xref: /openbsd/sys/net80211/ieee80211_proto.c (revision cecf84d4)
1 /*	$OpenBSD: ieee80211_proto.c,v 1.51 2015/03/14 03:38:51 jsg Exp $	*/
2 /*	$NetBSD: ieee80211_proto.c,v 1.8 2004/04/30 23:58:20 dyoung Exp $	*/
3 
4 /*-
5  * Copyright (c) 2001 Atsushi Onoe
6  * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
7  * Copyright (c) 2008, 2009 Damien Bergamini
8  * All rights reserved.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 3. The name of the author may not be used to endorse or promote products
19  *    derived from this software without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 /*
34  * IEEE 802.11 protocol support.
35  */
36 
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/mbuf.h>
40 #include <sys/kernel.h>
41 #include <sys/socket.h>
42 #include <sys/sockio.h>
43 #include <sys/endian.h>
44 #include <sys/errno.h>
45 #include <sys/sysctl.h>
46 
47 #include <net/if.h>
48 #include <net/if_dl.h>
49 #include <net/if_media.h>
50 #include <net/if_arp.h>
51 #include <net/if_llc.h>
52 
53 #include <netinet/in.h>
54 #include <netinet/if_ether.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_priv.h>
58 
59 const char * const ieee80211_mgt_subtype_name[] = {
60 	"assoc_req",	"assoc_resp",	"reassoc_req",	"reassoc_resp",
61 	"probe_req",	"probe_resp",	"reserved#6",	"reserved#7",
62 	"beacon",	"atim",		"disassoc",	"auth",
63 	"deauth",	"action",	"action_noack",	"reserved#15"
64 };
65 const char * const ieee80211_state_name[IEEE80211_S_MAX] = {
66 	"INIT",		/* IEEE80211_S_INIT */
67 	"SCAN",		/* IEEE80211_S_SCAN */
68 	"AUTH",		/* IEEE80211_S_AUTH */
69 	"ASSOC",	/* IEEE80211_S_ASSOC */
70 	"RUN"		/* IEEE80211_S_RUN */
71 };
72 const char * const ieee80211_phymode_name[] = {
73 	"auto",		/* IEEE80211_MODE_AUTO */
74 	"11a",		/* IEEE80211_MODE_11A */
75 	"11b",		/* IEEE80211_MODE_11B */
76 	"11g",		/* IEEE80211_MODE_11G */
77 	"turbo",	/* IEEE80211_MODE_TURBO */
78 };
79 
80 int ieee80211_newstate(struct ieee80211com *, enum ieee80211_state, int);
81 
82 void
83 ieee80211_proto_attach(struct ifnet *ifp)
84 {
85 	struct ieee80211com *ic = (void *)ifp;
86 
87 	ifp->if_hdrlen = sizeof(struct ieee80211_frame);
88 
89 #ifdef notdef
90 	ic->ic_rtsthreshold = IEEE80211_RTS_DEFAULT;
91 #else
92 	ic->ic_rtsthreshold = IEEE80211_RTS_MAX;
93 #endif
94 	ic->ic_fragthreshold = 2346;		/* XXX not used yet */
95 	ic->ic_fixed_rate = -1;			/* no fixed rate */
96 	ic->ic_protmode = IEEE80211_PROT_CTSONLY;
97 
98 	/* protocol state change handler */
99 	ic->ic_newstate = ieee80211_newstate;
100 
101 	/* initialize management frame handlers */
102 	ic->ic_recv_mgmt = ieee80211_recv_mgmt;
103 	ic->ic_send_mgmt = ieee80211_send_mgmt;
104 }
105 
106 void
107 ieee80211_proto_detach(struct ifnet *ifp)
108 {
109 	struct ieee80211com *ic = (void *)ifp;
110 
111 	IF_PURGE(&ic->ic_mgtq);
112 	IF_PURGE(&ic->ic_pwrsaveq);
113 }
114 
115 void
116 ieee80211_print_essid(const u_int8_t *essid, int len)
117 {
118 	int i;
119 	const u_int8_t *p;
120 
121 	if (len > IEEE80211_NWID_LEN)
122 		len = IEEE80211_NWID_LEN;
123 	/* determine printable or not */
124 	for (i = 0, p = essid; i < len; i++, p++) {
125 		if (*p < ' ' || *p > 0x7e)
126 			break;
127 	}
128 	if (i == len) {
129 		printf("\"");
130 		for (i = 0, p = essid; i < len; i++, p++)
131 			printf("%c", *p);
132 		printf("\"");
133 	} else {
134 		printf("0x");
135 		for (i = 0, p = essid; i < len; i++, p++)
136 			printf("%02x", *p);
137 	}
138 }
139 
140 #ifdef IEEE80211_DEBUG
141 void
142 ieee80211_dump_pkt(const u_int8_t *buf, int len, int rate, int rssi)
143 {
144 	struct ieee80211_frame *wh;
145 	int i;
146 
147 	wh = (struct ieee80211_frame *)buf;
148 	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
149 	case IEEE80211_FC1_DIR_NODS:
150 		printf("NODS %s", ether_sprintf(wh->i_addr2));
151 		printf("->%s", ether_sprintf(wh->i_addr1));
152 		printf("(%s)", ether_sprintf(wh->i_addr3));
153 		break;
154 	case IEEE80211_FC1_DIR_TODS:
155 		printf("TODS %s", ether_sprintf(wh->i_addr2));
156 		printf("->%s", ether_sprintf(wh->i_addr3));
157 		printf("(%s)", ether_sprintf(wh->i_addr1));
158 		break;
159 	case IEEE80211_FC1_DIR_FROMDS:
160 		printf("FRDS %s", ether_sprintf(wh->i_addr3));
161 		printf("->%s", ether_sprintf(wh->i_addr1));
162 		printf("(%s)", ether_sprintf(wh->i_addr2));
163 		break;
164 	case IEEE80211_FC1_DIR_DSTODS:
165 		printf("DSDS %s", ether_sprintf((u_int8_t *)&wh[1]));
166 		printf("->%s", ether_sprintf(wh->i_addr3));
167 		printf("(%s", ether_sprintf(wh->i_addr2));
168 		printf("->%s)", ether_sprintf(wh->i_addr1));
169 		break;
170 	}
171 	switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
172 	case IEEE80211_FC0_TYPE_DATA:
173 		printf(" data");
174 		break;
175 	case IEEE80211_FC0_TYPE_MGT:
176 		printf(" %s", ieee80211_mgt_subtype_name[
177 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK)
178 		    >> IEEE80211_FC0_SUBTYPE_SHIFT]);
179 		break;
180 	default:
181 		printf(" type#%d", wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
182 		break;
183 	}
184 	if (wh->i_fc[1] & IEEE80211_FC1_WEP)
185 		printf(" WEP");
186 	if (rate >= 0)
187 		printf(" %d%sM", rate / 2, (rate & 1) ? ".5" : "");
188 	if (rssi >= 0)
189 		printf(" +%d", rssi);
190 	printf("\n");
191 	if (len > 0) {
192 		for (i = 0; i < len; i++) {
193 			if ((i & 1) == 0)
194 				printf(" ");
195 			printf("%02x", buf[i]);
196 		}
197 		printf("\n");
198 	}
199 }
200 #endif
201 
202 int
203 ieee80211_fix_rate(struct ieee80211com *ic, struct ieee80211_node *ni,
204     int flags)
205 {
206 #define	RV(v)	((v) & IEEE80211_RATE_VAL)
207 	int i, j, ignore, error;
208 	int okrate, badrate, fixedrate;
209 	const struct ieee80211_rateset *srs;
210 	struct ieee80211_rateset *nrs;
211 	u_int8_t r;
212 
213 	/*
214 	 * If the fixed rate check was requested but no fixed rate has been
215 	 * defined then just remove the check.
216 	 */
217 	if ((flags & IEEE80211_F_DOFRATE) && ic->ic_fixed_rate == -1)
218 		flags &= ~IEEE80211_F_DOFRATE;
219 
220 	error = 0;
221 	okrate = badrate = fixedrate = 0;
222 	srs = &ic->ic_sup_rates[ieee80211_chan2mode(ic, ni->ni_chan)];
223 	nrs = &ni->ni_rates;
224 	for (i = 0; i < nrs->rs_nrates; ) {
225 		ignore = 0;
226 		if (flags & IEEE80211_F_DOSORT) {
227 			/*
228 			 * Sort rates.
229 			 */
230 			for (j = i + 1; j < nrs->rs_nrates; j++) {
231 				if (RV(nrs->rs_rates[i]) >
232 				    RV(nrs->rs_rates[j])) {
233 					r = nrs->rs_rates[i];
234 					nrs->rs_rates[i] = nrs->rs_rates[j];
235 					nrs->rs_rates[j] = r;
236 				}
237 			}
238 		}
239 		r = nrs->rs_rates[i] & IEEE80211_RATE_VAL;
240 		badrate = r;
241 		if (flags & IEEE80211_F_DOFRATE) {
242 			/*
243 			 * Check fixed rate is included.
244 			 */
245 			if (r == RV(srs->rs_rates[ic->ic_fixed_rate]))
246 				fixedrate = r;
247 		}
248 		if (flags & IEEE80211_F_DONEGO) {
249 			/*
250 			 * Check against supported rates.
251 			 */
252 			for (j = 0; j < srs->rs_nrates; j++) {
253 				if (r == RV(srs->rs_rates[j])) {
254 					/*
255 					 * Overwrite with the supported rate
256 					 * value so any basic rate bit is set.
257 					 * This insures that response we send
258 					 * to stations have the necessary basic
259 					 * rate bit set.
260 					 */
261 					nrs->rs_rates[i] = srs->rs_rates[j];
262 					break;
263 				}
264 			}
265 			if (j == srs->rs_nrates) {
266 				/*
267 				 * A rate in the node's rate set is not
268 				 * supported.  If this is a basic rate and we
269 				 * are operating as an AP then this is an error.
270 				 * Otherwise we just discard/ignore the rate.
271 				 * Note that this is important for 11b stations
272 				 * when they want to associate with an 11g AP.
273 				 */
274 #ifndef IEEE80211_STA_ONLY
275 				if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
276 				    (nrs->rs_rates[i] & IEEE80211_RATE_BASIC))
277 					error++;
278 #endif
279 				ignore++;
280 			}
281 		}
282 		if (flags & IEEE80211_F_DODEL) {
283 			/*
284 			 * Delete unacceptable rates.
285 			 */
286 			if (ignore) {
287 				nrs->rs_nrates--;
288 				for (j = i; j < nrs->rs_nrates; j++)
289 					nrs->rs_rates[j] = nrs->rs_rates[j + 1];
290 				nrs->rs_rates[j] = 0;
291 				continue;
292 			}
293 		}
294 		if (!ignore)
295 			okrate = nrs->rs_rates[i];
296 		i++;
297 	}
298 	if (okrate == 0 || error != 0 ||
299 	    ((flags & IEEE80211_F_DOFRATE) && fixedrate == 0))
300 		return badrate | IEEE80211_RATE_BASIC;
301 	else
302 		return RV(okrate);
303 #undef RV
304 }
305 
306 /*
307  * Reset 11g-related state.
308  */
309 void
310 ieee80211_reset_erp(struct ieee80211com *ic)
311 {
312 	ic->ic_flags &= ~IEEE80211_F_USEPROT;
313 	ic->ic_nonerpsta = 0;
314 	ic->ic_longslotsta = 0;
315 
316 	/*
317 	 * Enable short slot time iff:
318 	 * - we're operating in 802.11a or
319 	 * - we're operating in 802.11g and we're not in IBSS mode and
320 	 *   the device supports short slot time
321 	 */
322 	ieee80211_set_shortslottime(ic,
323 	    ic->ic_curmode == IEEE80211_MODE_11A
324 #ifndef IEEE80211_STA_ONLY
325 	    ||
326 	    (ic->ic_curmode == IEEE80211_MODE_11G &&
327 	     ic->ic_opmode == IEEE80211_M_HOSTAP &&
328 	     (ic->ic_caps & IEEE80211_C_SHSLOT))
329 #endif
330 	);
331 
332 	if (ic->ic_curmode == IEEE80211_MODE_11A ||
333 	    (ic->ic_caps & IEEE80211_C_SHPREAMBLE))
334 		ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
335 	else
336 		ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
337 }
338 
339 /*
340  * Set the short slot time state and notify the driver.
341  */
342 void
343 ieee80211_set_shortslottime(struct ieee80211com *ic, int on)
344 {
345 	if (on)
346 		ic->ic_flags |= IEEE80211_F_SHSLOT;
347 	else
348 		ic->ic_flags &= ~IEEE80211_F_SHSLOT;
349 
350 	/* notify the driver */
351 	if (ic->ic_updateslot != NULL)
352 		ic->ic_updateslot(ic);
353 }
354 
355 /*
356  * This function is called by the 802.1X PACP machine (via an ioctl) when
357  * the transmit key machine (4-Way Handshake for 802.11) should run.
358  */
359 int
360 ieee80211_keyrun(struct ieee80211com *ic, u_int8_t *macaddr)
361 {
362 #ifndef IEEE80211_STA_ONLY
363 	struct ieee80211_node *ni;
364 	struct ieee80211_pmk *pmk;
365 #endif
366 
367 	/* STA must be associated or AP must be ready */
368 	if (ic->ic_state != IEEE80211_S_RUN ||
369 	    !(ic->ic_flags & IEEE80211_F_RSNON))
370 		return ENETDOWN;
371 
372 #ifndef IEEE80211_STA_ONLY
373 	if (ic->ic_opmode == IEEE80211_M_STA)
374 #endif
375 		return 0;	/* supplicant only, do nothing */
376 
377 #ifndef IEEE80211_STA_ONLY
378 	/* find the STA with which we must start the key exchange */
379 	if ((ni = ieee80211_find_node(ic, macaddr)) == NULL) {
380 		DPRINTF(("no node found for %s\n", ether_sprintf(macaddr)));
381 		return EINVAL;
382 	}
383 	/* check that the STA is in the correct state */
384 	if (ni->ni_state != IEEE80211_STA_ASSOC ||
385 	    ni->ni_rsn_state != RSNA_AUTHENTICATION_2) {
386 		DPRINTF(("unexpected in state %d\n", ni->ni_rsn_state));
387 		return EINVAL;
388 	}
389 	ni->ni_rsn_state = RSNA_INITPMK;
390 
391 	/* make sure a PMK is available for this STA, otherwise deauth it */
392 	if ((pmk = ieee80211_pmksa_find(ic, ni, NULL)) == NULL) {
393 		DPRINTF(("no PMK available for %s\n", ether_sprintf(macaddr)));
394 		IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
395 		    IEEE80211_REASON_AUTH_LEAVE);
396 		ieee80211_node_leave(ic, ni);
397 		return EINVAL;
398 	}
399 	memcpy(ni->ni_pmk, pmk->pmk_key, IEEE80211_PMK_LEN);
400 	memcpy(ni->ni_pmkid, pmk->pmk_pmkid, IEEE80211_PMKID_LEN);
401 	ni->ni_flags |= IEEE80211_NODE_PMK;
402 
403 	/* initiate key exchange (4-Way Handshake) with STA */
404 	return ieee80211_send_4way_msg1(ic, ni);
405 #endif	/* IEEE80211_STA_ONLY */
406 }
407 
408 #ifndef IEEE80211_STA_ONLY
409 /*
410  * Initiate a group key handshake with a node.
411  */
412 static void
413 ieee80211_node_gtk_rekey(void *arg, struct ieee80211_node *ni)
414 {
415 	struct ieee80211com *ic = arg;
416 
417 	if (ni->ni_state != IEEE80211_STA_ASSOC ||
418 	    ni->ni_rsn_gstate != RSNA_IDLE)
419 		return;
420 
421 	/* initiate a group key handshake with STA */
422 	ni->ni_flags |= IEEE80211_NODE_REKEY;
423 	if (ieee80211_send_group_msg1(ic, ni) != 0)
424 		ni->ni_flags &= ~IEEE80211_NODE_REKEY;
425 	else
426 		ic->ic_rsn_keydonesta++;
427 }
428 
429 /*
430  * This function is called in HostAP mode when the group key needs to be
431  * changed.
432  */
433 void
434 ieee80211_setkeys(struct ieee80211com *ic)
435 {
436 	struct ieee80211_key *k;
437 	u_int8_t kid;
438 
439 	/* Swap(GM, GN) */
440 	kid = (ic->ic_def_txkey == 1) ? 2 : 1;
441 	k = &ic->ic_nw_keys[kid];
442 	memset(k, 0, sizeof(*k));
443 	k->k_id = kid;
444 	k->k_cipher = ic->ic_bss->ni_rsngroupcipher;
445 	k->k_flags = IEEE80211_KEY_GROUP | IEEE80211_KEY_TX;
446 	k->k_len = ieee80211_cipher_keylen(k->k_cipher);
447 	arc4random_buf(k->k_key, k->k_len);
448 
449 	if (ic->ic_caps & IEEE80211_C_MFP) {
450 		/* Swap(GM_igtk, GN_igtk) */
451 		kid = (ic->ic_igtk_kid == 4) ? 5 : 4;
452 		k = &ic->ic_nw_keys[kid];
453 		memset(k, 0, sizeof(*k));
454 		k->k_id = kid;
455 		k->k_cipher = ic->ic_bss->ni_rsngroupmgmtcipher;
456 		k->k_flags = IEEE80211_KEY_IGTK | IEEE80211_KEY_TX;
457 		k->k_len = 16;
458 		arc4random_buf(k->k_key, k->k_len);
459 	}
460 
461 	ic->ic_rsn_keydonesta = 0;
462 	ieee80211_iterate_nodes(ic, ieee80211_node_gtk_rekey, ic);
463 }
464 
465 /*
466  * The group key handshake has been completed with all associated stations.
467  */
468 void
469 ieee80211_setkeysdone(struct ieee80211com *ic)
470 {
471 	u_int8_t kid;
472 
473 	/* install GTK */
474 	kid = (ic->ic_def_txkey == 1) ? 2 : 1;
475 	if ((*ic->ic_set_key)(ic, ic->ic_bss, &ic->ic_nw_keys[kid]) == 0)
476 		ic->ic_def_txkey = kid;
477 
478 	if (ic->ic_caps & IEEE80211_C_MFP) {
479 		/* install IGTK */
480 		kid = (ic->ic_igtk_kid == 4) ? 5 : 4;
481 		if ((*ic->ic_set_key)(ic, ic->ic_bss,
482 		    &ic->ic_nw_keys[kid]) == 0)
483 			ic->ic_igtk_kid = kid;
484 	}
485 }
486 
487 /*
488  * Group key lifetime has expired, update it.
489  */
490 void
491 ieee80211_gtk_rekey_timeout(void *arg)
492 {
493 	struct ieee80211com *ic = arg;
494 	int s;
495 
496 	s = splnet();
497 	ieee80211_setkeys(ic);
498 	splx(s);
499 
500 	/* re-schedule a GTK rekeying after 3600s */
501 	timeout_add_sec(&ic->ic_rsn_timeout, 3600);
502 }
503 
504 void
505 ieee80211_sa_query_timeout(void *arg)
506 {
507 	struct ieee80211_node *ni = arg;
508 	struct ieee80211com *ic = ni->ni_ic;
509 	int s;
510 
511 	s = splnet();
512 	if (++ni->ni_sa_query_count >= 3) {
513 		ni->ni_flags &= ~IEEE80211_NODE_SA_QUERY;
514 		ni->ni_flags |= IEEE80211_NODE_SA_QUERY_FAILED;
515 	} else	/* retry SA Query Request */
516 		ieee80211_sa_query_request(ic, ni);
517 	splx(s);
518 }
519 
520 /*
521  * Request that a SA Query Request frame be sent to a specified peer STA
522  * to which the STA is associated.
523  */
524 void
525 ieee80211_sa_query_request(struct ieee80211com *ic, struct ieee80211_node *ni)
526 {
527 	/* MLME-SAQuery.request */
528 
529 	if (!(ni->ni_flags & IEEE80211_NODE_SA_QUERY)) {
530 		ni->ni_flags |= IEEE80211_NODE_SA_QUERY;
531 		ni->ni_flags &= ~IEEE80211_NODE_SA_QUERY_FAILED;
532 		ni->ni_sa_query_count = 0;
533 	}
534 	/* generate new Transaction Identifier */
535 	ni->ni_sa_query_trid++;
536 
537 	/* send SA Query Request */
538 	IEEE80211_SEND_ACTION(ic, ni, IEEE80211_CATEG_SA_QUERY,
539 	    IEEE80211_ACTION_SA_QUERY_REQ, 0);
540 	timeout_add_msec(&ni->ni_sa_query_to, 10);
541 }
542 #endif	/* IEEE80211_STA_ONLY */
543 
544 #ifndef IEEE80211_NO_HT
545 void
546 ieee80211_tx_ba_timeout(void *arg)
547 {
548 	struct ieee80211_tx_ba *ba = arg;
549 	struct ieee80211_node *ni = ba->ba_ni;
550 	struct ieee80211com *ic = ni->ni_ic;
551 	u_int8_t tid;
552 	int s;
553 
554 	s = splnet();
555 	if (ba->ba_state == IEEE80211_BA_REQUESTED) {
556 		/* MLME-ADDBA.confirm(TIMEOUT) */
557 		ba->ba_state = IEEE80211_BA_INIT;
558 
559 	} else if (ba->ba_state == IEEE80211_BA_AGREED) {
560 		/* Block Ack inactivity timeout */
561 		tid = ((caddr_t)ba - (caddr_t)ni->ni_tx_ba) / sizeof(*ba);
562 		ieee80211_delba_request(ic, ni, IEEE80211_REASON_TIMEOUT,
563 		    1, tid);
564 	}
565 	splx(s);
566 }
567 
568 void
569 ieee80211_rx_ba_timeout(void *arg)
570 {
571 	struct ieee80211_rx_ba *ba = arg;
572 	struct ieee80211_node *ni = ba->ba_ni;
573 	struct ieee80211com *ic = ni->ni_ic;
574 	u_int8_t tid;
575 	int s;
576 
577 	s = splnet();
578 
579 	/* Block Ack inactivity timeout */
580 	tid = ((caddr_t)ba - (caddr_t)ni->ni_rx_ba) / sizeof(*ba);
581 	ieee80211_delba_request(ic, ni, IEEE80211_REASON_TIMEOUT, 0, tid);
582 
583 	splx(s);
584 }
585 
586 /*
587  * Request initiation of Block Ack with the specified peer.
588  */
589 int
590 ieee80211_addba_request(struct ieee80211com *ic, struct ieee80211_node *ni,
591     u_int16_t ssn, u_int8_t tid)
592 {
593 	struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
594 
595 	/* MLME-ADDBA.request */
596 
597 	/* setup Block Ack */
598 	ba->ba_state = IEEE80211_BA_REQUESTED;
599 	ba->ba_token = ic->ic_dialog_token++;
600 	ba->ba_timeout_val = IEEE80211_BA_MAX_TIMEOUT;
601 	timeout_set(&ba->ba_to, ieee80211_tx_ba_timeout, ba);
602 	ba->ba_winsize = IEEE80211_BA_MAX_WINSZ;
603 	ba->ba_winstart = ssn;
604 	ba->ba_winend = (ba->ba_winstart + ba->ba_winsize - 1) & 0xfff;
605 
606 	timeout_add_sec(&ba->ba_to, 1);	/* dot11ADDBAResponseTimeout */
607 	IEEE80211_SEND_ACTION(ic, ni, IEEE80211_CATEG_BA,
608 	    IEEE80211_ACTION_ADDBA_REQ, tid);
609 	return 0;
610 }
611 
612 /*
613  * Request the deletion of Block Ack with a peer.
614  */
615 void
616 ieee80211_delba_request(struct ieee80211com *ic, struct ieee80211_node *ni,
617     u_int16_t reason, u_int8_t dir, u_int8_t tid)
618 {
619 	/* MLME-DELBA.request */
620 
621 	/* transmit a DELBA frame */
622 	IEEE80211_SEND_ACTION(ic, ni, IEEE80211_CATEG_BA,
623 	    IEEE80211_ACTION_DELBA, reason << 16 | dir << 8 | tid);
624 	if (dir) {
625 		/* MLME-DELBA.confirm(Originator) */
626 		struct ieee80211_tx_ba *ba = &ni->ni_tx_ba[tid];
627 
628 		if (ic->ic_ampdu_tx_stop != NULL)
629 			ic->ic_ampdu_tx_stop(ic, ni, tid);
630 
631 		ba->ba_state = IEEE80211_BA_INIT;
632 		/* stop Block Ack inactivity timer */
633 		timeout_del(&ba->ba_to);
634 	} else {
635 		/* MLME-DELBA.confirm(Recipient) */
636 		struct ieee80211_rx_ba *ba = &ni->ni_rx_ba[tid];
637 		int i;
638 
639 		if (ic->ic_ampdu_rx_stop != NULL)
640 			ic->ic_ampdu_rx_stop(ic, ni, tid);
641 
642 		ba->ba_state = IEEE80211_BA_INIT;
643 		/* stop Block Ack inactivity timer */
644 		timeout_del(&ba->ba_to);
645 
646 		if (ba->ba_buf != NULL) {
647 			/* free all MSDUs stored in reordering buffer */
648 			for (i = 0; i < IEEE80211_BA_MAX_WINSZ; i++)
649 				if (ba->ba_buf[i].m != NULL)
650 					m_freem(ba->ba_buf[i].m);
651 			/* free reordering buffer */
652 			free(ba->ba_buf, M_DEVBUF, 0);
653 			ba->ba_buf = NULL;
654 		}
655 	}
656 }
657 #endif	/* !IEEE80211_NO_HT */
658 
659 void
660 ieee80211_auth_open(struct ieee80211com *ic, const struct ieee80211_frame *wh,
661     struct ieee80211_node *ni, struct ieee80211_rxinfo *rxi, u_int16_t seq,
662     u_int16_t status)
663 {
664 	struct ifnet *ifp = &ic->ic_if;
665 	switch (ic->ic_opmode) {
666 #ifndef IEEE80211_STA_ONLY
667 	case IEEE80211_M_IBSS:
668 		if (ic->ic_state != IEEE80211_S_RUN ||
669 		    seq != IEEE80211_AUTH_OPEN_REQUEST) {
670 			DPRINTF(("discard auth from %s; state %u, seq %u\n",
671 			    ether_sprintf((u_int8_t *)wh->i_addr2),
672 			    ic->ic_state, seq));
673 			ic->ic_stats.is_rx_bad_auth++;
674 			return;
675 		}
676 		ieee80211_new_state(ic, IEEE80211_S_AUTH,
677 		    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
678 		break;
679 
680 	case IEEE80211_M_AHDEMO:
681 		/* should not come here */
682 		break;
683 
684 	case IEEE80211_M_HOSTAP:
685 		if (ic->ic_state != IEEE80211_S_RUN ||
686 		    seq != IEEE80211_AUTH_OPEN_REQUEST) {
687 			DPRINTF(("discard auth from %s; state %u, seq %u\n",
688 			    ether_sprintf((u_int8_t *)wh->i_addr2),
689 			    ic->ic_state, seq));
690 			ic->ic_stats.is_rx_bad_auth++;
691 			return;
692 		}
693 		if (ni == ic->ic_bss) {
694 			ni = ieee80211_find_node(ic, wh->i_addr2);
695 			if (ni == NULL)
696 				ni = ieee80211_alloc_node(ic, wh->i_addr2);
697 			if (ni == NULL) {
698 				return;
699 			}
700 			IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
701 			ni->ni_rssi = rxi->rxi_rssi;
702 			ni->ni_rstamp = rxi->rxi_tstamp;
703 			ni->ni_chan = ic->ic_bss->ni_chan;
704 		}
705 		IEEE80211_SEND_MGMT(ic, ni,
706 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
707 		if (ifp->if_flags & IFF_DEBUG)
708 			printf("%s: station %s %s authenticated (open)\n",
709 			    ifp->if_xname,
710 			    ether_sprintf((u_int8_t *)ni->ni_macaddr),
711 			    ni->ni_state != IEEE80211_STA_CACHE ?
712 			    "newly" : "already");
713 		ieee80211_node_newstate(ni, IEEE80211_STA_AUTH);
714 		break;
715 #endif	/* IEEE80211_STA_ONLY */
716 
717 	case IEEE80211_M_STA:
718 		if (ic->ic_state != IEEE80211_S_AUTH ||
719 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
720 			ic->ic_stats.is_rx_bad_auth++;
721 			DPRINTF(("discard auth from %s; state %u, seq %u\n",
722 			    ether_sprintf((u_int8_t *)wh->i_addr2),
723 			    ic->ic_state, seq));
724 			return;
725 		}
726 		if (ic->ic_flags & IEEE80211_F_RSNON) {
727 			/* XXX not here! */
728 			ic->ic_bss->ni_flags &= ~IEEE80211_NODE_TXRXPROT;
729 			ic->ic_bss->ni_port_valid = 0;
730 			ic->ic_bss->ni_replaycnt_ok = 0;
731 			(*ic->ic_delete_key)(ic, ic->ic_bss,
732 			    &ic->ic_bss->ni_pairwise_key);
733 		}
734 		if (status != 0) {
735 			if (ifp->if_flags & IFF_DEBUG)
736 				printf("%s: open authentication failed "
737 				    "(reason %d) for %s\n", ifp->if_xname,
738 				    status,
739 				    ether_sprintf((u_int8_t *)wh->i_addr3));
740 			if (ni != ic->ic_bss)
741 				ni->ni_fails++;
742 			ic->ic_stats.is_rx_auth_fail++;
743 			return;
744 		}
745 		ieee80211_new_state(ic, IEEE80211_S_ASSOC,
746 		    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
747 		break;
748 	default:
749 		break;
750 	}
751 }
752 
753 int
754 ieee80211_newstate(struct ieee80211com *ic, enum ieee80211_state nstate,
755     int mgt)
756 {
757 	struct ifnet *ifp = &ic->ic_if;
758 	struct ieee80211_node *ni;
759 	enum ieee80211_state ostate;
760 	u_int rate;
761 #ifndef IEEE80211_STA_ONLY
762 	int s;
763 #endif
764 
765 	ostate = ic->ic_state;
766 	DPRINTF(("%s -> %s\n", ieee80211_state_name[ostate],
767 	    ieee80211_state_name[nstate]));
768 	ic->ic_state = nstate;			/* state transition */
769 	ni = ic->ic_bss;			/* NB: no reference held */
770 	if (ostate == IEEE80211_S_RUN)
771 		ieee80211_set_link_state(ic, LINK_STATE_DOWN);
772 	switch (nstate) {
773 	case IEEE80211_S_INIT:
774 		/*
775 		 * If mgt = -1, driver is already partway down, so do
776 		 * not send management frames.
777 		 */
778 		switch (ostate) {
779 		case IEEE80211_S_INIT:
780 			break;
781 		case IEEE80211_S_RUN:
782 			if (mgt == -1)
783 				goto justcleanup;
784 			switch (ic->ic_opmode) {
785 			case IEEE80211_M_STA:
786 				IEEE80211_SEND_MGMT(ic, ni,
787 				    IEEE80211_FC0_SUBTYPE_DISASSOC,
788 				    IEEE80211_REASON_ASSOC_LEAVE);
789 				break;
790 #ifndef IEEE80211_STA_ONLY
791 			case IEEE80211_M_HOSTAP:
792 				s = splnet();
793 				RB_FOREACH(ni, ieee80211_tree, &ic->ic_tree) {
794 					if (ni->ni_associd == 0)
795 						continue;
796 					IEEE80211_SEND_MGMT(ic, ni,
797 					    IEEE80211_FC0_SUBTYPE_DISASSOC,
798 					    IEEE80211_REASON_ASSOC_LEAVE);
799 				}
800 				splx(s);
801 				break;
802 #endif
803 			default:
804 				break;
805 			}
806 			/* FALLTHROUGH */
807 		case IEEE80211_S_ASSOC:
808 			if (mgt == -1)
809 				goto justcleanup;
810 			switch (ic->ic_opmode) {
811 			case IEEE80211_M_STA:
812 				IEEE80211_SEND_MGMT(ic, ni,
813 				    IEEE80211_FC0_SUBTYPE_DEAUTH,
814 				    IEEE80211_REASON_AUTH_LEAVE);
815 				break;
816 #ifndef IEEE80211_STA_ONLY
817 			case IEEE80211_M_HOSTAP:
818 				s = splnet();
819 				RB_FOREACH(ni, ieee80211_tree, &ic->ic_tree) {
820 					IEEE80211_SEND_MGMT(ic, ni,
821 					    IEEE80211_FC0_SUBTYPE_DEAUTH,
822 					    IEEE80211_REASON_AUTH_LEAVE);
823 				}
824 				splx(s);
825 				break;
826 #endif
827 			default:
828 				break;
829 			}
830 			/* FALLTHROUGH */
831 		case IEEE80211_S_AUTH:
832 		case IEEE80211_S_SCAN:
833 justcleanup:
834 #ifndef IEEE80211_STA_ONLY
835 			if (ic->ic_opmode == IEEE80211_M_HOSTAP)
836 				timeout_del(&ic->ic_rsn_timeout);
837 #endif
838 			ic->ic_mgt_timer = 0;
839 			IF_PURGE(&ic->ic_mgtq);
840 			IF_PURGE(&ic->ic_pwrsaveq);
841 			ieee80211_free_allnodes(ic);
842 			break;
843 		}
844 		break;
845 	case IEEE80211_S_SCAN:
846 		ic->ic_flags &= ~IEEE80211_F_SIBSS;
847 		/* initialize bss for probe request */
848 		IEEE80211_ADDR_COPY(ni->ni_macaddr, etherbroadcastaddr);
849 		IEEE80211_ADDR_COPY(ni->ni_bssid, etherbroadcastaddr);
850 		ni->ni_rates = ic->ic_sup_rates[
851 			ieee80211_chan2mode(ic, ni->ni_chan)];
852 		ni->ni_associd = 0;
853 		ni->ni_rstamp = 0;
854 		switch (ostate) {
855 		case IEEE80211_S_INIT:
856 #ifndef IEEE80211_STA_ONLY
857 			if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
858 			    ic->ic_des_chan != IEEE80211_CHAN_ANYC) {
859 				/*
860 				 * AP operation and we already have a channel;
861 				 * bypass the scan and startup immediately.
862 				 */
863 				ieee80211_create_ibss(ic, ic->ic_des_chan);
864 			} else
865 #endif
866 				ieee80211_begin_scan(ifp);
867 			break;
868 		case IEEE80211_S_SCAN:
869 			/* scan next */
870 			if (ic->ic_flags & IEEE80211_F_ASCAN) {
871 				IEEE80211_SEND_MGMT(ic, ni,
872 				    IEEE80211_FC0_SUBTYPE_PROBE_REQ, 0);
873 			}
874 			break;
875 		case IEEE80211_S_RUN:
876 			/* beacon miss */
877 			if (ifp->if_flags & IFF_DEBUG) {
878 				/* XXX bssid clobbered above */
879 				printf("%s: no recent beacons from %s;"
880 				    " rescanning\n", ifp->if_xname,
881 				    ether_sprintf(ic->ic_bss->ni_bssid));
882 			}
883 			ieee80211_free_allnodes(ic);
884 			/* FALLTHROUGH */
885 		case IEEE80211_S_AUTH:
886 		case IEEE80211_S_ASSOC:
887 			/* timeout restart scan */
888 			ni = ieee80211_find_node(ic, ic->ic_bss->ni_macaddr);
889 			if (ni != NULL)
890 				ni->ni_fails++;
891 			ieee80211_begin_scan(ifp);
892 			break;
893 		}
894 		break;
895 	case IEEE80211_S_AUTH:
896 		switch (ostate) {
897 		case IEEE80211_S_INIT:
898 			DPRINTF(("invalid transition\n"));
899 			break;
900 		case IEEE80211_S_SCAN:
901 			IEEE80211_SEND_MGMT(ic, ni,
902 			    IEEE80211_FC0_SUBTYPE_AUTH, 1);
903 			break;
904 		case IEEE80211_S_AUTH:
905 		case IEEE80211_S_ASSOC:
906 			switch (mgt) {
907 			case IEEE80211_FC0_SUBTYPE_AUTH:
908 				/* ??? */
909 				IEEE80211_SEND_MGMT(ic, ni,
910 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
911 				break;
912 			case IEEE80211_FC0_SUBTYPE_DEAUTH:
913 				/* ignore and retry scan on timeout */
914 				break;
915 			}
916 			break;
917 		case IEEE80211_S_RUN:
918 			switch (mgt) {
919 			case IEEE80211_FC0_SUBTYPE_AUTH:
920 				IEEE80211_SEND_MGMT(ic, ni,
921 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
922 				ic->ic_state = ostate;	/* stay RUN */
923 				break;
924 			case IEEE80211_FC0_SUBTYPE_DEAUTH:
925 				/* try to reauth */
926 				IEEE80211_SEND_MGMT(ic, ni,
927 				    IEEE80211_FC0_SUBTYPE_AUTH, 1);
928 				break;
929 			}
930 			break;
931 		}
932 		break;
933 	case IEEE80211_S_ASSOC:
934 		switch (ostate) {
935 		case IEEE80211_S_INIT:
936 		case IEEE80211_S_SCAN:
937 		case IEEE80211_S_ASSOC:
938 			DPRINTF(("invalid transition\n"));
939 			break;
940 		case IEEE80211_S_AUTH:
941 			IEEE80211_SEND_MGMT(ic, ni,
942 			    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
943 			break;
944 		case IEEE80211_S_RUN:
945 			IEEE80211_SEND_MGMT(ic, ni,
946 			    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 1);
947 			break;
948 		}
949 		break;
950 	case IEEE80211_S_RUN:
951 		switch (ostate) {
952 		case IEEE80211_S_INIT:
953 		case IEEE80211_S_AUTH:
954 		case IEEE80211_S_RUN:
955 			DPRINTF(("invalid transition\n"));
956 			break;
957 		case IEEE80211_S_SCAN:		/* adhoc/hostap mode */
958 		case IEEE80211_S_ASSOC:		/* infra mode */
959 			if (ni->ni_txrate >= ni->ni_rates.rs_nrates)
960 				panic("%s: bogus xmit rate %u setup",
961 				    __func__, ni->ni_txrate);
962 			if (ifp->if_flags & IFF_DEBUG) {
963 				printf("%s: %s with %s ssid ",
964 				    ifp->if_xname,
965 				    ic->ic_opmode == IEEE80211_M_STA ?
966 				    "associated" : "synchronized",
967 				    ether_sprintf(ni->ni_bssid));
968 				ieee80211_print_essid(ic->ic_bss->ni_essid,
969 				    ni->ni_esslen);
970 				rate = ni->ni_rates.rs_rates[ni->ni_txrate] &
971 				    IEEE80211_RATE_VAL;
972 				printf(" channel %d start %u%sMb",
973 				    ieee80211_chan2ieee(ic, ni->ni_chan),
974 				    rate / 2, (rate & 1) ? ".5" : "");
975 				printf(" %s preamble %s slot time%s\n",
976 				    (ic->ic_flags & IEEE80211_F_SHPREAMBLE) ?
977 					"short" : "long",
978 				    (ic->ic_flags & IEEE80211_F_SHSLOT) ?
979 					"short" : "long",
980 				    (ic->ic_flags & IEEE80211_F_USEPROT) ?
981 					" protection enabled" : "");
982 			}
983 			if (!(ic->ic_flags & IEEE80211_F_RSNON)) {
984 				/*
985 				 * NB: When RSN is enabled, we defer setting
986 				 * the link up until the port is valid.
987 				 */
988 				ieee80211_set_link_state(ic, LINK_STATE_UP);
989 			}
990 			ic->ic_mgt_timer = 0;
991 			(*ifp->if_start)(ifp);
992 			break;
993 		}
994 		break;
995 	}
996 	return 0;
997 }
998 
999 void
1000 ieee80211_set_link_state(struct ieee80211com *ic, int nstate)
1001 {
1002 	struct ifnet *ifp = &ic->ic_if;
1003 
1004 	switch (ic->ic_opmode) {
1005 #ifndef IEEE80211_STA_ONLY
1006 	case IEEE80211_M_IBSS:
1007 	case IEEE80211_M_HOSTAP:
1008 		nstate = LINK_STATE_UNKNOWN;
1009 		break;
1010 #endif
1011 	case IEEE80211_M_MONITOR:
1012 		nstate = LINK_STATE_DOWN;
1013 		break;
1014 	default:
1015 		break;
1016 	}
1017 	if (nstate != ifp->if_link_state) {
1018 		ifp->if_link_state = nstate;
1019 		if_link_state_change(ifp);
1020 	}
1021 }
1022