First pass at converting the net80211 infrastrcture from FreeBSD.
[dragonfly.git] / sys / netproto / 802_11 / wlan / ieee80211_input.c
CommitLineData
32176cfd 1/*-
f186073c 2 * Copyright (c) 2001 Atsushi Onoe
32176cfd 3 * Copyright (c) 2002-2009 Sam Leffler, Errno Consulting
f186073c
JS
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
f186073c
JS
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 *
32176cfd
RP
26 * $FreeBSD: head/sys/net80211/ieee80211_input.c 196316 2009-08-17 12:57:57Z rpaulo $
27 * $DragonFly$
f186073c
JS
28 */
29
32176cfd
RP
30#include "opt_wlan.h"
31
f186073c 32#include <sys/param.h>
841ab66c 33#include <sys/systm.h>
f186073c
JS
34#include <sys/mbuf.h>
35#include <sys/malloc.h>
841ab66c 36#include <sys/endian.h>
f186073c 37#include <sys/kernel.h>
841ab66c 38
f186073c 39#include <sys/socket.h>
32176cfd 40
f186073c 41#include <net/ethernet.h>
32176cfd 42#include <net/if.h>
f186073c 43#include <net/if_llc.h>
32176cfd
RP
44#include <net/if_media.h>
45#include <net/route.h>
f186073c
JS
46
47#include <netproto/802_11/ieee80211_var.h>
32176cfd
RP
48#include <netproto/802_11/ieee80211_input.h>
49#ifdef IEEE80211_SUPPORT_MESH
50#include <netproto/802_11/ieee80211_mesh.h>
51#endif
f186073c
JS
52
53#include <net/bpf.h>
54
32176cfd
RP
55#ifdef INET
56#include <netinet/in.h>
57#include <net/ethernet.h>
58#endif
6bd66811
SZ
59
60int
32176cfd 61ieee80211_input_all(struct ieee80211com *ic, struct mbuf *m, int rssi, int nf)
f186073c 62{
32176cfd
RP
63 struct ieee80211vap *vap;
64 int type = -1;
841ab66c 65
32176cfd 66 m->m_flags |= M_BCAST; /* NB: mark for bpf tap'ing */
841ab66c 67
32176cfd
RP
68 /* XXX locking */
69 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
70 struct ieee80211_node *ni;
71 struct mbuf *mcopy;
1f8e62c9 72
32176cfd
RP
73 /* NB: could check for IFF_UP but this is cheaper */
74 if (vap->iv_state == IEEE80211_S_INIT)
75 continue;
841ab66c 76 /*
32176cfd
RP
77 * WDS vap's only receive directed traffic from the
78 * station at the ``far end''. That traffic should
79 * be passed through the AP vap the station is associated
80 * to--so don't spam them with mcast frames.
841ab66c 81 */
32176cfd
RP
82 if (vap->iv_opmode == IEEE80211_M_WDS)
83 continue;
84 if (TAILQ_NEXT(vap, iv_next) != NULL) {
841ab66c 85 /*
32176cfd
RP
86 * Packet contents are changed by ieee80211_decap
87 * so do a deep copy of the packet.
841ab66c 88 */
32176cfd
RP
89 mcopy = m_dup(m, MB_DONTWAIT);
90 if (mcopy == NULL) {
91 /* XXX stat+msg */
92 continue;
f186073c 93 }
841ab66c 94 } else {
32176cfd
RP
95 mcopy = m;
96 m = NULL;
841ab66c 97 }
32176cfd
RP
98 ni = ieee80211_ref_node(vap->iv_bss);
99 type = ieee80211_input(ni, mcopy, rssi, nf);
100 ieee80211_free_node(ni);
f186073c 101 }
32176cfd 102 if (m != NULL) /* no vaps, reclaim mbuf */
841ab66c 103 m_freem(m);
841ab66c 104 return type;
841ab66c
SZ
105}
106
107/*
32176cfd
RP
108 * This function reassembles fragments.
109 *
110 * XXX should handle 3 concurrent reassemblies per-spec.
841ab66c 111 */
32176cfd
RP
112struct mbuf *
113ieee80211_defrag(struct ieee80211_node *ni, struct mbuf *m, int hdrspace)
841ab66c 114{
32176cfd 115 struct ieee80211vap *vap = ni->ni_vap;
841ab66c
SZ
116 struct ieee80211_frame *wh = mtod(m, struct ieee80211_frame *);
117 struct ieee80211_frame *lwh;
118 uint16_t rxseq;
119 uint8_t fragno;
120 uint8_t more_frag = wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG;
121 struct mbuf *mfrag;
122
123 KASSERT(!IEEE80211_IS_MULTICAST(wh->i_addr1), ("multicast fragm?"));
124
125 rxseq = le16toh(*(uint16_t *)wh->i_seq);
126 fragno = rxseq & IEEE80211_SEQ_FRAG_MASK;
127
128 /* Quick way out, if there's nothing to defragment */
129 if (!more_frag && fragno == 0 && ni->ni_rxfrag[0] == NULL)
130 return m;
131
132 /*
133 * Remove frag to insure it doesn't get reaped by timer.
134 */
135 if (ni->ni_table == NULL) {
136 /*
137 * Should never happen. If the node is orphaned (not in
138 * the table) then input packets should not reach here.
139 * Otherwise, a concurrent request that yanks the table
140 * should be blocked by other interlocking and/or by first
141 * shutting the driver down. Regardless, be defensive
142 * here and just bail
143 */
144 /* XXX need msg+stat */
145 m_freem(m);
146 return NULL;
147 }
32176cfd 148 IEEE80211_NODE_LOCK(ni->ni_table);
841ab66c
SZ
149 mfrag = ni->ni_rxfrag[0];
150 ni->ni_rxfrag[0] = NULL;
32176cfd 151 IEEE80211_NODE_UNLOCK(ni->ni_table);
841ab66c
SZ
152
153 /*
154 * Validate new fragment is in order and
155 * related to the previous ones.
156 */
157 if (mfrag != NULL) {
158 uint16_t last_rxseq;
159
160 lwh = mtod(mfrag, struct ieee80211_frame *);
161 last_rxseq = le16toh(*(uint16_t *)lwh->i_seq);
162 /* NB: check seq # and frag together */
163 if (rxseq != last_rxseq+1 ||
164 !IEEE80211_ADDR_EQ(wh->i_addr1, lwh->i_addr1) ||
165 !IEEE80211_ADDR_EQ(wh->i_addr2, lwh->i_addr2)) {
166 /*
167 * Unrelated fragment or no space for it,
168 * clear current fragments.
169 */
170 m_freem(mfrag);
171 mfrag = NULL;
172 }
173 }
174
175 if (mfrag == NULL) {
176 if (fragno != 0) { /* !first fragment, discard */
32176cfd 177 vap->iv_stats.is_rx_defrag++;
841ab66c
SZ
178 IEEE80211_NODE_STAT(ni, rx_defrag);
179 m_freem(m);
180 return NULL;
181 }
182 mfrag = m;
183 } else { /* concatenate */
184 m_adj(m, hdrspace); /* strip header */
185 m_cat(mfrag, m);
186 /* NB: m_cat doesn't update the packet header */
187 mfrag->m_pkthdr.len += m->m_pkthdr.len;
188 /* track last seqnum and fragno */
189 lwh = mtod(mfrag, struct ieee80211_frame *);
190 *(uint16_t *) lwh->i_seq = *(uint16_t *) wh->i_seq;
191 }
192 if (more_frag) { /* more to come, save */
193 ni->ni_rxfragstamp = ticks;
194 ni->ni_rxfrag[0] = mfrag;
195 mfrag = NULL;
196 }
197 return mfrag;
198}
199
32176cfd
RP
200void
201ieee80211_deliver_data(struct ieee80211vap *vap,
841ab66c
SZ
202 struct ieee80211_node *ni, struct mbuf *m)
203{
204 struct ether_header *eh = mtod(m, struct ether_header *);
32176cfd 205 struct ifnet *ifp = vap->iv_ifp;
841ab66c 206
32176cfd
RP
207 /* clear driver/net80211 flags before passing up */
208 m->m_flags &= ~(M_80211_RX | M_MCAST | M_BCAST);
209
210 /* NB: see hostap_deliver_data, this path doesn't handle hostap */
211 KASSERT(vap->iv_opmode != IEEE80211_M_HOSTAP, ("gack, hostap"));
ffd45d58
SZ
212 /*
213 * Do accounting.
214 */
215 ifp->if_ipackets++;
216 IEEE80211_NODE_STAT(ni, rx_data);
217 IEEE80211_NODE_STAT_ADD(ni, rx_bytes, m->m_pkthdr.len);
218 if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
32176cfd 219 m->m_flags |= M_MCAST; /* XXX M_BCAST? */
ffd45d58 220 IEEE80211_NODE_STAT(ni, rx_mcast);
32176cfd 221 } else
ffd45d58 222 IEEE80211_NODE_STAT(ni, rx_ucast);
32176cfd 223 m->m_pkthdr.rcvif = ifp;
841ab66c 224
32176cfd
RP
225 if (ni->ni_vlan != 0) {
226 /* attach vlan tag */
227 m->m_pkthdr.ether_vlantag = ni->ni_vlan;
228 m->m_flags |= M_VLANTAG;
f186073c 229 }
32176cfd 230 ifp->if_input(ifp, m);
f186073c
JS
231}
232
32176cfd
RP
233struct mbuf *
234ieee80211_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen)
f186073c 235{
32176cfd 236 struct ieee80211_qosframe_addr4 wh;
f186073c 237 struct ether_header *eh;
f186073c
JS
238 struct llc *llc;
239
32176cfd
RP
240 KASSERT(hdrlen <= sizeof(wh),
241 ("hdrlen %d > max %zd", hdrlen, sizeof(wh)));
242
841ab66c
SZ
243 if (m->m_len < hdrlen + sizeof(*llc) &&
244 (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
32176cfd
RP
245 vap->iv_stats.is_rx_tooshort++;
246 /* XXX msg */
841ab66c 247 return NULL;
f186073c 248 }
841ab66c
SZ
249 memcpy(&wh, mtod(m, caddr_t), hdrlen);
250 llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
f186073c
JS
251 if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
252 llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
32176cfd
RP
253 llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
254 /* NB: preserve AppleTalk frames that have a native SNAP hdr */
255 !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
256 llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
841ab66c 257 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
f186073c
JS
258 llc = NULL;
259 } else {
841ab66c 260 m_adj(m, hdrlen - sizeof(*eh));
f186073c
JS
261 }
262 eh = mtod(m, struct ether_header *);
263 switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
264 case IEEE80211_FC1_DIR_NODS:
265 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
266 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
267 break;
268 case IEEE80211_FC1_DIR_TODS:
269 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
270 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
271 break;
272 case IEEE80211_FC1_DIR_FROMDS:
273 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
274 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
275 break;
276 case IEEE80211_FC1_DIR_DSTODS:
841ab66c
SZ
277 IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
278 IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr4);
279 break;
f186073c
JS
280 }
281#ifdef ALIGNED_POINTER
282 if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
32176cfd
RP
283 m = ieee80211_realign(vap, m, sizeof(*eh));
284 if (m == NULL)
285 return NULL;
f186073c
JS
286 }
287#endif /* ALIGNED_POINTER */
288 if (llc != NULL) {
289 eh = mtod(m, struct ether_header *);
290 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
291 }
292 return m;
293}
294
32176cfd
RP
295/*
296 * Decap a frame encapsulated in a fast-frame/A-MSDU.
297 */
298struct mbuf *
299ieee80211_decap1(struct mbuf *m, int *framelen)
300{
301#define FF_LLC_SIZE (sizeof(struct ether_header) + sizeof(struct llc))
302 struct ether_header *eh;
303 struct llc *llc;
304
305 /*
306 * The frame has an 802.3 header followed by an 802.2
307 * LLC header. The encapsulated frame length is in the
308 * first header type field; save that and overwrite it
309 * with the true type field found in the second. Then
310 * copy the 802.3 header up to where it belongs and
311 * adjust the mbuf contents to remove the void.
312 */
313 if (m->m_len < FF_LLC_SIZE && (m = m_pullup(m, FF_LLC_SIZE)) == NULL)
314 return NULL;
315 eh = mtod(m, struct ether_header *); /* 802.3 header is first */
316 llc = (struct llc *)&eh[1]; /* 802.2 header follows */
317 *framelen = ntohs(eh->ether_type) /* encap'd frame size */
318 + sizeof(struct ether_header) - sizeof(struct llc);
319 eh->ether_type = llc->llc_un.type_snap.ether_type;
320 ovbcopy(eh, mtod(m, uint8_t *) + sizeof(struct llc),
321 sizeof(struct ether_header));
322 m_adj(m, sizeof(struct llc));
323 return m;
324#undef FF_LLC_SIZE
325}
326
f186073c
JS
327/*
328 * Install received rate set information in the node's state block.
329 */
841ab66c
SZ
330int
331ieee80211_setup_rates(struct ieee80211_node *ni,
32176cfd 332 const uint8_t *rates, const uint8_t *xrates, int flags)
f186073c 333{
32176cfd 334 struct ieee80211vap *vap = ni->ni_vap;
f186073c
JS
335 struct ieee80211_rateset *rs = &ni->ni_rates;
336
337 memset(rs, 0, sizeof(*rs));
338 rs->rs_nrates = rates[1];
339 memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
340 if (xrates != NULL) {
341 uint8_t nxrates;
342 /*
343 * Tack on 11g extended supported rate element.
344 */
345 nxrates = xrates[1];
346 if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
347 nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
32176cfd
RP
348 IEEE80211_NOTE(vap, IEEE80211_MSG_XRATE, ni,
349 "extended rate set too large; only using "
350 "%u of %u rates", nxrates, xrates[1]);
351 vap->iv_stats.is_rx_rstoobig++;
f186073c
JS
352 }
353 memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
354 rs->rs_nrates += nxrates;
355 }
32176cfd 356 return ieee80211_fix_rate(ni, rs, flags);
841ab66c
SZ
357}
358
359/*
360 * Send a management frame error response to the specified
361 * station. If ni is associated with the station then use
362 * it; otherwise allocate a temporary node suitable for
363 * transmitting the frame and then free the reference so
364 * it will go away as soon as the frame has been transmitted.
365 */
32176cfd
RP
366void
367ieee80211_send_error(struct ieee80211_node *ni,
368 const uint8_t mac[IEEE80211_ADDR_LEN], int subtype, int arg)
841ab66c 369{
32176cfd 370 struct ieee80211vap *vap = ni->ni_vap;
841ab66c
SZ
371 int istmp;
372
32176cfd
RP
373 if (ni == vap->iv_bss) {
374 if (vap->iv_state != IEEE80211_S_RUN) {
375 /*
376 * XXX hack until we get rid of this routine.
377 * We can be called prior to the vap reaching
378 * run state under certain conditions in which
379 * case iv_bss->ni_chan will not be setup.
380 * Check for this explicitly and and just ignore
381 * the request.
382 */
383 return;
384 }
385 ni = ieee80211_tmp_node(vap, mac);
841ab66c
SZ
386 if (ni == NULL) {
387 /* XXX msg */
388 return;
389 }
390 istmp = 1;
391 } else
392 istmp = 0;
32176cfd 393 IEEE80211_SEND_MGMT(ni, subtype, arg);
841ab66c
SZ
394 if (istmp)
395 ieee80211_free_node(ni);
396}
397
32176cfd
RP
398int
399ieee80211_alloc_challenge(struct ieee80211_node *ni)
841ab66c
SZ
400{
401 if (ni->ni_challenge == NULL)
32176cfd
RP
402 ni->ni_challenge = (uint32_t *) kmalloc(IEEE80211_CHALLENGE_LEN,
403 M_80211_NODE, M_NOWAIT);
841ab66c 404 if (ni->ni_challenge == NULL) {
32176cfd
RP
405 IEEE80211_NOTE(ni->ni_vap,
406 IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, ni,
407 "%s", "shared key challenge alloc failed");
841ab66c
SZ
408 /* XXX statistic */
409 }
410 return (ni->ni_challenge != NULL);
411}
412
32176cfd
RP
413/*
414 * Parse a Beacon or ProbeResponse frame and return the
415 * useful information in an ieee80211_scanparams structure.
416 * Status is set to 0 if no problems were found; otherwise
417 * a bitmask of IEEE80211_BPARSE_* items is returned that
418 * describes the problems detected.
419 */
420int
421ieee80211_parse_beacon(struct ieee80211_node *ni, struct mbuf *m,
422 struct ieee80211_scanparams *scan)
841ab66c 423{
32176cfd
RP
424 struct ieee80211vap *vap = ni->ni_vap;
425 struct ieee80211com *ic = ni->ni_ic;
426 struct ieee80211_frame *wh;
427 uint8_t *frm, *efrm;
841ab66c 428
32176cfd
RP
429 wh = mtod(m, struct ieee80211_frame *);
430 frm = (uint8_t *)&wh[1];
431 efrm = mtod(m, uint8_t *) + m->m_len;
432 scan->status = 0;
841ab66c 433 /*
32176cfd
RP
434 * beacon/probe response frame format
435 * [8] time stamp
436 * [2] beacon interval
437 * [2] capability information
438 * [tlv] ssid
439 * [tlv] supported rates
440 * [tlv] country information
441 * [tlv] channel switch announcement (CSA)
442 * [tlv] parameter set (FH/DS)
443 * [tlv] erp information
444 * [tlv] extended supported rates
445 * [tlv] WME
446 * [tlv] WPA or RSN
447 * [tlv] HT capabilities
448 * [tlv] HT information
449 * [tlv] Atheros capabilities
450 * [tlv] Mesh ID
451 * [tlv] Mesh Configuration
841ab66c 452 */
32176cfd
RP
453 IEEE80211_VERIFY_LENGTH(efrm - frm, 12,
454 return (scan->status = IEEE80211_BPARSE_BADIELEN));
455 memset(scan, 0, sizeof(*scan));
456 scan->tstamp = frm; frm += 8;
457 scan->bintval = le16toh(*(uint16_t *)frm); frm += 2;
458 scan->capinfo = le16toh(*(uint16_t *)frm); frm += 2;
459 scan->bchan = ieee80211_chan2ieee(ic, ic->ic_curchan);
460 scan->chan = scan->bchan;
461 scan->ies = frm;
462 scan->ies_len = efrm - frm;
463
464 while (efrm - frm > 1) {
465 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2,
466 return (scan->status = IEEE80211_BPARSE_BADIELEN));
467 switch (*frm) {
468 case IEEE80211_ELEMID_SSID:
469 scan->ssid = frm;
470 break;
471 case IEEE80211_ELEMID_RATES:
472 scan->rates = frm;
473 break;
474 case IEEE80211_ELEMID_COUNTRY:
475 scan->country = frm;
476 break;
477 case IEEE80211_ELEMID_CSA:
478 scan->csa = frm;
479 break;
480 case IEEE80211_ELEMID_FHPARMS:
481 if (ic->ic_phytype == IEEE80211_T_FH) {
482 scan->fhdwell = LE_READ_2(&frm[2]);
483 scan->chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
484 scan->fhindex = frm[6];
841ab66c 485 }
32176cfd
RP
486 break;
487 case IEEE80211_ELEMID_DSPARMS:
841ab66c 488 /*
32176cfd
RP
489 * XXX hack this since depending on phytype
490 * is problematic for multi-mode devices.
841ab66c 491 */
32176cfd
RP
492 if (ic->ic_phytype != IEEE80211_T_FH)
493 scan->chan = frm[2];
841ab66c 494 break;
32176cfd
RP
495 case IEEE80211_ELEMID_TIM:
496 /* XXX ATIM? */
497 scan->tim = frm;
498 scan->timoff = frm - mtod(m, uint8_t *);
499 break;
500 case IEEE80211_ELEMID_IBSSPARMS:
501 case IEEE80211_ELEMID_CFPARMS:
502 case IEEE80211_ELEMID_PWRCNSTR:
503 /* NB: avoid debugging complaints */
504 break;
505 case IEEE80211_ELEMID_XRATES:
506 scan->xrates = frm;
507 break;
508 case IEEE80211_ELEMID_ERP:
509 if (frm[1] != 1) {
510 IEEE80211_DISCARD_IE(vap,
511 IEEE80211_MSG_ELEMID, wh, "ERP",
512 "bad len %u", frm[1]);
513 vap->iv_stats.is_rx_elem_toobig++;
514 break;
841ab66c 515 }
32176cfd
RP
516 scan->erp = frm[2] | 0x100;
517 break;
518 case IEEE80211_ELEMID_HTCAP:
519 scan->htcap = frm;
520 break;
521 case IEEE80211_ELEMID_RSN:
522 scan->rsn = frm;
523 break;
524 case IEEE80211_ELEMID_HTINFO:
525 scan->htinfo = frm;
526 break;
527#ifdef IEEE80211_SUPPORT_MESH
528 case IEEE80211_ELEMID_MESHID:
529 scan->meshid = frm;
530 break;
531 case IEEE80211_ELEMID_MESHCONF:
532 scan->meshconf = frm;
533 break;
534#endif
535 case IEEE80211_ELEMID_VENDOR:
536 if (iswpaoui(frm))
537 scan->wpa = frm;
538 else if (iswmeparam(frm) || iswmeinfo(frm))
539 scan->wme = frm;
540#ifdef IEEE80211_SUPPORT_SUPERG
541 else if (isatherosoui(frm))
542 scan->ath = frm;
543#endif
544#ifdef IEEE80211_SUPPORT_TDMA
545 else if (istdmaoui(frm))
546 scan->tdma = frm;
547#endif
548 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
549 /*
550 * Accept pre-draft HT ie's if the
551 * standard ones have not been seen.
552 */
553 if (ishtcapoui(frm)) {
554 if (scan->htcap == NULL)
555 scan->htcap = frm;
556 } else if (ishtinfooui(frm)) {
557 if (scan->htinfo == NULL)
558 scan->htcap = frm;
559 }
841ab66c 560 }
841ab66c
SZ
561 break;
562 default:
32176cfd
RP
563 IEEE80211_DISCARD_IE(vap, IEEE80211_MSG_ELEMID,
564 wh, "unhandled",
565 "id %u, len %u", *frm, frm[1]);
566 vap->iv_stats.is_rx_elem_unknown++;
567 break;
841ab66c 568 }
32176cfd 569 frm += frm[1] + 2;
841ab66c 570 }
32176cfd
RP
571 IEEE80211_VERIFY_ELEMENT(scan->rates, IEEE80211_RATE_MAXSIZE,
572 scan->status |= IEEE80211_BPARSE_RATES_INVALID);
573 if (scan->rates != NULL && scan->xrates != NULL) {
841ab66c 574 /*
32176cfd
RP
575 * NB: don't process XRATES if RATES is missing. This
576 * avoids a potential null ptr deref and should be ok
577 * as the return code will already note RATES is missing
578 * (so callers shouldn't otherwise process the frame).
841ab66c 579 */
32176cfd
RP
580 IEEE80211_VERIFY_ELEMENT(scan->xrates,
581 IEEE80211_RATE_MAXSIZE - scan->rates[1],
582 scan->status |= IEEE80211_BPARSE_XRATES_INVALID);
841ab66c 583 }
32176cfd
RP
584 IEEE80211_VERIFY_ELEMENT(scan->ssid, IEEE80211_NWID_LEN,
585 scan->status |= IEEE80211_BPARSE_SSID_INVALID);
586 if (scan->chan != scan->bchan && ic->ic_phytype != IEEE80211_T_FH) {
587 /*
588 * Frame was received on a channel different from the
589 * one indicated in the DS params element id;
590 * silently discard it.
591 *
592 * NB: this can happen due to signal leakage.
593 * But we should take it for FH phy because
594 * the rssi value should be correct even for
595 * different hop pattern in FH.
596 */
597 IEEE80211_DISCARD(vap,
598 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
599 wh, NULL, "for off-channel %u", scan->chan);
600 vap->iv_stats.is_rx_chanmismatch++;
601 scan->status |= IEEE80211_BPARSE_OFFCHAN;
602 }
603 if (!(IEEE80211_BINTVAL_MIN <= scan->bintval &&
604 scan->bintval <= IEEE80211_BINTVAL_MAX)) {
605 IEEE80211_DISCARD(vap,
606 IEEE80211_MSG_ELEMID | IEEE80211_MSG_INPUT,
607 wh, NULL, "bogus beacon interval", scan->bintval);
608 vap->iv_stats.is_rx_badbintval++;
609 scan->status |= IEEE80211_BPARSE_BINTVAL_INVALID;
610 }
611 if (scan->country != NULL) {
612 /*
613 * Validate we have at least enough data to extract
614 * the country code. Not sure if we should return an
615 * error instead of discarding the IE; consider this
616 * being lenient as we don't depend on the data for
617 * correct operation.
618 */
619 IEEE80211_VERIFY_LENGTH(scan->country[1], 3 * sizeof(uint8_t),
620 scan->country = NULL);
841ab66c 621 }
32176cfd
RP
622 if (scan->csa != NULL) {
623 /*
624 * Validate Channel Switch Announcement; this must
625 * be the correct length or we toss the frame.
626 */
627 IEEE80211_VERIFY_LENGTH(scan->csa[1], 3 * sizeof(uint8_t),
628 scan->status |= IEEE80211_BPARSE_CSA_INVALID);
841ab66c 629 }
841ab66c 630 /*
32176cfd
RP
631 * Process HT ie's. This is complicated by our
632 * accepting both the standard ie's and the pre-draft
633 * vendor OUI ie's that some vendors still use/require.
841ab66c 634 */
32176cfd
RP
635 if (scan->htcap != NULL) {
636 IEEE80211_VERIFY_LENGTH(scan->htcap[1],
637 scan->htcap[0] == IEEE80211_ELEMID_VENDOR ?
638 4 + sizeof(struct ieee80211_ie_htcap)-2 :
639 sizeof(struct ieee80211_ie_htcap)-2,
640 scan->htcap = NULL);
841ab66c 641 }
32176cfd
RP
642 if (scan->htinfo != NULL) {
643 IEEE80211_VERIFY_LENGTH(scan->htinfo[1],
644 scan->htinfo[0] == IEEE80211_ELEMID_VENDOR ?
645 4 + sizeof(struct ieee80211_ie_htinfo)-2 :
646 sizeof(struct ieee80211_ie_htinfo)-2,
647 scan->htinfo = NULL);
841ab66c 648 }
32176cfd 649 return scan->status;
841ab66c
SZ
650}
651
841ab66c 652/*
32176cfd 653 * Parse an Action frame. Return 0 on success, non-zero on failure.
841ab66c 654 */
32176cfd
RP
655int
656ieee80211_parse_action(struct ieee80211_node *ni, struct mbuf *m)
841ab66c 657{
32176cfd
RP
658 struct ieee80211vap *vap = ni->ni_vap;
659 const struct ieee80211_action *ia;
841ab66c
SZ
660 struct ieee80211_frame *wh;
661 uint8_t *frm, *efrm;
841ab66c 662
32176cfd
RP
663 /*
664 * action frame format:
665 * [1] category
666 * [1] action
667 * [tlv] parameters
668 */
669 wh = mtod(m, struct ieee80211_frame *);
670 frm = (u_int8_t *)&wh[1];
671 efrm = mtod(m, u_int8_t *) + m->m_len;
672 IEEE80211_VERIFY_LENGTH(efrm - frm,
673 sizeof(struct ieee80211_action), return EINVAL);
674 ia = (const struct ieee80211_action *) frm;
675
676 vap->iv_stats.is_rx_action++;
677 IEEE80211_NODE_STAT(ni, rx_action);
678
679 /* verify frame payloads but defer processing */
680 /* XXX maybe push this to method */
681 switch (ia->ia_category) {
682 case IEEE80211_ACTION_CAT_BA:
683 switch (ia->ia_action) {
684 case IEEE80211_ACTION_BA_ADDBA_REQUEST:
685 IEEE80211_VERIFY_LENGTH(efrm - frm,
686 sizeof(struct ieee80211_action_ba_addbarequest),
687 return EINVAL);
f186073c 688 break;
32176cfd
RP
689 case IEEE80211_ACTION_BA_ADDBA_RESPONSE:
690 IEEE80211_VERIFY_LENGTH(efrm - frm,
691 sizeof(struct ieee80211_action_ba_addbaresponse),
692 return EINVAL);
f186073c 693 break;
32176cfd
RP
694 case IEEE80211_ACTION_BA_DELBA:
695 IEEE80211_VERIFY_LENGTH(efrm - frm,
696 sizeof(struct ieee80211_action_ba_delba),
697 return EINVAL);
f186073c
JS
698 break;
699 }
700 break;
32176cfd
RP
701 case IEEE80211_ACTION_CAT_HT:
702 switch (ia->ia_action) {
703 case IEEE80211_ACTION_HT_TXCHWIDTH:
704 IEEE80211_VERIFY_LENGTH(efrm - frm,
705 sizeof(struct ieee80211_action_ht_txchwidth),
706 return EINVAL);
f186073c 707 break;
32176cfd
RP
708 case IEEE80211_ACTION_HT_MIMOPWRSAVE:
709 IEEE80211_VERIFY_LENGTH(efrm - frm,
710 sizeof(struct ieee80211_action_ht_mimopowersave),
711 return EINVAL);
f186073c
JS
712 break;
713 }
714 break;
715 }
32176cfd 716 return 0;
841ab66c
SZ
717}
718
719#ifdef IEEE80211_DEBUG
720/*
721 * Debugging support.
722 */
32176cfd
RP
723void
724ieee80211_ssid_mismatch(struct ieee80211vap *vap, const char *tag,
725 uint8_t mac[IEEE80211_ADDR_LEN], uint8_t *ssid)
726{
727 printf("[%s] discard %s frame, ssid mismatch: ",
728 ether_sprintf(mac), tag);
729 ieee80211_print_essid(ssid + 2, ssid[1]);
730 printf("\n");
731}
841ab66c
SZ
732
733/*
734 * Return the bssid of a frame.
735 */
736static const uint8_t *
32176cfd 737ieee80211_getbssid(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
841ab66c 738{
32176cfd 739 if (vap->iv_opmode == IEEE80211_M_STA)
841ab66c
SZ
740 return wh->i_addr2;
741 if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) != IEEE80211_FC1_DIR_NODS)
742 return wh->i_addr1;
743 if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == IEEE80211_FC0_SUBTYPE_PS_POLL)
744 return wh->i_addr1;
745 return wh->i_addr3;
746}
747
32176cfd
RP
748#include <machine/stdarg.h>
749
841ab66c 750void
32176cfd 751ieee80211_note(struct ieee80211vap *vap, const char *fmt, ...)
841ab66c
SZ
752{
753 char buf[128]; /* XXX */
32176cfd 754 va_list ap;
841ab66c 755
32176cfd 756 va_start(ap, fmt);
379210cb 757 kvsnprintf(buf, sizeof(buf), fmt, ap);
32176cfd 758 va_end(ap);
841ab66c 759
32176cfd 760 if_printf(vap->iv_ifp, "%s", buf); /* NB: no \n */
841ab66c
SZ
761}
762
763void
32176cfd 764ieee80211_note_frame(struct ieee80211vap *vap,
841ab66c
SZ
765 const struct ieee80211_frame *wh,
766 const char *fmt, ...)
767{
768 char buf[128]; /* XXX */
32176cfd 769 va_list ap;
841ab66c 770
32176cfd
RP
771 va_start(ap, fmt);
772 vsnprintf(buf, sizeof(buf), fmt, ap);
773 va_end(ap);
774 if_printf(vap->iv_ifp, "[%s] %s\n",
775 ether_sprintf(ieee80211_getbssid(vap, wh)), buf);
841ab66c
SZ
776}
777
778void
32176cfd 779ieee80211_note_mac(struct ieee80211vap *vap,
841ab66c
SZ
780 const uint8_t mac[IEEE80211_ADDR_LEN],
781 const char *fmt, ...)
782{
783 char buf[128]; /* XXX */
32176cfd 784 va_list ap;
841ab66c 785
32176cfd
RP
786 va_start(ap, fmt);
787 vsnprintf(buf, sizeof(buf), fmt, ap);
788 va_end(ap);
789 if_printf(vap->iv_ifp, "[%s] %s\n", ether_sprintf(mac), buf);
841ab66c
SZ
790}
791
32176cfd
RP
792void
793ieee80211_discard_frame(struct ieee80211vap *vap,
841ab66c
SZ
794 const struct ieee80211_frame *wh,
795 const char *type, const char *fmt, ...)
796{
32176cfd 797 va_list ap;
841ab66c 798
32176cfd
RP
799 if_printf(vap->iv_ifp, "[%s] discard ",
800 ether_sprintf(ieee80211_getbssid(vap, wh)));
801 if (type == NULL) {
802 printf("%s frame, ", ieee80211_mgt_subtype_name[
803 (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) >>
804 IEEE80211_FC0_SUBTYPE_SHIFT]);
805 } else
806 printf("%s frame, ", type);
807 va_start(ap, fmt);
808 vprintf(fmt, ap);
809 va_end(ap);
810 printf("\n");
841ab66c
SZ
811}
812
32176cfd
RP
813void
814ieee80211_discard_ie(struct ieee80211vap *vap,
841ab66c
SZ
815 const struct ieee80211_frame *wh,
816 const char *type, const char *fmt, ...)
817{
32176cfd 818 va_list ap;
841ab66c 819
32176cfd
RP
820 if_printf(vap->iv_ifp, "[%s] discard ",
821 ether_sprintf(ieee80211_getbssid(vap, wh)));
841ab66c 822 if (type != NULL)
32176cfd 823 printf("%s information element, ", type);
841ab66c 824 else
32176cfd
RP
825 printf("information element, ");
826 va_start(ap, fmt);
827 vprintf(fmt, ap);
828 va_end(ap);
829 printf("\n");
841ab66c
SZ
830}
831
32176cfd
RP
832void
833ieee80211_discard_mac(struct ieee80211vap *vap,
841ab66c
SZ
834 const uint8_t mac[IEEE80211_ADDR_LEN],
835 const char *type, const char *fmt, ...)
836{
32176cfd 837 va_list ap;
841ab66c 838
32176cfd 839 if_printf(vap->iv_ifp, "[%s] discard ", ether_sprintf(mac));
841ab66c 840 if (type != NULL)
32176cfd 841 printf("%s frame, ", type);
841ab66c 842 else
32176cfd
RP
843 printf("frame, ");
844 va_start(ap, fmt);
845 vprintf(fmt, ap);
846 va_end(ap);
847 printf("\n");
841ab66c
SZ
848}
849#endif /* IEEE80211_DEBUG */