xref: /freebsd/sys/net80211/ieee80211_input.c (revision 87569f75a91f298c52a71823c04d41cf53c88889)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  * 3. The name of the author may not be used to endorse or promote products
15  *    derived from this software without specific prior written permission.
16  *
17  * Alternatively, this software may be distributed under the terms of the
18  * GNU General Public License ("GPL") version 2 as published by the Free
19  * Software Foundation.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31  */
32 
33 #include <sys/cdefs.h>
34 __FBSDID("$FreeBSD$");
35 
36 #include <sys/param.h>
37 #include <sys/systm.h>
38 #include <sys/mbuf.h>
39 #include <sys/malloc.h>
40 #include <sys/endian.h>
41 #include <sys/kernel.h>
42 
43 #include <sys/socket.h>
44 
45 #include <net/if.h>
46 #include <net/if_media.h>
47 #include <net/ethernet.h>
48 #include <net/if_llc.h>
49 #include <net/if_vlan_var.h>
50 
51 #include <net80211/ieee80211_var.h>
52 
53 #include <net/bpf.h>
54 
55 #ifdef IEEE80211_DEBUG
56 #include <machine/stdarg.h>
57 
58 /*
59  * Decide if a received management frame should be
60  * printed when debugging is enabled.  This filters some
61  * of the less interesting frames that come frequently
62  * (e.g. beacons).
63  */
64 static __inline int
65 doprint(struct ieee80211com *ic, int subtype)
66 {
67 	switch (subtype) {
68 	case IEEE80211_FC0_SUBTYPE_BEACON:
69 		return (ic->ic_flags & IEEE80211_F_SCAN);
70 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
71 		return (ic->ic_opmode == IEEE80211_M_IBSS);
72 	}
73 	return 1;
74 }
75 
76 /*
77  * Emit a debug message about discarding a frame or information
78  * element.  One format is for extracting the mac address from
79  * the frame header; the other is for when a header is not
80  * available or otherwise appropriate.
81  */
82 #define	IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...) do {		\
83 	if ((_ic)->ic_debug & (_m))					\
84 		ieee80211_discard_frame(_ic, _wh, _type, _fmt, __VA_ARGS__);\
85 } while (0)
86 #define	IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...) do {	\
87 	if ((_ic)->ic_debug & (_m))					\
88 		ieee80211_discard_ie(_ic, _wh, _type, _fmt, __VA_ARGS__);\
89 } while (0)
90 #define	IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...) do {	\
91 	if ((_ic)->ic_debug & (_m))					\
92 		ieee80211_discard_mac(_ic, _mac, _type, _fmt, __VA_ARGS__);\
93 } while (0)
94 
95 static const u_int8_t *ieee80211_getbssid(struct ieee80211com *,
96 	const struct ieee80211_frame *);
97 static void ieee80211_discard_frame(struct ieee80211com *,
98 	const struct ieee80211_frame *, const char *type, const char *fmt, ...);
99 static void ieee80211_discard_ie(struct ieee80211com *,
100 	const struct ieee80211_frame *, const char *type, const char *fmt, ...);
101 static void ieee80211_discard_mac(struct ieee80211com *,
102 	const u_int8_t mac[IEEE80211_ADDR_LEN], const char *type,
103 	const char *fmt, ...);
104 #else
105 #define	IEEE80211_DISCARD(_ic, _m, _wh, _type, _fmt, ...)
106 #define	IEEE80211_DISCARD_IE(_ic, _m, _wh, _type, _fmt, ...)
107 #define	IEEE80211_DISCARD_MAC(_ic, _m, _mac, _type, _fmt, ...)
108 #endif /* IEEE80211_DEBUG */
109 
110 static struct mbuf *ieee80211_defrag(struct ieee80211com *,
111 	struct ieee80211_node *, struct mbuf *, int);
112 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int);
113 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *,
114 		const u_int8_t *mac, int subtype, int arg);
115 static void ieee80211_deliver_data(struct ieee80211com *,
116 	struct ieee80211_node *, struct mbuf *);
117 static void ieee80211_node_pwrsave(struct ieee80211_node *, int enable);
118 static void ieee80211_recv_pspoll(struct ieee80211com *,
119 	struct ieee80211_node *, struct mbuf *);
120 
121 /*
122  * Process a received frame.  The node associated with the sender
123  * should be supplied.  If nothing was found in the node table then
124  * the caller is assumed to supply a reference to ic_bss instead.
125  * The RSSI and a timestamp are also supplied.  The RSSI data is used
126  * during AP scanning to select a AP to associate with; it can have
127  * any units so long as values have consistent units and higher values
128  * mean ``better signal''.  The receive timestamp is currently not used
129  * by the 802.11 layer.
130  */
131 int
132 ieee80211_input(struct ieee80211com *ic, struct mbuf *m,
133 	struct ieee80211_node *ni, int rssi, u_int32_t rstamp)
134 {
135 #define	SEQ_LEQ(a,b)	((int)((a)-(b)) <= 0)
136 #define	HAS_SEQ(type)	((type & 0x4) == 0)
137 	struct ifnet *ifp = ic->ic_ifp;
138 	struct ieee80211_frame *wh;
139 	struct ieee80211_key *key;
140 	struct ether_header *eh;
141 	int hdrspace;
142 	u_int8_t dir, type, subtype;
143 	u_int8_t *bssid;
144 	u_int16_t rxseq;
145 
146 	KASSERT(ni != NULL, ("null node"));
147 	ni->ni_inact = ni->ni_inact_reload;
148 
149 	/* trim CRC here so WEP can find its own CRC at the end of packet. */
150 	if (m->m_flags & M_HASFCS) {
151 		m_adj(m, -IEEE80211_CRC_LEN);
152 		m->m_flags &= ~M_HASFCS;
153 	}
154 	type = -1;			/* undefined */
155 	/*
156 	 * In monitor mode, send everything directly to bpf.
157 	 * XXX may want to include the CRC
158 	 */
159 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
160 		goto out;
161 
162 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
163 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
164 		    ni->ni_macaddr, NULL,
165 		    "too short (1): len %u", m->m_pkthdr.len);
166 		ic->ic_stats.is_rx_tooshort++;
167 		goto out;
168 	}
169 	/*
170 	 * Bit of a cheat here, we use a pointer for a 3-address
171 	 * frame format but don't reference fields past outside
172 	 * ieee80211_frame_min w/o first validating the data is
173 	 * present.
174 	 */
175 	wh = mtod(m, struct ieee80211_frame *);
176 
177 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
178 	    IEEE80211_FC0_VERSION_0) {
179 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
180 		    ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
181 		ic->ic_stats.is_rx_badversion++;
182 		goto err;
183 	}
184 
185 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
186 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
187 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
188 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
189 		switch (ic->ic_opmode) {
190 		case IEEE80211_M_STA:
191 			bssid = wh->i_addr2;
192 			if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
193 				/* not interested in */
194 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
195 				    bssid, NULL, "%s", "not to bss");
196 				ic->ic_stats.is_rx_wrongbss++;
197 				goto out;
198 			}
199 			break;
200 		case IEEE80211_M_IBSS:
201 		case IEEE80211_M_AHDEMO:
202 		case IEEE80211_M_HOSTAP:
203 			if (dir != IEEE80211_FC1_DIR_NODS)
204 				bssid = wh->i_addr1;
205 			else if (type == IEEE80211_FC0_TYPE_CTL)
206 				bssid = wh->i_addr1;
207 			else {
208 				if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
209 					IEEE80211_DISCARD_MAC(ic,
210 					    IEEE80211_MSG_ANY, ni->ni_macaddr,
211 					    NULL, "too short (2): len %u",
212 					    m->m_pkthdr.len);
213 					ic->ic_stats.is_rx_tooshort++;
214 					goto out;
215 				}
216 				bssid = wh->i_addr3;
217 			}
218 			if (type != IEEE80211_FC0_TYPE_DATA)
219 				break;
220 			/*
221 			 * Data frame, validate the bssid.
222 			 */
223 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) &&
224 			    !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
225 				/* not interested in */
226 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
227 				    bssid, NULL, "%s", "not to bss");
228 				ic->ic_stats.is_rx_wrongbss++;
229 				goto out;
230 			}
231 			/*
232 			 * For adhoc mode we cons up a node when it doesn't
233 			 * exist. This should probably done after an ACL check.
234 			 */
235 			if (ni == ic->ic_bss &&
236 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
237 			    !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
238 				/*
239 				 * Fake up a node for this newly
240 				 * discovered member of the IBSS.
241 				 */
242 				ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
243 						    wh->i_addr2);
244 				if (ni == NULL) {
245 					/* NB: stat kept for alloc failure */
246 					goto err;
247 				}
248 			}
249 			break;
250 		default:
251 			goto out;
252 		}
253 		ni->ni_rssi = rssi;
254 		ni->ni_rstamp = rstamp;
255 		if (HAS_SEQ(type)) {
256 			u_int8_t tid;
257 			if (IEEE80211_QOS_HAS_SEQ(wh)) {
258 				tid = ((struct ieee80211_qosframe *)wh)->
259 					i_qos[0] & IEEE80211_QOS_TID;
260 				if (TID_TO_WME_AC(tid) >= WME_AC_VI)
261 					ic->ic_wme.wme_hipri_traffic++;
262 				tid++;
263 			} else
264 				tid = 0;
265 			rxseq = le16toh(*(u_int16_t *)wh->i_seq);
266 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
267 			    SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
268 				/* duplicate, discard */
269 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
270 				    bssid, "duplicate",
271 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
272 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
273 				    ni->ni_rxseqs[tid] >>
274 					IEEE80211_SEQ_SEQ_SHIFT,
275 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
276 				    ni->ni_rxseqs[tid] &
277 					IEEE80211_SEQ_FRAG_MASK,
278 				    tid);
279 				ic->ic_stats.is_rx_dup++;
280 				IEEE80211_NODE_STAT(ni, rx_dup);
281 				goto out;
282 			}
283 			ni->ni_rxseqs[tid] = rxseq;
284 		}
285 	}
286 
287 	switch (type) {
288 	case IEEE80211_FC0_TYPE_DATA:
289 		hdrspace = ieee80211_hdrspace(ic, wh);
290 		if (m->m_len < hdrspace &&
291 		    (m = m_pullup(m, hdrspace)) == NULL) {
292 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
293 			    ni->ni_macaddr, NULL,
294 			    "data too short: expecting %u", hdrspace);
295 			ic->ic_stats.is_rx_tooshort++;
296 			goto out;		/* XXX */
297 		}
298 		switch (ic->ic_opmode) {
299 		case IEEE80211_M_STA:
300 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
301 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
302 				    wh, "data", "%s", "unknown dir 0x%x", dir);
303 				ic->ic_stats.is_rx_wrongdir++;
304 				goto out;
305 			}
306 			if ((ifp->if_flags & IFF_SIMPLEX) &&
307 			    IEEE80211_IS_MULTICAST(wh->i_addr1) &&
308 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) {
309 				/*
310 				 * In IEEE802.11 network, multicast packet
311 				 * sent from me is broadcasted from AP.
312 				 * It should be silently discarded for
313 				 * SIMPLEX interface.
314 				 */
315 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
316 				    wh, NULL, "%s", "multicast echo");
317 				ic->ic_stats.is_rx_mcastecho++;
318 				goto out;
319 			}
320 			break;
321 		case IEEE80211_M_IBSS:
322 		case IEEE80211_M_AHDEMO:
323 			if (dir != IEEE80211_FC1_DIR_NODS) {
324 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
325 				    wh, "data", "%s", "unknown dir 0x%x", dir);
326 				ic->ic_stats.is_rx_wrongdir++;
327 				goto out;
328 			}
329 			/* XXX no power-save support */
330 			break;
331 		case IEEE80211_M_HOSTAP:
332 			if (dir != IEEE80211_FC1_DIR_TODS) {
333 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
334 				    wh, "data", "%s", "unknown dir 0x%x", dir);
335 				ic->ic_stats.is_rx_wrongdir++;
336 				goto out;
337 			}
338 			/* check if source STA is associated */
339 			if (ni == ic->ic_bss) {
340 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
341 				    wh, "data", "%s", "unknown src");
342 				ieee80211_send_error(ic, ni, wh->i_addr2,
343 				    IEEE80211_FC0_SUBTYPE_DEAUTH,
344 				    IEEE80211_REASON_NOT_AUTHED);
345 				ic->ic_stats.is_rx_notassoc++;
346 				goto err;
347 			}
348 			if (ni->ni_associd == 0) {
349 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
350 				    wh, "data", "%s", "unassoc src");
351 				IEEE80211_SEND_MGMT(ic, ni,
352 				    IEEE80211_FC0_SUBTYPE_DISASSOC,
353 				    IEEE80211_REASON_NOT_ASSOCED);
354 				ic->ic_stats.is_rx_notassoc++;
355 				goto err;
356 			}
357 
358 			/*
359 			 * Check for power save state change.
360 			 */
361 			if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
362 			    (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
363 				ieee80211_node_pwrsave(ni,
364 					wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
365 			break;
366 		default:
367 			/* XXX here to keep compiler happy */
368 			goto out;
369 		}
370 
371 		/*
372 		 * Handle privacy requirements.  Note that we
373 		 * must not be preempted from here until after
374 		 * we (potentially) call ieee80211_crypto_demic;
375 		 * otherwise we may violate assumptions in the
376 		 * crypto cipher modules used to do delayed update
377 		 * of replay sequence numbers.
378 		 */
379 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
380 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
381 				/*
382 				 * Discard encrypted frames when privacy is off.
383 				 */
384 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
385 				    wh, "WEP", "%s", "PRIVACY off");
386 				ic->ic_stats.is_rx_noprivacy++;
387 				IEEE80211_NODE_STAT(ni, rx_noprivacy);
388 				goto out;
389 			}
390 			key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
391 			if (key == NULL) {
392 				/* NB: stats+msgs handled in crypto_decap */
393 				IEEE80211_NODE_STAT(ni, rx_wepfail);
394 				goto out;
395 			}
396 			wh = mtod(m, struct ieee80211_frame *);
397 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
398 		} else {
399 			key = NULL;
400 		}
401 
402 		/*
403 		 * Next up, any fragmentation.
404 		 */
405 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
406 			m = ieee80211_defrag(ic, ni, m, hdrspace);
407 			if (m == NULL) {
408 				/* Fragment dropped or frame not complete yet */
409 				goto out;
410 			}
411 		}
412 		wh = NULL;		/* no longer valid, catch any uses */
413 
414 		/*
415 		 * Next strip any MSDU crypto bits.
416 		 */
417 		if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) {
418 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
419 			    ni->ni_macaddr, "data", "%s", "demic error");
420 			IEEE80211_NODE_STAT(ni, rx_demicfail);
421 			goto out;
422 		}
423 
424 		/* copy to listener after decrypt */
425 		if (ic->ic_rawbpf)
426 			bpf_mtap(ic->ic_rawbpf, m);
427 
428 		/*
429 		 * Finally, strip the 802.11 header.
430 		 */
431 		m = ieee80211_decap(ic, m, hdrspace);
432 		if (m == NULL) {
433 			/* don't count Null data frames as errors */
434 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA)
435 				goto out;
436 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
437 			    ni->ni_macaddr, "data", "%s", "decap error");
438 			ic->ic_stats.is_rx_decap++;
439 			IEEE80211_NODE_STAT(ni, rx_decap);
440 			goto err;
441 		}
442 		eh = mtod(m, struct ether_header *);
443 		if (!ieee80211_node_is_authorized(ni)) {
444 			/*
445 			 * Deny any non-PAE frames received prior to
446 			 * authorization.  For open/shared-key
447 			 * authentication the port is mark authorized
448 			 * after authentication completes.  For 802.1x
449 			 * the port is not marked authorized by the
450 			 * authenticator until the handshake has completed.
451 			 */
452 			if (eh->ether_type != htons(ETHERTYPE_PAE)) {
453 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
454 				    eh->ether_shost, "data",
455 				    "unauthorized port: ether type 0x%x len %u",
456 				    eh->ether_type, m->m_pkthdr.len);
457 				ic->ic_stats.is_rx_unauth++;
458 				IEEE80211_NODE_STAT(ni, rx_unauth);
459 				goto err;
460 			}
461 		} else {
462 			/*
463 			 * When denying unencrypted frames, discard
464 			 * any non-PAE frames received without encryption.
465 			 */
466 			if ((ic->ic_flags & IEEE80211_F_DROPUNENC) &&
467 			    key == NULL &&
468 			    eh->ether_type != htons(ETHERTYPE_PAE)) {
469 				/*
470 				 * Drop unencrypted frames.
471 				 */
472 				ic->ic_stats.is_rx_unencrypted++;
473 				IEEE80211_NODE_STAT(ni, rx_unencrypted);
474 				goto out;
475 			}
476 		}
477 		ifp->if_ipackets++;
478 		IEEE80211_NODE_STAT(ni, rx_data);
479 		IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
480 
481 		ieee80211_deliver_data(ic, ni, m);
482 		return IEEE80211_FC0_TYPE_DATA;
483 
484 	case IEEE80211_FC0_TYPE_MGT:
485 		IEEE80211_NODE_STAT(ni, rx_mgmt);
486 		if (dir != IEEE80211_FC1_DIR_NODS) {
487 			IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
488 			    wh, "data", "%s", "unknown dir 0x%x", dir);
489 			ic->ic_stats.is_rx_wrongdir++;
490 			goto err;
491 		}
492 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
493 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
494 			    ni->ni_macaddr, "mgt", "too short: len %u",
495 			    m->m_pkthdr.len);
496 			ic->ic_stats.is_rx_tooshort++;
497 			goto out;
498 		}
499 #ifdef IEEE80211_DEBUG
500 		if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) ||
501 		    ieee80211_msg_dumppkts(ic)) {
502 			if_printf(ic->ic_ifp, "received %s from %s rssi %d\n",
503 			    ieee80211_mgt_subtype_name[subtype >>
504 				IEEE80211_FC0_SUBTYPE_SHIFT],
505 			    ether_sprintf(wh->i_addr2), rssi);
506 		}
507 #endif
508 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
509 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
510 				/*
511 				 * Only shared key auth frames with a challenge
512 				 * should be encrypted, discard all others.
513 				 */
514 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
515 				    wh, ieee80211_mgt_subtype_name[subtype >>
516 					IEEE80211_FC0_SUBTYPE_SHIFT],
517 				    "%s", "WEP set but not permitted");
518 				ic->ic_stats.is_rx_mgtdiscard++; /* XXX */
519 				goto out;
520 			}
521 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
522 				/*
523 				 * Discard encrypted frames when privacy is off.
524 				 */
525 				IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
526 				    wh, "mgt", "%s", "WEP set but PRIVACY off");
527 				ic->ic_stats.is_rx_noprivacy++;
528 				goto out;
529 			}
530 			hdrspace = ieee80211_hdrspace(ic, wh);
531 			key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
532 			if (key == NULL) {
533 				/* NB: stats+msgs handled in crypto_decap */
534 				goto out;
535 			}
536 			wh = mtod(m, struct ieee80211_frame *);
537 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
538 		}
539 		if (ic->ic_rawbpf)
540 			bpf_mtap(ic->ic_rawbpf, m);
541 		(*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
542 		m_freem(m);
543 		return type;
544 
545 	case IEEE80211_FC0_TYPE_CTL:
546 		IEEE80211_NODE_STAT(ni, rx_ctrl);
547 		ic->ic_stats.is_rx_ctl++;
548 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
549 			switch (subtype) {
550 			case IEEE80211_FC0_SUBTYPE_PS_POLL:
551 				ieee80211_recv_pspoll(ic, ni, m);
552 				break;
553 			}
554 		}
555 		goto out;
556 	default:
557 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
558 		    wh, NULL, "bad frame type 0x%x", type);
559 		/* should not come here */
560 		break;
561 	}
562 err:
563 	ifp->if_ierrors++;
564 out:
565 	if (m != NULL) {
566 		if (ic->ic_rawbpf)
567 			bpf_mtap(ic->ic_rawbpf, m);
568 		m_freem(m);
569 	}
570 	return type;
571 #undef SEQ_LEQ
572 }
573 
574 /*
575  * This function reassemble fragments.
576  */
577 static struct mbuf *
578 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni,
579 	struct mbuf *m, int hdrspace)
580 {
581 	struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
582 	struct ieee80211_frame *lwh;
583 	u_int16_t rxseq;
584 	u_int8_t fragno;
585 	u_int8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
586 	struct mbuf *mfrag;
587 
588 	KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
589 
590 	rxseq = le16toh(*(u_int16_t *)wh->i_seq);
591 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
592 
593 	/* Quick way out, if there's nothing to defragment */
594 	if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
595 		return m;
596 
597 	/*
598 	 * Remove frag to insure it doesn't get reaped by timer.
599 	 */
600 	if (ni->ni_table == NULL) {
601 		/*
602 		 * Should never happen.  If the node is orphaned (not in
603 		 * the table) then input packets should not reach here.
604 		 * Otherwise, a concurrent request that yanks the table
605 		 * should be blocked by other interlocking and/or by first
606 		 * shutting the driver down.  Regardless, be defensive
607 		 * here and just bail
608 		 */
609 		/* XXX need msg+stat */
610 		m_freem(m);
611 		return NULL;
612 	}
613 	IEEE80211_NODE_LOCK(ni->ni_table);
614 	mfrag = ni->ni_rxfrag[0];
615 	ni->ni_rxfrag[0] = NULL;
616 	IEEE80211_NODE_UNLOCK(ni->ni_table);
617 
618 	/*
619 	 * Validate new fragment is in order and
620 	 * related to the previous ones.
621 	 */
622 	if (mfrag != NULL) {
623 		u_int16_t last_rxseq;
624 
625 		lwh = mtod(mfrag, struct ieee80211_frame *);
626 		last_rxseq = le16toh(*(u_int16_t *)lwh->i_seq);
627 		/* NB: check seq # and frag together */
628 		if (rxseq != last_rxseq+1 ||
629 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
630 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
631 			/*
632 			 * Unrelated fragment or no space for it,
633 			 * clear current fragments.
634 			 */
635 			m_freem(mfrag);
636 			mfrag = NULL;
637 		}
638 	}
639 
640  	if (mfrag == NULL) {
641 		if (fragno != 0) {		/* !first fragment, discard */
642 			IEEE80211_NODE_STAT(ni, rx_defrag);
643 			m_freem(m);
644 			return NULL;
645 		}
646 		mfrag = m;
647 	} else {				/* concatenate */
648 		m_adj(m, hdrspace);		/* strip header */
649 		m_cat(mfrag, m);
650 		/* NB: m_cat doesn't update the packet header */
651 		mfrag->m_pkthdr.len += m->m_pkthdr.len;
652 		/* track last seqnum and fragno */
653 		lwh = mtod(mfrag, struct ieee80211_frame *);
654 		*(u_int16_t *) lwh->i_seq = *(u_int16_t *) wh->i_seq;
655 	}
656 	if (more_frag) {			/* more to come, save */
657 		ni->ni_rxfragstamp = ticks;
658 		ni->ni_rxfrag[0] = mfrag;
659 		mfrag = NULL;
660 	}
661 	return mfrag;
662 }
663 
664 static void
665 ieee80211_deliver_data(struct ieee80211com *ic,
666 	struct ieee80211_node *ni, struct mbuf *m)
667 {
668 	struct ether_header *eh = mtod(m, struct ether_header *);
669 	struct ifnet *ifp = ic->ic_ifp;
670 
671 	/* perform as a bridge within the AP */
672 	if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
673 	    (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) {
674 		struct mbuf *m1 = NULL;
675 
676 		if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
677 			m1 = m_dup(m, M_DONTWAIT);
678 			if (m1 == NULL)
679 				ifp->if_oerrors++;
680 			else
681 				m1->m_flags |= M_MCAST;
682 		} else {
683 			/*
684 			 * Check if the destination is known; if so
685 			 * and the port is authorized dispatch directly.
686 			 */
687 			struct ieee80211_node *sta =
688 			    ieee80211_find_node(&ic->ic_sta, eh->ether_dhost);
689 			if (sta != NULL) {
690 				if (ieee80211_node_is_authorized(sta)) {
691 					/*
692 					 * Beware of sending to ourself; this
693 					 * needs to happen via the normal
694 					 * input path.
695 					 */
696 					if (sta != ic->ic_bss) {
697 						m1 = m;
698 						m = NULL;
699 					}
700 				} else {
701 					ic->ic_stats.is_rx_unauth++;
702 					IEEE80211_NODE_STAT(sta, rx_unauth);
703 				}
704 				ieee80211_free_node(sta);
705 			}
706 		}
707 		if (m1 != NULL)
708 			IF_HANDOFF(&ifp->if_snd, m1, ifp);
709 	}
710 	if (m != NULL) {
711 		if (ni->ni_vlan != 0) {
712 			/* attach vlan tag */
713 			VLAN_INPUT_TAG(ifp, m, ni->ni_vlan);
714 			if (m == NULL)
715 				goto out;	/* XXX goto err? */
716 		}
717 		(*ifp->if_input)(ifp, m);
718 	}
719 	return;
720   out:
721 	if (m != NULL) {
722 		if (ic->ic_rawbpf)
723 			bpf_mtap(ic->ic_rawbpf, m);
724 		m_freem(m);
725 	}
726 }
727 
728 static struct mbuf *
729 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen)
730 {
731 	struct ieee80211_qosframe_addr4 wh;	/* Max size address frames */
732 	struct ether_header *eh;
733 	struct llc *llc;
734 
735 	if (m->m_len < hdrlen + sizeof(*llc) &&
736 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
737 		/* XXX stat, msg */
738 		return NULL;
739 	}
740 	memcpy(&wh, mtod(m, caddr_t), hdrlen);
741 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
742 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
743 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
744 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
745 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
746 		llc = NULL;
747 	} else {
748 		m_adj(m, hdrlen - sizeof(*eh));
749 	}
750 	eh = mtod(m, struct ether_header *);
751 	switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
752 	case IEEE80211_FC1_DIR_NODS:
753 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
754 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
755 		break;
756 	case IEEE80211_FC1_DIR_TODS:
757 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
758 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
759 		break;
760 	case IEEE80211_FC1_DIR_FROMDS:
761 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
762 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
763 		break;
764 	case IEEE80211_FC1_DIR_DSTODS:
765 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
766 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
767 		break;
768 	}
769 #ifdef ALIGNED_POINTER
770 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), u_int32_t)) {
771 		struct mbuf *n, *n0, **np;
772 		caddr_t newdata;
773 		int off, pktlen;
774 
775 		n0 = NULL;
776 		np = &n0;
777 		off = 0;
778 		pktlen = m->m_pkthdr.len;
779 		while (pktlen > off) {
780 			if (n0 == NULL) {
781 				MGETHDR(n, M_DONTWAIT, MT_DATA);
782 				if (n == NULL) {
783 					m_freem(m);
784 					return NULL;
785 				}
786 				M_MOVE_PKTHDR(n, m);
787 				n->m_len = MHLEN;
788 			} else {
789 				MGET(n, M_DONTWAIT, MT_DATA);
790 				if (n == NULL) {
791 					m_freem(m);
792 					m_freem(n0);
793 					return NULL;
794 				}
795 				n->m_len = MLEN;
796 			}
797 			if (pktlen - off >= MINCLSIZE) {
798 				MCLGET(n, M_DONTWAIT);
799 				if (n->m_flags & M_EXT)
800 					n->m_len = n->m_ext.ext_size;
801 			}
802 			if (n0 == NULL) {
803 				newdata =
804 				    (caddr_t)ALIGN(n->m_data + sizeof(*eh)) -
805 				    sizeof(*eh);
806 				n->m_len -= newdata - n->m_data;
807 				n->m_data = newdata;
808 			}
809 			if (n->m_len > pktlen - off)
810 				n->m_len = pktlen - off;
811 			m_copydata(m, off, n->m_len, mtod(n, caddr_t));
812 			off += n->m_len;
813 			*np = n;
814 			np = &n->m_next;
815 		}
816 		m_freem(m);
817 		m = n0;
818 	}
819 #endif /* ALIGNED_POINTER */
820 	if (llc != NULL) {
821 		eh = mtod(m, struct ether_header *);
822 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
823 	}
824 	return m;
825 }
826 
827 /*
828  * Install received rate set information in the node's state block.
829  */
830 int
831 ieee80211_setup_rates(struct ieee80211_node *ni,
832 	const u_int8_t *rates, const u_int8_t *xrates, int flags)
833 {
834 	struct ieee80211com *ic = ni->ni_ic;
835 	struct ieee80211_rateset *rs = &ni->ni_rates;
836 
837 	memset(rs, 0, sizeof(*rs));
838 	rs->rs_nrates = rates[1];
839 	memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
840 	if (xrates != NULL) {
841 		u_int8_t nxrates;
842 		/*
843 		 * Tack on 11g extended supported rate element.
844 		 */
845 		nxrates = xrates[1];
846 		if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
847 			nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
848 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE,
849 			     "[%s] extended rate set too large;"
850 			     " only using %u of %u rates\n",
851 			     ether_sprintf(ni->ni_macaddr), nxrates, xrates[1]);
852 			ic->ic_stats.is_rx_rstoobig++;
853 		}
854 		memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
855 		rs->rs_nrates += nxrates;
856 	}
857 	return ieee80211_fix_rate(ni, flags);
858 }
859 
860 static void
861 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh,
862     struct ieee80211_node *ni, int rssi, u_int32_t rstamp, u_int16_t seq,
863     u_int16_t status)
864 {
865 
866 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
867 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
868 		    ni->ni_macaddr, "open auth",
869 		    "bad sta auth mode %u", ni->ni_authmode);
870 		ic->ic_stats.is_rx_bad_auth++;	/* XXX */
871 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
872 			/* XXX hack to workaround calling convention */
873 			ieee80211_send_error(ic, ni, wh->i_addr2,
874 			    IEEE80211_FC0_SUBTYPE_AUTH,
875 			    (seq + 1) | (IEEE80211_STATUS_ALG<<16));
876 		}
877 		return;
878 	}
879 	switch (ic->ic_opmode) {
880 	case IEEE80211_M_IBSS:
881 	case IEEE80211_M_AHDEMO:
882 	case IEEE80211_M_MONITOR:
883 		/* should not come here */
884 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
885 		    ni->ni_macaddr, "open auth",
886 		    "bad operating mode %u", ic->ic_opmode);
887 		break;
888 
889 	case IEEE80211_M_HOSTAP:
890 		if (ic->ic_state != IEEE80211_S_RUN ||
891 		    seq != IEEE80211_AUTH_OPEN_REQUEST) {
892 			ic->ic_stats.is_rx_bad_auth++;
893 			return;
894 		}
895 		/* always accept open authentication requests */
896 		if (ni == ic->ic_bss) {
897 			ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
898 			if (ni == NULL)
899 				return;
900 		} else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
901 			(void) ieee80211_ref_node(ni);
902 		/*
903 		 * Mark the node as referenced to reflect that it's
904 		 * reference count has been bumped to insure it remains
905 		 * after the transaction completes.
906 		 */
907 		ni->ni_flags |= IEEE80211_NODE_AREF;
908 
909 		IEEE80211_SEND_MGMT(ic, ni,
910 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
911 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
912 		    "[%s] station authenticated (open)\n",
913 		    ether_sprintf(ni->ni_macaddr));
914 		/*
915 		 * When 802.1x is not in use mark the port
916 		 * authorized at this point so traffic can flow.
917 		 */
918 		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
919 			ieee80211_node_authorize(ni);
920 		break;
921 
922 	case IEEE80211_M_STA:
923 		if (ic->ic_state != IEEE80211_S_AUTH ||
924 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
925 			ic->ic_stats.is_rx_bad_auth++;
926 			return;
927 		}
928 		if (status != 0) {
929 			IEEE80211_DPRINTF(ic,
930 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
931 			    "[%s] open auth failed (reason %d)\n",
932 			    ether_sprintf(ni->ni_macaddr), status);
933 			/* XXX can this happen? */
934 			if (ni != ic->ic_bss)
935 				ni->ni_fails++;
936 			ic->ic_stats.is_rx_auth_fail++;
937 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
938 		} else
939 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
940 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
941 		break;
942 	}
943 }
944 
945 /*
946  * Send a management frame error response to the specified
947  * station.  If ni is associated with the station then use
948  * it; otherwise allocate a temporary node suitable for
949  * transmitting the frame and then free the reference so
950  * it will go away as soon as the frame has been transmitted.
951  */
952 static void
953 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni,
954 	const u_int8_t *mac, int subtype, int arg)
955 {
956 	int istmp;
957 
958 	if (ni == ic->ic_bss) {
959 		ni = ieee80211_tmp_node(ic, mac);
960 		if (ni == NULL) {
961 			/* XXX msg */
962 			return;
963 		}
964 		istmp = 1;
965 	} else
966 		istmp = 0;
967 	IEEE80211_SEND_MGMT(ic, ni, subtype, arg);
968 	if (istmp)
969 		ieee80211_free_node(ni);
970 }
971 
972 static int
973 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni)
974 {
975 	if (ni->ni_challenge == NULL)
976 		MALLOC(ni->ni_challenge, u_int32_t*, IEEE80211_CHALLENGE_LEN,
977 		    M_DEVBUF, M_NOWAIT);
978 	if (ni->ni_challenge == NULL) {
979 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
980 		    "[%s] shared key challenge alloc failed\n",
981 		    ether_sprintf(ni->ni_macaddr));
982 		/* XXX statistic */
983 	}
984 	return (ni->ni_challenge != NULL);
985 }
986 
987 /* XXX TODO: add statistics */
988 static void
989 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh,
990     u_int8_t *frm, u_int8_t *efrm, struct ieee80211_node *ni, int rssi,
991     u_int32_t rstamp, u_int16_t seq, u_int16_t status)
992 {
993 	u_int8_t *challenge;
994 	int allocbs, estatus;
995 
996 	/*
997 	 * NB: this can happen as we allow pre-shared key
998 	 * authentication to be enabled w/o wep being turned
999 	 * on so that configuration of these can be done
1000 	 * in any order.  It may be better to enforce the
1001 	 * ordering in which case this check would just be
1002 	 * for sanity/consistency.
1003 	 */
1004 	if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
1005 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1006 		    ni->ni_macaddr, "shared key auth",
1007 		    "%s", " PRIVACY is disabled");
1008 		estatus = IEEE80211_STATUS_ALG;
1009 		goto bad;
1010 	}
1011 	/*
1012 	 * Pre-shared key authentication is evil; accept
1013 	 * it only if explicitly configured (it is supported
1014 	 * mainly for compatibility with clients like OS X).
1015 	 */
1016 	if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1017 	    ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1018 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1019 		    ni->ni_macaddr, "shared key auth",
1020 		    "bad sta auth mode %u", ni->ni_authmode);
1021 		ic->ic_stats.is_rx_bad_auth++;	/* XXX maybe a unique error? */
1022 		estatus = IEEE80211_STATUS_ALG;
1023 		goto bad;
1024 	}
1025 
1026 	challenge = NULL;
1027 	if (frm + 1 < efrm) {
1028 		if ((frm[1] + 2) > (efrm - frm)) {
1029 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1030 			    ni->ni_macaddr, "shared key auth",
1031 			    "ie %d/%d too long",
1032 			    frm[0], (frm[1] + 2) - (efrm - frm));
1033 			ic->ic_stats.is_rx_bad_auth++;
1034 			estatus = IEEE80211_STATUS_CHALLENGE;
1035 			goto bad;
1036 		}
1037 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
1038 			challenge = frm;
1039 		frm += frm[1] + 2;
1040 	}
1041 	switch (seq) {
1042 	case IEEE80211_AUTH_SHARED_CHALLENGE:
1043 	case IEEE80211_AUTH_SHARED_RESPONSE:
1044 		if (challenge == NULL) {
1045 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1046 			    ni->ni_macaddr, "shared key auth",
1047 			    "%s", "no challenge");
1048 			ic->ic_stats.is_rx_bad_auth++;
1049 			estatus = IEEE80211_STATUS_CHALLENGE;
1050 			goto bad;
1051 		}
1052 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1053 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1054 			    ni->ni_macaddr, "shared key auth",
1055 			    "bad challenge len %d", challenge[1]);
1056 			ic->ic_stats.is_rx_bad_auth++;
1057 			estatus = IEEE80211_STATUS_CHALLENGE;
1058 			goto bad;
1059 		}
1060 	default:
1061 		break;
1062 	}
1063 	switch (ic->ic_opmode) {
1064 	case IEEE80211_M_MONITOR:
1065 	case IEEE80211_M_AHDEMO:
1066 	case IEEE80211_M_IBSS:
1067 		IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1068 		    ni->ni_macaddr, "shared key auth",
1069 		    "bad operating mode %u", ic->ic_opmode);
1070 		return;
1071 	case IEEE80211_M_HOSTAP:
1072 		if (ic->ic_state != IEEE80211_S_RUN) {
1073 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1074 			    ni->ni_macaddr, "shared key auth",
1075 			    "bad state %u", ic->ic_state);
1076 			estatus = IEEE80211_STATUS_ALG;	/* XXX */
1077 			goto bad;
1078 		}
1079 		switch (seq) {
1080 		case IEEE80211_AUTH_SHARED_REQUEST:
1081 			if (ni == ic->ic_bss) {
1082 				ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
1083 				if (ni == NULL) {
1084 					/* NB: no way to return an error */
1085 					return;
1086 				}
1087 				allocbs = 1;
1088 			} else {
1089 				if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1090 					(void) ieee80211_ref_node(ni);
1091 				allocbs = 0;
1092 			}
1093 			/*
1094 			 * Mark the node as referenced to reflect that it's
1095 			 * reference count has been bumped to insure it remains
1096 			 * after the transaction completes.
1097 			 */
1098 			ni->ni_flags |= IEEE80211_NODE_AREF;
1099 			ni->ni_rssi = rssi;
1100 			ni->ni_rstamp = rstamp;
1101 			if (!alloc_challenge(ic, ni)) {
1102 				/* NB: don't return error so they rexmit */
1103 				return;
1104 			}
1105 			get_random_bytes(ni->ni_challenge,
1106 				IEEE80211_CHALLENGE_LEN);
1107 			IEEE80211_DPRINTF(ic,
1108 				IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1109 				"[%s] shared key %sauth request\n",
1110 				ether_sprintf(ni->ni_macaddr),
1111 				allocbs ? "" : "re");
1112 			break;
1113 		case IEEE80211_AUTH_SHARED_RESPONSE:
1114 			if (ni == ic->ic_bss) {
1115 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1116 				    ni->ni_macaddr, "shared key response",
1117 				    "%s", "unknown station");
1118 				/* NB: don't send a response */
1119 				return;
1120 			}
1121 			if (ni->ni_challenge == NULL) {
1122 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1123 				    ni->ni_macaddr, "shared key response",
1124 				    "%s", "no challenge recorded");
1125 				ic->ic_stats.is_rx_bad_auth++;
1126 				estatus = IEEE80211_STATUS_CHALLENGE;
1127 				goto bad;
1128 			}
1129 			if (memcmp(ni->ni_challenge, &challenge[2],
1130 			           challenge[1]) != 0) {
1131 				IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1132 				    ni->ni_macaddr, "shared key response",
1133 				    "%s", "challenge mismatch");
1134 				ic->ic_stats.is_rx_auth_fail++;
1135 				estatus = IEEE80211_STATUS_CHALLENGE;
1136 				goto bad;
1137 			}
1138 			IEEE80211_DPRINTF(ic,
1139 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1140 			    "[%s] station authenticated (shared key)\n",
1141 			    ether_sprintf(ni->ni_macaddr));
1142 			ieee80211_node_authorize(ni);
1143 			break;
1144 		default:
1145 			IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1146 			    ni->ni_macaddr, "shared key auth",
1147 			    "bad seq %d", seq);
1148 			ic->ic_stats.is_rx_bad_auth++;
1149 			estatus = IEEE80211_STATUS_SEQUENCE;
1150 			goto bad;
1151 		}
1152 		IEEE80211_SEND_MGMT(ic, ni,
1153 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1154 		break;
1155 
1156 	case IEEE80211_M_STA:
1157 		if (ic->ic_state != IEEE80211_S_AUTH)
1158 			return;
1159 		switch (seq) {
1160 		case IEEE80211_AUTH_SHARED_PASS:
1161 			if (ni->ni_challenge != NULL) {
1162 				FREE(ni->ni_challenge, M_DEVBUF);
1163 				ni->ni_challenge = NULL;
1164 			}
1165 			if (status != 0) {
1166 				IEEE80211_DPRINTF(ic,
1167 				    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1168 				    "[%s] shared key auth failed (reason %d)\n",
1169 				    ether_sprintf(ieee80211_getbssid(ic, wh)),
1170 				    status);
1171 				/* XXX can this happen? */
1172 				if (ni != ic->ic_bss)
1173 					ni->ni_fails++;
1174 				ic->ic_stats.is_rx_auth_fail++;
1175 				return;
1176 			}
1177 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1178 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1179 			break;
1180 		case IEEE80211_AUTH_SHARED_CHALLENGE:
1181 			if (!alloc_challenge(ic, ni))
1182 				return;
1183 			/* XXX could optimize by passing recvd challenge */
1184 			memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1185 			IEEE80211_SEND_MGMT(ic, ni,
1186 				IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1187 			break;
1188 		default:
1189 			IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH,
1190 			    wh, "shared key auth", "bad seq %d", seq);
1191 			ic->ic_stats.is_rx_bad_auth++;
1192 			return;
1193 		}
1194 		break;
1195 	}
1196 	return;
1197 bad:
1198 	/*
1199 	 * Send an error response; but only when operating as an AP.
1200 	 */
1201 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1202 		/* XXX hack to workaround calling convention */
1203 		ieee80211_send_error(ic, ni, wh->i_addr2,
1204 		    IEEE80211_FC0_SUBTYPE_AUTH,
1205 		    (seq + 1) | (estatus<<16));
1206 	} else if (ic->ic_opmode == IEEE80211_M_STA) {
1207 		/*
1208 		 * Kick the state machine.  This short-circuits
1209 		 * using the mgt frame timeout to trigger the
1210 		 * state transition.
1211 		 */
1212 		if (ic->ic_state == IEEE80211_S_AUTH)
1213 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1214 	}
1215 }
1216 
1217 /* Verify the existence and length of __elem or get out. */
1218 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do {			\
1219 	if ((__elem) == NULL) {						\
1220 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1221 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1222 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1223 		    "%s", "no " #__elem );				\
1224 		ic->ic_stats.is_rx_elem_missing++;			\
1225 		return;							\
1226 	}								\
1227 	if ((__elem)[1] > (__maxlen)) {					\
1228 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1229 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1230 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1231 		    "bad " #__elem " len %d", (__elem)[1]);		\
1232 		ic->ic_stats.is_rx_elem_toobig++;			\
1233 		return;							\
1234 	}								\
1235 } while (0)
1236 
1237 #define	IEEE80211_VERIFY_LENGTH(_len, _minlen) do {			\
1238 	if ((_len) < (_minlen)) {					\
1239 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,		\
1240 		    wh, ieee80211_mgt_subtype_name[subtype >>		\
1241 			IEEE80211_FC0_SUBTYPE_SHIFT],			\
1242 		    "%s", "ie too short");				\
1243 		ic->ic_stats.is_rx_elem_toosmall++;			\
1244 		return;							\
1245 	}								\
1246 } while (0)
1247 
1248 #ifdef IEEE80211_DEBUG
1249 static void
1250 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag,
1251 	u_int8_t mac[IEEE80211_ADDR_LEN], u_int8_t *ssid)
1252 {
1253 	printf("[%s] discard %s frame, ssid mismatch: ",
1254 		ether_sprintf(mac), tag);
1255 	ieee80211_print_essid(ssid + 2, ssid[1]);
1256 	printf("\n");
1257 }
1258 
1259 #define	IEEE80211_VERIFY_SSID(_ni, _ssid) do {				\
1260 	if ((_ssid)[1] != 0 &&						\
1261 	    ((_ssid)[1] != (_ni)->ni_esslen ||				\
1262 	    memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {	\
1263 		if (ieee80211_msg_input(ic))				\
1264 			ieee80211_ssid_mismatch(ic, 			\
1265 			    ieee80211_mgt_subtype_name[subtype >>	\
1266 				IEEE80211_FC0_SUBTYPE_SHIFT],		\
1267 				wh->i_addr2, _ssid);			\
1268 		ic->ic_stats.is_rx_ssidmismatch++;			\
1269 		return;							\
1270 	}								\
1271 } while (0)
1272 #else /* !IEEE80211_DEBUG */
1273 #define	IEEE80211_VERIFY_SSID(_ni, _ssid) do {				\
1274 	if ((_ssid)[1] != 0 &&						\
1275 	    ((_ssid)[1] != (_ni)->ni_esslen ||				\
1276 	    memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) {	\
1277 		ic->ic_stats.is_rx_ssidmismatch++;			\
1278 		return;							\
1279 	}								\
1280 } while (0)
1281 #endif /* !IEEE80211_DEBUG */
1282 
1283 /* unalligned little endian access */
1284 #define LE_READ_2(p)					\
1285 	((u_int16_t)					\
1286 	 ((((const u_int8_t *)(p))[0]      ) |		\
1287 	  (((const u_int8_t *)(p))[1] <<  8)))
1288 #define LE_READ_4(p)					\
1289 	((u_int32_t)					\
1290 	 ((((const u_int8_t *)(p))[0]      ) |		\
1291 	  (((const u_int8_t *)(p))[1] <<  8) |		\
1292 	  (((const u_int8_t *)(p))[2] << 16) |		\
1293 	  (((const u_int8_t *)(p))[3] << 24)))
1294 
1295 static int __inline
1296 iswpaoui(const u_int8_t *frm)
1297 {
1298 	return frm[1] > 3 && LE_READ_4(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI);
1299 }
1300 
1301 static int __inline
1302 iswmeoui(const u_int8_t *frm)
1303 {
1304 	return frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI);
1305 }
1306 
1307 static int __inline
1308 iswmeparam(const u_int8_t *frm)
1309 {
1310 	return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1311 		frm[6] == WME_PARAM_OUI_SUBTYPE;
1312 }
1313 
1314 static int __inline
1315 iswmeinfo(const u_int8_t *frm)
1316 {
1317 	return frm[1] > 5 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
1318 		frm[6] == WME_INFO_OUI_SUBTYPE;
1319 }
1320 
1321 static int __inline
1322 isatherosoui(const u_int8_t *frm)
1323 {
1324 	return frm[1] > 3 && LE_READ_4(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI);
1325 }
1326 
1327 /*
1328  * Convert a WPA cipher selector OUI to an internal
1329  * cipher algorithm.  Where appropriate we also
1330  * record any key length.
1331  */
1332 static int
1333 wpa_cipher(u_int8_t *sel, u_int8_t *keylen)
1334 {
1335 #define	WPA_SEL(x)	(((x)<<24)|WPA_OUI)
1336 	u_int32_t w = LE_READ_4(sel);
1337 
1338 	switch (w) {
1339 	case WPA_SEL(WPA_CSE_NULL):
1340 		return IEEE80211_CIPHER_NONE;
1341 	case WPA_SEL(WPA_CSE_WEP40):
1342 		if (keylen)
1343 			*keylen = 40 / NBBY;
1344 		return IEEE80211_CIPHER_WEP;
1345 	case WPA_SEL(WPA_CSE_WEP104):
1346 		if (keylen)
1347 			*keylen = 104 / NBBY;
1348 		return IEEE80211_CIPHER_WEP;
1349 	case WPA_SEL(WPA_CSE_TKIP):
1350 		return IEEE80211_CIPHER_TKIP;
1351 	case WPA_SEL(WPA_CSE_CCMP):
1352 		return IEEE80211_CIPHER_AES_CCM;
1353 	}
1354 	return 32;		/* NB: so 1<< is discarded */
1355 #undef WPA_SEL
1356 }
1357 
1358 /*
1359  * Convert a WPA key management/authentication algorithm
1360  * to an internal code.
1361  */
1362 static int
1363 wpa_keymgmt(u_int8_t *sel)
1364 {
1365 #define	WPA_SEL(x)	(((x)<<24)|WPA_OUI)
1366 	u_int32_t w = LE_READ_4(sel);
1367 
1368 	switch (w) {
1369 	case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1370 		return WPA_ASE_8021X_UNSPEC;
1371 	case WPA_SEL(WPA_ASE_8021X_PSK):
1372 		return WPA_ASE_8021X_PSK;
1373 	case WPA_SEL(WPA_ASE_NONE):
1374 		return WPA_ASE_NONE;
1375 	}
1376 	return 0;		/* NB: so is discarded */
1377 #undef WPA_SEL
1378 }
1379 
1380 /*
1381  * Parse a WPA information element to collect parameters
1382  * and validate the parameters against what has been
1383  * configured for the system.
1384  */
1385 static int
1386 ieee80211_parse_wpa(struct ieee80211com *ic, u_int8_t *frm,
1387 	struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1388 {
1389 	u_int8_t len = frm[1];
1390 	u_int32_t w;
1391 	int n;
1392 
1393 	/*
1394 	 * Check the length once for fixed parts: OUI, type,
1395 	 * version, mcast cipher, and 2 selector counts.
1396 	 * Other, variable-length data, must be checked separately.
1397 	 */
1398 	if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) {
1399 		IEEE80211_DISCARD_IE(ic,
1400 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1401 		    wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags);
1402 		return IEEE80211_REASON_IE_INVALID;
1403 	}
1404 	if (len < 14) {
1405 		IEEE80211_DISCARD_IE(ic,
1406 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1407 		    wh, "WPA", "too short, len %u", len);
1408 		return IEEE80211_REASON_IE_INVALID;
1409 	}
1410 	frm += 6, len -= 4;		/* NB: len is payload only */
1411 	/* NB: iswapoui already validated the OUI and type */
1412 	w = LE_READ_2(frm);
1413 	if (w != WPA_VERSION) {
1414 		IEEE80211_DISCARD_IE(ic,
1415 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1416 		    wh, "WPA", "bad version %u", w);
1417 		return IEEE80211_REASON_IE_INVALID;
1418 	}
1419 	frm += 2, len -= 2;
1420 
1421 	/* multicast/group cipher */
1422 	w = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1423 	if (w != rsn->rsn_mcastcipher) {
1424 		IEEE80211_DISCARD_IE(ic,
1425 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1426 		    wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
1427 		    w, rsn->rsn_mcastcipher);
1428 		return IEEE80211_REASON_IE_INVALID;
1429 	}
1430 	frm += 4, len -= 4;
1431 
1432 	/* unicast ciphers */
1433 	n = LE_READ_2(frm);
1434 	frm += 2, len -= 2;
1435 	if (len < n*4+2) {
1436 		IEEE80211_DISCARD_IE(ic,
1437 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1438 		    wh, "WPA", "ucast cipher data too short; len %u, n %u",
1439 		    len, n);
1440 		return IEEE80211_REASON_IE_INVALID;
1441 	}
1442 	w = 0;
1443 	for (; n > 0; n--) {
1444 		w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1445 		frm += 4, len -= 4;
1446 	}
1447 	w &= rsn->rsn_ucastcipherset;
1448 	if (w == 0) {
1449 		IEEE80211_DISCARD_IE(ic,
1450 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1451 		    wh, "WPA", "%s", "ucast cipher set empty");
1452 		return IEEE80211_REASON_IE_INVALID;
1453 	}
1454 	if (w & (1<<IEEE80211_CIPHER_TKIP))
1455 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1456 	else
1457 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1458 
1459 	/* key management algorithms */
1460 	n = LE_READ_2(frm);
1461 	frm += 2, len -= 2;
1462 	if (len < n*4) {
1463 		IEEE80211_DISCARD_IE(ic,
1464 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1465 		    wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1466 		    len, n);
1467 		return IEEE80211_REASON_IE_INVALID;
1468 	}
1469 	w = 0;
1470 	for (; n > 0; n--) {
1471 		w |= wpa_keymgmt(frm);
1472 		frm += 4, len -= 4;
1473 	}
1474 	w &= rsn->rsn_keymgmtset;
1475 	if (w == 0) {
1476 		IEEE80211_DISCARD_IE(ic,
1477 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1478 		    wh, "WPA", "%s", "no acceptable key mgmt alg");
1479 		return IEEE80211_REASON_IE_INVALID;
1480 	}
1481 	if (w & WPA_ASE_8021X_UNSPEC)
1482 		rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1483 	else
1484 		rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1485 
1486 	if (len > 2)		/* optional capabilities */
1487 		rsn->rsn_caps = LE_READ_2(frm);
1488 
1489 	return 0;
1490 }
1491 
1492 /*
1493  * Convert an RSN cipher selector OUI to an internal
1494  * cipher algorithm.  Where appropriate we also
1495  * record any key length.
1496  */
1497 static int
1498 rsn_cipher(u_int8_t *sel, u_int8_t *keylen)
1499 {
1500 #define	RSN_SEL(x)	(((x)<<24)|RSN_OUI)
1501 	u_int32_t w = LE_READ_4(sel);
1502 
1503 	switch (w) {
1504 	case RSN_SEL(RSN_CSE_NULL):
1505 		return IEEE80211_CIPHER_NONE;
1506 	case RSN_SEL(RSN_CSE_WEP40):
1507 		if (keylen)
1508 			*keylen = 40 / NBBY;
1509 		return IEEE80211_CIPHER_WEP;
1510 	case RSN_SEL(RSN_CSE_WEP104):
1511 		if (keylen)
1512 			*keylen = 104 / NBBY;
1513 		return IEEE80211_CIPHER_WEP;
1514 	case RSN_SEL(RSN_CSE_TKIP):
1515 		return IEEE80211_CIPHER_TKIP;
1516 	case RSN_SEL(RSN_CSE_CCMP):
1517 		return IEEE80211_CIPHER_AES_CCM;
1518 	case RSN_SEL(RSN_CSE_WRAP):
1519 		return IEEE80211_CIPHER_AES_OCB;
1520 	}
1521 	return 32;		/* NB: so 1<< is discarded */
1522 #undef WPA_SEL
1523 }
1524 
1525 /*
1526  * Convert an RSN key management/authentication algorithm
1527  * to an internal code.
1528  */
1529 static int
1530 rsn_keymgmt(u_int8_t *sel)
1531 {
1532 #define	RSN_SEL(x)	(((x)<<24)|RSN_OUI)
1533 	u_int32_t w = LE_READ_4(sel);
1534 
1535 	switch (w) {
1536 	case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1537 		return RSN_ASE_8021X_UNSPEC;
1538 	case RSN_SEL(RSN_ASE_8021X_PSK):
1539 		return RSN_ASE_8021X_PSK;
1540 	case RSN_SEL(RSN_ASE_NONE):
1541 		return RSN_ASE_NONE;
1542 	}
1543 	return 0;		/* NB: so is discarded */
1544 #undef RSN_SEL
1545 }
1546 
1547 /*
1548  * Parse a WPA/RSN information element to collect parameters
1549  * and validate the parameters against what has been
1550  * configured for the system.
1551  */
1552 static int
1553 ieee80211_parse_rsn(struct ieee80211com *ic, u_int8_t *frm,
1554 	struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1555 {
1556 	u_int8_t len = frm[1];
1557 	u_int32_t w;
1558 	int n;
1559 
1560 	/*
1561 	 * Check the length once for fixed parts:
1562 	 * version, mcast cipher, and 2 selector counts.
1563 	 * Other, variable-length data, must be checked separately.
1564 	 */
1565 	if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) {
1566 		IEEE80211_DISCARD_IE(ic,
1567 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1568 		    wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags);
1569 		return IEEE80211_REASON_IE_INVALID;
1570 	}
1571 	if (len < 10) {
1572 		IEEE80211_DISCARD_IE(ic,
1573 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1574 		    wh, "RSN", "too short, len %u", len);
1575 		return IEEE80211_REASON_IE_INVALID;
1576 	}
1577 	frm += 2;
1578 	w = LE_READ_2(frm);
1579 	if (w != RSN_VERSION) {
1580 		IEEE80211_DISCARD_IE(ic,
1581 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1582 		    wh, "RSN", "bad version %u", w);
1583 		return IEEE80211_REASON_IE_INVALID;
1584 	}
1585 	frm += 2, len -= 2;
1586 
1587 	/* multicast/group cipher */
1588 	w = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1589 	if (w != rsn->rsn_mcastcipher) {
1590 		IEEE80211_DISCARD_IE(ic,
1591 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1592 		    wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
1593 		    w, rsn->rsn_mcastcipher);
1594 		return IEEE80211_REASON_IE_INVALID;
1595 	}
1596 	frm += 4, len -= 4;
1597 
1598 	/* unicast ciphers */
1599 	n = LE_READ_2(frm);
1600 	frm += 2, len -= 2;
1601 	if (len < n*4+2) {
1602 		IEEE80211_DISCARD_IE(ic,
1603 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1604 		    wh, "RSN", "ucast cipher data too short; len %u, n %u",
1605 		    len, n);
1606 		return IEEE80211_REASON_IE_INVALID;
1607 	}
1608 	w = 0;
1609 	for (; n > 0; n--) {
1610 		w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1611 		frm += 4, len -= 4;
1612 	}
1613 	w &= rsn->rsn_ucastcipherset;
1614 	if (w == 0) {
1615 		IEEE80211_DISCARD_IE(ic,
1616 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1617 		    wh, "RSN", "%s", "ucast cipher set empty");
1618 		return IEEE80211_REASON_IE_INVALID;
1619 	}
1620 	if (w & (1<<IEEE80211_CIPHER_TKIP))
1621 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1622 	else
1623 		rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1624 
1625 	/* key management algorithms */
1626 	n = LE_READ_2(frm);
1627 	frm += 2, len -= 2;
1628 	if (len < n*4) {
1629 		IEEE80211_DISCARD_IE(ic,
1630 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1631 		    wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1632 		    len, n);
1633 		return IEEE80211_REASON_IE_INVALID;
1634 	}
1635 	w = 0;
1636 	for (; n > 0; n--) {
1637 		w |= rsn_keymgmt(frm);
1638 		frm += 4, len -= 4;
1639 	}
1640 	w &= rsn->rsn_keymgmtset;
1641 	if (w == 0) {
1642 		IEEE80211_DISCARD_IE(ic,
1643 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1644 		    wh, "RSN", "%s", "no acceptable key mgmt alg");
1645 		return IEEE80211_REASON_IE_INVALID;
1646 	}
1647 	if (w & RSN_ASE_8021X_UNSPEC)
1648 		rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1649 	else
1650 		rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1651 
1652 	/* optional RSN capabilities */
1653 	if (len > 2)
1654 		rsn->rsn_caps = LE_READ_2(frm);
1655 	/* XXXPMKID */
1656 
1657 	return 0;
1658 }
1659 
1660 static int
1661 ieee80211_parse_wmeparams(struct ieee80211com *ic, u_int8_t *frm,
1662 	const struct ieee80211_frame *wh)
1663 {
1664 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1665 	struct ieee80211_wme_state *wme = &ic->ic_wme;
1666 	u_int len = frm[1], qosinfo;
1667 	int i;
1668 
1669 	if (len < sizeof(struct ieee80211_wme_param)-2) {
1670 		IEEE80211_DISCARD_IE(ic,
1671 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1672 		    wh, "WME", "too short, len %u", len);
1673 		return -1;
1674 	}
1675 	qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1676 	qosinfo &= WME_QOSINFO_COUNT;
1677 	/* XXX do proper check for wraparound */
1678 	if (qosinfo == wme->wme_wmeChanParams.cap_info)
1679 		return 0;
1680 	frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1681 	for (i = 0; i < WME_NUM_AC; i++) {
1682 		struct wmeParams *wmep =
1683 			&wme->wme_wmeChanParams.cap_wmeParams[i];
1684 		/* NB: ACI not used */
1685 		wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1686 		wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1687 		wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1688 		wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1689 		wmep->wmep_txopLimit = LE_READ_2(frm+2);
1690 		frm += 4;
1691 	}
1692 	wme->wme_wmeChanParams.cap_info = qosinfo;
1693 	return 1;
1694 #undef MS
1695 }
1696 
1697 void
1698 ieee80211_saveie(u_int8_t **iep, const u_int8_t *ie)
1699 {
1700 	u_int ielen = ie[1]+2;
1701 	/*
1702 	 * Record information element for later use.
1703 	 */
1704 	if (*iep == NULL || (*iep)[1] != ie[1]) {
1705 		if (*iep != NULL)
1706 			FREE(*iep, M_DEVBUF);
1707 		MALLOC(*iep, void*, ielen, M_DEVBUF, M_NOWAIT);
1708 	}
1709 	if (*iep != NULL)
1710 		memcpy(*iep, ie, ielen);
1711 	/* XXX note failure */
1712 }
1713 
1714 /* XXX find a better place for definition */
1715 struct l2_update_frame {
1716 	struct ether_header eh;
1717 	u_int8_t dsap;
1718 	u_int8_t ssap;
1719 	u_int8_t control;
1720 	u_int8_t xid[3];
1721 }  __packed;
1722 
1723 /*
1724  * Deliver a TGf L2UF frame on behalf of a station.
1725  * This primes any bridge when the station is roaming
1726  * between ap's on the same wired network.
1727  */
1728 static void
1729 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1730 {
1731 	struct ieee80211com *ic = ni->ni_ic;
1732 	struct ifnet *ifp = ic->ic_ifp;
1733 	struct mbuf *m;
1734 	struct l2_update_frame *l2uf;
1735 	struct ether_header *eh;
1736 
1737 	m = m_gethdr(M_NOWAIT, MT_DATA);
1738 	if (m == NULL) {
1739 		IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1740 		    "%s", "no mbuf for l2uf frame");
1741 		ic->ic_stats.is_rx_nobuf++;	/* XXX not right */
1742 		return;
1743 	}
1744 	l2uf = mtod(m, struct l2_update_frame *);
1745 	eh = &l2uf->eh;
1746 	/* dst: Broadcast address */
1747 	IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1748 	/* src: associated STA */
1749 	IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1750 	eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1751 
1752 	l2uf->dsap = 0;
1753 	l2uf->ssap = 0;
1754 	l2uf->control = 0xf5;
1755 	l2uf->xid[0] = 0x81;
1756 	l2uf->xid[1] = 0x80;
1757 	l2uf->xid[2] = 0x00;
1758 
1759 	m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1760 	m->m_pkthdr.rcvif = ifp;
1761 	ieee80211_deliver_data(ic, ni, m);
1762 }
1763 
1764 void
1765 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
1766 	struct ieee80211_node *ni,
1767 	int subtype, int rssi, u_int32_t rstamp)
1768 {
1769 #define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1770 #define	ISREASSOC(_st)	((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1771 	struct ieee80211_frame *wh;
1772 	u_int8_t *frm, *efrm;
1773 	u_int8_t *ssid, *rates, *xrates, *wpa, *wme;
1774 	int reassoc, resp, allocbs;
1775 	u_int8_t rate;
1776 
1777 	wh = mtod(m0, struct ieee80211_frame *);
1778 	frm = (u_int8_t *)&wh[1];
1779 	efrm = mtod(m0, u_int8_t *) + m0->m_len;
1780 	switch (subtype) {
1781 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1782 	case IEEE80211_FC0_SUBTYPE_BEACON: {
1783 		struct ieee80211_scanparams scan;
1784 
1785 		/*
1786 		 * We process beacon/probe response frames:
1787 		 *    o when scanning, or
1788 		 *    o station mode when associated (to collect state
1789 		 *      updates such as 802.11g slot time), or
1790 		 *    o adhoc mode (to discover neighbors)
1791 		 * Frames otherwise received are discarded.
1792 		 */
1793 		if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
1794 		      (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) ||
1795 		       ic->ic_opmode == IEEE80211_M_IBSS)) {
1796 			ic->ic_stats.is_rx_mgtdiscard++;
1797 			return;
1798 		}
1799 		/*
1800 		 * beacon/probe response frame format
1801 		 *	[8] time stamp
1802 		 *	[2] beacon interval
1803 		 *	[2] capability information
1804 		 *	[tlv] ssid
1805 		 *	[tlv] supported rates
1806 		 *	[tlv] country information
1807 		 *	[tlv] parameter set (FH/DS)
1808 		 *	[tlv] erp information
1809 		 *	[tlv] extended supported rates
1810 		 *	[tlv] WME
1811 		 *	[tlv] WPA or RSN
1812 		 */
1813 		IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
1814 		memset(&scan, 0, sizeof(scan));
1815 		scan.tstamp  = frm;				frm += 8;
1816 		scan.bintval = le16toh(*(u_int16_t *)frm);	frm += 2;
1817 		scan.capinfo = le16toh(*(u_int16_t *)frm);	frm += 2;
1818 		scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
1819 		scan.chan = scan.bchan;
1820 
1821 		while (frm < efrm) {
1822 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
1823 			switch (*frm) {
1824 			case IEEE80211_ELEMID_SSID:
1825 				scan.ssid = frm;
1826 				break;
1827 			case IEEE80211_ELEMID_RATES:
1828 				scan.rates = frm;
1829 				break;
1830 			case IEEE80211_ELEMID_COUNTRY:
1831 				scan.country = frm;
1832 				break;
1833 			case IEEE80211_ELEMID_FHPARMS:
1834 				if (ic->ic_phytype == IEEE80211_T_FH) {
1835 					scan.fhdwell = LE_READ_2(&frm[2]);
1836 					scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
1837 					scan.fhindex = frm[6];
1838 				}
1839 				break;
1840 			case IEEE80211_ELEMID_DSPARMS:
1841 				/*
1842 				 * XXX hack this since depending on phytype
1843 				 * is problematic for multi-mode devices.
1844 				 */
1845 				if (ic->ic_phytype != IEEE80211_T_FH)
1846 					scan.chan = frm[2];
1847 				break;
1848 			case IEEE80211_ELEMID_TIM:
1849 				/* XXX ATIM? */
1850 				scan.tim = frm;
1851 				scan.timoff = frm - mtod(m0, u_int8_t *);
1852 				break;
1853 			case IEEE80211_ELEMID_IBSSPARMS:
1854 				break;
1855 			case IEEE80211_ELEMID_XRATES:
1856 				scan.xrates = frm;
1857 				break;
1858 			case IEEE80211_ELEMID_ERP:
1859 				if (frm[1] != 1) {
1860 					IEEE80211_DISCARD_IE(ic,
1861 					    IEEE80211_MSG_ELEMID, wh, "ERP",
1862 					    "bad len %u", frm[1]);
1863 					ic->ic_stats.is_rx_elem_toobig++;
1864 					break;
1865 				}
1866 				scan.erp = frm[2];
1867 				break;
1868 			case IEEE80211_ELEMID_RSN:
1869 				scan.wpa = frm;
1870 				break;
1871 			case IEEE80211_ELEMID_VENDOR:
1872 				if (iswpaoui(frm))
1873 					scan.wpa = frm;
1874 				else if (iswmeparam(frm) || iswmeinfo(frm))
1875 					scan.wme = frm;
1876 				/* XXX Atheros OUI support */
1877 				break;
1878 			default:
1879 				IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID,
1880 				    wh, "unhandled",
1881 				    "id %u, len %u", *frm, frm[1]);
1882 				ic->ic_stats.is_rx_elem_unknown++;
1883 				break;
1884 			}
1885 			frm += frm[1] + 2;
1886 		}
1887 		IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
1888 		IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
1889 		if (
1890 #if IEEE80211_CHAN_MAX < 255
1891 		    scan.chan > IEEE80211_CHAN_MAX ||
1892 #endif
1893 		    isclr(ic->ic_chan_active, scan.chan)) {
1894 			IEEE80211_DISCARD(ic,
1895 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1896 			    wh, ieee80211_mgt_subtype_name[subtype >>
1897 				IEEE80211_FC0_SUBTYPE_SHIFT],
1898 			    "invalid channel %u", scan.chan);
1899 			ic->ic_stats.is_rx_badchan++;
1900 			return;
1901 		}
1902 		if (scan.chan != scan.bchan &&
1903 		    ic->ic_phytype != IEEE80211_T_FH) {
1904 			/*
1905 			 * Frame was received on a channel different from the
1906 			 * one indicated in the DS params element id;
1907 			 * silently discard it.
1908 			 *
1909 			 * NB: this can happen due to signal leakage.
1910 			 *     But we should take it for FH phy because
1911 			 *     the rssi value should be correct even for
1912 			 *     different hop pattern in FH.
1913 			 */
1914 			IEEE80211_DISCARD(ic,
1915 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1916 			    wh, ieee80211_mgt_subtype_name[subtype >>
1917 				IEEE80211_FC0_SUBTYPE_SHIFT],
1918 			    "for off-channel %u", scan.chan);
1919 			ic->ic_stats.is_rx_chanmismatch++;
1920 			return;
1921 		}
1922 		if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
1923 		      scan.bintval <= IEEE80211_BINTVAL_MAX)) {
1924 			IEEE80211_DISCARD(ic,
1925 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
1926 			    wh, ieee80211_mgt_subtype_name[subtype >>
1927 				IEEE80211_FC0_SUBTYPE_SHIFT],
1928 			    "bogus beacon interval", scan.bintval);
1929 			ic->ic_stats.is_rx_badbintval++;
1930 			return;
1931 		}
1932 
1933 		/*
1934 		 * Count frame now that we know it's to be processed.
1935 		 */
1936 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1937 			ic->ic_stats.is_rx_beacon++;		/* XXX remove */
1938 			IEEE80211_NODE_STAT(ni, rx_beacons);
1939 		} else
1940 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1941 
1942 		/*
1943 		 * When operating in station mode, check for state updates.
1944 		 * Be careful to ignore beacons received while doing a
1945 		 * background scan.  We consider only 11g/WMM stuff right now.
1946 		 */
1947 		if (ic->ic_opmode == IEEE80211_M_STA &&
1948 		    ni->ni_associd != 0 &&
1949 		    ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1950 		     IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1951 			/* record tsf of last beacon */
1952 			memcpy(ni->ni_tstamp.data, scan.tstamp,
1953 				sizeof(ni->ni_tstamp));
1954 			/* count beacon frame for s/w bmiss handling */
1955 			ic->ic_swbmiss_count++;
1956 			ic->ic_bmiss_count = 0;
1957 			if (ni->ni_erp != scan.erp) {
1958 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1959 				    "[%s] erp change: was 0x%x, now 0x%x\n",
1960 				    ether_sprintf(wh->i_addr2),
1961 				    ni->ni_erp, scan.erp);
1962 				if (ic->ic_curmode == IEEE80211_MODE_11G &&
1963 				    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1964 					ic->ic_flags |= IEEE80211_F_USEPROT;
1965 				else
1966 					ic->ic_flags &= ~IEEE80211_F_USEPROT;
1967 				ni->ni_erp = scan.erp;
1968 				/* XXX statistic */
1969 			}
1970 			if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1971 				IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
1972 				    "[%s] capabilities change: before 0x%x,"
1973 				     " now 0x%x\n",
1974 				     ether_sprintf(wh->i_addr2),
1975 				     ni->ni_capinfo, scan.capinfo);
1976 				/*
1977 				 * NB: we assume short preamble doesn't
1978 				 *     change dynamically
1979 				 */
1980 				ieee80211_set_shortslottime(ic,
1981 					ic->ic_curmode == IEEE80211_MODE_11A ||
1982 					(scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1983 				ni->ni_capinfo = scan.capinfo;
1984 				/* XXX statistic */
1985 			}
1986 			if (scan.wme != NULL &&
1987 			    (ni->ni_flags & IEEE80211_NODE_QOS) &&
1988 			    ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0)
1989 				ieee80211_wme_updateparams(ic);
1990 			if (scan.tim != NULL) {
1991 				struct ieee80211_tim_ie *ie =
1992 				    (struct ieee80211_tim_ie *) scan.tim;
1993 
1994 				ni->ni_dtim_count = ie->tim_count;
1995 				ni->ni_dtim_period = ie->tim_period;
1996 			}
1997 			if (ic->ic_flags & IEEE80211_F_SCAN)
1998 				ieee80211_add_scan(ic, &scan, wh,
1999 					subtype, rssi, rstamp);
2000 			return;
2001 		}
2002 		/*
2003 		 * If scanning, just pass information to the scan module.
2004 		 */
2005 		if (ic->ic_flags & IEEE80211_F_SCAN) {
2006 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
2007 				/*
2008 				 * Actively scanning a channel marked passive;
2009 				 * send a probe request now that we know there
2010 				 * is 802.11 traffic present.
2011 				 *
2012 				 * XXX check if the beacon we recv'd gives
2013 				 * us what we need and suppress the probe req
2014 				 */
2015 				ieee80211_probe_curchan(ic, 1);
2016 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
2017 			}
2018 			ieee80211_add_scan(ic, &scan, wh,
2019 				subtype, rssi, rstamp);
2020 			return;
2021 		}
2022 		if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
2023 			if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2024 				/*
2025 				 * Create a new entry in the neighbor table.
2026 				 */
2027 				ni = ieee80211_add_neighbor(ic, wh, &scan);
2028 			} else if (ni->ni_capinfo == 0) {
2029 				/*
2030 				 * Update faked node created on transmit.
2031 				 * Note this also updates the tsf.
2032 				 */
2033 				ieee80211_init_neighbor(ni, wh, &scan);
2034 			} else {
2035 				/*
2036 				 * Record tsf for potential resync.
2037 				 */
2038 				memcpy(ni->ni_tstamp.data, scan.tstamp,
2039 					sizeof(ni->ni_tstamp));
2040 			}
2041 			if (ni != NULL) {
2042 				ni->ni_rssi = rssi;
2043 				ni->ni_rstamp = rstamp;
2044 			}
2045 		}
2046 		break;
2047 	}
2048 
2049 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2050 		if (ic->ic_opmode == IEEE80211_M_STA ||
2051 		    ic->ic_state != IEEE80211_S_RUN) {
2052 			ic->ic_stats.is_rx_mgtdiscard++;
2053 			return;
2054 		}
2055 		if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2056 			/* frame must be directed */
2057 			ic->ic_stats.is_rx_mgtdiscard++;	/* XXX stat */
2058 			return;
2059 		}
2060 
2061 		/*
2062 		 * prreq frame format
2063 		 *	[tlv] ssid
2064 		 *	[tlv] supported rates
2065 		 *	[tlv] extended supported rates
2066 		 */
2067 		ssid = rates = xrates = NULL;
2068 		while (frm < efrm) {
2069 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
2070 			switch (*frm) {
2071 			case IEEE80211_ELEMID_SSID:
2072 				ssid = frm;
2073 				break;
2074 			case IEEE80211_ELEMID_RATES:
2075 				rates = frm;
2076 				break;
2077 			case IEEE80211_ELEMID_XRATES:
2078 				xrates = frm;
2079 				break;
2080 			}
2081 			frm += frm[1] + 2;
2082 		}
2083 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2084 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2085 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2086 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
2087 			IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
2088 			    wh, ieee80211_mgt_subtype_name[subtype >>
2089 				IEEE80211_FC0_SUBTYPE_SHIFT],
2090 			    "%s", "no ssid with ssid suppression enabled");
2091 			ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/
2092 			return;
2093 		}
2094 
2095 		allocbs = 0;
2096 		if (ni == ic->ic_bss) {
2097 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
2098 				ni = ieee80211_tmp_node(ic, wh->i_addr2);
2099 				allocbs = 1;
2100 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2101 				/*
2102 				 * XXX Cannot tell if the sender is operating
2103 				 * in ibss mode.  But we need a new node to
2104 				 * send the response so blindly add them to the
2105 				 * neighbor table.
2106 				 */
2107 				ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
2108 					wh->i_addr2);
2109 			}
2110 			if (ni == NULL)
2111 				return;
2112 		}
2113 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2114 		    "[%s] recv probe req\n", ether_sprintf(wh->i_addr2));
2115 		ni->ni_rssi = rssi;
2116 		ni->ni_rstamp = rstamp;
2117 		rate = ieee80211_setup_rates(ni, rates, xrates,
2118 			  IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE
2119 			| IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2120 		if (rate & IEEE80211_RATE_BASIC) {
2121 			IEEE80211_DISCARD(ic, IEEE80211_MSG_XRATE,
2122 			    wh, ieee80211_mgt_subtype_name[subtype >>
2123 				IEEE80211_FC0_SUBTYPE_SHIFT],
2124 			    "%s", "recv'd rate set invalid");
2125 		} else {
2126 			IEEE80211_SEND_MGMT(ic, ni,
2127 				IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
2128 		}
2129 		if (allocbs) {
2130 			/*
2131 			 * Temporary node created just to send a
2132 			 * response, reclaim immediately.
2133 			 */
2134 			ieee80211_free_node(ni);
2135 		}
2136 		break;
2137 
2138 	case IEEE80211_FC0_SUBTYPE_AUTH: {
2139 		u_int16_t algo, seq, status;
2140 		/*
2141 		 * auth frame format
2142 		 *	[2] algorithm
2143 		 *	[2] sequence
2144 		 *	[2] status
2145 		 *	[tlv*] challenge
2146 		 */
2147 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
2148 		algo   = le16toh(*(u_int16_t *)frm);
2149 		seq    = le16toh(*(u_int16_t *)(frm + 2));
2150 		status = le16toh(*(u_int16_t *)(frm + 4));
2151 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2152 		    "[%s] recv auth frame with algorithm %d seq %d\n",
2153 		    ether_sprintf(wh->i_addr2), algo, seq);
2154 		/*
2155 		 * Consult the ACL policy module if setup.
2156 		 */
2157 		if (ic->ic_acl != NULL &&
2158 		    !ic->ic_acl->iac_check(ic, wh->i_addr2)) {
2159 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL,
2160 			    wh, "auth", "%s", "disallowed by ACL");
2161 			ic->ic_stats.is_rx_acl++;
2162 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2163 				IEEE80211_SEND_MGMT(ic, ni,
2164 				    IEEE80211_FC0_SUBTYPE_AUTH,
2165 				    (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
2166 			}
2167 			return;
2168 		}
2169 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
2170 			IEEE80211_DISCARD(ic,
2171 			    IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
2172 			    wh, "auth", "%s", "TKIP countermeasures enabled");
2173 			ic->ic_stats.is_rx_auth_countermeasures++;
2174 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2175 				IEEE80211_SEND_MGMT(ic, ni,
2176 					IEEE80211_FC0_SUBTYPE_AUTH,
2177 					IEEE80211_REASON_MIC_FAILURE);
2178 			}
2179 			return;
2180 		}
2181 		if (algo == IEEE80211_AUTH_ALG_SHARED)
2182 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi,
2183 			    rstamp, seq, status);
2184 		else if (algo == IEEE80211_AUTH_ALG_OPEN)
2185 			ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq,
2186 			    status);
2187 		else {
2188 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2189 			    wh, "auth", "unsupported alg %d", algo);
2190 			ic->ic_stats.is_rx_auth_unsupported++;
2191 			if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2192 				/* XXX not right */
2193 				IEEE80211_SEND_MGMT(ic, ni,
2194 					IEEE80211_FC0_SUBTYPE_AUTH,
2195 					(seq+1) | (IEEE80211_STATUS_ALG<<16));
2196 			}
2197 			return;
2198 		}
2199 		break;
2200 	}
2201 
2202 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2203 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
2204 		u_int16_t capinfo, lintval;
2205 		struct ieee80211_rsnparms rsn;
2206 		u_int8_t reason;
2207 
2208 		if (ic->ic_opmode != IEEE80211_M_HOSTAP ||
2209 		    ic->ic_state != IEEE80211_S_RUN) {
2210 			ic->ic_stats.is_rx_mgtdiscard++;
2211 			return;
2212 		}
2213 
2214 		if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
2215 			reassoc = 1;
2216 			resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
2217 		} else {
2218 			reassoc = 0;
2219 			resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
2220 		}
2221 		/*
2222 		 * asreq frame format
2223 		 *	[2] capability information
2224 		 *	[2] listen interval
2225 		 *	[6*] current AP address (reassoc only)
2226 		 *	[tlv] ssid
2227 		 *	[tlv] supported rates
2228 		 *	[tlv] extended supported rates
2229 		 *	[tlv] WPA or RSN
2230 		 */
2231 		IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4));
2232 		if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) {
2233 			IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2234 			    wh, ieee80211_mgt_subtype_name[subtype >>
2235 				IEEE80211_FC0_SUBTYPE_SHIFT],
2236 			    "%s", "wrong bssid");
2237 			ic->ic_stats.is_rx_assoc_bss++;
2238 			return;
2239 		}
2240 		capinfo = le16toh(*(u_int16_t *)frm);	frm += 2;
2241 		lintval = le16toh(*(u_int16_t *)frm);	frm += 2;
2242 		if (reassoc)
2243 			frm += 6;	/* ignore current AP info */
2244 		ssid = rates = xrates = wpa = wme = NULL;
2245 		while (frm < efrm) {
2246 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
2247 			switch (*frm) {
2248 			case IEEE80211_ELEMID_SSID:
2249 				ssid = frm;
2250 				break;
2251 			case IEEE80211_ELEMID_RATES:
2252 				rates = frm;
2253 				break;
2254 			case IEEE80211_ELEMID_XRATES:
2255 				xrates = frm;
2256 				break;
2257 			/* XXX verify only one of RSN and WPA ie's? */
2258 			case IEEE80211_ELEMID_RSN:
2259 				wpa = frm;
2260 				break;
2261 			case IEEE80211_ELEMID_VENDOR:
2262 				if (iswpaoui(frm))
2263 					wpa = frm;
2264 				else if (iswmeinfo(frm))
2265 					wme = frm;
2266 				/* XXX Atheros OUI support */
2267 				break;
2268 			}
2269 			frm += frm[1] + 2;
2270 		}
2271 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2272 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2273 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2274 
2275 		if (ni == ic->ic_bss) {
2276 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2277 			    "[%s] deny %s request, sta not authenticated\n",
2278 			    ether_sprintf(wh->i_addr2),
2279 			    reassoc ? "reassoc" : "assoc");
2280 			ieee80211_send_error(ic, ni, wh->i_addr2,
2281 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
2282 			    IEEE80211_REASON_ASSOC_NOT_AUTHED);
2283 			ic->ic_stats.is_rx_assoc_notauth++;
2284 			return;
2285 		}
2286 		/* assert right associstion security credentials */
2287 		if (wpa == NULL && (ic->ic_flags & IEEE80211_F_WPA)) {
2288 			IEEE80211_DPRINTF(ic,
2289 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2290 			    "[%s] no WPA/RSN IE in association request\n",
2291 			    ether_sprintf(wh->i_addr2));
2292 			IEEE80211_SEND_MGMT(ic, ni,
2293 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
2294 			    IEEE80211_REASON_RSN_REQUIRED);
2295 			ieee80211_node_leave(ic, ni);
2296 			/* XXX distinguish WPA/RSN? */
2297 			ic->ic_stats.is_rx_assoc_badwpaie++;
2298 			return;
2299 		}
2300 		if (wpa != NULL) {
2301 			/*
2302 			 * Parse WPA information element.  Note that
2303 			 * we initialize the param block from the node
2304 			 * state so that information in the IE overrides
2305 			 * our defaults.  The resulting parameters are
2306 			 * installed below after the association is assured.
2307 			 */
2308 			rsn = ni->ni_rsn;
2309 			if (wpa[0] != IEEE80211_ELEMID_RSN)
2310 				reason = ieee80211_parse_wpa(ic, wpa, &rsn, wh);
2311 			else
2312 				reason = ieee80211_parse_rsn(ic, wpa, &rsn, wh);
2313 			if (reason != 0) {
2314 				IEEE80211_SEND_MGMT(ic, ni,
2315 				    IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
2316 				ieee80211_node_leave(ic, ni);
2317 				/* XXX distinguish WPA/RSN? */
2318 				ic->ic_stats.is_rx_assoc_badwpaie++;
2319 				return;
2320 			}
2321 			IEEE80211_DPRINTF(ic,
2322 			    IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2323 			    "[%s] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n",
2324 			    ether_sprintf(wh->i_addr2),
2325 			    wpa[0] != IEEE80211_ELEMID_RSN ?  "WPA" : "RSN",
2326 			    rsn.rsn_mcastcipher, rsn.rsn_mcastkeylen,
2327 			    rsn.rsn_ucastcipher, rsn.rsn_ucastkeylen,
2328 			    rsn.rsn_keymgmt, rsn.rsn_caps);
2329 		}
2330 		/* discard challenge after association */
2331 		if (ni->ni_challenge != NULL) {
2332 			FREE(ni->ni_challenge, M_DEVBUF);
2333 			ni->ni_challenge = NULL;
2334 		}
2335 		/* NB: 802.11 spec says to ignore station's privacy bit */
2336 		if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2337 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2338 			    "[%s] deny %s request, capability mismatch 0x%x\n",
2339 			    ether_sprintf(wh->i_addr2),
2340 			    reassoc ? "reassoc" : "assoc", capinfo);
2341 			IEEE80211_SEND_MGMT(ic, ni, resp,
2342 				IEEE80211_STATUS_CAPINFO);
2343 			ieee80211_node_leave(ic, ni);
2344 			ic->ic_stats.is_rx_assoc_capmismatch++;
2345 			return;
2346 		}
2347 		rate = ieee80211_setup_rates(ni, rates, xrates,
2348 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2349 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2350 		/*
2351 		 * If constrained to 11g-only stations reject an
2352 		 * 11b-only station.  We cheat a bit here by looking
2353 		 * at the max negotiated xmit rate and assuming anyone
2354 		 * with a best rate <24Mb/s is an 11b station.
2355 		 */
2356 		if ((rate & IEEE80211_RATE_BASIC) ||
2357 		    ((ic->ic_flags & IEEE80211_F_PUREG) && rate < 48)) {
2358 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2359 			    "[%s] deny %s request, rate set mismatch\n",
2360 			    ether_sprintf(wh->i_addr2),
2361 			    reassoc ? "reassoc" : "assoc");
2362 			IEEE80211_SEND_MGMT(ic, ni, resp,
2363 				IEEE80211_STATUS_BASIC_RATE);
2364 			ieee80211_node_leave(ic, ni);
2365 			ic->ic_stats.is_rx_assoc_norate++;
2366 			return;
2367 		}
2368 		ni->ni_rssi = rssi;
2369 		ni->ni_rstamp = rstamp;
2370 		ni->ni_intval = lintval;
2371 		ni->ni_capinfo = capinfo;
2372 		ni->ni_chan = ic->ic_bss->ni_chan;
2373 		ni->ni_fhdwell = ic->ic_bss->ni_fhdwell;
2374 		ni->ni_fhindex = ic->ic_bss->ni_fhindex;
2375 		if (wpa != NULL) {
2376 			/*
2377 			 * Record WPA/RSN parameters for station, mark
2378 			 * node as using WPA and record information element
2379 			 * for applications that require it.
2380 			 */
2381 			ni->ni_rsn = rsn;
2382 			ieee80211_saveie(&ni->ni_wpa_ie, wpa);
2383 		} else if (ni->ni_wpa_ie != NULL) {
2384 			/*
2385 			 * Flush any state from a previous association.
2386 			 */
2387 			FREE(ni->ni_wpa_ie, M_DEVBUF);
2388 			ni->ni_wpa_ie = NULL;
2389 		}
2390 		if (wme != NULL) {
2391 			/*
2392 			 * Record WME parameters for station, mark node
2393 			 * as capable of QoS and record information
2394 			 * element for applications that require it.
2395 			 */
2396 			ieee80211_saveie(&ni->ni_wme_ie, wme);
2397 			ni->ni_flags |= IEEE80211_NODE_QOS;
2398 		} else if (ni->ni_wme_ie != NULL) {
2399 			/*
2400 			 * Flush any state from a previous association.
2401 			 */
2402 			FREE(ni->ni_wme_ie, M_DEVBUF);
2403 			ni->ni_wme_ie = NULL;
2404 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
2405 		}
2406 		ieee80211_deliver_l2uf(ni);
2407 		ieee80211_node_join(ic, ni, resp);
2408 		break;
2409 	}
2410 
2411 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2412 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
2413 		u_int16_t capinfo, associd;
2414 		u_int16_t status;
2415 
2416 		if (ic->ic_opmode != IEEE80211_M_STA ||
2417 		    ic->ic_state != IEEE80211_S_ASSOC) {
2418 			ic->ic_stats.is_rx_mgtdiscard++;
2419 			return;
2420 		}
2421 
2422 		/*
2423 		 * asresp frame format
2424 		 *	[2] capability information
2425 		 *	[2] status
2426 		 *	[2] association ID
2427 		 *	[tlv] supported rates
2428 		 *	[tlv] extended supported rates
2429 		 *	[tlv] WME
2430 		 */
2431 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
2432 		ni = ic->ic_bss;
2433 		capinfo = le16toh(*(u_int16_t *)frm);
2434 		frm += 2;
2435 		status = le16toh(*(u_int16_t *)frm);
2436 		frm += 2;
2437 		if (status != 0) {
2438 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2439 			    "[%s] %sassoc failed (reason %d)\n",
2440 			    ether_sprintf(wh->i_addr2),
2441 			    ISREASSOC(subtype) ?  "re" : "", status);
2442 			if (ni != ic->ic_bss)	/* XXX never true? */
2443 				ni->ni_fails++;
2444 			ic->ic_stats.is_rx_auth_fail++;	/* XXX */
2445 			return;
2446 		}
2447 		associd = le16toh(*(u_int16_t *)frm);
2448 		frm += 2;
2449 
2450 		rates = xrates = wpa = wme = NULL;
2451 		while (frm < efrm) {
2452 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1]);
2453 			switch (*frm) {
2454 			case IEEE80211_ELEMID_RATES:
2455 				rates = frm;
2456 				break;
2457 			case IEEE80211_ELEMID_XRATES:
2458 				xrates = frm;
2459 				break;
2460 			case IEEE80211_ELEMID_VENDOR:
2461 				if (iswmeoui(frm))
2462 					wme = frm;
2463 				/* XXX Atheros OUI support */
2464 				break;
2465 			}
2466 			frm += frm[1] + 2;
2467 		}
2468 
2469 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2470 		rate = ieee80211_setup_rates(ni, rates, xrates,
2471 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2472 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2473 		if (rate & IEEE80211_RATE_BASIC) {
2474 			IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2475 			    "[%s] %sassoc failed (rate set mismatch)\n",
2476 			    ether_sprintf(wh->i_addr2),
2477 			    ISREASSOC(subtype) ?  "re" : "");
2478 			if (ni != ic->ic_bss)	/* XXX never true? */
2479 				ni->ni_fails++;
2480 			ic->ic_stats.is_rx_assoc_norate++;
2481 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
2482 			return;
2483 		}
2484 
2485 		ni->ni_capinfo = capinfo;
2486 		ni->ni_associd = associd;
2487 		if (wme != NULL &&
2488 		    ieee80211_parse_wmeparams(ic, wme, wh) >= 0) {
2489 			ni->ni_flags |= IEEE80211_NODE_QOS;
2490 			ieee80211_wme_updateparams(ic);
2491 		} else
2492 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
2493 		/*
2494 		 * Configure state now that we are associated.
2495 		 *
2496 		 * XXX may need different/additional driver callbacks?
2497 		 */
2498 		if (ic->ic_curmode == IEEE80211_MODE_11A ||
2499 		    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
2500 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
2501 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
2502 		} else {
2503 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
2504 			ic->ic_flags |= IEEE80211_F_USEBARKER;
2505 		}
2506 		ieee80211_set_shortslottime(ic,
2507 			ic->ic_curmode == IEEE80211_MODE_11A ||
2508 			(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2509 		/*
2510 		 * Honor ERP protection.
2511 		 *
2512 		 * NB: ni_erp should zero for non-11g operation.
2513 		 * XXX check ic_curmode anyway?
2514 		 */
2515 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
2516 		    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2517 			ic->ic_flags |= IEEE80211_F_USEPROT;
2518 		else
2519 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
2520 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2521 		    "[%s] %sassoc success: %s preamble, %s slot time%s%s\n",
2522 		    ether_sprintf(wh->i_addr2),
2523 		    ISREASSOC(subtype) ? "re" : "",
2524 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
2525 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
2526 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
2527 		    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : ""
2528 		);
2529 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
2530 		break;
2531 	}
2532 
2533 	case IEEE80211_FC0_SUBTYPE_DEAUTH: {
2534 		u_int16_t reason;
2535 
2536 		if (ic->ic_state == IEEE80211_S_SCAN) {
2537 			ic->ic_stats.is_rx_mgtdiscard++;
2538 			return;
2539 		}
2540 		/*
2541 		 * deauth frame format
2542 		 *	[2] reason
2543 		 */
2544 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
2545 		reason = le16toh(*(u_int16_t *)frm);
2546 		ic->ic_stats.is_rx_deauth++;
2547 		IEEE80211_NODE_STAT(ni, rx_deauth);
2548 
2549 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2550 		    "[%s] recv deauthenticate (reason %d)\n",
2551 		    ether_sprintf(ni->ni_macaddr), reason);
2552 		switch (ic->ic_opmode) {
2553 		case IEEE80211_M_STA:
2554 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
2555 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2556 			break;
2557 		case IEEE80211_M_HOSTAP:
2558 			if (ni != ic->ic_bss)
2559 				ieee80211_node_leave(ic, ni);
2560 			break;
2561 		default:
2562 			ic->ic_stats.is_rx_mgtdiscard++;
2563 			break;
2564 		}
2565 		break;
2566 	}
2567 
2568 	case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2569 		u_int16_t reason;
2570 
2571 		if (ic->ic_state != IEEE80211_S_RUN &&
2572 		    ic->ic_state != IEEE80211_S_ASSOC &&
2573 		    ic->ic_state != IEEE80211_S_AUTH) {
2574 			ic->ic_stats.is_rx_mgtdiscard++;
2575 			return;
2576 		}
2577 		/*
2578 		 * disassoc frame format
2579 		 *	[2] reason
2580 		 */
2581 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
2582 		reason = le16toh(*(u_int16_t *)frm);
2583 		ic->ic_stats.is_rx_disassoc++;
2584 		IEEE80211_NODE_STAT(ni, rx_disassoc);
2585 
2586 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2587 		    "[%s] recv disassociate (reason %d)\n",
2588 		    ether_sprintf(ni->ni_macaddr), reason);
2589 		switch (ic->ic_opmode) {
2590 		case IEEE80211_M_STA:
2591 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
2592 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
2593 			break;
2594 		case IEEE80211_M_HOSTAP:
2595 			if (ni != ic->ic_bss)
2596 				ieee80211_node_leave(ic, ni);
2597 			break;
2598 		default:
2599 			ic->ic_stats.is_rx_mgtdiscard++;
2600 			break;
2601 		}
2602 		break;
2603 	}
2604 	default:
2605 		IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2606 		     wh, "mgt", "subtype 0x%x not handled", subtype);
2607 		ic->ic_stats.is_rx_badsubtype++;
2608 		break;
2609 	}
2610 #undef ISREASSOC
2611 #undef ISPROBE
2612 }
2613 #undef IEEE80211_VERIFY_LENGTH
2614 #undef IEEE80211_VERIFY_ELEMENT
2615 
2616 /*
2617  * Handle station power-save state change.
2618  */
2619 static void
2620 ieee80211_node_pwrsave(struct ieee80211_node *ni, int enable)
2621 {
2622 	struct ieee80211com *ic = ni->ni_ic;
2623 	struct mbuf *m;
2624 
2625 	if (enable) {
2626 		if ((ni->ni_flags & IEEE80211_NODE_PWR_MGT) == 0)
2627 			ic->ic_ps_sta++;
2628 		ni->ni_flags |= IEEE80211_NODE_PWR_MGT;
2629 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2630 		    "[%s] power save mode on, %u sta's in ps mode\n",
2631 		    ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta);
2632 		return;
2633 	}
2634 
2635 	if (ni->ni_flags & IEEE80211_NODE_PWR_MGT)
2636 		ic->ic_ps_sta--;
2637 	ni->ni_flags &= ~IEEE80211_NODE_PWR_MGT;
2638 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2639 	    "[%s] power save mode off, %u sta's in ps mode\n",
2640 	    ether_sprintf(ni->ni_macaddr), ic->ic_ps_sta);
2641 	/* XXX if no stations in ps mode, flush mc frames */
2642 
2643 	/*
2644 	 * Flush queued unicast frames.
2645 	 */
2646 	if (IEEE80211_NODE_SAVEQ_QLEN(ni) == 0) {
2647 		if (ic->ic_set_tim != NULL)
2648 			ic->ic_set_tim(ni, 0);		/* just in case */
2649 		return;
2650 	}
2651 	IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2652 	    "[%s] flush ps queue, %u packets queued\n",
2653 	    ether_sprintf(ni->ni_macaddr), IEEE80211_NODE_SAVEQ_QLEN(ni));
2654 	for (;;) {
2655 		int qlen;
2656 
2657 		IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
2658 		if (m == NULL)
2659 			break;
2660 		/*
2661 		 * If this is the last packet, turn off the TIM bit.
2662 		 * If there are more packets, set the more packets bit
2663 		 * in the mbuf so ieee80211_encap will mark the 802.11
2664 		 * head to indicate more data frames will follow.
2665 		 */
2666 		if (qlen != 0)
2667 			m->m_flags |= M_MORE_DATA;
2668 		/* XXX need different driver interface */
2669 		/* XXX bypasses q max */
2670 		IF_ENQUEUE(&ic->ic_ifp->if_snd, m);
2671 	}
2672 	if (ic->ic_set_tim != NULL)
2673 		ic->ic_set_tim(ni, 0);
2674 }
2675 
2676 /*
2677  * Process a received ps-poll frame.
2678  */
2679 static void
2680 ieee80211_recv_pspoll(struct ieee80211com *ic,
2681 	struct ieee80211_node *ni, struct mbuf *m0)
2682 {
2683 	struct ieee80211_frame_min *wh;
2684 	struct mbuf *m;
2685 	u_int16_t aid;
2686 	int qlen;
2687 
2688 	wh = mtod(m0, struct ieee80211_frame_min *);
2689 	if (ni->ni_associd == 0) {
2690 		IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2691 		    (struct ieee80211_frame *) wh, "ps-poll",
2692 		    "%s", "unassociated station");
2693 		ic->ic_stats.is_ps_unassoc++;
2694 		IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2695 			IEEE80211_REASON_NOT_ASSOCED);
2696 		return;
2697 	}
2698 
2699 	aid = le16toh(*(u_int16_t *)wh->i_dur);
2700 	if (aid != ni->ni_associd) {
2701 		IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2702 		    (struct ieee80211_frame *) wh, "ps-poll",
2703 		    "aid mismatch: sta aid 0x%x poll aid 0x%x",
2704 		    ni->ni_associd, aid);
2705 		ic->ic_stats.is_ps_badaid++;
2706 		IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2707 			IEEE80211_REASON_NOT_ASSOCED);
2708 		return;
2709 	}
2710 
2711 	/* Okay, take the first queued packet and put it out... */
2712 	IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
2713 	if (m == NULL) {
2714 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2715 		    "[%s] recv ps-poll, but queue empty\n",
2716 		    ether_sprintf(wh->i_addr2));
2717 		ieee80211_send_nulldata(ieee80211_ref_node(ni));
2718 		ic->ic_stats.is_ps_qempty++;	/* XXX node stat */
2719 		if (ic->ic_set_tim != NULL)
2720 			ic->ic_set_tim(ni, 0);	/* just in case */
2721 		return;
2722 	}
2723 	/*
2724 	 * If there are more packets, set the more packets bit
2725 	 * in the packet dispatched to the station; otherwise
2726 	 * turn off the TIM bit.
2727 	 */
2728 	if (qlen != 0) {
2729 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2730 		    "[%s] recv ps-poll, send packet, %u still queued\n",
2731 		    ether_sprintf(ni->ni_macaddr), qlen);
2732 		m->m_flags |= M_MORE_DATA;
2733 	} else {
2734 		IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
2735 		    "[%s] recv ps-poll, send packet, queue empty\n",
2736 		    ether_sprintf(ni->ni_macaddr));
2737 		if (ic->ic_set_tim != NULL)
2738 			ic->ic_set_tim(ni, 0);
2739 	}
2740 	m->m_flags |= M_PWR_SAV;		/* bypass PS handling */
2741 	IF_ENQUEUE(&ic->ic_ifp->if_snd, m);
2742 }
2743 
2744 #ifdef IEEE80211_DEBUG
2745 /*
2746  * Debugging support.
2747  */
2748 
2749 /*
2750  * Return the bssid of a frame.
2751  */
2752 static const u_int8_t *
2753 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh)
2754 {
2755 	if (ic->ic_opmode == IEEE80211_M_STA)
2756 		return wh->i_addr2;
2757 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
2758 		return wh->i_addr1;
2759 	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
2760 		return wh->i_addr1;
2761 	return wh->i_addr3;
2762 }
2763 
2764 void
2765 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...)
2766 {
2767 	char buf[128];		/* XXX */
2768 	va_list ap;
2769 
2770 	va_start(ap, fmt);
2771 	vsnprintf(buf, sizeof(buf), fmt, ap);
2772 	va_end(ap);
2773 
2774 	if_printf(ic->ic_ifp, "%s", buf);	/* NB: no \n */
2775 }
2776 
2777 void
2778 ieee80211_note_frame(struct ieee80211com *ic,
2779 	const struct ieee80211_frame *wh,
2780 	const char *fmt, ...)
2781 {
2782 	char buf[128];		/* XXX */
2783 	va_list ap;
2784 
2785 	va_start(ap, fmt);
2786 	vsnprintf(buf, sizeof(buf), fmt, ap);
2787 	va_end(ap);
2788 	if_printf(ic->ic_ifp, "[%s] %s\n",
2789 		ether_sprintf(ieee80211_getbssid(ic, wh)), buf);
2790 }
2791 
2792 void
2793 ieee80211_note_mac(struct ieee80211com *ic,
2794 	const u_int8_t mac[IEEE80211_ADDR_LEN],
2795 	const char *fmt, ...)
2796 {
2797 	char buf[128];		/* XXX */
2798 	va_list ap;
2799 
2800 	va_start(ap, fmt);
2801 	vsnprintf(buf, sizeof(buf), fmt, ap);
2802 	va_end(ap);
2803 	if_printf(ic->ic_ifp, "[%s] %s\n", ether_sprintf(mac), buf);
2804 }
2805 
2806 static void
2807 ieee80211_discard_frame(struct ieee80211com *ic,
2808 	const struct ieee80211_frame *wh,
2809 	const char *type, const char *fmt, ...)
2810 {
2811 	va_list ap;
2812 
2813 	printf("[%s:%s] discard ", ic->ic_ifp->if_xname,
2814 		ether_sprintf(ieee80211_getbssid(ic, wh)));
2815 	if (type != NULL)
2816 		printf("%s frame, ", type);
2817 	else
2818 		printf("frame, ");
2819 	va_start(ap, fmt);
2820 	vprintf(fmt, ap);
2821 	va_end(ap);
2822 	printf("\n");
2823 }
2824 
2825 static void
2826 ieee80211_discard_ie(struct ieee80211com *ic,
2827 	const struct ieee80211_frame *wh,
2828 	const char *type, const char *fmt, ...)
2829 {
2830 	va_list ap;
2831 
2832 	printf("[%s:%s] discard ", ic->ic_ifp->if_xname,
2833 		ether_sprintf(ieee80211_getbssid(ic, wh)));
2834 	if (type != NULL)
2835 		printf("%s information element, ", type);
2836 	else
2837 		printf("information element, ");
2838 	va_start(ap, fmt);
2839 	vprintf(fmt, ap);
2840 	va_end(ap);
2841 	printf("\n");
2842 }
2843 
2844 static void
2845 ieee80211_discard_mac(struct ieee80211com *ic,
2846 	const u_int8_t mac[IEEE80211_ADDR_LEN],
2847 	const char *type, const char *fmt, ...)
2848 {
2849 	va_list ap;
2850 
2851 	printf("[%s:%s] discard ", ic->ic_ifp->if_xname, ether_sprintf(mac));
2852 	if (type != NULL)
2853 		printf("%s frame, ", type);
2854 	else
2855 		printf("frame, ");
2856 	va_start(ap, fmt);
2857 	vprintf(fmt, ap);
2858 	va_end(ap);
2859 	printf("\n");
2860 }
2861 #endif /* IEEE80211_DEBUG */
2862