1 /* 2 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 3 * Use is subject to license terms. 4 */ 5 6 /* 7 * Copyright (c) 2001 Atsushi Onoe 8 * Copyright (c) 2002-2008 Sam Leffler, Errno Consulting 9 * All rights reserved. 10 * 11 * Redistribution and use in source and binary forms, with or without 12 * modification, are permitted provided that the following conditions 13 * are met: 14 * 1. Redistributions of source code must retain the above copyright 15 * notice, this list of conditions and the following disclaimer. 16 * 2. Redistributions in binary form must reproduce the above copyright 17 * notice, this list of conditions and the following disclaimer in the 18 * documentation and/or other materials provided with the distribution. 19 * 3. The name of the author may not be used to endorse or promote products 20 * derived from this software without specific prior written permission. 21 * 22 * Alternatively, this software may be distributed under the terms of the 23 * GNU General Public License ("GPL") version 2 as published by the Free 24 * Software Foundation. 25 * 26 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 27 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 28 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 29 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 30 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 31 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 32 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 33 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 34 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 35 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 36 */ 37 38 /* 39 * Process received frame 40 */ 41 42 #include <sys/mac_provider.h> 43 #include <sys/byteorder.h> 44 #include <sys/strsun.h> 45 #include "net80211_impl.h" 46 47 static mblk_t *ieee80211_defrag(ieee80211com_t *, ieee80211_node_t *, 48 mblk_t *, int); 49 50 /* 51 * Process a received frame. The node associated with the sender 52 * should be supplied. If nothing was found in the node table then 53 * the caller is assumed to supply a reference to ic_bss instead. 54 * The RSSI and a timestamp are also supplied. The RSSI data is used 55 * during AP scanning to select a AP to associate with; it can have 56 * any units so long as values have consistent units and higher values 57 * mean ``better signal''. The receive timestamp is currently not used 58 * by the 802.11 layer. 59 */ 60 int 61 ieee80211_input(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in, 62 int32_t rssi, uint32_t rstamp) 63 { 64 struct ieee80211_frame *wh; 65 struct ieee80211_key *key; 66 uint8_t *bssid; 67 int hdrspace; 68 int len; 69 uint16_t rxseq; 70 uint8_t dir; 71 uint8_t type; 72 uint8_t subtype; 73 uint8_t tid; 74 uint8_t qos; 75 76 if (mp->b_flag & M_AMPDU) { 77 /* 78 * Fastpath for A-MPDU reorder q resubmission. Frames 79 * w/ M_AMPDU marked have already passed through here 80 * but were received out of order and been held on the 81 * reorder queue. When resubmitted they are marked 82 * with the M_AMPDU flag and we can bypass most of the 83 * normal processing. 84 */ 85 IEEE80211_LOCK(ic); 86 wh = (struct ieee80211_frame *)mp->b_rptr; 87 type = IEEE80211_FC0_TYPE_DATA; 88 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 89 subtype = IEEE80211_FC0_SUBTYPE_QOS; 90 hdrspace = ieee80211_hdrspace(ic, wh); /* optimize */ 91 /* clear driver/net80211 flags before passing up */ 92 mp->b_flag &= ~M_AMPDU; 93 goto resubmit_ampdu; 94 } 95 96 ASSERT(in != NULL); 97 in->in_inact = in->in_inact_reload; 98 type = (uint8_t)-1; /* undefined */ 99 len = MBLKL(mp); 100 if (len < sizeof (struct ieee80211_frame_min)) { 101 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: " 102 "too short (1): len %u", len); 103 goto out; 104 } 105 /* 106 * Bit of a cheat here, we use a pointer for a 3-address 107 * frame format but don't reference fields past outside 108 * ieee80211_frame_min w/o first validating the data is 109 * present. 110 */ 111 wh = (struct ieee80211_frame *)mp->b_rptr; 112 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) != 113 IEEE80211_FC0_VERSION_0) { 114 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: " 115 "discard pkt with wrong version %x", wh->i_fc[0]); 116 goto out; 117 } 118 119 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK; 120 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK; 121 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK; 122 123 IEEE80211_LOCK(ic); 124 if (!(ic->ic_flags & IEEE80211_F_SCAN)) { 125 switch (ic->ic_opmode) { 126 case IEEE80211_M_STA: 127 bssid = wh->i_addr2; 128 if (!IEEE80211_ADDR_EQ(bssid, in->in_bssid)) 129 goto out_exit_mutex; 130 break; 131 case IEEE80211_M_IBSS: 132 case IEEE80211_M_AHDEMO: 133 if (dir != IEEE80211_FC1_DIR_NODS) { 134 bssid = wh->i_addr1; 135 } else if (type == IEEE80211_FC0_TYPE_CTL) { 136 bssid = wh->i_addr1; 137 } else { 138 if (len < sizeof (struct ieee80211_frame)) { 139 ieee80211_dbg(IEEE80211_MSG_ANY, 140 "ieee80211_input: too short(2):" 141 "len %u\n", len); 142 goto out_exit_mutex; 143 } 144 bssid = wh->i_addr3; 145 } 146 if (type != IEEE80211_FC0_TYPE_DATA) 147 break; 148 /* 149 * Data frame, validate the bssid. 150 */ 151 if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->in_bssid) && 152 !IEEE80211_ADDR_EQ(bssid, wifi_bcastaddr)) { 153 /* not interested in */ 154 ieee80211_dbg(IEEE80211_MSG_INPUT, 155 "ieee80211_input: not to bss %s\n", 156 ieee80211_macaddr_sprintf(bssid)); 157 goto out_exit_mutex; 158 } 159 /* 160 * For adhoc mode we cons up a node when it doesn't 161 * exist. This should probably done after an ACL check. 162 */ 163 if (in == ic->ic_bss && 164 ic->ic_opmode != IEEE80211_M_HOSTAP && 165 !IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) { 166 /* 167 * Fake up a node for this newly 168 * discovered member of the IBSS. 169 */ 170 in = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 171 wh->i_addr2); 172 if (in == NULL) { 173 /* NB: stat kept for alloc failure */ 174 goto out_exit_mutex; 175 } 176 } 177 break; 178 default: 179 goto out_exit_mutex; 180 } 181 in->in_rssi = (uint8_t)rssi; 182 in->in_rstamp = rstamp; 183 if (!(type & IEEE80211_FC0_TYPE_CTL)) { 184 if (IEEE80211_QOS_HAS_SEQ(wh)) { 185 tid = ((struct ieee80211_qosframe *)wh)-> 186 i_qos[0] & IEEE80211_QOS_TID; 187 if (TID_TO_WME_AC(tid) >= WME_AC_VI) 188 ic->ic_wme.wme_hipri_traffic++; 189 tid++; 190 } else { 191 tid = IEEE80211_NONQOS_TID; 192 } 193 rxseq = LE_16(*(uint16_t *)wh->i_seq); 194 if ((in->in_flags & IEEE80211_NODE_HT) == 0 && 195 (wh->i_fc[1] & IEEE80211_FC1_RETRY) && 196 (rxseq - in->in_rxseqs[tid]) <= 0) { 197 /* duplicate, discard */ 198 ieee80211_dbg(IEEE80211_MSG_INPUT, 199 "ieee80211_input: duplicate", 200 "seqno <%u,%u> fragno <%u,%u> tid %u", 201 rxseq >> IEEE80211_SEQ_SEQ_SHIFT, 202 in->in_rxseqs[tid] >> 203 IEEE80211_SEQ_SEQ_SHIFT, 204 rxseq & IEEE80211_SEQ_FRAG_MASK, 205 in->in_rxseqs[tid] & 206 IEEE80211_SEQ_FRAG_MASK, 207 tid); 208 ic->ic_stats.is_rx_dups++; 209 goto out_exit_mutex; 210 } 211 in->in_rxseqs[tid] = rxseq; 212 } 213 } 214 215 switch (type) { 216 case IEEE80211_FC0_TYPE_DATA: 217 hdrspace = ieee80211_hdrspace(ic, wh); 218 if (len < hdrspace) { 219 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: " 220 "data too short: expecting %u", hdrspace); 221 goto out_exit_mutex; 222 } 223 switch (ic->ic_opmode) { 224 case IEEE80211_M_STA: 225 if (dir != IEEE80211_FC1_DIR_FROMDS) { 226 ieee80211_dbg(IEEE80211_MSG_INPUT, 227 "ieee80211_input: data ", 228 "unknown dir 0x%x", dir); 229 goto out_exit_mutex; 230 } 231 if (IEEE80211_IS_MULTICAST(wh->i_addr1) && 232 IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_macaddr)) { 233 /* 234 * In IEEE802.11 network, multicast packet 235 * sent from me is broadcasted from AP. 236 * It should be silently discarded for 237 * SIMPLEX interface. 238 */ 239 ieee80211_dbg(IEEE80211_MSG_INPUT, 240 "ieee80211_input: multicast echo\n"); 241 goto out_exit_mutex; 242 } 243 break; 244 case IEEE80211_M_IBSS: 245 case IEEE80211_M_AHDEMO: 246 if (dir != IEEE80211_FC1_DIR_NODS) { 247 ieee80211_dbg(IEEE80211_MSG_INPUT, 248 "ieee80211_input: unknown dir 0x%x", 249 dir); 250 goto out_exit_mutex; 251 } 252 break; 253 default: 254 ieee80211_err("ieee80211_input: " 255 "receive data, unknown opmode %u, skip\n", 256 ic->ic_opmode); 257 goto out_exit_mutex; 258 } 259 260 /* 261 * Handle A-MPDU re-ordering. The station must be 262 * associated and negotiated HT. The frame must be 263 * a QoS frame (not QoS null data) and not previously 264 * processed for A-MPDU re-ordering. If the frame is 265 * to be processed directly then ieee80211_ampdu_reorder 266 * will return 0; otherwise it has consumed the mbuf 267 * and we should do nothing more with it. 268 */ 269 if ((in->in_flags & IEEE80211_NODE_HT) && 270 (subtype == IEEE80211_FC0_SUBTYPE_QOS)) { 271 IEEE80211_UNLOCK(ic); 272 if (ieee80211_ampdu_reorder(in, mp) != 0) { 273 mp = NULL; /* CONSUMED */ 274 goto out; 275 } 276 IEEE80211_LOCK(ic); 277 } 278 resubmit_ampdu: 279 280 /* 281 * Handle privacy requirements. 282 */ 283 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 284 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 285 /* 286 * Discard encrypted frames when privacy off. 287 */ 288 ieee80211_dbg(IEEE80211_MSG_INPUT, 289 "ieee80211_input: ""WEP PRIVACY off"); 290 ic->ic_stats.is_wep_errors++; 291 goto out_exit_mutex; 292 } 293 key = ieee80211_crypto_decap(ic, mp, hdrspace); 294 if (key == NULL) { 295 /* NB: stats+msgs handled in crypto_decap */ 296 ic->ic_stats.is_wep_errors++; 297 goto out_exit_mutex; 298 } 299 wh = (struct ieee80211_frame *)mp->b_rptr; 300 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 301 } else { 302 key = NULL; 303 } 304 305 /* 306 * Save QoS bits for use below--before we strip the header. 307 */ 308 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) { 309 qos = (dir == IEEE80211_FC1_DIR_DSTODS) ? 310 ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] : 311 ((struct ieee80211_qosframe *)wh)->i_qos[0]; 312 } else { 313 qos = 0; 314 } 315 316 /* 317 * Next up, any fragmentation 318 */ 319 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) { 320 mp = ieee80211_defrag(ic, in, mp, hdrspace); 321 if (mp == NULL) { 322 /* Fragment dropped or frame not complete yet */ 323 goto out_exit_mutex; 324 } 325 } 326 wh = NULL; /* no longer valid, catch any uses */ 327 328 /* 329 * Next strip any MSDU crypto bits. 330 */ 331 if (key != NULL && !ieee80211_crypto_demic(ic, key, mp, 0)) { 332 ieee80211_dbg(IEEE80211_MSG_INPUT, "ieee80211_input: " 333 "data demic error\n"); 334 goto out_exit_mutex; 335 } 336 337 if (qos & IEEE80211_QOS_AMSDU) { 338 ieee80211_dbg(IEEE80211_MSG_INPUT | IEEE80211_MSG_HT, 339 "ieee80211_input: QOS_AMSDU (%x)\n", qos); 340 341 mp = ieee80211_decap_amsdu(in, mp); 342 if (mp == NULL) /* MSDU processed by HT */ 343 goto out_exit_mutex; 344 } 345 346 ic->ic_stats.is_rx_frags++; 347 ic->ic_stats.is_rx_bytes += len; 348 IEEE80211_UNLOCK(ic); 349 mac_rx(ic->ic_mach, NULL, mp); 350 return (IEEE80211_FC0_TYPE_DATA); 351 352 case IEEE80211_FC0_TYPE_MGT: 353 if (dir != IEEE80211_FC1_DIR_NODS) 354 goto out_exit_mutex; 355 if (len < sizeof (struct ieee80211_frame)) 356 goto out_exit_mutex; 357 if (wh->i_fc[1] & IEEE80211_FC1_WEP) { 358 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) { 359 /* 360 * Only shared key auth frames with a challenge 361 * should be encrypted, discard all others. 362 */ 363 ieee80211_dbg(IEEE80211_MSG_INPUT, 364 "ieee80211_input: " 365 "%s WEP set but not permitted", 366 IEEE80211_SUBTYPE_NAME(subtype)); 367 ic->ic_stats.is_wep_errors++; 368 goto out_exit_mutex; 369 } 370 if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) { 371 /* 372 * Discard encrypted frames when privacy off. 373 */ 374 ieee80211_dbg(IEEE80211_MSG_INPUT, 375 "ieee80211_input: " 376 "mgt WEP set but PRIVACY off"); 377 ic->ic_stats.is_wep_errors++; 378 goto out_exit_mutex; 379 } 380 hdrspace = ieee80211_hdrspace(ic, wh); 381 key = ieee80211_crypto_decap(ic, mp, hdrspace); 382 if (key == NULL) { 383 /* NB: stats+msgs handled in crypto_decap */ 384 goto out_exit_mutex; 385 } 386 wh = (struct ieee80211_frame *)mp->b_rptr; 387 wh->i_fc[1] &= ~IEEE80211_FC1_WEP; 388 } 389 IEEE80211_UNLOCK(ic); 390 ic->ic_recv_mgmt(ic, mp, in, subtype, rssi, rstamp); 391 goto out; 392 393 case IEEE80211_FC0_TYPE_CTL: 394 if (ic->ic_opmode == IEEE80211_M_HOSTAP) { 395 switch (subtype) { 396 case IEEE80211_FC0_SUBTYPE_BAR: 397 ieee80211_recv_bar(in, mp); 398 break; 399 } 400 } 401 break; 402 403 default: 404 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_input: " 405 "bad frame type 0x%x", type); 406 /* should not come here */ 407 break; 408 } 409 out_exit_mutex: 410 IEEE80211_UNLOCK(ic); 411 out: 412 if (mp != NULL) 413 freemsg(mp); 414 415 return (type); 416 } 417 418 /* 419 * This function reassemble fragments. 420 * More fragments bit in the frame control means the packet is fragmented. 421 * While the sequence control field consists of 4-bit fragment number 422 * field and a 12-bit sequence number field. 423 */ 424 /* ARGSUSED */ 425 static mblk_t * 426 ieee80211_defrag(ieee80211com_t *ic, struct ieee80211_node *in, mblk_t *mp, 427 int hdrspace) 428 { 429 struct ieee80211_frame *wh = (struct ieee80211_frame *)mp->b_rptr; 430 struct ieee80211_frame *lwh; 431 mblk_t *mfrag; 432 uint16_t rxseq; 433 uint8_t fragno; 434 uint8_t more_frag; 435 436 ASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1)); 437 more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG; 438 rxseq = LE_16(*(uint16_t *)wh->i_seq); 439 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK; 440 441 /* Quick way out, if there's nothing to defragment */ 442 if (!more_frag && fragno == 0 && in->in_rxfrag == NULL) 443 return (mp); 444 445 /* 446 * Remove frag to insure it doesn't get reaped by timer. 447 */ 448 if (in->in_table == NULL) { 449 /* 450 * Should never happen. If the node is orphaned (not in 451 * the table) then input packets should not reach here. 452 * Otherwise, a concurrent request that yanks the table 453 * should be blocked by other interlocking and/or by first 454 * shutting the driver down. Regardless, be defensive 455 * here and just bail 456 */ 457 freemsg(mp); 458 return (NULL); 459 } 460 IEEE80211_NODE_LOCK(in->in_table); 461 mfrag = in->in_rxfrag; 462 in->in_rxfrag = NULL; 463 IEEE80211_NODE_UNLOCK(in->in_table); 464 465 /* 466 * Validate new fragment is in order and 467 * related to the previous ones. 468 */ 469 if (mfrag != NULL) { 470 uint16_t last_rxseq; 471 472 lwh = (struct ieee80211_frame *)mfrag->b_rptr; 473 last_rxseq = LE_16(*(uint16_t *)lwh->i_seq); 474 /* 475 * Sequence control field contains 12-bit sequence no 476 * and 4-bit fragment number. For fragemnts, the 477 * sequence no is not changed. 478 * NB: check seq # and frag together 479 */ 480 if (rxseq != last_rxseq + 1 || 481 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) || 482 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) { 483 /* 484 * Unrelated fragment or no space for it, 485 * clear current fragments. 486 */ 487 freemsg(mfrag); 488 mfrag = NULL; 489 } 490 } 491 492 if (mfrag == NULL) { 493 if (fragno != 0) { /* !first fragment, discard */ 494 freemsg(mp); 495 return (NULL); 496 } 497 mfrag = mp; 498 } else { /* concatenate */ 499 (void) adjmsg(mp, hdrspace); 500 linkb(mfrag, mp); 501 /* track last seqnum and fragno */ 502 lwh = (struct ieee80211_frame *)mfrag->b_rptr; 503 *(uint16_t *)lwh->i_seq = *(uint16_t *)wh->i_seq; 504 } 505 if (more_frag != 0) { /* more to come, save */ 506 in->in_rxfragstamp = ddi_get_lbolt(); 507 in->in_rxfrag = mfrag; 508 mfrag = NULL; 509 } 510 511 return (mfrag); 512 } 513 514 /* 515 * Install received rate set information in the node's state block. 516 */ 517 int 518 ieee80211_setup_rates(struct ieee80211_node *in, const uint8_t *rates, 519 const uint8_t *xrates, int flags) 520 { 521 struct ieee80211_rateset *rs = &in->in_rates; 522 523 bzero(rs, sizeof (*rs)); 524 rs->ir_nrates = rates[1]; 525 /* skip 1 byte element ID and 1 byte length */ 526 bcopy(rates + 2, rs->ir_rates, rs->ir_nrates); 527 if (xrates != NULL) { 528 uint8_t nxrates; 529 530 /* 531 * Tack on 11g extended supported rate element. 532 */ 533 nxrates = xrates[1]; 534 if (rs->ir_nrates + nxrates > IEEE80211_RATE_MAXSIZE) { 535 nxrates = IEEE80211_RATE_MAXSIZE - rs->ir_nrates; 536 ieee80211_dbg(IEEE80211_MSG_XRATE, 537 "ieee80211_setup_rates: %s", 538 "[%s] extended rate set too large;" 539 " only using %u of %u rates\n", 540 ieee80211_macaddr_sprintf(in->in_macaddr), 541 nxrates, xrates[1]); 542 } 543 bcopy(xrates + 2, rs->ir_rates + rs->ir_nrates, nxrates); 544 rs->ir_nrates += nxrates; 545 } 546 return (ieee80211_fix_rate(in, &in->in_rates, flags)); 547 } 548 549 /* 550 * Process open-system authentication response frame and start 551 * association if the authentication request is accepted. 552 */ 553 static void 554 ieee80211_auth_open(ieee80211com_t *ic, struct ieee80211_frame *wh, 555 struct ieee80211_node *in, uint16_t seq, uint16_t status) 556 { 557 IEEE80211_LOCK_ASSERT(ic); 558 if (in->in_authmode == IEEE80211_AUTH_SHARED) { 559 ieee80211_dbg(IEEE80211_MSG_AUTH, 560 "open auth: bad sta auth mode %u", in->in_authmode); 561 return; 562 } 563 if (ic->ic_opmode == IEEE80211_M_STA) { 564 if (ic->ic_state != IEEE80211_S_AUTH || 565 seq != IEEE80211_AUTH_OPEN_RESPONSE) { 566 return; 567 } 568 IEEE80211_UNLOCK(ic); 569 if (status != 0) { 570 ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 571 "open auth failed (reason %d)\n", status); 572 if (in != ic->ic_bss) 573 in->in_fails++; 574 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 575 } else { 576 /* i_fc[0] - frame control's type & subtype field */ 577 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 578 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 579 } 580 IEEE80211_LOCK(ic); 581 } else { 582 ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_open: " 583 "bad operating mode %u", ic->ic_opmode); 584 } 585 } 586 587 /* 588 * Allocate challenge text for use by shared-key authentication 589 * Return B_TRUE on success, B_FALST otherwise. 590 */ 591 static boolean_t 592 ieee80211_alloc_challenge(struct ieee80211_node *in) 593 { 594 if (in->in_challenge == NULL) { 595 in->in_challenge = kmem_alloc(IEEE80211_CHALLENGE_LEN, 596 KM_NOSLEEP); 597 } 598 if (in->in_challenge == NULL) { 599 ieee80211_dbg(IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, 600 "[%s] shared key challenge alloc failed\n", 601 ieee80211_macaddr_sprintf(in->in_macaddr)); 602 } 603 return (in->in_challenge != NULL); 604 } 605 606 /* 607 * Process shared-key authentication response frames. If authentication 608 * succeeds, start association; otherwise, restart scan. 609 */ 610 static void 611 ieee80211_auth_shared(ieee80211com_t *ic, struct ieee80211_frame *wh, 612 uint8_t *frm, uint8_t *efrm, struct ieee80211_node *in, uint16_t seq, 613 uint16_t status) 614 { 615 uint8_t *challenge; 616 617 /* 618 * Pre-shared key authentication is evil; accept 619 * it only if explicitly configured (it is supported 620 * mainly for compatibility with clients like OS X). 621 */ 622 IEEE80211_LOCK_ASSERT(ic); 623 if (in->in_authmode != IEEE80211_AUTH_AUTO && 624 in->in_authmode != IEEE80211_AUTH_SHARED) { 625 ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_auth_shared: " 626 "bad sta auth mode %u", in->in_authmode); 627 goto bad; 628 } 629 630 challenge = NULL; 631 if (frm + 1 < efrm) { 632 /* 633 * Challenge text information element 634 * frm[0] - element ID 635 * frm[1] - length 636 * frm[2]... - challenge text 637 */ 638 if ((frm[1] + 2) > (_PTRDIFF(efrm, frm))) { 639 ieee80211_dbg(IEEE80211_MSG_AUTH, 640 "ieee80211_auth_shared: ie %d%d too long\n", 641 frm[0], (frm[1] + 2) - (_PTRDIFF(efrm, frm))); 642 goto bad; 643 } 644 if (*frm == IEEE80211_ELEMID_CHALLENGE) 645 challenge = frm; 646 frm += frm[1] + 2; 647 } 648 switch (seq) { 649 case IEEE80211_AUTH_SHARED_CHALLENGE: 650 case IEEE80211_AUTH_SHARED_RESPONSE: 651 if (challenge == NULL) { 652 ieee80211_dbg(IEEE80211_MSG_AUTH, 653 "ieee80211_auth_shared: no challenge\n"); 654 goto bad; 655 } 656 if (challenge[1] != IEEE80211_CHALLENGE_LEN) { 657 ieee80211_dbg(IEEE80211_MSG_AUTH, 658 "ieee80211_auth_shared: bad challenge len %d\n", 659 challenge[1]); 660 goto bad; 661 } 662 default: 663 break; 664 } 665 switch (ic->ic_opmode) { 666 case IEEE80211_M_STA: 667 if (ic->ic_state != IEEE80211_S_AUTH) 668 return; 669 switch (seq) { 670 case IEEE80211_AUTH_SHARED_PASS: 671 if (in->in_challenge != NULL) { 672 kmem_free(in->in_challenge, 673 IEEE80211_CHALLENGE_LEN); 674 in->in_challenge = NULL; 675 } 676 if (status != 0) { 677 ieee80211_dbg(IEEE80211_MSG_DEBUG | 678 IEEE80211_MSG_AUTH, 679 "shared key auth failed (reason %d)\n", 680 status); 681 if (in != ic->ic_bss) 682 in->in_fails++; 683 return; 684 } 685 IEEE80211_UNLOCK(ic); 686 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 687 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 688 IEEE80211_LOCK(ic); 689 break; 690 case IEEE80211_AUTH_SHARED_CHALLENGE: 691 if (!ieee80211_alloc_challenge(in)) 692 return; 693 bcopy(&challenge[2], in->in_challenge, challenge[1]); 694 IEEE80211_UNLOCK(ic); 695 IEEE80211_SEND_MGMT(ic, in, IEEE80211_FC0_SUBTYPE_AUTH, 696 seq + 1); 697 IEEE80211_LOCK(ic); 698 break; 699 default: 700 ieee80211_dbg(IEEE80211_MSG_AUTH, "80211_auth_shared: " 701 "shared key auth: bad seq %d", seq); 702 return; 703 } 704 break; 705 706 default: 707 ieee80211_dbg(IEEE80211_MSG_AUTH, 708 "ieee80211_auth_shared: bad opmode %u\n", 709 ic->ic_opmode); 710 break; 711 } 712 return; 713 bad: 714 if (ic->ic_opmode == IEEE80211_M_STA) { 715 /* 716 * Kick the state machine. This short-circuits 717 * using the mgt frame timeout to trigger the 718 * state transition. 719 */ 720 if (ic->ic_state == IEEE80211_S_AUTH) { 721 IEEE80211_UNLOCK(ic); 722 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 723 IEEE80211_LOCK(ic); 724 } 725 } 726 } 727 728 static int 729 iswpaoui(const uint8_t *frm) 730 { 731 uint32_t c; 732 bcopy(frm + 2, &c, 4); 733 return (frm[1] > 3 && LE_32(c) == ((WPA_OUI_TYPE << 24) | WPA_OUI)); 734 } 735 736 #define LE_READ_4(p) \ 737 ((uint32_t) \ 738 ((((uint8_t *)(p))[0]) | (((uint8_t *)(p))[1] << 8) | \ 739 (((uint8_t *)(p))[2] << 16) | (((uint8_t *)(p))[3] << 24))) 740 741 #define LE_READ_2(p) \ 742 ((uint16_t) \ 743 (((uint8_t *)(p))[0]) | (((uint8_t *)(p))[1] << 8)) 744 745 static int 746 iswmeoui(const uint8_t *frm) 747 { 748 return (frm[1] > 3 && LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI)); 749 } 750 751 static int 752 iswmeparam(const uint8_t *frm) 753 { 754 return (frm[1] > 5 && 755 LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 756 frm[6] == WME_PARAM_OUI_SUBTYPE); 757 } 758 759 static int 760 iswmeinfo(const uint8_t *frm) 761 { 762 return (frm[1] > 5 && 763 LE_READ_4(frm+2) == ((WME_OUI_TYPE<<24)|WME_OUI) && 764 frm[6] == WME_INFO_OUI_SUBTYPE); 765 } 766 767 static int 768 ishtcapoui(const uint8_t *frm) 769 { 770 return (frm[1] > 3 && 771 LE_READ_4(frm+2) == ((BCM_OUI_HTCAP<<24)|BCM_OUI)); 772 } 773 774 static int 775 ishtinfooui(const uint8_t *frm) 776 { 777 return (frm[1] > 3 && 778 LE_READ_4(frm+2) == ((BCM_OUI_HTINFO<<24)|BCM_OUI)); 779 } 780 781 /* ARGSUSED */ 782 static int 783 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm, 784 const struct ieee80211_frame *wh) 785 { 786 #define MS(_v, _f) (((_v) & _f) >> _f##_S) 787 struct ieee80211_wme_state *wme = &ic->ic_wme; 788 uint_t len = frm[1]; 789 uint8_t qosinfo; 790 int i; 791 792 if (len < sizeof (struct ieee80211_wme_param) - 2) { 793 ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME, 794 "WME too short, len %u", len); 795 return (-1); 796 } 797 qosinfo = frm[offsetof(struct ieee80211_wme_param, wme_qosInfo)]; 798 qosinfo &= WME_QOSINFO_COUNT; 799 /* do proper check for wraparound */ 800 if (qosinfo == wme->wme_wmeChanParams.cap_info) 801 return (0); 802 frm += offsetof(struct ieee80211_wme_param, wme_acParams); 803 for (i = 0; i < WME_NUM_AC; i++) { 804 struct wmeParams *wmep = 805 &wme->wme_wmeChanParams.cap_wmeParams[i]; 806 /* NB: ACI not used */ 807 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM); 808 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN); 809 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN); 810 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX); 811 wmep->wmep_txopLimit = LE_READ_2(frm+2); 812 frm += 4; 813 } 814 wme->wme_wmeChanParams.cap_info = qosinfo; 815 return (1); 816 #undef MS 817 } 818 819 /* 820 * Process a beacon/probe response frame. 821 * When the device is in station mode, create a node and add it 822 * to the node database for a new ESS or update node info if it's 823 * already there. 824 */ 825 static void 826 ieee80211_recv_beacon(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in, 827 int subtype, int rssi, uint32_t rstamp) 828 { 829 ieee80211_impl_t *im = ic->ic_private; 830 struct ieee80211_frame *wh; 831 uint8_t *frm; 832 uint8_t *efrm; /* end of frame body */ 833 struct ieee80211_scanparams scan; 834 835 wh = (struct ieee80211_frame *)mp->b_rptr; 836 frm = (uint8_t *)&wh[1]; 837 efrm = (uint8_t *)mp->b_wptr; 838 839 ic->ic_beaconmiss = 0; /* clear beacon miss counter */ 840 841 /* 842 * We process beacon/probe response frames: 843 * o when scanning, or 844 * o station mode when associated (to collect state 845 * updates such as 802.11g slot time), or 846 * o adhoc mode (to discover neighbors) 847 * Frames otherwise received are discarded. 848 */ 849 if (!((ic->ic_flags & IEEE80211_F_SCAN) || 850 (ic->ic_opmode == IEEE80211_M_STA && in->in_associd != 0) || 851 ic->ic_opmode == IEEE80211_M_IBSS)) { 852 return; 853 } 854 855 /* 856 * beacon/probe response frame format 857 * [8] time stamp 858 * [2] beacon interval 859 * [2] capability information 860 * [tlv] ssid 861 * [tlv] supported rates 862 * [tlv] country information 863 * [tlv] parameter set (FH/DS) 864 * [tlv] erp information 865 * [tlv] extended supported rates 866 * [tlv] WME 867 * [tlv] WPA or RSN 868 * [tlv] HT capabilities 869 * [tlv] HT information 870 */ 871 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 872 IEEE80211_BEACON_ELEM_MIN, return); 873 bzero(&scan, sizeof (scan)); 874 scan.tstamp = frm; 875 frm += 8; 876 scan.bintval = LE_16(*(uint16_t *)frm); 877 frm += 2; 878 scan.capinfo = LE_16(*(uint16_t *)frm); 879 frm += 2; 880 scan.bchan = ieee80211_chan2ieee(ic, ic->ic_curchan); 881 scan.chan = scan.bchan; 882 883 while (frm < efrm) { 884 /* Agere element in beacon */ 885 if ((*frm == IEEE80211_ELEMID_AGERE1) || 886 (*frm == IEEE80211_ELEMID_AGERE2)) { 887 frm = efrm; 888 break; 889 } 890 891 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), frm[1], return); 892 switch (*frm) { 893 case IEEE80211_ELEMID_SSID: 894 scan.ssid = frm; 895 break; 896 case IEEE80211_ELEMID_RATES: 897 scan.rates = frm; 898 break; 899 case IEEE80211_ELEMID_COUNTRY: 900 scan.country = frm; 901 break; 902 case IEEE80211_ELEMID_FHPARMS: 903 if (ic->ic_phytype == IEEE80211_T_FH) { 904 scan.fhdwell = LE_16(*(uint16_t *)(frm + 2)); 905 scan.chan = IEEE80211_FH_CHAN(frm[4], frm[5]); 906 scan.fhindex = frm[6]; 907 scan.phytype = IEEE80211_T_FH; 908 } 909 break; 910 case IEEE80211_ELEMID_DSPARMS: 911 if (ic->ic_phytype != IEEE80211_T_FH) { 912 scan.chan = frm[2]; 913 scan.phytype = IEEE80211_T_DS; 914 } 915 break; 916 case IEEE80211_ELEMID_TIM: 917 scan.tim = frm; 918 scan.timoff = _PTRDIFF(frm, mp->b_rptr); 919 break; 920 case IEEE80211_ELEMID_IBSSPARMS: 921 break; 922 case IEEE80211_ELEMID_XRATES: 923 scan.xrates = frm; 924 break; 925 case IEEE80211_ELEMID_ERP: 926 if (frm[1] != 1) { 927 ieee80211_dbg(IEEE80211_MSG_ELEMID, 928 "ieee80211_recv_mgmt: ignore %s, " 929 "invalid ERP element; " 930 "length %u, expecting 1\n", 931 IEEE80211_SUBTYPE_NAME(subtype), 932 frm[1]); 933 break; 934 } 935 scan.erp = frm[2]; 936 scan.phytype = IEEE80211_T_OFDM; 937 break; 938 case IEEE80211_ELEMID_HTCAP: 939 scan.htcap = frm; 940 break; 941 case IEEE80211_ELEMID_RSN: 942 scan.wpa = frm; 943 break; 944 case IEEE80211_ELEMID_HTINFO: 945 scan.htinfo = frm; 946 break; 947 case IEEE80211_ELEMID_VENDOR: 948 if (iswpaoui(frm)) 949 scan.wpa = frm; /* IEEE802.11i D3.0 */ 950 else if (iswmeparam(frm) || iswmeinfo(frm)) 951 scan.wme = frm; 952 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) { 953 /* 954 * Accept pre-draft HT ie's if the 955 * standard ones have not been seen. 956 */ 957 if (ishtcapoui(frm)) { 958 if (scan.htcap == NULL) 959 scan.htcap = frm; 960 } else if (ishtinfooui(frm)) { 961 if (scan.htinfo == NULL) 962 scan.htinfo = frm; 963 } 964 } 965 break; 966 default: 967 ieee80211_dbg(IEEE80211_MSG_ELEMID, 968 "ieee80211_recv_mgmt: ignore %s," 969 "unhandled id %u, len %u, totallen %u", 970 IEEE80211_SUBTYPE_NAME(subtype), 971 *frm, frm[1], 972 MBLKL(mp)); 973 break; 974 } 975 /* frm[1] - component length */ 976 frm += IEEE80211_ELEM_LEN(frm[1]); 977 } 978 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE, return); 979 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN, return); 980 if (ieee80211_isclr(ic->ic_chan_active, scan.chan)) { 981 ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 982 "ieee80211_recv_mgmt: ignore %s ," 983 "invalid channel %u\n", 984 IEEE80211_SUBTYPE_NAME(subtype), scan.chan); 985 return; 986 } 987 if (scan.chan != scan.bchan && 988 ic->ic_phytype != IEEE80211_T_FH) { 989 /* 990 * Frame was received on a channel different from the 991 * one indicated in the DS params element id; 992 * silently discard it. 993 * 994 * NB: this can happen due to signal leakage. 995 * But we should take it for FH phy because 996 * the rssi value should be correct even for 997 * different hop pattern in FH. 998 */ 999 ieee80211_dbg(IEEE80211_MSG_ELEMID, 1000 "ieee80211_recv_mgmt: ignore %s ," 1001 "phytype %u channel %u marked for %u\n", 1002 IEEE80211_SUBTYPE_NAME(subtype), 1003 ic->ic_phytype, scan.bchan, scan.chan); 1004 return; 1005 } 1006 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval && 1007 scan.bintval <= IEEE80211_BINTVAL_MAX)) { 1008 ieee80211_dbg(IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT, 1009 "ieee80211_recv_mgmt: ignore %s ," 1010 "bogus beacon interval %u\n", 1011 IEEE80211_SUBTYPE_NAME(subtype), scan.bintval); 1012 return; 1013 } 1014 /* 1015 * Process HT ie's. This is complicated by our 1016 * accepting both the standard ie's and the pre-draft 1017 * vendor OUI ie's that some vendors still use/require. 1018 */ 1019 if (scan.htcap != NULL) { 1020 IEEE80211_VERIFY_LENGTH(scan.htcap[1], 1021 scan.htcap[0] == IEEE80211_ELEMID_VENDOR ? 1022 4 + sizeof (struct ieee80211_ie_htcap) - 2 : 1023 sizeof (struct ieee80211_ie_htcap) - 2, 1024 scan.htcap = NULL); 1025 } 1026 if (scan.htinfo != NULL) { 1027 IEEE80211_VERIFY_LENGTH(scan.htinfo[1], 1028 scan.htinfo[0] == IEEE80211_ELEMID_VENDOR ? 1029 4 + sizeof (struct ieee80211_ie_htinfo) - 2 : 1030 sizeof (struct ieee80211_ie_htinfo) - 2, 1031 scan.htinfo = NULL); 1032 } 1033 1034 /* 1035 * When operating in station mode, check for state updates. 1036 * Be careful to ignore beacons received while doing a 1037 * background scan. We consider only 11g/WMM stuff right now. 1038 */ 1039 if (ic->ic_opmode == IEEE80211_M_STA && 1040 in->in_associd != 0 && 1041 (!(ic->ic_flags & IEEE80211_F_SCAN) || 1042 IEEE80211_ADDR_EQ(wh->i_addr2, in->in_bssid))) { 1043 /* record tsf of last beacon */ 1044 bcopy(scan.tstamp, in->in_tstamp.data, 1045 sizeof (in->in_tstamp)); 1046 /* count beacon frame for s/w bmiss handling */ 1047 im->im_swbmiss_count++; 1048 im->im_bmiss_count = 0; 1049 1050 if ((in->in_capinfo ^ scan.capinfo) & 1051 IEEE80211_CAPINFO_SHORT_SLOTTIME) { 1052 ieee80211_dbg(IEEE80211_MSG_ASSOC, 1053 "ieee80211_recv_mgmt: " 1054 "[%s] cap change: before 0x%x, now 0x%x\n", 1055 ieee80211_macaddr_sprintf(wh->i_addr2), 1056 in->in_capinfo, scan.capinfo); 1057 /* 1058 * NB: we assume short preamble doesn't 1059 * change dynamically 1060 */ 1061 ieee80211_set_shortslottime(ic, 1062 ic->ic_curmode == IEEE80211_MODE_11A || 1063 (scan.capinfo & 1064 IEEE80211_CAPINFO_SHORT_SLOTTIME)); 1065 in->in_capinfo = scan.capinfo; 1066 } 1067 if (scan.wme != NULL && 1068 (in->in_flags & IEEE80211_NODE_QOS) && 1069 ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0) { 1070 ieee80211_wme_updateparams(ic); 1071 } 1072 if (scan.htcap != NULL) 1073 ieee80211_parse_htcap(in, scan.htcap); 1074 if (scan.htinfo != NULL) { 1075 ieee80211_parse_htinfo(in, scan.htinfo); 1076 if (in->in_chan != ic->ic_curchan) { 1077 /* 1078 * Channel has been adjusted based on 1079 * negotiated HT parameters; force the 1080 * channel state to follow. 1081 */ 1082 ieee80211_setcurchan(ic, in->in_chan); 1083 } 1084 } 1085 if (scan.tim != NULL) { 1086 struct ieee80211_tim_ie *ie; 1087 1088 ie = (struct ieee80211_tim_ie *)scan.tim; 1089 in->in_dtim_count = ie->tim_count; 1090 in->in_dtim_period = ie->tim_period; 1091 } 1092 if (ic->ic_flags & IEEE80211_F_SCAN) { 1093 ieee80211_add_scan(ic, &scan, wh, subtype, rssi, 1094 rstamp); 1095 } 1096 return; 1097 } 1098 /* 1099 * If scanning, just pass information to the scan module. 1100 */ 1101 if (ic->ic_flags & IEEE80211_F_SCAN) { 1102 ieee80211_add_scan(ic, &scan, wh, subtype, rssi, rstamp); 1103 return; 1104 } 1105 1106 if (ic->ic_opmode == IEEE80211_M_IBSS && 1107 scan.capinfo & IEEE80211_CAPINFO_IBSS) { 1108 if (!IEEE80211_ADDR_EQ(wh->i_addr2, in->in_macaddr)) { 1109 /* 1110 * Create a new entry in the neighbor table. 1111 */ 1112 in = ieee80211_add_neighbor(ic, wh, &scan); 1113 } else { 1114 /* 1115 * Copy data from beacon to neighbor table. 1116 * Some of this information might change after 1117 * ieee80211_add_neighbor(), so we just copy 1118 * everything over to be safe. 1119 */ 1120 ieee80211_init_neighbor(in, wh, &scan); 1121 } 1122 if (in != NULL) { 1123 in->in_rssi = (uint8_t)rssi; 1124 in->in_rstamp = rstamp; 1125 } 1126 } 1127 } 1128 1129 /* 1130 * Perform input processing for 802.11 management frames. 1131 * It's the default ic_recv_mgmt callback function for the interface 1132 * softc, ic. Tipically ic_recv_mgmt is called within ieee80211_input() 1133 */ 1134 void 1135 ieee80211_recv_mgmt(ieee80211com_t *ic, mblk_t *mp, struct ieee80211_node *in, 1136 int subtype, int rssi, uint32_t rstamp) 1137 { 1138 struct ieee80211_frame *wh; 1139 uint8_t *frm; /* pointer to start of the frame */ 1140 uint8_t *efrm; /* pointer to end of the frame */ 1141 uint8_t *ssid; 1142 uint8_t *rates; 1143 uint8_t *xrates; /* extended rates */ 1144 uint8_t *wme; 1145 uint8_t *htcap, *htinfo; 1146 boolean_t allocbs = B_FALSE; 1147 uint8_t rate; 1148 uint16_t algo; /* authentication algorithm */ 1149 uint16_t seq; /* sequence no */ 1150 uint16_t status; 1151 uint16_t capinfo; 1152 uint16_t associd; /* association ID */ 1153 const struct ieee80211_action *ia; 1154 1155 IEEE80211_LOCK(ic); 1156 wh = (struct ieee80211_frame *)mp->b_rptr; 1157 frm = (uint8_t *)&wh[1]; 1158 efrm = (uint8_t *)mp->b_wptr; 1159 switch (subtype) { 1160 case IEEE80211_FC0_SUBTYPE_PROBE_RESP: 1161 case IEEE80211_FC0_SUBTYPE_BEACON: 1162 ieee80211_recv_beacon(ic, mp, in, subtype, rssi, rstamp); 1163 break; 1164 1165 case IEEE80211_FC0_SUBTYPE_PROBE_REQ: 1166 if (ic->ic_opmode == IEEE80211_M_STA || 1167 ic->ic_state != IEEE80211_S_RUN || 1168 IEEE80211_IS_MULTICAST(wh->i_addr2)) { 1169 break; 1170 } 1171 1172 /* 1173 * prreq frame format 1174 * [tlv] ssid 1175 * [tlv] supported rates 1176 * [tlv] extended supported rates 1177 */ 1178 ssid = rates = xrates = NULL; 1179 while (frm < efrm) { 1180 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1181 frm[1], goto out); 1182 switch (*frm) { 1183 case IEEE80211_ELEMID_SSID: 1184 ssid = frm; 1185 break; 1186 case IEEE80211_ELEMID_RATES: 1187 rates = frm; 1188 break; 1189 case IEEE80211_ELEMID_XRATES: 1190 xrates = frm; 1191 break; 1192 } 1193 frm += frm[1] + 2; 1194 } 1195 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break); 1196 if (xrates != NULL) { 1197 IEEE80211_VERIFY_ELEMENT(xrates, 1198 IEEE80211_RATE_MAXSIZE - rates[1], break); 1199 } 1200 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, break); 1201 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, break); 1202 if (ic->ic_flags & IEEE80211_F_HIDESSID) { 1203 if (ssid == NULL || ssid[1] == 0) { 1204 ieee80211_dbg(IEEE80211_MSG_INPUT, 1205 "ieee80211_recv_mgmt: ignore %s, " 1206 "no ssid with ssid suppression enabled", 1207 IEEE80211_SUBTYPE_NAME(subtype)); 1208 break; 1209 } 1210 } 1211 1212 if (in == ic->ic_bss) { 1213 if (ic->ic_opmode != IEEE80211_M_IBSS) { 1214 in = ieee80211_tmp_node(ic, wh->i_addr2); 1215 allocbs = B_TRUE; 1216 } else if (!IEEE80211_ADDR_EQ(wh->i_addr2, 1217 in->in_macaddr)) { 1218 /* 1219 * Cannot tell if the sender is operating 1220 * in ibss mode. But we need a new node to 1221 * send the response so blindly add them to the 1222 * neighbor table. 1223 */ 1224 in = ieee80211_fakeup_adhoc_node(&ic->ic_sta, 1225 wh->i_addr2); 1226 } 1227 if (in == NULL) 1228 break; 1229 } 1230 ieee80211_dbg(IEEE80211_MSG_ASSOC, "ieee80211_recv_mgmt: " 1231 "[%s] recv probe req\n", 1232 ieee80211_macaddr_sprintf(wh->i_addr2)); 1233 in->in_rssi = (uint8_t)rssi; 1234 in->in_rstamp = rstamp; 1235 /* 1236 * Adjust and check station's rate list with device's 1237 * supported rate. Send back response if there is at 1238 * least one rate or the fixed rate(if being set) is 1239 * supported by both station and the device 1240 */ 1241 rate = ieee80211_setup_rates(in, rates, xrates, 1242 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 1243 IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 1244 if (rate & IEEE80211_RATE_BASIC) { 1245 ieee80211_dbg(IEEE80211_MSG_XRATE, "ieee80211_recv_mgmt" 1246 "%s recv'd rate set invalid", 1247 IEEE80211_SUBTYPE_NAME(subtype)); 1248 } else { 1249 IEEE80211_UNLOCK(ic); 1250 IEEE80211_SEND_MGMT(ic, in, 1251 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0); 1252 IEEE80211_LOCK(ic); 1253 } 1254 if (allocbs) { 1255 /* 1256 * Temporary node created just to send a 1257 * response, reclaim immediately. 1258 */ 1259 ieee80211_free_node(in); 1260 } 1261 break; 1262 1263 case IEEE80211_FC0_SUBTYPE_AUTH: 1264 /* 1265 * auth frame format 1266 * [2] algorithm 1267 * [2] sequence 1268 * [2] status 1269 * [tlv*] challenge 1270 */ 1271 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1272 IEEE80211_AUTH_ELEM_MIN, break); 1273 algo = LE_16(*(uint16_t *)frm); 1274 seq = LE_16(*(uint16_t *)(frm + 2)); 1275 status = LE_16(*(uint16_t *)(frm + 4)); 1276 ieee80211_dbg(IEEE80211_MSG_AUTH, "ieee80211_recv_mgmt: " 1277 "[%s] recv auth frame with algorithm %d seq %d\n", 1278 ieee80211_macaddr_sprintf(wh->i_addr2), algo, seq); 1279 1280 if (ic->ic_flags & IEEE80211_F_COUNTERM) { 1281 ieee80211_dbg(IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO, 1282 "ieee80211_recv_mgmt: ignore auth, %s\n", 1283 "TKIP countermeasures enabled"); 1284 break; 1285 } 1286 switch (algo) { 1287 case IEEE80211_AUTH_ALG_SHARED: 1288 ieee80211_auth_shared(ic, wh, frm + 6, efrm, in, 1289 seq, status); 1290 break; 1291 case IEEE80211_AUTH_ALG_OPEN: 1292 ieee80211_auth_open(ic, wh, in, seq, status); 1293 break; 1294 default: 1295 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: " 1296 "ignore auth, unsupported alg %d", algo); 1297 break; 1298 } 1299 break; 1300 1301 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP: 1302 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: 1303 if (ic->ic_opmode != IEEE80211_M_STA || 1304 ic->ic_state != IEEE80211_S_ASSOC) 1305 break; 1306 1307 /* 1308 * asresp frame format 1309 * [2] capability information 1310 * [2] status 1311 * [2] association ID 1312 * [tlv] supported rates 1313 * [tlv] extended supported rates 1314 * [tlv] WME 1315 * [tlv] HT capabilities 1316 * [tlv] HT info 1317 */ 1318 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1319 IEEE80211_ASSOC_RESP_ELEM_MIN, break); 1320 in = ic->ic_bss; 1321 capinfo = LE_16(*(uint16_t *)frm); 1322 frm += 2; 1323 status = LE_16(*(uint16_t *)frm); 1324 frm += 2; 1325 if (status != 0) { 1326 ieee80211_dbg(IEEE80211_MSG_ASSOC, 1327 "assoc failed (reason %d)\n", status); 1328 in = ieee80211_find_node(&ic->ic_scan, wh->i_addr2); 1329 if (in != NULL) { 1330 in->in_fails++; 1331 ieee80211_free_node(in); 1332 } 1333 break; 1334 } 1335 associd = LE_16(*(uint16_t *)frm); 1336 frm += 2; 1337 1338 rates = xrates = wme = htcap = htinfo = NULL; 1339 while (frm < efrm) { 1340 /* 1341 * Do not discard frames containing proprietary Agere 1342 * elements 128 and 129, as the reported element length 1343 * is often wrong. Skip rest of the frame, since we can 1344 * not rely on the given element length making it 1345 * impossible to know where the next element starts 1346 */ 1347 if ((*frm == IEEE80211_ELEMID_AGERE1) || 1348 (*frm == IEEE80211_ELEMID_AGERE2)) { 1349 frm = efrm; 1350 break; 1351 } 1352 1353 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1354 frm[1], goto out); 1355 switch (*frm) { 1356 case IEEE80211_ELEMID_RATES: 1357 rates = frm; 1358 break; 1359 case IEEE80211_ELEMID_XRATES: 1360 xrates = frm; 1361 break; 1362 case IEEE80211_ELEMID_HTCAP: 1363 htcap = frm; 1364 break; 1365 case IEEE80211_ELEMID_HTINFO: 1366 htinfo = frm; 1367 break; 1368 case IEEE80211_ELEMID_VENDOR: 1369 if (iswmeoui(frm)) 1370 wme = frm; 1371 else if (ic->ic_flags_ext & 1372 IEEE80211_FEXT_HTCOMPAT) { 1373 /* 1374 * Accept pre-draft HT ie's if the 1375 * standard ones have not been seen. 1376 */ 1377 if (ishtcapoui(frm)) { 1378 if (htcap == NULL) 1379 htcap = frm; 1380 } else if (ishtinfooui(frm)) { 1381 if (htinfo == NULL) 1382 htinfo = frm; 1383 } 1384 } 1385 break; 1386 } 1387 frm += frm[1] + 2; 1388 } 1389 1390 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, break); 1391 /* 1392 * Adjust and check AP's rate list with device's 1393 * supported rate. Re-start scan if no rate is or the 1394 * fixed rate(if being set) cannot be supported by 1395 * either AP or the device. 1396 */ 1397 rate = ieee80211_setup_rates(in, rates, xrates, 1398 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | 1399 IEEE80211_F_DONEGO | IEEE80211_F_DODEL); 1400 if (rate & IEEE80211_RATE_BASIC) { 1401 ieee80211_dbg(IEEE80211_MSG_ASSOC, 1402 "assoc failed (rate set mismatch)\n"); 1403 if (in != ic->ic_bss) 1404 in->in_fails++; 1405 IEEE80211_UNLOCK(ic); 1406 ieee80211_new_state(ic, IEEE80211_S_SCAN, 0); 1407 return; 1408 } 1409 1410 in->in_capinfo = capinfo; 1411 in->in_associd = associd; 1412 if (wme != NULL && 1413 ieee80211_parse_wmeparams(ic, wme, wh) >= 0) { 1414 in->in_flags |= IEEE80211_NODE_QOS; 1415 ieee80211_wme_updateparams(ic); 1416 } else { 1417 in->in_flags &= ~IEEE80211_NODE_QOS; 1418 } 1419 /* 1420 * Setup HT state according to the negotiation. 1421 */ 1422 if ((ic->ic_htcaps & IEEE80211_HTC_HT) && 1423 htcap != NULL && htinfo != NULL) { 1424 ieee80211_ht_node_init(in, htcap); 1425 ieee80211_parse_htinfo(in, htinfo); 1426 (void) ieee80211_setup_htrates(in, 1427 htcap, IEEE80211_F_JOIN | IEEE80211_F_DOBRS); 1428 ieee80211_setup_basic_htrates(in, htinfo); 1429 if (in->in_chan != ic->ic_curchan) { 1430 /* 1431 * Channel has been adjusted based on 1432 * negotiated HT parameters; force the 1433 * channel state to follow. 1434 */ 1435 ieee80211_setcurchan(ic, in->in_chan); 1436 } 1437 } 1438 /* 1439 * Configure state now that we are associated. 1440 */ 1441 if (ic->ic_curmode == IEEE80211_MODE_11A || 1442 (in->in_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) { 1443 ic->ic_flags |= IEEE80211_F_SHPREAMBLE; 1444 ic->ic_flags &= ~IEEE80211_F_USEBARKER; 1445 } else { 1446 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE; 1447 ic->ic_flags |= IEEE80211_F_USEBARKER; 1448 } 1449 ieee80211_set_shortslottime(ic, 1450 ic->ic_curmode == IEEE80211_MODE_11A || 1451 (in->in_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME)); 1452 /* 1453 * Honor ERP protection. 1454 * 1455 * NB: in_erp should zero for non-11g operation. 1456 * check ic_curmode anyway 1457 */ 1458 if (ic->ic_curmode == IEEE80211_MODE_11G && 1459 (in->in_erp & IEEE80211_ERP_USE_PROTECTION)) 1460 ic->ic_flags |= IEEE80211_F_USEPROT; 1461 else 1462 ic->ic_flags &= ~IEEE80211_F_USEPROT; 1463 ieee80211_dbg(IEEE80211_MSG_ASSOC, 1464 "assoc success: %s preamble, %s slot time%s%s\n", 1465 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long", 1466 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long", 1467 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "", 1468 in->in_flags & IEEE80211_NODE_QOS ? ", QoS" : ""); 1469 IEEE80211_UNLOCK(ic); 1470 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype); 1471 return; 1472 1473 case IEEE80211_FC0_SUBTYPE_DEAUTH: 1474 if (ic->ic_state == IEEE80211_S_SCAN) 1475 break; 1476 1477 /* 1478 * deauth frame format 1479 * [2] reason 1480 */ 1481 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break); 1482 status = LE_16(*(uint16_t *)frm); 1483 1484 ieee80211_dbg(IEEE80211_MSG_AUTH, 1485 "recv deauthenticate (reason %d)\n", status); 1486 switch (ic->ic_opmode) { 1487 case IEEE80211_M_STA: 1488 IEEE80211_UNLOCK(ic); 1489 ieee80211_new_state(ic, IEEE80211_S_AUTH, 1490 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 1491 return; 1492 default: 1493 break; 1494 } 1495 break; 1496 1497 case IEEE80211_FC0_SUBTYPE_DISASSOC: 1498 if (ic->ic_state != IEEE80211_S_RUN && 1499 ic->ic_state != IEEE80211_S_ASSOC && 1500 ic->ic_state != IEEE80211_S_AUTH) 1501 break; 1502 /* 1503 * disassoc frame format 1504 * [2] reason 1505 */ 1506 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 2, break); 1507 status = LE_16(*(uint16_t *)frm); 1508 1509 ieee80211_dbg(IEEE80211_MSG_ASSOC, 1510 "recv disassociate (reason %d)\n", status); 1511 switch (ic->ic_opmode) { 1512 case IEEE80211_M_STA: 1513 IEEE80211_UNLOCK(ic); 1514 ieee80211_new_state(ic, IEEE80211_S_ASSOC, 1515 wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK); 1516 return; 1517 default: 1518 break; 1519 } 1520 break; 1521 1522 case IEEE80211_FC0_SUBTYPE_ACTION: 1523 if (ic->ic_state != IEEE80211_S_RUN && 1524 ic->ic_state != IEEE80211_S_ASSOC && 1525 ic->ic_state != IEEE80211_S_AUTH) 1526 break; 1527 1528 /* 1529 * action frame format: 1530 * [1] category 1531 * [1] action 1532 * [tlv] parameters 1533 */ 1534 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1535 sizeof (struct ieee80211_action), break); 1536 ia = (const struct ieee80211_action *) frm; 1537 1538 /* verify frame payloads but defer processing */ 1539 /* maybe push this to method */ 1540 switch (ia->ia_category) { 1541 case IEEE80211_ACTION_CAT_BA: 1542 switch (ia->ia_action) { 1543 case IEEE80211_ACTION_BA_ADDBA_REQUEST: 1544 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1545 sizeof (struct ieee80211_action_ba_addbarequest), 1546 break); 1547 break; 1548 case IEEE80211_ACTION_BA_ADDBA_RESPONSE: 1549 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1550 sizeof (struct ieee80211_action_ba_addbaresponse), 1551 break); 1552 break; 1553 case IEEE80211_ACTION_BA_DELBA: 1554 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1555 sizeof (struct ieee80211_action_ba_delba), 1556 break); 1557 break; 1558 } 1559 break; 1560 case IEEE80211_ACTION_CAT_HT: 1561 switch (ia->ia_action) { 1562 case IEEE80211_ACTION_HT_TXCHWIDTH: 1563 IEEE80211_VERIFY_LENGTH(_PTRDIFF(efrm, frm), 1564 sizeof (struct ieee80211_action_ht_txchwidth), 1565 break); 1566 break; 1567 } 1568 break; 1569 } 1570 ic->ic_recv_action(in, frm, efrm); 1571 break; 1572 1573 default: 1574 ieee80211_dbg(IEEE80211_MSG_ANY, "ieee80211_recv_mgmt: " 1575 "subtype 0x%x not handled\n", subtype); 1576 break; 1577 } /* switch subtype */ 1578 out: 1579 IEEE80211_UNLOCK(ic); 1580 } 1581