xref: /illumos-gate/usr/src/uts/common/io/net80211/net80211_input.c (revision ff3124eff995e6cd8ebd8c6543648e0670920034)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2001 Atsushi Onoe
8  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * Alternatively, this software may be distributed under the terms of the
23  * GNU General Public License ("GPL") version 2 as published by the Free
24  * Software Foundation.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 #pragma ident	"%Z%%M%	%I%	%E% SMI"
39 
40 /*
41  * Process received frame
42  */
43 
44 #include <sys/byteorder.h>
45 #include <sys/strsun.h>
46 #include "net80211_impl.h"
47 
48 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *,
49     mblk_t *, int);
50 
51 /*
52  * Process a received frame.  The node associated with the sender
53  * should be supplied.  If nothing was found in the node table then
54  * the caller is assumed to supply a reference to ic_bss instead.
55  * The RSSI and a timestamp are also supplied.  The RSSI data is used
56  * during AP scanning to select a AP to associate with; it can have
57  * any units so long as values have consistent units and higher values
58  * mean ``better signal''.  The receive timestamp is currently not used
59  * by the 802.11 layer.
60  */
61 int
62 ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
63     int32_t rssi, uint32_t rstamp)
64 {
65 	struct ieee80211_frame *wh;
66 	struct ieee80211_key *key;
67 	uint8_t *bssid;
68 	int hdrspace;
69 	int len;
70 	uint16_t rxseq;
71 	uint8_t dir;
72 	uint8_t type;
73 	uint8_t subtype;
74 	uint8_t tid;
75 
76 	ASSERT(in != NULL);
77 	type = (uint8_t)-1;		/* undefined */
78 	len = MBLKL(mp);
79 	if (len < sizeof (struct ieee80211_frame_min)) {
80 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
81 		    "too short (1): len %u", len);
82 		goto out;
83 	}
84 	/*
85 	 * Bit of a cheat here, we use a pointer for a 3-address
86 	 * frame format but don't reference fields past outside
87 	 * ieee80211_frame_min w/o first validating the data is
88 	 * present.
89 	 */
90 	wh = (struct ieee80211_frame *)mp->b_rptr;
91 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
92 	    IEEE80211_FC0_VERSION_0) {
93 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
94 		    "discard pkt with wrong version %x", wh->i_fc[0]);
95 		goto out;
96 	}
97 
98 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
99 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
100 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
101 
102 	IEEE80211_LOCK(ic);
103 	if (!(ic->ic_flags & IEEE80211_F_SCAN)) {
104 		switch (ic->ic_opmode) {
105 		case IEEE80211_M_STA:
106 			bssid = wh->i_addr2;
107 			if (!IEEE80211_ADDR_EQ(bssid, in->in_bssid))
108 				goto out_exit_mutex;
109 			break;
110 		case IEEE80211_M_IBSS:
111 		case IEEE80211_M_AHDEMO:
112 			if (dir != IEEE80211_FC1_DIR_NODS) {
113 				bssid = wh->i_addr1;
114 			} else if (type == IEEE80211_FC0_TYPE_CTL) {
115 				bssid = wh->i_addr1;
116 			} else {
117 				if (len < sizeof (struct ieee80211_frame)) {
118 					ieee80211_dbg(IEEE80211_MSG_ANY,
119 					    "ieee80211_input: too short(2):"
120 					    "len %u\n", len);
121 					goto out_exit_mutex;
122 				}
123 				bssid = wh->i_addr3;
124 			}
125 			if (type != IEEE80211_FC0_TYPE_DATA)
126 				break;
127 			/*
128 			 * Data frame, validate the bssid.
129 			 */
130 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->in_bssid) &&
131 			    !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) {
132 				/* not interested in */
133 				ieee80211_dbg(IEEE80211_MSG_INPUT,
134 				    "ieee80211_input: not to bss %s\n",
135 				    ieee80211_macaddr_sprintf(bssid));
136 				goto out_exit_mutex;
137 			}
138 			/*
139 			 * For adhoc mode we cons up a node when it doesn't
140 			 * exist. This should probably done after an ACL check.
141 			 */
142 			if (in == ic->ic_bss &&
143 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
144 			    !IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
145 				/*
146 				 * Fake up a node for this newly
147 				 * discovered member of the IBSS.
148 				 */
149 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
150 				    wh->i_addr2);
151 				if (in == NULL) {
152 					/* NB: stat kept for alloc failure */
153 					goto out_exit_mutex;
154 				}
155 			}
156 			break;
157 		default:
158 			goto out_exit_mutex;
159 		}
160 		in->in_rssi = (uint8_t)rssi;
161 		in->in_rstamp = rstamp;
162 		if (!(type & IEEE80211_FC0_TYPE_CTL)) {
163 			tid = 0;
164 			rxseq = (*(uint16_t *)wh->i_seq);
165 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
166 			    (rxseq - in->in_rxseqs[tid]) <= 0) {
167 				/* duplicate, discard */
168 				ieee80211_dbg(IEEE80211_MSG_INPUT,
169 				    "ieee80211_input: duplicate",
170 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
171 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
172 				    in->in_rxseqs[tid] >>
173 				    IEEE80211_SEQ_SEQ_SHIFT,
174 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
175 				    in->in_rxseqs[tid] &
176 				    IEEE80211_SEQ_FRAG_MASK,
177 				    tid);
178 				ic->ic_stats.is_rx_dups++;
179 				goto out_exit_mutex;
180 			}
181 			in->in_rxseqs[tid] = rxseq;
182 		}
183 		in->in_inact = 0;
184 	}
185 
186 	hdrspace = ieee80211_hdrspace(wh);
187 	switch (type) {
188 	case IEEE80211_FC0_TYPE_DATA:
189 		if (len < hdrspace) {
190 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
191 			    "data too short: expecting %u", hdrspace);
192 			goto out_exit_mutex;
193 		}
194 		switch (ic->ic_opmode) {
195 		case IEEE80211_M_STA:
196 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
197 				ieee80211_dbg(IEEE80211_MSG_INPUT,
198 				    "ieee80211_input: data ",
199 				    "unknown dir 0x%x", dir);
200 				goto out_exit_mutex;
201 			}
202 			if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
203 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_macaddr)) {
204 				/*
205 				 * In IEEE802.11 network, multicast packet
206 				 * sent from me is broadcasted from AP.
207 				 * It should be silently discarded for
208 				 * SIMPLEX interface.
209 				 */
210 				ieee80211_dbg(IEEE80211_MSG_INPUT,
211 				    "ieee80211_input: multicast echo\n");
212 				goto out_exit_mutex;
213 			}
214 			break;
215 		case IEEE80211_M_IBSS:
216 		case IEEE80211_M_AHDEMO:
217 			if (dir != IEEE80211_FC1_DIR_NODS) {
218 				ieee80211_dbg(IEEE80211_MSG_INPUT,
219 				    "ieee80211_input: unknown dir 0x%x",
220 				    dir);
221 				goto out_exit_mutex;
222 			}
223 			break;
224 		default:
225 			ieee80211_err("ieee80211_input: "
226 			    "receive data, unknown opmode %u, skip\n",
227 			    ic->ic_opmode);
228 			goto out_exit_mutex;
229 		}
230 
231 		/*
232 		 * Handle privacy requirements.
233 		 */
234 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
235 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
236 				/*
237 				 * Discard encrypted frames when privacy off.
238 				 */
239 				ieee80211_dbg(IEEE80211_MSG_INPUT,
240 				    "ieee80211_input: ""WEP PRIVACY off");
241 				ic->ic_stats.is_wep_errors++;
242 				goto out_exit_mutex;
243 			}
244 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
245 			if (key == NULL) {
246 				/* NB: stats+msgs handled in crypto_decap */
247 				ic->ic_stats.is_wep_errors++;
248 				goto out_exit_mutex;
249 			}
250 			wh = (struct ieee80211_frame *)mp->b_rptr;
251 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
252 		} else {
253 			key = NULL;
254 		}
255 
256 		/*
257 		 * Next up, any fragmentation
258 		 */
259 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
260 			mp = ieee80211_defrag(ic, in, mp, hdrspace);
261 			if (mp == NULL) {
262 				/* Fragment dropped or frame not complete yet */
263 				goto out_exit_mutex;
264 			}
265 		}
266 		wh = NULL;	/* no longer valid, catch any uses */
267 
268 		/*
269 		 * Next strip any MSDU crypto bits.
270 		 */
271 		if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) {
272 			ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: "
273 			    "data demic error\n");
274 			goto out_exit_mutex;
275 		}
276 
277 		ic->ic_stats.is_rx_frags++;
278 		ic->ic_stats.is_rx_bytes += len;
279 		IEEE80211_UNLOCK(ic);
280 		mac_rx(ic->ic_mach, NULL, mp);
281 		return (IEEE80211_FC0_TYPE_DATA);
282 
283 	case IEEE80211_FC0_TYPE_MGT:
284 		if (dir != IEEE80211_FC1_DIR_NODS)
285 			goto out_exit_mutex;
286 		if (len < sizeof (struct ieee80211_frame))
287 			goto out_exit_mutex;
288 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
289 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
290 				/*
291 				 * Only shared key auth frames with a challenge
292 				 * should be encrypted, discard all others.
293 				 */
294 				ieee80211_dbg(IEEE80211_MSG_INPUT,
295 				    "ieee80211_input: "
296 				    "%s WEP set but not permitted",
297 				    IEEE80211_SUBTYPE_NAME(subtype));
298 				ic->ic_stats.is_wep_errors++;
299 				goto out_exit_mutex;
300 			}
301 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
302 				/*
303 				 * Discard encrypted frames when privacy off.
304 				 */
305 				ieee80211_dbg(IEEE80211_MSG_INPUT,
306 				    "ieee80211_input: "
307 				    "mgt WEP set but PRIVACY off");
308 				ic->ic_stats.is_wep_errors++;
309 				goto out_exit_mutex;
310 			}
311 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
312 			if (key == NULL) {
313 				/* NB: stats+msgs handled in crypto_decap */
314 				goto out_exit_mutex;
315 			}
316 			wh = (struct ieee80211_frame *)mp->b_rptr;
317 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
318 		}
319 		IEEE80211_UNLOCK(ic);
320 		ic->ic_recv_mgmt(ic, mp, in, subtype, rssi, rstamp);
321 		goto out;
322 
323 	case IEEE80211_FC0_TYPE_CTL:
324 	default:
325 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
326 		    "bad frame type 0x%x", type);
327 		/* should not come here */
328 		break;
329 	}
330 out_exit_mutex:
331 	IEEE80211_UNLOCK(ic);
332 out:
333 	if (mp != NULL)
334 		freemsg(mp);
335 
336 	return (type);
337 }
338 
339 /*
340  * This function reassemble fragments.
341  * More fragments bit in the frame control means the packet is fragmented.
342  * While the sequence control field consists of 4-bit fragment number
343  * field and a 12-bit sequence number field.
344  */
345 /* ARGSUSED */
346 static mblk_t *
347 ieee80211_defrag(ieee80211com_t *ic, struct ieee80211_node *in, mblk_t *mp,
348     int hdrspace)
349 {
350 	struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr;
351 	struct ieee80211_frame *lwh;
352 	mblk_t *mfrag;
353 	uint16_t rxseq;
354 	uint8_t fragno;
355 	uint8_t more_frag;
356 
357 	ASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1));
358 	more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
359 	rxseq = LE_16(*(uint16_t *)wh->i_seq);
360 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
361 
362 	/* Quick way out, if there's nothing to defragment */
363 	if (!more_frag && fragno == 0 && in->in_rxfrag == NULL)
364 		return (mp);
365 
366 	/*
367 	 * Remove frag to insure it doesn't get reaped by timer.
368 	 */
369 	if (in->in_table == NULL) {
370 		/*
371 		 * Should never happen.  If the node is orphaned (not in
372 		 * the table) then input packets should not reach here.
373 		 * Otherwise, a concurrent request that yanks the table
374 		 * should be blocked by other interlocking and/or by first
375 		 * shutting the driver down.  Regardless, be defensive
376 		 * here and just bail
377 		 */
378 		freemsg(mp);
379 		return (NULL);
380 	}
381 	IEEE80211_NODE_LOCK(in->in_table);
382 	mfrag = in->in_rxfrag;
383 	in->in_rxfrag = NULL;
384 	IEEE80211_NODE_UNLOCK(in->in_table);
385 
386 	/*
387 	 * Validate new fragment is in order and
388 	 * related to the previous ones.
389 	 */
390 	if (mfrag != NULL) {
391 		uint16_t last_rxseq;
392 
393 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
394 		last_rxseq = LE_16(*(uint16_t *)lwh->i_seq);
395 		/*
396 		 * Sequence control field contains 12-bit sequence no
397 		 * and 4-bit fragment number. For fragemnts, the
398 		 * sequence no is not changed.
399 		 * NB: check seq # and frag together
400 		 */
401 		if (rxseq != last_rxseq + 1 ||
402 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
403 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
404 			/*
405 			 * Unrelated fragment or no space for it,
406 			 * clear current fragments.
407 			 */
408 			freemsg(mfrag);
409 			mfrag = NULL;
410 		}
411 	}
412 
413 	if (mfrag == NULL) {
414 		if (fragno != 0) {	/* !first fragment, discard */
415 			freemsg(mp);
416 			return (NULL);
417 		}
418 		mfrag = mp;
419 	} else {			/* concatenate */
420 		(void) adjmsg(mp, hdrspace);
421 		linkb(mfrag, mp);
422 		/* track last seqnum and fragno */
423 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
424 		*(uint16_t *)lwh->i_seq = *(uint16_t *)wh->i_seq;
425 	}
426 	if (more_frag != 0) {		/* more to come, save */
427 		in->in_rxfragstamp = ddi_get_lbolt();
428 		in->in_rxfrag = mfrag;
429 		mfrag = NULL;
430 	}
431 
432 	return (mfrag);
433 }
434 
435 /*
436  * Install received rate set information in the node's state block.
437  */
438 int
439 ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates,
440     const uint8_t *xrates, int flags)
441 {
442 	struct ieee80211_rateset *rs = &in->in_rates;
443 
444 	bzero(rs, sizeof (*rs));
445 	rs->ir_nrates = rates[1];
446 	/* skip 1 byte element ID and 1 byte length */
447 	bcopy(rates + 2, rs->ir_rates, rs->ir_nrates);
448 	if (xrates != NULL) {
449 		uint8_t nxrates;
450 
451 		/*
452 		 * Tack on 11g extended supported rate element.
453 		 */
454 		nxrates = xrates[1];
455 		if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
456 			nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
457 			ieee80211_dbg(IEEE80211_MSG_XRATE,
458 			    "ieee80211_setup_rates: %s",
459 			    "[%s] extended rate set too large;"
460 			    " only using %u of %u rates\n",
461 			    ieee80211_macaddr_sprintf(in->in_macaddr),
462 			    nxrates, xrates[1]);
463 		}
464 		bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
465 		rs->ir_nrates += nxrates;
466 	}
467 	return (ieee80211_fix_rate(in, flags));
468 }
469 
470 /*
471  * Process open-system authentication response frame and start
472  * association if the authentication request is accepted.
473  */
474 static void
475 ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
476     struct ieee80211_node *in, uint16_t seq, uint16_t status)
477 {
478 	IEEE80211_LOCK_ASSERT(ic);
479 	if (in->in_authmode == IEEE80211_AUTH_SHARED) {
480 		ieee80211_dbg(IEEE80211_MSG_AUTH,
481 		    "open auth: bad sta auth mode %u", in->in_authmode);
482 		return;
483 	}
484 	if (ic->ic_opmode == IEEE80211_M_STA) {
485 		if (ic->ic_state != IEEE80211_S_AUTH ||
486 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
487 			return;
488 		}
489 		IEEE80211_UNLOCK(ic);
490 		if (status != 0) {
491 			ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
492 			    "open auth failed (reason %d)\n", status);
493 			if (in != ic->ic_bss)
494 				in->in_fails++;
495 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
496 		} else {
497 			/* i_fc[0] - frame control's type & subtype field */
498 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
499 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
500 		}
501 		IEEE80211_LOCK(ic);
502 	} else {
503 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: "
504 		    "bad operating mode %u", ic->ic_opmode);
505 	}
506 }
507 
508 /*
509  * Allocate challenge text for use by shared-key authentication
510  * Return B_TRUE on success, B_FALST otherwise.
511  */
512 static boolean_t
513 ieee80211_alloc_challenge(struct ieee80211_node *in)
514 {
515 	if (in->in_challenge == NULL) {
516 		in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN,
517 		    KM_NOSLEEP);
518 	}
519 	if (in->in_challenge == NULL) {
520 		ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
521 		    "[%s] shared key challenge alloc failed\n",
522 		    ieee80211_macaddr_sprintf(in->in_macaddr));
523 	}
524 	return (in->in_challenge != NULL);
525 }
526 
527 /*
528  * Process shared-key authentication response frames. If authentication
529  * succeeds, start association; otherwise, restart scan.
530  */
531 static void
532 ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
533     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *in, uint16_t seq,
534     uint16_t status)
535 {
536 	uint8_t *challenge;
537 
538 	/*
539 	 * Pre-shared key authentication is evil; accept
540 	 * it only if explicitly configured (it is supported
541 	 * mainly for compatibility with clients like OS X).
542 	 */
543 	IEEE80211_LOCK_ASSERT(ic);
544 	if (in->in_authmode != IEEE80211_AUTH_AUTO &&
545 	    in->in_authmode != IEEE80211_AUTH_SHARED) {
546 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: "
547 		    "bad sta auth mode %u", in->in_authmode);
548 		goto bad;
549 	}
550 
551 	challenge = NULL;
552 	if (frm + 1 < efrm) {
553 		/*
554 		 * Challenge text information element
555 		 * frm[0] - element ID
556 		 * frm[1] - length
557 		 * frm[2]... - challenge text
558 		 */
559 		if ((frm[1] + 2) > (_PTRDIFF(efrm, frm))) {
560 			ieee80211_dbg(IEEE80211_MSG_AUTH,
561 			    "ieee80211_auth_shared: ie %d%d too long\n",
562 			    frm[0], (frm[1] + 2) - (_PTRDIFF(efrm, frm)));
563 			goto bad;
564 		}
565 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
566 			challenge = frm;
567 		frm += frm[1] + 2;
568 	}
569 	switch (seq) {
570 	case IEEE80211_AUTH_SHARED_CHALLENGE:
571 	case IEEE80211_AUTH_SHARED_RESPONSE:
572 		if (challenge == NULL) {
573 			ieee80211_dbg(IEEE80211_MSG_AUTH,
574 			    "ieee80211_auth_shared: no challenge\n");
575 			goto bad;
576 		}
577 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
578 			ieee80211_dbg(IEEE80211_MSG_AUTH,
579 			    "ieee80211_auth_shared: bad challenge len %d\n",
580 			    challenge[1]);
581 			goto bad;
582 		}
583 	default:
584 		break;
585 	}
586 	switch (ic->ic_opmode) {
587 	case IEEE80211_M_STA:
588 		if (ic->ic_state != IEEE80211_S_AUTH)
589 			return;
590 		switch (seq) {
591 		case IEEE80211_AUTH_SHARED_PASS:
592 			if (in->in_challenge != NULL) {
593 				kmem_free(in->in_challenge,
594 				    IEEE80211_CHALLENGE_LEN);
595 				in->in_challenge = NULL;
596 			}
597 			if (status != 0) {
598 				ieee80211_dbg(IEEE80211_MSG_DEBUG |
599 				    IEEE80211_MSG_AUTH,
600 				    "shared key auth failed (reason %d)\n",
601 				    status);
602 				if (in != ic->ic_bss)
603 					in->in_fails++;
604 				return;
605 			}
606 			IEEE80211_UNLOCK(ic);
607 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
608 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
609 			IEEE80211_LOCK(ic);
610 			break;
611 		case IEEE80211_AUTH_SHARED_CHALLENGE:
612 			if (!ieee80211_alloc_challenge(in))
613 				return;
614 			bcopy(&challenge[2], in->in_challenge, challenge[1]);
615 			IEEE80211_UNLOCK(ic);
616 			IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
617 			    seq + 1);
618 			IEEE80211_LOCK(ic);
619 			break;
620 		default:
621 			ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: "
622 			    "shared key auth: bad seq %d", seq);
623 			return;
624 		}
625 		break;
626 
627 	default:
628 		ieee80211_dbg(IEEE80211_MSG_AUTH,
629 		    "ieee80211_auth_shared: bad opmode %u\n",
630 		    ic->ic_opmode);
631 		break;
632 	}
633 	return;
634 bad:
635 	if (ic->ic_opmode == IEEE80211_M_STA) {
636 		/*
637 		 * Kick the state machine.  This short-circuits
638 		 * using the mgt frame timeout to trigger the
639 		 * state transition.
640 		 */
641 		if (ic->ic_state == IEEE80211_S_AUTH) {
642 			IEEE80211_UNLOCK(ic);
643 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
644 			IEEE80211_LOCK(ic);
645 		}
646 	}
647 }
648 
649 static int
650 iswpaoui(const uint8_t *frm)
651 {
652 	uint32_t c = *(uint32_t *)(frm + 2);
653 	return (frm[1] > 3 && c == ((WPA_OUI_TYPE << 24) | WPA_OUI));
654 }
655 
656 /*
657  * Process a beacon/probe response frame.
658  * When the device is in station mode, create a node and add it
659  * to the node database for a new ESS or update node info if it's
660  * already there.
661  */
662 static void
663 ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
664     int subtype, int rssi, uint32_t rstamp)
665 {
666 	ieee80211_impl_t *im = ic->ic_private;
667 	struct ieee80211_frame *wh;
668 	uint8_t *frm;
669 	uint8_t *efrm;	/* end of frame body */
670 	struct ieee80211_scanparams scan;
671 
672 	wh = (struct ieee80211_frame *)mp->b_rptr;
673 	frm = (uint8_t *)&wh[1];
674 	efrm = (uint8_t *)mp->b_wptr;
675 
676 	/*
677 	 * We process beacon/probe response frames:
678 	 *    o when scanning, or
679 	 *    o station mode when associated (to collect state
680 	 *	updates such as 802.11g slot time), or
681 	 *    o adhoc mode (to discover neighbors)
682 	 * Frames otherwise received are discarded.
683 	 */
684 	if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
685 	    (ic->ic_opmode == IEEE80211_M_STA && in->in_associd != 0) ||
686 	    ic->ic_opmode == IEEE80211_M_IBSS)) {
687 		return;
688 	}
689 
690 	/*
691 	 * beacon/probe response frame format
692 	 *	[8] time stamp
693 	 *	[2] beacon interval
694 	 *	[2] capability information
695 	 *	[tlv] ssid
696 	 *	[tlv] supported rates
697 	 *	[tlv] country information
698 	 *	[tlv] parameter set (FH/DS)
699 	 *	[tlv] erp information
700 	 *	[tlv] extended supported rates
701 	 *	[tlv] WME
702 	 *	[tlv] WPA or RSN
703 	 */
704 	IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
705 	    IEEE80211_BEACON_ELEM_MIN, return);
706 	bzero(&scan, sizeof (scan));
707 	scan.tstamp  = frm;
708 	frm += 8;
709 	scan.bintval = (*(uint16_t *)frm);
710 	frm += 2;
711 	scan.capinfo = (*(uint16_t *)frm);
712 	frm += 2;
713 	scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
714 	scan.chan = scan.bchan;
715 
716 	while (frm < efrm) {
717 		/* Agere element in beacon */
718 		if ((*frm == IEEE80211_ELEMID_AGERE1) ||
719 		    (*frm == IEEE80211_ELEMID_AGERE2)) {
720 			frm = efrm;
721 			break;
722 		}
723 
724 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), frm[1], return);
725 		switch (*frm) {
726 		case IEEE80211_ELEMID_SSID:
727 			scan.ssid = frm;
728 			break;
729 		case IEEE80211_ELEMID_RATES:
730 			scan.rates = frm;
731 			break;
732 		case IEEE80211_ELEMID_COUNTRY:
733 			scan.country = frm;
734 			break;
735 		case IEEE80211_ELEMID_FHPARMS:
736 			if (ic->ic_phytype == IEEE80211_T_FH) {
737 				scan.fhdwell = LE_16(*(uint16_t *)(frm + 2));
738 				scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
739 				scan.fhindex = frm[6];
740 				scan.phytype = IEEE80211_T_FH;
741 			}
742 			break;
743 		case IEEE80211_ELEMID_DSPARMS:
744 			if (ic->ic_phytype != IEEE80211_T_FH) {
745 				scan.chan = frm[2];
746 				scan.phytype = IEEE80211_T_DS;
747 			}
748 			break;
749 		case IEEE80211_ELEMID_TIM:
750 			scan.tim = frm;
751 			scan.timoff = _PTRDIFF(frm, mp->b_rptr);
752 			break;
753 		case IEEE80211_ELEMID_IBSSPARMS:
754 			break;
755 		case IEEE80211_ELEMID_XRATES:
756 			scan.xrates = frm;
757 			break;
758 		case IEEE80211_ELEMID_ERP:
759 			if (frm[1] != 1) {
760 				ieee80211_dbg(IEEE80211_MSG_ELEMID,
761 				    "ieee80211_recv_mgmt: ignore %s, "
762 				    "invalid ERP element; "
763 				    "length %u, expecting 1\n",
764 				    IEEE80211_SUBTYPE_NAME(subtype),
765 				    frm[1]);
766 				break;
767 			}
768 			scan.erp = frm[2];
769 			scan.phytype = IEEE80211_T_OFDM;
770 			break;
771 		case IEEE80211_ELEMID_RSN:
772 			scan.wpa = frm;
773 			break;
774 		case IEEE80211_ELEMID_VENDOR:
775 			if (iswpaoui(frm))
776 				scan.wpa = frm;		/* IEEE802.11i D3.0 */
777 			break;
778 		default:
779 			ieee80211_dbg(IEEE80211_MSG_ELEMID,
780 			    "ieee80211_recv_mgmt: ignore %s,"
781 			    "unhandled id %u, len %u, totallen %u",
782 			    IEEE80211_SUBTYPE_NAME(subtype),
783 			    *frm, frm[1],
784 			    MBLKL(mp));
785 			break;
786 		}
787 		/* frm[1] - component length */
788 		frm += IEEE80211_ELEM_LEN(frm[1]);
789 	}
790 	IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE, return);
791 	IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return);
792 	if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) {
793 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
794 		    "ieee80211_recv_mgmt: ignore %s ,"
795 		    "invalid channel %u\n",
796 		    IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
797 		return;
798 	}
799 	if (scan.chan != scan.bchan &&
800 	    ic->ic_phytype != IEEE80211_T_FH) {
801 		/*
802 		 * Frame was received on a channel different from the
803 		 * one indicated in the DS params element id;
804 		 * silently discard it.
805 		 *
806 		 * NB:	this can happen due to signal leakage.
807 		 *	But we should take it for FH phy because
808 		 *	the rssi value should be correct even for
809 		 *	different hop pattern in FH.
810 		 */
811 		ieee80211_dbg(IEEE80211_MSG_ELEMID,
812 		    "ieee80211_recv_mgmt: ignore %s ,"
813 		    "phytype %u channel %u marked for %u\n",
814 		    IEEE80211_SUBTYPE_NAME(subtype),
815 		    ic->ic_phytype, scan.bchan, scan.chan);
816 		return;
817 	}
818 	if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
819 	    scan.bintval <= IEEE80211_BINTVAL_MAX)) {
820 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
821 		    "ieee80211_recv_mgmt: ignore %s ,"
822 		    "bogus beacon interval %u\n",
823 		    IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
824 		return;
825 	}
826 
827 	/*
828 	 * When operating in station mode, check for state updates.
829 	 * Be careful to ignore beacons received while doing a
830 	 * background scan.  We consider only 11g/WMM stuff right now.
831 	 */
832 	if (ic->ic_opmode == IEEE80211_M_STA &&
833 	    in->in_associd != 0 &&
834 	    (!(ic->ic_flags & IEEE80211_F_SCAN) ||
835 	    IEEE80211_ADDR_EQ(wh->i_addr2, in->in_bssid))) {
836 		/* record tsf of last beacon */
837 		bcopy(scan.tstamp, in->in_tstamp.data,
838 		    sizeof (in->in_tstamp));
839 		/* count beacon frame for s/w bmiss handling */
840 		im->im_swbmiss_count++;
841 		im->im_bmiss_count = 0;
842 
843 		if ((in->in_capinfo ^ scan.capinfo) &
844 		    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
845 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
846 			    "ieee80211_recv_mgmt: "
847 			    "[%s] cap change: before 0x%x, now 0x%x\n",
848 			    ieee80211_macaddr_sprintf(wh->i_addr2),
849 			    in->in_capinfo, scan.capinfo);
850 			/*
851 			 * NB:	we assume short preamble doesn't
852 			 *	change dynamically
853 			 */
854 			ieee80211_set_shortslottime(ic,
855 			    ic->ic_curmode == IEEE80211_MODE_11A ||
856 			    (scan.capinfo &
857 			    IEEE80211_CAPINFO_SHORT_SLOTTIME));
858 			in->in_capinfo = scan.capinfo;
859 		}
860 
861 		if (scan.tim != NULL) {
862 			struct ieee80211_tim_ie *ie;
863 
864 			ie = (struct ieee80211_tim_ie *)scan.tim;
865 			in->in_dtim_count = ie->tim_count;
866 			in->in_dtim_period = ie->tim_period;
867 		}
868 		if (ic->ic_flags & IEEE80211_F_SCAN) {
869 			ieee80211_add_scan(ic, &scan, wh, subtype, rssi,
870 			    rstamp);
871 		}
872 		return;
873 	}
874 	/*
875 	 * If scanning, just pass information to the scan module.
876 	 */
877 	if (ic->ic_flags & IEEE80211_F_SCAN) {
878 		ieee80211_add_scan(ic, &scan, wh, subtype, rssi, rstamp);
879 		return;
880 	}
881 
882 	if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
883 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
884 			/*
885 			 * Create a new entry in the neighbor table.
886 			 */
887 			in = ieee80211_add_neighbor(ic, wh, &scan);
888 		} else if (in->in_capinfo == 0) {
889 			/*
890 			 * Update faked node created on transmit.
891 			 * Note this also updates the tsf.
892 			 */
893 			ieee80211_init_neighbor(in, wh, &scan);
894 		} else {
895 			/*
896 			 * Record tsf for potential resync.
897 			 */
898 			bcopy(scan.tstamp, in->in_tstamp.data,
899 			    sizeof (in->in_tstamp));
900 		}
901 		if (in != NULL) {
902 			in->in_rssi = (uint8_t)rssi;
903 			in->in_rstamp = rstamp;
904 		}
905 	}
906 }
907 
908 /*
909  * Perform input processing for 802.11 management frames.
910  * It's the default ic_recv_mgmt callback function for the interface
911  * softc, ic. Tipically ic_recv_mgmt is called within ieee80211_input()
912  */
913 void
914 ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
915     int subtype, int rssi, uint32_t rstamp)
916 {
917 	struct ieee80211_frame *wh;
918 	uint8_t *frm;		/* pointer to start of the frame */
919 	uint8_t *efrm;		/* pointer to end of the frame */
920 	uint8_t *ssid;
921 	uint8_t *rates;
922 	uint8_t *xrates;	/* extended rates */
923 	boolean_t allocbs = B_FALSE;
924 	uint8_t rate;
925 	uint16_t algo;		/* authentication algorithm */
926 	uint16_t seq;		/* sequence no */
927 	uint16_t status;
928 	uint16_t capinfo;
929 	uint16_t associd;	/* association ID */
930 
931 	IEEE80211_LOCK(ic);
932 	wh = (struct ieee80211_frame *)mp->b_rptr;
933 	frm = (uint8_t *)&wh[1];
934 	efrm = (uint8_t *)mp->b_wptr;
935 	switch (subtype) {
936 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
937 	case IEEE80211_FC0_SUBTYPE_BEACON:
938 		ieee80211_recv_beacon(ic, mp, in, subtype, rssi, rstamp);
939 		break;
940 
941 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
942 		if (ic->ic_opmode == IEEE80211_M_STA ||
943 		    ic->ic_state != IEEE80211_S_RUN ||
944 		    IEEE80211_IS_MULTICAST(wh->i_addr2)) {
945 			break;
946 		}
947 
948 		/*
949 		 * prreq frame format
950 		 *	[tlv] ssid
951 		 *	[tlv] supported rates
952 		 *	[tlv] extended supported rates
953 		 */
954 		ssid = rates = xrates = NULL;
955 		while (frm < efrm) {
956 			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
957 			    frm[1], goto out);
958 			switch (*frm) {
959 			case IEEE80211_ELEMID_SSID:
960 				ssid = frm;
961 				break;
962 			case IEEE80211_ELEMID_RATES:
963 				rates = frm;
964 				break;
965 			case IEEE80211_ELEMID_XRATES:
966 				xrates = frm;
967 				break;
968 			}
969 			frm += frm[1] + 2;
970 		}
971 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
972 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, break);
973 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break);
974 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
975 			ieee80211_dbg(IEEE80211_MSG_INPUT,
976 			    "ieee80211_recv_mgmt: ignore %s, "
977 			    "no ssid with ssid suppression enabled",
978 			    IEEE80211_SUBTYPE_NAME(subtype));
979 			break;
980 		}
981 
982 		if (in == ic->ic_bss) {
983 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
984 				in = ieee80211_tmp_node(ic, wh->i_addr2);
985 				allocbs = B_TRUE;
986 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2,
987 			    in->in_macaddr)) {
988 				/*
989 				 * Cannot tell if the sender is operating
990 				 * in ibss mode.  But we need a new node to
991 				 * send the response so blindly add them to the
992 				 * neighbor table.
993 				 */
994 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
995 				    wh->i_addr2);
996 			}
997 			if (in == NULL)
998 				break;
999 		}
1000 		ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: "
1001 		    "[%s] recv probe req\n",
1002 		    ieee80211_macaddr_sprintf(wh->i_addr2));
1003 		in->in_rssi = (uint8_t)rssi;
1004 		in->in_rstamp = rstamp;
1005 		/*
1006 		 * Adjust and check station's rate list with device's
1007 		 * supported rate.  Send back response if there is at
1008 		 * least one rate or the fixed rate(if being set) is
1009 		 * supported by both station and the device
1010 		 */
1011 		rate = ieee80211_setup_rates(in, rates, xrates,
1012 		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1013 		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1014 		if (rate & IEEE80211_RATE_BASIC) {
1015 			ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt"
1016 			    "%s recv'd rate set invalid",
1017 			    IEEE80211_SUBTYPE_NAME(subtype));
1018 		} else {
1019 			IEEE80211_UNLOCK(ic);
1020 			IEEE80211_SEND_MGMT(ic, in,
1021 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
1022 			IEEE80211_LOCK(ic);
1023 		}
1024 		if (allocbs) {
1025 			/*
1026 			 * Temporary node created just to send a
1027 			 * response, reclaim immediately.
1028 			 */
1029 			ieee80211_free_node(in);
1030 		}
1031 		break;
1032 
1033 	case IEEE80211_FC0_SUBTYPE_AUTH:
1034 		/*
1035 		 * auth frame format
1036 		 *	[2] algorithm
1037 		 *	[2] sequence
1038 		 *	[2] status
1039 		 *	[tlv*] challenge
1040 		 */
1041 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1042 		    IEEE80211_AUTH_ELEM_MIN, break);
1043 		algo   = (*(uint16_t *)frm);
1044 		seq    = (*(uint16_t *)(frm + 2));
1045 		status = (*(uint16_t *)(frm + 4));
1046 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: "
1047 		    "[%s] recv auth frame with algorithm %d seq %d\n",
1048 		    ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
1049 
1050 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
1051 			ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1052 			    "ieee80211_recv_mgmt: ignore auth, %s\n",
1053 			    "TKIP countermeasures enabled");
1054 			break;
1055 		}
1056 		switch (algo) {
1057 		case IEEE80211_AUTH_ALG_SHARED:
1058 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, in,
1059 			    seq, status);
1060 			break;
1061 		case IEEE80211_AUTH_ALG_OPEN:
1062 			ieee80211_auth_open(ic, wh, in, seq, status);
1063 			break;
1064 		default:
1065 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1066 			    "ignore auth, unsupported alg %d", algo);
1067 			break;
1068 		}
1069 		break;
1070 
1071 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1072 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1073 		if (ic->ic_opmode != IEEE80211_M_STA ||
1074 		    ic->ic_state != IEEE80211_S_ASSOC)
1075 			break;
1076 
1077 		/*
1078 		 * asresp frame format
1079 		 *	[2] capability information
1080 		 *	[2] status
1081 		 *	[2] association ID
1082 		 *	[tlv] supported rates
1083 		 *	[tlv] extended supported rates
1084 		 *	[tlv] WME
1085 		 */
1086 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1087 		    IEEE80211_ASSOC_RESP_ELEM_MIN, break);
1088 		in = ic->ic_bss;
1089 		capinfo = (*(uint16_t *)frm);
1090 		frm += 2;
1091 		status = (*(uint16_t *)frm);
1092 		frm += 2;
1093 		if (status != 0) {
1094 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1095 			    "assoc failed (reason %d)\n", status);
1096 			in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2);
1097 			if (in != NULL) {
1098 				in->in_fails++;
1099 				ieee80211_free_node(in);
1100 			}
1101 			break;
1102 		}
1103 		associd = (*(uint16_t *)frm);
1104 		frm += 2;
1105 
1106 		rates = xrates = NULL;
1107 		while (frm < efrm) {
1108 			/*
1109 			 * Do not discard frames containing proprietary Agere
1110 			 * elements 128 and 129, as the reported element length
1111 			 * is often wrong. Skip rest of the frame, since we can
1112 			 * not rely on the given element length making it
1113 			 * impossible to know where the next element starts
1114 			 */
1115 			if ((*frm == IEEE80211_ELEMID_AGERE1) ||
1116 			    (*frm == IEEE80211_ELEMID_AGERE2)) {
1117 				frm = efrm;
1118 				break;
1119 			}
1120 
1121 			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1122 			    frm[1], goto out);
1123 			switch (*frm) {
1124 			case IEEE80211_ELEMID_RATES:
1125 				rates = frm;
1126 				break;
1127 			case IEEE80211_ELEMID_XRATES:
1128 				xrates = frm;
1129 				break;
1130 			}
1131 			frm += frm[1] + 2;
1132 		}
1133 
1134 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
1135 		/*
1136 		 * Adjust and check AP's rate list with device's
1137 		 * supported rate. Re-start scan if no rate is or the
1138 		 * fixed rate(if being set) cannot be supported by
1139 		 * either AP or the device.
1140 		 */
1141 		rate = ieee80211_setup_rates(in, rates, xrates,
1142 		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1143 		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1144 		if (rate & IEEE80211_RATE_BASIC) {
1145 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1146 			    "assoc failed (rate set mismatch)\n");
1147 			if (in != ic->ic_bss)
1148 				in->in_fails++;
1149 			IEEE80211_UNLOCK(ic);
1150 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1151 			return;
1152 		}
1153 
1154 		in->in_capinfo = capinfo;
1155 		in->in_associd = associd;
1156 		in->in_flags &= ~IEEE80211_NODE_QOS;
1157 		/*
1158 		 * Configure state now that we are associated.
1159 		 */
1160 		if (ic->ic_curmode == IEEE80211_MODE_11A ||
1161 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1162 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1163 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1164 		} else {
1165 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1166 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1167 		}
1168 		ieee80211_set_shortslottime(ic,
1169 		    ic->ic_curmode == IEEE80211_MODE_11A ||
1170 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1171 		/*
1172 		 * Honor ERP protection.
1173 		 *
1174 		 * NB:	in_erp should zero for non-11g operation.
1175 		 *	check ic_curmode anyway
1176 		 */
1177 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
1178 		    (in->in_erp & IEEE80211_ERP_USE_PROTECTION))
1179 			ic->ic_flags |= IEEE80211_F_USEPROT;
1180 		else
1181 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1182 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1183 		    "assoc success: %s preamble, %s slot time%s%s\n",
1184 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1185 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1186 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1187 		    in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
1188 		IEEE80211_UNLOCK(ic);
1189 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
1190 		return;
1191 
1192 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1193 		if (ic->ic_state == IEEE80211_S_SCAN)
1194 			break;
1195 
1196 		/*
1197 		 * deauth frame format
1198 		 *	[2] reason
1199 		 */
1200 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1201 		status = (*(uint16_t *)frm);
1202 
1203 		ieee80211_dbg(IEEE80211_MSG_AUTH,
1204 		    "recv deauthenticate (reason %d)\n", status);
1205 		switch (ic->ic_opmode) {
1206 		case IEEE80211_M_STA:
1207 			IEEE80211_UNLOCK(ic);
1208 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
1209 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1210 			return;
1211 		default:
1212 			break;
1213 		}
1214 		break;
1215 
1216 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1217 		if (ic->ic_state != IEEE80211_S_RUN &&
1218 		    ic->ic_state != IEEE80211_S_ASSOC &&
1219 		    ic->ic_state != IEEE80211_S_AUTH)
1220 			break;
1221 		/*
1222 		 * disassoc frame format
1223 		 *	[2] reason
1224 		 */
1225 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1226 		status = (*(uint16_t *)frm);
1227 
1228 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1229 		    "recv disassociate (reason %d)\n", status);
1230 		switch (ic->ic_opmode) {
1231 		case IEEE80211_M_STA:
1232 			IEEE80211_UNLOCK(ic);
1233 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1234 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1235 			return;
1236 		default:
1237 			break;
1238 		}
1239 		break;
1240 
1241 	default:
1242 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1243 		    "subtype 0x%x not handled\n", subtype);
1244 		break;
1245 	} /* switch subtype */
1246 out:
1247 	IEEE80211_UNLOCK(ic);
1248 }
1249