1 /* 2 * Copyright (c) 2001 Atsushi Onoe 3 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * Alternatively, this software may be distributed under the terms of the 18 * GNU General Public License ("GPL") version 2 as published by the Free 19 * Software Foundation. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 * 32 * $FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.62.2.14 2006/09/02 15:16:12 sam Exp $ 33 * $DragonFly: src/sys/netproto/802_11/wlan/ieee80211_input.c,v 1.21 2007/06/15 12:04:45 sephe Exp $ 34 */ 35 36 #include <sys/param.h> 37 #include <sys/systm.h> 38 #include <sys/mbuf.h> 39 #include <sys/malloc.h> 40 #include <sys/endian.h> 41 #include <sys/kernel.h> 42 #include <sys/serialize.h> 43 44 #include <sys/socket.h> 45 46 #include <net/if.h> 47 #include <net/if_arp.h> 48 #include <net/ifq_var.h> 49 #include <net/if_media.h> 50 #include <net/ethernet.h> 51 #include <net/if_llc.h> 52 #include <net/vlan/if_vlan_var.h> 53 54 #include <netproto/802_11/ieee80211_var.h> 55 56 #include <net/bpf.h> 57 58 #ifdef IEEE80211_DEBUG 59 #include <machine/stdarg.h> 60 61 /* 62 * Decide if a received management frame should be 63 * printed when debugging is enabled. This filters some 64 * of the less interesting frames that come frequently 65 * (e.g. beacons). 66 */ 67 static __inline int 68 doprint(struct ieee80211com *ic, int subtype) 69 { 70 switch (subtype) { 71 case IEEE80211_FC0_SUBTYPE_BEACON: 72 return (ic->ic_flags & IEEE80211_F_SCAN); 73 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 74 return (ic->ic_opmode == IEEE80211_M_IBSS); 75 } 76 return 1; 77 } 78 79 /* 80 * Emit a debug message about discarding a frame or information 81 * element. One format is for extracting the mac address from 82 * the frame header; the other is for when a header is not 83 * available or otherwise appropriate. 84 */ 85 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do { \ 86 if ((_ic)->ic_debug & (_m)) \ 87 ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\ 88 } while (0) 89 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do { \ 90 if ((_ic)->ic_debug & (_m)) \ 91 ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\ 92 } while (0) 93 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do { \ 94 if ((_ic)->ic_debug & (_m)) \ 95 ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\ 96 } while (0) 97 98 static const uint8_t *ieee80211_getbssid(struct ieee80211com *, 99 const struct ieee80211_frame *); 100 static void ieee80211_discard_frame(struct ieee80211com *, 101 const struct ieee80211_frame *, const char *type, const char *fmt, ...); 102 static void ieee80211_discard_ie(struct ieee80211com *, 103 const struct ieee80211_frame *, const char *type, const char *fmt, ...); 104 static void ieee80211_discard_mac(struct ieee80211com *, 105 const uint8_t mac[IEEE80211_ADDR_LEN], const char *type, 106 const char *fmt, ...); 107 #else 108 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) 109 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) 110 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) 111 #endif /* IEEE80211_DEBUG */ 112 113 static struct mbuf *ieee80211_defrag(struct ieee80211com *, 114 struct ieee80211_node *, struct mbuf *, int); 115 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int); 116 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *, 117 const uint8_t *mac, int subtype, int arg); 118 static void ieee80211_deliver_data(struct ieee80211com *, 119 struct ieee80211_node *, struct mbuf *); 120 static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable); 121 static void ieee80211_recv_pspoll(struct ieee80211com *, 122 struct ieee80211_node *, struct mbuf *); 123 124 /* 125 * Process a received frame. The node associated with the sender 126 * should be supplied. If nothing was found in the node table then 127 * the caller is assumed to supply a reference to ic_bss instead. 128 * The RSSI and a timestamp are also supplied. The RSSI data is used 129 * during AP scanning to select a AP to associate with; it can have 130 * any units so long as values have consistent units and higher values 131 * mean ``better signal''. The receive timestamp is currently not used 132 * by the 802.11 layer. 133 */ 134 int 135 ieee80211_input(struct ieee80211com *ic, struct mbuf *m, 136 struct ieee80211_node *ni, int rssi, uint32_t rstamp) 137 { 138 return ieee80211_input_withiv(ic, m, ni, rssi, rstamp, NULL); 139 } 140 141 int 142 ieee80211_input_withiv(struct ieee80211com *ic, struct mbuf *m, 143 struct ieee80211_node *ni, int rssi, uint32_t rstamp, 144 const struct ieee80211_crypto_iv *iv) 145 { 146 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0) 147 #define HAS_SEQ(type) ((type & 0x4) == 0) 148 struct ifnet *ifp = ic->ic_ifp; 149 struct ieee80211_frame *wh; 150 struct ieee80211_key *key; 151 struct ether_header *eh; 152 int hdrspace, need_tap; 153 uint8_t dir, type, subtype; 154 uint8_t *bssid; 155 uint16_t rxseq; 156 157 ASSERT_SERIALIZED(ifp->if_serializer); 158 159 KASSERT(ni != NULL, ("null node")); 160 ni->ni_inact = ni->ni_inact_reload; 161 162 need_tap = 1; /* mbuf need to be tapped */ 163 type = -1; /* undefined */ 164 /* 165 * In monitor mode, send everything directly to bpf. 166 * XXX may want to include the CRC 167 */ 168 if (ic->ic_opmode == IEEE80211_M_MONITOR) 169 goto out; 170 171 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) { 172 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 173 ni->ni_macaddr, NULL, 174 "too short (1): len %u", m->m_pkthdr.len); 175 ic->ic_stats.is_rx_tooshort++; 176 goto out; 177 } 178 /* 179 * Bit of a cheat here, we use a pointer for a 3-address 180 * frame format but don't reference fields past outside 181 * ieee80211_frame_min w/o first validating the data is 182 * present. 183 */ 184 wh = mtod(m, struct ieee80211_frame *); 185 186 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) != 187 IEEE80211_FC0_VERSION_0) { 188 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 189 ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]); 190 ic->ic_stats.is_rx_badversion++; 191 goto err; 192 } 193 194 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 195 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 196 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 197 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) { 198 switch (ic->ic_opmode) { 199 case IEEE80211_M_STA: 200 bssid = wh->i_addr2; 201 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) { 202 /* not interested in */ 203 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 204 bssid, NULL, "%s", "not to bss"); 205 ic->ic_stats.is_rx_wrongbss++; 206 goto out; 207 } 208 break; 209 case IEEE80211_M_IBSS: 210 case IEEE80211_M_AHDEMO: 211 case IEEE80211_M_HOSTAP: 212 if (dir != IEEE80211_FC1_DIR_NODS) 213 bssid = wh->i_addr1; 214 else if (type == IEEE80211_FC0_TYPE_CTL) 215 bssid = wh->i_addr1; 216 else { 217 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 218 IEEE80211_DISCARD_MAC(ic, 219 IEEE80211_MSG_ANY, ni->ni_macaddr, 220 NULL, "too short (2): len %u", 221 m->m_pkthdr.len); 222 ic->ic_stats.is_rx_tooshort++; 223 goto out; 224 } 225 bssid = wh->i_addr3; 226 } 227 if (type != IEEE80211_FC0_TYPE_DATA) 228 break; 229 /* 230 * Data frame, validate the bssid. 231 */ 232 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) && 233 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) { 234 /* not interested in */ 235 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 236 bssid, NULL, "%s", "not to bss"); 237 ic->ic_stats.is_rx_wrongbss++; 238 goto out; 239 } 240 /* 241 * For adhoc mode we cons up a node when it doesn't 242 * exist. This should probably done after an ACL check. 243 */ 244 if (ni == ic->ic_bss && 245 ic->ic_opmode != IEEE80211_M_HOSTAP && 246 !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 247 /* 248 * Fake up a node for this newly 249 * discovered member of the IBSS. 250 */ 251 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 252 wh->i_addr2); 253 if (ni == NULL) { 254 /* NB: stat kept for alloc failure */ 255 goto err; 256 } 257 } 258 break; 259 default: 260 goto out; 261 } 262 ni->ni_rssi = rssi; 263 ni->ni_rstamp = rstamp; 264 if (HAS_SEQ(type) && !IEEE80211_IS_MULTICAST(wh->i_addr1)) { 265 uint8_t tid; 266 if (IEEE80211_QOS_HAS_SEQ(wh)) { 267 tid = ((struct ieee80211_qosframe *)wh)-> 268 i_qos[0] & IEEE80211_QOS_TID; 269 if (TID_TO_WME_AC(tid) >= WME_AC_VI) 270 ic->ic_wme.wme_hipri_traffic++; 271 tid++; 272 } else 273 tid = 0; 274 rxseq = le16toh(*(uint16_t *)wh->i_seq); 275 if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) && 276 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) { 277 /* duplicate, discard */ 278 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 279 bssid, "duplicate", 280 "seqno <%u,%u> fragno <%u,%u> tid %u", 281 rxseq >> IEEE80211_SEQ_SEQ_SHIFT, 282 ni->ni_rxseqs[tid] >> 283 IEEE80211_SEQ_SEQ_SHIFT, 284 rxseq & IEEE80211_SEQ_FRAG_MASK, 285 ni->ni_rxseqs[tid] & 286 IEEE80211_SEQ_FRAG_MASK, 287 tid); 288 ic->ic_stats.is_rx_dup++; 289 IEEE80211_NODE_STAT(ni, rx_dup); 290 goto out; 291 } 292 ni->ni_rxseqs[tid] = rxseq; 293 } 294 } 295 296 switch (type) { 297 case IEEE80211_FC0_TYPE_DATA: 298 hdrspace = ieee80211_hdrspace(ic, wh); 299 if (m->m_len < hdrspace && 300 (m = m_pullup(m, hdrspace)) == NULL) { 301 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 302 ni->ni_macaddr, NULL, 303 "data too short: expecting %u", hdrspace); 304 ic->ic_stats.is_rx_tooshort++; 305 goto out; /* XXX */ 306 } 307 switch (ic->ic_opmode) { 308 case IEEE80211_M_STA: 309 if (dir != IEEE80211_FC1_DIR_FROMDS) { 310 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 311 wh, "data", "%s", "unknown dir 0x%x", dir); 312 ic->ic_stats.is_rx_wrongdir++; 313 goto out; 314 } 315 if ((ifp->if_flags & IFF_SIMPLEX) && 316 IEEE80211_IS_MULTICAST(wh->i_addr1) && 317 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) { 318 /* 319 * In IEEE802.11 network, multicast packet 320 * sent from me is broadcasted from AP. 321 * It should be silently discarded for 322 * SIMPLEX interface. 323 */ 324 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 325 wh, NULL, "%s", "multicast echo"); 326 ic->ic_stats.is_rx_mcastecho++; 327 goto out; 328 } 329 break; 330 case IEEE80211_M_IBSS: 331 case IEEE80211_M_AHDEMO: 332 if (dir != IEEE80211_FC1_DIR_NODS) { 333 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 334 wh, "data", "%s", "unknown dir 0x%x", dir); 335 ic->ic_stats.is_rx_wrongdir++; 336 goto out; 337 } 338 /* XXX no power-save support */ 339 break; 340 case IEEE80211_M_HOSTAP: 341 if (dir != IEEE80211_FC1_DIR_TODS) { 342 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 343 wh, "data", "%s", "unknown dir 0x%x", dir); 344 ic->ic_stats.is_rx_wrongdir++; 345 goto out; 346 } 347 /* check if source STA is associated */ 348 if (ni == ic->ic_bss) { 349 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 350 wh, "data", "%s", "unknown src"); 351 ieee80211_send_error(ic, ni, wh->i_addr2, 352 IEEE80211_FC0_SUBTYPE_DEAUTH, 353 IEEE80211_REASON_NOT_AUTHED); 354 ic->ic_stats.is_rx_notassoc++; 355 goto err; 356 } 357 if (ni->ni_associd == 0) { 358 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 359 wh, "data", "%s", "unassoc src"); 360 IEEE80211_SEND_MGMT(ic, ni, 361 IEEE80211_FC0_SUBTYPE_DISASSOC, 362 IEEE80211_REASON_NOT_ASSOCED); 363 ic->ic_stats.is_rx_notassoc++; 364 goto err; 365 } 366 367 /* 368 * Check for power save state change. 369 */ 370 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^ 371 (ni->ni_flags & IEEE80211_NODE_PWR_MGT))) 372 ieee80211_node_pwrsave(ni, 373 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT); 374 break; 375 default: 376 /* XXX here to keep compiler happy */ 377 goto out; 378 } 379 380 /* 381 * Handle privacy requirements. Note that we 382 * must not be preempted from here until after 383 * we (potentially) call ieee80211_crypto_demic; 384 * otherwise we may violate assumptions in the 385 * crypto cipher modules used to do delayed update 386 * of replay sequence numbers. 387 */ 388 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 389 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 390 /* 391 * Discard encrypted frames when privacy is off. 392 */ 393 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 394 wh, "WEP", "%s", "PRIVACY off"); 395 ic->ic_stats.is_rx_noprivacy++; 396 IEEE80211_NODE_STAT(ni, rx_noprivacy); 397 goto out; 398 } 399 if (iv == NULL) { 400 key = ieee80211_crypto_decap(ic, ni, m, 401 hdrspace); 402 } else { 403 key = ieee80211_crypto_update(ic, ni, iv, wh); 404 } 405 if (key == NULL) { 406 /* NB: stats+msgs handled in crypto_decap */ 407 IEEE80211_NODE_STAT(ni, rx_wepfail); 408 goto out; 409 } 410 wh = mtod(m, struct ieee80211_frame *); 411 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 412 } else { 413 key = NULL; 414 } 415 416 /* 417 * Next up, any fragmentation. 418 */ 419 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 420 m = ieee80211_defrag(ic, ni, m, hdrspace); 421 if (m == NULL) { 422 /* Fragment dropped or frame not complete yet */ 423 goto out; 424 } 425 } 426 wh = NULL; /* no longer valid, catch any uses */ 427 428 /* 429 * Next strip any MSDU crypto bits. 430 */ 431 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) { 432 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 433 ni->ni_macaddr, "data", "%s", "demic error"); 434 ic->ic_stats.is_rx_demicfail++; 435 IEEE80211_NODE_STAT(ni, rx_demicfail); 436 goto out; 437 } 438 439 /* copy to listener after decrypt */ 440 if (ic->ic_rawbpf) 441 bpf_mtap(ic->ic_rawbpf, m); 442 need_tap = 0; 443 444 /* 445 * Finally, strip the 802.11 header. 446 */ 447 m = ieee80211_decap(ic, m, hdrspace); 448 if (m == NULL) { 449 /* don't count Null data frames as errors */ 450 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA) 451 goto out; 452 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 453 ni->ni_macaddr, "data", "%s", "decap error"); 454 ic->ic_stats.is_rx_decap++; 455 IEEE80211_NODE_STAT(ni, rx_decap); 456 goto err; 457 } 458 eh = mtod(m, struct ether_header *); 459 if (!ieee80211_node_is_authorized(ni)) { 460 /* 461 * Deny any non-PAE frames received prior to 462 * authorization. For open/shared-key 463 * authentication the port is mark authorized 464 * after authentication completes. For 802.1x 465 * the port is not marked authorized by the 466 * authenticator until the handshake has completed. 467 */ 468 if (eh->ether_type != htons(ETHERTYPE_PAE)) { 469 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 470 eh->ether_shost, "data", 471 "unauthorized port: ether type 0x%x len %u", 472 eh->ether_type, m->m_pkthdr.len); 473 ic->ic_stats.is_rx_unauth++; 474 IEEE80211_NODE_STAT(ni, rx_unauth); 475 goto err; 476 } 477 } else { 478 /* 479 * When denying unencrypted frames, discard 480 * any non-PAE frames received without encryption. 481 */ 482 if ((ic->ic_flags & IEEE80211_F_DROPUNENC) && 483 key == NULL && 484 eh->ether_type != htons(ETHERTYPE_PAE)) { 485 /* 486 * Drop unencrypted frames. 487 */ 488 ic->ic_stats.is_rx_unencrypted++; 489 IEEE80211_NODE_STAT(ni, rx_unencrypted); 490 goto out; 491 } 492 } 493 ieee80211_deliver_data(ic, ni, m); 494 return IEEE80211_FC0_TYPE_DATA; 495 496 case IEEE80211_FC0_TYPE_MGT: 497 ic->ic_stats.is_rx_mgmt++; 498 IEEE80211_NODE_STAT(ni, rx_mgmt); 499 if (dir != IEEE80211_FC1_DIR_NODS) { 500 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 501 wh, "data", "%s", "unknown dir 0x%x", dir); 502 ic->ic_stats.is_rx_wrongdir++; 503 goto err; 504 } 505 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 506 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 507 ni->ni_macaddr, "mgt", "too short: len %u", 508 m->m_pkthdr.len); 509 ic->ic_stats.is_rx_tooshort++; 510 goto out; 511 } 512 #ifdef IEEE80211_DEBUG 513 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) || 514 ieee80211_msg_dumppkts(ic)) { 515 if_printf(ic->ic_ifp, "received %s from %6D rssi %d\n", 516 ieee80211_mgt_subtype_name[subtype >> 517 IEEE80211_FC0_SUBTYPE_SHIFT], 518 wh->i_addr2, ":", rssi); 519 } 520 #endif 521 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 522 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) { 523 /* 524 * Only shared key auth frames with a challenge 525 * should be encrypted, discard all others. 526 */ 527 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 528 wh, ieee80211_mgt_subtype_name[subtype >> 529 IEEE80211_FC0_SUBTYPE_SHIFT], 530 "%s", "WEP set but not permitted"); 531 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */ 532 goto out; 533 } 534 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 535 /* 536 * Discard encrypted frames when privacy is off. 537 */ 538 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 539 wh, "mgt", "%s", "WEP set but PRIVACY off"); 540 ic->ic_stats.is_rx_noprivacy++; 541 goto out; 542 } 543 if (iv == NULL) { 544 hdrspace = ieee80211_hdrspace(ic, wh); 545 key = ieee80211_crypto_decap(ic, ni, m, 546 hdrspace); 547 } else { 548 key = ieee80211_crypto_update(ic, ni, iv, wh); 549 } 550 if (key == NULL) { 551 /* NB: stats+msgs handled in crypto_decap */ 552 goto out; 553 } 554 wh = mtod(m, struct ieee80211_frame *); 555 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 556 } 557 if (ic->ic_rawbpf) 558 bpf_mtap(ic->ic_rawbpf, m); 559 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp); 560 m_freem(m); 561 return type; 562 563 case IEEE80211_FC0_TYPE_CTL: 564 IEEE80211_NODE_STAT(ni, rx_ctrl); 565 ic->ic_stats.is_rx_ctl++; 566 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 567 switch (subtype) { 568 case IEEE80211_FC0_SUBTYPE_PS_POLL: 569 ieee80211_recv_pspoll(ic, ni, m); 570 break; 571 } 572 } 573 goto out; 574 default: 575 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 576 wh, NULL, "bad frame type 0x%x", type); 577 /* should not come here */ 578 break; 579 } 580 err: 581 ifp->if_ierrors++; 582 out: 583 if (m != NULL) { 584 if (ic->ic_rawbpf && need_tap) 585 bpf_mtap(ic->ic_rawbpf, m); 586 m_freem(m); 587 } 588 return type; 589 #undef SEQ_LEQ 590 } 591 592 /* 593 * This function reassemble fragments. 594 */ 595 static struct mbuf * 596 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni, 597 struct mbuf *m, int hdrspace) 598 { 599 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 600 struct ieee80211_frame *lwh; 601 uint16_t rxseq; 602 uint8_t fragno; 603 uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG; 604 struct mbuf *mfrag; 605 606 KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?")); 607 608 rxseq = le16toh(*(uint16_t *)wh->i_seq); 609 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK; 610 611 /* Quick way out, if there's nothing to defragment */ 612 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL) 613 return m; 614 615 /* 616 * Remove frag to insure it doesn't get reaped by timer. 617 */ 618 if (ni->ni_table == NULL) { 619 /* 620 * Should never happen. If the node is orphaned (not in 621 * the table) then input packets should not reach here. 622 * Otherwise, a concurrent request that yanks the table 623 * should be blocked by other interlocking and/or by first 624 * shutting the driver down. Regardless, be defensive 625 * here and just bail 626 */ 627 /* XXX need msg+stat */ 628 m_freem(m); 629 return NULL; 630 } 631 mfrag = ni->ni_rxfrag[0]; 632 ni->ni_rxfrag[0] = NULL; 633 634 /* 635 * Validate new fragment is in order and 636 * related to the previous ones. 637 */ 638 if (mfrag != NULL) { 639 uint16_t last_rxseq; 640 641 lwh = mtod(mfrag, struct ieee80211_frame *); 642 last_rxseq = le16toh(*(uint16_t *)lwh->i_seq); 643 /* NB: check seq # and frag together */ 644 if (rxseq != last_rxseq+1 || 645 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) || 646 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { 647 /* 648 * Unrelated fragment or no space for it, 649 * clear current fragments. 650 */ 651 m_freem(mfrag); 652 mfrag = NULL; 653 } 654 } 655 656 if (mfrag == NULL) { 657 if (fragno != 0) { /* !first fragment, discard */ 658 ic->ic_stats.is_rx_defrag++; 659 IEEE80211_NODE_STAT(ni, rx_defrag); 660 m_freem(m); 661 return NULL; 662 } 663 mfrag = m; 664 } else { /* concatenate */ 665 m_adj(m, hdrspace); /* strip header */ 666 m_cat(mfrag, m); 667 /* NB: m_cat doesn't update the packet header */ 668 mfrag->m_pkthdr.len += m->m_pkthdr.len; 669 /* track last seqnum and fragno */ 670 lwh = mtod(mfrag, struct ieee80211_frame *); 671 *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq; 672 } 673 if (more_frag) { /* more to come, save */ 674 ni->ni_rxfragstamp = ticks; 675 ni->ni_rxfrag[0] = mfrag; 676 mfrag = NULL; 677 } 678 return mfrag; 679 } 680 681 static void 682 ieee80211_deliver_data(struct ieee80211com *ic, 683 struct ieee80211_node *ni, struct mbuf *m) 684 { 685 struct ether_header *eh = mtod(m, struct ether_header *); 686 struct ifnet *ifp = ic->ic_ifp; 687 688 /* 689 * Do accounting. 690 */ 691 ifp->if_ipackets++; 692 IEEE80211_NODE_STAT(ni, rx_data); 693 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len); 694 if (ETHER_IS_MULTICAST(eh->ether_dhost)) { 695 m->m_flags |= M_MCAST; /* XXX M_BCAST? */ 696 IEEE80211_NODE_STAT(ni, rx_mcast); 697 } else { 698 IEEE80211_NODE_STAT(ni, rx_ucast); 699 } 700 701 /* perform as a bridge within the AP */ 702 if (ic->ic_opmode == IEEE80211_M_HOSTAP && 703 (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) { 704 struct mbuf *m1 = NULL; 705 706 if (m->m_flags & M_MCAST) { 707 m1 = m_dup(m, MB_DONTWAIT); 708 if (m1 == NULL) 709 ifp->if_oerrors++; 710 else 711 m1->m_flags |= M_MCAST; 712 } else { 713 /* 714 * Check if the destination is known; if so 715 * and the port is authorized dispatch directly. 716 */ 717 struct ieee80211_node *sta = 718 ieee80211_find_node(&ic->ic_sta, eh->ether_dhost); 719 if (sta != NULL) { 720 if (ieee80211_node_is_authorized(sta)) { 721 /* 722 * Beware of sending to ourself; this 723 * needs to happen via the normal 724 * input path. 725 */ 726 if (sta != ic->ic_bss) { 727 m1 = m; 728 m = NULL; 729 } 730 } else { 731 ic->ic_stats.is_rx_unauth++; 732 IEEE80211_NODE_STAT(sta, rx_unauth); 733 } 734 ieee80211_free_node(sta); 735 } 736 } 737 if (m1 != NULL) { 738 /* XXX bypasses ALTQ */ 739 ifq_handoff(ifp, m1, NULL); 740 } 741 } 742 if (m != NULL) { 743 #ifdef FREEBSD_VLAN 744 if (ni->ni_vlan != 0) { 745 /* attach vlan tag */ 746 VLAN_INPUT_TAG_NEW(ifp, m, ni->ni_vlan); 747 if (m == NULL) 748 goto out; /* XXX goto err? */ 749 } 750 #endif 751 ifp->if_input(ifp, m); 752 } 753 return; 754 755 #ifdef FREEBSD_VLAN 756 out: 757 if (m != NULL) { 758 if (ic->ic_rawbpf) 759 bpf_mtap(ic->ic_rawbpf, m); 760 m_freem(m); 761 } 762 #endif 763 } 764 765 static struct mbuf * 766 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen) 767 { 768 struct ieee80211_qosframe_addr4 wh; /* Max size address frames */ 769 struct ether_header *eh; 770 struct llc *llc; 771 772 if (m->m_len < hdrlen + sizeof(*llc) && 773 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) { 774 /* XXX stat, msg */ 775 return NULL; 776 } 777 memcpy(&wh, mtod(m, caddr_t), hdrlen); 778 llc = (struct llc *)(mtod(m, caddr_t) + hdrlen); 779 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP && 780 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 && 781 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) { 782 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh)); 783 llc = NULL; 784 } else { 785 m_adj(m, hdrlen - sizeof(*eh)); 786 } 787 eh = mtod(m, struct ether_header *); 788 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) { 789 case IEEE80211_FC1_DIR_NODS: 790 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 791 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 792 break; 793 case IEEE80211_FC1_DIR_TODS: 794 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 795 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 796 break; 797 case IEEE80211_FC1_DIR_FROMDS: 798 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 799 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3); 800 break; 801 case IEEE80211_FC1_DIR_DSTODS: 802 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 803 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4); 804 break; 805 } 806 #ifdef ALIGNED_POINTER 807 if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) { 808 struct mbuf *n, *n0, **np; 809 caddr_t newdata; 810 int off, pktlen; 811 812 n0 = NULL; 813 np = &n0; 814 off = 0; 815 pktlen = m->m_pkthdr.len; 816 while (pktlen > off) { 817 if (n0 == NULL) { 818 MGETHDR(n, M_DONTWAIT, MT_DATA); 819 if (n == NULL) { 820 m_freem(m); 821 return NULL; 822 } 823 M_MOVE_PKTHDR(n, m); 824 n->m_len = MHLEN; 825 } else { 826 MGET(n, M_DONTWAIT, MT_DATA); 827 if (n == NULL) { 828 m_freem(m); 829 m_freem(n0); 830 return NULL; 831 } 832 n->m_len = MLEN; 833 } 834 if (pktlen - off >= MINCLSIZE) { 835 MCLGET(n, M_DONTWAIT); 836 if (n->m_flags & M_EXT) 837 n->m_len = n->m_ext.ext_size; 838 } 839 if (n0 == NULL) { 840 newdata = 841 (caddr_t)ALIGN(n->m_data + sizeof(*eh)) - 842 sizeof(*eh); 843 n->m_len -= newdata - n->m_data; 844 n->m_data = newdata; 845 } 846 if (n->m_len > pktlen - off) 847 n->m_len = pktlen - off; 848 m_copydata(m, off, n->m_len, mtod(n, caddr_t)); 849 off += n->m_len; 850 *np = n; 851 np = &n->m_next; 852 } 853 m_freem(m); 854 m = n0; 855 } 856 #endif /* ALIGNED_POINTER */ 857 if (llc != NULL) { 858 eh = mtod(m, struct ether_header *); 859 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh)); 860 } 861 return m; 862 } 863 864 /* 865 * Install received rate set information in the node's state block. 866 */ 867 int 868 ieee80211_setup_rates(struct ieee80211_node *ni, 869 const uint8_t *rates, const uint8_t *xrates, int flags, int join) 870 { 871 struct ieee80211com *ic = ni->ni_ic; 872 struct ieee80211_rateset *rs = &ni->ni_rates; 873 874 memset(rs, 0, sizeof(*rs)); 875 rs->rs_nrates = rates[1]; 876 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates); 877 if (xrates != NULL) { 878 uint8_t nxrates; 879 /* 880 * Tack on 11g extended supported rate element. 881 */ 882 nxrates = xrates[1]; 883 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) { 884 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates; 885 IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE, 886 "[%6D] extended rate set too large;" 887 " only using %u of %u rates\n", 888 ni->ni_macaddr, ":", nxrates, xrates[1]); 889 ic->ic_stats.is_rx_rstoobig++; 890 } 891 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates); 892 rs->rs_nrates += nxrates; 893 } 894 return ieee80211_fix_rate(ni, flags, join); 895 } 896 897 static void 898 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh, 899 struct ieee80211_node *ni, int rssi, uint32_t rstamp, uint16_t seq, 900 uint16_t status) 901 { 902 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) { 903 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 904 ni->ni_macaddr, "open auth", 905 "bad sta auth mode %u", ni->ni_authmode); 906 ic->ic_stats.is_rx_bad_auth++; /* XXX */ 907 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 908 /* 909 * Clear any challenge text that may be there if 910 * a previous shared key auth failed and then an 911 * open auth is attempted. 912 */ 913 if (ni->ni_challenge != NULL) { 914 FREE(ni->ni_challenge, M_DEVBUF); 915 ni->ni_challenge = NULL; 916 } 917 /* XXX hack to workaround calling convention */ 918 ieee80211_send_error(ic, ni, wh->i_addr2, 919 IEEE80211_FC0_SUBTYPE_AUTH, 920 (seq + 1) | (IEEE80211_STATUS_ALG<<16)); 921 } 922 return; 923 } 924 switch (ic->ic_opmode) { 925 case IEEE80211_M_IBSS: 926 case IEEE80211_M_AHDEMO: 927 case IEEE80211_M_MONITOR: 928 /* should not come here */ 929 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 930 ni->ni_macaddr, "open auth", 931 "bad operating mode %u", ic->ic_opmode); 932 break; 933 934 case IEEE80211_M_HOSTAP: 935 if (ic->ic_state != IEEE80211_S_RUN || 936 seq != IEEE80211_AUTH_OPEN_REQUEST) { 937 ic->ic_stats.is_rx_bad_auth++; 938 return; 939 } 940 /* always accept open authentication requests */ 941 if (ni == ic->ic_bss) { 942 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 943 if (ni == NULL) 944 return; 945 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 946 (void) ieee80211_ref_node(ni); 947 /* 948 * Mark the node as referenced to reflect that it's 949 * reference count has been bumped to insure it remains 950 * after the transaction completes. 951 */ 952 ni->ni_flags |= IEEE80211_NODE_AREF; 953 954 IEEE80211_SEND_MGMT(ic, ni, 955 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 956 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 957 "[%6D] station authenticated (open)\n", 958 ni->ni_macaddr, ":"); 959 /* 960 * When 802.1x is not in use mark the port 961 * authorized at this point so traffic can flow. 962 */ 963 if (ni->ni_authmode != IEEE80211_AUTH_8021X) 964 ieee80211_node_authorize(ni); 965 break; 966 967 case IEEE80211_M_STA: 968 if (ic->ic_state != IEEE80211_S_AUTH || 969 seq != IEEE80211_AUTH_OPEN_RESPONSE) { 970 ic->ic_stats.is_rx_bad_auth++; 971 return; 972 } 973 if (status != 0) { 974 IEEE80211_DPRINTF(ic, 975 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 976 "[%6D] open auth failed (reason %d)\n", 977 ni->ni_macaddr, ":", status); 978 /* XXX can this happen? */ 979 if (ni != ic->ic_bss) 980 ni->ni_fails++; 981 ic->ic_stats.is_rx_auth_fail++; 982 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 983 } else 984 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 985 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 986 break; 987 } 988 } 989 990 /* 991 * Send a management frame error response to the specified 992 * station. If ni is associated with the station then use 993 * it; otherwise allocate a temporary node suitable for 994 * transmitting the frame and then free the reference so 995 * it will go away as soon as the frame has been transmitted. 996 */ 997 static void 998 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni, 999 const uint8_t *mac, int subtype, int arg) 1000 { 1001 int istmp; 1002 1003 if (ni == ic->ic_bss) { 1004 ni = ieee80211_tmp_node(ic, mac); 1005 if (ni == NULL) { 1006 /* XXX msg */ 1007 return; 1008 } 1009 istmp = 1; 1010 } else 1011 istmp = 0; 1012 IEEE80211_SEND_MGMT(ic, ni, subtype, arg); 1013 if (istmp) 1014 ieee80211_free_node(ni); 1015 } 1016 1017 static int 1018 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni) 1019 { 1020 if (ni->ni_challenge == NULL) 1021 MALLOC(ni->ni_challenge, uint32_t*, IEEE80211_CHALLENGE_LEN, 1022 M_DEVBUF, M_NOWAIT); 1023 if (ni->ni_challenge == NULL) { 1024 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1025 "[%6D] shared key challenge alloc failed\n", 1026 ni->ni_macaddr, ":"); 1027 /* XXX statistic */ 1028 } 1029 return (ni->ni_challenge != NULL); 1030 } 1031 1032 /* XXX TODO: add statistics */ 1033 static void 1034 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh, 1035 uint8_t *frm, uint8_t *efrm, struct ieee80211_node *ni, int rssi, 1036 uint32_t rstamp, uint16_t seq, uint16_t status) 1037 { 1038 uint8_t *challenge; 1039 int allocbs, estatus; 1040 1041 /* 1042 * NB: this can happen as we allow pre-shared key 1043 * authentication to be enabled w/o wep being turned 1044 * on so that configuration of these can be done 1045 * in any order. It may be better to enforce the 1046 * ordering in which case this check would just be 1047 * for sanity/consistency. 1048 */ 1049 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 1050 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1051 ni->ni_macaddr, "shared key auth", 1052 "%s", " PRIVACY is disabled"); 1053 estatus = IEEE80211_STATUS_ALG; 1054 goto bad; 1055 } 1056 /* 1057 * Pre-shared key authentication is evil; accept 1058 * it only if explicitly configured (it is supported 1059 * mainly for compatibility with clients like OS X). 1060 */ 1061 if (ni->ni_authmode != IEEE80211_AUTH_AUTO && 1062 ni->ni_authmode != IEEE80211_AUTH_SHARED) { 1063 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1064 ni->ni_macaddr, "shared key auth", 1065 "bad sta auth mode %u", ni->ni_authmode); 1066 ic->ic_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */ 1067 estatus = IEEE80211_STATUS_ALG; 1068 goto bad; 1069 } 1070 1071 challenge = NULL; 1072 if (frm + 1 < efrm) { 1073 if ((frm[1] + 2) > (efrm - frm)) { 1074 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1075 ni->ni_macaddr, "shared key auth", 1076 "ie %d/%d too long", 1077 frm[0], (frm[1] + 2) - (efrm - frm)); 1078 ic->ic_stats.is_rx_bad_auth++; 1079 estatus = IEEE80211_STATUS_CHALLENGE; 1080 goto bad; 1081 } 1082 if (*frm == IEEE80211_ELEMID_CHALLENGE) 1083 challenge = frm; 1084 frm += frm[1] + 2; 1085 } 1086 switch (seq) { 1087 case IEEE80211_AUTH_SHARED_CHALLENGE: 1088 case IEEE80211_AUTH_SHARED_RESPONSE: 1089 if (challenge == NULL) { 1090 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1091 ni->ni_macaddr, "shared key auth", 1092 "%s", "no challenge"); 1093 ic->ic_stats.is_rx_bad_auth++; 1094 estatus = IEEE80211_STATUS_CHALLENGE; 1095 goto bad; 1096 } 1097 if (challenge[1] != IEEE80211_CHALLENGE_LEN) { 1098 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1099 ni->ni_macaddr, "shared key auth", 1100 "bad challenge len %d", challenge[1]); 1101 ic->ic_stats.is_rx_bad_auth++; 1102 estatus = IEEE80211_STATUS_CHALLENGE; 1103 goto bad; 1104 } 1105 default: 1106 break; 1107 } 1108 switch (ic->ic_opmode) { 1109 case IEEE80211_M_MONITOR: 1110 case IEEE80211_M_AHDEMO: 1111 case IEEE80211_M_IBSS: 1112 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1113 ni->ni_macaddr, "shared key auth", 1114 "bad operating mode %u", ic->ic_opmode); 1115 return; 1116 case IEEE80211_M_HOSTAP: 1117 if (ic->ic_state != IEEE80211_S_RUN) { 1118 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1119 ni->ni_macaddr, "shared key auth", 1120 "bad state %u", ic->ic_state); 1121 estatus = IEEE80211_STATUS_ALG; /* XXX */ 1122 goto bad; 1123 } 1124 switch (seq) { 1125 case IEEE80211_AUTH_SHARED_REQUEST: 1126 if (ni == ic->ic_bss) { 1127 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 1128 if (ni == NULL) { 1129 /* NB: no way to return an error */ 1130 return; 1131 } 1132 allocbs = 1; 1133 } else { 1134 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 1135 (void) ieee80211_ref_node(ni); 1136 allocbs = 0; 1137 } 1138 /* 1139 * Mark the node as referenced to reflect that it's 1140 * reference count has been bumped to insure it remains 1141 * after the transaction completes. 1142 */ 1143 ni->ni_flags |= IEEE80211_NODE_AREF; 1144 ni->ni_rssi = rssi; 1145 ni->ni_rstamp = rstamp; 1146 if (!alloc_challenge(ic, ni)) { 1147 /* NB: don't return error so they rexmit */ 1148 return; 1149 } 1150 get_random_bytes(ni->ni_challenge, 1151 IEEE80211_CHALLENGE_LEN); 1152 IEEE80211_DPRINTF(ic, 1153 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1154 "[%6D] shared key %sauth request\n", 1155 ni->ni_macaddr, ":", 1156 allocbs ? "" : "re"); 1157 break; 1158 case IEEE80211_AUTH_SHARED_RESPONSE: 1159 if (ni == ic->ic_bss) { 1160 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1161 ni->ni_macaddr, "shared key response", 1162 "%s", "unknown station"); 1163 /* NB: don't send a response */ 1164 return; 1165 } 1166 if (ni->ni_challenge == NULL) { 1167 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1168 ni->ni_macaddr, "shared key response", 1169 "%s", "no challenge recorded"); 1170 ic->ic_stats.is_rx_bad_auth++; 1171 estatus = IEEE80211_STATUS_CHALLENGE; 1172 goto bad; 1173 } 1174 if (memcmp(ni->ni_challenge, &challenge[2], 1175 challenge[1]) != 0) { 1176 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1177 ni->ni_macaddr, "shared key response", 1178 "%s", "challenge mismatch"); 1179 ic->ic_stats.is_rx_auth_fail++; 1180 estatus = IEEE80211_STATUS_CHALLENGE; 1181 goto bad; 1182 } 1183 IEEE80211_DPRINTF(ic, 1184 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1185 "[%6D] station authenticated (shared key)\n", 1186 ni->ni_macaddr, ":"); 1187 ieee80211_node_authorize(ni); 1188 break; 1189 default: 1190 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1191 ni->ni_macaddr, "shared key auth", 1192 "bad seq %d", seq); 1193 ic->ic_stats.is_rx_bad_auth++; 1194 estatus = IEEE80211_STATUS_SEQUENCE; 1195 goto bad; 1196 } 1197 IEEE80211_SEND_MGMT(ic, ni, 1198 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1199 break; 1200 1201 case IEEE80211_M_STA: 1202 if (ic->ic_state != IEEE80211_S_AUTH) 1203 return; 1204 switch (seq) { 1205 case IEEE80211_AUTH_SHARED_PASS: 1206 if (ni->ni_challenge != NULL) { 1207 FREE(ni->ni_challenge, M_DEVBUF); 1208 ni->ni_challenge = NULL; 1209 } 1210 if (status != 0) { 1211 IEEE80211_DPRINTF(ic, 1212 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1213 "[%6D] shared key auth failed (reason %d)\n", 1214 ieee80211_getbssid(ic, wh), ":", status); 1215 /* XXX can this happen? */ 1216 if (ni != ic->ic_bss) 1217 ni->ni_fails++; 1218 ic->ic_stats.is_rx_auth_fail++; 1219 return; 1220 } 1221 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 1222 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 1223 break; 1224 case IEEE80211_AUTH_SHARED_CHALLENGE: 1225 if (!alloc_challenge(ic, ni)) 1226 return; 1227 /* XXX could optimize by passing recvd challenge */ 1228 memcpy(ni->ni_challenge, &challenge[2], challenge[1]); 1229 IEEE80211_SEND_MGMT(ic, ni, 1230 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1231 break; 1232 default: 1233 IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH, 1234 wh, "shared key auth", "bad seq %d", seq); 1235 ic->ic_stats.is_rx_bad_auth++; 1236 return; 1237 } 1238 break; 1239 } 1240 return; 1241 bad: 1242 /* 1243 * Send an error response; but only when operating as an AP. 1244 */ 1245 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 1246 /* XXX hack to workaround calling convention */ 1247 ieee80211_send_error(ic, ni, wh->i_addr2, 1248 IEEE80211_FC0_SUBTYPE_AUTH, 1249 (seq + 1) | (estatus<<16)); 1250 } else if (ic->ic_opmode == IEEE80211_M_STA) { 1251 /* 1252 * Kick the state machine. This short-circuits 1253 * using the mgt frame timeout to trigger the 1254 * state transition. 1255 */ 1256 if (ic->ic_state == IEEE80211_S_AUTH) 1257 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 1258 } 1259 } 1260 1261 /* Verify the existence and length of __elem or get out. */ 1262 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \ 1263 if ((__elem) == NULL) { \ 1264 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1265 wh, ieee80211_mgt_subtype_name[subtype >> \ 1266 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1267 "%s", "no " #__elem ); \ 1268 ic->ic_stats.is_rx_elem_missing++; \ 1269 return; \ 1270 } \ 1271 if ((__elem)[1] > (__maxlen)) { \ 1272 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1273 wh, ieee80211_mgt_subtype_name[subtype >> \ 1274 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1275 "bad " #__elem " len %d", (__elem)[1]); \ 1276 ic->ic_stats.is_rx_elem_toobig++; \ 1277 return; \ 1278 } \ 1279 } while (0) 1280 1281 #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \ 1282 if ((_len) < (_minlen)) { \ 1283 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1284 wh, ieee80211_mgt_subtype_name[subtype >> \ 1285 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1286 "%s", "ie too short"); \ 1287 ic->ic_stats.is_rx_elem_toosmall++; \ 1288 return; \ 1289 } \ 1290 } while (0) 1291 1292 #ifdef IEEE80211_DEBUG 1293 static void 1294 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag, 1295 uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid) 1296 { 1297 kprintf("[%6D] discard %s frame, ssid mismatch: ", mac, ":", tag); 1298 ieee80211_print_essid(ssid + 2, ssid[1]); 1299 kprintf("\n"); 1300 } 1301 1302 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1303 if ((_ssid)[1] != 0 && \ 1304 ((_ssid)[1] != (_ni)->ni_esslen || \ 1305 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1306 if (ieee80211_msg_input(ic)) \ 1307 ieee80211_ssid_mismatch(ic, \ 1308 ieee80211_mgt_subtype_name[subtype >> \ 1309 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1310 wh->i_addr2, _ssid); \ 1311 ic->ic_stats.is_rx_ssidmismatch++; \ 1312 return; \ 1313 } \ 1314 } while (0) 1315 #else /* !IEEE80211_DEBUG */ 1316 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1317 if ((_ssid)[1] != 0 && \ 1318 ((_ssid)[1] != (_ni)->ni_esslen || \ 1319 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1320 ic->ic_stats.is_rx_ssidmismatch++; \ 1321 return; \ 1322 } \ 1323 } while (0) 1324 #endif /* !IEEE80211_DEBUG */ 1325 1326 /* unalligned little endian access */ 1327 #define LE_READ_2(p) \ 1328 ((uint16_t) \ 1329 ((((const uint8_t *)(p))[0] ) | \ 1330 (((const uint8_t *)(p))[1] << 8))) 1331 #define LE_READ_4(p) \ 1332 ((uint32_t) \ 1333 ((((const uint8_t *)(p))[0] ) | \ 1334 (((const uint8_t *)(p))[1] << 8) | \ 1335 (((const uint8_t *)(p))[2] << 16) | \ 1336 (((const uint8_t *)(p))[3] << 24))) 1337 1338 static int __inline 1339 iswpaoui(const uint8_t *frm) 1340 { 1341 return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI); 1342 } 1343 1344 static int __inline 1345 iswmeoui(const uint8_t *frm) 1346 { 1347 return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI); 1348 } 1349 1350 static int __inline 1351 iswmeparam(const uint8_t *frm) 1352 { 1353 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1354 frm[6] == WME_PARAM_OUI_SUBTYPE; 1355 } 1356 1357 static int __inline 1358 iswmeinfo(const uint8_t *frm) 1359 { 1360 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1361 frm[6] == WME_INFO_OUI_SUBTYPE; 1362 } 1363 1364 static int __inline 1365 isatherosoui(const uint8_t *frm) 1366 { 1367 return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI); 1368 } 1369 1370 /* 1371 * Convert a WPA cipher selector OUI to an internal 1372 * cipher algorithm. Where appropriate we also 1373 * record any key length. 1374 */ 1375 static int 1376 wpa_cipher(uint8_t *sel, uint8_t *keylen) 1377 { 1378 #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1379 uint32_t w = LE_READ_4(sel); 1380 1381 switch (w) { 1382 case WPA_SEL(WPA_CSE_NULL): 1383 return IEEE80211_CIPHER_NONE; 1384 case WPA_SEL(WPA_CSE_WEP40): 1385 if (keylen) 1386 *keylen = 40 / NBBY; 1387 return IEEE80211_CIPHER_WEP; 1388 case WPA_SEL(WPA_CSE_WEP104): 1389 if (keylen) 1390 *keylen = 104 / NBBY; 1391 return IEEE80211_CIPHER_WEP; 1392 case WPA_SEL(WPA_CSE_TKIP): 1393 return IEEE80211_CIPHER_TKIP; 1394 case WPA_SEL(WPA_CSE_CCMP): 1395 return IEEE80211_CIPHER_AES_CCM; 1396 } 1397 return 32; /* NB: so 1<< is discarded */ 1398 #undef WPA_SEL 1399 } 1400 1401 /* 1402 * Convert a WPA key management/authentication algorithm 1403 * to an internal code. 1404 */ 1405 static int 1406 wpa_keymgmt(uint8_t *sel) 1407 { 1408 #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1409 uint32_t w = LE_READ_4(sel); 1410 1411 switch (w) { 1412 case WPA_SEL(WPA_ASE_8021X_UNSPEC): 1413 return WPA_ASE_8021X_UNSPEC; 1414 case WPA_SEL(WPA_ASE_8021X_PSK): 1415 return WPA_ASE_8021X_PSK; 1416 case WPA_SEL(WPA_ASE_NONE): 1417 return WPA_ASE_NONE; 1418 } 1419 return 0; /* NB: so is discarded */ 1420 #undef WPA_SEL 1421 } 1422 1423 /* 1424 * Parse a WPA information element to collect parameters 1425 * and validate the parameters against what has been 1426 * configured for the system. 1427 */ 1428 static int 1429 ieee80211_parse_wpa(struct ieee80211com *ic, uint8_t *frm, 1430 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1431 { 1432 uint8_t len = frm[1]; 1433 uint32_t w; 1434 int n; 1435 1436 /* 1437 * Check the length once for fixed parts: OUI, type, 1438 * version, mcast cipher, and 2 selector counts. 1439 * Other, variable-length data, must be checked separately. 1440 */ 1441 if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) { 1442 IEEE80211_DISCARD_IE(ic, 1443 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1444 wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags); 1445 return IEEE80211_REASON_IE_INVALID; 1446 } 1447 if (len < 14) { 1448 IEEE80211_DISCARD_IE(ic, 1449 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1450 wh, "WPA", "too short, len %u", len); 1451 return IEEE80211_REASON_IE_INVALID; 1452 } 1453 frm += 6, len -= 4; /* NB: len is payload only */ 1454 /* NB: iswapoui already validated the OUI and type */ 1455 w = LE_READ_2(frm); 1456 if (w != WPA_VERSION) { 1457 IEEE80211_DISCARD_IE(ic, 1458 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1459 wh, "WPA", "bad version %u", w); 1460 return IEEE80211_REASON_IE_INVALID; 1461 } 1462 frm += 2, len -= 2; 1463 1464 /* multicast/group cipher */ 1465 w = wpa_cipher(frm, &rsn->rsn_mcastkeylen); 1466 if (w != rsn->rsn_mcastcipher) { 1467 IEEE80211_DISCARD_IE(ic, 1468 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1469 wh, "WPA", "mcast cipher mismatch; got %u, expected %u", 1470 w, rsn->rsn_mcastcipher); 1471 return IEEE80211_REASON_IE_INVALID; 1472 } 1473 frm += 4, len -= 4; 1474 1475 /* unicast ciphers */ 1476 n = LE_READ_2(frm); 1477 frm += 2, len -= 2; 1478 if (len < n*4+2) { 1479 IEEE80211_DISCARD_IE(ic, 1480 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1481 wh, "WPA", "ucast cipher data too short; len %u, n %u", 1482 len, n); 1483 return IEEE80211_REASON_IE_INVALID; 1484 } 1485 w = 0; 1486 for (; n > 0; n--) { 1487 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen); 1488 frm += 4, len -= 4; 1489 } 1490 w &= rsn->rsn_ucastcipherset; 1491 if (w == 0) { 1492 IEEE80211_DISCARD_IE(ic, 1493 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1494 wh, "WPA", "%s", "ucast cipher set empty"); 1495 return IEEE80211_REASON_IE_INVALID; 1496 } 1497 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1498 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1499 else 1500 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1501 1502 /* key management algorithms */ 1503 n = LE_READ_2(frm); 1504 frm += 2, len -= 2; 1505 if (len < n*4) { 1506 IEEE80211_DISCARD_IE(ic, 1507 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1508 wh, "WPA", "key mgmt alg data too short; len %u, n %u", 1509 len, n); 1510 return IEEE80211_REASON_IE_INVALID; 1511 } 1512 w = 0; 1513 for (; n > 0; n--) { 1514 w |= wpa_keymgmt(frm); 1515 frm += 4, len -= 4; 1516 } 1517 w &= rsn->rsn_keymgmtset; 1518 if (w == 0) { 1519 IEEE80211_DISCARD_IE(ic, 1520 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1521 wh, "WPA", "%s", "no acceptable key mgmt alg"); 1522 return IEEE80211_REASON_IE_INVALID; 1523 } 1524 if (w & WPA_ASE_8021X_UNSPEC) 1525 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC; 1526 else 1527 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK; 1528 1529 if (len > 2) /* optional capabilities */ 1530 rsn->rsn_caps = LE_READ_2(frm); 1531 1532 return 0; 1533 } 1534 1535 /* 1536 * Convert an RSN cipher selector OUI to an internal 1537 * cipher algorithm. Where appropriate we also 1538 * record any key length. 1539 */ 1540 static int 1541 rsn_cipher(uint8_t *sel, uint8_t *keylen) 1542 { 1543 #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1544 uint32_t w = LE_READ_4(sel); 1545 1546 switch (w) { 1547 case RSN_SEL(RSN_CSE_NULL): 1548 return IEEE80211_CIPHER_NONE; 1549 case RSN_SEL(RSN_CSE_WEP40): 1550 if (keylen) 1551 *keylen = 40 / NBBY; 1552 return IEEE80211_CIPHER_WEP; 1553 case RSN_SEL(RSN_CSE_WEP104): 1554 if (keylen) 1555 *keylen = 104 / NBBY; 1556 return IEEE80211_CIPHER_WEP; 1557 case RSN_SEL(RSN_CSE_TKIP): 1558 return IEEE80211_CIPHER_TKIP; 1559 case RSN_SEL(RSN_CSE_CCMP): 1560 return IEEE80211_CIPHER_AES_CCM; 1561 case RSN_SEL(RSN_CSE_WRAP): 1562 return IEEE80211_CIPHER_AES_OCB; 1563 } 1564 return 32; /* NB: so 1<< is discarded */ 1565 #undef WPA_SEL 1566 } 1567 1568 /* 1569 * Convert an RSN key management/authentication algorithm 1570 * to an internal code. 1571 */ 1572 static int 1573 rsn_keymgmt(uint8_t *sel) 1574 { 1575 #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1576 uint32_t w = LE_READ_4(sel); 1577 1578 switch (w) { 1579 case RSN_SEL(RSN_ASE_8021X_UNSPEC): 1580 return RSN_ASE_8021X_UNSPEC; 1581 case RSN_SEL(RSN_ASE_8021X_PSK): 1582 return RSN_ASE_8021X_PSK; 1583 case RSN_SEL(RSN_ASE_NONE): 1584 return RSN_ASE_NONE; 1585 } 1586 return 0; /* NB: so is discarded */ 1587 #undef RSN_SEL 1588 } 1589 1590 /* 1591 * Parse a WPA/RSN information element to collect parameters 1592 * and validate the parameters against what has been 1593 * configured for the system. 1594 */ 1595 static int 1596 ieee80211_parse_rsn(struct ieee80211com *ic, uint8_t *frm, 1597 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1598 { 1599 uint8_t len = frm[1]; 1600 uint32_t w; 1601 int n; 1602 1603 /* 1604 * Check the length once for fixed parts: 1605 * version, mcast cipher, and 2 selector counts. 1606 * Other, variable-length data, must be checked separately. 1607 */ 1608 if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) { 1609 IEEE80211_DISCARD_IE(ic, 1610 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1611 wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags); 1612 return IEEE80211_REASON_IE_INVALID; 1613 } 1614 if (len < 10) { 1615 IEEE80211_DISCARD_IE(ic, 1616 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1617 wh, "RSN", "too short, len %u", len); 1618 return IEEE80211_REASON_IE_INVALID; 1619 } 1620 frm += 2; 1621 w = LE_READ_2(frm); 1622 if (w != RSN_VERSION) { 1623 IEEE80211_DISCARD_IE(ic, 1624 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1625 wh, "RSN", "bad version %u", w); 1626 return IEEE80211_REASON_IE_INVALID; 1627 } 1628 frm += 2, len -= 2; 1629 1630 /* multicast/group cipher */ 1631 w = rsn_cipher(frm, &rsn->rsn_mcastkeylen); 1632 if (w != rsn->rsn_mcastcipher) { 1633 IEEE80211_DISCARD_IE(ic, 1634 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1635 wh, "RSN", "mcast cipher mismatch; got %u, expected %u", 1636 w, rsn->rsn_mcastcipher); 1637 return IEEE80211_REASON_IE_INVALID; 1638 } 1639 frm += 4, len -= 4; 1640 1641 /* unicast ciphers */ 1642 n = LE_READ_2(frm); 1643 frm += 2, len -= 2; 1644 if (len < n*4+2) { 1645 IEEE80211_DISCARD_IE(ic, 1646 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1647 wh, "RSN", "ucast cipher data too short; len %u, n %u", 1648 len, n); 1649 return IEEE80211_REASON_IE_INVALID; 1650 } 1651 w = 0; 1652 for (; n > 0; n--) { 1653 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen); 1654 frm += 4, len -= 4; 1655 } 1656 w &= rsn->rsn_ucastcipherset; 1657 if (w == 0) { 1658 IEEE80211_DISCARD_IE(ic, 1659 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1660 wh, "RSN", "%s", "ucast cipher set empty"); 1661 return IEEE80211_REASON_IE_INVALID; 1662 } 1663 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1664 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1665 else 1666 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1667 1668 /* key management algorithms */ 1669 n = LE_READ_2(frm); 1670 frm += 2, len -= 2; 1671 if (len < n*4) { 1672 IEEE80211_DISCARD_IE(ic, 1673 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1674 wh, "RSN", "key mgmt alg data too short; len %u, n %u", 1675 len, n); 1676 return IEEE80211_REASON_IE_INVALID; 1677 } 1678 w = 0; 1679 for (; n > 0; n--) { 1680 w |= rsn_keymgmt(frm); 1681 frm += 4, len -= 4; 1682 } 1683 w &= rsn->rsn_keymgmtset; 1684 if (w == 0) { 1685 IEEE80211_DISCARD_IE(ic, 1686 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1687 wh, "RSN", "%s", "no acceptable key mgmt alg"); 1688 return IEEE80211_REASON_IE_INVALID; 1689 } 1690 if (w & RSN_ASE_8021X_UNSPEC) 1691 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC; 1692 else 1693 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK; 1694 1695 /* optional RSN capabilities */ 1696 if (len > 2) 1697 rsn->rsn_caps = LE_READ_2(frm); 1698 /* XXXPMKID */ 1699 1700 return 0; 1701 } 1702 1703 static int 1704 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm, 1705 const struct ieee80211_frame *wh) 1706 { 1707 #define MS(_v, _f) (((_v) & _f) >> _f##_S) 1708 struct ieee80211_wme_state *wme = &ic->ic_wme; 1709 u_int len = frm[1], qosinfo; 1710 int i; 1711 1712 if (len < sizeof(struct ieee80211_wme_param)-2) { 1713 IEEE80211_DISCARD_IE(ic, 1714 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME, 1715 wh, "WME", "too short, len %u", len); 1716 return -1; 1717 } 1718 qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)]; 1719 qosinfo &= WME_QOSINFO_COUNT; 1720 /* XXX do proper check for wraparound */ 1721 if (qosinfo == wme->wme_wmeChanParams.cap_info) 1722 return 0; 1723 frm += __offsetof(struct ieee80211_wme_param, params_acParams); 1724 for (i = 0; i < WME_NUM_AC; i++) { 1725 struct wmeParams *wmep = 1726 &wme->wme_wmeChanParams.cap_wmeParams[i]; 1727 /* NB: ACI not used */ 1728 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM); 1729 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN); 1730 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN); 1731 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX); 1732 wmep->wmep_txopLimit = LE_READ_2(frm+2); 1733 frm += 4; 1734 } 1735 wme->wme_wmeChanParams.cap_info = qosinfo; 1736 return 1; 1737 #undef MS 1738 } 1739 1740 void 1741 ieee80211_saveie(uint8_t **iep, const uint8_t *ie) 1742 { 1743 u_int ielen = ie[1]+2; 1744 /* 1745 * Record information element for later use. 1746 */ 1747 if (*iep == NULL || (*iep)[1] != ie[1]) { 1748 if (*iep != NULL) 1749 FREE(*iep, M_DEVBUF); 1750 MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT); 1751 } 1752 if (*iep != NULL) 1753 memcpy(*iep, ie, ielen); 1754 /* XXX note failure */ 1755 } 1756 1757 /* XXX find a better place for definition */ 1758 struct l2_update_frame { 1759 struct ether_header eh; 1760 uint8_t dsap; 1761 uint8_t ssap; 1762 uint8_t control; 1763 uint8_t xid[3]; 1764 } __packed; 1765 1766 /* 1767 * Deliver a TGf L2UF frame on behalf of a station. 1768 * This primes any bridge when the station is roaming 1769 * between ap's on the same wired network. 1770 */ 1771 static void 1772 ieee80211_deliver_l2uf(struct ieee80211_node *ni) 1773 { 1774 struct ieee80211com *ic = ni->ni_ic; 1775 struct ifnet *ifp = ic->ic_ifp; 1776 struct mbuf *m; 1777 struct l2_update_frame *l2uf; 1778 struct ether_header *eh; 1779 1780 m = m_gethdr(MB_DONTWAIT, MT_DATA); 1781 if (m == NULL) { 1782 IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni, 1783 "%s", "no mbuf for l2uf frame"); 1784 ic->ic_stats.is_rx_nobuf++; /* XXX not right */ 1785 return; 1786 } 1787 l2uf = mtod(m, struct l2_update_frame *); 1788 eh = &l2uf->eh; 1789 /* dst: Broadcast address */ 1790 IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr); 1791 /* src: associated STA */ 1792 IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr); 1793 eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh)); 1794 1795 l2uf->dsap = 0; 1796 l2uf->ssap = 0; 1797 l2uf->control = 0xf5; 1798 l2uf->xid[0] = 0x81; 1799 l2uf->xid[1] = 0x80; 1800 l2uf->xid[2] = 0x00; 1801 1802 m->m_pkthdr.len = m->m_len = sizeof(*l2uf); 1803 m->m_pkthdr.rcvif = ifp; 1804 ieee80211_deliver_data(ic, ni, m); 1805 } 1806 1807 void 1808 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, 1809 struct ieee80211_node *ni, 1810 int subtype, int rssi, uint32_t rstamp) 1811 { 1812 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP) 1813 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP) 1814 struct ieee80211_frame *wh; 1815 uint8_t *frm, *efrm; 1816 uint8_t *ssid, *rates, *xrates, *wpa, *wme; 1817 int reassoc, resp; 1818 uint8_t rate; 1819 1820 wh = mtod(m0, struct ieee80211_frame *); 1821 frm = (uint8_t *)&wh[1]; 1822 efrm = mtod(m0, uint8_t *) + m0->m_len; 1823 switch (subtype) { 1824 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 1825 case IEEE80211_FC0_SUBTYPE_BEACON: { 1826 struct ieee80211_scanparams scan; 1827 1828 /* 1829 * We process beacon/probe response frames: 1830 * o when scanning, or 1831 * o station mode when associated (to collect state 1832 * updates such as 802.11g slot time), or 1833 * o adhoc mode (to discover neighbors) 1834 * Frames otherwise received are discarded. 1835 */ 1836 if (!((ic->ic_flags & IEEE80211_F_SCAN) || 1837 (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) || 1838 ic->ic_opmode == IEEE80211_M_IBSS)) { 1839 ic->ic_stats.is_rx_mgtdiscard++; 1840 return; 1841 } 1842 /* 1843 * beacon/probe response frame format 1844 * [8] time stamp 1845 * [2] beacon interval 1846 * [2] capability information 1847 * [tlv] ssid 1848 * [tlv] supported rates 1849 * [tlv] country information 1850 * [tlv] parameter set (FH/DS) 1851 * [tlv] erp information 1852 * [tlv] extended supported rates 1853 * [tlv] WME 1854 * [tlv] WPA or RSN 1855 */ 1856 IEEE80211_VERIFY_LENGTH(efrm - frm, 12); 1857 memset(&scan, 0, sizeof(scan)); 1858 scan.tstamp = frm; frm += 8; 1859 scan.bintval = le16toh(*(uint16_t *)frm); frm += 2; 1860 scan.capinfo = le16toh(*(uint16_t *)frm); frm += 2; 1861 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan); 1862 scan.chan = scan.bchan; 1863 1864 while (efrm - frm > 1) { 1865 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 1866 switch (*frm) { 1867 case IEEE80211_ELEMID_SSID: 1868 scan.ssid = frm; 1869 break; 1870 case IEEE80211_ELEMID_RATES: 1871 scan.rates = frm; 1872 break; 1873 case IEEE80211_ELEMID_COUNTRY: 1874 scan.country = frm; 1875 break; 1876 case IEEE80211_ELEMID_FHPARMS: 1877 if (ic->ic_phytype == IEEE80211_T_FH) { 1878 scan.fhdwell = LE_READ_2(&frm[2]); 1879 scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]); 1880 scan.fhindex = frm[6]; 1881 } 1882 break; 1883 case IEEE80211_ELEMID_DSPARMS: 1884 /* 1885 * XXX hack this since depending on phytype 1886 * is problematic for multi-mode devices. 1887 */ 1888 if (ic->ic_phytype != IEEE80211_T_FH) 1889 scan.chan = frm[2]; 1890 break; 1891 case IEEE80211_ELEMID_TIM: 1892 /* XXX ATIM? */ 1893 scan.tim = frm; 1894 scan.timoff = frm - mtod(m0, uint8_t *); 1895 break; 1896 case IEEE80211_ELEMID_IBSSPARMS: 1897 break; 1898 case IEEE80211_ELEMID_XRATES: 1899 scan.xrates = frm; 1900 break; 1901 case IEEE80211_ELEMID_ERP: 1902 if (frm[1] != 1) { 1903 IEEE80211_DISCARD_IE(ic, 1904 IEEE80211_MSG_ELEMID, wh, "ERP", 1905 "bad len %u", frm[1]); 1906 ic->ic_stats.is_rx_elem_toobig++; 1907 break; 1908 } 1909 scan.erp = frm[2]; 1910 break; 1911 case IEEE80211_ELEMID_RSN: 1912 scan.wpa = frm; 1913 break; 1914 case IEEE80211_ELEMID_VENDOR: 1915 if (iswpaoui(frm)) 1916 scan.wpa = frm; 1917 else if (iswmeparam(frm) || iswmeinfo(frm)) 1918 scan.wme = frm; 1919 /* XXX Atheros OUI support */ 1920 break; 1921 default: 1922 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID, 1923 wh, "unhandled", 1924 "id %u, len %u", *frm, frm[1]); 1925 ic->ic_stats.is_rx_elem_unknown++; 1926 break; 1927 } 1928 frm += frm[1] + 2; 1929 } 1930 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE); 1931 if (scan.xrates != NULL) { 1932 IEEE80211_VERIFY_ELEMENT(scan.xrates, 1933 IEEE80211_RATE_MAXSIZE - scan.rates[1]); 1934 } 1935 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN); 1936 if ( 1937 #if IEEE80211_CHAN_MAX < 255 1938 scan.chan > IEEE80211_CHAN_MAX || 1939 #endif 1940 isclr(ic->ic_chan_active, scan.chan)) { 1941 IEEE80211_DISCARD(ic, 1942 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1943 wh, ieee80211_mgt_subtype_name[subtype >> 1944 IEEE80211_FC0_SUBTYPE_SHIFT], 1945 "invalid channel %u", scan.chan); 1946 ic->ic_stats.is_rx_badchan++; 1947 return; 1948 } 1949 if (scan.chan != scan.bchan && 1950 ic->ic_phytype != IEEE80211_T_FH) { 1951 /* 1952 * Frame was received on a channel different from the 1953 * one indicated in the DS params element id; 1954 * silently discard it. 1955 * 1956 * NB: this can happen due to signal leakage. 1957 * But we should take it for FH phy because 1958 * the rssi value should be correct even for 1959 * different hop pattern in FH. 1960 */ 1961 IEEE80211_DISCARD(ic, 1962 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1963 wh, ieee80211_mgt_subtype_name[subtype >> 1964 IEEE80211_FC0_SUBTYPE_SHIFT], 1965 "for off-channel %u", scan.chan); 1966 ic->ic_stats.is_rx_chanmismatch++; 1967 return; 1968 } 1969 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 1970 scan.bintval <= IEEE80211_BINTVAL_MAX)) { 1971 IEEE80211_DISCARD(ic, 1972 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1973 wh, ieee80211_mgt_subtype_name[subtype >> 1974 IEEE80211_FC0_SUBTYPE_SHIFT], 1975 "bogus beacon interval", scan.bintval); 1976 ic->ic_stats.is_rx_badbintval++; 1977 return; 1978 } 1979 1980 /* 1981 * Count frame now that we know it's to be processed. 1982 */ 1983 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) { 1984 ic->ic_stats.is_rx_beacon++; /* XXX remove */ 1985 IEEE80211_NODE_STAT(ni, rx_beacons); 1986 } else 1987 IEEE80211_NODE_STAT(ni, rx_proberesp); 1988 1989 /* 1990 * When operating in station mode, check for state updates. 1991 * Be careful to ignore beacons received while doing a 1992 * background scan. We consider only 11g/WMM stuff right now. 1993 */ 1994 if (ic->ic_opmode == IEEE80211_M_STA && 1995 ni->ni_associd != 0 && 1996 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 || 1997 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) { 1998 int update_shpreamble = 0; 1999 2000 /* record tsf of last beacon */ 2001 memcpy(ni->ni_tstamp.data, scan.tstamp, 2002 sizeof(ni->ni_tstamp)); 2003 /* count beacon frame for s/w bmiss handling */ 2004 ic->ic_swbmiss_count++; 2005 ic->ic_bmiss_count = 0; 2006 if (ni->ni_erp != scan.erp) { 2007 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2008 "[%6D] erp change: was 0x%x, now 0x%x\n", 2009 wh->i_addr2, ":", ni->ni_erp, scan.erp); 2010 if (ic->ic_curmode == IEEE80211_MODE_11G && 2011 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 2012 ic->ic_flags |= IEEE80211_F_USEPROT; 2013 else 2014 ic->ic_flags &= ~IEEE80211_F_USEPROT; 2015 2016 if ((ni->ni_erp ^ scan.erp) & IEEE80211_ERP_LONG_PREAMBLE) 2017 update_shpreamble = 1; 2018 2019 ni->ni_erp = scan.erp; 2020 /* XXX statistic */ 2021 } 2022 if (ni->ni_capinfo != scan.capinfo) { 2023 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2024 "[%6D] capabilities change: before 0x%x," 2025 " now 0x%x\n", 2026 wh->i_addr2, ":", 2027 ni->ni_capinfo, scan.capinfo); 2028 2029 if ((ni->ni_capinfo ^ scan.capinfo) & 2030 IEEE80211_CAPINFO_SHORT_SLOTTIME) { 2031 ieee80211_set_shortslottime(ic, 2032 ic->ic_curmode == IEEE80211_MODE_11A || 2033 (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2034 } 2035 2036 if ((ni->ni_capinfo ^ scan.capinfo) & 2037 IEEE80211_CAPINFO_SHORT_PREAMBLE) 2038 update_shpreamble = 1; 2039 2040 ni->ni_capinfo = scan.capinfo; 2041 /* XXX statistic */ 2042 } 2043 2044 if (update_shpreamble) 2045 ieee80211_update_shpreamble(ic, ni); 2046 2047 if (scan.wme != NULL && 2048 (ni->ni_flags & IEEE80211_NODE_QOS) && 2049 ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0) 2050 ieee80211_wme_updateparams(ic); 2051 if (scan.tim != NULL) { 2052 struct ieee80211_tim_ie *ie = 2053 (struct ieee80211_tim_ie *) scan.tim; 2054 2055 ni->ni_dtim_count = ie->tim_count; 2056 ni->ni_dtim_period = ie->tim_period; 2057 } 2058 if (ic->ic_flags & IEEE80211_F_SCAN) 2059 ieee80211_add_scan(ic, &scan, wh, 2060 subtype, rssi, rstamp); 2061 return; 2062 } 2063 /* 2064 * If scanning, just pass information to the scan module. 2065 */ 2066 if (ic->ic_flags & IEEE80211_F_SCAN) { 2067 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) { 2068 /* 2069 * Actively scanning a channel marked passive; 2070 * send a probe request now that we know there 2071 * is 802.11 traffic present. 2072 * 2073 * XXX check if the beacon we recv'd gives 2074 * us what we need and suppress the probe req 2075 */ 2076 ieee80211_probe_curchan(ic, 1); 2077 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN; 2078 } 2079 ieee80211_add_scan(ic, &scan, wh, 2080 subtype, rssi, rstamp); 2081 return; 2082 } 2083 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) { 2084 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 2085 /* 2086 * Create a new entry in the neighbor table. 2087 */ 2088 ni = ieee80211_add_neighbor(ic, wh, &scan); 2089 } else if (ni->ni_capinfo == 0) { 2090 /* 2091 * Update faked node created on transmit. 2092 * Note this also updates the tsf. 2093 */ 2094 ieee80211_init_neighbor(ni, wh, &scan); 2095 } else { 2096 /* 2097 * Record tsf for potential resync. 2098 */ 2099 memcpy(ni->ni_tstamp.data, scan.tstamp, 2100 sizeof(ni->ni_tstamp)); 2101 } 2102 if (ni != NULL) { 2103 ni->ni_rssi = rssi; 2104 ni->ni_rstamp = rstamp; 2105 } 2106 } 2107 break; 2108 } 2109 2110 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: { 2111 int is_tmpnode; 2112 2113 if (ic->ic_opmode == IEEE80211_M_STA || 2114 ic->ic_state != IEEE80211_S_RUN) { 2115 ic->ic_stats.is_rx_mgtdiscard++; 2116 return; 2117 } 2118 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) { 2119 /* frame must be directed */ 2120 ic->ic_stats.is_rx_mgtdiscard++; /* XXX stat */ 2121 return; 2122 } 2123 2124 /* 2125 * prreq frame format 2126 * [tlv] ssid 2127 * [tlv] supported rates 2128 * [tlv] extended supported rates 2129 */ 2130 ssid = rates = xrates = NULL; 2131 while (efrm - frm > 1) { 2132 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2133 switch (*frm) { 2134 case IEEE80211_ELEMID_SSID: 2135 ssid = frm; 2136 break; 2137 case IEEE80211_ELEMID_RATES: 2138 rates = frm; 2139 break; 2140 case IEEE80211_ELEMID_XRATES: 2141 xrates = frm; 2142 break; 2143 } 2144 frm += frm[1] + 2; 2145 } 2146 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2147 if (xrates != NULL) { 2148 IEEE80211_VERIFY_ELEMENT(xrates, 2149 IEEE80211_RATE_MAXSIZE - rates[1]); 2150 } 2151 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2152 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2153 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) { 2154 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 2155 wh, ieee80211_mgt_subtype_name[subtype >> 2156 IEEE80211_FC0_SUBTYPE_SHIFT], 2157 "%s", "no ssid with ssid suppression enabled"); 2158 ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/ 2159 return; 2160 } 2161 2162 is_tmpnode = 0; 2163 if (ni == ic->ic_bss) { 2164 if (ic->ic_opmode != IEEE80211_M_IBSS) { 2165 ni = ieee80211_tmp_node(ic, wh->i_addr2); 2166 is_tmpnode = 1; 2167 } else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 2168 /* 2169 * XXX Cannot tell if the sender is operating 2170 * in ibss mode. But we need a new node to 2171 * send the response so blindly add them to the 2172 * neighbor table. 2173 */ 2174 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 2175 wh->i_addr2); 2176 } 2177 if (ni == NULL) 2178 return; 2179 } 2180 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2181 "[%6D] recv probe req\n", wh->i_addr2, ":"); 2182 ni->ni_rssi = rssi; 2183 ni->ni_rstamp = rstamp; 2184 2185 /* 2186 * Since temporary node's rate set will not be used, 2187 * there is no need to do rate negotiation for it. 2188 */ 2189 if (!is_tmpnode) { 2190 ieee80211_setup_rates(ni, rates, xrates, 2191 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2192 IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 0); 2193 } 2194 2195 IEEE80211_SEND_MGMT(ic, ni, 2196 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0); 2197 if (is_tmpnode) { 2198 /* 2199 * Temporary node created just to send a 2200 * response, reclaim immediately. 2201 */ 2202 ieee80211_free_node(ni); 2203 } 2204 break; 2205 } 2206 2207 case IEEE80211_FC0_SUBTYPE_AUTH: { 2208 uint16_t algo, seq, status; 2209 /* 2210 * auth frame format 2211 * [2] algorithm 2212 * [2] sequence 2213 * [2] status 2214 * [tlv*] challenge 2215 */ 2216 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2217 algo = le16toh(*(uint16_t *)frm); 2218 seq = le16toh(*(uint16_t *)(frm + 2)); 2219 status = le16toh(*(uint16_t *)(frm + 4)); 2220 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2221 "[%6D] recv auth frame with algorithm %d seq %d\n", 2222 wh->i_addr2, ":", algo, seq); 2223 /* 2224 * Consult the ACL policy module if setup. 2225 */ 2226 if (ic->ic_acl != NULL && 2227 !ic->ic_acl->iac_check(ic, wh->i_addr2)) { 2228 IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL, 2229 wh, "auth", "%s", "disallowed by ACL"); 2230 ic->ic_stats.is_rx_acl++; 2231 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2232 IEEE80211_SEND_MGMT(ic, ni, 2233 IEEE80211_FC0_SUBTYPE_AUTH, 2234 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16)); 2235 } 2236 return; 2237 } 2238 if (ic->ic_flags & IEEE80211_F_COUNTERM) { 2239 IEEE80211_DISCARD(ic, 2240 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO, 2241 wh, "auth", "%s", "TKIP countermeasures enabled"); 2242 ic->ic_stats.is_rx_auth_countermeasures++; 2243 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2244 IEEE80211_SEND_MGMT(ic, ni, 2245 IEEE80211_FC0_SUBTYPE_AUTH, 2246 IEEE80211_REASON_MIC_FAILURE); 2247 } 2248 return; 2249 } 2250 if (algo == IEEE80211_AUTH_ALG_SHARED) 2251 ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi, 2252 rstamp, seq, status); 2253 else if (algo == IEEE80211_AUTH_ALG_OPEN) 2254 ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq, 2255 status); 2256 else { 2257 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2258 wh, "auth", "unsupported alg %d", algo); 2259 ic->ic_stats.is_rx_auth_unsupported++; 2260 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2261 /* XXX not right */ 2262 IEEE80211_SEND_MGMT(ic, ni, 2263 IEEE80211_FC0_SUBTYPE_AUTH, 2264 (seq+1) | (IEEE80211_STATUS_ALG<<16)); 2265 } 2266 return; 2267 } 2268 break; 2269 } 2270 2271 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 2272 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: { 2273 uint16_t capinfo, lintval; 2274 struct ieee80211_rsnparms rsn; 2275 uint8_t reason; 2276 2277 if (ic->ic_opmode != IEEE80211_M_HOSTAP || 2278 ic->ic_state != IEEE80211_S_RUN) { 2279 ic->ic_stats.is_rx_mgtdiscard++; 2280 return; 2281 } 2282 2283 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 2284 reassoc = 1; 2285 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP; 2286 } else { 2287 reassoc = 0; 2288 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP; 2289 } 2290 /* 2291 * asreq frame format 2292 * [2] capability information 2293 * [2] listen interval 2294 * [6*] current AP address (reassoc only) 2295 * [tlv] ssid 2296 * [tlv] supported rates 2297 * [tlv] extended supported rates 2298 * [tlv] WPA or RSN 2299 */ 2300 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4)); 2301 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) { 2302 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2303 wh, ieee80211_mgt_subtype_name[subtype >> 2304 IEEE80211_FC0_SUBTYPE_SHIFT], 2305 "%s", "wrong bssid"); 2306 ic->ic_stats.is_rx_assoc_bss++; 2307 return; 2308 } 2309 capinfo = le16toh(*(uint16_t *)frm); frm += 2; 2310 lintval = le16toh(*(uint16_t *)frm); frm += 2; 2311 if (reassoc) 2312 frm += 6; /* ignore current AP info */ 2313 ssid = rates = xrates = wpa = wme = NULL; 2314 while (efrm - frm > 1) { 2315 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2316 switch (*frm) { 2317 case IEEE80211_ELEMID_SSID: 2318 ssid = frm; 2319 break; 2320 case IEEE80211_ELEMID_RATES: 2321 rates = frm; 2322 break; 2323 case IEEE80211_ELEMID_XRATES: 2324 xrates = frm; 2325 break; 2326 /* XXX verify only one of RSN and WPA ie's? */ 2327 case IEEE80211_ELEMID_RSN: 2328 wpa = frm; 2329 break; 2330 case IEEE80211_ELEMID_VENDOR: 2331 if (iswpaoui(frm)) 2332 wpa = frm; 2333 else if (iswmeinfo(frm)) 2334 wme = frm; 2335 /* XXX Atheros OUI support */ 2336 break; 2337 } 2338 frm += frm[1] + 2; 2339 } 2340 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2341 if (xrates != NULL) { 2342 IEEE80211_VERIFY_ELEMENT(xrates, 2343 IEEE80211_RATE_MAXSIZE - rates[1]); 2344 } 2345 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2346 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2347 2348 if (ni == ic->ic_bss) { 2349 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2350 "[%6D] deny %s request, sta not authenticated\n", 2351 wh->i_addr2, ":", reassoc ? "reassoc" : "assoc"); 2352 ieee80211_send_error(ic, ni, wh->i_addr2, 2353 IEEE80211_FC0_SUBTYPE_DEAUTH, 2354 IEEE80211_REASON_ASSOC_NOT_AUTHED); 2355 ic->ic_stats.is_rx_assoc_notauth++; 2356 return; 2357 } 2358 /* assert right associstion security credentials */ 2359 if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) { 2360 IEEE80211_DPRINTF(ic, 2361 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2362 "[%6D] no WPA/RSN IE in association request\n", 2363 wh->i_addr2, ":"); 2364 IEEE80211_SEND_MGMT(ic, ni, 2365 IEEE80211_FC0_SUBTYPE_DEAUTH, 2366 IEEE80211_REASON_RSN_REQUIRED); 2367 ieee80211_node_leave(ic, ni); 2368 /* XXX distinguish WPA/RSN? */ 2369 ic->ic_stats.is_rx_assoc_badwpaie++; 2370 return; 2371 } 2372 if (wpa != NULL) { 2373 /* 2374 * Parse WPA information element. Note that 2375 * we initialize the param block from the node 2376 * state so that information in the IE overrides 2377 * our defaults. The resulting parameters are 2378 * installed below after the association is assured. 2379 */ 2380 rsn = ni->ni_rsn; 2381 if (wpa[0] != IEEE80211_ELEMID_RSN) 2382 reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh); 2383 else 2384 reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh); 2385 if (reason != 0) { 2386 IEEE80211_SEND_MGMT(ic, ni, 2387 IEEE80211_FC0_SUBTYPE_DEAUTH, reason); 2388 ieee80211_node_leave(ic, ni); 2389 /* XXX distinguish WPA/RSN? */ 2390 ic->ic_stats.is_rx_assoc_badwpaie++; 2391 return; 2392 } 2393 IEEE80211_DPRINTF(ic, 2394 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2395 "[%6D] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n", 2396 wh->i_addr2, ":", 2397 wpa[0] != IEEE80211_ELEMID_RSN ? "WPA" : "RSN", 2398 rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen, 2399 rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen, 2400 rsn.rsn_keymgmt, rsn.rsn_caps); 2401 } 2402 /* discard challenge after association */ 2403 if (ni->ni_challenge != NULL) { 2404 FREE(ni->ni_challenge, M_DEVBUF); 2405 ni->ni_challenge = NULL; 2406 } 2407 /* NB: 802.11 spec says to ignore station's privacy bit */ 2408 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) { 2409 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2410 "[%6D] deny %s request, capability mismatch 0x%x\n", 2411 wh->i_addr2, ":", 2412 reassoc ? "reassoc" : "assoc", capinfo); 2413 IEEE80211_SEND_MGMT(ic, ni, resp, 2414 IEEE80211_STATUS_CAPINFO); 2415 ieee80211_node_leave(ic, ni); 2416 ic->ic_stats.is_rx_assoc_capmismatch++; 2417 return; 2418 } 2419 rate = ieee80211_setup_rates(ni, rates, xrates, 2420 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2421 IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 0); 2422 if (rate & IEEE80211_RATE_BASIC) { 2423 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2424 "[%6D] deny %s request, rate set mismatch\n", 2425 wh->i_addr2, ":", 2426 reassoc ? "reassoc" : "assoc"); 2427 IEEE80211_SEND_MGMT(ic, ni, resp, 2428 IEEE80211_STATUS_BASIC_RATE); 2429 ieee80211_node_leave(ic, ni); 2430 ic->ic_stats.is_rx_assoc_norate++; 2431 return; 2432 } 2433 ni->ni_rssi = rssi; 2434 ni->ni_rstamp = rstamp; 2435 ni->ni_intval = lintval; 2436 ni->ni_capinfo = capinfo; 2437 ni->ni_chan = ic->ic_bss->ni_chan; 2438 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell; 2439 ni->ni_fhindex = ic->ic_bss->ni_fhindex; 2440 if (wpa != NULL) { 2441 /* 2442 * Record WPA/RSN parameters for station, mark 2443 * node as using WPA and record information element 2444 * for applications that require it. 2445 */ 2446 ni->ni_rsn = rsn; 2447 ieee80211_saveie(&ni->ni_wpa_ie, wpa); 2448 } else if (ni->ni_wpa_ie != NULL) { 2449 /* 2450 * Flush any state from a previous association. 2451 */ 2452 FREE(ni->ni_wpa_ie, M_DEVBUF); 2453 ni->ni_wpa_ie = NULL; 2454 } 2455 if (wme != NULL) { 2456 /* 2457 * Record WME parameters for station, mark node 2458 * as capable of QoS and record information 2459 * element for applications that require it. 2460 */ 2461 ieee80211_saveie(&ni->ni_wme_ie, wme); 2462 ni->ni_flags |= IEEE80211_NODE_QOS; 2463 } else if (ni->ni_wme_ie != NULL) { 2464 /* 2465 * Flush any state from a previous association. 2466 */ 2467 FREE(ni->ni_wme_ie, M_DEVBUF); 2468 ni->ni_wme_ie = NULL; 2469 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2470 } 2471 ieee80211_deliver_l2uf(ni); 2472 ieee80211_node_join(ic, ni, resp); 2473 break; 2474 } 2475 2476 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 2477 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: { 2478 uint16_t capinfo, associd; 2479 uint16_t status; 2480 2481 if (ic->ic_opmode != IEEE80211_M_STA || 2482 ic->ic_state != IEEE80211_S_ASSOC) { 2483 ic->ic_stats.is_rx_mgtdiscard++; 2484 return; 2485 } 2486 2487 /* 2488 * asresp frame format 2489 * [2] capability information 2490 * [2] status 2491 * [2] association ID 2492 * [tlv] supported rates 2493 * [tlv] extended supported rates 2494 * [tlv] WME 2495 */ 2496 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2497 ni = ic->ic_bss; 2498 capinfo = le16toh(*(uint16_t *)frm); 2499 frm += 2; 2500 status = le16toh(*(uint16_t *)frm); 2501 frm += 2; 2502 if (status != 0) { 2503 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2504 "[%6D] %sassoc failed (reason %d)\n", 2505 wh->i_addr2, ":", 2506 ISREASSOC(subtype) ? "re" : "", status); 2507 if (ni != ic->ic_bss) /* XXX never true? */ 2508 ni->ni_fails++; 2509 ic->ic_stats.is_rx_auth_fail++; /* XXX */ 2510 return; 2511 } 2512 associd = le16toh(*(uint16_t *)frm); 2513 frm += 2; 2514 2515 rates = xrates = wpa = wme = NULL; 2516 while (efrm - frm > 1) { 2517 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2); 2518 switch (*frm) { 2519 case IEEE80211_ELEMID_RATES: 2520 rates = frm; 2521 break; 2522 case IEEE80211_ELEMID_XRATES: 2523 xrates = frm; 2524 break; 2525 case IEEE80211_ELEMID_VENDOR: 2526 if (iswmeoui(frm)) 2527 wme = frm; 2528 /* XXX Atheros OUI support */ 2529 break; 2530 } 2531 frm += frm[1] + 2; 2532 } 2533 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2534 if (xrates != NULL) { 2535 IEEE80211_VERIFY_ELEMENT(xrates, 2536 IEEE80211_RATE_MAXSIZE - rates[1]); 2537 } 2538 2539 rate = ieee80211_setup_rates(ni, rates, xrates, 2540 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2541 IEEE80211_F_DONEGO | IEEE80211_F_DODEL, 1); 2542 if (rate & IEEE80211_RATE_BASIC) { 2543 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2544 "[%6D] %sassoc failed (rate set mismatch)\n", 2545 wh->i_addr2, ":", 2546 ISREASSOC(subtype) ? "re" : ""); 2547 if (ni != ic->ic_bss) /* XXX never true? */ 2548 ni->ni_fails++; 2549 ic->ic_stats.is_rx_assoc_norate++; 2550 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 2551 return; 2552 } 2553 2554 ni->ni_capinfo = capinfo; 2555 ni->ni_associd = associd; 2556 if (wme != NULL && 2557 ieee80211_parse_wmeparams(ic, wme, wh) >= 0) { 2558 ni->ni_flags |= IEEE80211_NODE_QOS; 2559 ieee80211_wme_updateparams(ic); 2560 } else 2561 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2562 /* 2563 * Configure state now that we are associated. 2564 * 2565 * XXX may need different/additional driver callbacks? 2566 */ 2567 ieee80211_update_shpreamble(ic, ni); 2568 ieee80211_set_shortslottime(ic, 2569 ic->ic_curmode == IEEE80211_MODE_11A || 2570 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2571 /* 2572 * Honor ERP protection. 2573 * 2574 * NB: ni_erp should zero for non-11g operation. 2575 * XXX check ic_curmode anyway? 2576 */ 2577 if (ic->ic_curmode == IEEE80211_MODE_11G && 2578 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 2579 ic->ic_flags |= IEEE80211_F_USEPROT; 2580 else 2581 ic->ic_flags &= ~IEEE80211_F_USEPROT; 2582 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2583 "[%6D] %sassoc success: %s preamble, %s slot time%s%s\n", 2584 wh->i_addr2, ":", 2585 ISREASSOC(subtype) ? "re" : "", 2586 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long", 2587 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long", 2588 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "", 2589 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "" 2590 ); 2591 IEEE80211_PRINT_NODERATES(ic, ni, IEEE80211_MSG_ASSOC); 2592 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype); 2593 break; 2594 } 2595 2596 case IEEE80211_FC0_SUBTYPE_DEAUTH: { 2597 uint16_t reason; 2598 2599 if (ic->ic_state == IEEE80211_S_SCAN) { 2600 ic->ic_stats.is_rx_mgtdiscard++; 2601 return; 2602 } 2603 /* 2604 * deauth frame format 2605 * [2] reason 2606 */ 2607 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2608 reason = le16toh(*(uint16_t *)frm); 2609 ic->ic_stats.is_rx_deauth++; 2610 IEEE80211_NODE_STAT(ni, rx_deauth); 2611 2612 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) { 2613 /* NB: can happen when in promiscuous mode */ 2614 ic->ic_stats.is_rx_mgtdiscard++; 2615 break; 2616 } 2617 2618 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2619 "[%6D] recv deauthenticate (reason %d)\n", 2620 ni->ni_macaddr, ":", reason); 2621 switch (ic->ic_opmode) { 2622 case IEEE80211_M_STA: 2623 ieee80211_new_state(ic, IEEE80211_S_AUTH, 2624 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2625 break; 2626 case IEEE80211_M_HOSTAP: 2627 if (ni != ic->ic_bss) 2628 ieee80211_node_leave(ic, ni); 2629 break; 2630 default: 2631 ic->ic_stats.is_rx_mgtdiscard++; 2632 break; 2633 } 2634 break; 2635 } 2636 2637 case IEEE80211_FC0_SUBTYPE_DISASSOC: { 2638 uint16_t reason; 2639 2640 if (ic->ic_state != IEEE80211_S_RUN && 2641 ic->ic_state != IEEE80211_S_ASSOC && 2642 ic->ic_state != IEEE80211_S_AUTH) { 2643 ic->ic_stats.is_rx_mgtdiscard++; 2644 return; 2645 } 2646 /* 2647 * disassoc frame format 2648 * [2] reason 2649 */ 2650 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2651 reason = le16toh(*(uint16_t *)frm); 2652 ic->ic_stats.is_rx_disassoc++; 2653 IEEE80211_NODE_STAT(ni, rx_disassoc); 2654 2655 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) { 2656 /* NB: can happen when in promiscuous mode */ 2657 ic->ic_stats.is_rx_mgtdiscard++; 2658 break; 2659 } 2660 2661 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2662 "[%6D] recv disassociate (reason %d)\n", 2663 ni->ni_macaddr, ":", reason); 2664 switch (ic->ic_opmode) { 2665 case IEEE80211_M_STA: 2666 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 2667 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2668 break; 2669 case IEEE80211_M_HOSTAP: 2670 if (ni != ic->ic_bss) 2671 ieee80211_node_leave(ic, ni); 2672 break; 2673 default: 2674 ic->ic_stats.is_rx_mgtdiscard++; 2675 break; 2676 } 2677 break; 2678 } 2679 default: 2680 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2681 wh, "mgt", "subtype 0x%x not handled", subtype); 2682 ic->ic_stats.is_rx_badsubtype++; 2683 break; 2684 } 2685 #undef ISREASSOC 2686 #undef ISPROBE 2687 } 2688 #undef IEEE80211_VERIFY_LENGTH 2689 #undef IEEE80211_VERIFY_ELEMENT 2690 2691 /* 2692 * Handle station power-save state change. 2693 */ 2694 static void 2695 ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable) 2696 { 2697 struct ieee80211com *ic = ni->ni_ic; 2698 struct mbuf *m; 2699 2700 ASSERT_SERIALIZED(ic->ic_ifp->if_serializer); 2701 2702 if (enable) { 2703 if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) 2704 ic->ic_ps_sta++; 2705 ni->ni_flags |= IEEE80211_NODE_PWR_MGT; 2706 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2707 "[%6D] power save mode on, %u sta's in ps mode\n", 2708 ni->ni_macaddr, ":", ic->ic_ps_sta); 2709 return; 2710 } 2711 2712 if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) 2713 ic->ic_ps_sta--; 2714 ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT; 2715 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2716 "[%6D] power save mode off, %u sta's in ps mode\n", 2717 ni->ni_macaddr, ":", ic->ic_ps_sta); 2718 /* XXX if no stations in ps mode, flush mc frames */ 2719 2720 /* 2721 * Flush queued unicast frames. 2722 */ 2723 if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) { 2724 if (ic->ic_set_tim != NULL) 2725 ic->ic_set_tim(ni, 0); /* just in case */ 2726 return; 2727 } 2728 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2729 "[%6D] flush ps queue, %u packets queued\n", 2730 ni->ni_macaddr, ":", IEEE80211_NODE_SAVEQ_QLEN(ni)); 2731 for (;;) { 2732 int qlen; 2733 2734 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2735 if (m == NULL) 2736 break; 2737 /* 2738 * If this is the last packet, turn off the TIM bit. 2739 * If there are more packets, set the more packets bit 2740 * in the mbuf so ieee80211_encap will mark the 802.11 2741 * head to indicate more data frames will follow. 2742 */ 2743 if (qlen != 0) 2744 m->m_flags |= M_MORE_DATA; 2745 /* XXX need different driver interface */ 2746 /* XXX bypasses q max */ 2747 /* XXX bypasses ALTQ */ 2748 ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL); 2749 } 2750 if (ic->ic_set_tim != NULL) 2751 ic->ic_set_tim(ni, 0); 2752 } 2753 2754 /* 2755 * Process a received ps-poll frame. 2756 */ 2757 static void 2758 ieee80211_recv_pspoll(struct ieee80211com *ic, 2759 struct ieee80211_node *ni, struct mbuf *m0) 2760 { 2761 struct ieee80211_frame_min *wh; 2762 struct mbuf *m; 2763 uint16_t aid; 2764 int qlen; 2765 2766 ASSERT_SERIALIZED(ic->ic_ifp->if_serializer); 2767 2768 wh = mtod(m0, struct ieee80211_frame_min *); 2769 if (ni->ni_associd == 0) { 2770 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2771 (struct ieee80211_frame *) wh, "ps-poll", 2772 "%s", "unassociated station"); 2773 ic->ic_stats.is_ps_unassoc++; 2774 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2775 IEEE80211_REASON_NOT_ASSOCED); 2776 return; 2777 } 2778 2779 aid = le16toh(*(uint16_t *)wh->i_dur); 2780 if (aid != ni->ni_associd) { 2781 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2782 (struct ieee80211_frame *) wh, "ps-poll", 2783 "aid mismatch: sta aid 0x%x poll aid 0x%x", 2784 ni->ni_associd, aid); 2785 ic->ic_stats.is_ps_badaid++; 2786 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2787 IEEE80211_REASON_NOT_ASSOCED); 2788 return; 2789 } 2790 2791 /* Okay, take the first queued packet and put it out... */ 2792 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2793 if (m == NULL) { 2794 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2795 "[%6D] recv ps-poll, but queue empty\n", 2796 wh->i_addr2, ":"); 2797 ieee80211_send_nulldata(ieee80211_ref_node(ni)); 2798 ic->ic_stats.is_ps_qempty++; /* XXX node stat */ 2799 if (ic->ic_set_tim != NULL) 2800 ic->ic_set_tim(ni, 0); /* just in case */ 2801 return; 2802 } 2803 /* 2804 * If there are more packets, set the more packets bit 2805 * in the packet dispatched to the station; otherwise 2806 * turn off the TIM bit. 2807 */ 2808 if (qlen != 0) { 2809 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2810 "[%6D] recv ps-poll, send packet, %u still queued\n", 2811 ni->ni_macaddr, ":", qlen); 2812 m->m_flags |= M_MORE_DATA; 2813 } else { 2814 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2815 "[%6D] recv ps-poll, send packet, queue empty\n", 2816 ni->ni_macaddr, ":"); 2817 if (ic->ic_set_tim != NULL) 2818 ic->ic_set_tim(ni, 0); 2819 } 2820 m->m_flags |= M_PWR_SAV; /* bypass PS handling */ 2821 ifq_enqueue(&ic->ic_ifp->if_snd, m, NULL); /* XXX bypasses ALTQ */ 2822 } 2823 2824 #ifdef IEEE80211_DEBUG 2825 /* 2826 * Debugging support. 2827 */ 2828 2829 /* 2830 * Return the bssid of a frame. 2831 */ 2832 static const uint8_t * 2833 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh) 2834 { 2835 if (ic->ic_opmode == IEEE80211_M_STA) 2836 return wh->i_addr2; 2837 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS) 2838 return wh->i_addr1; 2839 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL) 2840 return wh->i_addr1; 2841 return wh->i_addr3; 2842 } 2843 2844 void 2845 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...) 2846 { 2847 char buf[128]; /* XXX */ 2848 __va_list ap; 2849 2850 __va_start(ap, fmt); 2851 kvsnprintf(buf, sizeof(buf), fmt, ap); 2852 __va_end(ap); 2853 2854 if_printf(ic->ic_ifp, "%s", buf); /* NB: no \n */ 2855 } 2856 2857 void 2858 ieee80211_note_frame(struct ieee80211com *ic, 2859 const struct ieee80211_frame *wh, 2860 const char *fmt, ...) 2861 { 2862 char buf[128]; /* XXX */ 2863 __va_list ap; 2864 2865 __va_start(ap, fmt); 2866 kvsnprintf(buf, sizeof(buf), fmt, ap); 2867 __va_end(ap); 2868 if_printf(ic->ic_ifp, "[%6D] %s\n", 2869 ieee80211_getbssid(ic, wh), ":", buf); 2870 } 2871 2872 void 2873 ieee80211_note_mac(struct ieee80211com *ic, 2874 const uint8_t mac[IEEE80211_ADDR_LEN], 2875 const char *fmt, ...) 2876 { 2877 char buf[128]; /* XXX */ 2878 __va_list ap; 2879 2880 __va_start(ap, fmt); 2881 kvsnprintf(buf, sizeof(buf), fmt, ap); 2882 __va_end(ap); 2883 if_printf(ic->ic_ifp, "[%6D] %s\n", mac, ":", buf); 2884 } 2885 2886 static void 2887 ieee80211_discard_frame(struct ieee80211com *ic, 2888 const struct ieee80211_frame *wh, 2889 const char *type, const char *fmt, ...) 2890 { 2891 __va_list ap; 2892 2893 kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname, 2894 ieee80211_getbssid(ic, wh), ":"); 2895 if (type != NULL) 2896 kprintf("%s frame, ", type); 2897 else 2898 kprintf("frame, "); 2899 __va_start(ap, fmt); 2900 kvprintf(fmt, ap); 2901 __va_end(ap); 2902 kprintf("\n"); 2903 } 2904 2905 static void 2906 ieee80211_discard_ie(struct ieee80211com *ic, 2907 const struct ieee80211_frame *wh, 2908 const char *type, const char *fmt, ...) 2909 { 2910 __va_list ap; 2911 2912 kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname, 2913 ieee80211_getbssid(ic, wh), ":"); 2914 if (type != NULL) 2915 kprintf("%s information element, ", type); 2916 else 2917 kprintf("information element, "); 2918 __va_start(ap, fmt); 2919 kvprintf(fmt, ap); 2920 __va_end(ap); 2921 kprintf("\n"); 2922 } 2923 2924 static void 2925 ieee80211_discard_mac(struct ieee80211com *ic, 2926 const uint8_t mac[IEEE80211_ADDR_LEN], 2927 const char *type, const char *fmt, ...) 2928 { 2929 __va_list ap; 2930 2931 kprintf("[%s:%6D] discard ", ic->ic_ifp->if_xname, mac, ":"); 2932 if (type != NULL) 2933 kprintf("%s frame, ", type); 2934 else 2935 kprintf("frame, "); 2936 __va_start(ap, fmt); 2937 kvprintf(fmt, ap); 2938 __va_end(ap); 2939 kprintf("\n"); 2940 } 2941 #endif /* IEEE80211_DEBUG */ 2942