xref: /titanic_50/usr/src/uts/common/io/net80211/net80211_input.c (revision 3e5bc1d795e8c41f3680a71e3954e72d079ee46d)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2001 Atsushi Onoe
8  * Copyright (c) 2002-2005 Sam Leffler, Errno Consulting
9  * All rights reserved.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. The name of the author may not be used to endorse or promote products
20  *    derived from this software without specific prior written permission.
21  *
22  * Alternatively, this software may be distributed under the terms of the
23  * GNU General Public License ("GPL") version 2 as published by the Free
24  * Software Foundation.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
27  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
28  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
29  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
30  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
31  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
32  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
33  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
34  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
35  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36  */
37 
38 /*
39  * Process received frame
40  */
41 
42 #include <sys/mac_provider.h>
43 #include <sys/byteorder.h>
44 #include <sys/strsun.h>
45 #include "net80211_impl.h"
46 
47 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *,
48     mblk_t *, int);
49 
50 /*
51  * Process a received frame.  The node associated with the sender
52  * should be supplied.  If nothing was found in the node table then
53  * the caller is assumed to supply a reference to ic_bss instead.
54  * The RSSI and a timestamp are also supplied.  The RSSI data is used
55  * during AP scanning to select a AP to associate with; it can have
56  * any units so long as values have consistent units and higher values
57  * mean ``better signal''.  The receive timestamp is currently not used
58  * by the 802.11 layer.
59  */
60 int
61 ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
62     int32_t rssi, uint32_t rstamp)
63 {
64 	struct ieee80211_frame *wh;
65 	struct ieee80211_key *key;
66 	uint8_t *bssid;
67 	int hdrspace;
68 	int len;
69 	uint16_t rxseq;
70 	uint8_t dir;
71 	uint8_t type;
72 	uint8_t subtype;
73 	uint8_t tid;
74 
75 	ASSERT(in != NULL);
76 	type = (uint8_t)-1;		/* undefined */
77 	len = MBLKL(mp);
78 	if (len < sizeof (struct ieee80211_frame_min)) {
79 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
80 		    "too short (1): len %u", len);
81 		goto out;
82 	}
83 	/*
84 	 * Bit of a cheat here, we use a pointer for a 3-address
85 	 * frame format but don't reference fields past outside
86 	 * ieee80211_frame_min w/o first validating the data is
87 	 * present.
88 	 */
89 	wh = (struct ieee80211_frame *)mp->b_rptr;
90 	if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
91 	    IEEE80211_FC0_VERSION_0) {
92 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
93 		    "discard pkt with wrong version %x", wh->i_fc[0]);
94 		goto out;
95 	}
96 
97 	dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
98 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
99 	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
100 
101 	IEEE80211_LOCK(ic);
102 	if (!(ic->ic_flags & IEEE80211_F_SCAN)) {
103 		switch (ic->ic_opmode) {
104 		case IEEE80211_M_STA:
105 			bssid = wh->i_addr2;
106 			if (!IEEE80211_ADDR_EQ(bssid, in->in_bssid))
107 				goto out_exit_mutex;
108 			break;
109 		case IEEE80211_M_IBSS:
110 		case IEEE80211_M_AHDEMO:
111 			if (dir != IEEE80211_FC1_DIR_NODS) {
112 				bssid = wh->i_addr1;
113 			} else if (type == IEEE80211_FC0_TYPE_CTL) {
114 				bssid = wh->i_addr1;
115 			} else {
116 				if (len < sizeof (struct ieee80211_frame)) {
117 					ieee80211_dbg(IEEE80211_MSG_ANY,
118 					    "ieee80211_input: too short(2):"
119 					    "len %u\n", len);
120 					goto out_exit_mutex;
121 				}
122 				bssid = wh->i_addr3;
123 			}
124 			if (type != IEEE80211_FC0_TYPE_DATA)
125 				break;
126 			/*
127 			 * Data frame, validate the bssid.
128 			 */
129 			if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->in_bssid) &&
130 			    !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) {
131 				/* not interested in */
132 				ieee80211_dbg(IEEE80211_MSG_INPUT,
133 				    "ieee80211_input: not to bss %s\n",
134 				    ieee80211_macaddr_sprintf(bssid));
135 				goto out_exit_mutex;
136 			}
137 			/*
138 			 * For adhoc mode we cons up a node when it doesn't
139 			 * exist. This should probably done after an ACL check.
140 			 */
141 			if (in == ic->ic_bss &&
142 			    ic->ic_opmode != IEEE80211_M_HOSTAP &&
143 			    !IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
144 				/*
145 				 * Fake up a node for this newly
146 				 * discovered member of the IBSS.
147 				 */
148 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
149 				    wh->i_addr2);
150 				if (in == NULL) {
151 					/* NB: stat kept for alloc failure */
152 					goto out_exit_mutex;
153 				}
154 			}
155 			break;
156 		default:
157 			goto out_exit_mutex;
158 		}
159 		in->in_rssi = (uint8_t)rssi;
160 		in->in_rstamp = rstamp;
161 		if (!(type & IEEE80211_FC0_TYPE_CTL)) {
162 			tid = 0;
163 			rxseq = (*(uint16_t *)wh->i_seq);
164 			if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
165 			    (rxseq - in->in_rxseqs[tid]) <= 0) {
166 				/* duplicate, discard */
167 				ieee80211_dbg(IEEE80211_MSG_INPUT,
168 				    "ieee80211_input: duplicate",
169 				    "seqno <%u,%u> fragno <%u,%u> tid %u",
170 				    rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
171 				    in->in_rxseqs[tid] >>
172 				    IEEE80211_SEQ_SEQ_SHIFT,
173 				    rxseq & IEEE80211_SEQ_FRAG_MASK,
174 				    in->in_rxseqs[tid] &
175 				    IEEE80211_SEQ_FRAG_MASK,
176 				    tid);
177 				ic->ic_stats.is_rx_dups++;
178 				goto out_exit_mutex;
179 			}
180 			in->in_rxseqs[tid] = rxseq;
181 		}
182 		in->in_inact = 0;
183 	}
184 
185 	switch (type) {
186 	case IEEE80211_FC0_TYPE_DATA:
187 		hdrspace = ieee80211_hdrspace(wh);
188 		if (len < hdrspace) {
189 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
190 			    "data too short: expecting %u", hdrspace);
191 			goto out_exit_mutex;
192 		}
193 		switch (ic->ic_opmode) {
194 		case IEEE80211_M_STA:
195 			if (dir != IEEE80211_FC1_DIR_FROMDS) {
196 				ieee80211_dbg(IEEE80211_MSG_INPUT,
197 				    "ieee80211_input: data ",
198 				    "unknown dir 0x%x", dir);
199 				goto out_exit_mutex;
200 			}
201 			if (IEEE80211_IS_MULTICAST(wh->i_addr1) &&
202 			    IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_macaddr)) {
203 				/*
204 				 * In IEEE802.11 network, multicast packet
205 				 * sent from me is broadcasted from AP.
206 				 * It should be silently discarded for
207 				 * SIMPLEX interface.
208 				 */
209 				ieee80211_dbg(IEEE80211_MSG_INPUT,
210 				    "ieee80211_input: multicast echo\n");
211 				goto out_exit_mutex;
212 			}
213 			break;
214 		case IEEE80211_M_IBSS:
215 		case IEEE80211_M_AHDEMO:
216 			if (dir != IEEE80211_FC1_DIR_NODS) {
217 				ieee80211_dbg(IEEE80211_MSG_INPUT,
218 				    "ieee80211_input: unknown dir 0x%x",
219 				    dir);
220 				goto out_exit_mutex;
221 			}
222 			break;
223 		default:
224 			ieee80211_err("ieee80211_input: "
225 			    "receive data, unknown opmode %u, skip\n",
226 			    ic->ic_opmode);
227 			goto out_exit_mutex;
228 		}
229 
230 		/*
231 		 * Handle privacy requirements.
232 		 */
233 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
234 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
235 				/*
236 				 * Discard encrypted frames when privacy off.
237 				 */
238 				ieee80211_dbg(IEEE80211_MSG_INPUT,
239 				    "ieee80211_input: ""WEP PRIVACY off");
240 				ic->ic_stats.is_wep_errors++;
241 				goto out_exit_mutex;
242 			}
243 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
244 			if (key == NULL) {
245 				/* NB: stats+msgs handled in crypto_decap */
246 				ic->ic_stats.is_wep_errors++;
247 				goto out_exit_mutex;
248 			}
249 			wh = (struct ieee80211_frame *)mp->b_rptr;
250 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
251 		} else {
252 			key = NULL;
253 		}
254 
255 		/*
256 		 * Next up, any fragmentation
257 		 */
258 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
259 			mp = ieee80211_defrag(ic, in, mp, hdrspace);
260 			if (mp == NULL) {
261 				/* Fragment dropped or frame not complete yet */
262 				goto out_exit_mutex;
263 			}
264 		}
265 		wh = NULL;	/* no longer valid, catch any uses */
266 
267 		/*
268 		 * Next strip any MSDU crypto bits.
269 		 */
270 		if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) {
271 			ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: "
272 			    "data demic error\n");
273 			goto out_exit_mutex;
274 		}
275 
276 		ic->ic_stats.is_rx_frags++;
277 		ic->ic_stats.is_rx_bytes += len;
278 		IEEE80211_UNLOCK(ic);
279 		mac_rx(ic->ic_mach, NULL, mp);
280 		return (IEEE80211_FC0_TYPE_DATA);
281 
282 	case IEEE80211_FC0_TYPE_MGT:
283 		if (dir != IEEE80211_FC1_DIR_NODS)
284 			goto out_exit_mutex;
285 		if (len < sizeof (struct ieee80211_frame))
286 			goto out_exit_mutex;
287 		if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
288 			if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
289 				/*
290 				 * Only shared key auth frames with a challenge
291 				 * should be encrypted, discard all others.
292 				 */
293 				ieee80211_dbg(IEEE80211_MSG_INPUT,
294 				    "ieee80211_input: "
295 				    "%s WEP set but not permitted",
296 				    IEEE80211_SUBTYPE_NAME(subtype));
297 				ic->ic_stats.is_wep_errors++;
298 				goto out_exit_mutex;
299 			}
300 			if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
301 				/*
302 				 * Discard encrypted frames when privacy off.
303 				 */
304 				ieee80211_dbg(IEEE80211_MSG_INPUT,
305 				    "ieee80211_input: "
306 				    "mgt WEP set but PRIVACY off");
307 				ic->ic_stats.is_wep_errors++;
308 				goto out_exit_mutex;
309 			}
310 			hdrspace = ieee80211_hdrspace(wh);
311 			key = ieee80211_crypto_decap(ic, mp, hdrspace);
312 			if (key == NULL) {
313 				/* NB: stats+msgs handled in crypto_decap */
314 				goto out_exit_mutex;
315 			}
316 			wh = (struct ieee80211_frame *)mp->b_rptr;
317 			wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
318 		}
319 		IEEE80211_UNLOCK(ic);
320 		ic->ic_recv_mgmt(ic, mp, in, subtype, rssi, rstamp);
321 		goto out;
322 
323 	case IEEE80211_FC0_TYPE_CTL:
324 	default:
325 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: "
326 		    "bad frame type 0x%x", type);
327 		/* should not come here */
328 		break;
329 	}
330 out_exit_mutex:
331 	IEEE80211_UNLOCK(ic);
332 out:
333 	if (mp != NULL)
334 		freemsg(mp);
335 
336 	return (type);
337 }
338 
339 /*
340  * This function reassemble fragments.
341  * More fragments bit in the frame control means the packet is fragmented.
342  * While the sequence control field consists of 4-bit fragment number
343  * field and a 12-bit sequence number field.
344  */
345 /* ARGSUSED */
346 static mblk_t *
347 ieee80211_defrag(ieee80211com_t *ic, struct ieee80211_node *in, mblk_t *mp,
348     int hdrspace)
349 {
350 	struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr;
351 	struct ieee80211_frame *lwh;
352 	mblk_t *mfrag;
353 	uint16_t rxseq;
354 	uint8_t fragno;
355 	uint8_t more_frag;
356 
357 	ASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1));
358 	more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
359 	rxseq = LE_16(*(uint16_t *)wh->i_seq);
360 	fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
361 
362 	/* Quick way out, if there's nothing to defragment */
363 	if (!more_frag && fragno == 0 && in->in_rxfrag == NULL)
364 		return (mp);
365 
366 	/*
367 	 * Remove frag to insure it doesn't get reaped by timer.
368 	 */
369 	if (in->in_table == NULL) {
370 		/*
371 		 * Should never happen.  If the node is orphaned (not in
372 		 * the table) then input packets should not reach here.
373 		 * Otherwise, a concurrent request that yanks the table
374 		 * should be blocked by other interlocking and/or by first
375 		 * shutting the driver down.  Regardless, be defensive
376 		 * here and just bail
377 		 */
378 		freemsg(mp);
379 		return (NULL);
380 	}
381 	IEEE80211_NODE_LOCK(in->in_table);
382 	mfrag = in->in_rxfrag;
383 	in->in_rxfrag = NULL;
384 	IEEE80211_NODE_UNLOCK(in->in_table);
385 
386 	/*
387 	 * Validate new fragment is in order and
388 	 * related to the previous ones.
389 	 */
390 	if (mfrag != NULL) {
391 		uint16_t last_rxseq;
392 
393 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
394 		last_rxseq = LE_16(*(uint16_t *)lwh->i_seq);
395 		/*
396 		 * Sequence control field contains 12-bit sequence no
397 		 * and 4-bit fragment number. For fragemnts, the
398 		 * sequence no is not changed.
399 		 * NB: check seq # and frag together
400 		 */
401 		if (rxseq != last_rxseq + 1 ||
402 		    !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
403 		    !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
404 			/*
405 			 * Unrelated fragment or no space for it,
406 			 * clear current fragments.
407 			 */
408 			freemsg(mfrag);
409 			mfrag = NULL;
410 		}
411 	}
412 
413 	if (mfrag == NULL) {
414 		if (fragno != 0) {	/* !first fragment, discard */
415 			freemsg(mp);
416 			return (NULL);
417 		}
418 		mfrag = mp;
419 	} else {			/* concatenate */
420 		(void) adjmsg(mp, hdrspace);
421 		linkb(mfrag, mp);
422 		/* track last seqnum and fragno */
423 		lwh = (struct ieee80211_frame *)mfrag->b_rptr;
424 		*(uint16_t *)lwh->i_seq = *(uint16_t *)wh->i_seq;
425 	}
426 	if (more_frag != 0) {		/* more to come, save */
427 		in->in_rxfragstamp = ddi_get_lbolt();
428 		in->in_rxfrag = mfrag;
429 		mfrag = NULL;
430 	}
431 
432 	return (mfrag);
433 }
434 
435 /*
436  * Install received rate set information in the node's state block.
437  */
438 int
439 ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates,
440     const uint8_t *xrates, int flags)
441 {
442 	struct ieee80211_rateset *rs = &in->in_rates;
443 
444 	bzero(rs, sizeof (*rs));
445 	rs->ir_nrates = rates[1];
446 	/* skip 1 byte element ID and 1 byte length */
447 	bcopy(rates + 2, rs->ir_rates, rs->ir_nrates);
448 	if (xrates != NULL) {
449 		uint8_t nxrates;
450 
451 		/*
452 		 * Tack on 11g extended supported rate element.
453 		 */
454 		nxrates = xrates[1];
455 		if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
456 			nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates;
457 			ieee80211_dbg(IEEE80211_MSG_XRATE,
458 			    "ieee80211_setup_rates: %s",
459 			    "[%s] extended rate set too large;"
460 			    " only using %u of %u rates\n",
461 			    ieee80211_macaddr_sprintf(in->in_macaddr),
462 			    nxrates, xrates[1]);
463 		}
464 		bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates);
465 		rs->ir_nrates += nxrates;
466 	}
467 	return (ieee80211_fix_rate(in, flags));
468 }
469 
470 /*
471  * Process open-system authentication response frame and start
472  * association if the authentication request is accepted.
473  */
474 static void
475 ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh,
476     struct ieee80211_node *in, uint16_t seq, uint16_t status)
477 {
478 	IEEE80211_LOCK_ASSERT(ic);
479 	if (in->in_authmode == IEEE80211_AUTH_SHARED) {
480 		ieee80211_dbg(IEEE80211_MSG_AUTH,
481 		    "open auth: bad sta auth mode %u", in->in_authmode);
482 		return;
483 	}
484 	if (ic->ic_opmode == IEEE80211_M_STA) {
485 		if (ic->ic_state != IEEE80211_S_AUTH ||
486 		    seq != IEEE80211_AUTH_OPEN_RESPONSE) {
487 			return;
488 		}
489 		IEEE80211_UNLOCK(ic);
490 		if (status != 0) {
491 			ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
492 			    "open auth failed (reason %d)\n", status);
493 			if (in != ic->ic_bss)
494 				in->in_fails++;
495 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
496 		} else {
497 			/* i_fc[0] - frame control's type & subtype field */
498 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
499 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
500 		}
501 		IEEE80211_LOCK(ic);
502 	} else {
503 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: "
504 		    "bad operating mode %u", ic->ic_opmode);
505 	}
506 }
507 
508 /*
509  * Allocate challenge text for use by shared-key authentication
510  * Return B_TRUE on success, B_FALST otherwise.
511  */
512 static boolean_t
513 ieee80211_alloc_challenge(struct ieee80211_node *in)
514 {
515 	if (in->in_challenge == NULL) {
516 		in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN,
517 		    KM_NOSLEEP);
518 	}
519 	if (in->in_challenge == NULL) {
520 		ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
521 		    "[%s] shared key challenge alloc failed\n",
522 		    ieee80211_macaddr_sprintf(in->in_macaddr));
523 	}
524 	return (in->in_challenge != NULL);
525 }
526 
527 /*
528  * Process shared-key authentication response frames. If authentication
529  * succeeds, start association; otherwise, restart scan.
530  */
531 static void
532 ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh,
533     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *in, uint16_t seq,
534     uint16_t status)
535 {
536 	uint8_t *challenge;
537 
538 	/*
539 	 * Pre-shared key authentication is evil; accept
540 	 * it only if explicitly configured (it is supported
541 	 * mainly for compatibility with clients like OS X).
542 	 */
543 	IEEE80211_LOCK_ASSERT(ic);
544 	if (in->in_authmode != IEEE80211_AUTH_AUTO &&
545 	    in->in_authmode != IEEE80211_AUTH_SHARED) {
546 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: "
547 		    "bad sta auth mode %u", in->in_authmode);
548 		goto bad;
549 	}
550 
551 	challenge = NULL;
552 	if (frm + 1 < efrm) {
553 		/*
554 		 * Challenge text information element
555 		 * frm[0] - element ID
556 		 * frm[1] - length
557 		 * frm[2]... - challenge text
558 		 */
559 		if ((frm[1] + 2) > (_PTRDIFF(efrm, frm))) {
560 			ieee80211_dbg(IEEE80211_MSG_AUTH,
561 			    "ieee80211_auth_shared: ie %d%d too long\n",
562 			    frm[0], (frm[1] + 2) - (_PTRDIFF(efrm, frm)));
563 			goto bad;
564 		}
565 		if (*frm == IEEE80211_ELEMID_CHALLENGE)
566 			challenge = frm;
567 		frm += frm[1] + 2;
568 	}
569 	switch (seq) {
570 	case IEEE80211_AUTH_SHARED_CHALLENGE:
571 	case IEEE80211_AUTH_SHARED_RESPONSE:
572 		if (challenge == NULL) {
573 			ieee80211_dbg(IEEE80211_MSG_AUTH,
574 			    "ieee80211_auth_shared: no challenge\n");
575 			goto bad;
576 		}
577 		if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
578 			ieee80211_dbg(IEEE80211_MSG_AUTH,
579 			    "ieee80211_auth_shared: bad challenge len %d\n",
580 			    challenge[1]);
581 			goto bad;
582 		}
583 	default:
584 		break;
585 	}
586 	switch (ic->ic_opmode) {
587 	case IEEE80211_M_STA:
588 		if (ic->ic_state != IEEE80211_S_AUTH)
589 			return;
590 		switch (seq) {
591 		case IEEE80211_AUTH_SHARED_PASS:
592 			if (in->in_challenge != NULL) {
593 				kmem_free(in->in_challenge,
594 				    IEEE80211_CHALLENGE_LEN);
595 				in->in_challenge = NULL;
596 			}
597 			if (status != 0) {
598 				ieee80211_dbg(IEEE80211_MSG_DEBUG |
599 				    IEEE80211_MSG_AUTH,
600 				    "shared key auth failed (reason %d)\n",
601 				    status);
602 				if (in != ic->ic_bss)
603 					in->in_fails++;
604 				return;
605 			}
606 			IEEE80211_UNLOCK(ic);
607 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
608 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
609 			IEEE80211_LOCK(ic);
610 			break;
611 		case IEEE80211_AUTH_SHARED_CHALLENGE:
612 			if (!ieee80211_alloc_challenge(in))
613 				return;
614 			bcopy(&challenge[2], in->in_challenge, challenge[1]);
615 			IEEE80211_UNLOCK(ic);
616 			IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH,
617 			    seq + 1);
618 			IEEE80211_LOCK(ic);
619 			break;
620 		default:
621 			ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: "
622 			    "shared key auth: bad seq %d", seq);
623 			return;
624 		}
625 		break;
626 
627 	default:
628 		ieee80211_dbg(IEEE80211_MSG_AUTH,
629 		    "ieee80211_auth_shared: bad opmode %u\n",
630 		    ic->ic_opmode);
631 		break;
632 	}
633 	return;
634 bad:
635 	if (ic->ic_opmode == IEEE80211_M_STA) {
636 		/*
637 		 * Kick the state machine.  This short-circuits
638 		 * using the mgt frame timeout to trigger the
639 		 * state transition.
640 		 */
641 		if (ic->ic_state == IEEE80211_S_AUTH) {
642 			IEEE80211_UNLOCK(ic);
643 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
644 			IEEE80211_LOCK(ic);
645 		}
646 	}
647 }
648 
649 static int
650 iswpaoui(const uint8_t *frm)
651 {
652 	uint32_t c = *(uint32_t *)(frm + 2);
653 	return (frm[1] > 3 && c == ((WPA_OUI_TYPE << 24) | WPA_OUI));
654 }
655 
656 /*
657  * Process a beacon/probe response frame.
658  * When the device is in station mode, create a node and add it
659  * to the node database for a new ESS or update node info if it's
660  * already there.
661  */
662 static void
663 ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
664     int subtype, int rssi, uint32_t rstamp)
665 {
666 	ieee80211_impl_t *im = ic->ic_private;
667 	struct ieee80211_frame *wh;
668 	uint8_t *frm;
669 	uint8_t *efrm;	/* end of frame body */
670 	struct ieee80211_scanparams scan;
671 
672 	wh = (struct ieee80211_frame *)mp->b_rptr;
673 	frm = (uint8_t *)&wh[1];
674 	efrm = (uint8_t *)mp->b_wptr;
675 
676 	/*
677 	 * We process beacon/probe response frames:
678 	 *    o when scanning, or
679 	 *    o station mode when associated (to collect state
680 	 *	updates such as 802.11g slot time), or
681 	 *    o adhoc mode (to discover neighbors)
682 	 * Frames otherwise received are discarded.
683 	 */
684 	if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
685 	    (ic->ic_opmode == IEEE80211_M_STA && in->in_associd != 0) ||
686 	    ic->ic_opmode == IEEE80211_M_IBSS)) {
687 		return;
688 	}
689 
690 	/*
691 	 * beacon/probe response frame format
692 	 *	[8] time stamp
693 	 *	[2] beacon interval
694 	 *	[2] capability information
695 	 *	[tlv] ssid
696 	 *	[tlv] supported rates
697 	 *	[tlv] country information
698 	 *	[tlv] parameter set (FH/DS)
699 	 *	[tlv] erp information
700 	 *	[tlv] extended supported rates
701 	 *	[tlv] WME
702 	 *	[tlv] WPA or RSN
703 	 */
704 	IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
705 	    IEEE80211_BEACON_ELEM_MIN, return);
706 	bzero(&scan, sizeof (scan));
707 	scan.tstamp  = frm;
708 	frm += 8;
709 	scan.bintval = (*(uint16_t *)frm);
710 	frm += 2;
711 	scan.capinfo = (*(uint16_t *)frm);
712 	frm += 2;
713 	scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
714 	scan.chan = scan.bchan;
715 
716 	while (frm < efrm) {
717 		/* Agere element in beacon */
718 		if ((*frm == IEEE80211_ELEMID_AGERE1) ||
719 		    (*frm == IEEE80211_ELEMID_AGERE2)) {
720 			frm = efrm;
721 			break;
722 		}
723 
724 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), frm[1], return);
725 		switch (*frm) {
726 		case IEEE80211_ELEMID_SSID:
727 			scan.ssid = frm;
728 			break;
729 		case IEEE80211_ELEMID_RATES:
730 			scan.rates = frm;
731 			break;
732 		case IEEE80211_ELEMID_COUNTRY:
733 			scan.country = frm;
734 			break;
735 		case IEEE80211_ELEMID_FHPARMS:
736 			if (ic->ic_phytype == IEEE80211_T_FH) {
737 				scan.fhdwell = LE_16(*(uint16_t *)(frm + 2));
738 				scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
739 				scan.fhindex = frm[6];
740 				scan.phytype = IEEE80211_T_FH;
741 			}
742 			break;
743 		case IEEE80211_ELEMID_DSPARMS:
744 			if (ic->ic_phytype != IEEE80211_T_FH) {
745 				scan.chan = frm[2];
746 				scan.phytype = IEEE80211_T_DS;
747 			}
748 			break;
749 		case IEEE80211_ELEMID_TIM:
750 			scan.tim = frm;
751 			scan.timoff = _PTRDIFF(frm, mp->b_rptr);
752 			break;
753 		case IEEE80211_ELEMID_IBSSPARMS:
754 			break;
755 		case IEEE80211_ELEMID_XRATES:
756 			scan.xrates = frm;
757 			break;
758 		case IEEE80211_ELEMID_ERP:
759 			if (frm[1] != 1) {
760 				ieee80211_dbg(IEEE80211_MSG_ELEMID,
761 				    "ieee80211_recv_mgmt: ignore %s, "
762 				    "invalid ERP element; "
763 				    "length %u, expecting 1\n",
764 				    IEEE80211_SUBTYPE_NAME(subtype),
765 				    frm[1]);
766 				break;
767 			}
768 			scan.erp = frm[2];
769 			scan.phytype = IEEE80211_T_OFDM;
770 			break;
771 		case IEEE80211_ELEMID_RSN:
772 			scan.wpa = frm;
773 			break;
774 		case IEEE80211_ELEMID_VENDOR:
775 			if (iswpaoui(frm))
776 				scan.wpa = frm;		/* IEEE802.11i D3.0 */
777 			break;
778 		default:
779 			ieee80211_dbg(IEEE80211_MSG_ELEMID,
780 			    "ieee80211_recv_mgmt: ignore %s,"
781 			    "unhandled id %u, len %u, totallen %u",
782 			    IEEE80211_SUBTYPE_NAME(subtype),
783 			    *frm, frm[1],
784 			    MBLKL(mp));
785 			break;
786 		}
787 		/* frm[1] - component length */
788 		frm += IEEE80211_ELEM_LEN(frm[1]);
789 	}
790 	IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE, return);
791 	IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return);
792 	if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) {
793 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
794 		    "ieee80211_recv_mgmt: ignore %s ,"
795 		    "invalid channel %u\n",
796 		    IEEE80211_SUBTYPE_NAME(subtype), scan.chan);
797 		return;
798 	}
799 	if (scan.chan != scan.bchan &&
800 	    ic->ic_phytype != IEEE80211_T_FH) {
801 		/*
802 		 * Frame was received on a channel different from the
803 		 * one indicated in the DS params element id;
804 		 * silently discard it.
805 		 *
806 		 * NB:	this can happen due to signal leakage.
807 		 *	But we should take it for FH phy because
808 		 *	the rssi value should be correct even for
809 		 *	different hop pattern in FH.
810 		 */
811 		ieee80211_dbg(IEEE80211_MSG_ELEMID,
812 		    "ieee80211_recv_mgmt: ignore %s ,"
813 		    "phytype %u channel %u marked for %u\n",
814 		    IEEE80211_SUBTYPE_NAME(subtype),
815 		    ic->ic_phytype, scan.bchan, scan.chan);
816 		return;
817 	}
818 	if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
819 	    scan.bintval <= IEEE80211_BINTVAL_MAX)) {
820 		ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
821 		    "ieee80211_recv_mgmt: ignore %s ,"
822 		    "bogus beacon interval %u\n",
823 		    IEEE80211_SUBTYPE_NAME(subtype), scan.bintval);
824 		return;
825 	}
826 
827 	/*
828 	 * When operating in station mode, check for state updates.
829 	 * Be careful to ignore beacons received while doing a
830 	 * background scan.  We consider only 11g/WMM stuff right now.
831 	 */
832 	if (ic->ic_opmode == IEEE80211_M_STA &&
833 	    in->in_associd != 0 &&
834 	    (!(ic->ic_flags & IEEE80211_F_SCAN) ||
835 	    IEEE80211_ADDR_EQ(wh->i_addr2, in->in_bssid))) {
836 		/* record tsf of last beacon */
837 		bcopy(scan.tstamp, in->in_tstamp.data,
838 		    sizeof (in->in_tstamp));
839 		/* count beacon frame for s/w bmiss handling */
840 		im->im_swbmiss_count++;
841 		im->im_bmiss_count = 0;
842 
843 		if ((in->in_capinfo ^ scan.capinfo) &
844 		    IEEE80211_CAPINFO_SHORT_SLOTTIME) {
845 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
846 			    "ieee80211_recv_mgmt: "
847 			    "[%s] cap change: before 0x%x, now 0x%x\n",
848 			    ieee80211_macaddr_sprintf(wh->i_addr2),
849 			    in->in_capinfo, scan.capinfo);
850 			/*
851 			 * NB:	we assume short preamble doesn't
852 			 *	change dynamically
853 			 */
854 			ieee80211_set_shortslottime(ic,
855 			    ic->ic_curmode == IEEE80211_MODE_11A ||
856 			    (scan.capinfo &
857 			    IEEE80211_CAPINFO_SHORT_SLOTTIME));
858 			in->in_capinfo = scan.capinfo;
859 		}
860 
861 		if (scan.tim != NULL) {
862 			struct ieee80211_tim_ie *ie;
863 
864 			ie = (struct ieee80211_tim_ie *)scan.tim;
865 			in->in_dtim_count = ie->tim_count;
866 			in->in_dtim_period = ie->tim_period;
867 		}
868 		if (ic->ic_flags & IEEE80211_F_SCAN) {
869 			ieee80211_add_scan(ic, &scan, wh, subtype, rssi,
870 			    rstamp);
871 		}
872 		return;
873 	}
874 	/*
875 	 * If scanning, just pass information to the scan module.
876 	 */
877 	if (ic->ic_flags & IEEE80211_F_SCAN) {
878 		ieee80211_add_scan(ic, &scan, wh, subtype, rssi, rstamp);
879 		return;
880 	}
881 
882 	if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
883 		if (!IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) {
884 			/*
885 			 * Create a new entry in the neighbor table.
886 			 */
887 			in = ieee80211_add_neighbor(ic, wh, &scan);
888 		} else if (in->in_capinfo == 0) {
889 			/*
890 			 * Update faked node created on transmit.
891 			 * Note this also updates the tsf.
892 			 */
893 			ieee80211_init_neighbor(in, wh, &scan);
894 		} else {
895 			/*
896 			 * Record tsf for potential resync.
897 			 */
898 			bcopy(scan.tstamp, in->in_tstamp.data,
899 			    sizeof (in->in_tstamp));
900 		}
901 		if (in != NULL) {
902 			in->in_rssi = (uint8_t)rssi;
903 			in->in_rstamp = rstamp;
904 		}
905 	}
906 }
907 
908 /*
909  * Perform input processing for 802.11 management frames.
910  * It's the default ic_recv_mgmt callback function for the interface
911  * softc, ic. Tipically ic_recv_mgmt is called within ieee80211_input()
912  */
913 void
914 ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in,
915     int subtype, int rssi, uint32_t rstamp)
916 {
917 	struct ieee80211_frame *wh;
918 	uint8_t *frm;		/* pointer to start of the frame */
919 	uint8_t *efrm;		/* pointer to end of the frame */
920 	uint8_t *ssid;
921 	uint8_t *rates;
922 	uint8_t *xrates;	/* extended rates */
923 	boolean_t allocbs = B_FALSE;
924 	uint8_t rate;
925 	uint16_t algo;		/* authentication algorithm */
926 	uint16_t seq;		/* sequence no */
927 	uint16_t status;
928 	uint16_t capinfo;
929 	uint16_t associd;	/* association ID */
930 
931 	IEEE80211_LOCK(ic);
932 	wh = (struct ieee80211_frame *)mp->b_rptr;
933 	frm = (uint8_t *)&wh[1];
934 	efrm = (uint8_t *)mp->b_wptr;
935 	switch (subtype) {
936 	case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
937 	case IEEE80211_FC0_SUBTYPE_BEACON:
938 		ieee80211_recv_beacon(ic, mp, in, subtype, rssi, rstamp);
939 		break;
940 
941 	case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
942 		if (ic->ic_opmode == IEEE80211_M_STA ||
943 		    ic->ic_state != IEEE80211_S_RUN ||
944 		    IEEE80211_IS_MULTICAST(wh->i_addr2)) {
945 			break;
946 		}
947 
948 		/*
949 		 * prreq frame format
950 		 *	[tlv] ssid
951 		 *	[tlv] supported rates
952 		 *	[tlv] extended supported rates
953 		 */
954 		ssid = rates = xrates = NULL;
955 		while (frm < efrm) {
956 			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
957 			    frm[1], goto out);
958 			switch (*frm) {
959 			case IEEE80211_ELEMID_SSID:
960 				ssid = frm;
961 				break;
962 			case IEEE80211_ELEMID_RATES:
963 				rates = frm;
964 				break;
965 			case IEEE80211_ELEMID_XRATES:
966 				xrates = frm;
967 				break;
968 			}
969 			frm += frm[1] + 2;
970 		}
971 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
972 		IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, break);
973 		IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break);
974 		if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
975 			ieee80211_dbg(IEEE80211_MSG_INPUT,
976 			    "ieee80211_recv_mgmt: ignore %s, "
977 			    "no ssid with ssid suppression enabled",
978 			    IEEE80211_SUBTYPE_NAME(subtype));
979 			break;
980 		}
981 
982 		if (in == ic->ic_bss) {
983 			if (ic->ic_opmode != IEEE80211_M_IBSS) {
984 				in = ieee80211_tmp_node(ic, wh->i_addr2);
985 				allocbs = B_TRUE;
986 			} else if (!IEEE80211_ADDR_EQ(wh->i_addr2,
987 			    in->in_macaddr)) {
988 				/*
989 				 * Cannot tell if the sender is operating
990 				 * in ibss mode.  But we need a new node to
991 				 * send the response so blindly add them to the
992 				 * neighbor table.
993 				 */
994 				in = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
995 				    wh->i_addr2);
996 			}
997 			if (in == NULL)
998 				break;
999 		}
1000 		ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: "
1001 		    "[%s] recv probe req\n",
1002 		    ieee80211_macaddr_sprintf(wh->i_addr2));
1003 		in->in_rssi = (uint8_t)rssi;
1004 		in->in_rstamp = rstamp;
1005 		/*
1006 		 * Adjust and check station's rate list with device's
1007 		 * supported rate.  Send back response if there is at
1008 		 * least one rate or the fixed rate(if being set) is
1009 		 * supported by both station and the device
1010 		 */
1011 		rate = ieee80211_setup_rates(in, rates, xrates,
1012 		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1013 		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1014 		if (rate & IEEE80211_RATE_BASIC) {
1015 			ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt"
1016 			    "%s recv'd rate set invalid",
1017 			    IEEE80211_SUBTYPE_NAME(subtype));
1018 		} else {
1019 			IEEE80211_UNLOCK(ic);
1020 			IEEE80211_SEND_MGMT(ic, in,
1021 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
1022 			IEEE80211_LOCK(ic);
1023 		}
1024 		if (allocbs) {
1025 			/*
1026 			 * Temporary node created just to send a
1027 			 * response, reclaim immediately.
1028 			 */
1029 			ieee80211_free_node(in);
1030 		}
1031 		break;
1032 
1033 	case IEEE80211_FC0_SUBTYPE_AUTH:
1034 		/*
1035 		 * auth frame format
1036 		 *	[2] algorithm
1037 		 *	[2] sequence
1038 		 *	[2] status
1039 		 *	[tlv*] challenge
1040 		 */
1041 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1042 		    IEEE80211_AUTH_ELEM_MIN, break);
1043 		algo   = (*(uint16_t *)frm);
1044 		seq    = (*(uint16_t *)(frm + 2));
1045 		status = (*(uint16_t *)(frm + 4));
1046 		ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: "
1047 		    "[%s] recv auth frame with algorithm %d seq %d\n",
1048 		    ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq);
1049 
1050 		if (ic->ic_flags & IEEE80211_F_COUNTERM) {
1051 			ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1052 			    "ieee80211_recv_mgmt: ignore auth, %s\n",
1053 			    "TKIP countermeasures enabled");
1054 			break;
1055 		}
1056 		switch (algo) {
1057 		case IEEE80211_AUTH_ALG_SHARED:
1058 			ieee80211_auth_shared(ic, wh, frm + 6, efrm, in,
1059 			    seq, status);
1060 			break;
1061 		case IEEE80211_AUTH_ALG_OPEN:
1062 			ieee80211_auth_open(ic, wh, in, seq, status);
1063 			break;
1064 		default:
1065 			ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1066 			    "ignore auth, unsupported alg %d", algo);
1067 			break;
1068 		}
1069 		break;
1070 
1071 	case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1072 	case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1073 		if (ic->ic_opmode != IEEE80211_M_STA ||
1074 		    ic->ic_state != IEEE80211_S_ASSOC)
1075 			break;
1076 
1077 		/*
1078 		 * asresp frame format
1079 		 *	[2] capability information
1080 		 *	[2] status
1081 		 *	[2] association ID
1082 		 *	[tlv] supported rates
1083 		 *	[tlv] extended supported rates
1084 		 *	[tlv] WME
1085 		 */
1086 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1087 		    IEEE80211_ASSOC_RESP_ELEM_MIN, break);
1088 		in = ic->ic_bss;
1089 		capinfo = (*(uint16_t *)frm);
1090 		frm += 2;
1091 		status = (*(uint16_t *)frm);
1092 		frm += 2;
1093 		if (status != 0) {
1094 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1095 			    "assoc failed (reason %d)\n", status);
1096 			in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2);
1097 			if (in != NULL) {
1098 				in->in_fails++;
1099 				ieee80211_free_node(in);
1100 			}
1101 			break;
1102 		}
1103 		associd = (*(uint16_t *)frm);
1104 		frm += 2;
1105 
1106 		rates = xrates = NULL;
1107 		while (frm < efrm) {
1108 			/*
1109 			 * Do not discard frames containing proprietary Agere
1110 			 * elements 128 and 129, as the reported element length
1111 			 * is often wrong. Skip rest of the frame, since we can
1112 			 * not rely on the given element length making it
1113 			 * impossible to know where the next element starts
1114 			 */
1115 			if ((*frm == IEEE80211_ELEMID_AGERE1) ||
1116 			    (*frm == IEEE80211_ELEMID_AGERE2)) {
1117 				frm = efrm;
1118 				break;
1119 			}
1120 
1121 			IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm),
1122 			    frm[1], goto out);
1123 			switch (*frm) {
1124 			case IEEE80211_ELEMID_RATES:
1125 				rates = frm;
1126 				break;
1127 			case IEEE80211_ELEMID_XRATES:
1128 				xrates = frm;
1129 				break;
1130 			}
1131 			frm += frm[1] + 2;
1132 		}
1133 
1134 		IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break);
1135 		/*
1136 		 * Adjust and check AP's rate list with device's
1137 		 * supported rate. Re-start scan if no rate is or the
1138 		 * fixed rate(if being set) cannot be supported by
1139 		 * either AP or the device.
1140 		 */
1141 		rate = ieee80211_setup_rates(in, rates, xrates,
1142 		    IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1143 		    IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1144 		if (rate & IEEE80211_RATE_BASIC) {
1145 			ieee80211_dbg(IEEE80211_MSG_ASSOC,
1146 			    "assoc failed (rate set mismatch)\n");
1147 			if (in != ic->ic_bss)
1148 				in->in_fails++;
1149 			IEEE80211_UNLOCK(ic);
1150 			ieee80211_new_state(ic, IEEE80211_S_SCAN, 0);
1151 			return;
1152 		}
1153 
1154 		in->in_capinfo = capinfo;
1155 		in->in_associd = associd;
1156 		in->in_flags &= ~IEEE80211_NODE_QOS;
1157 		/*
1158 		 * Configure state now that we are associated.
1159 		 */
1160 		if (ic->ic_curmode == IEEE80211_MODE_11A ||
1161 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1162 			ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1163 			ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1164 		} else {
1165 			ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1166 			ic->ic_flags |= IEEE80211_F_USEBARKER;
1167 		}
1168 		ieee80211_set_shortslottime(ic,
1169 		    ic->ic_curmode == IEEE80211_MODE_11A ||
1170 		    (in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1171 		/*
1172 		 * Honor ERP protection.
1173 		 *
1174 		 * NB:	in_erp should zero for non-11g operation.
1175 		 *	check ic_curmode anyway
1176 		 */
1177 		if (ic->ic_curmode == IEEE80211_MODE_11G &&
1178 		    (in->in_erp & IEEE80211_ERP_USE_PROTECTION))
1179 			ic->ic_flags |= IEEE80211_F_USEPROT;
1180 		else
1181 			ic->ic_flags &= ~IEEE80211_F_USEPROT;
1182 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1183 		    "assoc success: %s preamble, %s slot time%s%s\n",
1184 		    ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1185 		    ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1186 		    ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1187 		    in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : "");
1188 		IEEE80211_UNLOCK(ic);
1189 		ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
1190 		return;
1191 
1192 	case IEEE80211_FC0_SUBTYPE_DEAUTH:
1193 		if (ic->ic_state == IEEE80211_S_SCAN)
1194 			break;
1195 
1196 		/*
1197 		 * deauth frame format
1198 		 *	[2] reason
1199 		 */
1200 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1201 		status = (*(uint16_t *)frm);
1202 
1203 		ieee80211_dbg(IEEE80211_MSG_AUTH,
1204 		    "recv deauthenticate (reason %d)\n", status);
1205 		switch (ic->ic_opmode) {
1206 		case IEEE80211_M_STA:
1207 			IEEE80211_UNLOCK(ic);
1208 			ieee80211_new_state(ic, IEEE80211_S_AUTH,
1209 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1210 			return;
1211 		default:
1212 			break;
1213 		}
1214 		break;
1215 
1216 	case IEEE80211_FC0_SUBTYPE_DISASSOC:
1217 		if (ic->ic_state != IEEE80211_S_RUN &&
1218 		    ic->ic_state != IEEE80211_S_ASSOC &&
1219 		    ic->ic_state != IEEE80211_S_AUTH)
1220 			break;
1221 		/*
1222 		 * disassoc frame format
1223 		 *	[2] reason
1224 		 */
1225 		IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break);
1226 		status = (*(uint16_t *)frm);
1227 
1228 		ieee80211_dbg(IEEE80211_MSG_ASSOC,
1229 		    "recv disassociate (reason %d)\n", status);
1230 		switch (ic->ic_opmode) {
1231 		case IEEE80211_M_STA:
1232 			IEEE80211_UNLOCK(ic);
1233 			ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1234 			    wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1235 			return;
1236 		default:
1237 			break;
1238 		}
1239 		break;
1240 
1241 	default:
1242 		ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: "
1243 		    "subtype 0x%x not handled\n", subtype);
1244 		break;
1245 	} /* switch subtype */
1246 out:
1247 	IEEE80211_UNLOCK(ic);
1248 }
1249