xref: /titanic_41/usr/src/uts/common/io/net80211/net80211_input.c (revision b7d3956b92a285d8dac2c7f5f7e28d2ef5347ef8)
1 /*
2  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2001 Atsushi Onoe
8  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * Alternatively, this software may be distributed under the terms of the
23  * GNU General Public License ("GPL") version 2 as published by the Free
24  * Software Foundation.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 #pragma ident	"%Z%%M%	%I%	%E% SMI"
39 
40 /*
41  * Process received frame
42  */
43 
44 #include <sys/byteorder.h>
45 #include "net80211_impl.h"
46 
47 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *,
48     mblk_t *, int);
49 
50 /*
51  * Process a received frame.  The node associated with the sender
52  * should be supplied.  If nothing was found in the node table then
53  * the caller is assumed to supply a reference to ic_bss instead.
54  * The RSSI and a timestamp are also supplied.  The RSSI data is used
55  * during AP scanning to select a AP to associate with; it can have
56  * any units so long as values have consistent units and higher values
57  * mean ``better signal''.  The receive timestamp is currently not used
58  * by the 802.11 layer.
59  */
60 int
61 ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
62     int32_t rssi, uint32_t rstamp)
63 {
64 	struct ieee80211_frame *wh;
65 	struct ieee80211_key *key;
66 	uint8_t *bssid;
67 	int hdrspace;
68 	int len;
69 	uint16_t rxseq;
70 	uint8_t dir;
71 	uint8_t type;
72 	uint8_t subtype;
73 	uint8_t tid;
74 
75 	ASSERT(in != NULL);
76 	type = (uint8_t)-1;		/* undefined */
77 	len = mp->b_wptr - mp->b_rptr;
78 	if (len < sizeof (struct ieee80211_frame_min)) {
79 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
80 			"too short (1): len %u", len);
81 		goto out;
82 	}
83 	/*
84 	 * Bit of a cheat here, we use a pointer for a 3-address
85 	 * frame format but don't reference fields past outside
86 	 * ieee80211_frame_min w/o first validating the data is
87 	 * present.
88 	 */
89 	wh = (struct ieee80211_frame *)mp->b_rptr;
90 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
91 	    IEEE80211_FC0_VERSION_0) {
92 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
93 			"discard pkt with wrong version %x", wh->i_fc[0]);
94 		goto out;
95 	}
96 
97 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
98 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
99 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
100 
101 	IEEE80211_LOCK(ic);
102 	if (!(ic->ic_flags & IEEE80211_F_SCAN)) {
103 		switch (ic->ic_opmode) {
104 		case IEEE80211_M_STA:
105 			bssid = wh->i_addr2;
106 			if (!IEEE80211_ADDR_EQ(bssid, in->in_bssid))
107 				goto out_exit_mutex;
108 			break;
109 		case IEEE80211_M_IBSS:
110 		case IEEE80211_M_AHDEMO:
111 			if (dir != IEEE80211_FC1_DIR_NODS) {
112 				bssid = wh->i_addr1;
113 			} else if (type == IEEE80211_FC0_TYPE_CTL) {
114 				bssid = wh->i_addr1;
115 			} else {
116 				if (len < sizeof (struct ieee80211_frame)) {
117 					ieee80211_dbg(IEEE80211_MSG_ANY,
118 						"ieee80211_input: too short(2):"
119 						"len %u\n", len);
120 					goto out_exit_mutex;
121 				}
122 				bssid = wh->i_addr3;
123 			}
124 			if (type != IEEE80211_FC0_TYPE_DATA)
125 				break;
126 			/*
127 			 * Data frame, validate the bssid.
128 			 */
129 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->in_bssid) &&
130 			    !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) {
131 				/* not interested in */
132 				ieee80211_dbg(IEEE80211_MSG_INPUT,
133 					"ieee80211_input: not to bss %s\n",
134 					ieee80211_macaddr_sprintf(bssid));
135 				goto out_exit_mutex;
136 			}
137 			/*
138 			 * For adhoc mode we cons up a node when it doesn't
139 			 * exist. This should probably done after an ACL check.
140 			 */
141 			if (in == ic->ic_bss &&
142 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
143 			    !IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
144 				/*
145 				 * Fake up a node for this newly
146 				 * discovered member of the IBSS.
147 				 */
148 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
149 					wh->i_addr2);
150 				if (in == NULL) {
151 					/* NB: stat kept for alloc failure */
152 					goto out_exit_mutex;
153 				}
154 			}
155 			break;
156 		default:
157 			goto out_exit_mutex;
158 		}
159 		in->in_rssi = (uint8_t)rssi;
160 		in->in_rstamp = rstamp;
161 		if (!(type & IEEE80211_FC0_TYPE_CTL)) {
162 			tid = 0;
163 			rxseq = (*(uint16_t *)wh->i_seq);
164 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
165 			    (rxseq - in->in_rxseqs[tid]) <= 0) {
166 				/* duplicate, discard */
167 				ieee80211_dbg(IEEE80211_MSG_INPUT,
168 					"ieee80211_input: duplicate",
169 					"seqno <%u,%u> fragno <%u,%u> tid %u",
170 					rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
171 					in->in_rxseqs[tid] >>
172 						IEEE80211_SEQ_SEQ_SHIFT,
173 					rxseq & IEEE80211_SEQ_FRAG_MASK,
174 					in->in_rxseqs[tid] &
175 						IEEE80211_SEQ_FRAG_MASK,
176 					tid);
177 				ic->ic_stats.is_rx_dups++;
178 				goto out_exit_mutex;
179 			}
180 			in->in_rxseqs[tid] = rxseq;
181 		}
182 		in->in_inact = 0;
183 	}
184 
185 	hdrspace = ieee80211_hdrspace(wh);
186 	switch (type) {
187 	case IEEE80211_FC0_TYPE_DATA:
188 		if (len < hdrspace) {
189 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
190 				"data too short: expecting %u", hdrspace);
191 			goto out_exit_mutex;
192 		}
193 		switch (ic->ic_opmode) {
194 		case IEEE80211_M_STA:
195 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
196 				ieee80211_dbg(IEEE80211_MSG_INPUT,
197 					"ieee80211_input: data ",
198 					"unknown dir 0x%x", dir);
199 				goto out_exit_mutex;
200 			}
201 			if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
202 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_macaddr)) {
203 				/*
204 				 * In IEEE802.11 network, multicast packet
205 				 * sent from me is broadcasted from AP.
206 				 * It should be silently discarded for
207 				 * SIMPLEX interface.
208 				 */
209 				ieee80211_dbg(IEEE80211_MSG_INPUT,
210 					"ieee80211_input: multicast echo\n");
211 				goto out_exit_mutex;
212 			}
213 			break;
214 		case IEEE80211_M_IBSS:
215 		case IEEE80211_M_AHDEMO:
216 			if (dir != IEEE80211_FC1_DIR_NODS) {
217 				ieee80211_dbg(IEEE80211_MSG_INPUT,
218 					"ieee80211_input: unknown dir 0x%x",
219 					dir);
220 				goto out_exit_mutex;
221 			}
222 			break;
223 		default:
224 			ieee80211_err("ieee80211_input: "
225 				"receive data, unknown opmode %u, skip\n",
226 				ic->ic_opmode);
227 			goto out_exit_mutex;
228 		}
229 
230 		/*
231 		 * Handle privacy requirements.
232 		 */
233 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
234 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
235 				/*
236 				 * Discard encrypted frames when privacy off.
237 				 */
238 				ieee80211_dbg(IEEE80211_MSG_INPUT,
239 					"ieee80211_input: ""WEP PRIVACY off");
240 				ic->ic_stats.is_wep_errors++;
241 				goto out_exit_mutex;
242 			}
243 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
244 			if (key == NULL) {
245 				/* NB: stats+msgs handled in crypto_decap */
246 				ic->ic_stats.is_wep_errors++;
247 				goto out_exit_mutex;
248 			}
249 			wh = (struct ieee80211_frame *)mp->b_rptr;
250 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
251 		} else {
252 			key = NULL;
253 		}
254 
255 		/*
256 		 * Next up, any fragmentation
257 		 */
258 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
259 			mp = ieee80211_defrag(ic, in, mp, hdrspace);
260 			if (mp == NULL) {
261 				/* Fragment dropped or frame not complete yet */
262 				goto out_exit_mutex;
263 			}
264 		}
265 		wh = NULL;	/* no longer valid, catch any uses */
266 
267 		/*
268 		 * Next strip any MSDU crypto bits.
269 		 */
270 		if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) {
271 			ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: "
272 				"data demic error\n");
273 			goto out_exit_mutex;
274 		}
275 
276 		ic->ic_stats.is_rx_frags++;
277 		ic->ic_stats.is_rx_bytes += len;
278 		IEEE80211_UNLOCK(ic);
279 		mac_rx(ic->ic_mach, NULL, mp);
280 		return (IEEE80211_FC0_TYPE_DATA);
281 
282 	case IEEE80211_FC0_TYPE_MGT:
283 		if (dir != IEEE80211_FC1_DIR_NODS)
284 			goto out_exit_mutex;
285 		if (len < sizeof (struct ieee80211_frame))
286 			goto out_exit_mutex;
287 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
288 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
289 				/*
290 				 * Only shared key auth frames with a challenge
291 				 * should be encrypted, discard all others.
292 				 */
293 				ieee80211_dbg(IEEE80211_MSG_INPUT,
294 					"ieee80211_input: "
295 					"%s WEP set but not permitted",
296 					IEEE80211_SUBTYPE_NAME(subtype));
297 				ic->ic_stats.is_wep_errors++;
298 				goto out_exit_mutex;
299 			}
300 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
301 				/*
302 				 * Discard encrypted frames when privacy off.
303 				 */
304 				ieee80211_dbg(IEEE80211_MSG_INPUT,
305 					"ieee80211_input: "
306 					"mgt WEP set but PRIVACY off");
307 				ic->ic_stats.is_wep_errors++;
308 				goto out_exit_mutex;
309 			}
310 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
311 			if (key == NULL) {
312 				/* NB: stats+msgs handled in crypto_decap */
313 				goto out_exit_mutex;
314 			}
315 			wh = (struct ieee80211_frame *)mp->b_rptr;
316 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
317 		}
318 		IEEE80211_UNLOCK(ic);
319 		ic->ic_recv_mgmt(ic, mp, in, subtype, rssi, rstamp);
320 		goto out;
321 
322 	case IEEE80211_FC0_TYPE_CTL:
323 	default:
324 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
325 			"bad frame type 0x%x", type);
326 		/* should not come here */
327 		break;
328 	}
329 out_exit_mutex:
330 	IEEE80211_UNLOCK(ic);
331 out:
332 	if (mp != NULL)
333 		freemsg(mp);
334 
335 	return (type);
336 }
337 
338 /*
339  * This function reassemble fragments.
340  * More fragments bit in the frame control means the packet is fragmented.
341  * While the sequence control field consists of 4-bit fragment number
342  * field and a 12-bit sequence number field.
343  */
344 /* ARGSUSED */
345 static mblk_t *
346 ieee80211_defrag(ieee80211com_t *ic, struct ieee80211_node *in, mblk_t *mp,
347     int hdrspace)
348 {
349 	struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr;
350 	struct ieee80211_frame *lwh;
351 	mblk_t *mfrag;
352 	uint16_t rxseq;
353 	uint8_t fragno;
354 	uint8_t more_frag;
355 
356 	ASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1));
357 	more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
358 	rxseq = LE_16(*(uint16_t *)wh->i_seq);
359 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
360 
361 	/* Quick way out, if there's nothing to defragment */
362 	if (!more_frag && fragno == 0 && in->in_rxfrag == NULL)
363 		return (mp);
364 
365 	/*
366 	 * Remove frag to insure it doesn't get reaped by timer.
367 	 */
368 	if (in->in_table == NULL) {
369 		/*
370 		 * Should never happen.  If the node is orphaned (not in
371 		 * the table) then input packets should not reach here.
372 		 * Otherwise, a concurrent request that yanks the table
373 		 * should be blocked by other interlocking and/or by first
374 		 * shutting the driver down.  Regardless, be defensive
375 		 * here and just bail
376 		 */
377 		freemsg(mp);
378 		return (NULL);
379 	}
380 	IEEE80211_NODE_LOCK(in->in_table);
381 	mfrag = in->in_rxfrag;
382 	in->in_rxfrag = NULL;
383 	IEEE80211_NODE_UNLOCK(in->in_table);
384 
385 	/*
386 	 * Validate new fragment is in order and
387 	 * related to the previous ones.
388 	 */
389 	if (mfrag != NULL) {
390 		uint16_t last_rxseq;
391 
392 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
393 		last_rxseq = LE_16(*(uint16_t *)lwh->i_seq);
394 		/*
395 		 * Sequence control field contains 12-bit sequence no
396 		 * and 4-bit fragment number. For fragemnts, the
397 		 * sequence no is not changed.
398 		 * NB: check seq # and frag together
399 		 */
400 		if (rxseq != last_rxseq + 1 ||
401 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
402 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
403 			/*
404 			 * Unrelated fragment or no space for it,
405 			 * clear current fragments.
406 			 */
407 			freemsg(mfrag);
408 			mfrag = NULL;
409 		}
410 	}
411 
412 	if (mfrag == NULL) {
413 		if (fragno != 0) {	/* !first fragment, discard */
414 			freemsg(mp);
415 			return (NULL);
416 		}
417 		mfrag = mp;
418 	} else {			/* concatenate */
419 		(void) adjmsg(mp, hdrspace);
420 		linkb(mfrag, mp);
421 		/* track last seqnum and fragno */
422 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
423 		*(uint16_t *)lwh->i_seq = *(uint16_t *)wh->i_seq;
424 	}
425 	if (more_frag != 0) {		/* more to come, save */
426 		in->in_rxfragstamp = ddi_get_lbolt();
427 		in->in_rxfrag = mfrag;
428 		mfrag = NULL;
429 	}
430 
431 	return (mfrag);
432 }
433 
434 /*
435  * Install received rate set information in the node's state block.
436  */
437 int
438 ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates,
439     const uint8_t *xrates, int flags)
440 {
441 	struct ieee80211_rateset *rs = &in->in_rates;
442 
443 	bzero(rs, sizeof (*rs));
444 	rs->ir_nrates = rates[1];
445 	/* skip 1 byte element ID and 1 byte length */
446 	bcopy(rates + 2, rs->ir_rates, rs->ir_nrates);
447 	if (xrates != NULL) {
448 		uint8_t nxrates;
449 
450 		/*
451 		 * Tack on 11g extended supported rate element.
452 		 */
453 		nxrates = xrates[1];
454 		if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
455 			nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
456 			ieee80211_dbg(IEEE80211_MSG_XRATE,
457 				"ieee80211_setup_rates: %s",
458 				"[%s] extended rate set too large;"
459 				" only using %u of %u rates\n",
460 				ieee80211_macaddr_sprintf(in->in_macaddr),
461 				nxrates, xrates[1]);
462 		}
463 		bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
464 		rs->ir_nrates += nxrates;
465 	}
466 	return (ieee80211_fix_rate(in, flags));
467 }
468 
469 /*
470  * Process open-system authentication response frame and start
471  * association if the authentication request is accepted.
472  */
473 static void
474 ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
475     struct ieee80211_node *in, uint16_t seq, uint16_t status)
476 {
477 	IEEE80211_LOCK_ASSERT(ic);
478 	if (in->in_authmode == IEEE80211_AUTH_SHARED) {
479 		ieee80211_dbg(IEEE80211_MSG_AUTH,
480 			"open auth: bad sta auth mode %u", in->in_authmode);
481 		return;
482 	}
483 	if (ic->ic_opmode == IEEE80211_M_STA) {
484 		if (ic->ic_state != IEEE80211_S_AUTH ||
485 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
486 			return;
487 		}
488 		IEEE80211_UNLOCK(ic);
489 		if (status != 0) {
490 			ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
491 				"open auth failed (reason %d)\n", status);
492 			if (in != ic->ic_bss)
493 				in->in_fails++;
494 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
495 		} else {
496 			/* i_fc[0] - frame control's type & subtype field */
497 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
498 				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
499 		}
500 		IEEE80211_LOCK(ic);
501 	} else {
502 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: "
503 			"bad operating mode %u", ic->ic_opmode);
504 	}
505 }
506 
507 /*
508  * Allocate challenge text for use by shared-key authentication
509  * Return B_TRUE on success, B_FALST otherwise.
510  */
511 static boolean_t
512 ieee80211_alloc_challenge(struct ieee80211_node *in)
513 {
514 	if (in->in_challenge == NULL) {
515 		in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN,
516 			KM_NOSLEEP);
517 	}
518 	if (in->in_challenge == NULL) {
519 		ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
520 			"[%s] shared key challenge alloc failed\n",
521 			ieee80211_macaddr_sprintf(in->in_macaddr));
522 	}
523 	return (in->in_challenge != NULL);
524 }
525 
526 /*
527  * Process shared-key authentication response frames. If authentication
528  * succeeds, start association; otherwise, restart scan.
529  */
530 static void
531 ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
532     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *in, uint16_t seq,
533     uint16_t status)
534 {
535 	uint8_t *challenge;
536 
537 	/*
538 	 * Pre-shared key authentication is evil; accept
539 	 * it only if explicitly configured (it is supported
540 	 * mainly for compatibility with clients like OS X).
541 	 */
542 	IEEE80211_LOCK_ASSERT(ic);
543 	if (in->in_authmode != IEEE80211_AUTH_AUTO &&
544 	    in->in_authmode != IEEE80211_AUTH_SHARED) {
545 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: "
546 			"bad sta auth mode %u", in->in_authmode);
547 		goto bad;
548 	}
549 
550 	challenge = NULL;
551 	if (frm + 1 < efrm) {
552 		/*
553 		 * Challenge text information element
554 		 * frm[0] - element ID
555 		 * frm[1] - length
556 		 * frm[2]... - challenge text
557 		 */
558 		if ((frm[1] + 2) > (efrm - frm)) {
559 			ieee80211_dbg(IEEE80211_MSG_AUTH,
560 				"ieee80211_auth_shared: ie %d%d too long\n",
561 				frm[0], (frm[1] + 2) - (efrm - frm));
562 			goto bad;
563 		}
564 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
565 			challenge = frm;
566 		frm += frm[1] + 2;
567 	}
568 	switch (seq) {
569 	case IEEE80211_AUTH_SHARED_CHALLENGE:
570 	case IEEE80211_AUTH_SHARED_RESPONSE:
571 		if (challenge == NULL) {
572 			ieee80211_dbg(IEEE80211_MSG_AUTH,
573 				"ieee80211_auth_shared: no challenge\n");
574 			goto bad;
575 		}
576 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
577 			ieee80211_dbg(IEEE80211_MSG_AUTH,
578 				"ieee80211_auth_shared: bad challenge len %d\n",
579 				challenge[1]);
580 			goto bad;
581 		}
582 	default:
583 		break;
584 	}
585 	switch (ic->ic_opmode) {
586 	case IEEE80211_M_STA:
587 		if (ic->ic_state != IEEE80211_S_AUTH)
588 			return;
589 		switch (seq) {
590 		case IEEE80211_AUTH_SHARED_PASS:
591 			if (in->in_challenge != NULL) {
592 				kmem_free(in->in_challenge,
593 				    IEEE80211_CHALLENGE_LEN);
594 				in->in_challenge = NULL;
595 			}
596 			if (status != 0) {
597 				ieee80211_dbg(IEEE80211_MSG_DEBUG |
598 					IEEE80211_MSG_AUTH,
599 					"shared key auth failed (reason %d)\n",
600 					status);
601 				if (in != ic->ic_bss)
602 					in->in_fails++;
603 				return;
604 			}
605 			IEEE80211_UNLOCK(ic);
606 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
607 				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
608 			IEEE80211_LOCK(ic);
609 			break;
610 		case IEEE80211_AUTH_SHARED_CHALLENGE:
611 			if (!ieee80211_alloc_challenge(in))
612 				return;
613 			bcopy(&challenge[2], in->in_challenge, challenge[1]);
614 			IEEE80211_UNLOCK(ic);
615 			IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
616 				seq + 1);
617 			IEEE80211_LOCK(ic);
618 			break;
619 		default:
620 			ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: "
621 				"shared key auth: bad seq %d", seq);
622 			return;
623 		}
624 		break;
625 
626 	default:
627 		ieee80211_dbg(IEEE80211_MSG_AUTH,
628 			"ieee80211_auth_shared: bad opmode %u\n",
629 			ic->ic_opmode);
630 		break;
631 	}
632 	return;
633 bad:
634 	if (ic->ic_opmode == IEEE80211_M_STA) {
635 		/*
636 		 * Kick the state machine.  This short-circuits
637 		 * using the mgt frame timeout to trigger the
638 		 * state transition.
639 		 */
640 		if (ic->ic_state == IEEE80211_S_AUTH) {
641 			IEEE80211_UNLOCK(ic);
642 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
643 			IEEE80211_LOCK(ic);
644 		}
645 	}
646 }
647 
648 static int
649 iswpaoui(const uint8_t *frm)
650 {
651 	uint32_t c = *(uint32_t *)(frm + 2);
652 	return (frm[1] > 3 && c == ((WPA_OUI_TYPE << 24) | WPA_OUI));
653 }
654 
655 /*
656  * Process a beacon/probe response frame.
657  * When the device is in station mode, create a node and add it
658  * to the node database for a new ESS or update node info if it's
659  * already there.
660  */
661 static void
662 ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
663     int subtype, int rssi, uint32_t rstamp)
664 {
665 	ieee80211_impl_t *im = ic->ic_private;
666 	struct ieee80211_frame *wh;
667 	uint8_t *frm;
668 	uint8_t *efrm;	/* end of frame body */
669 	struct ieee80211_scanparams scan;
670 
671 	wh = (struct ieee80211_frame *)mp->b_rptr;
672 	frm = (uint8_t *)&wh[1];
673 	efrm = (uint8_t *)mp->b_wptr;
674 
675 	/*
676 	 * We process beacon/probe response frames:
677 	 *    o when scanning, or
678 	 *    o station mode when associated (to collect state
679 	 *	updates such as 802.11g slot time), or
680 	 *    o adhoc mode (to discover neighbors)
681 	 * Frames otherwise received are discarded.
682 	 */
683 	if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
684 	    (ic->ic_opmode == IEEE80211_M_STA && in->in_associd != 0) ||
685 	    ic->ic_opmode == IEEE80211_M_IBSS)) {
686 		return;
687 	}
688 
689 	/*
690 	 * beacon/probe response frame format
691 	 *	[8] time stamp
692 	 *	[2] beacon interval
693 	 *	[2] capability information
694 	 *	[tlv] ssid
695 	 *	[tlv] supported rates
696 	 *	[tlv] country information
697 	 *	[tlv] parameter set (FH/DS)
698 	 *	[tlv] erp information
699 	 *	[tlv] extended supported rates
700 	 *	[tlv] WME
701 	 *	[tlv] WPA or RSN
702 	 */
703 	IEEE80211_VERIFY_LENGTH(efrm - frm, IEEE80211_BEACON_ELEM_MIN, return);
704 	bzero(&scan, sizeof (scan));
705 	scan.tstamp  = frm;
706 	frm += 8;
707 	scan.bintval = (*(uint16_t *)frm);
708 	frm += 2;
709 	scan.capinfo = (*(uint16_t *)frm);
710 	frm += 2;
711 	scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
712 	scan.chan = scan.bchan;
713 
714 	while (frm < efrm) {
715 		/* Agere element in beacon */
716 		if ((*frm == IEEE80211_ELEMID_AGERE1) ||
717 		    (*frm == IEEE80211_ELEMID_AGERE2)) {
718 			frm = efrm;
719 			break;
720 		}
721 
722 		IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], return);
723 		switch (*frm) {
724 		case IEEE80211_ELEMID_SSID:
725 			scan.ssid = frm;
726 			break;
727 		case IEEE80211_ELEMID_RATES:
728 			scan.rates = frm;
729 			break;
730 		case IEEE80211_ELEMID_COUNTRY:
731 			scan.country = frm;
732 			break;
733 		case IEEE80211_ELEMID_FHPARMS:
734 			if (ic->ic_phytype == IEEE80211_T_FH) {
735 				scan.fhdwell = LE_16(*(uint16_t *)(frm + 2));
736 				scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
737 				scan.fhindex = frm[6];
738 				scan.phytype = IEEE80211_T_FH;
739 			}
740 			break;
741 		case IEEE80211_ELEMID_DSPARMS:
742 			if (ic->ic_phytype != IEEE80211_T_FH) {
743 				scan.chan = frm[2];
744 				scan.phytype = IEEE80211_T_DS;
745 			}
746 			break;
747 		case IEEE80211_ELEMID_TIM:
748 			scan.tim = frm;
749 			scan.timoff = frm - mp->b_rptr;
750 			break;
751 		case IEEE80211_ELEMID_IBSSPARMS:
752 			break;
753 		case IEEE80211_ELEMID_XRATES:
754 			scan.xrates = frm;
755 			break;
756 		case IEEE80211_ELEMID_ERP:
757 			if (frm[1] != 1) {
758 				ieee80211_dbg(IEEE80211_MSG_ELEMID,
759 					"ieee80211_recv_mgmt: ignore %s, "
760 					"invalid ERP element; "
761 					"length %u, expecting 1\n",
762 					IEEE80211_SUBTYPE_NAME(subtype),
763 					frm[1]);
764 				break;
765 			}
766 			scan.erp = frm[2];
767 			scan.phytype = IEEE80211_T_OFDM;
768 			break;
769 		case IEEE80211_ELEMID_RSN:
770 			scan.wpa = frm;
771 			break;
772 		case IEEE80211_ELEMID_VENDOR:
773 			if (iswpaoui(frm))
774 				scan.wpa = frm;		/* IEEE802.11i D3.0 */
775 			break;
776 		default:
777 			ieee80211_dbg(IEEE80211_MSG_ELEMID,
778 				"ieee80211_recv_mgmt: ignore %s,"
779 				"unhandled id %u, len %u, totallen %u",
780 				IEEE80211_SUBTYPE_NAME(subtype),
781 				*frm, frm[1],
782 				mp->b_wptr - mp->b_rptr);
783 			break;
784 		}
785 		/* frm[1] - component length */
786 		frm += IEEE80211_ELEM_LEN(frm[1]);
787 	}
788 	IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE, return);
789 	IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return);
790 	if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) {
791 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
792 			"ieee80211_recv_mgmt: ignore %s ,"
793 			"invalid channel %u\n",
794 			IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
795 		return;
796 	}
797 	if (scan.chan != scan.bchan &&
798 	    ic->ic_phytype != IEEE80211_T_FH) {
799 		/*
800 		 * Frame was received on a channel different from the
801 		 * one indicated in the DS params element id;
802 		 * silently discard it.
803 		 *
804 		 * NB:	this can happen due to signal leakage.
805 		 *	But we should take it for FH phy because
806 		 *	the rssi value should be correct even for
807 		 *	different hop pattern in FH.
808 		 */
809 		ieee80211_dbg(IEEE80211_MSG_ELEMID,
810 			"ieee80211_recv_mgmt: ignore %s ,"
811 			"phytype %u channel %u marked for %u\n",
812 			IEEE80211_SUBTYPE_NAME(subtype),
813 			ic->ic_phytype, scan.bchan, scan.chan);
814 		return;
815 	}
816 	if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
817 	    scan.bintval <= IEEE80211_BINTVAL_MAX)) {
818 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
819 			"ieee80211_recv_mgmt: ignore %s ,"
820 			"bogus beacon interval %u\n",
821 			IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
822 		return;
823 	}
824 
825 	/*
826 	 * When operating in station mode, check for state updates.
827 	 * Be careful to ignore beacons received while doing a
828 	 * background scan.  We consider only 11g/WMM stuff right now.
829 	 */
830 	if (ic->ic_opmode == IEEE80211_M_STA &&
831 	    in->in_associd != 0 &&
832 	    (!(ic->ic_flags & IEEE80211_F_SCAN) ||
833 	    IEEE80211_ADDR_EQ(wh->i_addr2, in->in_bssid))) {
834 		/* record tsf of last beacon */
835 		bcopy(scan.tstamp, in->in_tstamp.data,
836 		    sizeof (in->in_tstamp));
837 		/* count beacon frame for s/w bmiss handling */
838 		im->im_swbmiss_count++;
839 		im->im_bmiss_count = 0;
840 
841 		if ((in->in_capinfo ^ scan.capinfo) &
842 		    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
843 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
844 				"ieee80211_recv_mgmt: "
845 				"[%s] cap change: before 0x%x, now 0x%x\n",
846 				ieee80211_macaddr_sprintf(wh->i_addr2),
847 				in->in_capinfo, scan.capinfo);
848 			/*
849 			 * NB:	we assume short preamble doesn't
850 			 *	change dynamically
851 			 */
852 			ieee80211_set_shortslottime(ic,
853 				ic->ic_curmode == IEEE80211_MODE_11A ||
854 					(scan.capinfo &
855 					IEEE80211_CAPINFO_SHORT_SLOTTIME));
856 			in->in_capinfo = scan.capinfo;
857 		}
858 
859 		if (scan.tim != NULL) {
860 			struct ieee80211_tim_ie *ie;
861 
862 			ie = (struct ieee80211_tim_ie *)scan.tim;
863 			in->in_dtim_count = ie->tim_count;
864 			in->in_dtim_period = ie->tim_period;
865 		}
866 		if (ic->ic_flags & IEEE80211_F_SCAN) {
867 			ieee80211_add_scan(ic, &scan, wh, subtype, rssi,
868 				rstamp);
869 		}
870 		return;
871 	}
872 	/*
873 	 * If scanning, just pass information to the scan module.
874 	 */
875 	if (ic->ic_flags & IEEE80211_F_SCAN) {
876 		ieee80211_add_scan(ic, &scan, wh, subtype, rssi, rstamp);
877 		return;
878 	}
879 
880 	if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
881 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
882 			/*
883 			 * Create a new entry in the neighbor table.
884 			 */
885 			in = ieee80211_add_neighbor(ic, wh, &scan);
886 		} else if (in->in_capinfo == 0) {
887 			/*
888 			 * Update faked node created on transmit.
889 			 * Note this also updates the tsf.
890 			 */
891 			ieee80211_init_neighbor(in, wh, &scan);
892 		} else {
893 			/*
894 			 * Record tsf for potential resync.
895 			 */
896 			bcopy(scan.tstamp, in->in_tstamp.data,
897 			    sizeof (in->in_tstamp));
898 		}
899 		if (in != NULL) {
900 			in->in_rssi = (uint8_t)rssi;
901 			in->in_rstamp = rstamp;
902 		}
903 	}
904 }
905 
906 /*
907  * Perform input processing for 802.11 management frames.
908  * It's the default ic_recv_mgmt callback function for the interface
909  * softc, ic. Tipically ic_recv_mgmt is called within ieee80211_input()
910  */
911 void
912 ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
913     int subtype, int rssi, uint32_t rstamp)
914 {
915 	struct ieee80211_frame *wh;
916 	uint8_t *frm;		/* pointer to start of the frame */
917 	uint8_t *efrm;		/* pointer to end of the frame */
918 	uint8_t *ssid;
919 	uint8_t *rates;
920 	uint8_t *xrates;	/* extended rates */
921 	boolean_t allocbs = B_FALSE;
922 	uint8_t rate;
923 	uint16_t algo;		/* authentication algorithm */
924 	uint16_t seq;		/* sequence no */
925 	uint16_t status;
926 	uint16_t capinfo;
927 	uint16_t associd;	/* association ID */
928 
929 	IEEE80211_LOCK(ic);
930 	wh = (struct ieee80211_frame *)mp->b_rptr;
931 	frm = (uint8_t *)&wh[1];
932 	efrm = (uint8_t *)mp->b_wptr;
933 	switch (subtype) {
934 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
935 	case IEEE80211_FC0_SUBTYPE_BEACON:
936 		ieee80211_recv_beacon(ic, mp, in, subtype, rssi, rstamp);
937 		break;
938 
939 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
940 		if (ic->ic_opmode == IEEE80211_M_STA ||
941 		    ic->ic_state != IEEE80211_S_RUN ||
942 		    IEEE80211_IS_MULTICAST(wh->i_addr2)) {
943 			break;
944 		}
945 
946 		/*
947 		 * prreq frame format
948 		 *	[tlv] ssid
949 		 *	[tlv] supported rates
950 		 *	[tlv] extended supported rates
951 		 */
952 		ssid = rates = xrates = NULL;
953 		while (frm < efrm) {
954 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], goto out);
955 			switch (*frm) {
956 			case IEEE80211_ELEMID_SSID:
957 				ssid = frm;
958 				break;
959 			case IEEE80211_ELEMID_RATES:
960 				rates = frm;
961 				break;
962 			case IEEE80211_ELEMID_XRATES:
963 				xrates = frm;
964 				break;
965 			}
966 			frm += frm[1] + 2;
967 		}
968 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
969 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, break);
970 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break);
971 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
972 			ieee80211_dbg(IEEE80211_MSG_INPUT,
973 				"ieee80211_recv_mgmt: ignore %s, "
974 				"no ssid with ssid suppression enabled",
975 				IEEE80211_SUBTYPE_NAME(subtype));
976 			break;
977 		}
978 
979 		if (in == ic->ic_bss) {
980 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
981 				in = ieee80211_tmp_node(ic, wh->i_addr2);
982 				allocbs = B_TRUE;
983 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2,
984 			    in->in_macaddr)) {
985 				/*
986 				 * Cannot tell if the sender is operating
987 				 * in ibss mode.  But we need a new node to
988 				 * send the response so blindly add them to the
989 				 * neighbor table.
990 				 */
991 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
992 					wh->i_addr2);
993 			}
994 			if (in == NULL)
995 				break;
996 		}
997 		ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: "
998 			"[%s] recv probe req\n",
999 			ieee80211_macaddr_sprintf(wh->i_addr2));
1000 		in->in_rssi = (uint8_t)rssi;
1001 		in->in_rstamp = rstamp;
1002 		/*
1003 		 * Adjust and check station's rate list with device's
1004 		 * supported rate.  Send back response if there is at
1005 		 * least one rate or the fixed rate(if being set) is
1006 		 * supported by both station and the device
1007 		 */
1008 		rate = ieee80211_setup_rates(in, rates, xrates,
1009 			IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1010 			IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1011 		if (rate & IEEE80211_RATE_BASIC) {
1012 			ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt"
1013 				"%s recv'd rate set invalid",
1014 				IEEE80211_SUBTYPE_NAME(subtype));
1015 		} else {
1016 			IEEE80211_UNLOCK(ic);
1017 			IEEE80211_SEND_MGMT(ic, in,
1018 				IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
1019 			IEEE80211_LOCK(ic);
1020 		}
1021 		if (allocbs) {
1022 			/*
1023 			 * Temporary node created just to send a
1024 			 * response, reclaim immediately.
1025 			 */
1026 			ieee80211_free_node(in);
1027 		}
1028 		break;
1029 
1030 	case IEEE80211_FC0_SUBTYPE_AUTH:
1031 		/*
1032 		 * auth frame format
1033 		 *	[2] algorithm
1034 		 *	[2] sequence
1035 		 *	[2] status
1036 		 *	[tlv*] challenge
1037 		 */
1038 		IEEE80211_VERIFY_LENGTH(efrm - frm, IEEE80211_AUTH_ELEM_MIN,
1039 			break);
1040 		algo   = (*(uint16_t *)frm);
1041 		seq    = (*(uint16_t *)(frm + 2));
1042 		status = (*(uint16_t *)(frm + 4));
1043 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: "
1044 			"[%s] recv auth frame with algorithm %d seq %d\n",
1045 			ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
1046 
1047 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
1048 			ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1049 				"ieee80211_recv_mgmt: ignore auth, %s\n",
1050 				"TKIP countermeasures enabled");
1051 			break;
1052 		}
1053 		switch (algo) {
1054 		case IEEE80211_AUTH_ALG_SHARED:
1055 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, in,
1056 				seq, status);
1057 			break;
1058 		case IEEE80211_AUTH_ALG_OPEN:
1059 			ieee80211_auth_open(ic, wh, in, seq, status);
1060 			break;
1061 		default:
1062 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1063 				"ignore auth, unsupported alg %d", algo);
1064 			break;
1065 		}
1066 		break;
1067 
1068 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1069 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1070 		if (ic->ic_opmode != IEEE80211_M_STA ||
1071 		    ic->ic_state != IEEE80211_S_ASSOC)
1072 			break;
1073 
1074 		/*
1075 		 * asresp frame format
1076 		 *	[2] capability information
1077 		 *	[2] status
1078 		 *	[2] association ID
1079 		 *	[tlv] supported rates
1080 		 *	[tlv] extended supported rates
1081 		 *	[tlv] WME
1082 		 */
1083 		IEEE80211_VERIFY_LENGTH(efrm - frm,
1084 			IEEE80211_ASSOC_RESP_ELEM_MIN, break);
1085 		in = ic->ic_bss;
1086 		capinfo = (*(uint16_t *)frm);
1087 		frm += 2;
1088 		status = (*(uint16_t *)frm);
1089 		frm += 2;
1090 		if (status != 0) {
1091 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1092 				"assoc failed (reason %d)\n", status);
1093 			in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2);
1094 			if (in != NULL) {
1095 				in->in_fails++;
1096 				ieee80211_free_node(in);
1097 			}
1098 			break;
1099 		}
1100 		associd = (*(uint16_t *)frm);
1101 		frm += 2;
1102 
1103 		rates = xrates = NULL;
1104 		while (frm < efrm) {
1105 			/*
1106 			 * Do not discard frames containing proprietary Agere
1107 			 * elements 128 and 129, as the reported element length
1108 			 * is often wrong. Skip rest of the frame, since we can
1109 			 * not rely on the given element length making it
1110 			 * impossible to know where the next element starts
1111 			 */
1112 			if ((*frm == IEEE80211_ELEMID_AGERE1) ||
1113 			    (*frm == IEEE80211_ELEMID_AGERE2)) {
1114 				frm = efrm;
1115 				break;
1116 			}
1117 
1118 			IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], goto out);
1119 			switch (*frm) {
1120 			case IEEE80211_ELEMID_RATES:
1121 				rates = frm;
1122 				break;
1123 			case IEEE80211_ELEMID_XRATES:
1124 				xrates = frm;
1125 				break;
1126 			}
1127 			frm += frm[1] + 2;
1128 		}
1129 
1130 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
1131 		/*
1132 		 * Adjust and check AP's rate list with device's
1133 		 * supported rate. Re-start scan if no rate is or the
1134 		 * fixed rate(if being set) cannot be supported by
1135 		 * either AP or the device.
1136 		 */
1137 		rate = ieee80211_setup_rates(in, rates, xrates,
1138 			IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1139 			IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1140 		if (rate & IEEE80211_RATE_BASIC) {
1141 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1142 				"assoc failed (rate set mismatch)\n");
1143 			if (in != ic->ic_bss)
1144 				in->in_fails++;
1145 			IEEE80211_UNLOCK(ic);
1146 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1147 			return;
1148 		}
1149 
1150 		in->in_capinfo = capinfo;
1151 		in->in_associd = associd;
1152 		in->in_flags &= ~IEEE80211_NODE_QOS;
1153 		/*
1154 		 * Configure state now that we are associated.
1155 		 */
1156 		if (ic->ic_curmode == IEEE80211_MODE_11A ||
1157 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1158 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1159 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1160 		} else {
1161 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1162 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1163 		}
1164 		ieee80211_set_shortslottime(ic,
1165 			ic->ic_curmode == IEEE80211_MODE_11A ||
1166 			(in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1167 		/*
1168 		 * Honor ERP protection.
1169 		 *
1170 		 * NB:	in_erp should zero for non-11g operation.
1171 		 *	check ic_curmode anyway
1172 		 */
1173 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
1174 		    (in->in_erp & IEEE80211_ERP_USE_PROTECTION))
1175 			ic->ic_flags |= IEEE80211_F_USEPROT;
1176 		else
1177 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1178 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1179 			"assoc success: %s preamble, %s slot time%s%s\n",
1180 			ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1181 			ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1182 			ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1183 			in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
1184 		IEEE80211_UNLOCK(ic);
1185 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
1186 		return;
1187 
1188 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1189 		if (ic->ic_state == IEEE80211_S_SCAN)
1190 			break;
1191 
1192 		/*
1193 		 * deauth frame format
1194 		 *	[2] reason
1195 		 */
1196 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, break);
1197 		status = (*(uint16_t *)frm);
1198 
1199 		ieee80211_dbg(IEEE80211_MSG_AUTH,
1200 			"recv deauthenticate (reason %d)\n", status);
1201 		switch (ic->ic_opmode) {
1202 		case IEEE80211_M_STA:
1203 			IEEE80211_UNLOCK(ic);
1204 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
1205 				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1206 			return;
1207 		default:
1208 			break;
1209 		}
1210 		break;
1211 
1212 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1213 		if (ic->ic_state != IEEE80211_S_RUN &&
1214 		    ic->ic_state != IEEE80211_S_ASSOC &&
1215 		    ic->ic_state != IEEE80211_S_AUTH)
1216 			break;
1217 		/*
1218 		 * disassoc frame format
1219 		 *	[2] reason
1220 		 */
1221 		IEEE80211_VERIFY_LENGTH(efrm - frm, 2, break);
1222 		status = (*(uint16_t *)frm);
1223 
1224 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1225 			"recv disassociate (reason %d)\n", status);
1226 		switch (ic->ic_opmode) {
1227 		case IEEE80211_M_STA:
1228 			IEEE80211_UNLOCK(ic);
1229 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1230 				wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1231 			return;
1232 		default:
1233 			break;
1234 		}
1235 		break;
1236 
1237 	default:
1238 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1239 			"subtype 0x%x not handled\n", subtype);
1240 		break;
1241 	} /* switch subtype */
1242 out:
1243 	IEEE80211_UNLOCK(ic);
1244 }
1245