xref: /illumos-gate/usr/src/uts/common/io/net80211/net80211_input.c (revision 0ba2cbe97e0678a691742f98d2532caed0a2c4aa)
1 /*
2  * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2001 Atsushi Onoe
8  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * Alternatively, this software may be distributed under the terms of the
23  * GNU General Public License ("GPL") version 2 as published by the Free
24  * Software Foundation.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 #pragma ident	"%Z%%M%	%I%	%E% SMI"
39 
40 /*
41  * Process received frame
42  */
43 
44 #include <sys/byteorder.h>
45 #include "net80211_impl.h"
46 
47 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *,
48     mblk_t *, int);
49 
50 /*
51  * Process a received frame.  The node associated with the sender
52  * should be supplied.  If nothing was found in the node table then
53  * the caller is assumed to supply a reference to ic_bss instead.
54  * The RSSI and a timestamp are also supplied.  The RSSI data is used
55  * during AP scanning to select a AP to associate with; it can have
56  * any units so long as values have consistent units and higher values
57  * mean ``better signal''.  The receive timestamp is currently not used
58  * by the 802.11 layer.
59  */
60 int
61 ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
62     int32_t rssi, uint32_t rstamp)
63 {
64 	struct ieee80211_frame *wh;
65 	struct ieee80211_key *key;
66 	uint8_t *bssid;
67 	int hdrspace;
68 	int len;
69 	uint16_t rxseq;
70 	uint8_t dir;
71 	uint8_t type;
72 	uint8_t subtype;
73 	uint8_t tid;
74 
75 	ASSERT(in != NULL);
76 	type = (uint8_t)-1;		/* undefined */
77 	len = mp->b_wptr - mp->b_rptr;
78 	if (len < sizeof (struct ieee80211_frame_min)) {
79 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
80 			"too short (1): len %u", len);
81 		goto out;
82 	}
83 	/*
84 	 * Bit of a cheat here, we use a pointer for a 3-address
85 	 * frame format but don't reference fields past outside
86 	 * ieee80211_frame_min w/o first validating the data is
87 	 * present.
88 	 */
89 	wh = (struct ieee80211_frame *)mp->b_rptr;
90 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
91 	    IEEE80211_FC0_VERSION_0) {
92 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
93 			"discard pkt with wrong version %x", wh->i_fc[0]);
94 		goto out;
95 	}
96 
97 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
98 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
99 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
100 
101 	IEEE80211_LOCK(ic);
102 	if (!(ic->ic_flags & IEEE80211_F_SCAN)) {
103 		switch (ic->ic_opmode) {
104 		case IEEE80211_M_STA:
105 			bssid = wh->i_addr2;
106 			if (!IEEE80211_ADDR_EQ(bssid, in->in_bssid))
107 				goto out_exit_mutex;
108 			break;
109 		case IEEE80211_M_IBSS:
110 		case IEEE80211_M_AHDEMO:
111 			if (dir != IEEE80211_FC1_DIR_NODS) {
112 				bssid = wh->i_addr1;
113 			} else if (type == IEEE80211_FC0_TYPE_CTL) {
114 				bssid = wh->i_addr1;
115 			} else {
116 				if (len < sizeof (struct ieee80211_frame)) {
117 					ieee80211_dbg(IEEE80211_MSG_ANY,
118 						"ieee80211_input: too short(2):"
119 						"len %u\n", len);
120 					goto out_exit_mutex;
121 				}
122 				bssid = wh->i_addr3;
123 			}
124 			if (type != IEEE80211_FC0_TYPE_DATA)
125 				break;
126 			/*
127 			 * Data frame, validate the bssid.
128 			 */
129 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->in_bssid) &&
130 			    !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) {
131 				/* not interested in */
132 				ieee80211_dbg(IEEE80211_MSG_INPUT,
133 					"ieee80211_input: not to bss %s\n",
134 					ieee80211_macaddr_sprintf(bssid));
135 				goto out_exit_mutex;
136 			}
137 			/*
138 			 * For adhoc mode we cons up a node when it doesn't
139 			 * exist. This should probably done after an ACL check.
140 			 */
141 			if (in == ic->ic_bss &&
142 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
143 			    !IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
144 				/*
145 				 * Fake up a node for this newly
146 				 * discovered member of the IBSS.
147 				 */
148 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
149 					wh->i_addr2);
150 				if (in == NULL) {
151 					/* NB: stat kept for alloc failure */
152 					goto out_exit_mutex;
153 				}
154 			}
155 			break;
156 		default:
157 			goto out_exit_mutex;
158 		}
159 		in->in_rssi = (uint8_t)rssi;
160 		in->in_rstamp = rstamp;
161 		if (!(type & IEEE80211_FC0_TYPE_CTL)) {
162 			tid = 0;
163 			rxseq = (*(uint16_t *)wh->i_seq);
164 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
165 			    (rxseq - in->in_rxseqs[tid]) <= 0) {
166 				/* duplicate, discard */
167 				ieee80211_dbg(IEEE80211_MSG_INPUT,
168 					"ieee80211_input: duplicate",
169 					"seqno <%u,%u> fragno <%u,%u> tid %u",
170 					rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
171 					in->in_rxseqs[tid] >>
172 						IEEE80211_SEQ_SEQ_SHIFT,
173 					rxseq & IEEE80211_SEQ_FRAG_MASK,
174 					in->in_rxseqs[tid] &
175 						IEEE80211_SEQ_FRAG_MASK,
176 					tid);
177 				ic->ic_stats.is_rx_dups++;
178 				goto out_exit_mutex;
179 			}
180 			in->in_rxseqs[tid] = rxseq;
181 		}
182 		in->in_inact = 0;
183 	}
184 
185 	hdrspace = ieee80211_hdrspace(wh);
186 	switch (type) {
187 	case IEEE80211_FC0_TYPE_DATA:
188 		if (len < hdrspace) {
189 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
190 				"data too short: expecting %u", hdrspace);
191 			goto out_exit_mutex;
192 		}
193 		switch (ic->ic_opmode) {
194 		case IEEE80211_M_STA:
195 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
196 				ieee80211_dbg(IEEE80211_MSG_INPUT,
197 					"ieee80211_input: data ",
198 					"unknown dir 0x%x", dir);
199 				goto out_exit_mutex;
200 			}
201 			if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
202 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_macaddr)) {
203 				/*
204 				 * In IEEE802.11 network, multicast packet
205 				 * sent from me is broadcasted from AP.
206 				 * It should be silently discarded for
207 				 * SIMPLEX interface.
208 				 */
209 				ieee80211_dbg(IEEE80211_MSG_INPUT,
210 					"ieee80211_input: multicast echo\n");
211 				goto out_exit_mutex;
212 			}
213 			break;
214 		case IEEE80211_M_IBSS:
215 		case IEEE80211_M_AHDEMO:
216 			if (dir != IEEE80211_FC1_DIR_NODS) {
217 				ieee80211_dbg(IEEE80211_MSG_INPUT,
218 					"ieee80211_input: unknown dir 0x%x",
219 					dir);
220 				goto out_exit_mutex;
221 			}
222 			break;
223 		default:
224 			ieee80211_err("ieee80211_input: "
225 				"receive data, unknown opmode %u, skip\n",
226 				ic->ic_opmode);
227 			goto out_exit_mutex;
228 		}
229 
230 		/*
231 		 * Handle privacy requirements.
232 		 */
233 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
234 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
235 				/*
236 				 * Discard encrypted frames when privacy off.
237 				 */
238 				ieee80211_dbg(IEEE80211_MSG_INPUT,
239 					"ieee80211_input: ""WEP PRIVACY off");
240 				ic->ic_stats.is_wep_errors++;
241 				goto out_exit_mutex;
242 			}
243 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
244 			if (key == NULL) {
245 				/* NB: stats+msgs handled in crypto_decap */
246 				ic->ic_stats.is_wep_errors++;
247 				goto out_exit_mutex;
248 			}
249 			wh = (struct ieee80211_frame *)mp->b_rptr;
250 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
251 		} else {
252 			key = NULL;
253 		}
254 
255 		/*
256 		 * Next up, any fragmentation
257 		 */
258 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
259 			mp = ieee80211_defrag(ic, in, mp, hdrspace);
260 			if (mp == NULL) {
261 				/* Fragment dropped or frame not complete yet */
262 				goto out_exit_mutex;
263 			}
264 		}
265 		wh = NULL;	/* no longer valid, catch any uses */
266 
267 		/*
268 		 * Next strip any MSDU crypto bits.
269 		 */
270 		if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) {
271 			ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: "
272 				"data demic error\n");
273 			goto out_exit_mutex;
274 		}
275 
276 		ic->ic_stats.is_rx_frags++;
277 		ic->ic_stats.is_rx_bytes += len;
278 		IEEE80211_UNLOCK(ic);
279 		mac_rx(ic->ic_mach, NULL, mp);
280 		return (IEEE80211_FC0_TYPE_DATA);
281 
282 	case IEEE80211_FC0_TYPE_MGT:
283 		if (dir != IEEE80211_FC1_DIR_NODS)
284 			goto out_exit_mutex;
285 		if (len < sizeof (struct ieee80211_frame))
286 			goto out_exit_mutex;
287 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
288 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
289 				/*
290 				 * Only shared key auth frames with a challenge
291 				 * should be encrypted, discard all others.
292 				 */
293 				ieee80211_dbg(IEEE80211_MSG_INPUT,
294 					"ieee80211_input: "
295 					"%s WEP set but not permitted",
296 					IEEE80211_SUBTYPE_NAME(subtype));
297 				ic->ic_stats.is_wep_errors++;
298 				goto out_exit_mutex;
299 			}
300 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
301 				/*
302 				 * Discard encrypted frames when privacy off.
303 				 */
304 				ieee80211_dbg(IEEE80211_MSG_INPUT,
305 					"ieee80211_input: "
306 					"mgt WEP set but PRIVACY off");
307 				ic->ic_stats.is_wep_errors++;
308 				goto out_exit_mutex;
309 			}
310 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
311 			if (key == NULL) {
312 				/* NB: stats+msgs handled in crypto_decap */
313 				goto out_exit_mutex;
314 			}
315 			wh = (struct ieee80211_frame *)mp->b_rptr;
316 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
317 		}
318 		IEEE80211_UNLOCK(ic);
319 		ic->ic_recv_mgmt(ic, mp, in, subtype, rssi, rstamp);
320 		goto out;
321 
322 	case IEEE80211_FC0_TYPE_CTL:
323 	default:
324 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
325 			"bad frame type 0x%x", type);
326 		/* should not come here */
327 		break;
328 	}
329 out_exit_mutex:
330 	IEEE80211_UNLOCK(ic);
331 out:
332 	if (mp != NULL)
333 		freemsg(mp);
334 
335 	return (type);
336 }
337 
338 /*
339  * This function reassemble fragments.
340  * More fragments bit in the frame control means the packet is fragmented.
341  * While the sequence control field consists of 4-bit fragment number
342  * field and a 12-bit sequence number field.
343  */
344 /* ARGSUSED */
345 static mblk_t *
346 ieee80211_defrag(ieee80211com_t *ic, struct ieee80211_node *in, mblk_t *mp,
347     int hdrspace)
348 {
349 	struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr;
350 	struct ieee80211_frame *lwh;
351 	mblk_t *mfrag;
352 	uint16_t rxseq;
353 	uint8_t fragno;
354 	uint8_t more_frag;
355 
356 	ASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1));
357 	more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
358 	rxseq = LE_16(*(uint16_t *)wh->i_seq);
359 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
360 
361 	/* Quick way out, if there's nothing to defragment */
362 	if (!more_frag && fragno == 0 && in->in_rxfrag == NULL)
363 		return (mp);
364 
365 	/*
366 	 * Remove frag to insure it doesn't get reaped by timer.
367 	 */
368 	if (in->in_table == NULL) {
369 		/*
370 		 * Should never happen.  If the node is orphaned (not in
371 		 * the table) then input packets should not reach here.
372 		 * Otherwise, a concurrent request that yanks the table
373 		 * should be blocked by other interlocking and/or by first
374 		 * shutting the driver down.  Regardless, be defensive
375 		 * here and just bail
376 		 */
377 		freemsg(mp);
378 		return (NULL);
379 	}
380 	IEEE80211_NODE_LOCK(in->in_table);
381 	mfrag = in->in_rxfrag;
382 	in->in_rxfrag = NULL;
383 	IEEE80211_NODE_UNLOCK(in->in_table);
384 
385 	/*
386 	 * Validate new fragment is in order and
387 	 * related to the previous ones.
388 	 */
389 	if (mfrag != NULL) {
390 		uint16_t last_rxseq;
391 
392 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
393 		last_rxseq = LE_16(*(uint16_t *)lwh->i_seq);
394 		/*
395 		 * Sequence control field contains 12-bit sequence no
396 		 * and 4-bit fragment number. For fragemnts, the
397 		 * sequence no is not changed.
398 		 * NB: check seq # and frag together
399 		 */
400 		if (rxseq != last_rxseq + 1 ||
401 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
402 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
403 			/*
404 			 * Unrelated fragment or no space for it,
405 			 * clear current fragments.
406 			 */
407 			freemsg(mfrag);
408 			mfrag = NULL;
409 		}
410 	}
411 
412 	if (mfrag == NULL) {
413 		if (fragno != 0) {	/* !first fragment, discard */
414 			freemsg(mp);
415 			return (NULL);
416 		}
417 		mfrag = mp;
418 	} else {			/* concatenate */
419 		(void) adjmsg(mp, hdrspace);
420 		linkb(mfrag, mp);
421 		/* track last seqnum and fragno */
422 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
423 		*(uint16_t *)lwh->i_seq = *(uint16_t *)wh->i_seq;
424 	}
425 	if (more_frag != 0) {		/* more to come, save */
426 		in->in_rxfragstamp = ddi_get_lbolt();
427 		in->in_rxfrag = mfrag;
428 		mfrag = NULL;
429 	}
430 
431 	return (mfrag);
432 }
433 
434 /*
435  * Install received rate set information in the node's state block.
436  */
437 int
438 ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates,
439     const uint8_t *xrates, int flags)
440 {
441 	struct ieee80211_rateset *rs = &in->in_rates;
442 
443 	bzero(rs, sizeof (*rs));
444 	rs->ir_nrates = rates[1];
445 	/* skip 1 byte element ID and 1 byte length */
446 	bcopy(rates + 2, rs->ir_rates, rs->ir_nrates);
447 	if (xrates != NULL) {
448 		uint8_t nxrates;
449 
450 		/*
451 		 * Tack on 11g extended supported rate element.
452 		 */
453 		nxrates = xrates[1];
454 		if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
455 			nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
456 			ieee80211_dbg(IEEE80211_MSG_XRATE,
457 				"ieee80211_setup_rates: %s",
458 				"[%s] extended rate set too large;"
459 				" only using %u of %u rates\n",
460 				ieee80211_macaddr_sprintf(in->in_macaddr),
461 				nxrates, xrates[1]);
462 		}
463 		bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
464 		rs->ir_nrates += nxrates;
465 	}
466 	return (ieee80211_fix_rate(in, flags));
467 }
468 
469 /*
470  * Process open-system authentication response frame and start
471  * association if the authentication request is accepted.
472  */
473 static void
474 ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
475     struct ieee80211_node *in, uint16_t seq, uint16_t status)
476 {
477 	IEEE80211_LOCK_ASSERT(ic);
478 	if (in->in_authmode == IEEE80211_AUTH_SHARED) {
479 		ieee80211_dbg(IEEE80211_MSG_AUTH,
480 			"open auth: bad sta auth mode %u", in->in_authmode);
481 		return;
482 	}
483 	if (ic->ic_opmode == IEEE80211_M_STA) {
484 		if (ic->ic_state != IEEE80211_S_AUTH ||
485 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
486 			return;
487 		}
488 		IEEE80211_UNLOCK(ic);
489 		if (status != 0) {
490 			ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
491 				"open auth failed (reason %d)\n", status);
492 			if (in != ic->ic_bss)
493 				in->in_fails++;
494 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
495 		} else {
496 			/* i_fc[0] - frame control's type & subtype field */
497 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
498 				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
499 		}
500 		IEEE80211_LOCK(ic);
501 	} else {
502 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: "
503 			"bad operating mode %u", ic->ic_opmode);
504 	}
505 }
506 
507 /*
508  * Allocate challenge text for use by shared-key authentication
509  * Return B_TRUE on success, B_FALST otherwise.
510  */
511 static boolean_t
512 ieee80211_alloc_challenge(struct ieee80211_node *in)
513 {
514 	if (in->in_challenge == NULL) {
515 		in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN,
516 			KM_NOSLEEP);
517 	}
518 	if (in->in_challenge == NULL) {
519 		ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
520 			"[%s] shared key challenge alloc failed\n",
521 			ieee80211_macaddr_sprintf(in->in_macaddr));
522 	}
523 	return (in->in_challenge != NULL);
524 }
525 
526 /*
527  * Process shared-key authentication response frames. If authentication
528  * succeeds, start association; otherwise, restart scan.
529  */
530 static void
531 ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
532     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *in, uint16_t seq,
533     uint16_t status)
534 {
535 	uint8_t *challenge;
536 
537 	/*
538 	 * Pre-shared key authentication is evil; accept
539 	 * it only if explicitly configured (it is supported
540 	 * mainly for compatibility with clients like OS X).
541 	 */
542 	IEEE80211_LOCK_ASSERT(ic);
543 	if (in->in_authmode != IEEE80211_AUTH_AUTO &&
544 	    in->in_authmode != IEEE80211_AUTH_SHARED) {
545 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: "
546 			"bad sta auth mode %u", in->in_authmode);
547 		goto bad;
548 	}
549 
550 	challenge = NULL;
551 	if (frm + 1 < efrm) {
552 		/*
553 		 * Challenge text information element
554 		 * frm[0] - element ID
555 		 * frm[1] - length
556 		 * frm[2]... - challenge text
557 		 */
558 		if ((frm[1] + 2) > (efrm - frm)) {
559 			ieee80211_dbg(IEEE80211_MSG_AUTH,
560 				"ieee80211_auth_shared: ie %d%d too long\n",
561 				frm[0], (frm[1] + 2) - (efrm - frm));
562 			goto bad;
563 		}
564 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
565 			challenge = frm;
566 		frm += frm[1] + 2;
567 	}
568 	switch (seq) {
569 	case IEEE80211_AUTH_SHARED_CHALLENGE:
570 	case IEEE80211_AUTH_SHARED_RESPONSE:
571 		if (challenge == NULL) {
572 			ieee80211_dbg(IEEE80211_MSG_AUTH,
573 				"ieee80211_auth_shared: no challenge\n");
574 			goto bad;
575 		}
576 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
577 			ieee80211_dbg(IEEE80211_MSG_AUTH,
578 				"ieee80211_auth_shared: bad challenge len %d\n",
579 				challenge[1]);
580 			goto bad;
581 		}
582 	default:
583 		break;
584 	}
585 	switch (ic->ic_opmode) {
586 	case IEEE80211_M_STA:
587 		if (ic->ic_state != IEEE80211_S_AUTH)
588 			return;
589 		switch (seq) {
590 		case IEEE80211_AUTH_SHARED_PASS:
591 			if (in->in_challenge != NULL) {
592 				kmem_free(in->in_challenge,
593 				    IEEE80211_CHALLENGE_LEN);
594 				in->in_challenge = NULL;
595 			}
596 			if (status != 0) {
597 				ieee80211_dbg(IEEE80211_MSG_DEBUG |
598 					IEEE80211_MSG_AUTH,
599 					"shared key auth failed (reason %d)\n",
600 					status);
601 				if (in != ic->ic_bss)
602 					in->in_fails++;
603 				return;
604 			}
605 			IEEE80211_UNLOCK(ic);
606 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
607 				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
608 			IEEE80211_LOCK(ic);
609 			break;
610 		case IEEE80211_AUTH_SHARED_CHALLENGE:
611 			if (!ieee80211_alloc_challenge(in))
612 				return;
613 			bcopy(&challenge[2], in->in_challenge, challenge[1]);
614 			IEEE80211_UNLOCK(ic);
615 			IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
616 				seq + 1);
617 			IEEE80211_LOCK(ic);
618 			break;
619 		default:
620 			ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: "
621 				"shared key auth: bad seq %d", seq);
622 			return;
623 		}
624 		break;
625 
626 	default:
627 		ieee80211_dbg(IEEE80211_MSG_AUTH,
628 			"ieee80211_auth_shared: bad opmode %u\n",
629 			ic->ic_opmode);
630 		break;
631 	}
632 	return;
633 bad:
634 	if (ic->ic_opmode == IEEE80211_M_STA) {
635 		/*
636 		 * Kick the state machine.  This short-circuits
637 		 * using the mgt frame timeout to trigger the
638 		 * state transition.
639 		 */
640 		if (ic->ic_state == IEEE80211_S_AUTH) {
641 			IEEE80211_UNLOCK(ic);
642 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
643 			IEEE80211_LOCK(ic);
644 		}
645 	}
646 }
647 
648 /*
649  * Process a beacon/probe response frame.
650  * When the device is in station mode, create a node and add it
651  * to the node database for a new ESS or update node info if it's
652  * already there.
653  */
654 static void
655 ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
656     int subtype, int rssi, uint32_t rstamp)
657 {
658 	ieee80211_impl_t *im = ic->ic_private;
659 	struct ieee80211_frame *wh;
660 	uint8_t *frm;
661 	uint8_t *efrm;	/* end of frame body */
662 	struct ieee80211_scanparams scan;
663 
664 	wh = (struct ieee80211_frame *)mp->b_rptr;
665 	frm = (uint8_t *)&wh[1];
666 	efrm = (uint8_t *)mp->b_wptr;
667 
668 	/*
669 	 * We process beacon/probe response frames:
670 	 *    o when scanning, or
671 	 *    o station mode when associated (to collect state
672 	 *	updates such as 802.11g slot time), or
673 	 *    o adhoc mode (to discover neighbors)
674 	 * Frames otherwise received are discarded.
675 	 */
676 	if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
677 	    (ic->ic_opmode == IEEE80211_M_STA && in->in_associd != 0) ||
678 	    ic->ic_opmode == IEEE80211_M_IBSS)) {
679 		return;
680 	}
681 
682 	/*
683 	 * beacon/probe response frame format
684 	 *	[8] time stamp
685 	 *	[2] beacon interval
686 	 *	[2] capability information
687 	 *	[tlv] ssid
688 	 *	[tlv] supported rates
689 	 *	[tlv] country information
690 	 *	[tlv] parameter set (FH/DS)
691 	 *	[tlv] erp information
692 	 *	[tlv] extended supported rates
693 	 *	[tlv] WME
694 	 *	[tlv] WPA or RSN
695 	 */
696 	IEEE80211_VERIFY_LENGTH(efrm - frm, IEEE80211_BEACON_ELEM_MIN, return);
697 	bzero(&scan, sizeof (scan));
698 	scan.tstamp  = frm;
699 	frm += 8;
700 	scan.bintval = (*(uint16_t *)frm);
701 	frm += 2;
702 	scan.capinfo = (*(uint16_t *)frm);
703 	frm += 2;
704 	scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
705 	scan.chan = scan.bchan;
706 
707 	while (frm < efrm) {
708 		/* Agere element in beacon */
709 		if ((*frm == IEEE80211_ELEMID_AGERE1) ||
710 		    (*frm == IEEE80211_ELEMID_AGERE2)) {
711 			frm = efrm;
712 			break;
713 		}
714 
715 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], return);
716 		switch (*frm) {
717 		case IEEE80211_ELEMID_SSID:
718 			scan.ssid = frm;
719 			break;
720 		case IEEE80211_ELEMID_RATES:
721 			scan.rates = frm;
722 			break;
723 		case IEEE80211_ELEMID_COUNTRY:
724 			scan.country = frm;
725 			break;
726 		case IEEE80211_ELEMID_FHPARMS:
727 			if (ic->ic_phytype == IEEE80211_T_FH) {
728 				scan.fhdwell = LE_16(*(uint16_t *)(frm + 2));
729 				scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
730 				scan.fhindex = frm[6];
731 				scan.phytype = IEEE80211_T_FH;
732 			}
733 			break;
734 		case IEEE80211_ELEMID_DSPARMS:
735 			if (ic->ic_phytype != IEEE80211_T_FH) {
736 				scan.chan = frm[2];
737 				scan.phytype = IEEE80211_T_DS;
738 			}
739 			break;
740 		case IEEE80211_ELEMID_TIM:
741 			scan.tim = frm;
742 			scan.timoff = frm - mp->b_rptr;
743 			break;
744 		case IEEE80211_ELEMID_IBSSPARMS:
745 			break;
746 		case IEEE80211_ELEMID_XRATES:
747 			scan.xrates = frm;
748 			break;
749 		case IEEE80211_ELEMID_ERP:
750 			if (frm[1] != 1) {
751 				ieee80211_dbg(IEEE80211_MSG_ELEMID,
752 					"ieee80211_recv_mgmt: ignore %s, "
753 					"invalid ERP element; "
754 					"length %u, expecting 1\n",
755 					IEEE80211_SUBTYPE_NAME(subtype),
756 					frm[1]);
757 				break;
758 			}
759 			scan.erp = frm[2];
760 			scan.phytype = IEEE80211_T_OFDM;
761 			break;
762 		case IEEE80211_ELEMID_RSN:
763 			scan.wpa = frm;
764 			break;
765 		default:
766 			ieee80211_dbg(IEEE80211_MSG_ELEMID,
767 				"ieee80211_recv_mgmt: ignore %s,"
768 				"unhandled id %u, len %u, totallen %u",
769 				IEEE80211_SUBTYPE_NAME(subtype),
770 				*frm, frm[1],
771 				mp->b_wptr - mp->b_rptr);
772 			break;
773 		}
774 		/* frm[1] - component length */
775 		frm += IEEE80211_ELEM_LEN(frm[1]);
776 	}
777 	IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE, return);
778 	IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return);
779 	if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) {
780 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
781 			"ieee80211_recv_mgmt: ignore %s ,"
782 			"invalid channel %u\n",
783 			IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
784 		return;
785 	}
786 	if (scan.chan != scan.bchan &&
787 	    ic->ic_phytype != IEEE80211_T_FH) {
788 		/*
789 		 * Frame was received on a channel different from the
790 		 * one indicated in the DS params element id;
791 		 * silently discard it.
792 		 *
793 		 * NB:	this can happen due to signal leakage.
794 		 *	But we should take it for FH phy because
795 		 *	the rssi value should be correct even for
796 		 *	different hop pattern in FH.
797 		 */
798 		ieee80211_dbg(IEEE80211_MSG_ELEMID,
799 			"ieee80211_recv_mgmt: ignore %s ,"
800 			"phytype %u channel %u marked for %u\n",
801 			IEEE80211_SUBTYPE_NAME(subtype),
802 			ic->ic_phytype, scan.bchan, scan.chan);
803 		return;
804 	}
805 	if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
806 	    scan.bintval <= IEEE80211_BINTVAL_MAX)) {
807 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
808 			"ieee80211_recv_mgmt: ignore %s ,"
809 			"bogus beacon interval %u\n",
810 			IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
811 		return;
812 	}
813 
814 	/*
815 	 * When operating in station mode, check for state updates.
816 	 * Be careful to ignore beacons received while doing a
817 	 * background scan.  We consider only 11g/WMM stuff right now.
818 	 */
819 	if (ic->ic_opmode == IEEE80211_M_STA &&
820 	    in->in_associd != 0 &&
821 	    (!(ic->ic_flags & IEEE80211_F_SCAN) ||
822 	    IEEE80211_ADDR_EQ(wh->i_addr2, in->in_bssid))) {
823 		/* record tsf of last beacon */
824 		bcopy(scan.tstamp, in->in_tstamp.data,
825 		    sizeof (in->in_tstamp));
826 		/* count beacon frame for s/w bmiss handling */
827 		im->im_swbmiss_count++;
828 		im->im_bmiss_count = 0;
829 
830 		if ((in->in_capinfo ^ scan.capinfo) &
831 		    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
832 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
833 				"ieee80211_recv_mgmt: "
834 				"[%s] cap change: before 0x%x, now 0x%x\n",
835 				ieee80211_macaddr_sprintf(wh->i_addr2),
836 				in->in_capinfo, scan.capinfo);
837 			/*
838 			 * NB:	we assume short preamble doesn't
839 			 *	change dynamically
840 			 */
841 			ieee80211_set_shortslottime(ic,
842 				ic->ic_curmode == IEEE80211_MODE_11A ||
843 					(scan.capinfo &
844 					IEEE80211_CAPINFO_SHORT_SLOTTIME));
845 			in->in_capinfo = scan.capinfo;
846 		}
847 
848 		if (scan.tim != NULL) {
849 			struct ieee80211_tim_ie *ie;
850 
851 			ie = (struct ieee80211_tim_ie *)scan.tim;
852 			in->in_dtim_count = ie->tim_count;
853 			in->in_dtim_period = ie->tim_period;
854 		}
855 		if (ic->ic_flags & IEEE80211_F_SCAN) {
856 			ieee80211_add_scan(ic, &scan, wh, subtype, rssi,
857 				rstamp);
858 		}
859 		return;
860 	}
861 	/*
862 	 * If scanning, just pass information to the scan module.
863 	 */
864 	if (ic->ic_flags & IEEE80211_F_SCAN) {
865 		ieee80211_add_scan(ic, &scan, wh, subtype, rssi, rstamp);
866 		return;
867 	}
868 
869 	if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
870 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
871 			/*
872 			 * Create a new entry in the neighbor table.
873 			 */
874 			in = ieee80211_add_neighbor(ic, wh, &scan);
875 		} else if (in->in_capinfo == 0) {
876 			/*
877 			 * Update faked node created on transmit.
878 			 * Note this also updates the tsf.
879 			 */
880 			ieee80211_init_neighbor(in, wh, &scan);
881 		} else {
882 			/*
883 			 * Record tsf for potential resync.
884 			 */
885 			bcopy(scan.tstamp, in->in_tstamp.data,
886 			    sizeof (in->in_tstamp));
887 		}
888 		if (in != NULL) {
889 			in->in_rssi = (uint8_t)rssi;
890 			in->in_rstamp = rstamp;
891 		}
892 	}
893 }
894 
895 /*
896  * Perform input processing for 802.11 management frames.
897  * It's the default ic_recv_mgmt callback function for the interface
898  * softc, ic. Tipically ic_recv_mgmt is called within ieee80211_input()
899  */
900 void
901 ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
902     int subtype, int rssi, uint32_t rstamp)
903 {
904 	struct ieee80211_frame *wh;
905 	uint8_t *frm;		/* pointer to start of the frame */
906 	uint8_t *efrm;		/* pointer to end of the frame */
907 	uint8_t *ssid;
908 	uint8_t *rates;
909 	uint8_t *xrates;	/* extended rates */
910 	boolean_t allocbs = B_FALSE;
911 	uint8_t rate;
912 	uint16_t algo;		/* authentication algorithm */
913 	uint16_t seq;		/* sequence no */
914 	uint16_t status;
915 	uint16_t capinfo;
916 	uint16_t associd;	/* association ID */
917 
918 	IEEE80211_LOCK(ic);
919 	wh = (struct ieee80211_frame *)mp->b_rptr;
920 	frm = (uint8_t *)&wh[1];
921 	efrm = (uint8_t *)mp->b_wptr;
922 	switch (subtype) {
923 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
924 	case IEEE80211_FC0_SUBTYPE_BEACON:
925 		ieee80211_recv_beacon(ic, mp, in, subtype, rssi, rstamp);
926 		break;
927 
928 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
929 		if (ic->ic_opmode == IEEE80211_M_STA ||
930 		    ic->ic_state != IEEE80211_S_RUN ||
931 		    IEEE80211_IS_MULTICAST(wh->i_addr2)) {
932 			break;
933 		}
934 
935 		/*
936 		 * prreq frame format
937 		 *	[tlv] ssid
938 		 *	[tlv] supported rates
939 		 *	[tlv] extended supported rates
940 		 */
941 		ssid = rates = xrates = NULL;
942 		while (frm < efrm) {
943 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], goto out);
944 			switch (*frm) {
945 			case IEEE80211_ELEMID_SSID:
946 				ssid = frm;
947 				break;
948 			case IEEE80211_ELEMID_RATES:
949 				rates = frm;
950 				break;
951 			case IEEE80211_ELEMID_XRATES:
952 				xrates = frm;
953 				break;
954 			}
955 			frm += frm[1] + 2;
956 		}
957 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
958 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, break);
959 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break);
960 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
961 			ieee80211_dbg(IEEE80211_MSG_INPUT,
962 				"ieee80211_recv_mgmt: ignore %s, "
963 				"no ssid with ssid suppression enabled",
964 				IEEE80211_SUBTYPE_NAME(subtype));
965 			break;
966 		}
967 
968 		if (in == ic->ic_bss) {
969 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
970 				in = ieee80211_tmp_node(ic, wh->i_addr2);
971 				allocbs = B_TRUE;
972 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2,
973 			    in->in_macaddr)) {
974 				/*
975 				 * Cannot tell if the sender is operating
976 				 * in ibss mode.  But we need a new node to
977 				 * send the response so blindly add them to the
978 				 * neighbor table.
979 				 */
980 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
981 					wh->i_addr2);
982 			}
983 			if (in == NULL)
984 				break;
985 		}
986 		ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: "
987 			"[%s] recv probe req\n",
988 			ieee80211_macaddr_sprintf(wh->i_addr2));
989 		in->in_rssi = (uint8_t)rssi;
990 		in->in_rstamp = rstamp;
991 		/*
992 		 * Adjust and check station's rate list with device's
993 		 * supported rate.  Send back response if there is at
994 		 * least one rate or the fixed rate(if being set) is
995 		 * supported by both station and the device
996 		 */
997 		rate = ieee80211_setup_rates(in, rates, xrates,
998 			IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
999 			IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1000 		if (rate & IEEE80211_RATE_BASIC) {
1001 			ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt"
1002 				"%s recv'd rate set invalid",
1003 				IEEE80211_SUBTYPE_NAME(subtype));
1004 		} else {
1005 			IEEE80211_UNLOCK(ic);
1006 			IEEE80211_SEND_MGMT(ic, in,
1007 				IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
1008 			IEEE80211_LOCK(ic);
1009 		}
1010 		if (allocbs) {
1011 			/*
1012 			 * Temporary node created just to send a
1013 			 * response, reclaim immediately.
1014 			 */
1015 			ieee80211_free_node(in);
1016 		}
1017 		break;
1018 
1019 	case IEEE80211_FC0_SUBTYPE_AUTH:
1020 		/*
1021 		 * auth frame format
1022 		 *	[2] algorithm
1023 		 *	[2] sequence
1024 		 *	[2] status
1025 		 *	[tlv*] challenge
1026 		 */
1027 		IEEE80211_VERIFY_LENGTH(efrm - frm, IEEE80211_AUTH_ELEM_MIN,
1028 			break);
1029 		algo   = (*(uint16_t *)frm);
1030 		seq    = (*(uint16_t *)(frm + 2));
1031 		status = (*(uint16_t *)(frm + 4));
1032 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: "
1033 			"[%s] recv auth frame with algorithm %d seq %d\n",
1034 			ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
1035 
1036 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
1037 			ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1038 				"ieee80211_recv_mgmt: ignore auth, %s\n",
1039 				"TKIP countermeasures enabled");
1040 			break;
1041 		}
1042 		switch (algo) {
1043 		case IEEE80211_AUTH_ALG_SHARED:
1044 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, in,
1045 				seq, status);
1046 			break;
1047 		case IEEE80211_AUTH_ALG_OPEN:
1048 			ieee80211_auth_open(ic, wh, in, seq, status);
1049 			break;
1050 		default:
1051 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1052 				"ignore auth, unsupported alg %d", algo);
1053 			break;
1054 		}
1055 		break;
1056 
1057 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1058 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1059 		if (ic->ic_opmode != IEEE80211_M_STA ||
1060 		    ic->ic_state != IEEE80211_S_ASSOC)
1061 			break;
1062 
1063 		/*
1064 		 * asresp frame format
1065 		 *	[2] capability information
1066 		 *	[2] status
1067 		 *	[2] association ID
1068 		 *	[tlv] supported rates
1069 		 *	[tlv] extended supported rates
1070 		 *	[tlv] WME
1071 		 */
1072 		IEEE80211_VERIFY_LENGTH(efrm - frm,
1073 			IEEE80211_ASSOC_RESP_ELEM_MIN, break);
1074 		in = ic->ic_bss;
1075 		capinfo = (*(uint16_t *)frm);
1076 		frm += 2;
1077 		status = (*(uint16_t *)frm);
1078 		frm += 2;
1079 		if (status != 0) {
1080 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1081 				"assoc failed (reason %d)\n", status);
1082 			in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2);
1083 			if (in != NULL) {
1084 				in->in_fails++;
1085 				ieee80211_free_node(in);
1086 			}
1087 			break;
1088 		}
1089 		associd = (*(uint16_t *)frm);
1090 		frm += 2;
1091 
1092 		rates = xrates = NULL;
1093 		while (frm < efrm) {
1094 			/*
1095 			 * Do not discard frames containing proprietary Agere
1096 			 * elements 128 and 129, as the reported element length
1097 			 * is often wrong. Skip rest of the frame, since we can
1098 			 * not rely on the given element length making it
1099 			 * impossible to know where the next element starts
1100 			 */
1101 			if ((*frm == IEEE80211_ELEMID_AGERE1) ||
1102 			    (*frm == IEEE80211_ELEMID_AGERE2)) {
1103 				frm = efrm;
1104 				break;
1105 			}
1106 
1107 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], goto out);
1108 			switch (*frm) {
1109 			case IEEE80211_ELEMID_RATES:
1110 				rates = frm;
1111 				break;
1112 			case IEEE80211_ELEMID_XRATES:
1113 				xrates = frm;
1114 				break;
1115 			}
1116 			frm += frm[1] + 2;
1117 		}
1118 
1119 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
1120 		/*
1121 		 * Adjust and check AP's rate list with device's
1122 		 * supported rate. Re-start scan if no rate is or the
1123 		 * fixed rate(if being set) cannot be supported by
1124 		 * either AP or the device.
1125 		 */
1126 		rate = ieee80211_setup_rates(in, rates, xrates,
1127 			IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1128 			IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1129 		if (rate & IEEE80211_RATE_BASIC) {
1130 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1131 				"assoc failed (rate set mismatch)\n");
1132 			if (in != ic->ic_bss)
1133 				in->in_fails++;
1134 			IEEE80211_UNLOCK(ic);
1135 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1136 			return;
1137 		}
1138 
1139 		in->in_capinfo = capinfo;
1140 		in->in_associd = associd;
1141 		in->in_flags &= ~IEEE80211_NODE_QOS;
1142 		/*
1143 		 * Configure state now that we are associated.
1144 		 */
1145 		if (ic->ic_curmode == IEEE80211_MODE_11A ||
1146 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1147 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1148 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1149 		} else {
1150 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1151 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1152 		}
1153 		ieee80211_set_shortslottime(ic,
1154 			ic->ic_curmode == IEEE80211_MODE_11A ||
1155 			(in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1156 		/*
1157 		 * Honor ERP protection.
1158 		 *
1159 		 * NB:	in_erp should zero for non-11g operation.
1160 		 *	check ic_curmode anyway
1161 		 */
1162 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
1163 		    (in->in_erp & IEEE80211_ERP_USE_PROTECTION))
1164 			ic->ic_flags |= IEEE80211_F_USEPROT;
1165 		else
1166 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1167 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1168 			"assoc success: %s preamble, %s slot time%s%s\n",
1169 			ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1170 			ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1171 			ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1172 			in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
1173 		IEEE80211_UNLOCK(ic);
1174 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
1175 		return;
1176 
1177 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1178 		if (ic->ic_state == IEEE80211_S_SCAN)
1179 			break;
1180 
1181 		/*
1182 		 * deauth frame format
1183 		 *	[2] reason
1184 		 */
1185 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, break);
1186 		status = (*(uint16_t *)frm);
1187 
1188 		ieee80211_dbg(IEEE80211_MSG_AUTH,
1189 			"recv deauthenticate (reason %d)\n", status);
1190 		switch (ic->ic_opmode) {
1191 		case IEEE80211_M_STA:
1192 			IEEE80211_UNLOCK(ic);
1193 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
1194 				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1195 			return;
1196 		default:
1197 			break;
1198 		}
1199 		break;
1200 
1201 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1202 		if (ic->ic_state != IEEE80211_S_RUN &&
1203 		    ic->ic_state != IEEE80211_S_ASSOC &&
1204 		    ic->ic_state != IEEE80211_S_AUTH)
1205 			break;
1206 		/*
1207 		 * disassoc frame format
1208 		 *	[2] reason
1209 		 */
1210 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, break);
1211 		status = (*(uint16_t *)frm);
1212 
1213 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1214 			"recv disassociate (reason %d)\n", status);
1215 		switch (ic->ic_opmode) {
1216 		case IEEE80211_M_STA:
1217 			IEEE80211_UNLOCK(ic);
1218 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1219 				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1220 			return;
1221 		default:
1222 			break;
1223 		}
1224 		break;
1225 
1226 	default:
1227 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1228 			"subtype 0x%x not handled\n", subtype);
1229 		break;
1230 	} /* switch subtype */
1231 out:
1232 	IEEE80211_UNLOCK(ic);
1233 }
1234