sys/net80211/ieee80211_hostap.c

   1 /*-
   2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include <sys/cdefs.h>
  27 #ifdef __FreeBSD__
  28 __FBSDID("$FreeBSD$");
  29 #endif
  30
  31 /*
  32  * IEEE 802.11 HOSTAP mode support.
  33  */
  34 #include "opt_inet.h"
  35 #include "opt_wlan.h"
  36
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/mbuf.h>
  40 #include <sys/malloc.h>
  41 #include <sys/kernel.h>
  42
  43 #include <sys/socket.h>
  44 #include <sys/sockio.h>
  45 #include <sys/endian.h>
  46 #include <sys/errno.h>
  47 #include <sys/proc.h>
  48 #include <sys/sysctl.h>
  49
  50 #include <net/if.h>
  51 #include <net/if_var.h>
  52 #include <net/if_media.h>
  53 #include <net/if_llc.h>
  54 #include <net/ethernet.h>
  55
  56 #include <net/bpf.h>
  57
  58 #include <net80211/ieee80211_var.h>
  59 #include <net80211/ieee80211_hostap.h>
  60 #include <net80211/ieee80211_input.h>
  61 #ifdef IEEE80211_SUPPORT_SUPERG
  62 #include <net80211/ieee80211_superg.h>
  63 #endif
  64 #include <net80211/ieee80211_wds.h>
  65
  66 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
  67
  68 static  void hostap_vattach(struct ieee80211vap *);
  69 static  int hostap_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  70 static  int hostap_input(struct ieee80211_node *ni, struct mbuf *m,
  71             const struct ieee80211_rx_stats *,
  72             int rssi, int nf);
  73 static void hostap_deliver_data(struct ieee80211vap *,
  74             struct ieee80211_node *, struct mbuf *);
  75 static void hostap_recv_mgmt(struct ieee80211_node *, struct mbuf *,
  76             int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf);
  77 static void hostap_recv_ctl(struct ieee80211_node *, struct mbuf *, int);
  78
  79 void
  80 ieee80211_hostap_attach(struct ieee80211com *ic)
  81 {
  82         ic->ic_vattach[IEEE80211_M_HOSTAP] = hostap_vattach;
  83 }
  84
  85 void
  86 ieee80211_hostap_detach(struct ieee80211com *ic)
  87 {
  88 }
  89
  90 static void
  91 hostap_vdetach(struct ieee80211vap *vap)
  92 {
  93 }
  94
  95 static void
  96 hostap_vattach(struct ieee80211vap *vap)
  97 {
  98         vap->iv_newstate = hostap_newstate;
  99         vap->iv_input = hostap_input;
 100         vap->iv_recv_mgmt = hostap_recv_mgmt;
 101         vap->iv_recv_ctl = hostap_recv_ctl;
 102         vap->iv_opdetach = hostap_vdetach;
 103         vap->iv_deliver_data = hostap_deliver_data;
 104         vap->iv_recv_pspoll = ieee80211_recv_pspoll;
 105 }
 106
 107 static void
 108 sta_disassoc(void *arg, struct ieee80211_node *ni)
 109 {
 110
 111         if (ni->ni_associd != 0) {
 112                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DISASSOC,
 113                         IEEE80211_REASON_ASSOC_LEAVE);
 114                 ieee80211_node_leave(ni);
 115         }
 116 }
 117
 118 static void
 119 sta_csa(void *arg, struct ieee80211_node *ni)
 120 {
 121         struct ieee80211vap *vap = ni->ni_vap;
 122
 123         if (ni->ni_associd != 0)
 124                 if (ni->ni_inact > vap->iv_inact_init) {
 125                         ni->ni_inact = vap->iv_inact_init;
 126                         IEEE80211_NOTE(vap, IEEE80211_MSG_INACT, ni,
 127                             "%s: inact %u", __func__, ni->ni_inact);
 128                 }
 129 }
 130
 131 static void
 132 sta_drop(void *arg, struct ieee80211_node *ni)
 133 {
 134
 135         if (ni->ni_associd != 0)
 136                 ieee80211_node_leave(ni);
 137 }
 138
 139 /*
 140  * Does a channel change require associated stations to re-associate
 141  * so protocol state is correct.  This is used when doing CSA across
 142  * bands or similar (e.g. HT -> legacy).
 143  */
 144 static int
 145 isbandchange(struct ieee80211com *ic)
 146 {
 147         return ((ic->ic_bsschan->ic_flags ^ ic->ic_csa_newchan->ic_flags) &
 148             (IEEE80211_CHAN_2GHZ | IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_HALF |
 149              IEEE80211_CHAN_QUARTER | IEEE80211_CHAN_HT)) != 0;
 150 }
 151
 152 /*
 153  * IEEE80211_M_HOSTAP vap state machine handler.
 154  */
 155 static int
 156 hostap_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 157 {
 158         struct ieee80211com *ic = vap->iv_ic;
 159         enum ieee80211_state ostate;
 160
 161         IEEE80211_LOCK_ASSERT(ic);
 162
 163         ostate = vap->iv_state;
 164         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
 165             __func__, ieee80211_state_name[ostate],
 166             ieee80211_state_name[nstate], arg);
 167         vap->iv_state = nstate;                 /* state transition */
 168         if (ostate != IEEE80211_S_SCAN)
 169                 ieee80211_cancel_scan(vap);     /* background scan */
 170         switch (nstate) {
 171         case IEEE80211_S_INIT:
 172                 switch (ostate) {
 173                 case IEEE80211_S_SCAN:
 174                         ieee80211_cancel_scan(vap);
 175                         break;
 176                 case IEEE80211_S_CAC:
 177                         ieee80211_dfs_cac_stop(vap);
 178                         break;
 179                 case IEEE80211_S_RUN:
 180                         ieee80211_iterate_nodes_vap(&ic->ic_sta, vap,
 181                             sta_disassoc, NULL);
 182                         break;
 183                 default:
 184                         break;
 185                 }
 186                 if (ostate != IEEE80211_S_INIT) {
 187                         /* NB: optimize INIT -> INIT case */
 188                         ieee80211_reset_bss(vap);
 189                 }
 190                 if (vap->iv_auth->ia_detach != NULL)
 191                         vap->iv_auth->ia_detach(vap);
 192                 break;
 193         case IEEE80211_S_SCAN:
 194                 switch (ostate) {
 195                 case IEEE80211_S_CSA:
 196                 case IEEE80211_S_RUN:
 197                         ieee80211_iterate_nodes_vap(&ic->ic_sta, vap,
 198                             sta_disassoc, NULL);
 199                         /*
 200                          * Clear overlapping BSS state; the beacon frame
 201                          * will be reconstructed on transition to the RUN
 202                          * state and the timeout routines check if the flag
 203                          * is set before doing anything so this is sufficient.
 204                          */
 205                         ic->ic_flags_ext &= ~IEEE80211_FEXT_NONERP_PR;
 206                         ic->ic_flags_ht &= ~IEEE80211_FHT_NONHT_PR;
 207                         /* fall thru... */
 208                 case IEEE80211_S_CAC:
 209                         /*
 210                          * NB: We may get here because of a manual channel
 211                          *     change in which case we need to stop CAC
 212                          * XXX no need to stop if ostate RUN but it's ok
 213                          */
 214                         ieee80211_dfs_cac_stop(vap);
 215                         /* fall thru... */
 216                 case IEEE80211_S_INIT:
 217                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
 218                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan)) {
 219                                 /*
 220                                  * Already have a channel; bypass the
 221                                  * scan and startup immediately.
 222                                  * ieee80211_create_ibss will call back to
 223                                  * move us to RUN state.
 224                                  */
 225                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
 226                                 break;
 227                         }
 228                         /*
 229                          * Initiate a scan.  We can come here as a result
 230                          * of an IEEE80211_IOC_SCAN_REQ too in which case
 231                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
 232                          * and the scan request parameters will be present
 233                          * in iv_scanreq.  Otherwise we do the default.
 234                          */
 235                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
 236                                 ieee80211_check_scan(vap,
 237                                     vap->iv_scanreq_flags,
 238                                     vap->iv_scanreq_duration,
 239                                     vap->iv_scanreq_mindwell,
 240                                     vap->iv_scanreq_maxdwell,
 241                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
 242                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
 243                         } else
 244                                 ieee80211_check_scan_current(vap);
 245                         break;
 246                 case IEEE80211_S_SCAN:
 247                         /*
 248                          * A state change requires a reset; scan.
 249                          */
 250                         ieee80211_check_scan_current(vap);
 251                         break;
 252                 default:
 253                         break;
 254                 }
 255                 break;
 256         case IEEE80211_S_CAC:
 257                 /*
 258                  * Start CAC on a DFS channel.  We come here when starting
 259                  * a bss on a DFS channel (see ieee80211_create_ibss).
 260                  */
 261                 ieee80211_dfs_cac_start(vap);
 262                 break;
 263         case IEEE80211_S_RUN:
 264                 if (vap->iv_flags & IEEE80211_F_WPA) {
 265                         /* XXX validate prerequisites */
 266                 }
 267                 switch (ostate) {
 268                 case IEEE80211_S_INIT:
 269                         /*
 270                          * Already have a channel; bypass the
 271                          * scan and startup immediately.
 272                          * Note that ieee80211_create_ibss will call
 273                          * back to do a RUN->RUN state change.
 274                          */
 275                         ieee80211_create_ibss(vap,
 276                             ieee80211_ht_adjust_channel(ic,
 277                                 ic->ic_curchan, vap->iv_flags_ht));
 278                         /* NB: iv_bss is changed on return */
 279                         break;
 280                 case IEEE80211_S_CAC:
 281                         /*
 282                          * NB: This is the normal state change when CAC
 283                          * expires and no radar was detected; no need to
 284                          * clear the CAC timer as it's already expired.
 285                          */
 286                         /* fall thru... */
 287                 case IEEE80211_S_CSA:
 288                         /*
 289                          * Shorten inactivity timer of associated stations
 290                          * to weed out sta's that don't follow a CSA.
 291                          */
 292                         ieee80211_iterate_nodes_vap(&ic->ic_sta, vap,
 293                             sta_csa, NULL);
 294                         /*
 295                          * Update bss node channel to reflect where
 296                          * we landed after CSA.
 297                          */
 298                         ieee80211_node_set_chan(vap->iv_bss,
 299                             ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
 300                                 ieee80211_htchanflags(vap->iv_bss->ni_chan)));
 301                         /* XXX bypass debug msgs */
 302                         break;
 303                 case IEEE80211_S_SCAN:
 304                 case IEEE80211_S_RUN:
 305 #ifdef IEEE80211_DEBUG
 306                         if (ieee80211_msg_debug(vap)) {
 307                                 struct ieee80211_node *ni = vap->iv_bss;
 308                                 ieee80211_note(vap,
 309                                     "synchronized with %s ssid ",
 310                                     ether_sprintf(ni->ni_bssid));
 311                                 ieee80211_print_essid(ni->ni_essid,
 312                                     ni->ni_esslen);
 313                                 /* XXX MCS/HT */
 314                                 printf(" channel %d start %uMb\n",
 315                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
 316                                     IEEE80211_RATE2MBS(ni->ni_txrate));
 317                         }
 318 #endif
 319                         break;
 320                 default:
 321                         break;
 322                 }
 323                 /*
 324                  * Start/stop the authenticator.  We delay until here
 325                  * to allow configuration to happen out of order.
 326                  */
 327                 if (vap->iv_auth->ia_attach != NULL) {
 328                         /* XXX check failure */
 329                         vap->iv_auth->ia_attach(vap);
 330                 } else if (vap->iv_auth->ia_detach != NULL) {
 331                         vap->iv_auth->ia_detach(vap);
 332                 }
 333                 ieee80211_node_authorize(vap->iv_bss);
 334                 break;
 335         case IEEE80211_S_CSA:
 336                 if (ostate == IEEE80211_S_RUN && isbandchange(ic)) {
 337                         /*
 338                          * On a ``band change'' silently drop associated
 339                          * stations as they must re-associate before they
 340                          * can pass traffic (as otherwise protocol state
 341                          * such as capabilities and the negotiated rate
 342                          * set may/will be wrong).
 343                          */
 344                         ieee80211_iterate_nodes_vap(&ic->ic_sta, vap,
 345                             sta_drop, NULL);
 346                 }
 347                 break;
 348         default:
 349                 break;
 350         }
 351         return 0;
 352 }
 353
 354 static void
 355 hostap_deliver_data(struct ieee80211vap *vap,
 356         struct ieee80211_node *ni, struct mbuf *m)
 357 {
 358         struct ether_header *eh = mtod(m, struct ether_header *);
 359         struct ifnet *ifp = vap->iv_ifp;
 360
 361         /* clear driver/net80211 flags before passing up */
 362         m->m_flags &= ~(M_MCAST | M_BCAST);
 363         m_clrprotoflags(m);
 364
 365         KASSERT(vap->iv_opmode == IEEE80211_M_HOSTAP,
 366             ("gack, opmode %d", vap->iv_opmode));
 367         /*
 368          * Do accounting.
 369          */
 370         if_inc_counter(ifp, IFCOUNTER_IPACKETS, 1);
 371         IEEE80211_NODE_STAT(ni, rx_data);
 372         IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
 373         if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
 374                 m->m_flags |= M_MCAST;          /* XXX M_BCAST? */
 375                 IEEE80211_NODE_STAT(ni, rx_mcast);
 376         } else
 377                 IEEE80211_NODE_STAT(ni, rx_ucast);
 378
 379         /* perform as a bridge within the AP */
 380         if ((vap->iv_flags & IEEE80211_F_NOBRIDGE) == 0) {
 381                 struct mbuf *mcopy = NULL;
 382
 383                 if (m->m_flags & M_MCAST) {
 384                         mcopy = m_dup(m, M_NOWAIT);
 385                         if (mcopy == NULL)
 386                                 if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
 387                         else
 388                                 mcopy->m_flags |= M_MCAST;
 389                 } else {
 390                         /*
 391                          * Check if the destination is associated with the
 392                          * same vap and authorized to receive traffic.
 393                          * Beware of traffic destined for the vap itself;
 394                          * sending it will not work; just let it be delivered
 395                          * normally.
 396                          */
 397                         struct ieee80211_node *sta = ieee80211_find_vap_node(
 398                              &vap->iv_ic->ic_sta, vap, eh->ether_dhost);
 399                         if (sta != NULL) {
 400                                 if (ieee80211_node_is_authorized(sta)) {
 401                                         /*
 402                                          * Beware of sending to ourself; this
 403                                          * needs to happen via the normal
 404                                          * input path.
 405                                          */
 406                                         if (sta != vap->iv_bss) {
 407                                                 mcopy = m;
 408                                                 m = NULL;
 409                                         }
 410                                 } else {
 411                                         vap->iv_stats.is_rx_unauth++;
 412                                         IEEE80211_NODE_STAT(sta, rx_unauth);
 413                                 }
 414                                 ieee80211_free_node(sta);
 415                         }
 416                 }
 417                 if (mcopy != NULL)
 418                         (void) ieee80211_vap_xmitpkt(vap, mcopy);
 419         }
 420         if (m != NULL) {
 421                 /*
 422                  * Mark frame as coming from vap's interface.
 423                  */
 424                 m->m_pkthdr.rcvif = ifp;
 425                 if (m->m_flags & M_MCAST) {
 426                         /*
 427                          * Spam DWDS vap's w/ multicast traffic.
 428                          */
 429                         /* XXX only if dwds in use? */
 430                         ieee80211_dwds_mcast(vap, m);
 431                 }
 432                 if (ni->ni_vlan != 0) {
 433                         /* attach vlan tag */
 434                         m->m_pkthdr.ether_vtag = ni->ni_vlan;
 435                         m->m_flags |= M_VLANTAG;
 436                 }
 437                 ifp->if_input(ifp, m);
 438         }
 439 }
 440
 441 /*
 442  * Decide if a received management frame should be
 443  * printed when debugging is enabled.  This filters some
 444  * of the less interesting frames that come frequently
 445  * (e.g. beacons).
 446  */
 447 static __inline int
 448 doprint(struct ieee80211vap *vap, int subtype)
 449 {
 450         switch (subtype) {
 451         case IEEE80211_FC0_SUBTYPE_BEACON:
 452                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
 453         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 454                 return 0;
 455         }
 456         return 1;
 457 }
 458
 459 /*
 460  * Process a received frame.  The node associated with the sender
 461  * should be supplied.  If nothing was found in the node table then
 462  * the caller is assumed to supply a reference to iv_bss instead.
 463  * The RSSI and a timestamp are also supplied.  The RSSI data is used
 464  * during AP scanning to select a AP to associate with; it can have
 465  * any units so long as values have consistent units and higher values
 466  * mean ``better signal''.  The receive timestamp is currently not used
 467  * by the 802.11 layer.
 468  */
 469 static int
 470 hostap_input(struct ieee80211_node *ni, struct mbuf *m,
 471     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
 472 {
 473         struct ieee80211vap *vap = ni->ni_vap;
 474         struct ieee80211com *ic = ni->ni_ic;
 475         struct ifnet *ifp = vap->iv_ifp;
 476         struct ieee80211_frame *wh;
 477         struct ieee80211_key *key;
 478         struct ether_header *eh;
 479         int hdrspace, need_tap = 1;     /* mbuf need to be tapped. */
 480         uint8_t dir, type, subtype, qos;
 481         uint8_t *bssid;
 482
 483         if (m->m_flags & M_AMPDU_MPDU) {
 484                 /*
 485                  * Fastpath for A-MPDU reorder q resubmission.  Frames
 486                  * w/ M_AMPDU_MPDU marked have already passed through
 487                  * here but were received out of order and been held on
 488                  * the reorder queue.  When resubmitted they are marked
 489                  * with the M_AMPDU_MPDU flag and we can bypass most of
 490                  * the normal processing.
 491                  */
 492                 wh = mtod(m, struct ieee80211_frame *);
 493                 type = IEEE80211_FC0_TYPE_DATA;
 494                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 495                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
 496                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
 497                 goto resubmit_ampdu;
 498         }
 499
 500         KASSERT(ni != NULL, ("null node"));
 501         ni->ni_inact = ni->ni_inact_reload;
 502
 503         type = -1;                      /* undefined */
 504
 505         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
 506                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 507                     ni->ni_macaddr, NULL,
 508                     "too short (1): len %u", m->m_pkthdr.len);
 509                 vap->iv_stats.is_rx_tooshort++;
 510                 goto out;
 511         }
 512         /*
 513          * Bit of a cheat here, we use a pointer for a 3-address
 514          * frame format but don't reference fields past outside
 515          * ieee80211_frame_min w/o first validating the data is
 516          * present.
 517          */
 518         wh = mtod(m, struct ieee80211_frame *);
 519
 520         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
 521             IEEE80211_FC0_VERSION_0) {
 522                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 523                     ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
 524                     wh->i_fc[0], wh->i_fc[1]);
 525                 vap->iv_stats.is_rx_badversion++;
 526                 goto err;
 527         }
 528
 529         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 530         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 531         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 532         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 533                 if (dir != IEEE80211_FC1_DIR_NODS)
 534                         bssid = wh->i_addr1;
 535                 else if (type == IEEE80211_FC0_TYPE_CTL)
 536                         bssid = wh->i_addr1;
 537                 else {
 538                         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 539                                 IEEE80211_DISCARD_MAC(vap,
 540                                     IEEE80211_MSG_ANY, ni->ni_macaddr,
 541                                     NULL, "too short (2): len %u",
 542                                     m->m_pkthdr.len);
 543                                 vap->iv_stats.is_rx_tooshort++;
 544                                 goto out;
 545                         }
 546                         bssid = wh->i_addr3;
 547                 }
 548                 /*
 549                  * Validate the bssid.
 550                  */
 551                 if (!(type == IEEE80211_FC0_TYPE_MGT &&
 552                       subtype == IEEE80211_FC0_SUBTYPE_BEACON) &&
 553                     !IEEE80211_ADDR_EQ(bssid, vap->iv_bss->ni_bssid) &&
 554                     !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
 555                         /* not interested in */
 556                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 557                             bssid, NULL, "%s", "not to bss");
 558                         vap->iv_stats.is_rx_wrongbss++;
 559                         goto out;
 560                 }
 561
 562                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
 563                 ni->ni_noise = nf;
 564                 if (IEEE80211_HAS_SEQ(type, subtype)) {
 565                         uint8_t tid = ieee80211_gettid(wh);
 566                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
 567                             TID_TO_WME_AC(tid) >= WME_AC_VI)
 568                                 ic->ic_wme.wme_hipri_traffic++;
 569                         if (! ieee80211_check_rxseq(ni, wh, bssid))
 570                                 goto out;
 571                 }
 572         }
 573
 574         switch (type) {
 575         case IEEE80211_FC0_TYPE_DATA:
 576                 hdrspace = ieee80211_hdrspace(ic, wh);
 577                 if (m->m_len < hdrspace &&
 578                     (m = m_pullup(m, hdrspace)) == NULL) {
 579                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 580                             ni->ni_macaddr, NULL,
 581                             "data too short: expecting %u", hdrspace);
 582                         vap->iv_stats.is_rx_tooshort++;
 583                         goto out;               /* XXX */
 584                 }
 585                 if (!(dir == IEEE80211_FC1_DIR_TODS ||
 586                      (dir == IEEE80211_FC1_DIR_DSTODS &&
 587                       (vap->iv_flags & IEEE80211_F_DWDS)))) {
 588                         if (dir != IEEE80211_FC1_DIR_DSTODS) {
 589                                 IEEE80211_DISCARD(vap,
 590                                     IEEE80211_MSG_INPUT, wh, "data",
 591                                     "incorrect dir 0x%x", dir);
 592                         } else {
 593                                 IEEE80211_DISCARD(vap,
 594                                     IEEE80211_MSG_INPUT |
 595                                     IEEE80211_MSG_WDS, wh,
 596                                     "4-address data",
 597                                     "%s", "DWDS not enabled");
 598                         }
 599                         vap->iv_stats.is_rx_wrongdir++;
 600                         goto out;
 601                 }
 602                 /* check if source STA is associated */
 603                 if (ni == vap->iv_bss) {
 604                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 605                             wh, "data", "%s", "unknown src");
 606                         ieee80211_send_error(ni, wh->i_addr2,
 607                             IEEE80211_FC0_SUBTYPE_DEAUTH,
 608                             IEEE80211_REASON_NOT_AUTHED);
 609                         vap->iv_stats.is_rx_notassoc++;
 610                         goto err;
 611                 }
 612                 if (ni->ni_associd == 0) {
 613                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 614                             wh, "data", "%s", "unassoc src");
 615                         IEEE80211_SEND_MGMT(ni,
 616                             IEEE80211_FC0_SUBTYPE_DISASSOC,
 617                             IEEE80211_REASON_NOT_ASSOCED);
 618                         vap->iv_stats.is_rx_notassoc++;
 619                         goto err;
 620                 }
 621
 622                 /*
 623                  * Check for power save state change.
 624                  * XXX out-of-order A-MPDU frames?
 625                  */
 626                 if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
 627                     (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
 628                         vap->iv_node_ps(ni,
 629                                 wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
 630                 /*
 631                  * For 4-address packets handle WDS discovery
 632                  * notifications.  Once a WDS link is setup frames
 633                  * are just delivered to the WDS vap (see below).
 634                  */
 635                 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap == NULL) {
 636                         if (!ieee80211_node_is_authorized(ni)) {
 637                                 IEEE80211_DISCARD(vap,
 638                                     IEEE80211_MSG_INPUT |
 639                                     IEEE80211_MSG_WDS, wh,
 640                                     "4-address data",
 641                                     "%s", "unauthorized port");
 642                                 vap->iv_stats.is_rx_unauth++;
 643                                 IEEE80211_NODE_STAT(ni, rx_unauth);
 644                                 goto err;
 645                         }
 646                         ieee80211_dwds_discover(ni, m);
 647                         return type;
 648                 }
 649
 650                 /*
 651                  * Handle A-MPDU re-ordering.  If the frame is to be
 652                  * processed directly then ieee80211_ampdu_reorder
 653                  * will return 0; otherwise it has consumed the mbuf
 654                  * and we should do nothing more with it.
 655                  */
 656                 if ((m->m_flags & M_AMPDU) &&
 657                     ieee80211_ampdu_reorder(ni, m) != 0) {
 658                         m = NULL;
 659                         goto out;
 660                 }
 661         resubmit_ampdu:
 662
 663                 /*
 664                  * Handle privacy requirements.  Note that we
 665                  * must not be preempted from here until after
 666                  * we (potentially) call ieee80211_crypto_demic;
 667                  * otherwise we may violate assumptions in the
 668                  * crypto cipher modules used to do delayed update
 669                  * of replay sequence numbers.
 670                  */
 671                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 672                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 673                                 /*
 674                                  * Discard encrypted frames when privacy is off.
 675                                  */
 676                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 677                                     wh, "WEP", "%s", "PRIVACY off");
 678                                 vap->iv_stats.is_rx_noprivacy++;
 679                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
 680                                 goto out;
 681                         }
 682                         key = ieee80211_crypto_decap(ni, m, hdrspace);
 683                         if (key == NULL) {
 684                                 /* NB: stats+msgs handled in crypto_decap */
 685                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
 686                                 goto out;
 687                         }
 688                         wh = mtod(m, struct ieee80211_frame *);
 689                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
 690                 } else {
 691                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
 692                         key = NULL;
 693                 }
 694
 695                 /*
 696                  * Save QoS bits for use below--before we strip the header.
 697                  */
 698                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
 699                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
 700                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
 701                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
 702                 } else
 703                         qos = 0;
 704
 705                 /*
 706                  * Next up, any fragmentation.
 707                  */
 708                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 709                         m = ieee80211_defrag(ni, m, hdrspace);
 710                         if (m == NULL) {
 711                                 /* Fragment dropped or frame not complete yet */
 712                                 goto out;
 713                         }
 714                 }
 715                 wh = NULL;              /* no longer valid, catch any uses */
 716
 717                 /*
 718                  * Next strip any MSDU crypto bits.
 719                  */
 720                 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
 721                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 722                             ni->ni_macaddr, "data", "%s", "demic error");
 723                         vap->iv_stats.is_rx_demicfail++;
 724                         IEEE80211_NODE_STAT(ni, rx_demicfail);
 725                         goto out;
 726                 }
 727                 /* copy to listener after decrypt */
 728                 if (ieee80211_radiotap_active_vap(vap))
 729                         ieee80211_radiotap_rx(vap, m);
 730                 need_tap = 0;
 731                 /*
 732                  * Finally, strip the 802.11 header.
 733                  */
 734                 m = ieee80211_decap(vap, m, hdrspace);
 735                 if (m == NULL) {
 736                         /* XXX mask bit to check for both */
 737                         /* don't count Null data frames as errors */
 738                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
 739                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
 740                                 goto out;
 741                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 742                             ni->ni_macaddr, "data", "%s", "decap error");
 743                         vap->iv_stats.is_rx_decap++;
 744                         IEEE80211_NODE_STAT(ni, rx_decap);
 745                         goto err;
 746                 }
 747                 eh = mtod(m, struct ether_header *);
 748                 if (!ieee80211_node_is_authorized(ni)) {
 749                         /*
 750                          * Deny any non-PAE frames received prior to
 751                          * authorization.  For open/shared-key
 752                          * authentication the port is mark authorized
 753                          * after authentication completes.  For 802.1x
 754                          * the port is not marked authorized by the
 755                          * authenticator until the handshake has completed.
 756                          */
 757                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
 758                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 759                                     eh->ether_shost, "data",
 760                                     "unauthorized port: ether type 0x%x len %u",
 761                                     eh->ether_type, m->m_pkthdr.len);
 762                                 vap->iv_stats.is_rx_unauth++;
 763                                 IEEE80211_NODE_STAT(ni, rx_unauth);
 764                                 goto err;
 765                         }
 766                 } else {
 767                         /*
 768                          * When denying unencrypted frames, discard
 769                          * any non-PAE frames received without encryption.
 770                          */
 771                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
 772                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
 773                             eh->ether_type != htons(ETHERTYPE_PAE)) {
 774                                 /*
 775                                  * Drop unencrypted frames.
 776                                  */
 777                                 vap->iv_stats.is_rx_unencrypted++;
 778                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
 779                                 goto out;
 780                         }
 781                 }
 782                 /* XXX require HT? */
 783                 if (qos & IEEE80211_QOS_AMSDU) {
 784                         m = ieee80211_decap_amsdu(ni, m);
 785                         if (m == NULL)
 786                                 return IEEE80211_FC0_TYPE_DATA;
 787                 } else {
 788 #ifdef IEEE80211_SUPPORT_SUPERG
 789                         m = ieee80211_decap_fastframe(vap, ni, m);
 790                         if (m == NULL)
 791                                 return IEEE80211_FC0_TYPE_DATA;
 792 #endif
 793                 }
 794                 if (dir == IEEE80211_FC1_DIR_DSTODS && ni->ni_wdsvap != NULL)
 795                         ieee80211_deliver_data(ni->ni_wdsvap, ni, m);
 796                 else
 797                         hostap_deliver_data(vap, ni, m);
 798                 return IEEE80211_FC0_TYPE_DATA;
 799
 800         case IEEE80211_FC0_TYPE_MGT:
 801                 vap->iv_stats.is_rx_mgmt++;
 802                 IEEE80211_NODE_STAT(ni, rx_mgmt);
 803                 if (dir != IEEE80211_FC1_DIR_NODS) {
 804                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 805                             wh, "mgt", "incorrect dir 0x%x", dir);
 806                         vap->iv_stats.is_rx_wrongdir++;
 807                         goto err;
 808                 }
 809                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 810                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 811                             ni->ni_macaddr, "mgt", "too short: len %u",
 812                             m->m_pkthdr.len);
 813                         vap->iv_stats.is_rx_tooshort++;
 814                         goto out;
 815                 }
 816                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
 817                         /* ensure return frames are unicast */
 818                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 819                             wh, NULL, "source is multicast: %s",
 820                             ether_sprintf(wh->i_addr2));
 821                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
 822                         goto out;
 823                 }
 824 #ifdef IEEE80211_DEBUG
 825                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
 826                     ieee80211_msg_dumppkts(vap)) {
 827                         if_printf(ifp, "received %s from %s rssi %d\n",
 828                             ieee80211_mgt_subtype_name(subtype),
 829                             ether_sprintf(wh->i_addr2), rssi);
 830                 }
 831 #endif
 832                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 833                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
 834                                 /*
 835                                  * Only shared key auth frames with a challenge
 836                                  * should be encrypted, discard all others.
 837                                  */
 838                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 839                                     wh, NULL,
 840                                     "%s", "WEP set but not permitted");
 841                                 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
 842                                 goto out;
 843                         }
 844                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 845                                 /*
 846                                  * Discard encrypted frames when privacy is off.
 847                                  */
 848                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 849                                     wh, NULL, "%s", "WEP set but PRIVACY off");
 850                                 vap->iv_stats.is_rx_noprivacy++;
 851                                 goto out;
 852                         }
 853                         hdrspace = ieee80211_hdrspace(ic, wh);
 854                         key = ieee80211_crypto_decap(ni, m, hdrspace);
 855                         if (key == NULL) {
 856                                 /* NB: stats+msgs handled in crypto_decap */
 857                                 goto out;
 858                         }
 859                         wh = mtod(m, struct ieee80211_frame *);
 860                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
 861                 }
 862                 /*
 863                  * Pass the packet to radiotap before calling iv_recv_mgmt().
 864                  * Otherwise iv_recv_mgmt() might pass another packet to
 865                  * radiotap, resulting in out of order packet captures.
 866                  */
 867                 if (ieee80211_radiotap_active_vap(vap))
 868                         ieee80211_radiotap_rx(vap, m);
 869                 need_tap = 0;
 870                 vap->iv_recv_mgmt(ni, m, subtype, rxs, rssi, nf);
 871                 goto out;
 872
 873         case IEEE80211_FC0_TYPE_CTL:
 874                 vap->iv_stats.is_rx_ctl++;
 875                 IEEE80211_NODE_STAT(ni, rx_ctrl);
 876                 vap->iv_recv_ctl(ni, m, subtype);
 877                 goto out;
 878         default:
 879                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 880                     wh, "bad", "frame type 0x%x", type);
 881                 /* should not come here */
 882                 break;
 883         }
 884 err:
 885         if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
 886 out:
 887         if (m != NULL) {
 888                 if (need_tap && ieee80211_radiotap_active_vap(vap))
 889                         ieee80211_radiotap_rx(vap, m);
 890                 m_freem(m);
 891         }
 892         return type;
 893 }
 894
 895 static void
 896 hostap_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
 897     int rssi, int nf, uint16_t seq, uint16_t status)
 898 {
 899         struct ieee80211vap *vap = ni->ni_vap;
 900
 901         KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
 902
 903         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
 904                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 905                     ni->ni_macaddr, "open auth",
 906                     "bad sta auth mode %u", ni->ni_authmode);
 907                 vap->iv_stats.is_rx_bad_auth++; /* XXX */
 908                 /*
 909                  * Clear any challenge text that may be there if
 910                  * a previous shared key auth failed and then an
 911                  * open auth is attempted.
 912                  */
 913                 if (ni->ni_challenge != NULL) {
 914                         IEEE80211_FREE(ni->ni_challenge, M_80211_NODE);
 915                         ni->ni_challenge = NULL;
 916                 }
 917                 /* XXX hack to workaround calling convention */
 918                 ieee80211_send_error(ni, wh->i_addr2,
 919                     IEEE80211_FC0_SUBTYPE_AUTH,
 920                     (seq + 1) | (IEEE80211_STATUS_ALG<<16));
 921                 return;
 922         }
 923         if (seq != IEEE80211_AUTH_OPEN_REQUEST) {
 924                 vap->iv_stats.is_rx_bad_auth++;
 925                 return;
 926         }
 927         /* always accept open authentication requests */
 928         if (ni == vap->iv_bss) {
 929                 ni = ieee80211_dup_bss(vap, wh->i_addr2);
 930                 if (ni == NULL)
 931                         return;
 932         } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
 933                 (void) ieee80211_ref_node(ni);
 934         /*
 935          * Mark the node as referenced to reflect that it's
 936          * reference count has been bumped to insure it remains
 937          * after the transaction completes.
 938          */
 939         ni->ni_flags |= IEEE80211_NODE_AREF;
 940         /*
 941          * Mark the node as requiring a valid association id
 942          * before outbound traffic is permitted.
 943          */
 944         ni->ni_flags |= IEEE80211_NODE_ASSOCID;
 945
 946         if (vap->iv_acl != NULL &&
 947             vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
 948                 /*
 949                  * When the ACL policy is set to RADIUS we defer the
 950                  * authorization to a user agent.  Dispatch an event,
 951                  * a subsequent MLME call will decide the fate of the
 952                  * station.  If the user agent is not present then the
 953                  * node will be reclaimed due to inactivity.
 954                  */
 955                 IEEE80211_NOTE_MAC(vap,
 956                     IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL, ni->ni_macaddr,
 957                     "%s", "station authentication defered (radius acl)");
 958                 ieee80211_notify_node_auth(ni);
 959         } else {
 960                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
 961                 IEEE80211_NOTE_MAC(vap,
 962                     IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni->ni_macaddr,
 963                     "%s", "station authenticated (open)");
 964                 /*
 965                  * When 802.1x is not in use mark the port
 966                  * authorized at this point so traffic can flow.
 967                  */
 968                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 969                         ieee80211_node_authorize(ni);
 970         }
 971 }
 972
 973 static void
 974 hostap_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
 975     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
 976     uint16_t seq, uint16_t status)
 977 {
 978         struct ieee80211vap *vap = ni->ni_vap;
 979         uint8_t *challenge;
 980         int allocbs, estatus;
 981
 982         KASSERT(vap->iv_state == IEEE80211_S_RUN, ("state %d", vap->iv_state));
 983
 984         /*
 985          * NB: this can happen as we allow pre-shared key
 986          * authentication to be enabled w/o wep being turned
 987          * on so that configuration of these can be done
 988          * in any order.  It may be better to enforce the
 989          * ordering in which case this check would just be
 990          * for sanity/consistency.
 991          */
 992         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 993                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 994                     ni->ni_macaddr, "shared key auth",
 995                     "%s", " PRIVACY is disabled");
 996                 estatus = IEEE80211_STATUS_ALG;
 997                 goto bad;
 998         }
 999         /*
1000          * Pre-shared key authentication is evil; accept
1001          * it only if explicitly configured (it is supported
1002          * mainly for compatibility with clients like Mac OS X).
1003          */
1004         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1005             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1006                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1007                     ni->ni_macaddr, "shared key auth",
1008                     "bad sta auth mode %u", ni->ni_authmode);
1009                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
1010                 estatus = IEEE80211_STATUS_ALG;
1011                 goto bad;
1012         }
1013
1014         challenge = NULL;
1015         if (frm + 1 < efrm) {
1016                 if ((frm[1] + 2) > (efrm - frm)) {
1017                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1018                             ni->ni_macaddr, "shared key auth",
1019                             "ie %d/%d too long",
1020                             frm[0], (frm[1] + 2) - (efrm - frm));
1021                         vap->iv_stats.is_rx_bad_auth++;
1022                         estatus = IEEE80211_STATUS_CHALLENGE;
1023                         goto bad;
1024                 }
1025                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1026                         challenge = frm;
1027                 frm += frm[1] + 2;
1028         }
1029         switch (seq) {
1030         case IEEE80211_AUTH_SHARED_CHALLENGE:
1031         case IEEE80211_AUTH_SHARED_RESPONSE:
1032                 if (challenge == NULL) {
1033                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1034                             ni->ni_macaddr, "shared key auth",
1035                             "%s", "no challenge");
1036                         vap->iv_stats.is_rx_bad_auth++;
1037                         estatus = IEEE80211_STATUS_CHALLENGE;
1038                         goto bad;
1039                 }
1040                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1041                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1042                             ni->ni_macaddr, "shared key auth",
1043                             "bad challenge len %d", challenge[1]);
1044                         vap->iv_stats.is_rx_bad_auth++;
1045                         estatus = IEEE80211_STATUS_CHALLENGE;
1046                         goto bad;
1047                 }
1048         default:
1049                 break;
1050         }
1051         switch (seq) {
1052         case IEEE80211_AUTH_SHARED_REQUEST:
1053                 if (ni == vap->iv_bss) {
1054                         ni = ieee80211_dup_bss(vap, wh->i_addr2);
1055                         if (ni == NULL) {
1056                                 /* NB: no way to return an error */
1057                                 return;
1058                         }
1059                         allocbs = 1;
1060                 } else {
1061                         if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1062                                 (void) ieee80211_ref_node(ni);
1063                         allocbs = 0;
1064                 }
1065                 /*
1066                  * Mark the node as referenced to reflect that it's
1067                  * reference count has been bumped to insure it remains
1068                  * after the transaction completes.
1069                  */
1070                 ni->ni_flags |= IEEE80211_NODE_AREF;
1071                 /*
1072                  * Mark the node as requiring a valid association id
1073                  * before outbound traffic is permitted.
1074                  */
1075                 ni->ni_flags |= IEEE80211_NODE_ASSOCID;
1076                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1077                 ni->ni_noise = nf;
1078                 if (!ieee80211_alloc_challenge(ni)) {
1079                         /* NB: don't return error so they rexmit */
1080                         return;
1081                 }
1082                 get_random_bytes(ni->ni_challenge,
1083                         IEEE80211_CHALLENGE_LEN);
1084                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1085                     ni, "shared key %sauth request", allocbs ? "" : "re");
1086                 /*
1087                  * When the ACL policy is set to RADIUS we defer the
1088                  * authorization to a user agent.  Dispatch an event,
1089                  * a subsequent MLME call will decide the fate of the
1090                  * station.  If the user agent is not present then the
1091                  * node will be reclaimed due to inactivity.
1092                  */
1093                 if (vap->iv_acl != NULL &&
1094                     vap->iv_acl->iac_getpolicy(vap) == IEEE80211_MACCMD_POLICY_RADIUS) {
1095                         IEEE80211_NOTE_MAC(vap,
1096                             IEEE80211_MSG_AUTH | IEEE80211_MSG_ACL,
1097                             ni->ni_macaddr,
1098                             "%s", "station authentication defered (radius acl)");
1099                         ieee80211_notify_node_auth(ni);
1100                         return;
1101                 }
1102                 break;
1103         case IEEE80211_AUTH_SHARED_RESPONSE:
1104                 if (ni == vap->iv_bss) {
1105                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1106                             ni->ni_macaddr, "shared key response",
1107                             "%s", "unknown station");
1108                         /* NB: don't send a response */
1109                         return;
1110                 }
1111                 if (ni->ni_challenge == NULL) {
1112                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1113                             ni->ni_macaddr, "shared key response",
1114                             "%s", "no challenge recorded");
1115                         vap->iv_stats.is_rx_bad_auth++;
1116                         estatus = IEEE80211_STATUS_CHALLENGE;
1117                         goto bad;
1118                 }
1119                 if (memcmp(ni->ni_challenge, &challenge[2],
1120                            challenge[1]) != 0) {
1121                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1122                             ni->ni_macaddr, "shared key response",
1123                             "%s", "challenge mismatch");
1124                         vap->iv_stats.is_rx_auth_fail++;
1125                         estatus = IEEE80211_STATUS_CHALLENGE;
1126                         goto bad;
1127                 }
1128                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1129                     ni, "%s", "station authenticated (shared key)");
1130                 ieee80211_node_authorize(ni);
1131                 break;
1132         default:
1133                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1134                     ni->ni_macaddr, "shared key auth",
1135                     "bad seq %d", seq);
1136                 vap->iv_stats.is_rx_bad_auth++;
1137                 estatus = IEEE80211_STATUS_SEQUENCE;
1138                 goto bad;
1139         }
1140         IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1141         return;
1142 bad:
1143         /*
1144          * Send an error response; but only when operating as an AP.
1145          */
1146         /* XXX hack to workaround calling convention */
1147         ieee80211_send_error(ni, wh->i_addr2,
1148             IEEE80211_FC0_SUBTYPE_AUTH,
1149             (seq + 1) | (estatus<<16));
1150 }
1151
1152 /*
1153  * Convert a WPA cipher selector OUI to an internal
1154  * cipher algorithm.  Where appropriate we also
1155  * record any key length.
1156  */
1157 static int
1158 wpa_cipher(const uint8_t *sel, uint8_t *keylen, uint8_t *cipher)
1159 {
1160 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
1161         uint32_t w = le32dec(sel);
1162
1163         switch (w) {
1164         case WPA_SEL(WPA_CSE_NULL):
1165                 *cipher = IEEE80211_CIPHER_NONE;
1166                 break;
1167         case WPA_SEL(WPA_CSE_WEP40):
1168                 if (keylen)
1169                         *keylen = 40 / NBBY;
1170                 *cipher = IEEE80211_CIPHER_WEP;
1171                 break;
1172         case WPA_SEL(WPA_CSE_WEP104):
1173                 if (keylen)
1174                         *keylen = 104 / NBBY;
1175                 *cipher = IEEE80211_CIPHER_WEP;
1176                 break;
1177         case WPA_SEL(WPA_CSE_TKIP):
1178                 *cipher = IEEE80211_CIPHER_TKIP;
1179                 break;
1180         case WPA_SEL(WPA_CSE_CCMP):
1181                 *cipher = IEEE80211_CIPHER_AES_CCM;
1182                 break;
1183         default:
1184                 return (EINVAL);
1185         }
1186
1187         return (0);
1188 #undef WPA_SEL
1189 }
1190
1191 /*
1192  * Convert a WPA key management/authentication algorithm
1193  * to an internal code.
1194  */
1195 static int
1196 wpa_keymgmt(const uint8_t *sel)
1197 {
1198 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
1199         uint32_t w = le32dec(sel);
1200
1201         switch (w) {
1202         case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1203                 return WPA_ASE_8021X_UNSPEC;
1204         case WPA_SEL(WPA_ASE_8021X_PSK):
1205                 return WPA_ASE_8021X_PSK;
1206         case WPA_SEL(WPA_ASE_NONE):
1207                 return WPA_ASE_NONE;
1208         }
1209         return 0;               /* NB: so is discarded */
1210 #undef WPA_SEL
1211 }
1212
1213 /*
1214  * Parse a WPA information element to collect parameters.
1215  * Note that we do not validate security parameters; that
1216  * is handled by the authenticator; the parsing done here
1217  * is just for internal use in making operational decisions.
1218  */
1219 static int
1220 ieee80211_parse_wpa(struct ieee80211vap *vap, const uint8_t *frm,
1221         struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1222 {
1223         uint8_t len = frm[1];
1224         uint32_t w;
1225         int error, n;
1226
1227         /*
1228          * Check the length once for fixed parts: OUI, type,
1229          * version, mcast cipher, and 2 selector counts.
1230          * Other, variable-length data, must be checked separately.
1231          */
1232         if ((vap->iv_flags & IEEE80211_F_WPA1) == 0) {
1233                 IEEE80211_DISCARD_IE(vap,
1234                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1235                     wh, "WPA", "not WPA, flags 0x%x", vap->iv_flags);
1236                 return IEEE80211_REASON_IE_INVALID;
1237         }
1238         if (len < 14) {
1239                 IEEE80211_DISCARD_IE(vap,
1240                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1241                     wh, "WPA", "too short, len %u", len);
1242                 return IEEE80211_REASON_IE_INVALID;
1243         }
1244         frm += 6, len -= 4;             /* NB: len is payload only */
1245         /* NB: iswpaoui already validated the OUI and type */
1246         w = le16dec(frm);
1247         if (w != WPA_VERSION) {
1248                 IEEE80211_DISCARD_IE(vap,
1249                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1250                     wh, "WPA", "bad version %u", w);
1251                 return IEEE80211_REASON_IE_INVALID;
1252         }
1253         frm += 2, len -= 2;
1254
1255         memset(rsn, 0, sizeof(*rsn));
1256
1257         /* multicast/group cipher */
1258         error = wpa_cipher(frm, &rsn->rsn_mcastkeylen, &rsn->rsn_mcastcipher);
1259         if (error != 0) {
1260                 IEEE80211_DISCARD_IE(vap,
1261                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1262                     wh, "WPA", "unknown mcast cipher suite %08X",
1263                     le32dec(frm));
1264                 return IEEE80211_REASON_GROUP_CIPHER_INVALID;
1265         }
1266         frm += 4, len -= 4;
1267
1268         /* unicast ciphers */
1269         n = le16dec(frm);
1270         frm += 2, len -= 2;
1271         if (len < n*4+2) {
1272                 IEEE80211_DISCARD_IE(vap,
1273                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1274                     wh, "WPA", "ucast cipher data too short; len %u, n %u",
1275                     len, n);
1276                 return IEEE80211_REASON_IE_INVALID;
1277         }
1278         w = 0;
1279         for (; n > 0; n--) {
1280                 uint8_t cipher;
1281
1282                 error = wpa_cipher(frm, &rsn->rsn_ucastkeylen, &cipher);
1283                 if (error == 0)
1284                         w |= 1 << cipher;
1285
1286                 frm += 4, len -= 4;
1287         }
1288         if (w == 0) {
1289                 IEEE80211_DISCARD_IE(vap,
1290                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1291                     wh, "WPA", "no usable pairwise cipher suite found (w=%d)",
1292                     w);
1293                 return IEEE80211_REASON_PAIRWISE_CIPHER_INVALID;
1294         }
1295         /* XXX other? */
1296         if (w & (1 << IEEE80211_CIPHER_AES_CCM))
1297                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1298         else
1299                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1300
1301         /* key management algorithms */
1302         n = le16dec(frm);
1303         frm += 2, len -= 2;
1304         if (len < n*4) {
1305                 IEEE80211_DISCARD_IE(vap,
1306                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1307                     wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1308                     len, n);
1309                 return IEEE80211_REASON_IE_INVALID;
1310         }
1311         w = 0;
1312         for (; n > 0; n--) {
1313                 w |= wpa_keymgmt(frm);
1314                 frm += 4, len -= 4;
1315         }
1316         if (w & WPA_ASE_8021X_UNSPEC)
1317                 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1318         else
1319                 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1320
1321         if (len > 2)            /* optional capabilities */
1322                 rsn->rsn_caps = le16dec(frm);
1323
1324         return 0;
1325 }
1326
1327 /*
1328  * Convert an RSN cipher selector OUI to an internal
1329  * cipher algorithm.  Where appropriate we also
1330  * record any key length.
1331  */
1332 static int
1333 rsn_cipher(const uint8_t *sel, uint8_t *keylen, uint8_t *cipher)
1334 {
1335 #define RSN_SEL(x)      (((x)<<24)|RSN_OUI)
1336         uint32_t w = le32dec(sel);
1337
1338         switch (w) {
1339         case RSN_SEL(RSN_CSE_NULL):
1340                 *cipher = IEEE80211_CIPHER_NONE;
1341                 break;
1342         case RSN_SEL(RSN_CSE_WEP40):
1343                 if (keylen)
1344                         *keylen = 40 / NBBY;
1345                 *cipher = IEEE80211_CIPHER_WEP;
1346                 break;
1347         case RSN_SEL(RSN_CSE_WEP104):
1348                 if (keylen)
1349                         *keylen = 104 / NBBY;
1350                 *cipher = IEEE80211_CIPHER_WEP;
1351                 break;
1352         case RSN_SEL(RSN_CSE_TKIP):
1353                 *cipher = IEEE80211_CIPHER_TKIP;
1354                 break;
1355         case RSN_SEL(RSN_CSE_CCMP):
1356                 *cipher = IEEE80211_CIPHER_AES_CCM;
1357                 break;
1358         case RSN_SEL(RSN_CSE_WRAP):
1359                 *cipher = IEEE80211_CIPHER_AES_OCB;
1360                 break;
1361         default:
1362                 return (EINVAL);
1363         }
1364
1365         return (0);
1366 #undef WPA_SEL
1367 }
1368
1369 /*
1370  * Convert an RSN key management/authentication algorithm
1371  * to an internal code.
1372  */
1373 static int
1374 rsn_keymgmt(const uint8_t *sel)
1375 {
1376 #define RSN_SEL(x)      (((x)<<24)|RSN_OUI)
1377         uint32_t w = le32dec(sel);
1378
1379         switch (w) {
1380         case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1381                 return RSN_ASE_8021X_UNSPEC;
1382         case RSN_SEL(RSN_ASE_8021X_PSK):
1383                 return RSN_ASE_8021X_PSK;
1384         case RSN_SEL(RSN_ASE_NONE):
1385                 return RSN_ASE_NONE;
1386         }
1387         return 0;               /* NB: so is discarded */
1388 #undef RSN_SEL
1389 }
1390
1391 /*
1392  * Parse a WPA/RSN information element to collect parameters
1393  * and validate the parameters against what has been
1394  * configured for the system.
1395  */
1396 static int
1397 ieee80211_parse_rsn(struct ieee80211vap *vap, const uint8_t *frm,
1398         struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1399 {
1400         uint8_t len = frm[1];
1401         uint32_t w;
1402         int error, n;
1403
1404         /*
1405          * Check the length once for fixed parts:
1406          * version, mcast cipher, and 2 selector counts.
1407          * Other, variable-length data, must be checked separately.
1408          */
1409         if ((vap->iv_flags & IEEE80211_F_WPA2) == 0) {
1410                 IEEE80211_DISCARD_IE(vap,
1411                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1412                     wh, "WPA", "not RSN, flags 0x%x", vap->iv_flags);
1413                 return IEEE80211_REASON_IE_INVALID;
1414         }
1415         /* XXX may be shorter */
1416         if (len < 10) {
1417                 IEEE80211_DISCARD_IE(vap,
1418                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1419                     wh, "RSN", "too short, len %u", len);
1420                 return IEEE80211_REASON_IE_INVALID;
1421         }
1422         frm += 2;
1423         w = le16dec(frm);
1424         if (w != RSN_VERSION) {
1425                 IEEE80211_DISCARD_IE(vap,
1426                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1427                     wh, "RSN", "bad version %u", w);
1428                 return IEEE80211_REASON_UNSUPP_RSN_IE_VERSION;
1429         }
1430         frm += 2, len -= 2;
1431
1432         memset(rsn, 0, sizeof(*rsn));
1433
1434         /* multicast/group cipher */
1435         error = rsn_cipher(frm, &rsn->rsn_mcastkeylen, &rsn->rsn_mcastcipher);
1436         if (error != 0) {
1437                 IEEE80211_DISCARD_IE(vap,
1438                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1439                     wh, "RSN", "unknown mcast cipher suite %08X",
1440                     le32dec(frm));
1441                 return IEEE80211_REASON_GROUP_CIPHER_INVALID;
1442         }
1443         if (rsn->rsn_mcastcipher == IEEE80211_CIPHER_NONE) {
1444                 IEEE80211_DISCARD_IE(vap,
1445                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1446                     wh, "RSN", "invalid mcast cipher suite %d",
1447                     rsn->rsn_mcastcipher);
1448                 return IEEE80211_REASON_GROUP_CIPHER_INVALID;
1449         }
1450         frm += 4, len -= 4;
1451
1452         /* unicast ciphers */
1453         n = le16dec(frm);
1454         frm += 2, len -= 2;
1455         if (len < n*4+2) {
1456                 IEEE80211_DISCARD_IE(vap,
1457                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1458                     wh, "RSN", "ucast cipher data too short; len %u, n %u",
1459                     len, n);
1460                 return IEEE80211_REASON_IE_INVALID;
1461         }
1462         w = 0;
1463
1464         for (; n > 0; n--) {
1465                 uint8_t cipher;
1466
1467                 error = rsn_cipher(frm, &rsn->rsn_ucastkeylen, &cipher);
1468                 if (error == 0)
1469                         w |= 1 << cipher;
1470
1471                 frm += 4, len -= 4;
1472         }
1473         if (w & (1 << IEEE80211_CIPHER_AES_CCM))
1474                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1475         else if (w & (1 << IEEE80211_CIPHER_AES_OCB))
1476                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_OCB;
1477         else if (w & (1 << IEEE80211_CIPHER_TKIP))
1478                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1479         else if ((w & (1 << IEEE80211_CIPHER_NONE)) &&
1480             (rsn->rsn_mcastcipher == IEEE80211_CIPHER_WEP ||
1481              rsn->rsn_mcastcipher == IEEE80211_CIPHER_TKIP))
1482                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_NONE;
1483         else {
1484                 IEEE80211_DISCARD_IE(vap,
1485                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1486                     wh, "RSN", "no usable pairwise cipher suite found (w=%d)",
1487                     w);
1488                 return IEEE80211_REASON_PAIRWISE_CIPHER_INVALID;
1489         }
1490
1491         /* key management algorithms */
1492         n = le16dec(frm);
1493         frm += 2, len -= 2;
1494         if (len < n*4) {
1495                 IEEE80211_DISCARD_IE(vap,
1496                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1497                     wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1498                     len, n);
1499                 return IEEE80211_REASON_IE_INVALID;
1500         }
1501         w = 0;
1502         for (; n > 0; n--) {
1503                 w |= rsn_keymgmt(frm);
1504                 frm += 4, len -= 4;
1505         }
1506         if (w & RSN_ASE_8021X_UNSPEC)
1507                 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1508         else
1509                 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1510
1511         /* optional RSN capabilities */
1512         if (len > 2)
1513                 rsn->rsn_caps = le16dec(frm);
1514         /* XXXPMKID */
1515
1516         return 0;
1517 }
1518
1519 /*
1520  * WPA/802.11i association request processing.
1521  */
1522 static int
1523 wpa_assocreq(struct ieee80211_node *ni, struct ieee80211_rsnparms *rsnparms,
1524         const struct ieee80211_frame *wh, const uint8_t *wpa,
1525         const uint8_t *rsn, uint16_t capinfo)
1526 {
1527         struct ieee80211vap *vap = ni->ni_vap;
1528         uint8_t reason;
1529         int badwparsn;
1530
1531         ni->ni_flags &= ~(IEEE80211_NODE_WPS|IEEE80211_NODE_TSN);
1532         if (wpa == NULL && rsn == NULL) {
1533                 if (vap->iv_flags_ext & IEEE80211_FEXT_WPS) {
1534                         /*
1535                          * W-Fi Protected Setup (WPS) permits
1536                          * clients to associate and pass EAPOL frames
1537                          * to establish initial credentials.
1538                          */
1539                         ni->ni_flags |= IEEE80211_NODE_WPS;
1540                         return 1;
1541                 }
1542                 if ((vap->iv_flags_ext & IEEE80211_FEXT_TSN) &&
1543                     (capinfo & IEEE80211_CAPINFO_PRIVACY)) {
1544                         /*
1545                          * Transitional Security Network.  Permits clients
1546                          * to associate and use WEP while WPA is configured.
1547                          */
1548                         ni->ni_flags |= IEEE80211_NODE_TSN;
1549                         return 1;
1550                 }
1551                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1552                     wh, NULL, "%s", "no WPA/RSN IE in association request");
1553                 vap->iv_stats.is_rx_assoc_badwpaie++;
1554                 reason = IEEE80211_REASON_IE_INVALID;
1555                 goto bad;
1556         }
1557         /* assert right association security credentials */
1558         badwparsn = 0;                  /* NB: to silence compiler */
1559         switch (vap->iv_flags & IEEE80211_F_WPA) {
1560         case IEEE80211_F_WPA1:
1561                 badwparsn = (wpa == NULL);
1562                 break;
1563         case IEEE80211_F_WPA2:
1564                 badwparsn = (rsn == NULL);
1565                 break;
1566         case IEEE80211_F_WPA1|IEEE80211_F_WPA2:
1567                 badwparsn = (wpa == NULL && rsn == NULL);
1568                 break;
1569         }
1570         if (badwparsn) {
1571                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
1572                     wh, NULL,
1573                     "%s", "missing WPA/RSN IE in association request");
1574                 vap->iv_stats.is_rx_assoc_badwpaie++;
1575                 reason = IEEE80211_REASON_IE_INVALID;
1576                 goto bad;
1577         }
1578         /*
1579          * Parse WPA/RSN information element.
1580          */
1581         if (wpa != NULL)
1582                 reason = ieee80211_parse_wpa(vap, wpa, rsnparms, wh);
1583         else
1584                 reason = ieee80211_parse_rsn(vap, rsn, rsnparms, wh);
1585         if (reason != 0) {
1586                 /* XXX wpa->rsn fallback? */
1587                 /* XXX distinguish WPA/RSN? */
1588                 vap->iv_stats.is_rx_assoc_badwpaie++;
1589                 goto bad;
1590         }
1591         IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA, ni,
1592             "%s ie: mc %u/%u uc %u/%u key %u caps 0x%x",
1593             wpa != NULL ? "WPA" : "RSN",
1594             rsnparms->rsn_mcastcipher, rsnparms->rsn_mcastkeylen,
1595             rsnparms->rsn_ucastcipher, rsnparms->rsn_ucastkeylen,
1596             rsnparms->rsn_keymgmt, rsnparms->rsn_caps);
1597
1598         return 1;
1599 bad:
1600         ieee80211_node_deauth(ni, reason);
1601         return 0;
1602 }
1603
1604 /* XXX find a better place for definition */
1605 struct l2_update_frame {
1606         struct ether_header eh;
1607         uint8_t dsap;
1608         uint8_t ssap;
1609         uint8_t control;
1610         uint8_t xid[3];
1611 }  __packed;
1612
1613 /*
1614  * Deliver a TGf L2UF frame on behalf of a station.
1615  * This primes any bridge when the station is roaming
1616  * between ap's on the same wired network.
1617  */
1618 static void
1619 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1620 {
1621         struct ieee80211vap *vap = ni->ni_vap;
1622         struct ifnet *ifp = vap->iv_ifp;
1623         struct mbuf *m;
1624         struct l2_update_frame *l2uf;
1625         struct ether_header *eh;
1626
1627         m = m_gethdr(M_NOWAIT, MT_DATA);
1628         if (m == NULL) {
1629                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1630                     "%s", "no mbuf for l2uf frame");
1631                 vap->iv_stats.is_rx_nobuf++;    /* XXX not right */
1632                 return;
1633         }
1634         l2uf = mtod(m, struct l2_update_frame *);
1635         eh = &l2uf->eh;
1636         /* dst: Broadcast address */
1637         IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1638         /* src: associated STA */
1639         IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1640         eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1641
1642         l2uf->dsap = 0;
1643         l2uf->ssap = 0;
1644         l2uf->control = 0xf5;
1645         l2uf->xid[0] = 0x81;
1646         l2uf->xid[1] = 0x80;
1647         l2uf->xid[2] = 0x00;
1648
1649         m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1650         hostap_deliver_data(vap, ni, m);
1651 }
1652
1653 static void
1654 ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1655         int reassoc, int resp, const char *tag, int rate)
1656 {
1657         IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1658             "deny %s request, %s rate set mismatch, rate/MCS %d",
1659             reassoc ? "reassoc" : "assoc", tag, rate & IEEE80211_RATE_VAL);
1660         IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_BASIC_RATE);
1661         ieee80211_node_leave(ni);
1662 }
1663
1664 static void
1665 capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1666         int reassoc, int resp, const char *tag, int capinfo)
1667 {
1668         struct ieee80211vap *vap = ni->ni_vap;
1669
1670         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
1671             "deny %s request, %s mismatch 0x%x",
1672             reassoc ? "reassoc" : "assoc", tag, capinfo);
1673         IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_CAPINFO);
1674         ieee80211_node_leave(ni);
1675         vap->iv_stats.is_rx_assoc_capmismatch++;
1676 }
1677
1678 static void
1679 htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1680         int reassoc, int resp)
1681 {
1682         IEEE80211_NOTE_MAC(ni->ni_vap, IEEE80211_MSG_ANY, wh->i_addr2,
1683             "deny %s request, %s missing HT ie", reassoc ? "reassoc" : "assoc");
1684         /* XXX no better code */
1685         IEEE80211_SEND_MGMT(ni, resp, IEEE80211_STATUS_MISSING_HT_CAPS);
1686         ieee80211_node_leave(ni);
1687 }
1688
1689 static void
1690 authalgreject(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1691         int algo, int seq, int status)
1692 {
1693         struct ieee80211vap *vap = ni->ni_vap;
1694
1695         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1696             wh, NULL, "unsupported alg %d", algo);
1697         vap->iv_stats.is_rx_auth_unsupported++;
1698         ieee80211_send_error(ni, wh->i_addr2, IEEE80211_FC0_SUBTYPE_AUTH,
1699             seq | (status << 16));
1700 }
1701
1702 static __inline int
1703 ishtmixed(const uint8_t *ie)
1704 {
1705         const struct ieee80211_ie_htinfo *ht =
1706             (const struct ieee80211_ie_htinfo *) ie;
1707         return (ht->hi_byte2 & IEEE80211_HTINFO_OPMODE) ==
1708             IEEE80211_HTINFO_OPMODE_MIXED;
1709 }
1710
1711 static int
1712 is11bclient(const uint8_t *rates, const uint8_t *xrates)
1713 {
1714         static const uint32_t brates = (1<<2*1)|(1<<2*2)|(1<<11)|(1<<2*11);
1715         int i;
1716
1717         /* NB: the 11b clients we care about will not have xrates */
1718         if (xrates != NULL || rates == NULL)
1719                 return 0;
1720         for (i = 0; i < rates[1]; i++) {
1721                 int r = rates[2+i] & IEEE80211_RATE_VAL;
1722                 if (r > 2*11 || ((1<<r) & brates) == 0)
1723                         return 0;
1724         }
1725         return 1;
1726 }
1727
1728 static void
1729 hostap_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1730         int subtype, const struct ieee80211_rx_stats *rxs, int rssi, int nf)
1731 {
1732         struct ieee80211vap *vap = ni->ni_vap;
1733         struct ieee80211com *ic = ni->ni_ic;
1734         struct ieee80211_frame *wh;
1735         uint8_t *frm, *efrm, *sfrm;
1736         uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap;
1737         int reassoc, resp;
1738         uint8_t rate;
1739
1740         wh = mtod(m0, struct ieee80211_frame *);
1741         frm = (uint8_t *)&wh[1];
1742         efrm = mtod(m0, uint8_t *) + m0->m_len;
1743         switch (subtype) {
1744         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1745                 /*
1746                  * We process beacon/probe response frames when scanning;
1747                  * otherwise we check beacon frames for overlapping non-ERP
1748                  * BSS in 11g and/or overlapping legacy BSS when in HT.
1749                  */
1750                 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1751                         vap->iv_stats.is_rx_mgtdiscard++;
1752                         return;
1753                 }
1754                 /* FALLTHROUGH */
1755         case IEEE80211_FC0_SUBTYPE_BEACON: {
1756                 struct ieee80211_scanparams scan;
1757
1758                 /* NB: accept off-channel frames */
1759                 /* XXX TODO: use rxstatus to determine off-channel details */
1760                 if (ieee80211_parse_beacon(ni, m0, ic->ic_curchan, &scan) &~ IEEE80211_BPARSE_OFFCHAN)
1761                         return;
1762                 /*
1763                  * Count frame now that we know it's to be processed.
1764                  */
1765                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1766                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
1767                         IEEE80211_NODE_STAT(ni, rx_beacons);
1768                 } else
1769                         IEEE80211_NODE_STAT(ni, rx_proberesp);
1770                 /*
1771                  * If scanning, just pass information to the scan module.
1772                  */
1773                 if (ic->ic_flags & IEEE80211_F_SCAN) {
1774                         if (scan.status == 0 &&         /* NB: on channel */
1775                             (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN)) {
1776                                 /*
1777                                  * Actively scanning a channel marked passive;
1778                                  * send a probe request now that we know there
1779                                  * is 802.11 traffic present.
1780                                  *
1781                                  * XXX check if the beacon we recv'd gives
1782                                  * us what we need and suppress the probe req
1783                                  */
1784                                 ieee80211_probe_curchan(vap, 1);
1785                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1786                         }
1787                         ieee80211_add_scan(vap, ic->ic_curchan, &scan, wh,
1788                             subtype, rssi, nf);
1789                         return;
1790                 }
1791                 /*
1792                  * Check beacon for overlapping bss w/ non ERP stations.
1793                  * If we detect one and protection is configured but not
1794                  * enabled, enable it and start a timer that'll bring us
1795                  * out if we stop seeing the bss.
1796                  */
1797                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1798                     scan.status == 0 &&                 /* NB: on-channel */
1799                     ((scan.erp & 0x100) == 0 ||         /* NB: no ERP, 11b sta*/
1800                      (scan.erp & IEEE80211_ERP_NON_ERP_PRESENT))) {
1801                         ic->ic_lastnonerp = ticks;
1802                         ic->ic_flags_ext |= IEEE80211_FEXT_NONERP_PR;
1803                         if (ic->ic_protmode != IEEE80211_PROT_NONE &&
1804                             (ic->ic_flags & IEEE80211_F_USEPROT) == 0) {
1805                                 IEEE80211_NOTE_FRAME(vap,
1806                                     IEEE80211_MSG_ASSOC, wh,
1807                                     "non-ERP present on channel %d "
1808                                     "(saw erp 0x%x from channel %d), "
1809                                     "enable use of protection",
1810                                     ic->ic_curchan->ic_ieee,
1811                                     scan.erp, scan.chan);
1812                                 ic->ic_flags |= IEEE80211_F_USEPROT;
1813                                 ieee80211_notify_erp(ic);
1814                         }
1815                 }
1816                 /*
1817                  * Check beacon for non-HT station on HT channel
1818                  * and update HT BSS occupancy as appropriate.
1819                  */
1820                 if (IEEE80211_IS_CHAN_HT(ic->ic_curchan)) {
1821                         if (scan.status & IEEE80211_BPARSE_OFFCHAN) {
1822                                 /*
1823                                  * Off control channel; only check frames
1824                                  * that come in the extension channel when
1825                                  * operating w/ HT40.
1826                                  */
1827                                 if (!IEEE80211_IS_CHAN_HT40(ic->ic_curchan))
1828                                         break;
1829                                 if (scan.chan != ic->ic_curchan->ic_extieee)
1830                                         break;
1831                         }
1832                         if (scan.htinfo == NULL) {
1833                                 ieee80211_htprot_update(ic,
1834                                     IEEE80211_HTINFO_OPMODE_PROTOPT |
1835                                     IEEE80211_HTINFO_NONHT_PRESENT);
1836                         } else if (ishtmixed(scan.htinfo)) {
1837                                 /* XXX? take NONHT_PRESENT from beacon? */
1838                                 ieee80211_htprot_update(ic,
1839                                     IEEE80211_HTINFO_OPMODE_MIXED |
1840                                     IEEE80211_HTINFO_NONHT_PRESENT);
1841                         }
1842                 }
1843                 break;
1844         }
1845
1846         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1847                 if (vap->iv_state != IEEE80211_S_RUN) {
1848                         vap->iv_stats.is_rx_mgtdiscard++;
1849                         return;
1850                 }
1851                 /*
1852                  * Consult the ACL policy module if setup.
1853                  */
1854                 if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1855                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1856                             wh, NULL, "%s", "disallowed by ACL");
1857                         vap->iv_stats.is_rx_acl++;
1858                         return;
1859                 }
1860                 /*
1861                  * prreq frame format
1862                  *      [tlv] ssid
1863                  *      [tlv] supported rates
1864                  *      [tlv] extended supported rates
1865                  */
1866                 ssid = rates = xrates = NULL;
1867                 while (efrm - frm > 1) {
1868                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1869                         switch (*frm) {
1870                         case IEEE80211_ELEMID_SSID:
1871                                 ssid = frm;
1872                                 break;
1873                         case IEEE80211_ELEMID_RATES:
1874                                 rates = frm;
1875                                 break;
1876                         case IEEE80211_ELEMID_XRATES:
1877                                 xrates = frm;
1878                                 break;
1879                         }
1880                         frm += frm[1] + 2;
1881                 }
1882                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1883                 if (xrates != NULL)
1884                         IEEE80211_VERIFY_ELEMENT(xrates,
1885                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
1886                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
1887                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
1888                 if ((vap->iv_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
1889                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1890                             wh, NULL,
1891                             "%s", "no ssid with ssid suppression enabled");
1892                         vap->iv_stats.is_rx_ssidmismatch++; /*XXX*/
1893                         return;
1894                 }
1895
1896                 /* XXX find a better class or define it's own */
1897                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
1898                     "%s", "recv probe req");
1899                 /*
1900                  * Some legacy 11b clients cannot hack a complete
1901                  * probe response frame.  When the request includes
1902                  * only a bare-bones rate set, communicate this to
1903                  * the transmit side.
1904                  */
1905                 ieee80211_send_proberesp(vap, wh->i_addr2,
1906                     is11bclient(rates, xrates) ? IEEE80211_SEND_LEGACY_11B : 0);
1907                 break;
1908
1909         case IEEE80211_FC0_SUBTYPE_AUTH: {
1910                 uint16_t algo, seq, status;
1911
1912                 if (vap->iv_state != IEEE80211_S_RUN) {
1913                         vap->iv_stats.is_rx_mgtdiscard++;
1914                         return;
1915                 }
1916                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1917                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1918                             wh, NULL, "%s", "wrong bssid");
1919                         vap->iv_stats.is_rx_wrongbss++; /*XXX unique stat?*/
1920                         return;
1921                 }
1922                 /*
1923                  * auth frame format
1924                  *      [2] algorithm
1925                  *      [2] sequence
1926                  *      [2] status
1927                  *      [tlv*] challenge
1928                  */
1929                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1930                 algo   = le16toh(*(uint16_t *)frm);
1931                 seq    = le16toh(*(uint16_t *)(frm + 2));
1932                 status = le16toh(*(uint16_t *)(frm + 4));
1933                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1934                     "recv auth frame with algorithm %d seq %d", algo, seq);
1935                 /*
1936                  * Consult the ACL policy module if setup.
1937                  */
1938                 if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh)) {
1939                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1940                             wh, NULL, "%s", "disallowed by ACL");
1941                         vap->iv_stats.is_rx_acl++;
1942                         ieee80211_send_error(ni, wh->i_addr2,
1943                             IEEE80211_FC0_SUBTYPE_AUTH,
1944                             (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
1945                         return;
1946                 }
1947                 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1948                         IEEE80211_DISCARD(vap,
1949                             IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1950                             wh, NULL, "%s", "TKIP countermeasures enabled");
1951                         vap->iv_stats.is_rx_auth_countermeasures++;
1952                         ieee80211_send_error(ni, wh->i_addr2,
1953                                 IEEE80211_FC0_SUBTYPE_AUTH,
1954                                 IEEE80211_REASON_MIC_FAILURE);
1955                         return;
1956                 }
1957                 if (algo == IEEE80211_AUTH_ALG_SHARED)
1958                         hostap_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1959                             seq, status);
1960                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1961                         hostap_auth_open(ni, wh, rssi, nf, seq, status);
1962                 else if (algo == IEEE80211_AUTH_ALG_LEAP) {
1963                         authalgreject(ni, wh, algo,
1964                             seq+1, IEEE80211_STATUS_ALG);
1965                         return;
1966                 } else {
1967                         /*
1968                          * We assume that an unknown algorithm is the result
1969                          * of a decryption failure on a shared key auth frame;
1970                          * return a status code appropriate for that instead
1971                          * of IEEE80211_STATUS_ALG.
1972                          *
1973                          * NB: a seq# of 4 is intentional; the decrypted
1974                          *     frame likely has a bogus seq value.
1975                          */
1976                         authalgreject(ni, wh, algo,
1977                             4, IEEE80211_STATUS_CHALLENGE);
1978                         return;
1979                 }
1980                 break;
1981         }
1982
1983         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1984         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
1985                 uint16_t capinfo, lintval;
1986                 struct ieee80211_rsnparms rsnparms;
1987
1988                 if (vap->iv_state != IEEE80211_S_RUN) {
1989                         vap->iv_stats.is_rx_mgtdiscard++;
1990                         return;
1991                 }
1992                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_bss->ni_bssid)) {
1993                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1994                             wh, NULL, "%s", "wrong bssid");
1995                         vap->iv_stats.is_rx_assoc_bss++;
1996                         return;
1997                 }
1998                 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
1999                         reassoc = 1;
2000                         resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
2001                 } else {
2002                         reassoc = 0;
2003                         resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
2004                 }
2005                 if (ni == vap->iv_bss) {
2006                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ANY, wh->i_addr2,
2007                             "deny %s request, sta not authenticated",
2008                             reassoc ? "reassoc" : "assoc");
2009                         ieee80211_send_error(ni, wh->i_addr2,
2010                             IEEE80211_FC0_SUBTYPE_DEAUTH,
2011                             IEEE80211_REASON_ASSOC_NOT_AUTHED);
2012                         vap->iv_stats.is_rx_assoc_notauth++;
2013                         return;
2014                 }
2015
2016                 /*
2017                  * asreq frame format
2018                  *      [2] capability information
2019                  *      [2] listen interval
2020                  *      [6*] current AP address (reassoc only)
2021                  *      [tlv] ssid
2022                  *      [tlv] supported rates
2023                  *      [tlv] extended supported rates
2024                  *      [tlv] WPA or RSN
2025                  *      [tlv] HT capabilities
2026                  *      [tlv] Atheros capabilities
2027                  */
2028                 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
2029                 capinfo = le16toh(*(uint16_t *)frm);    frm += 2;
2030                 lintval = le16toh(*(uint16_t *)frm);    frm += 2;
2031                 if (reassoc)
2032                         frm += 6;       /* ignore current AP info */
2033                 ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL;
2034                 sfrm = frm;
2035                 while (efrm - frm > 1) {
2036                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2037                         switch (*frm) {
2038                         case IEEE80211_ELEMID_SSID:
2039                                 ssid = frm;
2040                                 break;
2041                         case IEEE80211_ELEMID_RATES:
2042                                 rates = frm;
2043                                 break;
2044                         case IEEE80211_ELEMID_XRATES:
2045                                 xrates = frm;
2046                                 break;
2047                         case IEEE80211_ELEMID_RSN:
2048                                 rsn = frm;
2049                                 break;
2050                         case IEEE80211_ELEMID_HTCAP:
2051                                 htcap = frm;
2052                                 break;
2053                         case IEEE80211_ELEMID_VENDOR:
2054                                 if (iswpaoui(frm))
2055                                         wpa = frm;
2056                                 else if (iswmeinfo(frm))
2057                                         wme = frm;
2058 #ifdef IEEE80211_SUPPORT_SUPERG
2059                                 else if (isatherosoui(frm))
2060                                         ath = frm;
2061 #endif
2062                                 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
2063                                         if (ishtcapoui(frm) && htcap == NULL)
2064                                                 htcap = frm;
2065                                 }
2066                                 break;
2067                         }
2068                         frm += frm[1] + 2;
2069                 }
2070                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
2071                 if (xrates != NULL)
2072                         IEEE80211_VERIFY_ELEMENT(xrates,
2073                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
2074                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
2075                 IEEE80211_VERIFY_SSID(vap->iv_bss, ssid, return);
2076                 if (htcap != NULL) {
2077                         IEEE80211_VERIFY_LENGTH(htcap[1],
2078                              htcap[0] == IEEE80211_ELEMID_VENDOR ?
2079                                  4 + sizeof(struct ieee80211_ie_htcap)-2 :
2080                                  sizeof(struct ieee80211_ie_htcap)-2,
2081                              return);           /* XXX just NULL out? */
2082                 }
2083
2084                 if ((vap->iv_flags & IEEE80211_F_WPA) &&
2085                     !wpa_assocreq(ni, &rsnparms, wh, wpa, rsn, capinfo))
2086                         return;
2087                 /* discard challenge after association */
2088                 if (ni->ni_challenge != NULL) {
2089                         IEEE80211_FREE(ni->ni_challenge, M_80211_NODE);
2090                         ni->ni_challenge = NULL;
2091                 }
2092                 /* NB: 802.11 spec says to ignore station's privacy bit */
2093                 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2094                         capinfomismatch(ni, wh, reassoc, resp,
2095                             "capability", capinfo);
2096                         return;
2097                 }
2098                 /*
2099                  * Disallow re-associate w/ invalid slot time setting.
2100                  */
2101                 if (ni->ni_associd != 0 &&
2102                     IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
2103                     ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
2104                         capinfomismatch(ni, wh, reassoc, resp,
2105                             "slot time", capinfo);
2106                         return;
2107                 }
2108                 rate = ieee80211_setup_rates(ni, rates, xrates,
2109                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2110                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2111                 if (rate & IEEE80211_RATE_BASIC) {
2112                         ratesetmismatch(ni, wh, reassoc, resp, "legacy", rate);
2113                         vap->iv_stats.is_rx_assoc_norate++;
2114                         return;
2115                 }
2116                 /*
2117                  * If constrained to 11g-only stations reject an
2118                  * 11b-only station.  We cheat a bit here by looking
2119                  * at the max negotiated xmit rate and assuming anyone
2120                  * with a best rate <24Mb/s is an 11b station.
2121                  */
2122                 if ((vap->iv_flags & IEEE80211_F_PUREG) && rate < 48) {
2123                         ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);
2124                         vap->iv_stats.is_rx_assoc_norate++;
2125                         return;
2126                 }
2127                 /*
2128                  * Do HT rate set handling and setup HT node state.
2129                  */
2130                 ni->ni_chan = vap->iv_bss->ni_chan;
2131                 if (IEEE80211_IS_CHAN_HT(ni->ni_chan) && htcap != NULL) {
2132                         rate = ieee80211_setup_htrates(ni, htcap,
2133                                 IEEE80211_F_DOFMCS | IEEE80211_F_DONEGO |
2134                                 IEEE80211_F_DOBRS);
2135                         if (rate & IEEE80211_RATE_BASIC) {
2136                                 ratesetmismatch(ni, wh, reassoc, resp,
2137                                     "HT", rate);
2138                                 vap->iv_stats.is_ht_assoc_norate++;
2139                                 return;
2140                         }
2141                         ieee80211_ht_node_init(ni);
2142                         ieee80211_ht_updatehtcap(ni, htcap);
2143                 } else if (ni->ni_flags & IEEE80211_NODE_HT)
2144                         ieee80211_ht_node_cleanup(ni);
2145 #ifdef IEEE80211_SUPPORT_SUPERG
2146                 /* Always do ff node cleanup; for A-MSDU */
2147                 ieee80211_ff_node_cleanup(ni);
2148 #endif
2149                 /*
2150                  * Allow AMPDU operation only with unencrypted traffic
2151                  * or AES-CCM; the 11n spec only specifies these ciphers
2152                  * so permitting any others is undefined and can lead
2153                  * to interoperability problems.
2154                  */
2155                 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
2156                     (((vap->iv_flags & IEEE80211_F_WPA) &&
2157                       rsnparms.rsn_ucastcipher != IEEE80211_CIPHER_AES_CCM) ||
2158                      (vap->iv_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) {
2159                         IEEE80211_NOTE(vap,
2160                             IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
2161                             "disallow HT use because WEP or TKIP requested, "
2162                             "capinfo 0x%x ucastcipher %d", capinfo,
2163                             rsnparms.rsn_ucastcipher);
2164                         ieee80211_ht_node_cleanup(ni);
2165 #ifdef IEEE80211_SUPPORT_SUPERG
2166                         /* Always do ff node cleanup; for A-MSDU */
2167                         ieee80211_ff_node_cleanup(ni);
2168 #endif
2169                         vap->iv_stats.is_ht_assoc_downgrade++;
2170                 }
2171                 /*
2172                  * If constrained to 11n-only stations reject legacy stations.
2173                  */
2174                 if ((vap->iv_flags_ht & IEEE80211_FHT_PUREN) &&
2175                     (ni->ni_flags & IEEE80211_NODE_HT) == 0) {
2176                         htcapmismatch(ni, wh, reassoc, resp);
2177                         vap->iv_stats.is_ht_assoc_nohtcap++;
2178                         return;
2179                 }
2180                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
2181                 ni->ni_noise = nf;
2182                 ni->ni_intval = lintval;
2183                 ni->ni_capinfo = capinfo;
2184                 ni->ni_fhdwell = vap->iv_bss->ni_fhdwell;
2185                 ni->ni_fhindex = vap->iv_bss->ni_fhindex;
2186                 /*
2187                  * Store the IEs.
2188                  * XXX maybe better to just expand
2189                  */
2190                 if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {
2191 #define setie(_ie, _off)        ieee80211_ies_setie(ni->ni_ies, _ie, _off)
2192                         if (wpa != NULL)
2193                                 setie(wpa_ie, wpa - sfrm);
2194                         if (rsn != NULL)
2195                                 setie(rsn_ie, rsn - sfrm);
2196                         if (htcap != NULL)
2197                                 setie(htcap_ie, htcap - sfrm);
2198                         if (wme != NULL) {
2199                                 setie(wme_ie, wme - sfrm);
2200                                 /*
2201                                  * Mark node as capable of QoS.
2202                                  */
2203                                 ni->ni_flags |= IEEE80211_NODE_QOS;
2204                         } else
2205                                 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2206 #ifdef IEEE80211_SUPPORT_SUPERG
2207                         if (ath != NULL) {
2208                                 setie(ath_ie, ath - sfrm);
2209                                 /*
2210                                  * Parse ATH station parameters.
2211                                  */
2212                                 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
2213                         } else
2214 #endif
2215                                 ni->ni_ath_flags = 0;
2216 #undef setie
2217                 } else {
2218                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
2219                         ni->ni_ath_flags = 0;
2220                 }
2221                 ieee80211_node_join(ni, resp);
2222                 ieee80211_deliver_l2uf(ni);
2223                 break;
2224         }
2225
2226         case IEEE80211_FC0_SUBTYPE_DEAUTH:
2227         case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2228                 uint16_t reason;
2229
2230                 if (vap->iv_state != IEEE80211_S_RUN ||
2231                     /* NB: can happen when in promiscuous mode */
2232                     !IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
2233                         vap->iv_stats.is_rx_mgtdiscard++;
2234                         break;
2235                 }
2236                 /*
2237                  * deauth/disassoc frame format
2238                  *      [2] reason
2239                  */
2240                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2241                 reason = le16toh(*(uint16_t *)frm);
2242                 if (subtype == IEEE80211_FC0_SUBTYPE_DEAUTH) {
2243                         vap->iv_stats.is_rx_deauth++;
2244                         IEEE80211_NODE_STAT(ni, rx_deauth);
2245                 } else {
2246                         vap->iv_stats.is_rx_disassoc++;
2247                         IEEE80211_NODE_STAT(ni, rx_disassoc);
2248                 }
2249                 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
2250                     "recv %s (reason: %d (%s))",
2251                     ieee80211_mgt_subtype_name(subtype),
2252                     reason, ieee80211_reason_to_string(reason));
2253                 if (ni != vap->iv_bss)
2254                         ieee80211_node_leave(ni);
2255                 break;
2256         }
2257
2258         case IEEE80211_FC0_SUBTYPE_ACTION:
2259         case IEEE80211_FC0_SUBTYPE_ACTION_NOACK:
2260                 if (ni == vap->iv_bss) {
2261                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2262                             wh, NULL, "%s", "unknown node");
2263                         vap->iv_stats.is_rx_mgtdiscard++;
2264                 } else if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
2265                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2266                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2267                             wh, NULL, "%s", "not for us");
2268                         vap->iv_stats.is_rx_mgtdiscard++;
2269                 } else if (vap->iv_state != IEEE80211_S_RUN) {
2270                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2271                             wh, NULL, "wrong state %s",
2272                             ieee80211_state_name[vap->iv_state]);
2273                         vap->iv_stats.is_rx_mgtdiscard++;
2274                 } else {
2275                         if (ieee80211_parse_action(ni, m0) == 0)
2276                                 (void)ic->ic_recv_action(ni, wh, frm, efrm);
2277                 }
2278                 break;
2279
2280         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2281         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
2282         case IEEE80211_FC0_SUBTYPE_TIMING_ADV:
2283         case IEEE80211_FC0_SUBTYPE_ATIM:
2284                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
2285                     wh, NULL, "%s", "not handled");
2286                 vap->iv_stats.is_rx_mgtdiscard++;
2287                 break;
2288
2289         default:
2290                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
2291                     wh, "mgt", "subtype 0x%x not handled", subtype);
2292                 vap->iv_stats.is_rx_badsubtype++;
2293                 break;
2294         }
2295 }
2296
2297 static void
2298 hostap_recv_ctl(struct ieee80211_node *ni, struct mbuf *m, int subtype)
2299 {
2300         switch (subtype) {
2301         case IEEE80211_FC0_SUBTYPE_PS_POLL:
2302                 ni->ni_vap->iv_recv_pspoll(ni, m);
2303                 break;
2304         case IEEE80211_FC0_SUBTYPE_BAR:
2305                 ieee80211_recv_bar(ni, m);
2306                 break;
2307         }
2308 }
2309
2310 /*
2311  * Process a received ps-poll frame.
2312  */
2313 void
2314 ieee80211_recv_pspoll(struct ieee80211_node *ni, struct mbuf *m0)
2315 {
2316         struct ieee80211vap *vap = ni->ni_vap;
2317         struct ieee80211com *ic = vap->iv_ic;
2318         struct ieee80211_frame_min *wh;
2319         struct mbuf *m;
2320         uint16_t aid;
2321         int qlen;
2322
2323         wh = mtod(m0, struct ieee80211_frame_min *);
2324         if (ni->ni_associd == 0) {
2325                 IEEE80211_DISCARD(vap,
2326                     IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2327                     (struct ieee80211_frame *) wh, NULL,
2328                     "%s", "unassociated station");
2329                 vap->iv_stats.is_ps_unassoc++;
2330                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
2331                         IEEE80211_REASON_NOT_ASSOCED);
2332                 return;
2333         }
2334
2335         aid = le16toh(*(uint16_t *)wh->i_dur);
2336         if (aid != ni->ni_associd) {
2337                 IEEE80211_DISCARD(vap,
2338                     IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
2339                     (struct ieee80211_frame *) wh, NULL,
2340                     "aid mismatch: sta aid 0x%x poll aid 0x%x",
2341                     ni->ni_associd, aid);
2342                 vap->iv_stats.is_ps_badaid++;
2343                 /*
2344                  * NB: We used to deauth the station but it turns out
2345                  * the Blackberry Curve 8230 (and perhaps other devices)
2346                  * sometimes send the wrong AID when WME is negotiated.
2347                  * Being more lenient here seems ok as we already check
2348                  * the station is associated and we only return frames
2349                  * queued for the station (i.e. we don't use the AID).
2350                  */
2351                 return;
2352         }
2353
2354         /* Okay, take the first queued packet and put it out... */
2355         m = ieee80211_node_psq_dequeue(ni, &qlen);
2356         if (m == NULL) {
2357                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_POWER, wh->i_addr2,
2358                     "%s", "recv ps-poll, but queue empty");
2359                 ieee80211_send_nulldata(ieee80211_ref_node(ni));
2360                 vap->iv_stats.is_ps_qempty++;   /* XXX node stat */
2361                 if (vap->iv_set_tim != NULL)
2362                         vap->iv_set_tim(ni, 0); /* just in case */
2363                 return;
2364         }
2365         /*
2366          * If there are more packets, set the more packets bit
2367          * in the packet dispatched to the station; otherwise
2368          * turn off the TIM bit.
2369          */
2370         if (qlen != 0) {
2371                 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2372                     "recv ps-poll, send packet, %u still queued", qlen);
2373                 m->m_flags |= M_MORE_DATA;
2374         } else {
2375                 IEEE80211_NOTE(vap, IEEE80211_MSG_POWER, ni,
2376                     "%s", "recv ps-poll, send packet, queue empty");
2377                 if (vap->iv_set_tim != NULL)
2378                         vap->iv_set_tim(ni, 0);
2379         }
2380         m->m_flags |= M_PWR_SAV;                /* bypass PS handling */
2381
2382         /*
2383          * Do the right thing; if it's an encap'ed frame then
2384          * call ieee80211_parent_xmitpkt() else
2385          * call ieee80211_vap_xmitpkt().
2386          */
2387         if (m->m_flags & M_ENCAP) {
2388                 (void) ieee80211_parent_xmitpkt(ic, m);
2389         } else {
2390                 (void) ieee80211_vap_xmitpkt(vap, m);
2391         }
2392 }