprobe)2474 ieee80211_setup_htop(struct ieee80211_node *ni, const uint8_t *data,
2475 uint8_t len, int isprobe)
2476 {
2477 if (len != 22)
2478 return 0;
2479
2480 ni->ni_primary_chan = data[0]; /* corresponds to ni_chan */
2481 ni->ni_htop0 = data[1];
2482 if (!ieee80211_40mhz_center_freq_valid(data[0], data[1]))
2483 ni->ni_htop0 &= ~IEEE80211_HTOP0_SCO_MASK;
2484 ni->ni_htop1 = (data[2] | (data[3] << 8));
2485 ni->ni_htop2 = (data[3] | (data[4] << 8));
2486
2487 /*
2488 * According to 802.11-2012 Table 8-130 the Basic MCS set is
2489 * only "present in Beacon, Probe Response, Mesh Peering Open
2490 * and Mesh Peering Confirm frames. Otherwise reserved."
2491 */
2492 if (isprobe)
2493 memcpy(ni->ni_basic_mcs, &data[6], sizeof(ni->ni_basic_mcs));
2494
2495 return 1;
2496 }
2497
2498 /*
2499 * Install received VHT caps information in the node's state block.
2500 */
2501 void
ieee80211_setup_vhtcaps(struct ieee80211_node * ni,const uint8_t * data,uint8_t len)2502 ieee80211_setup_vhtcaps(struct ieee80211_node *ni, const uint8_t *data,
2503 uint8_t len)
2504 {
2505 if (len != 12)
2506 return;
2507
2508 ni->ni_vhtcaps = (data[0] | (data[1] << 8) | data[2] << 16 |
2509 data[3] << 24);
2510 ni->ni_vht_rxmcs = (data[4] | (data[5] << 8));
2511 ni->ni_vht_rx_max_lgi_mbit_s = ((data[6] | (data[7] << 8)) &
2512 IEEE80211_VHT_MAX_LGI_MBIT_S_MASK);
2513 ni->ni_vht_txmcs = (data[8] | (data[9] << 8));
2514 ni->ni_vht_tx_max_lgi_mbit_s = ((data[10] | (data[11] << 8)) &
2515 IEEE80211_VHT_MAX_LGI_MBIT_S_MASK);
2516
2517 ni->ni_flags |= IEEE80211_NODE_VHTCAP;
2518 }
2519
2520 /*
2521 * Only accept 80 MHz channel configurations that conform to
2522 * regulatory operating classes as defined by the 802.11ac spec.
2523 * Passing other configurations down to firmware can result in
2524 * regulatory assertions being trigged, such as fatal firmware
2525 * error 14FD in iwm(4).
2526 *
2527 * See 802.11ac 2013, page 380, Tables E-1 to E-5.
2528 */
2529 int
ieee80211_80mhz_center_freq_valid(const uint8_t chanidx)2530 ieee80211_80mhz_center_freq_valid(const uint8_t chanidx)
2531 {
2532 static const uint8_t valid_center_chanidx[] = {
2533 42, 50, 58, 106, 112, 114, 138, 155
2534 };
2535 int i;
2536
2537 for (i = 0; i < nitems(valid_center_chanidx); i++) {
2538 if (chanidx == valid_center_chanidx[i])
2539 return 1;
2540 }
2541
2542 return 0;
2543 }
2544
2545 /*
2546 * Install received VHT op information in the node's state block.
2547 */
2548 int
ieee80211_setup_vhtop(struct ieee80211_node * ni,const uint8_t * data,uint8_t len,int isprobe)2549 ieee80211_setup_vhtop(struct ieee80211_node *ni, const uint8_t *data,
2550 uint8_t len, int isprobe)
2551 {
2552 uint8_t sco;
2553 int have_40mhz;
2554
2555 if (len != 5)
2556 return 0;
2557
2558 if (data[0] != IEEE80211_VHTOP0_CHAN_WIDTH_HT &&
2559 data[0] != IEEE80211_VHTOP0_CHAN_WIDTH_80 &&
2560 data[0] != IEEE80211_VHTOP0_CHAN_WIDTH_160 &&
2561 data[0] != IEEE80211_VHTOP0_CHAN_WIDTH_8080)
2562 return 0;
2563
2564 sco = ((ni->ni_htop0 & IEEE80211_HTOP0_SCO_MASK) >>
2565 IEEE80211_HTOP0_SCO_SHIFT);
2566 have_40mhz = (sco == IEEE80211_HTOP0_SCO_SCA ||
2567 sco == IEEE80211_HTOP0_SCO_SCB);
2568
2569 if (have_40mhz && ieee80211_80mhz_center_freq_valid(data[1])) {
2570 ni->ni_vht_chan_width = data[0];
2571 ni->ni_vht_chan_center_freq_idx0 = data[1];
2572
2573 /* Only used in non-consecutive 80-80 160MHz configs. */
2574 if (data[2] && ieee80211_80mhz_center_freq_valid(data[2]))
2575 ni->ni_vht_chan_center_freq_idx1 = data[2];
2576 else
2577 ni->ni_vht_chan_center_freq_idx1 = 0;
2578 } else {
2579 ni->ni_vht_chan_width = IEEE80211_VHTOP0_CHAN_WIDTH_HT;
2580 ni->ni_vht_chan_center_freq_idx0 = 0;
2581 ni->ni_vht_chan_center_freq_idx1 = 0;
2582 }
2583
2584 ni->ni_vht_basic_mcs = (data[3] | data[4] << 8);
2585 return 1;
2586 }
2587
2588 #ifndef IEEE80211_STA_ONLY
2589 /*
2590 * Handle nodes switching from 11ac into legacy modes.
2591 */
2592 void
ieee80211_clear_vhtcaps(struct ieee80211_node * ni)2593 ieee80211_clear_vhtcaps(struct ieee80211_node *ni)
2594 {
2595 ni->ni_vhtcaps = 0;
2596 ni->ni_vht_rxmcs = 0;
2597 ni->ni_vht_rx_max_lgi_mbit_s = 0;
2598 ni->ni_vht_txmcs = 0;
2599 ni->ni_vht_tx_max_lgi_mbit_s = 0;
2600
2601 ni->ni_flags &= ~(IEEE80211_NODE_VHT | IEEE80211_NODE_VHT_SGI80 |
2602 IEEE80211_NODE_VHT_SGI160 | IEEE80211_NODE_VHTCAP);
2603
2604 }
2605 #endif
2606
2607 /*
2608 * Install received rate set information in the node's state block.
2609 */
2610 int
ieee80211_setup_rates(struct ieee80211com * ic,struct ieee80211_node * ni,const u_int8_t * rates,const u_int8_t * xrates,int flags)2611 ieee80211_setup_rates(struct ieee80211com *ic, struct ieee80211_node *ni,
2612 const u_int8_t *rates, const u_int8_t *xrates, int flags)
2613 {
2614 struct ieee80211_rateset *rs = &ni->ni_rates;
2615
2616 memset(rs, 0, sizeof(*rs));
2617 rs->rs_nrates = rates[1];
2618 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
2619 if (xrates != NULL) {
2620 u_int8_t nxrates;
2621 /*
2622 * Tack on 11g extended supported rate element.
2623 */
2624 nxrates = xrates[1];
2625 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
2626 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
2627 DPRINTF(("extended rate set too large; "
2628 "only using %u of %u rates\n",
2629 nxrates, xrates[1]));
2630 ic->ic_stats.is_rx_rstoobig++;
2631 }
2632 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
2633 rs->rs_nrates += nxrates;
2634 }
2635 return ieee80211_fix_rate(ic, ni, flags);
2636 }
2637
2638 void
ieee80211_node_trigger_addba_req(struct ieee80211_node * ni,int tid)2639 ieee80211_node_trigger_addba_req(struct ieee80211_node *ni, int tid)
2640 {
2641 if (ni->ni_tx_ba[tid].ba_state == IEEE80211_BA_INIT &&
2642 !timeout_pending(&ni->ni_addba_req_to[tid])) {
2643 timeout_add_sec(&ni->ni_addba_req_to[tid],
2644 ni->ni_addba_req_intval[tid]);
2645 }
2646 }
2647
2648 void
ieee80211_node_addba_request(struct ieee80211_node * ni,int tid)2649 ieee80211_node_addba_request(struct ieee80211_node *ni, int tid)
2650 {
2651 struct ieee80211com *ic = ni->ni_ic;
2652 uint16_t ssn = ni->ni_qos_txseqs[tid];
2653
2654 ieee80211_addba_request(ic, ni, ssn, tid);
2655 }
2656
2657 void
ieee80211_node_addba_request_ac_be_to(void * arg)2658 ieee80211_node_addba_request_ac_be_to(void *arg)
2659 {
2660 struct ieee80211_node *ni = arg;
2661 ieee80211_node_addba_request(ni, EDCA_AC_BE);
2662 }
2663
2664 void
ieee80211_node_addba_request_ac_bk_to(void * arg)2665 ieee80211_node_addba_request_ac_bk_to(void *arg)
2666 {
2667 struct ieee80211_node *ni = arg;
2668 ieee80211_node_addba_request(ni, EDCA_AC_BK);
2669 }
2670
2671 void
ieee80211_node_addba_request_ac_vi_to(void * arg)2672 ieee80211_node_addba_request_ac_vi_to(void *arg)
2673 {
2674 struct ieee80211_node *ni = arg;
2675 ieee80211_node_addba_request(ni, EDCA_AC_VI);
2676 }
2677
2678 void
ieee80211_node_addba_request_ac_vo_to(void * arg)2679 ieee80211_node_addba_request_ac_vo_to(void *arg)
2680 {
2681 struct ieee80211_node *ni = arg;
2682 ieee80211_node_addba_request(ni, EDCA_AC_VO);
2683 }
2684
2685 #ifndef IEEE80211_STA_ONLY
2686 /*
2687 * Check if the specified node supports ERP.
2688 */
2689 int
ieee80211_iserp_sta(const struct ieee80211_node * ni)2690 ieee80211_iserp_sta(const struct ieee80211_node *ni)
2691 {
2692 static const u_int8_t rates[] = { 2, 4, 11, 22, 12, 24, 48 };
2693 const struct ieee80211_rateset *rs = &ni->ni_rates;
2694 int i, j;
2695
2696 /*
2697 * A STA supports ERP operation if it includes all the Clause 19
2698 * mandatory rates in its supported rate set.
2699 */
2700 for (i = 0; i < nitems(rates); i++) {
2701 for (j = 0; j < rs->rs_nrates; j++) {
2702 if ((rs->rs_rates[j] & IEEE80211_RATE_VAL) == rates[i])
2703 break;
2704 }
2705 if (j == rs->rs_nrates)
2706 return 0;
2707 }
2708 return 1;
2709 }
2710
2711 /*
2712 * This function is called to notify the 802.1X PACP machine that a new
2713 * 802.1X port is enabled and must be authenticated. For 802.11, a port
2714 * becomes enabled whenever a STA successfully completes Open System
2715 * authentication with an AP.
2716 */
2717 void
ieee80211_needs_auth(struct ieee80211com * ic,struct ieee80211_node * ni)2718 ieee80211_needs_auth(struct ieee80211com *ic, struct ieee80211_node *ni)
2719 {
2720 /*
2721 * XXX this could be done via the route socket of via a dedicated
2722 * EAP socket or another kernel->userland notification mechanism.
2723 * The notification should include the MAC address (ni_macaddr).
2724 */
2725 }
2726
2727 /*
2728 * Handle an HT STA joining an HT network.
2729 */
2730 void
ieee80211_node_join_ht(struct ieee80211com * ic,struct ieee80211_node * ni)2731 ieee80211_node_join_ht(struct ieee80211com *ic, struct ieee80211_node *ni)
2732 {
2733 enum ieee80211_htprot;
2734
2735 /* Update HT protection setting. */
2736 if ((ni->ni_flags & IEEE80211_NODE_HT) == 0) {
2737 uint16_t htop1 = ic->ic_bss->ni_htop1;
2738 htop1 &= ~IEEE80211_HTOP1_PROT_MASK;
2739 htop1 |= IEEE80211_HTPROT_NONHT_MIXED;
2740 ic->ic_bss->ni_htop1 = htop1;
2741 if (ic->ic_updateprot)
2742 ic->ic_updateprot(ic);
2743 }
2744 }
2745
2746 /*
2747 * Handle a station joining an RSN network.
2748 */
2749 void
ieee80211_node_join_rsn(struct ieee80211com * ic,struct ieee80211_node * ni)2750 ieee80211_node_join_rsn(struct ieee80211com *ic, struct ieee80211_node *ni)
2751 {
2752 DPRINTF(("station %s associated using proto %d akm 0x%x "
2753 "cipher 0x%x groupcipher 0x%x\n", ether_sprintf(ni->ni_macaddr),
2754 ni->ni_rsnprotos, ni->ni_rsnakms, ni->ni_rsnciphers,
2755 ni->ni_rsngroupcipher));
2756
2757 ni->ni_rsn_state = RSNA_AUTHENTICATION;
2758
2759 ni->ni_key_count = 0;
2760 ni->ni_port_valid = 0;
2761 ni->ni_flags &= ~IEEE80211_NODE_TXRXPROT;
2762 ni->ni_flags &= ~IEEE80211_NODE_RSN_NEW_PTK;
2763 ni->ni_replaycnt = -1; /* XXX */
2764 ni->ni_rsn_retries = 0;
2765 ni->ni_rsncipher = ni->ni_rsnciphers;
2766
2767 ni->ni_rsn_state = RSNA_AUTHENTICATION_2;
2768
2769 /* generate a new authenticator nonce (ANonce) */
2770 arc4random_buf(ni->ni_nonce, EAPOL_KEY_NONCE_LEN);
2771
2772 if (!ieee80211_is_8021x_akm(ni->ni_rsnakms)) {
2773 memcpy(ni->ni_pmk, ic->ic_psk, IEEE80211_PMK_LEN);
2774 ni->ni_flags |= IEEE80211_NODE_PMK;
2775 (void)ieee80211_send_4way_msg1(ic, ni);
2776 } else if (ni->ni_flags & IEEE80211_NODE_PMK) {
2777 /* skip 802.1X auth if a cached PMK was found */
2778 (void)ieee80211_send_4way_msg1(ic, ni);
2779 } else {
2780 /* no cached PMK found, needs full 802.1X auth */
2781 ieee80211_needs_auth(ic, ni);
2782 }
2783 }
2784
2785 void
ieee80211_count_longslotsta(void * arg,struct ieee80211_node * ni)2786 ieee80211_count_longslotsta(void *arg, struct ieee80211_node *ni)
2787 {
2788 int *longslotsta = arg;
2789
2790 if (ni->ni_associd == 0 || ni->ni_state == IEEE80211_STA_COLLECT)
2791 return;
2792
2793 if (!(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME))
2794 (*longslotsta)++;
2795 }
2796
2797 void
ieee80211_count_nonerpsta(void * arg,struct ieee80211_node * ni)2798 ieee80211_count_nonerpsta(void *arg, struct ieee80211_node *ni)
2799 {
2800 int *nonerpsta = arg;
2801
2802 if (ni->ni_associd == 0 || ni->ni_state == IEEE80211_STA_COLLECT)
2803 return;
2804
2805 if (!ieee80211_iserp_sta(ni))
2806 (*nonerpsta)++;
2807 }
2808
2809 void
ieee80211_count_pssta(void * arg,struct ieee80211_node * ni)2810 ieee80211_count_pssta(void *arg, struct ieee80211_node *ni)
2811 {
2812 int *pssta = arg;
2813
2814 if (ni->ni_associd == 0 || ni->ni_state == IEEE80211_STA_COLLECT)
2815 return;
2816
2817 if (ni->ni_pwrsave == IEEE80211_PS_DOZE)
2818 (*pssta)++;
2819 }
2820
2821 void
ieee80211_count_rekeysta(void * arg,struct ieee80211_node * ni)2822 ieee80211_count_rekeysta(void *arg, struct ieee80211_node *ni)
2823 {
2824 int *rekeysta = arg;
2825
2826 if (ni->ni_associd == 0 || ni->ni_state == IEEE80211_STA_COLLECT)
2827 return;
2828
2829 if (ni->ni_flags & IEEE80211_NODE_REKEY)
2830 (*rekeysta)++;
2831 }
2832
2833 /*
2834 * Handle a station joining an 11g network.
2835 */
2836 void
ieee80211_node_join_11g(struct ieee80211com * ic,struct ieee80211_node * ni)2837 ieee80211_node_join_11g(struct ieee80211com *ic, struct ieee80211_node *ni)
2838 {
2839 int longslotsta = 0, nonerpsta = 0;
2840
2841 if (!(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
2842 /*
2843 * Joining STA doesn't support short slot time. We must
2844 * disable the use of short slot time for all other associated
2845 * STAs and give the driver a chance to reconfigure the
2846 * hardware.
2847 */
2848 ieee80211_iterate_nodes(ic,
2849 ieee80211_count_longslotsta, &longslotsta);
2850 if (longslotsta == 1) {
2851 if (ic->ic_caps & IEEE80211_C_SHSLOT)
2852 ieee80211_set_shortslottime(ic, 0);
2853 }
2854 DPRINTF(("[%s] station needs long slot time, count %d\n",
2855 ether_sprintf(ni->ni_macaddr), longslotsta));
2856 }
2857
2858 if (!ieee80211_iserp_sta(ni)) {
2859 /*
2860 * Joining STA is non-ERP.
2861 */
2862 ieee80211_iterate_nodes(ic,
2863 ieee80211_count_nonerpsta, &nonerpsta);
2864 DPRINTF(("[%s] station is non-ERP, %d non-ERP "
2865 "stations associated\n", ether_sprintf(ni->ni_macaddr),
2866 nonerpsta));
2867 /* must enable the use of protection */
2868 if (ic->ic_protmode != IEEE80211_PROT_NONE) {
2869 DPRINTF(("enable use of protection\n"));
2870 ic->ic_flags |= IEEE80211_F_USEPROT;
2871 }
2872
2873 if (!(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE))
2874 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
2875 } else
2876 ni->ni_flags |= IEEE80211_NODE_ERP;
2877 }
2878
2879 void
ieee80211_node_join(struct ieee80211com * ic,struct ieee80211_node * ni,int resp)2880 ieee80211_node_join(struct ieee80211com *ic, struct ieee80211_node *ni,
2881 int resp)
2882 {
2883 int newassoc = (ni->ni_state != IEEE80211_STA_ASSOC);
2884
2885 if (ni->ni_associd == 0) {
2886 u_int16_t aid;
2887
2888 /*
2889 * It would be clever to search the bitmap
2890 * more efficiently, but this will do for now.
2891 */
2892 for (aid = 1; aid < ic->ic_max_aid; aid++) {
2893 if (!IEEE80211_AID_ISSET(aid,
2894 ic->ic_aid_bitmap))
2895 break;
2896 }
2897 if (aid >= ic->ic_max_aid) {
2898 IEEE80211_SEND_MGMT(ic, ni, resp,
2899 IEEE80211_REASON_ASSOC_TOOMANY);
2900 ieee80211_node_leave(ic, ni);
2901 return;
2902 }
2903 ni->ni_associd = aid | 0xc000;
2904 IEEE80211_AID_SET(ni->ni_associd, ic->ic_aid_bitmap);
2905 if (ic->ic_curmode == IEEE80211_MODE_11G ||
2906 (ic->ic_curmode == IEEE80211_MODE_11N &&
2907 IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)))
2908 ieee80211_node_join_11g(ic, ni);
2909 }
2910
2911 DPRINTF(("station %s %s associated at aid %d\n",
2912 ether_sprintf(ni->ni_macaddr), newassoc ? "newly" : "already",
2913 ni->ni_associd & ~0xc000));
2914
2915 ieee80211_ht_negotiate(ic, ni);
2916 if (ic->ic_flags & IEEE80211_F_HTON)
2917 ieee80211_node_join_ht(ic, ni);
2918
2919 /* give driver a chance to setup state like ni_txrate */
2920 if (ic->ic_newassoc)
2921 (*ic->ic_newassoc)(ic, ni, newassoc);
2922 IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_SUCCESS);
2923 ieee80211_node_newstate(ni, IEEE80211_STA_ASSOC);
2924
2925 if (!(ic->ic_flags & IEEE80211_F_RSNON)) {
2926 ni->ni_port_valid = 1;
2927 ni->ni_rsncipher = IEEE80211_CIPHER_USEGROUP;
2928 } else
2929 ieee80211_node_join_rsn(ic, ni);
2930
2931 #if NBRIDGE > 0
2932 /*
2933 * If the parent interface is a bridge port, learn
2934 * the node's address dynamically on this interface.
2935 */
2936 if (ic->ic_if.if_bridgeidx != 0)
2937 bridge_update(&ic->ic_if,
2938 (struct ether_addr *)ni->ni_macaddr, 0);
2939 #endif
2940 }
2941
2942 /*
2943 * Handle an HT STA leaving an HT network.
2944 */
2945 void
ieee80211_node_leave_ht(struct ieee80211com * ic,struct ieee80211_node * ni)2946 ieee80211_node_leave_ht(struct ieee80211com *ic, struct ieee80211_node *ni)
2947 {
2948 struct ieee80211_rx_ba *ba;
2949 u_int8_t tid;
2950 int i;
2951
2952 /* free all Block Ack records */
2953 ieee80211_ba_del(ni);
2954 for (tid = 0; tid < IEEE80211_NUM_TID; tid++) {
2955 ba = &ni->ni_rx_ba[tid];
2956 if (ba->ba_buf != NULL) {
2957 for (i = 0; i < IEEE80211_BA_MAX_WINSZ; i++)
2958 m_freem(ba->ba_buf[i].m);
2959 free(ba->ba_buf, M_DEVBUF,
2960 IEEE80211_BA_MAX_WINSZ * sizeof(*ba->ba_buf));
2961 ba->ba_buf = NULL;
2962 }
2963 }
2964
2965 ieee80211_clear_htcaps(ni);
2966 }
2967
2968 /*
2969 * Handle a VHT STA leaving a VHT network.
2970 */
2971 void
ieee80211_node_leave_vht(struct ieee80211com * ic,struct ieee80211_node * ni)2972 ieee80211_node_leave_vht(struct ieee80211com *ic, struct ieee80211_node *ni)
2973 {
2974 ieee80211_clear_vhtcaps(ni);
2975 }
2976
2977 /*
2978 * Handle a station leaving an RSN network.
2979 */
2980 void
ieee80211_node_leave_rsn(struct ieee80211com * ic,struct ieee80211_node * ni)2981 ieee80211_node_leave_rsn(struct ieee80211com *ic, struct ieee80211_node *ni)
2982 {
2983 int rekeysta = 0;
2984
2985 ni->ni_rsn_state = RSNA_INITIALIZE;
2986 if (ni->ni_flags & IEEE80211_NODE_REKEY) {
2987 ni->ni_flags &= ~IEEE80211_NODE_REKEY;
2988 ieee80211_iterate_nodes(ic,
2989 ieee80211_count_rekeysta, &rekeysta);
2990 if (rekeysta == 0)
2991 ieee80211_setkeysdone(ic);
2992 }
2993 ni->ni_flags &= ~IEEE80211_NODE_PMK;
2994 ni->ni_rsn_gstate = RSNA_IDLE;
2995
2996 timeout_del(&ni->ni_eapol_to);
2997 timeout_del(&ni->ni_sa_query_to);
2998
2999 ni->ni_rsn_retries = 0;
3000 ni->ni_flags &= ~IEEE80211_NODE_TXRXPROT;
3001 ni->ni_port_valid = 0;
3002 (*ic->ic_delete_key)(ic, ni, &ni->ni_pairwise_key);
3003 }
3004
3005 /*
3006 * Handle a station leaving an 11g network.
3007 */
3008 void
ieee80211_node_leave_11g(struct ieee80211com * ic,struct ieee80211_node * ni)3009 ieee80211_node_leave_11g(struct ieee80211com *ic, struct ieee80211_node *ni)
3010 {
3011 int longslotsta = 0, nonerpsta = 0;
3012
3013 if (!(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
3014 /* leaving STA did not support short slot time */
3015 ieee80211_iterate_nodes(ic,
3016 ieee80211_count_longslotsta, &longslotsta);
3017 if (longslotsta == 1) {
3018 /*
3019 * All associated STAs now support short slot time, so
3020 * enable this feature and give the driver a chance to
3021 * reconfigure the hardware. Notice that IBSS always
3022 * use a long slot time.
3023 */
3024 if ((ic->ic_caps & IEEE80211_C_SHSLOT) &&
3025 ic->ic_opmode != IEEE80211_M_IBSS)
3026 ieee80211_set_shortslottime(ic, 1);
3027 }
3028 DPRINTF(("[%s] long slot time station leaves, count %d\n",
3029 ether_sprintf(ni->ni_macaddr), longslotsta));
3030 }
3031
3032 if (!(ni->ni_flags & IEEE80211_NODE_ERP)) {
3033 /* leaving STA was non-ERP */
3034 ieee80211_iterate_nodes(ic,
3035 ieee80211_count_nonerpsta, &nonerpsta);
3036 if (nonerpsta == 1) {
3037 /*
3038 * All associated STAs are now ERP capable, disable use
3039 * of protection and re-enable short preamble support.
3040 */
3041 ic->ic_flags &= ~IEEE80211_F_USEPROT;
3042 if (ic->ic_caps & IEEE80211_C_SHPREAMBLE)
3043 ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
3044 }
3045 DPRINTF(("[%s] non-ERP station leaves, count %d\n",
3046 ether_sprintf(ni->ni_macaddr), nonerpsta));
3047 }
3048 }
3049
3050 void
ieee80211_node_leave_pwrsave(struct ieee80211com * ic,struct ieee80211_node * ni)3051 ieee80211_node_leave_pwrsave(struct ieee80211com *ic,
3052 struct ieee80211_node *ni)
3053 {
3054 struct mbuf_queue keep = MBUF_QUEUE_INITIALIZER(IFQ_MAXLEN, IPL_NET);
3055 struct mbuf *m;
3056
3057 if (ni->ni_pwrsave == IEEE80211_PS_DOZE)
3058 ni->ni_pwrsave = IEEE80211_PS_AWAKE;
3059
3060 if (mq_len(&ni->ni_savedq) > 0) {
3061 if (ic->ic_set_tim != NULL)
3062 (*ic->ic_set_tim)(ic, ni->ni_associd, 0);
3063 }
3064 while ((m = mq_dequeue(&ni->ni_savedq)) != NULL) {
3065 if (ni->ni_refcnt > 0)
3066 ieee80211_node_decref(ni);
3067 m_freem(m);
3068 }
3069
3070 /* Purge frames queued for transmission during DTIM. */
3071 while ((m = mq_dequeue(&ic->ic_pwrsaveq)) != NULL) {
3072 if (m->m_pkthdr.ph_cookie == ni) {
3073 if (ni->ni_refcnt > 0)
3074 ieee80211_node_decref(ni);
3075 m_freem(m);
3076 } else
3077 mq_enqueue(&keep, m);
3078 }
3079 while ((m = mq_dequeue(&keep)) != NULL)
3080 mq_enqueue(&ic->ic_pwrsaveq, m);
3081 }
3082
3083 /*
3084 * Handle bookkeeping for station deauthentication/disassociation
3085 * when operating as an ap.
3086 */
3087 void
ieee80211_node_leave(struct ieee80211com * ic,struct ieee80211_node * ni)3088 ieee80211_node_leave(struct ieee80211com *ic, struct ieee80211_node *ni)
3089 {
3090 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
3091 panic("not in ap mode, mode %u", ic->ic_opmode);
3092
3093 if (ni->ni_state == IEEE80211_STA_COLLECT)
3094 return;
3095 /*
3096 * If node wasn't previously associated all we need to do is
3097 * reclaim the reference.
3098 */
3099 if (ni->ni_associd == 0) {
3100 ieee80211_node_newstate(ni, IEEE80211_STA_COLLECT);
3101 return;
3102 }
3103
3104 ieee80211_node_leave_pwrsave(ic, ni);
3105
3106 if (ic->ic_flags & IEEE80211_F_RSNON)
3107 ieee80211_node_leave_rsn(ic, ni);
3108
3109 if (ic->ic_curmode == IEEE80211_MODE_11G ||
3110 (ic->ic_curmode == IEEE80211_MODE_11N &&
3111 IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)))
3112 ieee80211_node_leave_11g(ic, ni);
3113
3114 if (ni->ni_flags & IEEE80211_NODE_HT)
3115 ieee80211_node_leave_ht(ic, ni);
3116 if (ni->ni_flags & IEEE80211_NODE_VHT)
3117 ieee80211_node_leave_vht(ic, ni);
3118
3119 if (ic->ic_node_leave != NULL)
3120 (*ic->ic_node_leave)(ic, ni);
3121
3122 ieee80211_node_newstate(ni, IEEE80211_STA_COLLECT);
3123
3124 #if NBRIDGE > 0
3125 /*
3126 * If the parent interface is a bridge port, delete
3127 * any dynamically learned address for this node.
3128 */
3129 if (ic->ic_if.if_bridgeidx != 0)
3130 bridge_update(&ic->ic_if,
3131 (struct ether_addr *)ni->ni_macaddr, 1);
3132 #endif
3133 }
3134
3135 static int
ieee80211_do_slow_print(struct ieee80211com * ic,int * did_print)3136 ieee80211_do_slow_print(struct ieee80211com *ic, int *did_print)
3137 {
3138 static const struct timeval merge_print_intvl = {
3139 .tv_sec = 1, .tv_usec = 0
3140 };
3141 if ((ic->ic_if.if_flags & IFF_LINK0) == 0)
3142 return 0;
3143 if (!*did_print && (ic->ic_if.if_flags & IFF_DEBUG) == 0 &&
3144 !ratecheck(&ic->ic_last_merge_print, &merge_print_intvl))
3145 return 0;
3146
3147 *did_print = 1;
3148 return 1;
3149 }
3150
3151 /* ieee80211_ibss_merge helps merge 802.11 ad hoc networks. The
3152 * convention, set by the Wireless Ethernet Compatibility Alliance
3153 * (WECA), is that an 802.11 station will change its BSSID to match
3154 * the "oldest" 802.11 ad hoc network, on the same channel, that
3155 * has the station's desired SSID. The "oldest" 802.11 network
3156 * sends beacons with the greatest TSF timestamp.
3157 *
3158 * Return ENETRESET if the BSSID changed, 0 otherwise.
3159 *
3160 * XXX Perhaps we should compensate for the time that elapses
3161 * between the MAC receiving the beacon and the host processing it
3162 * in ieee80211_ibss_merge.
3163 */
3164 int
ieee80211_ibss_merge(struct ieee80211com * ic,struct ieee80211_node * ni,u_int64_t local_tsft)3165 ieee80211_ibss_merge(struct ieee80211com *ic, struct ieee80211_node *ni,
3166 u_int64_t local_tsft)
3167 {
3168 u_int64_t beacon_tsft;
3169 int did_print = 0, sign;
3170 union {
3171 u_int64_t word;
3172 u_int8_t tstamp[8];
3173 } u;
3174
3175 /* ensure alignment */
3176 (void)memcpy(&u, &ni->ni_tstamp[0], sizeof(u));
3177 beacon_tsft = letoh64(u.word);
3178
3179 /* we are faster, let the other guy catch up */
3180 if (beacon_tsft < local_tsft)
3181 sign = -1;
3182 else
3183 sign = 1;
3184
3185 if (IEEE80211_ADDR_EQ(ni->ni_bssid, ic->ic_bss->ni_bssid)) {
3186 if (!ieee80211_do_slow_print(ic, &did_print))
3187 return 0;
3188 printf("%s: tsft offset %s%llu\n", ic->ic_if.if_xname,
3189 (sign < 0) ? "-" : "",
3190 (sign < 0)
3191 ? (local_tsft - beacon_tsft)
3192 : (beacon_tsft - local_tsft));
3193 return 0;
3194 }
3195
3196 if (sign < 0)
3197 return 0;
3198
3199 if (ieee80211_match_bss(ic, ni, 0) != 0)
3200 return 0;
3201
3202 if (ieee80211_do_slow_print(ic, &did_print)) {
3203 printf("%s: ieee80211_ibss_merge: bssid mismatch %s\n",
3204 ic->ic_if.if_xname, ether_sprintf(ni->ni_bssid));
3205 printf("%s: my tsft %llu beacon tsft %llu\n",
3206 ic->ic_if.if_xname, local_tsft, beacon_tsft);
3207 printf("%s: sync TSF with %s\n",
3208 ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr));
3209 }
3210
3211 ic->ic_flags &= ~IEEE80211_F_SIBSS;
3212
3213 /* negotiate rates with new IBSS */
3214 ieee80211_fix_rate(ic, ni, IEEE80211_F_DOFRATE |
3215 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
3216 if (ni->ni_rates.rs_nrates == 0) {
3217 if (ieee80211_do_slow_print(ic, &did_print)) {
3218 printf("%s: rates mismatch, BSSID %s\n",
3219 ic->ic_if.if_xname, ether_sprintf(ni->ni_bssid));
3220 }
3221 return 0;
3222 }
3223
3224 if (ieee80211_do_slow_print(ic, &did_print)) {
3225 printf("%s: sync BSSID %s -> ",
3226 ic->ic_if.if_xname, ether_sprintf(ic->ic_bss->ni_bssid));
3227 printf("%s ", ether_sprintf(ni->ni_bssid));
3228 printf("(from %s)\n", ether_sprintf(ni->ni_macaddr));
3229 }
3230
3231 ieee80211_node_newstate(ni, IEEE80211_STA_BSS);
3232 (*ic->ic_node_copy)(ic, ic->ic_bss, ni);
3233
3234 return ENETRESET;
3235 }
3236
3237 void
ieee80211_set_tim(struct ieee80211com * ic,int aid,int set)3238 ieee80211_set_tim(struct ieee80211com *ic, int aid, int set)
3239 {
3240 if (set)
3241 setbit(ic->ic_tim_bitmap, aid & ~0xc000);
3242 else
3243 clrbit(ic->ic_tim_bitmap, aid & ~0xc000);
3244 }
3245
3246 /*
3247 * This function shall be called by drivers immediately after every DTIM.
3248 * Transmit all group addressed MSDUs buffered at the AP.
3249 */
3250 void
ieee80211_notify_dtim(struct ieee80211com * ic)3251 ieee80211_notify_dtim(struct ieee80211com *ic)
3252 {
3253 /* NB: group addressed MSDUs are buffered in ic_bss */
3254 struct ieee80211_node *ni = ic->ic_bss;
3255 struct ifnet *ifp = &ic->ic_if;
3256 struct ieee80211_frame *wh;
3257 struct mbuf *m;
3258
3259 KASSERT(ic->ic_opmode == IEEE80211_M_HOSTAP);
3260
3261 while ((m = mq_dequeue(&ni->ni_savedq)) != NULL) {
3262 if (!mq_empty(&ni->ni_savedq)) {
3263 /* more queued frames, set the more data bit */
3264 wh = mtod(m, struct ieee80211_frame *);
3265 wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
3266 }
3267 mq_enqueue(&ic->ic_pwrsaveq, m);
3268 if_start(ifp);
3269 }
3270 /* XXX assumes everything has been sent */
3271 ic->ic_tim_mcast_pending = 0;
3272 }
3273 #endif /* IEEE80211_STA_ONLY */
3274
3275 /*
3276 * Compare nodes in the tree by lladdr
3277 */
3278 int
ieee80211_node_cmp(const struct ieee80211_node * b1,const struct ieee80211_node * b2)3279 ieee80211_node_cmp(const struct ieee80211_node *b1,
3280 const struct ieee80211_node *b2)
3281 {
3282 return (memcmp(b1->ni_macaddr, b2->ni_macaddr, IEEE80211_ADDR_LEN));
3283 }
3284
3285 /*
3286 * Compare nodes in the tree by essid
3287 */
3288 int
ieee80211_ess_cmp(const struct ieee80211_ess_rbt * b1,const struct ieee80211_ess_rbt * b2)3289 ieee80211_ess_cmp(const struct ieee80211_ess_rbt *b1,
3290 const struct ieee80211_ess_rbt *b2)
3291 {
3292 return (memcmp(b1->essid, b2->essid, IEEE80211_NWID_LEN));
3293 }
3294
3295 /*
3296 * Generate red-black tree function logic
3297 */
3298 RBT_GENERATE(ieee80211_tree, ieee80211_node, ni_node, ieee80211_node_cmp);
3299 RBT_GENERATE(ieee80211_ess_tree, ieee80211_ess_rbt, ess_rbt, ieee80211_ess_cmp);
3300