sys/net80211/ieee80211_hostap.c

   1 /*-
   2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include <sys/cdefs.h>
  27 #ifdef __FreeBSD__
  28 __FBSDID("$FreeBSD$");
  29 #endif
  30
  31 /*
  32  * IEEE 802.11 HOSTAP mode support.
  33  */
  34 #include "opt_inet.h"
  35 #include "opt_wlan.h"
  36
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/mbuf.h>
  40 #include <sys/malloc.h>
  41 #include <sys/kernel.h>
  42
  43 #include <sys/socket.h>
  44 #include <sys/sockio.h>
  45 #include <sys/endian.h>
  46 #include <sys/errno.h>
  47 #include <sys/proc.h>
  48 #include <sys/sysctl.h>
  49
  50 #include <net/if.h>
  51 #include <net/if_var.h>
  52 #include <net/if_media.h>
  53 #include <net/if_llc.h>
  54 #include <net/ethernet.h>
  55
  56 #include <net/bpf.h>
  57
  58 #include <net80211/ieee80211_var.h>
  59 #include <net80211/ieee80211_hostap.h>
  60 #include <net80211/ieee80211_input.h>
  61 #ifdef IEEE80211_SUPPORT_SUPERG
  62 #include <net80211/ieee80211_superg.h>
  63 #endif
  64 #include <net80211/ieee80211_wds.h>
  65
  66 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
  67
  68 static  void hostap_vattach(struct ieee80211vap *);
  69 static  int hostap_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  70 static  int hostap_input(struct ieee80211_node *ni, struct mbuf *m,
  71             int rssi, int nf);
  72 static void hostap_deliver_data(struct ieee80211vap *,
  73             struct ieee80211_node *, struct mbuf *);
  74 static void hostap_recv_mgmt(struct ieee80211_node *, struct mbuf *,
  75             int subtype, int rssi, int nf);
  76 static void hostap_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
  77
  78 void
  79 ieee80211_hostap_attach(struct ieee80211com *ic)
  80 {
  81         ic->ic_vattach[IEEE80211_M_HOSTAP] = hostap_vattach;
  82 }
  83
  84 void
  85 ieee80211_hostap_detach(struct ieee80211com *ic)
  86 {
  87 }
  88
  89 static void
  90 hostap_vdetach(struct ieee80211vap *vap)
  91 {
  92 }
  93
  94 static void
  95 hostap_vattach(struct ieee80211vap *vap)
  96 {
  97         vap->iv_newstate = hostap_newstate;
  98         vap->iv_input = hostap_input;
  99         vap->iv_recv_mgmt = hostap_recv_mgmt;
 100         vap->iv_recv_ctl = hostap_recv_ctl;
 101         vap->iv_opdetach = hostap_vdetach;
 102         vap->iv_deliver_data = hostap_deliver_data;
 103         vap->iv_recv_pspoll = ieee80211_recv_pspoll;
 104 }
 105
 106 static void
 107 sta_disassoc(void *arg, struct ieee80211_node *ni)
 108 {
 109         struct ieee80211vap *vap = arg;
 110
 111         if (ni->ni_vap == vap && ni->ni_associd != 0) {
 112                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DISASSOC,
 113                         IEEE80211_REASON_ASSOC_LEAVE);
 114                 ieee80211_node_leave(ni);
 115         }
 116 }
 117
 118 static void
 119 sta_csa(void *arg, struct ieee80211_node *ni)
 120 {
 121         struct ieee80211vap *vap = arg;
 122
 123         if (ni->ni_vap == vap && ni->ni_associd != 0)
 124                 if (ni->ni_inact > vap->iv_inact_init) {
 125                         ni->ni_inact = vap->iv_inact_init;
 126                         IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,
 127                             "%s: inact %u", __func__, ni->ni_inact);
 128                 }
 129 }
 130
 131 static void
 132 sta_drop(void *arg, struct ieee80211_node *ni)
 133 {
 134         struct ieee80211vap *vap = arg;
 135
 136         if (ni->ni_vap == vap && ni->ni_associd != 0)
 137                 ieee80211_node_leave(ni);
 138 }
 139
 140 /*
 141  * Does a channel change require associated stations to re-associate
 142  * so protocol state is correct.  This is used when doing CSA across
 143  * bands or similar (e.g. HT -> legacy).
 144  */
 145 static int
 146 isbandchange(struct ieee80211com *ic)
 147 {
 148         return ((ic->ic_bsschan->ic_flags ^ ic->ic_csa_newchan->ic_flags) &
 149             (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_HALF |
 150              IEEE80211_CHAN_QUARTER | IEEE80211_CHAN_HT)) != 0;
 151 }
 152
 153 /*
 154  * IEEE80211_M_HOSTAP vap state machine handler.
 155  */
 156 static int
 157 hostap_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 158 {
 159         struct ieee80211com *ic = vap->iv_ic;
 160         enum ieee80211_state ostate;
 161
 162         IEEE80211_LOCK_ASSERT(ic);
 163
 164         ostate = vap->iv_state;
 165         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
 166             __func__, ieee80211_state_name[ostate],
 167             ieee80211_state_name[nstate], arg);
 168         vap->iv_state = nstate;                 /* state transition */
 169         if (ostate != IEEE80211_S_SCAN)
 170                 ieee80211_cancel_scan(vap);     /* background scan */
 171         switch (nstate) {
 172         case IEEE80211_S_INIT:
 173                 switch (ostate) {
 174                 case IEEE80211_S_SCAN:
 175                         ieee80211_cancel_scan(vap);
 176                         break;
 177                 case IEEE80211_S_CAC:
 178                         ieee80211_dfs_cac_stop(vap);
 179                         break;
 180                 case IEEE80211_S_RUN:
 181                         ieee80211_iterate_nodes(&ic->ic_sta, sta_disassoc, vap);
 182                         break;
 183                 default:
 184                         break;
 185                 }
 186                 if (ostate != IEEE80211_S_INIT) {
 187                         /* NB: optimize INIT -> INIT case */
 188                         ieee80211_reset_bss(vap);
 189                 }
 190                 if (vap->iv_auth->ia_detach != NULL)
 191                         vap->iv_auth->ia_detach(vap);
 192                 break;
 193         case IEEE80211_S_SCAN:
 194                 switch (ostate) {
 195                 case IEEE80211_S_CSA:
 196                 case IEEE80211_S_RUN:
 197                         ieee80211_iterate_nodes(&ic->ic_sta, sta_disassoc, vap);
 198                         /*
 199                          * Clear overlapping BSS state; the beacon frame
 200                          * will be reconstructed on transition to the RUN
 201                          * state and the timeout routines check if the flag
 202                          * is set before doing anything so this is sufficient.
 203                          */
 204                         ic->ic_flags_ext &= ~IEEE80211_FEXT_NONERP_PR;
 205                         ic->ic_flags_ht &= ~IEEE80211_FHT_NONHT_PR;
 206                         /* fall thru... */
 207                 case IEEE80211_S_CAC:
 208                         /*
 209                          * NB: We may get here because of a manual channel
 210                          *     change in which case we need to stop CAC
 211                          * XXX no need to stop if ostate RUN but it's ok
 212                          */
 213                         ieee80211_dfs_cac_stop(vap);
 214                         /* fall thru... */
 215                 case IEEE80211_S_INIT:
 216                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
 217                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
 218                                 /*
 219                                  * Already have a channel; bypass the
 220                                  * scan and startup immediately.
 221                                  * ieee80211_create_ibss will call back to
 222                                  * move us to RUN state.
 223                                  */
 224                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
 225                                 break;
 226                         }
 227                         /*
 228                          * Initiate a scan.  We can come here as a result
 229                          * of an IEEE80211_IOC_SCAN_REQ too in which case
 230                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
 231                          * and the scan request parameters will be present
 232                          * in iv_scanreq.  Otherwise we do the default.
 233                          */
 234                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
 235                                 ieee80211_check_scan(vap,
 236                                     vap->iv_scanreq_flags,
 237                                     vap->iv_scanreq_duration,
 238                                     vap->iv_scanreq_mindwell,
 239                                     vap->iv_scanreq_maxdwell,
 240                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
 241                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
 242                         } else
 243                                 ieee80211_check_scan_current(vap);
 244                         break;
 245                 case IEEE80211_S_SCAN:
 246                         /*
 247                          * A state change requires a reset; scan.
 248                          */
 249                         ieee80211_check_scan_current(vap);
 250                         break;
 251                 default:
 252                         break;
 253                 }
 254                 break;
 255         case IEEE80211_S_CAC:
 256                 /*
 257                  * Start CAC on a DFS channel.  We come here when starting
 258                  * a bss on a DFS channel (see ieee80211_create_ibss).
 259                  */
 260                 ieee80211_dfs_cac_start(vap);
 261                 break;
 262         case IEEE80211_S_RUN:
 263                 if (vap->iv_flags & IEEE80211_F_WPA) {
 264                         /* XXX validate prerequisites */
 265                 }
 266                 switch (ostate) {
 267                 case IEEE80211_S_INIT:
 268                         /*
 269                          * Already have a channel; bypass the
 270                          * scan and startup immediately.
 271                          * Note that ieee80211_create_ibss will call
 272                          * back to do a RUN->RUN state change.
 273                          */
 274                         ieee80211_create_ibss(vap,
 275                             ieee80211_ht_adjust_channel(ic,
 276                                 ic->ic_curchan, vap->iv_flags_ht));
 277                         /* NB: iv_bss is changed on return */
 278                         break;
 279                 case IEEE80211_S_CAC:
 280                         /*
 281                          * NB: This is the normal state change when CAC
 282                          * expires and no radar was detected; no need to
 283                          * clear the CAC timer as it's already expired.
 284                          */
 285                         /* fall thru... */
 286                 case IEEE80211_S_CSA:
 287                         /*
 288                          * Shorten inactivity timer of associated stations
 289                          * to weed out sta's that don't follow a CSA.
 290                          */
 291                         ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
 292                         /*
 293                          * Update bss node channel to reflect where
 294                          * we landed after CSA.
 295                          */
 296                         ieee80211_node_set_chan(vap->iv_bss,
 297                             ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
 298                                 ieee80211_htchanflags(vap->iv_bss->ni_chan)));
 299                         /* XXX bypass debug msgs */
 300                         break;
 301                 case IEEE80211_S_SCAN:
 302                 case IEEE80211_S_RUN:
 303 #ifdef IEEE80211_DEBUG
 304                         if (ieee80211_msg_debug(vap)) {
 305                                 struct ieee80211_node *ni = vap->iv_bss;
 306                                 ieee80211_note(vap,
 307                                     "synchronized with %s ssid ",
 308                                     ether_sprintf(ni->ni_bssid));
 309                                 ieee80211_print_essid(ni->ni_essid,
 310                                     ni->ni_esslen);
 311                                 /* XXX MCS/HT */
 312                                 printf(" channel %d start %uMb\n",
 313                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
 314                                     IEEE80211_RATE2MBS(ni->ni_txrate));
 315                         }
 316 #endif
 317                         break;
 318                 default:
 319                         break;
 320                 }
 321                 /*
 322                  * Start/stop the authenticator.  We delay until here
 323                  * to allow configuration to happen out of order.
 324                  */
 325                 if (vap->iv_auth->ia_attach != NULL) {
 326                         /* XXX check failure */
 327                         vap->iv_auth->ia_attach(vap);
 328                 } else if (vap->iv_auth->ia_detach != NULL) {
 329                         vap->iv_auth->ia_detach(vap);
 330                 }
 331                 ieee80211_node_authorize(vap->iv_bss);
 332                 break;
 333         case IEEE80211_S_CSA:
 334                 if (ostate == IEEE80211_S_RUN && isbandchange(ic)) {
 335                         /*
 336                          * On a ``band change'' silently drop associated
 337                          * stations as they must re-associate before they
 338                          * can pass traffic (as otherwise protocol state
 339                          * such as capabilities and the negotiated rate
 340                          * set may/will be wrong).
 341                          */
 342                         ieee80211_iterate_nodes(&ic->ic_sta, sta_drop, vap);
 343                 }
 344                 break;
 345         default:
 346                 break;
 347         }
 348         return 0;
 349 }
 350
 351 static void
 352 hostap_deliver_data(struct ieee80211vap *vap,
 353         struct ieee80211_node *ni, struct mbuf *m)
 354 {
 355         struct ether_header *eh = mtod(m, struct ether_header *);
 356         struct ifnet *ifp = vap->iv_ifp;
 357
 358         /* clear driver/net80211 flags before passing up */
 359 #if __FreeBSD_version >= 1000046
 360         m->m_flags &= ~(M_MCAST | M_BCAST);
 361         m_clrprotoflags(m);
 362 #else
 363         m->m_flags &= ~(M_80211_RX | M_MCAST | M_BCAST);
 364 #endif
 365
 366         KASSERT(vap->iv_opmode == IEEE80211_M_HOSTAP,
 367             ("gack, opmode %d", vap->iv_opmode));
 368         /*
 369          * Do accounting.
 370          */
 371         if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
 372         IEEE80211_NODE_STAT(ni, rx_data);
 373         IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
 374         if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
 375                 m->m_flags |= M_MCAST;          /* XXX M_BCAST? */
 376                 IEEE80211_NODE_STAT(ni, rx_mcast);
 377         } else
 378                 IEEE80211_NODE_STAT(ni, rx_ucast);
 379
 380         /* perform as a bridge within the AP */
 381         if ((vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0) {
 382                 struct mbuf *mcopy = NULL;
 383
 384                 if (m->m_flags & M_MCAST) {
 385                         mcopy = m_dup(m, M_NOWAIT);
 386                         if (mcopy == NULL)
 387                                 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
 388                         else
 389                                 mcopy->m_flags |= M_MCAST;
 390                 } else {
 391                         /*
 392                          * Check if the destination is associated with the
 393                          * same vap and authorized to receive traffic.
 394                          * Beware of traffic destined for the vap itself;
 395                          * sending it will not work; just let it be delivered
 396                          * normally.
 397                          */
 398                         struct ieee80211_node *sta = ieee80211_find_vap_node(
 399                              &vap->iv_ic->ic_sta, vap, eh->ether_dhost);
 400                         if (sta != NULL) {
 401                                 if (ieee80211_node_is_authorized(sta)) {
 402                                         /*
 403                                          * Beware of sending to ourself; this
 404                                          * needs to happen via the normal
 405                                          * input path.
 406                                          */
 407                                         if (sta != vap->iv_bss) {
 408                                                 mcopy = m;
 409                                                 m = NULL;
 410                                         }
 411                                 } else {
 412                                         vap->iv_stats.is_rx_unauth++;
 413                                         IEEE80211_NODE_STAT(sta, rx_unauth);
 414                                 }
 415                                 ieee80211_free_node(sta);
 416                         }
 417                 }
 418                 if (mcopy != NULL) {
 419                         int len, err;
 420                         len = mcopy->m_pkthdr.len;
 421                         err = ieee80211_vap_xmitpkt(vap, mcopy);
 422                         if (err) {
 423                                 /* NB: IFQ_HANDOFF reclaims mcopy */
 424                         } else {
 425                                 if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
 426                         }
 427                 }
 428         }
 429         if (m != NULL) {
 430                 /*
 431                  * Mark frame as coming from vap's interface.
 432                  */
 433                 m->m_pkthdr.rcvif = ifp;
 434                 if (m->m_flags & M_MCAST) {
 435                         /*
 436                          * Spam DWDS vap's w/ multicast traffic.
 437                          */
 438                         /* XXX only if dwds in use? */
 439                         ieee80211_dwds_mcast(vap, m);
 440                 }
 441                 if (ni->ni_vlan != 0) {
 442                         /* attach vlan tag */
 443                         m->m_pkthdr.ether_vtag = ni->ni_vlan;
 444                         m->m_flags |= M_VLANTAG;
 445                 }
 446                 ifp->if_input(ifp, m);
 447         }
 448 }
 449
 450 /*
 451  * Decide if a received management frame should be
 452  * printed when debugging is enabled.  This filters some
 453  * of the less interesting frames that come frequently
 454  * (e.g. beacons).
 455  */
 456 static __inline int
 457 doprint(struct ieee80211vap *vap, int subtype)
 458 {
 459         switch (subtype) {
 460         case IEEE80211_FC0_SUBTYPE_BEACON:
 461                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
 462         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 463                 return 0;
 464         }
 465         return 1;
 466 }
 467
 468 /*
 469  * Process a received frame.  The node associated with the sender
 470  * should be supplied.  If nothing was found in the node table then
 471  * the caller is assumed to supply a reference to iv_bss instead.
 472  * The RSSI and a timestamp are also supplied.  The RSSI data is used
 473  * during AP scanning to select a AP to associate with; it can have
 474  * any units so long as values have consistent units and higher values
 475  * mean ``better signal''.  The receive timestamp is currently not used
 476  * by the 802.11 layer.
 477  */
 478 static int
 479 hostap_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
 480 {
 481 #define HAS_SEQ(type)   ((type & 0x4) == 0)
 482         struct ieee80211vap *vap = ni->ni_vap;
 483         struct ieee80211com *ic = ni->ni_ic;
 484         struct ifnet *ifp = vap->iv_ifp;
 485         struct ieee80211_frame *wh;
 486         struct ieee80211_key *key;
 487         struct ether_header *eh;
 488         int hdrspace, need_tap = 1;     /* mbuf need to be tapped. */
 489         uint8_t dir, type, subtype, qos;
 490         uint8_t *bssid;
 491         uint16_t rxseq;
 492
 493         if (m->m_flags & M_AMPDU_MPDU) {
 494                 /*
 495                  * Fastpath for A-MPDU reorder q resubmission.  Frames
 496                  * w/ M_AMPDU_MPDU marked have already passed through
 497                  * here but were received out of order and been held on
 498                  * the reorder queue.  When resubmitted they are marked
 499                  * with the M_AMPDU_MPDU flag and we can bypass most of
 500                  * the normal processing.
 501                  */
 502                 wh = mtod(m, struct ieee80211_frame *);
 503                 type = IEEE80211_FC0_TYPE_DATA;
 504                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 505                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
 506                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
 507                 goto resubmit_ampdu;
 508         }
 509
 510         KASSERT(ni != NULL, ("null node"));
 511         ni->ni_inact = ni->ni_inact_reload;
 512
 513         type = -1;                      /* undefined */
 514
 515         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
 516                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 517                     ni->ni_macaddr, NULL,
 518                     "too short (1): len %u", m->m_pkthdr.len);
 519                 vap->iv_stats.is_rx_tooshort++;
 520                 goto out;
 521         }
 522         /*
 523          * Bit of a cheat here, we use a pointer for a 3-address
 524          * frame format but don't reference fields past outside
 525          * ieee80211_frame_min w/o first validating the data is
 526          * present.
 527          */
 528         wh = mtod(m, struct ieee80211_frame *);
 529
 530         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
 531             IEEE80211_FC0_VERSION_0) {
 532                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 533                     ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
 534                     wh->i_fc[0], wh->i_fc[1]);
 535                 vap->iv_stats.is_rx_badversion++;
 536                 goto err;
 537         }
 538
 539         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 540         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 541         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 542         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 543                 if (dir != IEEE80211_FC1_DIR_NODS)
 544                         bssid = wh->i_addr1;
 545                 else if (type == IEEE80211_FC0_TYPE_CTL)
 546                         bssid = wh->i_addr1;
 547                 else {
 548                         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 549                                 IEEE80211_DISCARD_MAC(vap,
 550                                     IEEE80211_MSG_ANY, ni->ni_macaddr,
 551                                     NULL, "too short (2): len %u",
 552                                     m->m_pkthdr.len);
 553                                 vap->iv_stats.is_rx_tooshort++;
 554                                 goto out;
 555                         }
 556                         bssid = wh->i_addr3;
 557                 }
 558                 /*
 559                  * Validate the bssid.
 560                  */
 561                 if (!(type == IEEE80211_FC0_TYPE_MGT &&
 562                       subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
 563                     !IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
 564                     !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
 565                         /* not interested in */
 566                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 567                             bssid, NULL, "%s", "not to bss");
 568                         vap->iv_stats.is_rx_wrongbss++;
 569                         goto out;
 570                 }
 571
 572                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
 573                 ni->ni_noise = nf;
 574                 if (HAS_SEQ(type)) {
 575                         uint8_t tid = ieee80211_gettid(wh);
 576                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
 577                             TID_TO_WME_AC(tid) >= WME_AC_VI)
 578                                 ic->ic_wme.wme_hipri_traffic++;
 579                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
 580                         if (! ieee80211_check_rxseq(ni, wh)) {
 581                                 /* duplicate, discard */
 582                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 583                                     bssid, "duplicate",
 584                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
 585                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
 586                                     ni->ni_rxseqs[tid] >>
 587                                         IEEE80211_SEQ_SEQ_SHIFT,
 588                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
 589                                     ni->ni_rxseqs[tid] &
 590                                         IEEE80211_SEQ_FRAG_MASK,
 591                                     tid);
 592                                 vap->iv_stats.is_rx_dup++;
 593                                 IEEE80211_NODE_STAT(ni, rx_dup);
 594                                 goto out;
 595                         }
 596                         ni->ni_rxseqs[tid] = rxseq;
 597                 }
 598         }
 599
 600         switch (type) {
 601         case IEEE80211_FC0_TYPE_DATA:
 602                 hdrspace = ieee80211_hdrspace(ic, wh);
 603                 if (m->m_len < hdrspace &&
 604                     (m = m_pullup(m, hdrspace)) == NULL) {
 605                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 606                             ni->ni_macaddr, NULL,
 607                             "data too short: expecting %u", hdrspace);
 608                         vap->iv_stats.is_rx_tooshort++;
 609                         goto out;               /* XXX */
 610                 }
 611                 if (!(dir == IEEE80211_FC1_DIR_TODS ||
 612                      (dir == IEEE80211_FC1_DIR_DSTODS &&
 613                       (vap->iv_flags & IEEE80211_F_DWDS)))) {
 614                         if (dir != IEEE80211_FC1_DIR_DSTODS) {
 615                                 IEEE80211_DISCARD(vap,
 616                                     IEEE80211_MSG_INPUT, wh, "data",
 617                                     "incorrect dir 0x%x", dir);
 618                         } else {
 619                                 IEEE80211_DISCARD(vap,
 620                                     IEEE80211_MSG_INPUT |
 621                                     IEEE80211_MSG_WDS, wh,
 622                                     "4-address data",
 623                                     "%s", "DWDS not enabled");
 624                         }
 625                         vap->iv_stats.is_rx_wrongdir++;
 626                         goto out;
 627                 }
 628                 /* check if source STA is associated */
 629                 if (ni == vap->iv_bss) {
 630                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 631                             wh, "data", "%s", "unknown src");
 632                         ieee80211_send_error(ni, wh->i_addr2,
 633                             IEEE80211_FC0_SUBTYPE_DEAUTH,
 634                             IEEE80211_REASON_NOT_AUTHED);
 635                         vap->iv_stats.is_rx_notassoc++;
 636                         goto err;
 637                 }
 638                 if (ni->ni_associd == 0) {
 639                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 640                             wh, "data", "%s", "unassoc src");
 641                         IEEE80211_SEND_MGMT(ni,
 642                             IEEE80211_FC0_SUBTYPE_DISASSOC,
 643                             IEEE80211_REASON_NOT_ASSOCED);
 644                         vap->iv_stats.is_rx_notassoc++;
 645                         goto err;
 646                 }
 647
 648                 /*
 649                  * Check for power save state change.
 650                  * XXX out-of-order A-MPDU frames?
 651                  */
 652                 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
 653                     (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
 654                         vap->iv_node_ps(ni,
 655                                 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
 656                 /*
 657                  * For 4-address packets handle WDS discovery
 658                  * notifications.  Once a WDS link is setup frames
 659                  * are just delivered to the WDS vap (see below).
 660                  */
 661                 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap == NULL) {
 662                         if (!ieee80211_node_is_authorized(ni)) {
 663                                 IEEE80211_DISCARD(vap,
 664                                     IEEE80211_MSG_INPUT |
 665                                     IEEE80211_MSG_WDS, wh,
 666                                     "4-address data",
 667                                     "%s", "unauthorized port");
 668                                 vap->iv_stats.is_rx_unauth++;
 669                                 IEEE80211_NODE_STAT(ni, rx_unauth);
 670                                 goto err;
 671                         }
 672                         ieee80211_dwds_discover(ni, m);
 673                         return type;
 674                 }
 675
 676                 /*
 677                  * Handle A-MPDU re-ordering.  If the frame is to be
 678                  * processed directly then ieee80211_ampdu_reorder
 679                  * will return 0; otherwise it has consumed the mbuf
 680                  * and we should do nothing more with it.
 681                  */
 682                 if ((m->m_flags & M_AMPDU) &&
 683                     ieee80211_ampdu_reorder(ni, m) != 0) {
 684                         m = NULL;
 685                         goto out;
 686                 }
 687         resubmit_ampdu:
 688
 689                 /*
 690                  * Handle privacy requirements.  Note that we
 691                  * must not be preempted from here until after
 692                  * we (potentially) call ieee80211_crypto_demic;
 693                  * otherwise we may violate assumptions in the
 694                  * crypto cipher modules used to do delayed update
 695                  * of replay sequence numbers.
 696                  */
 697                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 698                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 699                                 /*
 700                                  * Discard encrypted frames when privacy is off.
 701                                  */
 702                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 703                                     wh, "WEP", "%s", "PRIVACY off");
 704                                 vap->iv_stats.is_rx_noprivacy++;
 705                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
 706                                 goto out;
 707                         }
 708                         key = ieee80211_crypto_decap(ni, m, hdrspace);
 709                         if (key == NULL) {
 710                                 /* NB: stats+msgs handled in crypto_decap */
 711                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
 712                                 goto out;
 713                         }
 714                         wh = mtod(m, struct ieee80211_frame *);
 715                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
 716                 } else {
 717                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
 718                         key = NULL;
 719                 }
 720
 721                 /*
 722                  * Save QoS bits for use below--before we strip the header.
 723                  */
 724                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
 725                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
 726                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
 727                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
 728                 } else
 729                         qos = 0;
 730
 731                 /*
 732                  * Next up, any fragmentation.
 733                  */
 734                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 735                         m = ieee80211_defrag(ni, m, hdrspace);
 736                         if (m == NULL) {
 737                                 /* Fragment dropped or frame not complete yet */
 738                                 goto out;
 739                         }
 740                 }
 741                 wh = NULL;              /* no longer valid, catch any uses */
 742
 743                 /*
 744                  * Next strip any MSDU crypto bits.
 745                  */
 746                 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
 747                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 748                             ni->ni_macaddr, "data", "%s", "demic error");
 749                         vap->iv_stats.is_rx_demicfail++;
 750                         IEEE80211_NODE_STAT(ni, rx_demicfail);
 751                         goto out;
 752                 }
 753                 /* copy to listener after decrypt */
 754                 if (ieee80211_radiotap_active_vap(vap))
 755                         ieee80211_radiotap_rx(vap, m);
 756                 need_tap = 0;
 757                 /*
 758                  * Finally, strip the 802.11 header.
 759                  */
 760                 m = ieee80211_decap(vap, m, hdrspace);
 761                 if (m == NULL) {
 762                         /* XXX mask bit to check for both */
 763                         /* don't count Null data frames as errors */
 764                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
 765                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
 766                                 goto out;
 767                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 768                             ni->ni_macaddr, "data", "%s", "decap error");
 769                         vap->iv_stats.is_rx_decap++;
 770                         IEEE80211_NODE_STAT(ni, rx_decap);
 771                         goto err;
 772                 }
 773                 eh = mtod(m, struct ether_header *);
 774                 if (!ieee80211_node_is_authorized(ni)) {
 775                         /*
 776                          * Deny any non-PAE frames received prior to
 777                          * authorization.  For open/shared-key
 778                          * authentication the port is mark authorized
 779                          * after authentication completes.  For 802.1x
 780                          * the port is not marked authorized by the
 781                          * authenticator until the handshake has completed.
 782                          */
 783                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
 784                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 785                                     eh->ether_shost, "data",
 786                                     "unauthorized port: ether type 0x%x len %u",
 787                                     eh->ether_type, m->m_pkthdr.len);
 788                                 vap->iv_stats.is_rx_unauth++;
 789                                 IEEE80211_NODE_STAT(ni, rx_unauth);
 790                                 goto err;
 791                         }
 792                 } else {
 793                         /*
 794                          * When denying unencrypted frames, discard
 795                          * any non-PAE frames received without encryption.
 796                          */
 797                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
 798                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
 799                             eh->ether_type != htons(ETHERTYPE_PAE)) {
 800                                 /*
 801                                  * Drop unencrypted frames.
 802                                  */
 803                                 vap->iv_stats.is_rx_unencrypted++;
 804                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
 805                                 goto out;
 806                         }
 807                 }
 808                 /* XXX require HT? */
 809                 if (qos & IEEE80211_QOS_AMSDU) {
 810                         m = ieee80211_decap_amsdu(ni, m);
 811                         if (m == NULL)
 812                                 return IEEE80211_FC0_TYPE_DATA;
 813                 } else {
 814 #ifdef IEEE80211_SUPPORT_SUPERG
 815                         m = ieee80211_decap_fastframe(vap, ni, m);
 816                         if (m == NULL)
 817                                 return IEEE80211_FC0_TYPE_DATA;
 818 #endif
 819                 }
 820                 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
 821                         ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
 822                 else
 823                         hostap_deliver_data(vap, ni, m);
 824                 return IEEE80211_FC0_TYPE_DATA;
 825
 826         case IEEE80211_FC0_TYPE_MGT:
 827                 vap->iv_stats.is_rx_mgmt++;
 828                 IEEE80211_NODE_STAT(ni, rx_mgmt);
 829                 if (dir != IEEE80211_FC1_DIR_NODS) {
 830                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 831                             wh, "mgt", "incorrect dir 0x%x", dir);
 832                         vap->iv_stats.is_rx_wrongdir++;
 833                         goto err;
 834                 }
 835                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 836                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 837                             ni->ni_macaddr, "mgt", "too short: len %u",
 838                             m->m_pkthdr.len);
 839                         vap->iv_stats.is_rx_tooshort++;
 840                         goto out;
 841                 }
 842                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
 843                         /* ensure return frames are unicast */
 844                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 845                             wh, NULL, "source is multicast: %s",
 846                             ether_sprintf(wh->i_addr2));
 847                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
 848                         goto out;
 849                 }
 850 #ifdef IEEE80211_DEBUG
 851                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
 852                     ieee80211_msg_dumppkts(vap)) {
 853                         if_printf(ifp, "received %s from %s rssi %d\n",
 854                             ieee80211_mgt_subtype_name[subtype >>
 855                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 856                             ether_sprintf(wh->i_addr2), rssi);
 857                 }
 858 #endif
 859                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 860                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
 861                                 /*
 862                                  * Only shared key auth frames with a challenge
 863                                  * should be encrypted, discard all others.
 864                                  */
 865                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 866                                     wh, NULL,
 867                                     "%s", "WEP set but not permitted");
 868                                 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
 869                                 goto out;
 870                         }
 871                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 872                                 /*
 873                                  * Discard encrypted frames when privacy is off.
 874                                  */
 875                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 876                                     wh, NULL, "%s", "WEP set but PRIVACY off");
 877                                 vap->iv_stats.is_rx_noprivacy++;
 878                                 goto out;
 879                         }
 880                         hdrspace = ieee80211_hdrspace(ic, wh);
 881                         key = ieee80211_crypto_decap(ni, m, hdrspace);
 882                         if (key == NULL) {
 883                                 /* NB: stats+msgs handled in crypto_decap */
 884                                 goto out;
 885                         }
 886                         wh = mtod(m, struct ieee80211_frame *);
 887                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
 888                 }
 889                 /*
 890                  * Pass the packet to radiotap before calling iv_recv_mgmt().
 891                  * Otherwise iv_recv_mgmt() might pass another packet to
 892                  * radiotap, resulting in out of order packet captures.
 893                  */
 894                 if (ieee80211_radiotap_active_vap(vap))
 895                         ieee80211_radiotap_rx(vap, m);
 896                 need_tap = 0;
 897                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
 898                 goto out;
 899
 900         case IEEE80211_FC0_TYPE_CTL:
 901                 vap->iv_stats.is_rx_ctl++;
 902                 IEEE80211_NODE_STAT(ni, rx_ctrl);
 903                 vap->iv_recv_ctl(ni, m, subtype);
 904                 goto out;
 905         default:
 906                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 907                     wh, "bad", "frame type 0x%x", type);
 908                 /* should not come here */
 909                 break;
 910         }
 911 err:
 912         if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 913 out:
 914         if (m != NULL) {
 915                 if (need_tap && ieee80211_radiotap_active_vap(vap))
 916                         ieee80211_radiotap_rx(vap, m);
 917                 m_freem(m);
 918         }
 919         return type;
 920 }
 921
 922 static void
 923 hostap_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
 924     int rssi, int nf, uint16_t seq, uint16_t status)
 925 {
 926         struct ieee80211vap *vap = ni->ni_vap;
 927
 928         KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
 929
 930         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
 931                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 932                     ni->ni_macaddr, "open auth",
 933                     "bad sta auth mode %u", ni->ni_authmode);
 934                 vap->iv_stats.is_rx_bad_auth++; /* XXX */
 935                 /*
 936                  * Clear any challenge text that may be there if
 937                  * a previous shared key auth failed and then an
 938                  * open auth is attempted.
 939                  */
 940                 if (ni->ni_challenge != NULL) {
 941                         free(ni->ni_challenge, M_80211_NODE);
 942                         ni->ni_challenge = NULL;
 943                 }
 944                 /* XXX hack to workaround calling convention */
 945                 ieee80211_send_error(ni, wh->i_addr2,
 946                     IEEE80211_FC0_SUBTYPE_AUTH,
 947                     (seq + 1) | (IEEE80211_STATUS_ALG<<16));
 948                 return;
 949         }
 950         if (seq != IEEE80211_AUTH_OPEN_REQUEST) {
 951                 vap->iv_stats.is_rx_bad_auth++;
 952                 return;
 953         }
 954         /* always accept open authentication requests */
 955         if (ni == vap->iv_bss) {
 956                 ni = ieee80211_dup_bss(vap, wh->i_addr2);
 957                 if (ni == NULL)
 958                         return;
 959         } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
 960                 (void) ieee80211_ref_node(ni);
 961         /*
 962          * Mark the node as referenced to reflect that it's
 963          * reference count has been bumped to insure it remains
 964          * after the transaction completes.
 965          */
 966         ni->ni_flags |= IEEE80211_NODE_AREF;
 967         /*
 968          * Mark the node as requiring a valid association id
 969          * before outbound traffic is permitted.
 970          */
 971         ni->ni_flags |= IEEE80211_NODE_ASSOCID;
 972
 973         if (vap->iv_acl != NULL &&
 974             vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
 975                 /*
 976                  * When the ACL policy is set to RADIUS we defer the
 977                  * authorization to a user agent.  Dispatch an event,
 978                  * a subsequent MLME call will decide the fate of the
 979                  * station.  If the user agent is not present then the
 980                  * node will be reclaimed due to inactivity.
 981                  */
 982                 IEEE80211_NOTE_MAC(vap,
 983                     IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL, ni->ni_macaddr,
 984                     "%s", "station authentication defered (radius acl)");
 985                 ieee80211_notify_node_auth(ni);
 986         } else {
 987                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
 988                 IEEE80211_NOTE_MAC(vap,
 989                     IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni->ni_macaddr,
 990                     "%s", "station authenticated (open)");
 991                 /*
 992                  * When 802.1x is not in use mark the port
 993                  * authorized at this point so traffic can flow.
 994                  */
 995                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 996                         ieee80211_node_authorize(ni);
 997         }
 998 }
 999
1000 static void
1001 hostap_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
1002     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
1003     uint16_t seq, uint16_t status)
1004 {
1005         struct ieee80211vap *vap = ni->ni_vap;
1006         uint8_t *challenge;
1007         int allocbs, estatus;
1008
1009         KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
1010
1011         /*
1012          * NB: this can happen as we allow pre-shared key
1013          * authentication to be enabled w/o wep being turned
1014          * on so that configuration of these can be done
1015          * in any order.  It may be better to enforce the
1016          * ordering in which case this check would just be
1017          * for sanity/consistency.
1018          */
1019         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
1020                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1021                     ni->ni_macaddr, "shared key auth",
1022                     "%s", " PRIVACY is disabled");
1023                 estatus = IEEE80211_STATUS_ALG;
1024                 goto bad;
1025         }
1026         /*
1027          * Pre-shared key authentication is evil; accept
1028          * it only if explicitly configured (it is supported
1029          * mainly for compatibility with clients like Mac OS X).
1030          */
1031         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1032             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1033                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1034                     ni->ni_macaddr, "shared key auth",
1035                     "bad sta auth mode %u", ni->ni_authmode);
1036                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1037                 estatus = IEEE80211_STATUS_ALG;
1038                 goto bad;
1039         }
1040
1041         challenge = NULL;
1042         if (frm + 1 < efrm) {
1043                 if ((frm[1] + 2) > (efrm - frm)) {
1044                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1045                             ni->ni_macaddr, "shared key auth",
1046                             "ie %d/%d too long",
1047                             frm[0], (frm[1] + 2) - (efrm - frm));
1048                         vap->iv_stats.is_rx_bad_auth++;
1049                         estatus = IEEE80211_STATUS_CHALLENGE;
1050                         goto bad;
1051                 }
1052                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1053                         challenge = frm;
1054                 frm += frm[1] + 2;
1055         }
1056         switch (seq) {
1057         case IEEE80211_AUTH_SHARED_CHALLENGE:
1058         case IEEE80211_AUTH_SHARED_RESPONSE:
1059                 if (challenge == NULL) {
1060                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1061                             ni->ni_macaddr, "shared key auth",
1062                             "%s", "no challenge");
1063                         vap->iv_stats.is_rx_bad_auth++;
1064                         estatus = IEEE80211_STATUS_CHALLENGE;
1065                         goto bad;
1066                 }
1067                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1068                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1069                             ni->ni_macaddr, "shared key auth",
1070                             "bad challenge len %d", challenge[1]);
1071                         vap->iv_stats.is_rx_bad_auth++;
1072                         estatus = IEEE80211_STATUS_CHALLENGE;
1073                         goto bad;
1074                 }
1075         default:
1076                 break;
1077         }
1078         switch (seq) {
1079         case IEEE80211_AUTH_SHARED_REQUEST:
1080                 if (ni == vap->iv_bss) {
1081                         ni = ieee80211_dup_bss(vap, wh->i_addr2);
1082                         if (ni == NULL) {
1083                                 /* NB: no way to return an error */
1084                                 return;
1085                         }
1086                         allocbs = 1;
1087                 } else {
1088                         if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1089                                 (void) ieee80211_ref_node(ni);
1090                         allocbs = 0;
1091                 }
1092                 /*
1093                  * Mark the node as referenced to reflect that it's
1094                  * reference count has been bumped to insure it remains
1095                  * after the transaction completes.
1096                  */
1097                 ni->ni_flags |= IEEE80211_NODE_AREF;
1098                 /*
1099                  * Mark the node as requiring a valid associatio id
1100                  * before outbound traffic is permitted.
1101                  */
1102                 ni->ni_flags |= IEEE80211_NODE_ASSOCID;
1103                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1104                 ni->ni_noise = nf;
1105                 if (!ieee80211_alloc_challenge(ni)) {
1106                         /* NB: don't return error so they rexmit */
1107                         return;
1108                 }
1109                 get_random_bytes(ni->ni_challenge,
1110                         IEEE80211_CHALLENGE_LEN);
1111                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1112                     ni, "shared key %sauth request", allocbs ? "" : "re");
1113                 /*
1114                  * When the ACL policy is set to RADIUS we defer the
1115                  * authorization to a user agent.  Dispatch an event,
1116                  * a subsequent MLME call will decide the fate of the
1117                  * station.  If the user agent is not present then the
1118                  * node will be reclaimed due to inactivity.
1119                  */
1120                 if (vap->iv_acl != NULL &&
1121                     vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
1122                         IEEE80211_NOTE_MAC(vap,
1123                             IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL,
1124                             ni->ni_macaddr,
1125                             "%s", "station authentication defered (radius acl)");
1126                         ieee80211_notify_node_auth(ni);
1127                         return;
1128                 }
1129                 break;
1130         case IEEE80211_AUTH_SHARED_RESPONSE:
1131                 if (ni == vap->iv_bss) {
1132                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1133                             ni->ni_macaddr, "shared key response",
1134                             "%s", "unknown station");
1135                         /* NB: don't send a response */
1136                         return;
1137                 }
1138                 if (ni->ni_challenge == NULL) {
1139                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1140                             ni->ni_macaddr, "shared key response",
1141                             "%s", "no challenge recorded");
1142                         vap->iv_stats.is_rx_bad_auth++;
1143                         estatus = IEEE80211_STATUS_CHALLENGE;
1144                         goto bad;
1145                 }
1146                 if (memcmp(ni->ni_challenge, &challenge[2],
1147                            challenge[1]) != 0) {
1148                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1149                             ni->ni_macaddr, "shared key response",
1150                             "%s", "challenge mismatch");
1151                         vap->iv_stats.is_rx_auth_fail++;
1152                         estatus = IEEE80211_STATUS_CHALLENGE;
1153                         goto bad;
1154                 }
1155                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1156                     ni, "%s", "station authenticated (shared key)");
1157                 ieee80211_node_authorize(ni);
1158                 break;
1159         default:
1160                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1161                     ni->ni_macaddr, "shared key auth",
1162                     "bad seq %d", seq);
1163                 vap->iv_stats.is_rx_bad_auth++;
1164                 estatus = IEEE80211_STATUS_SEQUENCE;
1165                 goto bad;
1166         }
1167         IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1168         return;
1169 bad:
1170         /*
1171          * Send an error response; but only when operating as an AP.
1172          */
1173         /* XXX hack to workaround calling convention */
1174         ieee80211_send_error(ni, wh->i_addr2,
1175             IEEE80211_FC0_SUBTYPE_AUTH,
1176             (seq + 1) | (estatus<<16));
1177 }
1178
1179 /*
1180  * Convert a WPA cipher selector OUI to an internal
1181  * cipher algorithm.  Where appropriate we also
1182  * record any key length.
1183  */
1184 static int
1185 wpa_cipher(const uint8_t *sel, uint8_t *keylen)
1186 {
1187 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
1188         uint32_t w = LE_READ_4(sel);
1189
1190         switch (w) {
1191         case WPA_SEL(WPA_CSE_NULL):
1192                 return IEEE80211_CIPHER_NONE;
1193         case WPA_SEL(WPA_CSE_WEP40):
1194                 if (keylen)
1195                         *keylen = 40 / NBBY;
1196                 return IEEE80211_CIPHER_WEP;
1197         case WPA_SEL(WPA_CSE_WEP104):
1198                 if (keylen)
1199                         *keylen = 104 / NBBY;
1200                 return IEEE80211_CIPHER_WEP;
1201         case WPA_SEL(WPA_CSE_TKIP):
1202                 return IEEE80211_CIPHER_TKIP;
1203         case WPA_SEL(WPA_CSE_CCMP):
1204                 return IEEE80211_CIPHER_AES_CCM;
1205         }
1206         return 32;              /* NB: so 1<< is discarded */
1207 #undef WPA_SEL
1208 }
1209
1210 /*
1211  * Convert a WPA key management/authentication algorithm
1212  * to an internal code.
1213  */
1214 static int
1215 wpa_keymgmt(const uint8_t *sel)
1216 {
1217 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
1218         uint32_t w = LE_READ_4(sel);
1219
1220         switch (w) {
1221         case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1222                 return WPA_ASE_8021X_UNSPEC;
1223         case WPA_SEL(WPA_ASE_8021X_PSK):
1224                 return WPA_ASE_8021X_PSK;
1225         case WPA_SEL(WPA_ASE_NONE):
1226                 return WPA_ASE_NONE;
1227         }
1228         return 0;               /* NB: so is discarded */
1229 #undef WPA_SEL
1230 }
1231
1232 /*
1233  * Parse a WPA information element to collect parameters.
1234  * Note that we do not validate security parameters; that
1235  * is handled by the authenticator; the parsing done here
1236  * is just for internal use in making operational decisions.
1237  */
1238 static int
1239 ieee80211_parse_wpa(struct ieee80211vap *vap, const uint8_t *frm,
1240         struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1241 {
1242         uint8_t len = frm[1];
1243         uint32_t w;
1244         int n;
1245
1246         /*
1247          * Check the length once for fixed parts: OUI, type,
1248          * version, mcast cipher, and 2 selector counts.
1249          * Other, variable-length data, must be checked separately.
1250          */
1251         if ((vap->iv_flags & IEEE80211_F_WPA1) == 0) {
1252                 IEEE80211_DISCARD_IE(vap,
1253                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1254                     wh, "WPA", "not WPA, flags 0x%x", vap->iv_flags);
1255                 return IEEE80211_REASON_IE_INVALID;
1256         }
1257         if (len < 14) {
1258                 IEEE80211_DISCARD_IE(vap,
1259                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1260                     wh, "WPA", "too short, len %u", len);
1261                 return IEEE80211_REASON_IE_INVALID;
1262         }
1263         frm += 6, len -= 4;             /* NB: len is payload only */
1264         /* NB: iswpaoui already validated the OUI and type */
1265         w = LE_READ_2(frm);
1266         if (w != WPA_VERSION) {
1267                 IEEE80211_DISCARD_IE(vap,
1268                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1269                     wh, "WPA", "bad version %u", w);
1270                 return IEEE80211_REASON_IE_INVALID;
1271         }
1272         frm += 2, len -= 2;
1273
1274         memset(rsn, 0, sizeof(*rsn));
1275
1276         /* multicast/group cipher */
1277         rsn->rsn_mcastcipher = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1278         frm += 4, len -= 4;
1279
1280         /* unicast ciphers */
1281         n = LE_READ_2(frm);
1282         frm += 2, len -= 2;
1283         if (len < n*4+2) {
1284                 IEEE80211_DISCARD_IE(vap,
1285                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1286                     wh, "WPA", "ucast cipher data too short; len %u, n %u",
1287                     len, n);
1288                 return IEEE80211_REASON_IE_INVALID;
1289         }
1290         w = 0;
1291         for (; n > 0; n--) {
1292                 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1293                 frm += 4, len -= 4;
1294         }
1295         if (w & (1<<IEEE80211_CIPHER_TKIP))
1296                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1297         else
1298                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1299
1300         /* key management algorithms */
1301         n = LE_READ_2(frm);
1302         frm += 2, len -= 2;
1303         if (len < n*4) {
1304                 IEEE80211_DISCARD_IE(vap,
1305                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1306                     wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1307                     len, n);
1308                 return IEEE80211_REASON_IE_INVALID;
1309         }
1310         w = 0;
1311         for (; n > 0; n--) {
1312                 w |= wpa_keymgmt(frm);
1313                 frm += 4, len -= 4;
1314         }
1315         if (w & WPA_ASE_8021X_UNSPEC)
1316                 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1317         else
1318                 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1319
1320         if (len > 2)            /* optional capabilities */
1321                 rsn->rsn_caps = LE_READ_2(frm);
1322
1323         return 0;
1324 }
1325
1326 /*
1327  * Convert an RSN cipher selector OUI to an internal
1328  * cipher algorithm.  Where appropriate we also
1329  * record any key length.
1330  */
1331 static int
1332 rsn_cipher(const uint8_t *sel, uint8_t *keylen)
1333 {
1334 #define RSN_SEL(x)      (((x)<<24)|RSN_OUI)
1335         uint32_t w = LE_READ_4(sel);
1336
1337         switch (w) {
1338         case RSN_SEL(RSN_CSE_NULL):
1339                 return IEEE80211_CIPHER_NONE;
1340         case RSN_SEL(RSN_CSE_WEP40):
1341                 if (keylen)
1342                         *keylen = 40 / NBBY;
1343                 return IEEE80211_CIPHER_WEP;
1344         case RSN_SEL(RSN_CSE_WEP104):
1345                 if (keylen)
1346                         *keylen = 104 / NBBY;
1347                 return IEEE80211_CIPHER_WEP;
1348         case RSN_SEL(RSN_CSE_TKIP):
1349                 return IEEE80211_CIPHER_TKIP;
1350         case RSN_SEL(RSN_CSE_CCMP):
1351                 return IEEE80211_CIPHER_AES_CCM;
1352         case RSN_SEL(RSN_CSE_WRAP):
1353                 return IEEE80211_CIPHER_AES_OCB;
1354         }
1355         return 32;              /* NB: so 1<< is discarded */
1356 #undef WPA_SEL
1357 }
1358
1359 /*
1360  * Convert an RSN key management/authentication algorithm
1361  * to an internal code.
1362  */
1363 static int
1364 rsn_keymgmt(const uint8_t *sel)
1365 {
1366 #define RSN_SEL(x)      (((x)<<24)|RSN_OUI)
1367         uint32_t w = LE_READ_4(sel);
1368
1369         switch (w) {
1370         case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1371                 return RSN_ASE_8021X_UNSPEC;
1372         case RSN_SEL(RSN_ASE_8021X_PSK):
1373                 return RSN_ASE_8021X_PSK;
1374         case RSN_SEL(RSN_ASE_NONE):
1375                 return RSN_ASE_NONE;
1376         }
1377         return 0;               /* NB: so is discarded */
1378 #undef RSN_SEL
1379 }
1380
1381 /*
1382  * Parse a WPA/RSN information element to collect parameters
1383  * and validate the parameters against what has been
1384  * configured for the system.
1385  */
1386 static int
1387 ieee80211_parse_rsn(struct ieee80211vap *vap, const uint8_t *frm,
1388         struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1389 {
1390         uint8_t len = frm[1];
1391         uint32_t w;
1392         int n;
1393
1394         /*
1395          * Check the length once for fixed parts:
1396          * version, mcast cipher, and 2 selector counts.
1397          * Other, variable-length data, must be checked separately.
1398          */
1399         if ((vap->iv_flags & IEEE80211_F_WPA2) == 0) {
1400                 IEEE80211_DISCARD_IE(vap,
1401                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1402                     wh, "WPA", "not RSN, flags 0x%x", vap->iv_flags);
1403                 return IEEE80211_REASON_IE_INVALID;
1404         }
1405         if (len < 10) {
1406                 IEEE80211_DISCARD_IE(vap,
1407                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1408                     wh, "RSN", "too short, len %u", len);
1409                 return IEEE80211_REASON_IE_INVALID;
1410         }
1411         frm += 2;
1412         w = LE_READ_2(frm);
1413         if (w != RSN_VERSION) {
1414                 IEEE80211_DISCARD_IE(vap,
1415                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1416                     wh, "RSN", "bad version %u", w);
1417                 return IEEE80211_REASON_IE_INVALID;
1418         }
1419         frm += 2, len -= 2;
1420
1421         memset(rsn, 0, sizeof(*rsn));
1422
1423         /* multicast/group cipher */
1424         rsn->rsn_mcastcipher = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1425         frm += 4, len -= 4;
1426
1427         /* unicast ciphers */
1428         n = LE_READ_2(frm);
1429         frm += 2, len -= 2;
1430         if (len < n*4+2) {
1431                 IEEE80211_DISCARD_IE(vap,
1432                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1433                     wh, "RSN", "ucast cipher data too short; len %u, n %u",
1434                     len, n);
1435                 return IEEE80211_REASON_IE_INVALID;
1436         }
1437         w = 0;
1438         for (; n > 0; n--) {
1439                 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1440                 frm += 4, len -= 4;
1441         }
1442         if (w & (1<<IEEE80211_CIPHER_TKIP))
1443                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1444         else
1445                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1446
1447         /* key management algorithms */
1448         n = LE_READ_2(frm);
1449         frm += 2, len -= 2;
1450         if (len < n*4) {
1451                 IEEE80211_DISCARD_IE(vap,
1452                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1453                     wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1454                     len, n);
1455                 return IEEE80211_REASON_IE_INVALID;
1456         }
1457         w = 0;
1458         for (; n > 0; n--) {
1459                 w |= rsn_keymgmt(frm);
1460                 frm += 4, len -= 4;
1461         }
1462         if (w & RSN_ASE_8021X_UNSPEC)
1463                 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1464         else
1465                 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1466
1467         /* optional RSN capabilities */
1468         if (len > 2)
1469                 rsn->rsn_caps = LE_READ_2(frm);
1470         /* XXXPMKID */
1471
1472         return 0;
1473 }
1474
1475 /*
1476  * WPA/802.11i assocation request processing.
1477  */
1478 static int
1479 wpa_assocreq(struct ieee80211_node *ni, struct ieee80211_rsnparms *rsnparms,
1480         const struct ieee80211_frame *wh, const uint8_t *wpa,
1481         const uint8_t *rsn, uint16_t capinfo)
1482 {
1483         struct ieee80211vap *vap = ni->ni_vap;
1484         uint8_t reason;
1485         int badwparsn;
1486
1487         ni->ni_flags &= ~(IEEE80211_NODE_WPS|IEEE80211_NODE_TSN);
1488         if (wpa == NULL && rsn == NULL) {
1489                 if (vap->iv_flags_ext & IEEE80211_FEXT_WPS) {
1490                         /*
1491                          * W-Fi Protected Setup (WPS) permits
1492                          * clients to associate and pass EAPOL frames
1493                          * to establish initial credentials.
1494                          */
1495                         ni->ni_flags |= IEEE80211_NODE_WPS;
1496                         return 1;
1497                 }
1498                 if ((vap->iv_flags_ext & IEEE80211_FEXT_TSN) &&
1499                     (capinfo & IEEE80211_CAPINFO_PRIVACY)) {
1500                         /*
1501                          * Transitional Security Network.  Permits clients
1502                          * to associate and use WEP while WPA is configured.
1503                          */
1504                         ni->ni_flags |= IEEE80211_NODE_TSN;
1505                         return 1;
1506                 }
1507                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1508                     wh, NULL, "%s", "no WPA/RSN IE in association request");
1509                 vap->iv_stats.is_rx_assoc_badwpaie++;
1510                 reason = IEEE80211_REASON_IE_INVALID;
1511                 goto bad;
1512         }
1513         /* assert right association security credentials */
1514         badwparsn = 0;                  /* NB: to silence compiler */
1515         switch (vap->iv_flags & IEEE80211_F_WPA) {
1516         case IEEE80211_F_WPA1:
1517                 badwparsn = (wpa == NULL);
1518                 break;
1519         case IEEE80211_F_WPA2:
1520                 badwparsn = (rsn == NULL);
1521                 break;
1522         case IEEE80211_F_WPA1|IEEE80211_F_WPA2:
1523                 badwparsn = (wpa == NULL && rsn == NULL);
1524                 break;
1525         }
1526         if (badwparsn) {
1527                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1528                     wh, NULL,
1529                     "%s", "missing WPA/RSN IE in association request");
1530                 vap->iv_stats.is_rx_assoc_badwpaie++;
1531                 reason = IEEE80211_REASON_IE_INVALID;
1532                 goto bad;
1533         }
1534         /*
1535          * Parse WPA/RSN information element.
1536          */
1537         if (wpa != NULL)
1538                 reason = ieee80211_parse_wpa(vap, wpa, rsnparms, wh);
1539         else
1540                 reason = ieee80211_parse_rsn(vap, rsn, rsnparms, wh);
1541         if (reason != 0) {
1542                 /* XXX distinguish WPA/RSN? */
1543                 vap->iv_stats.is_rx_assoc_badwpaie++;
1544                 goto bad;
1545         }
1546         IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, ni,
1547             "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x",
1548             wpa != NULL ? "WPA" : "RSN",
1549             rsnparms->rsn_mcastcipher, rsnparms->rsn_mcastkeylen,
1550             rsnparms->rsn_ucastcipher, rsnparms->rsn_ucastkeylen,
1551             rsnparms->rsn_keymgmt, rsnparms->rsn_caps);
1552
1553         return 1;
1554 bad:
1555         ieee80211_node_deauth(ni, reason);
1556         return 0;
1557 }
1558
1559 /* XXX find a better place for definition */
1560 struct l2_update_frame {
1561         struct ether_header eh;
1562         uint8_t dsap;
1563         uint8_t ssap;
1564         uint8_t control;
1565         uint8_t xid[3];
1566 }  __packed;
1567
1568 /*
1569  * Deliver a TGf L2UF frame on behalf of a station.
1570  * This primes any bridge when the station is roaming
1571  * between ap's on the same wired network.
1572  */
1573 static void
1574 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1575 {
1576         struct ieee80211vap *vap = ni->ni_vap;
1577         struct ifnet *ifp = vap->iv_ifp;
1578         struct mbuf *m;
1579         struct l2_update_frame *l2uf;
1580         struct ether_header *eh;
1581
1582         m = m_gethdr(M_NOWAIT, MT_DATA);
1583         if (m == NULL) {
1584                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1585                     "%s", "no mbuf for l2uf frame");
1586                 vap->iv_stats.is_rx_nobuf++;    /* XXX not right */
1587                 return;
1588         }
1589         l2uf = mtod(m, struct l2_update_frame *);
1590         eh = &l2uf->eh;
1591         /* dst: Broadcast address */
1592         IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1593         /* src: associated STA */
1594         IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1595         eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1596
1597         l2uf->dsap = 0;
1598         l2uf->ssap = 0;
1599         l2uf->control = 0xf5;
1600         l2uf->xid[0] = 0x81;
1601         l2uf->xid[1] = 0x80;
1602         l2uf->xid[2] = 0x00;
1603
1604         m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1605         hostap_deliver_data(vap, ni, m);
1606 }
1607
1608 static void
1609 ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1610         int reassoc, int resp, const char *tag, int rate)
1611 {
1612         IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1613             "deny %s request, %s rate set mismatch, rate/MCS %d",
1614             reassoc ? "reassoc" : "assoc", tag, rate & IEEE80211_RATE_VAL);
1615         IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_BASIC_RATE);
1616         ieee80211_node_leave(ni);
1617 }
1618
1619 static void
1620 capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1621         int reassoc, int resp, const char *tag, int capinfo)
1622 {
1623         struct ieee80211vap *vap = ni->ni_vap;
1624
1625         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1626             "deny %s request, %s mismatch 0x%x",
1627             reassoc ? "reassoc" : "assoc", tag, capinfo);
1628         IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_CAPINFO);
1629         ieee80211_node_leave(ni);
1630         vap->iv_stats.is_rx_assoc_capmismatch++;
1631 }
1632
1633 static void
1634 htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1635         int reassoc, int resp)
1636 {
1637         IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1638             "deny %s request, %s missing HT ie", reassoc ? "reassoc" : "assoc");
1639         /* XXX no better code */
1640         IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_MISSING_HT_CAPS);
1641         ieee80211_node_leave(ni);
1642 }
1643
1644 static void
1645 authalgreject(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1646         int algo, int seq, int status)
1647 {
1648         struct ieee80211vap *vap = ni->ni_vap;
1649
1650         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1651             wh, NULL, "unsupported alg %d", algo);
1652         vap->iv_stats.is_rx_auth_unsupported++;
1653         ieee80211_send_error(ni, wh->i_addr2, IEEE80211_FC0_SUBTYPE_AUTH,
1654             seq | (status << 16));
1655 }
1656
1657 static __inline int
1658 ishtmixed(const uint8_t *ie)
1659 {
1660         const struct ieee80211_ie_htinfo *ht =
1661             (const struct ieee80211_ie_htinfo *) ie;
1662         return (ht->hi_byte2 & IEEE80211_HTINFO_OPMODE) ==
1663             IEEE80211_HTINFO_OPMODE_MIXED;
1664 }
1665
1666 static int
1667 is11bclient(const uint8_t *rates, const uint8_t *xrates)
1668 {
1669         static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
1670         int i;
1671
1672         /* NB: the 11b clients we care about will not have xrates */
1673         if (xrates != NULL || rates == NULL)
1674                 return 0;
1675         for (i = 0; i < rates[1]; i++) {
1676                 int r = rates[2+i] & IEEE80211_RATE_VAL;
1677                 if (r > 2*11 || ((1<<r) & brates) == 0)
1678                         return 0;
1679         }
1680         return 1;
1681 }
1682
1683 static void
1684 hostap_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1685         int subtype, int rssi, int nf)
1686 {
1687         struct ieee80211vap *vap = ni->ni_vap;
1688         struct ieee80211com *ic = ni->ni_ic;
1689         struct ieee80211_frame *wh;
1690         uint8_t *frm, *efrm, *sfrm;
1691         uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap;
1692         int reassoc, resp;
1693         uint8_t rate;
1694
1695         wh = mtod(m0, struct ieee80211_frame *);
1696         frm = (uint8_t *)&wh[1];
1697         efrm = mtod(m0, uint8_t *) + m0->m_len;
1698         switch (subtype) {
1699         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1700         case IEEE80211_FC0_SUBTYPE_BEACON: {
1701                 struct ieee80211_scanparams scan;
1702                 /*
1703                  * We process beacon/probe response frames when scanning;
1704                  * otherwise we check beacon frames for overlapping non-ERP
1705                  * BSS in 11g and/or overlapping legacy BSS when in HT.
1706                  */
1707                 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0 &&
1708                     subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
1709                         vap->iv_stats.is_rx_mgtdiscard++;
1710                         return;
1711                 }
1712                 /* NB: accept off-channel frames */
1713                 if (ieee80211_parse_beacon(ni, m0, &scan) &~ IEEE80211_BPARSE_OFFCHAN)
1714                         return;
1715                 /*
1716                  * Count frame now that we know it's to be processed.
1717                  */
1718                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1719                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
1720                         IEEE80211_NODE_STAT(ni, rx_beacons);
1721                 } else
1722                         IEEE80211_NODE_STAT(ni, rx_proberesp);
1723                 /*
1724                  * If scanning, just pass information to the scan module.
1725                  */
1726                 if (ic->ic_flags & IEEE80211_F_SCAN) {
1727                         if (scan.status == 0 &&         /* NB: on channel */
1728                             (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN)) {
1729                                 /*
1730                                  * Actively scanning a channel marked passive;
1731                                  * send a probe request now that we know there
1732                                  * is 802.11 traffic present.
1733                                  *
1734                                  * XXX check if the beacon we recv'd gives
1735                                  * us what we need and suppress the probe req
1736                                  */
1737                                 ieee80211_probe_curchan(vap, 1);
1738                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1739                         }
1740                         ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1741                         return;
1742                 }
1743                 /*
1744                  * Check beacon for overlapping bss w/ non ERP stations.
1745                  * If we detect one and protection is configured but not
1746                  * enabled, enable it and start a timer that'll bring us
1747                  * out if we stop seeing the bss.
1748                  */
1749                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1750                     scan.status == 0 &&                 /* NB: on-channel */
1751                     ((scan.erp & 0x100) == 0 ||         /* NB: no ERP, 11b sta*/
1752                      (scan.erp & IEEE80211_ERP_NON_ERP_PRESENT))) {
1753                         ic->ic_lastnonerp = ticks;
1754                         ic->ic_flags_ext |= IEEE80211_FEXT_NONERP_PR;
1755                         if (ic->ic_protmode != IEEE80211_PROT_NONE &&
1756                             (ic->ic_flags & IEEE80211_F_USEPROT) == 0) {
1757                                 IEEE80211_NOTE_FRAME(vap,
1758                                     IEEE80211_MSG_ASSOC, wh,
1759                                     "non-ERP present on channel %d "
1760                                     "(saw erp 0x%x from channel %d), "
1761                                     "enable use of protection",
1762                                     ic->ic_curchan->ic_ieee,
1763                                     scan.erp, scan.chan);
1764                                 ic->ic_flags |= IEEE80211_F_USEPROT;
1765                                 ieee80211_notify_erp(ic);
1766                         }
1767                 }
1768                 /*
1769                  * Check beacon for non-HT station on HT channel
1770                  * and update HT BSS occupancy as appropriate.
1771                  */
1772                 if (IEEE80211_IS_CHAN_HT(ic->ic_curchan)) {
1773                         if (scan.status & IEEE80211_BPARSE_OFFCHAN) {
1774                                 /*
1775                                  * Off control channel; only check frames
1776                                  * that come in the extension channel when
1777                                  * operating w/ HT40.
1778                                  */
1779                                 if (!IEEE80211_IS_CHAN_HT40(ic->ic_curchan))
1780                                         break;
1781                                 if (scan.chan != ic->ic_curchan->ic_extieee)
1782                                         break;
1783                         }
1784                         if (scan.htinfo == NULL) {
1785                                 ieee80211_htprot_update(ic,
1786                                     IEEE80211_HTINFO_OPMODE_PROTOPT |
1787                                     IEEE80211_HTINFO_NONHT_PRESENT);
1788                         } else if (ishtmixed(scan.htinfo)) {
1789                                 /* XXX? take NONHT_PRESENT from beacon? */
1790                                 ieee80211_htprot_update(ic,
1791                                     IEEE80211_HTINFO_OPMODE_MIXED |
1792                                     IEEE80211_HTINFO_NONHT_PRESENT);
1793                         }
1794                 }
1795                 break;
1796         }
1797
1798         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1799                 if (vap->iv_state != IEEE80211_S_RUN) {
1800                         vap->iv_stats.is_rx_mgtdiscard++;
1801                         return;
1802                 }
1803                 /*
1804                  * Consult the ACL policy module if setup.
1805                  */
1806                 if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1807                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1808                             wh, NULL, "%s", "disallowed by ACL");
1809                         vap->iv_stats.is_rx_acl++;
1810                         return;
1811                 }
1812                 /*
1813                  * prreq frame format
1814                  *      [tlv] ssid
1815                  *      [tlv] supported rates
1816                  *      [tlv] extended supported rates
1817                  */
1818                 ssid = rates = xrates = NULL;
1819                 sfrm = frm;
1820                 while (efrm - frm > 1) {
1821                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1822                         switch (*frm) {
1823                         case IEEE80211_ELEMID_SSID:
1824                                 ssid = frm;
1825                                 break;
1826                         case IEEE80211_ELEMID_RATES:
1827                                 rates = frm;
1828                                 break;
1829                         case IEEE80211_ELEMID_XRATES:
1830                                 xrates = frm;
1831                                 break;
1832                         }
1833                         frm += frm[1] + 2;
1834                 }
1835                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1836                 if (xrates != NULL)
1837                         IEEE80211_VERIFY_ELEMENT(xrates,
1838                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
1839                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
1840                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
1841                 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
1842                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1843                             wh, NULL,
1844                             "%s", "no ssid with ssid suppression enabled");
1845                         vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
1846                         return;
1847                 }
1848
1849                 /* XXX find a better class or define it's own */
1850                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
1851                     "%s", "recv probe req");
1852                 /*
1853                  * Some legacy 11b clients cannot hack a complete
1854                  * probe response frame.  When the request includes
1855                  * only a bare-bones rate set, communicate this to
1856                  * the transmit side.
1857                  */
1858                 ieee80211_send_proberesp(vap, wh->i_addr2,
1859                     is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
1860                 break;
1861
1862         case IEEE80211_FC0_SUBTYPE_AUTH: {
1863                 uint16_t algo, seq, status;
1864
1865                 if (vap->iv_state != IEEE80211_S_RUN) {
1866                         vap->iv_stats.is_rx_mgtdiscard++;
1867                         return;
1868                 }
1869                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1870                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1871                             wh, NULL, "%s", "wrong bssid");
1872                         vap->iv_stats.is_rx_wrongbss++; /*XXX unique stat?*/
1873                         return;
1874                 }
1875                 /*
1876                  * auth frame format
1877                  *      [2] algorithm
1878                  *      [2] sequence
1879                  *      [2] status
1880                  *      [tlv*] challenge
1881                  */
1882                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1883                 algo   = le16toh(*(uint16_t *)frm);
1884                 seq    = le16toh(*(uint16_t *)(frm + 2));
1885                 status = le16toh(*(uint16_t *)(frm + 4));
1886                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1887                     "recv auth frame with algorithm %d seq %d", algo, seq);
1888                 /*
1889                  * Consult the ACL policy module if setup.
1890                  */
1891                 if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1892                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1893                             wh, NULL, "%s", "disallowed by ACL");
1894                         vap->iv_stats.is_rx_acl++;
1895                         ieee80211_send_error(ni, wh->i_addr2,
1896                             IEEE80211_FC0_SUBTYPE_AUTH,
1897                             (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
1898                         return;
1899                 }
1900                 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1901                         IEEE80211_DISCARD(vap,
1902                             IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1903                             wh, NULL, "%s", "TKIP countermeasures enabled");
1904                         vap->iv_stats.is_rx_auth_countermeasures++;
1905                         ieee80211_send_error(ni, wh->i_addr2,
1906                                 IEEE80211_FC0_SUBTYPE_AUTH,
1907                                 IEEE80211_REASON_MIC_FAILURE);
1908                         return;
1909                 }
1910                 if (algo == IEEE80211_AUTH_ALG_SHARED)
1911                         hostap_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1912                             seq, status);
1913                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1914                         hostap_auth_open(ni, wh, rssi, nf, seq, status);
1915                 else if (algo == IEEE80211_AUTH_ALG_LEAP) {
1916                         authalgreject(ni, wh, algo,
1917                             seq+1, IEEE80211_STATUS_ALG);
1918                         return;
1919                 } else {
1920                         /*
1921                          * We assume that an unknown algorithm is the result
1922                          * of a decryption failure on a shared key auth frame;
1923                          * return a status code appropriate for that instead
1924                          * of IEEE80211_STATUS_ALG.
1925                          *
1926                          * NB: a seq# of 4 is intentional; the decrypted
1927                          *     frame likely has a bogus seq value.
1928                          */
1929                         authalgreject(ni, wh, algo,
1930                             4, IEEE80211_STATUS_CHALLENGE);
1931                         return;
1932                 }
1933                 break;
1934         }
1935
1936         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1937         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
1938                 uint16_t capinfo, lintval;
1939                 struct ieee80211_rsnparms rsnparms;
1940
1941                 if (vap->iv_state != IEEE80211_S_RUN) {
1942                         vap->iv_stats.is_rx_mgtdiscard++;
1943                         return;
1944                 }
1945                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1946                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1947                             wh, NULL, "%s", "wrong bssid");
1948                         vap->iv_stats.is_rx_assoc_bss++;
1949                         return;
1950                 }
1951                 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
1952                         reassoc = 1;
1953                         resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
1954                 } else {
1955                         reassoc = 0;
1956                         resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
1957                 }
1958                 if (ni == vap->iv_bss) {
1959                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1960                             "deny %s request, sta not authenticated",
1961                             reassoc ? "reassoc" : "assoc");
1962                         ieee80211_send_error(ni, wh->i_addr2,
1963                             IEEE80211_FC0_SUBTYPE_DEAUTH,
1964                             IEEE80211_REASON_ASSOC_NOT_AUTHED);
1965                         vap->iv_stats.is_rx_assoc_notauth++;
1966                         return;
1967                 }
1968
1969                 /*
1970                  * asreq frame format
1971                  *      [2] capability information
1972                  *      [2] listen interval
1973                  *      [6*] current AP address (reassoc only)
1974                  *      [tlv] ssid
1975                  *      [tlv] supported rates
1976                  *      [tlv] extended supported rates
1977                  *      [tlv] WPA or RSN
1978                  *      [tlv] HT capabilities
1979                  *      [tlv] Atheros capabilities
1980                  */
1981                 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
1982                 capinfo = le16toh(*(uint16_t *)frm);    frm += 2;
1983                 lintval = le16toh(*(uint16_t *)frm);    frm += 2;
1984                 if (reassoc)
1985                         frm += 6;       /* ignore current AP info */
1986                 ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL;
1987                 sfrm = frm;
1988                 while (efrm - frm > 1) {
1989                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1990                         switch (*frm) {
1991                         case IEEE80211_ELEMID_SSID:
1992                                 ssid = frm;
1993                                 break;
1994                         case IEEE80211_ELEMID_RATES:
1995                                 rates = frm;
1996                                 break;
1997                         case IEEE80211_ELEMID_XRATES:
1998                                 xrates = frm;
1999                                 break;
2000                         case IEEE80211_ELEMID_RSN:
2001                                 rsn = frm;
2002                                 break;
2003                         case IEEE80211_ELEMID_HTCAP:
2004                                 htcap = frm;
2005                                 break;
2006                         case IEEE80211_ELEMID_VENDOR:
2007                                 if (iswpaoui(frm))
2008                                         wpa = frm;
2009                                 else if (iswmeinfo(frm))
2010                                         wme = frm;
2011 #ifdef IEEE80211_SUPPORT_SUPERG
2012                                 else if (isatherosoui(frm))
2013                                         ath = frm;
2014 #endif
2015                                 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
2016                                         if (ishtcapoui(frm) && htcap == NULL)
2017                                                 htcap = frm;
2018                                 }
2019                                 break;
2020                         }
2021                         frm += frm[1] + 2;
2022                 }
2023                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2024                 if (xrates != NULL)
2025                         IEEE80211_VERIFY_ELEMENT(xrates,
2026                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
2027                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2028                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
2029                 if (htcap != NULL) {
2030                         IEEE80211_VERIFY_LENGTH(htcap[1],
2031                              htcap[0] == IEEE80211_ELEMID_VENDOR ?
2032                                  4 + sizeof(struct ieee80211_ie_htcap)-2 :
2033                                  sizeof(struct ieee80211_ie_htcap)-2,
2034                              return);           /* XXX just NULL out? */
2035                 }
2036
2037                 if ((vap->iv_flags & IEEE80211_F_WPA) &&
2038                     !wpa_assocreq(ni, &rsnparms, wh, wpa, rsn, capinfo))
2039                         return;
2040                 /* discard challenge after association */
2041                 if (ni->ni_challenge != NULL) {
2042                         free(ni->ni_challenge, M_80211_NODE);
2043                         ni->ni_challenge = NULL;
2044                 }
2045                 /* NB: 802.11 spec says to ignore station's privacy bit */
2046                 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2047                         capinfomismatch(ni, wh, reassoc, resp,
2048                             "capability", capinfo);
2049                         return;
2050                 }
2051                 /*
2052                  * Disallow re-associate w/ invalid slot time setting.
2053                  */
2054                 if (ni->ni_associd != 0 &&
2055                     IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
2056                     ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
2057                         capinfomismatch(ni, wh, reassoc, resp,
2058                             "slot time", capinfo);
2059                         return;
2060                 }
2061                 rate = ieee80211_setup_rates(ni, rates, xrates,
2062                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2063                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2064                 if (rate & IEEE80211_RATE_BASIC) {
2065                         ratesetmismatch(ni, wh, reassoc, resp, "legacy", rate);
2066                         vap->iv_stats.is_rx_assoc_norate++;
2067                         return;
2068                 }
2069                 /*
2070                  * If constrained to 11g-only stations reject an
2071                  * 11b-only station.  We cheat a bit here by looking
2072                  * at the max negotiated xmit rate and assuming anyone
2073                  * with a best rate <24Mb/s is an 11b station.
2074                  */
2075                 if ((vap->iv_flags & IEEE80211_F_PUREG) && rate < 48) {
2076                         ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);
2077                         vap->iv_stats.is_rx_assoc_norate++;
2078                         return;
2079                 }
2080                 /*
2081                  * Do HT rate set handling and setup HT node state.
2082                  */
2083                 ni->ni_chan = vap->iv_bss->ni_chan;
2084                 if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && htcap != NULL) {
2085                         rate = ieee80211_setup_htrates(ni, htcap,
2086                                 IEEE80211_F_DOFMCS | IEEE80211_F_DONEGO |
2087                                 IEEE80211_F_DOBRS);
2088                         if (rate & IEEE80211_RATE_BASIC) {
2089                                 ratesetmismatch(ni, wh, reassoc, resp,
2090                                     "HT", rate);
2091                                 vap->iv_stats.is_ht_assoc_norate++;
2092                                 return;
2093                         }
2094                         ieee80211_ht_node_init(ni);
2095                         ieee80211_ht_updatehtcap(ni, htcap);
2096                 } else if (ni->ni_flags & IEEE80211_NODE_HT)
2097                         ieee80211_ht_node_cleanup(ni);
2098 #ifdef IEEE80211_SUPPORT_SUPERG
2099                 else if (ni->ni_ath_flags & IEEE80211_NODE_ATH)
2100                         ieee80211_ff_node_cleanup(ni);
2101 #endif
2102                 /*
2103                  * Allow AMPDU operation only with unencrypted traffic
2104                  * or AES-CCM; the 11n spec only specifies these ciphers
2105                  * so permitting any others is undefined and can lead
2106                  * to interoperability problems.
2107                  */
2108                 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
2109                     (((vap->iv_flags & IEEE80211_F_WPA) &&
2110                       rsnparms.rsn_ucastcipher != IEEE80211_CIPHER_AES_CCM) ||
2111                      (vap->iv_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) {
2112                         IEEE80211_NOTE(vap,
2113                             IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
2114                             "disallow HT use because WEP or TKIP requested, "
2115                             "capinfo 0x%x ucastcipher %d", capinfo,
2116                             rsnparms.rsn_ucastcipher);
2117                         ieee80211_ht_node_cleanup(ni);
2118                         vap->iv_stats.is_ht_assoc_downgrade++;
2119                 }
2120                 /*
2121                  * If constrained to 11n-only stations reject legacy stations.
2122                  */
2123                 if ((vap->iv_flags_ht & IEEE80211_FHT_PUREN) &&
2124                     (ni->ni_flags & IEEE80211_NODE_HT) == 0) {
2125                         htcapmismatch(ni, wh, reassoc, resp);
2126                         vap->iv_stats.is_ht_assoc_nohtcap++;
2127                         return;
2128                 }
2129                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
2130                 ni->ni_noise = nf;
2131                 ni->ni_intval = lintval;
2132                 ni->ni_capinfo = capinfo;
2133                 ni->ni_fhdwell = vap->iv_bss->ni_fhdwell;
2134                 ni->ni_fhindex = vap->iv_bss->ni_fhindex;
2135                 /*
2136                  * Store the IEs.
2137                  * XXX maybe better to just expand
2138                  */
2139                 if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {
2140 #define setie(_ie, _off)        ieee80211_ies_setie(ni->ni_ies, _ie, _off)
2141                         if (wpa != NULL)
2142                                 setie(wpa_ie, wpa - sfrm);
2143                         if (rsn != NULL)
2144                                 setie(rsn_ie, rsn - sfrm);
2145                         if (htcap != NULL)
2146                                 setie(htcap_ie, htcap - sfrm);
2147                         if (wme != NULL) {
2148                                 setie(wme_ie, wme - sfrm);
2149                                 /*
2150                                  * Mark node as capable of QoS.
2151                                  */
2152                                 ni->ni_flags |= IEEE80211_NODE_QOS;
2153                         } else
2154                                 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2155 #ifdef IEEE80211_SUPPORT_SUPERG
2156                         if (ath != NULL) {
2157                                 setie(ath_ie, ath - sfrm);
2158                                 /*
2159                                  * Parse ATH station parameters.
2160                                  */
2161                                 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
2162                         } else
2163 #endif
2164                                 ni->ni_ath_flags = 0;
2165 #undef setie
2166                 } else {
2167                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
2168                         ni->ni_ath_flags = 0;
2169                 }
2170                 ieee80211_node_join(ni, resp);
2171                 ieee80211_deliver_l2uf(ni);
2172                 break;
2173         }
2174
2175         case IEEE80211_FC0_SUBTYPE_DEAUTH:
2176         case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2177                 uint16_t reason;
2178
2179                 if (vap->iv_state != IEEE80211_S_RUN ||
2180                     /* NB: can happen when in promiscuous mode */
2181                     !IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
2182                         vap->iv_stats.is_rx_mgtdiscard++;
2183                         break;
2184                 }
2185                 /*
2186                  * deauth/disassoc frame format
2187                  *      [2] reason
2188                  */
2189                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2190                 reason = le16toh(*(uint16_t *)frm);
2191                 if (subtype == IEEE80211_FC0_SUBTYPE_DEAUTH) {
2192                         vap->iv_stats.is_rx_deauth++;
2193                         IEEE80211_NODE_STAT(ni, rx_deauth);
2194                 } else {
2195                         vap->iv_stats.is_rx_disassoc++;
2196                         IEEE80211_NODE_STAT(ni, rx_disassoc);
2197                 }
2198                 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
2199                     "recv %s (reason %d)", ieee80211_mgt_subtype_name[subtype >>
2200                         IEEE80211_FC0_SUBTYPE_SHIFT], reason);
2201                 if (ni != vap->iv_bss)
2202                         ieee80211_node_leave(ni);
2203                 break;
2204         }
2205
2206         case IEEE80211_FC0_SUBTYPE_ACTION:
2207         case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2208                 if (ni == vap->iv_bss) {
2209                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2210                             wh, NULL, "%s", "unknown node");
2211                         vap->iv_stats.is_rx_mgtdiscard++;
2212                 } else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2213                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2214                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2215                             wh, NULL, "%s", "not for us");
2216                         vap->iv_stats.is_rx_mgtdiscard++;
2217                 } else if (vap->iv_state != IEEE80211_S_RUN) {
2218                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2219                             wh, NULL, "wrong state %s",
2220                             ieee80211_state_name[vap->iv_state]);
2221                         vap->iv_stats.is_rx_mgtdiscard++;
2222                 } else {
2223                         if (ieee80211_parse_action(ni, m0) == 0)
2224                                 (void)ic->ic_recv_action(ni, wh, frm, efrm);
2225                 }
2226                 break;
2227
2228         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2229         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2230         case IEEE80211_FC0_SUBTYPE_ATIM:
2231                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2232                     wh, NULL, "%s", "not handled");
2233                 vap->iv_stats.is_rx_mgtdiscard++;
2234                 break;
2235
2236         default:
2237                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2238                     wh, "mgt", "subtype 0x%x not handled", subtype);
2239                 vap->iv_stats.is_rx_badsubtype++;
2240                 break;
2241         }
2242 }
2243
2244 static void
2245 hostap_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2246 {
2247         switch (subtype) {
2248         case IEEE80211_FC0_SUBTYPE_PS_POLL:
2249                 ni->ni_vap->iv_recv_pspoll(ni, m);
2250                 break;
2251         case IEEE80211_FC0_SUBTYPE_BAR:
2252                 ieee80211_recv_bar(ni, m);
2253                 break;
2254         }
2255 }
2256
2257 /*
2258  * Process a received ps-poll frame.
2259  */
2260 void
2261 ieee80211_recv_pspoll(struct ieee80211_node *ni, struct mbuf *m0)
2262 {
2263         struct ieee80211vap *vap = ni->ni_vap;
2264         struct ieee80211com *ic = vap->iv_ic;
2265         struct ieee80211_frame_min *wh;
2266         struct mbuf *m;
2267         uint16_t aid;
2268         int qlen;
2269
2270         wh = mtod(m0, struct ieee80211_frame_min *);
2271         if (ni->ni_associd == 0) {
2272                 IEEE80211_DISCARD(vap,
2273                     IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2274                     (struct ieee80211_frame *) wh, NULL,
2275                     "%s", "unassociated station");
2276                 vap->iv_stats.is_ps_unassoc++;
2277                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2278                         IEEE80211_REASON_NOT_ASSOCED);
2279                 return;
2280         }
2281
2282         aid = le16toh(*(uint16_t *)wh->i_dur);
2283         if (aid != ni->ni_associd) {
2284                 IEEE80211_DISCARD(vap,
2285                     IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2286                     (struct ieee80211_frame *) wh, NULL,
2287                     "aid mismatch: sta aid 0x%x poll aid 0x%x",
2288                     ni->ni_associd, aid);
2289                 vap->iv_stats.is_ps_badaid++;
2290                 /*
2291                  * NB: We used to deauth the station but it turns out
2292                  * the Blackberry Curve 8230 (and perhaps other devices)
2293                  * sometimes send the wrong AID when WME is negotiated.
2294                  * Being more lenient here seems ok as we already check
2295                  * the station is associated and we only return frames
2296                  * queued for the station (i.e. we don't use the AID).
2297                  */
2298                 return;
2299         }
2300
2301         /* Okay, take the first queued packet and put it out... */
2302         m = ieee80211_node_psq_dequeue(ni, &qlen);
2303         if (m == NULL) {
2304                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_POWER, wh->i_addr2,
2305                     "%s", "recv ps-poll, but queue empty");
2306                 ieee80211_send_nulldata(ieee80211_ref_node(ni));
2307                 vap->iv_stats.is_ps_qempty++;   /* XXX node stat */
2308                 if (vap->iv_set_tim != NULL)
2309                         vap->iv_set_tim(ni, 0); /* just in case */
2310                 return;
2311         }
2312         /*
2313          * If there are more packets, set the more packets bit
2314          * in the packet dispatched to the station; otherwise
2315          * turn off the TIM bit.
2316          */
2317         if (qlen != 0) {
2318                 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2319                     "recv ps-poll, send packet, %u still queued", qlen);
2320                 m->m_flags |= M_MORE_DATA;
2321         } else {
2322                 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2323                     "%s", "recv ps-poll, send packet, queue empty");
2324                 if (vap->iv_set_tim != NULL)
2325                         vap->iv_set_tim(ni, 0);
2326         }
2327         m->m_flags |= M_PWR_SAV;                /* bypass PS handling */
2328
2329         /*
2330          * Do the right thing; if it's an encap'ed frame then
2331          * call ieee80211_parent_xmitpkt() (and free the ref) else
2332          * call ieee80211_vap_xmitpkt().
2333          */
2334         if (m->m_flags & M_ENCAP) {
2335                 if (ieee80211_parent_xmitpkt(ic, m) != 0)
2336                         ieee80211_free_node(ni);
2337         } else {
2338                 (void) ieee80211_vap_xmitpkt(vap, m);
2339         }
2340 }