1 /*- 2 * Copyright (c) 2007-2009 Sam Leffler, Errno Consulting 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 * 25 * $FreeBSD$ 26 */ 27 #ifndef _NET80211_IEEE80211_INPUT_H_ 28 #define _NET80211_IEEE80211_INPUT_H_ 29 30 /* Verify the existence and length of __elem or get out. */ 31 #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen, _action) do { \ 32 if ((__elem) == NULL) { \ 33 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID, \ 34 wh, NULL, "%s", "no " #__elem ); \ 35 vap->iv_stats.is_rx_elem_missing++; \ 36 _action; \ 37 } else if ((__elem)[1] > (__maxlen)) { \ 38 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID, \ 39 wh, NULL, "bad " #__elem " len %d", (__elem)[1]); \ 40 vap->iv_stats.is_rx_elem_toobig++; \ 41 _action; \ 42 } \ 43 } while (0) 44 45 #define IEEE80211_VERIFY_LENGTH(_len, _minlen, _action) do { \ 46 if ((_len) < (_minlen)) { \ 47 IEEE80211_DISCARD(vap, IEEE80211_MSG_ELEMID, \ 48 wh, NULL, "ie too short, got %d, expected %d", \ 49 (_len), (_minlen)); \ 50 vap->iv_stats.is_rx_elem_toosmall++; \ 51 _action; \ 52 } \ 53 } while (0) 54 55 #ifdef IEEE80211_DEBUG 56 void ieee80211_ssid_mismatch(struct ieee80211vap *, const char *tag, 57 uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid); 58 59 #define IEEE80211_VERIFY_SSID(_ni, _ssid, _action) do { \ 60 if ((_ssid)[1] != 0 && \ 61 ((_ssid)[1] != (_ni)->ni_esslen || \ 62 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 63 if (ieee80211_msg_input(vap)) \ 64 ieee80211_ssid_mismatch(vap, \ 65 ieee80211_mgt_subtype_name(subtype), \ 66 wh->i_addr2, _ssid); \ 67 vap->iv_stats.is_rx_ssidmismatch++; \ 68 _action; \ 69 } \ 70 } while (0) 71 #else /* !IEEE80211_DEBUG */ 72 #define IEEE80211_VERIFY_SSID(_ni, _ssid, _action) do { \ 73 if ((_ssid)[1] != 0 && \ 74 ((_ssid)[1] != (_ni)->ni_esslen || \ 75 memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \ 76 vap->iv_stats.is_rx_ssidmismatch++; \ 77 _action; \ 78 } \ 79 } while (0) 80 #endif /* !IEEE80211_DEBUG */ 81 82 #include <sys/endian.h> /* For le16toh() / le32dec() */ 83 84 static __inline int 85 iswpaoui(const uint8_t *frm) 86 { 87 return frm[1] > 3 && le32dec(frm+2) == ((WPA_OUI_TYPE<<24)|WPA_OUI); 88 } 89 90 static __inline int 91 iswmeoui(const uint8_t *frm) 92 { 93 return frm[1] > 3 && le32dec(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI); 94 } 95 96 static __inline int 97 iswmeparam(const uint8_t *frm) 98 { 99 return frm[1] > 5 && le32dec(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 100 frm[6] == WME_PARAM_OUI_SUBTYPE; 101 } 102 103 static __inline int 104 iswmeinfo(const uint8_t *frm) 105 { 106 return frm[1] > 5 && le32dec(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 107 frm[6] == WME_INFO_OUI_SUBTYPE; 108 } 109 110 static __inline int 111 isatherosoui(const uint8_t *frm) 112 { 113 return frm[1] > 3 && le32dec(frm+2) == ((ATH_OUI_TYPE<<24)|ATH_OUI); 114 } 115 116 static __inline int 117 istdmaoui(const uint8_t *frm) 118 { 119 return frm[1] > 3 && le32dec(frm+2) == ((TDMA_OUI_TYPE<<24)|TDMA_OUI); 120 } 121 122 static __inline int 123 ishtcapoui(const uint8_t *frm) 124 { 125 return frm[1] > 3 && le32dec(frm+2) == ((BCM_OUI_HTCAP<<24)|BCM_OUI); 126 } 127 128 static __inline int 129 ishtinfooui(const uint8_t *frm) 130 { 131 return frm[1] > 3 && le32dec(frm+2) == ((BCM_OUI_HTINFO<<24)|BCM_OUI); 132 } 133 134 static __inline int 135 ieee80211_check_rxseq_amsdu(const struct ieee80211_rx_stats *rxs) 136 { 137 138 return (!! (rxs->c_pktflags & IEEE80211_RX_F_AMSDU)); 139 } 140 141 /* 142 * Return 1 if the rxseq check should increment the sequence 143 * number. Return 0 if it's part of an AMSDU batch and it isn't 144 * the final frame in the decap'ed burst. 145 */ 146 static __inline int 147 ieee80211_check_rxseq_amsdu_more(const struct ieee80211_rx_stats *rxs) 148 { 149 /* No state? ok */ 150 if (rxs == NULL) 151 return (1); 152 153 /* State but no AMSDU set? ok */ 154 if ((rxs->c_pktflags & IEEE80211_RX_F_AMSDU) == 0) 155 return (1); 156 157 /* State, AMSDU set, then _MORE means "don't inc yet" */ 158 if (rxs->c_pktflags & IEEE80211_RX_F_AMSDU_MORE) { 159 return (0); 160 } 161 162 /* Both are set, so return ok */ 163 return (1); 164 } 165 166 /* 167 * Check the current frame sequence number against the current TID 168 * state and return whether it's in sequence or should be dropped. 169 * 170 * Since out of order packet and duplicate packet eliminations should 171 * be done by the AMPDU RX code, this routine blindly accepts all 172 * frames from a HT station w/ a TID that is currently doing AMPDU-RX. 173 * HT stations without WME or where the TID is not doing AMPDU-RX 174 * are checked like non-HT stations. 175 * 176 * The routine only eliminates packets whose sequence/fragment 177 * match or are less than the last seen sequence/fragment number 178 * AND are retransmits It doesn't try to eliminate out of order packets. 179 * 180 * Since all frames after sequence number 4095 will be less than 4095 181 * (as the seqnum wraps), handle that special case so packets aren't 182 * incorrectly dropped - ie, if the next packet is sequence number 0 183 * but a retransmit since the initial packet didn't make it. 184 * 185 * XXX TODO: handle sequence number space wrapping with dropped frames; 186 * especially in high interference conditions under high traffic load 187 * The RX AMPDU reorder code also needs it. 188 * 189 * XXX TODO: update for 802.11-2012 9.3.2.10 Duplicate Detection and Recovery. 190 */ 191 static __inline int 192 ieee80211_check_rxseq(struct ieee80211_node *ni, struct ieee80211_frame *wh, 193 uint8_t *bssid, const struct ieee80211_rx_stats *rxs) 194 { 195 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0) 196 #define SEQ_EQ(a,b) ((int)((a)-(b)) == 0) 197 #define SEQNO(a) ((a) >> IEEE80211_SEQ_SEQ_SHIFT) 198 #define FRAGNO(a) ((a) & IEEE80211_SEQ_FRAG_MASK) 199 struct ieee80211vap *vap = ni->ni_vap; 200 uint16_t rxseq; 201 uint8_t type, subtype; 202 uint8_t tid; 203 struct ieee80211_rx_ampdu *rap; 204 205 rxseq = le16toh(*(uint16_t *)wh->i_seq); 206 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 207 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 208 209 /* 210 * Types with no sequence number (or QoS (+)Null frames) 211 * are always treated valid. 212 */ 213 if (! IEEE80211_HAS_SEQ(type, subtype)) 214 return 1; 215 216 /* 217 * Always allow multicast frames for now - QoS (any TID) 218 * or not. 219 */ 220 if (IEEE80211_IS_MULTICAST(wh->i_addr1)) 221 return 1; 222 223 tid = ieee80211_gettid(wh); 224 225 /* 226 * Only do the HT AMPDU check for WME stations; non-WME HT stations 227 * shouldn't exist outside of debugging. We should at least 228 * handle that. 229 */ 230 if (tid < WME_NUM_TID) { 231 rap = &ni->ni_rx_ampdu[tid]; 232 /* HT nodes currently doing RX AMPDU are always valid */ 233 if ((ni->ni_flags & IEEE80211_NODE_HT) && 234 (rap->rxa_flags & IEEE80211_AGGR_RUNNING)) 235 goto ok; 236 } 237 238 /* 239 * Otherwise, retries for packets below or equal to the last 240 * seen sequence number should be dropped. 241 */ 242 243 /* 244 * Treat frame seqnum 4095 as special due to boundary 245 * wrapping conditions. 246 */ 247 if (SEQNO(ni->ni_rxseqs[tid]) == 4095) { 248 /* 249 * Drop retransmits on seqnum 4095/current fragment for itself. 250 */ 251 if (SEQ_EQ(rxseq, ni->ni_rxseqs[tid]) && 252 (wh->i_fc[1] & IEEE80211_FC1_RETRY)) 253 goto fail; 254 /* 255 * Treat any subsequent frame as fine if the last seen frame 256 * is 4095 and it's not a retransmit for the same sequence 257 * number. However, this doesn't capture incorrectly ordered 258 * fragments w/ sequence number 4095. It shouldn't be seen 259 * in practice, but see the comment above for further info. 260 */ 261 goto ok; 262 } 263 264 /* 265 * At this point we assume that retransmitted seq/frag numbers below 266 * the current can simply be eliminated. 267 */ 268 if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) && 269 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) 270 goto fail; 271 272 ok: 273 /* 274 * Only bump the sequence number if it's the last frame 275 * in a batch. That way frames in the rest of the batch 276 * get included, and the last frame in the batch kicks 277 * it next. 278 */ 279 if (ieee80211_check_rxseq_amsdu_more(rxs)) { 280 ni->ni_rxseqs[tid] = rxseq; 281 if ((rxs != NULL) && ieee80211_check_rxseq_amsdu(rxs)) 282 IEEE80211_NODE_STAT(ni, rx_amsdu_more_end); 283 } else { 284 /* .. still waiting */ 285 IEEE80211_NODE_STAT(ni, rx_amsdu_more); 286 } 287 288 return 1; 289 290 fail: 291 /* duplicate, discard */ 292 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT, bssid, "duplicate", 293 "seqno <%u,%u> fragno <%u,%u> tid %u", 294 SEQNO(rxseq), SEQNO(ni->ni_rxseqs[tid]), 295 FRAGNO(rxseq), FRAGNO(ni->ni_rxseqs[tid]), tid); 296 vap->iv_stats.is_rx_dup++; 297 IEEE80211_NODE_STAT(ni, rx_dup); 298 299 return 0; 300 #undef SEQ_LEQ 301 #undef SEQ_EQ 302 #undef SEQNO 303 #undef FRAGNO 304 } 305 306 void ieee80211_deliver_data(struct ieee80211vap *, 307 struct ieee80211_node *, struct mbuf *); 308 struct mbuf *ieee80211_defrag(struct ieee80211_node *, 309 struct mbuf *, int); 310 struct mbuf *ieee80211_realign(struct ieee80211vap *, struct mbuf *, size_t); 311 struct mbuf *ieee80211_decap(struct ieee80211vap *, struct mbuf *, int); 312 struct mbuf *ieee80211_decap1(struct mbuf *, int *); 313 int ieee80211_setup_rates(struct ieee80211_node *ni, 314 const uint8_t *rates, const uint8_t *xrates, int flags); 315 void ieee80211_send_error(struct ieee80211_node *, 316 const uint8_t mac[IEEE80211_ADDR_LEN], int subtype, int arg); 317 int ieee80211_alloc_challenge(struct ieee80211_node *); 318 int ieee80211_parse_beacon(struct ieee80211_node *, struct mbuf *, 319 struct ieee80211_channel *, 320 struct ieee80211_scanparams *); 321 int ieee80211_parse_action(struct ieee80211_node *, struct mbuf *); 322 #endif /* _NET80211_IEEE80211_INPUT_H_ */ 323