1 /*
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  *
32  * $FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.62.2.14 2006/09/02 15:16:12 sam Exp $
33  * $DragonFly: src/sys/netproto/802_11/wlan/ieee80211_input.c,v 1.22 2008/03/04 13:48:40 sephe Exp $
34  */
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/mbuf.h>
39 #include <sys/malloc.h>
40 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 #include <sys/serialize.h>
43 
44 #include <sys/socket.h>
45 
46 #include <net/if.h>
47 #include <net/if_arp.h>
48 #include <net/ifq_var.h>
49 #include <net/if_media.h>
50 #include <net/ethernet.h>
51 #include <net/if_llc.h>
52 #include <net/vlan/if_vlan_var.h>
53 
54 #include <netproto/802_11/ieee80211_var.h>
55 
56 #include <net/bpf.h>
57 
58 #ifdef IEEE80211_DEBUG
59 #include <machine/stdarg.h>
60 
61 /*
62  * Decide if a received management frame should be
63  * printed when debugging is enabled.  This filters some
64  * of the less interesting frames that come frequently
65  * (e.g. beacons).
66  */
67 static __inline int
68 doprint(struct ieee80211com *ic, int subtype)
69 {
70 	switch (subtype) {
71 	case IEEE80211_FC0_SUBTYPE_BEACON:
72 		return (ic->ic_flags & IEEE80211_F_SCAN);
73 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
74 		return (ic->ic_opmode == IEEE80211_M_IBSS);
75 	}
76 	return 1;
77 }
78 
79 /*
80  * Emit a debug message about discarding a frame or information
81  * element.  One format is for extracting the mac address from
82  * the frame header; the other is for when a header is not
83  * available or otherwise appropriate.
84  */
85 #define	IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do {		\
86 	if ((_ic)->ic_debug & (_m))					\
87 		ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\
88 } while (0)
89 #define	IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do {	\
90 	if ((_ic)->ic_debug & (_m))					\
91 		ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\
92 } while (0)
93 #define	IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do {	\
94 	if ((_ic)->ic_debug & (_m))					\
95 		ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\
96 } while (0)
97 
98 static const uint8_t *ieee80211_getbssid(struct ieee80211com *,
99 	const struct ieee80211_frame *);
100 static void ieee80211_discard_frame(struct ieee80211com *,
101 	const struct ieee80211_frame *, const char *type, const char *fmt, ...);
102 static void ieee80211_discard_ie(struct ieee80211com *,
103 	const struct ieee80211_frame *, const char *type, const char *fmt, ...);
104 static void ieee80211_discard_mac(struct ieee80211com *,
105 	const uint8_t mac[IEEE80211_ADDR_LEN], const char *type,
106 	const char *fmt, ...);
107 #else
108 #define	IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...)
109 #define	IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...)
110 #define	IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...)
111 #endif /* IEEE80211_DEBUG */
112 
113 static struct mbuf *ieee80211_defrag(struct ieee80211com *,
114 	struct ieee80211_node *, struct mbuf *, int);
115 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int);
116 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *,
117 		const uint8_t *mac, int subtype, int arg);
118 static void ieee80211_deliver_data(struct ieee80211com *,
119 	struct ieee80211_node *, struct mbuf *);
120 static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable);
121 static void ieee80211_recv_pspoll(struct ieee80211com *,
122 	struct ieee80211_node *, struct mbuf *);
123 
124 /*
125  * Process a received frame.  The node associated with the sender
126  * should be supplied.  If nothing was found in the node table then
127  * the caller is assumed to supply a reference to ic_bss instead.
128  * The RSSI and a timestamp are also supplied.  The RSSI data is used
129  * during AP scanning to select a AP to associate with; it can have
130  * any units so long as values have consistent units and higher values
131  * mean ``better signal''.  The receive timestamp is currently not used
132  * by the 802.11 layer.
133  */
134 int
135 ieee80211_input(struct ieee80211com *ic, struct mbuf *m,
136 	struct ieee80211_node *ni, int rssi, uint32_t rstamp)
137 {
138 	return ieee80211_input_withiv(ic, m, ni, rssi, rstamp, NULL);
139 }
140 
141 int
142 ieee80211_input_withiv(struct ieee80211com *ic, struct mbuf *m,
143 	struct ieee80211_node *ni, int rssi, uint32_t rstamp,
144 	const struct ieee80211_crypto_iv *iv)
145 {
146 #define	SEQ_LEQ(a,b)	((int)((a)-(b)) <= 0)
147 #define	HAS_SEQ(type)	((type & 0x4) == 0)
148 	struct ifnet *ifp = ic->ic_ifp;
149 	struct ieee80211_frame *wh;
150 	struct ieee80211_key *key;
151 	struct ether_header *eh;
152 	int hdrspace, need_tap;
153 	uint8_t dir, type, subtype;
154 	uint8_t *bssid;
155 	uint16_t rxseq;
156 
157 	ASSERT_SERIALIZED(ifp->if_serializer);
158 
159 	KASSERT(ni != NULL, ("null node"));
160 	ni->ni_inact = ni->ni_inact_reload;
161 
162 	need_tap = 1;			/* mbuf need to be tapped */
163 	type = -1;			/* undefined */
164 	/*
165 	 * In monitor mode, send everything directly to bpf.
166 	 * XXX may want to include the CRC
167 	 */
168 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
169 		goto out;
170 
171 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
172 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
173 		    ni->ni_macaddr, NULL,
174 		    "too short (1): len %u", m->m_pkthdr.len);
175 		ic->ic_stats.is_rx_tooshort++;
176 		goto out;
177 	}
178 	/*
179 	 * Bit of a cheat here, we use a pointer for a 3-address
180 	 * frame format but don't reference fields past outside
181 	 * ieee80211_frame_min w/o first validating the data is
182 	 * present.
183 	 */
184 	wh = mtod(m, struct ieee80211_frame *);
185 
186 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
187 	    IEEE80211_FC0_VERSION_0) {
188 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
189 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
190 		ic->ic_stats.is_rx_badversion++;
191 		goto err;
192 	}
193 
194 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
195 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
196 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
197 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
198 		switch (ic->ic_opmode) {
199 		case IEEE80211_M_STA:
200 			bssid = wh->i_addr2;
201 			if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
202 				/* not interested in */
203 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
204 				    bssid, NULL, "%s", "not to bss");
205 				ic->ic_stats.is_rx_wrongbss++;
206 				goto out;
207 			}
208 			break;
209 		case IEEE80211_M_IBSS:
210 		case IEEE80211_M_AHDEMO:
211 		case IEEE80211_M_HOSTAP:
212 			if (dir != IEEE80211_FC1_DIR_NODS)
213 				bssid = wh->i_addr1;
214 			else if (type == IEEE80211_FC0_TYPE_CTL)
215 				bssid = wh->i_addr1;
216 			else {
217 				if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
218 					IEEE80211_DISCARD_MAC(ic,
219 					    IEEE80211_MSG_ANY, ni->ni_macaddr,
220 					    NULL, "too short (2): len %u",
221 					    m->m_pkthdr.len);
222 					ic->ic_stats.is_rx_tooshort++;
223 					goto out;
224 				}
225 				bssid = wh->i_addr3;
226 			}
227 			if (type != IEEE80211_FC0_TYPE_DATA)
228 				break;
229 			/*
230 			 * Data frame, validate the bssid.
231 			 */
232 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) &&
233 			    !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
234 				/* not interested in */
235 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
236 				    bssid, NULL, "%s", "not to bss");
237 				ic->ic_stats.is_rx_wrongbss++;
238 				goto out;
239 			}
240 			/*
241 			 * For adhoc mode we cons up a node when it doesn't
242 			 * exist. This should probably done after an ACL check.
243 			 */
244 			if (ni == ic->ic_bss &&
245 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
246 			    !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
247 				/*
248 				 * Fake up a node for this newly
249 				 * discovered member of the IBSS.
250 				 */
251 				ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
252 						    wh->i_addr2);
253 				if (ni == NULL) {
254 					/* NB: stat kept for alloc failure */
255 					goto err;
256 				}
257 			}
258 			break;
259 		default:
260 			goto out;
261 		}
262 		ni->ni_rssi = rssi;
263 		ni->ni_rstamp = rstamp;
264 		if (HAS_SEQ(type) && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
265 			uint8_t tid;
266 			if (IEEE80211_QOS_HAS_SEQ(wh)) {
267 				tid = ((struct ieee80211_qosframe *)wh)->
268 					i_qos[0] & IEEE80211_QOS_TID;
269 				if (TID_TO_WME_AC(tid) >= WME_AC_VI)
270 					ic->ic_wme.wme_hipri_traffic++;
271 				tid++;
272 			} else
273 				tid = 0;
274 			rxseq = le16toh(*(uint16_t *)wh->i_seq);
275 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
276 			    SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
277 				/* duplicate, discard */
278 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
279 				    bssid, "duplicate",
280 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
281 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
282 				    ni->ni_rxseqs[tid] >>
283 					IEEE80211_SEQ_SEQ_SHIFT,
284 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
285 				    ni->ni_rxseqs[tid] &
286 					IEEE80211_SEQ_FRAG_MASK,
287 				    tid);
288 				ic->ic_stats.is_rx_dup++;
289 				IEEE80211_NODE_STAT(ni, rx_dup);
290 				goto out;
291 			}
292 			ni->ni_rxseqs[tid] = rxseq;
293 		}
294 	}
295 
296 	switch (type) {
297 	case IEEE80211_FC0_TYPE_DATA:
298 		hdrspace = ieee80211_hdrspace(ic, wh);
299 		if (m->m_len < hdrspace &&
300 		    (m = m_pullup(m, hdrspace)) == NULL) {
301 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
302 			    ni->ni_macaddr, NULL,
303 			    "data too short: expecting %u", hdrspace);
304 			ic->ic_stats.is_rx_tooshort++;
305 			goto out;		/* XXX */
306 		}
307 		switch (ic->ic_opmode) {
308 		case IEEE80211_M_STA:
309 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
310 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
311 				    wh, "data", "%s", "unknown dir 0x%x", dir);
312 				ic->ic_stats.is_rx_wrongdir++;
313 				goto out;
314 			}
315 			if ((ifp->if_flags & IFF_SIMPLEX) &&
316 			    IEEE80211_IS_MULTICAST(wh->i_addr1) &&
317 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) {
318 				/*
319 				 * In IEEE802.11 network, multicast packet
320 				 * sent from me is broadcasted from AP.
321 				 * It should be silently discarded for
322 				 * SIMPLEX interface.
323 				 */
324 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
325 				    wh, NULL, "%s", "multicast echo");
326 				ic->ic_stats.is_rx_mcastecho++;
327 				goto out;
328 			}
329 			break;
330 		case IEEE80211_M_IBSS:
331 		case IEEE80211_M_AHDEMO:
332 			if (dir != IEEE80211_FC1_DIR_NODS) {
333 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
334 				    wh, "data", "%s", "unknown dir 0x%x", dir);
335 				ic->ic_stats.is_rx_wrongdir++;
336 				goto out;
337 			}
338 			/* XXX no power-save support */
339 			break;
340 		case IEEE80211_M_HOSTAP:
341 			if (dir != IEEE80211_FC1_DIR_TODS) {
342 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
343 				    wh, "data", "%s", "unknown dir 0x%x", dir);
344 				ic->ic_stats.is_rx_wrongdir++;
345 				goto out;
346 			}
347 			/* check if source STA is associated */
348 			if (ni == ic->ic_bss) {
349 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
350 				    wh, "data", "%s", "unknown src");
351 				ieee80211_send_error(ic, ni, wh->i_addr2,
352 				    IEEE80211_FC0_SUBTYPE_DEAUTH,
353 				    IEEE80211_REASON_NOT_AUTHED);
354 				ic->ic_stats.is_rx_notassoc++;
355 				goto err;
356 			}
357 			if (ni->ni_associd == 0) {
358 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
359 				    wh, "data", "%s", "unassoc src");
360 				IEEE80211_SEND_MGMT(ic, ni,
361 				    IEEE80211_FC0_SUBTYPE_DISASSOC,
362 				    IEEE80211_REASON_NOT_ASSOCED);
363 				ic->ic_stats.is_rx_notassoc++;
364 				goto err;
365 			}
366 
367 			/*
368 			 * Check for power save state change.
369 			 */
370 			if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
371 			    (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
372 				ieee80211_node_pwrsave(ni,
373 					wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
374 			break;
375 		default:
376 			/* XXX here to keep compiler happy */
377 			goto out;
378 		}
379 
380 		/*
381 		 * Handle privacy requirements.  Note that we
382 		 * must not be preempted from here until after
383 		 * we (potentially) call ieee80211_crypto_demic;
384 		 * otherwise we may violate assumptions in the
385 		 * crypto cipher modules used to do delayed update
386 		 * of replay sequence numbers.
387 		 */
388 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
389 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
390 				/*
391 				 * Discard encrypted frames when privacy is off.
392 				 */
393 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
394 				    wh, "WEP", "%s", "PRIVACY off");
395 				ic->ic_stats.is_rx_noprivacy++;
396 				IEEE80211_NODE_STAT(ni, rx_noprivacy);
397 				goto out;
398 			}
399 			if (iv == NULL) {
400 				key = ieee80211_crypto_decap(ic, ni, m,
401 							     hdrspace);
402 			} else {
403 				key = ieee80211_crypto_update(ic, ni, iv, wh);
404 			}
405 			if (key == NULL) {
406 				/* NB: stats+msgs handled in crypto_decap */
407 				IEEE80211_NODE_STAT(ni, rx_wepfail);
408 				goto out;
409 			}
410 			wh = mtod(m, struct ieee80211_frame *);
411 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
412 		} else {
413 			key = NULL;
414 		}
415 
416 		/*
417 		 * Next up, any fragmentation.
418 		 */
419 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
420 			m = ieee80211_defrag(ic, ni, m, hdrspace);
421 			if (m == NULL) {
422 				/* Fragment dropped or frame not complete yet */
423 				goto out;
424 			}
425 		}
426 		wh = NULL;		/* no longer valid, catch any uses */
427 
428 		/*
429 		 * Next strip any MSDU crypto bits.
430 		 */
431 		if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) {
432 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
433 			    ni->ni_macaddr, "data", "%s", "demic error");
434 			ic->ic_stats.is_rx_demicfail++;
435 			IEEE80211_NODE_STAT(ni, rx_demicfail);
436 			goto out;
437 		}
438 
439 		/* copy to listener after decrypt */
440 		if (ic->ic_rawbpf)
441 			bpf_mtap(ic->ic_rawbpf, m);
442 		need_tap = 0;
443 
444 		/*
445 		 * Finally, strip the 802.11 header.
446 		 */
447 		m = ieee80211_decap(ic, m, hdrspace);
448 		if (m == NULL) {
449 			/* don't count Null data frames as errors */
450 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA)
451 				goto out;
452 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
453 			    ni->ni_macaddr, "data", "%s", "decap error");
454 			ic->ic_stats.is_rx_decap++;
455 			IEEE80211_NODE_STAT(ni, rx_decap);
456 			goto err;
457 		}
458 		eh = mtod(m, struct ether_header *);
459 		if (!ieee80211_node_is_authorized(ni)) {
460 			/*
461 			 * Deny any non-PAE frames received prior to
462 			 * authorization.  For open/shared-key
463 			 * authentication the port is mark authorized
464 			 * after authentication completes.  For 802.1x
465 			 * the port is not marked authorized by the
466 			 * authenticator until the handshake has completed.
467 			 */
468 			if (eh->ether_type != htons(ETHERTYPE_PAE)) {
469 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
470 				    eh->ether_shost, "data",
471 				    "unauthorized port: ether type 0x%x len %u",
472 				    eh->ether_type, m->m_pkthdr.len);
473 				ic->ic_stats.is_rx_unauth++;
474 				IEEE80211_NODE_STAT(ni, rx_unauth);
475 				goto err;
476 			}
477 		} else {
478 			/*
479 			 * When denying unencrypted frames, discard
480 			 * any non-PAE frames received without encryption.
481 			 */
482 			if ((ic->ic_flags & IEEE80211_F_DROPUNENC) &&
483 			    key == NULL &&
484 			    eh->ether_type != htons(ETHERTYPE_PAE)) {
485 				/*
486 				 * Drop unencrypted frames.
487 				 */
488 				ic->ic_stats.is_rx_unencrypted++;
489 				IEEE80211_NODE_STAT(ni, rx_unencrypted);
490 				goto out;
491 			}
492 		}
493 		ieee80211_deliver_data(ic, ni, m);
494 		return IEEE80211_FC0_TYPE_DATA;
495 
496 	case IEEE80211_FC0_TYPE_MGT:
497 		ic->ic_stats.is_rx_mgmt++;
498 		IEEE80211_NODE_STAT(ni, rx_mgmt);
499 		if (dir != IEEE80211_FC1_DIR_NODS) {
500 			IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
501 			    wh, "data", "%s", "unknown dir 0x%x", dir);
502 			ic->ic_stats.is_rx_wrongdir++;
503 			goto err;
504 		}
505 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
506 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
507 			    ni->ni_macaddr, "mgt", "too short: len %u",
508 			    m->m_pkthdr.len);
509 			ic->ic_stats.is_rx_tooshort++;
510 			goto out;
511 		}
512 #ifdef IEEE80211_DEBUG
513 		if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) ||
514 		    ieee80211_msg_dumppkts(ic)) {
515 			if_printf(ic->ic_ifp, "received %s from %6D rssi %d\n",
516 			    ieee80211_mgt_subtype_name[subtype >>
517 				IEEE80211_FC0_SUBTYPE_SHIFT],
518 			    wh->i_addr2, ":", rssi);
519 		}
520 #endif
521 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
522 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
523 				/*
524 				 * Only shared key auth frames with a challenge
525 				 * should be encrypted, discard all others.
526 				 */
527 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
528 				    wh, ieee80211_mgt_subtype_name[subtype >>
529 					IEEE80211_FC0_SUBTYPE_SHIFT],
530 				    "%s", "WEP set but not permitted");
531 				ic->ic_stats.is_rx_mgtdiscard++; /* XXX */
532 				goto out;
533 			}
534 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
535 				/*
536 				 * Discard encrypted frames when privacy is off.
537 				 */
538 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
539 				    wh, "mgt", "%s", "WEP set but PRIVACY off");
540 				ic->ic_stats.is_rx_noprivacy++;
541 				goto out;
542 			}
543 			if (iv == NULL) {
544 				hdrspace = ieee80211_hdrspace(ic, wh);
545 				key = ieee80211_crypto_decap(ic, ni, m,
546 							     hdrspace);
547 			} else {
548 				key = ieee80211_crypto_update(ic, ni, iv, wh);
549 			}
550 			if (key == NULL) {
551 				/* NB: stats+msgs handled in crypto_decap */
552 				goto out;
553 			}
554 			wh = mtod(m, struct ieee80211_frame *);
555 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
556 		}
557 		if (ic->ic_rawbpf)
558 			bpf_mtap(ic->ic_rawbpf, m);
559 		(*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
560 		m_freem(m);
561 		return type;
562 
563 	case IEEE80211_FC0_TYPE_CTL:
564 		IEEE80211_NODE_STAT(ni, rx_ctrl);
565 		ic->ic_stats.is_rx_ctl++;
566 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
567 			switch (subtype) {
568 			case IEEE80211_FC0_SUBTYPE_PS_POLL:
569 				ieee80211_recv_pspoll(ic, ni, m);
570 				break;
571 			}
572 		}
573 		goto out;
574 	default:
575 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
576 		    wh, NULL, "bad frame type 0x%x", type);
577 		/* should not come here */
578 		break;
579 	}
580 err:
581 	ifp->if_ierrors++;
582 out:
583 	if (m != NULL) {
584 		if (ic->ic_rawbpf && need_tap)
585 			bpf_mtap(ic->ic_rawbpf, m);
586 		m_freem(m);
587 	}
588 	return type;
589 #undef SEQ_LEQ
590 }
591 
592 /*
593  * This function reassemble fragments.
594  */
595 static struct mbuf *
596 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni,
597 	struct mbuf *m, int hdrspace)
598 {
599 	struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
600 	struct ieee80211_frame *lwh;
601 	uint16_t rxseq;
602 	uint8_t fragno;
603 	uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
604 	struct mbuf *mfrag;
605 
606 	KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
607 
608 	rxseq = le16toh(*(uint16_t *)wh->i_seq);
609 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
610 
611 	/* Quick way out, if there's nothing to defragment */
612 	if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
613 		return m;
614 
615 	/*
616 	 * Remove frag to insure it doesn't get reaped by timer.
617 	 */
618 	if (ni->ni_table == NULL) {
619 		/*
620 		 * Should never happen.  If the node is orphaned (not in
621 		 * the table) then input packets should not reach here.
622 		 * Otherwise, a concurrent request that yanks the table
623 		 * should be blocked by other interlocking and/or by first
624 		 * shutting the driver down.  Regardless, be defensive
625 		 * here and just bail
626 		 */
627 		/* XXX need msg+stat */
628 		m_freem(m);
629 		return NULL;
630 	}
631 	mfrag = ni->ni_rxfrag[0];
632 	ni->ni_rxfrag[0] = NULL;
633 
634 	/*
635 	 * Validate new fragment is in order and
636 	 * related to the previous ones.
637 	 */
638 	if (mfrag != NULL) {
639 		uint16_t last_rxseq;
640 
641 		lwh = mtod(mfrag, struct ieee80211_frame *);
642 		last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
643 		/* NB: check seq # and frag together */
644 		if (rxseq != last_rxseq+1 ||
645 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
646 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
647 			/*
648 			 * Unrelated fragment or no space for it,
649 			 * clear current fragments.
650 			 */
651 			m_freem(mfrag);
652 			mfrag = NULL;
653 		}
654 	}
655 
656  	if (mfrag == NULL) {
657 		if (fragno != 0) {		/* !first fragment, discard */
658 			ic->ic_stats.is_rx_defrag++;
659 			IEEE80211_NODE_STAT(ni, rx_defrag);
660 			m_freem(m);
661 			return NULL;
662 		}
663 		mfrag = m;
664 	} else {				/* concatenate */
665 		m_adj(m, hdrspace);		/* strip header */
666 		m_cat(mfrag, m);
667 		/* NB: m_cat doesn't update the packet header */
668 		mfrag->m_pkthdr.len += m->m_pkthdr.len;
669 		/* track last seqnum and fragno */
670 		lwh = mtod(mfrag, struct ieee80211_frame *);
671 		*(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
672 	}
673 	if (more_frag) {			/* more to come, save */
674 		ni->ni_rxfragstamp = ticks;
675 		ni->ni_rxfrag[0] = mfrag;
676 		mfrag = NULL;
677 	}
678 	return mfrag;
679 }
680 
681 static void
682 ieee80211_deliver_data(struct ieee80211com *ic,
683 	struct ieee80211_node *ni, struct mbuf *m)
684 {
685 	struct ether_header *eh = mtod(m, struct ether_header *);
686 	struct ifnet *ifp = ic->ic_ifp;
687 
688 	/*
689 	 * Do accounting.
690 	 */
691 	ifp->if_ipackets++;
692 	IEEE80211_NODE_STAT(ni, rx_data);
693 	IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
694 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
695 		m->m_flags |= M_MCAST;	/* XXX M_BCAST? */
696 		IEEE80211_NODE_STAT(ni, rx_mcast);
697 	} else {
698 		IEEE80211_NODE_STAT(ni, rx_ucast);
699 	}
700 
701 	/* perform as a bridge within the AP */
702 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
703 	    (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) {
704 		struct mbuf *m1 = NULL;
705 
706 		if (m->m_flags & M_MCAST) {
707 			m1 = m_dup(m, MB_DONTWAIT);
708 			if (m1 == NULL)
709 				ifp->if_oerrors++;
710 			else
711 				m1->m_flags |= M_MCAST;
712 		} else {
713 			/*
714 			 * Check if the destination is known; if so
715 			 * and the port is authorized dispatch directly.
716 			 */
717 			struct ieee80211_node *sta =
718 			    ieee80211_find_node(&ic->ic_sta, eh->ether_dhost);
719 			if (sta != NULL) {
720 				if (ieee80211_node_is_authorized(sta)) {
721 					/*
722 					 * Beware of sending to ourself; this
723 					 * needs to happen via the normal
724 					 * input path.
725 					 */
726 					if (sta != ic->ic_bss) {
727 						m1 = m;
728 						m = NULL;
729 					}
730 				} else {
731 					ic->ic_stats.is_rx_unauth++;
732 					IEEE80211_NODE_STAT(sta, rx_unauth);
733 				}
734 				ieee80211_free_node(sta);
735 			}
736 		}
737 		if (m1 != NULL) {
738 			/* XXX bypasses ALTQ */
739 			ifq_handoff(ifp, m1, NULL);
740 		}
741 	}
742 	if (m != NULL) {
743 #ifdef FREEBSD_VLAN
744 		if (ni->ni_vlan != 0) {
745 			/* attach vlan tag */
746 			VLAN_INPUT_TAG_NEW(ifp, m, ni->ni_vlan);
747 			if (m == NULL)
748 				goto out;	/* XXX goto err? */
749 		}
750 #endif
751 		m->m_flags &= ~M_IEEE80211;
752 		ifp->if_input(ifp, m);
753 	}
754 	return;
755 
756 #ifdef FREEBSD_VLAN
757   out:
758 	if (m != NULL) {
759 		if (ic->ic_rawbpf)
760 			bpf_mtap(ic->ic_rawbpf, m);
761 		m_freem(m);
762 	}
763 #endif
764 }
765 
766 static struct mbuf *
767 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen)
768 {
769 	struct ieee80211_qosframe_addr4 wh;	/* Max size address frames */
770 	struct ether_header *eh;
771 	struct llc *llc;
772 
773 	if (m->m_len < hdrlen + sizeof(*llc) &&
774 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
775 		/* XXX stat, msg */
776 		return NULL;
777 	}
778 	memcpy(&wh, mtod(m, caddr_t), hdrlen);
779 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
780 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
781 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
782 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
783 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
784 		llc = NULL;
785 	} else {
786 		m_adj(m, hdrlen - sizeof(*eh));
787 	}
788 	eh = mtod(m, struct ether_header *);
789 	switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
790 	case IEEE80211_FC1_DIR_NODS:
791 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
792 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
793 		break;
794 	case IEEE80211_FC1_DIR_TODS:
795 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
796 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
797 		break;
798 	case IEEE80211_FC1_DIR_FROMDS:
799 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
800 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
801 		break;
802 	case IEEE80211_FC1_DIR_DSTODS:
803 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
804 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
805 		break;
806 	}
807 #ifdef ALIGNED_POINTER
808 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
809 		struct mbuf *n, *n0, **np;
810 		caddr_t newdata;
811 		int off, pktlen;
812 
813 		n0 = NULL;
814 		np = &n0;
815 		off = 0;
816 		pktlen = m->m_pkthdr.len;
817 		while (pktlen > off) {
818 			if (n0 == NULL) {
819 				MGETHDR(n, M_DONTWAIT, MT_DATA);
820 				if (n == NULL) {
821 					m_freem(m);
822 					return NULL;
823 				}
824 				M_MOVE_PKTHDR(n, m);
825 				n->m_len = MHLEN;
826 			} else {
827 				MGET(n, M_DONTWAIT, MT_DATA);
828 				if (n == NULL) {
829 					m_freem(m);
830 					m_freem(n0);
831 					return NULL;
832 				}
833 				n->m_len = MLEN;
834 			}
835 			if (pktlen - off >= MINCLSIZE) {
836 				MCLGET(n, M_DONTWAIT);
837 				if (n->m_flags & M_EXT)
838 					n->m_len = n->m_ext.ext_size;
839 			}
840 			if (n0 == NULL) {
841 				newdata =
842 				    (caddr_t)ALIGN(n->m_data + sizeof(*eh)) -
843 				    sizeof(*eh);
844 				n->m_len -= newdata - n->m_data;
845 				n->m_data = newdata;
846 			}
847 			if (n->m_len > pktlen - off)
848 				n->m_len = pktlen - off;
849 			m_copydata(m, off, n->m_len, mtod(n, caddr_t));
850 			off += n->m_len;
851 			*np = n;
852 			np = &n->m_next;
853 		}
854 		m_freem(m);
855 		m = n0;
856 	}
857 #endif /* ALIGNED_POINTER */
858 	if (llc != NULL) {
859 		eh = mtod(m, struct ether_header *);
860 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
861 	}
862 	return m;
863 }
864 
865 /*
866  * Install received rate set information in the node's state block.
867  */
868 int
869 ieee80211_setup_rates(struct ieee80211_node *ni,
870 	const uint8_t *rates, const uint8_t *xrates, int flags, int join)
871 {
872 	struct ieee80211com *ic = ni->ni_ic;
873 	struct ieee80211_rateset *rs = &ni->ni_rates;
874 
875 	memset(rs, 0, sizeof(*rs));
876 	rs->rs_nrates = rates[1];
877 	memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
878 	if (xrates != NULL) {
879 		uint8_t nxrates;
880 		/*
881 		 * Tack on 11g extended supported rate element.
882 		 */
883 		nxrates = xrates[1];
884 		if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
885 			nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
886 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE,
887 			     "[%6D] extended rate set too large;"
888 			     " only using %u of %u rates\n",
889 			     ni->ni_macaddr, ":", nxrates, xrates[1]);
890 			ic->ic_stats.is_rx_rstoobig++;
891 		}
892 		memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
893 		rs->rs_nrates += nxrates;
894 	}
895 	return ieee80211_fix_rate(ni, flags, join);
896 }
897 
898 static void
899 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh,
900     struct ieee80211_node *ni, int rssi, uint32_t rstamp, uint16_t seq,
901     uint16_t status)
902 {
903 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
904 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
905 		    ni->ni_macaddr, "open auth",
906 		    "bad sta auth mode %u", ni->ni_authmode);
907 		ic->ic_stats.is_rx_bad_auth++;	/* XXX */
908 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
909 			/*
910 			 * Clear any challenge text that may be there if
911 			 * a previous shared key auth failed and then an
912 			 * open auth is attempted.
913 			 */
914 			if (ni->ni_challenge != NULL) {
915 				FREE(ni->ni_challenge, M_DEVBUF);
916 				ni->ni_challenge = NULL;
917 			}
918 			/* XXX hack to workaround calling convention */
919 			ieee80211_send_error(ic, ni, wh->i_addr2,
920 			    IEEE80211_FC0_SUBTYPE_AUTH,
921 			    (seq + 1) | (IEEE80211_STATUS_ALG<<16));
922 		}
923 		return;
924 	}
925 	switch (ic->ic_opmode) {
926 	case IEEE80211_M_IBSS:
927 	case IEEE80211_M_AHDEMO:
928 	case IEEE80211_M_MONITOR:
929 		/* should not come here */
930 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
931 		    ni->ni_macaddr, "open auth",
932 		    "bad operating mode %u", ic->ic_opmode);
933 		break;
934 
935 	case IEEE80211_M_HOSTAP:
936 		if (ic->ic_state != IEEE80211_S_RUN ||
937 		    seq != IEEE80211_AUTH_OPEN_REQUEST) {
938 			ic->ic_stats.is_rx_bad_auth++;
939 			return;
940 		}
941 		/* always accept open authentication requests */
942 		if (ni == ic->ic_bss) {
943 			ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
944 			if (ni == NULL)
945 				return;
946 		} else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
947 			(void) ieee80211_ref_node(ni);
948 		/*
949 		 * Mark the node as referenced to reflect that it's
950 		 * reference count has been bumped to insure it remains
951 		 * after the transaction completes.
952 		 */
953 		ni->ni_flags |= IEEE80211_NODE_AREF;
954 
955 		IEEE80211_SEND_MGMT(ic, ni,
956 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
957 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
958 		    "[%6D] station authenticated (open)\n",
959 		    ni->ni_macaddr, ":");
960 		/*
961 		 * When 802.1x is not in use mark the port
962 		 * authorized at this point so traffic can flow.
963 		 */
964 		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
965 			ieee80211_node_authorize(ni);
966 		break;
967 
968 	case IEEE80211_M_STA:
969 		if (ic->ic_state != IEEE80211_S_AUTH ||
970 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
971 			ic->ic_stats.is_rx_bad_auth++;
972 			return;
973 		}
974 		if (status != 0) {
975 			IEEE80211_DPRINTF(ic,
976 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
977 			    "[%6D] open auth failed (reason %d)\n",
978 			    ni->ni_macaddr, ":", status);
979 			/* XXX can this happen? */
980 			if (ni != ic->ic_bss)
981 				ni->ni_fails++;
982 			ic->ic_stats.is_rx_auth_fail++;
983 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
984 		} else
985 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
986 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
987 		break;
988 	}
989 }
990 
991 /*
992  * Send a management frame error response to the specified
993  * station.  If ni is associated with the station then use
994  * it; otherwise allocate a temporary node suitable for
995  * transmitting the frame and then free the reference so
996  * it will go away as soon as the frame has been transmitted.
997  */
998 static void
999 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni,
1000 	const uint8_t *mac, int subtype, int arg)
1001 {
1002 	int istmp;
1003 
1004 	if (ni == ic->ic_bss) {
1005 		ni = ieee80211_tmp_node(ic, mac);
1006 		if (ni == NULL) {
1007 			/* XXX msg */
1008 			return;
1009 		}
1010 		istmp = 1;
1011 	} else
1012 		istmp = 0;
1013 	IEEE80211_SEND_MGMT(ic, ni, subtype, arg);
1014 	if (istmp)
1015 		ieee80211_free_node(ni);
1016 }
1017 
1018 static int
1019 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni)
1020 {
1021 	if (ni->ni_challenge == NULL)
1022 		MALLOC(ni->ni_challenge, uint32_t*, IEEE80211_CHALLENGE_LEN,
1023 		    M_DEVBUF, M_NOWAIT);
1024 	if (ni->ni_challenge == NULL) {
1025 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1026 		    "[%6D] shared key challenge alloc failed\n",
1027 		    ni->ni_macaddr, ":");
1028 		/* XXX statistic */
1029 	}
1030 	return (ni->ni_challenge != NULL);
1031 }
1032 
1033 /* XXX TODO: add statistics */
1034 static void
1035 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh,
1036     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *ni, int rssi,
1037     uint32_t rstamp, uint16_t seq, uint16_t status)
1038 {
1039 	uint8_t *challenge;
1040 	int allocbs, estatus;
1041 
1042 	/*
1043 	 * NB: this can happen as we allow pre-shared key
1044 	 * authentication to be enabled w/o wep being turned
1045 	 * on so that configuration of these can be done
1046 	 * in any order.  It may be better to enforce the
1047 	 * ordering in which case this check would just be
1048 	 * for sanity/consistency.
1049 	 */
1050 	if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
1051 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1052 		    ni->ni_macaddr, "shared key auth",
1053 		    "%s", " PRIVACY is disabled");
1054 		estatus = IEEE80211_STATUS_ALG;
1055 		goto bad;
1056 	}
1057 	/*
1058 	 * Pre-shared key authentication is evil; accept
1059 	 * it only if explicitly configured (it is supported
1060 	 * mainly for compatibility with clients like OS X).
1061 	 */
1062 	if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1063 	    ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1064 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1065 		    ni->ni_macaddr, "shared key auth",
1066 		    "bad sta auth mode %u", ni->ni_authmode);
1067 		ic->ic_stats.is_rx_bad_auth++;	/* XXX maybe a unique error? */
1068 		estatus = IEEE80211_STATUS_ALG;
1069 		goto bad;
1070 	}
1071 
1072 	challenge = NULL;
1073 	if (frm + 1 < efrm) {
1074 		if ((frm[1] + 2) > (efrm - frm)) {
1075 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1076 			    ni->ni_macaddr, "shared key auth",
1077 			    "ie %d/%d too long",
1078 			    frm[0], (frm[1] + 2) - (efrm - frm));
1079 			ic->ic_stats.is_rx_bad_auth++;
1080 			estatus = IEEE80211_STATUS_CHALLENGE;
1081 			goto bad;
1082 		}
1083 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
1084 			challenge = frm;
1085 		frm += frm[1] + 2;
1086 	}
1087 	switch (seq) {
1088 	case IEEE80211_AUTH_SHARED_CHALLENGE:
1089 	case IEEE80211_AUTH_SHARED_RESPONSE:
1090 		if (challenge == NULL) {
1091 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1092 			    ni->ni_macaddr, "shared key auth",
1093 			    "%s", "no challenge");
1094 			ic->ic_stats.is_rx_bad_auth++;
1095 			estatus = IEEE80211_STATUS_CHALLENGE;
1096 			goto bad;
1097 		}
1098 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1099 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1100 			    ni->ni_macaddr, "shared key auth",
1101 			    "bad challenge len %d", challenge[1]);
1102 			ic->ic_stats.is_rx_bad_auth++;
1103 			estatus = IEEE80211_STATUS_CHALLENGE;
1104 			goto bad;
1105 		}
1106 	default:
1107 		break;
1108 	}
1109 	switch (ic->ic_opmode) {
1110 	case IEEE80211_M_MONITOR:
1111 	case IEEE80211_M_AHDEMO:
1112 	case IEEE80211_M_IBSS:
1113 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1114 		    ni->ni_macaddr, "shared key auth",
1115 		    "bad operating mode %u", ic->ic_opmode);
1116 		return;
1117 	case IEEE80211_M_HOSTAP:
1118 		if (ic->ic_state != IEEE80211_S_RUN) {
1119 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1120 			    ni->ni_macaddr, "shared key auth",
1121 			    "bad state %u", ic->ic_state);
1122 			estatus = IEEE80211_STATUS_ALG;	/* XXX */
1123 			goto bad;
1124 		}
1125 		switch (seq) {
1126 		case IEEE80211_AUTH_SHARED_REQUEST:
1127 			if (ni == ic->ic_bss) {
1128 				ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
1129 				if (ni == NULL) {
1130 					/* NB: no way to return an error */
1131 					return;
1132 				}
1133 				allocbs = 1;
1134 			} else {
1135 				if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1136 					(void) ieee80211_ref_node(ni);
1137 				allocbs = 0;
1138 			}
1139 			/*
1140 			 * Mark the node as referenced to reflect that it's
1141 			 * reference count has been bumped to insure it remains
1142 			 * after the transaction completes.
1143 			 */
1144 			ni->ni_flags |= IEEE80211_NODE_AREF;
1145 			ni->ni_rssi = rssi;
1146 			ni->ni_rstamp = rstamp;
1147 			if (!alloc_challenge(ic, ni)) {
1148 				/* NB: don't return error so they rexmit */
1149 				return;
1150 			}
1151 			get_random_bytes(ni->ni_challenge,
1152 				IEEE80211_CHALLENGE_LEN);
1153 			IEEE80211_DPRINTF(ic,
1154 				IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1155 				"[%6D] shared key %sauth request\n",
1156 				ni->ni_macaddr, ":",
1157 				allocbs ? "" : "re");
1158 			break;
1159 		case IEEE80211_AUTH_SHARED_RESPONSE:
1160 			if (ni == ic->ic_bss) {
1161 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1162 				    ni->ni_macaddr, "shared key response",
1163 				    "%s", "unknown station");
1164 				/* NB: don't send a response */
1165 				return;
1166 			}
1167 			if (ni->ni_challenge == NULL) {
1168 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1169 				    ni->ni_macaddr, "shared key response",
1170 				    "%s", "no challenge recorded");
1171 				ic->ic_stats.is_rx_bad_auth++;
1172 				estatus = IEEE80211_STATUS_CHALLENGE;
1173 				goto bad;
1174 			}
1175 			if (memcmp(ni->ni_challenge, &challenge[2],
1176 			           challenge[1]) != 0) {
1177 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1178 				    ni->ni_macaddr, "shared key response",
1179 				    "%s", "challenge mismatch");
1180 				ic->ic_stats.is_rx_auth_fail++;
1181 				estatus = IEEE80211_STATUS_CHALLENGE;
1182 				goto bad;
1183 			}
1184 			IEEE80211_DPRINTF(ic,
1185 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1186 			    "[%6D] station authenticated (shared key)\n",
1187 			    ni->ni_macaddr, ":");
1188 			ieee80211_node_authorize(ni);
1189 			break;
1190 		default:
1191 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1192 			    ni->ni_macaddr, "shared key auth",
1193 			    "bad seq %d", seq);
1194 			ic->ic_stats.is_rx_bad_auth++;
1195 			estatus = IEEE80211_STATUS_SEQUENCE;
1196 			goto bad;
1197 		}
1198 		IEEE80211_SEND_MGMT(ic, ni,
1199 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1200 		break;
1201 
1202 	case IEEE80211_M_STA:
1203 		if (ic->ic_state != IEEE80211_S_AUTH)
1204 			return;
1205 		switch (seq) {
1206 		case IEEE80211_AUTH_SHARED_PASS:
1207 			if (ni->ni_challenge != NULL) {
1208 				FREE(ni->ni_challenge, M_DEVBUF);
1209 				ni->ni_challenge = NULL;
1210 			}
1211 			if (status != 0) {
1212 				IEEE80211_DPRINTF(ic,
1213 				    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1214 				    "[%6D] shared key auth failed (reason %d)\n",
1215 				    ieee80211_getbssid(ic, wh), ":", status);
1216 				/* XXX can this happen? */
1217 				if (ni != ic->ic_bss)
1218 					ni->ni_fails++;
1219 				ic->ic_stats.is_rx_auth_fail++;
1220 				return;
1221 			}
1222 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1223 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1224 			break;
1225 		case IEEE80211_AUTH_SHARED_CHALLENGE:
1226 			if (!alloc_challenge(ic, ni))
1227 				return;
1228 			/* XXX could optimize by passing recvd challenge */
1229 			memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1230 			IEEE80211_SEND_MGMT(ic, ni,
1231 				IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1232 			break;
1233 		default:
1234 			IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH,
1235 			    wh, "shared key auth", "bad seq %d", seq);
1236 			ic->ic_stats.is_rx_bad_auth++;
1237 			return;
1238 		}
1239 		break;
1240 	}
1241 	return;
1242 bad:
1243 	/*
1244 	 * Send an error response; but only when operating as an AP.
1245 	 */
1246 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1247 		/* XXX hack to workaround calling convention */
1248 		ieee80211_send_error(ic, ni, wh->i_addr2,
1249 		    IEEE80211_FC0_SUBTYPE_AUTH,
1250 		    (seq + 1) | (estatus<<16));
1251 	} else if (ic->ic_opmode == IEEE80211_M_STA) {
1252 		/*
1253 		 * Kick the state machine.  This short-circuits
1254 		 * using the mgt frame timeout to trigger the
1255 		 * state transition.
1256 		 */
1257 		if (ic->ic_state == IEEE80211_S_AUTH)
1258 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1259 	}
1260 }
1261 
1262 /* Verify the existence and length of __elem or get out. */
1263 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do {			\
1264 	if ((__elem) == NULL) {						\
1265 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1266 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1267 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1268 		    "%s", "no " #__elem );				\
1269 		ic->ic_stats.is_rx_elem_missing++;			\
1270 		return;							\
1271 	}								\
1272 	if ((__elem)[1] > (__maxlen)) {					\
1273 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1274 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1275 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1276 		    "bad " #__elem " len %d", (__elem)[1]);		\
1277 		ic->ic_stats.is_rx_elem_toobig++;			\
1278 		return;							\
1279 	}								\
1280 } while (0)
1281 
1282 #define	IEEE80211_VERIFY_LENGTH(_len, _minlen) do {			\
1283 	if ((_len) < (_minlen)) {					\
1284 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1285 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1286 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1287 		    "%s", "ie too short");				\
1288 		ic->ic_stats.is_rx_elem_toosmall++;			\
1289 		return;							\
1290 	}								\
1291 } while (0)
1292 
1293 #ifdef IEEE80211_DEBUG
1294 static void
1295 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag,
1296 	uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
1297 {
1298 	kprintf("[%6D] discard %s frame, ssid mismatch: ", mac, ":", tag);
1299 	ieee80211_print_essid(ssid + 2, ssid[1]);
1300 	kprintf("\n");
1301 }
1302 
1303 #define	IEEE80211_VERIFY_SSID(_ni, _ssid) do {				\
1304 	if ((_ssid)[1] != 0 &&						\
1305 	    ((_ssid)[1] != (_ni)->ni_esslen ||				\
1306 	    memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {	\
1307 		if (ieee80211_msg_input(ic))				\
1308 			ieee80211_ssid_mismatch(ic, 			\
1309 			    ieee80211_mgt_subtype_name[subtype >>	\
1310 				IEEE80211_FC0_SUBTYPE_SHIFT],		\
1311 				wh->i_addr2, _ssid);			\
1312 		ic->ic_stats.is_rx_ssidmismatch++;			\
1313 		return;							\
1314 	}								\
1315 } while (0)
1316 #else /* !IEEE80211_DEBUG */
1317 #define	IEEE80211_VERIFY_SSID(_ni, _ssid) do {				\
1318 	if ((_ssid)[1] != 0 &&						\
1319 	    ((_ssid)[1] != (_ni)->ni_esslen ||				\
1320 	    memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {	\
1321 		ic->ic_stats.is_rx_ssidmismatch++;			\
1322 		return;							\
1323 	}								\
1324 } while (0)
1325 #endif /* !IEEE80211_DEBUG */
1326 
1327 /* unalligned little endian access */
1328 #define LE_READ_2(p)					\
1329 	((uint16_t)					\
1330 	 ((((const uint8_t *)(p))[0]      ) |		\
1331 	  (((const uint8_t *)(p))[1] <<  8)))
1332 #define LE_READ_4(p)					\
1333 	((uint32_t)					\
1334 	 ((((const uint8_t *)(p))[0]      ) |		\
1335 	  (((const uint8_t *)(p))[1] <<  8) |		\
1336 	  (((const uint8_t *)(p))[2] << 16) |		\
1337 	  (((const uint8_t *)(p))[3] << 24)))
1338 
1339 static int __inline
1340 iswpaoui(const uint8_t *frm)
1341 {
1342 	return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
1343 }
1344 
1345 static int __inline
1346 iswmeoui(const uint8_t *frm)
1347 {
1348 	return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI);
1349 }
1350 
1351 static int __inline
1352 iswmeparam(const uint8_t *frm)
1353 {
1354 	return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1355 		frm[6] == WME_PARAM_OUI_SUBTYPE;
1356 }
1357 
1358 static int __inline
1359 iswmeinfo(const uint8_t *frm)
1360 {
1361 	return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1362 		frm[6] == WME_INFO_OUI_SUBTYPE;
1363 }
1364 
1365 static int __inline
1366 isatherosoui(const uint8_t *frm)
1367 {
1368 	return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
1369 }
1370 
1371 /*
1372  * Convert a WPA cipher selector OUI to an internal
1373  * cipher algorithm.  Where appropriate we also
1374  * record any key length.
1375  */
1376 static int
1377 wpa_cipher(uint8_t *sel, uint8_t *keylen)
1378 {
1379 #define	WPA_SEL(x)	(((x)<<24)|WPA_OUI)
1380 	uint32_t w = LE_READ_4(sel);
1381 
1382 	switch (w) {
1383 	case WPA_SEL(WPA_CSE_NULL):
1384 		return IEEE80211_CIPHER_NONE;
1385 	case WPA_SEL(WPA_CSE_WEP40):
1386 		if (keylen)
1387 			*keylen = 40 / NBBY;
1388 		return IEEE80211_CIPHER_WEP;
1389 	case WPA_SEL(WPA_CSE_WEP104):
1390 		if (keylen)
1391 			*keylen = 104 / NBBY;
1392 		return IEEE80211_CIPHER_WEP;
1393 	case WPA_SEL(WPA_CSE_TKIP):
1394 		return IEEE80211_CIPHER_TKIP;
1395 	case WPA_SEL(WPA_CSE_CCMP):
1396 		return IEEE80211_CIPHER_AES_CCM;
1397 	}
1398 	return 32;		/* NB: so 1<< is discarded */
1399 #undef WPA_SEL
1400 }
1401 
1402 /*
1403  * Convert a WPA key management/authentication algorithm
1404  * to an internal code.
1405  */
1406 static int
1407 wpa_keymgmt(uint8_t *sel)
1408 {
1409 #define	WPA_SEL(x)	(((x)<<24)|WPA_OUI)
1410 	uint32_t w = LE_READ_4(sel);
1411 
1412 	switch (w) {
1413 	case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1414 		return WPA_ASE_8021X_UNSPEC;
1415 	case WPA_SEL(WPA_ASE_8021X_PSK):
1416 		return WPA_ASE_8021X_PSK;
1417 	case WPA_SEL(WPA_ASE_NONE):
1418 		return WPA_ASE_NONE;
1419 	}
1420 	return 0;		/* NB: so is discarded */
1421 #undef WPA_SEL
1422 }
1423 
1424 /*
1425  * Parse a WPA information element to collect parameters
1426  * and validate the parameters against what has been
1427  * configured for the system.
1428  */
1429 static int
1430 ieee80211_parse_wpa(struct ieee80211com *ic, uint8_t *frm,
1431 	struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1432 {
1433 	uint8_t len = frm[1];
1434 	uint32_t w;
1435 	int n;
1436 
1437 	/*
1438 	 * Check the length once for fixed parts: OUI, type,
1439 	 * version, mcast cipher, and 2 selector counts.
1440 	 * Other, variable-length data, must be checked separately.
1441 	 */
1442 	if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) {
1443 		IEEE80211_DISCARD_IE(ic,
1444 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1445 		    wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags);
1446 		return IEEE80211_REASON_IE_INVALID;
1447 	}
1448 	if (len < 14) {
1449 		IEEE80211_DISCARD_IE(ic,
1450 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1451 		    wh, "WPA", "too short, len %u", len);
1452 		return IEEE80211_REASON_IE_INVALID;
1453 	}
1454 	frm += 6, len -= 4;		/* NB: len is payload only */
1455 	/* NB: iswapoui already validated the OUI and type */
1456 	w = LE_READ_2(frm);
1457 	if (w != WPA_VERSION) {
1458 		IEEE80211_DISCARD_IE(ic,
1459 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1460 		    wh, "WPA", "bad version %u", w);
1461 		return IEEE80211_REASON_IE_INVALID;
1462 	}
1463 	frm += 2, len -= 2;
1464 
1465 	/* multicast/group cipher */
1466 	w = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1467 	if (w != rsn->rsn_mcastcipher) {
1468 		IEEE80211_DISCARD_IE(ic,
1469 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1470 		    wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
1471 		    w, rsn->rsn_mcastcipher);
1472 		return IEEE80211_REASON_IE_INVALID;
1473 	}
1474 	frm += 4, len -= 4;
1475 
1476 	/* unicast ciphers */
1477 	n = LE_READ_2(frm);
1478 	frm += 2, len -= 2;
1479 	if (len < n*4+2) {
1480 		IEEE80211_DISCARD_IE(ic,
1481 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1482 		    wh, "WPA", "ucast cipher data too short; len %u, n %u",
1483 		    len, n);
1484 		return IEEE80211_REASON_IE_INVALID;
1485 	}
1486 	w = 0;
1487 	for (; n > 0; n--) {
1488 		w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1489 		frm += 4, len -= 4;
1490 	}
1491 	w &= rsn->rsn_ucastcipherset;
1492 	if (w == 0) {
1493 		IEEE80211_DISCARD_IE(ic,
1494 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1495 		    wh, "WPA", "%s", "ucast cipher set empty");
1496 		return IEEE80211_REASON_IE_INVALID;
1497 	}
1498 	if (w & (1<<IEEE80211_CIPHER_TKIP))
1499 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1500 	else
1501 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1502 
1503 	/* key management algorithms */
1504 	n = LE_READ_2(frm);
1505 	frm += 2, len -= 2;
1506 	if (len < n*4) {
1507 		IEEE80211_DISCARD_IE(ic,
1508 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1509 		    wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1510 		    len, n);
1511 		return IEEE80211_REASON_IE_INVALID;
1512 	}
1513 	w = 0;
1514 	for (; n > 0; n--) {
1515 		w |= wpa_keymgmt(frm);
1516 		frm += 4, len -= 4;
1517 	}
1518 	w &= rsn->rsn_keymgmtset;
1519 	if (w == 0) {
1520 		IEEE80211_DISCARD_IE(ic,
1521 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1522 		    wh, "WPA", "%s", "no acceptable key mgmt alg");
1523 		return IEEE80211_REASON_IE_INVALID;
1524 	}
1525 	if (w & WPA_ASE_8021X_UNSPEC)
1526 		rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1527 	else
1528 		rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1529 
1530 	if (len > 2)		/* optional capabilities */
1531 		rsn->rsn_caps = LE_READ_2(frm);
1532 
1533 	return 0;
1534 }
1535 
1536 /*
1537  * Convert an RSN cipher selector OUI to an internal
1538  * cipher algorithm.  Where appropriate we also
1539  * record any key length.
1540  */
1541 static int
1542 rsn_cipher(uint8_t *sel, uint8_t *keylen)
1543 {
1544 #define	RSN_SEL(x)	(((x)<<24)|RSN_OUI)
1545 	uint32_t w = LE_READ_4(sel);
1546 
1547 	switch (w) {
1548 	case RSN_SEL(RSN_CSE_NULL):
1549 		return IEEE80211_CIPHER_NONE;
1550 	case RSN_SEL(RSN_CSE_WEP40):
1551 		if (keylen)
1552 			*keylen = 40 / NBBY;
1553 		return IEEE80211_CIPHER_WEP;
1554 	case RSN_SEL(RSN_CSE_WEP104):
1555 		if (keylen)
1556 			*keylen = 104 / NBBY;
1557 		return IEEE80211_CIPHER_WEP;
1558 	case RSN_SEL(RSN_CSE_TKIP):
1559 		return IEEE80211_CIPHER_TKIP;
1560 	case RSN_SEL(RSN_CSE_CCMP):
1561 		return IEEE80211_CIPHER_AES_CCM;
1562 	case RSN_SEL(RSN_CSE_WRAP):
1563 		return IEEE80211_CIPHER_AES_OCB;
1564 	}
1565 	return 32;		/* NB: so 1<< is discarded */
1566 #undef WPA_SEL
1567 }
1568 
1569 /*
1570  * Convert an RSN key management/authentication algorithm
1571  * to an internal code.
1572  */
1573 static int
1574 rsn_keymgmt(uint8_t *sel)
1575 {
1576 #define	RSN_SEL(x)	(((x)<<24)|RSN_OUI)
1577 	uint32_t w = LE_READ_4(sel);
1578 
1579 	switch (w) {
1580 	case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1581 		return RSN_ASE_8021X_UNSPEC;
1582 	case RSN_SEL(RSN_ASE_8021X_PSK):
1583 		return RSN_ASE_8021X_PSK;
1584 	case RSN_SEL(RSN_ASE_NONE):
1585 		return RSN_ASE_NONE;
1586 	}
1587 	return 0;		/* NB: so is discarded */
1588 #undef RSN_SEL
1589 }
1590 
1591 /*
1592  * Parse a WPA/RSN information element to collect parameters
1593  * and validate the parameters against what has been
1594  * configured for the system.
1595  */
1596 static int
1597 ieee80211_parse_rsn(struct ieee80211com *ic, uint8_t *frm,
1598 	struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1599 {
1600 	uint8_t len = frm[1];
1601 	uint32_t w;
1602 	int n;
1603 
1604 	/*
1605 	 * Check the length once for fixed parts:
1606 	 * version, mcast cipher, and 2 selector counts.
1607 	 * Other, variable-length data, must be checked separately.
1608 	 */
1609 	if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) {
1610 		IEEE80211_DISCARD_IE(ic,
1611 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1612 		    wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags);
1613 		return IEEE80211_REASON_IE_INVALID;
1614 	}
1615 	if (len < 10) {
1616 		IEEE80211_DISCARD_IE(ic,
1617 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1618 		    wh, "RSN", "too short, len %u", len);
1619 		return IEEE80211_REASON_IE_INVALID;
1620 	}
1621 	frm += 2;
1622 	w = LE_READ_2(frm);
1623 	if (w != RSN_VERSION) {
1624 		IEEE80211_DISCARD_IE(ic,
1625 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1626 		    wh, "RSN", "bad version %u", w);
1627 		return IEEE80211_REASON_IE_INVALID;
1628 	}
1629 	frm += 2, len -= 2;
1630 
1631 	/* multicast/group cipher */
1632 	w = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1633 	if (w != rsn->rsn_mcastcipher) {
1634 		IEEE80211_DISCARD_IE(ic,
1635 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1636 		    wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
1637 		    w, rsn->rsn_mcastcipher);
1638 		return IEEE80211_REASON_IE_INVALID;
1639 	}
1640 	frm += 4, len -= 4;
1641 
1642 	/* unicast ciphers */
1643 	n = LE_READ_2(frm);
1644 	frm += 2, len -= 2;
1645 	if (len < n*4+2) {
1646 		IEEE80211_DISCARD_IE(ic,
1647 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1648 		    wh, "RSN", "ucast cipher data too short; len %u, n %u",
1649 		    len, n);
1650 		return IEEE80211_REASON_IE_INVALID;
1651 	}
1652 	w = 0;
1653 	for (; n > 0; n--) {
1654 		w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1655 		frm += 4, len -= 4;
1656 	}
1657 	w &= rsn->rsn_ucastcipherset;
1658 	if (w == 0) {
1659 		IEEE80211_DISCARD_IE(ic,
1660 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1661 		    wh, "RSN", "%s", "ucast cipher set empty");
1662 		return IEEE80211_REASON_IE_INVALID;
1663 	}
1664 	if (w & (1<<IEEE80211_CIPHER_TKIP))
1665 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1666 	else
1667 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1668 
1669 	/* key management algorithms */
1670 	n = LE_READ_2(frm);
1671 	frm += 2, len -= 2;
1672 	if (len < n*4) {
1673 		IEEE80211_DISCARD_IE(ic,
1674 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1675 		    wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1676 		    len, n);
1677 		return IEEE80211_REASON_IE_INVALID;
1678 	}
1679 	w = 0;
1680 	for (; n > 0; n--) {
1681 		w |= rsn_keymgmt(frm);
1682 		frm += 4, len -= 4;
1683 	}
1684 	w &= rsn->rsn_keymgmtset;
1685 	if (w == 0) {
1686 		IEEE80211_DISCARD_IE(ic,
1687 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1688 		    wh, "RSN", "%s", "no acceptable key mgmt alg");
1689 		return IEEE80211_REASON_IE_INVALID;
1690 	}
1691 	if (w & RSN_ASE_8021X_UNSPEC)
1692 		rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1693 	else
1694 		rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1695 
1696 	/* optional RSN capabilities */
1697 	if (len > 2)
1698 		rsn->rsn_caps = LE_READ_2(frm);
1699 	/* XXXPMKID */
1700 
1701 	return 0;
1702 }
1703 
1704 static int
1705 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm,
1706 	const struct ieee80211_frame *wh)
1707 {
1708 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1709 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1710 	u_int len = frm[1], qosinfo;
1711 	int i;
1712 
1713 	if (len < sizeof(struct ieee80211_wme_param)-2) {
1714 		IEEE80211_DISCARD_IE(ic,
1715 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1716 		    wh, "WME", "too short, len %u", len);
1717 		return -1;
1718 	}
1719 	qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1720 	qosinfo &= WME_QOSINFO_COUNT;
1721 	/* XXX do proper check for wraparound */
1722 	if (qosinfo == wme->wme_wmeChanParams.cap_info)
1723 		return 0;
1724 	frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1725 	for (i = 0; i < WME_NUM_AC; i++) {
1726 		struct wmeParams *wmep =
1727 			&wme->wme_wmeChanParams.cap_wmeParams[i];
1728 		/* NB: ACI not used */
1729 		wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1730 		wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1731 		wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1732 		wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1733 		wmep->wmep_txopLimit = LE_READ_2(frm+2);
1734 		frm += 4;
1735 	}
1736 	wme->wme_wmeChanParams.cap_info = qosinfo;
1737 	return 1;
1738 #undef MS
1739 }
1740 
1741 void
1742 ieee80211_saveie(uint8_t **iep, const uint8_t *ie)
1743 {
1744 	u_int ielen = ie[1]+2;
1745 	/*
1746 	 * Record information element for later use.
1747 	 */
1748 	if (*iep == NULL || (*iep)[1] != ie[1]) {
1749 		if (*iep != NULL)
1750 			FREE(*iep, M_DEVBUF);
1751 		MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT);
1752 	}
1753 	if (*iep != NULL)
1754 		memcpy(*iep, ie, ielen);
1755 	/* XXX note failure */
1756 }
1757 
1758 /* XXX find a better place for definition */
1759 struct l2_update_frame {
1760 	struct ether_header eh;
1761 	uint8_t dsap;
1762 	uint8_t ssap;
1763 	uint8_t control;
1764 	uint8_t xid[3];
1765 } __packed;
1766 
1767 /*
1768  * Deliver a TGf L2UF frame on behalf of a station.
1769  * This primes any bridge when the station is roaming
1770  * between ap's on the same wired network.
1771  */
1772 static void
1773 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1774 {
1775 	struct ieee80211com *ic = ni->ni_ic;
1776 	struct ifnet *ifp = ic->ic_ifp;
1777 	struct mbuf *m;
1778 	struct l2_update_frame *l2uf;
1779 	struct ether_header *eh;
1780 
1781 	m = m_gethdr(MB_DONTWAIT, MT_DATA);
1782 	if (m == NULL) {
1783 		IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1784 		    "%s", "no mbuf for l2uf frame");
1785 		ic->ic_stats.is_rx_nobuf++;	/* XXX not right */
1786 		return;
1787 	}
1788 	l2uf = mtod(m, struct l2_update_frame *);
1789 	eh = &l2uf->eh;
1790 	/* dst: Broadcast address */
1791 	IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1792 	/* src: associated STA */
1793 	IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1794 	eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1795 
1796 	l2uf->dsap = 0;
1797 	l2uf->ssap = 0;
1798 	l2uf->control = 0xf5;
1799 	l2uf->xid[0] = 0x81;
1800 	l2uf->xid[1] = 0x80;
1801 	l2uf->xid[2] = 0x00;
1802 
1803 	m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1804 	m->m_pkthdr.rcvif = ifp;
1805 	ieee80211_deliver_data(ic, ni, m);
1806 }
1807 
1808 void
1809 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
1810 	struct ieee80211_node *ni,
1811 	int subtype, int rssi, uint32_t rstamp)
1812 {
1813 #define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1814 #define	ISREASSOC(_st)	((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1815 	struct ieee80211_frame *wh;
1816 	uint8_t *frm, *efrm;
1817 	uint8_t *ssid, *rates, *xrates, *wpa, *wme;
1818 	int reassoc, resp;
1819 	uint8_t rate;
1820 
1821 	wh = mtod(m0, struct ieee80211_frame *);
1822 	frm = (uint8_t *)&wh[1];
1823 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1824 	switch (subtype) {
1825 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1826 	case IEEE80211_FC0_SUBTYPE_BEACON: {
1827 		struct ieee80211_scanparams scan;
1828 
1829 		/*
1830 		 * We process beacon/probe response frames:
1831 		 *    o when scanning, or
1832 		 *    o station mode when associated (to collect state
1833 		 *      updates such as 802.11g slot time), or
1834 		 *    o adhoc mode (to discover neighbors)
1835 		 * Frames otherwise received are discarded.
1836 		 */
1837 		if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
1838 		      (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) ||
1839 		       ic->ic_opmode == IEEE80211_M_IBSS)) {
1840 			ic->ic_stats.is_rx_mgtdiscard++;
1841 			return;
1842 		}
1843 		/*
1844 		 * beacon/probe response frame format
1845 		 *	[8] time stamp
1846 		 *	[2] beacon interval
1847 		 *	[2] capability information
1848 		 *	[tlv] ssid
1849 		 *	[tlv] supported rates
1850 		 *	[tlv] country information
1851 		 *	[tlv] parameter set (FH/DS)
1852 		 *	[tlv] erp information
1853 		 *	[tlv] extended supported rates
1854 		 *	[tlv] WME
1855 		 *	[tlv] WPA or RSN
1856 		 */
1857 		IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
1858 		memset(&scan, 0, sizeof(scan));
1859 		scan.tstamp  = frm;				frm += 8;
1860 		scan.bintval = le16toh(*(uint16_t *)frm);	frm += 2;
1861 		scan.capinfo = le16toh(*(uint16_t *)frm);	frm += 2;
1862 		scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1863 		scan.chan = scan.bchan;
1864 
1865 		while (efrm - frm > 1) {
1866 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
1867 			switch (*frm) {
1868 			case IEEE80211_ELEMID_SSID:
1869 				scan.ssid = frm;
1870 				break;
1871 			case IEEE80211_ELEMID_RATES:
1872 				scan.rates = frm;
1873 				break;
1874 			case IEEE80211_ELEMID_COUNTRY:
1875 				scan.country = frm;
1876 				break;
1877 			case IEEE80211_ELEMID_FHPARMS:
1878 				if (ic->ic_phytype == IEEE80211_T_FH) {
1879 					scan.fhdwell = LE_READ_2(&frm[2]);
1880 					scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
1881 					scan.fhindex = frm[6];
1882 				}
1883 				break;
1884 			case IEEE80211_ELEMID_DSPARMS:
1885 				/*
1886 				 * XXX hack this since depending on phytype
1887 				 * is problematic for multi-mode devices.
1888 				 */
1889 				if (ic->ic_phytype != IEEE80211_T_FH)
1890 					scan.chan = frm[2];
1891 				break;
1892 			case IEEE80211_ELEMID_TIM:
1893 				/* XXX ATIM? */
1894 				scan.tim = frm;
1895 				scan.timoff = frm - mtod(m0, uint8_t *);
1896 				break;
1897 			case IEEE80211_ELEMID_IBSSPARMS:
1898 				break;
1899 			case IEEE80211_ELEMID_XRATES:
1900 				scan.xrates = frm;
1901 				break;
1902 			case IEEE80211_ELEMID_ERP:
1903 				if (frm[1] != 1) {
1904 					IEEE80211_DISCARD_IE(ic,
1905 					    IEEE80211_MSG_ELEMID, wh, "ERP",
1906 					    "bad len %u", frm[1]);
1907 					ic->ic_stats.is_rx_elem_toobig++;
1908 					break;
1909 				}
1910 				scan.erp = frm[2];
1911 				break;
1912 			case IEEE80211_ELEMID_RSN:
1913 				scan.wpa = frm;
1914 				break;
1915 			case IEEE80211_ELEMID_VENDOR:
1916 				if (iswpaoui(frm))
1917 					scan.wpa = frm;
1918 				else if (iswmeparam(frm) || iswmeinfo(frm))
1919 					scan.wme = frm;
1920 				/* XXX Atheros OUI support */
1921 				break;
1922 			default:
1923 				IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID,
1924 				    wh, "unhandled",
1925 				    "id %u, len %u", *frm, frm[1]);
1926 				ic->ic_stats.is_rx_elem_unknown++;
1927 				break;
1928 			}
1929 			frm += frm[1] + 2;
1930 		}
1931 		IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
1932 		if (scan.xrates != NULL) {
1933 			IEEE80211_VERIFY_ELEMENT(scan.xrates,
1934 				IEEE80211_RATE_MAXSIZE - scan.rates[1]);
1935 		}
1936 		IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
1937 		if (
1938 #if IEEE80211_CHAN_MAX < 255
1939 		    scan.chan > IEEE80211_CHAN_MAX ||
1940 #endif
1941 		    isclr(ic->ic_chan_active, scan.chan)) {
1942 			IEEE80211_DISCARD(ic,
1943 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1944 			    wh, ieee80211_mgt_subtype_name[subtype >>
1945 				IEEE80211_FC0_SUBTYPE_SHIFT],
1946 			    "invalid channel %u", scan.chan);
1947 			ic->ic_stats.is_rx_badchan++;
1948 			return;
1949 		}
1950 		if (scan.chan != scan.bchan &&
1951 		    ic->ic_phytype != IEEE80211_T_FH) {
1952 			if ((ic->ic_caps_ext & IEEE80211_CEXT_AUTOSCAN) &&
1953 			    (ic->ic_flags & IEEE80211_F_SCAN) &&
1954 			    isset(ic->ic_chan_active, scan.chan)) {
1955 				ieee80211_set_scanchan(ic,
1956 					&ic->ic_channels[scan.chan]);
1957 				scan.bchan = scan.chan;
1958 			} else {
1959 				/*
1960 				 * Frame was received on a channel different
1961 				 * from the one indicated in the DS params
1962 				 * element id; silently discard it.
1963 				 *
1964 				 * NB: this can happen due to signal leakage.
1965 				 *     But we should take it for FH phy because
1966 				 *     the rssi value should be correct even for
1967 				 *     different hop pattern in FH.
1968 				 */
1969 				IEEE80211_DISCARD(ic,
1970 				    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1971 				    wh, ieee80211_mgt_subtype_name[subtype >>
1972 					IEEE80211_FC0_SUBTYPE_SHIFT],
1973 				    "for off-channel %u", scan.chan);
1974 				ic->ic_stats.is_rx_chanmismatch++;
1975 				return;
1976 			}
1977 		}
1978 		if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
1979 		      scan.bintval <= IEEE80211_BINTVAL_MAX)) {
1980 			IEEE80211_DISCARD(ic,
1981 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1982 			    wh, ieee80211_mgt_subtype_name[subtype >>
1983 				IEEE80211_FC0_SUBTYPE_SHIFT],
1984 			    "bogus beacon interval", scan.bintval);
1985 			ic->ic_stats.is_rx_badbintval++;
1986 			return;
1987 		}
1988 
1989 		/*
1990 		 * Count frame now that we know it's to be processed.
1991 		 */
1992 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1993 			ic->ic_stats.is_rx_beacon++;		/* XXX remove */
1994 			IEEE80211_NODE_STAT(ni, rx_beacons);
1995 		} else
1996 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1997 
1998 		/*
1999 		 * When operating in station mode, check for state updates.
2000 		 * Be careful to ignore beacons received while doing a
2001 		 * background scan.  We consider only 11g/WMM stuff right now.
2002 		 */
2003 		if (ic->ic_opmode == IEEE80211_M_STA &&
2004 		    ni->ni_associd != 0 &&
2005 		    ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
2006 		     IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
2007 			int update_shpreamble = 0;
2008 
2009 			/* record tsf of last beacon */
2010 			memcpy(ni->ni_tstamp.data, scan.tstamp,
2011 				sizeof(ni->ni_tstamp));
2012 			/* count beacon frame for s/w bmiss handling */
2013 			ic->ic_swbmiss_count++;
2014 			ic->ic_bmiss_count = 0;
2015 			if (ni->ni_erp != scan.erp) {
2016 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2017 				    "[%6D] erp change: was 0x%x, now 0x%x\n",
2018 				    wh->i_addr2, ":", ni->ni_erp, scan.erp);
2019 				if (ic->ic_curmode == IEEE80211_MODE_11G &&
2020 				    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2021 					ic->ic_flags |= IEEE80211_F_USEPROT;
2022 				else
2023 					ic->ic_flags &= ~IEEE80211_F_USEPROT;
2024 
2025 				if ((ni->ni_erp ^ scan.erp) & IEEE80211_ERP_LONG_PREAMBLE)
2026 					update_shpreamble = 1;
2027 
2028 				ni->ni_erp = scan.erp;
2029 				/* XXX statistic */
2030 			}
2031 			if (ni->ni_capinfo != scan.capinfo) {
2032 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2033 				    "[%6D] capabilities change: before 0x%x,"
2034 				    " now 0x%x\n",
2035 				    wh->i_addr2, ":",
2036 				    ni->ni_capinfo, scan.capinfo);
2037 
2038 				if ((ni->ni_capinfo ^ scan.capinfo) &
2039 				    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
2040 					ieee80211_set_shortslottime(ic,
2041 					    ic->ic_curmode == IEEE80211_MODE_11A ||
2042 					    (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2043 				}
2044 
2045 				if ((ni->ni_capinfo ^ scan.capinfo) &
2046 				    IEEE80211_CAPINFO_SHORT_PREAMBLE)
2047 					update_shpreamble = 1;
2048 
2049 				ni->ni_capinfo = scan.capinfo;
2050 				/* XXX statistic */
2051 			}
2052 
2053 			if (update_shpreamble)
2054 				ieee80211_update_shpreamble(ic, ni);
2055 
2056 			if (scan.wme != NULL &&
2057 			    (ni->ni_flags & IEEE80211_NODE_QOS) &&
2058 			    ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0)
2059 				ieee80211_wme_updateparams(ic);
2060 			if (scan.tim != NULL) {
2061 				struct ieee80211_tim_ie *ie =
2062 				    (struct ieee80211_tim_ie *) scan.tim;
2063 
2064 				ni->ni_dtim_count = ie->tim_count;
2065 				ni->ni_dtim_period = ie->tim_period;
2066 			}
2067 			if (ic->ic_flags & IEEE80211_F_SCAN)
2068 				ieee80211_add_scan(ic, &scan, wh,
2069 					subtype, rssi, rstamp);
2070 			return;
2071 		}
2072 		/*
2073 		 * If scanning, just pass information to the scan module.
2074 		 */
2075 		if (ic->ic_flags & IEEE80211_F_SCAN) {
2076 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
2077 				/*
2078 				 * Actively scanning a channel marked passive;
2079 				 * send a probe request now that we know there
2080 				 * is 802.11 traffic present.
2081 				 *
2082 				 * XXX check if the beacon we recv'd gives
2083 				 * us what we need and suppress the probe req
2084 				 */
2085 				ieee80211_probe_curchan(ic, 1);
2086 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
2087 			}
2088 			ieee80211_add_scan(ic, &scan, wh,
2089 				subtype, rssi, rstamp);
2090 			return;
2091 		}
2092 		if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
2093 			if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2094 				/*
2095 				 * Create a new entry in the neighbor table.
2096 				 */
2097 				ni = ieee80211_add_neighbor(ic, wh, &scan);
2098 			} else if (ni->ni_capinfo == 0) {
2099 				/*
2100 				 * Update faked node created on transmit.
2101 				 * Note this also updates the tsf.
2102 				 */
2103 				ieee80211_init_neighbor(ni, wh, &scan);
2104 			} else {
2105 				/*
2106 				 * Record tsf for potential resync.
2107 				 */
2108 				memcpy(ni->ni_tstamp.data, scan.tstamp,
2109 					sizeof(ni->ni_tstamp));
2110 			}
2111 			if (ni != NULL) {
2112 				ni->ni_rssi = rssi;
2113 				ni->ni_rstamp = rstamp;
2114 			}
2115 		}
2116 		break;
2117 	}
2118 
2119 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ: {
2120 		int is_tmpnode;
2121 
2122 		if (ic->ic_opmode == IEEE80211_M_STA ||
2123 		    ic->ic_state != IEEE80211_S_RUN) {
2124 			ic->ic_stats.is_rx_mgtdiscard++;
2125 			return;
2126 		}
2127 		if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2128 			/* frame must be directed */
2129 			ic->ic_stats.is_rx_mgtdiscard++;	/* XXX stat */
2130 			return;
2131 		}
2132 
2133 		/*
2134 		 * prreq frame format
2135 		 *	[tlv] ssid
2136 		 *	[tlv] supported rates
2137 		 *	[tlv] extended supported rates
2138 		 */
2139 		ssid = rates = xrates = NULL;
2140 		while (efrm - frm > 1) {
2141 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2142 			switch (*frm) {
2143 			case IEEE80211_ELEMID_SSID:
2144 				ssid = frm;
2145 				break;
2146 			case IEEE80211_ELEMID_RATES:
2147 				rates = frm;
2148 				break;
2149 			case IEEE80211_ELEMID_XRATES:
2150 				xrates = frm;
2151 				break;
2152 			}
2153 			frm += frm[1] + 2;
2154 		}
2155 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2156 		if (xrates != NULL) {
2157 			IEEE80211_VERIFY_ELEMENT(xrates,
2158 				IEEE80211_RATE_MAXSIZE - rates[1]);
2159 		}
2160 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2161 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2162 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
2163 			IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
2164 			    wh, ieee80211_mgt_subtype_name[subtype >>
2165 				IEEE80211_FC0_SUBTYPE_SHIFT],
2166 			    "%s", "no ssid with ssid suppression enabled");
2167 			ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/
2168 			return;
2169 		}
2170 
2171 		is_tmpnode = 0;
2172 		if (ni == ic->ic_bss) {
2173 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
2174 				ni = ieee80211_tmp_node(ic, wh->i_addr2);
2175 				is_tmpnode = 1;
2176 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2177 				/*
2178 				 * XXX Cannot tell if the sender is operating
2179 				 * in ibss mode.  But we need a new node to
2180 				 * send the response so blindly add them to the
2181 				 * neighbor table.
2182 				 */
2183 				ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
2184 					wh->i_addr2);
2185 			}
2186 			if (ni == NULL)
2187 				return;
2188 		}
2189 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2190 		    "[%6D] recv probe req\n", wh->i_addr2, ":");
2191 		ni->ni_rssi = rssi;
2192 		ni->ni_rstamp = rstamp;
2193 
2194 		/*
2195 		 * Since temporary node's rate set will not be used,
2196 		 * there is no need to do rate negotiation for it.
2197 		 */
2198 		if (!is_tmpnode) {
2199 			ieee80211_setup_rates(ni, rates, xrates,
2200 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2201 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 0);
2202 		}
2203 
2204 		IEEE80211_SEND_MGMT(ic, ni,
2205 			IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
2206 		if (is_tmpnode) {
2207 			/*
2208 			 * Temporary node created just to send a
2209 			 * response, reclaim immediately.
2210 			 */
2211 			ieee80211_free_node(ni);
2212 		}
2213 		break;
2214 	}
2215 
2216 	case IEEE80211_FC0_SUBTYPE_AUTH: {
2217 		uint16_t algo, seq, status;
2218 		/*
2219 		 * auth frame format
2220 		 *	[2] algorithm
2221 		 *	[2] sequence
2222 		 *	[2] status
2223 		 *	[tlv*] challenge
2224 		 */
2225 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
2226 		algo   = le16toh(*(uint16_t *)frm);
2227 		seq    = le16toh(*(uint16_t *)(frm + 2));
2228 		status = le16toh(*(uint16_t *)(frm + 4));
2229 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2230 		    "[%6D] recv auth frame with algorithm %d seq %d\n",
2231 		    wh->i_addr2, ":", algo, seq);
2232 		/*
2233 		 * Consult the ACL policy module if setup.
2234 		 */
2235 		if (ic->ic_acl != NULL &&
2236 		    !ic->ic_acl->iac_check(ic, wh->i_addr2)) {
2237 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL,
2238 			    wh, "auth", "%s", "disallowed by ACL");
2239 			ic->ic_stats.is_rx_acl++;
2240 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2241 				IEEE80211_SEND_MGMT(ic, ni,
2242 				    IEEE80211_FC0_SUBTYPE_AUTH,
2243 				    (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
2244 			}
2245 			return;
2246 		}
2247 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
2248 			IEEE80211_DISCARD(ic,
2249 			    IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
2250 			    wh, "auth", "%s", "TKIP countermeasures enabled");
2251 			ic->ic_stats.is_rx_auth_countermeasures++;
2252 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2253 				IEEE80211_SEND_MGMT(ic, ni,
2254 					IEEE80211_FC0_SUBTYPE_AUTH,
2255 					IEEE80211_REASON_MIC_FAILURE);
2256 			}
2257 			return;
2258 		}
2259 		if (algo == IEEE80211_AUTH_ALG_SHARED)
2260 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi,
2261 			    rstamp, seq, status);
2262 		else if (algo == IEEE80211_AUTH_ALG_OPEN)
2263 			ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq,
2264 			    status);
2265 		else {
2266 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2267 			    wh, "auth", "unsupported alg %d", algo);
2268 			ic->ic_stats.is_rx_auth_unsupported++;
2269 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2270 				/* XXX not right */
2271 				IEEE80211_SEND_MGMT(ic, ni,
2272 					IEEE80211_FC0_SUBTYPE_AUTH,
2273 					(seq+1) | (IEEE80211_STATUS_ALG<<16));
2274 			}
2275 			return;
2276 		}
2277 		break;
2278 	}
2279 
2280 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2281 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
2282 		uint16_t capinfo, lintval;
2283 		struct ieee80211_rsnparms rsn;
2284 		uint8_t reason;
2285 
2286 		if (ic->ic_opmode != IEEE80211_M_HOSTAP ||
2287 		    ic->ic_state != IEEE80211_S_RUN) {
2288 			ic->ic_stats.is_rx_mgtdiscard++;
2289 			return;
2290 		}
2291 
2292 		if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
2293 			reassoc = 1;
2294 			resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
2295 		} else {
2296 			reassoc = 0;
2297 			resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
2298 		}
2299 		/*
2300 		 * asreq frame format
2301 		 *	[2] capability information
2302 		 *	[2] listen interval
2303 		 *	[6*] current AP address (reassoc only)
2304 		 *	[tlv] ssid
2305 		 *	[tlv] supported rates
2306 		 *	[tlv] extended supported rates
2307 		 *	[tlv] WPA or RSN
2308 		 */
2309 		IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4));
2310 		if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) {
2311 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2312 			    wh, ieee80211_mgt_subtype_name[subtype >>
2313 				IEEE80211_FC0_SUBTYPE_SHIFT],
2314 			    "%s", "wrong bssid");
2315 			ic->ic_stats.is_rx_assoc_bss++;
2316 			return;
2317 		}
2318 		capinfo = le16toh(*(uint16_t *)frm);	frm += 2;
2319 		lintval = le16toh(*(uint16_t *)frm);	frm += 2;
2320 		if (reassoc)
2321 			frm += 6;	/* ignore current AP info */
2322 		ssid = rates = xrates = wpa = wme = NULL;
2323 		while (efrm - frm > 1) {
2324 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2325 			switch (*frm) {
2326 			case IEEE80211_ELEMID_SSID:
2327 				ssid = frm;
2328 				break;
2329 			case IEEE80211_ELEMID_RATES:
2330 				rates = frm;
2331 				break;
2332 			case IEEE80211_ELEMID_XRATES:
2333 				xrates = frm;
2334 				break;
2335 			/* XXX verify only one of RSN and WPA ie's? */
2336 			case IEEE80211_ELEMID_RSN:
2337 				wpa = frm;
2338 				break;
2339 			case IEEE80211_ELEMID_VENDOR:
2340 				if (iswpaoui(frm))
2341 					wpa = frm;
2342 				else if (iswmeinfo(frm))
2343 					wme = frm;
2344 				/* XXX Atheros OUI support */
2345 				break;
2346 			}
2347 			frm += frm[1] + 2;
2348 		}
2349 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2350 		if (xrates != NULL) {
2351 			IEEE80211_VERIFY_ELEMENT(xrates,
2352 				IEEE80211_RATE_MAXSIZE - rates[1]);
2353 		}
2354 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2355 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2356 
2357 		if (ni == ic->ic_bss) {
2358 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2359 			    "[%6D] deny %s request, sta not authenticated\n",
2360 			    wh->i_addr2, ":", reassoc ? "reassoc" : "assoc");
2361 			ieee80211_send_error(ic, ni, wh->i_addr2,
2362 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
2363 			    IEEE80211_REASON_ASSOC_NOT_AUTHED);
2364 			ic->ic_stats.is_rx_assoc_notauth++;
2365 			return;
2366 		}
2367 		/* assert right associstion security credentials */
2368 		if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) {
2369 			IEEE80211_DPRINTF(ic,
2370 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2371 			    "[%6D] no WPA/RSN IE in association request\n",
2372 			    wh->i_addr2, ":");
2373 			IEEE80211_SEND_MGMT(ic, ni,
2374 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
2375 			    IEEE80211_REASON_RSN_REQUIRED);
2376 			ieee80211_node_leave(ic, ni);
2377 			/* XXX distinguish WPA/RSN? */
2378 			ic->ic_stats.is_rx_assoc_badwpaie++;
2379 			return;
2380 		}
2381 		if (wpa != NULL) {
2382 			/*
2383 			 * Parse WPA information element.  Note that
2384 			 * we initialize the param block from the node
2385 			 * state so that information in the IE overrides
2386 			 * our defaults.  The resulting parameters are
2387 			 * installed below after the association is assured.
2388 			 */
2389 			rsn = ni->ni_rsn;
2390 			if (wpa[0] != IEEE80211_ELEMID_RSN)
2391 				reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh);
2392 			else
2393 				reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh);
2394 			if (reason != 0) {
2395 				IEEE80211_SEND_MGMT(ic, ni,
2396 				    IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
2397 				ieee80211_node_leave(ic, ni);
2398 				/* XXX distinguish WPA/RSN? */
2399 				ic->ic_stats.is_rx_assoc_badwpaie++;
2400 				return;
2401 			}
2402 			IEEE80211_DPRINTF(ic,
2403 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2404 			    "[%6D] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n",
2405 			    wh->i_addr2, ":",
2406 			    wpa[0] != IEEE80211_ELEMID_RSN ?  "WPA" : "RSN",
2407 			    rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen,
2408 			    rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen,
2409 			    rsn.rsn_keymgmt, rsn.rsn_caps);
2410 		}
2411 		/* discard challenge after association */
2412 		if (ni->ni_challenge != NULL) {
2413 			FREE(ni->ni_challenge, M_DEVBUF);
2414 			ni->ni_challenge = NULL;
2415 		}
2416 		/* NB: 802.11 spec says to ignore station's privacy bit */
2417 		if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2418 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2419 			    "[%6D] deny %s request, capability mismatch 0x%x\n",
2420 			    wh->i_addr2, ":",
2421 			    reassoc ? "reassoc" : "assoc", capinfo);
2422 			IEEE80211_SEND_MGMT(ic, ni, resp,
2423 				IEEE80211_STATUS_CAPINFO);
2424 			ieee80211_node_leave(ic, ni);
2425 			ic->ic_stats.is_rx_assoc_capmismatch++;
2426 			return;
2427 		}
2428 		rate = ieee80211_setup_rates(ni, rates, xrates,
2429 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2430 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 0);
2431 		if (rate & IEEE80211_RATE_BASIC) {
2432 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2433 			    "[%6D] deny %s request, rate set mismatch\n",
2434 			    wh->i_addr2, ":",
2435 			    reassoc ? "reassoc" : "assoc");
2436 			IEEE80211_SEND_MGMT(ic, ni, resp,
2437 				IEEE80211_STATUS_BASIC_RATE);
2438 			ieee80211_node_leave(ic, ni);
2439 			ic->ic_stats.is_rx_assoc_norate++;
2440 			return;
2441 		}
2442 		ni->ni_rssi = rssi;
2443 		ni->ni_rstamp = rstamp;
2444 		ni->ni_intval = lintval;
2445 		ni->ni_capinfo = capinfo;
2446 		ni->ni_chan = ic->ic_bss->ni_chan;
2447 		ni->ni_fhdwell = ic->ic_bss->ni_fhdwell;
2448 		ni->ni_fhindex = ic->ic_bss->ni_fhindex;
2449 		if (wpa != NULL) {
2450 			/*
2451 			 * Record WPA/RSN parameters for station, mark
2452 			 * node as using WPA and record information element
2453 			 * for applications that require it.
2454 			 */
2455 			ni->ni_rsn = rsn;
2456 			ieee80211_saveie(&ni->ni_wpa_ie, wpa);
2457 		} else if (ni->ni_wpa_ie != NULL) {
2458 			/*
2459 			 * Flush any state from a previous association.
2460 			 */
2461 			FREE(ni->ni_wpa_ie, M_DEVBUF);
2462 			ni->ni_wpa_ie = NULL;
2463 		}
2464 		if (wme != NULL) {
2465 			/*
2466 			 * Record WME parameters for station, mark node
2467 			 * as capable of QoS and record information
2468 			 * element for applications that require it.
2469 			 */
2470 			ieee80211_saveie(&ni->ni_wme_ie, wme);
2471 			ni->ni_flags |= IEEE80211_NODE_QOS;
2472 		} else if (ni->ni_wme_ie != NULL) {
2473 			/*
2474 			 * Flush any state from a previous association.
2475 			 */
2476 			FREE(ni->ni_wme_ie, M_DEVBUF);
2477 			ni->ni_wme_ie = NULL;
2478 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
2479 		}
2480 		ieee80211_deliver_l2uf(ni);
2481 		ieee80211_node_join(ic, ni, resp);
2482 		break;
2483 	}
2484 
2485 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2486 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
2487 		uint16_t capinfo, associd;
2488 		uint16_t status;
2489 
2490 		if (ic->ic_opmode != IEEE80211_M_STA ||
2491 		    ic->ic_state != IEEE80211_S_ASSOC) {
2492 			ic->ic_stats.is_rx_mgtdiscard++;
2493 			return;
2494 		}
2495 
2496 		/*
2497 		 * asresp frame format
2498 		 *	[2] capability information
2499 		 *	[2] status
2500 		 *	[2] association ID
2501 		 *	[tlv] supported rates
2502 		 *	[tlv] extended supported rates
2503 		 *	[tlv] WME
2504 		 */
2505 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
2506 		ni = ic->ic_bss;
2507 		capinfo = le16toh(*(uint16_t *)frm);
2508 		frm += 2;
2509 		status = le16toh(*(uint16_t *)frm);
2510 		frm += 2;
2511 		if (status != 0) {
2512 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2513 			    "[%6D] %sassoc failed (reason %d)\n",
2514 			    wh->i_addr2, ":",
2515 			    ISREASSOC(subtype) ?  "re" : "", status);
2516 			if (ni != ic->ic_bss)	/* XXX never true? */
2517 				ni->ni_fails++;
2518 			ic->ic_stats.is_rx_auth_fail++;	/* XXX */
2519 			return;
2520 		}
2521 		associd = le16toh(*(uint16_t *)frm);
2522 		frm += 2;
2523 
2524 		rates = xrates = wpa = wme = NULL;
2525 		while (efrm - frm > 1) {
2526 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2);
2527 			switch (*frm) {
2528 			case IEEE80211_ELEMID_RATES:
2529 				rates = frm;
2530 				break;
2531 			case IEEE80211_ELEMID_XRATES:
2532 				xrates = frm;
2533 				break;
2534 			case IEEE80211_ELEMID_VENDOR:
2535 				if (iswmeoui(frm))
2536 					wme = frm;
2537 				/* XXX Atheros OUI support */
2538 				break;
2539 			}
2540 			frm += frm[1] + 2;
2541 		}
2542 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2543 		if (xrates != NULL) {
2544 			IEEE80211_VERIFY_ELEMENT(xrates,
2545 				IEEE80211_RATE_MAXSIZE - rates[1]);
2546 		}
2547 
2548 		rate = ieee80211_setup_rates(ni, rates, xrates,
2549 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2550 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 1);
2551 		if (rate & IEEE80211_RATE_BASIC) {
2552 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2553 			    "[%6D] %sassoc failed (rate set mismatch)\n",
2554 			    wh->i_addr2, ":",
2555 			    ISREASSOC(subtype) ?  "re" : "");
2556 			if (ni != ic->ic_bss)	/* XXX never true? */
2557 				ni->ni_fails++;
2558 			ic->ic_stats.is_rx_assoc_norate++;
2559 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
2560 			return;
2561 		}
2562 
2563 		ni->ni_capinfo = capinfo;
2564 		ni->ni_associd = associd;
2565 		if (wme != NULL &&
2566 		    ieee80211_parse_wmeparams(ic, wme, wh) >= 0) {
2567 			ni->ni_flags |= IEEE80211_NODE_QOS;
2568 			ieee80211_wme_updateparams(ic);
2569 		} else
2570 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
2571 		/*
2572 		 * Configure state now that we are associated.
2573 		 *
2574 		 * XXX may need different/additional driver callbacks?
2575 		 */
2576 		ieee80211_update_shpreamble(ic, ni);
2577 		ieee80211_set_shortslottime(ic,
2578 			ic->ic_curmode == IEEE80211_MODE_11A ||
2579 			(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2580 		/*
2581 		 * Honor ERP protection.
2582 		 *
2583 		 * NB: ni_erp should zero for non-11g operation.
2584 		 * XXX check ic_curmode anyway?
2585 		 */
2586 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
2587 		    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2588 			ic->ic_flags |= IEEE80211_F_USEPROT;
2589 		else
2590 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
2591 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2592 		    "[%6D] %sassoc success: %s preamble, %s slot time%s%s\n",
2593 		    wh->i_addr2, ":",
2594 		    ISREASSOC(subtype) ? "re" : "",
2595 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
2596 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
2597 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
2598 		    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : ""
2599 		);
2600 		IEEE80211_PRINT_NODERATES(ic, ni, IEEE80211_MSG_ASSOC);
2601 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
2602 		break;
2603 	}
2604 
2605 	case IEEE80211_FC0_SUBTYPE_DEAUTH: {
2606 		uint16_t reason;
2607 
2608 		if (ic->ic_state == IEEE80211_S_SCAN) {
2609 			ic->ic_stats.is_rx_mgtdiscard++;
2610 			return;
2611 		}
2612 		/*
2613 		 * deauth frame format
2614 		 *	[2] reason
2615 		 */
2616 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
2617 		reason = le16toh(*(uint16_t *)frm);
2618 		ic->ic_stats.is_rx_deauth++;
2619 		IEEE80211_NODE_STAT(ni, rx_deauth);
2620 
2621 		if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) {
2622 			/* NB: can happen when in promiscuous mode */
2623 			ic->ic_stats.is_rx_mgtdiscard++;
2624 			break;
2625 		}
2626 
2627 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2628 		    "[%6D] recv deauthenticate (reason %d)\n",
2629 		    ni->ni_macaddr, ":", reason);
2630 		switch (ic->ic_opmode) {
2631 		case IEEE80211_M_STA:
2632 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
2633 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2634 			break;
2635 		case IEEE80211_M_HOSTAP:
2636 			if (ni != ic->ic_bss)
2637 				ieee80211_node_leave(ic, ni);
2638 			break;
2639 		default:
2640 			ic->ic_stats.is_rx_mgtdiscard++;
2641 			break;
2642 		}
2643 		break;
2644 	}
2645 
2646 	case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2647 		uint16_t reason;
2648 
2649 		if (ic->ic_state != IEEE80211_S_RUN &&
2650 		    ic->ic_state != IEEE80211_S_ASSOC &&
2651 		    ic->ic_state != IEEE80211_S_AUTH) {
2652 			ic->ic_stats.is_rx_mgtdiscard++;
2653 			return;
2654 		}
2655 		/*
2656 		 * disassoc frame format
2657 		 *	[2] reason
2658 		 */
2659 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
2660 		reason = le16toh(*(uint16_t *)frm);
2661 		ic->ic_stats.is_rx_disassoc++;
2662 		IEEE80211_NODE_STAT(ni, rx_disassoc);
2663 
2664 		if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) {
2665 			/* NB: can happen when in promiscuous mode */
2666 			ic->ic_stats.is_rx_mgtdiscard++;
2667 			break;
2668 		}
2669 
2670 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2671 		    "[%6D] recv disassociate (reason %d)\n",
2672 		    ni->ni_macaddr, ":", reason);
2673 		switch (ic->ic_opmode) {
2674 		case IEEE80211_M_STA:
2675 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
2676 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2677 			break;
2678 		case IEEE80211_M_HOSTAP:
2679 			if (ni != ic->ic_bss)
2680 				ieee80211_node_leave(ic, ni);
2681 			break;
2682 		default:
2683 			ic->ic_stats.is_rx_mgtdiscard++;
2684 			break;
2685 		}
2686 		break;
2687 	}
2688 	default:
2689 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2690 		     wh, "mgt", "subtype 0x%x not handled", subtype);
2691 		ic->ic_stats.is_rx_badsubtype++;
2692 		break;
2693 	}
2694 #undef ISREASSOC
2695 #undef ISPROBE
2696 }
2697 #undef IEEE80211_VERIFY_LENGTH
2698 #undef IEEE80211_VERIFY_ELEMENT
2699 
2700 /*
2701  * Handle station power-save state change.
2702  */
2703 static void
2704 ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable)
2705 {
2706 	struct ieee80211com *ic = ni->ni_ic;
2707 	struct mbuf *m;
2708 
2709 	ASSERT_SERIALIZED(ic->ic_ifp->if_serializer);
2710 
2711 	if (enable) {
2712 		if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0)
2713 			ic->ic_ps_sta++;
2714 		ni->ni_flags |= IEEE80211_NODE_PWR_MGT;
2715 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2716 		    "[%6D] power save mode on, %u sta's in ps mode\n",
2717 		    ni->ni_macaddr, ":", ic->ic_ps_sta);
2718 		return;
2719 	}
2720 
2721 	if (ni->ni_flags & IEEE80211_NODE_PWR_MGT)
2722 		ic->ic_ps_sta--;
2723 	ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT;
2724 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2725 	    "[%6D] power save mode off, %u sta's in ps mode\n",
2726 	    ni->ni_macaddr, ":", ic->ic_ps_sta);
2727 	/* XXX if no stations in ps mode, flush mc frames */
2728 
2729 	/*
2730 	 * Flush queued unicast frames.
2731 	 */
2732 	if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) {
2733 		if (ic->ic_set_tim != NULL)
2734 			ic->ic_set_tim(ni, 0);		/* just in case */
2735 		return;
2736 	}
2737 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2738 	    "[%6D] flush ps queue, %u packets queued\n",
2739 	    ni->ni_macaddr, ":", IEEE80211_NODE_SAVEQ_QLEN(ni));
2740 	for (;;) {
2741 		int qlen;
2742 
2743 		IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
2744 		if (m == NULL)
2745 			break;
2746 		/*
2747 		 * If this is the last packet, turn off the TIM bit.
2748 		 * If there are more packets, set the more packets bit
2749 		 * in the mbuf so ieee80211_encap will mark the 802.11
2750 		 * head to indicate more data frames will follow.
2751 		 */
2752 		if (qlen != 0)
2753 			m->m_flags |= M_MORE_DATA;
2754 		/* XXX need different driver interface */
2755 		/* XXX bypasses q max */
2756 		/* XXX bypasses ALTQ */
2757 		ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL);
2758 	}
2759 	if (ic->ic_set_tim != NULL)
2760 		ic->ic_set_tim(ni, 0);
2761 }
2762 
2763 /*
2764  * Process a received ps-poll frame.
2765  */
2766 static void
2767 ieee80211_recv_pspoll(struct ieee80211com *ic,
2768 	struct ieee80211_node *ni, struct mbuf *m0)
2769 {
2770 	struct ieee80211_frame_min *wh;
2771 	struct mbuf *m;
2772 	uint16_t aid;
2773 	int qlen;
2774 
2775 	ASSERT_SERIALIZED(ic->ic_ifp->if_serializer);
2776 
2777 	wh = mtod(m0, struct ieee80211_frame_min *);
2778 	if (ni->ni_associd == 0) {
2779 		IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2780 		    (struct ieee80211_frame *) wh, "ps-poll",
2781 		    "%s", "unassociated station");
2782 		ic->ic_stats.is_ps_unassoc++;
2783 		IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2784 			IEEE80211_REASON_NOT_ASSOCED);
2785 		return;
2786 	}
2787 
2788 	aid = le16toh(*(uint16_t *)wh->i_dur);
2789 	if (aid != ni->ni_associd) {
2790 		IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2791 		    (struct ieee80211_frame *) wh, "ps-poll",
2792 		    "aid mismatch: sta aid 0x%x poll aid 0x%x",
2793 		    ni->ni_associd, aid);
2794 		ic->ic_stats.is_ps_badaid++;
2795 		IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2796 			IEEE80211_REASON_NOT_ASSOCED);
2797 		return;
2798 	}
2799 
2800 	/* Okay, take the first queued packet and put it out... */
2801 	IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
2802 	if (m == NULL) {
2803 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2804 		    "[%6D] recv ps-poll, but queue empty\n",
2805 		    wh->i_addr2, ":");
2806 		ieee80211_send_nulldata(ieee80211_ref_node(ni));
2807 		ic->ic_stats.is_ps_qempty++;	/* XXX node stat */
2808 		if (ic->ic_set_tim != NULL)
2809 			ic->ic_set_tim(ni, 0);	/* just in case */
2810 		return;
2811 	}
2812 	/*
2813 	 * If there are more packets, set the more packets bit
2814 	 * in the packet dispatched to the station; otherwise
2815 	 * turn off the TIM bit.
2816 	 */
2817 	if (qlen != 0) {
2818 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2819 		    "[%6D] recv ps-poll, send packet, %u still queued\n",
2820 		    ni->ni_macaddr, ":", qlen);
2821 		m->m_flags |= M_MORE_DATA;
2822 	} else {
2823 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2824 		    "[%6D] recv ps-poll, send packet, queue empty\n",
2825 		    ni->ni_macaddr, ":");
2826 		if (ic->ic_set_tim != NULL)
2827 			ic->ic_set_tim(ni, 0);
2828 	}
2829 	m->m_flags |= M_PWR_SAV;			/* bypass PS handling */
2830 	ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL);	/* XXX bypasses ALTQ */
2831 }
2832 
2833 #ifdef IEEE80211_DEBUG
2834 /*
2835  * Debugging support.
2836  */
2837 
2838 /*
2839  * Return the bssid of a frame.
2840  */
2841 static const uint8_t *
2842 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh)
2843 {
2844 	if (ic->ic_opmode == IEEE80211_M_STA)
2845 		return wh->i_addr2;
2846 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
2847 		return wh->i_addr1;
2848 	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
2849 		return wh->i_addr1;
2850 	return wh->i_addr3;
2851 }
2852 
2853 void
2854 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...)
2855 {
2856 	char buf[128];		/* XXX */
2857 	__va_list ap;
2858 
2859 	__va_start(ap, fmt);
2860 	kvsnprintf(buf, sizeof(buf), fmt, ap);
2861 	__va_end(ap);
2862 
2863 	if_printf(ic->ic_ifp, "%s", buf);	/* NB: no \n */
2864 }
2865 
2866 void
2867 ieee80211_note_frame(struct ieee80211com *ic,
2868 	const struct ieee80211_frame *wh,
2869 	const char *fmt, ...)
2870 {
2871 	char buf[128];		/* XXX */
2872 	__va_list ap;
2873 
2874 	__va_start(ap, fmt);
2875 	kvsnprintf(buf, sizeof(buf), fmt, ap);
2876 	__va_end(ap);
2877 	if_printf(ic->ic_ifp, "[%6D] %s\n",
2878 		ieee80211_getbssid(ic, wh), ":", buf);
2879 }
2880 
2881 void
2882 ieee80211_note_mac(struct ieee80211com *ic,
2883 	const uint8_t mac[IEEE80211_ADDR_LEN],
2884 	const char *fmt, ...)
2885 {
2886 	char buf[128];		/* XXX */
2887 	__va_list ap;
2888 
2889 	__va_start(ap, fmt);
2890 	kvsnprintf(buf, sizeof(buf), fmt, ap);
2891 	__va_end(ap);
2892 	if_printf(ic->ic_ifp, "[%6D] %s\n", mac, ":", buf);
2893 }
2894 
2895 static void
2896 ieee80211_discard_frame(struct ieee80211com *ic,
2897 	const struct ieee80211_frame *wh,
2898 	const char *type, const char *fmt, ...)
2899 {
2900 	__va_list ap;
2901 
2902 	kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname,
2903 		ieee80211_getbssid(ic, wh), ":");
2904 	if (type != NULL)
2905 		kprintf("%s frame, ", type);
2906 	else
2907 		kprintf("frame, ");
2908 	__va_start(ap, fmt);
2909 	kvprintf(fmt, ap);
2910 	__va_end(ap);
2911 	kprintf("\n");
2912 }
2913 
2914 static void
2915 ieee80211_discard_ie(struct ieee80211com *ic,
2916 	const struct ieee80211_frame *wh,
2917 	const char *type, const char *fmt, ...)
2918 {
2919 	__va_list ap;
2920 
2921 	kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname,
2922 		ieee80211_getbssid(ic, wh), ":");
2923 	if (type != NULL)
2924 		kprintf("%s information element, ", type);
2925 	else
2926 		kprintf("information element, ");
2927 	__va_start(ap, fmt);
2928 	kvprintf(fmt, ap);
2929 	__va_end(ap);
2930 	kprintf("\n");
2931 }
2932 
2933 static void
2934 ieee80211_discard_mac(struct ieee80211com *ic,
2935 	const uint8_t mac[IEEE80211_ADDR_LEN],
2936 	const char *type, const char *fmt, ...)
2937 {
2938 	__va_list ap;
2939 
2940 	kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname, mac, ":");
2941 	if (type != NULL)
2942 		kprintf("%s frame, ", type);
2943 	else
2944 		kprintf("frame, ");
2945 	__va_start(ap, fmt);
2946 	kvprintf(fmt, ap);
2947 	__va_end(ap);
2948 	kprintf("\n");
2949 }
2950 #endif /* IEEE80211_DEBUG */
2951