xref: /illumos-gate/usr/src/uts/common/io/net80211/net80211_input.c (revision 5644143a6cf1e70bc2e78d5140970830aae0e8cd)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2001 Atsushi Onoe
8  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * Alternatively, this software may be distributed under the terms of the
23  * GNU General Public License ("GPL") version 2 as published by the Free
24  * Software Foundation.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Process received frame
40  */
41 
42 #include <sys/byteorder.h>
43 #include <sys/strsun.h>
44 #include "net80211_impl.h"
45 
46 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *,
47     mblk_t *, int);
48 
49 /*
50  * Process a received frame.  The node associated with the sender
51  * should be supplied.  If nothing was found in the node table then
52  * the caller is assumed to supply a reference to ic_bss instead.
53  * The RSSI and a timestamp are also supplied.  The RSSI data is used
54  * during AP scanning to select a AP to associate with; it can have
55  * any units so long as values have consistent units and higher values
56  * mean ``better signal''.  The receive timestamp is currently not used
57  * by the 802.11 layer.
58  */
59 int
60 ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
61     int32_t rssi, uint32_t rstamp)
62 {
63 	struct ieee80211_frame *wh;
64 	struct ieee80211_key *key;
65 	uint8_t *bssid;
66 	int hdrspace;
67 	int len;
68 	uint16_t rxseq;
69 	uint8_t dir;
70 	uint8_t type;
71 	uint8_t subtype;
72 	uint8_t tid;
73 
74 	ASSERT(in != NULL);
75 	type = (uint8_t)-1;		/* undefined */
76 	len = MBLKL(mp);
77 	if (len < sizeof (struct ieee80211_frame_min)) {
78 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
79 		    "too short (1): len %u", len);
80 		goto out;
81 	}
82 	/*
83 	 * Bit of a cheat here, we use a pointer for a 3-address
84 	 * frame format but don't reference fields past outside
85 	 * ieee80211_frame_min w/o first validating the data is
86 	 * present.
87 	 */
88 	wh = (struct ieee80211_frame *)mp->b_rptr;
89 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
90 	    IEEE80211_FC0_VERSION_0) {
91 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
92 		    "discard pkt with wrong version %x", wh->i_fc[0]);
93 		goto out;
94 	}
95 
96 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
97 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
98 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
99 
100 	IEEE80211_LOCK(ic);
101 	if (!(ic->ic_flags & IEEE80211_F_SCAN)) {
102 		switch (ic->ic_opmode) {
103 		case IEEE80211_M_STA:
104 			bssid = wh->i_addr2;
105 			if (!IEEE80211_ADDR_EQ(bssid, in->in_bssid))
106 				goto out_exit_mutex;
107 			break;
108 		case IEEE80211_M_IBSS:
109 		case IEEE80211_M_AHDEMO:
110 			if (dir != IEEE80211_FC1_DIR_NODS) {
111 				bssid = wh->i_addr1;
112 			} else if (type == IEEE80211_FC0_TYPE_CTL) {
113 				bssid = wh->i_addr1;
114 			} else {
115 				if (len < sizeof (struct ieee80211_frame)) {
116 					ieee80211_dbg(IEEE80211_MSG_ANY,
117 					    "ieee80211_input: too short(2):"
118 					    "len %u\n", len);
119 					goto out_exit_mutex;
120 				}
121 				bssid = wh->i_addr3;
122 			}
123 			if (type != IEEE80211_FC0_TYPE_DATA)
124 				break;
125 			/*
126 			 * Data frame, validate the bssid.
127 			 */
128 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->in_bssid) &&
129 			    !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) {
130 				/* not interested in */
131 				ieee80211_dbg(IEEE80211_MSG_INPUT,
132 				    "ieee80211_input: not to bss %s\n",
133 				    ieee80211_macaddr_sprintf(bssid));
134 				goto out_exit_mutex;
135 			}
136 			/*
137 			 * For adhoc mode we cons up a node when it doesn't
138 			 * exist. This should probably done after an ACL check.
139 			 */
140 			if (in == ic->ic_bss &&
141 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
142 			    !IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
143 				/*
144 				 * Fake up a node for this newly
145 				 * discovered member of the IBSS.
146 				 */
147 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
148 				    wh->i_addr2);
149 				if (in == NULL) {
150 					/* NB: stat kept for alloc failure */
151 					goto out_exit_mutex;
152 				}
153 			}
154 			break;
155 		default:
156 			goto out_exit_mutex;
157 		}
158 		in->in_rssi = (uint8_t)rssi;
159 		in->in_rstamp = rstamp;
160 		if (!(type & IEEE80211_FC0_TYPE_CTL)) {
161 			tid = 0;
162 			rxseq = (*(uint16_t *)wh->i_seq);
163 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
164 			    (rxseq - in->in_rxseqs[tid]) <= 0) {
165 				/* duplicate, discard */
166 				ieee80211_dbg(IEEE80211_MSG_INPUT,
167 				    "ieee80211_input: duplicate",
168 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
169 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
170 				    in->in_rxseqs[tid] >>
171 				    IEEE80211_SEQ_SEQ_SHIFT,
172 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
173 				    in->in_rxseqs[tid] &
174 				    IEEE80211_SEQ_FRAG_MASK,
175 				    tid);
176 				ic->ic_stats.is_rx_dups++;
177 				goto out_exit_mutex;
178 			}
179 			in->in_rxseqs[tid] = rxseq;
180 		}
181 		in->in_inact = 0;
182 	}
183 
184 	switch (type) {
185 	case IEEE80211_FC0_TYPE_DATA:
186 		hdrspace = ieee80211_hdrspace(wh);
187 		if (len < hdrspace) {
188 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
189 			    "data too short: expecting %u", hdrspace);
190 			goto out_exit_mutex;
191 		}
192 		switch (ic->ic_opmode) {
193 		case IEEE80211_M_STA:
194 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
195 				ieee80211_dbg(IEEE80211_MSG_INPUT,
196 				    "ieee80211_input: data ",
197 				    "unknown dir 0x%x", dir);
198 				goto out_exit_mutex;
199 			}
200 			if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
201 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_macaddr)) {
202 				/*
203 				 * In IEEE802.11 network, multicast packet
204 				 * sent from me is broadcasted from AP.
205 				 * It should be silently discarded for
206 				 * SIMPLEX interface.
207 				 */
208 				ieee80211_dbg(IEEE80211_MSG_INPUT,
209 				    "ieee80211_input: multicast echo\n");
210 				goto out_exit_mutex;
211 			}
212 			break;
213 		case IEEE80211_M_IBSS:
214 		case IEEE80211_M_AHDEMO:
215 			if (dir != IEEE80211_FC1_DIR_NODS) {
216 				ieee80211_dbg(IEEE80211_MSG_INPUT,
217 				    "ieee80211_input: unknown dir 0x%x",
218 				    dir);
219 				goto out_exit_mutex;
220 			}
221 			break;
222 		default:
223 			ieee80211_err("ieee80211_input: "
224 			    "receive data, unknown opmode %u, skip\n",
225 			    ic->ic_opmode);
226 			goto out_exit_mutex;
227 		}
228 
229 		/*
230 		 * Handle privacy requirements.
231 		 */
232 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
233 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
234 				/*
235 				 * Discard encrypted frames when privacy off.
236 				 */
237 				ieee80211_dbg(IEEE80211_MSG_INPUT,
238 				    "ieee80211_input: ""WEP PRIVACY off");
239 				ic->ic_stats.is_wep_errors++;
240 				goto out_exit_mutex;
241 			}
242 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
243 			if (key == NULL) {
244 				/* NB: stats+msgs handled in crypto_decap */
245 				ic->ic_stats.is_wep_errors++;
246 				goto out_exit_mutex;
247 			}
248 			wh = (struct ieee80211_frame *)mp->b_rptr;
249 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
250 		} else {
251 			key = NULL;
252 		}
253 
254 		/*
255 		 * Next up, any fragmentation
256 		 */
257 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
258 			mp = ieee80211_defrag(ic, in, mp, hdrspace);
259 			if (mp == NULL) {
260 				/* Fragment dropped or frame not complete yet */
261 				goto out_exit_mutex;
262 			}
263 		}
264 		wh = NULL;	/* no longer valid, catch any uses */
265 
266 		/*
267 		 * Next strip any MSDU crypto bits.
268 		 */
269 		if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) {
270 			ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: "
271 			    "data demic error\n");
272 			goto out_exit_mutex;
273 		}
274 
275 		ic->ic_stats.is_rx_frags++;
276 		ic->ic_stats.is_rx_bytes += len;
277 		IEEE80211_UNLOCK(ic);
278 		mac_rx(ic->ic_mach, NULL, mp);
279 		return (IEEE80211_FC0_TYPE_DATA);
280 
281 	case IEEE80211_FC0_TYPE_MGT:
282 		if (dir != IEEE80211_FC1_DIR_NODS)
283 			goto out_exit_mutex;
284 		if (len < sizeof (struct ieee80211_frame))
285 			goto out_exit_mutex;
286 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
287 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
288 				/*
289 				 * Only shared key auth frames with a challenge
290 				 * should be encrypted, discard all others.
291 				 */
292 				ieee80211_dbg(IEEE80211_MSG_INPUT,
293 				    "ieee80211_input: "
294 				    "%s WEP set but not permitted",
295 				    IEEE80211_SUBTYPE_NAME(subtype));
296 				ic->ic_stats.is_wep_errors++;
297 				goto out_exit_mutex;
298 			}
299 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
300 				/*
301 				 * Discard encrypted frames when privacy off.
302 				 */
303 				ieee80211_dbg(IEEE80211_MSG_INPUT,
304 				    "ieee80211_input: "
305 				    "mgt WEP set but PRIVACY off");
306 				ic->ic_stats.is_wep_errors++;
307 				goto out_exit_mutex;
308 			}
309 			hdrspace = ieee80211_hdrspace(wh);
310 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
311 			if (key == NULL) {
312 				/* NB: stats+msgs handled in crypto_decap */
313 				goto out_exit_mutex;
314 			}
315 			wh = (struct ieee80211_frame *)mp->b_rptr;
316 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
317 		}
318 		IEEE80211_UNLOCK(ic);
319 		ic->ic_recv_mgmt(ic, mp, in, subtype, rssi, rstamp);
320 		goto out;
321 
322 	case IEEE80211_FC0_TYPE_CTL:
323 	default:
324 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
325 		    "bad frame type 0x%x", type);
326 		/* should not come here */
327 		break;
328 	}
329 out_exit_mutex:
330 	IEEE80211_UNLOCK(ic);
331 out:
332 	if (mp != NULL)
333 		freemsg(mp);
334 
335 	return (type);
336 }
337 
338 /*
339  * This function reassemble fragments.
340  * More fragments bit in the frame control means the packet is fragmented.
341  * While the sequence control field consists of 4-bit fragment number
342  * field and a 12-bit sequence number field.
343  */
344 /* ARGSUSED */
345 static mblk_t *
346 ieee80211_defrag(ieee80211com_t *ic, struct ieee80211_node *in, mblk_t *mp,
347     int hdrspace)
348 {
349 	struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr;
350 	struct ieee80211_frame *lwh;
351 	mblk_t *mfrag;
352 	uint16_t rxseq;
353 	uint8_t fragno;
354 	uint8_t more_frag;
355 
356 	ASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1));
357 	more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
358 	rxseq = LE_16(*(uint16_t *)wh->i_seq);
359 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
360 
361 	/* Quick way out, if there's nothing to defragment */
362 	if (!more_frag && fragno == 0 && in->in_rxfrag == NULL)
363 		return (mp);
364 
365 	/*
366 	 * Remove frag to insure it doesn't get reaped by timer.
367 	 */
368 	if (in->in_table == NULL) {
369 		/*
370 		 * Should never happen.  If the node is orphaned (not in
371 		 * the table) then input packets should not reach here.
372 		 * Otherwise, a concurrent request that yanks the table
373 		 * should be blocked by other interlocking and/or by first
374 		 * shutting the driver down.  Regardless, be defensive
375 		 * here and just bail
376 		 */
377 		freemsg(mp);
378 		return (NULL);
379 	}
380 	IEEE80211_NODE_LOCK(in->in_table);
381 	mfrag = in->in_rxfrag;
382 	in->in_rxfrag = NULL;
383 	IEEE80211_NODE_UNLOCK(in->in_table);
384 
385 	/*
386 	 * Validate new fragment is in order and
387 	 * related to the previous ones.
388 	 */
389 	if (mfrag != NULL) {
390 		uint16_t last_rxseq;
391 
392 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
393 		last_rxseq = LE_16(*(uint16_t *)lwh->i_seq);
394 		/*
395 		 * Sequence control field contains 12-bit sequence no
396 		 * and 4-bit fragment number. For fragemnts, the
397 		 * sequence no is not changed.
398 		 * NB: check seq # and frag together
399 		 */
400 		if (rxseq != last_rxseq + 1 ||
401 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
402 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
403 			/*
404 			 * Unrelated fragment or no space for it,
405 			 * clear current fragments.
406 			 */
407 			freemsg(mfrag);
408 			mfrag = NULL;
409 		}
410 	}
411 
412 	if (mfrag == NULL) {
413 		if (fragno != 0) {	/* !first fragment, discard */
414 			freemsg(mp);
415 			return (NULL);
416 		}
417 		mfrag = mp;
418 	} else {			/* concatenate */
419 		(void) adjmsg(mp, hdrspace);
420 		linkb(mfrag, mp);
421 		/* track last seqnum and fragno */
422 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
423 		*(uint16_t *)lwh->i_seq = *(uint16_t *)wh->i_seq;
424 	}
425 	if (more_frag != 0) {		/* more to come, save */
426 		in->in_rxfragstamp = ddi_get_lbolt();
427 		in->in_rxfrag = mfrag;
428 		mfrag = NULL;
429 	}
430 
431 	return (mfrag);
432 }
433 
434 /*
435  * Install received rate set information in the node's state block.
436  */
437 int
438 ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates,
439     const uint8_t *xrates, int flags)
440 {
441 	struct ieee80211_rateset *rs = &in->in_rates;
442 
443 	bzero(rs, sizeof (*rs));
444 	rs->ir_nrates = rates[1];
445 	/* skip 1 byte element ID and 1 byte length */
446 	bcopy(rates + 2, rs->ir_rates, rs->ir_nrates);
447 	if (xrates != NULL) {
448 		uint8_t nxrates;
449 
450 		/*
451 		 * Tack on 11g extended supported rate element.
452 		 */
453 		nxrates = xrates[1];
454 		if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
455 			nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
456 			ieee80211_dbg(IEEE80211_MSG_XRATE,
457 			    "ieee80211_setup_rates: %s",
458 			    "[%s] extended rate set too large;"
459 			    " only using %u of %u rates\n",
460 			    ieee80211_macaddr_sprintf(in->in_macaddr),
461 			    nxrates, xrates[1]);
462 		}
463 		bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
464 		rs->ir_nrates += nxrates;
465 	}
466 	return (ieee80211_fix_rate(in, flags));
467 }
468 
469 /*
470  * Process open-system authentication response frame and start
471  * association if the authentication request is accepted.
472  */
473 static void
474 ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
475     struct ieee80211_node *in, uint16_t seq, uint16_t status)
476 {
477 	IEEE80211_LOCK_ASSERT(ic);
478 	if (in->in_authmode == IEEE80211_AUTH_SHARED) {
479 		ieee80211_dbg(IEEE80211_MSG_AUTH,
480 		    "open auth: bad sta auth mode %u", in->in_authmode);
481 		return;
482 	}
483 	if (ic->ic_opmode == IEEE80211_M_STA) {
484 		if (ic->ic_state != IEEE80211_S_AUTH ||
485 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
486 			return;
487 		}
488 		IEEE80211_UNLOCK(ic);
489 		if (status != 0) {
490 			ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
491 			    "open auth failed (reason %d)\n", status);
492 			if (in != ic->ic_bss)
493 				in->in_fails++;
494 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
495 		} else {
496 			/* i_fc[0] - frame control's type & subtype field */
497 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
498 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
499 		}
500 		IEEE80211_LOCK(ic);
501 	} else {
502 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: "
503 		    "bad operating mode %u", ic->ic_opmode);
504 	}
505 }
506 
507 /*
508  * Allocate challenge text for use by shared-key authentication
509  * Return B_TRUE on success, B_FALST otherwise.
510  */
511 static boolean_t
512 ieee80211_alloc_challenge(struct ieee80211_node *in)
513 {
514 	if (in->in_challenge == NULL) {
515 		in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN,
516 		    KM_NOSLEEP);
517 	}
518 	if (in->in_challenge == NULL) {
519 		ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
520 		    "[%s] shared key challenge alloc failed\n",
521 		    ieee80211_macaddr_sprintf(in->in_macaddr));
522 	}
523 	return (in->in_challenge != NULL);
524 }
525 
526 /*
527  * Process shared-key authentication response frames. If authentication
528  * succeeds, start association; otherwise, restart scan.
529  */
530 static void
531 ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
532     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *in, uint16_t seq,
533     uint16_t status)
534 {
535 	uint8_t *challenge;
536 
537 	/*
538 	 * Pre-shared key authentication is evil; accept
539 	 * it only if explicitly configured (it is supported
540 	 * mainly for compatibility with clients like OS X).
541 	 */
542 	IEEE80211_LOCK_ASSERT(ic);
543 	if (in->in_authmode != IEEE80211_AUTH_AUTO &&
544 	    in->in_authmode != IEEE80211_AUTH_SHARED) {
545 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: "
546 		    "bad sta auth mode %u", in->in_authmode);
547 		goto bad;
548 	}
549 
550 	challenge = NULL;
551 	if (frm + 1 < efrm) {
552 		/*
553 		 * Challenge text information element
554 		 * frm[0] - element ID
555 		 * frm[1] - length
556 		 * frm[2]... - challenge text
557 		 */
558 		if ((frm[1] + 2) > (_PTRDIFF(efrm, frm))) {
559 			ieee80211_dbg(IEEE80211_MSG_AUTH,
560 			    "ieee80211_auth_shared: ie %d%d too long\n",
561 			    frm[0], (frm[1] + 2) - (_PTRDIFF(efrm, frm)));
562 			goto bad;
563 		}
564 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
565 			challenge = frm;
566 		frm += frm[1] + 2;
567 	}
568 	switch (seq) {
569 	case IEEE80211_AUTH_SHARED_CHALLENGE:
570 	case IEEE80211_AUTH_SHARED_RESPONSE:
571 		if (challenge == NULL) {
572 			ieee80211_dbg(IEEE80211_MSG_AUTH,
573 			    "ieee80211_auth_shared: no challenge\n");
574 			goto bad;
575 		}
576 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
577 			ieee80211_dbg(IEEE80211_MSG_AUTH,
578 			    "ieee80211_auth_shared: bad challenge len %d\n",
579 			    challenge[1]);
580 			goto bad;
581 		}
582 	default:
583 		break;
584 	}
585 	switch (ic->ic_opmode) {
586 	case IEEE80211_M_STA:
587 		if (ic->ic_state != IEEE80211_S_AUTH)
588 			return;
589 		switch (seq) {
590 		case IEEE80211_AUTH_SHARED_PASS:
591 			if (in->in_challenge != NULL) {
592 				kmem_free(in->in_challenge,
593 				    IEEE80211_CHALLENGE_LEN);
594 				in->in_challenge = NULL;
595 			}
596 			if (status != 0) {
597 				ieee80211_dbg(IEEE80211_MSG_DEBUG |
598 				    IEEE80211_MSG_AUTH,
599 				    "shared key auth failed (reason %d)\n",
600 				    status);
601 				if (in != ic->ic_bss)
602 					in->in_fails++;
603 				return;
604 			}
605 			IEEE80211_UNLOCK(ic);
606 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
607 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
608 			IEEE80211_LOCK(ic);
609 			break;
610 		case IEEE80211_AUTH_SHARED_CHALLENGE:
611 			if (!ieee80211_alloc_challenge(in))
612 				return;
613 			bcopy(&challenge[2], in->in_challenge, challenge[1]);
614 			IEEE80211_UNLOCK(ic);
615 			IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
616 			    seq + 1);
617 			IEEE80211_LOCK(ic);
618 			break;
619 		default:
620 			ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: "
621 			    "shared key auth: bad seq %d", seq);
622 			return;
623 		}
624 		break;
625 
626 	default:
627 		ieee80211_dbg(IEEE80211_MSG_AUTH,
628 		    "ieee80211_auth_shared: bad opmode %u\n",
629 		    ic->ic_opmode);
630 		break;
631 	}
632 	return;
633 bad:
634 	if (ic->ic_opmode == IEEE80211_M_STA) {
635 		/*
636 		 * Kick the state machine.  This short-circuits
637 		 * using the mgt frame timeout to trigger the
638 		 * state transition.
639 		 */
640 		if (ic->ic_state == IEEE80211_S_AUTH) {
641 			IEEE80211_UNLOCK(ic);
642 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
643 			IEEE80211_LOCK(ic);
644 		}
645 	}
646 }
647 
648 static int
649 iswpaoui(const uint8_t *frm)
650 {
651 	uint32_t c = *(uint32_t *)(frm + 2);
652 	return (frm[1] > 3 && c == ((WPA_OUI_TYPE << 24) | WPA_OUI));
653 }
654 
655 /*
656  * Process a beacon/probe response frame.
657  * When the device is in station mode, create a node and add it
658  * to the node database for a new ESS or update node info if it's
659  * already there.
660  */
661 static void
662 ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
663     int subtype, int rssi, uint32_t rstamp)
664 {
665 	ieee80211_impl_t *im = ic->ic_private;
666 	struct ieee80211_frame *wh;
667 	uint8_t *frm;
668 	uint8_t *efrm;	/* end of frame body */
669 	struct ieee80211_scanparams scan;
670 
671 	wh = (struct ieee80211_frame *)mp->b_rptr;
672 	frm = (uint8_t *)&wh[1];
673 	efrm = (uint8_t *)mp->b_wptr;
674 
675 	/*
676 	 * We process beacon/probe response frames:
677 	 *    o when scanning, or
678 	 *    o station mode when associated (to collect state
679 	 *	updates such as 802.11g slot time), or
680 	 *    o adhoc mode (to discover neighbors)
681 	 * Frames otherwise received are discarded.
682 	 */
683 	if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
684 	    (ic->ic_opmode == IEEE80211_M_STA && in->in_associd != 0) ||
685 	    ic->ic_opmode == IEEE80211_M_IBSS)) {
686 		return;
687 	}
688 
689 	/*
690 	 * beacon/probe response frame format
691 	 *	[8] time stamp
692 	 *	[2] beacon interval
693 	 *	[2] capability information
694 	 *	[tlv] ssid
695 	 *	[tlv] supported rates
696 	 *	[tlv] country information
697 	 *	[tlv] parameter set (FH/DS)
698 	 *	[tlv] erp information
699 	 *	[tlv] extended supported rates
700 	 *	[tlv] WME
701 	 *	[tlv] WPA or RSN
702 	 */
703 	IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
704 	    IEEE80211_BEACON_ELEM_MIN, return);
705 	bzero(&scan, sizeof (scan));
706 	scan.tstamp  = frm;
707 	frm += 8;
708 	scan.bintval = (*(uint16_t *)frm);
709 	frm += 2;
710 	scan.capinfo = (*(uint16_t *)frm);
711 	frm += 2;
712 	scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
713 	scan.chan = scan.bchan;
714 
715 	while (frm < efrm) {
716 		/* Agere element in beacon */
717 		if ((*frm == IEEE80211_ELEMID_AGERE1) ||
718 		    (*frm == IEEE80211_ELEMID_AGERE2)) {
719 			frm = efrm;
720 			break;
721 		}
722 
723 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), frm[1], return);
724 		switch (*frm) {
725 		case IEEE80211_ELEMID_SSID:
726 			scan.ssid = frm;
727 			break;
728 		case IEEE80211_ELEMID_RATES:
729 			scan.rates = frm;
730 			break;
731 		case IEEE80211_ELEMID_COUNTRY:
732 			scan.country = frm;
733 			break;
734 		case IEEE80211_ELEMID_FHPARMS:
735 			if (ic->ic_phytype == IEEE80211_T_FH) {
736 				scan.fhdwell = LE_16(*(uint16_t *)(frm + 2));
737 				scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
738 				scan.fhindex = frm[6];
739 				scan.phytype = IEEE80211_T_FH;
740 			}
741 			break;
742 		case IEEE80211_ELEMID_DSPARMS:
743 			if (ic->ic_phytype != IEEE80211_T_FH) {
744 				scan.chan = frm[2];
745 				scan.phytype = IEEE80211_T_DS;
746 			}
747 			break;
748 		case IEEE80211_ELEMID_TIM:
749 			scan.tim = frm;
750 			scan.timoff = _PTRDIFF(frm, mp->b_rptr);
751 			break;
752 		case IEEE80211_ELEMID_IBSSPARMS:
753 			break;
754 		case IEEE80211_ELEMID_XRATES:
755 			scan.xrates = frm;
756 			break;
757 		case IEEE80211_ELEMID_ERP:
758 			if (frm[1] != 1) {
759 				ieee80211_dbg(IEEE80211_MSG_ELEMID,
760 				    "ieee80211_recv_mgmt: ignore %s, "
761 				    "invalid ERP element; "
762 				    "length %u, expecting 1\n",
763 				    IEEE80211_SUBTYPE_NAME(subtype),
764 				    frm[1]);
765 				break;
766 			}
767 			scan.erp = frm[2];
768 			scan.phytype = IEEE80211_T_OFDM;
769 			break;
770 		case IEEE80211_ELEMID_RSN:
771 			scan.wpa = frm;
772 			break;
773 		case IEEE80211_ELEMID_VENDOR:
774 			if (iswpaoui(frm))
775 				scan.wpa = frm;		/* IEEE802.11i D3.0 */
776 			break;
777 		default:
778 			ieee80211_dbg(IEEE80211_MSG_ELEMID,
779 			    "ieee80211_recv_mgmt: ignore %s,"
780 			    "unhandled id %u, len %u, totallen %u",
781 			    IEEE80211_SUBTYPE_NAME(subtype),
782 			    *frm, frm[1],
783 			    MBLKL(mp));
784 			break;
785 		}
786 		/* frm[1] - component length */
787 		frm += IEEE80211_ELEM_LEN(frm[1]);
788 	}
789 	IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE, return);
790 	IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return);
791 	if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) {
792 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
793 		    "ieee80211_recv_mgmt: ignore %s ,"
794 		    "invalid channel %u\n",
795 		    IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
796 		return;
797 	}
798 	if (scan.chan != scan.bchan &&
799 	    ic->ic_phytype != IEEE80211_T_FH) {
800 		/*
801 		 * Frame was received on a channel different from the
802 		 * one indicated in the DS params element id;
803 		 * silently discard it.
804 		 *
805 		 * NB:	this can happen due to signal leakage.
806 		 *	But we should take it for FH phy because
807 		 *	the rssi value should be correct even for
808 		 *	different hop pattern in FH.
809 		 */
810 		ieee80211_dbg(IEEE80211_MSG_ELEMID,
811 		    "ieee80211_recv_mgmt: ignore %s ,"
812 		    "phytype %u channel %u marked for %u\n",
813 		    IEEE80211_SUBTYPE_NAME(subtype),
814 		    ic->ic_phytype, scan.bchan, scan.chan);
815 		return;
816 	}
817 	if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
818 	    scan.bintval <= IEEE80211_BINTVAL_MAX)) {
819 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
820 		    "ieee80211_recv_mgmt: ignore %s ,"
821 		    "bogus beacon interval %u\n",
822 		    IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
823 		return;
824 	}
825 
826 	/*
827 	 * When operating in station mode, check for state updates.
828 	 * Be careful to ignore beacons received while doing a
829 	 * background scan.  We consider only 11g/WMM stuff right now.
830 	 */
831 	if (ic->ic_opmode == IEEE80211_M_STA &&
832 	    in->in_associd != 0 &&
833 	    (!(ic->ic_flags & IEEE80211_F_SCAN) ||
834 	    IEEE80211_ADDR_EQ(wh->i_addr2, in->in_bssid))) {
835 		/* record tsf of last beacon */
836 		bcopy(scan.tstamp, in->in_tstamp.data,
837 		    sizeof (in->in_tstamp));
838 		/* count beacon frame for s/w bmiss handling */
839 		im->im_swbmiss_count++;
840 		im->im_bmiss_count = 0;
841 
842 		if ((in->in_capinfo ^ scan.capinfo) &
843 		    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
844 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
845 			    "ieee80211_recv_mgmt: "
846 			    "[%s] cap change: before 0x%x, now 0x%x\n",
847 			    ieee80211_macaddr_sprintf(wh->i_addr2),
848 			    in->in_capinfo, scan.capinfo);
849 			/*
850 			 * NB:	we assume short preamble doesn't
851 			 *	change dynamically
852 			 */
853 			ieee80211_set_shortslottime(ic,
854 			    ic->ic_curmode == IEEE80211_MODE_11A ||
855 			    (scan.capinfo &
856 			    IEEE80211_CAPINFO_SHORT_SLOTTIME));
857 			in->in_capinfo = scan.capinfo;
858 		}
859 
860 		if (scan.tim != NULL) {
861 			struct ieee80211_tim_ie *ie;
862 
863 			ie = (struct ieee80211_tim_ie *)scan.tim;
864 			in->in_dtim_count = ie->tim_count;
865 			in->in_dtim_period = ie->tim_period;
866 		}
867 		if (ic->ic_flags & IEEE80211_F_SCAN) {
868 			ieee80211_add_scan(ic, &scan, wh, subtype, rssi,
869 			    rstamp);
870 		}
871 		return;
872 	}
873 	/*
874 	 * If scanning, just pass information to the scan module.
875 	 */
876 	if (ic->ic_flags & IEEE80211_F_SCAN) {
877 		ieee80211_add_scan(ic, &scan, wh, subtype, rssi, rstamp);
878 		return;
879 	}
880 
881 	if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
882 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
883 			/*
884 			 * Create a new entry in the neighbor table.
885 			 */
886 			in = ieee80211_add_neighbor(ic, wh, &scan);
887 		} else if (in->in_capinfo == 0) {
888 			/*
889 			 * Update faked node created on transmit.
890 			 * Note this also updates the tsf.
891 			 */
892 			ieee80211_init_neighbor(in, wh, &scan);
893 		} else {
894 			/*
895 			 * Record tsf for potential resync.
896 			 */
897 			bcopy(scan.tstamp, in->in_tstamp.data,
898 			    sizeof (in->in_tstamp));
899 		}
900 		if (in != NULL) {
901 			in->in_rssi = (uint8_t)rssi;
902 			in->in_rstamp = rstamp;
903 		}
904 	}
905 }
906 
907 /*
908  * Perform input processing for 802.11 management frames.
909  * It's the default ic_recv_mgmt callback function for the interface
910  * softc, ic. Tipically ic_recv_mgmt is called within ieee80211_input()
911  */
912 void
913 ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
914     int subtype, int rssi, uint32_t rstamp)
915 {
916 	struct ieee80211_frame *wh;
917 	uint8_t *frm;		/* pointer to start of the frame */
918 	uint8_t *efrm;		/* pointer to end of the frame */
919 	uint8_t *ssid;
920 	uint8_t *rates;
921 	uint8_t *xrates;	/* extended rates */
922 	boolean_t allocbs = B_FALSE;
923 	uint8_t rate;
924 	uint16_t algo;		/* authentication algorithm */
925 	uint16_t seq;		/* sequence no */
926 	uint16_t status;
927 	uint16_t capinfo;
928 	uint16_t associd;	/* association ID */
929 
930 	IEEE80211_LOCK(ic);
931 	wh = (struct ieee80211_frame *)mp->b_rptr;
932 	frm = (uint8_t *)&wh[1];
933 	efrm = (uint8_t *)mp->b_wptr;
934 	switch (subtype) {
935 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
936 	case IEEE80211_FC0_SUBTYPE_BEACON:
937 		ieee80211_recv_beacon(ic, mp, in, subtype, rssi, rstamp);
938 		break;
939 
940 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
941 		if (ic->ic_opmode == IEEE80211_M_STA ||
942 		    ic->ic_state != IEEE80211_S_RUN ||
943 		    IEEE80211_IS_MULTICAST(wh->i_addr2)) {
944 			break;
945 		}
946 
947 		/*
948 		 * prreq frame format
949 		 *	[tlv] ssid
950 		 *	[tlv] supported rates
951 		 *	[tlv] extended supported rates
952 		 */
953 		ssid = rates = xrates = NULL;
954 		while (frm < efrm) {
955 			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
956 			    frm[1], goto out);
957 			switch (*frm) {
958 			case IEEE80211_ELEMID_SSID:
959 				ssid = frm;
960 				break;
961 			case IEEE80211_ELEMID_RATES:
962 				rates = frm;
963 				break;
964 			case IEEE80211_ELEMID_XRATES:
965 				xrates = frm;
966 				break;
967 			}
968 			frm += frm[1] + 2;
969 		}
970 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
971 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, break);
972 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break);
973 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
974 			ieee80211_dbg(IEEE80211_MSG_INPUT,
975 			    "ieee80211_recv_mgmt: ignore %s, "
976 			    "no ssid with ssid suppression enabled",
977 			    IEEE80211_SUBTYPE_NAME(subtype));
978 			break;
979 		}
980 
981 		if (in == ic->ic_bss) {
982 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
983 				in = ieee80211_tmp_node(ic, wh->i_addr2);
984 				allocbs = B_TRUE;
985 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2,
986 			    in->in_macaddr)) {
987 				/*
988 				 * Cannot tell if the sender is operating
989 				 * in ibss mode.  But we need a new node to
990 				 * send the response so blindly add them to the
991 				 * neighbor table.
992 				 */
993 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
994 				    wh->i_addr2);
995 			}
996 			if (in == NULL)
997 				break;
998 		}
999 		ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: "
1000 		    "[%s] recv probe req\n",
1001 		    ieee80211_macaddr_sprintf(wh->i_addr2));
1002 		in->in_rssi = (uint8_t)rssi;
1003 		in->in_rstamp = rstamp;
1004 		/*
1005 		 * Adjust and check station's rate list with device's
1006 		 * supported rate.  Send back response if there is at
1007 		 * least one rate or the fixed rate(if being set) is
1008 		 * supported by both station and the device
1009 		 */
1010 		rate = ieee80211_setup_rates(in, rates, xrates,
1011 		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1012 		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1013 		if (rate & IEEE80211_RATE_BASIC) {
1014 			ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt"
1015 			    "%s recv'd rate set invalid",
1016 			    IEEE80211_SUBTYPE_NAME(subtype));
1017 		} else {
1018 			IEEE80211_UNLOCK(ic);
1019 			IEEE80211_SEND_MGMT(ic, in,
1020 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
1021 			IEEE80211_LOCK(ic);
1022 		}
1023 		if (allocbs) {
1024 			/*
1025 			 * Temporary node created just to send a
1026 			 * response, reclaim immediately.
1027 			 */
1028 			ieee80211_free_node(in);
1029 		}
1030 		break;
1031 
1032 	case IEEE80211_FC0_SUBTYPE_AUTH:
1033 		/*
1034 		 * auth frame format
1035 		 *	[2] algorithm
1036 		 *	[2] sequence
1037 		 *	[2] status
1038 		 *	[tlv*] challenge
1039 		 */
1040 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1041 		    IEEE80211_AUTH_ELEM_MIN, break);
1042 		algo   = (*(uint16_t *)frm);
1043 		seq    = (*(uint16_t *)(frm + 2));
1044 		status = (*(uint16_t *)(frm + 4));
1045 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: "
1046 		    "[%s] recv auth frame with algorithm %d seq %d\n",
1047 		    ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
1048 
1049 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
1050 			ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1051 			    "ieee80211_recv_mgmt: ignore auth, %s\n",
1052 			    "TKIP countermeasures enabled");
1053 			break;
1054 		}
1055 		switch (algo) {
1056 		case IEEE80211_AUTH_ALG_SHARED:
1057 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, in,
1058 			    seq, status);
1059 			break;
1060 		case IEEE80211_AUTH_ALG_OPEN:
1061 			ieee80211_auth_open(ic, wh, in, seq, status);
1062 			break;
1063 		default:
1064 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1065 			    "ignore auth, unsupported alg %d", algo);
1066 			break;
1067 		}
1068 		break;
1069 
1070 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1071 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1072 		if (ic->ic_opmode != IEEE80211_M_STA ||
1073 		    ic->ic_state != IEEE80211_S_ASSOC)
1074 			break;
1075 
1076 		/*
1077 		 * asresp frame format
1078 		 *	[2] capability information
1079 		 *	[2] status
1080 		 *	[2] association ID
1081 		 *	[tlv] supported rates
1082 		 *	[tlv] extended supported rates
1083 		 *	[tlv] WME
1084 		 */
1085 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1086 		    IEEE80211_ASSOC_RESP_ELEM_MIN, break);
1087 		in = ic->ic_bss;
1088 		capinfo = (*(uint16_t *)frm);
1089 		frm += 2;
1090 		status = (*(uint16_t *)frm);
1091 		frm += 2;
1092 		if (status != 0) {
1093 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1094 			    "assoc failed (reason %d)\n", status);
1095 			in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2);
1096 			if (in != NULL) {
1097 				in->in_fails++;
1098 				ieee80211_free_node(in);
1099 			}
1100 			break;
1101 		}
1102 		associd = (*(uint16_t *)frm);
1103 		frm += 2;
1104 
1105 		rates = xrates = NULL;
1106 		while (frm < efrm) {
1107 			/*
1108 			 * Do not discard frames containing proprietary Agere
1109 			 * elements 128 and 129, as the reported element length
1110 			 * is often wrong. Skip rest of the frame, since we can
1111 			 * not rely on the given element length making it
1112 			 * impossible to know where the next element starts
1113 			 */
1114 			if ((*frm == IEEE80211_ELEMID_AGERE1) ||
1115 			    (*frm == IEEE80211_ELEMID_AGERE2)) {
1116 				frm = efrm;
1117 				break;
1118 			}
1119 
1120 			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1121 			    frm[1], goto out);
1122 			switch (*frm) {
1123 			case IEEE80211_ELEMID_RATES:
1124 				rates = frm;
1125 				break;
1126 			case IEEE80211_ELEMID_XRATES:
1127 				xrates = frm;
1128 				break;
1129 			}
1130 			frm += frm[1] + 2;
1131 		}
1132 
1133 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
1134 		/*
1135 		 * Adjust and check AP's rate list with device's
1136 		 * supported rate. Re-start scan if no rate is or the
1137 		 * fixed rate(if being set) cannot be supported by
1138 		 * either AP or the device.
1139 		 */
1140 		rate = ieee80211_setup_rates(in, rates, xrates,
1141 		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1142 		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1143 		if (rate & IEEE80211_RATE_BASIC) {
1144 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1145 			    "assoc failed (rate set mismatch)\n");
1146 			if (in != ic->ic_bss)
1147 				in->in_fails++;
1148 			IEEE80211_UNLOCK(ic);
1149 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1150 			return;
1151 		}
1152 
1153 		in->in_capinfo = capinfo;
1154 		in->in_associd = associd;
1155 		in->in_flags &= ~IEEE80211_NODE_QOS;
1156 		/*
1157 		 * Configure state now that we are associated.
1158 		 */
1159 		if (ic->ic_curmode == IEEE80211_MODE_11A ||
1160 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1161 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1162 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1163 		} else {
1164 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1165 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1166 		}
1167 		ieee80211_set_shortslottime(ic,
1168 		    ic->ic_curmode == IEEE80211_MODE_11A ||
1169 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1170 		/*
1171 		 * Honor ERP protection.
1172 		 *
1173 		 * NB:	in_erp should zero for non-11g operation.
1174 		 *	check ic_curmode anyway
1175 		 */
1176 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
1177 		    (in->in_erp & IEEE80211_ERP_USE_PROTECTION))
1178 			ic->ic_flags |= IEEE80211_F_USEPROT;
1179 		else
1180 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1181 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1182 		    "assoc success: %s preamble, %s slot time%s%s\n",
1183 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1184 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1185 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1186 		    in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
1187 		IEEE80211_UNLOCK(ic);
1188 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
1189 		return;
1190 
1191 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1192 		if (ic->ic_state == IEEE80211_S_SCAN)
1193 			break;
1194 
1195 		/*
1196 		 * deauth frame format
1197 		 *	[2] reason
1198 		 */
1199 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1200 		status = (*(uint16_t *)frm);
1201 
1202 		ieee80211_dbg(IEEE80211_MSG_AUTH,
1203 		    "recv deauthenticate (reason %d)\n", status);
1204 		switch (ic->ic_opmode) {
1205 		case IEEE80211_M_STA:
1206 			IEEE80211_UNLOCK(ic);
1207 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
1208 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1209 			return;
1210 		default:
1211 			break;
1212 		}
1213 		break;
1214 
1215 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1216 		if (ic->ic_state != IEEE80211_S_RUN &&
1217 		    ic->ic_state != IEEE80211_S_ASSOC &&
1218 		    ic->ic_state != IEEE80211_S_AUTH)
1219 			break;
1220 		/*
1221 		 * disassoc frame format
1222 		 *	[2] reason
1223 		 */
1224 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1225 		status = (*(uint16_t *)frm);
1226 
1227 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1228 		    "recv disassociate (reason %d)\n", status);
1229 		switch (ic->ic_opmode) {
1230 		case IEEE80211_M_STA:
1231 			IEEE80211_UNLOCK(ic);
1232 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1233 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1234 			return;
1235 		default:
1236 			break;
1237 		}
1238 		break;
1239 
1240 	default:
1241 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1242 		    "subtype 0x%x not handled\n", subtype);
1243 		break;
1244 	} /* switch subtype */
1245 out:
1246 	IEEE80211_UNLOCK(ic);
1247 }
1248