2 * Copyright (c) 2001 Atsushi Onoe
3 * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
17 * Alternatively, this software may be distributed under the terms of the
18 * GNU General Public License ("GPL") version 2 as published by the Free
19 * Software Foundation.
21 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
25 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
26 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
27 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
28 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
29 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
30 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
32 * $FreeBSD: src/sys/net80211/ieee80211_output.c,v 1.10 2004/04/02 23:25:39 sam Exp $
33 * $DragonFly: src/sys/netproto/802_11/Attic/ieee80211_output.c,v 1.1 2004/07/26 16:30:17 joerg Exp $
38 #include <sys/param.h>
39 #include <sys/systm.h>
41 #include <sys/malloc.h>
42 #include <sys/kernel.h>
43 #include <sys/socket.h>
44 #include <sys/sockio.h>
45 #include <sys/endian.h>
46 #include <sys/errno.h>
49 #include <sys/sysctl.h>
51 #include <machine/atomic.h>
54 #include <net/if_dl.h>
55 #include <net/if_media.h>
56 #include <net/if_arp.h>
57 #include <net/ethernet.h>
58 #include <net/if_llc.h>
60 #include <netproto/802_11/ieee80211_var.h>
65 #include <netinet/in.h>
66 #include <netinet/if_ether.h>
70 * Send a management frame to the specified node. The node pointer
71 * must have a reference as the pointer will be passed to the driver
72 * and potentially held for a long time. If the frame is successfully
73 * dispatched to the driver, then it is responsible for freeing the
74 * reference (and potentially free'ing up any associated storage).
77 ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni,
78 struct mbuf *m, int type)
80 struct ieee80211com *ic = (void *)ifp;
81 struct ieee80211_frame *wh;
83 KASSERT(ni != NULL, ("null node"));
87 * Yech, hack alert! We want to pass the node down to the
88 * driver's start routine. If we don't do so then the start
89 * routine must immediately look it up again and that can
90 * cause a lock order reversal if, for example, this frame
91 * is being sent because the station is being timedout and
92 * the frame being sent is a DEAUTH message. We could stick
93 * this in an m_tag and tack that on to the mbuf. However
94 * that's rather expensive to do for every frame so instead
95 * we stuff it in the rcvif field since outbound frames do
96 * not (presently) use this.
98 M_PREPEND(m, sizeof(struct ieee80211_frame), MB_DONTWAIT);
101 KASSERT(m->m_pkthdr.rcvif == NULL, ("rcvif not null"));
102 m->m_pkthdr.rcvif = (void *)ni;
104 wh = mtod(m, struct ieee80211_frame *);
105 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
106 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
107 *(uint16_t *)wh->i_dur = 0;
108 *(uint16_t *)wh->i_seq =
109 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
111 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
112 IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
113 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
115 if (ifp->if_flags & IFF_DEBUG) {
116 /* avoid to print too many frames */
117 if (ic->ic_opmode == IEEE80211_M_IBSS ||
118 #ifdef IEEE80211_DEBUG
119 ieee80211_debug > 1 ||
121 (type & IEEE80211_FC0_SUBTYPE_MASK) !=
122 IEEE80211_FC0_SUBTYPE_PROBE_RESP)
123 if_printf(ifp, "sending %s to %6D on channel %u\n",
124 ieee80211_mgt_subtype_name[
125 (type & IEEE80211_FC0_SUBTYPE_MASK)
126 >> IEEE80211_FC0_SUBTYPE_SHIFT],
128 ieee80211_chan2ieee(ic, ni->ni_chan));
131 IF_ENQUEUE(&ic->ic_mgtq, m);
133 (*ifp->if_start)(ifp);
138 * Encapsulate an outbound data frame. The mbuf chain is updated and
139 * a reference to the destination node is returned. If an error is
140 * encountered NULL is returned and the node reference will also be NULL.
142 * NB: The caller is responsible for free'ing a returned node reference.
143 * The convention is ic_bss is not reference counted; the caller must
147 ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni)
149 struct ieee80211com *ic = (void *)ifp;
150 struct ether_header eh;
151 struct ieee80211_frame *wh;
152 struct ieee80211_node *ni = NULL;
155 if (m->m_len < sizeof(struct ether_header)) {
156 m = m_pullup(m, sizeof(struct ether_header));
158 ic->ic_stats.is_tx_nombuf++;
162 memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
164 ni = ieee80211_find_txnode(ic, eh.ether_dhost);
166 IEEE80211_DPRINTF(("%s: no node for dst %6D, discard frame\n",
167 __func__, eh.ether_dhost, ":"));
168 ic->ic_stats.is_tx_nonode++;
173 m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
174 llc = mtod(m, struct llc *);
175 llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
176 llc->llc_control = LLC_UI;
177 llc->llc_snap.org_code[0] = 0;
178 llc->llc_snap.org_code[1] = 0;
179 llc->llc_snap.org_code[2] = 0;
180 llc->llc_snap.ether_type = eh.ether_type;
181 M_PREPEND(m, sizeof(struct ieee80211_frame), MB_DONTWAIT);
183 ic->ic_stats.is_tx_nombuf++;
186 wh = mtod(m, struct ieee80211_frame *);
187 wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
188 *(uint16_t *)wh->i_dur = 0;
189 *(uint16_t *)wh->i_seq =
190 htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
192 switch (ic->ic_opmode) {
193 case IEEE80211_M_STA:
194 wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
195 IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
196 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
197 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
199 case IEEE80211_M_IBSS:
200 case IEEE80211_M_AHDEMO:
201 wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
202 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
203 IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
204 IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
206 case IEEE80211_M_HOSTAP:
207 wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
208 IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
209 IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
210 IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
212 case IEEE80211_M_MONITOR:
220 if (ni && ni != ic->ic_bss)
221 ieee80211_free_node(ic, ni);
227 * Add a supported rates element id to a frame.
230 ieee80211_add_rates(uint8_t *frm, const struct ieee80211_rateset *rs)
234 *frm++ = IEEE80211_ELEMID_RATES;
235 nrates = rs->rs_nrates;
236 if (nrates > IEEE80211_RATE_SIZE)
237 nrates = IEEE80211_RATE_SIZE;
239 memcpy(frm, rs->rs_rates, nrates);
244 * Add an extended supported rates element id to a frame.
247 ieee80211_add_xrates(uint8_t *frm, const struct ieee80211_rateset *rs)
250 * Add an extended supported rates element if operating in 11g mode.
252 if (rs->rs_nrates > IEEE80211_RATE_SIZE) {
253 int nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
254 *frm++ = IEEE80211_ELEMID_XRATES;
256 memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
263 * Add an ssid elemet to a frame.
266 ieee80211_add_ssid(uint8_t *frm, const uint8_t *ssid, u_int len)
268 *frm++ = IEEE80211_ELEMID_SSID;
270 memcpy(frm, ssid, len);
275 ieee80211_getmbuf(int flags, int type, u_int pktlen)
279 KASSERT(pktlen <= MCLBYTES, ("802.11 packet too large: %u", pktlen));
281 MGETHDR(m, flags, type);
283 m = m_getcl(flags, type, M_PKTHDR);
288 * Send a management frame. The node is for the destination (or ic_bss
289 * when in station mode). Nodes other than ic_bss have their reference
290 * count bumped to reflect our use for an indeterminant time.
293 ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
296 #define senderr(_x, _v) do { ic->ic_stats._v++; ret = _x; goto bad; } while (0)
297 struct ifnet *ifp = &ic->ic_if;
300 enum ieee80211_phymode mode;
304 KASSERT(ni != NULL, ("null node"));
307 * Hold a reference on the node so it doesn't go away until after
308 * the xmit is complete all the way in the driver. On error we
309 * will remove our reference.
311 if (ni != ic->ic_bss)
312 ieee80211_ref_node(ni);
315 case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
319 * [tlv] supported rates
320 * [tlv] extended supported rates
322 m = ieee80211_getmbuf(MB_DONTWAIT, MT_DATA,
323 2 + ic->ic_des_esslen
324 + 2 + IEEE80211_RATE_SIZE
325 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
327 senderr(ENOMEM, is_tx_nombuf);
328 m->m_data += sizeof(struct ieee80211_frame);
329 frm = mtod(m, uint8_t *);
330 frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen);
331 mode = ieee80211_chan2mode(ic, ni->ni_chan);
332 frm = ieee80211_add_rates(frm, &ic->ic_sup_rates[mode]);
333 frm = ieee80211_add_xrates(frm, &ic->ic_sup_rates[mode]);
334 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
336 timer = IEEE80211_TRANS_WAIT;
339 case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
341 * probe response frame format
343 * [2] beacon interval
344 * [2] cabability information
346 * [tlv] supported rates
347 * [tlv] parameter set (FH/DS)
348 * [tlv] parameter set (IBSS)
349 * [tlv] extended supported rates
351 m = ieee80211_getmbuf(MB_DONTWAIT, MT_DATA,
354 + 2 + IEEE80211_RATE_SIZE
355 + (ic->ic_phytype == IEEE80211_T_FH ? 7 : 3)
357 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
359 senderr(ENOMEM, is_tx_nombuf);
360 m->m_data += sizeof(struct ieee80211_frame);
361 frm = mtod(m, uint8_t *);
363 memset(frm, 0, 8); /* timestamp should be filled later */
365 *(uint16_t *)frm = htole16(ic->ic_bss->ni_intval);
367 if (ic->ic_opmode == IEEE80211_M_IBSS)
368 capinfo = IEEE80211_CAPINFO_IBSS;
370 capinfo = IEEE80211_CAPINFO_ESS;
371 if (ic->ic_flags & IEEE80211_F_WEPON)
372 capinfo |= IEEE80211_CAPINFO_PRIVACY;
373 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
374 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
375 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
376 *(uint16_t *)frm = htole16(capinfo);
379 frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
380 ic->ic_bss->ni_esslen);
381 frm = ieee80211_add_rates(frm, &ic->ic_bss->ni_rates);
383 if (ic->ic_phytype == IEEE80211_T_FH) {
384 *frm++ = IEEE80211_ELEMID_FHPARMS;
386 *frm++ = ni->ni_fhdwell & 0x00ff;
387 *frm++ = (ni->ni_fhdwell >> 8) & 0x00ff;
388 *frm++ = IEEE80211_FH_CHANSET(
389 ieee80211_chan2ieee(ic, ni->ni_chan));
390 *frm++ = IEEE80211_FH_CHANPAT(
391 ieee80211_chan2ieee(ic, ni->ni_chan));
392 *frm++ = ni->ni_fhindex;
394 *frm++ = IEEE80211_ELEMID_DSPARMS;
396 *frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
399 if (ic->ic_opmode == IEEE80211_M_IBSS) {
400 *frm++ = IEEE80211_ELEMID_IBSSPARMS;
402 *frm++ = 0; *frm++ = 0; /* TODO: ATIM window */
403 } else { /* IEEE80211_M_HOSTAP */
405 *frm++ = IEEE80211_ELEMID_TIM;
406 *frm++ = 4; /* length */
407 *frm++ = 0; /* DTIM count */
408 *frm++ = 1; /* DTIM period */
409 *frm++ = 0; /* bitmap control */
410 *frm++ = 0; /* Partial Virtual Bitmap (variable length) */
412 frm = ieee80211_add_xrates(frm, &ic->ic_bss->ni_rates);
413 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
416 case IEEE80211_FC0_SUBTYPE_AUTH:
417 MGETHDR(m, MB_DONTWAIT, MT_DATA);
419 senderr(ENOMEM, is_tx_nombuf);
421 m->m_pkthdr.len = m->m_len = 6;
422 frm = mtod(m, uint8_t *);
423 /* TODO: shared key auth */
424 ((uint16_t *)frm)[0] = htole16(IEEE80211_AUTH_ALG_OPEN);
425 ((uint16_t *)frm)[1] = htole16(arg); /* sequence number */
426 ((uint16_t *)frm)[2] = 0; /* status */
427 if (ic->ic_opmode == IEEE80211_M_STA)
428 timer = IEEE80211_TRANS_WAIT;
431 case IEEE80211_FC0_SUBTYPE_DEAUTH:
432 if (ifp->if_flags & IFF_DEBUG)
433 if_printf(ifp, "station %6D deauthenticate (reason %d)\n",
434 ni->ni_macaddr, ":", arg);
435 MGETHDR(m, MB_DONTWAIT, MT_DATA);
437 senderr(ENOMEM, is_tx_nombuf);
439 m->m_pkthdr.len = m->m_len = 2;
440 *mtod(m, uint16_t *) = htole16(arg); /* reason */
443 case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
444 case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
447 * [2] capability information
448 * [2] listen interval
449 * [6*] current AP address (reassoc only)
451 * [tlv] supported rates
452 * [tlv] extended supported rates
454 m = ieee80211_getmbuf(MB_DONTWAIT, MT_DATA,
459 + 2 + IEEE80211_RATE_SIZE
460 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
462 senderr(ENOMEM, is_tx_nombuf);
463 m->m_data += sizeof(struct ieee80211_frame);
464 frm = mtod(m, uint8_t *);
467 if (ic->ic_opmode == IEEE80211_M_IBSS)
468 capinfo |= IEEE80211_CAPINFO_IBSS;
469 else /* IEEE80211_M_STA */
470 capinfo |= IEEE80211_CAPINFO_ESS;
471 if (ic->ic_flags & IEEE80211_F_WEPON)
472 capinfo |= IEEE80211_CAPINFO_PRIVACY;
474 * NB: Some 11a AP's reject the request when
475 * short premable is set.
477 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
478 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
479 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
480 if (ic->ic_flags & IEEE80211_F_SHSLOT)
481 capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
482 *(uint16_t *)frm = htole16(capinfo);
485 *(uint16_t *)frm = htole16(ic->ic_lintval);
488 if (type == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
489 IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
490 frm += IEEE80211_ADDR_LEN;
493 frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
494 frm = ieee80211_add_rates(frm, &ni->ni_rates);
495 frm = ieee80211_add_xrates(frm, &ni->ni_rates);
496 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
498 timer = IEEE80211_TRANS_WAIT;
501 case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
502 case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
505 * [2] capability information
508 * [tlv] supported rates
509 * [tlv] extended supported rates
511 m = ieee80211_getmbuf(MB_DONTWAIT, MT_DATA,
515 + 2 + IEEE80211_RATE_SIZE
516 + 2 + (IEEE80211_RATE_MAXSIZE - IEEE80211_RATE_SIZE));
518 senderr(ENOMEM, is_tx_nombuf);
519 m->m_data += sizeof(struct ieee80211_frame);
520 frm = mtod(m, uint8_t *);
522 capinfo = IEEE80211_CAPINFO_ESS;
523 if (ic->ic_flags & IEEE80211_F_WEPON)
524 capinfo |= IEEE80211_CAPINFO_PRIVACY;
525 if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
526 IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
527 capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
528 *(uint16_t *)frm = htole16(capinfo);
531 *(uint16_t *)frm = htole16(arg); /* status */
534 if (arg == IEEE80211_STATUS_SUCCESS)
535 *(uint16_t *)frm = htole16(ni->ni_associd);
538 frm = ieee80211_add_rates(frm, &ni->ni_rates);
539 frm = ieee80211_add_xrates(frm, &ni->ni_rates);
540 m->m_pkthdr.len = m->m_len = frm - mtod(m, uint8_t *);
543 case IEEE80211_FC0_SUBTYPE_DISASSOC:
544 if (ifp->if_flags & IFF_DEBUG)
545 if_printf(ifp, "station %6D disassociate (reason %d)\n",
546 ni->ni_macaddr, ":", arg);
547 MGETHDR(m, MB_DONTWAIT, MT_DATA);
549 senderr(ENOMEM, is_tx_nombuf);
551 m->m_pkthdr.len = m->m_len = 2;
552 *mtod(m, uint16_t *) = htole16(arg); /* reason */
556 IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n",
558 senderr(EINVAL, is_tx_unknownmgt);
562 ret = ieee80211_mgmt_output(ifp, ni, m, type);
565 ic->ic_mgt_timer = timer;
568 if (ni != ic->ic_bss) /* remove ref we added */
569 ieee80211_free_node(ic, ni);