1 /*-
2  * Copyright (c) 2009 The FreeBSD Foundation
3  * All rights reserved.
4  *
5  * This software was developed by Rui Paulo under sponsorship from the
6  * FreeBSD Foundation.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  */
29 #include <sys/cdefs.h>
30 #ifdef __FreeBSD__
31 __FBSDID("$FreeBSD$");
32 #endif
33 
34 /*
35  * IEEE 802.11s Hybrid Wireless Mesh Protocol, HWMP.
36  *
37  * Based on March 2009, D3.0 802.11s draft spec.
38  */
39 #include "opt_inet.h"
40 #include "opt_wlan.h"
41 
42 #include <sys/param.h>
43 #include <sys/systm.h>
44 #include <sys/mbuf.h>
45 #include <sys/malloc.h>
46 #include <sys/kernel.h>
47 
48 #include <sys/socket.h>
49 #include <sys/sockio.h>
50 #include <sys/endian.h>
51 #include <sys/errno.h>
52 #include <sys/proc.h>
53 #include <sys/sysctl.h>
54 
55 #include <net/if.h>
56 #include <net/if_media.h>
57 #include <net/if_llc.h>
58 #include <net/ethernet.h>
59 
60 #include <net/bpf.h>
61 
62 #include <netproto/802_11/ieee80211_var.h>
63 #include <netproto/802_11/ieee80211_action.h>
64 #include <netproto/802_11/ieee80211_input.h>
65 #include <netproto/802_11/ieee80211_mesh.h>
66 
67 static void	hwmp_vattach(struct ieee80211vap *);
68 static void	hwmp_vdetach(struct ieee80211vap *);
69 static int	hwmp_newstate(struct ieee80211vap *,
70 		    enum ieee80211_state, int);
71 static int	hwmp_send_action(struct ieee80211vap *,
72 		    const uint8_t [IEEE80211_ADDR_LEN],
73 		    uint8_t *, size_t);
74 static uint8_t * hwmp_add_meshpreq(uint8_t *,
75 		    const struct ieee80211_meshpreq_ie *);
76 static uint8_t * hwmp_add_meshprep(uint8_t *,
77 		    const struct ieee80211_meshprep_ie *);
78 static uint8_t * hwmp_add_meshperr(uint8_t *,
79 		    const struct ieee80211_meshperr_ie *);
80 static uint8_t * hwmp_add_meshrann(uint8_t *,
81 		    const struct ieee80211_meshrann_ie *);
82 static void	hwmp_rootmode_setup(struct ieee80211vap *);
83 static void	hwmp_rootmode_cb(void *);
84 static void	hwmp_rootmode_rann_cb(void *);
85 static void	hwmp_recv_preq(struct ieee80211vap *, struct ieee80211_node *,
86 		    const struct ieee80211_frame *,
87 		    const struct ieee80211_meshpreq_ie *);
88 static int	hwmp_send_preq(struct ieee80211vap *,
89 		    const uint8_t [IEEE80211_ADDR_LEN],
90 		    struct ieee80211_meshpreq_ie *,
91 		    struct timeval *, struct timeval *);
92 static void	hwmp_recv_prep(struct ieee80211vap *, struct ieee80211_node *,
93 		    const struct ieee80211_frame *,
94 		    const struct ieee80211_meshprep_ie *);
95 static int	hwmp_send_prep(struct ieee80211vap *,
96 		    const uint8_t [IEEE80211_ADDR_LEN],
97 		    struct ieee80211_meshprep_ie *);
98 static void	hwmp_recv_perr(struct ieee80211vap *, struct ieee80211_node *,
99 		    const struct ieee80211_frame *,
100 		    const struct ieee80211_meshperr_ie *);
101 static int	hwmp_send_perr(struct ieee80211vap *,
102 		    const uint8_t [IEEE80211_ADDR_LEN],
103 		    struct ieee80211_meshperr_ie *);
104 static void	hwmp_senderror(struct ieee80211vap *,
105 		    const uint8_t [IEEE80211_ADDR_LEN],
106 		    struct ieee80211_mesh_route *, int);
107 static void	hwmp_recv_rann(struct ieee80211vap *, struct ieee80211_node *,
108 		   const struct ieee80211_frame *,
109 		   const struct ieee80211_meshrann_ie *);
110 static int	hwmp_send_rann(struct ieee80211vap *,
111 		    const uint8_t [IEEE80211_ADDR_LEN],
112 		    struct ieee80211_meshrann_ie *);
113 static struct ieee80211_node *
114 		hwmp_discover(struct ieee80211vap *,
115 		    const uint8_t [IEEE80211_ADDR_LEN], struct mbuf *);
116 static void	hwmp_peerdown(struct ieee80211_node *);
117 
118 static struct timeval ieee80211_hwmp_preqminint = { 0, 100000 };
119 static struct timeval ieee80211_hwmp_perrminint = { 0, 100000 };
120 
121 
122 /* NB: the Target Address set in a Proactive PREQ is the broadcast address. */
123 static const uint8_t	broadcastaddr[IEEE80211_ADDR_LEN] =
124 	{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
125 
126 typedef uint32_t ieee80211_hwmp_seq;
127 #define	HWMP_SEQ_LT(a, b)	((int32_t)((a)-(b)) < 0)
128 #define	HWMP_SEQ_LEQ(a, b)	((int32_t)((a)-(b)) <= 0)
129 #define	HWMP_SEQ_EQ(a, b)	((int32_t)((a)-(b)) == 0)
130 #define	HWMP_SEQ_GT(a, b)	((int32_t)((a)-(b)) > 0)
131 #define	HWMP_SEQ_GEQ(a, b)	((int32_t)((a)-(b)) >= 0)
132 
133 #define HWMP_SEQ_MAX(a, b)	(a > b ? a : b)
134 
135 /*
136  * Private extension of ieee80211_mesh_route.
137  */
138 struct ieee80211_hwmp_route {
139 	ieee80211_hwmp_seq	hr_seq;		/* last HWMP seq seen from dst*/
140 	ieee80211_hwmp_seq	hr_preqid;	/* last PREQ ID seen from dst */
141 	ieee80211_hwmp_seq	hr_origseq;	/* seq. no. on our latest PREQ*/
142 	struct timeval		hr_lastpreq;	/* last time we sent a PREQ */
143 	struct timeval		hr_lastrootconf; /* last sent PREQ root conf */
144 	int			hr_preqretries;	/* number of discoveries */
145 	int			hr_lastdiscovery; /* last discovery in ticks */
146 };
147 struct ieee80211_hwmp_state {
148 	ieee80211_hwmp_seq	hs_seq;		/* next seq to be used */
149 	ieee80211_hwmp_seq	hs_preqid;	/* next PREQ ID to be used */
150 	int			hs_rootmode;	/* proactive HWMP */
151 	struct timeval		hs_lastperr;	/* last time we sent a PERR */
152 	struct callout		hs_roottimer;
153 	uint8_t			hs_maxhops;	/* max hop count */
154 };
155 
156 static SYSCTL_NODE(_net_wlan, OID_AUTO, hwmp, CTLFLAG_RD, 0,
157     "IEEE 802.11s HWMP parameters");
158 static int	ieee80211_hwmp_targetonly = 0;
159 SYSCTL_INT(_net_wlan_hwmp, OID_AUTO, targetonly, CTLFLAG_RW,
160     &ieee80211_hwmp_targetonly, 0, "Set TO bit on generated PREQs");
161 static int	ieee80211_hwmp_pathtimeout = -1;
162 SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, pathlifetime, CTLTYPE_INT | CTLFLAG_RW,
163     &ieee80211_hwmp_pathtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
164     "path entry lifetime (ms)");
165 static int	ieee80211_hwmp_maxpreq_retries = -1;
166 SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, maxpreq_retries, CTLTYPE_INT | CTLFLAG_RW,
167     &ieee80211_hwmp_maxpreq_retries, 0, ieee80211_sysctl_msecs_ticks, "I",
168     "maximum number of preq retries");
169 static int	ieee80211_hwmp_net_diameter_traversaltime = -1;
170 SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, net_diameter_traversal_time,
171     CTLTYPE_INT | CTLFLAG_RW, &ieee80211_hwmp_net_diameter_traversaltime, 0,
172     ieee80211_sysctl_msecs_ticks, "I",
173     "estimate travelse time across the MBSS (ms)");
174 static int	ieee80211_hwmp_roottimeout = -1;
175 SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, roottimeout, CTLTYPE_INT | CTLFLAG_RW,
176     &ieee80211_hwmp_roottimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
177     "root PREQ timeout (ms)");
178 static int	ieee80211_hwmp_rootint = -1;
179 SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rootint, CTLTYPE_INT | CTLFLAG_RW,
180     &ieee80211_hwmp_rootint, 0, ieee80211_sysctl_msecs_ticks, "I",
181     "root interval (ms)");
182 static int	ieee80211_hwmp_rannint = -1;
183 SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rannint, CTLTYPE_INT | CTLFLAG_RW,
184     &ieee80211_hwmp_rannint, 0, ieee80211_sysctl_msecs_ticks, "I",
185     "root announcement interval (ms)");
186 static struct timeval ieee80211_hwmp_rootconfint = { 0, 0 };
187 static int	ieee80211_hwmp_rootconfint_internal = -1;
188 SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, rootconfint, CTLTYPE_INT | CTLFLAG_RD,
189     &ieee80211_hwmp_rootconfint_internal, 0, ieee80211_sysctl_msecs_ticks, "I",
190     "root confirmation interval (ms) (read-only)");
191 
192 #define	IEEE80211_HWMP_DEFAULT_MAXHOPS	31
193 
194 static	ieee80211_recv_action_func hwmp_recv_action_meshpath;
195 
196 static struct ieee80211_mesh_proto_path mesh_proto_hwmp = {
197 	.mpp_descr	= "HWMP",
198 	.mpp_ie		= IEEE80211_MESHCONF_PATH_HWMP,
199 	.mpp_discover	= hwmp_discover,
200 	.mpp_peerdown	= hwmp_peerdown,
201 	.mpp_senderror	= hwmp_senderror,
202 	.mpp_vattach	= hwmp_vattach,
203 	.mpp_vdetach	= hwmp_vdetach,
204 	.mpp_newstate	= hwmp_newstate,
205 	.mpp_privlen	= sizeof(struct ieee80211_hwmp_route),
206 };
207 SYSCTL_PROC(_net_wlan_hwmp, OID_AUTO, inact, CTLTYPE_INT | CTLFLAG_RW,
208 	&mesh_proto_hwmp.mpp_inact, 0, ieee80211_sysctl_msecs_ticks, "I",
209 	"mesh route inactivity timeout (ms)");
210 
211 
212 static void
213 ieee80211_hwmp_init(void)
214 {
215 	/* Default values as per amendment */
216 	ieee80211_hwmp_pathtimeout = msecs_to_ticks(5*1000);
217 	ieee80211_hwmp_roottimeout = msecs_to_ticks(5*1000);
218 	ieee80211_hwmp_rootint = msecs_to_ticks(2*1000);
219 	ieee80211_hwmp_rannint = msecs_to_ticks(1*1000);
220 	ieee80211_hwmp_rootconfint_internal = msecs_to_ticks(2*1000);
221 	ieee80211_hwmp_maxpreq_retries = 3;
222 	/*
223 	 * (TU): A measurement of time equal to 1024 μs,
224 	 * 500 TU is 512 ms.
225 	 */
226 	ieee80211_hwmp_net_diameter_traversaltime = msecs_to_ticks(512);
227 
228 	/*
229 	 * NB: I dont know how to make SYSCTL_PROC that calls ms to ticks
230 	 * and return a struct timeval...
231 	 */
232 	ieee80211_hwmp_rootconfint.tv_usec =
233 	    ieee80211_hwmp_rootconfint_internal * 1000;
234 
235 	/*
236 	 * Register action frame handler.
237 	 */
238 	ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESH,
239 	    IEEE80211_ACTION_MESH_HWMP, hwmp_recv_action_meshpath);
240 
241 	/* NB: default is 5 secs per spec */
242 	mesh_proto_hwmp.mpp_inact = msecs_to_ticks(5*1000);
243 
244 	/*
245 	 * Register HWMP.
246 	 */
247 	ieee80211_mesh_register_proto_path(&mesh_proto_hwmp);
248 }
249 SYSINIT(wlan_hwmp, SI_SUB_DRIVERS, SI_ORDER_SECOND, ieee80211_hwmp_init, NULL);
250 
251 static void
252 hwmp_vattach(struct ieee80211vap *vap)
253 {
254 	struct ieee80211_hwmp_state *hs;
255 
256 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS,
257 	    ("not a mesh vap, opmode %d", vap->iv_opmode));
258 
259 #if defined(__DragonFly__)
260 	hs = kmalloc(sizeof(struct ieee80211_hwmp_state), M_80211_VAP,
261 		M_INTWAIT | M_ZERO);
262 #else
263 	hs = IEEE80211_MALLOC(sizeof(struct ieee80211_hwmp_state), M_80211_VAP,
264 		IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
265 #endif
266 	if (hs == NULL) {
267 		kprintf("%s: couldn't alloc HWMP state\n", __func__);
268 		return;
269 	}
270 	hs->hs_maxhops = IEEE80211_HWMP_DEFAULT_MAXHOPS;
271 #if defined(__DragonFly__)
272 	callout_init_mp(&hs->hs_roottimer);
273 #else
274 	callout_init(&hs->hs_roottimer, 1);
275 #endif
276 	vap->iv_hwmp = hs;
277 }
278 
279 static void
280 hwmp_vdetach(struct ieee80211vap *vap)
281 {
282 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
283 
284 	callout_drain(&hs->hs_roottimer);
285 	IEEE80211_FREE(vap->iv_hwmp, M_80211_VAP);
286 	vap->iv_hwmp = NULL;
287 }
288 
289 static int
290 hwmp_newstate(struct ieee80211vap *vap, enum ieee80211_state ostate, int arg)
291 {
292 	enum ieee80211_state nstate = vap->iv_state;
293 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
294 
295 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
296 	    __func__, ieee80211_state_name[ostate],
297 	    ieee80211_state_name[nstate], arg);
298 
299 	if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN)
300 		callout_drain(&hs->hs_roottimer);
301 	if (nstate == IEEE80211_S_RUN)
302 		hwmp_rootmode_setup(vap);
303 	return 0;
304 }
305 
306 /*
307  * Verify the length of an HWMP PREQ and return the number
308  * of destinations >= 1, if verification fails -1 is returned.
309  */
310 static int
311 verify_mesh_preq_len(struct ieee80211vap *vap,
312     const struct ieee80211_frame *wh, const uint8_t *iefrm)
313 {
314 	int alloc_sz = -1;
315 	int ndest = -1;
316 	if (iefrm[2] & IEEE80211_MESHPREQ_FLAGS_AE) {
317 		/* Originator External Address  present */
318 		alloc_sz =  IEEE80211_MESHPREQ_BASE_SZ_AE;
319 		ndest = iefrm[IEEE80211_MESHPREQ_TCNT_OFFSET_AE];
320 	} else {
321 		/* w/o Originator External Address */
322 		alloc_sz =  IEEE80211_MESHPREQ_BASE_SZ;
323 		ndest = iefrm[IEEE80211_MESHPREQ_TCNT_OFFSET];
324 	}
325 	alloc_sz += ndest * IEEE80211_MESHPREQ_TRGT_SZ;
326 
327 	if(iefrm[1] != (alloc_sz)) {
328 		IEEE80211_DISCARD(vap,
329 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_HWMP,
330 		    wh, NULL, "PREQ (AE=%s) with wrong len",
331 		    iefrm[2] & IEEE80211_MESHPREQ_FLAGS_AE ? "1" : "0");
332 		return (-1);
333 	}
334 	return ndest;
335 }
336 
337 /*
338  * Verify the length of an HWMP PREP and returns 1 on success,
339  * otherwise -1.
340  */
341 static int
342 verify_mesh_prep_len(struct ieee80211vap *vap,
343     const struct ieee80211_frame *wh, const uint8_t *iefrm)
344 {
345 	int alloc_sz = -1;
346 	if (iefrm[2] & IEEE80211_MESHPREP_FLAGS_AE) {
347 		if (iefrm[1] == IEEE80211_MESHPREP_BASE_SZ_AE)
348 			alloc_sz = IEEE80211_MESHPREP_BASE_SZ_AE;
349 	} else if (iefrm[1] == IEEE80211_MESHPREP_BASE_SZ)
350 		alloc_sz = IEEE80211_MESHPREP_BASE_SZ;
351 	if(alloc_sz < 0) {
352 		IEEE80211_DISCARD(vap,
353 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_HWMP,
354 		    wh, NULL, "PREP (AE=%s) with wrong len",
355 		    iefrm[2] & IEEE80211_MESHPREP_FLAGS_AE ? "1" : "0");
356 		return (-1);
357 	}
358 	return (1);
359 }
360 
361 /*
362  * Verify the length of an HWMP PERR and return the number
363  * of destinations >= 1, if verification fails -1 is returned.
364  */
365 static int
366 verify_mesh_perr_len(struct ieee80211vap *vap,
367     const struct ieee80211_frame *wh, const uint8_t *iefrm)
368 {
369 	int alloc_sz = -1;
370 	const uint8_t *iefrm_t = iefrm;
371 	uint8_t ndest = iefrm_t[IEEE80211_MESHPERR_NDEST_OFFSET];
372 	int i;
373 
374 	if(ndest > IEEE80211_MESHPERR_MAXDEST) {
375 		IEEE80211_DISCARD(vap,
376 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_HWMP,
377 		    wh, NULL, "PERR with wrong number of destionat (>19), %u",
378 		    ndest);
379 		return (-1);
380 	}
381 
382 	iefrm_t += IEEE80211_MESHPERR_NDEST_OFFSET + 1; /* flag is next field */
383 	/* We need to check each destionation flag to know size */
384 	for(i = 0; i<ndest; i++) {
385 		if ((*iefrm_t) & IEEE80211_MESHPERR_FLAGS_AE)
386 			iefrm_t += IEEE80211_MESHPERR_DEST_SZ_AE;
387 		else
388 			iefrm_t += IEEE80211_MESHPERR_DEST_SZ;
389 	}
390 
391 	alloc_sz = (iefrm_t - iefrm) - 2; /* action + code */
392 	if(alloc_sz !=  iefrm[1]) {
393 		IEEE80211_DISCARD(vap,
394 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_HWMP,
395 		    wh, NULL, "%s", "PERR with wrong len");
396 		return (-1);
397 	}
398 	return ndest;
399 }
400 
401 static int
402 hwmp_recv_action_meshpath(struct ieee80211_node *ni,
403 	const struct ieee80211_frame *wh,
404 	const uint8_t *frm, const uint8_t *efrm)
405 {
406 	struct ieee80211vap *vap = ni->ni_vap;
407 	struct ieee80211_meshpreq_ie *preq;
408 	struct ieee80211_meshprep_ie *prep;
409 	struct ieee80211_meshperr_ie *perr;
410 	struct ieee80211_meshrann_ie rann;
411 	const uint8_t *iefrm = frm + 2; /* action + code */
412 	const uint8_t *iefrm_t = iefrm; /* temporary pointer */
413 	int ndest = -1;
414 	int found = 0;
415 
416 	while (efrm - iefrm > 1) {
417 		IEEE80211_VERIFY_LENGTH(efrm - iefrm, iefrm[1] + 2, return 0);
418 		switch (*iefrm) {
419 		case IEEE80211_ELEMID_MESHPREQ:
420 		{
421 			int i = 0;
422 
423 			iefrm_t = iefrm;
424 			ndest = verify_mesh_preq_len(vap, wh, iefrm_t);
425 			if (ndest < 0) {
426 				vap->iv_stats.is_rx_mgtdiscard++;
427 				break;
428 			}
429 #if defined(__DragonFly__)
430 			preq = kmalloc(sizeof(*preq) +
431 			    (ndest - 1) * sizeof(*preq->preq_targets),
432 			    M_80211_MESH_PREQ, M_INTWAIT | M_ZERO);
433 #else
434 			preq = IEEE80211_MALLOC(sizeof(*preq) +
435 			    (ndest - 1) * sizeof(*preq->preq_targets),
436 			    M_80211_MESH_PREQ,
437 			    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
438 #endif
439 			KASSERT(preq != NULL, ("preq == NULL"));
440 
441 			preq->preq_ie = *iefrm_t++;
442 			preq->preq_len = *iefrm_t++;
443 			preq->preq_flags = *iefrm_t++;
444 			preq->preq_hopcount = *iefrm_t++;
445 			preq->preq_ttl = *iefrm_t++;
446 			preq->preq_id = le32dec(iefrm_t); iefrm_t += 4;
447 			IEEE80211_ADDR_COPY(preq->preq_origaddr, iefrm_t);
448 			iefrm_t += 6;
449 			preq->preq_origseq = le32dec(iefrm_t); iefrm_t += 4;
450 			/* NB: may have Originator Proxied Address */
451 			if (preq->preq_flags & IEEE80211_MESHPREQ_FLAGS_AE)  {
452 				IEEE80211_ADDR_COPY(
453 				    preq->preq_orig_ext_addr, iefrm_t);
454 				iefrm_t += 6;
455 			}
456 			preq->preq_lifetime = le32dec(iefrm_t); iefrm_t += 4;
457 			preq->preq_metric = le32dec(iefrm_t); iefrm_t += 4;
458 			preq->preq_tcount = *iefrm_t++;
459 
460 			for (i = 0; i < preq->preq_tcount; i++) {
461 				preq->preq_targets[i].target_flags = *iefrm_t++;
462 				IEEE80211_ADDR_COPY(
463 				    preq->preq_targets[i].target_addr, iefrm_t);
464 				iefrm_t += 6;
465 				preq->preq_targets[i].target_seq =
466 				    le32dec(iefrm_t);
467 				iefrm_t += 4;
468 			}
469 
470 			hwmp_recv_preq(vap, ni, wh, preq);
471 			IEEE80211_FREE(preq, M_80211_MESH_PREQ);
472 			found++;
473 			break;
474 		}
475 		case IEEE80211_ELEMID_MESHPREP:
476 		{
477 			iefrm_t = iefrm;
478 			ndest = verify_mesh_prep_len(vap, wh, iefrm_t);
479 			if (ndest < 0) {
480 				vap->iv_stats.is_rx_mgtdiscard++;
481 				break;
482 			}
483 #if defined(__DragonFly__)
484 			prep = kmalloc(sizeof(*prep),
485 			    M_80211_MESH_PREP, M_INTWAIT | M_ZERO);
486 #else
487 			prep = IEEE80211_MALLOC(sizeof(*prep),
488 			    M_80211_MESH_PREP,
489 			    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
490 #endif
491 			KASSERT(prep != NULL, ("prep == NULL"));
492 
493 			prep->prep_ie = *iefrm_t++;
494 			prep->prep_len = *iefrm_t++;
495 			prep->prep_flags = *iefrm_t++;
496 			prep->prep_hopcount = *iefrm_t++;
497 			prep->prep_ttl = *iefrm_t++;
498 			IEEE80211_ADDR_COPY(prep->prep_targetaddr, iefrm_t);
499 			iefrm_t += 6;
500 			prep->prep_targetseq = le32dec(iefrm_t); iefrm_t += 4;
501 			/* NB: May have Target Proxied Address */
502 			if (prep->prep_flags & IEEE80211_MESHPREP_FLAGS_AE)  {
503 				IEEE80211_ADDR_COPY(
504 				    prep->prep_target_ext_addr, iefrm_t);
505 				iefrm_t += 6;
506 			}
507 			prep->prep_lifetime = le32dec(iefrm_t); iefrm_t += 4;
508 			prep->prep_metric = le32dec(iefrm_t); iefrm_t += 4;
509 			IEEE80211_ADDR_COPY(prep->prep_origaddr, iefrm_t);
510 			iefrm_t += 6;
511 			prep->prep_origseq = le32dec(iefrm_t); iefrm_t += 4;
512 
513 			hwmp_recv_prep(vap, ni, wh, prep);
514 			IEEE80211_FREE(prep, M_80211_MESH_PREP);
515 			found++;
516 			break;
517 		}
518 		case IEEE80211_ELEMID_MESHPERR:
519 		{
520 			int i = 0;
521 
522 			iefrm_t = iefrm;
523 			ndest = verify_mesh_perr_len(vap, wh, iefrm_t);
524 			if (ndest < 0) {
525 				vap->iv_stats.is_rx_mgtdiscard++;
526 				break;
527 			}
528 #if defined(__DragonFly__)
529 			perr = kmalloc(sizeof(*perr) +
530 			    (ndest - 1) * sizeof(*perr->perr_dests),
531 			    M_80211_MESH_PERR, M_INTWAIT | M_ZERO);
532 #else
533 			perr = IEEE80211_MALLOC(sizeof(*perr) +
534 			    (ndest - 1) * sizeof(*perr->perr_dests),
535 			    M_80211_MESH_PERR,
536 			    IEEE80211_M_NOWAIT | IEEE80211_M_ZERO);
537 #endif
538 			KASSERT(perr != NULL, ("perr == NULL"));
539 
540 			perr->perr_ie = *iefrm_t++;
541 			perr->perr_len = *iefrm_t++;
542 			perr->perr_ttl = *iefrm_t++;
543 			perr->perr_ndests = *iefrm_t++;
544 
545 			for (i = 0; i<perr->perr_ndests; i++) {
546 				perr->perr_dests[i].dest_flags = *iefrm_t++;
547 				IEEE80211_ADDR_COPY(
548 				    perr->perr_dests[i].dest_addr, iefrm_t);
549 				iefrm_t += 6;
550 				perr->perr_dests[i].dest_seq = le32dec(iefrm_t);
551 				iefrm_t += 4;
552 				/* NB: May have Target Proxied Address */
553 				if (perr->perr_dests[i].dest_flags &
554 				    IEEE80211_MESHPERR_FLAGS_AE) {
555 					IEEE80211_ADDR_COPY(
556 					    perr->perr_dests[i].dest_ext_addr,
557 					    iefrm_t);
558 					iefrm_t += 6;
559 				}
560 				perr->perr_dests[i].dest_rcode =
561 				    le16dec(iefrm_t);
562 				iefrm_t += 2;
563 			}
564 
565 			hwmp_recv_perr(vap, ni, wh, perr);
566 			IEEE80211_FREE(perr, M_80211_MESH_PERR);
567 			found++;
568 			break;
569 		}
570 		case IEEE80211_ELEMID_MESHRANN:
571 		{
572 			const struct ieee80211_meshrann_ie *mrann =
573 			    (const struct ieee80211_meshrann_ie *) iefrm;
574 			if (mrann->rann_len !=
575 			    sizeof(struct ieee80211_meshrann_ie) - 2) {
576 				IEEE80211_DISCARD(vap,
577 				    IEEE80211_MSG_ACTION | IEEE80211_MSG_HWMP,
578 				    wh, NULL, "%s", "RAN with wrong len");
579 				    vap->iv_stats.is_rx_mgtdiscard++;
580 				return 1;
581 			}
582 			memcpy(&rann, mrann, sizeof(rann));
583 			rann.rann_seq = le32dec(&mrann->rann_seq);
584 			rann.rann_interval = le32dec(&mrann->rann_interval);
585 			rann.rann_metric = le32dec(&mrann->rann_metric);
586 			hwmp_recv_rann(vap, ni, wh, &rann);
587 			found++;
588 			break;
589 		}
590 		}
591 		iefrm += iefrm[1] + 2;
592 	}
593 	if (!found) {
594 		IEEE80211_DISCARD(vap,
595 		    IEEE80211_MSG_ACTION | IEEE80211_MSG_HWMP,
596 		    wh, NULL, "%s", "PATH SEL action without IE");
597 		vap->iv_stats.is_rx_mgtdiscard++;
598 	}
599 	return 0;
600 }
601 
602 static int
603 hwmp_send_action(struct ieee80211vap *vap,
604     const uint8_t da[IEEE80211_ADDR_LEN],
605     uint8_t *ie, size_t len)
606 {
607 	struct ieee80211_node *ni;
608 	struct ieee80211com *ic;
609 	struct ieee80211_bpf_params params;
610 	struct mbuf *m;
611 	uint8_t *frm;
612 	int ret;
613 
614 	if (IEEE80211_IS_MULTICAST(da)) {
615 		ni = ieee80211_ref_node(vap->iv_bss);
616 #ifdef IEEE80211_DEBUG_REFCNT
617 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
618 		"ieee80211_ref_node (%s:%u) %p<%s> refcnt %d\n",
619 		__func__, __LINE__,
620 		ni, ether_sprintf(ni->ni_macaddr),
621 		ieee80211_node_refcnt(ni)+1);
622 #endif
623 		ieee80211_ref_node(ni);
624 	}
625 	else
626 		ni = ieee80211_mesh_find_txnode(vap, da);
627 
628 	if (vap->iv_state == IEEE80211_S_CAC) {
629 		IEEE80211_NOTE(vap, IEEE80211_MSG_OUTPUT, ni,
630 		    "block %s frame in CAC state", "HWMP action");
631 		vap->iv_stats.is_tx_badstate++;
632 		return EIO;	/* XXX */
633 	}
634 
635 	KASSERT(ni != NULL, ("null node"));
636 	ic = ni->ni_ic;
637 
638 	m = ieee80211_getmgtframe(&frm,
639 	    ic->ic_headroom + sizeof(struct ieee80211_frame),
640 	    sizeof(struct ieee80211_action) + len
641 	);
642 	if (m == NULL) {
643 		ieee80211_free_node(ni);
644 		vap->iv_stats.is_tx_nobuf++;
645 		return ENOMEM;
646 	}
647 	*frm++ = IEEE80211_ACTION_CAT_MESH;
648 	*frm++ = IEEE80211_ACTION_MESH_HWMP;
649 	switch (*ie) {
650 	case IEEE80211_ELEMID_MESHPREQ:
651 		frm = hwmp_add_meshpreq(frm,
652 		    (struct ieee80211_meshpreq_ie *)ie);
653 		break;
654 	case IEEE80211_ELEMID_MESHPREP:
655 		frm = hwmp_add_meshprep(frm,
656 		    (struct ieee80211_meshprep_ie *)ie);
657 		break;
658 	case IEEE80211_ELEMID_MESHPERR:
659 		frm = hwmp_add_meshperr(frm,
660 		    (struct ieee80211_meshperr_ie *)ie);
661 		break;
662 	case IEEE80211_ELEMID_MESHRANN:
663 		frm = hwmp_add_meshrann(frm,
664 		    (struct ieee80211_meshrann_ie *)ie);
665 		break;
666 	}
667 
668 	m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
669 	M_PREPEND(m, sizeof(struct ieee80211_frame), M_NOWAIT);
670 	if (m == NULL) {
671 		ieee80211_free_node(ni);
672 		vap->iv_stats.is_tx_nobuf++;
673 		return ENOMEM;
674 	}
675 
676 	IEEE80211_TX_LOCK(ic);
677 
678 	ieee80211_send_setup(ni, m,
679 	    IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_ACTION,
680 	    IEEE80211_NONQOS_TID, vap->iv_myaddr, da, vap->iv_myaddr);
681 
682 	m->m_flags |= M_ENCAP;		/* mark encapsulated */
683 	IEEE80211_NODE_STAT(ni, tx_mgmt);
684 
685 	memset(&params, 0, sizeof(params));
686 	params.ibp_pri = WME_AC_VO;
687 	params.ibp_rate0 = ni->ni_txparms->mgmtrate;
688 	if (IEEE80211_IS_MULTICAST(da))
689 		params.ibp_try0 = 1;
690 	else
691 		params.ibp_try0 = ni->ni_txparms->maxretry;
692 	params.ibp_power = ni->ni_txpower;
693 	ret = ieee80211_raw_output(vap, ni, m, &params);
694 	IEEE80211_TX_UNLOCK(ic);
695 	return (ret);
696 }
697 
698 #define ADDSHORT(frm, v) do {		\
699 	le16enc(frm, v);		\
700 	frm += 2;			\
701 } while (0)
702 #define ADDWORD(frm, v) do {		\
703 	le32enc(frm, v);		\
704 	frm += 4;			\
705 } while (0)
706 /*
707  * Add a Mesh Path Request IE to a frame.
708  */
709 #define	PREQ_TFLAGS(n)	preq->preq_targets[n].target_flags
710 #define	PREQ_TADDR(n)	preq->preq_targets[n].target_addr
711 #define	PREQ_TSEQ(n)	preq->preq_targets[n].target_seq
712 static uint8_t *
713 hwmp_add_meshpreq(uint8_t *frm, const struct ieee80211_meshpreq_ie *preq)
714 {
715 	int i;
716 
717 	*frm++ = IEEE80211_ELEMID_MESHPREQ;
718 	*frm++ = preq->preq_len;	/* len already calculated */
719 	*frm++ = preq->preq_flags;
720 	*frm++ = preq->preq_hopcount;
721 	*frm++ = preq->preq_ttl;
722 	ADDWORD(frm, preq->preq_id);
723 	IEEE80211_ADDR_COPY(frm, preq->preq_origaddr); frm += 6;
724 	ADDWORD(frm, preq->preq_origseq);
725 	if (preq->preq_flags & IEEE80211_MESHPREQ_FLAGS_AE) {
726 		IEEE80211_ADDR_COPY(frm, preq->preq_orig_ext_addr);
727 		frm += 6;
728 	}
729 	ADDWORD(frm, preq->preq_lifetime);
730 	ADDWORD(frm, preq->preq_metric);
731 	*frm++ = preq->preq_tcount;
732 	for (i = 0; i < preq->preq_tcount; i++) {
733 		*frm++ = PREQ_TFLAGS(i);
734 		IEEE80211_ADDR_COPY(frm, PREQ_TADDR(i));
735 		frm += 6;
736 		ADDWORD(frm, PREQ_TSEQ(i));
737 	}
738 	return frm;
739 }
740 #undef	PREQ_TFLAGS
741 #undef	PREQ_TADDR
742 #undef	PREQ_TSEQ
743 
744 /*
745  * Add a Mesh Path Reply IE to a frame.
746  */
747 static uint8_t *
748 hwmp_add_meshprep(uint8_t *frm, const struct ieee80211_meshprep_ie *prep)
749 {
750 	*frm++ = IEEE80211_ELEMID_MESHPREP;
751 	*frm++ = prep->prep_len;	/* len already calculated */
752 	*frm++ = prep->prep_flags;
753 	*frm++ = prep->prep_hopcount;
754 	*frm++ = prep->prep_ttl;
755 	IEEE80211_ADDR_COPY(frm, prep->prep_targetaddr); frm += 6;
756 	ADDWORD(frm, prep->prep_targetseq);
757 	if (prep->prep_flags & IEEE80211_MESHPREP_FLAGS_AE) {
758 		IEEE80211_ADDR_COPY(frm, prep->prep_target_ext_addr);
759 		frm += 6;
760 	}
761 	ADDWORD(frm, prep->prep_lifetime);
762 	ADDWORD(frm, prep->prep_metric);
763 	IEEE80211_ADDR_COPY(frm, prep->prep_origaddr); frm += 6;
764 	ADDWORD(frm, prep->prep_origseq);
765 	return frm;
766 }
767 
768 /*
769  * Add a Mesh Path Error IE to a frame.
770  */
771 #define	PERR_DFLAGS(n)	perr->perr_dests[n].dest_flags
772 #define	PERR_DADDR(n)	perr->perr_dests[n].dest_addr
773 #define	PERR_DSEQ(n)	perr->perr_dests[n].dest_seq
774 #define	PERR_EXTADDR(n)	perr->perr_dests[n].dest_ext_addr
775 #define	PERR_DRCODE(n)	perr->perr_dests[n].dest_rcode
776 static uint8_t *
777 hwmp_add_meshperr(uint8_t *frm, const struct ieee80211_meshperr_ie *perr)
778 {
779 	int i;
780 
781 	*frm++ = IEEE80211_ELEMID_MESHPERR;
782 	*frm++ = perr->perr_len;	/* len already calculated */
783 	*frm++ = perr->perr_ttl;
784 	*frm++ = perr->perr_ndests;
785 	for (i = 0; i < perr->perr_ndests; i++) {
786 		*frm++ = PERR_DFLAGS(i);
787 		IEEE80211_ADDR_COPY(frm, PERR_DADDR(i));
788 		frm += 6;
789 		ADDWORD(frm, PERR_DSEQ(i));
790 		if (PERR_DFLAGS(i) & IEEE80211_MESHPERR_FLAGS_AE) {
791 			IEEE80211_ADDR_COPY(frm, PERR_EXTADDR(i));
792 			frm += 6;
793 		}
794 		ADDSHORT(frm, PERR_DRCODE(i));
795 	}
796 	return frm;
797 }
798 #undef	PERR_DFLAGS
799 #undef	PERR_DADDR
800 #undef	PERR_DSEQ
801 #undef	PERR_EXTADDR
802 #undef	PERR_DRCODE
803 
804 /*
805  * Add a Root Annoucement IE to a frame.
806  */
807 static uint8_t *
808 hwmp_add_meshrann(uint8_t *frm, const struct ieee80211_meshrann_ie *rann)
809 {
810 	*frm++ = IEEE80211_ELEMID_MESHRANN;
811 	*frm++ = rann->rann_len;
812 	*frm++ = rann->rann_flags;
813 	*frm++ = rann->rann_hopcount;
814 	*frm++ = rann->rann_ttl;
815 	IEEE80211_ADDR_COPY(frm, rann->rann_addr); frm += 6;
816 	ADDWORD(frm, rann->rann_seq);
817 	ADDWORD(frm, rann->rann_interval);
818 	ADDWORD(frm, rann->rann_metric);
819 	return frm;
820 }
821 
822 static void
823 hwmp_rootmode_setup(struct ieee80211vap *vap)
824 {
825 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
826 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
827 
828 	switch (hs->hs_rootmode) {
829 	case IEEE80211_HWMP_ROOTMODE_DISABLED:
830 		callout_drain(&hs->hs_roottimer);
831 		ms->ms_flags &= ~IEEE80211_MESHFLAGS_ROOT;
832 		break;
833 	case IEEE80211_HWMP_ROOTMODE_NORMAL:
834 	case IEEE80211_HWMP_ROOTMODE_PROACTIVE:
835 		callout_reset(&hs->hs_roottimer, ieee80211_hwmp_rootint,
836 		    hwmp_rootmode_cb, vap);
837 		ms->ms_flags |= IEEE80211_MESHFLAGS_ROOT;
838 		break;
839 	case IEEE80211_HWMP_ROOTMODE_RANN:
840 		callout_reset(&hs->hs_roottimer, ieee80211_hwmp_rannint,
841 		    hwmp_rootmode_rann_cb, vap);
842 		ms->ms_flags |= IEEE80211_MESHFLAGS_ROOT;
843 		break;
844 	}
845 }
846 
847 /*
848  * Send a broadcast Path Request to find all nodes on the mesh. We are
849  * called when the vap is configured as a HWMP root node.
850  */
851 #define	PREQ_TFLAGS(n)	preq.preq_targets[n].target_flags
852 #define	PREQ_TADDR(n)	preq.preq_targets[n].target_addr
853 #define	PREQ_TSEQ(n)	preq.preq_targets[n].target_seq
854 static void
855 hwmp_rootmode_cb(void *arg)
856 {
857 	struct ieee80211vap *vap = (struct ieee80211vap *)arg;
858 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
859 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
860 	struct ieee80211_meshpreq_ie preq;
861 
862 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, vap->iv_bss,
863 	    "%s", "send broadcast PREQ");
864 
865 	preq.preq_flags = 0;
866 	if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE)
867 		preq.preq_flags |= IEEE80211_MESHPREQ_FLAGS_GATE;
868 	if (hs->hs_rootmode == IEEE80211_HWMP_ROOTMODE_PROACTIVE)
869 		preq.preq_flags |= IEEE80211_MESHPREQ_FLAGS_PP;
870 	preq.preq_hopcount = 0;
871 	preq.preq_ttl = ms->ms_ttl;
872 	preq.preq_id = ++hs->hs_preqid;
873 	IEEE80211_ADDR_COPY(preq.preq_origaddr, vap->iv_myaddr);
874 	preq.preq_origseq = ++hs->hs_seq;
875 	preq.preq_lifetime = ticks_to_msecs(ieee80211_hwmp_roottimeout);
876 	preq.preq_metric = IEEE80211_MESHLMETRIC_INITIALVAL;
877 	preq.preq_tcount = 1;
878 	IEEE80211_ADDR_COPY(PREQ_TADDR(0), broadcastaddr);
879 	PREQ_TFLAGS(0) = IEEE80211_MESHPREQ_TFLAGS_TO |
880 	    IEEE80211_MESHPREQ_TFLAGS_USN;
881 	PREQ_TSEQ(0) = 0;
882 	vap->iv_stats.is_hwmp_rootreqs++;
883 	/* NB: we enforce rate check ourself */
884 	hwmp_send_preq(vap, broadcastaddr, &preq, NULL, NULL);
885 	hwmp_rootmode_setup(vap);
886 }
887 #undef	PREQ_TFLAGS
888 #undef	PREQ_TADDR
889 #undef	PREQ_TSEQ
890 
891 /*
892  * Send a Root Annoucement (RANN) to find all the nodes on the mesh. We are
893  * called when the vap is configured as a HWMP RANN root node.
894  */
895 static void
896 hwmp_rootmode_rann_cb(void *arg)
897 {
898 	struct ieee80211vap *vap = (struct ieee80211vap *)arg;
899 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
900 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
901 	struct ieee80211_meshrann_ie rann;
902 
903 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, vap->iv_bss,
904 	    "%s", "send broadcast RANN");
905 
906 	rann.rann_flags = 0;
907 	if (ms->ms_flags & IEEE80211_MESHFLAGS_GATE)
908 		rann.rann_flags |= IEEE80211_MESHFLAGS_GATE;
909 	rann.rann_hopcount = 0;
910 	rann.rann_ttl = ms->ms_ttl;
911 	IEEE80211_ADDR_COPY(rann.rann_addr, vap->iv_myaddr);
912 	rann.rann_seq = ++hs->hs_seq;
913 	rann.rann_interval = ieee80211_hwmp_rannint;
914 	rann.rann_metric = IEEE80211_MESHLMETRIC_INITIALVAL;
915 
916 	vap->iv_stats.is_hwmp_rootrann++;
917 	hwmp_send_rann(vap, broadcastaddr, &rann);
918 	hwmp_rootmode_setup(vap);
919 }
920 
921 /*
922  * Update forwarding information to TA if metric improves.
923  */
924 static void
925 hwmp_update_transmitter(struct ieee80211vap *vap, struct ieee80211_node *ni,
926     const char *hwmp_frame)
927 {
928 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
929 	struct ieee80211_mesh_route *rttran = NULL;	/* Transmitter */
930 	int metric = 0;
931 
932 	rttran = ieee80211_mesh_rt_find(vap, ni->ni_macaddr);
933 	if (rttran == NULL) {
934 		rttran = ieee80211_mesh_rt_add(vap, ni->ni_macaddr);
935 		if (rttran == NULL) {
936 #if defined(__DragonFly__)
937 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
938 			    "unable to add path to transmitter %s of %s",
939 			    ether_sprintf(ni->ni_macaddr), hwmp_frame);
940 #else
941 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
942 			    "unable to add path to transmitter %6D of %s",
943 			    ni->ni_macaddr, ":", hwmp_frame);
944 #endif
945 			vap->iv_stats.is_mesh_rtaddfailed++;
946 			return;
947 		}
948 	}
949 	metric = ms->ms_pmetric->mpm_metric(ni);
950 	if (!(rttran->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) ||
951 	    rttran->rt_metric > metric)
952 	{
953 #if defined(__DragonFly__)
954 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
955 		    "%s path to transmitter %s of %s, metric %d:%d",
956 		    rttran->rt_flags & IEEE80211_MESHRT_FLAGS_VALID ?
957 		    "prefer" : "update", ether_sprintf(ni->ni_macaddr),
958 		    hwmp_frame,
959 		    rttran->rt_metric, metric);
960 #else
961 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
962 		    "%s path to transmiter %6D of %s, metric %d:%d",
963 		    rttran->rt_flags & IEEE80211_MESHRT_FLAGS_VALID ?
964 		    "prefer" : "update", ni->ni_macaddr, ":", hwmp_frame,
965 		    rttran->rt_metric, metric);
966 #endif
967 		IEEE80211_ADDR_COPY(rttran->rt_nexthop, ni->ni_macaddr);
968 		rttran->rt_metric = metric;
969 		rttran->rt_nhops  = 1;
970 		ieee80211_mesh_rt_update(rttran, ms->ms_ppath->mpp_inact);
971 		rttran->rt_flags = IEEE80211_MESHRT_FLAGS_VALID;
972 	}
973 }
974 
975 #define	PREQ_TFLAGS(n)	preq->preq_targets[n].target_flags
976 #define	PREQ_TADDR(n)	preq->preq_targets[n].target_addr
977 #define	PREQ_TSEQ(n)	preq->preq_targets[n].target_seq
978 static void
979 hwmp_recv_preq(struct ieee80211vap *vap, struct ieee80211_node *ni,
980     const struct ieee80211_frame *wh, const struct ieee80211_meshpreq_ie *preq)
981 {
982 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
983 	struct ieee80211_mesh_route *rtorig = NULL;
984 	struct ieee80211_mesh_route *rtorig_ext = NULL;
985 	struct ieee80211_mesh_route *rttarg = NULL;
986 	struct ieee80211_hwmp_route *hrorig = NULL;
987 	struct ieee80211_hwmp_route *hrtarg = NULL;
988 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
989 	struct ieee80211_meshprep_ie prep;
990 	ieee80211_hwmp_seq preqid;	/* last seen preqid for orig */
991 	uint32_t metric = 0;
992 
993 	/*
994 	 * Ignore PREQs from us. Could happen because someone forward it
995 	 * back to us.
996 	 */
997 	if (IEEE80211_ADDR_EQ(vap->iv_myaddr, preq->preq_origaddr))
998 		return;
999 
1000 #if defined(__DragonFly__)
1001 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1002 	    "received PREQ, orig %s, targ(0) %s",
1003 	    ether_sprintf(preq->preq_origaddr),
1004 	    ether_sprintf(PREQ_TADDR(0)));
1005 #else
1006 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1007 	"received PREQ, orig %6D, targ(0) %6D", preq->preq_origaddr, ":",
1008 	PREQ_TADDR(0), ":");
1009 #endif
1010 
1011 	/*
1012 	 * Acceptance criteria: (if the PREQ is not for us or not broadcast,
1013 	 * or an external mac address not proxied by us),
1014 	 * AND forwarding is disabled, discard this PREQ.
1015 	 */
1016 	rttarg = ieee80211_mesh_rt_find(vap, PREQ_TADDR(0));
1017 	if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD) &&
1018 	    (!IEEE80211_ADDR_EQ(vap->iv_myaddr, PREQ_TADDR(0)) ||
1019 	    !IEEE80211_IS_MULTICAST(PREQ_TADDR(0)) ||
1020 	    (rttarg != NULL &&
1021 	    rttarg->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY &&
1022 	    IEEE80211_ADDR_EQ(vap->iv_myaddr, rttarg->rt_mesh_gate)))) {
1023 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_HWMP,
1024 		    preq->preq_origaddr, NULL, "%s", "not accepting PREQ");
1025 		return;
1026 	}
1027 	/*
1028 	 * Acceptance criteria: if unicast addressed
1029 	 * AND no valid forwarding for Target of PREQ, discard this PREQ.
1030 	 */
1031 	if(rttarg != NULL)
1032 		hrtarg = IEEE80211_MESH_ROUTE_PRIV(rttarg,
1033 		    struct ieee80211_hwmp_route);
1034 	/* Address mode: ucast */
1035 	if(preq->preq_flags & IEEE80211_MESHPREQ_FLAGS_AM &&
1036 	    rttarg == NULL &&
1037 	    !IEEE80211_ADDR_EQ(vap->iv_myaddr, PREQ_TADDR(0))) {
1038 #if defined(__DragonFly__)
1039 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_HWMP,
1040 		    preq->preq_origaddr, NULL,
1041 		    "unicast addressed PREQ of unknown target %s",
1042 		    ether_sprintf(PREQ_TADDR(0)));
1043 #else
1044 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_HWMP,
1045 		    preq->preq_origaddr, NULL,
1046 		    "unicast addressed PREQ of unknown target %6D",
1047 		    PREQ_TADDR(0), ":");
1048 #endif
1049 		return;
1050 	}
1051 
1052 	/* PREQ ACCEPTED */
1053 
1054 	rtorig = ieee80211_mesh_rt_find(vap, preq->preq_origaddr);
1055 	if (rtorig == NULL) {
1056 		rtorig = ieee80211_mesh_rt_add(vap, preq->preq_origaddr);
1057 		if (rtorig == NULL) {
1058 #if defined(__DragonFly__)
1059 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1060 			    "unable to add orig path to %s",
1061 			    ether_sprintf(preq->preq_origaddr));
1062 #else
1063 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1064 			"unable to add orig path to %6D",
1065 			preq->preq_origaddr, ":");
1066 #endif
1067 			vap->iv_stats.is_mesh_rtaddfailed++;
1068 			return;
1069 		}
1070 #if defined(__DragonFly__)
1071 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1072 		    "adding originator %s",
1073 		    ether_sprintf(preq->preq_origaddr));
1074 #else
1075 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1076 		    "adding originator %6D", preq->preq_origaddr, ":");
1077 #endif
1078 	}
1079 	hrorig = IEEE80211_MESH_ROUTE_PRIV(rtorig, struct ieee80211_hwmp_route);
1080 
1081 	/* record last seen preqid */
1082 	preqid = hrorig->hr_preqid;
1083 	hrorig->hr_preqid = HWMP_SEQ_MAX(hrorig->hr_preqid, preq->preq_id);
1084 
1085 	/* Data creation and update of forwarding information
1086 	 * according to Table 11C-8 for originator mesh STA.
1087 	 */
1088 	metric = preq->preq_metric + ms->ms_pmetric->mpm_metric(ni);
1089 	if (HWMP_SEQ_GT(preq->preq_origseq, hrorig->hr_seq) ||
1090 	    (HWMP_SEQ_EQ(preq->preq_origseq, hrorig->hr_seq) &&
1091 	    metric < rtorig->rt_metric)) {
1092 		hrorig->hr_seq = preq->preq_origseq;
1093 		IEEE80211_ADDR_COPY(rtorig->rt_nexthop, wh->i_addr2);
1094 		rtorig->rt_metric = metric;
1095 		rtorig->rt_nhops  = preq->preq_hopcount + 1;
1096 		ieee80211_mesh_rt_update(rtorig, preq->preq_lifetime);
1097 		/* Path to orig is valid now.
1098 		 * NB: we know it can't be Proxy, and if it is GATE
1099 		 * it will be marked below.
1100 		 */
1101 		rtorig->rt_flags = IEEE80211_MESHRT_FLAGS_VALID;
1102 	} else if ((hrtarg != NULL &&
1103 	    !HWMP_SEQ_EQ(hrtarg->hr_seq, PREQ_TSEQ(0))) ||
1104 	    (rtorig->rt_flags & IEEE80211_MESHRT_FLAGS_VALID &&
1105 	    preqid >= preq->preq_id)) {
1106 #if defined(__DragonFly__)
1107 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1108 		    "discard PREQ from %s, old seqno %u <= %u,"
1109 		    " or old preqid %u < %u",
1110 		    ether_sprintf(preq->preq_origaddr),
1111 		    preq->preq_origseq, hrorig->hr_seq,
1112 		    preq->preq_id, preqid);
1113 #else
1114 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1115 		    "discard PREQ from %6D, old seqno %u <= %u,"
1116 		    " or old preqid %u < %u",
1117 		    preq->preq_origaddr, ":",
1118 		    preq->preq_origseq, hrorig->hr_seq,
1119 		    preq->preq_id, preqid);
1120 #endif
1121 		return;
1122 	}
1123 
1124 	/* Update forwarding information to TA if metric improves. */
1125 	hwmp_update_transmitter(vap, ni, "PREQ");
1126 
1127 	/*
1128 	 * Check if the PREQ is addressed to us.
1129 	 * or a Proxy currently gated by us.
1130 	 */
1131 	if (IEEE80211_ADDR_EQ(vap->iv_myaddr, PREQ_TADDR(0)) ||
1132 	    (ms->ms_flags & IEEE80211_MESHFLAGS_GATE &&
1133 	    rttarg != NULL &&
1134 	    IEEE80211_ADDR_EQ(vap->iv_myaddr, rttarg->rt_mesh_gate) &&
1135 	    rttarg->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY &&
1136 	    rttarg->rt_flags & IEEE80211_MESHRT_FLAGS_VALID)) {
1137 		/*
1138 		 * When we are the target we shall update our own HWMP seq
1139 		 * number with max of (current and preq->seq) + 1
1140 		 */
1141 		hs->hs_seq = HWMP_SEQ_MAX(hs->hs_seq, PREQ_TSEQ(0)) + 1;
1142 
1143 		prep.prep_flags = 0;
1144 		prep.prep_hopcount = 0;
1145 		prep.prep_metric = IEEE80211_MESHLMETRIC_INITIALVAL;
1146 		IEEE80211_ADDR_COPY(prep.prep_targetaddr, vap->iv_myaddr);
1147 		if (rttarg != NULL && /* if NULL it means we are the target */
1148 		    rttarg->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY) {
1149 #if defined(__DragonFly__)
1150 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1151 			    "reply for proxy %s",
1152 			    ether_sprintf(rttarg->rt_dest));
1153 #else
1154 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1155 			    "reply for proxy %6D", rttarg->rt_dest, ":");
1156 #endif
1157 			prep.prep_flags |= IEEE80211_MESHPREP_FLAGS_AE;
1158 			IEEE80211_ADDR_COPY(prep.prep_target_ext_addr,
1159 			    rttarg->rt_dest);
1160 			/* update proxy seqno to HWMP seqno */
1161 			rttarg->rt_ext_seq = hs->hs_seq;
1162 			prep.prep_hopcount = rttarg->rt_nhops;
1163 			prep.prep_metric = rttarg->rt_metric;
1164 			IEEE80211_ADDR_COPY(prep.prep_targetaddr, rttarg->rt_mesh_gate);
1165 		}
1166 		/*
1167 		 * Build and send a PREP frame.
1168 		 */
1169 		prep.prep_ttl = ms->ms_ttl;
1170 		prep.prep_targetseq = hs->hs_seq;
1171 		prep.prep_lifetime = preq->preq_lifetime;
1172 		IEEE80211_ADDR_COPY(prep.prep_origaddr, preq->preq_origaddr);
1173 		prep.prep_origseq = preq->preq_origseq;
1174 
1175 #if defined(__DragonFly__)
1176 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1177 		    "reply to %s", ether_sprintf(preq->preq_origaddr));
1178 #else
1179 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1180 		"reply to %6D", preq->preq_origaddr, ":");
1181 #endif
1182 		hwmp_send_prep(vap, wh->i_addr2, &prep);
1183 		return;
1184 	}
1185 	/* we may update our proxy information for the orig external */
1186 	else if (preq->preq_flags & IEEE80211_MESHPREQ_FLAGS_AE) {
1187 		rtorig_ext =
1188 		    ieee80211_mesh_rt_find(vap, preq->preq_orig_ext_addr);
1189 		if (rtorig_ext == NULL) {
1190 			rtorig_ext = ieee80211_mesh_rt_add(vap,
1191 			    preq->preq_orig_ext_addr);
1192 			if (rtorig_ext == NULL) {
1193 #if defined(__DragonFly__)
1194 				IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1195 				    "unable to add orig ext proxy to %s",
1196 				    ether_sprintf(preq->preq_orig_ext_addr));
1197 #else
1198 				IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1199 				    "unable to add orig ext proxy to %6D",
1200 				    preq->preq_orig_ext_addr, ":");
1201 #endif
1202 				vap->iv_stats.is_mesh_rtaddfailed++;
1203 				return;
1204 			}
1205 			IEEE80211_ADDR_COPY(rtorig_ext->rt_mesh_gate,
1206 			    preq->preq_origaddr);
1207 		}
1208 		rtorig_ext->rt_ext_seq = preq->preq_origseq;
1209 		ieee80211_mesh_rt_update(rtorig_ext, preq->preq_lifetime);
1210 	}
1211 	/*
1212 	 * Proactive PREQ: reply with a proactive PREP to the
1213 	 * root STA if requested.
1214 	 */
1215 	if (IEEE80211_ADDR_EQ(PREQ_TADDR(0), broadcastaddr) &&
1216 	    (PREQ_TFLAGS(0) & IEEE80211_MESHPREQ_TFLAGS_TO)) {
1217 #if defined(__DragonFly__)
1218 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1219 		    "root mesh station @ %s",
1220 		    ether_sprintf(preq->preq_origaddr));
1221 #else
1222 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1223 		    "root mesh station @ %6D", preq->preq_origaddr, ":");
1224 #endif
1225 
1226 		/* Check if root is a mesh gate, mark it */
1227 		if (preq->preq_flags & IEEE80211_MESHPREQ_FLAGS_GATE) {
1228 			struct ieee80211_mesh_gate_route *gr;
1229 
1230 			rtorig->rt_flags |= IEEE80211_MESHRT_FLAGS_GATE;
1231 			gr = ieee80211_mesh_mark_gate(vap, preq->preq_origaddr,
1232 			    rtorig);
1233 			gr->gr_lastseq = 0; /* NOT GANN */
1234 		}
1235 
1236 		/*
1237 		 * Reply with a PREP if we don't have a path to the root
1238 		 * or if the root sent us a proactive PREQ.
1239 		 */
1240 		if ((rtorig->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 ||
1241 		    (preq->preq_flags & IEEE80211_MESHPREQ_FLAGS_PP)) {
1242 			prep.prep_flags = 0;
1243 			prep.prep_hopcount = 0;
1244 			prep.prep_ttl = ms->ms_ttl;
1245 			IEEE80211_ADDR_COPY(prep.prep_origaddr,
1246 			    preq->preq_origaddr);
1247 			prep.prep_origseq = preq->preq_origseq;
1248 			prep.prep_lifetime = preq->preq_lifetime;
1249 			prep.prep_metric = IEEE80211_MESHLMETRIC_INITIALVAL;
1250 			IEEE80211_ADDR_COPY(prep.prep_targetaddr,
1251 			    vap->iv_myaddr);
1252 			prep.prep_targetseq = ++hs->hs_seq;
1253 			hwmp_send_prep(vap, rtorig->rt_nexthop, &prep);
1254 		}
1255 	}
1256 
1257 	/*
1258 	 * Forwarding and Intermediate reply for PREQs with 1 target.
1259 	 */
1260 	if ((preq->preq_tcount == 1) && (preq->preq_ttl > 1) &&
1261 	    (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
1262 		struct ieee80211_meshpreq_ie ppreq; /* propagated PREQ */
1263 
1264 		memcpy(&ppreq, preq, sizeof(ppreq));
1265 
1266 		/*
1267 		 * We have a valid route to this node.
1268 		 * NB: if target is proxy dont reply.
1269 		 */
1270 		if (rttarg != NULL &&
1271 		    rttarg->rt_flags & IEEE80211_MESHRT_FLAGS_VALID &&
1272 		    !(rttarg->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY)) {
1273 			/*
1274 			 * Check if we can send an intermediate Path Reply,
1275 			 * i.e., Target Only bit is not set and target is not
1276 			 * the MAC broadcast address.
1277 			 */
1278 			if (!(PREQ_TFLAGS(0) & IEEE80211_MESHPREQ_TFLAGS_TO) &&
1279 			    !IEEE80211_ADDR_EQ(PREQ_TADDR(0), broadcastaddr)) {
1280 				struct ieee80211_meshprep_ie prep;
1281 
1282 #if defined(__DragonFly__)
1283 				IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1284 				    "intermediate reply for PREQ from %s",
1285 				    ether_sprintf(preq->preq_origaddr));
1286 #else
1287 				IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1288 				    "intermediate reply for PREQ from %6D",
1289 				    preq->preq_origaddr, ":");
1290 #endif
1291 				prep.prep_flags = 0;
1292 				prep.prep_hopcount = rttarg->rt_nhops;
1293 				prep.prep_ttl = ms->ms_ttl;
1294 				IEEE80211_ADDR_COPY(&prep.prep_targetaddr,
1295 				    PREQ_TADDR(0));
1296 				prep.prep_targetseq = hrtarg->hr_seq;
1297 				prep.prep_lifetime = preq->preq_lifetime;
1298 				prep.prep_metric =rttarg->rt_metric;
1299 				IEEE80211_ADDR_COPY(&prep.prep_origaddr,
1300 				    preq->preq_origaddr);
1301 				prep.prep_origseq = hrorig->hr_seq;
1302 				hwmp_send_prep(vap, rtorig->rt_nexthop, &prep);
1303 
1304 				/*
1305 				 * Set TO and unset RF bits because we have
1306 				 * sent a PREP.
1307 				 */
1308 				ppreq.preq_targets[0].target_flags |=
1309 				    IEEE80211_MESHPREQ_TFLAGS_TO;
1310 			}
1311 		}
1312 
1313 #if defined(__DragonFly__)
1314 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1315 		    "forward PREQ from %s",
1316 		    ether_sprintf(preq->preq_origaddr));
1317 #else
1318 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1319 		    "forward PREQ from %6D",
1320 		    preq->preq_origaddr, ":");
1321 #endif
1322 		ppreq.preq_hopcount += 1;
1323 		ppreq.preq_ttl -= 1;
1324 		ppreq.preq_metric += ms->ms_pmetric->mpm_metric(ni);
1325 
1326 		/* don't do PREQ ratecheck when we propagate */
1327 		hwmp_send_preq(vap, broadcastaddr, &ppreq, NULL, NULL);
1328 	}
1329 }
1330 #undef	PREQ_TFLAGS
1331 #undef	PREQ_TADDR
1332 #undef	PREQ_TSEQ
1333 
1334 static int
1335 hwmp_send_preq(struct ieee80211vap *vap,
1336     const uint8_t da[IEEE80211_ADDR_LEN],
1337     struct ieee80211_meshpreq_ie *preq,
1338     struct timeval *last, struct timeval *minint)
1339 {
1340 
1341 	/*
1342 	 * Enforce PREQ interval.
1343 	 * NB: Proactive ROOT PREQs rate is handled by cb task.
1344 	 */
1345 	if (last != NULL && minint != NULL) {
1346 		if (ratecheck(last, minint) == 0)
1347 			return EALREADY; /* XXX: we should postpone */
1348 		getmicrouptime(last);
1349 	}
1350 
1351 	/*
1352 	 * mesh preq action frame format
1353 	 *     [6] da
1354 	 *     [6] sa
1355 	 *     [6] addr3 = sa
1356 	 *     [1] action
1357 	 *     [1] category
1358 	 *     [tlv] mesh path request
1359 	 */
1360 	preq->preq_ie = IEEE80211_ELEMID_MESHPREQ;
1361 	preq->preq_len = (preq->preq_flags & IEEE80211_MESHPREQ_FLAGS_AE ?
1362 	    IEEE80211_MESHPREQ_BASE_SZ_AE : IEEE80211_MESHPREQ_BASE_SZ) +
1363 	    preq->preq_tcount * IEEE80211_MESHPREQ_TRGT_SZ;
1364 	return hwmp_send_action(vap, da, (uint8_t *)preq, preq->preq_len+2);
1365 }
1366 
1367 static void
1368 hwmp_recv_prep(struct ieee80211vap *vap, struct ieee80211_node *ni,
1369     const struct ieee80211_frame *wh, const struct ieee80211_meshprep_ie *prep)
1370 {
1371 #define	IS_PROXY(rt)	(rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY)
1372 #define	PROXIED_BY_US(rt)		\
1373     (IEEE80211_ADDR_EQ(vap->iv_myaddr, rt->rt_mesh_gate))
1374 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1375 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
1376 	struct ieee80211_mesh_route *rt = NULL;
1377 	struct ieee80211_mesh_route *rtorig = NULL;
1378 	struct ieee80211_mesh_route *rtext = NULL;
1379 	struct ieee80211_hwmp_route *hr;
1380 	struct ieee80211com *ic = vap->iv_ic;
1381 	struct mbuf *m, *next;
1382 	uint32_t metric = 0;
1383 	const uint8_t *addr;
1384 
1385 #if defined(__DragonFly__)
1386 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1387 	    "received PREP, orig %s, targ %s",
1388 	    ether_sprintf(prep->prep_origaddr),
1389 	    ether_sprintf(prep->prep_targetaddr));
1390 #else
1391 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1392 	    "received PREP, orig %6D, targ %6D", prep->prep_origaddr, ":",
1393 	    prep->prep_targetaddr, ":");
1394 #endif
1395 
1396 	/*
1397 	 * Acceptance criteria: (If the corresponding PREP was not generated
1398 	 * by us OR not generated by an external mac that is not proxied by us)
1399 	 * AND forwarding is disabled, discard this PREP.
1400 	 */
1401 	rtorig = ieee80211_mesh_rt_find(vap, prep->prep_origaddr);
1402 	if ((!IEEE80211_ADDR_EQ(vap->iv_myaddr, prep->prep_origaddr) ||
1403 	    (rtorig != NULL && IS_PROXY(rtorig) && !PROXIED_BY_US(rtorig))) &&
1404 	    !(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)){
1405 #if defined(__DragonFly__)
1406 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1407 		    "discard PREP, orig(%s) not proxied or generated by us",
1408 		    ether_sprintf(prep->prep_origaddr));
1409 #else
1410 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1411 		    "discard PREP, orig(%6D) not proxied or generated by us",
1412 		    prep->prep_origaddr, ":");
1413 #endif
1414 		return;
1415 	}
1416 
1417 	/* PREP ACCEPTED */
1418 
1419 	/*
1420 	 * If accepted shall create or update the active forwarding information
1421 	 * it maintains for the target mesh STA of the PREP (according to the
1422 	 * rules defined in 13.10.8.4). If the conditions for creating or
1423 	 * updating the forwarding information have not been met in those
1424 	 * rules, no further steps are applied to the PREP.
1425 	 */
1426 	rt = ieee80211_mesh_rt_find(vap, prep->prep_targetaddr);
1427 	if (rt == NULL) {
1428 		rt = ieee80211_mesh_rt_add(vap, prep->prep_targetaddr);
1429 		if (rt == NULL) {
1430 #if defined(__DragonFly__)
1431 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1432 			    "unable to add PREP path to %s",
1433 			    ether_sprintf(prep->prep_targetaddr));
1434 #else
1435 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1436 			    "unable to add PREP path to %6D",
1437 			    prep->prep_targetaddr, ":");
1438 #endif
1439 			vap->iv_stats.is_mesh_rtaddfailed++;
1440 			return;
1441 		}
1442 #if defined(__DragonFly__)
1443 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1444 		    "adding target %s", ether_sprintf(prep->prep_targetaddr));
1445 #else
1446 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1447 		    "adding target %6D", prep->prep_targetaddr, ":");
1448 #endif
1449 	}
1450 	hr = IEEE80211_MESH_ROUTE_PRIV(rt, struct ieee80211_hwmp_route);
1451 	/* update path metric */
1452 	metric = prep->prep_metric + ms->ms_pmetric->mpm_metric(ni);
1453 	if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID)) {
1454 		if (HWMP_SEQ_LT(prep->prep_targetseq, hr->hr_seq)) {
1455 #if defined(__DragonFly__)
1456 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1457 			    "discard PREP from %s, old seq no %u < %u",
1458 			    ether_sprintf(prep->prep_targetaddr),
1459 			    prep->prep_targetseq, hr->hr_seq);
1460 #else
1461 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1462 			    "discard PREP from %6D, old seq no %u < %u",
1463 			    prep->prep_targetaddr, ":",
1464 			    prep->prep_targetseq, hr->hr_seq);
1465 #endif
1466 			return;
1467 		} else if (HWMP_SEQ_LEQ(prep->prep_targetseq, hr->hr_seq) &&
1468 		    metric > rt->rt_metric) {
1469 #if defined(__DragonFly__)
1470 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1471 			    "discard PREP from %s, new metric %u > %u",
1472 			    ether_sprintf(prep->prep_targetaddr),
1473 			    metric, rt->rt_metric);
1474 #else
1475 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1476 			    "discard PREP from %6D, new metric %u > %u",
1477 			    prep->prep_targetaddr, ":",
1478 			    metric, rt->rt_metric);
1479 #endif
1480 			return;
1481 		}
1482 	}
1483 
1484 #if defined(__DragonFly__)
1485 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1486 	    "%s path to %s, hopcount %d:%d metric %d:%d",
1487 	    rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID ?
1488 	    "prefer" : "update",
1489 	    ether_sprintf(prep->prep_targetaddr),
1490 	    rt->rt_nhops, prep->prep_hopcount + 1,
1491 	    rt->rt_metric, metric);
1492 #else
1493 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1494 	    "%s path to %6D, hopcount %d:%d metric %d:%d",
1495 	    rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID ?
1496 	    "prefer" : "update",
1497 	    prep->prep_targetaddr, ":",
1498 	    rt->rt_nhops, prep->prep_hopcount + 1,
1499 	    rt->rt_metric, metric);
1500 #endif
1501 
1502 	hr->hr_seq = prep->prep_targetseq;
1503 	hr->hr_preqretries = 0;
1504 	IEEE80211_ADDR_COPY(rt->rt_nexthop, ni->ni_macaddr);
1505 	rt->rt_metric = metric;
1506 	rt->rt_nhops = prep->prep_hopcount + 1;
1507 	ieee80211_mesh_rt_update(rt, prep->prep_lifetime);
1508 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_DISCOVER) {
1509 		/* discovery complete */
1510 		rt->rt_flags &= ~IEEE80211_MESHRT_FLAGS_DISCOVER;
1511 	}
1512 	rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID; /* mark valid */
1513 
1514 	/* Update forwarding information to TA if metric improves */
1515 	hwmp_update_transmitter(vap, ni, "PREP");
1516 
1517 	/*
1518 	 * If it's NOT for us, propagate the PREP
1519 	 */
1520 	if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, prep->prep_origaddr) &&
1521 	    prep->prep_ttl > 1 &&
1522 	    prep->prep_hopcount < hs->hs_maxhops) {
1523 		struct ieee80211_meshprep_ie pprep; /* propagated PREP */
1524 		/*
1525 		 * NB: We should already have setup the path to orig
1526 		 * mesh STA when we propagated PREQ to target mesh STA,
1527 		 * no PREP is generated without a corresponding PREQ.
1528 		 * XXX: for now just ignore.
1529 		 */
1530 		if (rtorig == NULL) {
1531 #if defined(__DragonFly__)
1532 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1533 			    "received PREP for an unknown orig(%s)",
1534 			    ether_sprintf(prep->prep_origaddr));
1535 #else
1536 			IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1537 			    "received PREP for an unknown orig(%6D)",
1538 			    prep->prep_origaddr, ":");
1539 #endif
1540 			return;
1541 		}
1542 
1543 #if defined(__DragonFly__)
1544 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1545 		    "propagate PREP from %s",
1546 		    ether_sprintf(prep->prep_targetaddr));
1547 #else
1548 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1549 		    "propagate PREP from %6D",
1550 		    prep->prep_targetaddr, ":");
1551 #endif
1552 
1553 		memcpy(&pprep, prep, sizeof(pprep));
1554 		pprep.prep_hopcount += 1;
1555 		pprep.prep_ttl -= 1;
1556 		pprep.prep_metric += ms->ms_pmetric->mpm_metric(ni);
1557 		hwmp_send_prep(vap, rtorig->rt_nexthop, &pprep);
1558 
1559 		/* precursor list for the Target Mesh STA Address is updated */
1560 	}
1561 
1562 	/*
1563 	 * Check if we received a PREP w/ AE and store target external address.
1564 	 * We may store target external address if recevied PREP w/ AE
1565 	 * and we are not final destination
1566 	 */
1567 	if (prep->prep_flags & IEEE80211_MESHPREP_FLAGS_AE) {
1568 		rtext = ieee80211_mesh_rt_find(vap,
1569 			prep->prep_target_ext_addr);
1570 		if (rtext == NULL) {
1571 			rtext = ieee80211_mesh_rt_add(vap,
1572 				prep->prep_target_ext_addr);
1573 			if (rtext == NULL) {
1574 #if defined(__DragonFly__)
1575 				IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1576 				    "unable to add PREP path to proxy %s",
1577 				    ether_sprintf(prep->prep_targetaddr));
1578 #else
1579 				IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1580 				    "unable to add PREP path to proxy %6D",
1581 				    prep->prep_targetaddr, ":");
1582 #endif
1583 				vap->iv_stats.is_mesh_rtaddfailed++;
1584 				return;
1585 			}
1586 		}
1587 #if defined(__DragonFly__)
1588 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1589 		    "%s path to %s, hopcount %d:%d metric %d:%d",
1590 		    rtext->rt_flags & IEEE80211_MESHRT_FLAGS_VALID ?
1591 		    "prefer" : "update",
1592 		    ether_sprintf(prep->prep_target_ext_addr),
1593 		    rtext->rt_nhops, prep->prep_hopcount + 1,
1594 		    rtext->rt_metric, metric);
1595 #else
1596 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1597 		    "%s path to %6D, hopcount %d:%d metric %d:%d",
1598 		    rtext->rt_flags & IEEE80211_MESHRT_FLAGS_VALID ?
1599 		    "prefer" : "update",
1600 		    prep->prep_target_ext_addr, ":",
1601 		    rtext->rt_nhops, prep->prep_hopcount + 1,
1602 		    rtext->rt_metric, metric);
1603 #endif
1604 
1605 		rtext->rt_flags = IEEE80211_MESHRT_FLAGS_PROXY |
1606 			IEEE80211_MESHRT_FLAGS_VALID;
1607 		IEEE80211_ADDR_COPY(rtext->rt_dest,
1608 		    prep->prep_target_ext_addr);
1609 		IEEE80211_ADDR_COPY(rtext->rt_mesh_gate,
1610 		    prep->prep_targetaddr);
1611 		IEEE80211_ADDR_COPY(rtext->rt_nexthop, wh->i_addr2);
1612 		rtext->rt_metric = metric;
1613 		rtext->rt_lifetime = prep->prep_lifetime;
1614 		rtext->rt_nhops = prep->prep_hopcount + 1;
1615 		rtext->rt_ext_seq = prep->prep_origseq; /* new proxy seq */
1616 		/*
1617 		 * XXX: proxy entries have no HWMP priv data,
1618 		 * nullify them to be sure?
1619 		 */
1620 	}
1621 	/*
1622 	 * Check for frames queued awaiting path discovery.
1623 	 * XXX probably can tell exactly and avoid remove call
1624 	 * NB: hash may have false matches, if so they will get
1625 	 *     stuck back on the stageq because there won't be
1626 	 *     a path.
1627 	 */
1628 	addr = prep->prep_flags & IEEE80211_MESHPREP_FLAGS_AE ?
1629 	    prep->prep_target_ext_addr : prep->prep_targetaddr;
1630 	m = ieee80211_ageq_remove(&ic->ic_stageq,
1631 	    (struct ieee80211_node *)(uintptr_t)
1632 	    ieee80211_mac_hash(ic, addr)); /* either dest or ext_dest */
1633 
1634 	/*
1635 	 * All frames in the stageq here should be non-M_ENCAP; or things
1636 	 * will get very unhappy.
1637 	 */
1638 	for (; m != NULL; m = next) {
1639 		next = m->m_nextpkt;
1640 		m->m_nextpkt = NULL;
1641 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1642 		    "flush queued frame %p len %d", m, m->m_pkthdr.len);
1643 		/*
1644 		 * If the mbuf has M_ENCAP set, ensure we free it.
1645 		 * Note that after if_transmit() is called, m is invalid.
1646 		 */
1647 		(void) ieee80211_vap_xmitpkt(vap, m);
1648 	}
1649 #undef	IS_PROXY
1650 #undef	PROXIED_BY_US
1651 }
1652 
1653 static int
1654 hwmp_send_prep(struct ieee80211vap *vap,
1655     const uint8_t da[IEEE80211_ADDR_LEN],
1656     struct ieee80211_meshprep_ie *prep)
1657 {
1658 	/* NB: there's no PREP minimum interval. */
1659 
1660 	/*
1661 	 * mesh prep action frame format
1662 	 *     [6] da
1663 	 *     [6] sa
1664 	 *     [6] addr3 = sa
1665 	 *     [1] action
1666 	 *     [1] category
1667 	 *     [tlv] mesh path reply
1668 	 */
1669 	prep->prep_ie = IEEE80211_ELEMID_MESHPREP;
1670 	prep->prep_len = prep->prep_flags & IEEE80211_MESHPREP_FLAGS_AE ?
1671 	    IEEE80211_MESHPREP_BASE_SZ_AE : IEEE80211_MESHPREP_BASE_SZ;
1672 	return hwmp_send_action(vap, da, (uint8_t *)prep, prep->prep_len + 2);
1673 }
1674 
1675 #define	PERR_DFLAGS(n)	perr.perr_dests[n].dest_flags
1676 #define	PERR_DADDR(n)	perr.perr_dests[n].dest_addr
1677 #define	PERR_DSEQ(n)	perr.perr_dests[n].dest_seq
1678 #define	PERR_DRCODE(n)	perr.perr_dests[n].dest_rcode
1679 static void
1680 hwmp_peerdown(struct ieee80211_node *ni)
1681 {
1682 	struct ieee80211vap *vap = ni->ni_vap;
1683 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1684 	struct ieee80211_meshperr_ie perr;
1685 	struct ieee80211_mesh_route *rt;
1686 	struct ieee80211_hwmp_route *hr;
1687 
1688 	rt = ieee80211_mesh_rt_find(vap, ni->ni_macaddr);
1689 	if (rt == NULL)
1690 		return;
1691 	hr = IEEE80211_MESH_ROUTE_PRIV(rt, struct ieee80211_hwmp_route);
1692 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1693 	    "%s", "delete route entry");
1694 	perr.perr_ttl = ms->ms_ttl;
1695 	perr.perr_ndests = 1;
1696 	PERR_DFLAGS(0) = 0;
1697 	if (hr->hr_seq == 0)
1698 		PERR_DFLAGS(0) |= IEEE80211_MESHPERR_DFLAGS_USN;
1699 	PERR_DFLAGS(0) |= IEEE80211_MESHPERR_DFLAGS_RC;
1700 	IEEE80211_ADDR_COPY(PERR_DADDR(0), rt->rt_dest);
1701 	PERR_DSEQ(0) = ++hr->hr_seq;
1702 	PERR_DRCODE(0) = IEEE80211_REASON_MESH_PERR_DEST_UNREACH;
1703 	/* NB: flush everything passing through peer */
1704 	ieee80211_mesh_rt_flush_peer(vap, ni->ni_macaddr);
1705 	hwmp_send_perr(vap, broadcastaddr, &perr);
1706 }
1707 #undef	PERR_DFLAGS
1708 #undef	PERR_DADDR
1709 #undef	PERR_DSEQ
1710 #undef	PERR_DRCODE
1711 
1712 #define	PERR_DFLAGS(n)		perr->perr_dests[n].dest_flags
1713 #define	PERR_DADDR(n)		perr->perr_dests[n].dest_addr
1714 #define	PERR_DSEQ(n)		perr->perr_dests[n].dest_seq
1715 #define	PERR_DEXTADDR(n)	perr->perr_dests[n].dest_ext_addr
1716 #define	PERR_DRCODE(n)		perr->perr_dests[n].dest_rcode
1717 static void
1718 hwmp_recv_perr(struct ieee80211vap *vap, struct ieee80211_node *ni,
1719     const struct ieee80211_frame *wh, const struct ieee80211_meshperr_ie *perr)
1720 {
1721 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1722 	struct ieee80211_mesh_route *rt = NULL;
1723 	struct ieee80211_mesh_route *rt_ext = NULL;
1724 	struct ieee80211_hwmp_route *hr;
1725 	struct ieee80211_meshperr_ie *pperr = NULL;
1726 	int i, j = 0, forward = 0;
1727 
1728 #if defined(__DragonFly__)
1729 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1730 	    "received PERR from %s", ether_sprintf(wh->i_addr2));
1731 #else
1732 	IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1733 	    "received PERR from %6D", wh->i_addr2, ":");
1734 #endif
1735 
1736 	/*
1737 	 * if forwarding is true, prepare pperr
1738 	 */
1739 	if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) {
1740 		forward = 1;
1741 #if defined(__DragonFly__)
1742 		pperr = kmalloc(sizeof(*perr) + 31*sizeof(*perr->perr_dests),
1743 		    M_80211_MESH_PERR, M_INTWAIT); /* XXX: magic number, 32 err dests */
1744 #else
1745 		pperr = IEEE80211_MALLOC(sizeof(*perr) + 31*sizeof(*perr->perr_dests),
1746 		    M_80211_MESH_PERR, IEEE80211_M_NOWAIT); /* XXX: magic number, 32 err dests */
1747 #endif
1748 	}
1749 
1750 	/*
1751 	 * Acceptance criteria: check if we have forwarding information
1752 	 * stored about destination, and that nexthop == TA of this PERR.
1753 	 * NB: we also build a new PERR to propagate in case we should forward.
1754 	 */
1755 	for (i = 0; i < perr->perr_ndests; i++) {
1756 		rt = ieee80211_mesh_rt_find(vap, PERR_DADDR(i));
1757 		if (rt == NULL)
1758 			continue;
1759 		if (!IEEE80211_ADDR_EQ(rt->rt_nexthop, wh->i_addr2))
1760 			continue;
1761 
1762 		/* found and accepted a PERR ndest element, process it... */
1763 		if (forward)
1764 			memcpy(&pperr->perr_dests[j], &perr->perr_dests[i],
1765 			    sizeof(*perr->perr_dests));
1766 		hr = IEEE80211_MESH_ROUTE_PRIV(rt, struct ieee80211_hwmp_route);
1767 		switch(PERR_DFLAGS(i)) {
1768 		case (IEEE80211_REASON_MESH_PERR_NO_FI):
1769 			if (PERR_DSEQ(i) == 0) {
1770 				hr->hr_seq++;
1771 				if (forward) {
1772 					pperr->perr_dests[j].dest_seq =
1773 					    hr->hr_seq;
1774 				}
1775 			} else {
1776 				hr->hr_seq = PERR_DSEQ(i);
1777 			}
1778 			rt->rt_flags &= ~IEEE80211_MESHRT_FLAGS_VALID;
1779 			j++;
1780 			break;
1781 		case (IEEE80211_REASON_MESH_PERR_DEST_UNREACH):
1782 			if(HWMP_SEQ_GT(PERR_DSEQ(i), hr->hr_seq)) {
1783 				hr->hr_seq = PERR_DSEQ(i);
1784 				rt->rt_flags &= ~IEEE80211_MESHRT_FLAGS_VALID;
1785 				j++;
1786 			}
1787 			break;
1788 		case (IEEE80211_REASON_MESH_PERR_NO_PROXY):
1789 			rt_ext = ieee80211_mesh_rt_find(vap, PERR_DEXTADDR(i));
1790 			if (rt_ext != NULL) {
1791 				rt_ext->rt_flags &=
1792 				    ~IEEE80211_MESHRT_FLAGS_VALID;
1793 				j++;
1794 			}
1795 			break;
1796 		default:
1797 			IEEE80211_DISCARD(vap, IEEE80211_MSG_HWMP, wh, NULL,
1798 			    "PERR, unknown reason code %u\n", PERR_DFLAGS(i));
1799 			goto done; /* XXX: stats?? */
1800 		}
1801 		ieee80211_mesh_rt_flush_peer(vap, PERR_DADDR(i));
1802 		KASSERT(j < 32, ("PERR, error ndest >= 32 (%u)", j));
1803 	}
1804 	if (j == 0) {
1805 		IEEE80211_DISCARD(vap, IEEE80211_MSG_HWMP, wh, NULL, "%s",
1806 		    "PERR not accepted");
1807 		goto done; /* XXX: stats?? */
1808 	}
1809 
1810 	/*
1811 	 * Propagate the PERR if we previously found it on our routing table.
1812 	 */
1813 	if (forward && perr->perr_ttl > 1) {
1814 #if defined(__DragonFly__)
1815 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1816 		    "propagate PERR from %s", ether_sprintf(wh->i_addr2));
1817 #else
1818 		IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP, ni,
1819 		    "propagate PERR from %6D", wh->i_addr2, ":");
1820 #endif
1821 		pperr->perr_ndests = j;
1822 		pperr->perr_ttl--;
1823 		hwmp_send_perr(vap, broadcastaddr, pperr);
1824 	}
1825 done:
1826 	if (pperr != NULL)
1827 		IEEE80211_FREE(pperr, M_80211_MESH_PERR);
1828 }
1829 #undef	PERR_DFLAGS
1830 #undef	PERR_DADDR
1831 #undef	PERR_DSEQ
1832 #undef	PERR_DEXTADDR
1833 #undef	PERR_DRCODE
1834 
1835 static int
1836 hwmp_send_perr(struct ieee80211vap *vap,
1837     const uint8_t da[IEEE80211_ADDR_LEN],
1838     struct ieee80211_meshperr_ie *perr)
1839 {
1840 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
1841 	int i;
1842 	uint8_t length = 0;
1843 
1844 	/*
1845 	 * Enforce PERR interval.
1846 	 */
1847 	if (ratecheck(&hs->hs_lastperr, &ieee80211_hwmp_perrminint) == 0)
1848 		return EALREADY;
1849 	getmicrouptime(&hs->hs_lastperr);
1850 
1851 	/*
1852 	 * mesh perr action frame format
1853 	 *     [6] da
1854 	 *     [6] sa
1855 	 *     [6] addr3 = sa
1856 	 *     [1] action
1857 	 *     [1] category
1858 	 *     [tlv] mesh path error
1859 	 */
1860 	perr->perr_ie = IEEE80211_ELEMID_MESHPERR;
1861 	length = IEEE80211_MESHPERR_BASE_SZ;
1862 	for (i = 0; i<perr->perr_ndests; i++) {
1863 		if (perr->perr_dests[i].dest_flags &
1864 		    IEEE80211_MESHPERR_FLAGS_AE) {
1865 			length += IEEE80211_MESHPERR_DEST_SZ_AE;
1866 			continue ;
1867 		}
1868 		length += IEEE80211_MESHPERR_DEST_SZ;
1869 	}
1870 	perr->perr_len =length;
1871 	return hwmp_send_action(vap, da, (uint8_t *)perr, perr->perr_len+2);
1872 }
1873 
1874 /*
1875  * Called from the rest of the net80211 code (mesh code for example).
1876  * NB: IEEE80211_REASON_MESH_PERR_DEST_UNREACH can be trigger by the fact that
1877  * a mesh STA is unable to forward an MSDU/MMPDU to a next-hop mesh STA.
1878  */
1879 #define	PERR_DFLAGS(n)		perr.perr_dests[n].dest_flags
1880 #define	PERR_DADDR(n)		perr.perr_dests[n].dest_addr
1881 #define	PERR_DSEQ(n)		perr.perr_dests[n].dest_seq
1882 #define	PERR_DEXTADDR(n)	perr.perr_dests[n].dest_ext_addr
1883 #define	PERR_DRCODE(n)		perr.perr_dests[n].dest_rcode
1884 static void
1885 hwmp_senderror(struct ieee80211vap *vap,
1886     const uint8_t addr[IEEE80211_ADDR_LEN],
1887     struct ieee80211_mesh_route *rt, int rcode)
1888 {
1889 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1890 	struct ieee80211_hwmp_route *hr = NULL;
1891 	struct ieee80211_meshperr_ie perr;
1892 
1893 	if (rt != NULL)
1894 		hr = IEEE80211_MESH_ROUTE_PRIV(rt,
1895 		    struct ieee80211_hwmp_route);
1896 
1897 	perr.perr_ndests = 1;
1898 	perr.perr_ttl = ms->ms_ttl;
1899 	PERR_DFLAGS(0) = 0;
1900 	PERR_DRCODE(0) = rcode;
1901 
1902 	switch (rcode) {
1903 	case IEEE80211_REASON_MESH_PERR_NO_FI:
1904 		IEEE80211_ADDR_COPY(PERR_DADDR(0), addr);
1905 		PERR_DSEQ(0) = 0; /* reserved */
1906 		break;
1907 	case IEEE80211_REASON_MESH_PERR_NO_PROXY:
1908 		KASSERT(rt != NULL, ("no proxy info for sending PERR"));
1909 		KASSERT(rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY,
1910 		    ("route is not marked proxy"));
1911 		PERR_DFLAGS(0) |= IEEE80211_MESHPERR_FLAGS_AE;
1912 		IEEE80211_ADDR_COPY(PERR_DADDR(0), vap->iv_myaddr);
1913 		PERR_DSEQ(0) = rt->rt_ext_seq;
1914 		IEEE80211_ADDR_COPY(PERR_DEXTADDR(0), addr);
1915 		break;
1916 	case IEEE80211_REASON_MESH_PERR_DEST_UNREACH:
1917 		KASSERT(rt != NULL, ("no route info for sending PERR"));
1918 		IEEE80211_ADDR_COPY(PERR_DADDR(0), addr);
1919 		PERR_DSEQ(0) = hr->hr_seq;
1920 		break;
1921 	default:
1922 		KASSERT(0, ("unknown reason code for HWMP PERR (%u)", rcode));
1923 	}
1924 	hwmp_send_perr(vap, broadcastaddr, &perr);
1925 }
1926 #undef	PERR_DFLAGS
1927 #undef	PEER_DADDR
1928 #undef	PERR_DSEQ
1929 #undef	PERR_DEXTADDR
1930 #undef	PERR_DRCODE
1931 
1932 static void
1933 hwmp_recv_rann(struct ieee80211vap *vap, struct ieee80211_node *ni,
1934     const struct ieee80211_frame *wh, const struct ieee80211_meshrann_ie *rann)
1935 {
1936 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
1937 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
1938 	struct ieee80211_mesh_route *rt = NULL;
1939 	struct ieee80211_hwmp_route *hr;
1940 	struct ieee80211_meshpreq_ie preq;
1941 	struct ieee80211_meshrann_ie prann;
1942 	uint32_t metric = 0;
1943 
1944 	if (IEEE80211_ADDR_EQ(rann->rann_addr, vap->iv_myaddr))
1945 		return;
1946 
1947 	rt = ieee80211_mesh_rt_find(vap, rann->rann_addr);
1948 	if (rt != NULL && rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) {
1949 		hr = IEEE80211_MESH_ROUTE_PRIV(rt, struct ieee80211_hwmp_route);
1950 
1951 		/* Acceptance criteria: if RANN.seq < stored seq, discard RANN */
1952 		if (HWMP_SEQ_LT(rann->rann_seq, hr->hr_seq)) {
1953 			IEEE80211_DISCARD(vap, IEEE80211_MSG_HWMP, wh, NULL,
1954 			"RANN seq %u < %u", rann->rann_seq, hr->hr_seq);
1955 			return;
1956 		}
1957 
1958 		/* Acceptance criteria: if RANN.seq == stored seq AND
1959 		* RANN.metric > stored metric, discard RANN */
1960 		if (HWMP_SEQ_EQ(rann->rann_seq, hr->hr_seq) &&
1961 		rann->rann_metric > rt->rt_metric) {
1962 			IEEE80211_DISCARD(vap, IEEE80211_MSG_HWMP, wh, NULL,
1963 			"RANN metric %u > %u", rann->rann_metric, rt->rt_metric);
1964 			return;
1965 		}
1966 	}
1967 
1968 	/* RANN ACCEPTED */
1969 
1970 	ieee80211_hwmp_rannint = rann->rann_interval; /* XXX: mtx lock? */
1971 	metric = rann->rann_metric + ms->ms_pmetric->mpm_metric(ni);
1972 
1973 	if (rt == NULL) {
1974 		rt = ieee80211_mesh_rt_add(vap, rann->rann_addr);
1975 		if (rt == NULL) {
1976 #if defined(__DragonFly__)
1977 			IEEE80211_DISCARD(vap, IEEE80211_MSG_HWMP, wh, NULL,
1978 			    "unable to add mac for RANN root %s",
1979 			    ether_sprintf(rann->rann_addr));
1980 #else
1981 			IEEE80211_DISCARD(vap, IEEE80211_MSG_HWMP, wh, NULL,
1982 			    "unable to add mac for RANN root %6D",
1983 			    rann->rann_addr, ":");
1984 #endif
1985 			    vap->iv_stats.is_mesh_rtaddfailed++;
1986 			return;
1987 		}
1988 	}
1989 	hr = IEEE80211_MESH_ROUTE_PRIV(rt, struct ieee80211_hwmp_route);
1990 	/* Check if root is a mesh gate, mark it */
1991 	if (rann->rann_flags & IEEE80211_MESHRANN_FLAGS_GATE) {
1992 		struct ieee80211_mesh_gate_route *gr;
1993 
1994 		rt->rt_flags |= IEEE80211_MESHRT_FLAGS_GATE;
1995 		gr = ieee80211_mesh_mark_gate(vap, rann->rann_addr,
1996 			rt);
1997 		gr->gr_lastseq = 0; /* NOT GANN */
1998 	}
1999 	/* discovery timeout */
2000 	ieee80211_mesh_rt_update(rt,
2001 	    ticks_to_msecs(ieee80211_hwmp_roottimeout));
2002 
2003 	preq.preq_flags = IEEE80211_MESHPREQ_FLAGS_AM;
2004 	preq.preq_hopcount = 0;
2005 	preq.preq_ttl = ms->ms_ttl;
2006 	preq.preq_id = 0; /* reserved */
2007 	IEEE80211_ADDR_COPY(preq.preq_origaddr, vap->iv_myaddr);
2008 	preq.preq_origseq = ++hs->hs_seq;
2009 	preq.preq_lifetime = ieee80211_hwmp_roottimeout;
2010 	preq.preq_metric = IEEE80211_MESHLMETRIC_INITIALVAL;
2011 	preq.preq_tcount = 1;
2012 	preq.preq_targets[0].target_flags = IEEE80211_MESHPREQ_TFLAGS_TO;
2013 	/* NB: IEEE80211_MESHPREQ_TFLAGS_USN = 0 implicitly implied */
2014 	IEEE80211_ADDR_COPY(preq.preq_targets[0].target_addr, rann->rann_addr);
2015 	preq.preq_targets[0].target_seq = rann->rann_seq;
2016 	/* XXX: if rootconfint have not passed, we built this preq in vain */
2017 	hwmp_send_preq(vap, wh->i_addr2, &preq, &hr->hr_lastrootconf,
2018 	    &ieee80211_hwmp_rootconfint);
2019 
2020 	/* propagate a RANN */
2021 	if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID &&
2022 	    rann->rann_ttl > 1 &&
2023 	    ms->ms_flags & IEEE80211_MESHFLAGS_FWD) {
2024 		hr->hr_seq = rann->rann_seq;
2025 		memcpy(&prann, rann, sizeof(prann));
2026 		prann.rann_hopcount += 1;
2027 		prann.rann_ttl -= 1;
2028 		prann.rann_metric += ms->ms_pmetric->mpm_metric(ni);
2029 		hwmp_send_rann(vap, broadcastaddr, &prann);
2030 	}
2031 }
2032 
2033 static int
2034 hwmp_send_rann(struct ieee80211vap *vap,
2035     const uint8_t da[IEEE80211_ADDR_LEN],
2036     struct ieee80211_meshrann_ie *rann)
2037 {
2038 	/*
2039 	 * mesh rann action frame format
2040 	 *     [6] da
2041 	 *     [6] sa
2042 	 *     [6] addr3 = sa
2043 	 *     [1] action
2044 	 *     [1] category
2045 	 *     [tlv] root annoucement
2046 	 */
2047 	rann->rann_ie = IEEE80211_ELEMID_MESHRANN;
2048 	rann->rann_len = IEEE80211_MESHRANN_BASE_SZ;
2049 	return hwmp_send_action(vap, da, (uint8_t *)rann, rann->rann_len + 2);
2050 }
2051 
2052 #define	PREQ_TFLAGS(n)	preq.preq_targets[n].target_flags
2053 #define	PREQ_TADDR(n)	preq.preq_targets[n].target_addr
2054 #define	PREQ_TSEQ(n)	preq.preq_targets[n].target_seq
2055 static void
2056 hwmp_rediscover_cb(void *arg)
2057 {
2058 	struct ieee80211_mesh_route *rt = arg;
2059 	struct ieee80211vap *vap = rt->rt_vap;
2060 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
2061 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2062 	struct ieee80211_hwmp_route *hr;
2063 	struct ieee80211_meshpreq_ie preq; /* Optimize: storing first preq? */
2064 
2065 	if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID))
2066 		return ; /* nothing to do */
2067 
2068 	hr = IEEE80211_MESH_ROUTE_PRIV(rt, struct ieee80211_hwmp_route);
2069 	if (hr->hr_preqretries >=
2070 		ieee80211_hwmp_maxpreq_retries) {
2071 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY,
2072 			rt->rt_dest, "%s",
2073 			"max number of discovery, send queued frames to GATE");
2074 		ieee80211_mesh_forward_to_gates(vap, rt);
2075 		vap->iv_stats.is_mesh_fwd_nopath++;
2076 		return ; /* XXX: flush queue? */
2077 	}
2078 
2079 	hr->hr_preqretries++;
2080 
2081 
2082 	IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP, rt->rt_dest,
2083 	    "start path rediscovery , target seq %u", hr->hr_seq);
2084 	/*
2085 	 * Try to discover the path for this node.
2086 	 * Group addressed PREQ Case A
2087 	 */
2088 	preq.preq_flags = 0;
2089 	preq.preq_hopcount = 0;
2090 	preq.preq_ttl = ms->ms_ttl;
2091 	preq.preq_id = ++hs->hs_preqid;
2092 	IEEE80211_ADDR_COPY(preq.preq_origaddr, vap->iv_myaddr);
2093 	preq.preq_origseq = hr->hr_origseq;
2094 	preq.preq_lifetime = ticks_to_msecs(ieee80211_hwmp_pathtimeout);
2095 	preq.preq_metric = IEEE80211_MESHLMETRIC_INITIALVAL;
2096 	preq.preq_tcount = 1;
2097 	IEEE80211_ADDR_COPY(PREQ_TADDR(0), rt->rt_dest);
2098 	PREQ_TFLAGS(0) = 0;
2099 	if (ieee80211_hwmp_targetonly)
2100 		PREQ_TFLAGS(0) |= IEEE80211_MESHPREQ_TFLAGS_TO;
2101 	PREQ_TFLAGS(0) |= IEEE80211_MESHPREQ_TFLAGS_USN;
2102 	PREQ_TSEQ(0) = 0; /* RESERVED when USN flag is set */
2103 	/* XXX check return value */
2104 	hwmp_send_preq(vap, broadcastaddr, &preq, &hr->hr_lastpreq,
2105 	    &ieee80211_hwmp_preqminint);
2106 	callout_reset(&rt->rt_discovery,
2107 		ieee80211_hwmp_net_diameter_traversaltime * 2,
2108 		hwmp_rediscover_cb, rt);
2109 }
2110 
2111 static struct ieee80211_node *
2112 hwmp_discover(struct ieee80211vap *vap,
2113     const uint8_t dest[IEEE80211_ADDR_LEN], struct mbuf *m)
2114 {
2115 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
2116 	struct ieee80211_mesh_state *ms = vap->iv_mesh;
2117 	struct ieee80211_mesh_route *rt = NULL;
2118 	struct ieee80211_hwmp_route *hr;
2119 	struct ieee80211_meshpreq_ie preq;
2120 	struct ieee80211_node *ni;
2121 	int sendpreq = 0;
2122 
2123 	KASSERT(vap->iv_opmode == IEEE80211_M_MBSS,
2124 	    ("not a mesh vap, opmode %d", vap->iv_opmode));
2125 
2126 	KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
2127 	    ("%s: discovering self!", __func__));
2128 
2129 	ni = NULL;
2130 	if (!IEEE80211_IS_MULTICAST(dest)) {
2131 		rt = ieee80211_mesh_rt_find(vap, dest);
2132 		if (rt == NULL) {
2133 			rt = ieee80211_mesh_rt_add(vap, dest);
2134 			if (rt == NULL) {
2135 #if defined(__DragonFly__)
2136 				IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP,
2137 				    ni, "unable to add discovery path to %s",
2138 				    ether_sprintf(dest));
2139 #else
2140 				IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP,
2141 				    ni, "unable to add discovery path to %6D",
2142 				    dest, ":");
2143 #endif
2144 				vap->iv_stats.is_mesh_rtaddfailed++;
2145 				goto done;
2146 			}
2147 		}
2148 		hr = IEEE80211_MESH_ROUTE_PRIV(rt,
2149 		    struct ieee80211_hwmp_route);
2150 		if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_DISCOVER) {
2151 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP, dest,
2152 			    "%s", "already discovering queue frame until path found");
2153 			sendpreq = 1;
2154 			goto done;
2155 		}
2156 		if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
2157 			if (hr->hr_lastdiscovery != 0 &&
2158 			    (ticks - hr->hr_lastdiscovery <
2159 			    (ieee80211_hwmp_net_diameter_traversaltime * 2))) {
2160 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
2161 			            dest, NULL, "%s",
2162 				    "too frequent discovery requeust");
2163 				sendpreq = 1;
2164 				goto done;
2165 			}
2166 			hr->hr_lastdiscovery = ticks;
2167 			if (hr->hr_preqretries >=
2168 			    ieee80211_hwmp_maxpreq_retries) {
2169 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
2170 			            dest, NULL, "%s",
2171 				    "no valid path , max number of discovery");
2172 				vap->iv_stats.is_mesh_fwd_nopath++;
2173 				goto done;
2174 			}
2175 			rt->rt_flags = IEEE80211_MESHRT_FLAGS_DISCOVER;
2176 			hr->hr_preqretries++;
2177 			if (hr->hr_origseq == 0)
2178 				hr->hr_origseq = ++hs->hs_seq;
2179 			rt->rt_metric = IEEE80211_MESHLMETRIC_INITIALVAL;
2180 			sendpreq = 1;
2181 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP, dest,
2182 			    "start path discovery (src %s), target seq %u",
2183 			    m == NULL ? "<none>" : ether_sprintf(
2184 			    mtod(m, struct ether_header *)->ether_shost),
2185 			    hr->hr_seq);
2186 			/*
2187 			 * Try to discover the path for this node.
2188 			 * Group addressed PREQ Case A
2189 			 */
2190 			preq.preq_flags = 0;
2191 			preq.preq_hopcount = 0;
2192 			preq.preq_ttl = ms->ms_ttl;
2193 			preq.preq_id = ++hs->hs_preqid;
2194 			IEEE80211_ADDR_COPY(preq.preq_origaddr, vap->iv_myaddr);
2195 			preq.preq_origseq = hr->hr_origseq;
2196 			preq.preq_lifetime =
2197 			    ticks_to_msecs(ieee80211_hwmp_pathtimeout);
2198 			preq.preq_metric = IEEE80211_MESHLMETRIC_INITIALVAL;
2199 			preq.preq_tcount = 1;
2200 			IEEE80211_ADDR_COPY(PREQ_TADDR(0), dest);
2201 			PREQ_TFLAGS(0) = 0;
2202 			if (ieee80211_hwmp_targetonly)
2203 				PREQ_TFLAGS(0) |= IEEE80211_MESHPREQ_TFLAGS_TO;
2204 			PREQ_TFLAGS(0) |= IEEE80211_MESHPREQ_TFLAGS_USN;
2205 			PREQ_TSEQ(0) = 0; /* RESERVED when USN flag is set */
2206 			/* XXX check return value */
2207 			hwmp_send_preq(vap, broadcastaddr, &preq,
2208 			    &hr->hr_lastpreq, &ieee80211_hwmp_preqminint);
2209 			callout_reset(&rt->rt_discovery,
2210 			    ieee80211_hwmp_net_diameter_traversaltime * 2,
2211 			    hwmp_rediscover_cb, rt);
2212 		}
2213 		if (rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID)
2214 			ni = ieee80211_find_txnode(vap, rt->rt_nexthop);
2215 	} else {
2216 		ni = ieee80211_find_txnode(vap, dest);
2217 		/* NB: if null then we leak mbuf */
2218 		KASSERT(ni != NULL, ("leak mcast frame"));
2219 		return ni;
2220 	}
2221 done:
2222 	if (ni == NULL && m != NULL) {
2223 		if (sendpreq) {
2224 			struct ieee80211com *ic = vap->iv_ic;
2225 			/*
2226 			 * Queue packet for transmit when path discovery
2227 			 * completes.  If discovery never completes the
2228 			 * frame will be flushed by way of the aging timer.
2229 			 */
2230 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_HWMP, dest,
2231 			    "%s", "queue frame until path found");
2232 			m->m_pkthdr.rcvif = (void *)(uintptr_t)
2233 			    ieee80211_mac_hash(ic, dest);
2234 			/* XXX age chosen randomly */
2235 			ieee80211_ageq_append(&ic->ic_stageq, m,
2236 			    IEEE80211_INACT_WAIT);
2237 		} else {
2238 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_HWMP,
2239 			    dest, NULL, "%s", "no valid path to this node");
2240 			m_freem(m);
2241 		}
2242 	}
2243 	return ni;
2244 }
2245 #undef	PREQ_TFLAGS
2246 #undef	PREQ_TADDR
2247 #undef	PREQ_TSEQ
2248 
2249 static int
2250 hwmp_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
2251 {
2252 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
2253 	int error;
2254 
2255 	if (vap->iv_opmode != IEEE80211_M_MBSS)
2256 		return ENOSYS;
2257 	error = 0;
2258 	switch (ireq->i_type) {
2259 	case IEEE80211_IOC_HWMP_ROOTMODE:
2260 		ireq->i_val = hs->hs_rootmode;
2261 		break;
2262 	case IEEE80211_IOC_HWMP_MAXHOPS:
2263 		ireq->i_val = hs->hs_maxhops;
2264 		break;
2265 	default:
2266 		return ENOSYS;
2267 	}
2268 	return error;
2269 }
2270 IEEE80211_IOCTL_GET(hwmp, hwmp_ioctl_get80211);
2271 
2272 static int
2273 hwmp_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
2274 {
2275 	struct ieee80211_hwmp_state *hs = vap->iv_hwmp;
2276 	int error;
2277 
2278 	if (vap->iv_opmode != IEEE80211_M_MBSS)
2279 		return ENOSYS;
2280 	error = 0;
2281 	switch (ireq->i_type) {
2282 	case IEEE80211_IOC_HWMP_ROOTMODE:
2283 		if (ireq->i_val < 0 || ireq->i_val > 3)
2284 			return EINVAL;
2285 		hs->hs_rootmode = ireq->i_val;
2286 		hwmp_rootmode_setup(vap);
2287 		break;
2288 	case IEEE80211_IOC_HWMP_MAXHOPS:
2289 		if (ireq->i_val <= 0 || ireq->i_val > 255)
2290 			return EINVAL;
2291 		hs->hs_maxhops = ireq->i_val;
2292 		break;
2293 	default:
2294 		return ENOSYS;
2295 	}
2296 	return error;
2297 }
2298 IEEE80211_IOCTL_SET(hwmp, hwmp_ioctl_set80211);
2299