1b032f27cSSam Leffler /*- 2b032f27cSSam Leffler * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting 3b032f27cSSam Leffler * All rights reserved. 4b032f27cSSam Leffler * 5b032f27cSSam Leffler * Redistribution and use in source and binary forms, with or without 6b032f27cSSam Leffler * modification, are permitted provided that the following conditions 7b032f27cSSam Leffler * are met: 8b032f27cSSam Leffler * 1. Redistributions of source code must retain the above copyright 9b032f27cSSam Leffler * notice, this list of conditions and the following disclaimer. 10b032f27cSSam Leffler * 2. Redistributions in binary form must reproduce the above copyright 11b032f27cSSam Leffler * notice, this list of conditions and the following disclaimer in the 12b032f27cSSam Leffler * documentation and/or other materials provided with the distribution. 13b032f27cSSam Leffler * 14b032f27cSSam Leffler * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15b032f27cSSam Leffler * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16b032f27cSSam Leffler * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17b032f27cSSam Leffler * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18b032f27cSSam Leffler * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19b032f27cSSam Leffler * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20b032f27cSSam Leffler * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21b032f27cSSam Leffler * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22b032f27cSSam Leffler * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23b032f27cSSam Leffler * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24b032f27cSSam Leffler */ 25b032f27cSSam Leffler 26b032f27cSSam Leffler #include <sys/cdefs.h> 27b032f27cSSam Leffler #ifdef __FreeBSD__ 28b032f27cSSam Leffler __FBSDID("$FreeBSD$"); 29b032f27cSSam Leffler #endif 30b032f27cSSam Leffler 31b032f27cSSam Leffler /* 32b032f27cSSam Leffler * IEEE 802.11 HOSTAP mode support. 33b032f27cSSam Leffler */ 34b032f27cSSam Leffler #include "opt_inet.h" 35b032f27cSSam Leffler #include "opt_wlan.h" 36b032f27cSSam Leffler 37b032f27cSSam Leffler #include <sys/param.h> 38b032f27cSSam Leffler #include <sys/systm.h> 39b032f27cSSam Leffler #include <sys/mbuf.h> 40b032f27cSSam Leffler #include <sys/malloc.h> 41b032f27cSSam Leffler #include <sys/kernel.h> 42b032f27cSSam Leffler 43b032f27cSSam Leffler #include <sys/socket.h> 44b032f27cSSam Leffler #include <sys/sockio.h> 45b032f27cSSam Leffler #include <sys/endian.h> 46b032f27cSSam Leffler #include <sys/errno.h> 47b032f27cSSam Leffler #include <sys/proc.h> 48b032f27cSSam Leffler #include <sys/sysctl.h> 49b032f27cSSam Leffler 50b032f27cSSam Leffler #include <net/if.h> 5176039bc8SGleb Smirnoff #include <net/if_var.h> 52b032f27cSSam Leffler #include <net/if_media.h> 53b032f27cSSam Leffler #include <net/if_llc.h> 54b032f27cSSam Leffler #include <net/ethernet.h> 55b032f27cSSam Leffler 56b032f27cSSam Leffler #include <net/bpf.h> 57b032f27cSSam Leffler 58b032f27cSSam Leffler #include <net80211/ieee80211_var.h> 59b032f27cSSam Leffler #include <net80211/ieee80211_hostap.h> 60b032f27cSSam Leffler #include <net80211/ieee80211_input.h> 61616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG 62616190d0SSam Leffler #include <net80211/ieee80211_superg.h> 63616190d0SSam Leffler #endif 64b032f27cSSam Leffler #include <net80211/ieee80211_wds.h> 65b032f27cSSam Leffler 66b032f27cSSam Leffler #define IEEE80211_RATE2MBS(r) (((r) & IEEE80211_RATE_VAL) / 2) 67b032f27cSSam Leffler 68b032f27cSSam Leffler static void hostap_vattach(struct ieee80211vap *); 69b032f27cSSam Leffler static int hostap_newstate(struct ieee80211vap *, enum ieee80211_state, int); 70b032f27cSSam Leffler static int hostap_input(struct ieee80211_node *ni, struct mbuf *m, 71c79f192cSAdrian Chadd const struct ieee80211_rx_stats *, 725463c4a4SSam Leffler int rssi, int nf); 73b032f27cSSam Leffler static void hostap_deliver_data(struct ieee80211vap *, 74b032f27cSSam Leffler struct ieee80211_node *, struct mbuf *); 75b032f27cSSam Leffler static void hostap_recv_mgmt(struct ieee80211_node *, struct mbuf *, 76c79f192cSAdrian Chadd int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf); 7749eae5f7SSam Leffler static void hostap_recv_ctl(struct ieee80211_node *, struct mbuf *, int); 78b032f27cSSam Leffler 79b032f27cSSam Leffler void 80b032f27cSSam Leffler ieee80211_hostap_attach(struct ieee80211com *ic) 81b032f27cSSam Leffler { 82b032f27cSSam Leffler ic->ic_vattach[IEEE80211_M_HOSTAP] = hostap_vattach; 83b032f27cSSam Leffler } 84b032f27cSSam Leffler 85b032f27cSSam Leffler void 86b032f27cSSam Leffler ieee80211_hostap_detach(struct ieee80211com *ic) 87b032f27cSSam Leffler { 88b032f27cSSam Leffler } 89b032f27cSSam Leffler 90b032f27cSSam Leffler static void 91b032f27cSSam Leffler hostap_vdetach(struct ieee80211vap *vap) 92b032f27cSSam Leffler { 93b032f27cSSam Leffler } 94b032f27cSSam Leffler 95b032f27cSSam Leffler static void 96b032f27cSSam Leffler hostap_vattach(struct ieee80211vap *vap) 97b032f27cSSam Leffler { 98b032f27cSSam Leffler vap->iv_newstate = hostap_newstate; 99b032f27cSSam Leffler vap->iv_input = hostap_input; 100b032f27cSSam Leffler vap->iv_recv_mgmt = hostap_recv_mgmt; 10149eae5f7SSam Leffler vap->iv_recv_ctl = hostap_recv_ctl; 102b032f27cSSam Leffler vap->iv_opdetach = hostap_vdetach; 103b032f27cSSam Leffler vap->iv_deliver_data = hostap_deliver_data; 104e7f0d7cfSAdrian Chadd vap->iv_recv_pspoll = ieee80211_recv_pspoll; 105b032f27cSSam Leffler } 106b032f27cSSam Leffler 107b032f27cSSam Leffler static void 108b032f27cSSam Leffler sta_disassoc(void *arg, struct ieee80211_node *ni) 109b032f27cSSam Leffler { 110b032f27cSSam Leffler struct ieee80211vap *vap = arg; 111b032f27cSSam Leffler 112b032f27cSSam Leffler if (ni->ni_vap == vap && ni->ni_associd != 0) { 113b032f27cSSam Leffler IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DISASSOC, 114b032f27cSSam Leffler IEEE80211_REASON_ASSOC_LEAVE); 115b032f27cSSam Leffler ieee80211_node_leave(ni); 116b032f27cSSam Leffler } 117b032f27cSSam Leffler } 118b032f27cSSam Leffler 1194e150988SSam Leffler static void 1204e150988SSam Leffler sta_csa(void *arg, struct ieee80211_node *ni) 1214e150988SSam Leffler { 1224e150988SSam Leffler struct ieee80211vap *vap = arg; 1234e150988SSam Leffler 1244e150988SSam Leffler if (ni->ni_vap == vap && ni->ni_associd != 0) 1254e150988SSam Leffler if (ni->ni_inact > vap->iv_inact_init) { 1264e150988SSam Leffler ni->ni_inact = vap->iv_inact_init; 1274e150988SSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni, 1284e150988SSam Leffler "%s: inact %u", __func__, ni->ni_inact); 1294e150988SSam Leffler } 1304e150988SSam Leffler } 1314e150988SSam Leffler 1327131987dSSam Leffler static void 1337131987dSSam Leffler sta_drop(void *arg, struct ieee80211_node *ni) 1347131987dSSam Leffler { 1357131987dSSam Leffler struct ieee80211vap *vap = arg; 1367131987dSSam Leffler 1377131987dSSam Leffler if (ni->ni_vap == vap && ni->ni_associd != 0) 1387131987dSSam Leffler ieee80211_node_leave(ni); 1397131987dSSam Leffler } 1407131987dSSam Leffler 1417131987dSSam Leffler /* 1427131987dSSam Leffler * Does a channel change require associated stations to re-associate 1437131987dSSam Leffler * so protocol state is correct. This is used when doing CSA across 1447131987dSSam Leffler * bands or similar (e.g. HT -> legacy). 1457131987dSSam Leffler */ 1467131987dSSam Leffler static int 1477131987dSSam Leffler isbandchange(struct ieee80211com *ic) 1487131987dSSam Leffler { 1497131987dSSam Leffler return ((ic->ic_bsschan->ic_flags ^ ic->ic_csa_newchan->ic_flags) & 1507131987dSSam Leffler (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_HALF | 1517131987dSSam Leffler IEEE80211_CHAN_QUARTER | IEEE80211_CHAN_HT)) != 0; 1527131987dSSam Leffler } 1537131987dSSam Leffler 154b032f27cSSam Leffler /* 155b032f27cSSam Leffler * IEEE80211_M_HOSTAP vap state machine handler. 156b032f27cSSam Leffler */ 157b032f27cSSam Leffler static int 158b032f27cSSam Leffler hostap_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg) 159b032f27cSSam Leffler { 160b032f27cSSam Leffler struct ieee80211com *ic = vap->iv_ic; 161b032f27cSSam Leffler enum ieee80211_state ostate; 162b032f27cSSam Leffler 163b032f27cSSam Leffler IEEE80211_LOCK_ASSERT(ic); 164b032f27cSSam Leffler 165b032f27cSSam Leffler ostate = vap->iv_state; 166b032f27cSSam Leffler IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n", 167b032f27cSSam Leffler __func__, ieee80211_state_name[ostate], 168b032f27cSSam Leffler ieee80211_state_name[nstate], arg); 169b032f27cSSam Leffler vap->iv_state = nstate; /* state transition */ 170b032f27cSSam Leffler if (ostate != IEEE80211_S_SCAN) 171b032f27cSSam Leffler ieee80211_cancel_scan(vap); /* background scan */ 172b032f27cSSam Leffler switch (nstate) { 173b032f27cSSam Leffler case IEEE80211_S_INIT: 174b032f27cSSam Leffler switch (ostate) { 175b032f27cSSam Leffler case IEEE80211_S_SCAN: 176b032f27cSSam Leffler ieee80211_cancel_scan(vap); 177b032f27cSSam Leffler break; 178b032f27cSSam Leffler case IEEE80211_S_CAC: 179b032f27cSSam Leffler ieee80211_dfs_cac_stop(vap); 180b032f27cSSam Leffler break; 181b032f27cSSam Leffler case IEEE80211_S_RUN: 182b032f27cSSam Leffler ieee80211_iterate_nodes(&ic->ic_sta, sta_disassoc, vap); 183b032f27cSSam Leffler break; 184b032f27cSSam Leffler default: 185b032f27cSSam Leffler break; 186b032f27cSSam Leffler } 187b032f27cSSam Leffler if (ostate != IEEE80211_S_INIT) { 188b032f27cSSam Leffler /* NB: optimize INIT -> INIT case */ 189b032f27cSSam Leffler ieee80211_reset_bss(vap); 190b032f27cSSam Leffler } 191b032f27cSSam Leffler if (vap->iv_auth->ia_detach != NULL) 192b032f27cSSam Leffler vap->iv_auth->ia_detach(vap); 193b032f27cSSam Leffler break; 194b032f27cSSam Leffler case IEEE80211_S_SCAN: 195b032f27cSSam Leffler switch (ostate) { 196b032f27cSSam Leffler case IEEE80211_S_CSA: 197b032f27cSSam Leffler case IEEE80211_S_RUN: 198b032f27cSSam Leffler ieee80211_iterate_nodes(&ic->ic_sta, sta_disassoc, vap); 199b032f27cSSam Leffler /* 200b032f27cSSam Leffler * Clear overlapping BSS state; the beacon frame 201b032f27cSSam Leffler * will be reconstructed on transition to the RUN 202b032f27cSSam Leffler * state and the timeout routines check if the flag 203b032f27cSSam Leffler * is set before doing anything so this is sufficient. 204b032f27cSSam Leffler */ 205b032f27cSSam Leffler ic->ic_flags_ext &= ~IEEE80211_FEXT_NONERP_PR; 2062bfc8a91SSam Leffler ic->ic_flags_ht &= ~IEEE80211_FHT_NONHT_PR; 207b032f27cSSam Leffler /* fall thru... */ 208b032f27cSSam Leffler case IEEE80211_S_CAC: 209b032f27cSSam Leffler /* 210b032f27cSSam Leffler * NB: We may get here because of a manual channel 211b032f27cSSam Leffler * change in which case we need to stop CAC 212b032f27cSSam Leffler * XXX no need to stop if ostate RUN but it's ok 213b032f27cSSam Leffler */ 214b032f27cSSam Leffler ieee80211_dfs_cac_stop(vap); 215b032f27cSSam Leffler /* fall thru... */ 216b032f27cSSam Leffler case IEEE80211_S_INIT: 217b032f27cSSam Leffler if (vap->iv_des_chan != IEEE80211_CHAN_ANYC && 218b032f27cSSam Leffler !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) { 219b032f27cSSam Leffler /* 220b032f27cSSam Leffler * Already have a channel; bypass the 221b032f27cSSam Leffler * scan and startup immediately. 222b032f27cSSam Leffler * ieee80211_create_ibss will call back to 223b032f27cSSam Leffler * move us to RUN state. 224b032f27cSSam Leffler */ 225b032f27cSSam Leffler ieee80211_create_ibss(vap, vap->iv_des_chan); 226b032f27cSSam Leffler break; 227b032f27cSSam Leffler } 228b032f27cSSam Leffler /* 229b032f27cSSam Leffler * Initiate a scan. We can come here as a result 230b032f27cSSam Leffler * of an IEEE80211_IOC_SCAN_REQ too in which case 231b032f27cSSam Leffler * the vap will be marked with IEEE80211_FEXT_SCANREQ 232b032f27cSSam Leffler * and the scan request parameters will be present 233b032f27cSSam Leffler * in iv_scanreq. Otherwise we do the default. 234b032f27cSSam Leffler */ 235b032f27cSSam Leffler if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) { 236b032f27cSSam Leffler ieee80211_check_scan(vap, 237b032f27cSSam Leffler vap->iv_scanreq_flags, 238b032f27cSSam Leffler vap->iv_scanreq_duration, 239b032f27cSSam Leffler vap->iv_scanreq_mindwell, 240b032f27cSSam Leffler vap->iv_scanreq_maxdwell, 241b032f27cSSam Leffler vap->iv_scanreq_nssid, vap->iv_scanreq_ssid); 242b032f27cSSam Leffler vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ; 243b032f27cSSam Leffler } else 244b032f27cSSam Leffler ieee80211_check_scan_current(vap); 245b032f27cSSam Leffler break; 246b032f27cSSam Leffler case IEEE80211_S_SCAN: 247b032f27cSSam Leffler /* 248b032f27cSSam Leffler * A state change requires a reset; scan. 249b032f27cSSam Leffler */ 250b032f27cSSam Leffler ieee80211_check_scan_current(vap); 251b032f27cSSam Leffler break; 252b032f27cSSam Leffler default: 253b032f27cSSam Leffler break; 254b032f27cSSam Leffler } 255b032f27cSSam Leffler break; 256b032f27cSSam Leffler case IEEE80211_S_CAC: 257b032f27cSSam Leffler /* 258b032f27cSSam Leffler * Start CAC on a DFS channel. We come here when starting 259b032f27cSSam Leffler * a bss on a DFS channel (see ieee80211_create_ibss). 260b032f27cSSam Leffler */ 261b032f27cSSam Leffler ieee80211_dfs_cac_start(vap); 262b032f27cSSam Leffler break; 263b032f27cSSam Leffler case IEEE80211_S_RUN: 264b032f27cSSam Leffler if (vap->iv_flags & IEEE80211_F_WPA) { 265b032f27cSSam Leffler /* XXX validate prerequisites */ 266b032f27cSSam Leffler } 267b032f27cSSam Leffler switch (ostate) { 268b032f27cSSam Leffler case IEEE80211_S_INIT: 269b032f27cSSam Leffler /* 270b032f27cSSam Leffler * Already have a channel; bypass the 271b032f27cSSam Leffler * scan and startup immediately. 272b032f27cSSam Leffler * Note that ieee80211_create_ibss will call 273b032f27cSSam Leffler * back to do a RUN->RUN state change. 274b032f27cSSam Leffler */ 275b032f27cSSam Leffler ieee80211_create_ibss(vap, 276b032f27cSSam Leffler ieee80211_ht_adjust_channel(ic, 2772bfc8a91SSam Leffler ic->ic_curchan, vap->iv_flags_ht)); 278b032f27cSSam Leffler /* NB: iv_bss is changed on return */ 279b032f27cSSam Leffler break; 280b032f27cSSam Leffler case IEEE80211_S_CAC: 281b032f27cSSam Leffler /* 282b032f27cSSam Leffler * NB: This is the normal state change when CAC 283b032f27cSSam Leffler * expires and no radar was detected; no need to 284b032f27cSSam Leffler * clear the CAC timer as it's already expired. 285b032f27cSSam Leffler */ 286b032f27cSSam Leffler /* fall thru... */ 287b032f27cSSam Leffler case IEEE80211_S_CSA: 288b032f27cSSam Leffler /* 2894e150988SSam Leffler * Shorten inactivity timer of associated stations 2904e150988SSam Leffler * to weed out sta's that don't follow a CSA. 2914e150988SSam Leffler */ 2924e150988SSam Leffler ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap); 2934e150988SSam Leffler /* 294b032f27cSSam Leffler * Update bss node channel to reflect where 295b032f27cSSam Leffler * we landed after CSA. 296b032f27cSSam Leffler */ 297b032f27cSSam Leffler ieee80211_node_set_chan(vap->iv_bss, 298b032f27cSSam Leffler ieee80211_ht_adjust_channel(ic, ic->ic_curchan, 299b032f27cSSam Leffler ieee80211_htchanflags(vap->iv_bss->ni_chan))); 300b032f27cSSam Leffler /* XXX bypass debug msgs */ 301b032f27cSSam Leffler break; 302b032f27cSSam Leffler case IEEE80211_S_SCAN: 303b032f27cSSam Leffler case IEEE80211_S_RUN: 304b032f27cSSam Leffler #ifdef IEEE80211_DEBUG 305b032f27cSSam Leffler if (ieee80211_msg_debug(vap)) { 306b032f27cSSam Leffler struct ieee80211_node *ni = vap->iv_bss; 307b032f27cSSam Leffler ieee80211_note(vap, 308b032f27cSSam Leffler "synchronized with %s ssid ", 309b032f27cSSam Leffler ether_sprintf(ni->ni_bssid)); 310b032f27cSSam Leffler ieee80211_print_essid(ni->ni_essid, 311b032f27cSSam Leffler ni->ni_esslen); 312b032f27cSSam Leffler /* XXX MCS/HT */ 313b032f27cSSam Leffler printf(" channel %d start %uMb\n", 314b032f27cSSam Leffler ieee80211_chan2ieee(ic, ic->ic_curchan), 315b032f27cSSam Leffler IEEE80211_RATE2MBS(ni->ni_txrate)); 316b032f27cSSam Leffler } 317b032f27cSSam Leffler #endif 318b032f27cSSam Leffler break; 319b032f27cSSam Leffler default: 320b032f27cSSam Leffler break; 321b032f27cSSam Leffler } 322b032f27cSSam Leffler /* 323b032f27cSSam Leffler * Start/stop the authenticator. We delay until here 324b032f27cSSam Leffler * to allow configuration to happen out of order. 325b032f27cSSam Leffler */ 326b032f27cSSam Leffler if (vap->iv_auth->ia_attach != NULL) { 327b032f27cSSam Leffler /* XXX check failure */ 328b032f27cSSam Leffler vap->iv_auth->ia_attach(vap); 329b032f27cSSam Leffler } else if (vap->iv_auth->ia_detach != NULL) { 330b032f27cSSam Leffler vap->iv_auth->ia_detach(vap); 331b032f27cSSam Leffler } 332b032f27cSSam Leffler ieee80211_node_authorize(vap->iv_bss); 333b032f27cSSam Leffler break; 3347131987dSSam Leffler case IEEE80211_S_CSA: 3357131987dSSam Leffler if (ostate == IEEE80211_S_RUN && isbandchange(ic)) { 3367131987dSSam Leffler /* 3377131987dSSam Leffler * On a ``band change'' silently drop associated 3387131987dSSam Leffler * stations as they must re-associate before they 3397131987dSSam Leffler * can pass traffic (as otherwise protocol state 3407131987dSSam Leffler * such as capabilities and the negotiated rate 3417131987dSSam Leffler * set may/will be wrong). 3427131987dSSam Leffler */ 3437131987dSSam Leffler ieee80211_iterate_nodes(&ic->ic_sta, sta_drop, vap); 3447131987dSSam Leffler } 3457131987dSSam Leffler break; 346b032f27cSSam Leffler default: 347b032f27cSSam Leffler break; 348b032f27cSSam Leffler } 349b032f27cSSam Leffler return 0; 350b032f27cSSam Leffler } 351b032f27cSSam Leffler 352b032f27cSSam Leffler static void 353b032f27cSSam Leffler hostap_deliver_data(struct ieee80211vap *vap, 354b032f27cSSam Leffler struct ieee80211_node *ni, struct mbuf *m) 355b032f27cSSam Leffler { 356b032f27cSSam Leffler struct ether_header *eh = mtod(m, struct ether_header *); 357b032f27cSSam Leffler struct ifnet *ifp = vap->iv_ifp; 358b032f27cSSam Leffler 359e1cfcbcbSSam Leffler /* clear driver/net80211 flags before passing up */ 36086bd0491SAndre Oppermann m->m_flags &= ~(M_MCAST | M_BCAST); 36186bd0491SAndre Oppermann m_clrprotoflags(m); 362e1cfcbcbSSam Leffler 363b032f27cSSam Leffler KASSERT(vap->iv_opmode == IEEE80211_M_HOSTAP, 364b032f27cSSam Leffler ("gack, opmode %d", vap->iv_opmode)); 365b032f27cSSam Leffler /* 366b032f27cSSam Leffler * Do accounting. 367b032f27cSSam Leffler */ 368dea45121SGleb Smirnoff if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1); 369b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_data); 370b032f27cSSam Leffler IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len); 371b032f27cSSam Leffler if (ETHER_IS_MULTICAST(eh->ether_dhost)) { 372b032f27cSSam Leffler m->m_flags |= M_MCAST; /* XXX M_BCAST? */ 373b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_mcast); 374b032f27cSSam Leffler } else 375b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_ucast); 376b032f27cSSam Leffler 377b032f27cSSam Leffler /* perform as a bridge within the AP */ 378b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0) { 379b032f27cSSam Leffler struct mbuf *mcopy = NULL; 380b032f27cSSam Leffler 381b032f27cSSam Leffler if (m->m_flags & M_MCAST) { 382eb1b1807SGleb Smirnoff mcopy = m_dup(m, M_NOWAIT); 383b032f27cSSam Leffler if (mcopy == NULL) 384dea45121SGleb Smirnoff if_inc_counter(ifp, IFCOUNTER_OERRORS, 1); 385b032f27cSSam Leffler else 386b032f27cSSam Leffler mcopy->m_flags |= M_MCAST; 387b032f27cSSam Leffler } else { 388b032f27cSSam Leffler /* 389b032f27cSSam Leffler * Check if the destination is associated with the 390b032f27cSSam Leffler * same vap and authorized to receive traffic. 391b032f27cSSam Leffler * Beware of traffic destined for the vap itself; 392b032f27cSSam Leffler * sending it will not work; just let it be delivered 393b032f27cSSam Leffler * normally. 394b032f27cSSam Leffler */ 395b032f27cSSam Leffler struct ieee80211_node *sta = ieee80211_find_vap_node( 396b032f27cSSam Leffler &vap->iv_ic->ic_sta, vap, eh->ether_dhost); 397b032f27cSSam Leffler if (sta != NULL) { 398b032f27cSSam Leffler if (ieee80211_node_is_authorized(sta)) { 399b032f27cSSam Leffler /* 400b032f27cSSam Leffler * Beware of sending to ourself; this 401b032f27cSSam Leffler * needs to happen via the normal 402b032f27cSSam Leffler * input path. 403b032f27cSSam Leffler */ 404b032f27cSSam Leffler if (sta != vap->iv_bss) { 405b032f27cSSam Leffler mcopy = m; 406b032f27cSSam Leffler m = NULL; 407b032f27cSSam Leffler } 408b032f27cSSam Leffler } else { 409b032f27cSSam Leffler vap->iv_stats.is_rx_unauth++; 410b032f27cSSam Leffler IEEE80211_NODE_STAT(sta, rx_unauth); 411b032f27cSSam Leffler } 412b032f27cSSam Leffler ieee80211_free_node(sta); 413b032f27cSSam Leffler } 414b032f27cSSam Leffler } 415b032f27cSSam Leffler if (mcopy != NULL) { 416b032f27cSSam Leffler int len, err; 417b032f27cSSam Leffler len = mcopy->m_pkthdr.len; 418e7495198SAdrian Chadd err = ieee80211_vap_xmitpkt(vap, mcopy); 419b032f27cSSam Leffler if (err) { 420b032f27cSSam Leffler /* NB: IFQ_HANDOFF reclaims mcopy */ 421b032f27cSSam Leffler } else { 422dea45121SGleb Smirnoff if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1); 423b032f27cSSam Leffler } 424b032f27cSSam Leffler } 425b032f27cSSam Leffler } 426b032f27cSSam Leffler if (m != NULL) { 427b032f27cSSam Leffler /* 428b032f27cSSam Leffler * Mark frame as coming from vap's interface. 429b032f27cSSam Leffler */ 430b032f27cSSam Leffler m->m_pkthdr.rcvif = ifp; 431b032f27cSSam Leffler if (m->m_flags & M_MCAST) { 432b032f27cSSam Leffler /* 433b032f27cSSam Leffler * Spam DWDS vap's w/ multicast traffic. 434b032f27cSSam Leffler */ 435b032f27cSSam Leffler /* XXX only if dwds in use? */ 436b032f27cSSam Leffler ieee80211_dwds_mcast(vap, m); 437b032f27cSSam Leffler } 438b032f27cSSam Leffler if (ni->ni_vlan != 0) { 439b032f27cSSam Leffler /* attach vlan tag */ 440b032f27cSSam Leffler m->m_pkthdr.ether_vtag = ni->ni_vlan; 441b032f27cSSam Leffler m->m_flags |= M_VLANTAG; 442b032f27cSSam Leffler } 443b032f27cSSam Leffler ifp->if_input(ifp, m); 444b032f27cSSam Leffler } 445b032f27cSSam Leffler } 446b032f27cSSam Leffler 447b032f27cSSam Leffler /* 448b032f27cSSam Leffler * Decide if a received management frame should be 449b032f27cSSam Leffler * printed when debugging is enabled. This filters some 450b032f27cSSam Leffler * of the less interesting frames that come frequently 451b032f27cSSam Leffler * (e.g. beacons). 452b032f27cSSam Leffler */ 453b032f27cSSam Leffler static __inline int 454b032f27cSSam Leffler doprint(struct ieee80211vap *vap, int subtype) 455b032f27cSSam Leffler { 456b032f27cSSam Leffler switch (subtype) { 457b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_BEACON: 458b032f27cSSam Leffler return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN); 459b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 460b032f27cSSam Leffler return 0; 461b032f27cSSam Leffler } 462b032f27cSSam Leffler return 1; 463b032f27cSSam Leffler } 464b032f27cSSam Leffler 465b032f27cSSam Leffler /* 466b032f27cSSam Leffler * Process a received frame. The node associated with the sender 467b032f27cSSam Leffler * should be supplied. If nothing was found in the node table then 468b032f27cSSam Leffler * the caller is assumed to supply a reference to iv_bss instead. 469b032f27cSSam Leffler * The RSSI and a timestamp are also supplied. The RSSI data is used 470b032f27cSSam Leffler * during AP scanning to select a AP to associate with; it can have 471b032f27cSSam Leffler * any units so long as values have consistent units and higher values 472b032f27cSSam Leffler * mean ``better signal''. The receive timestamp is currently not used 473b032f27cSSam Leffler * by the 802.11 layer. 474b032f27cSSam Leffler */ 475b032f27cSSam Leffler static int 476c79f192cSAdrian Chadd hostap_input(struct ieee80211_node *ni, struct mbuf *m, 477c79f192cSAdrian Chadd const struct ieee80211_rx_stats *rxs, int rssi, int nf) 478b032f27cSSam Leffler { 479b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 480b032f27cSSam Leffler struct ieee80211com *ic = ni->ni_ic; 481b032f27cSSam Leffler struct ifnet *ifp = vap->iv_ifp; 482b032f27cSSam Leffler struct ieee80211_frame *wh; 483b032f27cSSam Leffler struct ieee80211_key *key; 484b032f27cSSam Leffler struct ether_header *eh; 4852b80a340SRui Paulo int hdrspace, need_tap = 1; /* mbuf need to be tapped. */ 486b032f27cSSam Leffler uint8_t dir, type, subtype, qos; 487b032f27cSSam Leffler uint8_t *bssid; 488b032f27cSSam Leffler 48945f856e3SSam Leffler if (m->m_flags & M_AMPDU_MPDU) { 490b032f27cSSam Leffler /* 491b032f27cSSam Leffler * Fastpath for A-MPDU reorder q resubmission. Frames 49245f856e3SSam Leffler * w/ M_AMPDU_MPDU marked have already passed through 49345f856e3SSam Leffler * here but were received out of order and been held on 49445f856e3SSam Leffler * the reorder queue. When resubmitted they are marked 49545f856e3SSam Leffler * with the M_AMPDU_MPDU flag and we can bypass most of 49645f856e3SSam Leffler * the normal processing. 497b032f27cSSam Leffler */ 498b032f27cSSam Leffler wh = mtod(m, struct ieee80211_frame *); 499b032f27cSSam Leffler type = IEEE80211_FC0_TYPE_DATA; 500b032f27cSSam Leffler dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 501b032f27cSSam Leffler subtype = IEEE80211_FC0_SUBTYPE_QOS; 502b032f27cSSam Leffler hdrspace = ieee80211_hdrspace(ic, wh); /* XXX optimize? */ 503b032f27cSSam Leffler goto resubmit_ampdu; 504b032f27cSSam Leffler } 505b032f27cSSam Leffler 506b032f27cSSam Leffler KASSERT(ni != NULL, ("null node")); 507b032f27cSSam Leffler ni->ni_inact = ni->ni_inact_reload; 508b032f27cSSam Leffler 509b032f27cSSam Leffler type = -1; /* undefined */ 510b032f27cSSam Leffler 511b032f27cSSam Leffler if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) { 512b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY, 513b032f27cSSam Leffler ni->ni_macaddr, NULL, 514b032f27cSSam Leffler "too short (1): len %u", m->m_pkthdr.len); 515b032f27cSSam Leffler vap->iv_stats.is_rx_tooshort++; 516b032f27cSSam Leffler goto out; 517b032f27cSSam Leffler } 518b032f27cSSam Leffler /* 519b032f27cSSam Leffler * Bit of a cheat here, we use a pointer for a 3-address 520b032f27cSSam Leffler * frame format but don't reference fields past outside 521b032f27cSSam Leffler * ieee80211_frame_min w/o first validating the data is 522b032f27cSSam Leffler * present. 523b032f27cSSam Leffler */ 524b032f27cSSam Leffler wh = mtod(m, struct ieee80211_frame *); 525b032f27cSSam Leffler 526b032f27cSSam Leffler if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) != 527b032f27cSSam Leffler IEEE80211_FC0_VERSION_0) { 528b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY, 529dc7bf546SSam Leffler ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x", 530dc7bf546SSam Leffler wh->i_fc[0], wh->i_fc[1]); 531b032f27cSSam Leffler vap->iv_stats.is_rx_badversion++; 532b032f27cSSam Leffler goto err; 533b032f27cSSam Leffler } 534b032f27cSSam Leffler 535b032f27cSSam Leffler dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 536b032f27cSSam Leffler type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 537b032f27cSSam Leffler subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 538b032f27cSSam Leffler if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) { 539b032f27cSSam Leffler if (dir != IEEE80211_FC1_DIR_NODS) 540b032f27cSSam Leffler bssid = wh->i_addr1; 541b032f27cSSam Leffler else if (type == IEEE80211_FC0_TYPE_CTL) 542b032f27cSSam Leffler bssid = wh->i_addr1; 543b032f27cSSam Leffler else { 544b032f27cSSam Leffler if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 545b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, 546b032f27cSSam Leffler IEEE80211_MSG_ANY, ni->ni_macaddr, 547b032f27cSSam Leffler NULL, "too short (2): len %u", 548b032f27cSSam Leffler m->m_pkthdr.len); 549b032f27cSSam Leffler vap->iv_stats.is_rx_tooshort++; 550b032f27cSSam Leffler goto out; 551b032f27cSSam Leffler } 552b032f27cSSam Leffler bssid = wh->i_addr3; 553b032f27cSSam Leffler } 554b032f27cSSam Leffler /* 555b032f27cSSam Leffler * Validate the bssid. 556b032f27cSSam Leffler */ 557b032f27cSSam Leffler if (!(type == IEEE80211_FC0_TYPE_MGT && 558b032f27cSSam Leffler subtype == IEEE80211_FC0_SUBTYPE_BEACON) && 559b032f27cSSam Leffler !IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) && 560b032f27cSSam Leffler !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) { 561b032f27cSSam Leffler /* not interested in */ 562b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, 563b032f27cSSam Leffler bssid, NULL, "%s", "not to bss"); 564b032f27cSSam Leffler vap->iv_stats.is_rx_wrongbss++; 565b032f27cSSam Leffler goto out; 566b032f27cSSam Leffler } 567b032f27cSSam Leffler 568b032f27cSSam Leffler IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi); 5695463c4a4SSam Leffler ni->ni_noise = nf; 570c3ebe019SAdrian Chadd if (IEEE80211_HAS_SEQ(type, subtype)) { 571b032f27cSSam Leffler uint8_t tid = ieee80211_gettid(wh); 572b032f27cSSam Leffler if (IEEE80211_QOS_HAS_SEQ(wh) && 573b032f27cSSam Leffler TID_TO_WME_AC(tid) >= WME_AC_VI) 574b032f27cSSam Leffler ic->ic_wme.wme_hipri_traffic++; 5751ffa8d7eSAndriy Voskoboinyk if (! ieee80211_check_rxseq(ni, wh, bssid)) 576b032f27cSSam Leffler goto out; 577b032f27cSSam Leffler } 578b032f27cSSam Leffler } 579b032f27cSSam Leffler 580b032f27cSSam Leffler switch (type) { 581b032f27cSSam Leffler case IEEE80211_FC0_TYPE_DATA: 582b032f27cSSam Leffler hdrspace = ieee80211_hdrspace(ic, wh); 583b032f27cSSam Leffler if (m->m_len < hdrspace && 584b032f27cSSam Leffler (m = m_pullup(m, hdrspace)) == NULL) { 585b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY, 586b032f27cSSam Leffler ni->ni_macaddr, NULL, 587b032f27cSSam Leffler "data too short: expecting %u", hdrspace); 588b032f27cSSam Leffler vap->iv_stats.is_rx_tooshort++; 589b032f27cSSam Leffler goto out; /* XXX */ 590b032f27cSSam Leffler } 591b032f27cSSam Leffler if (!(dir == IEEE80211_FC1_DIR_TODS || 592b032f27cSSam Leffler (dir == IEEE80211_FC1_DIR_DSTODS && 593b032f27cSSam Leffler (vap->iv_flags & IEEE80211_F_DWDS)))) { 594b032f27cSSam Leffler if (dir != IEEE80211_FC1_DIR_DSTODS) { 595b032f27cSSam Leffler IEEE80211_DISCARD(vap, 596b032f27cSSam Leffler IEEE80211_MSG_INPUT, wh, "data", 597b032f27cSSam Leffler "incorrect dir 0x%x", dir); 598b032f27cSSam Leffler } else { 599b032f27cSSam Leffler IEEE80211_DISCARD(vap, 600b032f27cSSam Leffler IEEE80211_MSG_INPUT | 601b032f27cSSam Leffler IEEE80211_MSG_WDS, wh, 602b032f27cSSam Leffler "4-address data", 603b032f27cSSam Leffler "%s", "DWDS not enabled"); 604b032f27cSSam Leffler } 605b032f27cSSam Leffler vap->iv_stats.is_rx_wrongdir++; 606b032f27cSSam Leffler goto out; 607b032f27cSSam Leffler } 608b032f27cSSam Leffler /* check if source STA is associated */ 609b032f27cSSam Leffler if (ni == vap->iv_bss) { 610b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 611b032f27cSSam Leffler wh, "data", "%s", "unknown src"); 612b032f27cSSam Leffler ieee80211_send_error(ni, wh->i_addr2, 613b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_DEAUTH, 614b032f27cSSam Leffler IEEE80211_REASON_NOT_AUTHED); 615b032f27cSSam Leffler vap->iv_stats.is_rx_notassoc++; 616b032f27cSSam Leffler goto err; 617b032f27cSSam Leffler } 618b032f27cSSam Leffler if (ni->ni_associd == 0) { 619b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 620b032f27cSSam Leffler wh, "data", "%s", "unassoc src"); 621b032f27cSSam Leffler IEEE80211_SEND_MGMT(ni, 622b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_DISASSOC, 623b032f27cSSam Leffler IEEE80211_REASON_NOT_ASSOCED); 624b032f27cSSam Leffler vap->iv_stats.is_rx_notassoc++; 625b032f27cSSam Leffler goto err; 626b032f27cSSam Leffler } 627b032f27cSSam Leffler 628b032f27cSSam Leffler /* 629b032f27cSSam Leffler * Check for power save state change. 630b032f27cSSam Leffler * XXX out-of-order A-MPDU frames? 631b032f27cSSam Leffler */ 632b032f27cSSam Leffler if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^ 633b032f27cSSam Leffler (ni->ni_flags & IEEE80211_NODE_PWR_MGT))) 634e7f0d7cfSAdrian Chadd vap->iv_node_ps(ni, 635b032f27cSSam Leffler wh->i_fc[1] & IEEE80211_FC1_PWR_MGT); 636b032f27cSSam Leffler /* 637b032f27cSSam Leffler * For 4-address packets handle WDS discovery 638b032f27cSSam Leffler * notifications. Once a WDS link is setup frames 639b032f27cSSam Leffler * are just delivered to the WDS vap (see below). 640b032f27cSSam Leffler */ 641b032f27cSSam Leffler if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap == NULL) { 642b032f27cSSam Leffler if (!ieee80211_node_is_authorized(ni)) { 643b032f27cSSam Leffler IEEE80211_DISCARD(vap, 644b032f27cSSam Leffler IEEE80211_MSG_INPUT | 645b032f27cSSam Leffler IEEE80211_MSG_WDS, wh, 646b032f27cSSam Leffler "4-address data", 647b032f27cSSam Leffler "%s", "unauthorized port"); 648b032f27cSSam Leffler vap->iv_stats.is_rx_unauth++; 649b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_unauth); 650b032f27cSSam Leffler goto err; 651b032f27cSSam Leffler } 652b032f27cSSam Leffler ieee80211_dwds_discover(ni, m); 653b032f27cSSam Leffler return type; 654b032f27cSSam Leffler } 655b032f27cSSam Leffler 656b032f27cSSam Leffler /* 65745f856e3SSam Leffler * Handle A-MPDU re-ordering. If the frame is to be 65845f856e3SSam Leffler * processed directly then ieee80211_ampdu_reorder 659b032f27cSSam Leffler * will return 0; otherwise it has consumed the mbuf 660b032f27cSSam Leffler * and we should do nothing more with it. 661b032f27cSSam Leffler */ 66245f856e3SSam Leffler if ((m->m_flags & M_AMPDU) && 663b032f27cSSam Leffler ieee80211_ampdu_reorder(ni, m) != 0) { 664b032f27cSSam Leffler m = NULL; 665b032f27cSSam Leffler goto out; 666b032f27cSSam Leffler } 667b032f27cSSam Leffler resubmit_ampdu: 668b032f27cSSam Leffler 669b032f27cSSam Leffler /* 670b032f27cSSam Leffler * Handle privacy requirements. Note that we 671b032f27cSSam Leffler * must not be preempted from here until after 672b032f27cSSam Leffler * we (potentially) call ieee80211_crypto_demic; 673b032f27cSSam Leffler * otherwise we may violate assumptions in the 674b032f27cSSam Leffler * crypto cipher modules used to do delayed update 675b032f27cSSam Leffler * of replay sequence numbers. 676b032f27cSSam Leffler */ 6775945b5f5SKevin Lo if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) { 678b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) { 679b032f27cSSam Leffler /* 680b032f27cSSam Leffler * Discard encrypted frames when privacy is off. 681b032f27cSSam Leffler */ 682b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 683b032f27cSSam Leffler wh, "WEP", "%s", "PRIVACY off"); 684b032f27cSSam Leffler vap->iv_stats.is_rx_noprivacy++; 685b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_noprivacy); 686b032f27cSSam Leffler goto out; 687b032f27cSSam Leffler } 688b032f27cSSam Leffler key = ieee80211_crypto_decap(ni, m, hdrspace); 689b032f27cSSam Leffler if (key == NULL) { 690b032f27cSSam Leffler /* NB: stats+msgs handled in crypto_decap */ 691b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_wepfail); 692b032f27cSSam Leffler goto out; 693b032f27cSSam Leffler } 694b032f27cSSam Leffler wh = mtod(m, struct ieee80211_frame *); 6955945b5f5SKevin Lo wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED; 696b032f27cSSam Leffler } else { 697b032f27cSSam Leffler /* XXX M_WEP and IEEE80211_F_PRIVACY */ 698b032f27cSSam Leffler key = NULL; 699b032f27cSSam Leffler } 700b032f27cSSam Leffler 701b032f27cSSam Leffler /* 702b032f27cSSam Leffler * Save QoS bits for use below--before we strip the header. 703b032f27cSSam Leffler */ 704b032f27cSSam Leffler if (subtype == IEEE80211_FC0_SUBTYPE_QOS) { 705b032f27cSSam Leffler qos = (dir == IEEE80211_FC1_DIR_DSTODS) ? 706b032f27cSSam Leffler ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] : 707b032f27cSSam Leffler ((struct ieee80211_qosframe *)wh)->i_qos[0]; 708b032f27cSSam Leffler } else 709b032f27cSSam Leffler qos = 0; 710b032f27cSSam Leffler 711b032f27cSSam Leffler /* 712b032f27cSSam Leffler * Next up, any fragmentation. 713b032f27cSSam Leffler */ 714b032f27cSSam Leffler if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 715b032f27cSSam Leffler m = ieee80211_defrag(ni, m, hdrspace); 716b032f27cSSam Leffler if (m == NULL) { 717b032f27cSSam Leffler /* Fragment dropped or frame not complete yet */ 718b032f27cSSam Leffler goto out; 719b032f27cSSam Leffler } 720b032f27cSSam Leffler } 721b032f27cSSam Leffler wh = NULL; /* no longer valid, catch any uses */ 722b032f27cSSam Leffler 723b032f27cSSam Leffler /* 724b032f27cSSam Leffler * Next strip any MSDU crypto bits. 725b032f27cSSam Leffler */ 726b032f27cSSam Leffler if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) { 727b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, 728b032f27cSSam Leffler ni->ni_macaddr, "data", "%s", "demic error"); 729b032f27cSSam Leffler vap->iv_stats.is_rx_demicfail++; 730b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_demicfail); 731b032f27cSSam Leffler goto out; 732b032f27cSSam Leffler } 733b032f27cSSam Leffler /* copy to listener after decrypt */ 7345463c4a4SSam Leffler if (ieee80211_radiotap_active_vap(vap)) 7355463c4a4SSam Leffler ieee80211_radiotap_rx(vap, m); 736b032f27cSSam Leffler need_tap = 0; 737b032f27cSSam Leffler /* 738b032f27cSSam Leffler * Finally, strip the 802.11 header. 739b032f27cSSam Leffler */ 740b032f27cSSam Leffler m = ieee80211_decap(vap, m, hdrspace); 741b032f27cSSam Leffler if (m == NULL) { 742b032f27cSSam Leffler /* XXX mask bit to check for both */ 743b032f27cSSam Leffler /* don't count Null data frames as errors */ 744b032f27cSSam Leffler if (subtype == IEEE80211_FC0_SUBTYPE_NODATA || 745b032f27cSSam Leffler subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL) 746b032f27cSSam Leffler goto out; 747b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, 748b032f27cSSam Leffler ni->ni_macaddr, "data", "%s", "decap error"); 749b032f27cSSam Leffler vap->iv_stats.is_rx_decap++; 750b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_decap); 751b032f27cSSam Leffler goto err; 752b032f27cSSam Leffler } 753b032f27cSSam Leffler eh = mtod(m, struct ether_header *); 754b032f27cSSam Leffler if (!ieee80211_node_is_authorized(ni)) { 755b032f27cSSam Leffler /* 756b032f27cSSam Leffler * Deny any non-PAE frames received prior to 757b032f27cSSam Leffler * authorization. For open/shared-key 758b032f27cSSam Leffler * authentication the port is mark authorized 759b032f27cSSam Leffler * after authentication completes. For 802.1x 760b032f27cSSam Leffler * the port is not marked authorized by the 761b032f27cSSam Leffler * authenticator until the handshake has completed. 762b032f27cSSam Leffler */ 763b032f27cSSam Leffler if (eh->ether_type != htons(ETHERTYPE_PAE)) { 764b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, 765b032f27cSSam Leffler eh->ether_shost, "data", 766b032f27cSSam Leffler "unauthorized port: ether type 0x%x len %u", 767b032f27cSSam Leffler eh->ether_type, m->m_pkthdr.len); 768b032f27cSSam Leffler vap->iv_stats.is_rx_unauth++; 769b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_unauth); 770b032f27cSSam Leffler goto err; 771b032f27cSSam Leffler } 772b032f27cSSam Leffler } else { 773b032f27cSSam Leffler /* 774b032f27cSSam Leffler * When denying unencrypted frames, discard 775b032f27cSSam Leffler * any non-PAE frames received without encryption. 776b032f27cSSam Leffler */ 777b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_DROPUNENC) && 778b032f27cSSam Leffler (key == NULL && (m->m_flags & M_WEP) == 0) && 779b032f27cSSam Leffler eh->ether_type != htons(ETHERTYPE_PAE)) { 780b032f27cSSam Leffler /* 781b032f27cSSam Leffler * Drop unencrypted frames. 782b032f27cSSam Leffler */ 783b032f27cSSam Leffler vap->iv_stats.is_rx_unencrypted++; 784b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_unencrypted); 785b032f27cSSam Leffler goto out; 786b032f27cSSam Leffler } 787b032f27cSSam Leffler } 788b032f27cSSam Leffler /* XXX require HT? */ 789b032f27cSSam Leffler if (qos & IEEE80211_QOS_AMSDU) { 790b032f27cSSam Leffler m = ieee80211_decap_amsdu(ni, m); 791b032f27cSSam Leffler if (m == NULL) 792b032f27cSSam Leffler return IEEE80211_FC0_TYPE_DATA; 793616190d0SSam Leffler } else { 794616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG 795616190d0SSam Leffler m = ieee80211_decap_fastframe(vap, ni, m); 796b032f27cSSam Leffler if (m == NULL) 797b032f27cSSam Leffler return IEEE80211_FC0_TYPE_DATA; 798616190d0SSam Leffler #endif 799b032f27cSSam Leffler } 800b032f27cSSam Leffler if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL) 801b032f27cSSam Leffler ieee80211_deliver_data(ni->ni_wdsvap, ni, m); 802b032f27cSSam Leffler else 803b032f27cSSam Leffler hostap_deliver_data(vap, ni, m); 804b032f27cSSam Leffler return IEEE80211_FC0_TYPE_DATA; 805b032f27cSSam Leffler 806b032f27cSSam Leffler case IEEE80211_FC0_TYPE_MGT: 807b032f27cSSam Leffler vap->iv_stats.is_rx_mgmt++; 808b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_mgmt); 809b032f27cSSam Leffler if (dir != IEEE80211_FC1_DIR_NODS) { 810b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 811b032f27cSSam Leffler wh, "mgt", "incorrect dir 0x%x", dir); 812b032f27cSSam Leffler vap->iv_stats.is_rx_wrongdir++; 813b032f27cSSam Leffler goto err; 814b032f27cSSam Leffler } 815b032f27cSSam Leffler if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) { 816b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY, 817b032f27cSSam Leffler ni->ni_macaddr, "mgt", "too short: len %u", 818b032f27cSSam Leffler m->m_pkthdr.len); 819b032f27cSSam Leffler vap->iv_stats.is_rx_tooshort++; 820b032f27cSSam Leffler goto out; 821b032f27cSSam Leffler } 822b032f27cSSam Leffler if (IEEE80211_IS_MULTICAST(wh->i_addr2)) { 823b032f27cSSam Leffler /* ensure return frames are unicast */ 824b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY, 825b032f27cSSam Leffler wh, NULL, "source is multicast: %s", 826b032f27cSSam Leffler ether_sprintf(wh->i_addr2)); 827b032f27cSSam Leffler vap->iv_stats.is_rx_mgtdiscard++; /* XXX stat */ 828b032f27cSSam Leffler goto out; 829b032f27cSSam Leffler } 830b032f27cSSam Leffler #ifdef IEEE80211_DEBUG 831b032f27cSSam Leffler if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) || 832b032f27cSSam Leffler ieee80211_msg_dumppkts(vap)) { 833b032f27cSSam Leffler if_printf(ifp, "received %s from %s rssi %d\n", 834b032f27cSSam Leffler ieee80211_mgt_subtype_name[subtype >> 835b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_SHIFT], 836b032f27cSSam Leffler ether_sprintf(wh->i_addr2), rssi); 837b032f27cSSam Leffler } 838b032f27cSSam Leffler #endif 8395945b5f5SKevin Lo if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) { 840b032f27cSSam Leffler if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) { 841b032f27cSSam Leffler /* 842b032f27cSSam Leffler * Only shared key auth frames with a challenge 843b032f27cSSam Leffler * should be encrypted, discard all others. 844b032f27cSSam Leffler */ 845b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 846b032f27cSSam Leffler wh, NULL, 847b032f27cSSam Leffler "%s", "WEP set but not permitted"); 848b032f27cSSam Leffler vap->iv_stats.is_rx_mgtdiscard++; /* XXX */ 849b032f27cSSam Leffler goto out; 850b032f27cSSam Leffler } 851b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) { 852b032f27cSSam Leffler /* 853b032f27cSSam Leffler * Discard encrypted frames when privacy is off. 854b032f27cSSam Leffler */ 855b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 856b032f27cSSam Leffler wh, NULL, "%s", "WEP set but PRIVACY off"); 857b032f27cSSam Leffler vap->iv_stats.is_rx_noprivacy++; 858b032f27cSSam Leffler goto out; 859b032f27cSSam Leffler } 860b032f27cSSam Leffler hdrspace = ieee80211_hdrspace(ic, wh); 861b032f27cSSam Leffler key = ieee80211_crypto_decap(ni, m, hdrspace); 862b032f27cSSam Leffler if (key == NULL) { 863b032f27cSSam Leffler /* NB: stats+msgs handled in crypto_decap */ 864b032f27cSSam Leffler goto out; 865b032f27cSSam Leffler } 866b032f27cSSam Leffler wh = mtod(m, struct ieee80211_frame *); 8675945b5f5SKevin Lo wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED; 868b032f27cSSam Leffler } 8694e87d54aSRui Paulo /* 8704e87d54aSRui Paulo * Pass the packet to radiotap before calling iv_recv_mgmt(). 8714e87d54aSRui Paulo * Otherwise iv_recv_mgmt() might pass another packet to 8724e87d54aSRui Paulo * radiotap, resulting in out of order packet captures. 8734e87d54aSRui Paulo */ 874323f12abSRui Paulo if (ieee80211_radiotap_active_vap(vap)) 875323f12abSRui Paulo ieee80211_radiotap_rx(vap, m); 876323f12abSRui Paulo need_tap = 0; 877c79f192cSAdrian Chadd vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf); 8788bbd3e41SSam Leffler goto out; 879b032f27cSSam Leffler 880b032f27cSSam Leffler case IEEE80211_FC0_TYPE_CTL: 881b032f27cSSam Leffler vap->iv_stats.is_rx_ctl++; 882b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_ctrl); 88349eae5f7SSam Leffler vap->iv_recv_ctl(ni, m, subtype); 884b032f27cSSam Leffler goto out; 885b032f27cSSam Leffler default: 886b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY, 887b032f27cSSam Leffler wh, "bad", "frame type 0x%x", type); 888b032f27cSSam Leffler /* should not come here */ 889b032f27cSSam Leffler break; 890b032f27cSSam Leffler } 891b032f27cSSam Leffler err: 892dea45121SGleb Smirnoff if_inc_counter(ifp, IFCOUNTER_IERRORS, 1); 893b032f27cSSam Leffler out: 894b032f27cSSam Leffler if (m != NULL) { 895a6c3cf3eSSam Leffler if (need_tap && ieee80211_radiotap_active_vap(vap)) 8965463c4a4SSam Leffler ieee80211_radiotap_rx(vap, m); 897b032f27cSSam Leffler m_freem(m); 898b032f27cSSam Leffler } 899b032f27cSSam Leffler return type; 900b032f27cSSam Leffler } 901b032f27cSSam Leffler 902b032f27cSSam Leffler static void 903b032f27cSSam Leffler hostap_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh, 9045463c4a4SSam Leffler int rssi, int nf, uint16_t seq, uint16_t status) 905b032f27cSSam Leffler { 906b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 907b032f27cSSam Leffler 908b032f27cSSam Leffler KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state)); 909b032f27cSSam Leffler 910b032f27cSSam Leffler if (ni->ni_authmode == IEEE80211_AUTH_SHARED) { 911b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 912b032f27cSSam Leffler ni->ni_macaddr, "open auth", 913b032f27cSSam Leffler "bad sta auth mode %u", ni->ni_authmode); 914b032f27cSSam Leffler vap->iv_stats.is_rx_bad_auth++; /* XXX */ 915b032f27cSSam Leffler /* 916b032f27cSSam Leffler * Clear any challenge text that may be there if 917b032f27cSSam Leffler * a previous shared key auth failed and then an 918b032f27cSSam Leffler * open auth is attempted. 919b032f27cSSam Leffler */ 920b032f27cSSam Leffler if (ni->ni_challenge != NULL) { 921b9b53389SAdrian Chadd IEEE80211_FREE(ni->ni_challenge, M_80211_NODE); 922b032f27cSSam Leffler ni->ni_challenge = NULL; 923b032f27cSSam Leffler } 924b032f27cSSam Leffler /* XXX hack to workaround calling convention */ 925b032f27cSSam Leffler ieee80211_send_error(ni, wh->i_addr2, 926b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_AUTH, 927b032f27cSSam Leffler (seq + 1) | (IEEE80211_STATUS_ALG<<16)); 928b032f27cSSam Leffler return; 929b032f27cSSam Leffler } 930b032f27cSSam Leffler if (seq != IEEE80211_AUTH_OPEN_REQUEST) { 931b032f27cSSam Leffler vap->iv_stats.is_rx_bad_auth++; 932b032f27cSSam Leffler return; 933b032f27cSSam Leffler } 934b032f27cSSam Leffler /* always accept open authentication requests */ 935b032f27cSSam Leffler if (ni == vap->iv_bss) { 936b032f27cSSam Leffler ni = ieee80211_dup_bss(vap, wh->i_addr2); 937b032f27cSSam Leffler if (ni == NULL) 938b032f27cSSam Leffler return; 939b032f27cSSam Leffler } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 940b032f27cSSam Leffler (void) ieee80211_ref_node(ni); 941b032f27cSSam Leffler /* 942b032f27cSSam Leffler * Mark the node as referenced to reflect that it's 943b032f27cSSam Leffler * reference count has been bumped to insure it remains 944b032f27cSSam Leffler * after the transaction completes. 945b032f27cSSam Leffler */ 946b032f27cSSam Leffler ni->ni_flags |= IEEE80211_NODE_AREF; 9471b999d64SSam Leffler /* 94812c290feSSam Leffler * Mark the node as requiring a valid association id 9491b999d64SSam Leffler * before outbound traffic is permitted. 9501b999d64SSam Leffler */ 9511b999d64SSam Leffler ni->ni_flags |= IEEE80211_NODE_ASSOCID; 952b032f27cSSam Leffler 953b032f27cSSam Leffler if (vap->iv_acl != NULL && 954b032f27cSSam Leffler vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) { 955b032f27cSSam Leffler /* 956b032f27cSSam Leffler * When the ACL policy is set to RADIUS we defer the 957b032f27cSSam Leffler * authorization to a user agent. Dispatch an event, 958b032f27cSSam Leffler * a subsequent MLME call will decide the fate of the 959b032f27cSSam Leffler * station. If the user agent is not present then the 960b032f27cSSam Leffler * node will be reclaimed due to inactivity. 961b032f27cSSam Leffler */ 962b032f27cSSam Leffler IEEE80211_NOTE_MAC(vap, 963b032f27cSSam Leffler IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL, ni->ni_macaddr, 964b032f27cSSam Leffler "%s", "station authentication defered (radius acl)"); 965b032f27cSSam Leffler ieee80211_notify_node_auth(ni); 966b032f27cSSam Leffler } else { 967b032f27cSSam Leffler IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 968b032f27cSSam Leffler IEEE80211_NOTE_MAC(vap, 969b032f27cSSam Leffler IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni->ni_macaddr, 970b032f27cSSam Leffler "%s", "station authenticated (open)"); 971b032f27cSSam Leffler /* 972b032f27cSSam Leffler * When 802.1x is not in use mark the port 973b032f27cSSam Leffler * authorized at this point so traffic can flow. 974b032f27cSSam Leffler */ 975b032f27cSSam Leffler if (ni->ni_authmode != IEEE80211_AUTH_8021X) 976b032f27cSSam Leffler ieee80211_node_authorize(ni); 977b032f27cSSam Leffler } 978b032f27cSSam Leffler } 979b032f27cSSam Leffler 980b032f27cSSam Leffler static void 981b032f27cSSam Leffler hostap_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh, 9825463c4a4SSam Leffler uint8_t *frm, uint8_t *efrm, int rssi, int nf, 983b032f27cSSam Leffler uint16_t seq, uint16_t status) 984b032f27cSSam Leffler { 985b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 986b032f27cSSam Leffler uint8_t *challenge; 987b032f27cSSam Leffler int allocbs, estatus; 988b032f27cSSam Leffler 989b032f27cSSam Leffler KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state)); 990b032f27cSSam Leffler 991b032f27cSSam Leffler /* 992b032f27cSSam Leffler * NB: this can happen as we allow pre-shared key 993b032f27cSSam Leffler * authentication to be enabled w/o wep being turned 994b032f27cSSam Leffler * on so that configuration of these can be done 995b032f27cSSam Leffler * in any order. It may be better to enforce the 996b032f27cSSam Leffler * ordering in which case this check would just be 997b032f27cSSam Leffler * for sanity/consistency. 998b032f27cSSam Leffler */ 999b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) { 1000b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1001b032f27cSSam Leffler ni->ni_macaddr, "shared key auth", 1002b032f27cSSam Leffler "%s", " PRIVACY is disabled"); 1003b032f27cSSam Leffler estatus = IEEE80211_STATUS_ALG; 1004b032f27cSSam Leffler goto bad; 1005b032f27cSSam Leffler } 1006b032f27cSSam Leffler /* 1007b032f27cSSam Leffler * Pre-shared key authentication is evil; accept 1008b032f27cSSam Leffler * it only if explicitly configured (it is supported 1009b032f27cSSam Leffler * mainly for compatibility with clients like Mac OS X). 1010b032f27cSSam Leffler */ 1011b032f27cSSam Leffler if (ni->ni_authmode != IEEE80211_AUTH_AUTO && 1012b032f27cSSam Leffler ni->ni_authmode != IEEE80211_AUTH_SHARED) { 1013b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1014b032f27cSSam Leffler ni->ni_macaddr, "shared key auth", 1015b032f27cSSam Leffler "bad sta auth mode %u", ni->ni_authmode); 1016b032f27cSSam Leffler vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */ 1017b032f27cSSam Leffler estatus = IEEE80211_STATUS_ALG; 1018b032f27cSSam Leffler goto bad; 1019b032f27cSSam Leffler } 1020b032f27cSSam Leffler 1021b032f27cSSam Leffler challenge = NULL; 1022b032f27cSSam Leffler if (frm + 1 < efrm) { 1023b032f27cSSam Leffler if ((frm[1] + 2) > (efrm - frm)) { 1024b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1025b032f27cSSam Leffler ni->ni_macaddr, "shared key auth", 1026b032f27cSSam Leffler "ie %d/%d too long", 1027b032f27cSSam Leffler frm[0], (frm[1] + 2) - (efrm - frm)); 1028b032f27cSSam Leffler vap->iv_stats.is_rx_bad_auth++; 1029b032f27cSSam Leffler estatus = IEEE80211_STATUS_CHALLENGE; 1030b032f27cSSam Leffler goto bad; 1031b032f27cSSam Leffler } 1032b032f27cSSam Leffler if (*frm == IEEE80211_ELEMID_CHALLENGE) 1033b032f27cSSam Leffler challenge = frm; 1034b032f27cSSam Leffler frm += frm[1] + 2; 1035b032f27cSSam Leffler } 1036b032f27cSSam Leffler switch (seq) { 1037b032f27cSSam Leffler case IEEE80211_AUTH_SHARED_CHALLENGE: 1038b032f27cSSam Leffler case IEEE80211_AUTH_SHARED_RESPONSE: 1039b032f27cSSam Leffler if (challenge == NULL) { 1040b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1041b032f27cSSam Leffler ni->ni_macaddr, "shared key auth", 1042b032f27cSSam Leffler "%s", "no challenge"); 1043b032f27cSSam Leffler vap->iv_stats.is_rx_bad_auth++; 1044b032f27cSSam Leffler estatus = IEEE80211_STATUS_CHALLENGE; 1045b032f27cSSam Leffler goto bad; 1046b032f27cSSam Leffler } 1047b032f27cSSam Leffler if (challenge[1] != IEEE80211_CHALLENGE_LEN) { 1048b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1049b032f27cSSam Leffler ni->ni_macaddr, "shared key auth", 1050b032f27cSSam Leffler "bad challenge len %d", challenge[1]); 1051b032f27cSSam Leffler vap->iv_stats.is_rx_bad_auth++; 1052b032f27cSSam Leffler estatus = IEEE80211_STATUS_CHALLENGE; 1053b032f27cSSam Leffler goto bad; 1054b032f27cSSam Leffler } 1055b032f27cSSam Leffler default: 1056b032f27cSSam Leffler break; 1057b032f27cSSam Leffler } 1058b032f27cSSam Leffler switch (seq) { 1059b032f27cSSam Leffler case IEEE80211_AUTH_SHARED_REQUEST: 1060b032f27cSSam Leffler if (ni == vap->iv_bss) { 1061b032f27cSSam Leffler ni = ieee80211_dup_bss(vap, wh->i_addr2); 1062b032f27cSSam Leffler if (ni == NULL) { 1063b032f27cSSam Leffler /* NB: no way to return an error */ 1064b032f27cSSam Leffler return; 1065b032f27cSSam Leffler } 1066b032f27cSSam Leffler allocbs = 1; 1067b032f27cSSam Leffler } else { 1068b032f27cSSam Leffler if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0) 1069b032f27cSSam Leffler (void) ieee80211_ref_node(ni); 1070b032f27cSSam Leffler allocbs = 0; 1071b032f27cSSam Leffler } 1072b032f27cSSam Leffler /* 1073b032f27cSSam Leffler * Mark the node as referenced to reflect that it's 1074b032f27cSSam Leffler * reference count has been bumped to insure it remains 1075b032f27cSSam Leffler * after the transaction completes. 1076b032f27cSSam Leffler */ 1077b032f27cSSam Leffler ni->ni_flags |= IEEE80211_NODE_AREF; 10781b999d64SSam Leffler /* 10791b999d64SSam Leffler * Mark the node as requiring a valid associatio id 10801b999d64SSam Leffler * before outbound traffic is permitted. 10811b999d64SSam Leffler */ 10821b999d64SSam Leffler ni->ni_flags |= IEEE80211_NODE_ASSOCID; 1083b032f27cSSam Leffler IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi); 10845463c4a4SSam Leffler ni->ni_noise = nf; 1085b032f27cSSam Leffler if (!ieee80211_alloc_challenge(ni)) { 1086b032f27cSSam Leffler /* NB: don't return error so they rexmit */ 1087b032f27cSSam Leffler return; 1088b032f27cSSam Leffler } 1089b032f27cSSam Leffler get_random_bytes(ni->ni_challenge, 1090b032f27cSSam Leffler IEEE80211_CHALLENGE_LEN); 1091b032f27cSSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1092b032f27cSSam Leffler ni, "shared key %sauth request", allocbs ? "" : "re"); 1093b032f27cSSam Leffler /* 1094b032f27cSSam Leffler * When the ACL policy is set to RADIUS we defer the 1095b032f27cSSam Leffler * authorization to a user agent. Dispatch an event, 1096b032f27cSSam Leffler * a subsequent MLME call will decide the fate of the 1097b032f27cSSam Leffler * station. If the user agent is not present then the 1098b032f27cSSam Leffler * node will be reclaimed due to inactivity. 1099b032f27cSSam Leffler */ 1100b032f27cSSam Leffler if (vap->iv_acl != NULL && 1101b032f27cSSam Leffler vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) { 1102b032f27cSSam Leffler IEEE80211_NOTE_MAC(vap, 1103b032f27cSSam Leffler IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL, 1104b032f27cSSam Leffler ni->ni_macaddr, 1105b032f27cSSam Leffler "%s", "station authentication defered (radius acl)"); 1106b032f27cSSam Leffler ieee80211_notify_node_auth(ni); 1107b032f27cSSam Leffler return; 1108b032f27cSSam Leffler } 1109b032f27cSSam Leffler break; 1110b032f27cSSam Leffler case IEEE80211_AUTH_SHARED_RESPONSE: 1111b032f27cSSam Leffler if (ni == vap->iv_bss) { 1112b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1113b032f27cSSam Leffler ni->ni_macaddr, "shared key response", 1114b032f27cSSam Leffler "%s", "unknown station"); 1115b032f27cSSam Leffler /* NB: don't send a response */ 1116b032f27cSSam Leffler return; 1117b032f27cSSam Leffler } 1118b032f27cSSam Leffler if (ni->ni_challenge == NULL) { 1119b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1120b032f27cSSam Leffler ni->ni_macaddr, "shared key response", 1121b032f27cSSam Leffler "%s", "no challenge recorded"); 1122b032f27cSSam Leffler vap->iv_stats.is_rx_bad_auth++; 1123b032f27cSSam Leffler estatus = IEEE80211_STATUS_CHALLENGE; 1124b032f27cSSam Leffler goto bad; 1125b032f27cSSam Leffler } 1126b032f27cSSam Leffler if (memcmp(ni->ni_challenge, &challenge[2], 1127b032f27cSSam Leffler challenge[1]) != 0) { 1128b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1129b032f27cSSam Leffler ni->ni_macaddr, "shared key response", 1130b032f27cSSam Leffler "%s", "challenge mismatch"); 1131b032f27cSSam Leffler vap->iv_stats.is_rx_auth_fail++; 1132b032f27cSSam Leffler estatus = IEEE80211_STATUS_CHALLENGE; 1133b032f27cSSam Leffler goto bad; 1134b032f27cSSam Leffler } 1135b032f27cSSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 1136b032f27cSSam Leffler ni, "%s", "station authenticated (shared key)"); 1137b032f27cSSam Leffler ieee80211_node_authorize(ni); 1138b032f27cSSam Leffler break; 1139b032f27cSSam Leffler default: 1140b032f27cSSam Leffler IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH, 1141b032f27cSSam Leffler ni->ni_macaddr, "shared key auth", 1142b032f27cSSam Leffler "bad seq %d", seq); 1143b032f27cSSam Leffler vap->iv_stats.is_rx_bad_auth++; 1144b032f27cSSam Leffler estatus = IEEE80211_STATUS_SEQUENCE; 1145b032f27cSSam Leffler goto bad; 1146b032f27cSSam Leffler } 1147b032f27cSSam Leffler IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1); 1148b032f27cSSam Leffler return; 1149b032f27cSSam Leffler bad: 1150b032f27cSSam Leffler /* 1151b032f27cSSam Leffler * Send an error response; but only when operating as an AP. 1152b032f27cSSam Leffler */ 1153b032f27cSSam Leffler /* XXX hack to workaround calling convention */ 1154b032f27cSSam Leffler ieee80211_send_error(ni, wh->i_addr2, 1155b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_AUTH, 1156b032f27cSSam Leffler (seq + 1) | (estatus<<16)); 1157b032f27cSSam Leffler } 1158b032f27cSSam Leffler 1159b032f27cSSam Leffler /* 1160b032f27cSSam Leffler * Convert a WPA cipher selector OUI to an internal 1161b032f27cSSam Leffler * cipher algorithm. Where appropriate we also 1162b032f27cSSam Leffler * record any key length. 1163b032f27cSSam Leffler */ 1164b032f27cSSam Leffler static int 1165b032f27cSSam Leffler wpa_cipher(const uint8_t *sel, uint8_t *keylen) 1166b032f27cSSam Leffler { 1167b032f27cSSam Leffler #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 116831021a2bSAndriy Voskoboinyk uint32_t w = le32dec(sel); 1169b032f27cSSam Leffler 1170b032f27cSSam Leffler switch (w) { 1171b032f27cSSam Leffler case WPA_SEL(WPA_CSE_NULL): 1172b032f27cSSam Leffler return IEEE80211_CIPHER_NONE; 1173b032f27cSSam Leffler case WPA_SEL(WPA_CSE_WEP40): 1174b032f27cSSam Leffler if (keylen) 1175b032f27cSSam Leffler *keylen = 40 / NBBY; 1176b032f27cSSam Leffler return IEEE80211_CIPHER_WEP; 1177b032f27cSSam Leffler case WPA_SEL(WPA_CSE_WEP104): 1178b032f27cSSam Leffler if (keylen) 1179b032f27cSSam Leffler *keylen = 104 / NBBY; 1180b032f27cSSam Leffler return IEEE80211_CIPHER_WEP; 1181b032f27cSSam Leffler case WPA_SEL(WPA_CSE_TKIP): 1182b032f27cSSam Leffler return IEEE80211_CIPHER_TKIP; 1183b032f27cSSam Leffler case WPA_SEL(WPA_CSE_CCMP): 1184b032f27cSSam Leffler return IEEE80211_CIPHER_AES_CCM; 1185b032f27cSSam Leffler } 1186b032f27cSSam Leffler return 32; /* NB: so 1<< is discarded */ 1187b032f27cSSam Leffler #undef WPA_SEL 1188b032f27cSSam Leffler } 1189b032f27cSSam Leffler 1190b032f27cSSam Leffler /* 1191b032f27cSSam Leffler * Convert a WPA key management/authentication algorithm 1192b032f27cSSam Leffler * to an internal code. 1193b032f27cSSam Leffler */ 1194b032f27cSSam Leffler static int 1195b032f27cSSam Leffler wpa_keymgmt(const uint8_t *sel) 1196b032f27cSSam Leffler { 1197b032f27cSSam Leffler #define WPA_SEL(x) (((x)<<24)|WPA_OUI) 119831021a2bSAndriy Voskoboinyk uint32_t w = le32dec(sel); 1199b032f27cSSam Leffler 1200b032f27cSSam Leffler switch (w) { 1201b032f27cSSam Leffler case WPA_SEL(WPA_ASE_8021X_UNSPEC): 1202b032f27cSSam Leffler return WPA_ASE_8021X_UNSPEC; 1203b032f27cSSam Leffler case WPA_SEL(WPA_ASE_8021X_PSK): 1204b032f27cSSam Leffler return WPA_ASE_8021X_PSK; 1205b032f27cSSam Leffler case WPA_SEL(WPA_ASE_NONE): 1206b032f27cSSam Leffler return WPA_ASE_NONE; 1207b032f27cSSam Leffler } 1208b032f27cSSam Leffler return 0; /* NB: so is discarded */ 1209b032f27cSSam Leffler #undef WPA_SEL 1210b032f27cSSam Leffler } 1211b032f27cSSam Leffler 1212b032f27cSSam Leffler /* 1213b032f27cSSam Leffler * Parse a WPA information element to collect parameters. 1214b032f27cSSam Leffler * Note that we do not validate security parameters; that 1215b032f27cSSam Leffler * is handled by the authenticator; the parsing done here 1216b032f27cSSam Leffler * is just for internal use in making operational decisions. 1217b032f27cSSam Leffler */ 1218b032f27cSSam Leffler static int 1219b032f27cSSam Leffler ieee80211_parse_wpa(struct ieee80211vap *vap, const uint8_t *frm, 1220b032f27cSSam Leffler struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1221b032f27cSSam Leffler { 1222b032f27cSSam Leffler uint8_t len = frm[1]; 1223b032f27cSSam Leffler uint32_t w; 1224b032f27cSSam Leffler int n; 1225b032f27cSSam Leffler 1226b032f27cSSam Leffler /* 1227b032f27cSSam Leffler * Check the length once for fixed parts: OUI, type, 1228b032f27cSSam Leffler * version, mcast cipher, and 2 selector counts. 1229b032f27cSSam Leffler * Other, variable-length data, must be checked separately. 1230b032f27cSSam Leffler */ 1231b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_WPA1) == 0) { 1232b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1233b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1234b032f27cSSam Leffler wh, "WPA", "not WPA, flags 0x%x", vap->iv_flags); 1235b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1236b032f27cSSam Leffler } 1237b032f27cSSam Leffler if (len < 14) { 1238b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1239b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1240b032f27cSSam Leffler wh, "WPA", "too short, len %u", len); 1241b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1242b032f27cSSam Leffler } 1243b032f27cSSam Leffler frm += 6, len -= 4; /* NB: len is payload only */ 1244f59310a1SRui Paulo /* NB: iswpaoui already validated the OUI and type */ 124531021a2bSAndriy Voskoboinyk w = le16dec(frm); 1246b032f27cSSam Leffler if (w != WPA_VERSION) { 1247b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1248b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1249b032f27cSSam Leffler wh, "WPA", "bad version %u", w); 1250b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1251b032f27cSSam Leffler } 1252b032f27cSSam Leffler frm += 2, len -= 2; 1253b032f27cSSam Leffler 1254b032f27cSSam Leffler memset(rsn, 0, sizeof(*rsn)); 1255b032f27cSSam Leffler 1256b032f27cSSam Leffler /* multicast/group cipher */ 1257b032f27cSSam Leffler rsn->rsn_mcastcipher = wpa_cipher(frm, &rsn->rsn_mcastkeylen); 1258b032f27cSSam Leffler frm += 4, len -= 4; 1259b032f27cSSam Leffler 1260b032f27cSSam Leffler /* unicast ciphers */ 126131021a2bSAndriy Voskoboinyk n = le16dec(frm); 1262b032f27cSSam Leffler frm += 2, len -= 2; 1263b032f27cSSam Leffler if (len < n*4+2) { 1264b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1265b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1266b032f27cSSam Leffler wh, "WPA", "ucast cipher data too short; len %u, n %u", 1267b032f27cSSam Leffler len, n); 1268b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1269b032f27cSSam Leffler } 1270b032f27cSSam Leffler w = 0; 1271b032f27cSSam Leffler for (; n > 0; n--) { 1272b032f27cSSam Leffler w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen); 1273b032f27cSSam Leffler frm += 4, len -= 4; 1274b032f27cSSam Leffler } 1275b032f27cSSam Leffler if (w & (1<<IEEE80211_CIPHER_TKIP)) 1276b032f27cSSam Leffler rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1277b032f27cSSam Leffler else 1278b032f27cSSam Leffler rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1279b032f27cSSam Leffler 1280b032f27cSSam Leffler /* key management algorithms */ 128131021a2bSAndriy Voskoboinyk n = le16dec(frm); 1282b032f27cSSam Leffler frm += 2, len -= 2; 1283b032f27cSSam Leffler if (len < n*4) { 1284b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1285b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1286b032f27cSSam Leffler wh, "WPA", "key mgmt alg data too short; len %u, n %u", 1287b032f27cSSam Leffler len, n); 1288b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1289b032f27cSSam Leffler } 1290b032f27cSSam Leffler w = 0; 1291b032f27cSSam Leffler for (; n > 0; n--) { 1292b032f27cSSam Leffler w |= wpa_keymgmt(frm); 1293b032f27cSSam Leffler frm += 4, len -= 4; 1294b032f27cSSam Leffler } 1295b032f27cSSam Leffler if (w & WPA_ASE_8021X_UNSPEC) 1296b032f27cSSam Leffler rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC; 1297b032f27cSSam Leffler else 1298b032f27cSSam Leffler rsn->rsn_keymgmt = WPA_ASE_8021X_PSK; 1299b032f27cSSam Leffler 1300b032f27cSSam Leffler if (len > 2) /* optional capabilities */ 130131021a2bSAndriy Voskoboinyk rsn->rsn_caps = le16dec(frm); 1302b032f27cSSam Leffler 1303b032f27cSSam Leffler return 0; 1304b032f27cSSam Leffler } 1305b032f27cSSam Leffler 1306b032f27cSSam Leffler /* 1307b032f27cSSam Leffler * Convert an RSN cipher selector OUI to an internal 1308b032f27cSSam Leffler * cipher algorithm. Where appropriate we also 1309b032f27cSSam Leffler * record any key length. 1310b032f27cSSam Leffler */ 1311b032f27cSSam Leffler static int 1312b032f27cSSam Leffler rsn_cipher(const uint8_t *sel, uint8_t *keylen) 1313b032f27cSSam Leffler { 1314b032f27cSSam Leffler #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 131531021a2bSAndriy Voskoboinyk uint32_t w = le32dec(sel); 1316b032f27cSSam Leffler 1317b032f27cSSam Leffler switch (w) { 1318b032f27cSSam Leffler case RSN_SEL(RSN_CSE_NULL): 1319b032f27cSSam Leffler return IEEE80211_CIPHER_NONE; 1320b032f27cSSam Leffler case RSN_SEL(RSN_CSE_WEP40): 1321b032f27cSSam Leffler if (keylen) 1322b032f27cSSam Leffler *keylen = 40 / NBBY; 1323b032f27cSSam Leffler return IEEE80211_CIPHER_WEP; 1324b032f27cSSam Leffler case RSN_SEL(RSN_CSE_WEP104): 1325b032f27cSSam Leffler if (keylen) 1326b032f27cSSam Leffler *keylen = 104 / NBBY; 1327b032f27cSSam Leffler return IEEE80211_CIPHER_WEP; 1328b032f27cSSam Leffler case RSN_SEL(RSN_CSE_TKIP): 1329b032f27cSSam Leffler return IEEE80211_CIPHER_TKIP; 1330b032f27cSSam Leffler case RSN_SEL(RSN_CSE_CCMP): 1331b032f27cSSam Leffler return IEEE80211_CIPHER_AES_CCM; 1332b032f27cSSam Leffler case RSN_SEL(RSN_CSE_WRAP): 1333b032f27cSSam Leffler return IEEE80211_CIPHER_AES_OCB; 1334b032f27cSSam Leffler } 1335b032f27cSSam Leffler return 32; /* NB: so 1<< is discarded */ 1336b032f27cSSam Leffler #undef WPA_SEL 1337b032f27cSSam Leffler } 1338b032f27cSSam Leffler 1339b032f27cSSam Leffler /* 1340b032f27cSSam Leffler * Convert an RSN key management/authentication algorithm 1341b032f27cSSam Leffler * to an internal code. 1342b032f27cSSam Leffler */ 1343b032f27cSSam Leffler static int 1344b032f27cSSam Leffler rsn_keymgmt(const uint8_t *sel) 1345b032f27cSSam Leffler { 1346b032f27cSSam Leffler #define RSN_SEL(x) (((x)<<24)|RSN_OUI) 134731021a2bSAndriy Voskoboinyk uint32_t w = le32dec(sel); 1348b032f27cSSam Leffler 1349b032f27cSSam Leffler switch (w) { 1350b032f27cSSam Leffler case RSN_SEL(RSN_ASE_8021X_UNSPEC): 1351b032f27cSSam Leffler return RSN_ASE_8021X_UNSPEC; 1352b032f27cSSam Leffler case RSN_SEL(RSN_ASE_8021X_PSK): 1353b032f27cSSam Leffler return RSN_ASE_8021X_PSK; 1354b032f27cSSam Leffler case RSN_SEL(RSN_ASE_NONE): 1355b032f27cSSam Leffler return RSN_ASE_NONE; 1356b032f27cSSam Leffler } 1357b032f27cSSam Leffler return 0; /* NB: so is discarded */ 1358b032f27cSSam Leffler #undef RSN_SEL 1359b032f27cSSam Leffler } 1360b032f27cSSam Leffler 1361b032f27cSSam Leffler /* 1362b032f27cSSam Leffler * Parse a WPA/RSN information element to collect parameters 1363b032f27cSSam Leffler * and validate the parameters against what has been 1364b032f27cSSam Leffler * configured for the system. 1365b032f27cSSam Leffler */ 1366b032f27cSSam Leffler static int 1367b032f27cSSam Leffler ieee80211_parse_rsn(struct ieee80211vap *vap, const uint8_t *frm, 1368b032f27cSSam Leffler struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh) 1369b032f27cSSam Leffler { 1370b032f27cSSam Leffler uint8_t len = frm[1]; 1371b032f27cSSam Leffler uint32_t w; 1372b032f27cSSam Leffler int n; 1373b032f27cSSam Leffler 1374b032f27cSSam Leffler /* 1375b032f27cSSam Leffler * Check the length once for fixed parts: 1376b032f27cSSam Leffler * version, mcast cipher, and 2 selector counts. 1377b032f27cSSam Leffler * Other, variable-length data, must be checked separately. 1378b032f27cSSam Leffler */ 1379b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_WPA2) == 0) { 1380b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1381b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1382b032f27cSSam Leffler wh, "WPA", "not RSN, flags 0x%x", vap->iv_flags); 1383b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1384b032f27cSSam Leffler } 1385b032f27cSSam Leffler if (len < 10) { 1386b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1387b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1388b032f27cSSam Leffler wh, "RSN", "too short, len %u", len); 1389b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1390b032f27cSSam Leffler } 1391b032f27cSSam Leffler frm += 2; 139231021a2bSAndriy Voskoboinyk w = le16dec(frm); 1393b032f27cSSam Leffler if (w != RSN_VERSION) { 1394b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1395b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1396b032f27cSSam Leffler wh, "RSN", "bad version %u", w); 1397b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1398b032f27cSSam Leffler } 1399b032f27cSSam Leffler frm += 2, len -= 2; 1400b032f27cSSam Leffler 1401b032f27cSSam Leffler memset(rsn, 0, sizeof(*rsn)); 1402b032f27cSSam Leffler 1403b032f27cSSam Leffler /* multicast/group cipher */ 1404b032f27cSSam Leffler rsn->rsn_mcastcipher = rsn_cipher(frm, &rsn->rsn_mcastkeylen); 1405b032f27cSSam Leffler frm += 4, len -= 4; 1406b032f27cSSam Leffler 1407b032f27cSSam Leffler /* unicast ciphers */ 140831021a2bSAndriy Voskoboinyk n = le16dec(frm); 1409b032f27cSSam Leffler frm += 2, len -= 2; 1410b032f27cSSam Leffler if (len < n*4+2) { 1411b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1412b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1413b032f27cSSam Leffler wh, "RSN", "ucast cipher data too short; len %u, n %u", 1414b032f27cSSam Leffler len, n); 1415b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1416b032f27cSSam Leffler } 1417b032f27cSSam Leffler w = 0; 1418b032f27cSSam Leffler for (; n > 0; n--) { 1419b032f27cSSam Leffler w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen); 1420b032f27cSSam Leffler frm += 4, len -= 4; 1421b032f27cSSam Leffler } 1422b032f27cSSam Leffler if (w & (1<<IEEE80211_CIPHER_TKIP)) 1423b032f27cSSam Leffler rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP; 1424b032f27cSSam Leffler else 1425b032f27cSSam Leffler rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM; 1426b032f27cSSam Leffler 1427b032f27cSSam Leffler /* key management algorithms */ 142831021a2bSAndriy Voskoboinyk n = le16dec(frm); 1429b032f27cSSam Leffler frm += 2, len -= 2; 1430b032f27cSSam Leffler if (len < n*4) { 1431b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 1432b032f27cSSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA, 1433b032f27cSSam Leffler wh, "RSN", "key mgmt alg data too short; len %u, n %u", 1434b032f27cSSam Leffler len, n); 1435b032f27cSSam Leffler return IEEE80211_REASON_IE_INVALID; 1436b032f27cSSam Leffler } 1437b032f27cSSam Leffler w = 0; 1438b032f27cSSam Leffler for (; n > 0; n--) { 1439b032f27cSSam Leffler w |= rsn_keymgmt(frm); 1440b032f27cSSam Leffler frm += 4, len -= 4; 1441b032f27cSSam Leffler } 1442b032f27cSSam Leffler if (w & RSN_ASE_8021X_UNSPEC) 1443b032f27cSSam Leffler rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC; 1444b032f27cSSam Leffler else 1445b032f27cSSam Leffler rsn->rsn_keymgmt = RSN_ASE_8021X_PSK; 1446b032f27cSSam Leffler 1447b032f27cSSam Leffler /* optional RSN capabilities */ 1448b032f27cSSam Leffler if (len > 2) 144931021a2bSAndriy Voskoboinyk rsn->rsn_caps = le16dec(frm); 1450b032f27cSSam Leffler /* XXXPMKID */ 1451b032f27cSSam Leffler 1452b032f27cSSam Leffler return 0; 1453b032f27cSSam Leffler } 1454b032f27cSSam Leffler 1455b032f27cSSam Leffler /* 1456b032f27cSSam Leffler * WPA/802.11i assocation request processing. 1457b032f27cSSam Leffler */ 1458b032f27cSSam Leffler static int 1459b032f27cSSam Leffler wpa_assocreq(struct ieee80211_node *ni, struct ieee80211_rsnparms *rsnparms, 1460b032f27cSSam Leffler const struct ieee80211_frame *wh, const uint8_t *wpa, 1461b032f27cSSam Leffler const uint8_t *rsn, uint16_t capinfo) 1462b032f27cSSam Leffler { 1463b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 1464b032f27cSSam Leffler uint8_t reason; 1465b032f27cSSam Leffler int badwparsn; 1466b032f27cSSam Leffler 1467b032f27cSSam Leffler ni->ni_flags &= ~(IEEE80211_NODE_WPS|IEEE80211_NODE_TSN); 1468b032f27cSSam Leffler if (wpa == NULL && rsn == NULL) { 1469b032f27cSSam Leffler if (vap->iv_flags_ext & IEEE80211_FEXT_WPS) { 1470b032f27cSSam Leffler /* 1471b032f27cSSam Leffler * W-Fi Protected Setup (WPS) permits 1472b032f27cSSam Leffler * clients to associate and pass EAPOL frames 1473b032f27cSSam Leffler * to establish initial credentials. 1474b032f27cSSam Leffler */ 1475b032f27cSSam Leffler ni->ni_flags |= IEEE80211_NODE_WPS; 1476b032f27cSSam Leffler return 1; 1477b032f27cSSam Leffler } 1478b032f27cSSam Leffler if ((vap->iv_flags_ext & IEEE80211_FEXT_TSN) && 1479b032f27cSSam Leffler (capinfo & IEEE80211_CAPINFO_PRIVACY)) { 1480b032f27cSSam Leffler /* 1481b032f27cSSam Leffler * Transitional Security Network. Permits clients 1482b032f27cSSam Leffler * to associate and use WEP while WPA is configured. 1483b032f27cSSam Leffler */ 1484b032f27cSSam Leffler ni->ni_flags |= IEEE80211_NODE_TSN; 1485b032f27cSSam Leffler return 1; 1486b032f27cSSam Leffler } 1487b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 1488b032f27cSSam Leffler wh, NULL, "%s", "no WPA/RSN IE in association request"); 1489b032f27cSSam Leffler vap->iv_stats.is_rx_assoc_badwpaie++; 1490b032f27cSSam Leffler reason = IEEE80211_REASON_IE_INVALID; 1491b032f27cSSam Leffler goto bad; 1492b032f27cSSam Leffler } 1493b032f27cSSam Leffler /* assert right association security credentials */ 1494b032f27cSSam Leffler badwparsn = 0; /* NB: to silence compiler */ 1495b032f27cSSam Leffler switch (vap->iv_flags & IEEE80211_F_WPA) { 1496b032f27cSSam Leffler case IEEE80211_F_WPA1: 1497b032f27cSSam Leffler badwparsn = (wpa == NULL); 1498b032f27cSSam Leffler break; 1499b032f27cSSam Leffler case IEEE80211_F_WPA2: 1500b032f27cSSam Leffler badwparsn = (rsn == NULL); 1501b032f27cSSam Leffler break; 1502b032f27cSSam Leffler case IEEE80211_F_WPA1|IEEE80211_F_WPA2: 1503b032f27cSSam Leffler badwparsn = (wpa == NULL && rsn == NULL); 1504b032f27cSSam Leffler break; 1505b032f27cSSam Leffler } 1506b032f27cSSam Leffler if (badwparsn) { 1507b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, 1508b032f27cSSam Leffler wh, NULL, 1509b032f27cSSam Leffler "%s", "missing WPA/RSN IE in association request"); 1510b032f27cSSam Leffler vap->iv_stats.is_rx_assoc_badwpaie++; 1511b032f27cSSam Leffler reason = IEEE80211_REASON_IE_INVALID; 1512b032f27cSSam Leffler goto bad; 1513b032f27cSSam Leffler } 1514b032f27cSSam Leffler /* 1515b032f27cSSam Leffler * Parse WPA/RSN information element. 1516b032f27cSSam Leffler */ 1517b032f27cSSam Leffler if (wpa != NULL) 1518b032f27cSSam Leffler reason = ieee80211_parse_wpa(vap, wpa, rsnparms, wh); 1519b032f27cSSam Leffler else 1520b032f27cSSam Leffler reason = ieee80211_parse_rsn(vap, rsn, rsnparms, wh); 1521b032f27cSSam Leffler if (reason != 0) { 1522b032f27cSSam Leffler /* XXX distinguish WPA/RSN? */ 1523b032f27cSSam Leffler vap->iv_stats.is_rx_assoc_badwpaie++; 1524b032f27cSSam Leffler goto bad; 1525b032f27cSSam Leffler } 1526b032f27cSSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, ni, 1527b032f27cSSam Leffler "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x", 1528b032f27cSSam Leffler wpa != NULL ? "WPA" : "RSN", 1529b032f27cSSam Leffler rsnparms->rsn_mcastcipher, rsnparms->rsn_mcastkeylen, 1530b032f27cSSam Leffler rsnparms->rsn_ucastcipher, rsnparms->rsn_ucastkeylen, 1531b032f27cSSam Leffler rsnparms->rsn_keymgmt, rsnparms->rsn_caps); 1532b032f27cSSam Leffler 1533b032f27cSSam Leffler return 1; 1534b032f27cSSam Leffler bad: 1535b032f27cSSam Leffler ieee80211_node_deauth(ni, reason); 1536b032f27cSSam Leffler return 0; 1537b032f27cSSam Leffler } 1538b032f27cSSam Leffler 1539b032f27cSSam Leffler /* XXX find a better place for definition */ 1540b032f27cSSam Leffler struct l2_update_frame { 1541b032f27cSSam Leffler struct ether_header eh; 1542b032f27cSSam Leffler uint8_t dsap; 1543b032f27cSSam Leffler uint8_t ssap; 1544b032f27cSSam Leffler uint8_t control; 1545b032f27cSSam Leffler uint8_t xid[3]; 1546b032f27cSSam Leffler } __packed; 1547b032f27cSSam Leffler 1548b032f27cSSam Leffler /* 1549b032f27cSSam Leffler * Deliver a TGf L2UF frame on behalf of a station. 1550b032f27cSSam Leffler * This primes any bridge when the station is roaming 1551b032f27cSSam Leffler * between ap's on the same wired network. 1552b032f27cSSam Leffler */ 1553b032f27cSSam Leffler static void 1554b032f27cSSam Leffler ieee80211_deliver_l2uf(struct ieee80211_node *ni) 1555b032f27cSSam Leffler { 1556b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 1557b032f27cSSam Leffler struct ifnet *ifp = vap->iv_ifp; 1558b032f27cSSam Leffler struct mbuf *m; 1559b032f27cSSam Leffler struct l2_update_frame *l2uf; 1560b032f27cSSam Leffler struct ether_header *eh; 1561b032f27cSSam Leffler 1562b032f27cSSam Leffler m = m_gethdr(M_NOWAIT, MT_DATA); 1563b032f27cSSam Leffler if (m == NULL) { 1564b032f27cSSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni, 1565b032f27cSSam Leffler "%s", "no mbuf for l2uf frame"); 1566b032f27cSSam Leffler vap->iv_stats.is_rx_nobuf++; /* XXX not right */ 1567b032f27cSSam Leffler return; 1568b032f27cSSam Leffler } 1569b032f27cSSam Leffler l2uf = mtod(m, struct l2_update_frame *); 1570b032f27cSSam Leffler eh = &l2uf->eh; 1571b032f27cSSam Leffler /* dst: Broadcast address */ 1572b032f27cSSam Leffler IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr); 1573b032f27cSSam Leffler /* src: associated STA */ 1574b032f27cSSam Leffler IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr); 1575b032f27cSSam Leffler eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh)); 1576b032f27cSSam Leffler 1577b032f27cSSam Leffler l2uf->dsap = 0; 1578b032f27cSSam Leffler l2uf->ssap = 0; 1579b032f27cSSam Leffler l2uf->control = 0xf5; 1580b032f27cSSam Leffler l2uf->xid[0] = 0x81; 1581b032f27cSSam Leffler l2uf->xid[1] = 0x80; 1582b032f27cSSam Leffler l2uf->xid[2] = 0x00; 1583b032f27cSSam Leffler 1584b032f27cSSam Leffler m->m_pkthdr.len = m->m_len = sizeof(*l2uf); 1585b032f27cSSam Leffler hostap_deliver_data(vap, ni, m); 1586b032f27cSSam Leffler } 1587b032f27cSSam Leffler 1588b032f27cSSam Leffler static void 1589b032f27cSSam Leffler ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh, 1590b032f27cSSam Leffler int reassoc, int resp, const char *tag, int rate) 1591b032f27cSSam Leffler { 1592b032f27cSSam Leffler IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2, 1593b032f27cSSam Leffler "deny %s request, %s rate set mismatch, rate/MCS %d", 1594b032f27cSSam Leffler reassoc ? "reassoc" : "assoc", tag, rate & IEEE80211_RATE_VAL); 1595b032f27cSSam Leffler IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_BASIC_RATE); 1596b032f27cSSam Leffler ieee80211_node_leave(ni); 1597b032f27cSSam Leffler } 1598b032f27cSSam Leffler 1599b032f27cSSam Leffler static void 1600b032f27cSSam Leffler capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh, 1601b032f27cSSam Leffler int reassoc, int resp, const char *tag, int capinfo) 1602b032f27cSSam Leffler { 1603b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 1604b032f27cSSam Leffler 1605b032f27cSSam Leffler IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2, 1606b032f27cSSam Leffler "deny %s request, %s mismatch 0x%x", 1607b032f27cSSam Leffler reassoc ? "reassoc" : "assoc", tag, capinfo); 1608b032f27cSSam Leffler IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_CAPINFO); 1609b032f27cSSam Leffler ieee80211_node_leave(ni); 1610b032f27cSSam Leffler vap->iv_stats.is_rx_assoc_capmismatch++; 1611b032f27cSSam Leffler } 1612b032f27cSSam Leffler 1613b032f27cSSam Leffler static void 1614b032f27cSSam Leffler htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh, 1615b032f27cSSam Leffler int reassoc, int resp) 1616b032f27cSSam Leffler { 1617b032f27cSSam Leffler IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2, 1618b032f27cSSam Leffler "deny %s request, %s missing HT ie", reassoc ? "reassoc" : "assoc"); 1619b032f27cSSam Leffler /* XXX no better code */ 1620b8ee2a22SSam Leffler IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_MISSING_HT_CAPS); 1621b032f27cSSam Leffler ieee80211_node_leave(ni); 1622b032f27cSSam Leffler } 1623b032f27cSSam Leffler 1624b032f27cSSam Leffler static void 1625b032f27cSSam Leffler authalgreject(struct ieee80211_node *ni, const struct ieee80211_frame *wh, 1626b032f27cSSam Leffler int algo, int seq, int status) 1627b032f27cSSam Leffler { 1628b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 1629b032f27cSSam Leffler 1630b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY, 1631b032f27cSSam Leffler wh, NULL, "unsupported alg %d", algo); 1632b032f27cSSam Leffler vap->iv_stats.is_rx_auth_unsupported++; 1633b032f27cSSam Leffler ieee80211_send_error(ni, wh->i_addr2, IEEE80211_FC0_SUBTYPE_AUTH, 1634b032f27cSSam Leffler seq | (status << 16)); 1635b032f27cSSam Leffler } 1636b032f27cSSam Leffler 1637b032f27cSSam Leffler static __inline int 1638b032f27cSSam Leffler ishtmixed(const uint8_t *ie) 1639b032f27cSSam Leffler { 1640b032f27cSSam Leffler const struct ieee80211_ie_htinfo *ht = 1641b032f27cSSam Leffler (const struct ieee80211_ie_htinfo *) ie; 1642b032f27cSSam Leffler return (ht->hi_byte2 & IEEE80211_HTINFO_OPMODE) == 1643b032f27cSSam Leffler IEEE80211_HTINFO_OPMODE_MIXED; 1644b032f27cSSam Leffler } 1645b032f27cSSam Leffler 1646b032f27cSSam Leffler static int 1647b032f27cSSam Leffler is11bclient(const uint8_t *rates, const uint8_t *xrates) 1648b032f27cSSam Leffler { 1649b032f27cSSam Leffler static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11); 1650b032f27cSSam Leffler int i; 1651b032f27cSSam Leffler 1652b032f27cSSam Leffler /* NB: the 11b clients we care about will not have xrates */ 1653b032f27cSSam Leffler if (xrates != NULL || rates == NULL) 1654b032f27cSSam Leffler return 0; 1655b032f27cSSam Leffler for (i = 0; i < rates[1]; i++) { 1656b032f27cSSam Leffler int r = rates[2+i] & IEEE80211_RATE_VAL; 1657b032f27cSSam Leffler if (r > 2*11 || ((1<<r) & brates) == 0) 1658b032f27cSSam Leffler return 0; 1659b032f27cSSam Leffler } 1660b032f27cSSam Leffler return 1; 1661b032f27cSSam Leffler } 1662b032f27cSSam Leffler 1663b032f27cSSam Leffler static void 1664b032f27cSSam Leffler hostap_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, 1665c79f192cSAdrian Chadd int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf) 1666b032f27cSSam Leffler { 1667b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 1668b032f27cSSam Leffler struct ieee80211com *ic = ni->ni_ic; 1669b032f27cSSam Leffler struct ieee80211_frame *wh; 1670b032f27cSSam Leffler uint8_t *frm, *efrm, *sfrm; 1671b032f27cSSam Leffler uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap; 1672b032f27cSSam Leffler int reassoc, resp; 1673b032f27cSSam Leffler uint8_t rate; 1674b032f27cSSam Leffler 1675b032f27cSSam Leffler wh = mtod(m0, struct ieee80211_frame *); 1676b032f27cSSam Leffler frm = (uint8_t *)&wh[1]; 1677b032f27cSSam Leffler efrm = mtod(m0, uint8_t *) + m0->m_len; 1678b032f27cSSam Leffler switch (subtype) { 1679b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 1680b032f27cSSam Leffler /* 1681b032f27cSSam Leffler * We process beacon/probe response frames when scanning; 1682b032f27cSSam Leffler * otherwise we check beacon frames for overlapping non-ERP 1683b032f27cSSam Leffler * BSS in 11g and/or overlapping legacy BSS when in HT. 1684b032f27cSSam Leffler */ 16854ba33fd1SAndriy Voskoboinyk if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) { 1686b032f27cSSam Leffler vap->iv_stats.is_rx_mgtdiscard++; 1687b032f27cSSam Leffler return; 1688b032f27cSSam Leffler } 16894ba33fd1SAndriy Voskoboinyk /* FALLTHROUGH */ 16904ba33fd1SAndriy Voskoboinyk case IEEE80211_FC0_SUBTYPE_BEACON: { 16914ba33fd1SAndriy Voskoboinyk struct ieee80211_scanparams scan; 16924ba33fd1SAndriy Voskoboinyk 1693b032f27cSSam Leffler /* NB: accept off-channel frames */ 1694c79f192cSAdrian Chadd /* XXX TODO: use rxstatus to determine off-channel details */ 1695c79f192cSAdrian Chadd if (ieee80211_parse_beacon(ni, m0, ic->ic_curchan, &scan) &~ IEEE80211_BPARSE_OFFCHAN) 1696b032f27cSSam Leffler return; 1697b032f27cSSam Leffler /* 1698b032f27cSSam Leffler * Count frame now that we know it's to be processed. 1699b032f27cSSam Leffler */ 1700b032f27cSSam Leffler if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) { 1701b032f27cSSam Leffler vap->iv_stats.is_rx_beacon++; /* XXX remove */ 1702b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_beacons); 1703b032f27cSSam Leffler } else 1704b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_proberesp); 1705b032f27cSSam Leffler /* 1706b032f27cSSam Leffler * If scanning, just pass information to the scan module. 1707b032f27cSSam Leffler */ 1708b032f27cSSam Leffler if (ic->ic_flags & IEEE80211_F_SCAN) { 1709b032f27cSSam Leffler if (scan.status == 0 && /* NB: on channel */ 1710b032f27cSSam Leffler (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN)) { 1711b032f27cSSam Leffler /* 1712b032f27cSSam Leffler * Actively scanning a channel marked passive; 1713b032f27cSSam Leffler * send a probe request now that we know there 1714b032f27cSSam Leffler * is 802.11 traffic present. 1715b032f27cSSam Leffler * 1716b032f27cSSam Leffler * XXX check if the beacon we recv'd gives 1717b032f27cSSam Leffler * us what we need and suppress the probe req 1718b032f27cSSam Leffler */ 1719b032f27cSSam Leffler ieee80211_probe_curchan(vap, 1); 1720b032f27cSSam Leffler ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN; 1721b032f27cSSam Leffler } 17222808a02bSAdrian Chadd ieee80211_add_scan(vap, ic->ic_curchan, &scan, wh, 17232808a02bSAdrian Chadd subtype, rssi, nf); 1724b032f27cSSam Leffler return; 1725b032f27cSSam Leffler } 1726b032f27cSSam Leffler /* 1727b032f27cSSam Leffler * Check beacon for overlapping bss w/ non ERP stations. 1728b032f27cSSam Leffler * If we detect one and protection is configured but not 1729b032f27cSSam Leffler * enabled, enable it and start a timer that'll bring us 1730b032f27cSSam Leffler * out if we stop seeing the bss. 1731b032f27cSSam Leffler */ 1732b032f27cSSam Leffler if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) && 1733b032f27cSSam Leffler scan.status == 0 && /* NB: on-channel */ 1734b032f27cSSam Leffler ((scan.erp & 0x100) == 0 || /* NB: no ERP, 11b sta*/ 1735b032f27cSSam Leffler (scan.erp & IEEE80211_ERP_NON_ERP_PRESENT))) { 1736b032f27cSSam Leffler ic->ic_lastnonerp = ticks; 1737b032f27cSSam Leffler ic->ic_flags_ext |= IEEE80211_FEXT_NONERP_PR; 1738b032f27cSSam Leffler if (ic->ic_protmode != IEEE80211_PROT_NONE && 1739b032f27cSSam Leffler (ic->ic_flags & IEEE80211_F_USEPROT) == 0) { 1740b032f27cSSam Leffler IEEE80211_NOTE_FRAME(vap, 1741b032f27cSSam Leffler IEEE80211_MSG_ASSOC, wh, 1742b032f27cSSam Leffler "non-ERP present on channel %d " 1743b032f27cSSam Leffler "(saw erp 0x%x from channel %d), " 1744b032f27cSSam Leffler "enable use of protection", 1745b032f27cSSam Leffler ic->ic_curchan->ic_ieee, 1746b032f27cSSam Leffler scan.erp, scan.chan); 1747b032f27cSSam Leffler ic->ic_flags |= IEEE80211_F_USEPROT; 1748b032f27cSSam Leffler ieee80211_notify_erp(ic); 1749b032f27cSSam Leffler } 1750b032f27cSSam Leffler } 1751b032f27cSSam Leffler /* 1752b032f27cSSam Leffler * Check beacon for non-HT station on HT channel 1753b032f27cSSam Leffler * and update HT BSS occupancy as appropriate. 1754b032f27cSSam Leffler */ 1755b032f27cSSam Leffler if (IEEE80211_IS_CHAN_HT(ic->ic_curchan)) { 1756b032f27cSSam Leffler if (scan.status & IEEE80211_BPARSE_OFFCHAN) { 1757b032f27cSSam Leffler /* 1758b032f27cSSam Leffler * Off control channel; only check frames 1759b032f27cSSam Leffler * that come in the extension channel when 1760b032f27cSSam Leffler * operating w/ HT40. 1761b032f27cSSam Leffler */ 1762b032f27cSSam Leffler if (!IEEE80211_IS_CHAN_HT40(ic->ic_curchan)) 1763b032f27cSSam Leffler break; 1764b032f27cSSam Leffler if (scan.chan != ic->ic_curchan->ic_extieee) 1765b032f27cSSam Leffler break; 1766b032f27cSSam Leffler } 1767b032f27cSSam Leffler if (scan.htinfo == NULL) { 1768b032f27cSSam Leffler ieee80211_htprot_update(ic, 1769b032f27cSSam Leffler IEEE80211_HTINFO_OPMODE_PROTOPT | 1770b032f27cSSam Leffler IEEE80211_HTINFO_NONHT_PRESENT); 1771b032f27cSSam Leffler } else if (ishtmixed(scan.htinfo)) { 1772b032f27cSSam Leffler /* XXX? take NONHT_PRESENT from beacon? */ 1773b032f27cSSam Leffler ieee80211_htprot_update(ic, 1774b032f27cSSam Leffler IEEE80211_HTINFO_OPMODE_MIXED | 1775b032f27cSSam Leffler IEEE80211_HTINFO_NONHT_PRESENT); 1776b032f27cSSam Leffler } 1777b032f27cSSam Leffler } 1778b032f27cSSam Leffler break; 1779b032f27cSSam Leffler } 1780b032f27cSSam Leffler 1781b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 1782b032f27cSSam Leffler if (vap->iv_state != IEEE80211_S_RUN) { 1783b032f27cSSam Leffler vap->iv_stats.is_rx_mgtdiscard++; 1784b032f27cSSam Leffler return; 1785b032f27cSSam Leffler } 1786b032f27cSSam Leffler /* 1787957458a8SAdrian Chadd * Consult the ACL policy module if setup. 1788957458a8SAdrian Chadd */ 17895a8801b0SBernhard Schmidt if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) { 1790957458a8SAdrian Chadd IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL, 1791957458a8SAdrian Chadd wh, NULL, "%s", "disallowed by ACL"); 1792957458a8SAdrian Chadd vap->iv_stats.is_rx_acl++; 1793957458a8SAdrian Chadd return; 1794957458a8SAdrian Chadd } 1795957458a8SAdrian Chadd /* 1796b032f27cSSam Leffler * prreq frame format 1797b032f27cSSam Leffler * [tlv] ssid 1798b032f27cSSam Leffler * [tlv] supported rates 1799b032f27cSSam Leffler * [tlv] extended supported rates 1800b032f27cSSam Leffler */ 1801b032f27cSSam Leffler ssid = rates = xrates = NULL; 1802b032f27cSSam Leffler sfrm = frm; 1803b032f27cSSam Leffler while (efrm - frm > 1) { 1804b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return); 1805b032f27cSSam Leffler switch (*frm) { 1806b032f27cSSam Leffler case IEEE80211_ELEMID_SSID: 1807b032f27cSSam Leffler ssid = frm; 1808b032f27cSSam Leffler break; 1809b032f27cSSam Leffler case IEEE80211_ELEMID_RATES: 1810b032f27cSSam Leffler rates = frm; 1811b032f27cSSam Leffler break; 1812b032f27cSSam Leffler case IEEE80211_ELEMID_XRATES: 1813b032f27cSSam Leffler xrates = frm; 1814b032f27cSSam Leffler break; 1815b032f27cSSam Leffler } 1816b032f27cSSam Leffler frm += frm[1] + 2; 1817b032f27cSSam Leffler } 1818b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return); 1819b032f27cSSam Leffler if (xrates != NULL) 1820b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(xrates, 1821b032f27cSSam Leffler IEEE80211_RATE_MAXSIZE - rates[1], return); 1822b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return); 1823b032f27cSSam Leffler IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return); 1824b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) { 1825b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 1826b032f27cSSam Leffler wh, NULL, 1827b032f27cSSam Leffler "%s", "no ssid with ssid suppression enabled"); 1828b032f27cSSam Leffler vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/ 1829b032f27cSSam Leffler return; 1830b032f27cSSam Leffler } 1831b032f27cSSam Leffler 1832b032f27cSSam Leffler /* XXX find a better class or define it's own */ 1833b032f27cSSam Leffler IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2, 1834b032f27cSSam Leffler "%s", "recv probe req"); 1835b032f27cSSam Leffler /* 1836b032f27cSSam Leffler * Some legacy 11b clients cannot hack a complete 1837b032f27cSSam Leffler * probe response frame. When the request includes 1838b032f27cSSam Leffler * only a bare-bones rate set, communicate this to 1839b032f27cSSam Leffler * the transmit side. 1840b032f27cSSam Leffler */ 1841b032f27cSSam Leffler ieee80211_send_proberesp(vap, wh->i_addr2, 1842b032f27cSSam Leffler is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0); 1843b032f27cSSam Leffler break; 1844b032f27cSSam Leffler 1845b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_AUTH: { 1846b032f27cSSam Leffler uint16_t algo, seq, status; 1847b032f27cSSam Leffler 1848b032f27cSSam Leffler if (vap->iv_state != IEEE80211_S_RUN) { 1849b032f27cSSam Leffler vap->iv_stats.is_rx_mgtdiscard++; 1850b032f27cSSam Leffler return; 1851b032f27cSSam Leffler } 1852b032f27cSSam Leffler if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) { 1853b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY, 1854b032f27cSSam Leffler wh, NULL, "%s", "wrong bssid"); 1855b032f27cSSam Leffler vap->iv_stats.is_rx_wrongbss++; /*XXX unique stat?*/ 1856b032f27cSSam Leffler return; 1857b032f27cSSam Leffler } 1858b032f27cSSam Leffler /* 1859b032f27cSSam Leffler * auth frame format 1860b032f27cSSam Leffler * [2] algorithm 1861b032f27cSSam Leffler * [2] sequence 1862b032f27cSSam Leffler * [2] status 1863b032f27cSSam Leffler * [tlv*] challenge 1864b032f27cSSam Leffler */ 1865b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return); 1866b032f27cSSam Leffler algo = le16toh(*(uint16_t *)frm); 1867b032f27cSSam Leffler seq = le16toh(*(uint16_t *)(frm + 2)); 1868b032f27cSSam Leffler status = le16toh(*(uint16_t *)(frm + 4)); 1869b032f27cSSam Leffler IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2, 1870b032f27cSSam Leffler "recv auth frame with algorithm %d seq %d", algo, seq); 1871b032f27cSSam Leffler /* 1872b032f27cSSam Leffler * Consult the ACL policy module if setup. 1873b032f27cSSam Leffler */ 18745a8801b0SBernhard Schmidt if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) { 1875b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL, 1876b032f27cSSam Leffler wh, NULL, "%s", "disallowed by ACL"); 1877b032f27cSSam Leffler vap->iv_stats.is_rx_acl++; 1878b032f27cSSam Leffler ieee80211_send_error(ni, wh->i_addr2, 1879b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_AUTH, 1880b032f27cSSam Leffler (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16)); 1881b032f27cSSam Leffler return; 1882b032f27cSSam Leffler } 1883b032f27cSSam Leffler if (vap->iv_flags & IEEE80211_F_COUNTERM) { 1884b032f27cSSam Leffler IEEE80211_DISCARD(vap, 1885b032f27cSSam Leffler IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO, 1886b032f27cSSam Leffler wh, NULL, "%s", "TKIP countermeasures enabled"); 1887b032f27cSSam Leffler vap->iv_stats.is_rx_auth_countermeasures++; 1888b032f27cSSam Leffler ieee80211_send_error(ni, wh->i_addr2, 1889b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_AUTH, 1890b032f27cSSam Leffler IEEE80211_REASON_MIC_FAILURE); 1891b032f27cSSam Leffler return; 1892b032f27cSSam Leffler } 1893b032f27cSSam Leffler if (algo == IEEE80211_AUTH_ALG_SHARED) 18945463c4a4SSam Leffler hostap_auth_shared(ni, wh, frm + 6, efrm, rssi, nf, 1895b032f27cSSam Leffler seq, status); 18965463c4a4SSam Leffler else if (algo == IEEE80211_AUTH_ALG_OPEN) 18975463c4a4SSam Leffler hostap_auth_open(ni, wh, rssi, nf, seq, status); 1898b032f27cSSam Leffler else if (algo == IEEE80211_AUTH_ALG_LEAP) { 1899b032f27cSSam Leffler authalgreject(ni, wh, algo, 1900b032f27cSSam Leffler seq+1, IEEE80211_STATUS_ALG); 1901b032f27cSSam Leffler return; 1902b032f27cSSam Leffler } else { 1903b032f27cSSam Leffler /* 1904b032f27cSSam Leffler * We assume that an unknown algorithm is the result 1905b032f27cSSam Leffler * of a decryption failure on a shared key auth frame; 1906b032f27cSSam Leffler * return a status code appropriate for that instead 1907b032f27cSSam Leffler * of IEEE80211_STATUS_ALG. 1908b032f27cSSam Leffler * 1909b032f27cSSam Leffler * NB: a seq# of 4 is intentional; the decrypted 1910b032f27cSSam Leffler * frame likely has a bogus seq value. 1911b032f27cSSam Leffler */ 1912b032f27cSSam Leffler authalgreject(ni, wh, algo, 1913b032f27cSSam Leffler 4, IEEE80211_STATUS_CHALLENGE); 1914b032f27cSSam Leffler return; 1915b032f27cSSam Leffler } 1916b032f27cSSam Leffler break; 1917b032f27cSSam Leffler } 1918b032f27cSSam Leffler 1919b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 1920b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: { 1921b032f27cSSam Leffler uint16_t capinfo, lintval; 1922b032f27cSSam Leffler struct ieee80211_rsnparms rsnparms; 1923b032f27cSSam Leffler 1924b032f27cSSam Leffler if (vap->iv_state != IEEE80211_S_RUN) { 1925b032f27cSSam Leffler vap->iv_stats.is_rx_mgtdiscard++; 1926b032f27cSSam Leffler return; 1927b032f27cSSam Leffler } 1928b032f27cSSam Leffler if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) { 1929b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY, 1930b032f27cSSam Leffler wh, NULL, "%s", "wrong bssid"); 1931b032f27cSSam Leffler vap->iv_stats.is_rx_assoc_bss++; 1932b032f27cSSam Leffler return; 1933b032f27cSSam Leffler } 1934b032f27cSSam Leffler if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 1935b032f27cSSam Leffler reassoc = 1; 1936b032f27cSSam Leffler resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP; 1937b032f27cSSam Leffler } else { 1938b032f27cSSam Leffler reassoc = 0; 1939b032f27cSSam Leffler resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP; 1940b032f27cSSam Leffler } 1941b032f27cSSam Leffler if (ni == vap->iv_bss) { 1942b032f27cSSam Leffler IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2, 1943b032f27cSSam Leffler "deny %s request, sta not authenticated", 1944b032f27cSSam Leffler reassoc ? "reassoc" : "assoc"); 1945b032f27cSSam Leffler ieee80211_send_error(ni, wh->i_addr2, 1946b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_DEAUTH, 1947b032f27cSSam Leffler IEEE80211_REASON_ASSOC_NOT_AUTHED); 1948b032f27cSSam Leffler vap->iv_stats.is_rx_assoc_notauth++; 1949b032f27cSSam Leffler return; 1950b032f27cSSam Leffler } 1951b032f27cSSam Leffler 1952b032f27cSSam Leffler /* 1953b032f27cSSam Leffler * asreq frame format 1954b032f27cSSam Leffler * [2] capability information 1955b032f27cSSam Leffler * [2] listen interval 1956b032f27cSSam Leffler * [6*] current AP address (reassoc only) 1957b032f27cSSam Leffler * [tlv] ssid 1958b032f27cSSam Leffler * [tlv] supported rates 1959b032f27cSSam Leffler * [tlv] extended supported rates 1960b032f27cSSam Leffler * [tlv] WPA or RSN 1961b032f27cSSam Leffler * [tlv] HT capabilities 1962b032f27cSSam Leffler * [tlv] Atheros capabilities 1963b032f27cSSam Leffler */ 1964b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return); 1965b032f27cSSam Leffler capinfo = le16toh(*(uint16_t *)frm); frm += 2; 1966b032f27cSSam Leffler lintval = le16toh(*(uint16_t *)frm); frm += 2; 1967b032f27cSSam Leffler if (reassoc) 1968b032f27cSSam Leffler frm += 6; /* ignore current AP info */ 1969b032f27cSSam Leffler ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL; 1970b032f27cSSam Leffler sfrm = frm; 1971b032f27cSSam Leffler while (efrm - frm > 1) { 1972b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return); 1973b032f27cSSam Leffler switch (*frm) { 1974b032f27cSSam Leffler case IEEE80211_ELEMID_SSID: 1975b032f27cSSam Leffler ssid = frm; 1976b032f27cSSam Leffler break; 1977b032f27cSSam Leffler case IEEE80211_ELEMID_RATES: 1978b032f27cSSam Leffler rates = frm; 1979b032f27cSSam Leffler break; 1980b032f27cSSam Leffler case IEEE80211_ELEMID_XRATES: 1981b032f27cSSam Leffler xrates = frm; 1982b032f27cSSam Leffler break; 1983b032f27cSSam Leffler case IEEE80211_ELEMID_RSN: 1984b032f27cSSam Leffler rsn = frm; 1985b032f27cSSam Leffler break; 1986b032f27cSSam Leffler case IEEE80211_ELEMID_HTCAP: 1987b032f27cSSam Leffler htcap = frm; 1988b032f27cSSam Leffler break; 1989b032f27cSSam Leffler case IEEE80211_ELEMID_VENDOR: 1990b032f27cSSam Leffler if (iswpaoui(frm)) 1991b032f27cSSam Leffler wpa = frm; 1992b032f27cSSam Leffler else if (iswmeinfo(frm)) 1993b032f27cSSam Leffler wme = frm; 1994616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG 1995b032f27cSSam Leffler else if (isatherosoui(frm)) 1996b032f27cSSam Leffler ath = frm; 1997616190d0SSam Leffler #endif 19982bfc8a91SSam Leffler else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) { 1999b032f27cSSam Leffler if (ishtcapoui(frm) && htcap == NULL) 2000b032f27cSSam Leffler htcap = frm; 2001b032f27cSSam Leffler } 2002b032f27cSSam Leffler break; 2003b032f27cSSam Leffler } 2004b032f27cSSam Leffler frm += frm[1] + 2; 2005b032f27cSSam Leffler } 2006b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return); 2007b032f27cSSam Leffler if (xrates != NULL) 2008b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(xrates, 2009b032f27cSSam Leffler IEEE80211_RATE_MAXSIZE - rates[1], return); 2010b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return); 2011b032f27cSSam Leffler IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return); 2012b032f27cSSam Leffler if (htcap != NULL) { 2013b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(htcap[1], 2014b032f27cSSam Leffler htcap[0] == IEEE80211_ELEMID_VENDOR ? 2015b032f27cSSam Leffler 4 + sizeof(struct ieee80211_ie_htcap)-2 : 2016b032f27cSSam Leffler sizeof(struct ieee80211_ie_htcap)-2, 2017b032f27cSSam Leffler return); /* XXX just NULL out? */ 2018b032f27cSSam Leffler } 2019b032f27cSSam Leffler 2020b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_WPA) && 2021b032f27cSSam Leffler !wpa_assocreq(ni, &rsnparms, wh, wpa, rsn, capinfo)) 2022b032f27cSSam Leffler return; 2023b032f27cSSam Leffler /* discard challenge after association */ 2024b032f27cSSam Leffler if (ni->ni_challenge != NULL) { 2025b9b53389SAdrian Chadd IEEE80211_FREE(ni->ni_challenge, M_80211_NODE); 2026b032f27cSSam Leffler ni->ni_challenge = NULL; 2027b032f27cSSam Leffler } 2028b032f27cSSam Leffler /* NB: 802.11 spec says to ignore station's privacy bit */ 2029b032f27cSSam Leffler if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) { 2030b032f27cSSam Leffler capinfomismatch(ni, wh, reassoc, resp, 2031b032f27cSSam Leffler "capability", capinfo); 2032b032f27cSSam Leffler return; 2033b032f27cSSam Leffler } 2034b032f27cSSam Leffler /* 2035b032f27cSSam Leffler * Disallow re-associate w/ invalid slot time setting. 2036b032f27cSSam Leffler */ 2037b032f27cSSam Leffler if (ni->ni_associd != 0 && 2038b032f27cSSam Leffler IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) && 2039b032f27cSSam Leffler ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) { 2040b032f27cSSam Leffler capinfomismatch(ni, wh, reassoc, resp, 2041b032f27cSSam Leffler "slot time", capinfo); 2042b032f27cSSam Leffler return; 2043b032f27cSSam Leffler } 2044b032f27cSSam Leffler rate = ieee80211_setup_rates(ni, rates, xrates, 2045b032f27cSSam Leffler IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 2046b032f27cSSam Leffler IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 2047b032f27cSSam Leffler if (rate & IEEE80211_RATE_BASIC) { 2048b032f27cSSam Leffler ratesetmismatch(ni, wh, reassoc, resp, "legacy", rate); 2049b032f27cSSam Leffler vap->iv_stats.is_rx_assoc_norate++; 2050b032f27cSSam Leffler return; 2051b032f27cSSam Leffler } 2052b032f27cSSam Leffler /* 2053b032f27cSSam Leffler * If constrained to 11g-only stations reject an 2054b032f27cSSam Leffler * 11b-only station. We cheat a bit here by looking 2055b032f27cSSam Leffler * at the max negotiated xmit rate and assuming anyone 2056b032f27cSSam Leffler * with a best rate <24Mb/s is an 11b station. 2057b032f27cSSam Leffler */ 2058b032f27cSSam Leffler if ((vap->iv_flags & IEEE80211_F_PUREG) && rate < 48) { 2059b032f27cSSam Leffler ratesetmismatch(ni, wh, reassoc, resp, "11g", rate); 2060b032f27cSSam Leffler vap->iv_stats.is_rx_assoc_norate++; 2061b032f27cSSam Leffler return; 2062b032f27cSSam Leffler } 2063b032f27cSSam Leffler /* 2064b032f27cSSam Leffler * Do HT rate set handling and setup HT node state. 2065b032f27cSSam Leffler */ 2066b032f27cSSam Leffler ni->ni_chan = vap->iv_bss->ni_chan; 2067b032f27cSSam Leffler if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && htcap != NULL) { 2068b032f27cSSam Leffler rate = ieee80211_setup_htrates(ni, htcap, 2069b032f27cSSam Leffler IEEE80211_F_DOFMCS | IEEE80211_F_DONEGO | 2070b032f27cSSam Leffler IEEE80211_F_DOBRS); 2071b032f27cSSam Leffler if (rate & IEEE80211_RATE_BASIC) { 2072b032f27cSSam Leffler ratesetmismatch(ni, wh, reassoc, resp, 2073b032f27cSSam Leffler "HT", rate); 2074b032f27cSSam Leffler vap->iv_stats.is_ht_assoc_norate++; 2075b032f27cSSam Leffler return; 2076b032f27cSSam Leffler } 2077fdabd982SSam Leffler ieee80211_ht_node_init(ni); 2078fdabd982SSam Leffler ieee80211_ht_updatehtcap(ni, htcap); 2079b032f27cSSam Leffler } else if (ni->ni_flags & IEEE80211_NODE_HT) 2080b032f27cSSam Leffler ieee80211_ht_node_cleanup(ni); 2081339ccfb3SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG 20820e6cbef2SAdrian Chadd /* Always do ff node cleanup; for A-MSDU */ 2083339ccfb3SSam Leffler ieee80211_ff_node_cleanup(ni); 2084339ccfb3SSam Leffler #endif 2085b032f27cSSam Leffler /* 2086b032f27cSSam Leffler * Allow AMPDU operation only with unencrypted traffic 2087b032f27cSSam Leffler * or AES-CCM; the 11n spec only specifies these ciphers 2088b032f27cSSam Leffler * so permitting any others is undefined and can lead 2089b032f27cSSam Leffler * to interoperability problems. 2090b032f27cSSam Leffler */ 2091b032f27cSSam Leffler if ((ni->ni_flags & IEEE80211_NODE_HT) && 2092b032f27cSSam Leffler (((vap->iv_flags & IEEE80211_F_WPA) && 2093b032f27cSSam Leffler rsnparms.rsn_ucastcipher != IEEE80211_CIPHER_AES_CCM) || 2094b032f27cSSam Leffler (vap->iv_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) { 2095b032f27cSSam Leffler IEEE80211_NOTE(vap, 2096b032f27cSSam Leffler IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni, 2097b032f27cSSam Leffler "disallow HT use because WEP or TKIP requested, " 2098b032f27cSSam Leffler "capinfo 0x%x ucastcipher %d", capinfo, 2099b032f27cSSam Leffler rsnparms.rsn_ucastcipher); 2100b032f27cSSam Leffler ieee80211_ht_node_cleanup(ni); 21010e6cbef2SAdrian Chadd #ifdef IEEE80211_SUPPORT_SUPERG 21020e6cbef2SAdrian Chadd /* Always do ff node cleanup; for A-MSDU */ 21030e6cbef2SAdrian Chadd ieee80211_ff_node_cleanup(ni); 21040e6cbef2SAdrian Chadd #endif 2105b032f27cSSam Leffler vap->iv_stats.is_ht_assoc_downgrade++; 2106b032f27cSSam Leffler } 2107b032f27cSSam Leffler /* 2108b032f27cSSam Leffler * If constrained to 11n-only stations reject legacy stations. 2109b032f27cSSam Leffler */ 21102bfc8a91SSam Leffler if ((vap->iv_flags_ht & IEEE80211_FHT_PUREN) && 2111b032f27cSSam Leffler (ni->ni_flags & IEEE80211_NODE_HT) == 0) { 2112b032f27cSSam Leffler htcapmismatch(ni, wh, reassoc, resp); 2113b032f27cSSam Leffler vap->iv_stats.is_ht_assoc_nohtcap++; 2114b032f27cSSam Leffler return; 2115b032f27cSSam Leffler } 2116b032f27cSSam Leffler IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi); 21175463c4a4SSam Leffler ni->ni_noise = nf; 2118b032f27cSSam Leffler ni->ni_intval = lintval; 2119b032f27cSSam Leffler ni->ni_capinfo = capinfo; 2120b032f27cSSam Leffler ni->ni_fhdwell = vap->iv_bss->ni_fhdwell; 2121b032f27cSSam Leffler ni->ni_fhindex = vap->iv_bss->ni_fhindex; 2122b032f27cSSam Leffler /* 2123b032f27cSSam Leffler * Store the IEs. 2124b032f27cSSam Leffler * XXX maybe better to just expand 2125b032f27cSSam Leffler */ 2126b032f27cSSam Leffler if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) { 2127b032f27cSSam Leffler #define setie(_ie, _off) ieee80211_ies_setie(ni->ni_ies, _ie, _off) 2128b032f27cSSam Leffler if (wpa != NULL) 2129b032f27cSSam Leffler setie(wpa_ie, wpa - sfrm); 2130b032f27cSSam Leffler if (rsn != NULL) 2131b032f27cSSam Leffler setie(rsn_ie, rsn - sfrm); 2132b032f27cSSam Leffler if (htcap != NULL) 2133b032f27cSSam Leffler setie(htcap_ie, htcap - sfrm); 2134b032f27cSSam Leffler if (wme != NULL) { 2135b032f27cSSam Leffler setie(wme_ie, wme - sfrm); 2136b032f27cSSam Leffler /* 2137b032f27cSSam Leffler * Mark node as capable of QoS. 2138b032f27cSSam Leffler */ 2139b032f27cSSam Leffler ni->ni_flags |= IEEE80211_NODE_QOS; 2140b032f27cSSam Leffler } else 2141b032f27cSSam Leffler ni->ni_flags &= ~IEEE80211_NODE_QOS; 2142616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG 2143b032f27cSSam Leffler if (ath != NULL) { 2144b032f27cSSam Leffler setie(ath_ie, ath - sfrm); 2145b032f27cSSam Leffler /* 2146b032f27cSSam Leffler * Parse ATH station parameters. 2147b032f27cSSam Leffler */ 2148b032f27cSSam Leffler ieee80211_parse_ath(ni, ni->ni_ies.ath_ie); 2149b032f27cSSam Leffler } else 2150616190d0SSam Leffler #endif 2151b032f27cSSam Leffler ni->ni_ath_flags = 0; 2152b032f27cSSam Leffler #undef setie 2153b032f27cSSam Leffler } else { 2154b032f27cSSam Leffler ni->ni_flags &= ~IEEE80211_NODE_QOS; 2155b032f27cSSam Leffler ni->ni_ath_flags = 0; 2156b032f27cSSam Leffler } 2157b032f27cSSam Leffler ieee80211_node_join(ni, resp); 2158b032f27cSSam Leffler ieee80211_deliver_l2uf(ni); 2159b032f27cSSam Leffler break; 2160b032f27cSSam Leffler } 2161b032f27cSSam Leffler 2162b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_DEAUTH: 2163b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_DISASSOC: { 2164b032f27cSSam Leffler uint16_t reason; 2165b032f27cSSam Leffler 2166b032f27cSSam Leffler if (vap->iv_state != IEEE80211_S_RUN || 2167b032f27cSSam Leffler /* NB: can happen when in promiscuous mode */ 2168b032f27cSSam Leffler !IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) { 2169b032f27cSSam Leffler vap->iv_stats.is_rx_mgtdiscard++; 2170b032f27cSSam Leffler break; 2171b032f27cSSam Leffler } 2172b032f27cSSam Leffler /* 2173b032f27cSSam Leffler * deauth/disassoc frame format 2174b032f27cSSam Leffler * [2] reason 2175b032f27cSSam Leffler */ 2176b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return); 2177b032f27cSSam Leffler reason = le16toh(*(uint16_t *)frm); 2178b032f27cSSam Leffler if (subtype == IEEE80211_FC0_SUBTYPE_DEAUTH) { 2179b032f27cSSam Leffler vap->iv_stats.is_rx_deauth++; 2180b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_deauth); 2181b032f27cSSam Leffler } else { 2182b032f27cSSam Leffler vap->iv_stats.is_rx_disassoc++; 2183b032f27cSSam Leffler IEEE80211_NODE_STAT(ni, rx_disassoc); 2184b032f27cSSam Leffler } 2185b032f27cSSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni, 2186*d72d72d3SAndriy Voskoboinyk "recv %s (reason: %d (%s))", 2187*d72d72d3SAndriy Voskoboinyk ieee80211_mgt_subtype_name[subtype >> 2188*d72d72d3SAndriy Voskoboinyk IEEE80211_FC0_SUBTYPE_SHIFT], 2189*d72d72d3SAndriy Voskoboinyk reason, ieee80211_reason_to_string(reason)); 2190b032f27cSSam Leffler if (ni != vap->iv_bss) 2191b032f27cSSam Leffler ieee80211_node_leave(ni); 2192b032f27cSSam Leffler break; 2193b032f27cSSam Leffler } 2194b032f27cSSam Leffler 2195b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_ACTION: 219696283082SBernhard Schmidt case IEEE80211_FC0_SUBTYPE_ACTION_NOACK: 2197893c4d6eSBernhard Schmidt if (ni == vap->iv_bss) { 2198893c4d6eSBernhard Schmidt IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 2199893c4d6eSBernhard Schmidt wh, NULL, "%s", "unknown node"); 2200893c4d6eSBernhard Schmidt vap->iv_stats.is_rx_mgtdiscard++; 2201893c4d6eSBernhard Schmidt } else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) && 2202893c4d6eSBernhard Schmidt !IEEE80211_IS_MULTICAST(wh->i_addr1)) { 2203893c4d6eSBernhard Schmidt IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 2204893c4d6eSBernhard Schmidt wh, NULL, "%s", "not for us"); 2205893c4d6eSBernhard Schmidt vap->iv_stats.is_rx_mgtdiscard++; 2206893c4d6eSBernhard Schmidt } else if (vap->iv_state != IEEE80211_S_RUN) { 220796283082SBernhard Schmidt IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 220896283082SBernhard Schmidt wh, NULL, "wrong state %s", 220996283082SBernhard Schmidt ieee80211_state_name[vap->iv_state]); 2210b032f27cSSam Leffler vap->iv_stats.is_rx_mgtdiscard++; 2211893c4d6eSBernhard Schmidt } else { 2212893c4d6eSBernhard Schmidt if (ieee80211_parse_action(ni, m0) == 0) 2213893c4d6eSBernhard Schmidt (void)ic->ic_recv_action(ni, wh, frm, efrm); 221496283082SBernhard Schmidt } 2215b032f27cSSam Leffler break; 2216b032f27cSSam Leffler 2217b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 2218b032f27cSSam Leffler case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: 2219665d5ae9SAndriy Voskoboinyk case IEEE80211_FC0_SUBTYPE_TIMING_ADV: 222096283082SBernhard Schmidt case IEEE80211_FC0_SUBTYPE_ATIM: 222196283082SBernhard Schmidt IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, 222296283082SBernhard Schmidt wh, NULL, "%s", "not handled"); 222396283082SBernhard Schmidt vap->iv_stats.is_rx_mgtdiscard++; 222496283082SBernhard Schmidt break; 222596283082SBernhard Schmidt 2226b032f27cSSam Leffler default: 2227b032f27cSSam Leffler IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY, 2228b032f27cSSam Leffler wh, "mgt", "subtype 0x%x not handled", subtype); 2229b032f27cSSam Leffler vap->iv_stats.is_rx_badsubtype++; 2230b032f27cSSam Leffler break; 2231b032f27cSSam Leffler } 2232b032f27cSSam Leffler } 2233b032f27cSSam Leffler 223449eae5f7SSam Leffler static void 223549eae5f7SSam Leffler hostap_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype) 223649eae5f7SSam Leffler { 223749eae5f7SSam Leffler switch (subtype) { 223849eae5f7SSam Leffler case IEEE80211_FC0_SUBTYPE_PS_POLL: 2239e7f0d7cfSAdrian Chadd ni->ni_vap->iv_recv_pspoll(ni, m); 224049eae5f7SSam Leffler break; 224149eae5f7SSam Leffler case IEEE80211_FC0_SUBTYPE_BAR: 224249eae5f7SSam Leffler ieee80211_recv_bar(ni, m); 224349eae5f7SSam Leffler break; 224449eae5f7SSam Leffler } 224549eae5f7SSam Leffler } 224649eae5f7SSam Leffler 2247b032f27cSSam Leffler /* 2248b032f27cSSam Leffler * Process a received ps-poll frame. 2249b032f27cSSam Leffler */ 2250e7f0d7cfSAdrian Chadd void 2251e7f0d7cfSAdrian Chadd ieee80211_recv_pspoll(struct ieee80211_node *ni, struct mbuf *m0) 2252b032f27cSSam Leffler { 2253b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 22545cda6006SAdrian Chadd struct ieee80211com *ic = vap->iv_ic; 2255b032f27cSSam Leffler struct ieee80211_frame_min *wh; 2256b032f27cSSam Leffler struct mbuf *m; 2257b032f27cSSam Leffler uint16_t aid; 2258b032f27cSSam Leffler int qlen; 2259b032f27cSSam Leffler 2260b032f27cSSam Leffler wh = mtod(m0, struct ieee80211_frame_min *); 2261b032f27cSSam Leffler if (ni->ni_associd == 0) { 2262b032f27cSSam Leffler IEEE80211_DISCARD(vap, 2263b032f27cSSam Leffler IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2264b032f27cSSam Leffler (struct ieee80211_frame *) wh, NULL, 2265b032f27cSSam Leffler "%s", "unassociated station"); 2266b032f27cSSam Leffler vap->iv_stats.is_ps_unassoc++; 2267b032f27cSSam Leffler IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH, 2268b032f27cSSam Leffler IEEE80211_REASON_NOT_ASSOCED); 2269b032f27cSSam Leffler return; 2270b032f27cSSam Leffler } 2271b032f27cSSam Leffler 2272b032f27cSSam Leffler aid = le16toh(*(uint16_t *)wh->i_dur); 2273b032f27cSSam Leffler if (aid != ni->ni_associd) { 2274b032f27cSSam Leffler IEEE80211_DISCARD(vap, 2275b032f27cSSam Leffler IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG, 2276b032f27cSSam Leffler (struct ieee80211_frame *) wh, NULL, 2277b032f27cSSam Leffler "aid mismatch: sta aid 0x%x poll aid 0x%x", 2278b032f27cSSam Leffler ni->ni_associd, aid); 2279b032f27cSSam Leffler vap->iv_stats.is_ps_badaid++; 2280693e3122SSam Leffler /* 2281693e3122SSam Leffler * NB: We used to deauth the station but it turns out 2282693e3122SSam Leffler * the Blackberry Curve 8230 (and perhaps other devices) 2283693e3122SSam Leffler * sometimes send the wrong AID when WME is negotiated. 2284693e3122SSam Leffler * Being more lenient here seems ok as we already check 2285693e3122SSam Leffler * the station is associated and we only return frames 2286693e3122SSam Leffler * queued for the station (i.e. we don't use the AID). 2287693e3122SSam Leffler */ 2288b032f27cSSam Leffler return; 2289b032f27cSSam Leffler } 2290b032f27cSSam Leffler 2291b032f27cSSam Leffler /* Okay, take the first queued packet and put it out... */ 229263092fceSSam Leffler m = ieee80211_node_psq_dequeue(ni, &qlen); 2293b032f27cSSam Leffler if (m == NULL) { 2294b032f27cSSam Leffler IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_POWER, wh->i_addr2, 2295b032f27cSSam Leffler "%s", "recv ps-poll, but queue empty"); 2296b032f27cSSam Leffler ieee80211_send_nulldata(ieee80211_ref_node(ni)); 2297b032f27cSSam Leffler vap->iv_stats.is_ps_qempty++; /* XXX node stat */ 2298b032f27cSSam Leffler if (vap->iv_set_tim != NULL) 2299b032f27cSSam Leffler vap->iv_set_tim(ni, 0); /* just in case */ 2300b032f27cSSam Leffler return; 2301b032f27cSSam Leffler } 2302b032f27cSSam Leffler /* 2303b032f27cSSam Leffler * If there are more packets, set the more packets bit 2304b032f27cSSam Leffler * in the packet dispatched to the station; otherwise 2305b032f27cSSam Leffler * turn off the TIM bit. 2306b032f27cSSam Leffler */ 2307b032f27cSSam Leffler if (qlen != 0) { 2308b032f27cSSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni, 2309b032f27cSSam Leffler "recv ps-poll, send packet, %u still queued", qlen); 2310b032f27cSSam Leffler m->m_flags |= M_MORE_DATA; 2311b032f27cSSam Leffler } else { 2312b032f27cSSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni, 2313b032f27cSSam Leffler "%s", "recv ps-poll, send packet, queue empty"); 2314b032f27cSSam Leffler if (vap->iv_set_tim != NULL) 2315b032f27cSSam Leffler vap->iv_set_tim(ni, 0); 2316b032f27cSSam Leffler } 2317b032f27cSSam Leffler m->m_flags |= M_PWR_SAV; /* bypass PS handling */ 231863092fceSSam Leffler 23197ea3aadaSAdrian Chadd /* 23205cda6006SAdrian Chadd * Do the right thing; if it's an encap'ed frame then 2321d3a4ade3SAdrian Chadd * call ieee80211_parent_xmitpkt() else 2322e7495198SAdrian Chadd * call ieee80211_vap_xmitpkt(). 23237ea3aadaSAdrian Chadd */ 23245cda6006SAdrian Chadd if (m->m_flags & M_ENCAP) { 2325d3a4ade3SAdrian Chadd (void) ieee80211_parent_xmitpkt(ic, m); 23265cda6006SAdrian Chadd } else { 2327e7495198SAdrian Chadd (void) ieee80211_vap_xmitpkt(vap, m); 23287ea3aadaSAdrian Chadd } 2329b032f27cSSam Leffler } 2330