xref: /freebsd/sys/net80211/ieee80211_input.c (revision b9b533891f5f8acf01ac15dafceafb03a611a80d)
11a1e1d21SSam Leffler /*-
27535e66aSSam Leffler  * Copyright (c) 2001 Atsushi Onoe
310ad9a77SSam Leffler  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
41a1e1d21SSam Leffler  * All rights reserved.
51a1e1d21SSam Leffler  *
61a1e1d21SSam Leffler  * Redistribution and use in source and binary forms, with or without
71a1e1d21SSam Leffler  * modification, are permitted provided that the following conditions
81a1e1d21SSam Leffler  * are met:
91a1e1d21SSam Leffler  * 1. Redistributions of source code must retain the above copyright
107535e66aSSam Leffler  *    notice, this list of conditions and the following disclaimer.
117535e66aSSam Leffler  * 2. Redistributions in binary form must reproduce the above copyright
127535e66aSSam Leffler  *    notice, this list of conditions and the following disclaimer in the
137535e66aSSam Leffler  *    documentation and/or other materials provided with the distribution.
141a1e1d21SSam Leffler  *
157535e66aSSam Leffler  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
167535e66aSSam Leffler  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
177535e66aSSam Leffler  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
187535e66aSSam Leffler  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
197535e66aSSam Leffler  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
207535e66aSSam Leffler  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
217535e66aSSam Leffler  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
227535e66aSSam Leffler  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
237535e66aSSam Leffler  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
247535e66aSSam Leffler  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
251a1e1d21SSam Leffler  */
261a1e1d21SSam Leffler 
271a1e1d21SSam Leffler #include <sys/cdefs.h>
281a1e1d21SSam Leffler __FBSDID("$FreeBSD$");
291a1e1d21SSam Leffler 
30b032f27cSSam Leffler #include "opt_wlan.h"
31b032f27cSSam Leffler 
321a1e1d21SSam Leffler #include <sys/param.h>
331a1e1d21SSam Leffler #include <sys/systm.h>
341a1e1d21SSam Leffler #include <sys/mbuf.h>
351a1e1d21SSam Leffler #include <sys/malloc.h>
361a1e1d21SSam Leffler #include <sys/endian.h>
37a0cc3f85SSam Leffler #include <sys/kernel.h>
381a1e1d21SSam Leffler 
398a1b9b6aSSam Leffler #include <sys/socket.h>
401a1e1d21SSam Leffler 
411a1e1d21SSam Leffler #include <net/ethernet.h>
42b032f27cSSam Leffler #include <net/if.h>
4376039bc8SGleb Smirnoff #include <net/if_var.h>
441a1e1d21SSam Leffler #include <net/if_llc.h>
45b032f27cSSam Leffler #include <net/if_media.h>
468a1b9b6aSSam Leffler #include <net/if_vlan_var.h>
471a1e1d21SSam Leffler 
481a1e1d21SSam Leffler #include <net80211/ieee80211_var.h>
49b032f27cSSam Leffler #include <net80211/ieee80211_input.h>
5059aa14a9SRui Paulo #ifdef IEEE80211_SUPPORT_MESH
5159aa14a9SRui Paulo #include <net80211/ieee80211_mesh.h>
5259aa14a9SRui Paulo #endif
531a1e1d21SSam Leffler 
541a1e1d21SSam Leffler #include <net/bpf.h>
551a1e1d21SSam Leffler 
56b032f27cSSam Leffler #ifdef INET
57b032f27cSSam Leffler #include <netinet/in.h>
58b032f27cSSam Leffler #include <net/ethernet.h>
598a1b9b6aSSam Leffler #endif
601a1e1d21SSam Leffler 
61864ab114SAdrian Chadd static void
62864ab114SAdrian Chadd ieee80211_process_mimo(struct ieee80211_node *ni, struct ieee80211_rx_stats *rx)
63864ab114SAdrian Chadd {
64864ab114SAdrian Chadd 	int i;
65864ab114SAdrian Chadd 
66864ab114SAdrian Chadd 	/* Verify the required MIMO bits are set */
67864ab114SAdrian Chadd 	if ((rx->r_flags & (IEEE80211_R_C_CHAIN | IEEE80211_R_C_NF | IEEE80211_R_C_RSSI)) !=
68864ab114SAdrian Chadd 	    (IEEE80211_R_C_CHAIN | IEEE80211_R_C_NF | IEEE80211_R_C_RSSI))
69864ab114SAdrian Chadd 		return;
70864ab114SAdrian Chadd 
71864ab114SAdrian Chadd 	/* XXX This assumes the MIMO radios have both ctl and ext chains */
72864ab114SAdrian Chadd 	for (i = 0; i < MIN(rx->c_chain, IEEE80211_MAX_CHAINS); i++) {
73864ab114SAdrian Chadd 		IEEE80211_RSSI_LPF(ni->ni_mimo_rssi_ctl[i], rx->c_rssi_ctl[i]);
74864ab114SAdrian Chadd 		IEEE80211_RSSI_LPF(ni->ni_mimo_rssi_ext[i], rx->c_rssi_ext[i]);
75864ab114SAdrian Chadd 	}
76864ab114SAdrian Chadd 
77864ab114SAdrian Chadd 	/* XXX This also assumes the MIMO radios have both ctl and ext chains */
78864ab114SAdrian Chadd 	for(i = 0; i < MIN(rx->c_chain, IEEE80211_MAX_CHAINS); i++) {
79864ab114SAdrian Chadd 		ni->ni_mimo_noise_ctl[i] = rx->c_nf_ctl[i];
80864ab114SAdrian Chadd 		ni->ni_mimo_noise_ext[i] = rx->c_nf_ext[i];
81864ab114SAdrian Chadd 	}
82864ab114SAdrian Chadd 	ni->ni_mimo_chains = rx->c_chain;
83864ab114SAdrian Chadd }
84864ab114SAdrian Chadd 
85864ab114SAdrian Chadd int
86864ab114SAdrian Chadd ieee80211_input_mimo(struct ieee80211_node *ni, struct mbuf *m,
87864ab114SAdrian Chadd     struct ieee80211_rx_stats *rx)
88864ab114SAdrian Chadd {
89864ab114SAdrian Chadd 	/* XXX should assert IEEE80211_R_NF and IEEE80211_R_RSSI are set */
90864ab114SAdrian Chadd 	ieee80211_process_mimo(ni, rx);
91c79f192cSAdrian Chadd 	//return ieee80211_input(ni, m, rx->rssi, rx->nf);
92c79f192cSAdrian Chadd 	return ni->ni_vap->iv_input(ni, m, rx, rx->rssi, rx->nf);
93864ab114SAdrian Chadd }
94864ab114SAdrian Chadd 
95b032f27cSSam Leffler int
965463c4a4SSam Leffler ieee80211_input_all(struct ieee80211com *ic, struct mbuf *m, int rssi, int nf)
97b032f27cSSam Leffler {
98864ab114SAdrian Chadd 	struct ieee80211_rx_stats rx;
99864ab114SAdrian Chadd 
100864ab114SAdrian Chadd 	rx.r_flags = IEEE80211_R_NF | IEEE80211_R_RSSI;
101864ab114SAdrian Chadd 	rx.nf = nf;
102864ab114SAdrian Chadd 	rx.rssi = rssi;
103864ab114SAdrian Chadd 	return ieee80211_input_mimo_all(ic, m, &rx);
104864ab114SAdrian Chadd }
105864ab114SAdrian Chadd 
106864ab114SAdrian Chadd int
107864ab114SAdrian Chadd ieee80211_input_mimo_all(struct ieee80211com *ic, struct mbuf *m,
108864ab114SAdrian Chadd     struct ieee80211_rx_stats *rx)
109864ab114SAdrian Chadd {
110b032f27cSSam Leffler 	struct ieee80211vap *vap;
111b032f27cSSam Leffler 	int type = -1;
112b032f27cSSam Leffler 
113e1cfcbcbSSam Leffler 	m->m_flags |= M_BCAST;		/* NB: mark for bpf tap'ing */
114e1cfcbcbSSam Leffler 
115b032f27cSSam Leffler 	/* XXX locking */
116b032f27cSSam Leffler 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
117b032f27cSSam Leffler 		struct ieee80211_node *ni;
118b032f27cSSam Leffler 		struct mbuf *mcopy;
119b032f27cSSam Leffler 
120c3655fa4SSam Leffler 		/* NB: could check for IFF_UP but this is cheaper */
121c3655fa4SSam Leffler 		if (vap->iv_state == IEEE80211_S_INIT)
122c3655fa4SSam Leffler 			continue;
123b032f27cSSam Leffler 		/*
124b032f27cSSam Leffler 		 * WDS vap's only receive directed traffic from the
125b032f27cSSam Leffler 		 * station at the ``far end''.  That traffic should
126b032f27cSSam Leffler 		 * be passed through the AP vap the station is associated
127b032f27cSSam Leffler 		 * to--so don't spam them with mcast frames.
128b032f27cSSam Leffler 		 */
129b032f27cSSam Leffler 		if (vap->iv_opmode == IEEE80211_M_WDS)
130b032f27cSSam Leffler 			continue;
131b032f27cSSam Leffler 		if (TAILQ_NEXT(vap, iv_next) != NULL) {
132b032f27cSSam Leffler 			/*
133b032f27cSSam Leffler 			 * Packet contents are changed by ieee80211_decap
134b032f27cSSam Leffler 			 * so do a deep copy of the packet.
135b032f27cSSam Leffler 			 */
136eb1b1807SGleb Smirnoff 			mcopy = m_dup(m, M_NOWAIT);
137b032f27cSSam Leffler 			if (mcopy == NULL) {
138b032f27cSSam Leffler 				/* XXX stat+msg */
139b032f27cSSam Leffler 				continue;
1408a1b9b6aSSam Leffler 			}
141b032f27cSSam Leffler 		} else {
142b032f27cSSam Leffler 			mcopy = m;
143b032f27cSSam Leffler 			m = NULL;
1448a1b9b6aSSam Leffler 		}
145b032f27cSSam Leffler 		ni = ieee80211_ref_node(vap->iv_bss);
146864ab114SAdrian Chadd 		type = ieee80211_input_mimo(ni, mcopy, rx);
147b032f27cSSam Leffler 		ieee80211_free_node(ni);
1481a1e1d21SSam Leffler 	}
149b032f27cSSam Leffler 	if (m != NULL)			/* no vaps, reclaim mbuf */
1501a1e1d21SSam Leffler 		m_freem(m);
1511f298879SSam Leffler 	return type;
1521a1e1d21SSam Leffler }
1531a1e1d21SSam Leffler 
1548a1b9b6aSSam Leffler /*
155df0d214aSRui Paulo  * This function reassembles fragments.
156b032f27cSSam Leffler  *
157b032f27cSSam Leffler  * XXX should handle 3 concurrent reassemblies per-spec.
1588a1b9b6aSSam Leffler  */
159b032f27cSSam Leffler struct mbuf *
160b032f27cSSam Leffler ieee80211_defrag(struct ieee80211_node *ni, struct mbuf *m, int hdrspace)
1611a1e1d21SSam Leffler {
162b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
1638a1b9b6aSSam Leffler 	struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
1648a1b9b6aSSam Leffler 	struct ieee80211_frame *lwh;
16568e8e04eSSam Leffler 	uint16_t rxseq;
16668e8e04eSSam Leffler 	uint8_t fragno;
16768e8e04eSSam Leffler 	uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
1688a1b9b6aSSam Leffler 	struct mbuf *mfrag;
1698a1b9b6aSSam Leffler 
1708a1b9b6aSSam Leffler 	KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
1718a1b9b6aSSam Leffler 
17268e8e04eSSam Leffler 	rxseq = le16toh(*(uint16_t *)wh->i_seq);
1738a1b9b6aSSam Leffler 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
1748a1b9b6aSSam Leffler 
1758a1b9b6aSSam Leffler 	/* Quick way out, if there's nothing to defragment */
1768a1b9b6aSSam Leffler 	if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
1778a1b9b6aSSam Leffler 		return m;
1788a1b9b6aSSam Leffler 
1798a1b9b6aSSam Leffler 	/*
1808a1b9b6aSSam Leffler 	 * Remove frag to insure it doesn't get reaped by timer.
1818a1b9b6aSSam Leffler 	 */
1828a1b9b6aSSam Leffler 	if (ni->ni_table == NULL) {
1838a1b9b6aSSam Leffler 		/*
1848a1b9b6aSSam Leffler 		 * Should never happen.  If the node is orphaned (not in
1858a1b9b6aSSam Leffler 		 * the table) then input packets should not reach here.
1868a1b9b6aSSam Leffler 		 * Otherwise, a concurrent request that yanks the table
1878a1b9b6aSSam Leffler 		 * should be blocked by other interlocking and/or by first
1888a1b9b6aSSam Leffler 		 * shutting the driver down.  Regardless, be defensive
1898a1b9b6aSSam Leffler 		 * here and just bail
1908a1b9b6aSSam Leffler 		 */
1918a1b9b6aSSam Leffler 		/* XXX need msg+stat */
1928a1b9b6aSSam Leffler 		m_freem(m);
1938a1b9b6aSSam Leffler 		return NULL;
1948a1b9b6aSSam Leffler 	}
1958a1b9b6aSSam Leffler 	IEEE80211_NODE_LOCK(ni->ni_table);
1968a1b9b6aSSam Leffler 	mfrag = ni->ni_rxfrag[0];
1978a1b9b6aSSam Leffler 	ni->ni_rxfrag[0] = NULL;
1988a1b9b6aSSam Leffler 	IEEE80211_NODE_UNLOCK(ni->ni_table);
1998a1b9b6aSSam Leffler 
2008a1b9b6aSSam Leffler 	/*
2018a1b9b6aSSam Leffler 	 * Validate new fragment is in order and
2028a1b9b6aSSam Leffler 	 * related to the previous ones.
2038a1b9b6aSSam Leffler 	 */
2048a1b9b6aSSam Leffler 	if (mfrag != NULL) {
20568e8e04eSSam Leffler 		uint16_t last_rxseq;
2068a1b9b6aSSam Leffler 
2078a1b9b6aSSam Leffler 		lwh = mtod(mfrag, struct ieee80211_frame *);
20868e8e04eSSam Leffler 		last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
2098a1b9b6aSSam Leffler 		/* NB: check seq # and frag together */
2108a1b9b6aSSam Leffler 		if (rxseq != last_rxseq+1 ||
2118a1b9b6aSSam Leffler 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
2128a1b9b6aSSam Leffler 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
2138a1b9b6aSSam Leffler 			/*
2148a1b9b6aSSam Leffler 			 * Unrelated fragment or no space for it,
2158a1b9b6aSSam Leffler 			 * clear current fragments.
2168a1b9b6aSSam Leffler 			 */
2178a1b9b6aSSam Leffler 			m_freem(mfrag);
2188a1b9b6aSSam Leffler 			mfrag = NULL;
2198a1b9b6aSSam Leffler 		}
2208a1b9b6aSSam Leffler 	}
2218a1b9b6aSSam Leffler 
2228a1b9b6aSSam Leffler  	if (mfrag == NULL) {
2238a1b9b6aSSam Leffler 		if (fragno != 0) {		/* !first fragment, discard */
224b032f27cSSam Leffler 			vap->iv_stats.is_rx_defrag++;
2258a1b9b6aSSam Leffler 			IEEE80211_NODE_STAT(ni, rx_defrag);
2268a1b9b6aSSam Leffler 			m_freem(m);
2278a1b9b6aSSam Leffler 			return NULL;
2288a1b9b6aSSam Leffler 		}
2298a1b9b6aSSam Leffler 		mfrag = m;
2308a1b9b6aSSam Leffler 	} else {				/* concatenate */
2312cc12adeSSam Leffler 		m_adj(m, hdrspace);		/* strip header */
2328a1b9b6aSSam Leffler 		m_cat(mfrag, m);
2338a1b9b6aSSam Leffler 		/* NB: m_cat doesn't update the packet header */
2348a1b9b6aSSam Leffler 		mfrag->m_pkthdr.len += m->m_pkthdr.len;
2358a1b9b6aSSam Leffler 		/* track last seqnum and fragno */
2368a1b9b6aSSam Leffler 		lwh = mtod(mfrag, struct ieee80211_frame *);
23768e8e04eSSam Leffler 		*(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
2388a1b9b6aSSam Leffler 	}
2398a1b9b6aSSam Leffler 	if (more_frag) {			/* more to come, save */
240a0cc3f85SSam Leffler 		ni->ni_rxfragstamp = ticks;
2418a1b9b6aSSam Leffler 		ni->ni_rxfrag[0] = mfrag;
2428a1b9b6aSSam Leffler 		mfrag = NULL;
2438a1b9b6aSSam Leffler 	}
2448a1b9b6aSSam Leffler 	return mfrag;
2458a1b9b6aSSam Leffler }
2468a1b9b6aSSam Leffler 
24768e8e04eSSam Leffler void
248b032f27cSSam Leffler ieee80211_deliver_data(struct ieee80211vap *vap,
2491bd482efSSam Leffler 	struct ieee80211_node *ni, struct mbuf *m)
2501bd482efSSam Leffler {
2511bd482efSSam Leffler 	struct ether_header *eh = mtod(m, struct ether_header *);
252b032f27cSSam Leffler 	struct ifnet *ifp = vap->iv_ifp;
2531bd482efSSam Leffler 
254e1cfcbcbSSam Leffler 	/* clear driver/net80211 flags before passing up */
25586bd0491SAndre Oppermann 	m->m_flags &= ~(M_MCAST | M_BCAST);
256b1051653SAdrian Chadd #if __FreeBSD_version >= 1000046
25786bd0491SAndre Oppermann 	m_clrprotoflags(m);
258b1051653SAdrian Chadd #endif
259e1cfcbcbSSam Leffler 
260b032f27cSSam Leffler 	/* NB: see hostap_deliver_data, this path doesn't handle hostap */
261b032f27cSSam Leffler 	KASSERT(vap->iv_opmode != IEEE80211_M_HOSTAP, ("gack, hostap"));
26206efa2f0SSam Leffler 	/*
26306efa2f0SSam Leffler 	 * Do accounting.
26406efa2f0SSam Leffler 	 */
265dea45121SGleb Smirnoff 	if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
26606efa2f0SSam Leffler 	IEEE80211_NODE_STAT(ni, rx_data);
26706efa2f0SSam Leffler 	IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
26806efa2f0SSam Leffler 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
26906efa2f0SSam Leffler 		m->m_flags |= M_MCAST;		/* XXX M_BCAST? */
27006efa2f0SSam Leffler 		IEEE80211_NODE_STAT(ni, rx_mcast);
27106efa2f0SSam Leffler 	} else
27206efa2f0SSam Leffler 		IEEE80211_NODE_STAT(ni, rx_ucast);
273b032f27cSSam Leffler 	m->m_pkthdr.rcvif = ifp;
27406efa2f0SSam Leffler 
2751bd482efSSam Leffler 	if (ni->ni_vlan != 0) {
2761bd482efSSam Leffler 		/* attach vlan tag */
27778ba57b9SAndre Oppermann 		m->m_pkthdr.ether_vtag = ni->ni_vlan;
27878ba57b9SAndre Oppermann 		m->m_flags |= M_VLANTAG;
2791bd482efSSam Leffler 	}
280b032f27cSSam Leffler 	ifp->if_input(ifp, m);
2811bd482efSSam Leffler }
2821bd482efSSam Leffler 
283b032f27cSSam Leffler struct mbuf *
284b032f27cSSam Leffler ieee80211_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen)
2858a1b9b6aSSam Leffler {
28659aa14a9SRui Paulo 	struct ieee80211_qosframe_addr4 wh;
2871a1e1d21SSam Leffler 	struct ether_header *eh;
2881a1e1d21SSam Leffler 	struct llc *llc;
2891a1e1d21SSam Leffler 
290c104cff2SRui Paulo 	KASSERT(hdrlen <= sizeof(wh),
291c104cff2SRui Paulo 	    ("hdrlen %d > max %zd", hdrlen, sizeof(wh)));
292c104cff2SRui Paulo 
2932cc12adeSSam Leffler 	if (m->m_len < hdrlen + sizeof(*llc) &&
2942cc12adeSSam Leffler 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
295c104cff2SRui Paulo 		vap->iv_stats.is_rx_tooshort++;
296c104cff2SRui Paulo 		/* XXX msg */
2971a1e1d21SSam Leffler 		return NULL;
2981a1e1d21SSam Leffler 	}
2992cc12adeSSam Leffler 	memcpy(&wh, mtod(m, caddr_t), hdrlen);
3002cc12adeSSam Leffler 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
3011a1e1d21SSam Leffler 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
3021a1e1d21SSam Leffler 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
3036bbdc701SSam Leffler 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
3046bbdc701SSam Leffler 	    /* NB: preserve AppleTalk frames that have a native SNAP hdr */
3056bbdc701SSam Leffler 	    !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
3066bbdc701SSam Leffler 	      llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
307ab96db10SSam Leffler 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
3081a1e1d21SSam Leffler 		llc = NULL;
3091a1e1d21SSam Leffler 	} else {
3102cc12adeSSam Leffler 		m_adj(m, hdrlen - sizeof(*eh));
3111a1e1d21SSam Leffler 	}
3121a1e1d21SSam Leffler 	eh = mtod(m, struct ether_header *);
3131a1e1d21SSam Leffler 	switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
3141a1e1d21SSam Leffler 	case IEEE80211_FC1_DIR_NODS:
3151a1e1d21SSam Leffler 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
3161a1e1d21SSam Leffler 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
3171a1e1d21SSam Leffler 		break;
3181a1e1d21SSam Leffler 	case IEEE80211_FC1_DIR_TODS:
3191a1e1d21SSam Leffler 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
3201a1e1d21SSam Leffler 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
3211a1e1d21SSam Leffler 		break;
3221a1e1d21SSam Leffler 	case IEEE80211_FC1_DIR_FROMDS:
3231a1e1d21SSam Leffler 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
3241a1e1d21SSam Leffler 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
3251a1e1d21SSam Leffler 		break;
3261a1e1d21SSam Leffler 	case IEEE80211_FC1_DIR_DSTODS:
3272cc12adeSSam Leffler 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
3282cc12adeSSam Leffler 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
3292cc12adeSSam Leffler 		break;
3301a1e1d21SSam Leffler 	}
33123f4fd6dSGleb Smirnoff #ifndef __NO_STRICT_ALIGNMENT
33268e8e04eSSam Leffler 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
333519f677aSSam Leffler 		m = ieee80211_realign(vap, m, sizeof(*eh));
334519f677aSSam Leffler 		if (m == NULL)
3351a1e1d21SSam Leffler 			return NULL;
3361a1e1d21SSam Leffler 	}
33723f4fd6dSGleb Smirnoff #endif /* !__NO_STRICT_ALIGNMENT */
3381a1e1d21SSam Leffler 	if (llc != NULL) {
3391a1e1d21SSam Leffler 		eh = mtod(m, struct ether_header *);
3401a1e1d21SSam Leffler 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
3411a1e1d21SSam Leffler 	}
3421a1e1d21SSam Leffler 	return m;
3431a1e1d21SSam Leffler }
3441a1e1d21SSam Leffler 
3451a1e1d21SSam Leffler /*
34668e8e04eSSam Leffler  * Decap a frame encapsulated in a fast-frame/A-MSDU.
34768e8e04eSSam Leffler  */
34868e8e04eSSam Leffler struct mbuf *
34968e8e04eSSam Leffler ieee80211_decap1(struct mbuf *m, int *framelen)
35068e8e04eSSam Leffler {
35168e8e04eSSam Leffler #define	FF_LLC_SIZE	(sizeof(struct ether_header) + sizeof(struct llc))
35268e8e04eSSam Leffler 	struct ether_header *eh;
35368e8e04eSSam Leffler 	struct llc *llc;
35468e8e04eSSam Leffler 
35568e8e04eSSam Leffler 	/*
35668e8e04eSSam Leffler 	 * The frame has an 802.3 header followed by an 802.2
35768e8e04eSSam Leffler 	 * LLC header.  The encapsulated frame length is in the
35868e8e04eSSam Leffler 	 * first header type field; save that and overwrite it
35968e8e04eSSam Leffler 	 * with the true type field found in the second.  Then
36068e8e04eSSam Leffler 	 * copy the 802.3 header up to where it belongs and
36168e8e04eSSam Leffler 	 * adjust the mbuf contents to remove the void.
36268e8e04eSSam Leffler 	 */
36368e8e04eSSam Leffler 	if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
36468e8e04eSSam Leffler 		return NULL;
36568e8e04eSSam Leffler 	eh = mtod(m, struct ether_header *);	/* 802.3 header is first */
36668e8e04eSSam Leffler 	llc = (struct llc *)&eh[1];		/* 802.2 header follows */
36768e8e04eSSam Leffler 	*framelen = ntohs(eh->ether_type)	/* encap'd frame size */
36868e8e04eSSam Leffler 		  + sizeof(struct ether_header) - sizeof(struct llc);
36968e8e04eSSam Leffler 	eh->ether_type = llc->llc_un.type_snap.ether_type;
37068e8e04eSSam Leffler 	ovbcopy(eh, mtod(m, uint8_t *) + sizeof(struct llc),
37168e8e04eSSam Leffler 		sizeof(struct ether_header));
37268e8e04eSSam Leffler 	m_adj(m, sizeof(struct llc));
37368e8e04eSSam Leffler 	return m;
37468e8e04eSSam Leffler #undef FF_LLC_SIZE
37568e8e04eSSam Leffler }
37668e8e04eSSam Leffler 
37768e8e04eSSam Leffler /*
3781a1e1d21SSam Leffler  * Install received rate set information in the node's state block.
3791a1e1d21SSam Leffler  */
3807d77cd53SSam Leffler int
3817d77cd53SSam Leffler ieee80211_setup_rates(struct ieee80211_node *ni,
38268e8e04eSSam Leffler 	const uint8_t *rates, const uint8_t *xrates, int flags)
3831a1e1d21SSam Leffler {
384b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
3851a1e1d21SSam Leffler 	struct ieee80211_rateset *rs = &ni->ni_rates;
3861a1e1d21SSam Leffler 
3871a1e1d21SSam Leffler 	memset(rs, 0, sizeof(*rs));
3881a1e1d21SSam Leffler 	rs->rs_nrates = rates[1];
3891a1e1d21SSam Leffler 	memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
3901a1e1d21SSam Leffler 	if (xrates != NULL) {
39168e8e04eSSam Leffler 		uint8_t nxrates;
3921a1e1d21SSam Leffler 		/*
3931a1e1d21SSam Leffler 		 * Tack on 11g extended supported rate element.
3941a1e1d21SSam Leffler 		 */
3951a1e1d21SSam Leffler 		nxrates = xrates[1];
3961a1e1d21SSam Leffler 		if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
3971a1e1d21SSam Leffler 			nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
398b032f27cSSam Leffler 			IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE, ni,
399b032f27cSSam Leffler 			    "extended rate set too large; only using "
400b032f27cSSam Leffler 			    "%u of %u rates", nxrates, xrates[1]);
401b032f27cSSam Leffler 			vap->iv_stats.is_rx_rstoobig++;
4021a1e1d21SSam Leffler 		}
4031a1e1d21SSam Leffler 		memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
4041a1e1d21SSam Leffler 		rs->rs_nrates += nxrates;
4051a1e1d21SSam Leffler 	}
40670e28b9aSSam Leffler 	return ieee80211_fix_rate(ni, rs, flags);
4071a1e1d21SSam Leffler }
4081a1e1d21SSam Leffler 
40984eb84c4SSam Leffler /*
41084eb84c4SSam Leffler  * Send a management frame error response to the specified
41184eb84c4SSam Leffler  * station.  If ni is associated with the station then use
41284eb84c4SSam Leffler  * it; otherwise allocate a temporary node suitable for
41384eb84c4SSam Leffler  * transmitting the frame and then free the reference so
41484eb84c4SSam Leffler  * it will go away as soon as the frame has been transmitted.
41584eb84c4SSam Leffler  */
416b032f27cSSam Leffler void
417b032f27cSSam Leffler ieee80211_send_error(struct ieee80211_node *ni,
418b032f27cSSam Leffler 	const uint8_t mac[IEEE80211_ADDR_LEN], int subtype, int arg)
41984eb84c4SSam Leffler {
420b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
42184eb84c4SSam Leffler 	int istmp;
42284eb84c4SSam Leffler 
423b032f27cSSam Leffler 	if (ni == vap->iv_bss) {
424b032f27cSSam Leffler 		if (vap->iv_state != IEEE80211_S_RUN) {
425b032f27cSSam Leffler 			/*
426b032f27cSSam Leffler 			 * XXX hack until we get rid of this routine.
427b032f27cSSam Leffler 			 * We can be called prior to the vap reaching
428b032f27cSSam Leffler 			 * run state under certain conditions in which
429b032f27cSSam Leffler 			 * case iv_bss->ni_chan will not be setup.
430b032f27cSSam Leffler 			 * Check for this explicitly and and just ignore
431b032f27cSSam Leffler 			 * the request.
432b032f27cSSam Leffler 			 */
433b032f27cSSam Leffler 			return;
434b032f27cSSam Leffler 		}
435b032f27cSSam Leffler 		ni = ieee80211_tmp_node(vap, mac);
43684eb84c4SSam Leffler 		if (ni == NULL) {
43784eb84c4SSam Leffler 			/* XXX msg */
43884eb84c4SSam Leffler 			return;
43984eb84c4SSam Leffler 		}
44084eb84c4SSam Leffler 		istmp = 1;
44184eb84c4SSam Leffler 	} else
44284eb84c4SSam Leffler 		istmp = 0;
443b032f27cSSam Leffler 	IEEE80211_SEND_MGMT(ni, subtype, arg);
44484eb84c4SSam Leffler 	if (istmp)
44584eb84c4SSam Leffler 		ieee80211_free_node(ni);
44684eb84c4SSam Leffler }
44784eb84c4SSam Leffler 
448b032f27cSSam Leffler int
449b032f27cSSam Leffler ieee80211_alloc_challenge(struct ieee80211_node *ni)
4508a1b9b6aSSam Leffler {
4518a1b9b6aSSam Leffler 	if (ni->ni_challenge == NULL)
452*b9b53389SAdrian Chadd 		ni->ni_challenge = (uint32_t *)
453*b9b53389SAdrian Chadd 		    IEEE80211_MALLOC(IEEE80211_CHALLENGE_LEN,
454*b9b53389SAdrian Chadd 		      M_80211_NODE, IEEE80211_M_NOWAIT);
4558a1b9b6aSSam Leffler 	if (ni->ni_challenge == NULL) {
456b032f27cSSam Leffler 		IEEE80211_NOTE(ni->ni_vap,
457b032f27cSSam Leffler 		    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
458b032f27cSSam Leffler 		    "%s", "shared key challenge alloc failed");
4598a1b9b6aSSam Leffler 		/* XXX statistic */
4608a1b9b6aSSam Leffler 	}
4618a1b9b6aSSam Leffler 	return (ni->ni_challenge != NULL);
4628a1b9b6aSSam Leffler }
4638a1b9b6aSSam Leffler 
46466ef3969SSam Leffler /*
465b032f27cSSam Leffler  * Parse a Beacon or ProbeResponse frame and return the
466b032f27cSSam Leffler  * useful information in an ieee80211_scanparams structure.
467b032f27cSSam Leffler  * Status is set to 0 if no problems were found; otherwise
468b032f27cSSam Leffler  * a bitmask of IEEE80211_BPARSE_* items is returned that
469b032f27cSSam Leffler  * describes the problems detected.
47066ef3969SSam Leffler  */
471b032f27cSSam Leffler int
472b032f27cSSam Leffler ieee80211_parse_beacon(struct ieee80211_node *ni, struct mbuf *m,
473c79f192cSAdrian Chadd 	struct ieee80211_channel *rxchan, struct ieee80211_scanparams *scan)
47466ef3969SSam Leffler {
475b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
47666ef3969SSam Leffler 	struct ieee80211com *ic = ni->ni_ic;
4771a1e1d21SSam Leffler 	struct ieee80211_frame *wh;
47868e8e04eSSam Leffler 	uint8_t *frm, *efrm;
4791a1e1d21SSam Leffler 
480b032f27cSSam Leffler 	wh = mtod(m, struct ieee80211_frame *);
48168e8e04eSSam Leffler 	frm = (uint8_t *)&wh[1];
482b032f27cSSam Leffler 	efrm = mtod(m, uint8_t *) + m->m_len;
483b032f27cSSam Leffler 	scan->status = 0;
4841a1e1d21SSam Leffler 	/*
4851a1e1d21SSam Leffler 	 * beacon/probe response frame format
4861a1e1d21SSam Leffler 	 *	[8] time stamp
4871a1e1d21SSam Leffler 	 *	[2] beacon interval
4881a1e1d21SSam Leffler 	 *	[2] capability information
4891a1e1d21SSam Leffler 	 *	[tlv] ssid
4901a1e1d21SSam Leffler 	 *	[tlv] supported rates
4911a1e1d21SSam Leffler 	 *	[tlv] country information
492c70761e6SSam Leffler 	 *	[tlv] channel switch announcement (CSA)
4931a1e1d21SSam Leffler 	 *	[tlv] parameter set (FH/DS)
4941a1e1d21SSam Leffler 	 *	[tlv] erp information
4951a1e1d21SSam Leffler 	 *	[tlv] extended supported rates
4968a1b9b6aSSam Leffler 	 *	[tlv] WME
4978a1b9b6aSSam Leffler 	 *	[tlv] WPA or RSN
49868e8e04eSSam Leffler 	 *	[tlv] HT capabilities
49968e8e04eSSam Leffler 	 *	[tlv] HT information
50068e8e04eSSam Leffler 	 *	[tlv] Atheros capabilities
50159aa14a9SRui Paulo 	 *	[tlv] Mesh ID
50259aa14a9SRui Paulo 	 *	[tlv] Mesh Configuration
5031a1e1d21SSam Leffler 	 */
504b032f27cSSam Leffler 	IEEE80211_VERIFY_LENGTH(efrm - frm, 12,
505b032f27cSSam Leffler 	    return (scan->status = IEEE80211_BPARSE_BADIELEN));
506b032f27cSSam Leffler 	memset(scan, 0, sizeof(*scan));
507b032f27cSSam Leffler 	scan->tstamp  = frm;				frm += 8;
508b032f27cSSam Leffler 	scan->bintval = le16toh(*(uint16_t *)frm);	frm += 2;
509b032f27cSSam Leffler 	scan->capinfo = le16toh(*(uint16_t *)frm);	frm += 2;
510c79f192cSAdrian Chadd 	scan->bchan = ieee80211_chan2ieee(ic, rxchan);
511b032f27cSSam Leffler 	scan->chan = scan->bchan;
512b032f27cSSam Leffler 	scan->ies = frm;
513b032f27cSSam Leffler 	scan->ies_len = efrm - frm;
514b5c99415SSam Leffler 
51570326a6eSSam Leffler 	while (efrm - frm > 1) {
516b032f27cSSam Leffler 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2,
517b032f27cSSam Leffler 		    return (scan->status = IEEE80211_BPARSE_BADIELEN));
5181a1e1d21SSam Leffler 		switch (*frm) {
5191a1e1d21SSam Leffler 		case IEEE80211_ELEMID_SSID:
520b032f27cSSam Leffler 			scan->ssid = frm;
5211a1e1d21SSam Leffler 			break;
5221a1e1d21SSam Leffler 		case IEEE80211_ELEMID_RATES:
523b032f27cSSam Leffler 			scan->rates = frm;
5241a1e1d21SSam Leffler 			break;
5251a1e1d21SSam Leffler 		case IEEE80211_ELEMID_COUNTRY:
526b032f27cSSam Leffler 			scan->country = frm;
5271a1e1d21SSam Leffler 			break;
528c70761e6SSam Leffler 		case IEEE80211_ELEMID_CSA:
529c70761e6SSam Leffler 			scan->csa = frm;
530c70761e6SSam Leffler 			break;
53132b0e64bSAdrian Chadd 		case IEEE80211_ELEMID_QUIET:
53232b0e64bSAdrian Chadd 			scan->quiet = frm;
53332b0e64bSAdrian Chadd 			break;
5341a1e1d21SSam Leffler 		case IEEE80211_ELEMID_FHPARMS:
5351a1e1d21SSam Leffler 			if (ic->ic_phytype == IEEE80211_T_FH) {
536b032f27cSSam Leffler 				scan->fhdwell = LE_READ_2(&frm[2]);
537b032f27cSSam Leffler 				scan->chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
538b032f27cSSam Leffler 				scan->fhindex = frm[6];
5391a1e1d21SSam Leffler 			}
5401a1e1d21SSam Leffler 			break;
5411a1e1d21SSam Leffler 		case IEEE80211_ELEMID_DSPARMS:
5421a1e1d21SSam Leffler 			/*
5431a1e1d21SSam Leffler 			 * XXX hack this since depending on phytype
5441a1e1d21SSam Leffler 			 * is problematic for multi-mode devices.
5451a1e1d21SSam Leffler 			 */
5461a1e1d21SSam Leffler 			if (ic->ic_phytype != IEEE80211_T_FH)
547b032f27cSSam Leffler 				scan->chan = frm[2];
5481a1e1d21SSam Leffler 			break;
5491a1e1d21SSam Leffler 		case IEEE80211_ELEMID_TIM:
5508a1b9b6aSSam Leffler 			/* XXX ATIM? */
551b032f27cSSam Leffler 			scan->tim = frm;
552b032f27cSSam Leffler 			scan->timoff = frm - mtod(m, uint8_t *);
5531a1e1d21SSam Leffler 			break;
5544bd067c5SSam Leffler 		case IEEE80211_ELEMID_IBSSPARMS:
555b032f27cSSam Leffler 		case IEEE80211_ELEMID_CFPARMS:
556643024a2SSam Leffler 		case IEEE80211_ELEMID_PWRCNSTR:
557b032f27cSSam Leffler 			/* NB: avoid debugging complaints */
5584bd067c5SSam Leffler 			break;
5591a1e1d21SSam Leffler 		case IEEE80211_ELEMID_XRATES:
560b032f27cSSam Leffler 			scan->xrates = frm;
5611a1e1d21SSam Leffler 			break;
5621a1e1d21SSam Leffler 		case IEEE80211_ELEMID_ERP:
5631a1e1d21SSam Leffler 			if (frm[1] != 1) {
564b032f27cSSam Leffler 				IEEE80211_DISCARD_IE(vap,
5658a1b9b6aSSam Leffler 				    IEEE80211_MSG_ELEMID, wh, "ERP",
5668a1b9b6aSSam Leffler 				    "bad len %u", frm[1]);
567b032f27cSSam Leffler 				vap->iv_stats.is_rx_elem_toobig++;
5681a1e1d21SSam Leffler 				break;
5691a1e1d21SSam Leffler 			}
570b032f27cSSam Leffler 			scan->erp = frm[2] | 0x100;
5711a1e1d21SSam Leffler 			break;
57268e8e04eSSam Leffler 		case IEEE80211_ELEMID_HTCAP:
573b032f27cSSam Leffler 			scan->htcap = frm;
57468e8e04eSSam Leffler 			break;
5758a1b9b6aSSam Leffler 		case IEEE80211_ELEMID_RSN:
576b032f27cSSam Leffler 			scan->rsn = frm;
57768e8e04eSSam Leffler 			break;
57868e8e04eSSam Leffler 		case IEEE80211_ELEMID_HTINFO:
579b032f27cSSam Leffler 			scan->htinfo = frm;
5808a1b9b6aSSam Leffler 			break;
581fbe007daSRui Paulo #ifdef IEEE80211_SUPPORT_MESH
58259aa14a9SRui Paulo 		case IEEE80211_ELEMID_MESHID:
58359aa14a9SRui Paulo 			scan->meshid = frm;
58459aa14a9SRui Paulo 			break;
58559aa14a9SRui Paulo 		case IEEE80211_ELEMID_MESHCONF:
58659aa14a9SRui Paulo 			scan->meshconf = frm;
58759aa14a9SRui Paulo 			break;
58859aa14a9SRui Paulo #endif
5898a1b9b6aSSam Leffler 		case IEEE80211_ELEMID_VENDOR:
5908a1b9b6aSSam Leffler 			if (iswpaoui(frm))
591b032f27cSSam Leffler 				scan->wpa = frm;
5928a1b9b6aSSam Leffler 			else if (iswmeparam(frm) || iswmeinfo(frm))
593b032f27cSSam Leffler 				scan->wme = frm;
594616190d0SSam Leffler #ifdef IEEE80211_SUPPORT_SUPERG
59568e8e04eSSam Leffler 			else if (isatherosoui(frm))
596b032f27cSSam Leffler 				scan->ath = frm;
597616190d0SSam Leffler #endif
59810ad9a77SSam Leffler #ifdef IEEE80211_SUPPORT_TDMA
59910ad9a77SSam Leffler 			else if (istdmaoui(frm))
60010ad9a77SSam Leffler 				scan->tdma = frm;
60110ad9a77SSam Leffler #endif
6022bfc8a91SSam Leffler 			else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
60368e8e04eSSam Leffler 				/*
60468e8e04eSSam Leffler 				 * Accept pre-draft HT ie's if the
60568e8e04eSSam Leffler 				 * standard ones have not been seen.
60668e8e04eSSam Leffler 				 */
60768e8e04eSSam Leffler 				if (ishtcapoui(frm)) {
608b032f27cSSam Leffler 					if (scan->htcap == NULL)
609b032f27cSSam Leffler 						scan->htcap = frm;
61068e8e04eSSam Leffler 				} else if (ishtinfooui(frm)) {
611b032f27cSSam Leffler 					if (scan->htinfo == NULL)
612b032f27cSSam Leffler 						scan->htcap = frm;
61368e8e04eSSam Leffler 				}
61468e8e04eSSam Leffler 			}
6158a1b9b6aSSam Leffler 			break;
6161a1e1d21SSam Leffler 		default:
617b032f27cSSam Leffler 			IEEE80211_DISCARD_IE(vap, IEEE80211_MSG_ELEMID,
6188a1b9b6aSSam Leffler 			    wh, "unhandled",
6198a1b9b6aSSam Leffler 			    "id %u, len %u", *frm, frm[1]);
620b032f27cSSam Leffler 			vap->iv_stats.is_rx_elem_unknown++;
6211a1e1d21SSam Leffler 			break;
6221a1e1d21SSam Leffler 		}
6231a1e1d21SSam Leffler 		frm += frm[1] + 2;
6241a1e1d21SSam Leffler 	}
625b032f27cSSam Leffler 	IEEE80211_VERIFY_ELEMENT(scan->rates, IEEE80211_RATE_MAXSIZE,
626b032f27cSSam Leffler 	    scan->status |= IEEE80211_BPARSE_RATES_INVALID);
627b032f27cSSam Leffler 	if (scan->rates != NULL && scan->xrates != NULL) {
628b032f27cSSam Leffler 		/*
629b032f27cSSam Leffler 		 * NB: don't process XRATES if RATES is missing.  This
630b032f27cSSam Leffler 		 * avoids a potential null ptr deref and should be ok
631b032f27cSSam Leffler 		 * as the return code will already note RATES is missing
632b032f27cSSam Leffler 		 * (so callers shouldn't otherwise process the frame).
633b032f27cSSam Leffler 		 */
634b032f27cSSam Leffler 		IEEE80211_VERIFY_ELEMENT(scan->xrates,
635b032f27cSSam Leffler 		    IEEE80211_RATE_MAXSIZE - scan->rates[1],
636b032f27cSSam Leffler 		    scan->status |= IEEE80211_BPARSE_XRATES_INVALID);
637b032f27cSSam Leffler 	}
638b032f27cSSam Leffler 	IEEE80211_VERIFY_ELEMENT(scan->ssid, IEEE80211_NWID_LEN,
639b032f27cSSam Leffler 	    scan->status |= IEEE80211_BPARSE_SSID_INVALID);
640b032f27cSSam Leffler 	if (scan->chan != scan->bchan && ic->ic_phytype != IEEE80211_T_FH) {
6411a1e1d21SSam Leffler 		/*
6421a1e1d21SSam Leffler 		 * Frame was received on a channel different from the
6434844aa7dSAtsushi Onoe 		 * one indicated in the DS params element id;
6441a1e1d21SSam Leffler 		 * silently discard it.
6451a1e1d21SSam Leffler 		 *
6461a1e1d21SSam Leffler 		 * NB: this can happen due to signal leakage.
6474844aa7dSAtsushi Onoe 		 *     But we should take it for FH phy because
6484844aa7dSAtsushi Onoe 		 *     the rssi value should be correct even for
6494844aa7dSAtsushi Onoe 		 *     different hop pattern in FH.
6501a1e1d21SSam Leffler 		 */
651b032f27cSSam Leffler 		IEEE80211_DISCARD(vap,
652d365f9c7SSam Leffler 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
653c79f192cSAdrian Chadd 		    wh, NULL, "for off-channel %u (bchan=%u)",
654c79f192cSAdrian Chadd 		    scan->chan, scan->bchan);
655b032f27cSSam Leffler 		vap->iv_stats.is_rx_chanmismatch++;
656b032f27cSSam Leffler 		scan->status |= IEEE80211_BPARSE_OFFCHAN;
657b5c99415SSam Leffler 	}
658b032f27cSSam Leffler 	if (!(IEEE80211_BINTVAL_MIN <= scan->bintval &&
659b032f27cSSam Leffler 	      scan->bintval <= IEEE80211_BINTVAL_MAX)) {
660b032f27cSSam Leffler 		IEEE80211_DISCARD(vap,
661b5c99415SSam Leffler 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
662de681822SAdrian Chadd 		    wh, NULL, "bogus beacon interval (%d TU)",
663de681822SAdrian Chadd 		    (int) scan->bintval);
664b032f27cSSam Leffler 		vap->iv_stats.is_rx_badbintval++;
665b032f27cSSam Leffler 		scan->status |= IEEE80211_BPARSE_BINTVAL_INVALID;
666b032f27cSSam Leffler 	}
667b032f27cSSam Leffler 	if (scan->country != NULL) {
668b032f27cSSam Leffler 		/*
669b032f27cSSam Leffler 		 * Validate we have at least enough data to extract
670b032f27cSSam Leffler 		 * the country code.  Not sure if we should return an
671b032f27cSSam Leffler 		 * error instead of discarding the IE; consider this
672b032f27cSSam Leffler 		 * being lenient as we don't depend on the data for
673b032f27cSSam Leffler 		 * correct operation.
674b032f27cSSam Leffler 		 */
675b032f27cSSam Leffler 		IEEE80211_VERIFY_LENGTH(scan->country[1], 3 * sizeof(uint8_t),
676b032f27cSSam Leffler 		    scan->country = NULL);
677d365f9c7SSam Leffler 	}
678c70761e6SSam Leffler 	if (scan->csa != NULL) {
679c70761e6SSam Leffler 		/*
680c70761e6SSam Leffler 		 * Validate Channel Switch Announcement; this must
681c70761e6SSam Leffler 		 * be the correct length or we toss the frame.
682c70761e6SSam Leffler 		 */
683c70761e6SSam Leffler 		IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t),
684c70761e6SSam Leffler 		    scan->status |= IEEE80211_BPARSE_CSA_INVALID);
685c70761e6SSam Leffler 	}
68668e8e04eSSam Leffler 	/*
68768e8e04eSSam Leffler 	 * Process HT ie's.  This is complicated by our
68868e8e04eSSam Leffler 	 * accepting both the standard ie's and the pre-draft
68968e8e04eSSam Leffler 	 * vendor OUI ie's that some vendors still use/require.
69068e8e04eSSam Leffler 	 */
691b032f27cSSam Leffler 	if (scan->htcap != NULL) {
692b032f27cSSam Leffler 		IEEE80211_VERIFY_LENGTH(scan->htcap[1],
693b032f27cSSam Leffler 		     scan->htcap[0] == IEEE80211_ELEMID_VENDOR ?
69468e8e04eSSam Leffler 			 4 + sizeof(struct ieee80211_ie_htcap)-2 :
69568e8e04eSSam Leffler 			 sizeof(struct ieee80211_ie_htcap)-2,
696b032f27cSSam Leffler 		     scan->htcap = NULL);
69768e8e04eSSam Leffler 	}
698b032f27cSSam Leffler 	if (scan->htinfo != NULL) {
699b032f27cSSam Leffler 		IEEE80211_VERIFY_LENGTH(scan->htinfo[1],
700b032f27cSSam Leffler 		     scan->htinfo[0] == IEEE80211_ELEMID_VENDOR ?
70168e8e04eSSam Leffler 			 4 + sizeof(struct ieee80211_ie_htinfo)-2 :
70268e8e04eSSam Leffler 			 sizeof(struct ieee80211_ie_htinfo)-2,
703b032f27cSSam Leffler 		     scan->htinfo = NULL);
704b032f27cSSam Leffler 	}
705b032f27cSSam Leffler 	return scan->status;
70668e8e04eSSam Leffler }
7071a1e1d21SSam Leffler 
7081a1e1d21SSam Leffler /*
709b032f27cSSam Leffler  * Parse an Action frame.  Return 0 on success, non-zero on failure.
71044c72e42SSam Leffler  */
711b032f27cSSam Leffler int
712b032f27cSSam Leffler ieee80211_parse_action(struct ieee80211_node *ni, struct mbuf *m)
713b032f27cSSam Leffler {
714b032f27cSSam Leffler 	struct ieee80211vap *vap = ni->ni_vap;
71568e8e04eSSam Leffler 	const struct ieee80211_action *ia;
716b032f27cSSam Leffler 	struct ieee80211_frame *wh;
717b032f27cSSam Leffler 	uint8_t *frm, *efrm;
71868e8e04eSSam Leffler 
71968e8e04eSSam Leffler 	/*
72068e8e04eSSam Leffler 	 * action frame format:
72168e8e04eSSam Leffler 	 *	[1] category
72268e8e04eSSam Leffler 	 *	[1] action
72368e8e04eSSam Leffler 	 *	[tlv] parameters
72468e8e04eSSam Leffler 	 */
725b032f27cSSam Leffler 	wh = mtod(m, struct ieee80211_frame *);
726b032f27cSSam Leffler 	frm = (u_int8_t *)&wh[1];
727b032f27cSSam Leffler 	efrm = mtod(m, u_int8_t *) + m->m_len;
72868e8e04eSSam Leffler 	IEEE80211_VERIFY_LENGTH(efrm - frm,
729b032f27cSSam Leffler 		sizeof(struct ieee80211_action), return EINVAL);
73068e8e04eSSam Leffler 	ia = (const struct ieee80211_action *) frm;
73168e8e04eSSam Leffler 
732b032f27cSSam Leffler 	vap->iv_stats.is_rx_action++;
73368e8e04eSSam Leffler 	IEEE80211_NODE_STAT(ni, rx_action);
73468e8e04eSSam Leffler 
73568e8e04eSSam Leffler 	/* verify frame payloads but defer processing */
73668e8e04eSSam Leffler 	switch (ia->ia_category) {
73768e8e04eSSam Leffler 	case IEEE80211_ACTION_CAT_BA:
73868e8e04eSSam Leffler 		switch (ia->ia_action) {
73968e8e04eSSam Leffler 		case IEEE80211_ACTION_BA_ADDBA_REQUEST:
74068e8e04eSSam Leffler 			IEEE80211_VERIFY_LENGTH(efrm - frm,
74168e8e04eSSam Leffler 			    sizeof(struct ieee80211_action_ba_addbarequest),
742b032f27cSSam Leffler 			    return EINVAL);
74368e8e04eSSam Leffler 			break;
74468e8e04eSSam Leffler 		case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
74568e8e04eSSam Leffler 			IEEE80211_VERIFY_LENGTH(efrm - frm,
74668e8e04eSSam Leffler 			    sizeof(struct ieee80211_action_ba_addbaresponse),
747b032f27cSSam Leffler 			    return EINVAL);
74868e8e04eSSam Leffler 			break;
74968e8e04eSSam Leffler 		case IEEE80211_ACTION_BA_DELBA:
75068e8e04eSSam Leffler 			IEEE80211_VERIFY_LENGTH(efrm - frm,
75168e8e04eSSam Leffler 			    sizeof(struct ieee80211_action_ba_delba),
752b032f27cSSam Leffler 			    return EINVAL);
75368e8e04eSSam Leffler 			break;
75468e8e04eSSam Leffler 		}
75568e8e04eSSam Leffler 		break;
75668e8e04eSSam Leffler 	case IEEE80211_ACTION_CAT_HT:
75768e8e04eSSam Leffler 		switch (ia->ia_action) {
75868e8e04eSSam Leffler 		case IEEE80211_ACTION_HT_TXCHWIDTH:
75968e8e04eSSam Leffler 			IEEE80211_VERIFY_LENGTH(efrm - frm,
76068e8e04eSSam Leffler 			    sizeof(struct ieee80211_action_ht_txchwidth),
761b032f27cSSam Leffler 			    return EINVAL);
762b032f27cSSam Leffler 			break;
763b032f27cSSam Leffler 		case IEEE80211_ACTION_HT_MIMOPWRSAVE:
764b032f27cSSam Leffler 			IEEE80211_VERIFY_LENGTH(efrm - frm,
765b032f27cSSam Leffler 			    sizeof(struct ieee80211_action_ht_mimopowersave),
766b032f27cSSam Leffler 			    return EINVAL);
76768e8e04eSSam Leffler 			break;
76868e8e04eSSam Leffler 		}
76968e8e04eSSam Leffler 		break;
770dbab732dSGleb Smirnoff #ifdef IEEE80211_SUPPORT_MESH
771bdd2a076SAdrian Chadd 	case IEEE80211_ACTION_CAT_MESH:
772bdd2a076SAdrian Chadd 		switch (ia->ia_action) {
773bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_LMETRIC:
774bdd2a076SAdrian Chadd 			/*
775bdd2a076SAdrian Chadd 			 * XXX: verification is true only if we are using
776bdd2a076SAdrian Chadd 			 * Airtime link metric (default)
777bdd2a076SAdrian Chadd 			 */
778bdd2a076SAdrian Chadd 			IEEE80211_VERIFY_LENGTH(efrm - frm,
779bdd2a076SAdrian Chadd 			    sizeof(struct ieee80211_meshlmetric_ie),
780bdd2a076SAdrian Chadd 			    return EINVAL);
781bdd2a076SAdrian Chadd 			break;
782bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_HWMP:
783bdd2a076SAdrian Chadd 			/* verify something */
784bdd2a076SAdrian Chadd 			break;
785bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_GANN:
786c81ceff7SMonthadar Al Jaberi 			IEEE80211_VERIFY_LENGTH(efrm - frm,
787c81ceff7SMonthadar Al Jaberi 			    sizeof(struct ieee80211_meshgann_ie),
788c81ceff7SMonthadar Al Jaberi 			    return EINVAL);
789c81ceff7SMonthadar Al Jaberi 			break;
790bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_CC:
791bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_MCCA_SREQ:
792bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_MCCA_SREP:
793bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_MCCA_AREQ:
794bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_MCCA_ADVER:
795bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_MCCA_TRDOWN:
796bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_TBTT_REQ:
797bdd2a076SAdrian Chadd 		case IEEE80211_ACTION_MESH_TBTT_RES:
798bdd2a076SAdrian Chadd 			/* reject these early on, not implemented */
799bdd2a076SAdrian Chadd 			IEEE80211_DISCARD(vap,
800bdd2a076SAdrian Chadd 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
801bdd2a076SAdrian Chadd 			    wh, NULL, "not implemented yet, act=0x%02X",
802bdd2a076SAdrian Chadd 			    ia->ia_action);
803bdd2a076SAdrian Chadd 			return EINVAL;
804bdd2a076SAdrian Chadd 		}
805bdd2a076SAdrian Chadd 		break;
806ebeaa1adSMonthadar Al Jaberi 	case IEEE80211_ACTION_CAT_SELF_PROT:
807ebeaa1adSMonthadar Al Jaberi 		/* If TA or RA group address discard silently */
808ebeaa1adSMonthadar Al Jaberi 		if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
809ebeaa1adSMonthadar Al Jaberi 			IEEE80211_IS_MULTICAST(wh->i_addr2))
810ebeaa1adSMonthadar Al Jaberi 			return EINVAL;
811ebeaa1adSMonthadar Al Jaberi 		/*
812ebeaa1adSMonthadar Al Jaberi 		 * XXX: Should we verify complete length now or it is
813ebeaa1adSMonthadar Al Jaberi 		 * to varying in sizes?
814ebeaa1adSMonthadar Al Jaberi 		 */
815ebeaa1adSMonthadar Al Jaberi 		switch (ia->ia_action) {
816ebeaa1adSMonthadar Al Jaberi 		case IEEE80211_ACTION_MESHPEERING_CONFIRM:
817ebeaa1adSMonthadar Al Jaberi 		case IEEE80211_ACTION_MESHPEERING_CLOSE:
818ebeaa1adSMonthadar Al Jaberi 			/* is not a peering candidate (yet) */
819ebeaa1adSMonthadar Al Jaberi 			if (ni == vap->iv_bss)
820ebeaa1adSMonthadar Al Jaberi 				return EINVAL;
821ebeaa1adSMonthadar Al Jaberi 			break;
822ebeaa1adSMonthadar Al Jaberi 		}
823ebeaa1adSMonthadar Al Jaberi 		break;
824dbab732dSGleb Smirnoff #endif
82568e8e04eSSam Leffler 	}
826b032f27cSSam Leffler 	return 0;
8278a1b9b6aSSam Leffler }
8288a1b9b6aSSam Leffler 
8298a1b9b6aSSam Leffler #ifdef IEEE80211_DEBUG
8308a1b9b6aSSam Leffler /*
8318a1b9b6aSSam Leffler  * Debugging support.
8328a1b9b6aSSam Leffler  */
833b032f27cSSam Leffler void
834b032f27cSSam Leffler ieee80211_ssid_mismatch(struct ieee80211vap *vap, const char *tag,
835b032f27cSSam Leffler 	uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
836b032f27cSSam Leffler {
837b032f27cSSam Leffler 	printf("[%s] discard %s frame, ssid mismatch: ",
838b032f27cSSam Leffler 		ether_sprintf(mac), tag);
839b032f27cSSam Leffler 	ieee80211_print_essid(ssid + 2, ssid[1]);
840b032f27cSSam Leffler 	printf("\n");
841b032f27cSSam Leffler }
8428a1b9b6aSSam Leffler 
8438a1b9b6aSSam Leffler /*
8448a1b9b6aSSam Leffler  * Return the bssid of a frame.
8458a1b9b6aSSam Leffler  */
84668e8e04eSSam Leffler static const uint8_t *
847d2bc4bf6SRui Paulo ieee80211_getbssid(const struct ieee80211vap *vap,
848d2bc4bf6SRui Paulo 	const struct ieee80211_frame *wh)
8498a1b9b6aSSam Leffler {
850b032f27cSSam Leffler 	if (vap->iv_opmode == IEEE80211_M_STA)
8518a1b9b6aSSam Leffler 		return wh->i_addr2;
8528a1b9b6aSSam Leffler 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
8538a1b9b6aSSam Leffler 		return wh->i_addr1;
8548a1b9b6aSSam Leffler 	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
8558a1b9b6aSSam Leffler 		return wh->i_addr1;
8568a1b9b6aSSam Leffler 	return wh->i_addr3;
8578a1b9b6aSSam Leffler }
8588a1b9b6aSSam Leffler 
859b032f27cSSam Leffler #include <machine/stdarg.h>
860b032f27cSSam Leffler 
861f6df3191SSam Leffler void
862d2bc4bf6SRui Paulo ieee80211_note(const struct ieee80211vap *vap, const char *fmt, ...)
863f6df3191SSam Leffler {
864f6df3191SSam Leffler 	char buf[128];		/* XXX */
865f6df3191SSam Leffler 	va_list ap;
866f6df3191SSam Leffler 
867f6df3191SSam Leffler 	va_start(ap, fmt);
868f6df3191SSam Leffler 	vsnprintf(buf, sizeof(buf), fmt, ap);
869f6df3191SSam Leffler 	va_end(ap);
870f6df3191SSam Leffler 
871b032f27cSSam Leffler 	if_printf(vap->iv_ifp, "%s", buf);	/* NB: no \n */
872f6df3191SSam Leffler }
873f6df3191SSam Leffler 
874f6df3191SSam Leffler void
875d2bc4bf6SRui Paulo ieee80211_note_frame(const struct ieee80211vap *vap,
876f6df3191SSam Leffler 	const struct ieee80211_frame *wh,
877f6df3191SSam Leffler 	const char *fmt, ...)
878f6df3191SSam Leffler {
879f6df3191SSam Leffler 	char buf[128];		/* XXX */
880f6df3191SSam Leffler 	va_list ap;
881f6df3191SSam Leffler 
882f6df3191SSam Leffler 	va_start(ap, fmt);
883f6df3191SSam Leffler 	vsnprintf(buf, sizeof(buf), fmt, ap);
884f6df3191SSam Leffler 	va_end(ap);
885b032f27cSSam Leffler 	if_printf(vap->iv_ifp, "[%s] %s\n",
886b032f27cSSam Leffler 		ether_sprintf(ieee80211_getbssid(vap, wh)), buf);
887f6df3191SSam Leffler }
888f6df3191SSam Leffler 
889f6df3191SSam Leffler void
890d2bc4bf6SRui Paulo ieee80211_note_mac(const struct ieee80211vap *vap,
89168e8e04eSSam Leffler 	const uint8_t mac[IEEE80211_ADDR_LEN],
892f6df3191SSam Leffler 	const char *fmt, ...)
893f6df3191SSam Leffler {
894f6df3191SSam Leffler 	char buf[128];		/* XXX */
895f6df3191SSam Leffler 	va_list ap;
896f6df3191SSam Leffler 
897f6df3191SSam Leffler 	va_start(ap, fmt);
898f6df3191SSam Leffler 	vsnprintf(buf, sizeof(buf), fmt, ap);
899f6df3191SSam Leffler 	va_end(ap);
900b032f27cSSam Leffler 	if_printf(vap->iv_ifp, "[%s] %s\n", ether_sprintf(mac), buf);
901f6df3191SSam Leffler }
902f6df3191SSam Leffler 
903a000d7c2SSam Leffler void
904d2bc4bf6SRui Paulo ieee80211_discard_frame(const struct ieee80211vap *vap,
9058a1b9b6aSSam Leffler 	const struct ieee80211_frame *wh,
9068a1b9b6aSSam Leffler 	const char *type, const char *fmt, ...)
9078a1b9b6aSSam Leffler {
9088a1b9b6aSSam Leffler 	va_list ap;
9098a1b9b6aSSam Leffler 
910b032f27cSSam Leffler 	if_printf(vap->iv_ifp, "[%s] discard ",
911b032f27cSSam Leffler 		ether_sprintf(ieee80211_getbssid(vap, wh)));
912b032f27cSSam Leffler 	if (type == NULL) {
913b032f27cSSam Leffler 		printf("%s frame, ", ieee80211_mgt_subtype_name[
914b032f27cSSam Leffler 			(wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) >>
915b032f27cSSam Leffler 			IEEE80211_FC0_SUBTYPE_SHIFT]);
916b032f27cSSam Leffler 	} else
9178a1b9b6aSSam Leffler 		printf("%s frame, ", type);
9188a1b9b6aSSam Leffler 	va_start(ap, fmt);
9198a1b9b6aSSam Leffler 	vprintf(fmt, ap);
9208a1b9b6aSSam Leffler 	va_end(ap);
9218a1b9b6aSSam Leffler 	printf("\n");
9228a1b9b6aSSam Leffler }
9238a1b9b6aSSam Leffler 
924a000d7c2SSam Leffler void
925d2bc4bf6SRui Paulo ieee80211_discard_ie(const struct ieee80211vap *vap,
9268a1b9b6aSSam Leffler 	const struct ieee80211_frame *wh,
9278a1b9b6aSSam Leffler 	const char *type, const char *fmt, ...)
9288a1b9b6aSSam Leffler {
9298a1b9b6aSSam Leffler 	va_list ap;
9308a1b9b6aSSam Leffler 
931b032f27cSSam Leffler 	if_printf(vap->iv_ifp, "[%s] discard ",
932b032f27cSSam Leffler 		ether_sprintf(ieee80211_getbssid(vap, wh)));
9338a1b9b6aSSam Leffler 	if (type != NULL)
9348a1b9b6aSSam Leffler 		printf("%s information element, ", type);
9358a1b9b6aSSam Leffler 	else
9368a1b9b6aSSam Leffler 		printf("information element, ");
9378a1b9b6aSSam Leffler 	va_start(ap, fmt);
9388a1b9b6aSSam Leffler 	vprintf(fmt, ap);
9398a1b9b6aSSam Leffler 	va_end(ap);
9408a1b9b6aSSam Leffler 	printf("\n");
9418a1b9b6aSSam Leffler }
9428a1b9b6aSSam Leffler 
943a000d7c2SSam Leffler void
944d2bc4bf6SRui Paulo ieee80211_discard_mac(const struct ieee80211vap *vap,
94568e8e04eSSam Leffler 	const uint8_t mac[IEEE80211_ADDR_LEN],
9468a1b9b6aSSam Leffler 	const char *type, const char *fmt, ...)
9478a1b9b6aSSam Leffler {
9488a1b9b6aSSam Leffler 	va_list ap;
9498a1b9b6aSSam Leffler 
950b032f27cSSam Leffler 	if_printf(vap->iv_ifp, "[%s] discard ", ether_sprintf(mac));
9518a1b9b6aSSam Leffler 	if (type != NULL)
9528a1b9b6aSSam Leffler 		printf("%s frame, ", type);
9538a1b9b6aSSam Leffler 	else
9548a1b9b6aSSam Leffler 		printf("frame, ");
9558a1b9b6aSSam Leffler 	va_start(ap, fmt);
9568a1b9b6aSSam Leffler 	vprintf(fmt, ap);
9578a1b9b6aSSam Leffler 	va_end(ap);
9588a1b9b6aSSam Leffler 	printf("\n");
9598a1b9b6aSSam Leffler }
9608a1b9b6aSSam Leffler #endif /* IEEE80211_DEBUG */
961