ieee80211_output.c revision 1.4 1 /* $NetBSD: ieee80211_output.c,v 1.4 2003/09/14 01:14:55 dyoung Exp $ */
2 /*-
3 * Copyright (c) 2001 Atsushi Onoe
4 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. The name of the author may not be used to endorse or promote products
16 * derived from this software without specific prior written permission.
17 *
18 * Alternatively, this software may be distributed under the terms of the
19 * GNU General Public License ("GPL") version 2 as published by the Free
20 * Software Foundation.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
23 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
24 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
25 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
27 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
28 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
29 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
30 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
31 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 */
33
34 #include <sys/cdefs.h>
35 #ifdef __FreeBSD__
36 __FBSDID("$FreeBSD: src/sys/net80211/ieee80211_output.c,v 1.5 2003/09/01 02:55:09 sam Exp $");
37 #else
38 __KERNEL_RCSID(0, "$NetBSD: ieee80211_output.c,v 1.4 2003/09/14 01:14:55 dyoung Exp $");
39 #endif
40
41 #include "opt_inet.h"
42
43 #include <sys/param.h>
44 #include <sys/systm.h>
45 #include <sys/mbuf.h>
46 #include <sys/malloc.h>
47 #include <sys/kernel.h>
48 #include <sys/socket.h>
49 #include <sys/sockio.h>
50 #include <sys/endian.h>
51 #include <sys/errno.h>
52 #include <sys/bus.h>
53 #include <sys/proc.h>
54 #include <sys/sysctl.h>
55
56 #ifdef __FreeBSD__
57 #include <machine/atomic.h>
58 #endif
59
60 #include <net/if.h>
61 #include <net/if_dl.h>
62 #include <net/if_media.h>
63 #include <net/if_arp.h>
64 #ifdef __FreeBSD__
65 #include <net/ethernet.h>
66 #endif
67 #include <net/if_llc.h>
68
69 #include <net80211/ieee80211_compat.h>
70 #include <net80211/ieee80211_var.h>
71
72 #include <net/bpf.h>
73
74 #ifdef INET
75 #include <netinet/in.h>
76 #include <netinet/if_ether.h>
77 #endif
78
79 /*
80 * Send a management frame to the specified node. The node pointer
81 * must have a reference as the pointer will be passed to the driver
82 * and potentially held for a long time. If the frame is successfully
83 * dispatched to the driver, then it is responsible for freeing the
84 * reference (and potentially free'ing up any associated storage).
85 */
86 static int
87 ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni,
88 struct mbuf *m, int type)
89 {
90 struct ieee80211com *ic = (void *)ifp;
91 struct ieee80211_frame *wh;
92
93 KASSERT(ni != NULL, ("null node"));
94 ni->ni_inact = 0;
95
96 /*
97 * Yech, hack alert! We want to pass the node down to the
98 * driver's start routine. If we don't do so then the start
99 * routine must immediately look it up again and that can
100 * cause a lock order reversal if, for example, this frame
101 * is being sent because the station is being timedout and
102 * the frame being sent is a DEAUTH message. We could stick
103 * this in an m_tag and tack that on to the mbuf. However
104 * that's rather expensive to do for every frame so instead
105 * we stuff it in the rcvif field since outbound frames do
106 * not (presently) use this.
107 */
108 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
109 if (m == NULL)
110 return ENOMEM;
111 KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null"));
112 m->m_pkthdr.rcvif = (void *)ni;
113
114 wh = mtod(m, struct ieee80211_frame *);
115 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
116 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
117 *(u_int16_t *)&wh->i_dur[0] = 0;
118 *(u_int16_t *)&wh->i_seq[0] =
119 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
120 ni->ni_txseq++;
121 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
122 IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
123 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
124
125 if (ifp->if_flags & IFF_DEBUG) {
126 /* avoid to print too many frames */
127 if (ic->ic_opmode == IEEE80211_M_IBSS ||
128 #ifdef IEEE80211_DEBUG
129 ieee80211_debug > 1 ||
130 #endif
131 (type & IEEE80211_FC0_SUBTYPE_MASK) !=
132 IEEE80211_FC0_SUBTYPE_PROBE_RESP)
133 if_printf(ifp, "sending %s to %s on channel %u\n",
134 ieee80211_mgt_subtype_name[
135 (type & IEEE80211_FC0_SUBTYPE_MASK)
136 >> IEEE80211_FC0_SUBTYPE_SHIFT],
137 ether_sprintf(ni->ni_macaddr),
138 ieee80211_chan2ieee(ic, ni->ni_chan));
139 }
140
141 IF_ENQUEUE(&ic->ic_mgtq, m);
142 ifp->if_timer = 1;
143 (*ifp->if_start)(ifp);
144 return 0;
145 }
146
147 /*
148 * Encapsulate an outbound data frame. The mbuf chain is updated and
149 * a reference to the destination node is returned. If an error is
150 * encountered NULL is returned and the node reference will also be NULL.
151 *
152 * NB: The caller is responsible for free'ing a returned node reference.
153 * The convention is ic_bss is not reference counted; the caller must
154 * maintain that.
155 */
156 struct mbuf *
157 ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni)
158 {
159 struct ieee80211com *ic = (void *)ifp;
160 struct ether_header eh;
161 struct ieee80211_frame *wh;
162 struct ieee80211_node *ni = NULL;
163 struct llc *llc;
164
165 if (m->m_len < sizeof(struct ether_header)) {
166 m = m_pullup(m, sizeof(struct ether_header));
167 if (m == NULL) {
168 /* XXX statistic */
169 goto bad;
170 }
171 }
172 memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
173
174 if (ic->ic_opmode != IEEE80211_M_STA) {
175 ni = ieee80211_find_node(ic, eh.ether_dhost);
176 if (ni == NULL) {
177 /*
178 * When not in station mode the
179 * destination address should always be
180 * in the node table unless this is a
181 * multicast/broadcast frame.
182 */
183 if (!IEEE80211_IS_MULTICAST(eh.ether_dhost)) {
184 /* ic->ic_stats.st_tx_nonode++; XXX statistic */
185 goto bad;
186 }
187 ni = ic->ic_bss;
188 }
189 } else
190 ni = ic->ic_bss;
191 ni->ni_inact = 0;
192
193 m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
194 llc = mtod(m, struct llc *);
195 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
196 llc->llc_control = LLC_UI;
197 llc->llc_snap.org_code[0] = 0;
198 llc->llc_snap.org_code[1] = 0;
199 llc->llc_snap.org_code[2] = 0;
200 llc->llc_snap.ether_type = eh.ether_type;
201 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
202 if (m == NULL)
203 goto bad;
204 wh = mtod(m, struct ieee80211_frame *);
205 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
206 *(u_int16_t *)&wh->i_dur[0] = 0;
207 *(u_int16_t *)&wh->i_seq[0] =
208 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
209 ni->ni_txseq++;
210 switch (ic->ic_opmode) {
211 case IEEE80211_M_STA:
212 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
213 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
214 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
215 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
216 break;
217 case IEEE80211_M_IBSS:
218 case IEEE80211_M_AHDEMO:
219 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
220 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
221 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
222 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
223 break;
224 case IEEE80211_M_HOSTAP:
225 wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
226 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
227 IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
228 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
229 break;
230 case IEEE80211_M_MONITOR:
231 goto bad;
232 }
233 *pni = ni;
234 return m;
235 bad:
236 if (m != NULL)
237 m_freem(m);
238 if (ni && ni != ic->ic_bss)
239 ieee80211_free_node(ic, ni);
240 *pni = NULL;
241 return NULL;
242 }
243
244 /*
245 * Add a supported rates element id to a frame.
246 */
247 u_int8_t *
248 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs)
249 {
250 int nrates;
251
252 *frm++ = IEEE80211_ELEMID_RATES;
253 nrates = rs->rs_nrates;
254 if (nrates > IEEE80211_RATE_SIZE)
255 nrates = IEEE80211_RATE_SIZE;
256 *frm++ = nrates;
257 memcpy(frm, rs->rs_rates, nrates);
258 return frm + nrates;
259 }
260
261 /*
262 * Add an extended supported rates element id to a frame.
263 */
264 u_int8_t *
265 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs)
266 {
267 /*
268 * Add an extended supported rates element if operating in 11g mode.
269 */
270 if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
271 int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
272 *frm++ = IEEE80211_ELEMID_XRATES;
273 *frm++ = nrates;
274 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
275 frm += nrates;
276 }
277 return frm;
278 }
279
280 /*
281 * Add an ssid elemet to a frame.
282 */
283 static u_int8_t *
284 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len)
285 {
286 *frm++ = IEEE80211_ELEMID_SSID;
287 *frm++ = len;
288 memcpy(frm, ssid, len);
289 return frm + len;
290 }
291
292 static struct mbuf *
293 ieee80211_getmbuf(int flags, int type, u_int pktlen)
294 {
295 struct mbuf *m;
296
297 KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
298 #ifdef __FreeBSD__
299 if (pktlen <= MHLEN)
300 MGETHDR(m, flags, type);
301 else
302 m = m_getcl(flags, type, M_PKTHDR);
303 #else
304 MGETHDR(m, flags, type);
305 if (m != NULL && pktlen > MHLEN)
306 MCLGET(m, flags);
307 #endif
308 return m;
309 }
310
311 /*
312 * Send a management frame. The node is for the destination (or ic_bss
313 * when in station mode). Nodes other than ic_bss have their reference
314 * count bumped to reflect our use for an indeterminant time.
315 */
316 int
317 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
318 int type, int arg)
319 {
320 #define senderr(_x) do { ret = _x; goto bad; } while (0)
321 struct ifnet *ifp = &ic->ic_if;
322 struct mbuf *m;
323 u_int8_t *frm;
324 enum ieee80211_phymode mode;
325 u_int16_t capinfo;
326 int ret, timer;
327
328 KASSERT(ni != NULL, ("null node"));
329
330 /*
331 * Hold a reference on the node so it doesn't go away until after
332 * the xmit is complete all the way in the driver. On error we
333 * will remove our reference.
334 */
335 if (ni != ic->ic_bss)
336 ieee80211_ref_node(ni);
337 timer = 0;
338 switch (type) {
339 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
340 /*
341 * prreq frame format
342 * [tlv] ssid
343 * [tlv] supported rates
344 * [tlv] extended supported rates
345 */
346 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
347 2 + ic->ic_des_esslen
348 + 2 + IEEE80211_RATE_SIZE
349 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
350 if (m == NULL)
351 senderr(ENOMEM);
352 m->m_data += sizeof(struct ieee80211_frame);
353 frm = mtod(m, u_int8_t *);
354 frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen);
355 mode = ieee80211_chan2mode(ic, ni->ni_chan);
356 frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]);
357 frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]);
358 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
359
360 timer = IEEE80211_TRANS_WAIT;
361 break;
362
363 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
364 /*
365 * probe response frame format
366 * [8] time stamp
367 * [2] beacon interval
368 * [2] cabability information
369 * [tlv] ssid
370 * [tlv] supported rates
371 * [tlv] parameter set (IBSS)
372 * [tlv] extended supported rates
373 */
374 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
375 8 + 2 + 2 + 2
376 + 2 + ni->ni_esslen
377 + 2 + IEEE80211_RATE_SIZE
378 + 6
379 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
380 if (m == NULL)
381 senderr(ENOMEM);
382 m->m_data += sizeof(struct ieee80211_frame);
383 frm = mtod(m, u_int8_t *);
384
385 memset(frm, 0, 8); /* timestamp should be filled later */
386 frm += 8;
387 *(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval);
388 frm += 2;
389 if (ic->ic_opmode == IEEE80211_M_IBSS)
390 capinfo = IEEE80211_CAPINFO_IBSS;
391 else
392 capinfo = IEEE80211_CAPINFO_ESS;
393 if (ic->ic_flags & IEEE80211_F_WEPON)
394 capinfo |= IEEE80211_CAPINFO_PRIVACY;
395 *(u_int16_t *)frm = htole16(capinfo);
396 frm += 2;
397
398 frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
399 ic->ic_bss->ni_esslen);
400 frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates);
401
402 if (ic->ic_opmode == IEEE80211_M_IBSS) {
403 *frm++ = IEEE80211_ELEMID_IBSSPARMS;
404 *frm++ = 2;
405 *frm++ = 0; *frm++ = 0; /* TODO: ATIM window */
406 } else { /* IEEE80211_M_HOSTAP */
407 /* TODO: TIM */
408 *frm++ = IEEE80211_ELEMID_TIM;
409 *frm++ = 4; /* length */
410 *frm++ = 0; /* DTIM count */
411 *frm++ = 1; /* DTIM period */
412 *frm++ = 0; /* bitmap control */
413 *frm++ = 0; /* Partial Virtual Bitmap (variable length) */
414 }
415 frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates);
416 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
417 break;
418
419 case IEEE80211_FC0_SUBTYPE_AUTH:
420 MGETHDR(m, M_DONTWAIT, MT_DATA);
421 if (m == NULL)
422 senderr(ENOMEM);
423 MH_ALIGN(m, 2 * 3);
424 m->m_pkthdr.len = m->m_len = 6;
425 frm = mtod(m, u_int8_t *);
426 /* TODO: shared key auth */
427 ((u_int16_t *)frm)[0] = htole16(IEEE80211_AUTH_ALG_OPEN);
428 ((u_int16_t *)frm)[1] = htole16(arg); /* sequence number */
429 ((u_int16_t *)frm)[2] = 0; /* status */
430 if (ic->ic_opmode == IEEE80211_M_STA)
431 timer = IEEE80211_TRANS_WAIT;
432 break;
433
434 case IEEE80211_FC0_SUBTYPE_DEAUTH:
435 if (ifp->if_flags & IFF_DEBUG)
436 if_printf(ifp, "station %s deauthenticate (reason %d)\n",
437 ether_sprintf(ni->ni_macaddr), arg);
438 MGETHDR(m, M_DONTWAIT, MT_DATA);
439 if (m == NULL)
440 senderr(ENOMEM);
441 MH_ALIGN(m, 2);
442 m->m_pkthdr.len = m->m_len = 2;
443 *mtod(m, u_int16_t *) = htole16(arg); /* reason */
444 break;
445
446 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
447 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
448 /*
449 * asreq frame format
450 * [2] capability information
451 * [2] listen interval
452 * [6*] current AP address (reassoc only)
453 * [tlv] ssid
454 * [tlv] supported rates
455 * [tlv] extended supported rates
456 */
457 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
458 sizeof(capinfo)
459 + sizeof(u_int16_t)
460 + IEEE80211_ADDR_LEN
461 + 2 + ni->ni_esslen
462 + 2 + IEEE80211_RATE_SIZE
463 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
464 if (m == NULL)
465 senderr(ENOMEM);
466 m->m_data += sizeof(struct ieee80211_frame);
467 frm = mtod(m, u_int8_t *);
468
469 capinfo = 0;
470 if (ic->ic_opmode == IEEE80211_M_IBSS)
471 capinfo |= IEEE80211_CAPINFO_IBSS;
472 else /* IEEE80211_M_STA */
473 capinfo |= IEEE80211_CAPINFO_ESS;
474 if (ic->ic_flags & IEEE80211_F_WEPON)
475 capinfo |= IEEE80211_CAPINFO_PRIVACY;
476 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
477 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
478 if (ic->ic_flags & IEEE80211_F_SHSLOT)
479 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
480 *(u_int16_t *)frm = htole16(capinfo);
481 frm += 2;
482
483 *(u_int16_t *)frm = htole16(ic->ic_lintval);
484 frm += 2;
485
486 if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
487 IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
488 frm += IEEE80211_ADDR_LEN;
489 }
490
491 frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
492 frm = ieee80211_add_rates(frm, &ni->ni_rates);
493 frm = ieee80211_add_xrates(frm, &ni->ni_rates);
494 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
495
496 timer = IEEE80211_TRANS_WAIT;
497 break;
498
499 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
500 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
501 /*
502 * asreq frame format
503 * [2] capability information
504 * [2] status
505 * [2] association ID
506 * [tlv] supported rates
507 * [tlv] extended supported rates
508 */
509 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
510 sizeof(capinfo)
511 + sizeof(u_int16_t)
512 + sizeof(u_int16_t)
513 + 2 + IEEE80211_RATE_SIZE
514 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
515 if (m == NULL)
516 senderr(ENOMEM);
517 m->m_data += sizeof(struct ieee80211_frame);
518 frm = mtod(m, u_int8_t *);
519
520 capinfo = IEEE80211_CAPINFO_ESS;
521 if (ic->ic_flags & IEEE80211_F_WEPON)
522 capinfo |= IEEE80211_CAPINFO_PRIVACY;
523 *(u_int16_t *)frm = htole16(capinfo);
524 frm += 2;
525
526 *(u_int16_t *)frm = htole16(arg); /* status */
527 frm += 2;
528
529 if (arg == IEEE80211_STATUS_SUCCESS)
530 *(u_int16_t *)frm = htole16(ni->ni_associd);
531 frm += 2;
532
533 frm = ieee80211_add_rates(frm, &ni->ni_rates);
534 frm = ieee80211_add_xrates(frm, &ni->ni_rates);
535 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
536 break;
537
538 case IEEE80211_FC0_SUBTYPE_DISASSOC:
539 if (ifp->if_flags & IFF_DEBUG)
540 if_printf(ifp, "station %s disassociate (reason %d)\n",
541 ether_sprintf(ni->ni_macaddr), arg);
542 MGETHDR(m, M_DONTWAIT, MT_DATA);
543 if (m == NULL)
544 senderr(ENOMEM);
545 MH_ALIGN(m, 2);
546 m->m_pkthdr.len = m->m_len = 2;
547 *mtod(m, u_int16_t *) = htole16(arg); /* reason */
548 break;
549
550 default:
551 IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n",
552 __func__, type));
553 senderr(EINVAL);
554 /* NOTREACHED */
555 }
556
557 ret = ieee80211_mgmt_output(ifp, ni, m, type);
558 if (ret == 0) {
559 if (timer)
560 ic->ic_mgt_timer = timer;
561 } else {
562 bad:
563 if (ni != ic->ic_bss) /* remove ref we added */
564 ieee80211_free_node(ic, ni);
565 }
566 return ret;
567 #undef senderr
568 }
569