Annotation of sys/net80211/ieee80211_output.c, Revision 1.1
1.1 ! nbrk 1: /* $OpenBSD: ieee80211_output.c,v 1.55 2007/08/05 21:41:11 claudio Exp $ */
! 2: /* $NetBSD: ieee80211_output.c,v 1.13 2004/05/31 11:02:55 dyoung Exp $ */
! 3:
! 4: /*-
! 5: * Copyright (c) 2001 Atsushi Onoe
! 6: * Copyright (c) 2002, 2003 Sam Leffler, Errno Consulting
! 7: * Copyright (c) 2007 Damien Bergamini
! 8: * All rights reserved.
! 9: *
! 10: * Redistribution and use in source and binary forms, with or without
! 11: * modification, are permitted provided that the following conditions
! 12: * are met:
! 13: * 1. Redistributions of source code must retain the above copyright
! 14: * notice, this list of conditions and the following disclaimer.
! 15: * 2. Redistributions in binary form must reproduce the above copyright
! 16: * notice, this list of conditions and the following disclaimer in the
! 17: * documentation and/or other materials provided with the distribution.
! 18: * 3. The name of the author may not be used to endorse or promote products
! 19: * derived from this software without specific prior written permission.
! 20: *
! 21: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
! 22: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
! 23: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
! 24: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
! 25: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
! 26: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
! 27: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
! 28: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
! 29: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
! 30: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
! 31: */
! 32:
! 33: #include "bpfilter.h"
! 34: #include "vlan.h"
! 35:
! 36: #include <sys/param.h>
! 37: #include <sys/systm.h>
! 38: #include <sys/mbuf.h>
! 39: #include <sys/kernel.h>
! 40: #include <sys/socket.h>
! 41: #include <sys/sockio.h>
! 42: #include <sys/endian.h>
! 43: #include <sys/errno.h>
! 44: #include <sys/proc.h>
! 45: #include <sys/sysctl.h>
! 46:
! 47: #include <net/if.h>
! 48: #include <net/if_dl.h>
! 49: #include <net/if_media.h>
! 50: #include <net/if_arp.h>
! 51: #include <net/if_llc.h>
! 52: #include <net/bpf.h>
! 53:
! 54: #ifdef INET
! 55: #include <netinet/in.h>
! 56: #include <netinet/if_ether.h>
! 57: #include <netinet/in_systm.h>
! 58: #include <netinet/ip.h>
! 59: #endif
! 60:
! 61: #if NVLAN > 0
! 62: #include <net/if_types.h>
! 63: #include <net/if_vlan_var.h>
! 64: #endif
! 65:
! 66: #include <net80211/ieee80211_var.h>
! 67:
! 68: #include <dev/rndvar.h>
! 69:
! 70: enum ieee80211_edca_ac ieee80211_up_to_ac(struct ieee80211com *, int);
! 71: int ieee80211_classify(struct ieee80211com *, struct mbuf *);
! 72: int ieee80211_mgmt_output(struct ifnet *, struct ieee80211_node *,
! 73: struct mbuf *, int);
! 74: u_int8_t *ieee80211_add_rsn_body(u_int8_t *, struct ieee80211com *,
! 75: const struct ieee80211_node *, int);
! 76: struct mbuf *ieee80211_getmbuf(int, int, u_int);
! 77: struct mbuf *ieee80211_get_probe_req(struct ieee80211com *,
! 78: struct ieee80211_node *);
! 79: struct mbuf *ieee80211_get_probe_resp(struct ieee80211com *,
! 80: struct ieee80211_node *);
! 81: struct mbuf *ieee80211_get_auth(struct ieee80211com *,
! 82: struct ieee80211_node *, u_int16_t, u_int16_t);
! 83: struct mbuf *ieee80211_get_deauth(struct ieee80211com *,
! 84: struct ieee80211_node *, u_int16_t);
! 85: struct mbuf *ieee80211_get_assoc_req(struct ieee80211com *,
! 86: struct ieee80211_node *, int);
! 87: struct mbuf *ieee80211_get_assoc_resp(struct ieee80211com *,
! 88: struct ieee80211_node *, u_int16_t);
! 89: struct mbuf *ieee80211_get_disassoc(struct ieee80211com *,
! 90: struct ieee80211_node *, u_int16_t);
! 91: int ieee80211_send_eapol_key(struct ieee80211com *, struct mbuf *,
! 92: struct ieee80211_node *);
! 93: u_int8_t *ieee80211_add_gtk_kde(u_int8_t *, const struct ieee80211_key *);
! 94: u_int8_t *ieee80211_add_pmkid_kde(u_int8_t *, const u_int8_t *);
! 95: struct mbuf *ieee80211_get_eapol_key(int, int, u_int);
! 96:
! 97:
! 98: /*
! 99: * IEEE 802.11 output routine. Normally this will directly call the
! 100: * Ethernet output routine because 802.11 encapsulation is called
! 101: * later by the driver. This function can be used to send raw frames
! 102: * if the mbuf has been tagged with a 802.11 data link type.
! 103: */
! 104: int
! 105: ieee80211_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
! 106: struct rtentry *rt)
! 107: {
! 108: u_int dlt = 0;
! 109: int s, error = 0;
! 110: struct m_tag *mtag;
! 111:
! 112: /* Interface has to be up and running */
! 113: if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) !=
! 114: (IFF_UP | IFF_RUNNING)) {
! 115: error = ENETDOWN;
! 116: goto bad;
! 117: }
! 118:
! 119: /* Try to get the DLT from a mbuf tag */
! 120: if ((mtag = m_tag_find(m, PACKET_TAG_DLT, NULL)) != NULL) {
! 121: dlt = *(u_int *)(mtag + 1);
! 122:
! 123: /* Fallback to ethernet for non-802.11 linktypes */
! 124: if (!(dlt == DLT_IEEE802_11 || dlt == DLT_IEEE802_11_RADIO))
! 125: goto fallback;
! 126:
! 127: /*
! 128: * Queue message on interface without adding any
! 129: * further headers, and start output if interface not
! 130: * yet active.
! 131: */
! 132: s = splnet();
! 133: IFQ_ENQUEUE(&ifp->if_snd, m, NULL, error);
! 134: if (error) {
! 135: /* mbuf is already freed */
! 136: splx(s);
! 137: printf("%s: failed to queue raw tx frame\n",
! 138: ifp->if_xname);
! 139: return (error);
! 140: }
! 141: ifp->if_obytes += m->m_pkthdr.len;
! 142: if (m->m_flags & M_MCAST)
! 143: ifp->if_omcasts++;
! 144: if ((ifp->if_flags & IFF_OACTIVE) == 0)
! 145: (*ifp->if_start)(ifp);
! 146: splx(s);
! 147:
! 148: return (error);
! 149: }
! 150:
! 151: fallback:
! 152: return (ether_output(ifp, m, dst, rt));
! 153:
! 154: bad:
! 155: if (m)
! 156: m_freem(m);
! 157: return (error);
! 158: }
! 159:
! 160: /*
! 161: * Send a management frame to the specified node. The node pointer
! 162: * must have a reference as the pointer will be passed to the driver
! 163: * and potentially held for a long time. If the frame is successfully
! 164: * dispatched to the driver, then it is responsible for freeing the
! 165: * reference (and potentially free'ing up any associated storage).
! 166: */
! 167: int
! 168: ieee80211_mgmt_output(struct ifnet *ifp, struct ieee80211_node *ni,
! 169: struct mbuf *m, int type)
! 170: {
! 171: struct ieee80211com *ic = (void *)ifp;
! 172: struct ieee80211_frame *wh;
! 173:
! 174: if (ni == NULL)
! 175: panic("null node");
! 176: ni->ni_inact = 0;
! 177:
! 178: /*
! 179: * Yech, hack alert! We want to pass the node down to the
! 180: * driver's start routine. We could stick this in an m_tag
! 181: * and tack that on to the mbuf. However that's rather
! 182: * expensive to do for every frame so instead we stuff it in
! 183: * the rcvif field since outbound frames do not (presently)
! 184: * use this.
! 185: */
! 186: M_PREPEND(m, sizeof(struct ieee80211_frame), M_DONTWAIT);
! 187: if (m == NULL)
! 188: return ENOMEM;
! 189: m->m_pkthdr.rcvif = (void *)ni;
! 190:
! 191: wh = mtod(m, struct ieee80211_frame *);
! 192: wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT | type;
! 193: wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
! 194: *(u_int16_t *)&wh->i_dur[0] = 0;
! 195: *(u_int16_t *)&wh->i_seq[0] =
! 196: htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
! 197: ni->ni_txseq++;
! 198: IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_macaddr);
! 199: IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
! 200: IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
! 201:
! 202: if (ifp->if_flags & IFF_DEBUG) {
! 203: /* avoid to print too many frames */
! 204: if (ic->ic_opmode == IEEE80211_M_IBSS ||
! 205: #ifdef IEEE80211_DEBUG
! 206: ieee80211_debug > 1 ||
! 207: #endif
! 208: (type & IEEE80211_FC0_SUBTYPE_MASK) !=
! 209: IEEE80211_FC0_SUBTYPE_PROBE_RESP)
! 210: printf("%s: sending %s to %s on channel %u mode %s\n",
! 211: ifp->if_xname,
! 212: ieee80211_mgt_subtype_name[
! 213: (type & IEEE80211_FC0_SUBTYPE_MASK)
! 214: >> IEEE80211_FC0_SUBTYPE_SHIFT],
! 215: ether_sprintf(ni->ni_macaddr),
! 216: ieee80211_chan2ieee(ic, ni->ni_chan),
! 217: ieee80211_phymode_name[
! 218: ieee80211_chan2mode(ic, ni->ni_chan)]);
! 219: }
! 220:
! 221: IF_ENQUEUE(&ic->ic_mgtq, m);
! 222: ifp->if_timer = 1;
! 223: (*ifp->if_start)(ifp);
! 224: return 0;
! 225: }
! 226:
! 227: /*-
! 228: * EDCA tables are computed using the following formulas:
! 229: *
! 230: * 1) EDCATable (non-AP QSTA)
! 231: *
! 232: * AC CWmin CWmax AIFSN TXOP limit(ms)
! 233: * -------------------------------------------------------------
! 234: * AC_BK aCWmin aCWmax 7 0
! 235: * AC_BE aCWmin aCWmax 3 0
! 236: * AC_VI (aCWmin+1)/2-1 aCWmin 2 agn=3.008 b=6.016 others=0
! 237: * AC_VO (aCWmin+1)/4-1 (aCWmin+1)/2-1 2 agn=1.504 b=3.264 others=0
! 238: *
! 239: * 2) QAPEDCATable (QAP)
! 240: *
! 241: * AC CWmin CWmax AIFSN TXOP limit(ms)
! 242: * -------------------------------------------------------------
! 243: * AC_BK aCWmin aCWmax 7 0
! 244: * AC_BE aCWmin 4*(aCWmin+1)-1 3 0
! 245: * AC_VI (aCWmin+1)/2-1 aCWmin 1 agn=3.008 b=6.016 others=0
! 246: * AC_VO (aCWmin+1)/4-1 (aCWmin+1)/2-1 1 agn=1.504 b=3.264 others=0
! 247: *
! 248: * and the following aCWmin/aCWmax values:
! 249: *
! 250: * PHY aCWmin aCWmax
! 251: * ---------------------------
! 252: * 11A 15 1023
! 253: * 11B 31 1023
! 254: * 11G 15* 1023 (*) aCWmin(1)
! 255: * FH 15 1023
! 256: * Turbo A/G 7 1023 (Atheros proprietary mode)
! 257: */
! 258: static const struct ieee80211_edca_ac_params
! 259: ieee80211_edca_table[IEEE80211_MODE_MAX][EDCA_NUM_AC] = {
! 260: [IEEE80211_MODE_FH] = {
! 261: [EDCA_AC_BK] = { 4, 10, 7, 0 },
! 262: [EDCA_AC_BE] = { 4, 10, 3, 0 },
! 263: [EDCA_AC_VI] = { 3, 4, 2, 0 },
! 264: [EDCA_AC_VO] = { 2, 3, 2, 0 }
! 265: },
! 266: [IEEE80211_MODE_11B] = {
! 267: [EDCA_AC_BK] = { 5, 10, 7, 0 },
! 268: [EDCA_AC_BE] = { 5, 10, 3, 0 },
! 269: [EDCA_AC_VI] = { 4, 5, 2, 188 },
! 270: [EDCA_AC_VO] = { 3, 4, 2, 102 }
! 271: },
! 272: [IEEE80211_MODE_11A] = {
! 273: [EDCA_AC_BK] = { 4, 10, 7, 0 },
! 274: [EDCA_AC_BE] = { 4, 10, 3, 0 },
! 275: [EDCA_AC_VI] = { 3, 4, 2, 94 },
! 276: [EDCA_AC_VO] = { 2, 3, 2, 47 }
! 277: },
! 278: [IEEE80211_MODE_11G] = {
! 279: [EDCA_AC_BK] = { 4, 10, 7, 0 },
! 280: [EDCA_AC_BE] = { 4, 10, 3, 0 },
! 281: [EDCA_AC_VI] = { 3, 4, 2, 94 },
! 282: [EDCA_AC_VO] = { 2, 3, 2, 47 }
! 283: },
! 284: [IEEE80211_MODE_TURBO] = {
! 285: [EDCA_AC_BK] = { 3, 10, 7, 0 },
! 286: [EDCA_AC_BE] = { 3, 10, 2, 0 },
! 287: [EDCA_AC_VI] = { 2, 3, 2, 94 },
! 288: [EDCA_AC_VO] = { 2, 2, 1, 47 }
! 289: }
! 290: };
! 291:
! 292: static const struct ieee80211_edca_ac_params
! 293: ieee80211_qap_edca_table[IEEE80211_MODE_MAX][EDCA_NUM_AC] = {
! 294: [IEEE80211_MODE_FH] = {
! 295: [EDCA_AC_BK] = { 4, 10, 7, 0 },
! 296: [EDCA_AC_BE] = { 4, 6, 3, 0 },
! 297: [EDCA_AC_VI] = { 3, 4, 1, 0 },
! 298: [EDCA_AC_VO] = { 2, 3, 1, 0 }
! 299: },
! 300: [IEEE80211_MODE_11B] = {
! 301: [EDCA_AC_BK] = { 5, 10, 7, 0 },
! 302: [EDCA_AC_BE] = { 5, 7, 3, 0 },
! 303: [EDCA_AC_VI] = { 4, 5, 1, 188 },
! 304: [EDCA_AC_VO] = { 3, 4, 1, 102 }
! 305: },
! 306: [IEEE80211_MODE_11A] = {
! 307: [EDCA_AC_BK] = { 4, 10, 7, 0 },
! 308: [EDCA_AC_BE] = { 4, 6, 3, 0 },
! 309: [EDCA_AC_VI] = { 3, 4, 1, 94 },
! 310: [EDCA_AC_VO] = { 2, 3, 1, 47 }
! 311: },
! 312: [IEEE80211_MODE_11G] = {
! 313: [EDCA_AC_BK] = { 4, 10, 7, 0 },
! 314: [EDCA_AC_BE] = { 4, 6, 3, 0 },
! 315: [EDCA_AC_VI] = { 3, 4, 1, 94 },
! 316: [EDCA_AC_VO] = { 2, 3, 1, 47 }
! 317: },
! 318: [IEEE80211_MODE_TURBO] = {
! 319: [EDCA_AC_BK] = { 3, 10, 7, 0 },
! 320: [EDCA_AC_BE] = { 3, 5, 2, 0 },
! 321: [EDCA_AC_VI] = { 2, 3, 1, 94 },
! 322: [EDCA_AC_VO] = { 2, 2, 1, 47 }
! 323: }
! 324: };
! 325:
! 326: /*
! 327: * Return the EDCA Access Category to be used for transmitting a frame with
! 328: * user-priority `up'.
! 329: */
! 330: enum ieee80211_edca_ac
! 331: ieee80211_up_to_ac(struct ieee80211com *ic, int up)
! 332: {
! 333: /* IEEE Std 802.11e-2005, table 20i */
! 334: static const enum ieee80211_edca_ac up_to_ac[] = {
! 335: EDCA_AC_BE, /* BE */
! 336: EDCA_AC_BK, /* BK */
! 337: EDCA_AC_BK, /* -- */
! 338: EDCA_AC_BE, /* EE */
! 339: EDCA_AC_VI, /* CL */
! 340: EDCA_AC_VI, /* VI */
! 341: EDCA_AC_VO, /* VO */
! 342: EDCA_AC_VO /* NC */
! 343: };
! 344: enum ieee80211_edca_ac ac;
! 345:
! 346: ac = (up <= 7) ? up_to_ac[up] : EDCA_AC_BE;
! 347:
! 348: if (ic->ic_opmode == IEEE80211_M_HOSTAP)
! 349: return ac;
! 350:
! 351: /*
! 352: * We do not support the admission control procedure defined in
! 353: * IEEE Std 802.11e-2005 section 9.9.3.1.2. The spec says that
! 354: * non-AP QSTAs that don't support this procedure shall use EDCA
! 355: * parameters of a lower priority AC that does not require
! 356: * admission control.
! 357: */
! 358: while (ac != EDCA_AC_BK && ic->ic_edca_ac[ac].ac_acm) {
! 359: switch (ac) {
! 360: case EDCA_AC_BK:
! 361: /* can't get there */
! 362: break;
! 363: case EDCA_AC_BE:
! 364: /* BE shouldn't require admission control */
! 365: ac = EDCA_AC_BK;
! 366: break;
! 367: case EDCA_AC_VI:
! 368: ac = EDCA_AC_BE;
! 369: break;
! 370: case EDCA_AC_VO:
! 371: ac = EDCA_AC_VI;
! 372: break;
! 373: }
! 374: }
! 375: return ac;
! 376: }
! 377:
! 378: /*
! 379: * Get mbuf's user-priority: if mbuf is not VLAN tagged, select user-priority
! 380: * based on the DSCP (Differentiated Services Codepoint) field.
! 381: */
! 382: int
! 383: ieee80211_classify(struct ieee80211com *ic, struct mbuf *m)
! 384: {
! 385: #ifdef INET
! 386: const struct ether_header *eh;
! 387: #endif
! 388: #if NVLAN > 0
! 389: if ((m->m_flags & M_PROTO1) == M_PROTO1 && m->m_pkthdr.rcvif != NULL) {
! 390: const struct ifvlan *ifv = m->m_pkthdr.rcvif->if_softc;
! 391:
! 392: /* use VLAN 802.1D user-priority */
! 393: if (ifv->ifv_prio <= 7)
! 394: return ifv->ifv_prio;
! 395: }
! 396: #endif
! 397: #ifdef INET
! 398: eh = mtod(m, struct ether_header *);
! 399: if (eh->ether_type == htons(ETHERTYPE_IP)) {
! 400: const struct ip *ip = (const struct ip *)(eh + 1);
! 401: /*
! 402: * Map Differentiated Services Codepoint field (see RFC2474).
! 403: * Preserves backward compatibility with IP Precedence field.
! 404: */
! 405: switch (ip->ip_tos & 0xfc) {
! 406: case IPTOS_PREC_PRIORITY:
! 407: return 2;
! 408: case IPTOS_PREC_IMMEDIATE:
! 409: return 1;
! 410: case IPTOS_PREC_FLASH:
! 411: return 3;
! 412: case IPTOS_PREC_FLASHOVERRIDE:
! 413: return 4;
! 414: case IPTOS_PREC_CRITIC_ECP:
! 415: return 5;
! 416: case IPTOS_PREC_INTERNETCONTROL:
! 417: return 6;
! 418: case IPTOS_PREC_NETCONTROL:
! 419: return 7;
! 420: }
! 421: }
! 422: #endif
! 423: return 0; /* default to Best-Effort */
! 424: }
! 425:
! 426: /*
! 427: * Encapsulate an outbound data frame. The mbuf chain is updated and
! 428: * a reference to the destination node is returned. If an error is
! 429: * encountered NULL is returned and the node reference will also be NULL.
! 430: *
! 431: * NB: The caller is responsible for free'ing a returned node reference.
! 432: * The convention is ic_bss is not reference counted; the caller must
! 433: * maintain that.
! 434: */
! 435: struct mbuf *
! 436: ieee80211_encap(struct ifnet *ifp, struct mbuf *m, struct ieee80211_node **pni)
! 437: {
! 438: struct ieee80211com *ic = (void *)ifp;
! 439: struct ether_header eh;
! 440: struct ieee80211_frame *wh;
! 441: struct ieee80211_node *ni = NULL;
! 442: struct llc *llc;
! 443: struct m_tag *mtag;
! 444: u_int8_t *addr;
! 445: u_int dlt, hdrlen;
! 446: int addqos, tid;
! 447:
! 448: /* Handle raw frames if mbuf is tagged as 802.11 */
! 449: if ((mtag = m_tag_find(m, PACKET_TAG_DLT, NULL)) != NULL) {
! 450: dlt = *(u_int *)(mtag + 1);
! 451:
! 452: if (!(dlt == DLT_IEEE802_11 || dlt == DLT_IEEE802_11_RADIO))
! 453: goto fallback;
! 454:
! 455: wh = mtod(m, struct ieee80211_frame *);
! 456:
! 457: if (m->m_pkthdr.len < sizeof(struct ieee80211_frame_min))
! 458: goto bad;
! 459:
! 460: if ((wh->i_fc[0] & IEEE80211_FC0_VERSION_MASK) !=
! 461: IEEE80211_FC0_VERSION_0)
! 462: goto bad;
! 463:
! 464: switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
! 465: case IEEE80211_FC1_DIR_NODS:
! 466: case IEEE80211_FC1_DIR_FROMDS:
! 467: addr = wh->i_addr1;
! 468: break;
! 469: case IEEE80211_FC1_DIR_DSTODS:
! 470: case IEEE80211_FC1_DIR_TODS:
! 471: addr = wh->i_addr3;
! 472: break;
! 473: default:
! 474: goto bad;
! 475: }
! 476:
! 477: ni = ieee80211_find_txnode(ic, addr);
! 478: if (ni == NULL)
! 479: ni = ieee80211_ref_node(ic->ic_bss);
! 480: if (ni == NULL) {
! 481: printf("%s: no node for dst %s, "
! 482: "discard raw tx frame\n", ifp->if_xname,
! 483: ether_sprintf(addr));
! 484: ic->ic_stats.is_tx_nonode++;
! 485: goto bad;
! 486: }
! 487: ni->ni_inact = 0;
! 488:
! 489: *pni = ni;
! 490: return (m);
! 491: }
! 492:
! 493: fallback:
! 494: if (m->m_len < sizeof(struct ether_header)) {
! 495: m = m_pullup(m, sizeof(struct ether_header));
! 496: if (m == NULL) {
! 497: ic->ic_stats.is_tx_nombuf++;
! 498: goto bad;
! 499: }
! 500: }
! 501: memcpy(&eh, mtod(m, caddr_t), sizeof(struct ether_header));
! 502:
! 503: ni = ieee80211_find_txnode(ic, eh.ether_dhost);
! 504: if (ni == NULL) {
! 505: IEEE80211_DPRINTF(("%s: no node for dst %s, discard frame\n",
! 506: __func__, ether_sprintf(eh.ether_dhost)));
! 507: ic->ic_stats.is_tx_nonode++;
! 508: goto bad;
! 509: }
! 510: #if 0
! 511: if (!ni->ni_port_valid && eh.ether_type != htons(ETHERTYPE_PAE)) {
! 512: IEEE80211_DPRINTF(("%s: port not valid: %s\n",
! 513: __func__, ether_sprintf(eh.ether_dhost)));
! 514: ic->ic_stats.is_tx_noauth++;
! 515: goto bad;
! 516: }
! 517: #endif
! 518: ni->ni_inact = 0;
! 519:
! 520: if ((ic->ic_flags & IEEE80211_F_QOS) &&
! 521: (ni->ni_flags & IEEE80211_NODE_QOS) &&
! 522: /* do not QoS-encapsulate EAPOL frames */
! 523: eh.ether_type != htons(ETHERTYPE_PAE)) {
! 524: tid = ieee80211_classify(ic, m);
! 525: hdrlen = sizeof(struct ieee80211_qosframe);
! 526: addqos = 1;
! 527: } else {
! 528: hdrlen = sizeof(struct ieee80211_frame);
! 529: addqos = 0;
! 530: }
! 531: m_adj(m, sizeof(struct ether_header) - sizeof(struct llc));
! 532: llc = mtod(m, struct llc *);
! 533: llc->llc_dsap = llc->llc_ssap = LLC_SNAP_LSAP;
! 534: llc->llc_control = LLC_UI;
! 535: llc->llc_snap.org_code[0] = 0;
! 536: llc->llc_snap.org_code[1] = 0;
! 537: llc->llc_snap.org_code[2] = 0;
! 538: llc->llc_snap.ether_type = eh.ether_type;
! 539: M_PREPEND(m, hdrlen, M_DONTWAIT);
! 540: if (m == NULL) {
! 541: ic->ic_stats.is_tx_nombuf++;
! 542: goto bad;
! 543: }
! 544: wh = mtod(m, struct ieee80211_frame *);
! 545: wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_DATA;
! 546: *(u_int16_t *)&wh->i_dur[0] = 0;
! 547: if (addqos) {
! 548: struct ieee80211_qosframe *qwh =
! 549: (struct ieee80211_qosframe *)wh;
! 550: qwh->i_fc[0] |= IEEE80211_FC0_SUBTYPE_QOS;
! 551: qwh->i_qos[0] = tid & IEEE80211_QOS_TID;
! 552: qwh->i_qos[1] = 0; /* no TXOP requested */
! 553: *(u_int16_t *)&qwh->i_seq[0] =
! 554: htole16(ni->ni_qos_txseqs[tid] << IEEE80211_SEQ_SEQ_SHIFT);
! 555: ni->ni_qos_txseqs[tid]++;
! 556: } else {
! 557: *(u_int16_t *)&wh->i_seq[0] =
! 558: htole16(ni->ni_txseq << IEEE80211_SEQ_SEQ_SHIFT);
! 559: ni->ni_txseq++;
! 560: }
! 561: switch (ic->ic_opmode) {
! 562: case IEEE80211_M_STA:
! 563: wh->i_fc[1] = IEEE80211_FC1_DIR_TODS;
! 564: IEEE80211_ADDR_COPY(wh->i_addr1, ni->ni_bssid);
! 565: IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
! 566: IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_dhost);
! 567: break;
! 568: case IEEE80211_M_IBSS:
! 569: case IEEE80211_M_AHDEMO:
! 570: wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
! 571: IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
! 572: IEEE80211_ADDR_COPY(wh->i_addr2, eh.ether_shost);
! 573: IEEE80211_ADDR_COPY(wh->i_addr3, ic->ic_bss->ni_bssid);
! 574: break;
! 575: case IEEE80211_M_HOSTAP:
! 576: wh->i_fc[1] = IEEE80211_FC1_DIR_FROMDS;
! 577: IEEE80211_ADDR_COPY(wh->i_addr1, eh.ether_dhost);
! 578: IEEE80211_ADDR_COPY(wh->i_addr2, ni->ni_bssid);
! 579: IEEE80211_ADDR_COPY(wh->i_addr3, eh.ether_shost);
! 580: break;
! 581: case IEEE80211_M_MONITOR:
! 582: goto bad;
! 583: }
! 584: if (ic->ic_flags & IEEE80211_F_WEPON)
! 585: wh->i_fc[1] |= IEEE80211_FC1_WEP;
! 586: *pni = ni;
! 587: return m;
! 588: bad:
! 589: if (m != NULL)
! 590: m_freem(m);
! 591: if (ni != NULL)
! 592: ieee80211_release_node(ic, ni);
! 593: *pni = NULL;
! 594: return NULL;
! 595: }
! 596:
! 597: /* unaligned little endian access */
! 598: #define LE_WRITE_2(p, v) do { \
! 599: ((u_int8_t *)(p))[0] = (v) & 0xff; \
! 600: ((u_int8_t *)(p))[1] = (v) >> 8; \
! 601: } while (0)
! 602:
! 603: /*
! 604: * Add a Capability Information field to a frame (see 7.3.1.4).
! 605: */
! 606: u_int8_t *
! 607: ieee80211_add_capinfo(u_int8_t *frm, struct ieee80211com *ic,
! 608: const struct ieee80211_node *ni)
! 609: {
! 610: u_int16_t capinfo;
! 611:
! 612: if (ic->ic_opmode == IEEE80211_M_IBSS)
! 613: capinfo = IEEE80211_CAPINFO_IBSS;
! 614: else if (ic->ic_opmode == IEEE80211_M_HOSTAP)
! 615: capinfo = IEEE80211_CAPINFO_ESS;
! 616: else
! 617: capinfo = 0;
! 618: if (ic->ic_flags & IEEE80211_F_WEPON)
! 619: capinfo |= IEEE80211_CAPINFO_PRIVACY;
! 620: /* NB: some 11a AP's reject the request when short preamble is set */
! 621: if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
! 622: IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
! 623: capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
! 624: if (ic->ic_flags & IEEE80211_F_SHSLOT)
! 625: capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
! 626: LE_WRITE_2(frm, capinfo);
! 627: return frm + 2;
! 628: }
! 629:
! 630: /*
! 631: * Add an SSID element to a frame (see 7.3.2.1).
! 632: */
! 633: u_int8_t *
! 634: ieee80211_add_ssid(u_int8_t *frm, const u_int8_t *ssid, u_int len)
! 635: {
! 636: *frm++ = IEEE80211_ELEMID_SSID;
! 637: *frm++ = len;
! 638: memcpy(frm, ssid, len);
! 639: return frm + len;
! 640: }
! 641:
! 642: /*
! 643: * Add a supported rates element to a frame (see 7.3.2.2).
! 644: */
! 645: u_int8_t *
! 646: ieee80211_add_rates(u_int8_t *frm, const struct ieee80211_rateset *rs)
! 647: {
! 648: int nrates;
! 649:
! 650: *frm++ = IEEE80211_ELEMID_RATES;
! 651: nrates = min(rs->rs_nrates, IEEE80211_RATE_SIZE);
! 652: *frm++ = nrates;
! 653: memcpy(frm, rs->rs_rates, nrates);
! 654: return frm + nrates;
! 655: }
! 656:
! 657: /*
! 658: * Add a FH Parameter Set element to a frame (see 7.3.2.3).
! 659: */
! 660: u_int8_t *
! 661: ieee80211_add_fh_params(u_int8_t *frm, struct ieee80211com *ic,
! 662: const struct ieee80211_node *ni)
! 663: {
! 664: u_int chan = ieee80211_chan2ieee(ic, ni->ni_chan);
! 665:
! 666: *frm++ = IEEE80211_ELEMID_FHPARMS;
! 667: *frm++ = 5;
! 668: LE_WRITE_2(frm, ni->ni_fhdwell); frm += 2;
! 669: *frm++ = IEEE80211_FH_CHANSET(chan);
! 670: *frm++ = IEEE80211_FH_CHANPAT(chan);
! 671: *frm++ = ni->ni_fhindex;
! 672: return frm;
! 673: }
! 674:
! 675: /*
! 676: * Add a DS Parameter Set element to a frame (see 7.3.2.4).
! 677: */
! 678: u_int8_t *
! 679: ieee80211_add_ds_params(u_int8_t *frm, struct ieee80211com *ic,
! 680: const struct ieee80211_node *ni)
! 681: {
! 682: *frm++ = IEEE80211_ELEMID_DSPARMS;
! 683: *frm++ = 1;
! 684: *frm++ = ieee80211_chan2ieee(ic, ni->ni_chan);
! 685: return frm;
! 686: }
! 687:
! 688: /*
! 689: * Add a TIM element to a frame (see 7.3.2.6 and Annex L).
! 690: */
! 691: u_int8_t *
! 692: ieee80211_add_tim(u_int8_t *frm, struct ieee80211com *ic)
! 693: {
! 694: u_int i, offset = 0, len;
! 695:
! 696: /* find first non-zero octet in the virtual bit map */
! 697: for (i = 0; i < ic->ic_tim_len && ic->ic_tim_bitmap[i] == 0; i++);
! 698:
! 699: /* clear the lsb as it is reserved for the broadcast indication bit */
! 700: if (i < ic->ic_tim_len)
! 701: offset = i & ~1;
! 702:
! 703: /* find last non-zero octet in the virtual bit map */
! 704: for (i = ic->ic_tim_len - 1; i > 0 && ic->ic_tim_bitmap[i] == 0; i--);
! 705:
! 706: len = i - offset + 1;
! 707:
! 708: *frm++ = IEEE80211_ELEMID_TIM;
! 709: *frm++ = len + 3; /* length */
! 710: *frm++ = ic->ic_dtim_count; /* DTIM count */
! 711: *frm++ = ic->ic_dtim_period; /* DTIM period */
! 712:
! 713: /* Bitmap Control */
! 714: *frm = offset;
! 715: /* set broadcast/multicast indication bit if necessary */
! 716: if (ic->ic_dtim_count == 0 && ic->ic_tim_mcast)
! 717: *frm |= 0x01;
! 718: frm++;
! 719:
! 720: /* Partial Virtual Bitmap */
! 721: memcpy(frm, &ic->ic_tim_bitmap[offset], len);
! 722: return frm + len;
! 723: }
! 724:
! 725: /*
! 726: * Add an IBSS Parameter Set element to a frame (see 7.3.2.7).
! 727: */
! 728: u_int8_t *
! 729: ieee80211_add_ibss_params(u_int8_t *frm, const struct ieee80211_node *ni)
! 730: {
! 731: *frm++ = IEEE80211_ELEMID_IBSSPARMS;
! 732: *frm++ = 2;
! 733: LE_WRITE_2(frm, 0); /* TODO: ATIM window */
! 734: return frm + 2;
! 735: }
! 736:
! 737: /*
! 738: * Add an EDCA Parameter Set element to a frame (see 7.3.2.29).
! 739: */
! 740: u_int8_t *
! 741: ieee80211_add_edca_params(u_int8_t *frm, struct ieee80211com *ic)
! 742: {
! 743: const struct ieee80211_edca_ac_params *edca;
! 744: int aci;
! 745:
! 746: *frm++ = IEEE80211_ELEMID_EDCAPARMS;
! 747: *frm++ = 18; /* length */
! 748: *frm++ = 0; /* QoS Info */
! 749: *frm++ = 0; /* reserved */
! 750:
! 751: /* setup AC Parameter Records */
! 752: edca = ieee80211_qap_edca_table[ic->ic_curmode];
! 753: for (aci = 0; aci < EDCA_NUM_AC; aci++) {
! 754: const struct ieee80211_edca_ac_params *ac = &edca[aci];
! 755:
! 756: *frm++ = (aci << 5) | ((ac->ac_acm & 0x1) << 4) |
! 757: (ac->ac_aifsn & 0xf);
! 758: *frm++ = (ac->ac_ecwmax << 4) |
! 759: (ac->ac_ecwmin & 0xf);
! 760: LE_WRITE_2(frm, ac->ac_txoplimit); frm += 2;
! 761: }
! 762: return frm;
! 763: }
! 764:
! 765: /*
! 766: * Add an ERP element to a frame (see 7.3.2.13).
! 767: */
! 768: u_int8_t *
! 769: ieee80211_add_erp(u_int8_t *frm, struct ieee80211com *ic)
! 770: {
! 771: u_int8_t erp;
! 772:
! 773: *frm++ = IEEE80211_ELEMID_ERP;
! 774: *frm++ = 1;
! 775: erp = 0;
! 776: /*
! 777: * The NonERP_Present bit shall be set to 1 when a NonERP STA
! 778: * is associated with the BSS.
! 779: */
! 780: if (ic->ic_nonerpsta != 0)
! 781: erp |= IEEE80211_ERP_NON_ERP_PRESENT;
! 782: /*
! 783: * If one or more NonERP STAs are associated in the BSS, the
! 784: * Use_Protection bit shall be set to 1 in transmitted ERP
! 785: * Information Elements.
! 786: */
! 787: if (ic->ic_flags & IEEE80211_F_USEPROT)
! 788: erp |= IEEE80211_ERP_USE_PROTECTION;
! 789: /*
! 790: * The Barker_Preamble_Mode bit shall be set to 1 by the ERP
! 791: * Information Element sender if one or more associated NonERP
! 792: * STAs are not short preamble capable.
! 793: */
! 794: if (!(ic->ic_flags & IEEE80211_F_SHPREAMBLE))
! 795: erp |= IEEE80211_ERP_BARKER_MODE;
! 796: *frm++ = erp;
! 797: return frm;
! 798: }
! 799:
! 800: /*
! 801: * Add a QoS Capability element to a frame (see 7.3.2.35).
! 802: */
! 803: u_int8_t *
! 804: ieee80211_add_qos_capability(u_int8_t *frm, struct ieee80211com *ic)
! 805: {
! 806: *frm++ = IEEE80211_ELEMID_QOS_CAP;
! 807: *frm++ = 1;
! 808: *frm++ = 0; /* QoS Info */
! 809: return frm;
! 810: }
! 811:
! 812: /*
! 813: * Add an RSN element to a frame (see 7.3.2.25).
! 814: */
! 815: u_int8_t *
! 816: ieee80211_add_rsn_body(u_int8_t *frm, struct ieee80211com *ic,
! 817: const struct ieee80211_node *ni, int wpa1)
! 818: {
! 819: const u_int8_t *oui = wpa1 ? MICROSOFT_OUI : IEEE80211_OUI;
! 820: u_int8_t *pcount;
! 821: u_int16_t count;
! 822:
! 823: /* write Version field */
! 824: LE_WRITE_2(frm, 1); frm += 2;
! 825:
! 826: /* write Group Cipher Suite field (see Table 20da) */
! 827: memcpy(frm, oui, 3); frm += 3;
! 828: switch (ni->ni_group_cipher) {
! 829: case IEEE80211_CIPHER_USEGROUP:
! 830: /* can't get there */
! 831: panic("invalid group cipher!");
! 832: break;
! 833: case IEEE80211_CIPHER_WEP40:
! 834: *frm++ = 1;
! 835: break;
! 836: case IEEE80211_CIPHER_TKIP:
! 837: *frm++ = 2;
! 838: break;
! 839: case IEEE80211_CIPHER_CCMP:
! 840: *frm++ = 4;
! 841: break;
! 842: case IEEE80211_CIPHER_WEP104:
! 843: *frm++ = 5;
! 844: break;
! 845: }
! 846:
! 847: pcount = frm; frm += 2;
! 848: count = 0;
! 849: /* write Pairwise Cipher Suite List */
! 850: if (ni->ni_pairwise_cipherset & IEEE80211_CIPHER_USEGROUP) {
! 851: memcpy(frm, oui, 3); frm += 3;
! 852: *frm++ = 0;
! 853: count++;
! 854: }
! 855: if (ni->ni_pairwise_cipherset & IEEE80211_CIPHER_TKIP) {
! 856: memcpy(frm, oui, 3); frm += 3;
! 857: *frm++ = 2;
! 858: count++;
! 859: }
! 860: if (ni->ni_pairwise_cipherset & IEEE80211_CIPHER_CCMP) {
! 861: memcpy(frm, oui, 3); frm += 3;
! 862: *frm++ = 4;
! 863: count++;
! 864: }
! 865: /* write Pairwise Cipher Suite Count field */
! 866: LE_WRITE_2(pcount, count);
! 867:
! 868: pcount = frm; frm += 2;
! 869: count = 0;
! 870: /* write AKM Suite List (see Table 20dc) */
! 871: if (ni->ni_akmset & IEEE80211_AKM_IEEE8021X) {
! 872: memcpy(frm, oui, 3); frm += 3;
! 873: *frm++ = 1;
! 874: count++;
! 875: }
! 876: if (ni->ni_akmset & IEEE80211_AKM_PSK) {
! 877: memcpy(frm, oui, 3); frm += 3;
! 878: *frm++ = 2;
! 879: count++;
! 880: }
! 881: /* write AKM Suite List Count field */
! 882: LE_WRITE_2(pcount, count);
! 883:
! 884: /* write RSN Capabilities field */
! 885: LE_WRITE_2(frm, ni->ni_rsncaps); frm += 2;
! 886:
! 887: /* no PMKID List for now */
! 888:
! 889: return frm;
! 890: }
! 891:
! 892: u_int8_t *
! 893: ieee80211_add_rsn(u_int8_t *frm, struct ieee80211com *ic,
! 894: const struct ieee80211_node *ni)
! 895: {
! 896: u_int8_t *plen;
! 897:
! 898: *frm++ = IEEE80211_ELEMID_RSN;
! 899: plen = frm++; /* length filled in later */
! 900: frm = ieee80211_add_rsn_body(frm, ic, ni, 0);
! 901:
! 902: /* write length field */
! 903: *plen = frm - plen - 1;
! 904: return frm;
! 905: }
! 906:
! 907: /*
! 908: * Add a vendor specific WPA1 element to a frame.
! 909: * This is required for compatibility with Wi-Fi Alliance WPA1/WPA1+WPA2.
! 910: */
! 911: u_int8_t *
! 912: ieee80211_add_wpa1(u_int8_t *frm, struct ieee80211com *ic,
! 913: const struct ieee80211_node *ni)
! 914: {
! 915: u_int8_t *plen;
! 916:
! 917: *frm++ = IEEE80211_ELEMID_VENDOR;
! 918: plen = frm++; /* length filled in later */
! 919: memcpy(frm, MICROSOFT_OUI, 3); frm += 3;
! 920: *frm++ = 1; /* WPA1 */
! 921: frm = ieee80211_add_rsn_body(frm, ic, ni, 1);
! 922:
! 923: /* write length field */
! 924: *plen = frm - plen - 1;
! 925: return frm;
! 926: }
! 927:
! 928: /*
! 929: * Add an extended supported rates element to a frame (see 7.3.2.14).
! 930: */
! 931: u_int8_t *
! 932: ieee80211_add_xrates(u_int8_t *frm, const struct ieee80211_rateset *rs)
! 933: {
! 934: int nrates;
! 935:
! 936: KASSERT(rs->rs_nrates > IEEE80211_RATE_SIZE);
! 937:
! 938: *frm++ = IEEE80211_ELEMID_XRATES;
! 939: nrates = rs->rs_nrates - IEEE80211_RATE_SIZE;
! 940: *frm++ = nrates;
! 941: memcpy(frm, rs->rs_rates + IEEE80211_RATE_SIZE, nrates);
! 942: return frm + nrates;
! 943: }
! 944:
! 945: struct mbuf *
! 946: ieee80211_getmbuf(int flags, int type, u_int pktlen)
! 947: {
! 948: struct mbuf *m;
! 949:
! 950: /* account for 802.11 header */
! 951: pktlen += sizeof(struct ieee80211_frame);
! 952:
! 953: if (pktlen > MCLBYTES)
! 954: panic("802.11 packet too large: %u", pktlen);
! 955: MGETHDR(m, flags, type);
! 956: if (m != NULL && pktlen > MHLEN) {
! 957: MCLGET(m, flags);
! 958: if (!(m->m_flags & M_EXT))
! 959: m = m_free(m);
! 960: }
! 961: return m;
! 962: }
! 963:
! 964: /*-
! 965: * Probe request frame format:
! 966: * [tlv] SSID
! 967: * [tlv] Supported rates
! 968: * [tlv] Extended Supported Rates (802.11g)
! 969: */
! 970: struct mbuf *
! 971: ieee80211_get_probe_req(struct ieee80211com *ic, struct ieee80211_node *ni)
! 972: {
! 973: const struct ieee80211_rateset *rs =
! 974: &ic->ic_sup_rates[ieee80211_chan2mode(ic, ni->ni_chan)];
! 975: struct mbuf *m;
! 976: u_int8_t *frm;
! 977:
! 978: m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
! 979: 2 + ic->ic_des_esslen +
! 980: 2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
! 981: ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
! 982: 2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0));
! 983: if (m == NULL)
! 984: return NULL;
! 985:
! 986: m->m_data += sizeof(struct ieee80211_frame);
! 987:
! 988: frm = mtod(m, u_int8_t *);
! 989: frm = ieee80211_add_ssid(frm, ic->ic_des_essid, ic->ic_des_esslen);
! 990: frm = ieee80211_add_rates(frm, rs);
! 991: if (rs->rs_nrates > IEEE80211_RATE_SIZE)
! 992: frm = ieee80211_add_xrates(frm, rs);
! 993:
! 994: m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
! 995:
! 996: return m;
! 997: }
! 998:
! 999: /*-
! 1000: * Probe response frame format:
! 1001: * [8] Timestamp
! 1002: * [2] Beacon interval
! 1003: * [2] Capability
! 1004: * [tlv] Service Set Identifier (SSID)
! 1005: * [tlv] Supported rates
! 1006: * [tlv*] Frequency-Hopping (FH) Parameter Set
! 1007: * [tlv*] DS Parameter Set (802.11g)
! 1008: * [tlv] ERP Information (802.11g)
! 1009: * [tlv] Extended Supported Rates (802.11g)
! 1010: * [tlv] RSN (802.11i)
! 1011: * [tlv] EDCA Parameter Set (802.11e)
! 1012: */
! 1013: struct mbuf *
! 1014: ieee80211_get_probe_resp(struct ieee80211com *ic, struct ieee80211_node *ni)
! 1015: {
! 1016: const struct ieee80211_rateset *rs = &ic->ic_bss->ni_rates;
! 1017: struct mbuf *m;
! 1018: u_int8_t *frm;
! 1019:
! 1020: m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
! 1021: 8 + 2 + 2 +
! 1022: 2 + ni->ni_esslen +
! 1023: 2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
! 1024: 2 + ((ic->ic_phytype == IEEE80211_T_FH) ? 5 : 1) +
! 1025: ((ic->ic_opmode == IEEE80211_M_IBSS) ? 2 + 2 : 0) +
! 1026: ((ic->ic_curmode == IEEE80211_MODE_11G) ? 2 + 1 : 0) +
! 1027: ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
! 1028: 2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
! 1029: ((ic->ic_flags & IEEE80211_F_RSN) ? 2 + 44 : 0) +
! 1030: ((ic->ic_flags & IEEE80211_F_QOS) ? 2 + 18 : 0) +
! 1031: ((ic->ic_flags & IEEE80211_F_WPA1) ? 2 + 48 : 0));
! 1032: if (m == NULL)
! 1033: return NULL;
! 1034:
! 1035: m->m_data += sizeof(struct ieee80211_frame);
! 1036:
! 1037: frm = mtod(m, u_int8_t *);
! 1038: memset(frm, 0, 8); frm += 8; /* timestamp is set by hardware */
! 1039: LE_WRITE_2(frm, ic->ic_bss->ni_intval); frm += 2;
! 1040: frm = ieee80211_add_capinfo(frm, ic, ni);
! 1041: frm = ieee80211_add_ssid(frm, ic->ic_bss->ni_essid,
! 1042: ic->ic_bss->ni_esslen);
! 1043: frm = ieee80211_add_rates(frm, rs);
! 1044: if (ic->ic_phytype == IEEE80211_T_FH)
! 1045: frm = ieee80211_add_fh_params(frm, ic, ni);
! 1046: else
! 1047: frm = ieee80211_add_ds_params(frm, ic, ni);
! 1048: if (ic->ic_opmode == IEEE80211_M_IBSS)
! 1049: frm = ieee80211_add_ibss_params(frm, ni);
! 1050: if (ic->ic_curmode == IEEE80211_MODE_11G)
! 1051: frm = ieee80211_add_erp(frm, ic);
! 1052: if (rs->rs_nrates > IEEE80211_RATE_SIZE)
! 1053: frm = ieee80211_add_xrates(frm, rs);
! 1054: if (ic->ic_flags & IEEE80211_F_RSN)
! 1055: frm = ieee80211_add_rsn(frm, ic, ic->ic_bss);
! 1056: if (ic->ic_flags & IEEE80211_F_QOS)
! 1057: frm = ieee80211_add_edca_params(frm, ic);
! 1058: if (ic->ic_flags & IEEE80211_F_WPA1)
! 1059: frm = ieee80211_add_wpa1(frm, ic, ic->ic_bss);
! 1060:
! 1061: m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
! 1062:
! 1063: return m;
! 1064: }
! 1065:
! 1066: /*-
! 1067: * Authentication frame format:
! 1068: * [2] Authentication algorithm number
! 1069: * [2] Authentication transaction sequence number
! 1070: * [2] Status code
! 1071: */
! 1072: struct mbuf *
! 1073: ieee80211_get_auth(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1074: u_int16_t status, u_int16_t seq)
! 1075: {
! 1076: struct mbuf *m;
! 1077: u_int8_t *frm;
! 1078:
! 1079: MGETHDR(m, M_DONTWAIT, MT_DATA);
! 1080: if (m == NULL)
! 1081: return NULL;
! 1082: MH_ALIGN(m, 2 * 3);
! 1083: m->m_pkthdr.len = m->m_len = 2 * 3;
! 1084:
! 1085: frm = mtod(m, u_int8_t *);
! 1086: LE_WRITE_2(frm, IEEE80211_AUTH_ALG_OPEN); frm += 2;
! 1087: LE_WRITE_2(frm, seq); frm += 2;
! 1088: LE_WRITE_2(frm, status);
! 1089:
! 1090: return m;
! 1091: }
! 1092:
! 1093: /*-
! 1094: * Deauthentication frame format:
! 1095: * [2] Reason code
! 1096: */
! 1097: struct mbuf *
! 1098: ieee80211_get_deauth(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1099: u_int16_t reason)
! 1100: {
! 1101: struct mbuf *m;
! 1102:
! 1103: MGETHDR(m, M_DONTWAIT, MT_DATA);
! 1104: if (m == NULL)
! 1105: return NULL;
! 1106: MH_ALIGN(m, 2);
! 1107:
! 1108: m->m_pkthdr.len = m->m_len = 2;
! 1109: *mtod(m, u_int16_t *) = htole16(reason);
! 1110:
! 1111: return m;
! 1112: }
! 1113:
! 1114: /*-
! 1115: * (Re)Association request frame format:
! 1116: * [2] Capability information
! 1117: * [2] Listen interval
! 1118: * [6*] Current AP address (Reassociation only)
! 1119: * [tlv] SSID
! 1120: * [tlv] Supported rates
! 1121: * [tlv] Extended Supported Rates (802.11g)
! 1122: * [tlv] RSN (802.11i)
! 1123: * [tlv] QoS Capability (802.11e)
! 1124: */
! 1125: struct mbuf *
! 1126: ieee80211_get_assoc_req(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1127: int reassoc)
! 1128: {
! 1129: const struct ieee80211_rateset *rs = &ni->ni_rates;
! 1130: struct mbuf *m;
! 1131: u_int8_t *frm;
! 1132: u_int16_t capinfo;
! 1133:
! 1134: m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
! 1135: 2 + 2 +
! 1136: ((reassoc == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) ?
! 1137: IEEE80211_ADDR_LEN : 0) +
! 1138: 2 + ni->ni_esslen +
! 1139: 2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
! 1140: ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
! 1141: 2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
! 1142: ((ic->ic_flags & IEEE80211_F_RSN) ? 2 + 44 : 0) +
! 1143: ((ic->ic_flags & IEEE80211_F_QOS) ? 2 + 1 : 0) +
! 1144: ((ic->ic_flags & IEEE80211_F_WPA1) ? 2 + 48 : 0));
! 1145: if (m == NULL)
! 1146: return NULL;
! 1147:
! 1148: m->m_data += sizeof(struct ieee80211_frame);
! 1149:
! 1150: frm = mtod(m, u_int8_t *);
! 1151: capinfo = IEEE80211_CAPINFO_ESS;
! 1152: if (ic->ic_flags & IEEE80211_F_WEPON)
! 1153: capinfo |= IEEE80211_CAPINFO_PRIVACY;
! 1154: if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
! 1155: IEEE80211_IS_CHAN_2GHZ(ni->ni_chan))
! 1156: capinfo |= IEEE80211_CAPINFO_SHORT_PREAMBLE;
! 1157: if ((ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_SLOTTIME) &&
! 1158: (ic->ic_flags & IEEE80211_F_SHSLOT))
! 1159: capinfo |= IEEE80211_CAPINFO_SHORT_SLOTTIME;
! 1160: LE_WRITE_2(frm, capinfo); frm += 2;
! 1161: LE_WRITE_2(frm, ic->ic_lintval); frm += 2;
! 1162: if (reassoc == IEEE80211_FC0_SUBTYPE_REASSOC_REQ) {
! 1163: IEEE80211_ADDR_COPY(frm, ic->ic_bss->ni_bssid);
! 1164: frm += IEEE80211_ADDR_LEN;
! 1165: }
! 1166: frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
! 1167: frm = ieee80211_add_rates(frm, rs);
! 1168: if (rs->rs_nrates > IEEE80211_RATE_SIZE)
! 1169: frm = ieee80211_add_xrates(frm, rs);
! 1170: if (ic->ic_flags & IEEE80211_F_RSN)
! 1171: frm = ieee80211_add_rsn(frm, ic, ic->ic_bss);
! 1172: if ((ic->ic_flags & IEEE80211_F_QOS) &&
! 1173: (ni->ni_flags & IEEE80211_NODE_QOS))
! 1174: frm = ieee80211_add_qos_capability(frm, ic);
! 1175: if (ic->ic_flags & IEEE80211_F_WPA1)
! 1176: frm = ieee80211_add_wpa1(frm, ic, ic->ic_bss);
! 1177:
! 1178: m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
! 1179:
! 1180: return m;
! 1181: }
! 1182:
! 1183: /*-
! 1184: * (Re)Association response frame format:
! 1185: * [2] Capability information
! 1186: * [2] Status code
! 1187: * [2] Association ID (AID)
! 1188: * [tlv] Supported rates
! 1189: * [tlv] Extended Supported Rates (802.11g)
! 1190: * [tlv] EDCA Parameter Set (802.11e)
! 1191: */
! 1192: struct mbuf *
! 1193: ieee80211_get_assoc_resp(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1194: u_int16_t status)
! 1195: {
! 1196: const struct ieee80211_rateset *rs = &ni->ni_rates;
! 1197: struct mbuf *m;
! 1198: u_int8_t *frm;
! 1199:
! 1200: m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
! 1201: 2 + 2 + 2 +
! 1202: 2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
! 1203: ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
! 1204: 2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
! 1205: ((ic->ic_flags & IEEE80211_F_QOS) ? 2 + 18 : 0));
! 1206: if (m == NULL)
! 1207: return NULL;
! 1208:
! 1209: m->m_data += sizeof(struct ieee80211_frame);
! 1210:
! 1211: frm = mtod(m, u_int8_t *);
! 1212: frm = ieee80211_add_capinfo(frm, ic, ni);
! 1213: LE_WRITE_2(frm, status); frm += 2;
! 1214: if (status == IEEE80211_STATUS_SUCCESS)
! 1215: LE_WRITE_2(frm, ni->ni_associd);
! 1216: else
! 1217: LE_WRITE_2(frm, 0);
! 1218: frm += 2;
! 1219: frm = ieee80211_add_rates(frm, rs);
! 1220: if (rs->rs_nrates > IEEE80211_RATE_SIZE)
! 1221: frm = ieee80211_add_xrates(frm, rs);
! 1222: if ((ic->ic_flags & IEEE80211_F_QOS) &&
! 1223: (ni->ni_flags & IEEE80211_NODE_QOS))
! 1224: frm = ieee80211_add_edca_params(frm, ic);
! 1225:
! 1226: m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
! 1227:
! 1228: return m;
! 1229: }
! 1230:
! 1231: /*-
! 1232: * Disassociation frame format:
! 1233: * [2] Reason code
! 1234: */
! 1235: struct mbuf *
! 1236: ieee80211_get_disassoc(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1237: u_int16_t reason)
! 1238: {
! 1239: struct mbuf *m;
! 1240:
! 1241: MGETHDR(m, M_DONTWAIT, MT_DATA);
! 1242: if (m == NULL)
! 1243: return NULL;
! 1244: MH_ALIGN(m, 2);
! 1245:
! 1246: m->m_pkthdr.len = m->m_len = 2;
! 1247: *mtod(m, u_int16_t *) = htole16(reason);
! 1248:
! 1249: return m;
! 1250: }
! 1251:
! 1252: /*
! 1253: * Send a management frame. The node is for the destination (or ic_bss
! 1254: * when in station mode). Nodes other than ic_bss have their reference
! 1255: * count bumped to reflect our use for an indeterminant time.
! 1256: */
! 1257: int
! 1258: ieee80211_send_mgmt(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1259: int type, int arg)
! 1260: {
! 1261: #define senderr(_x, _v) do { ic->ic_stats._v++; ret = _x; goto bad; } while (0)
! 1262: struct ifnet *ifp = &ic->ic_if;
! 1263: struct mbuf *m;
! 1264: int ret, timer;
! 1265:
! 1266: if (ni == NULL)
! 1267: panic("null node");
! 1268:
! 1269: /*
! 1270: * Hold a reference on the node so it doesn't go away until after
! 1271: * the xmit is complete all the way in the driver. On error we
! 1272: * will remove our reference.
! 1273: */
! 1274: ieee80211_ref_node(ni);
! 1275: timer = 0;
! 1276: switch (type) {
! 1277: case IEEE80211_FC0_SUBTYPE_PROBE_REQ:
! 1278: if ((m = ieee80211_get_probe_req(ic, ni)) == NULL)
! 1279: senderr(ENOMEM, is_tx_nombuf);
! 1280:
! 1281: timer = IEEE80211_TRANS_WAIT;
! 1282: break;
! 1283:
! 1284: case IEEE80211_FC0_SUBTYPE_PROBE_RESP:
! 1285: if ((m = ieee80211_get_probe_resp(ic, ni)) == NULL)
! 1286: senderr(ENOMEM, is_tx_nombuf);
! 1287: break;
! 1288:
! 1289: case IEEE80211_FC0_SUBTYPE_AUTH:
! 1290: m = ieee80211_get_auth(ic, ni, arg >> 16, arg & 0xffff);
! 1291: if (m == NULL)
! 1292: senderr(ENOMEM, is_tx_nombuf);
! 1293:
! 1294: if (ic->ic_opmode == IEEE80211_M_STA)
! 1295: timer = IEEE80211_TRANS_WAIT;
! 1296: break;
! 1297:
! 1298: case IEEE80211_FC0_SUBTYPE_DEAUTH:
! 1299: if ((m = ieee80211_get_deauth(ic, ni, arg)) == NULL)
! 1300: senderr(ENOMEM, is_tx_nombuf);
! 1301:
! 1302: if (ifp->if_flags & IFF_DEBUG) {
! 1303: printf("%s: station %s deauthenticate (reason %d)\n",
! 1304: ifp->if_xname, ether_sprintf(ni->ni_macaddr), arg);
! 1305: }
! 1306: break;
! 1307:
! 1308: case IEEE80211_FC0_SUBTYPE_ASSOC_REQ:
! 1309: case IEEE80211_FC0_SUBTYPE_REASSOC_REQ:
! 1310: if ((m = ieee80211_get_assoc_req(ic, ni, type)) == NULL)
! 1311: senderr(ENOMEM, is_tx_nombuf);
! 1312:
! 1313: timer = IEEE80211_TRANS_WAIT;
! 1314: break;
! 1315:
! 1316: case IEEE80211_FC0_SUBTYPE_ASSOC_RESP:
! 1317: case IEEE80211_FC0_SUBTYPE_REASSOC_RESP:
! 1318: if ((m = ieee80211_get_assoc_resp(ic, ni, arg)) == NULL)
! 1319: senderr(ENOMEM, is_tx_nombuf);
! 1320: break;
! 1321:
! 1322: case IEEE80211_FC0_SUBTYPE_DISASSOC:
! 1323: if ((m = ieee80211_get_disassoc(ic, ni, arg)) == NULL)
! 1324: senderr(ENOMEM, is_tx_nombuf);
! 1325:
! 1326: if (ifp->if_flags & IFF_DEBUG) {
! 1327: printf("%s: station %s disassociate (reason %d)\n",
! 1328: ifp->if_xname, ether_sprintf(ni->ni_macaddr), arg);
! 1329: }
! 1330: break;
! 1331:
! 1332: default:
! 1333: IEEE80211_DPRINTF(("%s: invalid mgmt frame type %u\n",
! 1334: __func__, type));
! 1335: senderr(EINVAL, is_tx_unknownmgt);
! 1336: /* NOTREACHED */
! 1337: }
! 1338:
! 1339: ret = ieee80211_mgmt_output(ifp, ni, m, type);
! 1340: if (ret == 0) {
! 1341: if (timer)
! 1342: ic->ic_mgt_timer = timer;
! 1343: } else {
! 1344: bad:
! 1345: ieee80211_release_node(ic, ni);
! 1346: }
! 1347: return ret;
! 1348: #undef senderr
! 1349: }
! 1350:
! 1351: /*
! 1352: * Build a RTS (Request To Send) control frame (see 7.2.1.1).
! 1353: */
! 1354: struct mbuf *
! 1355: ieee80211_get_rts(struct ieee80211com *ic, const struct ieee80211_frame *wh,
! 1356: u_int16_t dur)
! 1357: {
! 1358: struct ieee80211_frame_rts *rts;
! 1359: struct mbuf *m;
! 1360:
! 1361: MGETHDR(m, M_DONTWAIT, MT_DATA);
! 1362: if (m == NULL)
! 1363: return NULL;
! 1364:
! 1365: m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_rts);
! 1366:
! 1367: rts = mtod(m, struct ieee80211_frame_rts *);
! 1368: rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
! 1369: IEEE80211_FC0_SUBTYPE_RTS;
! 1370: rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
! 1371: *(u_int16_t *)rts->i_dur = htole16(dur);
! 1372: IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
! 1373: IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
! 1374:
! 1375: return m;
! 1376: }
! 1377:
! 1378: /*
! 1379: * Build a CTS-to-self (Clear To Send) control frame (see 7.2.1.2).
! 1380: */
! 1381: struct mbuf *
! 1382: ieee80211_get_cts_to_self(struct ieee80211com *ic, u_int16_t dur)
! 1383: {
! 1384: struct ieee80211_frame_cts *cts;
! 1385: struct mbuf *m;
! 1386:
! 1387: MGETHDR(m, M_DONTWAIT, MT_DATA);
! 1388: if (m == NULL)
! 1389: return NULL;
! 1390:
! 1391: m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_cts);
! 1392:
! 1393: cts = mtod(m, struct ieee80211_frame_cts *);
! 1394: cts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
! 1395: IEEE80211_FC0_SUBTYPE_CTS;
! 1396: cts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
! 1397: *(u_int16_t *)cts->i_dur = htole16(dur);
! 1398: IEEE80211_ADDR_COPY(cts->i_ra, ic->ic_myaddr);
! 1399:
! 1400: return m;
! 1401: }
! 1402:
! 1403: /*-
! 1404: * Beacon frame format:
! 1405: * [8] Timestamp
! 1406: * [2] Beacon interval
! 1407: * [2] Capability
! 1408: * [tlv] Service Set Identifier (SSID)
! 1409: * [tlv] Supported rates
! 1410: * [tlv*] Frequency-Hopping (FH) Parameter Set
! 1411: * [tlv*] DS Parameter Set (802.11g)
! 1412: * [tlv*] IBSS Parameter Set
! 1413: * [tlv] Traffic Indication Map (TIM)
! 1414: * [tlv] ERP Information (802.11g)
! 1415: * [tlv] Extended Supported Rates (802.11g)
! 1416: * [tlv] RSN (802.11i)
! 1417: * [tlv] EDCA Parameter Set (802.11e)
! 1418: */
! 1419: struct mbuf *
! 1420: ieee80211_beacon_alloc(struct ieee80211com *ic, struct ieee80211_node *ni)
! 1421: {
! 1422: const struct ieee80211_rateset *rs = &ni->ni_rates;
! 1423: struct ieee80211_frame *wh;
! 1424: struct mbuf *m;
! 1425: u_int8_t *frm;
! 1426:
! 1427: m = ieee80211_getmbuf(M_DONTWAIT, MT_DATA,
! 1428: 8 + 2 + 2 +
! 1429: 2 + ((ic->ic_flags & IEEE80211_F_HIDENWID) ? 0 : ni->ni_esslen) +
! 1430: 2 + min(rs->rs_nrates, IEEE80211_RATE_SIZE) +
! 1431: 2 + ((ic->ic_phytype == IEEE80211_T_FH) ? 5 : 1) +
! 1432: 2 + ((ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 254) +
! 1433: ((ic->ic_curmode == IEEE80211_MODE_11G) ? 2 + 1 : 0) +
! 1434: ((rs->rs_nrates > IEEE80211_RATE_SIZE) ?
! 1435: 2 + rs->rs_nrates - IEEE80211_RATE_SIZE : 0) +
! 1436: ((ic->ic_flags & IEEE80211_F_RSN) ? 2 + 44 : 0) +
! 1437: ((ic->ic_flags & IEEE80211_F_QOS) ? 2 + 18 : 0) +
! 1438: ((ic->ic_flags & IEEE80211_F_WPA1) ? 2 + 48 : 0));
! 1439: if (m == NULL)
! 1440: return NULL;
! 1441:
! 1442: wh = mtod(m, struct ieee80211_frame *);
! 1443: wh->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_MGT |
! 1444: IEEE80211_FC0_SUBTYPE_BEACON;
! 1445: wh->i_fc[1] = IEEE80211_FC1_DIR_NODS;
! 1446: *(u_int16_t *)wh->i_dur = 0;
! 1447: IEEE80211_ADDR_COPY(wh->i_addr1, etherbroadcastaddr);
! 1448: IEEE80211_ADDR_COPY(wh->i_addr2, ic->ic_myaddr);
! 1449: IEEE80211_ADDR_COPY(wh->i_addr3, ni->ni_bssid);
! 1450: *(u_int16_t *)wh->i_seq = 0;
! 1451:
! 1452: frm = (u_int8_t *)&wh[1];
! 1453: memset(frm, 0, 8); frm += 8; /* timestamp is set by hardware */
! 1454: LE_WRITE_2(frm, ni->ni_intval); frm += 2;
! 1455: frm = ieee80211_add_capinfo(frm, ic, ni);
! 1456: if (ic->ic_flags & IEEE80211_F_HIDENWID)
! 1457: frm = ieee80211_add_ssid(frm, NULL, 0);
! 1458: else
! 1459: frm = ieee80211_add_ssid(frm, ni->ni_essid, ni->ni_esslen);
! 1460: frm = ieee80211_add_rates(frm, rs);
! 1461: if (ic->ic_phytype == IEEE80211_T_FH)
! 1462: frm = ieee80211_add_fh_params(frm, ic, ni);
! 1463: else
! 1464: frm = ieee80211_add_ds_params(frm, ic, ni);
! 1465: if (ic->ic_opmode == IEEE80211_M_IBSS)
! 1466: frm = ieee80211_add_ibss_params(frm, ni);
! 1467: else
! 1468: frm = ieee80211_add_tim(frm, ic);
! 1469: if (ic->ic_curmode == IEEE80211_MODE_11G)
! 1470: frm = ieee80211_add_erp(frm, ic);
! 1471: if (rs->rs_nrates > IEEE80211_RATE_SIZE)
! 1472: frm = ieee80211_add_xrates(frm, rs);
! 1473: if (ic->ic_flags & IEEE80211_F_RSN)
! 1474: frm = ieee80211_add_rsn(frm, ic, ni);
! 1475: if (ic->ic_flags & IEEE80211_F_QOS)
! 1476: frm = ieee80211_add_edca_params(frm, ic);
! 1477: if (ic->ic_flags & IEEE80211_F_WPA1)
! 1478: frm = ieee80211_add_wpa1(frm, ic, ni);
! 1479:
! 1480: m->m_pkthdr.len = m->m_len = frm - mtod(m, u_int8_t *);
! 1481: m->m_pkthdr.rcvif = (void *)ni;
! 1482:
! 1483: return m;
! 1484: }
! 1485:
! 1486: /* unaligned big endian access */
! 1487: #define BE_READ_2(p) \
! 1488: ((u_int16_t)(p)[0] << 8 | (u_int16_t)(p)[1])
! 1489:
! 1490: #define BE_WRITE_2(p, v) do { \
! 1491: (p)[0] = (v) >> 8; (p)[1] = (v); \
! 1492: } while (0)
! 1493:
! 1494: #define BE_WRITE_8(p, v) do { \
! 1495: (p)[0] = (v) >> 56; (p)[1] = (v) >> 48; \
! 1496: (p)[2] = (v) >> 40; (p)[3] = (v) >> 32; \
! 1497: (p)[4] = (v) >> 24; (p)[5] = (v) >> 16; \
! 1498: (p)[6] = (v) >> 8; (p)[7] = (v); \
! 1499: } while (0)
! 1500:
! 1501: /* unaligned little endian access */
! 1502: #define LE_WRITE_8(p, v) do { \
! 1503: (p)[7] = (v) >> 56; (p)[6] = (v) >> 48; \
! 1504: (p)[5] = (v) >> 40; (p)[4] = (v) >> 32; \
! 1505: (p)[3] = (v) >> 24; (p)[2] = (v) >> 16; \
! 1506: (p)[1] = (v) >> 8; (p)[0] = (v); \
! 1507: } while (0)
! 1508:
! 1509: int
! 1510: ieee80211_send_eapol_key(struct ieee80211com *ic, struct mbuf *m,
! 1511: struct ieee80211_node *ni)
! 1512: {
! 1513: struct ifnet *ifp = &ic->ic_if;
! 1514: struct ether_header *eh;
! 1515: struct ieee80211_eapol_key *key;
! 1516: u_int16_t len, info;
! 1517: int s, error;
! 1518:
! 1519: M_PREPEND(m, sizeof(struct ether_header), M_DONTWAIT);
! 1520: if (m == NULL)
! 1521: return ENOMEM;
! 1522: eh = mtod(m, struct ether_header *);
! 1523: eh->ether_type = htons(ETHERTYPE_PAE);
! 1524: IEEE80211_ADDR_COPY(eh->ether_shost, ic->ic_myaddr);
! 1525: IEEE80211_ADDR_COPY(eh->ether_dhost, ni->ni_macaddr);
! 1526:
! 1527: key = (struct ieee80211_eapol_key *)&eh[1];
! 1528: key->version = EAPOL_VERSION;
! 1529: key->type = EAPOL_KEY;
! 1530: key->desc = ni->ni_eapol_desc;
! 1531:
! 1532: info = BE_READ_2(key->info);
! 1533: /* use V2 descriptor only when pairwise cipher is CCMP */
! 1534: info |= (ni->ni_pairwise_cipher != IEEE80211_CIPHER_CCMP) ?
! 1535: EAPOL_KEY_DESC_V1 : EAPOL_KEY_DESC_V2;
! 1536: BE_WRITE_2(key->info, info);
! 1537:
! 1538: len = m->m_len - sizeof(struct ether_header);
! 1539: BE_WRITE_2(key->paylen, len - sizeof(*key));
! 1540: BE_WRITE_2(key->len, len - 4);
! 1541:
! 1542: KASSERT((info & (EAPOL_KEY_ENCRYPTED | EAPOL_KEY_KEYMIC)) == 0 ||
! 1543: ni->ni_ptk_ok);
! 1544:
! 1545: if (info & EAPOL_KEY_ENCRYPTED)
! 1546: ieee80211_eapol_key_encrypt(ic, key, ni->ni_ptk.kek);
! 1547:
! 1548: if (info & EAPOL_KEY_KEYMIC)
! 1549: ieee80211_eapol_key_mic(key, ni->ni_ptk.kck);
! 1550:
! 1551: s = splnet();
! 1552: IFQ_ENQUEUE(&ifp->if_snd, m, NULL, error);
! 1553: if (error) {
! 1554: splx(s);
! 1555: return error;
! 1556: }
! 1557: ifp->if_obytes += m->m_pkthdr.len;
! 1558: if ((ifp->if_flags & IFF_OACTIVE) == 0)
! 1559: (*ifp->if_start)(ifp);
! 1560: splx(s);
! 1561:
! 1562: return 0;
! 1563: }
! 1564:
! 1565: /*
! 1566: * Add a GTK KDE to an EAPOL-Key frame (see Figure 144).
! 1567: */
! 1568: u_int8_t *
! 1569: ieee80211_add_gtk_kde(u_int8_t *frm, const struct ieee80211_key *k)
! 1570: {
! 1571: KASSERT(k->k_flags & IEEE80211_KEY_GROUP);
! 1572:
! 1573: *frm++ = IEEE80211_ELEMID_VENDOR;
! 1574: *frm++ = 6 + k->k_len;
! 1575: memcpy(frm, IEEE80211_OUI, 3); frm += 3;
! 1576: *frm++ = IEEE80211_KDE_GTK;
! 1577: *frm = k->k_id & 3;
! 1578: if (k->k_flags & IEEE80211_KEY_TX)
! 1579: *frm |= 1 << 2; /* set the Tx bit */
! 1580: frm++;
! 1581: *frm++ = 0; /* reserved */
! 1582: memcpy(frm, k->k_key, k->k_len);
! 1583: return frm + k->k_len;
! 1584: }
! 1585:
! 1586: /*
! 1587: * Add a PMKID KDE to an EAPOL-Key frame (see Figure 146).
! 1588: */
! 1589: u_int8_t *
! 1590: ieee80211_add_pmkid_kde(u_int8_t *frm, const u_int8_t *pmkid)
! 1591: {
! 1592: *frm++ = IEEE80211_ELEMID_VENDOR;
! 1593: *frm++ = 20;
! 1594: memcpy(frm, IEEE80211_OUI, 3); frm += 3;
! 1595: *frm++ = IEEE80211_KDE_PMKID;
! 1596: memcpy(frm, pmkid, IEEE80211_PMKID_LEN);
! 1597: return frm + IEEE80211_PMKID_LEN;
! 1598: }
! 1599:
! 1600: struct mbuf *
! 1601: ieee80211_get_eapol_key(int flags, int type, u_int pktlen)
! 1602: {
! 1603: struct mbuf *m;
! 1604:
! 1605: pktlen += sizeof(struct ether_header) +
! 1606: sizeof(struct ieee80211_eapol_key);
! 1607:
! 1608: if (pktlen > MCLBYTES)
! 1609: panic("EAPOL-Key frame too large: %u", pktlen);
! 1610: MGETHDR(m, flags, type);
! 1611: if (m != NULL && pktlen > MHLEN) {
! 1612: MCLGET(m, flags);
! 1613: if (!(m->m_flags & M_EXT))
! 1614: m = m_free(m);
! 1615: }
! 1616: m->m_data += sizeof(struct ether_header);
! 1617: return m;
! 1618: }
! 1619:
! 1620: /*
! 1621: * 4-Way Handshake Message 1 is sent by the authenticator to the supplicant
! 1622: * (see 8.5.3.1).
! 1623: */
! 1624: int
! 1625: ieee80211_send_4way_msg1(struct ieee80211com *ic, struct ieee80211_node *ni)
! 1626: {
! 1627: struct ieee80211_eapol_key *key;
! 1628: struct mbuf *m;
! 1629: u_int16_t info, keylen;
! 1630: u_int8_t *pmkid;
! 1631: u_int8_t *frm;
! 1632:
! 1633: m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA,
! 1634: (ni->ni_eapol_desc == EAPOL_KEY_DESC_IEEE80211) ? 2 + 20 : 0);
! 1635: if (m == NULL)
! 1636: return ENOMEM;
! 1637: key = mtod(m, struct ieee80211_eapol_key *);
! 1638: memset(key, 0, sizeof(*key));
! 1639:
! 1640: info = EAPOL_KEY_PAIRWISE | EAPOL_KEY_KEYACK;
! 1641: BE_WRITE_2(key->info, info);
! 1642:
! 1643: /* generate a new nonce ANonce */
! 1644: get_random_bytes(ni->ni_nonce, EAPOL_KEY_NONCE_LEN);
! 1645: memcpy(key->nonce, ni->ni_nonce, EAPOL_KEY_NONCE_LEN);
! 1646:
! 1647: keylen = ieee80211_cipher_keylen(ni->ni_pairwise_cipher);
! 1648: BE_WRITE_2(key->keylen, keylen);
! 1649:
! 1650: frm = (u_int8_t *)&key[1];
! 1651: /* WPA1 does not have PMKID KDE */
! 1652: if (ni->ni_eapol_desc == EAPOL_KEY_DESC_IEEE80211) {
! 1653: /* XXX retrieve PMKID from the PMKSA cache */
! 1654: frm = ieee80211_add_pmkid_kde(frm, pmkid);
! 1655: }
! 1656:
! 1657: m->m_pkthdr.len = m->m_len = frm - (u_int8_t *)key;
! 1658:
! 1659: if (ic->ic_if.if_flags & IFF_DEBUG)
! 1660: printf("%s: sending msg %d/%d of the %s handshake to %s\n",
! 1661: ic->ic_if.if_xname, 1, 4, "4-way",
! 1662: ether_sprintf(ni->ni_macaddr));
! 1663:
! 1664: return ieee80211_send_eapol_key(ic, m, ni);
! 1665: }
! 1666:
! 1667: /*
! 1668: * 4-Way Handshake Message 2 is sent by the supplicant to the authenticator
! 1669: * (see 8.5.3.2).
! 1670: */
! 1671: int
! 1672: ieee80211_send_4way_msg2(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1673: const u_int8_t *snonce)
! 1674: {
! 1675: struct ieee80211_eapol_key *key;
! 1676: struct mbuf *m;
! 1677: u_int16_t info;
! 1678: u_int8_t *frm;
! 1679:
! 1680: m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA,
! 1681: 2 + 48);
! 1682: if (m == NULL)
! 1683: return ENOMEM;
! 1684: key = mtod(m, struct ieee80211_eapol_key *);
! 1685: memset(key, 0, sizeof(*key));
! 1686:
! 1687: info = EAPOL_KEY_PAIRWISE | EAPOL_KEY_KEYMIC;
! 1688: BE_WRITE_2(key->info, info);
! 1689:
! 1690: /* copy key replay counter from authenticator */
! 1691: BE_WRITE_8(key->replaycnt, ni->ni_replaycnt);
! 1692:
! 1693: /* copy the supplicant's nonce (SNonce) */
! 1694: memcpy(key->nonce, snonce, EAPOL_KEY_NONCE_LEN);
! 1695:
! 1696: frm = (u_int8_t *)&key[1];
! 1697: /* add the WPA/RSN IE used in the (Re)Association Request */
! 1698: if (ni->ni_eapol_desc == EAPOL_KEY_DESC_WPA1) {
! 1699: u_int16_t keylen;
! 1700: frm = ieee80211_add_wpa1(frm, ic, ni);
! 1701: /* WPA1 sets the key length field here */
! 1702: keylen = ieee80211_cipher_keylen(ni->ni_pairwise_cipher);
! 1703: BE_WRITE_2(key->keylen, keylen);
! 1704: } else /* RSN */
! 1705: frm = ieee80211_add_rsn(frm, ic, ni);
! 1706:
! 1707: m->m_pkthdr.len = m->m_len = frm - (u_int8_t *)key;
! 1708:
! 1709: if (ic->ic_if.if_flags & IFF_DEBUG)
! 1710: printf("%s: sending msg %d/%d of the %s handshake to %s\n",
! 1711: ic->ic_if.if_xname, 2, 4, "4-way",
! 1712: ether_sprintf(ni->ni_macaddr));
! 1713:
! 1714: return ieee80211_send_eapol_key(ic, m, ni);
! 1715: }
! 1716:
! 1717: /*
! 1718: * 4-Way Handshake Message 3 is sent by the authenticator to the supplicant
! 1719: * (see 8.5.3.3).
! 1720: */
! 1721: int
! 1722: ieee80211_send_4way_msg3(struct ieee80211com *ic, struct ieee80211_node *ni)
! 1723: {
! 1724: struct ieee80211_eapol_key *key;
! 1725: struct ieee80211_key *gtk;
! 1726: struct mbuf *m;
! 1727: u_int16_t info, keylen;
! 1728: u_int8_t *frm;
! 1729:
! 1730: m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA,
! 1731: 2 + 48 +
! 1732: ((ni->ni_eapol_desc == EAPOL_KEY_DESC_IEEE80211) ?
! 1733: 2 + 6 + gtk->k_len : 0) +
! 1734: 8);
! 1735: if (m == NULL)
! 1736: return ENOMEM;
! 1737: key = mtod(m, struct ieee80211_eapol_key *);
! 1738: memset(key, 0, sizeof(*key));
! 1739:
! 1740: info = EAPOL_KEY_PAIRWISE | EAPOL_KEY_INSTALL | EAPOL_KEY_KEYACK |
! 1741: EAPOL_KEY_KEYMIC | EAPOL_KEY_SECURE;
! 1742:
! 1743: BE_WRITE_8(key->replaycnt, ni->ni_replaycnt);
! 1744: /* use same nonce as in Message 1 */
! 1745: memcpy(key->nonce, ni->ni_nonce, EAPOL_KEY_NONCE_LEN);
! 1746:
! 1747: keylen = ieee80211_cipher_keylen(ni->ni_pairwise_cipher);
! 1748: BE_WRITE_2(key->keylen, keylen);
! 1749:
! 1750: frm = (u_int8_t *)&key[1];
! 1751: /* add the WPA/RSN IE included in Beacon/Probe Response */
! 1752: if (ni->ni_eapol_desc == EAPOL_KEY_DESC_IEEE80211) {
! 1753: frm = ieee80211_add_rsn(frm, ic, ic->ic_bss);
! 1754: /* RSN: encapsulate the GTK and ask for encryption */
! 1755: frm = ieee80211_add_gtk_kde(frm, gtk);
! 1756: LE_WRITE_8(key->rsc, gtk->k_rsc);
! 1757: info |= EAPOL_KEY_ENCRYPTED;
! 1758: } else /* WPA1 */
! 1759: frm = ieee80211_add_wpa1(frm, ic, ic->ic_bss);
! 1760:
! 1761: /* write the key info field */
! 1762: BE_WRITE_2(key->info, info);
! 1763:
! 1764: m->m_pkthdr.len = m->m_len = frm - (u_int8_t *)key;
! 1765:
! 1766: if (ic->ic_if.if_flags & IFF_DEBUG)
! 1767: printf("%s: sending msg %d/%d of the %s handshake to %s\n",
! 1768: ic->ic_if.if_xname, 3, 4, "4-way",
! 1769: ether_sprintf(ni->ni_macaddr));
! 1770:
! 1771: return ieee80211_send_eapol_key(ic, m, ni);
! 1772: }
! 1773:
! 1774: /*
! 1775: * 4-Way Handshake Message 4 is sent by the supplicant to the authenticator
! 1776: * (see 8.5.3.4).
! 1777: */
! 1778: int
! 1779: ieee80211_send_4way_msg4(struct ieee80211com *ic, struct ieee80211_node *ni)
! 1780: {
! 1781: struct ieee80211_eapol_key *key;
! 1782: struct mbuf *m;
! 1783: u_int16_t info;
! 1784:
! 1785: m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA, 0);
! 1786: if (m == NULL)
! 1787: return ENOMEM;
! 1788: key = mtod(m, struct ieee80211_eapol_key *);
! 1789: memset(key, 0, sizeof(*key));
! 1790:
! 1791: info = EAPOL_KEY_PAIRWISE | EAPOL_KEY_KEYMIC | EAPOL_KEY_SECURE;
! 1792: BE_WRITE_2(key->info, info);
! 1793:
! 1794: /* copy key replay counter from authenticator */
! 1795: BE_WRITE_8(key->replaycnt, ni->ni_replaycnt);
! 1796:
! 1797: if (ni->ni_eapol_desc == EAPOL_KEY_DESC_WPA1) {
! 1798: u_int16_t keylen;
! 1799: /* WPA1 sets the key length field here */
! 1800: keylen = ieee80211_cipher_keylen(ni->ni_pairwise_cipher);
! 1801: BE_WRITE_2(key->keylen, keylen);
! 1802: }
! 1803:
! 1804: /* empty key data field */
! 1805: m->m_pkthdr.len = m->m_len = sizeof(*key);
! 1806:
! 1807: if (ic->ic_if.if_flags & IFF_DEBUG)
! 1808: printf("%s: sending msg %d/%d of the %s handshake to %s\n",
! 1809: ic->ic_if.if_xname, 4, 4, "4-way",
! 1810: ether_sprintf(ni->ni_macaddr));
! 1811:
! 1812: return ieee80211_send_eapol_key(ic, m, ni);
! 1813: }
! 1814:
! 1815: /*
! 1816: * Group Key Handshake Message 1 is sent by the authenticator to the
! 1817: * supplicant (see 8.5.4.1).
! 1818: */
! 1819: int
! 1820: ieee80211_send_group_msg1(struct ieee80211com *ic, struct ieee80211_node *ni)
! 1821: {
! 1822: struct ieee80211_eapol_key *key;
! 1823: struct ieee80211_key *gtk;
! 1824: struct mbuf *m;
! 1825: u_int16_t info;
! 1826: u_int8_t *frm;
! 1827:
! 1828: m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA,
! 1829: ((ni->ni_eapol_desc == EAPOL_KEY_DESC_WPA1) ?
! 1830: gtk->k_len : 2 + 6 + gtk->k_len) +
! 1831: 8);
! 1832: if (m == NULL)
! 1833: return ENOMEM;
! 1834: key = mtod(m, struct ieee80211_eapol_key *);
! 1835: memset(key, 0, sizeof(*key));
! 1836:
! 1837: info = EAPOL_KEY_KEYACK | EAPOL_KEY_KEYMIC | EAPOL_KEY_SECURE |
! 1838: EAPOL_KEY_ENCRYPTED;
! 1839:
! 1840: BE_WRITE_8(key->replaycnt, ni->ni_replaycnt);
! 1841:
! 1842: frm = (u_int8_t *)&key[1];
! 1843: if (ni->ni_eapol_desc == EAPOL_KEY_DESC_WPA1) {
! 1844: /* WPA1 does not have GTK KDE */
! 1845: BE_WRITE_2(key->keylen, gtk->k_len);
! 1846: memcpy(frm, gtk->k_key, gtk->k_len);
! 1847: frm += gtk->k_len;
! 1848: info |= gtk->k_id << EAPOL_KEY_WPA_KID_SHIFT;
! 1849: if (gtk->k_flags & IEEE80211_KEY_TX)
! 1850: info |= EAPOL_KEY_WPA_TX;
! 1851: } else /* RSN */
! 1852: frm = ieee80211_add_gtk_kde(frm, gtk);
! 1853:
! 1854: LE_WRITE_8(key->rsc, gtk->k_rsc);
! 1855:
! 1856: /* write the key info field */
! 1857: BE_WRITE_2(key->info, info);
! 1858:
! 1859: m->m_pkthdr.len = m->m_len = frm - (u_int8_t *)key;
! 1860:
! 1861: if (ic->ic_if.if_flags & IFF_DEBUG)
! 1862: printf("%s: sending msg %d/%d of the %s handshake to %s\n",
! 1863: ic->ic_if.if_xname, 1, 2, "group key",
! 1864: ether_sprintf(ni->ni_macaddr));
! 1865:
! 1866: return ieee80211_send_eapol_key(ic, m, ni);
! 1867: }
! 1868:
! 1869: /*
! 1870: * Group Key Handshake Message 2 is sent by the supplicant to the
! 1871: * authenticator (see 8.5.4.2).
! 1872: */
! 1873: int
! 1874: ieee80211_send_group_msg2(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1875: const struct ieee80211_key *gtk)
! 1876: {
! 1877: struct ieee80211_eapol_key *key;
! 1878: u_int16_t info;
! 1879: struct mbuf *m;
! 1880:
! 1881: m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA, 0);
! 1882: if (m == NULL)
! 1883: return ENOMEM;
! 1884: key = mtod(m, struct ieee80211_eapol_key *);
! 1885: memset(key, 0, sizeof(*key));
! 1886:
! 1887: info = EAPOL_KEY_KEYMIC | EAPOL_KEY_SECURE;
! 1888:
! 1889: /* copy key replay counter from authenticator */
! 1890: BE_WRITE_8(key->replaycnt, ni->ni_replaycnt);
! 1891:
! 1892: if (ni->ni_eapol_desc == EAPOL_KEY_DESC_WPA1) {
! 1893: /* WPA1 sets the key length and key id fields here */
! 1894: BE_WRITE_2(key->keylen, gtk->k_len);
! 1895: info |= (gtk->k_id & 3) << EAPOL_KEY_WPA_KID_SHIFT;
! 1896: }
! 1897:
! 1898: /* write the key info field */
! 1899: BE_WRITE_2(key->info, info);
! 1900:
! 1901: /* empty key data field */
! 1902: m->m_pkthdr.len = m->m_len = sizeof(*key);
! 1903:
! 1904: if (ic->ic_if.if_flags & IFF_DEBUG)
! 1905: printf("%s: sending msg %d/%d of the %s handshake to %s\n",
! 1906: ic->ic_if.if_xname, 2, 2, "group key",
! 1907: ether_sprintf(ni->ni_macaddr));
! 1908:
! 1909: return ieee80211_send_eapol_key(ic, m, ni);
! 1910: }
! 1911:
! 1912: /*
! 1913: * EAPOL-Key Request frames are sent by the supplicant to request that the
! 1914: * authenticator initiate either a 4-Way Handshake or Group Key Handshake
! 1915: * and to report a MIC failure in a TKIP MSDU.
! 1916: */
! 1917: int
! 1918: ieee80211_send_eapol_key_req(struct ieee80211com *ic,
! 1919: struct ieee80211_node *ni, u_int16_t info, u_int64_t tsc)
! 1920: {
! 1921: struct ieee80211_eapol_key *key;
! 1922: struct mbuf *m;
! 1923:
! 1924: m = ieee80211_get_eapol_key(M_DONTWAIT, MT_DATA, 0);
! 1925: if (m == NULL)
! 1926: return ENOMEM;
! 1927: key = mtod(m, struct ieee80211_eapol_key *);
! 1928: memset(key, 0, sizeof(*key));
! 1929:
! 1930: BE_WRITE_2(key->info, info);
! 1931:
! 1932: /* in case of TKIP MIC failure, fill the RSC field */
! 1933: if (info & EAPOL_KEY_ERROR)
! 1934: LE_WRITE_8(key->rsc, tsc);
! 1935:
! 1936: /* use our separate key replay counter for key requests */
! 1937: BE_WRITE_8(key->replaycnt, ic->ic_keyreplaycnt);
! 1938: ic->ic_keyreplaycnt++;
! 1939:
! 1940: if (ic->ic_if.if_flags & IFF_DEBUG)
! 1941: printf("%s: sending EAPOL-Key request to %s\n",
! 1942: ic->ic_if.if_xname, ether_sprintf(ni->ni_macaddr));
! 1943:
! 1944: return ieee80211_send_eapol_key(ic, m, ni);
! 1945: }
! 1946:
! 1947: void
! 1948: ieee80211_pwrsave(struct ieee80211com *ic, struct ieee80211_node *ni,
! 1949: struct mbuf *m)
! 1950: {
! 1951: /* store the new packet on our queue, changing the TIM if necessary */
! 1952: if (IF_IS_EMPTY(&ni->ni_savedq))
! 1953: (*ic->ic_set_tim)(ic, ni->ni_associd, 1);
! 1954:
! 1955: if (ni->ni_savedq.ifq_len >= IEEE80211_PS_MAX_QUEUE) {
! 1956: IF_DROP(&ni->ni_savedq);
! 1957: m_freem(m);
! 1958: if (ic->ic_if.if_flags & IFF_DEBUG)
! 1959: printf("%s: station %s power save queue overflow"
! 1960: " of size %d drops %d\n",
! 1961: ic->ic_if.if_xname,
! 1962: ether_sprintf(ni->ni_macaddr),
! 1963: IEEE80211_PS_MAX_QUEUE,
! 1964: ni->ni_savedq.ifq_drops);
! 1965: } else {
! 1966: /*
! 1967: * Similar to ieee80211_mgmt_output, store the node in
! 1968: * the rcvif field.
! 1969: */
! 1970: IF_ENQUEUE(&ni->ni_savedq, m);
! 1971: m->m_pkthdr.rcvif = (void *)ni;
! 1972: }
! 1973: }
CVSweb
![[BACK]](/icons/back.gif){kind=icon}
Return to ieee80211_output.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / sys / net80211