ieee80211_input.c revision 1.50
1 /* $NetBSD: ieee80211_input.c,v 1.50 2005/11/20 10:04:21 dyoung Exp $ */ 2 /*- 3 * Copyright (c) 2001 Atsushi Onoe 4 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote products 16 * derived from this software without specific prior written permission. 17 * 18 * Alternatively, this software may be distributed under the terms of the 19 * GNU General Public License ("GPL") version 2 as published by the Free 20 * Software Foundation. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 #ifdef __FreeBSD__ 36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.81 2005/08/10 16:22:29 sam Exp $"); 37 #endif 38 #ifdef __NetBSD__ 39 __KERNEL_RCSID(0, "$NetBSD: ieee80211_input.c,v 1.50 2005/11/20 10:04:21 dyoung Exp $"); 40 #endif 41 42 #include "opt_inet.h" 43 44 #ifdef __NetBSD__ 45 #include "bpfilter.h" 46 #endif /* __NetBSD__ */ 47 48 #include <sys/param.h> 49 #include <sys/systm.h> 50 #include <sys/mbuf.h> 51 #include <sys/malloc.h> 52 #include <sys/endian.h> 53 #include <sys/kernel.h> 54 55 #include <sys/socket.h> 56 #include <sys/sockio.h> 57 #include <sys/endian.h> 58 #include <sys/errno.h> 59 #include <sys/proc.h> 60 #include <sys/sysctl.h> 61 62 #include <net/if.h> 63 #include <net/if_media.h> 64 #include <net/if_arp.h> 65 #include <net/if_ether.h> 66 #include <net/if_llc.h> 67 68 #include <net80211/ieee80211_netbsd.h> 69 #include <net80211/ieee80211_var.h> 70 71 #if NBPFILTER > 0 72 #include <net/bpf.h> 73 #endif 74 75 #ifdef INET 76 #include <netinet/in.h> 77 #include <net/if_ether.h> 78 #endif 79 80 const struct timeval ieee80211_merge_print_intvl = {.tv_sec = 1, .tv_usec = 0}; 81 82 #ifdef IEEE80211_DEBUG 83 #include <machine/stdarg.h> 84 85 /* 86 * Decide if a received management frame should be 87 * printed when debugging is enabled. This filters some 88 * of the less interesting frames that come frequently 89 * (e.g. beacons). 90 */ 91 static __inline int 92 doprint(struct ieee80211com *ic, int subtype) 93 { 94 switch (subtype) { 95 case IEEE80211_FC0_SUBTYPE_BEACON: 96 return (ic->ic_flags & IEEE80211_F_SCAN); 97 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 98 return (ic->ic_opmode == IEEE80211_M_IBSS); 99 } 100 return 1; 101 } 102 103 /* 104 * Emit a debug message about discarding a frame or information 105 * element. One format is for extracting the mac address from 106 * the frame header; the other is for when a header is not 107 * available or otherwise appropriate. 108 */ 109 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do { \ 110 if ((_ic)->ic_debug & (_m)) \ 111 ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\ 112 } while (0) 113 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do { \ 114 if ((_ic)->ic_debug & (_m)) \ 115 ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\ 116 } while (0) 117 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do { \ 118 if ((_ic)->ic_debug & (_m)) \ 119 ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\ 120 } while (0) 121 122 static const u_int8_t *ieee80211_getbssid(struct ieee80211com *, 123 const struct ieee80211_frame *); 124 static void ieee80211_discard_frame(struct ieee80211com *, 125 const struct ieee80211_frame *, const char *type, const char *fmt, ...); 126 static void ieee80211_discard_ie(struct ieee80211com *, 127 const struct ieee80211_frame *, const char *type, const char *fmt, ...); 128 static void ieee80211_discard_mac(struct ieee80211com *, 129 const u_int8_t mac[IEEE80211_ADDR_LEN], const char *type, 130 const char *fmt, ...); 131 #else 132 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) 133 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) 134 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) 135 #endif /* IEEE80211_DEBUG */ 136 137 static struct mbuf *ieee80211_defrag(struct ieee80211com *, 138 struct ieee80211_node *, struct mbuf *, int); 139 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int); 140 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *, 141 const u_int8_t *mac, int subtype, int arg); 142 #ifndef IEEE80211_NO_HOSTAP 143 static void ieee80211_deliver_data(struct ieee80211com *, 144 struct ieee80211_node *, struct mbuf *); 145 static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable); 146 static void ieee80211_recv_pspoll(struct ieee80211com *, 147 struct ieee80211_node *, struct mbuf *); 148 #endif /* !IEEE80211_NO_HOSTAP */ 149 150 /* 151 * Process a received frame. The node associated with the sender 152 * should be supplied. If nothing was found in the node table then 153 * the caller is assumed to supply a reference to ic_bss instead. 154 * The RSSI and a timestamp are also supplied. The RSSI data is used 155 * during AP scanning to select a AP to associate with; it can have 156 * any units so long as values have consistent units and higher values 157 * mean ``better signal''. The receive timestamp is currently not used 158 * by the 802.11 layer. 159 */ 160 int 161 ieee80211_input(struct ieee80211com *ic, struct mbuf *m, 162 struct ieee80211_node *ni, int rssi, u_int32_t rstamp) 163 { 164 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0) 165 #define HAS_SEQ(type) ((type & 0x4) == 0) 166 struct ifnet *ifp = ic->ic_ifp; 167 struct ieee80211_frame *wh; 168 struct ieee80211_key *key; 169 struct ether_header *eh; 170 int hdrspace; 171 u_int8_t dir, type, subtype; 172 u_int8_t *bssid; 173 u_int16_t rxseq; 174 175 IASSERT(ni != NULL, ("null node")); 176 ni->ni_inact = ni->ni_inact_reload; 177 178 /* trim CRC here so WEP can find its own CRC at the end of packet. */ 179 if (m->m_flags & M_HASFCS) { 180 m_adj(m, -IEEE80211_CRC_LEN); 181 m->m_flags &= ~M_HASFCS; 182 } 183 type = -1; /* undefined */ 184 /* 185 * In monitor mode, send everything directly to bpf. 186 * XXX may want to include the CRC 187 */ 188 if (ic->ic_opmode == IEEE80211_M_MONITOR) 189 goto out; 190 191 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) { 192 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 193 ni->ni_macaddr, NULL, 194 "too short (1): len %u", m->m_pkthdr.len); 195 ic->ic_stats.is_rx_tooshort++; 196 goto out; 197 } 198 /* 199 * Bit of a cheat here, we use a pointer for a 3-address 200 * frame format but don't reference fields past outside 201 * ieee80211_frame_min w/o first validating the data is 202 * present. 203 */ 204 wh = mtod(m, struct ieee80211_frame *); 205 206 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) != 207 IEEE80211_FC0_VERSION_0) { 208 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 209 ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]); 210 ic->ic_stats.is_rx_badversion++; 211 goto err; 212 } 213 214 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 215 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 216 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 217 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) { 218 switch (ic->ic_opmode) { 219 case IEEE80211_M_STA: 220 bssid = wh->i_addr2; 221 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) { 222 /* not interested in */ 223 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 224 bssid, NULL, "%s", "not to bss"); 225 ic->ic_stats.is_rx_wrongbss++; 226 goto out; 227 } 228 break; 229 case IEEE80211_M_IBSS: 230 case IEEE80211_M_AHDEMO: 231 case IEEE80211_M_HOSTAP: 232 if (dir != IEEE80211_FC1_DIR_NODS) 233 bssid = wh->i_addr1; 234 else if (type == IEEE80211_FC0_TYPE_CTL) 235 bssid = wh->i_addr1; 236 else { 237 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 238 IEEE80211_DISCARD_MAC(ic, 239 IEEE80211_MSG_ANY, ni->ni_macaddr, 240 NULL, "too short (2): len %u", 241 m->m_pkthdr.len); 242 ic->ic_stats.is_rx_tooshort++; 243 goto out; 244 } 245 bssid = wh->i_addr3; 246 } 247 if (type != IEEE80211_FC0_TYPE_DATA) 248 break; 249 /* 250 * Data frame, validate the bssid. 251 */ 252 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) && 253 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) { 254 /* not interested in */ 255 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 256 bssid, NULL, "%s", "not to bss"); 257 ic->ic_stats.is_rx_wrongbss++; 258 goto out; 259 } 260 /* 261 * For adhoc mode we cons up a node when it doesn't 262 * exist. This should probably done after an ACL check. 263 */ 264 if (ni == ic->ic_bss && 265 ic->ic_opmode != IEEE80211_M_HOSTAP && 266 !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 267 /* 268 * Fake up a node for this newly 269 * discovered member of the IBSS. 270 */ 271 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 272 wh->i_addr2); 273 if (ni == NULL) { 274 /* NB: stat kept for alloc failure */ 275 goto err; 276 } 277 } 278 break; 279 default: 280 goto out; 281 } 282 ni->ni_rssi = rssi; 283 ni->ni_rstamp = rstamp; 284 if (HAS_SEQ(type)) { 285 u_int8_t tid; 286 if (IEEE80211_QOS_HAS_SEQ(wh)) { 287 tid = ((struct ieee80211_qosframe *)wh)-> 288 i_qos[0] & IEEE80211_QOS_TID; 289 if (TID_TO_WME_AC(tid) >= WME_AC_VI) 290 ic->ic_wme.wme_hipri_traffic++; 291 tid++; 292 } else 293 tid = 0; 294 rxseq = le16toh(*(u_int16_t *)wh->i_seq); 295 if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) && 296 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) { 297 /* duplicate, discard */ 298 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 299 bssid, "duplicate", 300 "seqno <%u,%u> fragno <%u,%u> tid %u", 301 rxseq >> IEEE80211_SEQ_SEQ_SHIFT, 302 ni->ni_rxseqs[tid] >> 303 IEEE80211_SEQ_SEQ_SHIFT, 304 rxseq & IEEE80211_SEQ_FRAG_MASK, 305 ni->ni_rxseqs[tid] & 306 IEEE80211_SEQ_FRAG_MASK, 307 tid); 308 ic->ic_stats.is_rx_dup++; 309 IEEE80211_NODE_STAT(ni, rx_dup); 310 goto out; 311 } 312 ni->ni_rxseqs[tid] = rxseq; 313 } 314 } 315 316 switch (type) { 317 case IEEE80211_FC0_TYPE_DATA: 318 hdrspace = ieee80211_hdrspace(ic, wh); 319 if (m->m_len < hdrspace && 320 (m = m_pullup(m, hdrspace)) == NULL) { 321 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 322 ni->ni_macaddr, NULL, 323 "data too short: expecting %u", hdrspace); 324 ic->ic_stats.is_rx_tooshort++; 325 goto out; /* XXX */ 326 } 327 switch (ic->ic_opmode) { 328 case IEEE80211_M_STA: 329 if (dir != IEEE80211_FC1_DIR_FROMDS) { 330 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 331 wh, "data", "%s", "unknown dir 0x%x", dir); 332 ic->ic_stats.is_rx_wrongdir++; 333 goto out; 334 } 335 if ((ifp->if_flags & IFF_SIMPLEX) && 336 IEEE80211_IS_MULTICAST(wh->i_addr1) && 337 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) { 338 /* 339 * In IEEE802.11 network, multicast packet 340 * sent from me is broadcasted from AP. 341 * It should be silently discarded for 342 * SIMPLEX interface. 343 */ 344 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 345 wh, NULL, "%s", "multicast echo"); 346 ic->ic_stats.is_rx_mcastecho++; 347 goto out; 348 } 349 break; 350 case IEEE80211_M_IBSS: 351 case IEEE80211_M_AHDEMO: 352 if (dir != IEEE80211_FC1_DIR_NODS) { 353 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 354 wh, "data", "%s", "unknown dir 0x%x", dir); 355 ic->ic_stats.is_rx_wrongdir++; 356 goto out; 357 } 358 /* XXX no power-save support */ 359 break; 360 case IEEE80211_M_HOSTAP: 361 #ifndef IEEE80211_NO_HOSTAP 362 if (dir != IEEE80211_FC1_DIR_TODS) { 363 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 364 wh, "data", "%s", "unknown dir 0x%x", dir); 365 ic->ic_stats.is_rx_wrongdir++; 366 goto out; 367 } 368 /* check if source STA is associated */ 369 if (ni == ic->ic_bss) { 370 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 371 wh, "data", "%s", "unknown src"); 372 ieee80211_send_error(ic, ni, wh->i_addr2, 373 IEEE80211_FC0_SUBTYPE_DEAUTH, 374 IEEE80211_REASON_NOT_AUTHED); 375 ic->ic_stats.is_rx_notassoc++; 376 goto err; 377 } 378 if (ni->ni_associd == 0) { 379 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 380 wh, "data", "%s", "unassoc src"); 381 IEEE80211_SEND_MGMT(ic, ni, 382 IEEE80211_FC0_SUBTYPE_DISASSOC, 383 IEEE80211_REASON_NOT_ASSOCED); 384 ic->ic_stats.is_rx_notassoc++; 385 goto err; 386 } 387 388 /* 389 * Check for power save state change. 390 */ 391 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^ 392 (ni->ni_flags & IEEE80211_NODE_PWR_MGT))) 393 ieee80211_node_pwrsave(ni, 394 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT); 395 #endif /* !IEEE80211_NO_HOSTAP */ 396 break; 397 default: 398 /* XXX here to keep compiler happy */ 399 goto out; 400 } 401 402 /* 403 * Handle privacy requirements. Note that we 404 * must not be preempted from here until after 405 * we (potentially) call ieee80211_crypto_demic; 406 * otherwise we may violate assumptions in the 407 * crypto cipher modules used to do delayed update 408 * of replay sequence numbers. 409 */ 410 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 411 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 412 /* 413 * Discard encrypted frames when privacy is off. 414 */ 415 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 416 wh, "WEP", "%s", "PRIVACY off"); 417 ic->ic_stats.is_rx_noprivacy++; 418 IEEE80211_NODE_STAT(ni, rx_noprivacy); 419 goto out; 420 } 421 key = ieee80211_crypto_decap(ic, ni, m, hdrspace); 422 if (key == NULL) { 423 /* NB: stats+msgs handled in crypto_decap */ 424 IEEE80211_NODE_STAT(ni, rx_wepfail); 425 goto out; 426 } 427 wh = mtod(m, struct ieee80211_frame *); 428 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 429 } else { 430 key = NULL; 431 } 432 433 /* 434 * Next up, any fragmentation. 435 */ 436 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 437 m = ieee80211_defrag(ic, ni, m, hdrspace); 438 if (m == NULL) { 439 /* Fragment dropped or frame not complete yet */ 440 goto out; 441 } 442 } 443 wh = NULL; /* no longer valid, catch any uses */ 444 445 /* 446 * Next strip any MSDU crypto bits. 447 */ 448 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) { 449 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 450 ni->ni_macaddr, "data", "%s", "demic error"); 451 IEEE80211_NODE_STAT(ni, rx_demicfail); 452 goto out; 453 } 454 455 #if NBPFILTER > 0 456 /* copy to listener after decrypt */ 457 if (ic->ic_rawbpf) 458 bpf_mtap(ic->ic_rawbpf, m); 459 #endif 460 461 /* 462 * Finally, strip the 802.11 header. 463 */ 464 m = ieee80211_decap(ic, m, hdrspace); 465 if (m == NULL) { 466 /* don't count Null data frames as errors */ 467 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA) 468 goto out; 469 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 470 ni->ni_macaddr, "data", "%s", "decap error"); 471 ic->ic_stats.is_rx_decap++; 472 IEEE80211_NODE_STAT(ni, rx_decap); 473 goto err; 474 } 475 eh = mtod(m, struct ether_header *); 476 if (!ieee80211_node_is_authorized(ni)) { 477 /* 478 * Deny any non-PAE frames received prior to 479 * authorization. For open/shared-key 480 * authentication the port is mark authorized 481 * after authentication completes. For 802.1x 482 * the port is not marked authorized by the 483 * authenticator until the handshake has completed. 484 */ 485 if (eh->ether_type != htons(ETHERTYPE_PAE)) { 486 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 487 eh->ether_shost, "data", 488 "unauthorized port: ether type 0x%x len %u", 489 eh->ether_type, m->m_pkthdr.len); 490 ic->ic_stats.is_rx_unauth++; 491 IEEE80211_NODE_STAT(ni, rx_unauth); 492 goto err; 493 } 494 } else { 495 /* 496 * When denying unencrypted frames, discard 497 * any non-PAE frames received without encryption. 498 */ 499 if ((ic->ic_flags & IEEE80211_F_DROPUNENC) && 500 key == NULL && 501 eh->ether_type != htons(ETHERTYPE_PAE)) { 502 /* 503 * Drop unencrypted frames. 504 */ 505 ic->ic_stats.is_rx_unencrypted++; 506 IEEE80211_NODE_STAT(ni, rx_unencrypted); 507 goto out; 508 } 509 } 510 ifp->if_ipackets++; 511 IEEE80211_NODE_STAT(ni, rx_data); 512 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len); 513 514 ieee80211_deliver_data(ic, ni, m); 515 return IEEE80211_FC0_TYPE_DATA; 516 517 case IEEE80211_FC0_TYPE_MGT: 518 IEEE80211_NODE_STAT(ni, rx_mgmt); 519 if (dir != IEEE80211_FC1_DIR_NODS) { 520 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 521 wh, "data", "%s", "unknown dir 0x%x", dir); 522 ic->ic_stats.is_rx_wrongdir++; 523 goto err; 524 } 525 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 526 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 527 ni->ni_macaddr, "mgt", "too short: len %u", 528 m->m_pkthdr.len); 529 ic->ic_stats.is_rx_tooshort++; 530 goto out; 531 } 532 #ifdef IEEE80211_DEBUG 533 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) || 534 ieee80211_msg_dumppkts(ic)) { 535 if_printf(ic->ic_ifp, "received %s from %s rssi %d\n", 536 ieee80211_mgt_subtype_name[subtype >> 537 IEEE80211_FC0_SUBTYPE_SHIFT], 538 ether_sprintf(wh->i_addr2), rssi); 539 } 540 #endif 541 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 542 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) { 543 /* 544 * Only shared key auth frames with a challenge 545 * should be encrypted, discard all others. 546 */ 547 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 548 wh, ieee80211_mgt_subtype_name[subtype >> 549 IEEE80211_FC0_SUBTYPE_SHIFT], 550 "%s", "WEP set but not permitted"); 551 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */ 552 goto out; 553 } 554 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 555 /* 556 * Discard encrypted frames when privacy is off. 557 */ 558 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 559 wh, "mgt", "%s", "WEP set but PRIVACY off"); 560 ic->ic_stats.is_rx_noprivacy++; 561 goto out; 562 } 563 hdrspace = ieee80211_hdrspace(ic, wh); 564 key = ieee80211_crypto_decap(ic, ni, m, hdrspace); 565 if (key == NULL) { 566 /* NB: stats+msgs handled in crypto_decap */ 567 goto out; 568 } 569 wh = mtod(m, struct ieee80211_frame *); 570 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 571 } 572 #if NBPFILTER > 0 573 if (ic->ic_rawbpf) 574 bpf_mtap(ic->ic_rawbpf, m); 575 #endif 576 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp); 577 m_freem(m); 578 return type; 579 580 case IEEE80211_FC0_TYPE_CTL: 581 IEEE80211_NODE_STAT(ni, rx_ctrl); 582 ic->ic_stats.is_rx_ctl++; 583 #ifndef IEEE80211_NO_HOSTAP 584 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 585 switch (subtype) { 586 case IEEE80211_FC0_SUBTYPE_PS_POLL: 587 ieee80211_recv_pspoll(ic, ni, m); 588 break; 589 } 590 } 591 #endif /* !IEEE80211_NO_HOSTAP */ 592 goto out; 593 default: 594 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 595 wh, NULL, "bad frame type 0x%x", type); 596 /* should not come here */ 597 break; 598 } 599 err: 600 ifp->if_ierrors++; 601 out: 602 if (m != NULL) { 603 #if NBPFILTER > 0 604 if (ic->ic_rawbpf) 605 bpf_mtap(ic->ic_rawbpf, m); 606 #endif 607 m_freem(m); 608 } 609 return type; 610 #undef SEQ_LEQ 611 } 612 613 /* 614 * This function reassemble fragments. 615 */ 616 static struct mbuf * 617 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni, 618 struct mbuf *m, int hdrspace) 619 { 620 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 621 struct ieee80211_frame *lwh; 622 u_int16_t rxseq; 623 u_int8_t fragno; 624 u_int8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG; 625 struct mbuf *mfrag; 626 627 IASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?")); 628 629 rxseq = le16toh(*(u_int16_t *)wh->i_seq); 630 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK; 631 632 /* Quick way out, if there's nothing to defragment */ 633 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL) 634 return m; 635 636 /* 637 * Remove frag to insure it doesn't get reaped by timer. 638 */ 639 if (ni->ni_table == NULL) { 640 /* 641 * Should never happen. If the node is orphaned (not in 642 * the table) then input packets should not reach here. 643 * Otherwise, a concurrent request that yanks the table 644 * should be blocked by other interlocking and/or by first 645 * shutting the driver down. Regardless, be defensive 646 * here and just bail 647 */ 648 /* XXX need msg+stat */ 649 m_freem(m); 650 return NULL; 651 } 652 IEEE80211_NODE_LOCK(ni->ni_table); 653 mfrag = ni->ni_rxfrag[0]; 654 ni->ni_rxfrag[0] = NULL; 655 IEEE80211_NODE_UNLOCK(ni->ni_table); 656 657 /* 658 * Validate new fragment is in order and 659 * related to the previous ones. 660 */ 661 if (mfrag != NULL) { 662 u_int16_t last_rxseq; 663 664 lwh = mtod(mfrag, struct ieee80211_frame *); 665 last_rxseq = le16toh(*(u_int16_t *)lwh->i_seq); 666 /* NB: check seq # and frag together */ 667 if (rxseq != last_rxseq+1 || 668 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) || 669 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { 670 /* 671 * Unrelated fragment or no space for it, 672 * clear current fragments. 673 */ 674 m_freem(mfrag); 675 mfrag = NULL; 676 } 677 } 678 679 if (mfrag == NULL) { 680 if (fragno != 0) { /* !first fragment, discard */ 681 IEEE80211_NODE_STAT(ni, rx_defrag); 682 m_freem(m); 683 return NULL; 684 } 685 mfrag = m; 686 } else { /* concatenate */ 687 m_adj(m, hdrspace); /* strip header */ 688 m_cat(mfrag, m); 689 /* NB: m_cat doesn't update the packet header */ 690 mfrag->m_pkthdr.len += m->m_pkthdr.len; 691 /* track last seqnum and fragno */ 692 lwh = mtod(mfrag, struct ieee80211_frame *); 693 *(u_int16_t *) lwh->i_seq = *(u_int16_t *) wh->i_seq; 694 } 695 if (more_frag) { /* more to come, save */ 696 ni->ni_rxfragstamp = ticks; 697 ni->ni_rxfrag[0] = mfrag; 698 mfrag = NULL; 699 } 700 return mfrag; 701 } 702 703 static void 704 ieee80211_deliver_data(struct ieee80211com *ic, 705 struct ieee80211_node *ni, struct mbuf *m) 706 { 707 struct ether_header *eh = mtod(m, struct ether_header *); 708 struct ifnet *ifp = ic->ic_ifp; 709 ALTQ_DECL(struct altq_pktattr pktattr;) 710 711 /* perform as a bridge within the AP */ 712 if (ic->ic_opmode == IEEE80211_M_HOSTAP && 713 (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) { 714 struct mbuf *m1 = NULL; 715 716 if (ETHER_IS_MULTICAST(eh->ether_dhost)) { 717 m1 = m_copypacket(m, M_DONTWAIT); 718 if (m1 == NULL) 719 ifp->if_oerrors++; 720 else 721 m1->m_flags |= M_MCAST; 722 } else { 723 /* 724 * Check if the destination is known; if so 725 * and the port is authorized dispatch directly. 726 */ 727 struct ieee80211_node *sta = 728 ieee80211_find_node(&ic->ic_sta, eh->ether_dhost); 729 if (sta != NULL) { 730 if (ieee80211_node_is_authorized(sta)) { 731 /* 732 * Beware of sending to ourself; this 733 * needs to happen via the normal 734 * input path. 735 */ 736 if (sta != ic->ic_bss) { 737 m1 = m; 738 m = NULL; 739 } 740 } else { 741 ic->ic_stats.is_rx_unauth++; 742 IEEE80211_NODE_STAT(sta, rx_unauth); 743 } 744 ieee80211_free_node(sta); 745 } 746 } 747 if (m1 != NULL) { 748 int len; 749 #ifdef ALTQ 750 if (ALTQ_IS_ENABLED(&ifp->if_snd)) { 751 altq_etherclassify(&ifp->if_snd, m1, 752 &pktattr); 753 } 754 #endif 755 len = m1->m_pkthdr.len; 756 IF_ENQUEUE(&ifp->if_snd, m1); 757 if (m != NULL) 758 ifp->if_omcasts++; 759 ifp->if_obytes += len; 760 } 761 } 762 if (m != NULL) { 763 #if NBPFILTER > 0 764 /* 765 * XXX If we forward packet into transmitter of the AP, 766 * we don't need to duplicate for DLT_EN10MB. 767 */ 768 if (ifp->if_bpf) 769 bpf_mtap(ifp->if_bpf, m); 770 #endif 771 772 if (ni->ni_vlan != 0) { 773 /* attach vlan tag */ 774 /* XXX goto err? */ 775 VLAN_INPUT_TAG(ifp, m, ni->ni_vlan, goto out); 776 } 777 (*ifp->if_input)(ifp, m); 778 } 779 return; 780 out: 781 if (m != NULL) { 782 #if NBPFILTER > 0 783 if (ic->ic_rawbpf) 784 bpf_mtap(ic->ic_rawbpf, m); 785 #endif 786 m_freem(m); 787 } 788 } 789 790 static struct mbuf * 791 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen) 792 { 793 struct ieee80211_qosframe_addr4 wh; /* Max size address frames */ 794 struct ether_header *eh; 795 struct llc *llc; 796 797 if (m->m_len < hdrlen + sizeof(*llc) && 798 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) { 799 /* XXX stat, msg */ 800 return NULL; 801 } 802 memcpy(&wh, mtod(m, caddr_t), hdrlen); 803 llc = (struct llc *)(mtod(m, caddr_t) + hdrlen); 804 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP && 805 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 && 806 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) { 807 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh)); 808 llc = NULL; 809 } else { 810 m_adj(m, hdrlen - sizeof(*eh)); 811 } 812 eh = mtod(m, struct ether_header *); 813 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) { 814 case IEEE80211_FC1_DIR_NODS: 815 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 816 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 817 break; 818 case IEEE80211_FC1_DIR_TODS: 819 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 820 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 821 break; 822 case IEEE80211_FC1_DIR_FROMDS: 823 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 824 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3); 825 break; 826 case IEEE80211_FC1_DIR_DSTODS: 827 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 828 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4); 829 break; 830 } 831 #ifdef ALIGNED_POINTER 832 if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), u_int32_t)) { 833 struct mbuf *n, *n0, **np; 834 caddr_t newdata; 835 int off, pktlen; 836 837 n0 = NULL; 838 np = &n0; 839 off = 0; 840 pktlen = m->m_pkthdr.len; 841 while (pktlen > off) { 842 if (n0 == NULL) { 843 MGETHDR(n, M_DONTWAIT, MT_DATA); 844 if (n == NULL) { 845 m_freem(m); 846 return NULL; 847 } 848 M_MOVE_PKTHDR(n, m); 849 n->m_len = MHLEN; 850 } else { 851 MGET(n, M_DONTWAIT, MT_DATA); 852 if (n == NULL) { 853 m_freem(m); 854 m_freem(n0); 855 return NULL; 856 } 857 n->m_len = MLEN; 858 } 859 if (pktlen - off >= MINCLSIZE) { 860 MCLGET(n, M_DONTWAIT); 861 if (n->m_flags & M_EXT) 862 n->m_len = n->m_ext.ext_size; 863 } 864 if (n0 == NULL) { 865 newdata = 866 (caddr_t)ALIGN(n->m_data + sizeof(*eh)) - 867 sizeof(*eh); 868 n->m_len -= newdata - n->m_data; 869 n->m_data = newdata; 870 } 871 if (n->m_len > pktlen - off) 872 n->m_len = pktlen - off; 873 m_copydata(m, off, n->m_len, mtod(n, caddr_t)); 874 off += n->m_len; 875 *np = n; 876 np = &n->m_next; 877 } 878 m_freem(m); 879 m = n0; 880 } 881 #endif /* ALIGNED_POINTER */ 882 if (llc != NULL) { 883 eh = mtod(m, struct ether_header *); 884 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh)); 885 } 886 return m; 887 } 888 889 /* 890 * Install received rate set information in the node's state block. 891 */ 892 int 893 ieee80211_setup_rates(struct ieee80211_node *ni, 894 const u_int8_t *rates, const u_int8_t *xrates, int flags) 895 { 896 struct ieee80211com *ic = ni->ni_ic; 897 struct ieee80211_rateset *rs = &ni->ni_rates; 898 899 memset(rs, 0, sizeof(*rs)); 900 rs->rs_nrates = rates[1]; 901 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates); 902 if (xrates != NULL) { 903 u_int8_t nxrates; 904 /* 905 * Tack on 11g extended supported rate element. 906 */ 907 nxrates = xrates[1]; 908 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) { 909 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates; 910 IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE, 911 "[%s] extended rate set too large;" 912 " only using %u of %u rates\n", 913 ether_sprintf(ni->ni_macaddr), nxrates, xrates[1]); 914 ic->ic_stats.is_rx_rstoobig++; 915 } 916 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates); 917 rs->rs_nrates += nxrates; 918 } 919 return ieee80211_fix_rate(ni, flags); 920 } 921 922 static void 923 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh, 924 struct ieee80211_node *ni, int rssi, u_int32_t rstamp, u_int16_t seq, 925 u_int16_t status) 926 { 927 928 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) { 929 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 930 ni->ni_macaddr, "open auth", 931 "bad sta auth mode %u", ni->ni_authmode); 932 ic->ic_stats.is_rx_bad_auth++; /* XXX */ 933 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 934 /* XXX hack to workaround calling convention */ 935 ieee80211_send_error(ic, ni, wh->i_addr2, 936 IEEE80211_FC0_SUBTYPE_AUTH, 937 (seq + 1) | (IEEE80211_STATUS_ALG<<16)); 938 } 939 return; 940 } 941 switch (ic->ic_opmode) { 942 case IEEE80211_M_IBSS: 943 case IEEE80211_M_AHDEMO: 944 case IEEE80211_M_MONITOR: 945 /* should not come here */ 946 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 947 ni->ni_macaddr, "open auth", 948 "bad operating mode %u", ic->ic_opmode); 949 break; 950 951 case IEEE80211_M_HOSTAP: 952 #ifndef IEEE80211_NO_HOSTAP 953 if (ic->ic_state != IEEE80211_S_RUN || 954 seq != IEEE80211_AUTH_OPEN_REQUEST) { 955 ic->ic_stats.is_rx_bad_auth++; 956 return; 957 } 958 /* always accept open authentication requests */ 959 if (ni == ic->ic_bss) { 960 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 961 if (ni == NULL) 962 return; 963 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 964 (void) ieee80211_ref_node(ni); 965 /* 966 * Mark the node as referenced to reflect that it's 967 * reference count has been bumped to insure it remains 968 * after the transaction completes. 969 */ 970 ni->ni_flags |= IEEE80211_NODE_AREF; 971 972 IEEE80211_SEND_MGMT(ic, ni, 973 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 974 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 975 "[%s] station authenticated (open)\n", 976 ether_sprintf(ni->ni_macaddr)); 977 /* 978 * When 802.1x is not in use mark the port 979 * authorized at this point so traffic can flow. 980 */ 981 if (ni->ni_authmode != IEEE80211_AUTH_8021X) 982 ieee80211_node_authorize(ni); 983 #endif /* !IEEE80211_NO_HOSTAP */ 984 break; 985 986 case IEEE80211_M_STA: 987 if (ic->ic_state != IEEE80211_S_AUTH || 988 seq != IEEE80211_AUTH_OPEN_RESPONSE) { 989 ic->ic_stats.is_rx_bad_auth++; 990 return; 991 } 992 if (status != 0) { 993 IEEE80211_DPRINTF(ic, 994 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 995 "[%s] open auth failed (reason %d)\n", 996 ether_sprintf(ni->ni_macaddr), status); 997 /* XXX can this happen? */ 998 if (ni != ic->ic_bss) 999 ni->ni_fails++; 1000 ic->ic_stats.is_rx_auth_fail++; 1001 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 1002 } else 1003 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 1004 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 1005 break; 1006 } 1007 } 1008 1009 /* 1010 * Send a management frame error response to the specified 1011 * station. If ni is associated with the station then use 1012 * it; otherwise allocate a temporary node suitable for 1013 * transmitting the frame and then free the reference so 1014 * it will go away as soon as the frame has been transmitted. 1015 */ 1016 static void 1017 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni, 1018 const u_int8_t *mac, int subtype, int arg) 1019 { 1020 int istmp; 1021 1022 if (ni == ic->ic_bss) { 1023 ni = ieee80211_tmp_node(ic, mac); 1024 if (ni == NULL) { 1025 /* XXX msg */ 1026 return; 1027 } 1028 istmp = 1; 1029 } else 1030 istmp = 0; 1031 IEEE80211_SEND_MGMT(ic, ni, subtype, arg); 1032 if (istmp) 1033 ieee80211_free_node(ni); 1034 } 1035 1036 static int 1037 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni) 1038 { 1039 if (ni->ni_challenge == NULL) 1040 MALLOC(ni->ni_challenge, u_int32_t*, IEEE80211_CHALLENGE_LEN, 1041 M_DEVBUF, M_NOWAIT); 1042 if (ni->ni_challenge == NULL) { 1043 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1044 "[%s] shared key challenge alloc failed\n", 1045 ether_sprintf(ni->ni_macaddr)); 1046 /* XXX statistic */ 1047 } 1048 return (ni->ni_challenge != NULL); 1049 } 1050 1051 /* XXX TODO: add statistics */ 1052 static void 1053 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh, 1054 u_int8_t *frm, u_int8_t *efrm, struct ieee80211_node *ni, int rssi, 1055 u_int32_t rstamp, u_int16_t seq, u_int16_t status) 1056 { 1057 u_int8_t *challenge; 1058 int estatus; 1059 1060 /* 1061 * NB: this can happen as we allow pre-shared key 1062 * authentication to be enabled w/o wep being turned 1063 * on so that configuration of these can be done 1064 * in any order. It may be better to enforce the 1065 * ordering in which case this check would just be 1066 * for sanity/consistency. 1067 */ 1068 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 1069 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1070 ni->ni_macaddr, "shared key auth", 1071 "%s", " PRIVACY is disabled"); 1072 estatus = IEEE80211_STATUS_ALG; 1073 goto bad; 1074 } 1075 /* 1076 * Pre-shared key authentication is evil; accept 1077 * it only if explicitly configured (it is supported 1078 * mainly for compatibility with clients like OS X). 1079 */ 1080 if (ni->ni_authmode != IEEE80211_AUTH_AUTO && 1081 ni->ni_authmode != IEEE80211_AUTH_SHARED) { 1082 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1083 ni->ni_macaddr, "shared key auth", 1084 "bad sta auth mode %u", ni->ni_authmode); 1085 ic->ic_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */ 1086 estatus = IEEE80211_STATUS_ALG; 1087 goto bad; 1088 } 1089 1090 challenge = NULL; 1091 if (frm + 1 < efrm) { 1092 if ((frm[1] + 2) > (efrm - frm)) { 1093 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1094 ni->ni_macaddr, "shared key auth", 1095 "ie %d/%d too long", 1096 frm[0], (frm[1] + 2) - (efrm - frm)); 1097 ic->ic_stats.is_rx_bad_auth++; 1098 estatus = IEEE80211_STATUS_CHALLENGE; 1099 goto bad; 1100 } 1101 if (*frm == IEEE80211_ELEMID_CHALLENGE) 1102 challenge = frm; 1103 frm += frm[1] + 2; 1104 } 1105 switch (seq) { 1106 case IEEE80211_AUTH_SHARED_CHALLENGE: 1107 case IEEE80211_AUTH_SHARED_RESPONSE: 1108 if (challenge == NULL) { 1109 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1110 ni->ni_macaddr, "shared key auth", 1111 "%s", "no challenge"); 1112 ic->ic_stats.is_rx_bad_auth++; 1113 estatus = IEEE80211_STATUS_CHALLENGE; 1114 goto bad; 1115 } 1116 if (challenge[1] != IEEE80211_CHALLENGE_LEN) { 1117 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1118 ni->ni_macaddr, "shared key auth", 1119 "bad challenge len %d", challenge[1]); 1120 ic->ic_stats.is_rx_bad_auth++; 1121 estatus = IEEE80211_STATUS_CHALLENGE; 1122 goto bad; 1123 } 1124 default: 1125 break; 1126 } 1127 switch (ic->ic_opmode) { 1128 case IEEE80211_M_MONITOR: 1129 case IEEE80211_M_AHDEMO: 1130 case IEEE80211_M_IBSS: 1131 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1132 ni->ni_macaddr, "shared key auth", 1133 "bad operating mode %u", ic->ic_opmode); 1134 return; 1135 case IEEE80211_M_HOSTAP: 1136 #ifndef IEEE80211_NO_HOSTAP 1137 { 1138 int allocbs; 1139 if (ic->ic_state != IEEE80211_S_RUN) { 1140 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1141 ni->ni_macaddr, "shared key auth", 1142 "bad state %u", ic->ic_state); 1143 estatus = IEEE80211_STATUS_ALG; /* XXX */ 1144 goto bad; 1145 } 1146 switch (seq) { 1147 case IEEE80211_AUTH_SHARED_REQUEST: 1148 if (ni == ic->ic_bss) { 1149 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 1150 if (ni == NULL) { 1151 /* NB: no way to return an error */ 1152 return; 1153 } 1154 allocbs = 1; 1155 } else { 1156 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 1157 (void) ieee80211_ref_node(ni); 1158 allocbs = 0; 1159 } 1160 /* 1161 * Mark the node as referenced to reflect that it's 1162 * reference count has been bumped to insure it remains 1163 * after the transaction completes. 1164 */ 1165 ni->ni_flags |= IEEE80211_NODE_AREF; 1166 ni->ni_rssi = rssi; 1167 ni->ni_rstamp = rstamp; 1168 if (!alloc_challenge(ic, ni)) { 1169 /* NB: don't return error so they rexmit */ 1170 return; 1171 } 1172 get_random_bytes(ni->ni_challenge, 1173 IEEE80211_CHALLENGE_LEN); 1174 IEEE80211_DPRINTF(ic, 1175 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1176 "[%s] shared key %sauth request\n", 1177 ether_sprintf(ni->ni_macaddr), 1178 allocbs ? "" : "re"); 1179 break; 1180 case IEEE80211_AUTH_SHARED_RESPONSE: 1181 if (ni == ic->ic_bss) { 1182 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1183 ni->ni_macaddr, "shared key response", 1184 "%s", "unknown station"); 1185 /* NB: don't send a response */ 1186 return; 1187 } 1188 if (ni->ni_challenge == NULL) { 1189 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1190 ni->ni_macaddr, "shared key response", 1191 "%s", "no challenge recorded"); 1192 ic->ic_stats.is_rx_bad_auth++; 1193 estatus = IEEE80211_STATUS_CHALLENGE; 1194 goto bad; 1195 } 1196 if (memcmp(ni->ni_challenge, &challenge[2], 1197 challenge[1]) != 0) { 1198 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1199 ni->ni_macaddr, "shared key response", 1200 "%s", "challenge mismatch"); 1201 ic->ic_stats.is_rx_auth_fail++; 1202 estatus = IEEE80211_STATUS_CHALLENGE; 1203 goto bad; 1204 } 1205 IEEE80211_DPRINTF(ic, 1206 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1207 "[%s] station authenticated (shared key)\n", 1208 ether_sprintf(ni->ni_macaddr)); 1209 ieee80211_node_authorize(ni); 1210 break; 1211 default: 1212 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1213 ni->ni_macaddr, "shared key auth", 1214 "bad seq %d", seq); 1215 ic->ic_stats.is_rx_bad_auth++; 1216 estatus = IEEE80211_STATUS_SEQUENCE; 1217 goto bad; 1218 } 1219 IEEE80211_SEND_MGMT(ic, ni, 1220 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1221 } 1222 #endif /* !IEEE80211_NO_HOSTAP */ 1223 break; 1224 1225 case IEEE80211_M_STA: 1226 if (ic->ic_state != IEEE80211_S_AUTH) 1227 return; 1228 switch (seq) { 1229 case IEEE80211_AUTH_SHARED_PASS: 1230 if (ni->ni_challenge != NULL) { 1231 FREE(ni->ni_challenge, M_DEVBUF); 1232 ni->ni_challenge = NULL; 1233 } 1234 if (status != 0) { 1235 IEEE80211_DPRINTF(ic, 1236 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1237 "[%s] shared key auth failed (reason %d)\n", 1238 ether_sprintf(ieee80211_getbssid(ic, wh)), 1239 status); 1240 /* XXX can this happen? */ 1241 if (ni != ic->ic_bss) 1242 ni->ni_fails++; 1243 ic->ic_stats.is_rx_auth_fail++; 1244 return; 1245 } 1246 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 1247 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 1248 break; 1249 case IEEE80211_AUTH_SHARED_CHALLENGE: 1250 if (!alloc_challenge(ic, ni)) 1251 return; 1252 /* XXX could optimize by passing recvd challenge */ 1253 memcpy(ni->ni_challenge, &challenge[2], challenge[1]); 1254 IEEE80211_SEND_MGMT(ic, ni, 1255 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1256 break; 1257 default: 1258 IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH, 1259 wh, "shared key auth", "bad seq %d", seq); 1260 ic->ic_stats.is_rx_bad_auth++; 1261 return; 1262 } 1263 break; 1264 } 1265 return; 1266 bad: 1267 #ifndef IEEE80211_NO_HOSTAP 1268 /* 1269 * Send an error response; but only when operating as an AP. 1270 */ 1271 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 1272 /* XXX hack to workaround calling convention */ 1273 ieee80211_send_error(ic, ni, wh->i_addr2, 1274 IEEE80211_FC0_SUBTYPE_AUTH, 1275 (seq + 1) | (estatus<<16)); 1276 } else if (ic->ic_opmode == IEEE80211_M_STA) { 1277 /* 1278 * Kick the state machine. This short-circuits 1279 * using the mgt frame timeout to trigger the 1280 * state transition. 1281 */ 1282 if (ic->ic_state == IEEE80211_S_AUTH) 1283 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 1284 } 1285 #else 1286 ; 1287 #endif /* !IEEE80211_NO_HOSTAP */ 1288 } 1289 1290 /* Verify the existence and length of __elem or get out. */ 1291 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \ 1292 if ((__elem) == NULL) { \ 1293 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1294 wh, ieee80211_mgt_subtype_name[subtype >> \ 1295 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1296 "%s", "no " #__elem ); \ 1297 ic->ic_stats.is_rx_elem_missing++; \ 1298 return; \ 1299 } \ 1300 if ((__elem)[1] > (__maxlen)) { \ 1301 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1302 wh, ieee80211_mgt_subtype_name[subtype >> \ 1303 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1304 "bad " #__elem " len %d", (__elem)[1]); \ 1305 ic->ic_stats.is_rx_elem_toobig++; \ 1306 return; \ 1307 } \ 1308 } while (0) 1309 1310 #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \ 1311 if ((_len) < (_minlen)) { \ 1312 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1313 wh, ieee80211_mgt_subtype_name[subtype >> \ 1314 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1315 "%s", "ie too short"); \ 1316 ic->ic_stats.is_rx_elem_toosmall++; \ 1317 return; \ 1318 } \ 1319 } while (0) 1320 1321 #ifdef IEEE80211_DEBUG 1322 static void 1323 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag, 1324 u_int8_t mac[IEEE80211_ADDR_LEN], u_int8_t *ssid) 1325 { 1326 printf("[%s] discard %s frame, ssid mismatch: ", 1327 ether_sprintf(mac), tag); 1328 ieee80211_print_essid(ssid + 2, ssid[1]); 1329 printf("\n"); 1330 } 1331 1332 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1333 if ((_ssid)[1] != 0 && \ 1334 ((_ssid)[1] != (_ni)->ni_esslen || \ 1335 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1336 if (ieee80211_msg_input(ic)) \ 1337 ieee80211_ssid_mismatch(ic, \ 1338 ieee80211_mgt_subtype_name[subtype >> \ 1339 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1340 wh->i_addr2, _ssid); \ 1341 ic->ic_stats.is_rx_ssidmismatch++; \ 1342 return; \ 1343 } \ 1344 } while (0) 1345 #else /* !IEEE80211_DEBUG */ 1346 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1347 if ((_ssid)[1] != 0 && \ 1348 ((_ssid)[1] != (_ni)->ni_esslen || \ 1349 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1350 ic->ic_stats.is_rx_ssidmismatch++; \ 1351 return; \ 1352 } \ 1353 } while (0) 1354 #endif /* !IEEE80211_DEBUG */ 1355 1356 /* unalligned little endian access */ 1357 #define LE_READ_2(p) \ 1358 ((u_int16_t) \ 1359 ((((const u_int8_t *)(p))[0] ) | \ 1360 (((const u_int8_t *)(p))[1] << 8))) 1361 #define LE_READ_4(p) \ 1362 ((u_int32_t) \ 1363 ((((const u_int8_t *)(p))[0] ) | \ 1364 (((const u_int8_t *)(p))[1] << 8) | \ 1365 (((const u_int8_t *)(p))[2] << 16) | \ 1366 (((const u_int8_t *)(p))[3] << 24))) 1367 1368 static int __inline 1369 iswpaoui(const u_int8_t *frm) 1370 { 1371 return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI); 1372 } 1373 1374 static int __inline 1375 iswmeoui(const u_int8_t *frm) 1376 { 1377 return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI); 1378 } 1379 1380 static int __inline 1381 iswmeparam(const u_int8_t *frm) 1382 { 1383 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1384 frm[6] == WME_PARAM_OUI_SUBTYPE; 1385 } 1386 1387 static int __inline 1388 iswmeinfo(const u_int8_t *frm) 1389 { 1390 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1391 frm[6] == WME_INFO_OUI_SUBTYPE; 1392 } 1393 1394 static int __inline 1395 isatherosoui(const u_int8_t *frm) 1396 { 1397 return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI); 1398 } 1399 1400 /* 1401 * Convert a WPA cipher selector OUI to an internal 1402 * cipher algorithm. Where appropriate we also 1403 * record any key length. 1404 */ 1405 static int 1406 wpa_cipher(u_int8_t *sel, u_int8_t *keylen) 1407 { 1408 #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1409 u_int32_t w = LE_READ_4(sel); 1410 1411 switch (w) { 1412 case WPA_SEL(WPA_CSE_NULL): 1413 return IEEE80211_CIPHER_NONE; 1414 case WPA_SEL(WPA_CSE_WEP40): 1415 if (keylen) 1416 *keylen = 40 / NBBY; 1417 return IEEE80211_CIPHER_WEP; 1418 case WPA_SEL(WPA_CSE_WEP104): 1419 if (keylen) 1420 *keylen = 104 / NBBY; 1421 return IEEE80211_CIPHER_WEP; 1422 case WPA_SEL(WPA_CSE_TKIP): 1423 return IEEE80211_CIPHER_TKIP; 1424 case WPA_SEL(WPA_CSE_CCMP): 1425 return IEEE80211_CIPHER_AES_CCM; 1426 } 1427 return 32; /* NB: so 1<< is discarded */ 1428 #undef WPA_SEL 1429 } 1430 1431 /* 1432 * Convert a WPA key management/authentication algorithm 1433 * to an internal code. 1434 */ 1435 static int 1436 wpa_keymgmt(u_int8_t *sel) 1437 { 1438 #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1439 u_int32_t w = LE_READ_4(sel); 1440 1441 switch (w) { 1442 case WPA_SEL(WPA_ASE_8021X_UNSPEC): 1443 return WPA_ASE_8021X_UNSPEC; 1444 case WPA_SEL(WPA_ASE_8021X_PSK): 1445 return WPA_ASE_8021X_PSK; 1446 case WPA_SEL(WPA_ASE_NONE): 1447 return WPA_ASE_NONE; 1448 } 1449 return 0; /* NB: so is discarded */ 1450 #undef WPA_SEL 1451 } 1452 1453 /* 1454 * Parse a WPA information element to collect parameters 1455 * and validate the parameters against what has been 1456 * configured for the system. 1457 */ 1458 static int 1459 ieee80211_parse_wpa(struct ieee80211com *ic, u_int8_t *frm, 1460 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1461 { 1462 u_int8_t len = frm[1]; 1463 u_int32_t w; 1464 int n; 1465 1466 /* 1467 * Check the length once for fixed parts: OUI, type, 1468 * version, mcast cipher, and 2 selector counts. 1469 * Other, variable-length data, must be checked separately. 1470 */ 1471 if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) { 1472 IEEE80211_DISCARD_IE(ic, 1473 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1474 wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags); 1475 return IEEE80211_REASON_IE_INVALID; 1476 } 1477 if (len < 14) { 1478 IEEE80211_DISCARD_IE(ic, 1479 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1480 wh, "WPA", "too short, len %u", len); 1481 return IEEE80211_REASON_IE_INVALID; 1482 } 1483 frm += 6, len -= 4; /* NB: len is payload only */ 1484 /* NB: iswapoui already validated the OUI and type */ 1485 w = LE_READ_2(frm); 1486 if (w != WPA_VERSION) { 1487 IEEE80211_DISCARD_IE(ic, 1488 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1489 wh, "WPA", "bad version %u", w); 1490 return IEEE80211_REASON_IE_INVALID; 1491 } 1492 frm += 2, len -= 2; 1493 1494 /* multicast/group cipher */ 1495 w = wpa_cipher(frm, &rsn->rsn_mcastkeylen); 1496 if (w != rsn->rsn_mcastcipher) { 1497 IEEE80211_DISCARD_IE(ic, 1498 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1499 wh, "WPA", "mcast cipher mismatch; got %u, expected %u", 1500 w, rsn->rsn_mcastcipher); 1501 return IEEE80211_REASON_IE_INVALID; 1502 } 1503 frm += 4, len -= 4; 1504 1505 /* unicast ciphers */ 1506 n = LE_READ_2(frm); 1507 frm += 2, len -= 2; 1508 if (len < n*4+2) { 1509 IEEE80211_DISCARD_IE(ic, 1510 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1511 wh, "WPA", "ucast cipher data too short; len %u, n %u", 1512 len, n); 1513 return IEEE80211_REASON_IE_INVALID; 1514 } 1515 w = 0; 1516 for (; n > 0; n--) { 1517 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen); 1518 frm += 4, len -= 4; 1519 } 1520 w &= rsn->rsn_ucastcipherset; 1521 if (w == 0) { 1522 IEEE80211_DISCARD_IE(ic, 1523 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1524 wh, "WPA", "%s", "ucast cipher set empty"); 1525 return IEEE80211_REASON_IE_INVALID; 1526 } 1527 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1528 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1529 else 1530 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1531 1532 /* key management algorithms */ 1533 n = LE_READ_2(frm); 1534 frm += 2, len -= 2; 1535 if (len < n*4) { 1536 IEEE80211_DISCARD_IE(ic, 1537 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1538 wh, "WPA", "key mgmt alg data too short; len %u, n %u", 1539 len, n); 1540 return IEEE80211_REASON_IE_INVALID; 1541 } 1542 w = 0; 1543 for (; n > 0; n--) { 1544 w |= wpa_keymgmt(frm); 1545 frm += 4, len -= 4; 1546 } 1547 w &= rsn->rsn_keymgmtset; 1548 if (w == 0) { 1549 IEEE80211_DISCARD_IE(ic, 1550 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1551 wh, "WPA", "%s", "no acceptable key mgmt alg"); 1552 return IEEE80211_REASON_IE_INVALID; 1553 } 1554 if (w & WPA_ASE_8021X_UNSPEC) 1555 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC; 1556 else 1557 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK; 1558 1559 if (len > 2) /* optional capabilities */ 1560 rsn->rsn_caps = LE_READ_2(frm); 1561 1562 return 0; 1563 } 1564 1565 /* 1566 * Convert an RSN cipher selector OUI to an internal 1567 * cipher algorithm. Where appropriate we also 1568 * record any key length. 1569 */ 1570 static int 1571 rsn_cipher(u_int8_t *sel, u_int8_t *keylen) 1572 { 1573 #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1574 u_int32_t w = LE_READ_4(sel); 1575 1576 switch (w) { 1577 case RSN_SEL(RSN_CSE_NULL): 1578 return IEEE80211_CIPHER_NONE; 1579 case RSN_SEL(RSN_CSE_WEP40): 1580 if (keylen) 1581 *keylen = 40 / NBBY; 1582 return IEEE80211_CIPHER_WEP; 1583 case RSN_SEL(RSN_CSE_WEP104): 1584 if (keylen) 1585 *keylen = 104 / NBBY; 1586 return IEEE80211_CIPHER_WEP; 1587 case RSN_SEL(RSN_CSE_TKIP): 1588 return IEEE80211_CIPHER_TKIP; 1589 case RSN_SEL(RSN_CSE_CCMP): 1590 return IEEE80211_CIPHER_AES_CCM; 1591 case RSN_SEL(RSN_CSE_WRAP): 1592 return IEEE80211_CIPHER_AES_OCB; 1593 } 1594 return 32; /* NB: so 1<< is discarded */ 1595 #undef WPA_SEL 1596 } 1597 1598 /* 1599 * Convert an RSN key management/authentication algorithm 1600 * to an internal code. 1601 */ 1602 static int 1603 rsn_keymgmt(u_int8_t *sel) 1604 { 1605 #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1606 u_int32_t w = LE_READ_4(sel); 1607 1608 switch (w) { 1609 case RSN_SEL(RSN_ASE_8021X_UNSPEC): 1610 return RSN_ASE_8021X_UNSPEC; 1611 case RSN_SEL(RSN_ASE_8021X_PSK): 1612 return RSN_ASE_8021X_PSK; 1613 case RSN_SEL(RSN_ASE_NONE): 1614 return RSN_ASE_NONE; 1615 } 1616 return 0; /* NB: so is discarded */ 1617 #undef RSN_SEL 1618 } 1619 1620 /* 1621 * Parse a WPA/RSN information element to collect parameters 1622 * and validate the parameters against what has been 1623 * configured for the system. 1624 */ 1625 static int 1626 ieee80211_parse_rsn(struct ieee80211com *ic, u_int8_t *frm, 1627 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1628 { 1629 u_int8_t len = frm[1]; 1630 u_int32_t w; 1631 int n; 1632 1633 /* 1634 * Check the length once for fixed parts: 1635 * version, mcast cipher, and 2 selector counts. 1636 * Other, variable-length data, must be checked separately. 1637 */ 1638 if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) { 1639 IEEE80211_DISCARD_IE(ic, 1640 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1641 wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags); 1642 return IEEE80211_REASON_IE_INVALID; 1643 } 1644 if (len < 10) { 1645 IEEE80211_DISCARD_IE(ic, 1646 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1647 wh, "RSN", "too short, len %u", len); 1648 return IEEE80211_REASON_IE_INVALID; 1649 } 1650 frm += 2; 1651 w = LE_READ_2(frm); 1652 if (w != RSN_VERSION) { 1653 IEEE80211_DISCARD_IE(ic, 1654 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1655 wh, "RSN", "bad version %u", w); 1656 return IEEE80211_REASON_IE_INVALID; 1657 } 1658 frm += 2, len -= 2; 1659 1660 /* multicast/group cipher */ 1661 w = rsn_cipher(frm, &rsn->rsn_mcastkeylen); 1662 if (w != rsn->rsn_mcastcipher) { 1663 IEEE80211_DISCARD_IE(ic, 1664 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1665 wh, "RSN", "mcast cipher mismatch; got %u, expected %u", 1666 w, rsn->rsn_mcastcipher); 1667 return IEEE80211_REASON_IE_INVALID; 1668 } 1669 frm += 4, len -= 4; 1670 1671 /* unicast ciphers */ 1672 n = LE_READ_2(frm); 1673 frm += 2, len -= 2; 1674 if (len < n*4+2) { 1675 IEEE80211_DISCARD_IE(ic, 1676 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1677 wh, "RSN", "ucast cipher data too short; len %u, n %u", 1678 len, n); 1679 return IEEE80211_REASON_IE_INVALID; 1680 } 1681 w = 0; 1682 for (; n > 0; n--) { 1683 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen); 1684 frm += 4, len -= 4; 1685 } 1686 w &= rsn->rsn_ucastcipherset; 1687 if (w == 0) { 1688 IEEE80211_DISCARD_IE(ic, 1689 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1690 wh, "RSN", "%s", "ucast cipher set empty"); 1691 return IEEE80211_REASON_IE_INVALID; 1692 } 1693 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1694 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1695 else 1696 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1697 1698 /* key management algorithms */ 1699 n = LE_READ_2(frm); 1700 frm += 2, len -= 2; 1701 if (len < n*4) { 1702 IEEE80211_DISCARD_IE(ic, 1703 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1704 wh, "RSN", "key mgmt alg data too short; len %u, n %u", 1705 len, n); 1706 return IEEE80211_REASON_IE_INVALID; 1707 } 1708 w = 0; 1709 for (; n > 0; n--) { 1710 w |= rsn_keymgmt(frm); 1711 frm += 4, len -= 4; 1712 } 1713 w &= rsn->rsn_keymgmtset; 1714 if (w == 0) { 1715 IEEE80211_DISCARD_IE(ic, 1716 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1717 wh, "RSN", "%s", "no acceptable key mgmt alg"); 1718 return IEEE80211_REASON_IE_INVALID; 1719 } 1720 if (w & RSN_ASE_8021X_UNSPEC) 1721 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC; 1722 else 1723 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK; 1724 1725 /* optional RSN capabilities */ 1726 if (len > 2) 1727 rsn->rsn_caps = LE_READ_2(frm); 1728 /* XXXPMKID */ 1729 1730 return 0; 1731 } 1732 1733 static int 1734 ieee80211_parse_wmeparams(struct ieee80211com *ic, u_int8_t *frm, 1735 const struct ieee80211_frame *wh) 1736 { 1737 #define MS(_v, _f) (((_v) & _f) >> _f##_S) 1738 struct ieee80211_wme_state *wme = &ic->ic_wme; 1739 u_int len = frm[1], qosinfo; 1740 int i; 1741 1742 if (len < sizeof(struct ieee80211_wme_param)-2) { 1743 IEEE80211_DISCARD_IE(ic, 1744 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME, 1745 wh, "WME", "too short, len %u", len); 1746 return -1; 1747 } 1748 qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)]; 1749 qosinfo &= WME_QOSINFO_COUNT; 1750 /* XXX do proper check for wraparound */ 1751 if (qosinfo == wme->wme_wmeChanParams.cap_info) 1752 return 0; 1753 frm += __offsetof(struct ieee80211_wme_param, params_acParams); 1754 for (i = 0; i < WME_NUM_AC; i++) { 1755 struct wmeParams *wmep = 1756 &wme->wme_wmeChanParams.cap_wmeParams[i]; 1757 /* NB: ACI not used */ 1758 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM); 1759 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN); 1760 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN); 1761 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX); 1762 wmep->wmep_txopLimit = LE_READ_2(frm+2); 1763 frm += 4; 1764 } 1765 wme->wme_wmeChanParams.cap_info = qosinfo; 1766 return 1; 1767 #undef MS 1768 } 1769 1770 void 1771 ieee80211_saveie(u_int8_t **iep, const u_int8_t *ie) 1772 { 1773 u_int ielen = ie[1]+2; 1774 /* 1775 * Record information element for later use. 1776 */ 1777 if (*iep == NULL || (*iep)[1] != ie[1]) { 1778 if (*iep != NULL) 1779 FREE(*iep, M_DEVBUF); 1780 MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT); 1781 } 1782 if (*iep != NULL) 1783 memcpy(*iep, ie, ielen); 1784 /* XXX note failure */ 1785 } 1786 1787 void 1788 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, 1789 struct ieee80211_node *ni, 1790 int subtype, int rssi, u_int32_t rstamp) 1791 { 1792 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP) 1793 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP) 1794 struct ieee80211_frame *wh; 1795 u_int8_t *frm, *efrm; 1796 u_int8_t *ssid, *rates, *xrates, *wpa, *wme; 1797 int reassoc, resp, allocbs; 1798 u_int8_t rate; 1799 1800 wh = mtod(m0, struct ieee80211_frame *); 1801 frm = (u_int8_t *)&wh[1]; 1802 efrm = mtod(m0, u_int8_t *) + m0->m_len; 1803 switch (subtype) { 1804 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 1805 case IEEE80211_FC0_SUBTYPE_BEACON: { 1806 struct ieee80211_scanparams scan; 1807 1808 /* 1809 * We process beacon/probe response frames: 1810 * o when scanning, or 1811 * o station mode when associated (to collect state 1812 * updates such as 802.11g slot time), or 1813 * o adhoc mode (to discover neighbors) 1814 * Frames otherwise received are discarded. 1815 */ 1816 if (!((ic->ic_flags & IEEE80211_F_SCAN) || 1817 (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) || 1818 ic->ic_opmode == IEEE80211_M_IBSS)) { 1819 ic->ic_stats.is_rx_mgtdiscard++; 1820 return; 1821 } 1822 /* 1823 * beacon/probe response frame format 1824 * [8] time stamp 1825 * [2] beacon interval 1826 * [2] capability information 1827 * [tlv] ssid 1828 * [tlv] supported rates 1829 * [tlv] country information 1830 * [tlv] parameter set (FH/DS) 1831 * [tlv] erp information 1832 * [tlv] extended supported rates 1833 * [tlv] WME 1834 * [tlv] WPA or RSN 1835 */ 1836 IEEE80211_VERIFY_LENGTH(efrm - frm, 12); 1837 memset(&scan, 0, sizeof(scan)); 1838 scan.tstamp = frm; frm += 8; 1839 scan.bintval = le16toh(*(u_int16_t *)frm); frm += 2; 1840 scan.capinfo = le16toh(*(u_int16_t *)frm); frm += 2; 1841 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan); 1842 scan.chan = scan.bchan; 1843 1844 while (frm < efrm) { 1845 switch (*frm) { 1846 case IEEE80211_ELEMID_SSID: 1847 scan.ssid = frm; 1848 break; 1849 case IEEE80211_ELEMID_RATES: 1850 scan.rates = frm; 1851 break; 1852 case IEEE80211_ELEMID_COUNTRY: 1853 scan.country = frm; 1854 break; 1855 case IEEE80211_ELEMID_FHPARMS: 1856 if (ic->ic_phytype == IEEE80211_T_FH) { 1857 scan.fhdwell = LE_READ_2(&frm[2]); 1858 scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]); 1859 scan.fhindex = frm[6]; 1860 } 1861 break; 1862 case IEEE80211_ELEMID_DSPARMS: 1863 /* 1864 * XXX hack this since depending on phytype 1865 * is problematic for multi-mode devices. 1866 */ 1867 if (ic->ic_phytype != IEEE80211_T_FH) 1868 scan.chan = frm[2]; 1869 break; 1870 case IEEE80211_ELEMID_TIM: 1871 /* XXX ATIM? */ 1872 scan.tim = frm; 1873 scan.timoff = frm - mtod(m0, u_int8_t *); 1874 break; 1875 case IEEE80211_ELEMID_IBSSPARMS: 1876 break; 1877 case IEEE80211_ELEMID_XRATES: 1878 scan.xrates = frm; 1879 break; 1880 case IEEE80211_ELEMID_ERP: 1881 if (frm[1] != 1) { 1882 IEEE80211_DISCARD_IE(ic, 1883 IEEE80211_MSG_ELEMID, wh, "ERP", 1884 "bad len %u", frm[1]); 1885 ic->ic_stats.is_rx_elem_toobig++; 1886 break; 1887 } 1888 scan.erp = frm[2]; 1889 break; 1890 case IEEE80211_ELEMID_RSN: 1891 scan.wpa = frm; 1892 break; 1893 case IEEE80211_ELEMID_VENDOR: 1894 if (iswpaoui(frm)) 1895 scan.wpa = frm; 1896 else if (iswmeparam(frm) || iswmeinfo(frm)) 1897 scan.wme = frm; 1898 /* XXX Atheros OUI support */ 1899 break; 1900 default: 1901 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID, 1902 wh, "unhandled", 1903 "id %u, len %u", *frm, frm[1]); 1904 ic->ic_stats.is_rx_elem_unknown++; 1905 break; 1906 } 1907 frm += frm[1] + 2; 1908 } 1909 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE); 1910 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN); 1911 if ( 1912 #if IEEE80211_CHAN_MAX < 255 1913 scan.chan > IEEE80211_CHAN_MAX || 1914 #endif 1915 isclr(ic->ic_chan_active, scan.chan)) { 1916 IEEE80211_DISCARD(ic, 1917 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1918 wh, ieee80211_mgt_subtype_name[subtype >> 1919 IEEE80211_FC0_SUBTYPE_SHIFT], 1920 "invalid channel %u", scan.chan); 1921 ic->ic_stats.is_rx_badchan++; 1922 return; 1923 } 1924 if (scan.chan != scan.bchan && 1925 ic->ic_phytype != IEEE80211_T_FH) { 1926 /* 1927 * Frame was received on a channel different from the 1928 * one indicated in the DS params element id; 1929 * silently discard it. 1930 * 1931 * NB: this can happen due to signal leakage. 1932 * But we should take it for FH phy because 1933 * the rssi value should be correct even for 1934 * different hop pattern in FH. 1935 */ 1936 IEEE80211_DISCARD(ic, 1937 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1938 wh, ieee80211_mgt_subtype_name[subtype >> 1939 IEEE80211_FC0_SUBTYPE_SHIFT], 1940 "for off-channel %u", scan.chan); 1941 ic->ic_stats.is_rx_chanmismatch++; 1942 return; 1943 } 1944 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 1945 scan.bintval <= IEEE80211_BINTVAL_MAX)) { 1946 IEEE80211_DISCARD(ic, 1947 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1948 wh, ieee80211_mgt_subtype_name[subtype >> 1949 IEEE80211_FC0_SUBTYPE_SHIFT], 1950 "bogus beacon interval", scan.bintval); 1951 ic->ic_stats.is_rx_badbintval++; 1952 return; 1953 } 1954 1955 if (ni != ic->ic_bss) { 1956 ni = ieee80211_refine_node_for_beacon(ic, ni, 1957 &ic->ic_channels[scan.chan], scan.ssid); 1958 } 1959 /* 1960 * Count frame now that we know it's to be processed. 1961 */ 1962 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) { 1963 ic->ic_stats.is_rx_beacon++; /* XXX remove */ 1964 IEEE80211_NODE_STAT(ni, rx_beacons); 1965 } else 1966 IEEE80211_NODE_STAT(ni, rx_proberesp); 1967 1968 /* 1969 * When operating in station mode, check for state updates. 1970 * Be careful to ignore beacons received while doing a 1971 * background scan. We consider only 11g/WMM stuff right now. 1972 */ 1973 if (ic->ic_opmode == IEEE80211_M_STA && 1974 ni->ni_associd != 0 && 1975 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 || 1976 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) { 1977 /* record tsf of last beacon */ 1978 memcpy(ni->ni_tstamp.data, scan.tstamp, 1979 sizeof(ni->ni_tstamp)); 1980 if (ni->ni_erp != scan.erp) { 1981 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 1982 "[%s] erp change: was 0x%x, now 0x%x\n", 1983 ether_sprintf(wh->i_addr2), 1984 ni->ni_erp, scan.erp); 1985 if (ic->ic_curmode == IEEE80211_MODE_11G && 1986 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 1987 ic->ic_flags |= IEEE80211_F_USEPROT; 1988 else 1989 ic->ic_flags &= ~IEEE80211_F_USEPROT; 1990 ni->ni_erp = scan.erp; 1991 /* XXX statistic */ 1992 } 1993 if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) { 1994 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 1995 "[%s] capabilities change: before 0x%x," 1996 " now 0x%x\n", 1997 ether_sprintf(wh->i_addr2), 1998 ni->ni_capinfo, scan.capinfo); 1999 /* 2000 * NB: we assume short preamble doesn't 2001 * change dynamically 2002 */ 2003 ieee80211_set_shortslottime(ic, 2004 ic->ic_curmode == IEEE80211_MODE_11A || 2005 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2006 ni->ni_capinfo = scan.capinfo; 2007 /* XXX statistic */ 2008 } 2009 if (scan.wme != NULL && 2010 (ni->ni_flags & IEEE80211_NODE_QOS) && 2011 ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0) 2012 ieee80211_wme_updateparams(ic); 2013 if (scan.tim != NULL) { 2014 struct ieee80211_tim_ie *ie = 2015 (struct ieee80211_tim_ie *) scan.tim; 2016 2017 ni->ni_dtim_count = ie->tim_count; 2018 ni->ni_dtim_period = ie->tim_period; 2019 } 2020 if (ic->ic_flags & IEEE80211_F_SCAN) 2021 ieee80211_add_scan(ic, &scan, wh, 2022 subtype, rssi, rstamp); 2023 return; 2024 } 2025 /* 2026 * If scanning, just pass information to the scan module. 2027 */ 2028 if (ic->ic_flags & IEEE80211_F_SCAN) { 2029 ieee80211_add_scan(ic, &scan, wh, 2030 subtype, rssi, rstamp); 2031 return; 2032 } 2033 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) { 2034 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 2035 /* 2036 * Create a new entry in the neighbor table. 2037 */ 2038 ni = ieee80211_add_neighbor(ic, wh, &scan); 2039 } else if (ni->ni_capinfo == 0) { 2040 /* 2041 * Initialize a node that was "faked 2042 * up." This updates the TSF, too. 2043 */ 2044 ieee80211_init_neighbor(ic, ni, wh, &scan, 0); 2045 } else { 2046 /* 2047 * Record tsf for potential resync. 2048 */ 2049 memcpy(ni->ni_tstamp.data, scan.tstamp, 2050 sizeof(ni->ni_tstamp)); 2051 } 2052 if (ni != NULL) { 2053 ni->ni_rssi = rssi; 2054 ni->ni_rstamp = rstamp; 2055 } 2056 } 2057 break; 2058 } 2059 2060 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 2061 if (ic->ic_opmode == IEEE80211_M_STA || 2062 ic->ic_state != IEEE80211_S_RUN) { 2063 ic->ic_stats.is_rx_mgtdiscard++; 2064 return; 2065 } 2066 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) { 2067 /* frame must be directed */ 2068 ic->ic_stats.is_rx_mgtdiscard++; /* XXX stat */ 2069 return; 2070 } 2071 2072 /* 2073 * prreq frame format 2074 * [tlv] ssid 2075 * [tlv] supported rates 2076 * [tlv] extended supported rates 2077 */ 2078 ssid = rates = xrates = NULL; 2079 while (frm < efrm) { 2080 switch (*frm) { 2081 case IEEE80211_ELEMID_SSID: 2082 ssid = frm; 2083 break; 2084 case IEEE80211_ELEMID_RATES: 2085 rates = frm; 2086 break; 2087 case IEEE80211_ELEMID_XRATES: 2088 xrates = frm; 2089 break; 2090 } 2091 frm += frm[1] + 2; 2092 } 2093 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2094 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2095 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2096 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) { 2097 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 2098 wh, ieee80211_mgt_subtype_name[subtype >> 2099 IEEE80211_FC0_SUBTYPE_SHIFT], 2100 "%s", "no ssid with ssid suppression enabled"); 2101 ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/ 2102 return; 2103 } 2104 2105 if (ni == ic->ic_bss) { 2106 if (ic->ic_opmode != IEEE80211_M_IBSS) 2107 ni = ieee80211_tmp_node(ic, wh->i_addr2); 2108 else if (IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) 2109 ; 2110 else { 2111 /* 2112 * XXX Cannot tell if the sender is operating 2113 * in ibss mode. But we need a new node to 2114 * send the response so blindly add them to the 2115 * neighbor table. 2116 */ 2117 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 2118 wh->i_addr2); 2119 } 2120 if (ni == NULL) 2121 return; 2122 allocbs = 1; 2123 } else 2124 allocbs = 0; 2125 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2126 "[%s] recv probe req\n", ether_sprintf(wh->i_addr2)); 2127 ni->ni_rssi = rssi; 2128 ni->ni_rstamp = rstamp; 2129 rate = ieee80211_setup_rates(ni, rates, xrates, 2130 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE 2131 | IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 2132 if (rate & IEEE80211_RATE_BASIC) { 2133 IEEE80211_DISCARD(ic, IEEE80211_MSG_XRATE, 2134 wh, ieee80211_mgt_subtype_name[subtype >> 2135 IEEE80211_FC0_SUBTYPE_SHIFT], 2136 "%s", "recv'd rate set invalid"); 2137 } else { 2138 IEEE80211_SEND_MGMT(ic, ni, 2139 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0); 2140 } 2141 if (allocbs && ic->ic_opmode != IEEE80211_M_IBSS) { 2142 /* reclaim immediately */ 2143 ieee80211_free_node(ni); 2144 } 2145 break; 2146 2147 case IEEE80211_FC0_SUBTYPE_AUTH: { 2148 u_int16_t algo, seq, status; 2149 /* 2150 * auth frame format 2151 * [2] algorithm 2152 * [2] sequence 2153 * [2] status 2154 * [tlv*] challenge 2155 */ 2156 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2157 algo = le16toh(*(u_int16_t *)frm); 2158 seq = le16toh(*(u_int16_t *)(frm + 2)); 2159 status = le16toh(*(u_int16_t *)(frm + 4)); 2160 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2161 "[%s] recv auth frame with algorithm %d seq %d\n", 2162 ether_sprintf(wh->i_addr2), algo, seq); 2163 /* 2164 * Consult the ACL policy module if setup. 2165 */ 2166 if (ic->ic_acl != NULL && 2167 !ic->ic_acl->iac_check(ic, wh->i_addr2)) { 2168 IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL, 2169 wh, "auth", "%s", "disallowed by ACL"); 2170 ic->ic_stats.is_rx_acl++; 2171 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2172 IEEE80211_SEND_MGMT(ic, ni, 2173 IEEE80211_FC0_SUBTYPE_AUTH, 2174 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16)); 2175 } 2176 return; 2177 } 2178 if (ic->ic_flags & IEEE80211_F_COUNTERM) { 2179 IEEE80211_DISCARD(ic, 2180 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO, 2181 wh, "auth", "%s", "TKIP countermeasures enabled"); 2182 ic->ic_stats.is_rx_auth_countermeasures++; 2183 #ifndef IEEE80211_NO_HOSTAP 2184 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2185 IEEE80211_SEND_MGMT(ic, ni, 2186 IEEE80211_FC0_SUBTYPE_AUTH, 2187 IEEE80211_REASON_MIC_FAILURE); 2188 } 2189 #endif /* !IEEE80211_NO_HOSTAP */ 2190 return; 2191 } 2192 if (algo == IEEE80211_AUTH_ALG_SHARED) 2193 ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi, 2194 rstamp, seq, status); 2195 else if (algo == IEEE80211_AUTH_ALG_OPEN) 2196 ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq, 2197 status); 2198 else { 2199 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2200 wh, "auth", "unsupported alg %d", algo); 2201 ic->ic_stats.is_rx_auth_unsupported++; 2202 #ifndef IEEE80211_NO_HOSTAP 2203 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2204 /* XXX not right */ 2205 IEEE80211_SEND_MGMT(ic, ni, 2206 IEEE80211_FC0_SUBTYPE_AUTH, 2207 (seq+1) | (IEEE80211_STATUS_ALG<<16)); 2208 } 2209 #endif /* !IEEE80211_NO_HOSTAP */ 2210 return; 2211 } 2212 break; 2213 } 2214 2215 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 2216 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: { 2217 u_int16_t capinfo, lintval; 2218 struct ieee80211_rsnparms rsn; 2219 u_int8_t reason; 2220 2221 if (ic->ic_opmode != IEEE80211_M_HOSTAP || 2222 ic->ic_state != IEEE80211_S_RUN) { 2223 ic->ic_stats.is_rx_mgtdiscard++; 2224 return; 2225 } 2226 2227 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 2228 reassoc = 1; 2229 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP; 2230 } else { 2231 reassoc = 0; 2232 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP; 2233 } 2234 /* 2235 * asreq frame format 2236 * [2] capability information 2237 * [2] listen interval 2238 * [6*] current AP address (reassoc only) 2239 * [tlv] ssid 2240 * [tlv] supported rates 2241 * [tlv] extended supported rates 2242 * [tlv] WPA or RSN 2243 */ 2244 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4)); 2245 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) { 2246 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2247 wh, ieee80211_mgt_subtype_name[subtype >> 2248 IEEE80211_FC0_SUBTYPE_SHIFT], 2249 "%s", "wrong bssid"); 2250 ic->ic_stats.is_rx_assoc_bss++; 2251 return; 2252 } 2253 capinfo = le16toh(*(u_int16_t *)frm); frm += 2; 2254 lintval = le16toh(*(u_int16_t *)frm); frm += 2; 2255 if (reassoc) 2256 frm += 6; /* ignore current AP info */ 2257 ssid = rates = xrates = wpa = wme = NULL; 2258 while (frm < efrm) { 2259 switch (*frm) { 2260 case IEEE80211_ELEMID_SSID: 2261 ssid = frm; 2262 break; 2263 case IEEE80211_ELEMID_RATES: 2264 rates = frm; 2265 break; 2266 case IEEE80211_ELEMID_XRATES: 2267 xrates = frm; 2268 break; 2269 /* XXX verify only one of RSN and WPA ie's? */ 2270 case IEEE80211_ELEMID_RSN: 2271 wpa = frm; 2272 break; 2273 case IEEE80211_ELEMID_VENDOR: 2274 if (iswpaoui(frm)) 2275 wpa = frm; 2276 else if (iswmeinfo(frm)) 2277 wme = frm; 2278 /* XXX Atheros OUI support */ 2279 break; 2280 } 2281 frm += frm[1] + 2; 2282 } 2283 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2284 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2285 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2286 2287 if (ni == ic->ic_bss) { 2288 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2289 "[%s] deny %s request, sta not authenticated\n", 2290 ether_sprintf(wh->i_addr2), 2291 reassoc ? "reassoc" : "assoc"); 2292 ieee80211_send_error(ic, ni, wh->i_addr2, 2293 IEEE80211_FC0_SUBTYPE_DEAUTH, 2294 IEEE80211_REASON_ASSOC_NOT_AUTHED); 2295 ic->ic_stats.is_rx_assoc_notauth++; 2296 return; 2297 } 2298 /* assert right associstion security credentials */ 2299 if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) { 2300 IEEE80211_DPRINTF(ic, 2301 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2302 "[%s] no WPA/RSN IE in association request\n", 2303 ether_sprintf(wh->i_addr2)); 2304 IEEE80211_SEND_MGMT(ic, ni, 2305 IEEE80211_FC0_SUBTYPE_DEAUTH, 2306 IEEE80211_REASON_RSN_REQUIRED); 2307 ieee80211_node_leave(ic, ni); 2308 /* XXX distinguish WPA/RSN? */ 2309 ic->ic_stats.is_rx_assoc_badwpaie++; 2310 return; 2311 } 2312 if (wpa != NULL) { 2313 /* 2314 * Parse WPA information element. Note that 2315 * we initialize the param block from the node 2316 * state so that information in the IE overrides 2317 * our defaults. The resulting parameters are 2318 * installed below after the association is assured. 2319 */ 2320 rsn = ni->ni_rsn; 2321 if (wpa[0] != IEEE80211_ELEMID_RSN) 2322 reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh); 2323 else 2324 reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh); 2325 if (reason != 0) { 2326 IEEE80211_SEND_MGMT(ic, ni, 2327 IEEE80211_FC0_SUBTYPE_DEAUTH, reason); 2328 ieee80211_node_leave(ic, ni); 2329 /* XXX distinguish WPA/RSN? */ 2330 ic->ic_stats.is_rx_assoc_badwpaie++; 2331 return; 2332 } 2333 IEEE80211_DPRINTF(ic, 2334 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2335 "[%s] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n", 2336 ether_sprintf(wh->i_addr2), 2337 wpa[0] != IEEE80211_ELEMID_RSN ? "WPA" : "RSN", 2338 rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen, 2339 rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen, 2340 rsn.rsn_keymgmt, rsn.rsn_caps); 2341 } 2342 /* discard challenge after association */ 2343 if (ni->ni_challenge != NULL) { 2344 FREE(ni->ni_challenge, M_DEVBUF); 2345 ni->ni_challenge = NULL; 2346 } 2347 /* NB: 802.11 spec says to ignore station's privacy bit */ 2348 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) { 2349 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2350 "[%s] deny %s request, capability mismatch 0x%x\n", 2351 ether_sprintf(wh->i_addr2), 2352 reassoc ? "reassoc" : "assoc", capinfo); 2353 IEEE80211_SEND_MGMT(ic, ni, resp, 2354 IEEE80211_STATUS_CAPINFO); 2355 ieee80211_node_leave(ic, ni); 2356 ic->ic_stats.is_rx_assoc_capmismatch++; 2357 return; 2358 } 2359 rate = ieee80211_setup_rates(ni, rates, xrates, 2360 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2361 IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 2362 /* 2363 * If constrained to 11g-only stations reject an 2364 * 11b-only station. We cheat a bit here by looking 2365 * at the max negotiated xmit rate and assuming anyone 2366 * with a best rate <24Mb/s is an 11b station. 2367 */ 2368 if ((rate & IEEE80211_RATE_BASIC) || 2369 ((ic->ic_flags & IEEE80211_F_PUREG) && rate < 48)) { 2370 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2371 "[%s] deny %s request, rate set mismatch\n", 2372 ether_sprintf(wh->i_addr2), 2373 reassoc ? "reassoc" : "assoc"); 2374 IEEE80211_SEND_MGMT(ic, ni, resp, 2375 IEEE80211_STATUS_BASIC_RATE); 2376 ieee80211_node_leave(ic, ni); 2377 ic->ic_stats.is_rx_assoc_norate++; 2378 return; 2379 } 2380 ni->ni_rssi = rssi; 2381 ni->ni_rstamp = rstamp; 2382 ni->ni_intval = lintval; 2383 ni->ni_capinfo = capinfo; 2384 ni->ni_chan = ic->ic_bss->ni_chan; 2385 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell; 2386 ni->ni_fhindex = ic->ic_bss->ni_fhindex; 2387 if (wpa != NULL) { 2388 /* 2389 * Record WPA/RSN parameters for station, mark 2390 * node as using WPA and record information element 2391 * for applications that require it. 2392 */ 2393 ni->ni_rsn = rsn; 2394 ieee80211_saveie(&ni->ni_wpa_ie, wpa); 2395 } else if (ni->ni_wpa_ie != NULL) { 2396 /* 2397 * Flush any state from a previous association. 2398 */ 2399 FREE(ni->ni_wpa_ie, M_DEVBUF); 2400 ni->ni_wpa_ie = NULL; 2401 } 2402 if (wme != NULL) { 2403 /* 2404 * Record WME parameters for station, mark node 2405 * as capable of QoS and record information 2406 * element for applications that require it. 2407 */ 2408 ieee80211_saveie(&ni->ni_wme_ie, wme); 2409 ni->ni_flags |= IEEE80211_NODE_QOS; 2410 } else if (ni->ni_wme_ie != NULL) { 2411 /* 2412 * Flush any state from a previous association. 2413 */ 2414 FREE(ni->ni_wme_ie, M_DEVBUF); 2415 ni->ni_wme_ie = NULL; 2416 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2417 } 2418 ieee80211_node_join(ic, ni, resp); 2419 break; 2420 } 2421 2422 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 2423 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: { 2424 u_int16_t capinfo, associd; 2425 u_int16_t status; 2426 2427 if (ic->ic_opmode != IEEE80211_M_STA || 2428 ic->ic_state != IEEE80211_S_ASSOC) { 2429 ic->ic_stats.is_rx_mgtdiscard++; 2430 return; 2431 } 2432 2433 /* 2434 * asresp frame format 2435 * [2] capability information 2436 * [2] status 2437 * [2] association ID 2438 * [tlv] supported rates 2439 * [tlv] extended supported rates 2440 * [tlv] WME 2441 */ 2442 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2443 ni = ic->ic_bss; 2444 capinfo = le16toh(*(u_int16_t *)frm); 2445 frm += 2; 2446 status = le16toh(*(u_int16_t *)frm); 2447 frm += 2; 2448 if (status != 0) { 2449 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2450 "[%s] %sassoc failed (reason %d)\n", 2451 ether_sprintf(wh->i_addr2), 2452 ISREASSOC(subtype) ? "re" : "", status); 2453 if (ni != ic->ic_bss) /* XXX never true? */ 2454 ni->ni_fails++; 2455 ic->ic_stats.is_rx_auth_fail++; /* XXX */ 2456 return; 2457 } 2458 associd = le16toh(*(u_int16_t *)frm); 2459 frm += 2; 2460 2461 rates = xrates = wpa = wme = NULL; 2462 while (frm < efrm) { 2463 switch (*frm) { 2464 case IEEE80211_ELEMID_RATES: 2465 rates = frm; 2466 break; 2467 case IEEE80211_ELEMID_XRATES: 2468 xrates = frm; 2469 break; 2470 case IEEE80211_ELEMID_VENDOR: 2471 if (iswmeoui(frm)) 2472 wme = frm; 2473 /* XXX Atheros OUI support */ 2474 break; 2475 } 2476 frm += frm[1] + 2; 2477 } 2478 2479 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2480 rate = ieee80211_setup_rates(ni, rates, xrates, 2481 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2482 IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 2483 if (rate & IEEE80211_RATE_BASIC) { 2484 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2485 "[%s] %sassoc failed (rate set mismatch)\n", 2486 ether_sprintf(wh->i_addr2), 2487 ISREASSOC(subtype) ? "re" : ""); 2488 if (ni != ic->ic_bss) /* XXX never true? */ 2489 ni->ni_fails++; 2490 ic->ic_stats.is_rx_assoc_norate++; 2491 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 2492 return; 2493 } 2494 2495 ni->ni_capinfo = capinfo; 2496 ni->ni_associd = associd; 2497 if (wme != NULL && 2498 ieee80211_parse_wmeparams(ic, wme, wh) >= 0) { 2499 ni->ni_flags |= IEEE80211_NODE_QOS; 2500 ieee80211_wme_updateparams(ic); 2501 } else 2502 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2503 /* 2504 * Configure state now that we are associated. 2505 * 2506 * XXX may need different/additional driver callbacks? 2507 */ 2508 if (ic->ic_curmode == IEEE80211_MODE_11A || 2509 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) { 2510 ic->ic_flags |= IEEE80211_F_SHPREAMBLE; 2511 ic->ic_flags &= ~IEEE80211_F_USEBARKER; 2512 } else { 2513 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE; 2514 ic->ic_flags |= IEEE80211_F_USEBARKER; 2515 } 2516 ieee80211_set_shortslottime(ic, 2517 ic->ic_curmode == IEEE80211_MODE_11A || 2518 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2519 /* 2520 * Honor ERP protection. 2521 * 2522 * NB: ni_erp should zero for non-11g operation. 2523 * XXX check ic_curmode anyway? 2524 */ 2525 if (ic->ic_curmode == IEEE80211_MODE_11G && 2526 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 2527 ic->ic_flags |= IEEE80211_F_USEPROT; 2528 else 2529 ic->ic_flags &= ~IEEE80211_F_USEPROT; 2530 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2531 "[%s] %sassoc success: %s preamble, %s slot time%s%s\n", 2532 ether_sprintf(wh->i_addr2), 2533 ISREASSOC(subtype) ? "re" : "", 2534 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long", 2535 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long", 2536 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "", 2537 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "" 2538 ); 2539 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype); 2540 break; 2541 } 2542 2543 case IEEE80211_FC0_SUBTYPE_DEAUTH: { 2544 u_int16_t reason; 2545 2546 if (ic->ic_state == IEEE80211_S_SCAN) { 2547 ic->ic_stats.is_rx_mgtdiscard++; 2548 return; 2549 } 2550 /* 2551 * deauth frame format 2552 * [2] reason 2553 */ 2554 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2555 reason = le16toh(*(u_int16_t *)frm); 2556 ic->ic_stats.is_rx_deauth++; 2557 IEEE80211_NODE_STAT(ni, rx_deauth); 2558 2559 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2560 "[%s] recv deauthenticate (reason %d)\n", 2561 ether_sprintf(ni->ni_macaddr), reason); 2562 switch (ic->ic_opmode) { 2563 case IEEE80211_M_STA: 2564 ieee80211_new_state(ic, IEEE80211_S_AUTH, 2565 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2566 break; 2567 case IEEE80211_M_HOSTAP: 2568 #ifndef IEEE80211_NO_HOSTAP 2569 if (ni != ic->ic_bss) 2570 ieee80211_node_leave(ic, ni); 2571 #endif /* !IEEE80211_NO_HOSTAP */ 2572 break; 2573 default: 2574 ic->ic_stats.is_rx_mgtdiscard++; 2575 break; 2576 } 2577 break; 2578 } 2579 2580 case IEEE80211_FC0_SUBTYPE_DISASSOC: { 2581 u_int16_t reason; 2582 2583 if (ic->ic_state != IEEE80211_S_RUN && 2584 ic->ic_state != IEEE80211_S_ASSOC && 2585 ic->ic_state != IEEE80211_S_AUTH) { 2586 ic->ic_stats.is_rx_mgtdiscard++; 2587 return; 2588 } 2589 /* 2590 * disassoc frame format 2591 * [2] reason 2592 */ 2593 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2594 reason = le16toh(*(u_int16_t *)frm); 2595 ic->ic_stats.is_rx_disassoc++; 2596 IEEE80211_NODE_STAT(ni, rx_disassoc); 2597 2598 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2599 "[%s] recv disassociate (reason %d)\n", 2600 ether_sprintf(ni->ni_macaddr), reason); 2601 switch (ic->ic_opmode) { 2602 case IEEE80211_M_STA: 2603 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 2604 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2605 break; 2606 case IEEE80211_M_HOSTAP: 2607 #ifndef IEEE80211_NO_HOSTAP 2608 if (ni != ic->ic_bss) 2609 ieee80211_node_leave(ic, ni); 2610 #endif /* !IEEE80211_NO_HOSTAP */ 2611 break; 2612 default: 2613 ic->ic_stats.is_rx_mgtdiscard++; 2614 break; 2615 } 2616 break; 2617 } 2618 default: 2619 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2620 wh, "mgt", "subtype 0x%x not handled", subtype); 2621 ic->ic_stats.is_rx_badsubtype++; 2622 break; 2623 } 2624 #undef ISREASSOC 2625 #undef ISPROBE 2626 } 2627 #undef IEEE80211_VERIFY_LENGTH 2628 #undef IEEE80211_VERIFY_ELEMENT 2629 2630 #ifndef IEEE80211_NO_HOSTAP 2631 /* 2632 * Handle station power-save state change. 2633 */ 2634 static void 2635 ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable) 2636 { 2637 struct ieee80211com *ic = ni->ni_ic; 2638 struct mbuf *m; 2639 2640 if (enable) { 2641 if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) 2642 ic->ic_ps_sta++; 2643 ni->ni_flags |= IEEE80211_NODE_PWR_MGT; 2644 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2645 "[%s] power save mode on, %u sta's in ps mode\n", 2646 ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta); 2647 return; 2648 } 2649 2650 if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) 2651 ic->ic_ps_sta--; 2652 ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT; 2653 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2654 "[%s] power save mode off, %u sta's in ps mode\n", 2655 ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta); 2656 /* XXX if no stations in ps mode, flush mc frames */ 2657 2658 /* 2659 * Flush queued unicast frames. 2660 */ 2661 if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) { 2662 if (ic->ic_set_tim != NULL) 2663 ic->ic_set_tim(ni, 0); /* just in case */ 2664 return; 2665 } 2666 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2667 "[%s] flush ps queue, %u packets queued\n", 2668 ether_sprintf(ni->ni_macaddr), IEEE80211_NODE_SAVEQ_QLEN(ni)); 2669 for (;;) { 2670 int qlen; 2671 2672 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2673 if (m == NULL) 2674 break; 2675 /* 2676 * If this is the last packet, turn off the TIM bit. 2677 * If there are more packets, set the more packets bit 2678 * in the mbuf so ieee80211_encap will mark the 802.11 2679 * head to indicate more data frames will follow. 2680 */ 2681 if (qlen != 0) 2682 m->m_flags |= M_MORE_DATA; 2683 /* XXX need different driver interface */ 2684 /* XXX bypasses q max */ 2685 IF_ENQUEUE(&ic->ic_ifp->if_snd, m); 2686 } 2687 if (ic->ic_set_tim != NULL) 2688 ic->ic_set_tim(ni, 0); 2689 } 2690 2691 /* 2692 * Process a received ps-poll frame. 2693 */ 2694 static void 2695 ieee80211_recv_pspoll(struct ieee80211com *ic, 2696 struct ieee80211_node *ni, struct mbuf *m0) 2697 { 2698 struct ieee80211_frame_min *wh; 2699 struct mbuf *m; 2700 u_int16_t aid; 2701 int qlen; 2702 2703 wh = mtod(m0, struct ieee80211_frame_min *); 2704 if (ni->ni_associd == 0) { 2705 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2706 (struct ieee80211_frame *) wh, "ps-poll", 2707 "%s", "unassociated station"); 2708 ic->ic_stats.is_ps_unassoc++; 2709 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2710 IEEE80211_REASON_NOT_ASSOCED); 2711 return; 2712 } 2713 2714 aid = le16toh(*(u_int16_t *)wh->i_dur); 2715 if (aid != ni->ni_associd) { 2716 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2717 (struct ieee80211_frame *) wh, "ps-poll", 2718 "aid mismatch: sta aid 0x%x poll aid 0x%x", 2719 ni->ni_associd, aid); 2720 ic->ic_stats.is_ps_badaid++; 2721 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2722 IEEE80211_REASON_NOT_ASSOCED); 2723 return; 2724 } 2725 2726 /* Okay, take the first queued packet and put it out... */ 2727 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2728 if (m == NULL) { 2729 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2730 "[%s] recv ps-poll, but queue empty\n", 2731 ether_sprintf(wh->i_addr2)); 2732 ieee80211_send_nulldata(ieee80211_ref_node(ni)); 2733 ic->ic_stats.is_ps_qempty++; /* XXX node stat */ 2734 if (ic->ic_set_tim != NULL) 2735 ic->ic_set_tim(ni, 0); /* just in case */ 2736 return; 2737 } 2738 /* 2739 * If there are more packets, set the more packets bit 2740 * in the packet dispatched to the station; otherwise 2741 * turn off the TIM bit. 2742 */ 2743 if (qlen != 0) { 2744 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2745 "[%s] recv ps-poll, send packet, %u still queued\n", 2746 ether_sprintf(ni->ni_macaddr), qlen); 2747 m->m_flags |= M_MORE_DATA; 2748 } else { 2749 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2750 "[%s] recv ps-poll, send packet, queue empty\n", 2751 ether_sprintf(ni->ni_macaddr)); 2752 if (ic->ic_set_tim != NULL) 2753 ic->ic_set_tim(ni, 0); 2754 } 2755 m->m_flags |= M_PWR_SAV; /* bypass PS handling */ 2756 IF_ENQUEUE(&ic->ic_ifp->if_snd, m); 2757 } 2758 #endif /* !IEEE80211_NO_HOSTAP */ 2759 2760 #ifdef IEEE80211_DEBUG 2761 /* 2762 * Debugging support. 2763 */ 2764 2765 /* 2766 * Return the bssid of a frame. 2767 */ 2768 static const u_int8_t * 2769 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh) 2770 { 2771 if (ic->ic_opmode == IEEE80211_M_STA) 2772 return wh->i_addr2; 2773 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS) 2774 return wh->i_addr1; 2775 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL) 2776 return wh->i_addr1; 2777 return wh->i_addr3; 2778 } 2779 2780 void 2781 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...) 2782 { 2783 char buf[128]; /* XXX */ 2784 va_list ap; 2785 2786 va_start(ap, fmt); 2787 vsnprintf(buf, sizeof(buf), fmt, ap); 2788 va_end(ap); 2789 2790 if_printf(ic->ic_ifp, "%s", buf); /* NB: no \n */ 2791 } 2792 2793 void 2794 ieee80211_note_frame(struct ieee80211com *ic, 2795 const struct ieee80211_frame *wh, 2796 const char *fmt, ...) 2797 { 2798 char buf[128]; /* XXX */ 2799 va_list ap; 2800 2801 va_start(ap, fmt); 2802 vsnprintf(buf, sizeof(buf), fmt, ap); 2803 va_end(ap); 2804 if_printf(ic->ic_ifp, "[%s] %s\n", 2805 ether_sprintf(ieee80211_getbssid(ic, wh)), buf); 2806 } 2807 2808 void 2809 ieee80211_note_mac(struct ieee80211com *ic, 2810 const u_int8_t mac[IEEE80211_ADDR_LEN], 2811 const char *fmt, ...) 2812 { 2813 char buf[128]; /* XXX */ 2814 va_list ap; 2815 2816 va_start(ap, fmt); 2817 vsnprintf(buf, sizeof(buf), fmt, ap); 2818 va_end(ap); 2819 if_printf(ic->ic_ifp, "[%s] %s\n", ether_sprintf(mac), buf); 2820 } 2821 2822 static void 2823 ieee80211_discard_frame(struct ieee80211com *ic, 2824 const struct ieee80211_frame *wh, 2825 const char *type, const char *fmt, ...) 2826 { 2827 va_list ap; 2828 2829 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, 2830 ether_sprintf(ieee80211_getbssid(ic, wh))); 2831 if (type != NULL) 2832 printf("%s frame, ", type); 2833 else 2834 printf("frame, "); 2835 va_start(ap, fmt); 2836 vprintf(fmt, ap); 2837 va_end(ap); 2838 printf("\n"); 2839 } 2840 2841 static void 2842 ieee80211_discard_ie(struct ieee80211com *ic, 2843 const struct ieee80211_frame *wh, 2844 const char *type, const char *fmt, ...) 2845 { 2846 va_list ap; 2847 2848 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, 2849 ether_sprintf(ieee80211_getbssid(ic, wh))); 2850 if (type != NULL) 2851 printf("%s information element, ", type); 2852 else 2853 printf("information element, "); 2854 va_start(ap, fmt); 2855 vprintf(fmt, ap); 2856 va_end(ap); 2857 printf("\n"); 2858 } 2859 2860 static void 2861 ieee80211_discard_mac(struct ieee80211com *ic, 2862 const u_int8_t mac[IEEE80211_ADDR_LEN], 2863 const char *type, const char *fmt, ...) 2864 { 2865 va_list ap; 2866 2867 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, ether_sprintf(mac)); 2868 if (type != NULL) 2869 printf("%s frame, ", type); 2870 else 2871 printf("frame, "); 2872 va_start(ap, fmt); 2873 vprintf(fmt, ap); 2874 va_end(ap); 2875 printf("\n"); 2876 } 2877 #endif /* IEEE80211_DEBUG */ 2878
Indexes created Wed Sep 24 05:09:52 GMT 2025