11a1e1d21SSam Leffler /*- 27535e66aSSam Leffler * Copyright (c) 2001 Atsushi Onoe 310ad9a77SSam Leffler * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting 41a1e1d21SSam Leffler * All rights reserved. 51a1e1d21SSam Leffler * 61a1e1d21SSam Leffler * Redistribution and use in source and binary forms, with or without 71a1e1d21SSam Leffler * modification, are permitted provided that the following conditions 81a1e1d21SSam Leffler * are met: 91a1e1d21SSam Leffler * 1. Redistributions of source code must retain the above copyright 107535e66aSSam Leffler * notice, this list of conditions and the following disclaimer. 117535e66aSSam Leffler * 2. Redistributions in binary form must reproduce the above copyright 127535e66aSSam Leffler * notice, this list of conditions and the following disclaimer in the 137535e66aSSam Leffler * documentation and/or other materials provided with the distribution. 141a1e1d21SSam Leffler * 157535e66aSSam Leffler * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 167535e66aSSam Leffler * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 177535e66aSSam Leffler * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 187535e66aSSam Leffler * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 197535e66aSSam Leffler * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 207535e66aSSam Leffler * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 217535e66aSSam Leffler * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 227535e66aSSam Leffler * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 237535e66aSSam Leffler * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 247535e66aSSam Leffler * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 251a1e1d21SSam Leffler */ 261a1e1d21SSam Leffler 271a1e1d21SSam Leffler #include <sys/cdefs.h> 281a1e1d21SSam Leffler __FBSDID("$FreeBSD$"); 291a1e1d21SSam Leffler 30b032f27cSSam Leffler #include "opt_wlan.h" 31b032f27cSSam Leffler 321a1e1d21SSam Leffler #include <sys/param.h> 331a1e1d21SSam Leffler #include <sys/systm.h> 341a1e1d21SSam Leffler #include <sys/mbuf.h> 351a1e1d21SSam Leffler #include <sys/malloc.h> 361a1e1d21SSam Leffler #include <sys/endian.h> 37a0cc3f85SSam Leffler #include <sys/kernel.h> 381a1e1d21SSam Leffler 398a1b9b6aSSam Leffler #include <sys/socket.h> 401a1e1d21SSam Leffler 411a1e1d21SSam Leffler #include <net/ethernet.h> 42b032f27cSSam Leffler #include <net/if.h> 4376039bc8SGleb Smirnoff #include <net/if_var.h> 441a1e1d21SSam Leffler #include <net/if_llc.h> 45b032f27cSSam Leffler #include <net/if_media.h> 468a1b9b6aSSam Leffler #include <net/if_vlan_var.h> 471a1e1d21SSam Leffler 481a1e1d21SSam Leffler #include <net80211/ieee80211_var.h> 49b032f27cSSam Leffler #include <net80211/ieee80211_input.h> 5059aa14a9SRui Paulo #ifdef IEEE80211_SUPPORT_MESH 5159aa14a9SRui Paulo #include <net80211/ieee80211_mesh.h> 5259aa14a9SRui Paulo #endif 531a1e1d21SSam Leffler 541a1e1d21SSam Leffler #include <net/bpf.h> 551a1e1d21SSam Leffler 56b032f27cSSam Leffler #ifdef INET 57b032f27cSSam Leffler #include <netinet/in.h> 58b032f27cSSam Leffler #include <net/ethernet.h> 598a1b9b6aSSam Leffler #endif 601a1e1d21SSam Leffler 61864ab114SAdrian Chadd static void 62864ab114SAdrian Chadd ieee80211_process_mimo(struct ieee80211_node *ni, struct ieee80211_rx_stats *rx) 63864ab114SAdrian Chadd { 64864ab114SAdrian Chadd int i; 65864ab114SAdrian Chadd 66864ab114SAdrian Chadd /* Verify the required MIMO bits are set */ 67864ab114SAdrian Chadd if ((rx->r_flags & (IEEE80211_R_C_CHAIN | IEEE80211_R_C_NF | IEEE80211_R_C_RSSI)) != 68864ab114SAdrian Chadd (IEEE80211_R_C_CHAIN | IEEE80211_R_C_NF | IEEE80211_R_C_RSSI)) 69864ab114SAdrian Chadd return; 70864ab114SAdrian Chadd 71864ab114SAdrian Chadd /* XXX This assumes the MIMO radios have both ctl and ext chains */ 72864ab114SAdrian Chadd for (i = 0; i < MIN(rx->c_chain, IEEE80211_MAX_CHAINS); i++) { 73864ab114SAdrian Chadd IEEE80211_RSSI_LPF(ni->ni_mimo_rssi_ctl[i], rx->c_rssi_ctl[i]); 74864ab114SAdrian Chadd IEEE80211_RSSI_LPF(ni->ni_mimo_rssi_ext[i], rx->c_rssi_ext[i]); 75864ab114SAdrian Chadd } 76864ab114SAdrian Chadd 77864ab114SAdrian Chadd /* XXX This also assumes the MIMO radios have both ctl and ext chains */ 78864ab114SAdrian Chadd for(i = 0; i < MIN(rx->c_chain, IEEE80211_MAX_CHAINS); i++) { 79864ab114SAdrian Chadd ni->ni_mimo_noise_ctl[i] = rx->c_nf_ctl[i]; 80864ab114SAdrian Chadd ni->ni_mimo_noise_ext[i] = rx->c_nf_ext[i]; 81864ab114SAdrian Chadd } 82864ab114SAdrian Chadd ni->ni_mimo_chains = rx->c_chain; 83864ab114SAdrian Chadd } 84864ab114SAdrian Chadd 85864ab114SAdrian Chadd int 86864ab114SAdrian Chadd ieee80211_input_mimo(struct ieee80211_node *ni, struct mbuf *m, 87864ab114SAdrian Chadd struct ieee80211_rx_stats *rx) 88864ab114SAdrian Chadd { 89864ab114SAdrian Chadd /* XXX should assert IEEE80211_R_NF and IEEE80211_R_RSSI are set */ 90864ab114SAdrian Chadd ieee80211_process_mimo(ni, rx); 91c79f192cSAdrian Chadd //return ieee80211_input(ni, m, rx->rssi, rx->nf); 92c79f192cSAdrian Chadd return ni->ni_vap->iv_input(ni, m, rx, rx->rssi, rx->nf); 93864ab114SAdrian Chadd } 94864ab114SAdrian Chadd 95b032f27cSSam Leffler int 965463c4a4SSam Leffler ieee80211_input_all(struct ieee80211com *ic, struct mbuf *m, int rssi, int nf) 97b032f27cSSam Leffler { 98864ab114SAdrian Chadd struct ieee80211_rx_stats rx; 99864ab114SAdrian Chadd 100864ab114SAdrian Chadd rx.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI; 101864ab114SAdrian Chadd rx.nf = nf; 102864ab114SAdrian Chadd rx.rssi = rssi; 103864ab114SAdrian Chadd return ieee80211_input_mimo_all(ic, m, &rx); 104864ab114SAdrian Chadd } 105864ab114SAdrian Chadd 106864ab114SAdrian Chadd int 107864ab114SAdrian Chadd ieee80211_input_mimo_all(struct ieee80211com *ic, struct mbuf *m, 108864ab114SAdrian Chadd struct ieee80211_rx_stats *rx) 109864ab114SAdrian Chadd { 110b032f27cSSam Leffler struct ieee80211vap *vap; 111b032f27cSSam Leffler int type = -1; 112b032f27cSSam Leffler 113e1cfcbcbSSam Leffler m->m_flags |= M_BCAST; /* NB: mark for bpf tap'ing */ 114e1cfcbcbSSam Leffler 115b032f27cSSam Leffler /* XXX locking */ 116b032f27cSSam Leffler TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) { 117b032f27cSSam Leffler struct ieee80211_node *ni; 118b032f27cSSam Leffler struct mbuf *mcopy; 119b032f27cSSam Leffler 120c3655fa4SSam Leffler /* NB: could check for IFF_UP but this is cheaper */ 121c3655fa4SSam Leffler if (vap->iv_state == IEEE80211_S_INIT) 122c3655fa4SSam Leffler continue; 123b032f27cSSam Leffler /* 124b032f27cSSam Leffler * WDS vap's only receive directed traffic from the 125b032f27cSSam Leffler * station at the ``far end''. That traffic should 126b032f27cSSam Leffler * be passed through the AP vap the station is associated 127b032f27cSSam Leffler * to--so don't spam them with mcast frames. 128b032f27cSSam Leffler */ 129b032f27cSSam Leffler if (vap->iv_opmode == IEEE80211_M_WDS) 130b032f27cSSam Leffler continue; 131b032f27cSSam Leffler if (TAILQ_NEXT(vap, iv_next) != NULL) { 132b032f27cSSam Leffler /* 133b032f27cSSam Leffler * Packet contents are changed by ieee80211_decap 134b032f27cSSam Leffler * so do a deep copy of the packet. 135b032f27cSSam Leffler */ 136eb1b1807SGleb Smirnoff mcopy = m_dup(m, M_NOWAIT); 137b032f27cSSam Leffler if (mcopy == NULL) { 138b032f27cSSam Leffler /* XXX stat+msg */ 139b032f27cSSam Leffler continue; 1408a1b9b6aSSam Leffler } 141b032f27cSSam Leffler } else { 142b032f27cSSam Leffler mcopy = m; 143b032f27cSSam Leffler m = NULL; 1448a1b9b6aSSam Leffler } 145b032f27cSSam Leffler ni = ieee80211_ref_node(vap->iv_bss); 146864ab114SAdrian Chadd type = ieee80211_input_mimo(ni, mcopy, rx); 147b032f27cSSam Leffler ieee80211_free_node(ni); 1481a1e1d21SSam Leffler } 149b032f27cSSam Leffler if (m != NULL) /* no vaps, reclaim mbuf */ 1501a1e1d21SSam Leffler m_freem(m); 1511f298879SSam Leffler return type; 1521a1e1d21SSam Leffler } 1531a1e1d21SSam Leffler 1548a1b9b6aSSam Leffler /* 155df0d214aSRui Paulo * This function reassembles fragments. 156b032f27cSSam Leffler * 157b032f27cSSam Leffler * XXX should handle 3 concurrent reassemblies per-spec. 1588a1b9b6aSSam Leffler */ 159b032f27cSSam Leffler struct mbuf * 160b032f27cSSam Leffler ieee80211_defrag(struct ieee80211_node *ni, struct mbuf *m, int hdrspace) 1611a1e1d21SSam Leffler { 162b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 1638a1b9b6aSSam Leffler struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *); 1648a1b9b6aSSam Leffler struct ieee80211_frame *lwh; 16568e8e04eSSam Leffler uint16_t rxseq; 16668e8e04eSSam Leffler uint8_t fragno; 16768e8e04eSSam Leffler uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG; 1688a1b9b6aSSam Leffler struct mbuf *mfrag; 1698a1b9b6aSSam Leffler 1708a1b9b6aSSam Leffler KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?")); 1718a1b9b6aSSam Leffler 17268e8e04eSSam Leffler rxseq = le16toh(*(uint16_t *)wh->i_seq); 1738a1b9b6aSSam Leffler fragno = rxseq & IEEE80211_SEQ_FRAG_MASK; 1748a1b9b6aSSam Leffler 1758a1b9b6aSSam Leffler /* Quick way out, if there's nothing to defragment */ 1768a1b9b6aSSam Leffler if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL) 1778a1b9b6aSSam Leffler return m; 1788a1b9b6aSSam Leffler 1798a1b9b6aSSam Leffler /* 1808a1b9b6aSSam Leffler * Remove frag to insure it doesn't get reaped by timer. 1818a1b9b6aSSam Leffler */ 1828a1b9b6aSSam Leffler if (ni->ni_table == NULL) { 1838a1b9b6aSSam Leffler /* 1848a1b9b6aSSam Leffler * Should never happen. If the node is orphaned (not in 1858a1b9b6aSSam Leffler * the table) then input packets should not reach here. 1868a1b9b6aSSam Leffler * Otherwise, a concurrent request that yanks the table 1878a1b9b6aSSam Leffler * should be blocked by other interlocking and/or by first 1888a1b9b6aSSam Leffler * shutting the driver down. Regardless, be defensive 1898a1b9b6aSSam Leffler * here and just bail 1908a1b9b6aSSam Leffler */ 1918a1b9b6aSSam Leffler /* XXX need msg+stat */ 1928a1b9b6aSSam Leffler m_freem(m); 1938a1b9b6aSSam Leffler return NULL; 1948a1b9b6aSSam Leffler } 1958a1b9b6aSSam Leffler IEEE80211_NODE_LOCK(ni->ni_table); 1968a1b9b6aSSam Leffler mfrag = ni->ni_rxfrag[0]; 1978a1b9b6aSSam Leffler ni->ni_rxfrag[0] = NULL; 1988a1b9b6aSSam Leffler IEEE80211_NODE_UNLOCK(ni->ni_table); 1998a1b9b6aSSam Leffler 2008a1b9b6aSSam Leffler /* 2018a1b9b6aSSam Leffler * Validate new fragment is in order and 2028a1b9b6aSSam Leffler * related to the previous ones. 2038a1b9b6aSSam Leffler */ 2048a1b9b6aSSam Leffler if (mfrag != NULL) { 20568e8e04eSSam Leffler uint16_t last_rxseq; 2068a1b9b6aSSam Leffler 2078a1b9b6aSSam Leffler lwh = mtod(mfrag, struct ieee80211_frame *); 20868e8e04eSSam Leffler last_rxseq = le16toh(*(uint16_t *)lwh->i_seq); 2098a1b9b6aSSam Leffler /* NB: check seq # and frag together */ 2108a1b9b6aSSam Leffler if (rxseq != last_rxseq+1 || 2118a1b9b6aSSam Leffler !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) || 2128a1b9b6aSSam Leffler !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { 2138a1b9b6aSSam Leffler /* 2148a1b9b6aSSam Leffler * Unrelated fragment or no space for it, 2158a1b9b6aSSam Leffler * clear current fragments. 2168a1b9b6aSSam Leffler */ 2178a1b9b6aSSam Leffler m_freem(mfrag); 2188a1b9b6aSSam Leffler mfrag = NULL; 2198a1b9b6aSSam Leffler } 2208a1b9b6aSSam Leffler } 2218a1b9b6aSSam Leffler 2228a1b9b6aSSam Leffler if (mfrag == NULL) { 2238a1b9b6aSSam Leffler if (fragno != 0) { /* !first fragment, discard */ 224b032f27cSSam Leffler vap->iv_stats.is_rx_defrag++; 2258a1b9b6aSSam Leffler IEEE80211_NODE_STAT(ni, rx_defrag); 2268a1b9b6aSSam Leffler m_freem(m); 2278a1b9b6aSSam Leffler return NULL; 2288a1b9b6aSSam Leffler } 2298a1b9b6aSSam Leffler mfrag = m; 2308a1b9b6aSSam Leffler } else { /* concatenate */ 2312cc12adeSSam Leffler m_adj(m, hdrspace); /* strip header */ 2328a1b9b6aSSam Leffler m_cat(mfrag, m); 2338a1b9b6aSSam Leffler /* NB: m_cat doesn't update the packet header */ 2348a1b9b6aSSam Leffler mfrag->m_pkthdr.len += m->m_pkthdr.len; 2358a1b9b6aSSam Leffler /* track last seqnum and fragno */ 2368a1b9b6aSSam Leffler lwh = mtod(mfrag, struct ieee80211_frame *); 23768e8e04eSSam Leffler *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq; 2388a1b9b6aSSam Leffler } 2398a1b9b6aSSam Leffler if (more_frag) { /* more to come, save */ 240a0cc3f85SSam Leffler ni->ni_rxfragstamp = ticks; 2418a1b9b6aSSam Leffler ni->ni_rxfrag[0] = mfrag; 2428a1b9b6aSSam Leffler mfrag = NULL; 2438a1b9b6aSSam Leffler } 2448a1b9b6aSSam Leffler return mfrag; 2458a1b9b6aSSam Leffler } 2468a1b9b6aSSam Leffler 24768e8e04eSSam Leffler void 248b032f27cSSam Leffler ieee80211_deliver_data(struct ieee80211vap *vap, 2491bd482efSSam Leffler struct ieee80211_node *ni, struct mbuf *m) 2501bd482efSSam Leffler { 2511bd482efSSam Leffler struct ether_header *eh = mtod(m, struct ether_header *); 252b032f27cSSam Leffler struct ifnet *ifp = vap->iv_ifp; 2531bd482efSSam Leffler 254e1cfcbcbSSam Leffler /* clear driver/net80211 flags before passing up */ 25586bd0491SAndre Oppermann m->m_flags &= ~(M_MCAST | M_BCAST); 256b1051653SAdrian Chadd #if __FreeBSD_version >= 1000046 25786bd0491SAndre Oppermann m_clrprotoflags(m); 258b1051653SAdrian Chadd #endif 259e1cfcbcbSSam Leffler 260b032f27cSSam Leffler /* NB: see hostap_deliver_data, this path doesn't handle hostap */ 261b032f27cSSam Leffler KASSERT(vap->iv_opmode != IEEE80211_M_HOSTAP, ("gack, hostap")); 26206efa2f0SSam Leffler /* 26306efa2f0SSam Leffler * Do accounting. 26406efa2f0SSam Leffler */ 265dea45121SGleb Smirnoff if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1); 26606efa2f0SSam Leffler IEEE80211_NODE_STAT(ni, rx_data); 26706efa2f0SSam Leffler IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len); 26806efa2f0SSam Leffler if (ETHER_IS_MULTICAST(eh->ether_dhost)) { 26906efa2f0SSam Leffler m->m_flags |= M_MCAST; /* XXX M_BCAST? */ 27006efa2f0SSam Leffler IEEE80211_NODE_STAT(ni, rx_mcast); 27106efa2f0SSam Leffler } else 27206efa2f0SSam Leffler IEEE80211_NODE_STAT(ni, rx_ucast); 273b032f27cSSam Leffler m->m_pkthdr.rcvif = ifp; 27406efa2f0SSam Leffler 2751bd482efSSam Leffler if (ni->ni_vlan != 0) { 2761bd482efSSam Leffler /* attach vlan tag */ 27778ba57b9SAndre Oppermann m->m_pkthdr.ether_vtag = ni->ni_vlan; 27878ba57b9SAndre Oppermann m->m_flags |= M_VLANTAG; 2791bd482efSSam Leffler } 280b032f27cSSam Leffler ifp->if_input(ifp, m); 2811bd482efSSam Leffler } 2821bd482efSSam Leffler 283b032f27cSSam Leffler struct mbuf * 284b032f27cSSam Leffler ieee80211_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen) 2858a1b9b6aSSam Leffler { 28659aa14a9SRui Paulo struct ieee80211_qosframe_addr4 wh; 2871a1e1d21SSam Leffler struct ether_header *eh; 2881a1e1d21SSam Leffler struct llc *llc; 2891a1e1d21SSam Leffler 290c104cff2SRui Paulo KASSERT(hdrlen <= sizeof(wh), 291c104cff2SRui Paulo ("hdrlen %d > max %zd", hdrlen, sizeof(wh))); 292c104cff2SRui Paulo 2932cc12adeSSam Leffler if (m->m_len < hdrlen + sizeof(*llc) && 2942cc12adeSSam Leffler (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) { 295c104cff2SRui Paulo vap->iv_stats.is_rx_tooshort++; 296c104cff2SRui Paulo /* XXX msg */ 2971a1e1d21SSam Leffler return NULL; 2981a1e1d21SSam Leffler } 2992cc12adeSSam Leffler memcpy(&wh, mtod(m, caddr_t), hdrlen); 3002cc12adeSSam Leffler llc = (struct llc *)(mtod(m, caddr_t) + hdrlen); 3011a1e1d21SSam Leffler if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP && 3021a1e1d21SSam Leffler llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 && 3036bbdc701SSam Leffler llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 && 3046bbdc701SSam Leffler /* NB: preserve AppleTalk frames that have a native SNAP hdr */ 3056bbdc701SSam Leffler !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) || 3066bbdc701SSam Leffler llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) { 307ab96db10SSam Leffler m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh)); 3081a1e1d21SSam Leffler llc = NULL; 3091a1e1d21SSam Leffler } else { 3102cc12adeSSam Leffler m_adj(m, hdrlen - sizeof(*eh)); 3111a1e1d21SSam Leffler } 3121a1e1d21SSam Leffler eh = mtod(m, struct ether_header *); 3131a1e1d21SSam Leffler switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) { 3141a1e1d21SSam Leffler case IEEE80211_FC1_DIR_NODS: 3151a1e1d21SSam Leffler IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 3161a1e1d21SSam Leffler IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 3171a1e1d21SSam Leffler break; 3181a1e1d21SSam Leffler case IEEE80211_FC1_DIR_TODS: 3191a1e1d21SSam Leffler IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 3201a1e1d21SSam Leffler IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2); 3211a1e1d21SSam Leffler break; 3221a1e1d21SSam Leffler case IEEE80211_FC1_DIR_FROMDS: 3231a1e1d21SSam Leffler IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1); 3241a1e1d21SSam Leffler IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3); 3251a1e1d21SSam Leffler break; 3261a1e1d21SSam Leffler case IEEE80211_FC1_DIR_DSTODS: 3272cc12adeSSam Leffler IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3); 3282cc12adeSSam Leffler IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4); 3292cc12adeSSam Leffler break; 3301a1e1d21SSam Leffler } 33123f4fd6dSGleb Smirnoff #ifndef __NO_STRICT_ALIGNMENT 33268e8e04eSSam Leffler if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) { 333519f677aSSam Leffler m = ieee80211_realign(vap, m, sizeof(*eh)); 334519f677aSSam Leffler if (m == NULL) 3351a1e1d21SSam Leffler return NULL; 3361a1e1d21SSam Leffler } 33723f4fd6dSGleb Smirnoff #endif /* !__NO_STRICT_ALIGNMENT */ 3381a1e1d21SSam Leffler if (llc != NULL) { 3391a1e1d21SSam Leffler eh = mtod(m, struct ether_header *); 3401a1e1d21SSam Leffler eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh)); 3411a1e1d21SSam Leffler } 3421a1e1d21SSam Leffler return m; 3431a1e1d21SSam Leffler } 3441a1e1d21SSam Leffler 3451a1e1d21SSam Leffler /* 34668e8e04eSSam Leffler * Decap a frame encapsulated in a fast-frame/A-MSDU. 34768e8e04eSSam Leffler */ 34868e8e04eSSam Leffler struct mbuf * 34968e8e04eSSam Leffler ieee80211_decap1(struct mbuf *m, int *framelen) 35068e8e04eSSam Leffler { 35168e8e04eSSam Leffler #define FF_LLC_SIZE (sizeof(struct ether_header) + sizeof(struct llc)) 35268e8e04eSSam Leffler struct ether_header *eh; 35368e8e04eSSam Leffler struct llc *llc; 35468e8e04eSSam Leffler 35568e8e04eSSam Leffler /* 35668e8e04eSSam Leffler * The frame has an 802.3 header followed by an 802.2 35768e8e04eSSam Leffler * LLC header. The encapsulated frame length is in the 35868e8e04eSSam Leffler * first header type field; save that and overwrite it 35968e8e04eSSam Leffler * with the true type field found in the second. Then 36068e8e04eSSam Leffler * copy the 802.3 header up to where it belongs and 36168e8e04eSSam Leffler * adjust the mbuf contents to remove the void. 36268e8e04eSSam Leffler */ 36368e8e04eSSam Leffler if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL) 36468e8e04eSSam Leffler return NULL; 36568e8e04eSSam Leffler eh = mtod(m, struct ether_header *); /* 802.3 header is first */ 36668e8e04eSSam Leffler llc = (struct llc *)&eh[1]; /* 802.2 header follows */ 36768e8e04eSSam Leffler *framelen = ntohs(eh->ether_type) /* encap'd frame size */ 36868e8e04eSSam Leffler + sizeof(struct ether_header) - sizeof(struct llc); 36968e8e04eSSam Leffler eh->ether_type = llc->llc_un.type_snap.ether_type; 37068e8e04eSSam Leffler ovbcopy(eh, mtod(m, uint8_t *) + sizeof(struct llc), 37168e8e04eSSam Leffler sizeof(struct ether_header)); 37268e8e04eSSam Leffler m_adj(m, sizeof(struct llc)); 37368e8e04eSSam Leffler return m; 37468e8e04eSSam Leffler #undef FF_LLC_SIZE 37568e8e04eSSam Leffler } 37668e8e04eSSam Leffler 37768e8e04eSSam Leffler /* 3781a1e1d21SSam Leffler * Install received rate set information in the node's state block. 3791a1e1d21SSam Leffler */ 3807d77cd53SSam Leffler int 3817d77cd53SSam Leffler ieee80211_setup_rates(struct ieee80211_node *ni, 38268e8e04eSSam Leffler const uint8_t *rates, const uint8_t *xrates, int flags) 3831a1e1d21SSam Leffler { 384b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 3851a1e1d21SSam Leffler struct ieee80211_rateset *rs = &ni->ni_rates; 3861a1e1d21SSam Leffler 3871a1e1d21SSam Leffler memset(rs, 0, sizeof(*rs)); 3881a1e1d21SSam Leffler rs->rs_nrates = rates[1]; 3891a1e1d21SSam Leffler memcpy(rs->rs_rates, rates + 2, rs->rs_nrates); 3901a1e1d21SSam Leffler if (xrates != NULL) { 39168e8e04eSSam Leffler uint8_t nxrates; 3921a1e1d21SSam Leffler /* 3931a1e1d21SSam Leffler * Tack on 11g extended supported rate element. 3941a1e1d21SSam Leffler */ 3951a1e1d21SSam Leffler nxrates = xrates[1]; 3961a1e1d21SSam Leffler if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) { 3971a1e1d21SSam Leffler nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates; 398b032f27cSSam Leffler IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE, ni, 399b032f27cSSam Leffler "extended rate set too large; only using " 400b032f27cSSam Leffler "%u of %u rates", nxrates, xrates[1]); 401b032f27cSSam Leffler vap->iv_stats.is_rx_rstoobig++; 4021a1e1d21SSam Leffler } 4031a1e1d21SSam Leffler memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates); 4041a1e1d21SSam Leffler rs->rs_nrates += nxrates; 4051a1e1d21SSam Leffler } 40670e28b9aSSam Leffler return ieee80211_fix_rate(ni, rs, flags); 4071a1e1d21SSam Leffler } 4081a1e1d21SSam Leffler 40984eb84c4SSam Leffler /* 41084eb84c4SSam Leffler * Send a management frame error response to the specified 41184eb84c4SSam Leffler * station. If ni is associated with the station then use 41284eb84c4SSam Leffler * it; otherwise allocate a temporary node suitable for 41384eb84c4SSam Leffler * transmitting the frame and then free the reference so 41484eb84c4SSam Leffler * it will go away as soon as the frame has been transmitted. 41584eb84c4SSam Leffler */ 416b032f27cSSam Leffler void 417b032f27cSSam Leffler ieee80211_send_error(struct ieee80211_node *ni, 418b032f27cSSam Leffler const uint8_t mac[IEEE80211_ADDR_LEN], int subtype, int arg) 41984eb84c4SSam Leffler { 420b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 42184eb84c4SSam Leffler int istmp; 42284eb84c4SSam Leffler 423b032f27cSSam Leffler if (ni == vap->iv_bss) { 424b032f27cSSam Leffler if (vap->iv_state != IEEE80211_S_RUN) { 425b032f27cSSam Leffler /* 426b032f27cSSam Leffler * XXX hack until we get rid of this routine. 427b032f27cSSam Leffler * We can be called prior to the vap reaching 428b032f27cSSam Leffler * run state under certain conditions in which 429b032f27cSSam Leffler * case iv_bss->ni_chan will not be setup. 430b032f27cSSam Leffler * Check for this explicitly and and just ignore 431b032f27cSSam Leffler * the request. 432b032f27cSSam Leffler */ 433b032f27cSSam Leffler return; 434b032f27cSSam Leffler } 435b032f27cSSam Leffler ni = ieee80211_tmp_node(vap, mac); 43684eb84c4SSam Leffler if (ni == NULL) { 43784eb84c4SSam Leffler /* XXX msg */ 43884eb84c4SSam Leffler return; 43984eb84c4SSam Leffler } 44084eb84c4SSam Leffler istmp = 1; 44184eb84c4SSam Leffler } else 44284eb84c4SSam Leffler istmp = 0; 443b032f27cSSam Leffler IEEE80211_SEND_MGMT(ni, subtype, arg); 44484eb84c4SSam Leffler if (istmp) 44584eb84c4SSam Leffler ieee80211_free_node(ni); 44684eb84c4SSam Leffler } 44784eb84c4SSam Leffler 448b032f27cSSam Leffler int 449b032f27cSSam Leffler ieee80211_alloc_challenge(struct ieee80211_node *ni) 4508a1b9b6aSSam Leffler { 4518a1b9b6aSSam Leffler if (ni->ni_challenge == NULL) 452*b9b53389SAdrian Chadd ni->ni_challenge = (uint32_t *) 453*b9b53389SAdrian Chadd IEEE80211_MALLOC(IEEE80211_CHALLENGE_LEN, 454*b9b53389SAdrian Chadd M_80211_NODE, IEEE80211_M_NOWAIT); 4558a1b9b6aSSam Leffler if (ni->ni_challenge == NULL) { 456b032f27cSSam Leffler IEEE80211_NOTE(ni->ni_vap, 457b032f27cSSam Leffler IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni, 458b032f27cSSam Leffler "%s", "shared key challenge alloc failed"); 4598a1b9b6aSSam Leffler /* XXX statistic */ 4608a1b9b6aSSam Leffler } 4618a1b9b6aSSam Leffler return (ni->ni_challenge != NULL); 4628a1b9b6aSSam Leffler } 4638a1b9b6aSSam Leffler 46466ef3969SSam Leffler /* 465b032f27cSSam Leffler * Parse a Beacon or ProbeResponse frame and return the 466b032f27cSSam Leffler * useful information in an ieee80211_scanparams structure. 467b032f27cSSam Leffler * Status is set to 0 if no problems were found; otherwise 468b032f27cSSam Leffler * a bitmask of IEEE80211_BPARSE_* items is returned that 469b032f27cSSam Leffler * describes the problems detected. 47066ef3969SSam Leffler */ 471b032f27cSSam Leffler int 472b032f27cSSam Leffler ieee80211_parse_beacon(struct ieee80211_node *ni, struct mbuf *m, 473c79f192cSAdrian Chadd struct ieee80211_channel *rxchan, struct ieee80211_scanparams *scan) 47466ef3969SSam Leffler { 475b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 47666ef3969SSam Leffler struct ieee80211com *ic = ni->ni_ic; 4771a1e1d21SSam Leffler struct ieee80211_frame *wh; 47868e8e04eSSam Leffler uint8_t *frm, *efrm; 4791a1e1d21SSam Leffler 480b032f27cSSam Leffler wh = mtod(m, struct ieee80211_frame *); 48168e8e04eSSam Leffler frm = (uint8_t *)&wh[1]; 482b032f27cSSam Leffler efrm = mtod(m, uint8_t *) + m->m_len; 483b032f27cSSam Leffler scan->status = 0; 4841a1e1d21SSam Leffler /* 4851a1e1d21SSam Leffler * beacon/probe response frame format 4861a1e1d21SSam Leffler * [8] time stamp 4871a1e1d21SSam Leffler * [2] beacon interval 4881a1e1d21SSam Leffler * [2] capability information 4891a1e1d21SSam Leffler * [tlv] ssid 4901a1e1d21SSam Leffler * [tlv] supported rates 4911a1e1d21SSam Leffler * [tlv] country information 492c70761e6SSam Leffler * [tlv] channel switch announcement (CSA) 4931a1e1d21SSam Leffler * [tlv] parameter set (FH/DS) 4941a1e1d21SSam Leffler * [tlv] erp information 4951a1e1d21SSam Leffler * [tlv] extended supported rates 4968a1b9b6aSSam Leffler * [tlv] WME 4978a1b9b6aSSam Leffler * [tlv] WPA or RSN 49868e8e04eSSam Leffler * [tlv] HT capabilities 49968e8e04eSSam Leffler * [tlv] HT information 50068e8e04eSSam Leffler * [tlv] Atheros capabilities 50159aa14a9SRui Paulo * [tlv] Mesh ID 50259aa14a9SRui Paulo * [tlv] Mesh Configuration 5031a1e1d21SSam Leffler */ 504b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 12, 505b032f27cSSam Leffler return (scan->status = IEEE80211_BPARSE_BADIELEN)); 506b032f27cSSam Leffler memset(scan, 0, sizeof(*scan)); 507b032f27cSSam Leffler scan->tstamp = frm; frm += 8; 508b032f27cSSam Leffler scan->bintval = le16toh(*(uint16_t *)frm); frm += 2; 509b032f27cSSam Leffler scan->capinfo = le16toh(*(uint16_t *)frm); frm += 2; 510c79f192cSAdrian Chadd scan->bchan = ieee80211_chan2ieee(ic, rxchan); 511b032f27cSSam Leffler scan->chan = scan->bchan; 512b032f27cSSam Leffler scan->ies = frm; 513b032f27cSSam Leffler scan->ies_len = efrm - frm; 514b5c99415SSam Leffler 51570326a6eSSam Leffler while (efrm - frm > 1) { 516b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, 517b032f27cSSam Leffler return (scan->status = IEEE80211_BPARSE_BADIELEN)); 5181a1e1d21SSam Leffler switch (*frm) { 5191a1e1d21SSam Leffler case IEEE80211_ELEMID_SSID: 520b032f27cSSam Leffler scan->ssid = frm; 5211a1e1d21SSam Leffler break; 5221a1e1d21SSam Leffler case IEEE80211_ELEMID_RATES: 523b032f27cSSam Leffler scan->rates = frm; 5241a1e1d21SSam Leffler break; 5251a1e1d21SSam Leffler case IEEE80211_ELEMID_COUNTRY: 526b032f27cSSam Leffler scan->country = frm; 5271a1e1d21SSam Leffler break; 528c70761e6SSam Leffler case IEEE80211_ELEMID_CSA: 529c70761e6SSam Leffler scan->csa = frm; 530c70761e6SSam Leffler break; 53132b0e64bSAdrian Chadd case IEEE80211_ELEMID_QUIET: 53232b0e64bSAdrian Chadd scan->quiet = frm; 53332b0e64bSAdrian Chadd break; 5341a1e1d21SSam Leffler case IEEE80211_ELEMID_FHPARMS: 5351a1e1d21SSam Leffler if (ic->ic_phytype == IEEE80211_T_FH) { 536b032f27cSSam Leffler scan->fhdwell = LE_READ_2(&frm[2]); 537b032f27cSSam Leffler scan->chan = IEEE80211_FH_CHAN(frm[4], frm[5]); 538b032f27cSSam Leffler scan->fhindex = frm[6]; 5391a1e1d21SSam Leffler } 5401a1e1d21SSam Leffler break; 5411a1e1d21SSam Leffler case IEEE80211_ELEMID_DSPARMS: 5421a1e1d21SSam Leffler /* 5431a1e1d21SSam Leffler * XXX hack this since depending on phytype 5441a1e1d21SSam Leffler * is problematic for multi-mode devices. 5451a1e1d21SSam Leffler */ 5461a1e1d21SSam Leffler if (ic->ic_phytype != IEEE80211_T_FH) 547b032f27cSSam Leffler scan->chan = frm[2]; 5481a1e1d21SSam Leffler break; 5491a1e1d21SSam Leffler case IEEE80211_ELEMID_TIM: 5508a1b9b6aSSam Leffler /* XXX ATIM? */ 551b032f27cSSam Leffler scan->tim = frm; 552b032f27cSSam Leffler scan->timoff = frm - mtod(m, uint8_t *); 5531a1e1d21SSam Leffler break; 5544bd067c5SSam Leffler case IEEE80211_ELEMID_IBSSPARMS: 555b032f27cSSam Leffler case IEEE80211_ELEMID_CFPARMS: 556643024a2SSam Leffler case IEEE80211_ELEMID_PWRCNSTR: 557b032f27cSSam Leffler /* NB: avoid debugging complaints */ 5584bd067c5SSam Leffler break; 5591a1e1d21SSam Leffler case IEEE80211_ELEMID_XRATES: 560b032f27cSSam Leffler scan->xrates = frm; 5611a1e1d21SSam Leffler break; 5621a1e1d21SSam Leffler case IEEE80211_ELEMID_ERP: 5631a1e1d21SSam Leffler if (frm[1] != 1) { 564b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, 5658a1b9b6aSSam Leffler IEEE80211_MSG_ELEMID, wh, "ERP", 5668a1b9b6aSSam Leffler "bad len %u", frm[1]); 567b032f27cSSam Leffler vap->iv_stats.is_rx_elem_toobig++; 5681a1e1d21SSam Leffler break; 5691a1e1d21SSam Leffler } 570b032f27cSSam Leffler scan->erp = frm[2] | 0x100; 5711a1e1d21SSam Leffler break; 57268e8e04eSSam Leffler case IEEE80211_ELEMID_HTCAP: 573b032f27cSSam Leffler scan->htcap = frm; 57468e8e04eSSam Leffler break; 5758a1b9b6aSSam Leffler case IEEE80211_ELEMID_RSN: 576b032f27cSSam Leffler scan->rsn = frm; 57768e8e04eSSam Leffler break; 57868e8e04eSSam Leffler case IEEE80211_ELEMID_HTINFO: 579b032f27cSSam Leffler scan->htinfo = frm; 5808a1b9b6aSSam Leffler break; 581fbe007daSRui Paulo #ifdef IEEE80211_SUPPORT_MESH 58259aa14a9SRui Paulo case IEEE80211_ELEMID_MESHID: 58359aa14a9SRui Paulo scan->meshid = frm; 58459aa14a9SRui Paulo break; 58559aa14a9SRui Paulo case IEEE80211_ELEMID_MESHCONF: 58659aa14a9SRui Paulo scan->meshconf = frm; 58759aa14a9SRui Paulo break; 58859aa14a9SRui Paulo #endif 5898a1b9b6aSSam Leffler case IEEE80211_ELEMID_VENDOR: 5908a1b9b6aSSam Leffler if (iswpaoui(frm)) 591b032f27cSSam Leffler scan->wpa = frm; 5928a1b9b6aSSam Leffler else if (iswmeparam(frm) || iswmeinfo(frm)) 593b032f27cSSam Leffler scan->wme = frm; 594616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG 59568e8e04eSSam Leffler else if (isatherosoui(frm)) 596b032f27cSSam Leffler scan->ath = frm; 597616190d0SSam Leffler #endif 59810ad9a77SSam Leffler #ifdef IEEE80211_SUPPORT_TDMA 59910ad9a77SSam Leffler else if (istdmaoui(frm)) 60010ad9a77SSam Leffler scan->tdma = frm; 60110ad9a77SSam Leffler #endif 6022bfc8a91SSam Leffler else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) { 60368e8e04eSSam Leffler /* 60468e8e04eSSam Leffler * Accept pre-draft HT ie's if the 60568e8e04eSSam Leffler * standard ones have not been seen. 60668e8e04eSSam Leffler */ 60768e8e04eSSam Leffler if (ishtcapoui(frm)) { 608b032f27cSSam Leffler if (scan->htcap == NULL) 609b032f27cSSam Leffler scan->htcap = frm; 61068e8e04eSSam Leffler } else if (ishtinfooui(frm)) { 611b032f27cSSam Leffler if (scan->htinfo == NULL) 612b032f27cSSam Leffler scan->htcap = frm; 61368e8e04eSSam Leffler } 61468e8e04eSSam Leffler } 6158a1b9b6aSSam Leffler break; 6161a1e1d21SSam Leffler default: 617b032f27cSSam Leffler IEEE80211_DISCARD_IE(vap, IEEE80211_MSG_ELEMID, 6188a1b9b6aSSam Leffler wh, "unhandled", 6198a1b9b6aSSam Leffler "id %u, len %u", *frm, frm[1]); 620b032f27cSSam Leffler vap->iv_stats.is_rx_elem_unknown++; 6211a1e1d21SSam Leffler break; 6221a1e1d21SSam Leffler } 6231a1e1d21SSam Leffler frm += frm[1] + 2; 6241a1e1d21SSam Leffler } 625b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(scan->rates, IEEE80211_RATE_MAXSIZE, 626b032f27cSSam Leffler scan->status |= IEEE80211_BPARSE_RATES_INVALID); 627b032f27cSSam Leffler if (scan->rates != NULL && scan->xrates != NULL) { 628b032f27cSSam Leffler /* 629b032f27cSSam Leffler * NB: don't process XRATES if RATES is missing. This 630b032f27cSSam Leffler * avoids a potential null ptr deref and should be ok 631b032f27cSSam Leffler * as the return code will already note RATES is missing 632b032f27cSSam Leffler * (so callers shouldn't otherwise process the frame). 633b032f27cSSam Leffler */ 634b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(scan->xrates, 635b032f27cSSam Leffler IEEE80211_RATE_MAXSIZE - scan->rates[1], 636b032f27cSSam Leffler scan->status |= IEEE80211_BPARSE_XRATES_INVALID); 637b032f27cSSam Leffler } 638b032f27cSSam Leffler IEEE80211_VERIFY_ELEMENT(scan->ssid, IEEE80211_NWID_LEN, 639b032f27cSSam Leffler scan->status |= IEEE80211_BPARSE_SSID_INVALID); 640b032f27cSSam Leffler if (scan->chan != scan->bchan && ic->ic_phytype != IEEE80211_T_FH) { 6411a1e1d21SSam Leffler /* 6421a1e1d21SSam Leffler * Frame was received on a channel different from the 6434844aa7dSAtsushi Onoe * one indicated in the DS params element id; 6441a1e1d21SSam Leffler * silently discard it. 6451a1e1d21SSam Leffler * 6461a1e1d21SSam Leffler * NB: this can happen due to signal leakage. 6474844aa7dSAtsushi Onoe * But we should take it for FH phy because 6484844aa7dSAtsushi Onoe * the rssi value should be correct even for 6494844aa7dSAtsushi Onoe * different hop pattern in FH. 6501a1e1d21SSam Leffler */ 651b032f27cSSam Leffler IEEE80211_DISCARD(vap, 652d365f9c7SSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 653c79f192cSAdrian Chadd wh, NULL, "for off-channel %u (bchan=%u)", 654c79f192cSAdrian Chadd scan->chan, scan->bchan); 655b032f27cSSam Leffler vap->iv_stats.is_rx_chanmismatch++; 656b032f27cSSam Leffler scan->status |= IEEE80211_BPARSE_OFFCHAN; 657b5c99415SSam Leffler } 658b032f27cSSam Leffler if (!(IEEE80211_BINTVAL_MIN <= scan->bintval && 659b032f27cSSam Leffler scan->bintval <= IEEE80211_BINTVAL_MAX)) { 660b032f27cSSam Leffler IEEE80211_DISCARD(vap, 661b5c99415SSam Leffler IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 662de681822SAdrian Chadd wh, NULL, "bogus beacon interval (%d TU)", 663de681822SAdrian Chadd (int) scan->bintval); 664b032f27cSSam Leffler vap->iv_stats.is_rx_badbintval++; 665b032f27cSSam Leffler scan->status |= IEEE80211_BPARSE_BINTVAL_INVALID; 666b032f27cSSam Leffler } 667b032f27cSSam Leffler if (scan->country != NULL) { 668b032f27cSSam Leffler /* 669b032f27cSSam Leffler * Validate we have at least enough data to extract 670b032f27cSSam Leffler * the country code. Not sure if we should return an 671b032f27cSSam Leffler * error instead of discarding the IE; consider this 672b032f27cSSam Leffler * being lenient as we don't depend on the data for 673b032f27cSSam Leffler * correct operation. 674b032f27cSSam Leffler */ 675b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(scan->country[1], 3 * sizeof(uint8_t), 676b032f27cSSam Leffler scan->country = NULL); 677d365f9c7SSam Leffler } 678c70761e6SSam Leffler if (scan->csa != NULL) { 679c70761e6SSam Leffler /* 680c70761e6SSam Leffler * Validate Channel Switch Announcement; this must 681c70761e6SSam Leffler * be the correct length or we toss the frame. 682c70761e6SSam Leffler */ 683c70761e6SSam Leffler IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t), 684c70761e6SSam Leffler scan->status |= IEEE80211_BPARSE_CSA_INVALID); 685c70761e6SSam Leffler } 68668e8e04eSSam Leffler /* 68768e8e04eSSam Leffler * Process HT ie's. This is complicated by our 68868e8e04eSSam Leffler * accepting both the standard ie's and the pre-draft 68968e8e04eSSam Leffler * vendor OUI ie's that some vendors still use/require. 69068e8e04eSSam Leffler */ 691b032f27cSSam Leffler if (scan->htcap != NULL) { 692b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(scan->htcap[1], 693b032f27cSSam Leffler scan->htcap[0] == IEEE80211_ELEMID_VENDOR ? 69468e8e04eSSam Leffler 4 + sizeof(struct ieee80211_ie_htcap)-2 : 69568e8e04eSSam Leffler sizeof(struct ieee80211_ie_htcap)-2, 696b032f27cSSam Leffler scan->htcap = NULL); 69768e8e04eSSam Leffler } 698b032f27cSSam Leffler if (scan->htinfo != NULL) { 699b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(scan->htinfo[1], 700b032f27cSSam Leffler scan->htinfo[0] == IEEE80211_ELEMID_VENDOR ? 70168e8e04eSSam Leffler 4 + sizeof(struct ieee80211_ie_htinfo)-2 : 70268e8e04eSSam Leffler sizeof(struct ieee80211_ie_htinfo)-2, 703b032f27cSSam Leffler scan->htinfo = NULL); 704b032f27cSSam Leffler } 705b032f27cSSam Leffler return scan->status; 70668e8e04eSSam Leffler } 7071a1e1d21SSam Leffler 7081a1e1d21SSam Leffler /* 709b032f27cSSam Leffler * Parse an Action frame. Return 0 on success, non-zero on failure. 71044c72e42SSam Leffler */ 711b032f27cSSam Leffler int 712b032f27cSSam Leffler ieee80211_parse_action(struct ieee80211_node *ni, struct mbuf *m) 713b032f27cSSam Leffler { 714b032f27cSSam Leffler struct ieee80211vap *vap = ni->ni_vap; 71568e8e04eSSam Leffler const struct ieee80211_action *ia; 716b032f27cSSam Leffler struct ieee80211_frame *wh; 717b032f27cSSam Leffler uint8_t *frm, *efrm; 71868e8e04eSSam Leffler 71968e8e04eSSam Leffler /* 72068e8e04eSSam Leffler * action frame format: 72168e8e04eSSam Leffler * [1] category 72268e8e04eSSam Leffler * [1] action 72368e8e04eSSam Leffler * [tlv] parameters 72468e8e04eSSam Leffler */ 725b032f27cSSam Leffler wh = mtod(m, struct ieee80211_frame *); 726b032f27cSSam Leffler frm = (u_int8_t *)&wh[1]; 727b032f27cSSam Leffler efrm = mtod(m, u_int8_t *) + m->m_len; 72868e8e04eSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 729b032f27cSSam Leffler sizeof(struct ieee80211_action), return EINVAL); 73068e8e04eSSam Leffler ia = (const struct ieee80211_action *) frm; 73168e8e04eSSam Leffler 732b032f27cSSam Leffler vap->iv_stats.is_rx_action++; 73368e8e04eSSam Leffler IEEE80211_NODE_STAT(ni, rx_action); 73468e8e04eSSam Leffler 73568e8e04eSSam Leffler /* verify frame payloads but defer processing */ 73668e8e04eSSam Leffler switch (ia->ia_category) { 73768e8e04eSSam Leffler case IEEE80211_ACTION_CAT_BA: 73868e8e04eSSam Leffler switch (ia->ia_action) { 73968e8e04eSSam Leffler case IEEE80211_ACTION_BA_ADDBA_REQUEST: 74068e8e04eSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 74168e8e04eSSam Leffler sizeof(struct ieee80211_action_ba_addbarequest), 742b032f27cSSam Leffler return EINVAL); 74368e8e04eSSam Leffler break; 74468e8e04eSSam Leffler case IEEE80211_ACTION_BA_ADDBA_RESPONSE: 74568e8e04eSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 74668e8e04eSSam Leffler sizeof(struct ieee80211_action_ba_addbaresponse), 747b032f27cSSam Leffler return EINVAL); 74868e8e04eSSam Leffler break; 74968e8e04eSSam Leffler case IEEE80211_ACTION_BA_DELBA: 75068e8e04eSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 75168e8e04eSSam Leffler sizeof(struct ieee80211_action_ba_delba), 752b032f27cSSam Leffler return EINVAL); 75368e8e04eSSam Leffler break; 75468e8e04eSSam Leffler } 75568e8e04eSSam Leffler break; 75668e8e04eSSam Leffler case IEEE80211_ACTION_CAT_HT: 75768e8e04eSSam Leffler switch (ia->ia_action) { 75868e8e04eSSam Leffler case IEEE80211_ACTION_HT_TXCHWIDTH: 75968e8e04eSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 76068e8e04eSSam Leffler sizeof(struct ieee80211_action_ht_txchwidth), 761b032f27cSSam Leffler return EINVAL); 762b032f27cSSam Leffler break; 763b032f27cSSam Leffler case IEEE80211_ACTION_HT_MIMOPWRSAVE: 764b032f27cSSam Leffler IEEE80211_VERIFY_LENGTH(efrm - frm, 765b032f27cSSam Leffler sizeof(struct ieee80211_action_ht_mimopowersave), 766b032f27cSSam Leffler return EINVAL); 76768e8e04eSSam Leffler break; 76868e8e04eSSam Leffler } 76968e8e04eSSam Leffler break; 770dbab732dSGleb Smirnoff #ifdef IEEE80211_SUPPORT_MESH 771bdd2a076SAdrian Chadd case IEEE80211_ACTION_CAT_MESH: 772bdd2a076SAdrian Chadd switch (ia->ia_action) { 773bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_LMETRIC: 774bdd2a076SAdrian Chadd /* 775bdd2a076SAdrian Chadd * XXX: verification is true only if we are using 776bdd2a076SAdrian Chadd * Airtime link metric (default) 777bdd2a076SAdrian Chadd */ 778bdd2a076SAdrian Chadd IEEE80211_VERIFY_LENGTH(efrm - frm, 779bdd2a076SAdrian Chadd sizeof(struct ieee80211_meshlmetric_ie), 780bdd2a076SAdrian Chadd return EINVAL); 781bdd2a076SAdrian Chadd break; 782bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_HWMP: 783bdd2a076SAdrian Chadd /* verify something */ 784bdd2a076SAdrian Chadd break; 785bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_GANN: 786c81ceff7SMonthadar Al Jaberi IEEE80211_VERIFY_LENGTH(efrm - frm, 787c81ceff7SMonthadar Al Jaberi sizeof(struct ieee80211_meshgann_ie), 788c81ceff7SMonthadar Al Jaberi return EINVAL); 789c81ceff7SMonthadar Al Jaberi break; 790bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_CC: 791bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_MCCA_SREQ: 792bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_MCCA_SREP: 793bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_MCCA_AREQ: 794bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_MCCA_ADVER: 795bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_MCCA_TRDOWN: 796bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_TBTT_REQ: 797bdd2a076SAdrian Chadd case IEEE80211_ACTION_MESH_TBTT_RES: 798bdd2a076SAdrian Chadd /* reject these early on, not implemented */ 799bdd2a076SAdrian Chadd IEEE80211_DISCARD(vap, 800bdd2a076SAdrian Chadd IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 801bdd2a076SAdrian Chadd wh, NULL, "not implemented yet, act=0x%02X", 802bdd2a076SAdrian Chadd ia->ia_action); 803bdd2a076SAdrian Chadd return EINVAL; 804bdd2a076SAdrian Chadd } 805bdd2a076SAdrian Chadd break; 806ebeaa1adSMonthadar Al Jaberi case IEEE80211_ACTION_CAT_SELF_PROT: 807ebeaa1adSMonthadar Al Jaberi /* If TA or RA group address discard silently */ 808ebeaa1adSMonthadar Al Jaberi if (IEEE80211_IS_MULTICAST(wh->i_addr1) || 809ebeaa1adSMonthadar Al Jaberi IEEE80211_IS_MULTICAST(wh->i_addr2)) 810ebeaa1adSMonthadar Al Jaberi return EINVAL; 811ebeaa1adSMonthadar Al Jaberi /* 812ebeaa1adSMonthadar Al Jaberi * XXX: Should we verify complete length now or it is 813ebeaa1adSMonthadar Al Jaberi * to varying in sizes? 814ebeaa1adSMonthadar Al Jaberi */ 815ebeaa1adSMonthadar Al Jaberi switch (ia->ia_action) { 816ebeaa1adSMonthadar Al Jaberi case IEEE80211_ACTION_MESHPEERING_CONFIRM: 817ebeaa1adSMonthadar Al Jaberi case IEEE80211_ACTION_MESHPEERING_CLOSE: 818ebeaa1adSMonthadar Al Jaberi /* is not a peering candidate (yet) */ 819ebeaa1adSMonthadar Al Jaberi if (ni == vap->iv_bss) 820ebeaa1adSMonthadar Al Jaberi return EINVAL; 821ebeaa1adSMonthadar Al Jaberi break; 822ebeaa1adSMonthadar Al Jaberi } 823ebeaa1adSMonthadar Al Jaberi break; 824dbab732dSGleb Smirnoff #endif 82568e8e04eSSam Leffler } 826b032f27cSSam Leffler return 0; 8278a1b9b6aSSam Leffler } 8288a1b9b6aSSam Leffler 8298a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG 8308a1b9b6aSSam Leffler /* 8318a1b9b6aSSam Leffler * Debugging support. 8328a1b9b6aSSam Leffler */ 833b032f27cSSam Leffler void 834b032f27cSSam Leffler ieee80211_ssid_mismatch(struct ieee80211vap *vap, const char *tag, 835b032f27cSSam Leffler uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid) 836b032f27cSSam Leffler { 837b032f27cSSam Leffler printf("[%s] discard %s frame, ssid mismatch: ", 838b032f27cSSam Leffler ether_sprintf(mac), tag); 839b032f27cSSam Leffler ieee80211_print_essid(ssid + 2, ssid[1]); 840b032f27cSSam Leffler printf("\n"); 841b032f27cSSam Leffler } 8428a1b9b6aSSam Leffler 8438a1b9b6aSSam Leffler /* 8448a1b9b6aSSam Leffler * Return the bssid of a frame. 8458a1b9b6aSSam Leffler */ 84668e8e04eSSam Leffler static const uint8_t * 847d2bc4bf6SRui Paulo ieee80211_getbssid(const struct ieee80211vap *vap, 848d2bc4bf6SRui Paulo const struct ieee80211_frame *wh) 8498a1b9b6aSSam Leffler { 850b032f27cSSam Leffler if (vap->iv_opmode == IEEE80211_M_STA) 8518a1b9b6aSSam Leffler return wh->i_addr2; 8528a1b9b6aSSam Leffler if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS) 8538a1b9b6aSSam Leffler return wh->i_addr1; 8548a1b9b6aSSam Leffler if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL) 8558a1b9b6aSSam Leffler return wh->i_addr1; 8568a1b9b6aSSam Leffler return wh->i_addr3; 8578a1b9b6aSSam Leffler } 8588a1b9b6aSSam Leffler 859b032f27cSSam Leffler #include <machine/stdarg.h> 860b032f27cSSam Leffler 861f6df3191SSam Leffler void 862d2bc4bf6SRui Paulo ieee80211_note(const struct ieee80211vap *vap, const char *fmt, ...) 863f6df3191SSam Leffler { 864f6df3191SSam Leffler char buf[128]; /* XXX */ 865f6df3191SSam Leffler va_list ap; 866f6df3191SSam Leffler 867f6df3191SSam Leffler va_start(ap, fmt); 868f6df3191SSam Leffler vsnprintf(buf, sizeof(buf), fmt, ap); 869f6df3191SSam Leffler va_end(ap); 870f6df3191SSam Leffler 871b032f27cSSam Leffler if_printf(vap->iv_ifp, "%s", buf); /* NB: no \n */ 872f6df3191SSam Leffler } 873f6df3191SSam Leffler 874f6df3191SSam Leffler void 875d2bc4bf6SRui Paulo ieee80211_note_frame(const struct ieee80211vap *vap, 876f6df3191SSam Leffler const struct ieee80211_frame *wh, 877f6df3191SSam Leffler const char *fmt, ...) 878f6df3191SSam Leffler { 879f6df3191SSam Leffler char buf[128]; /* XXX */ 880f6df3191SSam Leffler va_list ap; 881f6df3191SSam Leffler 882f6df3191SSam Leffler va_start(ap, fmt); 883f6df3191SSam Leffler vsnprintf(buf, sizeof(buf), fmt, ap); 884f6df3191SSam Leffler va_end(ap); 885b032f27cSSam Leffler if_printf(vap->iv_ifp, "[%s] %s\n", 886b032f27cSSam Leffler ether_sprintf(ieee80211_getbssid(vap, wh)), buf); 887f6df3191SSam Leffler } 888f6df3191SSam Leffler 889f6df3191SSam Leffler void 890d2bc4bf6SRui Paulo ieee80211_note_mac(const struct ieee80211vap *vap, 89168e8e04eSSam Leffler const uint8_t mac[IEEE80211_ADDR_LEN], 892f6df3191SSam Leffler const char *fmt, ...) 893f6df3191SSam Leffler { 894f6df3191SSam Leffler char buf[128]; /* XXX */ 895f6df3191SSam Leffler va_list ap; 896f6df3191SSam Leffler 897f6df3191SSam Leffler va_start(ap, fmt); 898f6df3191SSam Leffler vsnprintf(buf, sizeof(buf), fmt, ap); 899f6df3191SSam Leffler va_end(ap); 900b032f27cSSam Leffler if_printf(vap->iv_ifp, "[%s] %s\n", ether_sprintf(mac), buf); 901f6df3191SSam Leffler } 902f6df3191SSam Leffler 903a000d7c2SSam Leffler void 904d2bc4bf6SRui Paulo ieee80211_discard_frame(const struct ieee80211vap *vap, 9058a1b9b6aSSam Leffler const struct ieee80211_frame *wh, 9068a1b9b6aSSam Leffler const char *type, const char *fmt, ...) 9078a1b9b6aSSam Leffler { 9088a1b9b6aSSam Leffler va_list ap; 9098a1b9b6aSSam Leffler 910b032f27cSSam Leffler if_printf(vap->iv_ifp, "[%s] discard ", 911b032f27cSSam Leffler ether_sprintf(ieee80211_getbssid(vap, wh))); 912b032f27cSSam Leffler if (type == NULL) { 913b032f27cSSam Leffler printf("%s frame, ", ieee80211_mgt_subtype_name[ 914b032f27cSSam Leffler (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) >> 915b032f27cSSam Leffler IEEE80211_FC0_SUBTYPE_SHIFT]); 916b032f27cSSam Leffler } else 9178a1b9b6aSSam Leffler printf("%s frame, ", type); 9188a1b9b6aSSam Leffler va_start(ap, fmt); 9198a1b9b6aSSam Leffler vprintf(fmt, ap); 9208a1b9b6aSSam Leffler va_end(ap); 9218a1b9b6aSSam Leffler printf("\n"); 9228a1b9b6aSSam Leffler } 9238a1b9b6aSSam Leffler 924a000d7c2SSam Leffler void 925d2bc4bf6SRui Paulo ieee80211_discard_ie(const struct ieee80211vap *vap, 9268a1b9b6aSSam Leffler const struct ieee80211_frame *wh, 9278a1b9b6aSSam Leffler const char *type, const char *fmt, ...) 9288a1b9b6aSSam Leffler { 9298a1b9b6aSSam Leffler va_list ap; 9308a1b9b6aSSam Leffler 931b032f27cSSam Leffler if_printf(vap->iv_ifp, "[%s] discard ", 932b032f27cSSam Leffler ether_sprintf(ieee80211_getbssid(vap, wh))); 9338a1b9b6aSSam Leffler if (type != NULL) 9348a1b9b6aSSam Leffler printf("%s information element, ", type); 9358a1b9b6aSSam Leffler else 9368a1b9b6aSSam Leffler printf("information element, "); 9378a1b9b6aSSam Leffler va_start(ap, fmt); 9388a1b9b6aSSam Leffler vprintf(fmt, ap); 9398a1b9b6aSSam Leffler va_end(ap); 9408a1b9b6aSSam Leffler printf("\n"); 9418a1b9b6aSSam Leffler } 9428a1b9b6aSSam Leffler 943a000d7c2SSam Leffler void 944d2bc4bf6SRui Paulo ieee80211_discard_mac(const struct ieee80211vap *vap, 94568e8e04eSSam Leffler const uint8_t mac[IEEE80211_ADDR_LEN], 9468a1b9b6aSSam Leffler const char *type, const char *fmt, ...) 9478a1b9b6aSSam Leffler { 9488a1b9b6aSSam Leffler va_list ap; 9498a1b9b6aSSam Leffler 950b032f27cSSam Leffler if_printf(vap->iv_ifp, "[%s] discard ", ether_sprintf(mac)); 9518a1b9b6aSSam Leffler if (type != NULL) 9528a1b9b6aSSam Leffler printf("%s frame, ", type); 9538a1b9b6aSSam Leffler else 9548a1b9b6aSSam Leffler printf("frame, "); 9558a1b9b6aSSam Leffler va_start(ap, fmt); 9568a1b9b6aSSam Leffler vprintf(fmt, ap); 9578a1b9b6aSSam Leffler va_end(ap); 9588a1b9b6aSSam Leffler printf("\n"); 9598a1b9b6aSSam Leffler } 9608a1b9b6aSSam Leffler #endif /* IEEE80211_DEBUG */ 961