ieee80211_output.c revision 1.14
1 /* $NetBSD: ieee80211_output.c,v 1.14 2004/07/23 06:44:55 mycroft Exp $ */ 2 /*- 3 * Copyright (c) 2001 Atsushi Onoe 4 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting 5 * All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. The name of the author may not be used to endorse or promote products 16 * derived from this software without specific prior written permission. 17 * 18 * Alternatively, this software may be distributed under the terms of the 19 * GNU General Public License ("GPL") version 2 as published by the Free 20 * Software Foundation. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 32 */ 33 34 #include <sys/cdefs.h> 35 #ifdef __FreeBSD__ 36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_output.c,v 1.10 2004/04/02 23:25:39 sam Exp $"); 37 #else 38 __KERNEL_RCSID(0, "$NetBSD: ieee80211_output.c,v 1.14 2004/07/23 06:44:55 mycroft Exp $"); 39 #endif 40 41 #include "opt_inet.h" 42 43 #ifdef __NetBSD__ 44 #include "bpfilter.h" 45 #endif /* __NetBSD__ */ 46 47 #include <sys/param.h> 48 #include <sys/systm.h> 49 #include <sys/mbuf.h> 50 #include <sys/malloc.h> 51 #include <sys/kernel.h> 52 #include <sys/socket.h> 53 #include <sys/sockio.h> 54 #include <sys/endian.h> 55 #include <sys/errno.h> 56 #ifdef __FreeBSD__ 57 #include <sys/bus.h> 58 #endif 59 #include <sys/proc.h> 60 #include <sys/sysctl.h> 61 62 #ifdef __FreeBSD__ 63 #include <machine/atomic.h> 64 #endif 65 66 #include <net/if.h> 67 #include <net/if_dl.h> 68 #include <net/if_media.h> 69 #include <net/if_arp.h> 70 #ifdef __FreeBSD__ 71 #include <net/ethernet.h> 72 #else 73 #include <net/if_ether.h> 74 #endif 75 #include <net/if_llc.h> 76 77 #include <net80211/ieee80211_var.h> 78 #include <net80211/ieee80211_compat.h> 79 80 #if NBPFILTER > 0 81 #include <net/bpf.h> 82 #endif 83 84 #ifdef INET 85 #include <netinet/in.h> 86 #ifdef __FreeBSD__ 87 #include <netinet/if_ether.h> 88 #else 89 #include <net/if_ether.h> 90 #endif 91 #endif 92 93 /* 94 * Send a management frame to the specified node. The node pointer 95 * must have a reference as the pointer will be passed to the driver 96 * and potentially held for a long time. If the frame is successfully 97 * dispatched to the driver, then it is responsible for freeing the 98 * reference (and potentially free'ing up any associated storage). 99 */ 100 static int 101 ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni, 102 struct mbuf *m, int type) 103 { 104 struct ieee80211com *ic = (void *)ifp; 105 struct ieee80211_frame *wh; 106 107 IASSERT(ni != NULL, ("null node")); 108 ni->ni_inact = 0; 109 110 /* 111 * Yech, hack alert! We want to pass the node down to the 112 * driver's start routine. If we don't do so then the start 113 * routine must immediately look it up again and that can 114 * cause a lock order reversal if, for example, this frame 115 * is being sent because the station is being timedout and 116 * the frame being sent is a DEAUTH message. We could stick 117 * this in an m_tag and tack that on to the mbuf. However 118 * that's rather expensive to do for every frame so instead 119 * we stuff it in the rcvif field since outbound frames do 120 * not (presently) use this. 121 */ 122 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT); 123 if (m == NULL) 124 return ENOMEM; 125 #ifdef __FreeBSD__ 126 KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null")); 127 #endif 128 m->m_pkthdr.rcvif = (void *)ni; 129 130 wh = mtod(m, struct ieee80211_frame *); 131 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type; 132 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 133 *(u_int16_t *)&wh->i_dur[0] = 0; 134 *(u_int16_t *)&wh->i_seq[0] = 135 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT); 136 ni->ni_txseq++; 137 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr); 138 IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr); 139 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid); 140 141 if ((m->m_flags & M_LINK0) != 0 && ni->ni_challenge != NULL) { 142 m->m_flags &= ~M_LINK0; 143 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 144 ("%s: encrypting frame for %s\n", 145 __func__, ether_sprintf(wh->i_addr1))); 146 wh->i_fc[1] |= IEEE80211_FC1_WEP; 147 } 148 149 if (ifp->if_flags & IFF_DEBUG) { 150 /* avoid to print too many frames */ 151 if (ic->ic_opmode == IEEE80211_M_IBSS || 152 #ifdef IEEE80211_DEBUG 153 ieee80211_debug > 1 || 154 #endif 155 (type & IEEE80211_FC0_SUBTYPE_MASK) != 156 IEEE80211_FC0_SUBTYPE_PROBE_RESP) 157 if_printf(ifp, "sending %s to %s on channel %u\n", 158 ieee80211_mgt_subtype_name[ 159 (type & IEEE80211_FC0_SUBTYPE_MASK) 160 >> IEEE80211_FC0_SUBTYPE_SHIFT], 161 ether_sprintf(ni->ni_macaddr), 162 ieee80211_chan2ieee(ic, ni->ni_chan)); 163 } 164 165 IF_ENQUEUE(&ic->ic_mgtq, m); 166 ifp->if_timer = 1; 167 (*ifp->if_start)(ifp); 168 return 0; 169 } 170 171 /* 172 * Encapsulate an outbound data frame. The mbuf chain is updated and 173 * a reference to the destination node is returned. If an error is 174 * encountered NULL is returned and the node reference will also be NULL. 175 * 176 * NB: The caller is responsible for free'ing a returned node reference. 177 * The convention is ic_bss is not reference counted; the caller must 178 * maintain that. 179 */ 180 struct mbuf * 181 ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni) 182 { 183 struct ieee80211com *ic = (void *)ifp; 184 struct ether_header eh; 185 struct ieee80211_frame *wh; 186 struct ieee80211_node *ni = NULL; 187 struct llc *llc; 188 189 if (m->m_len < sizeof(struct ether_header)) { 190 m = m_pullup(m, sizeof(struct ether_header)); 191 if (m == NULL) { 192 ic->ic_stats.is_tx_nombuf++; 193 goto bad; 194 } 195 } 196 memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header)); 197 198 ni = ieee80211_find_txnode(ic, eh.ether_dhost); 199 if (ni == NULL) { 200 IEEE80211_DPRINTF(ic, IEEE80211_MSG_OUTPUT, 201 ("%s: no node for dst %s, discard frame\n", 202 __func__, ether_sprintf(eh.ether_dhost))); 203 ic->ic_stats.is_tx_nonode++; 204 goto bad; 205 } 206 ni->ni_inact = 0; 207 208 m_adj(m, sizeof(struct ether_header) - sizeof(struct llc)); 209 llc = mtod(m, struct llc *); 210 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP; 211 llc->llc_control = LLC_UI; 212 llc->llc_snap.org_code[0] = 0; 213 llc->llc_snap.org_code[1] = 0; 214 llc->llc_snap.org_code[2] = 0; 215 llc->llc_snap.ether_type = eh.ether_type; 216 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT); 217 if (m == NULL) { 218 ic->ic_stats.is_tx_nombuf++; 219 goto bad; 220 } 221 wh = mtod(m, struct ieee80211_frame *); 222 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA; 223 *(u_int16_t *)&wh->i_dur[0] = 0; 224 *(u_int16_t *)&wh->i_seq[0] = 225 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT); 226 ni->ni_txseq++; 227 switch (ic->ic_opmode) { 228 case IEEE80211_M_STA: 229 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS; 230 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid); 231 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost); 232 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost); 233 break; 234 case IEEE80211_M_IBSS: 235 case IEEE80211_M_AHDEMO: 236 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 237 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost); 238 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost); 239 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid); 240 break; 241 case IEEE80211_M_HOSTAP: 242 wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS; 243 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost); 244 IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid); 245 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost); 246 break; 247 case IEEE80211_M_MONITOR: 248 goto bad; 249 } 250 if (ic->ic_flags & IEEE80211_F_WEPON) 251 wh->i_fc[1] |= IEEE80211_FC1_WEP; 252 *pni = ni; 253 return m; 254 bad: 255 if (m != NULL) 256 m_freem(m); 257 if (ni && ni != ic->ic_bss) 258 ieee80211_free_node(ic, ni); 259 *pni = NULL; 260 return NULL; 261 } 262 263 /* 264 * Add a supported rates element id to a frame. 265 */ 266 u_int8_t * 267 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs) 268 { 269 int nrates; 270 271 *frm++ = IEEE80211_ELEMID_RATES; 272 nrates = rs->rs_nrates; 273 if (nrates > IEEE80211_RATE_SIZE) 274 nrates = IEEE80211_RATE_SIZE; 275 *frm++ = nrates; 276 memcpy(frm, rs->rs_rates, nrates); 277 return frm + nrates; 278 } 279 280 /* 281 * Add an extended supported rates element id to a frame. 282 */ 283 u_int8_t * 284 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs) 285 { 286 /* 287 * Add an extended supported rates element if operating in 11g mode. 288 */ 289 if (rs->rs_nrates > IEEE80211_RATE_SIZE) { 290 int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE; 291 *frm++ = IEEE80211_ELEMID_XRATES; 292 *frm++ = nrates; 293 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates); 294 frm += nrates; 295 } 296 return frm; 297 } 298 299 /* 300 * Add an ssid elemet to a frame. 301 */ 302 static u_int8_t * 303 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len) 304 { 305 *frm++ = IEEE80211_ELEMID_SSID; 306 *frm++ = len; 307 memcpy(frm, ssid, len); 308 return frm + len; 309 } 310 311 static struct mbuf * 312 ieee80211_getmbuf(int flags, int type, u_int pktlen) 313 { 314 struct mbuf *m; 315 316 IASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen)); 317 #ifdef __FreeBSD__ 318 if (pktlen <= MHLEN) 319 MGETHDR(m, flags, type); 320 else 321 m = m_getcl(flags, type, M_PKTHDR); 322 #else 323 MGETHDR(m, flags, type); 324 if (m != NULL && pktlen > MHLEN) 325 MCLGET(m, flags); 326 #endif 327 return m; 328 } 329 330 /* 331 * Send a management frame. The node is for the destination (or ic_bss 332 * when in station mode). Nodes other than ic_bss have their reference 333 * count bumped to reflect our use for an indeterminant time. 334 */ 335 int 336 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni, 337 int type, int arg) 338 { 339 #define senderr(_x, _v) do { ic->ic_stats._v++; ret = _x; goto bad; } while (0) 340 struct ifnet *ifp = &ic->ic_if; 341 struct mbuf *m; 342 u_int8_t *frm; 343 enum ieee80211_phymode mode; 344 u_int16_t capinfo; 345 int has_challenge, is_shared_key, ret, timer; 346 347 IASSERT(ni != NULL, ("null node")); 348 349 /* 350 * Hold a reference on the node so it doesn't go away until after 351 * the xmit is complete all the way in the driver. On error we 352 * will remove our reference. 353 */ 354 if (ni != ic->ic_bss) 355 ieee80211_ref_node(ni); 356 timer = 0; 357 switch (type) { 358 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 359 /* 360 * prreq frame format 361 * [tlv] ssid 362 * [tlv] supported rates 363 * [tlv] extended supported rates 364 */ 365 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 366 2 + ic->ic_des_esslen 367 + 2 + IEEE80211_RATE_SIZE 368 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 369 if (m == NULL) 370 senderr(ENOMEM, is_tx_nombuf); 371 m->m_data += sizeof(struct ieee80211_frame); 372 frm = mtod(m, u_int8_t *); 373 frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen); 374 mode = ieee80211_chan2mode(ic, ni->ni_chan); 375 frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]); 376 frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]); 377 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 378 379 timer = IEEE80211_TRANS_WAIT; 380 break; 381 382 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 383 /* 384 * probe response frame format 385 * [8] time stamp 386 * [2] beacon interval 387 * [2] cabability information 388 * [tlv] ssid 389 * [tlv] supported rates 390 * [tlv] parameter set (FH/DS) 391 * [tlv] parameter set (IBSS) 392 * [tlv] extended supported rates 393 */ 394 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 395 8 + 2 + 2 + 2 396 + 2 + ni->ni_esslen 397 + 2 + IEEE80211_RATE_SIZE 398 + (ic->ic_phytype == IEEE80211_T_FH ? 7 : 3) 399 + 6 400 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 401 if (m == NULL) 402 senderr(ENOMEM, is_tx_nombuf); 403 m->m_data += sizeof(struct ieee80211_frame); 404 frm = mtod(m, u_int8_t *); 405 406 memset(frm, 0, 8); /* timestamp should be filled later */ 407 frm += 8; 408 *(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval); 409 frm += 2; 410 if (ic->ic_opmode == IEEE80211_M_IBSS) 411 capinfo = IEEE80211_CAPINFO_IBSS; 412 else 413 capinfo = IEEE80211_CAPINFO_ESS; 414 if (ic->ic_flags & IEEE80211_F_WEPON) 415 capinfo |= IEEE80211_CAPINFO_PRIVACY; 416 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 417 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 418 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 419 *(u_int16_t *)frm = htole16(capinfo); 420 frm += 2; 421 422 frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid, 423 ic->ic_bss->ni_esslen); 424 frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates); 425 426 if (ic->ic_phytype == IEEE80211_T_FH) { 427 *frm++ = IEEE80211_ELEMID_FHPARMS; 428 *frm++ = 5; 429 *frm++ = ni->ni_fhdwell & 0x00ff; 430 *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff; 431 *frm++ = IEEE80211_FH_CHANSET( 432 ieee80211_chan2ieee(ic, ni->ni_chan)); 433 *frm++ = IEEE80211_FH_CHANPAT( 434 ieee80211_chan2ieee(ic, ni->ni_chan)); 435 *frm++ = ni->ni_fhindex; 436 } else { 437 *frm++ = IEEE80211_ELEMID_DSPARMS; 438 *frm++ = 1; 439 *frm++ = ieee80211_chan2ieee(ic, ni->ni_chan); 440 } 441 442 if (ic->ic_opmode == IEEE80211_M_IBSS) { 443 *frm++ = IEEE80211_ELEMID_IBSSPARMS; 444 *frm++ = 2; 445 *frm++ = 0; *frm++ = 0; /* TODO: ATIM window */ 446 } else { /* IEEE80211_M_HOSTAP */ 447 /* TODO: TIM */ 448 *frm++ = IEEE80211_ELEMID_TIM; 449 *frm++ = 4; /* length */ 450 *frm++ = 0; /* DTIM count */ 451 *frm++ = 1; /* DTIM period */ 452 *frm++ = 0; /* bitmap control */ 453 *frm++ = 0; /* Partial Virtual Bitmap (variable length) */ 454 } 455 frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates); 456 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 457 break; 458 459 case IEEE80211_FC0_SUBTYPE_AUTH: 460 MGETHDR(m, M_DONTWAIT, MT_DATA); 461 if (m == NULL) 462 senderr(ENOMEM, is_tx_nombuf); 463 464 has_challenge = ((arg == IEEE80211_AUTH_SHARED_CHALLENGE || 465 arg == IEEE80211_AUTH_SHARED_RESPONSE) && 466 ni->ni_challenge != NULL); 467 468 is_shared_key = has_challenge || (ni->ni_challenge != NULL && 469 arg == IEEE80211_AUTH_SHARED_PASS); 470 471 if (has_challenge) { 472 MH_ALIGN(m, 2 * 3 + 2 + IEEE80211_CHALLENGE_LEN); 473 m->m_pkthdr.len = m->m_len = 474 2 * 3 + 2 + IEEE80211_CHALLENGE_LEN; 475 } else { 476 MH_ALIGN(m, 2 * 3); 477 m->m_pkthdr.len = m->m_len = 2 * 3; 478 } 479 frm = mtod(m, u_int8_t *); 480 ((u_int16_t *)frm)[0] = 481 (is_shared_key) ? htole16(IEEE80211_AUTH_ALG_SHARED) 482 : htole16(IEEE80211_AUTH_ALG_OPEN); 483 ((u_int16_t *)frm)[1] = htole16(arg); /* sequence number */ 484 ((u_int16_t *)frm)[2] = 0; /* status */ 485 486 if (has_challenge) { 487 ((u_int16_t *)frm)[3] = 488 htole16((IEEE80211_CHALLENGE_LEN << 8) | 489 IEEE80211_ELEMID_CHALLENGE); 490 memcpy(&((u_int16_t *)frm)[4], ni->ni_challenge, 491 IEEE80211_CHALLENGE_LEN); 492 if (arg == IEEE80211_AUTH_SHARED_RESPONSE) { 493 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH, 494 ("%s: request encrypt frame\n", __func__)); 495 m->m_flags |= M_LINK0; /* WEP-encrypt, please */ 496 } 497 } 498 if (ic->ic_opmode == IEEE80211_M_STA) 499 timer = IEEE80211_TRANS_WAIT; 500 break; 501 502 case IEEE80211_FC0_SUBTYPE_DEAUTH: 503 if (ifp->if_flags & IFF_DEBUG) 504 if_printf(ifp, "station %s deauthenticate (reason %d)\n", 505 ether_sprintf(ni->ni_macaddr), arg); 506 MGETHDR(m, M_DONTWAIT, MT_DATA); 507 if (m == NULL) 508 senderr(ENOMEM, is_tx_nombuf); 509 MH_ALIGN(m, 2); 510 m->m_pkthdr.len = m->m_len = 2; 511 *mtod(m, u_int16_t *) = htole16(arg); /* reason */ 512 break; 513 514 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 515 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: 516 /* 517 * asreq frame format 518 * [2] capability information 519 * [2] listen interval 520 * [6*] current AP address (reassoc only) 521 * [tlv] ssid 522 * [tlv] supported rates 523 * [tlv] extended supported rates 524 */ 525 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 526 sizeof(capinfo) 527 + sizeof(u_int16_t) 528 + IEEE80211_ADDR_LEN 529 + 2 + ni->ni_esslen 530 + 2 + IEEE80211_RATE_SIZE 531 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 532 if (m == NULL) 533 senderr(ENOMEM, is_tx_nombuf); 534 m->m_data += sizeof(struct ieee80211_frame); 535 frm = mtod(m, u_int8_t *); 536 537 capinfo = 0; 538 if (ic->ic_opmode == IEEE80211_M_IBSS) 539 capinfo |= IEEE80211_CAPINFO_IBSS; 540 else /* IEEE80211_M_STA */ 541 capinfo |= IEEE80211_CAPINFO_ESS; 542 if (ic->ic_flags & IEEE80211_F_WEPON) 543 capinfo |= IEEE80211_CAPINFO_PRIVACY; 544 /* 545 * NB: Some 11a AP's reject the request when 546 * short premable is set. 547 */ 548 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 549 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 550 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 551 if (ic->ic_flags & IEEE80211_F_SHSLOT) 552 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME; 553 *(u_int16_t *)frm = htole16(capinfo); 554 frm += 2; 555 556 *(u_int16_t *)frm = htole16(ic->ic_lintval); 557 frm += 2; 558 559 if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 560 IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid); 561 frm += IEEE80211_ADDR_LEN; 562 } 563 564 frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen); 565 frm = ieee80211_add_rates(frm, &ni->ni_rates); 566 frm = ieee80211_add_xrates(frm, &ni->ni_rates); 567 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 568 569 timer = IEEE80211_TRANS_WAIT; 570 break; 571 572 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 573 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: 574 /* 575 * asreq frame format 576 * [2] capability information 577 * [2] status 578 * [2] association ID 579 * [tlv] supported rates 580 * [tlv] extended supported rates 581 */ 582 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 583 sizeof(capinfo) 584 + sizeof(u_int16_t) 585 + sizeof(u_int16_t) 586 + 2 + IEEE80211_RATE_SIZE 587 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 588 if (m == NULL) 589 senderr(ENOMEM, is_tx_nombuf); 590 m->m_data += sizeof(struct ieee80211_frame); 591 frm = mtod(m, u_int8_t *); 592 593 capinfo = IEEE80211_CAPINFO_ESS; 594 if (ic->ic_flags & IEEE80211_F_WEPON) 595 capinfo |= IEEE80211_CAPINFO_PRIVACY; 596 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 597 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 598 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 599 *(u_int16_t *)frm = htole16(capinfo); 600 frm += 2; 601 602 *(u_int16_t *)frm = htole16(arg); /* status */ 603 frm += 2; 604 605 if (arg == IEEE80211_STATUS_SUCCESS) 606 *(u_int16_t *)frm = htole16(ni->ni_associd); 607 frm += 2; 608 609 frm = ieee80211_add_rates(frm, &ni->ni_rates); 610 frm = ieee80211_add_xrates(frm, &ni->ni_rates); 611 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 612 break; 613 614 case IEEE80211_FC0_SUBTYPE_DISASSOC: 615 if (ifp->if_flags & IFF_DEBUG) 616 if_printf(ifp, "station %s disassociate (reason %d)\n", 617 ether_sprintf(ni->ni_macaddr), arg); 618 MGETHDR(m, M_DONTWAIT, MT_DATA); 619 if (m == NULL) 620 senderr(ENOMEM, is_tx_nombuf); 621 MH_ALIGN(m, 2); 622 m->m_pkthdr.len = m->m_len = 2; 623 *mtod(m, u_int16_t *) = htole16(arg); /* reason */ 624 break; 625 626 default: 627 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY, 628 ("%s: invalid mgmt frame type %u\n", __func__, type)); 629 senderr(EINVAL, is_tx_unknownmgt); 630 /* NOTREACHED */ 631 } 632 633 ret = ieee80211_mgmt_output(ifp, ni, m, type); 634 if (ret == 0) { 635 if (timer) 636 ic->ic_mgt_timer = timer; 637 } else { 638 bad: 639 if (ni != ic->ic_bss) /* remove ref we added */ 640 ieee80211_free_node(ic, ni); 641 } 642 return ret; 643 #undef senderr 644 } 645 646 void 647 ieee80211_pwrsave(struct ieee80211com *ic, struct ieee80211_node *ni, 648 struct mbuf *m) 649 { 650 /* Store the new packet on our queue, changing the TIM if necessary */ 651 652 if (IF_IS_EMPTY(&ni->ni_savedq)) { 653 ic->ic_set_tim(ic, ni->ni_associd, 1); 654 } 655 if (ni->ni_savedq.ifq_len >= IEEE80211_PS_MAX_QUEUE) { 656 IF_DROP(&ni->ni_savedq); 657 m_freem(m); 658 if (ic->ic_if.if_flags & IFF_DEBUG) 659 printf("%s: station %s power save queue overflow" 660 " of size %d drops %d\n", 661 ic->ic_if.if_xname, 662 ether_sprintf(ni->ni_macaddr), 663 IEEE80211_PS_MAX_QUEUE, 664 ni->ni_savedq.ifq_drops); 665 } else { 666 /* Similar to ieee80211_mgmt_output, store the node in 667 * the rcvif field. 668 */ 669 IF_ENQUEUE(&ni->ni_savedq, m); 670 m->m_pkthdr.rcvif = (void *)ni; 671 } 672 } 673 674
Indexes created Fri Sep 26 08:10:20 GMT 2025