1 /*- 2 * Copyright (c) 2001 Atsushi Onoe 3 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting 4 * All rights reserved. 5 * 6 * Redistribution and use in source and binary forms, with or without 7 * modification, are permitted provided that the following conditions 8 * are met: 9 * 1. Redistributions of source code must retain the above copyright 10 * notice, this list of conditions and the following disclaimer. 11 * 2. Redistributions in binary form must reproduce the above copyright 12 * notice, this list of conditions and the following disclaimer in the 13 * documentation and/or other materials provided with the distribution. 14 * 3. The name of the author may not be used to endorse or promote products 15 * derived from this software without specific prior written permission. 16 * 17 * Alternatively, this software may be distributed under the terms of the 18 * GNU General Public License ("GPL") version 2 as published by the Free 19 * Software Foundation. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 31 */ 32 33 #include <sys/cdefs.h> 34 __FBSDID("$FreeBSD$"); 35 36 #include "opt_inet.h" 37 38 #include <sys/param.h> 39 #include <sys/systm.h> 40 #include <sys/mbuf.h> 41 #include <sys/malloc.h> 42 #include <sys/kernel.h> 43 #include <sys/socket.h> 44 #include <sys/sockio.h> 45 #include <sys/endian.h> 46 #include <sys/errno.h> 47 #include <sys/bus.h> 48 #include <sys/proc.h> 49 #include <sys/sysctl.h> 50 51 #include <machine/atomic.h> 52 53 #include <net/if.h> 54 #include <net/if_dl.h> 55 #include <net/if_media.h> 56 #include <net/if_arp.h> 57 #include <net/ethernet.h> 58 #include <net/if_llc.h> 59 60 #include <net80211/ieee80211_var.h> 61 62 #include <net/bpf.h> 63 64 #ifdef INET 65 #include <netinet/in.h> 66 #include <netinet/if_ether.h> 67 #endif 68 69 /* 70 * Send a management frame to the specified node. The node pointer 71 * must have a reference as the pointer will be passed to the driver 72 * and potentially held for a long time. If the frame is successfully 73 * dispatched to the driver, then it is responsible for freeing the 74 * reference (and potentially free'ing up any associated storage). 75 */ 76 static int 77 ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni, 78 struct mbuf *m, int type) 79 { 80 struct ieee80211com *ic = (void *)ifp; 81 struct ieee80211_frame *wh; 82 83 KASSERT(ni != NULL, ("null node")); 84 ni->ni_inact = 0; 85 86 /* 87 * Yech, hack alert! We want to pass the node down to the 88 * driver's start routine. If we don't do so then the start 89 * routine must immediately look it up again and that can 90 * cause a lock order reversal if, for example, this frame 91 * is being sent because the station is being timedout and 92 * the frame being sent is a DEAUTH message. We could stick 93 * this in an m_tag and tack that on to the mbuf. However 94 * that's rather expensive to do for every frame so instead 95 * we stuff it in the rcvif field since outbound frames do 96 * not (presently) use this. 97 */ 98 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT); 99 if (m == NULL) 100 return ENOMEM; 101 KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null")); 102 m->m_pkthdr.rcvif = (void *)ni; 103 104 wh = mtod(m, struct ieee80211_frame *); 105 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type; 106 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 107 *(u_int16_t *)wh->i_dur = 0; 108 *(u_int16_t *)wh->i_seq = 109 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT); 110 ni->ni_txseq++; 111 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr); 112 IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr); 113 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid); 114 115 if (ifp->if_flags & IFF_DEBUG) { 116 /* avoid to print too many frames */ 117 if (ic->ic_opmode == IEEE80211_M_IBSS || 118 #ifdef IEEE80211_DEBUG 119 ieee80211_debug > 1 || 120 #endif 121 (type & IEEE80211_FC0_SUBTYPE_MASK) != 122 IEEE80211_FC0_SUBTYPE_PROBE_RESP) 123 if_printf(ifp, "sending %s to %s on channel %u\n", 124 ieee80211_mgt_subtype_name[ 125 (type & IEEE80211_FC0_SUBTYPE_MASK) 126 >> IEEE80211_FC0_SUBTYPE_SHIFT], 127 ether_sprintf(ni->ni_macaddr), 128 ieee80211_chan2ieee(ic, ni->ni_chan)); 129 } 130 131 IF_ENQUEUE(&ic->ic_mgtq, m); 132 ifp->if_timer = 1; 133 (*ifp->if_start)(ifp); 134 return 0; 135 } 136 137 /* 138 * Encapsulate an outbound data frame. The mbuf chain is updated and 139 * a reference to the destination node is returned. If an error is 140 * encountered NULL is returned and the node reference will also be NULL. 141 * 142 * NB: The caller is responsible for free'ing a returned node reference. 143 * The convention is ic_bss is not reference counted; the caller must 144 * maintain that. 145 */ 146 struct mbuf * 147 ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni) 148 { 149 struct ieee80211com *ic = (void *)ifp; 150 struct ether_header eh; 151 struct ieee80211_frame *wh; 152 struct ieee80211_node *ni = NULL; 153 struct llc *llc; 154 155 if (m->m_len < sizeof(struct ether_header)) { 156 m = m_pullup(m, sizeof(struct ether_header)); 157 if (m == NULL) { 158 /* XXX statistic */ 159 goto bad; 160 } 161 } 162 memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header)); 163 164 if (ic->ic_opmode != IEEE80211_M_STA) { 165 ni = ieee80211_find_node(ic, eh.ether_dhost); 166 if (ni == NULL) { 167 /* 168 * When not in station mode the 169 * destination address should always be 170 * in the node table unless this is a 171 * multicast/broadcast frame. 172 */ 173 if (!IEEE80211_IS_MULTICAST(eh.ether_dhost)) { 174 /* ic->ic_stats.st_tx_nonode++; XXX statistic */ 175 goto bad; 176 } 177 ni = ic->ic_bss; 178 } 179 } else 180 ni = ic->ic_bss; 181 ni->ni_inact = 0; 182 183 m_adj(m, sizeof(struct ether_header) - sizeof(struct llc)); 184 llc = mtod(m, struct llc *); 185 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP; 186 llc->llc_control = LLC_UI; 187 llc->llc_snap.org_code[0] = 0; 188 llc->llc_snap.org_code[1] = 0; 189 llc->llc_snap.org_code[2] = 0; 190 llc->llc_snap.ether_type = eh.ether_type; 191 M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT); 192 if (m == NULL) 193 goto bad; 194 wh = mtod(m, struct ieee80211_frame *); 195 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA; 196 *(u_int16_t *)wh->i_dur = 0; 197 *(u_int16_t *)wh->i_seq = 198 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT); 199 ni->ni_txseq++; 200 switch (ic->ic_opmode) { 201 case IEEE80211_M_STA: 202 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS; 203 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid); 204 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost); 205 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost); 206 break; 207 case IEEE80211_M_IBSS: 208 case IEEE80211_M_AHDEMO: 209 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS; 210 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost); 211 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost); 212 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid); 213 break; 214 case IEEE80211_M_HOSTAP: 215 wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS; 216 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost); 217 IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid); 218 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost); 219 break; 220 case IEEE80211_M_MONITOR: 221 goto bad; 222 } 223 *pni = ni; 224 return m; 225 bad: 226 if (m != NULL) 227 m_freem(m); 228 if (ni && ni != ic->ic_bss) 229 ieee80211_free_node(ic, ni); 230 *pni = NULL; 231 return NULL; 232 } 233 234 /* 235 * Add a supported rates element id to a frame. 236 */ 237 u_int8_t * 238 ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs) 239 { 240 int nrates; 241 242 *frm++ = IEEE80211_ELEMID_RATES; 243 nrates = rs->rs_nrates; 244 if (nrates > IEEE80211_RATE_SIZE) 245 nrates = IEEE80211_RATE_SIZE; 246 *frm++ = nrates; 247 memcpy(frm, rs->rs_rates, nrates); 248 return frm + nrates; 249 } 250 251 /* 252 * Add an extended supported rates element id to a frame. 253 */ 254 u_int8_t * 255 ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs) 256 { 257 /* 258 * Add an extended supported rates element if operating in 11g mode. 259 */ 260 if (rs->rs_nrates > IEEE80211_RATE_SIZE) { 261 int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE; 262 *frm++ = IEEE80211_ELEMID_XRATES; 263 *frm++ = nrates; 264 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates); 265 frm += nrates; 266 } 267 return frm; 268 } 269 270 /* 271 * Add an ssid elemet to a frame. 272 */ 273 static u_int8_t * 274 ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len) 275 { 276 *frm++ = IEEE80211_ELEMID_SSID; 277 *frm++ = len; 278 memcpy(frm, ssid, len); 279 return frm + len; 280 } 281 282 static struct mbuf * 283 ieee80211_getmbuf(int flags, int type, u_int pktlen) 284 { 285 struct mbuf *m; 286 287 KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen)); 288 if (pktlen <= MHLEN) 289 MGETHDR(m, flags, type); 290 else 291 m = m_getcl(flags, type, M_PKTHDR); 292 return m; 293 } 294 295 /* 296 * Send a management frame. The node is for the destination (or ic_bss 297 * when in station mode). Nodes other than ic_bss have their reference 298 * count bumped to reflect our use for an indeterminant time. 299 */ 300 int 301 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni, 302 int type, int arg) 303 { 304 #define senderr(_x) do { ret = _x; goto bad; } while (0) 305 struct ifnet *ifp = &ic->ic_if; 306 struct mbuf *m; 307 u_int8_t *frm; 308 enum ieee80211_phymode mode; 309 u_int16_t capinfo; 310 int ret, timer; 311 312 KASSERT(ni != NULL, ("null node")); 313 314 /* 315 * Hold a reference on the node so it doesn't go away until after 316 * the xmit is complete all the way in the driver. On error we 317 * will remove our reference. 318 */ 319 if (ni != ic->ic_bss) 320 ieee80211_ref_node(ni); 321 timer = 0; 322 switch (type) { 323 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 324 /* 325 * prreq frame format 326 * [tlv] ssid 327 * [tlv] supported rates 328 * [tlv] extended supported rates 329 */ 330 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 331 2 + ic->ic_des_esslen 332 + 2 + IEEE80211_RATE_SIZE 333 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 334 if (m == NULL) 335 senderr(ENOMEM); 336 m->m_data += sizeof(struct ieee80211_frame); 337 frm = mtod(m, u_int8_t *); 338 frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen); 339 mode = ieee80211_chan2mode(ic, ni->ni_chan); 340 frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]); 341 frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]); 342 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 343 344 timer = IEEE80211_TRANS_WAIT; 345 break; 346 347 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 348 /* 349 * probe response frame format 350 * [8] time stamp 351 * [2] beacon interval 352 * [2] cabability information 353 * [tlv] ssid 354 * [tlv] supported rates 355 * [tlv] parameter set (IBSS) 356 * [tlv] extended supported rates 357 */ 358 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 359 8 + 2 + 2 + 2 360 + 2 + ni->ni_esslen 361 + 2 + IEEE80211_RATE_SIZE 362 + 6 363 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 364 if (m == NULL) 365 senderr(ENOMEM); 366 m->m_data += sizeof(struct ieee80211_frame); 367 frm = mtod(m, u_int8_t *); 368 369 memset(frm, 0, 8); /* timestamp should be filled later */ 370 frm += 8; 371 *(u_int16_t *)frm = htole16(ic->ic_bss->ni_intval); 372 frm += 2; 373 if (ic->ic_opmode == IEEE80211_M_IBSS) 374 capinfo = IEEE80211_CAPINFO_IBSS; 375 else 376 capinfo = IEEE80211_CAPINFO_ESS; 377 if (ic->ic_flags & IEEE80211_F_WEPON) 378 capinfo |= IEEE80211_CAPINFO_PRIVACY; 379 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 380 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 381 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 382 *(u_int16_t *)frm = htole16(capinfo); 383 frm += 2; 384 385 frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid, 386 ic->ic_bss->ni_esslen); 387 frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates); 388 389 if (ic->ic_opmode == IEEE80211_M_IBSS) { 390 *frm++ = IEEE80211_ELEMID_IBSSPARMS; 391 *frm++ = 2; 392 *frm++ = 0; *frm++ = 0; /* TODO: ATIM window */ 393 } else { /* IEEE80211_M_HOSTAP */ 394 /* TODO: TIM */ 395 *frm++ = IEEE80211_ELEMID_TIM; 396 *frm++ = 4; /* length */ 397 *frm++ = 0; /* DTIM count */ 398 *frm++ = 1; /* DTIM period */ 399 *frm++ = 0; /* bitmap control */ 400 *frm++ = 0; /* Partial Virtual Bitmap (variable length) */ 401 } 402 frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates); 403 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 404 break; 405 406 case IEEE80211_FC0_SUBTYPE_AUTH: 407 MGETHDR(m, M_DONTWAIT, MT_DATA); 408 if (m == NULL) 409 senderr(ENOMEM); 410 MH_ALIGN(m, 2 * 3); 411 m->m_pkthdr.len = m->m_len = 6; 412 frm = mtod(m, u_int8_t *); 413 /* TODO: shared key auth */ 414 ((u_int16_t *)frm)[0] = htole16(IEEE80211_AUTH_ALG_OPEN); 415 ((u_int16_t *)frm)[1] = htole16(arg); /* sequence number */ 416 ((u_int16_t *)frm)[2] = 0; /* status */ 417 if (ic->ic_opmode == IEEE80211_M_STA) 418 timer = IEEE80211_TRANS_WAIT; 419 break; 420 421 case IEEE80211_FC0_SUBTYPE_DEAUTH: 422 if (ifp->if_flags & IFF_DEBUG) 423 if_printf(ifp, "station %s deauthenticate (reason %d)\n", 424 ether_sprintf(ni->ni_macaddr), arg); 425 MGETHDR(m, M_DONTWAIT, MT_DATA); 426 if (m == NULL) 427 senderr(ENOMEM); 428 MH_ALIGN(m, 2); 429 m->m_pkthdr.len = m->m_len = 2; 430 *mtod(m, u_int16_t *) = htole16(arg); /* reason */ 431 break; 432 433 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ: 434 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: 435 /* 436 * asreq frame format 437 * [2] capability information 438 * [2] listen interval 439 * [6*] current AP address (reassoc only) 440 * [tlv] ssid 441 * [tlv] supported rates 442 * [tlv] extended supported rates 443 */ 444 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 445 sizeof(capinfo) 446 + sizeof(u_int16_t) 447 + IEEE80211_ADDR_LEN 448 + 2 + ni->ni_esslen 449 + 2 + IEEE80211_RATE_SIZE 450 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 451 if (m == NULL) 452 senderr(ENOMEM); 453 m->m_data += sizeof(struct ieee80211_frame); 454 frm = mtod(m, u_int8_t *); 455 456 capinfo = 0; 457 if (ic->ic_opmode == IEEE80211_M_IBSS) 458 capinfo |= IEEE80211_CAPINFO_IBSS; 459 else /* IEEE80211_M_STA */ 460 capinfo |= IEEE80211_CAPINFO_ESS; 461 if (ic->ic_flags & IEEE80211_F_WEPON) 462 capinfo |= IEEE80211_CAPINFO_PRIVACY; 463 /* 464 * NB: Some 11a AP's reject the request when 465 * short premable is set. 466 */ 467 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 468 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 469 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 470 if (ic->ic_flags & IEEE80211_F_SHSLOT) 471 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME; 472 *(u_int16_t *)frm = htole16(capinfo); 473 frm += 2; 474 475 *(u_int16_t *)frm = htole16(ic->ic_lintval); 476 frm += 2; 477 478 if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) { 479 IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid); 480 frm += IEEE80211_ADDR_LEN; 481 } 482 483 frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen); 484 frm = ieee80211_add_rates(frm, &ni->ni_rates); 485 frm = ieee80211_add_xrates(frm, &ni->ni_rates); 486 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 487 488 timer = IEEE80211_TRANS_WAIT; 489 break; 490 491 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 492 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: 493 /* 494 * asreq frame format 495 * [2] capability information 496 * [2] status 497 * [2] association ID 498 * [tlv] supported rates 499 * [tlv] extended supported rates 500 */ 501 m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA, 502 sizeof(capinfo) 503 + sizeof(u_int16_t) 504 + sizeof(u_int16_t) 505 + 2 + IEEE80211_RATE_SIZE 506 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)); 507 if (m == NULL) 508 senderr(ENOMEM); 509 m->m_data += sizeof(struct ieee80211_frame); 510 frm = mtod(m, u_int8_t *); 511 512 capinfo = IEEE80211_CAPINFO_ESS; 513 if (ic->ic_flags & IEEE80211_F_WEPON) 514 capinfo |= IEEE80211_CAPINFO_PRIVACY; 515 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) && 516 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan)) 517 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE; 518 *(u_int16_t *)frm = htole16(capinfo); 519 frm += 2; 520 521 *(u_int16_t *)frm = htole16(arg); /* status */ 522 frm += 2; 523 524 if (arg == IEEE80211_STATUS_SUCCESS) 525 *(u_int16_t *)frm = htole16(ni->ni_associd); 526 frm += 2; 527 528 frm = ieee80211_add_rates(frm, &ni->ni_rates); 529 frm = ieee80211_add_xrates(frm, &ni->ni_rates); 530 m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *); 531 break; 532 533 case IEEE80211_FC0_SUBTYPE_DISASSOC: 534 if (ifp->if_flags & IFF_DEBUG) 535 if_printf(ifp, "station %s disassociate (reason %d)\n", 536 ether_sprintf(ni->ni_macaddr), arg); 537 MGETHDR(m, M_DONTWAIT, MT_DATA); 538 if (m == NULL) 539 senderr(ENOMEM); 540 MH_ALIGN(m, 2); 541 m->m_pkthdr.len = m->m_len = 2; 542 *mtod(m, u_int16_t *) = htole16(arg); /* reason */ 543 break; 544 545 default: 546 IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n", 547 __func__, type)); 548 senderr(EINVAL); 549 /* NOTREACHED */ 550 } 551 552 ret = ieee80211_mgmt_output(ifp, ni, m, type); 553 if (ret == 0) { 554 if (timer) 555 ic->ic_mgt_timer = timer; 556 } else { 557 bad: 558 if (ni != ic->ic_bss) /* remove ref we added */ 559 ieee80211_free_node(ic, ni); 560 } 561 return ret; 562 #undef senderr 563 } 564