1 /*-
2 * SPDX-License-Identifier: BSD-2-Clause
3 *
4 * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 */
27
28 /*
29 * IEEE 802.11 Station mode support.
30 */
31 #include "opt_inet.h"
32 #include "opt_wlan.h"
33
34 #include <sys/param.h>
35 #include <sys/systm.h>
36 #include <sys/mbuf.h>
37 #include <sys/malloc.h>
38 #include <sys/kernel.h>
39
40 #include <sys/socket.h>
41 #include <sys/sockio.h>
42 #include <sys/endian.h>
43 #include <sys/errno.h>
44 #include <sys/proc.h>
45 #include <sys/sysctl.h>
46
47 #include <net/if.h>
48 #include <net/if_media.h>
49 #include <net/if_llc.h>
50 #include <net/if_dl.h>
51 #include <net/if_var.h>
52 #include <net/ethernet.h>
53
54 #include <net/bpf.h>
55
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_sta.h>
58 #include <net80211/ieee80211_input.h>
59 #ifdef IEEE80211_SUPPORT_SUPERG
60 #include <net80211/ieee80211_superg.h>
61 #endif
62 #include <net80211/ieee80211_ratectl.h>
63 #include <net80211/ieee80211_sta.h>
64 #include <net80211/ieee80211_vht.h>
65
66 static void sta_vattach(struct ieee80211vap *);
67 static void sta_beacon_miss(struct ieee80211vap *);
68 static int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
69 static int sta_input(struct ieee80211_node *, struct mbuf *,
70 const struct ieee80211_rx_stats *, int, int);
71 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
72 int subtype, const struct ieee80211_rx_stats *, int rssi, int nf);
73 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
74
75 void
ieee80211_sta_attach(struct ieee80211com * ic)76 ieee80211_sta_attach(struct ieee80211com *ic)
77 {
78 ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
79 }
80
81 void
ieee80211_sta_detach(struct ieee80211com * ic)82 ieee80211_sta_detach(struct ieee80211com *ic)
83 {
84 }
85
86 static void
sta_vdetach(struct ieee80211vap * vap)87 sta_vdetach(struct ieee80211vap *vap)
88 {
89 }
90
91 static void
sta_vattach(struct ieee80211vap * vap)92 sta_vattach(struct ieee80211vap *vap)
93 {
94 vap->iv_newstate = sta_newstate;
95 vap->iv_input = sta_input;
96 vap->iv_recv_mgmt = sta_recv_mgmt;
97 vap->iv_recv_ctl = sta_recv_ctl;
98 vap->iv_opdetach = sta_vdetach;
99 vap->iv_bmiss = sta_beacon_miss;
100 }
101
102 /*
103 * Handle a beacon miss event. The common code filters out
104 * spurious events that can happen when scanning and/or before
105 * reaching RUN state.
106 */
107 static void
sta_beacon_miss(struct ieee80211vap * vap)108 sta_beacon_miss(struct ieee80211vap *vap)
109 {
110 struct ieee80211com *ic = vap->iv_ic;
111
112 IEEE80211_LOCK_ASSERT(ic);
113
114 KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
115 KASSERT(vap->iv_state >= IEEE80211_S_RUN,
116 ("wrong state %s", ieee80211_state_name[vap->iv_state]));
117
118 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
119 "beacon miss, mode %s state %s\n",
120 ieee80211_opmode_name[vap->iv_opmode],
121 ieee80211_state_name[vap->iv_state]);
122
123 if (vap->iv_state == IEEE80211_S_CSA) {
124 /*
125 * A Channel Switch is pending; assume we missed the
126 * beacon that would've completed the process and just
127 * force the switch. If we made a mistake we'll not
128 * find the AP on the new channel and fall back to a
129 * normal scan.
130 */
131 ieee80211_csa_completeswitch(ic);
132 return;
133 }
134 if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
135 /*
136 * Send a directed probe req before falling back to a
137 * scan; if we receive a response ic_bmiss_count will
138 * be reset. Some cards mistakenly report beacon miss
139 * so this avoids the expensive scan if the ap is
140 * still there.
141 */
142 ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
143 vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
144 vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
145 return;
146 }
147
148 callout_stop(&vap->iv_swbmiss);
149 vap->iv_bmiss_count = 0;
150 vap->iv_stats.is_beacon_miss++;
151 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
152 #ifdef IEEE80211_SUPPORT_SUPERG
153
154 /*
155 * If we receive a beacon miss interrupt when using
156 * dynamic turbo, attempt to switch modes before
157 * reassociating.
158 */
159 if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
160 ieee80211_dturbo_switch(vap,
161 ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
162 #endif
163 /*
164 * Try to reassociate before scanning for a new ap.
165 */
166 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
167 } else {
168 /*
169 * Somebody else is controlling state changes (e.g.
170 * a user-mode app) don't do anything that would
171 * confuse them; just drop into scan mode so they'll
172 * notified of the state change and given control.
173 */
174 ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
175 }
176 }
177
178 /*
179 * Handle deauth with reason. We retry only for
180 * the cases where we might succeed. Otherwise
181 * we downgrade the ap and scan.
182 */
183 static void
sta_authretry(struct ieee80211vap * vap,struct ieee80211_node * ni,int reason)184 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
185 {
186 switch (reason) {
187 case IEEE80211_STATUS_SUCCESS: /* NB: MLME assoc */
188 case IEEE80211_STATUS_TIMEOUT:
189 case IEEE80211_REASON_ASSOC_EXPIRE:
190 case IEEE80211_REASON_NOT_AUTHED:
191 case IEEE80211_REASON_NOT_ASSOCED:
192 case IEEE80211_REASON_ASSOC_LEAVE:
193 case IEEE80211_REASON_ASSOC_NOT_AUTHED:
194 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
195 break;
196 default:
197 ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
198 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
199 ieee80211_check_scan_current(vap);
200 break;
201 }
202 }
203
204 static void
sta_swbmiss_start(struct ieee80211vap * vap)205 sta_swbmiss_start(struct ieee80211vap *vap)
206 {
207
208 if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS) {
209 /*
210 * Start s/w beacon miss timer for devices w/o
211 * hardware support. We fudge a bit here since
212 * we're doing this in software.
213 */
214 vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
215 2 * vap->iv_bmissthreshold * vap->iv_bss->ni_intval);
216 vap->iv_swbmiss_count = 0;
217 callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
218 ieee80211_swbmiss, vap);
219 }
220 }
221
222 /*
223 * IEEE80211_M_STA vap state machine handler.
224 * This routine handles the main states in the 802.11 protocol.
225 */
226 static int
sta_newstate(struct ieee80211vap * vap,enum ieee80211_state nstate,int arg)227 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
228 {
229 struct ieee80211com *ic = vap->iv_ic;
230 struct ieee80211_node *ni;
231 enum ieee80211_state ostate;
232
233 IEEE80211_LOCK_ASSERT(ic);
234
235 ostate = vap->iv_state;
236 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
237 __func__, ieee80211_state_name[ostate],
238 ieee80211_state_name[nstate], arg);
239 vap->iv_state = nstate; /* state transition */
240 callout_stop(&vap->iv_mgtsend); /* XXX callout_drain */
241 if (ostate != IEEE80211_S_SCAN)
242 ieee80211_cancel_scan(vap); /* background scan */
243 ni = vap->iv_bss; /* NB: no reference held */
244 if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
245 callout_stop(&vap->iv_swbmiss);
246 switch (nstate) {
247 case IEEE80211_S_INIT:
248 switch (ostate) {
249 case IEEE80211_S_SLEEP:
250 /* XXX wakeup */
251 /* XXX driver hook to wakeup the hardware? */
252 case IEEE80211_S_RUN:
253 IEEE80211_SEND_MGMT(ni,
254 IEEE80211_FC0_SUBTYPE_DISASSOC,
255 IEEE80211_REASON_ASSOC_LEAVE);
256 ieee80211_sta_leave(ni);
257 break;
258 case IEEE80211_S_ASSOC:
259 IEEE80211_SEND_MGMT(ni,
260 IEEE80211_FC0_SUBTYPE_DEAUTH,
261 IEEE80211_REASON_AUTH_LEAVE);
262 break;
263 case IEEE80211_S_SCAN:
264 ieee80211_cancel_scan(vap);
265 break;
266 default:
267 break;
268 }
269 if (ostate != IEEE80211_S_INIT) {
270 /* NB: optimize INIT -> INIT case */
271 ieee80211_reset_bss(vap);
272 }
273 if (vap->iv_auth->ia_detach != NULL)
274 vap->iv_auth->ia_detach(vap);
275 break;
276 case IEEE80211_S_SCAN:
277 switch (ostate) {
278 case IEEE80211_S_INIT:
279 /*
280 * Initiate a scan. We can come here as a result
281 * of an IEEE80211_IOC_SCAN_REQ too in which case
282 * the vap will be marked with IEEE80211_FEXT_SCANREQ
283 * and the scan request parameters will be present
284 * in iv_scanreq. Otherwise we do the default.
285 */
286 if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
287 ieee80211_check_scan(vap,
288 vap->iv_scanreq_flags,
289 vap->iv_scanreq_duration,
290 vap->iv_scanreq_mindwell,
291 vap->iv_scanreq_maxdwell,
292 vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
293 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
294 } else
295 ieee80211_check_scan_current(vap);
296 break;
297 case IEEE80211_S_SCAN:
298 case IEEE80211_S_AUTH:
299 case IEEE80211_S_ASSOC:
300 /*
301 * These can happen either because of a timeout
302 * on an assoc/auth response or because of a
303 * change in state that requires a reset. For
304 * the former we're called with a non-zero arg
305 * that is the cause for the failure; pass this
306 * to the scan code so it can update state.
307 * Otherwise trigger a new scan unless we're in
308 * manual roaming mode in which case an application
309 * must issue an explicit scan request.
310 */
311 if (arg != 0)
312 ieee80211_scan_assoc_fail(vap,
313 vap->iv_bss->ni_macaddr, arg);
314 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
315 ieee80211_check_scan_current(vap);
316 break;
317 case IEEE80211_S_SLEEP: /* beacon miss */
318 /*
319 * XXX if in sleep we need to wakeup the hardware.
320 */
321 /* FALLTHROUGH */
322 case IEEE80211_S_RUN: /* beacon miss */
323 /*
324 * Beacon miss. Notify user space and if not
325 * under control of a user application (roaming
326 * manual) kick off a scan to re-connect.
327 */
328
329 ieee80211_sta_leave(ni);
330 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
331 ieee80211_check_scan_current(vap);
332 break;
333 default:
334 goto invalid;
335 }
336 break;
337 case IEEE80211_S_AUTH:
338 switch (ostate) {
339 case IEEE80211_S_INIT:
340 case IEEE80211_S_SCAN:
341 IEEE80211_SEND_MGMT(ni,
342 IEEE80211_FC0_SUBTYPE_AUTH, 1);
343 break;
344 case IEEE80211_S_AUTH:
345 case IEEE80211_S_ASSOC:
346 switch (arg & 0xff) {
347 case IEEE80211_FC0_SUBTYPE_AUTH:
348 /* ??? */
349 IEEE80211_SEND_MGMT(ni,
350 IEEE80211_FC0_SUBTYPE_AUTH, 2);
351 break;
352 case IEEE80211_FC0_SUBTYPE_DEAUTH:
353 sta_authretry(vap, ni, arg>>8);
354 break;
355 }
356 break;
357 case IEEE80211_S_SLEEP:
358 case IEEE80211_S_RUN:
359 switch (arg & 0xff) {
360 case IEEE80211_FC0_SUBTYPE_AUTH:
361 IEEE80211_SEND_MGMT(ni,
362 IEEE80211_FC0_SUBTYPE_AUTH, 2);
363 vap->iv_state = IEEE80211_S_RUN; /* stay RUN */
364 break;
365 case IEEE80211_FC0_SUBTYPE_DEAUTH:
366 ieee80211_sta_leave(ni);
367 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
368 /* try to reauth */
369 IEEE80211_SEND_MGMT(ni,
370 IEEE80211_FC0_SUBTYPE_AUTH, 1);
371 }
372 break;
373 }
374 break;
375 default:
376 goto invalid;
377 }
378 break;
379 case IEEE80211_S_ASSOC:
380 switch (ostate) {
381 case IEEE80211_S_AUTH:
382 case IEEE80211_S_ASSOC:
383 IEEE80211_SEND_MGMT(ni,
384 IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
385 break;
386 case IEEE80211_S_SLEEP: /* cannot happen */
387 case IEEE80211_S_RUN:
388 ieee80211_sta_leave(ni);
389 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
390 IEEE80211_SEND_MGMT(ni, arg ?
391 IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
392 IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
393 }
394 break;
395 default:
396 goto invalid;
397 }
398 break;
399 case IEEE80211_S_RUN:
400 if (vap->iv_flags & IEEE80211_F_WPA) {
401 /* XXX validate prerequisites */
402 }
403 switch (ostate) {
404 case IEEE80211_S_RUN:
405 case IEEE80211_S_CSA:
406 break;
407 case IEEE80211_S_AUTH: /* when join is done in fw */
408 case IEEE80211_S_ASSOC:
409 #ifdef IEEE80211_DEBUG
410 if (ieee80211_msg_debug(vap)) {
411 ieee80211_note(vap, "%s with %s ssid ",
412 (vap->iv_opmode == IEEE80211_M_STA ?
413 "associated" : "synchronized"),
414 ether_sprintf(ni->ni_bssid));
415 ieee80211_print_essid(vap->iv_bss->ni_essid,
416 ni->ni_esslen);
417 net80211_printf(" channel %d start %uMbit/s\n",
418 ieee80211_chan2ieee(ic, ic->ic_curchan),
419 ieee80211_node_get_txrate_kbit(ni) / 1000);
420 }
421 #endif
422 ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
423 ieee80211_notify_node_join(ni,
424 arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
425 break;
426 case IEEE80211_S_SLEEP:
427 /* Wake up from sleep */
428 vap->iv_sta_ps(vap, 0);
429 break;
430 default:
431 goto invalid;
432 }
433 ieee80211_sync_curchan(ic);
434 if (ostate != IEEE80211_S_RUN)
435 sta_swbmiss_start(vap);
436 /*
437 * When 802.1x is not in use mark the port authorized
438 * at this point so traffic can flow.
439 */
440 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
441 ieee80211_node_authorize(ni);
442 /*
443 * Fake association when joining an existing bss.
444 *
445 * Don't do this if we're doing SLEEP->RUN.
446 */
447 if (ic->ic_newassoc != NULL && ostate != IEEE80211_S_SLEEP)
448 ic->ic_newassoc(vap->iv_bss, (ostate != IEEE80211_S_RUN));
449 break;
450 case IEEE80211_S_CSA:
451 if (ostate != IEEE80211_S_RUN)
452 goto invalid;
453 break;
454 case IEEE80211_S_SLEEP:
455 sta_swbmiss_start(vap);
456 vap->iv_sta_ps(vap, 1);
457 break;
458 default:
459 invalid:
460 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
461 "%s: unexpected state transition %s -> %s\n", __func__,
462 ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
463 break;
464 }
465 return 0;
466 }
467
468 /*
469 * Return non-zero if the frame is an echo of a multicast
470 * frame sent by ourself. The dir is known to be DSTODS.
471 */
472 static __inline int
isdstods_mcastecho(struct ieee80211vap * vap,const struct ieee80211_frame * wh)473 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
474 {
475 #define QWH4(wh) ((const struct ieee80211_qosframe_addr4 *)wh)
476 #define WH4(wh) ((const struct ieee80211_frame_addr4 *)wh)
477 const uint8_t *sa;
478
479 KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
480
481 if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
482 return 0;
483 sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
484 return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
485 #undef WH4
486 #undef QWH4
487 }
488
489 /*
490 * Return non-zero if the frame is an echo of a multicast
491 * frame sent by ourself. The dir is known to be FROMDS.
492 */
493 static __inline int
isfromds_mcastecho(struct ieee80211vap * vap,const struct ieee80211_frame * wh)494 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
495 {
496 KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
497
498 if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
499 return 0;
500 return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
501 }
502
503 /*
504 * Decide if a received management frame should be
505 * printed when debugging is enabled. This filters some
506 * of the less interesting frames that come frequently
507 * (e.g. beacons).
508 */
509 static __inline int
doprint(struct ieee80211vap * vap,int subtype)510 doprint(struct ieee80211vap *vap, int subtype)
511 {
512 switch (subtype) {
513 case IEEE80211_FC0_SUBTYPE_BEACON:
514 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
515 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
516 return 0;
517 }
518 return 1;
519 }
520
521 /*
522 * Process a received frame. The node associated with the sender
523 * should be supplied. If nothing was found in the node table then
524 * the caller is assumed to supply a reference to iv_bss instead.
525 * The RSSI and a timestamp are also supplied. The RSSI data is used
526 * during AP scanning to select a AP to associate with; it can have
527 * any units so long as values have consistent units and higher values
528 * mean ``better signal''. The receive timestamp is currently not used
529 * by the 802.11 layer.
530 */
531 static int
sta_input(struct ieee80211_node * ni,struct mbuf * m,const struct ieee80211_rx_stats * rxs,int rssi,int nf)532 sta_input(struct ieee80211_node *ni, struct mbuf *m,
533 const struct ieee80211_rx_stats *rxs, int rssi, int nf)
534 {
535 struct ieee80211vap *vap = ni->ni_vap;
536 struct ieee80211com *ic = ni->ni_ic;
537 struct ifnet *ifp = vap->iv_ifp;
538 struct ieee80211_frame *wh;
539 struct ieee80211_key *key;
540 struct ether_header *eh;
541 int hdrspace, need_tap = 1; /* mbuf need to be tapped. */
542 uint8_t dir, type, subtype, qos;
543 uint8_t *bssid;
544 int is_hw_decrypted = 0;
545 int has_decrypted = 0;
546
547 KASSERT(ni != NULL, ("%s: null node, mbuf %p", __func__, m));
548
549 /* Early init in case of early error case. */
550 type = -1;
551
552 /*
553 * Bit of a cheat here, we use a pointer for a 3-address
554 * frame format but don't reference fields past outside
555 * ieee80211_frame_min (or other shorter frames) w/o first
556 * validating the data is present.
557 */
558 wh = mtod(m, struct ieee80211_frame *);
559
560 if (m->m_pkthdr.len < 2 || m->m_pkthdr.len < ieee80211_anyhdrsize(wh)) {
561 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
562 ni->ni_macaddr, NULL,
563 "too short (1): len %u", m->m_pkthdr.len);
564 vap->iv_stats.is_rx_tooshort++;
565 goto err;
566 }
567 if (!IEEE80211_IS_FC0_CHECK_VER(wh, IEEE80211_FC0_VERSION_0)) {
568 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
569 ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
570 wh->i_fc[0], wh->i_fc[1]);
571 vap->iv_stats.is_rx_badversion++;
572 goto err;
573 }
574
575 /*
576 * Some devices do hardware decryption all the way through
577 * to pretending the frame wasn't encrypted in the first place.
578 * So, tag it appropriately so it isn't discarded inappropriately.
579 */
580 if ((rxs != NULL) && (rxs->c_pktflags & IEEE80211_RX_F_DECRYPTED))
581 is_hw_decrypted = 1;
582
583 if (m->m_flags & M_AMPDU_MPDU) {
584 /*
585 * Fastpath for A-MPDU reorder q resubmission. Frames
586 * w/ M_AMPDU_MPDU marked have already passed through
587 * here but were received out of order and been held on
588 * the reorder queue. When resubmitted they are marked
589 * with the M_AMPDU_MPDU flag and we can bypass most of
590 * the normal processing.
591 */
592 type = IEEE80211_FC0_TYPE_DATA;
593 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
594 subtype = IEEE80211_FC0_SUBTYPE_QOS_DATA;
595 hdrspace = ieee80211_hdrspace(ic, wh); /* XXX optimize? */
596 goto resubmit_ampdu;
597 }
598
599 ni->ni_inact = ni->ni_inact_reload;
600
601 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
602 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
603 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
604 /*
605 * Control frames are not folowing the header scheme of data and mgmt
606 * frames so we do not apply extra checks here.
607 * We probably should do checks on RA (+TA) where available for those
608 * too, but for now do not drop them.
609 */
610 if (type != IEEE80211_FC0_TYPE_CTL &&
611 (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
612 bssid = wh->i_addr2;
613 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
614 /* not interested in */
615 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
616 bssid, NULL, "%s", "not to bss");
617 vap->iv_stats.is_rx_wrongbss++;
618 goto out;
619 }
620
621 /*
622 * Some devices may be in a promiscuous mode
623 * where they receive frames for multiple station
624 * addresses.
625 *
626 * If we receive a data frame that isn't
627 * destined to our VAP MAC, drop it.
628 *
629 * XXX TODO: This is only enforced when not scanning;
630 * XXX it assumes a software-driven scan will put the NIC
631 * XXX into a "no data frames" mode before setting this
632 * XXX flag. Otherwise it may be possible that we'll still
633 * XXX process data frames whilst scanning.
634 */
635 if ((! IEEE80211_IS_MULTICAST(wh->i_addr1))
636 && (! IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr))) {
637 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
638 bssid, NULL, "not to cur sta: lladdr=%6D, addr1=%6D",
639 vap->iv_myaddr, ":", wh->i_addr1, ":");
640 vap->iv_stats.is_rx_wrongbss++;
641 goto out;
642 }
643
644 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
645 ni->ni_noise = nf;
646 if ( IEEE80211_HAS_SEQ(type, subtype) &&
647 !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
648 uint8_t tid = ieee80211_gettid(wh);
649 if (IEEE80211_QOS_HAS_SEQ(wh) &&
650 TID_TO_WME_AC(tid) >= WME_AC_VI)
651 ic->ic_wme.wme_hipri_traffic++;
652 if (! ieee80211_check_rxseq(ni, wh, bssid, rxs))
653 goto out;
654 }
655 }
656
657 switch (type) {
658 case IEEE80211_FC0_TYPE_DATA:
659 hdrspace = ieee80211_hdrspace(ic, wh);
660 if (m->m_len < hdrspace &&
661 (m = m_pullup(m, hdrspace)) == NULL) {
662 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
663 ni->ni_macaddr, NULL,
664 "data too short: expecting %u", hdrspace);
665 vap->iv_stats.is_rx_tooshort++;
666 goto out; /* XXX */
667 }
668 /*
669 * Handle A-MPDU re-ordering. If the frame is to be
670 * processed directly then ieee80211_ampdu_reorder
671 * will return 0; otherwise it has consumed the mbuf
672 * and we should do nothing more with it.
673 */
674 if ((m->m_flags & M_AMPDU) &&
675 (dir == IEEE80211_FC1_DIR_FROMDS ||
676 dir == IEEE80211_FC1_DIR_DSTODS) &&
677 ieee80211_ampdu_reorder(ni, m, rxs) != 0) {
678 m = NULL;
679 goto out;
680 }
681 resubmit_ampdu:
682 if (dir == IEEE80211_FC1_DIR_FROMDS) {
683 if (ieee80211_vap_ifp_check_is_simplex(vap) &&
684 isfromds_mcastecho(vap, wh)) {
685 /*
686 * In IEEE802.11 network, multicast
687 * packets sent from "me" are broadcast
688 * from the AP; silently discard for
689 * SIMPLEX interface.
690 */
691 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
692 wh, "data", "%s", "multicast echo");
693 vap->iv_stats.is_rx_mcastecho++;
694 goto out;
695 }
696 if ((vap->iv_flags & IEEE80211_F_DWDS) &&
697 IEEE80211_IS_MULTICAST(wh->i_addr1)) {
698 /*
699 * DWDS sta's must drop 3-address mcast frames
700 * as they will be sent separately as a 4-addr
701 * frame. Accepting the 3-addr frame will
702 * confuse the bridge into thinking the sending
703 * sta is located at the end of WDS link.
704 */
705 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
706 "3-address data", "%s", "DWDS enabled");
707 vap->iv_stats.is_rx_mcastecho++;
708 goto out;
709 }
710 } else if (dir == IEEE80211_FC1_DIR_DSTODS) {
711 if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
712 IEEE80211_DISCARD(vap,
713 IEEE80211_MSG_INPUT, wh, "4-address data",
714 "%s", "DWDS not enabled");
715 vap->iv_stats.is_rx_wrongdir++;
716 goto out;
717 }
718 if (ieee80211_vap_ifp_check_is_simplex(vap) &&
719 isdstods_mcastecho(vap, wh)) {
720 /*
721 * In IEEE802.11 network, multicast
722 * packets sent from "me" are broadcast
723 * from the AP; silently discard for
724 * SIMPLEX interface.
725 */
726 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
727 "4-address data", "%s", "multicast echo");
728 vap->iv_stats.is_rx_mcastecho++;
729 goto out;
730 }
731 } else {
732 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
733 "data", "incorrect dir 0x%x", dir);
734 vap->iv_stats.is_rx_wrongdir++;
735 goto out;
736 }
737
738 /*
739 * Handle privacy requirements for hardware decryption
740 * devices.
741 *
742 * For those devices, a handful of things happen.
743 *
744 * + If IV has been stripped, then we can't run
745 * ieee80211_crypto_decap() - none of the key
746 * + If MIC has been stripped, we can't validate
747 * MIC here.
748 * + If MIC fails, then we need to communicate a
749 * MIC failure up to the stack - but we don't know
750 * which key was used.
751 */
752
753 /*
754 * Handle privacy requirements. Note that we
755 * must not be preempted from here until after
756 * we (potentially) call ieee80211_crypto_demic;
757 * otherwise we may violate assumptions in the
758 * crypto cipher modules used to do delayed update
759 * of replay sequence numbers.
760 */
761 if (is_hw_decrypted || IEEE80211_IS_PROTECTED(wh)) {
762 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
763 /*
764 * Discard encrypted frames when privacy is off.
765 */
766 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
767 wh, "WEP", "%s", "PRIVACY off");
768 vap->iv_stats.is_rx_noprivacy++;
769 IEEE80211_NODE_STAT(ni, rx_noprivacy);
770 goto out;
771 }
772 if (ieee80211_crypto_decap(ni, m, hdrspace, &key) == 0) {
773 /* NB: stats+msgs handled in crypto_decap */
774 IEEE80211_NODE_STAT(ni, rx_wepfail);
775 goto out;
776 }
777 wh = mtod(m, struct ieee80211_frame *);
778 wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
779 has_decrypted = 1;
780 } else {
781 /* XXX M_WEP and IEEE80211_F_PRIVACY */
782 key = NULL;
783 }
784
785 /*
786 * Save QoS bits for use below--before we strip the header.
787 */
788 if (subtype == IEEE80211_FC0_SUBTYPE_QOS_DATA)
789 qos = ieee80211_getqos(wh)[0];
790 else
791 qos = 0;
792
793 /*
794 * Next up, any fragmentation.
795 */
796 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
797 m = ieee80211_defrag(ni, m, hdrspace, has_decrypted);
798 if (m == NULL) {
799 /* Fragment dropped or frame not complete yet */
800 goto out;
801 }
802 }
803 wh = NULL; /* no longer valid, catch any uses */
804
805 /*
806 * Next strip any MSDU crypto bits.
807 *
808 * Note: we can't do MIC stripping/verification if the
809 * upper layer has stripped it. We have to check MIC
810 * ourselves. So, key may be NULL, but we have to check
811 * the RX status.
812 */
813 if (!ieee80211_crypto_demic(vap, key, m, 0)) {
814 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
815 ni->ni_macaddr, "data", "%s", "demic error");
816 vap->iv_stats.is_rx_demicfail++;
817 IEEE80211_NODE_STAT(ni, rx_demicfail);
818 goto out;
819 }
820
821 /* copy to listener after decrypt */
822 if (ieee80211_radiotap_active_vap(vap))
823 ieee80211_radiotap_rx(vap, m);
824 need_tap = 0;
825
826 /*
827 * Finally, strip the 802.11 header.
828 */
829 m = ieee80211_decap(vap, m, hdrspace, qos);
830 if (m == NULL) {
831 /* XXX mask bit to check for both */
832 /* don't count Null data frames as errors */
833 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
834 subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
835 goto out;
836 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
837 ni->ni_macaddr, "data", "%s", "decap error");
838 vap->iv_stats.is_rx_decap++;
839 IEEE80211_NODE_STAT(ni, rx_decap);
840 goto err;
841 }
842 if (!(qos & IEEE80211_QOS_AMSDU))
843 eh = mtod(m, struct ether_header *);
844 else
845 eh = NULL;
846 if (!ieee80211_node_is_authorized(ni)) {
847 /*
848 * Deny any non-PAE frames received prior to
849 * authorization. For open/shared-key
850 * authentication the port is mark authorized
851 * after authentication completes. For 802.1x
852 * the port is not marked authorized by the
853 * authenticator until the handshake has completed.
854 */
855 if (eh == NULL ||
856 eh->ether_type != htons(ETHERTYPE_PAE)) {
857 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
858 ni->ni_macaddr, "data", "unauthorized or "
859 "unknown port: ether type 0x%x len %u",
860 eh == NULL ? -1 : eh->ether_type,
861 m->m_pkthdr.len);
862 vap->iv_stats.is_rx_unauth++;
863 IEEE80211_NODE_STAT(ni, rx_unauth);
864 goto err;
865 }
866 } else {
867 /*
868 * When denying unencrypted frames, discard
869 * any non-PAE frames received without encryption.
870 */
871 if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
872 ((has_decrypted == 0) && (m->m_flags & M_WEP) == 0) &&
873 (is_hw_decrypted == 0) &&
874 (eh == NULL ||
875 eh->ether_type != htons(ETHERTYPE_PAE))) {
876 /*
877 * Drop unencrypted frames.
878 */
879 vap->iv_stats.is_rx_unencrypted++;
880 IEEE80211_NODE_STAT(ni, rx_unencrypted);
881 goto out;
882 }
883 }
884 /* XXX require HT? */
885 if (qos & IEEE80211_QOS_AMSDU) {
886 m = ieee80211_decap_amsdu(ni, m);
887 if (m == NULL)
888 return IEEE80211_FC0_TYPE_DATA;
889 } else {
890 #ifdef IEEE80211_SUPPORT_SUPERG
891 m = ieee80211_decap_fastframe(vap, ni, m);
892 if (m == NULL)
893 return IEEE80211_FC0_TYPE_DATA;
894 #endif
895 }
896 ieee80211_deliver_data(vap, ni, m);
897 return IEEE80211_FC0_TYPE_DATA;
898
899 case IEEE80211_FC0_TYPE_MGT:
900 vap->iv_stats.is_rx_mgmt++;
901 IEEE80211_NODE_STAT(ni, rx_mgmt);
902 if (dir != IEEE80211_FC1_DIR_NODS) {
903 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
904 wh, "data", "incorrect dir 0x%x", dir);
905 vap->iv_stats.is_rx_wrongdir++;
906 goto err;
907 }
908 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
909 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
910 ni->ni_macaddr, "mgt", "too short: len %u",
911 m->m_pkthdr.len);
912 vap->iv_stats.is_rx_tooshort++;
913 goto out;
914 }
915 #ifdef IEEE80211_DEBUG
916 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
917 ieee80211_msg_dumppkts(vap)) {
918 net80211_vap_printf(vap,
919 "received %s from %s rssi %d\n",
920 ieee80211_mgt_subtype_name(subtype),
921 ether_sprintf(wh->i_addr2), rssi);
922 }
923 #endif
924
925 /*
926 * Note: See above for hardware offload privacy requirements.
927 * It also applies here.
928 */
929
930 /*
931 * Again, having encrypted flag set check would be good, but
932 * then we have to also handle crypto_decap() like above.
933 */
934 if (IEEE80211_IS_PROTECTED(wh)) {
935 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
936 /*
937 * Only shared key auth frames with a challenge
938 * should be encrypted, discard all others.
939 */
940 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
941 wh, ieee80211_mgt_subtype_name(subtype),
942 "%s", "WEP set but not permitted");
943 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
944 goto out;
945 }
946 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
947 /*
948 * Discard encrypted frames when privacy is off.
949 */
950 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
951 wh, "mgt", "%s", "WEP set but PRIVACY off");
952 vap->iv_stats.is_rx_noprivacy++;
953 goto out;
954 }
955 hdrspace = ieee80211_hdrspace(ic, wh);
956
957 /*
958 * Again, if IV/MIC was stripped, then this whole
959 * setup will fail. That's going to need some poking.
960 */
961 if (ieee80211_crypto_decap(ni, m, hdrspace, &key) == 0) {
962 /* NB: stats+msgs handled in crypto_decap */
963 goto out;
964 }
965 has_decrypted = 1;
966 wh = mtod(m, struct ieee80211_frame *);
967 wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
968 }
969 vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
970 goto out;
971
972 case IEEE80211_FC0_TYPE_CTL:
973 vap->iv_stats.is_rx_ctl++;
974 IEEE80211_NODE_STAT(ni, rx_ctrl);
975 if (ieee80211_is_ctl_frame_for_vap(ni, m))
976 vap->iv_recv_ctl(ni, m, subtype);
977 goto out;
978
979 default:
980 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
981 wh, NULL, "bad frame type 0x%x", type);
982 /* should not come here */
983 break;
984 }
985 err:
986 if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
987 out:
988 if (m != NULL) {
989 if (need_tap && ieee80211_radiotap_active_vap(vap))
990 ieee80211_radiotap_rx(vap, m);
991 m_freem(m);
992 }
993 return type;
994 }
995
996 static void
sta_auth_open(struct ieee80211_node * ni,struct ieee80211_frame * wh,int rssi,int nf,uint16_t seq,uint16_t status)997 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
998 int rssi, int nf, uint16_t seq, uint16_t status)
999 {
1000 struct ieee80211vap *vap = ni->ni_vap;
1001
1002 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
1003 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1004 ni->ni_macaddr, "open auth",
1005 "bad sta auth mode %u", ni->ni_authmode);
1006 vap->iv_stats.is_rx_bad_auth++; /* XXX */
1007 return;
1008 }
1009 if (vap->iv_state != IEEE80211_S_AUTH ||
1010 seq != IEEE80211_AUTH_OPEN_RESPONSE) {
1011 vap->iv_stats.is_rx_bad_auth++;
1012 return;
1013 }
1014 if (status != 0) {
1015 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1016 ni, "open auth failed (reason %d)", status);
1017 vap->iv_stats.is_rx_auth_fail++;
1018 vap->iv_stats.is_rx_authfail_code = status;
1019 ieee80211_new_state(vap, IEEE80211_S_SCAN,
1020 IEEE80211_SCAN_FAIL_STATUS);
1021 } else
1022 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1023 }
1024
1025 static void
sta_auth_shared(struct ieee80211_node * ni,struct ieee80211_frame * wh,uint8_t * frm,uint8_t * efrm,int rssi,int nf,uint16_t seq,uint16_t status)1026 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
1027 uint8_t *frm, uint8_t *efrm, int rssi, int nf,
1028 uint16_t seq, uint16_t status)
1029 {
1030 struct ieee80211vap *vap = ni->ni_vap;
1031 uint8_t *challenge;
1032
1033 /*
1034 * NB: this can happen as we allow pre-shared key
1035 * authentication to be enabled w/o wep being turned
1036 * on so that configuration of these can be done
1037 * in any order. It may be better to enforce the
1038 * ordering in which case this check would just be
1039 * for sanity/consistency.
1040 */
1041 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
1042 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1043 ni->ni_macaddr, "shared key auth",
1044 "%s", " PRIVACY is disabled");
1045 goto bad;
1046 }
1047 /*
1048 * Pre-shared key authentication is evil; accept
1049 * it only if explicitly configured (it is supported
1050 * mainly for compatibility with clients like OS X).
1051 */
1052 if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1053 ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1054 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1055 ni->ni_macaddr, "shared key auth",
1056 "bad sta auth mode %u", ni->ni_authmode);
1057 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1058 goto bad;
1059 }
1060
1061 challenge = NULL;
1062 if (frm + 1 < efrm) {
1063 if ((frm[1] + 2) > (efrm - frm)) {
1064 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1065 ni->ni_macaddr, "shared key auth",
1066 "ie %d/%d too long",
1067 frm[0], (frm[1] + 2) - (efrm - frm));
1068 vap->iv_stats.is_rx_bad_auth++;
1069 goto bad;
1070 }
1071 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1072 challenge = frm;
1073 frm += frm[1] + 2;
1074 }
1075 switch (seq) {
1076 case IEEE80211_AUTH_SHARED_CHALLENGE:
1077 case IEEE80211_AUTH_SHARED_RESPONSE:
1078 if (challenge == NULL) {
1079 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1080 ni->ni_macaddr, "shared key auth",
1081 "%s", "no challenge");
1082 vap->iv_stats.is_rx_bad_auth++;
1083 goto bad;
1084 }
1085 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1086 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1087 ni->ni_macaddr, "shared key auth",
1088 "bad challenge len %d", challenge[1]);
1089 vap->iv_stats.is_rx_bad_auth++;
1090 goto bad;
1091 }
1092 default:
1093 break;
1094 }
1095 if (vap->iv_state != IEEE80211_S_AUTH)
1096 return;
1097 switch (seq) {
1098 case IEEE80211_AUTH_SHARED_PASS:
1099 if (ni->ni_challenge != NULL) {
1100 IEEE80211_FREE(ni->ni_challenge, M_80211_NODE);
1101 ni->ni_challenge = NULL;
1102 }
1103 if (status != 0) {
1104 IEEE80211_NOTE_FRAME(vap,
1105 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
1106 "shared key auth failed (reason %d)", status);
1107 vap->iv_stats.is_rx_auth_fail++;
1108 vap->iv_stats.is_rx_authfail_code = status;
1109 return;
1110 }
1111 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1112 break;
1113 case IEEE80211_AUTH_SHARED_CHALLENGE:
1114 if (!ieee80211_alloc_challenge(ni))
1115 return;
1116 /* XXX could optimize by passing recvd challenge */
1117 memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1118 IEEE80211_SEND_MGMT(ni,
1119 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1120 break;
1121 default:
1122 IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1123 wh, "shared key auth", "bad seq %d", seq);
1124 vap->iv_stats.is_rx_bad_auth++;
1125 return;
1126 }
1127 return;
1128 bad:
1129 /*
1130 * Kick the state machine. This short-circuits
1131 * using the mgt frame timeout to trigger the
1132 * state transition.
1133 */
1134 if (vap->iv_state == IEEE80211_S_AUTH)
1135 ieee80211_new_state(vap, IEEE80211_S_SCAN,
1136 IEEE80211_SCAN_FAIL_STATUS);
1137 }
1138
1139 /*
1140 * Parse the WME IE for QoS and U-APSD information.
1141 *
1142 * Returns -1 if the IE isn't found, 1 if it's found.
1143 */
1144 int
ieee80211_parse_wmeie(uint8_t * frm,const struct ieee80211_frame * wh,struct ieee80211_node * ni)1145 ieee80211_parse_wmeie(uint8_t *frm, const struct ieee80211_frame *wh,
1146 struct ieee80211_node *ni)
1147 {
1148 u_int len = frm[1];
1149
1150 ni->ni_uapsd = 0;
1151
1152 if (len < sizeof(struct ieee80211_wme_param)-2) {
1153 IEEE80211_DISCARD_IE(ni->ni_vap,
1154 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1155 wh, "WME", "too short, len %u", len);
1156 return -1;
1157 }
1158
1159 ni->ni_uapsd = frm[WME_CAPINFO_IE_OFFSET];
1160
1161 IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_POWER | IEEE80211_MSG_ASSOC,
1162 ni, "U-APSD settings from STA: 0x%02x", ni->ni_uapsd);
1163
1164 return 1;
1165 }
1166
1167 int
ieee80211_parse_wmeparams(struct ieee80211vap * vap,uint8_t * frm,const struct ieee80211_frame * wh,uint8_t * qosinfo)1168 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
1169 const struct ieee80211_frame *wh, uint8_t *qosinfo)
1170 {
1171 struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
1172 u_int len = frm[1], qosinfo_count;
1173 int i;
1174
1175 *qosinfo = 0;
1176
1177 if (len < sizeof(struct ieee80211_wme_param)-2) {
1178 IEEE80211_DISCARD_IE(vap,
1179 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1180 wh, "WME", "too short, len %u", len);
1181 return -1;
1182 }
1183 *qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1184 qosinfo_count = *qosinfo & WME_QOSINFO_COUNT;
1185
1186 /* XXX do proper check for wraparound */
1187 if (qosinfo_count == wme->wme_wmeChanParams.cap_info)
1188 return 0;
1189 frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1190 for (i = 0; i < WME_NUM_AC; i++) {
1191 struct wmeParams *wmep =
1192 &wme->wme_wmeChanParams.cap_wmeParams[i];
1193 /* NB: ACI not used */
1194 wmep->wmep_acm = _IEEE80211_MASKSHIFT(frm[0], WME_PARAM_ACM);
1195 wmep->wmep_aifsn =
1196 _IEEE80211_MASKSHIFT(frm[0], WME_PARAM_AIFSN);
1197 wmep->wmep_logcwmin =
1198 _IEEE80211_MASKSHIFT(frm[1], WME_PARAM_LOGCWMIN);
1199 wmep->wmep_logcwmax =
1200 _IEEE80211_MASKSHIFT(frm[1], WME_PARAM_LOGCWMAX);
1201 wmep->wmep_txopLimit = le16dec(frm+2);
1202 IEEE80211_DPRINTF(vap, IEEE80211_MSG_WME,
1203 "%s: WME: %d: acm=%d aifsn=%d logcwmin=%d logcwmax=%d txopLimit=%d\n",
1204 __func__,
1205 i,
1206 wmep->wmep_acm,
1207 wmep->wmep_aifsn,
1208 wmep->wmep_logcwmin,
1209 wmep->wmep_logcwmax,
1210 wmep->wmep_txopLimit);
1211 frm += 4;
1212 }
1213 wme->wme_wmeChanParams.cap_info = qosinfo_count;
1214 return 1;
1215 }
1216
1217 /*
1218 * Process 11h Channel Switch Announcement (CSA) ie. If this
1219 * is the first CSA then initiate the switch. Otherwise we
1220 * track state and trigger completion and/or cancel of the switch.
1221 * XXX should be public for IBSS use
1222 */
1223 static void
ieee80211_parse_csaparams(struct ieee80211vap * vap,uint8_t * frm,const struct ieee80211_frame * wh)1224 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
1225 const struct ieee80211_frame *wh)
1226 {
1227 struct ieee80211com *ic = vap->iv_ic;
1228 const struct ieee80211_csa_ie *csa =
1229 (const struct ieee80211_csa_ie *) frm;
1230
1231 KASSERT(vap->iv_state >= IEEE80211_S_RUN,
1232 ("state %s", ieee80211_state_name[vap->iv_state]));
1233
1234 if (csa->csa_mode > 1) {
1235 IEEE80211_DISCARD_IE(vap,
1236 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1237 wh, "CSA", "invalid mode %u", csa->csa_mode);
1238 return;
1239 }
1240 IEEE80211_LOCK(ic);
1241 if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
1242 /*
1243 * Convert the channel number to a channel reference. We
1244 * try first to preserve turbo attribute of the current
1245 * channel then fallback. Note this will not work if the
1246 * CSA specifies a channel that requires a band switch (e.g.
1247 * 11a => 11g). This is intentional as 11h is defined only
1248 * for 5GHz/11a and because the switch does not involve a
1249 * reassociation, protocol state (capabilities, negotated
1250 * rates, etc) may/will be wrong.
1251 */
1252 struct ieee80211_channel *c =
1253 ieee80211_find_channel_byieee(ic, csa->csa_newchan,
1254 (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
1255 if (c == NULL) {
1256 c = ieee80211_find_channel_byieee(ic,
1257 csa->csa_newchan,
1258 (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
1259 if (c == NULL) {
1260 IEEE80211_DISCARD_IE(vap,
1261 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1262 wh, "CSA", "invalid channel %u",
1263 csa->csa_newchan);
1264 goto done;
1265 }
1266 }
1267 #if IEEE80211_CSA_COUNT_MIN > 0
1268 if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
1269 /*
1270 * Require at least IEEE80211_CSA_COUNT_MIN count to
1271 * reduce the risk of being redirected by a fabricated
1272 * CSA. If a valid CSA is dropped we'll still get a
1273 * beacon miss when the AP leaves the channel so we'll
1274 * eventually follow to the new channel.
1275 *
1276 * NOTE: this violates the 11h spec that states that
1277 * count may be any value and if 0 then a switch
1278 * should happen asap.
1279 */
1280 IEEE80211_DISCARD_IE(vap,
1281 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1282 wh, "CSA", "count %u too small, must be >= %u",
1283 csa->csa_count, IEEE80211_CSA_COUNT_MIN);
1284 goto done;
1285 }
1286 #endif
1287 ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
1288 } else {
1289 /*
1290 * Validate this ie against the initial CSA. We require
1291 * mode and channel not change and the count must be
1292 * monotonically decreasing. This may be pointless and
1293 * canceling the switch as a result may be too paranoid but
1294 * in the worst case if we drop out of CSA because of this
1295 * and the AP does move then we'll just end up taking a
1296 * beacon miss and scan to find the AP.
1297 *
1298 * XXX may want <= on count as we also process ProbeResp
1299 * frames and those may come in w/ the same count as the
1300 * previous beacon; but doing so leaves us open to a stuck
1301 * count until we add a dead-man timer
1302 */
1303 if (!(csa->csa_count < ic->ic_csa_count &&
1304 csa->csa_mode == ic->ic_csa_mode &&
1305 csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
1306 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
1307 "CSA ie mismatch, initial ie <%d,%d,%d>, "
1308 "this ie <%d,%d,%d>", ic->ic_csa_mode,
1309 ic->ic_csa_newchan, ic->ic_csa_count,
1310 csa->csa_mode, csa->csa_newchan, csa->csa_count);
1311 ieee80211_csa_cancelswitch(ic);
1312 } else {
1313 if (csa->csa_count <= 1)
1314 ieee80211_csa_completeswitch(ic);
1315 else
1316 ic->ic_csa_count = csa->csa_count;
1317 }
1318 }
1319 done:
1320 IEEE80211_UNLOCK(ic);
1321 }
1322
1323 /*
1324 * Return non-zero if a background scan may be continued:
1325 * o bg scan is active
1326 * o no channel switch is pending
1327 * o there has not been any traffic recently
1328 * o no full-offload scan support (no need for explicitly continuing scan then)
1329 *
1330 * Note we do not check if there is an administrative enable;
1331 * this is only done to start the scan. We assume that any
1332 * change in state will be accompanied by a request to cancel
1333 * active scans which will otherwise cause this test to fail.
1334 */
1335 static __inline int
contbgscan(struct ieee80211vap * vap)1336 contbgscan(struct ieee80211vap *vap)
1337 {
1338 struct ieee80211com *ic = vap->iv_ic;
1339
1340 return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1341 (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1342 !(vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) &&
1343 vap->iv_state == IEEE80211_S_RUN && /* XXX? */
1344 ieee80211_time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1345 }
1346
1347 /*
1348 * Return non-zero if a backgrond scan may be started:
1349 * o bg scanning is administratively enabled
1350 * o no channel switch is pending
1351 * o we are not boosted on a dynamic turbo channel
1352 * o there has not been a scan recently
1353 * o there has not been any traffic recently (don't check if full-offload scan)
1354 */
1355 static __inline int
startbgscan(struct ieee80211vap * vap)1356 startbgscan(struct ieee80211vap *vap)
1357 {
1358 struct ieee80211com *ic = vap->iv_ic;
1359
1360 return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
1361 (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1362 #ifdef IEEE80211_SUPPORT_SUPERG
1363 !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1364 #endif
1365 ieee80211_time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
1366 ((vap->iv_flags_ext & IEEE80211_FEXT_SCAN_OFFLOAD) ||
1367 ieee80211_time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle)));
1368 }
1369
1370 #ifdef notyet
1371 /*
1372 * Compare two quiet IEs and return if they are equivalent.
1373 *
1374 * The tbttcount isn't checked - that's not part of the configuration.
1375 */
1376 static int
compare_quiet_ie(const struct ieee80211_quiet_ie * q1,const struct ieee80211_quiet_ie * q2)1377 compare_quiet_ie(const struct ieee80211_quiet_ie *q1,
1378 const struct ieee80211_quiet_ie *q2)
1379 {
1380
1381 if (q1->period != q2->period)
1382 return (0);
1383 if (le16dec(&q1->duration) != le16dec(&q2->duration))
1384 return (0);
1385 if (le16dec(&q1->offset) != le16dec(&q2->offset))
1386 return (0);
1387 return (1);
1388 }
1389 #endif
1390
1391 static void
sta_recv_mgmt(struct ieee80211_node * ni,struct mbuf * m0,int subtype,const struct ieee80211_rx_stats * rxs,int rssi,int nf)1392 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
1393 const struct ieee80211_rx_stats *rxs,
1394 int rssi, int nf)
1395 {
1396 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1397 struct ieee80211vap *vap = ni->ni_vap;
1398 struct ieee80211com *ic = ni->ni_ic;
1399 struct ieee80211_channel *rxchan = ic->ic_curchan;
1400 struct ieee80211_frame *wh;
1401 int ht_state_change = 0, do_ht = 0;
1402 uint8_t *frm, *efrm;
1403 uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
1404 uint8_t *vhtcap, *vhtopmode;
1405 uint8_t rate;
1406 uint8_t qosinfo;
1407
1408 wh = mtod(m0, struct ieee80211_frame *);
1409 frm = (uint8_t *)&wh[1];
1410 efrm = mtod(m0, uint8_t *) + m0->m_len;
1411 switch (subtype) {
1412 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1413 case IEEE80211_FC0_SUBTYPE_BEACON: {
1414 struct ieee80211_scanparams scan;
1415 struct ieee80211_channel *c;
1416 /*
1417 * We process beacon/probe response frames:
1418 * o when scanning, or
1419 * o station mode when associated (to collect state
1420 * updates such as 802.11g slot time)
1421 * Frames otherwise received are discarded.
1422 */
1423 if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
1424 vap->iv_stats.is_rx_mgtdiscard++;
1425 return;
1426 }
1427
1428 /* Override RX channel as appropriate */
1429 if (rxs != NULL) {
1430 c = ieee80211_lookup_channel_rxstatus(vap, rxs);
1431 if (c != NULL)
1432 rxchan = c;
1433 }
1434
1435 /* XXX probe response in sta mode when !scanning? */
1436 if (ieee80211_parse_beacon(ni, m0, rxchan, &scan) != 0) {
1437 if (! (ic->ic_flags & IEEE80211_F_SCAN))
1438 vap->iv_stats.is_beacon_bad++;
1439 return;
1440 }
1441
1442 /*
1443 * Count frame now that we know it's to be processed.
1444 */
1445 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1446 vap->iv_stats.is_rx_beacon++; /* XXX remove */
1447 IEEE80211_NODE_STAT(ni, rx_beacons);
1448 } else
1449 IEEE80211_NODE_STAT(ni, rx_proberesp);
1450 /*
1451 * When operating in station mode, check for state updates.
1452 * Be careful to ignore beacons received while doing a
1453 * background scan. We consider only 11g/WMM stuff right now.
1454 */
1455 if (ni->ni_associd != 0 &&
1456 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1457 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1458 /* record tsf of last beacon */
1459 memcpy(ni->ni_tstamp.data, scan.tstamp,
1460 sizeof(ni->ni_tstamp));
1461 /* count beacon frame for s/w bmiss handling */
1462 vap->iv_swbmiss_count++;
1463 vap->iv_bmiss_count = 0;
1464 if (ni->ni_erp != scan.erp) {
1465 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1466 wh->i_addr2,
1467 "erp change: was 0x%x, now 0x%x",
1468 ni->ni_erp, scan.erp);
1469 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1470 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1471 vap->iv_flags |= IEEE80211_F_USEPROT;
1472 else
1473 vap->iv_flags &= ~IEEE80211_F_USEPROT;
1474 ni->ni_erp = scan.erp;
1475 /* XXX statistic */
1476 /* driver notification */
1477 ieee80211_vap_update_erp_protmode(vap);
1478 }
1479 if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1480 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1481 wh->i_addr2,
1482 "capabilities change: was 0x%x, now 0x%x",
1483 ni->ni_capinfo, scan.capinfo);
1484 /*
1485 * NB: we assume short preamble doesn't
1486 * change dynamically
1487 */
1488 ieee80211_vap_set_shortslottime(vap,
1489 IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
1490 (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1491 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
1492 | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
1493 /* XXX statistic */
1494 }
1495 if (scan.wme != NULL &&
1496 (ni->ni_flags & IEEE80211_NODE_QOS)) {
1497 int _retval;
1498 if ((_retval = ieee80211_parse_wmeparams(vap,
1499 scan.wme, wh, &qosinfo)) >= 0) {
1500 if (qosinfo & WME_CAPINFO_UAPSD_EN)
1501 ni->ni_flags |=
1502 IEEE80211_NODE_UAPSD;
1503 if (_retval > 0)
1504 ieee80211_wme_updateparams(vap);
1505 }
1506 } else
1507 ni->ni_flags &= ~IEEE80211_NODE_UAPSD;
1508 #ifdef IEEE80211_SUPPORT_SUPERG
1509 if (scan.ath != NULL)
1510 ieee80211_parse_athparams(ni, scan.ath, wh);
1511 #endif
1512 if (scan.htcap != NULL && scan.htinfo != NULL &&
1513 (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1514 /* XXX state changes? */
1515 ieee80211_ht_updateparams(ni,
1516 scan.htcap, scan.htinfo);
1517 do_ht = 1;
1518 }
1519 if (scan.vhtcap != NULL && scan.vhtopmode != NULL &&
1520 (vap->iv_vht_flags & IEEE80211_FVHT_VHT)) {
1521 /* XXX state changes? */
1522 ieee80211_vht_updateparams(ni,
1523 scan.vhtcap, scan.vhtopmode);
1524 do_ht = 1;
1525 }
1526 if (do_ht) {
1527 if (ieee80211_ht_updateparams_final(ni,
1528 scan.htcap, scan.htinfo))
1529 ht_state_change = 1;
1530 }
1531
1532 /*
1533 * If we have a quiet time IE then report it up to
1534 * the driver.
1535 *
1536 * Otherwise, inform the driver that the quiet time
1537 * IE has disappeared - only do that once rather than
1538 * spamming it each time.
1539 */
1540 if (scan.quiet) {
1541 ic->ic_set_quiet(ni, scan.quiet);
1542 ni->ni_quiet_ie_set = 1;
1543 memcpy(&ni->ni_quiet_ie, scan.quiet,
1544 sizeof(struct ieee80211_quiet_ie));
1545 } else {
1546 if (ni->ni_quiet_ie_set == 1)
1547 ic->ic_set_quiet(ni, NULL);
1548 ni->ni_quiet_ie_set = 0;
1549 bzero(&ni->ni_quiet_ie,
1550 sizeof(struct ieee80211_quiet_ie));
1551 }
1552
1553 if (scan.tim != NULL) {
1554 struct ieee80211_tim_ie *tim =
1555 (struct ieee80211_tim_ie *) scan.tim;
1556 /*
1557 * XXX Check/debug this code; see if it's about
1558 * the right time to force the VAP awake if we
1559 * receive a frame destined for us?
1560 */
1561 int aid = IEEE80211_AID(ni->ni_associd);
1562 int ix = aid / NBBY;
1563 int min = tim->tim_bitctl &~ 1;
1564 int max = tim->tim_len + min - 4;
1565 int tim_ucast = 0;
1566 #ifdef __notyet__
1567 int tim_mcast = 0;
1568 #endif
1569
1570 /*
1571 * Only do this for unicast traffic in the TIM
1572 * The multicast traffic notification for
1573 * the scan notification stuff should occur
1574 * differently.
1575 */
1576 if (min <= ix && ix <= max &&
1577 isset(tim->tim_bitmap - min, aid)) {
1578 tim_ucast = 1;
1579 }
1580
1581 #ifdef __notyet__
1582 /*
1583 * Do a separate notification
1584 * for the multicast bit being set.
1585 */
1586 if (tim->tim_bitctl & 1) {
1587 tim_mcast = 1;
1588 }
1589 #endif
1590
1591 /*
1592 * If the TIM indicates there's traffic for
1593 * us then get us out of STA mode powersave.
1594 */
1595 if (tim_ucast == 1) {
1596 /*
1597 * Wake us out of SLEEP state if we're
1598 * in it; and if we're doing bgscan
1599 * then wake us out of STA powersave.
1600 */
1601 ieee80211_sta_tim_notify(vap, 1);
1602
1603 /*
1604 * This is preventing us from
1605 * continuing a bgscan; because it
1606 * tricks the contbgscan()
1607 * routine to think there's always
1608 * traffic for us.
1609 *
1610 * I think we need both an RX and
1611 * TX ic_lastdata field.
1612 */
1613 ic->ic_lastdata = ticks;
1614 }
1615
1616 ni->ni_dtim_count = tim->tim_count;
1617 ni->ni_dtim_period = tim->tim_period;
1618 }
1619 if (scan.csa != NULL &&
1620 (vap->iv_flags & IEEE80211_F_DOTH))
1621 ieee80211_parse_csaparams(vap, scan.csa, wh);
1622 else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
1623 /*
1624 * No CSA ie or 11h disabled, but a channel
1625 * switch is pending; drop out so we aren't
1626 * stuck in CSA state. If the AP really is
1627 * moving we'll get a beacon miss and scan.
1628 */
1629 IEEE80211_LOCK(ic);
1630 ieee80211_csa_cancelswitch(ic);
1631 IEEE80211_UNLOCK(ic);
1632 }
1633 /*
1634 * If scanning, pass the info to the scan module.
1635 * Otherwise, check if it's the right time to do
1636 * a background scan. Background scanning must
1637 * be enabled and we must not be operating in the
1638 * turbo phase of dynamic turbo mode. Then,
1639 * it's been a while since the last background
1640 * scan and if no data frames have come through
1641 * recently, kick off a scan. Note that this
1642 * is the mechanism by which a background scan
1643 * is started _and_ continued each time we
1644 * return on-channel to receive a beacon from
1645 * our ap.
1646 */
1647 if (ic->ic_flags & IEEE80211_F_SCAN) {
1648 ieee80211_add_scan(vap, rxchan,
1649 &scan, wh, subtype, rssi, nf);
1650 } else if (contbgscan(vap)) {
1651 ieee80211_bg_scan(vap, 0);
1652 } else if (startbgscan(vap)) {
1653 vap->iv_stats.is_scan_bg++;
1654 #if 0
1655 /* wakeup if we are sleeing */
1656 ieee80211_set_pwrsave(vap, 0);
1657 #endif
1658 ieee80211_bg_scan(vap, 0);
1659 }
1660
1661 /*
1662 * Put the station to sleep if we haven't seen
1663 * traffic in a while.
1664 */
1665 IEEE80211_LOCK(ic);
1666 ieee80211_sta_ps_timer_check(vap);
1667 IEEE80211_UNLOCK(ic);
1668
1669 /*
1670 * If we've had a channel width change (eg HT20<->HT40)
1671 * then schedule a delayed driver notification.
1672 */
1673 if (ht_state_change)
1674 ieee80211_update_chw(ic);
1675 return;
1676 }
1677 /*
1678 * If scanning, just pass information to the scan module.
1679 */
1680 if (ic->ic_flags & IEEE80211_F_SCAN) {
1681 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1682 /*
1683 * Actively scanning a channel marked passive;
1684 * send a probe request now that we know there
1685 * is 802.11 traffic present.
1686 *
1687 * XXX check if the beacon we recv'd gives
1688 * us what we need and suppress the probe req
1689 */
1690 ieee80211_probe_curchan(vap, true);
1691 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1692 }
1693 ieee80211_add_scan(vap, rxchan, &scan, wh,
1694 subtype, rssi, nf);
1695 return;
1696 }
1697 break;
1698 }
1699
1700 case IEEE80211_FC0_SUBTYPE_AUTH: {
1701 uint16_t algo, seq, status;
1702 /*
1703 * auth frame format
1704 * [2] algorithm
1705 * [2] sequence
1706 * [2] status
1707 * [tlv*] challenge
1708 */
1709 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1710 algo = le16toh(*(uint16_t *)frm);
1711 seq = le16toh(*(uint16_t *)(frm + 2));
1712 status = le16toh(*(uint16_t *)(frm + 4));
1713 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1714 "recv auth frame with algorithm %d seq %d", algo, seq);
1715
1716 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1717 IEEE80211_DISCARD(vap,
1718 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1719 wh, "auth", "%s", "TKIP countermeasures enabled");
1720 vap->iv_stats.is_rx_auth_countermeasures++;
1721 if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1722 ieee80211_send_error(ni, wh->i_addr2,
1723 IEEE80211_FC0_SUBTYPE_AUTH,
1724 IEEE80211_REASON_MIC_FAILURE);
1725 }
1726 return;
1727 }
1728 if (algo == IEEE80211_AUTH_ALG_SHARED)
1729 sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1730 seq, status);
1731 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1732 sta_auth_open(ni, wh, rssi, nf, seq, status);
1733 else {
1734 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1735 wh, "auth", "unsupported alg %d", algo);
1736 vap->iv_stats.is_rx_auth_unsupported++;
1737 return;
1738 }
1739 break;
1740 }
1741
1742 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1743 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
1744 uint16_t capinfo, associd;
1745 uint16_t status;
1746
1747 if (vap->iv_state != IEEE80211_S_ASSOC) {
1748 vap->iv_stats.is_rx_mgtdiscard++;
1749 return;
1750 }
1751
1752 /*
1753 * asresp frame format
1754 * [2] capability information
1755 * [2] status
1756 * [2] association ID
1757 * [tlv] supported rates
1758 * [tlv] extended supported rates
1759 * [tlv] WME
1760 * [tlv] HT capabilities
1761 * [tlv] HT info
1762 */
1763 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1764 ni = vap->iv_bss;
1765 capinfo = le16toh(*(uint16_t *)frm);
1766 frm += 2;
1767 status = le16toh(*(uint16_t *)frm);
1768 frm += 2;
1769 if (status != 0) {
1770 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1771 wh->i_addr2, "%sassoc failed (reason %d)",
1772 ISREASSOC(subtype) ? "re" : "", status);
1773 vap->iv_stats.is_rx_auth_fail++; /* XXX */
1774 return;
1775 }
1776 associd = le16toh(*(uint16_t *)frm);
1777 frm += 2;
1778
1779 rates = xrates = wme = htcap = htinfo = NULL;
1780 vhtcap = vhtopmode = NULL;
1781 while (efrm - frm > 1) {
1782 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1783 switch (*frm) {
1784 case IEEE80211_ELEMID_RATES:
1785 rates = frm;
1786 break;
1787 case IEEE80211_ELEMID_XRATES:
1788 xrates = frm;
1789 break;
1790 case IEEE80211_ELEMID_HTCAP:
1791 htcap = frm;
1792 break;
1793 case IEEE80211_ELEMID_HTINFO:
1794 htinfo = frm;
1795 break;
1796 case IEEE80211_ELEMID_VENDOR:
1797 if (iswmeoui(frm))
1798 wme = frm;
1799 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
1800 /*
1801 * Accept pre-draft HT ie's if the
1802 * standard ones have not been seen.
1803 */
1804 if (ishtcapoui(frm)) {
1805 if (htcap == NULL)
1806 htcap = frm;
1807 } else if (ishtinfooui(frm)) {
1808 if (htinfo == NULL)
1809 htinfo = frm;
1810 }
1811 }
1812 /* XXX Atheros OUI support */
1813 break;
1814 case IEEE80211_ELEMID_VHT_CAP:
1815 vhtcap = frm;
1816 break;
1817 case IEEE80211_ELEMID_VHT_OPMODE:
1818 vhtopmode = frm;
1819 break;
1820 }
1821 frm += frm[1] + 2;
1822 }
1823
1824 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1825 if (xrates != NULL)
1826 IEEE80211_VERIFY_ELEMENT(xrates,
1827 IEEE80211_RATE_MAXSIZE - rates[1], return);
1828 rate = ieee80211_setup_rates(ni, rates, xrates,
1829 IEEE80211_F_JOIN |
1830 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1831 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1832 if (rate & IEEE80211_RATE_BASIC) {
1833 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1834 wh->i_addr2,
1835 "%sassoc failed (rate set mismatch)",
1836 ISREASSOC(subtype) ? "re" : "");
1837 vap->iv_stats.is_rx_assoc_norate++;
1838 ieee80211_new_state(vap, IEEE80211_S_SCAN,
1839 IEEE80211_SCAN_FAIL_STATUS);
1840 return;
1841 }
1842
1843 ni->ni_capinfo = capinfo;
1844 ni->ni_associd = associd;
1845 if (ni->ni_jointime == 0)
1846 ni->ni_jointime = time_uptime;
1847 if (wme != NULL &&
1848 ieee80211_parse_wmeparams(vap, wme, wh, &qosinfo) >= 0) {
1849 ni->ni_flags |= IEEE80211_NODE_QOS;
1850 ieee80211_wme_updateparams(vap);
1851 } else
1852 ni->ni_flags &= ~IEEE80211_NODE_QOS;
1853 /*
1854 * Setup HT state according to the negotiation.
1855 *
1856 * NB: shouldn't need to check if HT use is enabled but some
1857 * ap's send back HT ie's even when we don't indicate we
1858 * are HT capable in our AssocReq.
1859 */
1860 if (htcap != NULL && htinfo != NULL &&
1861 (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1862 ieee80211_ht_node_init(ni);
1863 ieee80211_ht_updateparams(ni, htcap, htinfo);
1864
1865 if ((vhtcap != NULL) && (vhtopmode != NULL) &
1866 (vap->iv_vht_flags & IEEE80211_FVHT_VHT)) {
1867 /*
1868 * Log if we get a VHT assoc/reassoc response.
1869 * We aren't ready for 2GHz VHT support.
1870 */
1871 if (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) {
1872 net80211_vap_printf(vap,
1873 "%s: peer %6D: VHT on 2GHz, ignoring\n",
1874 __func__, ni->ni_macaddr, ":");
1875 } else {
1876 ieee80211_vht_node_init(ni);
1877 ieee80211_vht_updateparams(ni, vhtcap, vhtopmode);
1878 ieee80211_setup_vht_rates(ni);
1879 }
1880 }
1881
1882 ieee80211_ht_updateparams_final(ni, htcap, htinfo);
1883 ieee80211_setup_htrates(ni, htcap,
1884 IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
1885 ieee80211_setup_basic_htrates(ni, htinfo);
1886
1887 ieee80211_node_setuptxparms(ni);
1888 ieee80211_ratectl_node_init(ni);
1889 }
1890
1891 /*
1892 * Always initialise FF/superg state; we can use this
1893 * for doing A-MSDU encapsulation as well.
1894 */
1895 #ifdef IEEE80211_SUPPORT_SUPERG
1896 ieee80211_ff_node_init(ni);
1897 #endif
1898
1899 /*
1900 * Configure state now that we are associated.
1901 *
1902 * XXX may need different/additional driver callbacks?
1903 */
1904 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1905 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1906 vap->iv_flags |= IEEE80211_F_SHPREAMBLE;
1907 vap->iv_flags &= ~IEEE80211_F_USEBARKER;
1908 } else {
1909 vap->iv_flags &= ~IEEE80211_F_SHPREAMBLE;
1910 vap->iv_flags |= IEEE80211_F_USEBARKER;
1911 }
1912 ieee80211_vap_set_shortslottime(vap,
1913 IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1914 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1915 ieee80211_vap_update_preamble(vap);
1916 /*
1917 * Honor ERP protection.
1918 *
1919 * NB: ni_erp should zero for non-11g operation.
1920 */
1921 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1922 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1923 vap->iv_flags |= IEEE80211_F_USEPROT;
1924 else
1925 vap->iv_flags &= ~IEEE80211_F_USEPROT;
1926 ieee80211_vap_update_erp_protmode(vap);
1927 IEEE80211_NOTE_MAC(vap,
1928 IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
1929 "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s%s",
1930 ISREASSOC(subtype) ? "re" : "",
1931 IEEE80211_NODE_AID(ni),
1932 vap->iv_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1933 vap->iv_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1934 vap->iv_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1935 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
1936 ni->ni_flags & IEEE80211_NODE_HT ?
1937 (ni->ni_chw == IEEE80211_STA_RX_BW_40 ? ", HT40" : ", HT20") : "",
1938 ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
1939 ni->ni_flags & IEEE80211_NODE_AMSDU ? " (+AMSDU)" : "",
1940 ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
1941 ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
1942 ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
1943 IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
1944 ", fast-frames" : "",
1945 IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
1946 ", turbo" : ""
1947 );
1948 ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
1949 break;
1950 }
1951
1952 case IEEE80211_FC0_SUBTYPE_DEAUTH: {
1953 uint16_t reason;
1954
1955 if (vap->iv_state == IEEE80211_S_SCAN) {
1956 vap->iv_stats.is_rx_mgtdiscard++;
1957 return;
1958 }
1959 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1960 /* NB: can happen when in promiscuous mode */
1961 vap->iv_stats.is_rx_mgtdiscard++;
1962 break;
1963 }
1964
1965 /*
1966 * deauth frame format
1967 * [2] reason
1968 */
1969 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1970 reason = le16toh(*(uint16_t *)frm);
1971
1972 vap->iv_stats.is_rx_deauth++;
1973 vap->iv_stats.is_rx_deauth_code = reason;
1974 IEEE80211_NODE_STAT(ni, rx_deauth);
1975
1976 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1977 "recv deauthenticate (reason: %d (%s))", reason,
1978 ieee80211_reason_to_string(reason));
1979 ieee80211_new_state(vap, IEEE80211_S_AUTH,
1980 (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
1981 break;
1982 }
1983
1984 case IEEE80211_FC0_SUBTYPE_DISASSOC: {
1985 uint16_t reason;
1986
1987 if (vap->iv_state != IEEE80211_S_RUN &&
1988 vap->iv_state != IEEE80211_S_ASSOC &&
1989 vap->iv_state != IEEE80211_S_AUTH) {
1990 vap->iv_stats.is_rx_mgtdiscard++;
1991 return;
1992 }
1993 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1994 /* NB: can happen when in promiscuous mode */
1995 vap->iv_stats.is_rx_mgtdiscard++;
1996 break;
1997 }
1998
1999 /*
2000 * disassoc frame format
2001 * [2] reason
2002 */
2003 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2004 reason = le16toh(*(uint16_t *)frm);
2005
2006 vap->iv_stats.is_rx_disassoc++;
2007 vap->iv_stats.is_rx_disassoc_code = reason;
2008 IEEE80211_NODE_STAT(ni, rx_disassoc);
2009
2010 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
2011 "recv disassociate (reason: %d (%s))", reason,
2012 ieee80211_reason_to_string(reason));
2013 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
2014 break;
2015 }
2016
2017 case IEEE80211_FC0_SUBTYPE_ACTION:
2018 case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2019 if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2020 !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2021 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2022 wh, NULL, "%s", "not for us");
2023 vap->iv_stats.is_rx_mgtdiscard++;
2024 } else if (vap->iv_state != IEEE80211_S_RUN) {
2025 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2026 wh, NULL, "wrong state %s",
2027 ieee80211_state_name[vap->iv_state]);
2028 vap->iv_stats.is_rx_mgtdiscard++;
2029 } else {
2030 if (ieee80211_parse_action(ni, m0) == 0)
2031 (void)ic->ic_recv_action(ni, wh, frm, efrm);
2032 }
2033 break;
2034
2035 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2036 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
2037 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2038 case IEEE80211_FC0_SUBTYPE_TIMING_ADV:
2039 case IEEE80211_FC0_SUBTYPE_ATIM:
2040 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2041 wh, NULL, "%s", "not handled");
2042 vap->iv_stats.is_rx_mgtdiscard++;
2043 break;
2044
2045 default:
2046 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2047 wh, "mgt", "subtype 0x%x not handled", subtype);
2048 vap->iv_stats.is_rx_badsubtype++;
2049 break;
2050 }
2051 #undef ISREASSOC
2052 }
2053
2054 static void
sta_recv_ctl(struct ieee80211_node * ni,struct mbuf * m,int subtype)2055 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2056 {
2057
2058 switch (subtype) {
2059 case IEEE80211_FC0_SUBTYPE_BAR:
2060 ieee80211_recv_bar(ni, m);
2061 break;
2062 }
2063 }
2064