sys/netproto/802_11/wlan/ieee80211_mesh.c

   1 /*-
   2  * Copyright (c) 2009 The FreeBSD Foundation
   3  * All rights reserved.
   4  *
   5  * This software was developed by Rui Paulo under sponsorship from the
   6  * FreeBSD Foundation.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  *
  17  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27  * SUCH DAMAGE.
  28  *
  29  * $FreeBSD: head/sys/net80211/ieee80211_mesh.c 203423 2010-02-03 10:12:49Z rpaulo $
  30  * $DragonFly$
  31  */
  32
  33 /*
  34  * IEEE 802.11s Mesh Point (MBSS) support.
  35  *
  36  * Based on March 2009, D3.0 802.11s draft spec.
  37  */
  38 #include "opt_inet.h"
  39 #include "opt_wlan.h"
  40
  41 #include <sys/param.h>
  42 #include <sys/systm.h>
  43 #include <sys/mbuf.h>
  44 #include <sys/malloc.h>
  45 #include <sys/kernel.h>
  46
  47 #include <sys/socket.h>
  48 #include <sys/sockio.h>
  49 #include <sys/endian.h>
  50 #include <sys/errno.h>
  51 #include <sys/proc.h>
  52 #include <sys/sysctl.h>
  53
  54 #include <net/if.h>
  55 #include <net/if_media.h>
  56 #include <net/if_llc.h>
  57 #include <net/ethernet.h>
  58 #include <net/route.h>
  59
  60 #include <netproto/802_11/ieee80211_var.h>
  61 #include <netproto/802_11/ieee80211_action.h>
  62 #include <netproto/802_11/ieee80211_input.h>
  63 #include <netproto/802_11/ieee80211_mesh.h>
  64
  65 static void     mesh_rt_flush_invalid(struct ieee80211vap *);
  66 static int      mesh_select_proto_path(struct ieee80211vap *, const char *);
  67 static int      mesh_select_proto_metric(struct ieee80211vap *, const char *);
  68 static void     mesh_vattach(struct ieee80211vap *);
  69 static int      mesh_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  70 static void     mesh_rt_cleanup_callout(void *);
  71 static void     mesh_linkchange(struct ieee80211_node *,
  72                     enum ieee80211_mesh_mlstate);
  73 static void     mesh_checkid(void *, struct ieee80211_node *);
  74 static uint32_t mesh_generateid(struct ieee80211vap *);
  75 static int      mesh_checkpseq(struct ieee80211vap *,
  76                     const uint8_t [IEEE80211_ADDR_LEN], uint32_t);
  77 static struct ieee80211_node *
  78                 mesh_find_txnode(struct ieee80211vap *,
  79                     const uint8_t [IEEE80211_ADDR_LEN]);
  80 static void     mesh_forward(struct ieee80211vap *, struct mbuf *,
  81                     const struct ieee80211_meshcntl *);
  82 static int      mesh_input(struct ieee80211_node *, struct mbuf *, int, int);
  83 static void     mesh_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
  84                     int, int);
  85 static void     mesh_peer_timeout_setup(struct ieee80211_node *);
  86 static void     mesh_peer_timeout_backoff(struct ieee80211_node *);
  87 static void     mesh_peer_timeout_callout(void *);
  88 static __inline void
  89                 mesh_peer_timeout_stop(struct ieee80211_node *);
  90 static int      mesh_verify_meshid(struct ieee80211vap *, const uint8_t *);
  91 static int      mesh_verify_meshconf(struct ieee80211vap *, const uint8_t *);
  92 static int      mesh_verify_meshpeer(struct ieee80211vap *, uint8_t,
  93                     const uint8_t *);
  94 uint32_t        mesh_airtime_calc(struct ieee80211_node *);
  95
  96 /*
  97  * Timeout values come from the specification and are in milliseconds.
  98  */
  99 SYSCTL_NODE(_net_wlan, OID_AUTO, mesh, CTLFLAG_RD, 0,
 100     "IEEE 802.11s parameters");
 101 static int ieee80211_mesh_retrytimeout = -1;
 102 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, retrytimeout, CTLTYPE_INT | CTLFLAG_RW,
 103     &ieee80211_mesh_retrytimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
 104     "Retry timeout (msec)");
 105 static int ieee80211_mesh_holdingtimeout = -1;
 106 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, holdingtimeout, CTLTYPE_INT | CTLFLAG_RW,
 107     &ieee80211_mesh_holdingtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
 108     "Holding state timeout (msec)");
 109 static int ieee80211_mesh_confirmtimeout = -1;
 110 SYSCTL_PROC(_net_wlan_mesh, OID_AUTO, confirmtimeout, CTLTYPE_INT | CTLFLAG_RW,
 111     &ieee80211_mesh_confirmtimeout, 0, ieee80211_sysctl_msecs_ticks, "I",
 112     "Confirm state timeout (msec)");
 113 static int ieee80211_mesh_maxretries = 2;
 114 SYSCTL_INT(_net_wlan_mesh, OID_AUTO, maxretries, CTLTYPE_INT | CTLFLAG_RW,
 115     &ieee80211_mesh_maxretries, 0,
 116     "Maximum retries during peer link establishment");
 117
 118 static const uint8_t broadcastaddr[IEEE80211_ADDR_LEN] =
 119         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 120
 121 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_open;
 122 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_confirm;
 123 static  ieee80211_recv_action_func mesh_recv_action_meshpeering_close;
 124 static  ieee80211_recv_action_func mesh_recv_action_meshlmetric_req;
 125 static  ieee80211_recv_action_func mesh_recv_action_meshlmetric_rep;
 126
 127 static  ieee80211_send_action_func mesh_send_action_meshpeering_open;
 128 static  ieee80211_send_action_func mesh_send_action_meshpeering_confirm;
 129 static  ieee80211_send_action_func mesh_send_action_meshpeering_close;
 130 static  ieee80211_send_action_func mesh_send_action_meshlink_request;
 131 static  ieee80211_send_action_func mesh_send_action_meshlink_reply;
 132
 133 static const struct ieee80211_mesh_proto_metric mesh_metric_airtime = {
 134         .mpm_descr      = "AIRTIME",
 135         .mpm_ie         = IEEE80211_MESHCONF_METRIC_AIRTIME,
 136         .mpm_metric     = mesh_airtime_calc,
 137 };
 138
 139 static struct ieee80211_mesh_proto_path         mesh_proto_paths[4];
 140 static struct ieee80211_mesh_proto_metric       mesh_proto_metrics[4];
 141
 142 MALLOC_DEFINE(M_80211_MESH_RT, "80211mesh", "802.11s routing table");
 143
 144 /*
 145  * Helper functions to manipulate the Mesh routing table.
 146  */
 147
 148 static struct ieee80211_mesh_route *
 149 mesh_rt_find_locked(struct ieee80211_mesh_state *ms,
 150     const uint8_t dest[IEEE80211_ADDR_LEN])
 151 {
 152         struct ieee80211_mesh_route *rt;
 153
 154         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
 155                 if (IEEE80211_ADDR_EQ(dest, rt->rt_dest))
 156                         return rt;
 157         }
 158         return NULL;
 159 }
 160
 161 static struct ieee80211_mesh_route *
 162 mesh_rt_add_locked(struct ieee80211_mesh_state *ms,
 163     const uint8_t dest[IEEE80211_ADDR_LEN])
 164 {
 165         struct ieee80211_mesh_route *rt;
 166
 167         KASSERT(!IEEE80211_ADDR_EQ(broadcastaddr, dest),
 168             ("%s: adding broadcast to the routing table", __func__));
 169
 170         rt = kmalloc(ALIGN(sizeof(struct ieee80211_mesh_route)) +
 171             ms->ms_ppath->mpp_privlen, M_80211_MESH_RT, M_INTWAIT | M_ZERO);
 172         if (rt != NULL) {
 173                 IEEE80211_ADDR_COPY(rt->rt_dest, dest);
 174                 rt->rt_priv = (void *)ALIGN(&rt[1]);
 175                 rt->rt_crtime = ticks;
 176                 TAILQ_INSERT_TAIL(&ms->ms_routes, rt, rt_next);
 177         }
 178         return rt;
 179 }
 180
 181 struct ieee80211_mesh_route *
 182 ieee80211_mesh_rt_find(struct ieee80211vap *vap,
 183     const uint8_t dest[IEEE80211_ADDR_LEN])
 184 {
 185         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 186         struct ieee80211_mesh_route *rt;
 187
 188         rt = mesh_rt_find_locked(ms, dest);
 189         return rt;
 190 }
 191
 192 struct ieee80211_mesh_route *
 193 ieee80211_mesh_rt_add(struct ieee80211vap *vap,
 194     const uint8_t dest[IEEE80211_ADDR_LEN])
 195 {
 196         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 197         struct ieee80211_mesh_route *rt;
 198
 199         KASSERT(ieee80211_mesh_rt_find(vap, dest) == NULL,
 200             ("%s: duplicate entry in the routing table", __func__));
 201         KASSERT(!IEEE80211_ADDR_EQ(vap->iv_myaddr, dest),
 202             ("%s: adding self to the routing table", __func__));
 203
 204         rt = mesh_rt_add_locked(ms, dest);
 205         return rt;
 206 }
 207
 208 /*
 209  * Add a proxy route (as needed) for the specified destination.
 210  */
 211 void
 212 ieee80211_mesh_proxy_check(struct ieee80211vap *vap,
 213     const uint8_t dest[IEEE80211_ADDR_LEN])
 214 {
 215         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 216         struct ieee80211_mesh_route *rt;
 217
 218         rt = mesh_rt_find_locked(ms, dest);
 219         if (rt == NULL) {
 220                 rt = mesh_rt_add_locked(ms, dest);
 221                 if (rt == NULL) {
 222                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
 223                             "%s", "unable to add proxy entry");
 224                         vap->iv_stats.is_mesh_rtaddfailed++;
 225                 } else {
 226                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
 227                             "%s", "add proxy entry");
 228                         IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
 229                         rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
 230                                      |  IEEE80211_MESHRT_FLAGS_PROXY;
 231                 }
 232         /* XXX assert PROXY? */
 233         } else if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0) {
 234                 struct ieee80211com *ic = vap->iv_ic;
 235                 /*
 236                  * Fix existing entry created by received frames from
 237                  * stations that have some memory of dest.  We also
 238                  * flush any frames held on the staging queue; delivering
 239                  * them is too much trouble right now.
 240                  */
 241                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
 242                     "%s", "fix proxy entry");
 243                 IEEE80211_ADDR_COPY(rt->rt_nexthop, vap->iv_myaddr);
 244                 rt->rt_flags |= IEEE80211_MESHRT_FLAGS_VALID
 245                              |  IEEE80211_MESHRT_FLAGS_PROXY;
 246                 /* XXX belongs in hwmp */
 247                 ieee80211_ageq_drain_node(&ic->ic_stageq,
 248                    (void *)(uintptr_t) ieee80211_mac_hash(ic, dest));
 249                 /* XXX stat? */
 250         }
 251 }
 252
 253 static __inline void
 254 mesh_rt_del(struct ieee80211_mesh_state *ms, struct ieee80211_mesh_route *rt)
 255 {
 256         TAILQ_REMOVE(&ms->ms_routes, rt, rt_next);
 257         kfree(rt, M_80211_MESH_RT);
 258 }
 259
 260 void
 261 ieee80211_mesh_rt_del(struct ieee80211vap *vap,
 262     const uint8_t dest[IEEE80211_ADDR_LEN])
 263 {
 264         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 265         struct ieee80211_mesh_route *rt, *next;
 266
 267         TAILQ_FOREACH_MUTABLE(rt, &ms->ms_routes, rt_next, next) {
 268                 if (IEEE80211_ADDR_EQ(rt->rt_dest, dest)) {
 269                         mesh_rt_del(ms, rt);
 270                         return;
 271                 }
 272         }
 273 }
 274
 275 void
 276 ieee80211_mesh_rt_flush(struct ieee80211vap *vap)
 277 {
 278         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 279         struct ieee80211_mesh_route *rt, *next;
 280
 281         if (ms == NULL)
 282                 return;
 283         TAILQ_FOREACH_MUTABLE(rt, &ms->ms_routes, rt_next, next)
 284                 mesh_rt_del(ms, rt);
 285 }
 286
 287 void
 288 ieee80211_mesh_rt_flush_peer(struct ieee80211vap *vap,
 289     const uint8_t peer[IEEE80211_ADDR_LEN])
 290 {
 291         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 292         struct ieee80211_mesh_route *rt, *next;
 293
 294         TAILQ_FOREACH_MUTABLE(rt, &ms->ms_routes, rt_next, next) {
 295                 if (IEEE80211_ADDR_EQ(rt->rt_nexthop, peer))
 296                         mesh_rt_del(ms, rt);
 297         }
 298 }
 299
 300 /*
 301  * Flush expired routing entries, i.e. those in invalid state for
 302  * some time.
 303  */
 304 static void
 305 mesh_rt_flush_invalid(struct ieee80211vap *vap)
 306 {
 307         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 308         struct ieee80211_mesh_route *rt, *next;
 309
 310         if (ms == NULL)
 311                 return;
 312         TAILQ_FOREACH_MUTABLE(rt, &ms->ms_routes, rt_next, next) {
 313                 if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 &&
 314                     ticks - rt->rt_crtime >= ms->ms_ppath->mpp_inact)
 315                         mesh_rt_del(ms, rt);
 316         }
 317 }
 318
 319 #define N(a)    (sizeof(a) / sizeof(a[0]))
 320 int
 321 ieee80211_mesh_register_proto_path(const struct ieee80211_mesh_proto_path *mpp)
 322 {
 323         int i, firstempty = -1;
 324
 325         for (i = 0; i < N(mesh_proto_paths); i++) {
 326                 if (strncmp(mpp->mpp_descr, mesh_proto_paths[i].mpp_descr,
 327                     IEEE80211_MESH_PROTO_DSZ) == 0)
 328                         return EEXIST;
 329                 if (!mesh_proto_paths[i].mpp_active && firstempty == -1)
 330                         firstempty = i;
 331         }
 332         if (firstempty < 0)
 333                 return ENOSPC;
 334         memcpy(&mesh_proto_paths[firstempty], mpp, sizeof(*mpp));
 335         mesh_proto_paths[firstempty].mpp_active = 1;
 336         return 0;
 337 }
 338
 339 int
 340 ieee80211_mesh_register_proto_metric(const struct
 341     ieee80211_mesh_proto_metric *mpm)
 342 {
 343         int i, firstempty = -1;
 344
 345         for (i = 0; i < N(mesh_proto_metrics); i++) {
 346                 if (strncmp(mpm->mpm_descr, mesh_proto_metrics[i].mpm_descr,
 347                     IEEE80211_MESH_PROTO_DSZ) == 0)
 348                         return EEXIST;
 349                 if (!mesh_proto_metrics[i].mpm_active && firstempty == -1)
 350                         firstempty = i;
 351         }
 352         if (firstempty < 0)
 353                 return ENOSPC;
 354         memcpy(&mesh_proto_metrics[firstempty], mpm, sizeof(*mpm));
 355         mesh_proto_metrics[firstempty].mpm_active = 1;
 356         return 0;
 357 }
 358
 359 static int
 360 mesh_select_proto_path(struct ieee80211vap *vap, const char *name)
 361 {
 362         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 363         int i;
 364
 365         for (i = 0; i < N(mesh_proto_paths); i++) {
 366                 if (strcasecmp(mesh_proto_paths[i].mpp_descr, name) == 0) {
 367                         ms->ms_ppath = &mesh_proto_paths[i];
 368                         return 0;
 369                 }
 370         }
 371         return ENOENT;
 372 }
 373
 374 static int
 375 mesh_select_proto_metric(struct ieee80211vap *vap, const char *name)
 376 {
 377         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 378         int i;
 379
 380         for (i = 0; i < N(mesh_proto_metrics); i++) {
 381                 if (strcasecmp(mesh_proto_metrics[i].mpm_descr, name) == 0) {
 382                         ms->ms_pmetric = &mesh_proto_metrics[i];
 383                         return 0;
 384                 }
 385         }
 386         return ENOENT;
 387 }
 388 #undef  N
 389
 390 static void
 391 ieee80211_mesh_init(void)
 392 {
 393
 394         memset(mesh_proto_paths, 0, sizeof(mesh_proto_paths));
 395         memset(mesh_proto_metrics, 0, sizeof(mesh_proto_metrics));
 396
 397         /*
 398          * Setup mesh parameters that depends on the clock frequency.
 399          */
 400         ieee80211_mesh_retrytimeout = msecs_to_ticks(40);
 401         ieee80211_mesh_holdingtimeout = msecs_to_ticks(40);
 402         ieee80211_mesh_confirmtimeout = msecs_to_ticks(40);
 403
 404         /*
 405          * Register action frame handlers.
 406          */
 407         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 408             IEEE80211_ACTION_MESHPEERING_OPEN,
 409             mesh_recv_action_meshpeering_open);
 410         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 411             IEEE80211_ACTION_MESHPEERING_CONFIRM,
 412             mesh_recv_action_meshpeering_confirm);
 413         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 414             IEEE80211_ACTION_MESHPEERING_CLOSE,
 415             mesh_recv_action_meshpeering_close);
 416         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
 417             IEEE80211_ACTION_MESHLMETRIC_REQ, mesh_recv_action_meshlmetric_req);
 418         ieee80211_recv_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
 419             IEEE80211_ACTION_MESHLMETRIC_REP, mesh_recv_action_meshlmetric_rep);
 420
 421         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 422             IEEE80211_ACTION_MESHPEERING_OPEN,
 423             mesh_send_action_meshpeering_open);
 424         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 425             IEEE80211_ACTION_MESHPEERING_CONFIRM,
 426             mesh_send_action_meshpeering_confirm);
 427         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHPEERING,
 428             IEEE80211_ACTION_MESHPEERING_CLOSE,
 429             mesh_send_action_meshpeering_close);
 430         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
 431             IEEE80211_ACTION_MESHLMETRIC_REQ,
 432             mesh_send_action_meshlink_request);
 433         ieee80211_send_action_register(IEEE80211_ACTION_CAT_MESHLMETRIC,
 434             IEEE80211_ACTION_MESHLMETRIC_REP,
 435             mesh_send_action_meshlink_reply);
 436
 437         /*
 438          * Register Airtime Link Metric.
 439          */
 440         ieee80211_mesh_register_proto_metric(&mesh_metric_airtime);
 441
 442 }
 443 SYSINIT(wlan_mesh, SI_SUB_DRIVERS, SI_ORDER_FIRST, ieee80211_mesh_init, NULL);
 444
 445 void
 446 ieee80211_mesh_attach(struct ieee80211com *ic)
 447 {
 448         ic->ic_vattach[IEEE80211_M_MBSS] = mesh_vattach;
 449 }
 450
 451 void
 452 ieee80211_mesh_detach(struct ieee80211com *ic)
 453 {
 454 }
 455
 456 static void
 457 mesh_vdetach_peers(void *arg, struct ieee80211_node *ni)
 458 {
 459         struct ieee80211com *ic = ni->ni_ic;
 460         uint16_t args[3];
 461
 462         if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED) {
 463                 args[0] = ni->ni_mlpid;
 464                 args[1] = ni->ni_mllid;
 465                 args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
 466                 ieee80211_send_action(ni,
 467                     IEEE80211_ACTION_CAT_MESHPEERING,
 468                     IEEE80211_ACTION_MESHPEERING_CLOSE,
 469                     args);
 470         }
 471         callout_stop(&ni->ni_mltimer);
 472         /* XXX belongs in hwmp */
 473         ieee80211_ageq_drain_node(&ic->ic_stageq,
 474            (void *)(uintptr_t) ieee80211_mac_hash(ic, ni->ni_macaddr));
 475 }
 476
 477 static void
 478 mesh_vdetach(struct ieee80211vap *vap)
 479 {
 480         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 481
 482         callout_stop(&ms->ms_cleantimer);
 483         ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_vdetach_peers,
 484             NULL);
 485         ieee80211_mesh_rt_flush(vap);
 486         ms->ms_ppath->mpp_vdetach(vap);
 487         kfree(vap->iv_mesh, M_80211_VAP);
 488         vap->iv_mesh = NULL;
 489 }
 490
 491 static void
 492 mesh_vattach(struct ieee80211vap *vap)
 493 {
 494         struct ieee80211_mesh_state *ms;
 495         vap->iv_newstate = mesh_newstate;
 496         vap->iv_input = mesh_input;
 497         vap->iv_opdetach = mesh_vdetach;
 498         vap->iv_recv_mgmt = mesh_recv_mgmt;
 499         ms = kmalloc(sizeof(struct ieee80211_mesh_state), M_80211_VAP,
 500             M_INTWAIT | M_ZERO);
 501         if (ms == NULL) {
 502                 kprintf("%s: couldn't alloc MBSS state\n", __func__);
 503                 return;
 504         }
 505         vap->iv_mesh = ms;
 506         ms->ms_seq = 0;
 507         ms->ms_flags = (IEEE80211_MESHFLAGS_AP | IEEE80211_MESHFLAGS_FWD);
 508         ms->ms_ttl = IEEE80211_MESH_DEFAULT_TTL;
 509         TAILQ_INIT(&ms->ms_routes);
 510         callout_init_mp(&ms->ms_cleantimer);
 511         mesh_select_proto_metric(vap, "AIRTIME");
 512         KASSERT(ms->ms_pmetric, ("ms_pmetric == NULL"));
 513         mesh_select_proto_path(vap, "HWMP");
 514         KASSERT(ms->ms_ppath, ("ms_ppath == NULL"));
 515         ms->ms_ppath->mpp_vattach(vap);
 516 }
 517
 518 /*
 519  * IEEE80211_M_MBSS vap state machine handler.
 520  */
 521 static int
 522 mesh_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 523 {
 524         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 525         struct ieee80211com *ic = vap->iv_ic;
 526         struct ieee80211_node *ni;
 527         enum ieee80211_state ostate;
 528
 529         ostate = vap->iv_state;
 530         IEEE80211_DPRINTF(vap, IEEE80211_MSG_STATE, "%s: %s -> %s (%d)\n",
 531             __func__, ieee80211_state_name[ostate],
 532             ieee80211_state_name[nstate], arg);
 533         vap->iv_state = nstate;         /* state transition */
 534         if (ostate != IEEE80211_S_SCAN)
 535                 ieee80211_cancel_scan(vap);     /* background scan */
 536         ni = vap->iv_bss;                       /* NB: no reference held */
 537         if (nstate != IEEE80211_S_RUN && ostate == IEEE80211_S_RUN)
 538                 callout_stop(&ms->ms_cleantimer);
 539         switch (nstate) {
 540         case IEEE80211_S_INIT:
 541                 switch (ostate) {
 542                 case IEEE80211_S_SCAN:
 543                         ieee80211_cancel_scan(vap);
 544                         break;
 545                 case IEEE80211_S_CAC:
 546                         ieee80211_dfs_cac_stop(vap);
 547                         break;
 548                 case IEEE80211_S_RUN:
 549                         ieee80211_iterate_nodes(&ic->ic_sta,
 550                             mesh_vdetach_peers, NULL);
 551                         break;
 552                 default:
 553                         break;
 554                 }
 555                 if (ostate != IEEE80211_S_INIT) {
 556                         /* NB: optimize INIT -> INIT case */
 557                         ieee80211_reset_bss(vap);
 558                         ieee80211_mesh_rt_flush(vap);
 559                 }
 560                 break;
 561         case IEEE80211_S_SCAN:
 562                 switch (ostate) {
 563                 case IEEE80211_S_INIT:
 564                         if (vap->iv_des_chan != IEEE80211_CHAN_ANYC &&
 565                             !IEEE80211_IS_CHAN_RADAR(vap->iv_des_chan) &&
 566                             ms->ms_idlen != 0) {
 567                                 /*
 568                                  * Already have a channel and a mesh ID; bypass
 569                                  * the scan and startup immediately.
 570                                  */
 571                                 ieee80211_create_ibss(vap, vap->iv_des_chan);
 572                                 break;
 573                         }
 574                         /*
 575                          * Initiate a scan.  We can come here as a result
 576                          * of an IEEE80211_IOC_SCAN_REQ too in which case
 577                          * the vap will be marked with IEEE80211_FEXT_SCANREQ
 578                          * and the scan request parameters will be present
 579                          * in iv_scanreq.  Otherwise we do the default.
 580                         */
 581                         if (vap->iv_flags_ext & IEEE80211_FEXT_SCANREQ) {
 582                                 ieee80211_check_scan(vap,
 583                                     vap->iv_scanreq_flags,
 584                                     vap->iv_scanreq_duration,
 585                                     vap->iv_scanreq_mindwell,
 586                                     vap->iv_scanreq_maxdwell,
 587                                     vap->iv_scanreq_nssid, vap->iv_scanreq_ssid);
 588                                 vap->iv_flags_ext &= ~IEEE80211_FEXT_SCANREQ;
 589                         } else
 590                                 ieee80211_check_scan_current(vap);
 591                         break;
 592                 default:
 593                         break;
 594                 }
 595                 break;
 596         case IEEE80211_S_CAC:
 597                 /*
 598                  * Start CAC on a DFS channel.  We come here when starting
 599                  * a bss on a DFS channel (see ieee80211_create_ibss).
 600                  */
 601                 ieee80211_dfs_cac_start(vap);
 602                 break;
 603         case IEEE80211_S_RUN:
 604                 switch (ostate) {
 605                 case IEEE80211_S_INIT:
 606                         /*
 607                          * Already have a channel; bypass the
 608                          * scan and startup immediately.
 609                          * Note that ieee80211_create_ibss will call
 610                          * back to do a RUN->RUN state change.
 611                          */
 612                         ieee80211_create_ibss(vap,
 613                             ieee80211_ht_adjust_channel(ic,
 614                                 ic->ic_curchan, vap->iv_flags_ht));
 615                         /* NB: iv_bss is changed on return */
 616                         break;
 617                 case IEEE80211_S_CAC:
 618                         /*
 619                          * NB: This is the normal state change when CAC
 620                          * expires and no radar was detected; no need to
 621                          * clear the CAC timer as it's already expired.
 622                          */
 623                         /* fall thru... */
 624                 case IEEE80211_S_CSA:
 625 #if 0
 626                         /*
 627                          * Shorten inactivity timer of associated stations
 628                          * to weed out sta's that don't follow a CSA.
 629                          */
 630                         ieee80211_iterate_nodes(&ic->ic_sta, sta_csa, vap);
 631 #endif
 632                         /*
 633                          * Update bss node channel to reflect where
 634                          * we landed after CSA.
 635                          */
 636                         ieee80211_node_set_chan(vap->iv_bss,
 637                             ieee80211_ht_adjust_channel(ic, ic->ic_curchan,
 638                                 ieee80211_htchanflags(vap->iv_bss->ni_chan)));
 639                         /* XXX bypass debug msgs */
 640                         break;
 641                 case IEEE80211_S_SCAN:
 642                 case IEEE80211_S_RUN:
 643 #ifdef IEEE80211_DEBUG
 644                         if (ieee80211_msg_debug(vap)) {
 645                                 struct ieee80211_node *ni = vap->iv_bss;
 646                                 ieee80211_note(vap,
 647                                     "synchronized with %6D meshid ",
 648                                     ni->ni_meshid, ":");
 649                                 ieee80211_print_essid(ni->ni_meshid,
 650                                     ni->ni_meshidlen);
 651                                 /* XXX MCS/HT */
 652                                 kprintf(" channel %d\n",
 653                                     ieee80211_chan2ieee(ic, ic->ic_curchan));
 654                         }
 655 #endif
 656                         break;
 657                 default:
 658                         break;
 659                 }
 660                 ieee80211_node_authorize(vap->iv_bss);
 661                 callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
 662                     mesh_rt_cleanup_callout, vap);
 663                 break;
 664         default:
 665                 break;
 666         }
 667         /* NB: ostate not nstate */
 668         ms->ms_ppath->mpp_newstate(vap, ostate, arg);
 669         return 0;
 670 }
 671
 672 static void
 673 mesh_rt_cleanup_callout(void *arg)
 674 {
 675         struct ieee80211vap *vap = arg;
 676         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 677
 678         wlan_serialize_enter();
 679         mesh_rt_flush_invalid(vap);
 680         callout_reset(&ms->ms_cleantimer, ms->ms_ppath->mpp_inact,
 681                       mesh_rt_cleanup_callout, vap);
 682         wlan_serialize_exit();
 683 }
 684
 685
 686 /*
 687  * Helper function to note the Mesh Peer Link FSM change.
 688  */
 689 static void
 690 mesh_linkchange(struct ieee80211_node *ni, enum ieee80211_mesh_mlstate state)
 691 {
 692         struct ieee80211vap *vap = ni->ni_vap;
 693         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 694 #ifdef IEEE80211_DEBUG
 695         static const char *meshlinkstates[] = {
 696                 [IEEE80211_NODE_MESH_IDLE]              = "IDLE",
 697                 [IEEE80211_NODE_MESH_OPENSNT]           = "OPEN SENT",
 698                 [IEEE80211_NODE_MESH_OPENRCV]           = "OPEN RECEIVED",
 699                 [IEEE80211_NODE_MESH_CONFIRMRCV]        = "CONFIRM RECEIVED",
 700                 [IEEE80211_NODE_MESH_ESTABLISHED]       = "ESTABLISHED",
 701                 [IEEE80211_NODE_MESH_HOLDING]           = "HOLDING"
 702         };
 703 #endif
 704         IEEE80211_NOTE(vap, IEEE80211_MSG_MESH,
 705             ni, "peer link: %s -> %s",
 706             meshlinkstates[ni->ni_mlstate], meshlinkstates[state]);
 707
 708         /* track neighbor count */
 709         if (state == IEEE80211_NODE_MESH_ESTABLISHED &&
 710             ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
 711                 KASSERT(ms->ms_neighbors < 65535, ("neighbor count overflow"));
 712                 ms->ms_neighbors++;
 713                 ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
 714         } else if (ni->ni_mlstate == IEEE80211_NODE_MESH_ESTABLISHED &&
 715             state != IEEE80211_NODE_MESH_ESTABLISHED) {
 716                 KASSERT(ms->ms_neighbors > 0, ("neighbor count 0"));
 717                 ms->ms_neighbors--;
 718                 ieee80211_beacon_notify(vap, IEEE80211_BEACON_MESHCONF);
 719         }
 720         ni->ni_mlstate = state;
 721         switch (state) {
 722         case IEEE80211_NODE_MESH_HOLDING:
 723                 ms->ms_ppath->mpp_peerdown(ni);
 724                 break;
 725         case IEEE80211_NODE_MESH_ESTABLISHED:
 726                 ieee80211_mesh_discover(vap, ni->ni_macaddr, NULL);
 727                 break;
 728         default:
 729                 break;
 730         }
 731 }
 732
 733 /*
 734  * Helper function to generate a unique local ID required for mesh
 735  * peer establishment.
 736  */
 737 static void
 738 mesh_checkid(void *arg, struct ieee80211_node *ni)
 739 {
 740         uint16_t *r = arg;
 741
 742         if (*r == ni->ni_mllid)
 743                 *(uint16_t *)arg = 0;
 744 }
 745
 746 static uint32_t
 747 mesh_generateid(struct ieee80211vap *vap)
 748 {
 749         int maxiter = 4;
 750         uint16_t r;
 751
 752         do {
 753                 get_random_bytes(&r, 2);
 754                 ieee80211_iterate_nodes(&vap->iv_ic->ic_sta, mesh_checkid, &r);
 755                 maxiter--;
 756         } while (r == 0 && maxiter > 0);
 757         return r;
 758 }
 759
 760 /*
 761  * Verifies if we already received this packet by checking its
 762  * sequence number.
 763  * Returns 0 if the frame is to be accepted, 1 otherwise.
 764  */
 765 static int
 766 mesh_checkpseq(struct ieee80211vap *vap,
 767     const uint8_t source[IEEE80211_ADDR_LEN], uint32_t seq)
 768 {
 769         struct ieee80211_mesh_route *rt;
 770
 771         rt = ieee80211_mesh_rt_find(vap, source);
 772         if (rt == NULL) {
 773                 rt = ieee80211_mesh_rt_add(vap, source);
 774                 if (rt == NULL) {
 775                         IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
 776                             "%s", "add mcast route failed");
 777                         vap->iv_stats.is_mesh_rtaddfailed++;
 778                         return 1;
 779                 }
 780                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, source,
 781                     "add mcast route, mesh seqno %d", seq);
 782                 rt->rt_lastmseq = seq;
 783                 return 0;
 784         }
 785         if (IEEE80211_MESH_SEQ_GEQ(rt->rt_lastmseq, seq)) {
 786                 return 1;
 787         } else {
 788                 rt->rt_lastmseq = seq;
 789                 return 0;
 790         }
 791 }
 792
 793 /*
 794  * Iterate the routing table and locate the next hop.
 795  */
 796 static struct ieee80211_node *
 797 mesh_find_txnode(struct ieee80211vap *vap,
 798     const uint8_t dest[IEEE80211_ADDR_LEN])
 799 {
 800         struct ieee80211_mesh_route *rt;
 801
 802         rt = ieee80211_mesh_rt_find(vap, dest);
 803         if (rt == NULL)
 804                 return NULL;
 805         if ((rt->rt_flags & IEEE80211_MESHRT_FLAGS_VALID) == 0 ||
 806             (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY)) {
 807                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_MESH, dest,
 808                     "%s: !valid or proxy, flags 0x%x", __func__, rt->rt_flags);
 809                 /* XXX stat */
 810                 return NULL;
 811         }
 812         return ieee80211_find_txnode(vap, rt->rt_nexthop);
 813 }
 814
 815 /*
 816  * Forward the specified frame.
 817  * Decrement the TTL and set TA to our MAC address.
 818  */
 819 static void
 820 mesh_forward(struct ieee80211vap *vap, struct mbuf *m,
 821     const struct ieee80211_meshcntl *mc)
 822 {
 823         struct ieee80211com *ic = vap->iv_ic;
 824         struct ieee80211_mesh_state *ms = vap->iv_mesh;
 825         struct ifnet *ifp = vap->iv_ifp;
 826         struct ifnet *parent = ic->ic_ifp;
 827         const struct ieee80211_frame *wh =
 828             mtod(m, const struct ieee80211_frame *);
 829         struct mbuf *mcopy;
 830         struct ieee80211_meshcntl *mccopy;
 831         struct ieee80211_frame *whcopy;
 832         struct ieee80211_node *ni;
 833         int err;
 834
 835         if (mc->mc_ttl == 0) {
 836                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 837                     "%s", "frame not fwd'd, ttl 0");
 838                 vap->iv_stats.is_mesh_fwd_ttl++;
 839                 return;
 840         }
 841         if (!(ms->ms_flags & IEEE80211_MESHFLAGS_FWD)) {
 842                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 843                     "%s", "frame not fwd'd, fwding disabled");
 844                 vap->iv_stats.is_mesh_fwd_disabled++;
 845                 return;
 846         }
 847         mcopy = m_dup(m, MB_DONTWAIT);
 848         if (mcopy == NULL) {
 849                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 850                     "%s", "frame not fwd'd, cannot dup");
 851                 vap->iv_stats.is_mesh_fwd_nobuf++;
 852                 ifp->if_oerrors++;
 853                 return;
 854         }
 855         mcopy = m_pullup(mcopy, ieee80211_hdrspace(ic, wh) +
 856             sizeof(struct ieee80211_meshcntl));
 857         if (mcopy == NULL) {
 858                 IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 859                     "%s", "frame not fwd'd, too short");
 860                 vap->iv_stats.is_mesh_fwd_tooshort++;
 861                 ifp->if_oerrors++;
 862                 m_freem(mcopy);
 863                 return;
 864         }
 865         whcopy = mtod(mcopy, struct ieee80211_frame *);
 866         mccopy = (struct ieee80211_meshcntl *)
 867             (mtod(mcopy, uint8_t *) + ieee80211_hdrspace(ic, wh));
 868         /* XXX clear other bits? */
 869         whcopy->i_fc[1] &= ~IEEE80211_FC1_RETRY;
 870         IEEE80211_ADDR_COPY(whcopy->i_addr2, vap->iv_myaddr);
 871         if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 872                 ni = ieee80211_ref_node(vap->iv_bss);
 873                 mcopy->m_flags |= M_MCAST;
 874         } else {
 875                 ni = mesh_find_txnode(vap, whcopy->i_addr3);
 876                 if (ni == NULL) {
 877                         IEEE80211_NOTE_FRAME(vap, IEEE80211_MSG_MESH, wh,
 878                             "%s", "frame not fwd'd, no path");
 879                         vap->iv_stats.is_mesh_fwd_nopath++;
 880                         m_freem(mcopy);
 881                         return;
 882                 }
 883                 IEEE80211_ADDR_COPY(whcopy->i_addr1, ni->ni_macaddr);
 884         }
 885         KASSERT(mccopy->mc_ttl > 0, ("%s called with wrong ttl", __func__));
 886         mccopy->mc_ttl--;
 887
 888         /* XXX calculate priority so drivers can find the tx queue */
 889         M_WME_SETAC(mcopy, WME_AC_BE);
 890
 891         /* XXX do we know m_nextpkt is NULL? */
 892         mcopy->m_pkthdr.rcvif = (void *) ni;
 893         err = ieee80211_handoff(parent, mcopy);
 894         if (err != 0) {
 895                 /* NB: IFQ_HANDOFF reclaims mbuf */
 896                 ieee80211_free_node(ni);
 897         } else {
 898                 ifp->if_opackets++;
 899         }
 900 }
 901
 902 static struct mbuf *
 903 mesh_decap(struct ieee80211vap *vap, struct mbuf *m, int hdrlen, int meshdrlen)
 904 {
 905 #define WHDIR(wh) ((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK)
 906         uint8_t b[sizeof(struct ieee80211_qosframe_addr4) +
 907                   sizeof(struct ieee80211_meshcntl_ae11)];
 908         const struct ieee80211_qosframe_addr4 *wh;
 909         const struct ieee80211_meshcntl_ae10 *mc;
 910         struct ether_header *eh;
 911         struct llc *llc;
 912         int ae;
 913
 914         if (m->m_len < hdrlen + sizeof(*llc) &&
 915             (m = m_pullup(m, hdrlen + sizeof(*llc))) == NULL) {
 916                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_ANY,
 917                     "discard data frame: %s", "m_pullup failed");
 918                 vap->iv_stats.is_rx_tooshort++;
 919                 return NULL;
 920         }
 921         memcpy(b, mtod(m, caddr_t), hdrlen);
 922         wh = (const struct ieee80211_qosframe_addr4 *)&b[0];
 923         mc = (const struct ieee80211_meshcntl_ae10 *)&b[hdrlen - meshdrlen];
 924         KASSERT(WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS ||
 925                 WHDIR(wh) == IEEE80211_FC1_DIR_DSTODS,
 926             ("bogus dir, fc 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
 927
 928         llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
 929         if (llc->llc_dsap == LLC_SNAP_LSAP && llc->llc_ssap == LLC_SNAP_LSAP &&
 930             llc->llc_control == LLC_UI && llc->llc_snap.org_code[0] == 0 &&
 931             llc->llc_snap.org_code[1] == 0 && llc->llc_snap.org_code[2] == 0 &&
 932             /* NB: preserve AppleTalk frames that have a native SNAP hdr */
 933             !(llc->llc_snap.ether_type == htons(ETHERTYPE_AARP) ||
 934               llc->llc_snap.ether_type == htons(ETHERTYPE_IPX))) {
 935                 m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
 936                 llc = NULL;
 937         } else {
 938                 m_adj(m, hdrlen - sizeof(*eh));
 939         }
 940         eh = mtod(m, struct ether_header *);
 941         ae = mc->mc_flags & 3;
 942         if (WHDIR(wh) == IEEE80211_FC1_DIR_FROMDS) {
 943                 IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr1);
 944                 if (ae == 0) {
 945                         IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr3);
 946                 } else if (ae == 1) {
 947                         IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr4);
 948                 } else {
 949                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 950                             (const struct ieee80211_frame *)wh, NULL,
 951                             "bad AE %d", ae);
 952                         vap->iv_stats.is_mesh_badae++;
 953                         m_freem(m);
 954                         return NULL;
 955                 }
 956         } else {
 957                 if (ae == 0) {
 958                         IEEE80211_ADDR_COPY(eh->ether_dhost, wh->i_addr3);
 959                         IEEE80211_ADDR_COPY(eh->ether_shost, wh->i_addr4);
 960                 } else if (ae == 2) {
 961                         IEEE80211_ADDR_COPY(eh->ether_dhost, mc->mc_addr4);
 962                         IEEE80211_ADDR_COPY(eh->ether_shost, mc->mc_addr5);
 963                 } else {
 964                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
 965                             (const struct ieee80211_frame *)wh, NULL,
 966                             "bad AE %d", ae);
 967                         vap->iv_stats.is_mesh_badae++;
 968                         m_freem(m);
 969                         return NULL;
 970                 }
 971         }
 972 #ifdef ALIGNED_POINTER
 973         if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), uint32_t)) {
 974                 m = ieee80211_realign(vap, m, sizeof(*eh));
 975                 if (m == NULL)
 976                         return NULL;
 977         }
 978 #endif /* ALIGNED_POINTER */
 979         if (llc != NULL) {
 980                 eh = mtod(m, struct ether_header *);
 981                 eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
 982         }
 983         return m;
 984 #undef WDIR
 985 }
 986
 987 /*
 988  * Return non-zero if the unicast mesh data frame should be processed
 989  * locally.  Frames that are not proxy'd have our address, otherwise
 990  * we need to consult the routing table to look for a proxy entry.
 991  */
 992 static __inline int
 993 mesh_isucastforme(struct ieee80211vap *vap, const struct ieee80211_frame *wh,
 994     const struct ieee80211_meshcntl *mc)
 995 {
 996         int ae = mc->mc_flags & 3;
 997
 998         KASSERT((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS,
 999             ("bad dir 0x%x:0x%x", wh->i_fc[0], wh->i_fc[1]));
1000         KASSERT(ae == 0 || ae == 2, ("bad AE %d", ae));
1001         if (ae == 2) {                          /* ucast w/ proxy */
1002                 const struct ieee80211_meshcntl_ae10 *mc10 =
1003                     (const struct ieee80211_meshcntl_ae10 *) mc;
1004                 struct ieee80211_mesh_route *rt =
1005                     ieee80211_mesh_rt_find(vap, mc10->mc_addr4);
1006                 /* check for proxy route to ourself */
1007                 return (rt != NULL &&
1008                     (rt->rt_flags & IEEE80211_MESHRT_FLAGS_PROXY));
1009         } else                                  /* ucast w/o proxy */
1010                 return IEEE80211_ADDR_EQ(wh->i_addr3, vap->iv_myaddr);
1011 }
1012
1013 static int
1014 mesh_input(struct ieee80211_node *ni, struct mbuf *m, int rssi, int nf)
1015 {
1016 #define SEQ_LEQ(a,b)    ((int)((a)-(b)) <= 0)
1017 #define HAS_SEQ(type)   ((type & 0x4) == 0)
1018         struct ieee80211vap *vap = ni->ni_vap;
1019         struct ieee80211com *ic = ni->ni_ic;
1020         struct ifnet *ifp = vap->iv_ifp;
1021         struct ieee80211_frame *wh;
1022         const struct ieee80211_meshcntl *mc;
1023         int hdrspace, meshdrlen, need_tap;
1024         uint8_t dir, type, subtype, qos;
1025         uint32_t seq;
1026         uint8_t *addr;
1027         ieee80211_seq rxseq;
1028
1029         KASSERT(ni != NULL, ("null node"));
1030         ni->ni_inact = ni->ni_inact_reload;
1031
1032         need_tap = 1;                   /* mbuf need to be tapped. */
1033         type = -1;                      /* undefined */
1034
1035         if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
1036                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1037                     ni->ni_macaddr, NULL,
1038                     "too short (1): len %u", m->m_pkthdr.len);
1039                 vap->iv_stats.is_rx_tooshort++;
1040                 goto out;
1041         }
1042         /*
1043          * Bit of a cheat here, we use a pointer for a 3-address
1044          * frame format but don't reference fields past outside
1045          * ieee80211_frame_min w/o first validating the data is
1046          * present.
1047         */
1048         wh = mtod(m, struct ieee80211_frame *);
1049
1050         if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
1051             IEEE80211_FC0_VERSION_0) {
1052                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1053                     ni->ni_macaddr, NULL, "wrong version %x", wh->i_fc[0]);
1054                 vap->iv_stats.is_rx_badversion++;
1055                 goto err;
1056         }
1057         dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
1058         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1059         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
1060         if ((ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1061                 IEEE80211_RSSI_LPF(ni->ni_avgrssi, rssi);
1062                 ni->ni_noise = nf;
1063                 if (HAS_SEQ(type)) {
1064                         uint8_t tid = ieee80211_gettid(wh);
1065
1066                         if (IEEE80211_QOS_HAS_SEQ(wh) &&
1067                             TID_TO_WME_AC(tid) >= WME_AC_VI)
1068                                 ic->ic_wme.wme_hipri_traffic++;
1069                         rxseq = le16toh(*(uint16_t *)wh->i_seq);
1070                         if ((ni->ni_flags & IEEE80211_NODE_HT) == 0 &&
1071                             (wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
1072                             SEQ_LEQ(rxseq, ni->ni_rxseqs[tid])) {
1073                                 /* duplicate, discard */
1074                                 IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1075                                     wh->i_addr1, "duplicate",
1076                                     "seqno <%u,%u> fragno <%u,%u> tid %u",
1077                                     rxseq >> IEEE80211_SEQ_SEQ_SHIFT,
1078                                     ni->ni_rxseqs[tid] >>
1079                                     IEEE80211_SEQ_SEQ_SHIFT,
1080                                     rxseq & IEEE80211_SEQ_FRAG_MASK,
1081                                     ni->ni_rxseqs[tid] &
1082                                     IEEE80211_SEQ_FRAG_MASK,
1083                                     tid);
1084                                 vap->iv_stats.is_rx_dup++;
1085                                 IEEE80211_NODE_STAT(ni, rx_dup);
1086                                 goto out;
1087                         }
1088                         ni->ni_rxseqs[tid] = rxseq;
1089                 }
1090         }
1091 #ifdef IEEE80211_DEBUG
1092         /*
1093          * It's easier, but too expensive, to simulate different mesh
1094          * topologies by consulting the ACL policy very early, so do this
1095          * only under DEBUG.
1096          *
1097          * NB: this check is also done upon peering link initiation.
1098          */
1099         if (vap->iv_acl != NULL && !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
1100                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1101                     wh, NULL, "%s", "disallowed by ACL");
1102                 vap->iv_stats.is_rx_acl++;
1103                 goto out;
1104         }
1105 #endif
1106         switch (type) {
1107         case IEEE80211_FC0_TYPE_DATA:
1108                 if (ni == vap->iv_bss)
1109                         goto out;
1110                 if (ni->ni_mlstate != IEEE80211_NODE_MESH_ESTABLISHED) {
1111                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_MESH,
1112                             ni->ni_macaddr, NULL,
1113                             "peer link not yet established (%d)",
1114                             ni->ni_mlstate);
1115                         vap->iv_stats.is_mesh_nolink++;
1116                         goto out;
1117                 }
1118                 if (dir != IEEE80211_FC1_DIR_FROMDS &&
1119                     dir != IEEE80211_FC1_DIR_DSTODS) {
1120                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1121                             wh, "data", "incorrect dir 0x%x", dir);
1122                         vap->iv_stats.is_rx_wrongdir++;
1123                         goto err;
1124                 }
1125                 /* pull up enough to get to the mesh control */
1126                 hdrspace = ieee80211_hdrspace(ic, wh);
1127                 if (m->m_len < hdrspace + sizeof(struct ieee80211_meshcntl) &&
1128                     (m = m_pullup(m, hdrspace +
1129                         sizeof(struct ieee80211_meshcntl))) == NULL) {
1130                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1131                             ni->ni_macaddr, NULL,
1132                             "data too short: expecting %u", hdrspace);
1133                         vap->iv_stats.is_rx_tooshort++;
1134                         goto out;               /* XXX */
1135                 }
1136                 /*
1137                  * Now calculate the full extent of the headers. Note
1138                  * mesh_decap will pull up anything we didn't get
1139                  * above when it strips the 802.11 headers.
1140                  */
1141                 mc = (const struct ieee80211_meshcntl *)
1142                     (mtod(m, const uint8_t *) + hdrspace);
1143                 meshdrlen = sizeof(struct ieee80211_meshcntl) +
1144                     (mc->mc_flags & 3) * IEEE80211_ADDR_LEN;
1145                 hdrspace += meshdrlen;
1146                 seq = LE_READ_4(mc->mc_seq);
1147                 if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1148                         addr = wh->i_addr3;
1149                 else
1150                         addr = ((struct ieee80211_qosframe_addr4 *)wh)->i_addr4;
1151                 if (IEEE80211_ADDR_EQ(vap->iv_myaddr, addr)) {
1152                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1153                             addr, "data", "%s", "not to me");
1154                         vap->iv_stats.is_rx_wrongbss++; /* XXX kinda */
1155                         goto out;
1156                 }
1157                 if (mesh_checkpseq(vap, addr, seq) != 0) {
1158                         vap->iv_stats.is_rx_dup++;
1159                         goto out;
1160                 }
1161
1162                 /*
1163                  * Potentially forward packet.  See table s36 (p140)
1164                  * for the rules.  XXX tap fwd'd packets not for us?
1165                  */
1166                 if (dir == IEEE80211_FC1_DIR_FROMDS ||
1167                     !mesh_isucastforme(vap, wh, mc)) {
1168                         mesh_forward(vap, m, mc);
1169                         if (dir == IEEE80211_FC1_DIR_DSTODS)
1170                                 goto out;
1171                         /* NB: fall thru to deliver mcast frames locally */
1172                 }
1173
1174                 /*
1175                  * Save QoS bits for use below--before we strip the header.
1176                  */
1177                 if (subtype == IEEE80211_FC0_SUBTYPE_QOS) {
1178                         qos = (dir == IEEE80211_FC1_DIR_DSTODS) ?
1179                             ((struct ieee80211_qosframe_addr4 *)wh)->i_qos[0] :
1180                             ((struct ieee80211_qosframe *)wh)->i_qos[0];
1181                 } else
1182                         qos = 0;
1183                 /*
1184                  * Next up, any fragmentation.
1185                  */
1186                 if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1187                         m = ieee80211_defrag(ni, m, hdrspace);
1188                         if (m == NULL) {
1189                                 /* Fragment dropped or frame not complete yet */
1190                                 goto out;
1191                         }
1192                 }
1193                 wh = NULL;              /* no longer valid, catch any uses */
1194
1195                 if (ieee80211_radiotap_active_vap(vap))
1196                         ieee80211_radiotap_rx(vap, m);
1197                 need_tap = 0;
1198
1199                 /*
1200                  * Finally, strip the 802.11 header.
1201                  */
1202                 m = mesh_decap(vap, m, hdrspace, meshdrlen);
1203                 if (m == NULL) {
1204                         /* XXX mask bit to check for both */
1205                         /* don't count Null data frames as errors */
1206                         if (subtype == IEEE80211_FC0_SUBTYPE_NODATA ||
1207                             subtype == IEEE80211_FC0_SUBTYPE_QOS_NULL)
1208                                 goto out;
1209                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_INPUT,
1210                             ni->ni_macaddr, "data", "%s", "decap error");
1211                         vap->iv_stats.is_rx_decap++;
1212                         IEEE80211_NODE_STAT(ni, rx_decap);
1213                         goto err;
1214                 }
1215                 if (qos & IEEE80211_QOS_AMSDU) {
1216                         m = ieee80211_decap_amsdu(ni, m);
1217                         if (m == NULL)
1218                                 return IEEE80211_FC0_TYPE_DATA;
1219                 }
1220                 ieee80211_deliver_data(vap, ni, m);
1221                 return type;
1222         case IEEE80211_FC0_TYPE_MGT:
1223                 vap->iv_stats.is_rx_mgmt++;
1224                 IEEE80211_NODE_STAT(ni, rx_mgmt);
1225                 if (dir != IEEE80211_FC1_DIR_NODS) {
1226                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1227                             wh, "mgt", "incorrect dir 0x%x", dir);
1228                         vap->iv_stats.is_rx_wrongdir++;
1229                         goto err;
1230                 }
1231                 if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
1232                         IEEE80211_DISCARD_MAC(vap, IEEE80211_MSG_ANY,
1233                             ni->ni_macaddr, "mgt", "too short: len %u",
1234                             m->m_pkthdr.len);
1235                         vap->iv_stats.is_rx_tooshort++;
1236                         goto out;
1237                 }
1238 #ifdef IEEE80211_DEBUG
1239                 if ((ieee80211_msg_debug(vap) &&
1240                     (vap->iv_ic->ic_flags & IEEE80211_F_SCAN)) ||
1241                     ieee80211_msg_dumppkts(vap)) {
1242                         if_printf(ifp, "received %s from %6D rssi %d\n",
1243                             ieee80211_mgt_subtype_name[subtype >>
1244                             IEEE80211_FC0_SUBTYPE_SHIFT],
1245                             wh->i_addr2, ":", rssi);
1246                 }
1247 #endif
1248                 if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1249                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1250                             wh, NULL, "%s", "WEP set but not permitted");
1251                         vap->iv_stats.is_rx_mgtdiscard++; /* XXX */
1252                         goto out;
1253                 }
1254                 vap->iv_recv_mgmt(ni, m, subtype, rssi, nf);
1255                 goto out;
1256         case IEEE80211_FC0_TYPE_CTL:
1257                 vap->iv_stats.is_rx_ctl++;
1258                 IEEE80211_NODE_STAT(ni, rx_ctrl);
1259                 goto out;
1260         default:
1261                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1262                     wh, "bad", "frame type 0x%x", type);
1263                 /* should not come here */
1264                 break;
1265         }
1266 err:
1267         ifp->if_ierrors++;
1268 out:
1269         if (m != NULL) {
1270                 if (need_tap && ieee80211_radiotap_active_vap(vap))
1271                         ieee80211_radiotap_rx(vap, m);
1272                 m_freem(m);
1273         }
1274         return type;
1275 }
1276
1277 static void
1278 mesh_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m0, int subtype,
1279     int rssi, int nf)
1280 {
1281         struct ieee80211vap *vap = ni->ni_vap;
1282         struct ieee80211_mesh_state *ms = vap->iv_mesh;
1283         struct ieee80211com *ic = ni->ni_ic;
1284         struct ieee80211_frame *wh;
1285         uint8_t *frm, *efrm;
1286
1287         wh = mtod(m0, struct ieee80211_frame *);
1288         frm = (uint8_t *)&wh[1];
1289         efrm = mtod(m0, uint8_t *) + m0->m_len;
1290         switch (subtype) {
1291         case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1292         case IEEE80211_FC0_SUBTYPE_BEACON:
1293         {
1294                 struct ieee80211_scanparams scan;
1295                 /*
1296                  * We process beacon/probe response
1297                  * frames to discover neighbors.
1298                  */
1299                 if (ieee80211_parse_beacon(ni, m0, &scan) != 0)
1300                         return;
1301                 /*
1302                  * Count frame now that we know it's to be processed.
1303                  */
1304                 if (subtype == IEEE80211_FC0_SUBTYPE_BEACON) {
1305                         vap->iv_stats.is_rx_beacon++;   /* XXX remove */
1306                         IEEE80211_NODE_STAT(ni, rx_beacons);
1307                 } else
1308                         IEEE80211_NODE_STAT(ni, rx_proberesp);
1309                 /*
1310                  * If scanning, just pass information to the scan module.
1311                  */
1312                 if (ic->ic_flags & IEEE80211_F_SCAN) {
1313                         if (ic->ic_flags_ext & IEEE80211_FEXT_PROBECHAN) {
1314                                 /*
1315                                  * Actively scanning a channel marked passive;
1316                                  * send a probe request now that we know there
1317                                  * is 802.11 traffic present.
1318                                  *
1319                                  * XXX check if the beacon we recv'd gives
1320                                  * us what we need and suppress the probe req
1321                                  */
1322                                 ieee80211_probe_curchan(vap, 1);
1323                                 ic->ic_flags_ext &= ~IEEE80211_FEXT_PROBECHAN;
1324                         }
1325                         ieee80211_add_scan(vap, &scan, wh,
1326                             subtype, rssi, nf);
1327                         return;
1328                 }
1329
1330                 /* The rest of this code assumes we are running */
1331                 if (vap->iv_state != IEEE80211_S_RUN)
1332                         return;
1333                 /*
1334                  * Ignore non-mesh STAs.
1335                  */
1336                 if ((scan.capinfo &
1337                      (IEEE80211_CAPINFO_ESS|IEEE80211_CAPINFO_IBSS)) ||
1338                     scan.meshid == NULL || scan.meshconf == NULL) {
1339                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1340                             wh, "beacon", "%s", "not a mesh sta");
1341                         vap->iv_stats.is_mesh_wrongmesh++;
1342                         return;
1343                 }
1344                 /*
1345                  * Ignore STAs for other mesh networks.
1346                  */
1347                 if (memcmp(scan.meshid+2, ms->ms_id, ms->ms_idlen) != 0 ||
1348                     mesh_verify_meshconf(vap, scan.meshconf)) {
1349                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1350                             wh, "beacon", "%s", "not for our mesh");
1351                         vap->iv_stats.is_mesh_wrongmesh++;
1352                         return;
1353                 }
1354                 /*
1355                  * Peer only based on the current ACL policy.
1356                  */
1357                 if (vap->iv_acl != NULL &&
1358                     !vap->iv_acl->iac_check(vap, wh->i_addr2)) {
1359                         IEEE80211_DISCARD(vap, IEEE80211_MSG_ACL,
1360                             wh, NULL, "%s", "disallowed by ACL");
1361                         vap->iv_stats.is_rx_acl++;
1362                         return;
1363                 }
1364                 /*
1365                  * Do neighbor discovery.
1366                  */
1367                 if (!IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_macaddr)) {
1368                         /*
1369                          * Create a new entry in the neighbor table.
1370                          */
1371                         ni = ieee80211_add_neighbor(vap, wh, &scan);
1372                 }
1373                 /*
1374                  * Automatically peer with discovered nodes if possible.
1375                  * XXX backoff on repeated failure
1376                  */
1377                 if (ni != vap->iv_bss &&
1378                     (ms->ms_flags & IEEE80211_MESHFLAGS_AP) &&
1379                     ni->ni_mlstate == IEEE80211_NODE_MESH_IDLE) {
1380                         uint16_t args[1];
1381
1382                         ni->ni_mlpid = mesh_generateid(vap);
1383                         if (ni->ni_mlpid == 0)
1384                                 return;
1385                         mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENSNT);
1386                         args[0] = ni->ni_mlpid;
1387                         ieee80211_send_action(ni,
1388                             IEEE80211_ACTION_CAT_MESHPEERING,
1389                             IEEE80211_ACTION_MESHPEERING_OPEN, args);
1390                         ni->ni_mlrcnt = 0;
1391                         mesh_peer_timeout_setup(ni);
1392                 }
1393                 break;
1394         }
1395         case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1396         {
1397                 uint8_t *ssid, *meshid, *rates, *xrates;
1398                 uint8_t *sfrm;
1399
1400                 if (vap->iv_state != IEEE80211_S_RUN) {
1401                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1402                             wh, NULL, "wrong state %s",
1403                             ieee80211_state_name[vap->iv_state]);
1404                         vap->iv_stats.is_rx_mgtdiscard++;
1405                         return;
1406                 }
1407                 if (IEEE80211_IS_MULTICAST(wh->i_addr2)) {
1408                         /* frame must be directed */
1409                         IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1410                             wh, NULL, "%s", "not unicast");
1411                         vap->iv_stats.is_rx_mgtdiscard++;       /* XXX stat */
1412                         return;
1413                 }
1414                 /*
1415                  * prreq frame format
1416                  *      [tlv] ssid
1417                  *      [tlv] supported rates
1418                  *      [tlv] extended supported rates
1419                  *      [tlv] mesh id
1420                  */
1421                 ssid = meshid = rates = xrates = NULL;
1422                 sfrm = frm;
1423                 while (efrm - frm > 1) {
1424                         IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return);
1425                         switch (*frm) {
1426                         case IEEE80211_ELEMID_SSID:
1427                                 ssid = frm;
1428                                 break;
1429                         case IEEE80211_ELEMID_RATES:
1430                                 rates = frm;
1431                                 break;
1432                         case IEEE80211_ELEMID_XRATES:
1433                                 xrates = frm;
1434                                 break;
1435                         case IEEE80211_ELEMID_MESHID:
1436                                 meshid = frm;
1437                                 break;
1438                         }
1439                         frm += frm[2] + 2;
1440                 }
1441                 IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
1442                 IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
1443                 if (xrates != NULL)
1444                         IEEE80211_VERIFY_ELEMENT(xrates,
1445                             IEEE80211_RATE_MAXSIZE - rates[1], return);
1446                 if (meshid != NULL) {
1447                         IEEE80211_VERIFY_ELEMENT(meshid,
1448                             IEEE80211_MESHID_LEN, return);
1449                         /* NB: meshid, not ssid */
1450                         IEEE80211_VERIFY_SSID(vap->iv_bss, meshid, return);
1451                 }
1452
1453                 /* XXX find a better class or define it's own */
1454                 IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_INPUT, wh->i_addr2,
1455                     "%s", "recv probe req");
1456                 /*
1457                  * Some legacy 11b clients cannot hack a complete
1458                  * probe response frame.  When the request includes
1459                  * only a bare-bones rate set, communicate this to
1460                  * the transmit side.
1461                  */
1462                 ieee80211_send_proberesp(vap, wh->i_addr2, 0);
1463                 break;
1464         }
1465         case IEEE80211_FC0_SUBTYPE_ACTION:
1466                 if (vap->iv_state != IEEE80211_S_RUN) {
1467                         vap->iv_stats.is_rx_mgtdiscard++;
1468                         break;
1469                 }
1470                 /*
1471                  * We received an action for an unknown neighbor.
1472                  * XXX: wait for it to beacon or create ieee80211_node?
1473                  */
1474                 if (ni == vap->iv_bss) {
1475                         IEEE80211_DISCARD(vap, IEEE80211_MSG_MESH,
1476                             wh, NULL, "%s", "unknown node");
1477                         vap->iv_stats.is_rx_mgtdiscard++;
1478                         break;
1479                 }
1480                 /*
1481                  * Discard if not for us.
1482                  */
1483                 if (!IEEE80211_ADDR_EQ(vap->iv_myaddr, wh->i_addr1) &&
1484                     !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1485                         IEEE80211_DISCARD(vap, IEEE80211_MSG_MESH,
1486                             wh, NULL, "%s", "not for me");
1487                         vap->iv_stats.is_rx_mgtdiscard++;
1488                         break;
1489                 }
1490                 /* XXX parse_action is a bit useless now */
1491                 if (ieee80211_parse_action(ni, m0) == 0)
1492                         ic->ic_recv_action(ni, wh, frm, efrm);
1493                 break;
1494         case IEEE80211_FC0_SUBTYPE_AUTH:
1495         case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1496         case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1497         case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1498         case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1499         case IEEE80211_FC0_SUBTYPE_DEAUTH:
1500         case IEEE80211_FC0_SUBTYPE_DISASSOC:
1501                 IEEE80211_DISCARD(vap, IEEE80211_MSG_INPUT,
1502                     wh, NULL, "%s", "not handled");
1503                 vap->iv_stats.is_rx_mgtdiscard++;
1504                 return;
1505         default:
1506                 IEEE80211_DISCARD(vap, IEEE80211_MSG_ANY,
1507                     wh, "mgt", "subtype 0x%x not handled", subtype);
1508                 vap->iv_stats.is_rx_badsubtype++;
1509                 break;
1510         }
1511 }
1512
1513 /*
1514  * Parse meshpeering action ie's for open+confirm frames; the
1515  * important bits are returned in the supplied structure.
1516  */
1517 static const struct ieee80211_meshpeer_ie *
1518 mesh_parse_meshpeering_action(struct ieee80211_node *ni,
1519         const struct ieee80211_frame *wh,       /* XXX for VERIFY_LENGTH */
1520         const uint8_t *frm, const uint8_t *efrm,
1521         struct ieee80211_meshpeer_ie *mp, uint8_t subtype)
1522 {
1523         struct ieee80211vap *vap = ni->ni_vap;
1524         const struct ieee80211_meshpeer_ie *mpie;
1525         const uint8_t *meshid, *meshconf, *meshpeer;
1526
1527         meshid = meshconf = meshpeer = NULL;
1528         while (efrm - frm > 1) {
1529                 IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return NULL);
1530                 switch (*frm) {
1531                 case IEEE80211_ELEMID_MESHID:
1532                         meshid = frm;
1533                         break;
1534                 case IEEE80211_ELEMID_MESHCONF:
1535                         meshconf = frm;
1536                         break;
1537                 case IEEE80211_ELEMID_MESHPEER:
1538                         meshpeer = frm;
1539                         mpie = (const struct ieee80211_meshpeer_ie *) frm;
1540                         memset(mp, 0, sizeof(*mp));
1541                         mp->peer_llinkid = LE_READ_2(&mpie->peer_llinkid);
1542                         /* NB: peer link ID is optional on these frames */
1543                         if (subtype == IEEE80211_MESH_PEER_LINK_CLOSE &&
1544                             mpie->peer_len == 8) {
1545                                 mp->peer_linkid = 0;
1546                                 mp->peer_rcode = LE_READ_2(&mpie->peer_linkid);
1547                         } else {
1548                                 mp->peer_linkid = LE_READ_2(&mpie->peer_linkid);
1549                                 mp->peer_rcode = LE_READ_2(&mpie->peer_rcode);
1550                         }
1551                         break;
1552                 }
1553                 frm += frm[1] + 2;
1554         }
1555
1556         /*
1557          * Verify the contents of the frame. Action frames with
1558          * close subtype don't have a Mesh Configuration IE.
1559          * If if fails validation, close the peer link.
1560          */
1561         KASSERT(meshpeer != NULL &&
1562             subtype != IEEE80211_ACTION_MESHPEERING_CLOSE,
1563             ("parsing close action"));
1564
1565         if (mesh_verify_meshid(vap, meshid) ||
1566             mesh_verify_meshpeer(vap, subtype, meshpeer) ||
1567             mesh_verify_meshconf(vap, meshconf)) {
1568                 uint16_t args[3];
1569
1570                 IEEE80211_DISCARD(vap,
1571                     IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
1572                     wh, NULL, "%s", "not for our mesh");
1573                 vap->iv_stats.is_rx_mgtdiscard++;
1574                 switch (ni->ni_mlstate) {
1575                 case IEEE80211_NODE_MESH_IDLE:
1576                 case IEEE80211_NODE_MESH_ESTABLISHED:
1577                 case IEEE80211_NODE_MESH_HOLDING:
1578                         /* ignore */
1579                         break;
1580                 case IEEE80211_NODE_MESH_OPENSNT:
1581                 case IEEE80211_NODE_MESH_OPENRCV:
1582                 case IEEE80211_NODE_MESH_CONFIRMRCV:
1583                         args[0] = ni->ni_mlpid;
1584                         args[1] = ni->ni_mllid;
1585                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1586                         ieee80211_send_action(ni,
1587                             IEEE80211_ACTION_CAT_MESHPEERING,
1588                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1589                             args);
1590                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1591                         mesh_peer_timeout_setup(ni);
1592                         break;
1593                 }
1594                 return NULL;
1595         }
1596         return (const struct ieee80211_meshpeer_ie *) mp;
1597 }
1598
1599 static int
1600 mesh_recv_action_meshpeering_open(struct ieee80211_node *ni,
1601         const struct ieee80211_frame *wh,
1602         const uint8_t *frm, const uint8_t *efrm)
1603 {
1604         struct ieee80211vap *vap = ni->ni_vap;
1605         struct ieee80211_meshpeer_ie ie;
1606         const struct ieee80211_meshpeer_ie *meshpeer;
1607         uint16_t args[3];
1608
1609         /* +2+2 for action + code + capabilites */
1610         meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2, efrm, &ie,
1611             IEEE80211_ACTION_MESHPEERING_OPEN);
1612         if (meshpeer == NULL) {
1613                 return 0;
1614         }
1615
1616         /* XXX move up */
1617         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
1618             "recv PEER OPEN, lid 0x%x", meshpeer->peer_llinkid);
1619
1620         switch (ni->ni_mlstate) {
1621         case IEEE80211_NODE_MESH_IDLE:
1622                 mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
1623                 ni->ni_mllid = meshpeer->peer_llinkid;
1624                 ni->ni_mlpid = mesh_generateid(vap);
1625                 if (ni->ni_mlpid == 0)
1626                         return 0;               /* XXX */
1627                 args[0] = ni->ni_mlpid;
1628                 /* Announce we're open too... */
1629                 ieee80211_send_action(ni,
1630                     IEEE80211_ACTION_CAT_MESHPEERING,
1631                     IEEE80211_ACTION_MESHPEERING_OPEN, args);
1632                 /* ...and confirm the link. */
1633                 args[0] = ni->ni_mlpid;
1634                 args[1] = ni->ni_mllid;
1635                 ieee80211_send_action(ni,
1636                     IEEE80211_ACTION_CAT_MESHPEERING,
1637                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1638                     args);
1639                 mesh_peer_timeout_setup(ni);
1640                 break;
1641         case IEEE80211_NODE_MESH_OPENRCV:
1642                 /* Wrong Link ID */
1643                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
1644                         args[0] = ni->ni_mllid;
1645                         args[1] = ni->ni_mlpid;
1646                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1647                         ieee80211_send_action(ni,
1648                             IEEE80211_ACTION_CAT_MESHPEERING,
1649                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1650                             args);
1651                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1652                         mesh_peer_timeout_setup(ni);
1653                         break;
1654                 }
1655                 /* Duplicate open, confirm again. */
1656                 args[0] = ni->ni_mlpid;
1657                 args[1] = ni->ni_mllid;
1658                 ieee80211_send_action(ni,
1659                     IEEE80211_ACTION_CAT_MESHPEERING,
1660                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1661                     args);
1662                 break;
1663         case IEEE80211_NODE_MESH_OPENSNT:
1664                 ni->ni_mllid = meshpeer->peer_llinkid;
1665                 mesh_linkchange(ni, IEEE80211_NODE_MESH_OPENRCV);
1666                 args[0] = ni->ni_mlpid;
1667                 args[1] = ni->ni_mllid;
1668                 ieee80211_send_action(ni,
1669                     IEEE80211_ACTION_CAT_MESHPEERING,
1670                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1671                     args);
1672                 /* NB: don't setup/clear any timeout */
1673                 break;
1674         case IEEE80211_NODE_MESH_CONFIRMRCV:
1675                 if (ni->ni_mlpid != meshpeer->peer_linkid ||
1676                     ni->ni_mllid != meshpeer->peer_llinkid) {
1677                         args[0] = ni->ni_mlpid;
1678                         args[1] = ni->ni_mllid;
1679                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1680                         ieee80211_send_action(ni,
1681                             IEEE80211_ACTION_CAT_MESHPEERING,
1682                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1683                             args);
1684                         mesh_linkchange(ni,
1685                             IEEE80211_NODE_MESH_HOLDING);
1686                         mesh_peer_timeout_setup(ni);
1687                         break;
1688                 }
1689                 mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
1690                 ni->ni_mllid = meshpeer->peer_llinkid;
1691                 args[0] = ni->ni_mlpid;
1692                 args[1] = ni->ni_mllid;
1693                 ieee80211_send_action(ni,
1694                     IEEE80211_ACTION_CAT_MESHPEERING,
1695                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1696                     args);
1697                 mesh_peer_timeout_stop(ni);
1698                 break;
1699         case IEEE80211_NODE_MESH_ESTABLISHED:
1700                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
1701                         args[0] = ni->ni_mllid;
1702                         args[1] = ni->ni_mlpid;
1703                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1704                         ieee80211_send_action(ni,
1705                             IEEE80211_ACTION_CAT_MESHPEERING,
1706                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1707                             args);
1708                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1709                         mesh_peer_timeout_setup(ni);
1710                         break;
1711                 }
1712                 args[0] = ni->ni_mlpid;
1713                 args[1] = ni->ni_mllid;
1714                 ieee80211_send_action(ni,
1715                     IEEE80211_ACTION_CAT_MESHPEERING,
1716                     IEEE80211_ACTION_MESHPEERING_CONFIRM,
1717                     args);
1718                 break;
1719         case IEEE80211_NODE_MESH_HOLDING:
1720                 args[0] = ni->ni_mlpid;
1721                 args[1] = meshpeer->peer_llinkid;
1722                 args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
1723                 ieee80211_send_action(ni,
1724                     IEEE80211_ACTION_CAT_MESHPEERING,
1725                     IEEE80211_ACTION_MESHPEERING_CLOSE,
1726                     args);
1727                 break;
1728         }
1729         return 0;
1730 }
1731
1732 static int
1733 mesh_recv_action_meshpeering_confirm(struct ieee80211_node *ni,
1734         const struct ieee80211_frame *wh,
1735         const uint8_t *frm, const uint8_t *efrm)
1736 {
1737         struct ieee80211vap *vap = ni->ni_vap;
1738         struct ieee80211_meshpeer_ie ie;
1739         const struct ieee80211_meshpeer_ie *meshpeer;
1740         uint16_t args[3];
1741
1742         /* +2+2+2+2 for action + code + capabilites + status code + AID */
1743         meshpeer = mesh_parse_meshpeering_action(ni, wh, frm+2+2+2+2, efrm, &ie,
1744             IEEE80211_ACTION_MESHPEERING_CONFIRM);
1745         if (meshpeer == NULL) {
1746                 return 0;
1747         }
1748
1749         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
1750             "recv PEER CONFIRM, local id 0x%x, peer id 0x%x",
1751             meshpeer->peer_llinkid, meshpeer->peer_linkid);
1752
1753         switch (ni->ni_mlstate) {
1754         case IEEE80211_NODE_MESH_OPENRCV:
1755                 mesh_linkchange(ni, IEEE80211_NODE_MESH_ESTABLISHED);
1756                 mesh_peer_timeout_stop(ni);
1757                 break;
1758         case IEEE80211_NODE_MESH_OPENSNT:
1759                 mesh_linkchange(ni, IEEE80211_NODE_MESH_CONFIRMRCV);
1760                 break;
1761         case IEEE80211_NODE_MESH_HOLDING:
1762                 args[0] = ni->ni_mlpid;
1763                 args[1] = meshpeer->peer_llinkid;
1764                 args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
1765                 ieee80211_send_action(ni,
1766                     IEEE80211_ACTION_CAT_MESHPEERING,
1767                     IEEE80211_ACTION_MESHPEERING_CLOSE,
1768                     args);
1769                 break;
1770         case IEEE80211_NODE_MESH_CONFIRMRCV:
1771                 if (ni->ni_mllid != meshpeer->peer_llinkid) {
1772                         args[0] = ni->ni_mlpid;
1773                         args[1] = ni->ni_mllid;
1774                         args[2] = IEEE80211_REASON_PEER_LINK_CANCELED;
1775                         ieee80211_send_action(ni,
1776                             IEEE80211_ACTION_CAT_MESHPEERING,
1777                             IEEE80211_ACTION_MESHPEERING_CLOSE,
1778                             args);
1779                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1780                         mesh_peer_timeout_setup(ni);
1781                 }
1782                 break;
1783         default:
1784                 IEEE80211_DISCARD(vap,
1785                     IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
1786                     wh, NULL, "received confirm in invalid state %d",
1787                     ni->ni_mlstate);
1788                 vap->iv_stats.is_rx_mgtdiscard++;
1789                 break;
1790         }
1791         return 0;
1792 }
1793
1794 static int
1795 mesh_recv_action_meshpeering_close(struct ieee80211_node *ni,
1796         const struct ieee80211_frame *wh,
1797         const uint8_t *frm, const uint8_t *efrm)
1798 {
1799         uint16_t args[3];
1800
1801         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH,
1802             ni, "%s", "recv PEER CLOSE");
1803
1804         switch (ni->ni_mlstate) {
1805         case IEEE80211_NODE_MESH_IDLE:
1806                 /* ignore */
1807                 break;
1808         case IEEE80211_NODE_MESH_OPENRCV:
1809         case IEEE80211_NODE_MESH_OPENSNT:
1810         case IEEE80211_NODE_MESH_CONFIRMRCV:
1811         case IEEE80211_NODE_MESH_ESTABLISHED:
1812                 args[0] = ni->ni_mlpid;
1813                 args[1] = ni->ni_mllid;
1814                 args[2] = IEEE80211_REASON_MESH_CLOSE_RCVD;
1815                 ieee80211_send_action(ni,
1816                     IEEE80211_ACTION_CAT_MESHPEERING,
1817                     IEEE80211_ACTION_MESHPEERING_CLOSE,
1818                     args);
1819                 mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
1820                 mesh_peer_timeout_setup(ni);
1821                 break;
1822         case IEEE80211_NODE_MESH_HOLDING:
1823                 mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
1824                 mesh_peer_timeout_setup(ni);
1825                 break;
1826         }
1827         return 0;
1828 }
1829
1830 /*
1831  * Link Metric handling.
1832  */
1833 static int
1834 mesh_recv_action_meshlmetric_req(struct ieee80211_node *ni,
1835         const struct ieee80211_frame *wh,
1836         const uint8_t *frm, const uint8_t *efrm)
1837 {
1838         uint32_t metric;
1839
1840         metric = mesh_airtime_calc(ni);
1841         ieee80211_send_action(ni,
1842             IEEE80211_ACTION_CAT_MESHLMETRIC,
1843             IEEE80211_ACTION_MESHLMETRIC_REP,
1844             &metric);
1845         return 0;
1846 }
1847
1848 static int
1849 mesh_recv_action_meshlmetric_rep(struct ieee80211_node *ni,
1850         const struct ieee80211_frame *wh,
1851         const uint8_t *frm, const uint8_t *efrm)
1852 {
1853         return 0;
1854 }
1855
1856 static int
1857 mesh_send_action(struct ieee80211_node *ni, struct mbuf *m)
1858 {
1859         struct ieee80211_bpf_params params;
1860
1861         memset(&params, 0, sizeof(params));
1862         params.ibp_pri = WME_AC_VO;
1863         params.ibp_rate0 = ni->ni_txparms->mgmtrate;
1864         /* XXX ucast/mcast */
1865         params.ibp_try0 = ni->ni_txparms->maxretry;
1866         params.ibp_power = ni->ni_txpower;
1867         return ieee80211_mgmt_output(ni, m, IEEE80211_FC0_SUBTYPE_ACTION,
1868              &params);
1869 }
1870
1871 #define ADDSHORT(frm, v) do {                   \
1872         frm[0] = (v) & 0xff;                    \
1873         frm[1] = (v) >> 8;                      \
1874         frm += 2;                               \
1875 } while (0)
1876 #define ADDWORD(frm, v) do {                    \
1877         frm[0] = (v) & 0xff;                    \
1878         frm[1] = ((v) >> 8) & 0xff;             \
1879         frm[2] = ((v) >> 16) & 0xff;            \
1880         frm[3] = ((v) >> 24) & 0xff;            \
1881         frm += 4;                               \
1882 } while (0)
1883
1884 static int
1885 mesh_send_action_meshpeering_open(struct ieee80211_node *ni,
1886         int category, int action, void *args0)
1887 {
1888         struct ieee80211vap *vap = ni->ni_vap;
1889         struct ieee80211com *ic = ni->ni_ic;
1890         uint16_t *args = args0;
1891         const struct ieee80211_rateset *rs;
1892         struct mbuf *m;
1893         uint8_t *frm;
1894
1895         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
1896             "send PEER OPEN action: localid 0x%x", args[0]);
1897
1898         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1899             "ieee80211_ref_node (%s:%u) %p<%6D> refcnt %d\n", __func__, __LINE__,
1900             ni, ni->ni_macaddr, ":", ieee80211_node_refcnt(ni)+1);
1901         ieee80211_ref_node(ni);
1902
1903         m = ieee80211_getmgtframe(&frm,
1904             ic->ic_headroom + sizeof(struct ieee80211_frame),
1905             sizeof(uint16_t)    /* action+category */
1906             + sizeof(uint16_t)  /* capabilites */
1907             + 2 + IEEE80211_RATE_SIZE
1908             + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1909             + 2 + IEEE80211_MESHID_LEN
1910             + sizeof(struct ieee80211_meshconf_ie)
1911             + sizeof(struct ieee80211_meshpeer_ie)
1912         );
1913         if (m != NULL) {
1914                 /*
1915                  * mesh peer open action frame format:
1916                  *   [1] category
1917                  *   [1] action
1918                  *   [2] capabilities
1919                  *   [tlv] rates
1920                  *   [tlv] xrates
1921                  *   [tlv] mesh id
1922                  *   [tlv] mesh conf
1923                  *   [tlv] mesh peer link mgmt
1924                  */
1925                 *frm++ = category;
1926                 *frm++ = action;
1927                 ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
1928                 rs = ieee80211_get_suprates(ic, ic->ic_curchan);
1929                 frm = ieee80211_add_rates(frm, rs);
1930                 frm = ieee80211_add_xrates(frm, rs);
1931                 frm = ieee80211_add_meshid(frm, vap);
1932                 frm = ieee80211_add_meshconf(frm, vap);
1933                 frm = ieee80211_add_meshpeer(frm, IEEE80211_MESH_PEER_LINK_OPEN,
1934                     args[0], 0, 0);
1935                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
1936                 return mesh_send_action(ni, m);
1937         } else {
1938                 vap->iv_stats.is_tx_nobuf++;
1939                 ieee80211_free_node(ni);
1940                 return ENOMEM;
1941         }
1942 }
1943
1944 static int
1945 mesh_send_action_meshpeering_confirm(struct ieee80211_node *ni,
1946         int category, int action, void *args0)
1947 {
1948         struct ieee80211vap *vap = ni->ni_vap;
1949         struct ieee80211com *ic = ni->ni_ic;
1950         uint16_t *args = args0;
1951         const struct ieee80211_rateset *rs;
1952         struct mbuf *m;
1953         uint8_t *frm;
1954
1955         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
1956             "send PEER CONFIRM action: localid 0x%x, peerid 0x%x",
1957             args[0], args[1]);
1958
1959         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
1960             "ieee80211_ref_node (%s:%u) %p<%6D> refcnt %d\n", __func__, __LINE__,
1961             ni, ni->ni_macaddr, ":", ieee80211_node_refcnt(ni)+1);
1962         ieee80211_ref_node(ni);
1963
1964         m = ieee80211_getmgtframe(&frm,
1965             ic->ic_headroom + sizeof(struct ieee80211_frame),
1966             sizeof(uint16_t)    /* action+category */
1967             + sizeof(uint16_t)  /* capabilites */
1968             + sizeof(uint16_t)  /* status code */
1969             + sizeof(uint16_t)  /* AID */
1970             + 2 + IEEE80211_RATE_SIZE
1971             + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE)
1972             + 2 + IEEE80211_MESHID_LEN
1973             + sizeof(struct ieee80211_meshconf_ie)
1974             + sizeof(struct ieee80211_meshpeer_ie)
1975         );
1976         if (m != NULL) {
1977                 /*
1978                  * mesh peer confirm action frame format:
1979                  *   [1] category
1980                  *   [1] action
1981                  *   [2] capabilities
1982                  *   [2] status code
1983                  *   [2] association id (peer ID)
1984                  *   [tlv] rates
1985                  *   [tlv] xrates
1986                  *   [tlv] mesh id
1987                  *   [tlv] mesh conf
1988                  *   [tlv] mesh peer link mgmt
1989                  */
1990                 *frm++ = category;
1991                 *frm++ = action;
1992                 ADDSHORT(frm, ieee80211_getcapinfo(vap, ni->ni_chan));
1993                 ADDSHORT(frm, 0);               /* status code */
1994                 ADDSHORT(frm, args[1]);         /* AID */
1995                 rs = ieee80211_get_suprates(ic, ic->ic_curchan);
1996                 frm = ieee80211_add_rates(frm, rs);
1997                 frm = ieee80211_add_xrates(frm, rs);
1998                 frm = ieee80211_add_meshid(frm, vap);
1999                 frm = ieee80211_add_meshconf(frm, vap);
2000                 frm = ieee80211_add_meshpeer(frm,
2001                     IEEE80211_MESH_PEER_LINK_CONFIRM,
2002                     args[0], args[1], 0);
2003                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2004                 return mesh_send_action(ni, m);
2005         } else {
2006                 vap->iv_stats.is_tx_nobuf++;
2007                 ieee80211_free_node(ni);
2008                 return ENOMEM;
2009         }
2010 }
2011
2012 static int
2013 mesh_send_action_meshpeering_close(struct ieee80211_node *ni,
2014         int category, int action, void *args0)
2015 {
2016         struct ieee80211vap *vap = ni->ni_vap;
2017         struct ieee80211com *ic = ni->ni_ic;
2018         uint16_t *args = args0;
2019         struct mbuf *m;
2020         uint8_t *frm;
2021
2022         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2023             "send PEER CLOSE action: localid 0x%x, peerid 0x%x reason %d",
2024             args[0], args[1], args[2]);
2025
2026         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2027             "ieee80211_ref_node (%s:%u) %p<%6D> refcnt %d\n", __func__, __LINE__,
2028             ni, ni->ni_macaddr, ":", ieee80211_node_refcnt(ni)+1);
2029         ieee80211_ref_node(ni);
2030
2031         m = ieee80211_getmgtframe(&frm,
2032             ic->ic_headroom + sizeof(struct ieee80211_frame),
2033             sizeof(uint16_t)    /* action+category */
2034             + sizeof(uint16_t)  /* reason code */
2035             + 2 + IEEE80211_MESHID_LEN
2036             + sizeof(struct ieee80211_meshpeer_ie)
2037         );
2038         if (m != NULL) {
2039                 /*
2040                  * mesh peer close action frame format:
2041                  *   [1] category
2042                  *   [1] action
2043                  *   [2] reason code
2044                  *   [tlv] mesh id
2045                  *   [tlv] mesh peer link mgmt
2046                  */
2047                 *frm++ = category;
2048                 *frm++ = action;
2049                 ADDSHORT(frm, args[2]);         /* reason code */
2050                 frm = ieee80211_add_meshid(frm, vap);
2051                 frm = ieee80211_add_meshpeer(frm,
2052                     IEEE80211_MESH_PEER_LINK_CLOSE,
2053                     args[0], args[1], args[2]);
2054                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2055                 return mesh_send_action(ni, m);
2056         } else {
2057                 vap->iv_stats.is_tx_nobuf++;
2058                 ieee80211_free_node(ni);
2059                 return ENOMEM;
2060         }
2061 }
2062
2063 static int
2064 mesh_send_action_meshlink_request(struct ieee80211_node *ni,
2065         int category, int action, void *arg0)
2066 {
2067         struct ieee80211vap *vap = ni->ni_vap;
2068         struct ieee80211com *ic = ni->ni_ic;
2069         struct mbuf *m;
2070         uint8_t *frm;
2071
2072         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2073             "%s", "send LINK METRIC REQUEST action");
2074
2075         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2076             "ieee80211_ref_node (%s:%u) %p<%6D> refcnt %d\n", __func__, __LINE__,
2077             ni, ni->ni_macaddr, ":", ieee80211_node_refcnt(ni)+1);
2078         ieee80211_ref_node(ni);
2079
2080         m = ieee80211_getmgtframe(&frm,
2081             ic->ic_headroom + sizeof(struct ieee80211_frame),
2082             sizeof(uint16_t)    /* action+category */
2083         );
2084         if (m != NULL) {
2085                 /*
2086                  * mesh link metric request
2087                  *   [1] category
2088                  *   [1] action
2089                  */
2090                 *frm++ = category;
2091                 *frm++ = action;
2092                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2093                 return mesh_send_action(ni, m);
2094         } else {
2095                 vap->iv_stats.is_tx_nobuf++;
2096                 ieee80211_free_node(ni);
2097                 return ENOMEM;
2098         }
2099 }
2100
2101 static int
2102 mesh_send_action_meshlink_reply(struct ieee80211_node *ni,
2103         int category, int action, void *args0)
2104 {
2105         struct ieee80211vap *vap = ni->ni_vap;
2106         struct ieee80211com *ic = ni->ni_ic;
2107         uint32_t *metric = args0;
2108         struct mbuf *m;
2109         uint8_t *frm;
2110
2111         IEEE80211_NOTE(vap, IEEE80211_MSG_ACTION | IEEE80211_MSG_MESH, ni,
2112             "send LINK METRIC REPLY action: metric 0x%x", *metric);
2113
2114         IEEE80211_DPRINTF(vap, IEEE80211_MSG_NODE,
2115             "ieee80211_ref_node (%s:%u) %p<%6D> refcnt %d\n", __func__, __LINE__,
2116             ni, ni->ni_macaddr, ":", ieee80211_node_refcnt(ni)+1);
2117         ieee80211_ref_node(ni);
2118
2119         m = ieee80211_getmgtframe(&frm,
2120             ic->ic_headroom + sizeof(struct ieee80211_frame),
2121             sizeof(uint16_t)    /* action+category */
2122             + sizeof(struct ieee80211_meshlmetric_ie)
2123         );
2124         if (m != NULL) {
2125                 /*
2126                  * mesh link metric reply
2127                  *   [1] category
2128                  *   [1] action
2129                  *   [tlv] mesh link metric
2130                  */
2131                 *frm++ = category;
2132                 *frm++ = action;
2133                 frm = ieee80211_add_meshlmetric(frm, *metric);
2134                 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
2135                 return mesh_send_action(ni, m);
2136         } else {
2137                 vap->iv_stats.is_tx_nobuf++;
2138                 ieee80211_free_node(ni);
2139                 return ENOMEM;
2140         }
2141 }
2142
2143 static void
2144 mesh_peer_timeout_setup(struct ieee80211_node *ni)
2145 {
2146         switch (ni->ni_mlstate) {
2147         case IEEE80211_NODE_MESH_HOLDING:
2148                 ni->ni_mltval = ieee80211_mesh_holdingtimeout;
2149                 break;
2150         case IEEE80211_NODE_MESH_CONFIRMRCV:
2151                 ni->ni_mltval = ieee80211_mesh_confirmtimeout;
2152                 break;
2153         case IEEE80211_NODE_MESH_IDLE:
2154                 ni->ni_mltval = 0;
2155                 break;
2156         default:
2157                 ni->ni_mltval = ieee80211_mesh_retrytimeout;
2158                 break;
2159         }
2160         if (ni->ni_mltval) {
2161                 callout_reset(&ni->ni_mltimer, ni->ni_mltval,
2162                               mesh_peer_timeout_callout, ni);
2163         }
2164 }
2165
2166 /*
2167  * Same as above but backoffs timer statisically 50%.
2168  */
2169 static void
2170 mesh_peer_timeout_backoff(struct ieee80211_node *ni)
2171 {
2172         uint32_t r;
2173
2174         r = karc4random();
2175         ni->ni_mltval += r % ni->ni_mltval;
2176         callout_reset(&ni->ni_mltimer, ni->ni_mltval,
2177                       mesh_peer_timeout_callout, ni);
2178 }
2179
2180 static __inline void
2181 mesh_peer_timeout_stop(struct ieee80211_node *ni)
2182 {
2183         callout_stop(&ni->ni_mltimer);
2184 }
2185
2186 /*
2187  * Mesh Peer Link Management FSM timeout handling.
2188  */
2189 static void
2190 mesh_peer_timeout_callout(void *arg)
2191 {
2192         struct ieee80211_node *ni = (struct ieee80211_node *)arg;
2193         uint16_t args[3];
2194
2195         wlan_serialize_enter();
2196         IEEE80211_NOTE(ni->ni_vap, IEEE80211_MSG_MESH,
2197             ni, "mesh link timeout, state %d, retry counter %d",
2198             ni->ni_mlstate, ni->ni_mlrcnt);
2199
2200         switch (ni->ni_mlstate) {
2201         case IEEE80211_NODE_MESH_IDLE:
2202         case IEEE80211_NODE_MESH_ESTABLISHED:
2203                 break;
2204         case IEEE80211_NODE_MESH_OPENSNT:
2205         case IEEE80211_NODE_MESH_OPENRCV:
2206                 if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
2207                         args[0] = ni->ni_mlpid;
2208                         args[2] = IEEE80211_REASON_MESH_MAX_RETRIES;
2209                         ieee80211_send_action(ni,
2210                             IEEE80211_ACTION_CAT_MESHPEERING,
2211                             IEEE80211_ACTION_MESHPEERING_CLOSE, args);
2212                         ni->ni_mlrcnt = 0;
2213                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2214                         mesh_peer_timeout_setup(ni);
2215                 } else {
2216                         args[0] = ni->ni_mlpid;
2217                         ieee80211_send_action(ni,
2218                             IEEE80211_ACTION_CAT_MESHPEERING,
2219                             IEEE80211_ACTION_MESHPEERING_OPEN, args);
2220                         ni->ni_mlrcnt++;
2221                         mesh_peer_timeout_backoff(ni);
2222                 }
2223                 break;
2224         case IEEE80211_NODE_MESH_CONFIRMRCV:
2225                 if (ni->ni_mlrcnt == ieee80211_mesh_maxretries) {
2226                         args[0] = ni->ni_mlpid;
2227                         args[2] = IEEE80211_REASON_MESH_CONFIRM_TIMEOUT;
2228                         ieee80211_send_action(ni,
2229                             IEEE80211_ACTION_CAT_MESHPEERING,
2230                             IEEE80211_ACTION_MESHPEERING_CLOSE, args);
2231                         ni->ni_mlrcnt = 0;
2232                         mesh_linkchange(ni, IEEE80211_NODE_MESH_HOLDING);
2233                         mesh_peer_timeout_setup(ni);
2234                 } else {
2235                         ni->ni_mlrcnt++;
2236                         mesh_peer_timeout_setup(ni);
2237                 }
2238                 break;
2239         case IEEE80211_NODE_MESH_HOLDING:
2240                 mesh_linkchange(ni, IEEE80211_NODE_MESH_IDLE);
2241                 break;
2242         }
2243         wlan_serialize_exit();
2244 }
2245
2246 static int
2247 mesh_verify_meshid(struct ieee80211vap *vap, const uint8_t *ie)
2248 {
2249         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2250
2251         if (ie == NULL || ie[1] != ms->ms_idlen)
2252                 return 1;
2253         return memcmp(ms->ms_id, ie + 2, ms->ms_idlen);
2254 }
2255
2256 /*
2257  * Check if we are using the same algorithms for this mesh.
2258  */
2259 static int
2260 mesh_verify_meshconf(struct ieee80211vap *vap, const uint8_t *ie)
2261 {
2262         const struct ieee80211_meshconf_ie *meshconf =
2263             (const struct ieee80211_meshconf_ie *) ie;
2264         const struct ieee80211_mesh_state *ms = vap->iv_mesh;
2265         uint16_t cap;
2266
2267         if (meshconf == NULL)
2268                 return 1;
2269         if (meshconf->conf_pselid != ms->ms_ppath->mpp_ie) {
2270                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2271                     "unknown path selection algorithm: 0x%x\n",
2272                     meshconf->conf_pselid);
2273                 return 1;
2274         }
2275         if (meshconf->conf_pmetid != ms->ms_pmetric->mpm_ie) {
2276                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2277                     "unknown path metric algorithm: 0x%x\n",
2278                     meshconf->conf_pmetid);
2279                 return 1;
2280         }
2281         if (meshconf->conf_ccid != 0) {
2282                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2283                     "unknown congestion control algorithm: 0x%x\n",
2284                     meshconf->conf_ccid);
2285                 return 1;
2286         }
2287         if (meshconf->conf_syncid != IEEE80211_MESHCONF_SYNC_NEIGHOFF) {
2288                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2289                     "unknown sync algorithm: 0x%x\n",
2290                     meshconf->conf_syncid);
2291                 return 1;
2292         }
2293         if (meshconf->conf_authid != 0) {
2294                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2295                     "unknown auth auth algorithm: 0x%x\n",
2296                     meshconf->conf_pselid);
2297                 return 1;
2298         }
2299         /* NB: conf_cap is only read correctly here */
2300         cap = LE_READ_2(&meshconf->conf_cap);
2301         /* Not accepting peers */
2302         if (!(cap & IEEE80211_MESHCONF_CAP_AP)) {
2303                 IEEE80211_DPRINTF(vap, IEEE80211_MSG_MESH,
2304                     "not accepting peers: 0x%x\n", meshconf->conf_cap);
2305                 return 1;
2306         }
2307         return 0;
2308 }
2309
2310 static int
2311 mesh_verify_meshpeer(struct ieee80211vap *vap, uint8_t subtype,
2312     const uint8_t *ie)
2313 {
2314         const struct ieee80211_meshpeer_ie *meshpeer =
2315             (const struct ieee80211_meshpeer_ie *) ie;
2316
2317         if (meshpeer == NULL || meshpeer->peer_len < 6 ||
2318             meshpeer->peer_len > 10)
2319                 return 1;
2320         switch (subtype) {
2321         case IEEE80211_MESH_PEER_LINK_OPEN:
2322                 if (meshpeer->peer_len != 6)
2323                         return 1;
2324                 break;
2325         case IEEE80211_MESH_PEER_LINK_CONFIRM:
2326                 if (meshpeer->peer_len != 8)
2327                         return 1;
2328                 break;
2329         case IEEE80211_MESH_PEER_LINK_CLOSE:
2330                 if (meshpeer->peer_len < 8)
2331                         return 1;
2332                 if (meshpeer->peer_len == 8 && meshpeer->peer_linkid != 0)
2333                         return 1;
2334                 if (meshpeer->peer_rcode == 0)
2335                         return 1;
2336                 break;
2337         }
2338         return 0;
2339 }
2340
2341 /*
2342  * Add a Mesh ID IE to a frame.
2343  */
2344 uint8_t *
2345 ieee80211_add_meshid(uint8_t *frm, struct ieee80211vap *vap)
2346 {
2347         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2348
2349         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a mbss vap"));
2350
2351         *frm++ = IEEE80211_ELEMID_MESHID;
2352         *frm++ = ms->ms_idlen;
2353         memcpy(frm, ms->ms_id, ms->ms_idlen);
2354         return frm + ms->ms_idlen;
2355 }
2356
2357 /*
2358  * Add a Mesh Configuration IE to a frame.
2359  * For now just use HWMP routing, Airtime link metric, Null Congestion
2360  * Signaling, Null Sync Protocol and Null Authentication.
2361  */
2362 uint8_t *
2363 ieee80211_add_meshconf(uint8_t *frm, struct ieee80211vap *vap)
2364 {
2365         const struct ieee80211_mesh_state *ms = vap->iv_mesh;
2366         uint16_t caps;
2367
2368         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
2369
2370         *frm++ = IEEE80211_ELEMID_MESHCONF;
2371         *frm++ = sizeof(struct ieee80211_meshconf_ie) - 2;
2372         *frm++ = ms->ms_ppath->mpp_ie;          /* path selection */
2373         *frm++ = ms->ms_pmetric->mpm_ie;        /* link metric */
2374         *frm++ = IEEE80211_MESHCONF_CC_DISABLED;
2375         *frm++ = IEEE80211_MESHCONF_SYNC_NEIGHOFF;
2376         *frm++ = IEEE80211_MESHCONF_AUTH_DISABLED;
2377         /* NB: set the number of neighbors before the rest */
2378         *frm = (ms->ms_neighbors > 15 ? 15 : ms->ms_neighbors) << 1;
2379         if (ms->ms_flags & IEEE80211_MESHFLAGS_PORTAL)
2380                 *frm |= IEEE80211_MESHCONF_FORM_MP;
2381         frm += 1;
2382         caps = 0;
2383         if (ms->ms_flags & IEEE80211_MESHFLAGS_AP)
2384                 caps |= IEEE80211_MESHCONF_CAP_AP;
2385         if (ms->ms_flags & IEEE80211_MESHFLAGS_FWD)
2386                 caps |= IEEE80211_MESHCONF_CAP_FWRD;
2387         ADDSHORT(frm, caps);
2388         return frm;
2389 }
2390
2391 /*
2392  * Add a Mesh Peer Management IE to a frame.
2393  */
2394 uint8_t *
2395 ieee80211_add_meshpeer(uint8_t *frm, uint8_t subtype, uint16_t localid,
2396     uint16_t peerid, uint16_t reason)
2397 {
2398         /* XXX change for AH */
2399         static const uint8_t meshpeerproto[4] = IEEE80211_MESH_PEER_PROTO;
2400
2401         KASSERT(localid != 0, ("localid == 0"));
2402
2403         *frm++ = IEEE80211_ELEMID_MESHPEER;
2404         switch (subtype) {
2405         case IEEE80211_MESH_PEER_LINK_OPEN:
2406                 *frm++ = 6;             /* length */
2407                 memcpy(frm, meshpeerproto, 4);
2408                 frm += 4;
2409                 ADDSHORT(frm, localid); /* local ID */
2410                 break;
2411         case IEEE80211_MESH_PEER_LINK_CONFIRM:
2412                 KASSERT(peerid != 0, ("sending peer confirm without peer id"));
2413                 *frm++ = 8;             /* length */
2414                 memcpy(frm, meshpeerproto, 4);
2415                 frm += 4;
2416                 ADDSHORT(frm, localid); /* local ID */
2417                 ADDSHORT(frm, peerid);  /* peer ID */
2418                 break;
2419         case IEEE80211_MESH_PEER_LINK_CLOSE:
2420                 if (peerid)
2421                         *frm++ = 10;    /* length */
2422                 else
2423                         *frm++ = 8;     /* length */
2424                 memcpy(frm, meshpeerproto, 4);
2425                 frm += 4;
2426                 ADDSHORT(frm, localid); /* local ID */
2427                 if (peerid)
2428                         ADDSHORT(frm, peerid);  /* peer ID */
2429                 ADDSHORT(frm, reason);
2430                 break;
2431         }
2432         return frm;
2433 }
2434
2435 /*
2436  * Compute an Airtime Link Metric for the link with this node.
2437  *
2438  * Based on Draft 3.0 spec (11B.10, p.149).
2439  */
2440 /*
2441  * Max 802.11s overhead.
2442  */
2443 #define IEEE80211_MESH_MAXOVERHEAD \
2444         (sizeof(struct ieee80211_qosframe_addr4) \
2445          + sizeof(struct ieee80211_meshcntl_ae11) \
2446         + sizeof(struct llc) \
2447         + IEEE80211_ADDR_LEN \
2448         + IEEE80211_WEP_IVLEN \
2449         + IEEE80211_WEP_KIDLEN \
2450         + IEEE80211_WEP_CRCLEN \
2451         + IEEE80211_WEP_MICLEN \
2452         + IEEE80211_CRC_LEN)
2453 uint32_t
2454 mesh_airtime_calc(struct ieee80211_node *ni)
2455 {
2456 #define M_BITS 8
2457 #define S_FACTOR (2 * M_BITS)
2458         struct ieee80211com *ic = ni->ni_ic;
2459         struct ifnet *ifp = ni->ni_vap->iv_ifp;
2460         const static int nbits = 8192 << M_BITS;
2461         uint32_t overhead, rate, errrate;
2462         uint64_t res;
2463
2464         /* Time to transmit a frame */
2465         rate = ni->ni_txrate;
2466         overhead = ieee80211_compute_duration(ic->ic_rt,
2467             ifp->if_mtu + IEEE80211_MESH_MAXOVERHEAD, rate, 0) << M_BITS;
2468         /* Error rate in percentage */
2469         /* XXX assuming small failures are ok */
2470         errrate = (((ifp->if_oerrors +
2471             ifp->if_ierrors) / 100) << M_BITS) / 100;
2472         res = (overhead + (nbits / rate)) *
2473             ((1 << S_FACTOR) / ((1 << M_BITS) - errrate));
2474
2475         return (uint32_t)(res >> S_FACTOR);
2476 #undef M_BITS
2477 #undef S_FACTOR
2478 }
2479
2480 /*
2481  * Add a Mesh Link Metric report IE to a frame.
2482  */
2483 uint8_t *
2484 ieee80211_add_meshlmetric(uint8_t *frm, uint32_t metric)
2485 {
2486         *frm++ = IEEE80211_ELEMID_MESHLINK;
2487         *frm++ = 4;
2488         ADDWORD(frm, metric);
2489         return frm;
2490 }
2491 #undef ADDSHORT
2492 #undef ADDWORD
2493
2494 /*
2495  * Initialize any mesh-specific node state.
2496  */
2497 void
2498 ieee80211_mesh_node_init(struct ieee80211vap *vap, struct ieee80211_node *ni)
2499 {
2500         ni->ni_flags |= IEEE80211_NODE_QOS;
2501         callout_init_mp(&ni->ni_mltimer);
2502 }
2503
2504 /*
2505  * Cleanup any mesh-specific node state.
2506  */
2507 void
2508 ieee80211_mesh_node_cleanup(struct ieee80211_node *ni)
2509 {
2510         struct ieee80211vap *vap = ni->ni_vap;
2511         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2512
2513         callout_stop(&ni->ni_mltimer);
2514         /* NB: short-circuit callbacks after mesh_vdetach */
2515         if (vap->iv_mesh != NULL)
2516                 ms->ms_ppath->mpp_peerdown(ni);
2517 }
2518
2519 void
2520 ieee80211_parse_meshid(struct ieee80211_node *ni, const uint8_t *ie)
2521 {
2522         ni->ni_meshidlen = ie[1];
2523         memcpy(ni->ni_meshid, ie + 2, ie[1]);
2524 }
2525
2526 /*
2527  * Setup mesh-specific node state on neighbor discovery.
2528  */
2529 void
2530 ieee80211_mesh_init_neighbor(struct ieee80211_node *ni,
2531         const struct ieee80211_frame *wh,
2532         const struct ieee80211_scanparams *sp)
2533 {
2534         ieee80211_parse_meshid(ni, sp->meshid);
2535 }
2536
2537 void
2538 ieee80211_mesh_update_beacon(struct ieee80211vap *vap,
2539         struct ieee80211_beacon_offsets *bo)
2540 {
2541         KASSERT(vap->iv_opmode == IEEE80211_M_MBSS, ("not a MBSS vap"));
2542
2543         if (isset(bo->bo_flags, IEEE80211_BEACON_MESHCONF)) {
2544                 (void)ieee80211_add_meshconf(bo->bo_meshconf, vap);
2545                 clrbit(bo->bo_flags, IEEE80211_BEACON_MESHCONF);
2546         }
2547 }
2548
2549 static int
2550 mesh_ioctl_get80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
2551 {
2552         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2553         uint8_t tmpmeshid[IEEE80211_NWID_LEN];
2554         struct ieee80211_mesh_route *rt;
2555         struct ieee80211req_mesh_route *imr;
2556         size_t len, off;
2557         uint8_t *p;
2558         int error;
2559
2560         if (vap->iv_opmode != IEEE80211_M_MBSS)
2561                 return ENOSYS;
2562
2563         error = 0;
2564         switch (ireq->i_type) {
2565         case IEEE80211_IOC_MESH_ID:
2566                 ireq->i_len = ms->ms_idlen;
2567                 memcpy(tmpmeshid, ms->ms_id, ireq->i_len);
2568                 error = copyout(tmpmeshid, ireq->i_data, ireq->i_len);
2569                 break;
2570         case IEEE80211_IOC_MESH_AP:
2571                 ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_AP) != 0;
2572                 break;
2573         case IEEE80211_IOC_MESH_FWRD:
2574                 ireq->i_val = (ms->ms_flags & IEEE80211_MESHFLAGS_FWD) != 0;
2575                 break;
2576         case IEEE80211_IOC_MESH_TTL:
2577                 ireq->i_val = ms->ms_ttl;
2578                 break;
2579         case IEEE80211_IOC_MESH_RTCMD:
2580                 switch (ireq->i_val) {
2581                 case IEEE80211_MESH_RTCMD_LIST:
2582                         len = 0;
2583                         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
2584                                 len += sizeof(*imr);
2585                         }
2586                         if (len > ireq->i_len || ireq->i_len < sizeof(*imr)) {
2587                                 ireq->i_len = len;
2588                                 return ENOMEM;
2589                         }
2590                         ireq->i_len = len;
2591                         /* XXX M_WAIT? */
2592                         p = kmalloc(len, M_TEMP, M_INTWAIT | M_ZERO);
2593                         if (p == NULL)
2594                                 return ENOMEM;
2595                         off = 0;
2596                         TAILQ_FOREACH(rt, &ms->ms_routes, rt_next) {
2597                                 if (off >= len)
2598                                         break;
2599                                 imr = (struct ieee80211req_mesh_route *)
2600                                     (p + off);
2601                                 imr->imr_flags = rt->rt_flags;
2602                                 IEEE80211_ADDR_COPY(imr->imr_dest,
2603                                     rt->rt_dest);
2604                                 IEEE80211_ADDR_COPY(imr->imr_nexthop,
2605                                     rt->rt_nexthop);
2606                                 imr->imr_metric = rt->rt_metric;
2607                                 imr->imr_nhops = rt->rt_nhops;
2608                                 imr->imr_lifetime = rt->rt_lifetime;
2609                                 imr->imr_lastmseq = rt->rt_lastmseq;
2610                                 off += sizeof(*imr);
2611                         }
2612                         error = copyout(p, (uint8_t *)ireq->i_data,
2613                             ireq->i_len);
2614                         kfree(p, M_TEMP);
2615                         break;
2616                 case IEEE80211_MESH_RTCMD_FLUSH:
2617                 case IEEE80211_MESH_RTCMD_ADD:
2618                 case IEEE80211_MESH_RTCMD_DELETE:
2619                         return EINVAL;
2620                 default:
2621                         return ENOSYS;
2622                 }
2623                 break;
2624         case IEEE80211_IOC_MESH_PR_METRIC:
2625                 len = strlen(ms->ms_pmetric->mpm_descr);
2626                 if (ireq->i_len < len)
2627                         return EINVAL;
2628                 ireq->i_len = len;
2629                 error = copyout(ms->ms_pmetric->mpm_descr,
2630                     (uint8_t *)ireq->i_data, len);
2631                 break;
2632         case IEEE80211_IOC_MESH_PR_PATH:
2633                 len = strlen(ms->ms_ppath->mpp_descr);
2634                 if (ireq->i_len < len)
2635                         return EINVAL;
2636                 ireq->i_len = len;
2637                 error = copyout(ms->ms_ppath->mpp_descr,
2638                     (uint8_t *)ireq->i_data, len);
2639                 break;
2640         default:
2641                 return ENOSYS;
2642         }
2643
2644         return error;
2645 }
2646 IEEE80211_IOCTL_GET(mesh, mesh_ioctl_get80211);
2647
2648 static int
2649 mesh_ioctl_set80211(struct ieee80211vap *vap, struct ieee80211req *ireq)
2650 {
2651         struct ieee80211_mesh_state *ms = vap->iv_mesh;
2652         uint8_t tmpmeshid[IEEE80211_NWID_LEN];
2653         uint8_t tmpaddr[IEEE80211_ADDR_LEN];
2654         char tmpproto[IEEE80211_MESH_PROTO_DSZ];
2655         int error;
2656
2657         if (vap->iv_opmode != IEEE80211_M_MBSS)
2658                 return ENOSYS;
2659
2660         error = 0;
2661         switch (ireq->i_type) {
2662         case IEEE80211_IOC_MESH_ID:
2663                 if (ireq->i_val != 0 || ireq->i_len > IEEE80211_MESHID_LEN)
2664                         return EINVAL;
2665                 error = copyin(ireq->i_data, tmpmeshid, ireq->i_len);
2666                 if (error != 0)
2667                         break;
2668                 memset(ms->ms_id, 0, IEEE80211_NWID_LEN);
2669                 ms->ms_idlen = ireq->i_len;
2670                 memcpy(ms->ms_id, tmpmeshid, ireq->i_len);
2671                 error = ENETRESET;
2672                 break;
2673         case IEEE80211_IOC_MESH_AP:
2674                 if (ireq->i_val)
2675                         ms->ms_flags |= IEEE80211_MESHFLAGS_AP;
2676                 else
2677                         ms->ms_flags &= ~IEEE80211_MESHFLAGS_AP;
2678                 error = ENETRESET;
2679                 break;
2680         case IEEE80211_IOC_MESH_FWRD:
2681                 if (ireq->i_val)
2682                         ms->ms_flags |= IEEE80211_MESHFLAGS_FWD;
2683                 else
2684                         ms->ms_flags &= ~IEEE80211_MESHFLAGS_FWD;
2685                 break;
2686         case IEEE80211_IOC_MESH_TTL:
2687                 ms->ms_ttl = (uint8_t) ireq->i_val;
2688                 break;
2689         case IEEE80211_IOC_MESH_RTCMD:
2690                 switch (ireq->i_val) {
2691                 case IEEE80211_MESH_RTCMD_LIST:
2692                         return EINVAL;
2693                 case IEEE80211_MESH_RTCMD_FLUSH:
2694                         ieee80211_mesh_rt_flush(vap);
2695                         break;
2696                 case IEEE80211_MESH_RTCMD_ADD:
2697                         if (IEEE80211_ADDR_EQ(vap->iv_myaddr, ireq->i_data) ||
2698                             IEEE80211_ADDR_EQ(broadcastaddr, ireq->i_data))
2699                                 return EINVAL;
2700                         error = copyin(ireq->i_data, &tmpaddr,
2701                             IEEE80211_ADDR_LEN);
2702                         if (error == 0)
2703                                 ieee80211_mesh_discover(vap, tmpaddr, NULL);
2704                         break;
2705                 case IEEE80211_MESH_RTCMD_DELETE:
2706                         ieee80211_mesh_rt_del(vap, ireq->i_data);
2707                         break;
2708                 default:
2709                         return ENOSYS;
2710                 }
2711                 break;
2712         case IEEE80211_IOC_MESH_PR_METRIC:
2713                 error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
2714                 if (error == 0) {
2715                         error = mesh_select_proto_metric(vap, tmpproto);
2716                         if (error == 0)
2717                                 error = ENETRESET;
2718                 }
2719                 break;
2720         case IEEE80211_IOC_MESH_PR_PATH:
2721                 error = copyin(ireq->i_data, tmpproto, sizeof(tmpproto));
2722                 if (error == 0) {
2723                         error = mesh_select_proto_path(vap, tmpproto);
2724                         if (error == 0)
2725                                 error = ENETRESET;
2726                 }
2727                 break;
2728         default:
2729                 return ENOSYS;
2730         }
2731         return error;
2732 }
2733 IEEE80211_IOCTL_SET(mesh, mesh_ioctl_set80211);