2 * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 #include <sys/cdefs.h>
28 __FBSDID("$FreeBSD$");
32 * IEEE 802.11 Station mode support.
37 #include <sys/param.h>
38 #include <sys/systm.h>
40 #include <sys/malloc.h>
41 #include <sys/kernel.h>
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
48 #include <sys/sysctl.h>
51 #include <net/if_media.h>
52 #include <net/if_llc.h>
53 #include <net/ethernet.h>
57 #include <net80211/ieee80211_var.h>
58 #include <net80211/ieee80211_sta.h>
59 #include <net80211/ieee80211_input.h>
60 #ifdef IEEE80211_SUPPORT_SUPERG
61 #include <net80211/ieee80211_superg.h>
64 #define IEEE80211_RATE2MBS(r) (((r) & IEEE80211_RATE_VAL) / 2)
66 static void sta_vattach(struct ieee80211vap *);
67 static void sta_beacon_miss(struct ieee80211vap *);
68 static int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
69 static int sta_input(struct ieee80211_node *, struct mbuf *, int, int);
70 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
71 int subtype, int rssi, int nf);
72 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
75 ieee80211_sta_attach(struct ieee80211com *ic)
77 ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
81 ieee80211_sta_detach(struct ieee80211com *ic)
86 sta_vdetach(struct ieee80211vap *vap)
91 sta_vattach(struct ieee80211vap *vap)
93 vap->iv_newstate = sta_newstate;
94 vap->iv_input = sta_input;
95 vap->iv_recv_mgmt = sta_recv_mgmt;
96 vap->iv_recv_ctl = sta_recv_ctl;
97 vap->iv_opdetach = sta_vdetach;
98 vap->iv_bmiss = sta_beacon_miss;
102 * Handle a beacon miss event. The common code filters out
103 * spurious events that can happen when scanning and/or before
104 * reaching RUN state.
107 sta_beacon_miss(struct ieee80211vap *vap)
109 struct ieee80211com *ic = vap->iv_ic;
111 KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
112 KASSERT(vap->iv_state >= IEEE80211_S_RUN,
113 ("wrong state %s", ieee80211_state_name[vap->iv_state]));
115 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
116 "beacon miss, mode %s state %s\n",
117 ieee80211_opmode_name[vap->iv_opmode],
118 ieee80211_state_name[vap->iv_state]);
120 if (vap->iv_state == IEEE80211_S_CSA) {
122 * A Channel Switch is pending; assume we missed the
123 * beacon that would've completed the process and just
124 * force the switch. If we made a mistake we'll not
125 * find the AP on the new channel and fall back to a
128 ieee80211_csa_completeswitch(ic);
131 if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
133 * Send a directed probe req before falling back to a
134 * scan; if we receive a response ic_bmiss_count will
135 * be reset. Some cards mistakenly report beacon miss
136 * so this avoids the expensive scan if the ap is
139 ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
140 vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
141 vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
144 vap->iv_bmiss_count = 0;
145 vap->iv_stats.is_beacon_miss++;
146 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
147 #ifdef IEEE80211_SUPPORT_SUPERG
148 struct ieee80211com *ic = vap->iv_ic;
151 * If we receive a beacon miss interrupt when using
152 * dynamic turbo, attempt to switch modes before
155 if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
156 ieee80211_dturbo_switch(vap,
157 ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
160 * Try to reassociate before scanning for a new ap.
162 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
165 * Somebody else is controlling state changes (e.g.
166 * a user-mode app) don't do anything that would
167 * confuse them; just drop into scan mode so they'll
168 * notified of the state change and given control.
170 ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
175 * Handle deauth with reason. We retry only for
176 * the cases where we might succeed. Otherwise
177 * we downgrade the ap and scan.
180 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
183 case IEEE80211_STATUS_SUCCESS: /* NB: MLME assoc */
184 case IEEE80211_STATUS_TIMEOUT:
185 case IEEE80211_REASON_ASSOC_EXPIRE:
186 case IEEE80211_REASON_NOT_AUTHED:
187 case IEEE80211_REASON_NOT_ASSOCED:
188 case IEEE80211_REASON_ASSOC_LEAVE:
189 case IEEE80211_REASON_ASSOC_NOT_AUTHED:
190 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
193 ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
194 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
195 ieee80211_check_scan_current(vap);
201 * IEEE80211_M_STA vap state machine handler.
202 * This routine handles the main states in the 802.11 protocol.
205 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
207 struct ieee80211com *ic = vap->iv_ic;
208 struct ieee80211_node *ni;
209 enum ieee80211_state ostate;
211 IEEE80211_LOCK_ASSERT(ic);
213 ostate = vap->iv_state;
214 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
215 __func__, ieee80211_state_name[ostate],
216 ieee80211_state_name[nstate], arg);
217 vap->iv_state = nstate; /* state transition */
218 callout_stop(&vap->iv_mgtsend); /* XXX callout_drain */
219 if (ostate != IEEE80211_S_SCAN)
220 ieee80211_cancel_scan(vap); /* background scan */
221 ni = vap->iv_bss; /* NB: no reference held */
222 if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
223 callout_stop(&vap->iv_swbmiss);
225 case IEEE80211_S_INIT:
227 case IEEE80211_S_SLEEP:
229 case IEEE80211_S_RUN:
230 IEEE80211_SEND_MGMT(ni,
231 IEEE80211_FC0_SUBTYPE_DISASSOC,
232 IEEE80211_REASON_ASSOC_LEAVE);
233 ieee80211_sta_leave(ni);
235 case IEEE80211_S_ASSOC:
236 IEEE80211_SEND_MGMT(ni,
237 IEEE80211_FC0_SUBTYPE_DEAUTH,
238 IEEE80211_REASON_AUTH_LEAVE);
240 case IEEE80211_S_SCAN:
241 ieee80211_cancel_scan(vap);
246 if (ostate != IEEE80211_S_INIT) {
247 /* NB: optimize INIT -> INIT case */
248 ieee80211_reset_bss(vap);
250 if (vap->iv_auth->ia_detach != NULL)
251 vap->iv_auth->ia_detach(vap);
253 case IEEE80211_S_SCAN:
255 case IEEE80211_S_INIT:
257 * Initiate a scan. We can come here as a result
258 * of an IEEE80211_IOC_SCAN_REQ too in which case
259 * the vap will be marked with IEEE80211_FEXT_SCANREQ
260 * and the scan request parameters will be present
261 * in iv_scanreq. Otherwise we do the default.
263 if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
264 ieee80211_check_scan(vap,
265 vap->iv_scanreq_flags,
266 vap->iv_scanreq_duration,
267 vap->iv_scanreq_mindwell,
268 vap->iv_scanreq_maxdwell,
269 vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
270 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
272 ieee80211_check_scan_current(vap);
274 case IEEE80211_S_SCAN:
275 case IEEE80211_S_AUTH:
276 case IEEE80211_S_ASSOC:
278 * These can happen either because of a timeout
279 * on an assoc/auth response or because of a
280 * change in state that requires a reset. For
281 * the former we're called with a non-zero arg
282 * that is the cause for the failure; pass this
283 * to the scan code so it can update state.
284 * Otherwise trigger a new scan unless we're in
285 * manual roaming mode in which case an application
286 * must issue an explicit scan request.
289 ieee80211_scan_assoc_fail(vap,
290 vap->iv_bss->ni_macaddr, arg);
291 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
292 ieee80211_check_scan_current(vap);
294 case IEEE80211_S_RUN: /* beacon miss */
296 * Beacon miss. Notify user space and if not
297 * under control of a user application (roaming
298 * manual) kick off a scan to re-connect.
300 ieee80211_sta_leave(ni);
301 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
302 ieee80211_check_scan_current(vap);
308 case IEEE80211_S_AUTH:
310 case IEEE80211_S_INIT:
311 case IEEE80211_S_SCAN:
312 IEEE80211_SEND_MGMT(ni,
313 IEEE80211_FC0_SUBTYPE_AUTH, 1);
315 case IEEE80211_S_AUTH:
316 case IEEE80211_S_ASSOC:
317 switch (arg & 0xff) {
318 case IEEE80211_FC0_SUBTYPE_AUTH:
320 IEEE80211_SEND_MGMT(ni,
321 IEEE80211_FC0_SUBTYPE_AUTH, 2);
323 case IEEE80211_FC0_SUBTYPE_DEAUTH:
324 sta_authretry(vap, ni, arg>>8);
328 case IEEE80211_S_RUN:
329 switch (arg & 0xff) {
330 case IEEE80211_FC0_SUBTYPE_AUTH:
331 IEEE80211_SEND_MGMT(ni,
332 IEEE80211_FC0_SUBTYPE_AUTH, 2);
333 vap->iv_state = ostate; /* stay RUN */
335 case IEEE80211_FC0_SUBTYPE_DEAUTH:
336 ieee80211_sta_leave(ni);
337 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
339 IEEE80211_SEND_MGMT(ni,
340 IEEE80211_FC0_SUBTYPE_AUTH, 1);
349 case IEEE80211_S_ASSOC:
351 case IEEE80211_S_AUTH:
352 case IEEE80211_S_ASSOC:
353 IEEE80211_SEND_MGMT(ni,
354 IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
356 case IEEE80211_S_SLEEP: /* cannot happen */
357 case IEEE80211_S_RUN:
358 ieee80211_sta_leave(ni);
359 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
360 IEEE80211_SEND_MGMT(ni, arg ?
361 IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
362 IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
369 case IEEE80211_S_RUN:
370 if (vap->iv_flags & IEEE80211_F_WPA) {
371 /* XXX validate prerequisites */
374 case IEEE80211_S_RUN:
375 case IEEE80211_S_CSA:
377 case IEEE80211_S_AUTH: /* when join is done in fw */
378 case IEEE80211_S_ASSOC:
379 #ifdef IEEE80211_DEBUG
380 if (ieee80211_msg_debug(vap)) {
381 ieee80211_note(vap, "%s with %s ssid ",
382 (vap->iv_opmode == IEEE80211_M_STA ?
383 "associated" : "synchronized"),
384 ether_sprintf(ni->ni_bssid));
385 ieee80211_print_essid(vap->iv_bss->ni_essid,
388 printf(" channel %d start %uMb\n",
389 ieee80211_chan2ieee(ic, ic->ic_curchan),
390 IEEE80211_RATE2MBS(ni->ni_txrate));
393 ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
394 ieee80211_notify_node_join(ni,
395 arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
397 case IEEE80211_S_SLEEP:
398 ieee80211_sta_pwrsave(vap, 0);
403 ieee80211_sync_curchan(ic);
404 if (ostate != IEEE80211_S_RUN &&
405 (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)) {
407 * Start s/w beacon miss timer for devices w/o
408 * hardware support. We fudge a bit here since
409 * we're doing this in software.
411 vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
412 2 * vap->iv_bmissthreshold * ni->ni_intval);
413 vap->iv_swbmiss_count = 0;
414 callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
415 ieee80211_swbmiss, vap);
418 * When 802.1x is not in use mark the port authorized
419 * at this point so traffic can flow.
421 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
422 ieee80211_node_authorize(ni);
424 * Fake association when joining an existing bss.
426 if (ic->ic_newassoc != NULL)
427 ic->ic_newassoc(vap->iv_bss, ostate != IEEE80211_S_RUN);
429 case IEEE80211_S_CSA:
430 if (ostate != IEEE80211_S_RUN)
433 case IEEE80211_S_SLEEP:
434 ieee80211_sta_pwrsave(vap, 0);
438 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
439 "%s: unexpected state transition %s -> %s\n", __func__,
440 ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
447 * Return non-zero if the frame is an echo of a multicast
448 * frame sent by ourself. The dir is known to be DSTODS.
451 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
453 #define QWH4(wh) ((const struct ieee80211_qosframe_addr4 *)wh)
454 #define WH4(wh) ((const struct ieee80211_frame_addr4 *)wh)
457 KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
459 if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
461 sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
462 return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
468 * Return non-zero if the frame is an echo of a multicast
469 * frame sent by ourself. The dir is known to be FROMDS.
472 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
474 KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
476 if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
478 return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
482 * Decide if a received management frame should be
483 * printed when debugging is enabled. This filters some
484 * of the less interesting frames that come frequently
488 doprint(struct ieee80211vap *vap, int subtype)
491 case IEEE80211_FC0_SUBTYPE_BEACON:
492 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
493 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
500 * Process a received frame. The node associated with the sender
501 * should be supplied. If nothing was found in the node table then
502 * the caller is assumed to supply a reference to iv_bss instead.
503 * The RSSI and a timestamp are also supplied. The RSSI data is used
504 * during AP scanning to select a AP to associate with; it can have
505 * any units so long as values have consistent units and higher values
506 * mean ``better signal''. The receive timestamp is currently not used
507 * by the 802.11 layer.
510 sta_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
512 #define SEQ_LEQ(a,b) ((int)((a)-(b)) <= 0)
513 #define HAS_SEQ(type) ((type & 0x4) == 0)
514 struct ieee80211vap *vap = ni->ni_vap;
515 struct ieee80211com *ic = ni->ni_ic;
516 struct ifnet *ifp = vap->iv_ifp;
517 struct ieee80211_frame *wh;
518 struct ieee80211_key *key;
519 struct ether_header *eh;
520 int hdrspace, need_tap;
521 uint8_t dir, type, subtype, qos;
525 if (m->m_flags & M_AMPDU_MPDU) {
527 * Fastpath for A-MPDU reorder q resubmission. Frames
528 * w/ M_AMPDU_MPDU marked have already passed through
529 * here but were received out of order and been held on
530 * the reorder queue. When resubmitted they are marked
531 * with the M_AMPDU_MPDU flag and we can bypass most of
532 * the normal processing.
534 wh = mtod(m, struct ieee80211_frame *);
535 type = IEEE80211_FC0_TYPE_DATA;
536 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
537 subtype = IEEE80211_FC0_SUBTYPE_QOS;
538 hdrspace = ieee80211_hdrspace(ic, wh); /* XXX optimize? */
542 KASSERT(ni != NULL, ("null node"));
543 ni->ni_inact = ni->ni_inact_reload;
545 need_tap = 1; /* mbuf need to be tapped. */
546 type = -1; /* undefined */
548 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
549 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
550 ni->ni_macaddr, NULL,
551 "too short (1): len %u", m->m_pkthdr.len);
552 vap->iv_stats.is_rx_tooshort++;
556 * Bit of a cheat here, we use a pointer for a 3-address
557 * frame format but don't reference fields past outside
558 * ieee80211_frame_min w/o first validating the data is
561 wh = mtod(m, struct ieee80211_frame *);
563 if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
564 IEEE80211_FC0_VERSION_0) {
565 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
566 ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
567 wh->i_fc[0], wh->i_fc[1]);
568 vap->iv_stats.is_rx_badversion++;
572 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
573 type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
574 subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
575 if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
577 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
578 /* not interested in */
579 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
580 bssid, NULL, "%s", "not to bss");
581 vap->iv_stats.is_rx_wrongbss++;
584 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
587 uint8_t tid = ieee80211_gettid(wh);
588 if (IEEE80211_QOS_HAS_SEQ(wh) &&
589 TID_TO_WME_AC(tid) >= WME_AC_VI)
590 ic->ic_wme.wme_hipri_traffic++;
591 rxseq = le16toh(*(uint16_t *)wh->i_seq);
592 if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
593 (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
594 SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
595 /* duplicate, discard */
596 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
598 "seqno <%u,%u> fragno <%u,%u> tid %u",
599 rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
600 ni->ni_rxseqs[tid] >>
601 IEEE80211_SEQ_SEQ_SHIFT,
602 rxseq & IEEE80211_SEQ_FRAG_MASK,
604 IEEE80211_SEQ_FRAG_MASK,
606 vap->iv_stats.is_rx_dup++;
607 IEEE80211_NODE_STAT(ni, rx_dup);
610 ni->ni_rxseqs[tid] = rxseq;
615 case IEEE80211_FC0_TYPE_DATA:
616 hdrspace = ieee80211_hdrspace(ic, wh);
617 if (m->m_len < hdrspace &&
618 (m = m_pullup(m, hdrspace)) == NULL) {
619 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
620 ni->ni_macaddr, NULL,
621 "data too short: expecting %u", hdrspace);
622 vap->iv_stats.is_rx_tooshort++;
626 * Handle A-MPDU re-ordering. If the frame is to be
627 * processed directly then ieee80211_ampdu_reorder
628 * will return 0; otherwise it has consumed the mbuf
629 * and we should do nothing more with it.
631 if ((m->m_flags & M_AMPDU) &&
632 (dir == IEEE80211_FC1_DIR_FROMDS ||
633 dir == IEEE80211_FC1_DIR_DSTODS) &&
634 ieee80211_ampdu_reorder(ni, m) != 0) {
639 if (dir == IEEE80211_FC1_DIR_FROMDS) {
640 if ((ifp->if_flags & IFF_SIMPLEX) &&
641 isfromds_mcastecho(vap, wh)) {
643 * In IEEE802.11 network, multicast
644 * packets sent from "me" are broadcast
645 * from the AP; silently discard for
648 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
649 wh, "data", "%s", "multicast echo");
650 vap->iv_stats.is_rx_mcastecho++;
653 if ((vap->iv_flags & IEEE80211_F_DWDS) &&
654 IEEE80211_IS_MULTICAST(wh->i_addr1)) {
656 * DWDS sta's must drop 3-address mcast frames
657 * as they will be sent separately as a 4-addr
658 * frame. Accepting the 3-addr frame will
659 * confuse the bridge into thinking the sending
660 * sta is located at the end of WDS link.
662 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
663 "3-address data", "%s", "DWDS enabled");
664 vap->iv_stats.is_rx_mcastecho++;
667 } else if (dir == IEEE80211_FC1_DIR_DSTODS) {
668 if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
669 IEEE80211_DISCARD(vap,
670 IEEE80211_MSG_INPUT, wh, "4-address data",
671 "%s", "DWDS not enabled");
672 vap->iv_stats.is_rx_wrongdir++;
675 if ((ifp->if_flags & IFF_SIMPLEX) &&
676 isdstods_mcastecho(vap, wh)) {
678 * In IEEE802.11 network, multicast
679 * packets sent from "me" are broadcast
680 * from the AP; silently discard for
683 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
684 "4-address data", "%s", "multicast echo");
685 vap->iv_stats.is_rx_mcastecho++;
689 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
690 "data", "incorrect dir 0x%x", dir);
691 vap->iv_stats.is_rx_wrongdir++;
696 * Handle privacy requirements. Note that we
697 * must not be preempted from here until after
698 * we (potentially) call ieee80211_crypto_demic;
699 * otherwise we may violate assumptions in the
700 * crypto cipher modules used to do delayed update
701 * of replay sequence numbers.
703 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
704 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
706 * Discard encrypted frames when privacy is off.
708 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
709 wh, "WEP", "%s", "PRIVACY off");
710 vap->iv_stats.is_rx_noprivacy++;
711 IEEE80211_NODE_STAT(ni, rx_noprivacy);
714 key = ieee80211_crypto_decap(ni, m, hdrspace);
716 /* NB: stats+msgs handled in crypto_decap */
717 IEEE80211_NODE_STAT(ni, rx_wepfail);
720 wh = mtod(m, struct ieee80211_frame *);
721 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
723 /* XXX M_WEP and IEEE80211_F_PRIVACY */
728 * Save QoS bits for use below--before we strip the header.
730 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
731 qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
732 ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
733 ((struct ieee80211_qosframe *)wh)->i_qos[0];
738 * Next up, any fragmentation.
740 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
741 m = ieee80211_defrag(ni, m, hdrspace);
743 /* Fragment dropped or frame not complete yet */
747 wh = NULL; /* no longer valid, catch any uses */
750 * Next strip any MSDU crypto bits.
752 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
753 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
754 ni->ni_macaddr, "data", "%s", "demic error");
755 vap->iv_stats.is_rx_demicfail++;
756 IEEE80211_NODE_STAT(ni, rx_demicfail);
760 /* copy to listener after decrypt */
761 if (ieee80211_radiotap_active_vap(vap))
762 ieee80211_radiotap_tx(vap, m);
766 * Finally, strip the 802.11 header.
768 m = ieee80211_decap(vap, m, hdrspace);
770 /* XXX mask bit to check for both */
771 /* don't count Null data frames as errors */
772 if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
773 subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
775 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
776 ni->ni_macaddr, "data", "%s", "decap error");
777 vap->iv_stats.is_rx_decap++;
778 IEEE80211_NODE_STAT(ni, rx_decap);
781 eh = mtod(m, struct ether_header *);
782 if (!ieee80211_node_is_authorized(ni)) {
784 * Deny any non-PAE frames received prior to
785 * authorization. For open/shared-key
786 * authentication the port is mark authorized
787 * after authentication completes. For 802.1x
788 * the port is not marked authorized by the
789 * authenticator until the handshake has completed.
791 if (eh->ether_type != htons(ETHERTYPE_PAE)) {
792 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
793 eh->ether_shost, "data",
794 "unauthorized port: ether type 0x%x len %u",
795 eh->ether_type, m->m_pkthdr.len);
796 vap->iv_stats.is_rx_unauth++;
797 IEEE80211_NODE_STAT(ni, rx_unauth);
802 * When denying unencrypted frames, discard
803 * any non-PAE frames received without encryption.
805 if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
806 (key == NULL && (m->m_flags & M_WEP) == 0) &&
807 eh->ether_type != htons(ETHERTYPE_PAE)) {
809 * Drop unencrypted frames.
811 vap->iv_stats.is_rx_unencrypted++;
812 IEEE80211_NODE_STAT(ni, rx_unencrypted);
816 /* XXX require HT? */
817 if (qos & IEEE80211_QOS_AMSDU) {
818 m = ieee80211_decap_amsdu(ni, m);
820 return IEEE80211_FC0_TYPE_DATA;
822 #ifdef IEEE80211_SUPPORT_SUPERG
823 m = ieee80211_decap_fastframe(vap, ni, m);
825 return IEEE80211_FC0_TYPE_DATA;
828 ieee80211_deliver_data(vap, ni, m);
829 return IEEE80211_FC0_TYPE_DATA;
831 case IEEE80211_FC0_TYPE_MGT:
832 vap->iv_stats.is_rx_mgmt++;
833 IEEE80211_NODE_STAT(ni, rx_mgmt);
834 if (dir != IEEE80211_FC1_DIR_NODS) {
835 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
836 wh, "data", "incorrect dir 0x%x", dir);
837 vap->iv_stats.is_rx_wrongdir++;
840 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
841 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
842 ni->ni_macaddr, "mgt", "too short: len %u",
844 vap->iv_stats.is_rx_tooshort++;
847 #ifdef IEEE80211_DEBUG
848 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
849 ieee80211_msg_dumppkts(vap)) {
850 if_printf(ifp, "received %s from %s rssi %d\n",
851 ieee80211_mgt_subtype_name[subtype >>
852 IEEE80211_FC0_SUBTYPE_SHIFT],
853 ether_sprintf(wh->i_addr2), rssi);
856 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
857 if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
859 * Only shared key auth frames with a challenge
860 * should be encrypted, discard all others.
862 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
863 wh, ieee80211_mgt_subtype_name[subtype >>
864 IEEE80211_FC0_SUBTYPE_SHIFT],
865 "%s", "WEP set but not permitted");
866 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
869 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
871 * Discard encrypted frames when privacy is off.
873 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
874 wh, "mgt", "%s", "WEP set but PRIVACY off");
875 vap->iv_stats.is_rx_noprivacy++;
878 hdrspace = ieee80211_hdrspace(ic, wh);
879 key = ieee80211_crypto_decap(ni, m, hdrspace);
881 /* NB: stats+msgs handled in crypto_decap */
884 wh = mtod(m, struct ieee80211_frame *);
885 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
887 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
890 case IEEE80211_FC0_TYPE_CTL:
891 vap->iv_stats.is_rx_ctl++;
892 IEEE80211_NODE_STAT(ni, rx_ctrl);
893 vap->iv_recv_ctl(ni, m, subtype);
897 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
898 wh, NULL, "bad frame type 0x%x", type);
899 /* should not come here */
906 if (need_tap && ieee80211_radiotap_active_vap(vap))
907 ieee80211_radiotap_rx(vap, m);
915 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
916 int rssi, int nf, uint16_t seq, uint16_t status)
918 struct ieee80211vap *vap = ni->ni_vap;
920 if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
921 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
922 ni->ni_macaddr, "open auth",
923 "bad sta auth mode %u", ni->ni_authmode);
924 vap->iv_stats.is_rx_bad_auth++; /* XXX */
927 if (vap->iv_state != IEEE80211_S_AUTH ||
928 seq != IEEE80211_AUTH_OPEN_RESPONSE) {
929 vap->iv_stats.is_rx_bad_auth++;
933 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
934 ni, "open auth failed (reason %d)", status);
935 vap->iv_stats.is_rx_auth_fail++;
936 vap->iv_stats.is_rx_authfail_code = status;
937 ieee80211_new_state(vap, IEEE80211_S_SCAN,
938 IEEE80211_SCAN_FAIL_STATUS);
940 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
944 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
945 uint8_t *frm, uint8_t *efrm, int rssi, int nf,
946 uint16_t seq, uint16_t status)
948 struct ieee80211vap *vap = ni->ni_vap;
953 * NB: this can happen as we allow pre-shared key
954 * authentication to be enabled w/o wep being turned
955 * on so that configuration of these can be done
956 * in any order. It may be better to enforce the
957 * ordering in which case this check would just be
958 * for sanity/consistency.
960 if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
961 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
962 ni->ni_macaddr, "shared key auth",
963 "%s", " PRIVACY is disabled");
964 estatus = IEEE80211_STATUS_ALG;
968 * Pre-shared key authentication is evil; accept
969 * it only if explicitly configured (it is supported
970 * mainly for compatibility with clients like OS X).
972 if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
973 ni->ni_authmode != IEEE80211_AUTH_SHARED) {
974 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
975 ni->ni_macaddr, "shared key auth",
976 "bad sta auth mode %u", ni->ni_authmode);
977 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
978 estatus = IEEE80211_STATUS_ALG;
983 if (frm + 1 < efrm) {
984 if ((frm[1] + 2) > (efrm - frm)) {
985 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
986 ni->ni_macaddr, "shared key auth",
988 frm[0], (frm[1] + 2) - (efrm - frm));
989 vap->iv_stats.is_rx_bad_auth++;
990 estatus = IEEE80211_STATUS_CHALLENGE;
993 if (*frm == IEEE80211_ELEMID_CHALLENGE)
998 case IEEE80211_AUTH_SHARED_CHALLENGE:
999 case IEEE80211_AUTH_SHARED_RESPONSE:
1000 if (challenge == NULL) {
1001 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1002 ni->ni_macaddr, "shared key auth",
1003 "%s", "no challenge");
1004 vap->iv_stats.is_rx_bad_auth++;
1005 estatus = IEEE80211_STATUS_CHALLENGE;
1008 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1009 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1010 ni->ni_macaddr, "shared key auth",
1011 "bad challenge len %d", challenge[1]);
1012 vap->iv_stats.is_rx_bad_auth++;
1013 estatus = IEEE80211_STATUS_CHALLENGE;
1019 if (vap->iv_state != IEEE80211_S_AUTH)
1022 case IEEE80211_AUTH_SHARED_PASS:
1023 if (ni->ni_challenge != NULL) {
1024 free(ni->ni_challenge, M_80211_NODE);
1025 ni->ni_challenge = NULL;
1028 IEEE80211_NOTE_FRAME(vap,
1029 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
1030 "shared key auth failed (reason %d)", status);
1031 vap->iv_stats.is_rx_auth_fail++;
1032 vap->iv_stats.is_rx_authfail_code = status;
1035 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1037 case IEEE80211_AUTH_SHARED_CHALLENGE:
1038 if (!ieee80211_alloc_challenge(ni))
1040 /* XXX could optimize by passing recvd challenge */
1041 memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1042 IEEE80211_SEND_MGMT(ni,
1043 IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1046 IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1047 wh, "shared key auth", "bad seq %d", seq);
1048 vap->iv_stats.is_rx_bad_auth++;
1054 * Kick the state machine. This short-circuits
1055 * using the mgt frame timeout to trigger the
1058 if (vap->iv_state == IEEE80211_S_AUTH)
1059 ieee80211_new_state(vap, IEEE80211_S_SCAN,
1060 IEEE80211_SCAN_FAIL_STATUS);
1064 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
1065 const struct ieee80211_frame *wh)
1067 #define MS(_v, _f) (((_v) & _f) >> _f##_S)
1068 struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
1069 u_int len = frm[1], qosinfo;
1072 if (len < sizeof(struct ieee80211_wme_param)-2) {
1073 IEEE80211_DISCARD_IE(vap,
1074 IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1075 wh, "WME", "too short, len %u", len);
1078 qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1079 qosinfo &= WME_QOSINFO_COUNT;
1080 /* XXX do proper check for wraparound */
1081 if (qosinfo == wme->wme_wmeChanParams.cap_info)
1083 frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1084 for (i = 0; i < WME_NUM_AC; i++) {
1085 struct wmeParams *wmep =
1086 &wme->wme_wmeChanParams.cap_wmeParams[i];
1087 /* NB: ACI not used */
1088 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1089 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1090 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1091 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1092 wmep->wmep_txopLimit = LE_READ_2(frm+2);
1095 wme->wme_wmeChanParams.cap_info = qosinfo;
1101 * Process 11h Channel Switch Announcement (CSA) ie. If this
1102 * is the first CSA then initiate the switch. Otherwise we
1103 * track state and trigger completion and/or cancel of the switch.
1104 * XXX should be public for IBSS use
1107 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
1108 const struct ieee80211_frame *wh)
1110 struct ieee80211com *ic = vap->iv_ic;
1111 const struct ieee80211_csa_ie *csa =
1112 (const struct ieee80211_csa_ie *) frm;
1114 KASSERT(vap->iv_state >= IEEE80211_S_RUN,
1115 ("state %s", ieee80211_state_name[vap->iv_state]));
1117 if (csa->csa_mode > 1) {
1118 IEEE80211_DISCARD_IE(vap,
1119 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1120 wh, "CSA", "invalid mode %u", csa->csa_mode);
1124 if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
1126 * Convert the channel number to a channel reference. We
1127 * try first to preserve turbo attribute of the current
1128 * channel then fallback. Note this will not work if the
1129 * CSA specifies a channel that requires a band switch (e.g.
1130 * 11a => 11g). This is intentional as 11h is defined only
1131 * for 5GHz/11a and because the switch does not involve a
1132 * reassociation, protocol state (capabilities, negotated
1133 * rates, etc) may/will be wrong.
1135 struct ieee80211_channel *c =
1136 ieee80211_find_channel_byieee(ic, csa->csa_newchan,
1137 (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
1139 c = ieee80211_find_channel_byieee(ic,
1141 (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
1143 IEEE80211_DISCARD_IE(vap,
1144 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1145 wh, "CSA", "invalid channel %u",
1150 #if IEEE80211_CSA_COUNT_MIN > 0
1151 if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
1153 * Require at least IEEE80211_CSA_COUNT_MIN count to
1154 * reduce the risk of being redirected by a fabricated
1155 * CSA. If a valid CSA is dropped we'll still get a
1156 * beacon miss when the AP leaves the channel so we'll
1157 * eventually follow to the new channel.
1159 * NOTE: this violates the 11h spec that states that
1160 * count may be any value and if 0 then a switch
1161 * should happen asap.
1163 IEEE80211_DISCARD_IE(vap,
1164 IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1165 wh, "CSA", "count %u too small, must be >= %u",
1166 csa->csa_count, IEEE80211_CSA_COUNT_MIN);
1170 ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
1173 * Validate this ie against the initial CSA. We require
1174 * mode and channel not change and the count must be
1175 * monotonically decreasing. This may be pointless and
1176 * canceling the switch as a result may be too paranoid but
1177 * in the worst case if we drop out of CSA because of this
1178 * and the AP does move then we'll just end up taking a
1179 * beacon miss and scan to find the AP.
1181 * XXX may want <= on count as we also process ProbeResp
1182 * frames and those may come in w/ the same count as the
1183 * previous beacon; but doing so leaves us open to a stuck
1184 * count until we add a dead-man timer
1186 if (!(csa->csa_count < ic->ic_csa_count &&
1187 csa->csa_mode == ic->ic_csa_mode &&
1188 csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
1189 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
1190 "CSA ie mismatch, initial ie <%d,%d,%d>, "
1191 "this ie <%d,%d,%d>", ic->ic_csa_mode,
1192 ic->ic_csa_newchan, ic->ic_csa_count,
1193 csa->csa_mode, csa->csa_newchan, csa->csa_count);
1194 ieee80211_csa_cancelswitch(ic);
1196 if (csa->csa_count <= 1)
1197 ieee80211_csa_completeswitch(ic);
1199 ic->ic_csa_count = csa->csa_count;
1203 IEEE80211_UNLOCK(ic);
1207 * Return non-zero if a background scan may be continued:
1208 * o bg scan is active
1209 * o no channel switch is pending
1210 * o there has not been any traffic recently
1212 * Note we do not check if there is an administrative enable;
1213 * this is only done to start the scan. We assume that any
1214 * change in state will be accompanied by a request to cancel
1215 * active scans which will otherwise cause this test to fail.
1218 contbgscan(struct ieee80211vap *vap)
1220 struct ieee80211com *ic = vap->iv_ic;
1222 return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1223 (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1224 vap->iv_state == IEEE80211_S_RUN && /* XXX? */
1225 time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1229 * Return non-zero if a backgrond scan may be started:
1230 * o bg scanning is administratively enabled
1231 * o no channel switch is pending
1232 * o we are not boosted on a dynamic turbo channel
1233 * o there has not been a scan recently
1234 * o there has not been any traffic recently
1237 startbgscan(struct ieee80211vap *vap)
1239 struct ieee80211com *ic = vap->iv_ic;
1241 return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
1242 (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1243 #ifdef IEEE80211_SUPPORT_SUPERG
1244 !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1246 time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
1247 time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1251 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1252 int subtype, int rssi, int nf)
1254 #define ISPROBE(_st) ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1255 #define ISREASSOC(_st) ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1256 struct ieee80211vap *vap = ni->ni_vap;
1257 struct ieee80211com *ic = ni->ni_ic;
1258 struct ieee80211_frame *wh;
1259 uint8_t *frm, *efrm;
1260 uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
1263 wh = mtod(m0, struct ieee80211_frame *);
1264 frm = (uint8_t *)&wh[1];
1265 efrm = mtod(m0, uint8_t *) + m0->m_len;
1267 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1268 case IEEE80211_FC0_SUBTYPE_BEACON: {
1269 struct ieee80211_scanparams scan;
1271 * We process beacon/probe response frames:
1272 * o when scanning, or
1273 * o station mode when associated (to collect state
1274 * updates such as 802.11g slot time)
1275 * Frames otherwise received are discarded.
1277 if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
1278 vap->iv_stats.is_rx_mgtdiscard++;
1281 /* XXX probe response in sta mode when !scanning? */
1282 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
1285 * Count frame now that we know it's to be processed.
1287 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1288 vap->iv_stats.is_rx_beacon++; /* XXX remove */
1289 IEEE80211_NODE_STAT(ni, rx_beacons);
1291 IEEE80211_NODE_STAT(ni, rx_proberesp);
1293 * When operating in station mode, check for state updates.
1294 * Be careful to ignore beacons received while doing a
1295 * background scan. We consider only 11g/WMM stuff right now.
1297 if (ni->ni_associd != 0 &&
1298 ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1299 IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1300 /* record tsf of last beacon */
1301 memcpy(ni->ni_tstamp.data, scan.tstamp,
1302 sizeof(ni->ni_tstamp));
1303 /* count beacon frame for s/w bmiss handling */
1304 vap->iv_swbmiss_count++;
1305 vap->iv_bmiss_count = 0;
1306 if (ni->ni_erp != scan.erp) {
1307 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1309 "erp change: was 0x%x, now 0x%x",
1310 ni->ni_erp, scan.erp);
1311 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1312 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1313 ic->ic_flags |= IEEE80211_F_USEPROT;
1315 ic->ic_flags &= ~IEEE80211_F_USEPROT;
1316 ni->ni_erp = scan.erp;
1318 /* XXX driver notification */
1320 if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1321 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1323 "capabilities change: was 0x%x, now 0x%x",
1324 ni->ni_capinfo, scan.capinfo);
1326 * NB: we assume short preamble doesn't
1327 * change dynamically
1329 ieee80211_set_shortslottime(ic,
1330 IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
1331 (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1332 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
1333 | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
1336 if (scan.wme != NULL &&
1337 (ni->ni_flags & IEEE80211_NODE_QOS) &&
1338 ieee80211_parse_wmeparams(vap, scan.wme, wh) > 0)
1339 ieee80211_wme_updateparams(vap);
1340 #ifdef IEEE80211_SUPPORT_SUPERG
1341 if (scan.ath != NULL)
1342 ieee80211_parse_athparams(ni, scan.ath, wh);
1344 if (scan.htcap != NULL && scan.htinfo != NULL &&
1345 (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1346 ieee80211_ht_updateparams(ni,
1347 scan.htcap, scan.htinfo);
1348 /* XXX state changes? */
1350 if (scan.tim != NULL) {
1351 struct ieee80211_tim_ie *tim =
1352 (struct ieee80211_tim_ie *) scan.tim;
1354 int aid = IEEE80211_AID(ni->ni_associd);
1355 int ix = aid / NBBY;
1356 int min = tim->tim_bitctl &~ 1;
1357 int max = tim->tim_len + min - 4;
1358 if ((tim->tim_bitctl&1) ||
1359 (min <= ix && ix <= max &&
1360 isset(tim->tim_bitmap - min, aid))) {
1362 * XXX Do not let bg scan kick off
1363 * we are expecting data.
1365 ic->ic_lastdata = ticks;
1366 ieee80211_sta_pwrsave(vap, 0);
1369 ni->ni_dtim_count = tim->tim_count;
1370 ni->ni_dtim_period = tim->tim_period;
1372 if (scan.csa != NULL &&
1373 (vap->iv_flags & IEEE80211_F_DOTH))
1374 ieee80211_parse_csaparams(vap, scan.csa, wh);
1375 else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
1377 * No CSA ie or 11h disabled, but a channel
1378 * switch is pending; drop out so we aren't
1379 * stuck in CSA state. If the AP really is
1380 * moving we'll get a beacon miss and scan.
1383 ieee80211_csa_cancelswitch(ic);
1384 IEEE80211_UNLOCK(ic);
1387 * If scanning, pass the info to the scan module.
1388 * Otherwise, check if it's the right time to do
1389 * a background scan. Background scanning must
1390 * be enabled and we must not be operating in the
1391 * turbo phase of dynamic turbo mode. Then,
1392 * it's been a while since the last background
1393 * scan and if no data frames have come through
1394 * recently, kick off a scan. Note that this
1395 * is the mechanism by which a background scan
1396 * is started _and_ continued each time we
1397 * return on-channel to receive a beacon from
1400 if (ic->ic_flags & IEEE80211_F_SCAN) {
1401 ieee80211_add_scan(vap, &scan, wh,
1403 } else if (contbgscan(vap)) {
1404 ieee80211_bg_scan(vap, 0);
1405 } else if (startbgscan(vap)) {
1406 vap->iv_stats.is_scan_bg++;
1408 /* wakeup if we are sleeing */
1409 ieee80211_set_pwrsave(vap, 0);
1411 ieee80211_bg_scan(vap, 0);
1416 * If scanning, just pass information to the scan module.
1418 if (ic->ic_flags & IEEE80211_F_SCAN) {
1419 if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1421 * Actively scanning a channel marked passive;
1422 * send a probe request now that we know there
1423 * is 802.11 traffic present.
1425 * XXX check if the beacon we recv'd gives
1426 * us what we need and suppress the probe req
1428 ieee80211_probe_curchan(vap, 1);
1429 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1431 ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1437 case IEEE80211_FC0_SUBTYPE_AUTH: {
1438 uint16_t algo, seq, status;
1446 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1447 algo = le16toh(*(uint16_t *)frm);
1448 seq = le16toh(*(uint16_t *)(frm + 2));
1449 status = le16toh(*(uint16_t *)(frm + 4));
1450 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1451 "recv auth frame with algorithm %d seq %d", algo, seq);
1453 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1454 IEEE80211_DISCARD(vap,
1455 IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1456 wh, "auth", "%s", "TKIP countermeasures enabled");
1457 vap->iv_stats.is_rx_auth_countermeasures++;
1458 if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1459 ieee80211_send_error(ni, wh->i_addr2,
1460 IEEE80211_FC0_SUBTYPE_AUTH,
1461 IEEE80211_REASON_MIC_FAILURE);
1465 if (algo == IEEE80211_AUTH_ALG_SHARED)
1466 sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1468 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1469 sta_auth_open(ni, wh, rssi, nf, seq, status);
1471 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1472 wh, "auth", "unsupported alg %d", algo);
1473 vap->iv_stats.is_rx_auth_unsupported++;
1479 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1480 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
1481 uint16_t capinfo, associd;
1484 if (vap->iv_state != IEEE80211_S_ASSOC) {
1485 vap->iv_stats.is_rx_mgtdiscard++;
1490 * asresp frame format
1491 * [2] capability information
1493 * [2] association ID
1494 * [tlv] supported rates
1495 * [tlv] extended supported rates
1497 * [tlv] HT capabilities
1500 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1502 capinfo = le16toh(*(uint16_t *)frm);
1504 status = le16toh(*(uint16_t *)frm);
1507 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1508 wh->i_addr2, "%sassoc failed (reason %d)",
1509 ISREASSOC(subtype) ? "re" : "", status);
1510 vap->iv_stats.is_rx_auth_fail++; /* XXX */
1513 associd = le16toh(*(uint16_t *)frm);
1516 rates = xrates = wme = htcap = htinfo = NULL;
1517 while (efrm - frm > 1) {
1518 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1520 case IEEE80211_ELEMID_RATES:
1523 case IEEE80211_ELEMID_XRATES:
1526 case IEEE80211_ELEMID_HTCAP:
1529 case IEEE80211_ELEMID_HTINFO:
1532 case IEEE80211_ELEMID_VENDOR:
1535 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
1537 * Accept pre-draft HT ie's if the
1538 * standard ones have not been seen.
1540 if (ishtcapoui(frm)) {
1543 } else if (ishtinfooui(frm)) {
1548 /* XXX Atheros OUI support */
1554 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1556 IEEE80211_VERIFY_ELEMENT(xrates,
1557 IEEE80211_RATE_MAXSIZE - rates[1], return);
1558 rate = ieee80211_setup_rates(ni, rates, xrates,
1560 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1561 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1562 if (rate & IEEE80211_RATE_BASIC) {
1563 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1565 "%sassoc failed (rate set mismatch)",
1566 ISREASSOC(subtype) ? "re" : "");
1567 vap->iv_stats.is_rx_assoc_norate++;
1568 ieee80211_new_state(vap, IEEE80211_S_SCAN,
1569 IEEE80211_SCAN_FAIL_STATUS);
1573 ni->ni_capinfo = capinfo;
1574 ni->ni_associd = associd;
1575 if (ni->ni_jointime == 0)
1576 ni->ni_jointime = time_uptime;
1578 ieee80211_parse_wmeparams(vap, wme, wh) >= 0) {
1579 ni->ni_flags |= IEEE80211_NODE_QOS;
1580 ieee80211_wme_updateparams(vap);
1582 ni->ni_flags &= ~IEEE80211_NODE_QOS;
1584 * Setup HT state according to the negotiation.
1586 * NB: shouldn't need to check if HT use is enabled but some
1587 * ap's send back HT ie's even when we don't indicate we
1588 * are HT capable in our AssocReq.
1590 if (htcap != NULL && htinfo != NULL &&
1591 (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1592 ieee80211_ht_node_init(ni);
1593 ieee80211_ht_updateparams(ni, htcap, htinfo);
1594 ieee80211_setup_htrates(ni, htcap,
1595 IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
1596 ieee80211_setup_basic_htrates(ni, htinfo);
1597 ieee80211_node_setuptxparms(ni);
1599 #ifdef IEEE80211_SUPPORT_SUPERG
1600 if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_ATH))
1601 ieee80211_ff_node_init(ni);
1605 * Configure state now that we are associated.
1607 * XXX may need different/additional driver callbacks?
1609 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1610 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1611 ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1612 ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1614 ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1615 ic->ic_flags |= IEEE80211_F_USEBARKER;
1617 ieee80211_set_shortslottime(ic,
1618 IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1619 (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1621 * Honor ERP protection.
1623 * NB: ni_erp should zero for non-11g operation.
1625 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1626 (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1627 ic->ic_flags |= IEEE80211_F_USEPROT;
1629 ic->ic_flags &= ~IEEE80211_F_USEPROT;
1630 IEEE80211_NOTE_MAC(vap,
1631 IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
1632 "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s",
1633 ISREASSOC(subtype) ? "re" : "",
1634 IEEE80211_NODE_AID(ni),
1635 ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1636 ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1637 ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1638 ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
1639 ni->ni_flags & IEEE80211_NODE_HT ?
1640 (ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
1641 ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
1642 ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
1643 ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
1644 ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
1645 IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
1646 ", fast-frames" : "",
1647 IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
1650 ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
1654 case IEEE80211_FC0_SUBTYPE_DEAUTH: {
1657 if (vap->iv_state == IEEE80211_S_SCAN) {
1658 vap->iv_stats.is_rx_mgtdiscard++;
1661 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1662 /* NB: can happen when in promiscuous mode */
1663 vap->iv_stats.is_rx_mgtdiscard++;
1668 * deauth frame format
1671 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1672 reason = le16toh(*(uint16_t *)frm);
1674 vap->iv_stats.is_rx_deauth++;
1675 vap->iv_stats.is_rx_deauth_code = reason;
1676 IEEE80211_NODE_STAT(ni, rx_deauth);
1678 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1679 "recv deauthenticate (reason %d)", reason);
1680 ieee80211_new_state(vap, IEEE80211_S_AUTH,
1681 (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
1685 case IEEE80211_FC0_SUBTYPE_DISASSOC: {
1688 if (vap->iv_state != IEEE80211_S_RUN &&
1689 vap->iv_state != IEEE80211_S_ASSOC &&
1690 vap->iv_state != IEEE80211_S_AUTH) {
1691 vap->iv_stats.is_rx_mgtdiscard++;
1694 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1695 /* NB: can happen when in promiscuous mode */
1696 vap->iv_stats.is_rx_mgtdiscard++;
1701 * disassoc frame format
1704 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1705 reason = le16toh(*(uint16_t *)frm);
1707 vap->iv_stats.is_rx_disassoc++;
1708 vap->iv_stats.is_rx_disassoc_code = reason;
1709 IEEE80211_NODE_STAT(ni, rx_disassoc);
1711 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1712 "recv disassociate (reason %d)", reason);
1713 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1717 case IEEE80211_FC0_SUBTYPE_ACTION:
1718 if (vap->iv_state == IEEE80211_S_RUN) {
1719 if (ieee80211_parse_action(ni, m0) == 0)
1720 ic->ic_recv_action(ni, wh, frm, efrm);
1722 vap->iv_stats.is_rx_mgtdiscard++;
1725 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1726 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1727 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1728 vap->iv_stats.is_rx_mgtdiscard++;
1731 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1732 wh, "mgt", "subtype 0x%x not handled", subtype);
1733 vap->iv_stats.is_rx_badsubtype++;
1741 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m0, int subtype)