sys/net80211/ieee80211_input.c

   1 /*-
   2  * Copyright (c) 2001 Atsushi Onoe
   3  * Copyright (c) 2002-2007 Sam Leffler, Errno Consulting
   4  * All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25  */
  26
  27 #include <sys/cdefs.h>
  28 __FBSDID("$FreeBSD$");
  29
  30 #include <sys/param.h>
  31 #include <sys/systm.h>
  32 #include <sys/mbuf.h>
  33 #include <sys/malloc.h>
  34 #include <sys/endian.h>
  35 #include <sys/kernel.h>
  36
  37 #include <sys/socket.h>
  38
  39 #include <net/if.h>
  40 #include <net/if_media.h>
  41 #include <net/ethernet.h>
  42 #include <net/if_llc.h>
  43 #include <net/if_vlan_var.h>
  44
  45 #include <net80211/ieee80211_var.h>
  46 #include <net80211/ieee80211_input.h>
  47
  48 #include <net/bpf.h>
  49
  50 #ifdef IEEE80211_DEBUG
  51 #include <machine/stdarg.h>
  52
  53 /*
  54  * Decide if a received management frame should be
  55  * printed when debugging is enabled.  This filters some
  56  * of the less interesting frames that come frequently
  57  * (e.g. beacons).
  58  */
  59 static __inline int
  60 doprint(struct ieee80211com *ic, int subtype)
  61 {
  62         switch (subtype) {
  63         case IEEE80211_FC0_SUBTYPE_BEACON:
  64                 return (ic->ic_flags & IEEE80211_F_SCAN);
  65         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
  66                 return (ic->ic_opmode == IEEE80211_M_IBSS);
  67         }
  68         return 1;
  69 }
  70
  71 static const uint8_t *ieee80211_getbssid(struct ieee80211com *,
  72         const struct ieee80211_frame *);
  73 #endif /* IEEE80211_DEBUG */
  74
  75 static struct mbuf *ieee80211_defrag(struct ieee80211com *,
  76         struct ieee80211_node *, struct mbuf *, int);
  77 static struct mbuf *ieee80211_decap(struct ieee80211com *, struct mbuf *, int);
  78 static void ieee80211_send_error(struct ieee80211com *, struct ieee80211_node *,
  79                 const uint8_t *mac, int subtype, int arg);
  80 static struct mbuf *ieee80211_decap_fastframe(struct ieee80211com *,
  81         struct ieee80211_node *, struct mbuf *);
  82 static void ieee80211_recv_pspoll(struct ieee80211com *,
  83         struct ieee80211_node *, struct mbuf *);
  84
  85 /*
  86  * Process a received frame.  The node associated with the sender
  87  * should be supplied.  If nothing was found in the node table then
  88  * the caller is assumed to supply a reference to ic_bss instead.
  89  * The RSSI and a timestamp are also supplied.  The RSSI data is used
  90  * during AP scanning to select a AP to associate with; it can have
  91  * any units so long as values have consistent units and higher values
  92  * mean ``better signal''.  The receive timestamp is currently not used
  93  * by the 802.11 layer.
  94  */
  95 int
  96 ieee80211_input(struct ieee80211com *ic, struct mbuf *m,
  97         struct ieee80211_node *ni, int rssi, int noise, uint32_t rstamp)
  98 {
  99 #define SEQ_LEQ(a,b)    ((int)((a)-(b)) <= 0)
 100 #define HAS_SEQ(type)   ((type & 0x4) == 0)
 101         struct ifnet *ifp = ic->ic_ifp;
 102         struct ieee80211_frame *wh;
 103         struct ieee80211_key *key;
 104         struct ether_header *eh;
 105         int hdrspace, need_tap;
 106         uint8_t dir, type, subtype, qos;
 107         uint8_t *bssid;
 108         uint16_t rxseq;
 109
 110         if (m->m_flags & M_AMPDU) {
 111                 /*
 112                  * Fastpath for A-MPDU reorder q resubmission.  Frames
 113                  * w/ M_AMPDU marked have already passed through here
 114                  * but were received out of order and been held on the
 115                  * reorder queue.  When resubmitted they are marked
 116                  * with the M_AMPDU flag and we can bypass most of the
 117                  * normal processing.
 118                  */
 119                 wh = mtod(m, struct ieee80211_frame *);
 120                 type = IEEE80211_FC0_TYPE_DATA;
 121                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 122                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
 123                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
 124                 need_tap = 0;
 125                 goto resubmit_ampdu;
 126         }
 127
 128         KASSERT(ni != NULL, ("null node"));
 129         ni->ni_inact = ni->ni_inact_reload;
 130
 131         need_tap = 1;                   /* mbuf need to be tapped. */
 132         type = -1;                      /* undefined */
 133         /*
 134          * In monitor mode, send everything directly to bpf.
 135          * XXX may want to include the CRC
 136          */
 137         if (ic->ic_opmode == IEEE80211_M_MONITOR)
 138                 goto out;
 139
 140         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
 141                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 142                     ni->ni_macaddr, NULL,
 143                     "too short (1): len %u", m->m_pkthdr.len);
 144                 ic->ic_stats.is_rx_tooshort++;
 145                 goto out;
 146         }
 147         /*
 148          * Bit of a cheat here, we use a pointer for a 3-address
 149          * frame format but don't reference fields past outside
 150          * ieee80211_frame_min w/o first validating the data is
 151          * present.
 152          */
 153         wh = mtod(m, struct ieee80211_frame *);
 154
 155         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
 156             IEEE80211_FC0_VERSION_0) {
 157                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 158                     ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
 159                 ic->ic_stats.is_rx_badversion++;
 160                 goto err;
 161         }
 162
 163         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 164         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 165         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 166         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 167                 switch (ic->ic_opmode) {
 168                 case IEEE80211_M_STA:
 169                         bssid = wh->i_addr2;
 170                         if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
 171                                 /* not interested in */
 172                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
 173                                     bssid, NULL, "%s", "not to bss");
 174                                 ic->ic_stats.is_rx_wrongbss++;
 175                                 goto out;
 176                         }
 177                         break;
 178                 case IEEE80211_M_IBSS:
 179                 case IEEE80211_M_AHDEMO:
 180                 case IEEE80211_M_HOSTAP:
 181                         if (dir != IEEE80211_FC1_DIR_NODS)
 182                                 bssid = wh->i_addr1;
 183                         else if (type == IEEE80211_FC0_TYPE_CTL)
 184                                 bssid = wh->i_addr1;
 185                         else {
 186                                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 187                                         IEEE80211_DISCARD_MAC(ic,
 188                                             IEEE80211_MSG_ANY, ni->ni_macaddr,
 189                                             NULL, "too short (2): len %u",
 190                                             m->m_pkthdr.len);
 191                                         ic->ic_stats.is_rx_tooshort++;
 192                                         goto out;
 193                                 }
 194                                 bssid = wh->i_addr3;
 195                         }
 196                         if (type != IEEE80211_FC0_TYPE_DATA)
 197                                 break;
 198                         /*
 199                          * Data frame, validate the bssid.
 200                          */
 201                         if (!IEEE80211_ADDR_EQ(bssid, ic->ic_bss->ni_bssid) &&
 202                             !IEEE80211_ADDR_EQ(bssid, ifp->if_broadcastaddr)) {
 203                                 /* not interested in */
 204                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
 205                                     bssid, NULL, "%s", "not to bss");
 206                                 ic->ic_stats.is_rx_wrongbss++;
 207                                 goto out;
 208                         }
 209                         /*
 210                          * For adhoc mode we cons up a node when it doesn't
 211                          * exist. This should probably done after an ACL check.
 212                          */
 213                         if (ni == ic->ic_bss &&
 214                             ic->ic_opmode != IEEE80211_M_HOSTAP &&
 215                             !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
 216                                 /*
 217                                  * Fake up a node for this newly
 218                                  * discovered member of the IBSS.
 219                                  */
 220                                 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
 221                                                     wh->i_addr2);
 222                                 if (ni == NULL) {
 223                                         /* NB: stat kept for alloc failure */
 224                                         goto err;
 225                                 }
 226                         }
 227                         break;
 228                 default:
 229                         goto out;
 230                 }
 231                 ni->ni_rssi = rssi;
 232                 ni->ni_noise = noise;
 233                 ni->ni_rstamp = rstamp;
 234                 if (HAS_SEQ(type)) {
 235                         uint8_t tid;
 236                         if (IEEE80211_QOS_HAS_SEQ(wh)) {
 237                                 tid = ((struct ieee80211_qosframe *)wh)->
 238                                         i_qos[0] & IEEE80211_QOS_TID;
 239                                 if (TID_TO_WME_AC(tid) >= WME_AC_VI)
 240                                         ic->ic_wme.wme_hipri_traffic++;
 241                                 tid++;
 242                         } else
 243                                 tid = IEEE80211_NONQOS_TID;
 244                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
 245                         if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
 246                             (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
 247                             SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
 248                                 /* duplicate, discard */
 249                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
 250                                     bssid, "duplicate",
 251                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
 252                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
 253                                     ni->ni_rxseqs[tid] >>
 254                                         IEEE80211_SEQ_SEQ_SHIFT,
 255                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
 256                                     ni->ni_rxseqs[tid] &
 257                                         IEEE80211_SEQ_FRAG_MASK,
 258                                     tid);
 259                                 ic->ic_stats.is_rx_dup++;
 260                                 IEEE80211_NODE_STAT(ni, rx_dup);
 261                                 goto out;
 262                         }
 263                         ni->ni_rxseqs[tid] = rxseq;
 264                 }
 265         }
 266
 267         switch (type) {
 268         case IEEE80211_FC0_TYPE_DATA:
 269                 hdrspace = ieee80211_hdrspace(ic, wh);
 270                 if (m->m_len < hdrspace &&
 271                     (m = m_pullup(m, hdrspace)) == NULL) {
 272                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 273                             ni->ni_macaddr, NULL,
 274                             "data too short: expecting %u", hdrspace);
 275                         ic->ic_stats.is_rx_tooshort++;
 276                         goto out;               /* XXX */
 277                 }
 278                 switch (ic->ic_opmode) {
 279                 case IEEE80211_M_STA:
 280                         if (dir != IEEE80211_FC1_DIR_FROMDS) {
 281                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 282                                     wh, "data", "unknown dir 0x%x", dir);
 283                                 ic->ic_stats.is_rx_wrongdir++;
 284                                 goto out;
 285                         }
 286                         if ((ifp->if_flags & IFF_SIMPLEX) &&
 287                             IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 288                             IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) {
 289                                 /*
 290                                  * In IEEE802.11 network, multicast packet
 291                                  * sent from me is broadcasted from AP.
 292                                  * It should be silently discarded for
 293                                  * SIMPLEX interface.
 294                                  */
 295                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 296                                     wh, NULL, "%s", "multicast echo");
 297                                 ic->ic_stats.is_rx_mcastecho++;
 298                                 goto out;
 299                         }
 300                         break;
 301                 case IEEE80211_M_IBSS:
 302                 case IEEE80211_M_AHDEMO:
 303                         if (dir != IEEE80211_FC1_DIR_NODS) {
 304                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 305                                     wh, "data", "unknown dir 0x%x", dir);
 306                                 ic->ic_stats.is_rx_wrongdir++;
 307                                 goto out;
 308                         }
 309                         /* XXX no power-save support */
 310                         break;
 311                 case IEEE80211_M_HOSTAP:
 312                         if (dir != IEEE80211_FC1_DIR_TODS) {
 313                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 314                                     wh, "data", "unknown dir 0x%x", dir);
 315                                 ic->ic_stats.is_rx_wrongdir++;
 316                                 goto out;
 317                         }
 318                         /* check if source STA is associated */
 319                         if (ni == ic->ic_bss) {
 320                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 321                                     wh, "data", "%s", "unknown src");
 322                                 ieee80211_send_error(ic, ni, wh->i_addr2,
 323                                     IEEE80211_FC0_SUBTYPE_DEAUTH,
 324                                     IEEE80211_REASON_NOT_AUTHED);
 325                                 ic->ic_stats.is_rx_notassoc++;
 326                                 goto err;
 327                         }
 328                         if (ni->ni_associd == 0) {
 329                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 330                                     wh, "data", "%s", "unassoc src");
 331                                 IEEE80211_SEND_MGMT(ic, ni,
 332                                     IEEE80211_FC0_SUBTYPE_DISASSOC,
 333                                     IEEE80211_REASON_NOT_ASSOCED);
 334                                 ic->ic_stats.is_rx_notassoc++;
 335                                 goto err;
 336                         }
 337
 338                         /*
 339                          * Check for power save state change.
 340                          * XXX out-of-order A-MPDU frames?
 341                          */
 342                         if (((wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) ^
 343                             (ni->ni_flags & IEEE80211_NODE_PWR_MGT)))
 344                                 ieee80211_node_pwrsave(ni,
 345                                         wh->i_fc[1] & IEEE80211_FC1_PWR_MGT);
 346                         break;
 347                 default:
 348                         /* XXX here to keep compiler happy */
 349                         goto out;
 350                 }
 351
 352                 /*
 353                  * Handle A-MPDU re-ordering.  The station must be
 354                  * associated and negotiated HT.  The frame must be
 355                  * a QoS frame (not QoS null data) and not previously
 356                  * processed for A-MPDU re-ordering.  If the frame is
 357                  * to be processed directly then ieee80211_ampdu_reorder
 358                  * will return 0; otherwise it has consumed the mbuf
 359                  * and we should do nothing more with it.
 360                  */
 361                 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
 362                     subtype == IEEE80211_FC0_SUBTYPE_QOS &&
 363                     ieee80211_ampdu_reorder(ni, m) != 0) {
 364                         m = NULL;
 365                         goto out;
 366                 }
 367         resubmit_ampdu:
 368
 369                 /*
 370                  * Handle privacy requirements.  Note that we
 371                  * must not be preempted from here until after
 372                  * we (potentially) call ieee80211_crypto_demic;
 373                  * otherwise we may violate assumptions in the
 374                  * crypto cipher modules used to do delayed update
 375                  * of replay sequence numbers.
 376                  */
 377                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 378                         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
 379                                 /*
 380                                  * Discard encrypted frames when privacy is off.
 381                                  */
 382                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 383                                     wh, "WEP", "%s", "PRIVACY off");
 384                                 ic->ic_stats.is_rx_noprivacy++;
 385                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
 386                                 goto out;
 387                         }
 388                         key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
 389                         if (key == NULL) {
 390                                 /* NB: stats+msgs handled in crypto_decap */
 391                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
 392                                 goto out;
 393                         }
 394                         wh = mtod(m, struct ieee80211_frame *);
 395                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
 396                 } else {
 397                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
 398                         key = NULL;
 399                 }
 400
 401                 /*
 402                  * Save QoS bits for use below--before we strip the header.
 403                  */
 404                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
 405                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
 406                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
 407                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
 408                 } else
 409                         qos = 0;
 410
 411                 /*
 412                  * Next up, any fragmentation.
 413                  */
 414                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 415                         m = ieee80211_defrag(ic, ni, m, hdrspace);
 416                         if (m == NULL) {
 417                                 /* Fragment dropped or frame not complete yet */
 418                                 goto out;
 419                         }
 420                 }
 421                 wh = NULL;              /* no longer valid, catch any uses */
 422
 423                 /*
 424                  * Next strip any MSDU crypto bits.
 425                  */
 426                 if (key != NULL && !ieee80211_crypto_demic(ic, key, m, 0)) {
 427                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
 428                             ni->ni_macaddr, "data", "%s", "demic error");
 429                         ic->ic_stats.is_rx_demicfail++;
 430                         IEEE80211_NODE_STAT(ni, rx_demicfail);
 431                         goto out;
 432                 }
 433
 434                 /* copy to listener after decrypt */
 435                 if (bpf_peers_present(ic->ic_rawbpf))
 436                         bpf_mtap(ic->ic_rawbpf, m);
 437                 need_tap = 0;
 438
 439                 /*
 440                  * Finally, strip the 802.11 header.
 441                  */
 442                 m = ieee80211_decap(ic, m, hdrspace);
 443                 if (m == NULL) {
 444                         /* don't count Null data frames as errors */
 445                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
 446                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
 447                                 goto out;
 448                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
 449                             ni->ni_macaddr, "data", "%s", "decap error");
 450                         ic->ic_stats.is_rx_decap++;
 451                         IEEE80211_NODE_STAT(ni, rx_decap);
 452                         goto err;
 453                 }
 454                 eh = mtod(m, struct ether_header *);
 455                 if (!ieee80211_node_is_authorized(ni)) {
 456                         /*
 457                          * Deny any non-PAE frames received prior to
 458                          * authorization.  For open/shared-key
 459                          * authentication the port is mark authorized
 460                          * after authentication completes.  For 802.1x
 461                          * the port is not marked authorized by the
 462                          * authenticator until the handshake has completed.
 463                          */
 464                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
 465                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_INPUT,
 466                                     eh->ether_shost, "data",
 467                                     "unauthorized port: ether type 0x%x len %u",
 468                                     eh->ether_type, m->m_pkthdr.len);
 469                                 ic->ic_stats.is_rx_unauth++;
 470                                 IEEE80211_NODE_STAT(ni, rx_unauth);
 471                                 goto err;
 472                         }
 473                 } else {
 474                         /*
 475                          * When denying unencrypted frames, discard
 476                          * any non-PAE frames received without encryption.
 477                          */
 478                         if ((ic->ic_flags & IEEE80211_F_DROPUNENC) &&
 479                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
 480                             eh->ether_type != htons(ETHERTYPE_PAE)) {
 481                                 /*
 482                                  * Drop unencrypted frames.
 483                                  */
 484                                 ic->ic_stats.is_rx_unencrypted++;
 485                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
 486                                 goto out;
 487                         }
 488                 }
 489                 /* XXX require HT? */
 490                 if (qos & IEEE80211_QOS_AMSDU) {
 491                         m = ieee80211_decap_amsdu(ni, m);
 492                         if (m == NULL)
 493                                 return IEEE80211_FC0_TYPE_DATA;
 494                 } else if ((ni->ni_ath_flags & IEEE80211_NODE_FF) &&
 495 #define FF_LLC_SIZE     (sizeof(struct ether_header) + sizeof(struct llc))
 496                     m->m_pkthdr.len >= 3*FF_LLC_SIZE) {
 497                         struct llc *llc;
 498
 499                         /*
 500                          * Check for fast-frame tunnel encapsulation.
 501                          */
 502                         if (m->m_len < FF_LLC_SIZE &&
 503                             (m = m_pullup(m, FF_LLC_SIZE)) == NULL) {
 504                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 505                                     ni->ni_macaddr, "fast-frame",
 506                                     "%s", "m_pullup(llc) failed");
 507                                 ic->ic_stats.is_rx_tooshort++;
 508                                 return IEEE80211_FC0_TYPE_DATA;
 509                         }
 510                         llc = (struct llc *)(mtod(m, uint8_t *) +
 511                                 sizeof(struct ether_header));
 512                         if (llc->llc_snap.ether_type == htons(ATH_FF_ETH_TYPE)) {
 513                                 m_adj(m, FF_LLC_SIZE);
 514                                 m = ieee80211_decap_fastframe(ic, ni, m);
 515                                 if (m == NULL)
 516                                         return IEEE80211_FC0_TYPE_DATA;
 517                         }
 518                 }
 519 #undef FF_LLC_SIZE
 520                 ieee80211_deliver_data(ic, ni, m);
 521                 return IEEE80211_FC0_TYPE_DATA;
 522
 523         case IEEE80211_FC0_TYPE_MGT:
 524                 ic->ic_stats.is_rx_mgmt++;
 525                 IEEE80211_NODE_STAT(ni, rx_mgmt);
 526                 if (dir != IEEE80211_FC1_DIR_NODS) {
 527                         IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 528                             wh, "data", "unknown dir 0x%x", dir);
 529                         ic->ic_stats.is_rx_wrongdir++;
 530                         goto err;
 531                 }
 532                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 533                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 534                             ni->ni_macaddr, "mgt", "too short: len %u",
 535                             m->m_pkthdr.len);
 536                         ic->ic_stats.is_rx_tooshort++;
 537                         goto out;
 538                 }
 539 #ifdef IEEE80211_DEBUG
 540                 if ((ieee80211_msg_debug(ic) && doprint(ic, subtype)) ||
 541                     ieee80211_msg_dumppkts(ic)) {
 542                         if_printf(ic->ic_ifp, "received %s from %s rssi %d\n",
 543                             ieee80211_mgt_subtype_name[subtype >>
 544                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 545                             ether_sprintf(wh->i_addr2), rssi);
 546                 }
 547 #endif
 548                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 549                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
 550                                 /*
 551                                  * Only shared key auth frames with a challenge
 552                                  * should be encrypted, discard all others.
 553                                  */
 554                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 555                                     wh, ieee80211_mgt_subtype_name[subtype >>
 556                                         IEEE80211_FC0_SUBTYPE_SHIFT],
 557                                     "%s", "WEP set but not permitted");
 558                                 ic->ic_stats.is_rx_mgtdiscard++; /* XXX */
 559                                 goto out;
 560                         }
 561                         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
 562                                 /*
 563                                  * Discard encrypted frames when privacy is off.
 564                                  */
 565                                 IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
 566                                     wh, "mgt", "%s", "WEP set but PRIVACY off");
 567                                 ic->ic_stats.is_rx_noprivacy++;
 568                                 goto out;
 569                         }
 570                         hdrspace = ieee80211_hdrspace(ic, wh);
 571                         key = ieee80211_crypto_decap(ic, ni, m, hdrspace);
 572                         if (key == NULL) {
 573                                 /* NB: stats+msgs handled in crypto_decap */
 574                                 goto out;
 575                         }
 576                         wh = mtod(m, struct ieee80211_frame *);
 577                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
 578                 }
 579                 if (bpf_peers_present(ic->ic_rawbpf))
 580                         bpf_mtap(ic->ic_rawbpf, m);
 581                 (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, noise, rstamp);
 582                 m_freem(m);
 583                 return IEEE80211_FC0_TYPE_MGT;
 584
 585         case IEEE80211_FC0_TYPE_CTL:
 586                 ic->ic_stats.is_rx_ctl++;
 587                 IEEE80211_NODE_STAT(ni, rx_ctrl);
 588                 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 589                         switch (subtype) {
 590                         case IEEE80211_FC0_SUBTYPE_PS_POLL:
 591                                 ieee80211_recv_pspoll(ic, ni, m);
 592                                 break;
 593                         case IEEE80211_FC0_SUBTYPE_BAR:
 594                                 ieee80211_recv_bar(ni, m);
 595                                 break;
 596                         }
 597                 }
 598                 goto out;
 599         default:
 600                 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
 601                     wh, NULL, "bad frame type 0x%x", type);
 602                 /* should not come here */
 603                 break;
 604         }
 605 err:
 606         ifp->if_ierrors++;
 607 out:
 608         if (m != NULL) {
 609                 if (bpf_peers_present(ic->ic_rawbpf) && need_tap)
 610                         bpf_mtap(ic->ic_rawbpf, m);
 611                 m_freem(m);
 612         }
 613         return type;
 614 #undef SEQ_LEQ
 615 }
 616
 617 /*
 618  * This function reassemble fragments.
 619  */
 620 static struct mbuf *
 621 ieee80211_defrag(struct ieee80211com *ic, struct ieee80211_node *ni,
 622         struct mbuf *m, int hdrspace)
 623 {
 624         struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
 625         struct ieee80211_frame *lwh;
 626         uint16_t rxseq;
 627         uint8_t fragno;
 628         uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
 629         struct mbuf *mfrag;
 630
 631         KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
 632
 633         rxseq = le16toh(*(uint16_t *)wh->i_seq);
 634         fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
 635
 636         /* Quick way out, if there's nothing to defragment */
 637         if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
 638                 return m;
 639
 640         /*
 641          * Remove frag to insure it doesn't get reaped by timer.
 642          */
 643         if (ni->ni_table == NULL) {
 644                 /*
 645                  * Should never happen.  If the node is orphaned (not in
 646                  * the table) then input packets should not reach here.
 647                  * Otherwise, a concurrent request that yanks the table
 648                  * should be blocked by other interlocking and/or by first
 649                  * shutting the driver down.  Regardless, be defensive
 650                  * here and just bail
 651                  */
 652                 /* XXX need msg+stat */
 653                 m_freem(m);
 654                 return NULL;
 655         }
 656         IEEE80211_NODE_LOCK(ni->ni_table);
 657         mfrag = ni->ni_rxfrag[0];
 658         ni->ni_rxfrag[0] = NULL;
 659         IEEE80211_NODE_UNLOCK(ni->ni_table);
 660
 661         /*
 662          * Validate new fragment is in order and
 663          * related to the previous ones.
 664          */
 665         if (mfrag != NULL) {
 666                 uint16_t last_rxseq;
 667
 668                 lwh = mtod(mfrag, struct ieee80211_frame *);
 669                 last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
 670                 /* NB: check seq # and frag together */
 671                 if (rxseq != last_rxseq+1 ||
 672                     !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
 673                     !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
 674                         /*
 675                          * Unrelated fragment or no space for it,
 676                          * clear current fragments.
 677                          */
 678                         m_freem(mfrag);
 679                         mfrag = NULL;
 680                 }
 681         }
 682
 683         if (mfrag == NULL) {
 684                 if (fragno != 0) {              /* !first fragment, discard */
 685                         ic->ic_stats.is_rx_defrag++;
 686                         IEEE80211_NODE_STAT(ni, rx_defrag);
 687                         m_freem(m);
 688                         return NULL;
 689                 }
 690                 mfrag = m;
 691         } else {                                /* concatenate */
 692                 m_adj(m, hdrspace);             /* strip header */
 693                 m_cat(mfrag, m);
 694                 /* NB: m_cat doesn't update the packet header */
 695                 mfrag->m_pkthdr.len += m->m_pkthdr.len;
 696                 /* track last seqnum and fragno */
 697                 lwh = mtod(mfrag, struct ieee80211_frame *);
 698                 *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
 699         }
 700         if (more_frag) {                        /* more to come, save */
 701                 ni->ni_rxfragstamp = ticks;
 702                 ni->ni_rxfrag[0] = mfrag;
 703                 mfrag = NULL;
 704         }
 705         return mfrag;
 706 }
 707
 708 void
 709 ieee80211_deliver_data(struct ieee80211com *ic,
 710         struct ieee80211_node *ni, struct mbuf *m)
 711 {
 712         struct ether_header *eh = mtod(m, struct ether_header *);
 713         struct ifnet *ifp = ic->ic_ifp;
 714
 715         /*
 716          * Do accounting.
 717          */
 718         ifp->if_ipackets++;
 719         IEEE80211_NODE_STAT(ni, rx_data);
 720         IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
 721         if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
 722                 m->m_flags |= M_MCAST;          /* XXX M_BCAST? */
 723                 IEEE80211_NODE_STAT(ni, rx_mcast);
 724         } else
 725                 IEEE80211_NODE_STAT(ni, rx_ucast);
 726
 727         /* clear driver/net80211 flags before passing up */
 728         m->m_flags &= ~M_80211_RX;
 729
 730         /* perform as a bridge within the AP */
 731         if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
 732             (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) {
 733                 struct mbuf *m1 = NULL;
 734
 735                 if (m->m_flags & M_MCAST) {
 736                         m1 = m_dup(m, M_DONTWAIT);
 737                         if (m1 == NULL)
 738                                 ifp->if_oerrors++;
 739                         else
 740                                 m1->m_flags |= M_MCAST;
 741                 } else {
 742                         /*
 743                          * Check if the destination is known; if so
 744                          * and the port is authorized dispatch directly.
 745                          */
 746                         struct ieee80211_node *sta =
 747                             ieee80211_find_node(&ic->ic_sta, eh->ether_dhost);
 748                         if (sta != NULL) {
 749                                 if (ieee80211_node_is_authorized(sta)) {
 750                                         /*
 751                                          * Beware of sending to ourself; this
 752                                          * needs to happen via the normal
 753                                          * input path.
 754                                          */
 755                                         if (sta != ic->ic_bss) {
 756                                                 m1 = m;
 757                                                 m = NULL;
 758                                         }
 759                                 } else {
 760                                         ic->ic_stats.is_rx_unauth++;
 761                                         IEEE80211_NODE_STAT(sta, rx_unauth);
 762                                 }
 763                                 ieee80211_free_node(sta);
 764                         }
 765                 }
 766                 if (m1 != NULL) {
 767                         int error;
 768
 769                         /* XXX does not work well with WME */
 770                         IFQ_HANDOFF(ifp, m1, error);
 771                 }
 772         }
 773         if (m != NULL) {
 774                 m->m_pkthdr.rcvif = ifp;
 775                 if (ni->ni_vlan != 0) {
 776                         /* attach vlan tag */
 777                         m->m_pkthdr.ether_vtag = ni->ni_vlan;
 778                         m->m_flags |= M_VLANTAG;
 779                 }
 780                 (*ifp->if_input)(ifp, m);
 781         }
 782 }
 783
 784 static struct mbuf *
 785 ieee80211_decap(struct ieee80211com *ic, struct mbuf *m, int hdrlen)
 786 {
 787         struct ieee80211_qosframe_addr4 wh;     /* Max size address frames */
 788         struct ether_header *eh;
 789         struct llc *llc;
 790
 791         if (m->m_len < hdrlen + sizeof(*llc) &&
 792             (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
 793                 /* XXX stat, msg */
 794                 return NULL;
 795         }
 796         memcpy(&wh, mtod(m, caddr_t), hdrlen);
 797         llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
 798         if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
 799             llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
 800             llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0) {
 801                 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
 802                 llc = NULL;
 803         } else {
 804                 m_adj(m, hdrlen - sizeof(*eh));
 805         }
 806         eh = mtod(m, struct ether_header *);
 807         switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
 808         case IEEE80211_FC1_DIR_NODS:
 809                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
 810                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
 811                 break;
 812         case IEEE80211_FC1_DIR_TODS:
 813                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
 814                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
 815                 break;
 816         case IEEE80211_FC1_DIR_FROMDS:
 817                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
 818                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
 819                 break;
 820         case IEEE80211_FC1_DIR_DSTODS:
 821                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
 822                 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
 823                 break;
 824         }
 825 #ifdef ALIGNED_POINTER
 826         if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
 827                 struct mbuf *n, *n0, **np;
 828                 caddr_t newdata;
 829                 int off, pktlen;
 830
 831                 n0 = NULL;
 832                 np = &n0;
 833                 off = 0;
 834                 pktlen = m->m_pkthdr.len;
 835                 while (pktlen > off) {
 836                         if (n0 == NULL) {
 837                                 MGETHDR(n, M_DONTWAIT, MT_DATA);
 838                                 if (n == NULL) {
 839                                         m_freem(m);
 840                                         return NULL;
 841                                 }
 842                                 M_MOVE_PKTHDR(n, m);
 843                                 n->m_len = MHLEN;
 844                         } else {
 845                                 MGET(n, M_DONTWAIT, MT_DATA);
 846                                 if (n == NULL) {
 847                                         m_freem(m);
 848                                         m_freem(n0);
 849                                         return NULL;
 850                                 }
 851                                 n->m_len = MLEN;
 852                         }
 853                         if (pktlen - off >= MINCLSIZE) {
 854                                 MCLGET(n, M_DONTWAIT);
 855                                 if (n->m_flags & M_EXT)
 856                                         n->m_len = n->m_ext.ext_size;
 857                         }
 858                         if (n0 == NULL) {
 859                                 newdata =
 860                                     (caddr_t)ALIGN(n->m_data + sizeof(*eh)) -
 861                                     sizeof(*eh);
 862                                 n->m_len -= newdata - n->m_data;
 863                                 n->m_data = newdata;
 864                         }
 865                         if (n->m_len > pktlen - off)
 866                                 n->m_len = pktlen - off;
 867                         m_copydata(m, off, n->m_len, mtod(n, caddr_t));
 868                         off += n->m_len;
 869                         *np = n;
 870                         np = &n->m_next;
 871                 }
 872                 m_freem(m);
 873                 m = n0;
 874         }
 875 #endif /* ALIGNED_POINTER */
 876         if (llc != NULL) {
 877                 eh = mtod(m, struct ether_header *);
 878                 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
 879         }
 880         return m;
 881 }
 882
 883 /*
 884  * Decap a frame encapsulated in a fast-frame/A-MSDU.
 885  */
 886 struct mbuf *
 887 ieee80211_decap1(struct mbuf *m, int *framelen)
 888 {
 889 #define FF_LLC_SIZE     (sizeof(struct ether_header) + sizeof(struct llc))
 890         struct ether_header *eh;
 891         struct llc *llc;
 892
 893         /*
 894          * The frame has an 802.3 header followed by an 802.2
 895          * LLC header.  The encapsulated frame length is in the
 896          * first header type field; save that and overwrite it
 897          * with the true type field found in the second.  Then
 898          * copy the 802.3 header up to where it belongs and
 899          * adjust the mbuf contents to remove the void.
 900          */
 901         if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
 902                 return NULL;
 903         eh = mtod(m, struct ether_header *);    /* 802.3 header is first */
 904         llc = (struct llc *)&eh[1];             /* 802.2 header follows */
 905         *framelen = ntohs(eh->ether_type)       /* encap'd frame size */
 906                   + sizeof(struct ether_header) - sizeof(struct llc);
 907         eh->ether_type = llc->llc_un.type_snap.ether_type;
 908         ovbcopy(eh, mtod(m, uint8_t *) + sizeof(struct llc),
 909                 sizeof(struct ether_header));
 910         m_adj(m, sizeof(struct llc));
 911         return m;
 912 #undef FF_LLC_SIZE
 913 }
 914
 915 /*
 916  * Decap the encapsulated frame pair and dispatch the first
 917  * for delivery.  The second frame is returned for delivery
 918  * via the normal path.
 919  */
 920 static struct mbuf *
 921 ieee80211_decap_fastframe(struct ieee80211com *ic,
 922         struct ieee80211_node *ni, struct mbuf *m)
 923 {
 924 #define MS(x,f) (((x) & f) >> f##_S)
 925         uint32_t ath;
 926         struct mbuf *n;
 927         int framelen;
 928
 929         m_copydata(m, 0, sizeof(uint32_t), (caddr_t) &ath);
 930         if (MS(ath, ATH_FF_PROTO) != ATH_FF_PROTO_L2TUNNEL) {
 931                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 932                     ni->ni_macaddr, "fast-frame",
 933                     "unsupport tunnel protocol, header 0x%x", ath);
 934                 ic->ic_stats.is_ff_badhdr++;
 935                 m_freem(m);
 936                 return NULL;
 937         }
 938         /* NB: skip header and alignment padding */
 939         m_adj(m, roundup(sizeof(uint32_t) - 2, 4) + 2);
 940
 941         ic->ic_stats.is_ff_decap++;
 942
 943         /*
 944          * Decap the first frame, bust it apart from the
 945          * second and deliver; then decap the second frame
 946          * and return it to the caller for normal delivery.
 947          */
 948         m = ieee80211_decap1(m, &framelen);
 949         if (m == NULL) {
 950                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 951                     ni->ni_macaddr, "fast-frame", "%s", "first decap failed");
 952                 ic->ic_stats.is_ff_tooshort++;
 953                 return NULL;
 954         }
 955         n = m_split(m, framelen, M_NOWAIT);
 956         if (n == NULL) {
 957                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 958                     ni->ni_macaddr, "fast-frame",
 959                     "%s", "unable to split encapsulated frames");
 960                 ic->ic_stats.is_ff_split++;
 961                 m_freem(m);                     /* NB: must reclaim */
 962                 return NULL;
 963         }
 964         ieee80211_deliver_data(ic, ni, m);      /* 1st of pair */
 965
 966         /*
 967          * Decap second frame.
 968          */
 969         m_adj(n, roundup2(framelen, 4) - framelen);     /* padding */
 970         n = ieee80211_decap1(n, &framelen);
 971         if (n == NULL) {
 972                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_ANY,
 973                     ni->ni_macaddr, "fast-frame", "%s", "second decap failed");
 974                 ic->ic_stats.is_ff_tooshort++;
 975         }
 976         /* XXX verify framelen against mbuf contents */
 977         return n;                               /* 2nd delivered by caller */
 978 #undef MS
 979 }
 980
 981 /*
 982  * Install received rate set information in the node's state block.
 983  */
 984 int
 985 ieee80211_setup_rates(struct ieee80211_node *ni,
 986         const uint8_t *rates, const uint8_t *xrates, int flags)
 987 {
 988         struct ieee80211com *ic = ni->ni_ic;
 989         struct ieee80211_rateset *rs = &ni->ni_rates;
 990
 991         memset(rs, 0, sizeof(*rs));
 992         rs->rs_nrates = rates[1];
 993         memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
 994         if (xrates != NULL) {
 995                 uint8_t nxrates;
 996                 /*
 997                  * Tack on 11g extended supported rate element.
 998                  */
 999                 nxrates = xrates[1];
1000                 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
1001                         nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
1002                         IEEE80211_DPRINTF(ic, IEEE80211_MSG_XRATE,
1003                              "[%s] extended rate set too large;"
1004                              " only using %u of %u rates\n",
1005                              ether_sprintf(ni->ni_macaddr), nxrates, xrates[1]);
1006                         ic->ic_stats.is_rx_rstoobig++;
1007                 }
1008                 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
1009                 rs->rs_nrates += nxrates;
1010         }
1011         return ieee80211_fix_rate(ni, rs, flags);
1012 }
1013
1014 static void
1015 ieee80211_auth_open(struct ieee80211com *ic, struct ieee80211_frame *wh,
1016     struct ieee80211_node *ni, int rssi, int noise, uint32_t rstamp,
1017     uint16_t seq, uint16_t status)
1018 {
1019
1020         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
1021                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1022                     ni->ni_macaddr, "open auth",
1023                     "bad sta auth mode %u", ni->ni_authmode);
1024                 ic->ic_stats.is_rx_bad_auth++;  /* XXX */
1025                 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1026                         /*
1027                          * Clear any challenge text that may be there if
1028                          * a previous shared key auth failed and then an
1029                          * open auth is attempted.
1030                          */
1031                         if (ni->ni_challenge != NULL) {
1032                                 FREE(ni->ni_challenge, M_80211_NODE);
1033                                 ni->ni_challenge = NULL;
1034                         }
1035                         /* XXX hack to workaround calling convention */
1036                         ieee80211_send_error(ic, ni, wh->i_addr2,
1037                             IEEE80211_FC0_SUBTYPE_AUTH,
1038                             (seq + 1) | (IEEE80211_STATUS_ALG<<16));
1039                 }
1040                 return;
1041         }
1042         switch (ic->ic_opmode) {
1043         case IEEE80211_M_IBSS:
1044         case IEEE80211_M_AHDEMO:
1045         case IEEE80211_M_MONITOR:
1046         case IEEE80211_M_WDS:
1047                 /* should not come here */
1048                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1049                     ni->ni_macaddr, "open auth",
1050                     "bad operating mode %u", ic->ic_opmode);
1051                 break;
1052
1053         case IEEE80211_M_HOSTAP:
1054                 if (ic->ic_state != IEEE80211_S_RUN ||
1055                     seq != IEEE80211_AUTH_OPEN_REQUEST) {
1056                         ic->ic_stats.is_rx_bad_auth++;
1057                         return;
1058                 }
1059                 /* always accept open authentication requests */
1060                 if (ni == ic->ic_bss) {
1061                         ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
1062                         if (ni == NULL)
1063                                 return;
1064                 } else if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1065                         (void) ieee80211_ref_node(ni);
1066                 /*
1067                  * Mark the node as referenced to reflect that it's
1068                  * reference count has been bumped to insure it remains
1069                  * after the transaction completes.
1070                  */
1071                 ni->ni_flags |= IEEE80211_NODE_AREF;
1072
1073                 IEEE80211_SEND_MGMT(ic, ni,
1074                         IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1075                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1076                     "[%s] station authenticated (open)\n",
1077                     ether_sprintf(ni->ni_macaddr));
1078                 /*
1079                  * When 802.1x is not in use mark the port
1080                  * authorized at this point so traffic can flow.
1081                  */
1082                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
1083                         ieee80211_node_authorize(ni);
1084                 break;
1085
1086         case IEEE80211_M_STA:
1087                 if (ic->ic_state != IEEE80211_S_AUTH ||
1088                     seq != IEEE80211_AUTH_OPEN_RESPONSE) {
1089                         ic->ic_stats.is_rx_bad_auth++;
1090                         return;
1091                 }
1092                 if (status != 0) {
1093                         IEEE80211_DPRINTF(ic,
1094                             IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1095                             "[%s] open auth failed (reason %d)\n",
1096                             ether_sprintf(ni->ni_macaddr), status);
1097                         /* XXX can this happen? */
1098                         if (ni != ic->ic_bss)
1099                                 ni->ni_fails++;
1100                         ic->ic_stats.is_rx_auth_fail++;
1101                         ieee80211_new_state(ic, IEEE80211_S_SCAN,
1102                             IEEE80211_SCAN_FAIL_STATUS);
1103                 } else
1104                         ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
1105                 break;
1106         }
1107 }
1108
1109 /*
1110  * Send a management frame error response to the specified
1111  * station.  If ni is associated with the station then use
1112  * it; otherwise allocate a temporary node suitable for
1113  * transmitting the frame and then free the reference so
1114  * it will go away as soon as the frame has been transmitted.
1115  */
1116 static void
1117 ieee80211_send_error(struct ieee80211com *ic, struct ieee80211_node *ni,
1118         const uint8_t *mac, int subtype, int arg)
1119 {
1120         int istmp;
1121
1122         if (ni == ic->ic_bss) {
1123                 ni = ieee80211_tmp_node(ic, mac);
1124                 if (ni == NULL) {
1125                         /* XXX msg */
1126                         return;
1127                 }
1128                 istmp = 1;
1129         } else
1130                 istmp = 0;
1131         IEEE80211_SEND_MGMT(ic, ni, subtype, arg);
1132         if (istmp)
1133                 ieee80211_free_node(ni);
1134 }
1135
1136 static int
1137 alloc_challenge(struct ieee80211com *ic, struct ieee80211_node *ni)
1138 {
1139         if (ni->ni_challenge == NULL)
1140                 MALLOC(ni->ni_challenge, uint32_t*, IEEE80211_CHALLENGE_LEN,
1141                     M_80211_NODE, M_NOWAIT);
1142         if (ni->ni_challenge == NULL) {
1143                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1144                     "[%s] shared key challenge alloc failed\n",
1145                     ether_sprintf(ni->ni_macaddr));
1146                 /* XXX statistic */
1147         }
1148         return (ni->ni_challenge != NULL);
1149 }
1150
1151 /* XXX TODO: add statistics */
1152 static void
1153 ieee80211_auth_shared(struct ieee80211com *ic, struct ieee80211_frame *wh,
1154     uint8_t *frm, uint8_t *efrm, struct ieee80211_node *ni,
1155     int rssi, int noise, uint32_t rstamp, uint16_t seq, uint16_t status)
1156 {
1157         uint8_t *challenge;
1158         int allocbs, estatus;
1159
1160         /*
1161          * NB: this can happen as we allow pre-shared key
1162          * authentication to be enabled w/o wep being turned
1163          * on so that configuration of these can be done
1164          * in any order.  It may be better to enforce the
1165          * ordering in which case this check would just be
1166          * for sanity/consistency.
1167          */
1168         if ((ic->ic_flags & IEEE80211_F_PRIVACY) == 0) {
1169                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1170                     ni->ni_macaddr, "shared key auth",
1171                     "%s", " PRIVACY is disabled");
1172                 estatus = IEEE80211_STATUS_ALG;
1173                 goto bad;
1174         }
1175         /*
1176          * Pre-shared key authentication is evil; accept
1177          * it only if explicitly configured (it is supported
1178          * mainly for compatibility with clients like OS X).
1179          */
1180         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
1181             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
1182                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1183                     ni->ni_macaddr, "shared key auth",
1184                     "bad sta auth mode %u", ni->ni_authmode);
1185                 ic->ic_stats.is_rx_bad_auth++;  /* XXX maybe a unique error? */
1186                 estatus = IEEE80211_STATUS_ALG;
1187                 goto bad;
1188         }
1189
1190         challenge = NULL;
1191         if (frm + 1 < efrm) {
1192                 if ((frm[1] + 2) > (efrm - frm)) {
1193                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1194                             ni->ni_macaddr, "shared key auth",
1195                             "ie %d/%d too long",
1196                             frm[0], (frm[1] + 2) - (efrm - frm));
1197                         ic->ic_stats.is_rx_bad_auth++;
1198                         estatus = IEEE80211_STATUS_CHALLENGE;
1199                         goto bad;
1200                 }
1201                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
1202                         challenge = frm;
1203                 frm += frm[1] + 2;
1204         }
1205         switch (seq) {
1206         case IEEE80211_AUTH_SHARED_CHALLENGE:
1207         case IEEE80211_AUTH_SHARED_RESPONSE:
1208                 if (challenge == NULL) {
1209                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1210                             ni->ni_macaddr, "shared key auth",
1211                             "%s", "no challenge");
1212                         ic->ic_stats.is_rx_bad_auth++;
1213                         estatus = IEEE80211_STATUS_CHALLENGE;
1214                         goto bad;
1215                 }
1216                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1217                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1218                             ni->ni_macaddr, "shared key auth",
1219                             "bad challenge len %d", challenge[1]);
1220                         ic->ic_stats.is_rx_bad_auth++;
1221                         estatus = IEEE80211_STATUS_CHALLENGE;
1222                         goto bad;
1223                 }
1224         default:
1225                 break;
1226         }
1227         switch (ic->ic_opmode) {
1228         case IEEE80211_M_MONITOR:
1229         case IEEE80211_M_AHDEMO:
1230         case IEEE80211_M_IBSS:
1231         case IEEE80211_M_WDS:
1232                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1233                     ni->ni_macaddr, "shared key auth",
1234                     "bad operating mode %u", ic->ic_opmode);
1235                 return;
1236         case IEEE80211_M_HOSTAP:
1237                 if (ic->ic_state != IEEE80211_S_RUN) {
1238                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1239                             ni->ni_macaddr, "shared key auth",
1240                             "bad state %u", ic->ic_state);
1241                         estatus = IEEE80211_STATUS_ALG; /* XXX */
1242                         goto bad;
1243                 }
1244                 switch (seq) {
1245                 case IEEE80211_AUTH_SHARED_REQUEST:
1246                         if (ni == ic->ic_bss) {
1247                                 ni = ieee80211_dup_bss(&ic->ic_sta, wh->i_addr2);
1248                                 if (ni == NULL) {
1249                                         /* NB: no way to return an error */
1250                                         return;
1251                                 }
1252                                 allocbs = 1;
1253                         } else {
1254                                 if ((ni->ni_flags & IEEE80211_NODE_AREF) == 0)
1255                                         (void) ieee80211_ref_node(ni);
1256                                 allocbs = 0;
1257                         }
1258                         /*
1259                          * Mark the node as referenced to reflect that it's
1260                          * reference count has been bumped to insure it remains
1261                          * after the transaction completes.
1262                          */
1263                         ni->ni_flags |= IEEE80211_NODE_AREF;
1264                         ni->ni_rssi = rssi;
1265                         ni->ni_noise = noise;
1266                         ni->ni_rstamp = rstamp;
1267                         if (!alloc_challenge(ic, ni)) {
1268                                 /* NB: don't return error so they rexmit */
1269                                 return;
1270                         }
1271                         get_random_bytes(ni->ni_challenge,
1272                                 IEEE80211_CHALLENGE_LEN);
1273                         IEEE80211_DPRINTF(ic,
1274                                 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1275                                 "[%s] shared key %sauth request\n",
1276                                 ether_sprintf(ni->ni_macaddr),
1277                                 allocbs ? "" : "re");
1278                         break;
1279                 case IEEE80211_AUTH_SHARED_RESPONSE:
1280                         if (ni == ic->ic_bss) {
1281                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1282                                     ni->ni_macaddr, "shared key response",
1283                                     "%s", "unknown station");
1284                                 /* NB: don't send a response */
1285                                 return;
1286                         }
1287                         if (ni->ni_challenge == NULL) {
1288                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1289                                     ni->ni_macaddr, "shared key response",
1290                                     "%s", "no challenge recorded");
1291                                 ic->ic_stats.is_rx_bad_auth++;
1292                                 estatus = IEEE80211_STATUS_CHALLENGE;
1293                                 goto bad;
1294                         }
1295                         if (memcmp(ni->ni_challenge, &challenge[2],
1296                                    challenge[1]) != 0) {
1297                                 IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1298                                     ni->ni_macaddr, "shared key response",
1299                                     "%s", "challenge mismatch");
1300                                 ic->ic_stats.is_rx_auth_fail++;
1301                                 estatus = IEEE80211_STATUS_CHALLENGE;
1302                                 goto bad;
1303                         }
1304                         IEEE80211_DPRINTF(ic,
1305                             IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1306                             "[%s] station authenticated (shared key)\n",
1307                             ether_sprintf(ni->ni_macaddr));
1308                         ieee80211_node_authorize(ni);
1309                         break;
1310                 default:
1311                         IEEE80211_DISCARD_MAC(ic, IEEE80211_MSG_AUTH,
1312                             ni->ni_macaddr, "shared key auth",
1313                             "bad seq %d", seq);
1314                         ic->ic_stats.is_rx_bad_auth++;
1315                         estatus = IEEE80211_STATUS_SEQUENCE;
1316                         goto bad;
1317                 }
1318                 IEEE80211_SEND_MGMT(ic, ni,
1319                         IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1320                 break;
1321
1322         case IEEE80211_M_STA:
1323                 if (ic->ic_state != IEEE80211_S_AUTH)
1324                         return;
1325                 switch (seq) {
1326                 case IEEE80211_AUTH_SHARED_PASS:
1327                         if (ni->ni_challenge != NULL) {
1328                                 FREE(ni->ni_challenge, M_80211_NODE);
1329                                 ni->ni_challenge = NULL;
1330                         }
1331                         if (status != 0) {
1332                                 IEEE80211_DPRINTF(ic,
1333                                     IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
1334                                     "[%s] shared key auth failed (reason %d)\n",
1335                                     ether_sprintf(ieee80211_getbssid(ic, wh)),
1336                                     status);
1337                                 /* XXX can this happen? */
1338                                 if (ni != ic->ic_bss)
1339                                         ni->ni_fails++;
1340                                 ic->ic_stats.is_rx_auth_fail++;
1341                                 return;
1342                         }
1343                         ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
1344                         break;
1345                 case IEEE80211_AUTH_SHARED_CHALLENGE:
1346                         if (!alloc_challenge(ic, ni))
1347                                 return;
1348                         /* XXX could optimize by passing recvd challenge */
1349                         memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1350                         IEEE80211_SEND_MGMT(ic, ni,
1351                                 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1352                         break;
1353                 default:
1354                         IEEE80211_DISCARD(ic, IEEE80211_MSG_AUTH,
1355                             wh, "shared key auth", "bad seq %d", seq);
1356                         ic->ic_stats.is_rx_bad_auth++;
1357                         return;
1358                 }
1359                 break;
1360         }
1361         return;
1362 bad:
1363         /*
1364          * Send an error response; but only when operating as an AP.
1365          */
1366         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1367                 /* XXX hack to workaround calling convention */
1368                 ieee80211_send_error(ic, ni, wh->i_addr2,
1369                     IEEE80211_FC0_SUBTYPE_AUTH,
1370                     (seq + 1) | (estatus<<16));
1371         } else if (ic->ic_opmode == IEEE80211_M_STA) {
1372                 /*
1373                  * Kick the state machine.  This short-circuits
1374                  * using the mgt frame timeout to trigger the
1375                  * state transition.
1376                  */
1377                 if (ic->ic_state == IEEE80211_S_AUTH)
1378                         ieee80211_new_state(ic, IEEE80211_S_SCAN,
1379                             IEEE80211_SCAN_FAIL_STATUS);
1380         }
1381 }
1382
1383 /*
1384  * Convert a WPA cipher selector OUI to an internal
1385  * cipher algorithm.  Where appropriate we also
1386  * record any key length.
1387  */
1388 static int
1389 wpa_cipher(uint8_t *sel, uint8_t *keylen)
1390 {
1391 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
1392         uint32_t w = LE_READ_4(sel);
1393
1394         switch (w) {
1395         case WPA_SEL(WPA_CSE_NULL):
1396                 return IEEE80211_CIPHER_NONE;
1397         case WPA_SEL(WPA_CSE_WEP40):
1398                 if (keylen)
1399                         *keylen = 40 / NBBY;
1400                 return IEEE80211_CIPHER_WEP;
1401         case WPA_SEL(WPA_CSE_WEP104):
1402                 if (keylen)
1403                         *keylen = 104 / NBBY;
1404                 return IEEE80211_CIPHER_WEP;
1405         case WPA_SEL(WPA_CSE_TKIP):
1406                 return IEEE80211_CIPHER_TKIP;
1407         case WPA_SEL(WPA_CSE_CCMP):
1408                 return IEEE80211_CIPHER_AES_CCM;
1409         }
1410         return 32;              /* NB: so 1<< is discarded */
1411 #undef WPA_SEL
1412 }
1413
1414 /*
1415  * Convert a WPA key management/authentication algorithm
1416  * to an internal code.
1417  */
1418 static int
1419 wpa_keymgmt(uint8_t *sel)
1420 {
1421 #define WPA_SEL(x)      (((x)<<24)|WPA_OUI)
1422         uint32_t w = LE_READ_4(sel);
1423
1424         switch (w) {
1425         case WPA_SEL(WPA_ASE_8021X_UNSPEC):
1426                 return WPA_ASE_8021X_UNSPEC;
1427         case WPA_SEL(WPA_ASE_8021X_PSK):
1428                 return WPA_ASE_8021X_PSK;
1429         case WPA_SEL(WPA_ASE_NONE):
1430                 return WPA_ASE_NONE;
1431         }
1432         return 0;               /* NB: so is discarded */
1433 #undef WPA_SEL
1434 }
1435
1436 /*
1437  * Parse a WPA information element to collect parameters
1438  * and validate the parameters against what has been
1439  * configured for the system.
1440  */
1441 static int
1442 ieee80211_parse_wpa(struct ieee80211com *ic, uint8_t *frm,
1443         struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1444 {
1445         uint8_t len = frm[1];
1446         uint32_t w;
1447         int n;
1448
1449         /*
1450          * Check the length once for fixed parts: OUI, type,
1451          * version, mcast cipher, and 2 selector counts.
1452          * Other, variable-length data, must be checked separately.
1453          */
1454         if ((ic->ic_flags & IEEE80211_F_WPA1) == 0) {
1455                 IEEE80211_DISCARD_IE(ic,
1456                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1457                     wh, "WPA", "not WPA, flags 0x%x", ic->ic_flags);
1458                 return IEEE80211_REASON_IE_INVALID;
1459         }
1460         if (len < 14) {
1461                 IEEE80211_DISCARD_IE(ic,
1462                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1463                     wh, "WPA", "too short, len %u", len);
1464                 return IEEE80211_REASON_IE_INVALID;
1465         }
1466         frm += 6, len -= 4;             /* NB: len is payload only */
1467         /* NB: iswapoui already validated the OUI and type */
1468         w = LE_READ_2(frm);
1469         if (w != WPA_VERSION) {
1470                 IEEE80211_DISCARD_IE(ic,
1471                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1472                     wh, "WPA", "bad version %u", w);
1473                 return IEEE80211_REASON_IE_INVALID;
1474         }
1475         frm += 2, len -= 2;
1476
1477         /* multicast/group cipher */
1478         w = wpa_cipher(frm, &rsn->rsn_mcastkeylen);
1479         if (w != rsn->rsn_mcastcipher) {
1480                 IEEE80211_DISCARD_IE(ic,
1481                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1482                     wh, "WPA", "mcast cipher mismatch; got %u, expected %u",
1483                     w, rsn->rsn_mcastcipher);
1484                 return IEEE80211_REASON_IE_INVALID;
1485         }
1486         frm += 4, len -= 4;
1487
1488         /* unicast ciphers */
1489         n = LE_READ_2(frm);
1490         frm += 2, len -= 2;
1491         if (len < n*4+2) {
1492                 IEEE80211_DISCARD_IE(ic,
1493                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1494                     wh, "WPA", "ucast cipher data too short; len %u, n %u",
1495                     len, n);
1496                 return IEEE80211_REASON_IE_INVALID;
1497         }
1498         w = 0;
1499         for (; n > 0; n--) {
1500                 w |= 1<<wpa_cipher(frm, &rsn->rsn_ucastkeylen);
1501                 frm += 4, len -= 4;
1502         }
1503         w &= rsn->rsn_ucastcipherset;
1504         if (w == 0) {
1505                 IEEE80211_DISCARD_IE(ic,
1506                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1507                     wh, "WPA", "%s", "ucast cipher set empty");
1508                 return IEEE80211_REASON_IE_INVALID;
1509         }
1510         if (w & (1<<IEEE80211_CIPHER_TKIP))
1511                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1512         else
1513                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1514
1515         /* key management algorithms */
1516         n = LE_READ_2(frm);
1517         frm += 2, len -= 2;
1518         if (len < n*4) {
1519                 IEEE80211_DISCARD_IE(ic,
1520                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1521                     wh, "WPA", "key mgmt alg data too short; len %u, n %u",
1522                     len, n);
1523                 return IEEE80211_REASON_IE_INVALID;
1524         }
1525         w = 0;
1526         for (; n > 0; n--) {
1527                 w |= wpa_keymgmt(frm);
1528                 frm += 4, len -= 4;
1529         }
1530         w &= rsn->rsn_keymgmtset;
1531         if (w == 0) {
1532                 IEEE80211_DISCARD_IE(ic,
1533                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1534                     wh, "WPA", "%s", "no acceptable key mgmt alg");
1535                 return IEEE80211_REASON_IE_INVALID;
1536         }
1537         if (w & WPA_ASE_8021X_UNSPEC)
1538                 rsn->rsn_keymgmt = WPA_ASE_8021X_UNSPEC;
1539         else
1540                 rsn->rsn_keymgmt = WPA_ASE_8021X_PSK;
1541
1542         if (len > 2)            /* optional capabilities */
1543                 rsn->rsn_caps = LE_READ_2(frm);
1544
1545         return 0;
1546 }
1547
1548 /*
1549  * Convert an RSN cipher selector OUI to an internal
1550  * cipher algorithm.  Where appropriate we also
1551  * record any key length.
1552  */
1553 static int
1554 rsn_cipher(uint8_t *sel, uint8_t *keylen)
1555 {
1556 #define RSN_SEL(x)      (((x)<<24)|RSN_OUI)
1557         uint32_t w = LE_READ_4(sel);
1558
1559         switch (w) {
1560         case RSN_SEL(RSN_CSE_NULL):
1561                 return IEEE80211_CIPHER_NONE;
1562         case RSN_SEL(RSN_CSE_WEP40):
1563                 if (keylen)
1564                         *keylen = 40 / NBBY;
1565                 return IEEE80211_CIPHER_WEP;
1566         case RSN_SEL(RSN_CSE_WEP104):
1567                 if (keylen)
1568                         *keylen = 104 / NBBY;
1569                 return IEEE80211_CIPHER_WEP;
1570         case RSN_SEL(RSN_CSE_TKIP):
1571                 return IEEE80211_CIPHER_TKIP;
1572         case RSN_SEL(RSN_CSE_CCMP):
1573                 return IEEE80211_CIPHER_AES_CCM;
1574         case RSN_SEL(RSN_CSE_WRAP):
1575                 return IEEE80211_CIPHER_AES_OCB;
1576         }
1577         return 32;              /* NB: so 1<< is discarded */
1578 #undef WPA_SEL
1579 }
1580
1581 /*
1582  * Convert an RSN key management/authentication algorithm
1583  * to an internal code.
1584  */
1585 static int
1586 rsn_keymgmt(uint8_t *sel)
1587 {
1588 #define RSN_SEL(x)      (((x)<<24)|RSN_OUI)
1589         uint32_t w = LE_READ_4(sel);
1590
1591         switch (w) {
1592         case RSN_SEL(RSN_ASE_8021X_UNSPEC):
1593                 return RSN_ASE_8021X_UNSPEC;
1594         case RSN_SEL(RSN_ASE_8021X_PSK):
1595                 return RSN_ASE_8021X_PSK;
1596         case RSN_SEL(RSN_ASE_NONE):
1597                 return RSN_ASE_NONE;
1598         }
1599         return 0;               /* NB: so is discarded */
1600 #undef RSN_SEL
1601 }
1602
1603 /*
1604  * Parse a WPA/RSN information element to collect parameters
1605  * and validate the parameters against what has been
1606  * configured for the system.
1607  */
1608 static int
1609 ieee80211_parse_rsn(struct ieee80211com *ic, uint8_t *frm,
1610         struct ieee80211_rsnparms *rsn, const struct ieee80211_frame *wh)
1611 {
1612         uint8_t len = frm[1];
1613         uint32_t w;
1614         int n;
1615
1616         /*
1617          * Check the length once for fixed parts:
1618          * version, mcast cipher, and 2 selector counts.
1619          * Other, variable-length data, must be checked separately.
1620          */
1621         if ((ic->ic_flags & IEEE80211_F_WPA2) == 0) {
1622                 IEEE80211_DISCARD_IE(ic,
1623                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1624                     wh, "WPA", "not RSN, flags 0x%x", ic->ic_flags);
1625                 return IEEE80211_REASON_IE_INVALID;
1626         }
1627         if (len < 10) {
1628                 IEEE80211_DISCARD_IE(ic,
1629                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1630                     wh, "RSN", "too short, len %u", len);
1631                 return IEEE80211_REASON_IE_INVALID;
1632         }
1633         frm += 2;
1634         w = LE_READ_2(frm);
1635         if (w != RSN_VERSION) {
1636                 IEEE80211_DISCARD_IE(ic,
1637                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1638                     wh, "RSN", "bad version %u", w);
1639                 return IEEE80211_REASON_IE_INVALID;
1640         }
1641         frm += 2, len -= 2;
1642
1643         /* multicast/group cipher */
1644         w = rsn_cipher(frm, &rsn->rsn_mcastkeylen);
1645         if (w != rsn->rsn_mcastcipher) {
1646                 IEEE80211_DISCARD_IE(ic,
1647                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1648                     wh, "RSN", "mcast cipher mismatch; got %u, expected %u",
1649                     w, rsn->rsn_mcastcipher);
1650                 return IEEE80211_REASON_IE_INVALID;
1651         }
1652         frm += 4, len -= 4;
1653
1654         /* unicast ciphers */
1655         n = LE_READ_2(frm);
1656         frm += 2, len -= 2;
1657         if (len < n*4+2) {
1658                 IEEE80211_DISCARD_IE(ic,
1659                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1660                     wh, "RSN", "ucast cipher data too short; len %u, n %u",
1661                     len, n);
1662                 return IEEE80211_REASON_IE_INVALID;
1663         }
1664         w = 0;
1665         for (; n > 0; n--) {
1666                 w |= 1<<rsn_cipher(frm, &rsn->rsn_ucastkeylen);
1667                 frm += 4, len -= 4;
1668         }
1669         w &= rsn->rsn_ucastcipherset;
1670         if (w == 0) {
1671                 IEEE80211_DISCARD_IE(ic,
1672                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1673                     wh, "RSN", "%s", "ucast cipher set empty");
1674                 return IEEE80211_REASON_IE_INVALID;
1675         }
1676         if (w & (1<<IEEE80211_CIPHER_TKIP))
1677                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_TKIP;
1678         else
1679                 rsn->rsn_ucastcipher = IEEE80211_CIPHER_AES_CCM;
1680
1681         /* key management algorithms */
1682         n = LE_READ_2(frm);
1683         frm += 2, len -= 2;
1684         if (len < n*4) {
1685                 IEEE80211_DISCARD_IE(ic,
1686                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1687                     wh, "RSN", "key mgmt alg data too short; len %u, n %u",
1688                     len, n);
1689                 return IEEE80211_REASON_IE_INVALID;
1690         }
1691         w = 0;
1692         for (; n > 0; n--) {
1693                 w |= rsn_keymgmt(frm);
1694                 frm += 4, len -= 4;
1695         }
1696         w &= rsn->rsn_keymgmtset;
1697         if (w == 0) {
1698                 IEEE80211_DISCARD_IE(ic,
1699                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WPA,
1700                     wh, "RSN", "%s", "no acceptable key mgmt alg");
1701                 return IEEE80211_REASON_IE_INVALID;
1702         }
1703         if (w & RSN_ASE_8021X_UNSPEC)
1704                 rsn->rsn_keymgmt = RSN_ASE_8021X_UNSPEC;
1705         else
1706                 rsn->rsn_keymgmt = RSN_ASE_8021X_PSK;
1707
1708         /* optional RSN capabilities */
1709         if (len > 2)
1710                 rsn->rsn_caps = LE_READ_2(frm);
1711         /* XXXPMKID */
1712
1713         return 0;
1714 }
1715
1716 static int
1717 ieee80211_parse_wmeparams(struct ieee80211com *ic, uint8_t *frm,
1718         const struct ieee80211_frame *wh)
1719 {
1720 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
1721         struct ieee80211_wme_state *wme = &ic->ic_wme;
1722         u_int len = frm[1], qosinfo;
1723         int i;
1724
1725         if (len < sizeof(struct ieee80211_wme_param)-2) {
1726                 IEEE80211_DISCARD_IE(ic,
1727                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1728                     wh, "WME", "too short, len %u", len);
1729                 return -1;
1730         }
1731         qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1732         qosinfo &= WME_QOSINFO_COUNT;
1733         /* XXX do proper check for wraparound */
1734         if (qosinfo == wme->wme_wmeChanParams.cap_info)
1735                 return 0;
1736         frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1737         for (i = 0; i < WME_NUM_AC; i++) {
1738                 struct wmeParams *wmep =
1739                         &wme->wme_wmeChanParams.cap_wmeParams[i];
1740                 /* NB: ACI not used */
1741                 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1742                 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1743                 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1744                 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1745                 wmep->wmep_txopLimit = LE_READ_2(frm+2);
1746                 frm += 4;
1747         }
1748         wme->wme_wmeChanParams.cap_info = qosinfo;
1749         return 1;
1750 #undef MS
1751 }
1752
1753 static int
1754 ieee80211_parse_athparams(struct ieee80211_node *ni, uint8_t *frm,
1755         const struct ieee80211_frame *wh)
1756 {
1757         struct ieee80211com *ic = ni->ni_ic;
1758         const struct ieee80211_ath_ie *ath;
1759         u_int len = frm[1];
1760         int capschanged;
1761         uint16_t defkeyix;
1762
1763         if (len < sizeof(struct ieee80211_ath_ie)-2) {
1764                 IEEE80211_DISCARD_IE(ic,
1765                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_SUPERG,
1766                     wh, "Atheros", "too short, len %u", len);
1767                 return -1;
1768         }
1769         ath = (const struct ieee80211_ath_ie *)frm;
1770         capschanged = (ni->ni_ath_flags != ath->ath_capability);
1771         defkeyix = LE_READ_2(ath->ath_defkeyix);
1772         if (capschanged || defkeyix != ni->ni_ath_defkeyix) {
1773                 ni->ni_ath_flags = ath->ath_capability;
1774                 ni->ni_ath_defkeyix = defkeyix;
1775                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_SUPERG,
1776                     "[%s] ath ie change: new caps 0x%x defkeyix 0x%x\n",
1777                     ether_sprintf(ni->ni_macaddr),
1778                     ni->ni_ath_flags, ni->ni_ath_defkeyix);
1779         }
1780         if (IEEE80211_ATH_CAP(ic, ni, ATHEROS_CAP_TURBO_PRIME)) {
1781                 uint16_t curflags, newflags;
1782
1783                 /*
1784                  * Check for turbo mode switch.  Calculate flags
1785                  * for the new mode and effect the switch.
1786                  */
1787                 newflags = curflags = ic->ic_bsschan->ic_flags;
1788                 /* NB: BOOST is not in ic_flags, so get it from the ie */
1789                 if (ath->ath_capability & ATHEROS_CAP_BOOST)
1790                         newflags |= IEEE80211_CHAN_TURBO;
1791                 else
1792                         newflags &= ~IEEE80211_CHAN_TURBO;
1793                 if (newflags != curflags)
1794                         ieee80211_dturbo_switch(ic, newflags);
1795         }
1796         return capschanged;
1797 }
1798
1799 void
1800 ieee80211_parse_ath(struct ieee80211_node *ni, uint8_t *ie)
1801 {
1802         const struct ieee80211_ath_ie *ath =
1803                 (const struct ieee80211_ath_ie *) ie;
1804
1805         ni->ni_ath_flags = ath->ath_capability;
1806         ni->ni_ath_defkeyix = LE_READ_2(&ath->ath_defkeyix);
1807 }
1808
1809 /* XXX find a better place for definition */
1810 struct l2_update_frame {
1811         struct ether_header eh;
1812         uint8_t dsap;
1813         uint8_t ssap;
1814         uint8_t control;
1815         uint8_t xid[3];
1816 }  __packed;
1817
1818 /*
1819  * Deliver a TGf L2UF frame on behalf of a station.
1820  * This primes any bridge when the station is roaming
1821  * between ap's on the same wired network.
1822  */
1823 static void
1824 ieee80211_deliver_l2uf(struct ieee80211_node *ni)
1825 {
1826         struct ieee80211com *ic = ni->ni_ic;
1827         struct ifnet *ifp = ic->ic_ifp;
1828         struct mbuf *m;
1829         struct l2_update_frame *l2uf;
1830         struct ether_header *eh;
1831
1832         m = m_gethdr(M_NOWAIT, MT_DATA);
1833         if (m == NULL) {
1834                 IEEE80211_NOTE(ic, IEEE80211_MSG_ASSOC, ni,
1835                     "%s", "no mbuf for l2uf frame");
1836                 ic->ic_stats.is_rx_nobuf++;     /* XXX not right */
1837                 return;
1838         }
1839         l2uf = mtod(m, struct l2_update_frame *);
1840         eh = &l2uf->eh;
1841         /* dst: Broadcast address */
1842         IEEE80211_ADDR_COPY(eh->ether_dhost, ifp->if_broadcastaddr);
1843         /* src: associated STA */
1844         IEEE80211_ADDR_COPY(eh->ether_shost, ni->ni_macaddr);
1845         eh->ether_type = htons(sizeof(*l2uf) - sizeof(*eh));
1846
1847         l2uf->dsap = 0;
1848         l2uf->ssap = 0;
1849         l2uf->control = 0xf5;
1850         l2uf->xid[0] = 0x81;
1851         l2uf->xid[1] = 0x80;
1852         l2uf->xid[2] = 0x00;
1853
1854         m->m_pkthdr.len = m->m_len = sizeof(*l2uf);
1855         ieee80211_deliver_data(ic, ni, m);
1856 }
1857
1858 static __inline int
1859 contbgscan(struct ieee80211com *ic)
1860 {
1861         return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1862             time_after(ticks, ic->ic_lastdata + ic->ic_bgscanidle));
1863 }
1864
1865 static __inline int
1866 startbgscan(struct ieee80211com *ic)
1867 {
1868         return ((ic->ic_flags & IEEE80211_F_BGSCAN) &&
1869             !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1870             time_after(ticks, ic->ic_lastscan + ic->ic_bgscanintvl) &&
1871             time_after(ticks, ic->ic_lastdata + ic->ic_bgscanidle));
1872 }
1873
1874 static void
1875 ratesetmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1876         int reassoc, int resp, const char *tag, int rate)
1877 {
1878         struct ieee80211com *ic = ni->ni_ic;
1879
1880         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1881             "[%s] deny %s request, %s rate set mismatch, rate 0x%x\n",
1882             ether_sprintf(wh->i_addr2),
1883             reassoc ? "reassoc" : "assoc", tag, rate);
1884         IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_BASIC_RATE);
1885         ieee80211_node_leave(ic, ni);
1886         ic->ic_stats.is_rx_assoc_norate++;
1887 }
1888
1889 static void
1890 capinfomismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1891         int reassoc, int resp, const char *tag, int capinfo)
1892 {
1893         struct ieee80211com *ic = ni->ni_ic;
1894
1895         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
1896             "[%s] deny %s request, %s mismatch 0x%x\n",
1897             ether_sprintf(wh->i_addr2),
1898             reassoc ? "reassoc" : "assoc", tag, capinfo);
1899         IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_CAPINFO);
1900         ieee80211_node_leave(ic, ni);
1901         ic->ic_stats.is_rx_assoc_capmismatch++;
1902 }
1903
1904 static void
1905 htcapmismatch(struct ieee80211_node *ni, const struct ieee80211_frame *wh,
1906         int reassoc, int resp)
1907 {
1908         struct ieee80211com *ic = ni->ni_ic;
1909
1910         IEEE80211_NOTE_MAC(ic, IEEE80211_MSG_ANY, wh->i_addr2,
1911             "deny %s request, %s missing HT ie", reassoc ? "reassoc" : "assoc");
1912         /* XXX no better code */
1913         IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_OTHER);
1914         ieee80211_node_leave(ic, ni);
1915 }
1916
1917 void
1918 ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
1919         struct ieee80211_node *ni,
1920         int subtype, int rssi, int noise, uint32_t rstamp)
1921 {
1922 #define ISPROBE(_st)    ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1923 #define ISREASSOC(_st)  ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1924         struct ieee80211_frame *wh;
1925         uint8_t *frm, *efrm, *sfrm;
1926         uint8_t *ssid, *rates, *xrates, *wpa, *rsn, *wme, *ath, *htcap, *htinfo;
1927         int reassoc, resp, allocbs;
1928         uint8_t rate;
1929
1930         wh = mtod(m0, struct ieee80211_frame *);
1931         frm = (uint8_t *)&wh[1];
1932         efrm = mtod(m0, uint8_t *) + m0->m_len;
1933         switch (subtype) {
1934         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1935         case IEEE80211_FC0_SUBTYPE_BEACON: {
1936                 struct ieee80211_scanparams scan;
1937
1938                 /*
1939                  * We process beacon/probe response frames:
1940                  *    o when scanning, or
1941                  *    o station mode when associated (to collect state
1942                  *      updates such as 802.11g slot time), or
1943                  *    o adhoc mode (to discover neighbors)
1944                  * Frames otherwise received are discarded.
1945                  */
1946                 if (!((ic->ic_flags & IEEE80211_F_SCAN) ||
1947                       (ic->ic_opmode == IEEE80211_M_STA && ni->ni_associd) ||
1948                        ic->ic_opmode == IEEE80211_M_IBSS)) {
1949                         ic->ic_stats.is_rx_mgtdiscard++;
1950                         return;
1951                 }
1952                 /*
1953                  * beacon/probe response frame format
1954                  *      [8] time stamp
1955                  *      [2] beacon interval
1956                  *      [2] capability information
1957                  *      [tlv] ssid
1958                  *      [tlv] supported rates
1959                  *      [tlv] country information
1960                  *      [tlv] parameter set (FH/DS)
1961                  *      [tlv] erp information
1962                  *      [tlv] extended supported rates
1963                  *      [tlv] WME
1964                  *      [tlv] WPA or RSN
1965                  *      [tlv] HT capabilities
1966                  *      [tlv] HT information
1967                  *      [tlv] Atheros capabilities
1968                  */
1969                 IEEE80211_VERIFY_LENGTH(efrm - frm, 12, return);
1970                 memset(&scan, 0, sizeof(scan));
1971                 scan.tstamp  = frm;                             frm += 8;
1972                 scan.bintval = le16toh(*(uint16_t *)frm);       frm += 2;
1973                 scan.capinfo = le16toh(*(uint16_t *)frm);       frm += 2;
1974                 scan.bchan = IEEE80211_CHAN2IEEE(ic->ic_curchan);
1975                 scan.curchan = ic->ic_curchan;
1976                 scan.ies = frm;
1977                 scan.ies_len = efrm - frm;
1978
1979                 while (efrm - frm > 1) {
1980                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1981                         switch (*frm) {
1982                         case IEEE80211_ELEMID_SSID:
1983                                 scan.ssid = frm;
1984                                 break;
1985                         case IEEE80211_ELEMID_RATES:
1986                                 scan.rates = frm;
1987                                 break;
1988                         case IEEE80211_ELEMID_COUNTRY:
1989                                 scan.country = frm;
1990                                 break;
1991                         case IEEE80211_ELEMID_FHPARMS:
1992                                 if (ic->ic_phytype == IEEE80211_T_FH) {
1993                                         scan.fhdwell = LE_READ_2(&frm[2]);
1994                                         scan.bchan = IEEE80211_FH_CHAN(frm[4], frm[5]);
1995                                         scan.fhindex = frm[6];
1996                                 }
1997                                 break;
1998                         case IEEE80211_ELEMID_DSPARMS:
1999                                 /*
2000                                  * XXX hack this since depending on phytype
2001                                  * is problematic for multi-mode devices.
2002                                  */
2003                                 if (ic->ic_phytype != IEEE80211_T_FH)
2004                                         scan.bchan = frm[2];
2005                                 break;
2006                         case IEEE80211_ELEMID_TIM:
2007                                 /* XXX ATIM? */
2008                                 scan.tim = frm;
2009                                 scan.timoff = frm - mtod(m0, uint8_t *);
2010                                 break;
2011                         case IEEE80211_ELEMID_IBSSPARMS:
2012                                 break;
2013                         case IEEE80211_ELEMID_XRATES:
2014                                 scan.xrates = frm;
2015                                 break;
2016                         case IEEE80211_ELEMID_ERP:
2017                                 if (frm[1] != 1) {
2018                                         IEEE80211_DISCARD_IE(ic,
2019                                             IEEE80211_MSG_ELEMID, wh, "ERP",
2020                                             "bad len %u", frm[1]);
2021                                         ic->ic_stats.is_rx_elem_toobig++;
2022                                         break;
2023                                 }
2024                                 scan.erp = frm[2];
2025                                 break;
2026                         case IEEE80211_ELEMID_HTCAP:
2027                                 scan.htcap = frm;
2028                                 break;
2029                         case IEEE80211_ELEMID_RSN:
2030                                 scan.rsn = frm;
2031                                 break;
2032                         case IEEE80211_ELEMID_HTINFO:
2033                                 scan.htinfo = frm;
2034                                 break;
2035                         case IEEE80211_ELEMID_VENDOR:
2036                                 if (iswpaoui(frm))
2037                                         scan.wpa = frm;
2038                                 else if (iswmeparam(frm) || iswmeinfo(frm))
2039                                         scan.wme = frm;
2040                                 else if (isatherosoui(frm))
2041                                         scan.ath = frm;
2042                                 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
2043                                         /*
2044                                          * Accept pre-draft HT ie's if the
2045                                          * standard ones have not been seen.
2046                                          */
2047                                         if (ishtcapoui(frm)) {
2048                                                 if (scan.htcap == NULL)
2049                                                         scan.htcap = frm;
2050                                         } else if (ishtinfooui(frm)) {
2051                                                 if (scan.htinfo == NULL)
2052                                                         scan.htcap = frm;
2053                                         }
2054                                 }
2055                                 break;
2056                         default:
2057                                 IEEE80211_DISCARD_IE(ic, IEEE80211_MSG_ELEMID,
2058                                     wh, "unhandled",
2059                                     "id %u, len %u", *frm, frm[1]);
2060                                 ic->ic_stats.is_rx_elem_unknown++;
2061                                 break;
2062                         }
2063                         frm += frm[1] + 2;
2064                 }
2065                 IEEE80211_VERIFY_ELEMENT(scan.rates, IEEE80211_RATE_MAXSIZE);
2066                 if (scan.xrates != NULL)
2067                         IEEE80211_VERIFY_ELEMENT(scan.xrates,
2068                                 IEEE80211_RATE_MAXSIZE - scan.rates[1]);
2069                 IEEE80211_VERIFY_ELEMENT(scan.ssid, IEEE80211_NWID_LEN);
2070 #if IEEE80211_CHAN_MAX < 255
2071                 if (scan.chan > IEEE80211_CHAN_MAX) {
2072                         IEEE80211_DISCARD(ic, IEEE80211_MSG_ELEMID,
2073                             wh, ieee80211_mgt_subtype_name[subtype >>
2074                                 IEEE80211_FC0_SUBTYPE_SHIFT],
2075                             "invalid channel %u", scan.chan);
2076                         ic->ic_stats.is_rx_badchan++;
2077                         return;
2078                 }
2079 #endif
2080                 if (IEEE80211_CHAN2IEEE(scan.curchan) != scan.bchan &&
2081                     ic->ic_phytype != IEEE80211_T_FH) {
2082                         /*
2083                          * Frame was received on a channel different from the
2084                          * one indicated in the DS params element id;
2085                          * silently discard it.
2086                          *
2087                          * NB: this can happen due to signal leakage.
2088                          *     But we should take it for FH phy because
2089                          *     the rssi value should be correct even for
2090                          *     different hop pattern in FH.
2091                          */
2092                         IEEE80211_DISCARD(ic,
2093                             IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
2094                             wh, ieee80211_mgt_subtype_name[subtype >>
2095                                 IEEE80211_FC0_SUBTYPE_SHIFT],
2096                             "for off-channel %u",
2097                             IEEE80211_CHAN2IEEE(scan.curchan));
2098                         ic->ic_stats.is_rx_chanmismatch++;
2099                         return;
2100                 }
2101                 if (!(IEEE80211_BINTVAL_MIN <= scan.bintval &&
2102                       scan.bintval <= IEEE80211_BINTVAL_MAX)) {
2103                         IEEE80211_DISCARD(ic,
2104                             IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
2105                             wh, ieee80211_mgt_subtype_name[subtype >>
2106                                 IEEE80211_FC0_SUBTYPE_SHIFT],
2107                             "bogus beacon interval", scan.bintval);
2108                         ic->ic_stats.is_rx_badbintval++;
2109                         return;
2110                 }
2111                 /*
2112                  * Process HT ie's.  This is complicated by our
2113                  * accepting both the standard ie's and the pre-draft
2114                  * vendor OUI ie's that some vendors still use/require.
2115                  */
2116                 if (scan.htcap != NULL) {
2117                         IEEE80211_VERIFY_LENGTH(scan.htcap[1],
2118                              scan.htcap[0] == IEEE80211_ELEMID_VENDOR ?
2119                                  4 + sizeof(struct ieee80211_ie_htcap)-2 :
2120                                  sizeof(struct ieee80211_ie_htcap)-2,
2121                              scan.htcap = NULL);
2122                 }
2123                 if (scan.htinfo != NULL) {
2124                         IEEE80211_VERIFY_LENGTH(scan.htinfo[1],
2125                              scan.htinfo[0] == IEEE80211_ELEMID_VENDOR ?
2126                                  4 + sizeof(struct ieee80211_ie_htinfo)-2 :
2127                                  sizeof(struct ieee80211_ie_htinfo)-2,
2128                              scan.htinfo = NULL);
2129                 }
2130
2131                 /*
2132                  * Count frame now that we know it's to be processed.
2133                  */
2134                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
2135                         ic->ic_stats.is_rx_beacon++;            /* XXX remove */
2136                         IEEE80211_NODE_STAT(ni, rx_beacons);
2137                 } else
2138                         IEEE80211_NODE_STAT(ni, rx_proberesp);
2139
2140                 /*
2141                  * When operating in station mode, check for state updates.
2142                  * Be careful to ignore beacons received while doing a
2143                  * background scan.  We consider only 11g/WMM stuff right now.
2144                  */
2145                 if (ic->ic_opmode == IEEE80211_M_STA &&
2146                     ni->ni_associd != 0 &&
2147                     ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
2148                      IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
2149                         /* record tsf of last beacon */
2150                         memcpy(ni->ni_tstamp.data, scan.tstamp,
2151                                 sizeof(ni->ni_tstamp));
2152                         /* count beacon frame for s/w bmiss handling */
2153                         ic->ic_swbmiss_count++;
2154                         ic->ic_bmiss_count = 0;
2155                         if (ni->ni_erp != scan.erp) {
2156                                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2157                                     "[%s] erp change: was 0x%x, now 0x%x\n",
2158                                     ether_sprintf(wh->i_addr2),
2159                                     ni->ni_erp, scan.erp);
2160                                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
2161                                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2162                                         ic->ic_flags |= IEEE80211_F_USEPROT;
2163                                 else
2164                                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
2165                                 ni->ni_erp = scan.erp;
2166                                 /* XXX statistic */
2167                         }
2168                         if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
2169                                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2170                                     "[%s] capabilities change: before 0x%x,"
2171                                      " now 0x%x\n",
2172                                      ether_sprintf(wh->i_addr2),
2173                                      ni->ni_capinfo, scan.capinfo);
2174                                 /*
2175                                  * NB: we assume short preamble doesn't
2176                                  *     change dynamically
2177                                  */
2178                                 ieee80211_set_shortslottime(ic,
2179                                         IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
2180                                         (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2181                                 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
2182                                                | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
2183                                 /* XXX statistic */
2184                         }
2185                         if (scan.wme != NULL &&
2186                             (ni->ni_flags & IEEE80211_NODE_QOS) &&
2187                             ieee80211_parse_wmeparams(ic, scan.wme, wh) > 0)
2188                                 ieee80211_wme_updateparams(ic);
2189                         if (scan.ath != NULL)
2190                                 ieee80211_parse_athparams(ni, scan.ath, wh);
2191                         if (scan.htcap != NULL)
2192                                 ieee80211_parse_htcap(ni, scan.htcap);
2193                         if (scan.htinfo != NULL) {
2194                                 ieee80211_parse_htinfo(ni, scan.htinfo);
2195                                 if (ni->ni_chan != ic->ic_bsschan) {
2196                                         /*
2197                                          * Channel has been adjusted based on
2198                                          * negotiated HT parameters; force the
2199                                          * channel state to follow.
2200                                          */
2201                                         ieee80211_setbsschan(ic, ni->ni_chan);
2202                                 }
2203                         }
2204                         if (scan.tim != NULL) {
2205                                 struct ieee80211_tim_ie *tim =
2206                                     (struct ieee80211_tim_ie *) scan.tim;
2207 #if 0
2208                                 int aid = IEEE80211_AID(ni->ni_associd);
2209                                 int ix = aid / NBBY;
2210                                 int min = tim->tim_bitctl &~ 1;
2211                                 int max = tim->tim_len + min - 4;
2212                                 if ((tim->tim_bitctl&1) ||
2213                                     (min <= ix && ix <= max &&
2214                                      isset(tim->tim_bitmap - min, aid))) {
2215                                         /*
2216                                          * XXX Do not let bg scan kick off
2217                                          * we are expecting data.
2218                                          */
2219                                         ic->ic_lastdata = ticks;
2220                                         ieee80211_sta_pwrsave(ic, 0);
2221                                 }
2222 #endif
2223                                 ni->ni_dtim_count = tim->tim_count;
2224                                 ni->ni_dtim_period = tim->tim_period;
2225                         }
2226                         /*
2227                          * If scanning, pass the info to the scan module.
2228                          * Otherwise, check if it's the right time to do
2229                          * a background scan.  Background scanning must
2230                          * be enabled and we must not be operating in the
2231                          * turbo phase of dynamic turbo mode.  Then,
2232                          * it's been a while since the last background
2233                          * scan and if no data frames have come through
2234                          * recently, kick off a scan.  Note that this
2235                          * is the mechanism by which a background scan
2236                          * is started _and_ continued each time we
2237                          * return on-channel to receive a beacon from
2238                          * our ap.
2239                          */
2240                         if (ic->ic_flags & IEEE80211_F_SCAN) {
2241                                 ieee80211_add_scan(ic, &scan, wh,
2242                                         subtype, rssi, noise, rstamp);
2243                         } else if (contbgscan(ic)) {
2244                                 ieee80211_bg_scan(ic);
2245                         } else if (startbgscan(ic)) {
2246 #if 0
2247                                 /* wakeup if we are sleeing */
2248                                 ieee80211_set_pwrsave(ic, 0);
2249 #endif
2250                                 ieee80211_bg_scan(ic);
2251                         }
2252                         return;
2253                 }
2254                 /*
2255                  * If scanning, just pass information to the scan module.
2256                  */
2257                 if (ic->ic_flags & IEEE80211_F_SCAN) {
2258                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
2259                                 /*
2260                                  * Actively scanning a channel marked passive;
2261                                  * send a probe request now that we know there
2262                                  * is 802.11 traffic present.
2263                                  *
2264                                  * XXX check if the beacon we recv'd gives
2265                                  * us what we need and suppress the probe req
2266                                  */
2267                                 ieee80211_probe_curchan(ic, 1);
2268                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
2269                         }
2270                         ieee80211_add_scan(ic, &scan, wh,
2271                                 subtype, rssi, noise, rstamp);
2272                         return;
2273                 }
2274                 if (scan.capinfo & IEEE80211_CAPINFO_IBSS) {
2275                         if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2276                                 /*
2277                                  * Create a new entry in the neighbor table.
2278                                  */
2279                                 ni = ieee80211_add_neighbor(ic, wh, &scan);
2280                         } else if (ni->ni_capinfo == 0) {
2281                                 /*
2282                                  * Update faked node created on transmit.
2283                                  * Note this also updates the tsf.
2284                                  */
2285                                 ieee80211_init_neighbor(ni, wh, &scan);
2286                         } else {
2287                                 /*
2288                                  * Record tsf for potential resync.
2289                                  */
2290                                 memcpy(ni->ni_tstamp.data, scan.tstamp,
2291                                         sizeof(ni->ni_tstamp));
2292                         }
2293                         if (ni != NULL) {
2294                                 ni->ni_rssi = rssi;
2295                                 ni->ni_noise = noise;
2296                                 ni->ni_rstamp = rstamp;
2297                         }
2298                 }
2299                 break;
2300         }
2301
2302         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
2303                 if (ic->ic_opmode == IEEE80211_M_STA ||
2304                     ic->ic_state != IEEE80211_S_RUN) {
2305                         ic->ic_stats.is_rx_mgtdiscard++;
2306                         return;
2307                 }
2308                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
2309                         /* frame must be directed */
2310                         ic->ic_stats.is_rx_mgtdiscard++;        /* XXX stat */
2311                         return;
2312                 }
2313
2314                 /*
2315                  * prreq frame format
2316                  *      [tlv] ssid
2317                  *      [tlv] supported rates
2318                  *      [tlv] extended supported rates
2319                  */
2320                 ssid = rates = xrates = NULL;
2321                 while (efrm - frm > 1) {
2322                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2323                         switch (*frm) {
2324                         case IEEE80211_ELEMID_SSID:
2325                                 ssid = frm;
2326                                 break;
2327                         case IEEE80211_ELEMID_RATES:
2328                                 rates = frm;
2329                                 break;
2330                         case IEEE80211_ELEMID_XRATES:
2331                                 xrates = frm;
2332                                 break;
2333                         }
2334                         frm += frm[1] + 2;
2335                 }
2336                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2337                 if (xrates != NULL)
2338                         IEEE80211_VERIFY_ELEMENT(xrates,
2339                                 IEEE80211_RATE_MAXSIZE - rates[1]);
2340                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2341                 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2342                 if ((ic->ic_flags & IEEE80211_F_HIDESSID) && ssid[1] == 0) {
2343                         IEEE80211_DISCARD(ic, IEEE80211_MSG_INPUT,
2344                             wh, ieee80211_mgt_subtype_name[subtype >>
2345                                 IEEE80211_FC0_SUBTYPE_SHIFT],
2346                             "%s", "no ssid with ssid suppression enabled");
2347                         ic->ic_stats.is_rx_ssidmismatch++; /*XXX*/
2348                         return;
2349                 }
2350
2351                 allocbs = 0;
2352                 if (ni == ic->ic_bss) {
2353                         if (ic->ic_opmode != IEEE80211_M_IBSS) {
2354                                 ni = ieee80211_tmp_node(ic, wh->i_addr2);
2355                                 allocbs = 1;
2356                         } else if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
2357                                 /*
2358                                  * XXX Cannot tell if the sender is operating
2359                                  * in ibss mode.  But we need a new node to
2360                                  * send the response so blindly add them to the
2361                                  * neighbor table.
2362                                  */
2363                                 ni = ieee80211_fakeup_adhoc_node(&ic->ic_sta,
2364                                         wh->i_addr2);
2365                         }
2366                         if (ni == NULL)
2367                                 return;
2368                 }
2369                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2370                     "[%s] recv probe req\n", ether_sprintf(wh->i_addr2));
2371                 ni->ni_rssi = rssi;
2372                 ni->ni_rstamp = rstamp;
2373                 rate = ieee80211_setup_rates(ni, rates, xrates,
2374                           IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE
2375                         | IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2376                 if (rate & IEEE80211_RATE_BASIC) {
2377                         IEEE80211_DISCARD(ic, IEEE80211_MSG_XRATE,
2378                             wh, ieee80211_mgt_subtype_name[subtype >>
2379                                 IEEE80211_FC0_SUBTYPE_SHIFT],
2380                             "%s", "recv'd rate set invalid");
2381                 } else {
2382                         IEEE80211_SEND_MGMT(ic, ni,
2383                                 IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
2384                 }
2385                 if (allocbs) {
2386                         /*
2387                          * Temporary node created just to send a
2388                          * response, reclaim immediately.
2389                          */
2390                         ieee80211_free_node(ni);
2391                 }
2392                 break;
2393
2394         case IEEE80211_FC0_SUBTYPE_AUTH: {
2395                 uint16_t algo, seq, status;
2396                 /*
2397                  * auth frame format
2398                  *      [2] algorithm
2399                  *      [2] sequence
2400                  *      [2] status
2401                  *      [tlv*] challenge
2402                  */
2403                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
2404                 algo   = le16toh(*(uint16_t *)frm);
2405                 seq    = le16toh(*(uint16_t *)(frm + 2));
2406                 status = le16toh(*(uint16_t *)(frm + 4));
2407                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2408                     "[%s] recv auth frame with algorithm %d seq %d\n",
2409                     ether_sprintf(wh->i_addr2), algo, seq);
2410                 /*
2411                  * Consult the ACL policy module if setup.
2412                  */
2413                 if (ic->ic_acl != NULL &&
2414                     !ic->ic_acl->iac_check(ic, wh->i_addr2)) {
2415                         IEEE80211_DISCARD(ic, IEEE80211_MSG_ACL,
2416                             wh, "auth", "%s", "disallowed by ACL");
2417                         ic->ic_stats.is_rx_acl++;
2418                         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2419                                 IEEE80211_SEND_MGMT(ic, ni,
2420                                     IEEE80211_FC0_SUBTYPE_AUTH,
2421                                     (seq+1) | (IEEE80211_STATUS_UNSPECIFIED<<16));
2422                         }
2423                         return;
2424                 }
2425                 if (ic->ic_flags & IEEE80211_F_COUNTERM) {
2426                         IEEE80211_DISCARD(ic,
2427                             IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
2428                             wh, "auth", "%s", "TKIP countermeasures enabled");
2429                         ic->ic_stats.is_rx_auth_countermeasures++;
2430                         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2431                                 IEEE80211_SEND_MGMT(ic, ni,
2432                                         IEEE80211_FC0_SUBTYPE_AUTH,
2433                                         IEEE80211_REASON_MIC_FAILURE);
2434                         }
2435                         return;
2436                 }
2437                 if (algo == IEEE80211_AUTH_ALG_SHARED)
2438                         ieee80211_auth_shared(ic, wh, frm + 6, efrm, ni, rssi,
2439                             noise, rstamp, seq, status);
2440                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
2441                         ieee80211_auth_open(ic, wh, ni, rssi, noise, rstamp,
2442                             seq, status);
2443                 else {
2444                         IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2445                             wh, "auth", "unsupported alg %d", algo);
2446                         ic->ic_stats.is_rx_auth_unsupported++;
2447                         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2448                                 /* XXX not right */
2449                                 IEEE80211_SEND_MGMT(ic, ni,
2450                                         IEEE80211_FC0_SUBTYPE_AUTH,
2451                                         (seq+1) | (IEEE80211_STATUS_ALG<<16));
2452                         }
2453                         return;
2454                 }
2455                 break;
2456         }
2457
2458         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
2459         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ: {
2460                 uint16_t capinfo, lintval;
2461                 struct ieee80211_rsnparms rsnparms;
2462                 uint8_t reason;
2463                 int badwparsn;
2464
2465                 if (ic->ic_opmode != IEEE80211_M_HOSTAP ||
2466                     ic->ic_state != IEEE80211_S_RUN) {
2467                         ic->ic_stats.is_rx_mgtdiscard++;
2468                         return;
2469                 }
2470
2471                 if (subtype == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
2472                         reassoc = 1;
2473                         resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
2474                 } else {
2475                         reassoc = 0;
2476                         resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
2477                 }
2478                 /*
2479                  * asreq frame format
2480                  *      [2] capability information
2481                  *      [2] listen interval
2482                  *      [6*] current AP address (reassoc only)
2483                  *      [tlv] ssid
2484                  *      [tlv] supported rates
2485                  *      [tlv] extended supported rates
2486                  *      [tlv] WPA or RSN
2487                  *      [tlv] HT capabilities
2488                  *      [tlv] Atheros capabilities
2489                  */
2490                 IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4), return);
2491                 if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) {
2492                         IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
2493                             wh, ieee80211_mgt_subtype_name[subtype >>
2494                                 IEEE80211_FC0_SUBTYPE_SHIFT],
2495                             "%s", "wrong bssid");
2496                         ic->ic_stats.is_rx_assoc_bss++;
2497                         return;
2498                 }
2499                 capinfo = le16toh(*(uint16_t *)frm);    frm += 2;
2500                 lintval = le16toh(*(uint16_t *)frm);    frm += 2;
2501                 if (reassoc)
2502                         frm += 6;       /* ignore current AP info */
2503                 ssid = rates = xrates = wpa = rsn = wme = ath = htcap = NULL;
2504                 sfrm = frm;
2505                 while (efrm - frm > 1) {
2506                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2507                         switch (*frm) {
2508                         case IEEE80211_ELEMID_SSID:
2509                                 ssid = frm;
2510                                 break;
2511                         case IEEE80211_ELEMID_RATES:
2512                                 rates = frm;
2513                                 break;
2514                         case IEEE80211_ELEMID_XRATES:
2515                                 xrates = frm;
2516                                 break;
2517                         /* XXX verify only one of RSN and WPA ie's? */
2518                         case IEEE80211_ELEMID_RSN:
2519                                 rsn = frm;
2520                                 break;
2521                         case IEEE80211_ELEMID_HTCAP:
2522                                 htcap = frm;
2523                                 break;
2524                         case IEEE80211_ELEMID_VENDOR:
2525                                 if (iswpaoui(frm))
2526                                         wpa = frm;
2527                                 else if (iswmeinfo(frm))
2528                                         wme = frm;
2529                                 else if (isatherosoui(frm))
2530                                         ath = frm;
2531                                 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
2532                                         if (ishtcapoui(frm) && htcap == NULL)
2533                                                 htcap = frm;
2534                                 }
2535                                 break;
2536                         }
2537                         frm += frm[1] + 2;
2538                 }
2539                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2540                 if (xrates != NULL)
2541                         IEEE80211_VERIFY_ELEMENT(xrates,
2542                                 IEEE80211_RATE_MAXSIZE - rates[1]);
2543                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
2544                 IEEE80211_VERIFY_SSID(ic->ic_bss, ssid);
2545                 if (htcap != NULL) {
2546                         IEEE80211_VERIFY_LENGTH(htcap[1],
2547                              htcap[0] == IEEE80211_ELEMID_VENDOR ?
2548                                  4 + sizeof(struct ieee80211_ie_htcap)-2 :
2549                                  sizeof(struct ieee80211_ie_htcap)-2,
2550                              return);           /* XXX just NULL out? */
2551                 }
2552
2553                 if (ni == ic->ic_bss) {
2554                         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ANY,
2555                             "[%s] deny %s request, sta not authenticated\n",
2556                             ether_sprintf(wh->i_addr2),
2557                             reassoc ? "reassoc" : "assoc");
2558                         ieee80211_send_error(ic, ni, wh->i_addr2,
2559                             IEEE80211_FC0_SUBTYPE_DEAUTH,
2560                             IEEE80211_REASON_ASSOC_NOT_AUTHED);
2561                         ic->ic_stats.is_rx_assoc_notauth++;
2562                         return;
2563                 }
2564                 /* assert right association security credentials */
2565                 badwparsn = 0;
2566                 switch (ic->ic_flags & IEEE80211_F_WPA) {
2567                 case IEEE80211_F_WPA1:
2568                         if (wpa == NULL)
2569                                 badwparsn = 1;
2570                         break;
2571                 case IEEE80211_F_WPA2:
2572                         if (rsn == NULL)
2573                                 badwparsn = 1;
2574                         break;
2575                 case IEEE80211_F_WPA1|IEEE80211_F_WPA2:
2576                         if (wpa == NULL && rsn == NULL)
2577                                 badwparsn = 1;
2578                         break;
2579                 }
2580                 if (badwparsn) {
2581                         IEEE80211_DPRINTF(ic,
2582                             IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2583                             "[%s] no WPA/RSN IE in association request\n",
2584                             ether_sprintf(wh->i_addr2));
2585                         IEEE80211_SEND_MGMT(ic, ni,
2586                             IEEE80211_FC0_SUBTYPE_DEAUTH,
2587                             IEEE80211_REASON_IE_INVALID);
2588                         ieee80211_node_leave(ic, ni);
2589                         ic->ic_stats.is_rx_assoc_badwpaie++;
2590                         return;
2591                 }
2592                 if (wpa != NULL || rsn != NULL) {
2593                         /*
2594                          * Parse WPA/RSN information element.  Note that
2595                          * we initialize the param block from the node
2596                          * state so that information in the IE overrides
2597                          * our defaults.  The resulting parameters are
2598                          * installed below after the association is assured.
2599                          */
2600                         rsnparms = ni->ni_rsn;
2601                         if (wpa != NULL)
2602                                 reason = ieee80211_parse_wpa(ic, wpa, &rsnparms, wh);
2603                         else
2604                                 reason = ieee80211_parse_rsn(ic, rsn, &rsnparms, wh);
2605                         if (reason != 0) {
2606                                 IEEE80211_SEND_MGMT(ic, ni,
2607                                     IEEE80211_FC0_SUBTYPE_DEAUTH, reason);
2608                                 ieee80211_node_leave(ic, ni);
2609                                 /* XXX distinguish WPA/RSN? */
2610                                 ic->ic_stats.is_rx_assoc_badwpaie++;
2611                                 return;
2612                         }
2613                         IEEE80211_DPRINTF(ic,
2614                             IEEE80211_MSG_ASSOC | IEEE80211_MSG_WPA,
2615                             "[%s] %s ie: mc %u/%u uc %u/%u key %u caps 0x%x\n",
2616                             ether_sprintf(wh->i_addr2),
2617                             wpa != NULL ? "WPA" : "RSN",
2618                             rsnparms.rsn_mcastcipher, rsnparms.rsn_mcastkeylen,
2619                             rsnparms.rsn_ucastcipher, rsnparms.rsn_ucastkeylen,
2620                             rsnparms.rsn_keymgmt, rsnparms.rsn_caps);
2621                 }
2622                 /* discard challenge after association */
2623                 if (ni->ni_challenge != NULL) {
2624                         FREE(ni->ni_challenge, M_80211_NODE);
2625                         ni->ni_challenge = NULL;
2626                 }
2627                 /* NB: 802.11 spec says to ignore station's privacy bit */
2628                 if ((capinfo & IEEE80211_CAPINFO_ESS) == 0) {
2629                         capinfomismatch(ni, wh, reassoc, resp,
2630                             "capability", capinfo);
2631                         return;
2632                 }
2633                 /*
2634                  * Disallow re-associate w/ invalid slot time setting.
2635                  */
2636                 if (ni->ni_associd != 0 &&
2637                     IEEE80211_IS_CHAN_ANYG(ic->ic_bsschan) &&
2638                     ((ni->ni_capinfo ^ capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME)) {
2639                         capinfomismatch(ni, wh, reassoc, resp,
2640                             "slot time", capinfo);
2641                         return;
2642                 }
2643                 rate = ieee80211_setup_rates(ni, rates, xrates,
2644                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2645                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2646                 if (rate & IEEE80211_RATE_BASIC) {
2647                         ratesetmismatch(ni, wh, reassoc, resp, "basic", rate);
2648                         return;
2649                 }
2650                 /*
2651                  * If constrained to 11g-only stations reject an
2652                  * 11b-only station.  We cheat a bit here by looking
2653                  * at the max negotiated xmit rate and assuming anyone
2654                  * with a best rate <24Mb/s is an 11b station.
2655                  */
2656                 if ((ic->ic_flags & IEEE80211_F_PUREG) && rate < 48) {
2657                         ratesetmismatch(ni, wh, reassoc, resp, "11g", rate);
2658                         return;
2659                 }
2660                 /* XXX enforce PUREN */
2661                 /* 802.11n-specific rateset handling */
2662                 if (IEEE80211_IS_CHAN_HT(ic->ic_curchan) && htcap != NULL) {
2663                         rate = ieee80211_setup_htrates(ni, htcap,
2664                                 IEEE80211_F_DOFRATE | IEEE80211_F_DONEGO |
2665                                 IEEE80211_F_DOBRS);
2666                         if (rate & IEEE80211_RATE_BASIC) {
2667                                 /* XXX 11n-specific stat */
2668                                 ratesetmismatch(ni, wh, reassoc, resp,
2669                                     "HT", rate);
2670                                 return;
2671                         }
2672                         ieee80211_ht_node_init(ni, htcap);
2673                 } else if (ni->ni_flags & IEEE80211_NODE_HT)
2674                         ieee80211_ht_node_cleanup(ni);
2675                 /*
2676                  * Allow AMPDU operation only with unencrypted traffic
2677                  * or AES-CCM; the 11n spec only specifies these ciphers
2678                  * so permitting any others is undefined and can lead
2679                  * to interoperability problems.
2680                  *
2681                  * NB: We check for AES by looking at the GTK cipher
2682                  *     since the WPA/11i specs say the PTK cipher has
2683                  *     to be "as good or better".
2684                  */
2685                 if ((ni->ni_flags & IEEE80211_NODE_HT) &&
2686                     (((ic->ic_flags & IEEE80211_F_WPA) &&
2687                       rsnparms.rsn_mcastcipher != IEEE80211_CIPHER_AES_CCM) ||
2688                      (ic->ic_flags & (IEEE80211_F_WPA|IEEE80211_F_PRIVACY)) == IEEE80211_F_PRIVACY)) {
2689                         IEEE80211_NOTE(ic,
2690                             IEEE80211_MSG_ASSOC | IEEE80211_MSG_11N, ni,
2691                             "disallow HT use because WEP or TKIP requested, "
2692                             "capinfo 0x%x mcastcipher %d", capinfo,
2693                             rsnparms.rsn_mcastcipher);
2694                         ieee80211_ht_node_cleanup(ni);
2695                         ic->ic_stats.is_ht_assoc_downgrade++;
2696                 }
2697                 /*
2698                  * If constrained to 11n-only stations reject legacy stations.
2699                  */
2700                 if ((ic->ic_flags_ext & IEEE80211_FEXT_PUREN) &&
2701                     (ni->ni_flags & IEEE80211_NODE_HT) == 0) {
2702                         htcapmismatch(ni, wh, reassoc, resp);
2703                         ic->ic_stats.is_ht_assoc_nohtcap++;
2704                         return;
2705                 }
2706                 ni->ni_rssi = rssi;
2707                 ni->ni_noise = noise;
2708                 ni->ni_rstamp = rstamp;
2709                 ni->ni_intval = lintval;
2710                 ni->ni_capinfo = capinfo;
2711                 ni->ni_chan = ic->ic_bsschan;
2712                 ni->ni_fhdwell = ic->ic_bss->ni_fhdwell;
2713                 ni->ni_fhindex = ic->ic_bss->ni_fhindex;
2714                 /*
2715                  * Store the IEs.
2716                  * XXX maybe better to just expand
2717                  */
2718                 if (ieee80211_ies_init(&ni->ni_ies, sfrm, efrm - sfrm)) {
2719 #define setie(_ie, _off)        ieee80211_ies_setie(ni->ni_ies, _ie, _off)
2720                         if (wpa != NULL) {
2721                                 setie(wpa_ie, wpa - sfrm);
2722                                 ni->ni_rsn = rsnparms;
2723                         }
2724                         if (rsn != NULL) {
2725                                 setie(rsn_ie, rsn - sfrm);
2726                                 ni->ni_rsn = rsnparms;
2727                         }
2728                         if (htcap != NULL)
2729                                 setie(htcap_ie, htcap - sfrm);
2730                         if (wme != NULL) {
2731                                 setie(wme_ie, wme - sfrm);
2732                                 /*
2733                                  * Mark node as capable of QoS.
2734                                  */
2735                                 ni->ni_flags |= IEEE80211_NODE_QOS;
2736                         } else
2737                                 ni->ni_flags &= ~IEEE80211_NODE_QOS;
2738                         if (ath != NULL) {
2739                                 setie(ath_ie, ath - sfrm);
2740                                 /*
2741                                  * Parse ATH station parameters.
2742                                  */
2743                                 ieee80211_parse_ath(ni, ni->ni_ies.ath_ie);
2744                         } else
2745                                 ni->ni_ath_flags = 0;
2746 #undef setie
2747                 } else {
2748                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
2749                         ni->ni_ath_flags = 0;
2750                 }
2751                 ieee80211_node_join(ic, ni, resp);
2752                 ieee80211_deliver_l2uf(ni);
2753                 break;
2754         }
2755
2756         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
2757         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
2758                 uint16_t capinfo, associd;
2759                 uint16_t status;
2760
2761                 if (ic->ic_opmode != IEEE80211_M_STA ||
2762                     ic->ic_state != IEEE80211_S_ASSOC) {
2763                         ic->ic_stats.is_rx_mgtdiscard++;
2764                         return;
2765                 }
2766
2767                 /*
2768                  * asresp frame format
2769                  *      [2] capability information
2770                  *      [2] status
2771                  *      [2] association ID
2772                  *      [tlv] supported rates
2773                  *      [tlv] extended supported rates
2774                  *      [tlv] WME
2775                  *      [tlv] HT capabilities
2776                  *      [tlv] HT info
2777                  */
2778                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
2779                 ni = ic->ic_bss;
2780                 capinfo = le16toh(*(uint16_t *)frm);
2781                 frm += 2;
2782                 status = le16toh(*(uint16_t *)frm);
2783                 frm += 2;
2784                 if (status != 0) {
2785                         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2786                             "[%s] %sassoc failed (reason %d)\n",
2787                             ether_sprintf(wh->i_addr2),
2788                             ISREASSOC(subtype) ?  "re" : "", status);
2789                         if (ni != ic->ic_bss)   /* XXX never true? */
2790                                 ni->ni_fails++;
2791                         ic->ic_stats.is_rx_auth_fail++; /* XXX */
2792                         return;
2793                 }
2794                 associd = le16toh(*(uint16_t *)frm);
2795                 frm += 2;
2796
2797                 rates = xrates = wme = htcap = htinfo = NULL;
2798                 while (efrm - frm > 1) {
2799                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
2800                         switch (*frm) {
2801                         case IEEE80211_ELEMID_RATES:
2802                                 rates = frm;
2803                                 break;
2804                         case IEEE80211_ELEMID_XRATES:
2805                                 xrates = frm;
2806                                 break;
2807                         case IEEE80211_ELEMID_HTCAP:
2808                                 htcap = frm;
2809                                 break;
2810                         case IEEE80211_ELEMID_HTINFO:
2811                                 htinfo = frm;
2812                                 break;
2813                         case IEEE80211_ELEMID_VENDOR:
2814                                 if (iswmeoui(frm))
2815                                         wme = frm;
2816                                 else if (ic->ic_flags_ext & IEEE80211_FEXT_HTCOMPAT) {
2817                                         /*
2818                                          * Accept pre-draft HT ie's if the
2819                                          * standard ones have not been seen.
2820                                          */
2821                                         if (ishtcapoui(frm)) {
2822                                                 if (htcap == NULL)
2823                                                         htcap = frm;
2824                                         } else if (ishtinfooui(frm)) {
2825                                                 if (htinfo == NULL)
2826                                                         htcap = frm;
2827                                         }
2828                                 }
2829                                 /* XXX Atheros OUI support */
2830                                 break;
2831                         }
2832                         frm += frm[1] + 2;
2833                 }
2834
2835                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
2836                 if (xrates != NULL)
2837                         IEEE80211_VERIFY_ELEMENT(xrates,
2838                                 IEEE80211_RATE_MAXSIZE - rates[1]);
2839                 rate = ieee80211_setup_rates(ni, rates, xrates,
2840                                 IEEE80211_F_JOIN |
2841                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
2842                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2843                 if (rate & IEEE80211_RATE_BASIC) {
2844                         IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2845                             "[%s] %sassoc failed (rate set mismatch)\n",
2846                             ether_sprintf(wh->i_addr2),
2847                             ISREASSOC(subtype) ?  "re" : "");
2848                         if (ni != ic->ic_bss)   /* XXX never true? */
2849                                 ni->ni_fails++;
2850                         ic->ic_stats.is_rx_assoc_norate++;
2851                         ieee80211_new_state(ic, IEEE80211_S_SCAN,
2852                             IEEE80211_SCAN_FAIL_STATUS);
2853                         return;
2854                 }
2855
2856                 ni->ni_capinfo = capinfo;
2857                 ni->ni_associd = associd;
2858                 if (wme != NULL &&
2859                     ieee80211_parse_wmeparams(ic, wme, wh) >= 0) {
2860                         ni->ni_flags |= IEEE80211_NODE_QOS;
2861                         ieee80211_wme_updateparams(ic);
2862                 } else
2863                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
2864                 /*
2865                  * Setup HT state according to the negotiation.
2866                  */
2867                 if ((ic->ic_htcaps & IEEE80211_HTC_HT) &&
2868                     htcap != NULL && htinfo != NULL) {
2869                         ieee80211_ht_node_init(ni, htcap);
2870                         ieee80211_parse_htinfo(ni, htinfo);
2871                         ieee80211_setup_htrates(ni,
2872                             htcap, IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
2873                         ieee80211_setup_basic_htrates(ni, htinfo);
2874                         if (ni->ni_chan != ic->ic_bsschan) {
2875                                 /*
2876                                  * Channel has been adjusted based on
2877                                  * negotiated HT parameters; force the
2878                                  * channel state to follow.
2879                                  */
2880                                 ieee80211_setbsschan(ic, ni->ni_chan);
2881                         }
2882                 }
2883                 /*
2884                  * Configure state now that we are associated.
2885                  *
2886                  * XXX may need different/additional driver callbacks?
2887                  */
2888                 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
2889                     (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
2890                         ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
2891                         ic->ic_flags &= ~IEEE80211_F_USEBARKER;
2892                 } else {
2893                         ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
2894                         ic->ic_flags |= IEEE80211_F_USEBARKER;
2895                 }
2896                 ieee80211_set_shortslottime(ic,
2897                         IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
2898                         (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
2899                 /*
2900                  * Honor ERP protection.
2901                  *
2902                  * NB: ni_erp should zero for non-11g operation.
2903                  */
2904                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
2905                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
2906                         ic->ic_flags |= IEEE80211_F_USEPROT;
2907                 else
2908                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
2909                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2910                     "[%s] %sassoc success: %s preamble, %s slot time%s%s%s%s\n",
2911                     ether_sprintf(wh->i_addr2),
2912                     ISREASSOC(subtype) ? "re" : "",
2913                     ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
2914                     ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
2915                     ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
2916                     ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
2917                     ni->ni_flags & IEEE80211_NODE_HT ?
2918                         (ni->ni_chw == 20 ? ", HT20" : ", HT40") : "",
2919                     ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
2920                     IEEE80211_ATH_CAP(ic, ni, IEEE80211_NODE_FF) ?
2921                         ", fast-frames" : "",
2922                     IEEE80211_ATH_CAP(ic, ni, IEEE80211_NODE_TURBOP) ?
2923                         ", turbo" : ""
2924                 );
2925                 ieee80211_new_state(ic, IEEE80211_S_RUN, subtype);
2926                 break;
2927         }
2928
2929         case IEEE80211_FC0_SUBTYPE_DEAUTH: {
2930                 uint16_t reason;
2931
2932                 if (ic->ic_state == IEEE80211_S_SCAN) {
2933                         ic->ic_stats.is_rx_mgtdiscard++;
2934                         return;
2935                 }
2936                 /*
2937                  * deauth frame format
2938                  *      [2] reason
2939                  */
2940                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2941                 reason = le16toh(*(uint16_t *)frm);
2942                 ic->ic_stats.is_rx_deauth++;
2943                 IEEE80211_NODE_STAT(ni, rx_deauth);
2944
2945                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) {
2946                         /* NB: can happen when in promiscuous mode */
2947                         ic->ic_stats.is_rx_mgtdiscard++;
2948                         break;
2949                 }
2950                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_AUTH,
2951                     "[%s] recv deauthenticate (reason %d)\n",
2952                     ether_sprintf(ni->ni_macaddr), reason);
2953                 switch (ic->ic_opmode) {
2954                 case IEEE80211_M_STA:
2955                         ieee80211_new_state(ic, IEEE80211_S_AUTH,
2956                             (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
2957                         break;
2958                 case IEEE80211_M_HOSTAP:
2959                         if (ni != ic->ic_bss)
2960                                 ieee80211_node_leave(ic, ni);
2961                         break;
2962                 default:
2963                         ic->ic_stats.is_rx_mgtdiscard++;
2964                         break;
2965                 }
2966                 break;
2967         }
2968
2969         case IEEE80211_FC0_SUBTYPE_DISASSOC: {
2970                 uint16_t reason;
2971
2972                 if (ic->ic_state != IEEE80211_S_RUN &&
2973                     ic->ic_state != IEEE80211_S_ASSOC &&
2974                     ic->ic_state != IEEE80211_S_AUTH) {
2975                         ic->ic_stats.is_rx_mgtdiscard++;
2976                         return;
2977                 }
2978                 /*
2979                  * disassoc frame format
2980                  *      [2] reason
2981                  */
2982                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
2983                 reason = le16toh(*(uint16_t *)frm);
2984                 ic->ic_stats.is_rx_disassoc++;
2985                 IEEE80211_NODE_STAT(ni, rx_disassoc);
2986
2987                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, ic->ic_myaddr)) {
2988                         /* NB: can happen when in promiscuous mode */
2989                         ic->ic_stats.is_rx_mgtdiscard++;
2990                         break;
2991                 }
2992                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_ASSOC,
2993                     "[%s] recv disassociate (reason %d)\n",
2994                     ether_sprintf(ni->ni_macaddr), reason);
2995                 switch (ic->ic_opmode) {
2996                 case IEEE80211_M_STA:
2997                         ieee80211_new_state(ic, IEEE80211_S_ASSOC, 0);
2998                         break;
2999                 case IEEE80211_M_HOSTAP:
3000                         if (ni != ic->ic_bss)
3001                                 ieee80211_node_leave(ic, ni);
3002                         break;
3003                 default:
3004                         ic->ic_stats.is_rx_mgtdiscard++;
3005                         break;
3006                 }
3007                 break;
3008         }
3009
3010         case IEEE80211_FC0_SUBTYPE_ACTION: {
3011                 const struct ieee80211_action *ia;
3012
3013                 if (ic->ic_state != IEEE80211_S_RUN &&
3014                     ic->ic_state != IEEE80211_S_ASSOC &&
3015                     ic->ic_state != IEEE80211_S_AUTH) {
3016                         ic->ic_stats.is_rx_mgtdiscard++;
3017                         return;
3018                 }
3019                 /*
3020                  * action frame format:
3021                  *      [1] category
3022                  *      [1] action
3023                  *      [tlv] parameters
3024                  */
3025                 IEEE80211_VERIFY_LENGTH(efrm - frm,
3026                         sizeof(struct ieee80211_action), return);
3027                 ia = (const struct ieee80211_action *) frm;
3028
3029                 ic->ic_stats.is_rx_action++;
3030                 IEEE80211_NODE_STAT(ni, rx_action);
3031
3032                 /* verify frame payloads but defer processing */
3033                 /* XXX maybe push this to method */
3034                 switch (ia->ia_category) {
3035                 case IEEE80211_ACTION_CAT_BA:
3036                         switch (ia->ia_action) {
3037                         case IEEE80211_ACTION_BA_ADDBA_REQUEST:
3038                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
3039                                     sizeof(struct ieee80211_action_ba_addbarequest),
3040                                     return);
3041                                 break;
3042                         case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
3043                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
3044                                     sizeof(struct ieee80211_action_ba_addbaresponse),
3045                                     return);
3046                                 break;
3047                         case IEEE80211_ACTION_BA_DELBA:
3048                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
3049                                     sizeof(struct ieee80211_action_ba_delba),
3050                                     return);
3051                                 break;
3052                         }
3053                         break;
3054                 case IEEE80211_ACTION_CAT_HT:
3055                         switch (ia->ia_action) {
3056                         case IEEE80211_ACTION_HT_TXCHWIDTH:
3057                                 IEEE80211_VERIFY_LENGTH(efrm - frm,
3058                                     sizeof(struct ieee80211_action_ht_txchwidth),
3059                                     return);
3060                                 break;
3061                         }
3062                         break;
3063                 }
3064                 ic->ic_recv_action(ni, frm, efrm);
3065                 break;
3066         }
3067
3068         default:
3069                 IEEE80211_DISCARD(ic, IEEE80211_MSG_ANY,
3070                      wh, "mgt", "subtype 0x%x not handled", subtype);
3071                 ic->ic_stats.is_rx_badsubtype++;
3072                 break;
3073         }
3074 #undef ISREASSOC
3075 #undef ISPROBE
3076 }
3077 #undef IEEE80211_VERIFY_LENGTH
3078 #undef IEEE80211_VERIFY_ELEMENT
3079
3080 /*
3081  * Process a received ps-poll frame.
3082  */
3083 static void
3084 ieee80211_recv_pspoll(struct ieee80211com *ic,
3085         struct ieee80211_node *ni, struct mbuf *m0)
3086 {
3087         struct ieee80211_frame_min *wh;
3088         struct mbuf *m;
3089         uint16_t aid;
3090         int qlen;
3091
3092         wh = mtod(m0, struct ieee80211_frame_min *);
3093         if (ni->ni_associd == 0) {
3094                 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
3095                     (struct ieee80211_frame *) wh, "ps-poll",
3096                     "%s", "unassociated station");
3097                 ic->ic_stats.is_ps_unassoc++;
3098                 IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
3099                         IEEE80211_REASON_NOT_ASSOCED);
3100                 return;
3101         }
3102
3103         aid = le16toh(*(uint16_t *)wh->i_dur);
3104         if (aid != ni->ni_associd) {
3105                 IEEE80211_DISCARD(ic, IEEE80211_MSG_POWER | IEEE80211_MSG_DEBUG,
3106                     (struct ieee80211_frame *) wh, "ps-poll",
3107                     "aid mismatch: sta aid 0x%x poll aid 0x%x",
3108                     ni->ni_associd, aid);
3109                 ic->ic_stats.is_ps_badaid++;
3110                 /*
3111                  * NB: We used to deauth the station but it turns out
3112                  * the Blackberry Curve 8230 (and perhaps other devices)
3113                  * sometimes send the wrong AID when WME is negotiated.
3114                  * Being more lenient here seems ok as we already check
3115                  * the station is associated and we only return frames
3116                  * queued for the station (i.e. we don't use the AID).
3117                  */
3118                 return;
3119         }
3120
3121         /* Okay, take the first queued packet and put it out... */
3122         IEEE80211_NODE_SAVEQ_DEQUEUE(ni, m, qlen);
3123         if (m == NULL) {
3124                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
3125                     "[%s] recv ps-poll, but queue empty\n",
3126                     ether_sprintf(wh->i_addr2));
3127                 ieee80211_send_nulldata(ieee80211_ref_node(ni));
3128                 ic->ic_stats.is_ps_qempty++;    /* XXX node stat */
3129                 if (ic->ic_set_tim != NULL)
3130                         ic->ic_set_tim(ni, 0);  /* just in case */
3131                 return;
3132         }
3133         /*
3134          * If there are more packets, set the more packets bit
3135          * in the packet dispatched to the station; otherwise
3136          * turn off the TIM bit.
3137          */
3138         if (qlen != 0) {
3139                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
3140                     "[%s] recv ps-poll, send packet, %u still queued\n",
3141                     ether_sprintf(ni->ni_macaddr), qlen);
3142                 m->m_flags |= M_MORE_DATA;
3143         } else {
3144                 IEEE80211_DPRINTF(ic, IEEE80211_MSG_POWER,
3145                     "[%s] recv ps-poll, send packet, queue empty\n",
3146                     ether_sprintf(ni->ni_macaddr));
3147                 if (ic->ic_set_tim != NULL)
3148                         ic->ic_set_tim(ni, 0);
3149         }
3150         m->m_flags |= M_PWR_SAV;                /* bypass PS handling */
3151         IF_ENQUEUE(&ic->ic_ifp->if_snd, m);
3152 }
3153
3154 #ifdef IEEE80211_DEBUG
3155 /*
3156  * Debugging support.
3157  */
3158 void
3159 ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag,
3160         uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
3161 {
3162         printf("[%s] discard %s frame, ssid mismatch: ",
3163                 ether_sprintf(mac), tag);
3164         ieee80211_print_essid(ssid + 2, ssid[1]);
3165         printf("\n");
3166 }
3167
3168 /*
3169  * Return the bssid of a frame.
3170  */
3171 static const uint8_t *
3172 ieee80211_getbssid(struct ieee80211com *ic, const struct ieee80211_frame *wh)
3173 {
3174         if (ic->ic_opmode == IEEE80211_M_STA)
3175                 return wh->i_addr2;
3176         if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
3177                 return wh->i_addr1;
3178         if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
3179                 return wh->i_addr1;
3180         return wh->i_addr3;
3181 }
3182
3183 void
3184 ieee80211_note(struct ieee80211com *ic, const char *fmt, ...)
3185 {
3186         char buf[128];          /* XXX */
3187         va_list ap;
3188
3189         va_start(ap, fmt);
3190         vsnprintf(buf, sizeof(buf), fmt, ap);
3191         va_end(ap);
3192
3193         if_printf(ic->ic_ifp, "%s", buf);       /* NB: no \n */
3194 }
3195
3196 void
3197 ieee80211_note_frame(struct ieee80211com *ic,
3198         const struct ieee80211_frame *wh,
3199         const char *fmt, ...)
3200 {
3201         char buf[128];          /* XXX */
3202         va_list ap;
3203
3204         va_start(ap, fmt);
3205         vsnprintf(buf, sizeof(buf), fmt, ap);
3206         va_end(ap);
3207         if_printf(ic->ic_ifp, "[%s] %s\n",
3208                 ether_sprintf(ieee80211_getbssid(ic, wh)), buf);
3209 }
3210
3211 void
3212 ieee80211_note_mac(struct ieee80211com *ic,
3213         const uint8_t mac[IEEE80211_ADDR_LEN],
3214         const char *fmt, ...)
3215 {
3216         char buf[128];          /* XXX */
3217         va_list ap;
3218
3219         va_start(ap, fmt);
3220         vsnprintf(buf, sizeof(buf), fmt, ap);
3221         va_end(ap);
3222         if_printf(ic->ic_ifp, "[%s] %s\n", ether_sprintf(mac), buf);
3223 }
3224
3225 void
3226 ieee80211_discard_frame(struct ieee80211com *ic,
3227         const struct ieee80211_frame *wh,
3228         const char *type, const char *fmt, ...)
3229 {
3230         va_list ap;
3231
3232         printf("[%s:%s] discard ", ic->ic_ifp->if_xname,
3233                 ether_sprintf(ieee80211_getbssid(ic, wh)));
3234         if (type != NULL)
3235                 printf("%s frame, ", type);
3236         else
3237                 printf("frame, ");
3238         va_start(ap, fmt);
3239         vprintf(fmt, ap);
3240         va_end(ap);
3241         printf("\n");
3242 }
3243
3244 void
3245 ieee80211_discard_ie(struct ieee80211com *ic,
3246         const struct ieee80211_frame *wh,
3247         const char *type, const char *fmt, ...)
3248 {
3249         va_list ap;
3250
3251         printf("[%s:%s] discard ", ic->ic_ifp->if_xname,
3252                 ether_sprintf(ieee80211_getbssid(ic, wh)));
3253         if (type != NULL)
3254                 printf("%s information element, ", type);
3255         else
3256                 printf("information element, ");
3257         va_start(ap, fmt);
3258         vprintf(fmt, ap);
3259         va_end(ap);
3260         printf("\n");
3261 }
3262
3263 void
3264 ieee80211_discard_mac(struct ieee80211com *ic,
3265         const uint8_t mac[IEEE80211_ADDR_LEN],
3266         const char *type, const char *fmt, ...)
3267 {
3268         va_list ap;
3269
3270         printf("[%s:%s] discard ", ic->ic_ifp->if_xname, ether_sprintf(mac));
3271         if (type != NULL)
3272                 printf("%s frame, ", type);
3273         else
3274                 printf("frame, ");
3275         va_start(ap, fmt);
3276         vprintf(fmt, ap);
3277         va_end(ap);
3278         printf("\n");
3279 }
3280 #endif /* IEEE80211_DEBUG */