10ba2cbe9Sxc151355 /*
219d332feSfei feng - Sun Microsystems - Beijing China * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
30ba2cbe9Sxc151355 * Use is subject to license terms.
40ba2cbe9Sxc151355 */
50ba2cbe9Sxc151355
60ba2cbe9Sxc151355 /*
70ba2cbe9Sxc151355 * Copyright (c) 2001 Atsushi Onoe
819d332feSfei feng - Sun Microsystems - Beijing China * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
90ba2cbe9Sxc151355 * All rights reserved.
100ba2cbe9Sxc151355 *
110ba2cbe9Sxc151355 * Redistribution and use in source and binary forms, with or without
120ba2cbe9Sxc151355 * modification, are permitted provided that the following conditions
130ba2cbe9Sxc151355 * are met:
140ba2cbe9Sxc151355 * 1. Redistributions of source code must retain the above copyright
150ba2cbe9Sxc151355 * notice, this list of conditions and the following disclaimer.
160ba2cbe9Sxc151355 * 2. Redistributions in binary form must reproduce the above copyright
170ba2cbe9Sxc151355 * notice, this list of conditions and the following disclaimer in the
180ba2cbe9Sxc151355 * documentation and/or other materials provided with the distribution.
190ba2cbe9Sxc151355 * 3. The name of the author may not be used to endorse or promote products
200ba2cbe9Sxc151355 * derived from this software without specific prior written permission.
210ba2cbe9Sxc151355 *
220ba2cbe9Sxc151355 * Alternatively, this software may be distributed under the terms of the
230ba2cbe9Sxc151355 * GNU General Public License ("GPL") version 2 as published by the Free
240ba2cbe9Sxc151355 * Software Foundation.
250ba2cbe9Sxc151355 *
260ba2cbe9Sxc151355 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
270ba2cbe9Sxc151355 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
280ba2cbe9Sxc151355 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
290ba2cbe9Sxc151355 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
300ba2cbe9Sxc151355 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
310ba2cbe9Sxc151355 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
320ba2cbe9Sxc151355 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
330ba2cbe9Sxc151355 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
340ba2cbe9Sxc151355 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
350ba2cbe9Sxc151355 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
360ba2cbe9Sxc151355 */
370ba2cbe9Sxc151355
380ba2cbe9Sxc151355 /*
390ba2cbe9Sxc151355 * Process received frame
400ba2cbe9Sxc151355 */
410ba2cbe9Sxc151355
42da14cebeSEric Cheng #include <sys/mac_provider.h>
430ba2cbe9Sxc151355 #include <sys/byteorder.h>
44ff3124efSff224033 #include <sys/strsun.h>
450ba2cbe9Sxc151355 #include "net80211_impl.h"
460ba2cbe9Sxc151355
470ba2cbe9Sxc151355 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *,
480ba2cbe9Sxc151355 mblk_t *, int);
490ba2cbe9Sxc151355
500ba2cbe9Sxc151355 /*
510ba2cbe9Sxc151355 * Process a received frame. The node associated with the sender
520ba2cbe9Sxc151355 * should be supplied. If nothing was found in the node table then
530ba2cbe9Sxc151355 * the caller is assumed to supply a reference to ic_bss instead.
540ba2cbe9Sxc151355 * The RSSI and a timestamp are also supplied. The RSSI data is used
550ba2cbe9Sxc151355 * during AP scanning to select a AP to associate with; it can have
560ba2cbe9Sxc151355 * any units so long as values have consistent units and higher values
570ba2cbe9Sxc151355 * mean ``better signal''. The receive timestamp is currently not used
580ba2cbe9Sxc151355 * by the 802.11 layer.
590ba2cbe9Sxc151355 */
600ba2cbe9Sxc151355 int
ieee80211_input(ieee80211com_t * ic,mblk_t * mp,struct ieee80211_node * in,int32_t rssi,uint32_t rstamp)610ba2cbe9Sxc151355 ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
620ba2cbe9Sxc151355 int32_t rssi, uint32_t rstamp)
630ba2cbe9Sxc151355 {
640ba2cbe9Sxc151355 struct ieee80211_frame *wh;
650ba2cbe9Sxc151355 struct ieee80211_key *key;
660ba2cbe9Sxc151355 uint8_t *bssid;
670ba2cbe9Sxc151355 int hdrspace;
680ba2cbe9Sxc151355 int len;
690ba2cbe9Sxc151355 uint16_t rxseq;
700ba2cbe9Sxc151355 uint8_t dir;
710ba2cbe9Sxc151355 uint8_t type;
720ba2cbe9Sxc151355 uint8_t subtype;
730ba2cbe9Sxc151355 uint8_t tid;
74e2cf88acSQuaker Fang uint8_t qos;
75e2cf88acSQuaker Fang
76e2cf88acSQuaker Fang if (mp->b_flag & M_AMPDU) {
77e2cf88acSQuaker Fang /*
78e2cf88acSQuaker Fang * Fastpath for A-MPDU reorder q resubmission. Frames
79e2cf88acSQuaker Fang * w/ M_AMPDU marked have already passed through here
80e2cf88acSQuaker Fang * but were received out of order and been held on the
81e2cf88acSQuaker Fang * reorder queue. When resubmitted they are marked
82e2cf88acSQuaker Fang * with the M_AMPDU flag and we can bypass most of the
83e2cf88acSQuaker Fang * normal processing.
84e2cf88acSQuaker Fang */
85e2cf88acSQuaker Fang IEEE80211_LOCK(ic);
86e2cf88acSQuaker Fang wh = (struct ieee80211_frame *)mp->b_rptr;
87e2cf88acSQuaker Fang type = IEEE80211_FC0_TYPE_DATA;
88e2cf88acSQuaker Fang dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
89e2cf88acSQuaker Fang subtype = IEEE80211_FC0_SUBTYPE_QOS;
90e2cf88acSQuaker Fang hdrspace = ieee80211_hdrspace(ic, wh); /* optimize */
91e2cf88acSQuaker Fang /* clear driver/net80211 flags before passing up */
92e2cf88acSQuaker Fang mp->b_flag &= ~M_AMPDU;
93e2cf88acSQuaker Fang goto resubmit_ampdu;
94e2cf88acSQuaker Fang }
950ba2cbe9Sxc151355
960ba2cbe9Sxc151355 ASSERT(in != NULL);
9719d332feSfei feng - Sun Microsystems - Beijing China in->in_inact = in->in_inact_reload;
980ba2cbe9Sxc151355 type = (uint8_t)-1; /* undefined */
99ff3124efSff224033 len = MBLKL(mp);
1000ba2cbe9Sxc151355 if (len < sizeof (struct ieee80211_frame_min)) {
1010ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
1020ba2cbe9Sxc151355 "too short (1): len %u", len);
1030ba2cbe9Sxc151355 goto out;
1040ba2cbe9Sxc151355 }
1050ba2cbe9Sxc151355 /*
1060ba2cbe9Sxc151355 * Bit of a cheat here, we use a pointer for a 3-address
1070ba2cbe9Sxc151355 * frame format but don't reference fields past outside
1080ba2cbe9Sxc151355 * ieee80211_frame_min w/o first validating the data is
1090ba2cbe9Sxc151355 * present.
1100ba2cbe9Sxc151355 */
1110ba2cbe9Sxc151355 wh = (struct ieee80211_frame *)mp->b_rptr;
1120ba2cbe9Sxc151355 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1130ba2cbe9Sxc151355 IEEE80211_FC0_VERSION_0) {
1140ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
1150ba2cbe9Sxc151355 "discard pkt with wrong version %x", wh->i_fc[0]);
1160ba2cbe9Sxc151355 goto out;
1170ba2cbe9Sxc151355 }
1180ba2cbe9Sxc151355
1190ba2cbe9Sxc151355 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1200ba2cbe9Sxc151355 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1210ba2cbe9Sxc151355 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1220ba2cbe9Sxc151355
1230ba2cbe9Sxc151355 IEEE80211_LOCK(ic);
1240ba2cbe9Sxc151355 if (!(ic->ic_flags & IEEE80211_F_SCAN)) {
1250ba2cbe9Sxc151355 switch (ic->ic_opmode) {
1260ba2cbe9Sxc151355 case IEEE80211_M_STA:
1270ba2cbe9Sxc151355 bssid = wh->i_addr2;
1280ba2cbe9Sxc151355 if (!IEEE80211_ADDR_EQ(bssid, in->in_bssid))
1290ba2cbe9Sxc151355 goto out_exit_mutex;
1300ba2cbe9Sxc151355 break;
1310ba2cbe9Sxc151355 case IEEE80211_M_IBSS:
1320ba2cbe9Sxc151355 case IEEE80211_M_AHDEMO:
1330ba2cbe9Sxc151355 if (dir != IEEE80211_FC1_DIR_NODS) {
1340ba2cbe9Sxc151355 bssid = wh->i_addr1;
1350ba2cbe9Sxc151355 } else if (type == IEEE80211_FC0_TYPE_CTL) {
1360ba2cbe9Sxc151355 bssid = wh->i_addr1;
1370ba2cbe9Sxc151355 } else {
1380ba2cbe9Sxc151355 if (len < sizeof (struct ieee80211_frame)) {
1390ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ANY,
1400ba2cbe9Sxc151355 "ieee80211_input: too short(2):"
1410ba2cbe9Sxc151355 "len %u\n", len);
1420ba2cbe9Sxc151355 goto out_exit_mutex;
1430ba2cbe9Sxc151355 }
1440ba2cbe9Sxc151355 bssid = wh->i_addr3;
1450ba2cbe9Sxc151355 }
1460ba2cbe9Sxc151355 if (type != IEEE80211_FC0_TYPE_DATA)
1470ba2cbe9Sxc151355 break;
1480ba2cbe9Sxc151355 /*
1490ba2cbe9Sxc151355 * Data frame, validate the bssid.
1500ba2cbe9Sxc151355 */
1510ba2cbe9Sxc151355 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->in_bssid) &&
1520ba2cbe9Sxc151355 !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) {
1530ba2cbe9Sxc151355 /* not interested in */
1540ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
1550ba2cbe9Sxc151355 "ieee80211_input: not to bss %s\n",
1560ba2cbe9Sxc151355 ieee80211_macaddr_sprintf(bssid));
1570ba2cbe9Sxc151355 goto out_exit_mutex;
1580ba2cbe9Sxc151355 }
1590ba2cbe9Sxc151355 /*
1600ba2cbe9Sxc151355 * For adhoc mode we cons up a node when it doesn't
1610ba2cbe9Sxc151355 * exist. This should probably done after an ACL check.
1620ba2cbe9Sxc151355 */
1630ba2cbe9Sxc151355 if (in == ic->ic_bss &&
1640ba2cbe9Sxc151355 ic->ic_opmode != IEEE80211_M_HOSTAP &&
1650ba2cbe9Sxc151355 !IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
1660ba2cbe9Sxc151355 /*
1670ba2cbe9Sxc151355 * Fake up a node for this newly
1680ba2cbe9Sxc151355 * discovered member of the IBSS.
1690ba2cbe9Sxc151355 */
1700ba2cbe9Sxc151355 in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
1710ba2cbe9Sxc151355 wh->i_addr2);
1720ba2cbe9Sxc151355 if (in == NULL) {
1730ba2cbe9Sxc151355 /* NB: stat kept for alloc failure */
1740ba2cbe9Sxc151355 goto out_exit_mutex;
1750ba2cbe9Sxc151355 }
1760ba2cbe9Sxc151355 }
1770ba2cbe9Sxc151355 break;
1780ba2cbe9Sxc151355 default:
1790ba2cbe9Sxc151355 goto out_exit_mutex;
1800ba2cbe9Sxc151355 }
1810ba2cbe9Sxc151355 in->in_rssi = (uint8_t)rssi;
1820ba2cbe9Sxc151355 in->in_rstamp = rstamp;
1830ba2cbe9Sxc151355 if (!(type & IEEE80211_FC0_TYPE_CTL)) {
184e2cf88acSQuaker Fang if (IEEE80211_QOS_HAS_SEQ(wh)) {
185e2cf88acSQuaker Fang tid = ((struct ieee80211_qosframe *)wh)->
186e2cf88acSQuaker Fang i_qos[0] & IEEE80211_QOS_TID;
187e2cf88acSQuaker Fang if (TID_TO_WME_AC(tid) >= WME_AC_VI)
188e2cf88acSQuaker Fang ic->ic_wme.wme_hipri_traffic++;
189e2cf88acSQuaker Fang tid++;
190e2cf88acSQuaker Fang } else {
191e2cf88acSQuaker Fang tid = IEEE80211_NONQOS_TID;
192e2cf88acSQuaker Fang }
193b510adaeSfei feng - Sun Microsystems - Beijing China rxseq = LE_16(*(uint16_t *)wh->i_seq);
194e2cf88acSQuaker Fang if ((in->in_flags & IEEE80211_NODE_HT) == 0 &&
195e2cf88acSQuaker Fang (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
1960ba2cbe9Sxc151355 (rxseq - in->in_rxseqs[tid]) <= 0) {
1970ba2cbe9Sxc151355 /* duplicate, discard */
1980ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
1990ba2cbe9Sxc151355 "ieee80211_input: duplicate",
2000ba2cbe9Sxc151355 "seqno <%u,%u> fragno <%u,%u> tid %u",
2010ba2cbe9Sxc151355 rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
2020ba2cbe9Sxc151355 in->in_rxseqs[tid] >>
2030ba2cbe9Sxc151355 IEEE80211_SEQ_SEQ_SHIFT,
2040ba2cbe9Sxc151355 rxseq & IEEE80211_SEQ_FRAG_MASK,
2050ba2cbe9Sxc151355 in->in_rxseqs[tid] &
2060ba2cbe9Sxc151355 IEEE80211_SEQ_FRAG_MASK,
2070ba2cbe9Sxc151355 tid);
2080ba2cbe9Sxc151355 ic->ic_stats.is_rx_dups++;
2090ba2cbe9Sxc151355 goto out_exit_mutex;
2100ba2cbe9Sxc151355 }
2110ba2cbe9Sxc151355 in->in_rxseqs[tid] = rxseq;
2120ba2cbe9Sxc151355 }
2130ba2cbe9Sxc151355 }
2140ba2cbe9Sxc151355
2150ba2cbe9Sxc151355 switch (type) {
2160ba2cbe9Sxc151355 case IEEE80211_FC0_TYPE_DATA:
217e2cf88acSQuaker Fang hdrspace = ieee80211_hdrspace(ic, wh);
2180ba2cbe9Sxc151355 if (len < hdrspace) {
2190ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
2200ba2cbe9Sxc151355 "data too short: expecting %u", hdrspace);
2210ba2cbe9Sxc151355 goto out_exit_mutex;
2220ba2cbe9Sxc151355 }
2230ba2cbe9Sxc151355 switch (ic->ic_opmode) {
2240ba2cbe9Sxc151355 case IEEE80211_M_STA:
2250ba2cbe9Sxc151355 if (dir != IEEE80211_FC1_DIR_FROMDS) {
2260ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
2270ba2cbe9Sxc151355 "ieee80211_input: data ",
2280ba2cbe9Sxc151355 "unknown dir 0x%x", dir);
2290ba2cbe9Sxc151355 goto out_exit_mutex;
2300ba2cbe9Sxc151355 }
2310ba2cbe9Sxc151355 if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
2320ba2cbe9Sxc151355 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_macaddr)) {
2330ba2cbe9Sxc151355 /*
2340ba2cbe9Sxc151355 * In IEEE802.11 network, multicast packet
2350ba2cbe9Sxc151355 * sent from me is broadcasted from AP.
2360ba2cbe9Sxc151355 * It should be silently discarded for
2370ba2cbe9Sxc151355 * SIMPLEX interface.
2380ba2cbe9Sxc151355 */
2390ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
2400ba2cbe9Sxc151355 "ieee80211_input: multicast echo\n");
2410ba2cbe9Sxc151355 goto out_exit_mutex;
2420ba2cbe9Sxc151355 }
2430ba2cbe9Sxc151355 break;
2440ba2cbe9Sxc151355 case IEEE80211_M_IBSS:
2450ba2cbe9Sxc151355 case IEEE80211_M_AHDEMO:
2460ba2cbe9Sxc151355 if (dir != IEEE80211_FC1_DIR_NODS) {
2470ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
2480ba2cbe9Sxc151355 "ieee80211_input: unknown dir 0x%x",
2490ba2cbe9Sxc151355 dir);
2500ba2cbe9Sxc151355 goto out_exit_mutex;
2510ba2cbe9Sxc151355 }
2520ba2cbe9Sxc151355 break;
2530ba2cbe9Sxc151355 default:
2540ba2cbe9Sxc151355 ieee80211_err("ieee80211_input: "
2550ba2cbe9Sxc151355 "receive data, unknown opmode %u, skip\n",
2560ba2cbe9Sxc151355 ic->ic_opmode);
2570ba2cbe9Sxc151355 goto out_exit_mutex;
2580ba2cbe9Sxc151355 }
2590ba2cbe9Sxc151355
2600ba2cbe9Sxc151355 /*
261e2cf88acSQuaker Fang * Handle A-MPDU re-ordering. The station must be
262e2cf88acSQuaker Fang * associated and negotiated HT. The frame must be
263e2cf88acSQuaker Fang * a QoS frame (not QoS null data) and not previously
264e2cf88acSQuaker Fang * processed for A-MPDU re-ordering. If the frame is
265e2cf88acSQuaker Fang * to be processed directly then ieee80211_ampdu_reorder
266e2cf88acSQuaker Fang * will return 0; otherwise it has consumed the mbuf
267e2cf88acSQuaker Fang * and we should do nothing more with it.
268e2cf88acSQuaker Fang */
269e2cf88acSQuaker Fang if ((in->in_flags & IEEE80211_NODE_HT) &&
270e2cf88acSQuaker Fang (subtype == IEEE80211_FC0_SUBTYPE_QOS)) {
271e2cf88acSQuaker Fang IEEE80211_UNLOCK(ic);
272e2cf88acSQuaker Fang if (ieee80211_ampdu_reorder(in, mp) != 0) {
273e2cf88acSQuaker Fang mp = NULL; /* CONSUMED */
274e2cf88acSQuaker Fang goto out;
275e2cf88acSQuaker Fang }
276e2cf88acSQuaker Fang IEEE80211_LOCK(ic);
277e2cf88acSQuaker Fang }
278e2cf88acSQuaker Fang resubmit_ampdu:
279e2cf88acSQuaker Fang
280e2cf88acSQuaker Fang /*
2810ba2cbe9Sxc151355 * Handle privacy requirements.
2820ba2cbe9Sxc151355 */
2830ba2cbe9Sxc151355 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2840ba2cbe9Sxc151355 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
2850ba2cbe9Sxc151355 /*
2860ba2cbe9Sxc151355 * Discard encrypted frames when privacy off.
2870ba2cbe9Sxc151355 */
2880ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
2890ba2cbe9Sxc151355 "ieee80211_input: ""WEP PRIVACY off");
2900ba2cbe9Sxc151355 ic->ic_stats.is_wep_errors++;
2910ba2cbe9Sxc151355 goto out_exit_mutex;
2920ba2cbe9Sxc151355 }
2930ba2cbe9Sxc151355 key = ieee80211_crypto_decap(ic, mp, hdrspace);
2940ba2cbe9Sxc151355 if (key == NULL) {
2950ba2cbe9Sxc151355 /* NB: stats+msgs handled in crypto_decap */
2960ba2cbe9Sxc151355 ic->ic_stats.is_wep_errors++;
2970ba2cbe9Sxc151355 goto out_exit_mutex;
2980ba2cbe9Sxc151355 }
2990ba2cbe9Sxc151355 wh = (struct ieee80211_frame *)mp->b_rptr;
3000ba2cbe9Sxc151355 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
3010ba2cbe9Sxc151355 } else {
3020ba2cbe9Sxc151355 key = NULL;
3030ba2cbe9Sxc151355 }
3040ba2cbe9Sxc151355
3050ba2cbe9Sxc151355 /*
306e2cf88acSQuaker Fang * Save QoS bits for use below--before we strip the header.
307e2cf88acSQuaker Fang */
308e2cf88acSQuaker Fang if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
309e2cf88acSQuaker Fang qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
310e2cf88acSQuaker Fang ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
311e2cf88acSQuaker Fang ((struct ieee80211_qosframe *)wh)->i_qos[0];
312e2cf88acSQuaker Fang } else {
313e2cf88acSQuaker Fang qos = 0;
314e2cf88acSQuaker Fang }
315e2cf88acSQuaker Fang
316e2cf88acSQuaker Fang /*
3170ba2cbe9Sxc151355 * Next up, any fragmentation
3180ba2cbe9Sxc151355 */
3190ba2cbe9Sxc151355 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
3200ba2cbe9Sxc151355 mp = ieee80211_defrag(ic, in, mp, hdrspace);
3210ba2cbe9Sxc151355 if (mp == NULL) {
3220ba2cbe9Sxc151355 /* Fragment dropped or frame not complete yet */
3230ba2cbe9Sxc151355 goto out_exit_mutex;
3240ba2cbe9Sxc151355 }
3250ba2cbe9Sxc151355 }
3260ba2cbe9Sxc151355 wh = NULL; /* no longer valid, catch any uses */
3270ba2cbe9Sxc151355
3280ba2cbe9Sxc151355 /*
3290ba2cbe9Sxc151355 * Next strip any MSDU crypto bits.
3300ba2cbe9Sxc151355 */
3310ba2cbe9Sxc151355 if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) {
3320ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: "
3330ba2cbe9Sxc151355 "data demic error\n");
3340ba2cbe9Sxc151355 goto out_exit_mutex;
3350ba2cbe9Sxc151355 }
3360ba2cbe9Sxc151355
337e2cf88acSQuaker Fang if (qos & IEEE80211_QOS_AMSDU) {
338e2cf88acSQuaker Fang ieee80211_dbg(IEEE80211_MSG_INPUT | IEEE80211_MSG_HT,
339e2cf88acSQuaker Fang "ieee80211_input: QOS_AMSDU (%x)\n", qos);
340e2cf88acSQuaker Fang
341e2cf88acSQuaker Fang mp = ieee80211_decap_amsdu(in, mp);
342e2cf88acSQuaker Fang if (mp == NULL) /* MSDU processed by HT */
343e2cf88acSQuaker Fang goto out_exit_mutex;
344e2cf88acSQuaker Fang }
345e2cf88acSQuaker Fang
3460ba2cbe9Sxc151355 ic->ic_stats.is_rx_frags++;
3470ba2cbe9Sxc151355 ic->ic_stats.is_rx_bytes += len;
3480ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
3490ba2cbe9Sxc151355 mac_rx(ic->ic_mach, NULL, mp);
3500ba2cbe9Sxc151355 return (IEEE80211_FC0_TYPE_DATA);
3510ba2cbe9Sxc151355
3520ba2cbe9Sxc151355 case IEEE80211_FC0_TYPE_MGT:
3530ba2cbe9Sxc151355 if (dir != IEEE80211_FC1_DIR_NODS)
3540ba2cbe9Sxc151355 goto out_exit_mutex;
3550ba2cbe9Sxc151355 if (len < sizeof (struct ieee80211_frame))
3560ba2cbe9Sxc151355 goto out_exit_mutex;
3570ba2cbe9Sxc151355 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
3580ba2cbe9Sxc151355 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
3590ba2cbe9Sxc151355 /*
3600ba2cbe9Sxc151355 * Only shared key auth frames with a challenge
3610ba2cbe9Sxc151355 * should be encrypted, discard all others.
3620ba2cbe9Sxc151355 */
3630ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
3640ba2cbe9Sxc151355 "ieee80211_input: "
3650ba2cbe9Sxc151355 "%s WEP set but not permitted",
3660ba2cbe9Sxc151355 IEEE80211_SUBTYPE_NAME(subtype));
3670ba2cbe9Sxc151355 ic->ic_stats.is_wep_errors++;
3680ba2cbe9Sxc151355 goto out_exit_mutex;
3690ba2cbe9Sxc151355 }
3700ba2cbe9Sxc151355 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
3710ba2cbe9Sxc151355 /*
3720ba2cbe9Sxc151355 * Discard encrypted frames when privacy off.
3730ba2cbe9Sxc151355 */
3740ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
3750ba2cbe9Sxc151355 "ieee80211_input: "
3760ba2cbe9Sxc151355 "mgt WEP set but PRIVACY off");
3770ba2cbe9Sxc151355 ic->ic_stats.is_wep_errors++;
3780ba2cbe9Sxc151355 goto out_exit_mutex;
3790ba2cbe9Sxc151355 }
380e2cf88acSQuaker Fang hdrspace = ieee80211_hdrspace(ic, wh);
3810ba2cbe9Sxc151355 key = ieee80211_crypto_decap(ic, mp, hdrspace);
3820ba2cbe9Sxc151355 if (key == NULL) {
3830ba2cbe9Sxc151355 /* NB: stats+msgs handled in crypto_decap */
3840ba2cbe9Sxc151355 goto out_exit_mutex;
3850ba2cbe9Sxc151355 }
3860ba2cbe9Sxc151355 wh = (struct ieee80211_frame *)mp->b_rptr;
3870ba2cbe9Sxc151355 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
3880ba2cbe9Sxc151355 }
3890ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
3900ba2cbe9Sxc151355 ic->ic_recv_mgmt(ic, mp, in, subtype, rssi, rstamp);
3910ba2cbe9Sxc151355 goto out;
3920ba2cbe9Sxc151355
3930ba2cbe9Sxc151355 case IEEE80211_FC0_TYPE_CTL:
394e2cf88acSQuaker Fang if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
395e2cf88acSQuaker Fang switch (subtype) {
396e2cf88acSQuaker Fang case IEEE80211_FC0_SUBTYPE_BAR:
397e2cf88acSQuaker Fang ieee80211_recv_bar(in, mp);
398e2cf88acSQuaker Fang break;
399e2cf88acSQuaker Fang }
400e2cf88acSQuaker Fang }
401e2cf88acSQuaker Fang break;
402e2cf88acSQuaker Fang
4030ba2cbe9Sxc151355 default:
4040ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
4050ba2cbe9Sxc151355 "bad frame type 0x%x", type);
4060ba2cbe9Sxc151355 /* should not come here */
4070ba2cbe9Sxc151355 break;
4080ba2cbe9Sxc151355 }
4090ba2cbe9Sxc151355 out_exit_mutex:
4100ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
4110ba2cbe9Sxc151355 out:
4120ba2cbe9Sxc151355 if (mp != NULL)
4130ba2cbe9Sxc151355 freemsg(mp);
4140ba2cbe9Sxc151355
4150ba2cbe9Sxc151355 return (type);
4160ba2cbe9Sxc151355 }
4170ba2cbe9Sxc151355
4180ba2cbe9Sxc151355 /*
4190ba2cbe9Sxc151355 * This function reassemble fragments.
4200ba2cbe9Sxc151355 * More fragments bit in the frame control means the packet is fragmented.
4210ba2cbe9Sxc151355 * While the sequence control field consists of 4-bit fragment number
4220ba2cbe9Sxc151355 * field and a 12-bit sequence number field.
4230ba2cbe9Sxc151355 */
4240ba2cbe9Sxc151355 /* ARGSUSED */
4250ba2cbe9Sxc151355 static mblk_t *
ieee80211_defrag(ieee80211com_t * ic,struct ieee80211_node * in,mblk_t * mp,int hdrspace)4260ba2cbe9Sxc151355 ieee80211_defrag(ieee80211com_t *ic, struct ieee80211_node *in, mblk_t *mp,
4270ba2cbe9Sxc151355 int hdrspace)
4280ba2cbe9Sxc151355 {
4290ba2cbe9Sxc151355 struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr;
4300ba2cbe9Sxc151355 struct ieee80211_frame *lwh;
4310ba2cbe9Sxc151355 mblk_t *mfrag;
4320ba2cbe9Sxc151355 uint16_t rxseq;
4330ba2cbe9Sxc151355 uint8_t fragno;
4340ba2cbe9Sxc151355 uint8_t more_frag;
4350ba2cbe9Sxc151355
4360ba2cbe9Sxc151355 ASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1));
4370ba2cbe9Sxc151355 more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
4380ba2cbe9Sxc151355 rxseq = LE_16(*(uint16_t *)wh->i_seq);
4390ba2cbe9Sxc151355 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
4400ba2cbe9Sxc151355
4410ba2cbe9Sxc151355 /* Quick way out, if there's nothing to defragment */
4420ba2cbe9Sxc151355 if (!more_frag && fragno == 0 && in->in_rxfrag == NULL)
4430ba2cbe9Sxc151355 return (mp);
4440ba2cbe9Sxc151355
4450ba2cbe9Sxc151355 /*
4460ba2cbe9Sxc151355 * Remove frag to insure it doesn't get reaped by timer.
4470ba2cbe9Sxc151355 */
4480ba2cbe9Sxc151355 if (in->in_table == NULL) {
4490ba2cbe9Sxc151355 /*
4500ba2cbe9Sxc151355 * Should never happen. If the node is orphaned (not in
4510ba2cbe9Sxc151355 * the table) then input packets should not reach here.
4520ba2cbe9Sxc151355 * Otherwise, a concurrent request that yanks the table
4530ba2cbe9Sxc151355 * should be blocked by other interlocking and/or by first
4540ba2cbe9Sxc151355 * shutting the driver down. Regardless, be defensive
4550ba2cbe9Sxc151355 * here and just bail
4560ba2cbe9Sxc151355 */
4570ba2cbe9Sxc151355 freemsg(mp);
4580ba2cbe9Sxc151355 return (NULL);
4590ba2cbe9Sxc151355 }
4600ba2cbe9Sxc151355 IEEE80211_NODE_LOCK(in->in_table);
4610ba2cbe9Sxc151355 mfrag = in->in_rxfrag;
4620ba2cbe9Sxc151355 in->in_rxfrag = NULL;
4630ba2cbe9Sxc151355 IEEE80211_NODE_UNLOCK(in->in_table);
4640ba2cbe9Sxc151355
4650ba2cbe9Sxc151355 /*
4660ba2cbe9Sxc151355 * Validate new fragment is in order and
4670ba2cbe9Sxc151355 * related to the previous ones.
4680ba2cbe9Sxc151355 */
4690ba2cbe9Sxc151355 if (mfrag != NULL) {
4700ba2cbe9Sxc151355 uint16_t last_rxseq;
4710ba2cbe9Sxc151355
4720ba2cbe9Sxc151355 lwh = (struct ieee80211_frame *)mfrag->b_rptr;
4730ba2cbe9Sxc151355 last_rxseq = LE_16(*(uint16_t *)lwh->i_seq);
4740ba2cbe9Sxc151355 /*
4750ba2cbe9Sxc151355 * Sequence control field contains 12-bit sequence no
4760ba2cbe9Sxc151355 * and 4-bit fragment number. For fragemnts, the
4770ba2cbe9Sxc151355 * sequence no is not changed.
4780ba2cbe9Sxc151355 * NB: check seq # and frag together
4790ba2cbe9Sxc151355 */
4800ba2cbe9Sxc151355 if (rxseq != last_rxseq + 1 ||
4810ba2cbe9Sxc151355 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
4820ba2cbe9Sxc151355 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
4830ba2cbe9Sxc151355 /*
4840ba2cbe9Sxc151355 * Unrelated fragment or no space for it,
4850ba2cbe9Sxc151355 * clear current fragments.
4860ba2cbe9Sxc151355 */
4870ba2cbe9Sxc151355 freemsg(mfrag);
4880ba2cbe9Sxc151355 mfrag = NULL;
4890ba2cbe9Sxc151355 }
4900ba2cbe9Sxc151355 }
4910ba2cbe9Sxc151355
4920ba2cbe9Sxc151355 if (mfrag == NULL) {
4930ba2cbe9Sxc151355 if (fragno != 0) { /* !first fragment, discard */
4940ba2cbe9Sxc151355 freemsg(mp);
4950ba2cbe9Sxc151355 return (NULL);
4960ba2cbe9Sxc151355 }
4970ba2cbe9Sxc151355 mfrag = mp;
4980ba2cbe9Sxc151355 } else { /* concatenate */
4990ba2cbe9Sxc151355 (void) adjmsg(mp, hdrspace);
5000ba2cbe9Sxc151355 linkb(mfrag, mp);
5010ba2cbe9Sxc151355 /* track last seqnum and fragno */
5020ba2cbe9Sxc151355 lwh = (struct ieee80211_frame *)mfrag->b_rptr;
5030ba2cbe9Sxc151355 *(uint16_t *)lwh->i_seq = *(uint16_t *)wh->i_seq;
5040ba2cbe9Sxc151355 }
5050ba2cbe9Sxc151355 if (more_frag != 0) { /* more to come, save */
5060ba2cbe9Sxc151355 in->in_rxfragstamp = ddi_get_lbolt();
5070ba2cbe9Sxc151355 in->in_rxfrag = mfrag;
5080ba2cbe9Sxc151355 mfrag = NULL;
5090ba2cbe9Sxc151355 }
5100ba2cbe9Sxc151355
5110ba2cbe9Sxc151355 return (mfrag);
5120ba2cbe9Sxc151355 }
5130ba2cbe9Sxc151355
5140ba2cbe9Sxc151355 /*
5150ba2cbe9Sxc151355 * Install received rate set information in the node's state block.
5160ba2cbe9Sxc151355 */
5170ba2cbe9Sxc151355 int
ieee80211_setup_rates(struct ieee80211_node * in,const uint8_t * rates,const uint8_t * xrates,int flags)5180ba2cbe9Sxc151355 ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates,
5190ba2cbe9Sxc151355 const uint8_t *xrates, int flags)
5200ba2cbe9Sxc151355 {
5210ba2cbe9Sxc151355 struct ieee80211_rateset *rs = &in->in_rates;
5220ba2cbe9Sxc151355
5230ba2cbe9Sxc151355 bzero(rs, sizeof (*rs));
5240ba2cbe9Sxc151355 rs->ir_nrates = rates[1];
5250ba2cbe9Sxc151355 /* skip 1 byte element ID and 1 byte length */
5260ba2cbe9Sxc151355 bcopy(rates + 2, rs->ir_rates, rs->ir_nrates);
5270ba2cbe9Sxc151355 if (xrates != NULL) {
5280ba2cbe9Sxc151355 uint8_t nxrates;
5290ba2cbe9Sxc151355
5300ba2cbe9Sxc151355 /*
5310ba2cbe9Sxc151355 * Tack on 11g extended supported rate element.
5320ba2cbe9Sxc151355 */
5330ba2cbe9Sxc151355 nxrates = xrates[1];
5340ba2cbe9Sxc151355 if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
5350ba2cbe9Sxc151355 nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
5360ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_XRATE,
5370ba2cbe9Sxc151355 "ieee80211_setup_rates: %s",
5380ba2cbe9Sxc151355 "[%s] extended rate set too large;"
5390ba2cbe9Sxc151355 " only using %u of %u rates\n",
5400ba2cbe9Sxc151355 ieee80211_macaddr_sprintf(in->in_macaddr),
5410ba2cbe9Sxc151355 nxrates, xrates[1]);
5420ba2cbe9Sxc151355 }
5430ba2cbe9Sxc151355 bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
5440ba2cbe9Sxc151355 rs->ir_nrates += nxrates;
5450ba2cbe9Sxc151355 }
546e2cf88acSQuaker Fang return (ieee80211_fix_rate(in, &in->in_rates, flags));
5470ba2cbe9Sxc151355 }
5480ba2cbe9Sxc151355
5490ba2cbe9Sxc151355 /*
5500ba2cbe9Sxc151355 * Process open-system authentication response frame and start
5510ba2cbe9Sxc151355 * association if the authentication request is accepted.
5520ba2cbe9Sxc151355 */
5530ba2cbe9Sxc151355 static void
ieee80211_auth_open(ieee80211com_t * ic,struct ieee80211_frame * wh,struct ieee80211_node * in,uint16_t seq,uint16_t status)5540ba2cbe9Sxc151355 ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
5550ba2cbe9Sxc151355 struct ieee80211_node *in, uint16_t seq, uint16_t status)
5560ba2cbe9Sxc151355 {
5570ba2cbe9Sxc151355 IEEE80211_LOCK_ASSERT(ic);
5580ba2cbe9Sxc151355 if (in->in_authmode == IEEE80211_AUTH_SHARED) {
5590ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH,
5600ba2cbe9Sxc151355 "open auth: bad sta auth mode %u", in->in_authmode);
5610ba2cbe9Sxc151355 return;
5620ba2cbe9Sxc151355 }
5630ba2cbe9Sxc151355 if (ic->ic_opmode == IEEE80211_M_STA) {
5640ba2cbe9Sxc151355 if (ic->ic_state != IEEE80211_S_AUTH ||
5650ba2cbe9Sxc151355 seq != IEEE80211_AUTH_OPEN_RESPONSE) {
5660ba2cbe9Sxc151355 return;
5670ba2cbe9Sxc151355 }
5680ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
5690ba2cbe9Sxc151355 if (status != 0) {
5700ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
5710ba2cbe9Sxc151355 "open auth failed (reason %d)\n", status);
5720ba2cbe9Sxc151355 if (in != ic->ic_bss)
5730ba2cbe9Sxc151355 in->in_fails++;
5740ba2cbe9Sxc151355 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
5750ba2cbe9Sxc151355 } else {
5760ba2cbe9Sxc151355 /* i_fc[0] - frame control's type & subtype field */
5770ba2cbe9Sxc151355 ieee80211_new_state(ic, IEEE80211_S_ASSOC,
5780ba2cbe9Sxc151355 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
5790ba2cbe9Sxc151355 }
5800ba2cbe9Sxc151355 IEEE80211_LOCK(ic);
5810ba2cbe9Sxc151355 } else {
5820ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: "
5830ba2cbe9Sxc151355 "bad operating mode %u", ic->ic_opmode);
5840ba2cbe9Sxc151355 }
5850ba2cbe9Sxc151355 }
5860ba2cbe9Sxc151355
5870ba2cbe9Sxc151355 /*
5880ba2cbe9Sxc151355 * Allocate challenge text for use by shared-key authentication
5890ba2cbe9Sxc151355 * Return B_TRUE on success, B_FALST otherwise.
5900ba2cbe9Sxc151355 */
5910ba2cbe9Sxc151355 static boolean_t
ieee80211_alloc_challenge(struct ieee80211_node * in)5920ba2cbe9Sxc151355 ieee80211_alloc_challenge(struct ieee80211_node *in)
5930ba2cbe9Sxc151355 {
5940ba2cbe9Sxc151355 if (in->in_challenge == NULL) {
5950ba2cbe9Sxc151355 in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN,
5960ba2cbe9Sxc151355 KM_NOSLEEP);
5970ba2cbe9Sxc151355 }
5980ba2cbe9Sxc151355 if (in->in_challenge == NULL) {
5990ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
6000ba2cbe9Sxc151355 "[%s] shared key challenge alloc failed\n",
6010ba2cbe9Sxc151355 ieee80211_macaddr_sprintf(in->in_macaddr));
6020ba2cbe9Sxc151355 }
6030ba2cbe9Sxc151355 return (in->in_challenge != NULL);
6040ba2cbe9Sxc151355 }
6050ba2cbe9Sxc151355
6060ba2cbe9Sxc151355 /*
6070ba2cbe9Sxc151355 * Process shared-key authentication response frames. If authentication
6080ba2cbe9Sxc151355 * succeeds, start association; otherwise, restart scan.
6090ba2cbe9Sxc151355 */
6100ba2cbe9Sxc151355 static void
ieee80211_auth_shared(ieee80211com_t * ic,struct ieee80211_frame * wh,uint8_t * frm,uint8_t * efrm,struct ieee80211_node * in,uint16_t seq,uint16_t status)6110ba2cbe9Sxc151355 ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
6120ba2cbe9Sxc151355 uint8_t *frm, uint8_t *efrm, struct ieee80211_node *in, uint16_t seq,
6130ba2cbe9Sxc151355 uint16_t status)
6140ba2cbe9Sxc151355 {
6150ba2cbe9Sxc151355 uint8_t *challenge;
6160ba2cbe9Sxc151355
6170ba2cbe9Sxc151355 /*
6180ba2cbe9Sxc151355 * Pre-shared key authentication is evil; accept
6190ba2cbe9Sxc151355 * it only if explicitly configured (it is supported
6200ba2cbe9Sxc151355 * mainly for compatibility with clients like OS X).
6210ba2cbe9Sxc151355 */
6220ba2cbe9Sxc151355 IEEE80211_LOCK_ASSERT(ic);
6230ba2cbe9Sxc151355 if (in->in_authmode != IEEE80211_AUTH_AUTO &&
6240ba2cbe9Sxc151355 in->in_authmode != IEEE80211_AUTH_SHARED) {
6250ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: "
6260ba2cbe9Sxc151355 "bad sta auth mode %u", in->in_authmode);
6270ba2cbe9Sxc151355 goto bad;
6280ba2cbe9Sxc151355 }
6290ba2cbe9Sxc151355
6300ba2cbe9Sxc151355 challenge = NULL;
6310ba2cbe9Sxc151355 if (frm + 1 < efrm) {
6320ba2cbe9Sxc151355 /*
6330ba2cbe9Sxc151355 * Challenge text information element
6340ba2cbe9Sxc151355 * frm[0] - element ID
6350ba2cbe9Sxc151355 * frm[1] - length
6360ba2cbe9Sxc151355 * frm[2]... - challenge text
6370ba2cbe9Sxc151355 */
638ff3124efSff224033 if ((frm[1] + 2) > (_PTRDIFF(efrm, frm))) {
6390ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH,
6400ba2cbe9Sxc151355 "ieee80211_auth_shared: ie %d%d too long\n",
641ff3124efSff224033 frm[0], (frm[1] + 2) - (_PTRDIFF(efrm, frm)));
6420ba2cbe9Sxc151355 goto bad;
6430ba2cbe9Sxc151355 }
6440ba2cbe9Sxc151355 if (*frm == IEEE80211_ELEMID_CHALLENGE)
6450ba2cbe9Sxc151355 challenge = frm;
6460ba2cbe9Sxc151355 frm += frm[1] + 2;
6470ba2cbe9Sxc151355 }
6480ba2cbe9Sxc151355 switch (seq) {
6490ba2cbe9Sxc151355 case IEEE80211_AUTH_SHARED_CHALLENGE:
6500ba2cbe9Sxc151355 case IEEE80211_AUTH_SHARED_RESPONSE:
6510ba2cbe9Sxc151355 if (challenge == NULL) {
6520ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH,
6530ba2cbe9Sxc151355 "ieee80211_auth_shared: no challenge\n");
6540ba2cbe9Sxc151355 goto bad;
6550ba2cbe9Sxc151355 }
6560ba2cbe9Sxc151355 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
6570ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH,
6580ba2cbe9Sxc151355 "ieee80211_auth_shared: bad challenge len %d\n",
6590ba2cbe9Sxc151355 challenge[1]);
6600ba2cbe9Sxc151355 goto bad;
6610ba2cbe9Sxc151355 }
6620ba2cbe9Sxc151355 default:
6630ba2cbe9Sxc151355 break;
6640ba2cbe9Sxc151355 }
6650ba2cbe9Sxc151355 switch (ic->ic_opmode) {
6660ba2cbe9Sxc151355 case IEEE80211_M_STA:
6670ba2cbe9Sxc151355 if (ic->ic_state != IEEE80211_S_AUTH)
6680ba2cbe9Sxc151355 return;
6690ba2cbe9Sxc151355 switch (seq) {
6700ba2cbe9Sxc151355 case IEEE80211_AUTH_SHARED_PASS:
6710ba2cbe9Sxc151355 if (in->in_challenge != NULL) {
6720ba2cbe9Sxc151355 kmem_free(in->in_challenge,
6730ba2cbe9Sxc151355 IEEE80211_CHALLENGE_LEN);
6740ba2cbe9Sxc151355 in->in_challenge = NULL;
6750ba2cbe9Sxc151355 }
6760ba2cbe9Sxc151355 if (status != 0) {
6770ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_DEBUG |
6780ba2cbe9Sxc151355 IEEE80211_MSG_AUTH,
6790ba2cbe9Sxc151355 "shared key auth failed (reason %d)\n",
6800ba2cbe9Sxc151355 status);
6810ba2cbe9Sxc151355 if (in != ic->ic_bss)
6820ba2cbe9Sxc151355 in->in_fails++;
6830ba2cbe9Sxc151355 return;
6840ba2cbe9Sxc151355 }
6850ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
6860ba2cbe9Sxc151355 ieee80211_new_state(ic, IEEE80211_S_ASSOC,
6870ba2cbe9Sxc151355 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
6880ba2cbe9Sxc151355 IEEE80211_LOCK(ic);
6890ba2cbe9Sxc151355 break;
6900ba2cbe9Sxc151355 case IEEE80211_AUTH_SHARED_CHALLENGE:
6910ba2cbe9Sxc151355 if (!ieee80211_alloc_challenge(in))
6920ba2cbe9Sxc151355 return;
6930ba2cbe9Sxc151355 bcopy(&challenge[2], in->in_challenge, challenge[1]);
6940ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
6950ba2cbe9Sxc151355 IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
6960ba2cbe9Sxc151355 seq + 1);
6970ba2cbe9Sxc151355 IEEE80211_LOCK(ic);
6980ba2cbe9Sxc151355 break;
6990ba2cbe9Sxc151355 default:
7000ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: "
7010ba2cbe9Sxc151355 "shared key auth: bad seq %d", seq);
7020ba2cbe9Sxc151355 return;
7030ba2cbe9Sxc151355 }
7040ba2cbe9Sxc151355 break;
7050ba2cbe9Sxc151355
7060ba2cbe9Sxc151355 default:
7070ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH,
7080ba2cbe9Sxc151355 "ieee80211_auth_shared: bad opmode %u\n",
7090ba2cbe9Sxc151355 ic->ic_opmode);
7100ba2cbe9Sxc151355 break;
7110ba2cbe9Sxc151355 }
7120ba2cbe9Sxc151355 return;
7130ba2cbe9Sxc151355 bad:
7140ba2cbe9Sxc151355 if (ic->ic_opmode == IEEE80211_M_STA) {
7150ba2cbe9Sxc151355 /*
7160ba2cbe9Sxc151355 * Kick the state machine. This short-circuits
7170ba2cbe9Sxc151355 * using the mgt frame timeout to trigger the
7180ba2cbe9Sxc151355 * state transition.
7190ba2cbe9Sxc151355 */
7200ba2cbe9Sxc151355 if (ic->ic_state == IEEE80211_S_AUTH) {
7210ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
7220ba2cbe9Sxc151355 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
7230ba2cbe9Sxc151355 IEEE80211_LOCK(ic);
7240ba2cbe9Sxc151355 }
7250ba2cbe9Sxc151355 }
7260ba2cbe9Sxc151355 }
7270ba2cbe9Sxc151355
728a399b765Szf162725 static int
iswpaoui(const uint8_t * frm)729a399b765Szf162725 iswpaoui(const uint8_t *frm)
730a399b765Szf162725 {
731b510adaeSfei feng - Sun Microsystems - Beijing China uint32_t c;
732b510adaeSfei feng - Sun Microsystems - Beijing China bcopy(frm + 2, &c, 4);
733b510adaeSfei feng - Sun Microsystems - Beijing China return (frm[1] > 3 && LE_32(c) == ((WPA_OUI_TYPE << 24) | WPA_OUI));
734a399b765Szf162725 }
735a399b765Szf162725
736e2cf88acSQuaker Fang #define LE_READ_4(p) \
737e2cf88acSQuaker Fang ((uint32_t) \
738e2cf88acSQuaker Fang ((((uint8_t *)(p))[0]) | (((uint8_t *)(p))[1] << 8) | \
739e2cf88acSQuaker Fang (((uint8_t *)(p))[2] << 16) | (((uint8_t *)(p))[3] << 24)))
740e2cf88acSQuaker Fang
741e2cf88acSQuaker Fang #define LE_READ_2(p) \
742e2cf88acSQuaker Fang ((uint16_t) \
743e2cf88acSQuaker Fang (((uint8_t *)(p))[0]) | (((uint8_t *)(p))[1] << 8))
744e2cf88acSQuaker Fang
745e2cf88acSQuaker Fang static int
iswmeoui(const uint8_t * frm)746e2cf88acSQuaker Fang iswmeoui(const uint8_t *frm)
747e2cf88acSQuaker Fang {
748e2cf88acSQuaker Fang return (frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI));
749e2cf88acSQuaker Fang }
750e2cf88acSQuaker Fang
751e2cf88acSQuaker Fang static int
iswmeparam(const uint8_t * frm)752e2cf88acSQuaker Fang iswmeparam(const uint8_t *frm)
753e2cf88acSQuaker Fang {
754e2cf88acSQuaker Fang return (frm[1] > 5 &&
755e2cf88acSQuaker Fang LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
756e2cf88acSQuaker Fang frm[6] == WME_PARAM_OUI_SUBTYPE);
757e2cf88acSQuaker Fang }
758e2cf88acSQuaker Fang
759e2cf88acSQuaker Fang static int
iswmeinfo(const uint8_t * frm)760e2cf88acSQuaker Fang iswmeinfo(const uint8_t *frm)
761e2cf88acSQuaker Fang {
762e2cf88acSQuaker Fang return (frm[1] > 5 &&
763e2cf88acSQuaker Fang LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) &&
764e2cf88acSQuaker Fang frm[6] == WME_INFO_OUI_SUBTYPE);
765e2cf88acSQuaker Fang }
766e2cf88acSQuaker Fang
767e2cf88acSQuaker Fang static int
ishtcapoui(const uint8_t * frm)768e2cf88acSQuaker Fang ishtcapoui(const uint8_t *frm)
769e2cf88acSQuaker Fang {
770e2cf88acSQuaker Fang return (frm[1] > 3 &&
771e2cf88acSQuaker Fang LE_READ_4(frm+2) == ((BCM_OUI_HTCAP<<24)|BCM_OUI));
772e2cf88acSQuaker Fang }
773e2cf88acSQuaker Fang
774e2cf88acSQuaker Fang static int
ishtinfooui(const uint8_t * frm)775e2cf88acSQuaker Fang ishtinfooui(const uint8_t *frm)
776e2cf88acSQuaker Fang {
777e2cf88acSQuaker Fang return (frm[1] > 3 &&
778e2cf88acSQuaker Fang LE_READ_4(frm+2) == ((BCM_OUI_HTINFO<<24)|BCM_OUI));
779e2cf88acSQuaker Fang }
780e2cf88acSQuaker Fang
781e2cf88acSQuaker Fang /* ARGSUSED */
782e2cf88acSQuaker Fang static int
ieee80211_parse_wmeparams(struct ieee80211com * ic,uint8_t * frm,const struct ieee80211_frame * wh)783e2cf88acSQuaker Fang ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm,
784e2cf88acSQuaker Fang const struct ieee80211_frame *wh)
785e2cf88acSQuaker Fang {
786e2cf88acSQuaker Fang #define MS(_v, _f) (((_v) & _f) >> _f##_S)
787e2cf88acSQuaker Fang struct ieee80211_wme_state *wme = &ic->ic_wme;
788e2cf88acSQuaker Fang uint_t len = frm[1];
789e2cf88acSQuaker Fang uint8_t qosinfo;
790e2cf88acSQuaker Fang int i;
791e2cf88acSQuaker Fang
792e2cf88acSQuaker Fang if (len < sizeof (struct ieee80211_wme_param) - 2) {
793e2cf88acSQuaker Fang ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
794e2cf88acSQuaker Fang "WME too short, len %u", len);
795e2cf88acSQuaker Fang return (-1);
796e2cf88acSQuaker Fang }
797e2cf88acSQuaker Fang qosinfo = frm[offsetof(struct ieee80211_wme_param, wme_qosInfo)];
798e2cf88acSQuaker Fang qosinfo &= WME_QOSINFO_COUNT;
799e2cf88acSQuaker Fang /* do proper check for wraparound */
800e2cf88acSQuaker Fang if (qosinfo == wme->wme_wmeChanParams.cap_info)
801e2cf88acSQuaker Fang return (0);
802e2cf88acSQuaker Fang frm += offsetof(struct ieee80211_wme_param, wme_acParams);
803e2cf88acSQuaker Fang for (i = 0; i < WME_NUM_AC; i++) {
804e2cf88acSQuaker Fang struct wmeParams *wmep =
805e2cf88acSQuaker Fang &wme->wme_wmeChanParams.cap_wmeParams[i];
806e2cf88acSQuaker Fang /* NB: ACI not used */
807e2cf88acSQuaker Fang wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
808e2cf88acSQuaker Fang wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
809e2cf88acSQuaker Fang wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
810e2cf88acSQuaker Fang wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
811e2cf88acSQuaker Fang wmep->wmep_txopLimit = LE_READ_2(frm+2);
812e2cf88acSQuaker Fang frm += 4;
813e2cf88acSQuaker Fang }
814e2cf88acSQuaker Fang wme->wme_wmeChanParams.cap_info = qosinfo;
815e2cf88acSQuaker Fang return (1);
816e2cf88acSQuaker Fang #undef MS
817e2cf88acSQuaker Fang }
818e2cf88acSQuaker Fang
8190ba2cbe9Sxc151355 /*
8200ba2cbe9Sxc151355 * Process a beacon/probe response frame.
8210ba2cbe9Sxc151355 * When the device is in station mode, create a node and add it
8220ba2cbe9Sxc151355 * to the node database for a new ESS or update node info if it's
8230ba2cbe9Sxc151355 * already there.
8240ba2cbe9Sxc151355 */
8250ba2cbe9Sxc151355 static void
ieee80211_recv_beacon(ieee80211com_t * ic,mblk_t * mp,struct ieee80211_node * in,int subtype,int rssi,uint32_t rstamp)8260ba2cbe9Sxc151355 ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
8270ba2cbe9Sxc151355 int subtype, int rssi, uint32_t rstamp)
8280ba2cbe9Sxc151355 {
8290ba2cbe9Sxc151355 ieee80211_impl_t *im = ic->ic_private;
8300ba2cbe9Sxc151355 struct ieee80211_frame *wh;
8310ba2cbe9Sxc151355 uint8_t *frm;
8320ba2cbe9Sxc151355 uint8_t *efrm; /* end of frame body */
8330ba2cbe9Sxc151355 struct ieee80211_scanparams scan;
8340ba2cbe9Sxc151355
8350ba2cbe9Sxc151355 wh = (struct ieee80211_frame *)mp->b_rptr;
8360ba2cbe9Sxc151355 frm = (uint8_t *)&wh[1];
8370ba2cbe9Sxc151355 efrm = (uint8_t *)mp->b_wptr;
8380ba2cbe9Sxc151355
839*216e0daaSQuaker Fang ic->ic_beaconmiss = 0; /* clear beacon miss counter */
840*216e0daaSQuaker Fang
8410ba2cbe9Sxc151355 /*
8420ba2cbe9Sxc151355 * We process beacon/probe response frames:
8430ba2cbe9Sxc151355 * o when scanning, or
8440ba2cbe9Sxc151355 * o station mode when associated (to collect state
8450ba2cbe9Sxc151355 * updates such as 802.11g slot time), or
8460ba2cbe9Sxc151355 * o adhoc mode (to discover neighbors)
8470ba2cbe9Sxc151355 * Frames otherwise received are discarded.
8480ba2cbe9Sxc151355 */
8490ba2cbe9Sxc151355 if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
8500ba2cbe9Sxc151355 (ic->ic_opmode == IEEE80211_M_STA && in->in_associd != 0) ||
8510ba2cbe9Sxc151355 ic->ic_opmode == IEEE80211_M_IBSS)) {
8520ba2cbe9Sxc151355 return;
8530ba2cbe9Sxc151355 }
8540ba2cbe9Sxc151355
8550ba2cbe9Sxc151355 /*
8560ba2cbe9Sxc151355 * beacon/probe response frame format
8570ba2cbe9Sxc151355 * [8] time stamp
8580ba2cbe9Sxc151355 * [2] beacon interval
8590ba2cbe9Sxc151355 * [2] capability information
8600ba2cbe9Sxc151355 * [tlv] ssid
8610ba2cbe9Sxc151355 * [tlv] supported rates
8620ba2cbe9Sxc151355 * [tlv] country information
8630ba2cbe9Sxc151355 * [tlv] parameter set (FH/DS)
8640ba2cbe9Sxc151355 * [tlv] erp information
8650ba2cbe9Sxc151355 * [tlv] extended supported rates
8660ba2cbe9Sxc151355 * [tlv] WME
8670ba2cbe9Sxc151355 * [tlv] WPA or RSN
868e2cf88acSQuaker Fang * [tlv] HT capabilities
869e2cf88acSQuaker Fang * [tlv] HT information
8700ba2cbe9Sxc151355 */
871ff3124efSff224033 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
872ff3124efSff224033 IEEE80211_BEACON_ELEM_MIN, return);
8730ba2cbe9Sxc151355 bzero(&scan, sizeof (scan));
8740ba2cbe9Sxc151355 scan.tstamp = frm;
8750ba2cbe9Sxc151355 frm += 8;
876b510adaeSfei feng - Sun Microsystems - Beijing China scan.bintval = LE_16(*(uint16_t *)frm);
8770ba2cbe9Sxc151355 frm += 2;
878b510adaeSfei feng - Sun Microsystems - Beijing China scan.capinfo = LE_16(*(uint16_t *)frm);
8790ba2cbe9Sxc151355 frm += 2;
8800ba2cbe9Sxc151355 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
8810ba2cbe9Sxc151355 scan.chan = scan.bchan;
8820ba2cbe9Sxc151355
8830ba2cbe9Sxc151355 while (frm < efrm) {
8840ba2cbe9Sxc151355 /* Agere element in beacon */
8850ba2cbe9Sxc151355 if ((*frm == IEEE80211_ELEMID_AGERE1) ||
8860ba2cbe9Sxc151355 (*frm == IEEE80211_ELEMID_AGERE2)) {
8870ba2cbe9Sxc151355 frm = efrm;
8880ba2cbe9Sxc151355 break;
8890ba2cbe9Sxc151355 }
8900ba2cbe9Sxc151355
891ff3124efSff224033 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), frm[1], return);
8920ba2cbe9Sxc151355 switch (*frm) {
8930ba2cbe9Sxc151355 case IEEE80211_ELEMID_SSID:
8940ba2cbe9Sxc151355 scan.ssid = frm;
8950ba2cbe9Sxc151355 break;
8960ba2cbe9Sxc151355 case IEEE80211_ELEMID_RATES:
8970ba2cbe9Sxc151355 scan.rates = frm;
8980ba2cbe9Sxc151355 break;
8990ba2cbe9Sxc151355 case IEEE80211_ELEMID_COUNTRY:
9000ba2cbe9Sxc151355 scan.country = frm;
9010ba2cbe9Sxc151355 break;
9020ba2cbe9Sxc151355 case IEEE80211_ELEMID_FHPARMS:
9030ba2cbe9Sxc151355 if (ic->ic_phytype == IEEE80211_T_FH) {
9040ba2cbe9Sxc151355 scan.fhdwell = LE_16(*(uint16_t *)(frm + 2));
9050ba2cbe9Sxc151355 scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
9060ba2cbe9Sxc151355 scan.fhindex = frm[6];
9070ba2cbe9Sxc151355 scan.phytype = IEEE80211_T_FH;
9080ba2cbe9Sxc151355 }
9090ba2cbe9Sxc151355 break;
9100ba2cbe9Sxc151355 case IEEE80211_ELEMID_DSPARMS:
9110ba2cbe9Sxc151355 if (ic->ic_phytype != IEEE80211_T_FH) {
9120ba2cbe9Sxc151355 scan.chan = frm[2];
9130ba2cbe9Sxc151355 scan.phytype = IEEE80211_T_DS;
9140ba2cbe9Sxc151355 }
9150ba2cbe9Sxc151355 break;
9160ba2cbe9Sxc151355 case IEEE80211_ELEMID_TIM:
9170ba2cbe9Sxc151355 scan.tim = frm;
918ff3124efSff224033 scan.timoff = _PTRDIFF(frm, mp->b_rptr);
9190ba2cbe9Sxc151355 break;
9200ba2cbe9Sxc151355 case IEEE80211_ELEMID_IBSSPARMS:
9210ba2cbe9Sxc151355 break;
9220ba2cbe9Sxc151355 case IEEE80211_ELEMID_XRATES:
9230ba2cbe9Sxc151355 scan.xrates = frm;
9240ba2cbe9Sxc151355 break;
9250ba2cbe9Sxc151355 case IEEE80211_ELEMID_ERP:
9260ba2cbe9Sxc151355 if (frm[1] != 1) {
9270ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ELEMID,
9280ba2cbe9Sxc151355 "ieee80211_recv_mgmt: ignore %s, "
9290ba2cbe9Sxc151355 "invalid ERP element; "
9300ba2cbe9Sxc151355 "length %u, expecting 1\n",
9310ba2cbe9Sxc151355 IEEE80211_SUBTYPE_NAME(subtype),
9320ba2cbe9Sxc151355 frm[1]);
9330ba2cbe9Sxc151355 break;
9340ba2cbe9Sxc151355 }
9350ba2cbe9Sxc151355 scan.erp = frm[2];
9360ba2cbe9Sxc151355 scan.phytype = IEEE80211_T_OFDM;
9370ba2cbe9Sxc151355 break;
938e2cf88acSQuaker Fang case IEEE80211_ELEMID_HTCAP:
939e2cf88acSQuaker Fang scan.htcap = frm;
940e2cf88acSQuaker Fang break;
9410ba2cbe9Sxc151355 case IEEE80211_ELEMID_RSN:
9420ba2cbe9Sxc151355 scan.wpa = frm;
9430ba2cbe9Sxc151355 break;
944e2cf88acSQuaker Fang case IEEE80211_ELEMID_HTINFO:
945e2cf88acSQuaker Fang scan.htinfo = frm;
946e2cf88acSQuaker Fang break;
947a399b765Szf162725 case IEEE80211_ELEMID_VENDOR:
948a399b765Szf162725 if (iswpaoui(frm))
949a399b765Szf162725 scan.wpa = frm; /* IEEE802.11i D3.0 */
950e2cf88acSQuaker Fang else if (iswmeparam(frm) || iswmeinfo(frm))
951e2cf88acSQuaker Fang scan.wme = frm;
952e2cf88acSQuaker Fang else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
953e2cf88acSQuaker Fang /*
954e2cf88acSQuaker Fang * Accept pre-draft HT ie's if the
955e2cf88acSQuaker Fang * standard ones have not been seen.
956e2cf88acSQuaker Fang */
957e2cf88acSQuaker Fang if (ishtcapoui(frm)) {
958e2cf88acSQuaker Fang if (scan.htcap == NULL)
959e2cf88acSQuaker Fang scan.htcap = frm;
960e2cf88acSQuaker Fang } else if (ishtinfooui(frm)) {
961e2cf88acSQuaker Fang if (scan.htinfo == NULL)
962e2cf88acSQuaker Fang scan.htinfo = frm;
963e2cf88acSQuaker Fang }
964e2cf88acSQuaker Fang }
965a399b765Szf162725 break;
9660ba2cbe9Sxc151355 default:
9670ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ELEMID,
9680ba2cbe9Sxc151355 "ieee80211_recv_mgmt: ignore %s,"
9690ba2cbe9Sxc151355 "unhandled id %u, len %u, totallen %u",
9700ba2cbe9Sxc151355 IEEE80211_SUBTYPE_NAME(subtype),
9710ba2cbe9Sxc151355 *frm, frm[1],
972ff3124efSff224033 MBLKL(mp));
9730ba2cbe9Sxc151355 break;
9740ba2cbe9Sxc151355 }
9750ba2cbe9Sxc151355 /* frm[1] - component length */
9760ba2cbe9Sxc151355 frm += IEEE80211_ELEM_LEN(frm[1]);
9770ba2cbe9Sxc151355 }
9780ba2cbe9Sxc151355 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE, return);
9790ba2cbe9Sxc151355 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return);
9800ba2cbe9Sxc151355 if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) {
9810ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
9820ba2cbe9Sxc151355 "ieee80211_recv_mgmt: ignore %s ,"
9830ba2cbe9Sxc151355 "invalid channel %u\n",
9840ba2cbe9Sxc151355 IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
9850ba2cbe9Sxc151355 return;
9860ba2cbe9Sxc151355 }
9870ba2cbe9Sxc151355 if (scan.chan != scan.bchan &&
9880ba2cbe9Sxc151355 ic->ic_phytype != IEEE80211_T_FH) {
9890ba2cbe9Sxc151355 /*
9900ba2cbe9Sxc151355 * Frame was received on a channel different from the
9910ba2cbe9Sxc151355 * one indicated in the DS params element id;
9920ba2cbe9Sxc151355 * silently discard it.
9930ba2cbe9Sxc151355 *
9940ba2cbe9Sxc151355 * NB: this can happen due to signal leakage.
9950ba2cbe9Sxc151355 * But we should take it for FH phy because
9960ba2cbe9Sxc151355 * the rssi value should be correct even for
9970ba2cbe9Sxc151355 * different hop pattern in FH.
9980ba2cbe9Sxc151355 */
9990ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ELEMID,
10000ba2cbe9Sxc151355 "ieee80211_recv_mgmt: ignore %s ,"
10010ba2cbe9Sxc151355 "phytype %u channel %u marked for %u\n",
10020ba2cbe9Sxc151355 IEEE80211_SUBTYPE_NAME(subtype),
10030ba2cbe9Sxc151355 ic->ic_phytype, scan.bchan, scan.chan);
10040ba2cbe9Sxc151355 return;
10050ba2cbe9Sxc151355 }
10060ba2cbe9Sxc151355 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
10070ba2cbe9Sxc151355 scan.bintval <= IEEE80211_BINTVAL_MAX)) {
10080ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
10090ba2cbe9Sxc151355 "ieee80211_recv_mgmt: ignore %s ,"
10100ba2cbe9Sxc151355 "bogus beacon interval %u\n",
10110ba2cbe9Sxc151355 IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
10120ba2cbe9Sxc151355 return;
10130ba2cbe9Sxc151355 }
1014e2cf88acSQuaker Fang /*
1015e2cf88acSQuaker Fang * Process HT ie's. This is complicated by our
1016e2cf88acSQuaker Fang * accepting both the standard ie's and the pre-draft
1017e2cf88acSQuaker Fang * vendor OUI ie's that some vendors still use/require.
1018e2cf88acSQuaker Fang */
1019e2cf88acSQuaker Fang if (scan.htcap != NULL) {
1020e2cf88acSQuaker Fang IEEE80211_VERIFY_LENGTH(scan.htcap[1],
1021e2cf88acSQuaker Fang scan.htcap[0] == IEEE80211_ELEMID_VENDOR ?
1022e2cf88acSQuaker Fang 4 + sizeof (struct ieee80211_ie_htcap) - 2 :
1023e2cf88acSQuaker Fang sizeof (struct ieee80211_ie_htcap) - 2,
1024e2cf88acSQuaker Fang scan.htcap = NULL);
1025e2cf88acSQuaker Fang }
1026e2cf88acSQuaker Fang if (scan.htinfo != NULL) {
1027e2cf88acSQuaker Fang IEEE80211_VERIFY_LENGTH(scan.htinfo[1],
1028e2cf88acSQuaker Fang scan.htinfo[0] == IEEE80211_ELEMID_VENDOR ?
1029e2cf88acSQuaker Fang 4 + sizeof (struct ieee80211_ie_htinfo) - 2 :
1030e2cf88acSQuaker Fang sizeof (struct ieee80211_ie_htinfo) - 2,
1031e2cf88acSQuaker Fang scan.htinfo = NULL);
1032e2cf88acSQuaker Fang }
10330ba2cbe9Sxc151355
10340ba2cbe9Sxc151355 /*
10350ba2cbe9Sxc151355 * When operating in station mode, check for state updates.
10360ba2cbe9Sxc151355 * Be careful to ignore beacons received while doing a
10370ba2cbe9Sxc151355 * background scan. We consider only 11g/WMM stuff right now.
10380ba2cbe9Sxc151355 */
10390ba2cbe9Sxc151355 if (ic->ic_opmode == IEEE80211_M_STA &&
10400ba2cbe9Sxc151355 in->in_associd != 0 &&
10410ba2cbe9Sxc151355 (!(ic->ic_flags & IEEE80211_F_SCAN) ||
10420ba2cbe9Sxc151355 IEEE80211_ADDR_EQ(wh->i_addr2, in->in_bssid))) {
10430ba2cbe9Sxc151355 /* record tsf of last beacon */
10440ba2cbe9Sxc151355 bcopy(scan.tstamp, in->in_tstamp.data,
10450ba2cbe9Sxc151355 sizeof (in->in_tstamp));
10460ba2cbe9Sxc151355 /* count beacon frame for s/w bmiss handling */
10470ba2cbe9Sxc151355 im->im_swbmiss_count++;
10480ba2cbe9Sxc151355 im->im_bmiss_count = 0;
10490ba2cbe9Sxc151355
10500ba2cbe9Sxc151355 if ((in->in_capinfo ^ scan.capinfo) &
10510ba2cbe9Sxc151355 IEEE80211_CAPINFO_SHORT_SLOTTIME) {
10520ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ASSOC,
10530ba2cbe9Sxc151355 "ieee80211_recv_mgmt: "
10540ba2cbe9Sxc151355 "[%s] cap change: before 0x%x, now 0x%x\n",
10550ba2cbe9Sxc151355 ieee80211_macaddr_sprintf(wh->i_addr2),
10560ba2cbe9Sxc151355 in->in_capinfo, scan.capinfo);
10570ba2cbe9Sxc151355 /*
10580ba2cbe9Sxc151355 * NB: we assume short preamble doesn't
10590ba2cbe9Sxc151355 * change dynamically
10600ba2cbe9Sxc151355 */
10610ba2cbe9Sxc151355 ieee80211_set_shortslottime(ic,
10620ba2cbe9Sxc151355 ic->ic_curmode == IEEE80211_MODE_11A ||
10630ba2cbe9Sxc151355 (scan.capinfo &
10640ba2cbe9Sxc151355 IEEE80211_CAPINFO_SHORT_SLOTTIME));
10650ba2cbe9Sxc151355 in->in_capinfo = scan.capinfo;
10660ba2cbe9Sxc151355 }
1067e2cf88acSQuaker Fang if (scan.wme != NULL &&
1068e2cf88acSQuaker Fang (in->in_flags & IEEE80211_NODE_QOS) &&
1069e2cf88acSQuaker Fang ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0) {
1070e2cf88acSQuaker Fang ieee80211_wme_updateparams(ic);
1071e2cf88acSQuaker Fang }
1072e2cf88acSQuaker Fang if (scan.htcap != NULL)
1073e2cf88acSQuaker Fang ieee80211_parse_htcap(in, scan.htcap);
1074e2cf88acSQuaker Fang if (scan.htinfo != NULL) {
1075e2cf88acSQuaker Fang ieee80211_parse_htinfo(in, scan.htinfo);
1076e2cf88acSQuaker Fang if (in->in_chan != ic->ic_curchan) {
1077e2cf88acSQuaker Fang /*
1078e2cf88acSQuaker Fang * Channel has been adjusted based on
1079e2cf88acSQuaker Fang * negotiated HT parameters; force the
1080e2cf88acSQuaker Fang * channel state to follow.
1081e2cf88acSQuaker Fang */
1082e2cf88acSQuaker Fang ieee80211_setcurchan(ic, in->in_chan);
1083e2cf88acSQuaker Fang }
1084e2cf88acSQuaker Fang }
10850ba2cbe9Sxc151355 if (scan.tim != NULL) {
10860ba2cbe9Sxc151355 struct ieee80211_tim_ie *ie;
10870ba2cbe9Sxc151355
10880ba2cbe9Sxc151355 ie = (struct ieee80211_tim_ie *)scan.tim;
10890ba2cbe9Sxc151355 in->in_dtim_count = ie->tim_count;
10900ba2cbe9Sxc151355 in->in_dtim_period = ie->tim_period;
10910ba2cbe9Sxc151355 }
10920ba2cbe9Sxc151355 if (ic->ic_flags & IEEE80211_F_SCAN) {
10930ba2cbe9Sxc151355 ieee80211_add_scan(ic, &scan, wh, subtype, rssi,
10940ba2cbe9Sxc151355 rstamp);
10950ba2cbe9Sxc151355 }
10960ba2cbe9Sxc151355 return;
10970ba2cbe9Sxc151355 }
10980ba2cbe9Sxc151355 /*
10990ba2cbe9Sxc151355 * If scanning, just pass information to the scan module.
11000ba2cbe9Sxc151355 */
11010ba2cbe9Sxc151355 if (ic->ic_flags & IEEE80211_F_SCAN) {
11020ba2cbe9Sxc151355 ieee80211_add_scan(ic, &scan, wh, subtype, rssi, rstamp);
11030ba2cbe9Sxc151355 return;
11040ba2cbe9Sxc151355 }
11050ba2cbe9Sxc151355
110619d332feSfei feng - Sun Microsystems - Beijing China if (ic->ic_opmode == IEEE80211_M_IBSS &&
110719d332feSfei feng - Sun Microsystems - Beijing China scan.capinfo & IEEE80211_CAPINFO_IBSS) {
11080ba2cbe9Sxc151355 if (!IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
11090ba2cbe9Sxc151355 /*
11100ba2cbe9Sxc151355 * Create a new entry in the neighbor table.
11110ba2cbe9Sxc151355 */
11120ba2cbe9Sxc151355 in = ieee80211_add_neighbor(ic, wh, &scan);
11130ba2cbe9Sxc151355 } else {
11140ba2cbe9Sxc151355 /*
111519d332feSfei feng - Sun Microsystems - Beijing China * Copy data from beacon to neighbor table.
111619d332feSfei feng - Sun Microsystems - Beijing China * Some of this information might change after
111719d332feSfei feng - Sun Microsystems - Beijing China * ieee80211_add_neighbor(), so we just copy
111819d332feSfei feng - Sun Microsystems - Beijing China * everything over to be safe.
11190ba2cbe9Sxc151355 */
112019d332feSfei feng - Sun Microsystems - Beijing China ieee80211_init_neighbor(in, wh, &scan);
11210ba2cbe9Sxc151355 }
11220ba2cbe9Sxc151355 if (in != NULL) {
11230ba2cbe9Sxc151355 in->in_rssi = (uint8_t)rssi;
11240ba2cbe9Sxc151355 in->in_rstamp = rstamp;
11250ba2cbe9Sxc151355 }
11260ba2cbe9Sxc151355 }
11270ba2cbe9Sxc151355 }
11280ba2cbe9Sxc151355
11290ba2cbe9Sxc151355 /*
11300ba2cbe9Sxc151355 * Perform input processing for 802.11 management frames.
11310ba2cbe9Sxc151355 * It's the default ic_recv_mgmt callback function for the interface
11320ba2cbe9Sxc151355 * softc, ic. Tipically ic_recv_mgmt is called within ieee80211_input()
11330ba2cbe9Sxc151355 */
11340ba2cbe9Sxc151355 void
ieee80211_recv_mgmt(ieee80211com_t * ic,mblk_t * mp,struct ieee80211_node * in,int subtype,int rssi,uint32_t rstamp)11350ba2cbe9Sxc151355 ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
11360ba2cbe9Sxc151355 int subtype, int rssi, uint32_t rstamp)
11370ba2cbe9Sxc151355 {
11380ba2cbe9Sxc151355 struct ieee80211_frame *wh;
11390ba2cbe9Sxc151355 uint8_t *frm; /* pointer to start of the frame */
11400ba2cbe9Sxc151355 uint8_t *efrm; /* pointer to end of the frame */
11410ba2cbe9Sxc151355 uint8_t *ssid;
11420ba2cbe9Sxc151355 uint8_t *rates;
11430ba2cbe9Sxc151355 uint8_t *xrates; /* extended rates */
1144e2cf88acSQuaker Fang uint8_t *wme;
1145e2cf88acSQuaker Fang uint8_t *htcap, *htinfo;
11460ba2cbe9Sxc151355 boolean_t allocbs = B_FALSE;
11470ba2cbe9Sxc151355 uint8_t rate;
11480ba2cbe9Sxc151355 uint16_t algo; /* authentication algorithm */
11490ba2cbe9Sxc151355 uint16_t seq; /* sequence no */
11500ba2cbe9Sxc151355 uint16_t status;
11510ba2cbe9Sxc151355 uint16_t capinfo;
11520ba2cbe9Sxc151355 uint16_t associd; /* association ID */
1153e2cf88acSQuaker Fang const struct ieee80211_action *ia;
11540ba2cbe9Sxc151355
11550ba2cbe9Sxc151355 IEEE80211_LOCK(ic);
11560ba2cbe9Sxc151355 wh = (struct ieee80211_frame *)mp->b_rptr;
11570ba2cbe9Sxc151355 frm = (uint8_t *)&wh[1];
11580ba2cbe9Sxc151355 efrm = (uint8_t *)mp->b_wptr;
11590ba2cbe9Sxc151355 switch (subtype) {
11600ba2cbe9Sxc151355 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
11610ba2cbe9Sxc151355 case IEEE80211_FC0_SUBTYPE_BEACON:
11620ba2cbe9Sxc151355 ieee80211_recv_beacon(ic, mp, in, subtype, rssi, rstamp);
11630ba2cbe9Sxc151355 break;
11640ba2cbe9Sxc151355
11650ba2cbe9Sxc151355 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
11660ba2cbe9Sxc151355 if (ic->ic_opmode == IEEE80211_M_STA ||
11670ba2cbe9Sxc151355 ic->ic_state != IEEE80211_S_RUN ||
11680ba2cbe9Sxc151355 IEEE80211_IS_MULTICAST(wh->i_addr2)) {
11690ba2cbe9Sxc151355 break;
11700ba2cbe9Sxc151355 }
11710ba2cbe9Sxc151355
11720ba2cbe9Sxc151355 /*
11730ba2cbe9Sxc151355 * prreq frame format
11740ba2cbe9Sxc151355 * [tlv] ssid
11750ba2cbe9Sxc151355 * [tlv] supported rates
11760ba2cbe9Sxc151355 * [tlv] extended supported rates
11770ba2cbe9Sxc151355 */
11780ba2cbe9Sxc151355 ssid = rates = xrates = NULL;
11790ba2cbe9Sxc151355 while (frm < efrm) {
1180ff3124efSff224033 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1181ff3124efSff224033 frm[1], goto out);
11820ba2cbe9Sxc151355 switch (*frm) {
11830ba2cbe9Sxc151355 case IEEE80211_ELEMID_SSID:
11840ba2cbe9Sxc151355 ssid = frm;
11850ba2cbe9Sxc151355 break;
11860ba2cbe9Sxc151355 case IEEE80211_ELEMID_RATES:
11870ba2cbe9Sxc151355 rates = frm;
11880ba2cbe9Sxc151355 break;
11890ba2cbe9Sxc151355 case IEEE80211_ELEMID_XRATES:
11900ba2cbe9Sxc151355 xrates = frm;
11910ba2cbe9Sxc151355 break;
11920ba2cbe9Sxc151355 }
11930ba2cbe9Sxc151355 frm += frm[1] + 2;
11940ba2cbe9Sxc151355 }
11950ba2cbe9Sxc151355 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
119619d332feSfei feng - Sun Microsystems - Beijing China if (xrates != NULL) {
119719d332feSfei feng - Sun Microsystems - Beijing China IEEE80211_VERIFY_ELEMENT(xrates,
119819d332feSfei feng - Sun Microsystems - Beijing China IEEE80211_RATE_MAXSIZE - rates[1], break);
119919d332feSfei feng - Sun Microsystems - Beijing China }
12000ba2cbe9Sxc151355 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, break);
12010ba2cbe9Sxc151355 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break);
120219d332feSfei feng - Sun Microsystems - Beijing China if (ic->ic_flags & IEEE80211_F_HIDESSID) {
120319d332feSfei feng - Sun Microsystems - Beijing China if (ssid == NULL || ssid[1] == 0) {
12040ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_INPUT,
12050ba2cbe9Sxc151355 "ieee80211_recv_mgmt: ignore %s, "
12060ba2cbe9Sxc151355 "no ssid with ssid suppression enabled",
12070ba2cbe9Sxc151355 IEEE80211_SUBTYPE_NAME(subtype));
12080ba2cbe9Sxc151355 break;
12090ba2cbe9Sxc151355 }
121019d332feSfei feng - Sun Microsystems - Beijing China }
12110ba2cbe9Sxc151355
12120ba2cbe9Sxc151355 if (in == ic->ic_bss) {
12130ba2cbe9Sxc151355 if (ic->ic_opmode != IEEE80211_M_IBSS) {
12140ba2cbe9Sxc151355 in = ieee80211_tmp_node(ic, wh->i_addr2);
12150ba2cbe9Sxc151355 allocbs = B_TRUE;
12160ba2cbe9Sxc151355 } else if (!IEEE80211_ADDR_EQ(wh->i_addr2,
12170ba2cbe9Sxc151355 in->in_macaddr)) {
12180ba2cbe9Sxc151355 /*
12190ba2cbe9Sxc151355 * Cannot tell if the sender is operating
12200ba2cbe9Sxc151355 * in ibss mode. But we need a new node to
12210ba2cbe9Sxc151355 * send the response so blindly add them to the
12220ba2cbe9Sxc151355 * neighbor table.
12230ba2cbe9Sxc151355 */
12240ba2cbe9Sxc151355 in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
12250ba2cbe9Sxc151355 wh->i_addr2);
12260ba2cbe9Sxc151355 }
12270ba2cbe9Sxc151355 if (in == NULL)
12280ba2cbe9Sxc151355 break;
12290ba2cbe9Sxc151355 }
12300ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: "
12310ba2cbe9Sxc151355 "[%s] recv probe req\n",
12320ba2cbe9Sxc151355 ieee80211_macaddr_sprintf(wh->i_addr2));
12330ba2cbe9Sxc151355 in->in_rssi = (uint8_t)rssi;
12340ba2cbe9Sxc151355 in->in_rstamp = rstamp;
12350ba2cbe9Sxc151355 /*
12360ba2cbe9Sxc151355 * Adjust and check station's rate list with device's
12370ba2cbe9Sxc151355 * supported rate. Send back response if there is at
12380ba2cbe9Sxc151355 * least one rate or the fixed rate(if being set) is
12390ba2cbe9Sxc151355 * supported by both station and the device
12400ba2cbe9Sxc151355 */
12410ba2cbe9Sxc151355 rate = ieee80211_setup_rates(in, rates, xrates,
12420ba2cbe9Sxc151355 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
12430ba2cbe9Sxc151355 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
12440ba2cbe9Sxc151355 if (rate & IEEE80211_RATE_BASIC) {
12450ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt"
12460ba2cbe9Sxc151355 "%s recv'd rate set invalid",
12470ba2cbe9Sxc151355 IEEE80211_SUBTYPE_NAME(subtype));
12480ba2cbe9Sxc151355 } else {
12490ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
12500ba2cbe9Sxc151355 IEEE80211_SEND_MGMT(ic, in,
12510ba2cbe9Sxc151355 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
12520ba2cbe9Sxc151355 IEEE80211_LOCK(ic);
12530ba2cbe9Sxc151355 }
12540ba2cbe9Sxc151355 if (allocbs) {
12550ba2cbe9Sxc151355 /*
12560ba2cbe9Sxc151355 * Temporary node created just to send a
12570ba2cbe9Sxc151355 * response, reclaim immediately.
12580ba2cbe9Sxc151355 */
12590ba2cbe9Sxc151355 ieee80211_free_node(in);
12600ba2cbe9Sxc151355 }
12610ba2cbe9Sxc151355 break;
12620ba2cbe9Sxc151355
12630ba2cbe9Sxc151355 case IEEE80211_FC0_SUBTYPE_AUTH:
12640ba2cbe9Sxc151355 /*
12650ba2cbe9Sxc151355 * auth frame format
12660ba2cbe9Sxc151355 * [2] algorithm
12670ba2cbe9Sxc151355 * [2] sequence
12680ba2cbe9Sxc151355 * [2] status
12690ba2cbe9Sxc151355 * [tlv*] challenge
12700ba2cbe9Sxc151355 */
1271ff3124efSff224033 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1272ff3124efSff224033 IEEE80211_AUTH_ELEM_MIN, break);
1273b510adaeSfei feng - Sun Microsystems - Beijing China algo = LE_16(*(uint16_t *)frm);
1274b510adaeSfei feng - Sun Microsystems - Beijing China seq = LE_16(*(uint16_t *)(frm + 2));
1275b510adaeSfei feng - Sun Microsystems - Beijing China status = LE_16(*(uint16_t *)(frm + 4));
12760ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: "
12770ba2cbe9Sxc151355 "[%s] recv auth frame with algorithm %d seq %d\n",
12780ba2cbe9Sxc151355 ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
12790ba2cbe9Sxc151355
12800ba2cbe9Sxc151355 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
12810ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
12820ba2cbe9Sxc151355 "ieee80211_recv_mgmt: ignore auth, %s\n",
12830ba2cbe9Sxc151355 "TKIP countermeasures enabled");
12840ba2cbe9Sxc151355 break;
12850ba2cbe9Sxc151355 }
12860ba2cbe9Sxc151355 switch (algo) {
12870ba2cbe9Sxc151355 case IEEE80211_AUTH_ALG_SHARED:
12880ba2cbe9Sxc151355 ieee80211_auth_shared(ic, wh, frm + 6, efrm, in,
12890ba2cbe9Sxc151355 seq, status);
12900ba2cbe9Sxc151355 break;
12910ba2cbe9Sxc151355 case IEEE80211_AUTH_ALG_OPEN:
12920ba2cbe9Sxc151355 ieee80211_auth_open(ic, wh, in, seq, status);
12930ba2cbe9Sxc151355 break;
12940ba2cbe9Sxc151355 default:
12950ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
12960ba2cbe9Sxc151355 "ignore auth, unsupported alg %d", algo);
12970ba2cbe9Sxc151355 break;
12980ba2cbe9Sxc151355 }
12990ba2cbe9Sxc151355 break;
13000ba2cbe9Sxc151355
13010ba2cbe9Sxc151355 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
13020ba2cbe9Sxc151355 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
13030ba2cbe9Sxc151355 if (ic->ic_opmode != IEEE80211_M_STA ||
13040ba2cbe9Sxc151355 ic->ic_state != IEEE80211_S_ASSOC)
13050ba2cbe9Sxc151355 break;
13060ba2cbe9Sxc151355
13070ba2cbe9Sxc151355 /*
13080ba2cbe9Sxc151355 * asresp frame format
13090ba2cbe9Sxc151355 * [2] capability information
13100ba2cbe9Sxc151355 * [2] status
13110ba2cbe9Sxc151355 * [2] association ID
13120ba2cbe9Sxc151355 * [tlv] supported rates
13130ba2cbe9Sxc151355 * [tlv] extended supported rates
13140ba2cbe9Sxc151355 * [tlv] WME
1315e2cf88acSQuaker Fang * [tlv] HT capabilities
1316e2cf88acSQuaker Fang * [tlv] HT info
13170ba2cbe9Sxc151355 */
1318ff3124efSff224033 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
13190ba2cbe9Sxc151355 IEEE80211_ASSOC_RESP_ELEM_MIN, break);
13200ba2cbe9Sxc151355 in = ic->ic_bss;
1321b510adaeSfei feng - Sun Microsystems - Beijing China capinfo = LE_16(*(uint16_t *)frm);
13220ba2cbe9Sxc151355 frm += 2;
1323b510adaeSfei feng - Sun Microsystems - Beijing China status = LE_16(*(uint16_t *)frm);
13240ba2cbe9Sxc151355 frm += 2;
13250ba2cbe9Sxc151355 if (status != 0) {
13260ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ASSOC,
13270ba2cbe9Sxc151355 "assoc failed (reason %d)\n", status);
13280ba2cbe9Sxc151355 in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2);
13290ba2cbe9Sxc151355 if (in != NULL) {
13300ba2cbe9Sxc151355 in->in_fails++;
13310ba2cbe9Sxc151355 ieee80211_free_node(in);
13320ba2cbe9Sxc151355 }
13330ba2cbe9Sxc151355 break;
13340ba2cbe9Sxc151355 }
1335b510adaeSfei feng - Sun Microsystems - Beijing China associd = LE_16(*(uint16_t *)frm);
13360ba2cbe9Sxc151355 frm += 2;
13370ba2cbe9Sxc151355
1338e2cf88acSQuaker Fang rates = xrates = wme = htcap = htinfo = NULL;
13390ba2cbe9Sxc151355 while (frm < efrm) {
13400ba2cbe9Sxc151355 /*
13410ba2cbe9Sxc151355 * Do not discard frames containing proprietary Agere
13420ba2cbe9Sxc151355 * elements 128 and 129, as the reported element length
13430ba2cbe9Sxc151355 * is often wrong. Skip rest of the frame, since we can
13440ba2cbe9Sxc151355 * not rely on the given element length making it
13450ba2cbe9Sxc151355 * impossible to know where the next element starts
13460ba2cbe9Sxc151355 */
13470ba2cbe9Sxc151355 if ((*frm == IEEE80211_ELEMID_AGERE1) ||
13480ba2cbe9Sxc151355 (*frm == IEEE80211_ELEMID_AGERE2)) {
13490ba2cbe9Sxc151355 frm = efrm;
13500ba2cbe9Sxc151355 break;
13510ba2cbe9Sxc151355 }
13520ba2cbe9Sxc151355
1353ff3124efSff224033 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1354ff3124efSff224033 frm[1], goto out);
13550ba2cbe9Sxc151355 switch (*frm) {
13560ba2cbe9Sxc151355 case IEEE80211_ELEMID_RATES:
13570ba2cbe9Sxc151355 rates = frm;
13580ba2cbe9Sxc151355 break;
13590ba2cbe9Sxc151355 case IEEE80211_ELEMID_XRATES:
13600ba2cbe9Sxc151355 xrates = frm;
13610ba2cbe9Sxc151355 break;
1362e2cf88acSQuaker Fang case IEEE80211_ELEMID_HTCAP:
1363e2cf88acSQuaker Fang htcap = frm;
1364e2cf88acSQuaker Fang break;
1365e2cf88acSQuaker Fang case IEEE80211_ELEMID_HTINFO:
1366e2cf88acSQuaker Fang htinfo = frm;
1367e2cf88acSQuaker Fang break;
1368e2cf88acSQuaker Fang case IEEE80211_ELEMID_VENDOR:
1369e2cf88acSQuaker Fang if (iswmeoui(frm))
1370e2cf88acSQuaker Fang wme = frm;
1371e2cf88acSQuaker Fang else if (ic->ic_flags_ext &
1372e2cf88acSQuaker Fang IEEE80211_FEXT_HTCOMPAT) {
1373e2cf88acSQuaker Fang /*
1374e2cf88acSQuaker Fang * Accept pre-draft HT ie's if the
1375e2cf88acSQuaker Fang * standard ones have not been seen.
1376e2cf88acSQuaker Fang */
1377e2cf88acSQuaker Fang if (ishtcapoui(frm)) {
1378e2cf88acSQuaker Fang if (htcap == NULL)
1379e2cf88acSQuaker Fang htcap = frm;
1380e2cf88acSQuaker Fang } else if (ishtinfooui(frm)) {
1381e2cf88acSQuaker Fang if (htinfo == NULL)
1382e2cf88acSQuaker Fang htinfo = frm;
1383e2cf88acSQuaker Fang }
1384e2cf88acSQuaker Fang }
1385e2cf88acSQuaker Fang break;
13860ba2cbe9Sxc151355 }
13870ba2cbe9Sxc151355 frm += frm[1] + 2;
13880ba2cbe9Sxc151355 }
13890ba2cbe9Sxc151355
13900ba2cbe9Sxc151355 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
13910ba2cbe9Sxc151355 /*
13920ba2cbe9Sxc151355 * Adjust and check AP's rate list with device's
13930ba2cbe9Sxc151355 * supported rate. Re-start scan if no rate is or the
13940ba2cbe9Sxc151355 * fixed rate(if being set) cannot be supported by
13950ba2cbe9Sxc151355 * either AP or the device.
13960ba2cbe9Sxc151355 */
13970ba2cbe9Sxc151355 rate = ieee80211_setup_rates(in, rates, xrates,
13980ba2cbe9Sxc151355 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
13990ba2cbe9Sxc151355 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
14000ba2cbe9Sxc151355 if (rate & IEEE80211_RATE_BASIC) {
14010ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ASSOC,
14020ba2cbe9Sxc151355 "assoc failed (rate set mismatch)\n");
14030ba2cbe9Sxc151355 if (in != ic->ic_bss)
14040ba2cbe9Sxc151355 in->in_fails++;
14050ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
14060ba2cbe9Sxc151355 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
14070ba2cbe9Sxc151355 return;
14080ba2cbe9Sxc151355 }
14090ba2cbe9Sxc151355
14100ba2cbe9Sxc151355 in->in_capinfo = capinfo;
14110ba2cbe9Sxc151355 in->in_associd = associd;
1412e2cf88acSQuaker Fang if (wme != NULL &&
1413e2cf88acSQuaker Fang ieee80211_parse_wmeparams(ic, wme, wh) >= 0) {
1414e2cf88acSQuaker Fang in->in_flags |= IEEE80211_NODE_QOS;
1415e2cf88acSQuaker Fang ieee80211_wme_updateparams(ic);
1416e2cf88acSQuaker Fang } else {
14170ba2cbe9Sxc151355 in->in_flags &= ~IEEE80211_NODE_QOS;
1418e2cf88acSQuaker Fang }
1419e2cf88acSQuaker Fang /*
1420e2cf88acSQuaker Fang * Setup HT state according to the negotiation.
1421e2cf88acSQuaker Fang */
1422e2cf88acSQuaker Fang if ((ic->ic_htcaps & IEEE80211_HTC_HT) &&
1423e2cf88acSQuaker Fang htcap != NULL && htinfo != NULL) {
1424e2cf88acSQuaker Fang ieee80211_ht_node_init(in, htcap);
1425e2cf88acSQuaker Fang ieee80211_parse_htinfo(in, htinfo);
1426e2cf88acSQuaker Fang (void) ieee80211_setup_htrates(in,
1427e2cf88acSQuaker Fang htcap, IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
1428e2cf88acSQuaker Fang ieee80211_setup_basic_htrates(in, htinfo);
1429e2cf88acSQuaker Fang if (in->in_chan != ic->ic_curchan) {
1430e2cf88acSQuaker Fang /*
1431e2cf88acSQuaker Fang * Channel has been adjusted based on
1432e2cf88acSQuaker Fang * negotiated HT parameters; force the
1433e2cf88acSQuaker Fang * channel state to follow.
1434e2cf88acSQuaker Fang */
1435e2cf88acSQuaker Fang ieee80211_setcurchan(ic, in->in_chan);
1436e2cf88acSQuaker Fang }
1437e2cf88acSQuaker Fang }
14380ba2cbe9Sxc151355 /*
14390ba2cbe9Sxc151355 * Configure state now that we are associated.
14400ba2cbe9Sxc151355 */
14410ba2cbe9Sxc151355 if (ic->ic_curmode == IEEE80211_MODE_11A ||
14420ba2cbe9Sxc151355 (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
14430ba2cbe9Sxc151355 ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
14440ba2cbe9Sxc151355 ic->ic_flags &= ~IEEE80211_F_USEBARKER;
14450ba2cbe9Sxc151355 } else {
14460ba2cbe9Sxc151355 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
14470ba2cbe9Sxc151355 ic->ic_flags |= IEEE80211_F_USEBARKER;
14480ba2cbe9Sxc151355 }
14490ba2cbe9Sxc151355 ieee80211_set_shortslottime(ic,
14500ba2cbe9Sxc151355 ic->ic_curmode == IEEE80211_MODE_11A ||
14510ba2cbe9Sxc151355 (in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
14520ba2cbe9Sxc151355 /*
14530ba2cbe9Sxc151355 * Honor ERP protection.
14540ba2cbe9Sxc151355 *
14550ba2cbe9Sxc151355 * NB: in_erp should zero for non-11g operation.
14560ba2cbe9Sxc151355 * check ic_curmode anyway
14570ba2cbe9Sxc151355 */
14580ba2cbe9Sxc151355 if (ic->ic_curmode == IEEE80211_MODE_11G &&
14590ba2cbe9Sxc151355 (in->in_erp & IEEE80211_ERP_USE_PROTECTION))
14600ba2cbe9Sxc151355 ic->ic_flags |= IEEE80211_F_USEPROT;
14610ba2cbe9Sxc151355 else
14620ba2cbe9Sxc151355 ic->ic_flags &= ~IEEE80211_F_USEPROT;
14630ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ASSOC,
14640ba2cbe9Sxc151355 "assoc success: %s preamble, %s slot time%s%s\n",
14650ba2cbe9Sxc151355 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
14660ba2cbe9Sxc151355 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
14670ba2cbe9Sxc151355 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
14680ba2cbe9Sxc151355 in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
14690ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
14700ba2cbe9Sxc151355 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
14710ba2cbe9Sxc151355 return;
14720ba2cbe9Sxc151355
14730ba2cbe9Sxc151355 case IEEE80211_FC0_SUBTYPE_DEAUTH:
14740ba2cbe9Sxc151355 if (ic->ic_state == IEEE80211_S_SCAN)
14750ba2cbe9Sxc151355 break;
14760ba2cbe9Sxc151355
14770ba2cbe9Sxc151355 /*
14780ba2cbe9Sxc151355 * deauth frame format
14790ba2cbe9Sxc151355 * [2] reason
14800ba2cbe9Sxc151355 */
1481ff3124efSff224033 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1482b510adaeSfei feng - Sun Microsystems - Beijing China status = LE_16(*(uint16_t *)frm);
14830ba2cbe9Sxc151355
14840ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_AUTH,
14850ba2cbe9Sxc151355 "recv deauthenticate (reason %d)\n", status);
14860ba2cbe9Sxc151355 switch (ic->ic_opmode) {
14870ba2cbe9Sxc151355 case IEEE80211_M_STA:
14880ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
14890ba2cbe9Sxc151355 ieee80211_new_state(ic, IEEE80211_S_AUTH,
14900ba2cbe9Sxc151355 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
14910ba2cbe9Sxc151355 return;
14920ba2cbe9Sxc151355 default:
14930ba2cbe9Sxc151355 break;
14940ba2cbe9Sxc151355 }
14950ba2cbe9Sxc151355 break;
14960ba2cbe9Sxc151355
14970ba2cbe9Sxc151355 case IEEE80211_FC0_SUBTYPE_DISASSOC:
14980ba2cbe9Sxc151355 if (ic->ic_state != IEEE80211_S_RUN &&
14990ba2cbe9Sxc151355 ic->ic_state != IEEE80211_S_ASSOC &&
15000ba2cbe9Sxc151355 ic->ic_state != IEEE80211_S_AUTH)
15010ba2cbe9Sxc151355 break;
15020ba2cbe9Sxc151355 /*
15030ba2cbe9Sxc151355 * disassoc frame format
15040ba2cbe9Sxc151355 * [2] reason
15050ba2cbe9Sxc151355 */
1506ff3124efSff224033 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1507b510adaeSfei feng - Sun Microsystems - Beijing China status = LE_16(*(uint16_t *)frm);
15080ba2cbe9Sxc151355
15090ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ASSOC,
15100ba2cbe9Sxc151355 "recv disassociate (reason %d)\n", status);
15110ba2cbe9Sxc151355 switch (ic->ic_opmode) {
15120ba2cbe9Sxc151355 case IEEE80211_M_STA:
15130ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
15140ba2cbe9Sxc151355 ieee80211_new_state(ic, IEEE80211_S_ASSOC,
15150ba2cbe9Sxc151355 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
15160ba2cbe9Sxc151355 return;
15170ba2cbe9Sxc151355 default:
15180ba2cbe9Sxc151355 break;
15190ba2cbe9Sxc151355 }
15200ba2cbe9Sxc151355 break;
15210ba2cbe9Sxc151355
1522e2cf88acSQuaker Fang case IEEE80211_FC0_SUBTYPE_ACTION:
1523e2cf88acSQuaker Fang if (ic->ic_state != IEEE80211_S_RUN &&
1524e2cf88acSQuaker Fang ic->ic_state != IEEE80211_S_ASSOC &&
1525e2cf88acSQuaker Fang ic->ic_state != IEEE80211_S_AUTH)
1526e2cf88acSQuaker Fang break;
1527e2cf88acSQuaker Fang
1528e2cf88acSQuaker Fang /*
1529e2cf88acSQuaker Fang * action frame format:
1530e2cf88acSQuaker Fang * [1] category
1531e2cf88acSQuaker Fang * [1] action
1532e2cf88acSQuaker Fang * [tlv] parameters
1533e2cf88acSQuaker Fang */
1534e2cf88acSQuaker Fang IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1535e2cf88acSQuaker Fang sizeof (struct ieee80211_action), break);
1536e2cf88acSQuaker Fang ia = (const struct ieee80211_action *) frm;
1537e2cf88acSQuaker Fang
1538e2cf88acSQuaker Fang /* verify frame payloads but defer processing */
1539e2cf88acSQuaker Fang /* maybe push this to method */
1540e2cf88acSQuaker Fang switch (ia->ia_category) {
1541e2cf88acSQuaker Fang case IEEE80211_ACTION_CAT_BA:
1542e2cf88acSQuaker Fang switch (ia->ia_action) {
1543e2cf88acSQuaker Fang case IEEE80211_ACTION_BA_ADDBA_REQUEST:
1544e2cf88acSQuaker Fang IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1545e2cf88acSQuaker Fang sizeof (struct ieee80211_action_ba_addbarequest),
1546e2cf88acSQuaker Fang break);
1547e2cf88acSQuaker Fang break;
1548e2cf88acSQuaker Fang case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
1549e2cf88acSQuaker Fang IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1550e2cf88acSQuaker Fang sizeof (struct ieee80211_action_ba_addbaresponse),
1551e2cf88acSQuaker Fang break);
1552e2cf88acSQuaker Fang break;
1553e2cf88acSQuaker Fang case IEEE80211_ACTION_BA_DELBA:
1554e2cf88acSQuaker Fang IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1555e2cf88acSQuaker Fang sizeof (struct ieee80211_action_ba_delba),
1556e2cf88acSQuaker Fang break);
1557e2cf88acSQuaker Fang break;
1558e2cf88acSQuaker Fang }
1559e2cf88acSQuaker Fang break;
1560e2cf88acSQuaker Fang case IEEE80211_ACTION_CAT_HT:
1561e2cf88acSQuaker Fang switch (ia->ia_action) {
1562e2cf88acSQuaker Fang case IEEE80211_ACTION_HT_TXCHWIDTH:
1563e2cf88acSQuaker Fang IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1564e2cf88acSQuaker Fang sizeof (struct ieee80211_action_ht_txchwidth),
1565e2cf88acSQuaker Fang break);
1566e2cf88acSQuaker Fang break;
1567e2cf88acSQuaker Fang }
1568e2cf88acSQuaker Fang break;
1569e2cf88acSQuaker Fang }
1570e2cf88acSQuaker Fang ic->ic_recv_action(in, frm, efrm);
1571e2cf88acSQuaker Fang break;
1572e2cf88acSQuaker Fang
15730ba2cbe9Sxc151355 default:
15740ba2cbe9Sxc151355 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
15750ba2cbe9Sxc151355 "subtype 0x%x not handled\n", subtype);
15760ba2cbe9Sxc151355 break;
15770ba2cbe9Sxc151355 } /* switch subtype */
15780ba2cbe9Sxc151355 out:
15790ba2cbe9Sxc151355 IEEE80211_UNLOCK(ic);
15800ba2cbe9Sxc151355 }
1581