sys/net80211/ieee80211_adhoc.c

   1 /*-
   2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include <sys/cdefs.h>
  27 #ifdef __FreeBSD__
  28 __FBSDID("$FreeBSD$");
  29 #endif
  30
  31 /*
  32  * IEEE 802.11 IBSS mode support.
  33  */
  34 #include "opt_inet.h"
  35 #include "opt_wlan.h"
  36
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/mbuf.h>
  40 #include <sys/malloc.h>
  41 #include <sys/kernel.h>
  42
  43 #include <sys/socket.h>
  44 #include <sys/sockio.h>
  45 #include <sys/endian.h>
  46 #include <sys/errno.h>
  47 #include <sys/proc.h>
  48 #include <sys/sysctl.h>
  49
  50 #include <net/if.h>
  51 #include <net/if_media.h>
  52 #include <net/if_llc.h>
  53 #include <net/ethernet.h>
  54
  55 #include <net/bpf.h>
  56
  57 #include <net80211/ieee80211_var.h>
  58 #include <net80211/ieee80211_adhoc.h>
  59 #include <net80211/ieee80211_input.h>
  60
  61 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
  62
  63 static  void adhoc_vattach(struct ieee80211vap *);
  64 static  int adhoc_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  65 static int adhoc_input(struct ieee80211_node *, struct mbuf *,
  66         int rssi, int noise, uint32_t rstamp);
  67 static void adhoc_recv_mgmt(struct ieee80211_node *, struct mbuf *,
  68         int subtype, int rssi, int noise, uint32_t rstamp);
  69
  70 void
  71 ieee80211_adhoc_attach(struct ieee80211com *ic)
  72 {
  73         ic->ic_vattach[IEEE80211_M_IBSS] = adhoc_vattach;
  74         ic->ic_vattach[IEEE80211_M_AHDEMO] = adhoc_vattach;
  75 }
  76
  77 void
  78 ieee80211_adhoc_detach(struct ieee80211com *ic)
  79 {
  80 }
  81
  82 static void
  83 adhoc_vdetach(struct ieee80211vap *vap)
  84 {
  85 }
  86
  87 static void
  88 adhoc_vattach(struct ieee80211vap *vap)
  89 {
  90         vap->iv_newstate = adhoc_newstate;
  91         vap->iv_input = adhoc_input;
  92         vap->iv_recv_mgmt = adhoc_recv_mgmt;
  93         vap->iv_opdetach = adhoc_vdetach;
  94 }
  95
  96 /*
  97  * IEEE80211_M_IBSS+IEEE80211_M_AHDEMO vap state machine handler.
  98  */
  99 static int
 100 adhoc_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 101 {
 102 #ifdef IEEE80211_DEBUG
 103         struct ieee80211com *ic = vap->iv_ic;
 104 #endif
 105         struct ieee80211_node *ni;
 106         enum ieee80211_state ostate;
 107
 108         IEEE80211_LOCK_ASSERT(vap->iv_ic);
 109
 110         ostate = vap->iv_state;
 111         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
 112             __func__, ieee80211_state_name[ostate],
 113             ieee80211_state_name[nstate], arg);
 114         vap->iv_state = nstate;                 /* state transition */
 115         if (ostate != IEEE80211_S_SCAN)
 116                 ieee80211_cancel_scan(vap);     /* background scan */
 117         ni = vap->iv_bss;                       /* NB: no reference held */
 118         switch (nstate) {
 119         case IEEE80211_S_INIT:
 120                 switch (ostate) {
 121                 case IEEE80211_S_SCAN:
 122                         ieee80211_cancel_scan(vap);
 123                         break;
 124                 default:
 125                         break;
 126                 }
 127                 if (ostate != IEEE80211_S_INIT) {
 128                         /* NB: optimize INIT -> INIT case */
 129                         ieee80211_reset_bss(vap);
 130                 }
 131                 break;
 132         case IEEE80211_S_SCAN:
 133                 switch (ostate) {
 134                 case IEEE80211_S_INIT:
 135                 case IEEE80211_S_RUN:           /* beacon miss */
 136                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
 137                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
 138                                 /*
 139                                  * Already have a channel; bypass the
 140                                  * scan and startup immediately.
 141                                  */
 142                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
 143                                 break;
 144                         }
 145                         /*
 146                          * Initiate a scan.  We can come here as a result
 147                          * of an IEEE80211_IOC_SCAN_REQ too in which case
 148                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
 149                          * and the scan request parameters will be present
 150                          * in iv_scanreq.  Otherwise we do the default.
 151                          */
 152                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
 153                                 ieee80211_check_scan(vap,
 154                                     vap->iv_scanreq_flags,
 155                                     vap->iv_scanreq_duration,
 156                                     vap->iv_scanreq_mindwell,
 157                                     vap->iv_scanreq_maxdwell,
 158                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
 159                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
 160                         } else
 161                                 ieee80211_check_scan_current(vap);
 162                         break;
 163                 case IEEE80211_S_SCAN:
 164                         /*
 165                          * This can happen because of a change in state
 166                          * that requires a reset.  Trigger a new scan
 167                          * unless we're in manual roaming mode in which
 168                          * case an application must issue an explicit request.
 169                          */
 170                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
 171                                 ieee80211_check_scan_current(vap);
 172                         break;
 173                 default:
 174                         goto invalid;
 175                 }
 176                 break;
 177         case IEEE80211_S_RUN:
 178                 if (vap->iv_flags & IEEE80211_F_WPA) {
 179                         /* XXX validate prerequisites */
 180                 }
 181                 switch (ostate) {
 182                 case IEEE80211_S_SCAN:
 183 #ifdef IEEE80211_DEBUG
 184                         if (ieee80211_msg_debug(vap)) {
 185                                 ieee80211_note(vap,
 186                                     "synchronized with %s ssid ",
 187                                     ether_sprintf(ni->ni_bssid));
 188                                 ieee80211_print_essid(vap->iv_bss->ni_essid,
 189                                     ni->ni_esslen);
 190                                 /* XXX MCS/HT */
 191                                 printf(" channel %d start %uMb\n",
 192                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
 193                                     IEEE80211_RATE2MBS(ni->ni_txrate));
 194                         }
 195 #endif
 196                         break;
 197                 default:
 198                         goto invalid;
 199                 }
 200                 /*
 201                  * When 802.1x is not in use mark the port authorized
 202                  * at this point so traffic can flow.
 203                  */
 204                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 205                         ieee80211_node_authorize(ni);
 206                 break;
 207         case IEEE80211_S_SLEEP:
 208                 ieee80211_sta_pwrsave(vap, 0);
 209                 break;
 210         default:
 211         invalid:
 212                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
 213                     "%s: invalid state transition %s -> %s\n", __func__,
 214                     ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
 215                 break;
 216         }
 217         return 0;
 218 }
 219
 220 /*
 221  * Decide if a received management frame should be
 222  * printed when debugging is enabled.  This filters some
 223  * of the less interesting frames that come frequently
 224  * (e.g. beacons).
 225  */
 226 static __inline int
 227 doprint(struct ieee80211vap *vap, int subtype)
 228 {
 229         switch (subtype) {
 230         case IEEE80211_FC0_SUBTYPE_BEACON:
 231                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
 232         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 233                 return 1;
 234         }
 235         return 1;
 236 }
 237
 238 /*
 239  * Process a received frame.  The node associated with the sender
 240  * should be supplied.  If nothing was found in the node table then
 241  * the caller is assumed to supply a reference to iv_bss instead.
 242  * The RSSI and a timestamp are also supplied.  The RSSI data is used
 243  * during AP scanning to select a AP to associate with; it can have
 244  * any units so long as values have consistent units and higher values
 245  * mean ``better signal''.  The receive timestamp is currently not used
 246  * by the 802.11 layer.
 247  */
 248 static int
 249 adhoc_input(struct ieee80211_node *ni, struct mbuf *m,
 250         int rssi, int noise, uint32_t rstamp)
 251 {
 252 #define SEQ_LEQ(a,b)    ((int)((a)-(b)) <= 0)
 253 #define HAS_SEQ(type)   ((type & 0x4) == 0)
 254         struct ieee80211vap *vap = ni->ni_vap;
 255         struct ieee80211com *ic = ni->ni_ic;
 256         struct ifnet *ifp = vap->iv_ifp;
 257         struct ieee80211_frame *wh;
 258         struct ieee80211_key *key;
 259         struct ether_header *eh;
 260         int hdrspace, need_tap;
 261         uint8_t dir, type, subtype, qos;
 262         uint8_t *bssid;
 263         uint16_t rxseq;
 264
 265         if (m->m_flags & M_AMPDU_MPDU) {
 266                 /*
 267                  * Fastpath for A-MPDU reorder q resubmission.  Frames
 268                  * w/ M_AMPDU_MPDU marked have already passed through
 269                  * here but were received out of order and been held on
 270                  * the reorder queue.  When resubmitted they are marked
 271                  * with the M_AMPDU_MPDU flag and we can bypass most of
 272                  * the normal processing.
 273                  */
 274                 wh = mtod(m, struct ieee80211_frame *);
 275                 type = IEEE80211_FC0_TYPE_DATA;
 276                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 277                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
 278                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
 279                 goto resubmit_ampdu;
 280         }
 281
 282         KASSERT(ni != NULL, ("null node"));
 283         ni->ni_inact = ni->ni_inact_reload;
 284
 285         need_tap = 1;                   /* mbuf need to be tapped. */
 286         type = -1;                      /* undefined */
 287
 288         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
 289                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 290                     ni->ni_macaddr, NULL,
 291                     "too short (1): len %u", m->m_pkthdr.len);
 292                 vap->iv_stats.is_rx_tooshort++;
 293                 goto out;
 294         }
 295         /*
 296          * Bit of a cheat here, we use a pointer for a 3-address
 297          * frame format but don't reference fields past outside
 298          * ieee80211_frame_min w/o first validating the data is
 299          * present.
 300          */
 301         wh = mtod(m, struct ieee80211_frame *);
 302
 303         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
 304             IEEE80211_FC0_VERSION_0) {
 305                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 306                     ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
 307                 vap->iv_stats.is_rx_badversion++;
 308                 goto err;
 309         }
 310
 311         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 312         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 313         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 314         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 315                 if (dir != IEEE80211_FC1_DIR_NODS)
 316                         bssid = wh->i_addr1;
 317                 else if (type == IEEE80211_FC0_TYPE_CTL)
 318                         bssid = wh->i_addr1;
 319                 else {
 320                         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 321                                 IEEE80211_DISCARD_MAC(vap,
 322                                     IEEE80211_MSG_ANY, ni->ni_macaddr,
 323                                     NULL, "too short (2): len %u",
 324                                     m->m_pkthdr.len);
 325                                 vap->iv_stats.is_rx_tooshort++;
 326                                 goto out;
 327                         }
 328                         bssid = wh->i_addr3;
 329                 }
 330                 /*
 331                  * Validate the bssid.
 332                  */
 333                 if (!IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
 334                     !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
 335                         /* not interested in */
 336                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 337                             bssid, NULL, "%s", "not to bss");
 338                         vap->iv_stats.is_rx_wrongbss++;
 339                         goto out;
 340                 }
 341                 /*
 342                  * Data frame, cons up a node when it doesn't
 343                  * exist. This should probably done after an ACL check.
 344                  */
 345                 if (type == IEEE80211_FC0_TYPE_DATA &&
 346                     ni == vap->iv_bss &&
 347                     !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
 348                         /*
 349                          * Fake up a node for this newly
 350                          * discovered member of the IBSS.
 351                          */
 352                         ni = ieee80211_fakeup_adhoc_node(vap, wh->i_addr2);
 353                         if (ni == NULL) {
 354                                 /* NB: stat kept for alloc failure */
 355                                 goto err;
 356                         }
 357                 }
 358                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
 359                 ni->ni_noise = noise;
 360                 ni->ni_rstamp = rstamp;
 361                 if (HAS_SEQ(type)) {
 362                         uint8_t tid = ieee80211_gettid(wh);
 363                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
 364                             TID_TO_WME_AC(tid) >= WME_AC_VI)
 365                                 ic->ic_wme.wme_hipri_traffic++;
 366                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
 367                         if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
 368                             (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
 369                             SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
 370                                 /* duplicate, discard */
 371                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 372                                     bssid, "duplicate",
 373                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
 374                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
 375                                     ni->ni_rxseqs[tid] >>
 376                                         IEEE80211_SEQ_SEQ_SHIFT,
 377                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
 378                                     ni->ni_rxseqs[tid] &
 379                                         IEEE80211_SEQ_FRAG_MASK,
 380                                     tid);
 381                                 vap->iv_stats.is_rx_dup++;
 382                                 IEEE80211_NODE_STAT(ni, rx_dup);
 383                                 goto out;
 384                         }
 385                         ni->ni_rxseqs[tid] = rxseq;
 386                 }
 387         }
 388
 389         switch (type) {
 390         case IEEE80211_FC0_TYPE_DATA:
 391                 hdrspace = ieee80211_hdrspace(ic, wh);
 392                 if (m->m_len < hdrspace &&
 393                     (m = m_pullup(m, hdrspace)) == NULL) {
 394                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 395                             ni->ni_macaddr, NULL,
 396                             "data too short: expecting %u", hdrspace);
 397                         vap->iv_stats.is_rx_tooshort++;
 398                         goto out;               /* XXX */
 399                 }
 400                 if (dir != IEEE80211_FC1_DIR_NODS) {
 401                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 402                             wh, "data", "incorrect dir 0x%x", dir);
 403                         vap->iv_stats.is_rx_wrongdir++;
 404                         goto out;
 405                 }
 406                 /* XXX no power-save support */
 407
 408                 /*
 409                  * Handle A-MPDU re-ordering.  If the frame is to be
 410                  * processed directly then ieee80211_ampdu_reorder
 411                  * will return 0; otherwise it has consumed the mbuf
 412                  * and we should do nothing more with it.
 413                  */
 414                 if ((m->m_flags & M_AMPDU) &&
 415                     ieee80211_ampdu_reorder(ni, m) != 0) {
 416                         m = NULL;
 417                         goto out;
 418                 }
 419         resubmit_ampdu:
 420
 421                 /*
 422                  * Handle privacy requirements.  Note that we
 423                  * must not be preempted from here until after
 424                  * we (potentially) call ieee80211_crypto_demic;
 425                  * otherwise we may violate assumptions in the
 426                  * crypto cipher modules used to do delayed update
 427                  * of replay sequence numbers.
 428                  */
 429                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 430                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 431                                 /*
 432                                  * Discard encrypted frames when privacy is off.
 433                                  */
 434                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 435                                     wh, "WEP", "%s", "PRIVACY off");
 436                                 vap->iv_stats.is_rx_noprivacy++;
 437                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
 438                                 goto out;
 439                         }
 440                         key = ieee80211_crypto_decap(ni, m, hdrspace);
 441                         if (key == NULL) {
 442                                 /* NB: stats+msgs handled in crypto_decap */
 443                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
 444                                 goto out;
 445                         }
 446                         wh = mtod(m, struct ieee80211_frame *);
 447                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
 448                 } else {
 449                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
 450                         key = NULL;
 451                 }
 452
 453                 /*
 454                  * Save QoS bits for use below--before we strip the header.
 455                  */
 456                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
 457                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
 458                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
 459                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
 460                 } else
 461                         qos = 0;
 462
 463                 /*
 464                  * Next up, any fragmentation.
 465                  */
 466                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 467                         m = ieee80211_defrag(ni, m, hdrspace);
 468                         if (m == NULL) {
 469                                 /* Fragment dropped or frame not complete yet */
 470                                 goto out;
 471                         }
 472                 }
 473                 wh = NULL;              /* no longer valid, catch any uses */
 474
 475                 /*
 476                  * Next strip any MSDU crypto bits.
 477                  */
 478                 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
 479                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 480                             ni->ni_macaddr, "data", "%s", "demic error");
 481                         vap->iv_stats.is_rx_demicfail++;
 482                         IEEE80211_NODE_STAT(ni, rx_demicfail);
 483                         goto out;
 484                 }
 485
 486                 /* copy to listener after decrypt */
 487                 if (bpf_peers_present(vap->iv_rawbpf))
 488                         bpf_mtap(vap->iv_rawbpf, m);
 489                 need_tap = 0;
 490
 491                 /*
 492                  * Finally, strip the 802.11 header.
 493                  */
 494                 m = ieee80211_decap(vap, m, hdrspace);
 495                 if (m == NULL) {
 496                         /* XXX mask bit to check for both */
 497                         /* don't count Null data frames as errors */
 498                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
 499                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
 500                                 goto out;
 501                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 502                             ni->ni_macaddr, "data", "%s", "decap error");
 503                         vap->iv_stats.is_rx_decap++;
 504                         IEEE80211_NODE_STAT(ni, rx_decap);
 505                         goto err;
 506                 }
 507                 eh = mtod(m, struct ether_header *);
 508                 if (!ieee80211_node_is_authorized(ni)) {
 509                         /*
 510                          * Deny any non-PAE frames received prior to
 511                          * authorization.  For open/shared-key
 512                          * authentication the port is mark authorized
 513                          * after authentication completes.  For 802.1x
 514                          * the port is not marked authorized by the
 515                          * authenticator until the handshake has completed.
 516                          */
 517                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
 518                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 519                                     eh->ether_shost, "data",
 520                                     "unauthorized port: ether type 0x%x len %u",
 521                                     eh->ether_type, m->m_pkthdr.len);
 522                                 vap->iv_stats.is_rx_unauth++;
 523                                 IEEE80211_NODE_STAT(ni, rx_unauth);
 524                                 goto err;
 525                         }
 526                 } else {
 527                         /*
 528                          * When denying unencrypted frames, discard
 529                          * any non-PAE frames received without encryption.
 530                          */
 531                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
 532                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
 533                             eh->ether_type != htons(ETHERTYPE_PAE)) {
 534                                 /*
 535                                  * Drop unencrypted frames.
 536                                  */
 537                                 vap->iv_stats.is_rx_unencrypted++;
 538                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
 539                                 goto out;
 540                         }
 541                 }
 542                 /* XXX require HT? */
 543                 if (qos & IEEE80211_QOS_AMSDU) {
 544                         m = ieee80211_decap_amsdu(ni, m);
 545                         if (m == NULL)
 546                                 return IEEE80211_FC0_TYPE_DATA;
 547                 } else if ((ni->ni_ath_flags & IEEE80211_NODE_FF) &&
 548 #define FF_LLC_SIZE     (sizeof(struct ether_header) + sizeof(struct llc))
 549                     m->m_pkthdr.len >= 3*FF_LLC_SIZE) {
 550                         struct llc *llc;
 551
 552                         /*
 553                          * Check for fast-frame tunnel encapsulation.
 554                          */
 555                         if (m->m_len < FF_LLC_SIZE &&
 556                             (m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
 557                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 558                                     ni->ni_macaddr, "fast-frame",
 559                                     "%s", "m_pullup(llc) failed");
 560                                 vap->iv_stats.is_rx_tooshort++;
 561                                 return IEEE80211_FC0_TYPE_DATA;
 562                         }
 563                         llc = (struct llc *)(mtod(m, uint8_t *) +
 564                                 sizeof(struct ether_header));
 565                         if (llc->llc_snap.ether_type == htons(ATH_FF_ETH_TYPE)) {
 566                                 m_adj(m, FF_LLC_SIZE);
 567                                 m = ieee80211_decap_fastframe(ni, m);
 568                                 if (m == NULL)
 569                                         return IEEE80211_FC0_TYPE_DATA;
 570                         }
 571                 }
 572 #undef FF_LLC_SIZE
 573                 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
 574                         ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
 575                 else
 576                         ieee80211_deliver_data(vap, ni, m);
 577                 return IEEE80211_FC0_TYPE_DATA;
 578
 579         case IEEE80211_FC0_TYPE_MGT:
 580                 vap->iv_stats.is_rx_mgmt++;
 581                 IEEE80211_NODE_STAT(ni, rx_mgmt);
 582                 if (dir != IEEE80211_FC1_DIR_NODS) {
 583                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 584                             wh, "data", "incorrect dir 0x%x", dir);
 585                         vap->iv_stats.is_rx_wrongdir++;
 586                         goto err;
 587                 }
 588                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 589                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 590                             ni->ni_macaddr, "mgt", "too short: len %u",
 591                             m->m_pkthdr.len);
 592                         vap->iv_stats.is_rx_tooshort++;
 593                         goto out;
 594                 }
 595 #ifdef IEEE80211_DEBUG
 596                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
 597                     ieee80211_msg_dumppkts(vap)) {
 598                         if_printf(ifp, "received %s from %s rssi %d\n",
 599                             ieee80211_mgt_subtype_name[subtype >>
 600                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 601                             ether_sprintf(wh->i_addr2), rssi);
 602                 }
 603 #endif
 604                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 605                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 606                             wh, NULL, "%s", "WEP set but not permitted");
 607                         vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
 608                         goto out;
 609                 }
 610                 if (bpf_peers_present(vap->iv_rawbpf))
 611                         bpf_mtap(vap->iv_rawbpf, m);
 612                 /* NB: only IBSS mode gets mgt frames */
 613                 if (vap->iv_opmode == IEEE80211_M_IBSS)
 614                         vap->iv_recv_mgmt(ni, m, subtype, rssi, noise, rstamp);
 615                 m_freem(m);
 616                 return IEEE80211_FC0_TYPE_MGT;
 617
 618         case IEEE80211_FC0_TYPE_CTL:
 619                 vap->iv_stats.is_rx_ctl++;
 620                 IEEE80211_NODE_STAT(ni, rx_ctrl);
 621                 goto out;
 622         default:
 623                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 624                     wh, "bad", "frame type 0x%x", type);
 625                 /* should not come here */
 626                 break;
 627         }
 628 err:
 629         ifp->if_ierrors++;
 630 out:
 631         if (m != NULL) {
 632                 if (bpf_peers_present(vap->iv_rawbpf) && need_tap)
 633                         bpf_mtap(vap->iv_rawbpf, m);
 634                 m_freem(m);
 635         }
 636         return type;
 637 #undef SEQ_LEQ
 638 }
 639
 640 static int
 641 is11bclient(const uint8_t *rates, const uint8_t *xrates)
 642 {
 643         static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
 644         int i;
 645
 646         /* NB: the 11b clients we care about will not have xrates */
 647         if (xrates != NULL || rates == NULL)
 648                 return 0;
 649         for (i = 0; i < rates[1]; i++) {
 650                 int r = rates[2+i] & IEEE80211_RATE_VAL;
 651                 if (r > 2*11 || ((1<<r) & brates) == 0)
 652                         return 0;
 653         }
 654         return 1;
 655 }
 656
 657 static void
 658 adhoc_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
 659         int subtype, int rssi, int noise, uint32_t rstamp)
 660 {
 661         struct ieee80211vap *vap = ni->ni_vap;
 662         struct ieee80211com *ic = ni->ni_ic;
 663         struct ieee80211_frame *wh;
 664         uint8_t *frm, *efrm, *sfrm;
 665         uint8_t *ssid, *rates, *xrates;
 666
 667         wh = mtod(m0, struct ieee80211_frame *);
 668         frm = (uint8_t *)&wh[1];
 669         efrm = mtod(m0, uint8_t *) + m0->m_len;
 670         switch (subtype) {
 671         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
 672         case IEEE80211_FC0_SUBTYPE_BEACON: {
 673                 struct ieee80211_scanparams scan;
 674                 /*
 675                  * We process beacon/probe response
 676                  * frames to discover neighbors.
 677                  */
 678                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
 679                         return;
 680                 /*
 681                  * Count frame now that we know it's to be processed.
 682                  */
 683                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
 684                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
 685                         IEEE80211_NODE_STAT(ni, rx_beacons);
 686                 } else
 687                         IEEE80211_NODE_STAT(ni, rx_proberesp);
 688                 /*
 689                  * If scanning, just pass information to the scan module.
 690                  */
 691                 if (ic->ic_flags & IEEE80211_F_SCAN) {
 692                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
 693                                 /*
 694                                  * Actively scanning a channel marked passive;
 695                                  * send a probe request now that we know there
 696                                  * is 802.11 traffic present.
 697                                  *
 698                                  * XXX check if the beacon we recv'd gives
 699                                  * us what we need and suppress the probe req
 700                                  */
 701                                 ieee80211_probe_curchan(vap, 1);
 702                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
 703                         }
 704                         ieee80211_add_scan(vap, &scan, wh,
 705                                 subtype, rssi, noise, rstamp);
 706                         return;
 707                 }
 708                 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
 709                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
 710                                 /*
 711                                  * Create a new entry in the neighbor table.
 712                                  */
 713                                 ni = ieee80211_add_neighbor(vap, wh, &scan);
 714                         } else if (ni->ni_capinfo == 0) {
 715                                 /*
 716                                  * Update faked node created on transmit.
 717                                  * Note this also updates the tsf.
 718                                  */
 719                                 ieee80211_init_neighbor(ni, wh, &scan);
 720                         } else {
 721                                 /*
 722                                  * Record tsf for potential resync.
 723                                  */
 724                                 memcpy(ni->ni_tstamp.data, scan.tstamp,
 725                                         sizeof(ni->ni_tstamp));
 726                         }
 727                         if (ni != NULL) {
 728                                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
 729                                 ni->ni_noise = noise;
 730                                 ni->ni_rstamp = rstamp;
 731                         }
 732                 }
 733                 break;
 734         }
 735
 736         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 737                 if (vap->iv_state != IEEE80211_S_RUN) {
 738                         vap->iv_stats.is_rx_mgtdiscard++;
 739                         return;
 740                 }
 741                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
 742                         /* frame must be directed */
 743                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
 744                         return;
 745                 }
 746
 747                 /*
 748                  * prreq frame format
 749                  *      [tlv] ssid
 750                  *      [tlv] supported rates
 751                  *      [tlv] extended supported rates
 752                  */
 753                 ssid = rates = xrates = NULL;
 754                 sfrm = frm;
 755                 while (efrm - frm > 1) {
 756                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
 757                         switch (*frm) {
 758                         case IEEE80211_ELEMID_SSID:
 759                                 ssid = frm;
 760                                 break;
 761                         case IEEE80211_ELEMID_RATES:
 762                                 rates = frm;
 763                                 break;
 764                         case IEEE80211_ELEMID_XRATES:
 765                                 xrates = frm;
 766                                 break;
 767                         }
 768                         frm += frm[1] + 2;
 769                 }
 770                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
 771                 if (xrates != NULL)
 772                         IEEE80211_VERIFY_ELEMENT(xrates,
 773                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
 774                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
 775                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
 776                 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
 777                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 778                             wh, NULL,
 779                             "%s", "no ssid with ssid suppression enabled");
 780                         vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
 781                         return;
 782                 }
 783
 784                 /* XXX find a better class or define it's own */
 785                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
 786                     "%s", "recv probe req");
 787                 /*
 788                  * Some legacy 11b clients cannot hack a complete
 789                  * probe response frame.  When the request includes
 790                  * only a bare-bones rate set, communicate this to
 791                  * the transmit side.
 792                  */
 793                 ieee80211_send_proberesp(vap, wh->i_addr2,
 794                     is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
 795                 break;
 796
 797         case IEEE80211_FC0_SUBTYPE_ACTION: {
 798                 const struct ieee80211_action *ia;
 799
 800                 if (vap->iv_state != IEEE80211_S_RUN) {
 801                         vap->iv_stats.is_rx_mgtdiscard++;
 802                         return;
 803                 }
 804                 /*
 805                  * action frame format:
 806                  *      [1] category
 807                  *      [1] action
 808                  *      [tlv] parameters
 809                  */
 810                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 811                         sizeof(struct ieee80211_action), return);
 812                 ia = (const struct ieee80211_action *) frm;
 813
 814                 vap->iv_stats.is_rx_action++;
 815                 IEEE80211_NODE_STAT(ni, rx_action);
 816
 817                 /* verify frame payloads but defer processing */
 818                 /* XXX maybe push this to method */
 819                 switch (ia->ia_category) {
 820                 case IEEE80211_ACTION_CAT_BA:
 821                         switch (ia->ia_action) {
 822                         case IEEE80211_ACTION_BA_ADDBA_REQUEST:
 823                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 824                                     sizeof(struct ieee80211_action_ba_addbarequest),
 825                                     return);
 826                                 break;
 827                         case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
 828                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 829                                     sizeof(struct ieee80211_action_ba_addbaresponse),
 830                                     return);
 831                                 break;
 832                         case IEEE80211_ACTION_BA_DELBA:
 833                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 834                                     sizeof(struct ieee80211_action_ba_delba),
 835                                     return);
 836                                 break;
 837                         }
 838                         break;
 839                 case IEEE80211_ACTION_CAT_HT:
 840                         switch (ia->ia_action) {
 841                         case IEEE80211_ACTION_HT_TXCHWIDTH:
 842                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
 843                                     sizeof(struct ieee80211_action_ht_txchwidth),
 844                                     return);
 845                                 break;
 846                         }
 847                         break;
 848                 }
 849                 ic->ic_recv_action(ni, frm, efrm);
 850                 break;
 851         }
 852
 853         case IEEE80211_FC0_SUBTYPE_AUTH:
 854         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
 855         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
 856         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
 857         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
 858         case IEEE80211_FC0_SUBTYPE_DEAUTH:
 859         case IEEE80211_FC0_SUBTYPE_DISASSOC:
 860                 vap->iv_stats.is_rx_mgtdiscard++;
 861                 return;
 862
 863         default:
 864                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 865                      wh, "mgt", "subtype 0x%x not handled", subtype);
 866                 vap->iv_stats.is_rx_badsubtype++;
 867                 break;
 868         }
 869 }
 870 #undef IEEE80211_VERIFY_LENGTH
 871 #undef IEEE80211_VERIFY_ELEMENT