sys/netproto/802_11/wlan/ieee80211_sta.c

   1 /*-
   2  * Copyright (c) 2007-2008 Sam Leffler, Errno Consulting
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  17  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  21  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  *
  25  * $FreeBSD: head/sys/net80211/ieee80211_sta.c 203422 2010-02-03 10:07:43Z rpaulo $
  26  */
  27
  28 /*
  29  * IEEE 802.11 Station mode support.
  30  */
  31 #include "opt_inet.h"
  32 #include "opt_wlan.h"
  33
  34 #include <sys/param.h>
  35 #include <sys/systm.h>
  36 #include <sys/mbuf.h>
  37 #include <sys/malloc.h>
  38 #include <sys/kernel.h>
  39
  40 #include <sys/socket.h>
  41 #include <sys/sockio.h>
  42 #include <sys/endian.h>
  43 #include <sys/errno.h>
  44 #include <sys/proc.h>
  45 #include <sys/sysctl.h>
  46
  47 #include <net/if.h>
  48 #include <net/if_media.h>
  49 #include <net/if_llc.h>
  50 #include <net/ethernet.h>
  51 #include <net/route.h>
  52
  53 #include <net/bpf.h>
  54
  55 #include <netproto/802_11/ieee80211_var.h>
  56 #include <netproto/802_11/ieee80211_sta.h>
  57 #include <netproto/802_11/ieee80211_input.h>
  58 #ifdef IEEE80211_SUPPORT_SUPERG
  59 #include <netproto/802_11/ieee80211_superg.h>
  60 #endif
  61
  62 #define IEEE80211_RATE2MBS(r)   (((r) & IEEE80211_RATE_VAL) / 2)
  63
  64 static  void sta_vattach(struct ieee80211vap *);
  65 static  void sta_beacon_miss(struct ieee80211vap *);
  66 static  int sta_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  67 static  int sta_input(struct ieee80211_node *, struct mbuf *, int, int);
  68 static void sta_recv_mgmt(struct ieee80211_node *, struct mbuf *,
  69             int subtype, int rssi, int nf);
  70 static void sta_recv_ctl(struct ieee80211_node *, struct mbuf *, int subtype);
  71
  72 void
  73 ieee80211_sta_attach(struct ieee80211com *ic)
  74 {
  75         ic->ic_vattach[IEEE80211_M_STA] = sta_vattach;
  76 }
  77
  78 void
  79 ieee80211_sta_detach(struct ieee80211com *ic)
  80 {
  81 }
  82
  83 static void
  84 sta_vdetach(struct ieee80211vap *vap)
  85 {
  86 }
  87
  88 static void
  89 sta_vattach(struct ieee80211vap *vap)
  90 {
  91         vap->iv_newstate = sta_newstate;
  92         vap->iv_input = sta_input;
  93         vap->iv_recv_mgmt = sta_recv_mgmt;
  94         vap->iv_recv_ctl = sta_recv_ctl;
  95         vap->iv_opdetach = sta_vdetach;
  96         vap->iv_bmiss = sta_beacon_miss;
  97 }
  98
  99 /*
 100  * Handle a beacon miss event.  The common code filters out
 101  * spurious events that can happen when scanning and/or before
 102  * reaching RUN state.
 103  */
 104 static void
 105 sta_beacon_miss(struct ieee80211vap *vap)
 106 {
 107         struct ieee80211com *ic = vap->iv_ic;
 108
 109         KASSERT((ic->ic_flags & IEEE80211_F_SCAN) == 0, ("scanning"));
 110         KASSERT(vap->iv_state >= IEEE80211_S_RUN,
 111             ("wrong state %s", ieee80211_state_name[vap->iv_state]));
 112
 113         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE | IEEE80211_MSG_DEBUG,
 114             "beacon miss, mode %s state %s\n",
 115             ieee80211_opmode_name[vap->iv_opmode],
 116             ieee80211_state_name[vap->iv_state]);
 117
 118         if (vap->iv_state == IEEE80211_S_CSA) {
 119                 /*
 120                  * A Channel Switch is pending; assume we missed the
 121                  * beacon that would've completed the process and just
 122                  * force the switch.  If we made a mistake we'll not
 123                  * find the AP on the new channel and fall back to a
 124                  * normal scan.
 125                  */
 126                 ieee80211_csa_completeswitch(ic);
 127                 return;
 128         }
 129         if (++vap->iv_bmiss_count < vap->iv_bmiss_max) {
 130                 /*
 131                  * Send a directed probe req before falling back to a
 132                  * scan; if we receive a response ic_bmiss_count will
 133                  * be reset.  Some cards mistakenly report beacon miss
 134                  * so this avoids the expensive scan if the ap is
 135                  * still there.
 136                  */
 137                 ieee80211_send_probereq(vap->iv_bss, vap->iv_myaddr,
 138                         vap->iv_bss->ni_bssid, vap->iv_bss->ni_bssid,
 139                         vap->iv_bss->ni_essid, vap->iv_bss->ni_esslen);
 140                 return;
 141         }
 142         vap->iv_bmiss_count = 0;
 143         vap->iv_stats.is_beacon_miss++;
 144         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
 145 #ifdef IEEE80211_SUPPORT_SUPERG
 146                 struct ieee80211com *ic = vap->iv_ic;
 147
 148                 /*
 149                  * If we receive a beacon miss interrupt when using
 150                  * dynamic turbo, attempt to switch modes before
 151                  * reassociating.
 152                  */
 153                 if (IEEE80211_ATH_CAP(vap, vap->iv_bss, IEEE80211_NODE_TURBOP))
 154                         ieee80211_dturbo_switch(vap,
 155                             ic->ic_bsschan->ic_flags ^ IEEE80211_CHAN_TURBO);
 156 #endif
 157                 /*
 158                  * Try to reassociate before scanning for a new ap.
 159                  */
 160                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 1);
 161         } else {
 162                 /*
 163                  * Somebody else is controlling state changes (e.g.
 164                  * a user-mode app) don't do anything that would
 165                  * confuse them; just drop into scan mode so they'll
 166                  * notified of the state change and given control.
 167                  */
 168                 ieee80211_new_state(vap, IEEE80211_S_SCAN, 0);
 169         }
 170 }
 171
 172 /*
 173  * Handle deauth with reason.  We retry only for
 174  * the cases where we might succeed.  Otherwise
 175  * we downgrade the ap and scan.
 176  */
 177 static void
 178 sta_authretry(struct ieee80211vap *vap, struct ieee80211_node *ni, int reason)
 179 {
 180         switch (reason) {
 181         case IEEE80211_STATUS_SUCCESS:          /* NB: MLME assoc */
 182         case IEEE80211_STATUS_TIMEOUT:
 183         case IEEE80211_REASON_ASSOC_EXPIRE:
 184         case IEEE80211_REASON_NOT_AUTHED:
 185         case IEEE80211_REASON_NOT_ASSOCED:
 186         case IEEE80211_REASON_ASSOC_LEAVE:
 187         case IEEE80211_REASON_ASSOC_NOT_AUTHED:
 188                 IEEE80211_SEND_MGMT(ni, IEEE80211_FC0_SUBTYPE_AUTH, 1);
 189                 break;
 190         default:
 191                 ieee80211_scan_assoc_fail(vap, vap->iv_bss->ni_macaddr, reason);
 192                 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
 193                         ieee80211_check_scan_current(vap);
 194                 break;
 195         }
 196 }
 197
 198 /*
 199  * IEEE80211_M_STA vap state machine handler.
 200  * This routine handles the main states in the 802.11 protocol.
 201  */
 202 static int
 203 sta_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 204 {
 205         struct ieee80211com *ic = vap->iv_ic;
 206         struct ieee80211_node *ni;
 207         enum ieee80211_state ostate;
 208
 209         ostate = vap->iv_state;
 210         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
 211             __func__, ieee80211_state_name[ostate],
 212             ieee80211_state_name[nstate], arg);
 213         vap->iv_state = nstate;                 /* state transition */
 214         callout_stop(&vap->iv_mgtsend);         /* XXX callout_drain */
 215         if (ostate != IEEE80211_S_SCAN)
 216                 ieee80211_cancel_scan(vap);     /* background scan */
 217         ni = vap->iv_bss;                       /* NB: no reference held */
 218         if (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)
 219                 callout_stop(&vap->iv_swbmiss);
 220         switch (nstate) {
 221         case IEEE80211_S_INIT:
 222                 switch (ostate) {
 223                 case IEEE80211_S_SLEEP:
 224                         /* XXX wakeup */
 225                 case IEEE80211_S_RUN:
 226                         IEEE80211_SEND_MGMT(ni,
 227                             IEEE80211_FC0_SUBTYPE_DISASSOC,
 228                             IEEE80211_REASON_ASSOC_LEAVE);
 229                         ieee80211_sta_leave(ni);
 230                         break;
 231                 case IEEE80211_S_ASSOC:
 232                         IEEE80211_SEND_MGMT(ni,
 233                             IEEE80211_FC0_SUBTYPE_DEAUTH,
 234                             IEEE80211_REASON_AUTH_LEAVE);
 235                         break;
 236                 case IEEE80211_S_SCAN:
 237                         ieee80211_cancel_scan(vap);
 238                         break;
 239                 default:
 240                         goto invalid;
 241                 }
 242                 if (ostate != IEEE80211_S_INIT) {
 243                         /* NB: optimize INIT -> INIT case */
 244                         ieee80211_reset_bss(vap);
 245                 }
 246                 if (vap->iv_auth->ia_detach != NULL)
 247                         vap->iv_auth->ia_detach(vap);
 248                 break;
 249         case IEEE80211_S_SCAN:
 250                 switch (ostate) {
 251                 case IEEE80211_S_INIT:
 252                         /*
 253                          * Initiate a scan.  We can come here as a result
 254                          * of an IEEE80211_IOC_SCAN_REQ too in which case
 255                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
 256                          * and the scan request parameters will be present
 257                          * in iv_scanreq.  Otherwise we do the default.
 258                          */
 259                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
 260                                 ieee80211_check_scan(vap,
 261                                     vap->iv_scanreq_flags,
 262                                     vap->iv_scanreq_duration,
 263                                     vap->iv_scanreq_mindwell,
 264                                     vap->iv_scanreq_maxdwell,
 265                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
 266                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
 267                         } else
 268                                 ieee80211_check_scan_current(vap);
 269                         break;
 270                 case IEEE80211_S_SCAN:
 271                 case IEEE80211_S_AUTH:
 272                 case IEEE80211_S_ASSOC:
 273                         /*
 274                          * These can happen either because of a timeout
 275                          * on an assoc/auth response or because of a
 276                          * change in state that requires a reset.  For
 277                          * the former we're called with a non-zero arg
 278                          * that is the cause for the failure; pass this
 279                          * to the scan code so it can update state.
 280                          * Otherwise trigger a new scan unless we're in
 281                          * manual roaming mode in which case an application
 282                          * must issue an explicit scan request.
 283                          */
 284                         if (arg != 0)
 285                                 ieee80211_scan_assoc_fail(vap,
 286                                         vap->iv_bss->ni_macaddr, arg);
 287                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
 288                                 ieee80211_check_scan_current(vap);
 289                         break;
 290                 case IEEE80211_S_RUN:           /* beacon miss */
 291                         /*
 292                          * Beacon miss.  Notify user space and if not
 293                          * under control of a user application (roaming
 294                          * manual) kick off a scan to re-connect.
 295                          */
 296                         ieee80211_sta_leave(ni);
 297                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO)
 298                                 ieee80211_check_scan_current(vap);
 299                         break;
 300                 default:
 301                         goto invalid;
 302                 }
 303                 break;
 304         case IEEE80211_S_AUTH:
 305                 switch (ostate) {
 306                 case IEEE80211_S_INIT:
 307                 case IEEE80211_S_SCAN:
 308                         IEEE80211_SEND_MGMT(ni,
 309                             IEEE80211_FC0_SUBTYPE_AUTH, 1);
 310                         break;
 311                 case IEEE80211_S_AUTH:
 312                 case IEEE80211_S_ASSOC:
 313                         switch (arg & 0xff) {
 314                         case IEEE80211_FC0_SUBTYPE_AUTH:
 315                                 /* ??? */
 316                                 IEEE80211_SEND_MGMT(ni,
 317                                     IEEE80211_FC0_SUBTYPE_AUTH, 2);
 318                                 break;
 319                         case IEEE80211_FC0_SUBTYPE_DEAUTH:
 320                                 sta_authretry(vap, ni, arg>>8);
 321                                 break;
 322                         }
 323                         break;
 324                 case IEEE80211_S_RUN:
 325                         switch (arg & 0xff) {
 326                         case IEEE80211_FC0_SUBTYPE_AUTH:
 327                                 IEEE80211_SEND_MGMT(ni,
 328                                     IEEE80211_FC0_SUBTYPE_AUTH, 2);
 329                                 vap->iv_state = ostate; /* stay RUN */
 330                                 break;
 331                         case IEEE80211_FC0_SUBTYPE_DEAUTH:
 332                                 ieee80211_sta_leave(ni);
 333                                 if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
 334                                         /* try to reauth */
 335                                         IEEE80211_SEND_MGMT(ni,
 336                                             IEEE80211_FC0_SUBTYPE_AUTH, 1);
 337                                 }
 338                                 break;
 339                         }
 340                         break;
 341                 default:
 342                         goto invalid;
 343                 }
 344                 break;
 345         case IEEE80211_S_ASSOC:
 346                 switch (ostate) {
 347                 case IEEE80211_S_AUTH:
 348                 case IEEE80211_S_ASSOC:
 349                         IEEE80211_SEND_MGMT(ni,
 350                             IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
 351                         break;
 352                 case IEEE80211_S_SLEEP:         /* cannot happen */
 353                 case IEEE80211_S_RUN:
 354                         ieee80211_sta_leave(ni);
 355                         if (vap->iv_roaming == IEEE80211_ROAMING_AUTO) {
 356                                 IEEE80211_SEND_MGMT(ni, arg ?
 357                                     IEEE80211_FC0_SUBTYPE_REASSOC_REQ :
 358                                     IEEE80211_FC0_SUBTYPE_ASSOC_REQ, 0);
 359                         }
 360                         break;
 361                 default:
 362                         goto invalid;
 363                 }
 364                 break;
 365         case IEEE80211_S_RUN:
 366                 if (vap->iv_flags & IEEE80211_F_WPA) {
 367                         /* XXX validate prerequisites */
 368                 }
 369                 switch (ostate) {
 370                 case IEEE80211_S_RUN:
 371                 case IEEE80211_S_CSA:
 372                         break;
 373                 case IEEE80211_S_AUTH:          /* when join is done in fw */
 374                 case IEEE80211_S_ASSOC:
 375 #ifdef IEEE80211_DEBUG
 376                         if (ieee80211_msg_debug(vap)) {
 377                                 ieee80211_note(vap, "%s with %6D ssid ",
 378                                     (vap->iv_opmode == IEEE80211_M_STA ?
 379                                     "associated" : "synchronized"),
 380                                     ni->ni_bssid, ":");
 381                                 ieee80211_print_essid(vap->iv_bss->ni_essid,
 382                                     ni->ni_esslen);
 383                                 /* XXX MCS/HT */
 384                                 kprintf(" channel %d start %uMb\n",
 385                                     ieee80211_chan2ieee(ic, ic->ic_curchan),
 386                                     IEEE80211_RATE2MBS(ni->ni_txrate));
 387                         }
 388 #endif
 389                         ieee80211_scan_assoc_success(vap, ni->ni_macaddr);
 390                         ieee80211_notify_node_join(ni,
 391                             arg == IEEE80211_FC0_SUBTYPE_ASSOC_RESP);
 392                         break;
 393                 case IEEE80211_S_SLEEP:
 394                         ieee80211_sta_pwrsave(vap, 0);
 395                         break;
 396                 default:
 397                         goto invalid;
 398                 }
 399                 ieee80211_sync_curchan(ic);
 400                 if (ostate != IEEE80211_S_RUN &&
 401                     (vap->iv_flags_ext & IEEE80211_FEXT_SWBMISS)) {
 402                         /*
 403                          * Start s/w beacon miss timer for devices w/o
 404                          * hardware support.  We fudge a bit here since
 405                          * we're doing this in software.
 406                          */
 407                         vap->iv_swbmiss_period = IEEE80211_TU_TO_TICKS(
 408                                 2 * vap->iv_bmissthreshold * ni->ni_intval);
 409                         vap->iv_swbmiss_count = 0;
 410                         callout_reset(&vap->iv_swbmiss, vap->iv_swbmiss_period,
 411                                       ieee80211_swbmiss_callout, vap);
 412                 }
 413                 /*
 414                  * When 802.1x is not in use mark the port authorized
 415                  * at this point so traffic can flow.
 416                  */
 417                 if (ni->ni_authmode != IEEE80211_AUTH_8021X)
 418                         ieee80211_node_authorize(ni);
 419                 /*
 420                  * Fake association when joining an existing bss.
 421                  */
 422                 if (ic->ic_newassoc != NULL)
 423                         ic->ic_newassoc(vap->iv_bss, ostate != IEEE80211_S_RUN);
 424                 break;
 425         case IEEE80211_S_CSA:
 426                 if (ostate != IEEE80211_S_RUN)
 427                         goto invalid;
 428                 break;
 429         case IEEE80211_S_SLEEP:
 430                 ieee80211_sta_pwrsave(vap, 1);
 431                 break;
 432         default:
 433         invalid:
 434                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE,
 435                     "%s: unexpected state transition %s -> %s\n", __func__,
 436                     ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
 437                 break;
 438         }
 439         return 0;
 440 }
 441
 442 /*
 443  * Return non-zero if the frame is an echo of a multicast
 444  * frame sent by ourself.  The dir is known to be DSTODS.
 445  */
 446 static __inline int
 447 isdstods_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
 448 {
 449 #define QWH4(wh)        ((const struct ieee80211_qosframe_addr4 *)wh)
 450 #define WH4(wh)         ((const struct ieee80211_frame_addr4 *)wh)
 451         const uint8_t *sa;
 452
 453         KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
 454
 455         if (!IEEE80211_IS_MULTICAST(wh->i_addr3))
 456                 return 0;
 457         sa = IEEE80211_QOS_HAS_SEQ(wh) ? QWH4(wh)->i_addr4 : WH4(wh)->i_addr4;
 458         return IEEE80211_ADDR_EQ(sa, vap->iv_myaddr);
 459 #undef WH4
 460 #undef QWH4
 461 }
 462
 463 /*
 464  * Return non-zero if the frame is an echo of a multicast
 465  * frame sent by ourself.  The dir is known to be FROMDS.
 466  */
 467 static __inline int
 468 isfromds_mcastecho(struct ieee80211vap *vap, const struct ieee80211_frame *wh)
 469 {
 470         KASSERT(vap->iv_opmode == IEEE80211_M_STA, ("wrong mode"));
 471
 472         if (!IEEE80211_IS_MULTICAST(wh->i_addr1))
 473                 return 0;
 474         return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
 475 }
 476
 477 /*
 478  * Decide if a received management frame should be
 479  * printed when debugging is enabled.  This filters some
 480  * of the less interesting frames that come frequently
 481  * (e.g. beacons).
 482  */
 483 static __inline int
 484 doprint(struct ieee80211vap *vap, int subtype)
 485 {
 486         switch (subtype) {
 487         case IEEE80211_FC0_SUBTYPE_BEACON:
 488                 return (vap->iv_ic->ic_flags & IEEE80211_F_SCAN);
 489         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
 490                 return 0;
 491         }
 492         return 1;
 493 }
 494
 495 /*
 496  * Process a received frame.  The node associated with the sender
 497  * should be supplied.  If nothing was found in the node table then
 498  * the caller is assumed to supply a reference to iv_bss instead.
 499  * The RSSI and a timestamp are also supplied.  The RSSI data is used
 500  * during AP scanning to select a AP to associate with; it can have
 501  * any units so long as values have consistent units and higher values
 502  * mean ``better signal''.  The receive timestamp is currently not used
 503  * by the 802.11 layer.
 504  */
 505 static int
 506 sta_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
 507 {
 508 #define SEQ_LEQ(a,b)    ((int)((a)-(b)) <= 0)
 509 #define HAS_SEQ(type)   ((type & 0x4) == 0)
 510         struct ieee80211vap *vap = ni->ni_vap;
 511         struct ieee80211com *ic = ni->ni_ic;
 512         struct ifnet *ifp = vap->iv_ifp;
 513         struct ieee80211_frame *wh;
 514         struct ieee80211_key *key;
 515         struct ether_header *eh;
 516         int hdrspace, need_tap = 1;     /* mbuf need to be tapped. */
 517         uint8_t dir, type, subtype, qos;
 518         uint8_t *bssid;
 519         uint16_t rxseq;
 520
 521         if (m->m_flags & M_AMPDU_MPDU) {
 522                 /*
 523                  * Fastpath for A-MPDU reorder q resubmission.  Frames
 524                  * w/ M_AMPDU_MPDU marked have already passed through
 525                  * here but were received out of order and been held on
 526                  * the reorder queue.  When resubmitted they are marked
 527                  * with the M_AMPDU_MPDU flag and we can bypass most of
 528                  * the normal processing.
 529                  */
 530                 wh = mtod(m, struct ieee80211_frame *);
 531                 type = IEEE80211_FC0_TYPE_DATA;
 532                 dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 533                 subtype = IEEE80211_FC0_SUBTYPE_QOS;
 534                 hdrspace = ieee80211_hdrspace(ic, wh);  /* XXX optimize? */
 535                 goto resubmit_ampdu;
 536         }
 537
 538         KASSERT(ni != NULL, ("null node"));
 539         ni->ni_inact = ni->ni_inact_reload;
 540
 541         type = -1;                      /* undefined */
 542
 543         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
 544                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 545                     ni->ni_macaddr, NULL,
 546                     "too short (1): len %u", m->m_pkthdr.len);
 547                 vap->iv_stats.is_rx_tooshort++;
 548                 goto out;
 549         }
 550         /*
 551          * Bit of a cheat here, we use a pointer for a 3-address
 552          * frame format but don't reference fields past outside
 553          * ieee80211_frame_min w/o first validating the data is
 554          * present.
 555          */
 556         wh = mtod(m, struct ieee80211_frame *);
 557
 558         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
 559             IEEE80211_FC0_VERSION_0) {
 560                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 561                     ni->ni_macaddr, NULL, "wrong version, fc %02x:%02x",
 562                     wh->i_fc[0], wh->i_fc[1]);
 563                 vap->iv_stats.is_rx_badversion++;
 564                 goto err;
 565         }
 566
 567         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
 568         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 569         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
 570         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
 571                 bssid = wh->i_addr2;
 572                 if (!IEEE80211_ADDR_EQ(bssid, ni->ni_bssid)) {
 573                         /* not interested in */
 574                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 575                             bssid, NULL, "%s", "not to bss");
 576                         vap->iv_stats.is_rx_wrongbss++;
 577                         goto out;
 578                 }
 579                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
 580                 ni->ni_noise = nf;
 581                 if (HAS_SEQ(type) && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 582                         uint8_t tid = ieee80211_gettid(wh);
 583                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
 584                             TID_TO_WME_AC(tid) >= WME_AC_VI)
 585                                 ic->ic_wme.wme_hipri_traffic++;
 586                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
 587                         if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
 588                             (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
 589                             SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
 590                                 /* duplicate, discard */
 591                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 592                                     bssid, "duplicate",
 593                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
 594                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
 595                                     ni->ni_rxseqs[tid] >>
 596                                         IEEE80211_SEQ_SEQ_SHIFT,
 597                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
 598                                     ni->ni_rxseqs[tid] &
 599                                         IEEE80211_SEQ_FRAG_MASK,
 600                                     tid);
 601                                 vap->iv_stats.is_rx_dup++;
 602                                 IEEE80211_NODE_STAT(ni, rx_dup);
 603                                 goto out;
 604                         }
 605                         ni->ni_rxseqs[tid] = rxseq;
 606                 }
 607         }
 608
 609         switch (type) {
 610         case IEEE80211_FC0_TYPE_DATA:
 611                 hdrspace = ieee80211_hdrspace(ic, wh);
 612                 if (m->m_len < hdrspace &&
 613                     (m = m_pullup(m, hdrspace)) == NULL) {
 614                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 615                             ni->ni_macaddr, NULL,
 616                             "data too short: expecting %u", hdrspace);
 617                         vap->iv_stats.is_rx_tooshort++;
 618                         goto out;               /* XXX */
 619                 }
 620                 /*
 621                  * Handle A-MPDU re-ordering.  If the frame is to be
 622                  * processed directly then ieee80211_ampdu_reorder
 623                  * will return 0; otherwise it has consumed the mbuf
 624                  * and we should do nothing more with it.
 625                  */
 626                 if ((m->m_flags & M_AMPDU) &&
 627                     (dir == IEEE80211_FC1_DIR_FROMDS ||
 628                      dir == IEEE80211_FC1_DIR_DSTODS) &&
 629                     ieee80211_ampdu_reorder(ni, m) != 0) {
 630                         m = NULL;
 631                         goto out;
 632                 }
 633         resubmit_ampdu:
 634                 if (dir == IEEE80211_FC1_DIR_FROMDS) {
 635                         if ((ifp->if_flags & IFF_SIMPLEX) &&
 636                             isfromds_mcastecho(vap, wh)) {
 637                                 /*
 638                                  * In IEEE802.11 network, multicast
 639                                  * packets sent from "me" are broadcast
 640                                  * from the AP; silently discard for
 641                                  * SIMPLEX interface.
 642                                  */
 643                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 644                                     wh, "data", "%s", "multicast echo");
 645                                 vap->iv_stats.is_rx_mcastecho++;
 646                                 goto out;
 647                         }
 648                         if ((vap->iv_flags & IEEE80211_F_DWDS) &&
 649                             IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 650                                 /*
 651                                  * DWDS sta's must drop 3-address mcast frames
 652                                  * as they will be sent separately as a 4-addr
 653                                  * frame.  Accepting the 3-addr frame will
 654                                  * confuse the bridge into thinking the sending
 655                                  * sta is located at the end of WDS link.
 656                                  */
 657                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
 658                                     "3-address data", "%s", "DWDS enabled");
 659                                 vap->iv_stats.is_rx_mcastecho++;
 660                                 goto out;
 661                         }
 662                 } else if (dir == IEEE80211_FC1_DIR_DSTODS) {
 663                         if ((vap->iv_flags & IEEE80211_F_DWDS) == 0) {
 664                                 IEEE80211_DISCARD(vap,
 665                                     IEEE80211_MSG_INPUT, wh, "4-address data",
 666                                     "%s", "DWDS not enabled");
 667                                 vap->iv_stats.is_rx_wrongdir++;
 668                                 goto out;
 669                         }
 670                         if ((ifp->if_flags & IFF_SIMPLEX) &&
 671                             isdstods_mcastecho(vap, wh)) {
 672                                 /*
 673                                  * In IEEE802.11 network, multicast
 674                                  * packets sent from "me" are broadcast
 675                                  * from the AP; silently discard for
 676                                  * SIMPLEX interface.
 677                                  */
 678                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
 679                                     "4-address data", "%s", "multicast echo");
 680                                 vap->iv_stats.is_rx_mcastecho++;
 681                                 goto out;
 682                         }
 683                 } else {
 684                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT, wh,
 685                             "data", "incorrect dir 0x%x", dir);
 686                         vap->iv_stats.is_rx_wrongdir++;
 687                         goto out;
 688                 }
 689
 690                 /*
 691                  * Handle privacy requirements.  Note that we
 692                  * must not be preempted from here until after
 693                  * we (potentially) call ieee80211_crypto_demic;
 694                  * otherwise we may violate assumptions in the
 695                  * crypto cipher modules used to do delayed update
 696                  * of replay sequence numbers.
 697                  */
 698                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 699                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 700                                 /*
 701                                  * Discard encrypted frames when privacy is off.
 702                                  */
 703                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 704                                     wh, "WEP", "%s", "PRIVACY off");
 705                                 vap->iv_stats.is_rx_noprivacy++;
 706                                 IEEE80211_NODE_STAT(ni, rx_noprivacy);
 707                                 goto out;
 708                         }
 709                         key = ieee80211_crypto_decap(ni, m, hdrspace);
 710                         if (key == NULL) {
 711                                 /* NB: stats+msgs handled in crypto_decap */
 712                                 IEEE80211_NODE_STAT(ni, rx_wepfail);
 713                                 goto out;
 714                         }
 715                         wh = mtod(m, struct ieee80211_frame *);
 716                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
 717                 } else {
 718                         /* XXX M_WEP and IEEE80211_F_PRIVACY */
 719                         key = NULL;
 720                 }
 721
 722                 /*
 723                  * Save QoS bits for use below--before we strip the header.
 724                  */
 725                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
 726                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
 727                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
 728                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
 729                 } else
 730                         qos = 0;
 731
 732                 /*
 733                  * Next up, any fragmentation.
 734                  */
 735                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 736                         m = ieee80211_defrag(ni, m, hdrspace);
 737                         if (m == NULL) {
 738                                 /* Fragment dropped or frame not complete yet */
 739                                 goto out;
 740                         }
 741                 }
 742                 wh = NULL;              /* no longer valid, catch any uses */
 743
 744                 /*
 745                  * Next strip any MSDU crypto bits.
 746                  */
 747                 if (key != NULL && !ieee80211_crypto_demic(vap, key, m, 0)) {
 748                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 749                             ni->ni_macaddr, "data", "%s", "demic error");
 750                         vap->iv_stats.is_rx_demicfail++;
 751                         IEEE80211_NODE_STAT(ni, rx_demicfail);
 752                         goto out;
 753                 }
 754
 755                 /* copy to listener after decrypt */
 756                 if (ieee80211_radiotap_active_vap(vap))
 757                         ieee80211_radiotap_rx(vap, m);
 758                 need_tap = 0;
 759
 760                 /*
 761                  * Finally, strip the 802.11 header.
 762                  */
 763                 m = ieee80211_decap(vap, m, hdrspace);
 764                 if (m == NULL) {
 765                         /* XXX mask bit to check for both */
 766                         /* don't count Null data frames as errors */
 767                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
 768                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
 769                                 goto out;
 770                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 771                             ni->ni_macaddr, "data", "%s", "decap error");
 772                         vap->iv_stats.is_rx_decap++;
 773                         IEEE80211_NODE_STAT(ni, rx_decap);
 774                         goto err;
 775                 }
 776                 eh = mtod(m, struct ether_header *);
 777                 if (!ieee80211_node_is_authorized(ni)) {
 778                         /*
 779                          * Deny any non-PAE frames received prior to
 780                          * authorization.  For open/shared-key
 781                          * authentication the port is mark authorized
 782                          * after authentication completes.  For 802.1x
 783                          * the port is not marked authorized by the
 784                          * authenticator until the handshake has completed.
 785                          */
 786                         if (eh->ether_type != htons(ETHERTYPE_PAE)) {
 787                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
 788                                     eh->ether_shost, "data",
 789                                     "unauthorized port: ether type 0x%x len %u",
 790                                     eh->ether_type, m->m_pkthdr.len);
 791                                 vap->iv_stats.is_rx_unauth++;
 792                                 IEEE80211_NODE_STAT(ni, rx_unauth);
 793                                 goto err;
 794                         }
 795                 } else {
 796                         /*
 797                          * When denying unencrypted frames, discard
 798                          * any non-PAE frames received without encryption.
 799                          */
 800                         if ((vap->iv_flags & IEEE80211_F_DROPUNENC) &&
 801                             (key == NULL && (m->m_flags & M_WEP) == 0) &&
 802                             eh->ether_type != htons(ETHERTYPE_PAE)) {
 803                                 /*
 804                                  * Drop unencrypted frames.
 805                                  */
 806                                 vap->iv_stats.is_rx_unencrypted++;
 807                                 IEEE80211_NODE_STAT(ni, rx_unencrypted);
 808                                 goto out;
 809                         }
 810                 }
 811                 /* XXX require HT? */
 812                 if (qos & IEEE80211_QOS_AMSDU) {
 813                         m = ieee80211_decap_amsdu(ni, m);
 814                         if (m == NULL)
 815                                 return IEEE80211_FC0_TYPE_DATA;
 816                 } else {
 817 #ifdef IEEE80211_SUPPORT_SUPERG
 818                         m = ieee80211_decap_fastframe(vap, ni, m);
 819                         if (m == NULL)
 820                                 return IEEE80211_FC0_TYPE_DATA;
 821 #endif
 822                 }
 823                 ieee80211_deliver_data(vap, ni, m);
 824                 return IEEE80211_FC0_TYPE_DATA;
 825
 826         case IEEE80211_FC0_TYPE_MGT:
 827                 vap->iv_stats.is_rx_mgmt++;
 828                 IEEE80211_NODE_STAT(ni, rx_mgmt);
 829                 if (dir != IEEE80211_FC1_DIR_NODS) {
 830                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 831                             wh, "data", "incorrect dir 0x%x", dir);
 832                         vap->iv_stats.is_rx_wrongdir++;
 833                         goto err;
 834                 }
 835                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
 836                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
 837                             ni->ni_macaddr, "mgt", "too short: len %u",
 838                             m->m_pkthdr.len);
 839                         vap->iv_stats.is_rx_tooshort++;
 840                         goto out;
 841                 }
 842 #ifdef IEEE80211_DEBUG
 843                 if ((ieee80211_msg_debug(vap) && doprint(vap, subtype)) ||
 844                     ieee80211_msg_dumppkts(vap)) {
 845                         if_printf(ifp, "received %s from %6D rssi %d\n",
 846                             ieee80211_mgt_subtype_name[subtype >>
 847                                 IEEE80211_FC0_SUBTYPE_SHIFT],
 848                             wh->i_addr2, ":", rssi);
 849                 }
 850 #endif
 851                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 852                         if (subtype != IEEE80211_FC0_SUBTYPE_AUTH) {
 853                                 /*
 854                                  * Only shared key auth frames with a challenge
 855                                  * should be encrypted, discard all others.
 856                                  */
 857                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 858                                     wh, ieee80211_mgt_subtype_name[subtype >>
 859                                         IEEE80211_FC0_SUBTYPE_SHIFT],
 860                                     "%s", "WEP set but not permitted");
 861                                 vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
 862                                 goto out;
 863                         }
 864                         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 865                                 /*
 866                                  * Discard encrypted frames when privacy is off.
 867                                  */
 868                                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
 869                                     wh, "mgt", "%s", "WEP set but PRIVACY off");
 870                                 vap->iv_stats.is_rx_noprivacy++;
 871                                 goto out;
 872                         }
 873                         hdrspace = ieee80211_hdrspace(ic, wh);
 874                         key = ieee80211_crypto_decap(ni, m, hdrspace);
 875                         if (key == NULL) {
 876                                 /* NB: stats+msgs handled in crypto_decap */
 877                                 goto out;
 878                         }
 879                         wh = mtod(m, struct ieee80211_frame *);
 880                         wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
 881                 }
 882                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
 883                 goto out;
 884
 885         case IEEE80211_FC0_TYPE_CTL:
 886                 vap->iv_stats.is_rx_ctl++;
 887                 IEEE80211_NODE_STAT(ni, rx_ctrl);
 888                 vap->iv_recv_ctl(ni, m, subtype);
 889                 goto out;
 890
 891         default:
 892                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 893                     wh, NULL, "bad frame type 0x%x", type);
 894                 /* should not come here */
 895                 break;
 896         }
 897 err:
 898         ifp->if_ierrors++;
 899 out:
 900         if (m != NULL) {
 901                 if (need_tap && ieee80211_radiotap_active_vap(vap))
 902                         ieee80211_radiotap_rx(vap, m);
 903                 m_freem(m);
 904         }
 905         return type;
 906 #undef SEQ_LEQ
 907 }
 908
 909 static void
 910 sta_auth_open(struct ieee80211_node *ni, struct ieee80211_frame *wh,
 911     int rssi, int nf, uint16_t seq, uint16_t status)
 912 {
 913         struct ieee80211vap *vap = ni->ni_vap;
 914
 915         if (ni->ni_authmode == IEEE80211_AUTH_SHARED) {
 916                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 917                     ni->ni_macaddr, "open auth",
 918                     "bad sta auth mode %u", ni->ni_authmode);
 919                 vap->iv_stats.is_rx_bad_auth++; /* XXX */
 920                 return;
 921         }
 922         if (vap->iv_state != IEEE80211_S_AUTH ||
 923             seq != IEEE80211_AUTH_OPEN_RESPONSE) {
 924                 vap->iv_stats.is_rx_bad_auth++;
 925                 return;
 926         }
 927         if (status != 0) {
 928                 IEEE80211_NOTE(vap, IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH,
 929                     ni, "open auth failed (reason %d)", status);
 930                 vap->iv_stats.is_rx_auth_fail++;
 931                 vap->iv_stats.is_rx_authfail_code = status;
 932                 ieee80211_new_state(vap, IEEE80211_S_SCAN,
 933                     IEEE80211_SCAN_FAIL_STATUS);
 934         } else
 935                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
 936 }
 937
 938 static void
 939 sta_auth_shared(struct ieee80211_node *ni, struct ieee80211_frame *wh,
 940     uint8_t *frm, uint8_t *efrm, int rssi, int nf,
 941     uint16_t seq, uint16_t status)
 942 {
 943         struct ieee80211vap *vap = ni->ni_vap;
 944         uint8_t *challenge;
 945         int estatus;
 946
 947         /*
 948          * NB: this can happen as we allow pre-shared key
 949          * authentication to be enabled w/o wep being turned
 950          * on so that configuration of these can be done
 951          * in any order.  It may be better to enforce the
 952          * ordering in which case this check would just be
 953          * for sanity/consistency.
 954          */
 955         if ((vap->iv_flags & IEEE80211_F_PRIVACY) == 0) {
 956                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 957                     ni->ni_macaddr, "shared key auth",
 958                     "%s", " PRIVACY is disabled");
 959                 estatus = IEEE80211_STATUS_ALG;
 960                 goto bad;
 961         }
 962         /*
 963          * Pre-shared key authentication is evil; accept
 964          * it only if explicitly configured (it is supported
 965          * mainly for compatibility with clients like OS X).
 966          */
 967         if (ni->ni_authmode != IEEE80211_AUTH_AUTO &&
 968             ni->ni_authmode != IEEE80211_AUTH_SHARED) {
 969                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 970                     ni->ni_macaddr, "shared key auth",
 971                     "bad sta auth mode %u", ni->ni_authmode);
 972                 vap->iv_stats.is_rx_bad_auth++; /* XXX maybe a unique error? */
 973                 estatus = IEEE80211_STATUS_ALG;
 974                 goto bad;
 975         }
 976
 977         challenge = NULL;
 978         if (frm + 1 < efrm) {
 979                 if ((frm[1] + 2) > (efrm - frm)) {
 980                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 981                             ni->ni_macaddr, "shared key auth",
 982                             "ie %d/%d too long",
 983                             frm[0], (int)((frm[1] + 2) - (efrm - frm)));
 984                         vap->iv_stats.is_rx_bad_auth++;
 985                         estatus = IEEE80211_STATUS_CHALLENGE;
 986                         goto bad;
 987                 }
 988                 if (*frm == IEEE80211_ELEMID_CHALLENGE)
 989                         challenge = frm;
 990                 frm += frm[1] + 2;
 991         }
 992         switch (seq) {
 993         case IEEE80211_AUTH_SHARED_CHALLENGE:
 994         case IEEE80211_AUTH_SHARED_RESPONSE:
 995                 if (challenge == NULL) {
 996                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
 997                             ni->ni_macaddr, "shared key auth",
 998                             "%s", "no challenge");
 999                         vap->iv_stats.is_rx_bad_auth++;
1000                         estatus = IEEE80211_STATUS_CHALLENGE;
1001                         goto bad;
1002                 }
1003                 if (challenge[1] != IEEE80211_CHALLENGE_LEN) {
1004                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_AUTH,
1005                             ni->ni_macaddr, "shared key auth",
1006                             "bad challenge len %d", challenge[1]);
1007                         vap->iv_stats.is_rx_bad_auth++;
1008                         estatus = IEEE80211_STATUS_CHALLENGE;
1009                         goto bad;
1010                 }
1011         default:
1012                 break;
1013         }
1014         if (vap->iv_state != IEEE80211_S_AUTH)
1015                 return;
1016         switch (seq) {
1017         case IEEE80211_AUTH_SHARED_PASS:
1018                 if (ni->ni_challenge != NULL) {
1019                         kfree(ni->ni_challenge, M_80211_NODE);
1020                         ni->ni_challenge = NULL;
1021                 }
1022                 if (status != 0) {
1023                         IEEE80211_NOTE_FRAME(vap,
1024                             IEEE80211_MSG_DEBUG | IEEE80211_MSG_AUTH, wh,
1025                             "shared key auth failed (reason %d)", status);
1026                         vap->iv_stats.is_rx_auth_fail++;
1027                         vap->iv_stats.is_rx_authfail_code = status;
1028                         return;
1029                 }
1030                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1031                 break;
1032         case IEEE80211_AUTH_SHARED_CHALLENGE:
1033                 if (!ieee80211_alloc_challenge(ni))
1034                         return;
1035                 /* XXX could optimize by passing recvd challenge */
1036                 memcpy(ni->ni_challenge, &challenge[2], challenge[1]);
1037                 IEEE80211_SEND_MGMT(ni,
1038                         IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
1039                 break;
1040         default:
1041                 IEEE80211_DISCARD(vap, IEEE80211_MSG_AUTH,
1042                     wh, "shared key auth", "bad seq %d", seq);
1043                 vap->iv_stats.is_rx_bad_auth++;
1044                 return;
1045         }
1046         return;
1047 bad:
1048         /*
1049          * Kick the state machine.  This short-circuits
1050          * using the mgt frame timeout to trigger the
1051          * state transition.
1052          */
1053         if (vap->iv_state == IEEE80211_S_AUTH)
1054                 ieee80211_new_state(vap, IEEE80211_S_SCAN,
1055                     IEEE80211_SCAN_FAIL_STATUS);
1056 }
1057
1058 static int
1059 ieee80211_parse_wmeparams(struct ieee80211vap *vap, uint8_t *frm,
1060         const struct ieee80211_frame *wh)
1061 {
1062 #define MS(_v, _f)      (((_v) & _f) >> _f##_S)
1063         struct ieee80211_wme_state *wme = &vap->iv_ic->ic_wme;
1064         u_int len = frm[1], qosinfo;
1065         int i;
1066
1067         if (len < sizeof(struct ieee80211_wme_param)-2) {
1068                 IEEE80211_DISCARD_IE(vap,
1069                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_WME,
1070                     wh, "WME", "too short, len %u", len);
1071                 return -1;
1072         }
1073         qosinfo = frm[__offsetof(struct ieee80211_wme_param, param_qosInfo)];
1074         qosinfo &= WME_QOSINFO_COUNT;
1075         /* XXX do proper check for wraparound */
1076         if (qosinfo == wme->wme_wmeChanParams.cap_info)
1077                 return 0;
1078         frm += __offsetof(struct ieee80211_wme_param, params_acParams);
1079         for (i = 0; i < WME_NUM_AC; i++) {
1080                 struct wmeParams *wmep =
1081                         &wme->wme_wmeChanParams.cap_wmeParams[i];
1082                 /* NB: ACI not used */
1083                 wmep->wmep_acm = MS(frm[0], WME_PARAM_ACM);
1084                 wmep->wmep_aifsn = MS(frm[0], WME_PARAM_AIFSN);
1085                 wmep->wmep_logcwmin = MS(frm[1], WME_PARAM_LOGCWMIN);
1086                 wmep->wmep_logcwmax = MS(frm[1], WME_PARAM_LOGCWMAX);
1087                 wmep->wmep_txopLimit = LE_READ_2(frm+2);
1088                 frm += 4;
1089         }
1090         wme->wme_wmeChanParams.cap_info = qosinfo;
1091         return 1;
1092 #undef MS
1093 }
1094
1095 /*
1096  * Process 11h Channel Switch Announcement (CSA) ie.  If this
1097  * is the first CSA then initiate the switch.  Otherwise we
1098  * track state and trigger completion and/or cancel of the switch.
1099  * XXX should be public for IBSS use
1100  */
1101 static void
1102 ieee80211_parse_csaparams(struct ieee80211vap *vap, uint8_t *frm,
1103         const struct ieee80211_frame *wh)
1104 {
1105         struct ieee80211com *ic = vap->iv_ic;
1106         const struct ieee80211_csa_ie *csa =
1107             (const struct ieee80211_csa_ie *) frm;
1108
1109         KASSERT(vap->iv_state >= IEEE80211_S_RUN,
1110             ("state %s", ieee80211_state_name[vap->iv_state]));
1111
1112         if (csa->csa_mode > 1) {
1113                 IEEE80211_DISCARD_IE(vap,
1114                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1115                     wh, "CSA", "invalid mode %u", csa->csa_mode);
1116                 return;
1117         }
1118         if ((ic->ic_flags & IEEE80211_F_CSAPENDING) == 0) {
1119                 /*
1120                  * Convert the channel number to a channel reference.  We
1121                  * try first to preserve turbo attribute of the current
1122                  * channel then fallback.  Note this will not work if the
1123                  * CSA specifies a channel that requires a band switch (e.g.
1124                  * 11a => 11g).  This is intentional as 11h is defined only
1125                  * for 5GHz/11a and because the switch does not involve a
1126                  * reassociation, protocol state (capabilities, negotated
1127                  * rates, etc) may/will be wrong.
1128                  */
1129                 struct ieee80211_channel *c =
1130                     ieee80211_find_channel_byieee(ic, csa->csa_newchan,
1131                         (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALLTURBO));
1132                 if (c == NULL) {
1133                         c = ieee80211_find_channel_byieee(ic,
1134                             csa->csa_newchan,
1135                             (ic->ic_bsschan->ic_flags & IEEE80211_CHAN_ALL));
1136                         if (c == NULL) {
1137                                 IEEE80211_DISCARD_IE(vap,
1138                                     IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1139                                     wh, "CSA", "invalid channel %u",
1140                                     csa->csa_newchan);
1141                                 goto done;
1142                         }
1143                 }
1144 #if IEEE80211_CSA_COUNT_MIN > 0
1145                 if (csa->csa_count < IEEE80211_CSA_COUNT_MIN) {
1146                         /*
1147                          * Require at least IEEE80211_CSA_COUNT_MIN count to
1148                          * reduce the risk of being redirected by a fabricated
1149                          * CSA.  If a valid CSA is dropped we'll still get a
1150                          * beacon miss when the AP leaves the channel so we'll
1151                          * eventually follow to the new channel.
1152                          *
1153                          * NOTE: this violates the 11h spec that states that
1154                          * count may be any value and if 0 then a switch
1155                          * should happen asap.
1156                          */
1157                         IEEE80211_DISCARD_IE(vap,
1158                             IEEE80211_MSG_ELEMID | IEEE80211_MSG_DOTH,
1159                             wh, "CSA", "count %u too small, must be >= %u",
1160                             csa->csa_count, IEEE80211_CSA_COUNT_MIN);
1161                         goto done;
1162                 }
1163 #endif
1164                 ieee80211_csa_startswitch(ic, c, csa->csa_mode, csa->csa_count);
1165         } else {
1166                 /*
1167                  * Validate this ie against the initial CSA.  We require
1168                  * mode and channel not change and the count must be
1169                  * monotonically decreasing.  This may be pointless and
1170                  * canceling the switch as a result may be too paranoid but
1171                  * in the worst case if we drop out of CSA because of this
1172                  * and the AP does move then we'll just end up taking a
1173                  * beacon miss and scan to find the AP.
1174                  *
1175                  * XXX may want <= on count as we also process ProbeResp
1176                  * frames and those may come in w/ the same count as the
1177                  * previous beacon; but doing so leaves us open to a stuck
1178                  * count until we add a dead-man timer
1179                  */
1180                 if (!(csa->csa_count < ic->ic_csa_count &&
1181                       csa->csa_mode == ic->ic_csa_mode &&
1182                       csa->csa_newchan == ieee80211_chan2ieee(ic, ic->ic_csa_newchan))) {
1183                         IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_DOTH, wh,
1184                             "CSA ie mismatch, initial ie <%d,%d,%d>, "
1185                             "this ie <%d,%d,%d>", ic->ic_csa_mode,
1186                             ic->ic_csa_newchan->ic_ieee, ic->ic_csa_count,
1187                             csa->csa_mode, csa->csa_newchan, csa->csa_count);
1188                         ieee80211_csa_cancelswitch(ic);
1189                 } else {
1190                         if (csa->csa_count <= 1)
1191                                 ieee80211_csa_completeswitch(ic);
1192                         else
1193                                 ic->ic_csa_count = csa->csa_count;
1194                 }
1195         }
1196 done:
1197         ;
1198 }
1199
1200 /*
1201  * Return non-zero if a background scan may be continued:
1202  * o bg scan is active
1203  * o no channel switch is pending
1204  * o there has not been any traffic recently
1205  *
1206  * Note we do not check if there is an administrative enable;
1207  * this is only done to start the scan.  We assume that any
1208  * change in state will be accompanied by a request to cancel
1209  * active scans which will otherwise cause this test to fail.
1210  */
1211 static __inline int
1212 contbgscan(struct ieee80211vap *vap)
1213 {
1214         struct ieee80211com *ic = vap->iv_ic;
1215
1216         return ((ic->ic_flags_ext & IEEE80211_FEXT_BGSCAN) &&
1217             (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1218             vap->iv_state == IEEE80211_S_RUN &&         /* XXX? */
1219             time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1220 }
1221
1222 /*
1223  * Return non-zero if a backgrond scan may be started:
1224  * o bg scanning is administratively enabled
1225  * o no channel switch is pending
1226  * o we are not boosted on a dynamic turbo channel
1227  * o there has not been a scan recently
1228  * o there has not been any traffic recently
1229  */
1230 static __inline int
1231 startbgscan(struct ieee80211vap *vap)
1232 {
1233         struct ieee80211com *ic = vap->iv_ic;
1234
1235         return ((vap->iv_flags & IEEE80211_F_BGSCAN) &&
1236             (ic->ic_flags & IEEE80211_F_CSAPENDING) == 0 &&
1237 #ifdef IEEE80211_SUPPORT_SUPERG
1238             !IEEE80211_IS_CHAN_DTURBO(ic->ic_curchan) &&
1239 #endif
1240             time_after(ticks, ic->ic_lastscan + vap->iv_bgscanintvl) &&
1241             time_after(ticks, ic->ic_lastdata + vap->iv_bgscanidle));
1242 }
1243
1244 static void
1245 sta_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0,
1246         int subtype, int rssi, int nf)
1247 {
1248 #define ISPROBE(_st)    ((_st) == IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1249 #define ISREASSOC(_st)  ((_st) == IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1250         struct ieee80211vap *vap = ni->ni_vap;
1251         struct ieee80211com *ic = ni->ni_ic;
1252         struct ieee80211_frame *wh;
1253         uint8_t *frm, *efrm;
1254         uint8_t *rates, *xrates, *wme, *htcap, *htinfo;
1255         uint8_t rate;
1256
1257         wh = mtod(m0, struct ieee80211_frame *);
1258         frm = (uint8_t *)&wh[1];
1259         efrm = mtod(m0, uint8_t *) + m0->m_len;
1260         switch (subtype) {
1261         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1262         case IEEE80211_FC0_SUBTYPE_BEACON: {
1263                 struct ieee80211_scanparams scan;
1264                 /*
1265                  * We process beacon/probe response frames:
1266                  *    o when scanning, or
1267                  *    o station mode when associated (to collect state
1268                  *      updates such as 802.11g slot time)
1269                  * Frames otherwise received are discarded.
1270                  */
1271                 if (!((ic->ic_flags & IEEE80211_F_SCAN) || ni->ni_associd)) {
1272                         vap->iv_stats.is_rx_mgtdiscard++;
1273                         return;
1274                 }
1275                 /* XXX probe response in sta mode when !scanning? */
1276                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
1277                         return;
1278                 /*
1279                  * Count frame now that we know it's to be processed.
1280                  */
1281                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1282                         vap->iv_stats.is_rx_beacon++;           /* XXX remove */
1283                         IEEE80211_NODE_STAT(ni, rx_beacons);
1284                 } else
1285                         IEEE80211_NODE_STAT(ni, rx_proberesp);
1286                 /*
1287                  * When operating in station mode, check for state updates.
1288                  * Be careful to ignore beacons received while doing a
1289                  * background scan.  We consider only 11g/WMM stuff right now.
1290                  */
1291                 if (ni->ni_associd != 0 &&
1292                     ((ic->ic_flags & IEEE80211_F_SCAN) == 0 ||
1293                      IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid))) {
1294                         /* record tsf of last beacon */
1295                         memcpy(ni->ni_tstamp.data, scan.tstamp,
1296                                 sizeof(ni->ni_tstamp));
1297                         /* count beacon frame for s/w bmiss handling */
1298                         vap->iv_swbmiss_count++;
1299                         vap->iv_bmiss_count = 0;
1300                         if (ni->ni_erp != scan.erp) {
1301                                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1302                                     wh->i_addr2,
1303                                     "erp change: was 0x%x, now 0x%x",
1304                                     ni->ni_erp, scan.erp);
1305                                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1306                                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1307                                         ic->ic_flags |= IEEE80211_F_USEPROT;
1308                                 else
1309                                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
1310                                 ni->ni_erp = scan.erp;
1311                                 /* XXX statistic */
1312                                 /* XXX driver notification */
1313                         }
1314                         if ((ni->ni_capinfo ^ scan.capinfo) & IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1315                                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1316                                     wh->i_addr2,
1317                                     "capabilities change: was 0x%x, now 0x%x",
1318                                     ni->ni_capinfo, scan.capinfo);
1319                                 /*
1320                                  * NB: we assume short preamble doesn't
1321                                  *     change dynamically
1322                                  */
1323                                 ieee80211_set_shortslottime(ic,
1324                                         IEEE80211_IS_CHAN_A(ic->ic_bsschan) ||
1325                                         (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1326                                 ni->ni_capinfo = (ni->ni_capinfo &~ IEEE80211_CAPINFO_SHORT_SLOTTIME)
1327                                                | (scan.capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME);
1328                                 /* XXX statistic */
1329                         }
1330                         if (scan.wme != NULL &&
1331                             (ni->ni_flags & IEEE80211_NODE_QOS) &&
1332                             ieee80211_parse_wmeparams(vap, scan.wme, wh) > 0)
1333                                 ieee80211_wme_updateparams(vap);
1334 #ifdef IEEE80211_SUPPORT_SUPERG
1335                         if (scan.ath != NULL)
1336                                 ieee80211_parse_athparams(ni, scan.ath, wh);
1337 #endif
1338                         if (scan.htcap != NULL && scan.htinfo != NULL &&
1339                             (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1340                                 ieee80211_ht_updateparams(ni,
1341                                     scan.htcap, scan.htinfo);
1342                                 /* XXX state changes? */
1343                         }
1344                         if (scan.tim != NULL) {
1345                                 struct ieee80211_tim_ie *tim =
1346                                     (struct ieee80211_tim_ie *) scan.tim;
1347 #if 0
1348                                 int aid = IEEE80211_AID(ni->ni_associd);
1349                                 int ix = aid / NBBY;
1350                                 int min = tim->tim_bitctl &~ 1;
1351                                 int max = tim->tim_len + min - 4;
1352                                 if ((tim->tim_bitctl&1) ||
1353                                     (min <= ix && ix <= max &&
1354                                      isset(tim->tim_bitmap - min, aid))) {
1355                                         /*
1356                                          * XXX Do not let bg scan kick off
1357                                          * we are expecting data.
1358                                          */
1359                                         ic->ic_lastdata = ticks;
1360                                         ieee80211_sta_pwrsave(vap, 0);
1361                                 }
1362 #endif
1363                                 ni->ni_dtim_count = tim->tim_count;
1364                                 ni->ni_dtim_period = tim->tim_period;
1365                         }
1366                         if (scan.csa != NULL &&
1367                             (vap->iv_flags & IEEE80211_F_DOTH))
1368                                 ieee80211_parse_csaparams(vap, scan.csa, wh);
1369                         else if (ic->ic_flags & IEEE80211_F_CSAPENDING) {
1370                                 /*
1371                                  * No CSA ie or 11h disabled, but a channel
1372                                  * switch is pending; drop out so we aren't
1373                                  * stuck in CSA state.  If the AP really is
1374                                  * moving we'll get a beacon miss and scan.
1375                                  */
1376                                 ieee80211_csa_cancelswitch(ic);
1377                         }
1378                         /*
1379                          * If scanning, pass the info to the scan module.
1380                          * Otherwise, check if it's the right time to do
1381                          * a background scan.  Background scanning must
1382                          * be enabled and we must not be operating in the
1383                          * turbo phase of dynamic turbo mode.  Then,
1384                          * it's been a while since the last background
1385                          * scan and if no data frames have come through
1386                          * recently, kick off a scan.  Note that this
1387                          * is the mechanism by which a background scan
1388                          * is started _and_ continued each time we
1389                          * return on-channel to receive a beacon from
1390                          * our ap.
1391                          */
1392                         if (ic->ic_flags & IEEE80211_F_SCAN) {
1393                                 ieee80211_add_scan(vap, &scan, wh,
1394                                         subtype, rssi, nf);
1395                         } else if (contbgscan(vap)) {
1396                                 ieee80211_bg_scan(vap, 0);
1397                         } else if (startbgscan(vap)) {
1398                                 vap->iv_stats.is_scan_bg++;
1399 #if 0
1400                                 /* wakeup if we are sleeing */
1401                                 ieee80211_set_pwrsave(vap, 0);
1402 #endif
1403                                 ieee80211_bg_scan(vap, 0);
1404                         }
1405                         return;
1406                 }
1407                 /*
1408                  * If scanning, just pass information to the scan module.
1409                  */
1410                 if (ic->ic_flags & IEEE80211_F_SCAN) {
1411                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1412                                 /*
1413                                  * Actively scanning a channel marked passive;
1414                                  * send a probe request now that we know there
1415                                  * is 802.11 traffic present.
1416                                  *
1417                                  * XXX check if the beacon we recv'd gives
1418                                  * us what we need and suppress the probe req
1419                                  */
1420                                 ieee80211_probe_curchan(vap, 1);
1421                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1422                         }
1423                         ieee80211_add_scan(vap, &scan, wh, subtype, rssi, nf);
1424                         return;
1425                 }
1426                 break;
1427         }
1428
1429         case IEEE80211_FC0_SUBTYPE_AUTH: {
1430                 uint16_t algo, seq, status;
1431                 /*
1432                  * auth frame format
1433                  *      [2] algorithm
1434                  *      [2] sequence
1435                  *      [2] status
1436                  *      [tlv*] challenge
1437                  */
1438                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1439                 algo   = le16toh(*(uint16_t *)frm);
1440                 seq    = le16toh(*(uint16_t *)(frm + 2));
1441                 status = le16toh(*(uint16_t *)(frm + 4));
1442                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_AUTH, wh->i_addr2,
1443                     "recv auth frame with algorithm %d seq %d", algo, seq);
1444
1445                 if (vap->iv_flags & IEEE80211_F_COUNTERM) {
1446                         IEEE80211_DISCARD(vap,
1447                             IEEE80211_MSG_AUTH | IEEE80211_MSG_CRYPTO,
1448                             wh, "auth", "%s", "TKIP countermeasures enabled");
1449                         vap->iv_stats.is_rx_auth_countermeasures++;
1450                         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
1451                                 ieee80211_send_error(ni, wh->i_addr2,
1452                                         IEEE80211_FC0_SUBTYPE_AUTH,
1453                                         IEEE80211_REASON_MIC_FAILURE);
1454                         }
1455                         return;
1456                 }
1457                 if (algo == IEEE80211_AUTH_ALG_SHARED)
1458                         sta_auth_shared(ni, wh, frm + 6, efrm, rssi, nf,
1459                             seq, status);
1460                 else if (algo == IEEE80211_AUTH_ALG_OPEN)
1461                         sta_auth_open(ni, wh, rssi, nf, seq, status);
1462                 else {
1463                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1464                             wh, "auth", "unsupported alg %d", algo);
1465                         vap->iv_stats.is_rx_auth_unsupported++;
1466                         return;
1467                 }
1468                 break;
1469         }
1470
1471         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1472         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP: {
1473                 uint16_t capinfo, associd;
1474                 uint16_t status;
1475
1476                 if (vap->iv_state != IEEE80211_S_ASSOC) {
1477                         vap->iv_stats.is_rx_mgtdiscard++;
1478                         return;
1479                 }
1480
1481                 /*
1482                  * asresp frame format
1483                  *      [2] capability information
1484                  *      [2] status
1485                  *      [2] association ID
1486                  *      [tlv] supported rates
1487                  *      [tlv] extended supported rates
1488                  *      [tlv] WME
1489                  *      [tlv] HT capabilities
1490                  *      [tlv] HT info
1491                  */
1492                 IEEE80211_VERIFY_LENGTH(efrm - frm, 6, return);
1493                 ni = vap->iv_bss;
1494                 capinfo = le16toh(*(uint16_t *)frm);
1495                 frm += 2;
1496                 status = le16toh(*(uint16_t *)frm);
1497                 frm += 2;
1498                 if (status != 0) {
1499                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1500                             wh->i_addr2, "%sassoc failed (reason %d)",
1501                             ISREASSOC(subtype) ?  "re" : "", status);
1502                         vap->iv_stats.is_rx_auth_fail++;        /* XXX */
1503                         return;
1504                 }
1505                 associd = le16toh(*(uint16_t *)frm);
1506                 frm += 2;
1507
1508                 rates = xrates = wme = htcap = htinfo = NULL;
1509                 while (efrm - frm > 1) {
1510                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1511                         switch (*frm) {
1512                         case IEEE80211_ELEMID_RATES:
1513                                 rates = frm;
1514                                 break;
1515                         case IEEE80211_ELEMID_XRATES:
1516                                 xrates = frm;
1517                                 break;
1518                         case IEEE80211_ELEMID_HTCAP:
1519                                 htcap = frm;
1520                                 break;
1521                         case IEEE80211_ELEMID_HTINFO:
1522                                 htinfo = frm;
1523                                 break;
1524                         case IEEE80211_ELEMID_VENDOR:
1525                                 if (iswmeoui(frm))
1526                                         wme = frm;
1527                                 else if (vap->iv_flags_ht & IEEE80211_FHT_HTCOMPAT) {
1528                                         /*
1529                                          * Accept pre-draft HT ie's if the
1530                                          * standard ones have not been seen.
1531                                          */
1532                                         if (ishtcapoui(frm)) {
1533                                                 if (htcap == NULL)
1534                                                         htcap = frm;
1535                                         } else if (ishtinfooui(frm)) {
1536                                                 if (htinfo == NULL)
1537                                                         htcap = frm;
1538                                         }
1539                                 }
1540                                 /* XXX Atheros OUI support */
1541                                 break;
1542                         }
1543                         frm += frm[1] + 2;
1544                 }
1545
1546                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1547                 if (xrates != NULL)
1548                         IEEE80211_VERIFY_ELEMENT(xrates,
1549                                 IEEE80211_RATE_MAXSIZE - rates[1], return);
1550                 rate = ieee80211_setup_rates(ni, rates, xrates,
1551                                 IEEE80211_F_JOIN |
1552                                 IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE |
1553                                 IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
1554                 if (rate & IEEE80211_RATE_BASIC) {
1555                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_ASSOC,
1556                             wh->i_addr2,
1557                             "%sassoc failed (rate set mismatch)",
1558                             ISREASSOC(subtype) ?  "re" : "");
1559                         vap->iv_stats.is_rx_assoc_norate++;
1560                         ieee80211_new_state(vap, IEEE80211_S_SCAN,
1561                             IEEE80211_SCAN_FAIL_STATUS);
1562                         return;
1563                 }
1564
1565                 ni->ni_capinfo = capinfo;
1566                 ni->ni_associd = associd;
1567                 if (ni->ni_jointime == 0)
1568                         ni->ni_jointime = time_second;
1569                 if (wme != NULL &&
1570                     ieee80211_parse_wmeparams(vap, wme, wh) >= 0) {
1571                         ni->ni_flags |= IEEE80211_NODE_QOS;
1572                         ieee80211_wme_updateparams(vap);
1573                 } else
1574                         ni->ni_flags &= ~IEEE80211_NODE_QOS;
1575                 /*
1576                  * Setup HT state according to the negotiation.
1577                  *
1578                  * NB: shouldn't need to check if HT use is enabled but some
1579                  *     ap's send back HT ie's even when we don't indicate we
1580                  *     are HT capable in our AssocReq.
1581                  */
1582                 if (htcap != NULL && htinfo != NULL &&
1583                     (vap->iv_flags_ht & IEEE80211_FHT_HT)) {
1584                         ieee80211_ht_node_init(ni);
1585                         ieee80211_ht_updateparams(ni, htcap, htinfo);
1586                         ieee80211_setup_htrates(ni, htcap,
1587                              IEEE80211_F_JOIN | IEEE80211_F_DOBRS);
1588                         ieee80211_setup_basic_htrates(ni, htinfo);
1589                         ieee80211_node_setuptxparms(ni);
1590                 } else {
1591 #ifdef IEEE80211_SUPPORT_SUPERG
1592                         if (IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_ATH))
1593                                 ieee80211_ff_node_init(ni);
1594 #endif
1595                 }
1596                 /*
1597                  * Configure state now that we are associated.
1598                  *
1599                  * XXX may need different/additional driver callbacks?
1600                  */
1601                 if (IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1602                     (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE)) {
1603                         ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1604                         ic->ic_flags &= ~IEEE80211_F_USEBARKER;
1605                 } else {
1606                         ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1607                         ic->ic_flags |= IEEE80211_F_USEBARKER;
1608                 }
1609                 ieee80211_set_shortslottime(ic,
1610                         IEEE80211_IS_CHAN_A(ic->ic_curchan) ||
1611                         (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1612                 /*
1613                  * Honor ERP protection.
1614                  *
1615                  * NB: ni_erp should zero for non-11g operation.
1616                  */
1617                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan) &&
1618                     (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1619                         ic->ic_flags |= IEEE80211_F_USEPROT;
1620                 else
1621                         ic->ic_flags &= ~IEEE80211_F_USEPROT;
1622                 IEEE80211_NOTE_MAC(vap,
1623                     IEEE80211_MSG_ASSOC | IEEE80211_MSG_DEBUG, wh->i_addr2,
1624                     "%sassoc success at aid %d: %s preamble, %s slot time%s%s%s%s%s%s%s%s",
1625                     ISREASSOC(subtype) ? "re" : "",
1626                     IEEE80211_NODE_AID(ni),
1627                     ic->ic_flags&IEEE80211_F_SHPREAMBLE ? "short" : "long",
1628                     ic->ic_flags&IEEE80211_F_SHSLOT ? "short" : "long",
1629                     ic->ic_flags&IEEE80211_F_USEPROT ? ", protection" : "",
1630                     ni->ni_flags & IEEE80211_NODE_QOS ? ", QoS" : "",
1631                     ni->ni_flags & IEEE80211_NODE_HT ?
1632                         (ni->ni_chw == 40 ? ", HT40" : ", HT20") : "",
1633                     ni->ni_flags & IEEE80211_NODE_AMPDU ? " (+AMPDU)" : "",
1634                     ni->ni_flags & IEEE80211_NODE_MIMO_RTS ? " (+SMPS-DYN)" :
1635                         ni->ni_flags & IEEE80211_NODE_MIMO_PS ? " (+SMPS)" : "",
1636                     ni->ni_flags & IEEE80211_NODE_RIFS ? " (+RIFS)" : "",
1637                     IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_FF) ?
1638                         ", fast-frames" : "",
1639                     IEEE80211_ATH_CAP(vap, ni, IEEE80211_NODE_TURBOP) ?
1640                         ", turbo" : ""
1641                 );
1642                 ieee80211_new_state(vap, IEEE80211_S_RUN, subtype);
1643                 break;
1644         }
1645
1646         case IEEE80211_FC0_SUBTYPE_DEAUTH: {
1647                 uint16_t reason;
1648
1649                 if (vap->iv_state == IEEE80211_S_SCAN) {
1650                         vap->iv_stats.is_rx_mgtdiscard++;
1651                         return;
1652                 }
1653                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1654                         /* NB: can happen when in promiscuous mode */
1655                         vap->iv_stats.is_rx_mgtdiscard++;
1656                         break;
1657                 }
1658
1659                 /*
1660                  * deauth frame format
1661                  *      [2] reason
1662                  */
1663                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1664                 reason = le16toh(*(uint16_t *)frm);
1665
1666                 vap->iv_stats.is_rx_deauth++;
1667                 vap->iv_stats.is_rx_deauth_code = reason;
1668                 IEEE80211_NODE_STAT(ni, rx_deauth);
1669
1670                 IEEE80211_NOTE(vap, IEEE80211_MSG_AUTH, ni,
1671                     "recv deauthenticate (reason %d)", reason);
1672                 ieee80211_new_state(vap, IEEE80211_S_AUTH,
1673                     (reason << 8) | IEEE80211_FC0_SUBTYPE_DEAUTH);
1674                 break;
1675         }
1676
1677         case IEEE80211_FC0_SUBTYPE_DISASSOC: {
1678                 uint16_t reason;
1679
1680                 if (vap->iv_state != IEEE80211_S_RUN &&
1681                     vap->iv_state != IEEE80211_S_ASSOC &&
1682                     vap->iv_state != IEEE80211_S_AUTH) {
1683                         vap->iv_stats.is_rx_mgtdiscard++;
1684                         return;
1685                 }
1686                 if (!IEEE80211_ADDR_EQ(wh->i_addr1, vap->iv_myaddr)) {
1687                         /* NB: can happen when in promiscuous mode */
1688                         vap->iv_stats.is_rx_mgtdiscard++;
1689                         break;
1690                 }
1691
1692                 /*
1693                  * disassoc frame format
1694                  *      [2] reason
1695                  */
1696                 IEEE80211_VERIFY_LENGTH(efrm - frm, 2, return);
1697                 reason = le16toh(*(uint16_t *)frm);
1698
1699                 vap->iv_stats.is_rx_disassoc++;
1700                 vap->iv_stats.is_rx_disassoc_code = reason;
1701                 IEEE80211_NODE_STAT(ni, rx_disassoc);
1702
1703                 IEEE80211_NOTE(vap, IEEE80211_MSG_ASSOC, ni,
1704                     "recv disassociate (reason %d)", reason);
1705                 ieee80211_new_state(vap, IEEE80211_S_ASSOC, 0);
1706                 break;
1707         }
1708
1709         case IEEE80211_FC0_SUBTYPE_ACTION:
1710                 if (vap->iv_state == IEEE80211_S_RUN) {
1711                         if (ieee80211_parse_action(ni, m0) == 0)
1712                                 ic->ic_recv_action(ni, wh, frm, efrm);
1713                 } else
1714                         vap->iv_stats.is_rx_mgtdiscard++;
1715                 break;
1716
1717         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1718         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1719         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1720                 vap->iv_stats.is_rx_mgtdiscard++;
1721                 return;
1722         default:
1723                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1724                      wh, "mgt", "subtype 0x%x not handled", subtype);
1725                 vap->iv_stats.is_rx_badsubtype++;
1726                 break;
1727         }
1728 #undef ISREASSOC
1729 #undef ISPROBE
1730 }
1731
1732 static void
1733 sta_recv_ctl(struct ieee80211_node *ni, struct mbuf *m0, int subtype)
1734 {
1735 }