xref: /freebsd/sys/net80211/ieee80211_sta.c (revision e982e5c5610e41b669d89ce488d65e68f311159d)
1 /*-
2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  */
25 
26 #include <sys/cdefs.h>
27 #ifdef __FreeBSD__
28 __FBSDID("$FreeBSD$");
29 #endif
30 
31 /*
32  * IEEE 802.11 Station mode support.
33  */
34 #include "opt_inet.h"
35 #include "opt_wlan.h"
36 
37 #include <sys/param.h>
38 #include <sys/systm.h>
39 #include <sys/mbuf.h>
40 #include <sys/malloc.h>
41 #include <sys/kernel.h>
42 
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
47 #include <sys/proc.h>
48 #include <sys/sysctl.h>
49 
50 #include <net/if.h>
51 #include <net/if_media.h>
52 #include <net/if_llc.h>
53 #include <net/if_dl.h>
54 #include <net/if_var.h>
55 #include <net/ethernet.h>
56 
57 #include <net/bpf.h>
58 
59 #include <net80211/ieee80211_var.h>
60 #include <net80211/ieee80211_sta.h>
61 #include <net80211/ieee80211_input.h>
62 #ifdef IEEE80211_SUPPORT_SUPERG
63 #include <net80211/ieee80211_superg.h>
64 #endif
65 #include <net80211/ieee80211_ratectl.h>
66 #include <net80211/ieee80211_sta.h>
67 
68 #define	IEEE80211_RATE2MBS(r)	(((r) & IEEE80211_RATE_VAL) / 2)
69 
70 static	void sta_vattach(struct ieee80211vap *);
71 static	void sta_beacon_miss(struct ieee80211vap *);
72 static	int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
73 static	int sta_input(struct ieee80211_node *, struct mbuf *, int, int);
74 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
75 	    int subtype, int rssi, int nf);
76 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
77 
78 void
79 ieee80211_sta_attach(struct ieee80211com *ic)
80 {
81 	ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
82 }
83 
84 void
85 ieee80211_sta_detach(struct ieee80211com *ic)
86 {
87 }
88 
89 static void
90 sta_vdetach(struct ieee80211vap *vap)
91 {
92 }
93 
94 static void
95 sta_vattach(struct ieee80211vap *vap)
96 {
97 	vap->iv_newstate = sta_newstate;
98 	vap->iv_input = sta_input;
99 	vap->iv_recv_mgmt = sta_recv_mgmt;
100 	vap->iv_recv_ctl = sta_recv_ctl;
101 	vap->iv_opdetach = sta_vdetach;
102 	vap->iv_bmiss = sta_beacon_miss;
103 }
104 
105 /*
106  * Handle a beacon miss event.  The common code filters out
107  * spurious events that can happen when scanning and/or before
108  * reaching RUN state.
109  */
110 static void
111 sta_beacon_miss(struct ieee80211vap *vap)
112 {
113 	struct ieee80211com *ic = vap->iv_ic;
114 
115 	IEEE80211_LOCK_ASSERT(ic);
116 
117 	KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
118 	KASSERT(vap->iv_state >= IEEE80211_S_RUN,
119 	    ("wrong state %s", ieee80211_state_name[vap->iv_state]));
120 
121 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
122 	    "beacon miss, mode %s state %s\n",
123 	    ieee80211_opmode_name[vap->iv_opmode],
124 	    ieee80211_state_name[vap->iv_state]);
125 
126 	if (vap->iv_state == IEEE80211_S_CSA) {
127 		/*
128 		 * A Channel Switch is pending; assume we missed the
129 		 * beacon that would've completed the process and just
130 		 * force the switch.  If we made a mistake we'll not
131 		 * find the AP on the new channel and fall back to a
132 		 * normal scan.
133 		 */
134 		ieee80211_csa_completeswitch(ic);
135 		return;
136 	}
137 	if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
138 		/*
139 		 * Send a directed probe req before falling back to a
140 		 * scan; if we receive a response ic_bmiss_count will
141 		 * be reset.  Some cards mistakenly report beacon miss
142 		 * so this avoids the expensive scan if the ap is
143 		 * still there.
144 		 */
145 		ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
146 			vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
147 			vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
148 		return;
149 	}
150 
151 	callout_stop(&vap->iv_swbmiss);
152 	vap->iv_bmiss_count = 0;
153 	vap->iv_stats.is_beacon_miss++;
154 	if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
155 #ifdef IEEE80211_SUPPORT_SUPERG
156 		struct ieee80211com *ic = vap->iv_ic;
157 
158 		/*
159 		 * If we receive a beacon miss interrupt when using
160 		 * dynamic turbo, attempt to switch modes before
161 		 * reassociating.
162 		 */
163 		if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
164 			ieee80211_dturbo_switch(vap,
165 			    ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
166 #endif
167 		/*
168 		 * Try to reassociate before scanning for a new ap.
169 		 */
170 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
171 	} else {
172 		/*
173 		 * Somebody else is controlling state changes (e.g.
174 		 * a user-mode app) don't do anything that would
175 		 * confuse them; just drop into scan mode so they'll
176 		 * notified of the state change and given control.
177 		 */
178 		ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
179 	}
180 }
181 
182 /*
183  * Handle deauth with reason.  We retry only for
184  * the cases where we might succeed.  Otherwise
185  * we downgrade the ap and scan.
186  */
187 static void
188 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
189 {
190 	switch (reason) {
191 	case IEEE80211_STATUS_SUCCESS:		/* NB: MLME assoc */
192 	case IEEE80211_STATUS_TIMEOUT:
193 	case IEEE80211_REASON_ASSOC_EXPIRE:
194 	case IEEE80211_REASON_NOT_AUTHED:
195 	case IEEE80211_REASON_NOT_ASSOCED:
196 	case IEEE80211_REASON_ASSOC_LEAVE:
197 	case IEEE80211_REASON_ASSOC_NOT_AUTHED:
198 		IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
199 		break;
200 	default:
201 		ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
202 		if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
203 			ieee80211_check_scan_current(vap);
204 		break;
205 	}
206 }
207 
208 /*
209  * IEEE80211_M_STA vap state machine handler.
210  * This routine handles the main states in the 802.11 protocol.
211  */
212 static int
213 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
214 {
215 	struct ieee80211com *ic = vap->iv_ic;
216 	struct ieee80211_node *ni;
217 	enum ieee80211_state ostate;
218 
219 	IEEE80211_LOCK_ASSERT(ic);
220 
221 	ostate = vap->iv_state;
222 	IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
223 	    __func__, ieee80211_state_name[ostate],
224 	    ieee80211_state_name[nstate], arg);
225 	vap->iv_state = nstate;			/* state transition */
226 	callout_stop(&vap->iv_mgtsend);		/* XXX callout_drain */
227 	if (ostate != IEEE80211_S_SCAN)
228 		ieee80211_cancel_scan(vap);	/* background scan */
229 	ni = vap->iv_bss;			/* NB: no reference held */
230 	if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
231 		callout_stop(&vap->iv_swbmiss);
232 	switch (nstate) {
233 	case IEEE80211_S_INIT:
234 		switch (ostate) {
235 		case IEEE80211_S_SLEEP:
236 			/* XXX wakeup */
237 			/* XXX driver hook to wakeup the hardware? */
238 		case IEEE80211_S_RUN:
239 			IEEE80211_SEND_MGMT(ni,
240 			    IEEE80211_FC0_SUBTYPE_DISASSOC,
241 			    IEEE80211_REASON_ASSOC_LEAVE);
242 			ieee80211_sta_leave(ni);
243 			break;
244 		case IEEE80211_S_ASSOC:
245 			IEEE80211_SEND_MGMT(ni,
246 			    IEEE80211_FC0_SUBTYPE_DEAUTH,
247 			    IEEE80211_REASON_AUTH_LEAVE);
248 			break;
249 		case IEEE80211_S_SCAN:
250 			ieee80211_cancel_scan(vap);
251 			break;
252 		default:
253 			goto invalid;
254 		}
255 		if (ostate != IEEE80211_S_INIT) {
256 			/* NB: optimize INIT -> INIT case */
257 			ieee80211_reset_bss(vap);
258 		}
259 		if (vap->iv_auth->ia_detach != NULL)
260 			vap->iv_auth->ia_detach(vap);
261 		break;
262 	case IEEE80211_S_SCAN:
263 		switch (ostate) {
264 		case IEEE80211_S_INIT:
265 			/*
266 			 * Initiate a scan.  We can come here as a result
267 			 * of an IEEE80211_IOC_SCAN_REQ too in which case
268 			 * the vap will be marked with IEEE80211_FEXT_SCANREQ
269 			 * and the scan request parameters will be present
270 			 * in iv_scanreq.  Otherwise we do the default.
271 			 */
272 			if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
273 				ieee80211_check_scan(vap,
274 				    vap->iv_scanreq_flags,
275 				    vap->iv_scanreq_duration,
276 				    vap->iv_scanreq_mindwell,
277 				    vap->iv_scanreq_maxdwell,
278 				    vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
279 				vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
280 			} else
281 				ieee80211_check_scan_current(vap);
282 			break;
283 		case IEEE80211_S_SCAN:
284 		case IEEE80211_S_AUTH:
285 		case IEEE80211_S_ASSOC:
286 			/*
287 			 * These can happen either because of a timeout
288 			 * on an assoc/auth response or because of a
289 			 * change in state that requires a reset.  For
290 			 * the former we're called with a non-zero arg
291 			 * that is the cause for the failure; pass this
292 			 * to the scan code so it can update state.
293 			 * Otherwise trigger a new scan unless we're in
294 			 * manual roaming mode in which case an application
295 			 * must issue an explicit scan request.
296 			 */
297 			if (arg != 0)
298 				ieee80211_scan_assoc_fail(vap,
299 					vap->iv_bss->ni_macaddr, arg);
300 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
301 				ieee80211_check_scan_current(vap);
302 			break;
303 		case IEEE80211_S_SLEEP:		/* beacon miss */
304 			/*
305 			 * XXX if in sleep we need to wakeup the hardware.
306 			 */
307 			/* FALLTHROUGH */
308 		case IEEE80211_S_RUN:		/* beacon miss */
309 			/*
310 			 * Beacon miss.  Notify user space and if not
311 			 * under control of a user application (roaming
312 			 * manual) kick off a scan to re-connect.
313 			 */
314 
315 			ieee80211_sta_leave(ni);
316 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
317 				ieee80211_check_scan_current(vap);
318 			break;
319 		default:
320 			goto invalid;
321 		}
322 		break;
323 	case IEEE80211_S_AUTH:
324 		switch (ostate) {
325 		case IEEE80211_S_INIT:
326 		case IEEE80211_S_SCAN:
327 			IEEE80211_SEND_MGMT(ni,
328 			    IEEE80211_FC0_SUBTYPE_AUTH, 1);
329 			break;
330 		case IEEE80211_S_AUTH:
331 		case IEEE80211_S_ASSOC:
332 			switch (arg & 0xff) {
333 			case IEEE80211_FC0_SUBTYPE_AUTH:
334 				/* ??? */
335 				IEEE80211_SEND_MGMT(ni,
336 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
337 				break;
338 			case IEEE80211_FC0_SUBTYPE_DEAUTH:
339 				sta_authretry(vap, ni, arg>>8);
340 				break;
341 			}
342 			break;
343 		case IEEE80211_S_RUN:
344 			switch (arg & 0xff) {
345 			case IEEE80211_FC0_SUBTYPE_AUTH:
346 				IEEE80211_SEND_MGMT(ni,
347 				    IEEE80211_FC0_SUBTYPE_AUTH, 2);
348 				vap->iv_state = ostate;	/* stay RUN */
349 				break;
350 			case IEEE80211_FC0_SUBTYPE_DEAUTH:
351 				ieee80211_sta_leave(ni);
352 				if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
353 					/* try to reauth */
354 					IEEE80211_SEND_MGMT(ni,
355 					    IEEE80211_FC0_SUBTYPE_AUTH, 1);
356 				}
357 				break;
358 			}
359 			break;
360 		default:
361 			goto invalid;
362 		}
363 		break;
364 	case IEEE80211_S_ASSOC:
365 		switch (ostate) {
366 		case IEEE80211_S_AUTH:
367 		case IEEE80211_S_ASSOC:
368 			IEEE80211_SEND_MGMT(ni,
369 			    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
370 			break;
371 		case IEEE80211_S_SLEEP:		/* cannot happen */
372 		case IEEE80211_S_RUN:
373 			ieee80211_sta_leave(ni);
374 			if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
375 				IEEE80211_SEND_MGMT(ni, arg ?
376 				    IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
377 				    IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
378 			}
379 			break;
380 		default:
381 			goto invalid;
382 		}
383 		break;
384 	case IEEE80211_S_RUN:
385 		if (vap->iv_flags & IEEE80211_F_WPA) {
386 			/* XXX validate prerequisites */
387 		}
388 		switch (ostate) {
389 		case IEEE80211_S_RUN:
390 		case IEEE80211_S_CSA:
391 			break;
392 		case IEEE80211_S_AUTH:		/* when join is done in fw */
393 		case IEEE80211_S_ASSOC:
394 #ifdef IEEE80211_DEBUG
395 			if (ieee80211_msg_debug(vap)) {
396 				ieee80211_note(vap, "%s with %s ssid ",
397 				    (vap->iv_opmode == IEEE80211_M_STA ?
398 				    "associated" : "synchronized"),
399 				    ether_sprintf(ni->ni_bssid));
400 				ieee80211_print_essid(vap->iv_bss->ni_essid,
401 				    ni->ni_esslen);
402 				/* XXX MCS/HT */
403 				printf(" channel %d start %uMb\n",
404 				    ieee80211_chan2ieee(ic, ic->ic_curchan),
405 				    IEEE80211_RATE2MBS(ni->ni_txrate));
406 			}
407 #endif
408 			ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
409 			ieee80211_notify_node_join(ni,
410 			    arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
411 			break;
412 		case IEEE80211_S_SLEEP:
413 			/* Wake up from sleep */
414 			vap->iv_sta_ps(vap, 0);
415 			break;
416 		default:
417 			goto invalid;
418 		}
419 		ieee80211_sync_curchan(ic);
420 		if (ostate != IEEE80211_S_RUN &&
421 		    (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)) {
422 			/*
423 			 * Start s/w beacon miss timer for devices w/o
424 			 * hardware support.  We fudge a bit here since
425 			 * we're doing this in software.
426 			 */
427 			vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
428 				2 * vap->iv_bmissthreshold * ni->ni_intval);
429 			vap->iv_swbmiss_count = 0;
430 			callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
431 				ieee80211_swbmiss, vap);
432 		}
433 		/*
434 		 * When 802.1x is not in use mark the port authorized
435 		 * at this point so traffic can flow.
436 		 */
437 		if (ni->ni_authmode != IEEE80211_AUTH_8021X)
438 			ieee80211_node_authorize(ni);
439 		/*
440 		 * Fake association when joining an existing bss.
441 		 *
442 		 * Don't do this if we're doing SLEEP->RUN.
443 		 */
444 		if (ic->ic_newassoc != NULL && ostate != IEEE80211_S_SLEEP)
445 			ic->ic_newassoc(vap->iv_bss, (ostate != IEEE80211_S_RUN));
446 		break;
447 	case IEEE80211_S_CSA:
448 		if (ostate != IEEE80211_S_RUN)
449 			goto invalid;
450 		break;
451 	case IEEE80211_S_SLEEP:
452 		vap->iv_sta_ps(vap, 1);
453 		break;
454 	default:
455 	invalid:
456 		IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
457 		    "%s: unexpected state transition %s -> %s\n", __func__,
458 		    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
459 		break;
460 	}
461 	return 0;
462 }
463 
464 /*
465  * Return non-zero if the frame is an echo of a multicast
466  * frame sent by ourself.  The dir is known to be DSTODS.
467  */
468 static __inline int
469 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
470 {
471 #define	QWH4(wh)	((const struct ieee80211_qosframe_addr4 *)wh)
472 #define	WH4(wh)		((const struct ieee80211_frame_addr4 *)wh)
473 	const uint8_t *sa;
474 
475 	KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
476 
477 	if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
478 		return 0;
479 	sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
480 	return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
481 #undef WH4
482 #undef QWH4
483 }
484 
485 /*
486  * Return non-zero if the frame is an echo of a multicast
487  * frame sent by ourself.  The dir is known to be FROMDS.
488  */
489 static __inline int
490 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
491 {
492 	KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
493 
494 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
495 		return 0;
496 	return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
497 }
498 
499 /*
500  * Decide if a received management frame should be
501  * printed when debugging is enabled.  This filters some
502  * of the less interesting frames that come frequently
503  * (e.g. beacons).
504  */
505 static __inline int
506 doprint(struct ieee80211vap *vap, int subtype)
507 {
508 	switch (subtype) {
509 	case IEEE80211_FC0_SUBTYPE_BEACON:
510 		return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
511 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
512 		return 0;
513 	}
514 	return 1;
515 }
516 
517 /*
518  * Process a received frame.  The node associated with the sender
519  * should be supplied.  If nothing was found in the node table then
520  * the caller is assumed to supply a reference to iv_bss instead.
521  * The RSSI and a timestamp are also supplied.  The RSSI data is used
522  * during AP scanning to select a AP to associate with; it can have
523  * any units so long as values have consistent units and higher values
524  * mean ``better signal''.  The receive timestamp is currently not used
525  * by the 802.11 layer.
526  */
527 static int
528 sta_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
529 {
530 #define	HAS_SEQ(type)	((type & 0x4) == 0)
531 	struct ieee80211vap *vap = ni->ni_vap;
532 	struct ieee80211com *ic = ni->ni_ic;
533 	struct ifnet *ifp = vap->iv_ifp;
534 	struct ieee80211_frame *wh;
535 	struct ieee80211_key *key;
536 	struct ether_header *eh;
537 	int hdrspace, need_tap = 1;	/* mbuf need to be tapped. */
538 	uint8_t dir, type, subtype, qos;
539 	uint8_t *bssid;
540 	uint16_t rxseq;
541 
542 	if (m->m_flags & M_AMPDU_MPDU) {
543 		/*
544 		 * Fastpath for A-MPDU reorder q resubmission.  Frames
545 		 * w/ M_AMPDU_MPDU marked have already passed through
546 		 * here but were received out of order and been held on
547 		 * the reorder queue.  When resubmitted they are marked
548 		 * with the M_AMPDU_MPDU flag and we can bypass most of
549 		 * the normal processing.
550 		 */
551 		wh = mtod(m, struct ieee80211_frame *);
552 		type = IEEE80211_FC0_TYPE_DATA;
553 		dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
554 		subtype = IEEE80211_FC0_SUBTYPE_QOS;
555 		hdrspace = ieee80211_hdrspace(ic, wh);	/* XXX optimize? */
556 		goto resubmit_ampdu;
557 	}
558 
559 	KASSERT(ni != NULL, ("null node"));
560 	ni->ni_inact = ni->ni_inact_reload;
561 
562 	type = -1;			/* undefined */
563 
564 	if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
565 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
566 		    ni->ni_macaddr, NULL,
567 		    "too short (1): len %u", m->m_pkthdr.len);
568 		vap->iv_stats.is_rx_tooshort++;
569 		goto out;
570 	}
571 	/*
572 	 * Bit of a cheat here, we use a pointer for a 3-address
573 	 * frame format but don't reference fields past outside
574 	 * ieee80211_frame_min w/o first validating the data is
575 	 * present.
576 	 */
577 	wh = mtod(m, struct ieee80211_frame *);
578 
579 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
580 	    IEEE80211_FC0_VERSION_0) {
581 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
582 		    ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
583 		    wh->i_fc[0], wh->i_fc[1]);
584 		vap->iv_stats.is_rx_badversion++;
585 		goto err;
586 	}
587 
588 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
589 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
590 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
591 	if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
592 		bssid = wh->i_addr2;
593 		if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
594 			/* not interested in */
595 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
596 			    bssid, NULL, "%s", "not to bss");
597 			vap->iv_stats.is_rx_wrongbss++;
598 			goto out;
599 		}
600 
601 		/*
602 		 * Some devices may be in a promiscuous mode
603 		 * where they receive frames for multiple station
604 		 * addresses.
605 		 *
606 		 * If we receive a data frame that isn't
607 		 * destined to our VAP MAC, drop it.
608 		 *
609 		 * XXX TODO: This is only enforced when not scanning;
610 		 * XXX it assumes a software-driven scan will put the NIC
611 		 * XXX into a "no data frames" mode before setting this
612 		 * XXX flag. Otherwise it may be possible that we'll still
613 		 * XXX process data frames whilst scanning.
614 		 */
615 		if ((! IEEE80211_IS_MULTICAST(wh->i_addr1))
616 		    && (! IEEE80211_ADDR_EQ(wh->i_addr1, IF_LLADDR(ifp)))) {
617 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
618 			    bssid, NULL, "not to cur sta: lladdr=%6D, addr1=%6D",
619 			    IF_LLADDR(ifp), ":", wh->i_addr1, ":");
620 			vap->iv_stats.is_rx_wrongbss++;
621 			goto out;
622 		}
623 
624 		IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
625 		ni->ni_noise = nf;
626 		if (HAS_SEQ(type) && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
627 			uint8_t tid = ieee80211_gettid(wh);
628 			if (IEEE80211_QOS_HAS_SEQ(wh) &&
629 			    TID_TO_WME_AC(tid) >= WME_AC_VI)
630 				ic->ic_wme.wme_hipri_traffic++;
631 			rxseq = le16toh(*(uint16_t *)wh->i_seq);
632 			if (! ieee80211_check_rxseq(ni, wh)) {
633 				/* duplicate, discard */
634 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
635 				    bssid, "duplicate",
636 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
637 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
638 				    ni->ni_rxseqs[tid] >>
639 					IEEE80211_SEQ_SEQ_SHIFT,
640 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
641 				    ni->ni_rxseqs[tid] &
642 					IEEE80211_SEQ_FRAG_MASK,
643 				    tid);
644 				vap->iv_stats.is_rx_dup++;
645 				IEEE80211_NODE_STAT(ni, rx_dup);
646 				goto out;
647 			}
648 			ni->ni_rxseqs[tid] = rxseq;
649 		}
650 	}
651 
652 	switch (type) {
653 	case IEEE80211_FC0_TYPE_DATA:
654 		hdrspace = ieee80211_hdrspace(ic, wh);
655 		if (m->m_len < hdrspace &&
656 		    (m = m_pullup(m, hdrspace)) == NULL) {
657 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
658 			    ni->ni_macaddr, NULL,
659 			    "data too short: expecting %u", hdrspace);
660 			vap->iv_stats.is_rx_tooshort++;
661 			goto out;		/* XXX */
662 		}
663 		/*
664 		 * Handle A-MPDU re-ordering.  If the frame is to be
665 		 * processed directly then ieee80211_ampdu_reorder
666 		 * will return 0; otherwise it has consumed the mbuf
667 		 * and we should do nothing more with it.
668 		 */
669 		if ((m->m_flags & M_AMPDU) &&
670 		    (dir == IEEE80211_FC1_DIR_FROMDS ||
671 		     dir == IEEE80211_FC1_DIR_DSTODS) &&
672 		    ieee80211_ampdu_reorder(ni, m) != 0) {
673 			m = NULL;
674 			goto out;
675 		}
676 	resubmit_ampdu:
677 		if (dir == IEEE80211_FC1_DIR_FROMDS) {
678 			if ((ifp->if_flags & IFF_SIMPLEX) &&
679 			    isfromds_mcastecho(vap, wh)) {
680 				/*
681 				 * In IEEE802.11 network, multicast
682 				 * packets sent from "me" are broadcast
683 				 * from the AP; silently discard for
684 				 * SIMPLEX interface.
685 				 */
686 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
687 				    wh, "data", "%s", "multicast echo");
688 				vap->iv_stats.is_rx_mcastecho++;
689 				goto out;
690 			}
691 			if ((vap->iv_flags & IEEE80211_F_DWDS) &&
692 			    IEEE80211_IS_MULTICAST(wh->i_addr1)) {
693 				/*
694 				 * DWDS sta's must drop 3-address mcast frames
695 				 * as they will be sent separately as a 4-addr
696 				 * frame.  Accepting the 3-addr frame will
697 				 * confuse the bridge into thinking the sending
698 				 * sta is located at the end of WDS link.
699 				 */
700 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
701 				    "3-address data", "%s", "DWDS enabled");
702 				vap->iv_stats.is_rx_mcastecho++;
703 				goto out;
704 			}
705 		} else if (dir == IEEE80211_FC1_DIR_DSTODS) {
706 			if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
707 				IEEE80211_DISCARD(vap,
708 				    IEEE80211_MSG_INPUT, wh, "4-address data",
709 				    "%s", "DWDS not enabled");
710 				vap->iv_stats.is_rx_wrongdir++;
711 				goto out;
712 			}
713 			if ((ifp->if_flags & IFF_SIMPLEX) &&
714 			    isdstods_mcastecho(vap, wh)) {
715 				/*
716 				 * In IEEE802.11 network, multicast
717 				 * packets sent from "me" are broadcast
718 				 * from the AP; silently discard for
719 				 * SIMPLEX interface.
720 				 */
721 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
722 				    "4-address data", "%s", "multicast echo");
723 				vap->iv_stats.is_rx_mcastecho++;
724 				goto out;
725 			}
726 		} else {
727 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
728 			    "data", "incorrect dir 0x%x", dir);
729 			vap->iv_stats.is_rx_wrongdir++;
730 			goto out;
731 		}
732 
733 		/*
734 		 * Handle privacy requirements.  Note that we
735 		 * must not be preempted from here until after
736 		 * we (potentially) call ieee80211_crypto_demic;
737 		 * otherwise we may violate assumptions in the
738 		 * crypto cipher modules used to do delayed update
739 		 * of replay sequence numbers.
740 		 */
741 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
742 			if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
743 				/*
744 				 * Discard encrypted frames when privacy is off.
745 				 */
746 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
747 				    wh, "WEP", "%s", "PRIVACY off");
748 				vap->iv_stats.is_rx_noprivacy++;
749 				IEEE80211_NODE_STAT(ni, rx_noprivacy);
750 				goto out;
751 			}
752 			key = ieee80211_crypto_decap(ni, m, hdrspace);
753 			if (key == NULL) {
754 				/* NB: stats+msgs handled in crypto_decap */
755 				IEEE80211_NODE_STAT(ni, rx_wepfail);
756 				goto out;
757 			}
758 			wh = mtod(m, struct ieee80211_frame *);
759 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
760 		} else {
761 			/* XXX M_WEP and IEEE80211_F_PRIVACY */
762 			key = NULL;
763 		}
764 
765 		/*
766 		 * Save QoS bits for use below--before we strip the header.
767 		 */
768 		if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
769 			qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
770 			    ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
771 			    ((struct ieee80211_qosframe *)wh)->i_qos[0];
772 		} else
773 			qos = 0;
774 
775 		/*
776 		 * Next up, any fragmentation.
777 		 */
778 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
779 			m = ieee80211_defrag(ni, m, hdrspace);
780 			if (m == NULL) {
781 				/* Fragment dropped or frame not complete yet */
782 				goto out;
783 			}
784 		}
785 		wh = NULL;		/* no longer valid, catch any uses */
786 
787 		/*
788 		 * Next strip any MSDU crypto bits.
789 		 */
790 		if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
791 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
792 			    ni->ni_macaddr, "data", "%s", "demic error");
793 			vap->iv_stats.is_rx_demicfail++;
794 			IEEE80211_NODE_STAT(ni, rx_demicfail);
795 			goto out;
796 		}
797 
798 		/* copy to listener after decrypt */
799 		if (ieee80211_radiotap_active_vap(vap))
800 			ieee80211_radiotap_rx(vap, m);
801 		need_tap = 0;
802 
803 		/*
804 		 * Finally, strip the 802.11 header.
805 		 */
806 		m = ieee80211_decap(vap, m, hdrspace);
807 		if (m == NULL) {
808 			/* XXX mask bit to check for both */
809 			/* don't count Null data frames as errors */
810 			if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
811 			    subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
812 				goto out;
813 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
814 			    ni->ni_macaddr, "data", "%s", "decap error");
815 			vap->iv_stats.is_rx_decap++;
816 			IEEE80211_NODE_STAT(ni, rx_decap);
817 			goto err;
818 		}
819 		eh = mtod(m, struct ether_header *);
820 		if (!ieee80211_node_is_authorized(ni)) {
821 			/*
822 			 * Deny any non-PAE frames received prior to
823 			 * authorization.  For open/shared-key
824 			 * authentication the port is mark authorized
825 			 * after authentication completes.  For 802.1x
826 			 * the port is not marked authorized by the
827 			 * authenticator until the handshake has completed.
828 			 */
829 			if (eh->ether_type != htons(ETHERTYPE_PAE)) {
830 				IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
831 				    eh->ether_shost, "data",
832 				    "unauthorized port: ether type 0x%x len %u",
833 				    eh->ether_type, m->m_pkthdr.len);
834 				vap->iv_stats.is_rx_unauth++;
835 				IEEE80211_NODE_STAT(ni, rx_unauth);
836 				goto err;
837 			}
838 		} else {
839 			/*
840 			 * When denying unencrypted frames, discard
841 			 * any non-PAE frames received without encryption.
842 			 */
843 			if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
844 			    (key == NULL && (m->m_flags & M_WEP) == 0) &&
845 			    eh->ether_type != htons(ETHERTYPE_PAE)) {
846 				/*
847 				 * Drop unencrypted frames.
848 				 */
849 				vap->iv_stats.is_rx_unencrypted++;
850 				IEEE80211_NODE_STAT(ni, rx_unencrypted);
851 				goto out;
852 			}
853 		}
854 		/* XXX require HT? */
855 		if (qos & IEEE80211_QOS_AMSDU) {
856 			m = ieee80211_decap_amsdu(ni, m);
857 			if (m == NULL)
858 				return IEEE80211_FC0_TYPE_DATA;
859 		} else {
860 #ifdef IEEE80211_SUPPORT_SUPERG
861 			m = ieee80211_decap_fastframe(vap, ni, m);
862 			if (m == NULL)
863 				return IEEE80211_FC0_TYPE_DATA;
864 #endif
865 		}
866 		ieee80211_deliver_data(vap, ni, m);
867 		return IEEE80211_FC0_TYPE_DATA;
868 
869 	case IEEE80211_FC0_TYPE_MGT:
870 		vap->iv_stats.is_rx_mgmt++;
871 		IEEE80211_NODE_STAT(ni, rx_mgmt);
872 		if (dir != IEEE80211_FC1_DIR_NODS) {
873 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
874 			    wh, "data", "incorrect dir 0x%x", dir);
875 			vap->iv_stats.is_rx_wrongdir++;
876 			goto err;
877 		}
878 		if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
879 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
880 			    ni->ni_macaddr, "mgt", "too short: len %u",
881 			    m->m_pkthdr.len);
882 			vap->iv_stats.is_rx_tooshort++;
883 			goto out;
884 		}
885 #ifdef IEEE80211_DEBUG
886 		if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
887 		    ieee80211_msg_dumppkts(vap)) {
888 			if_printf(ifp, "received %s from %s rssi %d\n",
889 			    ieee80211_mgt_subtype_name[subtype >>
890 				IEEE80211_FC0_SUBTYPE_SHIFT],
891 			    ether_sprintf(wh->i_addr2), rssi);
892 		}
893 #endif
894 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
895 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
896 				/*
897 				 * Only shared key auth frames with a challenge
898 				 * should be encrypted, discard all others.
899 				 */
900 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
901 				    wh, ieee80211_mgt_subtype_name[subtype >>
902 					IEEE80211_FC0_SUBTYPE_SHIFT],
903 				    "%s", "WEP set but not permitted");
904 				vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
905 				goto out;
906 			}
907 			if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
908 				/*
909 				 * Discard encrypted frames when privacy is off.
910 				 */
911 				IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
912 				    wh, "mgt", "%s", "WEP set but PRIVACY off");
913 				vap->iv_stats.is_rx_noprivacy++;
914 				goto out;
915 			}
916 			hdrspace = ieee80211_hdrspace(ic, wh);
917 			key = ieee80211_crypto_decap(ni, m, hdrspace);
918 			if (key == NULL) {
919 				/* NB: stats+msgs handled in crypto_decap */
920 				goto out;
921 			}
922 			wh = mtod(m, struct ieee80211_frame *);
923 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
924 		}
925 		vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
926 		goto out;
927 
928 	case IEEE80211_FC0_TYPE_CTL:
929 		vap->iv_stats.is_rx_ctl++;
930 		IEEE80211_NODE_STAT(ni, rx_ctrl);
931 		vap->iv_recv_ctl(ni, m, subtype);
932 		goto out;
933 
934 	default:
935 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
936 		    wh, NULL, "bad frame type 0x%x", type);
937 		/* should not come here */
938 		break;
939 	}
940 err:
941 	if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
942 out:
943 	if (m != NULL) {
944 		if (need_tap && ieee80211_radiotap_active_vap(vap))
945 			ieee80211_radiotap_rx(vap, m);
946 		m_freem(m);
947 	}
948 	return type;
949 }
950 
951 static void
952 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
953     int rssi, int nf, uint16_t seq, uint16_t status)
954 {
955 	struct ieee80211vap *vap = ni->ni_vap;
956 
957 	if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
958 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
959 		    ni->ni_macaddr, "open auth",
960 		    "bad sta auth mode %u", ni->ni_authmode);
961 		vap->iv_stats.is_rx_bad_auth++;	/* XXX */
962 		return;
963 	}
964 	if (vap->iv_state != IEEE80211_S_AUTH ||
965 	    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
966 		vap->iv_stats.is_rx_bad_auth++;
967 		return;
968 	}
969 	if (status != 0) {
970 		IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
971 		    ni, "open auth failed (reason %d)", status);
972 		vap->iv_stats.is_rx_auth_fail++;
973 		vap->iv_stats.is_rx_authfail_code = status;
974 		ieee80211_new_state(vap, IEEE80211_S_SCAN,
975 		    IEEE80211_SCAN_FAIL_STATUS);
976 	} else
977 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
978 }
979 
980 static void
981 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
982     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
983     uint16_t seq, uint16_t status)
984 {
985 	struct ieee80211vap *vap = ni->ni_vap;
986 	uint8_t *challenge;
987 	int estatus;
988 
989 	/*
990 	 * NB: this can happen as we allow pre-shared key
991 	 * authentication to be enabled w/o wep being turned
992 	 * on so that configuration of these can be done
993 	 * in any order.  It may be better to enforce the
994 	 * ordering in which case this check would just be
995 	 * for sanity/consistency.
996 	 */
997 	if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
998 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
999 		    ni->ni_macaddr, "shared key auth",
1000 		    "%s", " PRIVACY is disabled");
1001 		estatus = IEEE80211_STATUS_ALG;
1002 		goto bad;
1003 	}
1004 	/*
1005 	 * Pre-shared key authentication is evil; accept
1006 	 * it only if explicitly configured (it is supported
1007 	 * mainly for compatibility with clients like OS X).
1008 	 */
1009 	if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1010 	    ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1011 		IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1012 		    ni->ni_macaddr, "shared key auth",
1013 		    "bad sta auth mode %u", ni->ni_authmode);
1014 		vap->iv_stats.is_rx_bad_auth++;	/* XXX maybe a unique error? */
1015 		estatus = IEEE80211_STATUS_ALG;
1016 		goto bad;
1017 	}
1018 
1019 	challenge = NULL;
1020 	if (frm + 1 < efrm) {
1021 		if ((frm[1] + 2) > (efrm - frm)) {
1022 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1023 			    ni->ni_macaddr, "shared key auth",
1024 			    "ie %d/%d too long",
1025 			    frm[0], (frm[1] + 2) - (efrm - frm));
1026 			vap->iv_stats.is_rx_bad_auth++;
1027 			estatus = IEEE80211_STATUS_CHALLENGE;
1028 			goto bad;
1029 		}
1030 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
1031 			challenge = frm;
1032 		frm += frm[1] + 2;
1033 	}
1034 	switch (seq) {
1035 	case IEEE80211_AUTH_SHARED_CHALLENGE:
1036 	case IEEE80211_AUTH_SHARED_RESPONSE:
1037 		if (challenge == NULL) {
1038 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1039 			    ni->ni_macaddr, "shared key auth",
1040 			    "%s", "no challenge");
1041 			vap->iv_stats.is_rx_bad_auth++;
1042 			estatus = IEEE80211_STATUS_CHALLENGE;
1043 			goto bad;
1044 		}
1045 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1046 			IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1047 			    ni->ni_macaddr, "shared key auth",
1048 			    "bad challenge len %d", challenge[1]);
1049 			vap->iv_stats.is_rx_bad_auth++;
1050 			estatus = IEEE80211_STATUS_CHALLENGE;
1051 			goto bad;
1052 		}
1053 	default:
1054 		break;
1055 	}
1056 	if (vap->iv_state != IEEE80211_S_AUTH)
1057 		return;
1058 	switch (seq) {
1059 	case IEEE80211_AUTH_SHARED_PASS:
1060 		if (ni->ni_challenge != NULL) {
1061 			free(ni->ni_challenge, M_80211_NODE);
1062 			ni->ni_challenge = NULL;
1063 		}
1064 		if (status != 0) {
1065 			IEEE80211_NOTE_FRAME(vap,
1066 			    IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
1067 			    "shared key auth failed (reason %d)", status);
1068 			vap->iv_stats.is_rx_auth_fail++;
1069 			vap->iv_stats.is_rx_authfail_code = status;
1070 			return;
1071 		}
1072 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1073 		break;
1074 	case IEEE80211_AUTH_SHARED_CHALLENGE:
1075 		if (!ieee80211_alloc_challenge(ni))
1076 			return;
1077 		/* XXX could optimize by passing recvd challenge */
1078 		memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1079 		IEEE80211_SEND_MGMT(ni,
1080 			IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1081 		break;
1082 	default:
1083 		IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1084 		    wh, "shared key auth", "bad seq %d", seq);
1085 		vap->iv_stats.is_rx_bad_auth++;
1086 		return;
1087 	}
1088 	return;
1089 bad:
1090 	/*
1091 	 * Kick the state machine.  This short-circuits
1092 	 * using the mgt frame timeout to trigger the
1093 	 * state transition.
1094 	 */
1095 	if (vap->iv_state == IEEE80211_S_AUTH)
1096 		ieee80211_new_state(vap, IEEE80211_S_SCAN,
1097 		    IEEE80211_SCAN_FAIL_STATUS);
1098 }
1099 
1100 int
1101 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
1102 	const struct ieee80211_frame *wh)
1103 {
1104 #define	MS(_v, _f)	(((_v) & _f) >> _f##_S)
1105 	struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
1106 	u_int len = frm[1], qosinfo;
1107 	int i;
1108 
1109 	if (len < sizeof(struct ieee80211_wme_param)-2) {
1110 		IEEE80211_DISCARD_IE(vap,
1111 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1112 		    wh, "WME", "too short, len %u", len);
1113 		return -1;
1114 	}
1115 	qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1116 	qosinfo &= WME_QOSINFO_COUNT;
1117 	/* XXX do proper check for wraparound */
1118 	if (qosinfo == wme->wme_wmeChanParams.cap_info)
1119 		return 0;
1120 	frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1121 	for (i = 0; i < WME_NUM_AC; i++) {
1122 		struct wmeParams *wmep =
1123 			&wme->wme_wmeChanParams.cap_wmeParams[i];
1124 		/* NB: ACI not used */
1125 		wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1126 		wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1127 		wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1128 		wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1129 		wmep->wmep_txopLimit = LE_READ_2(frm+2);
1130 		frm += 4;
1131 	}
1132 	wme->wme_wmeChanParams.cap_info = qosinfo;
1133 	return 1;
1134 #undef MS
1135 }
1136 
1137 /*
1138  * Process 11h Channel Switch Announcement (CSA) ie.  If this
1139  * is the first CSA then initiate the switch.  Otherwise we
1140  * track state and trigger completion and/or cancel of the switch.
1141  * XXX should be public for IBSS use
1142  */
1143 static void
1144 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
1145 	const struct ieee80211_frame *wh)
1146 {
1147 	struct ieee80211com *ic = vap->iv_ic;
1148 	const struct ieee80211_csa_ie *csa =
1149 	    (const struct ieee80211_csa_ie *) frm;
1150 
1151 	KASSERT(vap->iv_state >= IEEE80211_S_RUN,
1152 	    ("state %s", ieee80211_state_name[vap->iv_state]));
1153 
1154 	if (csa->csa_mode > 1) {
1155 		IEEE80211_DISCARD_IE(vap,
1156 		    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1157 		    wh, "CSA", "invalid mode %u", csa->csa_mode);
1158 		return;
1159 	}
1160 	IEEE80211_LOCK(ic);
1161 	if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
1162 		/*
1163 		 * Convert the channel number to a channel reference.  We
1164 		 * try first to preserve turbo attribute of the current
1165 		 * channel then fallback.  Note this will not work if the
1166 		 * CSA specifies a channel that requires a band switch (e.g.
1167 		 * 11a => 11g).  This is intentional as 11h is defined only
1168 		 * for 5GHz/11a and because the switch does not involve a
1169 		 * reassociation, protocol state (capabilities, negotated
1170 		 * rates, etc) may/will be wrong.
1171 		 */
1172 		struct ieee80211_channel *c =
1173 		    ieee80211_find_channel_byieee(ic, csa->csa_newchan,
1174 			(ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
1175 		if (c == NULL) {
1176 			c = ieee80211_find_channel_byieee(ic,
1177 			    csa->csa_newchan,
1178 			    (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
1179 			if (c == NULL) {
1180 				IEEE80211_DISCARD_IE(vap,
1181 				    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1182 				    wh, "CSA", "invalid channel %u",
1183 				    csa->csa_newchan);
1184 				goto done;
1185 			}
1186 		}
1187 #if IEEE80211_CSA_COUNT_MIN > 0
1188 		if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
1189 			/*
1190 			 * Require at least IEEE80211_CSA_COUNT_MIN count to
1191 			 * reduce the risk of being redirected by a fabricated
1192 			 * CSA.  If a valid CSA is dropped we'll still get a
1193 			 * beacon miss when the AP leaves the channel so we'll
1194 			 * eventually follow to the new channel.
1195 			 *
1196 			 * NOTE: this violates the 11h spec that states that
1197 			 * count may be any value and if 0 then a switch
1198 			 * should happen asap.
1199 			 */
1200 			IEEE80211_DISCARD_IE(vap,
1201 			    IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1202 			    wh, "CSA", "count %u too small, must be >= %u",
1203 			    csa->csa_count, IEEE80211_CSA_COUNT_MIN);
1204 			goto done;
1205 		}
1206 #endif
1207 		ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
1208 	} else {
1209 		/*
1210 		 * Validate this ie against the initial CSA.  We require
1211 		 * mode and channel not change and the count must be
1212 		 * monotonically decreasing.  This may be pointless and
1213 		 * canceling the switch as a result may be too paranoid but
1214 		 * in the worst case if we drop out of CSA because of this
1215 		 * and the AP does move then we'll just end up taking a
1216 		 * beacon miss and scan to find the AP.
1217 		 *
1218 		 * XXX may want <= on count as we also process ProbeResp
1219 		 * frames and those may come in w/ the same count as the
1220 		 * previous beacon; but doing so leaves us open to a stuck
1221 		 * count until we add a dead-man timer
1222 		 */
1223 		if (!(csa->csa_count < ic->ic_csa_count &&
1224 		      csa->csa_mode == ic->ic_csa_mode &&
1225 		      csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
1226 			IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
1227 			    "CSA ie mismatch, initial ie <%d,%d,%d>, "
1228 			    "this ie <%d,%d,%d>", ic->ic_csa_mode,
1229 			    ic->ic_csa_newchan, ic->ic_csa_count,
1230 			    csa->csa_mode, csa->csa_newchan, csa->csa_count);
1231 			ieee80211_csa_cancelswitch(ic);
1232 		} else {
1233 			if (csa->csa_count <= 1)
1234 				ieee80211_csa_completeswitch(ic);
1235 			else
1236 				ic->ic_csa_count = csa->csa_count;
1237 		}
1238 	}
1239 done:
1240 	IEEE80211_UNLOCK(ic);
1241 }
1242 
1243 /*
1244  * Return non-zero if a background scan may be continued:
1245  * o bg scan is active
1246  * o no channel switch is pending
1247  * o there has not been any traffic recently
1248  *
1249  * Note we do not check if there is an administrative enable;
1250  * this is only done to start the scan.  We assume that any
1251  * change in state will be accompanied by a request to cancel
1252  * active scans which will otherwise cause this test to fail.
1253  */
1254 static __inline int
1255 contbgscan(struct ieee80211vap *vap)
1256 {
1257 	struct ieee80211com *ic = vap->iv_ic;
1258 
1259 	return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1260 	    (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1261 	    vap->iv_state == IEEE80211_S_RUN &&		/* XXX? */
1262 	    time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1263 }
1264 
1265 /*
1266  * Return non-zero if a backgrond scan may be started:
1267  * o bg scanning is administratively enabled
1268  * o no channel switch is pending
1269  * o we are not boosted on a dynamic turbo channel
1270  * o there has not been a scan recently
1271  * o there has not been any traffic recently
1272  */
1273 static __inline int
1274 startbgscan(struct ieee80211vap *vap)
1275 {
1276 	struct ieee80211com *ic = vap->iv_ic;
1277 
1278 	return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
1279 	    (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1280 #ifdef IEEE80211_SUPPORT_SUPERG
1281 	    !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1282 #endif
1283 	    time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
1284 	    time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1285 }
1286 
1287 static void
1288 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1289 	int subtype, int rssi, int nf)
1290 {
1291 #define	ISPROBE(_st)	((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1292 #define	ISREASSOC(_st)	((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1293 	struct ieee80211vap *vap = ni->ni_vap;
1294 	struct ieee80211com *ic = ni->ni_ic;
1295 	struct ieee80211_frame *wh;
1296 	uint8_t *frm, *efrm;
1297 	uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
1298 	uint8_t rate;
1299 	int ht_state_change = 0;
1300 
1301 	wh = mtod(m0, struct ieee80211_frame *);
1302 	frm = (uint8_t *)&wh[1];
1303 	efrm = mtod(m0, uint8_t *) + m0->m_len;
1304 	switch (subtype) {
1305 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1306 	case IEEE80211_FC0_SUBTYPE_BEACON: {
1307 		struct ieee80211_scanparams scan;
1308 		/*
1309 		 * We process beacon/probe response frames:
1310 		 *    o when scanning, or
1311 		 *    o station mode when associated (to collect state
1312 		 *      updates such as 802.11g slot time)
1313 		 * Frames otherwise received are discarded.
1314 		 */
1315 		if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
1316 			vap->iv_stats.is_rx_mgtdiscard++;
1317 			return;
1318 		}
1319 		/* XXX probe response in sta mode when !scanning? */
1320 		if (ieee80211_parse_beacon(ni, m0, &scan) != 0) {
1321 			if (! (ic->ic_flags & IEEE80211_F_SCAN))
1322 				vap->iv_stats.is_beacon_bad++;
1323 			return;
1324 		}
1325 
1326 		/*
1327 		 * Count frame now that we know it's to be processed.
1328 		 */
1329 		if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1330 			vap->iv_stats.is_rx_beacon++;		/* XXX remove */
1331 			IEEE80211_NODE_STAT(ni, rx_beacons);
1332 		} else
1333 			IEEE80211_NODE_STAT(ni, rx_proberesp);
1334 		/*
1335 		 * When operating in station mode, check for state updates.
1336 		 * Be careful to ignore beacons received while doing a
1337 		 * background scan.  We consider only 11g/WMM stuff right now.
1338 		 */
1339 		if (ni->ni_associd != 0 &&
1340 		    ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1341 		     IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1342 			/* record tsf of last beacon */
1343 			memcpy(ni->ni_tstamp.data, scan.tstamp,
1344 				sizeof(ni->ni_tstamp));
1345 			/* count beacon frame for s/w bmiss handling */
1346 			vap->iv_swbmiss_count++;
1347 			vap->iv_bmiss_count = 0;
1348 			if (ni->ni_erp != scan.erp) {
1349 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1350 				    wh->i_addr2,
1351 				    "erp change: was 0x%x, now 0x%x",
1352 				    ni->ni_erp, scan.erp);
1353 				if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1354 				    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1355 					ic->ic_flags |= IEEE80211_F_USEPROT;
1356 				else
1357 					ic->ic_flags &= ~IEEE80211_F_USEPROT;
1358 				ni->ni_erp = scan.erp;
1359 				/* XXX statistic */
1360 				/* XXX driver notification */
1361 			}
1362 			if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1363 				IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1364 				    wh->i_addr2,
1365 				    "capabilities change: was 0x%x, now 0x%x",
1366 				    ni->ni_capinfo, scan.capinfo);
1367 				/*
1368 				 * NB: we assume short preamble doesn't
1369 				 *     change dynamically
1370 				 */
1371 				ieee80211_set_shortslottime(ic,
1372 					IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
1373 					(scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1374 				ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
1375 					       | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
1376 				/* XXX statistic */
1377 			}
1378 			if (scan.wme != NULL &&
1379 			    (ni->ni_flags & IEEE80211_NODE_QOS) &&
1380 			    ieee80211_parse_wmeparams(vap, scan.wme, wh) > 0)
1381 				ieee80211_wme_updateparams(vap);
1382 #ifdef IEEE80211_SUPPORT_SUPERG
1383 			if (scan.ath != NULL)
1384 				ieee80211_parse_athparams(ni, scan.ath, wh);
1385 #endif
1386 			if (scan.htcap != NULL && scan.htinfo != NULL &&
1387 			    (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1388 				/* XXX state changes? */
1389 				if (ieee80211_ht_updateparams(ni,
1390 				    scan.htcap, scan.htinfo))
1391 					ht_state_change = 1;
1392 			}
1393 			if (scan.quiet)
1394 				ic->ic_set_quiet(ni, scan.quiet);
1395 
1396 			if (scan.tim != NULL) {
1397 				struct ieee80211_tim_ie *tim =
1398 				    (struct ieee80211_tim_ie *) scan.tim;
1399 				/*
1400 				 * XXX Check/debug this code; see if it's about
1401 				 * the right time to force the VAP awake if we
1402 				 * receive a frame destined for us?
1403 				 */
1404 				int aid = IEEE80211_AID(ni->ni_associd);
1405 				int ix = aid / NBBY;
1406 				int min = tim->tim_bitctl &~ 1;
1407 				int max = tim->tim_len + min - 4;
1408 				int tim_ucast = 0, tim_mcast = 0;
1409 
1410 				/*
1411 				 * Only do this for unicast traffic in the TIM
1412 				 * The multicast traffic notification for
1413 				 * the scan notification stuff should occur
1414 				 * differently.
1415 				 */
1416 				if (min <= ix && ix <= max &&
1417 				     isset(tim->tim_bitmap - min, aid)) {
1418 					tim_ucast = 1;
1419 				}
1420 
1421 				/*
1422 				 * Do a separate notification
1423 				 * for the multicast bit being set.
1424 				 */
1425 				if (tim->tim_bitctl & 1) {
1426 					tim_mcast = 1;
1427 				}
1428 
1429 				/*
1430 				 * If the TIM indicates there's traffic for
1431 				 * us then get us out of STA mode powersave.
1432 				 */
1433 				if (tim_ucast == 1) {
1434 
1435 					/*
1436 					 * Wake us out of SLEEP state if we're
1437 					 * in it; and if we're doing bgscan
1438 					 * then wake us out of STA powersave.
1439 					 */
1440 					ieee80211_sta_tim_notify(vap, 1);
1441 
1442 					/*
1443 					 * This is preventing us from
1444 					 * continuing a bgscan; because it
1445 					 * tricks the contbgscan()
1446 					 * routine to think there's always
1447 					 * traffic for us.
1448 					 *
1449 					 * I think we need both an RX and
1450 					 * TX ic_lastdata field.
1451 					 */
1452 					ic->ic_lastdata = ticks;
1453 				}
1454 
1455 				ni->ni_dtim_count = tim->tim_count;
1456 				ni->ni_dtim_period = tim->tim_period;
1457 			}
1458 			if (scan.csa != NULL &&
1459 			    (vap->iv_flags & IEEE80211_F_DOTH))
1460 				ieee80211_parse_csaparams(vap, scan.csa, wh);
1461 			else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
1462 				/*
1463 				 * No CSA ie or 11h disabled, but a channel
1464 				 * switch is pending; drop out so we aren't
1465 				 * stuck in CSA state.  If the AP really is
1466 				 * moving we'll get a beacon miss and scan.
1467 				 */
1468 				IEEE80211_LOCK(ic);
1469 				ieee80211_csa_cancelswitch(ic);
1470 				IEEE80211_UNLOCK(ic);
1471 			}
1472 			/*
1473 			 * If scanning, pass the info to the scan module.
1474 			 * Otherwise, check if it's the right time to do
1475 			 * a background scan.  Background scanning must
1476 			 * be enabled and we must not be operating in the
1477 			 * turbo phase of dynamic turbo mode.  Then,
1478 			 * it's been a while since the last background
1479 			 * scan and if no data frames have come through
1480 			 * recently, kick off a scan.  Note that this
1481 			 * is the mechanism by which a background scan
1482 			 * is started _and_ continued each time we
1483 			 * return on-channel to receive a beacon from
1484 			 * our ap.
1485 			 */
1486 			if (ic->ic_flags & IEEE80211_F_SCAN) {
1487 				ieee80211_add_scan(vap, &scan, wh,
1488 					subtype, rssi, nf);
1489 			} else if (contbgscan(vap)) {
1490 				ieee80211_bg_scan(vap, 0);
1491 			} else if (startbgscan(vap)) {
1492 				vap->iv_stats.is_scan_bg++;
1493 #if 0
1494 				/* wakeup if we are sleeing */
1495 				ieee80211_set_pwrsave(vap, 0);
1496 #endif
1497 				ieee80211_bg_scan(vap, 0);
1498 			}
1499 
1500 			/*
1501 			 * Put the station to sleep if we haven't seen
1502 			 * traffic in a while.
1503 			 */
1504 			IEEE80211_LOCK(ic);
1505 			ieee80211_sta_ps_timer_check(vap);
1506 			IEEE80211_UNLOCK(ic);
1507 
1508 			/*
1509 			 * If we've had a channel width change (eg HT20<->HT40)
1510 			 * then schedule a delayed driver notification.
1511 			 */
1512 			if (ht_state_change)
1513 				ieee80211_update_chw(ic);
1514 			return;
1515 		}
1516 		/*
1517 		 * If scanning, just pass information to the scan module.
1518 		 */
1519 		if (ic->ic_flags & IEEE80211_F_SCAN) {
1520 			if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1521 				/*
1522 				 * Actively scanning a channel marked passive;
1523 				 * send a probe request now that we know there
1524 				 * is 802.11 traffic present.
1525 				 *
1526 				 * XXX check if the beacon we recv'd gives
1527 				 * us what we need and suppress the probe req
1528 				 */
1529 				ieee80211_probe_curchan(vap, 1);
1530 				ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1531 			}
1532 			ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1533 			return;
1534 		}
1535 		break;
1536 	}
1537 
1538 	case IEEE80211_FC0_SUBTYPE_AUTH: {
1539 		uint16_t algo, seq, status;
1540 		/*
1541 		 * auth frame format
1542 		 *	[2] algorithm
1543 		 *	[2] sequence
1544 		 *	[2] status
1545 		 *	[tlv*] challenge
1546 		 */
1547 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1548 		algo   = le16toh(*(uint16_t *)frm);
1549 		seq    = le16toh(*(uint16_t *)(frm + 2));
1550 		status = le16toh(*(uint16_t *)(frm + 4));
1551 		IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1552 		    "recv auth frame with algorithm %d seq %d", algo, seq);
1553 
1554 		if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1555 			IEEE80211_DISCARD(vap,
1556 			    IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1557 			    wh, "auth", "%s", "TKIP countermeasures enabled");
1558 			vap->iv_stats.is_rx_auth_countermeasures++;
1559 			if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1560 				ieee80211_send_error(ni, wh->i_addr2,
1561 					IEEE80211_FC0_SUBTYPE_AUTH,
1562 					IEEE80211_REASON_MIC_FAILURE);
1563 			}
1564 			return;
1565 		}
1566 		if (algo == IEEE80211_AUTH_ALG_SHARED)
1567 			sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1568 			    seq, status);
1569 		else if (algo == IEEE80211_AUTH_ALG_OPEN)
1570 			sta_auth_open(ni, wh, rssi, nf, seq, status);
1571 		else {
1572 			IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1573 			    wh, "auth", "unsupported alg %d", algo);
1574 			vap->iv_stats.is_rx_auth_unsupported++;
1575 			return;
1576 		}
1577 		break;
1578 	}
1579 
1580 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1581 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
1582 		uint16_t capinfo, associd;
1583 		uint16_t status;
1584 
1585 		if (vap->iv_state != IEEE80211_S_ASSOC) {
1586 			vap->iv_stats.is_rx_mgtdiscard++;
1587 			return;
1588 		}
1589 
1590 		/*
1591 		 * asresp frame format
1592 		 *	[2] capability information
1593 		 *	[2] status
1594 		 *	[2] association ID
1595 		 *	[tlv] supported rates
1596 		 *	[tlv] extended supported rates
1597 		 *	[tlv] WME
1598 		 *	[tlv] HT capabilities
1599 		 *	[tlv] HT info
1600 		 */
1601 		IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1602 		ni = vap->iv_bss;
1603 		capinfo = le16toh(*(uint16_t *)frm);
1604 		frm += 2;
1605 		status = le16toh(*(uint16_t *)frm);
1606 		frm += 2;
1607 		if (status != 0) {
1608 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1609 			    wh->i_addr2, "%sassoc failed (reason %d)",
1610 			    ISREASSOC(subtype) ?  "re" : "", status);
1611 			vap->iv_stats.is_rx_auth_fail++;	/* XXX */
1612 			return;
1613 		}
1614 		associd = le16toh(*(uint16_t *)frm);
1615 		frm += 2;
1616 
1617 		rates = xrates = wme = htcap = htinfo = NULL;
1618 		while (efrm - frm > 1) {
1619 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1620 			switch (*frm) {
1621 			case IEEE80211_ELEMID_RATES:
1622 				rates = frm;
1623 				break;
1624 			case IEEE80211_ELEMID_XRATES:
1625 				xrates = frm;
1626 				break;
1627 			case IEEE80211_ELEMID_HTCAP:
1628 				htcap = frm;
1629 				break;
1630 			case IEEE80211_ELEMID_HTINFO:
1631 				htinfo = frm;
1632 				break;
1633 			case IEEE80211_ELEMID_VENDOR:
1634 				if (iswmeoui(frm))
1635 					wme = frm;
1636 				else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
1637 					/*
1638 					 * Accept pre-draft HT ie's if the
1639 					 * standard ones have not been seen.
1640 					 */
1641 					if (ishtcapoui(frm)) {
1642 						if (htcap == NULL)
1643 							htcap = frm;
1644 					} else if (ishtinfooui(frm)) {
1645 						if (htinfo == NULL)
1646 							htinfo = frm;
1647 					}
1648 				}
1649 				/* XXX Atheros OUI support */
1650 				break;
1651 			}
1652 			frm += frm[1] + 2;
1653 		}
1654 
1655 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1656 		if (xrates != NULL)
1657 			IEEE80211_VERIFY_ELEMENT(xrates,
1658 				IEEE80211_RATE_MAXSIZE - rates[1], return);
1659 		rate = ieee80211_setup_rates(ni, rates, xrates,
1660 				IEEE80211_F_JOIN |
1661 				IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1662 				IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1663 		if (rate & IEEE80211_RATE_BASIC) {
1664 			IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1665 			    wh->i_addr2,
1666 			    "%sassoc failed (rate set mismatch)",
1667 			    ISREASSOC(subtype) ?  "re" : "");
1668 			vap->iv_stats.is_rx_assoc_norate++;
1669 			ieee80211_new_state(vap, IEEE80211_S_SCAN,
1670 			    IEEE80211_SCAN_FAIL_STATUS);
1671 			return;
1672 		}
1673 
1674 		ni->ni_capinfo = capinfo;
1675 		ni->ni_associd = associd;
1676 		if (ni->ni_jointime == 0)
1677 			ni->ni_jointime = time_uptime;
1678 		if (wme != NULL &&
1679 		    ieee80211_parse_wmeparams(vap, wme, wh) >= 0) {
1680 			ni->ni_flags |= IEEE80211_NODE_QOS;
1681 			ieee80211_wme_updateparams(vap);
1682 		} else
1683 			ni->ni_flags &= ~IEEE80211_NODE_QOS;
1684 		/*
1685 		 * Setup HT state according to the negotiation.
1686 		 *
1687 		 * NB: shouldn't need to check if HT use is enabled but some
1688 		 *     ap's send back HT ie's even when we don't indicate we
1689 		 *     are HT capable in our AssocReq.
1690 		 */
1691 		if (htcap != NULL && htinfo != NULL &&
1692 		    (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1693 			ieee80211_ht_node_init(ni);
1694 			ieee80211_ht_updateparams(ni, htcap, htinfo);
1695 			ieee80211_setup_htrates(ni, htcap,
1696 			     IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
1697 			ieee80211_setup_basic_htrates(ni, htinfo);
1698 			ieee80211_node_setuptxparms(ni);
1699 			ieee80211_ratectl_node_init(ni);
1700 		} else {
1701 #ifdef IEEE80211_SUPPORT_SUPERG
1702 			if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_ATH))
1703 				ieee80211_ff_node_init(ni);
1704 #endif
1705 		}
1706 		/*
1707 		 * Configure state now that we are associated.
1708 		 *
1709 		 * XXX may need different/additional driver callbacks?
1710 		 */
1711 		if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1712 		    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1713 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1714 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1715 		} else {
1716 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1717 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1718 		}
1719 		ieee80211_set_shortslottime(ic,
1720 			IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1721 			(ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1722 		/*
1723 		 * Honor ERP protection.
1724 		 *
1725 		 * NB: ni_erp should zero for non-11g operation.
1726 		 */
1727 		if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1728 		    (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1729 			ic->ic_flags |= IEEE80211_F_USEPROT;
1730 		else
1731 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1732 		IEEE80211_NOTE_MAC(vap,
1733 		    IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
1734 		    "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s",
1735 		    ISREASSOC(subtype) ? "re" : "",
1736 		    IEEE80211_NODE_AID(ni),
1737 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1738 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1739 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1740 		    ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
1741 		    ni->ni_flags & IEEE80211_NODE_HT ?
1742 			(ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
1743 		    ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
1744 		    ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
1745 			ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
1746 		    ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
1747 		    IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
1748 			", fast-frames" : "",
1749 		    IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
1750 			", turbo" : ""
1751 		);
1752 		ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
1753 		break;
1754 	}
1755 
1756 	case IEEE80211_FC0_SUBTYPE_DEAUTH: {
1757 		uint16_t reason;
1758 
1759 		if (vap->iv_state == IEEE80211_S_SCAN) {
1760 			vap->iv_stats.is_rx_mgtdiscard++;
1761 			return;
1762 		}
1763 		if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1764 			/* NB: can happen when in promiscuous mode */
1765 			vap->iv_stats.is_rx_mgtdiscard++;
1766 			break;
1767 		}
1768 
1769 		/*
1770 		 * deauth frame format
1771 		 *	[2] reason
1772 		 */
1773 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1774 		reason = le16toh(*(uint16_t *)frm);
1775 
1776 		vap->iv_stats.is_rx_deauth++;
1777 		vap->iv_stats.is_rx_deauth_code = reason;
1778 		IEEE80211_NODE_STAT(ni, rx_deauth);
1779 
1780 		IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1781 		    "recv deauthenticate (reason %d)", reason);
1782 		ieee80211_new_state(vap, IEEE80211_S_AUTH,
1783 		    (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
1784 		break;
1785 	}
1786 
1787 	case IEEE80211_FC0_SUBTYPE_DISASSOC: {
1788 		uint16_t reason;
1789 
1790 		if (vap->iv_state != IEEE80211_S_RUN &&
1791 		    vap->iv_state != IEEE80211_S_ASSOC &&
1792 		    vap->iv_state != IEEE80211_S_AUTH) {
1793 			vap->iv_stats.is_rx_mgtdiscard++;
1794 			return;
1795 		}
1796 		if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1797 			/* NB: can happen when in promiscuous mode */
1798 			vap->iv_stats.is_rx_mgtdiscard++;
1799 			break;
1800 		}
1801 
1802 		/*
1803 		 * disassoc frame format
1804 		 *	[2] reason
1805 		 */
1806 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1807 		reason = le16toh(*(uint16_t *)frm);
1808 
1809 		vap->iv_stats.is_rx_disassoc++;
1810 		vap->iv_stats.is_rx_disassoc_code = reason;
1811 		IEEE80211_NODE_STAT(ni, rx_disassoc);
1812 
1813 		IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1814 		    "recv disassociate (reason %d)", reason);
1815 		ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1816 		break;
1817 	}
1818 
1819 	case IEEE80211_FC0_SUBTYPE_ACTION:
1820 	case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
1821 		if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
1822 		    !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1823 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1824 			    wh, NULL, "%s", "not for us");
1825 			vap->iv_stats.is_rx_mgtdiscard++;
1826 		} else if (vap->iv_state != IEEE80211_S_RUN) {
1827 			IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1828 			    wh, NULL, "wrong state %s",
1829 			    ieee80211_state_name[vap->iv_state]);
1830 			vap->iv_stats.is_rx_mgtdiscard++;
1831 		} else {
1832 			if (ieee80211_parse_action(ni, m0) == 0)
1833 				(void)ic->ic_recv_action(ni, wh, frm, efrm);
1834 		}
1835 		break;
1836 
1837 	case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1838 	case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1839 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1840 	case IEEE80211_FC0_SUBTYPE_ATIM:
1841 		IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1842 		    wh, NULL, "%s", "not handled");
1843 		vap->iv_stats.is_rx_mgtdiscard++;
1844 		break;
1845 
1846 	default:
1847 		IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1848 		    wh, "mgt", "subtype 0x%x not handled", subtype);
1849 		vap->iv_stats.is_rx_badsubtype++;
1850 		break;
1851 	}
1852 #undef ISREASSOC
1853 #undef ISPROBE
1854 }
1855 
1856 static void
1857 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
1858 {
1859 	switch (subtype) {
1860 	case IEEE80211_FC0_SUBTYPE_BAR:
1861 		ieee80211_recv_bar(ni, m);
1862 		break;
1863 	}
1864 }
1865