ieee80211_input.c revision 1.82
1 /* $NetBSD: ieee80211_input.c,v 1.82 2016/04/20 09:01:04 knakahara Exp $ */ 2 /*- 3 * Copyright (c) 2001 Atsushi Onoe 4 * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote products 16 * derived from this software without specific prior written permission. 17 * 18 * Alternatively, this software may be distributed under the terms of the 19 * GNU General Public License ("GPL") version 2 as published by the Free 20 * Software Foundation. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 #ifdef __FreeBSD__ 36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_input.c,v 1.81 2005/08/10 16:22:29 sam Exp $"); 37 #endif 38 #ifdef __NetBSD__ 39 __KERNEL_RCSID(0, "$NetBSD: ieee80211_input.c,v 1.82 2016/04/20 09:01:04 knakahara Exp $"); 40 #endif 41 42 #ifdef _KERNEL_OPT 43 #include "opt_inet.h" 44 #endif 45 46 #ifdef __NetBSD__ 47 #endif /* __NetBSD__ */ 48 49 #include <sys/param.h> 50 #include <sys/systm.h> 51 #include <sys/mbuf.h> 52 #include <sys/malloc.h> 53 #include <sys/endian.h> 54 #include <sys/kernel.h> 55 56 #include <sys/socket.h> 57 #include <sys/sockio.h> 58 #include <sys/endian.h> 59 #include <sys/errno.h> 60 #include <sys/proc.h> 61 #include <sys/sysctl.h> 62 63 #include <net/if.h> 64 #include <net/if_media.h> 65 #include <net/if_arp.h> 66 #include <net/if_ether.h> 67 #include <net/if_llc.h> 68 69 #include <net80211/ieee80211_netbsd.h> 70 #include <net80211/ieee80211_var.h> 71 72 #include <net/bpf.h> 73 74 #ifdef INET 75 #include <netinet/in.h> 76 #include <net/if_ether.h> 77 #endif 78 79 const struct timeval ieee80211_merge_print_intvl = {.tv_sec = 1, .tv_usec = 0}; 80 81 #ifdef IEEE80211_DEBUG 82 83 /* 84 * Decide if a received management frame should be 85 * printed when debugging is enabled. This filters some 86 * of the less interesting frames that come frequently 87 * (e.g. beacons). 88 */ 89 static __inline int 90 doprint(struct ieee80211com *ic, int subtype) 91 { 92 switch (subtype) { 93 case IEEE80211_FC0_SUBTYPE_BEACON: 94 return (ic->ic_flags & IEEE80211_F_SCAN); 95 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 96 return (ic->ic_opmode == IEEE80211_M_IBSS); 97 } 98 return 1; 99 } 100 101 /* 102 * Emit a debug message about discarding a frame or information 103 * element. One format is for extracting the mac address from 104 * the frame header; the other is for when a header is not 105 * available or otherwise appropriate. 106 */ 107 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do { \ 108 if ((_ic)->ic_debug & (_m)) \ 109 ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\ 110 } while (0) 111 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do { \ 112 if ((_ic)->ic_debug & (_m)) \ 113 ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\ 114 } while (0) 115 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do { \ 116 if ((_ic)->ic_debug & (_m)) \ 117 ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\ 118 } while (0) 119 120 static const u_int8_t *ieee80211_getbssid(struct ieee80211com *, 121 const struct ieee80211_frame *); 122 static void ieee80211_discard_frame(struct ieee80211com *, 123 const struct ieee80211_frame *, const char *type, const char *fmt, ...); 124 static void ieee80211_discard_ie(struct ieee80211com *, 125 const struct ieee80211_frame *, const char *type, const char *fmt, ...); 126 static void ieee80211_discard_mac(struct ieee80211com *, 127 const u_int8_t mac[IEEE80211_ADDR_LEN], const char *type, 128 const char *fmt, ...); 129 #else 130 #define IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) 131 #define IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) 132 #define IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) 133 #endif /* IEEE80211_DEBUG */ 134 135 static struct mbuf *ieee80211_defrag(struct ieee80211com *, 136 struct ieee80211_node *, struct mbuf *, int); 137 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int); 138 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *, 139 const u_int8_t *mac, int subtype, int arg); 140 static void ieee80211_deliver_data(struct ieee80211com *, 141 struct ieee80211_node *, struct mbuf *); 142 #ifndef IEEE80211_NO_HOSTAP 143 static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable); 144 static void ieee80211_recv_pspoll(struct ieee80211com *, 145 struct ieee80211_node *, struct mbuf *); 146 #endif /* !IEEE80211_NO_HOSTAP */ 147 static void ieee80211_update_adhoc_node(struct ieee80211com *, 148 struct ieee80211_node *, struct ieee80211_frame *, 149 struct ieee80211_scanparams *, int, u_int32_t); 150 151 /* 152 * Process a received frame. The node associated with the sender 153 * should be supplied. If nothing was found in the node table then 154 * the caller is assumed to supply a reference to ic_bss instead. 155 * The RSSI and a timestamp are also supplied. The RSSI data is used 156 * during AP scanning to select a AP to associate with; it can have 157 * any units so long as values have consistent units and higher values 158 * mean ``better signal''. The receive timestamp is currently not used 159 * by the 802.11 layer. 160 */ 161 int 162 ieee80211_input(struct ieee80211com *ic, struct mbuf *m, 163 struct ieee80211_node *ni, int rssi, u_int32_t rstamp) 164 { 165 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0) 166 #define HAS_SEQ(type) ((type & 0x4) == 0) 167 struct ifnet *ifp = ic->ic_ifp; 168 struct ieee80211_frame *wh; 169 struct ieee80211_key *key; 170 struct ether_header *eh; 171 int hdrspace; 172 u_int8_t dir, type, subtype; 173 u_int8_t *bssid; 174 u_int16_t rxseq; 175 176 IASSERT(ni != NULL, ("null node")); 177 ni->ni_inact = ni->ni_inact_reload; 178 179 /* trim CRC here so WEP can find its own CRC at the end of packet. */ 180 if (m->m_flags & M_HASFCS) { 181 m_adj(m, -IEEE80211_CRC_LEN); 182 m->m_flags &= ~M_HASFCS; 183 } 184 type = -1; /* undefined */ 185 /* 186 * In monitor mode, send everything directly to bpf. 187 * XXX may want to include the CRC 188 */ 189 if (ic->ic_opmode == IEEE80211_M_MONITOR) 190 goto out; 191 192 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) { 193 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 194 ni->ni_macaddr, NULL, 195 "too short (1): len %u", m->m_pkthdr.len); 196 ic->ic_stats.is_rx_tooshort++; 197 goto out; 198 } 199 /* 200 * Bit of a cheat here, we use a pointer for a 3-address 201 * frame format but don't reference fields past outside 202 * ieee80211_frame_min w/o first validating the data is 203 * present. 204 */ 205 wh = mtod(m, struct ieee80211_frame *); 206 207 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) != 208 IEEE80211_FC0_VERSION_0) { 209 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 210 ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]); 211 ic->ic_stats.is_rx_badversion++; 212 goto err; 213 } 214 215 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 216 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 217 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 218 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) { 219 switch (ic->ic_opmode) { 220 case IEEE80211_M_STA: 221 bssid = wh->i_addr2; 222 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) { 223 /* not interested in */ 224 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 225 bssid, NULL, "%s", "not to bss"); 226 ic->ic_stats.is_rx_wrongbss++; 227 goto out; 228 } 229 break; 230 case IEEE80211_M_IBSS: 231 case IEEE80211_M_AHDEMO: 232 case IEEE80211_M_HOSTAP: 233 if (dir != IEEE80211_FC1_DIR_NODS) 234 bssid = wh->i_addr1; 235 else if (type == IEEE80211_FC0_TYPE_CTL) 236 bssid = wh->i_addr1; 237 else { 238 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 239 IEEE80211_DISCARD_MAC(ic, 240 IEEE80211_MSG_ANY, ni->ni_macaddr, 241 NULL, "too short (2): len %u", 242 m->m_pkthdr.len); 243 ic->ic_stats.is_rx_tooshort++; 244 goto out; 245 } 246 bssid = wh->i_addr3; 247 } 248 if (type != IEEE80211_FC0_TYPE_DATA) 249 break; 250 /* 251 * Data frame, validate the bssid. 252 */ 253 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) && 254 !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) { 255 /* not interested in */ 256 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 257 bssid, NULL, "%s", "not to bss"); 258 ic->ic_stats.is_rx_wrongbss++; 259 goto out; 260 } 261 /* 262 * For adhoc mode we cons up a node when it doesn't 263 * exist. This should probably done after an ACL check. 264 */ 265 if (ni == ic->ic_bss && 266 ic->ic_opmode != IEEE80211_M_HOSTAP && 267 !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 268 /* 269 * Fake up a node for this newly 270 * discovered member of the IBSS. 271 */ 272 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 273 wh->i_addr2); 274 if (ni == NULL) { 275 /* NB: stat kept for alloc failure */ 276 goto err; 277 } 278 } 279 break; 280 default: 281 goto out; 282 } 283 ni->ni_rssi = rssi; 284 ni->ni_rstamp = rstamp; 285 if (HAS_SEQ(type)) { 286 u_int8_t tid; 287 if (ieee80211_has_qos(wh)) { 288 tid = ((struct ieee80211_qosframe *)wh)-> 289 i_qos[0] & IEEE80211_QOS_TID; 290 if (TID_TO_WME_AC(tid) >= WME_AC_VI) 291 ic->ic_wme.wme_hipri_traffic++; 292 tid++; 293 } else 294 tid = 0; 295 rxseq = le16toh(*(u_int16_t *)wh->i_seq); 296 if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) && 297 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) { 298 /* duplicate, discard */ 299 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 300 bssid, "duplicate", 301 "seqno <%u,%u> fragno <%u,%u> tid %u", 302 rxseq >> IEEE80211_SEQ_SEQ_SHIFT, 303 ni->ni_rxseqs[tid] >> 304 IEEE80211_SEQ_SEQ_SHIFT, 305 rxseq & IEEE80211_SEQ_FRAG_MASK, 306 ni->ni_rxseqs[tid] & 307 IEEE80211_SEQ_FRAG_MASK, 308 tid); 309 ic->ic_stats.is_rx_dup++; 310 IEEE80211_NODE_STAT(ni, rx_dup); 311 goto out; 312 } 313 ni->ni_rxseqs[tid] = rxseq; 314 } 315 } 316 317 switch (type) { 318 case IEEE80211_FC0_TYPE_DATA: 319 hdrspace = ieee80211_hdrspace(ic, wh); 320 if (m->m_len < hdrspace && 321 (m = m_pullup(m, hdrspace)) == NULL) { 322 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 323 ni->ni_macaddr, NULL, 324 "data too short: expecting %u", hdrspace); 325 ic->ic_stats.is_rx_tooshort++; 326 goto out; /* XXX */ 327 } 328 switch (ic->ic_opmode) { 329 case IEEE80211_M_STA: 330 if (dir != IEEE80211_FC1_DIR_FROMDS) { 331 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 332 wh, "data", "%s", "unknown dir 0x%x", dir); 333 ic->ic_stats.is_rx_wrongdir++; 334 goto out; 335 } 336 if ((ifp->if_flags & IFF_SIMPLEX) && 337 IEEE80211_IS_MULTICAST(wh->i_addr1) && 338 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) { 339 /* 340 * In IEEE802.11 network, multicast packet 341 * sent from me is broadcasted from AP. 342 * It should be silently discarded for 343 * SIMPLEX interface. 344 */ 345 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 346 wh, NULL, "%s", "multicast echo"); 347 ic->ic_stats.is_rx_mcastecho++; 348 goto out; 349 } 350 break; 351 case IEEE80211_M_IBSS: 352 case IEEE80211_M_AHDEMO: 353 if (dir != IEEE80211_FC1_DIR_NODS) { 354 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 355 wh, "data", "%s", "unknown dir 0x%x", dir); 356 ic->ic_stats.is_rx_wrongdir++; 357 goto out; 358 } 359 /* XXX no power-save support */ 360 break; 361 case IEEE80211_M_HOSTAP: 362 #ifndef IEEE80211_NO_HOSTAP 363 if (dir != IEEE80211_FC1_DIR_TODS) { 364 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 365 wh, "data", "%s", "unknown dir 0x%x", dir); 366 ic->ic_stats.is_rx_wrongdir++; 367 goto out; 368 } 369 /* check if source STA is associated */ 370 if (ni == ic->ic_bss) { 371 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 372 wh, "data", "%s", "unknown src"); 373 ieee80211_send_error(ic, ni, wh->i_addr2, 374 IEEE80211_FC0_SUBTYPE_DEAUTH, 375 IEEE80211_REASON_NOT_AUTHED); 376 ic->ic_stats.is_rx_notassoc++; 377 goto err; 378 } 379 if (ni->ni_associd == 0) { 380 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 381 wh, "data", "%s", "unassoc src"); 382 IEEE80211_SEND_MGMT(ic, ni, 383 IEEE80211_FC0_SUBTYPE_DISASSOC, 384 IEEE80211_REASON_NOT_ASSOCED); 385 ic->ic_stats.is_rx_notassoc++; 386 goto err; 387 } 388 389 /* 390 * Check for power save state change. 391 */ 392 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^ 393 (ni->ni_flags & IEEE80211_NODE_PWR_MGT))) 394 ieee80211_node_pwrsave(ni, 395 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT); 396 #endif /* !IEEE80211_NO_HOSTAP */ 397 break; 398 default: 399 /* XXX here to keep compiler happy */ 400 goto out; 401 } 402 403 /* 404 * Handle privacy requirements. Note that we 405 * must not be preempted from here until after 406 * we (potentially) call ieee80211_crypto_demic; 407 * otherwise we may violate assumptions in the 408 * crypto cipher modules used to do delayed update 409 * of replay sequence numbers. 410 */ 411 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 412 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 413 /* 414 * Discard encrypted frames when privacy is off. 415 */ 416 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 417 wh, "WEP", "%s", "PRIVACY off"); 418 ic->ic_stats.is_rx_noprivacy++; 419 IEEE80211_NODE_STAT(ni, rx_noprivacy); 420 goto out; 421 } 422 key = ieee80211_crypto_decap(ic, ni, m, hdrspace); 423 if (key == NULL) { 424 /* NB: stats+msgs handled in crypto_decap */ 425 IEEE80211_NODE_STAT(ni, rx_wepfail); 426 goto out; 427 } 428 wh = mtod(m, struct ieee80211_frame *); 429 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 430 } else { 431 key = NULL; 432 } 433 434 /* 435 * Next up, any fragmentation. 436 */ 437 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 438 m = ieee80211_defrag(ic, ni, m, hdrspace); 439 if (m == NULL) { 440 /* Fragment dropped or frame not complete yet */ 441 goto out; 442 } 443 } 444 wh = NULL; /* no longer valid, catch any uses */ 445 446 /* 447 * Next strip any MSDU crypto bits. 448 */ 449 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) { 450 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 451 ni->ni_macaddr, "data", "%s", "demic error"); 452 IEEE80211_NODE_STAT(ni, rx_demicfail); 453 goto out; 454 } 455 456 /* copy to listener after decrypt */ 457 bpf_mtap3(ic->ic_rawbpf, m); 458 459 /* 460 * Finally, strip the 802.11 header. 461 */ 462 m = ieee80211_decap(ic, m, hdrspace); 463 if (m == NULL) { 464 /* don't count Null data frames as errors */ 465 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA) 466 goto out; 467 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 468 ni->ni_macaddr, "data", "%s", "decap error"); 469 ic->ic_stats.is_rx_decap++; 470 IEEE80211_NODE_STAT(ni, rx_decap); 471 goto err; 472 } 473 eh = mtod(m, struct ether_header *); 474 if (!ieee80211_node_is_authorized(ni)) { 475 /* 476 * Deny any non-PAE frames received prior to 477 * authorization. For open/shared-key 478 * authentication the port is mark authorized 479 * after authentication completes. For 802.1x 480 * the port is not marked authorized by the 481 * authenticator until the handshake has completed. 482 */ 483 if (eh->ether_type != htons(ETHERTYPE_PAE)) { 484 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT, 485 eh->ether_shost, "data", 486 "unauthorized port: ether type 0x%x len %u", 487 eh->ether_type, m->m_pkthdr.len); 488 ic->ic_stats.is_rx_unauth++; 489 IEEE80211_NODE_STAT(ni, rx_unauth); 490 goto err; 491 } 492 } else { 493 /* 494 * When denying unencrypted frames, discard 495 * any non-PAE frames received without encryption. 496 */ 497 if ((ic->ic_flags & IEEE80211_F_DROPUNENC) && 498 key == NULL && 499 eh->ether_type != htons(ETHERTYPE_PAE)) { 500 /* 501 * Drop unencrypted frames. 502 */ 503 ic->ic_stats.is_rx_unencrypted++; 504 IEEE80211_NODE_STAT(ni, rx_unencrypted); 505 goto out; 506 } 507 } 508 ifp->if_ipackets++; 509 IEEE80211_NODE_STAT(ni, rx_data); 510 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len); 511 512 ieee80211_deliver_data(ic, ni, m); 513 return IEEE80211_FC0_TYPE_DATA; 514 515 case IEEE80211_FC0_TYPE_MGT: 516 IEEE80211_NODE_STAT(ni, rx_mgmt); 517 if (dir != IEEE80211_FC1_DIR_NODS) { 518 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 519 wh, "data", "%s", "unknown dir 0x%x", dir); 520 ic->ic_stats.is_rx_wrongdir++; 521 goto err; 522 } 523 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 524 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY, 525 ni->ni_macaddr, "mgt", "too short: len %u", 526 m->m_pkthdr.len); 527 ic->ic_stats.is_rx_tooshort++; 528 goto out; 529 } 530 #ifdef IEEE80211_DEBUG 531 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) || 532 ieee80211_msg_dumppkts(ic)) { 533 if_printf(ic->ic_ifp, "received %s from %s rssi %d\n", 534 ieee80211_mgt_subtype_name[subtype >> 535 IEEE80211_FC0_SUBTYPE_SHIFT], 536 ether_sprintf(wh->i_addr2), rssi); 537 } 538 #endif 539 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 540 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) { 541 /* 542 * Only shared key auth frames with a challenge 543 * should be encrypted, discard all others. 544 */ 545 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 546 wh, ieee80211_mgt_subtype_name[subtype >> 547 IEEE80211_FC0_SUBTYPE_SHIFT], 548 "%s", "WEP set but not permitted"); 549 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */ 550 goto out; 551 } 552 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 553 /* 554 * Discard encrypted frames when privacy is off. 555 */ 556 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 557 wh, "mgt", "%s", "WEP set but PRIVACY off"); 558 ic->ic_stats.is_rx_noprivacy++; 559 goto out; 560 } 561 hdrspace = ieee80211_hdrspace(ic, wh); 562 key = ieee80211_crypto_decap(ic, ni, m, hdrspace); 563 if (key == NULL) { 564 /* NB: stats+msgs handled in crypto_decap */ 565 goto out; 566 } 567 wh = mtod(m, struct ieee80211_frame *); 568 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 569 } 570 bpf_mtap3(ic->ic_rawbpf, m); 571 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp); 572 m_freem(m); 573 return type; 574 575 case IEEE80211_FC0_TYPE_CTL: 576 IEEE80211_NODE_STAT(ni, rx_ctrl); 577 ic->ic_stats.is_rx_ctl++; 578 #ifndef IEEE80211_NO_HOSTAP 579 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 580 switch (subtype) { 581 case IEEE80211_FC0_SUBTYPE_PS_POLL: 582 ieee80211_recv_pspoll(ic, ni, m); 583 break; 584 } 585 } 586 #endif /* !IEEE80211_NO_HOSTAP */ 587 goto out; 588 default: 589 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 590 wh, NULL, "bad frame type 0x%x", type); 591 /* should not come here */ 592 break; 593 } 594 err: 595 ifp->if_ierrors++; 596 out: 597 if (m != NULL) { 598 bpf_mtap3(ic->ic_rawbpf, m); 599 m_freem(m); 600 } 601 return type; 602 #undef SEQ_LEQ 603 } 604 605 /* 606 * This function reassemble fragments. 607 */ 608 static struct mbuf * 609 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni, 610 struct mbuf *m, int hdrspace) 611 { 612 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 613 struct ieee80211_frame *lwh; 614 u_int16_t rxseq; 615 u_int8_t fragno; 616 u_int8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG; 617 struct mbuf *mfrag; 618 619 IASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?")); 620 621 rxseq = le16toh(*(u_int16_t *)wh->i_seq); 622 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK; 623 624 /* Quick way out, if there's nothing to defragment */ 625 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL) 626 return m; 627 628 /* 629 * Remove frag to insure it doesn't get reaped by timer. 630 */ 631 if (ni->ni_table == NULL) { 632 /* 633 * Should never happen. If the node is orphaned (not in 634 * the table) then input packets should not reach here. 635 * Otherwise, a concurrent request that yanks the table 636 * should be blocked by other interlocking and/or by first 637 * shutting the driver down. Regardless, be defensive 638 * here and just bail 639 */ 640 /* XXX need msg+stat */ 641 m_freem(m); 642 return NULL; 643 } 644 IEEE80211_NODE_LOCK(ni->ni_table); 645 mfrag = ni->ni_rxfrag[0]; 646 ni->ni_rxfrag[0] = NULL; 647 IEEE80211_NODE_UNLOCK(ni->ni_table); 648 649 /* 650 * Validate new fragment is in order and 651 * related to the previous ones. 652 */ 653 if (mfrag != NULL) { 654 u_int16_t last_rxseq; 655 656 lwh = mtod(mfrag, struct ieee80211_frame *); 657 last_rxseq = le16toh(*(u_int16_t *)lwh->i_seq); 658 /* NB: check seq # and frag together */ 659 if (rxseq != last_rxseq+1 || 660 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) || 661 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { 662 /* 663 * Unrelated fragment or no space for it, 664 * clear current fragments. 665 */ 666 m_freem(mfrag); 667 mfrag = NULL; 668 } 669 } 670 671 if (mfrag == NULL) { 672 if (fragno != 0) { /* !first fragment, discard */ 673 IEEE80211_NODE_STAT(ni, rx_defrag); 674 m_freem(m); 675 return NULL; 676 } 677 mfrag = m; 678 } else { /* concatenate */ 679 m_adj(m, hdrspace); /* strip header */ 680 m_cat(mfrag, m); 681 /* NB: m_cat doesn't update the packet header */ 682 mfrag->m_pkthdr.len += m->m_pkthdr.len; 683 /* track last seqnum and fragno */ 684 lwh = mtod(mfrag, struct ieee80211_frame *); 685 *(u_int16_t *) lwh->i_seq = *(u_int16_t *) wh->i_seq; 686 } 687 if (more_frag) { /* more to come, save */ 688 ni->ni_rxfragstamp = ticks; 689 ni->ni_rxfrag[0] = mfrag; 690 mfrag = NULL; 691 } 692 return mfrag; 693 } 694 695 static void 696 ieee80211_deliver_data(struct ieee80211com *ic, 697 struct ieee80211_node *ni, struct mbuf *m) 698 { 699 struct ether_header *eh = mtod(m, struct ether_header *); 700 struct ifnet *ifp = ic->ic_ifp; 701 int error; 702 703 /* perform as a bridge within the AP */ 704 if (ic->ic_opmode == IEEE80211_M_HOSTAP && 705 (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) { 706 struct mbuf *m1 = NULL; 707 708 if (ETHER_IS_MULTICAST(eh->ether_dhost)) { 709 m1 = m_copypacket(m, M_DONTWAIT); 710 if (m1 == NULL) 711 ifp->if_oerrors++; 712 else 713 m1->m_flags |= M_MCAST; 714 } else { 715 /* 716 * Check if the destination is known; if so 717 * and the port is authorized dispatch directly. 718 */ 719 struct ieee80211_node *sta = 720 ieee80211_find_node(&ic->ic_sta, eh->ether_dhost); 721 if (sta != NULL) { 722 if (ieee80211_node_is_authorized(sta)) { 723 /* 724 * Beware of sending to ourself; this 725 * needs to happen via the normal 726 * input path. 727 */ 728 if (sta != ic->ic_bss) { 729 m1 = m; 730 m = NULL; 731 } 732 } else { 733 ic->ic_stats.is_rx_unauth++; 734 IEEE80211_NODE_STAT(sta, rx_unauth); 735 } 736 ieee80211_free_node(sta); 737 } 738 } 739 if (m1 != NULL) { 740 int len; 741 #ifdef ALTQ 742 if (ALTQ_IS_ENABLED(&ifp->if_snd)) { 743 altq_etherclassify(&ifp->if_snd, m1); 744 } 745 #endif 746 len = m1->m_pkthdr.len; 747 IFQ_ENQUEUE(&ifp->if_snd, m1, error); 748 if (error) { 749 ifp->if_omcasts++; 750 m = NULL; 751 } 752 ifp->if_obytes += len; 753 } 754 } 755 if (m != NULL) { 756 /* 757 * XXX If we forward packet into transmitter of the AP, 758 * we don't need to duplicate for DLT_EN10MB. 759 */ 760 bpf_mtap(ifp, m); 761 762 if (ni->ni_vlan != 0) { 763 /* attach vlan tag */ 764 /* XXX goto err? */ 765 VLAN_INPUT_TAG(ifp, m, ni->ni_vlan, goto out); 766 } 767 768 /* 769 * XXX once ieee80211_input (or rxintr itself) runs in softint 770 * we have to change here too to use if_input. 771 */ 772 KASSERT(ifp->if_percpuq); 773 if_percpuq_enqueue(ifp->if_percpuq, m); 774 } 775 return; 776 out: 777 if (m != NULL) { 778 bpf_mtap3(ic->ic_rawbpf, m); 779 m_freem(m); 780 } 781 } 782 783 static struct mbuf * 784 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen) 785 { 786 struct ieee80211_qosframe_addr4 wh; /* Max size address frames */ 787 struct ether_header *eh; 788 struct llc *llc; 789 790 if (m->m_len < hdrlen + sizeof(*llc) && 791 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) { 792 /* XXX stat, msg */ 793 return NULL; 794 } 795 memcpy(&wh, mtod(m, void *), hdrlen); 796 llc = (struct llc *)(mtod(m, char *) + hdrlen); 797 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP && 798 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 && 799 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) { 800 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh)); 801 llc = NULL; 802 } else { 803 m_adj(m, hdrlen - sizeof(*eh)); 804 } 805 eh = mtod(m, struct ether_header *); 806 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) { 807 case IEEE80211_FC1_DIR_NODS: 808 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 809 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 810 break; 811 case IEEE80211_FC1_DIR_TODS: 812 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 813 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 814 break; 815 case IEEE80211_FC1_DIR_FROMDS: 816 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 817 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3); 818 break; 819 case IEEE80211_FC1_DIR_DSTODS: 820 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 821 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4); 822 break; 823 } 824 #ifdef ALIGNED_POINTER 825 if (!ALIGNED_POINTER(mtod(m, char *) + sizeof(*eh), u_int32_t)) { 826 struct mbuf *n, *n0, **np; 827 char *newdata; 828 int off, pktlen; 829 830 n0 = NULL; 831 np = &n0; 832 off = 0; 833 pktlen = m->m_pkthdr.len; 834 while (pktlen > off) { 835 if (n0 == NULL) { 836 MGETHDR(n, M_DONTWAIT, MT_DATA); 837 if (n == NULL) { 838 m_freem(m); 839 return NULL; 840 } 841 M_MOVE_PKTHDR(n, m); 842 n->m_len = MHLEN; 843 } else { 844 MGET(n, M_DONTWAIT, MT_DATA); 845 if (n == NULL) { 846 m_freem(m); 847 m_freem(n0); 848 return NULL; 849 } 850 n->m_len = MLEN; 851 } 852 if (pktlen - off >= MINCLSIZE) { 853 MCLGET(n, M_DONTWAIT); 854 if (n->m_flags & M_EXT) 855 n->m_len = n->m_ext.ext_size; 856 } 857 if (n0 == NULL) { 858 newdata = 859 (char *)ALIGN(n->m_data + sizeof(*eh)) - 860 sizeof(*eh); 861 n->m_len -= newdata - n->m_data; 862 n->m_data = newdata; 863 } 864 if (n->m_len > pktlen - off) 865 n->m_len = pktlen - off; 866 m_copydata(m, off, n->m_len, mtod(n, void *)); 867 off += n->m_len; 868 *np = n; 869 np = &n->m_next; 870 } 871 m_freem(m); 872 m = n0; 873 } 874 #endif /* ALIGNED_POINTER */ 875 if (llc != NULL) { 876 eh = mtod(m, struct ether_header *); 877 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh)); 878 } 879 return m; 880 } 881 882 /* 883 * Install received rate set information in the node's state block. 884 */ 885 int 886 ieee80211_setup_rates(struct ieee80211_node *ni, 887 const u_int8_t *rates, const u_int8_t *xrates, int flags) 888 { 889 struct ieee80211com *ic = ni->ni_ic; 890 struct ieee80211_rateset *rs = &ni->ni_rates; 891 892 memset(rs, 0, sizeof(*rs)); 893 rs->rs_nrates = rates[1]; 894 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates); 895 if (xrates != NULL) { 896 u_int8_t nxrates; 897 /* 898 * Tack on 11g extended supported rate element. 899 */ 900 nxrates = xrates[1]; 901 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) { 902 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates; 903 IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE, 904 "[%s] extended rate set too large;" 905 " only using %u of %u rates\n", 906 ether_sprintf(ni->ni_macaddr), nxrates, xrates[1]); 907 ic->ic_stats.is_rx_rstoobig++; 908 } 909 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates); 910 rs->rs_nrates += nxrates; 911 } 912 return ieee80211_fix_rate(ni, flags); 913 } 914 915 static void 916 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh, 917 struct ieee80211_node *ni, int rssi, u_int32_t rstamp, 918 u_int16_t seq, u_int16_t status) 919 { 920 921 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) { 922 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 923 ni->ni_macaddr, "open auth", 924 "bad sta auth mode %u", ni->ni_authmode); 925 ic->ic_stats.is_rx_bad_auth++; /* XXX */ 926 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 927 /* XXX hack to workaround calling convention */ 928 ieee80211_send_error(ic, ni, wh->i_addr2, 929 IEEE80211_FC0_SUBTYPE_AUTH, 930 (seq + 1) | (IEEE80211_STATUS_ALG<<16)); 931 } 932 return; 933 } 934 switch (ic->ic_opmode) { 935 case IEEE80211_M_IBSS: 936 case IEEE80211_M_AHDEMO: 937 case IEEE80211_M_MONITOR: 938 /* should not come here */ 939 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 940 ni->ni_macaddr, "open auth", 941 "bad operating mode %u", ic->ic_opmode); 942 break; 943 944 case IEEE80211_M_HOSTAP: 945 #ifndef IEEE80211_NO_HOSTAP 946 if (ic->ic_state != IEEE80211_S_RUN || 947 seq != IEEE80211_AUTH_OPEN_REQUEST) { 948 ic->ic_stats.is_rx_bad_auth++; 949 return; 950 } 951 /* always accept open authentication requests */ 952 if (ni == ic->ic_bss) { 953 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 954 if (ni == NULL) 955 return; 956 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 957 (void) ieee80211_ref_node(ni); 958 /* 959 * Mark the node as referenced to reflect that its 960 * reference count has been bumped to insure it remains 961 * after the transaction completes. 962 */ 963 ni->ni_flags |= IEEE80211_NODE_AREF; 964 965 IEEE80211_SEND_MGMT(ic, ni, 966 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 967 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 968 "[%s] station authenticated (open)\n", 969 ether_sprintf(ni->ni_macaddr)); 970 /* 971 * When 802.1x is not in use mark the port 972 * authorized at this point so traffic can flow. 973 */ 974 if (ni->ni_authmode != IEEE80211_AUTH_8021X) 975 ieee80211_node_authorize(ni); 976 #endif /* !IEEE80211_NO_HOSTAP */ 977 break; 978 979 case IEEE80211_M_STA: 980 if (ic->ic_state != IEEE80211_S_AUTH || 981 seq != IEEE80211_AUTH_OPEN_RESPONSE) { 982 ic->ic_stats.is_rx_bad_auth++; 983 return; 984 } 985 if (status != 0) { 986 IEEE80211_DPRINTF(ic, 987 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 988 "[%s] open auth failed (reason %d)\n", 989 ether_sprintf(ni->ni_macaddr), status); 990 /* XXX can this happen? */ 991 if (ni != ic->ic_bss) 992 ni->ni_fails++; 993 ic->ic_stats.is_rx_auth_fail++; 994 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 995 } else 996 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 997 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 998 break; 999 } 1000 } 1001 1002 /* 1003 * Send a management frame error response to the specified 1004 * station. If ni is associated with the station then use 1005 * it; otherwise allocate a temporary node suitable for 1006 * transmitting the frame and then free the reference so 1007 * it will go away as soon as the frame has been transmitted. 1008 */ 1009 static void 1010 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni, 1011 const u_int8_t *mac, int subtype, int arg) 1012 { 1013 int istmp; 1014 1015 if (ni == ic->ic_bss) { 1016 ni = ieee80211_tmp_node(ic, mac); 1017 if (ni == NULL) { 1018 /* XXX msg */ 1019 return; 1020 } 1021 istmp = 1; 1022 } else 1023 istmp = 0; 1024 IEEE80211_SEND_MGMT(ic, ni, subtype, arg); 1025 if (istmp) 1026 ieee80211_free_node(ni); 1027 } 1028 1029 static int 1030 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni) 1031 { 1032 if (ni->ni_challenge == NULL) 1033 ni->ni_challenge = malloc(IEEE80211_CHALLENGE_LEN, 1034 M_DEVBUF, M_NOWAIT); 1035 if (ni->ni_challenge == NULL) { 1036 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1037 "[%s] shared key challenge alloc failed\n", 1038 ether_sprintf(ni->ni_macaddr)); 1039 /* XXX statistic */ 1040 } 1041 return (ni->ni_challenge != NULL); 1042 } 1043 1044 /* XXX TODO: add statistics */ 1045 static void 1046 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh, 1047 u_int8_t *frm, u_int8_t *efrm, struct ieee80211_node *ni, int rssi, 1048 u_int32_t rstamp, u_int16_t seq, u_int16_t status) 1049 { 1050 u_int8_t *challenge; 1051 int estatus; 1052 1053 /* 1054 * NB: this can happen as we allow pre-shared key 1055 * authentication to be enabled w/o wep being turned 1056 * on so that configuration of these can be done 1057 * in any order. It may be better to enforce the 1058 * ordering in which case this check would just be 1059 * for sanity/consistency. 1060 */ 1061 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 1062 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1063 ni->ni_macaddr, "shared key auth", 1064 "%s", " PRIVACY is disabled"); 1065 estatus = IEEE80211_STATUS_ALG; 1066 goto bad; 1067 } 1068 /* 1069 * Pre-shared key authentication is evil; accept 1070 * it only if explicitly configured (it is supported 1071 * mainly for compatibility with clients like OS X). 1072 */ 1073 if (ni->ni_authmode != IEEE80211_AUTH_AUTO && 1074 ni->ni_authmode != IEEE80211_AUTH_SHARED) { 1075 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1076 ni->ni_macaddr, "shared key auth", 1077 "bad sta auth mode %u", ni->ni_authmode); 1078 ic->ic_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */ 1079 estatus = IEEE80211_STATUS_ALG; 1080 goto bad; 1081 } 1082 1083 challenge = NULL; 1084 if (frm + 1 < efrm) { 1085 if ((frm[1] + 2) > (efrm - frm)) { 1086 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1087 ni->ni_macaddr, "shared key auth", 1088 "ie %d/%d too long", 1089 frm[0], (frm[1] + 2) - (efrm - frm)); 1090 ic->ic_stats.is_rx_bad_auth++; 1091 estatus = IEEE80211_STATUS_CHALLENGE; 1092 goto bad; 1093 } 1094 if (*frm == IEEE80211_ELEMID_CHALLENGE) 1095 challenge = frm; 1096 frm += frm[1] + 2; 1097 } 1098 switch (seq) { 1099 case IEEE80211_AUTH_SHARED_CHALLENGE: 1100 case IEEE80211_AUTH_SHARED_RESPONSE: 1101 if (challenge == NULL) { 1102 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1103 ni->ni_macaddr, "shared key auth", 1104 "%s", "no challenge"); 1105 ic->ic_stats.is_rx_bad_auth++; 1106 estatus = IEEE80211_STATUS_CHALLENGE; 1107 goto bad; 1108 } 1109 if (challenge[1] != IEEE80211_CHALLENGE_LEN) { 1110 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1111 ni->ni_macaddr, "shared key auth", 1112 "bad challenge len %d", challenge[1]); 1113 ic->ic_stats.is_rx_bad_auth++; 1114 estatus = IEEE80211_STATUS_CHALLENGE; 1115 goto bad; 1116 } 1117 default: 1118 break; 1119 } 1120 switch (ic->ic_opmode) { 1121 case IEEE80211_M_MONITOR: 1122 case IEEE80211_M_AHDEMO: 1123 case IEEE80211_M_IBSS: 1124 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1125 ni->ni_macaddr, "shared key auth", 1126 "bad operating mode %u", ic->ic_opmode); 1127 return; 1128 case IEEE80211_M_HOSTAP: 1129 #ifndef IEEE80211_NO_HOSTAP 1130 { 1131 int allocbs; 1132 if (ic->ic_state != IEEE80211_S_RUN) { 1133 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1134 ni->ni_macaddr, "shared key auth", 1135 "bad state %u", ic->ic_state); 1136 estatus = IEEE80211_STATUS_ALG; /* XXX */ 1137 goto bad; 1138 } 1139 switch (seq) { 1140 case IEEE80211_AUTH_SHARED_REQUEST: 1141 if (ni == ic->ic_bss) { 1142 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2); 1143 if (ni == NULL) { 1144 /* NB: no way to return an error */ 1145 return; 1146 } 1147 allocbs = 1; 1148 } else { 1149 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 1150 (void) ieee80211_ref_node(ni); 1151 allocbs = 0; 1152 } 1153 /* 1154 * Mark the node as referenced to reflect that its 1155 * reference count has been bumped to insure it remains 1156 * after the transaction completes. 1157 */ 1158 ni->ni_flags |= IEEE80211_NODE_AREF; 1159 ni->ni_rssi = rssi; 1160 ni->ni_rstamp = rstamp; 1161 if (!alloc_challenge(ic, ni)) { 1162 /* NB: don't return error so they rexmit */ 1163 return; 1164 } 1165 get_random_bytes(ni->ni_challenge, 1166 IEEE80211_CHALLENGE_LEN); 1167 IEEE80211_DPRINTF(ic, 1168 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1169 "[%s] shared key %sauth request\n", 1170 ether_sprintf(ni->ni_macaddr), 1171 allocbs ? "" : "re"); 1172 break; 1173 case IEEE80211_AUTH_SHARED_RESPONSE: 1174 if (ni == ic->ic_bss) { 1175 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1176 ni->ni_macaddr, "shared key response", 1177 "%s", "unknown station"); 1178 /* NB: don't send a response */ 1179 return; 1180 } 1181 if (ni->ni_challenge == NULL) { 1182 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1183 ni->ni_macaddr, "shared key response", 1184 "%s", "no challenge recorded"); 1185 ic->ic_stats.is_rx_bad_auth++; 1186 estatus = IEEE80211_STATUS_CHALLENGE; 1187 goto bad; 1188 } 1189 if (memcmp(ni->ni_challenge, &challenge[2], 1190 challenge[1]) != 0) { 1191 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1192 ni->ni_macaddr, "shared key response", 1193 "%s", "challenge mismatch"); 1194 ic->ic_stats.is_rx_auth_fail++; 1195 estatus = IEEE80211_STATUS_CHALLENGE; 1196 goto bad; 1197 } 1198 IEEE80211_DPRINTF(ic, 1199 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1200 "[%s] station authenticated (shared key)\n", 1201 ether_sprintf(ni->ni_macaddr)); 1202 ieee80211_node_authorize(ni); 1203 break; 1204 default: 1205 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH, 1206 ni->ni_macaddr, "shared key auth", 1207 "bad seq %d", seq); 1208 ic->ic_stats.is_rx_bad_auth++; 1209 estatus = IEEE80211_STATUS_SEQUENCE; 1210 goto bad; 1211 } 1212 IEEE80211_SEND_MGMT(ic, ni, 1213 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1214 } 1215 #endif /* !IEEE80211_NO_HOSTAP */ 1216 break; 1217 1218 case IEEE80211_M_STA: 1219 if (ic->ic_state != IEEE80211_S_AUTH) 1220 return; 1221 switch (seq) { 1222 case IEEE80211_AUTH_SHARED_PASS: 1223 if (ni->ni_challenge != NULL) { 1224 free(ni->ni_challenge, M_DEVBUF); 1225 ni->ni_challenge = NULL; 1226 } 1227 if (status != 0) { 1228 IEEE80211_DPRINTF(ic, 1229 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1230 "[%s] shared key auth failed (reason %d)\n", 1231 ether_sprintf(ieee80211_getbssid(ic, wh)), 1232 status); 1233 /* XXX can this happen? */ 1234 if (ni != ic->ic_bss) 1235 ni->ni_fails++; 1236 ic->ic_stats.is_rx_auth_fail++; 1237 return; 1238 } 1239 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 1240 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 1241 break; 1242 case IEEE80211_AUTH_SHARED_CHALLENGE: 1243 if (!alloc_challenge(ic, ni)) 1244 return; 1245 /* XXX could optimize by passing recvd challenge */ 1246 memcpy(ni->ni_challenge, &challenge[2], challenge[1]); 1247 IEEE80211_SEND_MGMT(ic, ni, 1248 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1249 break; 1250 default: 1251 IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH, 1252 wh, "shared key auth", "bad seq %d", seq); 1253 ic->ic_stats.is_rx_bad_auth++; 1254 return; 1255 } 1256 break; 1257 } 1258 return; 1259 bad: 1260 #ifndef IEEE80211_NO_HOSTAP 1261 /* 1262 * Send an error response; but only when operating as an AP. 1263 */ 1264 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 1265 /* XXX hack to workaround calling convention */ 1266 ieee80211_send_error(ic, ni, wh->i_addr2, 1267 IEEE80211_FC0_SUBTYPE_AUTH, 1268 (seq + 1) | (estatus<<16)); 1269 } else if (ic->ic_opmode == IEEE80211_M_STA) { 1270 /* 1271 * Kick the state machine. This short-circuits 1272 * using the mgt frame timeout to trigger the 1273 * state transition. 1274 */ 1275 if (ic->ic_state == IEEE80211_S_AUTH) 1276 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 1277 } 1278 #else 1279 ; 1280 #endif /* !IEEE80211_NO_HOSTAP */ 1281 } 1282 1283 /* Verify the existence and length of __elem or get out. */ 1284 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \ 1285 if ((__elem) == NULL) { \ 1286 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1287 wh, ieee80211_mgt_subtype_name[subtype >> \ 1288 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1289 "%s", "no " #__elem ); \ 1290 ic->ic_stats.is_rx_elem_missing++; \ 1291 return; \ 1292 } \ 1293 if ((__elem)[1] > (__maxlen)) { \ 1294 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1295 wh, ieee80211_mgt_subtype_name[subtype >> \ 1296 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1297 "bad " #__elem " len %d", (__elem)[1]); \ 1298 ic->ic_stats.is_rx_elem_toobig++; \ 1299 return; \ 1300 } \ 1301 } while (0) 1302 1303 #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \ 1304 if ((_len) < (_minlen)) { \ 1305 IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID, \ 1306 wh, ieee80211_mgt_subtype_name[subtype >> \ 1307 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1308 "%s", "ie too short"); \ 1309 ic->ic_stats.is_rx_elem_toosmall++; \ 1310 return; \ 1311 } \ 1312 } while (0) 1313 1314 #ifdef IEEE80211_DEBUG 1315 static void 1316 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag, 1317 u_int8_t mac[IEEE80211_ADDR_LEN], u_int8_t *ssid) 1318 { 1319 printf("[%s] discard %s frame, ssid mismatch: ", 1320 ether_sprintf(mac), tag); 1321 ieee80211_print_essid(ssid + 2, ssid[1]); 1322 printf("\n"); 1323 } 1324 1325 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1326 if ((_ssid)[1] != 0 && \ 1327 ((_ssid)[1] != (_ni)->ni_esslen || \ 1328 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1329 if (ieee80211_msg_input(ic)) \ 1330 ieee80211_ssid_mismatch(ic, \ 1331 ieee80211_mgt_subtype_name[subtype >> \ 1332 IEEE80211_FC0_SUBTYPE_SHIFT], \ 1333 wh->i_addr2, _ssid); \ 1334 ic->ic_stats.is_rx_ssidmismatch++; \ 1335 return; \ 1336 } \ 1337 } while (0) 1338 #else /* !IEEE80211_DEBUG */ 1339 #define IEEE80211_VERIFY_SSID(_ni, _ssid) do { \ 1340 if ((_ssid)[1] != 0 && \ 1341 ((_ssid)[1] != (_ni)->ni_esslen || \ 1342 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 1343 ic->ic_stats.is_rx_ssidmismatch++; \ 1344 return; \ 1345 } \ 1346 } while (0) 1347 #endif /* !IEEE80211_DEBUG */ 1348 1349 /* unaligned little endian access */ 1350 #define LE_READ_2(p) \ 1351 ((u_int16_t) \ 1352 ((((const u_int8_t *)(p))[0] ) | \ 1353 (((const u_int8_t *)(p))[1] << 8))) 1354 #define LE_READ_4(p) \ 1355 ((u_int32_t) \ 1356 ((((const u_int8_t *)(p))[0] ) | \ 1357 (((const u_int8_t *)(p))[1] << 8) | \ 1358 (((const u_int8_t *)(p))[2] << 16) | \ 1359 (((const u_int8_t *)(p))[3] << 24))) 1360 1361 static __inline int 1362 iswpaoui(const u_int8_t *frm) 1363 { 1364 return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI); 1365 } 1366 1367 static __inline int 1368 iswmeoui(const u_int8_t *frm) 1369 { 1370 return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI); 1371 } 1372 1373 static __inline int 1374 iswmeparam(const u_int8_t *frm) 1375 { 1376 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1377 frm[6] == WME_PARAM_OUI_SUBTYPE; 1378 } 1379 1380 static __inline int 1381 iswmeinfo(const u_int8_t *frm) 1382 { 1383 return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 1384 frm[6] == WME_INFO_OUI_SUBTYPE; 1385 } 1386 1387 /* 1388 * Convert a WPA cipher selector OUI to an internal 1389 * cipher algorithm. Where appropriate we also 1390 * record any key length. 1391 */ 1392 static int 1393 wpa_cipher(u_int8_t *sel, u_int8_t *keylen) 1394 { 1395 #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1396 u_int32_t w = LE_READ_4(sel); 1397 1398 switch (w) { 1399 case WPA_SEL(WPA_CSE_NULL): 1400 return IEEE80211_CIPHER_NONE; 1401 case WPA_SEL(WPA_CSE_WEP40): 1402 if (keylen) 1403 *keylen = 40 / NBBY; 1404 return IEEE80211_CIPHER_WEP; 1405 case WPA_SEL(WPA_CSE_WEP104): 1406 if (keylen) 1407 *keylen = 104 / NBBY; 1408 return IEEE80211_CIPHER_WEP; 1409 case WPA_SEL(WPA_CSE_TKIP): 1410 return IEEE80211_CIPHER_TKIP; 1411 case WPA_SEL(WPA_CSE_CCMP): 1412 return IEEE80211_CIPHER_AES_CCM; 1413 } 1414 return 32; /* NB: so 1<< is discarded */ 1415 #undef WPA_SEL 1416 } 1417 1418 /* 1419 * Convert a WPA key management/authentication algorithm 1420 * to an internal code. 1421 */ 1422 static int 1423 wpa_keymgmt(u_int8_t *sel) 1424 { 1425 #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 1426 u_int32_t w = LE_READ_4(sel); 1427 1428 switch (w) { 1429 case WPA_SEL(WPA_ASE_8021X_UNSPEC): 1430 return WPA_ASE_8021X_UNSPEC; 1431 case WPA_SEL(WPA_ASE_8021X_PSK): 1432 return WPA_ASE_8021X_PSK; 1433 case WPA_SEL(WPA_ASE_NONE): 1434 return WPA_ASE_NONE; 1435 } 1436 return 0; /* NB: so is discarded */ 1437 #undef WPA_SEL 1438 } 1439 1440 /* 1441 * Parse a WPA information element to collect parameters 1442 * and validate the parameters against what has been 1443 * configured for the system. 1444 */ 1445 static int 1446 ieee80211_parse_wpa(struct ieee80211com *ic, u_int8_t *frm, 1447 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1448 { 1449 u_int8_t len = frm[1]; 1450 u_int32_t w; 1451 int n; 1452 1453 /* 1454 * Check the length once for fixed parts: OUI, type, 1455 * version, mcast cipher, and 2 selector counts. 1456 * Other, variable-length data, must be checked separately. 1457 */ 1458 if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) { 1459 IEEE80211_DISCARD_IE(ic, 1460 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1461 wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags); 1462 return IEEE80211_REASON_IE_INVALID; 1463 } 1464 if (len < 14) { 1465 IEEE80211_DISCARD_IE(ic, 1466 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1467 wh, "WPA", "too short, len %u", len); 1468 return IEEE80211_REASON_IE_INVALID; 1469 } 1470 frm += 6, len -= 4; /* NB: len is payload only */ 1471 /* NB: iswapoui already validated the OUI and type */ 1472 w = LE_READ_2(frm); 1473 if (w != WPA_VERSION) { 1474 IEEE80211_DISCARD_IE(ic, 1475 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1476 wh, "WPA", "bad version %u", w); 1477 return IEEE80211_REASON_IE_INVALID; 1478 } 1479 frm += 2, len -= 2; 1480 1481 /* multicast/group cipher */ 1482 w = wpa_cipher(frm, &rsn->rsn_mcastkeylen); 1483 if (w != rsn->rsn_mcastcipher) { 1484 IEEE80211_DISCARD_IE(ic, 1485 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1486 wh, "WPA", "mcast cipher mismatch; got %u, expected %u", 1487 w, rsn->rsn_mcastcipher); 1488 return IEEE80211_REASON_IE_INVALID; 1489 } 1490 frm += 4, len -= 4; 1491 1492 /* unicast ciphers */ 1493 n = LE_READ_2(frm); 1494 frm += 2, len -= 2; 1495 if (len < n*4+2) { 1496 IEEE80211_DISCARD_IE(ic, 1497 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1498 wh, "WPA", "ucast cipher data too short; len %u, n %u", 1499 len, n); 1500 return IEEE80211_REASON_IE_INVALID; 1501 } 1502 w = 0; 1503 for (; n > 0; n--) { 1504 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen); 1505 frm += 4, len -= 4; 1506 } 1507 w &= rsn->rsn_ucastcipherset; 1508 if (w == 0) { 1509 IEEE80211_DISCARD_IE(ic, 1510 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1511 wh, "WPA", "%s", "ucast cipher set empty"); 1512 return IEEE80211_REASON_IE_INVALID; 1513 } 1514 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1515 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1516 else 1517 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1518 1519 /* key management algorithms */ 1520 n = LE_READ_2(frm); 1521 frm += 2, len -= 2; 1522 if (len < n*4) { 1523 IEEE80211_DISCARD_IE(ic, 1524 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1525 wh, "WPA", "key mgmt alg data too short; len %u, n %u", 1526 len, n); 1527 return IEEE80211_REASON_IE_INVALID; 1528 } 1529 w = 0; 1530 for (; n > 0; n--) { 1531 w |= wpa_keymgmt(frm); 1532 frm += 4, len -= 4; 1533 } 1534 w &= rsn->rsn_keymgmtset; 1535 if (w == 0) { 1536 IEEE80211_DISCARD_IE(ic, 1537 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1538 wh, "WPA", "%s", "no acceptable key mgmt alg"); 1539 return IEEE80211_REASON_IE_INVALID; 1540 } 1541 if (w & WPA_ASE_8021X_UNSPEC) 1542 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC; 1543 else 1544 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK; 1545 1546 if (len > 2) /* optional capabilities */ 1547 rsn->rsn_caps = LE_READ_2(frm); 1548 1549 return 0; 1550 } 1551 1552 /* 1553 * Convert an RSN cipher selector OUI to an internal 1554 * cipher algorithm. Where appropriate we also 1555 * record any key length. 1556 */ 1557 static int 1558 rsn_cipher(u_int8_t *sel, u_int8_t *keylen) 1559 { 1560 #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1561 u_int32_t w = LE_READ_4(sel); 1562 1563 switch (w) { 1564 case RSN_SEL(RSN_CSE_NULL): 1565 return IEEE80211_CIPHER_NONE; 1566 case RSN_SEL(RSN_CSE_WEP40): 1567 if (keylen) 1568 *keylen = 40 / NBBY; 1569 return IEEE80211_CIPHER_WEP; 1570 case RSN_SEL(RSN_CSE_WEP104): 1571 if (keylen) 1572 *keylen = 104 / NBBY; 1573 return IEEE80211_CIPHER_WEP; 1574 case RSN_SEL(RSN_CSE_TKIP): 1575 return IEEE80211_CIPHER_TKIP; 1576 case RSN_SEL(RSN_CSE_CCMP): 1577 return IEEE80211_CIPHER_AES_CCM; 1578 case RSN_SEL(RSN_CSE_WRAP): 1579 return IEEE80211_CIPHER_AES_OCB; 1580 } 1581 return 32; /* NB: so 1<< is discarded */ 1582 #undef WPA_SEL 1583 } 1584 1585 /* 1586 * Convert an RSN key management/authentication algorithm 1587 * to an internal code. 1588 */ 1589 static int 1590 rsn_keymgmt(u_int8_t *sel) 1591 { 1592 #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 1593 u_int32_t w = LE_READ_4(sel); 1594 1595 switch (w) { 1596 case RSN_SEL(RSN_ASE_8021X_UNSPEC): 1597 return RSN_ASE_8021X_UNSPEC; 1598 case RSN_SEL(RSN_ASE_8021X_PSK): 1599 return RSN_ASE_8021X_PSK; 1600 case RSN_SEL(RSN_ASE_NONE): 1601 return RSN_ASE_NONE; 1602 } 1603 return 0; /* NB: so is discarded */ 1604 #undef RSN_SEL 1605 } 1606 1607 /* 1608 * Parse a WPA/RSN information element to collect parameters 1609 * and validate the parameters against what has been 1610 * configured for the system. 1611 */ 1612 static int 1613 ieee80211_parse_rsn(struct ieee80211com *ic, u_int8_t *frm, 1614 struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1615 { 1616 u_int8_t len = frm[1]; 1617 u_int32_t w; 1618 int n; 1619 1620 /* 1621 * Check the length once for fixed parts: 1622 * version, mcast cipher, and 2 selector counts. 1623 * Other, variable-length data, must be checked separately. 1624 */ 1625 if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) { 1626 IEEE80211_DISCARD_IE(ic, 1627 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1628 wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags); 1629 return IEEE80211_REASON_IE_INVALID; 1630 } 1631 if (len < 10) { 1632 IEEE80211_DISCARD_IE(ic, 1633 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1634 wh, "RSN", "too short, len %u", len); 1635 return IEEE80211_REASON_IE_INVALID; 1636 } 1637 frm += 2; 1638 w = LE_READ_2(frm); 1639 if (w != RSN_VERSION) { 1640 IEEE80211_DISCARD_IE(ic, 1641 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1642 wh, "RSN", "bad version %u", w); 1643 return IEEE80211_REASON_IE_INVALID; 1644 } 1645 frm += 2, len -= 2; 1646 1647 /* multicast/group cipher */ 1648 w = rsn_cipher(frm, &rsn->rsn_mcastkeylen); 1649 if (w != rsn->rsn_mcastcipher) { 1650 IEEE80211_DISCARD_IE(ic, 1651 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1652 wh, "RSN", "mcast cipher mismatch; got %u, expected %u", 1653 w, rsn->rsn_mcastcipher); 1654 return IEEE80211_REASON_IE_INVALID; 1655 } 1656 frm += 4, len -= 4; 1657 1658 /* unicast ciphers */ 1659 n = LE_READ_2(frm); 1660 frm += 2, len -= 2; 1661 if (len < n*4+2) { 1662 IEEE80211_DISCARD_IE(ic, 1663 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1664 wh, "RSN", "ucast cipher data too short; len %u, n %u", 1665 len, n); 1666 return IEEE80211_REASON_IE_INVALID; 1667 } 1668 w = 0; 1669 for (; n > 0; n--) { 1670 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen); 1671 frm += 4, len -= 4; 1672 } 1673 w &= rsn->rsn_ucastcipherset; 1674 if (w == 0) { 1675 IEEE80211_DISCARD_IE(ic, 1676 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1677 wh, "RSN", "%s", "ucast cipher set empty"); 1678 return IEEE80211_REASON_IE_INVALID; 1679 } 1680 if (w & (1<<IEEE80211_CIPHER_TKIP)) 1681 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1682 else 1683 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1684 1685 /* key management algorithms */ 1686 n = LE_READ_2(frm); 1687 frm += 2, len -= 2; 1688 if (len < n*4) { 1689 IEEE80211_DISCARD_IE(ic, 1690 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1691 wh, "RSN", "key mgmt alg data too short; len %u, n %u", 1692 len, n); 1693 return IEEE80211_REASON_IE_INVALID; 1694 } 1695 w = 0; 1696 for (; n > 0; n--) { 1697 w |= rsn_keymgmt(frm); 1698 frm += 4, len -= 4; 1699 } 1700 w &= rsn->rsn_keymgmtset; 1701 if (w == 0) { 1702 IEEE80211_DISCARD_IE(ic, 1703 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1704 wh, "RSN", "%s", "no acceptable key mgmt alg"); 1705 return IEEE80211_REASON_IE_INVALID; 1706 } 1707 if (w & RSN_ASE_8021X_UNSPEC) 1708 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC; 1709 else 1710 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK; 1711 1712 /* optional RSN capabilities */ 1713 if (len > 2) 1714 rsn->rsn_caps = LE_READ_2(frm); 1715 /* XXXPMKID */ 1716 1717 return 0; 1718 } 1719 1720 static int 1721 ieee80211_parse_wmeparams(struct ieee80211com *ic, u_int8_t *frm, 1722 const struct ieee80211_frame *wh) 1723 { 1724 #define MS(_v, _f) (((_v) & _f) >> _f##_S) 1725 struct ieee80211_wme_state *wme = &ic->ic_wme; 1726 u_int len = frm[1], qosinfo; 1727 int i; 1728 1729 if (len < sizeof(struct ieee80211_wme_param)-2) { 1730 IEEE80211_DISCARD_IE(ic, 1731 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME, 1732 wh, "WME", "too short, len %u", len); 1733 return -1; 1734 } 1735 qosinfo = frm[offsetof(struct ieee80211_wme_param, param_qosInfo)]; 1736 qosinfo &= WME_QOSINFO_COUNT; 1737 /* XXX do proper check for wraparound */ 1738 if (qosinfo == wme->wme_wmeChanParams.cap_info) 1739 return 0; 1740 frm += offsetof(struct ieee80211_wme_param, params_acParams); 1741 for (i = 0; i < WME_NUM_AC; i++) { 1742 struct wmeParams *wmep = 1743 &wme->wme_wmeChanParams.cap_wmeParams[i]; 1744 /* NB: ACI not used */ 1745 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM); 1746 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN); 1747 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN); 1748 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX); 1749 wmep->wmep_txopLimit = LE_READ_2(frm+2); 1750 frm += 4; 1751 } 1752 wme->wme_wmeChanParams.cap_info = qosinfo; 1753 return 1; 1754 #undef MS 1755 } 1756 1757 void 1758 ieee80211_saveie(u_int8_t **iep, const u_int8_t *ie) 1759 { 1760 u_int ielen = ie[1]+2; 1761 /* 1762 * Record information element for later use. 1763 */ 1764 if (*iep == NULL || (*iep)[1] != ie[1]) { 1765 if (*iep != NULL) 1766 free(*iep, M_DEVBUF); 1767 *iep = malloc(ielen, M_DEVBUF, M_NOWAIT); 1768 } 1769 if (*iep != NULL) 1770 memcpy(*iep, ie, ielen); 1771 /* XXX note failure */ 1772 } 1773 1774 static void 1775 ieee80211_update_adhoc_node(struct ieee80211com *ic, struct ieee80211_node *ni, 1776 struct ieee80211_frame *wh, struct ieee80211_scanparams *scan, int rssi, 1777 u_int32_t rstamp) 1778 { 1779 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) { 1780 /* 1781 * Create a new entry in the neighbor table. 1782 * Records the TSF. 1783 */ 1784 if ((ni = ieee80211_add_neighbor(ic, wh, scan)) == NULL) 1785 return; 1786 } else if (ni->ni_capinfo == 0) { 1787 /* 1788 * Initialize a node that was "faked up." Records 1789 * the TSF. 1790 * 1791 * No need to check for a change of BSSID: ni could 1792 * not have been the IBSS (ic_bss) 1793 */ 1794 ieee80211_init_neighbor(ic, ni, wh, scan, 0); 1795 } else { 1796 /* Record TSF for potential resync. */ 1797 memcpy(ni->ni_tstamp.data, scan->tstamp, sizeof(ni->ni_tstamp)); 1798 } 1799 1800 ni->ni_rssi = rssi; 1801 ni->ni_rstamp = rstamp; 1802 1803 /* Mark a neighbor's change of BSSID. */ 1804 if (IEEE80211_ADDR_EQ(wh->i_addr3, ni->ni_bssid)) 1805 return; 1806 1807 IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3); 1808 1809 if (ni != ic->ic_bss) 1810 return; 1811 else if (ic->ic_flags & IEEE80211_F_DESBSSID) { 1812 /* 1813 * Now, ni does not represent a network we 1814 * want to belong to, so start a scan. 1815 */ 1816 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 1817 return; 1818 } else { 1819 /* 1820 * A RUN->RUN transition lets the driver 1821 * reprogram its BSSID filter. 1822 * 1823 * No need to SCAN, we already belong to 1824 * an IBSS that meets our criteria: channel, 1825 * SSID, etc. It could be harmful to scan, 1826 * too: if a scan does not detect nodes 1827 * belonging to my current IBSS, then we 1828 * will create a new IBSS at the end of 1829 * the scan, needlessly splitting the 1830 * network. 1831 */ 1832 ieee80211_new_state(ic, IEEE80211_S_RUN, 0); 1833 } 1834 } 1835 1836 void 1837 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0, 1838 struct ieee80211_node *ni, 1839 int subtype, int rssi, u_int32_t rstamp) 1840 { 1841 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP) 1842 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP) 1843 struct ieee80211_frame *wh; 1844 u_int8_t *frm, *efrm; 1845 u_int8_t *ssid, *rates, *xrates, *wpa, *wme; 1846 int reassoc, resp, allocbs; 1847 u_int8_t rate; 1848 1849 wh = mtod(m0, struct ieee80211_frame *); 1850 frm = (u_int8_t *)&wh[1]; 1851 efrm = mtod(m0, u_int8_t *) + m0->m_len; 1852 switch (subtype) { 1853 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 1854 case IEEE80211_FC0_SUBTYPE_BEACON: { 1855 struct ieee80211_scanparams scan; 1856 1857 /* 1858 * We process beacon/probe response frames: 1859 * o when scanning, or 1860 * o station mode when associated (to collect state 1861 * updates such as 802.11g slot time), or 1862 * o adhoc mode (to discover neighbors) 1863 * Frames otherwise received are discarded. 1864 */ 1865 if (!((ic->ic_flags & IEEE80211_F_SCAN) || 1866 (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) || 1867 ic->ic_opmode == IEEE80211_M_IBSS)) { 1868 ic->ic_stats.is_rx_mgtdiscard++; 1869 return; 1870 } 1871 /* 1872 * beacon/probe response frame format 1873 * [8] time stamp 1874 * [2] beacon interval 1875 * [2] capability information 1876 * [tlv] ssid 1877 * [tlv] supported rates 1878 * [tlv] country information 1879 * [tlv] parameter set (FH/DS) 1880 * [tlv] erp information 1881 * [tlv] extended supported rates 1882 * [tlv] WME 1883 * [tlv] WPA or RSN 1884 */ 1885 IEEE80211_VERIFY_LENGTH(efrm - frm, 12); 1886 memset(&scan, 0, sizeof(scan)); 1887 scan.tstamp = frm; frm += 8; 1888 scan.bintval = le16toh(*(u_int16_t *)frm); frm += 2; 1889 scan.capinfo = le16toh(*(u_int16_t *)frm); frm += 2; 1890 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan); 1891 scan.chan = scan.bchan; 1892 1893 while (frm < efrm) { 1894 switch (*frm) { 1895 case IEEE80211_ELEMID_SSID: 1896 scan.ssid = frm; 1897 break; 1898 case IEEE80211_ELEMID_RATES: 1899 scan.rates = frm; 1900 break; 1901 case IEEE80211_ELEMID_COUNTRY: 1902 scan.country = frm; 1903 break; 1904 case IEEE80211_ELEMID_FHPARMS: 1905 if (ic->ic_phytype == IEEE80211_T_FH) { 1906 scan.fhdwell = LE_READ_2(&frm[2]); 1907 scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]); 1908 scan.fhindex = frm[6]; 1909 } 1910 break; 1911 case IEEE80211_ELEMID_DSPARMS: 1912 /* 1913 * XXX hack this since depending on phytype 1914 * is problematic for multi-mode devices. 1915 */ 1916 if (ic->ic_phytype != IEEE80211_T_FH) 1917 scan.chan = frm[2]; 1918 break; 1919 case IEEE80211_ELEMID_TIM: 1920 /* XXX ATIM? */ 1921 scan.tim = frm; 1922 scan.timoff = frm - mtod(m0, u_int8_t *); 1923 break; 1924 case IEEE80211_ELEMID_IBSSPARMS: 1925 break; 1926 case IEEE80211_ELEMID_XRATES: 1927 scan.xrates = frm; 1928 break; 1929 case IEEE80211_ELEMID_ERP: 1930 if (frm[1] != 1) { 1931 IEEE80211_DISCARD_IE(ic, 1932 IEEE80211_MSG_ELEMID, wh, "ERP", 1933 "bad len %u", frm[1]); 1934 ic->ic_stats.is_rx_elem_toobig++; 1935 break; 1936 } 1937 scan.erp = frm[2]; 1938 break; 1939 case IEEE80211_ELEMID_RSN: 1940 scan.wpa = frm; 1941 break; 1942 case IEEE80211_ELEMID_VENDOR: 1943 if (iswpaoui(frm)) 1944 scan.wpa = frm; 1945 else if (iswmeparam(frm) || iswmeinfo(frm)) 1946 scan.wme = frm; 1947 /* XXX Atheros OUI support */ 1948 break; 1949 default: 1950 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID, 1951 wh, "unhandled", 1952 "id %u, len %u", *frm, frm[1]); 1953 ic->ic_stats.is_rx_elem_unknown++; 1954 break; 1955 } 1956 frm += frm[1] + 2; 1957 } 1958 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE); 1959 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN); 1960 if ( 1961 #if IEEE80211_CHAN_MAX < 255 1962 scan.chan > IEEE80211_CHAN_MAX || 1963 #endif 1964 isclr(ic->ic_chan_active, scan.chan)) { 1965 IEEE80211_DISCARD(ic, 1966 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1967 wh, ieee80211_mgt_subtype_name[subtype >> 1968 IEEE80211_FC0_SUBTYPE_SHIFT], 1969 "invalid channel %u", scan.chan); 1970 ic->ic_stats.is_rx_badchan++; 1971 return; 1972 } 1973 if (scan.chan != scan.bchan && 1974 ic->ic_phytype != IEEE80211_T_FH) { 1975 /* 1976 * Frame was received on a channel different from the 1977 * one indicated in the DS params element id; 1978 * silently discard it. 1979 * 1980 * NB: this can happen due to signal leakage. 1981 * But we should take it for FH phy because 1982 * the rssi value should be correct even for 1983 * different hop pattern in FH. 1984 */ 1985 IEEE80211_DISCARD(ic, 1986 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1987 wh, ieee80211_mgt_subtype_name[subtype >> 1988 IEEE80211_FC0_SUBTYPE_SHIFT], 1989 "for off-channel %u", scan.chan); 1990 ic->ic_stats.is_rx_chanmismatch++; 1991 return; 1992 } 1993 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 1994 scan.bintval <= IEEE80211_BINTVAL_MAX)) { 1995 IEEE80211_DISCARD(ic, 1996 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1997 wh, ieee80211_mgt_subtype_name[subtype >> 1998 IEEE80211_FC0_SUBTYPE_SHIFT], 1999 "bogus beacon interval", scan.bintval); 2000 ic->ic_stats.is_rx_badbintval++; 2001 return; 2002 } 2003 2004 if (ni != ic->ic_bss) { 2005 ni = ieee80211_refine_node_for_beacon(ic, ni, 2006 &ic->ic_channels[scan.chan], scan.ssid); 2007 } 2008 /* 2009 * Count frame now that we know it's to be processed. 2010 */ 2011 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) { 2012 ic->ic_stats.is_rx_beacon++; /* XXX remove */ 2013 IEEE80211_NODE_STAT(ni, rx_beacons); 2014 } else 2015 IEEE80211_NODE_STAT(ni, rx_proberesp); 2016 2017 /* 2018 * When operating in station mode, check for state updates. 2019 * Be careful to ignore beacons received while doing a 2020 * background scan. We consider only 11g/WMM stuff right now. 2021 */ 2022 if (ic->ic_opmode == IEEE80211_M_STA && 2023 ni->ni_associd != 0 && 2024 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 || 2025 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) { 2026 /* record tsf of last beacon */ 2027 memcpy(ni->ni_tstamp.data, scan.tstamp, 2028 sizeof(ni->ni_tstamp)); 2029 if (ni->ni_erp != scan.erp) { 2030 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2031 "[%s] erp change: was 0x%x, now 0x%x\n", 2032 ether_sprintf(wh->i_addr2), 2033 ni->ni_erp, scan.erp); 2034 if (ic->ic_curmode == IEEE80211_MODE_11G && 2035 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 2036 ic->ic_flags |= IEEE80211_F_USEPROT; 2037 else 2038 ic->ic_flags &= ~IEEE80211_F_USEPROT; 2039 ni->ni_erp = scan.erp; 2040 /* XXX statistic */ 2041 } 2042 if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) { 2043 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2044 "[%s] capabilities change: before 0x%x," 2045 " now 0x%x\n", 2046 ether_sprintf(wh->i_addr2), 2047 ni->ni_capinfo, scan.capinfo); 2048 /* 2049 * NB: we assume short preamble doesn't 2050 * change dynamically 2051 */ 2052 ieee80211_set_shortslottime(ic, 2053 ic->ic_curmode == IEEE80211_MODE_11A || 2054 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2055 ni->ni_capinfo = scan.capinfo; 2056 /* XXX statistic */ 2057 } 2058 if (scan.wme != NULL && 2059 (ni->ni_flags & IEEE80211_NODE_QOS) && 2060 ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0) 2061 ieee80211_wme_updateparams(ic); 2062 if (scan.tim != NULL) { 2063 struct ieee80211_tim_ie *ie = 2064 (struct ieee80211_tim_ie *) scan.tim; 2065 2066 ni->ni_dtim_count = ie->tim_count; 2067 ni->ni_dtim_period = ie->tim_period; 2068 } 2069 if (ic->ic_flags & IEEE80211_F_SCAN) 2070 ieee80211_add_scan(ic, &scan, wh, 2071 subtype, rssi, rstamp); 2072 ic->ic_bmiss_count = 0; 2073 return; 2074 } 2075 /* 2076 * If scanning, just pass information to the scan module. 2077 */ 2078 if (ic->ic_flags & IEEE80211_F_SCAN) { 2079 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) { 2080 /* 2081 * Actively scanning a channel marked passive; 2082 * send a probe request now that we know there 2083 * is 802.11 traffic present. 2084 * 2085 * XXX check if the beacon we recv'd gives 2086 * us what we need and suppress the probe req 2087 */ 2088 ieee80211_probe_curchan(ic, 1); 2089 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN; 2090 } 2091 ieee80211_add_scan(ic, &scan, wh, 2092 subtype, rssi, rstamp); 2093 return; 2094 } 2095 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) 2096 ieee80211_update_adhoc_node(ic, ni, wh, &scan, rssi, 2097 rstamp); 2098 break; 2099 } 2100 2101 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 2102 if (ic->ic_opmode == IEEE80211_M_STA || 2103 ic->ic_state != IEEE80211_S_RUN) { 2104 ic->ic_stats.is_rx_mgtdiscard++; 2105 return; 2106 } 2107 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) { 2108 /* frame must be directed */ 2109 ic->ic_stats.is_rx_mgtdiscard++; /* XXX stat */ 2110 return; 2111 } 2112 2113 /* 2114 * prreq frame format 2115 * [tlv] ssid 2116 * [tlv] supported rates 2117 * [tlv] extended supported rates 2118 */ 2119 ssid = rates = xrates = NULL; 2120 while (frm < efrm) { 2121 switch (*frm) { 2122 case IEEE80211_ELEMID_SSID: 2123 ssid = frm; 2124 break; 2125 case IEEE80211_ELEMID_RATES: 2126 rates = frm; 2127 break; 2128 case IEEE80211_ELEMID_XRATES: 2129 xrates = frm; 2130 break; 2131 } 2132 frm += frm[1] + 2; 2133 } 2134 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2135 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2136 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2137 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) { 2138 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT, 2139 wh, ieee80211_mgt_subtype_name[subtype >> 2140 IEEE80211_FC0_SUBTYPE_SHIFT], 2141 "%s", "no ssid with ssid suppression enabled"); 2142 ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/ 2143 return; 2144 } 2145 2146 if (ni == ic->ic_bss) { 2147 if (ic->ic_opmode != IEEE80211_M_IBSS) 2148 ni = ieee80211_tmp_node(ic, wh->i_addr2); 2149 else if (IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) 2150 ; 2151 else { 2152 /* 2153 * XXX Cannot tell if the sender is operating 2154 * in ibss mode. But we need a new node to 2155 * send the response so blindly add them to the 2156 * neighbor table. 2157 */ 2158 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 2159 wh->i_addr2); 2160 } 2161 if (ni == NULL) 2162 return; 2163 allocbs = 1; 2164 } else 2165 allocbs = 0; 2166 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2167 "[%s] recv probe req\n", ether_sprintf(wh->i_addr2)); 2168 ni->ni_rssi = rssi; 2169 ni->ni_rstamp = rstamp; 2170 rate = ieee80211_setup_rates(ni, rates, xrates, 2171 IEEE80211_R_DOSORT | IEEE80211_R_DOFRATE 2172 | IEEE80211_R_DONEGO | IEEE80211_R_DODEL); 2173 if (rate & IEEE80211_RATE_BASIC) { 2174 IEEE80211_DISCARD(ic, IEEE80211_MSG_XRATE, 2175 wh, ieee80211_mgt_subtype_name[subtype >> 2176 IEEE80211_FC0_SUBTYPE_SHIFT], 2177 "%s", "recv'd rate set invalid"); 2178 } else { 2179 IEEE80211_SEND_MGMT(ic, ni, 2180 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0); 2181 } 2182 if (allocbs && ic->ic_opmode != IEEE80211_M_IBSS) { 2183 /* reclaim immediately */ 2184 ieee80211_free_node(ni); 2185 } 2186 break; 2187 2188 case IEEE80211_FC0_SUBTYPE_AUTH: { 2189 u_int16_t algo, seq, status; 2190 /* 2191 * auth frame format 2192 * [2] algorithm 2193 * [2] sequence 2194 * [2] status 2195 * [tlv*] challenge 2196 */ 2197 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2198 algo = le16toh(*(u_int16_t *)frm); 2199 seq = le16toh(*(u_int16_t *)(frm + 2)); 2200 status = le16toh(*(u_int16_t *)(frm + 4)); 2201 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2202 "[%s] recv auth frame with algorithm %d seq %d\n", 2203 ether_sprintf(wh->i_addr2), algo, seq); 2204 /* 2205 * Consult the ACL policy module if setup. 2206 */ 2207 if (ic->ic_acl != NULL && 2208 !ic->ic_acl->iac_check(ic, wh->i_addr2)) { 2209 IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL, 2210 wh, "auth", "%s", "disallowed by ACL"); 2211 ic->ic_stats.is_rx_acl++; 2212 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2213 IEEE80211_SEND_MGMT(ic, ni, 2214 IEEE80211_FC0_SUBTYPE_AUTH, 2215 (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16)); 2216 } 2217 return; 2218 } 2219 if (ic->ic_flags & IEEE80211_F_COUNTERM) { 2220 IEEE80211_DISCARD(ic, 2221 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO, 2222 wh, "auth", "%s", "TKIP countermeasures enabled"); 2223 ic->ic_stats.is_rx_auth_countermeasures++; 2224 #ifndef IEEE80211_NO_HOSTAP 2225 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2226 IEEE80211_SEND_MGMT(ic, ni, 2227 IEEE80211_FC0_SUBTYPE_AUTH, 2228 IEEE80211_REASON_MIC_FAILURE); 2229 } 2230 #endif /* !IEEE80211_NO_HOSTAP */ 2231 return; 2232 } 2233 if (algo == IEEE80211_AUTH_ALG_SHARED) 2234 ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi, 2235 rstamp, seq, status); 2236 else if (algo == IEEE80211_AUTH_ALG_OPEN) 2237 ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq, 2238 status); 2239 else { 2240 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2241 wh, "auth", "unsupported alg %d", algo); 2242 ic->ic_stats.is_rx_auth_unsupported++; 2243 #ifndef IEEE80211_NO_HOSTAP 2244 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 2245 /* XXX not right */ 2246 IEEE80211_SEND_MGMT(ic, ni, 2247 IEEE80211_FC0_SUBTYPE_AUTH, 2248 (seq+1) | (IEEE80211_STATUS_ALG<<16)); 2249 } 2250 #endif /* !IEEE80211_NO_HOSTAP */ 2251 return; 2252 } 2253 break; 2254 } 2255 2256 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 2257 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: { 2258 u_int16_t capinfo, lintval; 2259 struct ieee80211_rsnparms rsn; 2260 u_int8_t reason; 2261 2262 if (ic->ic_opmode != IEEE80211_M_HOSTAP || 2263 ic->ic_state != IEEE80211_S_RUN) { 2264 ic->ic_stats.is_rx_mgtdiscard++; 2265 return; 2266 } 2267 2268 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 2269 reassoc = 1; 2270 resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP; 2271 } else { 2272 reassoc = 0; 2273 resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP; 2274 } 2275 /* 2276 * asreq frame format 2277 * [2] capability information 2278 * [2] listen interval 2279 * [6*] current AP address (reassoc only) 2280 * [tlv] ssid 2281 * [tlv] supported rates 2282 * [tlv] extended supported rates 2283 * [tlv] WPA or RSN 2284 */ 2285 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4)); 2286 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) { 2287 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2288 wh, ieee80211_mgt_subtype_name[subtype >> 2289 IEEE80211_FC0_SUBTYPE_SHIFT], 2290 "%s", "wrong bssid"); 2291 ic->ic_stats.is_rx_assoc_bss++; 2292 return; 2293 } 2294 capinfo = le16toh(*(u_int16_t *)frm); frm += 2; 2295 lintval = le16toh(*(u_int16_t *)frm); frm += 2; 2296 if (reassoc) 2297 frm += 6; /* ignore current AP info */ 2298 ssid = rates = xrates = wpa = wme = NULL; 2299 while (frm < efrm) { 2300 switch (*frm) { 2301 case IEEE80211_ELEMID_SSID: 2302 ssid = frm; 2303 break; 2304 case IEEE80211_ELEMID_RATES: 2305 rates = frm; 2306 break; 2307 case IEEE80211_ELEMID_XRATES: 2308 xrates = frm; 2309 break; 2310 /* XXX verify only one of RSN and WPA ie's? */ 2311 case IEEE80211_ELEMID_RSN: 2312 wpa = frm; 2313 break; 2314 case IEEE80211_ELEMID_VENDOR: 2315 if (iswpaoui(frm)) 2316 wpa = frm; 2317 else if (iswmeinfo(frm)) 2318 wme = frm; 2319 /* XXX Atheros OUI support */ 2320 break; 2321 } 2322 frm += frm[1] + 2; 2323 } 2324 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2325 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN); 2326 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid); 2327 2328 if (ni == ic->ic_bss) { 2329 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2330 "[%s] deny %s request, sta not authenticated\n", 2331 ether_sprintf(wh->i_addr2), 2332 reassoc ? "reassoc" : "assoc"); 2333 ieee80211_send_error(ic, ni, wh->i_addr2, 2334 IEEE80211_FC0_SUBTYPE_DEAUTH, 2335 IEEE80211_REASON_ASSOC_NOT_AUTHED); 2336 ic->ic_stats.is_rx_assoc_notauth++; 2337 return; 2338 } 2339 /* assert right associstion security credentials */ 2340 if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) { 2341 IEEE80211_DPRINTF(ic, 2342 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2343 "[%s] no WPA/RSN IE in association request\n", 2344 ether_sprintf(wh->i_addr2)); 2345 IEEE80211_SEND_MGMT(ic, ni, 2346 IEEE80211_FC0_SUBTYPE_DEAUTH, 2347 IEEE80211_REASON_RSN_REQUIRED); 2348 ieee80211_node_leave(ic, ni); 2349 /* XXX distinguish WPA/RSN? */ 2350 ic->ic_stats.is_rx_assoc_badwpaie++; 2351 return; 2352 } 2353 if (wpa != NULL) { 2354 /* 2355 * Parse WPA information element. Note that 2356 * we initialize the param block from the node 2357 * state so that information in the IE overrides 2358 * our defaults. The resulting parameters are 2359 * installed below after the association is assured. 2360 */ 2361 rsn = ni->ni_rsn; 2362 if (wpa[0] != IEEE80211_ELEMID_RSN) 2363 reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh); 2364 else 2365 reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh); 2366 if (reason != 0) { 2367 IEEE80211_SEND_MGMT(ic, ni, 2368 IEEE80211_FC0_SUBTYPE_DEAUTH, reason); 2369 ieee80211_node_leave(ic, ni); 2370 /* XXX distinguish WPA/RSN? */ 2371 ic->ic_stats.is_rx_assoc_badwpaie++; 2372 return; 2373 } 2374 IEEE80211_DPRINTF(ic, 2375 IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 2376 "[%s] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n", 2377 ether_sprintf(wh->i_addr2), 2378 wpa[0] != IEEE80211_ELEMID_RSN ? "WPA" : "RSN", 2379 rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen, 2380 rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen, 2381 rsn.rsn_keymgmt, rsn.rsn_caps); 2382 } 2383 /* discard challenge after association */ 2384 if (ni->ni_challenge != NULL) { 2385 free(ni->ni_challenge, M_DEVBUF); 2386 ni->ni_challenge = NULL; 2387 } 2388 /* NB: 802.11 spec says to ignore station's privacy bit */ 2389 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) { 2390 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2391 "[%s] deny %s request, capability mismatch 0x%x\n", 2392 ether_sprintf(wh->i_addr2), 2393 reassoc ? "reassoc" : "assoc", capinfo); 2394 IEEE80211_SEND_MGMT(ic, ni, resp, 2395 IEEE80211_STATUS_CAPINFO); 2396 ieee80211_node_leave(ic, ni); 2397 ic->ic_stats.is_rx_assoc_capmismatch++; 2398 return; 2399 } 2400 rate = ieee80211_setup_rates(ni, rates, xrates, 2401 IEEE80211_R_DOSORT | IEEE80211_R_DOFRATE | 2402 IEEE80211_R_DONEGO | IEEE80211_R_DODEL); 2403 /* 2404 * If constrained to 11g-only stations reject an 2405 * 11b-only station. We cheat a bit here by looking 2406 * at the max negotiated xmit rate and assuming anyone 2407 * with a best rate <24Mb/s is an 11b station. 2408 */ 2409 if ((rate & IEEE80211_RATE_BASIC) || 2410 ((ic->ic_flags & IEEE80211_F_PUREG) && rate < 48)) { 2411 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 2412 "[%s] deny %s request, rate set mismatch\n", 2413 ether_sprintf(wh->i_addr2), 2414 reassoc ? "reassoc" : "assoc"); 2415 IEEE80211_SEND_MGMT(ic, ni, resp, 2416 IEEE80211_STATUS_BASIC_RATE); 2417 ieee80211_node_leave(ic, ni); 2418 ic->ic_stats.is_rx_assoc_norate++; 2419 return; 2420 } 2421 ni->ni_rssi = rssi; 2422 ni->ni_rstamp = rstamp; 2423 ni->ni_intval = lintval; 2424 ni->ni_capinfo = capinfo; 2425 ni->ni_chan = ic->ic_bss->ni_chan; 2426 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell; 2427 ni->ni_fhindex = ic->ic_bss->ni_fhindex; 2428 if (wpa != NULL) { 2429 /* 2430 * Record WPA/RSN parameters for station, mark 2431 * node as using WPA and record information element 2432 * for applications that require it. 2433 */ 2434 ni->ni_rsn = rsn; 2435 ieee80211_saveie(&ni->ni_wpa_ie, wpa); 2436 } else if (ni->ni_wpa_ie != NULL) { 2437 /* 2438 * Flush any state from a previous association. 2439 */ 2440 free(ni->ni_wpa_ie, M_DEVBUF); 2441 ni->ni_wpa_ie = NULL; 2442 } 2443 if (wme != NULL) { 2444 /* 2445 * Record WME parameters for station, mark node 2446 * as capable of QoS and record information 2447 * element for applications that require it. 2448 */ 2449 ieee80211_saveie(&ni->ni_wme_ie, wme); 2450 ni->ni_flags |= IEEE80211_NODE_QOS; 2451 } else if (ni->ni_wme_ie != NULL) { 2452 /* 2453 * Flush any state from a previous association. 2454 */ 2455 free(ni->ni_wme_ie, M_DEVBUF); 2456 ni->ni_wme_ie = NULL; 2457 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2458 } 2459 ieee80211_node_join(ic, ni, resp); 2460 break; 2461 } 2462 2463 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 2464 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: { 2465 u_int16_t capinfo, associd; 2466 u_int16_t status; 2467 2468 if (ic->ic_opmode != IEEE80211_M_STA || 2469 ic->ic_state != IEEE80211_S_ASSOC) { 2470 ic->ic_stats.is_rx_mgtdiscard++; 2471 return; 2472 } 2473 2474 /* 2475 * asresp frame format 2476 * [2] capability information 2477 * [2] status 2478 * [2] association ID 2479 * [tlv] supported rates 2480 * [tlv] extended supported rates 2481 * [tlv] WME 2482 */ 2483 IEEE80211_VERIFY_LENGTH(efrm - frm, 6); 2484 ni = ic->ic_bss; 2485 capinfo = le16toh(*(u_int16_t *)frm); 2486 frm += 2; 2487 status = le16toh(*(u_int16_t *)frm); 2488 frm += 2; 2489 if (status != 0) { 2490 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2491 "[%s] %sassoc failed (reason %d)\n", 2492 ether_sprintf(wh->i_addr2), 2493 ISREASSOC(subtype) ? "re" : "", status); 2494 if (ni != ic->ic_bss) /* XXX never true? */ 2495 ni->ni_fails++; 2496 ic->ic_stats.is_rx_auth_fail++; /* XXX */ 2497 return; 2498 } 2499 associd = le16toh(*(u_int16_t *)frm); 2500 frm += 2; 2501 2502 rates = xrates = wpa = wme = NULL; 2503 while (frm < efrm) { 2504 switch (*frm) { 2505 case IEEE80211_ELEMID_RATES: 2506 rates = frm; 2507 break; 2508 case IEEE80211_ELEMID_XRATES: 2509 xrates = frm; 2510 break; 2511 case IEEE80211_ELEMID_VENDOR: 2512 if (iswmeoui(frm)) 2513 wme = frm; 2514 /* XXX Atheros OUI support */ 2515 break; 2516 } 2517 frm += frm[1] + 2; 2518 } 2519 2520 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE); 2521 rate = ieee80211_setup_rates(ni, rates, xrates, 2522 IEEE80211_R_DOSORT | IEEE80211_R_DOFRATE | 2523 IEEE80211_R_DONEGO | IEEE80211_R_DODEL); 2524 if (rate & IEEE80211_RATE_BASIC) { 2525 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2526 "[%s] %sassoc failed (rate set mismatch)\n", 2527 ether_sprintf(wh->i_addr2), 2528 ISREASSOC(subtype) ? "re" : ""); 2529 if (ni != ic->ic_bss) /* XXX never true? */ 2530 ni->ni_fails++; 2531 ic->ic_stats.is_rx_assoc_norate++; 2532 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 2533 return; 2534 } 2535 2536 ni->ni_capinfo = capinfo; 2537 ni->ni_associd = associd; 2538 if (wme != NULL && 2539 ieee80211_parse_wmeparams(ic, wme, wh) >= 0) { 2540 ni->ni_flags |= IEEE80211_NODE_QOS; 2541 ieee80211_wme_updateparams(ic); 2542 } else 2543 ni->ni_flags &= ~IEEE80211_NODE_QOS; 2544 /* 2545 * Configure state now that we are associated. 2546 * 2547 * XXX may need different/additional driver callbacks? 2548 */ 2549 if (ic->ic_curmode == IEEE80211_MODE_11A || 2550 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) { 2551 ic->ic_flags |= IEEE80211_F_SHPREAMBLE; 2552 ic->ic_flags &= ~IEEE80211_F_USEBARKER; 2553 } else { 2554 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE; 2555 ic->ic_flags |= IEEE80211_F_USEBARKER; 2556 } 2557 ieee80211_set_shortslottime(ic, 2558 ic->ic_curmode == IEEE80211_MODE_11A || 2559 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 2560 /* 2561 * Honor ERP protection. 2562 * 2563 * NB: ni_erp should zero for non-11g operation. 2564 * XXX check ic_curmode anyway? 2565 */ 2566 if (ic->ic_curmode == IEEE80211_MODE_11G && 2567 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION)) 2568 ic->ic_flags |= IEEE80211_F_USEPROT; 2569 else 2570 ic->ic_flags &= ~IEEE80211_F_USEPROT; 2571 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2572 "[%s] %sassoc success: %s preamble, %s slot time%s%s\n", 2573 ether_sprintf(wh->i_addr2), 2574 ISREASSOC(subtype) ? "re" : "", 2575 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long", 2576 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long", 2577 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "", 2578 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "" 2579 ); 2580 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype); 2581 break; 2582 } 2583 2584 case IEEE80211_FC0_SUBTYPE_DEAUTH: { 2585 u_int16_t reason; 2586 2587 if (ic->ic_state == IEEE80211_S_SCAN) { 2588 ic->ic_stats.is_rx_mgtdiscard++; 2589 return; 2590 } 2591 /* 2592 * deauth frame format 2593 * [2] reason 2594 */ 2595 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2596 reason = le16toh(*(u_int16_t *)frm); 2597 ic->ic_stats.is_rx_deauth++; 2598 IEEE80211_NODE_STAT(ni, rx_deauth); 2599 2600 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) { 2601 /* Not intended for this station. */ 2602 ic->ic_stats.is_rx_mgtdiscard++; 2603 break; 2604 } 2605 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 2606 "[%s] recv deauthenticate (reason %d)\n", 2607 ether_sprintf(ni->ni_macaddr), reason); 2608 switch (ic->ic_opmode) { 2609 case IEEE80211_M_STA: 2610 ieee80211_new_state(ic, IEEE80211_S_AUTH, 2611 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2612 break; 2613 case IEEE80211_M_HOSTAP: 2614 #ifndef IEEE80211_NO_HOSTAP 2615 if (ni != ic->ic_bss) 2616 ieee80211_node_leave(ic, ni); 2617 #endif /* !IEEE80211_NO_HOSTAP */ 2618 break; 2619 default: 2620 ic->ic_stats.is_rx_mgtdiscard++; 2621 break; 2622 } 2623 break; 2624 } 2625 2626 case IEEE80211_FC0_SUBTYPE_DISASSOC: { 2627 u_int16_t reason; 2628 2629 if (ic->ic_state != IEEE80211_S_RUN && 2630 ic->ic_state != IEEE80211_S_ASSOC && 2631 ic->ic_state != IEEE80211_S_AUTH) { 2632 ic->ic_stats.is_rx_mgtdiscard++; 2633 return; 2634 } 2635 /* 2636 * disassoc frame format 2637 * [2] reason 2638 */ 2639 IEEE80211_VERIFY_LENGTH(efrm - frm, 2); 2640 reason = le16toh(*(u_int16_t *)frm); 2641 ic->ic_stats.is_rx_disassoc++; 2642 IEEE80211_NODE_STAT(ni, rx_disassoc); 2643 2644 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) { 2645 /* Not intended for this station. */ 2646 ic->ic_stats.is_rx_mgtdiscard++; 2647 break; 2648 } 2649 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC, 2650 "[%s] recv disassociate (reason %d)\n", 2651 ether_sprintf(ni->ni_macaddr), reason); 2652 switch (ic->ic_opmode) { 2653 case IEEE80211_M_STA: 2654 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 2655 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 2656 break; 2657 case IEEE80211_M_HOSTAP: 2658 #ifndef IEEE80211_NO_HOSTAP 2659 if (ni != ic->ic_bss) 2660 ieee80211_node_leave(ic, ni); 2661 #endif /* !IEEE80211_NO_HOSTAP */ 2662 break; 2663 default: 2664 ic->ic_stats.is_rx_mgtdiscard++; 2665 break; 2666 } 2667 break; 2668 } 2669 default: 2670 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY, 2671 wh, "mgt", "subtype 0x%x not handled", subtype); 2672 ic->ic_stats.is_rx_badsubtype++; 2673 break; 2674 } 2675 #undef ISREASSOC 2676 #undef ISPROBE 2677 } 2678 #undef IEEE80211_VERIFY_LENGTH 2679 #undef IEEE80211_VERIFY_ELEMENT 2680 2681 #ifndef IEEE80211_NO_HOSTAP 2682 /* 2683 * Handle station power-save state change. 2684 */ 2685 static void 2686 ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable) 2687 { 2688 struct ieee80211com *ic = ni->ni_ic; 2689 struct mbuf *m; 2690 2691 if (enable) { 2692 if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0) 2693 ic->ic_ps_sta++; 2694 ni->ni_flags |= IEEE80211_NODE_PWR_MGT; 2695 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2696 "[%s] power save mode on, %u sta's in ps mode\n", 2697 ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta); 2698 return; 2699 } 2700 2701 if (ni->ni_flags & IEEE80211_NODE_PWR_MGT) 2702 ic->ic_ps_sta--; 2703 ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT; 2704 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2705 "[%s] power save mode off, %u sta's in ps mode\n", 2706 ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta); 2707 /* XXX if no stations in ps mode, flush mc frames */ 2708 2709 /* 2710 * Flush queued unicast frames. 2711 */ 2712 if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) { 2713 if (ic->ic_set_tim != NULL) 2714 ic->ic_set_tim(ni, 0); /* just in case */ 2715 return; 2716 } 2717 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2718 "[%s] flush ps queue, %u packets queued\n", 2719 ether_sprintf(ni->ni_macaddr), IEEE80211_NODE_SAVEQ_QLEN(ni)); 2720 for (;;) { 2721 int qlen; 2722 2723 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2724 if (m == NULL) 2725 break; 2726 /* 2727 * If this is the last packet, turn off the TIM bit. 2728 * If there are more packets, set the more packets bit 2729 * in the mbuf so ieee80211_encap will mark the 802.11 2730 * head to indicate more data frames will follow. 2731 */ 2732 if (qlen != 0) 2733 m->m_flags |= M_MORE_DATA; 2734 /* XXX need different driver interface */ 2735 /* XXX bypasses q max */ 2736 IF_ENQUEUE(&ic->ic_ifp->if_snd, m); 2737 } 2738 if (ic->ic_set_tim != NULL) 2739 ic->ic_set_tim(ni, 0); 2740 } 2741 2742 /* 2743 * Process a received ps-poll frame. 2744 */ 2745 static void 2746 ieee80211_recv_pspoll(struct ieee80211com *ic, 2747 struct ieee80211_node *ni, struct mbuf *m0) 2748 { 2749 struct ieee80211_frame_min *wh; 2750 struct mbuf *m; 2751 u_int16_t aid; 2752 int qlen; 2753 2754 wh = mtod(m0, struct ieee80211_frame_min *); 2755 if (ni->ni_associd == 0) { 2756 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2757 (struct ieee80211_frame *) wh, "ps-poll", 2758 "%s", "unassociated station"); 2759 ic->ic_stats.is_ps_unassoc++; 2760 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2761 IEEE80211_REASON_NOT_ASSOCED); 2762 return; 2763 } 2764 2765 aid = le16toh(*(u_int16_t *)wh->i_dur); 2766 if (aid != ni->ni_associd) { 2767 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2768 (struct ieee80211_frame *) wh, "ps-poll", 2769 "aid mismatch: sta aid 0x%x poll aid 0x%x", 2770 ni->ni_associd, aid); 2771 ic->ic_stats.is_ps_badaid++; 2772 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2773 IEEE80211_REASON_NOT_ASSOCED); 2774 return; 2775 } 2776 2777 /* Okay, take the first queued packet and put it out... */ 2778 IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen); 2779 if (m == NULL) { 2780 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2781 "[%s] recv ps-poll, but queue empty\n", 2782 ether_sprintf(wh->i_addr2)); 2783 ieee80211_send_nulldata(ieee80211_ref_node(ni)); 2784 ic->ic_stats.is_ps_qempty++; /* XXX node stat */ 2785 if (ic->ic_set_tim != NULL) 2786 ic->ic_set_tim(ni, 0); /* just in case */ 2787 return; 2788 } 2789 /* 2790 * If there are more packets, set the more packets bit 2791 * in the packet dispatched to the station; otherwise 2792 * turn off the TIM bit. 2793 */ 2794 if (qlen != 0) { 2795 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2796 "[%s] recv ps-poll, send packet, %u still queued\n", 2797 ether_sprintf(ni->ni_macaddr), qlen); 2798 m->m_flags |= M_MORE_DATA; 2799 } else { 2800 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER, 2801 "[%s] recv ps-poll, send packet, queue empty\n", 2802 ether_sprintf(ni->ni_macaddr)); 2803 if (ic->ic_set_tim != NULL) 2804 ic->ic_set_tim(ni, 0); 2805 } 2806 m->m_flags |= M_PWR_SAV; /* bypass PS handling */ 2807 IF_ENQUEUE(&ic->ic_ifp->if_snd, m); 2808 } 2809 #endif /* !IEEE80211_NO_HOSTAP */ 2810 2811 #ifdef IEEE80211_DEBUG 2812 /* 2813 * Debugging support. 2814 */ 2815 2816 /* 2817 * Return the bssid of a frame. 2818 */ 2819 static const u_int8_t * 2820 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh) 2821 { 2822 if (ic->ic_opmode == IEEE80211_M_STA) 2823 return wh->i_addr2; 2824 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS) 2825 return wh->i_addr1; 2826 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL) 2827 return wh->i_addr1; 2828 return wh->i_addr3; 2829 } 2830 2831 void 2832 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...) 2833 { 2834 char buf[128]; /* XXX */ 2835 va_list ap; 2836 2837 va_start(ap, fmt); 2838 vsnprintf(buf, sizeof(buf), fmt, ap); 2839 va_end(ap); 2840 2841 if_printf(ic->ic_ifp, "%s", buf); /* NB: no \n */ 2842 } 2843 2844 void 2845 ieee80211_note_frame(struct ieee80211com *ic, 2846 const struct ieee80211_frame *wh, 2847 const char *fmt, ...) 2848 { 2849 char buf[128]; /* XXX */ 2850 va_list ap; 2851 2852 va_start(ap, fmt); 2853 vsnprintf(buf, sizeof(buf), fmt, ap); 2854 va_end(ap); 2855 if_printf(ic->ic_ifp, "[%s] %s\n", 2856 ether_sprintf(ieee80211_getbssid(ic, wh)), buf); 2857 } 2858 2859 void 2860 ieee80211_note_mac(struct ieee80211com *ic, 2861 const u_int8_t mac[IEEE80211_ADDR_LEN], 2862 const char *fmt, ...) 2863 { 2864 char buf[128]; /* XXX */ 2865 va_list ap; 2866 2867 va_start(ap, fmt); 2868 vsnprintf(buf, sizeof(buf), fmt, ap); 2869 va_end(ap); 2870 if_printf(ic->ic_ifp, "[%s] %s\n", ether_sprintf(mac), buf); 2871 } 2872 2873 static void 2874 ieee80211_discard_frame(struct ieee80211com *ic, 2875 const struct ieee80211_frame *wh, 2876 const char *type, const char *fmt, ...) 2877 { 2878 va_list ap; 2879 2880 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, 2881 ether_sprintf(ieee80211_getbssid(ic, wh))); 2882 if (type != NULL) 2883 printf("%s frame, ", type); 2884 else 2885 printf("frame, "); 2886 va_start(ap, fmt); 2887 vprintf(fmt, ap); 2888 va_end(ap); 2889 printf("\n"); 2890 } 2891 2892 static void 2893 ieee80211_discard_ie(struct ieee80211com *ic, 2894 const struct ieee80211_frame *wh, 2895 const char *type, const char *fmt, ...) 2896 { 2897 va_list ap; 2898 2899 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, 2900 ether_sprintf(ieee80211_getbssid(ic, wh))); 2901 if (type != NULL) 2902 printf("%s information element, ", type); 2903 else 2904 printf("information element, "); 2905 va_start(ap, fmt); 2906 vprintf(fmt, ap); 2907 va_end(ap); 2908 printf("\n"); 2909 } 2910 2911 static void 2912 ieee80211_discard_mac(struct ieee80211com *ic, 2913 const u_int8_t mac[IEEE80211_ADDR_LEN], 2914 const char *type, const char *fmt, ...) 2915 { 2916 va_list ap; 2917 2918 printf("[%s:%s] discard ", ic->ic_ifp->if_xname, ether_sprintf(mac)); 2919 if (type != NULL) 2920 printf("%s frame, ", type); 2921 else 2922 printf("frame, "); 2923 va_start(ap, fmt); 2924 vprintf(fmt, ap); 2925 va_end(ap); 2926 printf("\n"); 2927 } 2928 #endif /* IEEE80211_DEBUG */ 2929
Indexes created Tue Sep 23 14:10:03 GMT 2025