xref: /illumos-gate/usr/src/uts/common/io/net80211/net80211_input.c (revision 19d332fefbc61327bb6187d0eb818629f3b52c6f)
1 /*
2  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2001 Atsushi Onoe
8  * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * Alternatively, this software may be distributed under the terms of the
23  * GNU General Public License ("GPL") version 2 as published by the Free
24  * Software Foundation.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Process received frame
40  */
41 
42 #include <sys/mac_provider.h>
43 #include <sys/byteorder.h>
44 #include <sys/strsun.h>
45 #include "net80211_impl.h"
46 
47 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *,
48     mblk_t *, int);
49 
50 /*
51  * Process a received frame.  The node associated with the sender
52  * should be supplied.  If nothing was found in the node table then
53  * the caller is assumed to supply a reference to ic_bss instead.
54  * The RSSI and a timestamp are also supplied.  The RSSI data is used
55  * during AP scanning to select a AP to associate with; it can have
56  * any units so long as values have consistent units and higher values
57  * mean ``better signal''.  The receive timestamp is currently not used
58  * by the 802.11 layer.
59  */
60 int
61 ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
62     int32_t rssi, uint32_t rstamp)
63 {
64 	struct ieee80211_frame *wh;
65 	struct ieee80211_key *key;
66 	uint8_t *bssid;
67 	int hdrspace;
68 	int len;
69 	uint16_t rxseq;
70 	uint8_t dir;
71 	uint8_t type;
72 	uint8_t subtype;
73 	uint8_t tid;
74 
75 	ASSERT(in != NULL);
76 	in->in_inact = in->in_inact_reload;
77 	type = (uint8_t)-1;		/* undefined */
78 	len = MBLKL(mp);
79 	if (len < sizeof (struct ieee80211_frame_min)) {
80 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
81 		    "too short (1): len %u", len);
82 		goto out;
83 	}
84 	/*
85 	 * Bit of a cheat here, we use a pointer for a 3-address
86 	 * frame format but don't reference fields past outside
87 	 * ieee80211_frame_min w/o first validating the data is
88 	 * present.
89 	 */
90 	wh = (struct ieee80211_frame *)mp->b_rptr;
91 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
92 	    IEEE80211_FC0_VERSION_0) {
93 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
94 		    "discard pkt with wrong version %x", wh->i_fc[0]);
95 		goto out;
96 	}
97 
98 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
99 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
100 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
101 
102 	IEEE80211_LOCK(ic);
103 	if (!(ic->ic_flags & IEEE80211_F_SCAN)) {
104 		switch (ic->ic_opmode) {
105 		case IEEE80211_M_STA:
106 			bssid = wh->i_addr2;
107 			if (!IEEE80211_ADDR_EQ(bssid, in->in_bssid))
108 				goto out_exit_mutex;
109 			break;
110 		case IEEE80211_M_IBSS:
111 		case IEEE80211_M_AHDEMO:
112 			if (dir != IEEE80211_FC1_DIR_NODS) {
113 				bssid = wh->i_addr1;
114 			} else if (type == IEEE80211_FC0_TYPE_CTL) {
115 				bssid = wh->i_addr1;
116 			} else {
117 				if (len < sizeof (struct ieee80211_frame)) {
118 					ieee80211_dbg(IEEE80211_MSG_ANY,
119 					    "ieee80211_input: too short(2):"
120 					    "len %u\n", len);
121 					goto out_exit_mutex;
122 				}
123 				bssid = wh->i_addr3;
124 			}
125 			if (type != IEEE80211_FC0_TYPE_DATA)
126 				break;
127 			/*
128 			 * Data frame, validate the bssid.
129 			 */
130 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->in_bssid) &&
131 			    !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) {
132 				/* not interested in */
133 				ieee80211_dbg(IEEE80211_MSG_INPUT,
134 				    "ieee80211_input: not to bss %s\n",
135 				    ieee80211_macaddr_sprintf(bssid));
136 				goto out_exit_mutex;
137 			}
138 			/*
139 			 * For adhoc mode we cons up a node when it doesn't
140 			 * exist. This should probably done after an ACL check.
141 			 */
142 			if (in == ic->ic_bss &&
143 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
144 			    !IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
145 				/*
146 				 * Fake up a node for this newly
147 				 * discovered member of the IBSS.
148 				 */
149 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
150 				    wh->i_addr2);
151 				if (in == NULL) {
152 					/* NB: stat kept for alloc failure */
153 					goto out_exit_mutex;
154 				}
155 			}
156 			break;
157 		default:
158 			goto out_exit_mutex;
159 		}
160 		in->in_rssi = (uint8_t)rssi;
161 		in->in_rstamp = rstamp;
162 		if (!(type & IEEE80211_FC0_TYPE_CTL)) {
163 			tid = 0;
164 			rxseq = (*(uint16_t *)wh->i_seq);
165 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
166 			    (rxseq - in->in_rxseqs[tid]) <= 0) {
167 				/* duplicate, discard */
168 				ieee80211_dbg(IEEE80211_MSG_INPUT,
169 				    "ieee80211_input: duplicate",
170 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
171 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
172 				    in->in_rxseqs[tid] >>
173 				    IEEE80211_SEQ_SEQ_SHIFT,
174 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
175 				    in->in_rxseqs[tid] &
176 				    IEEE80211_SEQ_FRAG_MASK,
177 				    tid);
178 				ic->ic_stats.is_rx_dups++;
179 				goto out_exit_mutex;
180 			}
181 			in->in_rxseqs[tid] = rxseq;
182 		}
183 	}
184 
185 	switch (type) {
186 	case IEEE80211_FC0_TYPE_DATA:
187 		hdrspace = ieee80211_hdrspace(wh);
188 		if (len < hdrspace) {
189 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
190 			    "data too short: expecting %u", hdrspace);
191 			goto out_exit_mutex;
192 		}
193 		switch (ic->ic_opmode) {
194 		case IEEE80211_M_STA:
195 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
196 				ieee80211_dbg(IEEE80211_MSG_INPUT,
197 				    "ieee80211_input: data ",
198 				    "unknown dir 0x%x", dir);
199 				goto out_exit_mutex;
200 			}
201 			if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
202 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_macaddr)) {
203 				/*
204 				 * In IEEE802.11 network, multicast packet
205 				 * sent from me is broadcasted from AP.
206 				 * It should be silently discarded for
207 				 * SIMPLEX interface.
208 				 */
209 				ieee80211_dbg(IEEE80211_MSG_INPUT,
210 				    "ieee80211_input: multicast echo\n");
211 				goto out_exit_mutex;
212 			}
213 			break;
214 		case IEEE80211_M_IBSS:
215 		case IEEE80211_M_AHDEMO:
216 			if (dir != IEEE80211_FC1_DIR_NODS) {
217 				ieee80211_dbg(IEEE80211_MSG_INPUT,
218 				    "ieee80211_input: unknown dir 0x%x",
219 				    dir);
220 				goto out_exit_mutex;
221 			}
222 			break;
223 		default:
224 			ieee80211_err("ieee80211_input: "
225 			    "receive data, unknown opmode %u, skip\n",
226 			    ic->ic_opmode);
227 			goto out_exit_mutex;
228 		}
229 
230 		/*
231 		 * Handle privacy requirements.
232 		 */
233 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
234 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
235 				/*
236 				 * Discard encrypted frames when privacy off.
237 				 */
238 				ieee80211_dbg(IEEE80211_MSG_INPUT,
239 				    "ieee80211_input: ""WEP PRIVACY off");
240 				ic->ic_stats.is_wep_errors++;
241 				goto out_exit_mutex;
242 			}
243 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
244 			if (key == NULL) {
245 				/* NB: stats+msgs handled in crypto_decap */
246 				ic->ic_stats.is_wep_errors++;
247 				goto out_exit_mutex;
248 			}
249 			wh = (struct ieee80211_frame *)mp->b_rptr;
250 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
251 		} else {
252 			key = NULL;
253 		}
254 
255 		/*
256 		 * Next up, any fragmentation
257 		 */
258 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
259 			mp = ieee80211_defrag(ic, in, mp, hdrspace);
260 			if (mp == NULL) {
261 				/* Fragment dropped or frame not complete yet */
262 				goto out_exit_mutex;
263 			}
264 		}
265 		wh = NULL;	/* no longer valid, catch any uses */
266 
267 		/*
268 		 * Next strip any MSDU crypto bits.
269 		 */
270 		if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) {
271 			ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: "
272 			    "data demic error\n");
273 			goto out_exit_mutex;
274 		}
275 
276 		ic->ic_stats.is_rx_frags++;
277 		ic->ic_stats.is_rx_bytes += len;
278 		IEEE80211_UNLOCK(ic);
279 		mac_rx(ic->ic_mach, NULL, mp);
280 		return (IEEE80211_FC0_TYPE_DATA);
281 
282 	case IEEE80211_FC0_TYPE_MGT:
283 		if (dir != IEEE80211_FC1_DIR_NODS)
284 			goto out_exit_mutex;
285 		if (len < sizeof (struct ieee80211_frame))
286 			goto out_exit_mutex;
287 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
288 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
289 				/*
290 				 * Only shared key auth frames with a challenge
291 				 * should be encrypted, discard all others.
292 				 */
293 				ieee80211_dbg(IEEE80211_MSG_INPUT,
294 				    "ieee80211_input: "
295 				    "%s WEP set but not permitted",
296 				    IEEE80211_SUBTYPE_NAME(subtype));
297 				ic->ic_stats.is_wep_errors++;
298 				goto out_exit_mutex;
299 			}
300 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
301 				/*
302 				 * Discard encrypted frames when privacy off.
303 				 */
304 				ieee80211_dbg(IEEE80211_MSG_INPUT,
305 				    "ieee80211_input: "
306 				    "mgt WEP set but PRIVACY off");
307 				ic->ic_stats.is_wep_errors++;
308 				goto out_exit_mutex;
309 			}
310 			hdrspace = ieee80211_hdrspace(wh);
311 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
312 			if (key == NULL) {
313 				/* NB: stats+msgs handled in crypto_decap */
314 				goto out_exit_mutex;
315 			}
316 			wh = (struct ieee80211_frame *)mp->b_rptr;
317 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
318 		}
319 		IEEE80211_UNLOCK(ic);
320 		ic->ic_recv_mgmt(ic, mp, in, subtype, rssi, rstamp);
321 		goto out;
322 
323 	case IEEE80211_FC0_TYPE_CTL:
324 	default:
325 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
326 		    "bad frame type 0x%x", type);
327 		/* should not come here */
328 		break;
329 	}
330 out_exit_mutex:
331 	IEEE80211_UNLOCK(ic);
332 out:
333 	if (mp != NULL)
334 		freemsg(mp);
335 
336 	return (type);
337 }
338 
339 /*
340  * This function reassemble fragments.
341  * More fragments bit in the frame control means the packet is fragmented.
342  * While the sequence control field consists of 4-bit fragment number
343  * field and a 12-bit sequence number field.
344  */
345 /* ARGSUSED */
346 static mblk_t *
347 ieee80211_defrag(ieee80211com_t *ic, struct ieee80211_node *in, mblk_t *mp,
348     int hdrspace)
349 {
350 	struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr;
351 	struct ieee80211_frame *lwh;
352 	mblk_t *mfrag;
353 	uint16_t rxseq;
354 	uint8_t fragno;
355 	uint8_t more_frag;
356 
357 	ASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1));
358 	more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
359 	rxseq = LE_16(*(uint16_t *)wh->i_seq);
360 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
361 
362 	/* Quick way out, if there's nothing to defragment */
363 	if (!more_frag && fragno == 0 && in->in_rxfrag == NULL)
364 		return (mp);
365 
366 	/*
367 	 * Remove frag to insure it doesn't get reaped by timer.
368 	 */
369 	if (in->in_table == NULL) {
370 		/*
371 		 * Should never happen.  If the node is orphaned (not in
372 		 * the table) then input packets should not reach here.
373 		 * Otherwise, a concurrent request that yanks the table
374 		 * should be blocked by other interlocking and/or by first
375 		 * shutting the driver down.  Regardless, be defensive
376 		 * here and just bail
377 		 */
378 		freemsg(mp);
379 		return (NULL);
380 	}
381 	IEEE80211_NODE_LOCK(in->in_table);
382 	mfrag = in->in_rxfrag;
383 	in->in_rxfrag = NULL;
384 	IEEE80211_NODE_UNLOCK(in->in_table);
385 
386 	/*
387 	 * Validate new fragment is in order and
388 	 * related to the previous ones.
389 	 */
390 	if (mfrag != NULL) {
391 		uint16_t last_rxseq;
392 
393 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
394 		last_rxseq = LE_16(*(uint16_t *)lwh->i_seq);
395 		/*
396 		 * Sequence control field contains 12-bit sequence no
397 		 * and 4-bit fragment number. For fragemnts, the
398 		 * sequence no is not changed.
399 		 * NB: check seq # and frag together
400 		 */
401 		if (rxseq != last_rxseq + 1 ||
402 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
403 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
404 			/*
405 			 * Unrelated fragment or no space for it,
406 			 * clear current fragments.
407 			 */
408 			freemsg(mfrag);
409 			mfrag = NULL;
410 		}
411 	}
412 
413 	if (mfrag == NULL) {
414 		if (fragno != 0) {	/* !first fragment, discard */
415 			freemsg(mp);
416 			return (NULL);
417 		}
418 		mfrag = mp;
419 	} else {			/* concatenate */
420 		(void) adjmsg(mp, hdrspace);
421 		linkb(mfrag, mp);
422 		/* track last seqnum and fragno */
423 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
424 		*(uint16_t *)lwh->i_seq = *(uint16_t *)wh->i_seq;
425 	}
426 	if (more_frag != 0) {		/* more to come, save */
427 		in->in_rxfragstamp = ddi_get_lbolt();
428 		in->in_rxfrag = mfrag;
429 		mfrag = NULL;
430 	}
431 
432 	return (mfrag);
433 }
434 
435 /*
436  * Install received rate set information in the node's state block.
437  */
438 int
439 ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates,
440     const uint8_t *xrates, int flags)
441 {
442 	struct ieee80211_rateset *rs = &in->in_rates;
443 
444 	bzero(rs, sizeof (*rs));
445 	rs->ir_nrates = rates[1];
446 	/* skip 1 byte element ID and 1 byte length */
447 	bcopy(rates + 2, rs->ir_rates, rs->ir_nrates);
448 	if (xrates != NULL) {
449 		uint8_t nxrates;
450 
451 		/*
452 		 * Tack on 11g extended supported rate element.
453 		 */
454 		nxrates = xrates[1];
455 		if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
456 			nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
457 			ieee80211_dbg(IEEE80211_MSG_XRATE,
458 			    "ieee80211_setup_rates: %s",
459 			    "[%s] extended rate set too large;"
460 			    " only using %u of %u rates\n",
461 			    ieee80211_macaddr_sprintf(in->in_macaddr),
462 			    nxrates, xrates[1]);
463 		}
464 		bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
465 		rs->ir_nrates += nxrates;
466 	}
467 	return (ieee80211_fix_rate(in, flags));
468 }
469 
470 /*
471  * Process open-system authentication response frame and start
472  * association if the authentication request is accepted.
473  */
474 static void
475 ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
476     struct ieee80211_node *in, uint16_t seq, uint16_t status)
477 {
478 	IEEE80211_LOCK_ASSERT(ic);
479 	if (in->in_authmode == IEEE80211_AUTH_SHARED) {
480 		ieee80211_dbg(IEEE80211_MSG_AUTH,
481 		    "open auth: bad sta auth mode %u", in->in_authmode);
482 		return;
483 	}
484 	if (ic->ic_opmode == IEEE80211_M_STA) {
485 		if (ic->ic_state != IEEE80211_S_AUTH ||
486 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
487 			return;
488 		}
489 		IEEE80211_UNLOCK(ic);
490 		if (status != 0) {
491 			ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
492 			    "open auth failed (reason %d)\n", status);
493 			if (in != ic->ic_bss)
494 				in->in_fails++;
495 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
496 		} else {
497 			/* i_fc[0] - frame control's type & subtype field */
498 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
499 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
500 		}
501 		IEEE80211_LOCK(ic);
502 	} else {
503 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: "
504 		    "bad operating mode %u", ic->ic_opmode);
505 	}
506 }
507 
508 /*
509  * Allocate challenge text for use by shared-key authentication
510  * Return B_TRUE on success, B_FALST otherwise.
511  */
512 static boolean_t
513 ieee80211_alloc_challenge(struct ieee80211_node *in)
514 {
515 	if (in->in_challenge == NULL) {
516 		in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN,
517 		    KM_NOSLEEP);
518 	}
519 	if (in->in_challenge == NULL) {
520 		ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
521 		    "[%s] shared key challenge alloc failed\n",
522 		    ieee80211_macaddr_sprintf(in->in_macaddr));
523 	}
524 	return (in->in_challenge != NULL);
525 }
526 
527 /*
528  * Process shared-key authentication response frames. If authentication
529  * succeeds, start association; otherwise, restart scan.
530  */
531 static void
532 ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
533     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *in, uint16_t seq,
534     uint16_t status)
535 {
536 	uint8_t *challenge;
537 
538 	/*
539 	 * Pre-shared key authentication is evil; accept
540 	 * it only if explicitly configured (it is supported
541 	 * mainly for compatibility with clients like OS X).
542 	 */
543 	IEEE80211_LOCK_ASSERT(ic);
544 	if (in->in_authmode != IEEE80211_AUTH_AUTO &&
545 	    in->in_authmode != IEEE80211_AUTH_SHARED) {
546 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: "
547 		    "bad sta auth mode %u", in->in_authmode);
548 		goto bad;
549 	}
550 
551 	challenge = NULL;
552 	if (frm + 1 < efrm) {
553 		/*
554 		 * Challenge text information element
555 		 * frm[0] - element ID
556 		 * frm[1] - length
557 		 * frm[2]... - challenge text
558 		 */
559 		if ((frm[1] + 2) > (_PTRDIFF(efrm, frm))) {
560 			ieee80211_dbg(IEEE80211_MSG_AUTH,
561 			    "ieee80211_auth_shared: ie %d%d too long\n",
562 			    frm[0], (frm[1] + 2) - (_PTRDIFF(efrm, frm)));
563 			goto bad;
564 		}
565 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
566 			challenge = frm;
567 		frm += frm[1] + 2;
568 	}
569 	switch (seq) {
570 	case IEEE80211_AUTH_SHARED_CHALLENGE:
571 	case IEEE80211_AUTH_SHARED_RESPONSE:
572 		if (challenge == NULL) {
573 			ieee80211_dbg(IEEE80211_MSG_AUTH,
574 			    "ieee80211_auth_shared: no challenge\n");
575 			goto bad;
576 		}
577 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
578 			ieee80211_dbg(IEEE80211_MSG_AUTH,
579 			    "ieee80211_auth_shared: bad challenge len %d\n",
580 			    challenge[1]);
581 			goto bad;
582 		}
583 	default:
584 		break;
585 	}
586 	switch (ic->ic_opmode) {
587 	case IEEE80211_M_STA:
588 		if (ic->ic_state != IEEE80211_S_AUTH)
589 			return;
590 		switch (seq) {
591 		case IEEE80211_AUTH_SHARED_PASS:
592 			if (in->in_challenge != NULL) {
593 				kmem_free(in->in_challenge,
594 				    IEEE80211_CHALLENGE_LEN);
595 				in->in_challenge = NULL;
596 			}
597 			if (status != 0) {
598 				ieee80211_dbg(IEEE80211_MSG_DEBUG |
599 				    IEEE80211_MSG_AUTH,
600 				    "shared key auth failed (reason %d)\n",
601 				    status);
602 				if (in != ic->ic_bss)
603 					in->in_fails++;
604 				return;
605 			}
606 			IEEE80211_UNLOCK(ic);
607 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
608 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
609 			IEEE80211_LOCK(ic);
610 			break;
611 		case IEEE80211_AUTH_SHARED_CHALLENGE:
612 			if (!ieee80211_alloc_challenge(in))
613 				return;
614 			bcopy(&challenge[2], in->in_challenge, challenge[1]);
615 			IEEE80211_UNLOCK(ic);
616 			IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
617 			    seq + 1);
618 			IEEE80211_LOCK(ic);
619 			break;
620 		default:
621 			ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: "
622 			    "shared key auth: bad seq %d", seq);
623 			return;
624 		}
625 		break;
626 
627 	default:
628 		ieee80211_dbg(IEEE80211_MSG_AUTH,
629 		    "ieee80211_auth_shared: bad opmode %u\n",
630 		    ic->ic_opmode);
631 		break;
632 	}
633 	return;
634 bad:
635 	if (ic->ic_opmode == IEEE80211_M_STA) {
636 		/*
637 		 * Kick the state machine.  This short-circuits
638 		 * using the mgt frame timeout to trigger the
639 		 * state transition.
640 		 */
641 		if (ic->ic_state == IEEE80211_S_AUTH) {
642 			IEEE80211_UNLOCK(ic);
643 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
644 			IEEE80211_LOCK(ic);
645 		}
646 	}
647 }
648 
649 static int
650 iswpaoui(const uint8_t *frm)
651 {
652 	uint32_t c = *(uint32_t *)(frm + 2);
653 	return (frm[1] > 3 && c == ((WPA_OUI_TYPE << 24) | WPA_OUI));
654 }
655 
656 /*
657  * Process a beacon/probe response frame.
658  * When the device is in station mode, create a node and add it
659  * to the node database for a new ESS or update node info if it's
660  * already there.
661  */
662 static void
663 ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
664     int subtype, int rssi, uint32_t rstamp)
665 {
666 	ieee80211_impl_t *im = ic->ic_private;
667 	struct ieee80211_frame *wh;
668 	uint8_t *frm;
669 	uint8_t *efrm;	/* end of frame body */
670 	struct ieee80211_scanparams scan;
671 
672 	wh = (struct ieee80211_frame *)mp->b_rptr;
673 	frm = (uint8_t *)&wh[1];
674 	efrm = (uint8_t *)mp->b_wptr;
675 
676 	/*
677 	 * We process beacon/probe response frames:
678 	 *    o when scanning, or
679 	 *    o station mode when associated (to collect state
680 	 *	updates such as 802.11g slot time), or
681 	 *    o adhoc mode (to discover neighbors)
682 	 * Frames otherwise received are discarded.
683 	 */
684 	if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
685 	    (ic->ic_opmode == IEEE80211_M_STA && in->in_associd != 0) ||
686 	    ic->ic_opmode == IEEE80211_M_IBSS)) {
687 		return;
688 	}
689 
690 	/*
691 	 * beacon/probe response frame format
692 	 *	[8] time stamp
693 	 *	[2] beacon interval
694 	 *	[2] capability information
695 	 *	[tlv] ssid
696 	 *	[tlv] supported rates
697 	 *	[tlv] country information
698 	 *	[tlv] parameter set (FH/DS)
699 	 *	[tlv] erp information
700 	 *	[tlv] extended supported rates
701 	 *	[tlv] WME
702 	 *	[tlv] WPA or RSN
703 	 */
704 	IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
705 	    IEEE80211_BEACON_ELEM_MIN, return);
706 	bzero(&scan, sizeof (scan));
707 	scan.tstamp  = frm;
708 	frm += 8;
709 	scan.bintval = (*(uint16_t *)frm);
710 	frm += 2;
711 	scan.capinfo = (*(uint16_t *)frm);
712 	frm += 2;
713 	scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
714 	scan.chan = scan.bchan;
715 
716 	while (frm < efrm) {
717 		/* Agere element in beacon */
718 		if ((*frm == IEEE80211_ELEMID_AGERE1) ||
719 		    (*frm == IEEE80211_ELEMID_AGERE2)) {
720 			frm = efrm;
721 			break;
722 		}
723 
724 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), frm[1], return);
725 		switch (*frm) {
726 		case IEEE80211_ELEMID_SSID:
727 			scan.ssid = frm;
728 			break;
729 		case IEEE80211_ELEMID_RATES:
730 			scan.rates = frm;
731 			break;
732 		case IEEE80211_ELEMID_COUNTRY:
733 			scan.country = frm;
734 			break;
735 		case IEEE80211_ELEMID_FHPARMS:
736 			if (ic->ic_phytype == IEEE80211_T_FH) {
737 				scan.fhdwell = LE_16(*(uint16_t *)(frm + 2));
738 				scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
739 				scan.fhindex = frm[6];
740 				scan.phytype = IEEE80211_T_FH;
741 			}
742 			break;
743 		case IEEE80211_ELEMID_DSPARMS:
744 			if (ic->ic_phytype != IEEE80211_T_FH) {
745 				scan.chan = frm[2];
746 				scan.phytype = IEEE80211_T_DS;
747 			}
748 			break;
749 		case IEEE80211_ELEMID_TIM:
750 			scan.tim = frm;
751 			scan.timoff = _PTRDIFF(frm, mp->b_rptr);
752 			break;
753 		case IEEE80211_ELEMID_IBSSPARMS:
754 			break;
755 		case IEEE80211_ELEMID_XRATES:
756 			scan.xrates = frm;
757 			break;
758 		case IEEE80211_ELEMID_ERP:
759 			if (frm[1] != 1) {
760 				ieee80211_dbg(IEEE80211_MSG_ELEMID,
761 				    "ieee80211_recv_mgmt: ignore %s, "
762 				    "invalid ERP element; "
763 				    "length %u, expecting 1\n",
764 				    IEEE80211_SUBTYPE_NAME(subtype),
765 				    frm[1]);
766 				break;
767 			}
768 			scan.erp = frm[2];
769 			scan.phytype = IEEE80211_T_OFDM;
770 			break;
771 		case IEEE80211_ELEMID_RSN:
772 			scan.wpa = frm;
773 			break;
774 		case IEEE80211_ELEMID_VENDOR:
775 			if (iswpaoui(frm))
776 				scan.wpa = frm;		/* IEEE802.11i D3.0 */
777 			break;
778 		default:
779 			ieee80211_dbg(IEEE80211_MSG_ELEMID,
780 			    "ieee80211_recv_mgmt: ignore %s,"
781 			    "unhandled id %u, len %u, totallen %u",
782 			    IEEE80211_SUBTYPE_NAME(subtype),
783 			    *frm, frm[1],
784 			    MBLKL(mp));
785 			break;
786 		}
787 		/* frm[1] - component length */
788 		frm += IEEE80211_ELEM_LEN(frm[1]);
789 	}
790 	IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE, return);
791 	IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return);
792 	if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) {
793 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
794 		    "ieee80211_recv_mgmt: ignore %s ,"
795 		    "invalid channel %u\n",
796 		    IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
797 		return;
798 	}
799 	if (scan.chan != scan.bchan &&
800 	    ic->ic_phytype != IEEE80211_T_FH) {
801 		/*
802 		 * Frame was received on a channel different from the
803 		 * one indicated in the DS params element id;
804 		 * silently discard it.
805 		 *
806 		 * NB:	this can happen due to signal leakage.
807 		 *	But we should take it for FH phy because
808 		 *	the rssi value should be correct even for
809 		 *	different hop pattern in FH.
810 		 */
811 		ieee80211_dbg(IEEE80211_MSG_ELEMID,
812 		    "ieee80211_recv_mgmt: ignore %s ,"
813 		    "phytype %u channel %u marked for %u\n",
814 		    IEEE80211_SUBTYPE_NAME(subtype),
815 		    ic->ic_phytype, scan.bchan, scan.chan);
816 		return;
817 	}
818 	if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
819 	    scan.bintval <= IEEE80211_BINTVAL_MAX)) {
820 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
821 		    "ieee80211_recv_mgmt: ignore %s ,"
822 		    "bogus beacon interval %u\n",
823 		    IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
824 		return;
825 	}
826 
827 	/*
828 	 * When operating in station mode, check for state updates.
829 	 * Be careful to ignore beacons received while doing a
830 	 * background scan.  We consider only 11g/WMM stuff right now.
831 	 */
832 	if (ic->ic_opmode == IEEE80211_M_STA &&
833 	    in->in_associd != 0 &&
834 	    (!(ic->ic_flags & IEEE80211_F_SCAN) ||
835 	    IEEE80211_ADDR_EQ(wh->i_addr2, in->in_bssid))) {
836 		/* record tsf of last beacon */
837 		bcopy(scan.tstamp, in->in_tstamp.data,
838 		    sizeof (in->in_tstamp));
839 		/* count beacon frame for s/w bmiss handling */
840 		im->im_swbmiss_count++;
841 		im->im_bmiss_count = 0;
842 
843 		if ((in->in_capinfo ^ scan.capinfo) &
844 		    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
845 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
846 			    "ieee80211_recv_mgmt: "
847 			    "[%s] cap change: before 0x%x, now 0x%x\n",
848 			    ieee80211_macaddr_sprintf(wh->i_addr2),
849 			    in->in_capinfo, scan.capinfo);
850 			/*
851 			 * NB:	we assume short preamble doesn't
852 			 *	change dynamically
853 			 */
854 			ieee80211_set_shortslottime(ic,
855 			    ic->ic_curmode == IEEE80211_MODE_11A ||
856 			    (scan.capinfo &
857 			    IEEE80211_CAPINFO_SHORT_SLOTTIME));
858 			in->in_capinfo = scan.capinfo;
859 		}
860 
861 		if (scan.tim != NULL) {
862 			struct ieee80211_tim_ie *ie;
863 
864 			ie = (struct ieee80211_tim_ie *)scan.tim;
865 			in->in_dtim_count = ie->tim_count;
866 			in->in_dtim_period = ie->tim_period;
867 		}
868 		if (ic->ic_flags & IEEE80211_F_SCAN) {
869 			ieee80211_add_scan(ic, &scan, wh, subtype, rssi,
870 			    rstamp);
871 		}
872 		return;
873 	}
874 	/*
875 	 * If scanning, just pass information to the scan module.
876 	 */
877 	if (ic->ic_flags & IEEE80211_F_SCAN) {
878 		ieee80211_add_scan(ic, &scan, wh, subtype, rssi, rstamp);
879 		return;
880 	}
881 
882 	if (ic->ic_opmode == IEEE80211_M_IBSS &&
883 	    scan.capinfo & IEEE80211_CAPINFO_IBSS) {
884 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
885 			/*
886 			 * Create a new entry in the neighbor table.
887 			 */
888 			in = ieee80211_add_neighbor(ic, wh, &scan);
889 		} else {
890 			/*
891 			 * Copy data from beacon to neighbor table.
892 			 * Some of this information might change after
893 			 * ieee80211_add_neighbor(), so we just copy
894 			 * everything over to be safe.
895 			 */
896 			ieee80211_init_neighbor(in, wh, &scan);
897 		}
898 		if (in != NULL) {
899 			in->in_rssi = (uint8_t)rssi;
900 			in->in_rstamp = rstamp;
901 		}
902 	}
903 }
904 
905 /*
906  * Perform input processing for 802.11 management frames.
907  * It's the default ic_recv_mgmt callback function for the interface
908  * softc, ic. Tipically ic_recv_mgmt is called within ieee80211_input()
909  */
910 void
911 ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
912     int subtype, int rssi, uint32_t rstamp)
913 {
914 	struct ieee80211_frame *wh;
915 	uint8_t *frm;		/* pointer to start of the frame */
916 	uint8_t *efrm;		/* pointer to end of the frame */
917 	uint8_t *ssid;
918 	uint8_t *rates;
919 	uint8_t *xrates;	/* extended rates */
920 	boolean_t allocbs = B_FALSE;
921 	uint8_t rate;
922 	uint16_t algo;		/* authentication algorithm */
923 	uint16_t seq;		/* sequence no */
924 	uint16_t status;
925 	uint16_t capinfo;
926 	uint16_t associd;	/* association ID */
927 
928 	IEEE80211_LOCK(ic);
929 	wh = (struct ieee80211_frame *)mp->b_rptr;
930 	frm = (uint8_t *)&wh[1];
931 	efrm = (uint8_t *)mp->b_wptr;
932 	switch (subtype) {
933 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
934 	case IEEE80211_FC0_SUBTYPE_BEACON:
935 		ieee80211_recv_beacon(ic, mp, in, subtype, rssi, rstamp);
936 		break;
937 
938 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
939 		if (ic->ic_opmode == IEEE80211_M_STA ||
940 		    ic->ic_state != IEEE80211_S_RUN ||
941 		    IEEE80211_IS_MULTICAST(wh->i_addr2)) {
942 			break;
943 		}
944 
945 		/*
946 		 * prreq frame format
947 		 *	[tlv] ssid
948 		 *	[tlv] supported rates
949 		 *	[tlv] extended supported rates
950 		 */
951 		ssid = rates = xrates = NULL;
952 		while (frm < efrm) {
953 			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
954 			    frm[1], goto out);
955 			switch (*frm) {
956 			case IEEE80211_ELEMID_SSID:
957 				ssid = frm;
958 				break;
959 			case IEEE80211_ELEMID_RATES:
960 				rates = frm;
961 				break;
962 			case IEEE80211_ELEMID_XRATES:
963 				xrates = frm;
964 				break;
965 			}
966 			frm += frm[1] + 2;
967 		}
968 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
969 		if (xrates != NULL) {
970 			IEEE80211_VERIFY_ELEMENT(xrates,
971 			    IEEE80211_RATE_MAXSIZE - rates[1], break);
972 		}
973 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, break);
974 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break);
975 		if (ic->ic_flags & IEEE80211_F_HIDESSID) {
976 			if (ssid == NULL || ssid[1] == 0) {
977 				ieee80211_dbg(IEEE80211_MSG_INPUT,
978 				    "ieee80211_recv_mgmt: ignore %s, "
979 				    "no ssid with ssid suppression enabled",
980 				    IEEE80211_SUBTYPE_NAME(subtype));
981 				break;
982 			}
983 		}
984 
985 		if (in == ic->ic_bss) {
986 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
987 				in = ieee80211_tmp_node(ic, wh->i_addr2);
988 				allocbs = B_TRUE;
989 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2,
990 			    in->in_macaddr)) {
991 				/*
992 				 * Cannot tell if the sender is operating
993 				 * in ibss mode.  But we need a new node to
994 				 * send the response so blindly add them to the
995 				 * neighbor table.
996 				 */
997 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
998 				    wh->i_addr2);
999 			}
1000 			if (in == NULL)
1001 				break;
1002 		}
1003 		ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: "
1004 		    "[%s] recv probe req\n",
1005 		    ieee80211_macaddr_sprintf(wh->i_addr2));
1006 		in->in_rssi = (uint8_t)rssi;
1007 		in->in_rstamp = rstamp;
1008 		/*
1009 		 * Adjust and check station's rate list with device's
1010 		 * supported rate.  Send back response if there is at
1011 		 * least one rate or the fixed rate(if being set) is
1012 		 * supported by both station and the device
1013 		 */
1014 		rate = ieee80211_setup_rates(in, rates, xrates,
1015 		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1016 		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1017 		if (rate & IEEE80211_RATE_BASIC) {
1018 			ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt"
1019 			    "%s recv'd rate set invalid",
1020 			    IEEE80211_SUBTYPE_NAME(subtype));
1021 		} else {
1022 			IEEE80211_UNLOCK(ic);
1023 			IEEE80211_SEND_MGMT(ic, in,
1024 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
1025 			IEEE80211_LOCK(ic);
1026 		}
1027 		if (allocbs) {
1028 			/*
1029 			 * Temporary node created just to send a
1030 			 * response, reclaim immediately.
1031 			 */
1032 			ieee80211_free_node(in);
1033 		}
1034 		break;
1035 
1036 	case IEEE80211_FC0_SUBTYPE_AUTH:
1037 		/*
1038 		 * auth frame format
1039 		 *	[2] algorithm
1040 		 *	[2] sequence
1041 		 *	[2] status
1042 		 *	[tlv*] challenge
1043 		 */
1044 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1045 		    IEEE80211_AUTH_ELEM_MIN, break);
1046 		algo   = (*(uint16_t *)frm);
1047 		seq    = (*(uint16_t *)(frm + 2));
1048 		status = (*(uint16_t *)(frm + 4));
1049 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: "
1050 		    "[%s] recv auth frame with algorithm %d seq %d\n",
1051 		    ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
1052 
1053 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
1054 			ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1055 			    "ieee80211_recv_mgmt: ignore auth, %s\n",
1056 			    "TKIP countermeasures enabled");
1057 			break;
1058 		}
1059 		switch (algo) {
1060 		case IEEE80211_AUTH_ALG_SHARED:
1061 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, in,
1062 			    seq, status);
1063 			break;
1064 		case IEEE80211_AUTH_ALG_OPEN:
1065 			ieee80211_auth_open(ic, wh, in, seq, status);
1066 			break;
1067 		default:
1068 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1069 			    "ignore auth, unsupported alg %d", algo);
1070 			break;
1071 		}
1072 		break;
1073 
1074 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1075 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1076 		if (ic->ic_opmode != IEEE80211_M_STA ||
1077 		    ic->ic_state != IEEE80211_S_ASSOC)
1078 			break;
1079 
1080 		/*
1081 		 * asresp frame format
1082 		 *	[2] capability information
1083 		 *	[2] status
1084 		 *	[2] association ID
1085 		 *	[tlv] supported rates
1086 		 *	[tlv] extended supported rates
1087 		 *	[tlv] WME
1088 		 */
1089 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1090 		    IEEE80211_ASSOC_RESP_ELEM_MIN, break);
1091 		in = ic->ic_bss;
1092 		capinfo = (*(uint16_t *)frm);
1093 		frm += 2;
1094 		status = (*(uint16_t *)frm);
1095 		frm += 2;
1096 		if (status != 0) {
1097 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1098 			    "assoc failed (reason %d)\n", status);
1099 			in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2);
1100 			if (in != NULL) {
1101 				in->in_fails++;
1102 				ieee80211_free_node(in);
1103 			}
1104 			break;
1105 		}
1106 		associd = (*(uint16_t *)frm);
1107 		frm += 2;
1108 
1109 		rates = xrates = NULL;
1110 		while (frm < efrm) {
1111 			/*
1112 			 * Do not discard frames containing proprietary Agere
1113 			 * elements 128 and 129, as the reported element length
1114 			 * is often wrong. Skip rest of the frame, since we can
1115 			 * not rely on the given element length making it
1116 			 * impossible to know where the next element starts
1117 			 */
1118 			if ((*frm == IEEE80211_ELEMID_AGERE1) ||
1119 			    (*frm == IEEE80211_ELEMID_AGERE2)) {
1120 				frm = efrm;
1121 				break;
1122 			}
1123 
1124 			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1125 			    frm[1], goto out);
1126 			switch (*frm) {
1127 			case IEEE80211_ELEMID_RATES:
1128 				rates = frm;
1129 				break;
1130 			case IEEE80211_ELEMID_XRATES:
1131 				xrates = frm;
1132 				break;
1133 			}
1134 			frm += frm[1] + 2;
1135 		}
1136 
1137 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
1138 		/*
1139 		 * Adjust and check AP's rate list with device's
1140 		 * supported rate. Re-start scan if no rate is or the
1141 		 * fixed rate(if being set) cannot be supported by
1142 		 * either AP or the device.
1143 		 */
1144 		rate = ieee80211_setup_rates(in, rates, xrates,
1145 		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1146 		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1147 		if (rate & IEEE80211_RATE_BASIC) {
1148 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1149 			    "assoc failed (rate set mismatch)\n");
1150 			if (in != ic->ic_bss)
1151 				in->in_fails++;
1152 			IEEE80211_UNLOCK(ic);
1153 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1154 			return;
1155 		}
1156 
1157 		in->in_capinfo = capinfo;
1158 		in->in_associd = associd;
1159 		in->in_flags &= ~IEEE80211_NODE_QOS;
1160 		/*
1161 		 * Configure state now that we are associated.
1162 		 */
1163 		if (ic->ic_curmode == IEEE80211_MODE_11A ||
1164 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1165 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1166 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1167 		} else {
1168 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1169 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1170 		}
1171 		ieee80211_set_shortslottime(ic,
1172 		    ic->ic_curmode == IEEE80211_MODE_11A ||
1173 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1174 		/*
1175 		 * Honor ERP protection.
1176 		 *
1177 		 * NB:	in_erp should zero for non-11g operation.
1178 		 *	check ic_curmode anyway
1179 		 */
1180 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
1181 		    (in->in_erp & IEEE80211_ERP_USE_PROTECTION))
1182 			ic->ic_flags |= IEEE80211_F_USEPROT;
1183 		else
1184 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1185 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1186 		    "assoc success: %s preamble, %s slot time%s%s\n",
1187 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1188 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1189 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1190 		    in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
1191 		IEEE80211_UNLOCK(ic);
1192 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
1193 		return;
1194 
1195 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1196 		if (ic->ic_state == IEEE80211_S_SCAN)
1197 			break;
1198 
1199 		/*
1200 		 * deauth frame format
1201 		 *	[2] reason
1202 		 */
1203 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1204 		status = (*(uint16_t *)frm);
1205 
1206 		ieee80211_dbg(IEEE80211_MSG_AUTH,
1207 		    "recv deauthenticate (reason %d)\n", status);
1208 		switch (ic->ic_opmode) {
1209 		case IEEE80211_M_STA:
1210 			IEEE80211_UNLOCK(ic);
1211 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
1212 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1213 			return;
1214 		default:
1215 			break;
1216 		}
1217 		break;
1218 
1219 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1220 		if (ic->ic_state != IEEE80211_S_RUN &&
1221 		    ic->ic_state != IEEE80211_S_ASSOC &&
1222 		    ic->ic_state != IEEE80211_S_AUTH)
1223 			break;
1224 		/*
1225 		 * disassoc frame format
1226 		 *	[2] reason
1227 		 */
1228 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1229 		status = (*(uint16_t *)frm);
1230 
1231 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1232 		    "recv disassociate (reason %d)\n", status);
1233 		switch (ic->ic_opmode) {
1234 		case IEEE80211_M_STA:
1235 			IEEE80211_UNLOCK(ic);
1236 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1237 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1238 			return;
1239 		default:
1240 			break;
1241 		}
1242 		break;
1243 
1244 	default:
1245 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1246 		    "subtype 0x%x not handled\n", subtype);
1247 		break;
1248 	} /* switch subtype */
1249 out:
1250 	IEEE80211_UNLOCK(ic);
1251 }
1252