xref: /freebsd/sys/net80211/ieee80211_input.c (revision 8fc257994d0ce2396196d7a06d50d20c8015f4b7)
1 /*-
2  * Copyright (c) 2001 Atsushi Onoe
3  * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
4  * All rights reserved.
5  *
6  * Redistribution and use in source and binary forms, with or without
7  * modification, are permitted provided that the following conditions
8  * are met:
9  * 1. Redistributions of source code must retain the above copyright
10  *    notice, this list of conditions and the following disclaimer.
11  * 2. Redistributions in binary form must reproduce the above copyright
12  *    notice, this list of conditions and the following disclaimer in the
13  *    documentation and/or other materials provided with the distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25  */
26 
27 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
29 
30 #include "opt_wlan.h"
31 
32 #include <sys/param.h>
33 #include <sys/systm.h>
34 #include <sys/mbuf.h>
35 #include <sys/malloc.h>
36 #include <sys/endian.h>
37 #include <sys/kernel.h>
38 
39 #include <sys/socket.h>
40 
41 #include <net/ethernet.h>
42 #include <net/if.h>
43 #include <net/if_llc.h>
44 #include <net/if_media.h>
45 #include <net/if_vlan_var.h>
46 
47 #include <net80211/ieee80211_var.h>
48 #include <net80211/ieee80211_input.h>
49 #ifdef IEEE80211_SUPPORT_MESH
50 #include <net80211/ieee80211_mesh.h>
51 #endif
52 
53 #include <net/bpf.h>
54 
55 #ifdef INET
56 #include <netinet/in.h>
57 #include <net/ethernet.h>
58 #endif
59 
60 int
61 ieee80211_input_all(struct ieee80211com *ic, struct mbuf *m, int rssi, int nf)
62 {
63 	struct ieee80211vap *vap;
64 	int type = -1;
65 
66 	m->m_flags |= M_BCAST;		/* NB: mark for bpf tap'ing */
67 
68 	/* XXX locking */
69 	TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
70 		struct ieee80211_node *ni;
71 		struct mbuf *mcopy;
72 
73 		/* NB: could check for IFF_UP but this is cheaper */
74 		if (vap->iv_state == IEEE80211_S_INIT)
75 			continue;
76 		/*
77 		 * WDS vap's only receive directed traffic from the
78 		 * station at the ``far end''.  That traffic should
79 		 * be passed through the AP vap the station is associated
80 		 * to--so don't spam them with mcast frames.
81 		 */
82 		if (vap->iv_opmode == IEEE80211_M_WDS)
83 			continue;
84 		if (TAILQ_NEXT(vap, iv_next) != NULL) {
85 			/*
86 			 * Packet contents are changed by ieee80211_decap
87 			 * so do a deep copy of the packet.
88 			 */
89 			mcopy = m_dup(m, M_DONTWAIT);
90 			if (mcopy == NULL) {
91 				/* XXX stat+msg */
92 				continue;
93 			}
94 		} else {
95 			mcopy = m;
96 			m = NULL;
97 		}
98 		ni = ieee80211_ref_node(vap->iv_bss);
99 		type = ieee80211_input(ni, mcopy, rssi, nf);
100 		ieee80211_free_node(ni);
101 	}
102 	if (m != NULL)			/* no vaps, reclaim mbuf */
103 		m_freem(m);
104 	return type;
105 }
106 
107 /*
108  * This function reassembles fragments.
109  *
110  * XXX should handle 3 concurrent reassemblies per-spec.
111  */
112 struct mbuf *
113 ieee80211_defrag(struct ieee80211_node *ni, struct mbuf *m, int hdrspace)
114 {
115 	struct ieee80211vap *vap = ni->ni_vap;
116 	struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
117 	struct ieee80211_frame *lwh;
118 	uint16_t rxseq;
119 	uint8_t fragno;
120 	uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
121 	struct mbuf *mfrag;
122 
123 	KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
124 
125 	rxseq = le16toh(*(uint16_t *)wh->i_seq);
126 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
127 
128 	/* Quick way out, if there's nothing to defragment */
129 	if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
130 		return m;
131 
132 	/*
133 	 * Remove frag to insure it doesn't get reaped by timer.
134 	 */
135 	if (ni->ni_table == NULL) {
136 		/*
137 		 * Should never happen.  If the node is orphaned (not in
138 		 * the table) then input packets should not reach here.
139 		 * Otherwise, a concurrent request that yanks the table
140 		 * should be blocked by other interlocking and/or by first
141 		 * shutting the driver down.  Regardless, be defensive
142 		 * here and just bail
143 		 */
144 		/* XXX need msg+stat */
145 		m_freem(m);
146 		return NULL;
147 	}
148 	IEEE80211_NODE_LOCK(ni->ni_table);
149 	mfrag = ni->ni_rxfrag[0];
150 	ni->ni_rxfrag[0] = NULL;
151 	IEEE80211_NODE_UNLOCK(ni->ni_table);
152 
153 	/*
154 	 * Validate new fragment is in order and
155 	 * related to the previous ones.
156 	 */
157 	if (mfrag != NULL) {
158 		uint16_t last_rxseq;
159 
160 		lwh = mtod(mfrag, struct ieee80211_frame *);
161 		last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
162 		/* NB: check seq # and frag together */
163 		if (rxseq != last_rxseq+1 ||
164 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
165 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
166 			/*
167 			 * Unrelated fragment or no space for it,
168 			 * clear current fragments.
169 			 */
170 			m_freem(mfrag);
171 			mfrag = NULL;
172 		}
173 	}
174 
175  	if (mfrag == NULL) {
176 		if (fragno != 0) {		/* !first fragment, discard */
177 			vap->iv_stats.is_rx_defrag++;
178 			IEEE80211_NODE_STAT(ni, rx_defrag);
179 			m_freem(m);
180 			return NULL;
181 		}
182 		mfrag = m;
183 	} else {				/* concatenate */
184 		m_adj(m, hdrspace);		/* strip header */
185 		m_cat(mfrag, m);
186 		/* NB: m_cat doesn't update the packet header */
187 		mfrag->m_pkthdr.len += m->m_pkthdr.len;
188 		/* track last seqnum and fragno */
189 		lwh = mtod(mfrag, struct ieee80211_frame *);
190 		*(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
191 	}
192 	if (more_frag) {			/* more to come, save */
193 		ni->ni_rxfragstamp = ticks;
194 		ni->ni_rxfrag[0] = mfrag;
195 		mfrag = NULL;
196 	}
197 	return mfrag;
198 }
199 
200 void
201 ieee80211_deliver_data(struct ieee80211vap *vap,
202 	struct ieee80211_node *ni, struct mbuf *m)
203 {
204 	struct ether_header *eh = mtod(m, struct ether_header *);
205 	struct ifnet *ifp = vap->iv_ifp;
206 
207 	/* clear driver/net80211 flags before passing up */
208 	m->m_flags &= ~(M_80211_RX | M_MCAST | M_BCAST);
209 
210 	/* NB: see hostap_deliver_data, this path doesn't handle hostap */
211 	KASSERT(vap->iv_opmode != IEEE80211_M_HOSTAP, ("gack, hostap"));
212 	/*
213 	 * Do accounting.
214 	 */
215 	ifp->if_ipackets++;
216 	IEEE80211_NODE_STAT(ni, rx_data);
217 	IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
218 	if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
219 		m->m_flags |= M_MCAST;		/* XXX M_BCAST? */
220 		IEEE80211_NODE_STAT(ni, rx_mcast);
221 	} else
222 		IEEE80211_NODE_STAT(ni, rx_ucast);
223 	m->m_pkthdr.rcvif = ifp;
224 
225 	if (ni->ni_vlan != 0) {
226 		/* attach vlan tag */
227 		m->m_pkthdr.ether_vtag = ni->ni_vlan;
228 		m->m_flags |= M_VLANTAG;
229 	}
230 	ifp->if_input(ifp, m);
231 }
232 
233 struct mbuf *
234 ieee80211_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen)
235 {
236 	struct ieee80211_qosframe_addr4 wh;
237 	struct ether_header *eh;
238 	struct llc *llc;
239 
240 	KASSERT(hdrlen <= sizeof(wh),
241 	    ("hdrlen %d > max %zd", hdrlen, sizeof(wh)));
242 
243 	if (m->m_len < hdrlen + sizeof(*llc) &&
244 	    (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
245 		vap->iv_stats.is_rx_tooshort++;
246 		/* XXX msg */
247 		return NULL;
248 	}
249 	memcpy(&wh, mtod(m, caddr_t), hdrlen);
250 	llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
251 	if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
252 	    llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
253 	    llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
254 	    /* NB: preserve AppleTalk frames that have a native SNAP hdr */
255 	    !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
256 	      llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
257 		m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
258 		llc = NULL;
259 	} else {
260 		m_adj(m, hdrlen - sizeof(*eh));
261 	}
262 	eh = mtod(m, struct ether_header *);
263 	switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
264 	case IEEE80211_FC1_DIR_NODS:
265 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
266 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
267 		break;
268 	case IEEE80211_FC1_DIR_TODS:
269 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
270 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
271 		break;
272 	case IEEE80211_FC1_DIR_FROMDS:
273 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
274 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
275 		break;
276 	case IEEE80211_FC1_DIR_DSTODS:
277 		IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
278 		IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
279 		break;
280 	}
281 #ifdef ALIGNED_POINTER
282 	if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
283 		m = ieee80211_realign(vap, m, sizeof(*eh));
284 		if (m == NULL)
285 			return NULL;
286 	}
287 #endif /* ALIGNED_POINTER */
288 	if (llc != NULL) {
289 		eh = mtod(m, struct ether_header *);
290 		eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
291 	}
292 	return m;
293 }
294 
295 /*
296  * Decap a frame encapsulated in a fast-frame/A-MSDU.
297  */
298 struct mbuf *
299 ieee80211_decap1(struct mbuf *m, int *framelen)
300 {
301 #define	FF_LLC_SIZE	(sizeof(struct ether_header) + sizeof(struct llc))
302 	struct ether_header *eh;
303 	struct llc *llc;
304 
305 	/*
306 	 * The frame has an 802.3 header followed by an 802.2
307 	 * LLC header.  The encapsulated frame length is in the
308 	 * first header type field; save that and overwrite it
309 	 * with the true type field found in the second.  Then
310 	 * copy the 802.3 header up to where it belongs and
311 	 * adjust the mbuf contents to remove the void.
312 	 */
313 	if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
314 		return NULL;
315 	eh = mtod(m, struct ether_header *);	/* 802.3 header is first */
316 	llc = (struct llc *)&eh[1];		/* 802.2 header follows */
317 	*framelen = ntohs(eh->ether_type)	/* encap'd frame size */
318 		  + sizeof(struct ether_header) - sizeof(struct llc);
319 	eh->ether_type = llc->llc_un.type_snap.ether_type;
320 	ovbcopy(eh, mtod(m, uint8_t *) + sizeof(struct llc),
321 		sizeof(struct ether_header));
322 	m_adj(m, sizeof(struct llc));
323 	return m;
324 #undef FF_LLC_SIZE
325 }
326 
327 /*
328  * Install received rate set information in the node's state block.
329  */
330 int
331 ieee80211_setup_rates(struct ieee80211_node *ni,
332 	const uint8_t *rates, const uint8_t *xrates, int flags)
333 {
334 	struct ieee80211vap *vap = ni->ni_vap;
335 	struct ieee80211_rateset *rs = &ni->ni_rates;
336 
337 	memset(rs, 0, sizeof(*rs));
338 	rs->rs_nrates = rates[1];
339 	memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
340 	if (xrates != NULL) {
341 		uint8_t nxrates;
342 		/*
343 		 * Tack on 11g extended supported rate element.
344 		 */
345 		nxrates = xrates[1];
346 		if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
347 			nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
348 			IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE, ni,
349 			    "extended rate set too large; only using "
350 			    "%u of %u rates", nxrates, xrates[1]);
351 			vap->iv_stats.is_rx_rstoobig++;
352 		}
353 		memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
354 		rs->rs_nrates += nxrates;
355 	}
356 	return ieee80211_fix_rate(ni, rs, flags);
357 }
358 
359 /*
360  * Send a management frame error response to the specified
361  * station.  If ni is associated with the station then use
362  * it; otherwise allocate a temporary node suitable for
363  * transmitting the frame and then free the reference so
364  * it will go away as soon as the frame has been transmitted.
365  */
366 void
367 ieee80211_send_error(struct ieee80211_node *ni,
368 	const uint8_t mac[IEEE80211_ADDR_LEN], int subtype, int arg)
369 {
370 	struct ieee80211vap *vap = ni->ni_vap;
371 	int istmp;
372 
373 	if (ni == vap->iv_bss) {
374 		if (vap->iv_state != IEEE80211_S_RUN) {
375 			/*
376 			 * XXX hack until we get rid of this routine.
377 			 * We can be called prior to the vap reaching
378 			 * run state under certain conditions in which
379 			 * case iv_bss->ni_chan will not be setup.
380 			 * Check for this explicitly and and just ignore
381 			 * the request.
382 			 */
383 			return;
384 		}
385 		ni = ieee80211_tmp_node(vap, mac);
386 		if (ni == NULL) {
387 			/* XXX msg */
388 			return;
389 		}
390 		istmp = 1;
391 	} else
392 		istmp = 0;
393 	IEEE80211_SEND_MGMT(ni, subtype, arg);
394 	if (istmp)
395 		ieee80211_free_node(ni);
396 }
397 
398 int
399 ieee80211_alloc_challenge(struct ieee80211_node *ni)
400 {
401 	if (ni->ni_challenge == NULL)
402 		ni->ni_challenge = (uint32_t *) malloc(IEEE80211_CHALLENGE_LEN,
403 		    M_80211_NODE, M_NOWAIT);
404 	if (ni->ni_challenge == NULL) {
405 		IEEE80211_NOTE(ni->ni_vap,
406 		    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
407 		    "%s", "shared key challenge alloc failed");
408 		/* XXX statistic */
409 	}
410 	return (ni->ni_challenge != NULL);
411 }
412 
413 /*
414  * Parse a Beacon or ProbeResponse frame and return the
415  * useful information in an ieee80211_scanparams structure.
416  * Status is set to 0 if no problems were found; otherwise
417  * a bitmask of IEEE80211_BPARSE_* items is returned that
418  * describes the problems detected.
419  */
420 int
421 ieee80211_parse_beacon(struct ieee80211_node *ni, struct mbuf *m,
422 	struct ieee80211_scanparams *scan)
423 {
424 	struct ieee80211vap *vap = ni->ni_vap;
425 	struct ieee80211com *ic = ni->ni_ic;
426 	struct ieee80211_frame *wh;
427 	uint8_t *frm, *efrm;
428 
429 	wh = mtod(m, struct ieee80211_frame *);
430 	frm = (uint8_t *)&wh[1];
431 	efrm = mtod(m, uint8_t *) + m->m_len;
432 	scan->status = 0;
433 	/*
434 	 * beacon/probe response frame format
435 	 *	[8] time stamp
436 	 *	[2] beacon interval
437 	 *	[2] capability information
438 	 *	[tlv] ssid
439 	 *	[tlv] supported rates
440 	 *	[tlv] country information
441 	 *	[tlv] channel switch announcement (CSA)
442 	 *	[tlv] parameter set (FH/DS)
443 	 *	[tlv] erp information
444 	 *	[tlv] extended supported rates
445 	 *	[tlv] WME
446 	 *	[tlv] WPA or RSN
447 	 *	[tlv] HT capabilities
448 	 *	[tlv] HT information
449 	 *	[tlv] Atheros capabilities
450 	 *	[tlv] Mesh ID
451 	 *	[tlv] Mesh Configuration
452 	 */
453 	IEEE80211_VERIFY_LENGTH(efrm - frm, 12,
454 	    return (scan->status = IEEE80211_BPARSE_BADIELEN));
455 	memset(scan, 0, sizeof(*scan));
456 	scan->tstamp  = frm;				frm += 8;
457 	scan->bintval = le16toh(*(uint16_t *)frm);	frm += 2;
458 	scan->capinfo = le16toh(*(uint16_t *)frm);	frm += 2;
459 	scan->bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
460 	scan->chan = scan->bchan;
461 	scan->ies = frm;
462 	scan->ies_len = efrm - frm;
463 
464 	while (efrm - frm > 1) {
465 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2,
466 		    return (scan->status = IEEE80211_BPARSE_BADIELEN));
467 		switch (*frm) {
468 		case IEEE80211_ELEMID_SSID:
469 			scan->ssid = frm;
470 			break;
471 		case IEEE80211_ELEMID_RATES:
472 			scan->rates = frm;
473 			break;
474 		case IEEE80211_ELEMID_COUNTRY:
475 			scan->country = frm;
476 			break;
477 		case IEEE80211_ELEMID_CSA:
478 			scan->csa = frm;
479 			break;
480 		case IEEE80211_ELEMID_FHPARMS:
481 			if (ic->ic_phytype == IEEE80211_T_FH) {
482 				scan->fhdwell = LE_READ_2(&frm[2]);
483 				scan->chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
484 				scan->fhindex = frm[6];
485 			}
486 			break;
487 		case IEEE80211_ELEMID_DSPARMS:
488 			/*
489 			 * XXX hack this since depending on phytype
490 			 * is problematic for multi-mode devices.
491 			 */
492 			if (ic->ic_phytype != IEEE80211_T_FH)
493 				scan->chan = frm[2];
494 			break;
495 		case IEEE80211_ELEMID_TIM:
496 			/* XXX ATIM? */
497 			scan->tim = frm;
498 			scan->timoff = frm - mtod(m, uint8_t *);
499 			break;
500 		case IEEE80211_ELEMID_IBSSPARMS:
501 		case IEEE80211_ELEMID_CFPARMS:
502 		case IEEE80211_ELEMID_PWRCNSTR:
503 			/* NB: avoid debugging complaints */
504 			break;
505 		case IEEE80211_ELEMID_XRATES:
506 			scan->xrates = frm;
507 			break;
508 		case IEEE80211_ELEMID_ERP:
509 			if (frm[1] != 1) {
510 				IEEE80211_DISCARD_IE(vap,
511 				    IEEE80211_MSG_ELEMID, wh, "ERP",
512 				    "bad len %u", frm[1]);
513 				vap->iv_stats.is_rx_elem_toobig++;
514 				break;
515 			}
516 			scan->erp = frm[2] | 0x100;
517 			break;
518 		case IEEE80211_ELEMID_HTCAP:
519 			scan->htcap = frm;
520 			break;
521 		case IEEE80211_ELEMID_RSN:
522 			scan->rsn = frm;
523 			break;
524 		case IEEE80211_ELEMID_HTINFO:
525 			scan->htinfo = frm;
526 			break;
527 #ifdef IEEE80211_SUPPORT_MESH
528 		case IEEE80211_ELEMID_MESHID:
529 			scan->meshid = frm;
530 			break;
531 		case IEEE80211_ELEMID_MESHCONF:
532 			scan->meshconf = frm;
533 			break;
534 #endif
535 		case IEEE80211_ELEMID_VENDOR:
536 			if (iswpaoui(frm))
537 				scan->wpa = frm;
538 			else if (iswmeparam(frm) || iswmeinfo(frm))
539 				scan->wme = frm;
540 #ifdef IEEE80211_SUPPORT_SUPERG
541 			else if (isatherosoui(frm))
542 				scan->ath = frm;
543 #endif
544 #ifdef IEEE80211_SUPPORT_TDMA
545 			else if (istdmaoui(frm))
546 				scan->tdma = frm;
547 #endif
548 			else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
549 				/*
550 				 * Accept pre-draft HT ie's if the
551 				 * standard ones have not been seen.
552 				 */
553 				if (ishtcapoui(frm)) {
554 					if (scan->htcap == NULL)
555 						scan->htcap = frm;
556 				} else if (ishtinfooui(frm)) {
557 					if (scan->htinfo == NULL)
558 						scan->htcap = frm;
559 				}
560 			}
561 			break;
562 		default:
563 			IEEE80211_DISCARD_IE(vap, IEEE80211_MSG_ELEMID,
564 			    wh, "unhandled",
565 			    "id %u, len %u", *frm, frm[1]);
566 			vap->iv_stats.is_rx_elem_unknown++;
567 			break;
568 		}
569 		frm += frm[1] + 2;
570 	}
571 	IEEE80211_VERIFY_ELEMENT(scan->rates, IEEE80211_RATE_MAXSIZE,
572 	    scan->status |= IEEE80211_BPARSE_RATES_INVALID);
573 	if (scan->rates != NULL && scan->xrates != NULL) {
574 		/*
575 		 * NB: don't process XRATES if RATES is missing.  This
576 		 * avoids a potential null ptr deref and should be ok
577 		 * as the return code will already note RATES is missing
578 		 * (so callers shouldn't otherwise process the frame).
579 		 */
580 		IEEE80211_VERIFY_ELEMENT(scan->xrates,
581 		    IEEE80211_RATE_MAXSIZE - scan->rates[1],
582 		    scan->status |= IEEE80211_BPARSE_XRATES_INVALID);
583 	}
584 	IEEE80211_VERIFY_ELEMENT(scan->ssid, IEEE80211_NWID_LEN,
585 	    scan->status |= IEEE80211_BPARSE_SSID_INVALID);
586 	if (scan->chan != scan->bchan && ic->ic_phytype != IEEE80211_T_FH) {
587 		/*
588 		 * Frame was received on a channel different from the
589 		 * one indicated in the DS params element id;
590 		 * silently discard it.
591 		 *
592 		 * NB: this can happen due to signal leakage.
593 		 *     But we should take it for FH phy because
594 		 *     the rssi value should be correct even for
595 		 *     different hop pattern in FH.
596 		 */
597 		IEEE80211_DISCARD(vap,
598 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
599 		    wh, NULL, "for off-channel %u", scan->chan);
600 		vap->iv_stats.is_rx_chanmismatch++;
601 		scan->status |= IEEE80211_BPARSE_OFFCHAN;
602 	}
603 	if (!(IEEE80211_BINTVAL_MIN <= scan->bintval &&
604 	      scan->bintval <= IEEE80211_BINTVAL_MAX)) {
605 		IEEE80211_DISCARD(vap,
606 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
607 		    wh, NULL, "bogus beacon interval", scan->bintval);
608 		vap->iv_stats.is_rx_badbintval++;
609 		scan->status |= IEEE80211_BPARSE_BINTVAL_INVALID;
610 	}
611 	if (scan->country != NULL) {
612 		/*
613 		 * Validate we have at least enough data to extract
614 		 * the country code.  Not sure if we should return an
615 		 * error instead of discarding the IE; consider this
616 		 * being lenient as we don't depend on the data for
617 		 * correct operation.
618 		 */
619 		IEEE80211_VERIFY_LENGTH(scan->country[1], 3 * sizeof(uint8_t),
620 		    scan->country = NULL);
621 	}
622 	if (scan->csa != NULL) {
623 		/*
624 		 * Validate Channel Switch Announcement; this must
625 		 * be the correct length or we toss the frame.
626 		 */
627 		IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t),
628 		    scan->status |= IEEE80211_BPARSE_CSA_INVALID);
629 	}
630 	/*
631 	 * Process HT ie's.  This is complicated by our
632 	 * accepting both the standard ie's and the pre-draft
633 	 * vendor OUI ie's that some vendors still use/require.
634 	 */
635 	if (scan->htcap != NULL) {
636 		IEEE80211_VERIFY_LENGTH(scan->htcap[1],
637 		     scan->htcap[0] == IEEE80211_ELEMID_VENDOR ?
638 			 4 + sizeof(struct ieee80211_ie_htcap)-2 :
639 			 sizeof(struct ieee80211_ie_htcap)-2,
640 		     scan->htcap = NULL);
641 	}
642 	if (scan->htinfo != NULL) {
643 		IEEE80211_VERIFY_LENGTH(scan->htinfo[1],
644 		     scan->htinfo[0] == IEEE80211_ELEMID_VENDOR ?
645 			 4 + sizeof(struct ieee80211_ie_htinfo)-2 :
646 			 sizeof(struct ieee80211_ie_htinfo)-2,
647 		     scan->htinfo = NULL);
648 	}
649 	return scan->status;
650 }
651 
652 /*
653  * Parse an Action frame.  Return 0 on success, non-zero on failure.
654  */
655 int
656 ieee80211_parse_action(struct ieee80211_node *ni, struct mbuf *m)
657 {
658 	struct ieee80211vap *vap = ni->ni_vap;
659 	const struct ieee80211_action *ia;
660 	struct ieee80211_frame *wh;
661 	uint8_t *frm, *efrm;
662 
663 	/*
664 	 * action frame format:
665 	 *	[1] category
666 	 *	[1] action
667 	 *	[tlv] parameters
668 	 */
669 	wh = mtod(m, struct ieee80211_frame *);
670 	frm = (u_int8_t *)&wh[1];
671 	efrm = mtod(m, u_int8_t *) + m->m_len;
672 	IEEE80211_VERIFY_LENGTH(efrm - frm,
673 		sizeof(struct ieee80211_action), return EINVAL);
674 	ia = (const struct ieee80211_action *) frm;
675 
676 	vap->iv_stats.is_rx_action++;
677 	IEEE80211_NODE_STAT(ni, rx_action);
678 
679 	/* verify frame payloads but defer processing */
680 	/* XXX maybe push this to method */
681 	switch (ia->ia_category) {
682 	case IEEE80211_ACTION_CAT_BA:
683 		switch (ia->ia_action) {
684 		case IEEE80211_ACTION_BA_ADDBA_REQUEST:
685 			IEEE80211_VERIFY_LENGTH(efrm - frm,
686 			    sizeof(struct ieee80211_action_ba_addbarequest),
687 			    return EINVAL);
688 			break;
689 		case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
690 			IEEE80211_VERIFY_LENGTH(efrm - frm,
691 			    sizeof(struct ieee80211_action_ba_addbaresponse),
692 			    return EINVAL);
693 			break;
694 		case IEEE80211_ACTION_BA_DELBA:
695 			IEEE80211_VERIFY_LENGTH(efrm - frm,
696 			    sizeof(struct ieee80211_action_ba_delba),
697 			    return EINVAL);
698 			break;
699 		}
700 		break;
701 	case IEEE80211_ACTION_CAT_HT:
702 		switch (ia->ia_action) {
703 		case IEEE80211_ACTION_HT_TXCHWIDTH:
704 			IEEE80211_VERIFY_LENGTH(efrm - frm,
705 			    sizeof(struct ieee80211_action_ht_txchwidth),
706 			    return EINVAL);
707 			break;
708 		case IEEE80211_ACTION_HT_MIMOPWRSAVE:
709 			IEEE80211_VERIFY_LENGTH(efrm - frm,
710 			    sizeof(struct ieee80211_action_ht_mimopowersave),
711 			    return EINVAL);
712 			break;
713 		}
714 		break;
715 	}
716 	return 0;
717 }
718 
719 #ifdef IEEE80211_DEBUG
720 /*
721  * Debugging support.
722  */
723 void
724 ieee80211_ssid_mismatch(struct ieee80211vap *vap, const char *tag,
725 	uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
726 {
727 	printf("[%s] discard %s frame, ssid mismatch: ",
728 		ether_sprintf(mac), tag);
729 	ieee80211_print_essid(ssid + 2, ssid[1]);
730 	printf("\n");
731 }
732 
733 /*
734  * Return the bssid of a frame.
735  */
736 static const uint8_t *
737 ieee80211_getbssid(const struct ieee80211vap *vap,
738 	const struct ieee80211_frame *wh)
739 {
740 	if (vap->iv_opmode == IEEE80211_M_STA)
741 		return wh->i_addr2;
742 	if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
743 		return wh->i_addr1;
744 	if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
745 		return wh->i_addr1;
746 	return wh->i_addr3;
747 }
748 
749 #include <machine/stdarg.h>
750 
751 void
752 ieee80211_note(const struct ieee80211vap *vap, const char *fmt, ...)
753 {
754 	char buf[128];		/* XXX */
755 	va_list ap;
756 
757 	va_start(ap, fmt);
758 	vsnprintf(buf, sizeof(buf), fmt, ap);
759 	va_end(ap);
760 
761 	if_printf(vap->iv_ifp, "%s", buf);	/* NB: no \n */
762 }
763 
764 void
765 ieee80211_note_frame(const struct ieee80211vap *vap,
766 	const struct ieee80211_frame *wh,
767 	const char *fmt, ...)
768 {
769 	char buf[128];		/* XXX */
770 	va_list ap;
771 
772 	va_start(ap, fmt);
773 	vsnprintf(buf, sizeof(buf), fmt, ap);
774 	va_end(ap);
775 	if_printf(vap->iv_ifp, "[%s] %s\n",
776 		ether_sprintf(ieee80211_getbssid(vap, wh)), buf);
777 }
778 
779 void
780 ieee80211_note_mac(const struct ieee80211vap *vap,
781 	const uint8_t mac[IEEE80211_ADDR_LEN],
782 	const char *fmt, ...)
783 {
784 	char buf[128];		/* XXX */
785 	va_list ap;
786 
787 	va_start(ap, fmt);
788 	vsnprintf(buf, sizeof(buf), fmt, ap);
789 	va_end(ap);
790 	if_printf(vap->iv_ifp, "[%s] %s\n", ether_sprintf(mac), buf);
791 }
792 
793 void
794 ieee80211_discard_frame(const struct ieee80211vap *vap,
795 	const struct ieee80211_frame *wh,
796 	const char *type, const char *fmt, ...)
797 {
798 	va_list ap;
799 
800 	if_printf(vap->iv_ifp, "[%s] discard ",
801 		ether_sprintf(ieee80211_getbssid(vap, wh)));
802 	if (type == NULL) {
803 		printf("%s frame, ", ieee80211_mgt_subtype_name[
804 			(wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) >>
805 			IEEE80211_FC0_SUBTYPE_SHIFT]);
806 	} else
807 		printf("%s frame, ", type);
808 	va_start(ap, fmt);
809 	vprintf(fmt, ap);
810 	va_end(ap);
811 	printf("\n");
812 }
813 
814 void
815 ieee80211_discard_ie(const struct ieee80211vap *vap,
816 	const struct ieee80211_frame *wh,
817 	const char *type, const char *fmt, ...)
818 {
819 	va_list ap;
820 
821 	if_printf(vap->iv_ifp, "[%s] discard ",
822 		ether_sprintf(ieee80211_getbssid(vap, wh)));
823 	if (type != NULL)
824 		printf("%s information element, ", type);
825 	else
826 		printf("information element, ");
827 	va_start(ap, fmt);
828 	vprintf(fmt, ap);
829 	va_end(ap);
830 	printf("\n");
831 }
832 
833 void
834 ieee80211_discard_mac(const struct ieee80211vap *vap,
835 	const uint8_t mac[IEEE80211_ADDR_LEN],
836 	const char *type, const char *fmt, ...)
837 {
838 	va_list ap;
839 
840 	if_printf(vap->iv_ifp, "[%s] discard ", ether_sprintf(mac));
841 	if (type != NULL)
842 		printf("%s frame, ", type);
843 	else
844 		printf("frame, ");
845 	va_start(ap, fmt);
846 	vprintf(fmt, ap);
847 	va_end(ap);
848 	printf("\n");
849 }
850 #endif /* IEEE80211_DEBUG */
851