![[BACK]](/icons/back.gif){kind=icon}
Return to ieee80211_input.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / net80211|
Return to ieee80211_input.c CVS log | Up to [local] / sys / net80211 |
1.1 nbrk 1: /* $NetBSD: ieee80211_input.c,v 1.24 2004/05/31 11:12:24 dyoung Exp $ */
2: /* $OpenBSD: ieee80211_input.c,v 1.63 2007/08/16 14:59:14 deraadt Exp $ */
3: /*-
4: * Copyright (c) 2001 Atsushi Onoe
5: * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
6: * Copyright (c) 2007 Damien Bergamini
7: * All rights reserved.
8: *
9: * Redistribution and use in source and binary forms, with or without
10: * modification, are permitted provided that the following conditions
11: * are met:
12: * 1. Redistributions of source code must retain the above copyright
13: * notice, this list of conditions and the following disclaimer.
14: * 2. Redistributions in binary form must reproduce the above copyright
15: * notice, this list of conditions and the following disclaimer in the
16: * documentation and/or other materials provided with the distribution.
17: * 3. The name of the author may not be used to endorse or promote products
18: * derived from this software without specific prior written permission.
19: *
20: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
21: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
22: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
23: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
24: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
25: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
26: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
27: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
28: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
29: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
30: */
31:
32: #include "bpfilter.h"
33:
34: #include <sys/param.h>
35: #include <sys/systm.h>
36: #include <sys/mbuf.h>
37: #include <sys/malloc.h>
38: #include <sys/kernel.h>
39: #include <sys/socket.h>
40: #include <sys/sockio.h>
41: #include <sys/endian.h>
42: #include <sys/errno.h>
43: #include <sys/proc.h>
44: #include <sys/sysctl.h>
45: #include <sys/endian.h>
46:
47: #include <net/if.h>
48: #include <net/if_dl.h>
49: #include <net/if_media.h>
50: #include <net/if_arp.h>
51: #include <net/if_llc.h>
52:
53: #if NBPFILTER > 0
54: #include <net/bpf.h>
55: #endif
56:
57: #ifdef INET
58: #include <netinet/in.h>
59: #include <netinet/if_ether.h>
60: #endif
61:
62: #include <net80211/ieee80211_var.h>
63:
64: #include <dev/rndvar.h>
65:
66:
67: int ieee80211_setup_rates(struct ieee80211com *, struct ieee80211_node *,
68: const u_int8_t *, const u_int8_t *, int);
69: void ieee80211_auth_open(struct ieee80211com *,
70: const struct ieee80211_frame *, struct ieee80211_node *, int,
71: u_int32_t, u_int16_t, u_int16_t);
72: int ieee80211_parse_edca_params_body(struct ieee80211com *,
73: const u_int8_t *);
74: int ieee80211_parse_edca_params(struct ieee80211com *, const u_int8_t *);
75: int ieee80211_parse_wmm_params(struct ieee80211com *, const u_int8_t *);
76: enum ieee80211_cipher ieee80211_parse_rsn_cipher(const u_int8_t[]);
77: enum ieee80211_akm ieee80211_parse_rsn_akm(const u_int8_t[]);
78: int ieee80211_parse_rsn_body(struct ieee80211com *,
79: struct ieee80211_node *, const u_int8_t *, u_int);
80: int ieee80211_parse_rsn(struct ieee80211com *, struct ieee80211_node *,
81: const u_int8_t *);
82: int ieee80211_parse_wpa1(struct ieee80211com *, struct ieee80211_node *,
83: const u_int8_t *);
84: void ieee80211_recv_pspoll(struct ieee80211com *, struct mbuf *, int,
85: u_int32_t);
86: int ieee80211_do_slow_print(struct ieee80211com *, int *);
87: void ieee80211_recv_probe_resp(struct ieee80211com *, struct mbuf *,
88: struct ieee80211_node *, int, u_int32_t);
89: void ieee80211_recv_probe_req(struct ieee80211com *, struct mbuf *,
90: struct ieee80211_node *, int, u_int32_t);
91: void ieee80211_recv_auth(struct ieee80211com *, struct mbuf *,
92: struct ieee80211_node *, int, u_int32_t);
93: void ieee80211_recv_assoc_req(struct ieee80211com *, struct mbuf *,
94: struct ieee80211_node *, int, u_int32_t);
95: void ieee80211_recv_assoc_resp(struct ieee80211com *, struct mbuf *,
96: struct ieee80211_node *, int, u_int32_t);
97: void ieee80211_recv_deauth(struct ieee80211com *, struct mbuf *,
98: struct ieee80211_node *, int, u_int32_t);
99: void ieee80211_recv_disassoc(struct ieee80211com *, struct mbuf *,
100: struct ieee80211_node *, int, u_int32_t);
101: void ieee80211_recv_4way_msg1(struct ieee80211com *,
102: const struct ieee80211_eapol_key *, struct ieee80211_node *);
103: void ieee80211_recv_4way_msg2(struct ieee80211com *,
104: const struct ieee80211_eapol_key *, struct ieee80211_node *);
105: void ieee80211_recv_4way_msg3(struct ieee80211com *,
106: const struct ieee80211_eapol_key *, struct ieee80211_node *);
107: void ieee80211_recv_4way_msg4(struct ieee80211com *,
108: const struct ieee80211_eapol_key *, struct ieee80211_node *);
109: void ieee80211_recv_rsn_group_msg1(struct ieee80211com *,
110: const struct ieee80211_eapol_key *, struct ieee80211_node *);
111: void ieee80211_recv_wpa_group_msg1(struct ieee80211com *,
112: struct ieee80211_eapol_key *, struct ieee80211_node *);
113: void ieee80211_recv_group_msg2(struct ieee80211com *,
114: const struct ieee80211_eapol_key *, struct ieee80211_node *);
115: void ieee80211_recv_eapol_key_req(struct ieee80211com *,
116: const struct ieee80211_eapol_key *, struct ieee80211_node *);
117:
118: /*
119: * Process a received frame. The node associated with the sender
120: * should be supplied. If nothing was found in the node table then
121: * the caller is assumed to supply a reference to ic_bss instead.
122: * The RSSI and a timestamp are also supplied. The RSSI data is used
123: * during AP scanning to select a AP to associate with; it can have
124: * any units so long as values have consistent units and higher values
125: * mean ``better signal''. The receive timestamp is currently not used
126: * by the 802.11 layer.
127: */
128: void
129: ieee80211_input(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node *ni,
130: int rssi, u_int32_t rstamp)
131: {
132: struct ieee80211com *ic = (void *)ifp;
133: struct ieee80211_frame *wh;
134: struct ether_header *eh;
135: struct mbuf *m1;
136: int error, hdrlen, len;
137: u_int8_t dir, type, subtype;
138: u_int16_t orxseq, nrxseq;
139:
140: if (ni == NULL)
141: panic("null mode");
142:
143: /* trim CRC here so WEP can find its own CRC at the end of packet. */
144: if (m->m_flags & M_HASFCS) {
145: m_adj(m, -IEEE80211_CRC_LEN);
146: m->m_flags &= ~M_HASFCS;
147: }
148:
149: /*
150: * In monitor mode, send everything directly to bpf.
151: * XXX may want to include the CRC
152: */
153: if (ic->ic_opmode == IEEE80211_M_MONITOR)
154: goto out;
155:
156: /* do not process frames w/o i_addr2 any further */
157: if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min)) {
158: IEEE80211_DPRINTF2(("%s: frame too short (1), len %u\n",
159: __func__, m->m_pkthdr.len));
160: ic->ic_stats.is_rx_tooshort++;
161: goto out;
162: }
163:
164: wh = mtod(m, struct ieee80211_frame *);
165: if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
166: IEEE80211_FC0_VERSION_0) {
167: IEEE80211_DPRINTF(("%s: packet with wrong version: %x\n",
168: __func__, wh->i_fc[0]));
169: ic->ic_stats.is_rx_badversion++;
170: goto err;
171: }
172:
173: dir = wh->i_fc[1] & IEEE80211_FC1_DIR_MASK;
174: type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
175:
176: /*
177: * NB: We are not yet prepared to handle control frames,
178: * but permitting drivers to send them to us allows
179: * them to go through bpf tapping at the 802.11 layer.
180: */
181: if (m->m_pkthdr.len < sizeof(struct ieee80211_frame)) {
182: IEEE80211_DPRINTF2(("%s: frame too short (2), len %u\n",
183: __func__, m->m_pkthdr.len));
184: ic->ic_stats.is_rx_tooshort++;
185: goto out;
186: }
187: if (ic->ic_state != IEEE80211_S_SCAN) {
188: ni->ni_rssi = rssi;
189: ni->ni_rstamp = rstamp;
190: if (type == IEEE80211_FC0_TYPE_DATA &&
191: (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS)) {
192: struct ieee80211_qosframe *qwh =
193: (struct ieee80211_qosframe *)wh;
194: int tid = qwh->i_qos[0] & IEEE80211_QOS_TID;
195: orxseq = ni->ni_qos_rxseqs[tid];
196: nrxseq = ni->ni_qos_rxseqs[tid] =
197: letoh16(*(u_int16_t *)qwh->i_seq) >>
198: IEEE80211_SEQ_SEQ_SHIFT;
199: } else {
200: orxseq = ni->ni_rxseq;
201: nrxseq = ni->ni_rxseq =
202: letoh16(*(u_int16_t *)wh->i_seq) >>
203: IEEE80211_SEQ_SEQ_SHIFT;
204: }
205: /* TODO: fragment */
206: if ((wh->i_fc[1] & IEEE80211_FC1_RETRY) &&
207: orxseq == nrxseq) {
208: /* duplicate, silently discarded */
209: ic->ic_stats.is_rx_dup++; /* XXX per-station stat */
210: goto out;
211: }
212: ni->ni_inact = 0;
213: }
214:
215: if (ic->ic_set_tim != NULL &&
216: (wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) &&
217: ni->ni_pwrsave == 0) {
218: /* turn on power save mode */
219:
220: if (ifp->if_flags & IFF_DEBUG)
221: printf("%s: power save mode on for %s\n",
222: ifp->if_xname, ether_sprintf(wh->i_addr2));
223:
224: ni->ni_pwrsave = IEEE80211_PS_SLEEP;
225: }
226: if (ic->ic_set_tim != NULL &&
227: !(wh->i_fc[1] & IEEE80211_FC1_PWR_MGT) &&
228: ni->ni_pwrsave != 0) {
229: /* turn off power save mode, dequeue stored packets */
230:
231: ni->ni_pwrsave = 0;
232: (*ic->ic_set_tim)(ic, ni->ni_associd, 0);
233:
234: if (ifp->if_flags & IFF_DEBUG)
235: printf("%s: power save mode off for %s\n",
236: ifp->if_xname, ether_sprintf(wh->i_addr2));
237:
238: while (!IF_IS_EMPTY(&ni->ni_savedq)) {
239: struct mbuf *m;
240: IF_DEQUEUE(&ni->ni_savedq, m);
241: IF_ENQUEUE(&ic->ic_pwrsaveq, m);
242: (*ifp->if_start)(ifp);
243: }
244: }
245:
246: switch (type) {
247: case IEEE80211_FC0_TYPE_DATA:
248: switch (ic->ic_opmode) {
249: case IEEE80211_M_STA:
250: if (dir != IEEE80211_FC1_DIR_FROMDS) {
251: ic->ic_stats.is_rx_wrongdir++;
252: goto out;
253: }
254: if (ic->ic_state != IEEE80211_S_SCAN &&
255: !IEEE80211_ADDR_EQ(wh->i_addr2, ni->ni_bssid)) {
256: /* Source address is not our BSS. */
257: IEEE80211_DPRINTF(
258: ("%s: discard frame from SA %s\n",
259: __func__, ether_sprintf(wh->i_addr2)));
260: ic->ic_stats.is_rx_wrongbss++;
261: goto out;
262: }
263: if ((ifp->if_flags & IFF_SIMPLEX) &&
264: IEEE80211_IS_MULTICAST(wh->i_addr1) &&
265: IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_myaddr)) {
266: /*
267: * In IEEE802.11 network, multicast packet
268: * sent from me is broadcasted from AP.
269: * It should be silently discarded for
270: * SIMPLEX interface.
271: */
272: ic->ic_stats.is_rx_mcastecho++;
273: goto out;
274: }
275: break;
276: case IEEE80211_M_IBSS:
277: case IEEE80211_M_AHDEMO:
278: if (dir != IEEE80211_FC1_DIR_NODS) {
279: ic->ic_stats.is_rx_wrongdir++;
280: goto out;
281: }
282: if (ic->ic_state != IEEE80211_S_SCAN &&
283: !IEEE80211_ADDR_EQ(wh->i_addr3,
284: ic->ic_bss->ni_bssid) &&
285: !IEEE80211_ADDR_EQ(wh->i_addr3,
286: etherbroadcastaddr)) {
287: /* Destination is not our BSS or broadcast. */
288: IEEE80211_DPRINTF2(
289: ("%s: discard data frame to DA %s\n",
290: __func__, ether_sprintf(wh->i_addr3)));
291: ic->ic_stats.is_rx_wrongbss++;
292: goto out;
293: }
294: break;
295: case IEEE80211_M_HOSTAP:
296: if (dir != IEEE80211_FC1_DIR_TODS) {
297: ic->ic_stats.is_rx_wrongdir++;
298: goto out;
299: }
300: if (ic->ic_state != IEEE80211_S_SCAN &&
301: !IEEE80211_ADDR_EQ(wh->i_addr1,
302: ic->ic_bss->ni_bssid) &&
303: !IEEE80211_ADDR_EQ(wh->i_addr1,
304: etherbroadcastaddr)) {
305: /* BSS is not us or broadcast. */
306: IEEE80211_DPRINTF2(
307: ("%s: discard data frame to BSS %s\n",
308: __func__, ether_sprintf(wh->i_addr1)));
309: ic->ic_stats.is_rx_wrongbss++;
310: goto out;
311: }
312: /* check if source STA is associated */
313: if (ni == ic->ic_bss) {
314: IEEE80211_DPRINTF(("%s: "
315: "data from unknown src %s\n", __func__,
316: ether_sprintf(wh->i_addr2)));
317: /* NB: caller deals with reference */
318: ni = ieee80211_dup_bss(ic, wh->i_addr2);
319: if (ni != NULL) {
320: IEEE80211_SEND_MGMT(ic, ni,
321: IEEE80211_FC0_SUBTYPE_DEAUTH,
322: IEEE80211_REASON_NOT_AUTHED);
323: }
324: ic->ic_stats.is_rx_notassoc++;
325: goto err;
326: }
327: if (ni->ni_associd == 0) {
328: IEEE80211_DPRINTF(("%s: "
329: "data from unassoc src %s\n", __func__,
330: ether_sprintf(wh->i_addr2)));
331: IEEE80211_SEND_MGMT(ic, ni,
332: IEEE80211_FC0_SUBTYPE_DISASSOC,
333: IEEE80211_REASON_NOT_ASSOCED);
334: ic->ic_stats.is_rx_notassoc++;
335: goto err;
336: }
337: break;
338: case IEEE80211_M_MONITOR:
339: /* can't get there */
340: goto out;
341: }
342: if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS)
343: hdrlen = sizeof(struct ieee80211_qosframe);
344: else
345: hdrlen = sizeof(struct ieee80211_frame);
346: if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
347: if (ic->ic_flags & IEEE80211_F_WEPON) {
348: m = ieee80211_wep_crypt(ifp, m, 0);
349: if (m == NULL) {
350: ic->ic_stats.is_rx_wepfail++;
351: goto err;
352: }
353: wh = mtod(m, struct ieee80211_frame *);
354: } else {
355: ic->ic_stats.is_rx_nowep++;
356: goto out;
357: }
358: }
359: #if NBPFILTER > 0
360: /* copy to listener after decrypt */
361: if (ic->ic_rawbpf)
362: bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_IN);
363: #endif
364: m = ieee80211_decap(ifp, m, hdrlen);
365: if (m == NULL) {
366: IEEE80211_DPRINTF(("%s: "
367: "decapsulation error for src %s\n",
368: __func__, ether_sprintf(wh->i_addr2)));
369: ic->ic_stats.is_rx_decap++;
370: goto err;
371: }
372: eh = mtod(m, struct ether_header *);
373: #if 0
374: if (!ni->ni_port_valid &&
375: eh->ether_type != htons(ETHERTYPE_PAE)) {
376: IEEE80211_DPRINTF(("%s: port not valid: %s\n",
377: __func__, ether_sprintf(wh->i_addr2)));
378: ic->ic_stats.is_rx_unauth++;
379: goto err;
380: }
381: #endif
382: ifp->if_ipackets++;
383:
384: /* perform as a bridge within the AP */
385: m1 = NULL;
386: if (ic->ic_opmode == IEEE80211_M_HOSTAP &&
387: (ic->ic_flags & IEEE80211_F_NOBRIDGE) == 0) {
388: if (ETHER_IS_MULTICAST(eh->ether_dhost)) {
389: m1 = m_copym(m, 0, M_COPYALL, M_DONTWAIT);
390: if (m1 == NULL)
391: ifp->if_oerrors++;
392: else
393: m1->m_flags |= M_MCAST;
394: } else {
395: ni = ieee80211_find_node(ic, eh->ether_dhost);
396: if (ni != NULL) {
397: if (ni->ni_associd != 0) {
398: m1 = m;
399: m = NULL;
400: }
401: }
402: }
403: if (m1 != NULL) {
404: len = m1->m_pkthdr.len;
405: IFQ_ENQUEUE(&ifp->if_snd, m1, NULL, error);
406: if (error)
407: ifp->if_oerrors++;
408: else {
409: if (m != NULL)
410: ifp->if_omcasts++;
411: ifp->if_obytes += len;
412: }
413: }
414: }
415: if (m != NULL) {
416: #if NBPFILTER > 0
417: /*
418: * If we forward packet into transmitter of the AP,
419: * we don't need to duplicate for DLT_EN10MB.
420: */
421: if (ifp->if_bpf && m1 == NULL)
422: bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_IN);
423: #endif
424: ether_input_mbuf(ifp, m);
425: }
426: return;
427:
428: case IEEE80211_FC0_TYPE_MGT:
429: if (dir != IEEE80211_FC1_DIR_NODS) {
430: ic->ic_stats.is_rx_wrongdir++;
431: goto err;
432: }
433: if (ic->ic_opmode == IEEE80211_M_AHDEMO) {
434: ic->ic_stats.is_rx_ahdemo_mgt++;
435: goto out;
436: }
437: subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
438:
439: /* drop frames without interest */
440: if (ic->ic_state == IEEE80211_S_SCAN) {
441: if (subtype != IEEE80211_FC0_SUBTYPE_BEACON &&
442: subtype != IEEE80211_FC0_SUBTYPE_PROBE_RESP) {
443: ic->ic_stats.is_rx_mgtdiscard++;
444: goto out;
445: }
446: }
447:
448: if (ifp->if_flags & IFF_DEBUG) {
449: /* avoid to print too many frames */
450: int doprint = 0;
451:
452: switch (subtype) {
453: case IEEE80211_FC0_SUBTYPE_BEACON:
454: if (ic->ic_state == IEEE80211_S_SCAN)
455: doprint = 1;
456: break;
457: case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
458: if (ic->ic_opmode == IEEE80211_M_IBSS)
459: doprint = 1;
460: break;
461: default:
462: doprint = 1;
463: break;
464: }
465: #ifdef IEEE80211_DEBUG
466: doprint += ieee80211_debug;
467: #endif
468: if (doprint)
469: printf("%s: received %s from %s rssi %d mode %s\n",
470: ifp->if_xname,
471: ieee80211_mgt_subtype_name[subtype
472: >> IEEE80211_FC0_SUBTYPE_SHIFT],
473: ether_sprintf(wh->i_addr2), rssi,
474: ieee80211_phymode_name[ieee80211_chan2mode(ic,
475: ic->ic_bss->ni_chan)]);
476: }
477: #if NBPFILTER > 0
478: if (ic->ic_rawbpf)
479: bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_IN);
480: /*
481: * Drop mbuf if it was filtered by bpf. Normally, this is
482: * done in ether_input() but IEEE 802.11 management frames
483: * are a special case.
484: */
485: if (m->m_flags & M_FILDROP) {
486: m_freem(m);
487: return;
488: }
489: #endif
490: (*ic->ic_recv_mgmt)(ic, m, ni, subtype, rssi, rstamp);
491: m_freem(m);
492: return;
493:
494: case IEEE80211_FC0_TYPE_CTL:
495: ic->ic_stats.is_rx_ctl++;
496: if (ic->ic_opmode != IEEE80211_M_HOSTAP)
497: goto out;
498: subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
499: if (subtype == IEEE80211_FC0_SUBTYPE_PS_POLL) {
500: /* XXX statistic */
501: /* Dump out a single packet from the host */
502: if (ifp->if_flags & IFF_DEBUG)
503: printf("%s: got power save probe from %s\n",
504: ifp->if_xname,
505: ether_sprintf(wh->i_addr2));
506: ieee80211_recv_pspoll(ic, m, rssi, rstamp);
507: }
508: goto out;
509:
510: default:
511: IEEE80211_DPRINTF(("%s: bad packet type %x\n", __func__, type));
512: /* should not come here */
513: break;
514: }
515: err:
516: ifp->if_ierrors++;
517: out:
518: if (m != NULL) {
519: #if NBPFILTER > 0
520: if (ic->ic_rawbpf)
521: bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_IN);
522: #endif
523: m_freem(m);
524: }
525: }
526:
527: struct mbuf *
528: ieee80211_decap(struct ifnet *ifp, struct mbuf *m, int hdrlen)
529: {
530: struct ieee80211_frame wh;
531: struct ether_header *eh;
532: struct llc *llc;
533:
534: if (m->m_len < hdrlen + sizeof(*llc)) {
535: m = m_pullup(m, hdrlen + sizeof(*llc));
536: if (m == NULL)
537: return NULL;
538: }
539: memcpy(&wh, mtod(m, caddr_t), sizeof(wh));
540: llc = (struct llc *)(mtod(m, caddr_t) + hdrlen);
541: if (llc->llc_dsap == LLC_SNAP_LSAP &&
542: llc->llc_ssap == LLC_SNAP_LSAP &&
543: llc->llc_control == LLC_UI &&
544: llc->llc_snap.org_code[0] == 0 &&
545: llc->llc_snap.org_code[1] == 0 &&
546: llc->llc_snap.org_code[2] == 0) {
547: m_adj(m, hdrlen + sizeof(struct llc) - sizeof(*eh));
548: llc = NULL;
549: } else {
550: m_adj(m, hdrlen - sizeof(*eh));
551: }
552: eh = mtod(m, struct ether_header *);
553: switch (wh.i_fc[1] & IEEE80211_FC1_DIR_MASK) {
554: case IEEE80211_FC1_DIR_NODS:
555: IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
556: IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
557: break;
558: case IEEE80211_FC1_DIR_TODS:
559: IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr3);
560: IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr2);
561: break;
562: case IEEE80211_FC1_DIR_FROMDS:
563: IEEE80211_ADDR_COPY(eh->ether_dhost, wh.i_addr1);
564: IEEE80211_ADDR_COPY(eh->ether_shost, wh.i_addr3);
565: break;
566: case IEEE80211_FC1_DIR_DSTODS:
567: /* not yet supported */
568: IEEE80211_DPRINTF(("%s: discard DS to DS frame\n", __func__));
569: m_freem(m);
570: return NULL;
571: }
572: if (!ALIGNED_POINTER(mtod(m, caddr_t) + sizeof(*eh), u_int32_t)) {
573: struct mbuf *n, *n0, **np;
574: caddr_t newdata;
575: int off, pktlen;
576:
577: n0 = NULL;
578: np = &n0;
579: off = 0;
580: pktlen = m->m_pkthdr.len;
581: while (pktlen > off) {
582: if (n0 == NULL) {
583: MGETHDR(n, M_DONTWAIT, MT_DATA);
584: if (n == NULL) {
585: m_freem(m);
586: return NULL;
587: }
588: M_DUP_PKTHDR(n, m);
589: n->m_len = MHLEN;
590: } else {
591: MGET(n, M_DONTWAIT, MT_DATA);
592: if (n == NULL) {
593: m_freem(m);
594: m_freem(n0);
595: return NULL;
596: }
597: n->m_len = MLEN;
598: }
599: if (pktlen - off >= MINCLSIZE) {
600: MCLGET(n, M_DONTWAIT);
601: if (n->m_flags & M_EXT)
602: n->m_len = n->m_ext.ext_size;
603: }
604: if (n0 == NULL) {
605: newdata =
606: (caddr_t)ALIGN(n->m_data + sizeof(*eh)) -
607: sizeof(*eh);
608: n->m_len -= newdata - n->m_data;
609: n->m_data = newdata;
610: }
611: if (n->m_len > pktlen - off)
612: n->m_len = pktlen - off;
613: m_copydata(m, off, n->m_len, mtod(n, caddr_t));
614: off += n->m_len;
615: *np = n;
616: np = &n->m_next;
617: }
618: m_freem(m);
619: m = n0;
620: }
621: if (llc != NULL) {
622: eh = mtod(m, struct ether_header *);
623: eh->ether_type = htons(m->m_pkthdr.len - sizeof(*eh));
624: }
625: return m;
626: }
627:
628: /*
629: * Install received rate set information in the node's state block.
630: */
631: int
632: ieee80211_setup_rates(struct ieee80211com *ic, struct ieee80211_node *ni,
633: const u_int8_t *rates, const u_int8_t *xrates, int flags)
634: {
635: struct ieee80211_rateset *rs = &ni->ni_rates;
636:
637: memset(rs, 0, sizeof(*rs));
638: rs->rs_nrates = rates[1];
639: memcpy(rs->rs_rates, rates + 2, rs->rs_nrates);
640: if (xrates != NULL) {
641: u_int8_t nxrates;
642: /*
643: * Tack on 11g extended supported rate element.
644: */
645: nxrates = xrates[1];
646: if (rs->rs_nrates + nxrates > IEEE80211_RATE_MAXSIZE) {
647: nxrates = IEEE80211_RATE_MAXSIZE - rs->rs_nrates;
648: IEEE80211_DPRINTF(("%s: extended rate set too large;"
649: " only using %u of %u rates\n",
650: __func__, nxrates, xrates[1]));
651: ic->ic_stats.is_rx_rstoobig++;
652: }
653: memcpy(rs->rs_rates + rs->rs_nrates, xrates+2, nxrates);
654: rs->rs_nrates += nxrates;
655: }
656: return ieee80211_fix_rate(ic, ni, flags);
657: }
658:
659: /* Verify the existence and length of __elem or get out. */
660: #define IEEE80211_VERIFY_ELEMENT(__elem, __maxlen) do { \
661: if ((__elem) == NULL) { \
662: IEEE80211_DPRINTF(("%s: no " #__elem "in %s frame\n", \
663: __func__, ieee80211_mgt_subtype_name[ \
664: (wh->i_fc[0] & \
665: IEEE80211_FC0_SUBTYPE_MASK) >> \
666: IEEE80211_FC0_SUBTYPE_SHIFT])); \
667: ic->ic_stats.is_rx_elem_missing++; \
668: return; \
669: } \
670: if ((__elem)[1] > (__maxlen)) { \
671: IEEE80211_DPRINTF(("%s: bad " #__elem " len %d in %s " \
672: "frame from %s\n", __func__, (__elem)[1], \
673: ieee80211_mgt_subtype_name[(wh->i_fc[0] & \
674: IEEE80211_FC0_SUBTYPE_MASK) >> \
675: IEEE80211_FC0_SUBTYPE_SHIFT], \
676: ether_sprintf((u_int8_t *)wh->i_addr2))); \
677: ic->ic_stats.is_rx_elem_toobig++; \
678: return; \
679: } \
680: } while (0)
681:
682: #define IEEE80211_VERIFY_LENGTH(_len, _minlen) do { \
683: if ((_len) < (_minlen)) { \
684: IEEE80211_DPRINTF(("%s: %s frame too short from %s\n", \
685: __func__, \
686: ieee80211_mgt_subtype_name[(wh->i_fc[0] & \
687: IEEE80211_FC0_SUBTYPE_MASK) >> \
688: IEEE80211_FC0_SUBTYPE_SHIFT], \
689: ether_sprintf((u_int8_t *)wh->i_addr2))); \
690: ic->ic_stats.is_rx_elem_toosmall++; \
691: return; \
692: } \
693: } while (0)
694:
695: #ifdef IEEE80211_DEBUG
696: void
697: ieee80211_ssid_mismatch(struct ieee80211com *, const char *,
698: const u_int8_t[IEEE80211_ADDR_LEN], const u_int8_t *);
699: void
700: ieee80211_ssid_mismatch(struct ieee80211com *ic, const char *tag,
701: const u_int8_t mac[IEEE80211_ADDR_LEN], const u_int8_t *ssid)
702: {
703: printf("[%s] %s req ssid mismatch: ",
704: ether_sprintf((u_int8_t *)mac), tag);
705: ieee80211_print_essid(ssid + 2, ssid[1]);
706: printf("\n");
707: }
708:
709: #define IEEE80211_VERIFY_SSID(_ni, _ssid, _packet_type) do { \
710: if ((_ssid)[1] != 0 && \
711: ((_ssid)[1] != (_ni)->ni_esslen || \
712: memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \
713: if (ieee80211_debug) \
714: ieee80211_ssid_mismatch(ic, _packet_type, \
715: wh->i_addr2, _ssid); \
716: ic->ic_stats.is_rx_ssidmismatch++; \
717: return; \
718: } \
719: } while (0)
720: #else /* !IEEE80211_DEBUG */
721: #define IEEE80211_VERIFY_SSID(_ni, _ssid, _packet_type) do { \
722: if ((_ssid)[1] != 0 && \
723: ((_ssid)[1] != (_ni)->ni_esslen || \
724: memcmp((_ssid) + 2, (_ni)->ni_essid, (_ssid)[1]) != 0)) { \
725: ic->ic_stats.is_rx_ssidmismatch++; \
726: return; \
727: } \
728: } while (0)
729: #endif /* !IEEE80211_DEBUG */
730:
731: void
732: ieee80211_auth_open(struct ieee80211com *ic, const struct ieee80211_frame *wh,
733: struct ieee80211_node *ni, int rssi, u_int32_t rstamp, u_int16_t seq,
734: u_int16_t status)
735: {
736: struct ifnet *ifp = &ic->ic_if;
737: switch (ic->ic_opmode) {
738: case IEEE80211_M_IBSS:
739: if (ic->ic_state != IEEE80211_S_RUN ||
740: seq != IEEE80211_AUTH_OPEN_REQUEST) {
741: IEEE80211_DPRINTF(("%s: discard auth from %s; "
742: "state %u, seq %u\n", __func__,
743: ether_sprintf((u_int8_t *)wh->i_addr2),
744: ic->ic_state, seq));
745: ic->ic_stats.is_rx_bad_auth++;
746: return;
747: }
748: ieee80211_new_state(ic, IEEE80211_S_AUTH,
749: wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
750: break;
751:
752: case IEEE80211_M_AHDEMO:
753: /* should not come here */
754: break;
755:
756: case IEEE80211_M_HOSTAP:
757: if (ic->ic_state != IEEE80211_S_RUN ||
758: seq != IEEE80211_AUTH_OPEN_REQUEST) {
759: IEEE80211_DPRINTF(("%s: discard auth from %s; "
760: "state %u, seq %u\n", __func__,
761: ether_sprintf((u_int8_t *)wh->i_addr2),
762: ic->ic_state, seq));
763: ic->ic_stats.is_rx_bad_auth++;
764: return;
765: }
766: if (ni == ic->ic_bss) {
767: ni = ieee80211_alloc_node(ic, wh->i_addr2);
768: if (ni == NULL) {
769: ic->ic_stats.is_rx_nodealloc++;
770: return;
771: }
772: IEEE80211_ADDR_COPY(ni->ni_bssid, ic->ic_bss->ni_bssid);
773: ni->ni_rssi = rssi;
774: ni->ni_rstamp = rstamp;
775: ni->ni_chan = ic->ic_bss->ni_chan;
776: }
777: IEEE80211_SEND_MGMT(ic, ni,
778: IEEE80211_FC0_SUBTYPE_AUTH, seq + 1);
779: if (ifp->if_flags & IFF_DEBUG)
780: printf("%s: station %s %s authenticated (open)\n",
781: ifp->if_xname,
782: ether_sprintf((u_int8_t *)ni->ni_macaddr),
783: ni->ni_state != IEEE80211_STA_CACHE ?
784: "newly" : "already");
785: ieee80211_node_newstate(ni, IEEE80211_STA_AUTH);
786: break;
787:
788: case IEEE80211_M_STA:
789: if (ic->ic_state != IEEE80211_S_AUTH ||
790: seq != IEEE80211_AUTH_OPEN_RESPONSE) {
791: ic->ic_stats.is_rx_bad_auth++;
792: IEEE80211_DPRINTF(("%s: discard auth from %s; "
793: "state %u, seq %u\n", __func__,
794: ether_sprintf((u_int8_t *)wh->i_addr2),
795: ic->ic_state, seq));
796: return;
797: }
798: if (status != 0) {
799: if (ifp->if_flags & IFF_DEBUG)
800: printf("%s: open authentication failed "
801: "(reason %d) for %s\n", ifp->if_xname,
802: status,
803: ether_sprintf((u_int8_t *)wh->i_addr3));
804: if (ni != ic->ic_bss)
805: ni->ni_fails++;
806: ic->ic_stats.is_rx_auth_fail++;
807: return;
808: }
809: ieee80211_new_state(ic, IEEE80211_S_ASSOC,
810: wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
811: break;
812: case IEEE80211_M_MONITOR:
813: break;
814: }
815: }
816:
817: /* unaligned little endian access */
818: #define LE_READ_2(p) \
819: ((u_int16_t) \
820: ((((const u_int8_t *)(p))[0]) | \
821: (((const u_int8_t *)(p))[1] << 8)))
822: #define LE_READ_4(p) \
823: ((u_int32_t) \
824: ((((const u_int8_t *)(p))[0]) | \
825: (((const u_int8_t *)(p))[1] << 8) | \
826: (((const u_int8_t *)(p))[2] << 16) | \
827: (((const u_int8_t *)(p))[3] << 24)))
828:
829: /*
830: * Parse an EDCA Parameter Set element (see 7.3.2.27).
831: */
832: int
833: ieee80211_parse_edca_params_body(struct ieee80211com *ic, const u_int8_t *frm)
834: {
835: u_int updtcount;
836: int aci;
837:
838: /*
839: * Check if EDCA parameters have changed XXX if we miss more than
840: * 15 consecutive beacons, we might not detect changes to EDCA
841: * parameters due to wraparound of the 4-bit Update Count field.
842: */
843: updtcount = frm[0] & 0xf;
844: if (updtcount == ic->ic_edca_updtcount)
845: return 0; /* no changes to EDCA parameters, ignore */
846: ic->ic_edca_updtcount = updtcount;
847:
848: frm += 2; /* skip QoS Info & Reserved fields */
849:
850: /* parse AC Parameter Records */
851: for (aci = 0; aci < EDCA_NUM_AC; aci++) {
852: struct ieee80211_edca_ac_params *ac = &ic->ic_edca_ac[aci];
853:
854: ac->ac_acm = (frm[0] >> 4) & 0x1;
855: ac->ac_aifsn = frm[0] & 0xf;
856: ac->ac_ecwmin = frm[1] & 0xf;
857: ac->ac_ecwmax = frm[1] >> 4;
858: ac->ac_txoplimit = LE_READ_2(frm + 2);
859: frm += 4;
860: }
861: /* give drivers a chance to update their settings */
862: if ((ic->ic_flags & IEEE80211_F_QOS) && ic->ic_updateedca != NULL)
863: (*ic->ic_updateedca)(ic);
864:
865: return 0;
866: }
867:
868: int
869: ieee80211_parse_edca_params(struct ieee80211com *ic, const u_int8_t *frm)
870: {
871: /* check IE length */
872: if (frm[1] < 18) {
873: IEEE80211_DPRINTF(("%s: invalid EDCA parameter set IE;"
874: " length %u, expecting 18\n", __func__, frm[1]));
875: ic->ic_stats.is_rx_elem_toosmall++;
876: return IEEE80211_REASON_IE_INVALID;
877: }
878: return ieee80211_parse_edca_params_body(ic, frm + 2);
879: }
880:
881: int
882: ieee80211_parse_wmm_params(struct ieee80211com *ic, const u_int8_t *frm)
883: {
884: /* check IE length */
885: if (frm[1] < 24) {
886: IEEE80211_DPRINTF(("%s: invalid WMM parameter set IE;"
887: " length %u, expecting 24\n", __func__, frm[1]));
888: ic->ic_stats.is_rx_elem_toosmall++;
889: return IEEE80211_REASON_IE_INVALID;
890: }
891: return ieee80211_parse_edca_params_body(ic, frm + 8);
892: }
893:
894: enum ieee80211_cipher
895: ieee80211_parse_rsn_cipher(const u_int8_t selector[4])
896: {
897: /* from IEEE Std 802.11i-2004 - Table 20da */
898: if (memcmp(selector, MICROSOFT_OUI, 3) == 0 || /* WPA1 */
899: memcmp(selector, IEEE80211_OUI, 3) == 0) { /* RSN (aka WPA2) */
900: switch (selector[3]) {
901: case 0: /* use group cipher suite */
902: return IEEE80211_CIPHER_USEGROUP;
903: case 1: /* WEP-40 */
904: return IEEE80211_CIPHER_WEP40;
905: case 2: /* TKIP */
906: return IEEE80211_CIPHER_TKIP;
907: case 4: /* CCMP (RSNA default) */
908: return IEEE80211_CIPHER_CCMP;
909: case 5: /* WEP-104 */
910: return IEEE80211_CIPHER_WEP104;
911: }
912: }
913: return IEEE80211_CIPHER_NONE; /* ignore unknown ciphers */
914: }
915:
916: enum ieee80211_akm
917: ieee80211_parse_rsn_akm(const u_int8_t selector[4])
918: {
919: /* from IEEE Std 802.11i-2004 - Table 20dc */
920: if (memcmp(selector, MICROSOFT_OUI, 3) == 0 || /* WPA1 */
921: memcmp(selector, IEEE80211_OUI, 3) == 0) { /* RSN (aka WPA2) */
922: switch (selector[3]) {
923: case 1: /* IEEE 802.1X (RSNA default) */
924: return IEEE80211_AKM_IEEE8021X;
925: case 2: /* PSK */
926: return IEEE80211_AKM_PSK;
927: }
928: }
929: return IEEE80211_AKM_NONE; /* ignore unknown AKMs */
930: }
931:
932: /*
933: * Parse an RSN element (see 7.3.2.25).
934: */
935: int
936: ieee80211_parse_rsn_body(struct ieee80211com *ic, struct ieee80211_node *ni,
937: const u_int8_t *frm, u_int len)
938: {
939: const u_int8_t *efrm;
940: u_int16_t m, n, s;
941: u_int16_t rsncaps;
942: enum ieee80211_cipher group_cipher;
943: u_int akmset, pairwise_cipherset;
944:
945: efrm = frm + len;
946:
947: /* check Version field */
948: if (LE_READ_2(frm) != 1)
949: return IEEE80211_REASON_RSN_IE_VER_UNSUP;
950: frm += 2;
951:
952: /* all fields after the Version field are optional */
953:
954: /* if Cipher Suite missing, default to CCMP */
955: ni->ni_group_cipher = IEEE80211_CIPHER_CCMP;
956: ni->ni_pairwise_cipherset = IEEE80211_CIPHER_CCMP;
957: /* if AKM Suite missing, default to 802.1X */
958: ni->ni_akmset = IEEE80211_AKM_IEEE8021X;
959:
960: /* read Group Cipher Suite field */
961: if (frm + 4 > efrm)
962: return 0;
963: group_cipher = ieee80211_parse_rsn_cipher(frm);
964: if (group_cipher == IEEE80211_CIPHER_USEGROUP)
965: return IEEE80211_REASON_BAD_GROUP_CIPHER;
966: frm += 4;
967:
968: /* read Pairwise Cipher Suite Count field */
969: if (frm + 2 > efrm)
970: return 0;
971: m = LE_READ_2(frm);
972: frm += 2;
973:
974: /* read Pairwise Cipher Suite List */
975: if (frm + m * 4 > efrm)
976: return IEEE80211_REASON_IE_INVALID;
977: pairwise_cipherset = IEEE80211_CIPHER_NONE;
978: while (m-- > 0) {
979: pairwise_cipherset |= ieee80211_parse_rsn_cipher(frm);
980: frm += 4;
981: }
982: if (pairwise_cipherset & IEEE80211_CIPHER_USEGROUP) {
983: if (pairwise_cipherset != IEEE80211_CIPHER_USEGROUP)
984: return IEEE80211_REASON_BAD_PAIRWISE_CIPHER;
985: if (group_cipher == IEEE80211_CIPHER_CCMP)
986: return IEEE80211_REASON_BAD_PAIRWISE_CIPHER;
987: }
988:
989: /* read AKM Suite List Count field */
990: if (frm + 2 > efrm)
991: return 0;
992: n = LE_READ_2(frm);
993: frm += 2;
994:
995: /* read AKM Suite List */
996: if (frm + n * 4 > efrm)
997: return IEEE80211_REASON_IE_INVALID;
998: akmset = IEEE80211_AKM_NONE;
999: while (n-- > 0) {
1000: akmset |= ieee80211_parse_rsn_akm(frm);
1001: frm += 4;
1002: }
1003:
1004: /* read RSN Capabilities field */
1005: if (frm + 2 > efrm)
1006: return 0;
1007: rsncaps = LE_READ_2(frm);
1008: frm += 2;
1009:
1010: /* read PMKID Count field */
1011: if (frm + 2 > efrm)
1012: return 0;
1013: s = LE_READ_2(frm);
1014: frm += 2;
1015:
1016: /* read PMKID List */
1017: if (frm + s * IEEE80211_PMKID_LEN > efrm)
1018: return IEEE80211_REASON_IE_INVALID;
1019: while (s-- > 0) {
1020: /* ignore PMKIDs for now */
1021: frm += IEEE80211_PMKID_LEN;
1022: }
1023:
1024: ni->ni_group_cipher = group_cipher;
1025: ni->ni_pairwise_cipherset = pairwise_cipherset;
1026: ni->ni_akmset = akmset;
1027: ni->ni_rsncaps = rsncaps;
1028:
1029: return 0;
1030: }
1031:
1032: int
1033: ieee80211_parse_rsn(struct ieee80211com *ic, struct ieee80211_node *ni,
1034: const u_int8_t *frm)
1035: {
1036: /* check IE length */
1037: if (frm[1] < 2) {
1038: IEEE80211_DPRINTF(("%s: invalid RSN/WPA2 IE;"
1039: " length %u, expecting at least 2\n", __func__, frm[1]));
1040: ic->ic_stats.is_rx_elem_toosmall++;
1041: return IEEE80211_REASON_IE_INVALID;
1042: }
1043: return ieee80211_parse_rsn_body(ic, ni, frm + 2, frm[1] - 2);
1044: }
1045:
1046: int
1047: ieee80211_parse_wpa1(struct ieee80211com *ic, struct ieee80211_node *ni,
1048: const u_int8_t *frm)
1049: {
1050: /* check IE length */
1051: if (frm[1] < 6) {
1052: IEEE80211_DPRINTF(("%s: invalid WPA1 IE;"
1053: " length %u, expecting at least 6\n", __func__, frm[1]));
1054: ic->ic_stats.is_rx_elem_toosmall++;
1055: return IEEE80211_REASON_IE_INVALID;
1056: }
1057: return ieee80211_parse_rsn_body(ic, ni, frm + 6, frm[1] - 4);
1058: }
1059:
1060: /*-
1061: * Beacon/Probe response frame format:
1062: * [8] Timestamp
1063: * [2] Beacon interval
1064: * [2] Capability
1065: * [tlv] Service Set Identifier (SSID)
1066: * [tlv] Supported rates
1067: * [tlv*] Frequency-Hopping (FH) Parameter Set
1068: * [tlv*] DS Parameter Set (802.11g)
1069: * [tlv] ERP Information (802.11g)
1070: * [tlv] Extended Supported Rates (802.11g)
1071: * [tlv] RSN (802.11i)
1072: * [tlv] EDCA Parameter Set (802.11e)
1073: * [tlv] QoS Capability (Beacon only, 802.11e)
1074: */
1075: void
1076: ieee80211_recv_probe_resp(struct ieee80211com *ic, struct mbuf *m0,
1077: struct ieee80211_node *ni, int rssi, u_int32_t rstamp)
1078: {
1079: #define ISPROBE(_wh) (((_wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == \
1080: IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1081:
1082: const struct ieee80211_frame *wh;
1083: const u_int8_t *frm, *efrm;
1084: const u_int8_t *tstamp, *ssid, *rates, *xrates, *edca, *wmm;
1085: const u_int8_t *rsn, *wpa;
1086: u_int16_t capinfo, bintval, fhdwell;
1087: u_int8_t chan, bchan, fhindex, erp;
1088: int is_new;
1089:
1090: /*
1091: * We process beacon/probe response frames for:
1092: * o station mode: to collect state
1093: * updates such as 802.11g slot time and for passive
1094: * scanning of APs
1095: * o adhoc mode: to discover neighbors
1096: * o hostap mode: for passive scanning of neighbor APs
1097: * o when scanning
1098: * In other words, in all modes other than monitor (which
1099: * does not process incoming packets) and adhoc-demo (which
1100: * does not use management frames at all).
1101: */
1102: #ifdef DIAGNOSTIC
1103: if (ic->ic_opmode != IEEE80211_M_STA &&
1104: ic->ic_opmode != IEEE80211_M_IBSS &&
1105: ic->ic_opmode != IEEE80211_M_HOSTAP &&
1106: ic->ic_state != IEEE80211_S_SCAN) {
1107: panic("%s: impossible operating mode", __func__);
1108: }
1109: #endif
1110: wh = mtod(m0, struct ieee80211_frame *);
1111: frm = (const u_int8_t *)&wh[1];
1112: efrm = mtod(m0, u_int8_t *) + m0->m_len;
1113:
1114: IEEE80211_VERIFY_LENGTH(efrm - frm, 12);
1115: tstamp = frm; frm += 8;
1116: bintval = LE_READ_2(frm); frm += 2;
1117: capinfo = LE_READ_2(frm); frm += 2;
1118: ssid = rates = xrates = edca = wmm = rsn = wpa = NULL;
1119: bchan = ieee80211_chan2ieee(ic, ic->ic_bss->ni_chan);
1120: chan = bchan;
1121: fhdwell = 0;
1122: fhindex = 0;
1123: erp = 0;
1124: while (frm + 2 <= efrm) {
1125: if (frm + 2 + frm[1] > efrm) {
1126: ic->ic_stats.is_rx_elem_toosmall++;
1127: return;
1128: }
1129: switch (frm[0]) {
1130: case IEEE80211_ELEMID_SSID:
1131: ssid = frm;
1132: break;
1133: case IEEE80211_ELEMID_RATES:
1134: rates = frm;
1135: break;
1136: case IEEE80211_ELEMID_FHPARMS:
1137: if (ic->ic_phytype != IEEE80211_T_FH)
1138: break;
1139: if (frm[1] < 5) {
1140: ic->ic_stats.is_rx_elem_toosmall++;
1141: break;
1142: }
1143: fhdwell = LE_READ_2(frm + 2);
1144: chan = IEEE80211_FH_CHAN(frm[4], frm[5]);
1145: fhindex = frm[6];
1146: break;
1147: case IEEE80211_ELEMID_DSPARMS:
1148: if (ic->ic_phytype == IEEE80211_T_FH)
1149: break;
1150: if (frm[1] < 1) {
1151: ic->ic_stats.is_rx_elem_toosmall++;
1152: break;
1153: }
1154: chan = frm[2];
1155: break;
1156: case IEEE80211_ELEMID_TIM:
1157: break;
1158: case IEEE80211_ELEMID_IBSSPARMS:
1159: break;
1160: case IEEE80211_ELEMID_XRATES:
1161: xrates = frm;
1162: break;
1163: case IEEE80211_ELEMID_ERP:
1164: if (frm[1] < 1) {
1165: ic->ic_stats.is_rx_elem_toosmall++;
1166: break;
1167: }
1168: erp = frm[2];
1169: break;
1170: case IEEE80211_ELEMID_RSN:
1171: rsn = frm;
1172: break;
1173: case IEEE80211_ELEMID_EDCAPARMS:
1174: edca = frm;
1175: break;
1176: case IEEE80211_ELEMID_QOS_CAP:
1177: break;
1178: case IEEE80211_ELEMID_VENDOR:
1179: if (frm[1] < 4) {
1180: ic->ic_stats.is_rx_elem_toosmall++;
1181: break;
1182: }
1183: if (memcmp(frm + 2, MICROSOFT_OUI, 3) == 0) {
1184: if (frm[5] == 1)
1185: wpa = frm;
1186: else if (frm[1] >= 5 &&
1187: frm[5] == 2 && frm[6] == 1)
1188: wmm = frm;
1189: }
1190: break;
1191: default:
1192: IEEE80211_DPRINTF2(("%s: element id %u/len %u "
1193: "ignored\n", __func__, *frm, frm[1]));
1194: ic->ic_stats.is_rx_elem_unknown++;
1195: break;
1196: }
1197: frm += 2 + frm[1];
1198: }
1199: IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
1200: IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
1201:
1202: if (
1203: #if IEEE80211_CHAN_MAX < 255
1204: chan > IEEE80211_CHAN_MAX ||
1205: #endif
1206: isclr(ic->ic_chan_active, chan)) {
1207: IEEE80211_DPRINTF(("%s: ignore %s with invalid channel "
1208: "%u\n", __func__, ISPROBE(wh) ?
1209: "probe response" : "beacon", chan));
1210: ic->ic_stats.is_rx_badchan++;
1211: return;
1212: }
1213: if (!(ic->ic_caps & IEEE80211_C_SCANALL) &&
1214: (chan != bchan && ic->ic_phytype != IEEE80211_T_FH)) {
1215: /*
1216: * Frame was received on a channel different from the
1217: * one indicated in the DS params element id;
1218: * silently discard it.
1219: *
1220: * NB: this can happen due to signal leakage.
1221: * But we should take it for FH phy because
1222: * the rssi value should be correct even for
1223: * different hop pattern in FH.
1224: */
1225: IEEE80211_DPRINTF(("%s: ignore %s on channel %u marked "
1226: "for channel %u\n", __func__, ISPROBE(wh) ?
1227: "probe response" : "beacon", bchan, chan));
1228: ic->ic_stats.is_rx_chanmismatch++;
1229: return;
1230: }
1231: /*
1232: * Use mac, channel and rssi so we collect only the
1233: * best potential AP with the equal bssid while scanning.
1234: * Collecting all potential APs may result in bloat of
1235: * the node tree. This call will return NULL if the node
1236: * for this APs does not exist or if the new node is the
1237: * potential better one.
1238: */
1239: if ((ni = ieee80211_find_node_for_beacon(ic, wh->i_addr2,
1240: &ic->ic_channels[chan], ssid, rssi)) != NULL)
1241: return;
1242:
1243: #ifdef IEEE80211_DEBUG
1244: if (ieee80211_debug &&
1245: (ni == NULL || ic->ic_state == IEEE80211_S_SCAN)) {
1246: printf("%s: %s%s on chan %u (bss chan %u) ",
1247: __func__, (ni == NULL ? "new " : ""),
1248: ISPROBE(wh) ? "probe response" : "beacon",
1249: chan, bchan);
1250: ieee80211_print_essid(ssid + 2, ssid[1]);
1251: printf(" from %s\n", ether_sprintf((u_int8_t *)wh->i_addr2));
1252: printf("%s: caps 0x%x bintval %u erp 0x%x\n",
1253: __func__, capinfo, bintval, erp);
1254: }
1255: #endif
1256:
1257: if ((ni = ieee80211_find_node(ic, wh->i_addr2)) == NULL) {
1258: ni = ieee80211_alloc_node(ic, wh->i_addr2);
1259: if (ni == NULL)
1260: return;
1261: is_new = 1;
1262: } else
1263: is_new = 0;
1264:
1265: /*
1266: * When operating in station mode, check for state updates
1267: * while we're associated. We consider only 11g stuff right
1268: * now.
1269: */
1270: if (ic->ic_opmode == IEEE80211_M_STA &&
1271: ic->ic_state == IEEE80211_S_ASSOC &&
1272: ni->ni_state == IEEE80211_STA_BSS) {
1273: /*
1274: * Check if protection mode has changed since last
1275: * beacon.
1276: */
1277: if (ni->ni_erp != erp) {
1278: IEEE80211_DPRINTF((
1279: "[%s] erp change: was 0x%x, now 0x%x\n",
1280: ether_sprintf((u_int8_t *)wh->i_addr2),
1281: ni->ni_erp, erp));
1282: if (ic->ic_curmode == IEEE80211_MODE_11G &&
1283: (erp & IEEE80211_ERP_USE_PROTECTION))
1284: ic->ic_flags |= IEEE80211_F_USEPROT;
1285: else
1286: ic->ic_flags &= ~IEEE80211_F_USEPROT;
1287: ic->ic_bss->ni_erp = erp;
1288: }
1289: /*
1290: * Check if AP short slot time setting has changed
1291: * since last beacon and give the driver a chance to
1292: * update the hardware.
1293: */
1294: if ((ni->ni_capinfo ^ capinfo) &
1295: IEEE80211_CAPINFO_SHORT_SLOTTIME) {
1296: ieee80211_set_shortslottime(ic,
1297: ic->ic_curmode == IEEE80211_MODE_11A ||
1298: (capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1299: }
1300: }
1301: if (ni->ni_flags & IEEE80211_NODE_QOS) {
1302: if (edca != NULL)
1303: ieee80211_parse_edca_params(ic, edca);
1304: else if (wmm != NULL)
1305: ieee80211_parse_wmm_params(ic, edca);
1306: }
1307: if (ssid[1] != 0 && ni->ni_esslen == 0) {
1308: /*
1309: * Update ESSID at probe response to adopt hidden AP by
1310: * Lucent/Cisco, which announces null ESSID in beacon.
1311: */
1312: ni->ni_esslen = ssid[1];
1313: memset(ni->ni_essid, 0, sizeof(ni->ni_essid));
1314: memcpy(ni->ni_essid, ssid + 2, ssid[1]);
1315: }
1316: IEEE80211_ADDR_COPY(ni->ni_bssid, wh->i_addr3);
1317: ni->ni_rssi = rssi;
1318: ni->ni_rstamp = rstamp;
1319: memcpy(ni->ni_tstamp, tstamp, sizeof(ni->ni_tstamp));
1320: ni->ni_intval = bintval;
1321: ni->ni_capinfo = capinfo;
1322: /* XXX validate channel # */
1323: ni->ni_chan = &ic->ic_channels[chan];
1324: ni->ni_fhdwell = fhdwell;
1325: ni->ni_fhindex = fhindex;
1326: ni->ni_erp = erp;
1327: /* NB: must be after ni_chan is setup */
1328: ieee80211_setup_rates(ic, ni, rates, xrates, IEEE80211_F_DOSORT);
1329:
1330: /*
1331: * When scanning we record results (nodes) with a zero
1332: * refcnt. Otherwise we want to hold the reference for
1333: * ibss neighbors so the nodes don't get released prematurely.
1334: * Anything else can be discarded (XXX and should be handled
1335: * above so we don't do so much work).
1336: */
1337: if (ic->ic_opmode == IEEE80211_M_IBSS || (is_new && ISPROBE(wh))) {
1338: /*
1339: * Fake an association so the driver can setup it's
1340: * private state. The rate set has been setup above;
1341: * there is no handshake as in ap/station operation.
1342: */
1343: if (ic->ic_newassoc)
1344: (*ic->ic_newassoc)(ic, ni, 1);
1345: }
1346: #undef ISPROBE
1347: }
1348:
1349: /*-
1350: * Probe request frame format:
1351: * [tlv] SSID
1352: * [tlv] Supported rates
1353: * [tlv] Extended Supported Rates (802.11g)
1354: */
1355: void
1356: ieee80211_recv_probe_req(struct ieee80211com *ic, struct mbuf *m0,
1357: struct ieee80211_node *ni, int rssi, u_int32_t rstamp)
1358: {
1359: const struct ieee80211_frame *wh;
1360: const u_int8_t *frm, *efrm;
1361: const u_int8_t *ssid, *rates, *xrates;
1362: u_int8_t rate;
1363:
1364: if (ic->ic_opmode == IEEE80211_M_STA ||
1365: ic->ic_state != IEEE80211_S_RUN)
1366: return;
1367:
1368: wh = mtod(m0, struct ieee80211_frame *);
1369: frm = (const u_int8_t *)&wh[1];
1370: efrm = mtod(m0, u_int8_t *) + m0->m_len;
1371:
1372: ssid = rates = xrates = NULL;
1373: while (frm + 2 <= efrm) {
1374: if (frm + 2 + frm[1] > efrm) {
1375: ic->ic_stats.is_rx_elem_toosmall++;
1376: return;
1377: }
1378: switch (frm[0]) {
1379: case IEEE80211_ELEMID_SSID:
1380: ssid = frm;
1381: break;
1382: case IEEE80211_ELEMID_RATES:
1383: rates = frm;
1384: break;
1385: case IEEE80211_ELEMID_XRATES:
1386: xrates = frm;
1387: break;
1388: }
1389: frm += 2 + frm[1];
1390: }
1391: IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
1392: IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
1393: IEEE80211_VERIFY_SSID(ic->ic_bss, ssid, "probe");
1394: if ((ic->ic_flags & IEEE80211_F_HIDENWID) && ssid[1] == 0) {
1395: IEEE80211_DPRINTF(("%s: no ssid "
1396: "with ssid suppression enabled", __func__));
1397: ic->ic_stats.is_rx_ssidmismatch++;
1398: return;
1399: }
1400:
1401: if (ni == ic->ic_bss) {
1402: ni = ieee80211_dup_bss(ic, wh->i_addr2);
1403: if (ni == NULL)
1404: return;
1405: IEEE80211_DPRINTF(("%s: new probe req from %s\n",
1406: __func__, ether_sprintf((u_int8_t *)wh->i_addr2)));
1407: }
1408: ni->ni_rssi = rssi;
1409: ni->ni_rstamp = rstamp;
1410: rate = ieee80211_setup_rates(ic, ni, rates, xrates,
1411: IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | IEEE80211_F_DONEGO |
1412: IEEE80211_F_DODEL);
1413: if (rate & IEEE80211_RATE_BASIC) {
1414: IEEE80211_DPRINTF(("%s: rate mismatch for %s\n",
1415: __func__, ether_sprintf((u_int8_t *)wh->i_addr2)));
1416: } else {
1417: IEEE80211_SEND_MGMT(ic, ni,
1418: IEEE80211_FC0_SUBTYPE_PROBE_RESP, 0);
1419: }
1420: }
1421:
1422: /*-
1423: * Authentication frame format:
1424: * [2] Authentication algorithm number
1425: * [2] Authentication transaction sequence number
1426: * [2] Status code
1427: */
1428: void
1429: ieee80211_recv_auth(struct ieee80211com *ic, struct mbuf *m0,
1430: struct ieee80211_node *ni, int rssi, u_int32_t rstamp)
1431: {
1432: const struct ieee80211_frame *wh;
1433: const u_int8_t *frm, *efrm;
1434: u_int16_t algo, seq, status;
1435:
1436: wh = mtod(m0, struct ieee80211_frame *);
1437: frm = (const u_int8_t *)&wh[1];
1438: efrm = mtod(m0, u_int8_t *) + m0->m_len;
1439:
1440: IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
1441: algo = LE_READ_2(frm); frm += 2;
1442: seq = LE_READ_2(frm); frm += 2;
1443: status = LE_READ_2(frm); frm += 2;
1444: IEEE80211_DPRINTF(("%s: auth %d seq %d from %s\n",
1445: __func__, algo, seq, ether_sprintf((u_int8_t *)wh->i_addr2)));
1446:
1447: if (algo == IEEE80211_AUTH_ALG_OPEN)
1448: ieee80211_auth_open(ic, wh, ni, rssi, rstamp, seq, status);
1449: else {
1450: IEEE80211_DPRINTF(("%s: unsupported authentication "
1451: "algorithm %d from %s\n",
1452: __func__, algo, ether_sprintf((u_int8_t *)wh->i_addr2)));
1453: ic->ic_stats.is_rx_auth_unsupported++;
1454: if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1455: /* XXX hack to workaround calling convention */
1456: IEEE80211_SEND_MGMT(ic, ni,
1457: IEEE80211_FC0_SUBTYPE_AUTH,
1458: (seq+1) | (IEEE80211_STATUS_ALG<<16));
1459: }
1460: }
1461: }
1462:
1463: /*-
1464: * (Re)Association request frame format:
1465: * [2] Capability information
1466: * [2] Listen interval
1467: * [6*] Current AP address (Reassociation only)
1468: * [tlv] SSID
1469: * [tlv] Supported rates
1470: * [tlv] Extended Supported Rates (802.11g)
1471: * [tlv] RSN (802.11i)
1472: * [tlv] QoS Capability (802.11e)
1473: */
1474: void
1475: ieee80211_recv_assoc_req(struct ieee80211com *ic, struct mbuf *m0,
1476: struct ieee80211_node *ni, int rssi, u_int32_t rstamp)
1477: {
1478: #define ISREASSOC(_wh) (((_wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == \
1479: IEEE80211_FC0_SUBTYPE_REASSOC_REQ)
1480:
1481: const struct ieee80211_frame *wh;
1482: const u_int8_t *frm, *efrm;
1483: const u_int8_t *ssid, *rates, *xrates, *rsn, *wpa;
1484: u_int16_t capinfo, bintval;
1485: int reassoc, resp, reason = 0;
1486: u_int8_t rate;
1487:
1488: if (ic->ic_opmode != IEEE80211_M_HOSTAP ||
1489: ic->ic_state != IEEE80211_S_RUN)
1490: return;
1491:
1492: wh = mtod(m0, struct ieee80211_frame *);
1493: frm = (const u_int8_t *)&wh[1];
1494: efrm = mtod(m0, u_int8_t *) + m0->m_len;
1495:
1496: if (ISREASSOC(wh)) {
1497: reassoc = 1;
1498: resp = IEEE80211_FC0_SUBTYPE_REASSOC_RESP;
1499: } else {
1500: reassoc = 0;
1501: resp = IEEE80211_FC0_SUBTYPE_ASSOC_RESP;
1502: }
1503:
1504: IEEE80211_VERIFY_LENGTH(efrm - frm, (reassoc ? 10 : 4));
1505: if (!IEEE80211_ADDR_EQ(wh->i_addr3, ic->ic_bss->ni_bssid)) {
1506: IEEE80211_DPRINTF(("%s: ignore other bss from %s\n",
1507: __func__, ether_sprintf((u_int8_t *)wh->i_addr2)));
1508: ic->ic_stats.is_rx_assoc_bss++;
1509: return;
1510: }
1511: capinfo = LE_READ_2(frm); frm += 2;
1512: bintval = LE_READ_2(frm); frm += 2;
1513: if (reassoc)
1514: frm += IEEE80211_ADDR_LEN; /* skip current AP address */
1515: ssid = rates = xrates = rsn = wpa = NULL;
1516: while (frm + 2 <= efrm) {
1517: if (frm + 2 + frm[1] > efrm) {
1518: ic->ic_stats.is_rx_elem_toosmall++;
1519: return;
1520: }
1521: switch (frm[0]) {
1522: case IEEE80211_ELEMID_SSID:
1523: ssid = frm;
1524: break;
1525: case IEEE80211_ELEMID_RATES:
1526: rates = frm;
1527: break;
1528: case IEEE80211_ELEMID_XRATES:
1529: xrates = frm;
1530: break;
1531: case IEEE80211_ELEMID_RSN:
1532: rsn = frm;
1533: break;
1534: case IEEE80211_ELEMID_QOS_CAP:
1535: break;
1536: case IEEE80211_ELEMID_VENDOR:
1537: if (frm[1] < 4) {
1538: ic->ic_stats.is_rx_elem_toosmall++;
1539: break;
1540: }
1541: if (memcmp(frm + 2, MICROSOFT_OUI, 3) == 0) {
1542: if (frm[5] == 1)
1543: wpa = frm;
1544: }
1545: break;
1546: }
1547: frm += 2 + frm[1];
1548: }
1549: IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
1550: IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN);
1551: IEEE80211_VERIFY_SSID(ic->ic_bss, ssid,
1552: reassoc ? "reassoc" : "assoc");
1553: if (ni->ni_state != IEEE80211_STA_AUTH &&
1554: ni->ni_state != IEEE80211_STA_ASSOC) {
1555: IEEE80211_DPRINTF(
1556: ("%s: deny %sassoc from %s, not authenticated\n",
1557: __func__, reassoc ? "re" : "",
1558: ether_sprintf((u_int8_t *)wh->i_addr2)));
1559: ni = ieee80211_dup_bss(ic, wh->i_addr2);
1560: if (ni != NULL) {
1561: IEEE80211_SEND_MGMT(ic, ni,
1562: IEEE80211_FC0_SUBTYPE_DEAUTH,
1563: IEEE80211_REASON_ASSOC_NOT_AUTHED);
1564: }
1565: ic->ic_stats.is_rx_assoc_notauth++;
1566: return;
1567: }
1568: if (rsn != NULL)
1569: reason = ieee80211_parse_rsn(ic, ni, rsn);
1570: else if (wpa != NULL)
1571: reason = ieee80211_parse_wpa1(ic, ni, wpa);
1572: if (reason != 0) {
1573: IEEE80211_DPRINTF(("%s: invalid RSN IE for %s\n",
1574: __func__, ether_sprintf((u_int8_t *)wh->i_addr2)));
1575: IEEE80211_SEND_MGMT(ic, ni, IEEE80211_FC0_SUBTYPE_DEAUTH,
1576: reason);
1577: ieee80211_node_leave(ic, ni);
1578: ic->ic_stats.is_rx_assoc_badrsnie++;
1579: return;
1580: }
1581: if (!(capinfo & IEEE80211_CAPINFO_ESS)) {
1582: IEEE80211_DPRINTF(("%s: capinfo mismatch for %s\n",
1583: __func__, ether_sprintf((u_int8_t *)wh->i_addr2)));
1584: IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_CAPINFO);
1585: ieee80211_node_leave(ic, ni);
1586: ic->ic_stats.is_rx_assoc_capmismatch++;
1587: return;
1588: }
1589: rate = ieee80211_setup_rates(ic, ni, rates, xrates,
1590: IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | IEEE80211_F_DONEGO |
1591: IEEE80211_F_DODEL);
1592: if (rate & IEEE80211_RATE_BASIC) {
1593: IEEE80211_DPRINTF(("%s: rate mismatch for %s\n",
1594: __func__, ether_sprintf((u_int8_t *)wh->i_addr2)));
1595: IEEE80211_SEND_MGMT(ic, ni, resp, IEEE80211_STATUS_BASIC_RATE);
1596: ieee80211_node_leave(ic, ni);
1597: ic->ic_stats.is_rx_assoc_norate++;
1598: return;
1599: }
1600: ni->ni_rssi = rssi;
1601: ni->ni_rstamp = rstamp;
1602: ni->ni_intval = bintval;
1603: ni->ni_capinfo = capinfo;
1604: ni->ni_chan = ic->ic_bss->ni_chan;
1605: ni->ni_fhdwell = ic->ic_bss->ni_fhdwell;
1606: ni->ni_fhindex = ic->ic_bss->ni_fhindex;
1607:
1608: ieee80211_node_join(ic, ni, resp);
1609: #undef ISREASSOC
1610: }
1611:
1612: /*-
1613: * (Re)Association response frame format:
1614: * [2] Capability information
1615: * [2] Status code
1616: * [2] Association ID (AID)
1617: * [tlv] Supported rates
1618: * [tlv] Extended Supported Rates (802.11g)
1619: * [tlv] EDCA Parameter Set (802.11e)
1620: */
1621: void
1622: ieee80211_recv_assoc_resp(struct ieee80211com *ic, struct mbuf *m0,
1623: struct ieee80211_node *ni, int rssi, u_int32_t rstamp)
1624: {
1625: #define ISREASSOC(_wh) (((_wh)->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) == \
1626: IEEE80211_FC0_SUBTYPE_REASSOC_RESP)
1627:
1628: struct ifnet *ifp = &ic->ic_if;
1629: const struct ieee80211_frame *wh;
1630: const u_int8_t *frm, *efrm;
1631: const u_int8_t *rates, *xrates, *edca, *wmm;
1632: u_int16_t capinfo, status, associd;
1633: u_int8_t rate;
1634:
1635: if (ic->ic_opmode != IEEE80211_M_STA ||
1636: ic->ic_state != IEEE80211_S_ASSOC) {
1637: ic->ic_stats.is_rx_mgtdiscard++;
1638: return;
1639: }
1640:
1641: wh = mtod(m0, struct ieee80211_frame *);
1642: frm = (const u_int8_t *)&wh[1];
1643: efrm = mtod(m0, u_int8_t *) + m0->m_len;
1644:
1645: IEEE80211_VERIFY_LENGTH(efrm - frm, 6);
1646: ni = ic->ic_bss;
1647: capinfo = LE_READ_2(frm); frm += 2;
1648: status = LE_READ_2(frm); frm += 2;
1649: if (status != 0) {
1650: if (ifp->if_flags & IFF_DEBUG)
1651: printf("%s: %sassociation failed (reason %d)"
1652: " for %s\n", ifp->if_xname,
1653: ISREASSOC(wh) ? "re" : "",
1654: status, ether_sprintf((u_int8_t *)wh->i_addr3));
1655: if (ni != ic->ic_bss)
1656: ni->ni_fails++;
1657: ic->ic_stats.is_rx_auth_fail++;
1658: return;
1659: }
1660: associd = LE_READ_2(frm); frm += 2;
1661:
1662: rates = xrates = edca = wmm = NULL;
1663: while (frm + 2 <= efrm) {
1664: if (frm + 2 + frm[1] > efrm) {
1665: ic->ic_stats.is_rx_elem_toosmall++;
1666: return;
1667: }
1668: switch (frm[0]) {
1669: case IEEE80211_ELEMID_RATES:
1670: rates = frm;
1671: break;
1672: case IEEE80211_ELEMID_XRATES:
1673: xrates = frm;
1674: break;
1675: case IEEE80211_ELEMID_EDCAPARMS:
1676: edca = frm;
1677: break;
1678: case IEEE80211_ELEMID_VENDOR:
1679: if (frm[1] < 4) {
1680: ic->ic_stats.is_rx_elem_toosmall++;
1681: break;
1682: }
1683: if (memcmp(frm + 2, MICROSOFT_OUI, 3) == 0) {
1684: if (frm[1] >= 5 && frm[5] == 2 && frm[6] == 1)
1685: wmm = frm;
1686: }
1687: break;
1688: }
1689: frm += 2 + frm[1];
1690: }
1691:
1692: IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE);
1693: rate = ieee80211_setup_rates(ic, ni, rates, xrates,
1694: IEEE80211_F_DOSORT | IEEE80211_F_DOFRATE | IEEE80211_F_DONEGO |
1695: IEEE80211_F_DODEL);
1696: if (rate & IEEE80211_RATE_BASIC) {
1697: IEEE80211_DPRINTF(("%s: rate mismatch for %s\n",
1698: __func__, ether_sprintf((u_int8_t *)wh->i_addr2)));
1699: ic->ic_stats.is_rx_assoc_norate++;
1700: return;
1701: }
1702: ni->ni_capinfo = capinfo;
1703: ni->ni_associd = associd;
1704: if (edca != NULL || wmm != NULL) {
1705: /* force update of EDCA parameters */
1706: ic->ic_edca_updtcount = -1;
1707:
1708: if ((edca != NULL &&
1709: ieee80211_parse_edca_params(ic, edca) == 0) ||
1710: (wmm != NULL &&
1711: ieee80211_parse_wmm_params(ic, wmm) == 0))
1712: ni->ni_flags |= IEEE80211_NODE_QOS;
1713: else /* for Reassociation */
1714: ni->ni_flags &= ~IEEE80211_NODE_QOS;
1715: }
1716: /*
1717: * Configure state now that we are associated.
1718: */
1719: if (ic->ic_curmode == IEEE80211_MODE_11A ||
1720: (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE))
1721: ic->ic_flags |= IEEE80211_F_SHPREAMBLE;
1722: else
1723: ic->ic_flags &= ~IEEE80211_F_SHPREAMBLE;
1724:
1725: ieee80211_set_shortslottime(ic,
1726: ic->ic_curmode == IEEE80211_MODE_11A ||
1727: (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME));
1728: /*
1729: * Honor ERP protection.
1730: */
1731: if (ic->ic_curmode == IEEE80211_MODE_11G &&
1732: (ni->ni_erp & IEEE80211_ERP_USE_PROTECTION))
1733: ic->ic_flags |= IEEE80211_F_USEPROT;
1734: else
1735: ic->ic_flags &= ~IEEE80211_F_USEPROT;
1736:
1737: ieee80211_new_state(ic, IEEE80211_S_RUN,
1738: wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1739: #undef ISREASSOC
1740: }
1741:
1742: /*-
1743: * Deauthentication frame format:
1744: * [2] Reason code
1745: */
1746: void
1747: ieee80211_recv_deauth(struct ieee80211com *ic, struct mbuf *m0,
1748: struct ieee80211_node *ni, int rssi, u_int32_t rstamp)
1749: {
1750: struct ifnet *ifp = &ic->ic_if;
1751: const struct ieee80211_frame *wh;
1752: const u_int8_t *frm, *efrm;
1753: u_int16_t reason;
1754:
1755: wh = mtod(m0, struct ieee80211_frame *);
1756: frm = (const u_int8_t *)&wh[1];
1757: efrm = mtod(m0, u_int8_t *) + m0->m_len;
1758:
1759: IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
1760: reason = LE_READ_2(frm);
1761: ic->ic_stats.is_rx_deauth++;
1762: switch (ic->ic_opmode) {
1763: case IEEE80211_M_STA:
1764: ieee80211_new_state(ic, IEEE80211_S_AUTH,
1765: wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1766: break;
1767: case IEEE80211_M_HOSTAP:
1768: if (ni != ic->ic_bss) {
1769: if (ifp->if_flags & IFF_DEBUG)
1770: printf("%s: station %s deauthenticated "
1771: "by peer (reason %d)\n",
1772: ifp->if_xname,
1773: ether_sprintf(ni->ni_macaddr),
1774: reason);
1775: ieee80211_node_leave(ic, ni);
1776: }
1777: break;
1778: default:
1779: break;
1780: }
1781: }
1782:
1783: /*-
1784: * Disassociation frame format:
1785: * [2] Reason code
1786: */
1787: void
1788: ieee80211_recv_disassoc(struct ieee80211com *ic, struct mbuf *m0,
1789: struct ieee80211_node *ni, int rssi, u_int32_t rstamp)
1790: {
1791: struct ifnet *ifp = &ic->ic_if;
1792: const struct ieee80211_frame *wh;
1793: const u_int8_t *frm, *efrm;
1794: u_int16_t reason;
1795:
1796: wh = mtod(m0, struct ieee80211_frame *);
1797: frm = (const u_int8_t *)&wh[1];
1798: efrm = mtod(m0, u_int8_t *) + m0->m_len;
1799:
1800: IEEE80211_VERIFY_LENGTH(efrm - frm, 2);
1801: reason = LE_READ_2(frm);
1802: ic->ic_stats.is_rx_disassoc++;
1803: switch (ic->ic_opmode) {
1804: case IEEE80211_M_STA:
1805: ieee80211_new_state(ic, IEEE80211_S_ASSOC,
1806: wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK);
1807: break;
1808: case IEEE80211_M_HOSTAP:
1809: if (ni != ic->ic_bss) {
1810: if (ifp->if_flags & IFF_DEBUG)
1811: printf("%s: station %s disassociated "
1812: "by peer (reason %d)\n",
1813: ifp->if_xname,
1814: ether_sprintf(ni->ni_macaddr),
1815: reason);
1816: ieee80211_node_leave(ic, ni);
1817: }
1818: break;
1819: default:
1820: break;
1821: }
1822: }
1823:
1824: void
1825: ieee80211_recv_mgmt(struct ieee80211com *ic, struct mbuf *m0,
1826: struct ieee80211_node *ni, int subtype, int rssi, u_int32_t rstamp)
1827: {
1828: switch (subtype) {
1829: case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
1830: case IEEE80211_FC0_SUBTYPE_BEACON:
1831: ieee80211_recv_probe_resp(ic, m0, ni, rssi, rstamp);
1832: break;
1833: case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
1834: ieee80211_recv_probe_req(ic, m0, ni, rssi, rstamp);
1835: break;
1836: case IEEE80211_FC0_SUBTYPE_AUTH:
1837: ieee80211_recv_auth(ic, m0, ni, rssi, rstamp);
1838: break;
1839: case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
1840: case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
1841: ieee80211_recv_assoc_req(ic, m0, ni, rssi, rstamp);
1842: break;
1843: case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
1844: case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
1845: ieee80211_recv_assoc_resp(ic, m0, ni, rssi, rstamp);
1846: break;
1847: case IEEE80211_FC0_SUBTYPE_DEAUTH:
1848: ieee80211_recv_deauth(ic, m0, ni, rssi, rstamp);
1849: break;
1850: case IEEE80211_FC0_SUBTYPE_DISASSOC:
1851: ieee80211_recv_disassoc(ic, m0, ni, rssi, rstamp);
1852: break;
1853: default:
1854: IEEE80211_DPRINTF(("%s: mgmt frame with subtype 0x%x not "
1855: "handled\n", __func__, subtype));
1856: ic->ic_stats.is_rx_badsubtype++;
1857: break;
1858: }
1859: }
1860: #undef IEEE80211_VERIFY_LENGTH
1861: #undef IEEE80211_VERIFY_ELEMENT
1862: #undef IEEE80211_VERIFY_SSID
1863:
1864: /* unaligned big endian access */
1865: #define BE_READ_2(p) \
1866: ((u_int16_t)(p)[0] << 8 | (u_int16_t)(p)[1])
1867:
1868: #define BE_READ_8(p) \
1869: ((u_int64_t)(p)[0] << 56 | (u_int64_t)(p)[1] << 48 | \
1870: (u_int64_t)(p)[2] << 40 | (u_int64_t)(p)[3] << 32 | \
1871: (u_int64_t)(p)[4] << 24 | (u_int64_t)(p)[5] << 16 | \
1872: (u_int64_t)(p)[6] << 8 | (u_int64_t)(p)[7])
1873:
1874: #define BE_WRITE_2(p, v) do { \
1875: (p)[0] = (v) >> 8; \
1876: (p)[1] = (v) & 0xff; \
1877: } while (0)
1878:
1879: /* unaligned little endian access */
1880: #define LE_READ_8(p) \
1881: ((u_int64_t)(p)[7] << 56 | (u_int64_t)(p)[6] << 48 | \
1882: (u_int64_t)(p)[5] << 40 | (u_int64_t)(p)[4] << 32 | \
1883: (u_int64_t)(p)[3] << 24 | (u_int64_t)(p)[2] << 16 | \
1884: (u_int64_t)(p)[1] << 8 | (u_int64_t)(p)[0])
1885:
1886: /*
1887: * 4-Way Handshake Message 1 is sent by the authenticator to the supplicant
1888: * (see 8.5.3.1).
1889: */
1890: void
1891: ieee80211_recv_4way_msg1(struct ieee80211com *ic,
1892: const struct ieee80211_eapol_key *key, struct ieee80211_node *ni)
1893: {
1894: u_int8_t snonce[EAPOL_KEY_NONCE_LEN];
1895: const u_int8_t *frm, *efrm;
1896: const u_int8_t *pmkid;
1897: const u_int8_t *pmk;
1898: size_t pmk_len;
1899:
1900: if (ic->ic_opmode != IEEE80211_M_STA &&
1901: ic->ic_opmode != IEEE80211_M_IBSS)
1902: return;
1903:
1904: if (ni->ni_replaycnt_ok &&
1905: BE_READ_8(key->replaycnt) <= ni->ni_replaycnt)
1906: return;
1907:
1908: /* save authenticator's nonce (ANonce) */
1909: memcpy(ni->ni_nonce, key->nonce, EAPOL_KEY_NONCE_LEN);
1910:
1911: /* parse key data field (shall contain an encapsulated PMKID) */
1912: frm = (const u_int8_t *)&key[1];
1913: efrm = frm + BE_READ_2(key->paylen);
1914:
1915: pmkid = NULL;
1916: while (frm + 2 <= efrm) {
1917: if (frm + 2 + frm[1] > efrm)
1918: break;
1919: switch (frm[0]) {
1920: case IEEE80211_ELEMID_VENDOR:
1921: if (frm[1] < 4)
1922: break;
1923: if (memcmp(&frm[2], IEEE80211_OUI, 3) == 0) {
1924: switch (frm[5]) {
1925: case IEEE80211_KDE_PMKID:
1926: pmkid = frm;
1927: break;
1928: }
1929: }
1930: break;
1931: }
1932: frm += 2 + frm[1];
1933: }
1934: /* check that the PMKID KDE is valid */
1935: if (pmkid != NULL && pmkid[1] - 4 < 16)
1936: return;
1937:
1938: /* update the last seen value of the key replay counter field */
1939: ni->ni_replaycnt = BE_READ_8(key->replaycnt);
1940: /* do not set ni_replaycnt_ok since the frame contains no MIC */
1941:
1942: /* generate a new nonce (SNonce) */
1943: get_random_bytes(snonce, EAPOL_KEY_NONCE_LEN);
1944:
1945: if (ni->ni_akm == IEEE80211_AKM_IEEE8021X) {
1946: /* XXX find the PMK in the PMKSA cache using the PMKID */
1947: } else {
1948: /* XXX the PMK is the PSK */
1949: }
1950:
1951: /* derive PTK from PMK */
1952: ieee80211_derive_ptk(pmk, pmk_len, ni->ni_macaddr, ic->ic_myaddr,
1953: ni->ni_nonce, snonce, (u_int8_t *)&ni->ni_ptk, sizeof(ni->ni_ptk));
1954: ni->ni_ptk_ok = 1;
1955:
1956: if (ic->ic_if.if_flags & IFF_DEBUG)
1957: printf("%s: received msg %d/%d of the %s handshake from %s\n",
1958: ic->ic_if.if_xname, 1, 4, "4-way",
1959: ether_sprintf(ni->ni_macaddr));
1960:
1961: /* send message 2 to authenticator */
1962: ieee80211_send_4way_msg2(ic, ni, snonce);
1963: }
1964:
1965: /*
1966: * 4-Way Handshake Message 2 is sent by the supplicant to the authenticator
1967: * (see 8.5.3.2).
1968: */
1969: void
1970: ieee80211_recv_4way_msg2(struct ieee80211com *ic,
1971: const struct ieee80211_eapol_key *key, struct ieee80211_node *ni)
1972: {
1973: const u_int8_t *frm, *efrm;
1974: const u_int8_t *rsn;
1975: const u_int8_t *pmk;
1976: size_t pmk_len;
1977:
1978: if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
1979: ic->ic_opmode != IEEE80211_M_IBSS)
1980: return;
1981:
1982: if (BE_READ_8(key->replaycnt) != ni->ni_replaycnt)
1983: return;
1984:
1985: /* derive PTK from PMK */
1986: ieee80211_derive_ptk(pmk, pmk_len, ic->ic_myaddr, ni->ni_macaddr,
1987: ni->ni_nonce, key->nonce, (u_int8_t *)&ni->ni_ptk,
1988: sizeof(ni->ni_ptk));
1989: ni->ni_ptk_ok = 1;
1990:
1991: /* parse key data field (shall contain an RSN IE) */
1992: frm = (const u_int8_t *)&key[1];
1993: efrm = frm + BE_READ_2(key->paylen);
1994:
1995: rsn = NULL;
1996: while (frm + 2 <= efrm) {
1997: if (frm + 2 + frm[1] > efrm)
1998: break;
1999: switch (frm[0]) {
2000: case IEEE80211_ELEMID_RSN:
2001: rsn = frm;
2002: break;
2003: case IEEE80211_ELEMID_VENDOR:
2004: if (frm[1] < 4)
2005: break;
2006: if (memcmp(&frm[2], MICROSOFT_OUI, 3) == 0) {
2007: switch (frm[5]) {
2008: case 1: /* WPA */
2009: rsn = frm;
2010: break;
2011: }
2012: }
2013: }
2014: frm += 2 + frm[1];
2015: }
2016: if (rsn == NULL)
2017: return;
2018:
2019: /*
2020: * The RSN IE must match bit-wise with what the STA included in its
2021: * (Re)Association Request.
2022: */
2023: if (ni->ni_rsnie == NULL || rsn[1] != ni->ni_rsnie[1] ||
2024: memcmp(rsn, ni->ni_rsnie, 2 + rsn[1]) != 0)
2025: return;
2026:
2027: if (ic->ic_if.if_flags & IFF_DEBUG)
2028: printf("%s: received msg %d/%d of the %s handshake from %s\n",
2029: ic->ic_if.if_xname, 2, 4, "4-way",
2030: ether_sprintf(ni->ni_macaddr));
2031:
2032: /* send message 3 to supplicant */
2033: ieee80211_send_4way_msg3(ic, ni);
2034: }
2035:
2036: /*
2037: * 4-Way Handshake Message 3 is sent by the authenticator to the supplicant
2038: * (see 8.5.3.3).
2039: */
2040: void
2041: ieee80211_recv_4way_msg3(struct ieee80211com *ic,
2042: const struct ieee80211_eapol_key *key, struct ieee80211_node *ni)
2043: {
2044: struct ieee80211_key *k;
2045: const u_int8_t *frm, *efrm;
2046: const u_int8_t *rsn1, *rsn2, *gtk;
2047:
2048: if (ic->ic_opmode != IEEE80211_M_STA &&
2049: ic->ic_opmode != IEEE80211_M_IBSS)
2050: return;
2051:
2052: if (BE_READ_8(key->replaycnt) <= ni->ni_replaycnt)
2053: return;
2054:
2055: /* check that ANonce matches the one received in message 1 */
2056: if (memcmp(key->nonce, ni->ni_nonce, EAPOL_KEY_NONCE_LEN) != 0)
2057: return;
2058:
2059: /* parse key data field */
2060: frm = (const u_int8_t *)&key[1];
2061: efrm = frm + BE_READ_2(key->paylen);
2062:
2063: rsn1 = rsn2 = gtk = NULL;
2064: while (frm + 2 <= efrm) {
2065: if (frm + 2 + frm[1] > efrm)
2066: break;
2067: switch (frm[0]) {
2068: case IEEE80211_ELEMID_RSN:
2069: if (rsn1 == NULL)
2070: rsn1 = frm;
2071: else if (rsn2 == NULL)
2072: rsn2 = frm;
2073: /* ignore if more than two RSN IEs */
2074: break;
2075: case IEEE80211_ELEMID_VENDOR:
2076: if (frm[1] < 4)
2077: break;
2078: if (memcmp(&frm[2], IEEE80211_OUI, 3) == 0) {
2079: switch (frm[5]) {
2080: case IEEE80211_KDE_GTK:
2081: gtk = frm;
2082: break;
2083: }
2084: } else if (memcmp(&frm[2], MICROSOFT_OUI, 3) == 0) {
2085: switch (frm[5]) {
2086: case 1: /* WPA */
2087: rsn1 = frm;
2088: break;
2089: }
2090: }
2091: break;
2092: }
2093: frm += 2 + frm[1];
2094: }
2095: /* first WPA/RSN IE is mandatory */
2096: if (rsn1 == NULL)
2097: return;
2098: /* key data must be encrypted if GTK is included */
2099: if (gtk != NULL && !(BE_READ_2(key->info) & EAPOL_KEY_ENCRYPTED))
2100: return;
2101:
2102: /*
2103: * Check that first RSN IE is identical to the one received in
2104: * the beacon or probe response frame.
2105: */
2106: if (ni->ni_rsnie == NULL || rsn1[1] != ni->ni_rsnie[1] ||
2107: memcmp(rsn1, ni->ni_rsnie, 2 + rsn1[1]) != 0)
2108: return;
2109:
2110: /* update the last seen value of the key replay counter field */
2111: ni->ni_replaycnt = BE_READ_8(key->replaycnt);
2112: ni->ni_replaycnt_ok = 1;
2113:
2114: /*
2115: * If a second RSN information element is present, use its pairwise
2116: * cipher suite or deauthenticate.
2117: */
2118: if (rsn2 != NULL) {
2119: /* XXX ieee80211_parse_rsn(rsn2); */
2120: }
2121:
2122: /* install the PTK */
2123: k = &ni->ni_pairwise_key;
2124: memset(k, 0, sizeof(*k));
2125: k->k_cipher = ni->ni_pairwise_cipher;
2126: k->k_flags = IEEE80211_KEY_TX;
2127: k->k_len = BE_READ_2(key->keylen);
2128: /* check that key length matches pairwise cipher */
2129: if (k->k_len != ieee80211_cipher_keylen(k->k_cipher))
2130: return;
2131: memcpy(k->k_key, ni->ni_ptk.tk, k->k_len);
2132: if (ic->ic_set_key != NULL && (*ic->ic_set_key)(ic, ni, k) != 0)
2133: return;
2134:
2135: if (gtk != NULL) {
2136: u_int8_t kid;
2137:
2138: /* check that the GTK KDE is valid */
2139: if (gtk[1] - 4 < 2)
2140: return;
2141:
2142: /* install the GTK */
2143: kid = gtk[6] & 3;
2144: k = &ic->ic_nw_keys[kid];
2145: memset(k, 0, sizeof(*k));
2146: k->k_id = kid;
2147: k->k_cipher = ni->ni_group_cipher;
2148: k->k_flags = IEEE80211_KEY_GROUP;
2149: if (gtk[6] & (1 << 2)) /* Tx bit */
2150: k->k_flags |= IEEE80211_KEY_TX;
2151: k->k_len = gtk[1] - 6;
2152: /* check that key length matches group cipher */
2153: if (k->k_len != ieee80211_cipher_keylen(k->k_cipher))
2154: return; /* XXX PTK already installed! */
2155: memcpy(k->k_key, >k[8], k->k_len);
2156: k->k_rsc = LE_READ_8(key->rsc);
2157: if (ic->ic_set_key != NULL &&
2158: (*ic->ic_set_key)(ic, ni, k) != 0)
2159: return;
2160: }
2161:
2162: /* mark the PAE port as valid */
2163: ni->ni_port_valid = 1;
2164:
2165: if (ic->ic_if.if_flags & IFF_DEBUG)
2166: printf("%s: received msg %d/%d of the %s handshake from %s\n",
2167: ic->ic_if.if_xname, 3, 4, "4-way",
2168: ether_sprintf(ni->ni_macaddr));
2169:
2170: /* send message 4 to authenticator */
2171: ieee80211_send_4way_msg4(ic, ni);
2172: }
2173:
2174: /*
2175: * 4-Way Handshake Message 4 is sent by the supplicant to the authenticator
2176: * (see 8.5.3.4).
2177: */
2178: void
2179: ieee80211_recv_4way_msg4(struct ieee80211com *ic,
2180: const struct ieee80211_eapol_key *key, struct ieee80211_node *ni)
2181: {
2182: struct ieee80211_key *k;
2183:
2184: if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2185: ic->ic_opmode != IEEE80211_M_IBSS)
2186: return;
2187:
2188: if (BE_READ_8(key->replaycnt) != ni->ni_replaycnt)
2189: return;
2190:
2191: /* empty key data field */
2192:
2193: /* install the PTK */
2194: k = &ni->ni_pairwise_key;
2195: memset(k, 0, sizeof(*k));
2196: k->k_cipher = ni->ni_pairwise_cipher;
2197: k->k_flags = IEEE80211_KEY_TX;
2198: k->k_len = ieee80211_cipher_keylen(k->k_cipher);
2199: memcpy(k->k_key, ni->ni_ptk.tk, k->k_len);
2200: if (ic->ic_set_key != NULL && (*ic->ic_set_key)(ic, ni, k) != 0)
2201: return;
2202:
2203: if (ic->ic_opmode == IEEE80211_M_IBSS) {
2204: if (++ni->ni_key_count == 2)
2205: ni->ni_port_valid = 1;
2206: } else
2207: ni->ni_port_valid = 1;
2208:
2209: /* increment the 64-bit Key Replay Counter */
2210: ni->ni_replaycnt++;
2211:
2212: if (ic->ic_if.if_flags & IFF_DEBUG)
2213: printf("%s: received msg %d/%d of the %s handshake from %s\n",
2214: ic->ic_if.if_xname, 4, 4, "4-way",
2215: ether_sprintf(ni->ni_macaddr));
2216: }
2217:
2218: /*
2219: * Group Key Handshake Message 1 is sent by the authenticator to the
2220: * supplicant (see 8.5.4.1).
2221: */
2222: void
2223: ieee80211_recv_rsn_group_msg1(struct ieee80211com *ic,
2224: const struct ieee80211_eapol_key *key, struct ieee80211_node *ni)
2225: {
2226: struct ieee80211_key *k;
2227: const u_int8_t *frm, *efrm;
2228: const u_int8_t *gtk;
2229: u_int8_t kid;
2230:
2231: if (ic->ic_opmode != IEEE80211_M_STA &&
2232: ic->ic_opmode != IEEE80211_M_IBSS)
2233: return;
2234:
2235: if (BE_READ_8(key->replaycnt) <= ni->ni_replaycnt)
2236: return;
2237:
2238: /* parse key data field (shall contain a GTK KDE) */
2239: frm = (const u_int8_t *)&key[1];
2240: efrm = frm + BE_READ_2(key->paylen);
2241:
2242: gtk = NULL;
2243: while (frm + 2 <= efrm) {
2244: if (frm + 2 + frm[1] > efrm)
2245: break;
2246: switch (frm[0]) {
2247: case IEEE80211_ELEMID_VENDOR:
2248: if (frm[1] < 4)
2249: break;
2250: if (memcmp(&frm[2], IEEE80211_OUI, 3) == 0) {
2251: switch (frm[5]) {
2252: case IEEE80211_KDE_GTK:
2253: gtk = frm;
2254: break;
2255: }
2256: }
2257: break;
2258: }
2259: frm += 2 + frm[1];
2260: }
2261: if (gtk == NULL || !(BE_READ_2(key->info) & EAPOL_KEY_ENCRYPTED))
2262: return;
2263:
2264: /* check that the GTK KDE is valid */
2265: if (gtk[1] - 4 < 2)
2266: return;
2267:
2268: /* install the GTK */
2269: kid = gtk[6] & 3;
2270: k = &ic->ic_nw_keys[kid];
2271: memset(k, 0, sizeof(*k));
2272: k->k_id = kid;
2273: k->k_cipher = ni->ni_group_cipher;
2274: k->k_flags = IEEE80211_KEY_GROUP;
2275: if (gtk[6] & (1 << 2)) /* Tx bit */
2276: k->k_flags |= IEEE80211_KEY_TX;
2277: k->k_len = gtk[1] - 6;
2278: /* check that key length matches group cipher */
2279: if (k->k_len != ieee80211_cipher_keylen(k->k_cipher))
2280: return;
2281: memcpy(k->k_key, >k[8], k->k_len);
2282: k->k_rsc = LE_READ_8(key->rsc);
2283: if (ic->ic_set_key != NULL && (*ic->ic_set_key)(ic, ni, k) != 0)
2284: return;
2285:
2286: /* update the last seen value of the key replay counter field */
2287: ni->ni_replaycnt = BE_READ_8(key->replaycnt);
2288:
2289: if (ic->ic_if.if_flags & IFF_DEBUG)
2290: printf("%s: received msg %d/%d of the %s handshake from %s\n",
2291: ic->ic_if.if_xname, 1, 2, "group key",
2292: ether_sprintf(ni->ni_macaddr));
2293:
2294: /* send message 2 to authenticator */
2295: ieee80211_send_group_msg2(ic, ni, k);
2296: }
2297:
2298: void
2299: ieee80211_recv_wpa_group_msg1(struct ieee80211com *ic,
2300: struct ieee80211_eapol_key *key, struct ieee80211_node *ni)
2301: {
2302: struct ieee80211_key *k;
2303: u_int16_t info;
2304: u_int8_t kid;
2305:
2306: if (ic->ic_opmode != IEEE80211_M_STA &&
2307: ic->ic_opmode != IEEE80211_M_IBSS)
2308: return;
2309:
2310: if (BE_READ_8(key->replaycnt) <= ni->ni_replaycnt)
2311: return;
2312:
2313: /*
2314: * EAPOL-Key data field is encrypted even though WPA1 doesn't set
2315: * the ENCRYPTED bit in the info field.
2316: */
2317: if (!ni->ni_ptk_ok ||
2318: ieee80211_eapol_key_decrypt(key, ni->ni_ptk.kek) != 0)
2319: return;
2320:
2321: info = BE_READ_2(key->info);
2322:
2323: /* install the GTK */
2324: kid = (info >> EAPOL_KEY_WPA_KID_SHIFT) & 3;
2325: k = &ic->ic_nw_keys[kid];
2326: memset(k, 0, sizeof(*k));
2327: k->k_id = kid;
2328: k->k_cipher = ni->ni_group_cipher;
2329: k->k_flags = IEEE80211_KEY_GROUP;
2330: if (info & EAPOL_KEY_WPA_TX)
2331: k->k_flags |= IEEE80211_KEY_TX;
2332: k->k_len = BE_READ_2(key->keylen);
2333: /* check that key length matches group cipher */
2334: if (k->k_len != ieee80211_cipher_keylen(k->k_cipher))
2335: return;
2336: memcpy(k->k_key, (u_int8_t *)&key[1], k->k_len);
2337: k->k_rsc = LE_READ_8(key->rsc);
2338: if (ic->ic_set_key != NULL && (*ic->ic_set_key)(ic, ni, k) != 0)
2339: return;
2340:
2341: /* update the last seen value of the key replay counter field */
2342: ni->ni_replaycnt = BE_READ_8(key->replaycnt);
2343:
2344: if (ic->ic_if.if_flags & IFF_DEBUG)
2345: printf("%s: received msg %d/%d of the %s handshake from %s\n",
2346: ic->ic_if.if_xname, 1, 2, "group key",
2347: ether_sprintf(ni->ni_macaddr));
2348:
2349: /* send message 2 to authenticator */
2350: ieee80211_send_group_msg2(ic, ni, k);
2351: }
2352:
2353: /*
2354: * Group Key Handshake Message 2 is sent by the supplicant to the
2355: * authenticator (see 8.5.4.2).
2356: */
2357: void
2358: ieee80211_recv_group_msg2(struct ieee80211com *ic,
2359: const struct ieee80211_eapol_key *key, struct ieee80211_node *ni)
2360: {
2361: if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2362: ic->ic_opmode != IEEE80211_M_IBSS)
2363: return;
2364:
2365: if (BE_READ_8(key->replaycnt) != ni->ni_replaycnt)
2366: return;
2367:
2368: /* empty key data field */
2369:
2370: #ifdef notyet
2371: if (--ic->ic_keydone_sta == 0) {
2372: /* install GTK */
2373: }
2374: #endif
2375: if (ic->ic_if.if_flags & IFF_DEBUG)
2376: printf("%s: received msg %d/%d of the %s handshake from %s\n",
2377: ic->ic_if.if_xname, 2, 2, "group key",
2378: ether_sprintf(ni->ni_macaddr));
2379: }
2380:
2381: /*
2382: * EAPOL-Key Request frames are sent by the supplicant to request that the
2383: * authenticator initiate either a 4-Way Handshake or Group Key Handshake
2384: * and to report a MIC failure in a TKIP MSDU.
2385: */
2386: void
2387: ieee80211_recv_eapol_key_req(struct ieee80211com *ic,
2388: const struct ieee80211_eapol_key *key, struct ieee80211_node *ni)
2389: {
2390: u_int16_t info;
2391:
2392: if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2393: ic->ic_opmode != IEEE80211_M_IBSS)
2394: return;
2395:
2396: info = BE_READ_2(key->info);
2397:
2398: if (info & EAPOL_KEY_ERROR) {
2399: /* TKIP MIC failure */
2400:
2401: } else if (info & EAPOL_KEY_PAIRWISE) {
2402: /* initiate the 4-Way Handshake */
2403:
2404: } else {
2405: /*
2406: * Should change the GTK, initiate the 4-Way Handshake and
2407: * then execute a Group Key Handshake with all supplicants.
2408: */
2409: }
2410: }
2411:
2412: #ifdef IEEE80211_DEBUG
2413: static void
2414: ieee80211_print_eapol_key(struct ieee80211com *ic,
2415: const struct ieee80211_eapol_key *key, const struct ieee80211_node *ni)
2416: {
2417: int i;
2418: printf("%s: received EAPOL-Key frame from %s\n",
2419: ic->ic_if.if_xname, ether_sprintf((u_int8_t *)ni->ni_macaddr));
2420: printf("version=0x%02x type=0x%02x desc=0x%02x body length=%d "
2421: "data length=%d\n", key->version, key->type, key->desc,
2422: BE_READ_2(key->len), BE_READ_2(key->paylen));
2423: printf("info=%b\n", BE_READ_2(key->info),
2424: "\20\x03PAIRWISE\x06INSTALL\x07KEYACK\x08KEYMIC\x09SECURE"
2425: "\x0aERROR\x0bREQUEST\x0cENCRYPTED\x0dSMK");
2426: printf("Key Replay Counter=0x");
2427: for (i = 0; i < 8; i++)
2428: printf("%02x", key->replaycnt[i]);
2429: printf("\n");
2430: printf("Key Nonce=0x");
2431: for (i = 0; i < EAPOL_KEY_NONCE_LEN; i++)
2432: printf("%02x", key->nonce[i]);
2433: printf("\n");
2434: printf("Key IV=0x");
2435: for (i = 0; i < EAPOL_KEY_IV_LEN; i++)
2436: printf("%02x", key->iv[i]);
2437: printf("\n");
2438: printf("Key RSC=0x");
2439: for (i = 0; i < 8; i++)
2440: printf("%02x", key->rsc[i]);
2441: printf("\n");
2442: printf("Key MIC=0x");
2443: for (i = 0; i < EAPOL_KEY_MIC_LEN; i++)
2444: printf("%02x", key->mic[i]);
2445: printf("\n");
2446: }
2447: #endif
2448:
2449: /*
2450: * Process an incoming EAPOL frame. Notice that we are only interested in
2451: * EAPOL-Key frames with an IEEE 802.11 or WPA1 descriptor type.
2452: */
2453: void
2454: ieee80211_recv_eapol(struct ieee80211com *ic, struct mbuf *m0,
2455: struct ieee80211_node *ni)
2456: {
2457: struct ieee80211_eapol_key *key;
2458: u_int16_t info;
2459:
2460: if (m0->m_len < sizeof(struct ether_header) + sizeof(*key))
2461: goto out;
2462:
2463: m_adj(m0, sizeof(struct ether_header));
2464: key = mtod(m0, struct ieee80211_eapol_key *);
2465:
2466: if (key->type != EAPOL_KEY || key->desc != ni->ni_eapol_desc)
2467: goto out;
2468:
2469: /* check packet body length */
2470: if (m0->m_len < 4 + BE_READ_2(key->len))
2471: goto out;
2472:
2473: /* check key data length */
2474: if (m0->m_len < sizeof(*key) + BE_READ_2(key->paylen))
2475: goto out;
2476:
2477: #ifdef IEEE80211_DEBUG
2478: if (ieee80211_debug > 0)
2479: ieee80211_print_eapol_key(ic, key, ni);
2480: #endif
2481: info = BE_READ_2(key->info);
2482:
2483: if (info & (EAPOL_KEY_KEYMIC | EAPOL_KEY_ENCRYPTED)) {
2484: /* check that we have a valid PTK or TPTK */
2485: if (!ni->ni_ptk_ok)
2486: goto out;
2487:
2488: if (ni->ni_pairwise_cipher == IEEE80211_CIPHER_CCMP &&
2489: (info & EAPOL_KEY_VERSION_MASK) != EAPOL_KEY_DESC_V2)
2490: goto out;
2491:
2492: /* check Key MIC field using KCK */
2493: if ((info & EAPOL_KEY_KEYMIC) &&
2494: ieee80211_eapol_key_check_mic(key, ni->ni_ptk.kck) != 0)
2495: goto out;
2496:
2497: /* decrypt Key Data field using KEK */
2498: if ((info & EAPOL_KEY_ENCRYPTED) &&
2499: ieee80211_eapol_key_decrypt(key, ni->ni_ptk.kek) != 0)
2500: goto out;
2501: }
2502:
2503: /* determine message type (see 8.5.3.7) */
2504: if (info & EAPOL_KEY_REQUEST) {
2505: /* EAPOL-Key Request */
2506: ieee80211_recv_eapol_key_req(ic, key, ni);
2507:
2508: } else if (info & EAPOL_KEY_PAIRWISE) {
2509: /* 4-Way Handshake */
2510: if (info & EAPOL_KEY_KEYMIC) {
2511: if (!(info & EAPOL_KEY_KEYACK)) {
2512: if (info & EAPOL_KEY_SECURE)
2513: ieee80211_recv_4way_msg4(ic, key, ni);
2514: else
2515: ieee80211_recv_4way_msg2(ic, key, ni);
2516: } else
2517: ieee80211_recv_4way_msg3(ic, key, ni);
2518: } else
2519: ieee80211_recv_4way_msg1(ic, key, ni);
2520: } else {
2521: /* Group Key Handshake */
2522: if (!(info & EAPOL_KEY_KEYMIC))
2523: goto out;
2524: if (info & EAPOL_KEY_KEYACK) {
2525: if (key->desc == EAPOL_KEY_DESC_WPA1)
2526: ieee80211_recv_wpa_group_msg1(ic, key, ni);
2527: else
2528: ieee80211_recv_rsn_group_msg1(ic, key, ni);
2529: } else
2530: ieee80211_recv_group_msg2(ic, key, ni);
2531: }
2532: out:
2533: m_freem(m0);
2534: }
2535:
2536: void
2537: ieee80211_recv_pspoll(struct ieee80211com *ic, struct mbuf *m0, int rssi,
2538: u_int32_t rstamp)
2539: {
2540: struct ifnet *ifp = &ic->ic_if;
2541: struct ieee80211_frame *wh;
2542: struct ieee80211_node *ni;
2543: struct mbuf *m;
2544: u_int16_t aid;
2545:
2546: if (ic->ic_set_tim == NULL) /* no powersaving functionality */
2547: return;
2548:
2549: wh = mtod(m0, struct ieee80211_frame *);
2550:
2551: if ((ni = ieee80211_find_node(ic, wh->i_addr2)) == NULL) {
2552: if (ifp->if_flags & IFF_DEBUG)
2553: printf("%s: station %s sent bogus power save poll\n",
2554: ifp->if_xname, ether_sprintf(wh->i_addr2));
2555: return;
2556: }
2557:
2558: memcpy(&aid, wh->i_dur, sizeof(wh->i_dur));
2559: if ((aid & 0xc000) != 0xc000) {
2560: if (ifp->if_flags & IFF_DEBUG)
2561: printf("%s: station %s sent bogus aid %x\n",
2562: ifp->if_xname, ether_sprintf(wh->i_addr2), aid);
2563: return;
2564: }
2565:
2566: if (aid != ni->ni_associd) {
2567: if (ifp->if_flags & IFF_DEBUG)
2568: printf("%s: station %s aid %x doesn't match pspoll "
2569: "aid %x\n", ifp->if_xname,
2570: ether_sprintf(wh->i_addr2), ni->ni_associd, aid);
2571: return;
2572: }
2573:
2574: /* Okay, take the first queued packet and put it out... */
2575:
2576: IF_DEQUEUE(&ni->ni_savedq, m);
2577: if (m == NULL) {
2578: if (ifp->if_flags & IFF_DEBUG)
2579: printf("%s: station %s sent pspoll, "
2580: "but no packets are saved\n",
2581: ifp->if_xname, ether_sprintf(wh->i_addr2));
2582: return;
2583: }
2584: wh = mtod(m, struct ieee80211_frame *);
2585:
2586: /*
2587: * If this is the last packet, turn off the TIM fields.
2588: * If there are more packets, set the more packets bit.
2589: */
2590:
2591: if (IF_IS_EMPTY(&ni->ni_savedq))
2592: (*ic->ic_set_tim)(ic, ni->ni_associd, 0);
2593: else
2594: wh->i_fc[1] |= IEEE80211_FC1_MORE_DATA;
2595:
2596: if (ifp->if_flags & IFF_DEBUG)
2597: printf("%s: enqueued power saving packet for station %s\n",
2598: ifp->if_xname, ether_sprintf(ni->ni_macaddr));
2599:
2600: IF_ENQUEUE(&ic->ic_pwrsaveq, m);
2601: (*ifp->if_start)(ifp);
2602: }
2603:
2604: int
2605: ieee80211_do_slow_print(struct ieee80211com *ic, int *did_print)
2606: {
2607: static const struct timeval merge_print_intvl = {
2608: .tv_sec = 1, .tv_usec = 0
2609: };
2610: if ((ic->ic_if.if_flags & IFF_LINK0) == 0)
2611: return 0;
2612: if (!*did_print && (ic->ic_if.if_flags & IFF_DEBUG) == 0 &&
2613: !ratecheck(&ic->ic_last_merge_print, &merge_print_intvl))
2614: return 0;
2615:
2616: *did_print = 1;
2617: return 1;
2618: }
2619:
2620: /* ieee80211_ibss_merge helps merge 802.11 ad hoc networks. The
2621: * convention, set by the Wireless Ethernet Compatibility Alliance
2622: * (WECA), is that an 802.11 station will change its BSSID to match
2623: * the "oldest" 802.11 ad hoc network, on the same channel, that
2624: * has the station's desired SSID. The "oldest" 802.11 network
2625: * sends beacons with the greatest TSF timestamp.
2626: *
2627: * Return ENETRESET if the BSSID changed, 0 otherwise.
2628: *
2629: * XXX Perhaps we should compensate for the time that elapses
2630: * between the MAC receiving the beacon and the host processing it
2631: * in ieee80211_ibss_merge.
2632: */
2633: int
2634: ieee80211_ibss_merge(struct ieee80211com *ic, struct ieee80211_node *ni,
2635: u_int64_t local_tsft)
2636: {
2637: u_int64_t beacon_tsft;
2638: int did_print = 0, sign;
2639: union {
2640: u_int64_t word;
2641: u_int8_t tstamp[8];
2642: } u;
2643:
2644: /* ensure alignment */
2645: (void)memcpy(&u, &ni->ni_tstamp[0], sizeof(u));
2646: beacon_tsft = letoh64(u.word);
2647:
2648: /* we are faster, let the other guy catch up */
2649: if (beacon_tsft < local_tsft)
2650: sign = -1;
2651: else
2652: sign = 1;
2653:
2654: if (IEEE80211_ADDR_EQ(ni->ni_bssid, ic->ic_bss->ni_bssid)) {
2655: if (!ieee80211_do_slow_print(ic, &did_print))
2656: return 0;
2657: printf("%s: tsft offset %s%llu\n", ic->ic_if.if_xname,
2658: (sign < 0) ? "-" : "",
2659: (sign < 0)
2660: ? (local_tsft - beacon_tsft)
2661: : (beacon_tsft - local_tsft));
2662: return 0;
2663: }
2664:
2665: if (sign < 0)
2666: return 0;
2667:
2668: if (ieee80211_match_bss(ic, ni) != 0)
2669: return 0;
2670:
2671: if (ieee80211_do_slow_print(ic, &did_print)) {
2672: printf("%s: ieee80211_ibss_merge: bssid mismatch %s\n",
2673: ic->ic_if.if_xname, ether_sprintf(ni->ni_bssid));
2674: printf("%s: my tsft %llu beacon tsft %llu\n",
2675: ic->ic_if.if_xname, local_tsft, beacon_tsft);
2676: printf("%s: sync TSF with %s\n",
2677: ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr));
2678: }
2679:
2680: ic->ic_flags &= ~IEEE80211_F_SIBSS;
2681:
2682: /* negotiate rates with new IBSS */
2683: ieee80211_fix_rate(ic, ni, IEEE80211_F_DOFRATE |
2684: IEEE80211_F_DONEGO | IEEE80211_F_DODEL);
2685: if (ni->ni_rates.rs_nrates == 0) {
2686: if (ieee80211_do_slow_print(ic, &did_print)) {
2687: printf("%s: rates mismatch, BSSID %s\n",
2688: ic->ic_if.if_xname, ether_sprintf(ni->ni_bssid));
2689: }
2690: return 0;
2691: }
2692:
2693: if (ieee80211_do_slow_print(ic, &did_print)) {
2694: printf("%s: sync BSSID %s -> ",
2695: ic->ic_if.if_xname, ether_sprintf(ic->ic_bss->ni_bssid));
2696: printf("%s ", ether_sprintf(ni->ni_bssid));
2697: printf("(from %s)\n", ether_sprintf(ni->ni_macaddr));
2698: }
2699:
2700: ieee80211_node_newstate(ni, IEEE80211_STA_BSS);
2701: (*ic->ic_node_copy)(ic, ic->ic_bss, ni);
2702:
2703: return ENETRESET;
2704: }